last executing test programs: 4.31007574s ago: executing program 1 (id=4810): r0 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) setsockopt$inet6_IPV6_HOPOPTS(r0, 0x29, 0x36, &(0x7f0000000040)=ANY=[], 0x8) connect$inet6(r0, &(0x7f0000000100)={0xa, 0x0, 0x0, @mcast2, 0x7}, 0x1c) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, 0x0, 0x0) sendmmsg$inet6(r0, &(0x7f0000002b80)=[{{0x0, 0x0, &(0x7f0000000200)=[{&(0x7f00000001c0)="82", 0x1}, {&(0x7f0000000140)="11", 0x1}], 0x2}}], 0x1, 0x4404c880) sendto$inet6(r0, &(0x7f0000000300), 0x16, 0x3b00, 0x0, 0xfffffffffffffdfd) 4.021568072s ago: executing program 1 (id=4816): r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="0300000004000000040000000900000000000000", @ANYRES32=0x1, @ANYBLOB='\x00'/20, @ANYRES32=0x0, @ANYRES32, @ANYBLOB="00000000000000000000000000000000000000000000000000000000653907119b02679a841df76090a93ad9cd5c15b4b480bcada64b3e24f5b1a11710abc2f523ee84b89a273fdcf3fd1c2b4209f1b280328805f8e689713dd0fe54ce205111b3eaf418b8052a63f337c6abe1edbb6aaa002b3348e1e66b78ae5951d21763fb3148d2286c0cb9e6b715bd0ba7ee6dee2961c3595fb8c8bded220dfba7bbc16f69fa4054cd72ae5868b2928824567d80464990ad31d5d3b7edea0eac62fd99f7b29ea0149d856e"], 0x48) r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000100)=@base={0x3, 0x4, 0x4, 0x98, 0x0, 0x1}, 0x48) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r2, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x0) sendmsg$NFT_BATCH(r2, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f0000000880)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x3}}, [@NFT_MSG_DELRULE={0x2c, 0x8, 0xa, 0x3, 0x0, 0x0, {0xa, 0x0, 0x6}, [@NFTA_RULE_CHAIN={0x9, 0x2, 'syz2\x00'}, @NFTA_RULE_TABLE={0x9, 0x1, 'syz1\x00'}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x2}}}, 0x54}, 0x1, 0x0, 0x0, 0x4008091}, 0x24000000) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000080)={0x18, 0x7, &(0x7f00000001c0)=ANY=[@ANYBLOB="1800000000000000000000000000000218100000", @ANYRES32=r0, @ANYBLOB="000000000000000018100000", @ANYRES32=r1, @ANYBLOB="000000000000000095"], &(0x7f0000000a00)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2}, 0x80) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000380)={0x18, 0x7, &(0x7f0000000080)=ANY=[@ANYBLOB="18000000000000000000000000000000250002000000000005000200000000004500000000000000a500feff000000009500000000000000"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x3}, 0x94) 3.785925707s ago: executing program 1 (id=4819): r0 = socket$l2tp(0x2, 0x2, 0x73) bind$inet(r0, &(0x7f00000002c0)={0x2, 0x4e20, @empty}, 0x10) connect$inet(r0, &(0x7f0000000200)={0x2, 0x0, @local}, 0x10) sendmmsg$inet(r0, &(0x7f0000000900)=[{{0x0, 0x0, 0x0}}], 0x40000cf, 0x0) bind$inet(r0, &(0x7f0000000080)={0x2, 0x4e34, @multicast2}, 0x10) r1 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f00000005c0)='freezer.parent_freezing\x00', 0x0, 0x0) r2 = socket$inet_sctp(0x2, 0x5, 0x84) setsockopt$IPT_SO_SET_REPLACE(r2, 0x0, 0x40, &(0x7f0000000180)=@security={'security\x00', 0xe, 0x4, 0x298, 0xffffffff, 0x198, 0x0, 0x198, 0xffffffff, 0xffffffff, 0x230, 0x230, 0x230, 0xffffffff, 0x4, 0x0, {[{{@uncond, 0x0, 0x70, 0x90}, @common=@CLUSTERIP={0x60, 'CLUSTERIP\x00', 0x0, {0x1, @multicast, 0x2, 0x4, [0x33, 0x1f, 0xc, 0x2, 0x40, 0x30, 0x14, 0x34, 0x2a, 0x2b, 0x2c, 0x29, 0x40, 0x6, 0x1f, 0x30], 0x2, 0x4, 0x6}}}, {{@ip={@initdev={0xac, 0x1e, 0x1, 0x0}, @dev={0xac, 0x14, 0x14, 0xf}, 0xff0000ff, 0xff, 'team0\x00', 'vlan0\x00', {}, {}, 0x1, 0x3, 0x42}, 0x0, 0x70, 0x98}, @common=@inet=@SET1={0x28, 'SET\x00', 0x1, {{0x0, 0x0, 0x7}, {0x0, 0x3, 0x2}}}}, {{@ip={@remote, @loopback, 0xff, 0xffffffff, 'ipvlan1\x00', 'hsr0\x00', {}, {0xff}, 0x21, 0x1, 0x4}, 0x0, 0x70, 0x98}, @common=@unspec=@STANDARD={0x28, '\x00', 0x0, 0xfffffffffffffffd}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x2f8) getsockopt$netrom_NETROM_T4(r1, 0x103, 0x6, &(0x7f0000000600)=0x81, &(0x7f0000000a00)=0x4) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r3, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000008c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a3000000000090003007379"], 0x7c}}, 0x0) r4 = bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="1b00000000000000000000000080"], 0x50) r5 = bpf$PROG_LOAD(0x5, &(0x7f0000000780)={0x16, 0x10, &(0x7f0000000a40)=ANY=[@ANYBLOB="1800000010000000000000000000000018110000", @ANYRES32=r4, @ANYBLOB="0000000000000000b702000014000000b7030000000000008500000083000000bf09000000000000550901000000000095000000000000008500000011000000bf91000000000000b7020000020000008500000084000000b70000000000000095000000000000002c09848b340d99fd207655e9c4d2ada925efd873c35f3adb1efff1c429436fd158bafe82ae2e43eec5da241bfd793975e1ed5651cb604fe6a7ef1b9d57793dd290c91b286d274d8e50fb4dd5a499c123b93362ff9409f517327e6d79c4b8f83f"], &(0x7f0000000000)='GPL\x00', 0x1, 0x0, 0x0, 0x41000, 0x40, '\x00', 0x0, @flow_dissector=0x11, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffc}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000240)={r5, 0xfca804a0, 0x10, 0x38, &(0x7f00000002c0)="b800000500000000", &(0x7f0000000300)=""/8, 0x500, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x4c) r6 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$IPT_SO_SET_REPLACE(r6, 0x0, 0x40, &(0x7f0000000640)=@filter={'filter\x00', 0x42, 0x4, 0x348, 0xffffffff, 0x1b8, 0x0, 0x1b8, 0xffffffff, 0xffffffff, 0x2b0, 0x2b0, 0x2b0, 0xffffffff, 0x4, 0x0, {[{{@ip={@empty, @loopback, 0x0, 0x0, 'veth0_to_batadv\x00', 'wlan0\x00', {}, {}, 0x11}, 0x0, 0xd0, 0xf8, 0x0, {0x100000000000000}, [@common=@inet=@l2tp={{0x30}, {0x0, 0x0, 0x3, 0x0, 0xf}}, @common=@unspec=@connmark={{0x30}, {0x5}}]}, @REJECT={0x28}}, {{@uncond, 0x0, 0x98, 0xc0, 0x0, {}, [@common=@unspec=@state={{0x28}, {0x7}}]}, @REJECT={0x28, 'REJECT\x00', 0x0, {0x8}}}, {{@ip={@multicast2, @private=0xa010102, 0x0, 0x0, 'veth1_virt_wifi\x00', '\x00', {}, {}, 0x0, 0x1}, 0x0, 0xb8, 0xf8, 0x0, {}, [@common=@unspec=@connlabel={{0x28}, {0xf, 0x2}}, @common=@socket0={{0x20}}]}, @common=@unspec=@RATEEST={0x40, 'RATEEST\x00', 0x0, {'syz1\x00'}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x3a8) sendmsg$NFT_BATCH(r3, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000300)={{0x14}, [@NFT_MSG_NEWRULE={0x50, 0x6, 0xa, 0x160b, 0x0, 0x0, {0x2, 0x0, 0x8}, [@NFTA_RULE_EXPRESSIONS={0x24, 0x4, 0x0, 0x1, [{0x20, 0x1, 0x0, 0x1, @quota={{0xa}, @val={0x10, 0x2, 0x0, 0x1, [@NFTA_QUOTA_BYTES={0xc, 0x1, 0x1, 0x0, 0x2}]}}}]}, @NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_RULE_CHAIN={0x9, 0x2, 'syz2\x00'}]}], {0x14}}, 0x78}, 0x1, 0x0, 0x0, 0x850}, 0x0) r7 = socket$vsock_stream(0x28, 0x1, 0x0) r8 = socket$nl_generic(0x10, 0x3, 0x10) r9 = syz_genetlink_get_family_id$fou(&(0x7f00000000c0), 0xffffffffffffffff) sendmsg$FOU_CMD_GET(r8, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000040)=ANY=[@ANYBLOB="05000000", @ANYRES16=r9, @ANYBLOB="010b28bd7000f8dbdf2503000000"], 0x14}, 0x1, 0x0, 0x0, 0x24040015}, 0x40000) ioctl$XFS_IOC_ATTRMULTI_BY_HANDLE(r3, 0x4048587b, &(0x7f0000000380)={{r7, &(0x7f0000000000)='quota\x00', 0x40, &(0x7f0000000040)={@align=0x2, {0xf, 0xffff, 0xff, 0x8e6}}, 0x5, &(0x7f0000000080)={@_ha_fsid}, &(0x7f00000000c0)=0x90}, 0x2, &(0x7f00000002c0)=[{0x3, 0x80000001, &(0x7f0000000100)='\x00', &(0x7f0000000140)="20f2faadfa6bf00639deca49bcb3f1772b0b69af56c4f830ba236f875e4e931cb839ced0f22a45f6bb7bf0725e9b17f92619ef5530d7c867e7c6", 0x3a}, {0x1, 0x969, &(0x7f0000000280)='quota\x00', &(0x7f0000000b40)="542989e0e6fc0a3a64beceb2fafac81275fd08754dff8762925b80a0b0d2dbbc918ad9521fecd368386fe4ed9c39e0b908dc50ce7927edb099f533d418812150e3a14194590b5c7e0605ef783fd9590da5de2249c3ababbd726150a1ec8fbe845293e339e19b51c92a85b7c694b31a6d626bae6727c705fac9c1657acb1b038872661b04e06d5f8a2a6819781f4b", 0x8e, 0x38}]}) sendmsg$NFNL_MSG_ACCT_GET_CTRZERO(r10, &(0x7f0000000500)={&(0x7f0000000400)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f00000004c0)={&(0x7f0000000440)=ANY=[@ANYBLOB="60000000020701020000000000000000010000050c00034000000000800000010c000340000000000008000000000240000000000000a7fd1c0007800800014000000002080002400000000508000140000000030900010073797a3000000000"], 0x60}, 0x1, 0x0, 0x0, 0x80}, 0x20040840) r11 = socket$nl_generic(0x10, 0x3, 0x10) r12 = socket$packet(0x11, 0x3, 0x300) r13 = socket$inet6_sctp(0xa, 0x5, 0x84) setsockopt$inet_sctp6_SCTP_ENABLE_STREAM_RESET(r13, 0x84, 0x76, 0x0, 0x0) setsockopt$packet_int(r12, 0x107, 0x7, &(0x7f00000001c0)=0x7, 0x4) r14 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000f40), r11) sendmsg$IPVS_CMD_NEW_SERVICE(r11, &(0x7f0000001100)={0x0, 0x0, &(0x7f00000010c0)={&(0x7f00000001c0)=ANY=[@ANYBLOB='p\x00\x00\x00', @ANYRES16=r14, @ANYBLOB="010067bd7000fbdbdf25010000005c00018014000300fe8000000000000000000000000000bb060001000a00000008000600777272000c0007002e00000005000000080009002700feff060002001100000008000b00736970000800080009000000060004"], 0x70}, 0x1, 0x0, 0x0, 0x20004084}, 0x20008800) 3.115357757s ago: executing program 1 (id=4824): syz_emit_ethernet(0x6e, &(0x7f0000000040)=ANY=[@ANYBLOB="0180c2000002aaaaaaaaaaaa08004500006000000000002f9078640101000000000024806558000000000000000010000800000086dd"], 0x0) r0 = socket$nl_rdma(0x10, 0x3, 0x14) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000040)={0x38, 0x1403, 0x1, 0x70bd28, 0x25dfdc02, "", [{{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'ip6gre0\x00'}}]}, 0x38}, 0x1, 0x0, 0x0, 0xc890}, 0x20000000) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f00000001c0)=ANY=[@ANYRES32=r0], 0xf8}, 0x1, 0x0, 0x0, 0x2000c814}, 0x4000) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a01020000000000000000010000000900010073797a30000000004000ffff0900010073797a30000000000900020073797a3100000000140003800800014000000000"], 0x138}, 0x1, 0x0, 0x0, 0x20040855}, 0x0) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r1, &(0x7f0000000080)={0x1f, 0xffff, 0x3}, 0x6) write(r1, &(0x7f0000000000)="2d000000010001", 0x7) r2 = socket$kcm(0x10, 0x2, 0x10) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a03000000000000000000070000040900010073797a30000000009c000000090a010400000000000000000700000308000a40000000000900020073797a30000000000900010073797a3000000000080005400000000d58001280200001800e000100636f6e6e6c696d69740000000c0002800800014000000008200001800e000100636f6e6e6c696d69740000000c00028008000140000000001400017b090001006cdbf80789f3f947dd0002800800"], 0xe4}, 0x1, 0x0, 0x0, 0x8001}, 0x20050840) sendmsg$kcm(r2, &(0x7f0000000000)={0x0, 0xd18c9b25, &(0x7f0000000080)=[{&(0x7f0000000040)="e03f030041000b05d25a806c8c6394f90324fc60100000000a000200053582c137153e3704020180fc5409000c00", 0x33fe0}], 0x1}, 0x0) 2.876670171s ago: executing program 1 (id=4827): r0 = bpf$PROG_LOAD(0x5, &(0x7f0000000340)={0x3, 0x13, &(0x7f0000000000)=ANY=[@ANYBLOB="18000000000000000000000000000000180100002020702500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b7030000000000908500000071000000180100002020702500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000000000000b703000000000000850000007000000095"], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x24, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8}, 0x94) r1 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000000)={'macvtap0\x00', 0x0}) sendmsg$nl_route(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000140)=ANY=[@ANYBLOB="280000001d0001008a0000000000000007000000", @ANYRES32=r2, @ANYBLOB="080012000a0002"], 0x28}}, 0x10) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) r4 = socket(0xa, 0x3, 0x3a) setsockopt$MRT6_ADD_MFC(r4, 0x29, 0xcc, &(0x7f00000001c0)={{0xa, 0x0, 0x0, @local}, {0xa, 0x4e22, 0x7fd, @loopback}, 0x0, {[0x0, 0x2, 0x0, 0x1, 0x0, 0x4, 0x800000]}}, 0x5c) sendmsg$IPSET_CMD_CREATE(r3, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000044c0)={&(0x7f0000000100)={0x60, 0x2, 0x6, 0x401, 0x0, 0x0, {}, [@IPSET_ATTR_DATA={0x14, 0x7, 0x0, 0x1, [@IPSET_ATTR_TIMEOUT={0x8, 0x6, 0x1, 0x0, 0x9}, @IPSET_ATTR_CADT_FLAGS={0xfffffffffffffd03, 0x8, 0x1, 0x0, 0x9e}]}, @IPSET_ATTR_PROTOCOL={0x5, 0x1, 0x6}, @IPSET_ATTR_REVISION={0x0, 0x4, 0x3}, @IPSET_ATTR_REVISION={0x5}, @IPSET_ATTR_TYPENAME={0x11, 0x3, 'hash:net,net\x00'}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz0\x00'}]}, 0x60}, 0x1, 0x0, 0x0, 0x24040010}, 0x4040810) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000240)={r0, 0xffffffff, 0x10, 0xfffffffffffffffe, &(0x7f00000002c0)="0000ffffffffa000", &(0x7f0000000300)=""/8, 0x60ff, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x4c) 2.67242304s ago: executing program 1 (id=4832): bpf$MAP_CREATE(0x300000000000000, &(0x7f0000000580)=ANY=[@ANYBLOB="1800000006000020410000000000000001000000", @ANYRES32=0x1, @ANYBLOB='\x00'/20, @ANYRES32=0x0, @ANYRES32, @ANYBLOB="054000000400"/28], 0x50) r0 = socket(0x10, 0x3, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040), 0x80200, 0x0) ioctl$TUNSETVNETHDRSZ(r1, 0x400454d8, &(0x7f0000000240)=0x4) bind$netlink(r0, &(0x7f0000177ff4)={0x10, 0x0, 0x1}, 0xc) write(r0, &(0x7f0000000180)="2600000022004701050000070000000000000020002b1f000a4a51f1ee839cd53400b017ca5b", 0x26) connect$netlink(r0, &(0x7f00000005c0)=@proc={0x10, 0x0, 0x1}, 0xc) setsockopt$sock_int(r0, 0x1, 0x21, &(0x7f0000b4bffc)=0x8, 0x4) connect$pppl2tp(r0, &(0x7f0000000300)=@pppol2tpin6={0x18, 0x1, {0x0, r0, 0x1, 0x4, 0x1, 0x1, {0xa, 0x4e22, 0xf, @private1={0xfc, 0x1, '\x00', 0x1}, 0xfffffff8}}}, 0x32) sendmsg$kcm(0xffffffffffffffff, 0x0, 0x4) r2 = socket$kcm(0x10, 0x400000002, 0x0) socket$inet6_udp(0xa, 0x2, 0x0) write(r0, &(0x7f0000000000)='\"', 0x1) recvmmsg(r0, &(0x7f0000000780), 0x3ffffffffffff81, 0x2, 0x0) write$bt_hci(r0, &(0x7f0000000040)=ANY=[@ANYBLOB], 0x1d) sendmsg$NL80211_CMD_LEAVE_MESH(r0, &(0x7f00000003c0)={0x0, 0x0, 0x0}, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) r4 = socket$nl_generic(0x10, 0x3, 0x10) r5 = socket$nl_route(0x10, 0x3, 0x0) socketpair(0x1, 0x20000000000001, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) getsockname$packet(r6, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000400)=0x14) sendmsg$nl_route_sched(r5, &(0x7f0000006280)={0x0, 0x0, &(0x7f0000000500)={&(0x7f0000000740)=@newtaction={0x98, 0x30, 0x1, 0x0, 0x0, {0x0, 0x0, 0x6a00}, [{0x84, 0x1, [@m_mirred={0x50, 0x1, 0x0, 0x0, {{0xb}, {0x24, 0x2, 0x0, 0x1, [@TCA_MIRRED_PARMS={0x20, 0x2, {{0x80d, 0x0, 0x10000000, 0x5, 0x4}, 0x1, r8}}]}, {0x0, 0xa}, {0xc}, {0xc, 0x8, {0x2}}}}, @m_mpls={0x30, 0x2, 0x0, 0x0, {{0x9}, {0x1}, {0x4}, {0xc}, {0xc}}}]}]}, 0x98}, 0x1, 0x0, 0x0, 0x4008001}, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000040)={0x6, 0x5, &(0x7f0000000000)=ANY=[@ANYBLOB="18020000faffffff00000000850000007d0000009500000000000000000007000000000000000000"], &(0x7f00000001c0)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @xdp=0x25, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(r7, 0x84, 0x9, &(0x7f0000000600)={0x0, @in={{0x2, 0x4e23, @empty}}, 0xfff, 0x93, 0x200, 0x59a, 0x10, 0x7ff, 0x7}, 0x9c) sendmsg$inet(r2, &(0x7f0000001140)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001100)=[@ip_pktinfo={{0x1c, 0x0, 0x8, {r8, @dev={0xac, 0x14, 0x14, 0x1e}, @empty}}}, @ip_ttl={{0x14, 0x0, 0x2, 0xfffffffc}}], 0x38}, 0xc1) r9 = syz_genetlink_get_family_id$batadv(&(0x7f0000000400), 0xffffffffffffffff) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r4, 0x8933, &(0x7f0000000440)={'batadv0\x00', 0x0}) sendmsg$BATADV_CMD_SET_MESH(r4, &(0x7f0000000540)={0x0, 0x0, &(0x7f0000000500)={&(0x7f0000000140)=ANY=[@ANYBLOB=',\x00\x00\x00', @ANYRES16=r9, @ANYBLOB="010000000000000000000f000000050030000000000005002f000000000008000300", @ANYRES32=r10], 0x2c}}, 0x4000000) sendmsg$nl_route(r3, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000ac0)=ANY=[@ANYBLOB="500400001000030425bd7000ffffffff00000000", @ANYRES32=0x0, @ANYBLOB="40450000000000001c0012800b00010067726574617000000c00028008000400b227000008000a00", @ANYRES32=r10], 0x450}, 0x1, 0x0, 0x0, 0x4000881}, 0x48004) socket$inet6_sctp(0xa, 0x5, 0x84) 2.671403737s ago: executing program 2 (id=4833): r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x0) setsockopt$bt_l2cap_L2CAP_LM(r0, 0x6, 0x3, &(0x7f0000000040)=0x3a, 0x4) getsockopt$bt_l2cap_L2CAP_LM(r0, 0x6, 0x3, &(0x7f00000002c0), &(0x7f0000000500)=0x4) r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r1, &(0x7f00000029c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000100)={0x20, 0x10, 0x701, 0x0, 0x0, {0xa}, [@typed={0xc, 0x2, 0x0, 0x0, @str='nl80211\x00'}]}, 0x20}}, 0x0) recvmmsg(r1, &(0x7f0000001b40)=[{{0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000140)=""/189, 0xbd}, {&(0x7f00000003c0)=""/152, 0x98}, {&(0x7f0000000480)=""/4096, 0x1000}], 0x3}}], 0x7, 0x0, 0x0) r2 = socket$nl_route(0x10, 0x3, 0x0) setsockopt$netlink_NETLINK_TX_RING(r2, 0x10e, 0xc, &(0x7f0000000040)={0x80}, 0x10) sendmsg$nl_route(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000007c0)={&(0x7f0000000280)=ANY=[@ANYBLOB="1c0000001a002103010055fbcb24a5f2b900000000000000000000003cc45cc77126eac2ffb79af624e27a515e9f07b78421fe402bf37505ca12e33d547468ab2ee9ade52a116941b63681b6d3e6be42e36649995ddbe19342155ba4f9c165a990cddb8ea782a36bf29ff80b6ee963112fe72273d196fa7f5ca86730cc0310c6b0473116026a1833c05fba76a77ba77fa4d63f8740b64591c4e5368061cf9c90f6956fb9da0c67f587e345a56373f99e5ac9e46584f54bc8de67e3a901246cf77d0d8e9c44f083db54486298fb881bce930e29c1938281f3a3e47877c401ce5c56e4dae2a39389827b56b4c70900c66a16a1d7acef9f43bd20daa98ae139237b69f2fc50eba00936d682baecb7d9729d8cd596f50a5f5f6311e4aebe458cf37e9d841ef5810a525395abfdcaaf0b187497542122efd5283c00bece83647c4ff2f4b251f4aa06a890aee3c5d8576dfd90d40ed70d2ac67a86e00da1b3963d19eee07b529104ccf0fc78bb5c525d2d206c0eab85ca3a4bf1bfac6dba54f55d46c1c600"/405], 0x1c}, 0x1, 0x0, 0x0, 0x14}, 0x20000050) r3 = socket$nl_xfrm(0x10, 0x3, 0x6) r4 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_int(r4, 0x107, 0xf, &(0x7f0000000240)=0x2, 0x4) setsockopt$packet_rx_ring(r4, 0x107, 0x5, &(0x7f0000000040)=@req3={0x1000, 0x3a, 0x1000, 0x3a}, 0x1c) r5 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) ioctl$TUNSETIFF(r5, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) r6 = socket(0x400000000010, 0x3, 0x0) r7 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="10000000040000000800000008"], 0x50) r8 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x6, 0xd, &(0x7f0000001480)=ANY=[@ANYBLOB="1800000000000000000000400022000085000000bc0000f218110000", @ANYRES32=r7, @ANYBLOB="000000000000000000008000004000007b8af8ff00000000bca2000000000000a6020000f8ffffffb703000008000000b704000000000400850000003300000095308810e0a355db7483ecb8d9aed04adf5e9b07651ba0fbb7925d03e83daae80a7d150af4aca670e732bc8b4cdb9c6056d68cd1594ed58a22087e082a9201fd4b921a3670e2e7fed6c3ccbacf8fadbd96e9dfebf03e655653facba0ec8fa89bc15014dba27b0d1e72db998c05de708192fbb6a0f4ed7200c625fb3acb4cf064ce50b7cb3afdd19a10067bddf38fa33588e73c26b0c47a4bbb6ff1c67bb5f60499ab13971fead5a27f374751b3efbc031a57f93b37ea3e96177858f2673253c30cb72db67f0f"], &(0x7f0000000180)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @xdp, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000600)={r8, 0x5, 0x3100, 0x3100, &(0x7f0000000000), 0x0, 0xd01, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) ioctl$sock_ipv4_tunnel_SIOCCHGTUNNEL(r6, 0x89f3, &(0x7f0000000500)={'gre0\x00', &(0x7f0000000280)={'tunl0\x00', 0x0, 0x1, 0x7, 0xd, 0x0, {{0x5, 0x4, 0x0, 0x1, 0x14, 0x3, 0x0, 0x5, 0x2f, 0x0, @empty, @local}}}}) socket$kcm(0x2, 0x3, 0x2) ioctl$SIOCSIFHWADDR(r5, 0x8914, &(0x7f0000000080)={'netdevsim0\x00', @random="8ac9b292bf2e"}) write$tun(r5, &(0x7f0000000540)=ANY=[@ANYBLOB="08000800000404000800000000004504004500640000390290780000000064010114fd102975adb00e8cfa3c0ffd0214039078ac1414bbd77541e0a3ffc499e2a2c0ec57f889c5a1dd14200225d43fb2d0103b9c89c1fd0757805674f66e8d94cc9108392d593bd49964b3d20fc1249a22bf52d84e17c27d0f7fcacd8822ba8098ebfd54df4f69bf4fd5bee65fae5539464ae0484fb0c0fd9ee954992369229bff5b2409f2622662930c359dbb70b4640ab5a1420b066e5d3627bd3ca4d9f19b4ef1746ad6eb6ccf24478cf96d26d7231ddfdc15db93539f2a6a4e80db7f78c2a5c5357add4aa8ed787cc7cca8966fdf3eccaf8bbf74c52ff66e4a1cad53ff018ec1c21eafb30000000000000000000000000018796f608e3d581d2fbf543cf6705746b338bf91f4b7cdb38d4628ba087541e468a4de900165638b8795d5c16ca19d567a8356f3ad37534328b2adedb05c258135e6bce31a3b0e9279fc5ef340fed616742cf1b23b6fc6acafe4dfa7556c58c3610119f005e0a5be970290bcef46f8912ae9834f1b47b3b6c6ae03837cebd26bcab87f2e39fee6ecfc86a47e7af8e5da0e7b60cabb9b94a4dee338e9fde78c8c5a57afbb13cdbd8953"], 0x53) splice(r6, &(0x7f00000015c0)=0x10, r8, &(0x7f0000001600)=0x4, 0x400, 0xe) syz_emit_ethernet(0x82, &(0x7f00000001c0)={@broadcast, @empty, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x74, 0x0, 0x0, 0xfe, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @time_exceeded={0x5, 0x0, 0x0, 0xe0, 0x1, 0xe000, {0x16, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x11, 0x0, @remote, @rand_addr, {[@lsrr={0x83, 0x3}, @rr={0x7, 0x3, 0x2}, @timestamp_prespec={0x44, 0x3c, 0x0, 0x3, 0x0, [{@multicast1=0xe0000006}, {@dev}, {@dev}, {@remote}, {@private}, {@remote}, {@local, 0x7}]}]}}}}}}}, 0x0) sendmsg$nl_xfrm(r3, &(0x7f0000000040)={0x0, 0x11, &(0x7f00000008c0)={&(0x7f0000000200)=ANY=[], 0xb4}, 0x1, 0x0, 0x0, 0x4000}, 0x90) 2.215167863s ago: executing program 4 (id=4837): socket$nl_generic(0x10, 0x3, 0x10) bpf$PROG_LOAD(0x5, &(0x7f00000005c0)={0x0, 0xe, &(0x7f0000000800)=ANY=[@ANYBLOB="b702000000000000bfa300000000000007030000fdfdfff67a0af0fff8ffffff79a4f0ff00000000b7060000ffffffff2d6405000000000065040000010000400404000001000000b7050000050000006a0a00fe00000000850000000a000000b70000000000000095000000000000009cc6b3fcd62c061c6238975d43a4505f80e39c9f3c530cf08e467b592f868ee3b0a435df0a0e8c1bf176db2a6b2feb4b77d3d5707bfd2d84aaa3b1d4e984c46ea7e2b347a36f5662403e1b2be4284322a4908a0d411a9872971c7c56f0979bd10b97163c066d0e196bf02f46c7953ab1abdaf9de9ca3c00cb9bf4e418d076feafa22f0610a70f2bdf4000200000000b0c2c1254f0963f63223b7b80197aa3161f45346b100000000000000000089e399f6609876b5887437a172ebc02a740694298b79dc194e533583412dff048fc21f28bdd3e26a1a8a0481e9f0da43bb6ca66e2f55a9ff19ffcafe3e64be033c9d2f972cc93c1c13caec04a367c24a9fb6a6991ddb737d527d6acb15426415b6e8b14f822e86067a5e991c3b404984dfa2c6e94bd0339454c13ad3c328a182c15dc760a313e3b3ca5d3393404029e98fa883c71949a34d84030323e3d54f45b29d27643453ad9211e3550ee5520211d9370175133f260c6882a146880b9387f1beb5418618bc83a3becf9bb57da7ba8b913c685fc6700848dc6665d73248c1f74e08ad04ce905faf32706e0000249a028044ede964362cfb7830a246c3b2f60000fc4deb8eda1368b0960b8d69bd99c64893d44f962524429dc058528e7e541c903869d96989b9a986620cb2c95c83f2a082c52764f49e51188f9418b01bcd8ae164acdac95318ec8b2c6feacdcf4b528e5e58219bc54f6ad5679e7f430e6960ed048c46e1dccca05bfa1d67c83795eae2d31968c055d325a9c794ef88b30c2de4a274878b73c05ffa88b7033be648b12bb1fee58958d6a6f31bfe568215dfbde59dad00008a73b40f09cf018cd496b36050d7fd45e3620c28f76749262e33e16429a6da35ceb1a989de81c3f8b8bc3a4763948a1cbc10348ef2ac3781b847611fcb0a26acafdd6d9ab05865fcf7c493d8f8cd344a1d470ca0d6f16ab0293774b5509fb0e7113936d59d5a60dbd84a938476adeebab9ff44f531bb81c53f16d80f51006cbc71570a5e272b223425e09dc6b6cc1fbc455a64fd449284f71761092a0302000000000000008a05d36fd9b814b4292745418c92d944763a4bf5e138d810e29a31f08f7dea7762d28484e15dc4320e4f85c16a8fbffadf8214d6d24cabe17ad4135d8872935ce0e6a468fd20fa4461d1d67b234feac6eb4f046f2acc1b0efb4438abddcabb4e4e72a450aab72b589bec83bbb688e659fb426cb43d0ee993516fd4e867232cde69b6ffad447dcd92e0ef8234ff850ec3948dd1fa7afb77d951fe4abf618121b7894c1044ef221973432ccc7e62b151eb898a01010a7ec5acd0a5dcb2de443880c8a682515d1da9a3048744acb44384d1591df789883c0560495cb0cb32283529926d25e5c7f4815237c3aa356217738898a16ba603439f6eaad8e70b"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x24, '\x00', 0x0, @fallback=0x18, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x10, 0x9}, 0x94) r0 = bpf$MAP_CREATE(0x0, &(0x7f00000006c0)=ANY=[@ANYBLOB="090000000400000006000000ff00000042"], 0x48) bpf$MAP_UPDATE_BATCH(0x1a, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000000180), &(0x7f0000000080), 0x1, r0}, 0x38) socket$inet6_udp(0xa, 0x2, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) syz_genetlink_get_family_id$nl80211(&(0x7f0000000240), 0xffffffffffffffff) r2 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL80211_CMD_SET_WIPHY_NETNS(r2, &(0x7f0000000740)={0x0, 0x0, &(0x7f0000000700)={&(0x7f0000000180)=ANY=[@ANYBLOB="b16ed0b8aa9a835413cde397e68658bfbc4b0d337f6aef7021faf893b80af90581baf695fb70290e416ab44e", @ANYRESDEC, @ANYBLOB="01002bbd7000fcdbdf2531000000080001000d00000008000300", @ANYRES32=0x0, @ANYBLOB="0c0099000100000003000000", @ANYRES32=r2, @ANYRES8=0x0], 0x30}, 0x1, 0x0, 0x0, 0xc0}, 0x40040) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, 0x0) r3 = syz_init_net_socket$llc(0x1a, 0x1, 0x0) sendmsg$sock(r3, &(0x7f00000003c0)={&(0x7f0000000040)=@rc={0x1f, @any, 0x2}, 0x80, &(0x7f0000000300)}, 0x80) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(0xffffffffffffffff, 0x89f1, 0x0) sendmsg$ETHTOOL_MSG_PRIVFLAGS_SET(0xffffffffffffffff, 0x0, 0x8800) socket$nl_generic(0x10, 0x3, 0x10) r4 = openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$TUNSETIFF(r4, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x4c02}) readv(r4, &(0x7f0000000280)=[{0x0}], 0x1) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32, @ANYBLOB="0000000000000000b70800000d0000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) r5 = bpf$MAP_CREATE(0x0, &(0x7f0000000740)=ANY=[@ANYBLOB="0b00000005000000000400000900000001"], 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0xa, 0x4, &(0x7f0000000480)=ANY=[@ANYRESHEX=r5], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000d80)={0x18, 0x5, &(0x7f0000000480)=ANY=[@ANYBLOB="1801000021"], 0x0, 0x40, 0x0, 0x0, 0x0, 0xb4a02fe0ce239f93, '\x00', 0x0, 0x2}, 0x94) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0xe, 0x0, &(0x7f0000000440)=ANY=[@ANYBLOB="1900000000800000000000000000000018110000", @ANYRES32=r5], 0x0, 0x0, 0x0, 0x0, 0x0, 0x59, '\x00', 0x0, @fallback=0xd, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r6 = bpf$PROG_LOAD(0x5, &(0x7f0000000500)={0x6, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, @fallback=0x1a, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1e}, 0x94) socket$nl_route(0x10, 0x3, 0x0) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000000)={r6, 0x2000000, 0xe, 0x0, &(0x7f00000004c0)="630b008646dc3f0adf33c9f7b986", 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x20}, 0x50) socket$kcm(0x2, 0xa, 0x2) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000200)={0x0}}, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000080)={'bridge0\x00', 0x0}) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000200)=ANY=[@ANYBLOB="2c0000001d00070f000000000000000007000000", @ANYRES32=r7, @ANYBLOB="0000520006000500010000000800", @ANYRES16=r1], 0x2c}}, 0x20008000) 2.194684336s ago: executing program 2 (id=4838): bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000480)={&(0x7f0000000240)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0xb4, 0xb4, 0x4, [@struct={0x7, 0x1, 0x0, 0x4, 0x1, 0x4, [{0xa, 0x2, 0x4}]}, @volatile={0x3, 0x0, 0x0, 0x9, 0x1}, @const={0x2, 0x0, 0x0, 0xa, 0x5}, @union={0x8, 0x4, 0x0, 0x5, 0x0, 0x40, [{0xb, 0x0, 0x99}, {0x7, 0x4}, {0x6, 0x5, 0xfffffffc}, {0xc, 0x3, 0x1000}]}, @union={0x8, 0x2, 0x0, 0x5, 0x0, 0x401, [{0x10, 0x2, 0x5}, {0x8, 0x0, 0x5}]}, @int={0x7, 0x0, 0x0, 0x1, 0x0, 0x5a, 0x0, 0x33, 0x4}, @func_proto={0x0, 0x1, 0x0, 0xd, 0x0, [{0xe, 0x2}]}]}, {0x0, [0x5f, 0x0]}}, &(0x7f0000000340)=""/65, 0xd0, 0x41, 0x0, 0x4, 0x10000}, 0x28) r0 = socket(0x10, 0x803, 0x0) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000100)={'team_slave_1\x00', 0x0}) connect$rose(r0, &(0x7f0000000200)=@full={0xb, @dev={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, 0x6, [@netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @bcast, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}]}, 0x40) sendmsg$nl_route_sched(r0, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000140)=@newqdisc={0x24, 0x24, 0x10, 0x70bd25, 0x25dfdbfe, {0x0, 0x0, 0x0, r1, {0x0, 0xfff1}, {0xffff, 0xd}, {0xffe0, 0xfff3}}}, 0x24}}, 0x20044000) r2 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f0000000580)={0x1b, 0x0, 0x0, 0x904000, 0x0, 0xffffffffffffffff, 0x2, '\x00', r1, 0xffffffffffffffff, 0x5, 0x4}, 0x50) bpf$TOKEN_CREATE(0x24, &(0x7f00000001c0), 0x8) r3 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f00000006c0)={0x2, 0x4, 0x8, 0x1, 0x80, r2, 0x2, '\x00', r1}, 0x50) ioctl$ifreq_SIOCGIFINDEX_wireguard(0xffffffffffffffff, 0x8933, &(0x7f0000000000)={'wg1\x00', 0x0}) r5 = bpf$BPF_BTF_GET_FD_BY_ID(0x13, &(0x7f0000000100)=0xffffffffffffffff, 0x4) bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f0000000140)={0x3, 0x4, 0x4, 0xa, 0x0, 0x1, 0x2, '\x00', r4, r5, 0x0, 0x5, 0x2}, 0x50) r6 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000003c0)={0x1f, 