last executing test programs: 4.420803412s ago: executing program 4 (id=5093): mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x2, 0x31, 0xffffffffffffffff, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000440)={0x3, 0x6, &(0x7f0000000000)=ANY=[@ANYBLOB="b40800000000004173113300000000008510000002000000b7000000000000009500c200000000009500001200000000"], &(0x7f0000000080)='GPL\x00', 0x4, 0xc3, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @sched_cls}, 0x70) 4.307443098s ago: executing program 4 (id=5097): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) socket$alg(0x26, 0x5, 0x0) socket$nl_generic(0x10, 0x3, 0x10) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, 0x0) r2 = socket$unix(0x1, 0x5, 0x0) socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'syzkaller0\x00'}) r3 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$HCIINQUIRY(r3, 0x800448f0, &(0x7f0000000280)={0xffffffffffffffff, 0xfff5, 'H8-', 0x1f, 0x80}) bpf$BPF_BTF_LOAD(0x12, &(0x7f0000001740)={&(0x7f0000000200)=ANY=[@ANYBLOB="9feb01001800000000000000280000002800000005000000000000000200000d000000000300000002000000020000000200000000000000000000050000000000006161007a039b38632a136289ad534caf3647c531521ee1ef6097247a85476401032d87084d5b2410880e2ffb00821b4ff5ca1bcac015a93b2351a0602b2b64835e6ae3fbff1d23e941b04db7a738654d1d337b732cd4752c480988625e11fde55bf0f3f2aa26a45c0ef3103ca05df78b9d59422cc93e45e7e45a6555"], &(0x7f0000001640)=""/182, 0x45, 0xb6, 0x1}, 0x1f) r4 = openat$tun(0xffffffffffffff9c, &(0x7f00000001c0), 0x102, 0x0) close(r4) socket$nl_generic(0x10, 0x3, 0x10) r5 = syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10) sendmsg$netlink(r5, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000002580)=[{&(0x7f0000000180)=ANY=[@ANYBLOB="1400000013000100000000000000000008"], 0x14}], 0x1}, 0x0) ioctl$SIOCSIFHWADDR(r4, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r7, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r6, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000300)=@newqdisc={0x40, 0x24, 0x4ee4e6a52ff56541, 0x70b923, 0x80000, {0x0, 0x0, 0x0, r8, {0x0, 0xd}, {0xb, 0xb}, {0xffe0, 0xb}}, [@qdisc_kind_options=@q_fq={{0x7}, {0x14, 0x2, [@TCA_FQ_FLOW_MAX_RATE={0x8, 0x7, 0x9}, @TCA_FQ_CE_THRESHOLD={0x8, 0xc, 0x9}]}}]}, 0x40}, 0x1, 0x0, 0x0, 0x5c061}, 0x4008000) r9 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r9, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) r11 = socket$packet(0x11, 0x3, 0x300) sendto$packet(r11, &(0x7f00000004c0)="800000800000210ee7decd7a000000", 0xf, 0x40054, &(0x7f00000001c0)={0x11, 0x86dd, r10, 0x1, 0xd8, 0x6, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x43}}, 0x14) sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000740)=ANY=[@ANYBLOB="140000001000010000000000000100000000000a20000000000a01010000000000000000010000000900010073797a300000000068000000090a010400000000000000000100000008000a4000000000200011800e000100636f6e6e6c696d69740000000c00028008000140000000000900010073797a30000000000900020073797a3200000000080005400000001f0c000980080001400037"], 0xb0}}, 0x0) sendmsg$NFT_MSG_GETTABLE(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000001240)={&(0x7f0000000440)=ANY=[@ANYBLOB="20000000010a054b"], 0x20}, 0x1, 0x0, 0x0, 0x1}, 0x4804) 2.970559116s ago: executing program 3 (id=5112): r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000037c0)={0x0, 0x0, &(0x7f0000003780)={&(0x7f00000005c0)=@newtaction={0x8c0, 0x30, 0x12f, 0x4, 0x0, {}, [{0x8ac, 0x1, [@m_police={0x8a8, 0x1, 0x0, 0x0, {{0xb}, {0x87c, 0x2, 0x0, 0x1, [[@TCA_POLICE_RATE={0x404, 0x2, [0x4, 0x0, 0x0, 0xfffffffc, 0x7, 0xfffffe00, 0x0, 0x0, 0x0, 0x0, 0x400, 0x0, 0x3, 0x0, 0x2, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x80, 0x6, 0x0, 0x0, 0x1, 0x3, 0xffff, 0x0, 0x1, 0x10000, 0x0, 0x0, 0x0, 0xfffffffe, 0x0, 0x0, 0x1000000, 0x0, 0x0, 0xfffffffc, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0xc74, 0x0, 0xffffffff, 0x10, 0x0, 0x0, 0x0, 0x0, 0x3, 0x8, 0x0, 0x0, 0x0, 0xfffffffc, 0x20000000, 0x0, 0x0, 0xffffffb5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4006, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xcf, 0x0, 0x0, 0xffffffff, 0x0, 0x0, 0x1000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1000, 0x0, 0xfffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xc00, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0xfff, 0x0, 0x1, 0xfffffffc, 0x0, 0x2, 0x20000000, 0x8000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x20000000, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10001, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000]}, @TCA_POLICE_TBF={0x3c, 0x1, {0x0, 0x0, 0x0, 0x0, 0x10, {0x7, 0x0, 0xba6d, 0x0, 0x0, 0x7}, {0x0, 0x0, 0xb}}}, @TCA_POLICE_RATE64={0xc, 0x8, 0xfffffffffffffff9}], [@TCA_POLICE_RESULT={0x8}, @TCA_POLICE_RESULT={0x8, 0x5, 0xfffffff5}, @TCA_POLICE_RATE64={0xc, 0x8, 0x8000}, @TCA_POLICE_RATE={0x404, 0x2, [0xbdd, 0xe, 0x8, 0x3, 0xfdc7, 0x8, 0x748, 0x40, 0x140, 0x129, 0x4, 0xc3f, 0x6, 0x9, 0x9, 0xae9a, 0x0, 0x1, 0x40, 0xa, 0x76, 0x0, 0x4, 0x9, 0x2, 0xffffffff, 0x1ff, 0x8, 0xc, 0x1, 0x0, 0xd, 0x1, 0x3, 0x6, 0x0, 0x100, 0x9, 0x3, 0x0, 0xe1, 0x200, 0x7, 0x4, 0x2, 0x4, 0x4, 0x4, 0x1, 0x4, 0x3, 0xfffff1a2, 0x6, 0x710, 0x8, 0x4, 0x9, 0x4, 0x6, 0x0, 0x45, 0x5, 0x80, 0x3, 0xfffffff6, 0x7, 0x8000, 0x0, 0x1, 0x1, 0xffff, 0x9, 0x5, 0x4, 0x10, 0x4, 0x5, 0xfffffff9, 0x8, 0x0, 0x1, 0x1, 0x10000, 0x7, 0x6, 0x3, 0x7, 0xd9d, 0x5, 0x2, 0x0, 0x4, 0x4, 0x53, 0x7, 0x81, 0x100, 0x200, 0x3, 0xfb5, 0x56, 0x6, 0x8000, 0x6, 0x9, 0x10001, 0x9, 0x7ff, 0x173f, 0x101, 0x0, 0xb0f, 0x4, 0x10001, 0xd0fe, 0x10001, 0x9, 0x91dc, 0xb, 0x80000001, 0x800, 0x1, 0x6, 0x5, 0x200, 0x8, 0x7f, 0x4, 0x6fb61325, 0x1c, 0x2, 0x800, 0x4, 0x2073, 0x3b2, 0x9, 0x1386, 0xffffff1c, 0x6, 0x4, 0x6, 0x3, 0x6, 0x10, 0x2, 0x5, 0xa00000, 0x36, 0x0, 0x400, 0x3, 0xfffffe01, 0x6, 0xfffffffe, 0xb85, 0x5, 0xffffffff, 0x8, 0x1, 0x1, 0x9, 0x4289, 0x80, 0x5, 0x4, 0x80000001, 0x5, 0x2, 0x10001, 0xf, 0xfffffffc, 0x80, 0x3, 0x8001, 0x343c, 0x3, 0x0, 0x101, 0x5, 0x5, 0x2, 0x1, 0x7, 0x80000000, 0xbd, 0x2, 0x6, 0x2, 0x0, 0x81, 0x0, 0x7, 0xe, 0x3, 0x0, 0x92, 0x0, 0x0, 0x1030, 0xffffff81, 0x5, 0x7fb, 0xffffff94, 0x7, 0x3, 0x1, 0x7fffffff, 0xe, 0x80, 0x7ff, 0x5, 0x5, 0xf65, 0x8000, 0x1, 0x7ff, 0x4, 0x2, 0x6, 0x0, 0x8c, 0x0, 0x3, 0x9af2, 0x3, 0x800, 0x700000, 0x4, 0x1, 0xffff, 0x0, 0x1, 0x100, 0x1, 0xfff, 0x7fffffff, 0x1, 0x1, 0x10000, 0x33, 0x100, 0x4, 0x8, 0x4c, 0xfffffffc, 0x40, 0x0, 0x81, 0x4c, 0x5, 0x30, 0x7, 0x2, 0x9, 0xdae5, 0x6]}, @TCA_POLICE_PEAKRATE64={0xc, 0x9, 0x7}]]}, {0x4}, {0xc, 0xb}, {0xc, 0xa, {0x1}}}}]}]}, 0x8c0}}, 0x0) 2.724630697s ago: executing program 3 (id=5114): socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) sendmmsg$unix(r1, &(0x7f0000003580)=[{{0x0, 0x0, &(0x7f0000000640)=[{&(0x7f0000000380)="a1", 0x1}], 0x1, &(0x7f0000000800)=ANY=[@ANYBLOB="14000000000000000100000001000000", @ANYRES32=r0, @ANYBLOB="0000000014"], 0x30, 0x40400d1}}], 0x1, 0x810) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r2, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000001c0)={{0x14}, [@NFT_MSG_NEWTABLE={0x20, 0x0, 0xa, 0x5, 0x0, 0x0, {0x5, 0x0, 0x2}, [@NFTA_TABLE_NAME={0x9, 0x1, 'syz0\x00'}]}, @NFT_MSG_NEWCHAIN={0x2c, 0x3, 0xa, 0x101, 0x0, 0x0, {0x5}, [@NFTA_CHAIN_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_CHAIN_NAME={0x9, 0x3, 'syz0\x00'}]}, @NFT_MSG_NEWRULE={0x50, 0x6, 0xa, 0x401, 0x0, 0x0, {0x5, 0x0, 0x4}, [@NFTA_RULE_CHAIN_ID={0x8}, @NFTA_RULE_EXPRESSIONS={0x28, 0x4, 0x0, 0x1, [{0x24, 0x1, 0x0, 0x1, @tproxy={{0xb}, @val={0x14, 0x2, 0x0, 0x1, [@NFTA_TPROXY_REG_ADDR={0x8, 0x2, 0x1, 0x0, 0x4}, @NFTA_TPROXY_FAMILY={0x8, 0x1, 0x1, 0x0, 0x8}]}}}]}, @NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}]}], {0x14}}, 0xc4}}, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000002d40)={0xffffffffffffffff, 0xffffffffffffffff}) r5 = gettid() sendmsg$unix(r4, &(0x7f0000000600)={0x0, 0x0, &(0x7f0000000500)=[{&(0x7f0000000640)='Q', 0x1}], 0x1, &(0x7f0000001040)=ANY=[@ANYBLOB="1c000000000000000100000002000000", @ANYRES32=r5, @ANYRES32=0xee01, @ANYRES32=0x0, @ANYBLOB="0000000030000000000000000100000001000000", @ANYRES32=r4, @ANYRES32=r3, @ANYRES32=r3, @ANYRES32=r4, @ANYRES32=r3, @ANYRES32=r4, @ANYRES32=r3, @ANYRES32=r4, @ANYBLOB="1c000000000000000100000402000000", @ANYRES32, @ANYRES32=0xee01, @ANYRES32=0x0, @ANYBLOB="0000000014000000000000000100000001000000", @ANYRES32=r3, @ANYBLOB="0000000018"], 0xa0}, 0x4004881) 2.692606828s ago: executing program 4 (id=5116): socket$nl_route(0x10, 0x3, 0x0) r0 = socket$inet6_sctp(0xa, 0x5, 0x84) setsockopt$inet6_int(r0, 0x29, 0x11, &(0x7f00000029c0), 0x4) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000300), 0x35451d7003000c0b, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000200)={'rose0\x00', 0x112}) ioctl$TUNSETOWNER(r1, 0x400454cc, 0x0) r2 = socket$inet6_sctp(0xa, 0x1, 0x84) socket$inet6_sctp(0xa, 0x1, 0x84) r3 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r3, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000240)=ANY=[@ANYBLOB="fffffedb0b000f592d8458f93d63a329a5"], 0x14}, 0x1, 0x0, 0x0, 0x4800}, 0x8810) close(0x3) r4 = socket$inet6_sctp(0xa, 0x801, 0x84) sendmmsg$inet(r4, &(0x7f0000000d00)=[{{&(0x7f0000000040)={0x2, 0x4e21, @rand_addr=0x64010101}, 0x10, &(0x7f0000000300)=[{&(0x7f0000000080)='e', 0x1}], 0x1}}], 0x1, 0x4000) shutdown(r4, 0x1) setsockopt$inet_sctp6_SCTP_PEER_ADDR_THLDS(r2, 0x84, 0x85, &(0x7f0000000000)={0x0, @in6={{0xa, 0x4e21, 0x4, @empty, 0x4c7}}, 0x67c0}, 0x90) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x2, 0x31, 0xffffffffffffffff, 0x0) r5 = socket$nl_netfilter(0x10, 0x3, 0xc) ioctl$sock_SIOCETHTOOL(r5, 0x8946, &(0x7f0000000f80)={'wlan1\x00', &(0x7f0000000f40)=@ethtool_stats}) ioctl$TUNSETGROUP(r1, 0x400454ce, 0xee01) r6 = socket(0x10, 0x3, 0x0) socketpair$tipc(0x1e, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r9 = socket(0x10, 0x3, 0x0) setsockopt$netlink_NETLINK_TX_RING(r9, 0x10e, 0xc, &(0x7f0000000280)={0xffffffff}, 0x10) sendmsg$nl_generic(r9, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000001380)={0x14, 0x12, 0xa01, 0x70bd2d, 0x0, {0xa}}, 0x14}}, 0x0) recvmsg(r7, &(0x7f0000000500)={&(0x7f0000000040)=@hci, 0x80, &(0x7f0000000100)=[{&(0x7f0000000400)=""/248, 0x60ae0}], 0x318, 0x0, 0xdb0, 0xf5ffffff}, 0x0) sendmsg$tipc(r8, &(0x7f0000000240)={0x0, 0x18, &(0x7f00000000c0), 0x31}, 0x0) setsockopt$netlink_NETLINK_TX_RING(r6, 0x10e, 0xc, &(0x7f0000000040)={0xe4}, 0x10) sendmsg$nl_route(r6, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000140)=ANY=[@ANYBLOB="1c0000004a00010000000000000000000a0080"], 0x1c}}, 0x0) r10 = socket$inet6_udplite(0xa, 0x2, 0x88) setsockopt$inet6_MCAST_LEAVE_GROUP(r10, 0x29, 0x2d, &(0x7f00000000c0)={0x2, {{0xa, 0x4e23, 0x8, @private0, 0x9}}}, 0x88) 2.596174806s ago: executing program 2 (id=5118): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000008c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0) r1 = socket$inet6_udp(0xa, 0x2, 0x0) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_buf(r2, 0x6, 0xd, &(0x7f0000000080)='>', 0x1) setsockopt$inet6_int(r2, 0x29, 0xb, 0x0, 0x3f) getsockopt$inet6_int(r1, 0x29, 0x1a, &(0x7f00000000c0), &(0x7f0000000100)=0x4) sendmsg$NFT_BATCH(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000040)=ANY=[], 0x80}}, 0x80) 2.578917958s ago: executing program 3 (id=5120): mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x2, 0x31, 0xffffffffffffffff, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000440)={0x3, 0x6, &(0x7f0000000000)=ANY=[@ANYBLOB="b4080000000000ffa0113300000000008510000002000000b7000000000000009500c200000000009500001200000000"], &(0x7f0000000080)='GPL\x00', 0x4, 0xc3, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @sched_cls}, 0x70) 2.520623096s ago: executing program 1 (id=5121): openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='devices.list\x00', 0x275a, 0x0) socket$nl_generic(0x10, 0x3, 0x10) socket$netlink(0x10, 0x3, 0x0) socket$nl_generic(0x10, 0x3, 0x10) socket$nl_generic(0x10, 0x3, 0x10) close(0xffffffffffffffff) r0 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f00000000c0), 0x48) bpf$PROG_LOAD_XDP(0x5, &(0x7f00000004c0)={0x12, 0x4, &(0x7f0000000000)=ANY=[@ANYBLOB="18000000000000000000000000000000730109000000000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x1e}, 0x94) bpf$MAP_LOOKUP_ELEM(0x5, &(0x7f00000000c0)={r0, &(0x7f0000000000), &(0x7f0000000040)=""/73}, 0x70) socket(0x10, 0x80002, 0x0) socket$rxrpc(0x21, 0x2, 0xa) bpf$PROG_LOAD(0x5, &(0x7f0000000440)={0x13, 0x4, &(0x7f0000000740)=ANY=[@ANYBLOB="1800000000000004000000000020000061107d000000000095"], &(0x7f0000000100)='syzkaller\x00', 0x8, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x22, 0xffffffffffffffff, 0xf00, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) socketpair(0x1, 0x5, 0x0, &(0x7f0000000000)) socket$nl_generic(0x10, 0x3, 0x10) openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0xc1842, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x0, 0x4, &(0x7f0000000000)=@framed={{0x18, 0x2, 0x0, 0x0, 0xfffffffd, 0x0, 0x0, 0x0, 0x9}, [@call={0x85, 0x0, 0x0, 0xb4}]}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x40, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x9}, 0x94) r1 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f00000000c0), 0x48) bpf$MAP_LOOKUP_ELEM(0x5, &(0x7f00000000c0)={r1, &(0x7f0000000000), &(0x7f0000000040)=""/73}, 0x70) 2.395949948s ago: executing program 2 (id=5122): sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000180)={{0x14, 0x10, 0x9000, 0x6, 0x0, {0x3}}, [@NFT_MSG_NEWSET={0x38, 0x9, 0xa, 0x201, 0x0, 0x0, {0x0, 0x0, 0x5}, [@NFTA_SET_ID={0x8}, @NFTA_SET_NAME={0x9, 0x2, 'syz1\x00'}, @NFTA_SET_KEY_LEN={0x8}, @NFTA_SET_ID={0x8, 0xa, 0x1, 0x0, 0x3}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x0, 0x84}}}, 0x60}, 0x1, 0x0, 0x0, 0x8805}, 0x810) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000300)=@bpf_lsm={0xc, 0x4, &(0x7f0000000040)=@framed={{0x66, 0xa, 0x0, 0x0, 0x0, 0x61, 0x11, 0x4c}, [@call={0x85, 0x0, 0x0, 0x28}]}, &(0x7f0000000180)='GPL\x00', 0x0, 0x0, 0x0, 0x41100, 0x8}, 0x94) sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000100)=ANY=[@ANYBLOB="1400000010000100000000000000000000fc000a20000000000a09000000000000000000070000000900010073797a30000000004c000000090a010400000000000000000700000008000a40000000000900020073797a31000000000900010073797a3000000000080005400000001c08000640ffffff000800034000000028580000000c0a01010000000000000000070000000900020073797a31000000000900010073797a30000000002c0003802800008008000340000000021c00028018000280080001"], 0xec}}, 0x0) 2.39277468s ago: executing program 3 (id=5123): socket$packet(0x11, 0x3, 0x300) r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000400)={0x3, 0xc, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41100}, 0x94) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$nbd(&(0x7f00000000c0), r1) sendmsg$NBD_CMD_CONNECT(r1, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000003c0)=ANY=[@ANYBLOB='h\x00\x00\x00', @ANYRES16=r2, @ANYBLOB="010000000000000000000100000008000100400000000c000200700f0000000000000c00060003000000000000000a000a00272d5d29212b0000140007"], 0x6c}}, 0x0) setsockopt$inet6_tcp_TLS_TX(0xffffffffffffffff, 0x11a, 0x1, 0x0, 0x0) socketpair$tipc(0x1e, 0x2, 0x0, &(0x7f0000000240)={0xffffffffffffffff}) r4 = socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_UMEM_REG(r4, 0x11b, 0x4, &(0x7f00000000c0)={&(0x7f0000000000)=""/74, 0x328000, 0x1000}, 0x1c) setsockopt$XDP_UMEM_COMPLETION_RING(r4, 0x11b, 0x6, &(0x7f0000000080)=0x1, 0x4) r5 = bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000280)=@bpf_lsm={0x6, 0x3, &(0x7f00000003c0)=ANY=[@ANYBLOB="18000000003f000000000000000000f195"], &(0x7f0000000140)='GPL\x00'}, 0x80) bpf$BPF_PROG_TEST_RUN(0x1c, &(0x7f0000000240)={r5, 0x8, 0x25, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x40) r6 = bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000280)=@bpf_lsm={0x6, 0x3, &(0x7f00000003c0)=ANY=[], &(0x7f0000000140)='GPL\x00'}, 0x94) r7 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX(r7, 0x8933, &(0x7f00000002c0)={'bridge_slave_0\x00', 0x0}) r9 = socket(0x10, 0x80002, 0x0) sendmsg$nl_route(r9, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000280)=ANY=[@ANYBLOB="440000001100a7cc4a372eaf541d002007000000", @ANYRES32=r8], 0x44}, 0x1, 0x0, 0x0, 0x895}, 0x2000000) sendmsg$TEAM_CMD_OPTIONS_SET(0xffffffffffffffff, &(0x7f0000000840)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000000800)={&(0x7f0000000600)={0x1d0, 0x0, 0x200, 0x70bd27, 0x25dfdbfd, {}, [{{0x8}, {0x3c, 0x2, 0x0, 0x1, [{0x38, 0x1, @activeport={{0x24}, {0x5}, {0x8}}}]}}, {{0x8}, {0x170, 0x2, 0x0, 0x1, [{0x40, 0x1, @lb_tx_hash_to_port_mapping={{{0x24}, {0x5}, {0x8}}, {0x8}}}, {0x38, 0x1, @notify_peers_count={{0x24}, {0x5}, {0x8, 0x4, 0x3}}}, {0x3c, 0x1, @enabled={{{0x24}, {0x5}, {0x4}}, {0x8}}}, {0x3c, 0x1, @user_linkup_enabled={{{0x24}, {0x5}, {0x4}}, {0x8, 0x6, r8}}}, {0x40, 0x1, @priority={{{0x24}, {0x5}, {0x8, 0x4, 0x28}}, {0x8}}}, {0x3c, 0x1, @lb_tx_method={{0x24}, {0x5}, {0x9, 0x4, 'hash\x00'}}}]}}]}, 0x1d0}, 0x1, 0x0, 0x0, 0x4}, 0x40000) bpf$BPF_PROG_TEST_RUN(0x1c, &(0x7f0000000240)={r6, 0x8, 0x25, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x40) r10 = socket$inet6_udplite(0xa, 0x2, 0x88) setsockopt$XDP_RX_RING(r4, 0x11b, 0x2, &(0x7f0000001980)=0x100, 0x4) setsockopt$XDP_UMEM_FILL_RING(r4, 0x11b, 0x5, &(0x7f0000000340)=0x8000, 0x4) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r10, 0x8933, &(0x7f0000000400)={'batadv_slave_1\x00', 0x0}) bind$xdp(r4, &(0x7f0000000100)={0x2c, 0x0, r11}, 0x10) r12 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="1b0000000000000000000000000004"], 0x48) bpf$PROG_LOAD(0x5, &(0x7f0000000500)={0x11, 0xf, &(0x7f0000000340)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r12, @ANYBLOB="0000000000000000b702000014000000b7030000000000008500000083000000bf0900000000000055090100000000009500000800000000bf91000000000000b702000043e7b5538500000085000000b70000000000000095"], &(0x7f0000000080)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0xe, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) ppoll(&(0x7f00000010c0)=[{r12, 0x2000}, {r4, 0xf748}, {r0, 0x400}, {0xffffffffffffffff, 0xc4c4}], 0x4, 0x0, 0x0, 0x0) pselect6(0x40, &(0x7f00000001c0)={0x0, 0x7fffffff, 0x7, 0x4, 0x1000000, 0x800, 0x8, 0x4}, 0x0, &(0x7f00000002c0)={0x3ff, 0x0, 0x1, 0x8, 0x3f9a, 0x0, 0x8000000010001, 0x3}, 0x0, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x8031, 0xffffffffffffffff, 0x0) close(r3) 2.37632178s ago: executing program 1 (id=5124): r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000037c0)={0x0, 0x0, &(0x7f0000003780)={&(0x7f00000005c0)=@newtaction={0x8c0, 0x30, 0x12f, 0x4, 0x0, {}, [{0x8ac, 0x1, [@m_police={0x8a8, 0x1, 0x0, 0x0, {{0xb}, {0x87c, 0x2, 0x0, 0x1, [[@TCA_POLICE_RATE={0x404, 0x2, [0x4, 0x0, 0x0, 0xfffffffc, 0x7, 0xfffffe00, 0x0, 0x0, 0x0, 0x0, 0x400, 0x0, 0x3, 0x0, 0x2, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x80, 0x6, 0x0, 0x0, 0x1, 0x3, 0xffff, 0x0, 0x1, 0x10000, 0x0, 0x0, 0x0, 0xfffffffe, 0x0, 0x0, 0x1000000, 0x0, 0x0, 0xfffffffc, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0xc74, 0x0, 0xffffffff, 0x10, 0x0, 0x0, 0x0, 0x0, 0x3, 0x8, 0x0, 0x0, 0x0, 0xfffffffc, 0x40000000, 0x0, 0x0, 0xffffffb5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4006, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xcf, 0x0, 0x0, 0xffffffff, 0x0, 0x0, 0x1000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1000, 0x0, 0xfffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xc00, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0xfff, 0x0, 0x1, 0xfffffffc, 0x0, 0x2, 0x20000000, 0x8000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x20000000, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10001, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000]}, @TCA_POLICE_TBF={0x3c, 0x1, {0x0, 0x0, 0x0, 0x0, 0x10, {0x7, 0x0, 0xba6d, 0x0, 0x0, 0x7}, {0x0, 0x0, 0xb}}}, @TCA_POLICE_RATE64={0xc, 0x8, 0xfffffffffffffff9}], [@TCA_POLICE_RESULT={0x8}, @TCA_POLICE_RESULT={0x8, 0x5, 0xfffffff5}, @TCA_POLICE_RATE64={0xc, 0x8, 0x8000}, @TCA_POLICE_RATE={0x404, 0x2, [0xbdd, 0xe, 0x8, 0x3, 0xfdc7, 0x8, 0x748, 0x40, 0x140, 0x129, 0x4, 0xc3f, 0x6, 0x9, 0x9, 0xae9a, 0x0, 0x1, 0x40, 0xa, 0x76, 0x0, 0x4, 0x9, 0x2, 0xffffffff, 0x1ff, 0x8, 0xc, 0x1, 0x0, 0xd, 0x1, 0x3, 0x6, 0x0, 0x100, 0x9, 0x3, 0x0, 0xe1, 0x200, 0x7, 0x4, 0x2, 0x4, 0x4, 0x4, 0x1, 0x4, 0x3, 0xfffff1a2, 0x6, 0x710, 0x8, 0x4, 0x9, 0x4, 0x6, 0x0, 0x45, 0x5, 0x80, 0x3, 0xfffffff6, 0x7, 0x8000, 0x0, 0x1, 0x1, 0xffff, 0x9, 0x5, 0x4, 0x10, 0x4, 0x5, 0xfffffff9, 0x8, 0x0, 0x1, 0x1, 0x10000, 0x7, 0x6, 0x3, 0x7, 0xd9d, 0x5, 0x2, 0x0, 0x4, 0x4, 0x53, 0x7, 0x81, 0x100, 0x200, 0x3, 0xfb5, 0x56, 0x6, 0x8000, 0x6, 0x9, 0x10001, 0x9, 0x7ff, 0x173f, 0x101, 0x0, 0xb0f, 0x4, 0x10001, 0xd0fe, 0x10001, 0x9, 0x91dc, 0xb, 0x80000001, 0x800, 0x1, 0x6, 0x5, 0x200, 0x8, 0x7f, 0x4, 0x6fb61325, 0x1c, 0x2, 0x800, 0x4, 0x2073, 0x3b2, 0x9, 0x1386, 0xffffff1c, 0x6, 0x4, 0x6, 0x3, 0x6, 0x10, 0x2, 0x5, 0xa00000, 0x36, 0x0, 0x400, 0x3, 0xfffffe01, 0x6, 0xfffffffe, 0xb85, 0x5, 0xffffffff, 0x8, 0x1, 0x1, 0x9, 0x4289, 0x80, 0x5, 0x4, 0x80000001, 0x5, 0x2, 0x10001, 0xf, 0xfffffffc, 0x80, 0x3, 0x8001, 0x343c, 0x3, 0x0, 0x101, 0x5, 0x5, 0x2, 0x1, 0x7, 0x80000000, 0xbd, 0x2, 0x6, 0x2, 0x0, 0x81, 0x0, 0x7, 0xe, 0x3, 0x0, 0x92, 0x0, 0x0, 0x1030, 0xffffff81, 0x5, 0x7fb, 0xffffff94, 0x7, 0x3, 0x1, 0x7fffffff, 0xe, 0x80, 0x7ff, 0x5, 0x5, 0xf65, 0x8000, 0x1, 0x7ff, 0x4, 0x2, 0x6, 0x0, 0x8c, 0x0, 0x3, 0x9af2, 0x3, 0x800, 0x700000, 0x4, 0x1, 0xffff, 0x0, 0x1, 0x100, 0x1, 0xfff, 0x7fffffff, 0x1, 0x1, 0x10000, 0x33, 0x100, 0x4, 0x8, 0x4c, 0xfffffffc, 0x40, 0x0, 0x81, 0x4c, 0x5, 0x30, 0x7, 0x2, 0x9, 0xdae5, 0x6]}, @TCA_POLICE_PEAKRATE64={0xc, 0x9, 0x7}]]}, {0x4}, {0xc, 0xb}, {0xc, 0xa, {0x1}}}}]}]}, 0x8c0}}, 0x0) 2.252460523s ago: executing program 2 (id=5126): mmap(&(0x7f0000001000/0xc00000)=nil, 0xc00000, 0x0, 0x3032, 0xffffffffffffffff, 0x0) r0 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000340)=ANY=[@ANYBLOB="02000000040000000800000001"], 0x48) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000400)={0x11, 0x10, &(0x7f0000000000)=ANY=[@ANYBLOB="18000000000000000000000000000000b7080000000000007b8af8f500000000b7080000000000007b8af0ff00000000bf8100000000000007080000f8ffffffbfa400000000000007040000f0ffffffb70200000800000018210000", @ANYRES32=r0, @ANYBLOB="0000000002000000b705000008000000850000005d00000095"], &(0x7f00000002c0)='syzkaller\x00', 0x4, 0x1002, &(0x7f00000014c0)=""/4098, 0x0, 0x2}, 0x94) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket$qrtr(0x2a, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000080)={'bond0\x00', 0x0}) sendmsg$nl_route(r1, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000580)={&(0x7f00000000c0)=ANY=[@ANYBLOB="780000001000030400000000fcdbdf2500000400", @ANYRES32=0x0, @ANYBLOB="00030000000000005000128009000100766c616e00000000400002800600010002000000340004800c0039004ef1f011ffffffff0c0001000300000000feffff0c00010005000000f7ffffff0c004100080000000000000008000500", @ANYRES32=r3], 0x78}}, 0x0) mmap(&(0x7f0000001000/0xc00000)=nil, 0xc00000, 0x0, 0x3032, 0xffffffffffffffff, 0x0) (async) bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000340)=ANY=[@ANYBLOB="02000000040000000800000001"], 0x48) (async) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000400)={0x11, 0x10, &(0x7f0000000000)=ANY=[@ANYBLOB="18000000000000000000000000000000b7080000000000007b8af8f500000000b7080000000000007b8af0ff00000000bf8100000000000007080000f8ffffffbfa400000000000007040000f0ffffffb70200000800000018210000", @ANYRES32=r0, @ANYBLOB="0000000002000000b705000008000000850000005d00000095"], &(0x7f00000002c0)='syzkaller\x00', 0x4, 0x1002, &(0x7f00000014c0)=""/4098, 0x0, 0x2}, 0x94) (async) socket$nl_route(0x10, 0x3, 0x0) (async) socket$qrtr(0x2a, 0x2, 0x0) (async) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000080)={'bond0\x00'}) (async) sendmsg$nl_route(r1, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000580)={&(0x7f00000000c0)=ANY=[@ANYBLOB="780000001000030400000000fcdbdf2500000400", @ANYRES32=0x0, @ANYBLOB="00030000000000005000128009000100766c616e00000000400002800600010002000000340004800c0039004ef1f011ffffffff0c0001000300000000feffff0c00010005000000f7ffffff0c004100080000000000000008000500", @ANYRES32=r3], 0x78}}, 0x0) (async) 2.251549814s ago: executing program 1 (id=5127): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) socket$alg(0x26, 0x5, 0x0) socket$nl_generic(0x10, 0x3, 0x10) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, 0x0) r2 = socket$unix(0x1, 0x5, 0x0) socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'syzkaller0\x00'}) r3 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$HCIINQUIRY(r3, 0x800448f0, &(0x7f0000000280)={0xffffffffffffffff, 0xfff5, 'H8-', 0x1f, 0x80}) bpf$BPF_BTF_LOAD(0x12, &(0x7f0000001740)={&(0x7f0000000200)=ANY=[@ANYBLOB="9feb01001800000000000000280000002800000005000000000000000200000d000000000300000002000000020000000200000000000000000000050000000000006161007a039b38632a136289ad534caf3647c531521ee1ef6097247a85476401032d87084d5b2410880e2ffb00821b4ff5ca1bcac015a93b2351a0602b2b64835e6ae3fbff1d23e941b04db7a738654d1d337b732cd4752c480988625e11fde55bf0f3f2aa26a45c0ef3103ca05df78b9d59422cc93e45e7e45a6555"], &(0x7f0000001640)=""/182, 0x45, 0xb6, 0x1}, 0x1f) r4 = openat$tun(0xffffffffffffff9c, &(0x7f00000001c0), 0x102, 0x0) close(r4) socket$nl_generic(0x10, 0x3, 0x10) r5 = syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10) sendmsg$netlink(r5, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000002580)=[{&(0x7f0000000180)=ANY=[@ANYBLOB="1400000013000100000000000000000008"], 0x14}], 0x1}, 0x0) ioctl$SIOCSIFHWADDR(r4, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r7, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r6, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000300)=@newqdisc={0x40, 0x24, 0x4ee4e6a52ff56541, 0x70b923, 0x80000, {0x0, 0x0, 0x0, r8, {0x0, 0xd}, {0xb, 0xb}, {0xffe0, 0xb}}, [@qdisc_kind_options=@q_fq={{0x7}, {0x14, 0x2, [@TCA_FQ_FLOW_MAX_RATE={0x8, 0x7, 0x9}, @TCA_FQ_CE_THRESHOLD={0x8, 0xc, 0x9}]}}]}, 0x40}, 0x1, 0x0, 0x0, 0x5c061}, 0x4008000) r9 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r9, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) r11 = socket$packet(0x11, 0x3, 0x300) sendto$packet(r11, &(0x7f00000004c0)="800000800000210ee7decd7a000000", 0xf, 0x40054, &(0x7f00000001c0)={0x11, 0x86dd, r10, 0x1, 0xd8, 0x6, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x43}}, 0x14) sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000740)=ANY=[@ANYBLOB="140000001000010000000000000100000000000a20000000000a01010000000000000000010000000900010073797a300000000068000000090a010400000000000000000100000008000a4000000000200011800e000100636f6e6e6c696d69740000000c00028008000140000000000900010073797a30000000000900020073797a3200000000080005400000001f0c000980080001400037"], 0xb0}}, 0x0) sendmsg$NFT_MSG_GETTABLE(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000001240)={&(0x7f0000000440)=ANY=[@ANYBLOB="20000000010a054b"], 0x20}, 0x1, 0x0, 0x0, 0x1}, 0x4804) 2.050540316s ago: executing program 0 (id=5128): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000003c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r1, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000340)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x10) sendmsg$NFT_BATCH(r1, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000400)={{0x14}, [@NFT_MSG_NEWRULE={0x5c, 0x6, 0xa, 0x40b, 0x0, 0x0, {0x2, 0x0, 0x1}, [@NFTA_RULE_EXPRESSIONS={0x30, 0x4, 0x0, 0x1, [{0x2c, 0x1, 0x0, 0x1, @numgen={{0xb}, @val={0x1c, 0x2, 0x0, 0x1, [@NFTA_NG_TYPE={0x8}, @NFTA_NG_MODULUS={0x8, 0x2, 0x1, 0x0, 0xfffffffc}, @NFTA_NG_DREG={0x8, 0x1, 0x1, 0x0, 0x1}]}}}]}, @NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_RULE_CHAIN={0x9, 0x2, 'syz2\x00'}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0xa}}}, 0x84}, 0x1, 0x0, 0x0, 0x40880}, 0x0) close(r1) sendmsg$NFT_BATCH(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000240)={{0x14}, [@NFT_MSG_NEWRULE={0x8c, 0x6, 0xa, 0x409, 0x0, 0x0, {0x2}, [@NFTA_RULE_EXPRESSIONS={0x60, 0x4, 0x0, 0x1, [{0x3c, 0x1, 0x0, 0x1, @immediate={{0xe}, @val={0x28, 0x2, 0x0, 0x1, [@NFTA_IMMEDIATE_DATA={0x1c, 0x2, 0x0, 0x1, [@NFTA_DATA_VERDICT={0x18, 0x2, 0x0, 0x1, [@NFTA_VERDICT_CODE={0x8, 0x1, 0x0, 0x1, 0xfffffffffffffffd}, @NFTA_VERDICT_CHAIN={0x9, 0x2, 'syz2\x00'}]}]}, @NFTA_IMMEDIATE_DREG={0x8}]}}}, {0x20, 0x1, 0x0, 0x1, @counter={{0xc}, @val={0x10, 0x2, 0x0, 0x1, [@NFTA_COUNTER_BYTES={0xc, 0x1, 0x1, 0x0, 0x9}]}}}]}, @NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_RULE_CHAIN={0x9, 0x2, 'syz2\x00'}]}, @NFT_MSG_DELFLOWTABLE={0x14, 0x18, 0xa, 0x801, 0x0, 0x0, {0x2, 0x0, 0x8}}], {0x14}}, 0xc8}}, 0x0) 1.855086447s ago: executing program 2 (id=5129): socket$inet6_udp(0xa, 0x2, 0x0) getsockopt$inet6_mreq(0xffffffffffffffff, 0x29, 0x1c, &(0x7f0000000080)={@private0, 0x0}, &(0x7f00000000c0)=0x14) r1 = socket$inet6_udplite(0xa, 0x2, 0x88) ioctl$sock_ipv6_tunnel_SIOCGETTUNNEL(r1, 0x89f0, &(0x7f0000000180)={'ip6_vti0\x00', &(0x7f0000000100)={'ip6_vti0\x00', r0, 0x4, 0xf, 0xb, 0x1, 0xa, @mcast1, @remote, 0x80, 0x700, 0x4, 0x5}}) mmap(&(0x7f0000001000/0xc00000)=nil, 0xc00000, 0x200000d, 0x3b071, 0xffffffffffffffff, 0x0) r2 = socket$rds(0x15, 0x5, 0x0) bind$rds(r2, &(0x7f0000000840)={0x2, 0x0, @loopback}, 0x10) sendmsg$rds(r2, &(0x7f0000000000)={&(0x7f0000000040)={0x2, 0x0, @private=0xa010100}, 0x10, 0x0, 0x0, &(0x7f00000001c0)}, 0x0) 1.72077968s ago: executing program 0 (id=5130): r0 = bpf$PROG_LOAD(0x5, &(0x7f00000003c0)={0x11, 0x11, &(0x7f00000008c0)=ANY=[@ANYBLOB="180000008000000000000000fdffffff8500000011000000b7080000000000007b8af8ff00000000b7080000161300007b8af0ff00000000bfa100000000000007010000f8ffffffbfa400000000000007040000f0ffffffb70200000800000018030000", @ANYRES32=0x0, @ANYBLOB="0000000000000100b705000008000000850000006900000095"], &(0x7f0000000500)='GPL\x00', 0x0, 0x0, 0x0, 0x41100, 0x8, '\x00', 0x0, @fallback=0x19, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffff}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f00000002c0)={r0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1000003f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x20}, 0x15) 1.434294259s ago: executing program 0 (id=5131): r0 = socket$inet6(0xa, 0x5, 0x0) bind$inet6(r0, &(0x7f0000000000)={0xa, 0x4e20, 0x0, @ipv4={'\x00', '\xff\xff', @dev={0xac, 0x14, 0x14, 0x33}}}, 0x18) r1 = accept4(r0, &(0x7f00000015c0)=@hci, &(0x7f00000005c0)=0x80, 0x80000) recvmmsg$unix(r1, &(0x7f00000014c0)=[{{&(0x7f0000000d00), 0x6e, &(0x7f0000000e80)=[{&(0x7f0000000680)=""/10, 0xa}, {&(0x7f0000000d80)=""/118, 0x76}, {&(0x7f0000000e00)=""/108, 0x6c}], 0x3}}, {{&(0x7f0000000ec0)=@abs, 0x6e, &(0x7f0000000fc0)=[{&(0x7f0000000f40)=""/107, 0x6b}, {&(0x7f0000001100)=""/230, 0xe6}], 0x2, &(0x7f0000001000)=[@cred={{0x1c}}, @rights={{0x1c, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}], 0x40}}, {{&(0x7f0000001200)=@abs, 0x6e, &(0x7f0000001440)=[{&(0x7f0000001280)=""/175, 0xaf}, {&(0x7f0000001340)=""/213, 0xd5}], 0x2, &(0x7f0000001480)=[@rights={{0x1c, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}], 0x20}}], 0x3, 0x20, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) sendmmsg$unix(r6, &(0x7f0000003580)=[{{0x0, 0x0, &(0x7f0000000640)=[{&(0x7f0000000380)="a1", 0x1}], 0x1, &(0x7f0000000800)=ANY=[@ANYBLOB="14000000000000000100000001000000", @ANYRES32=r5, @ANYBLOB="0000000014"], 0x30, 0x40400d1}}], 0x1, 0x810) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000002d40)={0xffffffffffffffff, 0xffffffffffffffff}) r9 = gettid() setsockopt$netrom_NETROM_T4(r4, 0x103, 0x6, &(0x7f0000000700), 0x4) r10 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000040), 0xffffffffffffffff) r11 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$IPVS_CMD_NEW_SERVICE(r11, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000c80)=ANY=[@ANYRESHEX=r3, @ANYRES16=r10, @ANYBLOB="010000000000000000000100000040000180060001000a00000008000500000000000c000700000000000000000008000900710000000700060072720000080008000000000008000b"], 0x54}}, 0x0) r12 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r12, 0x29, 0x40, &(0x7f0000000000)=@raw={'raw\x00', 0x3c1, 0x3, 0x4c0, 0x300, 0x18c, 0x203, 0x300, 0x19030000, 0x3f0, 0x2e0, 0x2e0, 0x3f0, 0x2e0, 0x7fffffe, 0x0, {[{{@uncond, 0x300, 0x2d8, 0x320, 0x0, {0x1000000}, [@common=@unspec=@bpf0={{0x230}, {0x13, [{}, {0x20}, {}, {}, {}, {}, {}, {}, {}, {}, {0x0, 0x0, 0x0, 0xe}, {}, {0x0, 0x0, 0x3}, {0x2}, {}, {0x0, 0x0, 0x0, 0x1}, {}, {}, {0x16}, {}, {}, {0x7}, {}, {0x0, 0x0, 0x0, 0x101}, {}, {}, {0x0, 0x0, 0x2}, {}, {}, {}, {0xfffe, 0x0, 0x10}, {}, {}, {}, {0x0, 0xfd}, {}, {0x7a04}, {}, {0x0, 0x0, 0x0, 0x9}, {0x0, 0x0, 0x2}, {}, {}, {}, {0x0, 0x0, 0x0, 0x1}, {0x0, 0xfd}, {0xb84, 0x0, 0x0, 0xf00}, {0x0, 0x1, 0x0, 0x3}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {0x0, 0x0, 0x2}, {}, {0x4}]}}]}, @common=@unspec=@NFQUEUE3={0x28, 'NFQUEUE\x00', 0x3, {0x0, 0x4}}}, {{@uncond, 0x0, 0xa8, 0xf0}, @common=@unspec=@IDLETIMER={0x48, 'IDLETIMER\x00', 0x0, {0xb, 'syz0\x00', {0x8000000000000001}}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x520) sendmsg$IPVS_CMD_DEL_SERVICE(0xffffffffffffffff, &(0x7f00000001c0)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f0000000180)={&(0x7f0000000080)={0xd4, r10, 0x100, 0x70bd25, 0x25dfdbff, {}, [@IPVS_CMD_ATTR_DAEMON={0x58, 0x3, 0x0, 0x1, [@IPVS_DAEMON_ATTR_SYNC_ID={0x8, 0x3, 0x3}, @IPVS_DAEMON_ATTR_MCAST_IFN={0x14, 0x2, 'gretap0\x00'}, @IPVS_DAEMON_ATTR_SYNC_MAXLEN={0x6, 0x4, 0x8000}, @IPVS_DAEMON_ATTR_SYNC_MAXLEN={0x6, 0x4, 0x4}, @IPVS_DAEMON_ATTR_MCAST_PORT={0x6, 0x7, 0x4e20}, @IPVS_DAEMON_ATTR_SYNC_ID={0x8}, @IPVS_DAEMON_ATTR_SYNC_ID={0x8}, @IPVS_DAEMON_ATTR_MCAST_TTL={0x5, 0x8, 0x31}, @IPVS_DAEMON_ATTR_SYNC_MAXLEN={0x6, 0x4, 0x4000}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4, 0x1}, @IPVS_CMD_ATTR_DEST={0x34, 0x2, 0x0, 0x1, [@IPVS_DEST_ATTR_TUN_FLAGS={0x6, 0xf, 0x9}, @IPVS_DEST_ATTR_TUN_FLAGS={0x6, 0xf, 0x6}, @IPVS_DEST_ATTR_U_THRESH={0x8, 0x5, 0x5}, @IPVS_DEST_ATTR_TUN_PORT={0x6, 0xe, 0x4e24}, @IPVS_DEST_ATTR_U_THRESH={0x8, 0x5, 0x3}, @IPVS_DEST_ATTR_ADDR_FAMILY={0x6, 0xb, 0xa}]}, @IPVS_CMD_ATTR_TIMEOUT_UDP={0x8, 0x6, 0x80}, @IPVS_CMD_ATTR_DAEMON={0x24, 0x3, 0x0, 0x1, [@IPVS_DAEMON_ATTR_SYNC_MAXLEN={0x6, 0x4, 0x200}, @IPVS_DAEMON_ATTR_SYNC_MAXLEN={0x6, 0x4, 0x2}, @IPVS_DAEMON_ATTR_MCAST_TTL={0x5, 0x8, 0x1}, @IPVS_DAEMON_ATTR_MCAST_TTL={0x5, 0x8, 0x2}]}]}, 0xd4}, 0x1, 0x0, 0x0, 0xc001}, 0x0) r13 = socket$inet6_sctp(0xa, 0x1, 0x84) sendto$inet6(r13, &(0x7f0000000000)="10", 0x1, 0x0, &(0x7f000005ffe4)={0xa, 0x0, 0xfffffffe, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02', 0xcd03}, 0x1c) sendmsg$inet6(r13, &(0x7f0000000340)={&(0x7f0000000300)={0xa, 0x4e21, 0x5, @private1, 0x29}, 0x1c, &(0x7f0000000100)=[{&(0x7f00000002c0)='\x00', 0x1}], 0x1}, 0x20000000) bpf$MAP_CREATE(0x100000000000000, &(0x7f0000000280)=@base={0xa, 0x5, 0x4, 0x7b}, 0x50) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000440)={0x18, 0x3, &(0x7f0000000080)=@framed={{0x18, 0x8, 0x0, 0x0, 0x10000000, 0x0, 0x0, 0x0, 0x500}}, &(0x7f0000000000)='GPL\x00', 0x2, 0xde, &(0x7f0000000340)=""/222, 0x0, 0x84}, 0x94) poll(&(0x7f0000000080)=[{r13, 0x46a8}], 0x1, 0x400) shutdown(r13, 0x1) listen(r13, 0x8001) ioctl$F2FS_IOC_MOVE_RANGE(r2, 0xc020f509, &(0x7f0000001580)={r13, 0x3, 0xff, 0x2d}) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) writev(r6, &(0x7f0000000c00)=[{&(0x7f0000000540)="b9f0b008a763ef5dc04f243f1804", 0xe}, {&(0x7f0000000740)="d964a6a6416722745b795c830cfe75db1868b31b71131b13114e6cb5eeee4ed74dfbcd9dc24a02606746983395809134878df8019dde5f8a97410a6c66185920df03db71ae0ade6ca1bb151a332c979cea25af2c7e56c5899409b45d8ebfdd068f3d797d0972ef9c04b0dd7a41fc1501408924a397d04de523c685737ca569d0b79add43502e8d8349b109ec032805d4d87c3a1fca6fca29c7f47768bc1664dab5241fe10e0e70c24a2b4b062ac33cdc1fe1406355a589581a7ef4be4d70c8", 0xbf}, {&(0x7f0000000840)="50026491abb38e96187a05ec432dbb9c360d26dee32ff1078dd20ca156b4b8bedf5d47d1b17589e7050029cf3fee9ac6700c7fe7ed4e16246b0bab69612402cadc4dd5257b74c1eaecbad9891e01e04dc08fec9291622ee6cbbce0a0770452dfa2097cdc88d38e4f6de09e0e136fadf21db9cfcf11b0c4add1fd36e454e247caf2e8b29ce39ebd", 0x87}, {&(0x7f0000000580)="0fca13c3161c21465ab03fef7a086e42", 0x10}, {&(0x7f0000000900)="62fae7e7fd8dae0ec0963c60b95b297b6e5c0bc64e5967412a842a64dc4974afec6ae2cadb9022830e4535c16c41e5357ce44a6ab79c6a6d23b118887628add8116cbb6b7241ad4932e90e922564d48883c01ab1d4349ccbd4724c150ebd4ff47c9b8ba3bf331a9cbe4c5bf05e6a2ed770ab9715f6353d51a0f2f5a7c617358068fe3bee414fd2d8591adaec561d4ae305b764bf82fe84c21b070672c5e6a1a50179755281cc", 0xa6}, {&(0x7f00000009c0)="c919b7e769444ec989bfff6cbe70da3830a830c30654efa8dfbbacb489f81b27e7ca0615e48ab7a5ecfff3ece2cc427bc3f972873d842db618d1f497e14b9725a98f3e31af459e45934f7156d7105d32c3fc2e8776378aec28bdc262ad7c259a68d68c7a40e2f4becbae025811a9c1200f02f14ea7aa01c86a29a88999", 0x7d}, {&(0x7f0000000a40)="701c5efa5ddba8367962e367b9efac1a4f4fa128849b06157fc0bb19c17ad70edec633bca3c04ac2371be7e9c80636dd3c9d6b21e441da18c03a97ba472339d0844fc7570bd2503505c02f3a908100c084d1cf6d04d3ff8e0b88da6524c2c19a51fce1abee1c0a58e4395bb8b019fc9f4e9143a96c82259929d746ce906e470c47520d9c89237dc5e3bad9a72655c0e9fcbed804573211ea51d9c264fe6a2469cf482336b04a81ab44", 0xa9}, {&(0x7f0000000b00)="936c270c2e749c12b63a3f6f63cb5c3bbe9442cc62c8fa9b567c72c77c88dd737ece99ae49149ae99b106aa10f709d477b53841e1db0b6081195386b39e84caff43ede538134936c1bb7e6479d6db77f35997c506f7ce3905dbb1aafbb87e27858aa0c8b56411a94dfb2bdef006c4b95049c8e6930d260b1f3985e1c31a10615c9016a51174d09a0d4492345aa1e197598d7c7cd1a9c57c74a60af36238788f121894ebefae92c10cbbabfbb17cf9bc05c138f45f5463d11533a50e3d8753f76d092e573b3da720a58c72e76134fab9d65fa", 0xd2}], 0x8) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000006c0)) sendmsg$unix(r8, &(0x7f0000000600)={0x0, 0x0, &(0x7f0000000500)=[{&(0x7f0000000640)='Q', 0x1}], 0x1, &(0x7f0000001040)=ANY=[@ANYBLOB="1c000000000000000100000002000000", @ANYRES32=r9, @ANYRES32=0xee01, @ANYRES32=0x0, @ANYBLOB="0000000030000000000000000100000001000000", @ANYRES32=r8, @ANYRES32=r7, @ANYRES32=r7, @ANYRES32=r8, @ANYRES32=r7, @ANYRES32=r8, @ANYRES32=r7, @ANYRES32=r8, @ANYBLOB="1c000000000000000100000402000000", @ANYRES32, @ANYRES32=0xee01, @ANYRES32=0x0, @ANYBLOB="0000000014000000000000000100000001000000", @ANYRES32=r7, @ANYBLOB="0000000018"], 0xa0}, 0x4004881) 1.352741364s ago: executing program 4 (id=5132): r0 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="0e000000040000000800000005"], 0x48) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x6, 0xc, &(0x7f00000001c0)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bc82000000000000a6020000f8ffffffb703000008000000ac03000000000000850000003300000095"], &(0x7f0000000780)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x28, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r2 = socket$inet_tcp(0x2, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000180)={'syz_tun\x00', 0x0}) (async) r4 = socket$inet6(0xa, 0x6, 0x7) setsockopt$inet6_mreq(r4, 0x29, 0x1c, &(0x7f0000000280)={@mcast2, r3}, 0x14) (async) bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f00000005c0)={r1, r3, 0x25, 0x0, @val=@kprobe_multi=@syms={0x1, 0x0, 0x0, 0x0, 0x8000000000000001}}, 0x30) (async) r5 = syz_init_net_socket$rose(0xb, 0x5, 0x0) setsockopt$rose(r5, 0x104, 0x2, &(0x7f0000000040)=0x3, 0x4) (async) syz_emit_ethernet(0x1e1, &(0x7f0000000100)=ANY=[], 0x0) (async) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.cpu/syz0\x00', 0x1ff) (async) r6 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r7 = openat$cgroup_int(r6, &(0x7f0000000080)='hugetlb.2MB.rsvd.max_usage_in_bytes\x00', 0x2, 0x0) pread64(r7, &(0x7f00000000c0)=""/244, 0xf4, 0x0) (async) r8 = bpf$MAP_CREATE(0x0, &(0x7f0000000600)=ANY=[@ANYBLOB="1b00000000000000000000000080"], 0x48) r9 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000140)={0x3, 0xf, &(0x7f0000000b00)=ANY=[@ANYBLOB="18020000000080003367a20a00000000000000e5e3778f056f460000000818110000", @ANYRES32=r8, @ANYBLOB="0000000000000000b70200000300000085000000090000000000000020207025000004000149f819841aacfd74f2fa235bae00000007010000f8ffffffb7fcffff07000000b703000000000000850000009b00000d5ccd5b188c2e13e9cccfd2b300"/113], &(0x7f0000000500)='syzkaller\x00', 0x7, 0x0, 0x0, 0x40f00, 0x42}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000440)={r9, 0x0, 0x22b, 0x0, &(0x7f00000006c0)="e0ff547e121c9efc040000000000000000000000de8a79477701d82ce717fd910155f81e48b5b786872d1bbfb7e8d6f18379651b51d3227d54f6bda9f4b351e8b7cef05881d68f60039399fec446341bb3ee1debbacdec6f996b79c4c9f605000000c1b77c8f027a16f3714674bf27a99ec268ed25878811e2820a3110f23dd0f1fc703b96fd4b89df62a07319912bdcde88881428ff28d7e245f244398ed9447fe3c3d3549a39bc1435697643c2874393d9ed14c8f3683491a814c58dfb52dfaea070c9bd28b459260c18d8b7a9456d710ef6a5b74cb10f6fd6fa7d54f0431a352c77166673638f118b28f5d23da1011b4978e037ba7be045bafccb35ca2ae58a2dbbc3fa63f72a6ef6b0e9beea239ec9eaa7c088cd43c989ee74aed436bcf281c7a808d64ebca3eaba4703031c9d59a6e5fcecf864b02c8bfd6ee39ec424a0ad998edb28e4c2b75e5f711c78c20f2d57288d05053af436dabfef8cd95c5e179d7a9ae08dc8c9dd35bca98343082a79c818d2f2f41d6c934f4b9198bdaf7d6fe9bd3ca273a23d591ff92b37e1f94434b65d66d9ce696c7628e1ee6c70925e9c9d2f319f8e99ec14a9d8416a8e41224a087983a8f00956ceb54fde5bc6a1e5a4d9c8d8fecedd1326b921b9c1c811737b6b8e766bdab11f73cbcd0429024b9253b1009aa4c198bc033fc13cd2eeac54ae3ec8b20398971706d373675e759e7f6230f00ecd301a2f06f3a1b519c391246a9b58887f62d18119a353c9d951d33e61b2b658df9d3fea24843c6a", 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x952}, 0x50) (async) ioctl$F2FS_IOC_MOVE_RANGE(r9, 0xc020f509, &(0x7f0000000340)={r8, 0x3, 0x100, 0xfffffffffffffd86}) (async) r11 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r11, 0x8933, &(0x7f00000000c0)={'bridge0\x00', 0x0}) sendmsg$nl_route(r11, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000a00)=ANY=[@ANYBLOB="4000000010000104fcffffffffdbdf2500000000", @ANYRES32=0x0, @ANYBLOB="43190300000000000f00128008000100707070000c00028008000100", @ANYRES32=r6, @ANYBLOB="08000500", @ANYRES32=r12, @ANYBLOB="3a80bfe4fd1181787429992e76632a1fcd5c9a0f1ea9286d045c5ffb7601bc8ff3ff397490984fec4209ea10cf9d1d84f5ea08abeacfaa9295b60083fadf9aa0e5a892d8125b4455cd30ded051f6aa1e2afd5f0ebf044af116def3424b50aa568d3e2b4bbb2b93458ce8fb279648bea5ffa54246720292e897c1992393bd1582e6a25300e280b9d9c3c165a158197bc7861461c07e081ff071228c66bfd4e649c620d463699b0539677874808448edbbc549bacf8d8538534fd99f3a1056"], 0x40}, 0x1, 0x0, 0x0, 0x2004d808}, 0x0) (async) sendmsg$nl_route(r10, &(0x7f0000000540)={&(0x7f0000000380)={0x10, 0x0, 0x0, 0x8}, 0xc, &(0x7f0000000400)={&(0x7f00000003c0)=ANY=[@ANYBLOB="3c00000010000400d7f270000000000000000000", @ANYRES32=r12, @ANYBLOB="011200004000000014003500626f6e6430000000000000000000000008002c00fcffffff"], 0x3c}, 0x1, 0x0, 0x0, 0x40010}, 0x48000) r13 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000040), 0x161042, 0x0) (async, rerun: 32) r14 = socket$nl_generic(0x10, 0x3, 0x10) (async, rerun: 32) r15 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000080), 0xffffffffffffffff) (async) r16 = syz_init_net_socket$bt_l2cap(0x1f, 0x2, 0x0) setsockopt$bt_l2cap_L2CAP_OPTIONS(r16, 0x6, 0x1, &(0x7f0000000400)={0x2, 0x21ac, 0x4, 0xd, 0x7, 0x9, 0xffc0}, 0xc) (async, rerun: 64) sendmsg$L2TP_CMD_TUNNEL_CREATE(r14, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000400)=ANY=[@ANYBLOB='\\\x00\x00\x00', @ANYRES16=r15, @ANYBLOB="1709a70000000000000101000000080009003f00000014001f0000000000000000000000000000000001140020000000000000000000defffeff000000000500070000000000060002000d00000008000a"], 0x5c}}, 0x0) (rerun: 64) ioctl$PPPIOCNEWUNIT(r13, 0xc004743e, &(0x7f0000000000)=0x3) (async, rerun: 64) ioctl$PPPIOCGDEBUG(r13, 0x80047441, &(0x7f0000000680)) (rerun: 64) 1.040765239s ago: executing program 4 (id=5133): bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000b80)={0x6, 0x3, &(0x7f0000000680)=ANY=[@ANYBLOB="1800000002000000000000000000000095"], 0x0, 0x0, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x5}, 0x94) r0 = bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000400)={0x6, 0x3, &(0x7f0000000680)=ANY=[], &(0x7f00000002c0)='GPL\x00'}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000600)={r0, 0x5, 0xb68, 0x4000, &(0x7f0000000000)='%', 0x0, 0xd01, 0x4000, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x48) (fail_nth: 3) r1 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_fanout(r1, 0x107, 0x12, &(0x7f0000000040)={0x0, 0x6}, 0x4) setsockopt$packet_fanout_data(r1, 0x107, 0x16, &(0x7f0000000100)={0x2, &(0x7f0000000180)=[{0x40, 0x0, 0x0, 0xe3c7}, {0x6, 0x20, 0x6c}]}, 0x10) 627.682859ms ago: executing program 2 (id=5134): r0 = socket(0x2, 0x80805, 0x0) bpf$MAP_CREATE(0x0, 0x0, 0x50) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000240)=@delchain={0x24, 0x65, 0x400, 0x70bd29, 0x25dfdbfc, {0x0, 0x0, 0x0, 0x0, {0x509d884560ba1ba6, 0x3}, {}, {0x8, 0x10}}}, 0x24}}, 0x10) sendmsg$TEAM_CMD_OPTIONS_SET(0xffffffffffffffff, &(0x7f0000004bc0)={0x0, 0x0, &(0x7f0000004b80)={&(0x7f0000000100)=ANY=[@ANYBLOB="60b80000", @ANYRES16, @ANYBLOB="050427bd7000fedbdf250100000008000100", @ANYRES32, @ANYBLOB="4400028040000100240001006d6f6465000000000000000000000000000000000000000000000000000000000500030005"], 0x60}, 0x1, 0x0, 0x0, 0x4000401}, 0x4040084) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000100)=@newqdisc={0x3c, 0x24, 0x1, 0x80000000, 0x4, {0x0, 0x0, 0x0, 0x0, {0x8, 0x3}, {0xa, 0xffe0}, {0xfff1, 0x9}}, [@qdisc_kind_options=@q_fq_pie={{0xb}, {0xc, 0x8002, [@TCA_FQ_PIE_LIMIT={0x8, 0x1, 0xf4b6}]}}]}, 0x3c}}, 0x20004055) ioctl$sock_qrtr_SIOCGIFADDR(r0, 0x8915, &(0x7f0000000000)={'hsr0\x00'}) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000080)={0x0, 0x48}, 0x1, 0x0, 0x0, 0x10}, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000100)=ANY=[@ANYBLOB="500000001000010425bbe5ad600027842cf52300", @ANYRES32=0x0, @ANYBLOB="0300000000000000280012800a00010076786c616e00"], 0x50}, 0x1, 0x0, 0x0, 0x13d33d22cca65c15}, 0x4008840) r1 = socket$netlink(0x10, 0x3, 0x0) sendmmsg(r1, &(0x7f00000002c0), 0x40000000000009f, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000100)=@newqdisc={0x44, 0x24, 0x4, 0xc0000000, 0x0, {0x0, 0x0, 0x0, 0x0, {0x3, 0x8}, {0xa, 0xe}, {0x0, 0x9}}, [@qdisc_kind_options=@q_fq_pie={{0xb}, {0x14, 0x8002, [@TCA_FQ_PIE_TUPDATE={0x8, 0x4, 0x6}, @TCA_FQ_PIE_TARGET={0x8, 0x3, 0x4}]}}]}, 0x44}}, 0x20004015) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000100)=ANY=[@ANYBLOB="500000001000010425bbe5ad600027842cf52300", @ANYRES32=0x0, @ANYBLOB="0300000000000000280012800a00010076786c616e00"], 0x50}, 0x1, 0x0, 0x0, 0x13d33d22cca65c15}, 0x4008840) r2 = socket$netlink(0x10, 0x3, 0x0) sendmmsg(r2, &(0x7f00000002c0), 0x40000000000009f, 0x0) 621.543992ms ago: executing program 4 (id=5135): ioctl$sock_kcm_SIOCKCMCLONE(0xffffffffffffffff, 0x89e2, &(0x7f0000000000)={0xffffffffffffffff}) getsockopt$IP_SET_OP_VERSION(r0, 0x1, 0x53, &(0x7f0000000040), &(0x7f0000000080)=0x8) r1 = socket(0x11, 0x5, 0x2) setsockopt$bt_hci_HCI_TIME_STAMP(r1, 0x0, 0x3, &(0x7f00000000c0)=0x8, 0x4) sendmsg$NL80211_CMD_GET_REG(r1, &(0x7f00000001c0)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f0000000180)={&(0x7f0000000140)={0x3c, 0x0, 0x4, 0x70bd29, 0x25dfdbfe, {}, [@NL80211_ATTR_DFS_REGION={0x5, 0x92, 0x37}, @NL80211_ATTR_USER_REG_HINT_TYPE={0x8, 0x9a, 0x1}, @NL80211_ATTR_DFS_REGION={0x5, 0x92, 0x6}, @NL80211_ATTR_USER_REG_HINT_TYPE={0x8}, @NL80211_ATTR_DFS_REGION={0x5, 0x92, 0x1}]}, 0x3c}, 0x1, 0x0, 0x0, 0x4041}, 0x40810) r2 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$tipc(&(0x7f0000000200), r2) r3 = socket(0xa, 0x6, 0x13) r4 = gettid() getsockopt$inet6_IPV6_XFRM_POLICY(r0, 0x29, 0x23, &(0x7f0000000240)={{{@in=@loopback, @in=@private, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@initdev}}}, &(0x7f0000000340)=0xe8) r7 = getgid() setsockopt$sock_cred(r3, 0x1, 0x11, &(0x7f0000000380)={r4, r6, r7}, 0xc) r8 = openat$cgroup_procs(0xffffffffffffffff, &(0x7f00000003c0)='cgroup.procs\x00', 0x2, 0x0) write$cgroup_pid(r8, &(0x7f0000000400)=r4, 0x12) gettid() sendmsg$key(r0, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000540)={&(0x7f0000000440)={0x2, 0x5, 0x80, 0x2, 0x1f, 0x0, 0x70bd2a, 0x25dfdbff, [@sadb_spirange={0x2, 0x10, 0x4d4, 0x4d5}, @sadb_sa={0x2, 0x1, 0x3, 0xe, 0x0, 0x15, 0x2, 0x20000000}, @sadb_address={0x3, 0x7, 0x33, 0x20, 0x0, @in={0x2, 0x4e23, @multicast2}}, @sadb_x_nat_t_port={0x1, 0x15, 0x4e21}, @sadb_x_kmaddress={0x7, 0x19, 0x0, @in={0x2, 0x4e22, @initdev={0xac, 0x1e, 0x1, 0x0}}, @in6={0xa, 0x4e20, 0x0, @local, 0x1000}}, @sadb_x_sa2={0x2, 0x13, 0x1, 0x0, 0x0, 0x70bd27, 0x3504}, @sadb_x_filter={0x5, 0x1a, @in=@rand_addr=0x64010100, @in6=@mcast1, 0x18, 0x4}, @sadb_x_sa2={0x2, 0x13, 0xc3, 0x0, 0x0, 0x70bd27, 0x3504}, @sadb_x_filter={0x5, 0x1a, @in=@initdev={0xac, 0x1e, 0x1, 0x0}, @in6=@private0={0xfc, 0x0, '\x00', 0x1}, 0x9, 0x14}]}, 0xf8}}, 0x20000804) getsockopt$TIPC_IMPORTANCE(r0, 0x10f, 0x7f, &(0x7f00000005c0), &(0x7f0000000600)=0x4) r9 = syz_genetlink_get_family_id$gtp(&(0x7f0000000680), r2) sendmsg$GTP_CMD_NEWPDP(r2, &(0x7f0000000780)={&(0x7f0000000640)={0x10, 0x0, 0x0, 0x40000000}, 0xc, &(0x7f0000000740)={&(0x7f00000006c0)={0x44, r9, 0x1, 0x70bd2d, 0x25dfdbfd, {}, [@GTPA_VERSION={0x8, 0x2, 0x1}, @GTPA_VERSION={0x8, 0x2, 0x1}, @GTPA_VERSION={0x8}, @GTPA_VERSION={0x8}, @GTPA_PEER_ADDRESS={0x8, 0x4, @empty}, @GTPA_FLOW={0x6, 0x6, 0x2}]}, 0x44}, 0x1, 0x0, 0x0, 0x4040004}, 0x4000080) socket$nl_route(0x10, 0x3, 0x0) sendmsg$OSF_MSG_ADD(r3, &(0x7f00000011c0)={&(0x7f00000007c0)={0x10, 0x0, 0x0, 0x8000000}, 0xc, &(0x7f0000001180)={&(0x7f0000000800)={0x964, 0x0, 0x5, 0x801, 0x0, 0x0, {0x0, 0x0, 0x5}, [{{0x254, 0x1, {{0x1, 0x7fffffff}, 0x2, 0x1, 0x270, 0x6, 0x9, 'syz1\x00', "0893cf787163b5cc40183908315898b340a723d9cad065c0bef2353e336c6785", "c864235f99e48198745043476373d42b2fb50dff8552d0094361032efdb8a159", [{0x2, 0xaa8, {0x1, 0x2d0}}, {0x2, 0x7, {0x0, 0x4}}, {0x2, 0x84, {0x1, 0xffff}}, {0x888b, 0x400, {0x2, 0x100000}}, {0xc18, 0x4, {0x2, 0x76c}}, {0xffff, 0x497, {0x2, 0x8}}, {0x1a6, 0x5, {0x2}}, {0x8, 0x0, {0x2, 0x3}}, {0x998, 0x3, {0x1, 0x5}}, {0x9, 0x505, {0x0, 0x4}}, {0x9, 0x4, {0x0, 0x800}}, {0xfff1, 0x7fff, {0x3, 0xb}}, {0x1000, 0x3, {0x2, 0x3}}, {0x5, 0x9, {0x2}}, {0x3, 0x200, {0x0, 0xa76f}}, {0x3, 0x4a28, {0x3, 0xd4}}, {0x61, 0x1, {0x3, 0xfffffff1}}, {0x5, 0x9, {0x1, 0x4}}, {0xe, 0xd6, {0x1, 0x4}}, {0xfecc, 0x40, {0x1, 0x8}}, {0x1, 0x0, {0x2, 0x5263}}, {0xc2b, 0x3, {0x0, 0xc571}}, {0x800, 0x8, {0x0, 0xa3f}}, {0x7, 0x8, {0x2, 0x10}}, {0xfff8, 0xd631, {0x1, 0x3}}, {0x4, 0x4, {0x3, 0x79}}, {0x1, 0x8, {0x0, 0x4}}, {0x10, 0x4, {0x0, 0x7}}, {0xf6d, 0x1, {0x1, 0x100}}, {0x9, 0x9cd3, {0x1, 0x6c}}, {0xa6, 0x9, {0x2, 0x839}}, {0x1, 0x3ff, {0x1, 0x9}}, {0x4, 0x8, {0x2, 0x5}}, {0x4, 0x8, {0x0, 0xfffffffd}}, {0x41f, 0x6, {0x2, 0x3}}, {0x18, 0x0, {0x0, 0x5}}, {0x0, 0xf5, {0x0, 0x5}}, {0x7ff, 0x9, {0x0, 0xd1a}}, {0x7, 0x400, {0x3, 0x4}}, {0x8, 0x8000, {0x3, 0x4}}]}}}, {{0x254, 0x1, {{0x3, 0x3ff}, 0xfc, 0xf8, 0x3, 0xa8, 0x10, 'syz0\x00', "c50867dbd0497db3e560ce210f709cf1279a46825cc1c178348da5cdd5ab47b7", "68471c2ae9c775c84797b64dbe9805d8946379831853158f5c85dbb7d5041600", [{0x7, 0x96, {0x0, 0x1}}, {0x3, 0xf, {0x0, 0x6}}, {0xfbc8, 0xfff1, {0x2, 0x2}}, {0x0, 0x1, {0x3, 0x3}}, {0x5, 0x2, {0x1, 0x1}}, {0x9, 0x400, {0x2, 0x5}}, {0x8, 0x2, {0x2, 0x1}}, {0xffff, 0x8001, {0x0, 0x21c0e94d}}, {0x81, 0x3ff, {0x0, 0x5}}, {0x4, 0xff, {0x1, 0xf}}, {0xdbd0, 0x5, {0x1}}, {0x7f, 0x71, {0x1, 0x7ff}}, {0x80, 0x4, {0x0, 0xfffffffe}}, {0x4, 0x1, {0x1, 0x1}}, {0x3, 0x8, {0x1}}, {0x1, 0x1f, {0x3, 0x4}}, {0x5, 0x4, {0x1, 0xfffffff7}}, {0x80, 0x5, {0x1, 0x4e1c}}, {0xf, 0x9, {0x1, 0x7}}, {0x5, 0x5, {0x3, 0x5a97}}, {0x3, 0x1, {0x0, 0x6}}, {0x80, 0x2, {0x1, 0x1ff}}, {0xfffe, 0xff, {0x1, 0xffff}}, {0x1, 0x4e0, {0x3, 0x2}}, {0x101, 0xd, {0x1, 0x4f}}, {0x3, 0x80, {0x0, 0xfffffffa}}, {0xa3e, 0x8001, {0x2, 0x9f}}, {0xb, 0x9, {0x3}}, {0x691, 0x8, {0x2, 0x7}}, {0x3, 0xe9, {0x0, 0x3897}}, {0x2, 0x5e0, {0x0, 0x1}}, {0x9, 0x4, {0x0, 0x97c6}}, {0xc72, 0x0, {0x0, 0x1000}}, {0x1, 0x61}, {0x636f, 0x4, {0x3, 0x1}}, {0x8, 0xc0c, {0x0, 0x1}}, {0x2e4, 0x1, {0x3, 0x8}}, {0x3d, 0x200, {0x3, 0x80000001}}, {0x4, 0x595d, {0x3, 0xad}}, {0x1, 0x400, {0x2, 0x7b}}]}}}, {{0x254, 0x1, {{0x1, 0x8f}, 0xa7, 0x0, 0x9, 0xfc01, 0x1a, 'syz0\x00', "33cbbaa0fdc085924386244eb5950f70d37910940f06470f9ebf0e4d812df870", "45a033d6c16416e506f347c1c246c78d39fb0bf6261346ceb43083a79be4ad00", [{0x7, 0x9, {0x1, 0x3}}, {0x0, 0xfffb, {0x2, 0x9}}, {0x8, 0x1, {0x0, 0x80}}, {0xc, 0x2, {0x1, 0xaccc}}, {0x800, 0x4, {0x3, 0x4}}, {0xfff9, 0x2, {0x0, 0xff}}, {0x2, 0x5, {0x0, 0x7}}, {0x41f3, 0xa, {0x1, 0xe579}}, {0xfff6, 0x7, {0x1, 0x6}}, {0x45, 0x80, {0x0, 0x4}}, {0x9, 0x7ff, {0x0, 0xfffffffa}}, {0x81, 0x0, {0x2, 0xa8}}, {0x19, 0x400, {0x3, 0x9}}, {0x3, 0x7, {0x2, 0x57b}}, {0xfffd, 0x5d8d, {0x3, 0x8}}, {0xff, 0x2, {0x0, 0x200}}, {0x1, 0x7, {0x0, 0x485}}, {0x1, 0x5, {0x0, 0x7}}, {0x0, 0x400, {0x3, 0x5}}, {0x6, 0x3, {0x3, 0xd7b}}, {0x7, 0x0, {0x1, 0x5}}, {0x4, 0x0, {0x3, 0x7ff}}, {0x5, 0x19, {0x0, 0x2}}, {0x0, 0x0, {0x3, 0x5}}, {0x1, 0x81, {0x3, 0xfffffffa}}, {0x5, 0x1, {0x1, 0x6}}, {0x1, 0x2ef8, {0x1, 0x3e2}}, {0x0, 0x3, {0x3, 0x2}}, {0x3635, 0xb, {0x1, 0x9}}, {0x4, 0xb, {0x1, 0x33d}}, {0x2a, 0x4, {0x0, 0x101}}, {0xef, 0x0, {0x3, 0x389f1549}}, {0xffc0, 0xeb, {0x2, 0xffffffff}}, {0xa1a, 0x8, {0x0, 0x3}}, {0x4, 0xa6a4, {0x2, 0x38cd}}, {0x7, 0xc764, {0x0, 0xef70}}, {0x0, 0x9, {0x3, 0xffffffff}}, {0x0, 0x8, {0x3, 0x4}}, {0x1ff, 0x6, {0x1, 0x4c}}, {0x2, 0x800, {0x0, 0x1}}]}}}, {{0x254, 0x1, {{0x3, 0xf}, 0x3, 0x2, 0x2, 0x8, 0x14, 'syz1\x00', "f6489e75e77f5561599dd3cfdc2d8f2c3d7d73f0fd49f9b8f92004efbb358404", "fdbabc76cf3adf9b1411d06074175c0456e5fe2abaf6c9d000a168e578138535", [{0xac71, 0x7, {0x0, 0xff}}, {0x8d, 0x9, {0x1, 0x6}}, {0xa, 0x40, {0x0, 0x5}}, {0x7, 0x4, {0x3, 0x90000000}}, {0x5, 0x4, {0x1, 0x7}}, {0x3, 0x1, {0x1}}, {0x7ff, 0x3, {0x3, 0x80000000}}, {0xe24, 0x5, {0x0, 0x2}}, {0x8, 0x6, {0x1, 0xc}}, {0xff2c, 0x6, {0x2, 0xffffffff}}, {0x3ff, 0x80, {0x1, 0x8}}, {0xffff, 0x0, {0x0, 0x7}}, {0x2, 0x6, {0x0, 0x8}}, {0xfff, 0x2d, {0x2, 0x5}}, {0xa6f, 0x400}, {0x7, 0x6, {0x3, 0x5}}, {0x1ff, 0x4, {0xac4b702268dd9901, 0x5}}, {0x8, 0x9, {0x1, 0x4}}, {0x6, 0x80, {0x0, 0x8}}, {0x4, 0x8, {0x0, 0x6}}, {0x200, 0xfff, {0x1}}, {0x7ff, 0x7, {0x0, 0x8}}, {0x0, 0x3, {0x3, 0x401}}, {0x6, 0x81, {0x1, 0xcd}}, {0x2, 0x1, {0x2}}, {0x4, 0x81d3, {0x3, 0x7a4}}, {0x0, 0x3e76, {0x2, 0x8}}, {0xfff, 0x7, {0x3, 0x1}}, {0x101, 0x5, {0x0, 0xff}}, {0x4, 0x1, {0x1, 0x8}}, {0xd, 0x3ff, {0x1, 0x984}}, {0x2, 0x5, {0x762ed5742b1ac8e4, 0x8}}, {0x3, 0xd70, {0x0, 0x80}}, {0x5, 0x7fff, {0x2, 0xd}}, {0xfff9, 0x1, {0x0, 0x9}}, {0x5, 0x6, {0x3}}, {0x1, 0x6, {0x3, 0xbec}}, {0xff, 0x5, {0x3, 0x4630576a}}, {0x6, 0x4, {0x0, 0xc}}, {0x2, 0x1, {0x3, 0xfffffffa}}]}}}]}, 0x964}, 0x1, 0x0, 0x0, 0x21}, 0x4000) syz_emit_ethernet(0x2a, &(0x7f0000001200)={@empty, @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x3}, @void, {@arp={0x806, @ether_ipv4={0x1, 0x800, 0x6, 0x4, 0xa, @remote, @dev={0xac, 0x14, 0x14, 0x2e}, @broadcast, @broadcast}}}}, &(0x7f0000001240)={0x0, 0x1, [0xab2, 0xcba, 0x68b, 0xd17]}) r10 = accept4$netrom(r3, &(0x7f0000001280)={{0x3, @default}, [@netrom, @rose, @default, @netrom, @null, @default, @netrom, @netrom]}, &(0x7f0000001300)=0x48, 0xc1000) shutdown(r10, 0x0) r11 = bpf$PROG_LOAD(0x5, &(0x7f0000001500)={0x1f, 0x10, &(0x7f0000001340)=@framed={{0x18, 0x0, 0x0, 0x0, 0xff, 0x0, 0x0, 0x0, 0xffffff2a}, [@map_idx_val={0x18, 0x4, 0x6, 0x0, 0xd, 0x0, 0x0, 0x0, 0x4}, @ringbuf_output={{}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0x4}, {}, {}, {}, {}, {0x7, 0x0, 0xb, 0x4, 0x0, 0x0, 0x1}}, @generic={0x5, 0x3, 0xe, 0x1, 0x80}, @generic={0x7, 0x9, 0x8, 0x4f, 0x81}]}, &(0x7f00000013c0)='GPL\x00', 0x3, 0x32, &(0x7f0000001400)=""/50, 0x41100, 0x8, '\x00', r5, @fallback=0x30, 0xffffffffffffffff, 0x8, &(0x7f0000001440)={0x9, 0x2}, 0x8, 0x10, &(0x7f0000001480)={0x3, 0xf, 0x6d, 0xcb1f}, 0x10, 0x0, 0xffffffffffffffff, 0x0, &(0x7f00000014c0)=[0xffffffffffffffff, 0x1, 0xffffffffffffffff, 0xffffffffffffffff, 0x1, 0x1], 0x0, 0x10, 0x1}, 0x94) ioctl$INCFS_IOC_CREATE_FILE(r11, 0xc058671e, &(0x7f0000001840)={{'\x00', 0x3}, {0x7}, 0x0, 0x0, 0x0, &(0x7f00000015c0)='./file0\x00', &(0x7f0000001600)='./file0\x00', &(0x7f0000001640)="4020c38f7c7191f099f3830fb029af7d88d051405467420afe63f1bf1a5fc49b3075a2c0236bf93a313fcd447ca71b3500e0bf6890eeb9857d15e8884f75153be17579f580c876ebda153fdf47148126bb11488bf2eb449a3e44f96f88262606c51d97364a292a69f3706990a47c4d98aa7f821c9de82fabe6244521be931c255f79cd0b9660324708ed4f5fed1f4a5acaa3f91d65ca2c1fd55aae85e887b9f80b69f19b1f1f1a92425226dbdd6be043d91d0e7a2beb2e60c8f9bab4f1141375493d3f81ea24e73ee4ed561cc614455d29cdae198d21245f71e1fa0dbe302d5108bafb36d1f2ac878d6a49196f4c58876cbc2aa727b2bd2ec13f7b049ab518530ccc4f135d8bbd023de929f720a1eeea01671b33f7aa6fb96f", 0x119, 0x0, &(0x7f0000001780)={0x2, 0x4c, {0x0, 0xc, 0x15, "e528b956432fbcf61532244aa044cfaf0baff308fb", 0x2a, "785f10bf133d48ebc8e6bd271bfaae0a4f4c0af86b4e38ca86efb2129b3e19c2af3a1c17f8a58978a559"}, 0x61, "0e182a11a12e6c44ace3a04f5ff10c4953ec84fb7c72024e5ad48f3876643970389a2923802bfc70e66bf2c6372b29f8ded4bce4f1e0748eb28a3e51f7010bde088bbfad7d09c31a422752dfb580d244829218cf23ca1aa67d9183004d05f46e54"}, 0xb9}) recvmmsg(r2, &(0x7f0000003a80)=[{{&(0x7f00000018c0)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @local}}}, 0x80, &(0x7f0000001dc0)=[{&(0x7f0000001940)=""/214, 0xd6}, {&(0x7f0000001a40)=""/181, 0xb5}, {&(0x7f0000001b00)=""/15, 0xf}, {&(0x7f0000001b40)=""/23, 0x17}, {&(0x7f0000001b80)=""/81, 0x51}, {&(0x7f0000001c00)=""/12, 0xc}, {&(0x7f0000001c40)=""/89, 0x59}, {&(0x7f0000001cc0)=""/228, 0xe4}], 0x8, &(0x7f0000001e40)=""/226, 0xe2}, 0x7}, {{&(0x7f0000001f40)=@pppol2tpin6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @private1}}}, 0x80, &(0x7f0000002200)=[{&(0x7f0000001fc0)=""/60, 0x3c}, {&(0x7f0000002000)=""/199, 0xc7}, {&(0x7f0000002100)=""/250, 0xfa}], 0x3}, 0x2}, {{&(0x7f0000002240)=@l2, 0x80, &(0x7f0000002480)=[{&(0x7f00000022c0)=""/161, 0xa1}, {&(0x7f0000002380)=""/123, 0x7b}, {&(0x7f0000002400)=""/101, 0x65}], 0x3, &(0x7f00000024c0)=""/95, 0x5f}, 0xae3}, {{&(0x7f0000002540)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @remote}}}, 0x80, &(0x7f0000002a80)=[{&(0x7f00000025c0)}, {&(0x7f0000002600)=""/231, 0xe7}, {&(0x7f0000002700)=""/185, 0xb9}, {&(0x7f00000027c0)=""/175, 0xaf}, {&(0x7f0000002880)=""/154, 0x9a}, {&(0x7f0000002940)=""/70, 0x46}, {&(0x7f00000029c0)=""/144, 0x90}], 0x7, &(0x7f0000002b00)=""/12, 0xc}, 0x1}, {{0x0, 