last executing test programs: 2.998379014s ago: executing program 4 (id=3563): r0 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000340)=ANY=[@ANYBLOB="02000000040000000800000001"], 0xe) r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)=@base={0xc, 0x4, 0x4, 0x3, 0x0, r0, 0x9}, 0x50) (async) r2 = socket(0x2, 0x80805, 0x0) r3 = socket$inet6_sctp(0xa, 0x5, 0x84) shutdown(r3, 0x0) close(0x3) (async) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r3, 0x84, 0x6f, &(0x7f0000000200)={0x0, 0x10, &(0x7f00000001c0)=[@in={0x2, 0x4e23, @rand_addr=0x64010100}]}, &(0x7f0000000140)=0x10) getsockopt$inet_sctp6_SCTP_PRIMARY_ADDR(r3, 0x84, 0x7a, &(0x7f0000000340)={r4, @in6={{0xa, 0x3, 0x4, @mcast1}}}, &(0x7f0000000040)=0x84) sendmmsg$inet_sctp(r2, &(0x7f00000032c0)=[{0x0, 0x0, 0x0, 0x0, &(0x7f0000000700)=ANY=[@ANYBLOB="30000000000000008400000001000000000000017c"], 0x30}], 0x1, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000440)={0x13, 0x13, &(0x7f0000000080)=ANY=[@ANYBLOB="18080000fa0000000000000000010000851000000600000018000000", @ANYRES32, @ANYBLOB="00000000000000006608000000000000180000000000000000000000000000009500000000000000360a020000000000180100002020782500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b50a00000000000085000000060000009500000000000000"], &(0x7f0000000000)='GPL\x00', 0x2, 0xff5c, &(0x7f00000001c0)=""/222, 0x41100, 0x8, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffff97}, 0x78) (async) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.cpu/syz1\x00', 0x1ff) (async) r5 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r6 = openat$cgroup_procs(r5, &(0x7f0000000980)='tasks\x00', 0x2, 0x0) (async) r7 = openat$cgroup_procs(r5, &(0x7f00000002c0)='tasks\x00', 0x2, 0x0) write$cgroup_pid(r6, &(0x7f00000000c0), 0x12) (async) pread64(r7, &(0x7f0000001840)=""/4096, 0x1000, 0x1) readv(r6, &(0x7f0000001800)=[{&(0x7f0000000680)=""/42, 0x2a}], 0x1) r8 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='devices.list\x00', 0x275a, 0x0) write$cgroup_subtree(r8, &(0x7f0000000200)=ANY=[], 0x32600) (async) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x2000001, 0x12, r8, 0x0) setsockopt$inet_sctp_SCTP_CONTEXT(r2, 0x84, 0x11, &(0x7f0000000100)={0x0, 0x5}, 0x8) (async) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000007c0)={0x10, 0x2, &(0x7f0000000100)=@raw=[@ldst={0x1, 0x2, 0x4, 0x0, 0x1, 0x1b}, @jmp={0x5, 0x0, 0x9, 0x0, 0x6, 0xfffffffffffffe88}], &(0x7f0000000000)='GPL\x00', 0x2, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x1}, 0x94) (async) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000001c0)={0x1f, 0xf, &(0x7f0000000380)=ANY=[@ANYBLOB="180000000b00000006000000840e000018110000", @ANYRES32=r1, @ANYBLOB="0000000000000000b702000014000000b7030000000000008500000083000000bf0900000000000055090100000000009500000000000000bf91000000000000b7020000010000008500000084000000b7000000000000009500000000000000"], &(0x7f0000000100)='syzkaller\x00', 0x2, 0x0, 0x0, 0x0, 0x11, '\x00', 0x0, 0x0, r0}, 0x94) 2.932726039s ago: executing program 4 (id=3564): socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFULNL_MSG_CONFIG(0xffffffffffffffff, &(0x7f00000017c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000a80)=ANY=[@ANYBLOB="81ff000001040108000000e4050001000100000023cc1f0e9fefb74232d58503c5b25c3633ab1e3a60da8b0cd571b69961fa26ec509d9d471ef3f69b315a5e6b070ceb3372941a9b9e2ff97addc354096df5c337a756524f5c811e0e1413c450d739ea0d9cd9564dab2ab4727202b8a64176d7c3f30d4c3d8adfe2b4638d6d779500"/145], 0x24}, 0x1, 0x0, 0x0, 0x20000015}, 0x4000000) syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10) r0 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) r1 = socket$inet_mptcp(0x2, 0x1, 0x106) getsockopt$inet_mreqn(r1, 0x0, 0x24, &(0x7f0000000040)={@empty, @broadcast}, &(0x7f0000000080)=0xc) r2 = syz_init_net_socket$x25(0x9, 0x5, 0x0) r3 = socket$inet6(0xa, 0x2, 0x0) bind$inet6(r3, &(0x7f0000000380)={0xa, 0x14e24}, 0x1c) connect$inet6(r3, &(0x7f0000000100)={0xa, 0x4e24, 0x0, @rand_addr, 0x1}, 0x1c) sendmsg$IPSET_CMD_CREATE(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000140)=ANY=[], 0x14}, 0x1, 0x0, 0x0, 0x4000}, 0x4050) r4 = socket$inet6_mptcp(0xa, 0x1, 0x106) getsockopt$inet6_mptcp_buf(r4, 0x11c, 0x4, &(0x7f0000000000)=""/152, &(0x7f00000000c0)=0x98) r5 = socket$igmp6(0xa, 0x3, 0x2) setsockopt$IP6T_SO_SET_REPLACE(r5, 0x29, 0x40, &(0x7f0000000440)=@raw={'raw\x00', 0x8, 0x3, 0x4c8, 0x170, 0xffffffff, 0xffffffff, 0x170, 0xffffffff, 0x3f8, 0xffffffff, 0xffffffff, 0x3f8, 0xffffffff, 0x3, 0x0, {[{{@ipv6={@private0, @mcast2, [], [], 'veth0_macvtap\x00', 'dvmrp1\x00'}, 0x0, 0x148, 0x170, 0x0, {}, [@common=@unspec=@helper={{0x48}}, @common=@inet=@hashlimit1={{0x58}, {'bond_slave_1\x00', {0x41, 0x1ff, 0x6, 0xb0e2, 0x10001, 0x84e, 0xfffffffb, 0x18, 0x8}, {0x1}}}]}, @common=@unspec=@NFQUEUE0={0x28}}, {{@ipv6={@remote, @ipv4={'\x00', '\xff\xff', @dev}, [], [], 'erspan0\x00', 'gre0\x00'}, 0x0, 0x258, 0x288, 0x0, {}, [@common=@inet=@hashlimit1={{0x58}, {'pim6reg\x00', {0x0, 0x0, 0x5, 0x0, 0x0, 0x7, 0x3ff}}}, @common=@inet=@hashlimit3={{0x158}, {'vcan0\x00', {0x3, 0x0, 0x41, 0x0, 0x2, 0x1000, 0x6, 0x3}}}]}, @common=@unspec=@CONNMARK={0x30}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28, '\x00', 0x7}}}}, 0x528) sendmmsg(r3, &(0x7f00000092c0), 0x4ff, 0x0) r6 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x48241, 0x0) ioctl$TUNSETIFF(r6, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x6bf1c2d5adba8c32}) r7 = socket$kcm(0x2, 0xa, 0x2) r8 = syz_init_net_socket$bt_l2cap(0x1f, 0x0, 0x0) r9 = syz_init_net_socket$bt_l2cap(0x1f, 0x5, 0x0) bind$bt_l2cap(r9, &(0x7f0000000080)={0x1f, 0x1, @none, 0x0, 0x1}, 0xe) bind$bt_l2cap(r8, &(0x7f0000000340)={0x1f, 0x1, @fixed={'\xaa\xaa\xaa\xaa\xaa', 0x12}, 0x0, 0x2}, 0xe) ioctl$SIOCSIFHWADDR(r7, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local}) write$tun(r4, &(0x7f0000000b40)=ANY=[@ANYBLOB="000060041648087d069faaaaaaaaaabb0800452300ec0065000009069078ac1e0101ac1414bad9384e234e24", @ANYRES32=0x41424344, @ANYRES32=0x41424344, @ANYBLOB="d040ff8b90780002012203ce02040300050e0000004f0000080000000003fe0af989a5714473fbe76ba73608709f65e36ee38e85e836475c6f90cf968c371ce168e5e2439262f4eec2c52c4c4aa86ccdb82738e95d247ee439b7543f363668be5df3ac264dfe87ce0bf8a1f6ef1a1706001a0d1e3ed999ea6f1b1ab4d3ad06db165b6849c95b8cfac118b046cc78a0e1899b059944ad307c5851001ee3347819caa5fab6c107af37c209d2ff2c073789a09e3db0ce2ef4efd8223bf6fdc4096947c410e847140336c0f64e00"], 0xfe) r10 = syz_init_net_socket$x25(0x9, 0x5, 0x0) bind$x25(r10, &(0x7f0000000200)={0x9, @remote={'\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc', 0x2}}, 0x12) bind$x25(r2, &(0x7f0000000080), 0x12) ioctl$sock_ifreq(r0, 0x8910, &(0x7f0000000000)={'ip6gretap0\x00', @ifru_mtu=0x6}) ioctl$sock_netdev_private(r0, 0x8914, &(0x7f0000000000)) 2.505725705s ago: executing program 1 (id=3568): socket$inet_icmp_raw(0x2, 0x3, 0x1) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x5) unshare(0x6a040000) r0 = socket$inet6_sctp(0xa, 0x5, 0x84) getsockopt$inet_sctp6_SCTP_DISABLE_FRAGMENTS(r0, 0x84, 0x8, &(0x7f0000000080), &(0x7f00000000c0)=0x4) r1 = socket$inet(0x2, 0x1, 0x0) setsockopt$inet_opts(r1, 0x0, 0x4, &(0x7f0000000580)="8907040400", 0x5) connect$inet(r1, &(0x7f0000000140)={0x2, 0xc000, @multicast1}, 0x10) r2 = bpf$PROG_LOAD(0x5, &(0x7f0000000780)={0x15, 0x2000000000000216, &(0x7f0000000440)=ANY=[@ANYBLOB="18000000000000000000000000000000850000000f00000018010000646c6c2400000000000000007b1af8ff00000000bfa10000000000000701"], 0x0, 0xffffffff, 0x0, 0x0, 0x0, 0x1c, '\x00', 0x0, @fallback=0x28, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x18, 0x4, &(0x7f0000000480)=ANY=[@ANYBLOB="180100001c0000000000000000000000850000006d00000095"], 0x0, 0x5, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, 0x2}, 0x94) r3 = bpf$PROG_LOAD(0x5, &(0x7f0000000800)={0x16, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x3, 0x0, 0x0, 0x0, 0x2, '\x00', 0x0, @fallback=0x23, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000000)={r3, 0x2000000, 0xe, 0x0, &(0x7f0000000580)="63eced8e46aa7ce5a833c9f7b942", 0x0, 0x7ffd, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) r4 = socket$inet(0xa, 0x801, 0x84) connect$inet(r4, &(0x7f0000004cc0)={0x2, 0x0, @remote={0xac, 0x14, 0xffffffffffffffff}}, 0x10) socket$unix(0x1, 0x5, 0x0) r5 = socket$can_bcm(0x1d, 0x2, 0x2) connect$can_bcm(r5, &(0x7f00000000c0), 0x10) socket$inet6_tcp(0xa, 0x1, 0x0) sendmsg$can_bcm(0xffffffffffffffff, 0x0, 0x20000000) mmap(&(0x7f0000001000/0xc00000)=nil, 0xc00000, 0x0, 0x3032, 0xffffffffffffffff, 0x0) sendmsg$can_bcm(r5, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000580)=ANY=[], 0x4640}, 0x2}, 0x0) listen(r4, 0x8) syz_genetlink_get_family_id$ipvs(&(0x7f0000000040), 0xffffffffffffffff) bpf$BPF_PROG_ATTACH(0x8, &(0x7f0000000780)=ANY=[@ANYRES32, @ANYRES32, @ANYBLOB="0400000000", @ANYRES32], 0x20) sendmsg$IPVS_CMD_NEW_SERVICE(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000240)=ANY=[@ANYBLOB], 0x4c}, 0x1, 0x0, 0x0, 0x4000000}, 0x40040) r6 = socket$packet(0x11, 0x2, 0x300) splice(r2, &(0x7f0000000100)=0x100000001, r6, &(0x7f00000001c0)=0xc000, 0x2, 0x6) 2.448476258s ago: executing program 4 (id=3569): r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000e80)=ANY=[@ANYBLOB="0e000000040000000800000008"], 0x50) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x11, 0x14, &(0x7f0000000880)=ANY=[@ANYBLOB="1800000003000000000000000040000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000018010000756c6c2500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000005000000850000000600000095"], &(0x7f0000000400)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback=0x3a, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$PROG_BIND_MAP(0xa, &(0x7f00000003c0)={r1}, 0xc) r2 = bpf$BPF_BTF_LOAD(0x12, &(0x7f00000003c0)={&(0x7f0000000580)=ANY=[], 0x0, 0x96, 0x0, 0x1, 0x5}, 0x28) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f00000007c0)=@bpf_lsm={0x1d, 0x2, &(0x7f0000000500)=ANY=[@ANYBLOB="85000000900000003765040004000000ac8618712eb512b84002448d19a8ec42fb341dceac82229871ebdc104f52b98b"], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x41100, 0x41, '\x00', 0x0, 0x1b, r2, 0x8, 0x0, 0x0, 0x10, &(0x7f0000000340)={0x3, 0x3, 0x4d8, 0x6}, 0x10, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x10, 0x401}, 0x94) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='blkio.bfq.group_wait_time\x00', 0x275a, 0x0) setsockopt$inet_sctp6_SCTP_EVENTS(0xffffffffffffffff, 0x84, 0xb, &(0x7f0000000100)={0x66, 0xfe, 0x4, 0x0, 0x40, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x9}, 0xe) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000780)={0x11, 0x0, 0x0, &(0x7f00000004c0)='GPL\x00', 0x52, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x8}, 0x94) openat$6lowpan_control(0xffffffffffffff9c, &(0x7f0000000300), 0x2, 0x0) r3 = socket$inet(0xa, 0x801, 0x84) connect$inet(r3, &(0x7f0000000340)={0x2, 0x0, @remote={0xac, 0x14, 0xffffffffffffffff}}, 0x10) listen(r3, 0x8) r4 = accept4(r3, 0x0, 0x0, 0x0) sendmmsg$unix(r4, &(0x7f0000001840)=[{{0x0, 0x0, &(0x7f00000000c0)=[{&(0x7f0000000140)="c6", 0x1}], 0x1, 0x0, 0x0, 0x20048054}}], 0x1, 0x8800) sendto$inet(r4, &(0x7f00000002c0)="cc", 0x1, 0x0, 0x0, 0x0) setsockopt$inet_sctp6_SCTP_DEFAULT_SNDINFO(r4, 0x84, 0x22, &(0x7f0000000100)={0x3}, 0x10) sendto$inet(r4, &(0x7f0000000300)="b3", 0x1, 0x0, 0x0, 0x0) setsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER(r4, 0x84, 0x7b, &(0x7f0000000000)={0x0, 0x4}, 0x8) sendmmsg$alg(r4, &(0x7f0000005ac0)=[{0x0, 0x0, &(0x7f0000000180)=[{&(0x7f0000000380)="eb13456f46", 0x5}], 0x1, 0x0, 0x0, 0x40045}], 0x1, 0x4081) close(r4) r5 = socket$inet6_mptcp(0xa, 0x1, 0x106) bind$inet6(r5, &(0x7f00000002c0)={0xa, 0x4e22, 0x0, @local, 0xb}, 0x1c) listen(r5, 0x2) r6 = socket$alg(0x26, 0x5, 0x0) bind$alg(r6, &(0x7f0000000940)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc(blowfish)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r6, 0x117, 0x1, &(0x7f0000000280)="ad56b6c5", 0x4) r7 = accept4(r6, 0x0, 0x0, 0x800) sendmmsg$alg(r7, &(0x7f0000000040)=[{0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)="f78d9ca38fff48f3be52163448412ba8", 0xfffffe3f}, {&(0x7f0000000140)="ebe3a0e9796cfd1647e299f4e376fdba128280b372219d205e81f4a7f71c1926aae1efd7e0054a863f3d5cfe6cb55b5bb9fa6935849e6098ed884e7cb51726b360fbb37b4fe035bbb095873048"}, {&(0x7f00000003c0)="e8700e444d50a969ff67347cff6127e6ef12ee3819271482a4975a52c1ab9b8b4db3945d1032005eabe97b4dc33a47d3a158da988456d30026b433186f53cdcdb93a4722bf306a10470d50f5cb1ece9ead3459bab1cf1538cd0b157653c5e892962c80f158c443e9c6ad7d2a8103ef2f4b93766b9a21501f94c1568b13756b66f74f46cf801704d2da8b96c34070b233af0afcc436712e58ed25e721193af05a045ad3fdc928f02f3dbad19d3e66eebda2e63f3f46ef4511cee26d7b48241847bf9e343ef4674c45e2a085060f11"}], 0x1, &(0x7f0000000380)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x40800) recvmsg(r7, &(0x7f00000005c0)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f00000000c0)=""/81, 0x7ffff000}, {&(0x7f0000000200)=""/83, 0x20000253}], 0x2}, 0x0) syz_emit_ethernet(0x4e, &(0x7f0000000600)={@local, @broadcast, @void, {@ipv6={0x86dd, @tcp={0x0, 0x6, '\x00', 0x18, 0x6, 0x1, @local, @local, {[], {{0x0, 0x4e22, 0x41424344, 0x41424344, 0x0, 0x0, 0x6, 0xc2, 0x0, 0x0, 0x0, {[@fastopen={0x1e, 0x2}]}}}}}}}}, 0x0) 2.211694315s ago: executing program 4 (id=3572): r0 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000000000)=@raw={'raw\x00', 0x3c1, 0x3, 0x530, 0x0, 0x18c, 0x203, 0x0, 0x19030000, 0x460, 0x2e0, 0x2e0, 0x460, 0x2e0, 0x3, 0x0, {[{{@uncond, 0x300, 0x2d8, 0x320, 0x0, {}, [@common=@unspec=@bpf0={{0x230}, {0x13, [{0x0, 0x0, 0x8, 0x2000000}, {}, {}, {}, {}, {}, {}, {}, {0x0, 0x0, 0x0, 0x8}, {}, {0x0, 0x0, 0x0, 0xe}, {0x0, 0x0, 0x0, 0x3}, {0x0, 0x0, 0x3}, {0x2, 0x0, 0x4}, {}, {0x0, 0x0, 0x0, 0x1}, {0x0, 0x0, 0x8}, {}, {0x16}, {0x0, 0xff}, {}, {0x7}, {0x0, 0x0, 0x0, 0x4}, {0x0, 0x4, 0x0, 0x101}, {}, {0x0, 0x0, 0x5}, {}, {0x0, 0x0, 0x0, 0x9}, {0xfffc, 0x0, 0x0, 0x10}, {}, {0xfffe}, {}, {}, {}, {0xfffe, 0xfb}, {}, {0x7a04}, {}, {}, {0x20, 0x6}, {}, {}, {}, {0x0, 0x0, 0x0, 0x800}, {}, {0xb8c, 0x0, 0x0, 0xf00}, {0x0, 0x1, 0x0, 0x3}, {0x3}, {}, {}, {0x0, 0x0, 0x0, 0x16}, {}, {0x4}, {}, {}, {}, {}, {0x0, 0xfd}, {}, {}, {0x0, 0x0, 0x0, 0xfffffffd}, {}, {0x0, 0xb}, {0x4, 0x2}]}}]}, @common=@unspec=@IDLETIMER={0x48, 'IDLETIMER\x00', 0x0, {0x2, 'syz0\x00', {0x8001}}}}, {{@uncond, 0x0, 0xf8, 0x140, 0x0, {}, [@inet=@rpfilter={{0x28}, {0xb}}, @inet=@rpfilter={{0x28}, {0xd}}]}, @common=@unspec=@IDLETIMER={0x48, 'IDLETIMER\x00', 0x0, {0xb, 'syz1\x00', {0x6c8}}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x590) sendmsg$can_raw(0xffffffffffffffff, &(0x7f0000000700)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f0000000680)=@can={{0x3, 0x0, 0x0, 0x1}, 0x7, 0x2, 0x0, 0x0, "9a3d11a4a9aab3d4"}, 0x10}, 0x1, 0x0, 0x0, 0x40000}, 0x4) 1.986025568s ago: executing program 0 (id=3573): r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000100)=@newlink={0x74, 0x10, 0xc05, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x54, 0x12, 0x0, 0x1, @batadv={{0xb}, {0x44, 0x2, 0x0, 0x1, [@IFLA_BATADV_ALGO_NAME={0xd, 0x1, 'BATMAN_IV'}, @IFLA_BATADV_ALGO_NAME={0xd, 0x1, 'BATMAN_IV'}, @IFLA_BATADV_ALGO_NAME={0xd, 0x1, 'BATMAN_IV'}, @IFLA_BATADV_ALGO_NAME={0xd, 0x1, 'BATMAN_IV'}]}}}]}, 0x74}, 0x1, 0x0, 0x0, 0xc0}, 0x4000880) 1.93333461s ago: executing program 4 (id=3574): r0 = socket$inet6(0xa, 0x2, 0x0) bind$inet6(r0, &(0x7f0000000100)={0xa, 0x4e20, 0x0, @empty}, 0x1c) r1 = openat$tun(0xffffffffffffff9c, &(0x7f00000001c0), 0xa2f01, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x6bf1c2d5adbaa402}) socket$kcm(0x2, 0xa, 0x2) (async) r2 = socket$kcm(0x2, 0xa, 0x2) ioctl$SIOCSIFHWADDR(r2, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local}) (async) ioctl$SIOCSIFHWADDR(r2, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local}) write$tun(r1, &(0x7f0000000b00)={@val={0xa}, @void, @eth={@broadcast, @remote, @void, {@ipv6={0x86dd, @udp={0xd, 0x6, '\x00 \x00', 0xfb, 0x11, 0xff, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02', @mcast2, {[], {0x4f19, 0x4e20, 0xfb, 0x0, @opaque="6032a60d61027fc56132c70c5b2e374ea5c9f253bf510947670b66f27987c44cc92a4983e3a69d4d66f715db6bc3764c5d931bc54d44513770f4b8bab1f436c8435573795c1f21366220b8b21cf6acdd26fea91dd8728f7d1c0a41155f0da56ee7de80b5f1c653c10b002572c5c4da53d762eb53958e6688b73b8e214e6751ee18257e15bcde775faacada05890f86de2e3f8bd227b6c8631f9e340f3df7da564f3805ecf13af8303b52c516fa111f175b274d20b8f4559a9e06479a313217e7889387906d40e1dfb031cd684a466a82b41a53ab259be273875155f70afdde5eacca54e797623c9f1cf586d2d0875481db61b4"}}}}}}}, 0x135) recvmmsg(r0, &(0x7f0000004d00)=[{{0x0, 0x0, &(0x7f0000000340)=[{0x0}, {&(0x7f0000000000)=""/33, 0x21}], 0x2}, 0x7dcf}], 0x1, 0x20, 0x0) 1.868563407s ago: executing program 1 (id=3575): r0 = syz_init_net_socket$rose(0xb, 0x5, 0x0) sendmsg$NFT_BATCH(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={0x0, 0x70}}, 0x0) getsockopt$inet_sctp6_SCTP_MAX_BURST(0xffffffffffffffff, 0x84, 0x82, 0x0, 