0x18, &(0x7f0000000040)=ANY=[@ANYBLOB="18000000000000000000000000000000b7080000000000007b8af8ff00000000b7080000000000007b8af0ff00000000bfa100000000000007010000f8ffffffbfa400000000000007040000f0ffffffb70200000800000018230000", @ANYRES32=r3, @ANYBLOB="0000000000000000b70500000800000085000000a7000000180100002020642500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b70300000000000085000000a800000095"], &(0x7f0000000200)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x19}, 0x94) r7 = socket$inet6(0xa, 0x80002, 0x0) setsockopt$inet6_mreq(r7, 0x29, 0x1c, 0x0, 0x41) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000500)={r6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x48) bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000480)={&(0x7f0000000240)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0xb4, 0xb4, 0x4, [@struct={0x7, 0x1, 0x0, 0x4, 0x1, 0x4, [{0xa, 0x2, 0x4}]}, @volatile={0x3, 0x0, 0x0, 0x9, 0x1}, @const={0x2, 0x0, 0x0, 0xa, 0x5}, @union={0x8, 0x4, 0x0, 0x5, 0x0, 0x40, [{0xb, 0x0, 0x99}, {0x7, 0x4}, {0x6, 0x5, 0xfffffffc}, {0xc, 0x3, 0x1000}]}, @union={0x8, 0x2, 0x0, 0x5, 0x0, 0x401, [{0x10, 0x2, 0x5}, {0x8, 0x0, 0x5}]}, @int={0x7, 0x0, 0x0, 0x1, 0x0, 0x5a, 0x0, 0x33, 0x4}, @func_proto={0x0, 0x1, 0x0, 0xd, 0x0, [{0xe, 0x2}]}]}, {0x0, [0x5f, 0x0]}}, &(0x7f0000000340)=""/65, 0xd0, 0x41, 0x0, 0x4, 0x10000}, 0x28) (async) socket(0x10, 0x803, 0x0) (async) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000100)={'team_slave_1\x00'}) (async) connect$rose(r0, &(0x7f0000000200)=@full={0xb, @dev={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, 0x6, [@netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @bcast, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}]}, 0x40) (async) sendmsg$nl_route_sched(r0, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000140)=@newqdisc={0x24, 0x24, 0x10, 0x70bd25, 0x25dfdbfe, {0x0, 0x0, 0x0, r1, {0x0, 0xfff1}, {0xffff, 0xd}, {0xffe0, 0xfff3}}}, 0x24}}, 0x20044000) (async) bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f0000000580)={0x1b, 0x0, 0x0, 0x904000, 0x0, 0xffffffffffffffff, 0x2, '\x00', r1, 0xffffffffffffffff, 0x5, 0x4}, 0x50) (async) bpf$TOKEN_CREATE(0x24, &(0x7f00000001c0), 0x8) (async) bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f00000006c0)={0x2, 0x4, 0x8, 0x1, 0x80, r2, 0x2, '\x00', r1}, 0x50) (async) ioctl$ifreq_SIOCGIFINDEX_wireguard(0xffffffffffffffff, 0x8933, &(0x7f0000000000)={'wg1\x00'}) (async) bpf$BPF_BTF_GET_FD_BY_ID(0x13, &(0x7f0000000100)=0xffffffffffffffff, 0x4) (async) bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f0000000140)={0x3, 0x4, 0x4, 0xa, 0x0, 0x1, 0x2, '\x00', r4, r5, 0x0, 0x5, 0x2}, 0x50) (async) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000003c0)={0x1f, 0x18, &(0x7f0000000040)=ANY=[@ANYBLOB="18000000000000000000000000000000b7080000000000007b8af8ff00000000b7080000000000007b8af0ff00000000bfa100000000000007010000f8ffffffbfa400000000000007040000f0ffffffb70200000800000018230000", @ANYRES32=r3, @ANYBLOB="0000000000000000b70500000800000085000000a7000000180100002020642500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b70300000000000085000000a800000095"], &(0x7f0000000200)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x19}, 0x94) (async) socket$inet6(0xa, 0x80002, 0x0) (async) setsockopt$inet6_mreq(r7, 0x29, 0x1c, 0x0, 0x41) (async) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000500)={r6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x48) (async) 2.049534426s ago: executing program 2 (id=4840): r0 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) setsockopt$inet6_IPV6_HOPOPTS(r0, 0x29, 0x36, &(0x7f0000000040)=ANY=[], 0x8) connect$inet6(r0, &(0x7f0000000100)={0xa, 0x0, 0x0, @mcast2, 0x7}, 0x1c) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000080)='bridge0\x00', 0x10) sendmmsg$inet6(r0, 0x0, 0x0, 0x4404c880) sendto$inet6(r0, &(0x7f0000000300), 0x16, 0x3b00, 0x0, 0xfffffffffffffdfd) 1.994424319s ago: executing program 2 (id=4841): r0 = socket$inet_tcp(0x2, 0x1, 0x0) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r1, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000540)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a03000000000000000000030000000900010073797a300000000040000000030a03000000020000000000030000000900030073797a30000000000900010073797a300000000014000480080002406375fd82080001400000000028000000000a01040000000000000000030000000900010073797a300000000008000240"], 0xb0}}, 0x0) connect$inet(r0, &(0x7f0000ccb000)={0x2, 0x4e20, @local}, 0x10) ioctl$sock_kcm_SIOCKCMATTACH(0xffffffffffffffff, 0x89e0, &(0x7f0000000180)={r0}) poll(&(0x7f0000000000), 0x20000000000000b5, 0x9) r2 = socket$inet6_mptcp(0xa, 0x1, 0x106) r3 = socket$nl_generic(0x10, 0x3, 0x10) r4 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r4, &(0x7f00005f5000)={0x0, 0x0, &(0x7f0000000280)={0x0, 0xc8}}, 0x0) sendmsg$nl_generic(r3, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000340)=ANY=[@ANYBLOB="180000002500010324bd7002ffdbdf25010000000400ae"], 0x18}, 0x1, 0x0, 0x0, 0x4008}, 0x0) syz_genetlink_get_family_id$nl80211(&(0x7f0000000200), r3) syz_genetlink_get_family_id$batadv(&(0x7f0000000440), r3) recvmsg(r3, &(0x7f0000000080)={0x0, 0x5a, &(0x7f0000000380)=[{&(0x7f0000000480)=""/120, 0x88}, {&(0x7f0000000540)=""/4115, 0x1013}, {&(0x7f0000000240)=""/84, 0x8c}, {&(0x7f0000000000)=""/24, 0x7}, {&(0x7f00000000c0)=""/50, 0x32}], 0x5}, 0x20) getpeername$packet(0xffffffffffffffff, &(0x7f0000000080)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @remote}, &(0x7f0000000100)=0x14) sendmsg$MPTCP_PM_CMD_DEL_ADDR(r3, &(0x7f0000000200)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f00000001c0)={&(0x7f0000000140)={0x6c, 0x0, 0x100, 0x70bd28, 0x25dfdbff, {}, [@MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x5}, @MPTCP_PM_ATTR_ADDR_REMOTE={0x38, 0x6, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_ADDR6={0x14, 0x4, @mcast2}, @MPTCP_PM_ADDR_ATTR_ADDR4={0x8, 0x3, @local}, @MPTCP_PM_ADDR_ATTR_PORT={0x6, 0x5, 0x4e23}, @MPTCP_PM_ADDR_ATTR_ADDR4={0x8, 0x3, @loopback}, @MPTCP_PM_ADDR_ATTR_IF_IDX={0x8, 0x7, r5}]}, @MPTCP_PM_ATTR_LOC_ID={0x5, 0x5, 0x1c}, @MPTCP_PM_ATTR_LOC_ID={0x5, 0x5, 0xf3}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8}]}, 0x6c}, 0x1, 0x0, 0x0, 0x4000004}, 0x80) r6 = socket$nl_generic(0x10, 0x3, 0x10) r7 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r7, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000003740)=@newtaction={0x90, 0x30, 0xb, 0x0, 0x0, {}, [{0x7c, 0x1, [@m_gact={0x48, 0x1, 0x0, 0x0, {{0x9}, {0x1c, 0x2, 0x0, 0x1, [@TCA_GACT_PARMS={0x18, 0x2, {0x0, 0x0, 0x0, 0x0, 0x80006}}]}, {0x4}, {0xc}, {0xc, 0x8, {0x0, 0x3}}}}, @m_pedit={0x30, 0x1, 0x0, 0x0, {{0xa}, {0x4}, {0x4}, {0xc}, {0xc}}}]}]}, 0x90}}, 0x0) ioctl$sock_SIOCGIFINDEX(r6, 0x8933, &(0x7f00000001c0)={'team_slave_1\x00', 0x0}) r9 = syz_genetlink_get_family_id$team(&(0x7f0000000100), 0xffffffffffffffff) ioctl$ifreq_SIOCGIFINDEX_team(r6, 0x8933, &(0x7f0000000040)={'team0\x00', 0x0}) sendmsg$TEAM_CMD_OPTIONS_SET(r6, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000001580)=ANY=[@ANYBLOB='`\x00\x00\x00', @ANYRES16=r9, @ANYBLOB="010028bd700006dcdf250100000008000100", @ANYRES32=r10, @ANYBLOB="44000280400001002400010071756575655f69640000000000000000000000000000000000000000000000000500030003000000080004000100000008000600", @ANYRES32=r8, @ANYBLOB="3ff8d5c01a6d"], 0x60}, 0x1, 0x400000000000000}, 0x0) socket$packet(0x11, 0x3, 0x300) setsockopt$inet6_tcp_TCP_REPAIR(r2, 0x6, 0x13, &(0x7f0000000000), 0x4) r11 = socket$nl_generic(0x10, 0x3, 0x10) r12 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000040), 0xffffffffffffffff) r13 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$ipvs(&(0x7f00000002c0), r13) sendmsg$ETHTOOL_MSG_COALESCE_GET(r11, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000680)={&(0x7f00000006c0)={0x20, r12, 0x1, 0x2, 0x25dfdbfc, {0x1c}, [@HEADER={0xc, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_INDEX={0x8}]}]}, 0x20}}, 0x4000000) 1.731512056s ago: executing program 0 (id=4844): r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000640)=@base={0x1e, 0x0, 0x4, 0xff, 0x0, 0x1}, 0x48) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x3, &(0x7f00000003c0)={{r0}, 0x0, 0x0}, 0x20) r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000040)=ANY=[@ANYBLOB="3800000040000701feffffff00000000037c0000040042801c0001800600060088a80000100004"], 0x38}, 0x1, 0x0, 0x0, 0x48815}, 0xc085) r2 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000040), 0x161042, 0x0) ioctl$PPPIOCNEWUNIT(r2, 0xc004743e, &(0x7f0000000000)=0x2) r3 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000200)=@getsadinfo={0x88, 0x23, 0x100, 0x70bd2a, 0x25dfdbfd, 0x0, [@extra_flags={0x8}, @XFRMA_SET_MARK={0x8, 0x1d, 0x2}, @replay_esn_val={0x30, 0x17, {0x5, 0x70bd27, 0x70bd24, 0x70bd28, 0x70bd2b, 0x8, [0x80000001, 0x9, 0xbd93, 0x6bca, 0x0]}}, @policy_type={0xa}, @coaddr={0x14, 0xe, @in6=@mcast1}, @srcaddr={0x14, 0xd, @in=@local}]}, 0x88}, 0x1, 0x0, 0x0, 0x4008011}, 0x0) sendmsg$nl_route(r3, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000240)=ANY=[@ANYBLOB="4800000010001fff0000056800080000faff0000", @ANYRES32=0x0, @ANYBLOB="c30c424700000000280012800a00010076786c616e00000018000280140010"], 0x48}, 0x1, 0x0, 0x0, 0x1}, 0x0) r4 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='memory.events\x00', 0x275a, 0x0) write$cgroup_subtree(r4, &(0x7f0000000100)=ANY=[], 0x32600) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x2000001, 0x12, r4, 0x0) ioctl$RFKILL_IOC_MAX_SIZE(r4, 0x2, &(0x7f0000000300)=0x9) ioctl$PPPIOCSDEBUG(0xffffffffffffffff, 0x40047440, &(0x7f00000002c0)=0x1003) write$ppp(r2, &(0x7f0000000100)="aff9b3a1cd6f4608543eb4195f16e03eb24b51b547c49ad036b337b5582d0eb446a447c67fd944015cf0", 0x2a) r5 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r5, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000044c0)={&(0x7f0000000100)={0x54, 0x2, 0x6, 0x3, 0x0, 0x0, {0x5, 0x0, 0x7}, [@IPSET_ATTR_PROTOCOL={0x5, 0x1, 0x6}, @IPSET_ATTR_FAMILY={0x5, 0x5, 0xa}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz2\x00'}, @IPSET_ATTR_DATA={0xc, 0x7, 0x0, 0x1, [@IPSET_ATTR_CADT_FLAGS={0x8, 0x8, 0x0, 0x0, 0x44}]}, @IPSET_ATTR_REVISION={0x5}, @IPSET_ATTR_TYPENAME={0xd, 0x3, 'hash:net\x00'}]}, 0x54}}, 0x24040054) ioctl$PPPIOCGNPMODE(r2, 0xc008744c, &(0x7f0000000080)={0x2f}) write$ppp(r2, &(0x7f0000000140)="1e08", 0x23) 1.512893276s ago: executing program 2 (id=4845): r0 = socket$vsock_stream(0x28, 0x1, 0x0) ioctl$sock_SIOCETHTOOL(r0, 0x8946, &(0x7f00000003c0)={'veth1_virt_wifi\x00', &(0x7f0000000000)=@ethtool_modinfo={0x42, 0xab68, 0xe5d}}) 1.367347224s ago: executing program 2 (id=4847): r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='memory.events\x00', 0x275a, 0x0) writev(r0, &(0x7f0000000140)=[{&(0x7f0000000180)="a2", 0x1}], 0x1) mmap(&(0x7f0000000000/0x4000)=nil, 0x4000, 0x1, 0x10012, r0, 0x0) unshare(0x26000400) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) getsockopt$inet6_tcp_TCP_ZEROCOPY_RECEIVE(r1, 0x6, 0x23, &(0x7f0000000140)={&(0x7f0000ffc000/0x1000)=nil, 0x1000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, &(0x7f0000000000)=0x40) r2 = bpf$PROG_LOAD(0x5, &(0x7f0000000040)={0x2, 0x4, &(0x7f0000000200)=ANY=[@ANYBLOB="180000000300000000000000feffff10850000000700000095"], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x100, 0x70, '\x00', 0x0, @fallback=0x30, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r3 = getpid() bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f0000000180)={r2, 0x0, 0x30, 0x1, @val=@uprobe_multi={&(0x7f00000002c0)='./cgroup/cgroup.procs\x00', &(0x7f0000000300)=[0x0], 0x0, 0x0, 0x1, 0x0, r3}}, 0x40) r4 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r4, &(0x7f00000096c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000140)=@newtaction={0x14, 0x30, 0x1}, 0x14}, 0x1, 0x0, 0x0, 0x4000004}, 0x0) bind$bt_l2cap(0xffffffffffffffff, &(0x7f00000002c0)={0x1f, 0x0, @any, 0xfffa}, 0xe) socket$inet_icmp_raw(0x2, 0x3, 0x1) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x5) close(0x4) syz_open_procfs$namespace(0x0, &(0x7f0000000200)='ns/pid_for_children\x00') unshare(0x6a040000) ioctl$FS_IOC_GETFSMAP(r4, 0xc0c0583b, &(0x7f00000004c0)=ANY=[@ANYBLOB="000000000000000002000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000003e7dfffff08300008a00000000000000010000000000000049060000000000000400000000000000000000000000000000000000000000000000000000000000b5ca000000ffffff070000000000000000000000000000000700000000000000ff03000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000007d000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001700"/320]) socket$nl_route(0x10, 0x3, 0x0) r5 = socket$nl_generic(0x10, 0x3, 0x10) r6 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000440), 0xffffffffffffffff) sendmsg$ETHTOOL_MSG_STRSET_GET(r5, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000880)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r6, @ANYBLOB="05072bbd7600ffdbdf25010000000400028004000300"], 0x1c}, 0x1, 0x0, 0x0, 0x40008d0}, 0x0) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x0) r7 = socket$nl_netfilter(0x10, 0x3, 0xc) socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_ADD(r7, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000300)=ANY=[@ANYBLOB="50000000090601020000000000000000020000840900020073797a31000000000500010007000000280007800c00018008000140fffffff70500070084000000060004404e22000006000540"], 0x50}, 0x1, 0x0, 0x0, 0x10000082}, 0x90) r8 = syz_init_net_socket$ax25(0x3, 0x2, 0xf0) ioctl$sock_ax25_SIOCADDRT(r8, 0x890b, &(0x7f00000000c0)={@default, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, 0x0, [@default, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @default, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @bcast, @null]}) socket$inet6(0xa, 0x80000, 0x2) 1.290844032s ago: executing program 0 (id=4849): socket(0x10, 0x803, 0x0) r0 = socket$packet(0x11, 0x3, 0x300) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r0, 0x8933, 0x0) (async) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000003c0)={0x6, 0x3, &(0x7f0000000480)=ANY=[], &(0x7f0000000500)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x18, '\x00', 0x0, @fallback=0xa, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7fff}, 0x94) (async) r2 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000580)={'team_slave_0\x00', 0x0}) bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f00000004c0)={r1, r3, 0x25, 0x0, @void}, 0x10) (async, rerun: 32) socket$isdn(0x22, 0x3, 0x22) (async, rerun: 32) r4 = openat$nci(0xffffffffffffff9c, &(0x7f0000000240), 0x2, 0x0) (async, rerun: 32) r5 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) (rerun: 32) r6 = syz_genetlink_get_family_id$nfc(&(0x7f0000000100), r5) (async, rerun: 32) ioctl$IOCTL_GET_NCIDEV_IDX(r4, 0x0, &(0x7f00000000c0)=0x0) (rerun: 32) sendmsg$NFC_CMD_DEV_UP(r5, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000002c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r6, @ANYBLOB="010026bd7000fcdbdf250200000008000100", @ANYRES32=r7], 0x1c}}, 0x840) (async) r8 = socket$netlink(0x10, 0x3, 0xf) ioctl$sock_SIOCETHTOOL(r8, 0x89f1, &(0x7f0000000340)={'veth0_to_bridge\x00', &(0x7f0000001ec0)=@ethtool_modinfo={0x42, 0x2, 0x7}}) (async) openat$rfkill(0xffffffffffffff9c, &(0x7f0000000040), 0x801, 0x0) (async, rerun: 64) sendmsg$inet(0xffffffffffffffff, &(0x7f0000001b00)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001d80)=ANY=[@ANYBLOB="28010000000000000100000001"], 0x128}, 0x0) (async, rerun: 64) mmap(&(0x7f0000001000/0xc00000)=nil, 0xc00000, 0x0, 0x3032, 0xffffffffffffffff, 0x0) r9 = openat$tun(0xffffffffffffff9c, &(0x7f0000000140), 0x0, 0x0) ioctl$TUNSETIFF(r9, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x4c02}) (async) readv(r9, &(0x7f0000000080)=[{0x0}, {&(0x7f0000000980)=""/4096, 0x1000}], 0x2) r10 = socket$kcm(0x2, 0xa, 0x2) ioctl$TUNSETVNETHDRSZ(r9, 0x400454d8, &(0x7f0000000100)=0x730) (async) ioctl$SIOCSIFHWADDR(r10, 0x8914, &(0x7f0000000000)={'syzkaller1\x00', @link_local}) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000001480)) (async) r11 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_TCP_REPAIR_WINDOW(r11, 0x6, 0x25, &(0x7f0000000040)={0xfffffffd, 0x0, 0xffffffff}, 0x14) openat$nci(0xffffffffffffff9c, &(0x7f0000000240), 0x2, 0x0) r12 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nfc(&(0x7f0000000100), r12) 1.278908358s ago: executing program 4 (id=4850): getsockopt$inet_mreqn(0xffffffffffffffff, 0x0, 0x23, &(0x7f0000000000)={@multicast2, @broadcast, 0x0}, &(0x7f00000000c0)=0xc) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f00000003c0)=@newtaction={0x140, 0x30, 0x1, 0x70bd2c, 0x25dfdbfd, {}, [{0x12c, 0x1, [@m_mirred={0x128, 0x14, 0x0, 0x0, {{0xb}, {0x84, 0x2, 0x0, 0x1, [@TCA_MIRRED_PARMS={0x20, 0x2, {{0x7, 0x8, 0x7, 0x2, 0x6}, 0x3, r0}}, @TCA_MIRRED_PARMS={0x20, 0x2, {{0xa, 0x4f95be26, 0x4, 0x100}, 0x2, r0}}, @TCA_MIRRED_PARMS={0x20, 0x2, {{0x148, 0x10001, 0x20000000, 0x7f, 0xa}, 0x3, r0}}, @TCA_MIRRED_PARMS={0x20, 0x2, {{0x3, 0xb, 0x20000000, 0xa, 0x38b}, 0x2, r0}}]}, {0x7c, 0x6, "b74eec25fdfb8bf500bccb70092dda5a4df63aa1c3f67f209d63b0c858fed5597220bfcce71a3b4d81bcdfb4776d72167a9028786d719535eda5a19ccb45f4fa19aeeb57ce62535a409778be9433166d99add92eb6d92b4f34ec54bd92de4bd952703b4f26c34750e38505bfc2585302e65118d40a2101f1"}, {0xc, 0x7, {0x1}}, {0xc, 0x8, {0x2, 0x2}}}}]}]}, 0x140}}, 0x4000000) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x18, 0x0, 0x0, &(0x7f0000000740)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x60d1}, 0x94) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFNL_MSG_ACCT_NEW(r2, &(0x7f0000000500)={0x0, 0x0, &(0x7f0000000380)={&(0x7f00000007c0)={0x2c, 0x0, 0x7, 0x101, 0x0, 0x0, {0x1}, [@NFACCT_PKTS={0xc, 0x2, 0x1, 0x0, 0xe88}, @NFACCT_NAME={0x9, 0x1, 'syz1\x00'}]}, 0x2c}, 0x1, 0x0, 0x0, 0x8800}, 0x814) write$cgroup_int(r1, &(0x7f0000000200), 0xffffffc1) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x22052, r1, 0x0) sendmsg$NLBL_UNLABEL_C_STATICREMOVEDEF(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000540)=ANY=[@ANYBLOB="14000000"], 0x14}, 0x1, 0xffffffff00000003, 0x0, 0x60040}, 0x0) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_DEL(r3, &(0x7f0000000340)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000500)=ANY=[@ANYBLOB="e00000000a06010100000000000000000300000908000940800000010900020073797a310000000005000100070000000800094000000005880008800c000780080009"], 0x13a}, 0x1, 0x0, 0x0, 0x4800}, 0x48080) 1.012719141s ago: executing program 0 (id=4851): r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) sendmsg$IPVS_CMD_SET_INFO(r1, &(0x7f0000000b00)={0x0, 0x0, &(0x7f0000000ac0)={0x0, 0x14}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000500)=@newlink={0x3c, 0x10, 0x403, 0x0, 0x0, {0x0, 0x0, 0x0, r2, 0x90646}, [@IFLA_LINKINFO={0x1c, 0x12, 0x0, 0x1, @bond={{0x9}, {0xc, 0x2, 0x0, 0x1, [@IFLA_BOND_FAIL_OVER_MAC={0x5, 0xd, 0x1}]}}}]}, 0x3c}, 0x1, 0x0, 0x0, 0x690}, 0x20048040) r3 = socket$rds(0x15, 0x5, 0x0) setsockopt$SO_RDS_TRANSPORT(r3, 0x114, 0x8, &(0x7f0000000180)=0x1, 0x4) socket$nl_route(0x10, 0x3, 0x0) r4 = socket(0x3, 0x4, 0xa) r5 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r6 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r7 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r8 = syz_genetlink_get_family_id$nl802154(&(0x7f00000005c0), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_802154(r7, 0x8933, &(0x7f0000000600)={'wpan0\x00', 0x0}) sendmsg$NL80211_CMD_NEW_INTERFACE(r1, &(0x7f0000000440)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x150000}, 0xc, &(0x7f0000000400)={&(0x7f0000000380)={0x50, 0x0, 0x20, 0x70bd2a, 0x25dfdbfd, {{}, {@val={0x8, 0x1, 0x67}, @void, @val={0xc, 0x99, {0x7, 0x5a}}}}, [@NL80211_ATTR_IFNAME={0x14, 0x4, 'virt_wifi0\x00'}, @NL80211_ATTR_IFNAME={0x14, 0x4, 'tunl0\x00'}]}, 0x50}, 0x1, 0x0, 0x0, 0x200448c0}, 0x1c) sendmsg$NL802154_CMD_SET_CHANNEL(r6, &(0x7f0000000700)={0x0, 0x2, &(0x7f00000006c0)={&(0x7f0000000000)=ANY=[@ANYBLOB=',\x00\x00\x00', @ANYRES16=r8, @ANYBLOB="110a28bd7000fddbdf2509000000050008000200000008000300", @ANYRES32=r9, @ANYBLOB="050007"], 0x2c}}, 0x48814) sendmsg$NL802154_CMD_NEW_INTERFACE(r5, &(0x7f00000001c0)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x800}, 0xc, &(0x7f0000000180)={&(0x7f0000000300)=ANY=[@ANYBLOB="48000000f88888a1c9af6f661471", @ANYRES16=r8, @ANYBLOB="00022abd7000fcdbdf250700000008000500010000000a0004007770616e310000000c00060007000000050000000c00060003000000000000000800010000000000"], 0x48}, 0x1, 0x0, 0x0, 0x400c810}, 0x40) getsockname$packet(r4, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000002c0)=0x14) 774.029906ms ago: executing program 3 (id=4852): r0 = socket$inet_smc(0x2b, 0x1, 0x0) setsockopt$IP_VS_SO_SET_ADD(r0, 0x0, 0x482, 0x0, 0x0) syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10) sendmsg$ETHTOOL_MSG_COALESCE_SET(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f00000001c0)={0x0, 0x2c}}, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000080)=ANY=[@ANYBLOB="5000000020000103feffffff0000000002"], 0x50}}, 0x4000850) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f00000007c0)=@bpf_lsm={0x1d, 0x2, &(0x7f0000000500)=ANY=[@ANYRESHEX], 0x0, 0x0, 0x0, 0x0, 0x41100, 0x41, '\x00', 0x0, 0x1b, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x401}, 0x94) openat$6lowpan_control(0xffffffffffffff9c, &(0x7f0000000300), 0x2, 0x0) r1 = socket$inet6_mptcp(0xa, 0x1, 0x106) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000600)={0xb, 0x3, 0x0, 0x0}, 0x94) bind$inet6(r1, &(0x7f00000002c0)={0xa, 0x4e22, 0x0, @local, 0xb}, 0x1c) sendto(0xffffffffffffffff, &(0x7f00000000c0)="120000001200e7ef", 0x8, 0x0, 0x0, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f00000037c0), 0x0, 0xffa6, 0x0) listen(r1, 0x2) r2 = socket$alg(0x26, 0x5, 0x0) bind$alg(r2, &(0x7f0000000940)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc(blowfish)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r2, 0x117, 0x1, &(0x7f0000000280)="ad56b6c5", 0x4) r3 = accept4(r2, 0x0, 0x0, 0x800) sendmmsg$alg(r3, &(0x7f0000000040)=[{0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)="f78d9ca38fff48f3be52163448412ba8", 0xfffffe3f}, {&(0x7f0000000140)="ebe3a0e9796cfd1647e299f4e376fdba128280b372219d205e81f4a7f71c1926aae1efd7e0054a863f3d5cfe6cb55b5bb9fa6935849e6098ed884e7cb51726b360fbb37b4fe035bbb095873048"}, {&(0x7f00000003c0)="e8700e444d50a969ff67347cff6127e6ef12ee3819271482a4975a52c1ab9b8b4db3945d1032005eabe97b4dc33a47d3a158da988456d30026b433186f53cdcdb93a4722bf306a10470d50f5cb1ece9ead3459bab1cf1538cd0b157653c5e892962c80f158c443e9c6ad7d2a8103ef2f4b93766b9a21501f94c1568b13756b66f74f46cf801704d2da8b96c34070b233af0afcc436712e58ed25e721193af05a045ad3fdc928f02f3dbad19d3e66eebda2e63f3f46ef4511cee26d7b48241847bf9e343ef4674c45e2a085060f11"}], 0x1, &(0x7f0000000380)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x40800) recvmsg(r3, &(0x7f00000005c0)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f00000000c0)=""/81, 0x7ffff000}, {&(0x7f0000000200)=""/83, 0x20000253}], 0x2}, 0x0) syz_emit_ethernet(0x4e, &(0x7f0000000600)={@local, @broadcast, @void, {@ipv6={0x86dd, @tcp={0x0, 0x6, '\x00', 0x18, 0x6, 0x1, @local, @local, {[], {{0x0, 0x4e22, 0x41424344, 0x41424344, 0x0, 0x0, 0x6, 0xc2, 0x0, 0x0, 0x0, {[@fastopen={0x1e, 0x2}]}}}}}}}}, 0x0) 772.257412ms ago: executing program 4 (id=4853): r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000180)={0x11, 0xb, &(0x7f0000000100)=ANY=[@ANYBLOB="180300000000008000000000001000008510000006000000180000000000000000000000000000006500000000000000180000000000000000000000000000009500000000000000840300000000000095"], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0xffffffff}, 0x94) r1 = socket$pppl2tp(0x18, 0x1, 0x1) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) socketpair(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="120000000d0000000400000002"], 0x50) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000180)={{r4}, &(0x7f0000000040), &(0x7f0000000140)=r3}, 0x20) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f00000003c0)={{r4}, &(0x7f0000000100), &(0x7f00000001c0)=r2}, 0x20) ioctl$sock_ipv4_tunnel_SIOCCHGTUNNEL(0xffffffffffffffff, 0x89f3, &(0x7f0000000540)={'syztnl2\x00', &(0x7f0000000480)={'tunl0\x00', 0x0, 0x40, 0x0, 0xff, 0xae, {{0x1b, 0x4, 0x0, 0xf, 0x6c, 0x64, 0x0, 0xf8, 0x2f, 0x0, @multicast2, @local, {[@generic={0x7, 0x8, "6947dee650a9"}, @noop, @ssrr={0x89, 0x1f, 0x27, [@broadcast, @private=0xa010100, @initdev={0xac, 0x1e, 0x0, 0x0}, @local, @rand_addr=0x64010101, @dev={0xac, 0x14, 0x14, 0x2f}, @initdev={0xac, 0x1e, 0x0, 0x0}]}, @timestamp_prespec={0x44, 0x14, 0x86, 0x3, 0x4, [{@multicast1, 0x84}, {@private=0xa010102, 0x8}]}, @ra={0x94, 0x4}, @timestamp_prespec={0x44, 0x14, 0xce, 0x3, 0xd, [{@dev={0xac, 0x14, 0x14, 0x36}, 0x7}, {@multicast1, 0x149c}]}, @end]}}}}}) r6 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f00000007c0)={0x1b, 0x0, 0x0, 0x40000, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0}, 0x50) bpf$PROG_LOAD(0x5, &(0x7f0000000040)={0x3, 0x18, &(0x7f0000000100)=@ringbuf={{}, {{0x18, 0x1, 0x1, 0x0, r6}}, {}, [@func={0x85, 0x0, 0x1, 0x0, 0xfffffff5}, @printk={@lu, {}, {}, {}, {}, {0x7, 0x0, 0xb, 0x3, 0x0, 0x0, 0xfffffffb}}], {{}, {0x7, 0x0, 0xb, 0x2, 0x0, 0x0, 0x1}, {0x85, 0x0, 0x0, 0x84}}}, &(0x7f0000000980)='GPL\x00', 0xb, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sched_cls, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r7 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f0000000600)={0x3, 0x4, 0x4, 0xa, 0x0, 0x1, 0x2, '\x00', 0x0, 0xffffffffffffffff, 0x3, 0x0, 0x2}, 0x50) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000700)={{0xffffffffffffffff, 0xffffffffffffffff}, &(0x7f0000000680), &(0x7f00000006c0)=r0}, 0x20) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000800)=@bpf_lsm={0x1d, 0x11, &(0x7f0000000340)=@framed={{0x18, 0x0, 0x0, 0x0, 0xcf5, 0x0, 0x0, 0x0, 0x4}, [@snprintf={{}, {}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0x200}, {}, {}, {}, {}, {}, {}, {0x18, 0x3, 0x2, 0x0, r4}}, @kfunc={0x85, 0x0, 0x2, 0x0, 0x4}]}, &(0x7f0000000400)='syzkaller\x00', 0x1, 0x16, &(0x7f0000000440)=""/22, 0x41000, 0xd, '\x00', r5, 0x1b, 0xffffffffffffffff, 0x8, &(0x7f0000000580)={0x0, 0x2}, 0x8, 0x10, &(0x7f00000005c0)={0x2, 0xb, 0x6, 0xfffffff9}, 0x10, 0xffffffffffffffff, 0x0, 0x7, &(0x7f0000000740)=[r6, 0x1, r7, r8], &(0x7f0000000780)=[{0x5, 0x4, 0x3, 0x9}, {0x1, 0x3, 0x5, 0xc}, {0x0, 0x1, 0x1, 0x5}, {0x4, 0x2, 0x7, 0x9}, {0x0, 0x2, 0x6, 0x8}, {0x0, 0x3, 0xc, 0xc}, {0x3, 0x4, 0x2, 0xa}], 0x10, 0x7ff}, 0x94) ioctl$SIOCSIFMTU(r1, 0x8922, &(0x7f0000000040)={'veth0_virt_wifi\x00', 0xa9a4}) r9 = accept4$inet6(0xffffffffffffffff, &(0x7f0000000080)={0xa, 0x0, 0x0, @empty}, &(0x7f00000000c0)=0x1c, 0x80000) r10 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r10, 0x8933, &(0x7f0000000300)={'bridge0\x00', 0x0}) sendmsg$nl_route(r10, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000080)=@RTM_NEWMDB={0x38, 0x55, 0x1, 0x70bd2b, 0x2, {0x7, r11}, [@MDBA_SET_ENTRY={0x20, 0x1, {r11, 0x0, 0x2, 0x0, {@ip4=@loopback}}}]}, 0x38}}, 0x40080c0) ioctl$sock_inet6_SIOCDELRT(r9, 0x890c, &(0x7f0000000240)={@ipv4={'\x00', '\xff\xff', @initdev={0xac, 0x1e, 0x1, 0x0}}, @dev={0xfe, 0x80, '\x00', 0x1a}, @empty, 0x4, 0x5, 0x5, 0x100, 0x2, 0x410100, r11}) 634.676964ms ago: executing program 0 (id=4854): r0 = bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000400)={&(0x7f0000000680)=ANY=[@ANYBLOB="9feb01001800000000000000340000003400000b0000000000001101000000030000000800000000000009040000000200000000000000030000000a000000000000100800000000612e2e2e00305f30000000000000000026b2b6eba670406657b0724cd84922ebd7f9f08fab32232a0978aff6717dd58fe4d18a40ec4361c5ad4abef0333538b332c142f60bccfd7bc5cea69f53107c25230e4785864fdfaeb10adf2a124fcc3fcb"], &(0x7f0000000380)=""/109, 0x58, 0x6d, 0x1, 0x0, 0x10000}, 0x28) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000080)={0x3, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x41000, 0x4, '\x00', 0x0, 0x25, r0, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x4}, 0x94) r1 = socket$kcm(0x2, 0xa, 0x2) ioctl$sock_SIOCETHTOOL(r1, 0x8946, &(0x7f0000000080)={'ip_vti0\x00', &(0x7f0000000000)=@ethtool_sfeatures={0x17}}) r2 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_fanout(r2, 0x107, 0x12, &(0x7f0000000000), 0x4) r3 = socket$netlink(0x10, 0x3, 0x20) r4 = epoll_create1(0x0) ioctl$FS_IOC_SETFLAGS(r4, 0x40088a01, &(0x7f0000000000)=0x10) r5 = socket$nl_generic(0x10, 0x3, 0x10) r6 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000500), 0xffffffffffffffff) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r5, &(0x7f0000000740)={0x0, 0x0, &(0x7f0000000640)={&(0x7f00000005c0)=ANY=[@ANYBLOB='D\x00\x00\x00', @ANYRES16=r6, @ANYBLOB="010025bd70001bdcdf250100000030000180080006001c0100000001000000397fed2b19e367626b76a09e890ce4b200ff02010800070021e6", @ANYRES32=0x0, @ANYBLOB], 0x44}, 0x1, 0x0, 0x0, 0x48090}, 0x4000) epoll_ctl$EPOLL_CTL_ADD(r4, 0x1, r3, &(0x7f0000000040)={0xe000200d}) r7 = socket(0x200000100000011, 0x803, 0x0) setsockopt$packet_fanout(r7, 0x107, 0x12, &(0x7f0000000100), 