0x0, &(0x7f0000002f00)=[{&(0x7f0000002b40)=""/30, 0x1e}, {&(0x7f0000002b80)=""/142, 0x8e}, {&(0x7f0000002c40)=""/79, 0x4f}, {&(0x7f0000002cc0)=""/126, 0x7e}, {&(0x7f0000002d40)=""/61, 0x3d}, {&(0x7f0000002d80)=""/167, 0xa7}, {&(0x7f0000002e40)=""/142, 0x8e}], 0x7, &(0x7f0000002f80)=""/91, 0x5b}, 0x10001}, {{&(0x7f0000003000)=@l2tp6={0xa, 0x0, 0x0, @private1}, 0x80, &(0x7f0000003340)=[{&(0x7f0000003080)=""/15, 0xf}, {&(0x7f00000030c0)=""/43, 0x2b}, {&(0x7f0000003100)=""/167, 0xa7}, {&(0x7f00000031c0)=""/212, 0xd4}, {&(0x7f00000032c0)=""/108, 0x6c}], 0x5, &(0x7f00000033c0)=""/45, 0x2d}, 0x6}, {{&(0x7f0000003400)=@alg, 0x80, &(0x7f0000003980)=[{&(0x7f0000003480)=""/83, 0x53}, {&(0x7f0000003500)=""/149, 0x95}, {&(0x7f00000035c0)=""/191, 0xbf}, {&(0x7f0000003680)=""/45, 0x2d}, {&(0x7f00000036c0)=""/165, 0xa5}, {&(0x7f0000003780)=""/167, 0xa7}, {&(0x7f0000003840)=""/190, 0xbe}, {&(0x7f0000003900)=""/84, 0x54}], 0x8, &(0x7f0000003a00)=""/100, 0x64}, 0x7fff}], 0x7, 0x0, 0x0) sendmsg$IPCTNL_MSG_EXP_NEW(r12, &(0x7f0000003e00)={&(0x7f0000003c40)={0x10, 0x0, 0x0, 0x1000000}, 0xc, &(0x7f0000003dc0)={&(0x7f0000003c80)={0x138, 0x0, 0x2, 0x201, 0x0, 0x0, {0x3, 0x0, 0x6}, [@CTA_EXPECT_ID={0x8, 0x5, 0x1, 0x0, 0xffff171f}, @CTA_EXPECT_TIMEOUT={0x8, 0x4, 0x1, 0x0, 0x55}, @CTA_EXPECT_NAT={0xd8, 0xa, 0x0, 0x1, [@CTA_EXPECT_NAT_DIR={0x8}, @CTA_EXPECT_NAT_DIR={0x8}, @CTA_EXPECT_NAT_TUPLE={0xb4, 0x2, 0x0, 0x1, [@CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5, 0x1, 0x1}}, @CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @loopback}, {0x14, 0x4, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02'}}}, @CTA_TUPLE_ZONE={0x6, 0x3, 0x1, 0x0, 0x1}, @CTA_TUPLE_IP={0x14, 0x1, 0x0, 0x1, @ipv4={{0x8, 0x1, @broadcast}, {0x8, 0x2, @initdev={0xac, 0x1e, 0x1, 0x0}}}}, @CTA_TUPLE_IP={0x14, 0x1, 0x0, 0x1, @ipv4={{0x8, 0x1, @empty}, {0x8, 0x2, @remote}}}, @CTA_TUPLE_ZONE={0x6, 0x3, 0x1, 0x0, 0x1}, @CTA_TUPLE_ZONE={0x6}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5}}, @CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02'}, {0x14, 0x4, @local}}}]}, @CTA_EXPECT_NAT_DIR={0x8, 0x1, 0x1, 0x0, 0x1}, @CTA_EXPECT_NAT_DIR={0x8}]}, @CTA_EXPECT_FLAGS={0x8}, @CTA_EXPECT_MASTER={0x2c, 0x1, 0x0, 0x1, [@CTA_TUPLE_ZONE={0x6, 0x3, 0x1, 0x0, 0x2}, @CTA_TUPLE_IP={0x14, 0x1, 0x0, 0x1, @ipv4={{0x8, 0x1, @rand_addr=0x64010100}, {0x8, 0x2, @local}}}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5, 0x1, 0x3a}}]}, @CTA_EXPECT_ZONE={0x6}]}, 0x138}, 0x1, 0x0, 0x0, 0x40}, 0x1) socket$nl_route(0x10, 0x3, 0x0) pread64(0xffffffffffffffff, &(0x7f0000003ec0)=""/32, 0x20, 0x0) 369.638628ms ago: executing program 0 (id=5136): sendmsg$ETHTOOL_MSG_COALESCE_GET(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000680)={&(0x7f0000000200)={0x2c, 0x0, 0x1, 0x0, 0x0, {0x1c}, [@HEADER={0x18, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'netdevsim0\x00'}]}]}, 0x2c}}, 0x0) r0 = syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10) sendmsg$netlink(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000200)=ANY=[@ANYBLOB="140100002800010004000000f8dbdf2503"], 0x114}], 0x1, 0x0, 0x0, 0x1}, 0x0) pipe(&(0x7f0000000040)) ioctl$F2FS_IOC_COMMIT_ATOMIC_WRITE(r0, 0xf502, 0x0) syz_emit_ethernet(0x1fe, &(0x7f0000000200)={@random="e33110495bfd", @dev, @void, {@ipv6={0x86dd, @icmpv6={0x0, 0x6, "cb653e", 0x1c8, 0x3a, 0xff, @dev, @local, {[], @ndisc_redir={0x89, 0x0, 0x0, '\x00', @ipv4={'\x00', '\xff\xff', @rand_addr=0x64010102}, @private1, [{0x4, 0x33, "9595f429ae08a565c9a41d413a70a44d2e6f790a3872d50bb1d710154d25344dc4b3a281f175f5ee04aab21301b94d966c72c15a143c69205625466855101cf44d89d9f6ee47d77c0d4e53e34b67c542fc6f6f6c60139c43b78286f5bb8f4f11d164af24e2633a45bf4ed944b0ef6a7b7167f73cf54e78686ac09402659c29eb0ce380654c1bb0f61d255b1556b7a311096b7aab867396997ffab76abca01185b08d1e29ee14d8fe61245487104b1c5205c6adc794ba413b92d2d208b86f40983c4819c33b59c1abe2a4b0aa661fcb54e0855d6bb5dd267878ff59bcfc6079e7a5e0135118be22dc6c97e730f7053d6ec34cb64994c78f38f5c966190288a11b5c7c3830af6b26868600f042ff7778f02de78c461feec2dbc7777f3c1648da649b02ab84887d321d98ce20c8e1998b380ba10bc62d1f3965f657d607a0b5dc8c3a0b319b563b758f3368982151727decc966d3971da04a3de762195acbe67019b828d036a19da5c13890cac99197cc8195d6e1db4c557b4278675e1bcd19b8e7cf05330356af6db28c3535b1aef3a597df0a00ac7bbc"}, {0x4, 0x1, "11fb6825931b"}]}}}}}}, 0x0) bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0xd, 0x4, &(0x7f0000000080)=ANY=[@ANYBLOB="b4000057f30000006114a8000000000024bc5000f0ffffff95000000000000001163dc29f5a70a5ab4425a944e6d1cbfbedfb81f8ec88cb2db9dc8b53d84e08bdf22b5027f7639aa9bdd73003006d980a297360b8e5e34bdec8f611734c705aaeda1e6def5ef8c46618f70dbc1cf5f22afe91cf11c6a98b2979cc7731a5d641b391a2938b0b39101334c9dfd210ffe815dea6deaaa7617ea"], &(0x7f0000000000)='syzkaller\x00', 0x5, 0xcab5, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @sock_ops}, 0x48) sendmsg$ETHTOOL_MSG_COALESCE_GET(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000680)={&(0x7f0000000200)={0x2c, 0x0, 0x1, 0x0, 0x0, {0x1c}, [@HEADER={0x18, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'netdevsim0\x00'}]}]}, 0x2c}}, 0x0) (async) syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10) (async) sendmsg$netlink(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000200)=ANY=[@ANYBLOB="140100002800010004000000f8dbdf2503"], 0x114}], 0x1, 0x0, 0x0, 0x1}, 0x0) (async) pipe(&(0x7f0000000040)) (async) ioctl$F2FS_IOC_COMMIT_ATOMIC_WRITE(r0, 0xf502, 0x0) (async) syz_emit_ethernet(0x1fe, &(0x7f0000000200)={@random="e33110495bfd", @dev, @void, {@ipv6={0x86dd, @icmpv6={0x0, 0x6, "cb653e", 0x1c8, 0x3a, 0xff, @dev, @local, {[], @ndisc_redir={0x89, 0x0, 0x0, '\x00', @ipv4={'\x00', '\xff\xff', @rand_addr=0x64010102}, @private1, [{0x4, 0x33, "9595f429ae08a565c9a41d413a70a44d2e6f790a3872d50bb1d710154d25344dc4b3a281f175f5ee04aab21301b94d966c72c15a143c69205625466855101cf44d89d9f6ee47d77c0d4e53e34b67c542fc6f6f6c60139c43b78286f5bb8f4f11d164af24e2633a45bf4ed944b0ef6a7b7167f73cf54e78686ac09402659c29eb0ce380654c1bb0f61d255b1556b7a311096b7aab867396997ffab76abca01185b08d1e29ee14d8fe61245487104b1c5205c6adc794ba413b92d2d208b86f40983c4819c33b59c1abe2a4b0aa661fcb54e0855d6bb5dd267878ff59bcfc6079e7a5e0135118be22dc6c97e730f7053d6ec34cb64994c78f38f5c966190288a11b5c7c3830af6b26868600f042ff7778f02de78c461feec2dbc7777f3c1648da649b02ab84887d321d98ce20c8e1998b380ba10bc62d1f3965f657d607a0b5dc8c3a0b319b563b758f3368982151727decc966d3971da04a3de762195acbe67019b828d036a19da5c13890cac99197cc8195d6e1db4c557b4278675e1bcd19b8e7cf05330356af6db28c3535b1aef3a597df0a00ac7bbc"}, {0x4, 0x1, "11fb6825931b"}]}}}}}}, 0x0) (async) bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0xd, 0x4, &(0x7f0000000080)=ANY=[@ANYBLOB="b4000057f30000006114a8000000000024bc5000f0ffffff95000000000000001163dc29f5a70a5ab4425a944e6d1cbfbedfb81f8ec88cb2db9dc8b53d84e08bdf22b5027f7639aa9bdd73003006d980a297360b8e5e34bdec8f611734c705aaeda1e6def5ef8c46618f70dbc1cf5f22afe91cf11c6a98b2979cc7731a5d641b391a2938b0b39101334c9dfd210ffe815dea6deaaa7617ea"], &(0x7f0000000000)='syzkaller\x00', 0x5, 0xcab5, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @sock_ops}, 0x48) (async) 364.983649ms ago: executing program 3 (id=5137): r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000540)={&(0x7f0000000140)=@newlink={0x44, 0x10, 0xff05, 0x0, 0x0, {0x0, 0x0, 0x4a00, 0x0, 0xffc3}, [@IFLA_LINKINFO={0x24, 0x12, 0x0, 0x1, @bond={{0x9}, {0x14, 0x2, 0x0, 0x1, [@IFLA_BOND_RESEND_IGMP={0x8, 0xf, 0xff}, @IFLA_BOND_MODE={0x5, 0x1, 0x6}]}}}]}, 0x44}}, 0x0) r1 = socket$inet_smc(0x2b, 0x1, 0x0) bind$unix(r1, &(0x7f0000003040)=@abs={0x0, 0x0, 0x4e24}, 0x6e) socket$can_bcm(0x1d, 0x2, 0x2) r2 = epoll_create(0x2) epoll_ctl$EPOLL_CTL_DEL(r2, 0x2, r0) 335.405217ms ago: executing program 1 (id=5138): r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000037c0)={0x0, 0x0, &(0x7f0000003780)={&(0x7f00000005c0)=@newtaction={0x8c0, 0x30, 0x12f, 0x4, 0x0, {}, [{0x8ac, 0x1, [@m_police={0x8a8, 0x1, 0x0, 0x0, {{0xb}, {0x87c, 0x2, 0x0, 0x1, [[@TCA_POLICE_RATE={0x404, 0x2, [0x4, 0x0, 0x0, 0xfffffffc, 0x7, 0xfffffe00, 0x0, 0x0, 0x0, 0x0, 0x400, 0x0, 0x3, 0x0, 0x2, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x80, 0x6, 0x0, 0x0, 0x1, 0x3, 0xffff, 0x0, 0x1, 0x10000, 0x0, 0x0, 0x0, 0xfffffffe, 0x0, 0x0, 0x1000000, 0x0, 0x0, 0xfffffffc, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0xc74, 0x0, 0xffffffff, 0x10, 0x0, 0x0, 0x0, 0x0, 0x3, 0x8, 0x0, 0x0, 0x0, 0xfffffffc, 0xe4ffffff, 0x0, 0x0, 0xffffffb5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4006, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xcf, 0x0, 0x0, 0xffffffff, 0x0, 0x0, 0x1000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1000, 0x0, 0xfffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xc00, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0xfff, 0x0, 0x1, 0xfffffffc, 0x0, 0x2, 0x20000000, 0x8000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x20000000, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10001, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000]}, @TCA_POLICE_TBF={0x3c, 0x1, {0x0, 0x0, 0x0, 0x0, 0x10, {0x7, 0x0, 0xba6d, 0x0, 0x0, 0x7}, {0x0, 0x0, 0xb}}}, @TCA_POLICE_RATE64={0xc, 0x8, 0xfffffffffffffff9}], [@TCA_POLICE_RESULT={0x8}, @TCA_POLICE_RESULT={0x8, 0x5, 0xfffffff5}, @TCA_POLICE_RATE64={0xc, 0x8, 0x8000}, @TCA_POLICE_RATE={0x404, 0x2, [0xbdd, 0xe, 0x8, 0x3, 0xfdc7, 0x8, 0x748, 0x40, 0x140, 0x129, 0x4, 0xc3f, 0x6, 0x9, 0x9, 0xae9a, 0x0, 0x1, 0x40, 0xa, 0x76, 0x0, 0x4, 0x9, 0x2, 0xffffffff, 0x1ff, 0x8, 0xc, 0x1, 0x0, 0xd, 0x1, 0x3, 0x6, 0x0, 0x100, 0x9, 0x3, 0x0, 0xe1, 0x200, 0x7, 0x4, 0x2, 0x4, 0x4, 0x4, 0x1, 0x4, 0x3, 0xfffff1a2, 0x6, 0x710, 0x8, 0x4, 0x9, 0x4, 0x6, 0x0, 0x45, 0x5, 0x80, 0x3, 0xfffffff6, 0x7, 0x8000, 0x0, 0x1, 0x1, 0xffff, 0x9, 0x5, 0x4, 0x10, 0x4, 0x5, 0xfffffff9, 0x8, 0x0, 0x1, 0x1, 0x10000, 0x7, 0x6, 0x3, 0x7, 0xd9d, 0x5, 0x2, 0x0, 0x4, 0x4, 0x53, 0x7, 0x81, 0x100, 0x200, 0x3, 0xfb5, 0x56, 0x6, 0x8000, 0x6, 0x9, 0x10001, 0x9, 0x7ff, 0x173f, 0x101, 0x0, 0xb0f, 0x4, 0x10001, 0xd0fe, 0x10001, 0x9, 0x91dc, 0xb, 0x80000001, 0x800, 0x1, 0x6, 0x5, 0x200, 0x8, 0x7f, 0x4, 0x6fb61325, 0x1c, 0x2, 0x800, 0x4, 0x2073, 0x3b2, 0x9, 0x1386, 0xffffff1c, 0x6, 0x4, 0x6, 0x3, 0x6, 0x10, 0x2, 0x5, 0xa00000, 0x36, 0x0, 0x400, 0x3, 0xfffffe01, 0x6, 0xfffffffe, 0xb85, 0x5, 0xffffffff, 0x8, 0x1, 0x1, 0x9, 0x4289, 0x80, 0x5, 0x4, 0x80000001, 0x5, 0x2, 0x10001, 0xf, 0xfffffffc, 0x80, 0x3, 0x8001, 0x343c, 0x3, 0x0, 0x101, 0x5, 0x5, 0x2, 0x1, 0x7, 0x80000000, 0xbd, 0x2, 0x6, 0x2, 0x0, 0x81, 0x0, 0x7, 0xe, 0x3, 0x0, 0x92, 0x0, 0x0, 0x1030, 0xffffff81, 0x5, 0x7fb, 0xffffff94, 0x7, 0x3, 0x1, 0x7fffffff, 0xe, 0x80, 0x7ff, 0x5, 0x5, 0xf65, 0x8000, 0x1, 0x7ff, 0x4, 0x2, 0x6, 0x0, 0x8c, 0x0, 0x3, 0x9af2, 0x3, 0x800, 0x700000, 0x4, 0x1, 0xffff, 0x0, 0x1, 0x100, 0x1, 0xfff, 0x7fffffff, 0x1, 0x1, 0x10000, 0x33, 0x100, 0x4, 0x8, 0x4c, 0xfffffffc, 0x40, 0x0, 0x81, 0x4c, 0x5, 0x30, 0x7, 0x2, 0x9, 0xdae5, 0x6]}, @TCA_POLICE_PEAKRATE64={0xc, 0x9, 0x7}]]}, {0x4}, {0xc, 0xb}, {0xc, 0xa, {0x1}}}}]}]}, 0x8c0}}, 0x0) 228.412046ms ago: executing program 2 (id=5139): r0 = socket$inet6_sctp(0xa, 0x5, 0x84) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r0, 0x84, 0x6f, &(0x7f0000000140)={0x0, 0x1c, &(0x7f00000002c0)=[@in6={0xa, 0x4e24, 0x9, @private2={0xfc, 0x2, '\x00', 0x1}, 0x7177}]}, &(0x7f0000000180)=0x10) setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(r0, 0x84, 0x9, &(0x7f0000000080)={0x0, @in6={{0xa, 0x4e24, 0x9, @private2={0xfc, 0x2, '\x00', 0x1}, 0x7}}, 0x5, 0x0, 0x80000003, 0x104, 0xe2d8f2eb1d010935, 0x7, 0x6}, 0x9c) r1 = socket$qrtr(0x2a, 0x2, 0x0) connect$qrtr(r1, &(0x7f0000000040)={0x2a, 0x1, 0xfffffffe}, 0xc) r2 = socket$qrtr(0x2a, 0x2, 0x0) recvmmsg(r1, &(0x7f0000000ac0)=[{{0x0, 0xff2c, 0x0}, 0x1}], 0x40, 0x2, 0x0) r3 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r3, &(0x7f0000000000)={0x3, 0x0, &(0x7f0000000340)={&(0x7f0000000480)=ANY=[@ANYBLOB="02030003100000002cbd7040fcdbdf2502000900080000001c0000000000000005000600000000000a004e23000003ffff010000000000000000000000000001010000800000000002000100fffffffe000007020000008005000500000000000a"], 0x80}, 0x1, 0x7}, 0x804) connect$qrtr(r2, &(0x7f0000000040)={0x2a, 0x1, 0x4000}, 0xc) writev(r2, &(0x7f0000000340)=[{&(0x7f0000000400)="090000000000000030548abafb54c8ec", 0x10}], 0x1) socket$nl_xfrm(0x10, 0x3, 0x6) setsockopt$ALG_SET_KEY(0xffffffffffffffff, 0x117, 0x1, &(0x7f0000000400), 0x0) r4 = socket$vsock_stream(0x28, 0x1, 0x0) bind$vsock_stream(r4, &(0x7f0000000440)={0x28, 0x0, 0x2711}, 0x10) listen(r4, 0x709) r5 = socket$vsock_stream(0x28, 0x1, 0x0) writev(r4, &(0x7f0000000280)=[{&(0x7f0000000240)="18620cdb09511c8f07ef7a2fa2f074c04105848eb6e73bed78073069c4c7730c03a1edbcc57620ec4cdcef0e168473d467b7294ace332ad5f7c22c", 0x3b}, {&(0x7f0000000380)="99c39b58df5c93937840b3e496225b778c31cd0b746252c3eaf5490ecacb64d0fd3d3acd5077daf1a07004ccfbdd61a63b41d10515524784c35b00ba5091247dd0a472fba8cad8fc15eb15fb", 0x4c}], 0x2) connect$vsock_stream(r5, &(0x7f0000000100)={0x28, 0x0, 0x0, @local}, 0x10) socket$vsock_stream(0x28, 0x1, 0x0) connect$vsock_stream(r4, &(0x7f0000000040)={0x28, 0x0, 0x0, @local}, 0x10) close(0x3) r6 = socket$alg(0x26, 0x5, 0x0) bind$alg(r6, &(0x7f00000001c0)={0x26, 'aead\x00', 0x0, 0x0, 'aegis256-generic\x00'}, 0x58) socket$nl_route(0x10, 0x3, 0x0) r7 = socket(0x10, 0x803, 0x0) sendmsg$IPVS_CMD_SET_INFO(r7, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000ac0)={0x0}, 0x1, 0x0, 0x0, 0x44051}, 0x844) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) r9 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r9, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000380)=ANY=[@ANYBLOB="3c0000001000850600"/20, @ANYRES32=r8, @ANYBLOB="01000000000000001c0012000c000100626f6e64000000000c0002000800010006"], 0x3c}, 0x1, 0x0, 0x0, 0x44}, 0x24000000) 183.636092ms ago: executing program 1 (id=5140): sendmsg$IPSET_CMD_SWAP(0xffffffffffffffff, &(0x7f0000000100)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x10}, 0xc, &(0x7f00000000c0)={&(0x7f0000000040)={0x64, 0x6, 0x6, 0x801, 0x0, 0x0, {0x1, 0x0, 0xa}, [@IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_SETNAME2={0x9, 0x3, 'syz0\x00'}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz2\x00'}, @IPSET_ATTR_SETNAME2={0x9, 0x3, 'syz0\x00'}, @IPSET_ATTR_SETNAME2={0x9, 0x3, 'syz0\x00'}, @IPSET_ATTR_SETNAME2={0x9, 0x3, 'syz1\x00'}, @IPSET_ATTR_SETNAME2={0x9, 0x3, 'syz1\x00'}]}, 0x64}, 0x1, 0x0, 0x0, 0x4000045}, 0x69ad1f5f8ce413c3) r0 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl80211(&(0x7f0000000140), r0) r1 = syz_genetlink_get_family_id$ethtool(&(0x7f00000001c0), r0) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r0, 0x8933, &(0x7f0000000200)={'batadv_slave_0\x00', 0x0}) getsockopt$inet6_mreq(0xffffffffffffffff, 0x29, 0x15, &(0x7f0000000240)={@remote, 0x0}, &(0x7f0000000280)=0x14) bpf$BPF_GET_MAP_INFO(0xf, &(0x7f0000000340)={0x1, 0x58, &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, ""/16, 0x0}}, 0x10) sendmsg$ETHTOOL_MSG_LINKSTATE_GET(r0, &(0x7f00000004c0)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x218000}, 0xc, &(0x7f0000000480)={&(0x7f0000000380)={0xd0, r1, 0x20, 0x70bd2a, 0x25dfdbfe, {}, [@HEADER={0x44, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x1}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'wlan0\x00'}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x2}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'wlan0\x00'}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x3}]}, @HEADER={0x78, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r2}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r3}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'veth0_macvtap\x00'}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'veth1_macvtap\x00'}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r4}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x2}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'veth0\x00'}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x2}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x2}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8}]}]}, 0xd0}, 0x1, 0x0, 0x0, 0x410}, 0x40000) r5 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$sock_ipv6_tunnel_SIOCGET6RD(r5, 0x89f8, &(0x7f00000005c0)={'ip_vti0\x00', &(0x7f0000000500)={'sit0\x00', r2, 0x7800, 0x10, 0x263, 0x200, {{0x25, 0x4, 0x0, 0x8, 0x94, 0x67, 0x0, 0x9, 0x2f, 0x0, @private=0xa010101, @multicast2, {[@lsrr={0x83, 0x1f, 0x75, [@dev={0xac, 0x14, 0x14, 0x3c}, @private=0xa010100, @rand_addr=0x64010101, @dev={0xac, 0x14, 0x14, 0x1b}, @local, @loopback, @rand_addr=0x64010100]}, @noop, @lsrr={0x83, 0xf, 0xa0, [@broadcast, @broadcast, @rand_addr=0x64010100]}, @ra={0x94, 0x4}, @generic={0x86, 0x5, "8df2e2"}, @ssrr={0x89, 0x13, 0xc4, [@broadcast, @remote, @empty, @private=0xa010102]}, @ssrr={0x89, 0x7, 0x47, [@dev={0xac, 0x14, 0x14, 0x17}]}, @timestamp={0x44, 0x18, 0xcc, 0x0, 0x2, [0x5, 0x8001, 0x4, 0x101, 0x0]}, @rr={0x7, 0x13, 0x67, [@empty, @rand_addr=0x64010100, @initdev={0xac, 0x1e, 0x0, 0x0}, @remote]}]}}}}}) r6 = socket$inet_udp(0x2, 0x2, 0x0) sendmsg$DEVLINK_CMD_GET(r0, &(0x7f0000000740)={&(0x7f0000000600)={0x10, 0x0, 0x0, 0x820}, 0xc, &(0x7f0000000700)={&(0x7f0000000640)={0x8c, 0x0, 0x0, 0x70bd2d, 0x25dfdbfd, {}, [@pci={{0x8}, {0x11}}, @nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, @nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, @pci={{0x8}, {0x11}}]}, 0x8c}, 0x1, 0x0, 0x0, 0x4000000}, 0x404c000) r7 = socket$inet6_icmp(0xa, 0x2, 0x3a) ioctl$sock_inet_SIOCGIFADDR(r7, 0x8915, &(0x7f0000000780)={'caif0\x00', {0x2, 0x0, @dev}}) preadv(r6, &(0x7f0000000940)=[{&(0x7f00000007c0)=""/155, 0x9b}, {&(0x7f0000000880)=""/190, 0xbe}], 0x2, 0xf24f, 0x3) sendmsg$IPSET_CMD_FLUSH(0xffffffffffffffff, &(0x7f0000000a40)={&(0x7f0000000980)={0x10, 0x0, 0x0, 0x40000}, 0xc, &(0x7f0000000a00)={&(0x7f00000009c0)={0x34, 0x4, 0x6, 0x101, 0x0, 0x0, {0x3, 0x0, 0x8}, [@IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_PROTOCOL={0x5}]}, 0x34}, 0x1, 0x0, 0x0, 0x5}, 0x40) sendmsg$ETHTOOL_MSG_EEE_SET(r0, &(0x7f0000000b40)={&(0x7f0000000a80)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f0000000b00)={&(0x7f0000000ac0)={0x20, r1, 0x800, 0x70bd25, 0x25dfdbfc, {}, [@ETHTOOL_A_EEE_HEADER={0x4}, @ETHTOOL_A_EEE_ENABLED={0x5}]}, 0x20}, 0x1, 0x0, 0x0, 0x800}, 0x80) syz_emit_ethernet(0x4c, &(0x7f0000000b80)={@random="4bcd089e551e", @dev={'\xaa\xaa\xaa\xaa\xaa', 0x31}, @val={@val={0x88a8, 0x7, 0x0, 0x2}, {0x8100, 0x2, 0x1, 0x1}}, {@llc={0x4, {@llc={0xaa, 0xe, "8337", "bd28dfebd9d3404bee4f51da4fbd7cc3fe5281ae39e722e2a72c888d08300aec8bd15f216a19ba15823883c32d6d1bca806b"}}}}}, &(0x7f0000000c00)={0x0, 0x2, [0xe5d, 0x578, 0xc60, 0x902]}) getsockname$inet6(r7, &(0x7f0000000c40)={0xa, 0x0, 0x0, @ipv4={""/10, ""/2, @private}}, &(0x7f0000000c80)=0x1c) r8 = syz_genetlink_get_family_id$fou(&(0x7f0000000d00), r0) sendmsg$FOU_CMD_GET(r0, &(0x7f0000000dc0)={&(0x7f0000000cc0)={0x10, 0x0, 0x0, 0x20}, 0xc, &(0x7f0000000d80)={&(0x7f0000000d40)={0x24, r8, 0x500, 0x70bd28, 0x25dfdbff, {}, [@FOU_ATTR_LOCAL_V4={0x8, 0x6, @multicast1}, @FOU_ATTR_PEER_PORT={0x6, 0xa, 0x4e24}]}, 0x24}, 0x1, 0x0, 0x0, 0x40}, 0x20044000) socket$inet_icmp(0x2, 0x2, 0x1) r9 = socket$netlink(0x10, 0x3, 0x12) r10 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000e40), r0) sendmsg$MPTCP_PM_CMD_SUBFLOW_CREATE(r9, &(0x7f0000000f40)={&(0x7f0000000e00)={0x10, 0x0, 0x0, 0x10}, 0xc, &(0x7f0000000f00)={&(0x7f0000000e80)={0x48, r10, 0x10, 0x70bd26, 0x25dfdbfb, {}, [@MPTCP_PM_ATTR_LOC_ID={0x5, 0x5, 0x7}, @MPTCP_PM_ATTR_LOC_ID={0x5, 0x5, 0x7f}, @MPTCP_PM_ATTR_TOKEN={0x8, 0x4, 0x100}, @MPTCP_PM_ATTR_ADDR_REMOTE={0x4}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x5}, @MPTCP_PM_ATTR_TOKEN={0x8, 0x4, 0xffff}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x1}]}, 0x48}, 0x1, 0x0, 0x0, 0x44801}, 0x800) sendmsg$inet6(0xffffffffffffffff, &(0x7f0000001240)={&(0x7f0000000f80)={0xa, 0x4e20, 0xfffffffb, @mcast2}, 0x1c, &(0x7f0000001200)=[{&(0x7f0000000fc0)="7a4c116658aedbb5b2caadefd424a264df6bab7102e57941e85b782b392028ce554e41e717610b08ded3bfa388ce71de251ad841943f21e846e5a2121c04e85a5204ac5c90e239556f9f3e1490399eb5a488945278f0723eb82097", 0x5b}, {&(0x7f0000001040)="9252356e61a9e717e610952a81755d6e3999f83ddf8230a26e5e9a2dcaf297187dc16a8edb5dccbac6c74b50271fd3fe4d5175409e9a309d26427870f061a0fd69a972d16e85ead3b9906132407cffd82dceb67b359e5863f05dc82d37b048a907d51943cc00b6b788de934d122c35b63e06d3ca4afd3e16a66c203a5f2572cea02fa37e1aa3ccd5b3a314a5865a11786be9dfe212af5ebc2e56d43bd9de1ffaef798b1286ac70d766bd71af49e5a9c5a2ab16ab7e7da0c6971eeaff7baa97fe770580c3e20841e15878b3d3731252bcfec735afe0bf652a2acd39f456e1dd489a77e789598465b2e3b9dba1d8ad5b6e48", 0xf1}, {&(0x7f0000001140)="6e7c1488d898891a29907ad4e27702bed01cc14766ddfabf9b79b3094d0e", 0x1e}, {&(0x7f0000001180)="6879a6d55cc1cafe50d8e9be07a75d2329448144a7907a377f411904855696c775c5d06d09f8d432b43073a43586a68b991bc947b98bb06419ca861e4c34bd8bb38416558c5be2a32592ba09e23dffd84df9a0bf9414427894fdead7f5e9251077", 0x61}], 0x4}, 0x4048000) r11 = syz_genetlink_get_family_id$l2tp(&(0x7f00000012c0), r0) sendmsg$L2TP_CMD_TUNNEL_MODIFY(r0, &(0x7f0000001380)={&(0x7f0000001280)={0x10, 0x0, 0x0, 0x2000}, 0xc, &(0x7f0000001340)={&(0x7f0000001300)={0x1c, r11, 0x300, 0x70bd29, 0x25dfdbfb, {}, [@L2TP_ATTR_PEER_SESSION_ID={0x8, 0xc, 0x1}]}, 0x1c}, 0x1, 0x0, 0x0, 0x20000841}, 0x20000040) r12 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$IPVS_CMD_SET_INFO(r12, &(0x7f00000014c0)={&(0x7f00000013c0)={0x10, 0x0, 0x0, 0x8}, 0xc, &(0x7f0000001480)={&(0x7f0000001440)={0x1c, 0x0, 0x8, 0x70bd25, 0x25dfdbfe, {}, [@IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4, 0x1}]}, 0x1c}, 0x1, 0x0, 0x0, 0xc0}, 0x40000) 132.134789ms ago: executing program 0 (id=5141): r0 = socket$nl_sock_diag(0x10, 0x3, 0x4) connect$netlink(r0, &(0x7f0000000000)=@kern={0x10, 0x0, 0x0, 0x100000}, 0xc) ioctl$TUNATTACHFILTER(0xffffffffffffffff, 0x401054d5, &(0x7f00000000c0)={0x9, &(0x7f0000000040)=[{0x1, 0xfc, 0x4, 0x8}, {0x2, 0x7, 0x8}, {0x800, 0x3d, 0x8, 0x7140da65}, {0xfff, 0x78, 0x6, 0x1000}, {0x3, 0x77, 0x4}, {0x6, 0x0, 0x84, 0x7fff}, {0x5, 0x3, 0x8, 0x3}, {0x5, 0x30, 0x0, 0x2}, {0x11d8, 0x6, 0x9}]}) r1 = bpf$ITER_CREATE(0x21, &(0x7f0000000100), 0x8) sendmsg$TIPC_CMD_GET_MAX_PORTS(r1, &(0x7f0000000200)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x800000}, 0xc, &(0x7f00000001c0)={&(0x7f0000000180)={0x1c, 0x0, 0x100, 0x70bd29, 0x25dfdbfd, {}, ["", "", ""]}, 0x1c}, 0x1, 0x0, 0x0, 0xc1}, 0x20000000) ioctl$BTRFS_IOC_TREE_SEARCH(r0, 0xd0009411, &(0x7f0000000240)={{0x0, 0x2, 0x8, 0x4f8, 0x0, 0x10000000000, 0x2, 0x8, 0x1, 0x9, 0xc3e7, 0x10, 0x5, 0x5, 0x4}}) ioctl$BTRFS_IOC_INO_LOOKUP_USER(r0, 0xd000943e, &(0x7f0000001240)={0x0, r2, "47e147c801ce21d3c0fa9b77d09add76fa17f5613ad8bff173a97e525a7073e43546626d1b172de7cd366f5353d2239f1308d8b2f21423dd109c51a6ce2ef56f3141278080c2a9dfd88f7f31e2c49ff07f50eb4d5d6b1238bed2690dd7ade3055a7a8d1c669d51956e6131ab09688b09a4156e335e60e13ee8ae721ddba582aaf3c7c5f198e6c03c7b079b0f2b8765ca4b3fcf520adc7da3aa2cc5526a086da27435ac5d43bc1484fab6a85c03a6adbf03156ec1e5a11d90a537d4f6c6ff8fa4135ca83d23c8139f426c37e4d3a242379e9c883d4cf82cda74b750b1b5e5020bab49fc2d252ce3b12034cefbe4af38bfeb88a27313eb7c4b89a57b259a6f3bc2", "2459f3bd09c2447dbab7c9d5aca147e3f05e11262d6ad935dbd551939cb9cd3f183d318e4c88b61ac4fc39988d49e81d844b40811270802e4f991f7a5264818b7915dd98b2b3a0e8b094ccf788ff9f17b860ae6aec7cb2d84104272f0bbe94c07d3380fa6fcfaf97e26266415d312dcf6bbab8946c380f586899d45a02cbb88dc4f6b9579659edb453e4428e24dfb1db55c5037dd3cc5e743efb77c546339109e9b29d3dced452b0efcbb46a909d50e8d76f95c5ecbda927a251bdfcd36bbb91f2c7b46c1a49b0fd66f115459f2763c1ecd86f830a14761e0cc00a6356235c6bd077c893f88b71ba43f48a70db505533601367b17c82db034c3f3fd0b7b83a09c0d5bfec10c8f1162064771eb4085aec6eae959f373284f71ed4babc234d0c5f370aad62ef788ca1dca4d29d382766d082122ded4f02c180bff70391a25c5b23fb39e18a7a6722a428cf8c520356f4c8883af4f107ebadca1d147ea73e694767198682812be71829a8dbe19e2922b4f5fa55f3716d194e01f253d64b77a4949aeb83e7a061a2a863ac3bbd746d0ba36a80d919966833ab948382d9b1c06607325b176fe255634c9057039a6745971ede6654c5d6fba13d5f879cafbac40a2b6d4e75c12a334def54310bdcc6a0e8d9eeef53a8f354c8bbcdd80b73bf3966ed5459d398acff12b086499426d5af95f2af76adf56c3e2550c4244c622ce411fdb3771d27ebab332a3806f3edffd3cd27fbef62f24f92479de8dd20f41b3210b1970f37c235e1a46969cbc016f25ac0d64aab303788d6a6c93e57c2a7de48812494f6aef6de0d84d0bc656f30c37d2bfece36e6b52d1420e2483f970b4eecfbbb19217cf7feb34b696782e7ea2a48864c37c62bacafeb041cf3fffa6f7e57f762cc322be440f9243312fe2bec639560c118e62b05fa10e1d1f8fccbb510d8ef971d805e71cb49081c5b28507962b15f7ebf9209825b5e073b8d947f32a626d9579c12e74e34a6aa3820c2eede0cebf1da9727060a2d6343a658ee0565df9159769de4a9aa3f4c417d0fb21b9a989fea4243195c506c785d87ee81c1596d08409fdb6114eac34090d64090d9b7f2ca35f9d4220ce213a9555bcd89c4efc06a8e5f1ac2a3ce0d99424403d9f365934395d19e707ebacc4958c27529d5246d15b62ca6c174c32f1348610d32e133832f9eb585a75d607361e8881dfba43fe77cb735bfa4f5d2c6f5053703acb6b6bf5746e82ac8b71c2f303843873c3ca30e7855e58441748d9c2878a6f998d197a8a6bec8e4df5f193442bba4f30902bc8ebff083bd52c8b57f613386f9c7891eb866cdb72057744f78b7f7d33970a6f7b7cbf8c79846148bad427731e469761d5cc9dace52f20558bc4df4ac2a74983a56b07f8cc51a0fa76bd00ba65293ab7ad3ea35c3f677fd401373f7d501918bcd5afea71d9d5b893fa5cfc4eedef21c299e04271e063026eae6647ef05edd3f937bfdf6a24849e336166198a98cd8668a90a8437c4f6d6b9723d655101d0e4cb39efa31ea2b71082ab9defade0c094fabd3030765a253b6e00254640c8659940e18952c512ca2cf490ba68b218e10e9a313b5a3b324219745650e92ed1523a0d1e8d008def7618aecfdd399a10e48532efece4e9f91b479fc6443f2b6fdbc3fb0e029ca53be93d63e26b91378096339c539babebfb9a307f5c99f447bc591d3d70ab421e6d99c4e7203c4205f55215ad1403e182f8dc3f3c476b25f6a31ded8f475532ca7017ed74552e08106ab5560fccfb6719873f01f09b84da103a31e48bb52c281524355e8c98a1b8f53fe510bed7eba7c67afa7dde49ead0b51835d24c34f785cc430ed7f5b90919d9fb24cbc4b7f6dd88dca4e5311995a08f198923e451ce91ee161f818abe4645465c238a9e552893c740487c275a31765e960cd63bcb413a2e3c7b63e7a21922aa49c601087d94d8e00743985e3f2600158ab5300a90ea114be76c8efa5dea75396c7088934157ea1a74e761c573656950fcbe46cc044b5faf5610578a810aca5ffe8dfefc2df7fdf50fa1cf3499f0f413074aea32142f1ef7d63af76ceebcfd747287c47922e519c4caf91b87da23c07a89b92c4684a96239c70025190edee5858020376809a341b108661970b870d857510ad12efbbbf392eea3ba69f6bebd49acb2c3c01211f7aa1a9b8a5618182eec9c4a549c2b9768114adc4328b2715dfefbafa7a818c2947aeb635453ba9843dc7134b8612fcfffa9ea8daf6bfe1a5015a84440c113052ad15585e392b1edb3a55f74e0504e3faa6dacf8dc76844670644db7df602c1db32a913eea124dfa0828882dcf38c85d0f0d64a586f9c458b0a8e3111dd9051511e632ce25f127b34b771a514bb272e4668cc1857a1d5353034a1191a8f40c34b1b9d4918e67afd75b92b597ded07570bd10cf2ca65ffef2a30d0415d52b6d7e6a5139efaf5dbdd7ebdec6bc94d2f62372f94ae397eb6513cdd15f0eec0c3379935b451eafeb5d4dfa4551442b356aa6587daa45c9fbdc49a858fd94a734ba97a7ef3d2f2316f3eaf679a2c9e0446b64306533ef82ba826a2e144ea1e768900d1a50fd8a189a93d867f10ce93eff0d5b8d1482c8e7b981c2a8be91c734756c86d986d8ec8e3ae0d82a8a578cdff5fd3b2a4f06a4128c347ae2f38a7023c84be60615681ad7265154fb989a10040467a1d9f6396924931b57c3f35d53e2773fa5d5ebb259e6a09f74d7ca2216f57fa7a6f337f5c448e4377cf9979aa4ef90eb16bba6c54dbcc44ed9b19956f7cd74354662fe2548892080d281a568c6904c755e60c454578ad5860f183dc2341066058eba41bdc8da0d483311484f4f4fd63ae04de7e0bca90b50ce64ca8fa5daf0578328f97baca920f6279df8d34040592d58ab582f798a63ecd05cbf93e7c6cb53d98f7e2a249c11c3e15f79016733133985390b5e5f676cee52d4a7dd6af87c01f246e16112931769796df821344138924f0c957aac49a02a5a1a09c962e620315019c82a934674f9ae21d74d1b5ce217e4d544ea90fa3a9463677f3ddf0c4f5fa40750f1bb438997af53f73841c81cd70c1cc5699dccef3b6f34352805c502373f4fb06951b5e4baef8a701e72d81874c27858cde9570ac1fb22590c8b052dc0858458afa1b4311acf3e0f512667f991f860f42d0f5ac71a88fb09c327ff5899746bd579eb515f2e36a80b5ed00d257b2764ed0fe3ba01b083aa2ba98af1c2caa16d1f7d5aca0c6e5418866c3899d735093cfd8afa1448f841ba5380a220c5d9ea796a84c5c989669fdd60d569032439be2ac96dd98259e9afc01635964a3946bc7e73eee64acc70ac2433b6b9772be5955d9c00010df05563cebf3c4c69bbeefaccb6eb449815e9d2a3179e60a7a0b7d94f56f75daa4a5ff017c4912d6fc856585a19247d4b8c94c277a6112547ac5c69f4f4db0a45d7620fa050d07730d5686410af9e41474ea1d42dc60c6c8b219910b628ace79ca6cce579d20cee68c543af017efcd0659b85a4febcc920434103d69afc6376c815960657d81f552acf9b7bfeaa6d51a2762ede8c486da5af3f0e7f501e3f508bf0c3f5f0da12545fb4cc7e5f5aa158c7f18eba1b44d0892bdcd97658325d2a2f18d62ffd6f8e39bcdf2d98075236142a951b89f7231a20fe96243abeddc21f9b5f888edd9f94e5df18b2f40fe88247d6ca8d0af80f65756c751984946f2087f19b9ae576b3d981b9ceaf1e9ed938a9320417f35ca20f8c9597148a52ec2065b884e6469246ff553c0b8a4757798b836f7e3bbf69292bd430a94d8f63a8789bda29df797a45010991599ea35b56177e11af50dff7c18511afc31474f99b4bd7f171a8cbede738f29cbc81a2e8e0cbf35c8644eeccb6fd69d080ba28e3fc1ff71b09feed242c9bd57f92e51b278ca7b7006fb4ea0d9019e771f1cbb83168383a40ddd55313b45e22b7e66e4e3fb97ff54546d04e760f4cea6cd47734c71d44086399fca10327cfd5b6fc526dcef7d4116b39d8142f4e85e6234ec79e9c346180db451e1693ba5b1989981a801028b9236ec986308a2c7fa21b4a3017d11fdc4c49974e2736919a57483726769411b9fa945fffa37bd2fc7368eed7dc0c19d34ce22a45d246ed5420426f718df4d7a1f9ff1f24c3a767b0028975c9b500b5430ded592dfbd5aebf760d7755cc03429eb3685ad603ad210e782586fefc3f5b67256e77032f9f340dfedd9ecde13be4efe3fdeb445be37c57d0a35495c0f9e03e763dbc866ca36dd46d2226e9044208695b73afdc66833551d371dc0cea0ff286fd8e726f554ade074abcda55ec57dfb97f78f2b203291010e95441071476dca10c9c023c5a2082edb5bfb07388b3c3fdb993e93eeb5ddc580326cac2fd5a326e9c2701302ffc4ea3b0a5bebab63909961406fa13aa6ef16ffa4888076aae4f89451422cf770a9c80df56d7c89f728268943dc841697c072ab63421ad7eb8f14be9036a8fed12fa0ca9428686df3e423dfde20da44cf5610e42c666aa205bc6e74d49779e02634c4d8f1b3c69c9ad92fd29c86a54260b4b242bfb170bfa2b33da804ef3405cc776b2c846d4958dc567f49929866a6fc19ec0a385e22910cd5c5a9868e431d692e2d193ec2d9bed4a8573ade4797bff85df3215066fa64cbcbaa43385531946bb944ee32d107f58402770a89cef426726cfffb71dd15f5f77a3b7aae111ceaffa6202ad95d5f3fff542c00d92e0e0f9011decce4669e96774c3bb18b392d66317e9a1c7a60bd5ea8a01e97f0bebeb3dc0162615a27166fc1e6133d6e1ec5d375ebd2417e0b6d647241e34ce9bf47145765786eda3ce1c9fbcb69adc2e2a7954814becd1a2968f6c668d12b712eb8eaf3b98d03fe80a2523039fd30933002447f7407a87ead0f6ba5914ea5616cfa8183ed2ee68d95b544ad979df46b106919ab795a26c53119da00be52e6ee03ea6bc2fb3ea1ba71ea0a1a798b4e6c37f58a14d25cf030307601df87f5649a79da7d94e42e56b09a5d2aca28d8350f70265519e45553f9c5c2bb99f4b6e0c9e5b66c667ca1c647a1c0caea3a74cdf1fa01ed1ab34cecd45ebb28b446787a586356da22c4242a6023ba6fdd033b90dca194d9456e58b1ee53f7e2b6fde1f3eb88009699869cd13a3a2f5e5ed00ff77e16b41261bc750d2f0085dcecbc7d0bcc9a3ef86476f967868e7db4d13d51ad0c0c84e91d8641d46ae2756c063ba702ec56d05d720e95f039c7593e9aed52939b8531b7aeddf4985eea2c05e2c99a3da0356aa8339574ac30ff24b94f9d25a0e88d646b2b4bfb2354091eac6cd420e1d1f02700d91e25bd69df08046a157ce31d9602bb9b63c6d3ca23deddee3d59696f477bc5e025b689579ad37bbe4efcca"}) r3 = syz_genetlink_get_family_id$ethtool(&(0x7f0000002280), r1) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(r1, 0x89f2, &(0x7f0000002340)={'ip6_vti0\x00', &(0x7f00000022c0)={'ip6_vti0\x00', 0x0, 0x4, 0x1, 0xf8, 0x6f2, 0x1d, @private2, @mcast2, 0x7, 0x7, 0x6, 0xb}}) getpeername$packet(r1, &(0x7f0000002380)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @local}, &(0x7f00000023c0)=0x14) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(r1, 0x89f1, &(0x7f0000002480)={'tunl0\x00', &(0x7f0000002400)={'tunl0\x00', 0x0, 0x700, 0x7, 0x10000, 0xa62c, {{0xe, 0x4, 0x0, 0x3d, 0x38, 0x68, 0x0, 0x5, 0x29, 0x0, @loopback, @dev={0xac, 0x14, 0x14, 0x32}, {[@lsrr={0x83, 0xb, 0xa7, [@remote, @local]}, @rr={0x7, 0x17, 0xd4, [@multicast1, @multicast2, @initdev={0xac, 0x1e, 0x0, 0x0}, @initdev={0xac, 0x1e, 0x0, 0x0}, @broadcast]}, @noop]}}}}}) ioctl$sock_ipv6_tunnel_SIOCCHGTUNNEL(0xffffffffffffffff, 0x89f3, &(0x7f0000002540)={'ip6_vti0\x00', &(0x7f00000024c0)={'ip6gre0\x00', 0x0, 0x29, 0xc, 0x4, 0x2, 0x33, @private1={0xfc, 0x1, '\x00', 0x1}, @mcast2, 0x1, 0x7800, 0x7, 0x80}}) ioctl$ifreq_SIOCGIFINDEX_wireguard(r0, 0x8933, &(0x7f0000002580)={'wg1\x00', 0x0}) ioctl$sock_ipv6_tunnel_SIOCGETTUNNEL(r1, 0x89f0, &(0x7f0000002640)={'ip6_vti0\x00', &(0x7f00000025c0)={'syztnl1\x00', 0x0, 0x29, 0x3, 0x6, 0x60000000, 0x2, @remote, @mcast2, 0x40, 0x7, 0x7, 0xffffffb1}}) ioctl$sock_ipv6_tunnel_SIOCGETTUNNEL(r1, 0x89f0, &(0x7f0000002700)={'ip6_vti0\x00', &(0x7f0000002680)={'ip6_vti0\x00', 0x0, 0x4, 0xa8, 0x6, 0x7ff, 0x4, @loopback, @private0={0xfc, 0x0, '\x00', 0x1}, 0x8000, 0x8, 0xbaa6, 0xfffffffe}}) getsockopt$inet6_mreq(r1, 0x29, 0x1b, &(0x7f0000002740)={@rand_addr, 0x0}, &(0x7f0000002780)=0x14) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f00000027c0)={'nicvf0\x00', 0x0}) sendmsg$ETHTOOL_MSG_TSINFO_GET(r1, &(0x7f0000002a40)={&(0x7f0000002240)={0x10, 0x0, 0x0, 0x4000000}, 0xc, &(0x7f0000002a00)={&(0x7f0000002800)={0x1e0, r3, 0x20, 0x70bd2a, 0x25dfdbff, {}, [@HEADER={0x4c, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r4}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r5}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r6}, @ETHTOOL_A_HEADER_FLAGS={0x8}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'pimreg0\x00'}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'geneve1\x00'}]}, @HEADER={0xc, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_INDEX={0x8}]}, @HEADER={0xc, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x1}]}, @HEADER={0x58, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'virt_wifi0\x00'}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'veth1_to_hsr\x00'}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r7}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'bond0\x00'}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r8}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8}]}, @HEADER={0x4}, @HEADER={0x54, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'syz_tun\x00'}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'macvtap0\x00'}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x2}, @ETHTOOL_A_HEADER_FLAGS={0x8}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x2}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8}]}, @HEADER={0x64, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'vlan1\x00'}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x1}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'wg2\x00'}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'wg1\x00'}, @ETHTOOL_A_HEADER_FLAGS={0x8}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'wg0\x00'}]}, @HEADER={0x54, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r9}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'pim6reg0\x00'}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r10}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'dummy0\x00'}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r11}, @ETHTOOL_A_HEADER_FLAGS={0x8}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r12}]}]}, 0x1e0}, 0x1, 0x0, 0x0, 0x80000}, 0x40) r13 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NLBL_MGMT_C_LISTALL(r13, &(0x7f0000002b80)={&(0x7f0000002a80)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f0000002b40)={&(0x7f0000002ac0)={0x44, 0x0, 0x100, 0x70bd27, 0x25dfdbff, {}, [@NLBL_MGMT_A_IPV6MASK={0x14, 0x6, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02'}, @NLBL_MGMT_A_IPV4ADDR={0x8, 0x7, @empty}, @NLBL_MGMT_A_IPV6ADDR={0x14, 0x5, @empty}]}, 0x44}, 0x1, 0x0, 0x0, 0x40080}, 0xf8fad25626057fe7) sendmsg$key(r1, &(0x7f0000002cc0)={0x0, 0x0, &(0x7f0000002c80)={&(0x7f0000002bc0)={0x2, 0x7, 0xc, 0x2, 0x15, 0x0, 0x70bd2d, 0x25dfdbff, [@sadb_x_policy={0x8, 0x12, 0x0, 0x0, 0x0, 0x6e6bc0, 0x1, {0x6, 0x33, 0x9, 0x6, 0x0, 0x101, 0x0, @in=@multicast2, @in=@loopback}}, @sadb_lifetime={0x4, 0x2, 0x8, 0x632bd2ad, 0x1, 0x2}, @sadb_ident={0x2, 0xa, 0x26e, 0x0, 0x9}, @sadb_ident={0x2, 0xa, 0x8, 0x0, 0x3}, @sadb_x_sa2={0x2, 0x13, 0x6, 0x0, 0x0, 0x70bd29, 0x3502}, @sadb_x_nat_t_type={0x1, 0x14, 0x5}]}, 0xa8}}, 0xc0) syz_genetlink_get_family_id$nfc(&(0x7f0000002d00), r13) pipe(&(0x7f0000002d40)={0xffffffffffffffff, 0xffffffffffffffff}) connect$inet6(r15, &(0x7f0000002d80)={0xa, 0x4e20, 0x100, @private0={0xfc, 0x0, '\x00', 0x1}, 0x3}, 0x1c) ioctl$sock_inet_SIOCSIFBRDADDR(r0, 0x891a, &(0x7f0000002dc0)={'macsec0\x00', {0x2, 0x4e20, @private=0xa010101}}) bind$netlink(r14, &(0x7f0000002e00)={0x10, 0x0, 0x25dfdbfc, 0x10000000}, 0xc) ioctl$sock_SIOCBRDELBR(r14, 0x89a1, &(0x7f0000002e40)='netdevsim0\x00') ioctl$BTRFS_IOC_SUBVOL_SETFLAGS(r0, 0x4008941a, &(0x7f0000002e80)=0x2) r16 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000002f00), 0xffffffffffffffff) sendmsg$IEEE802154_LLSEC_ADD_SECLEVEL(r13, &(0x7f0000003000)={&(0x7f0000002ec0)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000002fc0)={&(0x7f0000002f40)={0x58, r16, 0x800, 0x70bd2c, 0x25dfdbfd, {}, [@IEEE802154_ATTR_LLSEC_DEV_OVERRIDE={0x5}, @IEEE802154_ATTR_LLSEC_CMD_FRAME_ID={0x5, 0x34, 0x3}, @IEEE802154_ATTR_LLSEC_FRAME_TYPE={0x5, 0x33, 0x4}, @IEEE802154_ATTR_LLSEC_CMD_FRAME_ID={0x5, 0x34, 0xe}, @IEEE802154_ATTR_LLSEC_FRAME_TYPE={0x5, 0x33, 0x1}, @IEEE802154_ATTR_LLSEC_SECLEVELS={0x5}, @IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan4\x00'}, @IEEE802154_ATTR_LLSEC_DEV_OVERRIDE={0x5, 0x36, 0x1}]}, 0x58}, 0x1, 0x0, 0x0, 0x11}, 0x800) 131.728184ms ago: executing program 3 (id=5142): r0 = socket$inet_smc(0x2b, 0x1, 0x0) ioctl$int_in(r0, 0x5452, &(0x7f0000000000)=0xfffffffffffffdf1) sendto$inet(r0, 0x0, 0x0, 0x20000090, 0x0, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket$inet6_udp(0xa, 0x2, 0x0) close(0x3) r3 = socket$unix(0x1, 0x1, 0x0) connect$unix(r3, &(0x7f0000000480)=@file={0x1, './file0\x00'}, 0x6e) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000c80)={'lo\x00', 0x0}) ioctl$sock_kcm_SIOCKCMCLONE(0xffffffffffffffff, 0x89e2, &(0x7f00000000c0)={r1}) syz_genetlink_get_family_id$ethtool(&(0x7f0000000380), 0xffffffffffffffff) getsockopt$inet6_mreq(r2, 0x29, 0x15, &(0x7f00000003c0), &(0x7f0000000400)=0x14) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000440)={'netpci0\x00'}) r5 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000100)={'syzkaller0\x00'}) sendmsg$nl_route_sched(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000340)=@newqdisc={0x24, 0x24, 0x4ee4e6a52ff56541, 0x70bd2d, 0x0, {0x0, 0x0, 0x0, r4, {0x0, 0xffe0}, {0xffff, 0xffff}, {0x10}}}, 0x24}, 0x1, 0x0, 0x0, 0x4040841}, 0x800) sendmsg$nl_route_sched(r1, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000001c0)=@newqdisc={0x178, 0x24, 0xd0f, 0x200000, 0x0, {0x60, 0x0, 0x0, r4, {}, {0xffff, 0xffff}, {0x0, 0xfff3}}, [@qdisc_kind_options=@q_gred={{0x9}, {0x148, 0x2, [@TCA_GRED_STAB={0x104, 0x2, "abcc61b4e508c02286f1bafc7a22c407a52b0e13291c865d493f15736245f220cd4e40006df455836aa3bd3aaa2c9b95578719c46f89e01798d28b6d63cf7465ea95bd97b018b7afaccdcb28bb42d677b73c44e790f0875fb4b795ca95b7dd712d2c5d69945535f92f74a71236743acd06103cd77bd07f2df5989ee40e409b077cc85e96554beb53c986a216051bd5979a8cfcfe9f98be58ffcf44f6cfda8579dbaedceee578bfd1fb554b6e185e9315425ef0a3fc69d17ede93fc7c46357990f7acfdb8216ea52f604b9f12033688caa4b04adecfc926b3f6ca25bcb5432905e3f30ccbf10cf0f2d00858ba2bbd2702b8d4a7a7c744fbaa2fa35b1c586020d6"}, @TCA_GRED_PARMS={0x38, 0x1, {0x100, 0x5, 0x400, 0x9, 0x81, 0x101, 0xe, 0xc40, 0x7fffffff, 0xfffffffd, 0x20, 0xb, 0xff, 0x6, 0xca11, 0xfffe}}, @TCA_GRED_MAX_P={0x8, 0x4, 0x5}]}}]}, 0x178}, 0x1, 0x0, 0x0, 0x845}, 0x24008004) 68.601887ms ago: executing program 1 (id=5143): openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) r0 = socket$rds(0x15, 0x5, 0x0) sendmsg$rds(r0, 0x0, 0x0) socket$inet6_sctp(0xa, 0x5, 0x84) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, 0x0) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r2 = socket$netlink(0x10, 0x3, 0x0) r3 = socket$unix(0x1, 0x1, 0x0) r4 = socket$unix(0x1, 0x1, 0x0) r5 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r5, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000400)=@newqdisc={0x48, 0x24, 0x4ee4e6a52ff56541, 0x70bd2e, 0x0, {0x0, 0x0, 0x0, r6, {0x0, 0x2}, {0xffff, 0xffff}, {0x2}}, [@qdisc_kind_options=@q_cbs={{0x8}, {0x1c, 0x2, @TCA_CBS_PARMS={0x18, 0x1, {0x0, '\x00', 0xe8b, 0x93, 0x1, 0x3}}}}]}, 0x48}, 0x1, 0x0, 0x0, 0x20000001}, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000008c0)=@newqdisc={0x24, 0x28, 0x4, 0x4001, 0xfffffdfc, {0x0, 0x0, 0x0, r7, {}, {0xf, 0xffff}, {0x2, 0x1}}}, 0x24}, 0x1, 0x0, 0x0, 0x400dc}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000012c0)={0x0, 0x0, 0x0}, 0x0) r8 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r8, 0x0, 0x0) sendto$inet(r8, &(0x7f0000000140), 0xffffffffffffff58, 0x20008005, &(0x7f0000000100)={0x2, 0x4e20}, 0x10) recvmmsg(r8, 0x0, 0x0, 0x10001, 0x0) r9 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) ioctl$TUNSETIFF(r9, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) r10 = socket$kcm(0x2, 0xa, 0x2) ioctl$SIOCSIFHWADDR(r10, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local}) write$tun(r9, &(0x7f00000024c0)={@val={0x0, 0x800}, @val={0x0, 0x0, 0x3}, @ipv4=@icmp={{0x9, 0x4, 0x1, 0x16, 0x2c, 0x65, 0x0, 0x4, 0x1, 0x0, @remote, @broadcast, {[@generic={0x94, 0xf, "f00c8e76d0966f9a2b2407c08a"}]}}, @address_reply={0x12, 0x0, 0x0, 0xffff}}}, 0xff04) bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="1b0000000000000000000000000004"], 0x48) bpf$PROG_LOAD(0x5, &(0x7f0000000440)={0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, @fallback=0x5, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x200000}, 0x94) r11 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r11, &(0x7f0000009b40)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000bc0)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x7}}, [@NFT_MSG_NEWSET={0x14, 0x9, 0xa, 0x401, 0x0, 0x0, {0xa, 0x0, 0x4}}, @NFT_MSG_NEWSETELEM={0x2c, 0xc, 0xa, 0x101, 0x0, 0x0, {0xa, 0x0, 0x6}, [@NFTA_SET_ELEM_LIST_SET={0x9, 0x2, 'syz1\x00'}, @NFTA_SET_ELEM_LIST_TABLE={0x9, 0x1, 'syz1\x00'}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x3}}}, 0x68}, 0x1, 0x0, 0x0, 0x4000850}, 0x24028010) 0s ago: executing program 0 (id=5144): pipe(&(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) vmsplice(r1, &(0x7f00000000c0)=[{&(0x7f0000000180)="77690addcfbe1fbb66ec", 0xff3b}], 0x1, 0x1) r2 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$nbd(&(0x7f0000000040), 0xffffffffffffffff) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff}) sendmsg$NBD_CMD_CONNECT(r2, &(0x7f0000001ac0)={0x0, 0x7f00, &(0x7f0000000080)={&(0x7f0000000100)=ANY=[@ANYBLOB='<\x00\x00\x00', @ANYRES16=r3, @ANYBLOB="0100feffffff0010f49d875f000180080001003611bc5b12034a1b751147804b3d9ba21beb54ead168ba59204f9522cac769398400"/68, @ANYRES32=r4, @ANYBLOB="0c00050037193c99a8772efb0c000200ffff000000000000"], 0x3c}}, 0x20000000) r5 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_generic(r1, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000240)=ANY=[@ANYBLOB="5c2229001500010000000000fbdbdf250a0000000400000014000100fe880000000000000007000000000000002202f78abc7755ccec735a3cf1fe0a899729049e38befcee1e7ea6b6cbfaebca59d352ba707b1e487f5bf7d5a5ddf53b955ecdb187f41121e11b5bc90a52fecf791f79dfdfaaa534d4d63f9bfcc74e8093c6244c889ce13b3edd43af9ccb110e91b0bf8f41f926b7a511665ee15b89a67e63"], 0x225c}, 0x1, 0x0, 0x0, 0x20040844}, 0x40000) splice(r0, 0x0, r5, 0x0, 0x10d00, 0xf) kernel console output (not intermixed with test programs): in process `syz.3.3681'. [ 607.101256][T20116] bond5 (unregistering): (slave gretap2): Releasing active interface [ 607.125598][T20116] bond5 (unregistering): Released all slaves [ 607.178512][T20121] wg1 speed is unknown, defaulting to 1000 [ 607.359837][T20143] netlink: 12 bytes leftover after parsing attributes in process `syz.2.3687'. [ 607.397771][T20144] x_tables: duplicate underflow at hook 2 [ 607.471205][T20143] 8021q: adding VLAN 0 to HW filter on device bond5 [ 608.032372][T20160] syzkaller0: entered promiscuous mode [ 608.047152][T20160] syzkaller0: entered allmulticast mode [ 610.334155][T20208] syz.1.3697 (20208) used obsolete PPPIOCDETACH ioctl [ 610.347095][T20219] netlink: 'syz.4.3704': attribute type 4 has an invalid length. [ 610.401669][T20224] netlink: 'syz.4.3704': attribute type 4 has an invalid length. [ 610.425169][T20223] __nla_validate_parse: 1 callbacks suppressed [ 610.425187][T20223] netlink: 108 bytes leftover after parsing attributes in process `syz.2.3705'. [ 610.468114][T20219] netlink: 16 bytes leftover after parsing attributes in process `syz.4.3704'. [ 610.540188][T20228] netlink: 'syz.2.3707': attribute type 5 has an invalid length. [ 610.939156][T20247] netlink: 'syz.4.3710': attribute type 1 has an invalid length. [ 611.018517][T20249] netlink: 8 bytes leftover after parsing attributes in process `syz.2.3715'. [ 611.276997][T20263] netlink: 4 bytes leftover after parsing attributes in process `syz.2.3718'. [ 611.356158][T20263] veth1_to_hsr: entered promiscuous mode [ 611.385898][T20263] macvtap1: entered promiscuous mode [ 611.403462][T20263] macvtap1: entered allmulticast mode [ 611.423596][T20263] veth1_to_hsr: entered allmulticast mode [ 611.644274][T20275] netlink: 8 bytes leftover after parsing attributes in process `syz.2.3719'. [ 611.701687][T20278] netlink: 'syz.1.3722': attribute type 12 has an invalid length. [ 611.828528][T20258] netlink: 8 bytes leftover after parsing attributes in process `syz.3.3717'. [ 611.935273][T20258] netlink: 'syz.3.3717': attribute type 5 has an invalid length. [ 612.174754][T20305] netlink: 8 bytes leftover after parsing attributes in process `syz.2.3728'. [ 612.820917][T20338] wg1 speed is unknown, defaulting to 1000 [ 612.880945][T20349] netlink: 16 bytes leftover after parsing attributes in process `syz.4.3739'. [ 612.984932][T20340] netlink: 4 bytes leftover after parsing attributes in process `syz.1.3737'. [ 613.055038][T20354] netlink: 84 bytes leftover after parsing attributes in process `syz.4.3740'. [ 613.074765][T20356] lo speed is unknown, defaulting to 1000 [ 613.094651][T20356] lo speed is unknown, defaulting to 1000 [ 613.125084][T20356] lo speed is unknown, defaulting to 1000 [ 613.166443][T20356] infiniband syz2: RDMA CMA: cma_listen_on_dev, error -98 [ 613.209735][T20356] lo speed is unknown, defaulting to 1000 [ 613.238710][T20356] lo speed is unknown, defaulting to 1000 [ 613.250055][T20356] lo speed is unknown, defaulting to 1000 [ 613.266325][T20356] lo speed is unknown, defaulting to 1000 [ 613.299773][T20356] lo speed is unknown, defaulting to 1000 [ 613.321579][T20356] lo speed is unknown, defaulting to 1000 [ 614.151663][T20362] lec:lec_atm_close: lec0: Shut down! [ 614.460266][T20427] Bluetooth: MGMT ver 1.23 [ 615.043061][T20450] wg1 speed is unknown, defaulting to 1000 [ 615.079872][T20450] lo speed is unknown, defaulting to 1000 [ 615.201828][T20456] wg1 speed is unknown, defaulting to 1000 [ 615.235082][T20456] lo speed is unknown, defaulting to 1000 [ 615.618640][T20467] __nla_validate_parse: 9 callbacks suppressed [ 615.618658][T20467] netlink: 212280 bytes leftover after parsing attributes in process `syz.2.3765'. [ 615.797467][T20474] netlink: 296 bytes leftover after parsing attributes in process `syz.2.3768'. [ 616.053588][T20486] sctp: [Deprecated]: syz.4.3771 (pid 20486) Use of int in maxseg socket option. [ 616.053588][T20486] Use struct sctp_assoc_value instead [ 616.435707][T20493] netlink: 56 bytes leftover after parsing attributes in process `syz.3.3775'. [ 616.553667][T20513] sctp: [Deprecated]: syz.0.3778 (pid 20513) Use of struct sctp_assoc_value in delayed_ack socket option. [ 616.553667][T20513] Use struct sctp_sack_info instead [ 616.663676][T20519] netlink: 12 bytes leftover after parsing attributes in process `syz.2.3779'. [ 616.690179][T20519] block nbd2: Unsupported socket: should be TCP or UNIX. [ 616.829591][T20532] openvswitch: netlink: ERSPAN option length err (len 256, max 255). [ 616.851208][T20528] wg1 speed is unknown, defaulting to 1000 [ 616.883566][T20535] netlink: 'syz.1.3784': attribute type 1 has an invalid length. [ 616.980279][T20535] 8021q: adding VLAN 0 to HW filter on device bond4 [ 617.015619][T20528] lo speed is unknown, defaulting to 1000 [ 617.131368][T20535] netlink: 28 bytes leftover after parsing attributes in process `syz.1.3784'. [ 617.304963][T20535] openvswitch: netlink: Key type 10836 is out of range max 32 [ 617.328416][T20547] netlink: 28 bytes leftover after parsing attributes in process `syz.4.3786'. [ 617.348718][T20535] netlink: 28 bytes leftover after parsing attributes in process `syz.1.3784'. [ 617.363076][T20547] netlink: 36 bytes leftover after parsing attributes in process `syz.4.3786'. [ 617.694855][T20535] bond4 (unregistering): Released all slaves [ 617.822843][T20570] netlink: 'syz.0.3793': attribute type 27 has an invalid length. [ 617.944221][T20574] wg1 speed is unknown, defaulting to 1000 [ 617.953461][T20574] lo speed is unknown, defaulting to 1000 [ 618.072994][T20585] netlink: 52 bytes leftover after parsing attributes in process `syz.4.3795'. [ 618.180382][T20588] netlink: 24 bytes leftover after parsing attributes in process `syz.4.3795'. [ 618.232939][T20585] IPVS: Error connecting to the multicast addr [ 618.430701][T20595] wg1 speed is unknown, defaulting to 1000 [ 618.439439][T20595] lo speed is unknown, defaulting to 1000 [ 618.566525][T20596] "syz.2.3791" (20596) uses obsolete ecb(arc4) skcipher [ 618.752294][T20610] sctp: [Deprecated]: syz.4.3800 (pid 20610) Use of int in maxseg socket option. [ 618.752294][T20610] Use struct sctp_assoc_value instead [ 619.157837][ C0] lec0: NETDEV WATCHDOG: CPU: 0: transmit queue 0 timed out 5010 ms [ 619.165905][ C0] lec:lec_tx_timeout: lec0 [ 619.401953][T20648] netlink: 'syz.0.3813': attribute type 16 has an invalid length. [ 619.806101][T20667] tipc: Enabling of bearer rejected, failed to enable media [ 619.928980][T20676] "syz.3.3821" (20676) uses obsolete ecb(arc4) skcipher [ 620.191683][T20688] netdevsim netdevsim1 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 620.381442][T20688] netdevsim netdevsim1 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 620.433924][T20708] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 620.591793][T20688] netdevsim netdevsim1 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 620.680455][ T5941] IPVS: starting estimator thread 0... [ 620.778739][T20719] IPVS: using max 27 ests per chain, 64800 per kthread [ 620.792402][T20688] netdevsim netdevsim1 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 620.820590][T20723] __nla_validate_parse: 8 callbacks suppressed [ 620.820609][T20723] netlink: 12 bytes leftover after parsing attributes in process `syz.0.3834'. [ 620.933361][T20732] netlink: 'syz.3.3836': attribute type 29 has an invalid length. [ 620.963502][T20723] netlink: 'syz.0.3834': attribute type 2 has an invalid length. [ 620.988613][T20732] netlink: 'syz.3.3836': attribute type 29 has an invalid length. [ 621.078331][T20736] netlink: 500 bytes leftover after parsing attributes in process `syz.3.3836'. [ 621.150516][ T3840] netdevsim netdevsim1 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 621.177171][ T3840] netdevsim netdevsim1 eth1: set [1, 0] type 2 family 0 port 6081 - 0 [ 621.252023][ T3840] netdevsim netdevsim1 eth2: set [1, 0] type 2 family 0 port 6081 - 0 [ 621.295231][T15532] netdevsim netdevsim1 eth3: set [1, 0] type 2 family 0 port 6081 - 0 [ 621.374785][T20748] netlink: 240 bytes leftover after parsing attributes in process `syz.0.3840'. [ 621.543012][T20759] xt_cgroup: invalid path, errno=-2 [ 621.612716][T20759] rdma_rxe: rxe_newlink: failed to add bridge0 [ 621.624275][T20758] bridge0: port 2(bridge_slave_1) entered disabled state [ 621.636424][T20758] bridge_slave_1: left allmulticast mode [ 621.645330][T20759] Can not set IPV6_FL_F_REFLECT if flowlabel_consistency sysctl is enable [ 621.655477][T20758] bridge_slave_1: left promiscuous mode [ 621.662774][T20758] bridge0: port 2(bridge_slave_1) entered disabled state [ 621.708199][T20758] bridge_slave_1: entered promiscuous mode [ 621.714939][T20758] bridge_slave_1: entered allmulticast mode [ 621.722312][T20758] bond0: (slave bridge_slave_1): Enslaving as an active interface with an up link [ 621.861383][T20765] bridge0: port 2(bridge_slave_1) entered disabled state [ 621.869297][T20765] bridge0: port 1(bridge_slave_0) entered disabled state [ 621.890608][T20765] bond0: left allmulticast mode [ 621.895538][T20765] bond_slave_0: left allmulticast mode [ 621.901371][T20765] bond_slave_1: left allmulticast mode [ 621.906885][T20765] bond0: left promiscuous mode [ 621.913779][T20765] bond_slave_0: left promiscuous mode [ 621.922139][T20765] bond_slave_1: left promiscuous mode [ 621.928877][T20765] bridge0: port 3(bond0) entered disabled state [ 621.988862][T20765] bridge_slave_0: left allmulticast mode [ 621.994560][T20765] bridge_slave_0: left promiscuous mode [ 622.001104][T20765] bridge0: port 1(bridge_slave_0) entered disabled state [ 622.023093][T20765] bridge_slave_1: left allmulticast mode [ 622.031830][T20765] bridge_slave_1: left promiscuous mode [ 622.038011][T20765] bridge0: port 2(bridge_slave_1) entered disabled state [ 622.061312][T20765] bond0: (slave bond_slave_0): Releasing backup interface [ 622.080995][T20765] bond0: (slave bond_slave_1): Releasing backup interface [ 622.114410][T20765] team0: Port device team_slave_0 removed [ 622.132382][T20765] team0: Port device team_slave_1 removed [ 622.142498][T20765] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 622.154001][T20765] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 622.166226][T20765] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 622.178656][T20765] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 622.196161][T20765] A link change request failed with some changes committed already. Interface hsr_slave_0 may have been left with an inconsistent configuration, please check. [ 622.245894][T20774] bond5: option arp_interval: mode dependency failed, not supported in mode 802.3ad(4) [ 622.271204][T20774] bond5 (unregistering): Released all slaves [ 622.409146][T20787] netlink: 'syz.2.3852': attribute type 21 has an invalid length. [ 622.417393][T20787] netlink: 4 bytes leftover after parsing attributes in process `syz.2.3852'. [ 622.642365][T20788] A link change request failed with some changes committed already. Interface wg0 may have been left with an inconsistent configuration, please check. [ 622.697451][T20796] vlan3: entered promiscuous mode [ 622.728118][T20796] ip6gretap0: entered promiscuous mode [ 622.759843][T20796] vlan3: entered allmulticast mode [ 622.781505][T20796] ip6gretap0: entered allmulticast mode [ 623.030374][T20818] netlink: 48 bytes leftover after parsing attributes in process `syz.4.3863'. [ 623.081346][T20818] wg1 speed is unknown, defaulting to 1000 [ 623.111492][T20826] netlink: 8 bytes leftover after parsing attributes in process `syz.4.3863'. [ 623.122317][T20818] lo speed is unknown, defaulting to 1000 [ 623.679953][T20856] netlink: 56 bytes leftover after parsing attributes in process `syz.0.3872'. [ 623.859454][T20868] netlink: 'syz.3.3877': attribute type 3 has an invalid length. [ 623.887116][T20868] netlink: 28 bytes leftover after parsing attributes in process `syz.3.3877'. [ 624.014373][T20874] xt_ecn: cannot match TCP bits for non-tcp packets [ 624.025156][T20874] netlink: 20 bytes leftover after parsing attributes in process `syz.1.3879'. [ 624.058745][T20880] netlink: 12 bytes leftover after parsing attributes in process `syz.0.3881'. [ 624.130626][T20880] 8021q: adding VLAN 0 to HW filter on device bond7 [ 624.146602][T20883] 8021q: adding VLAN 0 to HW filter on device batadv1 [ 624.183365][T20883] bond7: (slave batadv1): Enslaving as an active interface with an up link [ 624.506404][T20905] vlan2: entered promiscuous mode [ 625.102043][T20938] netdevsim netdevsim1 eth3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 625.203414][T20938] netdevsim netdevsim1 eth2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 625.516113][T20938] netdevsim netdevsim1 eth1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 625.651885][T20955] 8021q: adding VLAN 0 to HW filter on device bond5 [ 625.718367][T20956] 8021q: adding VLAN 0 to HW filter on device batadv1 [ 625.745257][T20956] bond5: (slave batadv1): Enslaving as an active interface with an up link [ 625.770707][T20938] netdevsim netdevsim1 eth0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 625.997457][T15532] netdevsim netdevsim1 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 626.049639][T15530] netdevsim netdevsim1 eth1: set [1, 0] type 2 family 0 port 6081 - 0 [ 626.109000][T15530] netdevsim netdevsim1 eth2: set [1, 0] type 2 family 0 port 6081 - 0 [ 626.139839][T15530] netdevsim netdevsim1 eth3: set [1, 0] type 2 family 0 port 6081 - 0 [ 626.193068][T20977] wg1 speed is unknown, defaulting to 1000 [ 626.219000][T20977] lo speed is unknown, defaulting to 1000 [ 626.517899][T21002] __nla_validate_parse: 7 callbacks suppressed [ 626.517928][T21002] netlink: 12 bytes leftover after parsing attributes in process `syz.0.3911'. [ 626.641308][T21008] netlink: 4 bytes leftover after parsing attributes in process `syz.0.3911'. [ 626.699652][T21002] 8021q: adding VLAN 0 to HW filter on device bond8 [ 626.734132][T21008] 8021q: adding VLAN 0 to HW filter on device batadv2 [ 626.761246][T21008] bond8: (slave batadv2): Enslaving as an active interface with an up link [ 627.019931][T21016] netlink: 36 bytes leftover after parsing attributes in process `syz.1.3907'. [ 628.685173][T20995] wg1 speed is unknown, defaulting to 1000 [ 628.720582][T21028] syzkaller0: entered promiscuous mode [ 628.726148][T21028] syzkaller0: entered allmulticast mode [ 628.750560][T21042] netlink: 16 bytes leftover after parsing attributes in process `syz.0.3915'. [ 628.771880][T20995] lo speed is unknown, defaulting to 1000 [ 628.938315][T21054] netlink: 48 bytes leftover after parsing attributes in process `syz.2.3919'. [ 628.978844][T21059] dvmrp1: entered allmulticast mode [ 629.081999][T21059] dvmrp1: left allmulticast mode [ 629.463304][T21086] netlink: 68 bytes leftover after parsing attributes in process `syz.3.3928'. [ 629.482830][T21089] netlink: 'syz.4.3931': attribute type 10 has an invalid length. [ 629.505154][T21091] netlink: 32 bytes leftover after parsing attributes in process `syz.2.3932'. [ 629.525272][T21089] netlink: 2 bytes leftover after parsing attributes in process `syz.4.3931'. [ 629.587197][T21089] FAULT_INJECTION: forcing a failure. [ 629.587197][T21089] name failslab, interval 1, probability 0, space 0, times 0 [ 629.621142][ T1302] lec:lec_start_xmit: lec0:No lecd attached [ 629.658351][T21089] CPU: 