0x0) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$ieee802154(&(0x7f00000002c0), r1) sendmsg$IEEE802154_ADD_IFACE(r1, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000040)={0x2c, r2, 0xd29, 0x70bd2d, 0x25dfdbfb, {}, [@IEEE802154_ATTR_HW_ADDR={0xc, 0x5, {0xaaaaaaaaaaaa0202}}, @IEEE802154_ATTR_PHY_NAME={0x9, 0x1f, 'phy0\x00'}]}, 0x2c}, 0x1, 0x0, 0x0, 0x8090}, 0x4000004) 1.860495294s ago: executing program 3 (id=3576): r0 = bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0xe, 0x4, &(0x7f0000000540)=ANY=[@ANYBLOB="b4050000fdff7f006110580000000000c60000000000000095000000000000009f33ef60916e6e713f1eeb0b725ad99b817fd98cd824498949714ffaac8a6f770600dcca55f21f3ca9e822d182054d54d53cd2b6db714e4beb5447000001000000008f2b9000f22425e4097ed62cbc891061017cfa6fa26fa7088c60897d4a6148a1c1e43f00001bde60beac671e8e8fdecb03588aa623fa71f31bf0f871ab5c2ff88afc60027f4e5b5271ed58e835cf0d0000000098b51fe6b1b8d9dbe87dcff414ed000000000000000000000000000000000000000000000000000000b347abe6352a080f8140e5fd10747b6ecdb3540546bf636e3d6e700e5b0500000000000000eb9e1403e6c8f7a187eaf60f3a17f0f046a307a403c19d9829c90bd2114252581567acae715cbe1b57d5cda432c5b910400623d24195405f2e76ccb7b37b41215c184e731fb1"], &(0x7f0000003ff6)='GPL\x00', 0x4, 0xfd90, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @sk_skb, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x366, 0x10, &(0x7f0000000000), 0x1dd}, 0x48) (async) r1 = socket$pppl2tp(0x18, 0x1, 0x1) setsockopt$pppl2tp_PPPOL2TP_SO_LNSMODE(r1, 0x111, 0x4, 0x0, 0x4) (async) r2 = bpf$MAP_CREATE(0x0, &(0x7f00000008c0)=ANY=[@ANYBLOB="0f000000040000000400000012"], 0x48) r3 = bpf$BPF_LINK_CREATE(0x1c, &(0x7f00000001c0)={r0, r2, 0x26, 0x0, @void}, 0x10) bpf$LINK_DETACH(0x22, &(0x7f0000000480)=r3, 0x4) (async) bpf$BPF_GET_MAP_INFO(0xf, &(0x7f00000013c0)={r3, 0x0, 0x0}, 0x10) (async) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) bpf$PROG_LOAD(0x5, 0x0, 0x0) (async) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r4, 0x8933, &(0x7f0000000080)={'batadv_slave_1\x00', 0x0}) (async) r6 = socket$inet_sctp(0x2, 0x1, 0x84) setsockopt$sock_int(r6, 0x1, 0xf, &(0x7f0000000600)=0x9, 0x4) setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(r6, 0x84, 0x64, &(0x7f0000000180)=[@in={0x2, 0x4e21, @dev={0xac, 0x14, 0x14, 0x26}}], 0x10) listen(r6, 0x7) (async) socket$inet_sctp(0x2, 0x5, 0x84) r7 = socket$inet6_sctp(0xa, 0x1, 0x84) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r7, 0x84, 0x6f, &(0x7f0000000280)={0x0, 0x1c, &(0x7f0000000000)=[@in6={0xa, 0x0, 0x0, @private1, 0x9}]}, &(0x7f00000002c0)=0x10) getsockopt$inet_sctp6_SCTP_MAX_BURST(r7, 0x84, 0x83, &(0x7f0000000000)=@assoc_value={0x0}, &(0x7f00000004c0)=0x8) setsockopt$inet_sctp_SCTP_DEFAULT_PRINFO(r6, 0x84, 0x72, &(0x7f0000000500)={r8, 0x7, 0x20}, 0xc) bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f00000004c0)={r0, r5, 0x25, 0x1, @val=@kprobe_multi=@syms={0x0, 0xa, &(0x7f0000000400)=[&(0x7f0000000800)='\x10\x14\x98\xa3<\x17\x18\'\xb0\xfb2&m\xd1\xa1\xd0\xd1xe\xd0\v\x83\x95\x16\v\x87\xd0\x05K\x94>D\x87\xb50\x0fz\x11\r\xff\x99=-\xd5@\xb3l\xdf\xb5F\xfd\xe0\x80\xa7\xc8\xfa|1\x1cj\xe3\xc8\x13\xa0B?C\x80w\r\x8d\xb4\x9c\x12x\xce\x95\x00\nL1FTk\t\x19\xd9)\x15X\xdf\x12*\xfb\xcb\xef\xb1q\xb1|\x15\xa3\x00\x00\x00', &(0x7f0000000100)='\x00', &(0x7f0000000140)='%/\',/{\x00', &(0x7f00000000c0)='\xaa\xaa\xaa\xaa\xaa', &(0x7f0000000240)='\xaa\xaa\xaa\xaa\xaa', &(0x7f0000000280)='\x00', &(0x7f00000002c0)='\\x&\xec\x00', &(0x7f0000000300)='\x00', &(0x7f0000000380)='GPL\x00', &(0x7f00000003c0)='/-\x00'], 0x0, 0x6}}, 0x30) (async) socket$xdp(0x2c, 0x3, 0x0) r9 = socket$inet_tcp(0x2, 0x1, 0x0) close(r9) (async) socket$kcm(0xa, 0x3, 0x87) (async) r10 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) ioctl$TUNSETIFF(r10, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) (async) r11 = socket$kcm(0x2, 0xa, 0x2) (async) pselect6(0x40, &(0x7f0000000040)={0x4, 0x7, 0x0, 0x7fc0000000000003, 0x1, 0x1000, 0x2000000000000007, 0x7}, 0x0, 0x0, 0x0, 0x0) ioctl$SIOCSIFHWADDR(r11, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local}) (async) write$tun(r10, &(0x7f0000000040)=ANY=[@ANYBLOB="034886dd120000000000140000006000000003088700fe88a43de1a400000000000000007d01ff020000000000000000000000000001"], 0xfdef) 1.770078859s ago: executing program 0 (id=3577): r0 = socket$nl_route(0x10, 0x3, 0x0) (async) r1 = socket$inet(0x2, 0x2, 0x1) setsockopt$inet_int(r1, 0x0, 0x13, &(0x7f0000000040)=0x7, 0x4) (async) r2 = socket(0x10, 0x3, 0x0) sendmsg$nl_generic(r2, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000001240)={&(0x7f0000000500)=ANY=[@ANYBLOB="840100001900010000000000000000001d0109004d00108025b57efaa223b473fe7783bc4a506cf756740574b89d316af9b5963870ef3391f3ac176f88d6e1db9b2bb2e5c90fa4eb2f71ebaede447dc8f6f61c6615fcf740adda4853b2d23adb370000001e0106"], 0x184}}, 0x0) (async) setsockopt$SO_BINDTODEVICE(r1, 0x1, 0x19, &(0x7f00000000c0)='veth1_vlan\x00', 0x10) (async) bind$l2tp(r1, &(0x7f0000000100)={0x2, 0x0, @rand_addr=0x64010100, 0x4}, 0x10) (async) sendmsg$inet(r1, &(0x7f0000000080)={&(0x7f0000000000)={0x2, 0x4e21, @multicast2}, 0x10, &(0x7f0000000700)=[{&(0x7f0000000200)="08001efbb0", 0x5}, {&(0x7f0000000180)="d0849e", 0x3}], 0x2, 0x0, 0x0, 0x60000000}, 0x20008004) (async) sendmsg$nl_route(r0, &(0x7f0000000900)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000200)=@ipv6_newrule={0x4c, 0x20, 0x1, 0x0, 0x25dfdbfb, {0xa, 0x80, 0x14, 0x0, 0x0, 0x0, 0x0, 0x7, 0x1a}, [@FRA_SRC={0x14, 0x2, @private2={0xfc, 0x2, '\x00', 0x1}}, @FIB_RULE_POLICY=@FRA_IP_PROTO={0x5, 0x16, 0x87}, @FRA_DST={0x14, 0x1, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01'}]}, 0xfecd}, 0x1, 0x0, 0x0, 0x4000010}, 0x40000) r3 = socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$SEG6(&(0x7f0000000000), r3) sendmsg$SEG6_CMD_SETHMAC(r3, &(0x7f0000002140)={0x0, 0x0, &(0x7f0000002100)={&(0x7f0000002080)={0x34, r4, 0x1, 0x70bd29, 0x25dfdbfd, {}, [@SEG6_ATTR_HMACKEYID={0x8, 0x3, 0x7}, @SEG6_ATTR_SECRET={0x8, 0x4, [0x4]}, @SEG6_ATTR_SECRETLEN={0x5, 0x5, 0x3}, @SEG6_ATTR_ALGID={0x5, 0x6, 0x1}]}, 0x34}, 0x1, 0x4000000000000000, 0x0, 0x882}, 0x0) bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=@base={0xd, 0x4, 0x8, 0xc}, 0x50) (async) r5 = socket$xdp(0x2c, 0x3, 0x0) (async) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000440)={0x13, 0x13, &(0x7f0000000080)=ANY=[@ANYBLOB="18080000fa0000000000000000010000851000000600000018000000", @ANYRES32, @ANYBLOB="00000000000000006608000000000000180000000000000000000000000000009500000000000000360a020000000000180100002020782500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b50a00000000000085000000060000009500000000000000"], &(0x7f0000000000)='GPL\x00', 0x2, 0xff5c, &(0x7f00000001c0)=""/222, 0x41100, 0x8, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffff97}, 0x78) (async) r6 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='devices.list\x00', 0x275a, 0x0) write$cgroup_subtree(r6, &(0x7f0000000200)=ANY=[], 0x32600) (async) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x2000001, 0x12, r6, 0x0) (async) getsockopt$XDP_STATISTICS(r5, 0x11b, 0x7, 0x0, &(0x7f0000000400)) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000500)={&(0x7f0000000340)=@newlink={0x5c, 0x10, 0x439, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x3c, 0x12, 0x0, 0x1, @ipip6={{0xb}, {0x2c, 0x2, 0x0, 0x1, [@IFLA_IPTUN_REMOTE={0x14, 0x3, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01'}, @IFLA_IPTUN_LOCAL={0x14, 0x2, @private2}]}}}]}, 0x5c}}, 0x0) 1.751832916s ago: executing program 2 (id=3578): r0 = socket$inet(0x2, 0x2, 0x0) setsockopt$inet_mreqn(r0, 0x0, 0x27, &(0x7f0000000740)={@multicast2, @loopback}, 0xc) r1 = socket$netlink(0x10, 0x3, 0x0) writev(r1, &(0x7f00000003c0)=[{&(0x7f0000000180)="390000001300034700bb65e1c3e4ffff01000000010000005600000025000000190004000400000007fd17e5ffff0800040000000000000000", 0x39}], 0x1) 1.702093599s ago: executing program 3 (id=3579): r0 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x80000000000002, &(0x7f00000004c0)=0x79, 0x4) (async, rerun: 32) bind$inet(r0, &(0x7f0000000080)={0x2, 0x4e23, @multicast1}, 0x10) (async, rerun: 32) setsockopt$SO_ATTACH_FILTER(r0, 0x1, 0x1a, &(0x7f0000000000)={0x1, &(0x7f0000000280)=[{0x6, 0xfa, 0x0, 0xe4}]}, 0x10) sendto$inet(r0, 0x0, 0x0, 0x200007fd, &(0x7f0000e68000)={0x2, 0x4e23, @local}, 0x10) (async, rerun: 32) getsockopt$inet_sctp_SCTP_RECVNXTINFO(r0, 0x84, 0x21, &(0x7f0000000200), &(0x7f0000000680)=0x4) (async, rerun: 32) setsockopt$inet_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f0000000100)='bbr', 0x3) r1 = socket$inet6_sctp(0xa, 0x1, 0x84) ioctl$ifreq_SIOCGIFINDEX_vcan(r1, 0x8933, &(0x7f0000000300)={'vcan0\x00', 0x0}) (async, rerun: 64) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) (rerun: 64) bind$inet6(r3, &(0x7f0000000240)={0xa, 0x0, 0x0, @dev, 0x81}, 0x1c) (async) bind$inet6(r3, &(0x7f0000000140)={0xa, 0x4e22, 0x0, @ipv4={'\x00', '\xff\xff', @local}}, 0x1c) (async, rerun: 32) ioctl$sock_inet6_SIOCADDRT(r1, 0x890b, &(0x7f0000000340)={@mcast2, @empty, @mcast1, 0x9, 0x5, 0xb, 0x0, 0xea41, 0x900003, r2}) (async, rerun: 32) sendmmsg$inet(r0, &(0x7f0000000c80)=[{{0x0, 0x0, &(0x7f0000001dc0)=[{&(0x7f0000000140)="91f8a9849519def28691bbc4173c3d6f357d0272b7319130feaab952ac4703cad04be68907e50e997fc26e4c91ea4feb931647fc5393de25000000000000000000", 0x41}, {&(0x7f0000000ac0)="44900000000056ee66c3725fa7aaa9fd188037fad2d5b5bfb0ba06f274a8d026bd209da8ffa6a26e3b3f8075704a9d0ef9aff7f1e7db2460bdb304e8caf67fe716623faa0ea1f0bc9f02d34e76992c9df9fe6888c6c9a4825c6223be6ac54536025af1dea54e527c68b0ff250261953f2da79a78106d009e7b16ed8ab124945aa9ab7581ebd385fb61d442035db81e18c2d271d30d1a5fff9d3b1ce90b597992b2a4d541611ce77f58dce7c9500118229e7cdf4ca7f6adca92c73d97ce54164c1942b2568635bec8e020b41fb2f8000000000000000000000000000000001c8a9f7956583e26f6f0edc415851d0b8305febebf2eca0bfb035cb164353d250755f59054af0c6669531942d5a3abc0f65e1daa9005a9c58c7081eae25c48ce816e5a18cc7ececc18ca10", 0x129}], 0x2}}, {{0x0, 0x0, &(0x7f00000005c0)=[{&(0x7f0000000200)}], 0x1}}, {{0x0, 0x0, &(0x7f0000000a40)=[{&(0x7f0000000d40)="504fd84e46c1819f771555bb3dbd485672d2ba0e9572e3ee66ef94536a7dfd0082883c5bd7fcb4e185c0cd7967b8616cc0446a181b1528f750b94e39b3a39c177446c9d7d9f2ff6922899e853818a3e80b2fd38f5e782b6b42c95104fd111ddce1505140ac49ae419e6264054d2cc0853c21ee312b754d0701db", 0x7a}, {&(0x7f00000003c0)="5238e95e63ee39039afbdcc3623762630b41620ad9c3ba2e00e019dd2a6d12b41daf39e8a94ebfb013cd351ea18c923617691c1ff8a55cafd19518d9ba95411af2f1bfa8d10cde6696d503887396d47677c9c8d2197e677aca63c919ba13cd532d707f0cc3c03813e4b03eb3bee052f4410191b5c81e4aff290bce080945cc24f16b3da715a177e3b1c5dafc5d15a50802013c63f017086b240b1e50875cf19e5fd0d1536d00510e64a5b59840872f76d1fc28de642110d1706588a9c0062b77494b9694de0ddca71fe6561f3c6500a792c25148622cef830dc029c43c817c3a01ad50", 0xe3}, {&(0x7f0000000500)="23355c484a99f50fe80290dad71777c07547ba6775a98ce83fd6c7031048db3f6cc0829e59806f8b94c170faf06472d63b65d24f52ef895f5bfb0b98cebbd1a6d72b1b", 0x43}, {&(0x7f0000000600)="9e1d7cffeebcc56f4a1cd2cebf23c21f5951c799bf8c8d62efca81f675745d0f6114880da308a45e71eb6d09080cd8a7a6afc5912915b9a1575c0ba983d07725aa072d2ad688e93c6073c1", 0x4b}, {&(0x7f0000000780)="1c5f4bb563d6ef2ffbb46cb2b02454214c50a988a9cd0d8b4ec20810aca4b2efa0acccf7f1ae615e5a985b570424d4421f111a30122bedb13152a3959b7caf873e0846e5744ee93fd80558d6dad07296391225706724c9f8b6f7fd1f816cb091f9d30d12a020b173b105ac383f1af7be39825720221707da95194aae3a2e497a6500915c5f54d39771fb9b", 0x8b}, {&(0x7f0000000840)="55b2f45a82e979ee13cfa93f385d876f372e49b02d643c72db8e0e97739ef4a3fd8e6104505786b8afbd549b2e9adbcf0d17b0f665810f5d862724a67e881efcad7b931b40cffd764f7d3c4467c1f6016b9297758569e5cc6f1009", 0x5b}, {&(0x7f0000000940)="d361df209d9688a550cc85099cada97bd2fa7d9612b994fa0f7103b8281c97bd23fdc09c0b961e0a54ab", 0x2a}], 0x7, &(0x7f0000000dc0)=[@ip_ttl={{0x14, 0x0, 0x2, 0x1}}, @ip_tos_u8={{0x11, 0x0, 0x1, 0x6}}, @ip_pktinfo={{0x1c, 0x0, 0x8, {r2, @private=0xa010102, @remote}}}, @ip_retopts={{0x1c, 0x0, 0x7, {[@cipso={0x86, 0x9, 0x2, [{0x1, 0x3, "bf"}]}, @noop, @noop]}}}, @ip_tos_int={{0x14, 0x0, 0x1, 0xe55d}}, @ip_retopts={{0xa0, 0x0, 0x7, {[@lsrr={0x83, 0x1b, 0x58, [@dev={0xac, 0x14, 0x14, 0x36}, @broadcast, @broadcast, @loopback, @local, @dev={0xac, 0x14, 0x14, 0x11}]}, @generic={0x86, 0x6, "be1ab53c"}, @timestamp={0x44, 0xc, 0x5e, 0x0, 0xe, [0x9, 0x0]}, @timestamp_addr={0x44, 0x3c, 0x80, 0x1, 0x8, [{@loopback}, {@multicast1, 0x6}, {@local, 0x220}, {@dev={0xac, 0x14, 0x14, 0x3c}, 0x2}, {@empty, 0x7}, {@multicast1, 0x84}, {@dev={0xac, 0x14, 0x14, 0x15}, 0x7}]}, @ssrr={0x89, 0xb, 0xd3, [@rand_addr=0x64010100, @dev={0xac, 0x14, 0x14, 0xe}]}, @rr={0x7, 0xb, 0x9c, [@rand_addr=0x64010100, @broadcast]}, @timestamp={0x44, 0x10, 0x2d, 0x0, 0x3, [0x5, 0x7, 0x40]}]}}}, @ip_tos_u8={{0x11, 0x0, 0x1, 0x7}}], 0x140}}], 0x3, 0x2090) (async) setsockopt$sock_int(r0, 0x1, 0x21, &(0x7f0000000040)=0xdfa, 0x4) (async) sendto$inet(r0, &(0x7f0000000580)="17", 0x59a, 0x10008095, 0x0, 0x0) (async) unshare(0x20000400) (async) r4 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r4, &(0x7f0000005c40)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f00000004c0)=@newtaction={0x44, 0x30, 0x1, 0x0, 0x0, {}, [{0x30, 0x1, [@m_bpf={0x2c, 0x18, 0x0, 0x0, {{0x8}, {0x4}, {0x4}, {0xc}, {0xc}}}]}]}, 0x44}}, 0x4c8d0) (async) getsockopt$inet_buf(r0, 0x0, 0x9, &(0x7f00000002c0)=""/234, &(0x7f00000000c0)=0xea) r5 = socket$nl_generic(0x10, 0x3, 0x10) (async, rerun: 64) r6 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000700), 0xffffffffffffffff) (rerun: 64) sendmsg$TIPC_NL_LINK_SET(r5, &(0x7f00000008c0)={&(0x7f00000006c0)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000000740)={&(0x7f0000001200)={0x2f8, r6, 0x2, 0x70bd2a, 0x25dfdbff, {}, [@TIPC_NLA_MEDIA={0x1c, 0x5, 0x0, 0x1, [@TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'udp\x00'}, @TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'eth\x00'}, @TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'udp\x00'}]}, @TIPC_NLA_NODE={0xf4, 0x6, 0x0, 0x1, [@TIPC_NLA_NODE_REKEYING={0x8, 0x6, 0x40}, @TIPC_NLA_NODE_ADDR={0x8, 0x1, 0x1}, @TIPC_NLA_NODE_ADDR={0x8, 0x1, 0x7504}, @TIPC_NLA_NODE_ID={0x2b, 0x3, "d125f8b5b5fa00563a67a870e63559d748a6f8ac07bc92e889a3d709a8cc3d2db67abc4dda6d40"}, @TIPC_NLA_NODE_KEY={0x49, 0x4, {'gcm(aes)\x00', 0x21, "0ef97f829f73aa8a7a1f38ef04ff657ffca77067ccd33b893f11d572e4df08fac1"}}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_ADDR={0x8, 0x1, 0x3}, @TIPC_NLA_NODE_KEY_MASTER={0x4}, @TIPC_NLA_NODE_KEY={0x49, 0x4, {'gcm(aes)\x00', 0x21, "d1558a2eb76831e0f76ba5b2017cde9b837cca24b24160f46e2032cd61965d3ed5"}}]}, @TIPC_NLA_NET={0x10, 0x7, 0x0, 0x1, [@TIPC_NLA_NET_NODEID={0xc}]}, @TIPC_NLA_MEDIA={0x94, 0x5, 0x0, 0x1, [@TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'eth\x00'}, @TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'udp\x00'}, @TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'udp\x00'}, @TIPC_NLA_MEDIA_PROP={0x2c, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_WIN={0x8, 0x3, 0x1}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x1}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x80}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0xc}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x2}]}, @TIPC_NLA_MEDIA_PROP={0x14, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x18}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x1c}]}, @TIPC_NLA_MEDIA_PROP={0x2c, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0x10}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x5}, @TIPC_NLA_PROP_TOL={0x8}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x3e2}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0xe}]}, @TIPC_NLA_MEDIA_PROP={0xc, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x2}]}]}, @TIPC_NLA_MON={0x34, 0x9, 0x0, 0x1, [@TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8, 0x1, 0x100}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8, 0x1, 0x6}, @TIPC_NLA_MON_REF={0x8, 0x2, 0xc}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8, 0x1, 0x8}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8, 0x1, 0x3}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8, 0x1, 0x2}]}, @TIPC_NLA_MEDIA={0xf8, 0x5, 0x0, 0x1, [@TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'eth\x00'}, @TIPC_NLA_MEDIA_NAME={0x7, 0x1, 'ib\x00'}, @TIPC_NLA_MEDIA_PROP={0x3c, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_WIN={0x8, 0x3, 0x2}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x11}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x14}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x4}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x5}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0xffffffda}]}, @TIPC_NLA_MEDIA_PROP={0x4c, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x7}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x2}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x80000000}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x4}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x80000001}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x5}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x16}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x29}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x1}]}, @TIPC_NLA_MEDIA_PROP={0xc, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x3}]}, @TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'udp\x00'}, @TIPC_NLA_MEDIA_PROP={0x24, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_TOL={0x8, 