last executing test programs: 17.332239046s ago: executing program 3 (id=5959): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$gtp(0x0, r0) r2 = socket(0x10, 0x803, 0x0) syz_genetlink_get_family_id$nl80211(&(0x7f0000000180), r2) getsockname$packet(r2, &(0x7f00000001c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r2, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000280)={&(0x7f00000002c0)=@newlink={0x38, 0x10, 0x437, 0x800000, 0x0, {0x0, 0x0, 0x0, r3, 0x504c3}, [@IFLA_LINKINFO={0x18, 0x12, 0x0, 0x1, @gtp={{0x8}, {0xc, 0x2, 0x0, 0x1, [@IFLA_GTP_FD0={0x8, 0x1, @udp6}]}}}]}, 0x38}, 0x1, 0x0, 0x0, 0x2000c014}, 0x0) sendmsg$GTP_CMD_DELPDP(r0, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000000)=ANY=[@ANYBLOB='4\x00\x00\x00', @ANYRES16=r1, @ANYBLOB="03002cbd70000e0000000100000008000100", @ANYRES32=r3, @ANYBLOB="0800020000001f515b11373ac367db11050046a518d281a02a8c2a3f1544d5f2c4fd6002830f2d308fa430c8b2d0e56775db423ee8a64ec7167fbb658f18f441a097a45ba25f8669d523042412e9560b645562e4a27c3bc8df093f23ef4d5dfded6090452a"], 0x34}, 0x1, 0x0, 0x0, 0x44800}, 0x20000000) 16.598533607s ago: executing program 3 (id=5963): r0 = socket$nl_route(0x10, 0x3, 0x0) (async) r1 = socket$inet6_udp(0xa, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000c80)={'lo\x00', 0x0}) r3 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f0000000040)={0x3, 0x4, 0x4, 0xa, 0x0, 0x1, 0x5, '\x00', r2, 0xffffffffffffffff, 0x2, 0x2, 0x2}, 0x50) (async) r4 = bpf$PROG_LOAD(0x5, &(0x7f0000000380)={0x16, 0xd, &(0x7f0000000100)=@raw=[@snprintf={{}, {}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0xa2f3}}], &(0x7f0000000180)='GPL\x00', 0x101, 0x68, &(0x7f00000001c0)=""/104, 0x41100, 0x9, '\x00', r2, @fallback=0x19, 0xffffffffffffffff, 0x8, &(0x7f0000000240)={0x8, 0x5}, 0x8, 0x10, &(0x7f0000000280)={0x5, 0xf, 0x1, 0x5}, 0x10, 0xffffffffffffffff, 0xffffffffffffffff, 0x3, &(0x7f0000000300)=[0x1], &(0x7f0000000340)=[{0x4, 0x5, 0x7, 0x4}, {0x5, 0x1, 0xe, 0x5}, {0x2, 0x5, 0xd, 0xb}]}, 0x94) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000480)={{r3}, &(0x7f00000000c0), &(0x7f0000000440)=r4}, 0x20) (async) sendmsg$nl_route_sched(r0, &(0x7f0000001200)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000002c0)=@newqdisc={0x24, 0x24, 0x4ee4e6a52ff56541, 0x0, 0x0, {0x0, 0x0, 0x0, r2, {}, {0xffff, 0xffff}, {0x0, 0xb}}}, 0x24}, 0x1, 0x0, 0x0, 0x400c881}, 0x40000) 16.16020873s ago: executing program 3 (id=5964): socket$nl_generic(0x10, 0x3, 0x10) r0 = bpf$ITER_CREATE(0xb, 0x0, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) bpf$BPF_PROG_DETACH(0x1c, &(0x7f0000000440)=ANY=[@ANYRES32=r0, @ANYRES32, @ANYBLOB], 0x20) pread64(r0, 0x0, 0x0, 0x5) r1 = syz_init_net_socket$x25(0x9, 0x5, 0x0) bind$x25(r1, &(0x7f0000001380), 0x12) socket$inet_tcp(0x2, 0x1, 0x0) syz_genetlink_get_family_id$mptcp(&(0x7f0000000100), r0) r2 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) syz_init_net_socket$x25(0x9, 0x5, 0x0) r4 = socket(0xa, 0x2, 0x0) getsockopt$IP6T_SO_GET_REVISION_TARGET(r4, 0x29, 0x45, &(0x7f0000000040)={'NETMAP\x00'}, &(0x7f0000000080)=0x1e) r5 = socket$inet6_sctp(0xa, 0x5, 0x84) getsockopt$inet_sctp_SCTP_MAX_BURST(0xffffffffffffffff, 0x84, 0xd, &(0x7f0000000140)=@assoc_value={0x0}, &(0x7f0000000180)=0x8) setsockopt$inet_sctp6_SCTP_DEFAULT_PRINFO(r5, 0x84, 0x72, &(0x7f00000001c0)={r6, 0xff, 0x30}, 0xc) getsockopt$inet_sctp6_SCTP_RECONFIG_SUPPORTED(r4, 0x84, 0x75, &(0x7f0000000200)={r6, 0x2}, &(0x7f0000000240)=0x8) connect$x25(r1, &(0x7f00000000c0)={0x9, @remote={'\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc', 0x2}}, 0x12) bind$x25(r4, &(0x7f0000000000)={0x9, @remote={'\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc', 0x0}}, 0x8) sendmsg$NFT_BATCH(r3, 0x0, 0x0) ioctl$sock_inet_SIOCSIFFLAGS(r2, 0x8914, &(0x7f00000015c0)={'bond0\x00', 0x2000}) 5.166111136s ago: executing program 2 (id=6036): r0 = syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0) read(r0, &(0x7f00000000c0)=""/207, 0xcf) connect$802154_dgram(r0, &(0x7f00000001c0)={0x24, @long={0x3, 0x1, {0xaaaaaaaaaaaa0102}}}, 0x14) r1 = socket(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000800)=@gettaction={0x28, 0x5a, 0x1, 0x0, 0x0, {}, [@action_dump_flags=@TCA_ROOT_FLAGS={0xc, 0x2, {0x1}}, @action_dump_flags=@TCA_ROOT_TIME_DELTA={0x8}]}, 0x28}, 0x1, 0x0, 0x0, 0x4040840}, 0x0) sendmsg$802154_dgram(r0, &(0x7f0000000200)={&(0x7f0000000240), 0x14, &(0x7f0000000280)={0x0}, 0x1, 0x0, 0x0, 0x11}, 0x94) socket$can_bcm(0x1d, 0x2, 0x2) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, 0x0) clock_gettime(0x0, &(0x7f00000002c0)) r2 = bpf$BPF_BTF_GET_FD_BY_ID(0x13, &(0x7f0000000340)=0xffffffffffffffff, 0x4) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000380)={0x11, 0x19, &(0x7f0000000440)=@ringbuf={{0x18, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x3ff3}, {}, {}, [@printk={@x, {}, {}, {}, {}, {0x7, 0x0, 0xb, 0x3, 0x0, 0x0, 0xd}}, @btf_id={0x18, 0x3, 0x3, 0x0, 0x2}], {{}, {0x7, 0x0, 0xb, 0x2, 0x0, 0x0, 0x1}, {0x85, 0x0, 0x0, 0x84}}}, &(0x7f0000000540)='syzkaller\x00', 0x5, 0xe5, &(0x7f0000000580)=""/229, 0x41100, 0x20, '\x00', 0x0, 0x0, r2, 0x8, &(0x7f0000000680)={0x7, 0x1}, 0x8, 0x10, &(0x7f00000006c0)={0x0, 0x6, 0x4, 0x54}, 0x10, 0x0, 0x0, 0x7, 0x0, &(0x7f0000000700)=[{0x0, 0x1, 0xb, 0x6}, {0x1, 0x4, 0x0, 0x1}, {0x3, 0x4, 0xf, 0xe}, {0x2, 0x3, 0xb, 0xf}, {0x2, 0x3, 0x5, 0xc}, {0x1, 0x2, 0x8}, {0x5, 0x5, 0x1, 0x7}], 0x10, 0xffff0001}, 0x94) r3 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r3, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)=[{&(0x7f0000000300)="2e00000010008108090f9becdb7f845e3a5971ea1300000069bd6efb2502eaf60d000100020400bf050005001201", 0x2e}], 0x1}, 0x0) 4.011720322s ago: executing program 2 (id=6042): socket$key(0xf, 0x3, 0x2) r0 = socket$nl_xfrm(0x10, 0x3, 0x6) bpf$MAP_CREATE(0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="1900000004000000040000000200000000000000", @ANYRES32=0x1, @ANYBLOB='\x00'/20, @ANYRES32=0x0, @ANYRES32, @ANYBLOB="00000000000008000000000000000000000000000004000000000000"], 0x48) r1 = socket$inet_sctp(0x2, 0x1, 0x84) setsockopt$inet_int(r1, 0x0, 0x33, &(0x7f0000000080)=0x80000002, 0x4) r2 = socket$inet_sctp(0x2, 0x1, 0x84) r3 = socket$inet6(0xa, 0x3, 0x1) connect$inet6(r3, &(0x7f0000000180)={0xa, 0x4ea3, 0x5, @loopback, 0x3}, 0x1c) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) sendmmsg$unix(r5, &(0x7f0000000200)=[{{0x0, 0x0, &(0x7f0000000240)=[{&(0x7f0000000280)="a1", 0x1}], 0x1, &(0x7f00000002c0)=ANY=[@ANYBLOB="14000000000000000100000001000000", @ANYRES32=r4, @ANYBLOB="0000000014000000000000000100000001000000", @ANYRES32=r5], 0x30, 0x40400d1}}], 0x1, 0x10) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) splice(r4, 0x0, r6, 0x0, 0x400000, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000400)={&(0x7f0000000d40)=@delchain={0x1e8, 0x65, 0x400, 0x70bd2a, 0x25dfdbfc, {0x0, 0x0, 0x0, 0x0, {0x8, 0x2}, {0x0, 0x1}, {0x5}}, [@filter_kind_options=@f_bpf={{0x8}, {0x1bc, 0x2, [@TCA_BPF_ACT={0x1b8, 0x1, [@m_skbmod={0x1b4, 0x18, 0x0, 0x0, {{0xb}, {0x78, 0x2, 0x0, 0x1, [@TCA_SKBMOD_PARMS={0x24, 0x2, {{0x9, 0x1, 0x1, 0x0, 0xab6d}, 0xa}}, @TCA_SKBMOD_DMAC={0xa, 0x3, @random="addd8ec7b991"}, @TCA_SKBMOD_SMAC={0xa, 0x4, @random="c42d89d0476d"}, @TCA_SKBMOD_PARMS={0x24, 0x2, {{0x6e2, 0x6, 0x3, 0x7fa80, 0x7}, 0xc}}, @TCA_SKBMOD_ETYPE={0x6, 0x5, 0x9}, @TCA_SKBMOD_DMAC={0xa, 0x3, @remote}]}, {0x112, 0x6, "0c5720b707de8a9600a2c5c884a83101ab1330a7c10ee2be34aa729f8f7f657f8621a2165e976c3538da2fa427f5a41285ad8376e443f0473df1a6abb6bf6be48dac58dd2b082bacfab3bcd53757683c1c0d212191fa3f0ec2d327fed0b2eab4bc9a2c74b4134ca0c5a9c1d5271da9a31296bde60257f2440d5e2a30e4e80d2148172961982fa14afb0c1e46c90998b87dcb9fe848ca94cccb28a2548a07b4f6c66706c6972ec9bf1e162134eaa471dae8349e2457250eb954363e269d1ff96cfe0d1ff0455bc96168072b0c7f2371622cb8c3d34c8ebe52378d44c1eca09b9c391bd6ec7fb401bc6f6004686c78fd0a72270c4fa8a753a467c3d7be8770cd0dcd93eb96ad4096374ee450a51fbb"}, {0xc, 0x7, {0x1, 0x1}}, {0xc, 0x8, {0x3, 0x1}}}}]}]}}]}, 0x1e8}, 0x1, 0x0, 0x0, 0x2404c080}, 0x20000080) bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000440)={&(0x7f0000000480)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0x10, 0x10, 0x2, [@int={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x4}]}}, 0x0, 0x2a, 0x0, 0x1}, 0x20) socket(0x3, 0x5, 0xffffff01) r7 = socket(0x10, 0x803, 0x0) bind$bt_hci(0xffffffffffffffff, &(0x7f0000000f40)={0x1f, 0xffffffffffffffff, 0x3}, 0x6) vmsplice(0xffffffffffffffff, 0x0, 0x0, 0x5) sendto(r7, &(0x7f0000000f80)="120000001200e7ef007b00000000000000a1", 0x12, 0x4044084, 0x0, 0x0) recvmmsg(r7, &(0x7f0000000fc0)=[{{&(0x7f0000001000)=@ethernet={0x0, @random}, 0xfdf4, &(0x7f0000001080)=[{&(0x7f0000001100)=""/100, 0x365}, {&(0x7f0000001180)=""/85, 0x7c}, {&(0x7f0000001200)=""/4096, 0x197}, {&(0x7f0000002200)=""/106, 0x645}, {&(0x7f0000002280)=""/73, 0x1b}, {&(0x7f0000002300)=""/77, 0x14}, {&(0x7f0000002380)=""/154, 0x21}, {&(0x7f0000002440)=""/17, 0x1d8}], 0x21, &(0x7f0000002480)=""/191, 0xffffffffffffff2f}}], 0x4000000000003b4, 0x2040000, &(0x7f0000002540)={0x77359400}) r8 = socket$igmp6(0xa, 0x3, 0x2) setsockopt$IP6T_SO_SET_REPLACE(r8, 0x29, 0x40, &(0x7f0000000740)=@raw={'raw\x00', 0x8, 0x3, 0x4d8, 0x180, 0xffffffff, 0xffffffff, 0x0, 0xffffffff, 0x408, 0xffffffff, 0xffffffff, 0x408, 0xffffffff, 0x3, 0x0, {[{{@ipv6={@loopback, @mcast2, [], [], 'veth0_macvtap\x00', 'bridge0\x00'}, 0x0, 0x158, 0x180, 0x0, {}, [@common=@unspec=@helper={{0x48}}, @common=@inet=@iprange={{0x68}, {@ipv6=@initdev={0xfe, 0x88, '\x00', 0x1, 0x0}, @ipv4=@multicast2, @ipv6=@loopback, @ipv6=@empty}}]}, @common=@unspec=@NFQUEUE0={0x28}}, {{@ipv6={@remote, @ipv4={'\x00', '\xff\xff', @dev}, [], [], 'erspan0\x00', 'gre0\x00', {0xff}, {}, 0x0, 0x0, 0x0, 0x4b}, 0x0, 0x258, 0x288, 0x0, {}, [@common=@inet=@hashlimit1={{0x58}, {'pim6reg\x00', {0x0, 0x0, 0x5, 0x0, 0x0, 0x7, 0x3ff}}}, @common=@inet=@hashlimit3={{0x158}, {'vcan0\x00', {0x3, 0x0, 0x41, 0xfffffffe, 0x2, 0x1000, 0x6, 0x3}}}]}, @common=@unspec=@CONNMARK={0x30}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28, '\x00', 0x7}}}}, 0x538) sendmsg(r3, &(0x7f0000000c80)={0x0, 0x0, &(0x7f0000000cc0)=[{&(0x7f0000000d00)="08ab947e60eb08cc726c", 0xa}], 0x1, 0x0, 0x0, 0x2c}, 0x44004) setsockopt$inet_int(r2, 0x0, 0x33, &(0x7f00000000c0)=0x80000002, 0x4) connect$inet(r1, &(0x7f0000000140)={0x2, 0x4e24, @dev={0xac, 0x14, 0x14, 0x29}}, 0x10) listen(r2, 0x7fffffff) sendmsg$nl_xfrm(r0, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000000600)=@newsa={0x128, 0x10, 0x7, 0x0, 0x0, {{@in6=@empty, @in=@multicast2, 0x4e20, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0xee00}, {@in6=@mcast1, 0x0, 0x2b}, @in6=@private0, {0x3, 0x1, 0x2, 0x9, 0x10000000, 0x1}, {0x0, 0x2, 0x7}, {0x40000, 0xffffffff, 0xae8}, 0x0, 0x3504, 0xa, 0x2, 0xfe, 0x34}, [@coaddr={0x14, 0xe, @in6=@remote}, @lifetime_val={0x24, 0x9, {0x6b8f, 0x2, 0xb4, 0x5}}]}, 0x128}, 0x1, 0x0, 0x0, 0x1}, 0x890) r9 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r9, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000380)={&(0x7f00000004c0)=@newsa={0x104, 0x1a, 0x7, 0x70bd2a, 0x0, {{@in6=@dev={0xfe, 0x80, '\x00', 0x1b}, @in6=@empty, 0x3, 0x0, 0x4e22, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0xee00}, {@in6=@mcast1, 0x0, 0x2b}, @in6=@private0, {0x5a, 0xb400, 0x2, 0x4, 0x0, 0x60000, 0x0, 0xdea1}, {0x0, 0x200000, 0x7, 0xfffffffffffffffd}, {0x8001, 0x0, 0xae8}, 0x0, 0x0, 0xa, 0x2, 0x0, 0x70}, [@coaddr={0x14, 0xe, @in=@remote}]}, 0x104}}, 0x8000) 3.804196813s ago: executing program 0 (id=6044): syz_emit_ethernet(0x2f, &(0x7f0000000000)={@multicast, @broadcast, @void, {@ipv4={0x800, @udp={{0x5, 0x4, 0x0, 0x0, 0x21, 0x0, 0x0, 0x0, 0x2f, 0x0, @rand_addr, @empty}, {0x4e21, 0x88be, 0xd, 0x0, @opaque="6b8b836832"}}}}}, 0x0) 3.802216173s ago: executing program 1 (id=6045): r0 = socket(0x2, 0x3, 0x6) setsockopt$IPT_SO_SET_REPLACE(r0, 0x0, 0x40, &(0x7f0000000800)=@raw={'raw\x00', 0x9, 0x3, 0x1d0, 0x0, 0xffffffff, 0xffffffff, 0x98, 0xffffffff, 0x0, 0xffffffff, 0xffffffff, 0x138, 0xffffffff, 0x3, 0x0, {[{{@uncond, 0x0, 0x70, 0x98}, @common=@unspec=@STANDARD={0x28, '\x00', 0x0, 0xfffffffe}}, {{@uncond, 0x0, 0x70, 0xa0}, @common=@unspec=@CONNMARK={0x30, 'CONNMARK\x00', 0x1, {0x1, 0xffffffff, 0xffffffff}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x230) syz_emit_ethernet(0x32, &(0x7f0000000a40)={@random="e90c610faca2", @multicast, @void, {@ipv4={0x800, @udp={{0x5, 0x4, 0x0, 0x0, 0x24, 0x0, 0xe000, 0x3, 0x11, 0x0, @empty, @empty}, {0x0, 0xfffe, 0xfffffffffffffcb9, 0x0, @gue={{0x2, 0x0, 0x2, 0x1}}}}}}}, 0x0) syz_emit_ethernet(0xfdef, &(0x7f0000000a80)={@link_local, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x1f}, @void, {@ipv4={0x800, @udp={{0x5, 0x4, 0x0, 0x0, 0xfde1, 0x0, 0x2, 0x8, 0x11, 0x0, @empty, @empty}, {0x0, 0x4e20, 0x9c, 0x0, @wg=@initiation={0x1, 0x0, "2a995ffbee74ab1b3690842deee3df48f8806827d5c763698c4c288abc85bfcc", "9f6cf565ebbd4ddfc4f9c023b431968db6dbc868705956f8baf975b8cb6e17048850e8e89f732bced1e3baee50e5acb8", "112c482ee3d37cb1a7a31c450e403a6ee32477eaeb41d283c8618b26", {"6652725f56c59b04563b19a79d293550", "25b048c89cb27902d8d629c56b49c550"}}}}}}}, 0x0) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFQNL_MSG_CONFIG(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000280)={0x28, 0x2, 0x3, 0x101, 0x0, 0x0, {0x2}, [@NFQA_CFG_CMD={0x8, 0x1, {0x1, 0x0, 0x2}}, @NFQA_CFG_PARAMS={0x9, 0x2, {0x0, 0x2}}]}, 0x28}}, 0x0) r2 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$IPT_SO_SET_REPLACE(r2, 0x0, 0x40, &(0x7f0000000400)=@filter={'filter\x00', 0xe, 0x4, 0x298, 0xffffffff, 0x0, 0xd0, 0x168, 0xffffffff, 0xffffffff, 0xd0, 0x168, 0x200, 0xffffffff, 0x4, 0x0, {[{{@uncond, 0x0, 0xa8, 0xd0, 0x0, {}, [@common=@unspec=@time={{0x38}, {0x0, 0x7fffffff, 0x0, 0x1517f, 0xffffffff, 0xfe}}]}, @common=@unspec=@STANDARD={0x28, '\x00', 0x0, 0xfffffffc}}, {{@uncond, 0x0, 0x70, 0x98}, @common=@unspec=@STANDARD={0x28, '\x00', 0x0, 0xffffffff}}, {{@uncond, 0x0, 0x70, 0x98}, @common=@unspec=@STANDARD={0x28, '\x00', 0x0, 0xffffffff}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28, '\x00', 0x0, 0xffffffff}}}}, 0x1000) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$TUNSETIFF(r3, 0x400454ca, &(0x7f00000000c0)={'syzkaller0\x00', 0xca02}) r4 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCSIFVLAN_ADD_VLAN_CMD(r4, 0x8983, &(0x7f0000000100)={0x0, 'syzkaller0\x00', {0x1}, 0xb5}) r5 = socket$netlink(0x10, 0x3, 0x0) ioctl$SIOCSIFHWADDR(r5, 0x8914, &(0x7f0000000140)={'syzkaller0\x00', @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x2}}) preadv(r3, &(0x7f0000000180)=[{&(0x7f0000000b40)=""/173, 0xad}], 0x1, 0x6bbf, 0x7c) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000740)={'syzkaller1\x00', 0xc201}) r6 = socket$kcm(0x2, 0x3, 0x2) ioctl$SIOCSIFHWADDR(r6, 0x8914, &(0x7f0000000780)={'syzkaller1\x00', @broadcast}) write$tun(0xffffffffffffffff, &(0x7f00000007c0)={@val={0x8, 0x800}, @val={0x1, 0x0, 0x4, 0xfffd, 0x14}, @ipv4=@generic={{0x5, 0x4, 0x1, 0x22, 0x16, 0x65, 0x0, 0x60, 0x2, 0x0, @empty, @broadcast}, "14f3"}}, 0x24) sendmsg$NFQNL_MSG_VERDICT(r1, &(0x7f0000000340)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000002940)={0x20, 0x1, 0x3, 0x1, 0x0, 0x0, {0x2}, [@NFQA_VERDICT_HDR={0xc, 0x2, {0xffffff05, 0x1}}]}, 0x20}}, 0x0) 3.538359411s ago: executing program 0 (id=6047): socket$nl_generic(0x10, 0x3, 0x10) r0 = bpf$ITER_CREATE(0xb, 0x0, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) bpf$BPF_PROG_DETACH(0x1c, &(0x7f0000000440)=ANY=[@ANYRES32=r0, @ANYRES32, @ANYBLOB], 0x20) pread64(r0, 0x0, 0x0, 0x5) r1 = syz_init_net_socket$x25(0x9, 0x5, 0x0) bind$x25(r1, &(0x7f0000001380), 0x12) socket$inet_tcp(0x2, 0x1, 0x0) syz_genetlink_get_family_id$mptcp(&(0x7f0000000100), r0) r2 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) syz_init_net_socket$x25(0x9, 0x5, 0x0) getsockopt$IP6T_SO_GET_REVISION_TARGET(0xffffffffffffffff, 0x29, 0x45, &(0x7f0000000040)={'NETMAP\x00'}, &(0x7f0000000080)=0x1e) r4 = socket$inet6_sctp(0xa, 0x5, 0x84) r5 = socket$inet_sctp(0x2, 0x1, 0x84) getsockopt$inet_sctp_SCTP_MAX_BURST(r5, 0x84, 0xd, &(0x7f0000000140)=@assoc_value={0x0}, &(0x7f0000000180)=0x8) setsockopt$inet_sctp6_SCTP_DEFAULT_PRINFO(r4, 0x84, 0x72, &(0x7f00000001c0)={r6, 0xff, 0x30}, 0xc) getsockopt$inet_sctp6_SCTP_RECONFIG_SUPPORTED(0xffffffffffffffff, 0x84, 0x75, &(0x7f0000000200)={r6, 0x2}, &(0x7f0000000240)=0x8) connect$x25(r1, &(0x7f00000000c0)={0x9, @remote={'\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc', 0x2}}, 0x12) bind$x25(0xffffffffffffffff, &(0x7f0000000000)={0x9, @remote={'\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc', 0x0}}, 0x8) sendmsg$NFT_BATCH(r3, 0x0, 0x0) ioctl$sock_inet_SIOCSIFFLAGS(r2, 0x8914, &(0x7f00000015c0)={'bond0\x00', 0x2000}) 3.216198568s ago: executing program 0 (id=6049): socket(0x10, 0x3, 0x0) socket$packet(0x11, 0x3, 0x300) r0 = bpf$PROG_LOAD_XDP(0x5, &(0x7f0000001640)={0x6, 0x4, &(0x7f0000001700)=ANY=[@ANYBLOB="18020000000000020000000000000000850000001700000095"], &(0x7f0000001740)='GPL\x00'}, 0x94) r1 = socket(0x10, 0x803, 0x8) sendmsg$IPVS_CMD_SET_INFO(r1, &(0x7f0000001780)={0x0, 0x0, &(0x7f00000017c0)={0x0, 0x2d}, 0x1, 0x0, 0x0, 0x8801}, 0x8000) r2 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) setsockopt$sock_int(r2, 0x1, 0x22, &(0x7f0000001240)=0xccb, 0x4) bind$bt_hci(r2, &(0x7f0000001300)={0x1f, 0xffffffffffffffff, 0x2}, 0x6) r3 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$HCIINQUIRY(r3, 0x400448ca, 0x0) socketpair(0x1, 0x1, 0x0, &(0x7f0000001340)={0xffffffffffffffff}) bpf$MAP_CREATE(0x0, 0x0, 0x0) bpf$MAP_DELETE_ELEM(0x3, 0x0, 0x0) bind$bt_hci(r3, &(0x7f0000001540)={0x1f, 0x0, 0x1}, 0x6) getpeername$netlink(r4, 0x0, &(0x7f00000015c0)) write$bt_hci(r3, &(0x7f00000019c0)=ANY=[], 0x6) r5 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route(r5, &(0x7f0000001880)={0x0, 0x0, &(0x7f00000018c0)={&(0x7f0000001900)=ANY=[@ANYBLOB="3c0000001000850600000000ff6122314a000800", @ANYRES32, @ANYBLOB="00001000252155b21c0012000c000100626f6e64"], 0x3c}}, 0x40000) bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f0000001940)={r0, 0x0, 0x25, 0x0, @val=@netkit={@void, @value=r0}}, 0x1c) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000011c0)={0x0, 0x0, &(0x7f0000001200)={&(0x7f0000001980)=@deltclass={0x40, 0x29, 0x400, 0x70bd2c, 0x25dfdbff, {0x0, 0x0, 0x0, 0x0, {0x3, 0xd}, {0x10}, {0x9, 0xffe0}}, [@tclass_kind_options=@c_taprio={0xb}, @TCA_RATE={0x6, 0x5, {0x9, 0x5}}, @TCA_RATE={0x6, 0x5, {0x4}}]}, 0x40}}, 0x4004804) r6 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route(r6, &(0x7f0000001280)={0x0, 0x0, &(0x7f00000012c0)={&(0x7f0000001380)=ANY=[@ANYBLOB="4c0000001000010400"/20, @ANYRES32=0x0, @ANYBLOB="8000000000005baec0f2923053b6e2cd62810000180012800b00010067726574617000000800028004001200140003006e696376663000"/64], 0x4c}, 0x1, 0x0, 0x0, 0xc845}, 0x0) sendmmsg(r6, &(0x7f0000001380), 0x40000000000009f, 0x0) syz_emit_ethernet(0x2a, &(0x7f0000001400)=ANY=[@ANYBLOB="2f4bcadb21dcb3bbbbbbe2f8e1137d48bbbb08004510001c006600000e029078e00000020a010178ac1414bb00000000"], 0x0) r7 = socket$packet(0x11, 0x3, 0x300) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r7, 0x8933, &(0x7f00000000c0)={'batadv0\x00', 0x0}) sendto$packet(r7, &(0x7f0000001140)="114353012008ba", 0x7, 0x4008005, &(0x7f0000001180)={0x11, 0xd, r8, 0x1, 0x7, 0x6, @local}, 0x14) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xc, 0x8031, 0xffffffffffffffff, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) 2.642413355s ago: executing program 1 (id=6051): r0 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="1b0000000000000000000000000004"], 0x48) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000140)={0x6, 0x10, &(0x7f0000000200)=ANY=[@ANYBLOB="1800000021bf0000000000000500000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b702000014000000b7030000000000008500000083000000bf0900000000000055090100000000009500000000000000db090000a1000000bf91000000000000b7020000000000008500000084000000b70000000000000095"], &(0x7f0000000280)='syzkaller\x00', 0x4, 0x0, 0x0, 0x0, 0x6}, 0x94) setsockopt$IP_VS_SO_SET_STOPDAEMON(0xffffffffffffffff, 0x0, 0x48c, 0x0, 0x0) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r2, &(0x7f0000000040)={0x1f, 0xffffffffffffffff, 0x4}, 0x6) pipe(&(0x7f00000002c0)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = socket$nl_generic(0x10, 0x3, 0x10) r5 = socket$nl_generic(0x10, 0x3, 0x10) r6 = accept(r5, &(0x7f0000005180)=@l2, &(0x7f0000005200)=0x80) write$bt_hci(r6, &(0x7f0000005240)={0x1, @read_link_policy={{0x80c, 0x2}, {0xc9}}}, 0x6) r7 = syz_genetlink_get_family_id$nl80211(&(0x7f0000003e40), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r5, 0x8933, &(0x7f0000003e80)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_FRAME(r5, &(0x7f0000003ec0)={0x0, 0x0, &(0x7f0000003f00)={&(0x7f0000003f40)=ANY=[@ANYBLOB='h\x00\x00\x00', @ANYRES16=r7, @ANYBLOB="01002abd7000fcdbdf259900000008000300", @ANYRES32=r8, @ANYBLOB="0400cd003e00330020180600080211000000080211000001ffffffffff166500000208000802110000000006010101010101dd062ae05c1ac346dd062321472a614f0000080057"], 0x68}, 0x1, 0x0, 0x0, 0x4018010}, 0x804) sendmsg$NL80211_CMD_REGISTER_FRAME(r3, &(0x7f0000005140)={&(0x7f0000000580)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f0000005100)={&(0x7f0000003fc0)={0x110c, 0x0, 0x400, 0x70bd25, 0x25dfdbfb, {{}, {@val={0x8, 0x3, r8}, @val={0xc, 0x99, {0x35, 0x80}}}}, [@NL80211_ATTR_FRAME_TYPE={0x6, 0x65, 0x8}, @NL80211_ATTR_FRAME_MATCH={0x34, 0x5b, "47fa139e68b960812ffcfc145491525b0be7da2040a28fab64cdf8a32def276f4cbbdd36da692d0a8322d57ee3cfbd9c"}, @NL80211_ATTR_FRAME_TYPE={0x6, 0x65, 0x2}, @NL80211_ATTR_FRAME_TYPE={0x6, 0x65, 0xff}, @NL80211_ATTR_FRAME_MATCH={0x1004, 0x5b, "9d8a4080de5dc8a244835b42d344ab127dc425840fca4e73c2fceb53b8ee6e759a8e2cef134f9395c78daf9ab60d10ced3fbd94cd4ef19e24b2f5e528127ef1241cff72806338b40ae80b337acba74d20900475b413fa8e418a1e37a74b81b039bd0a3b5e87a4b65ee219d44655ca804e299dc3c0a1811a065cdbbe61ef7c482c29fb19c605d984fb6c5f451f20511cc679b211f765bbf21c36943c004f59c2dd6abddfb533d70a02d13b9cb678cafb9cc696eec8c855617b3c3073af2679cc24fe7f55b405735c3389926187a936dedaf0e153619e1f6964e8dcc075be121b1abb64157ee7a569737dfbd0633042a0fbbaf37d96645c307c2226ae789319646d72fb10f9d4140abfd49c9dc580690b2766220bc3dbf656b3e1b784ef7d881c9237605f4fc4412421b3bcb340f302be390e8b5a9ba1c129b65e72ebca96c831d8c8e89f746abd8dd7f1cdd3c5941e3a1b37c044d73c308b1a39c25de8c0a44cab3c994c5f202d2c4b03771860383871b5fb3345fb6cb9e93cc3d6bc3275db6ab9ce27e21601aadeaad1b97e7a71509e3a7a2cc98ce594ae2838bfd5da8107ce99dcbf95b38aa47edc5156adf60cb77e62e973839b6f09a1762e54be07c19531d45d33da91ae0cee2597293f2ffd8caafb40869896c2385b6ff70cda0094c0fb6eb5ec6adfe7d6ce83613aefe6b70a7cf710b32208610b0c5a91017efd9014b3792678b9457e58b817b79bc95d6249b313b1e39e5dd7d7287a510e73296b887bfae7376744e8f1b7152183cb8f08784e5961c1932e324b35ffdf872a69d3c3bae056666997877b872b03f47b8810efc6f19c978a3a1cd0260da2da889020608802cf4fce2aa3c664d35fedef822371cc18ed94ea38f407594c19c8a297571f921aa8ca347af4a6065217bd722d1372c8aa6752f52117afcf91a0c6e180e97284ab39fcad2cc599af86236c3aa181de386eae4263b9be18f5f8fa990df987ccf13b7d24d21b3025589380029b13d251d36b6211047c12b8134b01559b1e9c35b8c4e65a5c9e604723c7cf4c1c0a61a1976520d7e3c09bd9f2f5279d4b2f4089d7d7b4f06865ef7b0ddd862dc7e7b88ba18a001541819aefc3f4583b3aefd72e7ea19307a793c1341aa20cb2961c604a636cec3a99055442669fe1e20979a12382f9cd87308ad39bbeb3ebbfea5aac74bf65e3d40ccde3c7f7b951b27d1ea1855d49fcad916e4e178ffaaa40a008f92b97fe34cb03aa210a7a568ad4cd6d1a300403893cd4ae8a28390cf8dd09959a05589095f355e64c2e6c64d4f38818e5454b8182f6c75fee9577c15f748c859f138dcc7b7ec3e96d40b3d9488154fb45de7964f7eaa183d6da64096003093621f972fc7ec3203ec519522c6a4c4500ef4d0b919354371626f162f5047fc00c7f2a7032f1afe732331e7f6c779516ad02204b6414b69b7e750ab6444bc58357e6befcc14b488bd76f90e13c324435998cfa600ecdeab6ef9e89156b1d875b387c8219bf382b9e69dc2ca401aee6c32aed5bb91959471a70ec12d5c7dac1c8c0741e2aa3acff9fa185eff65fb56aad8a6f6fede5eead298b26abdfaf451b0fdf5854990f2d8b0b79456681d1091d6a1b8175267f25ac1fecabe81f9bea4663d5e5589975c52c6b16e9c02818842336ed6954f5af070f8aed61c3497059407b98f8ac46e8291d20e43004a32a9be804ace627264d0c39a977afc21403b73813786d11e766f9d223a59b30268dd2029a5045b4041bb6a34e24e4db7b69e9ec695883b7e762e488855eb5f68303cbe5f0a97ef3d5aa3f9eccacdbd2a492c8a236a87b4a8ee9b6786049876b03a0ed59bf1b24d7fa79f61d53bbfcc824713ecd5807eb5055d22fc256d9a7b1d416b0a8a5e76e3546f00984ca0eb10fe4634dcae124cc84b0d9f14d07b64adf17fd5525f1094a5bf5df9415657f1c93cd8c8d8d42660610f9fe0b202ec46aea9027da800ae70dc7063c16c52eccbd50189e939f39ca55f4e202b9bea1743f1277f17de3b01509685266fcf5b74ea2a87413c87e7dd36228bae98313cd7ea5598c9b22c66f1d1e45e63395ca8b7efbb00f4d6b4be10dd88e155b180fe3da721a28aee884a53db871157093de80adcdc44d2f5adba834659e549a1f1c898a434130405d61f54eaddf497a69bbe863f43db7e278487b9fcd0cb04128f37829fd8fbbed241dad8c76f4af86d4580c4723fb6473a3e68fe10497c4693d265c28d54ef49ebd73de4754e6f1e92666d88dcb1ab6d88670b51501ee6848aff0c6fd1d206c6bf86467f35517f8c5908cbb7cc0f12363c2e87dd7c8372d41281fecc5000dcfffc0b316cf50762fb7d8b21fbd5d8045bdbf35b8776917763e57a53efaf95151c78556ca27260f1e3b49d42f8d9704ea42c346a43433241c0f668c973d2ea908397e65f8ed43501e9986bc9ef42a8508c1b632a5b771b75503ce9143c0e58d91186ad5577272fefd3af727fc8fb291a602f55c6a8a8651e6da9d0ee57a6de5dcd14291c911995b4d6b99a9f9fb5d9cc19990d90afdfaf4b762979aa01878975853ca8cf561b6f359bc8ad27b17fc1183732537961a9e6e5ba968f7fda7775a7936864e46d59508b38b1c7b4b410450a8de7b26dc51ff3c59e671abb59e745e2e72ce872a3408e78897d76c9d92dfb1c3351e3f0ce33de401af4e00d642e7c49210bd720392bfb2b1136e8bdbd99d347f0ecd28cb022fb6484f8a3f8bb77f2196f666551d26bcb0178fc321b3effaddc4af92668b86abd6e90f78518a7a6caf024f68c45fee9038f3b014cc0bb3d0fc2585b6b0dc0f0e3d4e29c9a57109debabce341b119a38e77f36bd8ed6e01110e2c24b7949fbd675501b6f9a89c2b923a9323e6b56163f2e8c8e3d0545d9812d1f9954fc0752b4a4444d07f67289f44da27e45fffe61943e1284d3d1319abd887e4c39fbb9acdefdc4e71cc6ebcfd2214b07bf7ca655e8ba3eeef77e995cb6bc479d4122e82ac73f9a2d29795f59e923491063060758a2138b6b3a25a1fb9dc3c40a6cb3a26e740c928b19b5f969b228baee742bbcb83d7dd6ad6075a480a3e4c3845f73d53083a842bee49baa4b12881c33c829b602fe9219f6eb652cd56d225fa2d771b7a2f0514f8b7709a1ed1105739bd040a59e0ae94ac899c33de5b7b8002c537e6ac2825bd7a1bd001911bc190ebe648dd803c752de526dbd962ce8a24686c190a3882baf4b65b1107e8575272c5a18b71bbb5cc75905b8b293623308c8d667a9ae9a4880ee82f7077818c311b0b680b48bdb87b68edcb8d1e5b43144d9bde26f5b767d098f4f6ee80e3ff2969904f98f72e0dccdd174599c8fe6f8ed827b5c86244fbb0728e8bfe6d5403b14895cc65db401c07b1554c8c8191532b53ce31df3b6e707ee8ab4e5e4272884134800b23b09bedea9a85b384166792acb60ed42ee8d659f22386d3ce04f1cf54a782ce944e02f810fe0f3869850bb901d1604e636efd6f5c3308011a7bf131a4f098b8b4915f83069dbcc0241e3cfe82d38c57fc10ed87c4a043fa8a7276b6100da0b0373b895bead6d0e897bbdb3e40309fb91f03dfbfe2bd7d6f666790d1e0212acec12630e532d274797cd4f7d335171268181708679ca58518ad159392c232cbe62ada8989ed8bcefcfb7c3b527856a0c228e757cbe5c982b770fe283a0dc130ed9f409935dfc404cde44c8204fd559e57d438a49562ce9400ee35e490aa220c0e6b39c637d479666ed04bf576d5aaede58cdb069a604c91d4a3b520d62d53482e21c554a251a735e85167ee4b1025f82fc6be8e7bba390c5222310399b76d22069e8447620dd1130ebd53c06d93de7ba4ed16ea76e1b3d0a6de6f239deda2d7a0bee8e92ea812f6aa6b3a25cd6de59753e2db88904c3f4f581fbaa95f8a31cadf03b794b5653f764b44d28ca5025853a7fd9a33b3e006c51a934c6cf3c0137d22547f23c8d1722c23c223be6307ea5e91ea3b55360a2b99f5139ba6083a7ed4266261f7a6fc493f214c7b610f22d4f7f3dcc702af3757a79f0e9c87fcf3644ce9afb913dce9daf05e80e3cca25e663d49f7c7c3543a861f25d5cc93e477c2f729c99ffe710af31a1f2a2459251d2788869944de5e46cca8d6d651c83691e112f93e4a8371f34e082ee30f083523c9316f23d92d354b46ae1479456717b4b0659116e4cc4b58c17ea61b10a09271df12fa68e37ff7d48c5d116c015771b6299ae1703d22e23846f06d286fb25ee1bbd4b6ec1d596807535154fcddc276f1fdf0cb148eb9633ac1f2d36e875d56158905e9c7da1196e8ec03444046a1e15c8516e7e6009244b1ef3f2eafaef57ec52051e08141ee800bd983469fb365635390a3033339be5bd3b6fbbe03408a38ebc6c6d0374ff9cc574033b993b331811cc3953f2f5622ed8608303f4ad9cad83d931d5bfd7f68f68a573a56c621c5acd38934fe7028bd0626af0f8bfacdafc90b9a2b0f30d1f78b16901bc734cdb72b57d90db35122cebbda15b9945301b4408d32b34bd08606793b75f5892d0b39060654a6c0bfbd0f0cf940048250fb4a646d430849c9cb7a2f09ecd26cdc0fa14ab47ddd7e242f2b54614aeb2d5d61883d2c940f27bc76c7933eda1ba4124935dfa229ea067c30cfab0f3d4bb2bcdb18d29cfa1db77992fa73ac47141514622104b3478fa47e0f3c1f67fbfac09810a435bfd83a040ec087740892961d9dc33ce311acc110c96a6096a2f283fe70b580d348eaf485decbda0a9b231f1b78bc90046ab695da97dc055efbdd8b889c106833e9706b82c9631a02f45b22d38bb7dd8aebaab561db21483a78b68b0c8a7484cd97221b1f39d56eb731b0a4132790c5da37efc09d712888f3c455b15842a5dce9f04fdcea7a53d2061371a4c830dafeb7a4da1c52f4f452f0443bd4866ce9bd977c33aeae98731139931865da4ef4efc237646cd1e9b83c852213fc0c913524ce624cf476c3027d62111a11c18f25981a2e3f8d3d724ff8bad136f8fea32a8e6998e3990defa9760ae1bd41b4f823e2cd83028b34ac45de43352afd3f25b50492d3d631e887fe0710abb50d56d1ff825a5f5ab9aa4131b2cfcaf8ffbe7d40121eaef653ad2e12c277e9f44770cc332c82c149a60914983f04cc8e067da2c602b59d70906da4b962fe4b0f11dbcf3e01b4c9006841935ba7dbf23379c2728126a2ab4d9b36b3c9b144040c0d1abfefd7e85e3a255e58f831427e2d7eb753a1c9a1910ecff7ed6af4d034081f551b7426f9ad957efc409d41581e53b0ff91fba32c5ab22609d25deaed477e829aa822868110a1322ec7458947e892a46097febdeb5c62739da3d14353153deb30ca48507ca77ff055a991ce5787dabe64d34366254cd18b6dc378b93430d6c01609ec2084ce4fa448cafea67f5ae63fa2b0328850108b5c45002674d8201797c93ed70fb910b1445617a342785b96e26ac85a3caefe6e82762108c4e199d6ad1207b32fc448890cdfededbdd1a525b7045be515c97cef012f9c0f0bdb5be0931aefc3cac5fd2d251e7ce0d8cafa35cfb9ec7373b18cf31467121adfa06e88411795bf74484f7c5e64a11450544697fa8dd040b320d342b0041a3302cc658d48e763f3b6345836d957d3e2c9e0adcf80ab7573a8106a1918485f5aa035b331373ca77f869ed70024012b1a9863a3d28b1d1f3ce02da33bc07bf4360cbb089cb5cbf16dc8f5db1cfff4c62cd517a8d6962dd6972250cc745a6ab97ba7d1c92c92ef4fc20b0aff693480521668fd60056d2"}, @NL80211_ATTR_FRAME_MATCH={0x8a, 