last executing test programs: 1m8.566930352s ago: executing program 3 (id=5887): ioctl$F2FS_IOC_MOVE_RANGE(0xffffffffffffffff, 0xc020f509, &(0x7f0000000100)={0xffffffffffffffff, 0x5, 0x389c, 0x7}) r0 = bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0x16, 0x4, &(0x7f0000000040)=ANY=[@ANYBLOB="b400000000000000791090000000000007000000002000209500000000000000"], &(0x7f0000003ff6)='GPL\x00', 0x5, 0x22, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @flow_dissector, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x3f}, 0x48) r1 = socket$netlink(0x10, 0x3, 0x10) r2 = socket$netlink(0x10, 0x3, 0x15) bind$netlink(r2, &(0x7f0000514ff4)={0x10, 0x0, 0x0, 0x2ffffffff}, 0xc) sendmsg$nl_route_sched(0xffffffffffffffff, 0x0, 0x0) setsockopt$sock_int(r2, 0x1, 0x8, &(0x7f0000000000)=0x80, 0x4) setsockopt$netlink_NETLINK_BROADCAST_ERROR(r2, 0x10e, 0x4, &(0x7f0000000180)=0x10000ffc, 0x4) r3 = syz_genetlink_get_family_id$devlink(0x0, 0xffffffffffffffff) sendmsg$DEVLINK_CMD_RATE_NEW(r1, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000700)={&(0x7f0000000300)=ANY=[@ANYBLOB='4\x00\x00\x00', @ANYRES16=r3, @ANYBLOB="000000000000fbdbdf25250000000e0001006e657464657673696d0000000f00020200657464657673696d300000"], 0x34}, 0x1, 0x0, 0x0, 0x41}, 0x0) r4 = syz_init_net_socket$llc(0x1a, 0x1, 0x0) sendmsg$DEVLINK_CMD_SB_POOL_SET(0xffffffffffffffff, &(0x7f0000000940)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x20000}, 0xc, &(0x7f0000000900)={&(0x7f0000000740)={0x1c0, r3, 0x1, 0x70bd27, 0x25dfdbfb, {}, [{@pci={{0x8}, {0x11}}, {0x8, 0xb, 0x3}, {0x6, 0x11, 0x9}, {0x8, 0x13, 0xfffff69b}, {0x5, 0x14, 0x1}}, {@pci={{0x8}, {0x11}}, {0x8, 0xb, 0xfffeffff}, {0x6, 0x11, 0x8}, {0x8, 0x13, 0x80000001}, {0x5}}, {@pci={{0x8}, {0x11}}, {0x8, 0xb, 0x9}, {0x6, 0x11, 0x3}, {0x8, 0x13, 0xd4}, {0x5}}, {@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, {0x8, 0xb, 0x5}, {0x6, 0x11, 0x1}, {0x8, 0x13, 0x7}, {0x5}}, {@pci={{0x8}, {0x11}}, {0x8, 0xb, 0xff}, {0x6, 0x11, 0x6104}, {0x8, 0x13, 0x3}, {0x5}}, {@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, {0x8, 0xb, 0x2}, {0x6, 0x11, 0xa}, {0x8, 0x13, 0x4a}, {0x5}}, {@pci={{0x8}, {0x11}}, {0x8, 0xb, 0x1c}, {0x6, 0x11, 0x6}, {0x8, 0x13, 0x45}, {0x5, 0x14, 0x1}}]}, 0x1c0}, 0x1, 0x0, 0x0, 0x4040}, 0x80) connect$llc(r4, &(0x7f0000000180)={0x1a, 0x0, 0x0, 0x8, 0x0, 0x0, @multicast}, 0x10) bind$llc(r4, &(0x7f0000000000)={0x1a, 0x312, 0x5, 0xd, 0x3, 0x9, @broadcast}, 0x10) sendmmsg(r4, &(0x7f0000001380), 0x3fffffffffffeed, 0x0) syz_genetlink_get_family_id$nl80211(&(0x7f0000000140), r4) socket(0x11, 0x3, 0x0) r5 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r5, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000140)={0x1c, 0x2a, 0x107, 0xfffffffc, 0x0, {0x5, 0x7c}, [@typed={0x8, 0x1, 0x0, 0x0, @ipv4=@broadcast}]}, 0x1c}, 0x1, 0x0, 0x0, 0x488c4}, 0xc000) r6 = socket(0x2d, 0x2, 0x0) sendmsg$nl_route(r6, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={0x0, 0x48}}, 0x40000) syz_init_net_socket$llc(0x1a, 0x1, 0x0) ioctl$FICLONE(r2, 0x40049409, r0) r7 = socket$kcm(0x2, 0x200000000000001, 0x106) sendmsg$inet(r7, &(0x7f0000000000)={&(0x7f0000000140)={0x2, 0x4001, @empty}, 0x10, 0x0}, 0x30006041) bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0x6, 0x4, &(0x7f0000000340)=ANY=[@ANYBLOB="18020000040000000ad29ac17ec40c22aaa151aa34d678000000000000000085000000410000009500000000000000b054ddc7e7ce4fcb6c352dd83cb669ee71a8d4022e8093371917d000008d2cb7385bf342696c09285ddc6987c478b709aebf416dcd"], &(0x7f00000001c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x40, '\x00', 0x0, @xdp, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r8 = socket$inet6(0xa, 0x80002, 0x0) setsockopt$sock_int(r8, 0x1, 0xf, &(0x7f0000000180)=0x81000004, 0x4) 1m7.529351573s ago: executing program 3 (id=5898): r0 = openat$ppp(0xffffffffffffff9c, &(0x7f0000001740), 0x101042, 0x0) ioctl$PPPIOCNEWUNIT(r0, 0xc004743e, &(0x7f00000002c0)) ioctl$PPPIOCSACTIVE(r0, 0x40047459, &(0x7f0000000080)={0xfffffffffffffe43, 0x0}) read(r0, 0x0, 0xff40) write$ppp(r0, &(0x7f0000000200)="bc72", 0x2) socket$inet_mptcp(0x2, 0x1, 0x106) poll(0x0, 0x0, 0x400) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32, @ANYBLOB="0000000000000000b70800000d0000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000380)='memory.events\x00', 0x275a, 0x0) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) pwritev(r2, &(0x7f0000000100)=[{&(0x7f0000000040)="8e", 0x1}], 0x1, 0x4008001, 0x80) close(r2) socket$kcm(0x29, 0x2, 0x0) ioctl$sock_ipv4_tunnel_SIOCCHGTUNNEL(r1, 0x89f3, &(0x7f0000000800)={'ip_vti0\x00', &(0x7f0000000780)={'sit0\x00', 0x0, 0x17, 0x700, 0x8, 0x1ff, {{0x15, 0x4, 0x3, 0x3, 0x54, 0x64, 0x0, 0x7f, 0x2f, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @initdev={0xac, 0x1e, 0x1, 0x0}, {[@lsrr={0x83, 0x7, 0x98, [@remote]}, @ra={0x94, 0x4, 0x1}, @generic={0x88, 0x8, "dc718d0a5296"}, @lsrr={0x83, 0x2b, 0xa1, [@private=0xa010101, @broadcast, @broadcast, @empty, @local, @multicast1, @initdev={0xac, 0x1e, 0x1, 0x0}, @multicast1, @remote, @broadcast]}]}}}}}) bpf$PROG_LOAD_XDP(0x5, &(0x7f00000008c0)={0x6, 0x2b, &(0x7f00000004c0)=@ringbuf={{0x18, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x7fff}, {{0x18, 0x1, 0x1, 0x0, r2}}, {}, [@generic={0x7, 0x0, 0x6, 0x8, 0x1}, @alu={0x7, 0x0, 0x6, 0x2, 0x7, 0xffffffffffffffc0, 0x4}, @printk={@lld, {}, {}, {}, {}, {0x7, 0x0, 0xb, 0x3, 0x0, 0x0, 0x73e}}, @map_idx={0x18, 0x0, 0x5, 0x0, 0x9}, @snprintf={{}, {}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0x3}, {}, {}, {}, {}, {}, {}, {0x18, 0x3, 0x2, 0x0, r2}}, @generic={0x0, 0x2, 0x4, 0x5, 0xffffff80}, @btf_id={0x18, 0x6, 0x3, 0x0, 0x1}], {{}, {0x7, 0x0, 0xb, 0x2, 0x0, 0x0, 0x2}, {0x85, 0x0, 0x0, 0x85}}}, &(0x7f0000000640)='syzkaller\x00', 0x4, 0x15, &(0x7f0000000680)=""/21, 0x40f00, 0x9, '\x00', r3, 0x25, r2, 0x8, &(0x7f0000000840)={0x9, 0x5}, 0x8, 0x10, &(0x7f0000000880)={0x3, 0x9, 0x7ff}, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x3}, 0x94) sendfile(r2, r1, 0x0, 0xf03a0005) bpf$MAP_CREATE(0x0, &(0x7f0000000740)=ANY=[@ANYBLOB="0b00000005000000000400000900000001"], 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0xa, 0x4, &(0x7f0000000480)=ANY=[@ANYBLOB="1800"/16], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000d80)={0x18, 0x5, &(0x7f0000000480)=ANY=[@ANYBLOB="1801000021"], 0x0, 0x40, 0x0, 0x0, 0x0, 0xb4a02fe0ce239f93, '\x00', 0x0, 0x2}, 0x94) r4 = bpf$PROG_LOAD(0x5, &(0x7f0000000300)={0x6, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback=0x4, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) socket(0x1, 0x80802, 0x0) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000180)={r4, 0x2000000, 0xe, 0x0, &(0x7f0000000040)="630b008646dc3f0adf33c9f7b986", 0x0, 0xcf25, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x80}, 0x50) r5 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r5, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f0000000140)=ANY=[@ANYBLOB="c000000019000100fcffffff00000140e00000fcfffff5ffffffffffffff0000ac1414bb00000000000000000000ecffff0f000000000a00200062000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="0b00000000000000120000000000000002000000010000000000000000000000ff0f000000000000fbffffffffffffffffffffffffffffff00000000000000000000000010000000030000000000002002000000000000000000000000000000feffffff0000000000000003000000000800160081000000"], 0xc0}}, 0x10004004) sendmsg$nl_xfrm(r5, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000000)=ANY=[@ANYBLOB="b8000000140001000000000000080016e000000200000000000000000000000000000000000000000000000000000000000000001000f4030a"], 0xb8}, 0x1, 0x0, 0x0, 0x404c830}, 0x20000800) 1m6.423921466s ago: executing program 3 (id=5914): r0 = socket$pppl2tp(0x18, 0x1, 0x1) r1 = socket$nl_generic(0x10, 0x3, 0x10) syz_emit_ethernet(0x36, &(0x7f0000000080)={@local, @empty, @void, {@ipv4={0x800, @tcp={{0x5, 0x4, 0x0, 0x0, 0x28, 0x320, 0x0, 0x0, 0x6, 0x0, @rand_addr=0x640100fe, @local}, {{0x3, 0x4e22, 0x41424344, 0x41424344, 0x0, 0x6, 0x5, 0x2, 0xfffe}}}}}}, 0x0) sendmsg$nl_generic(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000080)=ANY=[@ANYBLOB="1c0000004600070128b5700000"], 0x1c}, 0x1, 0x0, 0x0, 0x4048011}, 0xc000) bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0xd, 0x4, &(0x7f0000000040)=ANY=[@ANYRES64=r0], &(0x7f0000003ff6)='GPL\x00', 0x2, 0xc3, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @sock_ops}, 0x94) r2 = syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x3) writev(r2, &(0x7f0000019880)=[{&(0x7f0000000400)}, {0x0}], 0x2) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_DELETE(r3, &(0x7f0000000240)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x8}, 0xc, &(0x7f0000000200)={&(0x7f00000000c0)=ANY=[@ANYBLOB="e80000000201010400000000000000000a000009140016400000000900000007000000010000000608000c40000000001c00188008000140fffff800080003400000000408000140000000099c000e800c00028005000100110000000c00028018000100840000002c00018014000300fe8000000000000000000000000000bb14000400bf3598d46951fc020000000000000003002001000000000000000000000000000014000400fe8000000000000000000000000000aa0c000280050001000600000006000340000100001400018008000100e00000020800"], 0xe8}, 0x1, 0x0, 0x0, 0x20008040}, 0x4048850) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)) bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0x1, 0x4, &(0x7f0000001fd8)=@framed={{0x5, 0x0, 0x0, 0x0, 0x0, 0xffffffbc, 0x10}, [@ldst={0x7, 0xff05, 0x0, 0x0, 0xa}]}, &(0x7f0000003ff6)='GPL\x00', 0x2, 0xff06, &(0x7f000000cf3d)=""/195}, 0x48) syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff) r4 = socket(0x10, 0x803, 0x0) sendmsg$nl_route(r4, &(0x7f0000000380)={0x0, 0x4076cbba9945d516, &(0x7f0000000340)={0x0, 0x14}}, 0x0) r5 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r5, &(0x7f0000000740)={0x0, 0x0, &(0x7f0000000080)=[{&(0x7f00000000c0)=ANY=[@ANYBLOB="3c0000001000010000000000000000002c00000020000000ff0f00000000000008001c00c9"], 0x3c}], 0x1, 0x0, 0x0, 0xb305e06d8ab48273}, 0x48800) getsockname$packet(r4, &(0x7f0000000280)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) r7 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r7, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000500)={&(0x7f0000000300)=ANY=[@ANYBLOB="380000001000390400000000fcffffff00000000", @ANYRES32=r6, @ANYBLOB="01980000020800001884f6f6d2388ddc937245d4800147f865000c00028008b89e000700ac271429"], 0x38}}, 0x0) r8 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFULNL_MSG_CONFIG(r8, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000140)=ANY=[@ANYBLOB="1c000000010401010000000000000000000004000500010001"], 0x1c}}, 0x40040) r9 = socket$nl_generic(0x10, 0x3, 0x10) r10 = syz_genetlink_get_family_id$batadv(&(0x7f0000000400), 0xffffffffffffffff) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r9, 0x8933, &(0x7f0000000440)={'batadv0\x00', 0x0}) sendmsg$BATADV_CMD_SET_MESH(r9, &(0x7f0000000540)={0x0, 0x0, &(0x7f0000000500)={&(0x7f0000000040)={0x44, r10, 0x1, 0x70bd28, 0x1, {}, [@BATADV_ATTR_MESH_IFINDEX={0x8, 0x3, r11}, @BATADV_ATTR_GW_MODE={0x5, 0x33, 0x2}, @BATADV_ATTR_GW_BANDWIDTH_UP={0x8, 0x32, 0x7}, @BATADV_ATTR_GW_BANDWIDTH_DOWN={0x8, 0x31, 0x3fc}, @BATADV_ATTR_GW_SEL_CLASS={0x8, 0x34, 0x2}, @BATADV_ATTR_HARD_IFINDEX={0x8}]}, 0x44}}, 0x80) close(r8) sendmsg$nl_route(r7, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000780)=@newlink={0x30c, 0x10, 0x439, 0x2, 0x0, {0x0, 0x0, 0x0, r6, 0x1040, 0x44100}, [@IFLA_LINKINFO={0x28, 0x12, 0x0, 0x1, @gre={{0x8}, {0x1c, 0x2, 0x0, 0x1, [@IFLA_GRE_ERSPAN_INDEX={0x8, 0x15, 0x3b145}, @IFLA_GRE_FWMARK={0x8, 0x14, 0xd6}, @IFLA_GRE_ENCAP_FLAGS={0x6, 0xf, 0x3}]}}}, @IFLA_ADDRESS={0xa, 0x1, @random="977774604b7e"}, @IFLA_VFINFO_LIST={0x2ac, 0x16, 0x0, 0x1, [{0x38, 0x1, 0x0, 0x1, [@IFLA_VF_RATE={0x10, 0x6, {0x5, 0xfffffff7, 0x3}}, @IFLA_VF_LINK_STATE={0xc, 0x5, {0x4, 0x31d0}}, @IFLA_VF_VLAN_LIST={0x18, 0xc, 0x0, 0x1, [{0x14, 0x1, {0x1000, 0x451, 0x5d4, 0x88a8}}]}]}, {0x20, 0x1, 0x0, 0x1, [@IFLA_VF_LINK_STATE={0xc, 0x5, {0xbd, 0x4}}, @IFLA_VF_VLAN={0x10, 0x2, {0x8, 0xea, 0xe}}]}, {0x100, 0x1, 0x0, 0x1, [@IFLA_VF_VLAN={0x10, 0x2, {0x20000000, 0x767, 0x9}}, @IFLA_VF_MAC={0x28, 0x1, {0x100, @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x3}}}, @IFLA_VF_VLAN_LIST={0xa4, 0xc, 0x0, 0x1, [{0x14, 0x1, {0x71e, 0xa92, 0x3ff, 0x8100}}, {0x14, 0x1, {0x10f7, 0x13d, 0xffff, 0x88a8}}, {0x14, 0x1, {0x0, 0x3ee, 0x80, 0x88a8}}, {0x14, 0x1, {0x1ff, 0x31, 0x2, 0x8100}}, {0x14, 0x1, {0x100, 0x254, 0x72, 0x88a8}}, {0x14, 0x1, {0x2, 0x35d, 0x0, 0x8100}}, {0x14, 0x1, {0xfffffff9, 0x5c1, 0x80000000, 0x8100}}, {0x14, 0x1, {0xda58, 0x7a6, 0x80, 0x8100}}]}, @IFLA_VF_IB_PORT_GUID={0x14, 0xb, {0x0, 0x98b2}}, @IFLA_VF_TX_RATE={0xc, 0x3, {0x10, 0x40}}]}, {0x48, 0x1, 0x0, 0x1, [@IFLA_VF_IB_NODE_GUID={0x14, 0xa, {0x6, 0x800000000000009}}, @IFLA_VF_IB_NODE_GUID={0x14, 0xa, {0x3, 0x7}}, @IFLA_VF_TRUST={0xc, 0x9, {0x8, 0x8}}, @IFLA_VF_VLAN={0x10, 0x2, {0x2, 0x265, 0x9}}]}, {0x10, 0x1, 0x0, 0x1, [@IFLA_VF_TRUST={0xc, 0x9, {0x6, 0x5}}]}, {0x9c, 0x1, 0x0, 0x1, [@IFLA_VF_TX_RATE={0xc, 0x3, {0x10000, 0x3}}, @IFLA_VF_RSS_QUERY_EN={0xc, 0x7, {0x945, 0x25a12b06}}, @IFLA_VF_VLAN={0x10, 0x2, {0x3, 0x4dd, 0x80}}, @IFLA_VF_IB_PORT_GUID={0x14, 0xb, {0xd, 0xffffffff}}, @IFLA_VF_MAC={0x28, 0x1, {0x1, @broadcast}}, @IFLA_VF_TRUST={0xc, 0x9, {0x5, 0x2}}, @IFLA_VF_RSS_QUERY_EN={0xc, 0x7, {0x101, 0x9}}, @IFLA_VF_TX_RATE={0xc, 0x3, {0x6, 0x7}}, @IFLA_VF_VLAN={0x10, 0x2, {0x7, 0x65f, 0x200}}]}, {0x5c, 0x1, 0x0, 0x1, [@IFLA_VF_MAC={0x28, 0x1, {0x4, @broadcast}}, @IFLA_VF_VLAN={0x10, 0x2, {0x80000000, 0xd58, 0x6ec}}, @IFLA_VF_TX_RATE={0xc, 0x3, {0x5, 0x15}}, @IFLA_VF_IB_NODE_GUID={0x14, 0xa, {0x4, 0xc}}]}]}, @IFLA_PHYS_PORT_ID={0x4}, @IFLA_MTU={0x8, 0x4, 0x6}]}, 0x30c}, 0x1, 0x0, 0x0, 0x1}, 0x4004000) unshare(0x2a020400) pselect6(0x40, &(0x7f00000001c0)={0x7f, 0x3, 0x0, 0xbf1, 0x0, 0xffff7ffffffffffa, 0x8}, 0x0, 0x0, 0x0, 0x0) socket$inet_icmp(0x2, 0x2, 0x1) 1m6.189795031s ago: executing program 3 (id=5915): bpf$PROG_LOAD(0x5, &(0x7f0000000100)={0x1, 0x0, 0x0, &(0x7f0000000340)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x36, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r0 = bpf$MAP_CREATE(0x0, &(0x7f00000004c0)=@base={0x1, 0x1, 0x40, 0x40, 0x41, 0xffffffffffffffff, 0xfffffffe}, 0x50) bpf$MAP_UPDATE_BATCH(0x1a, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000840)="ac17a905bf7bb1b165160f8aab38a1e709c998c81bc9cfa511de16f027bc10ad67be7863f941928938b91a5fc0970b5bd2c86f8f2de3d03d82cd279ca4fe0b00000000920a0e68992804a7f2", &(0x7f00000003c0), 0x1003, r0}, 0x38) bpf$MAP_LOOKUP_ELEM(0x15, &(0x7f0000000b80)={r0, &(0x7f00000005c0), &(0x7f0000000b40)=""/31}, 0x20) r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000280)=@base={0x5, 0x4, 0xfff, 0x7, 0x88, 0xffffffffffffffff, 0x1}, 0x50) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000004000000018110000", @ANYRES32=r1, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb70300000e41621eb70400000000000085000000c300000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x1f, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x1a, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$wireguard(&(0x7f0000000000), r2) ioctl$ifreq_SIOCGIFINDEX_wireguard(r2, 0x8933, &(0x7f00000003c0)={'wg2\x00', 0x0}) sendmsg$WG_CMD_SET_DEVICE(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000800)={0x68, r3, 0x1, 0x0, 0x3, {}, [@WGDEVICE_A_IFINDEX={0x8, 0x1, r4}, @WGDEVICE_A_PEERS={0x4c, 0x8, 0x0, 0x1, [{0x48, 0x0, 0x0, 0x1, [@WGPEER_A_ENDPOINT6={0x20, 0x4, {0xa, 0x4e21, 0x0, @loopback, 0x30000}}, @WGPEER_A_PUBLIC_KEY={0x24, 0x1, @a_g}]}]}]}, 0x68}}, 0x0) connect$can_bcm(0xffffffffffffffff, &(0x7f0000000140), 0x10) r5 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='memory.events\x00', 0x275a, 0x0) write$cgroup_subtree(r5, &(0x7f0000000100)=ANY=[], 0x32600) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x2000001, 0x12, r5, 0x0) getsockopt$inet_sctp_SCTP_MAX_BURST(0xffffffffffffffff, 0x84, 0xd, &(0x7f0000000000)=@assoc_value, &(0x7f0000000040)=0x8) unshare(0xa020480) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000040)='./cgroup.net/syz0\x00', 0x1ff) r6 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000040), 0x200002, 0x0) r7 = bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@base={0x8, 0x4, 0x4, 0x8}, 0x50) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000280)={{r7}, &(0x7f0000000200), &(0x7f0000000240)=r6}, 0x20) r8 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r8, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000b80)={0x34, 0x2c, 0x107, 0x70bd28, 0x25dfdbff, {0x1, 0x7c}, [@nested={0x10, 0x1, 0x0, 0x1, [@nested={0xc, 0x134, 0x0, 0x1, [@nested={0x4, 0xd7}, @nested={0x4, 0x36}]}]}, @nested={0x10, 0x2, 0x0, 0x1, [@nested={0xc, 0x1, 0x0, 0x1, [@generic="92502f90ef0a73b8"]}]}]}, 0x34}, 0x1, 0x0, 0x0, 0x4881}, 0x2400c810) connect$inet6(r5, &(0x7f0000000380)={0xa, 0x4e21, 0x1, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02', 0x7fffffff}, 0xffffffffffffff2f) ioctl$XFS_IOC_START_COMMIT(0xffffffffffffffff, 0x80585882, &(0x7f0000000040)={0xffffffffffffffff}) bpf$TOKEN_CREATE(0x24, &(0x7f0000000200), 0x8) bpf$TOKEN_CREATE(0x24, &(0x7f0000000300)={0x0, r9}, 0x8) 1m6.037160427s ago: executing program 3 (id=5917): r0 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=@base={0x19, 0x4, 0x8, 0x8, 0x0, 0x1}, 0x50) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x6, 0x14, &(0x7f00000001c0)=ANY=[@ANYBLOB="18000000000000000000000000000000180100002020752500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000007100000018110000", @ANYRES16=0x0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bca2000000000000a6020000f8ffffffb703000000000000b704000000000000850000003300000095"], &(0x7f0000000180)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @xdp, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000340)={r1, 0x8100, 0x67, 0x0, &(0x7f00000002c0)="c810e19e00399da26f0000000000", 0x0, 0xadf0, 0x21, 0x0, 0x0, 0x0, 0x0}, 0x50) r2 = socket(0x2, 0x3, 0x81) setsockopt(r2, 0xff, 0x1, 0x0, 0x26) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$NL80211_CMD_ADD_NAN_FUNCTION(r2, &(0x7f0000002600)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x20000}, 0xc, &(0x7f00000025c0)={&(0x7f0000001240)={0x1370, r3, 0x300, 0x70bd26, 0x25dfdbfd, {{}, {@void, @void}}, [@NL80211_ATTR_NAN_FUNC={0x1c4, 0xf0, 0x0, 0x1, [@NL80211_NAN_FUNC_SERVICE_ID={0xa, 0x2, "0915db52f3e8"}, @NL80211_NAN_FUNC_PUBLISH_BCAST={0x4}, @NL80211_NAN_FUNC_SRF={0x20, 0xc, 0x0, 0x1, [@NL80211_NAN_SRF_BF_IDX={0x5, 0x3, 0x5}, @NL80211_NAN_SRF_BF_IDX={0x5, 0x3, 0x6}, @NL80211_NAN_SRF_BF_IDX={0x5, 0x3, 0x6e}, @NL80211_NAN_SRF_INCLUDE={0x4}]}, @NL80211_NAN_FUNC_CLOSE_RANGE={0x4}, @NL80211_NAN_FUNC_FOLLOW_UP_REQ_ID={0x5, 0x7, 0x6}, @NL80211_NAN_FUNC_RX_MATCH_FILTER={0x100, 0xd, 0x0, 0x1, [{0xf9, 0x0, "e8c95b803ce3cfc385c0b9c7920facf3ce83795c87d7556c2d6b803d94d046b5c9734a1d79b5d37264639200716c550b6d5746d4dfc4a5850e42f36a227e073be27949b5ce410d75a9b5131037e1b077b3b3ec9301e6f5dd578d82b584c6ae30d4288f8949691a9ea0b634710559ff741210d5ee21e949c1c5fe52382ffdd5c347d0e31c16bd167a0b09a4839379f83ddebd86383d4fc0a7350416a76ea109d040592cbe96b222bfd3c818f815add8caf76dd35d07c11992daf255cb016d934cf8de3229a3775d0bc83c5b239f14228d6cabaf3a7f41dea91b95fa77fa2caab92a20783d5bc392512ca2393df33ec6443adc8412ce"}]}, @NL80211_NAN_FUNC_CLOSE_RANGE={0x4}, @NL80211_NAN_FUNC_SERVICE_INFO={0x7f, 0xb, "37ceaf47f4ed9c341f219931a66873edbce7f1ce9e03678f559c7ea88b08d4ca72502cb73f484536d750d87fe2df460d1442b25fad961af246c3551146796f417871ebaac5239c459b6273c3a2552418cada74dbfc853fde8449a789aa12437f99daa6fb09d86e228b414f4e87670482c9074919819c1378f6107c"}]}, @NL80211_ATTR_NAN_FUNC={0x4e0, 0xf0, 0x0, 0x1, [@NL80211_NAN_FUNC_TTL={0x8, 0xa, 0x4}, @NL80211_NAN_FUNC_PUBLISH_BCAST={0x4}, @NL80211_NAN_FUNC_TERM_REASON={0x5, 0x10, 0xe1}, @NL80211_NAN_FUNC_SRF={0x478, 0xc, 0x0, 0x1, [@NL80211_NAN_SRF_BF_IDX={0x5, 0x3, 0x3}, @NL80211_NAN_SRF_BF_IDX={0x5, 0x3, 0xfd}, @NL80211_NAN_SRF_BF={0x103, 0x2, "a07fc97b579b003960ebee17d8abab1c26c4787c22a414046d3a1c29f046d2fed9972266d71f4077635946bdeffb749a437233d1e89103d020a8f4839b42dd6c930028d317d77ff7bca6fd6fb6b152450d2b470beb4775e982903460844caa023adcdd76c9169753b05a71f698c766fec2db7e9063deff3988850013db3833c09f12abc7fdc86714b7bff1d9cf43324df85bb8255a7176f5c3ff0193546ac4513cf2d1363b832cce43de39f3dc4f9b2ea28f95ebd252cc21e532ea99ecc74527399ea8b4d855b59a6b001cd7f52d6adc1af30969846468c3403a854fd39273f73f379ccefec81e959c8b042e49d6bda37e6742618fece7c4c8143172e404c8"}, @NL80211_NAN_SRF_MAC_ADDRS={0x40, 0x4, 0x0, 0x1, [{0xa, 0x6, @broadcast}, {0xa}, {0xa, 0x6, @broadcast}, {0xa, 0x6, @device_b}, {0xa, 0x6, @broadcast}]}, @NL80211_NAN_SRF_BF={0x103, 0x2, "c14d3f6a74f82183f832a3fc5076816c111aa3b5ddc6b0a1a9066425ff8b41b1143ca228eb308fb75b17436e0af664a9ae019d0e445255c368160290a4a7100f98db58e325a7132608926b4d890526d9f0ff0335c1468e2f9b50a0b45d6175bd08284a8dfe7776e348926507da6dfe9251710c38a4eb2786e0450960a3f96fbb482943a8f2e9ceb67b386204b1b83ed827f158d5b4d237b7cbf5dbcd1d39310a1fea8851fa5829b9fd5cea187e846f7ed58005b0d49779b20e3119a88c187234e54f2cda75ae3cb07cfec1be3d381adb7d3731718bc0ebc0a4cf08bdb2ba28bd46c6aa367692d60c93ca4c8bffd170de405bb99d74386df93d684bab0fa000"}, @NL80211_NAN_SRF_BF={0x103, 0x2, "98d2d15a68dc72bf1c1c19a7f28b5031bb4257253a336980d733844a4e7beaf0112da856417adf99940bcf66c519935c64b97ab17f73e7aa762e24059c9e48a53d43db40c2aeadca6c888bba7f6de892e12f50f8d83e4b639d4840c71f43ac25a0d5ed8b4c144ea0d3a88ef0ba4d5e1f206b67e3d542736e6e276569488b2f619224f596f75ba5b125b7c73370b891757a0217ff850c06ec941c4ff007ef29652ca9ad64bd41cce015b09a82c9878a83dd2acdd8941dd91d971a46d3486dc58c566b8bde744bf585732b593fc1a3cf39ae3e43d06885107a2bec11b9bb5d40cf9f24b4801fa4ec5549bda8191977575bc4c0a5809291b33870199318b06e38"}, @NL80211_NAN_SRF_INCLUDE={0x4}, @NL80211_NAN_SRF_BF_IDX={0x5, 0x3, 0x33}, @NL80211_NAN_SRF_BF={0x103, 0x2, "f7b8ea176f1021edbdbf70a0fcf7d6e8e81a941336363fb204439f8d5a09124fb864831e8d761f881703fddca69ed7d2504ff7136f48747028127bb3de6cac02202dd6ca24f4650916d962f3f529b5cdd0ae63e47dfc0a5cc749dc52b04ca09052e8e43118a67deed67c82ab51df39d8171c2802778ddd8425fa3bf8279b03b5c0bd921f179660a59b8294824d0f112dc6851c5225c936b895c7fa4d181aa2419d1dd9e510c8ff016725bd32e06e8bd8b0e98c520bed59ec1237b0943e17456541bc559de7b48d9df02977a5d41a3d4f5352de698e6f2f78876b1a8f4e3cdd1d5f68a8306a14d08015c21c8f99101622b7469999c98506b29247baeadb22ce"}, @NL80211_NAN_SRF_BF_IDX={0x5}]}, @NL80211_NAN_FUNC_FOLLOW_UP_DEST={0xa, 0x8, @broadcast}, @NL80211_NAN_FUNC_SRF={0x44, 0xc, 0x0, 0x1, [@NL80211_NAN_SRF_MAC_ADDRS={0x28, 0x4, 0x0, 0x1, [{0xa, 0x6, @broadcast}, {0xa, 0x6, @device_b}, {0xa, 0x6, @device_b}]}, @NL80211_NAN_SRF_BF_IDX={0x5, 0x3, 0x4}, @NL80211_NAN_SRF_MAC_ADDRS={0x10, 0x4, 0x0, 0x1, [{0xa}]}]}]}, @NL80211_ATTR_NAN_FUNC={0x20, 0xf0, 0x0, 0x1, [@NL80211_NAN_FUNC_SERVICE_ID={0xa, 0x2, "7f464e0c43f9"}, @NL80211_NAN_FUNC_TYPE={0x5, 0x1, 0x2}, @NL80211_NAN_FUNC_PUBLISH_TYPE={0x5, 0x3, 0x4a}]}, @NL80211_ATTR_NAN_FUNC={0x288, 0xf0, 0x0, 0x1, [@NL80211_NAN_FUNC_RX_MATCH_FILTER={0x284, 0xd, 0x0, 0x1, [{0x73, 0x0, "a01ecc90e6359b224ea94aac03e2a8512d021e388aaf073b22c5a0bf321bc7003afea6d4666f3e4b78128dff2842d4eb7b6dc19873ae76064c3b96d2efd78d8353466267bb76e92c0d94326ee81f6cce08927554dcf9ff1652d5dd3b4feb1108cea8f0e3c96b1d09efc656792908a0"}, {0xdf, 0x0, "07d26ca242e659b8d55c2135cfd7d11a1df3cefaeb72b8f597adabe39ab1ad732eae3dfd1ae2068e115c1d1e252f36d1a84226b8ba1b384ce49faa0a8d856974a440dc9f2dab79cacb703161e2ae1d4a05fbbd4e47f9b7a1088dd66418a07dcc924c9cc21170abf4e2e717538801ff0fe0d3e13a125413ae5d8f2a669e5ac064022281085244da7762e3e0bc0efc94fe4792a795692fe89f1af15f29fcfa27dfe09e991f40dc206a351be6a52ed4a1f50bdbfefe4f920d15305a2e42b4186b53d6869d15169d06f2093e1c37df70967666435dd9eaca38a02fb621"}, {0x7, 0x0, "f70d5e"}, {0xb4, 0x0, "5dbf9cef7a5a72ae2cf4152718ca62bbbf74e54d00f544f4998929b029075cb61fc58a358a760cc308cd5788f468b08f706b241b82e8f2745cbb10a8dffb3ab7f6fed368167a1f384bdf97c94f25cf5f7b2494cdb364477c37eafe7b56a2cfc5ead4c921b062a0a6c4f792bb09bc1ba94252dc4bf131ebfb686563657fb20d87221e4ff3f3b1b194ef4992365bdbf5b1a6752ed13d6324cd0a3e4d3bcf90ff0519254d474a0284d55490977124db3fab"}, {0x3a, 0x0, "6cac45fdecc187d5b3dcb1b6d9896d15155403620e96595cfddecef7b77051efb68ae0cddd4b1ed0cfd85b2174549b264469961cf4c1"}, {0x31, 0x0, "1255ac1cd407cf41036798568b4a3225bcb926c188a1947938932fad78a8d23e930510c9f29993fc5e333037ec"}]}]}, @NL80211_ATTR_NAN_FUNC={0x284, 0xf0, 0x0, 0x1, [@NL80211_NAN_FUNC_TTL={0x8, 0xa, 0x3}, @NL80211_NAN_FUNC_TYPE={0x5, 0x1, 0x2}, @NL80211_NAN_FUNC_TTL={0x8, 0xa, 0x101}, @NL80211_NAN_FUNC_CLOSE_RANGE={0x4}, @NL80211_NAN_FUNC_INSTANCE_ID={0x5, 0xf, 0xf9}, @NL80211_NAN_FUNC_SRF={0x240, 0xc, 0x0, 0x1, [@NL80211_NAN_SRF_MAC_ADDRS={0x1c, 0x4, 0x0, 0x1, [{0xa, 0x6, @broadcast}, {0xa, 0x6, @device_b}]}, @NL80211_NAN_SRF_BF_IDX={0x5, 0x3, 0x4}, @NL80211_NAN_SRF_BF={0x103, 0x2, "cd8adbf31e623da778309ad5a26274f0056487ab23c24c09ef375f4ed837a7a535cd01eaa4a024df422c47ac186169070ec49454017435cc0f30f7085708dce3a4c430daccb3762915302fc51c9da60b1cb571281e53b7b140ba3a09818c54e43e8d3da20d93e2e74fffd1a8c907f1c1b50e0af853eec56ab4ae185d72e37d36eb4cdaf2f5e7a96cb99dfd13b5b9e47610f312ba18680517d3aafc018674ea4c171be222bcb0817517d2b2708a9912085979aa3e9d938e9fd85c3280cafacfbbf004c92939b7faa03101edec3fc9a810c4152b907739c175c2cf58be6efc2a6a568768c37bf5e847bb4915464477c3c7e1735248366d3afbf147720eb501e9"}, @NL80211_NAN_SRF_BF_IDX={0x5, 0x3, 0x9}, @NL80211_NAN_SRF_INCLUDE={0x4}, @NL80211_NAN_SRF_INCLUDE={0x4}, @NL80211_NAN_SRF_BF={0x103, 0x2, "3e52f1e45c29800a941636a8c4ffdf3f4a13ef9da409361765c4d870bedaf697d2e8c0e52ba29147b848f16cb60eac4daa26cec7b76de5e03c6c593a21a8ec39813746e95df8016359094f1f17a420babb8f1477038e813054be27d131e2352c83bfb99837e4e0485c77bbd0a902eae8ed71e8975b389324f47abcfefc510e21eff565688655634827c5ae03039532d1b46225a025a188f83811b3e484ae2b0e6d696709bfc9cb99f427745c7d237b024fa256f12f449ff06ea24d1694f272cc5852f6bb657031ff97477bc4dd5b26e409a022e6247c49f165106e21daebf78eee17b556ccf23d44e1ca69982f217f5fc73f97bfa7085026d42164fdb86fb3"}]}, @NL80211_NAN_FUNC_TERM_REASON={0x5, 0x10, 0x9}, @NL80211_NAN_FUNC_FOLLOW_UP_REQ_ID={0x5, 0x7, 0x7c}, @NL80211_NAN_FUNC_TYPE={0x5, 0x1, 0x2}, @NL80211_NAN_FUNC_CLOSE_RANGE={0x4}]}, @NL80211_ATTR_NAN_FUNC={0x78c, 0xf0, 0x0, 0x1, [@NL80211_NAN_FUNC_SRF={0x8, 0xc, 0x0, 0x1, [@NL80211_NAN_SRF_INCLUDE={0x4}]}, @NL80211_NAN_FUNC_TX_MATCH_FILTER={0x648, 0xe, 0x0, 0x1, [{0xdd, 0x0, "c0aafdedf9c61f9c52936003437a14d26abb7e8e9bf6274c4de5a42525a6133e5676f3f8f163354945047926d0799e6afe788f4e8dedc6c75ccb39e1bd9143cb00a00a41f0ca548d5b8b1360d76ba4d22f2c162bbf9500821df87e819cde77efbd3e9eb45e0947632d6243958b1bf803e45556f5165f2a1d18c9c11e88ba92280b9581ede6ccd9413d0a3795d7180e07b4910528853cc907ae772b4a689d5e4e6fda5cac58f3ed3a02069f05a1e68586f38d5c8127001f0ecf7731dad8706942f562a1495a97fa87c4713289ddcec295fea55cf2907b0ce871"}, {0x77, 0x0, "ef6d671d08e37844e449e04b0e1cd8d82b7f6b04f26292157b183a53ba1c9edd30b3512ec27997ae539b3b4d855dc285e0f2ebc5c6f28c5d00def512f8ca2e68c18aa32349bce08dda8475cef0383b5c4fd73e35b63d0ce101d9537b1cdeeba9e95d44f51061374ed2f26aee13f229aefefada"}, {0xc2, 0x0, "920bfb406c50cc31a6c57b1b659862067e5e7b1f5bd78becfe8e94def85a4372804af2ae939854b3ec2ae51981dab4cff86201f8111e95448a3b2bf57d6f5ecf63347ad12e2c1094160b59c3b3f41eeba54f5d12c0520f17a062e4a1ac110e7d9313db8affd81655cb09341e9cc9ea8e0aded79b1126024dcce6657064f0ecb0882acc6361a02c2be556887172b44587367258a359971e1737ccc88e0212839b2b08c5293d732c47fa056b6392e17a486c470a78989be7087660d4d18e8a"}, {0xa7, 0x0, "8c74597f278298629e8c98efafba2f4d5475aa43d80086d3179f6336d3e5bdce15b1e01cff7e3e845c5109f142a8014b39acc013acb3a511098ad5953e59454a6ff7fff28288bfa4d79ae77a885be49e5c44afcbe1041080faa9018e8a52cc441f44817d9e2a550588d7eabd79bcc64f6bd46411f31deba274680fc77b97552d3bdaceb0d90f8bdb35376d39b35dbfc08e310697b46745386fee738a1e6dc348db935c"}, {0xa4, 0x0, "82550a1b56e1c1761f208af30f58af5e8b13b22915ac22a899b999e09476d77be75e4bbdc5f2c63404f939b93a339ae88d9af8f10e8ee5e984edc2357c66a7a6253a5a0571d52d0f642fdf5ab2cded93c7e4bae19a563cbe3c53700b504a6bc2761ae821b4b6316cd515512841bd803ebe911d14fb972b8a4d2b121d334668a4dcfa18a71a1cc609dc3189b9487fea4277bfe41f6d5ae35505564b9d435f05d4"}, {0xed, 0x0, "d99592cfcdb985d37573846aca26447b6650f6972772178c6ba734cab68a8e690ec79a34587fddcd76698bbcc6e3cbbe520f416c49bf0dfa5062e0b2d69f5d9a6d0143412d047daed3ea38c8eaa02ccbbf58002cdefe373d79e3609d07507a097de8e2a4b31f4830159b3d99dd997d9ca0d47009b7753de0393dc9e065c8822177ae1bbab84edd6bd0a1cdf956bd1a21fa6d97633009cdd0468c5d9c82b8e3975eecf7aad7fdd9d6df4a48523749d89984b1b70e3c453426bb020b2f91cf49ec792ed7cf6255bed837b0dc26670698aade8395cd76427d0d9845f2b173d6a54a6df0cfe3e44a2a55ff"}, {0x82, 0x0, "b4d222e2ef47505ed1b34dea4dd5583a2c8bb4655beda03d5314a334d6625e3d50f1e47d2106284de0076bd7121103b9d6feabb4a56c426b4b18133fbfd32dec5d7327dcdd4c14757f5c0bfac6dcc5b82573c09d49ee2c5d6cc1a0626c6b876bddb7dfb7713a402086056d78c1d2b0652988b05eb544dbaadf3c4efadd0a"}, {0xda, 0x0, "c108262530bd73851a2314839a123962ef3f456dc8685bcbdcb231ef2c431976a5e9f6886827edf7abd70567907077e0bafbc869c7bd35167efc4c100dd7515aa6c78b070884df347fcd9e5d529fba5bfad1d89830548cd51a8d1fe1bae5f50f21c8906943ea34afb2973a7224cc8b7013878f06307cb1a881d28ca965e534305775bca61ac791fca6343001f4f08a0031461e26ab109ea0e0b2328f39d483c873a1ae5eac8e9e8065aaf14b7ff1072350523758508f9e88aa96a32f17b46e2a3501d17f5f9e9280b81cbaecd5077a3930b90fd5cebd"}, {0x8a, 0x0, "c1e4257f5615a39f39c9a0ccc77436f08d0b54b74c72863ef4c5f3fb79f2e28cf9f4e08fd8a7f5dcb7f3364be482c493942dffe99471f561a603fd33dd10d6e9f74f596549a35b89057bc3b9bdac8e88d14cc6b01bbae617fa0616fbd72f74c1a5935b2fd0e0e6dac6a1043718771c049c8a1754393c4a7aaa4f38997a7119aa38daee408ecb"}]}, @NL80211_NAN_FUNC_FOLLOW_UP_DEST={0xa, 0x8, @device_b}, @NL80211_NAN_FUNC_TTL={0x8, 0xa, 0x2}, @NL80211_NAN_FUNC_SRF={0x124, 0xc, 0x0, 0x1, [@NL80211_NAN_SRF_BF={0x103, 0x2, "8c46c6f80776b798d400c23d051d55458dfc442028014cba7ff0a6dc45f86b7ad98e743bb84083645ad1cca0ac0f4302d9254db29f4204041c84c54f5c8c12f7e429d08ab81ec979d65e27e37a5b097ad462215ff919e61ba9b49da1765f0b39a0a82a5c29770a6ea7810be99424c9c0ee70d9e5b10244dd8dde44019ed7942ddefc38346d79af8cd5cd5fd38b03e645cff38c447e133747030b4a8aa356f280f2a126c572bd0ad7255f092ea3ed9ba11cc21903939287e6713d641b2a1716f3af03a6688cf52737810b847399012426ce1c0c8d8525c284a6dd5231f581bb9a7757ed16426270ab68c3beb49e859d454a14502fcd107151b531dc697cd0ea"}, @NL80211_NAN_SRF_MAC_ADDRS={0x10, 0x4, 0x0, 0x1, [{0xa}]}, @NL80211_NAN_SRF_BF_IDX={0x5, 0x3, 0xe}, @NL80211_NAN_SRF_INCLUDE={0x4}]}]}]}, 0x1370}, 0x1, 0x0, 0x0, 0x4000000}, 0x4000805) ioctl$BTRFS_IOC_BALANCE_V2(r1, 0xc4009420, &(0x7f00000003c0)={0x14, 0x1, {0x4, @usage=0x1a, 0x0, 0x7, 0x1, 0x81, 0x1, 0x401, 0x0, @usage=0x3, 0x7a, 0x800, [0x5, 0x8, 0xffffffffffffff00, 0x8, 0xffffffffffffff08, 0x1]}, {0x7, @struct={0x9, 0x8bb}, 0x0, 0x1, 0x4, 0x9, 0xd235, 0x3, 0x0, @usage=0x5, 0x8, 0x8, [0x100, 0x2, 0x3, 0x200, 0x9, 0x80000001]}, {0x1ff2, @struct={0x80000001, 0x1}, 0x0, 0x78e06829, 0x5, 0xce7d, 0x10, 0xff, 0x428, @usage=0x6, 0x1ff, 0x5, [0x5, 0x1679, 0x5, 0x2, 0x1, 0x2]}, {0x5, 0xa, 0x9}}) ioctl$BTRFS_IOC_SCRUB(r1, 0xc400941b, &(0x7f0000002640)={r4, 0x3, 0x1, 0x1}) ioctl$BTRFS_IOC_SCRUB(r0, 0xc400941b, &(0x7f0000000a40)={r5, 0x301, 