0 UID: 0 PID: 21089 Comm: syz.4.3931 Not tainted syzkaller #0 PREEMPT(full) [ 629.658382][T21089] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/13/2026 [ 629.658396][T21089] Call Trace: [ 629.658404][T21089] [ 629.658413][T21089] dump_stack_lvl+0xe8/0x150 [ 629.658446][T21089] should_fail_ex+0x412/0x560 [ 629.658481][T21089] should_failslab+0xa8/0x100 [ 629.658509][T21089] __kmalloc_noprof+0xde/0x7e0 [ 629.658528][T21089] ? kfree+0x4d/0x650 [ 629.658560][T21089] ? tomoyo_realpath_from_path+0xe3/0x5d0 [ 629.658596][T21089] tomoyo_realpath_from_path+0xe3/0x5d0 [ 629.658637][T21089] ? tomoyo_domain+0xd7/0x130 [ 629.658671][T21089] ? tomoyo_path_number_perm+0x219/0x630 [ 629.658693][T21089] tomoyo_path_number_perm+0x246/0x630 [ 629.658720][T21089] ? __pfx_tomoyo_path_number_perm+0x10/0x10 [ 629.658742][T21089] ? __lock_acquire+0x6b5/0x2cf0 [ 629.658777][T21089] ? __mutex_unlock_slowpath+0x1bd/0x7d0 [ 629.658817][T21089] ? __fget_files+0x2a/0x420 [ 629.658843][T21089] ? __fget_files+0x2a/0x420 [ 629.658866][T21089] ? __fget_files+0x3a0/0x420 [ 629.658890][T21089] ? __fget_files+0x2a/0x420 [ 629.658916][T21089] security_file_ioctl+0xc3/0x2a0 [ 629.658940][T21089] __se_sys_ioctl+0x47/0x170 [ 629.658975][T21089] do_syscall_64+0xe2/0xf80 [ 629.658995][T21089] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 629.659015][T21089] ? trace_irq_disable+0x37/0x100 [ 629.659041][T21089] ? clear_bhb_loop+0x60/0xb0 [ 629.659063][T21089] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 629.659083][T21089] RIP: 0033:0x7f14d859acb9 [ 629.659101][T21089] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 629.659119][T21089] RSP: 002b:00007f14d948a028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 629.659141][T21089] RAX: ffffffffffffffda RBX: 00007f14d8815fa0 RCX: 00007f14d859acb9 [ 629.659157][T21089] RDX: 0000200000000380 RSI: 00000000000089e2 RDI: 0000000000000005 [ 629.659170][T21089] RBP: 00007f14d948a090 R08: 0000000000000000 R09: 0000000000000000 [ 629.659183][T21089] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 629.659195][T21089] R13: 00007f14d8816038 R14: 00007f14d8815fa0 R15: 00007fffad656408 [ 629.659229][T21089] [ 629.659281][T21089] ERROR: Out of memory at tomoyo_realpath_from_path. [ 629.792465][T21098] netlink: 'syz.0.3933': attribute type 10 has an invalid length. [ 629.903955][T21098] netlink: 2 bytes leftover after parsing attributes in process `syz.0.3933'. [ 630.726944][T21125] wg1 speed is unknown, defaulting to 1000 [ 630.749543][T21125] lo speed is unknown, defaulting to 1000 [ 630.756916][T21127] wg1 speed is unknown, defaulting to 1000 [ 630.772519][T21127] lo speed is unknown, defaulting to 1000 [ 631.338047][T17987] ip6_tunnel: ip6gretap1 xmit: Local address not yet configured! [ 631.482565][T21150] netlink: 'syz.1.3947': attribute type 10 has an invalid length. [ 631.507647][T21150] netlink: 2 bytes leftover after parsing attributes in process `syz.1.3947'. [ 631.608562][T15532] ip6_tunnel: ip6gretap1 xmit: Local address not yet configured! [ 631.706208][T21161] netlink: 'syz.2.3951': attribute type 10 has an invalid length. [ 631.744229][T21161] netlink: 2 bytes leftover after parsing attributes in process `syz.2.3951'. [ 631.772680][T21161] bond0: entered promiscuous mode [ 631.787787][T21161] 8021q: adding VLAN 0 to HW filter on device bond0 [ 631.795035][T21161] bridge0: port 1(bond0) entered blocking state [ 631.801952][T21161] bridge0: port 1(bond0) entered disabled state [ 631.808740][T21161] bond0: entered allmulticast mode [ 631.818455][T21164] netlink: 4 bytes leftover after parsing attributes in process `syz.4.3952'. [ 632.078143][T17987] ip6_tunnel: ip6gretap1 xmit: Local address not yet configured! [ 632.506969][T21197] netlink: 4 bytes leftover after parsing attributes in process `syz.1.3962'. [ 632.521305][T21197] netlink: 'syz.1.3962': attribute type 1 has an invalid length. [ 632.638572][T21201] bond4: (slave bridge3): making interface the new active one [ 632.670216][T21201] bond4: (slave bridge3): Enslaving as an active interface with an up link [ 632.695130][ T36] ip6_tunnel: ip6gretap1 xmit: Local address not yet configured! [ 632.718708][ T36] ip6_tunnel: ip6gretap1 xmit: Local address not yet configured! [ 632.870481][T21208] wg1 speed is unknown, defaulting to 1000 [ 632.896346][T21208] lo speed is unknown, defaulting to 1000 [ 633.092295][T21214] wg1 speed is unknown, defaulting to 1000 [ 633.143186][T21214] lo speed is unknown, defaulting to 1000 [ 633.170097][T21220] syzkaller0: entered promiscuous mode [ 633.175657][T21220] syzkaller0: entered allmulticast mode [ 633.179140][ T5941] ip6_tunnel: ip6gretap1 xmit: Local address not yet configured! [ 633.250960][T21222] netlink: 56 bytes leftover after parsing attributes in process `syz.4.3969'. [ 633.591550][T21231] syzkaller0: entered promiscuous mode [ 633.602229][T21231] syzkaller0: entered allmulticast mode [ 633.800009][T21245] IPVS: set_ctl: invalid protocol: 255 172.20.20.170:0 [ 633.906127][T21247] xt_TPROXY: Can be used only with -p tcp or -p udp [ 633.950895][T21255] netlink: 12 bytes leftover after parsing attributes in process `syz.3.3980'. [ 633.965911][T21256] FAULT_INJECTION: forcing a failure. [ 633.965911][T21256] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 633.995083][T21256] CPU: 1 UID: 0 PID: 21256 Comm: syz.2.3979 Not tainted syzkaller #0 PREEMPT(full) [ 633.995112][T21256] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/13/2026 [ 633.995126][T21256] Call Trace: [ 633.995134][T21256] [ 633.995143][T21256] dump_stack_lvl+0xe8/0x150 [ 633.995174][T21256] should_fail_ex+0x412/0x560 [ 633.995210][T21256] _copy_from_user+0x2d/0xb0 [ 633.995233][T21256] __copy_msghdr+0x3c5/0x5b0 [ 633.995262][T21256] ___sys_sendmsg+0x213/0x360 [ 633.995282][T21256] ? __lock_acquire+0x6b5/0x2cf0 [ 633.995308][T21256] ? __pfx____sys_sendmsg+0x10/0x10 [ 633.995367][T21256] ? __fget_files+0x2a/0x420 [ 633.995392][T21256] ? __fget_files+0x3a0/0x420 [ 633.995428][T21256] __x64_sys_sendmsg+0x1bd/0x2a0 [ 633.995453][T21256] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 633.995487][T21256] ? __pfx_ksys_write+0x10/0x10 [ 633.995519][T21256] do_syscall_64+0xe2/0xf80 [ 633.995540][T21256] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 633.995568][T21256] ? trace_irq_disable+0x37/0x100 [ 633.995596][T21256] ? clear_bhb_loop+0x60/0xb0 [ 633.995621][T21256] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 633.995642][T21256] RIP: 0033:0x7f517d19acb9 [ 633.995660][T21256] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 633.995677][T21256] RSP: 002b:00007f517e057028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 633.995698][T21256] RAX: ffffffffffffffda RBX: 00007f517d415fa0 RCX: 00007f517d19acb9 [ 633.995713][T21256] RDX: 0000000000000010 RSI: 0000200000000200 RDI: 0000000000000005 [ 633.995726][T21256] RBP: 00007f517e057090 R08: 0000000000000000 R09: 0000000000000000 [ 633.995739][T21256] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 633.995751][T21256] R13: 00007f517d416038 R14: 00007f517d415fa0 R15: 00007ffc22241be8 [ 633.995784][T21256] [ 634.300657][T21265] netlink: 'syz.4.3983': attribute type 10 has an invalid length. [ 634.310827][T21265] netlink: 2 bytes leftover after parsing attributes in process `syz.4.3983'. [ 635.021104][T21307] netlink: 'syz.2.3996': attribute type 10 has an invalid length. [ 635.037614][ C0] lec0: NETDEV WATCHDOG: CPU: 0: transmit queue 0 timed out 5420 ms [ 635.045824][ C0] lec:lec_tx_timeout: lec0 [ 635.069261][T21307] netlink: 2 bytes leftover after parsing attributes in process `syz.2.3996'. [ 635.116794][T21307] netlink: 12 bytes leftover after parsing attributes in process `syz.2.3996'. [ 635.169996][T21306] wg1 speed is unknown, defaulting to 1000 [ 635.191197][T21316] netlink: 4 bytes leftover after parsing attributes in process `syz.2.3996'. [ 635.210617][T21306] lo speed is unknown, defaulting to 1000 [ 635.216081][T21317] netlink: 16 bytes leftover after parsing attributes in process `syz.4.3998'. [ 635.257776][T21311] tap0: tun_chr_ioctl cmd 1074812118 [ 635.559934][T21327] 8021q: adding VLAN 0 to HW filter on device bond6 [ 635.583350][T21312] nr0: left promiscuous mode [ 635.588444][T21312] nr0: left allmulticast mode [ 635.640571][T21331] 8021q: adding VLAN 0 to HW filter on device batadv2 [ 635.678509][T21331] bond6: (slave batadv2): Enslaving as an active interface with an up link [ 636.071165][T21344] syzkaller0: entered promiscuous mode [ 636.085348][T21344] syzkaller0: entered allmulticast mode [ 636.267680][T21353] workqueue: Failed to create a rescuer kthread for wq "nfc2_nci_tx_wq": -EINTR [ 636.337055][T21342] wg1 speed is unknown, defaulting to 1000 [ 636.384943][T21342] lo speed is unknown, defaulting to 1000 [ 636.486477][T21367] macvtap1: entered promiscuous mode [ 636.490911][T21369] xt_connbytes: Forcing CT accounting to be enabled [ 636.503472][T21367] macvtap1: entered allmulticast mode [ 636.512767][T21367] dummy0: entered promiscuous mode [ 636.521493][T21367] team0: Device macvtap1 failed to register rx_handler [ 636.530851][T21367] dummy0: left promiscuous mode [ 636.583458][T21374] netlink: 'syz.0.4014': attribute type 1 has an invalid length. [ 636.593612][T21374] netlink: 'syz.0.4014': attribute type 1 has an invalid length. [ 636.784651][T21386] __nla_validate_parse: 9 callbacks suppressed [ 636.784706][T21386] netlink: 4 bytes leftover after parsing attributes in process `syz.4.4016'. [ 636.800715][ C0] ip6_tunnel: ip6gretap1 xmit: Local address not yet configured! [ 636.810296][T21384] 8021q: adding VLAN 0 to HW filter on device bond5 [ 636.848940][T21390] netlink: 104 bytes leftover after parsing attributes in process `syz.3.4017'. [ 636.889633][T21386] 8021q: adding VLAN 0 to HW filter on device batadv1 [ 636.930735][T21386] bond5: (slave batadv1): Enslaving as an active interface with an up link [ 637.100781][T21400] RDS: rds_bind could not find a transport for fc01::1, load rds_tcp or rds_rdma? [ 637.175630][T21391] nr0: entered promiscuous mode [ 637.181994][T21391] nr0: entered allmulticast mode [ 637.187325][T21388] wg1 speed is unknown, defaulting to 1000 [ 637.217010][T21388] lo speed is unknown, defaulting to 1000 [ 637.420525][T21409] netlink: 40 bytes leftover after parsing attributes in process `syz.2.4024'. [ 637.505669][T21410] netlink: 12 bytes leftover after parsing attributes in process `syz.2.4024'. [ 637.520052][T21410] netlink: 'syz.2.4024': attribute type 1 has an invalid length. [ 637.528297][T21410] netlink: 96 bytes leftover after parsing attributes in process `syz.2.4024'. [ 637.537293][T21410] netlink: 658 bytes leftover after parsing attributes in process `syz.2.4024'. [ 637.580166][T21410] netlink: 1 bytes leftover after parsing attributes in process `syz.2.4024'. [ 637.752151][T21420] netlink: 'syz.3.4028': attribute type 48 has an invalid length. [ 637.760253][T21420] netlink: 8 bytes leftover after parsing attributes in process `syz.3.4028'. [ 637.792659][T21418] netlink: 'syz.1.4027': attribute type 12 has an invalid length. [ 637.801906][T21418] netlink: 132 bytes leftover after parsing attributes in process `syz.1.4027'. [ 638.152651][T21442] netlink: 'syz.3.4035': attribute type 1 has an invalid length. [ 638.161104][T21442] netlink: 232 bytes leftover after parsing attributes in process `syz.3.4035'. [ 638.172808][T21442] netlink: 'syz.3.4035': attribute type 2 has an invalid length. [ 638.261052][T21444] FAULT_INJECTION: forcing a failure. [ 638.261052][T21444] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 638.274692][T21444] CPU: 0 UID: 0 PID: 21444 Comm: syz.0.4036 Not tainted syzkaller #0 PREEMPT(full) [ 638.274720][T21444] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/13/2026 [ 638.274734][T21444] Call Trace: [ 638.274742][T21444] [ 638.274751][T21444] dump_stack_lvl+0xe8/0x150 [ 638.274783][T21444] should_fail_ex+0x412/0x560 [ 638.274818][T21444] _copy_from_user+0x2d/0xb0 [ 638.274842][T21444] ___sys_sendmsg+0x1c6/0x360 [ 638.274863][T21444] ? __lock_acquire+0x6b5/0x2cf0 [ 638.274889][T21444] ? __pfx____sys_sendmsg+0x10/0x10 [ 638.274948][T21444] ? __fget_files+0x2a/0x420 [ 638.274976][T21444] ? __fget_files+0x3a0/0x420 [ 638.275012][T21444] __x64_sys_sendmsg+0x1bd/0x2a0 [ 638.275037][T21444] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 638.275070][T21444] ? __pfx_ksys_write+0x10/0x10 [ 638.275118][T21444] do_syscall_64+0xe2/0xf80 [ 638.275139][T21444] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 638.275158][T21444] ? trace_irq_disable+0x37/0x100 [ 638.275193][T21444] ? clear_bhb_loop+0x60/0xb0 [ 638.275218][T21444] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 638.275238][T21444] RIP: 0033:0x7f53ce79acb9 [ 638.275257][T21444] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 638.275275][T21444] RSP: 002b:00007f53cf648028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 638.275297][T21444] RAX: ffffffffffffffda RBX: 00007f53cea15fa0 RCX: 00007f53ce79acb9 [ 638.275313][T21444] RDX: 0000000000000000 RSI: 0000200000000100 RDI: 0000000000000003 [ 638.275327][T21444] RBP: 00007f53cf648090 R08: 0000000000000000 R09: 0000000000000000 [ 638.275340][T21444] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 638.275352][T21444] R13: 00007f53cea16038 R14: 00007f53cea15fa0 R15: 00007ffd347aa3a8 [ 638.275386][T21444] [ 638.587239][T21448] wg1 speed is unknown, defaulting to 1000 [ 638.665294][T21448] lo speed is unknown, defaulting to 1000 [ 638.666338][T10751] nci: nci_add_new_protocol: the target found does not have the desired protocol [ 639.105967][T21466] 8021q: adding VLAN 0 to HW filter on device bond6 [ 639.149064][T21467] 8021q: adding VLAN 0 to HW filter on device batadv2 [ 639.159763][T21467] bond6: (slave batadv2): Enslaving as an active interface with an up link [ 639.562491][T21487] netlink: 'syz.1.4045': attribute type 1 has an invalid length. [ 639.632860][T21487] 8021q: adding VLAN 0 to HW filter on device bond5 [ 639.641556][T21490] 8021q: VLANs not supported on ip6_vti0 [ 640.072408][T21490] bond5: (slave ip6gretap2): making interface the new active one [ 640.097157][T21490] bond5: (slave ip6gretap2): Enslaving as an active interface with an up link [ 640.690052][T21526] sctp: [Deprecated]: syz.0.4052 (pid 21526) Use of int in maxseg socket option. [ 640.690052][T21526] Use struct sctp_assoc_value instead [ 640.889362][T21530] wg1 speed is unknown, defaulting to 1000 [ 640.902004][T21535] IPVS: Schedule: port zero only supported in persistent services, check your ipvs configuration [ 640.946327][ T9930] lec:lec_start_xmit: lec0:No lecd attached [ 640.982122][T21535] netlink: 'syz.2.4059': attribute type 1 has an invalid length. [ 641.017769][T21530] lo speed is unknown, defaulting to 1000 [ 641.646516][T21506] lec:lec_atm_close: lec0: Shut down! [ 642.468201][T21593] __nla_validate_parse: 8 callbacks suppressed [ 642.468221][T21593] netlink: 8 bytes leftover after parsing attributes in process `syz.0.4071'. [ 642.663556][T21605] netlink: 8 bytes leftover after parsing attributes in process `syz.1.4077'. [ 642.689261][T21605] netlink: 'syz.1.4077': attribute type 7 has an invalid length. [ 642.845942][T21608] veth3: entered promiscuous mode [ 642.864407][T15526] netdevsim netdevsim1 eth0: set [0, 0] type 1 family 0 port 8472 - 0 [ 642.901217][T21604] netlink: 'syz.3.4076': attribute type 1 has an invalid length. [ 642.944095][T15526] netdevsim netdevsim1 eth1: set [0, 0] type 1 family 0 port 8472 - 0 [ 643.021183][T15526] netdevsim netdevsim1 eth2: set [0, 0] type 1 family 0 port 8472 - 0 [ 643.055196][T15526] netdevsim netdevsim1 eth3: set [0, 0] type 1 family 0 port 8472 - 0 [ 643.055670][T21630] netlink: 20 bytes leftover after parsing attributes in process `syz.2.4079'. [ 643.132278][T21622] wg1 speed is unknown, defaulting to 1000 [ 643.140336][T21622] lo speed is unknown, defaulting to 1000 [ 643.332082][T21637] netlink: 32 bytes leftover after parsing attributes in process `syz.1.4084'. [ 643.400191][T21640] netlink: 52 bytes leftover after parsing attributes in process `syz.0.4086'. [ 643.661274][T21651] bridge4: the hash_elasticity option has been deprecated and is always 16 [ 643.670138][T21651] bridge4: entered allmulticast mode [ 644.342312][T21646] netlink: 24 bytes leftover after parsing attributes in process `syz.4.4085'. [ 644.957941][ C0] ip6_tunnel: ip6gretap1 xmit: Local address not yet configured! [ 645.020008][T21696] syzkaller0: entered promiscuous mode [ 645.025545][T21696] syzkaller0: entered allmulticast mode [ 645.310963][T21697] syzkaller0: entered promiscuous mode [ 645.324650][T21697] syzkaller0: entered allmulticast mode [ 645.939189][T21732] netlink: 24 bytes leftover after parsing attributes in process `syz.3.4105'. [ 645.978001][T21732] FAULT_INJECTION: forcing a failure. [ 645.978001][T21732] name failslab, interval 1, probability 0, space 0, times 0 [ 646.028387][T21732] CPU: 0 UID: 0 PID: 21732 Comm: syz.3.4105 Not tainted syzkaller #0 PREEMPT(full) [ 646.028421][T21732] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/13/2026 [ 646.028434][T21732] Call Trace: [ 646.028442][T21732] [ 646.028451][T21732] dump_stack_lvl+0xe8/0x150 [ 646.028484][T21732] should_fail_ex+0x412/0x560 [ 646.028521][T21732] should_failslab+0xa8/0x100 [ 646.028548][T21732] __kmalloc_cache_noprof+0x83/0x6e0 [ 646.028569][T21732] ? __netlink_lookup+0xc6/0x8b0 [ 646.028596][T21732] ? ctnetlink_alloc_filter+0xb2/0xb50 [ 646.028631][T21732] ctnetlink_alloc_filter+0xb2/0xb50 [ 646.028651][T21732] ? __pfx___mutex_lock+0x10/0x10 [ 646.028673][T21732] ? __pfx_ctnetlink_alloc_filter+0x10/0x10 [ 646.028701][T21732] ? netlink_lookup+0x30/0x200 [ 646.028729][T21732] ctnetlink_start+0x13b/0x1b0 [ 646.028763][T21732] __netlink_dump_start+0x469/0x7e0 [ 646.028798][T21732] ctnetlink_get_conntrack+0x212/0x7b0 [ 646.028837][T21732] ? __pfx_ctnetlink_get_conntrack+0x10/0x10 [ 646.028873][T21732] ? __pfx___mutex_lock+0x10/0x10 [ 646.028891][T21732] ? rcu_preempt_deferred_qs_irqrestore+0x7b9/0xbc0 [ 646.028916][T21732] ? __pfx_ctnetlink_start+0x10/0x10 [ 646.028944][T21732] ? __pfx_ctnetlink_dump_table+0x10/0x10 [ 646.028974][T21732] ? __pfx_ctnetlink_done+0x10/0x10 [ 646.029021][T21732] nfnetlink_rcv_msg+0xc00/0x12c0 [ 646.029045][T21732] ? nfnetlink_rcv_msg+0x229/0x12c0 [ 646.029087][T21732] ? __pfx_nfnetlink_rcv_msg+0x10/0x10 [ 646.029142][T21732] ? __lock_acquire+0x6b5/0x2cf0 [ 646.029179][T21732] netlink_rcv_skb+0x232/0x4b0 [ 646.029205][T21732] ? __pfx_nfnetlink_rcv_msg+0x10/0x10 [ 646.029230][T21732] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 646.029268][T21732] ? bpf_lsm_capable+0x9/0x20 [ 646.029292][T21732] ? security_capable+0x7e/0x2c0 [ 646.029327][T21732] nfnetlink_rcv+0x2c0/0x27b0 [ 646.029360][T21732] ? is_bpf_text_address+0x292/0x2b0 [ 646.029392][T21732] ? is_bpf_text_address+0x26/0x2b0 [ 646.029428][T21732] ? kernel_text_address+0xa5/0xe0 [ 646.029458][T21732] ? __kernel_text_address+0xd/0x30 [ 646.029488][T21732] ? unwind_get_return_address+0x4d/0x90 [ 646.029521][T21732] ? __lock_acquire+0x6b5/0x2cf0 [ 646.029547][T21732] ? __pfx_nfnetlink_rcv+0x10/0x10 [ 646.029570][T21732] ? stack_trace_save+0xa9/0x100 [ 646.029607][T21732] ? __lock_acquire+0x6b5/0x2cf0 [ 646.029647][T21732] ? __lock_acquire+0x6b5/0x2cf0 [ 646.029681][T21732] ? __netlink_lookup+0xc6/0x8b0 [ 646.029719][T21732] ? netlink_deliver_tap+0x2e/0x1b0 [ 646.029747][T21732] ? netlink_deliver_tap+0x2e/0x1b0 [ 646.029780][T21732] ? netlink_deliver_tap+0x2e/0x1b0 [ 646.029813][T21732] netlink_unicast+0x80f/0x9b0 [ 646.029845][T21732] ? __pfx_netlink_unicast+0x10/0x10 [ 646.029870][T21732] ? netlink_sendmsg+0x650/0xb40 [ 646.029893][T21732] ? skb_put+0x11b/0x210 [ 646.029917][T21732] netlink_sendmsg+0x813/0xb40 [ 646.029953][T21732] ? __pfx_netlink_sendmsg+0x10/0x10 [ 646.029982][T21732] ? aa_file_perm+0x12d/0x1630 [ 646.030011][T21732] ? aa_sock_msg_perm+0xf1/0x1b0 [ 646.030042][T21732] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 646.030061][T21732] ? __pfx_netlink_sendmsg+0x10/0x10 [ 646.030088][T21732] __sock_sendmsg+0x21c/0x270 [ 646.030119][T21732] ____sys_sendmsg+0x4d7/0x810 [ 646.030140][T21732] ? __might_fault+0xaf/0x130 [ 646.030178][T21732] ? __pfx_____sys_sendmsg+0x10/0x10 [ 646.030210][T21732] ? import_iovec+0x73/0xa0 [ 646.030236][T21732] ___sys_sendmsg+0x2a5/0x360 [ 646.030257][T21732] ? __lock_acquire+0x6b5/0x2cf0 [ 646.030284][T21732] ? __pfx____sys_sendmsg+0x10/0x10 [ 646.030349][T21732] ? __fget_files+0x2a/0x420 [ 646.030374][T21732] ? __fget_files+0x3a0/0x420 [ 646.030412][T21732] __x64_sys_sendmsg+0x1bd/0x2a0 [ 646.030437][T21732] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 646.030471][T21732] ? __pfx_ksys_write+0x10/0x10 [ 646.030506][T21732] do_syscall_64+0xe2/0xf80 [ 646.030526][T21732] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 646.030546][T21732] ? clear_bhb_loop+0x60/0xb0 [ 646.030572][T21732] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 646.030591][T21732] RIP: 0033:0x7f399a99acb9 [ 646.030610][T21732] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 646.030637][T21732] RSP: 002b:00007f399b8b2028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 646.030659][T21732] RAX: ffffffffffffffda RBX: 00007f399ac15fa0 RCX: 00007f399a99acb9 [ 646.030675][T21732] RDX: 0000000000000000 RSI: 0000200000000100 RDI: 0000000000000003 [ 646.030688][T21732] RBP: 00007f399b8b2090 R08: 0000000000000000 R09: 0000000000000000 [ 646.030701][T21732] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 646.030713][T21732] R13: 00007f399ac16038 R14: 00007f399ac15fa0 R15: 00007fffd47bb588 [ 646.030749][T21732] [ 647.037658][ C0] lec0: NETDEV WATCHDOG: CPU: 0: transmit queue 0 timed out 5400 ms [ 647.045724][ C0] lec:lec_tx_timeout: lec0 [ 647.085738][T21755] netlink: 60 bytes leftover after parsing attributes in process `syz.4.4109'. [ 647.144068][T21753] netlink: 'syz.3.4110': attribute type 1 has an invalid length. [ 647.152901][T21755] netlink: 'syz.4.4109': attribute type 10 has an invalid length. [ 647.167837][T21755] netlink: 2 bytes leftover after parsing attributes in process `syz.4.4109'. [ 647.177021][T21753] netlink: 'syz.3.4110': attribute type 4 has an invalid length. [ 647.203084][T21753] netlink: 15538 bytes leftover after parsing attributes in process `syz.3.4110'. [ 647.379726][T21773] netlink: 'syz.3.4110': attribute type 1 has an invalid length. [ 647.417375][T21767] netlink: 'syz.1.4113': attribute type 146 has an invalid length. [ 647.459265][T21767] netlink: 'syz.1.4113': attribute type 201 has an invalid length. [ 647.485129][T21778] __nla_validate_parse: 2 callbacks suppressed [ 647.485149][T21778] netlink: 12 bytes leftover after parsing attributes in process `syz.0.4111'. [ 647.528550][T21766] wg1 speed is unknown, defaulting to 1000 [ 647.536228][T21766] lo speed is unknown, defaulting to 1000 [ 647.548231][T21767] netlink: 'syz.1.4113': attribute type 9 has an invalid length. [ 647.558555][T21767] netlink: 'syz.1.4113': attribute type 7 has an invalid length. [ 647.578339][T21767] netlink: 'syz.1.4113': attribute type 8 has an invalid length. [ 647.606295][T21778] bridge0: port 2(vlan3) entered blocking state [ 647.626724][T21778] bridge0: port 2(vlan3) entered disabled state [ 647.638414][T21778] vlan3: entered allmulticast mode [ 647.643675][T21778] bridge0: entered allmulticast mode [ 647.672443][T21778] vlan3: left allmulticast mode [ 647.689575][T21778] bridge0: left allmulticast mode [ 648.068881][T21799] netlink: 'syz.4.4118': attribute type 10 has an invalid length. [ 648.077146][T21799] netlink: 2 bytes leftover after parsing attributes in process `syz.4.4118'. [ 648.439383][T21806] netlink: 8 bytes leftover after parsing attributes in process `syz.0.4120'. [ 649.599775][T21806] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 649.671057][T21804] wg1 speed is unknown, defaulting to 1000 [ 649.740177][T21810] syzkaller0: entered promiscuous mode [ 649.745713][T21810] syzkaller0: entered allmulticast mode [ 649.758809][T21804] lo speed is unknown, defaulting to 1000 [ 649.820127][T21813] 8021q: adding VLAN 0 to HW filter on device bond6 [ 649.895529][T21821] bond6: (slave veth3): Enslaving as an active interface with a down link [ 650.042889][T21830] netlink: 12 bytes leftover after parsing attributes in process `syz.3.4127'. [ 650.105236][T21832] netlink: 60 bytes leftover after parsing attributes in process `syz.1.4129'. [ 650.115939][T21833] netlink: 4 bytes leftover after parsing attributes in process `syz.3.4127'. [ 650.125046][T21832] unsupported nlmsg_type 40 [ 650.163414][T21830] 8021q: adding VLAN 0 to HW filter on device bond7 [ 650.191334][T21833] 8021q: adding VLAN 0 to HW filter on device batadv2 [ 650.200640][T21833] bond7: (slave batadv2): Enslaving as an active interface with an up link [ 650.368776][T21843] netlink: 2 bytes leftover after parsing attributes in process `syz.3.4132'. [ 650.481979][T21846] batadv0: entered promiscuous mode [ 650.642401][T10751] nci: nci_rf_discover_ntf_packet: unsupported rf_tech_and_mode 0x60 [ 651.061046][T21889] netlink: 2 bytes leftover after parsing attributes in process `syz.2.4146'. [ 651.463576][T21901] netlink: 12 bytes leftover after parsing attributes in process `syz.1.4147'. [ 651.540838][T21900] 8021q: adding VLAN 0 to HW filter on device bond6 [ 651.575661][T21901] vlan1: entered promiscuous mode [ 651.606157][T21901] bond6: entered promiscuous mode [ 651.614516][T21901] vlan1: entered allmulticast mode [ 651.622385][T21901] bond6: entered allmulticast mode [ 651.635776][T21913] netlink: 16 bytes leftover after parsing attributes in process `syz.3.4151'. [ 651.727368][T21908] gretap1: entered promiscuous mode [ 651.748775][T21908] batman_adv: batadv0: Adding interface: gretap1 [ 651.755220][T21908] batman_adv: batadv0: The MTU of interface gretap1 is too small (1462) to handle the transport of batman-adv packets. If you experience problems getting traffic through try increasing the MTU to 1500. [ 651.782481][T21908] batman_adv: batadv0: Not using interface gretap1 (retrying later): interface not active [ 651.968050][T21929] x_tables: ip6_tables: SNPT target: used from hooks FORWARD, but only usable from INPUT/POSTROUTING [ 651.979561][T21927] syzkaller0: entered promiscuous mode [ 651.985078][T21927] syzkaller0: entered allmulticast mode [ 652.065852][ T6582] IPVS: starting estimator thread 0... [ 652.188749][T21939] IPVS: using max 31 ests per chain, 74400 per kthread [ 652.207135][T21950] validate_nla: 5 callbacks suppressed [ 652.207173][T21950] netlink: 'syz.1.4159': attribute type 1 has an invalid length. [ 652.325211][T21954] tipc: Failed to remove unknown binding: 66,0,0/2435989539:1051128921/1051128922 [ 652.360758][T21954] tipc: Failed to remove unknown binding: 66,0,0/2435989539:1051128921/1051128922 [ 652.426872][T21949] wg1 speed is unknown, defaulting to 1000 [ 652.520336][T21949] lo speed is unknown, defaulting to 1000 [ 652.552654][T21961] __nla_validate_parse: 6 callbacks suppressed [ 652.552675][T21961] netlink: 320 bytes leftover after parsing attributes in process `syz.3.4163'. [ 652.587601][T21961] netlink: 24 bytes leftover after parsing attributes in process `syz.3.4163'. [ 652.606942][T21961] netlink: 24 bytes leftover after parsing attributes in process `syz.3.4163'. [ 652.627202][T21961] netlink: 24 bytes leftover after parsing attributes in process `syz.3.4163'. [ 652.919480][T21975] netlink: 4 bytes leftover after parsing attributes in process `syz.4.4166'. [ 652.954886][T21976] netlink: 12 bytes leftover after parsing attributes in process `syz.3.4167'. [ 653.186609][T21983] 8021q: VLANs not supported on caif0 [ 653.252619][T21983] netlink: 152 bytes leftover after parsing attributes in process `syz.2.4169'. [ 653.315379][T21983] netlink: 20 bytes leftover after parsing attributes in process `syz.2.4169'. [ 653.361792][T22002] netlink: 9 bytes leftover after parsing attributes in process `syz.4.4173'. [ 653.397300][T22002] gretap0: entered promiscuous mode [ 653.432242][T22002] netlink: 'syz.4.4173': attribute type 1 has an invalid length. [ 653.528775][T22009] netlink: 'syz.3.4176': attribute type 10 has an invalid length. [ 653.558071][T22009] netlink: 2 bytes leftover after parsing attributes in process `syz.3.4176'. [ 653.618920][T22017] bond0: (slave rose0): Error: Device is in use and cannot be enslaved [ 653.763619][T22024] FAULT_INJECTION: forcing a failure. [ 653.763619][T22024] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 653.817793][T22024] CPU: 1 UID: 0 PID: 22024 Comm: syz.2.4180 Not tainted syzkaller #0 PREEMPT(full) [ 653.817824][T22024] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/13/2026 [ 653.817837][T22024] Call Trace: [ 653.817846][T22024] [ 653.817854][T22024] dump_stack_lvl+0xe8/0x150 [ 653.817887][T22024] should_fail_ex+0x412/0x560 [ 653.817923][T22024] _copy_from_user+0x2d/0xb0 [ 653.817947][T22024] __sys_bpf+0x229/0x920 [ 653.817978][T22024] ? __pfx___sys_bpf+0x10/0x10 [ 653.818024][T22024] ? ksys_write+0x242/0x270 [ 653.818053][T22024] ? __pfx_ksys_write+0x10/0x10 [ 653.818082][T22024] __x64_sys_bpf+0x7c/0x90 [ 653.818109][T22024] do_syscall_64+0xe2/0xf80 [ 653.818129][T22024] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 