0x5b, "cee4ccbdc383987b0c08e979ff4bfc48d6d35fd3cbba6fc2c1428fe539561f615381758951563827d68618050645aee8babf4b629c3962892c5403c861cb8a7e196ec7953f8af8ef6eaaf284eb298dbf813ad757a5240f6491fc8cfe4669e9c2f15ad0c74017480079c91a97eddc31c46ad5598d4da9aa95e46be57a7ce134ea3198c77739c3"}, @NL80211_ATTR_FRAME_TYPE={0x6, 0x65, 0x1}]}, 0x110c}, 0x1, 0x0, 0x0, 0x808c}, 0x20000000) r9 = syz_genetlink_get_family_id$batadv(&(0x7f0000000340), r4) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r4, 0x8933, &(0x7f0000000380)={'batadv0\x00', 0x0}) sendmsg$BATADV_CMD_GET_DAT_CACHE(r4, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000400)={&(0x7f0000000440)={0x1c, r9, 0x83625fc5352ba305, 0x70bd29, 0x25dfdbfe, {}, [@BATADV_ATTR_MESH_IFINDEX={0x8, 0x3, r10}]}, 0x1c}}, 0x20008000) bind$inet6(r3, &(0x7f0000000300)={0xa, 0x4e22, 0x9, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, 0x400}, 0x1c) write$bt_hci(r2, &(0x7f0000000080)=ANY=[@ANYBLOB="2f0100003201"], 0x138) r11 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r11, &(0x7f0000000480)={0x0, 0x0, &(0x7f00000004c0)={&(0x7f0000000500)=@newtaction={0x64, 0x30, 0xeaa3ef926154ef0f, 0x0, 0x0, {}, [{0x50, 0x1, [@m_vlan={0x4c, 0x1, 0x0, 0x0, {{0x9}, {0x20, 0x2, 0x0, 0x1, [@TCA_VLAN_PARMS={0x1c, 0x2, {{0x8001, 0x2, 0x8, 0x7, 0x10001}, 0x1}}]}, {0x4}, {0xc}, {0xc}}}]}]}, 0x64}}, 0x0) sendmsg$nl_generic(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000100)={&(0x7f00000005c0)=ANY=[@ANYBLOB="18000000260001031dbd7002fadbdf25010000200400ae"], 0x18}, 0x1, 0x0, 0x0, 0x850}, 0x0) recvmsg(r1, &(0x7f0000000600)={0x0, 0x0, &(0x7f0000000640)=[{&(0x7f0000000700)=""/259, 0x103}, {&(0x7f0000000840)=""/4123, 0x101b}, {&(0x7f0000001880)=""/98, 0x62}, {&(0x7f0000001900)=""/4091, 0xffb}, {&(0x7f0000002900)=""/183, 0xb7}, {&(0x7f00000029c0)=""/119, 0x77}, {&(0x7f0000002a40)=""/109, 0x6d}, {&(0x7f0000002ac0)=""/4086, 0xff6}, {&(0x7f0000003ac0)=""/246, 0xf6}, {&(0x7f0000003bc0)=""/142, 0x8e}, {&(0x7f0000003c80)=""/243, 0xf3}, {&(0x7f0000003d80)=""/158, 0x9e}], 0xc}, 0x10082) 2.640600571s ago: executing program 4 (id=6052): r0 = accept4$bt_l2cap(0xffffffffffffffff, &(0x7f0000000080)={0x1f, 0x0, @none}, &(0x7f00000000c0)=0xe, 0x800) setsockopt$bt_BT_CHANNEL_POLICY(r0, 0x112, 0xa, &(0x7f0000000100)=0xbfb8, 0x4) r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r1, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000001140)={&(0x7f0000000000)=ANY=[@ANYBLOB="38000000100003058f4509085abac5dcc546fed58fe3cc000003000000000000000000", @ANYRES32=0x0, @ANYBLOB="00000000000000001800128010000100767469000c0002800800020000000000"], 0x38}, 0x1, 0x7500}, 0x0) 2.572241488s ago: executing program 2 (id=6053): bpf$PROG_LOAD(0x5, &(0x7f0000000300)={0xa, 0xe, &(0x7f00000003c0)=ANY=[@ANYBLOB="bf16000000000000b70100003b0204007b1ae0ff00000000b7010000000000007b1ae8ff000000007b1af0ffb8ff0000bf61000000000000b702000001000000bfa300000000000007030000e0ffffffb7040000180000008500000049000000b70000000000000095"], &(0x7f0000000440)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) 2.324128735s ago: executing program 4 (id=6054): bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000040)={0x1a, 0x4, &(0x7f0000000180)=@framed={{0x18, 0x2, 0x0, 0x0, 0xb2b3, 0x0, 0x0, 0x0, 0x18}, [@kfunc={0x85, 0x0, 0x2, 0x0, 0x351ec}]}, &(0x7f00000001c0)='GPL\x00', 0x8, 0x0, 0x0, 0x40f00, 0x40, '\x00', 0x0, 0x3d}, 0x94) r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000240)=ANY=[@ANYBLOB="380000006c0015000000d9fece23b82000000000", @ANYRES32=r0, @ANYBLOB="000080000000000018003480050035"], 0x38}, 0x1, 0x300}, 0x0) sendmsg$nl_route(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000240)=ANY=[@ANYBLOB='8\x00\x00\x00l'], 0x38}, 0x1, 0x300}, 0x0) 2.241881202s ago: executing program 2 (id=6055): mmap(&(0x7f0000001000/0xc00000)=nil, 0xc00000, 0x3000004, 0x3032, 0xffffffffffffffff, 0x0) r0 = socket$inet_udp(0x2, 0x2, 0x0) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_TX_RING(r2, 0x11b, 0x3, &(0x7f0000000000)=0x40, 0x4) r3 = socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_UMEM_REG(r3, 0x11b, 0x4, &(0x7f0000000040)={&(0x7f0000000100)=""/62, 0x328000, 0x800, 0x9, 0x3}, 0x20) setsockopt$XDP_UMEM_COMPLETION_RING(r3, 0x11b, 0x6, &(0x7f0000000140)=0x1, 0x4) setsockopt$XDP_RX_RING(r3, 0x11b, 0x2, &(0x7f0000000180)=0x100, 0x4) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r1, 0x8933, &(0x7f00000001c0)={'batadv_slave_1\x00', 0x0}) setsockopt$XDP_UMEM_FILL_RING(r3, 0x11b, 0x5, &(0x7f0000000200)=0x2, 0x4) bind$xdp(r3, &(0x7f0000000240)={0x2c, 0x0, r4}, 0x10) bind$xdp(r2, &(0x7f0000000280)={0x2c, 0x1, r4, 0x0, r3}, 0x10) socket$nl_route(0x10, 0x3, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000080)=@broute={'broute\x00', 0x20, 0x5, 0x2e0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x200000000e80], 0x0, 0x0, &(0x7f0000000e80)=[{0x0, '\x00', 0x0, 0xffffffffffffffff, 0x1, [{0x3, 0x7, 0x8914, 'vlan0\x00', 'veth0_to_team\x00', 'ip6gre0\x00', 'dvmrp0\x00', @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0xf}, [0xff, 0x0, 0xff], @link_local, [0x0, 0xff, 0x0, 0xff, 0xff], 0x6e, 0x70, 0x70, 0xa8, [], [], @common=@dnat={'dnat\x00', 0x10, {{@broadcast}}}}]}, {0x0, '\x00', 0x1, 0xfffffffffffffffe, 0x2, [{0x9, 0x0, 0x6004, 'pimreg0\x00', 'veth1_virt_wifi\x00', '\x00', 'team0\x00', @random="46aafcc3cd06", [0x0, 0x0, 0xff, 0xff, 0xff], @empty, [0xff, 0xff, 0xff, 0xff], 0x0, 0x70, 0x70, 0xc0, [], [], @common=@log={'log\x00', 0x28, {{0xc4, "0eda5d467cde600e4b09dcbb068dfecb4c27ea8d6481ec1680a6cb53e5c4", 0xb}}}}, {0x5, 0x8, 0x4305, 'veth0_to_batadv\x00', 'bridge_slave_1\x00', 'wlan1\x00', 'pimreg\x00', @multicast, [0x0, 0x0, 0xff, 0xff, 0xff], @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x3}, [0x0, 0x0, 0x0, 0x0, 0x0, 0xff], 0x0, 0x70, 0x70, 0xe8, [], [], @common=@nflog={'nflog\x00', 0x50, {{0x1, 0xcdb7, 0x7, 0x0, 0x0, "36699c45c98ea2561510bc5af0e8ab823a9815a16c24929eba27cc5ed8e8e1a5723cbd8352b08035b68c3bd52a5300b175ba19c69d9c5a5ed4b527f2f8717c9d"}}}}]}, {0x0, '\x00', 0x3, 0xfffffffffffffffe}]}, 0x358) 2.07968644s ago: executing program 1 (id=6056): r0 = socket$kcm(0x10, 0x400000002, 0x0) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) pipe(&(0x7f0000000500)={0xffffffffffffffff, 0xffffffffffffffff}) vmsplice(r3, &(0x7f0000000540)=[{&(0x7f0000000580)="77690addcfbe1fbb66ec", 0xff3b}], 0x1, 0x1) close(r3) socket$nl_route(0x10, 0x3, 0x0) r4 = socket$nl_generic(0x10, 0x3, 0x10) getsockopt$SO_COOKIE(r4, 0x1, 0x2a, 0x0, &(0x7f0000000880)) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f00000005c0)={'bond_slave_0\x00', 0x0}) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000600)={0x0, 0x0, &(0x7f0000000640)={&(0x7f0000000680)=ANY=[@ANYBLOB="4400000010000100"/20, @ANYRES32=r5, @ANYBLOB="000024000000000024001200140001006272696467655f736c617665800000000c0005"], 0x3}, 0x1, 0x0, 0x0, 0x4004000}, 0x0) splice(r2, 0x0, r3, 0x0, 0x10500, 0x79c1210480bbdc0a) ioctl$sock_bt_hci(r1, 0x400448de, &(0x7f00000002c0)) r6 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r6, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000200)=ANY=[@ANYBLOB="f4000000290001000000000000000000fc020000000000000000000000000001fe8000000000000000000000000000200000000000020000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="be6b6e000000000050001100ac1414aa000000000000000000000000ffffffff0000000000000000fc020000000000000000000000000001ff0200000000000000000000000000013c040000080000000a000a00280020"], 0xf4}, 0x1, 0x0, 0x0, 0x24000000}, 0x0) sendmsg$inet(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000000c0)=[{&(0x7f0000000140)="170000007a006bcd9e3fe3dc6e08170007000054250000", 0x17}], 0x1, 0x0, 0x0, 0x1f00c00e}, 0x0) ioctl$sock_kcm_SIOCKCMCLONE(r0, 0x89e2, &(0x7f00000002c0)={r6}) bpf$PROG_LOAD(0x5, &(0x7f0000000740)={0xc, 0x4, &(0x7f0000000800)=@framed={{}, [@ldst={0x1, 0x2, 0x3, 0x0, 0x1, 0xab}]}, &(0x7f0000000840)='syzkaller\x00', 0x8, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) r8 = syz_open_procfs$namespace(0xffffffffffffffff, &(0x7f00000006c0)='ns/time\x00') ioctl$FIBMAP(r8, 0x1, &(0x7f0000000700)=0x7) r9 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000340), 0xffffffffffffffff) getsockopt$inet_pktinfo(0xffffffffffffffff, 0x0, 0x8, &(0x7f0000000380)={0x0, @rand_addr, @multicast1}, &(0x7f00000003c0)=0xc) sendmsg$ETHTOOL_MSG_LINKINFO_SET(r7, &(0x7f00000004c0)={&(0x7f0000000300)={0x10, 0x0, 0x0, 0x400}, 0xc, &(0x7f0000000480)={&(0x7f0000000400)=ANY=[@ANYBLOB='l\x00\x00\x00', @ANYRES16=r9, @ANYBLOB="000225bd7000ffdbdf250300000005000200020000000500030000000000050003000100f5ff0400020005000000050005060300800005000500400000e30028000180080001", @ANYRES32=r10, @ANYBLOB="140002006261746164763000000000000000000008000100", @ANYRES32=0x0, @ANYBLOB], 0x6c}, 0x1, 0x0, 0x0, 0x2}, 0x4000080) syz_emit_ethernet(0x6a, &(0x7f0000000000)=ANY=[@ANYBLOB="0580c20000000180c200000008004510005c00000000002f90780000000000000000248065580000000010"], 0x0) r11 = socket$inet6(0x10, 0x3, 0xfffffff8) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000000)=ANY=[@ANYBLOB="2c000000190001000000000000000000021800000000fd000000ed0008000100ac1414000800080004"], 0x2c}}, 0x0) sendto$inet6(r11, &(0x7f0000000000)='s', 0x10a73, 0x800, 0x0, 0x4b6ae4f95a5de35b) 1.86381775s ago: executing program 4 (id=6057): r0 = socket$nl_route(0x10, 0x3, 0x0) getsockopt$sock_buf(r0, 0x1, 0xb, &(0x7f00000000c0)=""/193, &(0x7f0000000200)=0xc1) socket$nl_generic(0x10, 0x3, 0x10) syz_init_net_socket$x25(0x9, 0x5, 0x0) socket$inet6_udp(0xa, 0x2, 0x0) r1 = socket$inet6_mptcp(0xa, 0x1, 0x106) bind$inet6(r1, &(0x7f0000000700)={0xa, 0x4e22, 0xfffffffc, @empty, 0x7}, 0x1c) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000740), 0xffffffffffffffff) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r2, &(0x7f0000000780)={0x0, 0x0, &(0x7f00000007c0)={&(0x7f0000000800)=ANY=[@ANYBLOB='8\x00\x00\x00', @ANYRES16=r3, @ANYBLOB="0100000000000000000001000000000180060005004e230000060001000200000008000300ac1414aa0800060001000000"], 0x38}}, 0x0) listen(r1, 0xc) r4 = socket$inet_mptcp(0x2, 0x1, 0x106) connect$inet(r4, &(0x7f0000000840)={0x2, 0x4e22, @local}, 0x10) sendmsg$MPTCP_PM_CMD_ADD_ADDR(0xffffffffffffffff, 0x0, 0x4000090) r5 = socket$nl_generic(0x10, 0x3, 0x10) r6 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000980), 0xffffffffffffffff) getpeername$packet(0xffffffffffffffff, &(0x7f00000001c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @link_local}, &(0x7f0000000240)=0x14) sendmsg$MPTCP_PM_CMD_FLUSH_ADDRS(r5, &(0x7f00000009c0)={0x0, 0x0, &(0x7f0000000a00)={&(0x7f0000000000)={0x38, r6, 0x1, 0x70bd26, 0x25dfdbff, {}, [@MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x5}, @MPTCP_PM_ATTR_ADDR_REMOTE={0x14, 0x6, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_IF_IDX={0x8, 0x7, r7}, @MPTCP_PM_ADDR_ATTR_FAMILY={0x6, 0x1, 0xa}]}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x3}]}, 0x38}, 0x1, 0x0, 0x0, 0x20048001}, 0x800) 1.505629422s ago: executing program 1 (id=6058): socket$nl_generic(0x10, 0x3, 0x10) r0 = bpf$ITER_CREATE(0xb, 0x0, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) bpf$BPF_PROG_DETACH(0x1c, &(0x7f0000000440)=ANY=[@ANYRES32=r0, @ANYRES32, @ANYBLOB], 0x20) pread64(r0, 0x0, 0x0, 0x5) r1 = syz_init_net_socket$x25(0x9, 0x5, 0x0) bind$x25(r1, &(0x7f0000001380), 0x12) socket$inet_tcp(0x2, 0x1, 0x0) syz_genetlink_get_family_id$mptcp(&(0x7f0000000100), r0) r2 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) r4 = socket(0xa, 0x2, 0x0) getsockopt$IP6T_SO_GET_REVISION_TARGET(r4, 0x29, 0x45, &(0x7f0000000040)={'NETMAP\x00'}, &(0x7f0000000080)=0x1e) r5 = socket$inet6_sctp(0xa, 0x5, 0x84) r6 = socket$inet_sctp(0x2, 0x1, 0x84) getsockopt$inet_sctp_SCTP_MAX_BURST(r6, 0x84, 0xd, &(0x7f0000000140)=@assoc_value={0x0}, &(0x7f0000000180)=0x8) setsockopt$inet_sctp6_SCTP_DEFAULT_PRINFO(r5, 0x84, 0x72, &(0x7f00000001c0)={r7, 0xff, 0x30}, 0xc) getsockopt$inet_sctp6_SCTP_RECONFIG_SUPPORTED(r4, 0x84, 0x75, &(0x7f0000000200)={r7, 0x2}, &(0x7f0000000240)=0x8) connect$x25(r1, &(0x7f00000000c0)={0x9, @remote={'\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc', 0x2}}, 0x12) bind$x25(r4, &(0x7f0000000000)={0x9, @remote={'\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc', 0x0}}, 0x8) sendmsg$NFT_BATCH(r3, 0x0, 0x0) ioctl$sock_inet_SIOCSIFFLAGS(r2, 0x8914, &(0x7f00000015c0)={'bond0\x00', 0x2000}) 1.346712257s ago: executing program 2 (id=6059): sendmsg$nl_route_sched(0xffffffffffffffff, 0x0, 0x0) r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$ieee802154(&(0x7f0000000380), r0) ioctl$sock_SIOCGIFINDEX_802154(0xffffffffffffffff, 0x8933, &(0x7f0000000400)={'wpan0\x00', 0x0}) sendmsg$NL802154_CMD_GET_INTERFACE(r0, &(0x7f0000000500)={&(0x7f00000003c0)={0x10, 0x0, 0x0, 0x8}, 0xc, &(0x7f00000004c0)={&(0x7f0000000440)=ANY=[@ANYBLOB='X\x00\b\x00', @ANYRES16=0x0, @ANYBLOB="20002bbd7000fbdbdf25050000000c00060002000000020000000c000600030000000300000008000300", @ANYRES32=r1, @ANYBLOB="0c0006001b4ac9860aecba030c00060001000000010000000c0006000200000000000000"], 0x58}, 0x1, 0x0, 0x0, 0x40}, 0x40) r2 = socket$netlink(0x10, 0x3, 0x0) bind$netlink(r2, &(0x7f0000000ac0)={0x10, 0x0, 0x25dfdbfc, 0x2ffffffff}, 0xc) r3 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r3, 0x29, 0x40, &(0x7f0000003080)=@raw={'raw\x00', 0x3c1, 0x3, 0x3a8, 0x0, 0x18c, 0x203, 0x158, 0x19030000, 0x2d8, 0x2e0, 0x2e0, 0x2d8, 0x2e0, 0x7fffffe, 0x0, {[{{@uncond, 0x300, 0xf0, 0x158, 0x0, {0x1000000}, [@common=@unspec=@limit={{0x48}, {0x2000007a, 0x7f, 0x40, 0x8, 0xe6, 0x75800a43, 0xfffffffffffffff9}}]}, @unspec=@CT1={0x68, 'CT\x00', 0x1, {0x15, 0x8, 0x6, 0x462, 'syz1\x00', 'syz0\x00', {0x6}}}}, {{@ipv6={@remote, @mcast2, [0xff, 0x0, 0xff, 0xffffffff], [0xffffff00, 0xffffff00, 0xff, 0xffffff00], 'nr0\x00', 'bond_slave_1\x00', {}, {0xff}, 0x33, 0x0, 0x3, 0x3d}, 0x0, 0x138, 0x180, 0x0, {}, [@common=@srh1={{0x90}, {0x0, 0x8, 0x5, 0x9, 0x81, @private0, @mcast2, @ipv4={'\x00', '\xff\xff', @remote}, [0x0, 0x0, 0xffffffff, 0xff000000], [0xffffff00, 0xff000000, 0x0, 0xffffff00], [0xffffff00, 0x0, 0xffffff00], 0x46}}]}, @common=@unspec=@IDLETIMER={0x48, 'IDLETIMER\x00', 0x0, {0xb, 'syz0\x00', {0x6cb}}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x408) r4 = socket$inet6(0xa, 0x1, 0x0) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r4, 0x29, 0x20, &(0x7f0000000000)={@private2, 0x0, 0x0, 0x103, 0xd, 0x0, 0x1}, 0x20) r5 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$IPT_SO_SET_REPLACE(r5, 0x4000000000000, 0x40, &(0x7f0000000040)=@raw={'raw\x00', 0x4001, 0x3, 0x2b8, 0x148, 0xb, 0x148, 0x148, 0x148, 0x220, 0x240, 0x240, 0x220, 0x215, 0x3, 0x0, {[{{@ip={@local, @multicast1, 0x0, 0xffffff00, 'ip6erspan0\x00', 'nr0\x00', {}, {0xff}, 0x21, 0x0, 0x10}, 0x2e8, 0xe8, 0x148, 0x0, {0xff0f000000000000}, [@common=@inet=@multiport={{0x50}, {0x0, 0x0, [0x4e24, 0x4e23, 0x4e22, 0x4e24, 0x4e24, 0x4e24, 0x4e22, 0x4e23, 0x4e21, 0x4e20, 0x3, 0x4e22, 0x4e23, 0xeac, 0x4e24], [0x1, 0x0, 0x43, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x41, 0x0, 0x0, 0x0, 0xfc]}}, @inet=@rpfilter={{0x28}, {0xa}}]}, @common=@SET={0x60, 'SET\x00', 0x0, {{0x4, [0x1, 0x1, 0x0, 0x1, 0x1, 0x1], 0x6, 0x4}, {0x3, [0x4, 0x2, 0x6, 0x4, 0x2, 0x7], 0x2, 0x7}}}}, {{@ip={@broadcast, @remote, 0x0, 0x0, 'team0\x00', 'netpci0\x00', {}, {}, 0x0, 0x1}, 0xec010000, 0x70, 0xd8}, @unspec=@CT1={0x68, 'CT\x00', 0x1, {0x4, 0x5, 0x22000000, 0xfffffffa, '\x00', 'syz1\x00', {0x3}}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x318) r6 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r6, &(0x7f0000000900)={0x0, 0x0, &(0x7f0000000940)={&(0x7f0000000980)=@newqdisc={0x30, 0x24, 0x601, 0x0, 0x0, {0x0, 0x0, 0x0, 0x1, {}, {0xfff1, 0xffff}}, [@qdisc_kind_options=@q_ingress={0xc}]}, 0x30}}, 0x0) sendmsg$nl_route_sched(r6, &(0x7f00000009c0)={0x0, 0x0, &(0x7f0000000a00)={&(0x7f0000000b00)=@newtfilter={0x2580, 0x2c, 0x400, 0x0, 0x0, {0x0, 0x0, 0x0, 0x1, {0x1, 0x6}, {0xfff1, 0xffff}, {0x3, 0x1}}, [@filter_kind_options=@f_fw={{0x7}, {0x2554, 0x2, [@TCA_FW_ACT={0x1f7c, 0x4, [@m_vlan={0xb0, 0x16, 0x0, 0x0, {{0x9}, {0x4}, {0x84, 0x6, "9d375f28efa062cb31cdb920f25c28a812c99150fa2fcb5bb42b97912418aab2512aa991e378c9da1db31d80486c71ed264dd49c00ff5223631abcdb642a4688d0e4364480c20fd5902fa2cf3e9295958dcc4d4266ae95ca842b14af5e65a51f34f5719a715bc896964fc57ddb49f719c98665f142410df7373ff3777e058233"}, {0xc, 0x7, {0x0, 0x1}}, {0xc, 0x8, {0x1, 0x1}}}}, @m_csum={0xcc, 0x1a, 0x0, 0x0, {{0x9}, {0x20, 0x2, 0x0, 0x1, [@TCA_CSUM_PARMS={0x1c, 0x1, {{0xfffffc25, 0x7, 0x3, 0x6, 0x5}, 0x73}}]}, {0x83, 0x6, "bbad482db2833f48a84e4ceaea2efa423c3f34edb37f0783db08df13ecbe4cfb4f65fdc3ea2111369bc4e6c2d5ddcf0fd4f26ff0311ab641a162310bae6d416b8b0e025323b8a2285dcc57434fdc12556a7703fc79f089b4d78963ec367e454f2043a77263ad04d9a65b62792973acbe03f06bd662e737b5f153f235c78fdb"}, {0xc, 0x7, {0x1}}, {0xc, 0x8, {0x2, 0x3}}}}, @m_ctinfo={0xd0, 0x12, 0x0, 0x0, {{0xb}, {0x4}, {0xa2, 0x6, "e46cb80b2cf47e4ec2cbde030e051e1e5bc48d43f38c4d26406d59eac5510b76a9dd47b597d2efbacb64538de3373dd6c52ecc957d740febc2ae3583f26784a60e47637f87ac6bacf3d8069e063207f58e322194c49c51eaa27ea8686b3ef60a545ab60e03bcf99ed936bc22744f94cf1c42d8b1e404a865acbcce7d98137194a8a0bdffa07102ec9dace4c825cbf4ee67d99e0fefe304af399dbbd2245a"}, {0xc, 0x7, {0x1}}, {0xc, 0x8, {0x2, 0x3}}}}, @m_police={0x1d2c, 0x1, 0x0, 0x0, {{0xb}, {0x1cd8, 0x2, 0x0, 0x1, [[@TCA_POLICE_RATE={0x404, 0x2, [0x40, 0x4, 0x7, 0x4, 0xec, 0x2394, 0x8, 0x10000, 0x8, 0x0, 0x1000, 0x2d, 0x1, 0x4, 0x7, 0xfa, 0x0, 0xbb2, 0x7, 0x7, 0xd6d, 0x2, 0x95f, 0xff, 0x1, 0x3, 0x3, 0xfffffff9, 0x8f, 0x80000001, 0x9, 0x5, 0x0, 0x2, 0x8, 0x5, 0x7, 0x2c5b, 0x4, 0x800, 0x7, 0x7, 0xfffffff9, 0x1, 0xda16, 0x6, 0x1, 0x5, 0xfffffffd, 0x3, 0x7f, 0x5, 0x8, 0x2, 0x3, 0xfffffffb, 0xc32, 0x7, 0x9, 0x4, 0x0, 0x1ff, 0x0, 0xa, 0x4, 0x4, 0x4a, 0x7, 0x4, 0x2, 0x5, 0x6a, 0x2, 0x8, 0x6, 0x9, 0x5, 0x5, 0x6, 0x0, 0x6, 0x9, 0x0, 0x1, 0x1000, 0x0, 0xe02d, 0x800, 0x3ff, 0x3ff, 0xb2, 0x1600, 0x9, 0xfffffffd, 0xa954, 0x2, 0x239, 0x6, 0xa8b, 0xffffffff, 0xfffffffa, 0x0, 0x4, 0x2, 0x808d, 0x8879, 0x2, 0x7ff, 0x6, 0x800, 0x1, 0xfffffff7, 0x8, 0x3, 0x40000000, 0x10001, 0x58f0, 0x7c000000, 0xfffe0000, 0x0, 0xb, 0x3, 0x5, 0x40, 0x1, 0x2, 0x1, 0x7f, 0x677, 0x8001, 0x4, 0x8, 0x2e2273a4, 0x0, 0x0, 0x915, 0x7, 0x0, 0x2, 0x6, 0xfffffa34, 0xa, 0x4, 0x101, 0x0, 0x6, 0x3, 0x0, 0x1, 0x0, 0x2, 0xff, 0x400, 0x3627, 0x1, 0x2, 0xd, 0x8000, 0xffffffff, 0x1, 0x1, 0x4, 0x3, 0x0, 0x50000000, 0xffffffff, 0x8, 0x2, 0x0, 0x6, 0xf5, 0xffffffff, 0xa, 0xbc7, 0xd, 0x4, 0x8ae9, 0x5, 0x0, 0x0, 0x62, 0x9, 0x2cce, 0x9, 0x40, 0x0, 0x3, 0x3, 0xff, 0x1000, 0x800, 0x101, 0x9, 0x9e, 0x2, 0x83, 0x82d, 0x2, 0x0, 0x4, 0xfffff001, 0xa4, 0x31, 0x7, 0xad, 0x81, 0x200, 0x6, 0x0, 0x3, 0x1e5cdb9c, 0x10000, 0xb55b, 0xd, 0xbd, 0x8, 0x3, 0xdc11, 0x6b, 0x8, 0x200, 0x7, 0x893, 0x4, 0x8d4, 0x6, 0x9, 0xfffffffb, 0xacb, 0xffffffff, 0x8, 0x3, 0x1c, 0x62, 0x5, 0x5, 0x0, 0xd, 0x0, 0xf1e4, 0x4, 0x0, 0x2, 0x63, 0x1, 0x8, 0x10, 0x34c, 0x5, 0x3, 0xff, 0x7ff, 0xa72, 0xfffffe59, 0xfffffff9, 0xf0d]}, @TCA_POLICE_PEAKRATE={0x404, 0x3, [0x0, 0xa06d, 0xae9, 0x1, 0x3ba, 0x7, 0x0, 0x9, 0x6, 0x1f24c788, 0x9, 0x4, 0xb, 0x101, 0x3, 0x2, 0x1, 0x8, 0x0, 0x6, 0x8, 0xc9b, 0x295, 0x15, 0x1b, 0x9, 0x4, 0x6, 0xfffffffb, 0x1, 0x3, 0x7, 0x80, 0x1, 0x1ff, 0x7, 0x42b8, 0x1, 0x10000, 0x4, 0x57a, 0x5, 0x1000, 0x9, 0x8000, 0x6, 0x4, 0x3, 0x6, 0x6384, 0x1, 0x8, 0xffffffff, 0xef, 0x60, 0xfffffff7, 0x8, 0x8, 0x6000, 0x1, 0x7, 0x4, 0x200, 0x1, 0x3cfb, 0x40, 0x2, 0x8, 0xa, 0x6, 0x7, 0x5, 0xe, 0x3, 0x2, 0x3ff, 0xf, 0x9, 0xfffffffb, 0x9926, 0x7fff, 0x8, 0x9, 0x0, 0x5, 0x7, 0x7fff, 0x6, 0x32, 0x10001, 0x6, 0x4, 0x9, 0x1, 0xad6d, 0x7f, 0xc720, 0xfb0, 0x100, 0x94, 0x10, 0x0, 0x2c, 0x8000, 0x3, 0x401, 0x5, 0xffff0001, 0x512b, 0xfffffff9, 0xff, 0xfff, 0x9, 0x0, 0xfffffffe, 0x0, 0x1, 0x5, 0x3, 0xf, 0x6, 0x4, 0x2, 0x0, 0x87b2, 0x9, 0xc, 0x3, 0x7, 0x7ff, 0x6, 0x7, 0x1, 0x2, 0x3, 0x9, 0x5, 0x3, 0x7fffffff, 0x550a921, 0x2, 0x3, 0x7fff, 0x7, 0x0, 0xffff, 0x3b2, 0x100, 0xf, 0x5, 0x0, 0x4, 0x6, 0x9, 0x10001, 0x6, 0x10, 0x8000, 0x5, 0x100, 0x2, 0x25, 0x0, 0x400, 0x10001, 0xe, 0x5, 0x4, 0x1, 0x6, 0x3, 0x6, 0x0, 0x3, 0x0, 0x4, 0x9603, 0x9, 0x5, 0x9, 0x4, 0x5, 0x743b, 0x5, 0x7, 0x6, 0x0, 0x40, 0x2, 0x4, 0xff, 0xc1a, 0x8, 0x5, 0x0, 0x8, 0x6, 0x2f5, 0x400, 0xfffffff9, 0x10001, 0x0, 0x8, 0x2, 0x10001, 0xa2, 0x0, 0x8, 0x0, 0x9, 0x3, 0x3, 0x5, 0xfffffffd, 0x6, 0x10001, 0x9, 0xd6, 0x45ef, 0x4, 0x3, 0xa99, 0x4c62, 0xf8b0, 0xe, 0x3, 0x2400, 0x9, 0x8, 0x14d6441c, 0xd2f, 0x3, 0x8, 0x8, 0x6000000, 0x5, 0xfffffffc, 0x8, 0x8, 0xbb7e, 0x1, 0x9ca, 0x2, 0x8, 0xc25, 0x8, 0xa418, 0x9, 0x9, 0xffffffff, 0x9, 0x32, 0x7f, 0x1, 0xaa3, 0x5]}], [@TCA_POLICE_RATE={0x404, 0x2, [0x5, 0x2, 0x5, 0x2, 0x3, 0xe0b, 0x8, 0xfffffffc, 0xa23d, 0x7, 0x4, 0x0, 0x7ff, 0x6, 0x10001, 0x5, 0xffff, 0x5, 0x1, 0x8, 0xde, 0xda, 0x10, 0x9, 0x9, 0x8, 0x9, 0x5, 0xffffff26, 0x4, 0xffffff8e, 0x8, 0xfffffffc, 0x5, 0x280, 0x9, 0x2, 0x1, 0xfffffffc, 0x266, 0x0, 0x5, 0x8, 0x1, 0x7ff, 0x2, 0x8, 0x0, 0x8, 0x7, 0x1, 0x2, 0x5, 0x8001, 0x9, 0x6a1, 0x7fffffff, 0x8ce, 0x1, 0x0, 0x1, 0x5, 0x3, 0x1, 0x2b, 0x2, 0x5, 0x10000, 0x5, 0x8, 0x4, 0x101, 0x1, 0x8, 0xf, 0x2, 0x6, 0xff, 0x81, 0x7, 0x4, 0xc, 0x7, 0x1, 0x7, 0xfb8, 0x2, 0x1, 0x3, 0x8, 0x7, 0xfffffffc, 0x78, 0x3, 0x994, 0x4, 0x5994, 0xc, 0x2, 0xc, 0xf6f, 0x200000, 0x4, 0x101, 0x7, 0xfffffff8, 0xc, 0x80000001, 0x6, 0x5, 0x3, 0x0, 0x9c, 0x0, 0x80000001, 0x0, 0x17c0, 0x4, 0x9, 0x9, 0x8, 0x72267dbc, 0x1000, 0x7, 0x6, 0x5, 0xe, 0x9, 0x6, 0xc, 0x3ff, 0x1, 0x9, 0x7f08a15, 0x4b32, 0x10, 0x6, 0x5804, 0x7, 0x8, 0x0, 0xc9c, 0x6, 0x8, 0x3, 0xef, 0x0, 0x9, 0xffff, 0x4, 0x1, 0x1, 0x1c2, 0x8, 0x3, 0x2, 0x80000000, 0x2, 0x6, 0xa, 0xab4, 0x5b, 0x2, 0x7, 0x5, 0x7, 0x7, 0x9, 0x7fffffff, 0x2, 0xf7, 0x8, 0x3, 0x5, 0x3, 0x1ff, 0x69b7, 0x0, 0x7ff, 0x0, 0xfffffff9, 0xd71, 0xfffffff9, 0x8, 0x8, 0xc, 0x1, 0x6, 0xa5, 0x7f, 0x4, 0x8081, 0x5, 0x3, 0x2, 0x5, 0x2f, 0x3, 0x80, 0x978, 0x4, 0x8, 0x9, 0x6, 0x5, 0x5, 0x6, 0x6, 0xc8d, 0x4, 0x2, 0x10, 0x800, 0x5, 0x9, 0xb8c, 0x9, 0xfffffa58, 0x4, 0x9, 0x6, 0x7, 0x3, 0x6, 0xb, 0x7ff, 0x8, 0x100, 0x8, 0x7, 0x2, 0x7, 0x100, 0xe15b, 0xfcde, 0x9, 0x3, 0x101, 0x8, 0x1, 0x0, 0x7ff, 0x4, 0x79, 0x3, 0x258, 0x5, 0x5, 0x0, 0x2, 0xeb65, 0xa3, 0x3, 0x0, 0xe82, 0x6]}], [@TCA_POLICE_RATE={0x404, 0x2, [0x9, 0xefde, 0xffffffff, 0x2, 0x4, 0xfff, 0x5, 0x4e3, 0xa2b, 0x0, 0x1010000, 0x4, 0x6, 0x5, 0x5, 0x7, 0x1, 0x7f, 0x1, 0x4, 0x1000, 0x2c5, 0x1, 0x8, 0xc5, 0x7ff, 0xf47, 0x3, 0xdf7, 0x7, 0x5, 0x3, 0x5f369585, 0x0, 0x2, 0x6, 0x7, 0xa1eb, 0x6, 0xf929, 0x4, 0x9, 0xfffffffe, 0xfca2, 0x8, 0x1, 0x80000, 0x0, 0x944, 0x4, 0x6, 0x0, 0x7fff, 0xe5, 0x3, 0x1, 0xa, 0x8, 0x79f5f632, 0x1, 0xfffffffb, 0xe2, 0x7, 0x400, 0x40, 0x1, 0x0, 0xc28, 0x3, 0x8000, 0xfffff815, 0x80, 0x1d9, 0x8, 0x5a, 0x8001, 0x9, 0x80, 0x3, 0x9, 0xee07, 0x81, 0x2, 0x8, 0x8, 0x6, 0x1, 0xa0000000, 0x9, 0x5, 0xc, 0xc3, 0xffffffff, 0x5bfe, 0x5, 0x7, 0x4, 0x7, 0x10000, 0x7, 0x7ff, 0xfffffffa, 0x8, 0x7, 0x5, 0x7, 0x1, 0x9, 0x0, 0x369, 0x75, 0x9, 0x7fffffff, 0x3ffc0000, 0x40, 0x8, 0x1000, 0x9, 0x6, 0x8, 0x2, 0x0, 0xffff, 0x0, 0xc62, 0x8, 0x7, 0x3, 0x5, 0x4, 0x4, 0x2, 0xfffff180, 0x0, 0x9, 0x0, 0x60, 0x7fff, 0xaa000000, 0x5, 0xc, 0x8000, 0xb, 0xffff7fff, 0x5, 0x800, 0xb, 0x401, 0x5, 0x1, 0x6, 0x7, 0x4, 0x8000, 0xfffffff8, 0x7fffffff, 0xd, 0x5, 0x7fffffff, 0x47ca34d7, 0x6, 0x3, 0x1, 0x7, 0x0, 0x8, 0xce9, 0x380000, 0x8, 0x400, 0x7c7a, 0x9, 0xca, 0x4, 0x7ff, 0x200, 0x96, 0x9776, 0xa, 0x200, 0x9, 0x1ff, 0x4, 0x3, 0x3, 0x2d2, 0xfffffffb, 0x4f, 0x7f, 0x8001, 0x3, 0xdf, 0x1, 0x1, 0x9, 0x4, 0x4, 0x8, 0x4a2, 0x3, 0xffffffff, 0x3, 0x8be, 0x1, 0xc, 0x0, 0x5, 0xffff, 0x7fff, 0x9, 0x7f, 0x9, 0x9, 0x6, 0xa, 0x782, 0x8ed5, 0x80000001, 0xe71, 0x7f, 0xa, 0x9, 0x4, 0x3, 0x9, 0x4, 0x6, 0x0, 0x2, 0x78e8, 0x200, 0x2, 0x0, 0x5ccf, 0x3, 0x3, 0x8, 0x2, 0x4, 0x12e, 0xad14, 0x6, 0x7, 0x4, 0x1, 0x6, 0x8, 0x30, 0xe, 0x9, 0xe, 0x4634, 0x7ff, 0xc85, 0x9]}, @TCA_POLICE_PEAKRATE={0x404, 0x3, [0xed7b, 0x5000, 0x8, 0x9, 0x0, 0x3, 0x1ff, 0x7, 0x3, 0x420, 0x6, 0x800, 0xc, 0x82, 0x3, 0x6, 0x7f, 0x10000, 0xe6, 0xf19, 0x9, 0xf46c, 0x9, 0x0, 0xee6e, 0xc, 0x1, 0xce, 0x3f8, 0x5, 0x4, 0x3, 0x100, 0x19, 0x8000, 0x2, 0xeee, 0xfffffff3, 0x2, 0x8, 0x6, 0xf6, 0x8, 0x9, 0x5, 0x6, 0x1, 0x3, 0x400, 0xfffffffd, 0x34, 0x10, 0x9, 0x80, 0x2, 0x9, 0x1, 0x1e, 0x101, 0x8, 0x24, 0x2, 0x9, 0x5, 0x0, 0x0, 0x6, 0x0, 0x9, 0x2, 0x6, 0x9, 0x6, 0x6, 0x0, 0x6, 0xffff, 0x7, 0xfffff226, 0xffff, 0x1, 0x0, 0x7, 0x2, 0x25767860, 0x6, 0x2, 0x6, 0x54a, 0x469, 0x6, 0x37, 0x8, 0x6, 0x1, 0xdc4, 0x2, 0x2, 0x7ff, 0x3ff, 0x5, 0x63, 0x3, 0x6, 0x6, 0x7, 0x80, 0x2, 0xf, 0x5, 0x0, 0x10, 0xf2, 0xa, 0x55b554f, 0x1, 0x800, 0x9, 0xadb, 0x5a6c, 0xa, 0xa, 0x64, 0x8, 0xbebd, 0x8c36, 0x253, 0x0, 0xe, 0x4, 0x9, 0x4f, 0x1, 0xae6, 0x100, 0x8, 0x0, 0x6, 0x5, 0x6, 0x4, 0xffffffc0, 0x4, 0x8, 0x9, 0x2, 0x8000000, 0x9, 0xc, 0x0, 0x6, 0x3, 0x55, 0xdd9, 0xffff7fff, 0x9, 0x3, 0x4, 0x2, 0x14, 0xc, 0x4, 0xb, 0x400, 0x2, 0x200, 0xfffffffc, 0x4, 0x66d73c12, 0x7, 0x2, 0x6, 0x4, 0x5, 0xd6, 0x7fffffff, 0x5, 0xd, 0x13f6, 0x7, 0x81, 0x0, 0x60f, 0xe3c9, 0x1, 0x4, 0x2, 0x8, 0x7f, 0xd, 0x75a7, 0x8, 0xfffffff7, 0x9, 0x2, 0x1, 0x7, 0x4, 0x3, 0x10000, 0x5, 0xcd40, 0x1, 0x8001, 0x23, 0x80000000, 0x6, 0xffffffff, 0x7, 0xffff7377, 0x400, 0x92, 0xb16, 0x10001, 0x6, 0x3c2, 0x1, 0x3, 0x5, 0x40, 0x0, 0xe99, 0xa, 0xfffffffa, 0x67, 0x100, 0x0, 0xffffffff, 0x9, 0x7, 0x9, 0x5, 0xd, 0x8, 0x46, 0x8, 0x3, 0xa, 0x7, 0xfffffffd, 0x80000000, 0x6, 0x4, 0xfcfdad6, 0x0, 0x1, 0x0, 0x9d3b, 0x7fff, 0x9, 0x2, 0x3, 0x8, 0x0, 0x640, 0x8]}, @TCA_POLICE_PEAKRATE64={0xc, 0x9, 0x1}, @TCA_POLICE_RATE64={0xc, 0x8, 0x4}], [@TCA_POLICE_PEAKRATE64={0xc, 0x9, 0x8a}, @TCA_POLICE_PEAKRATE64={0xc, 0x9, 0x8000000000000000}, @TCA_POLICE_PEAKRATE={0x404, 0x3, [0xdd, 0x0, 0xfffffff9, 0x401, 0x7, 0x5, 0x1cd, 0x9, 0x1, 0xff, 0x9, 0xff, 0x401, 0xb5, 0x4, 0x6, 0x8, 0x5, 0x1200000, 0x3, 0x1, 0x3, 0x7, 0xce, 0x3, 0x4, 0x9, 0x9, 0x80, 0x3, 0x3ff, 0xb, 0x400, 0x1, 0x8, 0x2, 0x10000, 0x0, 0x0, 0xf, 0x9, 0x51, 0x7, 0x6d0b, 0x8, 0x4, 0x1c31, 0x6, 0x8, 0x0, 0x4, 0xffffff01, 0x7626, 0x6, 0x0, 0x7, 0x5, 0xfffffffa, 0x8cee, 0x1, 0x8000, 0x2, 0x80000001, 0x6, 0x5, 0x2, 0x1ff, 0x7, 0xffffffff, 0x7, 0x0, 0xffffca34, 0x4, 0x0, 0x0, 0x3, 0x6, 0x9, 0x7, 0xb, 0x8001, 0x0, 0x786e, 0xb50d, 0x1ff, 0xd0, 0x1, 0xfffffff7, 0x0, 0xd6b, 0x7, 0x9, 0x44bf, 0x100, 0xd21a, 0x6, 0x8001, 0x800, 0x10000, 0x0, 0x3, 0x4, 0x3, 0x0, 0xfffffff0, 0x8c000000, 0x0, 0x3, 0x3, 0x7, 0x1, 0x2, 0x8000, 0xbc, 0x10001, 0x2, 0x7fff, 0x6, 0xf6, 0x1, 0x8, 0x401, 0x7ff, 0x0, 0xff2, 0x1, 0x9, 0x0, 0x6, 0xfffff11a, 0x7, 0x1, 0x1, 0x6, 0x372, 0x7097, 0x6, 0x10, 0x10, 0x5, 0x80, 0x10000, 0x100, 0x0, 0xb, 0x1ff, 0x9ed, 0x9, 0x4, 0x1000, 0x81, 0x7, 0x4, 0xf8b0, 0x9, 0x0, 0x2, 0x0, 0x0, 0x7ff, 0x1, 0x7, 0x5, 0x5, 0x4, 0xadc7, 0x7fffffff, 0x0, 0x18, 0x912, 0x9, 0x1, 0x2, 0x6, 0x8, 0x1, 0xa, 0x6, 0x7fff, 0x2, 0x7, 0x7, 0x3, 0x1, 0x5, 0x5, 0x6, 0x4, 0xa, 0x8, 0x1, 0x8, 0x92, 0x9, 0x3, 0x296, 0x9, 0xfffffffb, 0x6, 0x9, 0x0, 0x8, 0x3, 0xb, 0x4, 0x6, 0x80000000, 0x1, 0x8, 0x5, 0x3, 0x98, 0x9, 0x6, 0xd, 0x3, 0x6, 0x7, 0x29b, 0x8, 0x13f5, 0x7, 0x7, 0x6, 0x3fb, 0x7fff, 0xe000, 0xe881, 0x9, 0x4a, 0x372d, 0x8, 0xf57, 0x2, 0x6, 0x5, 0x80, 0x1ff, 0x3a7d1757, 0x8, 0x80, 0x7, 0x0, 0x8000, 0x5, 0x1, 0x0, 0x7ff, 0x6e, 0x9, 0x0, 0x92, 0xd, 0x2, 0x1e800000]}, @TCA_POLICE_RESULT={0x8, 0x5, 0x47}], [@TCA_POLICE_RATE64={0xc, 0x8, 0x8}, @TCA_POLICE_RATE64={0xc, 0x8, 0xd069}, @TCA_POLICE_RATE64={0xc, 0x8, 0x800}, @TCA_POLICE_RESULT={0x8, 0x5, 0x2}, @TCA_POLICE_PEAKRATE={0x404, 0x3, [0x5, 0x587, 0x4, 0x9, 0x1, 0x401, 0xe00, 0xffffffff, 0x7, 0x4, 0xaf41, 0x5, 0x4, 0x800, 0x26cdb3da, 0x80000000, 0x7, 0x7, 0x0, 0x5, 0x1, 0x8, 0x8, 0x84a, 0x7, 0x5a, 0x4cd, 0xfffffff9, 0x3, 0x3, 0xd, 0x6, 0x40, 0x3, 0x80000000, 0xea5b, 0x6e51, 0x100, 0xf, 0x1800, 0x5, 0x9, 0x7, 0xed4c, 0x6da, 0x6, 0x8, 0x9, 0x288, 0x4, 0xb64, 0x3, 0x5c57, 0x8, 0x0, 0x2, 0xfffffffc, 0x401, 0x5, 0x2, 0xff, 0x6, 0xd, 0x1, 0x9, 0x81, 0xffffffff, 0x2, 0x54, 0x5, 0x562c, 0x6, 0x8, 0x4, 0x5, 0x6ea, 0x40, 0x1, 0x2, 0x660, 0x4, 0x7, 0xcf, 0x4, 0x9, 0xfffffffc, 0x7, 0x2, 0x1, 0xc, 0x697057a, 0x5, 0x7, 0x7, 