0x7}) ioctl$BTRFS_IOC_BALANCE_V2(r1, 0xc4009420, &(0x7f0000000e40)={0x0, 0x2, {0x7, @struct={0x7, 0x2}, 0x0, 0x667b, 0x4, 0x416fe7d, 0x1, 0xf6a, 0x6f, @struct={0x3, 0x6}, 0x2092, 0xfffffffb, [0x8, 0x9, 0x2d99, 0x1, 0xfffffffeffffffff, 0x401]}, {0x9, @struct={0x10001, 0xff}, r4, 0x0, 0x0, 0x7fffffffffffffff, 0x1, 0x7fffffffffffffff, 0x10, @struct={0x7, 0xffffffff}, 0x978, 0x3, [0x4, 0x8, 0xd, 0x1b9b3f9d, 0x1000000, 0x3]}, {0x1ff, @struct={0x80000001, 0x40}, r6, 0xa, 0xd71e, 0x7f, 0x4f, 0x5, 0x400, @struct={0x101, 0x7}, 0x7ff, 0x8, [0xea, 0x6, 0x400, 0x3, 0x80, 0x5]}, {0x4, 0x1, 0x6}}) 1m5.847874231s ago: executing program 3 (id=5919): socket$inet6_tcp(0xa, 0x1, 0x0) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.net/syz0\x00', 0x1ff) r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) openat$cgroup_freezer_state(r0, &(0x7f00000000c0), 0x2, 0x0) r1 = socket(0x10, 0x3, 0x0) sendmsg$netlink(r1, 0x0, 0x300) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket$can_bcm(0x1d, 0x2, 0x2) ioctl$ifreq_SIOCGIFINDEX_vcan(r3, 0x8933, &(0x7f0000000180)={'vxcan0\x00', 0x0}) bpf$PROG_LOAD(0x5, &(0x7f0000000440)={0xd, 0x4, &(0x7f0000000540)=ANY=[@ANYBLOB="b400000000000000611138000000000054000000000000009500000000000000bf4ab41f57177a09badf2d609444dce0a96da39d4a798136691a3acad1a53ca6ce540a262ed4d483bc474439e647a1fe8030f2b3decef1295ff730339c3b5ca0adc5f22a7b86087fcde36b3b7cb28db72bad9afec5d35b5e41055d58aa2e7cc3a7b823d0e6b013fb8d78d2bb25a3487045b6cc75954d55d645146a97a9b3467e370ad955419fe2164b973301d9ddc38b6281c82a230dc1f9e00e95f5874e6964663a4b40c9c46b665868aa5b296c1e5f80a8059d"], &(0x7f0000000080)='GPL\x00', 0x4, 0x3e0, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @sock_ops, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x0, 0x10, &(0x7f0000000000), 0x76, 0x0, 0xffffffffffffffff, 0xffffff33}, 0x48) connect$can_bcm(r3, &(0x7f0000000140)={0x1d, r4}, 0x10) sendmsg$can_bcm(r3, &(0x7f00000004c0)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000400)=ANY=[@ANYBLOB="05"], 0x48}}, 0x0) r5 = socket$can_bcm(0x1d, 0x2, 0x2) r6 = socket(0x1d, 0x2, 0x6) ioctl$ifreq_SIOCGIFINDEX_vcan(r6, 0x8933, &(0x7f0000000000)={'vxcan0\x00', 0x0}) bind$can_j1939(0xffffffffffffffff, &(0x7f0000000380)={0x1d, 0x0, 0x1, {0x0, 0x0, 0x1}, 0xfd}, 0x18) bind$can_j1939(r6, &(0x7f0000000100)={0x1d, r7, 0x2, {0x3}}, 0x18) ioctl$ifreq_SIOCGIFINDEX_vcan(r5, 0x8933, &(0x7f0000000100)={'vxcan0\x00', 0x0}) sendmsg$nl_route_sched(r2, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000240)=@getchain={0x24, 0x11, 0x1, 0x0, 0x25dfdbfb, {0x0, 0x0, 0x0, r8, {0x8}, {0x7, 0xf}, {0x0, 0xe}}}, 0x24}, 0x1, 0x0, 0x0, 0x44060}, 0x98) ioctl$sock_inet6_SIOCSIFDSTADDR(r1, 0x8918, &(0x7f0000000080)={@private0, 0x3a}) syz_open_procfs$namespace(0x0, &(0x7f00000000c0)='ns/net\x00') r9 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x16, 0xb, &(0x7f0000000580)=ANY=[@ANYBLOB="18000000000000000000000000000000180000002020702500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000000000000b703000000000000850000007000000095"], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, @flow_dissector, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0x1c, &(0x7f00000004c0)={r9, 0x3, 0x11, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8}, 0x44) r10 = socket(0x11, 0x3, 0x1) setsockopt(r10, 0x107, 0xf, &(0x7f0000000100)="00008634", 0x4) r11 = socket$inet6_udp(0xa, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r11, 0x8933, &(0x7f00000000c0)={'bridge0\x00', 0x0}) sendmsg(r10, &(0x7f0000000180)={&(0x7f0000000040)=@xdp={0x2c, 0x8, r12, 0x6}, 0x80, &(0x7f0000000600)=[{&(0x7f00000004c0)="000302000b00000000002d3922ff65b4355e953d23d254f0", 0x18}], 0x1}, 0x40011) r13 = openat$cgroup_procs(r0, &(0x7f0000000040)='tasks\x00', 0x2, 0x0) write$cgroup_pid(r13, &(0x7f0000000180), 0x12) 50.684089986s ago: executing program 32 (id=5919): socket$inet6_tcp(0xa, 0x1, 0x0) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.net/syz0\x00', 0x1ff) r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) openat$cgroup_freezer_state(r0, &(0x7f00000000c0), 0x2, 0x0) r1 = socket(0x10, 0x3, 0x0) sendmsg$netlink(r1, 0x0, 0x300) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket$can_bcm(0x1d, 0x2, 0x2) ioctl$ifreq_SIOCGIFINDEX_vcan(r3, 0x8933, &(0x7f0000000180)={'vxcan0\x00', 0x0}) bpf$PROG_LOAD(0x5, &(0x7f0000000440)={0xd, 0x4, &(0x7f0000000540)=ANY=[@ANYBLOB="b400000000000000611138000000000054000000000000009500000000000000bf4ab41f57177a09badf2d609444dce0a96da39d4a798136691a3acad1a53ca6ce540a262ed4d483bc474439e647a1fe8030f2b3decef1295ff730339c3b5ca0adc5f22a7b86087fcde36b3b7cb28db72bad9afec5d35b5e41055d58aa2e7cc3a7b823d0e6b013fb8d78d2bb25a3487045b6cc75954d55d645146a97a9b3467e370ad955419fe2164b973301d9ddc38b6281c82a230dc1f9e00e95f5874e6964663a4b40c9c46b665868aa5b296c1e5f80a8059d"], &(0x7f0000000080)='GPL\x00', 0x4, 0x3e0, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @sock_ops, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x0, 0x10, &(0x7f0000000000), 0x76, 0x0, 0xffffffffffffffff, 0xffffff33}, 0x48) connect$can_bcm(r3, &(0x7f0000000140)={0x1d, r4}, 0x10) sendmsg$can_bcm(r3, &(0x7f00000004c0)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000400)=ANY=[@ANYBLOB="05"], 0x48}}, 0x0) r5 = socket$can_bcm(0x1d, 0x2, 0x2) r6 = socket(0x1d, 0x2, 0x6) ioctl$ifreq_SIOCGIFINDEX_vcan(r6, 0x8933, &(0x7f0000000000)={'vxcan0\x00', 0x0}) bind$can_j1939(0xffffffffffffffff, &(0x7f0000000380)={0x1d, 0x0, 0x1, {0x0, 0x0, 0x1}, 0xfd}, 0x18) bind$can_j1939(r6, &(0x7f0000000100)={0x1d, r7, 0x2, {0x3}}, 0x18) ioctl$ifreq_SIOCGIFINDEX_vcan(r5, 0x8933, &(0x7f0000000100)={'vxcan0\x00', 0x0}) sendmsg$nl_route_sched(r2, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000240)=@getchain={0x24, 0x11, 0x1, 0x0, 0x25dfdbfb, {0x0, 0x0, 0x0, r8, {0x8}, {0x7, 0xf}, {0x0, 0xe}}}, 0x24}, 0x1, 0x0, 0x0, 0x44060}, 0x98) ioctl$sock_inet6_SIOCSIFDSTADDR(r1, 0x8918, &(0x7f0000000080)={@private0, 0x3a}) syz_open_procfs$namespace(0x0, &(0x7f00000000c0)='ns/net\x00') r9 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x16, 0xb, &(0x7f0000000580)=ANY=[@ANYBLOB="18000000000000000000000000000000180000002020702500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000000000000b703000000000000850000007000000095"], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, @flow_dissector, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0x1c, &(0x7f00000004c0)={r9, 0x3, 0x11, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8}, 0x44) r10 = socket(0x11, 0x3, 0x1) setsockopt(r10, 0x107, 0xf, &(0x7f0000000100)="00008634", 0x4) r11 = socket$inet6_udp(0xa, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r11, 0x8933, &(0x7f00000000c0)={'bridge0\x00', 0x0}) sendmsg(r10, &(0x7f0000000180)={&(0x7f0000000040)=@xdp={0x2c, 0x8, r12, 0x6}, 0x80, &(0x7f0000000600)=[{&(0x7f00000004c0)="000302000b00000000002d3922ff65b4355e953d23d254f0", 0x18}], 0x1}, 0x40011) r13 = openat$cgroup_procs(r0, &(0x7f0000000040)='tasks\x00', 0x2, 0x0) write$cgroup_pid(r13, &(0x7f0000000180), 0x12) 4.170533046s ago: executing program 0 (id=6368): socket$alg(0x26, 0x5, 0x0) r0 = socket$kcm(0xa, 0x2, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000440)={0x18, 0x12, &(0x7f0000000080)=@framed={{0x18, 0x8, 0x0, 0x0, 0xffd0}, [@func={0x85, 0x0, 0x1, 0x0, 0x6}, @map_fd={0x18, 0x0, 0x0}, @generic={0x66, 0x8}, @initr0={0x18, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1000000}, @exit, @printk={@x, {}, {}, {}, {}, {0x5, 0x0, 0xb, 0xa, 0x0, 0xfffd}}]}, &(0x7f0000000000)='GPL\x00', 0x2, 0xde, &(0x7f0000000340)=""/222, 0x0, 0xc}, 0x94) r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000500)=ANY=[@ANYBLOB="340000003e0007010300000000000000027c00000400428011000100686d"], 0x34}, 0x1, 0x0, 0x0, 0x4048011}, 0xc000) r2 = socket(0x25, 0x80805, 0xffff) r3 = socket$inet_sctp(0x2, 0x5, 0x84) setsockopt$IP_VS_SO_SET_ADD(r3, 0x0, 0x482, &(0x7f0000000140)={0x84, @rand_addr=0x64010105, 0x4e22, 0x3, 'lblc\x00', 0x1, 0x80005, 0x6f}, 0x2c) setsockopt$IP_VS_SO_SET_ADDDEST(r2, 0x0, 0x487, &(0x7f0000000000)={{0x84, @private=0xa010102, 0x4e21, 0x3, 'lc\x00', 0x5, 0x8, 0x77}, {@remote, 0x4e20, 0x2, 0xcd}}, 0x44) sendmsg$nl_generic(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x29, &(0x7f0000000100)={&(0x7f0000000600)=ANY=[@ANYBLOB="8f678dee49e381be29c51e5f450a61c31157e4709f032da594deeacefbf63a25bf7f2234d6d85bcbee2b450157b8ced3ff394b27fa7c896fb769122efa91438d9bbed3b8b58c412309fa30e36edd2d80f44fb879c97255d1a5d751a9d0de8118655ef1b5bea06a64cb3a8c0e481ab853a1a4ea3c460c2421aa5578aa0d455788cd64cd001fd0f4f250a7f6b09d1721baa7d43c1ba5cd24929f8e5fac04c24baf71ebfc8fca00ef5a007b2e9737e76130998c4d5334f64d86956db400b14837d4803262e515f777d144b5a4301635188fc777a59e1a9a224b8bdf33198340ee675ed682c4a4d3b34a4e348b6a95270cdb44791fd5d66a07dfa025f0d440ea41f1a8e7379d6c94780298b7b3f8019e038e0c40ddd423f3b4021c5a468af0403c2ff1e30c9ac06b8badc328c7c23040f837978c263a55d63ec8659a84dadc4d3a80093391c13024058a4a962766b6613135f19e29bb1b7cd308e0b4f2ce70dedf41aaf6d5e1cd13606961ada81671f22a1f60d508f53ed80f338cc59f17d0405c62b091ed013b9a0e183beb194e14f2fb83d344c4212f5ef61c412c766db9445f908d1b9c67f70fc3698117521104b21ac83014f8b9b9e5469695bbc8a4037ec913263a1ca322a6e8f08f5ef9ad8eb6d1b0ca619ff8617fbde91248e051c70e512b63f3ae640a942832705b0343a6a585e680eb13cbb463271be664341fee04761b8ce60486346be0a98ebe1ea7d4c12abe69b714896bd03c16e20ce7b31ffc344fb2bf9892adec417c6e17d8e5dadb0fa2dbfb9391f46d187d7a9519a5093c06445fc9ca5eb490d0c423370eb458cf5facf7558081038f20b0fb630e1fd60941c19c7e8d739e9d3afdcdfe1438d9d2a1f0998f6775e4fbb8f5484b7ca30cab18e99e820adfce9aa3fd5fd1c6f7d09e145b9bfcb9e77ec40ac5824e1a13df57809741a7fd7aae71820016720fe44be6c453df469466da4de06940d3c022ef85ca802622c9b759244912d122c911bfbbd26bb7107763b046c79245070806f3e63e9f149861bec855710e9009f97d68e8c9f9ffa00e54322e27c7c1cf070805f155f7d27d7bdecca3be289614fb6b064f3410a7d93a387c81f2751743bfd0ef0b96aaf1cb9d2a80e2a280cc873dfee9388cfcc6585eb32ccf37cd5ca1305b25c8436e785dc03865a7b866b205ffafcd16174bbe7f9fa0c8bc7070ea140c4f9f9ac108932ef3ed157b91b968ae5b10bdda974d017952b06653a0565714880478150293d4a62a28e06fa97b1d100eace305e3af76c4bc60b60c630997e3aca3440a1e1d8f2dbee90c834f545ca9b5d075118d71366a6218f6817a62b5094180c32a286f4ab52762793ab74216e8e931151aa42b552f18088f6858d5d7703999511b1e83fca412b2fdbe5f037d5f551df9ef6912e4d9ba911dbf72b33a0676b3c1c77957159c070664f597a9de13e10bbb20ba860bca3635c3123954e35fb9ffead0625b4bc37c5dde647281d410f04e86c1bb610c91c4fea93dcbb5c9add8040c3b63efef75bd68475402a82860e4d600abafc3598c29749b8cc29ecbe624edb34431a331c205d30ca966fe2f08bbe010c9592ac0a8b75ebe529274c64f627a0cf2294a0d9a0b009da7d00e6d2ff963e088b8dd8f68381e96f8ed231137b617e8ea4a4279402271f086d18641a6980572a4b7167210aec1782d334ab76ac88cd9b7d229f0c3dd00b6317e4861c9411a53641bc2ffb22a0c5e3230ff8e938bf6dc2d0442ae600ee6a23366b7a79e670a376577b97fb58c91770784e152977234757a86abb9e15368029fbf88254aebc29a861b589daa03e253445ed87d9f36d19186a0e0a8d48190590d240a76ad7178bbbc3b1a6bc2272ca3a6f6b788dd17e335c460d0fa6d508c541a4c5cbec32a40edd534638ffec9ef976f1cc3782f69eac856a28140d46af5175ab559b3c7522b3de854d87c6cfb8154fe1e7d42eed8aaeca7744bf55dd2374160d25ffb034d4bb299eef0a26b4d38d0d5752cb09e8a1f2b23f6313b4fa09dc54e5fa02810e6832d003508c218e0eb2d60f7bb9a4df5379f33ad4b4465fdc33d0ae79cf8127b86667105d3a3437343545687d55ceaceba3056f8ef6829da0b7c07ad4d0f9c3f6ffbc0dd7a076bc0c5f3053cfe9a5441ac14568306e63e9f9915c65ce08b0768e84602ebbd161cfa4ae97c02749266cbaeedc3f6660ec50c7d1d0b8775c167d04ceb35b1f610c0dc10f9b1e3fc7bb046c293d94038bf7e7424eb03aa7417defa11d39fd744a9b4ff6e4cc6ce87633576ec08662d490097052de42f18fbd75a3b240b82dcad4b77092e0851ae98b96dc73cfca0439f9cf9c9dae5c77ff28e323d5e6ca80880dcba5c7b750d159c0cd3085a871688de6560d4958dd27d9d8c95748bcadbe750bd65c43c2988ed2b874dfe9ac85ea467cbc7ebec95935f26c3562e0601f85d6df3fcc4bc15d07eaeeb5a8d877890bb126eae4310eb2465f505564dae42e8338758a14770036a2abf85c5b32859450356ba2adcb14bc48c7ea43359b351cc6cf61695ff18c74910134b5393429f182bdc80f31db07b68c4643ed3811f130885f51938d16baf4d0a15084c5dad7aef785f571fa67f435f698b9ae3ba7e280b93bfee4b0fec2c6fe5fc0c8a126f8b5a4a9126fd1c010e0b4ff4d14ef7117324bfcaf3037a59724307969a0e2bccaaac638481cd07633c2c5c25452ae682f938baaf61c3266d81dc7e08d0a6167223cd7802ee2d46b196c269d45f3714f62fbb7a18dc2e4f6b05a996f6cdf6803ce16d5c2824285bdc96dfe2a1f2d9783c821c3621d3c64940ebb311a1159c011aad754353cbc533061de82f79b139a6402066805e7ebbe714e5615115938f7579d239196fd7f83e0dbf630a53d06b49e0298f4ec56f9b160912437f27cb9a6bf8e7fe17b15c14583d22aee50926c7d9fab3a4ebcf1ff4377106023e214e0c8eb1750cf8ee1ff4434d725c9b1ab248bc596d57697fca17e49a85805e04dfdb8fcfd5ac117afd8ee524b28850700474725972771760ad2047067e1180e15a9dfde4d4698bcd8f00809764fab8c8fd6a5a16015ba273455ede00151f28d7d68ced7a5c3971792dd6e711702b5196e6cab7e911fb1222b6ed9b92776449cc09d6231d5d5c057ab0e25c339a1da46d50081a8bbebd1aa89f2e56632e45779b0eba1575dcc5bcd21b9ca02f076ba6a0d452fb6dc2b6f6200d2741a91333853b4dba932d56a944e5be525174e663ffdeab081a4054b989d7d59c346896ac8e91a0ce05113fcdf6198d5b88ab9d7169437ef9a06cf1456c0aad20d06e0da05dd064b34f528a6fb75a7e620423966cf843779cbad099a994518f676547b79c1b20e06570169e70ae24a9a7c8305e11fe0237398fe19b41a2270ffda6ac6dc39b9cc397b712719e539754cad0c26e4375beb5dbbc11ed595fa406616b2fe46e0fc1155a18d4057abbf993ebdd22607eaac3bb900b1585eff85fc53dc3138155285d20f93a43435c8c381fd3eea99ec7581b1b00e797411c27f97d2a3bcf76a2b33e7c7bd4c43722429c76a79293908a6bbdc5f43d0ead96741e954109210c86737647ebc51e3a3bb8e44d54d8d76b7c07e57261b0c2e9d0c221140ebd561d7d5accd42b44fcaeb0e1aeff3078cb47784d816a190b882e76efc9dfd69c735eaf137fdf7f144de2359837d0e126ee573d1a0e090af370b80bce35156576ea85e7828cd2ed158c0ab3186b49cd7424abc2efec8c29469aa5ed361dbfbfb1db73dd39ca9da23277e0b2f3ff3b683bc95b53ccc1639d926ab65c6d728b8c3cd7c5ac64c3ca438c311de6487f984aafde8c7f89c109d1b3862b6ff98611788662a2be828a9f4b60e0c2966af6eeaa62769cd2c62cd29252acba5abc395866d96dba1ea9b3b818e5bb01cdeab7f9fec19fc92f6ab1a9d692d620da9687fb54a8a7b2b862414ab26e99481e0fa1f47d537a4d5d1c5941fed5d6194c5d6fd1e9e7503cb54910bb967e0d1fee4b730370415874c2ebaad5eeb603bac85980dd5693a611bf135c3c808ee74dea480a668005a3de054fe8d1daecd704d855a65f118a3a21dc7867c99c384a19fcf08d8867d95d4e84c62d94ed2d6946938aee087e360ad0395390bb913b86689b06c378476a4f4ddd20b7c43d0f23bc4cbda0200cd7496ab8233074b3ef1cda6db6ebd590b0d244bef0db60851426dab137d7e6fe91667ba89f69277ae852f7d993a22edaa8e474a1c1bac32e2cfc2265bd79f49457d039376f8ac389a4c34b0df21104292948b030dd5e8f752ad3156072f018652da50ed8f0800cc2ab9750dcd42973d87608265d7c1dd255c8f389417ed5dfb891d5d075bb3c537b411832a6847d43c093851895d06411a32dc02a47e7c89d3e3fb8fa28016726a9b3ee26fc65cf286fe923317c7dd951798f3c7ec108de4c70a1122a527c96d396f92612bdbca3fb38e9f6b729c2ebc9795f211bdc1e059b45bdf7daa8509a59d9eadb1927418a1e804a7d831ebbbea9c61a6afc5764e69914bbc9fe605c0037d88bf25954848e8247fa2e8684c72d3b6823a827a8a3cc504c7b35bac64ac2c875121fdaf31d81a55b223c296b942b936e158d3f2df75362dfb51cc1ae6b5e5df5a50caf1564f9e12f5db32306f9d32756f45b20b8807e9d4100eef514f4a8a21ca647ba5ee00b3bc744ba25979afa52bf49d7074a62e5a1f93b19c7a8e81b6833358b89f3376c80412e2da896a18dcfa528fc73efe0dce41c2d4ea4c149887df75f2e8e15fee1c75fdd09e865d9ab3db880d4c8bc836024d0169cdc94bec78cbf12d75a8e63fd5c9feaee6f47abbd95a96d1373702d8d8de28926ab01397d8148877f10664f2176dd9e32b9c553258910dda4a473a81fe1b1275b3c977bf73f37ad67554462ca669fb89acf4e492eda23af8fcaaffbe49f0d811b0bfeec90ca74b23ca518352b3429a9c9b981f4dfb0f6de59b265e12500dc65f3767cfb4fbdcff47d2846f0709bcd2e02f9e2662f9c6c1961586cb68405b878c76c47376e861772cfc8d7a4550e4e1444ace5ef542eb74281f9f236c609cd2ebf62c500c2753a1240b19aed90c04addafba8963ab4a942f57f0476c2c01d7116765172065177369740a6600e5050d65dd7e8220d8fda7cb758f00051747f405ebe1d8e5e56ee950d1b09ce5f7399ad93dfa58b1911c55b39c19d96342b6ed74bb642a84ff39d7c2a0b9f7ee704d2068a1bc7c664b21ae08b2c7f72fec60b695995abb2c79cf3dfe03a10942d18ecad459d8b970cc70cf732b295e23ae3b08b1e3ec4be41dc5d44ac24c8752f61c89033844cdeab60a2a96cd19c31dd171f12084720a1c4db99bd2f880f4efffa64a59e912323ba415d739f0d48d2c8a8456972c6356e29d08275e72b6ddfa38cbffe7fe4c347472d6a9bf9a776ca4f4a18a84ce0bf7a8b8c941d61d751673db212b09572af7f193308ac7526ea8ed4f7076669f5e26e8c0a1efa1de6c54404e5b5f8b346d5eeb48bb0cce892c8ae49e2606fb5af1722bc2f4a4ef85d36f0b41de8baf2a827cd337a5b7c0571b128287f074b3a0e5e2731ac552e03d8f5046e383e41b1c5205b853a462d3358f9ad4d28d7a6e0d620504e34381dc96c7c5d9f64c3dbf7dfe33666a325011c7c0246a66a1a567b0ed9781fd8c83a7ceba8c5b804d25f7212a98097ac633e7bd337914e0d8a6b0af397e4b6bfe92aaa63368e493ae0f23da4ac530a55d973f776b2913d0b1cda696808d2a7bdcc33f8e35365893"], 0x1c}, 0x1, 0x0, 0x0, 0x1}, 0x0) sendmsg$sock(r0, &(0x7f0000000200)={&(0x7f0000000580)=@can, 0x80, 0x0, 0x0, &(0x7f00000001c0)=[@txtime={{0x18, 0x1, 0x3d, 0x1}}, @mark={{0x14, 0x1, 0x24, 0xffffffff}}], 0x30}, 0x4000800) setsockopt$IP_VS_SO_SET_FLUSH(r3, 0x0, 0x485, 0x0, 0x0) r4 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x109001, 0x0) ppoll(&(0x7f0000000180), 0x1f, &(0x7f0000000040)={0x0, 0x3938700}, &(0x7f0000000180)={[0x9da6]}, 0x8) ioctl$TUNSETIFF(r4, 0x400454ca, &(0x7f0000000000)={'\x00', 0x5}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$inet(r6, &(0x7f0000001b00)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001d80)=ANY=[@ANYBLOB="28010000000000000100000001"], 0x128}, 0x0) recvmsg$unix(r5, 0x0, 0x0) socketpair$unix(0x1, 0x2, 0x0, 0x0) writev(0xffffffffffffffff, 0x0, 0x0) bpf$PROG_LOAD_XDP(0x5, 0x0, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f0000001b00)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001d80)=ANY=[], 0x128}, 0x0) recvmsg$unix(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000080), 0x100}, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$inet(r8, &(0x7f0000001b00)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001d80)=ANY=[], 0x128}, 0x0) recvmsg$unix(r7, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x0, &(0x7f00000002c0), 0x100}, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff}) recvmsg(r9, &(0x7f00000005c0)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001dc0)=""/4096, 0x1000}, 0x0) ioctl$TUNGETDEVNETNS(r4, 0x54e3, 0x0) socket$nl_generic(0x10, 0x3, 0x10) 3.170022345s ago: executing program 1 (id=6383): r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)=@base={0x1, 0x4, 0x4, 0x2, 0x0, 0xffffffffffffffff, 0x2}, 0x50) close(0x3) bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=@base={0xe, 0x4, 0x8, 0x8}, 0x50) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0x14, &(0x7f0000000280)=ANY=[@ANYBLOB="180000000000000000000000000000001801000020646c2100000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000001000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x14, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$PROG_BIND_MAP(0xa, &(0x7f0000000080)={r1}, 0xc) ioctl$XFS_IOC_PATH_TO_HANDLE(0xffffffffffffffff, 0xc0385869, &(0x7f0000000600)={r1, &(0x7f0000000500)='syztnl2\x00', 0x10000, &(0x7f0000000540)={@align=0xd038, {0x7fff, 0x5, 0x8000, 0x800}}, 0x401, &(0x7f0000000580)={@_ha_fsid}, &(0x7f00000005c0)=0x8}) sendmsg$nl_generic(r2, 0x0, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) r4 = socket$inet6_udp(0xa, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000040)={'lo\x00', 0x0}) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(r4, 0x89f2, &(0x7f0000000140)={'syztnl2\x00', &(0x7f00000000c0)={'ip6_vti0\x00', r5, 0x2f, 0xff, 0x91, 0x6, 0x0, @loopback, @dev={0xfe, 0x80, '\x00', 0x1c}, 0x8000, 0x40, 0x6, 0x10002}}) sendmsg$nl_route(r3, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000080)=@ipv4_newroute={0x34, 0x1a, 0x200, 0x70bd24, 0x25dfdffd, {0x2, 0x80, 0x20, 0x0, 0xfc, 0x0, 0x0, 0x7}, [@RTA_IIF={0x8, 0x3, r6}, @RTA_DST={0x8, 0x1, @multicast1}, @RTA_SRC={0x8, 0x2, @rand_addr=0x64010102}]}, 0x34}, 0x1, 0x0, 0x0, 0x8000}, 0xea5bc50b6199d77e) socket$nl_generic(0x10, 0x3, 0x10) r7 = socket$inet6(0xa, 0x2, 0x0) sendmsg$inet6(r7, &(0x7f0000000340)={&(0x7f00000001c0)={0xa, 0x4e20, 0x80000, @dev={0xfe, 0x80, '\x00', 0x44}, 0x5}, 0x1c, 0x0, 0x0, &(0x7f0000000940)=[@flowinfo={{0x10, 0x29, 0x3b, 0xffff0000}}], 0x10}, 0xc4) syz_genetlink_get_family_id$ethtool(&(0x7f0000000040), 0xffffffffffffffff) r8 = bpf$MAP_CREATE(0x0, &(0x7f0000000440)=ANY=[@ANYBLOB="0e000000040000000800000001"], 0x50) pipe(&(0x7f0000000140)={0xffffffffffffffff}) epoll_ctl$EPOLL_CTL_DEL(r9, 0x2, r8) sendmsg$RDMA_NLDEV_CMD_RES_PD_GET(r9, &(0x7f00000004c0)={&(0x7f0000000400)={0x10, 0x0, 0x0, 0x80000800}, 0xc, &(0x7f0000000480)={&(0x7f0000000440)={0x20, 0x140e, 0x4, 0x70bd29, 0x25dfdbff, "", [@RDMA_NLDEV_ATTR_PORT_INDEX={0x8}, @RDMA_NLDEV_ATTR_RES_PDN={0x8, 0x3c, 0x4}]}, 0x20}, 0x1, 0x0, 0x0, 0x41}, 0x8000) r10 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r10, 0x8933, &(0x7f0000000040)={'lo\x00', 0x0}) recvmmsg(0xffffffffffffffff, 0x0, 0x0, 0x2000, 0x0) getsockopt$inet6_IPV6_IPSEC_POLICY(r4, 0x29, 0x22, &(0x7f00000001c0)={{{@in6=@mcast1, @in=@private, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@dev}, 0x0, @in6=@private0}}, &(0x7f00000002c0)=0xe8) r13 = socket$inet6_sctp(0xa, 0x5, 0x84) r14 = socket$inet6_sctp(0xa, 0x1, 0x84) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r14, 0x84, 0x6f, &(0x7f0000000280)={0x0, 0x10, &(0x7f0000000000)=[@in={0x2, 0x4e21, @initdev={0xac, 0x1e, 0x0, 0x0}}]}, &(0x7f00000002c0)=0x10) getsockopt$inet_sctp6_SCTP_MAX_BURST(r14, 0x84, 0x83, &(0x7f0000000000)=@assoc_value={0x0}, &(0x7f00000004c0)=0x8) getsockopt$inet_sctp6_SCTP_PR_ASSOC_STATUS(r13, 0x84, 0x74, &(0x7f0000000340)={r15, 0x4, 0x20, 0x3}, &(0x7f0000000300)=0x18) setsockopt$inet_IP_XFRM_POLICY(r10, 0x0, 0x11, &(0x7f0000000300)={{{@in6=@empty, @in=@dev={0xac, 0x14, 0x14, 0x9}, 0x4e20, 0xe, 0x4e23, 0x3, 0x2, 0x0, 0x20, 0x87, r11, r12}, {0x9, 0x8, 0x25c00, 0xe, 0xaa1, 0x7, 0x4, 0x3}, {0xfffffffffffffff7, 0x9, 0xfffffffffffffffb, 0x1}, 0x669, 0x6e6bbd, 0x0, 0x1, 0x2, 0x1}, {{@in=@private=0xa010101, 0x4d5, 0x33}, 0x2, @in=@multicast2, 0x3506, 0x2, 0x3, 0x31, 0x7, 0x2, 0x1}}, 0xe8) 3.053248794s ago: executing program 0 (id=6385): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x2}) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) close(r1) r2 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000740)=@newqdisc={0xa4, 0x24, 0x4ee4e6a52ff56541, 0x70bd2d, 0x25dfdbfd, {0x0, 0x0, 0x0, r3, {0x0, 0xb}, {0xffff, 0xffff}, {0xfff2, 0x1}}, [@qdisc_kind_options=@q_netem={{0x8}, {0x74, 0x2, {{0x3, 0x3, 0x6361, 0x5, 0xffffffff, 0x3}, [@TCA_NETEM_RATE={0x14, 0x6, {0x5, 0x4b7, 0x6, 0x1}}, @TCA_NETEM_RATE={0x14, 0x6, {0xd8fc, 0x7ff, 0x8001, 0x2}}, @TCA_NETEM_LOSS={0x30, 0x5, 0x0, 0x1, [@NETEM_LOSS_GI={0x18, 0x1, {0xffffffff, 0x2, 0x4, 0x8, 0x66eb50de}}, @NETEM_LOSS_GE={0x14, 0x2, {0xfffffffa, 0xd, 0xbff, 0x80000000}}]}]}}}]}, 0xa4}, 0x1, 0x0, 0x0, 0x40088c1}, 0x0) sendmsg$nl_route_sched(r2, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f00000006c0)=@newqdisc={0x48, 0x24, 0x4ee4e6a52ff56541, 0x70b926, 0x25dfdc01, {0x0, 0x0, 0x0, r3, {0x0, 0xd}, {0xffff, 0xb}, {0xffff, 0xffe0}}, [@qdisc_kind_options=@q_fq_codel={{0xd}, {0x14, 0x2, [@TCA_FQ_CODEL_CE_THRESHOLD={0x8, 0x7, 0xfffffff9}, @TCA_FQ_CODEL_CE_THRESHOLD_MASK={0x5, 0xb, 0x11}]}}]}, 0x48}, 0x1, 0x0, 0x0, 0x240040e0}, 0x4890) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) r4 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) r6 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$IPT_SO_SET_REPLACE(r6, 0x0, 0x40, &(0x7f0000000000)=@nat={'nat\x00', 0x670, 0x5, 0x460, 0x0, 0x240, 0xffffffff, 0x1a0, 0x0, 0x3c8, 0x3c8, 0xffffffff, 0x3c8, 0x3c8, 0x5, 0x0, {[{{@ip={@rand_addr=0x64010100, @local, 0xff0000ff, 0xffffff00, 'veth1_to_bridge\x00', 'veth0_macvtap\x00', {}, {0xff}, 0x16}, 0x0, 0x168, 0x1a0, 0x48, {}, [@common=@unspec=@string={{0xc0}, {0x7, 0xc, 'kmp\x00', "4801d3e4c6b2bfd892aa7400051624fa86999b13d39b99407a9b7abe75a728baa18da576811985de44110b8602025e1298ea55f1c5087ab16f67b18ca90ac68f0b3d6a068f727f7d23fa5fad26a59a5da2651212bdf9d29248ae63e2349b2470915eea2c39ade5129ff26b6fe772493180cfda2cdd49412e9469d85abdb467ba", 0x76, 0x2, {0x1}}}, @common=@unspec=@devgroup={{0x38}, {0x3, 0x0, 0x3, 0x3, 0x81}}]}, @DNAT0={0x38, 'DNAT\x00', 0x0, {0xae, {0xf, @remote, @initdev={0xac, 0x1e, 0x0, 0x0}, @icmp_id=0x65, @port=0x4e24}}}}, {{@uncond, 0x0, 0x70, 0xa0}, @common=@inet=@SET2={0x30, 'SET\x00', 0x2, {{0xfffc, 0xd, 0x1}, {0x2, 0x4, 0x3}, 0x1000, 0x100}}}, {{@ip={@multicast2, @broadcast, 0xff, 0x0, 'virt_wifi0\x00', 'veth1_to_bridge\x00', {}, {}, 0x0, 0x0, 0x4e}, 0x0, 0x70, 0xb8}, @unspec=@SNAT1={0x48, 'SNAT\x00', 0x1, {0x0, @ipv4=@rand_addr=0x64010102, @ipv4=@private=0xa010101, @icmp_id=0x68, @icmp_id=0x64}}}, {{@ip={@loopback, @remote, 0xff, 0x0, 'batadv_slave_1\x00', 'ip_vti0\x00', {}, {0xff}, 0x6, 0x1, 0x5}, 0x0, 0x98, 0xd0, 0x0, {}, [@common=@icmp={{0x28}, {0x4, '\\Q', 0x1}}]}, @DNAT0={0x38, 'DNAT\x00', 0x0, {0x1, {0x10, @local, @dev={0xac, 0x14, 0x14, 0x2a}, @port=0x4e22, @gre_key=0x5}}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x4c0) ioctl$BTRFS_IOC_SEND(r6, 0x40489426, &(0x7f0000000500)={{r6}, 0x2, &(0x7f00000004c0)=[0xfff, 0xfffffffffffffff9], 0x5, 0xc}) r7 = socket$packet(0x11, 0x3, 0x300) sendto$packet(r7, &(0x7f0000000240)="800000800000210ee7decd7a0003", 0x36, 0x40, &(0x7f00000001c0)={0x11, 0x8100, r5, 0x1, 0xd8, 0x6, @broadcast}, 0x14) unshare(0x24020400) r8 = socket$inet_sctp(0x2, 0x1, 0x84) setsockopt$IP_VS_SO_SET_ADDDEST(r8, 0x0, 0x480, 0x0, 0x0) r9 = socket(0x10, 0x803, 0x0) ioctl$sock_SIOCETHTOOL(r9, 0x8946, &(0x7f00000002c0)={'veth0_to_team\x00', &(0x7f0000000000)=@ethtool_channels={0x3d, 0x0, 0x0, 0x0, 0x0, 0x1, 0x2}}) 3.000626704s ago: executing program 4 (id=6386): r0 = bpf$PROG_LOAD(0x5, &(0x7f0000000600)={0x20, 0x3, &(0x7f00000002c0)=ANY=[@ANYBLOB="1800000000000000000000000000000095"], &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @netfilter=0x2d, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x99ee}, 0x94) bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f0000000500)={r0, 0x0, 0x2d, 0x0, @val=@netfilter={0xa, 0x0, 0x80000000}}, 0x20) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000200)={'vcan0\x00', 0xc201}) socket$kcm(0x2, 0xa, 0x2) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$inet(r3, &(0x7f0000001b00)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001d80)=ANY=[@ANYBLOB="28010000000000000100000001"], 0x128}, 0x0) recvmsg$unix(r2, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x0, &(0x7f00000000c0), 0x100}, 0x0) r4 = bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000380)={&(0x7f0000000080)=ANY=[@ANYBLOB="9feb010018000000000000001c0000001c00000003000000010000000000000e0200000000000000000000000000000504000000002e"], 0x0, 0x37, 0x0, 0x1}, 0x28) bpf$PROG_LOAD(0x5, &(0x7f000000d000)={0xa, 0x3, &(0x7f0000008000)=@framed={{0xffffff85, 0x0, 0x0, 0x0, 0x0, 0x7}}, &(0x7f0000000040)='GPL\x00', 0x2, 0x1000, &(0x7f0000014000)=""/4096, 0x0, 0x0, '\x00', 0x0, @fallback, r4, 0x14, &(0x7f00000000c0)={0x0, 0x11}, 0x1, 0x10, &(0x7f0000000000), 0xa, 0x0, 0xffffffffffffffff, 0x4c}, 0x70) r5 = socket(0x21, 0x3, 0xfffffffc) connect$inet6(r5, &(0x7f00000002c0)={0xa, 0x4e21, 0x50000000, @empty, 0x7}, 0x1c) r6 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) bpf$PROG_LOAD(0x5, &(0x7f00000017c0)={0x10, 0xe, &(0x7f0000000a80)=ANY=[@ANYBLOB="b70000008e000000bca31000000000002403000030feffff720af0ffa4ffffff91a4f0ff000000001f030000000000002e140200000000002604fdffa4ffffff14010000000300001d130000000000007a0a00fe0020001f0f14000000000000b503f7fff80000009500000000000000033bc065b78111c6dfa041b63af4a3912435f1a864a7aad58db6a693002e7f3be361917adef6ee1c8a2a4f8ef1e50becb150c537bf2085651d6dd6ce9bc461e91a7168e5181554a090f300020000fe275daf51efd601b6bf0134c8e8b1b526375ee4dd6fcd82e4fee5bef7af9aa0d7d600c095199fe3ff3128e599b0eaebbdbd732c9cc00eec363e4a8f6456e2cc21557c0afc646cb7798b3e6440c2fbdb00a3e35208b0bb0d2cd829e65440000000000000000028610643a98d9ec21ead2ed51b104d4d91af25b845b9f7d08d123deda88c658d42ecbf28bf7076c15b463bebc72f526dd70252e79166d858fcd0e06dd31af9612fa402d0b11008e59a5923906f88b53987ad1714e72ba7a54f0c33d39000d06a59ff61623604000000000000006a89adaf17b0a6041bdeebdfd1f5089048ddff6da40f9411fe7226a40409d6e37c4f46756d31cb467600ade70063e5291569b33d21dae356e1c51f03a801be8189679a16da18ec0ae564162a27afea62d84f3a10076443d643649393bf52d2105bd901128c7e0ec82701c8204a1deeed4136dc2869f478341d02d0f5ad94b081fcd507acb4b9c67382f13d000000225d85ae49cee383dc5049076b98fb6853ab39a21514da60d2ae20cfb91d6a49964757cdf538f9ce2bdbb9893a5de817101ab062cd54e67051d355d84ce97bb0c6b6a595e487a2cc47c0efbb2d71cde2c10f0bc6980fe78683ac5c0c31032599dd273863be9261eee52216d009f4c52048ef8c126aeef5f510a8f1aded94a129e4aec6e8d9ab06faffc3a15d91ff073e2e04cfe031b287539d0540059fe6c7fe7cd8697502c7596566d674e425da5e7f009602a9f61d3804b3e0a1053abdc31282dfb15eb6841bb64a1b3045024a982f3c48153baaa244e7bf573eac34b781337ad5905c6bbf1137548c7f1a4cad2422ee965a38f7defbd2960242b104e20dc2d9b0c35608d402ccdd9069bd50b994fda7a9de44022a579dfc0229cc0dc98816106dec28eaeb883418f562ae00003ea96d10f172c0374d6eed826416050000000bfe9b4a9c5a90ff59d54d1f92ecc48899b212c55318294270a1ad10c80fef7c24d47afcc829ba0f85da6d888f18ea40ab959f6074ab2a40d85d1501783a7ab51380d7b4ead35a385e0b4a26b7025488316241f64c851a7fe7396df7e0c1e02b88c114f244a9bf93f04bf072f0861f5c0b000000000000eedcf2ba1a9508f9d6aba582a896a9f1ffa968eacea75caf822a7a63ba3401e6a52acb11883ad2a3b1832371fe5bc621426d1ed01b389708165b9cdbae2ed9dc7358f0ebadde0b727f27feeb7464dcd857ab15e355713767c536cbae2f5c7d951680f6f2f9a6a8346962a350845ffa0d82884f79adc287906943408e6df3c391e97ba48db0a5adbfd03aac93df8866fb010ae20e92bed1fe39af169d2a466f0db6f3d9436a7d55fc30511d00000000c95265b2bd83d64a532869d701723fedcbada1ee7baa19faf67256b56a41fd355b6a686b50f0937f778af083e055f6138a757ebd0ed91124a6b244f9acf41ac5d73a008364e0606a594817031fc2f52c8785fe0721719b3d654026c6ea08b83b123145ab5703dad844ced301efeb6dc5f6a9037d2283c42efc54fa84323afc4c10eff462c8843187f1dd48ef0900000000000000ff0f40b1888e1cdba94a6ea80c33ead5722c3293a493f1479531dd88261458f40d31fe8df15efaaeea831555877f9538c6ee6ba65893ff1f908ba7554ba583ec7932f5954f31a878e2fae6691d1aee1da02ba516467df3e7d1daac43738612e4fee18a22da19fc08001011e32f808890205f3a6da2819d2f9e77c7c64affa54fec0136cbafa5f62e3f753b639a924599c1f69219927ea5301fff0a6063d427180d61542c2571f983e96635600000554f327a3535e7c7542799493c31ac05a7b57f03ca91a01ba2a30c1675767999d146aef7799738b292fd64bb25b2969e2b15f36b788bce5ccdbaf75c94cb93499f6947a967a794963342aece449a0d80010fcdb9913823333a70c2a4ab000000000000003f8dafc7ac96d404607a0000000051a2104f22e6db5a62b5089c1b45282d38864daa3ae81d6b0968d1d2867b91b7d12096833d6864da40b54783a17aaeb6737c323f9f98e354cc090000000000000061563e69ffe1c2c73e1661261173f359e93d2c5e424c17998809ec8f0232b3955e052a4cecd89008f70314a0bdd491ecab5d232f89fe0120f64c62e8e3ed8bcb45202c204bbec8d722824c0ebca8db1ea4a05e41f6016ab5bbe4fe7ff5d785d0128171c90d9901010000b0f9d01c4b45294fbba468df3e1b393cb4e62e753b4172ba435926b61c94bc5d047899fd219f448bf9189c65c9d91eda6b52a373803a9efe44f86909bc90addb7b9aee813df534aac4b3093c91b8068cd849904568916694d461b76a58d88cf0f520310a1e9fdc18cde98d662eee077515d0aa81192292ffff5392ab3d1311b82432662806add87047f601fa888400000000000000000000000000006acc19808d7cf29bc974b0ea92499a41b9b9a7c2bca311a28ee4952f2d325a56397c78f12205db653a536f0100e0eda300a43a13bd1b9f3322405d1efd78e5789c6b3fb84f3738a4b6caa800000087efa51c5d95ecba4e50e529d1e8c89600e809dc3d0a2f65579e23457949a50f2d0455cf79a43746979f99f6a1527f004f1e37a3926937e84fb478199dc1020f4beb98b8074bf7df8b5e783637da740800000000000000c55a4385e9a617aa6c8e10d4202c5afeb06eef98aee88ea12f92d7ae633d44086b3f03b20d546fa66a72e38207c9d20035abc46271a30f1240de52536941242d23896ab74a3c6670fdc49c14f34fc4eadd6db8d80eba439772bf60a1db18c472dafc5569adc282928d2a1ffe29f1a57d3f18f4edaeb5d37918e6fddcd821da67a0785585a4443440dc65600e64a6a274000000000000000000000000000000000000000000000009dd14b38f2f4426d7cf5075047c31f6ce6adddfe3ac649c0643c8bfbeb14ba1fd7a485aa893915cf81e29aaf375e904bbe52691a4100260ffcd8f1d04166d291ebcef893e1b9ccb6797d0646fe0e7274434f28efb43e06ee0ff698caca42f4e6018a455736c482a017e2b13dac4a90faa109f0e87cc94e3efb649692456463ca74aa6ad4bf50c1acb3928143be1c1023a375e528285544d0064b98646f3109e9a4942ce42c6e7ec84b664f6c2770803f10baa804a707f0a1fcbfc309381aeba191950bae71f37f1eb7ceeffb3c0547ac6571603adbfde4c8b5f8d7f4b854441613633b48865b65bdc415e1e0dcf672d68cf4cebf04f4bc1eebf560a26d34d3757b1450fdb0a9a69f432e277f3a0386eb2bd3305c821c64757f786b79fef54dbe64c67d73934bc80b2133fb3c04cc7ea48bf97a6243c9f95dcbddecf45f008f1822c7868e1ff5a3cff5d6b6898335792749df7b1f51e913ac1c3b1b93b33aaa3fab69cef08a9f6f6cf39dea3d878b2ed42545421970cc426e644332bc956d1c6adefdf0ede2c5c94aa632646ae225accdf031f611d01622921f1b922a5ac887cca3136133dce8d9f5f4da7bed2ea5d94362200000000000000000000f296b0c1484e5f781ad26bff696b05ff0a5e2270e07618b04273bd4075ea38ab463bfa6a38e7c537498ba3e4df8dfc9e040000003c3ffad44d2a376def42e41e9fc31678257e040fa7cf32c221aaac08000000000000001a00000000000000000000173570f0c11ae694b0f7a4f9c2f6790044a357e785af6e153d5f1ea460af92c7cbbd6295afe740f5e154346d483e0d641ef02e495295d756e110522a7a945b93fb705b95b6aae27a8fb33732ce1da1c0b1af8eb9222a06e984ab1e6984c8bdc12360627137ab67b6b68ab08acb29a74dc36b51209cfbc87f61182bbeb2772e9d5a1ffc477179be481efe46a4ce86be0b1d8eee42a611a3d44ca450b14586ed63dd92005c79e4a8ab8a94f0c6cb4bed8594a39bd76d3ef8a7ab014e787596db796bd93a36c2880423291e3bccc86f66ba792ff4d87b3f80e5908779e51c5e9055fc5b23605cd000c723187ef09dcf4b07b06a9342f3f62ee7acddff292082c1f4d8eb9561f80873a09a1ae0c9af1121175e5600f43a1179484502009759264a5729f07c2b218fa36ba2316a99aaad0130df83d0bda1e711290f78c143ea143967b00adcd77e6ad5e48d839ea61aadb83e4d071c54691924a3830d3e7b5c198bb0ed623153590000060000000000004b985ea1702f34f2f85b168c083e810ed567e3f1979b9ed1a4bf6a10dac825c96a0828b335de445a4880bb6474157efd1a72ca46ae4cbe3ab648c9bc4867a5a4cb87d7d6d55475b34b3cb6aa9e2337d4e04a37e35109752522ac9b186ddd80c47da6a2f4ef7bb909c97552606ffff97e86dc995604346262a177b06c634969a31b5717c416f8224662f4dd46d6081cb96dd6"], &(0x7f00000001c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sk_msg, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0xffffffffffffff97, 