653.818161][T22024] ? trace_irq_disable+0x37/0x100 [ 653.818189][T22024] ? clear_bhb_loop+0x60/0xb0 [ 653.818213][T22024] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 653.818233][T22024] RIP: 0033:0x7f517d19acb9 [ 653.818252][T22024] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 653.818269][T22024] RSP: 002b:00007f517e036028 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 653.818291][T22024] RAX: ffffffffffffffda RBX: 00007f517d416090 RCX: 00007f517d19acb9 [ 653.818306][T22024] RDX: 0000000000000050 RSI: 0000200000000640 RDI: 000000000000000a [ 653.818319][T22024] RBP: 00007f517e036090 R08: 0000000000000000 R09: 0000000000000000 [ 653.818331][T22024] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 653.818342][T22024] R13: 00007f517d416128 R14: 00007f517d416090 R15: 00007ffc22241be8 [ 653.818377][T22024] [ 654.099864][T22029] wg1 speed is unknown, defaulting to 1000 [ 654.107300][T22029] lo speed is unknown, defaulting to 1000 [ 654.582080][T22053] netlink: 'syz.4.4191': attribute type 10 has an invalid length. [ 654.690523][ T6562] IPVS: starting estimator thread 0... [ 654.787965][T22056] IPVS: using max 25 ests per chain, 60000 per kthread [ 655.309641][T22081] 8021q: adding VLAN 0 to HW filter on device bond7 [ 655.320489][T22085] x_tables: ip_tables: osf.0 match: invalid size 48 (kernel) != (user) 4096 [ 655.343779][T22084] 8021q: adding VLAN 0 to HW filter on device batadv3 [ 655.382053][T22084] bond7: (slave batadv3): Enslaving as an active interface with an up link [ 655.442104][ T52] Bluetooth: hci0: Opcode 0x0c03 failed: -110 [ 655.481298][T14845] IPVS: stop unused estimator thread 0... [ 655.494917][T22087] 8021q: adding VLAN 0 to HW filter on device bond0 [ 655.534556][T22087] A link change request failed with some changes committed already. Interface wlan1 may have been left with an inconsistent configuration, please check. [ 655.566274][T22090] wg1 speed is unknown, defaulting to 1000 [ 655.717139][T22090] lo speed is unknown, defaulting to 1000 [ 655.846548][T22087] syzkaller1: tun_chr_ioctl cmd 1074025677 [ 655.853321][T22087] syzkaller1: linktype set to 823 [ 655.988082][T22100] wg1 speed is unknown, defaulting to 1000 [ 656.045321][T22100] lo speed is unknown, defaulting to 1000 [ 656.127834][T22120] netlink: 'syz.0.4210': attribute type 4 has an invalid length. [ 656.239694][T16888] IPVS: starting estimator thread 0... [ 656.274497][T22132] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 656.281926][T22132] IPv6: NLM_F_CREATE should be set when creating new route [ 656.347867][T22126] IPVS: using max 28 ests per chain, 67200 per kthread [ 656.400615][T22137] netlink: 'syz.0.4216': attribute type 10 has an invalid length. [ 656.645226][T22135] bridge0: port 2(bridge_slave_1) entered disabled state [ 656.652774][T22135] bridge0: port 1(bridge_slave_0) entered disabled state [ 656.809150][T22135] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 656.825832][T22135] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 656.851025][T22155] netlink: 'syz.3.4222': attribute type 5 has an invalid length. [ 656.929512][T22135] mac80211_hwsim hwsim32 wlan1: left promiscuous mode [ 656.973059][T15530] netdevsim netdevsim1 eth0: unset [0, 0] type 1 family 0 port 8472 - 0 [ 657.008139][T15530] netdevsim netdevsim1 eth0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 657.016599][T15530] netdevsim netdevsim1 eth1: unset [0, 0] type 1 family 0 port 8472 - 0 [ 657.057987][T15530] netdevsim netdevsim1 eth1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 657.073224][T15530] netdevsim netdevsim1 eth2: unset [0, 0] type 1 family 0 port 8472 - 0 [ 657.102563][T15530] netdevsim netdevsim1 eth2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 657.130699][T15530] netdevsim netdevsim1 eth3: unset [0, 0] type 1 family 0 port 8472 - 0 [ 657.154098][T15530] netdevsim netdevsim1 eth3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 657.175621][T22161] netlink: 'syz.4.4226': attribute type 32 has an invalid length. [ 657.279564][T22161] bond8: Setting coupled_control to off (0) [ 657.368646][T22173] : entered promiscuous mode [ 657.487459][T22180] bond8: option miimon: invalid value (18446744073709551607) [ 657.495273][T22180] bond8: option miimon: allowed values 0 - 2147483647 [ 657.508961][T22180] bond8 (unregistering): Released all slaves [ 657.562489][T22187] netlink: 'syz.3.4232': attribute type 4 has an invalid length. [ 657.587925][T22187] __nla_validate_parse: 9 callbacks suppressed [ 657.587944][T22187] netlink: 3657 bytes leftover after parsing attributes in process `syz.3.4232'. [ 657.633461][T22188] openvswitch: netlink: ERSPAN option length err (len 256, max 255). [ 657.665890][T22196] netlink: 8 bytes leftover after parsing attributes in process `syz.0.4234'. [ 658.004776][T22216] sctp: [Deprecated]: syz.1.4239 (pid 22216) Use of int in max_burst socket option. [ 658.004776][T22216] Use struct sctp_assoc_value instead [ 658.021754][T22216] sctp: [Deprecated]: syz.1.4239 (pid 22216) Use of int in maxseg socket option. [ 658.021754][T22216] Use struct sctp_assoc_value instead [ 658.788535][T22242] syzkaller0: entered promiscuous mode [ 658.794212][T22242] syzkaller0: entered allmulticast mode [ 658.803662][T22242] netlink: 24 bytes leftover after parsing attributes in process `syz.0.4246'. [ 658.937103][T22257] netlink: 12 bytes leftover after parsing attributes in process `syz.2.4251'. [ 659.017776][T22261] netlink: 4 bytes leftover after parsing attributes in process `syz.2.4251'. [ 659.627936][T22271] netlink: 8 bytes leftover after parsing attributes in process `syz.3.4254'. [ 659.905630][T22257] 8021q: adding VLAN 0 to HW filter on device bond8 [ 659.945442][T22261] 8021q: adding VLAN 0 to HW filter on device batadv4 [ 659.955377][T22275] netlink: 8 bytes leftover after parsing attributes in process `syz.1.4255'. [ 659.965452][T22261] bond8: (slave batadv4): Enslaving as an active interface with an up link [ 659.971532][T22275] netlink: 24 bytes leftover after parsing attributes in process `syz.1.4255'. [ 659.983629][T22260] netlink: 116 bytes leftover after parsing attributes in process `syz.0.4252'. [ 660.122540][T22283] netlink: 'syz.2.4256': attribute type 3 has an invalid length. [ 660.135022][T22283] netlink: 'syz.2.4256': attribute type 1 has an invalid length. [ 660.145913][T22283] netlink: 60387 bytes leftover after parsing attributes in process `syz.2.4256'. [ 660.958232][T22288] tun0: tun_chr_ioctl cmd 1074025673 [ 661.016937][T22297] netlink: 'syz.3.4259': attribute type 10 has an invalid length. [ 661.602279][T22321] netdevsim netdevsim0 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 661.703604][T22323] 8021q: adding VLAN 0 to HW filter on device bond9 [ 661.729523][T22327] 8021q: adding VLAN 0 to HW filter on device batadv3 [ 661.769158][T22327] bond9: (slave batadv3): Enslaving as an active interface with an up link [ 661.956175][T22321] netdevsim netdevsim0 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 662.081987][T22334] netlink: 'syz.1.4270': attribute type 10 has an invalid length. [ 662.597756][T22340] netlink: 'syz.3.4271': attribute type 1 has an invalid length. [ 662.623839][T22340] __nla_validate_parse: 8 callbacks suppressed [ 662.623859][T22340] netlink: 224 bytes leftover after parsing attributes in process `syz.3.4271'. [ 662.771389][T22321] netdevsim netdevsim0 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 662.923523][T22321] netdevsim netdevsim0 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 663.101461][T22357] netlink: 'syz.3.4276': attribute type 1 has an invalid length. [ 663.122025][T10751] netdevsim netdevsim0 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 663.213527][T22357] 8021q: adding VLAN 0 to HW filter on device bond8 [ 663.329757][T22361] bond8: (slave ip6gretap1): Enslaving as an active interface with an up link [ 663.345843][T10751] netdevsim netdevsim0 eth1: set [1, 0] type 2 family 0 port 6081 - 0 [ 663.370494][T22321] netdevsim netdevsim0 eth1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 663.480761][T22321] netdevsim netdevsim0 eth0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 663.490801][T22362] wg1 speed is unknown, defaulting to 1000 [ 663.503174][T22362] lo speed is unknown, defaulting to 1000 [ 663.733320][T22372] netlink: 12 bytes leftover after parsing attributes in process `syz.1.4279'. [ 663.804933][T22377] netlink: 4 bytes leftover after parsing attributes in process `syz.1.4279'. [ 663.853011][T22372] 8021q: adding VLAN 0 to HW filter on device bond7 [ 663.920170][T22377] 8021q: adding VLAN 0 to HW filter on device batadv1 [ 663.953192][T22377] bond7: (slave batadv1): Enslaving as an active interface with an up link [ 664.104614][T22387] netlink: 'syz.4.4283': attribute type 10 has an invalid length. [ 664.127655][T22387] netlink: 2 bytes leftover after parsing attributes in process `syz.4.4283'. [ 664.158173][T22387] : renamed from bond_slave_0 (while UP) [ 664.713502][T22409] netlink: 8 bytes leftover after parsing attributes in process `syz.3.4292'. [ 664.828592][T22419] netlink: 12 bytes leftover after parsing attributes in process `syz.1.4294'. [ 664.907838][T22419] 8021q: adding VLAN 0 to HW filter on device bond8 [ 664.950458][T22422] netlink: 4 bytes leftover after parsing attributes in process `syz.1.4294'. [ 664.972252][T22422] 8021q: adding VLAN 0 to HW filter on device batadv2 [ 664.992867][T22422] bond8: (slave batadv2): Enslaving as an active interface with an up link [ 665.129986][T22431] netlink: 'syz.3.4297': attribute type 10 has an invalid length. [ 665.150869][T22431] netlink: 2 bytes leftover after parsing attributes in process `syz.3.4297'. [ 665.238565][T22438] wg1 speed is unknown, defaulting to 1000 [ 665.258579][T22438] lo speed is unknown, defaulting to 1000 [ 665.274102][T22444] sctp: [Deprecated]: syz.2.4300 (pid 22444) Use of int in max_burst socket option deprecated. [ 665.274102][T22444] Use struct sctp_assoc_value instead [ 665.294122][T22444] IPVS: Schedule: port zero only supported in persistent services, check your ipvs configuration [ 665.660442][T22461] netlink: 12 bytes leftover after parsing attributes in process `syz.4.4303'. [ 665.672839][T22457] netlink: 4 bytes leftover after parsing attributes in process `syz.1.4302'. [ 665.722014][T22461] vlan2: entered promiscuous mode [ 665.727170][T22461] dummy0: entered promiscuous mode [ 666.010454][T22475] xt_CT: No such helper "snmp" [ 666.266432][T22487] netlink: 'syz.3.4313': attribute type 16 has an invalid length. [ 666.402591][T22490] netlink: 'syz.4.4314': attribute type 10 has an invalid length. [ 667.501006][T22549] @0: renamed from bond_slave_1 [ 667.646270][T22557] sctp: [Deprecated]: syz.2.4333 (pid 22557) Use of int in max_burst socket option. [ 667.646270][T22557] Use struct sctp_assoc_value instead [ 667.769696][ T30] audit: type=1800 audit(1769236687.479:6): pid=22544 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.4.4328" name="memory.events" dev="tmpfs" ino=1074 res=0 errno=0 [ 668.236023][T22581] RDS: rds_bind could not find a transport for ::ffff:172.20.20.170, load rds_tcp or rds_rdma? [ 668.671797][T22597] __nla_validate_parse: 6 callbacks suppressed [ 668.671817][T22597] netlink: 28 bytes leftover after parsing attributes in process `syz.2.4339'. [ 668.691958][T22599] netlink: 'syz.4.4340': attribute type 1 has an invalid length. [ 668.862415][T22599] 8021q: adding VLAN 0 to HW filter on device bond10 [ 668.941843][T22604] batman_adv: Cannot find parent device. Skipping batadv-on-batadv check for gretap2 [ 669.021320][T22607] netlink: 212368 bytes leftover after parsing attributes in process `syz.3.4343'. [ 669.046460][T22604] batman_adv: batadv0: Adding interface: gretap2 [ 669.062919][T22604] batman_adv: batadv0: The MTU of interface gretap2 is too small (1462) to handle the transport of batman-adv packets. If you experience problems getting traffic through try increasing the MTU to 1500. [ 669.147915][T22604] batman_adv: batadv0: Interface activated: gretap2 [ 669.593632][T22646] netlink: 24 bytes leftover after parsing attributes in process `syz.4.4353'. [ 669.883969][T22623] macvlan2: entered allmulticast mode [ 669.890689][T22623] syz_tun: entered allmulticast mode [ 669.900332][T22623] team0: Port device macvlan2 added [ 670.133039][T22657] bridge0: port 2(bridge_slave_1) entered disabled state [ 670.141744][T22657] bridge_slave_1: left allmulticast mode [ 670.148845][T22657] bridge_slave_1: left promiscuous mode [ 670.159586][T22657] bridge0: port 2(bridge_slave_1) entered disabled state [ 670.177102][T22657] bridge_slave_1: entered promiscuous mode [ 670.183913][T22657] bridge_slave_1: entered allmulticast mode [ 670.227416][T22657] bond0: (slave bridge_slave_1): Enslaving as an active interface with an up link [ 670.321130][T22661] wg1 speed is unknown, defaulting to 1000 [ 670.346574][T22661] lo speed is unknown, defaulting to 1000 [ 670.448959][T22672] xt_addrtype: input interface limitation not valid in POSTROUTING and OUTPUT [ 670.605408][T22680] netlink: 4 bytes leftover after parsing attributes in process `syz.1.4363'. [ 670.692995][T22680] bridge_slave_1: left allmulticast mode [ 670.701568][T22680] bridge_slave_1: left promiscuous mode [ 670.738391][T22680] bridge0: port 2(bridge_slave_1) entered disabled state [ 670.778895][T22680] bridge_slave_0: left allmulticast mode [ 670.785128][T22680] bridge0: port 1(bridge_slave_0) entered disabled state [ 671.457489][T22689] netlink: 6 bytes leftover after parsing attributes in process `syz.3.4361'. [ 671.466689][T22689] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 671.491924][T22698] tipc: Started in network mode [ 671.496975][T22698] tipc: Node identity 4, cluster identity 4711 [ 671.506684][T22698] tipc: Node number set to 4 [ 671.512855][T22690] netlink: 40 bytes leftover after parsing attributes in process `syz.2.4364'. [ 671.703287][T22709] netlink: 'syz.4.4366': attribute type 11 has an invalid length. [ 671.803633][T22716] netlink: 'syz.2.4370': attribute type 1 has an invalid length. [ 671.869335][T22721] netlink: 16 bytes leftover after parsing attributes in process `syz.4.4371'. [ 671.942821][T22719] sit0: entered promiscuous mode [ 672.002540][T22719] netlink: 'syz.4.4371': attribute type 1 has an invalid length. [ 672.011990][T22719] netlink: 1 bytes leftover after parsing attributes in process `syz.4.4371'. [ 672.044026][T22724] bond9: entered promiscuous mode [ 672.072011][T22724] bond9: entered allmulticast mode [ 672.079584][T22724] 8021q: adding VLAN 0 to HW filter on device bond9 [ 672.182983][T22716] 8021q: adding VLAN 0 to HW filter on device bond10 [ 672.194755][T22716] bond10: entered promiscuous mode [ 672.200717][T22716] bond10: entered allmulticast mode [ 672.208618][T22716] bond9: (slave bond10): Enslaving as a backup interface with a down link [ 672.257124][T22736] pim6reg1: entered promiscuous mode [ 672.269409][T22744] netlink: 12 bytes leftover after parsing attributes in process `syz.4.4377'. [ 672.288522][T22736] pim6reg1: entered allmulticast mode [ 672.302968][T22742] delete_channel: no stack [ 672.344104][T22746] syzkaller1: entered promiscuous mode [ 672.353614][T22746] syzkaller1: entered allmulticast mode [ 672.436476][ T30] audit: type=1107 audit(1769236692.129:7): pid=22751 uid=0 auid=4294967295 ses=4294967295 subj=unconfined msg='' [ 672.680229][T22766] netlink: 20 bytes leftover after parsing attributes in process `syz.3.4385'. [ 673.249940][T22803] 8021q: adding VLAN 0 to HW filter on device bond9 [ 673.328755][T22812] netlink: 'syz.0.4401': attribute type 1 has an invalid length. [ 673.393365][T22812] 8021q: adding VLAN 0 to HW filter on device bond10 [ 673.529702][T22812] bond10: (slave gretap1): making interface the new active one [ 673.548586][T22812] bond10: (slave gretap1): Enslaving as an active interface with an up link [ 673.602332][T22812] macsec2: entered promiscuous mode [ 673.608320][T22812] macsec2: entered allmulticast mode [ 673.763259][T22831] wg1 speed is unknown, defaulting to 1000 [ 673.782919][T22835] x_tables: unsorted underflow at hook 2 [ 673.794429][T22831] lo speed is unknown, defaulting to 1000 [ 674.218998][ T10] IPVS: starting estimator thread 0... [ 674.328878][T22850] IPVS: using max 27 ests per chain, 64800 per kthread [ 674.408485][T22855] __nla_validate_parse: 7 callbacks suppressed [ 674.408506][T22855] netlink: 12 bytes leftover after parsing attributes in process `syz.3.4413'. [ 674.498152][T22860] netlink: 56 bytes leftover after parsing attributes in process `syz.1.4414'. [ 674.519431][T22862] netlink: 4 bytes leftover after parsing attributes in process `syz.3.4413'. [ 674.547602][T22860] netlink: 20 bytes leftover after parsing attributes in process `syz.1.4414'. [ 674.586967][T22855] 8021q: adding VLAN 0 to HW filter on device bond9 [ 674.653221][T22862] 8021q: adding VLAN 0 to HW filter on device batadv3 [ 674.671776][T22862] bond9: (slave batadv3): Enslaving as an active interface with an up link [ 674.831413][T22878] xt_policy: too many policy elements [ 674.855428][T15532] IPVS: stop unused estimator thread 0... [ 674.942269][T22879] wg1 speed is unknown, defaulting to 1000 [ 674.950028][T22879] lo speed is unknown, defaulting to 1000 [ 675.579725][T22904] wg1 speed is unknown, defaulting to 1000 [ 675.614012][T22904] lo speed is unknown, defaulting to 1000 [ 676.118477][T22927] IPVS: ovf: FWM 3 0x00000003 - no destination available [ 676.174473][T22929] siw: device registration error -23 [ 676.189503][T22927] bond0: left allmulticast mode [ 676.208375][T22927] : left allmulticast mode [ 676.213060][T22927] bond_slave_1: left allmulticast mode [ 676.247650][T22927] bond1: left allmulticast mode [ 676.252690][T22927] bridge_slave_1: left allmulticast mode [ 676.270316][T22927] bridge0: port 3(bond0) entered disabled state [ 676.384129][T22927] bridge_slave_0: left allmulticast mode [ 676.419858][T22927] bridge_slave_0: left promiscuous mode [ 676.445499][T22927] bridge0: port 1(bridge_slave_0) entered disabled state [ 676.525658][T22952] netlink: 48 bytes leftover after parsing attributes in process `syz.1.4442'. [ 677.032365][T22927] bond0: (slave bridge_slave_1): Releasing backup interface [ 677.042417][T22927] bridge_slave_1: left promiscuous mode [ 677.080063][T22927] bond0: (slave 32): Releasing backup interface [ 677.094666][T22927] : left promiscuous mode [ 677.126800][T22927] bond0: (slave bond_slave_1): Releasing backup interface [ 677.141813][T22927] bond_slave_1: left promiscuous mode [ 677.159574][T22973] netlink: 8 bytes leftover after parsing attributes in process `syz.2.4445'. [ 677.165797][T22927] team0: Port device team_slave_0 removed [ 677.180918][T22927] team0: Port device team_slave_1 removed [ 677.186433][T22973] netlink: 56 bytes leftover after parsing attributes in process `syz.2.4445'. [ 677.190024][T22927] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 677.204086][T22927] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 677.215175][T22927] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 677.223252][T22927] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 677.247909][T22927] A link change request failed with some changes committed already. Interface hsr_slave_0 may have been left with an inconsistent configuration, please check. [ 677.332796][T22960] wg1 speed is unknown, defaulting to 1000 [ 677.358843][T22960] lo speed is unknown, defaulting to 1000 [ 677.646633][T22984] wg1 speed is unknown, defaulting to 1000 [ 677.665447][T22984] lo speed is unknown, defaulting to 1000 [ 677.690427][T22989] nft_compat: unsupported protocol 0 [ 677.757708][ T52] Bluetooth: hci3: command 0x0406 tx timeout [ 678.033862][T22997] netlink: 8 bytes leftover after parsing attributes in process `syz.4.4453'. [ 678.110853][T22998] xt_TCPMSS: Only works on TCP SYN packets [ 680.427342][T22995] wg1 speed is unknown, defaulting to 1000 [ 680.434073][T22995] wg1 speed is unknown, defaulting to 1000 [ 680.441029][T22995] wg1 speed is unknown, defaulting to 1000 [ 680.460430][T22995] infiniband syz: RDMA CMA: cma_listen_on_dev, error -98 [ 680.593126][T22989] wg1 speed is unknown, defaulting to 1000 [ 680.599403][T22995] wg1 speed is unknown, defaulting to 1000 [ 680.617908][T22995] wg1 speed is unknown, defaulting to 1000 [ 680.638254][T22995] wg1 speed is unknown, defaulting to 1000 [ 680.645750][T22995] wg1 speed is unknown, defaulting to 1000 [ 680.664295][T22995] wg1 speed is unknown, defaulting to 1000 [ 680.681607][T22995] wg1 speed is unknown, defaulting to 1000 [ 680.689258][T22995] wg1 speed is unknown, defaulting to 1000 [ 680.696424][T22995] wg1 speed is unknown, defaulting to 1000 [ 680.703844][T22995] wg1 speed is unknown, defaulting to 1000 [ 680.711198][T22995] wg1 speed is unknown, defaulting to 1000 [ 680.719890][T22995] wg1 speed is unknown, defaulting to 1000 [ 680.728678][T23003] wg1 speed is unknown, defaulting to 1000 [ 680.737897][T22989] lo speed is unknown, defaulting to 1000 [ 680.746878][T23003] lo speed is unknown, defaulting to 1000 [ 681.050535][T23011] netlink: 16 bytes leftover after parsing attributes in process `syz.4.4457'. [ 681.141779][T23014] Bluetooth: MGMT ver 1.23 [ 681.151340][T23014] Bluetooth: hci1: too big key_count value 29096 [ 681.171309][T23013] mac80211_hwsim hwsim37 wlan1: (WE) : Wireless Event (cmd=0x8B1A) too big (33) [ 681.473888][T23035] netlink: 12 bytes leftover after parsing attributes in process `syz.2.4467'. [ 681.527048][T23041] netlink: 4 bytes leftover after parsing attributes in process `syz.2.4467'. [ 681.560811][T23035] 8021q: adding VLAN 0 to HW filter on device bond11 [ 681.614956][T23041] 8021q: adding VLAN 0 to HW filter on device batadv5 [ 681.626136][T23041] bond11: (slave batadv5): Enslaving as an active interface with an up link [ 681.709859][T23039] workqueue: Failed to create a rescuer kthread for wq "bond10": -EINTR [ 681.711355][T23046] workqueue: Failed to create a rescuer kthread for wq "bond10": -EINTR [ 681.822936][T23058] netlink: 8 bytes leftover after parsing attributes in process `syz.2.4471'. [ 681.881848][T23058] netdevsim netdevsim2 eth3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 681.946547][T23061] netlink: 12 bytes leftover after parsing attributes in process `syz.4.4473'. [ 681.976665][T23061] netlink: 'syz.4.4473': attribute type 1 has an invalid length. [ 682.060126][T23058] netdevsim netdevsim2 eth2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 682.085779][T23061] netlink: 20 bytes leftover after parsing attributes in process `syz.4.4473'. [ 682.104513][T23061] x_tables: (null)_tables: SNAT target: only valid in nat table, not syz0 [ 682.201774][T23058] netdevsim netdevsim2 eth1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 682.260596][T23077] netlink: 4 bytes leftover after parsing attributes in process `syz.3.4479'. [ 682.297302][T23058] netdevsim netdevsim2 eth0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 682.428334][T15530] netdevsim netdevsim2 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 682.448174][T15530] netdevsim netdevsim2 eth1: set [1, 0] type 2 family 0 port 6081 - 0 [ 682.476301][T15530] netdevsim netdevsim2 eth2: set [1, 0] type 2 family 0 port 6081 - 0 [ 682.572578][T15530] netdevsim netdevsim2 eth3: set [1, 0] type 2 family 0 port 6081 - 0 [ 682.619255][T23083] netlink: 12 bytes leftover after parsing attributes in process `syz.0.4482'. [ 682.671016][T23084] netlink: 4 bytes leftover after parsing attributes in process `syz.0.4482'. [ 682.715590][T23083] 8021q: adding VLAN 0 to HW filter on device bond11 [ 682.931738][T23084] 8021q: adding VLAN 0 to HW filter on device batadv3 [ 682.953141][T23084] bond11: (slave batadv3): Enslaving as an active interface with an up link [ 683.143071][T23097] netlink: 'syz.1.4485': attribute type 10 has an invalid length. [ 683.165473][T23097] netlink: 228 bytes leftover after parsing attributes in process `syz.1.4485'. [ 683.631425][ T30] audit: type=1804 audit(1769236703.289:8): pid=23113 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=open_writers comm="syz.0.4493" name="/newroot/280/cgroup.controllers" dev="tmpfs" ino=1453 res=1 errno=0 [ 683.655543][ T30] audit: type=1800 audit(1769236703.299:9): pid=23113 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.0.4493" name="cgroup.controllers" dev="tmpfs" ino=1453 res=0 errno=0 [ 683.824755][T23125] TCP: TCP_TX_DELAY enabled [ 683.908257][T23130] netlink: 'syz.3.4497': attribute type 298 has an invalid length. [ 684.382499][T23152] netlink: 'syz.1.4506': attribute type 1 has an invalid length. [ 684.445877][T23152] bond9: entered promiscuous mode [ 684.451639][T23152] 8021q: adding VLAN 0 to HW filter on device bond9 [ 684.672840][T23167] 8021q: adding VLAN 0 to HW filter on device bond12 [ 684.783201][T23173] 8021q: adding VLAN 0 to HW filter on device batadv4 [ 684.825837][T23173] bond12: (slave batadv4): Enslaving as an active interface with an up link [ 685.777912][T23237] openvswitch: netlink: IP tunnel dst address not specified [ 685.940810][T23238] bridge4: port 1(veth0_to_bond) entered blocking state [ 685.964148][T23238] bridge4: port 1(veth0_to_bond) entered disabled state [ 685.972349][T23238] veth0_to_bond: entered allmulticast mode [ 685.981054][T23238] veth0_to_bond: entered promiscuous mode [ 686.079365][T23247] RDS: rds_bind could not find a transport for fe80::bb, load rds_tcp or rds_rdma? [ 686.201005][T23257] __nla_validate_parse: 11 callbacks suppressed [ 686.201028][T23257] netlink: 28 bytes leftover after parsing attributes in process `syz.0.4538'. [ 686.227922][T23257] netlink: 12 bytes leftover after parsing attributes in process `syz.0.4538'. [ 686.262469][T23262] faux_driver regulatory: loading /lib/firmware/regulatory.db failed with error -4 [ 686.309536][T23262] faux_driver regulatory: Direct firmware load for regulatory.db failed with error -4 [ 686.329358][T23263] netlink: 'syz.0.4538': attribute type 21 has an invalid length. [ 686.337325][T23262] faux_driver regulatory: Falling back to sysfs fallback for: regulatory.db [ 686.388997][T23263] netlink: 132 bytes leftover after parsing attributes in process `syz.0.4538'. [ 686.491442][T23275] netlink: 12 bytes leftover after parsing attributes in process `syz.3.4544'. [ 686.539446][T23275] 8021q: adding VLAN 0 to HW filter on device bond10 [ 687.231649][T23314] netlink: 96 bytes leftover after parsing attributes in process `syz.2.4553'. [ 687.286067][T23318] netlink: 96 bytes leftover after parsing attributes in process `syz.2.4553'. [ 687.384056][T23323] netlink: 12 bytes leftover after parsing attributes in process `syz.4.4555'. [ 687.392602][T23314] netlink: 'syz.2.4553': attribute type 1 has an invalid length. [ 687.443725][T23326] netlink: 'syz.1.4557': attribute type 1 has an invalid length. [ 687.491925][T23323] bond11: (slave bridge5): Enslaving as an active interface with an up link [ 687.514650][T23318] bond12: (slave vxcan3): The slave device specified does not support setting the MAC address [ 687.531087][T23332] netlink: 4 bytes leftover after parsing attributes in process `syz.1.4557'. [ 687.542360][T23318] bond12: (slave vxcan3): Error -95 calling set_mac_address [ 687.669936][T23332] bond10 (unregistering): Released all slaves [ 687.804383][T23346] openvswitch: netlink: IPv4 tunnel dst address is zero [ 688.650417][T23340] batman_adv: batadv0: Interface deactivated: gretap2 [ 688.694979][ T10] wg1 speed is unknown, defaulting to 1000 [ 688.705294][ T10] syz: Port: 1 Link DOWN [ 688.722299][T15524] netdevsim netdevsim4 eth0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 688.741530][T15524] netdevsim netdevsim4 eth1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 688.760903][T15524] netdevsim netdevsim4 eth2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 688.776235][T15524] netdevsim netdevsim4 eth3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 689.576039][T23443] openvswitch: netlink: IP tunnel TTL not specified. [ 689.616701][T23448] netlink: 180 bytes leftover after parsing attributes in process `syz.1.4586'. [ 689.680706][T23451] netlink: 4 bytes leftover after parsing attributes in process `syz.2.4587'. [ 690.094084][T23477] netlink: 'syz.2.4599': attribute type 1 has an invalid length. [ 690.102558][T23477] netlink: 'syz.2.4599': attribute type 4 has an invalid length. [ 690.396658][T23488] wg1 speed is unknown, defaulting to 1000 [ 690.416482][T23488] lo speed is unknown, defaulting to 1000 [ 690.450255][T23488] wg1 speed is unknown, defaulting to 1000 [ 690.498662][T23503] netlink: 'syz.2.4605': attribute type 12 has an invalid length. [ 690.884422][T23529] netlink: 'syz.0.4612': attribute type 2 has an invalid length. [ 691.036023][T23537] geneve2: entered promiscuous mode [ 691.044596][ T1302] aoe: packet could not be sent on bond0. consider increasing tx_queue_len [ 691.056314][ T1302] lec:lec_start_xmit: lec0:No lecd attached [ 691.078587][T14845] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 691.120675][T14845] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 691.147592][T14845] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 691.176761][T14845] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 691.264033][T23551] wg1 speed is unknown, defaulting to 1000 [ 691.275712][T23551] lo speed is unknown, defaulting to 1000 [ 691.295455][T23551] wg1 speed is unknown, defaulting to 1000 [ 691.341799][T23559] gre0: left promiscuous mode [ 691.378420][T23559] gre0: left allmulticast mode [ 691.617787][T23570] FAULT_INJECTION: forcing a failure. [ 691.617787][T23570] name failslab, interval 1, probability 0, space 0, times 0 [ 691.687825][T23570] CPU: 1 UID: 0 PID: 23570 Comm: syz.3.4623 Not tainted syzkaller #0 PREEMPT(full) [ 691.687855][T23570] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/13/2026 [ 691.687867][T23570] Call Trace: [ 691.687875][T23570] [ 691.687884][T23570] dump_stack_lvl+0xe8/0x150 [ 691.687916][T23570] should_fail_ex+0x412/0x560 [ 691.687951][T23570] should_failslab+0xa8/0x100 [ 691.687977][T23570] __kvmalloc_node_noprof+0x166/0x8d0 [ 691.688013][T23570] ? page_pool_create_percpu+0x2dd/0xb80 [ 691.688040][T23570] ? page_pool_create_percpu+0xaf/0xb80 [ 691.688074][T23570] page_pool_create_percpu+0x2dd/0xb80 [ 691.688112][T23570] bpf_test_run_xdp_live+0x23d/0x1cf0 [ 691.688145][T23570] ? bpf_dispatcher_change_prog+0xae0/0xd70 [ 691.688185][T23570] ? __pfx_wait_rcu_exp_gp+0x10/0x10 [ 691.688214][T23570] ? __pfx_autoremove_wake_function+0x10/0x10 [ 691.688249][T23570] ? __pfx_bpf_test_run_xdp_live+0x10/0x10 [ 691.688298][T23570] ? 