0x9, 0xff69, 0xafe, 0x38000000, 0x4, 0x7, 0x1, 0x1, 0x8, 0x9, 0xe, 0x2, 0xd, 0x8, 0x6, 0xff, 0x8, 0x2, 0x0, 0x0, 0x0, 0x7fff, 0x5, 0x8000, 0x6, 0x7e, 0x7fff, 0x7, 0x7, 0x0, 0xffff7fff, 0x7, 0x7, 0x101, 0x100, 0x8c, 0x1, 0x2, 0x5, 0x1, 0xa, 0x9d4f, 0xffff, 0x8, 0x200, 0x6, 0x0, 0x9, 0x9, 0x8, 0xfffffff0, 0x40, 0xffffffff, 0x3, 0x3, 0xf1, 0xe6b4, 0xa1, 0xdcf9, 0x1, 0x10, 0x0, 0xb2, 0x7, 0x2a8d7334, 0x3, 0x81, 0x23fb, 0x7, 0x703a, 0xfce, 0x1, 0x2, 0x81, 0xc4, 0x9, 0x100, 0x9, 0x7, 0xd, 0xffffffff, 0x401, 0x7, 0xffffffff, 0xfffffc00, 0xff, 0x8, 0x100, 0x1ff, 0xfffffffa, 0xfffffc00, 0x8000, 0x9, 0x6, 0x9, 0xe, 0x9, 0xb08b, 0x9, 0x7, 0x4, 0xffffff7f, 0x3, 0x4f, 0x1, 0x0, 0xc, 0x8, 0x6, 0x9, 0x6, 0x5, 0x7e69, 0xa32, 0x7fffffff, 0x4, 0xffff, 0x3, 0x2, 0x7fffffff, 0x2, 0x0, 0xfffffffc, 0x9, 0x500, 0xef, 0x8, 0x5, 0xff9, 0x8001, 0xa3c, 0x1615, 0x12, 0x723c, 0x8, 0x1, 0x6, 0x2, 0x8, 0x1ff, 0x9, 0xfffffffb, 0xffffffff, 0x1, 0x81, 0x0, 0x80000001, 0x63e, 0xe, 0x1ff, 0x81, 0xc, 0x0, 0x1, 0x58, 0x8, 0x9a06, 0xd, 0xffff, 0x5, 0xc, 0x5]}, @TCA_POLICE_TBF={0x3c, 0x1, {0x5, 0x7, 0xfffffff9, 0x9, 0x8, {0x5, 0x0, 0x6, 0x1, 0x6b1b, 0x401}, {0x0, 0x2, 0xee1, 0x8, 0x0, 0x1}, 0x7, 0x4, 0x8a3a}}, @TCA_POLICE_RATE64={0xc, 0x8, 0x3}, @TCA_POLICE_PEAKRATE64={0xc, 0x9, 0x10}]]}, {0x2a, 0x6, "d4e100749455f121b84bdbd80b522fb3d61d24f7cb10878974d68085af602ab3a3f01b1054bd"}, {0xc, 0x7, {0x1}}, {0xc, 0x8, {0x3, 0x1}}}}]}, @TCA_FW_ACT={0x74, 0x4, [@m_xt={0x70, 0x17, 0x0, 0x0, {{0x7}, {0x14, 0x2, 0x0, 0x1, [@TCA_IPT_HOOK={0x8}, @TCA_IPT_HOOK={0x8, 0x2, 0x3}]}, {0x35, 0x6, "5db0dbd47adfa7e1ef5487974d4cc65e0e63e64d0184e9a01a914f9aa54556c61edadf49eb8ff3068e217063e899d219b5"}, {0xc, 0x7, {0x1, 0x1}}, {0xc, 0x8, {0x3, 0x2}}}}]}, @TCA_FW_POLICE={0x49c, 0x2, [@TCA_POLICE_RATE={0x404, 0x2, [0xfffffff7, 0x34, 0x8, 0x3, 0x7, 0xd, 0x28d53f0c, 0x6, 0x3, 0x1, 0x19, 0x0, 0x3, 0xfff, 0x7, 0x10, 0x8, 0x4e, 0xffff, 0x9, 0x40, 0x8, 0x8, 0x3, 0x0, 0x7, 0x8000, 0x7f, 0x2, 0xe2, 0x1, 0x6, 0xd, 0xffffffff, 0x5, 0x4, 0xff, 0x4, 0x8, 0x4, 0x26e3b704, 0xffffffc0, 0x1, 0x1, 0xfff, 0x8, 0x3, 0x3, 0xfff, 0x6e, 0x4, 0x4, 0x8, 0x8, 0x400, 0x7fff, 0x6, 0x0, 0x7, 0xfffffff3, 0x0, 0x3, 0x1, 0x1, 0x0, 0x3, 0xe81, 0x3, 0x5, 0x101, 0xf, 0x9, 0x4, 0x1, 0x1, 0x8, 0x2, 0x1, 0x3, 0x4, 0x2, 0x1, 0x5, 0x8, 0x7, 0xfffffff7, 0x3, 0xd621, 0x3, 0xfff, 0xc8, 0xf, 0xdf, 0x40, 0x800, 0x6, 0x7, 0xf36, 0x245d, 0xffff, 0x4, 0x9, 0xc, 0x1, 0x7fffffff, 0x7, 0x9, 0x34, 0x3, 0x2a, 0xc, 0x2, 0x4, 0x8, 0x3269, 0x7, 0x1ff, 0x8001, 0x4, 0x3, 0x4, 0x6, 0x3, 0xb2f, 0x4, 0x0, 0x8000, 0x3, 0x9, 0x1d2, 0xff, 0x4e, 0x9, 0x1, 0x4, 0x2, 0x6, 0x5487, 0x6, 0x5, 0x1, 0x8, 0x9, 0x3, 0x8d95, 0x2, 0xf, 0x8, 0x2, 0x3, 0x2, 0x9, 0xc9c0, 0x3, 0x7, 0x894, 0xafd3, 0x5, 0x3, 0x0, 0x2, 0x1, 0x8000, 0x8b0a3f7, 0x2, 0x7, 0x4, 0x100, 0xf, 0x7, 0x7, 0x7f, 0x0, 0x9ccf, 0x1ff, 0xdd, 0x4, 0x0, 0x2, 0x2, 0x81, 0xe4f, 0x1, 0x4, 0xfffffff7, 0x9, 0x4, 0x3, 0x2, 0x2, 0x3, 0x2, 0x2, 0x1, 0xffffffff, 0x3, 0x10, 0x1, 0xfffffffa, 0x4, 0xd, 0x6, 0x0, 0xb, 0x6, 0x442f, 0x1, 0x1, 0x4, 0x0, 0x0, 0x5, 0xfffffff8, 0x0, 0x0, 0xa, 0x6, 0x6, 0x2, 0x8, 0x57, 0x7, 0x8, 0x2893e484, 0x7, 0x38, 0x2, 0xfff, 0x7, 0x80000000, 0x1ff, 0xe, 0x3, 0xb, 0xfff, 0xd, 0xa, 0x6, 0x987, 0x9, 0x3ff, 0x6, 0xd, 0x4, 0xf0, 0x3, 0x31, 0x9a00000, 0x64, 0x9, 0x7f, 0x2, 0x6, 0x7, 0x10, 0x6]}, @TCA_POLICE_PEAKRATE64={0xc, 0x9, 0x5}, @TCA_POLICE_RESULT={0x8, 0x5, 0x43}, @TCA_POLICE_TBF={0x3c, 0x1, {0x39b, 0x5, 0x87a, 0xffff, 0x9, {0x41, 0x2, 0xb, 0x8, 0x8, 0x40}, {0x0, 0x2, 0xe, 0x3, 0x4}, 0xfffffff8, 0x1, 0xf}}, @TCA_POLICE_TBF={0x3c, 0x1, {0x8, 0xffffffffffffffff, 0x47af, 0x6, 0x2, {0x8, 0x0, 0x2c, 0x9, 0x0, 0x800}, {0x6, 0x1, 0x10, 0x9, 0x8, 0x6}, 0x5, 0xfffffffe, 0x7f}}, @TCA_POLICE_AVRATE={0x8, 0x4, 0x5}]}, @TCA_FW_CLASSID={0x8, 0x1, {0xfff1, 0x4}}, @TCA_FW_POLICE={0xa0, 0x2, [@TCA_POLICE_TBF={0x3c, 0x1, {0x20000, 0x4, 0xfffffff8, 0x8000, 0x9, {0x7, 0x2, 0xa73d, 0x9b6e, 0x7fff, 0x54a7d0d3}, {0x9, 0x0, 0xb9, 0x5, 0x9, 0x3}, 0x101, 0x0, 0x7}}, @TCA_POLICE_RATE64={0xc, 0x8, 0xff}, @TCA_POLICE_TBF={0x3c, 0x1, {0x231, 0x5, 0x80000000, 0x2, 0x3a223965, {0x2, 0x2, 0x2, 0x4, 0x9, 0x5cf18998}, {0x2, 0x1, 0x2, 0x5, 0x100, 0x9}, 0xb12c, 0x0, 0x80000000}}, @TCA_POLICE_RESULT={0x8, 0x5, 0x5ef9ce92}, @TCA_POLICE_RESULT={0x8, 0x5, 0xa0a}, @TCA_POLICE_RESULT={0x8, 0x5, 0x1}]}, @TCA_FW_CLASSID={0x8, 0x1, {0x8, 0x6}}, @TCA_FW_INDEV={0x14, 0x3, 'veth0_vlan\x00'}]}}]}, 0x2580}}, 0x0) r7 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000580), r2) sendmsg$L2TP_CMD_SESSION_DELETE(r2, &(0x7f0000000640)={&(0x7f0000000540)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f0000000600)={&(0x7f0000000680)=ANY=[@ANYBLOB='0\x00\x00\x00', @ANYRES16=r7, @ANYBLOB="00032abd7000fcdbdf250600000008000900040000000c000f00020000000000000008000a0003000000bfde7f331ec8fa72a7d22f304407395a03d348dc3eecfdb9ca55b0fb4703aedab9f6e8320f139e4e04006c67"], 0x30}, 0x1, 0x0, 0x0, 0x2040}, 0x90) 1.345605032s ago: executing program 0 (id=6060): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_TCP_MD5SIG(r0, 0x6, 0xe, &(0x7f00000002c0)={@in6={{0xa, 0x4e21, 0x0, @ipv4={'\x00', '\xff\xff', @empty}}}, 0x0, 0x0, 0x4a, 0x0, "e541bd3d3aa6a2bf75e9671e8abcb31c134f3a9db8f52e7300fe6e079f35ac63186c7244fc3b3801e79f15ced9fd7e55d0345bce05c13ed90158fbdeb70322ea3188f81890e3db00"}, 0xd8) bind$inet6(r0, &(0x7f00000003c0)={0xa, 0x4e22, 0x8000}, 0x1c) listen(r0, 0x7be) syz_emit_ethernet(0x4a, &(0x7f00000004c0)={@local, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x3a}, @void, {@ipv4={0x800, @tcp={{0x5, 0x4, 0x0, 0x28, 0x3c, 0x4000, 0x0, 0x1d, 0x6, 0x0, @empty, @empty}, {{0x4e21, 0x4e22, 0x41424344, 0x41424344, 0x0, 0x0, 0xa, 0xf5b439e5fa041319, 0xc3, 0x0, 0x0, {[@md5sig={0x13, 0x12, "2b0a4c532395fc7786ead8d57a2231c4"}]}}}}}}}, 0x0) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000180)={0x6, 0x4, &(0x7f0000000240)=@framed={{0x18, 0x0, 0x0, 0x0, 0x40, 0x0, 0x0, 0x0, 0xffffff15}, [@kfunc]}, &(0x7f0000000280)='GPL\x00', 0x8, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0xd4}, 0x94) bpf$PROG_LOAD(0x5, &(0x7f0000000740)={0x11, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="180000000000000000000000000000001801000020646c2500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b7030000040000008500000072000000850000005000000095"], 0x0, 0xfffffffd, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x94) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_EXP_GET_STATS_CPU(r1, &(0x7f0000000580)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f0000000540)={&(0x7f0000000080)={0x14, 0x3, 0x2, 0x101, 0x0, 0x0, {0x0, 0x0, 0x2}, ["", "", "", "", "", "", "", "", "", ""]}, 0x14}, 0x1, 0x0, 0x0, 0x20008085}, 0x4000) bpf$PROG_LOAD(0x5, &(0x7f0000001a00)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="18090000000000000000000000000000850000006d0000001801000020696c2500000000002020207b"], 0x0, 0x0, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r2 = socket$netlink(0x10, 0x3, 0xa) sendmsg$nl_xfrm(r2, &(0x7f00000005c0)={0x0, 0x0, &(0x7f0000000600)={&(0x7f0000000640)=@getsa={0x28, 0x12, 0x800, 0x70bd2a, 0x25dfdc01, {@in=@remote, 0x4d2, 0x2, 0x33}}, 0x28}, 0x1, 0x0, 0x0, 0x40010}, 0x2000c004) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0x5, &(0x7f0000000440)=ANY=[@ANYBLOB="1809000000ffffff0000000000000000851000000200000085000000070000009500000000000000"], 0x0, 0xfffffdff, 0x0, 0x0, 0x727c45cd4283345, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$PROG_LOAD(0x5, &(0x7f0000000680)={0x11, 0x14, &(0x7f0000000400)=ANY=[@ANYBLOB="180000000000000000000000000000001801000020646c2100000000002020207b1af8ff00000000bfa10000000000000701000000feffffb7"], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x40f03, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) 1.204102627s ago: executing program 4 (id=6061): r0 = socket(0x2, 0x3, 0x6) setsockopt$IPT_SO_SET_REPLACE(r0, 0x0, 0x40, &(0x7f0000000800)=@raw={'raw\x00', 0x9, 0x3, 0x1d0, 0x0, 0xffffffff, 0xffffffff, 0x98, 0xffffffff, 0x0, 0xffffffff, 0xffffffff, 0x138, 0xffffffff, 0x3, 0x0, {[{{@uncond, 0x0, 0x70, 0x98}, @common=@unspec=@STANDARD={0x28, '\x00', 0x0, 0xfffffffe}}, {{@uncond, 0x0, 0x70, 0xa0}, @common=@unspec=@CONNMARK={0x30, 'CONNMARK\x00', 0x1, {0x1, 0xffffffff, 0xffffffff}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x230) syz_emit_ethernet(0x32, &(0x7f0000000a40)={@random="e90c610faca2", @multicast, @void, {@ipv4={0x800, @udp={{0x5, 0x4, 0x0, 0x0, 0x24, 0x0, 0xe000, 0x3, 0x11, 0x0, @empty, @empty}, {0x0, 0xfffe, 0xfffffffffffffcb9, 0x0, @gue={{0x2, 0x0, 0x2, 0x1}}}}}}}, 0x0) syz_emit_ethernet(0xfdef, &(0x7f0000000a80)={@link_local, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x1f}, @void, {@ipv4={0x800, @udp={{0x5, 0x4, 0x0, 0x0, 0xfde1, 0x0, 0x2, 0x8, 0x11, 0x0, @empty, @empty}, {0x0, 0x4e20, 0x9c, 0x0, @wg=@initiation={0x1, 0x0, "2a995ffbee74ab1b3690842deee3df48f8806827d5c763698c4c288abc85bfcc", "9f6cf565ebbd4ddfc4f9c023b431968db6dbc868705956f8baf975b8cb6e17048850e8e89f732bced1e3baee50e5acb8", "112c482ee3d37cb1a7a31c450e403a6ee32477eaeb41d283c8618b26", {"6652725f56c59b04563b19a79d293550", "25b048c89cb27902d8d629c56b49c550"}}}}}}}, 0x0) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFQNL_MSG_CONFIG(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000280)={0x28, 0x2, 0x3, 0x101, 0x0, 0x0, {0x2}, [@NFQA_CFG_CMD={0x8, 0x1, {0x1, 0x0, 0x2}}, @NFQA_CFG_PARAMS={0x9, 0x2, {0x0, 0x2}}]}, 0x28}}, 0x0) r2 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$IPT_SO_SET_REPLACE(r2, 0x0, 0x40, &(0x7f0000000400)=@filter={'filter\x00', 0xe, 0x4, 0x298, 0xffffffff, 0x0, 0xd0, 0x168, 0xffffffff, 0xffffffff, 0xd0, 0x168, 0x200, 0xffffffff, 0x4, 0x0, {[{{@uncond, 0x0, 0xa8, 0xd0, 0x0, {}, [@common=@unspec=@time={{0x38}, {0x0, 0x7fffffff, 0x0, 0x1517f, 0xffffffff, 0xfe}}]}, @common=@unspec=@STANDARD={0x28, '\x00', 0x0, 0xfffffffc}}, {{@uncond, 0x0, 0x70, 0x98}, @common=@unspec=@STANDARD={0x28, '\x00', 0x0, 0xffffffff}}, {{@uncond, 0x0, 0x70, 0x98}, @common=@unspec=@STANDARD={0x28, '\x00', 0x0, 0xffffffff}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28, '\x00', 0x0, 0xffffffff}}}}, 0x1000) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$TUNSETIFF(r3, 0x400454ca, &(0x7f00000000c0)={'syzkaller0\x00', 0xca02}) r4 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCSIFVLAN_ADD_VLAN_CMD(r4, 0x8983, &(0x7f0000000100)={0x0, 'syzkaller0\x00', {0x1}, 0xb5}) r5 = socket$netlink(0x10, 0x3, 0x0) ioctl$SIOCSIFHWADDR(r5, 0x8914, &(0x7f0000000140)={'syzkaller0\x00', @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x2}}) r6 = openat$tun(0xffffffffffffff9c, &(0x7f0000000700), 0x40241, 0x0) ioctl$TUNSETIFF(r6, 0x400454ca, &(0x7f0000000740)={'syzkaller1\x00', 0xc201}) r7 = socket$kcm(0x2, 0x3, 0x2) ioctl$SIOCSIFHWADDR(r7, 0x8914, &(0x7f0000000780)={'syzkaller1\x00', @broadcast}) write$tun(r6, &(0x7f00000007c0)={@val={0x8, 0x800}, @val={0x1, 0x0, 0x4, 0xfffd, 0x14}, @ipv4=@generic={{0x5, 0x4, 0x1, 0x22, 0x16, 0x65, 0x0, 0x60, 0x2, 0x0, @empty, @broadcast}, "14f3"}}, 0x24) sendmsg$NFQNL_MSG_VERDICT(r1, &(0x7f0000000340)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000002940)={0x20, 0x1, 0x3, 0x1, 0x0, 0x0, {0x2}, [@NFQA_VERDICT_HDR={0xc, 0x2, {0xffffff05, 0x1}}]}, 0x20}}, 0x0) 1.119523939s ago: executing program 1 (id=6062): r0 = socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt(r0, 0x84, 0x81, &(0x7f0000000140)="1a00000002000000", 0x8) r1 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) bind$bt_sco(r1, 0x0, 0x0) setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(r0, 0x84, 0x64, &(0x7f0000000180)=[@in6={0xa, 0x4e23, 0x0, @loopback}], 0x1c) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r2, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000300)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a05000000000000000000010000000900010073797a300000000034000000030a010200000000000000000100fffc0900030073797a40000000000900010073797a300000000008000a400000000420000000080a01080000000000000000010000000900010073797a30"], 0x9c}}, 0xc000) syz_emit_ethernet(0xf7, &(0x7f0000000000)={@local, @dev, @void, {@ipv6={0x86dd, @tcp={0x0, 0x6, "4a3ff2", 0xc1, 0x6, 0x0, @remote, @local, {[], {{0x0, 0x4e22, 0x41424344, 0x41424344, 0x0, 0x0, 0x5, 0x14}, {"d77010bccc638e41d335ff361ce886173572c1c6089e36cd551c13256174146b9ec3297ed6f7e4e855a2a473476a1f8f7842a7b9d5baa28f23d342e9d4c3ca479f46646411f3ae97c5c20a618be50ed5efa2acc9ffa20881cdb562d8d2afc05cc12d32916de708b279c53a377fb7e598643430e476a62642336ec479540ecc7239330f6ca802f72bd956c845bff0ad0116e6c290ba25c4833c826f5d1b2f16151638e676e08ef63a200e503f04"}}}}}}}, 0x0) sendto$inet6(r0, &(0x7f00000001c0)="cd", 0x1, 0x8010, &(0x7f0000000200)={0xa, 0x4e23, 0x0, @loopback, 0xfffffffe}, 0x1c) setsockopt$inet_sctp6_SCTP_AUTH_KEY(r0, 0x84, 0x17, &(0x7f0000000240)=ANY=[@ANYRES32=0x0, @ANYBLOB="06"], 0x9) setsockopt$inet_sctp6_SCTP_AUTH_ACTIVE_KEY(r0, 0x84, 0x18, &(0x7f0000000280)={0x0, 0x6}, 0x8) 932.01356ms ago: executing program 2 (id=6063): socket$nl_netfilter(0x10, 0x3, 0xc) (async) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) r1 = socket(0x23, 0x5, 0x0) getsockopt$sock_buf(r1, 0x1, 0x1c, 0x0, &(0x7f0000000540)) (async) getsockopt$sock_buf(r1, 0x1, 0x1c, 0x0, &(0x7f0000000540)) r2 = socket$inet6_sctp(0xa, 0x1, 0x84) r3 = socket$inet_sctp(0x2, 0x5, 0x84) getsockopt$inet_sctp_SCTP_MAX_BURST(r3, 0x84, 0xc, &(0x7f0000000580)=@assoc_value={0x0}, &(0x7f00000008c0)=0x8) getsockopt$inet_sctp6_SCTP_ENABLE_STREAM_RESET(r2, 0x84, 0x76, &(0x7f0000000900)={r4, 0x9}, &(0x7f0000000ac0)=0x8) getsockopt$inet_sctp_SCTP_LOCAL_AUTH_CHUNKS(r1, 0x84, 0x1b, &(0x7f0000000b00)={r4, 0x9e, "6a15f61ab825cc37d6b80997363b4eb4370da4f97ccc9d3b1241f223599bbb2dc1018893e39af0999d77bc67e56f69bc802fca0090e3525e1da982ea7af1cd2ca6d53d29fb8fa351d98720dd9ff525205357ff585f0c2a9afeeff0b62f3cfe118f0eb06e0d017c932440b4da2c71d12a3b3b8987567517c953c1b43e7df282bfcb9f6b88251e31265fff2c6a0fcfd935511acb20ec94e3436b3b14fafb5b"}, &(0x7f0000000bc0)=0xa6) sendmsg$NFT_BATCH(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000007c0)={&(0x7f0000000800)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a01020000000000000000010000000900010073797a300000000058000000070a01000000000000000000010000000900010073797a30000000000900020073797a30000000002c00038008000140000000000800024000000000180003803100010076657468305f746f5f687372000000005c000000200a0101000b000000000000010000000900020073797a30000084000900010073797a30"], 0xe8}}, 0x0) syz_80211_inject_frame(&(0x7f0000000000), &(0x7f0000000740)=ANY=[@ANYBLOB="a5491f42bddd71ae1ab97094000000ffffffffffffc05cc61d3a389a7d2d4ff3a3fb06d9dbd832e36d8d43906f8e0f07b6cae915f60e4f01c515d15fd234bcef3e80000056d4e971a381e8e515ba425bb8e1d93f1e8971c50b2972bc83a2721017bd8c372700000000a6d0f52fad9cdfb33cef60efc5"], 0x10) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000004c0)={0x0, 0x0, &(0x7f0000000500)={&(0x7f0000000940)=@gettaction={0x154, 0x32, 0x300, 0x70bd2b, 0x25dfdbff, {}, [@action_gd=@TCA_ACT_TAB={0x7c, 0x1, [{0x10, 0x1a, 0x0, 0x0, @TCA_ACT_KIND={0x9, 0x1, 'csum\x00'}}, {0x10, 0xc, 0x0, 0x0, @TCA_ACT_KIND={0xb, 0x1, 'sample\x00'}}, {0x10, 0x5, 0x0, 0x0, @TCA_ACT_KIND={0x9, 0x1, 'gact\x00'}}, {0x10, 0xb, 0x0, 0x0, @TCA_ACT_KIND={0x9, 0x1, 'vlan\x00'}}, {0x10, 0x17, 0x0, 0x0, @TCA_ACT_KIND={0x9, 0x1, 'vlan\x00'}}, {0xc, 0xf, 0x0, 0x0, @TCA_ACT_KIND={0x7, 0x1, 'xt\x00'}}, {0x10, 0x15, 0x0, 0x0, @TCA_ACT_KIND={0x9, 0x1, 'gact\x00'}}, {0xc, 0x1d, 0x0, 0x0, @TCA_ACT_INDEX={0x8, 0x3, 0x8}}]}, @action_dump_flags=@TCA_ROOT_FLAGS={0xc}, @action_dump_flags=@TCA_ROOT_TIME_DELTA={0x8, 0x4, 0xa698}, @action_gd=@TCA_ACT_TAB={0x28, 0x1, [{0xc, 0x7, 0x0, 0x0, @TCA_ACT_KIND={0x8, 0x1, 'nat\x00'}}, {0xc, 0x17, 0x0, 0x0, @TCA_ACT_INDEX={0x8, 0x3, 0x3}}, {0xc, 0x6, 0x0, 0x0, @TCA_ACT_INDEX={0x8, 0x3, 0x1}}]}, @action_gd=@TCA_ACT_TAB={0x6c, 0x1, [{0xc, 0xb, 0x0, 0x0, @TCA_ACT_INDEX={0x8, 0x3, 0x7}}, {0xc, 0xb, 0x0, 0x0, @TCA_ACT_KIND={0x8, 0x1, 'ife\x00'}}, {0x14, 0x12, 0x0, 0x0, @TCA_ACT_KIND={0xd, 0x1, 'connmark\x00'}}, {0x14, 0x2, 0x0, 0x0, @TCA_ACT_KIND={0xf, 0x1, 'tunnel_key\x00'}}, {0xc, 0x4, 0x0, 0x0, @TCA_ACT_INDEX={0x8, 0x3, 0x6df}}, {0xc, 0x16, 0x0, 0x0, @TCA_ACT_KIND={0x7, 0x1, 'xt\x00'}}, {0x10, 0x0, 0x0, 0x0, @TCA_ACT_KIND={0xb, 0x1, 'mirred\x00'}}]}, @action_dump_flags=@TCA_ROOT_TIME_DELTA={0x8, 0x4, 0x200}, @action_gd=@TCA_ACT_TAB={0x14, 0x1, [{0x10, 0x1c, 0x0, 0x0, @TCA_ACT_KIND={0x9, 0x1, 'gact\x00'}}]}]}, 0x154}, 0x1, 0x0, 0x0, 0x4}, 0x0) (async) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000004c0)={0x0, 0x0, &(0x7f0000000500)={&(0x7f0000000940)=@gettaction={0x154, 0x32, 0x300, 0x70bd2b, 0x25dfdbff, {}, [@action_gd=@TCA_ACT_TAB={0x7c, 0x1, [{0x10, 0x1a, 0x0, 0x0, @TCA_ACT_KIND={0x9, 0x1, 'csum\x00'}}, {0x10, 0xc, 0x0, 0x0, @TCA_ACT_KIND={0xb, 0x1, 'sample\x00'}}, {0x10, 0x5, 0x0, 0x0, @TCA_ACT_KIND={0x9, 0x1, 'gact\x00'}}, {0x10, 0xb, 0x0, 0x0, @TCA_ACT_KIND={0x9, 0x1, 'vlan\x00'}}, {0x10, 0x17, 0x0, 0x0, @TCA_ACT_KIND={0x9, 0x1, 'vlan\x00'}}, {0xc, 0xf, 0x0, 0x0, @TCA_ACT_KIND={0x7, 0x1, 'xt\x00'}}, {0x10, 0x15, 0x0, 0x0, @TCA_ACT_KIND={0x9, 0x1, 'gact\x00'}}, {0xc, 0x1d, 0x0, 0x0, @TCA_ACT_INDEX={0x8, 0x3, 0x8}}]}, @action_dump_flags=@TCA_ROOT_FLAGS={0xc}, @action_dump_flags=@TCA_ROOT_TIME_DELTA={0x8, 0x4, 0xa698}, @action_gd=@TCA_ACT_TAB={0x28, 0x1, [{0xc, 0x7, 0x0, 0x0, @TCA_ACT_KIND={0x8, 0x1, 'nat\x00'}}, {0xc, 0x17, 0x0, 0x0, @TCA_ACT_INDEX={0x8, 0x3, 0x3}}, {0xc, 0x6, 0x0, 0x0, @TCA_ACT_INDEX={0x8, 0x3, 0x1}}]}, @action_gd=@TCA_ACT_TAB={0x6c, 0x1, [{0xc, 0xb, 0x0, 0x0, @TCA_ACT_INDEX={0x8, 0x3, 0x7}}, {0xc, 0xb, 0x0, 0x0, @TCA_ACT_KIND={0x8, 0x1, 'ife\x00'}}, {0x14, 0x12, 0x0, 0x0, @TCA_ACT_KIND={0xd, 0x1, 'connmark\x00'}}, {0x14, 0x2, 0x0, 0x0, @TCA_ACT_KIND={0xf, 0x1, 'tunnel_key\x00'}}, {0xc, 0x4, 0x0, 0x0, @TCA_ACT_INDEX={0x8, 0x3, 0x6df}}, {0xc, 0x16, 0x0, 0x0, @TCA_ACT_KIND={0x7, 0x1, 'xt\x00'}}, {0x10, 0x0, 0x0, 0x0, @TCA_ACT_KIND={0xb, 0x1, 'mirred\x00'}}]}, @action_dump_flags=@TCA_ROOT_TIME_DELTA={0x8, 0x4, 0x200}, @action_gd=@TCA_ACT_TAB={0x14, 0x1, [{0x10, 0x1c, 0x0, 0x0, @TCA_ACT_KIND={0x9, 0x1, 'gact\x00'}}]}]}, 0x154}, 0x1, 0x0, 0x0, 0x4}, 0x0) sendmsg$ETHTOOL_MSG_LINKMODES_SET(0xffffffffffffffff, &(0x7f00000005c0)={0x0, 0x0, &(0x7f0000000600)={&(0x7f0000000640)=ANY=[@ANYBLOB='D\x00\x00\x00', @ANYRES16, @ANYBLOB="0100000000000000000005000000180001801400020073797a5f74756e000000080000000000180003"], 0x44}}, 0x0) (async) sendmsg$ETHTOOL_MSG_LINKMODES_SET(0xffffffffffffffff, &(0x7f00000005c0)={0x0, 0x0, &(0x7f0000000600)={&(0x7f0000000640)=ANY=[@ANYBLOB='D\x00\x00\x00', @ANYRES16, @ANYBLOB="0100000000000000000005000000180001801400020073797a5f74756e000000080000000000180003"], 0x44}}, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) (async) r5 = socket$nl_netfilter(0x10, 0x3, 0xc) close(r5) socket$nl_netfilter(0x10, 0x3, 0xc) (async) r6 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r6, &(0x7f0000000e40)={0x0, 0x0, &(0x7f0000000e80)={&(0x7f0000000ec0)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x0) (async) sendmsg$NFT_BATCH(r6, &(0x7f0000000e40)={0x0, 0x0, &(0x7f0000000e80)={&(0x7f0000000ec0)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x0) sendmsg$NFT_BATCH(r6, &(0x7f0000000f40)={0x0, 0x0, &(0x7f0000000f80)={&(0x7f0000000c00)=ANY=[@ANYBLOB="1400000010007c0000000000006000000500000a3c000000090a010400000000000000000a0000040900010073797a310000000008000540000000010900020073797a310000000008000a40fffffffc400000000c0a010100000000000000000a0000060900020073797a31000000000900010073797a310000000014000380100000800c00018005000100d1000000140000001100010000000000000000000100000aca20cbbdb89f4663e0a3fa9879cb86e461294bfbb400941e39449baaa350ec2f45cdbc372358870c71301ed16c30dfa649b7fecf06c2c857222ba6cec1cef444edae8b6b52a44dfe1d77afa31d0c719e34763363ba3c960dbaeb5f6adf8e497959146c1e74da55897fe348e8008444129a9738e836fb9e850638392e74736330f16a10b9e5def9f6559ce118d65696807e7a7bdcefbd6a6b19af6c0aa435f27a081170d8386dbdf0ee463928ed7375760656f8c448c2f9e6243ac992fbe6e04cb8b692b67a58171d831004c238e600baf43dfa6a91aade29edaf26c913b172f6af14cdaee5272be99b4f1a600e3473a411c2726e8cee06b47816526e2323d223f77f95797f09e65e603623"], 0xa4}}, 0x40) sendmsg$NFT_BATCH(r5, &(0x7f0000001080)={0x0, 0x0, &(0x7f00000010c0)={&(0x7f0000001100)=ANY=[@ANYBLOB="1400000010007b0000000000000000000500000a480000001e0a010100000000000000000a0000060900020073797a31000000000900010073797a31"], 0x70}, 0x1, 0x0, 0x0, 0x4451099e661a63b1}, 0x0) syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10) (async) r7 = syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10) sendmsg$netlink(r7, &(0x7f0000000680)={0x0, 0x0, &(0x7f00000006c0)=[{&(0x7f0000000700)=ANY=[@ANYBLOB="180100002000010000000000fcdbdf2506"], 0x118}], 0x1, 0x0, 0x0, 0x20008001}, 0x0) (async) sendmsg$netlink(r7, &(0x7f0000000680)={0x0, 0x0, &(0x7f00000006c0)=[{&(0x7f0000000700)=ANY=[@ANYBLOB="180100002000010000000000fcdbdf2506"], 0x118}], 0x1, 0x0, 0x0, 0x20008001}, 0x0) socket$inet6_sctp(0xa, 0x5, 0x84) (async) r8 = socket$inet6_sctp(0xa, 0x5, 0x84) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r8, 0x84, 0x6f, &(0x7f0000000080)={0x0, 0x10, &(0x7f00000000c0)=[@in={0x2, 0x0, @private=0xa010101}]}, &(0x7f0000000100)=0x10) syz_80211_inject_frame(&(0x7f0000000140)=@device_b, 0x0, 0x0) clock_gettime(0x0, &(0x7f0000000180)={0x0, 0x0}) nanosleep(&(0x7f00000001c0)={r9, r10+60000000}, 0x0) r11 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r11, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000400)={&(0x7f0000000440)=ANY=[@ANYBLOB="680000003f000100000000000000000003010000000000002600010000112233445566778899aabb0802450000140000000001170000010203040506070800000c0002000600061408000000100003"], 0x68}}, 0x0) syz_80211_inject_frame(&(0x7f0000000200)=@broadcast, 0x0, 0x0) clock_gettime(0x0, &(0x7f0000000240)={0x0, 0x0}) nanosleep(&(0x7f0000000280)={r12, r13+10000000}, 0x0) 847.025755ms ago: executing program 0 (id=6064): r0 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={0x0, 0x3c}}, 0x0) ioctl$sock_ifreq(r0, 0x8910, &(0x7f0000000180)={'veth0_vlan\x00', @ifru_ivalue=0x4}) ioctl$sock_netdev_private(r0, 0x89ef, &(0x7f00000001c0)) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000080)={0x10, 0x4, &(0x7f0000000480)=ANY=[@ANYRESDEC=r0], &(0x7f0000000040)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x9}, 0x94) 844.030661ms ago: executing program 3 (id=5965): ioctl$ifreq_SIOCGIFINDEX_wireguard(0xffffffffffffffff, 0x8933, &(0x7f0000000000)={'wg1\x00', 0x0}) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$batadv(&(0x7f0000000140), r1) sendmsg$BATADV_CMD_GET_NEIGHBORS(r1, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000280)={&(0x7f00000002c0)={0x14, r2, 0x331, 0x70bd2c, 0x25dfdbfb, {0xb}}, 0x14}, 0x1, 0x0, 0x0, 0x4008010}, 0xc0) bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x1d, 0x13, &(0x7f0000000040)=ANY=[@ANYBLOB="18020000000000000000000000000000180100002020702500000000002020207baaf8ff00000000bda106000000000047010000f8ffffffb702000008000000b70300000040000085000000050000001801000020696c250000000000202021db1af8ff51000000bda102000000000007010000f8ffffffb702000008000000b703000000000000850000007b00000095"], &(0x7f0000000100)='syzkaller\x00', 0xa, 0x0, 0x0, 0x0, 0x0, '\x00', r0, @lsm, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) ioctl$ifreq_SIOCGIFINDEX_wireguard(0xffffffffffffffff, 0x8933, &(0x7f0000000000)={'wg1\x00'}) (async) socket$nl_generic(0x10, 0x3, 0x10) (async) syz_genetlink_get_family_id$batadv(&(0x7f0000000140), r1) (async) sendmsg$BATADV_CMD_GET_NEIGHBORS(r1, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000280)={&(0x7f00000002c0)={0x14, r2, 0x331, 0x70bd2c, 0x25dfdbfb, {0xb}}, 0x14}, 0x1, 0x0, 0x0, 0x4008010}, 0xc0) (async) bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x1d, 0x13, &(0x7f0000000040)=ANY=[@ANYBLOB="18020000000000000000000000000000180100002020702500000000002020207baaf8ff00000000bda106000000000047010000f8ffffffb702000008000000b70300000040000085000000050000001801000020696c250000000000202021db1af8ff51000000bda102000000000007010000f8ffffffb702000008000000b703000000000000850000007b00000095"], &(0x7f0000000100)='syzkaller\x00', 0xa, 0x0, 0x0, 0x0, 0x0, '\x00', r0, @lsm, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) (async) 592.46717ms ago: executing program 0 (id=6065): r0 = socket$nl_generic(0x10, 0x3, 0x10) (async) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$L2TP_CMD_SESSION_GET(r0, &(0x7f0000000100)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x20}, 0xc, &(0x7f00000000c0)={&(0x7f0000000080)={0x30, r1, 0x8, 0x70bd27, 0x25dfdbfe, {}, [@L2TP_ATTR_L2SPEC_LEN={0x5, 0x6, 0xa}, @L2TP_ATTR_PW_TYPE={0x6, 0x1, 0xb}, @L2TP_ATTR_RECV_TIMEOUT={0xc}]}, 0x30}, 0x1, 0x0, 0x0, 0x42}, 0x4000810) (async) r2 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000180), r0) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f00000001c0)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_REGISTER_FRAME(r0, &(0x7f0000000380)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x40000000}, 0xc, &(0x7f0000000340)={&(0x7f0000000200)={0x124, r2, 0x300, 0x70bd2c, 0x25dfdbfb, {{}, {@val={0x8, 0x3, r3}, @void}}, [@NL80211_ATTR_FRAME_MATCH={0x7b, 0x5b, "00cc82a8f2a67c8f1e8620b390898915c55a7ead6af76aa5bbdf06540d86f0e71a66027e9e12498fad080b2c9c25ce1ff2a2adca88deb5fcfba47af305f0e42035316ac84426c939375b476de4e782f8bb0a597dd9afa0c096c4704c6c60f8284c03ed8d5ab822c1b193ea456f65fa3f363a4ae52d88bf"}, @NL80211_ATTR_FRAME_MATCH={0x12, 0x5b, "48a0fec8e305a589ab21380bec32"}, @NL80211_ATTR_FRAME_MATCH={0x66, 0x5b, "77cc8e845a723aa9230193b8c6bad07f28ac8dfab3e474149690904afb2bb15d441307d043d11970d0154d40eaa2a89503dedb7ef0f2602c637cac39aa5da82c1a4f41cbc876d21ec89c79e15413082b2c7ee00152039a2510967a39ac0c8fdca4ae"}, @NL80211_ATTR_FRAME_TYPE={0x6, 0x65, 0xc}, @NL80211_ATTR_FRAME_TYPE={0x6, 0x65, 0xa}]}, 0x124}, 0x1, 0x0, 0x0, 0x8000}, 0x20044800) (async) r4 = socket$nl_generic(0x10, 0x3, 0x10) r5 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000400), r0) sendmsg$NL80211_CMD_GET_FTM_RESPONDER_STATS(r4, &(0x7f00000004c0)={&(0x7f00000003c0)={0x10, 0x0, 0x0, 0x4000}, 0xc, &(0x7f0000000480)={&(0x7f0000000440)={0x20, r5, 0x4, 0x70bd26, 0x25dfdbff, {{}, {@void, @val={0xc, 0x99, {0xd907, 0x74}}}}, [""]}, 0x20}, 0x1, 0x0, 0x0, 0x10}, 0x8804) (async) ioctl$XFS_IOC_PATH_TO_HANDLE(r0, 0xc0385869, &(0x7f0000000600)={0xffffffffffffffff, &(0x7f0000000500)='\\+\'^@\x8e\x00', 0x88000, &(0x7f0000000540)={@_ha_fsid={[0x1, 0x1]}, {0x2, 0x6, 0x8, 0x8000000000000000}}, 0x1ff, &(0x7f0000000580)={@_ha_fsid}, &(0x7f00000005c0)=0x40}) ioctl$BTRFS_IOC_QUOTA_CTL(r6, 0xc0109428, &(0x7f0000000640)={0x3, 0xd3a9}) (async) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(0xffffffffffffffff, 0x89f1, &(0x7f0000000980)={'gre0\x00', &(0x7f0000000900)={'ip_vti0\x00', 0x0, 0x7, 0x7, 0x283, 0x5, {{0xa, 0x4, 0x0, 0x1b, 0x28, 0x68, 0x0, 0x6, 0x4, 0x0, @initdev={0xac, 0x1e, 0x1, 0x0}, @empty, {[@end, @ra={0x94, 0x4}, @noop, @end, @generic={0x86, 0xc, "dff8a8375ce6572a422b"}]}}}}}) (async) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(r6, 0x89f0, &(0x7f0000000a80)={'ip_vti0\x00', &(0x7f00000009c0)={'syztnl2\x00', 0x0, 0x10, 0x7, 0x2, 0x5, {{0x1e, 0x4, 0x2, 0x31, 0x78, 0x64, 0x0, 0x0, 0x4, 0x0, @local, @rand_addr=0x64010101, {[@cipso={0x86, 0x64, 0x2, [{0x6, 0x12, "2699e7e663b22f3446e7f590381d8016"}, {0x6, 0x6, "54a5f7c3"}, {0x0, 0x2}, {0x1, 0x11, "53349c3fe9949650c4a3fe990e4fae"}, {0x7, 0x12, "62195b03094fcced237198a36ebfcefa"}, {0x7, 0xf, "ae551a75071c7dac1011a413db"}, {0x7, 0x12, "89daaea6bef6ed7d05d271de1ef45f80"}]}]}}}}}) sendmmsg$inet(r0, &(0x7f0000000b80)=[{{&(0x7f0000000680)={0x2, 0x4e23, @multicast2}, 0x10, &(0x7f00000006c0), 0x0, &(0x7f0000000700)=[@ip_tos_int={{0x14, 0x0, 0x1, 0x5}}, @ip_ttl={{0x14, 0x0, 0x2, 0x1}}, @ip_retopts={{0x60, 0x0, 0x7, {[@noop, @generic={0x44, 0xe, "f20304cf68fa6e8dcabf1dc7"}, @ra={0x94, 0x4, 0x1}, @timestamp_prespec={0x44, 0x3c, 0xe7, 0x3, 0x0, [{@multicast1, 0x5}, {@dev={0xac, 0x14, 0x14, 0x40}, 0x4}, {@dev={0xac, 0x14, 0x14, 0x34}, 0x8}, {@rand_addr=0x64010101, 0x2}, {@multicast1, 0xe2c6cc63}, {@initdev={0xac, 0x1e, 0x0, 0x0}, 0x5}, {@dev={0xac, 0x14, 0x14, 0x15}, 0x4}]}]}}}], 0x90}}, {{0x0, 0x0, &(0x7f00000008c0)=[{&(0x7f00000007c0)="32c5070b85ce0cc67a1cea436cdcc097f563f04b2667f308170207e858ce3881d90a9e925dfbad47e1fbb9a38d0d25fe77bc8a58719ffddb887764defde03ccf43a42aafd4ccbbb73133cf29644628d1fef32d5000b22acc5ac538d89e505ff52320a373f53179773baf1b69b64ebd23421bbc3aa80e595161eacf7f8c289ac11afcf145130828ec03a183b4216a1faede7285e332dbbdcc7ba187c30b07ab1330cf04a7d68fab5cde0976d2bfde26da27ec0f3311112d59a9ba784b", 0xbc}, {&(0x7f0000000880)}], 0x2, &(0x7f0000000ac0)=[@ip_pktinfo={{0x1c, 0x0, 0x8, {r7, @multicast2, @loopback}}}, @ip_tos_u8={{0x11, 0x0, 0x1, 0xb2}}, @ip_tos_u8={{0x11, 0x0, 0x1, 0xfe}}, @ip_pktinfo={{0x1c, 0x0, 0x8, {r8, @local, @loopback}}}, @ip_tos_u8={{0x11, 0x0, 0x1, 0x9}}, @ip_ttl={{0x14, 0x0, 0x2, 0x4}}], 0xa0}}], 0x2, 