0x2, 0x8}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0xe}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x7}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0xb}]}, @TIPC_NLA_MEDIA_PROP={0x24, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_TOL={0x8}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0xfff}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x3c}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x3}]}]}, @TIPC_NLA_NODE={0x4}]}, 0x2f8}}, 0x800) (async) r7 = socket$alg(0x26, 0x5, 0x0) bind$alg(r7, &(0x7f0000000540)={0x26, 'aead\x00', 0x0, 0x0, 'aegis128\x00'}, 0x58) (async, rerun: 64) setsockopt$ALG_SET_KEY(r7, 0x117, 0x1, &(0x7f0000000140)="2c385aa3d49100dc6626c892b6bc436a", 0x10) (rerun: 64) r8 = accept4(r7, 0x0, 0x0, 0x0) sendmsg$IPCTNL_MSG_TIMEOUT_DEFAULT_GET(r8, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000380)={0x0, 0x54}, 0x1, 0x0, 0x0, 0x8041}, 0x40004000) (async) syz_genetlink_get_family_id$ipvs(&(0x7f0000000400), r8) (async) setsockopt$MRT_ADD_VIF(r0, 0x0, 0xca, &(0x7f00000001c0)={0x0, 0x8, 0xaf, 0x3, @vifc_lcl_addr=@multicast2, @initdev={0xac, 0x1e, 0x1, 0x0}}, 0x10) 1.609656081s ago: executing program 0 (id=3580): r0 = openat$cgroup_procs(0xffffffffffffffff, &(0x7f0000000000)='cgroup.procs\x00', 0x2, 0x0) ioctl$int_out(r0, 0x5460, &(0x7f0000000040)) r1 = socket$nl_xfrm(0x10, 0x3, 0x6) ioctl$F2FS_IOC_ABORT_ATOMIC_WRITE(r1, 0xf505, 0x0) (async, rerun: 64) setsockopt$TIPC_GROUP_JOIN(0xffffffffffffffff, 0x10f, 0x87, &(0x7f0000000080)={0x43, 0x0, 0x1}, 0x10) (rerun: 64) ioctl$XFS_IOC_GOINGDOWN(r0, 0x8004587d, &(0x7f00000000c0)=0xff) r2 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000140), 0xffffffffffffffff) ioctl$sock_ipv6_tunnel_SIOCCHGTUNNEL(0xffffffffffffffff, 0x89f3, &(0x7f0000000200)={'ip6gre0\x00', &(0x7f0000000180)={'ip6tnl0\x00', 0x0, 0x29, 0xa, 0x4, 0x0, 0x4e, @remote, @local, 0x700, 0x10, 0x9, 0x3}}) (async) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r1, 0x8933, &(0x7f0000000240)={'batadv0\x00', 0x0}) (async) ioctl$sock_ipv6_tunnel_SIOCADDTUNNEL(0xffffffffffffffff, 0x89f1, &(0x7f0000000300)={'syztnl1\x00', &(0x7f0000000280)={'syztnl1\x00', 0x0, 0x29, 0x1, 0x1, 0x5, 0x10, @mcast2, @local, 0x7800, 0x80, 0x8000, 0x6}}) ioctl$sock_ipv6_tunnel_SIOCCHGTUNNEL(0xffffffffffffffff, 0x89f3, &(0x7f00000003c0)={'ip6gre0\x00', &(0x7f0000000340)={'syztnl1\x00', 0x0, 0x0, 0x1, 0x3e, 0x4, 0x4, @empty, @initdev={0xfe, 0x88, '\x00', 0x1, 0x0}, 0x8000, 0x10, 0x4, 0x2}}) sendmsg$ETHTOOL_MSG_DEBUG_GET(0xffffffffffffffff, &(0x7f0000000540)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x800000}, 0xc, &(0x7f0000000500)={&(0x7f0000000400)={0xc4, r2, 0x400, 0x70bd29, 0x25dfdbfe, {}, [@HEADER={0xc, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x1}]}, @HEADER={0x34, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'ip6_vti0\x00'}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x1}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'virt_wifi0\x00'}]}, @HEADER={0xc, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x1}]}, @HEADER={0x4}, @HEADER={0x54, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'ip6gretap0\x00'}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r3}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'bridge_slave_1\x00'}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r4}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x3}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r5}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r6}]}, @HEADER={0xc, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0xa6ad69fe7860258a}]}]}, 0xc4}, 0x1, 0x0, 0x0, 0x48000}, 0x0) r7 = bpf$TOKEN_CREATE(0x24, &(0x7f0000000780)={0x0, r0}, 0x8) r8 = bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000740)={&(0x7f0000000580)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0x7e, 0x7e, 0x3, [@int={0x1, 0x0, 0x0, 0x1, 0x0, 0x6c, 0x0, 0x4f, 0x2}, @func={0xf, 0x0, 0x0, 0xc, 0x1}, @float={0x2, 0x0, 0x0, 0x10, 0x4}, @func={0xc, 0x0, 0x0, 0xc, 0x1}, @restrict={0x10, 0x0, 0x0, 0xb, 0x3}, @volatile={0x5, 0x0, 0x0, 0x9, 0x5}, @restrict={0x0, 0x0, 0x0, 0xb, 0x4}, @datasec={0xc, 0x1, 0x0, 0xf, 0x2, [{0x5, 0x12, 0x10000}], "ffae"}, @const={0x4}]}, {0x0, [0x30]}}, &(0x7f0000000640)=""/218, 0x9b, 0xda, 0x1, 0x8, 0x10000, @value=r7}, 0x28) ioctl$BTRFS_IOC_SUBVOL_SETFLAGS(r8, 0x4008941a, &(0x7f00000007c0)=0x2) ioctl$sock_netdev_private(r1, 0x89f9, &(0x7f0000000800)="4d3d8a1c75f6c07d6eaf6dcf2fde6097bcabba09d2678bdfa16f1e3c78065c80c606") r9 = openat$tun(0xffffffffffffff9c, &(0x7f0000000840), 0x6400, 0x0) r10 = accept4$rose(0xffffffffffffffff, &(0x7f0000000880)=@short={0xb, @dev, @default, 0x1, @null}, &(0x7f00000008c0)=0x1c, 0x800) setsockopt$rose(r10, 0x104, 0x1, &(0x7f0000000900)=0x100, 0x4) (async) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f00000009c0)={{0x1, 0xffffffffffffffff}, &(0x7f0000000940), &(0x7f0000000980)}, 0x20) (async, rerun: 64) bpf$BPF_BTF_GET_NEXT_ID(0x17, &(0x7f0000000b80)={0x5, 0x0}, 0x8) (rerun: 64) bpf$PROG_LOAD(0x5, &(0x7f0000000c00)={0x6, 0x14, &(0x7f0000000a00)=@raw=[@initr0={0x18, 0x0, 0x0, 0x0, 0xfff, 0x0, 0x0, 0x0, 0x1}, @initr0={0x18, 0x0, 0x0, 0x0, 0x8b, 0x0, 0x0, 0x0, 0x4}, @ringbuf_output={{0x18, 0x1, 0x1, 0x0, r11}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0x70000}, {}, {}, {}, {}, {0x7, 0x0, 0xb, 0x4, 0x0, 0x0, 0x2}}, @ldst={0x0, 0x2, 0x4, 0xb, 0x7, 0xfffffffffffffffe}, @alu={0x7, 0x0, 0xb, 0x3, 0xb, 0x20, 0xfffffffffffffffc}, @tail_call={{0x18, 0x2, 0x1, 0x0, r8}}], &(0x7f0000000ac0)='GPL\x00', 0x8, 0x0, 0x0, 0x41000, 0x44, '\x00', r4, @fallback=0x19, r8, 0x8, &(0x7f0000000b00)={0x1, 0x5}, 0x8, 0x10, &(0x7f0000000b40)={0x1, 0xa, 0x2, 0x5}, 0x10, r12, 0xffffffffffffffff, 0x4, 0x0, &(0x7f0000000bc0)=[{0x3, 0x2, 0x10, 0x5}, {0x0, 0x1, 0x9, 0x8}, {0x0, 0x2, 0x8, 0x7}, {0x2, 0x5, 0x0, 0xa}], 0x10, 0x5}, 0x94) (async) ioctl$BTRFS_IOC_QUOTA_RESCAN_WAIT(r8, 0x942e, 0x0) (async) ioctl$BTRFS_IOC_DEV_INFO(r1, 0xd000941e, &(0x7f0000000cc0)={0x0, "59a82dfee0b77e4c972524dfe7a94c69"}) ioctl$BTRFS_IOC_DEV_INFO(r9, 0xd000941e, &(0x7f0000001cc0)={r13, "f0a1c87ede9cceacda0cbc31a0542349"}) (async) socket$nl_route(0x10, 0x3, 0x0) (async) r14 = socket(0x11, 0x1, 0x8000) r15 = syz_genetlink_get_family_id$ipvs(&(0x7f0000002d00), r14) sendmsg$IPVS_CMD_DEL_DEST(r14, &(0x7f0000002e00)={&(0x7f0000002cc0)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f0000002dc0)={&(0x7f0000002d40)={0x78, r15, 0x0, 0x70bd26, 0x25dfdbfe, {}, [@IPVS_CMD_ATTR_DAEMON={0x30, 0x3, 0x0, 0x1, [@IPVS_DAEMON_ATTR_MCAST_IFN={0x14, 0x2, 'erspan0\x00'}, @IPVS_DAEMON_ATTR_SYNC_ID={0x8}, @IPVS_DAEMON_ATTR_SYNC_MAXLEN={0x6, 0x4, 0x2}, @IPVS_DAEMON_ATTR_SYNC_MAXLEN={0x6, 0x4, 0xffff}]}, @IPVS_CMD_ATTR_SERVICE={0x18, 0x1, 0x0, 0x1, [@IPVS_SVC_ATTR_ADDR={0x14, 0x3, @ipv6=@mcast1}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4, 0x1}, @IPVS_CMD_ATTR_SERVICE={0xc, 0x1, 0x0, 0x1, [@IPVS_SVC_ATTR_PROTOCOL={0x6, 0x2, 0x2e}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4, 0x6}]}, 0x78}, 0x1, 0x0, 0x0, 0x8000}, 0x2c000011) (async) sendmsg$NL80211_CMD_SET_COALESCE(r14, &(0x7f0000002f80)={&(0x7f0000002e40), 0xc, &(0x7f0000002f40)={&(0x7f0000002f00)={0x40, 0x0, 0x200, 0x70bd2c, 0x25dfdbfe, {{}, {@val={0x8}, @void}}, [@NL80211_ATTR_COALESCE_RULE_PKT_PATTERN={0x10, 0x3, 0x0, 0x1, [{0xc, 0x0, 0x0, 0x1, @NL80211_PKTPAT_OFFSET={0x8, 0x3, 0x111}}]}, @NL80211_ATTR_COALESCE_RULE_CONDITION={0x8}, @NL80211_ATTR_COALESCE_RULE_CONDITION={0x8, 0x2, 0x1}, @NL80211_ATTR_COALESCE_RULE_PKT_PATTERN={0x4}]}, 0x40}, 0x1, 0x0, 0x0, 0x4000002}, 0x4008040) 1.609274095s ago: executing program 1 (id=3581): r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000002c80)={0x3, 0xc, &(0x7f0000000500)=ANY=[@ANYBLOB="1802000002000000000000000000000085000000870000001801000020786c2500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000000700000095"], &(0x7f0000000080)='syzkaller\x00', 0x0, 0x0, 0x0, 0x41000}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f00000002c0)={r0, 0x2000, 0xe, 0x0, &(0x7f0000000100)="e0b9547ed387dbe9abc89b6f5bec", 0x0, 0x2000, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) 1.492585917s ago: executing program 3 (id=3582): bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f00000007c0)=ANY=[@ANYBLOB="1b0000000000000000000000000004"], 0x48) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000200)=@base={0xa, 0x5, 0x2, 0x9, 0x0, 0x1, 0x10000}, 0x50) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=@framed={{0x18, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0xfffffff7}, [@ringbuf_output={{0x18, 0x1, 0x1, 0x0, r0}, {}, {}, {}, {}, {}, {}, {0x85, 0x0, 0x0, 0x3}}]}, &(0x7f0000000400)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback=0xd, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$MAP_UPDATE_BATCH(0x1a, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180), &(0x7f0000000000), 0x9, r0}, 0x38) bpf$PROG_BIND_MAP(0xa, &(0x7f00000003c0)={r1, r0}, 0xc) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) setsockopt$SO_ATTACH_FILTER(r2, 0x1, 0x1a, &(0x7f0000000000)={0x2, &(0x7f00000000c0)=[{0x28, 0x7, 0x0, 0xa56e}, {0x6, 0x0, 0x0, 0xa1a}]}, 0x10) r3 = socket$inet6_mptcp(0xa, 0x1, 0x106) ioctl$sock_inet6_tcp_SIOCOUTQNSD(r3, 0x894b, &(0x7f0000000000)) r4 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)=[{&(0x7f0000000040)="100000002d000b02d25a806f8c6394f9101a04000a", 0x15}], 0x1}, 0x0) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000940)={0x0, 0x0, &(0x7f0000000180)=[{&(0x7f0000000000)="d80000001c0081044e81f782db44b9040a1d08030e000000e8fea4a1180015000600142603600e1208000f1000810401a80016000a0001", 0x37}], 0x1, 0x0, 0x0, 0x7400}, 0x10) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000080)={&(0x7f0000000000)=@in6={0xa, 0x0, 0x0, @mcast1}, 0x80, 0x0, 0x0, 0x0, 0x5c8}, 0x0) write$cgroup_subtree(0xffffffffffffffff, &(0x7f0000000000)=ANY=[@ANYBLOB="8fedcb7907009875f37538e486dd6317ce620300fe"], 0xfe1b) r5 = socket$kcm(0x10, 0x2, 0x0) write$cgroup_subtree(r5, &(0x7f0000000000)=ANY=[@ANYBLOB="563f00001800599c6d0eab070004000523"], 0xfe33) write$cgroup_subtree(r4, &(0x7f0000000000)=ANY=[], 0xfe33) r6 = socket(0x200000000000011, 0x2, 0x0) setsockopt$packet_tx_ring(r6, 0x107, 0xd, &(0x7f0000000040)=@req3={0x10000, 0x100000001, 0x10000, 0x1, 0x0, 0x7fffffff, 0x34}, 0x1c) r7 = openat$ppp(0xffffffffffffff9c, &(0x7f0000001740), 0x101042, 0x0) ioctl$PPPIOCNEWUNIT(r7, 0xc004743e, &(0x7f0000000040)) ioctl$PPPIOCSACTIVE(r7, 0x40047459, &(0x7f0000000080)={0xfffffffffffffe43, 0x0}) syz_init_net_socket$x25(0x9, 0x5, 0x0) socket(0x23, 0x3, 0x7) ioctl$BTRFS_IOC_SNAP_DESTROY_V2(r7, 0x5000943f, &(0x7f00000000c0)={{r7}, 0x0, 0xc, @unused=[0x2, 0x7, 0xdc8, 0x4], @subvolid=0x8000000000a}) r8 = socket$can_bcm(0x1d, 0x2, 0x2) ioctl$ifreq_SIOCGIFINDEX_vcan(r8, 0x8933, &(0x7f0000000100)={'vcan0\x00', 0x0}) connect$can_bcm(r8, &(0x7f00000000c0)={0x1d, r9}, 0x10) bpf$BPF_PROG_QUERY(0x10, &(0x7f00000011c0)={@ifindex=r9, 0x15, 0x0, 0x6, &(0x7f00000010c0)=[0x0, 0x0, 0x0, 0x0, 0x0], 0x5, 0x0, &(0x7f0000001100)=[0x0, 0x0, 0x0, 0x0], &(0x7f0000001140)=[0x0, 0x0, 0x0, 0x0], &(0x7f0000001180)=[0x0]}, 0x40) ioctl$FS_IOC_GETFLAGS(r7, 0x80086601, &(0x7f0000000000)) 1.439032657s ago: executing program 1 (id=3583): r0 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000000)={'ip6gretap0\x00', 0x0}) r2 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r2, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000001c0)=@gettclass={0x24, 0x2a, 0x129, 0x0, 0xfffffffd, {0x0, 0x0, 0x0, r1, {0xb, 0xd}, {}, {0x8, 0xfff1}}}, 0x24}}, 0x40004) recvmmsg(r2, &(0x7f0000001480)=[{{0x0, 0x0, 0x0}, 0x5d}], 0x1, 0x10022, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000040)={'ip6gretap0\x00'}) 1.366373783s ago: executing program 2 (id=3584): r0 = socket$igmp6(0xa, 0x3, 0x2) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000000440)=@raw={'raw\x00', 0x8, 0x3, 0x4c8, 0x0, 0xffffffff, 0xffffffff, 0x0, 0xffffffff, 0x3f8, 0xffffffff, 0xffffffff, 0x3f8, 0xffffffff, 0x3, 0x0, {[{{@ipv6={@private0, @mcast2, [], [], 'veth0_macvtap\x00', 'bridge0\x00'}, 0x0, 0x148, 0x170, 0x0, {}, [@common=@unspec=@helper={{0x48}}, @common=@inet=@hashlimit1={{0x58}, {'bond_slave_1\x00', {0x41, 0x1ff, 0x6, 0xb0e2, 0x10001, 0x84e, 0xfffffffb, 0x18, 0x8}, {0x1}}}]}, @common=@unspec=@NFQUEUE0={0x28}}, {{@ipv6={@remote, @ipv4={'\x00', '\xff\xff', @dev}, [], [], 'erspan0\x00', 'gre0\x00', {0xff}, {}, 0x0, 0x0, 0x0, 0x4b}, 0x0, 0x258, 0x288, 0x0, {}, [@common=@inet=@hashlimit1={{0x58}, {'pim6reg\x00', {0x0, 0x0, 0x5, 0x0, 0x0, 0x7, 0x3ff}}}, @common=@inet=@hashlimit3={{0x158}, {'vcan0\x00', {0x3, 0x0, 0x41, 0xfffffffe, 0x2, 0x1000, 0x6, 0x3}}}]}, @common=@unspec=@CONNMARK={0x30}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28, '\x00', 0x7}}}}, 0x528) ioctl$XFS_IOC_START_COMMIT(r0, 0x80585882, &(0x7f0000000000)={0xffffffffffffffff}) bind$rxrpc(r1, &(0x7f0000000080)=@in4={0x21, 0x2, 0x2, 0x10, {0x2, 0x4e24, @broadcast}}, 0x24) syz_emit_ethernet(0x5e, &(0x7f0000000e00)={@local, @dev, @void, {@ipv6={0x86dd, @icmpv6={0x0, 0x6, "cb653e", 0x28, 0x3a, 0xff, @dev, @local, {[], @ndisc_redir={0x89, 0x0, 0x0, '\x00', @private2, @private1}}}}}}, 0x0) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$batadv(&(0x7f0000000100), r1) sendmsg$BATADV_CMD_GET_HARDIF(r2, &(0x7f00000001c0)={&(0x7f00000000c0), 0xc, &(0x7f0000000180)={&(0x7f0000000140)={0x24, r3, 0x1, 0x70bd2b, 0x25dfdbff, {}, [@BATADV_ATTR_ELP_INTERVAL={0x8, 0x3a, 0x10}, @BATADV_ATTR_GW_BANDWIDTH_DOWN={0x8, 0x31, 0x6}]}, 0x24}, 0x1, 0x0, 0x0, 0x4000}, 0x40) socket$igmp6(0xa, 0x3, 0x2) (async) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000000440)=@raw={'raw\x00', 0x8, 0x3, 0x4c8, 0x0, 0xffffffff, 0xffffffff, 0x0, 0xffffffff, 0x3f8, 0xffffffff, 0xffffffff, 0x3f8, 0xffffffff, 0x3, 0x0, {[{{@ipv6={@private0, @mcast2, [], [], 'veth0_macvtap\x00', 'bridge0\x00'}, 0x0, 0x148, 0x170, 0x0, {}, [@common=@unspec=@helper={{0x48}}, @common=@inet=@hashlimit1={{0x58}, {'bond_slave_1\x00', {0x41, 0x1ff, 0x6, 0xb0e2, 0x10001, 0x84e, 0xfffffffb, 0x18, 0x8}, {0x1}}}]}, @common=@unspec=@NFQUEUE0={0x28}}, {{@ipv6={@remote, @ipv4={'\x00', '\xff\xff', @dev}, [], [], 'erspan0\x00', 'gre0\x00', {0xff}, {}, 0x0, 0x0, 0x0, 0x4b}, 0x0, 0x258, 0x288, 0x0, {}, [@common=@inet=@hashlimit1={{0x58}, {'pim6reg\x00', {0x0, 0x0, 0x5, 0x0, 0x0, 0x7, 0x3ff}}}, @common=@inet=@hashlimit3={{0x158}, {'vcan0\x00', {0x3, 0x0, 0x41, 0xfffffffe, 0x2, 0x1000, 0x6, 0x3}}}]}, @common=@unspec=@CONNMARK={0x30}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28, '\x00', 0x7}}}}, 0x528) (async) ioctl$XFS_IOC_START_COMMIT(r0, 0x80585882, &(0x7f0000000000)) (async) bind$rxrpc(r1, &(0x7f0000000080)=@in4={0x21, 0x2, 0x2, 0x10, {0x2, 0x4e24, @broadcast}}, 0x24) (async) syz_emit_ethernet(0x5e, &(0x7f0000000e00)={@local, @dev, @void, {@ipv6={0x86dd, @icmpv6={0x0, 0x6, "cb653e", 0x28, 0x3a, 0xff, @dev, @local, {[], @ndisc_redir={0x89, 0x0, 0x0, '\x00', @private2, @private1}}}}}}, 0x0) (async) socket$nl_generic(0x10, 0x3, 0x10) (async) syz_genetlink_get_family_id$batadv(&(0x7f0000000100), r1) (async) sendmsg$BATADV_CMD_GET_HARDIF(r2, &(0x7f00000001c0)={&(0x7f00000000c0), 0xc, &(0x7f0000000180)={&(0x7f0000000140)={0x24, r3, 0x1, 0x70bd2b, 0x25dfdbff, {}, [@BATADV_ATTR_ELP_INTERVAL={0x8, 0x3a, 0x10}, @BATADV_ATTR_GW_BANDWIDTH_DOWN={0x8, 0x31, 0x6}]}, 0x24}, 0x1, 0x0, 0x0, 0x4000}, 0x40) (async) 1.365067323s ago: executing program 0 (id=3585): r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$IPVS_CMD_SET_INFO(r2, &(0x7f0000000b00)={0x0, 0x0, &(0x7f0000000ac0)={0x0, 0x14}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000380)=ANY=[@ANYBLOB="3c0000001000850600"/20, @ANYRES32=r3, @ANYBLOB="01000000000000001c0012000c000100626f6e64000000000c0002000800010006"], 0x3c}}, 0x0) sendmsg$nl_route(r1, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000140)=@newlink={0x3c, 0x10, 0xffffff1f, 0x0, 0x1, {}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @veth={{0x9}, {0x4, 0x2, 0x0, 0x1, @void}}}, @IFLA_MASTER={0x8, 0xa, r3}]}, 0x3c}, 0x1, 0x0, 0x0, 0x40000}, 0x0) r4 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r4, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000540)={&(0x7f0000000180)=@newlink={0x3c, 0x10, 0xff05, 0x0, 0x0, {0x0, 0x0, 0x4a00}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @batadv={{0xb}, {0x4}}}, @IFLA_MASTER={0x8, 0xa, r3}]}, 0x3c}}, 0x0) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(0xffffffffffffffff, 0x89f2, &(0x7f00000000c0)={'syztnl0\x00', &(0x7f0000000040)={'syztnl0\x00', 0x0, 0x6, 0x1, 0x6, 0x9, 0x6d, @ipv4={'\x00', '\xff\xff', @remote}, @loopback, 0x8, 0x7810, 0x7, 0x5b}}) sendmsg$nl_route(r0, &(0x7f00000001c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x8000}, 