0x10, &(0x7f00000000c0), 0xfffffffffffffd00}, 0x48) sendmsg$NL80211_CMD_GET_SCAN(r5, &(0x7f0000000140)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x800}, 0xc, &(0x7f0000000100)={&(0x7f00000000c0)={0x14, r6, 0x20, 0x70bd2c, 0x25dfdbfd, {{}, {@void, @void}}, ["", "", "", "", "", ""]}, 0x14}, 0x1, 0x0, 0x0, 0x20000000}, 0x810) r7 = socket$nl_generic(0x10, 0x3, 0x10) r8 = syz_genetlink_get_family_id$fou(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$FOU_CMD_ADD(r7, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000400)={0x38, r8, 0x209, 0x106, 0x25dfdbfe, {}, [@FOU_ATTR_AF={0x5, 0x2, 0xa}, @FOU_ATTR_LOCAL_V6={0x14, 0x7, @loopback={0xff00000000000000}}, @FOU_ATTR_TYPE={0x5, 0x4, 0x1}]}, 0x38}, 0x1, 0x0, 0x0, 0x40000}, 0x0) 2.659809023s ago: executing program 4 (id=6389): bpf$MAP_CREATE(0x0, &(0x7f0000000880)=ANY=[@ANYBLOB="1b00000000000000000000000080"], 0x48) bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="0e000000040000000800000008"], 0x50) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000440)={0xffffffffffffffff, 0x21, 0xf89, 0x0, &(0x7f0000000540)="39bdeac368e4c4e87a7bfd439b9f4793bcb64f217eb9435d6b4e435770512f9a534ba988586c565c33b12ddb4c357728b463ae54ffa88f65c5bc96051eb279632efcc45cc6c9e2dc521020f9357b64ce3879ce30e3", 0x0, 0x0, 0x0, 0x0, 0x62, 0x0, 0x0, 0x6, 0x9, 0xffffffff}, 0x28) 2.592960806s ago: executing program 0 (id=6391): r0 = socket$nl_xfrm(0x10, 0x3, 0x6) r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000023c0)={&(0x7f0000000400)=ANY=[@ANYBLOB="200000003e00090b000000000008000003"], 0x20}}, 0x0) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) r3 = socket$alg(0x26, 0x5, 0x0) bind$alg(r3, &(0x7f0000000380)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc-cast5-avx\x00'}, 0x58) setsockopt$ALG_SET_KEY(r3, 0x117, 0x1, &(0x7f0000000140)="2c385aa3d4", 0x5) r4 = accept4(r3, 0x0, 0x0, 0x0) sendmsg$nl_route_sched_retired(r4, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f00000009c0)=@deltclass={0x24, 0x29, 0x300, 0x70bd29, 0x25dfdbff, {0x0, 0x0, 0x0, 0x0, {0x10, 0xffff}, {0x6, 0xf}, {0xe, 0xd}}}, 0x62}}, 0x0) recvmmsg(r4, &(0x7f0000000c40)=[{{0x0, 0x0, &(0x7f0000000480)=[{&(0x7f0000000100)=""/1, 0x1}, {&(0x7f00000001c0)=""/64, 0x40}], 0x2}, 0x8}], 0x1, 0x2, 0x0) sendmsg$NFT_MSG_GETCHAIN(r4, &(0x7f0000000740)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f0000000700)={&(0x7f0000000680)=ANY=[@ANYBLOB="7c000000040a000000000000000000000000000108000540ffffffff08000a40000000b05a5711010900030073797a3200000000440004800800014000000000140003006e657464657673696d300000000000001400030067726530000000000000000000000000080002403abf95c3080002402fcc699308000a40"], 0x7c}, 0x1, 0x0, 0x0, 0x20000080}, 0x1) setsockopt$inet6_tcp_int(r2, 0x6, 0x13, &(0x7f0000000000)=0x100000001, 0x4) r5 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$TUNSETIFF(r5, 0x400454ca, &(0x7f00000000c0)={'syzkaller0\x00', 0x84aebfbd6349b7f2}) r6 = socket(0x10, 0x803, 0x0) ioctl$sock_SIOCGIFINDEX(r6, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r6, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000a40)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70bd28, 0xffffffff, {0x0, 0x0, 0x0, r7, {0x0, 0x9}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_fq_codel={{0xd}, {0x4}}]}, 0x38}}, 0x0) sendmsg$nl_route_sched(r6, &(0x7f0000006040)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000001400)=@newtfilter={0x40, 0x2c, 0xd27, 0x70bd25, 0x0, {0x0, 0x0, 0x0, r7, {0x4, 0x4}, {}, {0x1, 0xf}}, [@filter_kind_options=@f_fw={{0x7}, {0x14, 0x2, [@TCA_FW_MASK={0x8, 0x5, 0x7}, @TCA_FW_MASK={0x4, 0x5, 0x4}]}}]}, 0x40}}, 0x20040054) connect$inet6(r2, &(0x7f0000000200)={0xa, 0x0, 0x0, @loopback}, 0x1c) setsockopt$inet6_tcp_TCP_ULP(r2, 0x6, 0x1f, &(0x7f00000000c0), 0x4) setsockopt$inet6_tcp_TLS_TX(r2, 0x11a, 0x1, &(0x7f0000000540)=@gcm_128={{0x303}, "ffffffffffffffe2", "8e083700daf38a6d69e9b5e9c2f133d7", "6a3a05b9", "12772541f8eb02bb"}, 0x28) sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000c80)=@updsa={0x2fc, 0x1a, 0x20, 0x70bd2b, 0x25dfdbfe, {{@in6=@ipv4={'\x00', '\xff\xff', @remote}, @in=@broadcast, 0x4e22, 0x8, 0x4e24, 0x4, 0x2, 0x0, 0x80, 0xff, r7}, {@in6=@mcast2, 0x4d5, 0x32}, @in6=@empty, {0x5, 0x7, 0xfffffffffffffff9, 0x3, 0xdb, 0x3, 0x1, 0x1}, {0x8, 0x10001, 0x4, 0x639fb97d}, {0x8, 0x0, 0x5e}, 0x70bd2a, 0x3504, 0xa, 0x0, 0x8, 0x2}, [@policy={0xac, 0x7, {{@in6=@private1={0xfc, 0x1, '\x00', 0x1}, @in6=@ipv4={'\x00', '\xff\xff', @rand_addr=0x64010102}, 0x4e20, 0x2, 0x4e22, 0x73d, 0x0, 0x20, 0x20, 0x16, r7}, {0x2, 0x272, 0xff, 0xc, 0xffffffff80000001, 0x4, 0xfffffffffffffc01, 0x1}, {0x3, 0x2, 0xffffffffffff8001, 0xc}, 0x4, 0x0, 0x2, 0x1, 0x26d79b9ea8c292e7, 0x2}}, @policy={0xac, 0x7, {{@in=@remote, @in=@loopback, 0x4e20, 0x7, 0x4e24, 0x0, 0xa, 0x0, 0x88f476323b554f1b, 0xc}, {0x1, 0x6, 0x7, 0x401, 0x8, 0x9, 0x6, 0xfffffffffffffff9}, {0xffffffffffffffff, 0xfffffffffffffffe, 0x0, 0xffffffff}, 0x0, 0x6e6bb0, 0x1, 0x0, 0x3}}, @mark={0xc, 0x15, {0x35075c, 0x74e11983}}, @replay_esn_val={0x40, 0x17, {0x9, 0x70bd28, 0x70bd2d, 0x70bd28, 0x70bd2b, 0x5, [0x7fff, 0x2aef, 0x4, 0x6, 0xdc, 0x5, 0x9, 0x3, 0x1]}}, @encap={0x1c, 0x4, {0xfffffffffffffffd, 0x3, 0x4e23, @in6=@empty}}, @srcaddr={0x14, 0xd, @in6=@initdev={0xfe, 0x88, '\x00', 0x0, 0x0}}, @mark={0xc, 0x15, {0x35075b, 0x4}}, @extra_flags={0x8, 0x18, 0x5}, @replay_esn_val={0x24, 0x17, {0x2, 0x70bd2c, 0x70bd2c, 0x70bd26, 0x70bd2d, 0x4, [0x1, 0x100]}}]}, 0x2fc}}, 0x0) r8 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='freezer.state\x00', 0x275a, 0x0) write$cgroup_int(r8, &(0x7f0000000000), 0xffffff6a) setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r2, 0x6, 0x14, &(0x7f0000000040)=0x1, 0x4) syz_emit_ethernet(0xce, &(0x7f0000000580)=ANY=[@ANYBLOB="bbbbbbbbbbbb00000000000008004f1e00c00064000009029078ac1414aae0000001830452b889172ee0000002ac1e00017f000001e0000001ac1414aa01441c40e10000000003ffe000000100000008ff0000010000007c8307e700000000441c2e017f00000100000001640101010000012c0a010102000000ff070b51e0000001640101010000110b9078e00000019e7af35f080fb2cbc9535365e7d08edd8de0fc9d02fb2bcb53b7e74458360a323c93a8ada4b61105656f96f42bfd32b9802400a49b26e093974f14cc0000"], 0x0) sendfile(r2, r0, 0x0, 0xffffffff004) r9 = bpf$MAP_CREATE(0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="22000000040000001000000012"], 0x48) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000180)={{r9}, &(0x7f0000000080), &(0x7f00000001c0)=r9}, 0x20) bpf$BPF_MAP_CONST_STR_FREEZE(0x16, 0x0, 0x0) 2.490740294s ago: executing program 4 (id=6393): ioctl$F2FS_IOC_MOVE_RANGE(0xffffffffffffffff, 0xc020f509, &(0x7f0000000100)={0xffffffffffffffff, 0x5, 0x389c, 0x7}) r0 = bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0x16, 0x4, &(0x7f0000000040)=ANY=[@ANYBLOB="b400000000000000791090000000000007000000002000209500000000000000"], &(0x7f0000003ff6)='GPL\x00', 0x5, 0x22, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @flow_dissector, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x3f}, 0x48) r1 = socket$netlink(0x10, 0x3, 0x10) r2 = socket$netlink(0x10, 0x3, 0x15) bind$netlink(r2, &(0x7f0000514ff4)={0x10, 0x0, 0x0, 0x2ffffffff}, 0xc) sendmsg$nl_route_sched(0xffffffffffffffff, 0x0, 0x0) setsockopt$sock_int(r2, 0x1, 0x8, &(0x7f0000000000)=0x80, 0x4) setsockopt$netlink_NETLINK_BROADCAST_ERROR(r2, 0x10e, 0x4, &(0x7f0000000180)=0x10000ffc, 0x4) r3 = syz_genetlink_get_family_id$devlink(0x0, 0xffffffffffffffff) sendmsg$DEVLINK_CMD_RATE_NEW(r1, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000700)={&(0x7f0000000300)=ANY=[@ANYBLOB='4\x00\x00\x00', @ANYRES16=r3, @ANYBLOB="000000000000fbdbdf25250000000e0001006e657464657673696d0000000f00020200657464657673696d300000"], 0x34}, 0x1, 0x0, 0x0, 0x41}, 0x0) r4 = syz_init_net_socket$llc(0x1a, 0x1, 0x0) sendmsg$DEVLINK_CMD_SB_POOL_SET(0xffffffffffffffff, &(0x7f0000000940)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x20000}, 0xc, &(0x7f0000000900)={&(0x7f0000000740)={0x1c0, r3, 0x1, 0x70bd27, 0x25dfdbfb, {}, [{@pci={{0x8}, {0x11}}, {0x8, 0xb, 0x3}, {0x6, 0x11, 0x9}, {0x8, 0x13, 0xfffff69b}, {0x5, 0x14, 0x1}}, {@pci={{0x8}, {0x11}}, {0x8, 0xb, 0xfffeffff}, {0x6, 0x11, 0x8}, {0x8, 0x13, 0x80000001}, {0x5}}, {@pci={{0x8}, {0x11}}, {0x8, 0xb, 0x9}, {0x6, 0x11, 0x3}, {0x8, 0x13, 0xd4}, {0x5}}, {@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, {0x8, 0xb, 0x5}, {0x6, 0x11, 0x1}, {0x8, 0x13, 0x7}, {0x5}}, {@pci={{0x8}, {0x11}}, {0x8, 0xb, 0xff}, {0x6, 0x11, 0x6104}, {0x8, 0x13, 0x3}, {0x5}}, {@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, {0x8, 0xb, 0x2}, {0x6, 0x11, 0xa}, {0x8, 0x13, 0x4a}, {0x5}}, {@pci={{0x8}, {0x11}}, {0x8, 0xb, 0x1c}, {0x6, 0x11, 0x6}, {0x8, 0x13, 0x45}, {0x5, 0x14, 0x1}}]}, 0x1c0}, 0x1, 0x0, 0x0, 0x4040}, 0x80) connect$llc(r4, &(0x7f0000000180)={0x1a, 0x0, 0x0, 0x8, 0x0, 0x0, @multicast}, 0x10) bind$llc(r4, &(0x7f0000000000)={0x1a, 0x312, 0x5, 0xd, 0x3, 0x9, @broadcast}, 0x10) sendmmsg(r4, &(0x7f0000001380), 0x3fffffffffffeed, 0x0) syz_genetlink_get_family_id$nl80211(&(0x7f0000000140), r4) socket(0x11, 0x3, 0x0) r5 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r5, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000140)={0x1c, 0x2a, 0x107, 0xfffffffc, 0x0, {0x5, 0x7c}, [@typed={0x8, 0x1, 0x0, 0x0, @ipv4=@broadcast}]}, 0x1c}, 0x1, 0x0, 0x0, 0x488c4}, 0xc000) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={0x0, 0x48}}, 0x40000) syz_init_net_socket$llc(0x1a, 0x1, 0x0) ioctl$FICLONE(r2, 0x40049409, r0) r6 = socket$kcm(0x2, 0x200000000000001, 0x106) sendmsg$inet(r6, &(0x7f0000000000)={&(0x7f0000000140)={0x2, 0x4001, @empty}, 0x10, 0x0}, 0x30006041) bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0x6, 0x4, &(0x7f0000000340)=ANY=[@ANYBLOB="18020000040000000ad29ac17ec40c22aaa151aa34d678000000000000000085000000410000009500000000000000b054ddc7e7ce4fcb6c352dd83cb669ee71a8d4022e8093371917d000008d2cb7385bf342696c09285ddc6987c478b709aebf416dcd"], &(0x7f00000001c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x40, '\x00', 0x0, @xdp, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r7 = socket$inet6(0xa, 0x80002, 0x0) setsockopt$SO_ATTACH_FILTER(r7, 0x1, 0x33, &(0x7f0000000000)={0x1, &(0x7f0000000140)=[{0x6, 0x0, 0x1}]}, 0x10) 2.234682152s ago: executing program 1 (id=6395): bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="1b0000000000000000000000000004000000", @ANYRES32=0x0, @ANYBLOB="00000000000000008d46284f68c700000000000099ed0e7e3f7e7806f509f5e4297397d05a4db18368"], 0x48) r0 = bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000480)={0x6, 0x3, &(0x7f00000000c0)=ANY=[@ANYBLOB="1800000002000000000000000008082295"], &(0x7f00000002c0)='GPL\x00'}, 0x80) write$cgroup_subtree(0xffffffffffffffff, &(0x7f0000000000)=ANY=[@ANYBLOB="8fedcb010789005e107538e486dd6317ce22000000fffe80000000000000101000007f0600080000000000000071273fa7b49301641184a907"], 0xfdef) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000600)={r0, 0x5, 0xb68, 0x739, &(0x7f0000000000)="ff", 0x0, 0x149c, 0x503, 0x0, 0x0, 0x0, 0x0, 0x2, 0xffff80fe}, 0x48) (fail_nth: 11) 2.008031388s ago: executing program 1 (id=6397): r0 = syz_genetlink_get_family_id$nbd(&(0x7f0000000100), 0xffffffffffffffff) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NBD_CMD_RECONFIGURE(r1, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000140)=ANY=[@ANYBLOB='8\x00\x00\x00', @ANYRES16=r0, @ANYBLOB="810902000000000000000300000008000100000000001c0007800c000180080001"], 0x38}, 0x1, 0x0, 0x0, 0x2008810}, 0x48080) r2 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000040), r1) ioctl$sock_SIOCGIFINDEX_802154(r1, 0x8933, &(0x7f00000000c0)={'wpan1\x00', 0x0}) sendmsg$IEEE802154_LLSEC_ADD_KEY(r1, &(0x7f0000000240)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f0000000200)={&(0x7f0000000180)={0x4c, r2, 0x800, 0x70bd2a, 0x25dfdbfc, {}, [@IEEE802154_ATTR_SHORT_ADDR={0x6, 0x4, 0xaaa1}, @IEEE802154_ATTR_LLSEC_KEY_MODE={0x5, 0x2b, 0x1}, @IEEE802154_ATTR_LLSEC_KEY_USAGE_FRAME_TYPES={0x5, 0x31, 0xf8}, @IEEE802154_ATTR_LLSEC_KEY_MODE={0x5, 0x2b, 0x1}, @IEEE802154_ATTR_DEV_INDEX={0x8, 0x2, r3}, @IEEE802154_ATTR_SHORT_ADDR={0x6, 0x4, 0xaaa2}, @IEEE802154_ATTR_LLSEC_KEY_MODE={0x5}]}, 0x4c}, 0x1, 0x0, 0x0, 0x20004800}, 0x4048001) syz_genetlink_get_family_id$nbd(&(0x7f0000000280), r1) 1.848157121s ago: executing program 2 (id=6398): setsockopt$packet_fanout(0xffffffffffffffff, 0x107, 0x12, 0x0, 0x0) socket$kcm(0x10, 0x2, 0x10) socket$nl_generic(0x10, 0x3, 0x10) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000044c0)={&(0x7f0000000940)=ANY=[@ANYBLOB="5c00000002060104000000000000000005000000050001000600000016000300686173683a6e65742c706f72742c6e65740000000900020073797a31000000000c000780080012400000000c050005000a000000050004"], 0x5c}, 0x1, 0x0, 0x0, 0x24040000}, 0x0) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r1, 0x0, 0x90) sendmsg$IPSET_CMD_ADD(r1, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000780)=ANY=[@ANYBLOB="74000300090601020000000000000000030000000900020073797a310000000005000100070000004c0007801800018014000240fe8000000000000000000000000000aa1800148014000240fc000000000000000000000000000000060004404e1f0000050007008400000006000540"], 0x74}, 0x1, 0x0, 0x0, 0x10040003}, 0x0) bpf$PROG_LOAD_XDP(0x5, 0x0, 0x0) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_LIST(r2, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000040)={0x1c, 0x7, 0x6, 0x801, 0x0, 0x0, {0xa, 0x0, 0x4}, [@IPSET_ATTR_PROTOCOL={0x5}]}, 0x1c}, 0x1, 0x0, 0x0, 0x20000005}, 0x80) 1.674118396s ago: executing program 2 (id=6399): r0 = socket$pppl2tp(0x18, 0x1, 0x1) r1 = socket$nl_generic(0x10, 0x3, 0x10) syz_emit_ethernet(0x36, &(0x7f0000000080)={@local, @empty, @void, {@ipv4={0x800, @tcp={{0x5, 0x4, 0x0, 0x0, 0x28, 0x320, 0x0, 0x0, 0x6, 0x0, @rand_addr=0x640100fe, @local}, {{0x3, 0x4e22, 0x41424344, 0x41424344, 0x0, 0x6, 0x5, 0x2, 0xfffe}}}}}}, 0x0) sendmsg$nl_generic(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000080)=ANY=[@ANYBLOB="1c0000004600070128b5700000"], 0x1c}, 0x1, 0x0, 0x0, 0x4048011}, 0xc000) bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0xd, 0x4, &(0x7f0000000040)=ANY=[@ANYRES64=r0], &(0x7f0000003ff6)='GPL\x00', 0x2, 0xc3, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @sock_ops}, 0x94) r2 = syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x3) writev(r2, &(0x7f0000019880)=[{&(0x7f0000000400)="fb", 0x1}, {0x0}], 0x2) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_DELETE(r3, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000000c0)=ANY=[@ANYBLOB="e80000000201010400000000000000000a000009140016400000000900000007000000010000000608000c40000000001c00188008000140fffff800080003400000000408000140000000099c000e800c00028005000100110000000c00028018000100840000002c00018014000300fe8000000000000000000000000000bb14000400bf3598d46951fc020000000000000003002001000000000000000000000000000014000400fe8000000000000000000000000000aa0c000280050001000600000006000340000100001400018008000100e00000"], 0xe8}, 0x1, 0x0, 0x0, 0x20008040}, 0x4048850) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)) bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0x1, 0x4, &(0x7f0000001fd8)=@framed={{0x5, 0x0, 0x0, 0x0, 0x0, 0xffffffbc, 0x10}, [@ldst={0x7, 0xff05, 0x0, 0x0, 0xa}]}, &(0x7f0000003ff6)='GPL\x00', 0x2, 0xff06, &(0x7f000000cf3d)=""/195}, 0x48) syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff) r4 = socket(0x10, 0x803, 0x0) sendmsg$nl_route(r4, &(0x7f0000000380)={0x0, 0x4076cbba9945d516, &(0x7f0000000340)={0x0, 0x14}}, 0x0) r5 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r5, &(0x7f0000000740)={0x0, 0x0, &(0x7f0000000080)=[{&(0x7f00000000c0)=ANY=[@ANYBLOB="3c0000001000010000000000000000002c00000020000000ff0f00000000000008001c00c9"], 0x3c}], 0x1, 0x0, 0x0, 0xb305e06d8ab48273}, 0x48800) getsockname$packet(r4, &(0x7f0000000280)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) r7 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r7, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000500)={&(0x7f0000000300)=ANY=[@ANYBLOB="380000001000390400000000fcffffff00000000", @ANYRES32=r6, @ANYBLOB="01980000020800001884f6f6d2388ddc937245d4800147f865000c00028008b89e000700ac271429"], 0x38}}, 0x0) r8 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFULNL_MSG_CONFIG(r8, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000140)=ANY=[@ANYBLOB="1c000000010401010000000000000000000004000500010001"], 0x1c}}, 0x40040) r9 = socket$nl_generic(0x10, 0x3, 0x10) r10 = syz_genetlink_get_family_id$batadv(&(0x7f0000000400), 0xffffffffffffffff) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r9, 0x8933, &(0x7f0000000440)={'batadv0\x00', 0x0}) sendmsg$BATADV_CMD_SET_MESH(r9, &(0x7f0000000540)={0x0, 0x0, &(0x7f0000000500)={&(0x7f0000000040)={0x44, r10, 0x1, 0x70bd28, 0x1, {}, [@BATADV_ATTR_MESH_IFINDEX={0x8, 0x3, r11}, @BATADV_ATTR_GW_MODE={0x5, 0x33, 0x2}, @BATADV_ATTR_GW_BANDWIDTH_UP={0x8, 0x32, 0x7}, @BATADV_ATTR_GW_BANDWIDTH_DOWN={0x8, 0x31, 0x3fc}, @BATADV_ATTR_GW_SEL_CLASS={0x8, 0x34, 0x2}, @BATADV_ATTR_HARD_IFINDEX={0x8}]}, 0x44}}, 0x80) close(r8) sendmsg$nl_route(r7, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000780)=@newlink={0x30c, 0x10, 0x439, 0x2, 0x0, {0x0, 0x0, 0x0, r6, 0x1040, 0x44100}, [@IFLA_LINKINFO={0x28, 0x12, 0x0, 0x1, @gre={{0x8}, {0x1c, 0x2, 0x0, 0x1, [@IFLA_GRE_ERSPAN_INDEX={0x8, 0x15, 0x3b145}, @IFLA_GRE_FWMARK={0x8, 0x14, 0xd6}, @IFLA_GRE_ENCAP_FLAGS={0x6, 0xf, 0x3}]}}}, @IFLA_ADDRESS={0xa, 0x1, @random="977774604b7e"}, @IFLA_VFINFO_LIST={0x2ac, 0x16, 0x0, 0x1, [{0x38, 0x1, 0x0, 0x1, [@IFLA_VF_RATE={0x10, 0x6, {0x5, 0xfffffff7, 0x3}}, @IFLA_VF_LINK_STATE={0xc, 0x5, {0x4, 0x31d0}}, @IFLA_VF_VLAN_LIST={0x18, 0xc, 0x0, 0x1, [{0x14, 0x1, {0x1000, 0x451, 0x5d4, 0x88a8}}]}]}, {0x20, 0x1, 0x0, 0x1, [@IFLA_VF_LINK_STATE={0xc, 0x5, {0xbd, 0x4}}, @IFLA_VF_VLAN={0x10, 0x2, {0x8, 0xea, 0xe}}]}, {0x100, 0x1, 0x0, 0x1, [@IFLA_VF_VLAN={0x10, 0x2, {0x20000000, 0x767, 0x9}}, @IFLA_VF_MAC={0x28, 0x1, {0x100, @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x3}}}, @IFLA_VF_VLAN_LIST={0xa4, 0xc, 0x0, 0x1, [{0x14, 0x1, {0x71e, 0xa92, 0x3ff, 0x8100}}, {0x14, 0x1, {0x10f7, 0x13d, 0xffff, 0x88a8}}, {0x14, 0x1, {0x0, 0x3ee, 0x80, 0x88a8}}, {0x14, 0x1, {0x1ff, 0x31, 0x2, 0x8100}}, {0x14, 0x1, {0x100, 0x254, 0x72, 0x88a8}}, {0x14, 0x1, {0x2, 0x35d, 0x0, 0x8100}}, {0x14, 0x1, {0xfffffff9, 0x5c1, 0x80000000, 0x8100}}, {0x14, 0x1, {0xda58, 0x7a6, 0x80, 0x8100}}]}, @IFLA_VF_IB_PORT_GUID={0x14, 0xb, {0x0, 0x98b2}}, @IFLA_VF_TX_RATE={0xc, 0x3, {0x10, 0x40}}]}, {0x48, 0x1, 0x0, 0x1, [@IFLA_VF_IB_NODE_GUID={0x14, 0xa, {0x6, 0x800000000000009}}, @IFLA_VF_IB_NODE_GUID={0x14, 0xa, {0x3, 0x7}}, @IFLA_VF_TRUST={0xc, 0x9, {0x8, 0x8}}, @IFLA_VF_VLAN={0x10, 0x2, {0x2, 0x265, 0x9}}]}, {0x10, 0x1, 0x0, 0x1, [@IFLA_VF_TRUST={0xc, 0x9, {0x6, 0x5}}]}, {0x9c, 0x1, 0x0, 0x1, [@IFLA_VF_TX_RATE={0xc, 0x3, {0x10000, 0x3}}, @IFLA_VF_RSS_QUERY_EN={0xc, 0x7, {0x945, 0x25a12b06}}, @IFLA_VF_VLAN={0x10, 0x2, {0x3, 0x4dd, 0x80}}, @IFLA_VF_IB_PORT_GUID={0x14, 0xb, {0xd, 0xffffffff}}, @IFLA_VF_MAC={0x28, 0x1, {0x1, @broadcast}}, @IFLA_VF_TRUST={0xc, 0x9, {0x5, 0x2}}, @IFLA_VF_RSS_QUERY_EN={0xc, 0x7, {0x101, 0x9}}, @IFLA_VF_TX_RATE={0xc, 0x3, {0x6, 0x7}}, @IFLA_VF_VLAN={0x10, 0x2, {0x7, 0x65f, 0x200}}]}, {0x5c, 0x1, 0x0, 0x1, [@IFLA_VF_MAC={0x28, 0x1, {0x4, @broadcast}}, @IFLA_VF_VLAN={0x10, 0x2, {0x80000000, 0xd58, 0x6ec}}, @IFLA_VF_TX_RATE={0xc, 0x3, {0x5, 0x15}}, @IFLA_VF_IB_NODE_GUID={0x14, 0xa, {0x4, 0xc}}]}]}, @IFLA_PHYS_PORT_ID={0x4}, @IFLA_MTU={0x8, 0x4, 0x6}]}, 0x30c}, 0x1, 0x0, 0x0, 0x1}, 0x4004000) unshare(0x2a020400) pselect6(0x40, &(0x7f00000001c0)={0x7f, 0x3, 0x0, 0xbf1, 0x0, 0xffff7ffffffffffa, 0x8}, 0x0, 0x0, 0x0, 0x0) socket$inet_icmp(0x2, 0x2, 0x1) 1.583756949s ago: executing program 1 (id=6401): r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000240), 0xffffffffffffffff) (async) ioctl$sock_SIOCGIFINDEX_802154(r0, 0x8933, &(0x7f0000000000)={'wpan0\x00', 0x0}) sendmsg$NL802154_CMD_SET_SEC_PARAMS(r0, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000000040)=ANY=[@ANYBLOB='$\x00\x00\x00', @ANYRES16=r1, @ANYBLOB="010022bd7000fcdbdf252800000008000300", @ANYRES32=r2, @ANYBLOB='\b\x00*'], 0x24}, 0x1, 0x0, 0x0, 0x48}, 0x20040000) (async) r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nfc(&(0x7f0000000080), r3) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000100)=[{0x0}], 0x1}, 0x8084) (async) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) (async) r4 = socket(0x10, 0x3, 0x0) sendmmsg(r4, &(0x7f0000000000), 0x4000000000001f2, 0x0) (async) r5 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000000), r3) sendmsg$IEEE802154_LLSEC_ADD_DEVKEY(r3, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000001200)={&(0x7f0000000380)={0x34, r5, 0x607, 0x0, 0x0, {}, [@IEEE802154_ATTR_LLSEC_FRAME_COUNTER={0x8, 0x2f, 0x7}, @IEEE802154_ATTR_HW_ADDR={0xc, 0x5, {0xaaaaaaaaaaaa0102}}, @IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan0\x00'}]}, 0x34}}, 0x20048840) 1.549180206s ago: executing program 4 (id=6402): r0 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$ipvs(&(0x7f0000000480), r0) sendmsg$IPVS_CMD_NEW_DAEMON(r0, &(0x7f0000000600)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x400c085}, 0x0) 1.244509597s ago: executing program 0 (id=6403): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$devlink(&(0x7f0000000140), 0xffffffffffffffff) sendmsg$DEVLINK_CMD_PORT_SPLIT(r0, &(0x7f0000000300)={&(0x7f0000000800)={0x10, 0x0, 0x0, 0x4000000}, 0xc, &(0x7f00000002c0)={&(0x7f0000000580)=ANY=[@ANYRESDEC=r1, @ANYRES16=r1, @ANYBLOB="bb8400fac9b4076464f8662b00", @ANYRES64=r1, @ANYRES8=r0, @ANYRES8=r0, @ANYRES16=r1, @ANYRES16=r1], 0x124}, 0x1, 0x0, 0x0, 0x4000000}, 0x480d0) r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="1e000000000000000a00000007"], 0x48) bpf$MAP_LOOKUP_ELEM(0x2, &(0x7f0000001740)={r2, 0x0, &(0x7f0000001700)=""/53}, 0x20) r3 = socket$kcm(0x10, 0x2, 0x0) sendmsg$inet(r3, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000001240)=[{&(0x7f0000000000)="5c00000013006bcd9e3fe3dc5e48aa31086b87f52f202546239100000000000000160af3ec65040014000d0002008be3a0e64094a68589028577d7dcbb2352d1f006baa45e0d501e2494acf1", 0x4c}, {&(0x7f0000000080)="d64b2bea4b3d87865e428c54bcc3abaf", 0x10}], 0x2, 0x0, 0x0, 0x1f00c00e}, 0x4801) r4 = socket$tipc(0x1e, 0x2, 0x0) bind$tipc(r4, &(0x7f0000000200)=@nameseq={0x1e, 0x1, 0x0, {0x42, 0x0, 0xfffffffd}}, 0x10) r5 = socket$tipc(0x1e, 0x5, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000440)={0xe, 0x6, &(0x7f0000000000)=ANY=[@ANYBLOB="05000000000000007111670000000000851000000200000085000000b200000095000000000000009500000000000000"], &(0x7f0000000080)='GPL\x00', 0x5, 0x29e, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @sk_skb, 0xffffffffffffffff, 0x6}, 0x70) bind$tipc(r5, &(0x7f0000000180)=@nameseq={0x1e, 0x1, 0x0, {0x42, 0x2, 0x4}}, 0x10) r6 = socket$inet6_mptcp(0xa, 0x1, 0x106) ioctl$sock_inet6_tcp_SIOCINQ(r6, 0x541b, &(0x7f0000000240)) bind$tipc(r4, &(0x7f0000000400)=@name={0x1e, 0x2, 0x2, {{0x42, 0x2}, 0x3}}, 0x10) bind$tipc(r5, &(0x7f0000000440)=@nameseq={0x1e, 0x1, 0x0, {0x42, 0x2, 0x3}}, 0x10) bpf$BPF_MAP_LOOKUP_AND_DELETE_ELEM(0x15, &(0x7f00000007c0)={r2, &(0x7f0000000340)="c173ba321bb3b6f5795b060a0ff8a2081b9dd31e4d18c6f2b66d46860007bb145575636e46d7b4b54bcbae49c047c2e618131b84a460a039d6fc0bd98e0f09620798a26f8e289115dba6c8943da5eb31d6535b65f91c951c2b05a230f671a8f4e779e244c97d51a5034b7d067b015e1194c3ed5b8149e36def2386c643eb8b76a18d959e8f73a1f14c4f8ea461fc867854a022a273b2efb1849652d7", &(0x7f00000006c0)=""/248}, 0x20) r7 = socket(0x40000000015, 0x5, 0x0) connect$l2tp6(r7, &(0x7f0000000200)={0xa, 0x0, 0x0, @local, 0x0, 0x2}, 0x20) bind$tipc(r5, &(0x7f00000001c0)=@nameseq={0x1e, 0x1, 0x0, {0x42, 0x3, 0x4}}, 0x10) r8 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r8, &(0x7f0000000900)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000540)=ANY=[@ANYBLOB="380000002000010000000000000000000a004000000000030000000014000200fc020000000000000000000000000000080016004e204e2259eacc"], 0x38}, 0x1, 0x0, 0x0, 0x40011}, 0x40000) sendmsg$nl_route(r8, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000500)={&(0x7f00000002c0)=ANY=[@ANYBLOB="5c00000010003904000000000000000000008000", @ANYRES32=0x0, @ANYBLOB="00000000000000003c0012800b000100697036746e6c00002c000280140003002001000000000000000000000000000114000200fc02"], 0x5c}}, 0x0) bind$tipc(r4, 0x0, 0x0) getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffffff, 0x29, 0x22, &(0x7f00000005c0)={{{@in6=@empty, @in=@broadcast}}, {{@in6=@dev}, 0x0, @in6=@empty}}, &(0x7f0000000280)=0xe8) 1.164210707s ago: executing program 4 (id=6404): r0 = openat$ppp(0xffffffffffffff9c, &(0x7f0000001740), 0x101042, 0x0) ioctl$PPPIOCNEWUNIT(r0, 0xc004743e, &(0x7f00000002c0)) ioctl$PPPIOCSACTIVE(r0, 0x40047459, &(0x7f0000000080)={0xfffffffffffffe43, 0x0}) read(r0, 0x0, 0xff40) write$ppp(r0, &(0x7f0000000200)="bc72", 0x2) socket$inet_mptcp(0x2, 0x1, 0x106) poll(0x0, 0x0, 0x400) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32, @ANYBLOB="0000000000000000b70800000d0000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000380)='memory.events\x00', 0x275a, 0x0) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) pwritev(r2, &(0x7f0000000100)=[{&(0x7f0000000040)="8e", 0x1}], 0x1, 0x4008001, 0x80) close(r2) socket$kcm(0x29, 0x2, 0x0) ioctl$sock_ipv4_tunnel_SIOCCHGTUNNEL(r1, 0x89f3, &(0x7f0000000800)={'ip_vti0\x00', &(0x7f0000000780)={'sit0\x00', 0x0, 0x17, 0x700, 0x8, 0x1ff, {{0x15, 0x4, 0x3, 0x3, 0x54, 0x64, 0x0, 0x7f, 0x2f, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @initdev={0xac, 0x1e, 0x1, 0x0}, {[@lsrr={0x83, 0x7, 0x98, [@remote]}, @ra={0x94, 0x4, 0x1}, @generic={0x88, 0x8, "dc718d0a5296"}, @lsrr={0x83, 0x2b, 0xa1, [@private=0xa010101, @broadcast, @broadcast, @empty, @local, @multicast1, @initdev={0xac, 0x1e, 0x1, 0x0}, @multicast1, @remote, @broadcast]}]}}}}}) bpf$PROG_LOAD_XDP(0x5, &(0x7f00000008c0)={0x6, 0x2b, &(0x7f00000004c0)=@ringbuf={{0x18, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x7fff}, {{0x18, 0x1, 0x1, 0x0, r2}}, {}, [@generic={0x7, 0x0, 0x6, 0x8, 0x1}, @alu={0x7, 0x0, 0x6, 0x2, 0x7, 0xffffffffffffffc0, 0x4}, @printk={@lld, {}, {}, {}, {}, {0x7, 0x0, 0xb, 0x3, 0x0, 0x0, 0x73e}}, @map_idx={0x18, 0x0, 0x5, 0x0, 0x9}, @snprintf={{}, {}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0x3}, {}, {}, {}, {}, {}, {}, {0x18, 0x3, 0x2, 0x0, r2}}, @generic={0x0, 0x2, 0x4, 0x5, 0xffffff80}, @btf_id={0x18, 0x6, 0x3, 0x0, 0x1}], {{}, {0x7, 0x0, 0xb, 0x2, 0x0, 0x0, 0x2}, {0x85, 0x0, 0x0, 0x85}}}, &(0x7f0000000640)='syzkaller\x00', 0x4, 0x15, &(0x7f0000000680)=""/21, 0x40f00, 0x9, '\x00', r3, 0x25, r2, 0x8, &(0x7f0000000840)={0x9, 0x5}, 0x8, 0x10, &(0x7f0000000880)={0x3, 0x9, 0x7ff}, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x3}, 0x94) sendfile(r2, r1, 0x0, 0xf03a0005) bpf$MAP_CREATE(0x0, &(0x7f0000000740)=ANY=[@ANYBLOB="0b00000005000000000400000900000001"], 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0xa, 0x4, &(0x7f0000000480)=ANY=[@ANYBLOB="18000000000000000000000000000000850000006d"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000d80)={0x18, 0x5, &(0x7f0000000480)=ANY=[@ANYBLOB="1801000021"], 0x0, 0x40, 0x0, 0x0, 0x0, 0xb4a02fe0ce239f93, '\x00', 0x0, 0x2}, 0x94) r4 = bpf$PROG_LOAD(0x5, 0x0, 0x0) socket(0x1, 0x80802, 0x0) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000180)={r4, 0x2000000, 0xe, 0x0, &(0x7f0000000040)="630b008646dc3f0adf33c9f7b986", 0x0, 0xcf25, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x80}, 0x50) r5 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r5, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f0000000140)=ANY=[@ANYBLOB="c000000019000100fcffffff00000140e00000fcfffff5ffffffffffffff0000ac1414bb00000000000000000000ecffff0f000000000a00200062000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="0b00000000000000120000000000000002000000010000000000000000000000ff0f000000000000fbffffffffffffffffffffffffffffff00000000000000000000000010000000030000000000002002000000000000000000000000000000feffffff0000000000000003000000000800160081000000"], 0xc0}}, 0x10004004) sendmsg$nl_xfrm(r5, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000000)=ANY=[@ANYBLOB="b8000000140001000000000000080016e000000200000000000000000000000000000000000000000000000000000000000000001000f4030a"], 0xb8}, 0x1, 0x0, 0x0, 0x404c830}, 0x20000800) 1.116827364s ago: executing program 2 (id=6405): r0 = socket$pppoe(0x18, 0x1, 