0x4) syz_emit_ethernet(0x42, &(0x7f0000000000)={@dev={'\xaa\xaa\xaa\xaa\xaa', 0x2c}, @broadcast, @void, {@arp={0x806, @ether_ipv6={0x1, 0x86dd, 0x6, 0x10, 0x9, @broadcast, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01', @empty, @mcast1}}}}, &(0x7f0000000140)={0x0, 0x2, [0x93, 0x13e, 0xd0f, 0x1bb]}) r8 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000200), r7) r9 = socket$netlink(0x10, 0x3, 0x0) r10 = socket$netlink(0x10, 0x3, 0x0) sendmsg$NL80211_CMD_NEW_KEY(0xffffffffffffffff, &(0x7f00000004c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000540)=ANY=[@ANYRES8=r6, @ANYRES16=0x0, @ANYRES32=r10, @ANYRES32=0x0, @ANYRES64=r0], 0x1c}, 0x1, 0x0, 0x0, 0x20000001}, 0x4000004) ioctl$sock_SIOCBRDELBR(r10, 0x89a2, &(0x7f0000000000)='bridge0\x00') writev(r9, &(0x7f0000000040)=[{&(0x7f0000000180)="290000002000190f00003fffffffda0602000000ffe80001dd0000040d001800ea11c21d0005000000", 0x29}], 0x1) r11 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r11, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000003c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a01030000000000000000010000000900010073797a300000000040000000030a01020000000000000000010000000900030073797a32000000001400048008000240326565a708000140000000000900010073797a300000000048000000060a010400000000000000000100000008000b40000000000900010073797a3000000000200004801c0001800b00010072656a65637400000c000280080001400000000114000000110001"], 0xd0}}, 0x0) syz_emit_ethernet(0x100, &(0x7f0000000880)={@broadcast, @dev, @void, {@ipv4={0x800, @generic={{0x7, 0x4, 0x2, 0x3d, 0xf2, 0x67, 0x800, 0x1, 0x21, 0x0, @broadcast, @remote, {[@end, @timestamp={0x44, 0x4, 0xd5, 0x0, 0x6}]}}, "33629a7ea000426699a51bee9a74f89e93121fb96ec2f87bf5724364207fa8f253ce4608512153fd0959377e9dba6be55a22d96a474a51068212b6ded5619cacbf0447cac486a279d6e47c1cfa428a0d837d9120dcbad104d24f36e57c9fae294abec0854862e6627630a513957b512fc7989f6e2a62af87f8818ee785007548f03093a862f39c73a85090f033a6797d08444a31afa83ac986a4c2d51cde61d1f154a7be137e8deedf7df34f2be772428025b47256ae82ee345b07cad904e2f4f830c93d0c7ecc72c905fed99d8afee26f56b42ec928"}}}}, 0x0) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r3, &(0x7f00000002c0)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x20000}, 0xc, &(0x7f0000000280)={&(0x7f0000000240)={0x14, r8, 0x1, 0x70bd26, 0x25dfdbff}, 0x14}, 0x1, 0x0, 0x0, 0x8010}, 0x84) r12 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='memory.events\x00', 0x275a, 0x0) write$cgroup_subtree(r12, &(0x7f0000000000)=ANY=[], 0x32600) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x2000001, 0x12, r12, 0x0) socket$inet_icmp_raw(0x2, 0x3, 0x1) 588.214433ms ago: executing program 3 (id=4855): r0 = socket$netlink(0x10, 0x3, 0x0) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f00000001c0), r0) sendmsg$NL80211_CMD_SET_QOS_MAP(r0, &(0x7f0000000340)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x20000000}, 0xc, &(0x7f0000000300)={&(0x7f0000000200)={0xd0, r1, 0x200, 0x70bd25, 0x25dfdbfe, {{}, {@void, @void}}, [@NL80211_ATTR_QOS_MAP={0x34, 0xc7, {[{0x2, 0x5}, {0x5, 0x2}, {0xc0, 0x4}, {0x1, 0x7}, {0x3, 0x7}, {0xfb, 0x5}, {0x3, 0x5}, {0x4, 0x6}, {0x6, 0x6}, {0x4, 0x1}, {0x6, 0x1}, {0x40, 0x5}, {0xf7, 0x3}, {0x8, 0x5}, {0x7, 0x2}, {0xbc, 0x3}, {0x5, 0x3}, {0xff, 0x4}, {0xab, 0x1}, {0x2, 0x7}], "4230d8199e3f4abc"}}, @NL80211_ATTR_QOS_MAP={0x14, 0xc7, {[{0xe0, 0x5}, {0x1, 0x2}, {0xa0, 0x4}, {0xf, 0x5}], "6c22295ca09b6f69"}}, @NL80211_ATTR_QOS_MAP={0x12, 0xc7, {[{0x1, 0x3}, {0xff, 0x5}, {0x67}], "4cf1cddbd20c1d77"}}, @NL80211_ATTR_QOS_MAP={0x16, 0xc7, {[{0x10, 0x6}, {0x49, 0x1}, {0x0, 0x1}, {0xcb, 0x2}, {0x3b, 0x7}], "88d5e7f4c5957748"}}, @NL80211_ATTR_QOS_MAP={0x18, 0xc7, {[{0x8, 0x2}, {0x45, 0x3}, {0x4}, {0x5, 0x4}, {0x52}, {0x9}], "c7c8eb36b9a1a507"}}, @NL80211_ATTR_QOS_MAP={0x18, 0xc7, {[{0x8e, 0x4}, {0x72, 0x3}, {0x7}, {0x10, 0x5}, {0x5, 0x7}, {0x6, 0x40}], "1f47fffe91f8938a"}}, @NL80211_ATTR_QOS_MAP={0x18, 0xc7, {[{0xb, 0x3}, {0x8, 0x1}, {0x94, 0x5}, {0x80, 0x1}, {0x8, 0x4}, {0x9, 0x1}], "46109f0f17d08787"}}]}, 0xd0}, 0x1, 0x0, 0x0, 0xc0}, 0x20000004) socketpair(0x2c, 0x3, 0x1, &(0x7f0000000080)={0xffffffffffffffff}) getpeername$packet(r2, &(0x7f0000000000)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000040)=0x14) sendmsg$nl_route(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000001140)={&(0x7f0000000100)=@newlink={0x50, 0x10, 0x503, 0xfffffffc, 0x40000, {0x0, 0x0, 0x0, 0x0, 0x21111, 0x31}, [@IFLA_LINKINFO={0x28, 0x12, 0x0, 0x1, @macsec={{0xb}, {0x18, 0x2, 0x0, 0x1, [@IFLA_MACSEC_CIPHER_SUITE={0xc, 0x4, 0x80c20001000001}, @IFLA_MACSEC_WINDOW={0x8, 0x5, 0x5}]}}}, @IFLA_LINK={0x8, 0x5, r3}]}, 0x50}, 0x1, 0x0, 0x0, 0x48890}, 0x0) 443.992859ms ago: executing program 4 (id=4856): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000300), 0xffffffffffffffff) sendmsg$TIPC_NL_LINK_SET(r0, &(0x7f0000000780)={0x0, 0x0, &(0x7f0000000740)={&(0x7f0000000000)=ANY=[@ANYBLOB="142abcdbd0ef10f019580e3ce2f441a545", @ANYRES16=r1, @ANYBLOB="010000000000000000000a000000800004801300010062726f6164636173742d6c696e6b00002400078008000300000000000800030007000000080001000000000008000300050000002c000780080002000100000008000400000100000800030004000000080001001500000008000200030000006a00010073797a30000000000900010073797a3100000000"], 0x94}}, 0x0) 424.871795ms ago: executing program 0 (id=4857): r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000780)=ANY=[@ANYBLOB="19000000040000000800000008"], 0x50) r1 = socket(0x10, 0x80002, 0x0) sendmsg$nl_route(r1, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000100)={&(0x7f00000001c0)=ANY=[@ANYBLOB="1c0000005e00679a3601ffc4910700004f78d4c1a0731cccff"], 0x1c}}, 0x0) recvmmsg$unix(r1, &(0x7f0000000000)=[{{0x0, 0x0, &(0x7f0000001340)=[{&(0x7f0000001380)=""/4096, 0x1000}], 0x1, 0x0, 0x0, 0x1000000}}], 0x14, 0x0, 0x0) r2 = socket$nl_route(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) pipe(&(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) splice(r4, 0x0, r6, 0x0, 0x1, 0x0) vmsplice(r5, &(0x7f0000000c40)=[{&(0x7f0000000180)='\r', 0x1}], 0x1, 0x6) ioctl$sock_inet_udp_SIOCINQ(r6, 0x541b, 0x0) write(r3, 0x0, 0x0) sendmsg$nl_route(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000600)=ANY=[@ANYBLOB="300000001800090000000000000000001c140000fe000001000000000a00120002"], 0x30}}, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x6, 0xd, &(0x7f0000000200)=ANY=[@ANYBLOB="18000000000000000000000000000000850000000700000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bca2000000000000a6020000f8ffffffb703000008000000b704000000000400850000003300000095"], &(0x7f0000000800)='syzkaller\x00', 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @xdp, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r7 = socket$inet_tcp(0x2, 0x1, 0x0) socket$nl_route(0x10, 0x3, 0x0) setsockopt$IPT_SO_SET_REPLACE(r7, 0x0, 0x40, &(0x7f0000000000)=@raw={'raw\x00', 0x8, 0x3, 0x260, 0x128, 0x43, 0xa0, 0x128, 0x98, 0x1c8, 0x178, 0x178, 0x1c8, 0x178, 0x49, 0x0, {[{{@ip={@loopback, @initdev={0xac, 0x1e, 0x0, 0x0}, 0xffffff00, 0xffffffff, 'veth0_vlan\x00', 'bond0\x00', {0xff}, {}, 0x0, 0x2}, 0x12a, 0xc8, 0x128, 0x0, {0x0, 0x7a010000}, [@inet=@rpfilter={{0x28}, {0x1}}, @common=@addrtype={{0x30}, {0x1}}]}, @common=@SET={0x60, 'SET\x00', 0x0, {{0x0, [0xe7b34dc4353f5976, 0x4, 0x6, 0x1, 0x6], 0x6, 0x4}, {0xffffffffffffffff, [0x2, 0x7, 0x7, 0x0, 0x4, 0x1], 0x3, 0x1}}}}, {{@uncond, 0x0, 0x70, 0xa0}, @common=@inet=@SET2={0x30, 'SET\x00', 0x2, {{0xffffffffffffffff, 0x6}, {0x4, 0x1, 0x4}, 0x8, 0x1cc32a6}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28, '\x00', 0x4}}}}, 0x2c0) r8 = bpf$MAP_CREATE(0x0, &(0x7f00000002c0)=@bloom_filter={0x1e, 0x8, 0x7, 0x8001, 0x4003, r0, 0x3, '\x00', 0x0, 0xffffffffffffffff, 0x5, 0x0, 0x2, 0xa}, 0x50) r9 = socket$packet(0x11, 0x3, 0x300) ioctl$sock_SIOCGIFINDEX(r9, 0x8933, &(0x7f0000001800)={'veth1_virt_wifi\x00', 0x0}) setsockopt$packet_int(r9, 0x107, 0xf, &(0x7f0000000000)=0x3da, 0x4) sendto$packet(r9, &(0x7f00000000c0)="3f03fe7f0302140006001e0089e9aaa911d7c2290f0086dd1327c9167c643c4a1b7880610cc96655b1b141ab059b24d0fbc50df71548a3f6c5609063382a0c1511fdc9435e3ffe46", 0xe90c, 0x0, &(0x7f0000000540)={0xc9, 0x0, r10, 0x1, 0x0, 0x6, @multicast}, 0x14) r11 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r12 = openat$cgroup_ro(r11, &(0x7f00000002c0)='blkio.bfq.time_recursive\x00', 0x0, 0x0) preadv(r12, &(0x7f00000000c0)=[{&(0x7f0000000180)=""/140, 0x8c}], 0x1, 0x0, 0x0) r13 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_int(r13, 0x29, 0x4b, &(0x7f0000000100)=0x401, 0x4) setsockopt$sock_int(r13, 0x1, 0xf, &(0x7f0000000180)=0x800001, 0x4) bind$inet6(r13, &(0x7f0000000140)={0xa, 0x4e22, 0x3, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02', 0x31e5}, 0x1c) listen(r13, 0x1) bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f00000003c0)={0x2, 0x4, 0x8, 0x1, 0x80, r8, 0x7fff, '\x00', r10, r12, 0x3, 0x4}, 0x50) 366.942978ms ago: executing program 3 (id=4858): recvmsg(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000014c0)}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000180)=@newqdisc={0x24, 0x24, 0x20, 0x800, 0x0, {0x0, 0x0, 0x0, 0x0, {0x3, 0x5}, {0xc29b9f0cf3c06c67, 0xfffe}}}, 0x24}}, 0x48880) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000080)=ANY=[@ANYBLOB="7800000010000304000000000000000000007400", @ANYRES32=0x0, @ANYBLOB="00000000600000005800128008000100677470"], 0x78}}, 0x0) r0 = socket$netlink(0x10, 0x3, 0x0) sendmmsg(r0, &(0x7f00000002c0), 0x40000000000009f, 0x0) recvmsg(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000014c0)}, 0x0) (async) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000180)=@newqdisc={0x24, 0x24, 0x20, 0x800, 0x0, {0x0, 0x0, 0x0, 0x0, {0x3, 0x5}, {0xc29b9f0cf3c06c67, 0xfffe}}}, 0x24}}, 0x48880) (async) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000080)=ANY=[@ANYBLOB="7800000010000304000000000000000000007400", @ANYRES32=0x0, @ANYBLOB="00000000600000005800128008000100677470"], 0x78}}, 0x0) (async) socket$netlink(0x10, 0x3, 0x0) (async) sendmmsg(r0, &(0x7f00000002c0), 0x40000000000009f, 0x0) (async) 318.057357ms ago: executing program 4 (id=4859): socket$nl_xfrm(0x10, 0x3, 0x6) r0 = socket(0x1e, 0x5, 0x0) r1 = socket$inet6_sctp(0xa, 0x5, 0x84) shutdown(r1, 0x0) close(0x3) r2 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000001240)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000340)=@newlink={0x50, 0x10, 0xffffff1f, 0x0, 0x25dfdbff, {0x0, 0x0, 0x0, 0x0, 0x0, 0x35288}, [@IFLA_LINKINFO={0x30, 0x12, 0x0, 0x1, @ipip6={{0xb}, {0x20, 0x2, 0x0, 0x1, [@IFLA_IPTUN_REMOTE={0x14, 0x3, @local}, @IFLA_IPTUN_TTL={0x5, 0x4, 0xf}]}}}]}, 0x50}, 0x1, 0x0, 0x0, 0x2000c014}, 0x4000080) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r1, 0x84, 0x6f, &(0x7f0000000200)={0x0, 0x10, &(0x7f00000001c0)=[@in={0x2, 0x4e21, @rand_addr=0x64010100}]}, &(0x7f0000000140)=0x10) getsockopt$inet_sctp6_SCTP_PRIMARY_ADDR(r1, 0x84, 0x7a, &(0x7f0000000340)={r3, @in6={{0xa, 0x3, 0x4, @mcast1}}}, &(0x7f0000000040)=0x84) listen(r0, 0x0) bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0x15, 0x4, &(0x7f0000000040)=ANY=[@ANYBLOB="b4000000020000000f100000000000007a0000000000000095f305e49b243c69"], &(0x7f0000003ff6)='GPL\x00', 0x9, 0xba, &(0x7f000000cf3d)=""/186, 0x0, 0x0, '\x00', 0x0, @sk_reuseport=0x27, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x8, 0x10, &(0x7f0000000000), 0x10}, 0x94) 262.850017ms ago: executing program 3 (id=4860): r0 = socket$pptp(0x18, 0x1, 0x2) writev(r0, &(0x7f0000001080)=[{&(0x7f0000000000)="77c4b4d047e0c94de478e60972cbd5939b30e5e5caeb83a49f5699d7861c7ef12180cdee226001742f40dcbe68790e629449adc58caf0ee8a4ee384887de6517846d02b17824d03b0dab77f41f16b804bcbd8c807a87b42388fd284a41bb26ea033450c09569d9fa0c17c20791c2fde3a36dc8bec15d5c14789b8261f372dd6bd20fa600aee6a5c6fb4e7de02c03b915bd25b7219bd9c9fb51d5654b0375f7fa5c8e29027e6ad1045452f817433e64f48dc46556e2698fff3495fe2c0f6f01ac32c75b4b833ee6efa4dde8a6576e2db32c4f95f8f490bfffc8b9b3ca5a9c17113929cab30d686c6f9bd13540cdbbccd272e5308027e271038db9c5b1e9b6f82c9d16be1a7937a3a4a7b06da958ef79ed4a02e539fe108d97353d80781384673af8a2fdd045adddb0c317f061e5a0124b939f58179fb094b90a1118c9ec624d3d8e6f2e60941438d35147aa9c8ec18cf620832295513037cad1b8ae2ac7439ef9df9290ac400544e820fed7978d8730e5689d1b10720d4eddf43b56f7c262be9d79f4dd3e440c7d4c80fd76e5497641ddf94ca4063f335e9138e6f4dc175857f319460a2b45eb090a309fde3b94d38d0f827edf301891a08ee7bcc04d52944c0873ac108697674494910a57f3e21654090b71368a15c97d4f770641bd2307008bb6f688277daf2143a664f9777ff02a28cf1165359b5de3f2cd56be72e469798779733d16aaa8513bbda9a4ab2402ceb08b11be27e643dac367cd7179f0bcaa04f895e1c1b179132efa22b4831cb7c57e79da2b2fd8f862f2f8726b79a7f35082c318ac9bdd33de7c3cc25417e8d54b871e8996bfb655002629ab2d946822c403bad5536a761a7e1b43b8c220f59dd63a2ac4785a98c4aae43fbad55eb40c785166368b3e7174817e1dd0f9bf71d0c552e726b96aee52f4213bb946fdc3ae8ec64afcfd1d2b106f6b3dafdb13f2d05c13b1a6c685b3fa0e920858e920f6bbbe9143d23e749af18caca5aac4520f4f77ef763b6bd1e3f37bbc30136b4b66bf812718b272e570ba90789ef5e76ec0dd1dbdb16e18230146aa73190cb0fdec76eb86b6f914e4a06d613745c66d01b1495d074cdfca1f7f39a886d1bbd5b31b25ae0078e75d4265cc327fa14f74c8e71d70d6538e8dd6517179dce7aeed0e2033c9fea8438d39984468fdc32eb3393474c6c367f498d47d4f376c3602733dcee101e99edca410f75afaa8d696558684e2100e05a00e517a03b2b459c331d6a55dd8cfdd2894be0875746dfc2f1bbbfec7570cf1be4d2aef062d8c8f369ae521be0e53c115864e7e27264669e556d4bf4fa5ae496d924f4d62db4124ebdaa25790ca3ca64152078bf8e32e90dff077a827a0272e5fe2b182e8ce80e7fca186b5cdedf1e3547aafdd6140fcb9a6f9b5c2a89d7b73bdb9b219cf4cc85e93d1ffc618d13604bc9a5e0e0a51db12f74845d17a856d0495292c7640fb49f40513bf95fd52d1b35c656187c3ce399029afb8ca6f2fba72ae71720be31ca986e20c97d0e8a927cddcb60a8573b51f41e1266cff4a5c98100e7929967b37365381a098a2aefb3f36a40a437dcf8bf415daad983f9d928dfb5d048b53d11d6175480f45422ee609a3e761c0cb8e31acd70e474d8e6adb51a908576db76a686ce068a8c3ae4f491b259e592b5ecd826a4fe34e83bb6d452cdd58d53da37f4d4ff1967abff783535f839cd8096acc7e1efae60ccf402ecbf4001e9ceacb35dc22e8653da4832079065db99e54250467ec51e1bb12567a1fd4179dbe6802d2837bb5ffa4bc64506ee87870dae4c2883a89783aa7c3cf232b82ddcb424e581c9d5933fb183e00900cc83f420ac41d03eda0f3b857220f0dedc80d1e2d4854027ffe4dfc7415784b97476de594e22d9b5bbb9e6d51cd75eda55a95e5ffb75130e6ce2bf1de13e3ebd0129124f21996f7b27cfcc18351e100b5471e00c48a7d25555cb0eb8ec8beee9d0b74589f69588550bfb1e910f763b3043a9731bdb231446a195bc51c6781576984953742efb11f672c9b94a1dd387512b110be72d77b9639b86cc3211c65bc56e4098268cc979d2723e6461cfea1079259ff92ee530c1c81d7e12bbdb12c18fda81d95dda5603fa3d85204213c6bdb2d6ac5aae48d5a5391f622ebc7ddd065cee1ea9eec3c8f2918ec610bd4630c09feb8560ac028479dc95e7552dcfe54995fd2c42fd2cd463b4b2d392372c066a1b73a2722f38dadec83d59d943e0cf0fdfed11c87ce0ba995fe39a546b136bd15c70a052697adb17964ba4f706c17e54624aa1630430dc2a30bf8c67336b08d6858d4a8bb50695a9241a6820f80184f33d168a484624b4e4b5ee6855fa45838eda910bae6cbaa4c752fd6a1be81e1e00cdad1164e3c4326e763acfa81321cb1ddef79920e60d86ae955bbae3b2c438b34b449551a01efa7068b4f93195b60b9f74a52410d0dbb9eb5ff9d6cf68c5f2c881035416052b9e13ec958e528784b1c086aa7b17502940fc8ac8440fac8cf8bb5f652091fd6435adcbde0d9706f824a1691ab3abfdc8fbcdc790982dbcbcbe7606982552e132af4c5bbc34582221d2d208e60f1601a9e03235e339377c8f5e1dfa814f4c677199114d8d5b659a7958710d1166edaf0d0dd2c10b439490315872cfe3f7be00b5935ec03dcf4f7343c3b11c80175587f9c2a5ffd3ef3deb2374099319817b3806e6c4733345fda3290253cfbdf87d1ccb74ece4aabe2f9751ca4cf3516f54ec9f845a830ce44f38cf6ce856670b716058d730cb58f9dd995150781f0809e8528f7d01d66527c318d0d44407bd34a1aa57e15fd623b3b21e2194f5703beaae0766541ef75b1877deeef1231c2a867ff1384fe4c58251e0290f9a2858cffdff365b4b377f54818e1d700459e6606107cf651da949529a3fb8dd43fa1fb9a2da28c742de3005f509ed96cd379b9691444812047769d9def02344f352ac8abf5ce067bdea7fcb038b4b434d00e4a6dbed953d16c220bfac17d3678fa55f2bcb45b1780faf51871c00dad0f1f85e4544a3b0852f7ff4a792fd1f689d59be48c314725c6d8758d3662669f19d8f7d459bb0b402d5af01cd0c99de7238e240d176755dc764c4c08f0f2943033326cd93b3d8cfb7b71a963803eb10b723df2307ca0fa24c8307e057b03d48a227e6056983cefee828911c4e862fd49dc4016a81f57ac65f4ca73e3e79adf791b07f967bda5758bc3da70c5166f085ecefbec02d9f6a3423a6b62f853a7501f41d792ff1f0e3fcbd09d0933a38444256234f9e8bc21126c9e5765e42842fe5b47cc89f33ca73b5e2a2a2d816d55dcfd06f4e3affaca67fe625f10ce83c6674e5157a0d27921f86216448a2b3cab018440e9c761538c941daeae2902e56b3000818e8b002c7b91ead35d73ff9b4c8bd9946f88083a825e66fd18b3c390fb51ee23a964fbd5ed4be629e936a920ae2b5b81f8800bc91f3224d24232c5d32970326e345f3a7cf25726b9a35c014139f5aab75f30ab551b49e631677486587772ed468405f3a5d51f964e272ebdf85ab60bcabcaff96e4cbc5d5ac9bc4623c3958e6f193cf530f12463b3c2151fc5e110fc1eea3d105d0c6e6ed06c0b3e0a09fcff2c53625cbaf0fc30b64621f1962c3c6627c3c7139ea436379ced035bb0d411526aa3b0cd32d6c790819bb9a020492518ab9ecf489e1d1ea19f199fde08ea43cb1037b78c16fadeecfcafb736ec865661f0d7e4a0b16c86ac168e39d3431e8301c9df4fce71cf83e5f7424352a6e0f8043f2289262ece070518b75ed24f3a26f8ac0d29f21c7e037ead73b650b29330a0244d7110f1a3f4c7c4d0e5e7e2d5625f2c9043edcaa2720490f44d2d87505fe82dc3261befd70ad820afbccdc14fe705c93d4484f690239bde31b2eeb5296dfbc3e1689225edfbe56fc4b565205ffacfe4c19109b5798ceab84be68c0fc1aab81c9426545c85ce9aaf00cb05125a11432e8ac4784dea07e9df7acf8c7dbb146e3c1f84dffcb414c461354b9df56ab75fe4881a5f4f8d93b9c0adb1ecbead1eee93804cd025df3cbb5bf47ea13b00c34020a4068ced14a8e17c10dfb64e104811c7fc399183b93d18585ea80add3da6983883d604aef13756491fc1dc578844e636c3c70cef833b213d5c276c95a53c3fd1c816c6cd6a2d322f4538cb282b382ced90bd24bc847c66debe4239171ae181f8c520ea31e9060a0b4ffb2293e359a348f3f1967a5ebf21b3b9f73298b751e077b9c4529780c2de3593ae571a4d297b7552457e0654f720b491f542e9061890a428dd3d8070d324cfa56dd5134bba7bc864cd5a28e89d5e2ceb10b9b680f418ec7ccfa347b4ab883d0c020c3f0704c9a35f361a9396d0395154002703efa95bf2421329b41c4b63ec90f344f7ac76811b948188ab0bebee827df3d5af533c8e08cf767cc24942ef7e711444824bfce12b5db563985c82794d874fe9c04a1075652958f3817feaf35f79503e3719a3cd5cff9675a9e528d4444d7b71b069daae89e790fae2b714bdbcf6fd47b6babde7dda010b5e3eb0bcd4bce2440b66cf74863a41dd31e9a70781695f52fc06d7cd258dd65d157b8951c9844223f4116e4238298c16366fd44b663f70c9e1290bc900301dff3219f85da959366fd914045d6899e4462fd0ad3a5946be2a7d51aa73dde1638cee1743797f4b58d50ab76aae70b0b5297fc9bec2d537a18980a156921dc1398be7a518ccc37fad9c35c260dcd06e8e32caab632af6b0343b65171eb6d3d5ad43816af02ba27a1f514a4f17b5a43ad9d370138f6a339690a0396590c58222f24d20190e4f2f04976269e948f2b6cefd5024da04562f31d14cca5d4b84c94e90855a895444c29ab1645a8ee788756765fe5033c9ee981f639391fcf576e2fd5b7b5d91e7270b23a98384779fbdd8ce42dfec98ccd87de2a847251fe7ebe449c36a08d5bb3c9d6be9fd26c6606b4552fe113c38f0edf3c592179c885fc1be649a4b1e6a21e81138b63a1434ecf8d591ac7ac5d4ed1b520ce5f8f29ca6c326746c201e67971b164d6a5f9c2b79ba002ff016ab8e77f43e7f0d720330419f3dafca2ccf6bcbca0e74badb14f5bf6e1daa0652f3f3c2fc160e551f41186a182204c66ea81a2d7e74060452cbd6a028f961a9855a9ead4d2609577085f5e6d44be1107c51f9e97228f4a22c0848b72f8d4f1d26b86ad1822fef256b62ea25d328aa20968991eda96b7f44417bc4f30ab8fa713bc72f4f931dc1cef0ef21e70941bd7fe0bf1ee2b216675cbe98d5b5d603da55179ff1c0ef1e1c67f1a84445b263a4148c65a4b051b0f2d1444bc6274e3e89d90b720774f124227fcd7eb0f3362b4eba48af9eb63522cb8cbd1e2a234860277448768fb5fda7810d3195c0136ad2e6acfab98681c1c83450e15fb2112cfd78419e19c57f28746590565673e89f37d67d058224d041788092f183718289c8c9c6009ca3b732097f4e9bf420cebfae2b99386cfc517c455c6e3e334575c2a2065ae64f554476c5223081b4764a7e0a6cee979cae082c887eee5227f0a46785011a803610bcceb9da8e22cd6edac4e0b6cb04cbd137a4f1cd8b6b3dc3c70641a6ecfb41ecccd469afaaa9589a8bd6d0664e0296c75af20d3d13194006e79b341b80f0043e792658a7079624399b37f8f6278530ae30ffe3b58ed1daf136fc81610449667a0aef83823fab91975af08cdf0f3394d65c479bd596ca5c663978ad813d1a7c797d5e54866f2eaa03a11645cb92d1da5", 0x1000}, {&(0x7f0000001000)="1511481a9357dfc3925b68983766f0fa4708", 0x12}, {&(0x7f0000001040)="79df576c0e25a73d4f20c945e62b72cb6ef3de23", 0x14}], 0x3) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$nl80211(&(0x7f0000001100), 0xffffffffffffffff) sendmsg$NL80211_CMD_GET_INTERFACE(r1, &(0x7f00000011c0)={&(0x7f00000010c0)={0x10, 0x0, 0x0, 0x800}, 0xc, &(0x7f0000001180)={&(0x7f0000001140)={0x20, r2, 0xcde3d7aabe1fc456, 0x70bd25, 0x25dfdbfc, {{}, {@void, @val={0xc, 0x99, {0x8, 0x32}}}}, ["", "", "", "", ""]}, 0x20}, 0x1, 0x0, 0x0, 0x5}, 0x40) r3 = socket$nl_audit(0x10, 0x3, 0x9) sendmsg$AUDIT_LIST_RULES(r3, &(0x7f00000012c0)={&(0x7f0000001200)={0x10, 0x0, 0x0, 0x20000000}, 0xc, &(0x7f0000001280)={&(0x7f0000001240)={0x10, 0x3f5, 0x2, 0x70bd29, 0x25dfdbfe, "", ["", "", ""]}, 0x10}, 0x1, 0x0, 0x0, 0x4000800}, 0x4000000) r4 = syz_genetlink_get_family_id$devlink(&(0x7f0000001340), r1) sendmsg$DEVLINK_CMD_SB_OCC_MAX_CLEAR(r1, &(0x7f0000001480)={&(0x7f0000001300)={0x10, 0x0, 0x0, 0x400}, 0xc, &(0x7f0000001440)={&(0x7f0000001380)={0xa8, r4, 0x5, 0x70bd29, 0x25dfdbfe, {}, [{@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, {0x8, 0xb, 0x26e}}, {@pci={{0x8}, {0x11}}, {0x8, 0xb, 0x1}}, {@pci={{0x8}, {0x11}}, {0x8, 0xb, 0x9}}, {@pci={{0x8}, {0x11}}, {0x8, 0xb, 0x95}}]}, 0xa8}}, 0x800) r5 = socket$nl_crypto(0x10, 0x3, 0x15) ioctl$BTRFS_IOC_SET_FEATURES(0xffffffffffffffff, 0x40309439, &(0x7f00000014c0)={0x3, 0x0, 0x1a}) ioctl$OCFS2_IOC_MOVE_EXT(r3, 0x40406f06, &(0x7f0000001500)={0x800, 0xffffffffffffffff, 0x100000000, 0x9, 0x1}) r6 = syz_genetlink_get_family_id$nl802154(&(0x7f0000001580), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_802154(0xffffffffffffffff, 0x8933, &(0x7f00000015c0)={'wpan3\x00', 0x0}) ioctl$sock_SIOCGIFINDEX_802154(0xffffffffffffffff, 0x8933, &(0x7f0000001600)={'wpan4\x00', 0x0}) sendmsg$NL802154_CMD_SET_SEC_PARAMS(0xffffffffffffffff, &(0x7f0000001700)={&(0x7f0000001540)={0x10, 0x0, 0x0, 0x8000000}, 0xc, &(0x7f00000016c0)={&(0x7f0000001640)={0x44, r6, 0x200, 0x70bd2a, 0x25dfdbfd, {}, [@NL802154_ATTR_SEC_OUT_LEVEL={0x8, 0x2a, 0x6}, @NL802154_ATTR_SEC_OUT_LEVEL={0x8, 0x2a, 0x3}, @NL802154_ATTR_SEC_FRAME_COUNTER={0x8, 0x2c, 0x4}, @NL802154_ATTR_IFINDEX={0x8, 0x3, r7}, @NL802154_ATTR_IFINDEX={0x8, 0x3, r8}, @NL802154_ATTR_SEC_ENABLED={0x5, 0x29, 0x1}]}, 0x44}, 0x1, 0x0, 0x0, 0x4015}, 0x4) sendmsg$IPVS_CMD_SET_CONFIG(r1, &(0x7f0000001900)={&(0x7f0000001740)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f00000018c0)={&(0x7f0000001780)={0x120, 0x0, 0x600, 0x70bd29, 0x25dfdbfe, {}, [@IPVS_CMD_ATTR_DEST={0x4c, 0x2, 0x0, 0x1, [@IPVS_DEST_ATTR_U_THRESH={0x8, 0x5, 0x10}, @IPVS_DEST_ATTR_FWD_METHOD={0x8, 0x3, 0x1}, @IPVS_DEST_ATTR_ACTIVE_CONNS={0x8, 0x7, 0x1ff}, @IPVS_DEST_ATTR_FWD_METHOD={0x8, 0x3, 0x3}, @IPVS_DEST_ATTR_TUN_FLAGS={0x6, 0xf, 0xf}, @IPVS_DEST_ATTR_PERSIST_CONNS={0x8, 0x9, 0xf612}, @IPVS_DEST_ATTR_TUN_TYPE={0x5, 0xd, 0x1}, @IPVS_DEST_ATTR_PORT={0x6, 0x2, 0x4e21}, @IPVS_DEST_ATTR_TUN_FLAGS={0x6, 0xf, 0x2}]}, @IPVS_CMD_ATTR_DAEMON={0x5c, 0x3, 0x0, 0x1, [@IPVS_DAEMON_ATTR_MCAST_TTL={0x5, 0x8, 0xf}, @IPVS_DAEMON_ATTR_MCAST_IFN={0x14, 0x2, 'wlan1\x00'}, @IPVS_DAEMON_ATTR_MCAST_GROUP6={0x14, 0x6, @dev={0xfe, 0x80, '\x00', 0x44}}, @IPVS_DAEMON_ATTR_MCAST_IFN={0x14, 0x2, 'virt_wifi0\x00'}, @IPVS_DAEMON_ATTR_MCAST_GROUP6={0x14, 0x6, @loopback}]}, @IPVS_CMD_ATTR_TIMEOUT_UDP={0x8, 0x6, 0x3ff}, @IPVS_CMD_ATTR_DAEMON={0x14, 0x3, 0x0, 0x1, [@IPVS_DAEMON_ATTR_MCAST_GROUP={0x8, 0x5, @rand_addr=0x64010102}, @IPVS_DAEMON_ATTR_SYNC_ID={0x8, 0x3, 0x2}]}, @IPVS_CMD_ATTR_DAEMON={0x48, 0x3, 0x0, 0x1, [@IPVS_DAEMON_ATTR_SYNC_MAXLEN={0x6}, @IPVS_DAEMON_ATTR_MCAST_IFN={0x14, 0x2, 'bond_slave_1\x00'}, @IPVS_DAEMON_ATTR_SYNC_ID={0x8, 0x3, 0x4}, @IPVS_DAEMON_ATTR_STATE={0x8, 0x1, 0x1}, @IPVS_DAEMON_ATTR_STATE={0x8, 0x1, 0x2}, @IPVS_DAEMON_ATTR_MCAST_GROUP={0x8, 0x5, @dev={0xac, 0x14, 0x14, 0x26}}, @IPVS_DAEMON_ATTR_MCAST_TTL={0x5, 0x8, 0xb6}]}]}, 0x120}, 0x1, 0x0, 0x0, 0x20044090}, 0x1) ioctl(r0, 0x1, &(0x7f0000001940)="5fb554ce506852317b5f6da269bfb2a6cdbfca2d55e6aa4954c0130aa3a58760e195a2f951ee5bd38329275465fd84b504df2e3a72aba852e4e528241730f3d0e83f3a29c81dfcbe04d69a6b627607fdc6d62911f6c1e2b38e1512f6b980c91030ccf064c3ddacf5cdbbbc753cb3dee083b564f3ebb822a6f36dbc82bf1dcec9d9e2055d139bc9e3bdfe4e487611380a947dd3373c4bdf9f3aa45888325b8a39d2a9526c58bc4b2238e4683352d117812a42c1aef6630e8f89eaa5ac365c583c09") sendmsg$nl_crypto(r5, &(0x7f0000001bc0)={&(0x7f0000001a40)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f0000001b80)={&(0x7f0000001a80)=@getstat={0xe0, 0x15, 0x10, 0x70bd2b, 0x25dfdbfe, {{'ccm-aes-ce\x00'}, '\x00', '\x00', 0x400}, ["", "", "", "", ""]}, 0xe0}, 0x1, 0x0, 0x0, 0x4008080}, 0x440d0) setsockopt$inet6_tcp_int(0xffffffffffffffff, 0x6, 0x11, &(0x7f0000001c00)=0xfffffff9, 0x4) sendmsg$TIPC_CMD_GET_NETID(r1, &(0x7f0000001d00)={&(0x7f0000001c40)={0x10, 0x0, 0x0, 0x8000000}, 0xc, &(0x7f0000001cc0)={&(0x7f0000001c80)={0x1c, 0x0, 0x800, 0x70bd27, 0x25dfdbfe, {}, ["", "", "", "", ""]}, 0x1c}, 0x1, 0x0, 0x0, 0x4004}, 0x400c000) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000001d80)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_SET_PMK(r1, &(0x7f0000001f00)={&(0x7f0000001d40)={0x10, 0x0, 0x0, 0x1000}, 0xc, &(0x7f0000001ec0)={&(0x7f0000001dc0)={0xc8, r2, 0x400, 0x70bd26, 0x25dfdbff, {{}, {@val={0x8, 0x3, r9}, @void}}, [@NL80211_ATTR_PMKR0_NAME={0x14, 0x102, "c8c207226800569f9136b5926e13f481"}, @NL80211_ATTR_PMKR0_NAME={0x14, 0x102, "0f946ca0e83961f64478a3a6b730a056"}, @NL80211_ATTR_PMK={0x14, 0xfe, "38003622d3aaedbc46f89f053722630f"}, @NL80211_ATTR_PMK={0x14, 0xfe, "9a89dcfa9045b077ec0e5e9d0cf460be"}, @NL80211_ATTR_PMKR0_NAME={0x14, 0x102, "e4cdafc727186761ba4a1fcce5ac8823"}, @NL80211_ATTR_PMKR0_NAME={0x14, 0x102, "98270d60c307a901e3298856e5ac51b6"}, @NL80211_ATTR_PMKR0_NAME={0x14, 0x102, "d880f9367bafb794d42305549b373ba2"}, @NL80211_ATTR_MAC={0xa}, @NL80211_ATTR_PMK={0x14, 0xfe, "bde5dba36df474067f4dcc37db4c26d2"}]}, 0xc8}}, 0x40) r10 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r11 = syz_genetlink_get_family_id$nbd(&(0x7f0000001f80), 0xffffffffffffffff) sendmsg$NBD_CMD_STATUS(r10, &(0x7f0000002080)={&(0x7f0000001f40)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f0000002040)={&(0x7f0000001fc0)={0x5c, r11, 0x2, 0x70bd28, 0x25dfdbfd, {}, [@NBD_ATTR_CLIENT_FLAGS={0xc}, @NBD_ATTR_SERVER_FLAGS={0xc, 0x5, 0xd}, @NBD_ATTR_CLIENT_FLAGS={0xc, 0x6, 0x1}, @NBD_ATTR_BLOCK_SIZE_BYTES={0xc, 0x3, 0x8000}, @NBD_ATTR_TIMEOUT={0xc}, @NBD_ATTR_SERVER_FLAGS={0xc, 0x5, 0x26}]}, 0x5c}, 0x1, 0x0, 0x0, 0x20000400}, 0x4001) r12 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_MSG_GETSET(r12, &(0x7f0000002280)={&(0x7f00000020c0)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f0000002240)={&(0x7f0000002100)={0x108, 0xa, 0xa, 0x0, 0x0, 0x0, {0x2, 0x0, 0x3}, [@NFTA_SET_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_SET_FLAGS={0x8}, @NFTA_SET_HANDLE={0xc, 0x10, 0x1, 0x0, 0x4}, @NFTA_SET_ID={0x8, 0xa, 0x1, 0x0, 0x3}, @NFTA_SET_TIMEOUT={0xc, 0xb, 0x1, 0x0, 0x8}, @NFTA_SET_USERDATA={0xbf, 0xd, 0x1, 0x0, "efbddbdc8f5e89189be106930396091b95142551d28b63614290c7ab8ba1340fe0f5187eb8248cf981e44700376fc2caf39a4ef710b5441a2a2a3840d224303b81a0676415053e833c783a05089dd7b095b3836cc201ebb365db7dd064bd97b7541912074e6f3efd2b9c09aabab054f585aa6d64249e866018777ecee9f7ae54beeb44b7f04ff24b37542b1377f714efc8dd26d2007ed1d6ade9258bfa6d9dd073fb111802274c0e1f564bb6f6515077787e337296023bb069d023"}]}, 0x108}, 0x1, 0x0, 0x0, 0x20000c40}, 0x4810) mmap(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x0, 0x8010, r5, 0xa996c000) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000023c0)={&(0x7f00000022c0), 0xc, &(0x7f0000002380)={&(0x7f0000002340)=@getqdisc={0x2c, 0x26, 0x1, 0x70bd27, 0x25dfdbfb, {0x0, 0x0, 0x0, 0x0, {0x5, 0x7}, {0x3, 0x3}, {0xa, 0xfff2}}, [{0x4}, {0x4}]}, 0x2c}}, 0x20008800) 114.669401ms ago: executing program 3 (id=4861): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000700)={&(0x7f0000001640)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a01030000000000000000010000000900010073797a300000000040000000030a01020000000000000000010000000900030073797a320000000014000480080001400000000108000240378b5ec30900010073797a300000000050000000060a010400000000000000000100000008000b40000000000900010073797a300000000028000480240001800a0001007175657565000000140002800600034000010000060001400017000014000000110001"], 0xd8}}, 0x0) r1 = socket$nl_xfrm(0x10, 0x3, 0x6) r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000500)=@base={0xe, 0x4, 0x4, 0x2, 0x0, 0xffffffffffffffff, 0x8}, 0x50) r3 = openat$6lowpan_control(0xffffffffffffff9c, &(0x7f0000000280), 0x2, 0x0) preadv(r3, &(0x7f0000000180)=[{0x0}, {&(0x7f0000000040)=""/248, 0xf8}], 0x2, 0xe9, 0x7) bpf$PROG_LOAD(0x5, &(0x7f0000000380)={0x6, 0xd, &(0x7f0000000200)=@framed={{0x18, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, [@ringbuf_output={{0x18, 0x1, 0x1, 0x0, r2}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0x401}, {}, {0x4}, {0x6, 0x0, 0xa}, {}, {}, {0x85, 0x0, 0x0, 0x33}}, @call={0x85, 0x0, 0x0, 0x50}]}, &(0x7f00000004c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x29, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, 0x94) r4 = bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000880)={0x6, 