0xc, &(0x7f0000000180)={&(0x7f0000000100)=@ipv6_getnexthop={0x54, 0x6a, 0x100, 0x70bd2b, 0x25dfdbfc, {}, [@NHA_OIF={0x8}, @NHA_ID={0x8, 0x1, 0x2}, @NHA_MASTER={0x8, 0xa, 0x2}, @NHA_OIF={0x8, 0x5, r3}, @NHA_ID={0x8}, @NHA_MASTER={0x8}, @NHA_FDB={0x4}, @NHA_OIF={0x8, 0x5, r5}]}, 0x54}, 0x1, 0x0, 0x0, 0x4000000}, 0x20004840) 1.16744784s ago: executing program 1 (id=3586): bpf$MAP_CREATE(0x0, &(0x7f0000000240)=ANY=[@ANYBLOB="1000000004000000080000000500000000000000", @ANYRES32, @ANYBLOB='\x00'/18, @ANYRES32=0x0, @ANYRES32, @ANYBLOB="000000fae44e9100000000000000000015"], 0x48) r0 = socket$inet_mptcp(0x2, 0x1, 0x106) shutdown(r0, 0x0) shutdown(r0, 0x1) sendmsg$inet(r0, &(0x7f0000001040)={0x0, 0x0, 0x0}, 0x20008005) r1 = socket$inet_udplite(0x2, 0x2, 0x88) setsockopt$IPT_SO_SET_REPLACE(r1, 0x0, 0x40, &(0x7f0000000040)=@raw={'raw\x00', 0x8, 0x3, 0x490, 0x0, 0xa, 0x148, 0x0, 0x60, 0x3f8, 0x2a8, 0x2a8, 0x3f8, 0x2a8, 0x3, 0x0, {[{{@ip={@multicast2, @multicast2, 0x0, 0x0, 'bridge0\x00', 'rose0\x00', {}, {}, 0xff, 0x0, 0x61}, 0x0, 0x2c8, 0x338, 0x0, {0x200003ae, 0x7f00}, [@common=@inet=@socket2={{0x28}, 0x1}, @common=@unspec=@bpf1={{0x230, 'bpf\x00', 0x0}, @pinned={0x1, 0x8601, 0x6, './file0\x00'}}]}, @common=@unspec=@NFLOG={0x70, 'NFLOG\x00', 0x0, {0x0, 0x0, 0x0, 0x0, 0x0, "f2f7b9f28413d9d8ad470ad2b60c45cb4ea6e7bf902bdc2ff8a9304d9f655c746adc0bdc773506378bc2d27efd6abb05175089830cc46186074d7de46d5af300"}}}, {{@ip={@multicast1, @empty, 0x0, 0x0, 'syzkaller0\x00', 'veth0_to_team\x00', {}, {}, 0x0, 0x0, 0x20}, 0x0, 0x98, 0xc0, 0x0, {}, [@inet=@rpfilter={{0x28}, {0xc}}]}, @common=@unspec=@MARK={0x28}}], {{'\x00', 0xc8, 0x70, 0x98}, {0x28}}}}, 0x4f0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) setsockopt$SO_ATTACH_FILTER(r2, 0x1, 0x1a, &(0x7f0000000040)={0x3, &(0x7f0000000140)=[{0x20, 0x0, 0xe9, 0xfffff024}, {0x2d, 0x0, 0x0, 0x8000}, {0x6, 0x0, 0x4}]}, 0x10) r3 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$wireguard(&(0x7f0000000540), r3) ioctl$sock_inet_SIOCSIFDSTADDR(r1, 0x8918, &(0x7f0000000000)={'erspan0\x00', {0x2, 0x4e20, @dev={0xac, 0x14, 0x14, 0x40}}}) 871.851839ms ago: executing program 2 (id=3587): getsockopt$inet_sctp6_SCTP_ASSOCINFO(0xffffffffffffffff, 0x84, 0x1, &(0x7f0000000000)={0x0, 0xfc00, 0x0, 0x0, 0xffffffff, 0x4}, &(0x7f0000000040)=0x14) setsockopt$inet_sctp6_SCTP_AUTH_DELETE_KEY(0xffffffffffffffff, 0x84, 0x19, &(0x7f0000000080)={r0, 0xf7d}, 0x8) r1 = socket$inet6_sctp(0xa, 0x5, 0x84) bpf$MAP_CREATE(0x0, 0x0, 0x0) r2 = socket$inet_icmp_raw(0x2, 0x3, 0x1) sendto$inet(r2, &(0x7f0000000540)="0b09207965b0b9f1", 0xffeb, 0x4000000, &(0x7f0000000340), 0x10) getsockopt$inet_sctp6_SCTP_RECONFIG_SUPPORTED(0xffffffffffffffff, 0x84, 0x75, &(0x7f00000000c0)={r0, 0xfffffffc}, &(0x7f0000000100)=0x8) r3 = syz_init_net_socket$llc(0x1a, 0x1, 0x0) syz_emit_ethernet(0x1f, &(0x7f0000000040)=ANY=[@ANYBLOB="ffffffffce2a0000000000000011424203"], 0x0) setsockopt$inet_sctp6_SCTP_RTOINFO(r1, 0x84, 0x0, &(0x7f0000000840)={r0, 0xf31b0000, 0x5, 0x1}, 0x10) setsockopt$SO_BINDTODEVICE(r3, 0x1, 0x19, &(0x7f0000000280)='gre0\x00', 0x10) sendmmsg(r3, &(0x7f0000000cc0)=[{{&(0x7f0000000100)=@caif=@dgm={0x25, 0xc, 0x4}, 0x80, 0x0, 0x0, &(0x7f0000000640)=ANY=[], 0x540}}], 0x1, 0x8000) ioctl$XFS_IOC_ATTRMULTI_BY_HANDLE(r3, 0x4048587b, &(0x7f0000000740)={{0xffffffffffffffff, &(0x7f0000000440)='\'[{$\x00', 0x200, &(0x7f0000000480)={@align=0x7fff, {0x39, 0x7, 0xe, 0x3}}, 0x3, &(0x7f00000004c0)={@_ha_fsid}, &(0x7f0000000500)=0xfff}, 0x2, &(0x7f0000000700)=[{0x2, 0x3c64, &(0x7f0000000580)='\x00', &(0x7f00000005c0)="624140cceb019f3eb30f7b72c23981fdf0e4bc0f2a42f612da50555a77db02653cc1c57bf9767d7bbdd9bece9761dc0fd4fcbebe075c954a636353ad5eb0944a7e3ba2bb7d5661253e9d1048bb9cf24b0e336fbee9e57995728ed3ff49791eebe8421524cb9e1a06505a7a18af91de482f4a0b534827771d06a7ccf9e3367b1aa1c0bb09", 0x84, 0x2}, {0x1, 0x800, &(0x7f0000000680)='\x00', &(0x7f00000006c0)="cc0da096c1f2d9014b8ed7fba140485fc172970fd2656a63a28b42c3dd378a77a283cec8", 0x24, 0x62}]}) ioctl$sock_ipv6_tunnel_SIOCCHGTUNNEL(r4, 0x89f3, &(0x7f0000000400)={'ip6gre0\x00', &(0x7f0000000380)={'ip6gre0\x00', 0x0, 0x29, 0x8, 0x9, 0x0, 0x35, @ipv4={'\x00', '\xff\xff', @empty}, @loopback, 0x700, 0x40, 0x6, 0x3}}) r6 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000980)={0x1f, 0x3, &(0x7f0000000a40)=ANY=[], &(0x7f0000000180)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x11, '\x00', r5, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x7fffffff}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000900)={r6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f00000008c0)="89", 0x0}, 0x32) bpf$PROG_LOAD(0x5, &(0x7f0000000580)={0x3, 0x3, &(0x7f0000000d00)=ANY=[@ANYRES32=r6, @ANYRESOCT=r6, @ANYBLOB="ea8ed21a417c95899ba12c2a560cc18aef12e4184d733eaa6ed698877a66f10f2eba300c948d7020eafde7d09e1a92255f2296bf7a2ebf44dd3f13636cde2f50ce0132663f051a97f7bd0e79b2a35d086b0674482d54001f8504356f6718f5e86bb8113f5078f3b421b6733bd2ff1704f2abdb6fb8182588cf33dd54757a57213677bd819630c9424df4c30e26f5da6ee9e86dfaa31b97d6f44f06b8ca84ff0fc692632a49efe9", @ANYBLOB="73032b1eb6e73fb7efd0381061650c695c5002793db9497dbc56afda0da7e39dac0f4fe800eabfddad6779974a633abdad64fa830eec1807db0b72be7a4db3b7e243776fbd4e881d0fddd7754a29b6ac5c6be598dc4eae5859f657309e3c5189d3d63d98a86b8db49cee52403b3a818d51156206285a6af73246fe9022288159a2243f35fbf6db78a6b41092c223342c7e049f1d26b568e4b26ef3947276d686201cb3a97ad4e161a0e6e616a1f3a37875a142fa1bc11c85aa09c7d552298dc187da5f1142e48e1c2eb0000288c13c8c7cef320ea528c76730c28077545ee565504be323"], 0x0, 0x0, 0x0, 0x0, 0x41000, 0x65, '\x00', 0x0, @fallback=0x13, r4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000100)=@bpf_ext={0x1c, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x41100, 0x50, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x1313f, 0xffffffffffffffff, 0x0, 0x0, &(0x7f0000000000)}, 0x94) r7 = openat$tun(0xffffffffffffff9c, &(0x7f0000000280), 0x42000, 0x0) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) close(r7) r8 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$TUNSETOFFLOAD(r8, 0xc004743e, 0x110e22fff6) ioctl$TUNGETVNETLE(r7, 0x4010744d, &(0x7f0000000180)) r9 = socket(0x2, 0x80805, 0x0) getsockopt$inet_sctp_SCTP_MAX_BURST(r9, 0x84, 0x14, &(0x7f0000000000)=@assoc_value, &(0x7f0000001080)=0x4) r10 = bpf$MAP_CREATE(0x0, &(0x7f0000000a40)=ANY=[@ANYBLOB="000000000b000000420010003e00000042000000", @ANYRES32, @ANYBLOB='\x00'/20, @ANYRES32=0x0, @ANYRES32, @ANYBLOB="00000000000000000000000000000000000000e6ffb59f0e0f2a80908b72f343421c84f49b90b98aa107f3b014107bcbe946ea36932594db529511ecde40fa8ff5eeb6f22916555e136aa8f1cbe4a7ef31aaea41d01d476da25b864feea43afcdf4c15866a8c65ea3f63c9b90f4f0a3ab144760a7042e779f0a58b5499d608e0aa8e78b0ac1e377df10234dff0eddc5a570000000000653170210edd5d190b1cc8acce83b1c83f311975df2dbcb82afe2a84f94084c8c18f8f7723d38abc85d05fa27c6bbdc11cac47800dc0d8f355c4bb980e56305d50c05a5f119720f4e23d2d213f73f9e8afe84429fa0193648956042f3e4e92091c19ae4afba23c6d55e309b29836eb4e7004f877b1ed1e14c6a2c07c138c61c1000000"], 0x50) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000300)={{r10, 0xffffffffffffffff}, &(0x7f0000000100), &(0x7f0000000180)}, 0x20) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f00000002c0)={{r11}, &(0x7f0000000140), &(0x7f0000000280)}, 0x20) bpf$MAP_CREATE(0x0, 0x0, 0x0) 762.000853ms ago: executing program 0 (id=3588): r0 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="02000000040000000800000001"], 0x50) bpf$PROG_LOAD(0x5, &(0x7f0000000540)={0xb, 0x1c, &(0x7f0000000d80)=ANY=[@ANYBLOB="18080000cbb60000000000000000000218110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b702000014000000b7030000000000008500000005000000bf0900000000000035090100000000009500000000000000b70200001fffffff7b9af8ff00000000d6090000000000007baaf0ff00000000bf2720000000000007080000fffdffffbf9400000000000007040000f0ffffff640200000800000018220000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7050000081c00004608f0ff76000000bf980000000000005e08000000000000856eaa0005000000b70700000000000095"], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000000}, 0x94) 760.029371ms ago: executing program 1 (id=3589): r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) sendmsg$NL80211_CMD_CRIT_PROTOCOL_START(r1, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000540)={0x0, 0x1c}}, 0x0) getsockname$packet(r1, &(0x7f0000000600)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000080)=0x14) sendmsg$nl_route(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000640)=ANY=[@ANYBLOB="3c0000001000850600000000ff6122314a000800", @ANYRES32=r2, @ANYBLOB="f5ff0f00252155b21c0012000c000100626f6e64000000000c0002000800010001"], 0x3c}}, 0x40000) r3 = socket(0x10, 0x803, 0x2) syz_genetlink_get_family_id$mptcp(&(0x7f00000000c0), r3) getsockname$packet(r3, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) r5 = socket$inet6_tcp(0xa, 0x1, 0x0) ioctl$sock_inet6_SIOCSIFADDR(r5, 0x8916, &(0x7f0000000100)={@ipv4={'\x00', '\xff\xff', @multicast2}, 0x56, r2}) r6 = socket$inet6_sctp(0xa, 0x5, 0x84) ioctl$sock_inet6_SIOCSIFADDR(r6, 0x8916, &(0x7f0000000180)={@rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02', 0x2d, r4}) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000240)=@newlink={0x50, 0x10, 0x503, 0x0, 0x700, {0x0, 0x0, 0x0, 0x0, 0x0, 0x1006}, [@IFLA_LINKINFO={0x28, 0x12, 0x0, 0x1, @gre={{0x8}, {0x1c, 0x2, 0x0, 0x1, [@IFLA_GRE_LOCAL={0x8, 0x6, @local}, @IFLA_GRE_ENCAP_DPORT={0x6, 0x11, 0x4e20}, @IFLA_GRE_ENCAP_SPORT={0x6, 0x10, 0x4e20}]}}}, @IFLA_MASTER={0x8, 0xa, r2}]}, 0x50}, 0x1, 0x0, 0x0, 0x800}, 0x2004c030) socket$netlink(0x10, 0x3, 0x0) (async) socket(0x10, 0x803, 0x0) (async) sendmsg$NL80211_CMD_CRIT_PROTOCOL_START(r1, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000540)={0x0, 0x1c}}, 0x0) (async) getsockname$packet(r1, &(0x7f0000000600)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000080)=0x14) (async) sendmsg$nl_route(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000640)=ANY=[@ANYBLOB="3c0000001000850600000000ff6122314a000800", @ANYRES32=r2, @ANYBLOB="f5ff0f00252155b21c0012000c000100626f6e64000000000c0002000800010001"], 0x3c}}, 0x40000) (async) socket(0x10, 0x803, 0x2) (async) syz_genetlink_get_family_id$mptcp(&(0x7f00000000c0), r3) (async) getsockname$packet(r3, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) (async) socket$inet6_tcp(0xa, 0x1, 0x0) (async) ioctl$sock_inet6_SIOCSIFADDR(r5, 0x8916, &(0x7f0000000100)={@ipv4={'\x00', '\xff\xff', @multicast2}, 0x56, r2}) (async) socket$inet6_sctp(0xa, 0x5, 0x84) (async) ioctl$sock_inet6_SIOCSIFADDR(r6, 0x8916, &(0x7f0000000180)={@rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02', 0x2d, r4}) (async) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000240)=@newlink={0x50, 0x10, 0x503, 0x0, 0x700, {0x0, 0x0, 0x0, 0x0, 0x0, 0x1006}, [@IFLA_LINKINFO={0x28, 0x12, 0x0, 0x1, @gre={{0x8}, {0x1c, 0x2, 0x0, 0x1, [@IFLA_GRE_LOCAL={0x8, 0x6, @local}, @IFLA_GRE_ENCAP_DPORT={0x6, 0x11, 0x4e20}, @IFLA_GRE_ENCAP_SPORT={0x6, 0x10, 0x4e20}]}}}, @IFLA_MASTER={0x8, 0xa, r2}]}, 0x50}, 0x1, 0x0, 0x0, 0x800}, 0x2004c030) (async) 718.338978ms ago: executing program 4 (id=3590): socket$nl_netfilter(0x10, 0x3, 0xc) r0 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x6, 0xc, &(0x7f00000006c0)=ANY=[@ANYBLOB="1800000000000000000000000046d100180100002020702500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000000000000b7030000000008208500000073000000850000000700000095"], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x40, '\x00', 0x0, @xdp=0x25, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000140)={r0, 0x18000000000002a0, 0xe, 0x0, &(0x7f0000000200)="9e36d448b388dd965f7a331286dd", 0x0, 0xbffffffa, 0xe8030000, 0x0, 0x0, 0x0, 0x0}, 0x50) r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=@newlink={0x44, 0x10, 0x403, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x32844, 0xc1}, [@IFLA_LINKINFO={0x18, 0x12, 0x0, 0x1, @ip6erspan={{0xe}, {0x4}}}, @IFLA_ADDRESS={0xa, 0x1, @dev={'\xaa\xaa\xaa\xaa\xaa', 0xfc}}]}, 0x44}}, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000007c0)={0x10, 0x2, &(0x7f0000000100)=@raw=[@ldst={0x1, 0x2, 0x4, 0x0, 0x1, 0x38}, @jmp={0x5, 0x0, 0x9, 0x0, 0x6, 0xfffffffffffffe88}], &(0x7f0000000000)='GPL\x00', 0x2, 0x0, 0x0, 0x0, 0x40, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x1}, 0x94) 698.8612ms ago: executing program 0 (id=3591): r0 = socket$kcm(0x11, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f0000001780)={&(0x7f00000003c0)=@caif=@dgm={0x25, 0x7, 0x4}, 0x80, &(0x7f0000000040)=[{&(0x7f0000000840)='O', 0x1}], 0x1}, 0x4008000) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = socket$nl_xfrm(0x10, 0x3, 0x6) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000000)={'bond0\x00', 0x0}) sendmsg$nl_xfrm(r2, &(0x7f0000000540)={0x0, 0x0, &(0x7f0000000500)={&(0x7f0000000580)=ANY=[@ANYBLOB="c4000000190001050000000000000000fc000000000000000000000000000000e000000200000000000000000000000000000000000000000200000000000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000c001c00", @ANYRES32=r3, @ANYBLOB="04"], 0xc4}, 0x1, 0x0, 0x0, 0x20004015}, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0xb, 0xc3072, 0xffffffffffffffff, 0x0) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) recvmsg$unix(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000440)=[@rights={{0x10}}], 0x10}, 0x0) ioctl$SIOCSIFHWADDR(0xffffffffffffffff, 0x8914, &(0x7f0000000040)={'syzkaller1\x00', @multicast}) r5 = socket$l2tp(0x2, 0x2, 0x73) r6 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='memory.events\x00', 0x275a, 0x0) write$cgroup_subtree(r6, &(0x7f0000000000)=ANY=[], 0x32600) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x2000001, 0x12, r6, 0x0) setsockopt$IPT_SO_SET_REPLACE(r5, 0x0, 0x40, &(0x7f0000000000)=@mangle={'mangle\x00', 0x44, 0x6, 0x3c8, 0x298, 0x168, 0x0, 0x0, 0x200, 0x370, 0x370, 0x370, 0x370, 0x370, 0x6, 0x0, {[{{@ip={@multicast1, @dev={0xac, 0x14, 0x14, 0x13}, 0xff, 0xff000000, 'pim6reg1\x00', 'bridge_slave_0\x00', {}, {0xff}, 0x88, 0x3}, 0x0, 0x70, 0x98}, @common=@unspec=@STANDARD={0x28, '\x00', 0x0, 0x298}}, {{@ip={@private=0xa010100, @local, 0x0, 0x0, 'vcan0\x00', 'veth0_virt_wifi\x00', {}, {0xff}}, 0x0, 0x70, 0xd0}, @common=@SET={0x60, 'SET\x00', 0x0, {{}, {0x0, [0x0, 0x0, 0x0, 0x2, 0x4, 0x11000000]}}}}, {{@uncond, 0x0, 0x70, 0x98}, @unspec=@CHECKSUM={0x28}}, {{@ip={@private=0xa010102, @multicast1, 0x0, 0xffffff00, 'syzkaller0\x00', 'bond0\x00'}, 0x0, 0x70, 0x98}, @unspec=@CHECKSUM={0x28}}, {{@ip={@remote, @initdev={0xac, 0x1e, 0x1, 0x0}, 0x0, 0x0, 'lo\x00', 'batadv_slave_1\x00'}, 0x0, 0x70, 0x98}, @ECN={0x28}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x428) sendmsg$NFT_BATCH(r4, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000080)={{0x14}, [@NFT_MSG_NEWTABLE={0x20, 0x0, 0xa, 0x101, 0x0, 0x0, {0x1}, [@NFTA_TABLE_NAME={0x9, 0x1, 'syz0\x00'}]}, @NFT_MSG_NEWCHAIN={0x2c, 0x3, 0xa, 0x201, 0x0, 0x0, {0x1, 0x0, 0xa}, [@NFTA_CHAIN_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_CHAIN_NAME={0x9, 0x3, 'syz0\x00'}]}, @NFT_MSG_NEWRULE={0x50, 0x6, 0xa, 0x401, 0x0, 0x0, {0x1}, [@NFTA_RULE_CHAIN_ID={0x8}, @NFTA_RULE_EXPRESSIONS={0x28, 0x4, 0x0, 0x1, [{0x24, 0x1, 0x0, 0x1, @cmp={{0x8}, @val={0x18, 0x2, 0x0, 0x1, [@NFTA_CMP_DATA={0x4}, @NFTA_CMP_OP={0x8}, @NFTA_CMP_SREG={0x8}]}}}]}, @NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x7}}}, 0xc4}}, 0x0) mmap(&(0x7f0000400000/0x3000)=nil, 0x3000, 0x2000009, 0x4d032, 0xffffffffffffffff, 0x0) r7 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r7, &(0x7f0000007940)={0x0, 0x0, &(0x7f0000007900)={&(0x7f0000003c40)=@newtaction={0xac, 0x30, 0x216822a75a8bdd29, 0x0, 0x0, {}, [{0x98, 0x1, [@m_ct={0x44, 0x1, 0x0, 0x0, {{0x7}, {0x1c, 0x2, 0x0, 0x1, [@TCA_CT_PARMS={0x18}]}, {0x4}, {0xc}, {0xc}}}, @m_connmark={0x50, 0x2, 0x0, 0x0, {{0xd}, {0x20, 0x2, 0x0, 0x1, [@TCA_CONNMARK_PARMS={0x1c, 0x1, {{0x0, 0xfffffffe, 0x20000001}}}]}, {0x4}, {0xc}, {0xc, 0x8, {0x0, 0x3}}}}]}]}, 0xac}}, 0x0) bpf$PROG_LOAD_XDP(0x5, 0x0, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x204000) r8 = syz_genetlink_get_family_id$devlink(&(0x7f0000000140), r1) sendmsg$DEVLINK_CMD_RATE_GET(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000000c0)={0x14, r8, 0x301, 0x70bd2a, 0x25dfdbfd, {0x5}}, 0x14}, 0x1, 0x0, 0x0, 0x40014}, 0x0) r9 = socket$kcm(0x10, 0x3, 0x10) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000480)={&(0x7f00000004c0)=@delchain={0x40, 0x65, 0x2, 0x70bd27, 0x25dfdbfa, {0x0, 0x0, 0x0, 0x0, {0xfff2, 0x8}, {0x0, 0x7}, {0x0, 0x8}}, [@TCA_RATE={0x6, 0x5, {0xdc, 0x5}}, @TCA_CHAIN={0x8, 0xb, 0x6}, @filter_kind_options=@f_bpf={{0x8}, {0x4}}]}, 0x40}, 0x1, 0x0, 0x0, 0x81}, 0x20000080) sendmsg$kcm(r9, &(0x7f0000000000)={0x0, 0xffffff0a, &(0x7f0000000080)=[{&(0x7f0000000040)="c01803002e000b12d25a80648c2594f90324fc60180c02400a000000053582c137153e370248078000f01700d1bd", 0x33fe0}], 0x1}, 