0x0) unshare(0x400) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32, @ANYBLOB="0000000000000000b70800000d0000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) r1 = socket$inet6(0xa, 0x3, 0x76) setsockopt$inet6_IPV6_XFRM_POLICY(r1, 0x29, 0x23, &(0x7f0000000180)={{{@in6=@remote, @in6=@mcast1, 0x4, 0x0, 0x0, 0x0, 0x2, 0x0, 0x20, 0x2f}, {0xfffffefffffffffd, 0xeca, 0x2d, 0x3, 0x0, 0x0, 0x400778e, 0xffff}, {0xfffffffffffffff7, 0x0, 0xd}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1}, {{@in6=@rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02', 0x4d6, 0x3c}, 0x0, @in=@multicast1, 0x0, 0x4}}, 0xe8) close(r1) r2 = socket$inet_mptcp(0x2, 0x1, 0x106) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) setsockopt$SO_ATTACH_FILTER(r4, 0x1, 0x1a, &(0x7f0000000000)={0x3, &(0x7f00000000c0)=[{0x20, 0x0, 0x0, 0xfffff034}, {0x20, 0x0, 0x0, 0xfffff034}, {0x6}]}, 0x10) sendmmsg(r3, &(0x7f0000000180), 0x4000190, 0x0) connect$inet(r2, &(0x7f0000000040)={0x2, 0x4e21, @remote}, 0x10) setsockopt$inet_int(0xffffffffffffffff, 0x0, 0x13, &(0x7f0000000040), 0x4) r5 = bpf$MAP_CREATE(0x0, &(0x7f0000000740)=ANY=[@ANYBLOB="0b00000005000000000400000900000001"], 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0xa, 0x4, &(0x7f0000000480)=ANY=[@ANYBLOB="18000000000000000000000000000000850000006d"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r6 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000d80)={0x18, 0x5, &(0x7f0000000480)=ANY=[@ANYBLOB="1801000021"], 0x0, 0x40, 0x0, 0x0, 0x0, 0xb4a02fe0ce239f93, '\x00', 0x0, 0x2}, 0x94) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0xe, 0x0, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000800000000000000000000018110000", @ANYRES32=r5], 0x0, 0x0, 0x0, 0x0, 0x41100, 0x59, '\x00', 0x0, @fallback=0x2a, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, r6, 0x0, 0x0, 0x0, 0x0}, 0x94) r7 = bpf$PROG_LOAD(0x5, &(0x7f0000000300)={0x6, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback=0x4, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f00000003c0)={r7, 0x2000000, 0xe, 0x0, &(0x7f0000000280)="01000000f3ffffffde31c9f7b986", 0x0, 0xcf25, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x80}, 0x50) r8 = socket$nl_route(0x10, 0x3, 0x0) r9 = socket(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r9, 0x8933, &(0x7f0000000080)={'ip6tnl0\x00', 0x0}) sendmsg$nl_route(r8, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000500)={&(0x7f0000000280)=ANY=[@ANYBLOB="480000001000390400000000030000000000002c4f82a934043f4600c10462b3ecd0cd00", @ANYRES32=r10, @ANYBLOB="0141000000000000280012800b000100697036746e6c00001800028014000200fe800000000000000000000000000010"], 0x48}, 0x1, 0x0, 0x0, 0x4040000}, 0x94) r11 = socket(0x25, 0xa, 0x5) r12 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000080), 0xffffffffffffffff) r13 = socket$inet_udp(0x2, 0x2, 0x0) sendmsg$L2TP_CMD_SESSION_GET(r11, &(0x7f0000000180)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f0000000140)={&(0x7f00000000c0)={0x50, r12, 0x200, 0x70bd26, 0x25dfdbfd, {}, [@L2TP_ATTR_IP6_SADDR={0x14, 0x1f, @loopback}, @L2TP_ATTR_VLAN_ID={0x6, 0xe, 0x7fbd}, @L2TP_ATTR_UDP_DPORT={0x6, 0x1b, 0x4e20}, @L2TP_ATTR_FD={0x34, 0x17, @udp=r13}, @L2TP_ATTR_SESSION_ID={0x8, 0xb, 0x3}, @L2TP_ATTR_UDP_SPORT={0x6, 0x1a, 0x4e1e}]}, 0x50}, 0x1, 0x0, 0x0, 0x20000400}, 0x4008884) connect$pppoe(r0, &(0x7f0000000000)={0x18, 0x0, {0x4, @multicast, 'macvlan1\x00'}}, 0x1e) r14 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r14, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000440)={0x20, 0x2e, 0x9, 0x70bd27, 0x0, {0x4}, [@typed={0x8, 0x18, 0x0, 0x0, @binary="04ac0f00"}, @typed={0x4, 0x1e}]}, 0x20}, 0x1, 0x0, 0x0, 0x42804}, 0x0) writev(r0, &(0x7f0000000200)=[{&(0x7f0000000240)='\x00', 0x5ea}], 0x1) 1.090757752s ago: executing program 5 (id=6406): r0 = socket$inet6_udp(0xa, 0x2, 0x0) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f000000c2c0)={0x0, 0x0, 0x0}, 0x0) sendmsg$NFT_BATCH(0xffffffffffffffff, 0x0, 0x0) bind$inet6(r0, &(0x7f0000000000)={0xa, 0xe22, 0x0, @empty}, 0x1c) r1 = socket$pppl2tp(0x18, 0x1, 0x1) connect$pppl2tp(r1, &(0x7f0000000100)=@pppol2tpv3={0x18, 0x1, {0x0, r0, {0x2, 0xffff, @loopback}, 0x4}}, 0x2e) syz_emit_ethernet(0x46, &(0x7f0000000140)={@link_local, @random="ecb403236035", @void, {@ipv6={0x86dd, @udp={0x0, 0x6, "010100", 0x10, 0x11, 0xff, @remote, @local, {[], {0x3, 0xe22, 0x10, 0x0, @gue={{0x2, 0x0, 0x0, 0x3}}}}}}}}, 0x0) (fail_nth: 1) 1.03590615s ago: executing program 1 (id=6407): r0 = socket$inet6(0xa, 0x2, 0x0) bind$inet6(r0, &(0x7f0000f5dfe4)={0xa, 0x4e20, 0x0, @empty}, 0x1c) recvmmsg(r0, &(0x7f0000002500)=[{{0x0, 0x0, &(0x7f0000002440)=[{0x0}, {&(0x7f0000002340)=""/252, 0xfc}], 0x2}, 0x7}], 0x1, 0x0, 0x0) syz_emit_ethernet(0x86, &(0x7f0000000000)={@dev={'\xaa\xaa\xaa\xaa\xaa', 0x23}, @remote, @void, {@ipv4={0x800, @udp={{0x5, 0x4, 0x0, 0x0, 0x78, 0x0, 0x0, 0x0, 0x11, 0x0, @empty, @empty}, {0x0, 0x4e20, 0x64, 0x0, @wg=@response={0x2, 0x3, 0x1, "56805c734ee222c29de4125f81f6e030a5441a99f362cd24e0a1ac2291500733", "467f517bd818d5a4a8d26ae61b4cbf13", {"31ffc21d2e9bfb1eb3c03976ed837b6f", "876605ac29dcb96a8901e0711afb3db3"}}}}}}}, 0x0) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000840)={0x6, 0x3, &(0x7f0000000680)=ANY=[@ANYBLOB="1800000002000000000000000000000095"], 0x0, 0x5, 0x0, 0x0, 0x60ff78ce1cb3c070}, 0x94) r1 = bpf$PROG_LOAD_XDP(0x5, &(0x7f0000007300)={0x6, 0x3, &(0x7f0000000680)=ANY=[], &(0x7f0000006200)='syzkaller\x00', 0x7, 0x0, 0x0, 0x0, 0x4c, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x2}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000600)={r1, 0x5, 0xb68, 0x0, &(0x7f0000000000)='%', 0x0, 0xd01, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x48) 972.723643ms ago: executing program 5 (id=6408): socket$nl_generic(0x10, 0x3, 0x10) r0 = socket$inet6_udp(0xa, 0x2, 0x0) ioctl$sock_ipv6_tunnel_SIOCADDTUNNEL(r0, 0x8910, &(0x7f0000000100)={'ip6tnl0\x00', &(0x7f0000000080)={'syztnl0\x00', 0x0, 0x29, 0x0, 0x10, 0xcab2, 0x60, @private0, @private0={0xfc, 0x0, '\x00', 0x1}, 0x40, 0x8000, 0x5, 0x6864}}) 903.494799ms ago: executing program 5 (id=6409): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$batadv(&(0x7f0000000400), 0xffffffffffffffff) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r0, 0x8933, &(0x7f0000000440)={'batadv0\x00', 0x0}) r3 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000580)=ANY=[@ANYBLOB="02000000040000000800000001"], 0x50) bpf$PROG_LOAD(0x5, &(0x7f0000000400)={0x3, 0x12, &(0x7f0000000700)=@framed={{}, [@cb_func={0x18, 0x9, 0x4, 0x0, 0xfffffffffffffffd}, @snprintf={{}, {}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0xffffff90}, {}, {}, {}, {}, {}, {}, {0x18, 0x3, 0x2, 0x0, r3}}]}, &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sched_cls, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) sendmsg$BATADV_CMD_SET_MESH(r0, &(0x7f0000000540)={0x0, 0x0, &(0x7f0000000500)={&(0x7f0000000000)=ANY=[@ANYBLOB="eb8677f6", @ANYRES16=r1, @ANYBLOB="010028bd7040010000000f00000008003c000600000008000300", @ANYRES32=r2, @ANYBLOB="050029000000000005002f0000000000"], 0x34}}, 0x18) 844.092851ms ago: executing program 0 (id=6410): bpf$PROG_LOAD(0x5, &(0x7f0000000400)={0x6, 0x5, &(0x7f0000000200)=@framed={{}, [@map_fd={0x18, 0x6}]}, &(0x7f00000004c0)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @xdp, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x94) r0 = accept$packet(0xffffffffffffffff, &(0x7f0000000000), &(0x7f0000000040)=0x14) r1 = socket$unix(0x1, 0x5, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) r3 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000040), 0xffffffffffffffff) r4 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$ETHTOOL_MSG_LINKMODES_GET(r4, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000980)={0x34, r3, 0x301, 0x70bd29, 0x25dfdbfc, {0x24}, [@HEADER={0x20, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'bond0\x00'}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r2}]}]}, 0x34}, 0x1, 0x0, 0x0, 0x8041}, 0x0) setsockopt$packet_drop_memb(r0, 0x107, 0x2, &(0x7f0000000080)={r2, 0x1, 0x6}, 0x10) 691.869819ms ago: executing program 5 (id=6411): bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000d00)=ANY=[@ANYBLOB="0200000004000000080000000100000080000000", @ANYRES32=0x0, @ANYBLOB="0500"/20, @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="00000000000000000000000000000000000000000000000000000000187b7c4589e019fda922c714c865ea5154ebccfa70a0766ea27c01fe04a4c709a9817bd203b24246c39c4bfe642095e4cf154cb96dc83e94d097189caac7436eda93c73c089c35bb"], 0x50) r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = socket$inet_mptcp(0x2, 0x1, 0x106) setsockopt$SO_ATTACH_FILTER(r1, 0x29, 0x1a, 0x0, 0x0) r2 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) recvfrom(r1, &(0x7f0000000240)=""/232, 0xe8, 0x101, &(0x7f00000003c0)=@pppoe={0x18, 0x0, {0x3, @empty, 'ip6tnl0\x00'}}, 0x80) bind$bt_hci(r2, &(0x7f0000000080)={0x1f, 0x4, 0x3}, 0x6) bpf$BPF_GET_PROG_INFO(0xf, &(0x7f0000000ac0)={0xffffffffffffffff, 0xe0, &(0x7f00000009c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, &(0x7f0000000800)=[0x0], ""/16, 0x0, 0x0, 0x0, 0x0, 0x1, 0x6, &(0x7f0000000840)=[0x0], &(0x7f0000000880)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0], 0x0, 0x51, &(0x7f00000008c0)=[{}], 0x8, 0x10, &(0x7f0000000900), &(0x7f0000000940), 0x8, 0x30, 0x8, 0x8, &(0x7f0000000980)}}, 0x10) getsockopt$inet6_mreq(0xffffffffffffffff, 0x29, 0x15, &(0x7f0000000b00)={@private1, 0x0}, &(0x7f0000000b40)=0x14) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r2, 0x8933, &(0x7f0000000b80)={'batadv_slave_1\x00', 0x0}) ioctl$sock_ipv4_tunnel_SIOCDELTUNNEL(0xffffffffffffffff, 0x89f2, &(0x7f0000000c00)={'tunl0\x00', &(0x7f0000000bc0)={'syztnl0\x00', 0x0, 0x7800, 0x40, 0x3, 0x9, {{0x6, 0x4, 0x1, 0x8, 0x18, 0x66, 0x0, 0xbb, 0x2f, 0x0, @multicast1, @loopback, {[@end]}}}}}) r7 = socket(0x400000000010, 0x3, 0x0) r8 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r8, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r7, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000005c0)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0xffffffff, {0x0, 0x0, 0x0, r9, {0x0, 0xfff1}, {0xffff, 0xffff}, {0x0, 0x5}}, [@qdisc_kind_options=@q_multiq={{0xb}, {0x8}}]}, 0x38}, 0x1, 0x0, 0x0, 0x4000}, 0x0) sendmsg$nl_route_sched(r7, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000240)=@newtfilter={0x44, 0x2c, 0xd27, 0x70bd2c, 0x0, {0x0, 0x0, 0x0, r9, {0xa, 0x9}, {}, {0xc, 0x8}}, [@filter_kind_options=@f_flower={{0xb}, {0x14, 0x2, [@TCA_FLOWER_CLASSID={0x8, 0x1, {0x1, 0xd}}, @TCA_FLOWER_KEY_CT_STATE={0x6, 0x5b, 0x4}]}}]}, 0x44}, 0x1, 0x0, 0x0, 0x60000080}, 0x20000000) r10 = socket(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000002c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$sock_SIOCGIFINDEX(r11, 0x8933, &(0x7f0000000000)={'lo\x00', 0x0}) sendmsg$nl_route_sched(r10, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000680)=@newqdisc={0x48, 0x24, 0xd0f, 0x470bd2d, 0x25dfdbfd, {0x60, 0x0, 0x0, r12, {0x0, 0xfff2}, {0xfff1, 0xffff}, {0x0, 0xd}}, [@qdisc_kind_options=@q_clsact={0xb}, @TCA_EGRESS_BLOCK={0x8, 0xe, 0x7}, @TCA_INGRESS_BLOCK={0x8, 0xd, 0x83}, @TCA_RATE={0x6, 0x5, {0x48, 0x6}}]}, 0x48}, 0x1, 0x0, 0x0, 0x24000040}, 0x0) r13 = socket$can_raw(0x1d, 0x3, 0x1) r14 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000840)={0x18, 0x3, &(0x7f0000000800)=ANY=[@ANYBLOB="1800000000000000000000000000000095"], &(0x7f0000000080)='syzkaller\x00', 0x0, 0x0, 0x0, 0x41100, 0x2c}, 0x94) bpf$BPF_GET_PROG_INFO(0xf, &(0x7f0000000580)={r14, 0xe0, &(0x7f0000000480)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, ""/16, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0}}, 0x10) bpf$BPF_GET_PROG_INFO(0xf, &(0x7f0000001440)={r14, 0xe0, &(0x7f0000000440)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, ""/16, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0}}, 0x10) sendmsg$sock(r13, &(0x7f0000000600)={&(0x7f0000000340)=@can={0x1d, r16}, 0x80, &(0x7f0000000280)=[{0x0}, {&(0x7f0000000640)="6ec7213690337aab88585c5b8baf46ae", 0x10}], 0x2}, 0x1) ioctl$sock_ipv6_tunnel_SIOCADDTUNNEL(0xffffffffffffffff, 0x89f1, &(0x7f0000000cc0)={'ip6tnl0\x00', &(0x7f0000000c40)={'syztnl2\x00', 0x0, 0x2f, 0x9d, 0x8, 0x4, 0x50, @empty, @private0, 0x80, 0x80, 0x0, 0x2335}}) sendmsg$ETHTOOL_MSG_RINGS_GET(0xffffffffffffffff, &(0x7f0000000ec0)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x40000}, 0xc, &(0x7f0000000e80)={&(0x7f0000000f00)=ANY=[@ANYBLOB="6c010000", @ANYRES16=0x0, @ANYBLOB="080029bd7000ffdbdf250f0000004c0001800800030003000000000002006970365f767469300000000000000000080003000100000008000100", @ANYRES32=0x0, @ANYBLOB="08000100", @ANYRES32=0x0, @ANYBLOB="08000100", @ANYRES32=0x0, @ANYBLOB="080003000200000008000100", @ANYRES32=r3, @ANYBLOB="08000100", @ANYRES32=r4, @ANYBLOB="68000180080003000200000008000100", @ANYRES32=r5, @ANYBLOB="08000300020000001439020076657468315f766c616e0000000000001400020074756e6c300000000000000000000000140002007465616d30000000000000000000000008000100", @ANYRES32=r6, @ANYBLOB="08000100", @ANYRES32=0x0, @ANYBLOB="4c0001807dff0100", @ANYRES32=r9, @ANYBLOB="08000100", @ANYRES32=r12, @ANYBLOB="14000200697036746e6c3000000000000000000008000100", @ANYRES32=r16, @ANYBLOB="1400020076657468315f746f5f6261746164760008000100", @ANYRES32=r17, @ANYBLOB="58000180140002006e723000000000000000000000000000140002006e657470636930000000000000000000080003000200000008000300010000001400020064766d727031000000000000000000000800030003000000"], 0x16c}, 0x1, 0x0, 0x0, 0x4000000}, 0x80) write(r2, &(0x7f0000000340)="4700000001003f", 0x7) syz_genetlink_get_family_id$ieee802154(&(0x7f0000000000), r0) bpf$PROG_LOAD(0x5, &(0x7f0000000dc0)={0x6, 0x10, &(0x7f00000000c0)=ANY=[@ANYRES32=r15, @ANYRES32=r2, @ANYBLOB="0000000000000000b703000010040000850000006900000095"], 0xfffffffffffffffd, 0x7, 0x0, 0x0, 0x0, 0x65, '\x00', 0x0, @xdp=0x25, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) 541.264747ms ago: executing program 2 (id=6412): sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000280)="d8000000190081044e81f782db4cb90402200800fd007c05e8fe55a108001e000140cde8dfe90e4190000900ac00060211000000160012000a0002000d48035c3b61c1d67f01282e8d614230a68000a007a290457f01a705000000000000009100005ee4e11b14d6d930dfe1d9d322fe7c9f8775730d16a4683f5ae24e25ccca9e603a6a8a9826835d3a71d95667e006dcdf63951f2155e3bb9ad809d5e1cace81ed0bffece0b42a9ecbee5de6ccd40dd6e4edef3d93452a92954b43370e971ad9", 0xc1}], 0x1}, 0x44004) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000300)=ANY=[@ANYBLOB="44000000190001090040000024000000021800000002fd010000000008000100ac141400080005006401010010001680"], 0x44}}, 0x0) 439.96481ms ago: executing program 0 (id=6413): r0 = socket$nl_xfrm(0x10, 0x3, 0x6) r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000023c0)={&(0x7f0000000400)=ANY=[@ANYBLOB="200000003e00090b000000000008000003"], 0x20}}, 0x0) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) r3 = socket$alg(0x26, 0x5, 0x0) bind$alg(r3, &(0x7f0000000380)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc-cast5-avx\x00'}, 0x58) setsockopt$ALG_SET_KEY(r3, 0x117, 0x1, &(0x7f0000000140)="2c385aa3d4", 0x5) r4 = accept4(r3, 0x0, 0x0, 0x0) sendmsg$nl_route_sched_retired(r4, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f00000009c0)=@deltclass={0x24, 0x29, 0x300, 0x70bd29, 0x25dfdbff, {0x0, 0x0, 0x0, 0x0, {0x10, 0xffff}, {0x6, 0xf}, {0xe, 0xd}}}, 0x62}}, 0x0) recvmmsg(r4, &(0x7f0000000c40)=[{{0x0, 0x0, &(0x7f0000000480)=[{&(0x7f0000000100)=""/1, 0x1}, {&(0x7f00000001c0)=""/64, 0x40}], 0x2}, 0x8}], 0x1, 0x2, 0x0) sendmsg$NFT_MSG_GETCHAIN(r4, &(0x7f0000000740)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f0000000700)={&(0x7f0000000680)=ANY=[@ANYBLOB="7c000000040a000000000000000000000000000108000540ffffffff08000a40000000b05a5711010900030073797a3200000000440004800800014000000000140003006e657464657673696d300000000000001400030067726530000000000000000000000000080002403abf95c3080002402fcc699308000a40"], 0x7c}, 0x1, 0x0, 0x0, 0x20000080}, 0x1) setsockopt$inet6_tcp_int(r2, 0x6, 0x13, &(0x7f0000000000)=0x100000001, 0x4) r5 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$TUNSETIFF(r5, 0x400454ca, &(0x7f00000000c0)={'syzkaller0\x00', 0x84aebfbd6349b7f2}) r6 = socket(0x10, 0x803, 0x0) ioctl$sock_SIOCGIFINDEX(r6, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r6, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000a40)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70bd28, 0xffffffff, {0x0, 0x0, 0x0, r7, {0x0, 0x9}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_fq_codel={{0xd}, {0x4}}]}, 0x38}}, 0x0) sendmsg$nl_route_sched(r6, &(0x7f0000006040)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000001400)=@newtfilter={0x40, 0x2c, 0xd27, 0x70bd25, 0x0, {0x0, 0x0, 0x0, r7, {0x4, 0x4}, {}, {0x1, 0xf}}, [@filter_kind_options=@f_fw={{0x7}, {0x14, 0x2, [@TCA_FW_MASK={0x8, 0x5, 0x7}, @TCA_FW_MASK={0x4, 0x5, 0x4}]}}]}, 0x40}}, 0x20040054) connect$inet6(r2, &(0x7f0000000200)={0xa, 0x0, 0x0, @loopback}, 0x1c) setsockopt$inet6_tcp_TCP_ULP(r2, 0x6, 0x1f, &(0x7f00000000c0), 0x4) setsockopt$inet6_tcp_TLS_TX(r2, 0x11a, 0x1, &(0x7f0000000540)=@gcm_128={{0x303}, "ffffffffffffffe2", "8e083700daf38a6d69e9b5e9c2f133d7", "6a3a05b9", "12772541f8eb02bb"}, 0x28) sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000c80)=@updsa={0x2fc, 0x1a, 0x20, 0x70bd2b, 0x25dfdbfe, {{@in6=@ipv4={'\x00', '\xff\xff', @remote}, @in=@broadcast, 0x4e22, 0x8, 0x4e24, 0x4, 0x2, 0x0, 0x80, 0xff, r7}, {@in6=@mcast2, 0x4d5, 0x32}, @in6=@empty, {0x5, 0x7, 0xfffffffffffffff9, 0x3, 0xdb, 0x3, 0x1, 0x1}, {0x8, 0x10001, 0x4, 0x639fb97d}, {0x8, 0x0, 0x5e}, 0x70bd2a, 0x3504, 0xa, 0x0, 0x8, 0x2}, [@policy={0xac, 0x7, {{@in6=@private1={0xfc, 0x1, '\x00', 0x1}, @in6=@ipv4={'\x00', '\xff\xff', @rand_addr=0x64010102}, 0x4e20, 0x2, 0x4e22, 0x73d, 0x0, 0x20, 0x20, 0x16, r7}, {0x2, 0x272, 0xff, 0xc, 0xffffffff80000001, 0x4, 0xfffffffffffffc01, 0x1}, {0x3, 0x2, 0xffffffffffff8001, 0xc}, 0x4, 0x0, 0x2, 0x1, 0x26d79b9ea8c292e7, 0x2}}, @policy={0xac, 0x7, {{@in=@remote, @in=@loopback, 0x4e20, 0x7, 0x4e24, 0x0, 0xa, 0x0, 0x88f476323b554f1b, 0xc}, {0x1, 0x6, 0x7, 0x401, 0x8, 0x9, 0x6, 0xfffffffffffffff9}, {0xffffffffffffffff, 0xfffffffffffffffe, 0x0, 0xffffffff}, 0x0, 0x6e6bb0, 0x1, 0x0, 0x3}}, @mark={0xc, 0x15, {0x35075c, 0x74e11983}}, @replay_esn_val={0x40, 0x17, {0x9, 0x70bd28, 0x70bd2d, 0x70bd28, 0x70bd2b, 0x5, [0x7fff, 0x2aef, 0x4, 0x6, 0xdc, 0x5, 0x9, 0x3, 0x1]}}, @encap={0x1c, 0x4, {0xfffffffffffffffd, 0x3, 0x4e23, @in6=@empty}}, @srcaddr={0x14, 0xd, @in6=@initdev={0xfe, 0x88, '\x00', 0x0, 0x0}}, @mark={0xc, 0x15, {0x35075b, 0x4}}, @extra_flags={0x8, 0x18, 0x5}, @replay_esn_val={0x24, 0x17, {0x2, 0x70bd2c, 0x70bd2c, 0x70bd26, 0x70bd2d, 0x4, [0x1, 0x100]}}]}, 0x2fc}}, 0x0) r8 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='freezer.state\x00', 0x275a, 0x0) write$cgroup_int(r8, &(0x7f0000000000), 0xffffff6a) setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r2, 0x6, 0x14, &(0x7f0000000040)=0x1, 0x4) syz_emit_ethernet(0xce, &(0x7f0000000580)=ANY=[@ANYBLOB="bbbbbbbbbbbb00000000000008004f1e00c00064000009029078ac1414aae0000001830452b889172ee0000002ac1e00017f000001e0000001ac1414aa01441c40e10000000003ffe000000100000008ff0000010000007c8307e700000000441c2e017f00000100000001640101010000012c0a010102000000ff070b51e0000001640101010000110b9078e00000019e7af35f080fb2cbc9535365e7d08edd8de0fc9d02fb2bcb53b7e74458360a323c93a8ada4b61105656f96f42bfd32b9802400a49b26e093974f14cc0000"], 0x0) sendfile(r2, r0, 0x0, 0xffffffff004) r9 = bpf$MAP_CREATE(0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="22000000040000001000000012"], 0x48) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000180)={{r9}, &(0x7f0000000080), &(0x7f00000001c0)=r9}, 0x20) bpf$BPF_MAP_CONST_STR_FREEZE(0x16, 0x0, 0x0) 358.05922ms ago: executing program 2 (id=6414): sendmsg$DEVLINK_CMD_RATE_NEW(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f00000001c0)={0x40, 0x0, 0x1, 0x70bd26, 0x25dfdbfe, {}, [@DEVLINK_ATTR_RATE_TX_SHARE={0xc}, @handle=@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}]}, 0x40}, 0x1, 0x0, 0x0, 0x4004000}, 0x4005000) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) syz_emit_ethernet(0x4a, &(0x7f0000000200)={@local, @multicast, @void, {@ipv4={0x800, @tcp={{0x5, 0x4, 0x2, 0x3, 0x3c, 0x64, 0x0, 0x7, 0x6, 0x0, @private=0xa010102, @remote}, {{0x6e22, 0x4e20, 0x41424344, 0x41424344, 0x0, 0x0, 0xa, 0x8, 0x606d, 0x0, 0x1ff, {[@md5sig={0x13, 0x12, "0e958d0000f1ff000000ec2400000041"}]}}}}}}}, 0x0) sendmsg$ETHTOOL_MSG_COALESCE_SET(0xffffffffffffffff, &(0x7f0000000540)={0x0, 0x0, &(0x7f0000000500)={&(0x7f00000001c0)=ANY=[@ANYBLOB='\\\x00\x00\x00', @ANYRES16, @ANYBLOB="010000000000000000001400000008000200fc00000018000180140002"], 0x5c}, 0x1, 0x0, 0x0, 0x4000800}, 0x0) sendmsg$NFT_BATCH(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x8890}, 0x20004450) sendmsg$NFT_MSG_GETRULE(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000001c0)=ANY=[@ANYBLOB="38000000070a010100000006000000000a0040010900010073797a3100"], 0x38}, 0x1, 0x0, 0x0, 0x20040850}, 0x44054) 234.140093ms ago: executing program 5 (id=6415): r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f00000018c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000400)=ANY=[@ANYBLOB="200000001e000100000000000000000007000000", @ANYRES32=0x0, @ANYBLOB], 0x20}}, 0xcc04) 155.656119ms ago: executing program 2 (id=6416): r0 = socket$nl_generic(0x10, 0x3, 0x10) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x5) close(0x4) syz_open_procfs$namespace(0x0, &(0x7f0000000040)='ns/cgroup\x00') socket$packet(0x11, 0x2, 0x300) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f07ebbeef, 0x8031, 0xffffffffffffffff, 0x215eb000) bpf$PROG_LOAD(0x5, &(0x7f0000000680)={0x4, 0x4, &(0x7f00000000c0)=ANY=[@ANYBLOB="18d1520ef6ec6e79cc4aaa3e0d513aa3baec51d300000000000002850000002a03000000981da7767b80ebac7d0cdb13d200009500000000000000"], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x20, '\x00', 0x0, @fallback=0x12, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) socket$nl_netfilter(0x10, 0x3, 0xc) socket$nl_generic(0x10, 0x3, 0x10) r1 = socket$netlink(0x10, 0x3, 0x10) bind$netlink(r1, &(0x7f0000514ff4)={0x10, 0x0, 0x0, 0x2ffffffff}, 0xc) setsockopt$sock_int(r1, 0x1, 0x8, &(0x7f0000000000), 0x4) setsockopt$netlink_NETLINK_BROADCAST_ERROR(r1, 0x10e, 0x4, &(0x7f0000000100)=0x1800, 0x4) sendmsg$nl_generic(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x4000d}, 0x20000001) r2 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r2, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000140)=ANY=[@ANYBLOB="5c0300002e00090027bd70000000000004000000480311"], 0x35c}, 0x1, 0x0, 0x0, 0x42804}, 0x4000010) r3 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r3, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000140)=ANY=[@ANYBLOB="5c0300002e00090027bd70000000000005"], 0x35c}, 0x1, 0x0, 0x0, 0x42804}, 0x4000010) socket$alg(0x26, 0x5, 0x0) r4 = socket(0x14, 0x2, 0x4) sendmsg$kcm(r4, 0x0, 0x801) ioctl$sock_SIOCGIFINDEX(r4, 0x61d0, 0x0) getsockopt$inet_mreqn(r4, 0x0, 0x20, &(0x7f0000000340)={@broadcast, @empty}, &(0x7f00000003c0)=0xc) syz_genetlink_get_family_id$ipvs(&(0x7f0000000080), r0) syz_init_net_socket$x25(0x9, 0x5, 0x0) r5 = socket$inet_sctp(0x2, 0x5, 0x84) getsockopt$inet_sctp_SCTP_ENABLE_STREAM_RESET(r5, 0x84, 0x76, &(0x7f0000000280)={0x0, 0x2}, &(0x7f00000002c0)=0x8) socket$netlink(0x10, 0x3, 0x0) getsockname$packet(0xffffffffffffffff, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) 89.972017ms ago: executing program 4 (id=6417): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) close(r0) r1 = socket(0x2b, 0x1, 0x1) bind$inet6(r0, &(0x7f0000000080)={0xa, 0x4e22, 0x0, @empty}, 0x1c) listen(r1, 0x5) r2 = socket$inet_smc(0x2b, 0x1, 0x0) connect$inet(r2, &(0x7f0000000000)={0x2, 0x4e22, @local}, 0x10) 59.829191ms ago: executing program 5 (id=6418): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r1, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000340)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x0) sendmsg$NFT_BATCH(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f0000000c80)=ANY=[@ANYBLOB="140000001000010000000000000000000300000a58000000060a010400000000000000000a0000040900010073797a31000000000900020073797a32000000002c000480280001800d00010073796e70726f787900000000140002800500020001000000080003"], 0x80}, 0x1, 0x0, 0x0, 0x4000850}, 0x24044010) close(r0) r2 = socket(0x2b, 0x1, 0x1) bind$inet6(r0, &(0x7f0000000080)={0xa, 0x4e22, 0x0, @empty}, 0x1c) listen(r2, 0x5) r3 = socket$inet_smc(0x2b, 0x1, 0x0) connect$inet(r3, &(0x7f0000000000)={0x2, 0x4e22, @local}, 0x10) 0s ago: executing program 1 (id=6419): bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000340)={&(0x7f00000002c0)=ANY=[], 0x0, 0x64}, 0x28) r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000080)=@filter={'filter\x00', 0xe, 0x4, 0x90, [0x0, 0x200000000180, 0x2000000002c6, 0x2000000004dc], 0x0, 0x0, 0x0}, 0x108) r1 = socket$inet6(0xa, 0x2, 0x0) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000080)=ANY=[@ANYBLOB="2c0000001e0001000000000000000000020000000100000000000000080001000000000008000f"], 0x2c}, 0x1, 0x0, 0x0, 0x2}, 0x0) setsockopt$inet6_int(r1, 0x29, 0x46, &(0x7f0000000440)=0x8000, 0x4) sendto$inet6(r1, 0x0, 0x0, 0x0, &(0x7f0000000200)={0xa, 0x4e20, 0x0, @dev={0xfe, 0x80, '\x00', 0x33}}, 0x1c) r3 = socket$nl_route(0x10, 0x3, 0x0) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) ioctl$XFS_IOC_GETPARENTS_BY_HANDLE(r1, 0xc040583f, &(0x7f00000005c0)={{@_ha_fsid={[0x8, 0x2]}, {0x6, 0x9, 0x0, 0x1}}, {{[0xffffffff, 0x2, 0x6, 0x7]}, 0x0, 0x2, 0x0, 0x0, &(0x7f0000000480)=[{{@align=0x80000001, {0xcd, 0xc, 0x401, 0x5}}, 0x7, 0x0, '#(-\x00'}, {{@_ha_fsid={[0x6, 0xf]}, {0x7, 0x9, 0x7, 0x5}}, 0x6, 0x0, '-\'\x00'}, {{@_ha_fsid={[0x800, 0x8]}, {0x6, 0x7, 0xa0, 0x80000000}}, 0x2, 0x0, 'filter\x00'}, {{@_ha_fsid={[0x9, 0x1]}, {0x2, 0xd6, 0x1, 0x8}}, 0x9, 0x0, 'team0\x00'}, {{@_ha_fsid={[0x4, 0x9]}, {0x0, 0x0, 0x343, 0x81}}, 0x9, 0x0, '\x00'}, {{@_ha_fsid={[0x5, 0x7bf32fb6]}, {0x4, 0x3, 0x1, 0x101}}, 0x9, 0x0, '\x00'}, {{@_ha_fsid={[0x7, 0x9]}, {0x4, 0x80, 0x9, 0x94a}}, 0xa1bb, 0x0, 'filter\x00'}]}}) sendmsg$IPCTNL_MSG_CT_NEW(r4, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000000c0)=ANY=[@ANYBLOB="74000000000101040000000000000000020000002400018014000180080001000000000008000200e00000020c0002800500010000000000240002800c00028005000100000000001400018008000100ac1e000108000200e000000208000740000000001000"], 0x74}}, 0x0) ioctl$ifreq_SIOCGIFINDEX_team(r3, 0x8933, &(0x7f0000000040)={'team0\x00', 0x0}) r6 = socket$inet_mptcp(0x2, 0x1, 0x106) getsockopt$inet_mreqsrc(r6, 0x0, 0x25, &(0x7f0000000000)={@multicast2, @dev, @empty}, &(0x7f0000000080)=0xc) getsockopt$SO_TIMESTAMP(r6, 0x1, 0x62, 0x0, &(0x7f0000000140)) socket$packet(0x11, 0x3, 0x300) r7 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r7, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)=[{&(0x7f0000000100)=ANY=[@ANYBLOB="18a7e437bc62447368f3000000030002070044d2ffff0000"], 0x18}], 0x1}, 0x0) r8 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000240)=ANY=[@ANYRESDEC=r3, @ANYRES32=r7, @ANYRES32=r4, @ANYRES8=r3, @ANYRESDEC=r4], 0x48) bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f00000007c0)={0x1b, 0x0, 0x0, 0x40000, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0}, 0x48) bpf$PROG_LOAD(0x5, &(0x7f0000000840)={0x10, 0x1c, &(0x7f0000000600)=ANY=[@ANYBLOB="1808000000000000000000000000000018110000", @ANYRESOCT, @ANYBLOB="0000000000000000b702000014000000b7030000000000008500000005000000bca900000000000035090100000020009500000000000000b7020000000000007b9af8ff00000000bd09020000000000dbaaf8fff1000000bf8200000000000007080000f8ffffffbfa420000000000007090000f0ffffffc70200000800000018220000", @ANYRES32=r8, @ANYBLOB="0000000000000000b7050000080000004608f1ff76000000bf9800000000000056080000000000008500000007000000b70000000000000095"], &(0x7f0000000980)='GPL\x00', 0x0, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, @sk_msg=0x7, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) sendmsg$nl_route(r3, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000580)={&(0x7f00000001c0)=ANY=[@ANYBLOB="54000000100003040007057007c78d9292cb", @ANYRES32=0x0, @ANYBLOB="00030000000000002c0012800b00010062726964676500001c00028008000500010000000500250001000000050029000000000008", @ANYRES32=r5], 0x54}, 0x1, 0x0, 0x0, 0x4}, 0x8044) kernel console output (not intermixed with test programs): 506][T24287] dump_stack_lvl+0xe8/0x150 [ 774.563538][T24287] should_fail_ex+0x412/0x560 [ 774.563569][T24287] should_failslab+0xa8/0x100 [ 774.563594][T24287] __kmalloc_cache_noprof+0x88/0x660 [ 774.563625][T24287] ? ip_set_pernet+0x23/0x240 [ 774.563718][T24287] ? ip_set_create+0x391/0x1a40 [ 774.563747][T24287] ip_set_create+0x391/0x1a40 [ 774.563776][T24287] ? trace_contention_end+0x3d/0x140 [ 774.563816][T24287] ? __pfx_ip_set_create+0x10/0x10 [ 774.563877][T24287] nfnetlink_rcv_msg+0xc03/0x12c0 [ 774.563903][T24287] ? __lock_acquire+0x6b5/0x2cf0 [ 774.563935][T24287] ? nfnetlink_rcv_msg+0x22a/0x12c0 [ 774.563980][T24287] ? __pfx_nfnetlink_rcv_msg+0x10/0x10 [ 774.564036][T24287] ? __lock_acquire+0x6b5/0x2cf0 [ 774.564082][T24287] netlink_rcv_skb+0x232/0x4b0 [ 774.564112][T24287] ? __pfx_nfnetlink_rcv_msg+0x10/0x10 [ 774.564138][T24287] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 774.564179][T24287] ? bpf_lsm_capable+0x9/0x20 [ 774.564202][T24287] ? security_capable+0x7e/0x2c0 [ 774.564243][T24287] nfnetlink_rcv+0x2c0/0x27b0 [ 774.564270][T24287] ? kernel_text_address+0xa5/0xe0 [ 774.564305][T24287] ? __kernel_text_address+0xd/0x30 [ 774.564336][T24287] ? unwind_get_return_address+0x4d/0x90 [ 774.564364][T24287] ? __pfx_stack_trace_consume_entry+0x10/0x10 [ 774.564399][T24287] ? arch_stack_walk+0xfb/0x150 [ 774.564441][T24287] ? stack_trace_save+0xa9/0x100 [ 774.564478][T24287] ? __lock_acquire+0x6b5/0x2cf0 [ 774.564503][T24287] ? __pfx_nfnetlink_rcv+0x10/0x10 [ 774.564534][T24287] ? kasan_save_track+0x4f/0x80 [ 774.564565][T24287] ? kasan_save_track+0x3e/0x80 [ 774.564594][T24287] ? __kasan_slab_alloc+0x6c/0x80 [ 774.564624][T24287] ? kmem_cache_alloc_node_noprof+0x384/0x690 [ 774.564652][T24287] ? __alloc_skb+0x27d/0x7d0 [ 774.564673][T24287] ? netlink_sendmsg+0x5d4/0xb40 [ 774.564707][T24287] ? __lock_acquire+0x6b5/0x2cf0 [ 774.564742][T24287] ? __netlink_lookup+0xc6/0x8b0 [ 774.564780][T24287] ? netlink_deliver_tap+0x2e/0x1b0 [ 774.564807][T24287] ? netlink_deliver_tap+0x2e/0x1b0 [ 774.564840][T24287] ? netlink_deliver_tap+0x2e/0x1b0 [ 774.564866][T24287] ? netlink_deliver_tap+0x2e/0x1b0 [ 774.564902][T24287] netlink_unicast+0x75c/0x8e0 [ 774.564947][T24287] netlink_sendmsg+0x813/0xb40 [ 774.564984][T24287] ? __pfx_netlink_sendmsg+0x10/0x10 [ 774.565017][T24287] ? aa_sock_msg_perm+0xf1/0x1b0 [ 774.565053][T24287] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 774.565088][T24287] ____sys_sendmsg+0x972/0x9f0 [ 774.565115][T24287] ? __might_fault+0xaf/0x130 [ 774.565152][T24287] ? __pfx_____sys_sendmsg+0x10/0x10 [ 774.565191][T24287] ? import_iovec+0x73/0xa0 [ 774.565222][T24287] ___sys_sendmsg+0x2a5/0x360 [ 774.565247][T24287] ? __lock_acquire+0x6b5/0x2cf0 [ 774.565276][T24287] ? __pfx____sys_sendmsg+0x10/0x10 [ 774.565345][T24287] ? __fget_files+0x2a/0x420 [ 774.565373][T24287] ? __fget_files+0x3a0/0x420 [ 774.565413][T24287] __x64_sys_sendmsg+0x1bd/0x2a0 [ 774.565444][T24287] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 774.565483][T24287] ? __pfx_ksys_write+0x10/0x10 [ 774.565526][T24287] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 774.565552][T24287] do_syscall_64+0x174/0x580 [ 774.565574][T24287] ? trace_irq_disable+0x3b/0x140 [ 774.565608][T24287] ? clear_bhb_loop+0x40/0x90 [ 774.565637][T24287] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 774.565661][T24287] RIP: 0033:0x7f4382d9ce59 [ 774.565684][T24287] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 774.565705][T24287] RSP: 002b:00007f4383bcb028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 774.565729][T24287] RAX: ffffffffffffffda RBX: 00007f4383015fa0 RCX: 00007f4382d9ce59 [ 774.565745][T24287] RDX: 0000000020004000 RSI: 0000200000000540 RDI: 0000000000000004 [ 774.565759][T24287] RBP: 00007f4383bcb090 R08: 0000000000000000 R09: 0000000000000000 [ 774.565774][T24287] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 774.565786][T24287] R13: 00007f4383016038 R14: 00007f4383015fa0 R15: 00007fffaffa0d38 [ 774.565823][T24287] [ 775.326009][ T5635] Bluetooth: hci0: command tx timeout [ 775.432562][T24297] __nla_validate_parse: 1 callbacks suppressed [ 775.432586][T24297] netlink: 8 bytes leftover after parsing attributes in process `syz.1.5712'. [ 775.449939][T24297] netlink: 24 bytes leftover after parsing attributes in process `syz.1.5712'. [ 775.461177][T24297] netlink: 8 bytes leftover after parsing attributes in process `syz.1.5712'. [ 775.477068][T24297] netlink: 24 bytes leftover after parsing attributes in process `syz.1.5712'. [ 775.858639][T24314] netlink: 8 bytes leftover after parsing attributes in process `syz.3.5716'. [ 776.041138][T24301] netlink: 8 bytes leftover after parsing attributes in process `syz.0.5713'. [ 776.069894][T24320] bridge0: port 1(bridge_slave_0) entered disabled state [ 776.091259][T24322] netlink: 'syz.1.5718': attribute type 1 has an invalid length. [ 776.116393][T24322] netlink: 224 bytes leftover after parsing attributes in process `syz.1.5718'. [ 776.151534][T24320] bridge_slave_0 (unregistering): left allmulticast mode [ 776.197769][T24320] bridge_slave_0 (unregistering): left promiscuous mode [ 776.226893][T24320] bridge0: port 1(bridge_slave_0) entered disabled state [ 776.290109][T24230] bridge0: port 1(bridge_slave_0) entered blocking state [ 776.313604][T24230] bridge0: port 1(bridge_slave_0) entered disabled state [ 776.357705][T24230] bridge_slave_0: entered allmulticast mode [ 776.385101][T24230] bridge_slave_0: entered promiscuous mode [ 776.409377][T24230] bridge0: port 2(bridge_slave_1) entered blocking state [ 776.418540][T24332] netlink: 8 bytes leftover after parsing attributes in process `syz.0.5721'. [ 776.429069][T24230] bridge0: port 2(bridge_slave_1) entered disabled state [ 776.437232][T24230] bridge_slave_1: entered allmulticast mode [ 776.445546][T24230] bridge_slave_1: entered promiscuous mode [ 776.496561][T24334] netlink: 64 bytes leftover after parsing attributes in process `syz.4.5722'. [ 776.524003][T24336] netlink: 64 bytes leftover after parsing attributes in process `syz.1.5723'. [ 776.558303][T24230] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 776.573148][T24334] netlink: 'syz.4.5722': attribute type 1 has an invalid length. [ 776.586343][T24230] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 776.639646][T24336] netlink: 'syz.1.5723': attribute type 1 has an invalid length. [ 776.712415][T24334] netlink: 'syz.4.5722': attribute type 3 has an invalid length. [ 776.823057][T24230] team0: Port device team_slave_0 added [ 776.884189][T24336] netlink: 'syz.1.5723': attribute type 3 has an invalid length. [ 776.964093][T24338] 8021q: adding VLAN 0 to HW filter on device bond14 [ 777.004912][T24338] bond13: (slave bond14): making interface the new active one [ 777.055205][T24338] bond13: (slave bond14): Enslaving as an active interface with an up link [ 777.094993][T24230] team0: Port device team_slave_1 added [ 777.177497][T24336] 8021q: adding VLAN 0 to HW filter on device bond21 [ 777.187394][T24336] bond20: (slave bond21): making interface the new active one [ 777.196514][T24336] bond20: (slave bond21): Enslaving as an active interface with an up link [ 777.252029][T24230] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 777.272529][T24230] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 777.320574][T24230] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 777.339401][T24359] netlink: 'syz.4.5729': attribute type 1 has an invalid length. [ 777.358500][T24230] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 777.380811][T24230] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 777.407371][ T5635] Bluetooth: hci0: command tx timeout [ 777.420318][T24364] FAULT_INJECTION: forcing a failure. [ 777.420318][T24364] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 777.442008][T24230] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 777.453761][T24364] CPU: 0 UID: 0 PID: 24364 Comm: syz.0.5730 Not tainted syzkaller #0 PREEMPT(full) [ 777.453792][T24364] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 777.453807][T24364] Call Trace: [ 777.453817][T24364] [ 777.453827][T24364] dump_stack_lvl+0xe8/0x150 [ 777.453858][T24364] should_fail_ex+0x412/0x560 [ 777.453888][T24364] _copy_from_iter+0x1d3/0x1670 [ 777.453917][T24364] ? rcu_is_watching+0x15/0xb0 [ 777.453950][T24364] ? __pfx__copy_from_iter+0x10/0x10 [ 777.453983][T24364] ? netlink_sendmsg+0x650/0xb40 [ 777.454009][T24364] ? skb_put+0x11b/0x210 [ 777.454037][T24364] netlink_sendmsg+0x6c0/0xb40 [ 777.454073][T24364] ? __pfx_netlink_sendmsg+0x10/0x10 [ 777.454102][T24364] ? aa_sock_msg_perm+0xf1/0x1b0 [ 777.454138][T24364] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 777.454173][T24364] ____sys_sendmsg+0x972/0x9f0 [ 777.454203][T24364] ? __might_fault+0xaf/0x130 [ 777.454240][T24364] ? __pfx_____sys_sendmsg+0x10/0x10 [ 777.454284][T24364] ? import_iovec+0x73/0xa0 [ 777.454313][T24364] ___sys_sendmsg+0x2a5/0x360 [ 777.454338][T24364] ? __lock_acquire+0x6b5/0x2cf0 [ 777.454365][T24364] ? __pfx____sys_sendmsg+0x10/0x10 [ 777.454399][T24364] ? kstrtouint+0x6e/0xe0 [ 777.454460][T24364] ? __fget_files+0x2a/0x420 [ 777.454487][T24364] ? __fget_files+0x3a0/0x420 [ 777.454526][T24364] __sys_sendmmsg+0x27c/0x4e0 [ 777.454558][T24364] ? __pfx___sys_sendmmsg+0x10/0x10 [ 777.454582][T24364] ? __mutex_unlock_slowpath+0x1be/0x6f0 [ 777.454634][T24364] ? ksys_write+0x242/0x270 [ 777.454668][T24364] ? __pfx_ksys_write+0x10/0x10 [ 777.454709][T24364] __x64_sys_sendmmsg+0xa0/0xc0 [ 777.454736][T24364] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 777.454760][T24364] do_syscall_64+0x174/0x580 [ 777.454784][T24364] ? trace_irq_disable+0x3b/0x140 [ 777.454818][T24364] ? clear_bhb_loop+0x40/0x90 [ 777.454846][T24364] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 777.454868][T24364] RIP: 0033:0x7f3ccd99ce59 [ 777.454889][T24364] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 777.454908][T24364] RSP: 002b:00007f3cce8fd028 EFLAGS: 00000246 ORIG_RAX: 0000000000000133 [ 777.454932][T24364] RAX: ffffffffffffffda RBX: 00007f3ccdc15fa0 RCX: 00007f3ccd99ce59 [ 777.454949][T24364] RDX: 040000000000009f RSI: 00002000000002c0 RDI: 0000000000000003 [ 777.454964][T24364] RBP: 00007f3cce8fd090 R08: 0000000000000000 R09: 0000000000000000 [ 777.454978][T24364] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 777.454992][T24364] R13: 00007f3ccdc16038 R14: 00007f3ccdc15fa0 R15: 00007fff5267ffb8 [ 777.455028][T24364] [ 777.750315][T24230] hsr_slave_0: entered promiscuous mode [ 777.757338][T24230] hsr_slave_1: entered promiscuous mode [ 777.817078][T24359] netlink: 'syz.4.5729': attribute type 3 has an invalid length. [ 777.826564][T24372] netlink: 'syz.3.5732': attribute type 1 has an invalid length. [ 777.881646][T24363] syzkaller1: entered promiscuous mode [ 777.890563][T24363] syzkaller1: entered allmulticast mode [ 777.938948][T24360] 8021q: adding VLAN 0 to HW filter on device bond16 [ 777.978834][T24360] bond15: (slave bond16): making interface the new active one [ 778.004579][T24360] bond15: (slave bond16): Enslaving as an active interface with an up link [ 778.190911][T24387] syz_tun: entered allmulticast mode [ 778.236690][T24389] ip6_tunnel: non-ECT from fc02:0000:0000:0000:0000:0000:0000:0000 with DS=0x1 [ 778.323896][T24383] syz_tun (unregistering): left allmulticast mode [ 778.800297][T24230] netdevsim netdevsim2 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 778.971261][T24413] netlink: 'syz.1.5743': attribute type 1 has an invalid length. [ 779.361394][T24230] netdevsim netdevsim2 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 779.492859][ T5635] Bluetooth: hci0: command tx timeout [ 779.498826][T24432] xfrm0: entered allmulticast mode [ 779.653185][T24230] netdevsim netdevsim2 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 779.677031][T24439] bridge: RTM_NEWNEIGH with invalid state 0x0 [ 779.698664][T24439] netlink: 'syz.4.5752': attribute type 1 has an invalid length. [ 779.789717][T24230] netdevsim netdevsim2 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 780.025138][T24446] gretap2: entered allmulticast mode [ 780.056240][T24446] bond17: (slave gretap2): making interface the new active one [ 780.085341][T24446] bond17: (slave gretap2): Enslaving as an active interface with an up link [ 780.321768][T24230] netdevsim netdevsim2 netdevsim0: renamed from eth0 [ 780.363510][T24230] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 780.379031][T24230] netdevsim netdevsim2 netdevsim1: renamed from eth1 [ 780.392642][T24230] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 780.412133][T24230] netdevsim netdevsim2 netdevsim2: renamed from eth2 [ 780.437989][T24230] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 780.455521][T24230] netdevsim netdevsim2 netdevsim3: renamed from eth3 [ 780.479246][T24230] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 780.499337][T24457] bond0: (slave ipvlan0): enslaved VLAN challenged slave. Adding VLANs will be blocked as long as it is part of bond. [ 780.517045][T24457] bond0: (slave ipvlan0): The slave device specified does not support setting the MAC address [ 780.605736][T24467] __nla_validate_parse: 19 callbacks suppressed [ 780.605760][T24467] netlink: 24 bytes leftover after parsing attributes in process `syz.1.5762'. [ 780.718931][T24468] macsec1: entered promiscuous mode [ 780.741621][T24230] 8021q: adding VLAN 0 to HW filter on device bond0 [ 780.776385][T24230] 8021q: adding VLAN 0 to HW filter on device team0 [ 780.793686][T10159] bridge0: port 1(bridge_slave_0) entered blocking state [ 780.800973][T10159] bridge0: port 1(bridge_slave_0) entered forwarding state [ 780.821608][ T37] bridge0: port 2(bridge_slave_1) entered blocking state [ 780.828941][ T37] bridge0: port 2(bridge_slave_1) entered forwarding state [ 780.984995][T24472] netlink: 8 bytes leftover after parsing attributes in process `syz.3.5764'. [ 780.997377][T24472] netlink: 4 bytes leftover after parsing attributes in process `syz.3.5764'. [ 781.566397][ T5635] Bluetooth: hci0: command tx timeout [ 781.632925][T24503] netlink: 8 bytes leftover after parsing attributes in process `syz.0.5774'. [ 781.711355][T24503] xt_l2tp: invalid flags combination: 8 [ 782.473965][T24230] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 782.488548][T24525] validate_nla: 5 callbacks suppressed [ 782.488568][T24525] netlink: 'syz.4.5780': attribute type 1 has an invalid length. [ 782.550189][T24531] netlink: 52 bytes leftover after parsing attributes in process `syz.4.5780'. [ 782.623989][T24525] bond18: entered promiscuous mode [ 782.630499][T24525] 8021q: adding VLAN 0 to HW filter on device bond18 [ 782.730932][T24230] veth0_vlan: entered promiscuous mode [ 782.780531][T24230] veth1_vlan: entered promiscuous mode [ 782.843953][T24230] veth0_macvtap: entered promiscuous mode [ 782.873867][T24230] veth1_macvtap: entered promiscuous mode [ 782.927830][T24230] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 782.951452][T24230] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 782.990916][ T76] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 783.012222][ T76] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 783.034120][ T76] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 783.052330][ T76] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 783.081120][T24551] FAULT_INJECTION: forcing a failure. [ 783.081120][T24551] name failslab, interval 1, probability 0, space 0, times 0 [ 783.111084][T24551] CPU: 0 UID: 0 PID: 24551 Comm: syz.4.5786 Not tainted syzkaller #0 PREEMPT(full) [ 783.111114][T24551] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 783.111128][T24551] Call Trace: [ 783.111137][T24551] [ 783.111146][T24551] dump_stack_lvl+0xe8/0x150 [ 783.111178][T24551] should_fail_ex+0x412/0x560 [ 783.111208][T24551] should_failslab+0xa8/0x100 [ 783.111237][T24551] kmem_cache_alloc_node_noprof+0x8f/0x690 [ 783.111270][T24551] ? __alloc_skb+0x186/0x7d0 [ 783.111292][T24551] ? __alloc_skb+0x1d0/0x7d0 [ 783.111311][T24551] ? __local_bh_enable_ip+0xd0/0x130 [ 783.111339][T24551] __alloc_skb+0x1d0/0x7d0 [ 783.111376][T24551] netlink_sendmsg+0x5d4/0xb40 [ 783.111414][T24551] ? __pfx_netlink_sendmsg+0x10/0x10 [ 783.111444][T24551] ? aa_sock_msg_perm+0xf1/0x1b0 [ 783.111478][T24551] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 783.111514][T24551] ____sys_sendmsg+0x972/0x9f0 [ 783.111540][T24551] ? __might_fault+0xaf/0x130 [ 783.111577][T24551] ? __pfx_____sys_sendmsg+0x10/0x10 [ 783.111613][T24551] ? import_iovec+0x73/0xa0 [ 783.111644][T24551] ___sys_sendmsg+0x2a5/0x360 [ 783.111669][T24551] ? __lock_acquire+0x6b5/0x2cf0 [ 783.111698][T24551] ? __pfx____sys_sendmsg+0x10/0x10 [ 783.111763][T24551] ? __fget_files+0x2a/0x420 [ 783.111790][T24551] ? __fget_files+0x3a0/0x420 [ 783.111829][T24551] __x64_sys_sendmsg+0x1bd/0x2a0 [ 783.111858][T24551] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 783.111897][T24551] ? __pfx_ksys_write+0x10/0x10 [ 783.111939][T24551] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 783.111964][T24551] do_syscall_64+0x174/0x580 [ 783.111988][T24551] ? trace_irq_disable+0x3b/0x140 [ 783.112021][T24551] ? clear_bhb_loop+0x40/0x90 [ 783.112050][T24551] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 783.112072][T24551] RIP: 0033:0x7f94a3d9ce59 [ 783.112093][T24551] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 783.112113][T24551] RSP: 002b:00007f94a4bb5028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 783.112137][T24551] RAX: ffffffffffffffda RBX: 00007f94a4016090 RCX: 00007f94a3d9ce59 [ 783.112154][T24551] RDX: 0000000002000800 RSI: 0000200000000000 RDI: 0000000000000006 [ 783.112170][T24551] RBP: 00007f94a4bb5090 R08: 0000000000000000 R09: 0000000000000000 [ 783.112184][T24551] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 783.112198][T24551] R13: 00007f94a4016128 R14: 00007f94a4016090 R15: 00007fffbee4ec28 [ 783.112233][T24551] [ 783.389429][T24550] netlink: 8 bytes leftover after parsing attributes in process `syz.1.5787'. [ 783.449964][ T1181] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 783.484094][T24553] xt_l2tp: invalid flags combination: 8 [ 783.502157][ T1181] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 783.865151][T24573] netlink: 8 bytes leftover after parsing attributes in process `syz.4.5791'. [ 783.925564][ T1165] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 783.938224][ T1165] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 784.109847][T24579] netlink: 12 bytes leftover after parsing attributes in process `syz.4.5792'. [ 784.196930][T24579] FAULT_INJECTION: forcing a failure. [ 784.196930][T24579] name failslab, interval 1, probability 0, space 0, times 0 [ 784.223365][T24585] FAULT_INJECTION: forcing a failure. [ 784.223365][T24585] name failslab, interval 1, probability 0, space 0, times 0 [ 784.266082][T24579] CPU: 1 UID: 0 PID: 24579 Comm: syz.4.5792 Not tainted syzkaller #0 PREEMPT(full) [ 784.266114][T24579] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 784.266129][T24579] Call Trace: [ 784.266138][T24579] [ 784.266148][T24579] dump_stack_lvl+0xe8/0x150 [ 784.266181][T24579] should_fail_ex+0x412/0x560 [ 784.266217][T24579] should_failslab+0xa8/0x100 [ 784.266241][T24579] ? skb_clone+0x212/0x3a0 [ 784.266269][T24579] kmem_cache_alloc_noprof+0x87/0x650 [ 784.266311][T24579] skb_clone+0x212/0x3a0 [ 784.266344][T24579] __netlink_deliver_tap+0x404/0x850 [ 784.266387][T24579] ? netlink_deliver_tap+0x2e/0x1b0 [ 784.266416][T24579] netlink_deliver_tap+0x19c/0x1b0 [ 784.266446][T24579] netlink_sendskb+0x68/0x140 [ 784.266473][T24579] netlink_rcv_skb+0x2b6/0x4b0 [ 784.266502][T24579] ? __pfx_genl_rcv_msg+0x10/0x10 [ 784.266537][T24579] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 784.266582][T24579] ? down_read+0x270/0x2e0 [ 784.266608][T24579] ? genl_rcv+0xd/0x40 [ 784.266642][T24579] genl_rcv+0x28/0x40 [ 784.266673][T24579] netlink_unicast+0x75c/0x8e0 [ 784.266719][T24579] netlink_sendmsg+0x813/0xb40 [ 784.266758][T24579] ? __pfx_netlink_sendmsg+0x10/0x10 [ 784.266789][T24579] ? aa_sock_msg_perm+0xf1/0x1b0 [ 784.266827][T24579] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 784.266862][T24579] ____sys_sendmsg+0x972/0x9f0 [ 784.266889][T24579] ? __might_fault+0xaf/0x130 [ 784.266928][T24579] ? __pfx_____sys_sendmsg+0x10/0x10 [ 784.266966][T24579] ? import_iovec+0x73/0xa0 [ 784.266999][T24579] ___sys_sendmsg+0x2a5/0x360 [ 784.267025][T24579] ? __lock_acquire+0x6b5/0x2cf0 [ 784.267054][T24579] ? __pfx____sys_sendmsg+0x10/0x10 [ 784.267123][T24579] ? __fget_files+0x2a/0x420 [ 784.267151][T24579] ? __fget_files+0x3a0/0x420 [ 784.267192][T24579] __x64_sys_sendmsg+0x1bd/0x2a0 [ 784.267223][T24579] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 784.267262][T24579] ? __pfx_ksys_write+0x10/0x10 [ 784.267306][T24579] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 784.267332][T24579] do_syscall_64+0x174/0x580 [ 784.267358][T24579] ? trace_irq_disable+0x3b/0x140 [ 784.267392][T24579] ? clear_bhb_loop+0x40/0x90 [ 784.267421][T24579] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 784.267445][T24579] RIP: 0033:0x7f94a3d9ce59 [ 784.267466][T24579] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 784.267486][T24579] RSP: 002b:00007f94a4bb5028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 784.267511][T24579] RAX: ffffffffffffffda RBX: 00007f94a4016090 RCX: 00007f94a3d9ce59 [ 784.267528][T24579] RDX: 0000000000000000 RSI: 0000200000000180 RDI: 0000000000000003 [ 784.267542][T24579] RBP: 00007f94a4bb5090 R08: 0000000000000000 R09: 0000000000000000 [ 784.267557][T24579] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 784.267571][T24579] R13: 00007f94a4016128 R14: 00007f94a4016090 R15: 00007fffbee4ec28 [ 784.267606][T24579] [ 784.268042][T24585] CPU: 0 UID: 0 PID: 24585 Comm: syz.1.5794 Not tainted syzkaller #0 PREEMPT(full) [ 784.268069][T24585] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 784.268083][T24585] Call Trace: [ 784.268092][T24585] [ 784.268101][T24585] dump_stack_lvl+0xe8/0x150 [ 784.268127][T24585] should_fail_ex+0x412/0x560 [ 784.268155][T24585] should_failslab+0xa8/0x100 [ 784.268189][T24585] kmem_cache_alloc_node_noprof+0x8f/0x690 [ 784.268221][T24585] ? __alloc_skb+0x186/0x7d0 [ 784.268241][T24585] ? __alloc_skb+0x1d0/0x7d0 [ 784.268261][T24585] ? __local_bh_enable_ip+0xd0/0x130 [ 784.268287][T24585] __alloc_skb+0x1d0/0x7d0 [ 784.268315][T24585] netlink_sendmsg+0x5d4/0xb40 [ 784.268352][T24585] ? __pfx_netlink_sendmsg+0x10/0x10 [ 784.268384][T24585] ? aa_sock_msg_perm+0xf1/0x1b0 [ 784.268419][T24585] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 784.268453][T24585] ____sys_sendmsg+0x972/0x9f0 [ 784.268479][T24585] ? __might_fault+0xaf/0x130 [ 784.268516][T24585] ? __pfx_____sys_sendmsg+0x10/0x10 [ 784.268554][T24585] ? import_iovec+0x73/0xa0 [ 784.268585][T24585] ___sys_sendmsg+0x2a5/0x360 [ 784.268610][T24585] ? __lock_acquire+0x6b5/0x2cf0 [ 784.268639][T24585] ? __pfx____sys_sendmsg+0x10/0x10 [ 784.268703][T24585] ? __fget_files+0x2a/0x420 [ 784.268731][T24585] ? __fget_files+0x3a0/0x420 [ 784.268771][T24585] __x64_sys_sendmsg+0x1bd/0x2a0 [ 784.268801][T24585] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 784.268838][T24585] ? __pfx_ksys_write+0x10/0x10 [ 784.268881][T24585] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 784.268905][T24585] do_syscall_64+0x174/0x580 [ 784.268930][T24585] ? trace_irq_disable+0x3b/0x140 [ 784.268965][T24585] ? clear_bhb_loop+0x40/0x90 [ 784.268994][T24585] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 784.269017][T24585] RIP: 0033:0x7ff4aa99ce59 [ 784.269041][T24585] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 784.269061][T24585] RSP: 002b:00007ff4ab7de028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 784.269085][T24585] RAX: ffffffffffffffda RBX: 00007ff4aac15fa0 RCX: 00007ff4aa99ce59 [ 784.269102][T24585] RDX: 0000000000000000 RSI: 00002000000003c0 RDI: 0000000000000004 [ 784.269117][T24585] RBP: 00007ff4ab7de090 R08: 0000000000000000 R09: 0000000000000000 [ 784.269132][T24585] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 784.269146][T24585] R13: 00007ff4aac16038 R14: 00007ff4aac15fa0 R15: 00007fffee4ab8b8 [ 784.269189][T24585] [ 784.872092][T24589] netlink: 8 bytes leftover after parsing attributes in process `syz.4.5797'. [ 785.035115][T24596] FAULT_INJECTION: forcing a failure. [ 785.035115][T24596] name failslab, interval 1, probability 0, space 0, times 0 [ 785.072023][T24596] CPU: 1 UID: 0 PID: 24596 Comm: syz.0.5798 Not tainted syzkaller #0 PREEMPT(full) [ 785.072057][T24596] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 785.072072][T24596] Call Trace: [ 785.072082][T24596] [ 785.072092][T24596] dump_stack_lvl+0xe8/0x150 [ 785.072125][T24596] should_fail_ex+0x412/0x560 [ 785.072156][T24596] should_failslab+0xa8/0x100 [ 785.072182][T24596] __kmalloc_noprof+0xe8/0x760 [ 785.072217][T24596] ? bpf_test_init+0x9f/0x150 [ 785.072242][T24596] ? __lock_acquire+0x6b5/0x2cf0 [ 785.072271][T24596] bpf_test_init+0x9f/0x150 [ 785.072301][T24596] bpf_prog_test_run_skb+0x392/0x2260 [ 785.072352][T24596] ? __fget_files+0x3a0/0x420 [ 785.072379][T24596] ? __fget_files+0x2a/0x420 [ 785.072413][T24596] ? __pfx_bpf_prog_test_run_skb+0x10/0x10 [ 785.072440][T24596] bpf_prog_test_run+0x2c7/0x340 [ 785.072467][T24596] __sys_bpf+0x643/0x950 [ 785.072504][T24596] ? __pfx___sys_bpf+0x10/0x10 [ 785.072565][T24596] ? ksys_write+0x242/0x270 [ 785.072600][T24596] ? __pfx_ksys_write+0x10/0x10 [ 785.072639][T24596] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 785.072668][T24596] __x64_sys_bpf+0x7c/0x90 [ 785.072700][T24596] do_syscall_64+0x174/0x580 [ 785.072727][T24596] ? clear_bhb_loop+0x40/0x90 [ 785.072755][T24596] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 785.072778][T24596] RIP: 0033:0x7f3ccd99ce59 [ 785.072799][T24596] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 785.072819][T24596] RSP: 002b:00007f3cce8fd028 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 785.072843][T24596] RAX: ffffffffffffffda RBX: 00007f3ccdc15fa0 RCX: 00007f3ccd99ce59 [ 785.072861][T24596] RDX: 0000000000000050 RSI: 0000200000000480 RDI: 000000000000000a [ 785.072875][T24596] RBP: 00007f3cce8fd090 R08: 0000000000000000 R09: 0000000000000000 [ 785.072890][T24596] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 785.072903][T24596] R13: 00007f3ccdc16038 R14: 00007f3ccdc15fa0 R15: 00007fff5267ffb8 [ 785.072940][T24596] [ 785.209546][ T50] Bluetooth: hci5: unexpected cc 0x0c03 length: 249 > 1 [ 785.296662][ T50] Bluetooth: hci5: unexpected cc 0x1003 length: 249 > 9 [ 785.308644][ T50] Bluetooth: hci5: unexpected cc 0x1001 length: 249 > 9 [ 785.316747][ T50] Bluetooth: hci5: unexpected cc 0x0c23 length: 249 > 4 [ 785.324567][ T50] Bluetooth: hci5: unexpected cc 0x0c38 length: 249 > 2 [ 785.454029][T24603] netlink: 8 bytes leftover after parsing attributes in process `syz.0.5801'. [ 786.098672][T24619] netlink: 8 bytes leftover after parsing attributes in process `syz.4.5804'. [ 786.193766][T24619] xt_l2tp: invalid flags combination: 8 [ 786.235458][T24622] FAULT_INJECTION: forcing a failure. [ 786.235458][T24622] name failslab, interval 1, probability 0, space 0, times 0 [ 786.287350][T24622] CPU: 1 UID: 0 PID: 24622 Comm: syz.2.5806 Not tainted syzkaller #0 PREEMPT(full) [ 786.287381][T24622] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 786.287396][T24622] Call Trace: [ 786.287405][T24622] [ 786.287416][T24622] dump_stack_lvl+0xe8/0x150 [ 786.287447][T24622] should_fail_ex+0x412/0x560 [ 786.287477][T24622] should_failslab+0xa8/0x100 [ 786.287503][T24622] kmem_cache_alloc_node_noprof+0x8f/0x690 [ 786.287534][T24622] ? __alloc_skb+0x186/0x7d0 [ 786.287557][T24622] ? __alloc_skb+0x1d0/0x7d0 [ 786.287577][T24622] ? __local_bh_enable_ip+0xd0/0x130 [ 786.287605][T24622] __alloc_skb+0x1d0/0x7d0 [ 786.287628][T24622] ? bpf_lsm_socket_getpeersec_dgram+0x9/0x20 [ 786.287665][T24622] netlink_sendmsg+0x5d4/0xb40 [ 786.287701][T24622] ? __pfx_netlink_sendmsg+0x10/0x10 [ 786.287733][T24622] ? aa_sock_msg_perm+0xf1/0x1b0 [ 786.287767][T24622] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 786.287800][T24622] ____sys_sendmsg+0x972/0x9f0 [ 786.287826][T24622] ? __might_fault+0xaf/0x130 [ 786.287862][T24622] ? __pfx_____sys_sendmsg+0x10/0x10 [ 786.287898][T24622] ? import_iovec+0x73/0xa0 [ 786.287930][T24622] ___sys_sendmsg+0x2a5/0x360 [ 786.287954][T24622] ? __lock_acquire+0x6b5/0x2cf0 [ 786.287984][T24622] ? __pfx____sys_sendmsg+0x10/0x10 [ 786.288055][T24622] ? __fget_files+0x2a/0x420 [ 786.288087][T24622] ? __fget_files+0x3a0/0x420 [ 786.288125][T24622] __x64_sys_sendmsg+0x1bd/0x2a0 [ 786.288156][T24622] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 786.288192][T24622] ? __pfx_ksys_write+0x10/0x10 [ 786.288235][T24622] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 786.288260][T24622] do_syscall_64+0x174/0x580 [ 786.288284][T24622] ? trace_irq_disable+0x3b/0x140 [ 786.288317][T24622] ? clear_bhb_loop+0x40/0x90 [ 786.288345][T24622] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 786.288367][T24622] RIP: 0033:0x7f1068d9ce59 [ 786.288388][T24622] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 786.288407][T24622] RSP: 002b:00007f1069c8c028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 786.288431][T24622] RAX: ffffffffffffffda RBX: 00007f1069015fa0 RCX: 00007f1068d9ce59 [ 786.288448][T24622] RDX: 0000000000000000 RSI: 0000200000000000 RDI: 0000000000000003 [ 786.288462][T24622] RBP: 00007f1069c8c090 R08: 0000000000000000 R09: 0000000000000000 [ 786.288477][T24622] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 786.288490][T24622] R13: 00007f1069016038 R14: 00007f1069015fa0 R15: 00007ffe7692eff8 [ 786.288525][T24622] [ 786.778228][T24631] netlink: 8 bytes leftover after parsing attributes in process `syz.2.5810'. [ 786.813123][T24634] xt_hashlimit: size too large, truncated to 1048576 [ 786.859800][T24637] netlink: 4 bytes leftover after parsing attributes in process `syz.0.5812'. [ 786.949842][T24637] xt_TCPMSS: Only works on TCP SYN packets [ 787.032684][T24646] netlink: 'syz.2.5813': attribute type 29 has an invalid length. [ 787.111603][T24637] veth0_virt_wifi: left allmulticast mode [ 787.126946][T24637] veth0_virt_wifi: left promiscuous mode [ 787.144898][T24637] bridge0: port 3(veth0_virt_wifi) entered disabled state [ 787.184431][T24637] bridge_slave_1: left allmulticast mode [ 787.234504][T24637] bridge_slave_1: left promiscuous mode [ 787.246859][T24637] bridge0: port 2(bridge_slave_1) entered disabled state [ 787.273693][T24637] bridge_slave_0: left allmulticast mode [ 787.280967][T24637] bridge_slave_0: left promiscuous mode [ 787.296456][T24637] bridge0: port 1(bridge_slave_0) entered disabled state [ 787.323013][T24652] netlink: 8 bytes leftover after parsing attributes in process `syz.3.5815'. [ 787.407290][ T50] Bluetooth: hci5: command tx timeout [ 787.499778][T24656] netlink: 8 bytes leftover after parsing attributes in process `syz.0.5817'. [ 787.713217][T24661] tipc: Enabled bearer , priority 0 [ 787.739496][T24664] netlink: 8 bytes leftover after parsing attributes in process `syz.0.5820'. [ 787.782672][T24661] mac80211_hwsim hwsim36 syzkaller0: entered promiscuous mode [ 787.794202][T24661] mac80211_hwsim hwsim36 syzkaller0: entered allmulticast mode [ 787.804154][T24664] xt_l2tp: invalid flags combination: 8 [ 787.810842][T24665] sch_tbf: burst 255 is lower than device syzkaller0 mtu (1514) ! [ 787.858015][T24661] tipc: Resetting bearer [ 788.045365][T24673] netlink: 8 bytes leftover after parsing attributes in process `syz.0.5822'. [ 788.064019][T24674] netlink: 9 bytes leftover after parsing attributes in process `syz.2.5824'. [ 788.117473][T24674] gretap0: entered promiscuous mode [ 788.139694][T24677] netlink: 5 bytes leftover after parsing attributes in process `syz.2.5824'. [ 788.265354][T24677] 0ªî{X¹¦: renamed from gretap0 [ 788.290823][T24677] 0ªî{X¹¦: left promiscuous mode [ 788.300081][T24677] 0ªî{X¹¦: entered allmulticast mode [ 788.312253][T24687] netlink: 'syz.3.5827': attribute type 5 has an invalid length. [ 788.322161][T24677] A link change request failed with some changes committed already. Interface 30ªî{X¹¦ may have been left with an inconsistent configuration, please check. [ 788.374378][T24690] netlink: 620 bytes leftover after parsing attributes in process `syz.0.5829'. [ 788.391793][T24598] bridge0: port 1(bridge_slave_0) entered blocking state [ 788.401145][T24598] bridge0: port 1(bridge_slave_0) entered disabled state [ 788.411542][T24598] bridge_slave_0: entered allmulticast mode [ 788.420855][T24598] bridge_slave_0: entered promiscuous mode [ 788.430164][T24598] bridge0: port 2(bridge_slave_1) entered blocking state [ 788.438544][T24598] bridge0: port 2(bridge_slave_1) entered disabled state [ 788.447324][T24598] bridge_slave_1: entered allmulticast mode [ 788.459444][T24598] bridge_slave_1: entered promiscuous mode [ 788.547742][T24598] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 788.570414][T24598] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 788.586251][T24696] xt_l2tp: invalid flags combination: 8 [ 788.636939][T24598] team0: Port device team_slave_0 added [ 788.648951][T24598] team0: Port device team_slave_1 added [ 788.707915][T24598] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 788.714996][T24598] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 788.742566][T24598] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 788.785060][T24598] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 788.803594][T24598] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 788.854252][T24598] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 