0x14, &(0x7f00000002c0)=@raw=[@map_idx_val={0x18, 0x6, 0x6, 0x0, 0x1, 0x0, 0x0, 0x0, 0x3}, @ringbuf_query={{0x18, 0x1, 0x1, 0x0, r2}}, @snprintf={{}, {}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0x1000}, {}, {}, {}, {}, {}, {}, {0x18, 0x3, 0x2, 0x0, r2}}, @generic={0x2, 0x5, 0x5, 0x1, 0x3}], &(0x7f0000000440)='GPL\x00', 0x598, 0x5a, &(0x7f0000000580)=""/90, 0x41100, 0x63, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, &(0x7f0000000600)={0x3, 0x3, 0xc0dd, 0x1200}, 0x10, 0x0, 0x0, 0x0, &(0x7f0000000640)=[r2, r2, r2, r2], 0x0, 0x10, 0x6fd9}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000b80)={r4, 0x2000012, 0xe, 0x0, &(0x7f0000000140)="63ec33c9e9b9860000e2ff040000", 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x8}, 0x50) r5 = socket$nl_netfilter(0x10, 0x3, 0xc) r6 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="1b0000000000000000000000000004"], 0x48) ioctl$sock_inet_SIOCGIFDSTADDR(r5, 0x8917, &(0x7f0000000000)={'hsr0\x00', {0x2, 0x0, @dev}}) bpf$PROG_LOAD(0x5, &(0x7f0000002c40)={0x7, 0x17, &(0x7f00000007c0)=ANY=[@ANYBLOB="1800000000000000000000000004000018110000", @ANYRES32=r6, @ANYBLOB="0000000000000000b702000014000000b7030000000000008500000005000000bf0900000000000046090100000003e716000000060000001801000020207025000000000082a372584f1279852020207b9af8ff00000000ad9100000000000037010000f8ffffffb702000008000000b70300000000000024090000114200005c93000000000000b5030000000000008500000076000000b700000000000000"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) sendmsg$netlink(r1, &(0x7f0000001f80)={0x0, 0x0, &(0x7f0000001f00)=[{&(0x7f0000000c40)=ANY=[@ANYBLOB="1401000027000100000000000000000001"], 0x114}], 0x1}, 0x0) syz_emit_ethernet(0x3e, &(0x7f0000000940)=ANY=[@ANYBLOB="ffffffffffffaaaaaaaaaaaa86dd60108f8400083a00fe8000000000000000000000000000bbfe8000000000000000000000000000aa"], 0x0) 112.654378ms ago: executing program 4 (id=4862): bpf$MAP_CREATE(0x0, &(0x7f0000000540)=@base={0x19, 0x4, 0x8, 0x9}, 0x50) close(0x3) bpf$MAP_CREATE(0x0, &(0x7f0000000180)=@base={0xb, 0x5, 0x400, 0x9, 0x1}, 0x48) r0 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xd, &(0x7f0000000180)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="19000000040000000400000001"], 0x50) r1 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[], 0x48) r2 = bpf$PROG_LOAD(0x5, &(0x7f0000000a00)={0x11, 0x14, &(0x7f0000000280)=ANY=[@ANYBLOB="180000000000000000000000000000001801000020646c2100000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000007300000018110000", @ANYRES32=r1, @ANYBLOB="0000000000000000b7080000000200007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000540)={{r1}, &(0x7f00000004c0), &(0x7f0000000500)=r2}, 0x20) bpf$PROG_BIND_MAP(0xa, &(0x7f0000000980)={r2}, 0xc) bpf$PROG_BIND_MAP(0xa, &(0x7f00000005c0)={r0}, 0xc) r3 = socket$alg(0x26, 0x5, 0x0) bind$alg(r3, &(0x7f00000007c0)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc(sm4)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r3, 0x117, 0x1, &(0x7f0000001280)="b7f2288a911993f08d3aaea2bc0000de", 0x10) r4 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000005380)={0x34, 0x40, 0x107, 0x70bd2b, 0x25dfdbfe, {0x2, 0x7c}, [@nested={0x1c, 0x1c2, 0x0, 0x1, [@nested={0x18, 0x9, 0x0, 0x1, [@nested={0x14, 0xce, 0x0, 0x1, [@nested={0xd, 0x13b, 0x0, 0x1, [@generic="676f8a82c3b80c910f"]}]}]}]}, @nested={0x4, 0x1}]}, 0x34}, 0x1, 0x0, 0x0, 0x4c090}, 0xc000) r5 = accept$alg(r3, 0x0, 0x0) r6 = syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0) ioctl$sock_SIOCETHTOOL(r6, 0x8946, &(0x7f0000000040)={'wlan1\x00', &(0x7f0000000000)=@ethtool_stats={0x1d, 0x2000000000000070}}) sendmmsg$alg(r5, &(0x7f0000000a40)=[{0x0, 0x0, &(0x7f0000000380)=[{&(0x7f0000000180)="77167ead34cd1eaf2108c04de96e99fa4435f9041368e8dfec6af2ae8080b56c53c12b8431d17955ae1ec78709eee9acf825fdb672651f7eafb44b576930aff4b6a86ced3e4392cfe57a2c11b97e93f38debd6dc69f3a50d5742daa7081df08bd8118dcd6d9d18830c7d79d8", 0x6c}, {&(0x7f0000000240)="23ade41881a1e7ca07379924e2cb53138ec1e2ac415947eb6c7f56119ff98596d7469564e6d7c4", 0x27}, {&(0x7f0000000280)="66348451d22f5e2e4385e0bf75c5c3d30327039c072cd147f3b25df80100010000000004706aa85896228ef23136cbc160147a2320c7ffc6b506e6e3c7f8bd478c56beb9520ea32612337688c4905af416fe75be77c3f12e55f3f657129e6daf6844369cf70c947ab82e778a4263f9b75692d4e5c905bb9119b28241e191e54e38a5357ad888c9cd225dae2276839bfcc7dc87c05ba539e435888d6677bd00"/169, 0xa9}, {&(0x7f0000000440)="fe6abb1be48e556b473cabd427d746ca7d9bbf4f24ec7659b1c254940281f0a248dfc8c103fad1369a53e3402210b77170735064ceae5fcf381d21cc8960440e0a459705262c4c53065f369fe8e63bc7650112b91fdccaceff93fd8cdab5a479b9614318eebc5a609b633b114fe330c840cc077cd6a6f6ca2bca0cc48c06177e0bc3b7fe6320e9f2e5a824d74aa3cccac383bacd0a126a58fa999675ad5c41c171807570ac0501332c2794950f4633a074325e58cd43d58340513dbc10eaaf4ff3c4b8d98621267d8b1abdbf01d7de9a86c2d4373dd907da5a96ac79f134e212c180623e4fa8cc6705ff1e8008f9fa3599ee91d3b93ce61fadd15a25546ec7aaf849b1e643e8d684cb5761ec656200b5fdf1bc71d5d39e1714a4f03b1ffda35df2b3e378282a4d2843e02bbc9f6a8511bbb577c33aeb421b3ecb4b5a92abbc18a97eb000e101e5c316c40ecde4c405839befe44699094cc65fc87808b8178a264d9c15d6d45f3751c4becf85b7bb2cc2", 0x170}, {&(0x7f0000000680)="1b1eb47967b88f89e960c59413baaf1384ad9c758abf845c5714a919ca02735c5514fa78f9f084d72227c1d3f6607ce5a2183a169535d0b2bb594ecb92b8df361bca805ac5595a389d39a58a35c0ff662c2c83431c0c2e2ece5ca6a104d1d45c1c15ca4d75cab6b1bb923cac1c51270bf577cf4c79ba54a6c45a345cc13208fa430c1e54548e5a9c5cf45337451511abc0a7d3539ac22191025d5655a5d05c4024b8cb0fb4", 0xfed1}], 0x5, 0x0, 0x0, 0x40880}], 0x1, 0x4814) recvmmsg(r5, &(0x7f0000003540)=[{{0x0, 0x0, 0x0}, 0x5}, {{0x0, 0xedb012ab09c1eefe, &(0x7f0000000080)=[{&(0x7f00000012c0)=""/4082, 0x1000}], 0x1}, 0xffffff0b}], 0x2, 0x2001, 0x0) 38.935346ms ago: executing program 0 (id=4863): r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000000c0)={'bridge0\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000440)=@newlink={0x44, 0x10, 0x401, 0xfffffffc, 0x25dfdbfc, {0x0, 0x0, 0x0, 0x0, 0x1503}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @ipvlan={{0xb}, {0x4}}}, @IFLA_LINK={0x8, 0x5, r1}, @IFLA_MASTER={0x8, 0xa, r1}]}, 0x44}, 0x1, 0x0, 0x0, 0x24000891}, 0x0) bpf$MAP_CREATE(0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="14000000040000000400000022bf80"], 0x48) 0s ago: executing program 3 (id=4864): ioctl$F2FS_IOC_MOVE_RANGE(0xffffffffffffffff, 0xc020f509, &(0x7f0000000040)={0xffffffffffffffff, 0x3, 0x5, 0xfffffffffffffffc}) r1 = socket$nl_route(0x10, 0x3, 0x0) (async) r2 = bpf$PROG_LOAD(0x5, &(0x7f0000000100)={0x1f, 0x5, &(0x7f0000000bc0)=ANY=[@ANYBLOB="1800000000000000000000000000000085000000a8000000850000001100000095"], &(0x7f0000000b00)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x1a, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000340)={r2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x3a) (async) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000040)) (async, rerun: 32) bpf$PROG_BIND_MAP(0xa, &(0x7f00000007c0)={r2}, 0x11) (async, rerun: 32) sendmsg$nl_route_sched(r1, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000005c0)=@newtaction={0x88, 0x30, 0xffff, 0x0, 0x0, {0x0, 0x0, 0x1300}, [{0x74, 0x1, [@m_mirred={0x70, 0x1, 0x0, 0x0, {{0xb}, {0x44, 0x2, 0x0, 0x1, [@TCA_MIRRED_PARMS={0x20, 0x4, {{0xfffff7e8}}}, @TCA_MIRRED_PARMS={0x20, 0x2, {{0x80000001, 0x3df, 0xffffffffffffffff, 0x1, 0xffff7fff}, 0x4}}]}, {0x4}, {0xc}, {0xc, 0x8, {0x0, 0x2}}}}]}]}, 0x88}}, 0x0) (async) getpeername$packet(0xffffffffffffffff, &(0x7f00000000c0)={0x11, 0x0, 0x0}, &(0x7f0000000100)=0x14) (async, rerun: 32) ioctl$BTRFS_IOC_TREE_SEARCH(r0, 0xd0009411, &(0x7f0000000200)={{0x0, 0xb, 0x7fff, 0x200, 0xfffffffffffffa80, 0x2, 0x9, 0x0, 0x100, 0x7, 0x3, 0x8, 0xfffffffffffffffc, 0x1, 0x7}}) (rerun: 32) sendmsg$nl_route_sched(r0, &(0x7f00000001c0)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x800000}, 0xc, &(0x7f0000000180)={&(0x7f0000000140)=@gettclass={0x24, 0x2a, 0x1, 0x70bd29, 0x25dfdbff, {0x0, 0x0, 0x0, r3, {0x5, 0xa}, {0xc, 0x2}, {0x3, 0xfff2}}, ["", "", "", ""]}, 0x24}, 0x1, 0x0, 0x0, 0x200000c0}, 0x24000011) openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) (async, rerun: 32) r4 = bpf$BPF_BTF_GET_FD_BY_ID(0x13, &(0x7f0000001340)=0xffffffffffffffff, 0x4) (async, rerun: 32) bpf$BPF_BTF_GET_NEXT_ID(0x17, &(0x7f00000013c0)={0xe2, 0x0}, 0x8) bpf$PROG_LOAD(0x5, &(0x7f0000001440)={0x4, 0x5, &(0x7f0000001200)=@framed={{0x18, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xe}, [@initr0={0x18, 0x0, 0x0, 0x0, 0x808, 0x0, 0x0, 0x0, 0xa8}]}, &(0x7f0000001240)='GPL\x00', 0x2, 0xa9, &(0x7f0000001280)=""/169, 0x40f00, 0x8, '\x00', r3, @fallback=0x17, r4, 0x8, 0x0, 0x0, 0x10, &(0x7f0000001380)={0x3, 0xe, 0x1, 0x80000001}, 0x10, r5, 0xffffffffffffffff, 0x4, 0x0, &(0x7f0000001400)=[{0x4, 0x4, 0xd, 0xc}, {0x1, 0x4, 0x0, 0x3}, {0x3, 0x5, 0x10, 0x7}, {0x0, 0x1, 0x0, 0xe}], 0x10, 0x9}, 0x94) (async) r6 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$TIPC_NL_MEDIA_SET(r6, 0x0, 0x20040884) (async) r7 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='memory.events\x00', 0x275a, 0x0) write$cgroup_subtree(r7, &(0x7f0000000100)=ANY=[], 0x32600) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x2000001, 0x12, r7, 0x0) (async) r8 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) getsockopt$inet6_int(r8, 0x29, 0xce, 0x0, &(0x7f00000007c0)=0xffffff78) (async) r9 = socket$netlink(0x10, 0x3, 0x0) setsockopt$netlink_NETLINK_LISTEN_ALL_NSID(r9, 0x10e, 0x8, &(0x7f0000000000)=0x2, 0x4) recvmmsg(r9, &(0x7f000000a440), 0x1, 0x12020, 0x0) bind$netlink(r9, &(0x7f0000514ff4)={0x10, 0x0, 0x0, 0x2ffffffff}, 0xc) (async) setsockopt$netlink_NETLINK_PKTINFO(r9, 0x10e, 0x3, &(0x7f0000000100)=0x7, 0x4) (async) sendmsg$IPCTNL_MSG_TIMEOUT_DEFAULT_GET(r9, &(0x7f00000015c0)={&(0x7f0000001500)={0x10, 0x0, 0x0, 0x1000}, 0xc, &(0x7f0000001580)={&(0x7f0000001540)={0x2c, 0x4, 0x8, 0x801, 0x0, 0x0, {0x1, 0x0, 0xa}, [@CTA_TIMEOUT_L3PROTO={0x6, 0x2, 0x1, 0x0, 0x20844bf0d298a698}, @CTA_TIMEOUT_L4PROTO={0x5, 0x3, 0x6}, @CTA_TIMEOUT_L3PROTO={0x6, 0x2, 0x1, 0x0, 0x94e8}]}, 0x2c}, 0x1, 0x0, 0x0, 0x24000004}, 0x4800) (async) r10 = socket$nl_route(0x10, 0x3, 0x0) write(r10, &(0x7f0000000000)="240000005800410f9c00f4f90085b3a85c91fddf080001000501009f0800028001000000", 0x24) syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10) kernel console output (not intermixed with test programs): 0 [ 555.575269][T20651] FAULT_INJECTION: forcing a failure. [ 555.575269][T20651] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 555.591985][T20651] CPU: 0 UID: 0 PID: 20651 Comm: syz.4.3564 Not tainted syzkaller #0 PREEMPT(full) [ 555.592016][T20651] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026 [ 555.592028][T20651] Call Trace: [ 555.592036][T20651] [ 555.592045][T20651] dump_stack_lvl+0xe8/0x150 [ 555.592079][T20651] should_fail_ex+0x412/0x560 [ 555.592116][T20651] _copy_from_user+0x2d/0xb0 [ 555.592142][T20651] ____sys_sendmsg+0x308/0x9f0 [ 555.592183][T20651] ? __pfx_____sys_sendmsg+0x10/0x10 [ 555.592224][T20651] ? import_iovec+0x73/0xa0 [ 555.592261][T20651] ___sys_sendmsg+0x2a5/0x360 [ 555.592298][T20651] ? __pfx____sys_sendmsg+0x10/0x10 [ 555.592334][T20651] ? kstrtouint+0x6e/0xe0 [ 555.592391][T20651] ? __fget_files+0x2a/0x420 [ 555.592410][T20651] ? __fget_files+0x3a0/0x420 [ 555.592440][T20651] __sys_sendmmsg+0x27c/0x4e0 [ 555.592466][T20651] ? __pfx___sys_sendmmsg+0x10/0x10 [ 555.592483][T20651] ? __mutex_unlock_slowpath+0x1bd/0x7d0 [ 555.592537][T20651] ? ksys_write+0x242/0x270 [ 555.592563][T20651] ? __pfx_ksys_write+0x10/0x10 [ 555.592594][T20651] __x64_sys_sendmmsg+0xa0/0xc0 [ 555.592617][T20651] do_syscall_64+0x14d/0xf80 [ 555.592640][T20651] ? trace_irq_disable+0x3b/0x150 [ 555.592659][T20651] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 555.592679][T20651] ? clear_bhb_loop+0x40/0x90 [ 555.592705][T20651] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 555.592725][T20651] RIP: 0033:0x7fe23959c819 [ 555.592744][T20651] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 555.592763][T20651] RSP: 002b:00007fe2377f6028 EFLAGS: 00000246 ORIG_RAX: 0000000000000133 [ 555.592785][T20651] RAX: ffffffffffffffda RBX: 00007fe239815fa0 RCX: 00007fe23959c819 [ 555.592800][T20651] RDX: 0000000000000001 RSI: 0000200000003380 RDI: 0000000000000003 [ 555.592813][T20651] RBP: 00007fe2377f6090 R08: 0000000000000000 R09: 0000000000000000 [ 555.592826][T20651] R10: 0000000004000004 R11: 0000000000000246 R12: 0000000000000001 [ 555.592839][T20651] R13: 00007fe239816038 R14: 00007fe239815fa0 R15: 00007fff0cf439f8 [ 555.592873][T20651] [ 556.340380][T20674] netlink: 16 bytes leftover after parsing attributes in process `syz.1.3572'. [ 556.443941][T20685] netlink: 28 bytes leftover after parsing attributes in process `syz.4.3576'. [ 556.489453][T20685] netlink: 7 bytes leftover after parsing attributes in process `syz.4.3576'. [ 556.491250][T20688] sctp: [Deprecated]: syz.3.3577 (pid 20688) Use of int in max_burst socket option. [ 556.491250][T20688] Use struct sctp_assoc_value instead [ 556.548947][T20683] IPVS: Scheduler module ip_vs_ not found [ 556.585343][T20698] sctp: [Deprecated]: syz.3.3577 (pid 20698) Use of int in max_burst socket option. [ 556.585343][T20698] Use struct sctp_assoc_value instead [ 556.586971][T20693] dvmrp6: entered allmulticast mode [ 556.724261][T20699] xt_connbytes: Forcing CT accounting to be enabled [ 556.741605][T20707] netlink: 'syz.3.3581': attribute type 1 has an invalid length. [ 556.760572][ T5933] gre0 speed is unknown, defaulting to 1000 [ 556.792932][T20710] bridge0: port 3(vlan2) entered blocking state [ 556.800514][T20710] bridge0: port 3(vlan2) entered disabled state [ 556.807422][T20710] vlan2: entered allmulticast mode [ 556.813830][T20711] netlink: 'syz.4.3582': attribute type 1 has an invalid length. [ 556.824425][T20710] ip6gretap0: entered allmulticast mode [ 556.835316][T20710] vlan2: entered promiscuous mode [ 556.841215][T20710] ip6gretap0: entered promiscuous mode [ 556.913870][T20707] 8021q: adding VLAN 0 to HW filter on device bond2 [ 556.987916][T20711] 8021q: adding VLAN 0 to HW filter on device bond4 [ 557.041933][T20709] bond4: (slave veth3): Enslaving as an active interface with a down link [ 557.260514][ T5933] net_ratelimit: 2 callbacks suppressed [ 557.260536][ T5933] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 557.273475][T20736] 8021q: adding VLAN 0 to HW filter on device batadv1 [ 557.293802][T20736] bond4: (slave batadv1): dev_set_mac_address on slave failed! ALB mode requires that the base driver support setting the hw address also when the network device's interface is open [ 557.414542][T20745] netlink: 'syz.2.3592': attribute type 1 has an invalid length. [ 557.556215][T20751] bond2 (unregistering): Released all slaves [ 557.727489][T20763] ip6gre2: entered promiscuous mode [ 557.737711][T20763] ip6gre2: entered allmulticast mode [ 558.025009][T20779] IPVS: set_ctl: invalid protocol: 41 172.20.20.39:20002 [ 558.136933][T20783] tipc: Enabled bearer , priority 14 [ 558.159412][T20783] 0ªX¹¦À: renamed from caif0 [ 558.174610][T20783] tipc: Disabling bearer [ 558.188038][T20790] FAULT_INJECTION: forcing a failure. [ 558.188038][T20790] name failslab, interval 1, probability 0, space 0, times 0 [ 558.202985][T20790] CPU: 1 UID: 0 PID: 20790 Comm: syz.1.3607 Not tainted syzkaller #0 PREEMPT(full) [ 558.203014][T20790] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026 [ 558.203027][T20790] Call Trace: [ 558.203036][T20790] [ 558.203044][T20790] dump_stack_lvl+0xe8/0x150 [ 558.203081][T20790] should_fail_ex+0x412/0x560 [ 558.203118][T20790] should_failslab+0xa8/0x100 [ 558.203146][T20790] __kmalloc_cache_noprof+0x88/0x660 [ 558.203172][T20790] ? sctp_add_bind_addr+0x8c/0x370 [ 558.203192][T20790] ? __pfx_sctp_get_port_local+0x10/0x10 [ 558.203225][T20790] sctp_add_bind_addr+0x8c/0x370 [ 558.203256][T20790] ? sctp_auto_asconf_init+0x15c/0x1e0 [ 558.203288][T20790] sctp_do_bind+0x5b2/0x9d0 [ 558.203336][T20790] sctp_connect_new_asoc+0x270/0x6b0 [ 558.203367][T20790] ? __pfx_sctp_connect_new_asoc+0x10/0x10 [ 558.203402][T20790] ? __local_bh_enable_ip+0xd0/0x130 [ 558.203425][T20790] ? bpf_lsm_sctp_bind_connect+0x9/0x20 [ 558.203450][T20790] ? security_sctp_bind_connect+0x7e/0x2c0 [ 558.203482][T20790] sctp_sendmsg+0x1528/0x2c10 [ 558.203523][T20790] ? __pfx_sctp_sendmsg+0x10/0x10 [ 558.203554][T20790] ? aa_sk_perm+0x6d5/0x900 [ 558.203593][T20790] ? __pfx_aa_sk_perm+0x10/0x10 [ 558.203627][T20790] ? sock_rps_record_flow+0x19/0x350 [ 558.203662][T20790] ? inet_sendmsg+0x2f4/0x370 [ 558.203687][T20790] ____sys_sendmsg+0x80a/0x9f0 [ 558.203727][T20790] ? __pfx_____sys_sendmsg+0x10/0x10 [ 558.203768][T20790] ? import_iovec+0x73/0xa0 [ 558.203798][T20790] ___sys_sendmsg+0x2a5/0x360 [ 558.203834][T20790] ? __pfx____sys_sendmsg+0x10/0x10 [ 558.203870][T20790] ? kstrtouint+0x6e/0xe0 [ 558.203936][T20790] ? __fget_files+0x2a/0x420 [ 558.203955][T20790] ? __fget_files+0x3a0/0x420 [ 558.203986][T20790] __sys_sendmmsg+0x27c/0x4e0 [ 558.204012][T20790] ? __pfx___sys_sendmmsg+0x10/0x10 [ 558.204029][T20790] ? __mutex_unlock_slowpath+0x1bd/0x7d0 [ 558.204085][T20790] ? ksys_write+0x242/0x270 [ 558.204111][T20790] ? __pfx_ksys_write+0x10/0x10 [ 558.204142][T20790] __x64_sys_sendmmsg+0xa0/0xc0 [ 558.204164][T20790] do_syscall_64+0x14d/0xf80 [ 558.204187][T20790] ? trace_irq_disable+0x3b/0x150 [ 558.204205][T20790] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 558.204226][T20790] ? clear_bhb_loop+0x40/0x90 [ 558.204261][T20790] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 558.204281][T20790] RIP: 0033:0x7f7fc3f9c819 [ 558.204301][T20790] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 558.204318][T20790] RSP: 002b:00007f7fc4e08028 EFLAGS: 00000246 ORIG_RAX: 0000000000000133 [ 558.204341][T20790] RAX: ffffffffffffffda RBX: 00007f7fc4215fa0 RCX: 00007f7fc3f9c819 [ 558.204355][T20790] RDX: 0000000000000001 RSI: 0000200000003380 RDI: 0000000000000003 [ 558.204367][T20790] RBP: 00007f7fc4e08090 R08: 0000000000000000 R09: 0000000000000000 [ 558.204379][T20790] R10: 0000000004000004 R11: 0000000000000246 R12: 0000000000000001 [ 558.204392][T20790] R13: 00007f7fc4216038 R14: 00007f7fc4215fa0 R15: 00007ffc548789f8 [ 558.204426][T20790] [ 558.289305][T20796] openvswitch: netlink: Multiple metadata blocks provided [ 558.521567][ T796] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 558.530075][ T980] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 558.538744][T20783] 0ªX¹¦À: entered allmulticast mode [ 558.547451][T20783] A link change request failed with some changes committed already. Interface 60ªX¹¦À may have been left with an inconsistent configuration, please check. [ 558.574069][T20793] nbd2: detected capacity change from 0 to 63 [ 558.683542][T20794] nbd3: detected capacity change from 0 to 63 [ 558.717217][ T5840] block nbd3: Receive control failed (result -104) [ 558.729631][ T5829] block nbd2: Receive control failed (result -32) [ 559.000634][T20824] FAULT_INJECTION: forcing a failure. [ 559.000634][T20824] name failslab, interval 1, probability 0, space 0, times 0 [ 559.048010][T20824] CPU: 0 UID: 0 PID: 20824 Comm: syz.2.3619 Not tainted syzkaller #0 PREEMPT(full) [ 559.048039][T20824] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026 [ 559.048051][T20824] Call Trace: [ 559.048060][T20824] [ 559.048069][T20824] dump_stack_lvl+0xe8/0x150 [ 559.048104][T20824] should_fail_ex+0x412/0x560 [ 559.048141][T20824] should_failslab+0xa8/0x100 [ 559.048171][T20824] __kmalloc_cache_noprof+0x88/0x660 [ 559.048197][T20824] ? sctp_association_new+0x89/0x25e0 [ 559.048232][T20824] sctp_association_new+0x89/0x25e0 [ 559.048269][T20824] ? sctp_do_bind+0x661/0x9d0 [ 559.048311][T20824] sctp_connect_new_asoc+0x2e4/0x6b0 [ 559.048343][T20824] ? __pfx_sctp_connect_new_asoc+0x10/0x10 [ 559.048379][T20824] ? __local_bh_enable_ip+0xd0/0x130 [ 559.048404][T20824] ? bpf_lsm_sctp_bind_connect+0x9/0x20 [ 559.048430][T20824] ? security_sctp_bind_connect+0x7e/0x2c0 [ 559.048462][T20824] sctp_sendmsg+0x1528/0x2c10 [ 559.048506][T20824] ? __pfx_sctp_sendmsg+0x10/0x10 [ 559.048537][T20824] ? aa_sk_perm+0x6d5/0x900 [ 559.048572][T20824] ? __pfx_aa_sk_perm+0x10/0x10 [ 559.048603][T20824] ? sock_rps_record_flow+0x19/0x350 [ 559.048638][T20824] ? inet_sendmsg+0x2f4/0x370 [ 559.048664][T20824] ____sys_sendmsg+0x80a/0x9f0 [ 559.048706][T20824] ? __pfx_____sys_sendmsg+0x10/0x10 [ 559.048748][T20824] ? import_iovec+0x73/0xa0 [ 559.048776][T20824] ___sys_sendmsg+0x2a5/0x360 [ 559.048815][T20824] ? __pfx____sys_sendmsg+0x10/0x10 [ 559.048852][T20824] ? kstrtouint+0x6e/0xe0 [ 559.048912][T20824] ? __fget_files+0x2a/0x420 [ 559.048932][T20824] ? __fget_files+0x3a0/0x420 [ 559.048962][T20824] __sys_sendmmsg+0x27c/0x4e0 [ 559.048988][T20824] ? __pfx___sys_sendmmsg+0x10/0x10 [ 559.049004][T20824] ? __mutex_unlock_slowpath+0x1bd/0x7d0 [ 559.049056][T20824] ? ksys_write+0x242/0x270 [ 559.049082][T20824] ? __pfx_ksys_write+0x10/0x10 [ 559.049112][T20824] __x64_sys_sendmmsg+0xa0/0xc0 [ 559.049132][T20824] do_syscall_64+0x14d/0xf80 [ 559.049156][T20824] ? trace_irq_disable+0x3b/0x150 [ 559.049179][T20824] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 559.049199][T20824] ? clear_bhb_loop+0x40/0x90 [ 559.049224][T20824] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 559.049243][T20824] RIP: 0033:0x7f195ed9c819 [ 559.049272][T20824] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 559.049290][T20824] RSP: 002b:00007f195fd42028 EFLAGS: 00000246 ORIG_RAX: 0000000000000133 [ 559.049311][T20824] RAX: ffffffffffffffda RBX: 00007f195f015fa0 RCX: 00007f195ed9c819 [ 559.049326][T20824] RDX: 0000000000000001 RSI: 0000200000003380 RDI: 0000000000000003 [ 559.049338][T20824] RBP: 00007f195fd42090 R08: 0000000000000000 R09: 0000000000000000 [ 559.049350][T20824] R10: 0000000004000004 R11: 0000000000000246 R12: 0000000000000001 [ 559.049363][T20824] R13: 00007f195f016038 R14: 00007f195f015fa0 R15: 00007ffdcbb1e228 [ 559.049397][T20824] [ 559.365370][T20832] geneve1: entered promiscuous mode [ 559.423524][T20827] syzkaller0: entered promiscuous mode [ 559.429075][T20827] syzkaller0: entered allmulticast mode [ 559.501656][T20827] syzkaller1: entered promiscuous mode [ 559.507283][T20827] syzkaller1: entered allmulticast mode [ 559.584112][ T796] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 559.698105][T20837] bond1: invalid ARP target 0.0.0.0 specified for addition [ 559.705522][T20837] bond1: option arp_ip_target: invalid value (0) [ 559.714187][T20837] bond1 (unregistering): Released all slaves [ 559.801774][T20854] __nla_validate_parse: 21 callbacks suppressed [ 559.801795][T20854] netlink: 104 bytes leftover after parsing attributes in process `syz.3.3628'. [ 559.823558][T20854] netlink: 24 bytes leftover after parsing attributes in process `syz.3.3628'. [ 559.840780][T20849] bond_slave_0: entered promiscuous mode [ 559.847283][T20849] bond_slave_1: entered promiscuous mode [ 559.854827][T20849] 8021q: adding VLAN 0 to HW filter on device macvlan2 [ 559.867328][T20849] team0: Port device macvlan2 added [ 559.971721][T20859] netlink: 44 bytes leftover after parsing attributes in process `syz.1.3631'. [ 560.050162][T20861] netlink: 16 bytes leftover after parsing attributes in process `syz.4.3632'. [ 560.071487][T20863] netlink: 8 bytes leftover after parsing attributes in process `syz.3.3633'. [ 560.122681][T20869] netlink: 'syz.1.3636': attribute type 1 has an invalid length. [ 560.134124][T20869] netlink: 224 bytes leftover after parsing attributes in process `syz.1.3636'. [ 560.234060][T20874] IPVS: set_ctl: invalid protocol: 50 172.20.20.187:20003 [ 560.272686][T20876] IPVS: set_ctl: invalid protocol: 50 172.20.20.187:20003 [ 560.388200][T20885] gre0 speed is unknown, defaulting to 1000 [ 560.411298][T20882] netlink: 192 bytes leftover after parsing attributes in process `syz.2.3640'. [ 560.527980][T20892] netlink: 'syz.0.3643': attribute type 4 has an invalid length. [ 560.620829][ T5891] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 560.829571][T20908] netlink: 84 bytes leftover after parsing attributes in process `syz.3.3649'. [ 560.851156][T20908] netlink: 12 bytes leftover after parsing attributes in process `syz.3.3649'. [ 560.868782][T20907] netlink: 16 bytes leftover after parsing attributes in process `syz.1.3648'. [ 560.906032][T20885] virt_wifi0 speed is unknown, defaulting to 1000 [ 561.028815][T20912] batadv_slave_0: entered promiscuous mode [ 561.112195][ T5917] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 561.127215][T20914] batadv_slave_0: left promiscuous mode [ 561.376459][T20928] netlink: 'syz.3.3653': attribute type 22 has an invalid length. [ 561.580509][ T42] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 561.667195][ T5891] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 561.726578][T20943] rdma_rxe: rxe_newlink: failed to add gre0 [ 562.028078][T20936] xt_TPROXY: Can be used only with -p tcp or -p udp [ 562.350046][T20959] netlink: 'syz.4.3667': attribute type 10 has an invalid length. [ 562.361571][T20959] bond0: (slave wlan1): Opening slave failed [ 562.700369][ T5891] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 562.725398][T20975] netlink: 'syz.4.3672': attribute type 1 has an invalid length. [ 562.771508][T20981] netlink: 'syz.3.3673': attribute type 1 has an invalid length. [ 562.803409][T20975] bond5: entered promiscuous mode [ 562.814139][T20986] IPVS: set_ctl: invalid protocol: 137 224.0.0.1:20004 [ 562.816734][T20975] 8021q: adding VLAN 0 to HW filter on device bond5 [ 563.053225][T20987] bond3 (unregistering): Released all slaves [ 563.741237][ T796] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 563.871301][T21038] FAULT_INJECTION: forcing a failure. [ 563.871301][T21038] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 563.919412][T21038] CPU: 1 UID: 0 PID: 21038 Comm: syz.3.3688 Not tainted syzkaller #0 PREEMPT(full) [ 563.919442][T21038] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026 [ 563.919454][T21038] Call Trace: [ 563.919462][T21038] [ 563.919470][T21038] dump_stack_lvl+0xe8/0x150 [ 563.919504][T21038] should_fail_ex+0x412/0x560 [ 563.919539][T21038] _copy_from_iter+0x1d3/0x1670 [ 563.919563][T21038] ? rcu_is_watching+0x15/0xb0 [ 563.919596][T21038] ? __pfx__copy_from_iter+0x10/0x10 [ 563.919624][T21038] ? netlink_sendmsg+0x650/0xb40 [ 563.919650][T21038] ? skb_put+0x11b/0x210 [ 563.919682][T21038] netlink_sendmsg+0x6c0/0xb40 [ 563.919719][T21038] ? __pfx_netlink_sendmsg+0x10/0x10 [ 563.919752][T21038] ? aa_sock_msg_perm+0xf1/0x1b0 [ 563.919773][T21038] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 563.919799][T21038] ____sys_sendmsg+0x972/0x9f0 [ 563.919838][T21038] ? __pfx_____sys_sendmsg+0x10/0x10 [ 563.919878][T21038] ? import_iovec+0x73/0xa0 [ 563.919905][T21038] ___sys_sendmsg+0x2a5/0x360 [ 563.919940][T21038] ? __pfx____sys_sendmsg+0x10/0x10 [ 563.920003][T21038] ? __fget_files+0x2a/0x420 [ 563.920022][T21038] ? __fget_files+0x3a0/0x420 [ 563.920048][T21038] __x64_sys_sendmsg+0x1bd/0x2a0 [ 563.920082][T21038] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 563.920119][T21038] ? __pfx_ksys_write+0x10/0x10 [ 563.920154][T21038] do_syscall_64+0x14d/0xf80 [ 563.920188][T21038] ? trace_irq_disable+0x3b/0x150 [ 563.920205][T21038] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 563.920226][T21038] ? clear_bhb_loop+0x40/0x90 [ 563.920251][T21038] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 563.920271][T21038] RIP: 0033:0x7f303099c819 [ 563.920291][T21038] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 563.920308][T21038] RSP: 002b:00007f30318e1028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 563.920331][T21038] RAX: ffffffffffffffda RBX: 00007f3030c15fa0 RCX: 00007f303099c819 [ 563.920346][T21038] RDX: 0000000000040830 RSI: 0000200000000280 RDI: 0000000000000003 [ 563.920359][T21038] RBP: 00007f30318e1090 R08: 0000000000000000 R09: 0000000000000000 [ 563.920371][T21038] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 563.920383][T21038] R13: 00007f3030c16038 R14: 00007f3030c15fa0 R15: 00007fff4f52a788 [ 563.920415][T21038] [ 563.965409][T21044] syzkaller0: entered promiscuous mode [ 564.179897][T21044] syzkaller0: entered allmulticast mode [ 564.418894][T21059] netlink: 'syz.3.3697': attribute type 1 has an invalid length. [ 564.627178][ T42] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 564.791663][ T796] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 565.077414][T21089] gre0 speed is unknown, defaulting to 1000 [ 565.420164][T21089] virt_wifi0 speed is unknown, defaulting to 1000 [ 565.487434][T21102] tipc: Enabled bearer , priority 0 [ 565.496133][T21103] syzkaller0: entered promiscuous mode [ 565.502128][T21103] syzkaller0: entered allmulticast mode [ 565.620789][T21103] tipc: Resetting bearer [ 565.701343][T21103] tipc: Disabling bearer [ 565.819502][ T796] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 565.831700][T21115] netlink: 'syz.2.3708': attribute type 1 has an invalid length. [ 565.914428][T21119] FAULT_INJECTION: forcing a failure. [ 565.914428][T21119] name failslab, interval 1, probability 0, space 0, times 0 [ 565.942338][T21119] CPU: 1 UID: 0 PID: 21119 Comm: syz.4.3709 Not tainted syzkaller #0 PREEMPT(full) [ 565.942368][T21119] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026 [ 565.942401][T21119] Call Trace: [ 565.942410][T21119] [ 565.942418][T21119] dump_stack_lvl+0xe8/0x150 [ 565.942454][T21119] should_fail_ex+0x412/0x560 [ 565.942492][T21119] should_failslab+0xa8/0x100 [ 565.942521][T21119] kmem_cache_alloc_node_noprof+0x8f/0x690 [ 565.942545][T21119] ? __alloc_skb+0x186/0x7d0 [ 565.942571][T21119] ? __alloc_skb+0x1d0/0x7d0 [ 565.942596][T21119] ? __local_bh_enable_ip+0xd0/0x130 [ 565.942629][T21119] __alloc_skb+0x1d0/0x7d0 [ 565.942656][T21119] ? netlink_ack_tlv_len+0x6c/0x210 [ 565.942687][T21119] netlink_ack+0x146/0xa50 [ 565.942711][T21119] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 565.942734][T21119] ? ref_tracker_free+0x693/0x840 [ 565.942753][T21119] ? __pfx_ref_tracker_free+0x10/0x10 [ 565.942780][T21119] netlink_rcv_skb+0x2b6/0x4b0 [ 565.942810][T21119] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 565.942836][T21119] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 565.942871][T21119] ? netlink_deliver_tap+0x2e/0x1b0 [ 565.942896][T21119] ? netlink_deliver_tap+0x2e/0x1b0 [ 565.942924][T21119] netlink_unicast+0x75c/0x8e0 [ 565.942953][T21119] netlink_sendmsg+0x813/0xb40 [ 565.942987][T21119] ? __pfx_netlink_sendmsg+0x10/0x10 [ 565.943019][T21119] ? aa_sock_msg_perm+0xf1/0x1b0 [ 565.943038][T21119] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 565.943066][T21119] ____sys_sendmsg+0x972/0x9f0 [ 565.943103][T21119] ? __pfx_____sys_sendmsg+0x10/0x10 [ 565.943141][T21119] ? import_iovec+0x73/0xa0 [ 565.943180][T21119] ___sys_sendmsg+0x2a5/0x360 [ 565.943216][T21119] ? __pfx____sys_sendmsg+0x10/0x10 [ 565.943285][T21119] ? __fget_files+0x2a/0x420 [ 565.943303][T21119] ? __fget_files+0x3a0/0x420 [ 565.943340][T21119] __x64_sys_sendmsg+0x1bd/0x2a0 [ 565.943373][T21119] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 565.943414][T21119] ? __pfx_ksys_write+0x10/0x10 [ 565.943451][T21119] do_syscall_64+0x14d/0xf80 [ 565.943475][T21119] ? trace_irq_disable+0x3b/0x150 [ 565.943493][T21119] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 565.943514][T21119] ? clear_bhb_loop+0x40/0x90 [ 565.943539][T21119] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 565.943559][T21119] RIP: 0033:0x7fe23959c819 [ 565.943580][T21119] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 565.943599][T21119] RSP: 002b:00007fe2377f6028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 565.943622][T21119] RAX: ffffffffffffffda RBX: 00007fe239815fa0 RCX: 00007fe23959c819 [ 565.943637][T21119] RDX: 0000000000040830 RSI: 0000200000000280 RDI: 0000000000000003 [ 565.943650][T21119] RBP: 00007fe2377f6090 R08: 0000000000000000 R09: 0000000000000000 [ 565.943663][T21119] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 565.943675][T21119] R13: 00007fe239816038 R14: 00007fe239815fa0 R15: 00007fff0cf439f8 [ 565.943709][T21119] [ 565.964772][T21118] bond5: (slave vxcan3): The slave device specified does not support setting the MAC address [ 566.174393][T21128] __nla_validate_parse: 11 callbacks suppressed [ 566.174412][T21128] netlink: 56 bytes leftover after parsing attributes in process `syz.4.3712'. [ 566.175658][T21126] netlink: 16 bytes leftover after parsing attributes in process `syz.3.3711'. [ 566.280475][T21118] bond5: (slave vxcan3): Error -95 calling set_mac_address [ 566.413253][T21115] bond5: (slave gretap1): making interface the new active one [ 566.426607][T21115] bond5: (slave gretap1): Enslaving as an active interface with an up link [ 566.760706][T21153] syz1: rxe_newlink: already configured on gre0 [ 566.835351][T21151] netlink: 8 bytes leftover after parsing attributes in process `syz.2.3718'. [ 566.847788][T21156] netem: unknown loss type 0 [ 566.853176][T21156] netem: change failed [ 566.864009][ T796] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 566.868685][T21159] netlink: 8 bytes leftover after parsing attributes in process `syz.4.3720'. [ 566.926129][T21161] netlink: 8 bytes leftover after parsing attributes in process `syz.4.3720'. [ 567.298830][T21182] netlink: 16 bytes leftover after parsing attributes in process `syz.3.3729'. [ 567.344203][T21182] netlink: 768 bytes leftover after parsing attributes in process `syz.3.3729'. [ 567.401779][T21194] netlink: 'syz.4.3728': attribute type 13 has an invalid length. [ 567.618346][T21199] netlink: 8 bytes leftover after parsing attributes in process `syz.1.3731'. [ 567.661246][ T980] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 567.717650][T21184] netlink: 'syz.4.3728': attribute type 1 has an invalid length. [ 567.909492][ T796] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 568.049008][T21214] netlink: 'syz.4.3733': attribute type 1 has an invalid length. [ 568.060477][T21215] netlink: 28 bytes leftover after parsing attributes in process `syz.0.3735'. [ 568.069874][T21214] netlink: 224 bytes leftover after parsing attributes in process `syz.4.3733'. [ 568.381330][T21230] FAULT_INJECTION: forcing a failure. [ 568.381330][T21230] name failslab, interval 1, probability 0, space 0, times 0 [ 568.417633][T21230] CPU: 0 UID: 0 PID: 21230 Comm: syz.4.3737 Not tainted syzkaller #0 PREEMPT(full) [ 568.417663][T21230] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026 [ 568.417675][T21230] Call Trace: [ 568.417683][T21230] [ 568.417692][T21230] dump_stack_lvl+0xe8/0x150 [ 568.417728][T21230] should_fail_ex+0x412/0x560 [ 568.417766][T21230] should_failslab+0xa8/0x100 [ 568.417796][T21230] __kmalloc_cache_noprof+0x88/0x660 [ 568.417821][T21230] ? sctp_add_bind_addr+0x8c/0x370 [ 568.417849][T21230] sctp_add_bind_addr+0x8c/0x370 [ 568.417875][T21230] sctp_copy_local_addr_list+0x314/0x4f0 [ 568.417902][T21230] ? sctp_copy_local_addr_list+0xa4/0x4f0 [ 568.417923][T21230] ? __pfx_sctp_copy_local_addr_list+0x10/0x10 [ 568.417950][T21230] ? sctp_v4_is_any+0x35/0x60 [ 568.417972][T21230] ? sctp_copy_one_addr+0x93/0x360 [ 568.417999][T21230] sctp_bind_addr_copy+0x189/0x3c0 [ 568.418029][T21230] sctp_connect_new_asoc+0x2ff/0x6b0 [ 568.418061][T21230] ? __pfx_sctp_connect_new_asoc+0x10/0x10 [ 568.418097][T21230] ? __local_bh_enable_ip+0xd0/0x130 [ 568.418121][T21230] ? bpf_lsm_sctp_bind_connect+0x9/0x20 [ 568.418147][T21230] ? security_sctp_bind_connect+0x7e/0x2c0 [ 568.418188][T21230] sctp_sendmsg+0x1528/0x2c10 [ 568.418233][T21230] ? __pfx_sctp_sendmsg+0x10/0x10 [ 568.418263][T21230] ? aa_sk_perm+0x6d5/0x900 [ 568.418301][T21230] ? __pfx_aa_sk_perm+0x10/0x10 [ 568.418334][T21230] ? sock_rps_record_flow+0x19/0x350 [ 568.418370][T21230] ? inet_sendmsg+0x2f4/0x370 [ 568.418395][T21230] ____sys_sendmsg+0x80a/0x9f0 [ 568.418438][T21230] ? __pfx_____sys_sendmsg+0x10/0x10 [ 568.418481][T21230] ? import_iovec+0x73/0xa0 [ 568.418510][T21230] ___sys_sendmsg+0x2a5/0x360 [ 568.418548][T21230] ? __pfx____sys_sendmsg+0x10/0x10 [ 568.418585][T21230] ? kstrtouint+0x6e/0xe0 [ 568.418644][T21230] ? __fget_files+0x2a/0x420 [ 568.418664][T21230] ? __fget_files+0x3a0/0x420 [ 568.418696][T21230] __sys_sendmmsg+0x27c/0x4e0 [ 568.418723][T21230] ? __pfx___sys_sendmmsg+0x10/0x10 [ 568.418740][T21230] ? __mutex_unlock_slowpath+0x1bd/0x7d0 [ 568.418796][T21230] ? ksys_write+0x242/0x270 [ 568.418824][T21230] ? __pfx_ksys_write+0x10/0x10 [ 568.418856][T21230] __x64_sys_sendmmsg+0xa0/0xc0 [ 568.418879][T21230] do_syscall_64+0x14d/0xf80 [ 568.418903][T21230] ? trace_irq_disable+0x3b/0x150 [ 568.418920][T21230] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 568.418939][T21230] ? clear_bhb_loop+0x40/0x90 [ 568.418965][T21230] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 568.418985][T21230] RIP: 0033:0x7fe23959c819 [ 568.419006][T21230] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 568.419023][T21230] RSP: 002b:00007fe2377f6028 EFLAGS: 00000246 ORIG_RAX: 0000000000000133 [ 568.419046][T21230] RAX: ffffffffffffffda RBX: 00007fe239815fa0 RCX: 00007fe23959c819 [ 568.419061][T21230] RDX: 0000000000000001 RSI: 0000200000003380 RDI: 0000000000000003 [ 568.419074][T21230] RBP: 00007fe2377f6090 R08: 0000000000000000 R09: 0000000000000000 [ 568.419087][T21230] R10: 0000000004000004 R11: 0000000000000246 R12: 0000000000000002 [ 568.419100][T21230] R13: 00007fe239816038 R14: 00007fe239815fa0 R15: 00007fff0cf439f8 [ 568.419135][T21230] [ 568.814930][T21237] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 568.901373][T21232] workqueue: Failed to create a rescuer kthread for wq "nfc3_nci_rx_wq": -EINTR [ 568.939704][ T5933] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 569.149103][T21261] ipvlan2: entered promiscuous mode [ 569.239783][T21263] netlink: 'syz.3.3747': attribute type 1 has an invalid length. [ 569.321170][T21269] netlink: 'syz.2.3749': attribute type 10 has an invalid length. [ 569.375429][T21269] dummy0: entered promiscuous mode [ 569.392475][T21269] bridge0: port 4(dummy0) entered blocking state [ 569.401601][T21269] bridge0: port 4(dummy0) entered disabled state [ 569.424600][T21269] dummy0: entered allmulticast mode [ 569.453091][T21269] bridge0: port 4(dummy0) entered blocking state [ 569.459739][T21269] bridge0: port 4(dummy0) entered forwarding state [ 569.645335][T21283] FAULT_INJECTION: forcing a failure. [ 569.645335][T21283] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 569.672094][T21283] CPU: 0 UID: 0 PID: 21283 Comm: syz.2.3753 Not tainted syzkaller #0 PREEMPT(full) [ 569.672125][T21283] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026 [ 569.672137][T21283] Call Trace: [ 569.672146][T21283] [ 569.672155][T21283] dump_stack_lvl+0xe8/0x150 [ 569.672191][T21283] should_fail_ex+0x412/0x560 [ 569.672230][T21283] _copy_from_user+0x2d/0xb0 [ 569.672256][T21283] ___sys_sendmsg+0x1c6/0x360 [ 569.672296][T21283] ? __pfx____sys_sendmsg+0x10/0x10 [ 569.672369][T21283] ? __fget_files+0x2a/0x420 [ 569.672387][T21283] ? __fget_files+0x3a0/0x420 [ 569.672418][T21283] __x64_sys_sendmsg+0x1bd/0x2a0 [ 569.672453][T21283] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 569.672495][T21283] ? __pfx_ksys_write+0x10/0x10 [ 569.672533][T21283] do_syscall_64+0x14d/0xf80 [ 569.672557][T21283] ? trace_irq_disable+0x3b/0x150 [ 569.672576][T21283] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 569.672599][T21283] ? clear_bhb_loop+0x40/0x90 [ 569.672625][T21283] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 569.672646][T21283] RIP: 0033:0x7f195ed9c819 [ 569.672666][T21283] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 569.672684][T21283] RSP: 002b:00007f195fd42028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 569.672708][T21283] RAX: ffffffffffffffda RBX: 00007f195f015fa0 RCX: 00007f195ed9c819 [ 569.672724][T21283] RDX: 0000000000000000 RSI: 00002000000003c0 RDI: 0000000000000004 [ 569.672737][T21283] RBP: 00007f195fd42090 R08: 0000000000000000 R09: 0000000000000000 [ 569.672750][T21283] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 569.672763][T21283] R13: 00007f195f016038 R14: 00007f195f015fa0 R15: 00007ffdcbb1e228 [ 569.672813][T21283] [ 569.980066][ T5933] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 570.047733][T21292] "syz.2.3756" (21292) uses obsolete ecb(arc4) skcipher [ 570.235446][T21309] netlink: 'syz.0.3761': attribute type 1 has an invalid length. [ 570.551042][T21331] FAULT_INJECTION: forcing a failure. [ 570.551042][T21331] name failslab, interval 1, probability 0, space 0, times 0 [ 570.564403][T21331] CPU: 0 UID: 0 PID: 21331 Comm: syz.1.3766 Not tainted syzkaller #0 PREEMPT(full) [ 570.564432][T21331] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026 [ 570.564445][T21331] Call Trace: [ 570.564454][T21331] [ 570.564462][T21331] dump_stack_lvl+0xe8/0x150 [ 570.564498][T21331] should_fail_ex+0x412/0x560 [ 570.564535][T21331] should_failslab+0xa8/0x100 [ 570.564564][T21331] kmem_cache_alloc_node_noprof+0x8f/0x690 [ 570.564589][T21331] ? __alloc_skb+0x186/0x7d0 [ 570.564616][T21331] ? __alloc_skb+0x1d0/0x7d0 [ 570.564641][T21331] ? __local_bh_enable_ip+0xd0/0x130 [ 570.564672][T21331] __alloc_skb+0x1d0/0x7d0 [ 570.564704][T21331] netlink_sendmsg+0x5d4/0xb40 [ 570.564742][T21331] ? __pfx_netlink_sendmsg+0x10/0x10 [ 570.564773][T21331] ? aa_sock_msg_perm+0xf1/0x1b0 [ 570.564794][T21331] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 570.564820][T21331] ____sys_sendmsg+0x972/0x9f0 [ 570.564859][T21331] ? __pfx_____sys_sendmsg+0x10/0x10 [ 570.564897][T21331] ? import_iovec+0x73/0xa0 [ 570.564926][T21331] ___sys_sendmsg+0x2a5/0x360 [ 570.564961][T21331] ? __pfx____sys_sendmsg+0x10/0x10 [ 570.565031][T21331] ? __fget_files+0x2a/0x420 [ 570.565048][T21331] ? __fget_files+0x3a0/0x420 [ 570.565079][T21331] __x64_sys_sendmsg+0x1bd/0x2a0 [ 570.565113][T21331] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 570.565164][T21331] ? __pfx_ksys_write+0x10/0x10 [ 570.565200][T21331] do_syscall_64+0x14d/0xf80 [ 570.565225][T21331] ? trace_irq_disable+0x3b/0x150 [ 570.565244][T21331] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 570.565264][T21331] ? clear_bhb_loop+0x40/0x90 [ 570.565290][T21331] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 570.565310][T21331] RIP: 0033:0x7f7fc3f9c819 [ 570.565330][T21331] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 570.565348][T21331] RSP: 002b:00007f7fc4e08028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 570.565371][T21331] RAX: ffffffffffffffda RBX: 00007f7fc4215fa0 RCX: 00007f7fc3f9c819 [ 570.565386][T21331] RDX: 0000000000000000 RSI: 00002000000003c0 RDI: 0000000000000004 [ 570.565398][T21331] RBP: 00007f7fc4e08090 R08: 0000000000000000 R09: 0000000000000000 [ 570.565411][T21331] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 570.565423][T21331] R13: 00007f7fc4216038 R14: 00007f7fc4215fa0 R15: 00007ffc548789f8 [ 570.565456][T21331] [ 570.805300][ T980] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 570.846266][ T5917] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 570.885918][T21339] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 570.936453][T21337] gre0 speed is unknown, defaulting to 1000 [ 571.020309][ T796] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 571.196028][T21337] virt_wifi0 speed is unknown, defaulting to 1000 [ 571.402683][T21362] x_tables: duplicate underflow at hook 4 [ 571.587034][T21364] netlink: 'syz.0.3775': attribute type 1 has an invalid length. [ 571.596537][T21364] netlink: 'syz.0.3775': attribute type 1 has an invalid length. [ 571.763976][T21376] xt_addrtype: input interface limitation not valid in POSTROUTING and OUTPUT [ 572.078446][ T796] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 572.189464][T21400] sctp: [Deprecated]: syz.0.3787 (pid 21400) Use of int in max_burst socket option deprecated. [ 572.189464][T21400] Use struct sctp_assoc_value instead [ 572.368473][T21410] bond6: entered promiscuous mode [ 572.392842][T21410] 8021q: adding VLAN 0 to HW filter on device bond6 [ 572.404681][T21410] bridge0: port 3(bond6) entered blocking state [ 572.411758][T21410] bridge0: port 3(bond6) entered disabled state [ 572.418549][T21410] bond6: entered allmulticast mode [ 572.427448][T21410] bridge0: port 3(bond6) entered blocking state [ 572.434627][T21410] bridge0: port 3(bond6) entered forwarding state [ 572.448115][ T7561] bridge0: port 3(bond6) entered disabled state [ 572.593405][T21428] __nla_validate_parse: 7 callbacks suppressed [ 572.593427][T21428] netlink: 8 bytes leftover after parsing attributes in process `syz.1.3796'. [ 572.806042][ T5829] block nbd4: Receive control failed (result -32) [ 573.102979][ T5891] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 573.270010][T21463] netlink: 32 bytes leftover after parsing attributes in process `syz.0.3804'. [ 573.357712][T21466] xt_addrtype: ipv6 BLACKHOLE matching not supported [ 573.738367][T21491] netlink: 8 bytes leftover after parsing attributes in process `syz.1.3815'. [ 573.761156][T21486] gre0 speed is unknown, defaulting to 1000 [ 573.820517][ T980] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 573.848454][T21499] FAULT_INJECTION: forcing a failure. [ 573.848454][T21499] name failslab, interval 1, probability 0, space 0, times 0 [ 573.900484][T21499] CPU: 1 UID: 0 PID: 21499 Comm: syz.4.3816 Not tainted syzkaller #0 PREEMPT(full) [ 573.900516][T21499] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026 [ 573.900529][T21499] Call Trace: [ 573.900537][T21499] [ 573.900546][T21499] dump_stack_lvl+0xe8/0x150 [ 573.900583][T21499] should_fail_ex+0x412/0x560 [ 573.900620][T21499] should_failslab+0xa8/0x100 [ 573.900649][T21499] __kmalloc_cache_noprof+0x88/0x660 [ 573.900672][T21499] ? netlink_lookup+0x30/0x200 [ 573.900698][T21499] ? genl_family_rcv_msg_attrs_parse+0xe9/0x2f0 [ 573.900722][T21499] ? genl_start+0x1c9/0x6c0 [ 573.900750][T21499] genl_start+0x1c9/0x6c0 [ 573.900771][T21499] ? netlink_lookup+0x30/0x200 [ 573.900806][T21499] __netlink_dump_start+0x469/0x7e0 [ 573.900843][T21499] genl_family_rcv_msg_dumpit+0x213/0x310 [ 573.900872][T21499] ? __pfx_genl_family_rcv_msg_dumpit+0x10/0x10 [ 573.900904][T21499] ? genl_get_cmd+0x82e/0x960 [ 573.900929][T21499] ? __pfx___mutex_lock+0x10/0x10 [ 573.900955][T21499] ? __pfx_genl_start+0x10/0x10 [ 573.900975][T21499] ? __pfx_genl_dumpit+0x10/0x10 [ 573.900995][T21499] ? __pfx_genl_done+0x10/0x10 [ 573.901024][T21499] ? __lock_acquire+0x6b5/0x2cf0 [ 573.901063][T21499] genl_rcv_msg+0x5e8/0x7a0 [ 573.901093][T21499] ? __pfx_genl_rcv_msg+0x10/0x10 [ 573.901115][T21499] ? __pfx_nl802154_dump_interface+0x10/0x10 [ 573.901155][T21499] netlink_rcv_skb+0x232/0x4b0 [ 573.901185][T21499] ? __pfx_genl_rcv_msg+0x10/0x10 [ 573.901209][T21499] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 573.901256][T21499] ? down_read+0x272/0x2e0 [ 573.901280][T21499] ? genl_rcv+0xd/0x40 [ 573.901304][T21499] genl_rcv+0x28/0x40 [ 573.901324][T21499] netlink_unicast+0x75c/0x8e0 [ 573.901364][T21499] netlink_sendmsg+0x813/0xb40 [ 573.901404][T21499] ? __pfx_netlink_sendmsg+0x10/0x10 [ 573.901437][T21499] ? aa_sock_msg_perm+0xf1/0x1b0 [ 573.901460][T21499] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 573.901489][T21499] ____sys_sendmsg+0x972/0x9f0 [ 573.901532][T21499] ? __pfx_____sys_sendmsg+0x10/0x10 [ 573.901573][T21499] ? import_iovec+0x73/0xa0 [ 573.901603][T21499] ___sys_sendmsg+0x2a5/0x360 [ 573.901641][T21499] ? __pfx____sys_sendmsg+0x10/0x10 [ 573.901715][T21499] ? __fget_files+0x2a/0x420 [ 573.901733][T21499] ? __fget_files+0x3a0/0x420 [ 573.901765][T21499] __x64_sys_sendmsg+0x1bd/0x2a0 [ 573.901799][T21499] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 573.901842][T21499] ? __pfx_ksys_write+0x10/0x10 [ 573.901880][T21499] do_syscall_64+0x14d/0xf80 [ 573.901911][T21499] ? trace_irq_disable+0x3b/0x150 [ 573.901928][T21499] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 573.901949][T21499] ? clear_bhb_loop+0x40/0x90 [ 573.901975][T21499] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 573.901995][T21499] RIP: 0033:0x7fe23959c819 [ 573.902016][T21499] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 573.902034][T21499] RSP: 002b:00007fe2377f6028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 573.902058][T21499] RAX: ffffffffffffffda RBX: 00007fe239815fa0 RCX: 00007fe23959c819 [ 573.902072][T21499] RDX: 0000000000000000 RSI: 00002000000003c0 RDI: 0000000000000004 [ 573.902086][T21499] RBP: 00007fe2377f6090 R08: 0000000000000000 R09: 0000000000000000 [ 573.902098][T21499] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 573.902111][T21499] R13: 00007fe239816038 R14: 00007fe239815fa0 R15: 00007fff0cf439f8 [ 573.902145][T21499] [ 574.049539][T21486] virt_wifi0 speed is unknown, defaulting to 1000 [ 574.280780][ T5891] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 574.466393][T21505] syzkaller0: entered promiscuous mode [ 574.472146][T21505] syzkaller0: entered allmulticast mode [ 574.518770][T21520] netlink: 'syz.1.3821': attribute type 16 has an invalid length. [ 574.552730][T21514] netlink: 12 bytes leftover after parsing attributes in process `syz.4.3819'. [ 574.574044][T21523] netlink: 60 bytes leftover after parsing attributes in process `syz.1.3821'. [ 574.612917][T21523] netlink: 12 bytes leftover after parsing attributes in process `syz.1.3821'. [ 574.663236][T21505] netlink: 48 bytes leftover after parsing attributes in process `syz.4.3819'. [ 574.677568][T21523] xfrm1: entered allmulticast mode [ 575.005683][T21533] openvswitch: netlink: Missing valid actions attribute. [ 575.013118][T21533] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 575.140149][T21547] FAULT_INJECTION: forcing a failure. [ 575.140149][T21547] name failslab, interval 1, probability 0, space 0, times 0 [ 575.159676][T21547] CPU: 0 UID: 0 PID: 21547 Comm: syz.4.3829 Not tainted syzkaller #0 PREEMPT(full) [ 575.159706][T21547] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026 [ 575.159718][T21547] Call Trace: [ 575.159726][T21547] [ 575.159735][T21547] dump_stack_lvl+0xe8/0x150 [ 575.159769][T21547] should_fail_ex+0x412/0x560 [ 575.159807][T21547] should_failslab+0xa8/0x100 [ 575.159836][T21547] kmem_cache_alloc_node_noprof+0x8f/0x690 [ 575.159862][T21547] ? __alloc_skb+0x1d0/0x7d0 [ 575.159889][T21547] ? __local_bh_enable_ip+0xd0/0x130 [ 575.159921][T21547] __alloc_skb+0x1d0/0x7d0 [ 575.159955][T21547] netlink_dump+0x1d8/0xe10 [ 575.159997][T21547] ? __pfx_netlink_dump+0x10/0x10 [ 575.160040][T21547] ? genl_start+0x499/0x6c0 [ 575.160081][T21547] __netlink_dump_start+0x5cb/0x7e0 [ 575.160119][T21547] genl_family_rcv_msg_dumpit+0x213/0x310 [ 575.160147][T21547] ? __pfx_genl_family_rcv_msg_dumpit+0x10/0x10 [ 575.160169][T21547] ? genl_get_cmd+0x82e/0x960 [ 575.160194][T21547] ? __pfx___mutex_lock+0x10/0x10 [ 575.160220][T21547] ? __pfx_genl_start+0x10/0x10 [ 575.160240][T21547] ? __pfx_genl_dumpit+0x10/0x10 [ 575.160260][T21547] ? __pfx_genl_done+0x10/0x10 [ 575.160289][T21547] ? __lock_acquire+0x6b5/0x2cf0 [ 575.160323][T21547] genl_rcv_msg+0x5e8/0x7a0 [ 575.160353][T21547] ? __pfx_genl_rcv_msg+0x10/0x10 [ 575.160375][T21547] ? __pfx_nl802154_dump_interface+0x10/0x10 [ 575.160417][T21547] netlink_rcv_skb+0x232/0x4b0 [ 575.160446][T21547] ? __pfx_genl_rcv_msg+0x10/0x10 [ 575.160471][T21547] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 575.160517][T21547] ? down_read+0x272/0x2e0 [ 575.160541][T21547] ? genl_rcv+0xd/0x40 [ 575.160564][T21547] genl_rcv+0x28/0x40 [ 575.160584][T21547] netlink_unicast+0x75c/0x8e0 [ 575.160624][T21547] netlink_sendmsg+0x813/0xb40 [ 575.160664][T21547] ? __pfx_netlink_sendmsg+0x10/0x10 [ 575.160698][T21547] ? aa_sock_msg_perm+0xf1/0x1b0 [ 575.160721][T21547] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 575.160750][T21547] ____sys_sendmsg+0x972/0x9f0 [ 575.160792][T21547] ? __pfx_____sys_sendmsg+0x10/0x10 [ 575.160832][T21547] ? import_iovec+0x73/0xa0 [ 575.160861][T21547] ___sys_sendmsg+0x2a5/0x360 [ 575.160899][T21547] ? __pfx____sys_sendmsg+0x10/0x10 [ 575.160972][T21547] ? __fget_files+0x2a/0x420 [ 575.160991][T21547] ? __fget_files+0x3a0/0x420 [ 575.161023][T21547] __x64_sys_sendmsg+0x1bd/0x2a0 [ 575.161056][T21547] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 575.161106][T21547] ? __pfx_ksys_write+0x10/0x10 [ 575.161143][T21547] do_syscall_64+0x14d/0xf80 [ 575.161167][T21547] ? trace_irq_disable+0x3b/0x150 [ 575.161184][T21547] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 575.161205][T21547] ? clear_bhb_loop+0x40/0x90 [ 575.161230][T21547] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 575.161250][T21547] RIP: 0033:0x7fe23959c819 [ 575.161270][T21547] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 575.161286][T21547] RSP: 002b:00007fe2377f6028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 575.161308][T21547] RAX: ffffffffffffffda RBX: 00007fe239815fa0 RCX: 00007fe23959c819 [ 575.161323][T21547] RDX: 0000000000000000 RSI: 00002000000003c0 RDI: 0000000000000004 [ 575.161335][T21547] RBP: 00007fe2377f6090 R08: 0000000000000000 R09: 0000000000000000 [ 575.161348][T21547] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 575.161360][T21547] R13: 00007fe239816038 R14: 00007fe239815fa0 R15: 00007fff0cf439f8 [ 575.161395][T21547] [ 575.554230][ T5891] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 575.573163][T21539] netlink: 'syz.0.3828': attribute type 3 has an invalid length. [ 575.575159][T21544] gre0 speed is unknown, defaulting to 1000 [ 575.582591][T21539] netlink: 666 bytes leftover after parsing attributes in process `syz.0.3828'. [ 575.613755][T21550] netlink: 8 bytes leftover after parsing attributes in process `syz.1.3830'. [ 575.623057][T21550] netlink: 16 bytes leftover after parsing attributes in process `syz.1.3830'. [ 576.036436][ T6575] netdevsim netdevsim4 eth0: set [0, 0] type 1 family 0 port 8472 - 0 [ 576.045365][ T6575] netdevsim netdevsim4 eth1: set [0, 0] type 1 family 0 port 8472 - 0 [ 576.080220][ T6575] netdevsim netdevsim4 eth2: set [0, 0] type 1 family 0 port 8472 - 0 [ 576.102292][ T6575] netdevsim netdevsim4 eth3: set [0, 0] type 1 family 0 port 8472 - 0 [ 576.126081][T21571] FAULT_INJECTION: forcing a failure. [ 576.126081][T21571] name failslab, interval 1, probability 0, space 0, times 0 [ 576.175751][T21571] CPU: 0 UID: 0 PID: 21571 Comm: syz.0.3838 Not tainted syzkaller #0 PREEMPT(full) [ 576.175781][T21571] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026 [ 576.175793][T21571] Call Trace: [ 576.175802][T21571] [ 576.175810][T21571] dump_stack_lvl+0xe8/0x150 [ 576.175844][T21571] should_fail_ex+0x412/0x560 [ 576.175883][T21571] should_failslab+0xa8/0x100 [ 576.175911][T21571] __kmalloc_cache_noprof+0x88/0x660 [ 576.175938][T21571] ? sctp_add_bind_addr+0x8c/0x370 [ 576.175969][T21571] sctp_add_bind_addr+0x8c/0x370 [ 576.175996][T21571] sctp_copy_local_addr_list+0x314/0x4f0 [ 576.176022][T21571] ? sctp_copy_local_addr_list+0xa4/0x4f0 [ 576.176043][T21571] ? __pfx_sctp_copy_local_addr_list+0x10/0x10 [ 576.176069][T21571] ? sctp_v4_is_any+0x35/0x60 [ 576.176098][T21571] ? sctp_copy_one_addr+0x93/0x360 [ 576.176123][T21571] sctp_bind_addr_copy+0x189/0x3c0 [ 576.176152][T21571] sctp_connect_new_asoc+0x2ff/0x6b0 [ 576.176182][T21571] ? __pfx_sctp_connect_new_asoc+0x10/0x10 [ 576.176215][T21571] ? __local_bh_enable_ip+0xd0/0x130 [ 576.176239][T21571] ? bpf_lsm_sctp_bind_connect+0x9/0x20 [ 576.176263][T21571] ? security_sctp_bind_connect+0x7e/0x2c0 [ 576.176292][T21571] sctp_sendmsg+0x1528/0x2c10 [ 576.176333][T21571] ? __pfx_sctp_sendmsg+0x10/0x10 [ 576.176361][T21571] ? aa_sk_perm+0x6d5/0x900 [ 576.176400][T21571] ? __pfx_aa_sk_perm+0x10/0x10 [ 576.176432][T21571] ? sock_rps_record_flow+0x19/0x350 [ 576.176466][T21571] ? inet_sendmsg+0x2f4/0x370 [ 576.176491][T21571] ____sys_sendmsg+0x80a/0x9f0 [ 576.176533][T21571] ? __pfx_____sys_sendmsg+0x10/0x10 [ 576.176574][T21571] ? import_iovec+0x73/0xa0 [ 576.176604][T21571] ___sys_sendmsg+0x2a5/0x360 [ 576.176642][T21571] ? __pfx____sys_sendmsg+0x10/0x10 [ 576.176680][T21571] ? kstrtouint+0x6e/0xe0 [ 576.176740][T21571] ? __fget_files+0x2a/0x420 [ 576.176759][T21571] ? __fget_files+0x3a0/0x420 [ 576.176791][T21571] __sys_sendmmsg+0x27c/0x4e0 [ 576.176819][T21571] ? __pfx___sys_sendmmsg+0x10/0x10 [ 576.176836][T21571] ? __mutex_unlock_slowpath+0x1bd/0x7d0 [ 576.176892][T21571] ? ksys_write+0x242/0x270 [ 576.176918][T21571] ? __pfx_ksys_write+0x10/0x10 [ 576.176950][T21571] __x64_sys_sendmmsg+0xa0/0xc0 [ 576.176973][T21571] do_syscall_64+0x14d/0xf80 [ 576.176996][T21571] ? trace_irq_disable+0x3b/0x150 [ 576.177014][T21571] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 576.177035][T21571] ? clear_bhb_loop+0x40/0x90 [ 576.177062][T21571] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 576.177090][T21571] RIP: 0033:0x7fd8e1b9c819 [ 576.177111][T21571] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 576.177129][T21571] RSP: 002b:00007fd8e2b30028 EFLAGS: 00000246 ORIG_RAX: 0000000000000133 [ 576.177151][T21571] RAX: ffffffffffffffda RBX: 00007fd8e1e15fa0 RCX: 00007fd8e1b9c819 [ 576.177166][T21571] RDX: 0000000000000001 RSI: 0000200000003380 RDI: 0000000000000003 [ 576.177179][T21571] RBP: 00007fd8e2b30090 R08: 0000000000000000 R09: 0000000000000000 [ 576.177192][T21571] R10: 0000000004000004 R11: 0000000000000246 R12: 0000000000000002 [ 576.177204][T21571] R13: 00007fd8e1e16038 R14: 00007fd8e1e15fa0 R15: 00007ffdfc09bd48 [ 576.177239][T21571] [ 576.519666][T21544] virt_wifi0 speed is unknown, defaulting to 1000 [ 576.623694][ T796] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 576.741508][T21584] sch_tbf: peakrate 2 is lower than or equals to rate 8607250805684256844 ! [ 576.860159][ T42] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 576.915537][T21589] syzkaller0: entered promiscuous mode [ 576.936038][T21589] syzkaller0: entered allmulticast mode [ 577.299512][T21600] netlink: 'syz.4.3847': attribute type 1 has an invalid length. [ 577.384757][T21600] bond8: entered promiscuous mode [ 577.426289][T21600] 8021q: adding VLAN 0 to HW filter on device bond8 [ 577.519523][T21607] 8021q: adding VLAN 0 to HW filter on device bond8 [ 577.540546][T21607] bond8: (slave gre1): The slave device specified does not support setting the MAC address [ 577.555627][T21607] bond8: (slave gre1): Setting fail_over_mac to active for active-backup mode [ 577.570917][T21616] FAULT_INJECTION: forcing a failure. [ 577.570917][T21616] name failslab, interval 1, probability 0, space 0, times 0 [ 577.602910][T21607] bond8: (slave gre1): making interface the new active one [ 577.610762][T21607] gre1: entered promiscuous mode [ 577.618584][T21607] bond8: (slave gre1): Enslaving as an active interface with an up link [ 577.622776][T21616] CPU: 0 UID: 0 PID: 21616 Comm: syz.2.3852 Not tainted syzkaller #0 PREEMPT(full) [ 577.622803][T21616] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026 [ 577.622813][T21616] Call Trace: [ 577.622820][T21616] [ 577.622828][T21616] dump_stack_lvl+0xe8/0x150 [ 577.622860][T21616] should_fail_ex+0x412/0x560 [ 577.622894][T21616] should_failslab+0xa8/0x100 [ 577.622920][T21616] __kmalloc_cache_noprof+0x88/0x660 [ 577.622944][T21616] ? sctp_add_bind_addr+0x8c/0x370 [ 577.622970][T21616] sctp_add_bind_addr+0x8c/0x370 [ 577.622995][T21616] sctp_copy_local_addr_list+0x314/0x4f0 [ 577.623027][T21616] ? sctp_copy_local_addr_list+0xa4/0x4f0 [ 577.623047][T21616] ? __pfx_sctp_copy_local_addr_list+0x10/0x10 [ 577.623072][T21616] ? sctp_v4_is_any+0x35/0x60 [ 577.623092][T21616] ? sctp_copy_one_addr+0x93/0x360 [ 577.623117][T21616] sctp_bind_addr_copy+0x189/0x3c0 [ 577.623144][T21616] sctp_connect_new_asoc+0x2ff/0x6b0 [ 577.623173][T21616] ? __pfx_sctp_connect_new_asoc+0x10/0x10 [ 577.623204][T21616] ? __local_bh_enable_ip+0xd0/0x130 [ 577.623226][T21616] ? bpf_lsm_sctp_bind_connect+0x9/0x20 [ 577.623248][T21616] ? security_sctp_bind_connect+0x7e/0x2c0 [ 577.623275][T21616] sctp_sendmsg+0x1528/0x2c10 [ 577.623315][T21616] ? __pfx_sctp_sendmsg+0x10/0x10 [ 577.623342][T21616] ? aa_sk_perm+0x6d5/0x900 [ 577.623377][T21616] ? __pfx_aa_sk_perm+0x10/0x10 [ 577.623407][T21616] ? sock_rps_record_flow+0x19/0x350 [ 577.623439][T21616] ? inet_sendmsg+0x2f4/0x370 [ 577.623460][T21616] ____sys_sendmsg+0x80a/0x9f0 [ 577.623515][T21616] ? __pfx_____sys_sendmsg+0x10/0x10 [ 577.623560][T21616] ? import_iovec+0x73/0xa0 [ 577.623587][T21616] ___sys_sendmsg+0x2a5/0x360 [ 577.623620][T21616] ? __pfx____sys_sendmsg+0x10/0x10 [ 577.623653][T21616] ? kstrtouint+0x6e/0xe0 [ 577.623708][T21616] ? __fget_files+0x2a/0x420 [ 577.623723][T21616] ? __fget_files+0x3a0/0x420 [ 577.623751][T21616] __sys_sendmmsg+0x27c/0x4e0 [ 577.623775][T21616] ? __pfx___sys_sendmmsg+0x10/0x10 [ 577.623790][T21616] ? __mutex_unlock_slowpath+0x1bd/0x7d0 [ 577.623845][T21616] ? ksys_write+0x242/0x270 [ 577.623868][T21616] ? __pfx_ksys_write+0x10/0x10 [ 577.623896][T21616] __x64_sys_sendmmsg+0xa0/0xc0 [ 577.623917][T21616] do_syscall_64+0x14d/0xf80 [ 577.623937][T21616] ? trace_irq_disable+0x3b/0x150 [ 577.623953][T21616] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 577.623972][T21616] ? clear_bhb_loop+0x40/0x90 [ 577.623995][T21616] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 577.624021][T21616] RIP: 0033:0x7f195ed9c819 [ 577.624040][T21616] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 577.624055][T21616] RSP: 002b:00007f195fd42028 EFLAGS: 00000246 ORIG_RAX: 0000000000000133 [ 577.624076][T21616] RAX: ffffffffffffffda RBX: 00007f195f015fa0 RCX: 00007f195ed9c819 [ 577.624089][T21616] RDX: 0000000000000001 RSI: 0000200000003380 RDI: 0000000000000003 [ 577.624101][T21616] RBP: 00007f195fd42090 R08: 0000000000000000 R09: 0000000000000000 [ 577.624112][T21616] R10: 0000000004000004 R11: 0000000000000246 R12: 0000000000000002 [ 577.624123][T21616] R13: 00007f195f016038 R14: 00007f195f015fa0 R15: 00007ffdcbb1e228 [ 577.624154][T21616] [ 577.679646][ T5891] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 578.312789][T21635] gre0 speed is unknown, defaulting to 1000 [ 578.645808][T21635] virt_wifi0 speed is unknown, defaulting to 1000 [ 578.707386][ T5891] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 578.905666][T21672] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 578.928824][T21672] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 578.937943][ C0] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 578.968996][T21674] __nla_validate_parse: 3 callbacks suppressed [ 578.969017][T21674] netlink: 4 bytes leftover after parsing attributes in process `syz.3.3869'. [ 578.994662][T21672] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 579.003203][ C0] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 579.033741][T21672] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 579.042293][ C0] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 579.105251][T21672] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 579.113677][ C0] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 579.149577][T21672] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 579.646297][T21689] netlink: 12 bytes leftover after parsing attributes in process `syz.0.3872'. [ 579.757371][T21689] bond1: entered promiscuous mode [ 579.763246][T21689] 8021q: adding VLAN 0 to HW filter on device bond1 [ 579.763409][T21696] netlink: 'syz.2.3873': attribute type 1 has an invalid length. [ 579.817738][T21689] netlink: 153100 bytes leftover after parsing attributes in process `syz.0.3872'. [ 579.856526][T21698] 8021q: adding VLAN 0 to HW filter on device bond1 [ 579.878759][T21698] bond1: (slave ip6gre1): The slave device specified does not support setting the MAC address [ 579.890961][T21698] bond1: (slave ip6gre1): Error -95 calling set_mac_address [ 579.941869][T21709] netlink: 20 bytes leftover after parsing attributes in process `syz.2.3873'. [ 579.976872][T21711] netlink: 4 bytes leftover after parsing attributes in process `syz.3.3877'. [ 579.982852][T21704] bond6: (slave vxcan3): The slave device specified does not support setting the MAC address [ 579.997975][T21704] bond6: (slave vxcan3): Error -95 calling set_mac_address [ 580.062608][T21709] bond6: (slave bridge3): Enslaving as an active interface with a down link [ 580.126725][T21696] macvlan3: entered promiscuous mode [ 580.134362][T21696] macvlan3: entered allmulticast mode [ 580.141566][T21696] bond6: entered promiscuous mode [ 580.147590][T21696] 8021q: adding VLAN 0 to HW filter on device macvlan3 [ 580.156633][T21696] bond6: left promiscuous mode [ 580.180951][T21719] netlink: 'syz.0.3880': attribute type 1 has an invalid length. [ 580.202123][T21719] netlink: 88 bytes leftover after parsing attributes in process `syz.0.3880'. [ 580.217871][T21719] netlink: 1 bytes leftover after parsing attributes in process `syz.0.3880'. [ 580.244822][T21719] netlink: 'syz.0.3880': attribute type 1 has an invalid length. [ 580.271383][T21719] netlink: 634 bytes leftover after parsing attributes in process `syz.0.3880'. [ 580.514286][T21731] netlink: 12 bytes leftover after parsing attributes in process `syz.2.3884'. [ 580.549130][T21739] netlink: 156 bytes leftover after parsing attributes in process `syz.3.3886'. [ 580.613051][T21741] netlink: 'syz.4.3888': attribute type 3 has an invalid length. [ 581.189784][T21777] rdma_rxe: rxe_newlink: failed to add gre0 [ 581.230676][T21778] rdma_rxe: rxe_newlink: failed to add gre0 [ 581.526807][T21794] set_target_v3_checkentry: 1 callbacks suppressed [ 581.526831][T21794] Cannot find add_set index 0 as target [ 581.575084][T21793] batadv_slave_1: entered promiscuous mode [ 581.594955][T21793] macsec1: entered promiscuous mode [ 581.783783][T21807] IPVS: set_ctl: invalid protocol: 51 255.255.255.255:3618 [ 581.855900][T21814] netlink: 'syz.0.3906': attribute type 13 has an invalid length. [ 581.890353][T21814] netlink: 'syz.0.3906': attribute type 17 has an invalid length. [ 582.386098][T21807] bridge0: port 2(bridge_slave_1) entered disabled state [ 582.393747][T21807] bridge0: port 1(bridge_slave_0) entered disabled state [ 582.772054][T21807] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 582.813757][T21807] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 583.231472][T21814] 8021q: adding VLAN 0 to HW filter on device bond0 [ 583.239889][T21814] 8021q: adding VLAN 0 to HW filter on device team0 [ 583.251060][T21814] 0ªX¹¦À: left allmulticast mode [ 583.457069][ T49] netdevsim netdevsim0 eth0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 583.475745][T21853] rdma_rxe: rxe_newlink: failed to add gre0 [ 583.496341][ T49] netdevsim netdevsim0 eth1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 583.523001][ T49] netdevsim netdevsim0 eth2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 583.551166][ T49] netdevsim netdevsim0 eth3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 583.606904][T21858] Cannot find del_set index 1 as target [ 583.654059][T21858] netlink: 'syz.1.3915': attribute type 11 has an invalid length. [ 583.975185][T21876] x_tables: duplicate underflow at hook 1 [ 584.221651][T21894] xt_SECMARK: only valid in 'mangle' or 'security' table, not 'filter' [ 584.748957][T21916] rdma_rxe: rxe_newlink: failed to add gre0 [ 584.792471][T21916] __nla_validate_parse: 8 callbacks suppressed [ 584.792494][T21916] netlink: 8 bytes leftover after parsing attributes in process `syz.1.3929'. [ 585.482365][T21949] netlink: 8 bytes leftover after parsing attributes in process `syz.2.3938'. [ 585.519517][T21949] netlink: 32 bytes leftover after parsing attributes in process `syz.2.3938'. [ 585.756915][T21959] netlink: 'syz.0.3942': attribute type 1 has an invalid length. [ 585.811742][T21959] bond2: (slave vxcan3): The slave device specified does not support setting the MAC address [ 585.823887][T21959] bond2: (slave vxcan3): Error -95 calling set_mac_address [ 585.880004][T21966] rdma_rxe: rxe_newlink: failed to add gre0 [ 585.893501][T21963] bond2: (slave gretap1): making interface the new active one [ 585.908423][T21965] netlink: 'syz.2.3944': attribute type 21 has an invalid length. [ 585.916399][T21963] bond2: (slave gretap1): Enslaving as an active interface with an up link [ 585.923758][T21959] macvlan2: entered promiscuous mode [ 585.931290][T21959] macvlan2: entered allmulticast mode [ 585.937634][T21959] bond2: entered promiscuous mode [ 585.943475][T21959] gretap1: entered promiscuous mode [ 585.950328][T21959] 8021q: adding VLAN 0 to HW filter on device macvlan2 [ 585.985927][T21965] netlink: 'syz.2.3944': attribute type 21 has an invalid length. [ 586.051913][T21967] netlink: 8 bytes leftover after parsing attributes in process `syz.4.3943'. [ 586.092342][T21959] bond2: (slave macvlan2): the slave hw address is in use by the bond; giving it the hw address of gretap1 [ 586.132326][T21959] bond2: left promiscuous mode [ 586.137294][T21959] gretap1: left promiscuous mode [ 586.157744][T21977] netlink: 84 bytes leftover after parsing attributes in process `syz.3.3946'. [ 586.183211][T21977] netlink: 24 bytes leftover after parsing attributes in process `syz.3.3946'. [ 586.485121][T21972] bridge0: port 2(bridge_slave_1) entered disabled state [ 586.492756][T21972] bridge0: port 1(bridge_slave_0) entered disabled state [ 586.851295][T21972] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 586.892136][T21972] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 587.270799][T21972] vlan2: left allmulticast mode [ 587.275864][T21972] vlan0: left allmulticast mode [ 587.282133][T21972] veth0_vlan: left allmulticast mode [ 587.288407][T21972] bond1: left allmulticast mode [ 587.320590][T21972] xfrm1: left allmulticast mode [ 587.334548][T21977] netlink: 48 bytes leftover after parsing attributes in process `syz.3.3946'. [ 587.407519][ T6579] netdevsim netdevsim1 netdevsim0: unset [0, 0] type 1 family 0 port 8472 - 0 [ 587.448315][ T6579] netdevsim netdevsim1 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 587.461598][ T6579] netdevsim netdevsim1 netdevsim1: unset [0, 0] type 1 family 0 port 8472 - 0 [ 587.475085][T21990] netlink: 36 bytes leftover after parsing attributes in process `syz.2.3951'. [ 587.486938][ T6579] netdevsim netdevsim1 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 587.496494][ T6579] netdevsim netdevsim1 netdevsim2: unset [0, 0] type 1 family 0 port 8472 - 0 [ 587.521269][T21990] sctp: [Deprecated]: syz.2.3951 (pid 21990) Use of struct sctp_assoc_value in delayed_ack socket option. [ 587.521269][T21990] Use struct sctp_sack_info instead [ 587.540660][ T6579] netdevsim netdevsim1 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 587.559835][ T6579] netdevsim netdevsim1 netdevsim3: unset [0, 0] type 1 family 0 port 8472 - 0 [ 587.568897][ T6579] netdevsim netdevsim1 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 587.612515][T21999] netlink: 'syz.3.3953': attribute type 12 has an invalid length. [ 587.651783][T22009] Bluetooth: MGMT ver 1.23 [ 587.780616][T22017] netlink: 'syz.2.3956': attribute type 1 has an invalid length. [ 587.864268][T22017] bond7: entered promiscuous mode [ 587.876091][T22017] 8021q: adding VLAN 0 to HW filter on device bond7 [ 588.035517][T22031] netlink: 52 bytes leftover after parsing attributes in process `syz.2.3956'. [ 588.081615][T22031] netlink: 8 bytes leftover after parsing attributes in process `syz.2.3956'. [ 588.153300][T22033] gre0 speed is unknown, defaulting to 1000 [ 588.483156][T22033] virt_wifi0 speed is unknown, defaulting to 1000 [ 588.629509][ T25] block nbd2: Possible stuck request ffff888026b50000: control (read@0,1024B). Runtime 30 seconds [ 588.644890][ T25] block nbd2: Possible stuck request ffff888026b50200: control (read@1024,1024B). Runtime 30 seconds [ 588.656468][ T25] block nbd2: Possible stuck request ffff888026b50400: control (read@2048,1024B). Runtime 30 seconds [ 588.666406][T22049] erspan0: entered promiscuous mode [ 588.667729][ T25] block nbd2: Possible stuck request ffff888026b50600: control (read@3072,1024B). Runtime 30 seconds [ 588.766075][T22051] bridge0: port 5(syz_tun) entered blocking state [ 588.791540][T22051] bridge0: port 5(syz_tun) entered disabled state [ 588.798300][T22051] syz_tun: entered allmulticast mode [ 588.806281][T22051] syz_tun: entered promiscuous mode [ 588.836490][T22051] bridge0: port 5(syz_tun) entered blocking state [ 588.843821][T22051] bridge0: port 5(syz_tun) entered forwarding state [ 588.998998][T22063] lo: entered allmulticast mode [ 589.008677][T22063] lo: left allmulticast mode [ 589.271471][ T5220] block nbd3: Possible stuck request ffff888026bc2600: control (read@0,1024B). Runtime 30 seconds [ 589.283458][ T5220] block nbd3: Possible stuck request ffff888026bc2800: control (read@1024,1024B). Runtime 30 seconds [ 589.298545][ T5220] block nbd3: Possible stuck request ffff888026bc2a00: control (read@2048,1024B). Runtime 30 seconds [ 589.321263][ T5220] block nbd3: Possible stuck request ffff888026bc2c00: control (read@3072,1024B). Runtime 30 seconds [ 589.768473][T22077] netlink: 'syz.4.3972': attribute type 2 has an invalid length. [ 590.182923][T22103] netlink: 'syz.0.3980': attribute type 1 has an invalid length. [ 590.348941][T22119] __nla_validate_parse: 3 callbacks suppressed [ 590.348961][T22119] netlink: 72 bytes leftover after parsing attributes in process `syz.2.3984'. [ 590.657337][T22133] netlink: 64 bytes leftover after parsing attributes in process `syz.2.3988'. [ 590.671342][T22130] gre0 speed is unknown, defaulting to 1000 [ 590.723514][T22138] netlink: 'syz.3.3990': attribute type 1 has an invalid length. [ 590.789377][T22138] netlink: 224 bytes leftover after parsing attributes in process `syz.3.3990'. [ 590.895513][T22141] netlink: 16 bytes leftover after parsing attributes in process `syz.1.3992'. [ 591.168896][T22122] netlink: 8 bytes leftover after parsing attributes in process `syz.4.3982'. [ 591.260264][T22122] netlink: 4 bytes leftover after parsing attributes in process `syz.4.3982'. [ 591.301086][T22122] netlink: 'syz.4.3982': attribute type 18 has an invalid length. [ 591.338332][T22110] bond9 (unregistering): Released all slaves [ 591.769703][T22130] virt_wifi0 speed is unknown, defaulting to 1000 [ 592.303397][T22206] netlink: 16 bytes leftover after parsing attributes in process `syz.4.4002'. [ 592.590610][T22193] gre0 speed is unknown, defaulting to 1000 [ 592.745112][T22222] netlink: 'syz.2.4010': attribute type 9 has an invalid length. [ 592.763657][T22222] netlink: 212308 bytes leftover after parsing attributes in process `syz.2.4010'. [ 592.808632][T22220] bond4: option primary_reselect: invalid value (4) [ 592.849738][T22220] bond4 (unregistering): Released all slaves [ 593.024485][T22224] bond4: option primary_reselect: invalid value (4) [ 593.042061][T22224] bond4 (unregistering): Released all slaves [ 593.130691][T22222] netlink: 32 bytes leftover after parsing attributes in process `syz.2.4010'. [ 593.160525][T22222] netlink: 8 bytes leftover after parsing attributes in process `syz.2.4010'. [ 593.258281][T22244] net_ratelimit: 2045 callbacks suppressed [ 593.258302][T22244] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 593.433337][T22252] žÿ: renamed from team_slave_1 (while UP) [ 593.595053][T22251] syzkaller0: entered promiscuous mode [ 593.619001][T22251] syzkaller0: entered allmulticast mode [ 593.661699][T22193] virt_wifi0 speed is unknown, defaulting to 1000 [ 596.774226][T22317] FAULT_INJECTION: forcing a failure. [ 596.774226][T22317] name failslab, interval 1, probability 0, space 0, times 0 [ 596.802752][T22317] CPU: 0 UID: 0 PID: 22317 Comm: syz.4.4027 Not tainted syzkaller #0 PREEMPT(full) [ 596.802782][T22317] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026 [ 596.802794][T22317] Call Trace: [ 596.802802][T22317] [ 596.802820][T22317] dump_stack_lvl+0xe8/0x150 [ 596.802853][T22317] should_fail_ex+0x412/0x560 [ 596.802888][T22317] should_failslab+0xa8/0x100 [ 596.802915][T22317] kmem_cache_alloc_node_noprof+0x8f/0x690 [ 596.802937][T22317] ? __alloc_skb+0x186/0x7d0 [ 596.802963][T22317] ? __alloc_skb+0x1d0/0x7d0 [ 596.802985][T22317] ? __local_bh_enable_ip+0xd0/0x130 [ 596.803014][T22317] __alloc_skb+0x1d0/0x7d0 [ 596.803039][T22317] ? bpf_lsm_socket_getpeersec_dgram+0x9/0x20 [ 596.803067][T22317] netlink_sendmsg+0x5d4/0xb40 [ 596.803105][T22317] ? __pfx_netlink_sendmsg+0x10/0x10 [ 596.803135][T22317] ? aa_sock_msg_perm+0xf1/0x1b0 [ 596.803157][T22317] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 596.803182][T22317] ____sys_sendmsg+0x972/0x9f0 [ 596.803219][T22317] ? __pfx_____sys_sendmsg+0x10/0x10 [ 596.803258][T22317] ? import_iovec+0x73/0xa0 [ 596.803285][T22317] ___sys_sendmsg+0x2a5/0x360 [ 596.803321][T22317] ? __pfx____sys_sendmsg+0x10/0x10 [ 596.803392][T22317] ? __fget_files+0x2a/0x420 [ 596.803411][T22317] ? __fget_files+0x3a0/0x420 [ 596.803439][T22317] __x64_sys_sendmsg+0x1bd/0x2a0 [ 596.803473][T22317] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 596.803511][T22317] ? __pfx_ksys_write+0x10/0x10 [ 596.803547][T22317] do_syscall_64+0x14d/0xf80 [ 596.803569][T22317] ? trace_irq_disable+0x3b/0x150 [ 596.803587][T22317] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 596.803607][T22317] ? clear_bhb_loop+0x40/0x90 [ 596.803632][T22317] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 596.803652][T22317] RIP: 0033:0x7fe23959c819 [ 596.803672][T22317] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 596.803689][T22317] RSP: 002b:00007fe2377f6028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 596.803712][T22317] RAX: ffffffffffffffda RBX: 00007fe239815fa0 RCX: 00007fe23959c819 [ 596.803726][T22317] RDX: 0000000000000000 RSI: 00002000000003c0 RDI: 0000000000000004 [ 596.803739][T22317] RBP: 00007fe2377f6090 R08: 0000000000000000 R09: 0000000000000000 [ 596.803752][T22317] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 596.803764][T22317] R13: 00007fe239816038 R14: 00007fe239815fa0 R15: 00007fff0cf439f8 [ 596.803796][T22317] [ 597.149834][T22322] __nla_validate_parse: 1 callbacks suppressed [ 597.149854][T22322] netlink: 60 bytes leftover after parsing attributes in process `syz.3.4030'. [ 597.722644][T22356] netlink: 'syz.0.4038': attribute type 1 has an invalid length. [ 597.746863][T22356] netlink: 'syz.0.4038': attribute type 4 has an invalid length. [ 597.841754][T22356] netlink: 9462 bytes leftover after parsing attributes in process `syz.0.4038'. [ 598.022856][T22378] netlink: 67 bytes leftover after parsing attributes in process `syz.2.4045'. [ 598.116013][T22382] netlink: 324 bytes leftover after parsing attributes in process `syz.3.4043'. [ 598.292558][T22394] netlink: 'syz.0.4047': attribute type 1 has an invalid length. [ 598.339606][T22394] netlink: 13 bytes leftover after parsing attributes in process `syz.0.4047'. [ 598.370570][T22394] netlink: 24 bytes leftover after parsing attributes in process `syz.0.4047'. [ 598.484394][T22403] netlink: 16 bytes leftover after parsing attributes in process `syz.4.4049'. [ 598.521117][T22403] netlink: 64 bytes leftover after parsing attributes in process `syz.4.4049'. [ 598.634553][T22407] IPVS: set_ctl: invalid protocol: 0 0.32.0.0:3072 [ 598.643003][T22403] netlink: 'syz.4.4049': attribute type 4 has an invalid length. [ 598.678149][T22403] netlink: 32 bytes leftover after parsing attributes in process `syz.4.4049'. [ 599.555443][T22459] netlink: 28 bytes leftover after parsing attributes in process `syz.1.4063'. [ 599.578018][T22459] netlink: 'syz.1.4063': attribute type 4 has an invalid length. [ 599.620046][T22464] gre0 speed is unknown, defaulting to 1000 [ 600.023407][T22488] erspan1: entered allmulticast mode [ 600.229433][T22464] virt_wifi0 speed is unknown, defaulting to 1000 [ 600.229533][T22493] gre0 speed is unknown, defaulting to 1000 [ 600.937360][T22495] gre0 speed is unknown, defaulting to 1000 [ 601.714340][T22495] virt_wifi0 speed is unknown, defaulting to 1000 [ 601.731389][T22493] virt_wifi0 speed is unknown, defaulting to 1000 [ 602.422317][T22569] siw: device registration error -23 [ 603.222673][T22598] tipc: Enabling of bearer rejected, failed to enable media [ 603.381515][T22605] __nla_validate_parse: 3 callbacks suppressed [ 603.381540][T22605] netlink: 8 bytes leftover after parsing attributes in process `syz.1.4101'. [ 603.417444][T22605] netlink: 'syz.1.4101': attribute type 21 has an invalid length. [ 603.618161][T22610] syzkaller0: entered promiscuous mode [ 603.629641][T22610] syzkaller0: entered allmulticast mode [ 603.694208][T22612] bond2: entered allmulticast mode [ 603.709085][T22612] 8021q: adding VLAN 0 to HW filter on device bond2 [ 603.968009][T22628] bridge_slave_1: left allmulticast mode [ 603.985055][T22628] bridge_slave_1: left promiscuous mode [ 603.992366][T22628] bridge0: port 2(bridge_slave_1) entered disabled state [ 604.015451][T22628] bridge_slave_0: left allmulticast mode [ 604.022022][T22628] bridge_slave_0: left promiscuous mode [ 604.028127][T22628] bridge0: port 1(bridge_slave_0) entered disabled state [ 604.284874][T22642] netlink: 'syz.3.4110': attribute type 15 has an invalid length. [ 604.296372][T22642] netlink: 666 bytes leftover after parsing attributes in process `syz.3.4110'. [ 604.369832][T22644] netlink: 40 bytes leftover after parsing attributes in process `syz.0.4111'. [ 604.413994][T22647] netlink: 32 bytes leftover after parsing attributes in process `syz.4.4112'. [ 604.527956][T22655] IPVS: Schedule: port zero only supported in persistent services, check your ipvs configuration [ 604.556139][T22656] syzkaller0: entered promiscuous mode [ 604.562115][T22656] syzkaller0: entered allmulticast mode [ 604.579947][T22656] tc action pedit 'at' offset 257 out of bounds [ 604.587091][T22656] tc action pedit 'at' offset 257 out of bounds [ 604.593546][T22656] tc action pedit 'at' offset 257 out of bounds [ 604.599894][T22656] tc action pedit 'at' offset 257 out of bounds [ 604.606175][T22656] tc action pedit 'at' offset 257 out of bounds [ 604.612533][T22656] tc action pedit 'at' offset 257 out of bounds [ 604.618809][T22656] tc action pedit 'at' offset 257 out of bounds [ 604.625209][T22656] tc action pedit 'at' offset 257 out of bounds [ 604.631604][T22656] tc action pedit 'at' offset 257 out of bounds [ 604.637974][T22656] tc action pedit 'at' offset 257 out of bounds [ 604.644314][T22656] 0: reclassify loop, rule prio 0, protocol 800 [ 604.702406][T22656] vxcan2: entered allmulticast mode [ 604.882499][T22670] netlink: 8 bytes leftover after parsing attributes in process `syz.2.4119'. [ 605.040760][T22674] netlink: 12 bytes leftover after parsing attributes in process `syz.0.4121'. [ 605.232441][ T5829] block nbd5: Receive control failed (result -32) [ 605.484371][T22703] rdma_rxe: rxe_newlink: failed to add gre0 [ 605.552542][T22702] netlink: 8 bytes leftover after parsing attributes in process `syz.1.4126'. [ 605.770771][T22722] gre0 speed is unknown, defaulting to 1000 [ 605.787619][T22717] xt_CHECKSUM: unsupported CHECKSUM operation 68 [ 606.120215][T22731] netlink: 156 bytes leftover after parsing attributes in process `syz.3.4134'. [ 606.171018][T22731] netlink: 156 bytes leftover after parsing attributes in process `syz.3.4134'. [ 606.194890][T22731] netlink: 8 bytes leftover after parsing attributes in process `syz.3.4134'. [ 606.219805][T22722] virt_wifi0 speed is unknown, defaulting to 1000 [ 606.254423][T22734] gre0 speed is unknown, defaulting to 1000 [ 606.478585][T22746] IPv6: NLM_F_REPLACE set, but no existing node found! [ 606.908134][T22734] virt_wifi0 speed is unknown, defaulting to 1000 [ 607.051710][T22769] netlink: 'syz.0.4141': attribute type 14 has an invalid length. [ 607.059944][T22769] netlink: 'syz.0.4141': attribute type 13 has an invalid length. [ 607.267242][T22781] netlink: 'syz.2.4143': attribute type 2 has an invalid length. [ 607.289336][T22781] netlink: 'syz.2.4143': attribute type 2 has an invalid length. [ 607.580777][T22789] xt_l2tp: invalid flags combination: 0 [ 607.627963][T22791] Cannot find add_set index 0 as target [ 607.907116][T22800] kthread_run failed with err -4 [ 608.190016][T22813] rdma_rxe: rxe_newlink: failed to add gre0 [ 608.410586][T22828] Bluetooth: MGMT ver 1.23 [ 608.528557][T22830] batadv_slave_1: Device is already in use. [ 608.691470][T22843] ip6tnl1: entered promiscuous mode [ 608.794297][T22850] __nla_validate_parse: 9 callbacks suppressed [ 608.794320][T22850] netlink: 104 bytes leftover after parsing attributes in process `syz.0.4160'. [ 609.069751][T22869] netlink: zone id is out of range [ 609.075185][T22869] netlink: zone id is out of range [ 609.083749][T22869] netlink: zone id is out of range [ 609.089499][T22869] netlink: zone id is out of range [ 609.094798][T22869] netlink: zone id is out of range [ 609.103554][T22869] netlink: zone id is out of range [ 609.118646][T22869] netlink: zone id is out of range [ 609.142195][T22869] netlink: zone id is out of range [ 609.158177][T22869] netlink: zone id is out of range [ 609.171869][T22868] gre0 speed is unknown, defaulting to 1000 [ 609.488894][T22882] nftables ruleset with unbound chain [ 609.497690][T22884] netlink: 88 bytes leftover after parsing attributes in process `syz.3.4174'. [ 609.671655][T22896] netlink: 4 bytes leftover after parsing attributes in process `syz.4.4177'. [ 609.700666][T22896] bond6: left allmulticast mode [ 609.706734][T22896] bridge0: port 3(bond6) entered disabled state [ 609.734753][T22896] bridge_slave_1: left allmulticast mode [ 609.735484][T22903] IPVS: Schedule: port zero only supported in persistent services, check your ipvs configuration [ 609.751918][T22896] bridge_slave_1: left promiscuous mode [ 609.758445][T22896] bridge0: port 2(bridge_slave_1) entered disabled state [ 609.770858][T22896] bridge_slave_0: left allmulticast mode [ 609.776549][T22896] bridge_slave_0: left promiscuous mode [ 609.784006][T22896] bridge0: port 1(bridge_slave_0) entered disabled state [ 609.815857][T22906] netlink: 36 bytes leftover after parsing attributes in process `syz.0.4179'. [ 609.836077][T22868] virt_wifi0 speed is unknown, defaulting to 1000 [ 610.080747][T22914] netlink: 12 bytes leftover after parsing attributes in process `syz.4.4182'. [ 610.397831][T22923] netlink: 'syz.4.4183': attribute type 10 has an invalid length. [ 610.463639][T22923] netlink: 'syz.4.4183': attribute type 10 has an invalid length. [ 610.557921][T22934] netlink: 'syz.0.4187': attribute type 4 has an invalid length. [ 610.665731][T22939] netlink: 4 bytes leftover after parsing attributes in process `syz.4.4190'. [ 610.695222][T22939] netlink: 12 bytes leftover after parsing attributes