0x0) sendmsg$NFNL_MSG_CTHELPER_NEW(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000080)=ANY=[@ANYBLOB="640000000009010800000000000000000000000008000540000000000900010073797a30000000003c0002002c00018014000300ff01000000000000000000000000000114000400fc0100000000000000000000000000000c000280c0fd50309f0500010000000000"], 0x64}}, 0x0) r10 = syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10) sendmsg$netlink(r10, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000040)=ANY=[@ANYBLOB="280100002f00010000000000fcdbdf250801f2800c00180008ac0f000010000014000100fc00000000000000000000000000000008004400", @ANYRES32=0x0, @ANYBLOB="d900"], 0x128}], 0x1, 0x0, 0x0, 0x1}, 0x0) 597.052466ms ago: executing program 3 (id=3592): r0 = socket$inet_tcp(0x2, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000180)={'syz_tun\x00', 0x0}) (async) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x2e, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) (async) r2 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="19000000040000000800000008"], 0x48) r3 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="180000000000000000000000000001b518110000", @ANYRES32=r2], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8}, 0x94) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000600)={{r2}, &(0x7f0000000000), &(0x7f00000005c0)=r3}, 0x20) r4 = socket$inet_mptcp(0x2, 0x1, 0x106) setsockopt$inet_int(r4, 0x0, 0x33, &(0x7f0000000000)=0x80020000, 0x4) (async) listen(r4, 0x2) r5 = socket$netlink(0x10, 0x3, 0x8000000004) writev(r5, &(0x7f00000002c0)=[{&(0x7f0000000040)="580000001400192340834b80040d8c560a067fbc45ff81054e220000000058000b480400945f64009400050038925a01000000000000008004000000ffe809000000fff5dd0000000800030006010000418e01400004fcff", 0x58}], 0x1) (async) r6 = bpf$PROG_LOAD(0x5, &(0x7f0000000500)={0x6, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='syzkaller\x00', 0x0, 0x0, 0x0, 0x41000, 0xc, '\x00', 0x0, @fallback=0x2, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f0000000000)={r6, r1, 0x25, 0x4, @void}, 0x10) (async) syz_emit_ethernet(0x16, &(0x7f0000000000)={@local, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x3f}, @void, {@mpls_uc={0x8847, {[], @llc={@snap={0x0, 0xaa, "a4", "93a681", 0x1a}}}}}}, 0x0) 530.278564ms ago: executing program 2 (id=3593): r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000000)='memory.swap.current\x00', 0x275a, 0x0) write$cgroup_int(r0, &(0x7f0000000300)=0x400000000009, 0xfffffffffffffd83) mmap(&(0x7f0000000000/0x4000)=nil, 0x4000, 0x4000003, 0x13, r0, 0x0) (async) mmap(&(0x7f0000000000/0x4000)=nil, 0x4000, 0x4000003, 0x13, r0, 0x0) socket(0x28, 0x5, 0x0) (async) r1 = socket(0x28, 0x5, 0x0) r2 = syz_genetlink_get_family_id$tipc(&(0x7f00000000c0), 0xffffffffffffffff) r3 = socket$inet6_mptcp(0xa, 0x1, 0x106) listen(r3, 0x0) (async) listen(r3, 0x0) r4 = socket$tipc(0x1e, 0x5, 0x0) bind$tipc(r4, &(0x7f0000000200)=@nameseq={0x1e, 0x1, 0x3, {0x42}}, 0x10) (async) bind$tipc(r4, &(0x7f0000000200)=@nameseq={0x1e, 0x1, 0x3, {0x42}}, 0x10) r5 = socket$tipc(0x1e, 0x5, 0x0) bind$tipc(r5, &(0x7f0000000200)=@nameseq={0x1e, 0x1, 0x2, {0x42, 0x0, 0xfffffffd}}, 0x10) socket$tipc(0x1e, 0x5, 0x0) connect$inet6(r1, &(0x7f0000000100)={0xa, 0x4e24, 0x1, @dev={0xfe, 0x80, '\x00', 0x12}, 0x9}, 0x1c) (async) connect$inet6(r1, &(0x7f0000000100)={0xa, 0x4e24, 0x1, @dev={0xfe, 0x80, '\x00', 0x12}, 0x9}, 0x1c) bind$tipc(0xffffffffffffffff, &(0x7f00000000c0)=@nameseq={0x1e, 0x1, 0x0, {0x42}}, 0x10) sendmsg$TIPC_CMD_SHOW_NAME_TABLE(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000180)={0x30, r2, 0x1, 0x8001, 0x25dfdbfe, {{}, {}, {0x14, 0x19, {0x3, 0x1, 0x1, 0x6}}}}, 0xffffffffffffff9d}}, 0x0) bind$vsock_stream(r1, &(0x7f00000002c0)={0x28, 0x0, 0x0, @local}, 0x10) listen(r1, 0x0) r6 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r6, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) openat$tun(0xffffffffffffff9c, &(0x7f0000000380), 0x466902, 0x0) (async) openat$tun(0xffffffffffffff9c, &(0x7f0000000380), 0x466902, 0x0) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup/syz0\x00', 0x1ff) mkdirat$cgroup_root(0xffffffffffffff9c, 0x0, 0x1ff) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) (async) r7 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r8 = openat$cgroup_procs(r7, &(0x7f0000000280)='cgroup.threads\x00', 0x2, 0x0) socket$inet6_sctp(0xa, 0x5, 0x84) (async) socket$inet6_sctp(0xa, 0x5, 0x84) pread64(r8, &(0x7f00000001c0)=""/100, 0x64, 0x6) (async) pread64(r8, &(0x7f00000001c0)=""/100, 0x64, 0x6) r9 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) close(r9) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)) ioctl$SIOCSIFHWADDR(r9, 0x8943, &(0x7f0000002280)={'syzkaller0\x00', @random="000600000102"}) (async) ioctl$SIOCSIFHWADDR(r9, 0x8943, &(0x7f0000002280)={'syzkaller0\x00', @random="000600000102"}) 358.719856ms ago: executing program 2 (id=3594): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000880)={{0x14}, [@NFT_MSG_NEWTABLE={0x20, 0x0, 0xa, 0x101, 0x0, 0x0, {0x1, 0x0, 0x3}, [@NFTA_TABLE_NAME={0x9, 0x1, 'syz1\x00'}]}, @NFT_MSG_NEWSETELEM={0x76c, 0xc, 0xa, 0x201, 0x0, 0x0, {0x1, 0x0, 0x3}, [@NFTA_SET_ELEM_LIST_SET_ID={0x8, 0x4, 0x1, 0x0, 0x2}, @NFTA_SET_ELEM_LIST_SET_ID={0x8, 0x4, 0x1, 0x0, 0xfffffffe}, @NFTA_SET_ELEM_LIST_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_SET_ELEM_LIST_ELEMENTS={0x734, 0x3, 0x0, 0x1, [{0x4}, {0xa0, 0x0, 0x0, 0x1, [@NFTA_SET_ELEM_EXPR={0x20, 0x7, 0x0, 0x1, @fwd={{0x8}, @val={0x14, 0x2, 0x0, 0x1, [@NFTA_FWD_NFPROTO={0x8, 0x3, 0x1, 0x0, 0xa}, @NFTA_FWD_NFPROTO={0x8, 0x3, 0x1, 0x0, 0xa}]}}}, @NFTA_SET_ELEM_EXPRESSIONS={0x70, 0xb, 0x0, 0x1, [{0x10, 0x1, 0x0, 0x1, @redir={{0xa}, @void}}, {0x20, 0x1, 0x0, 0x1, @synproxy={{0xd}, @val={0xc, 0x2, 0x0, 0x1, [@NFTA_SYNPROXY_WSCALE={0x5, 0x2, 0x6}]}}}, {0x2c, 0x1, 0x0, 0x1, @exthdr={{0xb}, @val={0x1c, 0x2, 0x0, 0x1, [@NFTA_EXTHDR_OFFSET={0x8, 0x3, 0x1, 0x0, 0xcb}, @NFTA_EXTHDR_OP={0x8}, @NFTA_EXTHDR_FLAGS={0x8}]}}}, {0x10, 0x1, 0x0, 0x1, @bitwise={{0xc}, @val={0x0, 0x2, 0x0, 0x1, [@NFTA_BITWISE_MASK={0x0, 0x4, 0x0, 0x1, [@NFTA_DATA_VALUE={0x0, 0x1, "ce1594d9470749b81883b9ad21f28724b28b240888f8cbb829fcd549275de87b84124f0418f376d4725de61c06dffa2e324dbc5111f772c9c1a49e68c5db378f1b632b9ed21d53cc"}, @NFTA_DATA_VALUE={0x0, 0x1, "fc5a9572d45952f3de7061b08339dd76b86a75ccd422423ba254b368c3438c3784c11d232434a1c2ac36ddbc5891acb6c4abd11638"}]}, @NFTA_BITWISE_XOR={0x0, 0x5, 0x0, 0x1, [@NFTA_DATA_VALUE={0x0, 0x1, "4b7fadbb2639555fb913115efebb58b774fc6668d056d8af901f2fbc1f5231784b139d837e5bf38891b2ceb24590b025b61778dae121aca90dc78944e6b532b1a39f4f0947138a4b02ea76047439029a4c68eaad9141b32b3b2d1daa1e14452c17232ffa76ab756fe8dcdc3699f7a19cc588a47b49de1f1b8e2ef8"}, @NFTA_DATA_VALUE]}, @NFTA_BITWISE_DREG={0x0, 0x2, 0x1, 0x0, 0x8}, @NFTA_BITWISE_MASK={0x0, 0x4, 0x0, 0x1, [@NFTA_DATA_VERDICT={0x0, 0x2, 0x0, 0x1, [@NFTA_VERDICT_CODE={0x0, 0x1, 0x0, 0x1, 0xffffffffffffffff}, @NFTA_VERDICT_CHAIN_ID={0x0, 0x3, 0x1, 0x0, 0x3}, @NFTA_VERDICT_CHAIN_ID={0x0, 0x3, 0x1, 0x0, 0x4}, @NFTA_VERDICT_CHAIN={0x0, 0x2, 'syz1\x00'}, @NFTA_VERDICT_CHAIN={0x0, 0x2, 'syz1\x00'}, @NFTA_VERDICT_CODE={0x0, 0x1, 0x0, 0x1, 0xffffffffffffffff}]}, @NFTA_DATA_VERDICT={0x0, 0x2, 0x0, 0x1, [@NFTA_VERDICT_CODE={0x0, 0x1, 0x0, 0x1, 0xfffffffffffffffc}]}, @NFTA_DATA_VERDICT={0x0, 0x2, 0x0, 0x1, [@NFTA_VERDICT_CODE={0x0, 0x1, 0x0, 0x1, 0xfffffffffffffffd}, @NFTA_VERDICT_CHAIN_ID={0x0, 0x3, 0x1, 0x0, 0x4}, @NFTA_VERDICT_CHAIN={0x0, 0x2, 'syz1\x00'}, @NFTA_VERDICT_CHAIN_ID={0x0, 0x3, 0x1, 0x0, 0x2}, @NFTA_VERDICT_CHAIN={0x0, 0x2, 'syz2\x00'}, @NFTA_VERDICT_CHAIN={0x0, 0x2, 'syz0\x00'}, @NFTA_VERDICT_CHAIN={0x0, 0x2, 'syz1\x00'}, @NFTA_VERDICT_CODE={0x0, 0x1, 0x0, 0x1, 0xfffffffffffffffd}]}, @NFTA_DATA_VALUE={0x0, 0x1, "ecd5a3b14965be5547f030595f4be513e2853b812b3f9c7734d2486234fe728646ce615a164f2bbc4b1b655dad801e7eb72eef1bde147ee7c8122834eeb7044f297ddc945f228fcb8de03c8fa92c4c942bd36c4de620ba3e9ccddef3c943b83446e0b5078f1c"}, @NFTA_DATA_VERDICT={0x0, 0x2, 0x0, 0x1, [@NFTA_VERDICT_CHAIN_ID={0x0, 0x3, 0x1, 0x0, 0x4}, @NFTA_VERDICT_CODE, @NFTA_VERDICT_CHAIN_ID={0x0, 0x3, 0x1, 0x0, 0x3}, @NFTA_VERDICT_CHAIN_ID={0x0, 0x3, 0x1, 0x0, 0x1}, @NFTA_VERDICT_CODE={0x0, 0x1, 0x0, 0x1, 0xfffffffffffffffc}, @NFTA_VERDICT_CHAIN_ID={0x0, 0x3, 0x1, 0x0, 0x3}]}, @NFTA_DATA_VERDICT={0x0, 0x2, 0x0, 0x1, [@NFTA_VERDICT_CHAIN={0x0, 0x2, 'syz2\x00'}, @NFTA_VERDICT_CHAIN_ID={0x0, 0x3, 0x1, 0x0, 0x3}, @NFTA_VERDICT_CHAIN_ID={0x0, 0x3, 0x1, 0x0, 0x2}, @NFTA_VERDICT_CHAIN={0x0, 0x2, 'syz1\x00'}, @NFTA_VERDICT_CODE={0x0, 0x1, 0x0, 0x1, 0xfffffffffffffffc}]}]}, @NFTA_BITWISE_SREG={0x0, 0x1, 0x1, 0x0, 0xc}, @NFTA_BITWISE_SREG={0x0, 0x1, 0x1, 0x0, 0xe}, @NFTA_BITWISE_LEN={0x0, 0x3, 0x1, 0x0, 0x1}]}}}]}, @NFTA_SET_ELEM_EXPR={0xc, 0x7, 0x0, 0x1, @ct={{0x7}, @void}}]}, {0x204, 0x0, 0x0, 0x1, [@NFTA_SET_ELEM_EXPR={0xc, 0x7, 0x0, 0x1, @log={{0x39}, @void}}, @NFTA_SET_ELEM_KEY={0x8, 0x1, 0x0, 0x1, [@NFTA_DATA_VALUE={0x4}]}, @NFTA_SET_ELEM_EXPRESSIONS={0x130, 0xb, 0x0, 0x1, [{0x4c, 0x1, 0x0, 0x1, @tunnel={{0xb}, @val={0x3c, 0x2, 0x0, 0x1, [@NFTA_TUNNEL_MODE={0x8, 0x3, 0x1, 0x0, 0x2}, @NFTA_TUNNEL_KEY={0x8}, @NFTA_TUNNEL_KEY={0x8, 0x1, 0x1, 0x0, 0x1}, @NFTA_TUNNEL_MODE={0x8}, @NFTA_TUNNEL_DREG={0x8, 0x2, 0x1, 0x0, 0x1}, @NFTA_TUNNEL_MODE={0x8}, @NFTA_TUNNEL_DREG={0x8, 0x2, 0x1, 0x0, 0x17}]}}}, {0x1c, 0x1, 0x0, 0x1, @bitwise={{0xc}, @val={0xc, 0x2, 0x0, 0x1, [@NFTA_BITWISE_SREG={0x8, 0x1, 0x1, 0x0, 0xd}]}}}, {0x74, 0x1, 0x0, 0x1, @range={{0xa}, @val={0x64, 0x2, 0x0, 0x1, [@NFTA_RANGE_TO_DATA={0x60, 0x4, 0x0, 0x1, [@NFTA_DATA_VERDICT={0x14, 0x2, 0x0, 0x1, [@NFTA_VERDICT_CODE={0x8, 0x1, 0x0, 0x1, 0xfffffffffffffffd}, @NFTA_VERDICT_CHAIN_ID={0x8, 0x3, 0x1, 0x0, 0x4}]}, @NFTA_DATA_VERDICT={0x48, 0x2, 0x0, 0x1, [@NFTA_VERDICT_CODE={0x8, 0x1, 0x0, 0x1, 0xfffffffffffffffc}, @NFTA_VERDICT_CHAIN_ID={0x8, 0x3, 0x1, 0x0, 0x2}, @NFTA_VERDICT_CODE={0x8, 0x1, 0x0, 0x1, 0xfffffffffffffffe}, @NFTA_VERDICT_CHAIN_ID={0x8, 0x3, 0x1, 0x0, 0x3}, @NFTA_VERDICT_CHAIN_ID={0x8, 0x3, 0x1, 0x0, 0x4}, @NFTA_VERDICT_CODE={0x8, 0x1, 0x0, 0x1, 0xffffffffffffffff}, @NFTA_VERDICT_CHAIN={0x9, 0x2, 'syz2\x00'}, @NFTA_VERDICT_CHAIN_ID={0x8, 0x3, 0x1, 0x0, 0x1}]}]}]}}}, {0x40, 0x1, 0x0, 0x1, @log={{0x8}, @val={0x34, 0x2, 0x0, 0x1, [@NFTA_LOG_QTHRESHOLD={0x6, 0x4, 0x1, 0x0, 0xfac3}, @NFTA_LOG_GROUP={0x6, 0x1, 0x1, 0x0, 0x9}, @NFTA_LOG_FLAGS={0x8, 0x6, 0x1, 0x0, 0x9}, @NFTA_LOG_QTHRESHOLD={0x6, 0x4, 0x1, 0x0, 0x8}, @NFTA_LOG_QTHRESHOLD={0x6}, @NFTA_LOG_SNAPLEN={0x8, 0x3, 0x1, 0x0, 0x6659}]}}}, {0x10, 0x1, 0x0, 0x1, @range={{0xa}, @void}}]}, @NFTA_SET_ELEM_EXPRESSIONS={0x78, 0xb, 0x0, 0x1, [{0x34, 0x1, 0x0, 0x1, @socket={{0xb}, @val={0x24, 0x2, 0x0, 0x1, [@NFTA_SOCKET_DREG={0x8, 0x2, 0x1, 0x0, 0x8}, @NFTA_SOCKET_LEVEL={0x8, 0x3, 0x1a}, @NFTA_SOCKET_DREG={0x8, 0x2, 0x1, 0x0, 0x11}, @NFTA_SOCKET_DREG={0x8, 0x2, 0x1, 0x0, 0x14}]}}}, {0xc, 0x1, 0x0, 0x1, @rt={{0x7}, @void}}, {0x28, 0x1, 0x0, 0x1, @dup={{0x8}, @val={0x1c, 0x2, 0x0, 0x1, [@NFTA_DUP_SREG_DEV={0x8, 0x2, 0x1, 0x0, 0xe}, @NFTA_DUP_SREG_DEV={0x8, 0x2, 0x1, 0x0, 0x15}, @NFTA_DUP_SREG_DEV={0x8, 0x2, 0x1, 0x0, 0x4}]}}}, {0xc, 0x1, 0x0, 0x1, @dup_ipv4={{0x8}, @void}}]}, @NFTA_SET_ELEM_EXPR={0x38, 0x7, 0x0, 0x1, @quota={{0xa}, @val={0x28, 0x2, 0x0, 0x1, [@NFTA_QUOTA_CONSUMED={0xc, 0x4, 0x1, 0x0, 0x6}, @NFTA_QUOTA_FLAGS={0x8, 0x2, 0x1, 0x0, 0x3}, @NFTA_QUOTA_FLAGS={0x8, 0x2, 0x1, 0x0, 0x3}, @NFTA_QUOTA_FLAGS={0x8}]}}}, @NFTA_SET_ELEM_TIMEOUT={0xc, 0x4, 0x1, 0x0, 0x100000000}]}, {0x15c, 0x0, 0x0, 0x1, [@NFTA_SET_ELEM_EXPRESSIONS={0x150, 0xb, 0x0, 0x1, [{0x14, 0x1, 0x0, 0x1, @connlimit={{0xe}, @void}}, {0x12c, 0x1, 0x0, 0x1, @cmp={{0x8}, @val={0x120, 0x2, 0x0, 0x1, [@NFTA_CMP_SREG={0x8, 0x1, 0x1, 0x0, 0x11}, @NFTA_CMP_OP={0x8, 0x2, 0x1, 0x0, 0x4}, @NFTA_CMP_OP={0x8, 0x2, 0x1, 0x0, 0x5}, @NFTA_CMP_DATA={0xf4, 0x3, 0x0, 0x1, [@NFTA_DATA_VALUE={0x39, 0x1, "68032116f225930d1c059eeb1fb790195a1c96390576e6d01c8536adbee1961fc9b4e36b7945d5b8c0c94b6e8da3c8c32d95fb7c85"}, @NFTA_DATA_VALUE={0x6c, 0x1, "63bbc1e5108e3648d3eb8d6e2e005a21b1651950c9022de1eb5615bf9945e8b139ea3eaef0df4d88e4486a62634465c8c52d2724145e43a7d69ef34056d7db12b63c2f2d196ee5c8c27021ecbe1283d7b123c2e6ecd5b2c4e2bbe41aedd3859e22dfa99fe3088e00"}, @NFTA_DATA_VERDICT={0x48, 0x2, 0x0, 0x1, [@NFTA_VERDICT_CHAIN_ID={0x8, 0x3, 0x1, 0x0, 0x3}, @NFTA_VERDICT_CHAIN_ID={0x8, 0x3, 0x1, 0x0, 0x4}, @NFTA_VERDICT_CHAIN_ID={0x8, 0x3, 0x1, 0x0, 0x4}, @NFTA_VERDICT_CHAIN_ID={0x8, 0x3, 0x1, 0x0, 0x7e3}, @NFTA_VERDICT_CHAIN={0x9, 0x2, 'syz1\x00'}, @NFTA_VERDICT_CODE={0x8}, @NFTA_VERDICT_CHAIN_ID={0x8, 0x3, 0x1, 0x0, 0x4}, @NFTA_VERDICT_CODE={0x8, 0x1, 0x0, 0x1, 0xfffffffffffffffc}]}]}, @NFTA_CMP_SREG={0x8, 0x1, 0x1, 0x0, 0x13}, @NFTA_CMP_SREG={0x8, 0x1, 0x1, 0x0, 0x2}]}}}, {0xc, 0x1, 0x0, 0x1, @nat={{0x8}, @void}}]}, @NFTA_SET_ELEM_FLAGS={0x8}]}, {0x2d0, 0x0, 0x0, 0x1, [@NFTA_SET_ELEM_EXPR={0x44, 0x7, 0x0, 0x1, @tproxy={{0xb}, @val={0x34, 0x2, 0x0, 0x1, [@NFTA_TPROXY_FAMILY={0x8, 0x1, 0x1, 0x0, 0xa}, @NFTA_TPROXY_FAMILY={0x8, 0x1, 0x1, 0x0, 0xb}, @NFTA_TPROXY_FAMILY={0x8}, @NFTA_TPROXY_REG_ADDR={0x8, 0x2, 0x1, 0x0, 0x8}, @NFTA_TPROXY_REG_ADDR={0x8, 0x2, 0x1, 0x0, 0x13}, @NFTA_TPROXY_REG_ADDR={0x8, 0x2, 0x1, 0x0, 0x1d}]}}}, @NFTA_SET_ELEM_KEY_END={0x1d4, 0xa, 0x0, 0x1, [@NFTA_DATA_VERDICT={0x18, 0x2, 0x0, 0x1, [@NFTA_VERDICT_CODE={0x8, 0x1, 0x0, 0x1, 0xfffffffffffffffe}, @NFTA_VERDICT_CHAIN={0x9, 0x2, 'syz1\x00'}]}, @NFTA_DATA_VALUE={0xa6, 0x1, "cb1e12e4b0b440dd99ab9ba472e1d630a773f920f207b12b8223dff85f1608b8371421b0185a5431e2a0f301c52541885dd4089038d176caa63411f85c13b641814654db3f89ccb0257b2ceeb8f3326e9327cbaf38af103afd0c4a4f88f99eb6a34a1fc14a74d52a40a2e8c8c717eddc49980739e61820f0bbf7402c66f6fc0c0fd3409a39ab36f73caacfc352f8e5b136fa0a181901fbb191e184c8178785744a8b"}, @NFTA_DATA_VERDICT={0x20, 0x2, 0x0, 0x1, [@NFTA_VERDICT_CODE={0x8, 0x1, 0x0, 0x1, 0xfffffffffffffffc}, @NFTA_VERDICT_CHAIN_ID={0x8, 0x3, 0x1, 0x0, 0x4}, @NFTA_VERDICT_CHAIN={0x9, 0x2, 'syz1\x00'}]}, @NFTA_DATA_VALUE={0xef, 0x1, "3390e61165855830d527c3136866393666a1d0e0ee82470a010b86821684409a05c6483f1571079a7e896ef2b6fca6d448feda26fa4fec28c81d3d7c3204eb0da59bebce92b720600d3ad1cecfad0969f96f4e86c54ae486e321d2b67d3057418a556bf5914be80d20832a67fcdeeac0a459b12c0df5562f30f23eaf6e259778b22490894d7ee634bb43008cf4462910c05977a036c39d0c9857d73afc94298717a6f6c15e77b295994cb5ed333acc0ef48158972ccd6ee5728f610043b3f2ed798845f1b35d70c1af87955a52ab0f0e62d5ddce217948dc956d25f77b4fb534756fd4f9389ae3fe9508aa"}]}, @NFTA_SET_ELEM_KEY_END={0x40, 0xa, 0x0, 0x1, [@NFTA_DATA_VERDICT={0x14, 0x2, 0x0, 0x1, [@NFTA_VERDICT_CHAIN_ID={0x8, 0x3, 0x1, 0x0, 0x4}, @NFTA_VERDICT_CHAIN_ID={0x8, 0x3, 0x1, 0x0, 0x3}]}, @NFTA_DATA_VERDICT={0x28, 0x2, 0x0, 0x1, [@NFTA_VERDICT_CODE={0x8, 0x1, 0x0, 0x1, 0xfffffffffffffffe}, @NFTA_VERDICT_CHAIN_ID={0x8, 0x3, 0x1, 0x0, 0x2}, @NFTA_VERDICT_CHAIN_ID={0x8, 0x3, 0x1, 0x0, 0x3}, @NFTA_VERDICT_CHAIN={0x9, 0x2, 'syz2\x00'}]}]}, @NFTA_SET_ELEM_USERDATA={0x74, 0x6, 0x1, 0x0, "5a658793368d1a5aa698dd2b13e8e59afbd23aa2d5b709c685a1cf019dc469bcd89920116b59ec9b83728b9ef049d108a1918e9f26a9b8e4a42c914b9cfd98020299b57afc8e5b1eeefbc8903ec3367f5c25f74872d03d87e6cbaa072ad9c40136104bd26810ed6f887eadf5b41c8ec8"}]}, {0x5c, 0x0, 0x0, 0x1, [@NFTA_SET_ELEM_FLAGS={0x8, 0x3, 0x1, 0x0, 0x3}, @NFTA_SET_ELEM_USERDATA={0x4e, 0x6, 0x1, 0x0, "981bf29076464dede75889cec684c4d6cb205b23b842044153341455164678cbac615793d3abdecdd9ee0709380465399cc61c681b6d64721d9af6cb39f5101947b702953aa43227d75a"}]}]}, @NFTA_SET_ELEM_LIST_SET_ID={0x8}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x7}}}, 0x7b4}, 0x1, 0x0, 0x0, 0x4008810}, 0x0) 320.291024ms ago: executing program 3 (id=3595): socket$nl_netfilter(0x10, 0x3, 0xc) (async) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) syz_emit_ethernet(0x56, &(0x7f0000000480)=ANY=[@ANYBLOB="aaaaaaaaaaaaaaaaaaaaaaaa08004d0000480000000000059078ac1414000a010100fd565f0312bf57fd4414050300000000000007cee00000010700"/70, @ANYRES32=0x41424344, @ANYRES32=0x41424344, @ANYBLOB="5c00000090780000"], 0x0) sendmsg$NFQNL_MSG_CONFIG(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000040)={0x1c, 0x2, 0x3, 0x201, 0x0, 0x0, {0x0, 0x0, 0xf}, [@NFQA_CFG_CMD={0x8, 0x1, {0x1}}]}, 0x1c}}, 0x0) close(r0) 181.77272ms ago: executing program 3 (id=3596): r0 = socket$inet6_sctp(0xa, 0x4, 0x84) ioctl$sock_SIOCGIFVLAN_SET_VLAN_NAME_TYPE_CMD(r0, 0x8982, 0x0) r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f0000000100)={0x26, 'rng\x00', 0x0, 0x0, 'drbg_nopr_hmac_sha512\x00'}, 0x58) r2 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="02000000040000000800000001"], 0x50) r3 = bpf$MAP_CREATE(0x0, &(0x7f0000000200)=ANY=[], 0x48) bpf$PROG_LOAD(0x5, &(0x7f0000000540)={0x7, 0x1c, &(0x7f0000000d80)=@ringbuf={{0x18, 0x8, 0x0, 0x0, 0xb6cb}, {{0x18, 0x1, 0x1, 0x0, r3}, {}, {}, {0x85, 0x0, 0x0, 0x5}}, {{0x5, 0x0, 0x3}}, [@snprintf={{0x7, 0x0, 0xb, 0x2, 0x0, 0x0, 0xffffff1f}, {0x3, 0x3, 0x3, 0xa, 0x9}, {0x6, 0x0, 0xd, 0x9, 0x0, 0x0, 0x80000001}, {0x3, 0x3, 0x3, 0xa, 0xa}, {0x7, 0x1, 0xb, 0x7, 0x2, 0x20}, {0x7, 0x0, 0x0, 0x8, 0x0, 0x0, 0xfffffdff}, {0x7, 0x1, 0xb, 0x4, 0x9}, {}, {0x4, 0x0, 0x6}, {0x18, 0x2, 0x2, 0x0, r2}, {}, {0x46, 0x8, 0xfff0, 0x76}}], {{0x7, 0x1, 0xb, 0x8}, {0x6, 0x0, 0x5, 0x8}, {0x85, 0x0, 0x0, 