0x20000000) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000c40)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_DEAUTHENTICATE(r0, &(0x7f0000000d80)={&(0x7f0000000c00)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f0000000d40)={&(0x7f0000000c80)={0xa4, 0x0, 0x800, 0x70bd25, 0x25dfdbfb, {{}, {@val={0x8, 0x3, r9}, @void}}, [@NL80211_ATTR_SSID={0xa, 0x34, @default_ibss_ssid}, @NL80211_ATTR_LOCAL_STATE_CHANGE={0x4}, @NL80211_ATTR_SSID={0x1f, 0x34, @random="d560753639f92ce9e30de54f96a0e533d74a56806a38f9c2acd752"}, @NL80211_ATTR_SSID={0xa, 0x34, @default_ibss_ssid}, @NL80211_ATTR_IE={0x3e, 0x2a, [@peer_mgmt={0x75, 0x8, {0x1, 0x7ba, @val=0xfff8, @val=0x31, @void}}, @ht={0x2d, 0x1a, {0x2, 0x1, 0x6, 0x0, {0x7, 0x2, 0x0, 0x100, 0x0, 0x1, 0x0, 0x1, 0x1}, 0x9, 0x2, 0x5}}, @link_id={0x65, 0x12, {@initial, @device_b, @broadcast}}]}, @NL80211_ATTR_SSID={0xa, 0x34, @default_ibss_ssid}]}, 0xa4}, 0x1, 0x0, 0x0, 0x4008840}, 0x0) (async) clock_gettime(0x0, &(0x7f0000000dc0)={0x0, 0x0}) nanosleep(&(0x7f0000000e00)={r10, r11+60000000}, 0x0) setsockopt$inet_tcp_TCP_CONGESTION(r6, 0x6, 0xd, &(0x7f0000000e40)='cubic', 0x5) (async) getsockopt$inet_IP_XFRM_POLICY(r6, 0x0, 0x11, &(0x7f0000000ec0)={{{@in6=@mcast2, @in6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@private}, 0x0, @in=@multicast2}}, &(0x7f0000000fc0)=0xe8) sendmsg$nl_xfrm(r6, &(0x7f00000010c0)={&(0x7f0000000e80)={0x10, 0x0, 0x0, 0x800}, 0xc, &(0x7f0000001080)={&(0x7f0000001000)=@delpolicy={0x68, 0x14, 0x20, 0x70bd26, 0x25dfdbfe, {{@in6=@private0, @in6=@ipv4={'\x00', '\xff\xff', @local}, 0x4e21, 0x4c4, 0x4e20, 0xe1b, 0x2, 0x0, 0x80, 0x1, 0x0, r12}, 0x6e6bb2}, [@srcaddr={0x14, 0xd, @in6=@mcast1}, @iptfs_dont_frag={0x4}]}, 0x68}, 0x1, 0x0, 0x0, 0x90}, 0x2000) socket$nl_generic(0x10, 0x3, 0x10) (async) r13 = openat$tun(0xffffffffffffff9c, &(0x7f0000001100), 0x446040, 0x0) ioctl$SIOCSIFHWADDR(r13, 0x8924, &(0x7f0000001140)={'veth1_macvtap\x00'}) (async) sendmsg$NL80211_CMD_UNEXPECTED_FRAME(r13, &(0x7f0000001240)={&(0x7f0000001180)={0x10, 0x0, 0x0, 0x2000}, 0xc, &(0x7f0000001200)={&(0x7f00000011c0)={0x20, r2, 0x200, 0x8, 0x25dfdbff, {{}, {@void, @val={0xc, 0x99, {0x10000, 0xf}}}}, [""]}, 0x20}, 0x1, 0x0, 0x0, 0x4000800}, 0x8010) r14 = socket(0x2, 0x2, 0x8c4c) ioctl$XFS_IOC_SCRUBV_METADATA(r14, 0xc0285840, &(0x7f00000012c0)={0x46d0, 0xb, 0x80000000, 0x0, 0x1ff, 0x2, 0x0, &(0x7f0000001280)=[{0x3, 0x101, 0xfffffff7}, {0x16, 0x1ff, 0x5}]}) (async) sendmsg$AUDIT_USER(r14, &(0x7f0000001480)={&(0x7f0000001300)={0x10, 0x0, 0x0, 0x20000}, 0xc, &(0x7f0000001440)={&(0x7f0000001340)={0xd8, 0x3ed, 0x100, 0x70bd2b, 0x25dfdbfe, "cc1dc5939cd09af52b47fcea1a4022a406755d644651c8dc1aa40336f787eb61d9e9d9062374e838fbb6b686048584acefc58ee74babb3c004df4671caf2a0144815e7739ea9f62de87c58b23a0f293c58aa9ce17277729f0aac680a5623713c77783e0b4b1c4fcb41f64151eaa01cf4044bfce016a5ab028e3d301b0847280dac76f5cdf0bf770738a20a1c6df8ca5422fcb589dea53bc816f553fcb728468254234da691c5fa8931727815d4e824a9c2f787745417655880863b4c7172aa5921553a61e69d", [""]}, 0xd8}, 0x1, 0x0, 0x0, 0x4000}, 0x20040040) connect$802154_dgram(r14, &(0x7f00000014c0)={0x24, @none={0x0, 0xffff}}, 0x14) (async) bind(r4, &(0x7f0000001500)=@phonet={0x23, 0xc0, 0x7f, 0xf}, 0x80) 578.509561ms ago: executing program 3 (id=6066): bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000040)={0x1a, 0x4, &(0x7f0000000180)=@framed={{0x18, 0x2, 0x0, 0x0, 0xb2b3, 0x0, 0x0, 0x0, 0x18}, [@kfunc={0x85, 0x0, 0x2, 0x0, 0x351ec}]}, &(0x7f00000001c0)='GPL\x00', 0x8, 0x0, 0x0, 0x40f00, 0x40, '\x00', 0x0, 0x3d}, 0x94) r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000240)=ANY=[@ANYBLOB="380000006c0015000000d9fece23b82000000000", @ANYRES32=r0, @ANYBLOB="000080000000000018003480050035"], 0x38}, 0x1, 0x300}, 0x0) sendmsg$nl_route(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000240)=ANY=[@ANYBLOB="380000c36d"], 0x38}, 0x1, 0x300}, 0x0) 216.325872ms ago: executing program 3 (id=6067): socket$nl_generic(0x10, 0x3, 0x10) (async) r0 = socket$nl_generic(0x10, 0x3, 0x10) epoll_create1(0x0) (async) r1 = epoll_create1(0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f0000000040)=@file={0x0, './file0\x00'}, 0x6e) (async) connect$unix(r2, &(0x7f0000000040)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r3, &(0x7f00000000c0), 0x318, 0x0) (async) sendmmsg$unix(r3, &(0x7f00000000c0), 0x318, 0x0) recvmmsg(r2, &(0x7f0000000100), 0x10106, 0x2, 0x0) (async) recvmmsg(r2, &(0x7f0000000100), 0x10106, 0x2, 0x0) r4 = epoll_create1(0x0) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r3, &(0x7f0000000140)={0x20000014}) syz_init_net_socket$bt_bnep(0x1f, 0x3, 0x4) socket$inet_udp(0x2, 0x2, 0x0) socket$nl_route(0x10, 0x3, 0x0) (async) socket$nl_route(0x10, 0x3, 0x0) r5 = socket$can_bcm(0x1d, 0x2, 0x2) r6 = socket$can_bcm(0x1d, 0x2, 0x2) ioctl$ifreq_SIOCGIFINDEX_vcan(r6, 0x8933, &(0x7f00000000c0)={'vcan0\x00'}) (async) ioctl$ifreq_SIOCGIFINDEX_vcan(r6, 0x8933, &(0x7f00000000c0)={'vcan0\x00', 0x0}) connect$can_bcm(r5, &(0x7f0000000100)={0x1d, r7}, 0x10) sendmsg$can_bcm(r5, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000280)={&(0x7f00000002c0)=ANY=[@ANYBLOB="05"], 0x48}}, 0x0) sendmsg$can_bcm(r5, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000380)=ANY=[@ANYBLOB="050000000109"], 0x80}}, 0x0) sendmsg$can_bcm(r5, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000400)={&(0x7f0000000440)=ANY=[@ANYRES16=r5], 0x48}}, 0x40800) epoll_ctl$EPOLL_CTL_ADD(r4, 0x1, r1, &(0x7f0000000180)={0xa0000001}) ppoll(&(0x7f00000001c0)=[{r4, 0x1}], 0x1, 0x0, 0x0, 0x0) epoll_wait(r4, &(0x7f0000000200)=[{}], 0x1, 0xffffffff) r8 = syz_genetlink_get_family_id$fou(&(0x7f0000002b40), 0xffffffffffffffff) sendmsg$FOU_CMD_ADD(r0, &(0x7f0000002c00)={0x0, 0x100000, &(0x7f0000002bc0)={&(0x7f0000002b80)=ANY=[@ANYBLOB='8\x00\x00\x00', @ANYRES16=r8, @ANYBLOB="220000000000000000000100000006000a004e22007650b2b59a4800050002000a00000014000900"/50], 0x38}}, 0x0) 184.496622ms ago: executing program 4 (id=6068): bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000240), 0x50) bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f00000007c0)={0x1b, 0x0, 0x0, 0x40000, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0}, 0x50) bpf$PROG_LOAD(0x5, &(0x7f0000000840)={0x18, 0x1c, &(0x7f0000000d80)=ANY=[], &(0x7f0000000980)='GPL\x00', 0x2, 0x0, 0x0, 0x0, 0x9, '\x00', 0x0, @fallback=0xd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) 58.214437ms ago: executing program 1 (id=6069): socket$nl_route(0x10, 0x3, 0x0) (async) socket$nl_route(0x10, 0x3, 0x0) socket$nl_route(0x10, 0x3, 0x0) openat$tun(0xffffffffffffff9c, &(0x7f00000003c0), 0x0, 0x0) pipe(&(0x7f0000000400)) (async) pipe(&(0x7f0000000400)) r0 = socket$nl_rdma(0x10, 0x3, 0x14) sendmsg$RDMA_NLDEV_CMD_SET(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000080)={0x20, 0x1402, 0x1, 0x70bd2a, 0x25dfdc02, "", [@RDMA_NLDEV_ATTR_DEV_INDEX={0x8}, @RDMA_NLDEV_ATTR_DEV_DIM={0x5}]}, 0x20}, 0x1, 0x0, 0x0, 0x4000801}, 0x40810) socket$tipc(0x1e, 0x5, 0x0) bpf$MAP_CREATE_CONST_STR(0x0, 0x0, 0x0) (async) bpf$MAP_CREATE_CONST_STR(0x0, 0x0, 0x0) bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f0000000440)=ANY=[@ANYBLOB="1b00000000000000000000000000040000ed", @ANYRES32=0x0, @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB='\x00'/11], 0x48) (async) bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f0000000440)=ANY=[@ANYBLOB="1b00000000000000000000000000040000ed", @ANYRES32=0x0, @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB='\x00'/11], 0x48) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000480), 0xffffffffffffffff) socket$inet6(0xa, 0x3, 0xff) (async) r3 = socket$inet6(0xa, 0x3, 0xff) setsockopt$IP6T_SO_SET_REPLACE(r3, 0x29, 0x40, &(0x7f00000004c0)=@filter={'filter\x00', 0xe, 0x4, 0x340, 0xffffffff, 0x0, 0xd0, 0x1a0, 0xffffffff, 0xffffffff, 0x0, 0xd0, 0x2a0, 0xffffffff, 0x4, 0x0, {[{{@uncond, 0x0, 0xa8, 0xd0}, @common=@unspec=@STANDARD={0x28, '\x00', 0x0, 0xfffffffe}}, {{@uncond, 0x0, 0xa8, 0xd0}, @common=@unspec=@STANDARD={0x28, '\x00', 0x0, 0xfffffffe}}, {{@ipv6={@empty, @empty, [], [], '\x00', '\x00', {}, {}, 0x6, 0x0, 0x1}, 0x0, 0xa8, 0xd0}, @common=@inet=@TCPMSS={0x28, 'TCPMSS\x00', 0x0, {0x578}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x3a0) r4 = socket$inet6(0xa, 0x3, 0x3c) writev(r4, &(0x7f0000000880)=[{&(0x7f00000008c0)="06c3", 0x2}, {&(0x7f0000000900)}, {&(0x7f0000000f00)="4c7911315ed07e13be5391e38b57247dcbfa424aaec74724dd2da16f11eb", 0x1e}], 0x3) (async) writev(r4, &(0x7f0000000880)=[{&(0x7f00000008c0)="06c3", 0x2}, {&(0x7f0000000900)}, {&(0x7f0000000f00)="4c7911315ed07e13be5391e38b57247dcbfa424aaec74724dd2da16f11eb", 0x1e}], 0x3) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f0000000f40)={'wlan0\x00', 0x0}) socket$inet(0x2, 0x2, 0x0) (async) r6 = socket$inet(0x2, 0x2, 0x0) ioctl$sock_inet_SIOCSIFFLAGS(r6, 0x8914, &(0x7f0000000f80)={'bond0\x00'}) (async) ioctl$sock_inet_SIOCSIFFLAGS(r6, 0x8914, &(0x7f0000000f80)={'bond0\x00'}) sendmsg$NL80211_CMD_SET_INTERFACE(r1, &(0x7f0000000fc0)={0x0, 0x0, &(0x7f0000001000)={&(0x7f0000001040)={0x24, r2, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r5}, @void}}, [@NL80211_ATTR_IFTYPE={0x8, 0x5, 0x7}]}, 0x24}}, 0x0) ioctl$sock_inet_SIOCSIFFLAGS(r6, 0x8914, &(0x7f0000001080)={'wlan0\x00', 0x1}) (async) ioctl$sock_inet_SIOCSIFFLAGS(r6, 0x8914, &(0x7f0000001080)={'wlan0\x00', 0x1}) sendmsg$NL80211_CMD_JOIN_MESH(r1, &(0x7f00000010c0)={0x0, 0x0, &(0x7f0000001100)={&(0x7f0000001140)={0x28, r2, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r5}, @void}}, [@NL80211_ATTR_MESH_ID={0xa}]}, 0x28}}, 0x0) sendmsg$NL80211_CMD_NEW_STATION(r1, &(0x7f0000001180)={0x0, 0x0, &(0x7f00000011c0)={&(0x7f0000001200)={0x3c, r2, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r5}, @void}}, [@NL80211_ATTR_MAC={0xa, 0x6, @device_b}, @NL80211_ATTR_STA_AID={0x6, 0x10, 0x1}, @NL80211_ATTR_STA_LISTEN_INTERVAL={0x6, 0x12, 0x1}, @NL80211_ATTR_STA_SUPPORTED_RATES={0x4}]}, 0x3c}}, 0x0) sendmsg$NL80211_CMD_NEW_MPATH(r1, &(0x7f0000001240)={0x0, 0x0, &(0x7f0000001280)={&(0x7f00000012c0)={0x34, r2, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r5}, @void}}, [@NL80211_ATTR_MPATH_NEXT_HOP={0xa, 0x1a, @device_b}, @NL80211_ATTR_MAC={0xa, 0x6, @device_b}]}, 0x34}}, 0x0) r7 = socket$packet(0x11, 0x3, 0x300) bind$packet(r7, &(0x7f0000001300)={0x11, 0x300, r5, 0x1, 0x0, 0x6, @random="080211000001"}, 0x14) write(r7, &(0x7f0000001340)="0802110000010802110000000800450000280000", 0x14) (async) write(r7, &(0x7f0000001340)="0802110000010802110000000800450000280000", 0x14) sendmsg$NL80211_CMD_DEL_INTERFACE(r1, &(0x7f0000001380)={0x0, 0x0, &(0x7f00000013c0)={&(0x7f0000001400)={0x1c, r2, 0x5, 0x0, 0x0, {{}, {@val={0x5, 0x3, r5}, @void}}}, 0x1c}}, 0x0) socket$nl_route(0x10, 0x3, 0x0) pipe(0x0) socket$nl_generic(0x10, 0x3, 0x10) 0s ago: executing program 4 (id=6070): r0 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl80211(&(0x7f0000000040), 0xffffffffffffffff) (async) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000040), 0xffffffffffffffff) r2 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000080)={'wlan0\x00'}) (async) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000080)={'wlan0\x00', 0x0}) r4 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL80211_CMD_FRAME(r4, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000140)={0x1c, r1, 0x1, 0x0, 0x0, {{}, {@val={0x8, 0x3, r3}, @void}}}, 0x1c}, 0x1, 0x0, 0x0, 0xc0}, 0x0) r5 = socket$nl_generic(0x10, 0x3, 0x10) r6 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000180), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r5, 0x8933, &(0x7f00000001c0)={'wlan0\x00'}) (async) ioctl$sock_SIOCGIFINDEX_80211(r5, 0x8933, &(0x7f00000001c0)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_JOIN_MESH(r5, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000280)={0x34, r6, 0x1, 0x70bd28, 0x25dfdbfb, {{}, {@val={0x8, 0x3, r7}, @void}}, [@NL80211_ATTR_MESH_ID={0xa}, @NL80211_ATTR_MESH_SETUP={0xc, 0x70, [@NL80211_MESH_SETUP_ENABLE_VENDOR_SYNC={0x5}]}]}, 0x34}, 0x1, 0x0, 0x0, 0x85}, 0x4c044) sendmsg$NL80211_CMD_UNEXPECTED_FRAME(r0, &(0x7f0000000340)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x8}, 0xc, &(0x7f0000000300)={&(0x7f00000002c0)={0x28, r1, 0x10, 0x70bd2a, 0x25dfdbfc, {{}, {@val={0x8, 0x3, r7}, @val={0xc, 0x99, {0x2, 0x1c}}}}, ["", "", "", "", "", "", "", "", "", ""]}, 0x28}, 0x1, 0x0, 0x0, 0x4000}, 0x8000) (async) sendmsg$NL80211_CMD_UNEXPECTED_FRAME(r0, &(0x7f0000000340)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x8}, 0xc, &(0x7f0000000300)={&(0x7f00000002c0)={0x28, r1, 0x10, 0x70bd2a, 0x25dfdbfc, {{}, {@val={0x8, 0x3, r7}, @val={0xc, 0x99, {0x2, 0x1c}}}}, ["", "", "", "", "", "", "", "", "", ""]}, 0x28}, 0x1, 0x0, 0x0, 0x4000}, 0x8000) ioctl$sock_SIOCSIFVLAN_DEL_VLAN_CMD(r5, 0x8983, &(0x7f00000003c0)={0x1, 'wlan0\x00', {}, 0x7f}) kernel console output (not intermixed with test programs): ttribute type 32 has an invalid length. [ 663.618650][ T6970] bond0: (slave bond_slave_0): interface is now down [ 663.619270][ T6970] bond0: (slave bond_slave_1): interface is now down [ 663.645030][ T6970] bond0: (slave team0): interface is now down [ 664.004113][T24135] __nla_validate_parse: 246 callbacks suppressed [ 664.004136][T24135] netlink: 268 bytes leftover after parsing attributes in process `syz.1.4668'. [ 664.380481][T24149] openvswitch: netlink: nsh attr 0 has unexpected len 94 expected 0 [ 664.686259][T24161] netlink: 4 bytes leftover after parsing attributes in process `syz.3.4676'. [ 664.808126][T24161] netlink: 4 bytes leftover after parsing attributes in process `syz.3.4676'. [ 665.136997][T24179] netlink: 12 bytes leftover after parsing attributes in process `syz.3.4682'. [ 665.145425][T24179] netlink: 44 bytes leftover after parsing attributes in process `syz.3.4682'. [ 665.569522][T24202] syzkaller1: entered promiscuous mode [ 665.569547][T24202] syzkaller1: entered allmulticast mode [ 665.606620][T24202] netlink: 'syz.4.4690': attribute type 10 has an invalid length. [ 665.612177][T24202] netlink: 'syz.4.4690': attribute type 10 has an invalid length. [ 665.865593][T24217] netlink: 8 bytes leftover after parsing attributes in process `syz.1.4693'. [ 666.147253][ T6970] bond0: (slave bond_slave_0): interface is now down [ 666.147864][ T6970] bond0: (slave bond_slave_1): interface is now down [ 666.148429][ T6970] bond0: (slave team0): interface is now down [ 666.300277][T24202] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 666.319720][T24202] netdevsim netdevsim4 netdevsim1: entered promiscuous mode [ 666.331104][T24202] bond0: (slave netdevsim1): Enslaving as an active interface with a down link [ 666.881197][T24248] netlink: 'syz.4.4701': attribute type 3 has an invalid length. [ 666.881221][T24248] netlink: 244 bytes leftover after parsing attributes in process `syz.4.4701'. [ 666.881835][T24248] netlink: 20 bytes leftover after parsing attributes in process `syz.4.4701'. [ 667.136384][T24260] netlink: 'syz.0.4703': attribute type 4 has an invalid length. [ 667.159696][T24260] netlink: 'syz.0.4703': attribute type 4 has an invalid length. [ 667.225820][T24271] netlink: 28 bytes leftover after parsing attributes in process `syz.1.4704'. [ 667.395400][T24275] netlink: 28 bytes leftover after parsing attributes in process `syz.1.4704'. [ 668.437454][T24325] netlink: 'syz.0.4717': attribute type 28 has an invalid length. [ 668.437478][T24325] netlink: 'syz.0.4717': attribute type 3 has an invalid length. [ 668.554008][T24327] netlink: 'syz.3.4719': attribute type 1 has an invalid length. [ 668.616610][T24327] macvtap1: entered allmulticast mode [ 668.707808][ T6975] bond0: (slave bond_slave_0): interface is now down [ 668.708375][ T6975] bond0: (slave bond_slave_1): interface is now down [ 668.708908][ T6975] bond0: (slave team0): interface is now down [ 669.591509][ T6975] IPVS: starting estimator thread 0... [ 669.684904][T24376] IPVS: using max 28 ests per chain, 67200 per kthread [ 669.790111][T24384] __nla_validate_parse: 9 callbacks suppressed [ 669.790134][T24384] netlink: 48 bytes leftover after parsing attributes in process `syz.0.4735'. [ 670.301329][T24409] netlink: 8 bytes leftover after parsing attributes in process `syz.1.4739'. [ 670.301366][T24409] netlink: 20 bytes leftover after parsing attributes in process `syz.1.4739'. [ 670.352992][T24409] netlink: 8 bytes leftover after parsing attributes in process `syz.1.4739'. [ 670.353027][T24409] netlink: 20 bytes leftover after parsing attributes in process `syz.1.4739'. [ 670.378456][T24416] netlink: 8 bytes leftover after parsing attributes in process `syz.1.4739'. [ 670.378491][T24416] netlink: 20 bytes leftover after parsing attributes in process `syz.1.4739'. [ 670.398576][T24416] netlink: 8 bytes leftover after parsing attributes in process `syz.1.4739'. [ 670.398608][T24416] netlink: 20 bytes leftover after parsing attributes in process `syz.1.4739'. [ 670.442657][ T31] netdevsim netdevsim1 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0 [ 670.443715][ T31] netdevsim netdevsim1 : set [0, 0] type 1 family 0 port 8472 - 0 [ 670.443756][ T31] netdevsim netdevsim1 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0 [ 670.443793][ T31] netdevsim netdevsim1 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0 [ 670.656967][ T6975] bond0: (slave bond_slave_0): link status definitely down, disabling slave [ 670.676094][ T6975] bond0: now running without any active interface! [ 670.678432][T24427] netlink: 'syz.0.4745': attribute type 12 has an invalid length. [ 670.749100][T24427] ÿÿÿÿÿÿ: renamed from virt_wifi0 [ 671.264026][ T62] bond0: (slave bond_slave_0): interface is now down [ 671.264659][ T62] bond0: (slave bond_slave_1): interface is now down [ 671.265264][ T62] bond0: (slave team0): interface is now down [ 671.313410][ T62] bond0: now running without any active interface! [ 671.494247][T24461] netlink: 9 bytes leftover after parsing attributes in process `syz.1.4755'. [ 672.856259][T24528] xfrm2: entered promiscuous mode [ 672.856284][T24528] xfrm2: entered allmulticast mode [ 673.450134][T24563] bridge0: port 2(bridge_slave_1) entered blocking state [ 673.450267][T24563] bridge0: port 2(bridge_slave_1) entered listening state [ 673.450579][T24563] bridge0: port 1(bridge_slave_0) entered blocking state [ 673.450715][T24563] bridge0: port 1(bridge_slave_0) entered listening state [ 673.451827][T24563] bridge0: entered promiscuous mode [ 673.451888][T24563] bridge0: entered allmulticast mode [ 674.017317][T24589] FAULT_INJECTION: forcing a failure. [ 674.017317][T24589] name failslab, interval 1, probability 0, space 0, times 0 [ 674.017361][T24589] CPU: 1 UID: 0 PID: 24589 Comm: syz.0.4788 Not tainted syzkaller #0 PREEMPT(full) [ 674.017386][T24589] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/15/2026 [ 674.017399][T24589] Call Trace: [ 674.017408][T24589] [ 674.017419][T24589] dump_stack_lvl+0xe8/0x150 [ 674.017465][T24589] should_fail_ex+0x3eb/0x540 [ 674.017587][T24589] should_failslab+0xa8/0x100 [ 674.017626][T24589] __kmalloc_noprof+0xf9/0x710 [ 674.017656][T24589] ? tcf_idr_create+0x5d/0x6b0 [ 674.017741][T24589] ? tcf_idr_create+0x5d/0x6b0 [ 674.017771][T24589] tcf_idr_create+0x5d/0x6b0 [ 674.017802][T24589] tcf_idr_create_from_flags+0x60/0x80 [ 674.017837][T24589] tcf_gate_init+0x42b/0x15a0 [ 674.017919][T24589] ? __pfx___nla_validate_parse+0x10/0x10 [ 674.017953][T24589] ? __pfx_tcf_gate_init+0x10/0x10 [ 674.017979][T24589] ? __lock_acquire+0x747/0x2de0 [ 674.018023][T24589] ? __pfx___nla_validate_parse+0x10/0x10 [ 674.018065][T24589] ? __nla_validate_parse+0x2429/0x2d50 [ 674.018107][T24589] ? __nla_parse+0x40/0x60 [ 674.018143][T24589] tcf_action_init_1+0x4ba/0x740 [ 674.018176][T24589] ? __pfx_tcf_action_init_1+0x10/0x10 [ 674.018199][T24589] ? _raw_read_unlock+0x28/0x50 [ 674.018257][T24589] ? tc_action_load_ops+0x247/0x540 [ 674.018308][T24589] ? __nla_parse+0x40/0x60 [ 674.018345][T24589] tcf_action_init+0x31f/0xac0 [ 674.018379][T24589] ? __kernel_text_address+0xd/0x30 [ 674.018425][T24589] ? __pfx_tcf_action_init+0x10/0x10 [ 674.018480][T24589] ? hook_capable+0x1c3/0x5e0 [ 674.018538][T24589] ? __pfx___nla_validate_parse+0x10/0x10 [ 674.018569][T24589] ? hook_capable+0x1c3/0x5e0 [ 674.018590][T24589] ? nlmon_xmit+0xb0/0x100 [ 674.018674][T24589] ? dev_hard_start_xmit+0x2cd/0x830 [ 674.018725][T24589] ? __dev_queue_xmit+0x14d1/0x3920 [ 674.018751][T24589] ? __netlink_deliver_tap+0x4f1/0x6e0 [ 674.018831][T24589] tc_ctl_action+0x44a/0xc80 [ 674.018870][T24589] ? __pfx_tc_ctl_action+0x10/0x10 [ 674.018929][T24589] ? __pfx_hook_capable+0x10/0x10 [ 674.018958][T24589] ? __pfx___mutex_lock+0x10/0x10 [ 674.019008][T24589] ? __pfx_tc_ctl_action+0x10/0x10 [ 674.019033][T24589] rtnetlink_rcv_msg+0x7b9/0xc00 [ 674.019071][T24589] ? rtnetlink_rcv_msg+0x1c9/0xc00 [ 674.019095][T24589] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 674.019123][T24589] ? __copy_skb_header+0xa3/0x4a0 [ 674.019191][T24589] netlink_rcv_skb+0x226/0x4a0 [ 674.019225][T24589] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 674.019252][T24589] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 674.019301][T24589] ? netlink_deliver_tap+0x2e/0x1b0 [ 674.019333][T24589] ? netlink_deliver_tap+0x2e/0x1b0 [ 674.019372][T24589] netlink_unicast+0x8ef/0xa80 [ 674.019423][T24589] netlink_sendmsg+0x7f0/0xb20 [ 674.019464][T24589] ? __pfx_netlink_sendmsg+0x10/0x10 [ 674.019510][T24589] ? aa_sock_msg_perm+0x144/0x210 [ 674.019550][T24589] ? apparmor_socket_sendmsg+0x98/0x360 [ 674.019618][T24589] ? __pfx_netlink_sendmsg+0x10/0x10 [ 674.019650][T24589] sock_sendmsg_nosec+0x14e/0x190 [ 674.019711][T24589] __sys_sendto+0x408/0x5a0 [ 674.019769][T24589] ? ksys_write+0x1e6/0x270 [ 674.019821][T24589] ? __pfx___sys_sendto+0x10/0x10 [ 674.019852][T24589] ? __mutex_unlock_slowpath+0x731/0x900 [ 674.019896][T24589] ? fdget+0x1ac/0x250 [ 674.019979][T24589] ? __pfx_ksys_write+0x10/0x10 [ 674.020016][T24589] __x64_sys_sendto+0xde/0x100 [ 674.020056][T24589] do_syscall_64+0x166/0x520 [ 674.020082][T24589] ? trace_irq_disable+0x3b/0x140 [ 674.020115][T24589] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 674.020140][T24589] ? clear_bhb_loop+0x70/0xc0 [ 674.020169][T24589] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 674.020193][T24589] RIP: 0033:0x7fdc41f9f559 [ 674.020215][T24589] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 674.020235][T24589] RSP: 002b:00007fdc42eb2028 EFLAGS: 00000246 ORIG_RAX: 000000000000002c [ 674.020260][T24589] RAX: ffffffffffffffda RBX: 00007fdc42225fa0 RCX: 00007fdc41f9f559 [ 674.020277][T24589] RDX: 0000000000000068 RSI: 0000200000000140 RDI: 0000000000000003 [ 674.020293][T24589] RBP: 00007fdc42eb2090 R08: 0000000000000000 R09: 0000000000000000 [ 674.020309][T24589] R10: 0000000004000104 R11: 0000000000000246 R12: 0000000000000001 [ 674.020325][T24589] R13: 00007fdc42226038 R14: 00007fdc42225fa0 R15: 00007ffff01d5c58 [ 674.020368][T24589] [ 674.022117][T24588] netlink: 'syz.2.4786': attribute type 12 has an invalid length. [ 674.868763][T24613] syzkaller0: entered promiscuous mode [ 674.868797][T24613] syzkaller0: entered allmulticast mode [ 675.387267][T24635] FAULT_INJECTION: forcing a failure. [ 675.387267][T24635] name failslab, interval 1, probability 0, space 0, times 0 [ 675.387301][T24635] CPU: 0 UID: 0 PID: 24635 Comm: syz.4.4800 Not tainted syzkaller #0 PREEMPT(full) [ 675.387325][T24635] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/15/2026 [ 675.387338][T24635] Call Trace: [ 675.387346][T24635] [ 675.387355][T24635] dump_stack_lvl+0xe8/0x150 [ 675.387397][T24635] should_fail_ex+0x3eb/0x540 [ 675.387431][T24635] should_failslab+0xa8/0x100 [ 675.387465][T24635] __kmalloc_cache_noprof+0x9e/0x600 [ 675.387495][T24635] ? tcf_gate_init+0x521/0x15a0 [ 675.387520][T24635] ? tcf_gate_init+0x521/0x15a0 [ 675.387555][T24635] tcf_gate_init+0x521/0x15a0 [ 675.387600][T24635] ? __pfx___nla_validate_parse+0x10/0x10 [ 675.387633][T24635] ? __pfx_tcf_gate_init+0x10/0x10 [ 675.387657][T24635] ? __lock_acquire+0x747/0x2de0 [ 675.387691][T24635] ? __pfx___nla_validate_parse+0x10/0x10 [ 675.387732][T24635] ? __nla_validate_parse+0x2429/0x2d50 [ 675.387772][T24635] ? __nla_parse+0x40/0x60 [ 675.387810][T24635] tcf_action_init_1+0x4ba/0x740 [ 675.387841][T24635] ? __pfx_tcf_action_init_1+0x10/0x10 [ 675.387863][T24635] ? _raw_read_unlock+0x28/0x50 [ 675.387885][T24635] ? tc_action_load_ops+0x247/0x540 [ 675.387933][T24635] ? __nla_parse+0x40/0x60 [ 675.387966][T24635] tcf_action_init+0x31f/0xac0 [ 675.387998][T24635] ? __kernel_text_address+0xd/0x30 [ 675.388032][T24635] ? __pfx_tcf_action_init+0x10/0x10 [ 675.388085][T24635] ? hook_capable+0x1c3/0x5e0 [ 675.388109][T24635] ? __pfx___nla_validate_parse+0x10/0x10 [ 675.388139][T24635] ? hook_capable+0x1c3/0x5e0 [ 675.388159][T24635] ? nlmon_xmit+0xb0/0x100 [ 675.388184][T24635] ? dev_hard_start_xmit+0x2cd/0x830 [ 675.388209][T24635] ? __dev_queue_xmit+0x14d1/0x3920 [ 675.388234][T24635] ? __netlink_deliver_tap+0x4f1/0x6e0 [ 675.388312][T24635] tc_ctl_action+0x44a/0xc80 [ 675.388351][T24635] ? __pfx_tc_ctl_action+0x10/0x10 [ 675.388405][T24635] ? irqentry_exit+0x2a0/0x9b0 [ 675.388432][T24635] ? __pfx_hook_capable+0x10/0x10 [ 675.388452][T24635] ? irqentry_exit+0x2a0/0x9b0 [ 675.388484][T24635] ? __pfx___mutex_lock+0x10/0x10 [ 675.388531][T24635] ? __pfx_tc_ctl_action+0x10/0x10 [ 675.388554][T24635] rtnetlink_rcv_msg+0x7b9/0xc00 [ 675.388583][T24635] ? rtnetlink_rcv_msg+0x1c9/0xc00 [ 675.388604][T24635] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 675.388631][T24635] ? __copy_skb_header+0xa3/0x4a0 [ 675.388668][T24635] netlink_rcv_skb+0x226/0x4a0 [ 675.388700][T24635] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 675.388726][T24635] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 675.388772][T24635] ? netlink_deliver_tap+0x2e/0x1b0 [ 675.388803][T24635] ? netlink_deliver_tap+0x2e/0x1b0 [ 675.388841][T24635] netlink_unicast+0x8ef/0xa80 [ 675.388890][T24635] netlink_sendmsg+0x7f0/0xb20 [ 675.388930][T24635] ? __pfx_netlink_sendmsg+0x10/0x10 [ 675.388966][T24635] ? aa_sock_msg_perm+0x144/0x210 [ 675.388994][T24635] ? apparmor_socket_sendmsg+0x98/0x360 [ 675.389029][T24635] ? __pfx_netlink_sendmsg+0x10/0x10 [ 675.389059][T24635] sock_sendmsg_nosec+0x14e/0x190 [ 675.389092][T24635] __sys_sendto+0x408/0x5a0 [ 675.389126][T24635] ? ksys_write+0x1e6/0x270 [ 675.389160][T24635] ? __pfx___sys_sendto+0x10/0x10 [ 675.389192][T24635] ? __mutex_unlock_slowpath+0x731/0x900 [ 675.389233][T24635] ? fdget+0x1ac/0x250 [ 675.389283][T24635] ? __pfx_ksys_write+0x10/0x10 [ 675.389319][T24635] __x64_sys_sendto+0xde/0x100 [ 675.389358][T24635] do_syscall_64+0x166/0x520 [ 675.389381][T24635] ? trace_irq_disable+0x3b/0x140 [ 675.389412][T24635] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 675.389435][T24635] ? clear_bhb_loop+0x70/0xc0 [ 675.389463][T24635] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 675.389485][T24635] RIP: 0033:0x7f70c959f559 [ 675.389506][T24635] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 675.389525][T24635] RSP: 002b:00007f70ca51e028 EFLAGS: 00000246 ORIG_RAX: 000000000000002c [ 675.389548][T24635] RAX: ffffffffffffffda RBX: 00007f70c9825fa0 RCX: 00007f70c959f559 [ 675.389564][T24635] RDX: 0000000000000068 RSI: 0000200000000140 RDI: 0000000000000003 [ 675.389578][T24635] RBP: 00007f70ca51e090 R08: 0000000000000000 R09: 0000000000000000 [ 675.389592][T24635] R10: 0000000004000104 R11: 0000000000000246 R12: 0000000000000001 [ 675.389606][T24635] R13: 00007f70c9826038 R14: 00007f70c9825fa0 R15: 00007ffed505ca48 [ 675.389643][T24635] [ 675.522549][ C0] bridge0: port 1(bridge_slave_0) entered learning state [ 675.524571][ C0] bridge0: port 2(bridge_slave_1) entered learning state [ 675.718727][T24637] IPv6: NLM_F_CREATE should be specified when creating new route [ 676.084526][T24648] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 676.098816][T24648] xt_TCPMSS: Only works on TCP SYN packets [ 676.101238][T24653] xt_TCPMSS: Only works on TCP SYN packets [ 676.127713][T24648] __nla_validate_parse: 5 callbacks suppressed [ 676.127734][T24648] netlink: 232 bytes leftover after parsing attributes in process `syz.0.4804'. [ 676.162094][T24655] netlink: 'syz.1.4805': attribute type 2 has an invalid length. [ 676.162118][T24655] netlink: 8 bytes leftover after parsing attributes in process `syz.1.4805'. [ 676.485924][T24679] FAULT_INJECTION: forcing a failure. [ 676.485924][T24679] name failslab, interval 1, probability 0, space 0, times 0 [ 676.485958][T24679] CPU: 0 UID: 0 PID: 24679 Comm: syz.3.4812 Not tainted syzkaller #0 PREEMPT(full) [ 676.485983][T24679] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/15/2026 [ 676.485997][T24679] Call Trace: [ 676.486006][T24679] [ 676.486015][T24679] dump_stack_lvl+0xe8/0x150 [ 676.486059][T24679] should_fail_ex+0x3eb/0x540 [ 676.486093][T24679] should_failslab+0xa8/0x100 [ 676.486129][T24679] __kmalloc_cache_noprof+0x9e/0x600 [ 