in process `syz.4.4190'. [ 610.819783][T22947] netlink: 16 bytes leftover after parsing attributes in process `syz.2.4193'. [ 611.320844][T22975] syz1: rxe_newlink: already configured on gre0 [ 611.360076][T22977] rdma_rxe: rxe_newlink: failed to add gre0 [ 611.367765][T22968] gre0 speed is unknown, defaulting to 1000 [ 611.541253][T22982] netlink: 8 bytes leftover after parsing attributes in process `syz.2.4199'. [ 611.612626][T22974] netlink: 8 bytes leftover after parsing attributes in process `syz.4.4200'. [ 611.700518][T22968] virt_wifi0 speed is unknown, defaulting to 1000 [ 611.797891][T22993] gre0 speed is unknown, defaulting to 1000 [ 612.064624][T23006] net_ratelimit: 45 callbacks suppressed [ 612.064646][T23006] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 612.473118][T23021] syz1: rxe_newlink: already configured on gre0 [ 612.578954][T22993] virt_wifi0 speed is unknown, defaulting to 1000 [ 613.144259][T23044] gre0 speed is unknown, defaulting to 1000 [ 613.529937][T23066] netlink: 'syz.3.4223': attribute type 1 has an invalid length. [ 613.626422][T23069] netlink: 'syz.1.4225': attribute type 2 has an invalid length. [ 613.834446][T23044] virt_wifi0 speed is unknown, defaulting to 1000 [ 613.991665][T23078] ip6gretap0: left promiscuous mode [ 614.343261][T23090] gre0 speed is unknown, defaulting to 1000 [ 614.343748][ T29] audit: type=1804 audit(1776269149.751:13): pid=23096 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=open_writers comm="syz.4.4232" name="/newroot/231/memory.events" dev="tmpfs" ino=1205 res=1 errno=0 [ 614.386381][ T29] audit: type=1800 audit(1776269149.781:14): pid=23096 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.4.4232" name="memory.events" dev="tmpfs" ino=1205 res=0 errno=0 [ 614.410197][ T29] audit: type=1804 audit(1776269149.781:15): pid=23096 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=ToMToU comm="syz.4.4232" name="/newroot/231/memory.events" dev="tmpfs" ino=1205 res=1 errno=0 [ 614.624822][T23090] virt_wifi0 speed is unknown, defaulting to 1000 [ 614.807225][T23110] __nla_validate_parse: 7 callbacks suppressed [ 614.807247][T23110] netlink: 8 bytes leftover after parsing attributes in process `syz.1.4237'. [ 615.391869][T23100] lec:lec_atm_close: lec0: Shut down! [ 615.464905][T23130] netlink: 'syz.2.4242': attribute type 63 has an invalid length. [ 615.748879][T23137] netlink: 8 bytes leftover after parsing attributes in process `syz.0.4243'. [ 615.764962][T23137] netlink: 8 bytes leftover after parsing attributes in process `syz.0.4243'. [ 615.887123][T23143] xt_socket: unknown flags 0x4 [ 615.903792][T23143] A link change request failed with some changes committed already. Interface veth1_vlan may have been left with an inconsistent configuration, please check. [ 615.930882][T23144] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 615.952871][T23146] netlink: 4 bytes leftover after parsing attributes in process `syz.0.4246'. [ 615.987860][T23143] netlink: 24 bytes leftover after parsing attributes in process `syz.2.4244'. [ 616.170908][T23153] netlink: 4 bytes leftover after parsing attributes in process `syz.0.4246'. [ 616.258915][T23146] netlink: 4 bytes leftover after parsing attributes in process `syz.0.4246'. [ 616.610762][T23168] geneve2: entered promiscuous mode [ 616.672622][T23172] netlink: 8 bytes leftover after parsing attributes in process `syz.4.4251'. [ 616.897573][T23179] netlink: 212344 bytes leftover after parsing attributes in process `syz.4.4254'. [ 616.919567][T23178] netlink: 212344 bytes leftover after parsing attributes in process `syz.4.4254'. [ 617.065873][T23186] netlink: zone id is out of range [ 617.071483][T23186] netlink: zone id is out of range [ 617.089372][T23186] netlink: zone id is out of range [ 617.094543][T23186] netlink: zone id is out of range [ 617.112424][T23186] netlink: zone id is out of range [ 617.124109][T23186] netlink: zone id is out of range [ 617.145959][T23186] netlink: zone id is out of range [ 617.199711][T23186] netlink: zone id is out of range [ 617.204915][T23186] netlink: zone id is out of range [ 617.207983][T23193] netlink: 'syz.0.4256': attribute type 2 has an invalid length. [ 617.323620][T23186] netlink: zone id is out of range [ 617.380160][T23211] netlink: 'syz.0.4256': attribute type 2 has an invalid length. [ 617.406721][T23186] netlink: zone id is out of range [ 617.458259][T23193] : entered promiscuous mode [ 617.845293][T23236] netlink: 'syz.4.4266': attribute type 58 has an invalid length. [ 617.863508][T23235] pim6reg1: entered promiscuous mode [ 617.881575][T23235] pim6reg1: entered allmulticast mode [ 618.149730][ T5488] lec:lec_start_xmit: lec0:No lecd attached [ 618.519998][T23278] smc: net device wlan0 applied user defined pnetid SYZ0 [ 618.563136][T23282] sctp: [Deprecated]: syz.4.4275 (pid 23282) Use of struct sctp_assoc_value in delayed_ack socket option. [ 618.563136][T23282] Use struct sctp_sack_info instead [ 618.615598][T23276] gre0 speed is unknown, defaulting to 1000 [ 618.712446][ T25] block nbd2: Possible stuck request ffff888026b50000: control (read@0,1024B). Runtime 60 seconds [ 618.723785][ T25] block nbd2: Possible stuck request ffff888026b50200: control (read@1024,1024B). Runtime 60 seconds [ 618.735668][ T25] block nbd2: Possible stuck request ffff888026b50400: control (read@2048,1024B). Runtime 60 seconds [ 618.747570][ T25] block nbd2: Possible stuck request ffff888026b50600: control (read@3072,1024B). Runtime 60 seconds [ 619.339499][ C0] ip6_tunnel: ip6gre1 xmit: Local address not yet configured! [ 619.353735][ T5220] block nbd3: Possible stuck request ffff888026bc2600: control (read@0,1024B). Runtime 60 seconds [ 619.365240][ T5220] block nbd3: Possible stuck request ffff888026bc2800: control (read@1024,1024B). Runtime 60 seconds [ 619.378095][ T5220] block nbd3: Possible stuck request ffff888026bc2a00: control (read@2048,1024B). Runtime 60 seconds [ 619.390200][ T5220] block nbd3: Possible stuck request ffff888026bc2c00: control (read@3072,1024B). Runtime 60 seconds [ 620.034331][T23305] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 620.057143][T23305] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 620.563118][T23269] gre0 speed is unknown, defaulting to 1000 [ 620.574949][T23276] virt_wifi0 speed is unknown, defaulting to 1000 [ 620.629622][T15154] netdevsim netdevsim3 eth0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 620.644739][T23345] __nla_validate_parse: 10 callbacks suppressed [ 620.644761][T23345] netlink: 12 bytes leftover after parsing attributes in process `syz.1.4287'. [ 620.661014][T15154] netdevsim netdevsim3 eth1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 620.673531][T23345] netlink: 20 bytes leftover after parsing attributes in process `syz.1.4287'. [ 620.684289][T23345] netlink: 8 bytes leftover after parsing attributes in process `syz.1.4287'. [ 620.719114][T15154] netdevsim netdevsim3 eth2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 620.751225][T15154] netdevsim netdevsim3 eth3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 621.467412][T23269] virt_wifi0 speed is unknown, defaulting to 1000 [ 621.513470][T23387] netlink: 1 bytes leftover after parsing attributes in process `syz.2.4301'. [ 621.870751][T23399] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 621.901497][T23399] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 621.929318][ T5192] udevd[5192]: worker [20082] /devices/virtual/block/nbd2 is taking a long time [ 621.938462][ T5192] udevd[5192]: worker [20056] /devices/virtual/block/nbd3 is taking a long time [ 622.280089][T23416] syzkaller0: entered promiscuous mode [ 622.296949][T23416] syzkaller0: entered allmulticast mode [ 622.482439][T23422] netlink: 'syz.4.4313': attribute type 29 has an invalid length. [ 622.504595][T23425] netlink: 'syz.0.4314': attribute type 2 has an invalid length. [ 622.768141][T23446] netlink: 8 bytes leftover after parsing attributes in process `syz.2.4320'. [ 622.776588][T23450] netlink: 64 bytes leftover after parsing attributes in process `syz.1.4321'. [ 622.805903][T23450] nbd: couldn't find a device at index 0 [ 622.926185][T23457] gre0 speed is unknown, defaulting to 1000 [ 622.974188][T23466] netlink: 'syz.2.4320': attribute type 21 has an invalid length. [ 623.029393][T23466] netlink: 132 bytes leftover after parsing attributes in process `syz.2.4320'. [ 623.159381][ C1] lec0: NETDEV WATCHDOG: CPU: 1: transmit queue 0 timed out 5010 ms [ 623.168152][ C1] lec:lec_tx_timeout: lec0 [ 623.173062][ C1] lec:lec_start_xmit: lec0:No lecd attached [ 623.315824][T23480] netlink: 24 bytes leftover after parsing attributes in process `syz.1.4327'. [ 623.396956][T23457] virt_wifi0 speed is unknown, defaulting to 1000 [ 623.471777][T23482] pim6reg0: tun_chr_ioctl cmd 1074025675 [ 623.488021][T23482] pim6reg0: persist disabled [ 623.560348][T23488] netlink: 132 bytes leftover after parsing attributes in process `syz.3.4329'. [ 623.718652][T23493] netlink: 12 bytes leftover after parsing attributes in process `syz.2.4330'. [ 623.892723][T23508] sctp: [Deprecated]: syz.4.4333 (pid 23508) Use of struct sctp_assoc_value in delayed_ack socket option. [ 623.892723][T23508] Use struct sctp_sack_info instead [ 624.757674][T23563] netdevsim netdevsim4 eth3 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 624.819566][T23563] netdevsim netdevsim4 eth3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 624.922516][T23563] netdevsim netdevsim4 eth2 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 624.949603][T23563] netdevsim netdevsim4 eth2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 624.992716][T23575] netlink: 'syz.0.4348': attribute type 29 has an invalid length. [ 625.058990][T23563] netdevsim netdevsim4 eth1 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 625.091023][T23563] netdevsim netdevsim4 eth1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 625.215826][T23563] netdevsim netdevsim4 eth0 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 625.249393][T23563] netdevsim netdevsim4 eth0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 625.478075][ T6579] netdevsim netdevsim4 eth0: set [0, 0] type 1 family 0 port 8472 - 0 [ 625.496778][ T6579] netdevsim netdevsim4 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 625.547322][T15159] netdevsim netdevsim4 eth1: set [0, 0] type 1 family 0 port 8472 - 0 [ 625.569697][T15159] netdevsim netdevsim4 eth1: set [1, 0] type 2 family 0 port 6081 - 0 [ 625.625212][T15159] netdevsim netdevsim4 eth2: set [0, 0] type 1 family 0 port 8472 - 0 [ 625.639275][T15159] netdevsim netdevsim4 eth2: set [1, 0] type 2 family 0 port 6081 - 0 [ 625.714216][T15159] netdevsim netdevsim4 eth3: set [0, 0] type 1 family 0 port 8472 - 0 [ 625.732932][T15159] netdevsim netdevsim4 eth3: set [1, 0] type 2 family 0 port 6081 - 0 [ 625.880228][T23611] netlink: 'syz.4.4356': attribute type 4 has an invalid length. [ 626.085411][T23614] __nla_validate_parse: 8 callbacks suppressed [ 626.085432][T23614] netlink: 43 bytes leftover after parsing attributes in process `syz.0.4357'. [ 626.176757][T23621] netlink: 'syz.4.4359': attribute type 15 has an invalid length. [ 626.200303][T23625] netlink: 8 bytes leftover after parsing attributes in process `syz.2.4360'. [ 626.238947][T23627] netlink: 40 bytes leftover after parsing attributes in process `syz.1.4361'. [ 626.251935][T23627] siw: device registration error -23 [ 626.258484][T23627] siw: device registration error -23 [ 626.262634][T23631] netlink: 4 bytes leftover after parsing attributes in process `syz.4.4359'. [ 626.472238][T23639] netlink: 'syz.0.4364': attribute type 1 has an invalid length. [ 626.493269][T23639] IPVS: set_ctl: invalid protocol: 28777 97.110.48.0:0 [ 626.529441][T23637] gre0 speed is unknown, defaulting to 1000 [ 626.731066][T23648] netlink: 88 bytes leftover after parsing attributes in process `syz.0.4366'. [ 626.740346][T23648] netlink: 8 bytes leftover after parsing attributes in process `syz.0.4366'. [ 626.865571][T23637] virt_wifi0 speed is unknown, defaulting to 1000 [ 626.966156][T23651] IPv6: NLM_F_CREATE should be specified when creating new route [ 627.071375][T23651] netlink: 8 bytes leftover after parsing attributes in process `syz.2.4367'. [ 627.201011][T23660] netlink: 'syz.1.4370': attribute type 22 has an invalid length. [ 627.219750][T23660] netlink: 16 bytes leftover after parsing attributes in process `syz.1.4370'. [ 627.331621][T23661] netlink: 8 bytes leftover after parsing attributes in process `syz.0.4369'. [ 627.499077][T23662] netlink: 'syz.0.4369': attribute type 1 has an invalid length. [ 627.507546][T23662] netlink: 256 bytes leftover after parsing attributes in process `syz.0.4369'. [ 627.526024][T23670] IPVS: Schedule: port zero only supported in persistent services, check your ipvs configuration [ 627.549423][T23662] tipc: Can't bind to reserved service type 0 [ 627.891812][T23686] netlink: 'syz.2.4375': attribute type 22 has an invalid length. [ 627.919097][T23682] syzkaller1: entered promiscuous mode [ 627.925825][T23682] syzkaller1: entered allmulticast mode [ 628.042383][T23690] team0: Port device team_slave_0 removed [ 628.070423][T23685] batman_adv: batadv0: Adding interface: ipvlan2 [ 628.076861][T23685] batman_adv: batadv0: The MTU of interface ipvlan2 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 628.103414][T23685] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 628.115180][T23685] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 628.128362][T23685] batman_adv: batadv0: Not using interface ipvlan2 (retrying later): interface not active [ 628.738728][T23721] netlink: 'syz.2.4386': attribute type 1 has an invalid length. [ 628.939199][ C1] lec0: NETDEV WATCHDOG: CPU: 1: transmit queue 0 timed out 5760 ms [ 628.947350][ C1] lec:lec_tx_timeout: lec0 [ 628.953444][ C1] lec:lec_start_xmit: lec0:No lecd attached [ 629.003345][T23736] netlink: 'syz.3.4391': attribute type 1 has an invalid length. [ 629.162281][T23743] net_ratelimit: 354 callbacks suppressed [ 629.162315][T23743] A link change request failed with some changes committed already. Interface syz_tun may have been left with an inconsistent configuration, please check. [ 629.711934][T23779] netlink: 'syz.0.4405': attribute type 1 has an invalid length. [ 629.820799][T23779] xt_policy: output policy not valid in PREROUTING and INPUT [ 630.064757][T23793] ip6tnl4: entered allmulticast mode [ 630.090205][T23793] x_tables: unsorted underflow at hook 2 [ 630.245655][T23810] netlink: 'syz.3.4413': attribute type 1 has an invalid length. [ 630.320904][T23810] 8021q: adding VLAN 0 to HW filter on device bond4 [ 630.520790][T23805] netlink: 'syz.3.4413': attribute type 1 has an invalid length. [ 630.607139][T23805] bond4: (slave batadv3): Opening slave failed [ 630.771727][T23835] rdma_rxe: rxe_newlink: failed to add gre0 [ 630.863953][T23841] netlink: 'syz.3.4423': attribute type 64 has an invalid length. [ 630.866960][T23842] netlink: 'syz.4.4422': attribute type 2 has an invalid length. [ 630.895713][T23844] netlink: 'syz.3.4423': attribute type 64 has an invalid length. [ 630.921306][T23842] hmac(sha224): entered promiscuous mode [ 631.341262][T23868] __nla_validate_parse: 27 callbacks suppressed [ 631.341286][T23868] netlink: 12 bytes leftover after parsing attributes in process `syz.1.4428'. [ 631.601569][T23885] netlink: 132 bytes leftover after parsing attributes in process `syz.0.4433'. [ 631.624827][T23885] veth0: Caught tx_queue_len zero misconfig [ 631.717621][T23890] netlink: 27 bytes leftover after parsing attributes in process `syz.2.4435'. [ 631.742349][T23892] rdma_rxe: rxe_newlink: failed to add gre0 [ 631.757844][T23892] netlink: 8 bytes leftover after parsing attributes in process `syz.1.4434'. [ 631.772198][T23895] netlink: 152 bytes leftover after parsing attributes in process `syz.0.4436'. [ 631.813425][T23895] .`: renamed from bond0 (while UP) [ 632.105739][T23909] netlink: 12 bytes leftover after parsing attributes in process `syz.1.4440'. [ 632.128076][T23913] netlink: 8 bytes leftover after parsing attributes in process `syz.2.4442'. [ 632.234465][T23916] mac80211_hwsim hwsim141 syzkaller0: entered promiscuous mode [ 632.252653][T23916] mac80211_hwsim hwsim141 syzkaller0: entered allmulticast mode [ 632.271374][T23919] xt_hashlimit: overflow, rate too high: 0 [ 632.355053][ T29] audit: type=1107 audit(1776269167.761:16): pid=23924 uid=0 auid=4294967295 ses=4294967295 subj=unconfined msg='3ú·«SŠLUîOëüIåÛœœf¦ñõV6öpŸ¨ØÎ)YSÉî0&FÕð8ÿc^Í]˜%[w)NŽýkgïÆ@T·V¨¹ {³Õª' [ 632.452037][T23928] rdma_rxe: rxe_newlink: failed to add gre0 [ 632.477703][T23928] netlink: 8 bytes leftover after parsing attributes in process `syz.1.4448'. [ 632.486062][T23932] netlink: 27 bytes leftover after parsing attributes in process `syz.3.4447'. [ 632.611816][T23939] validate_nla: 1 callbacks suppressed [ 632.611838][T23939] netlink: 'syz.3.4451': attribute type 4 has an invalid length. [ 632.622042][T23937] netlink: 'syz.4.4450': attribute type 1 has an invalid length. [ 632.652887][T23939] netlink: 'syz.3.4451': attribute type 1 has an invalid length. [ 632.663015][T23939] netlink: 15506 bytes leftover after parsing attributes in process `syz.3.4451'. [ 632.688656][T23937] bond10: entered promiscuous mode [ 632.725232][T23937] 8021q: adding VLAN 0 to HW filter on device bond10 [ 632.761244][T23940] gre0 speed is unknown, defaulting to 1000 [ 632.906337][T23948] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 633.205395][T23944] gre0 speed is unknown, defaulting to 1000 [ 633.217283][T23940] virt_wifi0 speed is unknown, defaulting to 1000 [ 633.491668][T23983] workqueue: Failed to create a rescuer kthread for wq "nfc4_nci_tx_wq": -EINTR [ 633.648042][T24000] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 633.679127][T23944] virt_wifi0 speed is unknown, defaulting to 1000 [ 633.730224][T23991] rdma_rxe: rxe_newlink: failed to add gre0 [ 633.812854][T24004] IPVS: set_ctl: invalid protocol: 108 224.0.0.2:20004 [ 633.979287][ C1] lec0: NETDEV WATCHDOG: CPU: 1: transmit queue 0 timed out 5020 ms [ 633.987361][ C1] lec:lec_tx_timeout: lec0 [ 633.994009][ C1] lec:lec_start_xmit: lec0:No lecd attached [ 634.011147][T24010] x_tables: arp_tables: NFQUEUE target: not valid for this family [ 634.211274][T24023] lo speed is unknown, defaulting to 1000 [ 634.258904][T24023] lo speed is unknown, defaulting to 1000 [ 634.315719][T24023] lo speed is unknown, defaulting to 1000 [ 634.731222][T24050] netlink: 'syz.3.4478': attribute type 13 has an invalid length. [ 634.766235][T24050] netlink: 'syz.3.4478': attribute type 27 has an invalid length. [ 634.877679][T24057] bond3: (slave bond_slave_1): Device is not our slave [ 634.895112][T24057] bond3: option active_slave: invalid value (bond_slave_1) [ 634.954423][T24057] bond3 (unregistering): Released all slaves [ 634.990339][T24023] infiniband sqz0: set active [ 635.002013][T24023] infiniband sqz0: added lo [ 635.160640][T24023] RDS/IB: sqz0: added [ 635.175176][T24023] smc: adding ib device sqz0 with port count 1 [ 635.182374][T24023] smc: ib device sqz0 port 1 has no pnetid [ 635.206905][ T796] lo speed is unknown, defaulting to 1000 [ 635.213204][T24053] gre0 speed is unknown, defaulting to 1000 [ 635.219343][T23336] lo speed is unknown, defaulting to 1000 [ 635.309552][T24023] lo speed is unknown, defaulting to 1000 [ 635.986340][T24023] lo speed is unknown, defaulting to 1000 [ 636.219465][T24109] bridge0: entered promiscuous mode [ 636.249393][T24109] vlan0: entered promiscuous mode [ 636.351073][T24120] netlink: 'syz.3.4495': attribute type 4 has an invalid length. [ 636.377160][T24112] netlink: 'syz.3.4495': attribute type 4 has an invalid length. [ 636.403516][T24112] __nla_validate_parse: 11 callbacks suppressed [ 636.403542][T24112] netlink: 76 bytes leftover after parsing attributes in process `syz.3.4495'. [ 636.439828][T24112] netlink: 52 bytes leftover after parsing attributes in process `syz.3.4495'. [ 636.626518][T24023] lo speed is unknown, defaulting to 1000 [ 636.961296][T24137] netlink: 27 bytes leftover after parsing attributes in process `syz.3.4500'. [ 637.304889][T24023] lo speed is unknown, defaulting to 1000 [ 637.398323][T24154] netlink: 8 bytes leftover after parsing attributes in process `syz.3.4504'. [ 637.614888][T24157] netlink: 4 bytes leftover after parsing attributes in process `syz.1.4507'. [ 637.664994][T24159] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 637.710711][T24023] lo speed is unknown, defaulting to 1000 [ 637.851464][T24023] lo speed is unknown, defaulting to 1000 [ 637.994183][T24023] lo speed is unknown, defaulting to 1000 [ 638.145884][T24023] lo speed is unknown, defaulting to 1000 [ 638.293633][T24053] virt_wifi0 speed is unknown, defaulting to 1000 [ 638.301445][T24053] lo speed is unknown, defaulting to 1000 [ 638.429780][T24153] rdma_rxe: rxe_newlink: failed to add gre0 [ 638.627950][T24165] xt_bpf: check failed: parse error [ 638.673478][T24165] tipc: Failed to remove unknown binding: 66,1,1/0:1358974245/1358974247 [ 638.682587][T24165] tipc: Failed to remove unknown binding: 66,1,1/0:1358974245/1358974247 [ 638.803365][T24168] netlink: 156 bytes leftover after parsing attributes in process `syz.3.4511'. [ 638.870063][T24176] netlink: 156 bytes leftover after parsing attributes in process `syz.3.4511'. [ 638.961203][T24178] netlink: 412 bytes leftover after parsing attributes in process `syz.4.4513'. [ 639.009512][ C1] lec0: NETDEV WATCHDOG: CPU: 1: transmit queue 0 timed out 5010 ms [ 639.017596][ C1] lec:lec_tx_timeout: lec0 [ 639.022834][ C1] lec:lec_start_xmit: lec0:No lecd attached [ 639.279611][T24170] gre0 speed is unknown, defaulting to 1000 [ 639.718507][T24202] netlink: 40 bytes leftover after parsing attributes in process `syz.4.4518'. [ 639.940918][T24170] virt_wifi0 speed is unknown, defaulting to 1000 [ 639.982313][T24170] lo speed is unknown, defaulting to 1000 [ 640.222619][T24211] netlink: 'syz.2.4522': attribute type 1 has an invalid length. [ 640.408193][T24216] bond8: entered promiscuous mode [ 640.467135][T24216] bond8: entered allmulticast mode [ 640.475009][T24216] 8021q: adding VLAN 0 to HW filter on device bond8 [ 640.579739][T24219] veth5: entered promiscuous mode [ 640.585055][T24219] veth5: entered allmulticast mode [ 640.610609][T24219] bond8: (slave veth5): Enslaving as a backup interface with a down link [ 640.634758][T24211] veth1_to_bond: entered allmulticast mode [ 640.988138][T24210] veth1_to_bond: left allmulticast mode [ 641.162006][T24244] netlink: 8 bytes leftover after parsing attributes in process `syz.2.4530'. [ 641.878524][T24265] pim6reg1: entered promiscuous mode [ 641.897455][T24265] pim6reg1: entered allmulticast mode [ 642.016312][T24269] IPVS: Error connecting to the multicast addr [ 642.069897][T24273] __nla_validate_parse: 1 callbacks suppressed [ 642.069922][T24273] netlink: 260 bytes leftover after parsing attributes in process `syz.0.4537'. [ 642.408742][T24292] netlink: 'syz.4.4543': attribute type 3 has an invalid length. [ 642.418390][T24292] netlink: 'syz.4.4543': attribute type 3 has an invalid length. [ 642.426959][T24292] netlink: 'syz.4.4543': attribute type 3 has an invalid length. [ 642.460398][T24292] netlink: 'syz.4.4543': attribute type 3 has an invalid length. [ 642.475024][T24292] netlink: 'syz.4.4543': attribute type 3 has an invalid length. [ 642.495932][T24292] netlink: 'syz.4.4543': attribute type 3 has an invalid length. [ 642.517308][T24296] xt_hashlimit: max too large, truncated to 1048576 [ 642.520561][T24292] netlink: 'syz.4.4543': attribute type 3 has an invalid length. [ 642.534923][T24296] xt_hashlimit: Unknown mode mask 300, kernel too old? [ 642.540657][T24292] netlink: 'syz.4.4543': attribute type 3 has an invalid length. [ 642.569494][T24292] netlink: 'syz.4.4543': attribute type 3 has an invalid length. [ 642.684350][T24309] netlink: 8 bytes leftover after parsing attributes in process `syz.1.4547'. [ 642.817341][T24315] bridge_slave_0: left allmulticast mode [ 642.846765][T24315] bridge_slave_0: left promiscuous mode [ 642.879813][T24315] bridge0: port 1(bridge_slave_0) entered disabled state [ 642.903874][T24315] bridge_slave_1: left allmulticast mode [ 642.919708][T24315] bridge_slave_1: left promiscuous mode [ 642.925882][T24315] bridge0: port 2(bridge_slave_1) entered disabled state [ 642.957120][T24315] .`: (slave bond_slave_0): Releasing backup interface [ 642.973889][T24315] .`: (slave bond_slave_1): Releasing backup interface [ 642.986544][T24315] team0: Port device team_slave_1 removed [ 642.994787][T24315] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 643.005629][T24315] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 643.013854][T24315] A link change request failed with some changes committed already. Interface hsr_slave_0 may have been left with an inconsistent configuration, please check. [ 643.035583][T24325] netlink: 48 bytes leftover after parsing attributes in process `syz.4.4552'. [ 643.040444][T24311] gre0 speed is unknown, defaulting to 1000 [ 643.059656][T24318] team0: Mode changed to "activebackup" [ 643.812711][T24340] gre0 speed is unknown, defaulting to 1000 [ 643.816364][T24311] virt_wifi0 speed is unknown, defaulting to 1000 [ 643.831665][T24311] lo speed is unknown, defaulting to 1000 [ 643.859552][T24346] netlink: 4 bytes leftover after parsing attributes in process `syz.0.4556'. [ 644.029190][ C1] lec0: NETDEV WATCHDOG: CPU: 1: transmit queue 0 timed out 5010 ms [ 644.037248][ C1] lec:lec_tx_timeout: lec0 [ 644.042008][ C1] lec:lec_start_xmit: lec0:No lecd attached [ 644.261087][T24351] bridge3: trying to set multicast query interval above maximum, setting to 8640000 (86400000ms) [ 644.351966][T24351] dvmrp0: entered allmulticast mode [ 644.530312][T24340] virt_wifi0 speed is unknown, defaulting to 1000 [ 644.551095][T24340] lo speed is unknown, defaulting to 1000 [ 644.789494][T24357] netlink: 8 bytes leftover after parsing attributes in process `syz.2.4559'. [ 644.935028][T24359] batman_adv: Cannot find parent device. Skipping batadv-on-batadv check for ip6gretap1 [ 644.979994][ T796] ip6_tunnel: ip6gretap1 xmit: Local address not yet configured! [ 645.059502][ T5891] ip6_tunnel: ip6gretap1 xmit: Local address not yet configured! [ 645.266075][T24369] netlink: 16 bytes leftover after parsing attributes in process `syz.1.4564'. [ 645.324481][T24370] netlink: 16 bytes leftover after parsing attributes in process `syz.1.4564'. [ 645.929623][ T6579] ip6_tunnel: ip6gretap1 xmit: Local address not yet configured! [ 646.037946][T24394] validate_nla: 39 callbacks suppressed [ 646.037969][T24394] netlink: 'syz.2.4570': attribute type 6 has an invalid length. [ 646.345472][T24401] x_tables: duplicate underflow at hook 2 [ 646.425757][T24399] xt_CT: No such helper "syz1" [ 646.495555][T24406] netlink: 'syz.1.4573': attribute type 1 has an invalid length. [ 646.686743][T24419] xt_TCPMSS: Only works on TCP SYN packets [ 646.738436][T24411] 8021q: adding VLAN 0 to HW filter on device bond7 [ 646.793689][T24425] IPv6: addrconf: prefix option has invalid lifetime [ 646.907698][T24430] xt_hashlimit: max too large, truncated to 1048576 [ 646.920920][T24430] xt_hashlimit: overflow, try lower: 2/0 [ 646.941905][ T6579] ip6_tunnel: ip6gretap1 xmit: Local address not yet configured! [ 646.959521][ T6579] ip6_tunnel: ip6gretap1 xmit: Local address not yet configured! [ 646.998132][T24433] netlink: 'syz.0.4581': attribute type 32 has an invalid length. [ 647.122548][T24443] netlink: 16 bytes leftover after parsing attributes in process `syz.0.4584'. [ 647.165538][ T796] ip6_tunnel: ip6gretap1 xmit: Local address not yet configured! [ 647.170364][T24443] bond0: entered promiscuous mode [ 647.178964][T24443] 8021q: adding VLAN 0 to HW filter on device bond0 [ 647.484156][T24462] bond6: option lp_interval: invalid value (0) [ 647.491989][T24462] bond6: option lp_interval: allowed values 1 - 2147483647 [ 647.503471][T24462] bond6 (unregistering): Released all slaves [ 647.618067][T24466] gre0 speed is unknown, defaulting to 1000 [ 647.799065][T24476] netlink: 'syz.0.4592': attribute type 21 has an invalid length. [ 647.807465][T24476] IPv6: NLM_F_CREATE should be specified when creating new route [ 647.955453][T24488] netlink: 1047 bytes leftover after parsing attributes in process `syz.2.4596'. [ 647.965281][T24488] bridge_slave_1: default FDB implementation only supports local addresses [ 648.194422][T24494] netlink: 'syz.3.4597': attribute type 1 has an invalid length. [ 648.204930][T24494] netlink: 'syz.3.4597': attribute type 3 has an invalid length. [ 648.221676][T24494] netlink: 'syz.3.4597': attribute type 1 has an invalid length. [ 648.266894][T24494] netlink: 140 bytes leftover after parsing attributes in process `syz.3.4597'. [ 648.276151][T24466] virt_wifi0 