0x5}}}, &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000000}, 0x94) r4 = socket$nl_generic(0x10, 0x3, 0x10) r5 = syz_genetlink_get_family_id$devlink(&(0x7f0000000240), 0xffffffffffffffff) sendmsg$DEVLINK_CMD_SB_TC_POOL_BIND_SET(r4, &(0x7f0000000340)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x8dce2a106ceac82b}, 0xc, &(0x7f0000000300)={&(0x7f0000000180)={0x64, r5, 0x8, 0x70bd2a, 0x25dfdbfb, {}, [{{@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, {0x8}}, {0x8, 0xb, 0x4}, {0x6, 0x16, 0xe4e5}, {0x5, 0x12, 0x1}, {0x6, 0x11, 0xe}, {0x8}}]}, 0x64}, 0x1, 0x0, 0x0, 0x20c8800}, 0x0) getsockopt$inet_sctp6_SCTP_GET_ASSOC_ID_LIST(r0, 0x84, 0x1d, &(0x7f0000000080)={0x1, [0x0]}, &(0x7f00000000c0)=0x8) r6 = accept4(r1, 0x0, 0x0, 0x0) recvmmsg(r6, &(0x7f0000002440), 0x3ffffffffffff67, 0x0, 0x0) socket$nl_route(0x10, 0x3, 0x0) socket$nl_generic(0x10, 0x3, 0x10) socket$nl_netfilter(0x10, 0x3, 0xc) openat$tun(0xffffffffffffff9c, &(0x7f0000000040), 0x40241, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)) r7 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r7, &(0x7f0000000680)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000500)=ANY=[@ANYBLOB="380000001800010000000000000000000a000000000000000000000808000400", @ANYRES32=r7, @ANYBLOB="06001500070000000c00168008000100", @ANYRES64=r7], 0x38}}, 0x10) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f07ebbee9, 0x8031, 0xffffffffffffffff, 0x0) socket$netlink(0x10, 0x3, 0x1) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x2, 0x31, 0xffffffffffffffff, 0x0) r8 = syz_init_net_socket$x25(0x9, 0x5, 0x0) getsockopt$X25_QBITINCL(r8, 0x106, 0x1, 0x0, &(0x7f0000000140)) socket$can_raw(0x1d, 0x3, 0x1) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000140)={0xffffffffffffffff}) setsockopt$SO_TIMESTAMP(r9, 0x1, 0x40, 0x0, 0x0) recvmsg$unix(r9, 0x0, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) 0s ago: executing program 2 (id=3597): r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000380)=ANY=[@ANYBLOB="1b00000006000000f9ffffff0080000000000000", @ANYRES32, @ANYBLOB='\x00'/20, @ANYRES32=0x0, @ANYRES32, @ANYBLOB="000010000000000000000000000001e0fa11a6e964f7c80147830000"], 0x50) r1 = syz_init_net_socket$rose(0xb, 0x5, 0x0) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000140), 0x0, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x4c02}) readv(r2, &(0x7f00000015c0)=[{&(0x7f00000001c0)=""/98, 0x62}, {&(0x7f0000000080)=""/38, 0x26}, {&(0x7f00000004c0)=""/4096, 0x1000}], 0x3) r3 = socket$kcm(0x2, 0xa, 0x2) ioctl$TUNSETVNETHDRSZ(r2, 0x400454d8, &(0x7f0000000100)=0x1000) ioctl$SIOCSIFHWADDR(r3, 0x8914, &(0x7f0000000000)={'syzkaller1\x00', @link_local}) mmap$xdp(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x700000c, 0x11, 0xffffffffffffffff, 0x180000000) ioctl$SIOCRSGCAUSE(r1, 0x89e0, &(0x7f0000000040)) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup/syz0\x00', 0x1ff) r4 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r5 = openat$cgroup_ro(r4, &(0x7f00000005c0)='cpu.stat\x00', 0x275a, 0x0) preadv(r5, &(0x7f00000004c0)=[{&(0x7f0000000280)=""/96, 0x46}, {0x0, 0xa00}], 0x2, 0xa, 0x6c8) r6 = bpf$PROG_LOAD(0x5, &(0x7f0000000240)={0x3, 0x8, &(0x7f0000001600)=ANY=[@ANYBLOB="18000000000000000000000000000000850000001100000018110000", @ANYRES32=r0, @ANYBLOB="0800000000000000b702000000180000457cc6b4d029b5f7958166dee45cd7b0545513c42bbd95595644aa848eb5b917c359e75f669c8ea06c543f5631b379afcb8513bc2b07cb52770f2da0431bdfdfa77691a5713541330f07e974f4bf0d73320d4da6d94b86b870f34b352906486e076516ddc45235ce657ad7e13876ba147de90997f33c5e04efa236513a8ddb1cedac92b75592910a5a0bbb5d98fd7ca0242214063a23"], &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x41000, 0x1, '\x00', 0x0, @fallback=0x16, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r7 = openat$nci(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) r8 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r9 = syz_genetlink_get_family_id$nfc(&(0x7f0000000100), r8) ioctl$IOCTL_GET_NCIDEV_IDX(r7, 0x0, &(0x7f00000000c0)=0x0) sendmsg$NFC_CMD_DEV_UP(r8, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000d80)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r9, @ANYBLOB="010426bd7000f8dbdf250200000008000100", @ANYRES32=r10], 0x1c}, 0x1, 0x0, 0x0, 0x800}, 0x4008054) r11 = openat$nci(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) r12 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nfc(&(0x7f0000000100), r12) ioctl$IOCTL_GET_NCIDEV_IDX(r11, 0x0, &(0x7f00000000c0)=0x0) sendmsg$NFC_CMD_DEV_UP(r12, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000d80)=ANY=[@ANYBLOB="1c800000", @ANYBLOB, @ANYBLOB="010426bd7000f8dbdf250200000008000100", @ANYRES32=r13], 0x1c}}, 0x4008054) write$nci(r11, 0x0, 0xc) write$nci(r11, &(0x7f0000000380)=ANY=[@ANYBLOB="500238", @ANYRES32=r13], 0x3b) ioctl$IOCTL_GET_NCIDEV_IDX(r5, 0x0, &(0x7f0000000440)) sendmsg$NFC_CMD_LLC_SET_PARAMS(0xffffffffffffffff, &(0x7f0000001540)={&(0x7f0000000300)={0x10, 0x0, 0x0, 0x100200}, 0xffb4, &(0x7f0000000400)={&(0x7f0000001700)=ANY=[@ANYBLOB='L\x00\x00\x00', @ANYRES16=0x0, @ANYBLOB="000427bd7000fcdbdf251000000005000f000500000008000100", @ANYRES32=r10, @ANYBLOB="05000f00060005000f00050000000500844c3b87000008000100fd7b7854da7b4e2d4900d76aca8c037ea60d42a106965c43ed78315e75d9c6310e66b98e2c691152a4095c9c9bfea3c1764c6d0b5331f2404d9a1ffc5b91fab215d91eec9dd249651d593bffa4d6f09ba90cf52f0f4c5d8ba744848fa9369f5ac4968940c5a12fd3d78bff32146552a8beae438f8e42154360547be204cb20257b00"/175, @ANYRES32=r13, @ANYBLOB], 0x4c}, 0x1, 0x0, 0x0, 0x8}, 0x4080) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000180)={r6, 0x18000000000002a0, 0xe, 0x0, &(0x7f0000000340)="b9ff03316844268cb8ed08fa3add", 0x0, 0x9, 0x60000000, 0x0, 0x0, 0x0, 0x0}, 0x50) kernel console output (not intermixed with test programs): : 'syz.4.2651': attribute type 4 has an invalid length. [ 420.311018][T16075] tipc: Enabling of bearer rejected, already enabled [ 420.484172][T16082] netlink: 'syz.4.2657': attribute type 4 has an invalid length. [ 420.723717][T16104] netlink: 64691 bytes leftover after parsing attributes in process `syz.4.2663'. [ 420.773001][T16112] netlink: 64691 bytes leftover after parsing attributes in process `syz.4.2663'. [ 420.899368][T16093] lo speed is unknown, defaulting to 1000 [ 420.928078][T16119] netlink: 12 bytes leftover after parsing attributes in process `syz.2.2666'. [ 421.044048][T16123] netlink: 228 bytes leftover after parsing attributes in process `syz.1.2667'. [ 421.161428][T16131] netlink: 24 bytes leftover after parsing attributes in process `syz.4.2669'. [ 421.173734][T16093] lo speed is unknown, defaulting to 1000 [ 421.457282][T16152] netlink: 'syz.2.2674': attribute type 4 has an invalid length. [ 421.470557][T16154] netlink: 'syz.1.2673': attribute type 1 has an invalid length. [ 421.492737][T16154] nbd: couldn't find device at index -427251215 [ 422.119051][T16166] lo speed is unknown, defaulting to 1000 [ 422.131432][T16189] xt_hashlimit: size too large, truncated to 1048576 [ 422.331892][ C0] lec0: NETDEV WATCHDOG: CPU: 0: transmit queue 0 timed out 5730 ms [ 422.340156][ C0] lec:lec_tx_timeout: lec0 [ 422.345621][ C0] lec:lec_start_xmit: lec0:No lecd attached [ 422.628962][T16211] netlink: 76 bytes leftover after parsing attributes in process `syz.4.2685'. [ 422.647426][T16211] openvswitch: netlink: Flow key attr not present in new flow. [ 422.973722][T16229] netlink: 8 bytes leftover after parsing attributes in process `syz.1.2690'. [ 422.989912][T16229] A link change request failed with some changes committed already. Interface bridge_slave_0 may have been left with an inconsistent configuration, please check. [ 423.173789][T16233] pim6reg: entered allmulticast mode [ 423.197422][T16233] pim6reg: left allmulticast mode [ 423.231203][T16168] lo speed is unknown, defaulting to 1000 [ 423.233218][T16166] lo speed is unknown, defaulting to 1000 [ 423.254604][T16241] netlink: 8 bytes leftover after parsing attributes in process `syz.2.2693'. [ 423.376072][T16233] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 423.645325][T16256] netlink: 'syz.2.2694': attribute type 21 has an invalid length. [ 423.704041][T16256] netlink: 132 bytes leftover after parsing attributes in process `syz.2.2694'. [ 423.925077][T16217] lo speed is unknown, defaulting to 1000 [ 424.417790][T16291] tipc: Enabled bearer , priority 0 [ 424.427423][T16291] syzkaller0: entered promiscuous mode [ 424.443313][T16291] syzkaller0: entered allmulticast mode [ 424.487810][T16291] tipc: Resetting bearer [ 424.563626][T16291] tipc: Disabling bearer [ 424.738003][T16168] lo speed is unknown, defaulting to 1000 [ 424.739204][T16299] lo speed is unknown, defaulting to 1000 [ 424.789408][T16217] lo speed is unknown, defaulting to 1000 [ 425.386398][T16299] lo speed is unknown, defaulting to 1000 [ 426.192560][T16347] netlink: 'syz.2.2711': attribute type 1 has an invalid length. [ 426.250133][T16347] workqueue: Failed to create a rescuer kthread for wq "bond6": -EINTR [ 426.314937][ T51] block nbd0: Receive control failed (result -32) [ 426.377683][T16359] tap0: tun_chr_ioctl cmd 1074025680 [ 426.428529][T16365] -: renamed from bond_slave_0 [ 426.578517][T16375] netlink: 'syz.3.2719': attribute type 4 has an invalid length. [ 426.676477][T16383] netlink: 'syz.2.2721': attribute type 3 has an invalid length. [ 426.703928][T16383] netlink: 'syz.2.2721': attribute type 1 has an invalid length. [ 426.711796][T16383] __nla_validate_parse: 1 callbacks suppressed [ 426.711814][T16383] netlink: 224 bytes leftover after parsing attributes in process `syz.2.2721'. [ 426.758149][T16393] tipc: Enabling of bearer rejected, failed to enable media [ 427.016145][T16412] netlink: 4 bytes leftover after parsing attributes in process `syz.3.2725'. [ 427.102314][T16412] netlink: 'syz.3.2725': attribute type 8 has an invalid length. [ 427.110091][T16412] netlink: 'syz.3.2725': attribute type 9 has an invalid length. [ 427.140145][T16412] netlink: 'syz.3.2725': attribute type 10 has an invalid length. [ 427.172567][T16412] netlink: 'syz.3.2725': attribute type 11 has an invalid length. [ 427.204734][T16412] netlink: 12 bytes leftover after parsing attributes in process `syz.3.2725'. [ 427.224047][T16418] bond7: option tlb_dynamic_lb: mode dependency failed, not supported in mode balance-rr(0) [ 427.284715][T16418] bond7 (unregistering): Released all slaves [ 427.418639][T16417] bond7: option tlb_dynamic_lb: mode dependency failed, not supported in mode balance-rr(0) [ 427.434155][T16417] bond7 (unregistering): Released all slaves [ 427.667434][T16452] netlink: 'syz.3.2736': attribute type 1 has an invalid length. [ 427.688171][T16454] netlink: 4 bytes leftover after parsing attributes in process `syz.0.2737'. [ 427.761563][T16452] 8021q: adding VLAN 0 to HW filter on device bond8 [ 427.838927][T16452] vlan5: entered promiscuous mode [ 427.845065][T16452] bond8: entered promiscuous mode [ 427.850499][T16452] vlan5: entered allmulticast mode [ 427.868195][T16452] bond8: entered allmulticast mode [ 427.886803][T16467] netlink: 4 bytes leftover after parsing attributes in process `syz.4.2739'. [ 427.961512][T16463] bond4: entered allmulticast mode [ 427.996217][T16467] bridge5: entered promiscuous mode [ 428.001553][T16467] bridge5: entered allmulticast mode [ 428.018848][T16467] bond4: (slave bridge5): making interface the new active one [ 428.032805][T16467] bond4: (slave bridge5): Enslaving as an active interface with an up link [ 428.065401][T16465] tipc: Enabling of bearer rejected, failed to enable media [ 428.091927][ C0] lec0: NETDEV WATCHDOG: CPU: 0: transmit queue 0 timed out 5750 ms [ 428.100035][ C0] lec:lec_tx_timeout: lec0 [ 428.110872][ C0] lec:lec_start_xmit: lec0:No lecd attached [ 428.117917][ T1988] block nbd2: Possible stuck request ffff888026f90000: control (read@0,1024B). Runtime 150 seconds [ 428.129564][ T1988] block nbd2: Possible stuck request ffff888026f90200: control (read@1024,1024B). Runtime 150 seconds [ 428.141073][ T1988] block nbd2: Possible stuck request ffff888026f90400: control (read@2048,1024B). Runtime 150 seconds [ 428.153085][ T1988] block nbd2: Possible stuck request ffff888026f90600: control (read@3072,1024B). Runtime 150 seconds [ 428.367206][T16476] netlink: 4 bytes leftover after parsing attributes in process `syz.3.2741'. [ 428.606522][T16502] siw: device registration error -23 [ 428.856542][ T5832] Bluetooth: hci5: unexpected cc 0x0c03 length: 249 > 1 [ 428.866704][ T5832] Bluetooth: hci5: unexpected cc 0x1003 length: 249 > 9 [ 428.876318][ T5832] Bluetooth: hci5: unexpected cc 0x1001 length: 249 > 9 [ 428.884604][ T5832] Bluetooth: hci5: unexpected cc 0x0c23 length: 249 > 4 [ 428.892575][ T5832] Bluetooth: hci5: unexpected cc 0x0c38 length: 249 > 2 [ 428.956391][T16520] SET target dimension over the limit! [ 428.977772][ T51] Bluetooth: hci5: unexpected cc 0x0c03 length: 249 > 1 [ 428.986196][ T51] Bluetooth: hci5: unexpected cc 0x1003 length: 249 > 9 [ 428.994450][ T51] Bluetooth: hci5: unexpected cc 0x1001 length: 249 > 9 [ 429.025415][ T51] Bluetooth: hci5: unexpected cc 0x0c23 length: 249 > 4 [ 429.039623][ T51] Bluetooth: hci5: unexpected cc 0x0c38 length: 249 > 2 [ 429.315842][T16532] netlink: 212368 bytes leftover after parsing attributes in process `syz.1.2752'. [ 431.132941][ T51] Bluetooth: hci5: command tx timeout [ 431.159630][T16538] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 431.230846][T16515] lo speed is unknown, defaulting to 1000 [ 431.359150][T16547] tipc: Enabled bearer , priority 0 [ 431.506204][T16547] syzkaller0: entered promiscuous mode [ 431.562282][T16547] syzkaller0: entered allmulticast mode [ 431.568656][T16547] tipc: Resetting bearer [ 431.679207][T16561] netlink: 16 bytes leftover after parsing attributes in process `syz.1.2759'. [ 431.729093][T16537] lo speed is unknown, defaulting to 1000 [ 431.737594][T16515] lo speed is unknown, defaulting to 1000 [ 431.932067][T16571] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 431.978313][T16546] tipc: Resetting bearer [ 432.198454][T16578] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 432.268408][T16578] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 433.134461][ C0] lec0: NETDEV WATCHDOG: CPU: 0: transmit queue 0 timed out 5020 ms [ 433.142521][ C0] lec:lec_tx_timeout: lec0 [ 433.147319][ C0] lec:lec_start_xmit: lec0:No lecd attached [ 433.224850][ T51] Bluetooth: hci5: command tx timeout [ 434.131404][T16546] tipc: Disabling bearer [ 434.176044][ T982] tipc: Node number set to 1362168090 [ 434.193337][T16537] lo speed is unknown, defaulting to 1000 [ 434.306351][T16583] netlink: 'syz.2.2765': attribute type 2 has an invalid length. [ 434.382849][T16588] netlink: 72 bytes leftover after parsing attributes in process `syz.4.2767'. [ 434.411742][T16515] chnl_net:caif_netlink_parms(): no params data found [ 434.535476][T16599] netlink: 'syz.1.2769': attribute type 1 has an invalid length. [ 434.739711][T16613] xt_l2tp: missing protocol rule (udp|l2tpip) [ 434.756908][T16613] netlink: 24 bytes leftover after parsing attributes in process `syz.2.2771'. [ 434.779809][T16602] bond10: (slave gretap2): making interface the new active one [ 434.796827][T16615] netlink: 12 bytes leftover after parsing attributes in process `syz.4.2772'. [ 434.815070][T16602] bond10: (slave gretap2): Enslaving as an active interface with an up link [ 434.894205][T16515] bridge0: port 1(bridge_slave_0) entered blocking state [ 434.912328][T16515] bridge0: port 1(bridge_slave_0) entered disabled state [ 434.919715][T16515] bridge_slave_0: entered allmulticast mode [ 434.942030][T16515] bridge_slave_0: entered promiscuous mode [ 434.969032][T16515] bridge0: port 2(bridge_slave_1) entered blocking state [ 434.978916][T16515] bridge0: port 2(bridge_slave_1) entered disabled state [ 434.986885][T16515] bridge_slave_1: entered allmulticast mode [ 434.996775][T16515] bridge_slave_1: entered promiscuous mode [ 435.077731][T16515] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 435.113285][T16515] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 435.323355][ T51] Bluetooth: hci5: command tx timeout [ 435.364778][T16515] team0: Port device team_slave_0 added [ 435.401248][T16515] team0: Port device team_slave_1 added [ 435.506487][T16515] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 435.514692][T16515] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 435.546970][T16515] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 435.558792][T16646] netlink: 'syz.4.2780': attribute type 13 has an invalid length. [ 435.559822][T16515] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 435.576157][T16515] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 435.642491][T16515] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 435.680139][T16656] netlink: 232 bytes leftover after parsing attributes in process `syz.1.2783'. [ 435.856450][T16650] mac80211_hwsim hwsim10 syzkaller0: Caught tx_queue_len zero misconfig [ 435.923464][T16665] netlink: 24 bytes leftover after