0xffffffffa02019dc [ 691.688345][T23570] ? __pfx_xdp_test_run_init_page+0x10/0x10 [ 691.688384][T23570] ? _copy_from_user+0x94/0xb0 [ 691.688407][T23570] ? bpf_test_init+0x113/0x150 [ 691.688429][T23570] ? xdp_convert_md_to_buff+0x5b/0x330 [ 691.688458][T23570] bpf_prog_test_run_xdp+0x81c/0x1160 [ 691.688500][T23570] ? __pfx_bpf_prog_test_run_xdp+0x10/0x10 [ 691.688532][T23570] ? __fget_files+0x2a/0x420 [ 691.688563][T23570] ? __pfx_bpf_prog_test_run_xdp+0x10/0x10 [ 691.688590][T23570] bpf_prog_test_run+0x2c7/0x340 [ 691.688624][T23570] __sys_bpf+0x5cb/0x920 [ 691.688655][T23570] ? __pfx___sys_bpf+0x10/0x10 [ 691.688702][T23570] ? ksys_write+0x242/0x270 [ 691.688725][T23570] ? __pfx_ksys_write+0x10/0x10 [ 691.688755][T23570] __x64_sys_bpf+0x7c/0x90 [ 691.688781][T23570] do_syscall_64+0xe2/0xf80 [ 691.688801][T23570] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 691.688821][T23570] ? trace_irq_disable+0x37/0x100 [ 691.688848][T23570] ? clear_bhb_loop+0x60/0xb0 [ 691.688872][T23570] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 691.688892][T23570] RIP: 0033:0x7f399a99acb9 [ 691.688910][T23570] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 691.688927][T23570] RSP: 002b:00007f399b8b2028 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 691.688948][T23570] RAX: ffffffffffffffda RBX: 00007f399ac15fa0 RCX: 00007f399a99acb9 [ 691.688963][T23570] RDX: 0000000000000048 RSI: 0000200000000600 RDI: 000000000000000a [ 691.688976][T23570] RBP: 00007f399b8b2090 R08: 0000000000000000 R09: 0000000000000000 [ 691.689001][T23570] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 691.689014][T23570] R13: 00007f399ac16038 R14: 00007f399ac15fa0 R15: 00007fffd47bb588 [ 691.689048][T23570] [ 691.689128][T23570] page_pool_create_percpu() gave up with errno -12 [ 692.445155][T23592] __nla_validate_parse: 5 callbacks suppressed [ 692.445175][T23592] netlink: 8 bytes leftover after parsing attributes in process `syz.3.4626'. [ 692.466205][T23559] bridge0: port 3(bond0) entered disabled state [ 692.473479][T23559] bridge0: port 1(bridge_slave_0) entered disabled state [ 693.083101][T23559] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 693.157985][T23559] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 693.734989][T23559] xfrm1: left allmulticast mode [ 693.748091][T23559] mac80211_hwsim hwsim41 wlan0: left promiscuous mode [ 693.760671][T23559] mac80211_hwsim hwsim41 wlan0: left allmulticast mode [ 693.768768][T23559] bond1: left promiscuous mode [ 693.773709][T23559] vcan1: left promiscuous mode [ 693.779053][T23559] vcan1: left allmulticast mode [ 693.795229][T23559] bridge1: left allmulticast mode [ 693.926009][T23559] vlan2: left promiscuous mode [ 693.981884][T23559] veth3: left promiscuous mode [ 694.031358][T23559] macsec2: left promiscuous mode [ 694.044129][T23559] macsec2: left allmulticast mode [ 694.113771][T23575] syzkaller1: entered allmulticast mode [ 694.120027][T23582] syzkaller1: left allmulticast mode [ 694.550212][T23607] netlink: 8 bytes leftover after parsing attributes in process `syz.4.4630'. [ 695.159166][T23626] netlink: 28 bytes leftover after parsing attributes in process `syz.4.4637'. [ 695.176401][T23626] netlink: 28 bytes leftover after parsing attributes in process `syz.4.4637'. [ 695.294460][T23634] xt_CHECKSUM: unsupported CHECKSUM operation 68 [ 695.479041][T23630] wg1 speed is unknown, defaulting to 1000 [ 695.507704][T23630] lo speed is unknown, defaulting to 1000 [ 695.543295][T23630] wg1 speed is unknown, defaulting to 1000 [ 695.682520][T23646] wg1 speed is unknown, defaulting to 1000 [ 695.728177][T23646] lo speed is unknown, defaulting to 1000 [ 695.754858][T23649] netlink: 8 bytes leftover after parsing attributes in process `syz.3.4641'. [ 695.776534][T23648] wg1 speed is unknown, defaulting to 1000 [ 695.797285][T23646] wg1 speed is unknown, defaulting to 1000 [ 695.825215][T23648] lo speed is unknown, defaulting to 1000 [ 695.897008][T23648] wg1 speed is unknown, defaulting to 1000 [ 696.051152][T23655] netlink: 8 bytes leftover after parsing attributes in process `syz.4.4644'. [ 696.067838][ C0] lec0: NETDEV WATCHDOG: CPU: 0: transmit queue 0 timed out 5010 ms [ 696.076004][ C0] lec:lec_tx_timeout: lec0 [ 696.179648][T23659] netlink: 8 bytes leftover after parsing attributes in process `syz.4.4644'. [ 696.674033][ T5835] IPVS: starting estimator thread 0... [ 696.785183][T23689] IPVS: using max 29 ests per chain, 69600 per kthread [ 697.144722][T23712] wg1 speed is unknown, defaulting to 1000 [ 697.165120][T23712] lo speed is unknown, defaulting to 1000 [ 697.175842][T23712] wg1 speed is unknown, defaulting to 1000 [ 697.416904][T23729] netlink: 'syz.3.4667': attribute type 3 has an invalid length. [ 697.490936][T23727] veth7: entered promiscuous mode [ 697.526214][T23727] netlink: 'syz.1.4666': attribute type 83 has an invalid length. [ 697.534735][T14845] IPVS: stop unused estimator thread 0... [ 697.662029][T23741] tipc: Enabled bearer , priority 0 [ 697.672621][T23741] syzkaller0: entered promiscuous mode [ 697.707784][T23741] syzkaller0: entered allmulticast mode [ 697.723770][T23741] netlink: 'syz.0.4672': attribute type 13 has an invalid length. [ 697.771626][T23743] bond0: left allmulticast mode [ 697.776553][T23743] bond_slave_0: left allmulticast mode [ 697.784033][T23743] bond_slave_1: left allmulticast mode [ 697.808015][T23743] bridge0: port 3(bond0) entered disabled state [ 697.865186][T23743] bridge_slave_0: left allmulticast mode [ 697.882010][T23743] bridge_slave_0: left promiscuous mode [ 697.892612][T23743] bridge0: port 1(bridge_slave_0) entered disabled state [ 697.903819][T23743] bridge_slave_1: left allmulticast mode [ 697.924439][T23743] bridge_slave_1: left promiscuous mode [ 697.933135][T23743] bridge0: port 2(bridge_slave_1) entered disabled state [ 697.949200][T23743] bond0: (slave bond_slave_0): Releasing backup interface [ 697.967000][T23743] bond_slave_0: left promiscuous mode [ 697.975214][T23743] bond0: (slave bond_slave_1): Releasing backup interface [ 697.985954][T23743] bond_slave_1: left promiscuous mode [ 697.998652][T23743] team0: Port device team_slave_0 removed [ 698.023775][T23743] team0: Port device team_slave_1 removed [ 698.046251][T23743] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 698.076264][T23743] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 698.104964][T23743] A link change request failed with some changes committed already. Interface hsr_slave_0 may have been left with an inconsistent configuration, please check. [ 698.138237][T23741] tipc: Resetting bearer [ 698.218299][T23739] tipc: Resetting bearer [ 698.252169][T23766] netlink: 4 bytes leftover after parsing attributes in process `syz.2.4677'. [ 698.279479][T23739] tipc: Disabling bearer [ 698.449177][T23752] wg1 speed is unknown, defaulting to 1000 [ 698.489717][T23752] lo speed is unknown, defaulting to 1000 [ 698.499092][T23752] wg1 speed is unknown, defaulting to 1000 [ 698.564485][T23777] netlink: 12 bytes leftover after parsing attributes in process `syz.0.4680'. [ 698.628230][T23779] netlink: 8 bytes leftover after parsing attributes in process `syz.2.4679'. [ 698.678574][T23785] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 698.814067][T23789] netlink: 'syz.4.4683': attribute type 12 has an invalid length. [ 698.999239][T23802] netlink: 20 bytes leftover after parsing attributes in process `syz.2.4686'. [ 699.026924][T23802] netlink: 'syz.2.4686': attribute type 83 has an invalid length. [ 699.243890][T23811] netlink: 24 bytes leftover after parsing attributes in process `syz.4.4690'. [ 699.265642][T23813] team0 (unregistering): Port device team_slave_0 removed [ 699.277259][T23813] team0 (unregistering): Port device team_slave_1 removed [ 699.293825][T23813] syz_tun: left allmulticast mode [ 699.303205][T23813] team0 (unregistering): Port device macvlan2 removed [ 700.864405][T23817] ip6gre2: entered promiscuous mode [ 701.028566][T23836] block nbd0: NBD_DISCONNECT [ 701.043497][T23836] block nbd0: Send disconnect failed -32 [ 701.089452][T23840] batadv0: left promiscuous mode [ 701.091948][T23842] netlink: 'syz.3.4698': attribute type 3 has an invalid length. [ 701.106900][T23842] netlink: 'syz.3.4698': attribute type 1 has an invalid length. [ 701.117046][T23842] netlink: 60387 bytes leftover after parsing attributes in process `syz.3.4698'. [ 701.158695][T23838] netlink: 4 bytes leftover after parsing attributes in process `syz.1.4695'. [ 701.430137][T23864] netlink: 4 bytes leftover after parsing attributes in process `syz.2.4697'. [ 701.548054][T23840] geneve2: left promiscuous mode [ 701.559996][T23840] bond2: left promiscuous mode [ 701.565279][T23840] bond2: left allmulticast mode [ 701.580556][T23840] veth1_to_hsr: left allmulticast mode [ 701.586645][T23840] macvtap1: left promiscuous mode [ 701.592635][T23840] macvtap1: left allmulticast mode [ 701.631568][T23840] bond9: left promiscuous mode [ 701.636582][T23840] bond10: left promiscuous mode [ 701.642045][T23840] bond9: left allmulticast mode [ 701.647168][T23840] bond10: left allmulticast mode [ 701.664866][T23840] ip6gre2: left promiscuous mode [ 701.712602][T23864] geneve3: entered promiscuous mode [ 701.732651][T23864] geneve3: entered allmulticast mode [ 701.750174][T23875] netlink: 4 bytes leftover after parsing attributes in process `syz.1.4703'. [ 701.780112][T23869] batman_adv: Cannot find parent device. Skipping batadv-on-batadv check for ip6gretap2 [ 701.804654][T23876] netlink: 12 bytes leftover after parsing attributes in process `syz.1.4703'. [ 702.444639][T23912] mac80211_hwsim hwsim39 wlan0: entered promiscuous mode [ 702.470391][T23912] A link change request failed with some changes committed already. Interface wlan0 may have been left with an inconsistent configuration, please check. [ 703.375275][T23942] xt_socket: unknown flags 0x50 [ 703.646349][T23955] RDS: rds_bind could not find a transport for ::ffff:172.20.20.187, load rds_tcp or rds_rdma? [ 703.661840][T23954] __nla_validate_parse: 3 callbacks suppressed [ 703.661862][T23954] netlink: 100 bytes leftover after parsing attributes in process `syz.3.4725'. [ 703.872146][T23964] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 703.901680][T23963] tc_dump_action: action bad kind [ 704.060372][T23970] sctp: [Deprecated]: syz.2.4730 (pid 23970) Use of int in max_burst socket option. [ 704.060372][T23970] Use struct sctp_assoc_value instead [ 704.442162][T23985] tipc: Enabling of bearer rejected, media not registered [ 704.511410][T23991] netlink: 148 bytes leftover after parsing attributes in process `syz.1.4735'. [ 704.531957][T23991] A link change request failed with some changes committed already. Interface gre0 may have been left with an inconsistent configuration, please check. [ 704.560420][T23993] netlink: 8 bytes leftover after parsing attributes in process `syz.4.4736'. [ 704.612450][T23999] netlink: 8 bytes leftover after parsing attributes in process `syz.2.4737'. [ 704.696116][T23999] netlink: 8 bytes leftover after parsing attributes in process `syz.2.4737'. [ 704.741553][T24003] mac80211_hwsim hwsim50 wlan0: entered promiscuous mode [ 704.751882][T23999] netlink: 8 bytes leftover after parsing attributes in process `syz.2.4737'. [ 704.819677][T23999] netlink: 8 bytes leftover after parsing attributes in process `syz.2.4737'. [ 704.898276][T23999] netlink: 8 bytes leftover after parsing attributes in process `syz.2.4737'. [ 705.010128][T24024] netlink: 'syz.1.4744': attribute type 30 has an invalid length. [ 705.235787][T24024] wg1 speed is unknown, defaulting to 1000 [ 705.272156][T24024] lo speed is unknown, defaulting to 1000 [ 705.408443][T24040] netlink: 8 bytes leftover after parsing attributes in process `syz.0.4745'. [ 705.569967][ T9930] lec:lec_start_xmit: lec0:No lecd attached [ 705.936473][T24074] IPVS: Schedule: port zero only supported in persistent services, check your ipvs configuration [ 705.974362][T24069] workqueue: Failed to create a rescuer kthread for wq "nfc2_nci_rx_wq": -EINTR [ 706.173750][T24079] netlink: 48 bytes leftover after parsing attributes in process `syz.4.4756'. [ 706.285939][T24024] wg1 speed is unknown, defaulting to 1000 [ 706.293763][T24047] workqueue: Failed to create a rescuer kthread for wq "bond11": -EINTR [ 706.766733][T24102] veth0: entered promiscuous mode [ 706.839891][T24102] veth0 (unregistering): left promiscuous mode [ 706.932890][T24104] iwpm_parse_nlmsg: Invalid attribute (msg type Query Mapping response ret = -34) [ 707.015290][T24109] wg1 speed is unknown, defaulting to 1000 [ 707.023528][T24109] lo speed is unknown, defaulting to 1000 [ 707.031244][T24109] wg1 speed is unknown, defaulting to 1000 [ 708.414926][T24144] openvswitch: netlink: IP tunnel dst address not specified [ 708.551186][T24154] ipt_ECN: cannot use operation on non-tcp rule [ 708.570585][T24154] netlink: 'syz.1.4779': attribute type 30 has an invalid length. [ 708.706663][T24161] netlink: 'syz.2.4782': attribute type 10 has an invalid length. [ 708.721356][T24162] rdma_rxe: rxe_newlink: failed to add lo [ 708.731232][T24161] 8021q: adding VLAN 0 to HW filter on device team0 [ 708.740728][T24161] team0: entered promiscuous mode [ 708.745823][T24161] bridge1: entered promiscuous mode [ 708.752252][T24161] team0: entered allmulticast mode [ 708.757416][T24161] bridge1: entered allmulticast mode [ 708.765112][T24161] bond0: (slave team0): Enslaving as an active interface with a down link [ 708.783879][T24161] netlink: 'syz.2.4782': attribute type 1 has an invalid length. [ 708.917946][T24174] __nla_validate_parse: 2 callbacks suppressed [ 708.917965][T24174] netlink: 44 bytes leftover after parsing attributes in process `syz.0.4787'. [ 709.016018][T24181] netlink: 8 bytes leftover after parsing attributes in process `syz.2.4788'. [ 709.326903][T24177] wg1 speed is unknown, defaulting to 1000 [ 709.386918][T24177] lo speed is unknown, defaulting to 1000 [ 709.410868][T24177] wg1 speed is unknown, defaulting to 1000 [ 709.719685][T24206] tipc: Enabling of bearer rejected, failed to enable media [ 709.915499][T24214] wg1 speed is unknown, defaulting to 1000 [ 709.936822][T24214] lo speed is unknown, defaulting to 1000 [ 709.960699][T24217] netlink: 32 bytes leftover after parsing attributes in process `syz.3.4799'. [ 709.974316][T24214] wg1 speed is unknown, defaulting to 1000 [ 710.121802][T24231] netlink: 64 bytes leftover after parsing attributes in process `syz.4.4804'. [ 710.413501][T24234] ip6gretap3: entered allmulticast mode [ 710.686278][T24252] netlink: 'syz.2.4812': attribute type 8 has an invalid length. [ 710.703793][T24253] netlink: 4 bytes leftover after parsing attributes in process `syz.0.4811'. [ 710.756225][T24253] netlink: 4 bytes leftover after parsing attributes in process `syz.0.4811'. [ 710.821286][T24264] netlink: 156 bytes leftover after parsing attributes in process `syz.4.4813'. [ 710.842365][T24264] netlink: 12 bytes leftover after parsing attributes in process `syz.4.4813'. [ 711.037620][ C0] lec0: NETDEV WATCHDOG: CPU: 0: transmit queue 0 timed out 5470 ms [ 711.045682][ C0] lec:lec_tx_timeout: lec0 [ 711.223598][T24287] netlink: 'syz.0.4823': attribute type 3 has an invalid length. [ 711.231979][T24287] netlink: 'syz.0.4823': attribute type 1 has an invalid length. [ 711.247826][T24287] netlink: 60387 bytes leftover after parsing attributes in process `syz.0.4823'. [ 711.349932][T24291] netlink: 'syz.3.4825': attribute type 5 has an invalid length. [ 711.367459][T24291] netlink: 88 bytes leftover after parsing attributes in process `syz.3.4825'. [ 711.703899][T24319] netlink: 'syz.3.4829': attribute type 10 has an invalid length. [ 711.762127][T24320] netlink: 'syz.3.4829': attribute type 10 has an invalid length. [ 712.389683][T24319] team0: Port device dummy0 added [ 712.433713][T24320] team0: Port device dummy0 removed [ 712.457401][T24320] dummy0: entered promiscuous mode [ 712.485357][T24320] bond0: (slave dummy0): Enslaving as an active interface with an up link [ 712.651822][T24337] netlink: 'syz.4.4838': attribute type 13 has an invalid length. [ 713.660047][T24391] tipc: Started in network mode [ 713.681090][T24391] tipc: Node identity d649ba6cc154, cluster identity 4711 [ 713.700884][T24391] tipc: Enabled bearer , priority 0 [ 713.722696][T24391] syzkaller0: entered promiscuous mode [ 713.745346][T24391] syzkaller0: entered allmulticast mode [ 713.802535][T24391] tipc: Resetting bearer [ 713.961372][T24414] __nla_validate_parse: 3 callbacks suppressed [ 713.961392][T24414] netlink: 8 bytes leftover after parsing attributes in process `syz.3.4859'. [ 714.050441][T24390] tipc: Resetting bearer [ 714.104071][T24390] tipc: Disabling bearer [ 714.117360][T24414] workqueue: Failed to create a rescuer kthread for wq "bond11": -EINTR [ 714.567329][T24433] IPv6: NLM_F_CREATE should be specified when creating new route [ 714.656310][T24433] netlink: 24 bytes leftover after parsing attributes in process `syz.3.4862'. [ 714.714980][T24444] netlink: 4 bytes leftover after parsing attributes in process `syz.3.4862'. [ 714.899956][T24445] wg1 speed is unknown, defaulting to 1000 [ 714.922366][T24445] lo speed is unknown, defaulting to 1000 [ 714.961804][T24445] wg1 speed is unknown, defaulting to 1000 [ 715.181342][T24462] netlink: 212368 bytes leftover after parsing attributes in process `syz.1.4870'. [ 715.281423][T24457] netlink: 12 bytes leftover after parsing attributes in process `syz.1.4870'. [ 715.294880][T24457] bridge_slave_0: default FDB implementation only supports local addresses [ 715.431724][T24470] netlink: 8 bytes leftover after parsing attributes in process `syz.3.4872'. [ 715.442215][T24470] netlink: 20 bytes leftover after parsing attributes in process `syz.3.4872'. [ 715.469312][T24470] geneve3: entered promiscuous mode [ 715.481797][T24470] geneve3: entered allmulticast mode [ 715.550311][T24470] netlink: 36 bytes leftover after parsing attributes in process `syz.3.4872'. [ 715.823624][T24500] netlink: 44 bytes leftover after parsing attributes in process `syz.4.4875'. [ 715.852107][T24494] wg1 speed is unknown, defaulting to 1000 [ 715.896712][T24494] lo speed is unknown, defaulting to 1000 [ 715.926331][T24494] wg1 speed is unknown, defaulting to 1000 [ 716.012695][T24503] wg1 speed is unknown, defaulting to 1000 [ 716.022774][T24505] netlink: 36 bytes leftover after parsing attributes in process `syz.3.4879'. [ 716.045154][T24503] lo speed is unknown, defaulting to 1000 [ 716.059868][T24503] wg1 speed is unknown, defaulting to 1000 [ 716.343932][T24509] bond0: left allmulticast mode [ 716.354530][T24509] team0: left allmulticast mode [ 716.376693][T24509] bridge1: left allmulticast mode [ 716.389050][T24509] bond0: left promiscuous mode [ 716.393873][T24509] team0: left promiscuous mode [ 716.409154][T24509] bridge1: left promiscuous mode [ 716.414733][T24509] bridge0: port 1(bond0) entered disabled state [ 716.941092][T24539] wg1 speed is unknown, defaulting to 1000 [ 717.066533][T24539] lo speed is unknown, defaulting to 1000 [ 717.090047][T24546] tipc: New replicast peer: 255.255.255.255 [ 717.109594][T24546] tipc: Enabled bearer , priority 10 [ 717.329502][T24539] wg1 speed is unknown, defaulting to 1000 [ 717.780898][T24574] wg1 speed is unknown, defaulting to 1000 [ 717.818682][T24574] lo speed is unknown, defaulting to 1000 [ 717.845894][T24574] wg1 speed is unknown, defaulting to 1000 [ 717.976180][T24593] netlink: 'syz.2.4901': attribute type 10 has an invalid length. [ 717.992556][T24593] team0: Port device dummy0 added [ 718.014731][T24595] --map-set only usable from mangle table [ 718.318553][T24611] xt_bpf: check failed: parse error [ 718.596502][T24620] vlan2: entered promiscuous mode [ 719.239404][T24650] x_tables: ip_tables: DNAT target: used from hooks POSTROUTING, but only usable from PREROUTING/OUTPUT [ 719.338482][T24643] xt_connbytes: Forcing CT accounting to be enabled [ 719.723098][T24678] __nla_validate_parse: 13 callbacks suppressed [ 719.723120][T24678] netlink: 16 bytes leftover after parsing attributes in process `syz.2.4923'. [ 719.739495][T24678] netlink: 108 bytes leftover after parsing attributes in process `syz.2.4923'. [ 719.749094][T24678] netlink: 16 bytes leftover after parsing attributes in process `syz.2.4923'. [ 719.870078][T24692] netlink: 'syz.3.4928': attribute type 1 has an invalid length. [ 720.073846][T24703] geneve3: left promiscuous mode [ 720.079971][T24703] geneve3: left allmulticast mode [ 720.092321][T14845] netdevsim netdevsim2 eth0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 720.122275][T14845] netdevsim netdevsim2 eth1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 720.161226][T14845] netdevsim netdevsim2 eth2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 720.177836][T14845] netdevsim netdevsim2 eth3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 720.474032][T24722] xt_hashlimit: size too large, truncated to 1048576 [ 720.547062][T24731] x9: renamed from bridge_slave_0 [ 720.766494][T24741] netlink: 12 bytes leftover after parsing attributes in process `syz.1.4940'. [ 720.790131][T24740] x_tables: duplicate entry at hook 3 [ 721.187116][T24761] tipc: Started in network mode [ 721.196854][T24761] tipc: Node identity , cluster identity 4711 [ 721.215257][T24761] tipc: Failed to obtain node identity [ 721.222914][T24761] tipc: Enabling of bearer rejected, failed to enable media [ 721.250080][T24753] wg1 speed is unknown, defaulting to 1000 [ 721.364743][T24768] syzkaller0: entered promiscuous mode [ 721.393759][T24768] syzkaller0: entered allmulticast mode [ 721.414915][T24753] lo speed is unknown, defaulting to 1000 [ 721.459711][T24753] wg1 speed is unknown, defaulting to 1000 [ 721.486454][T17987] hid-generic 0005:0006:5508.0001: hidraw0: BLUETOOTH HID vc3.36 Device [syz0] on aa:aa:aa:aa:aa:aa [ 721.586402][T24773] bond13: option arp_validate: invalid value (18446744073491447809) [ 721.617188][T24773] bond13 (unregistering): Released all slaves [ 721.649452][T24780] fido_id[24780]: Failed to open report descriptor at '/sys/devices/virtual/bluetooth/hci2/hci2:200/report_descriptor': No such file or directory [ 723.415564][T24794] nbd: must specify an index to disconnect [ 723.520098][T24790] wg1 speed is unknown, defaulting to 1000 [ 723.528842][T24790] lo speed is unknown, defaulting to 1000 [ 723.536681][T24790] wg1 speed is unknown, defaulting to 1000 [ 723.677997][T24807] netlink: 'syz.0.4954': attribute type 15 has an invalid length. [ 723.685922][T24807] netlink: 24 bytes leftover after parsing attributes in process `syz.0.4954'. [ 723.791950][T24821] sctp: [Deprecated]: syz.3.4958 (pid 24821) Use of int in max_burst socket option. [ 723.791950][T24821] Use struct sctp_assoc_value instead [ 724.048289][T24821] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 724.151050][T24839] sctp: [Deprecated]: syz.2.4961 (pid 24839) Use of struct sctp_assoc_value in delayed_ack socket option. [ 724.151050][T24839] Use struct sctp_sack_info instead [ 724.185462][T24839] netlink: 8 bytes leftover after parsing attributes in process `syz.2.4961'. [ 724.203874][T24839] netlink: 4 bytes leftover after parsing attributes in process `syz.2.4961'. [ 724.213838][T24826] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 724.230161][T24839] netlink: 'syz.2.4961': attribute type 13 has an invalid length. [ 724.239260][T24839] netlink: 'syz.2.4961': attribute type 12 has an invalid length. [ 724.509909][T24853] netlink: 'syz.0.4966': attribute type 1 has an invalid length. [ 724.660814][T24853] 8021q: adding VLAN 0 to HW filter on device bond13 [ 724.757054][T24853] gretap2: entered promiscuous mode [ 724.781638][T24869] pim6reg1: entered promiscuous mode [ 724.800248][T24869] pim6reg1: entered allmulticast mode [ 724.873323][T24873] x_tables: ip_tables: socket match: used from hooks OUTPUT, but only valid from PREROUTING/INPUT [ 724.975630][T24880] wg1 speed is unknown, defaulting to 1000 [ 724.983716][T24880] lo speed is unknown, defaulting to 1000 [ 724.991909][T24880] wg1 speed is unknown, defaulting to 1000 [ 725.217840][T24891] netlink: 64 bytes leftover after parsing attributes in process `syz.1.4973'. [ 725.415952][T24913] netlink: 'syz.0.4980': attribute type 2 has an invalid length. [ 725.435085][T24913] !9: entered promiscuous mode [ 725.463888][T24917] netlink: 'syz.0.4980': attribute type 2 has an invalid length. [ 725.478998][T24917] !9: left promiscuous mode [ 725.682664][T24928] netlink: 8 bytes leftover after parsing attributes in process `syz.1.4985'. [ 725.712801][T24928] netlink: 8 bytes leftover after parsing attributes in process `syz.1.4985'. [ 725.739014][T24928] netlink: 8 bytes leftover after parsing attributes in process `syz.1.4985'. [ 725.769330][T24931] tipc: Enabled bearer , priority 0 [ 725.783460][T24931] syzkaller0: entered promiscuous mode [ 725.789929][T24928] PF_CAN: dropped non conform CAN XL skbuff: dev type 280, len 40 [ 725.798418][T24931] syzkaller0: entered allmulticast mode [ 725.875803][T24931] netlink: 12 bytes leftover after parsing attributes in process `syz.2.4986'. [ 725.899167][T24931] tipc: Resetting bearer [ 725.929269][T24930] tipc: Resetting bearer [ 725.988106][ T5835] IPVS: starting estimator thread 0... [ 726.078118][T24945] IPVS: using max 24 ests per chain, 57600 per kthread [ 726.149596][T24954] netlink: 4 bytes leftover after parsing attributes in process `syz.1.4993'. [ 726.232853][T24930] tipc: Disabling bearer [ 726.493629][T24958] wg1 speed is unknown, defaulting to 1000 [ 726.576558][T24958] lo speed is unknown, defaulting to 1000 [ 726.616022][T24958] wg1 speed is unknown, defaulting to 1000 [ 726.652910][T24973] netlink: 'syz.1.4997': attribute type 1 has an invalid length. [ 726.662519][T24973] netlink: 'syz.1.4997': attribute type 4 has an invalid length. [ 726.702289][T24973] netlink: 9462 bytes leftover after parsing attributes in process `syz.1.4997'. [ 726.819813][T15526] IPVS: stop unused estimator thread 0... [ 727.011594][T24996] netlink: 24 bytes leftover after parsing attributes in process `syz.1.5002'. [ 727.160777][T25003] netlink: 28 bytes leftover after parsing attributes in process `syz.1.5002'. [ 727.332219][T25014] netlink: 60 bytes leftover after parsing attributes in process `syz.3.5005'. [ 727.796325][T25037] wg1 speed is unknown, defaulting to 1000 [ 727.830993][T25037] lo speed is unknown, defaulting to 1000 [ 727.866865][T25037] wg1 speed is unknown, defaulting to 1000 [ 728.330407][T25069] FAULT_INJECTION: forcing a failure. [ 728.330407][T25069] name failslab, interval 1, probability 0, space 0, times 0 [ 728.376769][T25069] CPU: 0 UID: 0 PID: 25069 Comm: syz.1.5020 Not tainted syzkaller #0 PREEMPT(full) [ 728.376798][T25069] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/13/2026 [ 728.376811][T25069] Call Trace: [ 728.376821][T25069] [ 728.376831][T25069] dump_stack_lvl+0xe8/0x150 [ 728.376864][T25069] should_fail_ex+0x412/0x560 [ 728.376901][T25069] should_failslab+0xa8/0x100 [ 728.376928][T25069] kmem_cache_alloc_noprof+0x87/0x6e0 [ 728.376957][T25069] ? pidfs_register_pid+0xa6/0x1b0 [ 728.376982][T25069] pidfs_register_pid+0xa6/0x1b0 [ 728.377005][T25069] __scm_send+0xb44/0x14a0 [ 728.377043][T25069] ? __pfx___scm_send+0x10/0x10 [ 728.377065][T25069] ? __lock_acquire+0x6b5/0x2cf0 [ 728.377084][T25069] ? bpf_lsm_socket_getpeersec_dgram+0x9/0x20 [ 728.377105][T25069] unix_stream_sendmsg+0x152/0xe80 [ 728.377146][T25069] ? __might_fault+0xaf/0x130 [ 728.377172][T25069] ? __pfx_unix_stream_sendmsg+0x10/0x10 [ 728.377204][T25069] ? aa_sock_msg_perm+0xda/0x1b0 [ 728.377229][T25069] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 728.377244][T25069] ? __pfx_unix_stream_sendmsg+0x10/0x10 [ 728.377280][T25069] __sock_sendmsg+0x21c/0x270 [ 