676.486159][T24679] ? parse_gate_list+0x1d5/0xbe0 [ 676.486187][T24679] ? parse_gate_list+0x1d5/0xbe0 [ 676.486225][T24679] parse_gate_list+0x1d5/0xbe0 [ 676.486270][T24679] ? rcu_is_watching+0x16/0xb0 [ 676.486305][T24679] ? __pfx_parse_gate_list+0x10/0x10 [ 676.486334][T24679] ? __kasan_kmalloc+0x93/0xb0 [ 676.486367][T24679] ? __kmalloc_cache_noprof+0x31c/0x600 [ 676.486395][T24679] ? __kmalloc_cache_noprof+0x148/0x600 [ 676.486425][T24679] ? tcf_gate_init+0x521/0x15a0 [ 676.486449][T24679] ? tcf_gate_init+0x521/0x15a0 [ 676.486485][T24679] tcf_gate_init+0x5b3/0x15a0 [ 676.486531][T24679] ? __pfx___nla_validate_parse+0x10/0x10 [ 676.486564][T24679] ? __pfx_tcf_gate_init+0x10/0x10 [ 676.486590][T24679] ? __lock_acquire+0x747/0x2de0 [ 676.486625][T24679] ? __pfx___nla_validate_parse+0x10/0x10 [ 676.486677][T24679] ? __nla_validate_parse+0x2429/0x2d50 [ 676.486718][T24679] ? __nla_parse+0x40/0x60 [ 676.486753][T24679] tcf_action_init_1+0x4ba/0x740 [ 676.486784][T24679] ? __pfx_tcf_action_init_1+0x10/0x10 [ 676.486806][T24679] ? _raw_read_unlock+0x28/0x50 [ 676.486828][T24679] ? tc_action_load_ops+0x247/0x540 [ 676.486874][T24679] ? __nla_parse+0x40/0x60 [ 676.486909][T24679] tcf_action_init+0x31f/0xac0 [ 676.486941][T24679] ? __kernel_text_address+0xd/0x30 [ 676.486975][T24679] ? __pfx_tcf_action_init+0x10/0x10 [ 676.487027][T24679] ? hook_capable+0x1c3/0x5e0 [ 676.487050][T24679] ? __pfx___nla_validate_parse+0x10/0x10 [ 676.487079][T24679] ? hook_capable+0x1c3/0x5e0 [ 676.487099][T24679] ? nlmon_xmit+0xb0/0x100 [ 676.487124][T24679] ? dev_hard_start_xmit+0x2cd/0x830 [ 676.487149][T24679] ? __dev_queue_xmit+0x14d1/0x3920 [ 676.487174][T24679] ? __netlink_deliver_tap+0x4f1/0x6e0 [ 676.487250][T24679] tc_ctl_action+0x44a/0xc80 [ 676.487288][T24679] ? __pfx_tc_ctl_action+0x10/0x10 [ 676.487347][T24679] ? __pfx_hook_capable+0x10/0x10 [ 676.487378][T24679] ? __pfx___mutex_lock+0x10/0x10 [ 676.487425][T24679] ? __pfx_tc_ctl_action+0x10/0x10 [ 676.487466][T24679] rtnetlink_rcv_msg+0x7b9/0xc00 [ 676.487522][T24679] ? rtnetlink_rcv_msg+0x1c9/0xc00 [ 676.487544][T24679] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 676.487570][T24679] ? __copy_skb_header+0xa3/0x4a0 [ 676.487608][T24679] netlink_rcv_skb+0x226/0x4a0 [ 676.487640][T24679] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 676.487666][T24679] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 676.487712][T24679] ? netlink_deliver_tap+0x2e/0x1b0 [ 676.487742][T24679] ? netlink_deliver_tap+0x2e/0x1b0 [ 676.487782][T24679] netlink_unicast+0x8ef/0xa80 [ 676.487831][T24679] netlink_sendmsg+0x7f0/0xb20 [ 676.487871][T24679] ? __pfx_netlink_sendmsg+0x10/0x10 [ 676.487906][T24679] ? aa_sock_msg_perm+0x144/0x210 [ 676.487940][T24679] ? apparmor_socket_sendmsg+0x98/0x360 [ 676.487975][T24679] ? __pfx_netlink_sendmsg+0x10/0x10 [ 676.488006][T24679] sock_sendmsg_nosec+0x14e/0x190 [ 676.488039][T24679] __sys_sendto+0x408/0x5a0 [ 676.488073][T24679] ? ksys_write+0x1e6/0x270 [ 676.488106][T24679] ? __pfx___sys_sendto+0x10/0x10 [ 676.488137][T24679] ? __mutex_unlock_slowpath+0x731/0x900 [ 676.488197][T24679] ? fdget+0x1ac/0x250 [ 676.488247][T24679] ? __pfx_ksys_write+0x10/0x10 [ 676.488284][T24679] __x64_sys_sendto+0xde/0x100 [ 676.488324][T24679] do_syscall_64+0x166/0x520 [ 676.488348][T24679] ? trace_irq_disable+0x3b/0x140 [ 676.488379][T24679] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 676.488404][T24679] ? clear_bhb_loop+0x70/0xc0 [ 676.488432][T24679] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 676.488455][T24679] RIP: 0033:0x7fa7e7b9f559 [ 676.488477][T24679] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 676.488496][T24679] RSP: 002b:00007fa7e89d2028 EFLAGS: 00000246 ORIG_RAX: 000000000000002c [ 676.488521][T24679] RAX: ffffffffffffffda RBX: 00007fa7e7e25fa0 RCX: 00007fa7e7b9f559 [ 676.488538][T24679] RDX: 0000000000000068 RSI: 0000200000000140 RDI: 0000000000000003 [ 676.488554][T24679] RBP: 00007fa7e89d2090 R08: 0000000000000000 R09: 0000000000000000 [ 676.488568][T24679] R10: 0000000004000104 R11: 0000000000000246 R12: 0000000000000001 [ 676.488582][T24679] R13: 00007fa7e7e26038 R14: 00007fa7e7e25fa0 R15: 00007ffd5bdd8228 [ 676.488620][T24679] [ 676.662114][T24681] rxe_eth0 speed is unknown, defaulting to 1000 [ 676.697777][T24681] rxe_eth0 speed is unknown, defaulting to 1000 [ 676.698005][T24681] rxe_eth0 speed is unknown, defaulting to 1000 [ 676.698161][T24681] rxe_eth0 speed is unknown, defaulting to 1000 [ 676.698355][T24681] rxe_eth0 speed is unknown, defaulting to 1000 [ 676.698518][T24681] rxe_eth0 speed is unknown, defaulting to 1000 [ 676.709004][T24681] rxe_eth0 speed is unknown, defaulting to 1000 [ 676.709545][T24681] rxe_eth0 speed is unknown, defaulting to 1000 [ 676.710751][T24681] rxe_eth0 speed is unknown, defaulting to 1000 [ 676.720244][T24681] rxe_eth0 speed is unknown, defaulting to 1000 [ 676.760876][T24681] rxe_eth0 speed is unknown, defaulting to 1000 [ 676.769970][T24681] rxe_eth0 speed is unknown, defaulting to 1000 [ 676.793116][T24681] rxe_eth0 speed is unknown, defaulting to 1000 [ 676.795186][T24681] rxe_eth0 speed is unknown, defaulting to 1000 [ 676.795438][T24681] rxe_eth0 speed is unknown, defaulting to 1000 [ 676.795588][T24681] rxe_eth0 speed is unknown, defaulting to 1000 [ 676.795735][T24681] rxe_eth0 speed is unknown, defaulting to 1000 [ 676.835350][T24681] rxe_eth0 speed is unknown, defaulting to 1000 [ 676.841526][T24681] rxe_eth0 speed is unknown, defaulting to 1000 [ 676.898731][T24681] rxe_eth0 speed is unknown, defaulting to 1000 [ 676.899677][T24681] rxe_eth0 speed is unknown, defaulting to 1000 [ 676.900219][T24681] rxe_eth0 speed is unknown, defaulting to 1000 [ 676.907241][T24681] rxe_eth0 speed is unknown, defaulting to 1000 [ 676.907673][T24681] rxe_eth0 speed is unknown, defaulting to 1000 [ 676.910745][T24681] rxe_eth0 speed is unknown, defaulting to 1000 [ 676.918454][T24681] rxe_eth0 speed is unknown, defaulting to 1000 [ 676.919031][T24681] rxe_eth0 speed is unknown, defaulting to 1000 [ 676.924271][T24681] rxe_eth0 speed is unknown, defaulting to 1000 [ 676.938579][T24681] rxe_eth0 speed is unknown, defaulting to 1000 [ 676.939184][T24681] rxe_eth0 speed is unknown, defaulting to 1000 [ 676.939581][T24681] rxe_eth0 speed is unknown, defaulting to 1000 [ 676.966596][T24681] rxe_eth0 speed is unknown, defaulting to 1000 [ 676.967204][T24681] rxe_eth0 speed is unknown, defaulting to 1000 [ 677.282238][T24689] netlink: 4 bytes leftover after parsing attributes in process `syz.1.4815'. [ 677.447430][T24692] netlink: 8 bytes leftover after parsing attributes in process `syz.4.4817'. [ 677.535667][T24701] ip6erspan0: entered allmulticast mode [ 677.582540][ C0] bridge0: port 2(bridge_slave_1) entered forwarding state [ 677.582567][ C0] bridge0: topology change detected, propagating [ 677.583050][ C0] bridge0: port 1(bridge_slave_0) entered forwarding state [ 677.583070][ C0] bridge0: topology change detected, propagating [ 677.766013][T24712] FAULT_INJECTION: forcing a failure. [ 677.766013][T24712] name failslab, interval 1, probability 0, space 0, times 0 [ 677.766045][T24712] CPU: 0 UID: 0 PID: 24712 Comm: syz.2.4826 Not tainted syzkaller #0 PREEMPT(full) [ 677.766071][T24712] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/15/2026 [ 677.766084][T24712] Call Trace: [ 677.766093][T24712] [ 677.766103][T24712] dump_stack_lvl+0xe8/0x150 [ 677.766145][T24712] should_fail_ex+0x3eb/0x540 [ 677.766179][T24712] should_failslab+0xa8/0x100 [ 677.766216][T24712] __kmalloc_cache_noprof+0x9e/0x600 [ 677.766246][T24712] ? parse_gate_list+0x1d5/0xbe0 [ 677.766274][T24712] ? parse_gate_list+0x1d5/0xbe0 [ 677.766311][T24712] parse_gate_list+0x1d5/0xbe0 [ 677.766348][T24712] ? rcu_is_watching+0x16/0xb0 [ 677.766383][T24712] ? __pfx_parse_gate_list+0x10/0x10 [ 677.766413][T24712] ? __kasan_kmalloc+0x93/0xb0 [ 677.766445][T24712] ? __kmalloc_cache_noprof+0x31c/0x600 [ 677.766473][T24712] ? __kmalloc_cache_noprof+0x148/0x600 [ 677.766499][T24712] ? tcf_gate_init+0x521/0x15a0 [ 677.766525][T24712] ? tcf_gate_init+0x521/0x15a0 [ 677.766560][T24712] tcf_gate_init+0x5b3/0x15a0 [ 677.766608][T24712] ? __pfx___nla_validate_parse+0x10/0x10 [ 677.766641][T24712] ? __pfx_tcf_gate_init+0x10/0x10 [ 677.766674][T24712] ? __lock_acquire+0x747/0x2de0 [ 677.766711][T24712] ? __pfx___nla_validate_parse+0x10/0x10 [ 677.766753][T24712] ? __nla_validate_parse+0x2429/0x2d50 [ 677.766798][T24712] ? __nla_parse+0x40/0x60 [ 677.766835][T24712] tcf_action_init_1+0x4ba/0x740 [ 677.766868][T24712] ? __pfx_tcf_action_init_1+0x10/0x10 [ 677.766891][T24712] ? _raw_read_unlock+0x28/0x50 [ 677.766914][T24712] ? tc_action_load_ops+0x247/0x540 [ 677.766963][T24712] ? __nla_parse+0x40/0x60 [ 677.766998][T24712] tcf_action_init+0x31f/0xac0 [ 677.767039][T24712] ? __pfx_tcf_action_init+0x10/0x10 [ 677.767094][T24712] ? hook_capable+0x1c3/0x5e0 [ 677.767118][T24712] ? __pfx___nla_validate_parse+0x10/0x10 [ 677.767148][T24712] ? hook_capable+0x1c3/0x5e0 [ 677.767172][T24712] ? ktime_get+0x45/0x220 [ 677.767240][T24712] tc_ctl_action+0x44a/0xc80 [ 677.767267][T24712] ? lockdep_hardirqs_on+0x7b/0x110 [ 677.767303][T24712] ? __pfx_tc_ctl_action+0x10/0x10 [ 677.767362][T24712] ? __pfx_hook_capable+0x10/0x10 [ 677.767394][T24712] ? __pfx___mutex_lock+0x10/0x10 [ 677.767443][T24712] ? __pfx_tc_ctl_action+0x10/0x10 [ 677.767466][T24712] rtnetlink_rcv_msg+0x7b9/0xc00 [ 677.767495][T24712] ? rtnetlink_rcv_msg+0x1c9/0xc00 [ 677.767518][T24712] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 677.767545][T24712] ? __copy_skb_header+0xa3/0x4a0 [ 677.767584][T24712] netlink_rcv_skb+0x226/0x4a0 [ 677.767618][T24712] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 677.767644][T24712] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 677.767700][T24712] ? netlink_deliver_tap+0x2e/0x1b0 [ 677.767731][T24712] ? netlink_deliver_tap+0x2e/0x1b0 [ 677.767770][T24712] netlink_unicast+0x8ef/0xa80 [ 677.767821][T24712] netlink_sendmsg+0x7f0/0xb20 [ 677.767860][T24712] ? __pfx_netlink_sendmsg+0x10/0x10 [ 677.767898][T24712] ? aa_sock_msg_perm+0x144/0x210 [ 677.767925][T24712] ? apparmor_socket_sendmsg+0x98/0x360 [ 677.767962][T24712] ? __pfx_netlink_sendmsg+0x10/0x10 [ 677.767994][T24712] sock_sendmsg_nosec+0x14e/0x190 [ 677.768028][T24712] __sys_sendto+0x408/0x5a0 [ 677.768063][T24712] ? ksys_write+0x1e6/0x270 [ 677.768097][T24712] ? __pfx___sys_sendto+0x10/0x10 [ 677.768130][T24712] ? __mutex_unlock_slowpath+0x731/0x900 [ 677.768172][T24712] ? fdget+0x1ac/0x250 [ 677.768216][T24712] ? __pfx_ksys_write+0x10/0x10 [ 677.768252][T24712] __x64_sys_sendto+0xde/0x100 [ 677.768292][T24712] do_syscall_64+0x166/0x520 [ 677.768316][T24712] ? trace_irq_disable+0x3b/0x140 [ 677.768347][T24712] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 677.768371][T24712] ? clear_bhb_loop+0x70/0xc0 [ 677.768400][T24712] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 677.768422][T24712] RIP: 0033:0x7f21c939f559 [ 677.768444][T24712] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 677.768463][T24712] RSP: 002b:00007f21ca31f028 EFLAGS: 00000246 ORIG_RAX: 000000000000002c [ 677.768488][T24712] RAX: ffffffffffffffda RBX: 00007f21c9625fa0 RCX: 00007f21c939f559 [ 677.768505][T24712] RDX: 0000000000000068 RSI: 0000200000000140 RDI: 0000000000000003 [ 677.768519][T24712] RBP: 00007f21ca31f090 R08: 0000000000000000 R09: 0000000000000000 [ 677.768533][T24712] R10: 0000000004000104 R11: 0000000000000246 R12: 0000000000000001 [ 677.768548][T24712] R13: 00007f21c9626038 R14: 00007f21c9625fa0 R15: 00007ffca7799818 [ 677.768586][T24712] [ 678.277952][T24717] xt_TCPMSS: Only works on TCP SYN packets [ 678.481249][T24733] netlink: 112 bytes leftover after parsing attributes in process `syz.2.4833'. [ 678.691348][T24744] netlink: 'syz.3.4835': attribute type 1 has an invalid length. [ 678.754266][T24741] A link change request failed with some changes committed already. Interface xfrm0 may have been left with an inconsistent configuration, please check. [ 678.783018][T24751] netlink: 4 bytes leftover after parsing attributes in process `syz.3.4835'. [ 678.876059][T24744] 8021q: adding VLAN 0 to HW filter on device bond5 [ 678.908316][T24759] netlink: 20 bytes leftover after parsing attributes in process `syz.4.4839'. [ 678.929794][T24744] netlink: 'syz.3.4835': attribute type 10 has an invalid length. [ 678.929818][T24744] netlink: 40 bytes leftover after parsing attributes in process `syz.3.4835'. [ 678.989435][T24751] bond5: (slave veth3): Enslaving as a backup interface with a down link [ 679.058293][T24760] geneve2: entered promiscuous mode [ 679.058320][T24760] geneve2: entered allmulticast mode [ 679.321685][T24765] netlink: 40 bytes leftover after parsing attributes in process `syz.4.4841'. [ 679.420272][T24773] team_slave_1: entered promiscuous mode [ 679.420298][T24773] team_slave_1: entered allmulticast mode [ 679.590879][T24778] netlink: 108 bytes leftover after parsing attributes in process `syz.4.4846'. [ 680.270817][T24809] syzkaller0: MTU not usable for tipc bearer [ 680.270857][T24809] tipc: Enabling of bearer rejected, failed to enable media [ 680.297522][T24803] can: request_module (can-proto-5) failed. [ 680.481964][T24818] netlink: 'syz.1.4855': attribute type 1 has an invalid length. [ 680.587681][T24821] 8021q: VLANs not supported on syzkaller0 [ 680.977709][T24833] xt_recent: Unsupported userspace flags (000000b1) [ 680.977864][T24833] xt_recent: Unsupported userspace flags (000000b1) [ 680.977991][T24833] xt_recent: Unsupported userspace flags (000000b1) [ 680.978099][T24833] xt_recent: Unsupported userspace flags (000000b1) [ 680.978205][T24833] xt_recent: Unsupported userspace flags (000000b1) [ 680.978311][T24833] xt_recent: Unsupported userspace flags (000000b1) [ 680.983108][T24833] xt_recent: Unsupported userspace flags (000000b1) [ 680.983708][T24833] xt_recent: Unsupported userspace flags (000000b1) [ 680.987252][T24833] xt_recent: Unsupported userspace flags (000000b1) [ 680.987682][T24833] xt_recent: Unsupported userspace flags (000000b1) [ 681.064494][T24834] ip_tables: iptables: counters copy to user failed while replacing table [ 681.281616][T24847] FAULT_INJECTION: forcing a failure. [ 681.281616][T24847] name failslab, interval 1, probability 0, space 0, times 0 [ 681.281650][T24847] CPU: 0 UID: 0 PID: 24847 Comm: syz.4.4866 Not tainted syzkaller #0 PREEMPT(full) [ 681.281690][T24847] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/15/2026 [ 681.281712][T24847] Call Trace: [ 681.281721][T24847] [ 681.281731][T24847] dump_stack_lvl+0xe8/0x150 [ 681.281772][T24847] should_fail_ex+0x3eb/0x540 [ 681.281806][T24847] should_failslab+0xa8/0x100 [ 681.281841][T24847] __kmalloc_noprof+0xf9/0x710 [ 681.281867][T24847] ? lock_acquire+0x115/0x350 [ 681.281894][T24847] ? tcf_gate_offload_act_setup+0x49f/0xaf0 [ 681.281922][T24847] ? tcf_gate_offload_act_setup+0x49f/0xaf0 [ 681.281962][T24847] tcf_gate_offload_act_setup+0x49f/0xaf0 [ 681.281999][T24847] tc_setup_action+0x517/0xb90 [ 681.282130][T24847] ? __pfx_tc_setup_action+0x10/0x10 [ 681.282157][T24847] ? tcf_action_offload_add_ex+0x400/0x820 [ 681.282185][T24847] ? __local_bh_enable_ip+0xd6/0x140 [ 681.282233][T24847] tcf_action_offload_add_ex+0x4e6/0x820 [ 681.282265][T24847] ? __pfx_tcf_action_offload_add_ex+0x10/0x10 [ 681.282319][T24847] ? tcf_gate_get_fill_size+0x22/0x270 [ 681.282345][T24847] ? tcf_gate_get_fill_size+0x22/0x270 [ 681.282382][T24847] ? tcf_gate_get_fill_size+0x220/0x270 [ 681.282412][T24847] ? __pfx_tcf_gate_get_fill_size+0x10/0x10 [ 681.282445][T24847] tcf_action_init+0x37f/0xac0 [ 681.282475][T24847] ? __kernel_text_address+0xd/0x30 [ 681.282507][T24847] ? __pfx_tcf_action_init+0x10/0x10 [ 681.282561][T24847] ? hook_capable+0x1c3/0x5e0 [ 681.282585][T24847] ? __pfx___nla_validate_parse+0x10/0x10 [ 681.282615][T24847] ? hook_capable+0x1c3/0x5e0 [ 681.282635][T24847] ? nlmon_xmit+0xb0/0x100 [ 681.282660][T24847] ? dev_hard_start_xmit+0x2cd/0x830 [ 681.282684][T24847] ? __dev_queue_xmit+0x14d1/0x3920 [ 681.282709][T24847] ? __netlink_deliver_tap+0x4f1/0x6e0 [ 681.282779][T24847] tc_ctl_action+0x44a/0xc80 [ 681.282816][T24847] ? __pfx_tc_ctl_action+0x10/0x10 [ 681.282873][T24847] ? __pfx_hook_capable+0x10/0x10 [ 681.282905][T24847] ? __pfx___mutex_lock+0x10/0x10 [ 681.282952][T24847] ? __pfx_tc_ctl_action+0x10/0x10 [ 681.282976][T24847] rtnetlink_rcv_msg+0x7b9/0xc00 [ 681.283003][T24847] ? rtnetlink_rcv_msg+0x1c9/0xc00 [ 681.283026][T24847] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 681.283051][T24847] ? __copy_skb_header+0xa3/0x4a0 [ 681.283090][T24847] netlink_rcv_skb+0x226/0x4a0 [ 681.283122][T24847] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 681.283147][T24847] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 681.283194][T24847] ? netlink_deliver_tap+0x2e/0x1b0 [ 681.283224][T24847] ? netlink_deliver_tap+0x2e/0x1b0 [ 681.283262][T24847] netlink_unicast+0x8ef/0xa80 [ 681.283311][T24847] netlink_sendmsg+0x7f0/0xb20 [ 681.283351][T24847] ? __pfx_netlink_sendmsg+0x10/0x10 [ 681.283395][T24847] ? aa_sock_msg_perm+0x144/0x210 [ 681.283424][T24847] ? apparmor_socket_sendmsg+0x98/0x360 [ 681.283459][T24847] ? __pfx_netlink_sendmsg+0x10/0x10 [ 681.283489][T24847] sock_sendmsg_nosec+0x14e/0x190 [ 681.283522][T24847] __sys_sendto+0x408/0x5a0 [ 681.283556][T24847] ? ksys_write+0x1e6/0x270 [ 681.283588][T24847] ? __pfx___sys_sendto+0x10/0x10 [ 681.283620][T24847] ? __mutex_unlock_slowpath+0x731/0x900 [ 681.283662][T24847] ? fdget+0x1ac/0x250 [ 681.283704][T24847] ? __pfx_ksys_write+0x10/0x10 [ 681.283739][T24847] __x64_sys_sendto+0xde/0x100 [ 681.283777][T24847] do_syscall_64+0x166/0x520 [ 681.283801][T24847] ? trace_irq_disable+0x3b/0x140 [ 681.283832][T24847] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 681.283855][T24847] ? clear_bhb_loop+0x70/0xc0 [ 681.283883][T24847] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 681.283905][T24847] RIP: 0033:0x7f70c959f559 [ 681.283926][T24847] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 681.283944][T24847] RSP: 002b:00007f70ca51e028 EFLAGS: 00000246 ORIG_RAX: 000000000000002c [ 681.283968][T24847] RAX: ffffffffffffffda RBX: 00007f70c9825fa0 RCX: 00007f70c959f559 [ 681.283984][T24847] RDX: 0000000000000068 RSI: 0000200000000140 RDI: 0000000000000003 [ 681.283999][T24847] RBP: 00007f70ca51e090 R08: 0000000000000000 R09: 0000000000000000 [ 681.284013][T24847] R10: 0000000004000104 R11: 0000000000000246 R12: 0000000000000002 [ 681.284043][T24847] R13: 00007f70c9826038 R14: 00007f70c9825fa0 R15: 00007ffed505ca48 [ 681.284082][T24847] [ 681.738264][T24849] syzkaller1: entered promiscuous mode [ 681.738288][T24849] syzkaller1: entered allmulticast mode [ 682.196705][T24867] __nla_validate_parse: 5 callbacks suppressed [ 682.196728][T24867] netlink: 8 bytes leftover after parsing attributes in process `syz.3.4871'. [ 682.376389][T24881] FAULT_INJECTION: forcing a failure. [ 682.376389][T24881] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 682.376423][T24881] CPU: 1 UID: 0 PID: 24881 Comm: syz.3.4878 Not tainted syzkaller #0 PREEMPT(full) [ 682.376449][T24881] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/15/2026 [ 682.376462][T24881] Call Trace: [ 682.376471][T24881] [ 682.376481][T24881] dump_stack_lvl+0xe8/0x150 [ 682.376523][T24881] should_fail_ex+0x3eb/0x540 [ 682.376557][T24881] _copy_to_user+0x31/0xb0 [ 682.376727][T24881] simple_read_from_buffer+0xe1/0x170 [ 682.376762][T24881] proc_fail_nth_read+0x1bb/0x230 [ 682.376872][T24881] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 682.376911][T24881] ? rw_verify_area+0x24a/0x4c0 [ 682.376940][T24881] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 682.376976][T24881] vfs_read+0x213/0xa80 [ 682.377007][T24881] ? __pfx___mutex_lock+0x10/0x10 [ 682.377037][T24881] ? __pfx_vfs_read+0x10/0x10 [ 682.377068][T24881] ? __fget_files+0x2a/0x420 [ 682.377094][T24881] ? __fget_files+0x3a2/0x420 [ 682.377121][T24881] ? __fget_files+0x2a/0x420 [ 682.377153][T24881] ? fdget+0x1ac/0x250 [ 682.377189][T24881] ksys_read+0x150/0x270 [ 682.377222][T24881] ? __pfx_ksys_read+0x10/0x10 [ 682.377267][T24881] do_syscall_64+0x166/0x520 [ 682.377292][T24881] ? trace_irq_disable+0x3b/0x140 [ 682.377324][T24881] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 682.377348][T24881] ? clear_bhb_loop+0x70/0xc0 [ 682.377377][T24881] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 682.377401][T24881] RIP: 0033:0x7fa7e7b5fd8e [ 682.377423][T24881] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 682.377443][T24881] RSP: 002b:00007fa7e89d1fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 682.377468][T24881] RAX: ffffffffffffffda RBX: 00007fa7e89d26c0 RCX: 00007fa7e7b5fd8e [ 682.377486][T24881] RDX: 000000000000000f RSI: 00007fa7e89d20a0 RDI: 0000000000000004 [ 682.377501][T24881] RBP: 00007fa7e89d2090 R08: 0000000000000000 R09: 0000000000000000 [ 682.377516][T24881] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 682.377530][T24881] R13: 00007fa7e7e26038 R14: 00007fa7e7e25fa0 R15: 00007ffd5bdd8228 [ 682.377569][T24881] [ 682.799416][T24893] netlink: 12 bytes leftover after parsing attributes in process `syz.3.4881'. [ 682.800415][T24893] netlink: 44 bytes leftover after parsing attributes in process `syz.3.4881'. [ 682.977493][T24899] tipc: Enabling of bearer rejected, failed to enable media [ 683.226326][T24907] netlink: 48 bytes leftover after parsing attributes in process `syz.1.4884'. [ 683.241111][T24909] netlink: 48 bytes leftover after parsing attributes in process `syz.1.4884'. [ 683.418469][T24913] A link change request failed with some changes committed already. Interface vlan1 may have been left with an inconsistent configuration, please check. [ 683.476923][T24928] netlink: 48 bytes leftover after parsing attributes in process `syz.1.4887'. [ 683.502203][T24928] netlink: 4 bytes leftover after parsing attributes in process `syz.1.4887'. [ 683.674050][T24934] netlink: 4 bytes leftover after parsing attributes in process `syz.0.4890'. [ 683.729935][T24934] netlink: 4 bytes leftover after parsing attributes in process `syz.0.4890'. [ 683.739308][T24934] netlink: 4 bytes leftover after parsing attributes in process `syz.0.4890'. [ 685.860153][T25039] Bluetooth: hci0: unsupported parameter 5161 [ 685.860179][T25039] Bluetooth: hci0: unsupported parameter 8192 [ 685.860194][T25039] Bluetooth: hci0: unsupported parameter 5161 [ 685.860208][T25039] Bluetooth: hci0: unsupported parameter 8192 [ 685.998675][ T1319] ieee802154 phy1 wpan1: encryption failed: -22 [ 686.488179][T25064] netlink: 'syz.2.4921': attribute type 29 has an invalid length. [ 686.526476][T25064] netlink: 'syz.2.4921': attribute type 29 has an invalid length. [ 686.564622][T25071] lo: entered promiscuous mode [ 686.577724][T25071] tunl0: entered promiscuous mode [ 686.594710][T25071] gre0: entered promiscuous mode [ 686.656357][T25071] gretap0: entered promiscuous mode [ 686.685473][T25071] erspan0: entered promiscuous mode [ 686.715633][T25071] ip_vti0: entered promiscuous mode [ 687.285411][T25107] xt_hashlimit: size too large, truncated to 1048576 [ 687.317120][T25099] netlink: 'syz.0.4930': attribute type 1 has an invalid length. [ 687.594238][T25115] __nla_validate_parse: 11 callbacks suppressed [ 687.594259][T25115] netlink: 4 bytes leftover after parsing attributes in process `syz.2.4933'. [ 687.594380][T25115] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 687.666706][T25115] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 687.749246][ T53] block nbd296: Receive control failed (result -32) [ 688.178967][T25133] netlink: 116 bytes leftover after parsing attributes in process `syz.4.4937'. [ 688.215855][T25139] netlink: 45 bytes leftover after parsing attributes in process `syz.2.4940'. [ 688.422216][T25144] bridge0: trying to set multicast startup query interval above maximum, setting to 8640000 (86400000ms) [ 688.767391][T25162] netdevsim netdevsim0 netdevsim0: entered promiscuous mode [ 688.921544][T25168] netlink: 12 bytes leftover after parsing attributes in process `syz.1.4947'. [ 689.069166][T25177] netlink: 4 bytes leftover after parsing attributes in process `syz.2.4953'. [ 689.071780][T25177] netlink: 24 bytes leftover after parsing attributes in process `syz.2.4953'. [ 689.090556][T25177] netlink: 4 bytes leftover after parsing attributes in process `syz.2.4953'. [ 689.307213][T25187] netlink: 'syz.2.4955': attribute type 32 has an invalid length. [ 689.307237][T25187] netlink: 8 bytes leftover after parsing attributes in process `syz.2.4955'. [ 689.348573][T25187] bond3: option coupled_control: invalid value (110) [ 689.353938][T25187] bond3 (unregistering): Released all slaves [ 690.107449][T25226] netlink: 56 bytes leftover after parsing attributes in process `syz.1.4966'. [ 690.338643][T25245] netlink: 112 bytes leftover after parsing attributes in process `syz.3.4972'. [ 690.722082][T25264] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 691.043049][T25275] netlink: 'syz.3.4980': attribute type 10 has an invalid length. [ 691.157137][T25282] IPVS: sync thread started: state = BACKUP, mcast_ifn = bridge0, syncid = 4, id = 0 [ 691.230461][T25285] x_tables: duplicate underflow at hook 1 [ 691.419119][T25293] syzkaller0: left promiscuous mode [ 691.419144][T25293] syzkaller0: left allmulticast mode [ 691.422087][T25293] batman_adv: batadv0: Adding interface: veth0 [ 691.422104][T25293] batman_adv: batadv0: The MTU of interface veth0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 691.422135][T25293] batman_adv: batadv0: Interface activated: veth0 [ 691.500706][T25293] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 691.500734][T25293] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 691.529434][T25293] batman_adv: batadv0: Removing interface: bridge1 [ 691.532284][T25293] batman_adv: batadv0: Interface deactivated: syzkaller0 [ 691.532308][T25293] batman_adv: batadv0: Removing interface: syzkaller0 [ 691.564896][T25293] batman_adv: batadv0: Interface deactivated: veth0 [ 691.564921][T25293] batman_adv: batadv0: Removing interface: veth0 [ 691.610076][T25293] batadv0 (unregistering): left promiscuous mode [ 692.276383][T25347] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 692.421422][T25357] netlink: 'syz.3.5005': attribute type 1 has an invalid length. [ 692.421448][T25357] netlink: 'syz.3.5005': attribute type 3 has an invalid length. [ 692.684447][T25367] openvswitch: netlink: nsh attribute has unmatched MD type 0. [ 692.684871][T25367] openvswitch: netlink: nsh attribute has unmatched MD type 0. [ 692.685285][T25367] openvswitch: netlink: nsh attribute has unmatched MD type 0. [ 692.685666][T25367] openvswitch: netlink: nsh attribute has unmatched MD type 0. [ 692.690495][T25367] openvswitch: netlink: nsh attribute has unmatched MD type 0. [ 692.690971][T25367] openvswitch: netlink: nsh attribute has unmatched MD type 0. [ 692.691393][T25367] openvswitch: netlink: nsh attribute has unmatched MD type 0. [ 692.748614][T25367] openvswitch: netlink: nsh attribute has unmatched MD type 0. [ 692.827008][T25380] veth1_macvtap: left promiscuous mode [ 692.864605][T25380] __nla_validate_parse: 8 callbacks suppressed [ 692.864629][T25380] netlink: 4 bytes leftover after parsing attributes in process `syz.4.5012'. [ 693.007823][T25387] netlink: 12 bytes leftover after parsing attributes in process `syz.0.5015'. [ 693.179915][T25395] netlink: 'syz.4.5017': attribute type 1 has an invalid length. [ 693.248245][T25395] 8021q: adding VLAN 0 to HW filter on device bond8 [ 693.304014][T25407] netlink: 12 bytes leftover after parsing attributes in process `syz.1.5021'. [ 693.550499][T25415] netlink: 96 bytes leftover after parsing attributes in process `syz.4.5023'. [ 693.720189][T25424] netlink: 12 bytes leftover after parsing attributes in process `syz.3.5027'. [ 694.099042][T25439] netlink: 'syz.1.5029': attribute type 2 has an invalid length. [ 694.100483][T25439] netlink: 'syz.1.5029': attribute type 2 has an invalid length. [ 694.100699][T25439] netlink: 'syz.1.5029': attribute type 2 has an invalid length. [ 694.100914][T25439] netlink: 'syz.1.5029': attribute type 2 has an invalid length. [ 694.101093][T25439] netlink: 'syz.1.5029': attribute type 2 has an invalid length. [ 694.101275][T25439] netlink: 'syz.1.5029': attribute type 2 has an invalid length. [ 694.101489][T25439] netlink: 'syz.1.5029': attribute type 2 has an invalid length. [ 694.445200][T25455] xt_connbytes: Forcing CT accounting to be enabled [ 694.445460][T25455] set match dimension is over the limit! [ 694.800507][T25474] netlink: 12 bytes leftover after parsing attributes in process `syz.3.5038'. [ 694.803065][T25474] netlink: 44 bytes leftover after parsing attributes in process `syz.3.5038'. [ 694.905286][T25469] netlink: 96 bytes leftover after parsing