parsing attributes in process `syz.4.2780'. [ 435.967099][T16665] netlink: 24 bytes leftover after parsing attributes in process `syz.4.2780'. [ 436.104072][T16515] hsr_slave_0: entered promiscuous mode [ 436.121145][T16515] hsr_slave_1: entered promiscuous mode [ 436.138282][T16515] debugfs: 'hsr0' already exists in 'hsr' [ 436.149952][T16515] Cannot create hsr debugfs directory [ 436.172404][T16680] netlink: 8 bytes leftover after parsing attributes in process `syz.4.2789'. [ 436.251825][T16678] lo speed is unknown, defaulting to 1000 [ 436.254985][T16680] netlink: 52 bytes leftover after parsing attributes in process `syz.4.2789'. [ 436.437218][T16689] netlink: 12 bytes leftover after parsing attributes in process `syz.2.2790'. [ 436.504374][T16688] vlan0: entered allmulticast mode [ 436.510921][T16688] team0: entered allmulticast mode [ 436.537376][T16688] team_slave_0: entered allmulticast mode [ 436.560944][T16688] team_slave_1: entered allmulticast mode [ 436.590481][T16678] lo speed is unknown, defaulting to 1000 [ 436.643424][T16515] netdevsim netdevsim3 eth3 (unregistering): unset [1, 0] type 2 family 0 port 20000 - 0 [ 436.726159][T16515] netdevsim netdevsim3 eth2 (unregistering): unset [1, 0] type 2 family 0 port 20000 - 0 [ 436.778387][T16515] netdevsim netdevsim3 eth1 (unregistering): unset [1, 0] type 2 family 0 port 20000 - 0 [ 436.904672][T16515] netdevsim netdevsim3 eth0 (unregistering): unset [1, 0] type 2 family 0 port 20000 - 0 [ 436.971788][T16708] netlink: 8 bytes leftover after parsing attributes in process `syz.4.2798'. [ 437.211495][T16713] wg1 speed is unknown, defaulting to 1000 [ 437.246776][T16713] wg1 speed is unknown, defaulting to 1000 [ 437.287254][T16713] wg1 speed is unknown, defaulting to 1000 [ 437.363460][T16717] block nbd6: server does not support multiple connections per device. [ 437.373097][ T51] Bluetooth: hci5: command tx timeout [ 437.386946][T16717] block nbd6: shutting down sockets [ 437.425329][T16515] netdevsim netdevsim3 netdevsim0: renamed from eth0 [ 437.450595][T16515] netdevsim netdevsim3 netdevsim1: renamed from eth1 [ 437.472876][T16515] netdevsim netdevsim3 netdevsim2: renamed from eth2 [ 437.492558][T16515] netdevsim netdevsim3 netdevsim3: renamed from eth3 [ 437.570388][T16713] infiniband sz0: set active [ 437.576603][ T982] wg1 speed is unknown, defaulting to 1000 [ 437.606349][T16713] infiniband sz0: added wg1 [ 437.616975][T16515] 8021q: adding VLAN 0 to HW filter on device bond0 [ 437.646629][T16515] 8021q: adding VLAN 0 to HW filter on device team0 [ 437.674890][ T73] bridge0: port 1(bridge_slave_0) entered blocking state [ 437.682590][ T73] bridge0: port 1(bridge_slave_0) entered forwarding state [ 437.713736][ T73] bridge0: port 2(bridge_slave_1) entered blocking state [ 437.721683][ T73] bridge0: port 2(bridge_slave_1) entered forwarding state [ 437.722255][T16734] netlink: 'syz.1.2804': attribute type 1 has an invalid length. [ 437.745458][T16713] RDS/IB: sz0: added [ 437.752965][T16713] smc: adding ib device sz0 with port count 1 [ 437.769125][T16713] smc: ib device sz0 port 1 has no pnetid [ 437.791678][ T24] wg1 speed is unknown, defaulting to 1000 [ 437.810980][T16713] wg1 speed is unknown, defaulting to 1000 [ 437.867951][T16740] netlink: 'syz.1.2806': attribute type 29 has an invalid length. [ 437.906780][T16740] netlink: 'syz.1.2806': attribute type 29 has an invalid length. [ 438.142489][T16515] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 438.161897][ C0] lec0: NETDEV WATCHDOG: CPU: 0: transmit queue 0 timed out 5010 ms [ 438.169974][ C0] lec:lec_tx_timeout: lec0 [ 438.175757][ C0] lec:lec_start_xmit: lec0:No lecd attached [ 438.196913][T16515] veth0_vlan: entered promiscuous mode [ 438.215535][T16515] veth1_vlan: entered promiscuous mode [ 438.250413][T16713] wg1 speed is unknown, defaulting to 1000 [ 438.305837][T16515] veth0_macvtap: entered promiscuous mode [ 438.335836][T16515] veth1_macvtap: entered promiscuous mode [ 438.342646][T16755] xt_ecn: cannot match TCP bits for non-tcp packets [ 438.350156][T16754] RDS: rds_bind could not find a transport for ::ffff:172.20.20.170, load rds_tcp or rds_rdma? [ 438.387135][T16515] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 438.397736][T16754] syz.1.2810 (16754) used obsolete PPPIOCDETACH ioctl [ 438.418863][T16515] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 438.453376][T10720] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 438.470978][T10720] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 438.484024][T10720] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 438.539588][T10720] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 438.744923][ T49] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 438.755132][ T49] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 438.780235][T16713] wg1 speed is unknown, defaulting to 1000 [ 438.819045][ T7442] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 438.828167][ T7442] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 439.149927][T16713] wg1 speed is unknown, defaulting to 1000 [ 439.229085][T16786] A link change request failed with some changes committed already. Interface veth0_vlan may have been left with an inconsistent configuration, please check. [ 439.278801][ T1170] netdevsim netdevsim4 netdevsim0: set [0, 0] type 1 family 0 port 8472 - 0 [ 439.302542][ T1170] netdevsim netdevsim4 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0 [ 439.311471][ T1170] netdevsim netdevsim4 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0 [ 439.333763][ T1170] netdevsim netdevsim4 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0 [ 439.468985][T16713] wg1 speed is unknown, defaulting to 1000 [ 439.674953][T16800] __nla_validate_parse: 8 callbacks suppressed [ 439.674975][T16800] netlink: 132 bytes leftover after parsing attributes in process `syz.4.2822'. [ 439.851162][T16713] wg1 speed is unknown, defaulting to 1000 [ 439.962671][T16817] netlink: 8 bytes leftover after parsing attributes in process `syz.3.2825'. [ 440.256962][ T1302] ieee802154 phy1 wpan1: encryption failed: -22 [ 440.294873][ T5489] veth0_vlan: left promiscuous mode [ 440.351258][ T5489] veth0_vlan: entered promiscuous mode [ 440.487335][T16845] netlink: 8 bytes leftover after parsing attributes in process `syz.4.2833'. [ 440.496966][T16845] netlink: 'syz.4.2833': attribute type 30 has an invalid length. [ 440.579388][T16845] netlink: 8 bytes leftover after parsing attributes in process `syz.4.2833'. [ 440.596396][T16845] netlink: 'syz.4.2833': attribute type 30 has an invalid length. [ 440.743353][T16850] bond11: entered promiscuous mode [ 440.763522][T16850] 8021q: adding VLAN 0 to HW filter on device bond11 [ 440.788623][T16859] netlink: 8 bytes leftover after parsing attributes in process `syz.4.2838'. [ 440.829812][T16864] lo speed is unknown, defaulting to 1000 [ 440.862310][T16856] netlink: 16 bytes leftover after parsing attributes in process `syz.3.2836'. [ 441.135079][T16878] team0 (unregistering): Failed to send port change of device team_slave_0 via netlink (err -105) [ 441.152826][T16878] team0 (unregistering): Port device team_slave_0 removed [ 441.180698][T16878] team0 (unregistering): Failed to send options change via netlink (err -105) [ 441.207003][T16878] team0 (unregistering): Failed to send port change of device team_slave_1 via netlink (err -105) [ 441.235462][T16878] team0 (unregistering): Port device team_slave_1 removed [ 441.272307][T16878] team0 (unregistering): Failed to send options change via netlink (err -105) [ 441.325517][T16878] team0 (unregistering): Failed to send port change of device netdevsim0 via netlink (err -105) [ 441.358461][T16878] team0 (unregistering): Port device netdevsim0 removed [ 441.426590][T16864] lo speed is unknown, defaulting to 1000 [ 441.434643][T16864] wg1 speed is unknown, defaulting to 1000 [ 441.618241][T16907] xt_hashlimit: size too large, truncated to 1048576 [ 441.637289][T16900] ip6tnl2: entered promiscuous mode [ 441.656027][T16900] ip6tnl2: entered allmulticast mode [ 441.679384][T16909] bond0: entered promiscuous mode [ 441.692743][ T9518] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 441.732168][T16909] bond_slave_0: entered promiscuous mode [ 441.738079][T16909] bond_slave_1: entered promiscuous mode [ 441.764842][T16909] batadv0: entered promiscuous mode [ 441.771206][T16909] hsr1: Slave A (bond0) is not up; please bring it up to get a fully working HSR network [ 441.783367][ T982] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 441.784287][T16914] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 441.801178][T16909] hsr1: Slave B (batadv0) is not up; please bring it up to get a fully working HSR network [ 441.802156][T16909] 8021q: adding VLAN 0 to HW filter on device hsr1 [ 441.865103][T16905] smc: removing ib device sqz0 [ 441.887258][T16919] netlink: 'syz.1.2847': attribute type 1 has an invalid length. [ 442.187690][ T5833] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 442.187726][T16924] netlink: 212328 bytes leftover after parsing attributes in process `syz.2.2849'. [ 442.208263][T16924] netlink: ct family unspecified [ 442.263437][T16930] netlink: 12 bytes leftover after parsing attributes in process `syz.1.2851'. [ 442.456877][T16936] netlink: 8 bytes leftover after parsing attributes in process `syz.2.2852'. [ 442.733805][ T5833] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 442.816135][ T5833] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 442.833473][ T5888] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 443.078501][ T5832] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 443.099035][ T5832] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 443.108465][ T5832] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 443.124813][ T5832] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 443.135300][ T5832] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 443.181884][ C0] lec0: NETDEV WATCHDOG: CPU: 0: transmit queue 0 timed out 5010 ms [ 443.190006][ C0] lec:lec_tx_timeout: lec0 [ 443.195269][ C0] lec:lec_start_xmit: lec0:No lecd attached [ 443.282697][T16959] netlink: 24 bytes leftover after parsing attributes in process `syz.4.2858'. [ 443.456502][T16950] lo speed is unknown, defaulting to 1000 [ 443.470058][T16950] wg1 speed is unknown, defaulting to 1000 [ 443.853470][ T982] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 443.891092][T16980] lo speed is unknown, defaulting to 1000 [ 444.311758][T16995] wg1: entered promiscuous mode [ 444.316919][T16995] wg1: entered allmulticast mode [ 444.518017][T16980] wg1 speed is unknown, defaulting to 1000 [ 444.691177][T16950] chnl_net:caif_netlink_parms(): no params data found [ 444.910698][ T5888] net_ratelimit: 1 callbacks suppressed [ 444.910719][ T5888] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 444.938427][T17007] FAULT_INJECTION: forcing a failure. [ 444.938427][T17007] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 444.953128][T17007] CPU: 1 UID: 0 PID: 17007 Comm: syz.4.2871 Not tainted syzkaller #0 PREEMPT(full) [ 444.953155][T17007] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 444.953166][T17007] Call Trace: [ 444.953173][T17007] [ 444.953180][T17007] dump_stack_lvl+0xe8/0x150 [ 444.953216][T17007] should_fail_ex+0x412/0x560 [ 444.953243][T17007] _copy_from_iter+0x1d3/0x1670 [ 444.953270][T17007] ? rcu_is_watching+0x15/0xb0 [ 444.953300][T17007] ? __pfx__copy_from_iter+0x10/0x10 [ 444.953330][T17007] ? netlink_sendmsg+0x650/0xb40 [ 444.953352][T17007] ? skb_put+0x11b/0x210 [ 444.953377][T17007] netlink_sendmsg+0x6c0/0xb40 [ 444.953405][T17007] ? __pfx_netlink_sendmsg+0x10/0x10 [ 444.953430][T17007] ? aa_sock_msg_perm+0xf1/0x1b0 [ 444.953454][T17007] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 444.953474][T17007] ? __pfx_netlink_sendmsg+0x10/0x10 [ 444.953495][T17007] ____sys_sendmsg+0xa68/0xad0 [ 444.953530][T17007] ? __pfx_____sys_sendmsg+0x10/0x10 [ 444.953563][T17007] ? import_iovec+0x73/0xa0 [ 444.953590][T17007] ___sys_sendmsg+0x2a5/0x360 [ 444.953620][T17007] ? __pfx____sys_sendmsg+0x10/0x10 [ 444.953678][T17007] ? __fget_files+0x2a/0x420 [ 444.953710][T17007] ? __fget_files+0x3a0/0x420 [ 444.953743][T17007] __x64_sys_sendmsg+0x1bd/0x2a0 [ 444.953771][T17007] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 444.953805][T17007] ? __pfx_ksys_write+0x10/0x10 [ 444.953834][T17007] do_syscall_64+0x14d/0xf80 [ 444.953946][T17007] ? trace_irq_disable+0x3b/0x150 [ 444.953977][T17007] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 444.953995][T17007] ? clear_bhb_loop+0x40/0x90 [ 444.954017][T17007] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 444.954035][T17007] RIP: 0033:0x7f2625f9c799 [ 444.954055][T17007] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 444.954070][T17007] RSP: 002b:00007f26241f6028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 444.954092][T17007] RAX: ffffffffffffffda RBX: 00007f2626215fa0 RCX: 00007f2625f9c799 [ 444.954112][T17007] RDX: 0000000000000000 RSI: 0000200000000000 RDI: 0000000000000003 [ 444.954123][T17007] RBP: 00007f26241f6090 R08: 0000000000000000 R09: 0000000000000000 [ 444.954134][T17007] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 444.954145][T17007] R13: 00007f2626216038 R14: 00007f2626215fa0 R15: 00007ffccf206c78 [ 444.954175][T17007] [ 444.999044][T16950] bridge0: port 1(bridge_slave_0) entered blocking state [ 445.230720][T16950] bridge0: port 1(bridge_slave_0) entered disabled state [ 445.232017][ T24] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 445.238230][T16950] bridge_slave_0: entered allmulticast mode [ 445.274840][T16950] bridge_slave_0: entered promiscuous mode [ 445.292374][ T5832] Bluetooth: hci2: command tx timeout [ 445.350945][T17008] __nla_validate_parse: 3 callbacks suppressed [ 445.350965][T17008] netlink: 12 bytes leftover after parsing attributes in process `syz.0.2870'. [ 445.369678][T16950] bridge0: port 2(bridge_slave_1) entered blocking state [ 445.390269][T16950] bridge0: port 2(bridge_slave_1) entered disabled state [ 445.410805][T16950] bridge_slave_1: entered allmulticast mode [ 445.419370][T16950] bridge_slave_1: entered promiscuous mode [ 445.705141][T16950] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 445.718371][T16950] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 445.778205][T17008] lo speed is unknown, defaulting to 1000 [ 445.789818][T17008] wg1 speed is unknown, defaulting to 1000 [ 445.799223][T16950] team0: Port device team_slave_0 added [ 445.807899][T16950] team0: Port device team_slave_1 added [ 445.856656][T16950] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 445.882439][T16950] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 445.933236][ T5888] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 445.942484][T16950] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 445.982998][T16950] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 445.990309][T16950] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 446.026139][T16950] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 446.236428][T16950] hsr_slave_0: entered promiscuous mode [ 446.249377][T17029] netlink: 24 bytes leftover after parsing attributes in process `syz.4.2877'. [ 446.249520][T16950] hsr_slave_1: entered promiscuous mode [ 446.266733][T16950] debugfs: 'hsr0' already exists in 'hsr' [ 446.273013][T16950] Cannot create hsr debugfs directory [ 446.317622][T17033] netlink: 57 bytes leftover after parsing attributes in process `syz.3.2878'. [ 446.353959][T17033] netlink: 57 bytes leftover after parsing attributes in process `syz.3.2878'. [ 446.460217][T17038] netlink: 8 bytes leftover after parsing attributes in process `syz.3.2880'. [ 446.473806][T17038] netlink: 12 bytes leftover after parsing attributes in process `syz.3.2880'. [ 446.899448][T17056] netdevsim netdevsim4 netdevsim3 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 446.924486][T17056] netdevsim netdevsim4 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 446.998557][ T5888] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 447.031454][T17056] netdevsim netdevsim4 netdevsim2 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 447.042226][T17056] netdevsim netdevsim4 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 447.116463][T17056] netdevsim netdevsim4 netdevsim1 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 447.127476][T17056] netdevsim netdevsim4 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 447.156350][T17061] netlink: 8 bytes leftover after parsing attributes in process `syz.3.2888'. [ 447.166249][T17061] netlink: 52 bytes leftover after parsing attributes in process `syz.3.2888'. [ 447.204281][T17056] netdevsim netdevsim4 netdevsim0 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 447.217414][T17056] netdevsim netdevsim4 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 447.349261][ T1170] netdevsim netdevsim4 eth0: set [0, 0] type 1 family 0 port 8472 - 