788.968951][T24598] hsr_slave_0: entered promiscuous mode [ 788.988022][T24598] hsr_slave_1: entered promiscuous mode [ 788.994612][T24598] debugfs: 'hsr0' already exists in 'hsr' [ 789.010789][T24598] Cannot create hsr debugfs directory [ 789.388716][T24722] netlink: 'syz.4.5842': attribute type 1 has an invalid length. [ 789.485993][ T50] Bluetooth: hci5: command tx timeout [ 789.628910][T24734] netlink: 'syz.4.5847': attribute type 1 has an invalid length. [ 789.680934][T24737] IPVS: Schedule: port zero only supported in persistent services, check your ipvs configuration [ 789.732519][T24598] netdevsim netdevsim1 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 789.995870][T24750] netlink: 'syz.4.5849': attribute type 4 has an invalid length. [ 790.069377][T24598] netdevsim netdevsim1 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 790.249970][T24598] netdevsim netdevsim1 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 790.443620][T24598] netdevsim netdevsim1 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 790.487662][T24766] netlink: 'syz.4.5856': attribute type 1 has an invalid length. [ 791.217817][T24791] __nla_validate_parse: 17 callbacks suppressed [ 791.217842][T24791] netlink: 12 bytes leftover after parsing attributes in process `syz.3.5863'. [ 791.233546][T24598] netdevsim netdevsim1 netdevsim0: renamed from eth0 [ 791.253835][T24598] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 791.271511][T24791] xfrm1: entered promiscuous mode [ 791.277058][T24791] xfrm1: entered allmulticast mode [ 791.282892][T24598] netdevsim netdevsim1 netdevsim1: renamed from eth1 [ 791.290188][T24791] netlink: 12 bytes leftover after parsing attributes in process `syz.3.5863'. [ 791.303935][T24598] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 791.322533][T24598] netdevsim netdevsim1 netdevsim2: renamed from eth2 [ 791.358323][T24598] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 791.379727][T24598] netdevsim netdevsim1 netdevsim3: renamed from eth3 [ 791.444506][T24800] netlink: 4 bytes leftover after parsing attributes in process `syz.3.5866'. [ 791.455262][T24598] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 791.566017][ T50] Bluetooth: hci5: command tx timeout [ 791.629854][T24808] netlink: 'syz.3.5866': attribute type 1 has an invalid length. [ 791.638029][T24808] netlink: 36 bytes leftover after parsing attributes in process `syz.3.5866'. [ 791.682011][T24800] netlink: 8 bytes leftover after parsing attributes in process `syz.3.5866'. [ 791.696172][T24800] bridge: RTM_NEWNEIGH with invalid state 0x0 [ 791.852093][T24598] 8021q: adding VLAN 0 to HW filter on device bond0 [ 791.910082][T24598] 8021q: adding VLAN 0 to HW filter on device team0 [ 791.952747][T10158] bridge0: port 1(bridge_slave_0) entered blocking state [ 791.960076][T10158] bridge0: port 1(bridge_slave_0) entered forwarding state [ 791.982490][T10158] bridge0: port 2(bridge_slave_1) entered blocking state [ 791.989877][T10158] bridge0: port 2(bridge_slave_1) entered forwarding state [ 792.026359][ T995] IPVS: starting estimator thread 0... [ 792.052572][T24816] bridge0: port 1(bridge_slave_0) entered disabled state [ 792.090833][T24821] netlink: 'syz.2.5869': attribute type 1 has an invalid length. [ 792.116047][T24821] netlink: 224 bytes leftover after parsing attributes in process `syz.2.5869'. [ 792.129319][T24818] IPVS: using max 26 ests per chain, 62400 per kthread [ 792.160529][T24816] bridge_slave_0 (unregistering): left allmulticast mode [ 792.176384][T24816] bridge_slave_0 (unregistering): left promiscuous mode [ 792.198772][T24816] bridge0: port 1(bridge_slave_0) entered disabled state [ 792.714912][T24842] xt_TCPMSS: Only works on TCP SYN packets [ 792.743269][T24844] sch_tbf: burst 2 is lower than device syzkaller0 mtu (313) ! [ 792.816697][T24844] tipc: Enabling of bearer rejected, already enabled [ 792.830832][T24844] netlink: 8 bytes leftover after parsing attributes in process `syz.3.5875'. [ 792.856854][T24844] netlink: 12 bytes leftover after parsing attributes in process `syz.3.5875'. [ 792.875668][T24844] netlink: 4 bytes leftover after parsing attributes in process `syz.3.5875'. [ 793.348088][T24866] netlink: 4 bytes leftover after parsing attributes in process `syz.4.5879'. [ 793.422187][T24866] bridge: RTM_NEWNEIGH with invalid state 0x0 [ 793.482389][T24866] netlink: 'syz.4.5879': attribute type 1 has an invalid length. [ 793.584859][T24598] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 793.646266][ T50] Bluetooth: hci5: command tx timeout [ 793.716067][T24876] netlink: 'syz.3.5884': attribute type 1 has an invalid length. [ 793.779475][T24876] bond13: entered promiscuous mode [ 793.785175][T24876] 8021q: adding VLAN 0 to HW filter on device bond13 [ 793.810313][T24877] netlink: 'syz.4.5883': attribute type 1 has an invalid length. [ 793.819120][T24598] veth0_vlan: entered promiscuous mode [ 793.842131][T24598] veth1_vlan: entered promiscuous mode [ 793.903361][T24598] veth0_macvtap: entered promiscuous mode [ 793.952921][T24598] veth1_macvtap: entered promiscuous mode [ 794.001754][T24872] IPVS: wrr: FWM 3 0x00000003 - no destination available [ 794.022151][T24598] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 794.047063][T24883] Bluetooth: MGMT ver 1.23 [ 794.080130][T24598] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 794.118844][ T1165] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 794.179226][ T1165] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 794.218820][ T1165] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 794.249074][ T1165] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 794.539654][ T76] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 794.571109][ T76] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 794.672217][T10157] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 794.703243][T10157] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 794.873734][T24912] netlink: 'syz.2.5894': attribute type 1 has an invalid length. [ 794.886498][T24909] mac80211_hwsim hwsim42 syzkaller0: left promiscuous mode [ 794.895384][T24909] mac80211_hwsim hwsim42 syzkaller0: left allmulticast mode [ 795.094020][T24924] netlink: 'syz.1.5896': attribute type 1 has an invalid length. [ 795.590630][T24949] xt_ecn: cannot match TCP bits for non-tcp packets [ 795.881239][T24956] ip6_tunnel: non-ECT from fc02:0000:0000:0000:0000:0000:0000:0000 with DS=0x1 [ 796.123532][T24962] xt_l2tp: invalid flags combination: 8 [ 796.320149][T24975] netlink: 'syz.4.5911': attribute type 1 has an invalid length. [ 796.342835][T24975] netlink: 'syz.4.5911': attribute type 11 has an invalid length. [ 796.368667][T24974] llcp: llcp_sock_recvmsg: Recv datagram failed state 4 -11 0 [ 796.372058][T24975] __nla_validate_parse: 17 callbacks suppressed [ 796.372082][T24975] netlink: 224 bytes leftover after parsing attributes in process `syz.4.5911'. [ 796.414664][T24978] bridge1: trying to set multicast query interval above maximum, setting to 8640000 (86400000ms) [ 796.466640][T24981] netlink: 12 bytes leftover after parsing attributes in process `syz.3.5914'. [ 796.478664][T24981] netlink: 24 bytes leftover after parsing attributes in process `syz.3.5914'. [ 796.950629][T24993] netlink: 4 bytes leftover after parsing attributes in process `syz.3.5919'. [ 797.177009][T24998] netlink: 212348 bytes leftover after parsing attributes in process `syz.1.5921'. [ 797.186975][T24998] FAULT_INJECTION: forcing a failure. [ 797.186975][T24998] name failslab, interval 1, probability 0, space 0, times 0 [ 797.201007][T24998] CPU: 1 UID: 0 PID: 24998 Comm: syz.1.5921 Not tainted syzkaller #0 PREEMPT(full) [ 797.201036][T24998] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 797.201051][T24998] Call Trace: [ 797.201061][T24998] [ 797.201071][T24998] dump_stack_lvl+0xe8/0x150 [ 797.201103][T24998] should_fail_ex+0x412/0x560 [ 797.201134][T24998] should_failslab+0xa8/0x100 [ 797.201160][T24998] kmem_cache_alloc_node_noprof+0x8f/0x690 [ 797.201192][T24998] ? kmem_cache_alloc_noprof+0x307/0x650 [ 797.201221][T24998] ? ovs_flow_alloc+0x24/0x1f0 [ 797.201358][T24998] ? ovs_flow_alloc+0x103/0x1f0 [ 797.201392][T24998] ovs_flow_alloc+0x103/0x1f0 [ 797.201423][T24998] ovs_packet_cmd_execute+0x585/0xea0 [ 797.201467][T24998] ? __pfx_ovs_packet_cmd_execute+0x10/0x10 [ 797.201503][T24998] ? genl_family_rcv_msg_attrs_parse+0x20b/0x2f0 [ 797.201537][T24998] ? genl_family_rcv_msg_attrs_parse+0x265/0x2f0 [ 797.201581][T24998] genl_family_rcv_msg_doit+0x22a/0x330 [ 797.201623][T24998] ? __pfx_genl_family_rcv_msg_doit+0x10/0x10 [ 797.201679][T24998] ? bpf_lsm_capable+0x9/0x20 [ 797.201701][T24998] ? security_capable+0x7e/0x2c0 [ 797.201740][T24998] genl_rcv_msg+0x61c/0x7a0 [ 797.201780][T24998] ? __pfx_genl_rcv_msg+0x10/0x10 [ 797.201812][T24998] ? __pfx_ovs_packet_cmd_execute+0x10/0x10 [ 797.201844][T24998] ? __pfx_ref_tracker_free+0x10/0x10 [ 797.201867][T24998] ? __asan_memcpy+0x40/0x70 [ 797.201894][T24998] ? __skb_clone+0x63/0x7a0 [ 797.201931][T24998] netlink_rcv_skb+0x232/0x4b0 [ 797.201959][T24998] ? __pfx_genl_rcv_msg+0x10/0x10 [ 797.201994][T24998] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 797.202040][T24998] ? down_read+0x270/0x2e0 [ 797.202066][T24998] ? genl_rcv+0xd/0x40 [ 797.202100][T24998] genl_rcv+0x28/0x40 [ 797.202130][T24998] netlink_unicast+0x75c/0x8e0 [ 797.202168][T24998] netlink_sendmsg+0x813/0xb40 [ 797.202207][T24998] ? __pfx_netlink_sendmsg+0x10/0x10 [ 797.202239][T24998] ? aa_sock_msg_perm+0xf1/0x1b0 [ 797.202275][T24998] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 797.202310][T24998] ____sys_sendmsg+0x972/0x9f0 [ 797.202337][T24998] ? __might_fault+0xaf/0x130 [ 797.202375][T24998] ? __pfx_____sys_sendmsg+0x10/0x10 [ 797.202413][T24998] ? import_iovec+0x73/0xa0 [ 797.202445][T24998] ___sys_sendmsg+0x2a5/0x360 [ 797.202470][T24998] ? __lock_acquire+0x6b5/0x2cf0 [ 797.202501][T24998] ? __pfx____sys_sendmsg+0x10/0x10 [ 797.202569][T24998] ? __fget_files+0x2a/0x420 [ 797.202598][T24998] ? __fget_files+0x3a0/0x420 [ 797.202638][T24998] __x64_sys_sendmsg+0x1bd/0x2a0 [ 797.202679][T24998] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 797.202717][T24998] ? __pfx_ksys_write+0x10/0x10 [ 797.202761][T24998] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 797.202787][T24998] do_syscall_64+0x174/0x580 [ 797.202811][T24998] ? trace_irq_disable+0x3b/0x140 [ 797.202845][T24998] ? clear_bhb_loop+0x40/0x90 [ 797.202873][T24998] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 797.202896][T24998] RIP: 0033:0x7f72e919ce59 [ 797.202918][T24998] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 797.202937][T24998] RSP: 002b:00007f72e73f6028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 797.202961][T24998] RAX: ffffffffffffffda RBX: 00007f72e9415fa0 RCX: 00007f72e919ce59 [ 797.202978][T24998] RDX: 0000000000000000 RSI: 0000200000000000 RDI: 0000000000000003 [ 797.202994][T24998] RBP: 00007f72e73f6090 R08: 0000000000000000 R09: 0000000000000000 [ 797.203008][T24998] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 797.203022][T24998] R13: 00007f72e9416038 R14: 00007f72e9415fa0 R15: 00007fff7500e838 [ 797.203058][T24998] [ 797.687176][T25000] netlink: 8 bytes leftover after parsing attributes in process `syz.4.5922'. [ 797.737388][T25000] netlink: 4 bytes leftover after parsing attributes in process `syz.4.5922'. [ 797.843366][T25006] netlink: 68 bytes leftover after parsing attributes in process `syz.4.5922'. [ 797.943651][T25009] netlink: 8 bytes leftover after parsing attributes in process `syz.1.5924'. [ 797.958279][T25009] netlink: 104 bytes leftover after parsing attributes in process `syz.1.5924'. [ 798.325929][T25022] xt_bpf: check failed: parse error [ 798.968759][T25050] netlink: 'syz.4.5930': attribute type 1 has an invalid length. [ 799.205769][T25054] 8021q: adding VLAN 0 to HW filter on device bond20 [ 799.282229][T25054] bond19: (slave bond20): making interface the new active one [ 799.322181][T25054] bond19: (slave bond20): Enslaving as an active interface with an up link [ 800.097445][T25090] FAULT_INJECTION: forcing a failure. [ 800.097445][T25090] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 800.120622][T25090] CPU: 0 UID: 0 PID: 25090 Comm: syz.0.5934 Not tainted syzkaller #0 PREEMPT(full) [ 800.120655][T25090] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 800.120671][T25090] Call Trace: [ 800.120680][T25090] [ 800.120691][T25090] dump_stack_lvl+0xe8/0x150 [ 800.120723][T25090] should_fail_ex+0x412/0x560 [ 800.120756][T25090] _copy_from_iter+0x1d3/0x1670 [ 800.120787][T25090] ? sock_alloc_send_pskb+0x896/0x990 [ 800.120825][T25090] ? __pfx__copy_from_iter+0x10/0x10 [ 800.120861][T25090] ? __pfx_sock_alloc_send_pskb+0x10/0x10 [ 800.120896][T25090] skb_copy_datagram_from_iter+0xf5/0x710 [ 800.120928][T25090] ? dev_get_by_index+0x22/0x2e0 [ 800.120959][T25090] ? skb_put+0x11b/0x210 [ 800.120988][T25090] packet_sendmsg+0x35b1/0x4fb0 [ 800.121039][T25090] ? __lock_acquire+0x6b5/0x2cf0 [ 800.121079][T25090] ? __lock_acquire+0x6b5/0x2cf0 [ 800.121129][T25090] ? __pfx_packet_sendmsg+0x10/0x10 [ 800.121154][T25090] ? aa_sk_perm+0x6d5/0x900 [ 800.121197][T25090] ? __pfx_aa_sk_perm+0x10/0x10 [ 800.121228][T25090] ? tomoyo_socket_sendmsg_permission+0x1e0/0x300 [ 800.121273][T25090] ? aa_sock_msg_perm+0xf1/0x1b0 [ 800.121309][T25090] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 800.121341][T25090] ? __pfx_packet_sendmsg+0x10/0x10 [ 800.121369][T25090] __sys_sendto+0x672/0x710 [ 800.121398][T25090] ? __pfx___sys_sendto+0x10/0x10 [ 800.121418][T25090] ? __mutex_unlock_slowpath+0x1be/0x6f0 [ 800.121461][T25090] ? __fget_files+0x3a0/0x420 [ 800.121503][T25090] ? ksys_write+0x242/0x270 [ 800.121542][T25090] ? __pfx_ksys_write+0x10/0x10 [ 800.121582][T25090] __x64_sys_sendto+0xde/0x100 [ 800.121608][T25090] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 800.121634][T25090] do_syscall_64+0x174/0x580 [ 800.121658][T25090] ? trace_irq_disable+0x3b/0x140 [ 800.121697][T25090] ? clear_bhb_loop+0x40/0x90 [ 800.121726][T25090] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 800.121749][T25090] RIP: 0033:0x7f3ccd99ce59 [ 800.121772][T25090] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 800.121792][T25090] RSP: 002b:00007f3cce8dc028 EFLAGS: 00000246 ORIG_RAX: 000000000000002c [ 800.121816][T25090] RAX: ffffffffffffffda RBX: 00007f3ccdc16090 RCX: 00007f3ccd99ce59 [ 800.121833][T25090] RDX: 000000000000fce0 RSI: 00002000000002c0 RDI: 0000000000000005 [ 800.121849][T25090] RBP: 00007f3cce8dc090 R08: 0000200000000140 R09: 0000000000000014 [ 800.121865][T25090] R10: 0000000000000004 R11: 0000000000000246 R12: 0000000000000001 [ 800.121880][T25090] R13: 00007f3ccdc16128 R14: 00007f3ccdc16090 R15: 00007fff5267ffb8 [ 800.121918][T25090] [ 800.479295][T25095] netlink: 'syz.1.5936': attribute type 1 has an invalid length. [ 800.511195][T25091] syzkaller0: entered promiscuous mode [ 800.518344][T25091] syzkaller0: entered allmulticast mode [ 800.528854][T25096] netlink: 'syz.0.5937': attribute type 1 has an invalid length. [ 800.683191][T25096] macvlan2: entered promiscuous mode [ 800.689202][T25096] macvlan2: entered allmulticast mode [ 800.937949][ T5622] IPVS: starting estimator thread 0... [ 801.043300][T25113] IPVS: using max 27 ests per chain, 64800 per kthread [ 801.148279][T25123] netlink: 'syz.1.5944': attribute type 1 has an invalid length. [ 801.188040][T25121] 8021q: adding VLAN 0 to HW filter on device bond21 [ 801.512531][T25123] bond1 (unregistering): Released all slaves [ 801.572589][T25124] bond21: (slave hsr0): The slave device specified does not support setting the MAC address [ 801.600697][T25124] hsr0: A HSR master's MTU cannot be greater than the smallest MTU of its slaves minus the HSR Tag length (6 octets). [ 801.624321][T25124] bond21: (slave hsr0): Error -22 calling dev_set_mtu [ 802.244878][T25148] gtp0: entered promiscuous mode [ 802.266502][T25148] gtp0: entered allmulticast mode [ 802.287349][T25148] team0: Device gtp0 is of different type [ 802.403629][T25152] __nla_validate_parse: 10 callbacks suppressed [ 802.403655][T25152] netlink: 8 bytes leftover after parsing attributes in process `syz.0.5954'. [ 802.501269][T25157] netlink: 4 bytes leftover after parsing attributes in process `syz.0.5956'. [ 802.584504][T25165] netlink: 8 bytes leftover after parsing attributes in process `syz.0.5956'. [ 802.660567][T25157] netlink: 'syz.0.5956': attribute type 1 has an invalid length. [ 802.672895][T25157] netlink: 36 bytes leftover after parsing attributes in process `syz.0.5956'. [ 802.950790][T25174] netlink: 8 bytes leftover after parsing attributes in process `syz.4.5958'. [ 802.964577][T25173] netlink: 104 bytes leftover after parsing attributes in process `syz.4.5958'. [ 805.434761][T25158] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 805.844625][T25212] syzkaller0: entered allmulticast mode [ 805.864108][T25212] netlink: 8 bytes leftover after parsing attributes in process `syz.2.5970'. [ 806.190498][T25217] netlink: 12 bytes leftover after parsing attributes in process `syz.4.5972'. [ 806.199924][T25217] netlink: 12 bytes leftover after parsing attributes in process `syz.4.5972'. [ 806.904104][T25232] netlink: 8 bytes leftover after parsing attributes in process `syz.1.5977'. [ 807.169766][T25243] xt_hashlimit: size too large, truncated to 1048576 [ 807.583184][T25259] netlink: 8 bytes leftover after parsing attributes in process `syz.1.5984'. [ 807.618553][T25259] vlan2: entered allmulticast mode [ 807.628637][T25259] bond_slave_1: entered allmulticast mode [ 807.638519][T25261] netlink: 8 bytes leftover after parsing attributes in process `syz.2.5985'. [ 807.829057][T25267] netlink: 4 bytes leftover after parsing attributes in process `syz.1.5988'. [ 807.870774][T25267] ip6_tunnel: non-ECT from fc02:0000:0000:0000:0000:0000:0000:0000 with DS=0x1 [ 808.144871][T25275] netlink: 16 bytes leftover after parsing attributes in process `syz.2.5990'. [ 808.156162][T25282] netlink: 12 bytes leftover after parsing attributes in process `syz.1.5991'. [ 808.182283][T25282] FAULT_INJECTION: forcing a failure. [ 808.182283][T25282] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 808.224367][T25282] CPU: 1 UID: 0 PID: 25282 Comm: syz.1.5991 Not tainted syzkaller #0 PREEMPT(full) [ 808.224400][T25282] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 808.224415][T25282] Call Trace: [ 808.224424][T25282] [ 808.224435][T25282] dump_stack_lvl+0xe8/0x150 [ 808.224467][T25282] should_fail_ex+0x412/0x560 [ 808.224499][T25282] _copy_to_user+0x31/0xb0 [ 808.224531][T25282] simple_read_from_buffer+0xe1/0x170 [ 808.224565][T25282] proc_fail_nth_read+0x1bb/0x230 [ 808.224601][T25282] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 808.224635][T25282] ? rw_verify_area+0x2a6/0x4d0 [ 808.224667][T25282] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 808.224698][T25282] vfs_read+0x20c/0xa70 [ 808.224736][T25282] ? __pfx___mutex_lock+0x10/0x10 [ 808.224765][T25282] ? __pfx_vfs_read+0x10/0x10 [ 808.224810][T25282] ? __fget_files+0x2a/0x420 [ 808.224843][T25282] ? __fget_files+0x3a0/0x420 [ 808.224870][T25282] ? __fget_files+0x2a/0x420 [ 808.224909][T25282] ksys_read+0x150/0x270 [ 808.224945][T25282] ? __pfx_ksys_read+0x10/0x10 [ 808.224987][T25282] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 808.225012][T25282] do_syscall_64+0x174/0x580 [ 808.225036][T25282] ? trace_irq_disable+0x3b/0x140 [ 808.225069][T25282] ? clear_bhb_loop+0x40/0x90 [ 808.225097][T25282] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 808.225120][T25282] RIP: 0033:0x7f72e915d68e [ 808.225141][T25282] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 808.225162][T25282] RSP: 002b:00007f72e73f5fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 808.225186][T25282] RAX: ffffffffffffffda RBX: 00007f72e73f66c0 RCX: 00007f72e915d68e [ 808.225204][T25282] RDX: 000000000000000f RSI: 00007f72e73f60a0 RDI: 0000000000000003 [ 808.225218][T25282] RBP: 00007f72e73f6090 R08: 0000000000000000 R09: 0000000000000000 [ 808.225233][T25282] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 808.225247][T25282] R13: 00007f72e9416038 R14: 00007f72e9415fa0 R15: 00007fff7500e838 [ 808.225285][T25282] [ 808.587304][T25284] netlink: 12 bytes leftover after parsing attributes in process `syz.0.5992'. [ 808.768804][T25294] sctp: [Deprecated]: syz.4.5996 (pid 25294) Use of int in max_burst socket option. [ 808.768804][T25294] Use struct sctp_assoc_value instead [ 808.793238][T25300] netlink: 56 bytes leftover after parsing attributes in process `syz.0.5998'. [ 808.942629][T25303] netlink: 8 bytes leftover after parsing attributes in process `syz.4.5999'. [ 808.965227][T25306] netlink: 8 bytes leftover after parsing attributes in process `syz.1.6001'. [ 808.984623][T25306] netlink: 16 bytes leftover after parsing attributes in process `syz.1.6001'. [ 809.232495][T25319] netdevsim netdevsim4 netdevsim3: unset [0, 0] type 1 family 0 port 8472 - 0 [ 809.257082][T25319] netdevsim netdevsim4 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 809.270466][T25322] netlink: 'syz.0.6005': attribute type 10 has an invalid length. [ 809.313516][T25322] FAULT_INJECTION: forcing a failure. [ 809.313516][T25322] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 809.346175][T25322] CPU: 1 UID: 0 PID: 25322 Comm: syz.0.6005 Not tainted syzkaller #0 PREEMPT(full) [ 809.346201][T25322] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 809.346214][T25322] Call Trace: [ 809.346221][T25322] [ 809.346230][T25322] dump_stack_lvl+0xe8/0x150 [ 809.346258][T25322] should_fail_ex+0x412/0x560 [ 809.346284][T25322] _copy_to_user+0x31/0xb0 [ 809.346311][T25322] simple_read_from_buffer+0xe1/0x170 [ 809.346341][T25322] proc_fail_nth_read+0x1bb/0x230 [ 809.346371][T25322] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 809.346402][T25322] ? rw_verify_area+0x2a6/0x4d0 [ 809.346428][T25322] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 809.346453][T25322] vfs_read+0x20c/0xa70 [ 809.346484][T25322] ? __pfx___mutex_lock+0x10/0x10 [ 809.346506][T25322] ? __pfx_vfs_read+0x10/0x10 [ 809.346534][T25322] ? __fget_files+0x2a/0x420 [ 809.346561][T25322] ? __fget_files+0x3a0/0x420 [ 809.346600][T25322] ? __fget_files+0x2a/0x420 [ 809.346630][T25322] ksys_read+0x150/0x270 [ 809.346660][T25322] ? __pfx_ksys_read+0x10/0x10 [ 809.346694][T25322] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 809.346714][T25322] do_syscall_64+0x174/0x580 [ 809.346734][T25322] ? trace_irq_disable+0x3b/0x140 [ 809.346771][T25322] ? clear_bhb_loop+0x40/0x90 [ 809.346794][T25322] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 809.346812][T25322] RIP: 0033:0x7f3ccd95d68e [ 809.346831][T25322] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 809.346847][T25322] RSP: 002b:00007f3cce8fcfe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 809.346867][T25322] RAX: ffffffffffffffda RBX: 00007f3cce8fd6c0 RCX: 00007f3ccd95d68e [ 809.346881][T25322] RDX: 000000000000000f RSI: 00007f3cce8fd0a0 RDI: 0000000000000004 [ 809.346894][T25322] RBP: 00007f3cce8fd090 R08: 0000000000000000 R09: 0000000000000000 [ 809.346908][T25322] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 809.346921][T25322] R13: 00007f3ccdc16038 R14: 00007f3ccdc15fa0 R15: 00007fff5267ffb8 [ 809.346955][T25322] [ 810.329864][T25320] netdevsim netdevsim4 netdevsim2 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 810.361366][T25320] netdevsim netdevsim4 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 810.404640][T25365] netlink: 'syz.2.6010': attribute type 1 has an invalid length. [ 810.623668][T25320] netdevsim netdevsim4 netdevsim1 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 810.659586][T25320] netdevsim netdevsim4 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 810.704319][T25374] bridge_slave_0: entered promiscuous mode [ 810.718761][T25355] bridge_slave_0: left promiscuous mode [ 810.897884][T25320] netdevsim netdevsim4 netdevsim0 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 810.931570][T25320] netdevsim netdevsim4 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 811.005092][T25379] netlink: 'syz.2.6011': attribute type 12 has an invalid length. [ 811.120850][T25379] macsec0: entered promiscuous mode [ 811.262787][T25379] veth1_macvtap: left promiscuous mode [ 811.403268][T25379] macsec0 (unregistering): left promiscuous mode [ 811.630237][T25406] netlink: 'syz.1.6018': attribute type 10 has an invalid length. [ 811.657981][ T1165] netdevsim netdevsim4 eth0: set [0, 0] type 1 family 0 port 8472 - 0 [ 811.676210][ T1165] netdevsim netdevsim4 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 811.700808][T25406] bridge0: port 2(bridge_slave_1) entered disabled state [ 811.710562][T25406] bridge0: port 1(bridge_slave_0) entered disabled state [ 811.755261][T25406] bridge0: port 2(bridge_slave_1) entered blocking state [ 811.762634][T25406] bridge0: port 2(bridge_slave_1) entered forwarding state [ 811.770350][T25406] bridge0: port 1(bridge_slave_0) entered blocking state [ 811.777637][T25406] bridge0: port 1(bridge_slave_0) entered forwarding state [ 811.819862][T25406] bond0: (slave bridge0): Enslaving as an active interface with an up link [ 812.021082][ T13] netdevsim netdevsim4 eth1: set [0, 0] type 1 family 0 port 8472 - 0 [ 812.059378][ T13] netdevsim netdevsim4 eth1: set [1, 0] type 2 family 0 port 6081 - 0 [ 812.157304][ T13] netdevsim netdevsim4 eth2: set [0, 0] type 1 family 0 port 8472 - 0 [ 812.178079][ T13] netdevsim netdevsim4 eth2: set [1, 0] type 2 family 0 port 6081 - 0 [ 812.209047][T10157] netdevsim netdevsim4 eth3: set [0, 0] type 1 family 0 port 8472 - 0 [ 812.225409][T10157] netdevsim netdevsim4 eth3: set [1, 0] type 2 family 0 port 6081 - 0 [ 812.416519][ T5635] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 812.432441][ T5635] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 812.446115][ T5635] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 812.454345][ T5635] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 812.463318][ T5635] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 812.524433][T25424] sctp: [Deprecated]: syz.2.6023 (pid 25424) Use of struct sctp_assoc_value in delayed_ack socket option. [ 812.524433][T25424] Use struct sctp_sack_info instead [ 812.619429][T25426] netlink: 'syz.2.6023': attribute type 1 has an invalid length. [ 812.634674][T25435] –: renamed from dummy0 [ 812.653257][T25426] __nla_validate_parse: 11 callbacks suppressed [ 812.653277][T25426] netlink: 224 bytes leftover after parsing attributes in process `syz.2.6023'. [ 813.067520][T25453] Bluetooth: MGMT ver 1.23 [ 813.270143][T25460] Cannot find add_set index 0 as target [ 813.283453][T25460] Cannot find add_set index 0 as target [ 813.293359][T25458] netlink: 'syz.1.6030': attribute type 5 has an invalid length. [ 813.439883][T25466] netlink: 8 bytes leftover after parsing attributes in process `syz.4.6032'. [ 814.311051][T25427] bridge0: port 1(bridge_slave_0) entered blocking state [ 814.318548][T25427] bridge0: port 1(bridge_slave_0) entered disabled state [ 814.326904][T25427] bridge_slave_0: entered allmulticast mode [ 814.335050][T25427] bridge_slave_0: entered promiscuous mode [ 814.344965][T25427] bridge0: port 2(bridge_slave_1) entered blocking state [ 814.352573][T25427] bridge0: port 2(bridge_slave_1) entered disabled state [ 814.368847][T25427] bridge_slave_1: entered allmulticast mode [ 814.382008][T25427] bridge_slave_1: entered promiscuous mode [ 814.446074][T25478] netlink: 212256 bytes leftover after parsing attributes in process `syz.4.6035'. [ 814.517238][T25427] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 814.527231][ T5635] Bluetooth: hci2: command tx timeout [ 814.570543][T25427] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 814.688119][T25427] team0: Port device team_slave_0 added [ 814.712626][T25427] team0: Port device team_slave_1 added [ 814.845641][T25427] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 814.861346][T25427] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 814.917126][T25427] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 814.947382][T25427] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 814.967582][T25427] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 815.036751][T25427] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 815.207318][T25496] netlink: 8 bytes leftover after parsing attributes in process `syz.0.6040'. [ 815.233326][T25427] hsr_slave_0: entered promiscuous mode [ 815.250588][T25427] hsr_slave_1: entered promiscuous mode [ 815.257899][T25427] debugfs: 'hsr0' already exists in 'hsr' [ 815.264217][T25427] Cannot create hsr debugfs directory [ 815.700047][T25427] netdevsim netdevsim5 netdevsim0: renamed from eth0 [ 815.713755][T25427] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 815.724619][T25427] netdevsim netdevsim5 netdevsim1: renamed from eth1 [ 815.843278][T25427] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 815.854771][T25427] netdevsim netdevsim5 netdevsim2: renamed from eth2 [ 815.874463][T25427] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 815.884056][T25427] netdevsim netdevsim5 netdevsim3: renamed from eth3 [ 815.898662][T25427] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 815.996327][T25427] 8021q: adding VLAN 0 to HW filter on device bond0 [ 816.018319][T25427] 8021q: adding VLAN 0 to HW filter on device team0 [ 816.032187][T10157] bridge0: port 1(bridge_slave_0) entered blocking state [ 816.039542][T10157] bridge0: port 1(bridge_slave_0) entered forwarding state [ 816.061058][ T76] bridge0: port 2(bridge_slave_1) entered blocking state [ 816.068309][ T76] bridge0: port 2(bridge_slave_1) entered forwarding state [ 816.173375][T25427] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 816.443093][T25540] netlink: 8 bytes leftover after parsing attributes in process `syz.1.6050'. [ 816.467667][T25540] netlink: 24 bytes leftover after parsing attributes in process `syz.1.6050'. [ 816.606426][ T5635] Bluetooth: hci2: command tx timeout [ 816.887638][T25561] FAULT_INJECTION: forcing a failure. [ 816.887638][T25561] name failslab, interval 1, probability 0, space 0, times 0 [ 816.916284][T25561] CPU: 1 UID: 0 PID: 25561 Comm: syz.1.6056 Not tainted syzkaller #0 PREEMPT(full) [ 816.916315][T25561] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 816.916330][T25561] Call Trace: [ 816.916340][T25561] [ 816.916351][T25561] dump_stack_lvl+0xe8/0x150 [ 816.916382][T25561] should_fail_ex+0x412/0x560 [ 816.916430][T25561] should_failslab+0xa8/0x100 [ 816.916456][T25561] __kmalloc_node_track_caller_noprof+0xeb/0x7b0 [ 816.916493][T25561] ? ethnl_default_set_doit+0x59d/0xad0 [ 816.916524][T25561] ? __kmalloc_noprof+0x37d/0x760 [ 816.916560][T25561] kmemdup_noprof+0x2b/0x70 [ 816.916587][T25561] ethnl_default_set_doit+0x59d/0xad0 [ 816.916631][T25561] genl_family_rcv_msg_doit+0x22a/0x330 [ 816.916667][T25561] ? __asan_memcpy+0x40/0x70 [ 816.916710][T25561] ? __pfx_genl_family_rcv_msg_doit+0x10/0x10 [ 816.916758][T25561] ? bpf_lsm_capable+0x9/0x20 [ 816.916781][T25561] ? security_capable+0x7e/0x2c0 [ 816.916820][T25561] genl_rcv_msg+0x61c/0x7a0 [ 816.916861][T25561] ? __pfx_genl_rcv_msg+0x10/0x10 [ 816.916893][T25561] ? __pfx_ethnl_default_set_doit+0x10/0x10 [ 816.916927][T25561] ? __pfx_ref_tracker_free+0x10/0x10 [ 816.916950][T25561] ? __asan_memcpy+0x40/0x70 [ 816.916977][T25561] ? __skb_clone+0x63/0x7a0 [ 816.917014][T25561] netlink_rcv_skb+0x232/0x4b0 [ 816.917042][T25561] ? __pfx_genl_rcv_msg+0x10/0x10 [ 816.917077][T25561] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 816.917123][T25561] ? down_read+0x270/0x2e0 [ 816.917149][T25561] ? genl_rcv+0xd/0x40 [ 816.917182][T25561] genl_rcv+0x28/0x40 [ 816.917212][T25561] netlink_unicast+0x75c/0x8e0 [ 816.917249][T25561] netlink_sendmsg+0x813/0xb40 [ 816.917288][T25561] ? __pfx_netlink_sendmsg+0x10/0x10 [ 816.917320][T25561] ? aa_sock_msg_perm+0xf1/0x1b0 [ 816.917355][T25561] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 816.917391][T25561] ____sys_sendmsg+0x972/0x9f0 [ 816.917417][T25561] ? __might_fault+0xaf/0x130 [ 816.917455][T25561] ? __pfx_____sys_sendmsg+0x10/0x10 [ 816.917493][T25561] ? import_iovec+0x73/0xa0 [ 816.917525][T25561] ___sys_sendmsg+0x2a5/0x360 [ 816.917551][T25561] ? __lock_acquire+0x6b5/0x2cf0 [ 816.917585][T25561] ? __pfx____sys_sendmsg+0x10/0x10 [ 816.917651][T25561] ? __fget_files+0x2a/0x420 [ 816.917679][T25561] ? __fget_files+0x3a0/0x420 [ 816.917727][T25561] __x64_sys_sendmsg+0x1bd/0x2a0 [ 816.917758][T25561] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 816.917796][T25561] ? __pfx_ksys_write+0x10/0x10 [ 816.917840][T25561] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 816.917865][T25561] do_syscall_64+0x174/0x580 [ 816.917890][T25561] ? trace_irq_disable+0x3b/0x140 [ 816.917924][T25561] ? clear_bhb_loop+0x40/0x90 [ 816.917952][T25561] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 816.917975][T25561] RIP: 0033:0x7f72e919ce59 [ 816.917997][T25561] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 816.918018][T25561] RSP: 002b:00007f72e73f6028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 816.918043][T25561] RAX: ffffffffffffffda RBX: 00007f72e9415fa0 RCX: 00007f72e919ce59 [ 816.918060][T25561] RDX: 0000000000000000 RSI: 0000200000000540 RDI: 0000000000000006 [ 816.918075][T25561] RBP: 00007f72e73f6090 R08: 0000000000000000 R09: 0000000000000000 [ 816.918090][T25561] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 816.918103][T25561] R13: 00007f72e9416038 R14: 00007f72e9415fa0 R15: 00007fff7500e838 [ 816.918142][T25561] [ 816.923282][T25560] netlink: 24 bytes leftover after parsing attributes in process `syz.4.6055'. [ 817.312648][T25544] netlink: 8 bytes leftover after parsing attributes in process `syz.2.6051'. [ 817.364327][T25565] IPVS: wrr: FWM 3 0x00000003 - no destination available [ 817.565057][T25578] netlink: 8 bytes leftover after parsing attributes in process `syz.0.6061'. [ 817.630644][T25580] netlink: 8 bytes leftover after parsing attributes in process `syz.2.6062'. [ 817.646529][T25578] xt_l2tp: invalid flags combination: 8 [ 817.685420][T25427] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 818.009892][T25570] __nla_validate_parse: 3 callbacks suppressed [ 818.009915][T25570] netlink: 8 bytes leftover after parsing attributes in process `syz.1.6059'. [ 818.271547][T25427] veth0_vlan: entered promiscuous mode [ 818.294150][T25427] veth1_vlan: entered promiscuous mode [ 818.343872][T25427] veth0_macvtap: entered promiscuous mode [ 818.357551][T25427] veth1_macvtap: entered promiscuous mode [ 818.391236][T25427] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 818.404259][T25427] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 818.438839][ T37] netdevsim netdevsim5 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 818.449648][ T37] netdevsim netdevsim5 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 818.467999][T25603] batman_adv: batadv0: Adding interface: dummy0 [ 818.474482][T25603] batman_adv: batadv0: The MTU of interface dummy0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 818.501548][T25603] batman_adv: batadv0: Interface activated: dummy0 [ 818.510520][ T37] netdevsim netdevsim5 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 818.521437][ T37] netdevsim netdevsim5 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 818.678483][T10157] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 818.696398][ T5635] Bluetooth: hci2: command tx timeout [ 818.708577][T10157] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 818.995054][T25613] netlink: 'syz.4.6072': attribute type 1 has an invalid length. [ 819.003567][T25613] netlink: 224 bytes leftover after parsing attributes in process `syz.4.6072'. [ 819.043799][ T1165] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 819.061092][ T1165] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 819.096164][T25611] netlink: 8 bytes leftover after parsing attributes in process `syz.0.6071'. [ 819.302554][T25619] netlink: 'syz.0.6074': attribute type 13 has an invalid length. [ 819.313344][T25617] netlink: 8 bytes leftover after parsing attributes in process `syz.2.6073'. [ 819.328071][T25617] netlink: 24 bytes leftover after parsing attributes in process `syz.2.6073'. [ 819.345138][T25617] netlink: 8 bytes leftover after parsing attributes in process `syz.2.6073'. [ 819.433463][T25617] netlink: 24 bytes leftover after parsing attributes in process `syz.2.6073'. [ 819.829533][ T50] Bluetooth: hci6: unexpected cc 0x0c03 length: 249 > 1 [ 819.843882][ T50] Bluetooth: hci6: unexpected cc 0x1003 length: 249 > 9 [ 819.854211][ T50] Bluetooth: hci6: unexpected cc 0x1001 length: 249 > 9 [ 819.862676][ T50] Bluetooth: hci6: unexpected cc 0x0c23 length: 249 > 4 [ 819.874423][ T50] Bluetooth: hci6: unexpected cc 0x0c38 length: 249 > 2 [ 819.911017][T25636] netlink: 8 bytes leftover after parsing attributes in process `syz.1.6076'. [ 820.012479][T25641] netlink: 104 bytes leftover after parsing attributes in process `syz.1.6076'. [ 820.367943][T25651] netlink: 112 bytes leftover after parsing attributes in process `syz.5.6082'. [ 820.767356][ T50] Bluetooth: hci2: command tx timeout [ 821.413194][T25686] FAULT_INJECTION: forcing a failure. [ 821.413194][T25686] name failslab, interval 1, probability 0, space 0, times 0 [ 821.426356][T25686] CPU: 1 UID: 0 PID: 25686 Comm: syz.1.6093 Not tainted syzkaller #0 PREEMPT(full) [ 821.426388][T25686] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 821.426402][T25686] Call Trace: [ 821.426412][T25686] [ 821.426421][T25686] dump_stack_lvl+0xe8/0x150 [ 821.426455][T25686] should_fail_ex+0x412/0x560 [ 821.426485][T25686] should_failslab+0xa8/0x100 [ 821.426509][T25686] ? skb_clone+0x212/0x3a0 [ 821.426537][T25686] kmem_cache_alloc_noprof+0x87/0x650 [ 821.426579][T25686] skb_clone+0x212/0x3a0 [ 821.426611][T25686] __netlink_deliver_tap+0x404/0x850 [ 821.426652][T25686] ? netlink_deliver_tap+0x2e/0x1b0 [ 821.426682][T25686] netlink_deliver_tap+0x19c/0x1b0 [ 821.426711][T25686] netlink_sendskb+0x68/0x140 [ 821.426737][T25686] netlink_rcv_skb+0x2b6/0x4b0 [ 821.426766][T25686] ? __pfx_genl_rcv_msg+0x10/0x10 [ 821.426800][T25686] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 821.426847][T25686] ? down_read+0x270/0x2e0 [ 821.426873][T25686] ? genl_rcv+0xd/0x40 [ 821.426915][T25686] genl_rcv+0x28/0x40 [ 821.426945][T25686] netlink_unicast+0x75c/0x8e0 [ 821.426982][T25686] netlink_sendmsg+0x813/0xb40 [ 821.427020][T25686] ? __pfx_netlink_sendmsg+0x10/0x10 [ 821.427052][T25686] ? aa_sock_msg_perm+0xf1/0x1b0 [ 821.427089][T25686] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 821.427126][T25686] ____sys_sendmsg+0x972/0x9f0 [ 821.427169][T25686] ? __might_fault+0xaf/0x130 [ 821.427207][T25686] ? __pfx_____sys_sendmsg+0x10/0x10 [ 821.427246][T25686] ? import_iovec+0x73/0xa0 [ 821.427304][T25686] ___sys_sendmsg+0x2a5/0x360 [ 821.427334][T25686] ? __lock_acquire+0x6b5/0x2cf0 [ 821.427363][T25686] ? __pfx____sys_sendmsg+0x10/0x10 [ 821.427433][T25686] ? __fget_files+0x2a/0x420 [ 821.427459][T25686] ? __fget_files+0x3a0/0x420 [ 821.427498][T25686] __x64_sys_sendmsg+0x1bd/0x2a0 [ 821.427525][T25686] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 821.427561][T25686] ? __pfx_ksys_write+0x10/0x10 [ 821.427603][T25686] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 821.427628][T25686] do_syscall_64+0x174/0x580 [ 821.427652][T25686] ? trace_irq_disable+0x3b/0x140 [ 821.427687][T25686] ? clear_bhb_loop+0x40/0x90 [ 821.427715][T25686] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 821.427738][T25686] RIP: 0033:0x7f72e919ce59 [ 821.427761][T25686] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 821.427780][T25686] RSP: 002b:00007f72e73f6028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 821.427804][T25686] RAX: ffffffffffffffda RBX: 00007f72e9415fa0 RCX: 00007f72e919ce59 [ 821.427821][T25686] RDX: 0000000000000000 RSI: 00002000000006c0 RDI: 0000000000000003 [ 821.427835][T25686] RBP: 00007f72e73f6090 R08: 0000000000000000 R09: 0000000000000000 [ 821.427849][T25686] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 821.427863][T25686] R13: 00007f72e9416038 R14: 00007f72e9415fa0 R15: 00007fff7500e838 [ 821.427909][T25686] [ 821.873387][T25689] unsupported nlmsg_type 40 [ 821.969727][ T50] Bluetooth: hci6: command tx timeout [ 822.250103][T25698] lo: entered allmulticast mode [ 822.378199][T25698] lo: left allmulticast mode [ 822.401214][T25634] bridge0: port 1(bridge_slave_0) entered blocking state [ 822.423351][T25634] bridge0: port 1(bridge_slave_0) entered disabled state [ 822.454487][T25634] bridge_slave_0: entered allmulticast mode [ 822.484048][T25634] bridge_slave_0: entered promiscuous mode [ 822.514662][T25634] bridge0: port 2(bridge_slave_1) entered blocking state [ 822.547839][T25634] bridge0: port 2(bridge_slave_1) entered disabled state [ 822.566305][T25634] bridge_slave_1: entered allmulticast mode [ 822.592750][T25634] bridge_slave_1: entered promiscuous mode [ 822.712153][T25634] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 822.747975][T25634] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 822.886857][T25720] openvswitch: netlink: Unexpected mask (mask=4400040, allowed=410048) [ 822.941094][T25634] team0: Port device team_slave_0 added [ 822.972062][T25634] team0: Port device team_slave_1 added [ 823.048124][T25729] netlink: 'syz.2.6109': attribute type 1 has an invalid length. [ 823.451491][T25732] 8021q: adding VLAN 0 to HW filter on device bond2 [ 823.491132][T25732] bond1: (slave bond2): making interface the new active one [ 823.525157][T25732] bond1: (slave bond2): Enslaving as an active interface with an up link [ 823.549700][T25731] __nla_validate_parse: 15 callbacks suppressed [ 823.549722][T25731] netlink: 8 bytes leftover after parsing attributes in process `syz.0.6110'. [ 823.580913][T25634] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 823.599417][T25634] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 823.655395][T25634] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 823.701014][ T5622] IPVS: starting estimator thread 0... [ 823.717938][T25736] bond1: (slave gretap1): Enslaving as a backup interface with an up link [ 823.750997][T25748] netlink: 'syz.5.6113': attribute type 1 has an invalid length. [ 823.761264][T25747] netlink: 20 bytes leftover after parsing attributes in process `syz.0.6114'. [ 823.771383][T25748] netlink: 224 bytes leftover after parsing attributes in process `syz.5.6113'. [ 823.775543][T25634] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 823.790055][T25634] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 823.817195][T25745] IPVS: using max 30 ests per chain, 72000 per kthread [ 823.825576][T25749] netlink: 24 bytes leftover after parsing attributes in process `syz.0.6114'. [ 823.834979][T25634] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 823.870967][T25744] bridge0: port 1(bridge_slave_0) entered disabled state [ 823.922907][T25744] bridge_slave_0 (unregistering): left allmulticast mode [ 823.931000][T25744] bridge_slave_0 (unregistering): left promiscuous mode [ 823.956629][T25744] bridge0: port 1(bridge_slave_0) entered disabled state [ 824.046450][ T50] Bluetooth: hci6: command tx timeout [ 824.228514][T25634] hsr_slave_0: entered promiscuous mode [ 824.255494][T25634] hsr_slave_1: entered promiscuous mode [ 824.276132][T25634] debugfs: 'hsr0' already exists in 'hsr' [ 824.295048][T25634] Cannot create hsr debugfs directory [ 825.031055][T25786] netlink: 128 bytes leftover after parsing attributes in process `syz.1.6124'. [ 825.056344][T25787] netlink: 20 bytes leftover after parsing attributes in process `syz.0.6125'. [ 825.080737][T25786] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 825.105717][T25787] netlink: 24 bytes leftover after parsing attributes in process `syz.0.6125'. [ 825.202781][T25634] netdevsim netdevsim4 eth3 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 825.246227][T25634] netdevsim netdevsim4 eth3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 825.320901][T25796] xt_SECMARK: invalid mode: 4 [ 825.457961][T25634] netdevsim netdevsim4 eth2 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 825.503092][T25634] netdevsim netdevsim4 eth2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 825.551055][T25799] netlink: 8 bytes leftover after parsing attributes in process `syz.2.6128'. [ 825.562153][T25799] netlink: 24 bytes leftover after parsing attributes in process `syz.2.6128'. [ 825.578224][T25799] netlink: 8 bytes leftover after parsing attributes in process `syz.2.6128'. [ 825.707816][T25634] netdevsim netdevsim4 eth1 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 825.718138][T25634] netdevsim netdevsim4 eth1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 825.926900][T25634] netdevsim netdevsim4 eth0 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 825.946682][T25634] netdevsim netdevsim4 eth0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 826.126177][ T50] Bluetooth: hci6: command tx timeout [ 827.023702][T25831] bond0 (unregistering): (slave gretap1): Releasing active interface [ 827.064533][T25831] bond0 (unregistering): Released all slaves [ 827.173434][T25634] netdevsim netdevsim4 netdevsim0: renamed from eth0 [ 827.197202][T25634] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 827.222216][T25634] netdevsim netdevsim4 netdevsim1: renamed from eth1 [ 827.249434][T25634] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 827.265163][T25634] netdevsim netdevsim4 netdevsim2: renamed from eth2 [ 827.292857][T25634] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 827.311078][T25634] netdevsim netdevsim4 netdevsim3: renamed from eth3 [ 827.353558][T25634] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 827.673928][T25634] 8021q: adding VLAN 0 to HW filter on device bond0 [ 827.766956][T25634] 8021q: adding VLAN 0 to HW filter on device team0 [ 827.900830][ T37] bridge0: port 1(bridge_slave_0) entered blocking state [ 827.908178][ T37] bridge0: port 1(bridge_slave_0) entered forwarding state [ 827.962878][ T76] bridge0: port 2(bridge_slave_1) entered blocking state [ 827.970152][ T76] bridge0: port 2(bridge_slave_1) entered forwarding state [ 828.129696][ T13] wlan1: Trigger new scan to find an IBSS to join [ 828.206904][ T50] Bluetooth: hci6: command tx timeout [ 828.848852][T25898] __nla_validate_parse: 12 callbacks suppressed [ 828.848877][T25898] netlink: 4 bytes leftover after parsing attributes in process `syz.5.6158'. [ 828.908399][T25900] ip6_tunnel: non-ECT from fc02:0000:0000:0000:0000:0000:0000:0000 with DS=0x1 [ 829.089106][T25908] netlink: 8 bytes leftover after parsing attributes in process `syz.0.6161'. [ 829.383759][T25920] bond3: option packets_per_slave: invalid value (1048582) [ 829.391948][T25920] bond3: option packets_per_slave: allowed values 0 - 65535 [ 829.404823][T25920] bond3 (unregistering): Released all slaves [ 829.609399][T25935] vcan1: entered allmulticast mode [ 829.713337][T25634] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 829.737546][T25939] netlink: 16 bytes leftover after parsing attributes in process `syz.0.6170'. [ 830.083655][T25953] netlink: 4 bytes leftover after parsing attributes in process `syz.0.6173'. [ 830.364332][T25634] veth0_vlan: entered promiscuous mode [ 830.403493][T25963] IPVS: wrr: FWM 3 0x00000003 - no destination available: all destinations are overloaded [ 830.449998][T25960] syzkaller1: entered promiscuous mode [ 830.469728][T25960] syzkaller1: entered allmulticast mode [ 830.489801][T25634] veth1_vlan: entered promiscuous mode [ 830.492274][T25965] netlink: 'syz.1.6176': attribute type 1 has an invalid length. [ 830.543955][T25966] netlink: 'syz.1.6176': attribute type 1 has an invalid length. [ 830.563498][T25966] netlink: 96 bytes leftover after parsing attributes in process `syz.1.6176'. [ 830.585210][T25966] netlink: 1 bytes leftover after parsing attributes in process `syz.1.6176'. [ 830.595335][T25966] netlink: 'syz.1.6176': attribute type 1 has an invalid length. [ 830.605173][T25965] bond1: entered promiscuous mode [ 830.632571][T25965] 8021q: adding VLAN 0 to HW filter on device bond1 [ 830.721287][T25970] xfrm0: entered allmulticast mode [ 831.011230][T25975] netlink: 8 bytes leftover after parsing attributes in process `syz.0.6179'. [ 831.093051][T25634] veth0_macvtap: entered promiscuous mode [ 831.123119][T25634] veth1_macvtap: entered promiscuous mode [ 831.166813][ T13] wlan1: Trigger new scan to find an IBSS to join [ 831.291389][T25989] netlink: 4 bytes leftover after parsing attributes in process `syz.2.6184'. [ 831.318435][T25634] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 831.344125][T25994] ip6_tunnel: non-ECT from fc02:0000:0000:0000:0000:0000:0000:0000 with DS=0x1 [ 831.371972][T25634] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 831.456626][ T76] netdevsim netdevsim4 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 831.470680][ T76] netdevsim netdevsim4 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 831.492202][ T76] netdevsim netdevsim4 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 831.513727][T25999] IPVS: wrr: FWM 3 0x00000003 - no destination available: all destinations are overloaded [ 831.529852][ T76] netdevsim netdevsim4 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 831.715458][T10544] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 831.752476][T10544] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 831.755170][T26005] netlink: 12 bytes leftover after parsing attributes in process `syz.1.6188'. [ 831.842426][ T76] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 831.857548][ T76] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 831.987055][T26015] xt_hashlimit: size too large, truncated to 1048576 [ 832.212987][T26025] netlink: 14 bytes leftover after parsing attributes in process `syz.2.6194'. [ 832.386896][T26027] IPVS: set_ctl: invalid protocol: 0 0.0.0.0:0 [ 832.444508][T26030] syzkaller1: entered promiscuous mode [ 832.455483][T26030] syzkaller1: entered allmulticast mode [ 832.829296][T26043] ip6_tunnel: non-ECT from fc02:0000:0000:0000:0000:0000:0000:0000 with DS=0x1 [ 833.161281][T26054] netlink: 'syz.2.6202': attribute type 2 has an invalid length. [ 833.230187][T26051] dvmrp0: entered allmulticast mode [ 833.346160][T26064] IPVS: Unknown mcast interface: macsec0 [ 833.659739][T26081] ip6_tunnel: non-ECT from fc02:0000:0000:0000:0000:0000:0000:0000 with DS=0x1 [ 834.106800][T26105] netlink: 'syz.1.6219': attribute type 10 has an invalid length. [ 834.134352][T26100] __nla_validate_parse: 4 callbacks suppressed [ 834.134369][T26100] netlink: 32 bytes leftover after parsing attributes in process `syz.5.6217'. [ 834.186027][T26105] tap0: tun_chr_ioctl cmd 1074025677 [ 834.207989][T26105] tap0: linktype set to 773 [ 834.273288][T26105] : entered promiscuous mode [ 834.429102][T26108] mac80211_hwsim hwsim42 syzkaller0: Caught tx_queue_len zero misconfig [ 834.442743][T26111] netlink: 'syz.0.6220': attribute type 5 has an invalid length. [ 835.059626][T26128] netlink: 4 bytes leftover after parsing attributes in process `syz.5.6227'. [ 835.086653][T26128] ip6_tunnel: non-ECT from fc02:0000:0000:0000:0000:0000:0000:0000 with DS=0x1 [ 835.101210][T26131] ip6erspan0: entered allmulticast mode [ 835.458996][T26145] netlink: 'syz.4.6232': attribute type 18 has an invalid length. [ 835.477603][T26145] netlink: 8 bytes leftover after parsing attributes in process `syz.4.6232'. [ 835.578606][T26154] netlink: 2 bytes leftover after parsing attributes in process `syz.1.6234'. [ 835.685352][T26161] netlink: 8 bytes leftover after parsing attributes in process `syz.5.6233'. [ 835.734091][T26149] bond1: option active_slave: mode dependency failed, not supported in mode balance-rr(0) [ 835.768069][T26149] bond1 (unregistering): Released all slaves [ 836.314846][T26186] netlink: 16 bytes leftover after parsing attributes in process `syz.2.6241'. [ 836.659933][T26193] netlink: 4 bytes leftover after parsing attributes in process `syz.5.6243'. [ 836.687064][T26193] ip6_tunnel: non-ECT from fc02:0000:0000:0000:0000:0000:0000:0000 with DS=0x1 [ 836.760898][T26199] netlink: 12 bytes leftover after parsing attributes in process `syz.2.6246'. [ 836.796354][T26199] netlink: 24 bytes leftover after parsing attributes in process `syz.2.6246'. [ 837.238612][T26212] netlink: 12 bytes leftover after parsing attributes in process `syz.5.6250'. [ 837.370786][ T5635] Bluetooth: hci4: unexpected cc 0x0c03 length: 249 > 1 [ 837.401191][ T5635] Bluetooth: hci4: unexpected cc 0x1003 length: 249 > 9 [ 837.419342][ T5635] Bluetooth: hci4: unexpected cc 0x1001 length: 249 > 9 [ 837.430415][ T5635] Bluetooth: hci4: unexpected cc 0x0c23 length: 249 > 4 [ 837.438585][ T5635] Bluetooth: hci4: unexpected cc 0x0c38 length: 249 > 2 [ 838.113959][T26242] FAULT_INJECTION: forcing a failure. [ 838.113959][T26242] name failslab, interval 1, probability 0, space 0, times 0 [ 838.132818][T26242] CPU: 1 UID: 0 PID: 26242 Comm: syz.4.6255 Not tainted syzkaller #0 PREEMPT(full) [ 838.132845][T26242] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 838.132858][T26242] Call Trace: [ 838.132866][T26242] [ 838.132875][T26242] dump_stack_lvl+0xe8/0x150 [ 838.132903][T26242] should_fail_ex+0x412/0x560 [ 838.132927][T26242] should_failslab+0xa8/0x100 [ 838.132948][T26242] kmem_cache_alloc_node_noprof+0x8f/0x690 [ 838.132975][T26242] ? __alloc_skb+0x186/0x7d0 [ 838.132993][T26242] ? __alloc_skb+0x1d0/0x7d0 [ 838.133009][T26242] ? __local_bh_enable_ip+0xd0/0x130 [ 838.133040][T26242] __alloc_skb+0x1d0/0x7d0 [ 838.133062][T26242] ? __lock_acquire+0x6b5/0x2cf0 [ 838.133089][T26242] alloc_skb_with_frags+0xc8/0x760 [ 838.133114][T26242] ? __lock_acquire+0x6b5/0x2cf0 [ 838.133141][T26242] ? __lock_acquire+0x6b5/0x2cf0 [ 838.133168][T26242] sock_alloc_send_pskb+0x878/0x990 [ 838.133217][T26242] ? __pfx_sock_alloc_send_pskb+0x10/0x10 [ 838.133260][T26242] tun_get_user+0x5df/0x43e0 [ 838.133301][T26242] ? aa_file_perm+0x192/0x15e0 [ 838.133327][T26242] ? aa_file_perm+0x50e/0x15e0 [ 838.133347][T26242] ? __pfx_tun_get_user+0x10/0x10 [ 838.133372][T26242] ? __lock_acquire+0x6b5/0x2cf0 [ 838.133399][T26242] ? kstrtoull+0x12f/0x1d0 [ 838.133439][T26242] ? ref_tracker_alloc+0x35c/0x4c0 [ 838.133466][T26242] ? __pfx_ref_tracker_alloc+0x10/0x10 [ 838.133491][T26242] ? tun_get+0x1c/0x2f0 [ 838.133513][T26242] ? tun_get+0x1c/0x2f0 [ 838.133540][T26242] ? tun_get+0x1c/0x2f0 [ 838.133560][T26242] ? tun_get+0x1c/0x2f0 [ 838.133587][T26242] tun_chr_write_iter+0x113/0x200 [ 838.133614][T26242] vfs_write+0x61d/0xb90 [ 838.133655][T26242] ? __pfx_vfs_write+0x10/0x10 [ 838.133708][T26242] ? __fget_files+0x2a/0x420 [ 838.133745][T26242] ksys_write+0x150/0x270 [ 838.133780][T26242] ? __pfx_ksys_write+0x10/0x10 [ 838.133822][T26242] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 838.133862][T26242] do_syscall_64+0x174/0x580 [ 838.133886][T26242] ? trace_irq_disable+0x3b/0x140 [ 838.133919][T26242] ? clear_bhb_loop+0x40/0x90 [ 838.133947][T26242] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 838.133970][T26242] RIP: 0033:0x7f2b6075d68e [ 838.133992][T26242] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 838.134013][T26242] RSP: 002b:00007f2b6169cfb8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 838.134036][T26242] RAX: ffffffffffffffda RBX: 00007f2b6169d6c0 RCX: 00007f2b6075d68e [ 838.134053][T26242] RDX: 000000000000fdef RSI: 00002000000004c0 RDI: 00000000000000c8 [ 838.134068][T26242] RBP: 00007f2b6169d090 R08: 0000000000000000 R09: 0000000000000000 [ 838.134082][T26242] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 838.134096][T26242] R13: 00007f2b60a16038 R14: 00007f2b60a15fa0 R15: 00007ffeb7cb0ee8 [ 838.134132][T26242] [ 838.729020][T26250] ip6_tunnel: non-ECT from fc02:0000:0000:0000:0000:0000:0000:0000 with DS=0x1 [ 839.330739][T26268] tap0: tun_chr_ioctl cmd 1074025681 [ 839.380931][T26215] bridge0: port 1(bridge_slave_0) entered blocking state [ 839.410936][T26215] bridge0: port 1(bridge_slave_0) entered disabled state [ 839.426215][T26215] bridge_slave_0: entered allmulticast mode [ 839.445149][T26274] __nla_validate_parse: 6 callbacks suppressed [ 839.445165][T26274] netlink: 8 bytes leftover after parsing attributes in process `syz.2.6263'. [ 839.461788][T26215] bridge_slave_0: entered promiscuous mode [ 839.474758][T26215] bridge0: port 2(bridge_slave_1) entered blocking state [ 839.482815][T26215] bridge0: port 2(bridge_slave_1) entered disabled state [ 839.490371][ T5635] Bluetooth: hci4: command tx timeout [ 839.526340][T26215] bridge_slave_1: entered allmulticast mode [ 839.539979][T26215] bridge_slave_1: entered promiscuous mode [ 839.629241][T26215] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 839.644737][T26215] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 839.732226][T26215] team0: Port device team_slave_0 added [ 839.740271][T26278] syzkaller0: entered promiscuous mode [ 839.756085][T26278] syzkaller0: entered allmulticast mode [ 839.783777][T26215] team0: Port device team_slave_1 added [ 839.789145][T26278] block nbd0: not configured, cannot reconfigure [ 839.895922][T26215] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 839.903110][T26215] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 839.948099][T26215] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 839.987866][T26215] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 840.001153][T26215] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 840.029448][T26215] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 840.083195][T26288] netlink: 12 bytes leftover after parsing attributes in process `syz.5.6269'. [ 840.095533][T26288] netlink: 24 bytes leftover after parsing attributes in process `syz.5.6269'. [ 840.168943][T26293] netlink: 4 bytes leftover after parsing attributes in process `syz.2.6271'. [ 840.189648][T26293] ip6_tunnel: non-ECT from fc02:0000:0000:0000:0000:0000:0000:0000 with DS=0x1 [ 840.211955][T26215] hsr_slave_0: entered promiscuous mode [ 840.227768][T26215] hsr_slave_1: entered promiscuous mode [ 840.242839][T26215] debugfs: 'hsr0' already exists in 'hsr' [ 840.259109][T26215] Cannot create hsr debugfs directory [ 840.648625][T26307] bond2: option miimon: invalid value (18446744073709551607) [ 840.666297][T26307] bond2: option miimon: allowed values 0 - 2147483647 [ 840.689723][T26307] bond2 (unregistering): Released all slaves [ 840.918025][T26215] netdevsim netdevsim0 eth3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 841.163924][T26215] netdevsim netdevsim0 eth2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 841.204265][T26335] netlink: 12 bytes leftover after parsing attributes in process `syz.4.6282'. [ 841.244469][T26335] netlink: 24 bytes leftover after parsing attributes in process `syz.4.6282'. [ 841.280313][T26338] FAULT_INJECTION: forcing a failure. [ 841.280313][T26338] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 841.297137][T26338] CPU: 1 UID: 0 PID: 26338 Comm: syz.1.6284 Not tainted syzkaller #0 PREEMPT(full) [ 841.297168][T26338] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 841.297182][T26338] Call Trace: [ 841.297191][T26338] [ 841.297202][T26338] dump_stack_lvl+0xe8/0x150 [ 841.297232][T26338] should_fail_ex+0x412/0x560 [ 841.297263][T26338] _copy_to_user+0x31/0xb0 [ 841.297294][T26338] simple_read_from_buffer+0xe1/0x170 [ 841.297330][T26338] proc_fail_nth_read+0x1bb/0x230 [ 841.297364][T26338] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 841.297397][T26338] ? rw_verify_area+0x2a6/0x4d0 [ 841.297437][T26338] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 841.297470][T26338] vfs_read+0x20c/0xa70 [ 841.297513][T26338] ? __pfx___mutex_lock+0x10/0x10 [ 841.297542][T26338] ? __pfx_vfs_read+0x10/0x10 [ 841.297576][T26338] ? __fget_files+0x2a/0x420 [ 841.297610][T26338] ? __fget_files+0x3a0/0x420 [ 841.297636][T26338] ? __fget_files+0x2a/0x420 [ 841.297674][T26338] ksys_read+0x150/0x270 [ 841.297710][T26338] ? __pfx_ksys_read+0x10/0x10 [ 841.297752][T26338] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 841.297778][T26338] do_syscall_64+0x174/0x580 [ 841.297802][T26338] ? trace_irq_disable+0x3b/0x140 [ 841.297835][T26338] ? clear_bhb_loop+0x40/0x90 [ 841.297863][T26338] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 841.297886][T26338] RIP: 0033:0x7f72e915d68e [ 841.297906][T26338] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 841.297926][T26338] RSP: 002b:00007f72e73f5fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 841.297949][T26338] RAX: ffffffffffffffda RBX: 00007f72e73f66c0 RCX: 00007f72e915d68e [ 841.297965][T26338] RDX: 000000000000000f RSI: 00007f72e73f60a0 RDI: 0000000000000004 [ 841.297980][T26338] RBP: 00007f72e73f6090 R08: 0000000000000000 R09: 0000000000000000 [ 841.297994][T26338] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 841.298007][T26338] R13: 00007f72e9416038 R14: 00007f72e9415fa0 R15: 00007fff7500e838 [ 841.298044][T26338] [ 841.578806][ T5635] Bluetooth: hci4: command tx timeout [ 841.681280][T26215] netdevsim netdevsim0 eth1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 841.776585][T26345] netlink: 'syz.2.6288': attribute type 1 has an invalid length. [ 841.815484][T26345] 8021q: adding VLAN 0 to HW filter on device bond3 [ 841.841097][T26215] netdevsim netdevsim0 eth0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 841.935365][T26345] 8021q: adding VLAN 0 to HW filter on device batadv1 [ 841.945770][T26345] bond3: (slave batadv1): making interface the new active one [ 841.958039][T26345] bond3: (slave batadv1): Enslaving as an active interface with an up link [ 842.349336][T26365] netlink: 64 bytes leftover after parsing attributes in process `syz.2.6293'. [ 842.415415][T26365] netlink: 'syz.2.6293': attribute type 1 has an invalid length. [ 842.568889][T26366] netlink: 'syz.2.6293': attribute