attributes in process `syz.1.5036'. [ 694.908557][T25469] netlink: 28 bytes leftover after parsing attributes in process `syz.1.5036'. [ 694.908586][T25469] netlink: 12 bytes leftover after parsing attributes in process `syz.1.5036'. [ 695.824031][T25524] 8021q: adding VLAN 0 to HW filter on device bond6 [ 695.843926][T25524] bond0: left promiscuous mode [ 695.843951][T25524] bond_slave_0: left promiscuous mode [ 695.844252][T25524] bond_slave_1: left promiscuous mode [ 696.426139][T25563] team0: Port device dummy0 added [ 696.668338][T25577] tc_dump_action: action bad kind [ 696.681797][T25578] Bluetooth: ISO socket layer initialized [ 697.470264][T25623] net_ratelimit: 26 callbacks suppressed [ 697.470286][T25623] openvswitch: netlink: ct_state flags 010000e0 unsupported [ 698.208030][T25670] __nla_validate_parse: 51 callbacks suppressed [ 698.208052][T25670] netlink: 24 bytes leftover after parsing attributes in process `syz.3.5094'. [ 698.310039][T25674] netlink: 24 bytes leftover after parsing attributes in process `syz.0.5096'. [ 698.311234][T25673] netlink: 24 bytes leftover after parsing attributes in process `syz.0.5096'. [ 698.377608][T25671] gre0: Caught tx_queue_len zero misconfig [ 698.377640][T25671] sch_tbf: burst 0 is lower than device gre0 mtu (1500) ! [ 698.484671][T25671] netlink: 4 bytes leftover after parsing attributes in process `syz.3.5094'. [ 698.894906][T25710] netlink: 8 bytes leftover after parsing attributes in process `syz.3.5102'. [ 698.897721][T25710] netlink: 8 bytes leftover after parsing attributes in process `syz.3.5102'. [ 698.901699][T25710] netlink: 8 bytes leftover after parsing attributes in process `syz.3.5102'. [ 698.928614][T25710] netlink: 8 bytes leftover after parsing attributes in process `syz.3.5102'. [ 698.945692][T25710] netlink: 8 bytes leftover after parsing attributes in process `syz.3.5102'. [ 698.947101][T25710] netlink: 8 bytes leftover after parsing attributes in process `syz.3.5102'. [ 699.388562][T25734] validate_nla: 33 callbacks suppressed [ 699.389131][T25734] netlink: 'syz.1.5105': attribute type 1 has an invalid length. [ 700.906734][T25810] bridge0: port 2(bridge_slave_1) entered blocking state [ 700.906866][T25810] bridge0: port 2(bridge_slave_1) entered forwarding state [ 700.930615][T25810] bridge0: entered promiscuous mode [ 700.930692][T25810] bridge0: entered allmulticast mode [ 700.955222][T25813] bridge0: port 2(bridge_slave_1) entered disabled state [ 701.253218][T25838] ip_tables: iptables: counters copy to user failed while replacing table [ 701.525453][T25844] netlink: 'syz.4.5136': attribute type 12 has an invalid length. [ 701.720404][T25848] netlink: 'syz.4.5136': attribute type 12 has an invalid length. [ 702.690169][T25866] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 703.071760][T25885] ip_tables: iptables: counters copy to user failed while replacing table [ 703.178206][T25894] ip6t_hbh: too many supported opts specified [ 703.336446][T25906] syzkaller0: entered promiscuous mode [ 703.336472][T25906] syzkaller0: entered allmulticast mode [ 703.498961][T25913] __nla_validate_parse: 41 callbacks suppressed [ 703.498986][T25913] netlink: 48 bytes leftover after parsing attributes in process `syz.4.5154'. [ 703.669446][T25924] tipc: Started in network mode [ 703.669479][T25924] tipc: Node identity ac14142f, cluster identity 4711 [ 703.670481][T25924] tipc: Enabled bearer , priority 10 [ 703.691556][T25924] tipc: Can't add remote ip to TIPC UDP multicast bearer [ 703.809874][T25926] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 703.821936][T25926] A link change request failed with some changes committed already. Interface wlan0 may have been left with an inconsistent configuration, please check. [ 704.254408][T25958] netlink: 8 bytes leftover after parsing attributes in process `syz.2.5165'. [ 704.281897][T25958] netlink: 32 bytes leftover after parsing attributes in process `syz.2.5165'. [ 704.400749][T25962] netlink: 8 bytes leftover after parsing attributes in process `syz.0.5166'. [ 704.410279][T25962] netlink: 52 bytes leftover after parsing attributes in process `syz.0.5166'. [ 704.508633][T25946] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 704.529128][T25946] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 704.531654][T25946] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 704.531881][T25946] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 704.532031][T25946] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 704.532188][T25946] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 704.532344][T25946] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 704.792523][T25081] tipc: Node number set to 2886997039 [ 705.122997][T25986] netlink: 8 bytes leftover after parsing attributes in process `syz.0.5176'. [ 705.123800][T25986] netlink: 20 bytes leftover after parsing attributes in process `syz.0.5176'. [ 705.216203][T25989] netlink: 220 bytes leftover after parsing attributes in process `syz.2.5177'. [ 705.216228][T25989] tc_dump_action: action bad kind [ 705.387031][T26002] team0: Device gtp2 is up. Set it down before adding it as a team port [ 705.609205][T26012] xt_CT: You must specify a L4 protocol and not use inversions on it [ 706.335460][T26040] netlink: 24 bytes leftover after parsing attributes in process `syz.3.5196'. [ 706.363338][T26040] netlink: 32 bytes leftover after parsing attributes in process `syz.3.5196'. [ 706.405282][T26041] macsec0: entered promiscuous mode [ 706.778016][T26060] siw: device registration error -23 [ 706.804915][T26057] batman_adv: batadv0: Adding interface: gretap1 [ 706.804937][T26057] batman_adv: batadv0: The MTU of interface gretap1 is too small (1442) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 706.804972][T26057] batman_adv: batadv0: Interface activated: gretap1 [ 706.805645][T26061] wg0 speed is unknown, defaulting to 1000 [ 706.805728][T26061] wg0 speed is unknown, defaulting to 1000 [ 706.806481][T26061] wg0 speed is unknown, defaulting to 1000 [ 706.815763][T26061] smbdirect: ib_dev[syz0]: added: RNIC max_fast_reg_page_list_len=256 device_cap_flags=0x200000 kernel_cap_flags=0x10 page_size_cap=0x1000 [ 706.815860][T26061] smbdirect: ib_dev[syz0]: num_ports=1 max_qp_rd_atom=128 max_qp_init_rd_atom=128 max_sgl_rd=0 max_sge_rd=1 max_cqe=3276800 max_qp_wr=32768 max_send_sge=6 max_recv_sge=6 [ 706.815969][T26061] smbdirect: ib_dev[syz0]PORT[1]: iwarp=1 ib=0 roce=0 v1=0 v2=0 core_cap_flags=0x400008 [ 707.016429][T26061] wg0 speed is unknown, defaulting to 1000 [ 707.030878][T26061] wg0 speed is unknown, defaulting to 1000 [ 707.057202][T26061] wg0 speed is unknown, defaulting to 1000 [ 707.070071][T26061] wg0 speed is unknown, defaulting to 1000 [ 707.092124][T26061] wg0 speed is unknown, defaulting to 1000 [ 707.136595][T26061] wg0 speed is unknown, defaulting to 1000 [ 707.726615][T26084] net_ratelimit: 59 callbacks suppressed [ 707.726638][T26084] hsr_slave_0: hsr_addr_subst_dest: Unknown node [ 707.726832][T26084] hsr_slave_1: hsr_addr_subst_dest: Unknown node [ 707.809873][T26092] netlink: 'syz.0.5205': attribute type 1 has an invalid length. [ 707.812677][T26093] netlink: 'syz.0.5205': attribute type 1 has an invalid length. [ 708.211561][T26092] bridge6: entered promiscuous mode [ 708.225135][T26092] bond4: (slave bridge6): making interface the new active one [ 708.233271][T26092] bond4: (slave bridge6): Enslaving as an active interface with an up link [ 708.259721][T26105] bridge7: entered promiscuous mode [ 708.269073][T26105] bond4: (slave bridge7): Enslaving as a backup interface with an up link [ 708.521037][T26132] ÿÿÿÿÿÿ: renamed from virt_wifi0 [ 708.551319][T26132] __nla_validate_parse: 3 callbacks suppressed [ 708.551339][T26132] netlink: 36 bytes leftover after parsing attributes in process `syz.2.5211'. [ 708.608063][T26138] netlink: 20 bytes leftover after parsing attributes in process `syz.4.5214'. [ 708.611158][T26138] netlink: 64 bytes leftover after parsing attributes in process `syz.4.5214'. [ 708.639367][T26136] netlink: 12 bytes leftover after parsing attributes in process `syz.1.5212'. [ 708.639398][T26136] block nbd4: Unsupported socket: should be TCP or UNIX. [ 708.834014][T26146] netlink: 'syz.3.5218': attribute type 5 has an invalid length. [ 708.884499][T26153] netlink: 272 bytes leftover after parsing attributes in process `syz.2.5215'. [ 708.890524][T26148] sctp: [Deprecated]: syz.0.5216 (pid 26148) Use of struct sctp_assoc_value in delayed_ack socket option. [ 708.890524][T26148] Use struct sctp_sack_info instead [ 708.974016][T26142] bridge5: trying to set multicast startup query interval above maximum, setting to 8640000 (86400000ms) [ 709.338247][T26171] netlink: 24 bytes leftover after parsing attributes in process `syz.3.5223'. [ 709.384427][T26171] netlink: 92 bytes leftover after parsing attributes in process `syz.3.5223'. [ 709.499375][T26178] netlink: 41 bytes leftover after parsing attributes in process `syz.2.5226'. [ 709.499400][T26178] netlink: 140 bytes leftover after parsing attributes in process `syz.2.5226'. [ 709.499422][T26178] netlink: 41 bytes leftover after parsing attributes in process `syz.2.5226'. [ 710.188893][T26218] veth4: entered promiscuous mode [ 710.188917][T26218] veth4: entered allmulticast mode [ 710.230555][T26219] 8021q: VLANs not supported on ip6tnl0 [ 710.347723][T26226] xt_limit: Overflow, try lower: 536871034/0 [ 710.684141][T26239] Bluetooth: hci0: unsupported parameter 5134 [ 710.684166][T26239] Bluetooth: hci0: unsupported parameter 8192 [ 710.684180][T26239] Bluetooth: hci0: unsupported parameter 5134 [ 710.684194][T26239] Bluetooth: hci0: unsupported parameter 8192 [ 710.725719][T26247] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 710.842273][T26253] netlink: 'syz.1.5246': attribute type 1 has an invalid length. [ 711.775722][T26300] syzkaller0: entered promiscuous mode [ 711.775807][T26300] syzkaller0: entered allmulticast mode [ 713.845352][T26315] lo: entered allmulticast mode [ 714.010473][T26331] __nla_validate_parse: 6 callbacks suppressed [ 714.010495][T26331] netlink: 12 bytes leftover after parsing attributes in process `syz.3.5269'. [ 714.751074][T26369] netlink: 32 bytes leftover after parsing attributes in process `syz.4.5286'. [ 714.765900][T26368] rxe_eth0 speed is unknown, defaulting to 1000 [ 714.891851][T26380] ieee802154 phy1 wpan1: encryption failed: -22 [ 714.934051][T26381] netlink: 12 bytes leftover after parsing attributes in process `syz.2.5288'. [ 715.232013][T26393] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 715.531001][T26368] wg0 speed is unknown, defaulting to 1000 [ 715.608907][T26412] netlink: 48 bytes leftover after parsing attributes in process `syz.1.5297'. [ 715.611650][T26411] netlink: 14 bytes leftover after parsing attributes in process `syz.1.5297'. [ 715.670630][T26411] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 715.688335][T26411] bond0 (unregistering): Released all slaves [ 715.771699][T26415] ip_tables: iptables: counters copy to user failed while replacing table [ 715.874902][T26415] netlink: 12 bytes leftover after parsing attributes in process `syz.0.5299'. [ 715.906179][T26420] netlink: 84 bytes leftover after parsing attributes in process `syz.2.5301'. [ 715.933724][T26420] netlink: 16 bytes leftover after parsing attributes in process `syz.2.5301'. [ 715.933758][T26420] macvlan0: entered promiscuous mode [ 716.438138][T26441] netlink: 8 bytes leftover after parsing attributes in process `syz.4.5307'. [ 716.438164][T26441] netlink: 4 bytes leftover after parsing attributes in process `syz.4.5307'. [ 716.531535][T26432] 8021q: adding VLAN 0 to HW filter on device bond9 [ 716.629958][T26441] 8021q: adding VLAN 0 to HW filter on device bond0 [ 716.649399][T26441] bond9: (slave bond0): Enslaving as an active interface with a down link [ 716.720183][T26446] bond9 (unregistering): (slave bond0): Releasing active interface [ 716.743913][T26446] bond9 (unregistering): Released all slaves [ 716.786457][T26453] netlink: 'syz.2.5312': attribute type 12 has an invalid length. [ 717.438571][T26488] netlink: 'syz.4.5322': attribute type 10 has an invalid length. [ 717.526562][T26497] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 718.009137][T26505] vlan2: entered promiscuous mode [ 718.009161][T26505] hsr0: entered promiscuous mode [ 718.073957][T26521] hsr_slave_0: left promiscuous mode [ 718.077976][T26521] hsr_slave_1: left promiscuous mode [ 718.720121][T26538] bond9: (slave bond_slave_0): Device is not our slave [ 718.720145][T26538] bond9: option active_slave: invalid value (bond_slave_0) [ 718.747421][T26538] bond9 (unregistering): Released all slaves [ 719.034867][T26556] __nla_validate_parse: 5 callbacks suppressed [ 719.034890][T26556] netlink: 8 bytes leftover after parsing attributes in process `syz.2.5343'. [ 719.166660][T26564] netlink: 2 bytes leftover after parsing attributes in process `syz.3.5345'. [ 719.166704][T26564] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 719.346424][T26568] netlink: 12 bytes leftover after parsing attributes in process `syz.2.5347'. [ 719.394444][T26569] syzkaller0: entered promiscuous mode [ 719.394656][T26569] syzkaller0: entered allmulticast mode [ 719.579276][T26576] netlink: 132 bytes leftover after parsing attributes in process `syz.3.5349'. [ 720.516590][T26604] netlink: 4 bytes leftover after parsing attributes in process `syz.2.5358'. [ 720.520645][T26604] netlink: 'syz.2.5358': attribute type 2 has an invalid length. [ 721.252360][T26624] netlink: 'syz.1.5362': attribute type 1 has an invalid length. [ 721.258806][T26624] netlink: 228 bytes leftover after parsing attributes in process `syz.1.5362'. [ 721.319260][T26629] x_tables: unsorted underflow at hook 1 [ 721.340636][T26632] FAULT_INJECTION: forcing a failure. [ 721.340636][T26632] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 721.340672][T26632] CPU: 1 UID: 0 PID: 26632 Comm: syz.3.5365 Not tainted syzkaller #0 PREEMPT(full) [ 721.340697][T26632] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/15/2026 [ 721.340711][T26632] Call Trace: [ 721.340720][T26632] [ 721.340730][T26632] dump_stack_lvl+0xe8/0x150 [ 721.340772][T26632] should_fail_ex+0x3eb/0x540 [ 721.340806][T26632] _copy_from_iter+0x1d3/0x1680 [ 721.340833][T26632] ? __alloc_skb+0x27a/0x7a0 [ 721.340870][T26632] ? __alloc_skb+0x27a/0x7a0 [ 721.340907][T26632] ? __alloc_skb+0x27a/0x7a0 [ 721.340941][T26632] ? __pfx__copy_from_iter+0x10/0x10 [ 721.340964][T26632] ? kmem_cache_alloc_node_noprof+0x1f4/0x600 [ 721.340991][T26632] ? __alloc_skb+0x27a/0x7a0 [ 721.341022][T26632] ? __alloc_skb+0x27a/0x7a0 [ 721.341063][T26632] ? netlink_sendmsg+0x64f/0xb20 [ 721.341095][T26632] ? skb_put+0x112/0x210 [ 721.341120][T26632] netlink_sendmsg+0x6bb/0xb20 [ 721.341160][T26632] ? __pfx_netlink_sendmsg+0x10/0x10 [ 721.341197][T26632] ? aa_sock_msg_perm+0x144/0x210 [ 721.341232][T26632] ? apparmor_socket_sendmsg+0x98/0x360 [ 721.341269][T26632] ? __pfx_netlink_sendmsg+0x10/0x10 [ 721.341300][T26632] sock_sendmsg_nosec+0x14e/0x190 [ 721.341334][T26632] __sys_sendto+0x408/0x5a0 [ 721.341369][T26632] ? ksys_write+0x1e6/0x270 [ 721.341421][T26632] ? __pfx___sys_sendto+0x10/0x10 [ 721.341454][T26632] ? __mutex_unlock_slowpath+0x731/0x900 [ 721.341499][T26632] ? fdget+0x1ac/0x250 [ 721.341543][T26632] ? __pfx_ksys_write+0x10/0x10 [ 721.341580][T26632] __x64_sys_sendto+0xde/0x100 [ 721.341620][T26632] do_syscall_64+0x166/0x520 [ 721.341646][T26632] ? trace_irq_disable+0x3b/0x140 [ 721.341679][T26632] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 721.341704][T26632] ? clear_bhb_loop+0x70/0xc0 [ 721.341732][T26632] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 721.341757][T26632] RIP: 0033:0x7fa7e7b9f559 [ 721.341779][T26632] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 721.341799][T26632] RSP: 002b:00007fa7e89d2028 EFLAGS: 00000246 ORIG_RAX: 000000000000002c [ 721.341836][T26632] RAX: ffffffffffffffda RBX: 00007fa7e7e25fa0 RCX: 00007fa7e7b9f559 [ 721.341853][T26632] RDX: 0000000000000068 RSI: 0000200000000140 RDI: 0000000000000003 [ 721.341867][T26632] RBP: 00007fa7e89d2090 R08: 0000000000000000 R09: 0000000000000000 [ 721.341881][T26632] R10: 0000000004000104 R11: 0000000000000246 R12: 0000000000000001 [ 721.341895][T26632] R13: 00007fa7e7e26038 R14: 00007fa7e7e25fa0 R15: 00007ffd5bdd8228 [ 721.341933][T26632] [ 721.904752][T26638] netlink: 'syz.2.5368': attribute type 6 has an invalid length. [ 721.995074][T26641] netlink: 'syz.2.5368': attribute type 6 has an invalid length. [ 722.476360][T26661] pim6reg1: entered promiscuous mode [ 722.476388][T26661] pim6reg1: entered allmulticast mode [ 722.511147][T26661] pim6reg527: entered allmulticast mode [ 722.590041][T26668] syzkaller0: entered promiscuous mode [ 722.590066][T26668] syzkaller0: entered allmulticast mode [ 722.600529][T26669] netlink: 'syz.0.5374': attribute type 1 has an invalid length. [ 722.736462][T26669] 8021q: adding VLAN 0 to HW filter on device bond6 [ 722.927565][T26675] FAULT_INJECTION: forcing a failure. [ 722.927565][T26675] name failslab, interval 1, probability 0, space 0, times 0 [ 722.927604][T26675] CPU: 0 UID: 0 PID: 26675 Comm: syz.1.5376 Not tainted syzkaller #0 PREEMPT(full) [ 722.927630][T26675] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/15/2026 [ 722.927645][T26675] Call Trace: [ 722.927654][T26675] [ 722.927664][T26675] dump_stack_lvl+0xe8/0x150 [ 722.927709][T26675] should_fail_ex+0x3eb/0x540 [ 722.927741][T26675] ? __alloc_skb+0x1db/0x7a0 [ 722.927775][T26675] should_failslab+0xa8/0x100 [ 722.927810][T26675] ? __alloc_skb+0x1db/0x7a0 [ 722.927842][T26675] kmem_cache_alloc_node_noprof+0x9c/0x600 [ 722.927869][T26675] ? __alloc_skb+0x18d/0x7a0 [ 722.927905][T26675] ? __alloc_skb+0x1db/0x7a0 [ 722.927947][T26675] __alloc_skb+0x1db/0x7a0 [ 722.927987][T26675] netlink_dump+0x201/0xf20 [ 722.928019][T26675] ? __netlink_lookup+0xe6/0x8f0 [ 722.928064][T26675] ? __netlink_lookup+0x82e/0x8f0 [ 722.928100][T26675] ? __pfx_netlink_dump+0x10/0x10 [ 722.928143][T26675] ? netlink_lookup+0x30/0x200 [ 722.928173][T26675] ? netlink_lookup+0x30/0x200 [ 722.928212][T26675] __netlink_dump_start+0x589/0x7b0 [ 722.928274][T26675] rtnetlink_rcv_msg+0xa48/0xc00 [ 722.928301][T26675] ? __pfx_tc_dump_action+0x10/0x10 [ 722.928326][T26675] ? rtnetlink_rcv_msg+0x1c9/0xc00 [ 722.928349][T26675] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 722.928372][T26675] ? __pfx_rtnl_dumpit+0x10/0x10 [ 722.928394][T26675] ? __pfx_tc_dump_action+0x10/0x10 [ 722.928434][T26675] netlink_rcv_skb+0x226/0x4a0 [ 722.928467][T26675] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 722.928493][T26675] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 722.928540][T26675] ? netlink_deliver_tap+0x2e/0x1b0 [ 722.928572][T26675] ? netlink_deliver_tap+0x2e/0x1b0 [ 722.928612][T26675] netlink_unicast+0x8ef/0xa80 [ 722.928662][T26675] netlink_sendmsg+0x7f0/0xb20 [ 722.928701][T26675] ? __pfx_netlink_sendmsg+0x10/0x10 [ 722.928738][T26675] ? aa_sock_msg_perm+0x144/0x210 [ 722.928767][T26675] ? apparmor_socket_sendmsg+0x98/0x360 [ 722.928803][T26675] ? __pfx_netlink_sendmsg+0x10/0x10 [ 722.928834][T26675] sock_sendmsg_nosec+0x14e/0x190 [ 722.928868][T26675] __sys_sendto+0x408/0x5a0 [ 722.928903][T26675] ? ksys_write+0x1e6/0x270 [ 722.928936][T26675] ? __pfx___sys_sendto+0x10/0x10 [ 722.928968][T26675] ? __mutex_unlock_slowpath+0x731/0x900 [ 722.929011][T26675] ? fdget+0x1ac/0x250 [ 722.929060][T26675] ? __pfx_ksys_write+0x10/0x10 [ 722.929097][T26675] __x64_sys_sendto+0xde/0x100 [ 722.929143][T26675] do_syscall_64+0x166/0x520 [ 722.929169][T26675] ? trace_irq_disable+0x3b/0x140 [ 722.929201][T26675] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 722.929224][T26675] ? clear_bhb_loop+0x70/0xc0 [ 722.929253][T26675] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 722.929276][T26675] RIP: 0033:0x7f8bec39f559 [ 722.929298][T26675] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 722.929317][T26675] RSP: 002b:00007f8bed2b5028 EFLAGS: 00000246 ORIG_RAX: 000000000000002c [ 722.929342][T26675] RAX: ffffffffffffffda RBX: 00007f8bec625fa0 RCX: 00007f8bec39f559 [ 722.929359][T26675] RDX: 0000000000000068 RSI: 0000200000000140 RDI: 0000000000000003 [ 722.929374][T26675] RBP: 00007f8bed2b5090 R08: 0000000000000000 R09: 0000000000000000 [ 722.929388][T26675] R10: 0000000004000104 R11: 0000000000000246 R12: 0000000000000001 [ 722.929404][T26675] R13: 00007f8bec626038 R14: 00007f8bec625fa0 R15: 00007ffe7fa9cbe8 [ 722.929442][T26675] [ 723.487203][T26680] netlink: 16 bytes leftover after parsing attributes in process `syz.0.5378'. [ 723.726079][T26693] netlink: 12 bytes leftover after parsing attributes in process `syz.3.5383'. [ 723.886211][T26701] bridge0: left allmulticast mode [ 723.888115][T26693] syzkaller0: entered promiscuous mode [ 723.888136][T26693] syzkaller0: entered allmulticast mode [ 724.151959][T26716] FAULT_INJECTION: forcing a failure. [ 724.151959][T26716] name failslab, interval 1, probability 0, space 0, times 0 [ 724.151993][T26716] CPU: 0 UID: 0 PID: 26716 Comm: syz.3.5389 Not tainted syzkaller #0 PREEMPT(full) [ 724.152019][T26716] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/15/2026 [ 724.152032][T26716] Call Trace: [ 724.152041][T26716] [ 724.152051][T26716] dump_stack_lvl+0xe8/0x150 [ 724.152094][T26716] should_fail_ex+0x3eb/0x540 [ 724.152125][T26716] ? __alloc_skb+0x1db/0x7a0 [ 724.152161][T26716] should_failslab+0xa8/0x100 [ 724.152195][T26716] ? __alloc_skb+0x1db/0x7a0 [ 724.152228][T26716] kmem_cache_alloc_node_noprof+0x9c/0x600 [ 724.152254][T26716] ? __alloc_skb+0x18d/0x7a0 [ 724.152290][T26716] ? __alloc_skb+0x1db/0x7a0 [ 724.152332][T26716] __alloc_skb+0x1db/0x7a0 [ 724.152378][T26716] netlink_dump+0x201/0xf20 [ 724.152410][T26716] ? __netlink_lookup+0xe6/0x8f0 [ 724.152448][T26716] ? __netlink_lookup+0x82e/0x8f0 [ 724.152483][T26716] ? __pfx_netlink_dump+0x10/0x10 [ 724.152525][T26716] ? netlink_lookup+0x30/0x200 [ 724.152555][T26716] ? netlink_lookup+0x30/0x200 [ 724.152592][T26716] __netlink_dump_start+0x589/0x7b0 [ 724.152632][T26716] rtnetlink_rcv_msg+0xa48/0xc00 [ 724.152658][T26716] ? __pfx_tc_dump_action+0x10/0x10 [ 724.152683][T26716] ? rtnetlink_rcv_msg+0x1c9/0xc00 [ 724.152706][T26716] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 724.152729][T26716] ? __pfx_rtnl_dumpit+0x10/0x10 [ 724.152749][T26716] ? __pfx_tc_dump_action+0x10/0x10 [ 724.152788][T26716] netlink_rcv_skb+0x226/0x4a0 [ 724.152822][T26716] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 724.152848][T26716] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 724.152893][T26716] ? netlink_deliver_tap+0x2e/0x1b0 [ 724.152932][T26716] ? netlink_deliver_tap+0x2e/0x1b0 [ 724.152970][T26716] netlink_unicast+0x8ef/0xa80 [ 724.153019][T26716] netlink_sendmsg+0x7f0/0xb20 [ 724.153059][T26716] ? __pfx_netlink_sendmsg+0x10/0x10 [ 724.153096][T26716] ? aa_sock_msg_perm+0x144/0x210 [ 724.153125][T26716] ? apparmor_socket_sendmsg+0x98/0x360 [ 724.153161][T26716] ? __pfx_netlink_sendmsg+0x10/0x10 [ 724.153193][T26716] sock_sendmsg_nosec+0x14e/0x190 [ 724.153227][T26716] __sys_sendto+0x408/0x5a0 [ 724.153262][T26716] ? ksys_write+0x1e6/0x270 [ 724.153296][T26716] ? __pfx___sys_sendto+0x10/0x10 [ 724.153328][T26716] ? __mutex_unlock_slowpath+0x731/0x900 [ 724.153372][T26716] ? fdget+0x1ac/0x250 [ 724.153416][T26716] ? __pfx_ksys_write+0x10/0x10 [ 724.153454][T26716] __x64_sys_sendto+0xde/0x100 [ 724.153493][T26716] do_syscall_64+0x166/0x520 [ 724.153518][T26716] ? trace_irq_disable+0x3b/0x140 [ 724.153550][T26716] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 724.153574][T26716] ? clear_bhb_loop+0x70/0xc0 [ 724.153603][T26716] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 724.153626][T26716] RIP: 0033:0x7fa7e7b9f559 [ 724.153648][T26716] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 724.153667][T26716] RSP: 002b:00007fa7e89d2028 EFLAGS: 00000246 ORIG_RAX: 000000000000002c [ 724.153691][T26716] RAX: ffffffffffffffda RBX: 00007fa7e7e25fa0 RCX: 00007fa7e7b9f559 [ 724.153708][T26716] RDX: 0000000000000068 RSI: 0000200000000140 RDI: 0000000000000003 [ 724.153722][T26716] RBP: 00007fa7e89d2090 R08: 0000000000000000 R09: 0000000000000000 [ 724.153737][T26716] R10: 0000000004000104 R11: 0000000000000246 R12: 0000000000000001 [ 724.153762][T26716] R13: 00007fa7e7e26038 R14: 00007fa7e7e25fa0 R15: 00007ffd5bdd8228 [ 724.153798][T26716] [ 724.848600][T26717] 8021q: VLANs not supported on gre0 [ 724.848707][T26721] veth0: entered promiscuous mode [ 724.849214][T26721] veth0: left promiscuous mode [ 725.861951][T26763] netlink: 'syz.2.5401': attribute type 1 has an invalid length. [ 725.950512][T26769] netlink: 'syz.2.5401': attribute type 1 has an invalid length. [ 726.453380][ T6970] netdevsim netdevsim2 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0 [ 726.455865][ T6963] netdevsim netdevsim2 netdevsim0: set [0, 0] type 1 family 0 port 8472 - 0 [ 726.475726][ T6970] netdevsim netdevsim2 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0 [ 726.483551][ T206] netdevsim netdevsim2 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0 [ 727.088351][T26804] syzkaller0: entered promiscuous mode [ 727.088564][T26804] syzkaller0: entered allmulticast mode [ 727.407946][T26820] openvswitch: netlink: Message has -1 unknown bytes. [ 727.710082][T26831] netlink: 56 bytes leftover after parsing attributes in process `syz.0.5420'. [ 728.043716][T26836] netlink: 14 bytes leftover after parsing attributes in process `syz.2.5421'. [ 731.225411][T26866] netlink: 'syz.2.5429': attribute type 1 has an invalid length. [ 731.225435][T26866] netlink: 224 bytes leftover after parsing attributes in process `syz.2.5429'. [ 731.525453][T26870] Bluetooth: hci0: invalid length 0, exp 4 for type 32 [ 731.782531][T26879] netlink: 20 bytes leftover after parsing attributes in process `syz.0.5435'. [ 731.966164][T26888] netlink: 8 bytes leftover after parsing attributes in process `syz.3.5437'. [ 731.966262][T26888] veth1: Caught tx_queue_len zero misconfig [ 732.274077][T26897] ip_tables: iptables: counters copy to user failed while replacing table [ 732.280863][T26897] ip_tables: iptables: counters copy to user failed while replacing table [ 732.288896][T26897] 8021q: VLANs not supported on syzkaller0 [ 732.303917][T26897] syzkaller0: left promiscuous mode [ 732.303948][T26897] syzkaller0: left allmulticast mode [ 732.362243][T26897] syzkaller1: entered promiscuous mode [ 732.366423][T26897] syzkaller1: entered allmulticast mode [ 732.607788][T26911] netlink: 4 bytes leftover after parsing attributes in process `syz.1.5439'. [ 734.077129][T26961] syzkaller0: entered promiscuous mode [ 734.077154][T26961] syzkaller0: entered allmulticast mode [ 734.156945][T26965] netlink: 12 bytes leftover after parsing attributes in process `syz.1.5457'. [ 734.600233][T26984] netlink: 12 bytes leftover after parsing attributes in process `syz.0.5463'. [ 735.489682][T27009] netlink: 56 bytes leftover after parsing attributes in process `syz.0.5472'. [ 735.546700][T27016] netlink: 40 bytes leftover after parsing attributes in process `syz.0.5472'. [ 735.663436][T27009] bond7 (unregistering): Released all slaves [ 735.717240][T27022] netlink: 20 bytes leftover after parsing attributes in process `syz.2.5476'. [ 735.886077][T27022] netlink: 4 bytes leftover after parsing attributes in process `syz.2.5476'. [ 736.093865][T27029] ip_tables: iptables: counters copy to user failed while replacing table [ 736.513882][T27046] netlink: 'syz.0.5485': attribute type 11 has an invalid length. [ 736.513906][T27046] netlink: 224 bytes leftover after parsing attributes in process `syz.0.5485'. [ 736.933266][T27066] netlink: 12 bytes leftover after parsing attributes in process `syz.1.5489'. [ 737.044494][T27066] bond0: entered promiscuous mode [ 737.049305][T27066] 8021q: adding VLAN 0 to HW filter on device bond0 [ 737.131871][T27071] 8021q: adding VLAN 0 to HW filter on device bond0 [ 737.140392][T27071] bond0: (slave sit2): The slave device specified does not support setting the MAC address [ 737.160715][T27071] bond0: (slave sit2): Error -95 calling set_mac_address [ 737.665835][T27089] netlink: 16 bytes leftover after parsing attributes in process `syz.4.5491'. [ 737.875409][T27098] netlink: 9 bytes leftover after parsing attributes in process `syz.1.5496'. [ 737.940435][T27099] 0ªî{X¹¦: renamed from gretap0 [ 737.960900][T27099] 0ªî{X¹¦: left promiscuous mode [ 737.960923][T27099] 0ªî{X¹¦: entered allmulticast mode [ 737.983597][T27099] A link change request failed with some changes committed already. Interface 30ªî{X¹¦ may have been left with an inconsistent configuration, please check. [ 738.380015][T27104] nbd: socks must be embedded in a SOCK_ITEM attr [ 738.747968][T27123] netlink: 