speed is unknown, defaulting to 1000 [ 648.280746][T24503] netlink: 12 bytes leftover after parsing attributes in process `syz.3.4597'. [ 648.295147][T24466] lo speed is unknown, defaulting to 1000 [ 648.638591][T24516] netlink: 104 bytes leftover after parsing attributes in process `syz.1.4602'. [ 648.779106][T24520] pim6reg: entered allmulticast mode [ 648.784862][ T25] block nbd2: Possible stuck request ffff888026b50000: control (read@0,1024B). Runtime 90 seconds [ 648.799812][ T25] block nbd2: Possible stuck request ffff888026b50200: control (read@1024,1024B). Runtime 90 seconds [ 648.819632][ T25] block nbd2: Possible stuck request ffff888026b50400: control (read@2048,1024B). Runtime 90 seconds [ 648.830685][ T25] block nbd2: Possible stuck request ffff888026b50600: control (read@3072,1024B). Runtime 90 seconds [ 649.049199][ C1] lec0: NETDEV WATCHDOG: CPU: 1: transmit queue 0 timed out 5010 ms [ 649.057308][ C1] lec:lec_tx_timeout: lec0 [ 649.062568][ C1] lec:lec_start_xmit: lec0:No lecd attached [ 649.139616][T24533] netlink: 'syz.3.4607': attribute type 9 has an invalid length. [ 649.178094][T24533] netlink: 8 bytes leftover after parsing attributes in process `syz.3.4607'. [ 649.223148][T24537] netlink: 8 bytes leftover after parsing attributes in process `syz.1.4608'. [ 649.232889][T24537] netlink: 24 bytes leftover after parsing attributes in process `syz.1.4608'. [ 649.277040][T24533] macvlan0: entered promiscuous mode [ 649.321655][T24533] macvlan0: entered allmulticast mode [ 649.327113][T24533] erspan0: entered allmulticast mode [ 649.420428][ T5220] block nbd3: Possible stuck request ffff888026bc2600: control (read@0,1024B). Runtime 90 seconds [ 649.432906][ T5220] block nbd3: Possible stuck request ffff888026bc2800: control (read@1024,1024B). Runtime 90 seconds [ 649.434228][T24544] netlink: 28 bytes leftover after parsing attributes in process `syz.2.4609'. [ 649.443900][ T5220] block nbd3: Possible stuck request ffff888026bc2a00: control (read@2048,1024B). Runtime 90 seconds [ 649.443938][ T5220] block nbd3: Possible stuck request ffff888026bc2c00: control (read@3072,1024B). Runtime 90 seconds [ 649.654281][T24545] netlink: 28 bytes leftover after parsing attributes in process `syz.2.4609'. [ 649.992130][T24564] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 650.271765][T24573] netlink: 'syz.1.4616': attribute type 1 has an invalid length. [ 650.381120][T24573] bond3: (slave vxcan3): The slave device specified does not support setting the MAC address [ 650.392673][T24573] bond3: (slave vxcan3): Error -95 calling set_mac_address [ 650.717817][T24592] wg1 speed is unknown, defaulting to 1000 [ 650.741431][T24592] wg1 speed is unknown, defaulting to 1000 [ 650.748730][T24592] wg1 speed is unknown, defaulting to 1000 [ 650.774988][T24595] Bluetooth: MGMT ver 1.23 [ 650.887456][T24605] netlink: 'syz.1.4625': attribute type 1 has an invalid length. [ 650.891064][T24596] gre0 speed is unknown, defaulting to 1000 [ 650.949463][ C0] ip6_tunnel: ip6gretap1 xmit: Local address not yet configured! [ 651.041722][T24605] bond4: entered promiscuous mode [ 651.083080][T24605] 8021q: adding VLAN 0 to HW filter on device bond4 [ 651.112282][T24606] bond4: (slave ipvlan2): enslaved VLAN challenged slave. Adding VLANs will be blocked as long as it is part of bond. [ 651.125151][T24606] bond4: (slave ipvlan2): The slave device specified does not support setting the MAC address [ 651.135931][T24606] bond4: (slave ipvlan2): Setting fail_over_mac to active for active-backup mode [ 651.371562][T24596] virt_wifi0 speed is unknown, defaulting to 1000 [ 651.380710][T24596] lo speed is unknown, defaulting to 1000 [ 651.675606][T24623] netlink: 'syz.0.4629': attribute type 21 has an invalid length. [ 651.683906][T24623] IPv6: NLM_F_CREATE should be specified when creating new route [ 651.693718][T24623] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 651.701228][T24623] IPv6: NLM_F_CREATE should be set when creating new route [ 651.708946][T24623] IPv6: NLM_F_CREATE should be set when creating new route [ 651.716341][T24623] IPv6: NLM_F_CREATE should be set when creating new route [ 651.760361][T24592] infiniband syz0: set down [ 651.764953][T24592] infiniband syz0: added wg1 [ 651.785043][T24592] workqueue: Failed to create a rescuer kthread for wq "ib_mad1": -EINTR [ 651.787419][T24592] infiniband syz0: Couldn't open port 1 [ 651.802021][ T980] wg1 speed is unknown, defaulting to 1000 [ 651.876254][T24592] RDS/IB: syz0: added [ 651.881838][T24592] smc: adding ib device syz0 with port count 1 [ 651.888360][T24592] smc: ib device syz0 port 1 has no pnetid [ 651.906678][T24631] sctp: [Deprecated]: syz.0.4632 (pid 24631) Use of int in max_burst socket option. [ 651.906678][T24631] Use struct sctp_assoc_value instead [ 651.968566][ T980] wg1 speed is unknown, defaulting to 1000 [ 651.980784][T24592] wg1 speed is unknown, defaulting to 1000 [ 652.131268][T24641] gre2: entered promiscuous mode [ 652.223563][T24645] batadv_slave_1: entered promiscuous mode [ 652.468321][T24592] wg1 speed is unknown, defaulting to 1000 [ 652.780598][T24642] batadv_slave_1: left promiscuous mode [ 652.833807][T24653] __nla_validate_parse: 3 callbacks suppressed [ 652.833828][T24653] netlink: 8 bytes leftover after parsing attributes in process `syz.4.4639'. [ 653.041142][T24665] netlink: 12 bytes leftover after parsing attributes in process `syz.0.4642'. [ 653.243007][T24592] wg1 speed is unknown, defaulting to 1000 [ 653.289021][T24665] 8021q: adding VLAN 0 to HW filter on device bond6 [ 653.312032][T24679] netlink: 'syz.1.4646': attribute type 25 has an invalid length. [ 653.321664][T24679] netlink: 'syz.1.4646': attribute type 29 has an invalid length. [ 653.711672][T24592] wg1 speed is unknown, defaulting to 1000 [ 654.038117][T24592] wg1 speed is unknown, defaulting to 1000 [ 654.069179][ C1] lec0: NETDEV WATCHDOG: CPU: 1: transmit queue 0 timed out 5010 ms [ 654.077356][ C1] lec:lec_tx_timeout: lec0 [ 654.082030][ C1] lec:lec_start_xmit: lec0:No lecd attached [ 654.320458][T24701] netlink: 12 bytes leftover after parsing attributes in process `syz.1.4652'. [ 654.338592][T24592] wg1 speed is unknown, defaulting to 1000 [ 654.394013][T24701] bond5: entered promiscuous mode [ 654.399815][T24701] 8021q: adding VLAN 0 to HW filter on device bond5 [ 654.405979][T24704] netlink: 'syz.4.4654': attribute type 1 has an invalid length. [ 654.418768][T24697] 8021q: adding VLAN 0 to HW filter on device bond5 [ 654.421356][T24704] netlink: 96 bytes leftover after parsing attributes in process `syz.4.4654'. [ 654.439535][T24704] netlink: 658 bytes leftover after parsing attributes in process `syz.4.4654'. [ 654.439933][T24697] bond5: (slave ip6gre2): The slave device specified does not support setting the MAC address [ 654.448803][T24704] netlink: 1 bytes leftover after parsing attributes in process `syz.4.4654'. [ 654.472318][T24697] bond5: (slave ip6gre2): Error -95 calling set_mac_address [ 654.690303][T24715] tipc: Started in network mode [ 654.695325][T24715] tipc: Node identity 46a1bc1b4e8, cluster identity 4711 [ 654.709729][T24715] tipc: Enabled bearer , priority 0 [ 654.717756][T24715] syzkaller0: entered promiscuous mode [ 654.723914][T24715] syzkaller0: entered allmulticast mode [ 654.749686][T24592] wg1 speed is unknown, defaulting to 1000 [ 654.753345][T24715] tipc: Resetting bearer [ 654.769719][T24714] tipc: Resetting bearer [ 654.796835][T24714] tipc: Disabling bearer [ 654.808737][T24717] tipc: Started in network mode [ 654.814792][T24717] tipc: Node identity 0000000000002e000000000000000001, cluster identity 4711 [ 654.824649][T24717] tipc: Enabling of bearer rejected, failed to enable media [ 654.948136][T24721] netlink: 12 bytes leftover after parsing attributes in process `syz.4.4659'. [ 655.124825][T24592] wg1 speed is unknown, defaulting to 1000 [ 655.187023][T24724] netlink: 244 bytes leftover after parsing attributes in process `syz.4.4660'. [ 655.460990][T24686] gre0 speed is unknown, defaulting to 1000 [ 655.846867][T24741] netlink: 68 bytes leftover after parsing attributes in process `syz.1.4665'. [ 656.129975][T24745] netlink: 'syz.1.4667': attribute type 11 has an invalid length. [ 656.542690][T24686] virt_wifi0 speed is unknown, defaulting to 1000 [ 656.566065][T24686] lo speed is unknown, defaulting to 1000 [ 656.615617][T24759] netlink: 8 bytes leftover after parsing attributes in process `syz.4.4673'. [ 656.722865][T24757] delete_channel: no stack [ 657.061070][T24686] wg1 speed is unknown, defaulting to 1000 [ 657.175120][T24783] tipc: Enabled bearer , priority 0 [ 657.220645][T24783] syzkaller0: entered promiscuous mode [ 657.230268][T24783] syzkaller0: entered allmulticast mode [ 657.312181][T24783] tipc: Resetting bearer [ 657.468593][T24782] tipc: Resetting bearer [ 657.502084][T24782] tipc: Disabling bearer [ 657.515455][T24799] netlink: 'syz.2.4684': attribute type 1 has an invalid length. [ 657.563917][T24797] bond6: entered allmulticast mode [ 657.716957][T24810] x_tables: duplicate underflow at hook 3 [ 657.933888][T24819] __nla_validate_parse: 6 callbacks suppressed [ 657.933909][T24819] netlink: 24 bytes leftover after parsing attributes in process `syz.3.4691'. [ 657.952104][T24819] sctp: [Deprecated]: syz.3.4691 (pid 24819) Use of struct sctp_assoc_value in delayed_ack socket option. [ 657.952104][T24819] Use struct sctp_sack_info instead [ 658.049320][T24821] syz1: rxe_newlink: already configured on gre0 [ 659.019372][ C0] ip6_tunnel: ip6gretap1 xmit: Local address not yet configured! [ 659.089215][ C1] lec0: NETDEV WATCHDOG: CPU: 1: transmit queue 0 timed out 5010 ms [ 659.097282][ C1] lec:lec_tx_timeout: lec0 [ 659.102105][ C1] lec:lec_start_xmit: lec0:No lecd attached [ 659.161459][T24848] x_tables: arp_tables: NFQUEUE target: not valid for this family [ 659.201973][T24851] netlink: 60 bytes leftover after parsing attributes in process `syz.4.4700'. [ 659.534310][T24858] mac80211_hwsim hwsim129 ªªªªª;: renamed from wlan0 [ 659.907616][T24878] netlink: 56 bytes leftover after parsing attributes in process `syz.3.4709'. [ 660.029732][T24877] tipc: Enabling of bearer rejected, failed to enable media [ 660.315693][T24903] netlink: 'syz.4.4721': attribute type 1 has an invalid length. [ 660.432486][T24908] mac80211_hwsim hwsim141 syzkaller0: left promiscuous mode [ 660.440988][T24908] mac80211_hwsim hwsim141 syzkaller0: left allmulticast mode [ 660.450918][T24908] bond2: left allmulticast mode [ 660.470067][T24908] ip6tnl4: left allmulticast mode [ 660.488092][T24916] netlink: 212336 bytes leftover after parsing attributes in process `syz.4.4721'. [ 660.500452][T24916] netlink: 28 bytes leftover after parsing attributes in process `syz.4.4721'. [ 660.515163][T24908] bond4: left promiscuous mode [ 660.529803][T24908] bond6: left allmulticast mode [ 660.609916][T24909] bond11: (slave veth5): Enslaving as an active interface with a down link [ 660.621503][T24921] netlink: 20 bytes leftover after parsing attributes in process `syz.3.4724'. [ 660.712804][T24911] netlink: 'syz.2.4723': attribute type 1 has an invalid length. [ 660.725639][T24929] x_tables: arp_tables: CLASSIFY target: used from hooks INPUT, but only usable from FORWARD/OUTPUT [ 660.773872][T24903] bond11: (slave veth7): Enslaving as an active interface with a down link [ 660.802173][T24916] 8021q: adding VLAN 0 to HW filter on device bond11 [ 660.976030][T24911] bond9: entered promiscuous mode [ 660.982012][T24911] 8021q: adding VLAN 0 to HW filter on device bond9 [ 661.062487][T24934] 8021q: adding VLAN 0 to HW filter on device bond9 [ 661.103415][T24934] bond9: (slave gre3): The slave device specified does not support setting the MAC address [ 661.130501][T24934] bond9: (slave gre3): Setting fail_over_mac to active for active-backup mode [ 661.156864][T24934] bond9: (slave gre3): making interface the new active one [ 661.166509][T24934] gre3: entered promiscuous mode [ 661.174199][T24934] bond9: (slave gre3): Enslaving as an active interface with an up link [ 661.382961][T24952] syzkaller1: entered promiscuous mode [ 661.388599][T24952] syzkaller1: entered allmulticast mode [ 661.763676][T24968] xt_ecn: cannot match TCP bits for non-tcp packets [ 661.776310][T24968] netlink: 'syz.2.4734': attribute type 1 has an invalid length. [ 661.921352][T24974] erspan1: entered allmulticast mode [ 662.100889][T24968] bond10: entered promiscuous mode [ 662.106211][T24968] bond10: entered allmulticast mode [ 662.116931][T24968] 8021q: adding VLAN 0 to HW filter on device bond10 [ 662.126998][T24976] gre0 speed is unknown, defaulting to 1000 [ 662.695956][T24990] netlink: 576 bytes leftover after parsing attributes in process `syz.4.4740'. [ 662.711240][T24976] virt_wifi0 speed is unknown, defaulting to 1000 [ 662.725216][T24976] lo speed is unknown, defaulting to 1000 [ 662.873474][T24999] netlink: 8 bytes leftover after parsing attributes in process `syz.0.4744'. [ 662.915727][T25002] netlink: 8 bytes leftover after parsing attributes in process `syz.4.4743'. [ 662.958048][T24999] bridge2: trying to set multicast startup query interval below minimum, setting to 100 (1000ms) [ 663.333609][T24976] wg1 speed is unknown, defaulting to 1000 [ 663.489630][T25029] netlink: 44 bytes leftover after parsing attributes in process `syz.0.4751'. [ 663.498889][T25029] netlink: 8 bytes leftover after parsing attributes in process `syz.0.4751'. [ 663.595866][T25032] netlink: 'syz.2.4753': attribute type 2 has an invalid length. [ 663.604186][T25032] netlink: 'syz.2.4753': attribute type 2 has an invalid length. [ 663.612910][T25032] netlink: 'syz.2.4753': attribute type 2 has an invalid length. [ 664.109233][ C1] lec0: NETDEV WATCHDOG: CPU: 1: transmit queue 0 timed out 5010 ms [ 664.117362][ C1] lec:lec_tx_timeout: lec0 [ 664.123612][ C1] lec:lec_start_xmit: lec0:No lecd attached [ 664.406107][T25065] netlink: 'syz.3.4761': attribute type 89 has an invalid length. [ 665.098697][T25075] netlink: 'syz.4.4763': attribute type 1 has an invalid length. [ 665.402860][T25086] openvswitch: netlink: Flow actions attr not present in new flow. [ 666.024361][T25116] netlink: 'syz.1.4778': attribute type 2 has an invalid length. [ 666.043037][T25115] netlink: 'syz.3.4780': attribute type 2 has an invalid length. [ 666.069549][T25116] netlink: 36 bytes leftover after parsing attributes in process `syz.1.4778'. [ 666.154868][T25115] bond8: entered allmulticast mode [ 666.168488][T25122] gre0 speed is unknown, defaulting to 1000 [ 666.245891][T25129] netlink: 12 bytes leftover after parsing attributes in process `syz.0.4783'. [ 666.543598][T25143] netlink: 32 bytes leftover after parsing attributes in process `syz.3.4787'. [ 666.561371][T25143] netlink: 7 bytes leftover after parsing attributes in process `syz.3.4787'. [ 666.584404][T25143] netlink: 20 bytes leftover after parsing attributes in process `syz.3.4787'. [ 666.693562][T25122] virt_wifi0 speed is unknown, defaulting to 1000 [ 666.735319][T25122] lo speed is unknown, defaulting to 1000 [ 666.749715][T25149] IPVS: Schedule: port zero only supported in persistent services, check your ipvs configuration [ 666.774719][T25149] netlink: 'syz.0.4789': attribute type 32 has an invalid length. [ 666.785582][T25149] netlink: 8 bytes leftover after parsing attributes in process `syz.0.4789'. [ 666.879088][T25149] bond8: option coupled_control: invalid value (12) [ 666.900995][T25162] netlink: 24 bytes leftover after parsing attributes in process `syz.1.4793'. [ 666.915755][T25149] bond8 (unregistering): Released all slaves [ 667.046226][T25162] tipc: Enabled bearer , priority 21 [ 667.168499][T25173] netlink: 8 bytes leftover after parsing attributes in process `syz.1.4797'. [ 667.199809][T25122] wg1 speed is unknown, defaulting to 1000 [ 667.671783][T25196] netlink: 'syz.1.4803': attribute type 1 has an invalid length. [ 667.689289][T25196] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 667.736736][T25199] netlink: 'syz.3.4804': attribute type 4 has an invalid length. [ 668.021462][T25210] wg1: entered allmulticast mode [ 668.159368][ T980] tipc: Node number set to 11777 [ 668.553497][T25237] __nla_validate_parse: 2 callbacks suppressed [ 668.553522][T25237] netlink: 8 bytes leftover after parsing attributes in process `syz.2.4818'. [ 669.035121][T25252] syzkaller0: entered promiscuous mode [ 669.069840][T25252] syzkaller0: entered allmulticast mode [ 669.127150][T25256] syz1: rxe_newlink: already configured on gre0 [ 669.139180][ C1] lec0: NETDEV WATCHDOG: CPU: 1: transmit queue 0 timed out 5010 ms [ 669.147241][ C1] lec:lec_tx_timeout: lec0 [ 669.151898][ C1] lec:lec_start_xmit: lec0:No lecd attached [ 669.246493][T25255] netlink: 8 bytes leftover after parsing attributes in process `syz.2.4823'. [ 669.317334][T25258] netlink: 212348 bytes leftover after parsing attributes in process `syz.1.4824'. [ 669.505014][T25264] netlink: 48 bytes leftover after parsing attributes in process `syz.1.4827'. [ 669.526322][T25266] netlink: 20 bytes leftover after parsing attributes in process `syz.2.4828'. [ 669.684018][T25274] netlink: 12 bytes leftover after parsing attributes in process `syz.0.4830'. [ 669.714645][T25274] "syz.0.4830" (25274) uses obsolete ecb(arc4) skcipher [ 669.923108][T25287] netlink: 28 bytes leftover after parsing attributes in process `syz.1.4832'. [ 669.949670][T25287] netlink: 32 bytes leftover after parsing attributes in process `syz.1.4832'. [ 669.979394][T25287] netlink: 28 bytes leftover after parsing attributes in process `syz.1.4832'. [ 669.997938][T25287] netlink: 32 bytes leftover after parsing attributes in process `syz.1.4832'. [ 670.033861][T25290] IPVS: Schedule: port zero only supported in persistent services, check your ipvs configuration [ 670.332646][T25291] gretap2: entered promiscuous mode [ 670.339427][T25291] batman_adv: batadv0: Adding interface: gretap2 [ 670.346009][T25291] batman_adv: batadv0: The MTU of interface gretap2 is too small (1462) to handle the transport of batman-adv packets. If you experience problems getting traffic through try increasing the MTU to 1532. [ 670.366690][T25291] batman_adv: batadv0: Not using interface gretap2 (retrying later): interface not active [ 670.707370][T25316] dvmrp0: entered allmulticast mode [ 670.833659][T15154] netdevsim netdevsim0 eth0: set [0, 0] type 1 family 0 port 8472 - 0 [ 670.845294][T15154] netdevsim netdevsim0 eth1: set [0, 0] type 1 family 0 port 8472 - 0 [ 670.860361][T15154] netdevsim netdevsim0 eth2: set [0, 0] type 1 family 0 port 8472 - 0 [ 670.884837][T15154] netdevsim netdevsim0 eth3: set [0, 0] type 1 family 0 port 8472 - 0 [ 671.185458][T25339] gre0 speed is unknown, defaulting to 1000 [ 671.567792][T25348] bond8: entered allmulticast mode [ 671.573962][T25339] virt_wifi0 speed is unknown, defaulting to 1000 [ 671.582947][T25339] lo speed is unknown, defaulting to 1000 [ 672.085788][T25339] wg1 speed is unknown, defaulting to 1000 [ 672.236795][T25367] SET target dimension over the limit! [ 672.273959][T25380] openvswitch: netlink: ufid size 20 bytes exceeds the range (1, 16) [ 672.292853][T25380] openvswitch: netlink: Either Ethernet header or EtherType is required. [ 672.336034][T25380] ================================================================== [ 672.344165][T25380] BUG: KASAN: slab-out-of-bounds in af_alg_pull_tsgl+0x1c6/0x740 [ 672.352032][T25380] Read of size 8 at addr ffff888029a6b7e0 by task syz.4.4862/25380 [ 672.359992][T25380] [ 672.362355][T25380] CPU: 1 UID: 0 PID: 25380 Comm: syz.4.4862 Not tainted syzkaller #0 PREEMPT(full) [ 672.362386][T25380] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026 [ 672.362400][T25380] Call Trace: [ 672.362409][T25380] [ 672.362419][T25380] dump_stack_lvl+0xe8/0x150 [ 672.362455][T25380] print_report+0xba/0x230 [ 672.362482][T25380] ? af_alg_pull_tsgl+0x1c6/0x740 [ 672.362515][T25380] kasan_report+0x117/0x150 [ 672.362543][T25380] ? af_alg_pull_tsgl+0x1c6/0x740 [ 672.362578][T25380] af_alg_pull_tsgl+0x1c6/0x740 [ 672.362618][T25380] skcipher_recvmsg+0x5df/0x1140 [ 672.362651][T25380] ? __pfx_skcipher_recvmsg+0x10/0x10 [ 672.362680][T25380] ? __pfx_skcipher_recvmsg+0x10/0x10 [ 672.362705][T25380] sock_recvmsg_nosec+0x10c/0x140 [ 672.362733][T25380] ____sys_recvmsg+0x3e3/0x4a0 [ 672.362757][T25380] ? __pfx_____sys_recvmsg+0x10/0x10 [ 672.362785][T25380] ? import_iovec+0x73/0xa0 [ 672.362812][T25380] ___sys_recvmsg+0x215/0x590 [ 672.362831][T25380] ? __lock_acquire+0x6b5/0x2cf0 [ 672.362861][T25380] ? __pfx____sys_recvmsg+0x10/0x10 [ 672.362901][T25380] do_recvmmsg+0x334/0x800 [ 672.362924][T25380] ? __sys_sendmmsg+0x4ae/0x4e0 [ 672.362943][T25380] ? __pfx_do_recvmmsg+0x10/0x10 [ 672.362969][T25380] ? __pfx_do_futex+0x10/0x10 [ 672.363012][T25380] __x64_sys_recvmmsg+0x198/0x250 [ 672.363035][T25380] ? __pfx___x64_sys_recvmmsg+0x10/0x10 [ 672.363063][T25380] do_syscall_64+0x14d/0xf80 [ 672.363088][T25380] ? trace_irq_disable+0x3b/0x150 [ 672.363107][T25380] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 672.363128][T25380] ? clear_bhb_loop+0x40/0x90 [ 672.363152][T25380] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 672.363174][T25380] RIP: 0033:0x7fe23959c819 [ 672.363194][T25380] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 672.363214][T25380] RSP: 002b:00007fe2377f6028 EFLAGS: 00000246 ORIG_RAX: 000000000000012b [ 672.363239][T25380] RAX: ffffffffffffffda RBX: 00007fe239815fa0 RCX: 00007fe23959c819 [ 672.363256][T25380] RDX: 0000000000000002 RSI: 0000200000003540 RDI: 0000000000000009 [ 672.363270][T25380] RBP: 00007fe239632c91 R08: 0000000000000000 R09: 0000000000000000 [ 672.363285][T25380] R10: 0000000000002001 R11: 0000000000000246 R12: 0000000000000000 [ 672.363299][T25380] R13: 00007fe239816038 R14: 00007fe239815fa0 R15: 00007fff0cf439f8 [ 672.363324][T25380] [ 672.363332][T25380] [ 672.369827][T25384] ipvlan3: entered promiscuous mode [ 672.372714][T25380] Allocated by task 25380: [ 672.372731][T25380] kasan_save_track+0x3e/0x80 [ 672.405543][T25384] bridge0: port 1(ipvlan3) entered blocking state [ 672.407745][T25380] __kasan_kmalloc+0x93/0xb0 [ 672.429332][T25384] bridge0: port 1(ipvlan3) entered disabled state [ 672.433480][T25380] __kmalloc_noprof+0x35c/0x760 [ 672.638572][T25380] sock_kmalloc+0xd6/0x160 [ 672.643004][T25380] skcipher_recvmsg+0x54d/0x1140 [ 672.647980][T25380] sock_recvmsg_nosec+0x10c/0x140 [ 672.653027][T25380] ____sys_recvmsg+0x3e3/0x4a0 [ 672.657813][T25380] ___sys_recvmsg+0x215/0x590 [ 672.662491][T25380] do_recvmmsg+0x334/0x800 [ 672.666910][T25380] __x64_sys_recvmmsg+0x198/0x250 [ 672.672036][T25380] do_syscall_64+0x14d/0xf80 [ 672.676634][T25380] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 672.682722][T25380] [ 672.685059][T25380] The buggy address belongs to the object at ffff888029a6b7c0 [ 672.685059][T25380] which belongs to the cache kmalloc-32 of size 32 [ 672.698944][T25380] The buggy address is located 0 bytes to the right of [ 672.698944][T25380] allocated 32-byte region [ffff888029a6b7c0, ffff888029a6b7e0) [ 672.713442][T25380] [ 672.715770][T25380] The buggy address belongs to the physical page: [ 672.722184][T25380] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0xffff888029a6b080 pfn:0x29a6b [ 672.732451][T25380] flags: 0xfff00000000200(workingset|node=0|zone=1|lastcpupid=0x7ff) [ 672.740557][T25380] page_type: f5(slab) [ 672.744556][T25380] raw: 00fff00000000200 ffff88813feac780 ffffea0000c33490 ffffea0000c33790 [ 672.753146][T25380] raw: ffff888029a6b080 000000080040003e 00000000f5000000 0000000000000000 [ 672.761907][T25380] page dumped because: kasan: bad access detected [ 672.768319][T25380] page_owner tracks the page as allocated [ 672.774045][T25380] page last allocated via order 0, migratetype Unmovable, gfp_mask 0xd2800(GFP_NOWAIT|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 22550, tgid 22550 (rm), ts 601498738959, free_ts 601496052203 [ 672.793259][T25380] post_alloc_hook+0x231/0x280 [ 672.798212][T25380] get_page_from_freelist+0x24dc/0x2580 [ 672.804022][T25380] __alloc_frozen_pages_noprof+0x18d/0x380 [ 672.810068][T25380] allocate_slab+0x77/0x660 [ 672.814682][T25380] refill_objects+0x331/0x3c0 [ 672.819368][T25380] __pcs_replace_empty_main+0x2e6/0x730 [ 672.824927][T25380] __kmalloc_cache_noprof+0x392/0x660 [ 672.830303][T25380] kmem_cache_free+0x15b/0x630 [ 672.835075][T25380] tear_down_vmas+0x312/0x520 [ 672.839756][T25380] exit_mmap+0x4b6/0xa10 [ 672.844003][T25380] __mmput+0x118/0x430 [ 672.848082][T25380] exit_mm+0x168/0x220 [ 672.852150][T25380] do_exit+0x6a2/0x23c0 [ 672.856312][T25380] do_group_exit+0x21b/0x2d0 [ 672.860906][T25380] __x64_sys_exit_group+0x3f/0x40 [ 672.866019][T25380] x64_sys_call+0x221a/0x2240 [ 672.870712][T25380] page last free pid 22550 tgid 22550 stack trace: [ 672.877219][T25380] __free_frozen_pages+0xc2b/0xdb0 [ 672.882341][T25380] tlb_finish_mmu+0x144/0x230 [ 672.887026][T25380] exit_mmap+0x498/0xa10 [ 672.891540][T25380] __mmput+0x118/0x430 [ 672.895617][T25380] exit_mm+0x168/0x220 [ 672.899687][T25380] do_exit+0x6a2/0x23c0 [ 672.903874][T25380] do_group_exit+0x21b/0x2d0 [ 672.908467][T25380] __x64_sys_exit_group+0x3f/0x40 [ 672.913594][T25380] x64_sys_call+0x221a/0x2240 [ 672.918298][T25380] do_syscall_64+0x14d/0xf80 [ 672.922933][T25380] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 672.928849][T25380] [ 672.931185][T25380] Memory state around the buggy address: [ 672.936817][T25380] ffff888029a6b680: fa fb fb fb fc fc fc fc fa fb fb fb fc fc fc fc [ 672.944885][T25380] ffff888029a6b700: fa fb fb fb fc fc fc fc fa fb fb fb fc fc fc fc [ 672.952955][T25380] >ffff888029a6b780: fa fb fb fb fc fc fc fc 00 00 00 00 fc fc fc fc [ 672.961020][T25380] ^ [ 672.968396][T25380] ffff888029a6b800: fa fb fb fb fc fc fc fc fa fb fb fb fc fc fc fc [ 672.976565][T25380] ffff888029a6b880: fa fb fb fb fc fc fc fc fa fb fb fb fc fc fc fc [ 672.984661][T25380] ================================================================== [ 673.008874][T25380] Kernel panic - not syncing: KASAN: panic_on_warn set ... [ 673.016136][T25380] CPU: 0 UID: 0 PID: 25380 Comm: syz.4.4862 Not tainted syzkaller #0 PREEMPT(full) [ 673.025620][T25380] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026 [ 673.035685][T25380] Call Trace: [ 673.038986][T25380] [ 673.041951][T25380] vpanic+0x56c/0xa60 [ 673.045974][T25380] ? __pfx_vpanic+0x10/0x10 [ 673.050591][T25380] ? __pfx___schedule+0x10/0x10 [ 673.055458][T25380] panic+0xc5/0xd0 [ 673.059195][T25380] ? __pfx_panic+0x10/0x10 [ 673.063733][T25380] ? preempt_schedule_common+0x82/0xd0 [ 673.069231][T25380] ? af_alg_pull_tsgl+0x1c6/0x740 [ 673.074374][T25380] check_panic_on_warn+0x89/0xb0 [ 673.079329][T25380] ? af_alg_pull_tsgl+0x1c6/0x740 [ 673.084470][T25380] end_report+0x73/0x180 [ 673.088725][T25380] ? af_alg_pull_tsgl+0x1c6/0x740 [ 673.093766][T25380] kasan_report+0x128/0x150 [ 673.098286][T25380] ? af_alg_pull_tsgl+0x1c6/0x740 [ 673.103326][T25380] af_alg_pull_tsgl+0x1c6/0x740 [ 673.108202][T25380] skcipher_recvmsg+0x5df/0x1140 [ 673.113169][T25380] ? __pfx_skcipher_recvmsg+0x10/0x10 [ 673.118570][T25380] ? __pfx_skcipher_recvmsg+0x10/0x10 [ 673.123952][T25380] sock_recvmsg_nosec+0x10c/0x140 [ 673.128999][T25380] ____sys_recvmsg+0x3e3/0x4a0 [ 673.133787][T25380] ? __pfx_____sys_recvmsg+0x10/0x10 [ 673.139083][T25380] ? import_iovec+0x73/0xa0 [ 673.143626][T25380] ___sys_recvmsg+0x215/0x590 [ 673.148312][T25380] ? __lock_acquire+0x6b5/0x2cf0 [ 673.153264][T25380] ? __pfx____sys_recvmsg+0x10/0x10 [ 673.158487][T25380] do_recvmmsg+0x334/0x800 [ 673.162928][T25380] ? __sys_sendmmsg+0x4ae/0x4e0 [ 673.167783][T25380] ? __pfx_do_recvmmsg+0x10/0x10 [ 673.172732][T25380] ? __pfx_do_futex+0x10/0x10 [ 673.177428][T25380] __x64_sys_recvmmsg+0x198/0x250 [ 673.182647][T25380] ? __pfx___x64_sys_recvmmsg+0x10/0x10 [ 673.188231][T25380] do_syscall_64+0x14d/0xf80 [ 673.192864][T25380] ? trace_irq_disable+0x3b/0x150 [ 673.197902][T25380] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 673.203974][T25380] ? clear_bhb_loop+0x40/0x90 [ 673.208667][T25380] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 673.214569][T25380] RIP: 0033:0x7fe23959c819 [ 673.219009][T25380] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 673.238739][T25380] RSP: 002b:00007fe2377f6028 EFLAGS: 00000246 ORIG_RAX: 000000000000012b [ 673.247269][T25380] RAX: ffffffffffffffda RBX: 00007fe239815fa0 RCX: 00007fe23959c819 [ 673.255611][T25380] RDX: 0000000000000002 RSI: 0000200000003540 RDI: 0000000000000009 [ 673.263595][T25380] RBP: 00007fe239632c91 R08: 0000000000000000 R09: 0000000000000000 [ 673.271584][T25380] R10: 0000000000002001 R11: 0000000000000246 R12: 0000000000000000 [ 673.279869][T25380] R13: 00007fe239816038 R14: 00007fe239815fa0 R15: 00007fff0cf439f8 [ 673.288044][T25380] [ 673.291579][T25380] Kernel Offset: disabled [ 673.295929][T25380] Rebooting in 86400 seconds..