type 3 has an invalid length. [ 842.577155][T26366] netlink: 3 bytes leftover after parsing attributes in process `syz.2.6293'. [ 842.592285][T26369] netlink: 4768 bytes leftover after parsing attributes in process `syz.1.6294'. [ 842.672289][T26372] 8021q: adding VLAN 0 to HW filter on device bond5 [ 842.682860][T26372] bond4: (slave bond5): making interface the new active one [ 842.692716][T26372] bond4: (slave bond5): Enslaving as an active interface with an up link [ 842.859852][T26379] FAULT_INJECTION: forcing a failure. [ 842.859852][T26379] name failslab, interval 1, probability 0, space 0, times 0 [ 842.873128][T26379] CPU: 0 UID: 0 PID: 26379 Comm: syz.5.6296 Not tainted syzkaller #0 PREEMPT(full) [ 842.873159][T26379] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 842.873173][T26379] Call Trace: [ 842.873182][T26379] [ 842.873192][T26379] dump_stack_lvl+0xe8/0x150 [ 842.873236][T26379] should_fail_ex+0x412/0x560 [ 842.873267][T26379] should_failslab+0xa8/0x100 [ 842.873289][T26379] ? skb_clone+0x212/0x3a0 [ 842.873316][T26379] kmem_cache_alloc_noprof+0x87/0x650 [ 842.873348][T26379] ? __netlink_lookup+0xc6/0x8b0 [ 842.873383][T26379] skb_clone+0x212/0x3a0 [ 842.873413][T26379] __netlink_deliver_tap+0x404/0x850 [ 842.873453][T26379] ? netlink_deliver_tap+0x2e/0x1b0 [ 842.873482][T26379] netlink_deliver_tap+0x19c/0x1b0 [ 842.873507][T26379] netlink_unicast+0x730/0x8e0 [ 842.873541][T26379] netlink_sendmsg+0x813/0xb40 [ 842.873578][T26379] ? __pfx_netlink_sendmsg+0x10/0x10 [ 842.873610][T26379] ? aa_sock_msg_perm+0xf1/0x1b0 [ 842.873647][T26379] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 842.873681][T26379] ____sys_sendmsg+0x972/0x9f0 [ 842.873706][T26379] ? __might_fault+0xaf/0x130 [ 842.873741][T26379] ? __pfx_____sys_sendmsg+0x10/0x10 [ 842.873777][T26379] ? import_iovec+0x73/0xa0 [ 842.873809][T26379] ___sys_sendmsg+0x2a5/0x360 [ 842.873833][T26379] ? __lock_acquire+0x6b5/0x2cf0 [ 842.873862][T26379] ? __pfx____sys_sendmsg+0x10/0x10 [ 842.873929][T26379] ? __fget_files+0x2a/0x420 [ 842.873956][T26379] ? __fget_files+0x3a0/0x420 [ 842.873996][T26379] __x64_sys_sendmsg+0x1bd/0x2a0 [ 842.874026][T26379] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 842.874064][T26379] ? __pfx_ksys_write+0x10/0x10 [ 842.874111][T26379] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 842.874137][T26379] do_syscall_64+0x174/0x580 [ 842.874162][T26379] ? trace_irq_disable+0x3b/0x140 [ 842.874196][T26379] ? clear_bhb_loop+0x40/0x90 [ 842.874234][T26379] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 842.874258][T26379] RIP: 0033:0x7f277e19ce59 [ 842.874279][T26379] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 842.874298][T26379] RSP: 002b:00007f277f0eb028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 842.874321][T26379] RAX: ffffffffffffffda RBX: 00007f277e416090 RCX: 00007f277e19ce59 [ 842.874338][T26379] RDX: 0000000000000000 RSI: 0000200000000000 RDI: 0000000000000005 [ 842.874352][T26379] RBP: 00007f277f0eb090 R08: 0000000000000000 R09: 0000000000000000 [ 842.874367][T26379] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 842.874380][T26379] R13: 00007f277e416128 R14: 00007f277e416090 R15: 00007fff3bfdfe78 [ 842.874417][T26379] [ 843.333994][ T1165] bridge_slave_1: left allmulticast mode [ 843.339942][ T1165] bridge_slave_1: left promiscuous mode [ 843.345747][ T1165] bridge0: port 2(bridge_slave_1) entered disabled state [ 843.647104][ T50] Bluetooth: hci4: command tx timeout [ 843.689258][ T1165] bond1 (unregistering): (slave gretap1): Releasing backup interface [ 843.823713][ T1165] bond1 (unregistering): (slave bond2): Releasing backup interface [ 843.839855][ T1165] bond1 (unregistering): Released all slaves [ 843.867404][ T1165] bond2 (unregistering): Released all slaves [ 843.891497][ T1165] bond3 (unregistering): (slave bond4): Releasing backup interface [ 843.905431][ T1165] bond3 (unregistering): Released all slaves [ 843.931637][ T1165] bond4 (unregistering): Released all slaves [ 843.966925][ T1165] bond5 (unregistering): (slave veth3): Releasing backup interface [ 843.981983][ T1165] bond5 (unregistering): Released all slaves [ 844.006679][ T1165] bond0 (unregistering): Released all slaves [ 844.031251][ T1165] bond6 (unregistering): (slave bond7): Releasing backup interface [ 844.044947][ T1165] bond6 (unregistering): Released all slaves [ 844.073390][ T1165] bond7 (unregistering): Released all slaves [ 844.100327][ T1165] bond8 (unregistering): Released all slaves [ 844.125582][ T1165] bond9 (unregistering): Released all slaves [ 844.153121][ T1165] bond10 (unregistering): (slave bond11): Releasing backup interface [ 844.168389][ T1165] bond10 (unregistering): Released all slaves [ 844.187098][ T1165] bond11 (unregistering): Released all slaves [ 844.216002][ T1165] bond12 (unregistering): Released all slaves [ 844.233107][ T1165] bond13 (unregistering): Released all slaves [ 844.252709][ T1165] bond14 (unregistering): Released all slaves [ 844.276785][ T1165] bond15 (unregistering): Released all slaves [ 844.293756][ T1165] bond16 (unregistering): Released all slaves [ 844.311401][ T1165] bond17 (unregistering): (slave bond18): Releasing backup interface [ 844.320758][ T1165] bond17 (unregistering): Released all slaves [ 844.346664][ T1165] bond18 (unregistering): Released all slaves [ 844.364278][ T1165] bond19 (unregistering): (slave veth7): Releasing backup interface [ 844.382308][ T1165] bond19 (unregistering): Released all slaves [ 844.400364][ T1165] bond20 (unregistering): (slave bond21): Releasing backup interface [ 844.409664][ T1165] bond20 (unregistering): Released all slaves [ 844.425592][ T1165] bond21 (unregistering): Released all slaves [ 844.669482][ T1165] tipc: Left network mode [ 844.899172][T26357] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 844.915607][T26215] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 844.962230][T26215] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 845.006900][T26215] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 845.051861][T26215] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 845.168967][T26215] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 845.200556][T26215] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 845.220544][T26215] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 845.256071][T26215] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 845.341485][ T1165] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 845.353306][ T1165] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 845.368326][ T1165] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 845.383419][T26408] FAULT_INJECTION: forcing a failure. [ 845.383419][T26408] name failslab, interval 1, probability 0, space 0, times 0 [ 845.395600][ T1165] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 845.398916][T26408] CPU: 1 UID: 0 PID: 26408 Comm: syz.5.6304 Not tainted syzkaller #0 PREEMPT(full) [ 845.398993][T26408] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 845.399040][T26408] Call Trace: [ 845.399071][T26408] [ 845.399109][T26408] dump_stack_lvl+0xe8/0x150 [ 845.399217][T26408] should_fail_ex+0x412/0x560 [ 845.399304][T26408] should_failslab+0xa8/0x100 [ 845.399361][T26408] ? skb_clone+0x212/0x3a0 [ 845.399440][T26408] kmem_cache_alloc_noprof+0x87/0x650 [ 845.399536][T26408] ? __netlink_lookup+0xc6/0x8b0 [ 845.399632][T26408] skb_clone+0x212/0x3a0 [ 845.399718][T26408] __netlink_deliver_tap+0x404/0x850 [ 845.399826][T26408] ? netlink_deliver_tap+0x2e/0x1b0 [ 845.399901][T26408] netlink_deliver_tap+0x19c/0x1b0 [ 845.399984][T26408] netlink_unicast+0x730/0x8e0 [ 845.400068][T26408] netlink_sendmsg+0x813/0xb40 [ 845.400166][T26408] ? __pfx_netlink_sendmsg+0x10/0x10 [ 845.400254][T26408] ? aa_sock_msg_perm+0xf1/0x1b0 [ 845.400353][T26408] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 845.400458][T26408] ____sys_sendmsg+0x972/0x9f0 [ 845.400561][T26408] ? __might_fault+0xaf/0x130 [ 845.400674][T26408] ? __pfx_____sys_sendmsg+0x10/0x10 [ 845.400772][T26408] ? import_iovec+0x73/0xa0 [ 845.400860][T26408] ___sys_sendmsg+0x2a5/0x360 [ 845.400935][T26408] ? __lock_acquire+0x6b5/0x2cf0 [ 845.401024][T26408] ? __pfx____sys_sendmsg+0x10/0x10 [ 845.401201][T26408] ? __fget_files+0x2a/0x420 [ 845.401278][T26408] ? __fget_files+0x3a0/0x420 [ 845.401389][T26408] __x64_sys_sendmsg+0x1bd/0x2a0 [ 845.401474][T26408] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 845.401585][T26408] ? __pfx_ksys_write+0x10/0x10 [ 845.401710][T26408] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 845.401777][T26408] do_syscall_64+0x174/0x580 [ 845.401857][T26408] ? trace_irq_disable+0x3b/0x140 [ 845.401979][T26408] ? clear_bhb_loop+0x40/0x90 [ 845.402060][T26408] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 845.402123][T26408] RIP: 0033:0x7f277e19ce59 [ 845.402186][T26408] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 845.402241][T26408] RSP: 002b:00007f277f10c028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 845.402307][T26408] RAX: ffffffffffffffda RBX: 00007f277e415fa0 RCX: 00007f277e19ce59 [ 845.402359][T26408] RDX: 0000000000000000 RSI: 0000200000000300 RDI: 0000000000000003 [ 845.402393][T26408] RBP: 00007f277f10c090 R08: 0000000000000000 R09: 0000000000000000 [ 845.402435][T26408] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 845.402475][T26408] R13: 00007f277e416038 R14: 00007f277e415fa0 R15: 00007fff3bfdfe78 [ 845.402574][T26408] [ 845.693141][ T1165] veth1_macvtap: left promiscuous mode [ 845.706075][ T1165] veth0_macvtap: left promiscuous mode [ 845.726787][ T50] Bluetooth: hci4: command 0x0419 tx timeout [ 845.945045][ T1165] pim6reg (unregistering): left allmulticast mode [ 846.065739][T26423] openvswitch: netlink: Actions may not be safe on all matching packets [ 846.185530][ T1165] team0 (unregistering): Port device team_slave_1 removed [ 846.225343][ T1165] team0 (unregistering): Port device team_slave_0 removed [ 846.470373][ T37] smbdirect: ib_dev[syz1] removed [ 846.721593][T17257] infiniband syz1: ib_query_port failed (-19) [ 847.065521][T26449] FAULT_INJECTION: forcing a failure. [ 847.065521][T26449] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 847.126450][T26449] CPU: 1 UID: 0 PID: 26449 Comm: syz.1.6312 Not tainted syzkaller #0 PREEMPT(full) [ 847.126479][T26449] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 847.126492][T26449] Call Trace: [ 847.126500][T26449] [ 847.126509][T26449] dump_stack_lvl+0xe8/0x150 [ 847.126537][T26449] should_fail_ex+0x412/0x560 [ 847.126564][T26449] _copy_from_user+0x2d/0xb0 [ 847.126589][T26449] ___sys_sendmsg+0x1c6/0x360 [ 847.126612][T26449] ? __lock_acquire+0x6b5/0x2cf0 [ 847.126638][T26449] ? __pfx____sys_sendmsg+0x10/0x10 [ 847.126693][T26449] ? __fget_files+0x2a/0x420 [ 847.126717][T26449] ? __fget_files+0x3a0/0x420 [ 847.126750][T26449] __x64_sys_sendmsg+0x1bd/0x2a0 [ 847.126776][T26449] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 847.126808][T26449] ? __pfx_ksys_write+0x10/0x10 [ 847.126846][T26449] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 847.126870][T26449] do_syscall_64+0x174/0x580 [ 847.126891][T26449] ? trace_irq_disable+0x3b/0x140 [ 847.126921][T26449] ? clear_bhb_loop+0x40/0x90 [ 847.126944][T26449] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 847.126963][T26449] RIP: 0033:0x7f72e919ce59 [ 847.126982][T26449] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 847.126998][T26449] RSP: 002b:00007f72e73f6028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 847.127019][T26449] RAX: ffffffffffffffda RBX: 00007f72e9415fa0 RCX: 00007f72e919ce59 [ 847.127034][T26449] RDX: 0000000000000800 RSI: 00002000000001c0 RDI: 0000000000000003 [ 847.127046][T26449] RBP: 00007f72e73f6090 R08: 0000000000000000 R09: 0000000000000000 [ 847.127057][T26449] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 847.127069][T26449] R13: 00007f72e9416038 R14: 00007f72e9415fa0 R15: 00007fff7500e838 [ 847.127100][T26449] [ 847.284165][T26215] 8021q: adding VLAN 0 to HW filter on device bond0 [ 847.572873][T26215] 8021q: adding VLAN 0 to HW filter on device team0 [ 847.640867][T10159] bridge0: port 1(bridge_slave_0) entered blocking state [ 847.648196][T10159] bridge0: port 1(bridge_slave_0) entered forwarding state [ 847.730958][T10159] bridge0: port 2(bridge_slave_1) entered blocking state [ 847.738316][T10159] bridge0: port 2(bridge_slave_1) entered forwarding state [ 847.807275][ T5635] Bluetooth: hci4: command 0x0419 tx timeout [ 847.831994][ T1165] IPVS: stop unused estimator thread 0... [ 848.748071][T26486] FAULT_INJECTION: forcing a failure. [ 848.748071][T26486] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 848.797929][T26486] CPU: 1 UID: 0 PID: 26486 Comm: syz.2.6319 Not tainted syzkaller #0 PREEMPT(full) [ 848.797961][T26486] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 848.797974][T26486] Call Trace: [ 848.797984][T26486] [ 848.797993][T26486] dump_stack_lvl+0xe8/0x150 [ 848.798024][T26486] should_fail_ex+0x412/0x560 [ 848.798054][T26486] _copy_from_user+0x2d/0xb0 [ 848.798082][T26486] ___sys_recvmsg+0x175/0x590 [ 848.798117][T26486] ? __pfx____sys_recvmsg+0x10/0x10 [ 848.798149][T26486] ? __fget_files+0x2a/0x420 [ 848.798220][T26486] do_recvmmsg+0x334/0x800 [ 848.798256][T26486] ? __pfx_do_recvmmsg+0x10/0x10 [ 848.798297][T26486] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 848.798358][T26486] __x64_sys_recvmmsg+0x198/0x250 [ 848.798390][T26486] ? __pfx___x64_sys_recvmmsg+0x10/0x10 [ 848.798428][T26486] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 848.798453][T26486] do_syscall_64+0x174/0x580 [ 848.798476][T26486] ? trace_irq_disable+0x3b/0x140 [ 848.798509][T26486] ? clear_bhb_loop+0x40/0x90 [ 848.798536][T26486] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 848.798559][T26486] RIP: 0033:0x7f1068d9ce59 [ 848.798580][T26486] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 848.798599][T26486] RSP: 002b:00007f1069c8c028 EFLAGS: 00000246 ORIG_RAX: 000000000000012b [ 848.798622][T26486] RAX: ffffffffffffffda RBX: 00007f1069015fa0 RCX: 00007f1068d9ce59 [ 848.798639][T26486] RDX: 00000000040002ce RSI: 0000200000000c40 RDI: 0000000000000005 [ 848.798654][T26486] RBP: 00007f1069c8c090 R08: 0000000000000000 R09: 0000000000000000 [ 848.798669][T26486] R10: 0000000000000080 R11: 0000000000000246 R12: 0000000000000002 [ 848.798682][T26486] R13: 00007f1069016038 R14: 00007f1069015fa0 R15: 00007ffe7692eff8 [ 848.798718][T26486] [ 849.233047][T26498] netlink: 'syz.4.6323': attribute type 29 has an invalid length. [ 849.288693][T26492] netlink: 'syz.4.6323': attribute type 29 has an invalid length. [ 849.672014][T26514] pim6reg: entered allmulticast mode [ 849.718081][T26514] pim6reg: left allmulticast mode [ 849.748510][T26215] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 849.882670][T26215] veth0_vlan: entered promiscuous mode [ 849.909616][T26215] veth1_vlan: entered promiscuous mode [ 849.919680][T26526] netlink: 'syz.2.6329': attribute type 1 has an invalid length. [ 850.119574][T26526] 8021q: adding VLAN 0 to HW filter on device bond7 [ 850.187502][T26526] bond6: (slave bond7): making interface the new active one [ 850.213991][T26526] bond6: (slave bond7): Enslaving as an active interface with an up link [ 850.351371][T26215] veth0_macvtap: entered promiscuous mode [ 850.404752][T26215] veth1_macvtap: entered promiscuous mode [ 850.484621][T26215] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 850.518386][T26215] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 850.522021][T26549] netlink: 'syz.1.6333': attribute type 30 has an invalid length. [ 850.546512][T26549] netlink: 4 bytes leftover after parsing attributes in process `syz.1.6333'. [ 850.598897][T26551] netlink: 'syz.1.6333': attribute type 30 has an invalid length. [ 850.612228][T10544] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 850.625664][T26551] netlink: 4 bytes leftover after parsing attributes in process `syz.1.6333'. [ 850.639144][T10544] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 850.725551][T10544] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 850.742106][T26559] netlink: 'syz.1.6333': attribute type 1 has an invalid length. [ 850.753170][T10544] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 850.978869][T26559] 8021q: adding VLAN 0 to HW filter on device bond2 [ 851.400023][T26577] netlink: 28 bytes leftover after parsing attributes in process `syz.1.6337'. [ 851.415312][T26577] netlink: 28 bytes leftover after parsing attributes in process `syz.1.6337'. [ 851.482101][ T1165] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 851.524725][ T1165] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 851.756897][T26594] netlink: 'syz.4.6341': attribute type 1 has an invalid length. [ 851.887677][T26604] sctp: [Deprecated]: syz.4.6341 (pid 26604) Use of int in maxseg socket option. [ 851.887677][T26604] Use struct sctp_assoc_value instead [ 851.933754][T26604] netlink: 'syz.4.6341': attribute type 10 has an invalid length. [ 852.058170][T26594] 8021q: adding VLAN 0 to HW filter on device bond1 [ 852.177230][T26599] bond1: (slave veth3): Enslaving as an active interface with a down link [ 852.261867][T26591] bond3: option lp_interval: invalid value (0) [ 852.271730][T26591] bond3: option lp_interval: allowed values 1 - 2147483647 [ 852.281854][T26591] bond3 (unregistering): Released all slaves [ 852.322351][T26604] bridge0: port 2(bridge_slave_1) entered disabled state [ 852.330175][T26604] bridge0: port 1(bridge_slave_0) entered disabled state [ 852.345426][T26604] bridge0: port 2(bridge_slave_1) entered blocking state [ 852.352718][T26604] bridge0: port 2(bridge_slave_1) entered forwarding state [ 852.360378][T26604] bridge0: port 1(bridge_slave_0) entered blocking state [ 852.367628][T26604] bridge0: port 1(bridge_slave_0) entered forwarding state [ 852.379982][T26604] bond0: (slave bridge0): Enslaving as an active interface with an up link [ 852.529420][T10544] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 852.546644][T10544] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 852.579955][T26618] netlink: 8 bytes leftover after parsing attributes in process `syz.4.6342'. [ 856.834060][T26618] vlan2: entered allmulticast mode [ 856.840187][T26618] bond_slave_1: entered allmulticast mode [ 857.527131][T26679] netlink: 5220 bytes leftover after parsing attributes in process `syz.1.6353'. [ 857.547932][T26679] netlink: 964 bytes leftover after parsing attributes in process `syz.1.6353'. [ 857.578387][T26679] netlink: 5220 bytes leftover after parsing attributes in process `syz.1.6353'. [ 857.700164][T26690] netlink: 224 bytes leftover after parsing attributes in process `syz.0.6355'. [ 857.711729][T26690] netlink: 2 bytes leftover after parsing attributes in process `syz.0.6355'. [ 857.730304][T26690] netlink: 1028 bytes leftover after parsing attributes in process `syz.0.6355'. [ 857.741013][T26690] sch_tbf: peakrate 7 is lower than or equals to rate 6829859379779001161 ! [ 857.755568][T26693] syzkaller0: entered promiscuous mode [ 857.766007][T26693] syzkaller0: entered allmulticast mode [ 857.952893][T26704] netlink: 4 bytes leftover after parsing attributes in process `syz.5.6358'. [ 857.981888][T26704] openvswitch: netlink: IPv4 frag type 127 is out of range max 2 [ 858.005691][T26705] netlink: 256 bytes leftover after parsing attributes in process `syz.5.6358'. [ 858.294837][T26719] netlink: 'syz.1.6367': attribute type 29 has an invalid length. [ 858.303447][T26719] netlink: 8 bytes leftover after parsing attributes in process `syz.1.6367'. [ 858.313632][T26719] netlink: 'syz.1.6367': attribute type 29 has an invalid length. [ 858.321977][T26719] netlink: 8 bytes leftover after parsing attributes in process `syz.1.6367'. [ 858.332406][T26719] netlink: 'syz.1.6367': attribute type 29 has an invalid length. [ 858.343677][T26717] netlink: 'syz.4.6366': attribute type 1 has an invalid length. [ 858.352541][T26719] netlink: 'syz.1.6367': attribute type 29 has an invalid length. [ 858.381391][T26719] netlink: 'syz.1.6367': attribute type 29 has an invalid length. [ 858.403217][T26719] netlink: 'syz.1.6367': attribute type 29 has an invalid length. [ 858.421860][T26721] hsr0: entered promiscuous mode [ 858.429673][T26719] netlink: 'syz.1.6367': attribute type 29 has an invalid length. [ 858.450016][T26719] netlink: 'syz.1.6367': attribute type 29 has an invalid length. [ 858.459119][T26719] netlink: 'syz.1.6367': attribute type 29 has an invalid length. [ 858.832050][T17257] IPVS: starting estimator thread 0... [ 858.956441][T26740] tipc: Started in network mode [ 858.961775][T26734] IPVS: using max 29 ests per chain, 69600 per kthread [ 858.963341][T26740] tipc: Node identity 5258b81e817b, cluster identity 4711 [ 858.990404][T26740] tipc: Enabled bearer , priority 0 [ 859.040748][T26740] tipc: Disabling bearer [ 859.430317][T26761] dvmrp0: entered allmulticast mode [ 859.469086][T26750] 8021q: adding VLAN 0 to HW filter on device bond4 [ 859.478448][T26750] bond3: (slave bond4): making interface the new active one [ 859.488567][T26750] bond3: (slave bond4): Enslaving as an active interface with an up link [ 859.498807][ T1165] netdevsim netdevsim2 netdevsim0: set [0, 0] type 1 family 0 port 8472 - 0 [ 859.522808][ T1165] netdevsim netdevsim2 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0 [ 859.559302][T26763] ip6gre1: entered promiscuous mode [ 859.570753][T26763] ip6gre1: entered allmulticast mode [ 859.618377][ T1165] netdevsim netdevsim2 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0 [ 859.647151][ T76] netdevsim netdevsim2 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0 [ 859.791772][ T13] ip6_tunnel: ip6gre1 xmit: Local address not yet configured! [ 859.802025][ T13] ip6_tunnel: ip6gre1 xmit: Local address not yet configured! [ 859.826140][T17255] ip6_tunnel: ip6gre1 xmit: Local address not yet configured! [ 859.894799][T26781] syzkaller0: entered promiscuous mode [ 859.906079][T26781] syzkaller0: entered allmulticast mode [ 860.109041][T17255] ip6_tunnel: ip6gre1 xmit: Local address not yet configured! [ 860.752622][T26815] block nbd0: not configured, cannot reconfigure [ 860.767530][T17255] ip6_tunnel: ip6gre1 xmit: Local address not yet configured! [ 861.186272][T26832] FAULT_INJECTION: forcing a failure. [ 861.186272][T26832] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 861.207708][T26832] CPU: 1 UID: 0 PID: 26832 Comm: syz.5.6400 Not tainted syzkaller #0 PREEMPT(full) [ 861.207740][T26832] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 861.207755][T26832] Call Trace: [ 861.207765][T26832] [ 861.207775][T26832] dump_stack_lvl+0xe8/0x150 [ 861.207807][T26832] should_fail_ex+0x412/0x560 [ 861.207838][T26832] _copy_to_user+0x31/0xb0 [ 861.207875][T26832] simple_read_from_buffer+0xe1/0x170 [ 861.207910][T26832] proc_fail_nth_read+0x1bb/0x230 [ 861.207945][T26832] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 861.207979][T26832] ? rw_verify_area+0x2a6/0x4d0 [ 861.208011][T26832] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 861.208044][T26832] vfs_read+0x20c/0xa70 [ 861.208082][T26832] ? __pfx___mutex_lock+0x10/0x10 [ 861.208110][T26832] ? __pfx_vfs_read+0x10/0x10 [ 861.208144][T26832] ? __fget_files+0x2a/0x420 [ 861.208178][T26832] ? __fget_files+0x3a0/0x420 [ 861.208205][T26832] ? __fget_files+0x2a/0x420 [ 861.208243][T26832] ksys_read+0x150/0x270 [ 861.208279][T26832] ? __pfx_ksys_read+0x10/0x10 [ 861.208321][T26832] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 861.208346][T26832] do_syscall_64+0x174/0x580 [ 861.208370][T26832] ? trace_irq_disable+0x3b/0x140 [ 861.208413][T26832] ? clear_bhb_loop+0x40/0x90 [ 861.208442][T26832] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 861.208464][T26832] RIP: 0033:0x7f277e15d68e [ 861.208486][T26832] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 861.208506][T26832] RSP: 002b:00007f277f10bfe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 861.208531][T26832] RAX: ffffffffffffffda RBX: 00007f277f10c6c0 RCX: 00007f277e15d68e [ 861.208548][T26832] RDX: 000000000000000f RSI: 00007f277f10c0a0 RDI: 0000000000000004 [ 861.208562][T26832] RBP: 00007f277f10c090 R08: 0000000000000000 R09: 0000000000000000 [ 861.208576][T26832] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 861.208588][T26832] R13: 00007f277e416038 R14: 00007f277e415fa0 R15: 00007fff3bfdfe78 [ 861.208625][T26832] [ 862.561958][T26882] __nla_validate_parse: 37 callbacks suppressed [ 862.561985][T26882] netlink: 4 bytes leftover after parsing attributes in process `syz.5.6415'. [ 862.798415][T26892] netlink: 52 bytes leftover after parsing attributes in process `syz.1.6419'. [ 862.824547][T26887] [ 862.826949][T26887] ====================================================== [ 862.834011][T26887] WARNING: possible circular locking dependency detected [ 862.841069][T26887] syzkaller #0 Not tainted [ 862.845507][T26887] ------------------------------------------------------ [ 862.852629][T26887] syz.5.6418/26887 is trying to acquire lock: [ 862.858718][T26887] ffff88806804d568 ((work_completion)(&new_smc->smc_listen_work)){+.+.}-{0:0}, at: __flush_work+0x100/0xc50 [ 862.870320][T26887] [ 862.870320][T26887] but task is already holding lock: [ 862.877737][T26887] ffff88806804d9e0 (sk_lock-AF_SMC/1){+.+.}-{0:0}, at: smc_release+0x255/0x560 [ 862.886856][T26887] [ 862.886856][T26887] which lock already depends on the new lock. [ 862.886856][T26887] [ 862.897277][T26887] [ 862.897277][T26887] the existing dependency chain (in reverse order) is: [ 862.906303][T26887] [ 862.906303][T26887] -> #1 (sk_lock-AF_SMC/1){+.+.}-{0:0}: [ 862.914067][T26887] lock_sock_nested+0x41/0x100 [ 862.919382][T26887] smc_listen_out+0x109/0x3e0 [ 862.924596][T26887] smc_listen_work+0x813/0x13f0 [ 862.929995][T26887] process_scheduled_works+0xb5d/0x1860 [ 862.936086][T26887] worker_thread+0xa53/0xfc0 [ 862.941215][T26887] kthread+0x389/0x470 [ 862.945832][T26887] ret_from_fork+0x514/0xb70 [ 862.950968][T26887] ret_from_fork_asm+0x1a/0x30 [ 862.956274][T26887] [ 862.956274][T26887] -> #0 ((work_completion)(&new_smc->smc_listen_work)){+.+.}-{0:0}: [ 862.966584][T26887] __lock_acquire+0x15a5/0x2cf0 [ 862.972158][T26887] lock_acquire+0x106/0x350 [ 862.977202][T26887] __flush_work+0x700/0xc50 [ 862.982251][T26887] __cancel_work_sync+0xbe/0x110 [ 862.987740][T26887] smc_clcsock_release+0x60/0xf0 [ 862.993300][T26887] __smc_release+0x66b/0x7e0 [ 862.998460][T26887] smc_close_non_accepted+0xd5/0x1f0 [ 863.004292][T26887] smc_close_active+0xb67/0xf10 [ 863.009688][T26887] __smc_release+0x8d/0x7e0 [ 863.014738][T26887] smc_release+0x2ce/0x560 [ 863.019701][T26887] sock_close+0xc3/0x240 [ 863.024496][T26887] __fput+0x44f/0xa60 [ 863.029032][T26887] task_work_run+0x1d9/0x270 [ 863.034209][T26887] exit_to_user_mode_loop+0x193/0x680 [ 863.040125][T26887] do_syscall_64+0x353/0x580 [ 863.045265][T26887] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 863.051789][T26887] [ 863.051789][T26887] other info that might help us debug this: [ 863.051789][T26887] [ 863.062029][T26887] Possible unsafe locking scenario: [ 863.062029][T26887] [ 863.069492][T26887] CPU0 CPU1 [ 863.074874][T26887] ---- ---- [ 863.080257][T26887] lock(sk_lock-AF_SMC/1); [ 863.084793][T26887] lock((work_completion)(&new_smc->smc_listen_work)); [ 863.094272][T26887] lock(sk_lock-AF_SMC/1); [ 863.101324][T26887] lock((work_completion)(&new_smc->smc_listen_work)); [ 863.108372][T26887] [ 863.108372][T26887] *** DEADLOCK *** [ 863.108372][T26887] [ 863.116526][T26887] 3 locks held by syz.5.6418/26887: [ 863.121734][T26887] #0: ffff888077226400 (&sb->s_type->i_mutex_key#13){+.+.}-{4:4}, at: sock_close+0x9b/0x240 [ 863.132043][T26887] #1: ffff88806804d9e0 (sk_lock-AF_SMC/1){+.+.}-{0:0}, at: smc_release+0x255/0x560 [ 863.141581][T26887] #2: ffffffff8e95cc20 (rcu_read_lock){....}-{1:3}, at: __flush_work+0x100/0xc50 [ 863.150838][T26887] [ 863.150838][T26887] stack backtrace: [ 863.156743][T26887] CPU: 1 UID: 0 PID: 26887 Comm: syz.5.6418 Not tainted syzkaller #0 PREEMPT(full) [ 863.156764][T26887] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 863.156776][T26887] Call Trace: [ 863.156784][T26887] [ 863.156792][T26887] dump_stack_lvl+0xe8/0x150 [ 863.156813][T26887] print_circular_bug+0x2e1/0x300 [ 863.156840][T26887] check_noncircular+0x12e/0x150 [ 863.156866][T26887] __lock_acquire+0x15a5/0x2cf0 [ 863.156888][T26887] ? do_raw_spin_lock+0x12b/0x2f0 [ 863.156919][T26887] ? __flush_work+0x100/0xc50 [ 863.156939][T26887] lock_acquire+0x106/0x350 [ 863.156956][T26887] ? __flush_work+0x100/0xc50 [ 863.156981][T26887] ? __flush_work+0x100/0xc50 [ 863.157002][T26887] __flush_work+0x700/0xc50 [ 863.157021][T26887] ? __flush_work+0x100/0xc50 [ 863.157042][T26887] ? __flush_work+0x100/0xc50 [ 863.157063][T26887] ? __pfx___flush_work+0x10/0x10 [ 863.157084][T26887] ? __pfx_wq_barrier_func+0x10/0x10 [ 863.157112][T26887] ? __cancel_work_sync+0x5c/0x110 [ 863.157136][T26887] __cancel_work_sync+0xbe/0x110 [ 863.157158][T26887] smc_clcsock_release+0x60/0xf0 [ 863.157180][T26887] __smc_release+0x66b/0x7e0 [ 863.157206][T26887] ? __local_bh_enable_ip+0xd0/0x130 [ 863.157226][T26887] smc_close_non_accepted+0xd5/0x1f0 [ 863.157255][T26887] smc_close_active+0xb67/0xf10 [ 863.157276][T26887] ? __pfx_sock_def_readable+0x10/0x10 [ 863.157303][T26887] __smc_release+0x8d/0x7e0 [ 863.157328][T26887] ? __local_bh_enable_ip+0xd0/0x130 [ 863.157348][T26887] smc_release+0x2ce/0x560 [ 863.157375][T26887] sock_close+0xc3/0x240 [ 863.157400][T26887] ? __pfx_sock_close+0x10/0x10 [ 863.157423][T26887] __fput+0x44f/0xa60 [ 863.157449][T26887] task_work_run+0x1d9/0x270 [ 863.157476][T26887] ? __pfx_task_work_run+0x10/0x10 [ 863.157505][T26887] exit_to_user_mode_loop+0x193/0x680 [ 863.157522][T26887] ? rcu_is_watching+0x15/0xb0 [ 863.157543][T26887] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 863.157562][T26887] do_syscall_64+0x353/0x580 [ 863.157581][T26887] ? trace_irq_disable+0x3b/0x140 [ 863.157609][T26887] ? clear_bhb_loop+0x40/0x90 [ 863.157634][T26887] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 863.157652][T26887] RIP: 0033:0x7f277e19ce59 [ 863.157668][T26887] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 863.157684][T26887] RSP: 002b:00007fff3bfdffd8 EFLAGS: 00000246 ORIG_RAX: 00000000000001b4 [ 863.157702][T26887] RAX: 0000000000000000 RBX: 00007fff3bfe00c0 RCX: 00007f277e19ce59 [ 863.157715][T26887] RDX: 0000000000000000 RSI: 000000000000001e RDI: 0000000000000003 [ 863.157726][T26887] RBP: 00000000000d29d1 R08: 0000000000000001 R09: 0000000000000000 [ 863.157737][T26887] R10: 0000001b30a20000 R11: 0000000000000246 R12: 00007fff3bfe0100 [ 863.157749][T26887] R13: 00007f277e415fac R14: 00000000000d2a2c R15: 00007f277e415fa0 [ 863.157770][T26887] [ 863.624386][T26884] ieee80211 : Selected rate control algorithm 'minstrel_ht' [ 863.806120][ C0] ip6_tunnel: ip6gre1 xmit: Local address not yet configured! [ 871.645988][ C0] ip6_tunnel: ip6gre1 xmit: Local address not yet configured!