'syz.1.5503': attribute type 2 has an invalid length. [ 738.773818][T27123] netlink: 'syz.1.5503': attribute type 1 has an invalid length. [ 739.226910][T27136] __nla_validate_parse: 7 callbacks suppressed [ 739.226932][T27136] netlink: 28 bytes leftover after parsing attributes in process `syz.2.5506'. [ 739.226961][T27136] netlink: 28 bytes leftover after parsing attributes in process `syz.2.5506'. [ 739.290496][T27142] netlink: 28 bytes leftover after parsing attributes in process `syz.2.5506'. [ 739.290532][T27142] netlink: 28 bytes leftover after parsing attributes in process `syz.2.5506'. [ 739.986667][T27169] ip_tables: iptables: counters copy to user failed while replacing table [ 740.090656][T27172] tipc: Enabling of bearer rejected, already enabled [ 740.100271][T27170] netlink: 'syz.4.5514': attribute type 10 has an invalid length. [ 740.224639][T27170] wg2: entered promiscuous mode [ 740.224834][T27170] team0: Device wg2 is of different type [ 740.298300][T27181] tipc: Enabling of bearer rejected, already enabled [ 740.672036][T27193] netlink: 'syz.4.5519': attribute type 21 has an invalid length. [ 740.683289][T27194] netlink: 'syz.4.5519': attribute type 21 has an invalid length. [ 740.850277][T27193] bond10: Unable to set up delay as MII monitoring is disabled [ 740.933523][T27193] bond10 (unregistering): Released all slaves [ 741.174699][T27194] bond10: Unable to set up delay as MII monitoring is disabled [ 741.179986][T27194] bond10 (unregistering): Released all slaves [ 741.311968][T27217] netlink: 'syz.2.5527': attribute type 10 has an invalid length. [ 741.542844][T27220] netlink: 40 bytes leftover after parsing attributes in process `syz.0.5528'. [ 741.571052][T27220] sctp: [Deprecated]: syz.0.5528 (pid 27220) Use of struct sctp_assoc_value in delayed_ack socket option. [ 741.571052][T27220] Use struct sctp_sack_info instead [ 741.651619][T27223] netlink: 24 bytes leftover after parsing attributes in process `syz.4.5530'. [ 741.651645][T27223] netlink: 80 bytes leftover after parsing attributes in process `syz.4.5530'. [ 741.651663][T27223] netlink: 24 bytes leftover after parsing attributes in process `syz.4.5530'. [ 742.038897][T27237] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 742.112301][T27237] netlink: 'syz.2.5535': attribute type 10 has an invalid length. [ 742.166914][T27236] syzkaller0: entered promiscuous mode [ 742.166939][T27236] syzkaller0: entered allmulticast mode [ 742.470235][T27253] netlink: 36 bytes leftover after parsing attributes in process `syz.0.5538'. [ 742.970672][T27263] xt_esp: unknown flags DD [ 743.003287][T27263] netlink: 24 bytes leftover after parsing attributes in process `syz.3.5541'. [ 743.234275][T27275] IPVS: set_ctl: invalid protocol: 47 172.20.20.170:20002 [ 744.060109][T27297] IPVS: set_ctl: invalid protocol: 0 0.0.0.0:0 [ 744.060418][T27297] IPVS: set_ctl: invalid protocol: 0 0.0.0.0:0 [ 744.236356][T27304] __nla_validate_parse: 6 callbacks suppressed [ 744.236381][T27304] netlink: 100 bytes leftover after parsing attributes in process `syz.1.5553'. [ 744.262204][T27304] netlink: 84 bytes leftover after parsing attributes in process `syz.1.5553'. [ 744.295351][T27304] netlink: 256 bytes leftover after parsing attributes in process `syz.1.5553'. [ 744.350485][T27307] netlink: 12 bytes leftover after parsing attributes in process `syz.2.5554'. [ 744.787702][T27319] 8021q: adding VLAN 0 to HW filter on device macsec2 [ 744.858512][T27326] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 744.883970][T27326] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 744.895817][T27325] netlink: 224 bytes leftover after parsing attributes in process `syz.3.5558'. [ 744.911194][T27326] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 744.927384][T27326] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 744.939883][T27326] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 745.003680][T27320] bond10: entered allmulticast mode [ 745.004178][T27320] 8021q: adding VLAN 0 to HW filter on device bond10 [ 745.099653][T27322] 8021q: adding VLAN 0 to HW filter on device macsec2 [ 745.177182][T27336] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 745.561797][T27348] tipc: Resetting bearer [ 745.711650][T27348] tipc: Disabling bearer [ 745.844305][T27348] team0 (unregistering): Port device xfrm0 removed [ 745.975200][T27353] vlan3: entered allmulticast mode [ 745.975229][T27353] veth0_vlan: entered allmulticast mode [ 745.978640][T27355] netdevsim netdevsim2 netdevsim0: entered promiscuous mode [ 746.302181][T27368] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 746.302202][T27368] IPv6: NLM_F_CREATE should be set when creating new route [ 746.302246][T27368] IPv6: NLM_F_CREATE should be set when creating new route [ 746.302272][T27368] IPv6: NLM_F_CREATE should be set when creating new route [ 746.328146][T27368] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 746.668095][T27381] netlink: 20 bytes leftover after parsing attributes in process `syz.2.5574'. [ 746.955012][T27390] bond0: entered allmulticast mode [ 746.966037][T27390] 8021q: adding VLAN 0 to HW filter on device bond0 [ 747.005382][T27390] bond0: option ad_select: unable to set because the bond device is up [ 747.005655][T27390] bond0: option ad_select: unable to set because the bond device is up [ 747.005879][T27390] bond0: option ad_select: unable to set because the bond device is up [ 747.006125][T27390] bond0: option ad_select: unable to set because the bond device is up [ 747.006355][T27390] bond0: option ad_select: unable to set because the bond device is up [ 747.006576][T27390] bond0: option ad_select: unable to set because the bond device is up [ 747.006812][T27390] bond0: option ad_select: unable to set because the bond device is up [ 747.024680][T27390] bond0: option ad_select: unable to set because the bond device is up [ 747.025415][T27390] bond0: option ad_select: unable to set because the bond device is up [ 747.025995][T27390] bond0: option ad_select: unable to set because the bond device is up [ 747.057012][T27390] bond0: option ad_select: unable to set because the bond device is up [ 747.057255][T27390] bond0: option ad_select: unable to set because the bond device is up [ 747.057903][T27390] bond0: option ad_select: unable to set because the bond device is up [ 747.058474][T27390] bond0: option ad_select: unable to set because the bond device is up [ 747.071661][T27390] bond0: option ad_select: unable to set because the bond device is up [ 747.072264][T27390] bond0: option ad_select: unable to set because the bond device is up [ 747.224859][T27387] geneve2: entered allmulticast mode [ 747.239439][T27390] bond0: option ad_select: unable to set because the bond device is up [ 747.239711][T27390] bond0: option ad_select: unable to set because the bond device is up [ 747.239977][T27390] bond0: option ad_select: unable to set because the bond device is up [ 747.240250][T27390] bond0: option ad_select: unable to set because the bond device is up [ 747.240481][T27390] bond0: option ad_select: unable to set because the bond device is up [ 747.240711][T27390] bond0: option ad_select: unable to set because the bond device is up [ 747.240945][T27390] bond0: option ad_select: unable to set because the bond device is up [ 747.428273][ T1319] ieee802154 phy1 wpan1: encryption failed: -22 [ 747.529711][T27405] netlink: 4 bytes leftover after parsing attributes in process `syz.1.5579'. [ 747.566541][T27390] bond0: option ad_select: unable to set because the bond device is up [ 747.682101][T27390] bond0: option ad_select: unable to set because the bond device is up [ 747.690977][T27390] bond0: option ad_select: unable to set because the bond device is up [ 747.691437][T27390] bond0: option ad_select: unable to set because the bond device is up [ 747.691670][T27390] bond0: option ad_select: unable to set because the bond device is up [ 747.699818][T27390] bond0: option ad_select: unable to set because the bond device is up [ 747.705899][T27390] bond0: option ad_select: unable to set because the bond device is up [ 747.709399][T27390] bond0: option ad_select: unable to set because the bond device is up [ 747.718975][T27390] bond0: option ad_select: unable to set because the bond device is up [ 747.721115][T27390] bond0: option ad_select: unable to set because the bond device is up [ 747.730961][T27390] bond0: option ad_select: unable to set because the bond device is up [ 747.740086][T27390] bond0: option ad_select: unable to set because the bond device is up [ 747.760698][T27390] bond0: option ad_select: unable to set because the bond device is up [ 747.793479][T27390] bond0: option ad_select: unable to set because the bond device is up [ 747.794496][T27390] bond0: option ad_select: unable to set because the bond device is up [ 747.794722][T27390] bond0: option ad_select: unable to set because the bond device is up [ 747.794964][T27390] bond0: option ad_select: unable to set because the bond device is up [ 747.795186][T27390] bond0: option ad_select: unable to set because the bond device is up [ 747.796618][T27390] bond0: option ad_select: unable to set because the bond device is up [ 747.796864][T27390] bond0: option ad_select: unable to set because the bond device is up [ 747.797754][T27390] bond0: option ad_select: unable to set because the bond device is up [ 747.798022][T27390] bond0: option ad_select: unable to set because the bond device is up [ 747.798243][T27390] bond0: option ad_select: unable to set because the bond device is up [ 747.799989][T27390] bond0: option ad_select: unable to set because the bond device is up [ 747.977837][T27414] block nbd4: Unsupported socket: should be TCP or UNIX. [ 748.597498][T27430] IPVS: set_ctl: invalid protocol: 59 0.0.0.0:20003 [ 748.684811][T27436] xt_ecn: cannot match TCP bits for non-tcp packets [ 749.026138][T27446] netlink: 28 bytes leftover after parsing attributes in process `syz.0.5596'. [ 749.045041][T27446] netlink: 8 bytes leftover after parsing attributes in process `syz.0.5596'. [ 749.071906][T27446] netlink: 12 bytes leftover after parsing attributes in process `syz.0.5596'. [ 749.251934][T27450] netlink: 32 bytes leftover after parsing attributes in process `syz.4.5598'. [ 750.007147][T27479] netlink: 4 bytes leftover after parsing attributes in process `syz.2.5607'. [ 750.179422][T27486] IPVS: set_ctl: invalid protocol: 115 127.0.0.1:20001 [ 750.433553][T27495] netlink: 32 bytes leftover after parsing attributes in process `syz.4.5612'. [ 750.778193][T27515] tipc: Enabling of bearer rejected, already enabled [ 751.978073][T27564] netlink: 'syz.1.5631': attribute type 3 has an invalid length. [ 752.042046][T27564] netlink: 'syz.1.5631': attribute type 3 has an invalid length. [ 752.074335][T27568] bond0: Error: CAN devices cannot be enslaved [ 752.381226][T27577] netlink: 44 bytes leftover after parsing attributes in process `syz.1.5636'. [ 752.381389][T27577] veth1_vlan: entered promiscuous mode [ 752.381598][T27577] macvlan0: entered promiscuous mode [ 752.414316][T27577] netlink: 44 bytes leftover after parsing attributes in process `syz.1.5636'. [ 753.776201][T27640] netlink: 44 bytes leftover after parsing attributes in process `syz.0.5650'. [ 754.050061][T27652] netlink: 'syz.0.5653': attribute type 2 has an invalid length. [ 754.165587][T27656] netlink: 156 bytes leftover after parsing attributes in process `syz.4.5654'. [ 754.733622][T27682] ip_tables: iptables: counters copy to user failed while replacing table [ 754.937719][T27685] syzkaller0: entered promiscuous mode [ 754.937744][T27685] syzkaller0: entered allmulticast mode [ 755.576891][T27704] netlink: 8 bytes leftover after parsing attributes in process `syz.4.5669'. [ 755.576929][T27704] netlink: 'syz.4.5669': attribute type 5 has an invalid length. [ 755.576947][T27704] netlink: 20 bytes leftover after parsing attributes in process `syz.4.5669'. [ 755.578688][T27703] netlink: 8 bytes leftover after parsing attributes in process `syz.4.5669'. [ 755.578943][T27703] netlink: 'syz.4.5669': attribute type 5 has an invalid length. [ 755.578959][T27703] netlink: 20 bytes leftover after parsing attributes in process `syz.4.5669'. [ 755.640194][T27701] netlink: 'syz.1.5668': attribute type 24 has an invalid length. [ 755.769091][T27704] geneve3: entered promiscuous mode [ 755.769116][T27704] geneve3: entered allmulticast mode [ 755.788881][T27700] netlink: 'syz.3.5666': attribute type 1 has an invalid length. [ 755.806472][T25465] netdevsim netdevsim4 netdevsim0: set [1, 1] type 2 family 0 port 256 - 0 [ 755.806520][T25465] netdevsim netdevsim4 netdevsim1: set [1, 1] type 2 family 0 port 256 - 0 [ 755.806558][T25465] netdevsim netdevsim4 netdevsim2: set [1, 1] type 2 family 0 port 256 - 0 [ 755.806595][T25465] netdevsim netdevsim4 netdevsim3: set [1, 1] type 2 family 0 port 256 - 0 [ 755.854807][T27710] rxe_eth0 speed is unknown, defaulting to 1000 [ 756.020592][T27708] netlink: 'syz.3.5666': attribute type 3 has an invalid length. [ 756.020616][T27708] netlink: 666 bytes leftover after parsing attributes in process `syz.3.5666'. [ 756.178198][T27716] netlink: 72 bytes leftover after parsing attributes in process `syz.1.5671'. [ 756.201738][T27716] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 757.154405][T27740] netlink: 'syz.0.5676': attribute type 2 has an invalid length. [ 757.171803][T27740] netlink: 8 bytes leftover after parsing attributes in process `syz.0.5676'. [ 757.291823][T27710] wg0 speed is unknown, defaulting to 1000 [ 757.645996][T27752] netlink: 216 bytes leftover after parsing attributes in process `syz.4.5682'. [ 757.687986][T27752] netlink: 5196 bytes leftover after parsing attributes in process `syz.4.5682'. [ 757.987227][T27764] netlink: 'syz.0.5685': attribute type 8 has an invalid length. [ 758.091590][T27776] netlink: 'syz.0.5685': attribute type 8 has an invalid length. [ 758.191952][T27780] netlink: 8 bytes leftover after parsing attributes in process `syz.1.5688'. [ 759.237545][T27802] netlink: 'syz.1.5693': attribute type 10 has an invalid length. [ 759.269926][T27802] team0: Device wg2 is of different type [ 759.428464][T27817] xt_REDIRECT: bad rangesize 26624. [ 759.511138][T27820] netlink: 'syz.1.5698': attribute type 6 has an invalid length. [ 759.946657][T27825] sctp: [Deprecated]: syz.0.5699 (pid 27825) Use of int in max_burst socket option deprecated. [ 759.946657][T27825] Use struct sctp_assoc_value instead [ 760.037594][T27829] bridge1: entered promiscuous mode [ 760.037809][T27829] bridge1: entered allmulticast mode [ 760.096391][T27829] team0: Port device bridge1 added [ 760.135066][T27836] netlink: 'syz.4.5702': attribute type 62 has an invalid length. [ 760.180329][T27835] 8021q: adding VLAN 0 to HW filter on device bond11 [ 760.181635][T27835] bridge0: port 1(bond11) entered blocking state [ 760.181757][T27835] bridge0: port 1(bond11) entered disabled state [ 760.181924][T27835] bond11: entered allmulticast mode [ 760.221838][T27835] bond11: entered promiscuous mode [ 760.282105][T27841] netlink: 'syz.4.5702': attribute type 62 has an invalid length. [ 760.382883][T27837] bridge0: port 3(team0) entered blocking state [ 760.383391][T27837] bridge0: port 3(team0) entered disabled state [ 760.383751][T27837] team0: entered allmulticast mode [ 760.383770][T27837] team_slave_0: entered allmulticast mode [ 760.384204][T27837] team_slave_1: entered allmulticast mode [ 760.384615][T27837] dummy0: entered allmulticast mode [ 760.444909][T27837] team0: entered promiscuous mode [ 760.444937][T27837] team_slave_0: entered promiscuous mode [ 760.445926][T27837] team_slave_1: entered promiscuous mode [ 760.446880][T27837] dummy0: entered promiscuous mode [ 760.524476][ T6966] bridge0: port 3(team0) entered blocking state [ 760.524596][ T6966] bridge0: port 3(team0) entered forwarding state [ 760.637906][T27843] 8021q: adding VLAN 0 to HW filter on device bond12 [ 760.651559][T27843] bridge0: port 2(bond12) entered blocking state [ 760.651682][T27843] bridge0: port 2(bond12) entered disabled state [ 760.651841][T27843] bond12: entered allmulticast mode [ 760.679861][T27843] bond12: entered promiscuous mode [ 761.057452][T27871] x_tables: duplicate underflow at hook 3 [ 761.269965][T27880] nbd: nbd0 already in use [ 761.280330][T27868] xt_hashlimit: size too large, truncated to 1048576 [ 761.281949][T27871] __nla_validate_parse: 3 callbacks suppressed [ 761.281968][T27871] netlink: 45349 bytes leftover after parsing attributes in process `syz.0.5709'. [ 761.282120][T27871] 0ªX¹¦Dö»: renamed from gretap0 (while UP) [ 761.351135][T27871] 0ªX¹¦Dö»: entered allmulticast mode [ 761.417352][T27884] openvswitch: netlink: Port 536870913 exceeds max allowable 65535 [ 761.535975][T27887] netlink: 100 bytes leftover after parsing attributes in process `syz.3.5713'. [ 761.892201][T27894] netlink: 16 bytes leftover after parsing attributes in process `syz.3.5715'. [ 762.348815][T27905] netlink: 15 bytes leftover after parsing attributes in process `syz.2.5714'. [ 762.900670][T27918] Bluetooth: hci0: Opcode 0x0401 failed: -22 [ 766.640020][T27945] netlink: 12 bytes leftover after parsing attributes in process `syz.4.5723'. [ 766.855339][T27950] netlink: 4595 bytes leftover after parsing attributes in process `syz.2.5725'. [ 766.855660][T27952] netlink: 4595 bytes leftover after parsing attributes in process `syz.2.5725'. [ 766.887924][T27950] netlink: 4595 bytes leftover after parsing attributes in process `syz.2.5725'. [ 766.974561][T27951] netlink: 8 bytes leftover after parsing attributes in process `syz.1.5724'. [ 766.974591][T27951] netlink: 8 bytes leftover after parsing attributes in process `syz.1.5724'. [ 767.378017][T27966] netlink: 4 bytes leftover after parsing attributes in process `syz.2.5728'. [ 768.173984][T27992] netlink: 28 bytes leftover after parsing attributes in process `syz.4.5735'. [ 768.301796][T27992] netlink: 56 bytes leftover after parsing attributes in process `syz.4.5735'. [ 769.241243][T28024] ip_tables: iptables: counters copy to user failed while replacing table [ 769.636707][T28036] netlink: 596 bytes leftover after parsing attributes in process `syz.1.5744'. [ 770.424695][T28060] tipc: Enabled bearer , priority 11 [ 770.432155][T28064] tipc: Enabling of bearer rejected, already enabled [ 770.492555][T28074] sctp: [Deprecated]: syz.4.5752 (pid 28074) Use of int in max_burst socket option. [ 770.492555][T28074] Use struct sctp_assoc_value instead [ 771.007944][T28087] netlink: 'syz.3.5755': attribute type 4 has an invalid length. [ 771.841856][T28118] ipvlan2: entered allmulticast mode [ 771.841880][T28118] virt_wifi0: entered allmulticast mode [ 771.861622][T28118] batman_adv: batadv0: Adding interface: ipvlan2 [ 771.861649][T28118] batman_adv: batadv0: The MTU of interface ipvlan2 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 771.861679][T28118] batman_adv: batadv0: Not using interface ipvlan2 (retrying later): interface not active [ 772.030396][T28127] geneve0: Caught tx_queue_len zero misconfig [ 772.199955][T28128] rdma_rxe: rxe_newlink: failed to add wg1 [ 773.283252][T28161] rxe_eth0 speed is unknown, defaulting to 1000 [ 773.745534][T28173] bridge0: port 4(veth0) entered blocking state [ 773.745655][T28173] bridge0: port 4(veth0) entered disabled state [ 773.745846][T28173] veth0: entered allmulticast mode [ 773.775420][T28173] veth0: entered promiscuous mode [ 774.086244][T28184] __nla_validate_parse: 5 callbacks suppressed [ 774.086269][T28184] netlink: 40 bytes leftover after parsing attributes in process `syz.0.5780'. [ 774.237905][T28181] IPVS: set_ctl: invalid protocol: 0 0.0.0.0:0 [ 774.318526][T28161] wg0 speed is unknown, defaulting to 1000 [ 774.524314][T28196] openvswitch: netlink: VXLAN extension message has 1 unknown bytes. [ 774.621387][T28206] IPv6: NLM_F_CREATE should be specified when creating new route [ 774.621480][T28206] netlink: 12 bytes leftover after parsing attributes in process `syz.1.5785'. [ 776.658593][T28264] openvswitch: netlink: nsh attribute has 1 unknown bytes. [ 777.219800][T28287] netlink: 112 bytes leftover after parsing attributes in process `syz.0.5800'. [ 777.475892][T28295] netlink: 'syz.4.5802': attribute type 1 has an invalid length. [ 777.475919][T28295] netlink: 224 bytes leftover after parsing attributes in process `syz.4.5802'. [ 778.998296][T28340] netlink: 20 bytes leftover after parsing attributes in process `syz.1.5812'. [ 779.381511][T28358] openvswitch: netlink: Tunnel attr 229 out of range max 16 [ 780.157294][T28391] netlink: Conntrack attr has 8 unknown bytes [ 780.286246][T28397] xt_TCPMSS: Only works on TCP SYN packets [ 780.310733][T28395] netlink: 8 bytes leftover after parsing attributes in process `syz.1.5819'. [ 780.517122][T28394] syzkaller0: entered promiscuous mode [ 780.517148][T28394] syzkaller0: entered allmulticast mode [ 780.720483][T28303] udevd[28303]: inotify_add_watch(7, /dev/nbd64, 10) failed: No such file or directory [ 780.960850][T28407] netlink: 4 bytes leftover after parsing attributes in process `syz.4.5821'. [ 781.010275][T28407] x_tables: duplicate underflow at hook 1 [ 781.234066][T28417] netlink: 16 bytes leftover after parsing attributes in process `syz.0.5825'. [ 781.391782][T28422] netlink: 12 bytes leftover after parsing attributes in process `syz.3.5828'. [ 781.634980][T28427] x_tables: ip_tables: osf match: only valid for protocol 6 [ 782.141014][T28454] netlink: 'syz.3.5834': attribute type 1 has an invalid length. [ 782.167795][T28459] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 782.409136][T28466] netlink: 16 bytes leftover after parsing attributes in process `syz.0.5839'. [ 783.039873][T28489] netlink: 'syz.3.5849': attribute type 1 has an invalid length. [ 783.671448][T28509] netlink: 16 bytes leftover after parsing attributes in process `syz.3.5853'. [ 784.099381][T28518] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 784.252118][T28524] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 784.278881][T28524] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 784.438216][T28528] bond8: option fail_over_mac: invalid value (16) [ 784.440285][T28528] bond8 (unregistering): Released all slaves [ 785.104235][T28545] netlink: 12 bytes leftover after parsing attributes in process `syz.1.5866'. [ 785.257078][T28550] netlink: 16 bytes leftover after parsing attributes in process `syz.0.5868'. [ 785.556774][T28544] bridge0: port 2(bridge_slave_1) entered blocking state [ 785.556912][T28544] bridge0: port 2(bridge_slave_1) entered forwarding state [ 785.558889][T28544] bridge0: left promiscuous mode [ 785.648887][T28561] sctp: [Deprecated]: syz.4.5870 (pid 28561) Use of int in maxseg socket option. [ 785.648887][T28561] Use struct sctp_assoc_value instead [ 785.740549][T28544] A link change request failed with some changes committed already. Interface bridge_slave_0 may have been left with an inconsistent configuration, please check. [ 785.808968][ T1159] bridge0: port 1(bridge_slave_0) entered blocking state [ 785.809106][ T1159] bridge0: port 1(bridge_slave_0) entered forwarding state [ 786.159280][T20865] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 786.177660][T20865] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 786.186625][T20865] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 786.217741][T20865] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 786.343085][T20865] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 786.406521][ T53] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 786.409819][ T53] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 786.410204][ T53] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 786.411292][ T53] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 786.412120][ T53] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 787.279517][T28602] syzkaller1: entered promiscuous mode [ 787.279727][T28602] syzkaller1: entered allmulticast mode [ 787.388837][T28601] netlink: 12 bytes leftover after parsing attributes in process `syz.2.5881'. [ 787.407994][T28601] netlink: 44 bytes leftover after parsing attributes in process `syz.2.5881'. [ 787.635443][T28615] syzkaller0: left promiscuous mode [ 787.635470][T28615] syzkaller0: left allmulticast mode [ 787.736963][T28572] rxe_eth0 speed is unknown, defaulting to 1000 [ 788.251223][T28627] netlink: 44 bytes leftover after parsing attributes in process `syz.4.5887'. [ 788.463191][ T53] Bluetooth: hci3: command tx timeout [ 788.720095][T28572] wg0 speed is unknown, defaulting to 1000 [ 789.550468][T28646] netlink: 8 bytes leftover after parsing attributes in process `syz.3.5892'. [ 789.814858][T28655] netlink: 16 bytes leftover after parsing attributes in process `syz.4.5895'. [ 790.319963][T28572] bridge0: port 1(bridge_slave_0) entered blocking state [ 790.320085][T28572] bridge0: port 1(bridge_slave_0) entered disabled state [ 790.320260][T28572] bridge_slave_0: entered allmulticast mode [ 790.348084][T28572] bridge_slave_0: entered promiscuous mode [ 790.364636][T28572] bridge0: port 2(bridge_slave_1) entered blocking state [ 790.367075][T28572] bridge0: port 2(bridge_slave_1) entered disabled state [ 790.367235][T28572] bridge_slave_1: entered allmulticast mode [ 790.396873][T28572] bridge_slave_1: entered promiscuous mode [ 790.537039][T28572] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 790.552700][ T53] Bluetooth: hci3: command tx timeout [ 790.571002][T28572] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 790.781282][T28572] team0: Port device team_slave_0 added [ 790.821147][T28572] team0: Port device team_slave_1 added [ 791.019903][T28572] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 791.019923][T28572] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 791.019951][T28572] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 791.060040][T28572] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 791.060060][T28572] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 791.060096][T28572] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 791.540928][T28572] hsr_slave_0: entered promiscuous mode [ 791.542117][T28572] hsr_slave_1: entered promiscuous mode [ 791.554750][T28703] netlink: 40 bytes leftover after parsing attributes in process `syz.3.5907'. [ 791.566039][T28685] syzkaller0: entered promiscuous mode [ 791.566062][T28685] syzkaller0: entered allmulticast mode [ 792.388755][T28725] netlink: 'syz.4.5911': attribute type 5 has an invalid length. [ 792.388779][T28725] netlink: 52 bytes leftover after parsing attributes in process `syz.4.5911'. [ 792.434966][T28728] netlink: 36 bytes leftover after parsing attributes in process `syz.4.5911'. [ 792.490757][T28727] netlink: 'syz.2.5910': attribute type 1 has an invalid length. [ 792.527661][T28726] A link change request failed with some changes committed already. Interface C may have been left with an inconsistent configuration, please check. [ 792.551010][T28726] A link change request failed with some changes committed already. Interface C may have been left with an inconsistent configuration, please check. [ 792.585626][T28726] A link change request failed with some changes committed already. Interface C may have been left with an inconsistent configuration, please check. [ 792.590395][T28726] A link change request failed with some changes committed already. Interface C may have been left with an inconsistent configuration, please check. [ 792.625959][ T53] Bluetooth: hci3: command tx timeout [ 792.636351][T28726] A link change request failed with some changes committed already. Interface C may have been left with an inconsistent configuration, please check. [ 792.821334][T28726] A link change request failed with some changes committed already. Interface C may have been left with an inconsistent configuration, please check. [ 792.915433][T28726] A link change request failed with some changes committed already. Interface C may have been left with an inconsistent configuration, please check. [ 793.080453][T28572] netdevsim netdevsim0 netdevsim3 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 793.080496][T28572] netdevsim netdevsim0 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 793.080527][T28572] netdevsim netdevsim0 netdevsim3 (unregistering): unset [1, 1] type 2 family 0 port 19999 - 0 [ 793.137277][T28726] A link change request failed with some changes committed already. Interface C may have been left with an inconsistent configuration, please check. [ 793.141989][T28726] A link change request failed with some changes committed already. Interface C may have been left with an inconsistent configuration, please check. [ 793.280915][T28726] A link change request failed with some changes committed already. Interface C may have been left with an inconsistent configuration, please