728.377305][T25069] ____sys_sendmsg+0x4d7/0x810 [ 728.377323][T25069] ? __might_fault+0xaf/0x130 [ 728.377353][T25069] ? __pfx_____sys_sendmsg+0x10/0x10 [ 728.377378][T25069] ? import_iovec+0x73/0xa0 [ 728.377400][T25069] ___sys_sendmsg+0x2a5/0x360 [ 728.377417][T25069] ? __lock_acquire+0x6b5/0x2cf0 [ 728.377438][T25069] ? __pfx____sys_sendmsg+0x10/0x10 [ 728.377493][T25069] ? __fget_files+0x2a/0x420 [ 728.377519][T25069] ? __fget_files+0x3a0/0x420 [ 728.377556][T25069] __x64_sys_sendmsg+0x1bd/0x2a0 [ 728.377579][T25069] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 728.377606][T25069] ? __pfx_ksys_write+0x10/0x10 [ 728.377632][T25069] do_syscall_64+0xe2/0xf80 [ 728.377649][T25069] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 728.377665][T25069] ? trace_irq_disable+0x37/0x100 [ 728.377688][T25069] ? clear_bhb_loop+0x60/0xb0 [ 728.377708][T25069] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 728.377725][T25069] RIP: 0033:0x7f3ffb19acb9 [ 728.377741][T25069] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 728.377756][T25069] RSP: 002b:00007f3ffc0e4028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 728.377774][T25069] RAX: ffffffffffffffda RBX: 00007f3ffb415fa0 RCX: 00007f3ffb19acb9 [ 728.377787][T25069] RDX: 0000000004004881 RSI: 0000200000000600 RDI: 0000000000000006 [ 728.377798][T25069] RBP: 00007f3ffc0e4090 R08: 0000000000000000 R09: 0000000000000000 [ 728.377809][T25069] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 728.377819][T25069] R13: 00007f3ffb416038 R14: 00007f3ffb415fa0 R15: 00007fffe3ff5ae8 [ 728.377846][T25069] [ 728.875434][T25081] nbd: socks must be embedded in a SOCK_ITEM attr [ 728.896151][T24434] block nbd64: NBD_DISCONNECT [ 728.975489][T25095] netlink: 'syz.4.5028': attribute type 8 has an invalid length. [ 728.983696][T25095] netlink: 'syz.4.5028': attribute type 9 has an invalid length. [ 728.991657][T25095] netlink: 'syz.4.5028': attribute type 10 has an invalid length. [ 729.000529][T25095] netlink: 'syz.4.5028': attribute type 11 has an invalid length. [ 729.320822][T24434] udevd[24434]: inotify_add_watch(7, /dev/nbd64, 10) failed: No such file or directory [ 729.336305][T25104] bond12: entered promiscuous mode [ 729.342178][T25104] 8021q: adding VLAN 0 to HW filter on device bond12 [ 729.466683][T25113] x_tables: ip6_tables: udplite match: only valid for protocol 136 [ 729.508567][T25116] FAULT_INJECTION: forcing a failure. [ 729.508567][T25116] name failslab, interval 1, probability 0, space 0, times 0 [ 729.522565][T25116] CPU: 1 UID: 0 PID: 25116 Comm: syz.3.5035 Not tainted syzkaller #0 PREEMPT(full) [ 729.522590][T25116] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/13/2026 [ 729.522602][T25116] Call Trace: [ 729.522610][T25116] [ 729.522618][T25116] dump_stack_lvl+0xe8/0x150 [ 729.522647][T25116] should_fail_ex+0x412/0x560 [ 729.522677][T25116] should_failslab+0xa8/0x100 [ 729.522701][T25116] __kmalloc_cache_noprof+0x83/0x6e0 [ 729.522718][T25116] ? lockdep_hardirqs_on+0x7a/0x110 [ 729.522735][T25116] ? __scm_send+0x687/0x14a0 [ 729.522755][T25116] ? _raw_spin_unlock_irq+0x2e/0x50 [ 729.522784][T25116] __scm_send+0x687/0x14a0 [ 729.522823][T25116] ? __pfx___scm_send+0x10/0x10 [ 729.522845][T25116] ? __lock_acquire+0x6b5/0x2cf0 [ 729.522865][T25116] ? bpf_lsm_socket_getpeersec_dgram+0x9/0x20 [ 729.522888][T25116] unix_stream_sendmsg+0x152/0xe80 [ 729.522930][T25116] ? __might_fault+0xaf/0x130 [ 729.522955][T25116] ? __pfx_unix_stream_sendmsg+0x10/0x10 [ 729.522988][T25116] ? aa_sock_msg_perm+0xda/0x1b0 [ 729.523014][T25116] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 729.523030][T25116] ? __pfx_unix_stream_sendmsg+0x10/0x10 [ 729.523057][T25116] __sock_sendmsg+0x21c/0x270 [ 729.523083][T25116] ____sys_sendmsg+0x4d7/0x810 [ 729.523101][T25116] ? __might_fault+0xaf/0x130 [ 729.523132][T25116] ? __pfx_____sys_sendmsg+0x10/0x10 [ 729.523159][T25116] ? import_iovec+0x73/0xa0 [ 729.523181][T25116] ___sys_sendmsg+0x2a5/0x360 [ 729.523212][T25116] ? __lock_acquire+0x6b5/0x2cf0 [ 729.523235][T25116] ? __pfx____sys_sendmsg+0x10/0x10 [ 729.523290][T25116] ? __fget_files+0x2a/0x420 [ 729.523311][T25116] ? __fget_files+0x3a0/0x420 [ 729.523342][T25116] __x64_sys_sendmsg+0x1bd/0x2a0 [ 729.523363][T25116] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 729.523391][T25116] ? __pfx_ksys_write+0x10/0x10 [ 729.523419][T25116] do_syscall_64+0xe2/0xf80 [ 729.523437][T25116] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 729.523456][T25116] ? trace_irq_disable+0x37/0x100 [ 729.523479][T25116] ? clear_bhb_loop+0x60/0xb0 [ 729.523500][T25116] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 729.523517][T25116] RIP: 0033:0x7f399a99acb9 [ 729.523534][T25116] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 729.523549][T25116] RSP: 002b:00007f399b8b2028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 729.523568][T25116] RAX: ffffffffffffffda RBX: 00007f399ac15fa0 RCX: 00007f399a99acb9 [ 729.523582][T25116] RDX: 0000000004004881 RSI: 0000200000000600 RDI: 0000000000000006 [ 729.523593][T25116] RBP: 00007f399b8b2090 R08: 0000000000000000 R09: 0000000000000000 [ 729.523604][T25116] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 729.523615][T25116] R13: 00007f399ac16038 R14: 00007f399ac15fa0 R15: 00007fffd47bb588 [ 729.523644][T25116] [ 729.812661][ T52] Bluetooth: hci2: command 0x0405 tx timeout [ 729.966103][T25104] bond12 (unregistering): Released all slaves [ 730.038286][T25113] wg1 speed is unknown, defaulting to 1000 [ 730.059694][T25113] lo speed is unknown, defaulting to 1000 [ 730.163955][T25113] wg1 speed is unknown, defaulting to 1000 [ 730.476015][T25147] netlink: 'syz.0.5045': attribute type 1 has an invalid length. [ 730.582680][T25147] 8021q: adding VLAN 0 to HW filter on device bond14 [ 730.634734][T25161] openvswitch: netlink: Duplicate or invalid key (type 0). [ 730.644467][T25158] bond14: (slave geneve3): making interface the new active one [ 730.647345][T25161] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 730.662044][T25158] bond14: (slave geneve3): Enslaving as an active interface with an up link [ 731.060889][T25183] __nla_validate_parse: 8 callbacks suppressed [ 731.060911][T25183] netlink: 12 bytes leftover after parsing attributes in process `syz.3.5056'. [ 731.085525][T25182] FAULT_INJECTION: forcing a failure. [ 731.085525][T25182] name failslab, interval 1, probability 0, space 0, times 0 [ 731.099707][T25182] CPU: 1 UID: 0 PID: 25182 Comm: syz.2.5057 Not tainted syzkaller #0 PREEMPT(full) [ 731.099735][T25182] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/13/2026 [ 731.099748][T25182] Call Trace: [ 731.099756][T25182] [ 731.099765][T25182] dump_stack_lvl+0xe8/0x150 [ 731.099796][T25182] should_fail_ex+0x412/0x560 [ 731.099831][T25182] should_failslab+0xa8/0x100 [ 731.099857][T25182] __kmalloc_cache_noprof+0x83/0x6e0 [ 731.099879][T25182] ? unix_prepare_fpl+0xf3/0x5c0 [ 731.099910][T25182] unix_prepare_fpl+0xf3/0x5c0 [ 731.099940][T25182] unix_scm_to_skb+0x2e1/0x460 [ 731.099965][T25182] queue_oob+0xe4/0x4f0 [ 731.099988][T25182] ? __pfx_queue_oob+0x10/0x10 [ 731.100009][T25182] ? __lock_acquire+0x6b5/0x2cf0 [ 731.100031][T25182] ? bpf_lsm_socket_getpeersec_dgram+0x9/0x20 [ 731.100056][T25182] unix_stream_sendmsg+0xcb1/0xe80 [ 731.100103][T25182] ? __might_fault+0xaf/0x130 [ 731.100132][T25182] ? __pfx_unix_stream_sendmsg+0x10/0x10 [ 731.100170][T25182] ? aa_sock_msg_perm+0xda/0x1b0 [ 731.100200][T25182] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 731.100218][T25182] ? __pfx_unix_stream_sendmsg+0x10/0x10 [ 731.100251][T25182] __sock_sendmsg+0x21c/0x270 [ 731.100281][T25182] ____sys_sendmsg+0x4d7/0x810 [ 731.100309][T25182] ? __might_fault+0xaf/0x130 [ 731.100346][T25182] ? __pfx_____sys_sendmsg+0x10/0x10 [ 731.100377][T25182] ? import_iovec+0x73/0xa0 [ 731.100402][T25182] ___sys_sendmsg+0x2a5/0x360 [ 731.100422][T25182] ? __lock_acquire+0x6b5/0x2cf0 [ 731.100447][T25182] ? __pfx____sys_sendmsg+0x10/0x10 [ 731.100507][T25182] ? __fget_files+0x2a/0x420 [ 731.100531][T25182] ? __fget_files+0x3a0/0x420 [ 731.100566][T25182] __x64_sys_sendmsg+0x1bd/0x2a0 [ 731.100591][T25182] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 731.100623][T25182] ? __pfx_ksys_write+0x10/0x10 [ 731.100656][T25182] do_syscall_64+0xe2/0xf80 [ 731.100676][T25182] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 731.100695][T25182] ? trace_irq_disable+0x37/0x100 [ 731.100721][T25182] ? clear_bhb_loop+0x60/0xb0 [ 731.100746][T25182] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 731.100766][T25182] RIP: 0033:0x7f517d19acb9 [ 731.100784][T25182] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 731.100801][T25182] RSP: 002b:00007f517e057028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 731.100822][T25182] RAX: ffffffffffffffda RBX: 00007f517d415fa0 RCX: 00007f517d19acb9 [ 731.100837][T25182] RDX: 0000000004004881 RSI: 0000200000000600 RDI: 0000000000000006 [ 731.100850][T25182] RBP: 00007f517e057090 R08: 0000000000000000 R09: 0000000000000000 [ 731.100863][T25182] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 731.100875][T25182] R13: 00007f517d416038 R14: 00007f517d415fa0 R15: 00007ffc22241be8 [ 731.100908][T25182] [ 731.344168][T25192] netlink: 4 bytes leftover after parsing attributes in process `syz.1.5058'. [ 731.452132][T25188] bridge_slave_0: left promiscuous mode [ 731.480193][T25188] macsec1: left promiscuous mode [ 731.485874][T25188] vlan2: left allmulticast mode [ 731.494388][T25188] dummy0: left allmulticast mode [ 731.522316][T25188] bridge4: left allmulticast mode [ 731.537924][T25188] vlan1: left promiscuous mode [ 731.542777][T25188] bond6: left promiscuous mode [ 731.578163][T25188] vlan1: left allmulticast mode [ 731.583096][T25188] bond6: left allmulticast mode [ 731.636926][T25188] macvlan2: left allmulticast mode [ 731.646495][T25188] bond9: left promiscuous mode [ 731.654218][T25188] veth7: left promiscuous mode [ 731.663765][T25188] ip6gretap3: left allmulticast mode [ 731.722754][T25200] syzkaller1: entered promiscuous mode [ 731.729142][T25200] syzkaller1: entered allmulticast mode [ 731.827179][T25214] af_packet: tpacket_rcv: packet too big, clamped from 3960 to 3942. macoff=106 [ 731.838612][ T52] Bluetooth: hci2: command 0x0405 tx timeout [ 731.852083][T25218] netlink: 8 bytes leftover after parsing attributes in process `syz.4.5063'. [ 732.064624][T25231] netlink: 8 bytes leftover after parsing attributes in process `syz.4.5066'. [ 732.088631][T25231] netlink: 8 bytes leftover after parsing attributes in process `syz.4.5066'. [ 732.212175][T25243] netlink: 28 bytes leftover after parsing attributes in process `syz.1.5069'. [ 732.258069][T25243] netlink: 28 bytes leftover after parsing attributes in process `syz.1.5069'. [ 732.267118][T25243] netlink: 28 bytes leftover after parsing attributes in process `syz.1.5069'. [ 732.341739][T25249] FAULT_INJECTION: forcing a failure. [ 732.341739][T25249] name failslab, interval 1, probability 0, space 0, times 0 [ 732.384000][T25249] CPU: 1 UID: 0 PID: 25249 Comm: syz.4.5071 Not tainted syzkaller #0 PREEMPT(full) [ 732.384031][T25249] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/13/2026 [ 732.384044][T25249] Call Trace: [ 732.384052][T25249] [ 732.384060][T25249] dump_stack_lvl+0xe8/0x150 [ 732.384093][T25249] should_fail_ex+0x412/0x560 [ 732.384128][T25249] should_failslab+0xa8/0x100 [ 732.384156][T25249] __kmalloc_cache_noprof+0x83/0x6e0 [ 732.384177][T25249] ? unix_prepare_fpl+0xf3/0x5c0 [ 732.384207][T25249] unix_prepare_fpl+0xf3/0x5c0 [ 732.384238][T25249] unix_scm_to_skb+0x2e1/0x460 [ 732.384260][T25249] queue_oob+0xe4/0x4f0 [ 732.384279][T25249] ? __pfx_queue_oob+0x10/0x10 [ 732.384296][T25249] ? __lock_acquire+0x6b5/0x2cf0 [ 732.384316][T25249] ? bpf_lsm_socket_getpeersec_dgram+0x9/0x20 [ 732.384337][T25249] unix_stream_sendmsg+0xcb1/0xe80 [ 732.384376][T25249] ? __might_fault+0xaf/0x130 [ 732.384402][T25249] ? __pfx_unix_stream_sendmsg+0x10/0x10 [ 732.384434][T25249] ? aa_sock_msg_perm+0xda/0x1b0 [ 732.384459][T25249] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 732.384474][T25249] ? __pfx_unix_stream_sendmsg+0x10/0x10 [ 732.384502][T25249] __sock_sendmsg+0x21c/0x270 [ 732.384528][T25249] ____sys_sendmsg+0x4d7/0x810 [ 732.384545][T25249] ? __might_fault+0xaf/0x130 [ 732.384575][T25249] ? __pfx_____sys_sendmsg+0x10/0x10 [ 732.384601][T25249] ? import_iovec+0x73/0xa0 [ 732.384622][T25249] ___sys_sendmsg+0x2a5/0x360 [ 732.384638][T25249] ? __lock_acquire+0x6b5/0x2cf0 [ 732.384659][T25249] ? __pfx____sys_sendmsg+0x10/0x10 [ 732.384706][T25249] ? __fget_files+0x2a/0x420 [ 732.384727][T25249] ? __fget_files+0x3a0/0x420 [ 732.384757][T25249] __x64_sys_sendmsg+0x1bd/0x2a0 [ 732.384777][T25249] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 732.384802][T25249] ? __pfx_ksys_write+0x10/0x10 [ 732.384829][T25249] do_syscall_64+0xe2/0xf80 [ 732.384846][T25249] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 732.384862][T25249] ? trace_irq_disable+0x37/0x100 [ 732.384885][T25249] ? clear_bhb_loop+0x60/0xb0 [ 732.384906][T25249] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 732.384923][T25249] RIP: 0033:0x7f14d859acb9 [ 732.384939][T25249] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 732.384954][T25249] RSP: 002b:00007f14d948a028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 732.384972][T25249] RAX: ffffffffffffffda RBX: 00007f14d8815fa0 RCX: 00007f14d859acb9 [ 732.384985][T25249] RDX: 0000000004004881 RSI: 0000200000000600 RDI: 0000000000000006 [ 732.385003][T25249] RBP: 00007f14d948a090 R08: 0000000000000000 R09: 0000000000000000 [ 732.385025][T25249] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 732.385035][T25249] R13: 00007f14d8816038 R14: 00007f14d8815fa0 R15: 00007fffad656408 [ 732.385079][T25249] [ 733.374645][T25284] netlink: 4 bytes leftover after parsing attributes in process `syz.3.5081'. [ 733.421135][T15526] netdevsim netdevsim3 netdevsim0: set [0, 0] type 1 family 0 port 8472 - 0 [ 733.437453][T25284] netlink: 4 bytes leftover after parsing attributes in process `syz.3.5081'. [ 733.457762][T15526] netdevsim netdevsim3 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0 [ 733.492836][T25289] FAULT_INJECTION: forcing a failure. [ 733.492836][T25289] name failslab, interval 1, probability 0, space 0, times 0 [ 733.506049][T15526] netdevsim netdevsim3 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0 [ 733.519141][T15526] netdevsim netdevsim3 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0 [ 733.528598][T25289] CPU: 0 UID: 0 PID: 25289 Comm: syz.4.5084 Not tainted syzkaller #0 PREEMPT(full) [ 733.528625][T25289] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/13/2026 [ 733.528639][T25289] Call Trace: [ 733.528648][T25289] [ 733.528657][T25289] dump_stack_lvl+0xe8/0x150 [ 733.528690][T25289] should_fail_ex+0x412/0x560 [ 733.528725][T25289] should_failslab+0xa8/0x100 [ 733.528753][T25289] __kmalloc_cache_noprof+0x83/0x6e0 [ 733.528776][T25289] ? unix_prepare_fpl+0xf3/0x5c0 [ 733.528806][T25289] unix_prepare_fpl+0xf3/0x5c0 [ 733.528839][T25289] unix_scm_to_skb+0x2e1/0x460 [ 733.528875][T25289] queue_oob+0xe4/0x4f0 [ 733.528898][T25289] ? __pfx_queue_oob+0x10/0x10 [ 733.528921][T25289] ? __lock_acquire+0x6b5/0x2cf0 [ 733.528944][T25289] ? bpf_lsm_socket_getpeersec_dgram+0x9/0x20 [ 733.528972][T25289] unix_stream_sendmsg+0xcb1/0xe80 [ 733.529021][T25289] ? __might_fault+0xaf/0x130 [ 733.529052][T25289] ? __pfx_unix_stream_sendmsg+0x10/0x10 [ 733.529092][T25289] ? aa_sock_msg_perm+0xda/0x1b0 [ 733.529124][T25289] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 733.529143][T25289] ? __pfx_unix_stream_sendmsg+0x10/0x10 [ 733.529177][T25289] __sock_sendmsg+0x21c/0x270 [ 733.529209][T25289] ____sys_sendmsg+0x4d7/0x810 [ 733.529232][T25289] ? __might_fault+0xaf/0x130 [ 733.529268][T25289] ? __pfx_____sys_sendmsg+0x10/0x10 [ 733.529300][T25289] ? import_iovec+0x73/0xa0 [ 733.529327][T25289] ___sys_sendmsg+0x2a5/0x360 [ 733.529349][T25289] ? __lock_acquire+0x6b5/0x2cf0 [ 733.529375][T25289] ? __pfx____sys_sendmsg+0x10/0x10 [ 733.529403][T25289] ? preempt_schedule_thunk+0x16/0x30 [ 733.529454][T25289] ? __fget_files+0x2a/0x420 [ 733.529479][T25289] ? __fget_files+0x3a0/0x420 [ 733.529517][T25289] __x64_sys_sendmsg+0x1bd/0x2a0 [ 733.529543][T25289] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 733.529576][T25289] ? rcu_is_watching+0x15/0xb0 [ 733.529616][T25289] do_syscall_64+0xe2/0xf80 [ 733.529637][T25289] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 733.529656][T25289] ? trace_irq_disable+0x37/0x100 [ 733.529682][T25289] ? clear_bhb_loop+0x60/0xb0 [ 733.529708][T25289] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 733.529728][T25289] RIP: 0033:0x7f14d859acb9 [ 733.529746][T25289] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 733.529763][T25289] RSP: 002b:00007f14d948a028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 733.529784][T25289] RAX: ffffffffffffffda RBX: 00007f14d8815fa0 RCX: 00007f14d859acb9 [ 733.529799][T25289] RDX: 0000000004004881 RSI: 0000200000000600 RDI: 0000000000000006 [ 733.529812][T25289] RBP: 00007f14d948a090 R08: 0000000000000000 R09: 0000000000000000 [ 733.529825][T25289] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 733.529836][T25289] R13: 00007f14d8816038 R14: 00007f14d8815fa0 R15: 00007fffad656408 [ 733.529878][T25289] [ 734.043464][T25306] batadv0: mtu less than device minimum [ 734.156825][T25313] netlink: 'syz.0.5091': attribute type 6 has an invalid length. [ 734.283314][T25322] netlink: 'syz.0.5094': attribute type 1 has an invalid length. [ 734.383931][T25322] bond15: (slave geneve4): making interface the new active one [ 734.395783][T25322] bond15: (slave geneve4): Enslaving as an active interface with an up link [ 734.419140][T25326] : renamed from wg2 [ 735.005797][T25365] netlink: 'syz.2.5104': attribute type 1 has an invalid length. [ 736.241352][T25421] __nla_validate_parse: 8 callbacks suppressed [ 736.241373][T25421] netlink: 12 bytes leftover after parsing attributes in process `syz.2.5122'. [ 736.278146][T25423] netlink: 20 bytes leftover after parsing attributes in process `syz.3.5123'. [ 736.385298][T25423] nbd: socks must be embedded in a SOCK_ITEM attr [ 736.405792][T24603] block nbd64: NBD_DISCONNECT [ 736.425285][T25434] vlan3: entered promiscuous mode [ 736.448542][T25434] bond0: entered promiscuous mode [ 736.475243][T25434] team0: entered promiscuous mode [ 736.505148][T25434] bridge1: entered promiscuous mode [ 736.524144][T25434] dummy0: entered promiscuous mode [ 736.552590][T25434] vlan3: entered allmulticast mode [ 736.578068][T25434] bond0: entered allmulticast mode [ 736.592968][T25434] team0: entered allmulticast mode [ 736.607914][T25434] bridge1: entered allmulticast mode [ 736.623517][T25434] dummy0: entered allmulticast mode [ 736.715240][T24434] udevd[24434]: inotify_add_watch(7, /dev/nbd64, 10) failed: No such file or directory [ 736.838139][T25437] netlink: 12 bytes leftover after parsing attributes in process `syz.1.5127'. [ 737.594589][T25484] FAULT_INJECTION: forcing a failure. [ 737.594589][T25484] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 737.617976][T25484] CPU: 0 UID: 0 PID: 25484 Comm: syz.4.5133 Not tainted syzkaller #0 PREEMPT(full) [ 737.618005][T25484] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/13/2026 [ 737.618018][T25484] Call Trace: [ 737.618028][T25484] [ 737.618037][T25484] dump_stack_lvl+0xe8/0x150 [ 737.618070][T25484] should_fail_ex+0x412/0x560 [ 737.618106][T25484] _copy_from_user+0x2d/0xb0 [ 737.618131][T25484] bpf_test_init+0xd8/0x150 [ 737.618161][T25484] bpf_prog_test_run_xdp+0x529/0x1160 [ 737.618204][T25484] ? __pfx_bpf_prog_test_run_xdp+0x10/0x10 [ 737.618237][T25484] ? __fget_files+0x2a/0x420 [ 737.618270][T25484] ? __pfx_bpf_prog_test_run_xdp+0x10/0x10 [ 737.618298][T25484] bpf_prog_test_run+0x2c7/0x340 [ 737.618333][T25484] __sys_bpf+0x5cb/0x920 [ 737.618365][T25484] ? __pfx___sys_bpf+0x10/0x10 [ 737.618413][T25484] ? ksys_write+0x242/0x270 [ 737.618437][T25484] ? __pfx_ksys_write+0x10/0x10 [ 737.618465][T25484] __x64_sys_bpf+0x7c/0x90 [ 737.618494][T25484] do_syscall_64+0xe2/0xf80 [ 737.618514][T25484] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 737.618535][T25484] ? trace_irq_disable+0x37/0x100 [ 737.618561][T25484] ? clear_bhb_loop+0x60/0xb0 [ 737.618587][T25484] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 737.618608][T25484] RIP: 0033:0x7f14d859acb9 [ 737.618627][T25484] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 737.618645][T25484] RSP: 002b:00007f14d948a028 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 737.618669][T25484] RAX: ffffffffffffffda RBX: 00007f14d8815fa0 RCX: 00007f14d859acb9 [ 737.618685][T25484] RDX: 0000000000000048 RSI: 0000200000000600 RDI: 000000000000000a [ 737.618698][T25484] RBP: 00007f14d948a090 R08: 0000000000000000 R09: 0000000000000000 [ 737.618712][T25484] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 737.618725][T25484] R13: 00007f14d8816038 R14: 00007f14d8815fa0 R15: 00007fffad656408 [ 737.618761][T25484] [ 738.051049][T25487] netlink: 12 bytes leftover after parsing attributes in process `syz.2.5134'. [ 738.096750][ T6212] netdevsim netdevsim2 eth0: set [0, 0] type 1 family 0 port 8472 - 0 [ 738.118345][T25487] netlink: 4 bytes leftover after parsing attributes in process `syz.2.5134'. [ 738.119599][ T6212] netdevsim netdevsim2 eth1: set [0, 0] type 1 family 0 port 8472 - 0 [ 738.184331][ T6212] netdevsim netdevsim2 eth2: set [0, 0] type 1 family 0 port 8472 - 0 [ 738.204753][ T6212] netdevsim netdevsim2 eth3: set [0, 0] type 1 family 0 port 8472 - 0 [ 738.204940][T25487] netlink: 4 bytes leftover after parsing attributes in process `syz.2.5134'. [ 738.309669][T25499] netlink: 'syz.0.5136': attribute type 1 has an invalid length. [ 738.337889][T25499] netlink: 232 bytes leftover after parsing attributes in process `syz.0.5136'. [ 738.350946][T25499] netlink: 'syz.0.5136': attribute type 1 has an invalid length. [ 738.354233][T25496] bond12: entered promiscuous mode [ 738.364360][T25496] bond12: entered allmulticast mode [ 738.370351][T25496] 8021q: adding VLAN 0 to HW filter on device bond12 [ 738.417718][T25499] netlink: 232 bytes leftover after parsing attributes in process `syz.0.5136'. [ 738.732868][T10753] ================================================================== [ 738.740995][T10753] BUG: KASAN: use-after-free in __linkwatch_run_queue+0x6a0/0x7f0 [ 738.744175][T25524] netlink: 'syz.2.5139': attribute type 1 has an invalid length. [ 738.748858][T10753] Read of size 1 at addr ffff888093268cd1 by task kworker/u8:19/10753 [ 738.748881][T10753] [ 738.748894][T10753] CPU: 0 UID: 0 PID: 10753 Comm: kworker/u8:19 Not tainted syzkaller #0 PREEMPT(full) [ 738.748916][T10753] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/13/2026 [ 738.748929][T10753] Workqueue: events_unbound linkwatch_event [ 738.748959][T10753] Call Trace: [ 738.748968][T10753] [ 738.748977][T10753] dump_stack_lvl+0xe8/0x150 [ 738.749057][T10753] print_report+0xba/0x230 [ 738.749132][T10753] ? __linkwatch_run_queue+0x6a0/0x7f0 [ 738.749198][T10753] kasan_report+0x117/0x150 [ 738.749270][T10753] ? __linkwatch_run_queue+0x6a0/0x7f0 [ 738.749346][T10753] __linkwatch_run_queue+0x6a0/0x7f0 [ 738.749431][T10753] ? __pfx___linkwatch_run_queue+0x10/0x10 [ 738.749523][T10753] ? process_scheduled_works+0xa0f/0x17a0 [ 738.749585][T10753] ? process_scheduled_works+0xa0f/0x17a0 [ 738.749639][T10753] linkwatch_event+0x4c/0x60 [ 738.749704][T10753] process_scheduled_works+0xaec/0x17a0 [ 738.749808][T10753] ? __pfx_process_scheduled_works+0x10/0x10 [ 738.749862][T10753] ? do_raw_spin_lock+0x12b/0x2f0 [ 738.749948][T10753] ? assign_work+0x3d3/0x440 [ 738.750012][T10753] worker_thread+0x89f/0xd90 [ 738.750086][T10753] ? __kthread_parkme+0x7a/0x1f0 [ 738.750162][T10753] kthread+0x726/0x8b0 [ 738.750235][T10753] ? __pfx_worker_thread+0x10/0x10 [ 738.750291][T10753] ? __pfx_kthread+0x10/0x10 [ 738.750365][T10753] ? _raw_spin_unlock_irq+0x23/0x50 [ 738.750440][T10753] ? __pfx_kthread+0x10/0x10 [ 738.750533][T10753] ret_from_fork+0x51b/0xa40 [ 738.750607][T10753] ? __pfx_ret_from_fork+0x10/0x10 [ 738.750671][T10753] ? __switch_to+0xc82/0x1410 [ 738.750741][T10753] ? __pfx_kthread+0x10/0x10 [ 738.750811][T10753] ret_from_fork_asm+0x1a/0x30 [ 738.750905][T10753] [ 738.750925][T10753] [ 738.934839][T10753] The buggy address belongs to the physical page: [ 738.941329][T10753] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0xffff888093268dc0 pfn:0x93268 [ 738.951434][T10753] flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff) [ 738.958586][T10753] raw: 00fff00000000000 ffffea0002746908 ffff8880b8740c00 0000000000000000 [ 738.967202][T10753] raw: ffff888093268dc0 0000000000000000 00000000ffffffff 0000000000000000 [ 738.975822][T10753] page dumped because: kasan: bad access detected [ 738.982275][T10753] page_owner tracks the page as freed [ 738.987670][T10753] page last allocated via order 2, migratetype Unmovable, gfp_mask 0x446dc0(GFP_KERNEL_ACCOUNT|__GFP_ZERO|__GFP_NOWARN|__GFP_RETRY_MAYFAIL|__GFP_COMP), pid 25510, tgid 25508 (syz.1.5143), ts 738534522390, free_ts 738731957480 [ 739.009423][T10753] post_alloc_hook+0x228/0x280 [ 739.014233][T10753] get_page_from_freelist+0x24dc/0x2580 [ 739.019829][T10753] __alloc_frozen_pages_noprof+0x18d/0x380 [ 739.025667][T10753] alloc_pages_mpol+0x232/0x4a0 [ 739.030537][T10753] ___kmalloc_large_node+0x4e/0x150 [ 739.035748][T10753] __kmalloc_large_node_noprof+0x18/0x90 [ 739.041406][T10753] __kvmalloc_node_noprof+0x6e/0x8d0 [ 739.046702][T10753] alloc_netdev_mqs+0xa6/0x11b0 [ 739.051570][T10753] tun_set_iff+0x532/0xf00 [ 739.056027][T10753] __tun_chr_ioctl+0x7bb/0x1e10 [ 739.060899][T10753] __se_sys_ioctl+0xfc/0x170 [ 739.065554][T10753] do_syscall_64+0xe2/0xf80 [ 739.070102][T10753] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 739.076023][T10753] page last free pid 25508 tgid 25508 stack trace: [ 739.082543][T10753] __free_frozen_pages+0xbb0/0xd10 [ 739.087773][T10753] device_release+0x9e/0x1d0 [ 739.092388][T10753] kobject_put+0x228/0x560 [ 739.096835][T10753] netdev_run_todo+0xc75/0xde0 [ 739.101631][T10753] tun_chr_close+0x13c/0x1c0 [ 739.106246][T10753] __fput+0x44f/0xa70 [ 739.110269][T10753] task_work_run+0x1d9/0x270 [ 739.114883][T10753] exit_to_user_mode_loop+0xed/0x480 [ 739.120274][T10753] do_syscall_64+0x2b7/0xf80 [ 739.124965][T10753] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 739.130883][T10753] [ 739.133220][T10753] Memory state around the buggy address: [ 739.138863][T10753] ffff888093268b80: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 739.146979][T10753] ffff888093268c00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 739.155054][T10753] >ffff888093268c80: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 739.163139][T10753] ^ [ 739.170004][T10753] ffff888093268d00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 739.178079][T10753] ffff888093268d80: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 739.186153][T10753] ================================================================== [ 739.229905][T10753] Kernel panic - not syncing: KASAN: panic_on_warn set ... [ 739.237155][T10753] CPU: 0 UID: 0 PID: 10753 Comm: kworker/u8:19 Not tainted syzkaller #0 PREEMPT(full) [ 739.246825][T10753] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/13/2026 [ 739.256921][T10753] Workqueue: events_unbound linkwatch_event [ 739.262872][T10753] Call Trace: [ 739.266188][T10753] [ 739.269250][T10753] vpanic+0x1e0/0x670 [ 739.273279][T10753] panic+0xc5/0xd0 [ 739.277391][T10753] ? __pfx_panic+0x10/0x10 [ 739.281863][T10753] ? preempt_schedule_thunk+0x16/0x30 [ 739.287284][T10753] ? __linkwatch_run_queue+0x6a0/0x7f0 [ 739.292792][T10753] check_panic_on_warn+0x89/0xb0 [ 739.297777][T10753] ? __linkwatch_run_queue+0x6a0/0x7f0 [ 739.303272][T10753] end_report+0x6f/0x140 [ 739.307543][T10753] kasan_report+0x128/0x150 [ 739.312081][T10753] ? __linkwatch_run_queue+0x6a0/0x7f0 [ 739.317609][T10753] __linkwatch_run_queue+0x6a0/0x7f0 [ 739.322930][T10753] ? __pfx___linkwatch_run_queue+0x10/0x10 [ 739.328767][T10753] ? process_scheduled_works+0xa0f/0x17a0 [ 739.334515][T10753] ? process_scheduled_works+0xa0f/0x17a0 [ 739.340277][T10753] linkwatch_event+0x4c/0x60 [ 739.344941][T10753] process_scheduled_works+0xaec/0x17a0 [ 739.350534][T10753] ? __pfx_process_scheduled_works+0x10/0x10 [ 739.356546][T10753] ? do_raw_spin_lock+0x12b/0x2f0 [ 739.361607][T10753] ? assign_work+0x3d3/0x440 [ 739.366225][T10753] worker_thread+0x89f/0xd90 [ 739.370859][T10753] ? __kthread_parkme+0x7a/0x1f0 [ 739.375909][T10753] kthread+0x726/0x8b0 [ 739.380007][T10753] ? __pfx_worker_thread+0x10/0x10 [ 739.385148][T10753] ? __pfx_kthread+0x10/0x10 [ 739.389766][T10753] ? _raw_spin_unlock_irq+0x23/0x50 [ 739.394990][T10753] ? __pfx_kthread+0x10/0x10 [ 739.399606][T10753] ret_from_fork+0x51b/0xa40 [ 739.404214][T10753] ? __pfx_ret_from_fork+0x10/0x10 [ 739.409335][T10753] ? __switch_to+0xc82/0x1410 [ 739.414040][T10753] ? __pfx_kthread+0x10/0x10 [ 739.418650][T10753] ret_from_fork_asm+0x1a/0x30 [ 739.423447][T10753] [ 739.427071][T10753] Kernel Offset: disabled [ 739.431452][T10753] Rebooting in 86400 seconds..