check. [ 793.436736][T28572] netdevsim netdevsim0 netdevsim2 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 793.436779][T28572] netdevsim netdevsim0 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 793.436810][T28572] netdevsim netdevsim0 netdevsim2 (unregistering): unset [1, 1] type 2 family 0 port 19999 - 0 [ 793.939510][T28572] netdevsim netdevsim0 netdevsim1 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 793.939553][T28572] netdevsim netdevsim0 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 793.989706][T28572] netdevsim netdevsim0 netdevsim1 (unregistering): unset [1, 1] type 2 family 0 port 19999 - 0 [ 794.269519][T28572] netdevsim netdevsim0 netdevsim0 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 794.272100][T28572] netdevsim netdevsim0 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 794.272138][T28572] netdevsim netdevsim0 netdevsim0 (unregistering): unset [1, 1] type 2 family 0 port 19999 - 0 [ 794.702709][ T53] Bluetooth: hci3: command tx timeout [ 794.897526][T28784] netlink: 4 bytes leftover after parsing attributes in process `syz.1.5924'. [ 795.107589][T28790] x_tables: ip6_tables: rpfilter match: used from hooks OUTPUT, but only valid from PREROUTING [ 796.031924][T28572] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 796.056592][T28572] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 796.061172][T28572] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 796.100916][T28572] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 796.113168][T28572] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 796.135778][T28572] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 796.136713][T28572] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 796.182677][T28572] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 796.471712][T28815] xt_limit: Overflow, try lower: 536871034/127 [ 796.540704][T28817] netlink: 'syz.3.5933': attribute type 12 has an invalid length. [ 796.540731][T28817] netlink: 'syz.3.5933': attribute type 29 has an invalid length. [ 796.540747][T28817] netlink: 148 bytes leftover after parsing attributes in process `syz.3.5933'. [ 796.540767][T28817] netlink: 59 bytes leftover after parsing attributes in process `syz.3.5933'. [ 796.683673][T28822] netlink: 16 bytes leftover after parsing attributes in process `syz.2.5935'. [ 796.746449][T28572] 8021q: adding VLAN 0 to HW filter on device bond0 [ 796.804633][T28572] 8021q: adding VLAN 0 to HW filter on device team0 [ 796.834047][ T6968] bridge0: port 1(bridge_slave_0) entered blocking state [ 796.834159][ T6968] bridge0: port 1(bridge_slave_0) entered forwarding state [ 796.893063][T25464] bridge0: port 2(bridge_slave_1) entered blocking state [ 796.893203][T25464] bridge0: port 2(bridge_slave_1) entered forwarding state [ 797.237734][T28837] 8021q: VLANs not supported on syzkaller0 [ 797.238870][T28837] syzkaller0: left promiscuous mode [ 797.238891][T28837] syzkaller0: left allmulticast mode [ 797.301886][T28837] syzkaller1: entered promiscuous mode [ 797.301912][T28837] syzkaller1: entered allmulticast mode [ 798.756804][T28877] bond0: option ad_user_port_key: mode dependency failed, not supported in mode balance-rr(0) [ 799.015611][T28896] netlink: 28 bytes leftover after parsing attributes in process `syz.4.5950'. [ 799.442962][T28905] net_ratelimit: 2 callbacks suppressed [ 799.442985][T28905] ip_tables: iptables: counters copy to user failed while replacing table [ 799.448064][T28905] ip_tables: iptables: counters copy to user failed while replacing table [ 799.451107][T28905] 8021q: VLANs not supported on syzkaller0 [ 799.636670][T28572] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 799.705058][T28905] syzkaller1: entered promiscuous mode [ 799.705085][T28905] syzkaller1: entered allmulticast mode [ 800.061082][T28572] veth0_vlan: entered promiscuous mode [ 800.104341][T28572] veth1_vlan: entered promiscuous mode [ 800.170717][T28918] FAULT_INJECTION: forcing a failure. [ 800.170717][T28918] name failslab, interval 1, probability 0, space 0, times 0 [ 800.170752][T28918] CPU: 0 UID: 0 PID: 28918 Comm: syz.3.5956 Not tainted syzkaller #0 PREEMPT(full) [ 800.170792][T28918] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/15/2026 [ 800.170815][T28918] Call Trace: [ 800.170823][T28918] [ 800.170833][T28918] dump_stack_lvl+0xe8/0x150 [ 800.170876][T28918] should_fail_ex+0x3eb/0x540 [ 800.170909][T28918] ? __alloc_skb+0x1db/0x7a0 [ 800.170962][T28918] should_failslab+0xa8/0x100 [ 800.170998][T28918] ? __alloc_skb+0x1db/0x7a0 [ 800.171029][T28918] kmem_cache_alloc_node_noprof+0x9c/0x600 [ 800.171057][T28918] ? __alloc_skb+0x18d/0x7a0 [ 800.171092][T28918] ? __alloc_skb+0x1db/0x7a0 [ 800.171141][T28918] __alloc_skb+0x1db/0x7a0 [ 800.171187][T28918] rtmsg_ifinfo_build_skb+0x7f/0x260 [ 800.171303][T28918] ? ip6_route_dev_notify+0x9a/0x5b0 [ 800.171415][T28918] rtmsg_ifinfo+0x8c/0x1a0 [ 800.171456][T28918] netif_state_change+0x297/0x3a0 [ 800.171519][T28918] ? __pfx_netif_state_change+0x10/0x10 [ 800.171553][T28918] ? kasan_quarantine_put+0xbb/0x1f0 [ 800.171582][T28918] ? lockdep_hardirqs_on+0x7b/0x110 [ 800.171621][T28918] netdev_state_change+0xf7/0x210 [ 800.171675][T28918] rtnl_linkprop+0x6c4/0x7d0 [ 800.171711][T28918] ? __pfx_rtnl_linkprop+0x10/0x10 [ 800.171824][T28918] ? lock_acquire+0x115/0x350 [ 800.171871][T28918] ? __pfx_rtnl_dellinkprop+0x10/0x10 [ 800.171895][T28918] rtnetlink_rcv_msg+0x7b9/0xc00 [ 800.171923][T28918] ? rtnetlink_rcv_msg+0x1c9/0xc00 [ 800.171946][T28918] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 800.171985][T28918] ? __copy_skb_header+0xa3/0x4a0 [ 800.172023][T28918] netlink_rcv_skb+0x226/0x4a0 [ 800.172056][T28918] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 800.172082][T28918] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 800.172138][T28918] ? netlink_deliver_tap+0x2e/0x1b0 [ 800.172169][T28918] ? netlink_deliver_tap+0x2e/0x1b0 [ 800.172207][T28918] netlink_unicast+0x8ef/0xa80 [ 800.172257][T28918] netlink_sendmsg+0x7f0/0xb20 [ 800.172296][T28918] ? __pfx_netlink_sendmsg+0x10/0x10 [ 800.172333][T28918] ? aa_sock_msg_perm+0x144/0x210 [ 800.172373][T28918] ? apparmor_socket_sendmsg+0x98/0x360 [ 800.172424][T28918] ? __pfx_netlink_sendmsg+0x10/0x10 [ 800.172454][T28918] sock_sendmsg_nosec+0x14e/0x190 [ 800.172487][T28918] ____sys_sendmsg+0x54e/0x850 [ 800.172517][T28918] ? __pfx_____sys_sendmsg+0x10/0x10 [ 800.172552][T28918] ? import_iovec+0x73/0xa0 [ 800.172584][T28918] ___sys_sendmsg+0x2a5/0x360 [ 800.172606][T28918] ? __lock_acquire+0x747/0x2de0 [ 800.172639][T28918] ? __pfx____sys_sendmsg+0x10/0x10 [ 800.172706][T28918] ? __fget_files+0x3a2/0x420 [ 800.172732][T28918] ? __fget_files+0x2a/0x420 [ 800.172769][T28918] __x64_sys_sendmsg+0x1b1/0x290 [ 800.172814][T28918] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 800.172865][T28918] do_syscall_64+0x166/0x520 [ 800.172891][T28918] ? trace_irq_disable+0x3b/0x140 [ 800.172923][T28918] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 800.172959][T28918] ? clear_bhb_loop+0x70/0xc0 [ 800.172987][T28918] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 800.173009][T28918] RIP: 0033:0x7fa7e7b9f559 [ 800.173031][T28918] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 800.173049][T28918] RSP: 002b:00007fa7e89d2028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 800.173073][T28918] RAX: ffffffffffffffda RBX: 00007fa7e7e25fa0 RCX: 00007fa7e7b9f559 [ 800.173090][T28918] RDX: 0000000000000000 RSI: 0000200000000140 RDI: 0000000000000003 [ 800.173105][T28918] RBP: 00007fa7e89d2090 R08: 0000000000000000 R09: 0000000000000000 [ 800.173127][T28918] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 800.173140][T28918] R13: 00007fa7e7e26038 R14: 00007fa7e7e25fa0 R15: 00007ffd5bdd8228 [ 800.173177][T28918] [ 800.740199][T28572] veth0_macvtap: entered promiscuous mode [ 800.798999][T28572] veth1_macvtap: entered promiscuous mode [ 800.940560][T28572] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 800.984972][T28572] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 801.053943][ T6968] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 801.158153][ T6968] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 801.158443][ T6968] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 801.164209][ T6966] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 801.649514][ T1159] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 801.649538][ T1159] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 801.727919][ T6968] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 801.727942][ T6968] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 802.107945][T28953] netlink: 32 bytes leftover after parsing attributes in process `syz.2.5962'. [ 802.108010][T28953] netlink: 32 bytes leftover after parsing attributes in process `syz.2.5962'. [ 802.448349][T28953] netlink: 32 bytes leftover after parsing attributes in process `syz.2.5962'. [ 802.448418][T28953] netlink: 32 bytes leftover after parsing attributes in process `syz.2.5962'. [ 803.105558][T28967] ip_tables: iptables: counters copy to user failed while replacing table [ 803.150067][T28967] ip_tables: iptables: counters copy to user failed while replacing table [ 803.229962][T20865] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 803.244610][T20865] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 803.247129][T20865] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 803.250502][T20865] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 803.251199][T20865] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 803.817080][T28980] netlink: 12 bytes leftover after parsing attributes in process `syz.4.5969'. [ 803.835704][T28980] netlink: 8 bytes leftover after parsing attributes in process `syz.4.5969'. [ 804.060621][T28986] nbd: must specify a size in bytes for the device [ 804.300264][T28993] netlink: 88 bytes leftover after parsing attributes in process `syz.4.5973'. [ 804.320893][T28995] netlink: 40 bytes leftover after parsing attributes in process `syz.1.5974'. [ 804.805677][T29014] netlink: 36 bytes leftover after parsing attributes in process `syz.4.5979'. [ 804.861783][T28969] rxe_eth0 speed is unknown, defaulting to 1000 [ 805.424340][T20865] Bluetooth: hci2: command tx timeout [ 805.479477][T29027] ip_tables: iptables: counters copy to user failed while replacing table [ 805.508002][T29027] ip_tables: iptables: counters copy to user failed while replacing table [ 805.525025][T29027] 8021q: VLANs not supported on syzkaller0 [ 805.548646][T29028] netlink: 12 bytes leftover after parsing attributes in process `syz.1.5985'. [ 805.617427][T29028] xfrm1: entered promiscuous mode [ 805.617453][T29028] xfrm1: entered allmulticast mode [ 805.629996][T28969] wg0 speed is unknown, defaulting to 1000 [ 806.125683][T28436] IPVS: starting estimator thread 0... [ 806.212875][T29044] IPVS: using max 23 ests per chain, 55200 per kthread [ 806.269867][T29049] netlink: 28 bytes leftover after parsing attributes in process `syz.4.5991'. [ 806.403789][T29056] IPv6: sit2: Disabled Multicast RS [ 806.647454][T29055] netlink: 24 bytes leftover after parsing attributes in process `syz.1.5993'. [ 807.079514][T29075] netlink: 104 bytes leftover after parsing attributes in process `syz.4.5997'. [ 807.204689][T29080] xt_time: unknown flags 0x68 [ 807.409357][T28969] bridge0: port 1(bridge_slave_0) entered blocking state [ 807.409876][T28969] bridge0: port 1(bridge_slave_0) entered disabled state [ 807.410787][T28969] bridge_slave_0: entered allmulticast mode [ 807.437903][T28969] bridge_slave_0: entered promiscuous mode [ 807.459895][T28969] bridge0: port 2(bridge_slave_1) entered blocking state [ 807.460020][T28969] bridge0: port 2(bridge_slave_1) entered disabled state [ 807.460179][T28969] bridge_slave_1: entered allmulticast mode [ 807.487821][T28969] bridge_slave_1: entered promiscuous mode [ 807.504088][T20865] Bluetooth: hci2: command tx timeout [ 807.629634][T29098] ip_tables: iptables: counters copy to user failed while replacing table [ 807.634302][T29097] ip_tables: iptables: counters copy to user failed while replacing table [ 807.810266][T28969] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 807.830450][T29100] netlink: 228 bytes leftover after parsing attributes in process `syz.0.6002'. [ 807.927859][T28969] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 808.126785][T28969] team0: Port device team_slave_0 added [ 808.145533][T28969] team0: Port device team_slave_1 added [ 808.446832][T28969] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 808.446854][T28969] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 808.446891][T28969] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 808.455220][T28969] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 808.455265][T28969] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 808.455354][T28969] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 808.814113][T28969] hsr_slave_0: entered promiscuous mode [ 808.819130][T28969] hsr_slave_1: entered promiscuous mode [ 808.824373][T28969] debugfs: 'hsr0' already exists in 'hsr' [ 808.824436][T28969] Cannot create hsr debugfs directory [ 808.868170][ T1319] ieee802154 phy1 wpan1: encryption failed: -22 [ 809.554968][T29134] netlink: 40 bytes leftover after parsing attributes in process `syz.1.6013'. [ 809.583894][T20865] Bluetooth: hci2: command tx timeout [ 809.881015][T29136] netlink: 12 bytes leftover after parsing attributes in process `syz.4.6014'. [ 809.993582][T29148] netlink: 44 bytes leftover after parsing attributes in process `syz.4.6014'. [ 810.001294][T28969] netdevsim netdevsim3 netdevsim3 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 810.001333][T28969] netdevsim netdevsim3 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 810.213117][T29152] ip_tables: iptables: counters copy to user failed while replacing table [ 810.253580][T29152] ip_tables: iptables: counters copy to user failed while replacing table [ 810.378792][T28969] netdevsim netdevsim3 netdevsim2 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 810.378835][T28969] netdevsim netdevsim3 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 810.438326][T29153] 8021q: VLANs not supported on syzkaller0 [ 810.607557][T28969] netdevsim netdevsim3 netdevsim1 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 810.607598][T28969] netdevsim netdevsim3 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 810.671759][T29161] netlink: 36 bytes leftover after parsing attributes in process `syz.0.6019'. [ 810.837253][T28969] netdevsim netdevsim3  (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 810.837295][T28969] netdevsim netdevsim3  (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 811.287551][T29172] Unknown options in mask 4 [ 811.355060][T29176] IPv6: addrconf: prefix option has invalid lifetime [ 811.356307][T29176] netlink: 4 bytes leftover after parsing attributes in process `syz.0.6025'. [ 811.664906][T20865] Bluetooth: hci2: command tx timeout [ 811.680262][T29182] syzkaller0: entered promiscuous mode [ 811.680310][T29182] syzkaller0: entered allmulticast mode [ 812.025069][T28969] netdevsim netdevsim3 netdevsim0: renamed from eth0 [ 812.044233][T28969] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 812.046781][T28969] netdevsim netdevsim3 netdevsim1: renamed from eth1 [ 812.080538][T28969] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 812.093308][T28969] netdevsim netdevsim3 netdevsim2: renamed from eth2 [ 812.125537][T28969] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 812.191571][T28969] netdevsim netdevsim3 netdevsim3: renamed from eth3 [ 812.216037][T28969] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 812.349746][T29206] ip_tables: iptables: counters copy to user failed while replacing table [ 812.381198][T29206] ip_tables: iptables: counters copy to user failed while replacing table [ 812.406792][T29206] 8021q: VLANs not supported on syzkaller0 [ 812.419769][T29206] syzkaller0: left promiscuous mode [ 812.419794][T29206] syzkaller0: left allmulticast mode [ 812.422209][T29209] netlink: 12 bytes leftover after parsing attributes in process `syz.0.6032'. [ 812.451626][T29209] netlink: 44 bytes leftover after parsing attributes in process `syz.0.6032'. [ 812.921514][T28969] 8021q: adding VLAN 0 to HW filter on device bond0 [ 812.997095][T28969] 8021q: adding VLAN 0 to HW filter on device team0 [ 813.036615][ T6964] bridge0: port 1(bridge_slave_0) entered blocking state [ 813.036733][ T6964] bridge0: port 1(bridge_slave_0) entered forwarding state [ 813.091711][ T6974] bridge0: port 2(bridge_slave_1) entered blocking state [ 813.091829][ T6974] bridge0: port 2(bridge_slave_1) entered forwarding state [ 813.229016][T29218] netlink: 28 bytes leftover after parsing attributes in process `syz.1.6035'. [ 813.229058][T29218] netlink: 28 bytes leftover after parsing attributes in process `syz.1.6035'. [ 813.278835][T29221] netlink: 'syz.2.6036': attribute type 2 has an invalid length. [ 813.282084][T29218] 0ªî{X¹¦: entered promiscuous mode [ 813.301161][T29218] 0ªî{X¹¦: left promiscuous mode [ 813.807882][T29231] netlink: 16 bytes leftover after parsing attributes in process `syz.4.6038'. [ 814.500298][T29259] xt_hashlimit: size too large, truncated to 1048576 [ 814.527906][T29257] ip_tables: iptables: counters copy to user failed while replacing table [ 814.596054][T29257] ip_tables: iptables: counters copy to user failed while replacing table [ 815.119558][T28969] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 815.188920][T29278] netlink: 12 bytes leftover after parsing attributes in process `syz.0.6049'. [ 815.306746][T29283] netlink: 44 bytes leftover after parsing attributes in process `syz.0.6049'. [ 815.498994][T28969] veth0_vlan: entered promiscuous mode [ 815.556564][T28969] veth1_vlan: entered promiscuous mode [ 815.650169][T29285] netlink: 24 bytes leftover after parsing attributes in process `syz.4.6052'. [ 815.707356][T28969] veth0_macvtap: entered promiscuous mode [ 815.739137][T28969] veth1_macvtap: entered promiscuous mode [ 815.830290][T28969] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 815.926312][T28969] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 816.056018][ T6974] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 816.076465][ T6974] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 816.076966][ T6974] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 816.077009][ T6974] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 816.302275][T29295] Bluetooth: hci0: Opcode 0x0c20 failed: -22 [ 816.338842][T29295] netlink: 'syz.1.6056': attribute type 32 has an invalid length. [ 816.338867][T29295] netlink: 56 bytes leftover after parsing attributes in process `syz.1.6056'. [ 816.446107][ T6964] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 816.446131][ T6964] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 816.660500][ T6968] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 816.660526][ T6968] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 816.955301][T29310] xt_limit: Overflow, try lower: 536871034/127 [ 816.959310][T29310] Can not set IPV6_FL_F_REFLECT if flowlabel_consistency sysctl is enable [ 816.960535][T29310] Cannot find add_set index 4 as target [ 817.087975][T29313] ip_tables: iptables: counters copy to user failed while replacing table [ 817.163587][T29313] ip_tables: iptables: counters copy to user failed while replacing table [ 817.360257][T29313] syzkaller1: entered promiscuous mode [ 817.360470][T29313] syzkaller1: entered allmulticast mode [ 817.394689][T29320] netlink: 48 bytes leftover after parsing attributes in process `syz.2.6063'. [ 817.443698][T29320] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 817.550995][T29320] netlink: 28 bytes leftover after parsing attributes in process `syz.2.6063'. [ 817.566454][T29323] netlink: 260 bytes leftover after parsing attributes in process `syz.2.6063'. [ 817.567531][T29320] netlink: 260 bytes leftover after parsing attributes in process `syz.2.6063'. [ 817.631383][T29323] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 817.705277][T29326] netlink: 'syz.2.6063': attribute type 1 has an invalid length. [ 817.705302][T29326] netlink: 'syz.2.6063': attribute type 2 has an invalid length. [ 817.705318][T29326] netlink: 12 bytes leftover after parsing attributes in process `syz.2.6063'. [ 817.739995][T29326] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 818.249992][T29348] ------------[ cut here ]------------ [ 818.250009][T29348] sp->magic != HWSIM_STA_MAGIC [ 818.250036][T29348] WARNING: drivers/net/wireless/virtual/mac80211_hwsim_main.c:258 at mac80211_hwsim_tx+0x1d04/0x25b0, CPU#1: syz.1.6069/29348 [ 818.273698][T29348] Modules linked in: [ 818.277667][T29348] CPU: 1 UID: 0 PID: 29348 Comm: syz.1.6069 Not tainted syzkaller #0 PREEMPT(full) [ 818.287157][T29348] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/15/2026 [ 818.297325][T29348] RIP: 0010:mac80211_hwsim_tx+0x1d04/0x25b0 [ 818.303359][T29348] Code: e8 03 42 0f b6 04 20 84 c0 0f 85 0b 08 00 00 45 0f b6 8d 71 08 00 00 4c 89 ee 67 48 0f b9 3a e9 c4 f4 ff ff e8 9d 04 7a fa 90 <0f> 0b 90 e9 27 f5 ff ff e8 8f 04 7a fa 90 0f 0b 90 48 8b 7c 24 20 [ 818.323067][T29348] RSP: 0018:ffffc90003df6b60 EFLAGS: 00010293 [ 818.329243][T29348] RAX: ffffffff874f1133 RBX: 0000000000000000 RCX: ffff88807d2f5dc0 [ 818.337324][T29348] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 000000006d537749 [ 818.345381][T29348] RBP: ffffc90003df6cf0 R08: ffff88805358464f R09: 0000000000000000 [ 818.353485][T29348] R10: ffff888053584640 R11: ffffffff874ef430 R12: dffffc0000000000 [ 818.361517][T29348] R13: 00000000ffffffff R14: 0000000000000000 R15: 1ffff920007bedb8 [ 818.369596][T29348] FS: 00007f8bed2946c0(0000) GS:ffff88812371f000(0000) knlGS:0000000000000000 [ 818.378638][T29348] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 818.385293][T29348] CR2: 0000200000001000 CR3: 00000000572c4000 CR4: 00000000003526f0 [ 818.393358][T29348] Call Trace: [ 818.396679][T29348] [ 818.399692][T29348] ? __pfx_mac80211_hwsim_tx+0x10/0x10 [ 818.405278][T29348] ieee80211_tx_frags+0x3df/0x890 [ 818.410476][T29348] ? __pfx_ieee80211_tx_frags+0x10/0x10 [ 818.416217][T29348] __ieee80211_xmit_fast+0xabf/0x2160 [ 818.421662][T29348] ? __flow_hash_from_keys+0x431/0x6c0 [ 818.427242][T29348] ? cfg80211_classify8021d+0x67e/0x1220 [ 818.433081][T29348] ? __pfx___ieee80211_xmit_fast+0x10/0x10 [ 818.438952][T29348] ? lock_acquire+0x115/0x350 [ 818.443788][T29348] ? ieee80211_downgrade_queue+0x432/0x5b0 [ 818.449763][T29348] ? ieee80211_mesh_xmit_fast+0x902/0xe20 [ 818.455659][T29348] ieee80211_mesh_xmit_fast+0xa6d/0xe20 [ 818.461260][T29348] ? lock_acquire+0x115/0x350 [ 818.466051][T29348] ? __pfx_ieee80211_mesh_xmit_fast+0x10/0x10 [ 818.472209][T29348] ? __ieee80211_subif_start_xmit+0x2c5/0x1840 [ 818.478537][T29348] __ieee80211_subif_start_xmit+0x663/0x1840 [ 818.484657][T29348] ? sock_alloc_send_pskb+0xc69/0xd90 [ 818.490088][T29348] ? vfs_write+0x612/0xba0 [ 818.494605][T29348] ? __pfx___ieee80211_subif_start_xmit+0x10/0x10 [ 818.501090][T29348] ieee80211_subif_start_xmit+0xee/0x560 [ 818.506833][T29348] ? __netif_skb_features+0xabc/0x1060 [ 818.512379][T29348] ? __pfx_ieee80211_subif_start_xmit+0x10/0x10 [ 818.518675][T29348] ? __pfx___netif_skb_features+0x10/0x10 [ 818.524473][T29348] ? __lock_acquire+0x747/0x2de0 [ 818.529498][T29348] dev_hard_start_xmit+0x2cd/0x830 [ 818.534729][T29348] __dev_queue_xmit+0x14d1/0x3920 [ 818.539801][T29348] ? __dev_queue_xmit+0x29b/0x3920 [ 818.545014][T29348] ? __might_fault+0xaf/0x130 [ 818.549737][T29348] ? _copy_from_iter+0x21b/0x1680 [ 818.554843][T29348] ? __pfx___dev_queue_xmit+0x10/0x10 [ 818.560270][T29348] ? __pfx__copy_from_iter+0x10/0x10 [ 818.565657][T29348] ? __pfx_packet_parse_headers+0x10/0x10 [ 818.571523][T29348] ? packet_xmit+0x68/0x330 [ 818.576116][T29348] ? skb_put+0x112/0x210 [ 818.580406][T29348] packet_sendmsg+0x406f/0x5330 [ 818.585383][T29348] ? lock_acquire+0x115/0x350 [ 818.590121][T29348] ? aa_file_perm+0x18b/0x15f0 [ 818.594977][T29348] ? __pfx_packet_sendmsg+0x10/0x10 [ 818.600227][T29348] ? aa_sk_perm+0x6ff/0x8f0 [ 818.604834][T29348] ? __pfx_aa_sk_perm+0x10/0x10 [ 818.609739][T29348] ? aa_sock_msg_perm+0x144/0x210 [ 818.614850][T29348] ? apparmor_socket_sendmsg+0x98/0x360 [ 818.620473][T29348] ? __pfx_packet_sendmsg+0x10/0x10 [ 818.625760][T29348] sock_sendmsg_nosec+0x14e/0x190 [ 818.630839][T29348] sock_write_iter+0x2de/0x3e0 [ 818.635693][T29348] ? __pfx_sock_write_iter+0x10/0x10 [ 818.641051][T29348] ? bpf_lsm_file_permission+0x9/0x20 [ 818.646521][T29348] ? security_file_permission+0x75/0x260 [ 818.652296][T29348] vfs_write+0x612/0xba0 [ 818.656628][T29348] ? __pfx_vfs_write+0x10/0x10 [ 818.661442][T29348] ? __fget_files+0x3a2/0x420 [ 818.666217][T29348] ? __fget_files+0x2a/0x420 [ 818.670856][T29348] ? fdget+0x1ac/0x250 [ 818.675039][T29348] ksys_write+0x150/0x270 [ 818.679423][T29348] ? __pfx_ksys_write+0x10/0x10 [ 818.684376][T29348] do_syscall_64+0x166/0x520 [ 818.689012][T29348] ? trace_irq_disable+0x3b/0x140 [ 818.694127][T29348] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 818.700236][T29348] ? clear_bhb_loop+0x70/0xc0 [ 818.705008][T29348] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 818.710941][T29348] RIP: 0033:0x7f8bec39f559 [ 818.715445][T29348] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 818.735153][T29348] RSP: 002b:00007f8bed294028 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 818.743655][T29348] RAX: ffffffffffffffda RBX: 00007f8bec626090 RCX: 00007f8bec39f559 [ 818.751670][T29348] RDX: 0000000000000014 RSI: 0000200000001340 RDI: 0000000000000013 [ 818.759731][T29348] RBP: 00007f8bec436b50 R08: 0000000000000000 R09: 0000000000000000 [ 818.767780][T29348] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 818.775835][T29348] R13: 00007f8bec626128 R14: 00007f8bec626090 R15: 00007ffe7fa9cbe8 [ 818.783944][T29348] [ 818.787037][T29348] Kernel panic - not syncing: kernel: panic_on_warn set ... [ 818.794354][T29348] CPU: 1 UID: 0 PID: 29348 Comm: syz.1.6069 Not tainted syzkaller #0 PREEMPT(full) [ 818.803757][T29348] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/15/2026 [ 818.813846][T29348] Call Trace: [ 818.817151][T29348] [ 818.820110][T29348] vpanic+0x26f/0x710 [ 818.824172][T29348] panic+0xc5/0xd0 [ 818.827951][T29348] ? __pfx_panic+0x10/0x10 [ 818.832437][T29348] __warn+0x315/0x4c0 [ 818.836455][T29348] ? mac80211_hwsim_tx+0x1d04/0x25b0 [ 818.841817][T29348] ? mac80211_hwsim_tx+0x1d04/0x25b0 [ 818.847146][T29348] __report_bug+0x276/0x570 [ 818.851793][T29348] ? mac80211_hwsim_tx+0x1d04/0x25b0 [ 818.857135][T29348] ? __pfx___report_bug+0x10/0x10 [ 818.862237][T29348] ? rate_control_cap_mask+0x425/0x1040 [ 818.867921][T29348] ? __asan_memcpy+0x40/0x70 [ 818.872563][T29348] ? ieee80211_encrypt_tx_skb+0x2fc/0x3f0 [ 818.878332][T29348] ? mac80211_hwsim_tx+0x1d04/0x25b0 [ 818.883662][T29348] report_bug+0x16b/0x220 [ 818.888036][T29348] ? mac80211_hwsim_tx+0x1d04/0x25b0 [ 818.893369][T29348] ? mac80211_hwsim_tx+0x1d06/0x25b0 [ 818.898701][T29348] handle_bug+0x9c/0x200 [ 818.902996][T29348] exc_invalid_op+0x1a/0x50 [ 818.907548][T29348] asm_exc_invalid_op+0x1a/0x20 [ 818.912437][T29348] RIP: 0010:mac80211_hwsim_tx+0x1d04/0x25b0 [ 818.918383][T29348] Code: e8 03 42 0f b6 04 20 84 c0 0f 85 0b 08 00 00 45 0f b6 8d 71 08 00 00 4c 89 ee 67 48 0f b9 3a e9 c4 f4 ff ff e8 9d 04 7a fa 90 <0f> 0b 90 e9 27 f5 ff ff e8 8f 04 7a fa 90 0f 0b 90 48 8b 7c 24 20 [ 818.938026][T29348] RSP: 0018:ffffc90003df6b60 EFLAGS: 00010293 [ 818.944141][T29348] RAX: ffffffff874f1133 RBX: 0000000000000000 RCX: ffff88807d2f5dc0 [ 818.952145][T29348] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 000000006d537749 [ 818.960155][T29348] RBP: ffffc90003df6cf0 R08: ffff88805358464f R09: 0000000000000000 [ 818.968163][T29348] R10: ffff888053584640 R11: ffffffff874ef430 R12: dffffc0000000000 [ 818.976176][T29348] R13: 00000000ffffffff R14: 0000000000000000 R15: 1ffff920007bedb8 [ 818.984197][T29348] ? __pfx_mac80211_hwsim_tx+0x10/0x10 [ 818.989710][T29348] ? mac80211_hwsim_tx+0x1d03/0x25b0 [ 818.995079][T29348] ? __pfx_mac80211_hwsim_tx+0x10/0x10 [ 819.000600][T29348] ieee80211_tx_frags+0x3df/0x890 [ 819.005688][T29348] ? __pfx_ieee80211_tx_frags+0x10/0x10 [ 819.011294][T29348] __ieee80211_xmit_fast+0xabf/0x2160 [ 819.016730][T29348] ? __flow_hash_from_keys+0x431/0x6c0 [ 819.022215][T29348] ? cfg80211_classify8021d+0x67e/0x1220 [ 819.027874][T29348] ? __pfx___ieee80211_xmit_fast+0x10/0x10 [ 819.033731][T29348] ? lock_acquire+0x115/0x350 [ 819.038452][T29348] ? ieee80211_downgrade_queue+0x432/0x5b0 [ 819.044294][T29348] ? ieee80211_mesh_xmit_fast+0x902/0xe20 [ 819.050064][T29348] ieee80211_mesh_xmit_fast+0xa6d/0xe20