0 [ 447.357908][ T1170] netdevsim netdevsim4 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 447.372287][ T5832] Bluetooth: hci2: command tx timeout [ 447.387393][T16950] netdevsim netdevsim1 netdevsim0: renamed from eth0 [ 447.412716][ T1170] netdevsim netdevsim4 eth1: set [0, 0] type 1 family 0 port 8472 - 0 [ 447.421278][ T1170] netdevsim netdevsim4 eth1: set [1, 0] type 2 family 0 port 6081 - 0 [ 447.430061][ T1170] netdevsim netdevsim4 eth2: set [0, 0] type 1 family 0 port 8472 - 0 [ 447.438514][ T1170] netdevsim netdevsim4 eth2: set [1, 0] type 2 family 0 port 6081 - 0 [ 447.447787][T16950] netdevsim netdevsim1 netdevsim1: renamed from eth1 [ 447.458886][T16950] netdevsim netdevsim1 netdevsim2: renamed from eth2 [ 447.480555][T16950] netdevsim netdevsim1 netdevsim3: renamed from eth3 [ 447.496474][T10720] netdevsim netdevsim4 eth3: set [0, 0] type 1 family 0 port 8472 - 0 [ 447.515161][T10720] netdevsim netdevsim4 eth3: set [1, 0] type 2 family 0 port 6081 - 0 [ 447.550534][T17063] netlink: 'syz.0.2889': attribute type 2 has an invalid length. [ 447.578632][T17063] : entered promiscuous mode [ 447.604204][T17063] netlink: 'syz.0.2889': attribute type 2 has an invalid length. [ 447.633614][T17063] : left promiscuous mode [ 447.674732][T17076] FAULT_INJECTION: forcing a failure. [ 447.674732][T17076] name failslab, interval 1, probability 0, space 0, times 0 [ 447.731679][T16950] 8021q: adding VLAN 0 to HW filter on device bond0 [ 447.739137][T17076] CPU: 0 UID: 0 PID: 17076 Comm: syz.4.2891 Not tainted syzkaller #0 PREEMPT(full) [ 447.739162][T17076] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 447.739173][T17076] Call Trace: [ 447.739180][T17076] [ 447.739188][T17076] dump_stack_lvl+0xe8/0x150 [ 447.739218][T17076] should_fail_ex+0x412/0x560 [ 447.739244][T17076] should_failslab+0xa8/0x100 [ 447.739264][T17076] ? skb_clone+0x212/0x3a0 [ 447.739287][T17076] kmem_cache_alloc_noprof+0x87/0x650 [ 447.739310][T17076] ? apparmor_capable+0x126/0x170 [ 447.739337][T17076] skb_clone+0x212/0x3a0 [ 447.739358][T17076] ? nfnetlink_rcv+0x4b0/0x27b0 [ 447.739377][T17076] nfnetlink_rcv+0x4e2/0x27b0 [ 447.739404][T17076] ? lockdep_hardirqs_on+0x7a/0x110 [ 447.739426][T17076] ? __dev_queue_xmit+0x28d/0x38d0 [ 447.739440][T17076] ? __local_bh_enable_ip+0xd0/0x130 [ 447.739461][T17076] ? __dev_queue_xmit+0x1f56/0x38d0 [ 447.739475][T17076] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 447.739493][T17076] ? __dev_queue_xmit+0x28d/0x38d0 [ 447.739515][T17076] ? __pfx_nfnetlink_rcv+0x10/0x10 [ 447.739548][T17076] ? ref_tracker_free+0x693/0x840 [ 447.739568][T17076] ? __copy_skb_header+0xa3/0x4a0 [ 447.739604][T17076] ? __pfx_ref_tracker_free+0x10/0x10 [ 447.739637][T17076] ? skb_clone+0x246/0x3a0 [ 447.739664][T17076] ? __netlink_deliver_tap+0x807/0x850 [ 447.739682][T17076] ? netlink_deliver_tap+0x2e/0x1b0 [ 447.739715][T17076] netlink_unicast+0x80f/0x9b0 [ 447.739740][T17076] ? __pfx_netlink_unicast+0x10/0x10 [ 447.739759][T17076] ? netlink_sendmsg+0x650/0xb40 [ 447.739777][T17076] ? skb_put+0x11b/0x210 [ 447.739799][T17076] netlink_sendmsg+0x813/0xb40 [ 447.739827][T17076] ? __pfx_netlink_sendmsg+0x10/0x10 [ 447.739850][T17076] ? aa_sock_msg_perm+0xf1/0x1b0 [ 447.739871][T17076] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 447.739890][T17076] ? __pfx_netlink_sendmsg+0x10/0x10 [ 447.739909][T17076] ____sys_sendmsg+0xa68/0xad0 [ 447.739940][T17076] ? __pfx_____sys_sendmsg+0x10/0x10 [ 447.739973][T17076] ? import_iovec+0x73/0xa0 [ 447.739999][T17076] ___sys_sendmsg+0x2a5/0x360 [ 447.740028][T17076] ? __pfx____sys_sendmsg+0x10/0x10 [ 447.740079][T17076] ? __fget_files+0x2a/0x420 [ 447.740101][T17076] ? __fget_files+0x3a0/0x420 [ 447.740131][T17076] __x64_sys_sendmsg+0x1bd/0x2a0 [ 447.740158][T17076] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 447.740189][T17076] ? __pfx_ksys_write+0x10/0x10 [ 447.740218][T17076] do_syscall_64+0x14d/0xf80 [ 447.740241][T17076] ? trace_irq_disable+0x3b/0x150 [ 447.740264][T17076] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 447.740280][T17076] ? clear_bhb_loop+0x40/0x90 [ 447.740301][T17076] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 447.740319][T17076] RIP: 0033:0x7f2625f9c799 [ 447.740335][T17076] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 447.740348][T17076] RSP: 002b:00007f26241f6028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 447.740365][T17076] RAX: ffffffffffffffda RBX: 00007f2626215fa0 RCX: 00007f2625f9c799 [ 447.740383][T17076] RDX: 0000000000000000 RSI: 0000200000000000 RDI: 0000000000000003 [ 447.740394][T17076] RBP: 00007f26241f6090 R08: 0000000000000000 R09: 0000000000000000 [ 447.740404][T17076] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 447.740415][T17076] R13: 00007f2626216038 R14: 00007f2626215fa0 R15: 00007ffccf206c78 [ 447.740443][T17076] [ 448.089960][T16950] 8021q: adding VLAN 0 to HW filter on device team0 [ 448.102774][ T49] bridge0: port 1(bridge_slave_0) entered blocking state [ 448.109908][ T49] bridge0: port 1(bridge_slave_0) entered forwarding state [ 448.133870][ T7442] bridge0: port 2(bridge_slave_1) entered blocking state [ 448.141007][ T7442] bridge0: port 2(bridge_slave_1) entered forwarding state [ 448.169971][ T982] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 448.211897][ C0] lec0: NETDEV WATCHDOG: CPU: 0: transmit queue 0 timed out 5010 ms [ 448.219963][ C0] lec:lec_tx_timeout: lec0 [ 448.225199][ C0] lec:lec_start_xmit: lec0:No lecd attached [ 448.237437][T17080] sch_tbf: burst 2 is lower than device tunl0 mtu (1480) ! [ 448.250188][T17083] netlink: 32 bytes leftover after parsing attributes in process `syz.0.2893'. [ 448.263772][ T24] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 448.330370][T17085] macsec1: entered promiscuous mode [ 448.362700][T17085] macsec1: entered allmulticast mode [ 448.388508][T16950] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 448.400077][T16950] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 448.482961][T17089] tipc: Enabled bearer , priority 0 [ 448.498302][T17098] netlink: 8 bytes leftover after parsing attributes in process `syz.0.2896'. [ 448.599784][T17103] netlink: 'syz.0.2898': attribute type 4 has an invalid length. [ 448.646243][T17101] lo speed is unknown, defaulting to 1000 [ 448.663941][T17101] wg1 speed is unknown, defaulting to 1000 [ 448.843700][T16950] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 448.864555][T17115] bond_slave_0: Caught tx_queue_len zero misconfig [ 448.931080][T16950] veth0_vlan: entered promiscuous mode [ 448.965247][T16950] veth1_vlan: entered promiscuous mode [ 449.007388][T16950] veth0_macvtap: entered promiscuous mode [ 449.025740][T16950] veth1_macvtap: entered promiscuous mode [ 449.065785][T16950] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 449.093500][ T49] tipc: Resetting bearer [ 449.109908][T16950] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 449.154444][ T49] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 449.175953][ T49] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 449.187347][ T49] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 449.215459][ T5896] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 449.225126][ T982] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 449.243092][ T49] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 449.409838][ T49] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 449.424629][ T49] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 449.463039][ T5832] Bluetooth: hci2: command tx timeout [ 449.536911][ T7442] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 449.548666][ T7442] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 449.862871][ T24] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 449.945254][T17147] IPVS: set_ctl: invalid protocol: 47 172.20.20.170:20003 [ 449.955539][T17146] IPVS: set_ctl: invalid protocol: 47 172.20.20.170:20003 [ 450.127317][T17153] geneve2: entered promiscuous mode [ 450.133126][T17153] geneve2: entered allmulticast mode [ 450.258402][ T9] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 450.344418][T17167] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 450.381287][T17165] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 450.406071][T17184] __nla_validate_parse: 1 callbacks suppressed [ 450.406102][T17184] netlink: 60 bytes leftover after parsing attributes in process `syz.3.2922'. [ 450.450284][T17184] bond1: Unable to set down delay as MII monitoring is disabled [ 450.464349][T17184] bond1 (unregistering): Released all slaves [ 450.764571][T17198] netlink: 'syz.1.2927': attribute type 1 has an invalid length. [ 450.861511][T17199] team0: Device vxcan3 is of different type [ 451.144101][ T24] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 451.153712][ T9518] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 451.286629][T17230] netlink: 'syz.3.2935': attribute type 1 has an invalid length. [ 451.300681][ T5896] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 451.307990][T17230] netlink: 'syz.3.2935': attribute type 2 has an invalid length. [ 451.386430][T17224] netlink: 'syz.4.2934': attribute type 8 has an invalid length. [ 451.395242][T17225] netlink: 8 bytes leftover after parsing attributes in process `syz.2.2932'. [ 451.534254][ T5832] Bluetooth: hci2: command tx timeout [ 452.343145][ T5888] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 452.895177][ T24] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 453.052269][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 453.238988][ C0] lec0: NETDEV WATCHDOG: CPU: 0: transmit queue 0 timed out 5010 ms [ 453.247566][ C0] lec:lec_tx_timeout: lec0 [ 453.253842][ C0] lec:lec_start_xmit: lec0:No lecd attached [ 453.382702][ T5896] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 453.834703][T17246] netdevsim netdevsim1 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 453.968938][T17277] netlink: 8 bytes leftover after parsing attributes in process `syz.2.2944'. [ 453.974962][T17246] netdevsim netdevsim1 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 454.297127][T17246] netdevsim netdevsim1 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 454.442981][T17300] netlink: 4 bytes leftover after parsing attributes in process `syz.2.2948'. [ 454.577045][T17309] atomic_op ffff888044773198 conn xmit_atomic 0000000000000000 [ 454.678778][ T5896] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 454.691569][T17299] A link change request failed with some changes committed already. Interface 60X may have been left with an inconsistent configuration, please check. [ 454.764613][T17318] netlink: 8 bytes leftover after parsing attributes in process `syz.3.2951'. [ 454.817961][T17246] netdevsim netdevsim1 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 454.868037][T17323] siw: device registration error -23 [ 454.885544][ T5888] lo speed is unknown, defaulting to 1000 [ 454.929458][ T5888] syz2: Port: 1 Link ACTIVE [ 455.013078][T17324] lo speed is unknown, defaulting to 1000 [ 455.065778][T17324] wg1 speed is unknown, defaulting to 1000 [ 455.171178][T10720] netdevsim netdevsim1 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 455.216351][ T49] netdevsim netdevsim1 eth1: set [1, 0] type 2 family 0 port 6081 - 0 [ 455.261396][T10720] netdevsim netdevsim1 eth2: set [1, 0] type 2 family 0 port 6081 - 0 [ 455.326064][ T13] netdevsim netdevsim1 eth3: set [1, 0] type 2 family 0 port 6081 - 0 [ 455.603322][T17356] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 455.612120][ C0] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 455.701953][ T982] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 455.727044][T17373] netlink: 132 bytes leftover after parsing attributes in process `syz.1.2963'. [ 455.864868][T17347] lo speed is unknown, defaulting to 1000 [ 455.932767][ T47] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 455.968333][T17347] wg1 speed is unknown, defaulting to 1000 [ 456.284545][T17391] netlink: 8 bytes leftover after parsing attributes in process `syz.4.2966'. [ 456.393905][T17386] netlink: 'syz.3.2964': attribute type 10 has an invalid length. [ 456.419539][T17402] netlink: 8 bytes leftover after parsing attributes in process `syz.1.2968'. [ 456.444229][T17402] netlink: 4 bytes leftover after parsing attributes in process `syz.1.2968'. [ 456.462078][T17402] netlink: 'syz.1.2968': attribute type 18 has an invalid length. [ 456.598558][T17386] bond0: (slave wlan1): Enslaving as an active interface with an up link [ 456.645393][T17383] lo speed is unknown, defaulting to 1000 [ 456.654169][T17383] wg1 speed is unknown, defaulting to 1000 [ 456.773971][T17410] netlink: 'syz.4.2969': attribute type 1 has an invalid length. [ 456.842595][ T5896] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 457.033995][T17410] 8021q: adding VLAN 0 to HW filter on device bond5 [ 457.128386][T17424] bond5: (slave veth11): Enslaving as an active interface with a down link [ 457.855826][T17470] netlink: 'syz.4.2982': attribute type 49 has an invalid length. [ 457.860351][ T982] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 457.881672][T17466] batman_adv: Cannot find parent device. Skipping batadv-on-batadv check for gretap1 [ 458.172106][ T1988] block nbd2: Possible stuck request ffff888026f90000: control (read@0,1024B). Runtime 180 seconds [ 458.183194][ T1988] block nbd2: Possible stuck request ffff888026f90200: control (read@1024,1024B). Runtime 180 seconds [ 458.194398][ T1988] block nbd2: Possible stuck request ffff888026f90400: control (read@2048,1024B). Runtime 180 seconds [ 458.205615][ T1988] block nbd2: Possible stuck request ffff888026f90600: control (read@3072,1024B). Runtime 180 seconds [ 458.261899][ C0] lec0: NETDEV WATCHDOG: CPU: 0: transmit queue 0 timed out 5010 ms [ 458.269959][ C0] lec:lec_tx_timeout: lec0 [ 458.274714][ C0] lec:lec_start_xmit: lec0:No lecd attached [ 458.340499][T17487] netlink: 8 bytes leftover after parsing attributes in process `syz.3.2986'. [ 458.350476][T17487] netlink: 24 bytes leftover after parsing attributes in process `syz.3.2986'. [ 458.382973][T17485] netlink: 'syz.4.2985': attribute type 1 has an invalid length. [ 458.898621][ T5896] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 458.974438][ T47] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 459.044206][T17519] netlink: 'syz.4.2994': attribute type 4 has an invalid length. [ 459.110584][ T5896] lo speed is unknown, defaulting to 1000 [ 459.124247][ T5896] syz2: Port: 1 Link DOWN [ 459.218105][T17525] openvswitch: netlink: Actions may not be safe on all matching packets [ 459.430383][ T13] nci: nci_rsp_packet: unknown rsp opcode 0x218 [ 459.643657][ T51] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 459.655150][ T51] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 459.664717][ T51] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 459.677232][ T51] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 459.686303][ T51] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 459.745774][T17551] lo speed is unknown, defaulting to 1000 [ 459.754699][T17551] wg1 speed is unknown, defaulting to 1000 [ 459.937596][ T5896] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 459.959205][T17561] netlink: 20 bytes leftover after parsing attributes in process `syz.1.3005'. [ 459.987428][T17561] netlink: 8 bytes leftover after parsing attributes in process `syz.1.3005'. [ 460.038551][T17538] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 460.236026][T17564] netlink: 'syz.1.3006': attribute type 2 has an invalid length. [ 460.370793][T17551] chnl_net:caif_netlink_parms(): no params data found [ 460.658602][T17551] bridge0: port 1(bridge_slave_0) entered blocking state [ 460.682034][T17551] bridge0: port 1(bridge_slave_0) entered disabled state [ 460.689328][T17551] bridge_slave_0: entered allmulticast mode [ 460.712303][T17551] bridge_slave_0: entered promiscuous mode [ 460.723535][T17551] bridge0: port 2(bridge_slave_1) entered blocking state [ 460.737546][ T47] net_ratelimit: 1 callbacks suppressed [ 460.737563][ T47] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 460.762147][T17551] bridge0: port 2(bridge_slave_1) entered disabled state [ 460.792464][T17551] bridge_slave_1: entered allmulticast mode [ 460.807674][T17551] bridge_slave_1: entered promiscuous mode [ 460.864840][T17601] siw: device registration error -23 [ 460.991481][ T5896] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 461.003516][T17551] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 461.026565][T17603] netlink: 11562 bytes leftover after parsing attributes in process `syz.0.3015'. [ 461.092742][T17551] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 461.164846][T17609] netlink: 32 bytes leftover after parsing attributes in process `syz.2.3016'. [ 461.229484][T17551] team0: Port device team_slave_0 added [ 461.262471][T17599] lo speed is unknown, defaulting to 1000 [ 461.273690][T17551] team0: Port device team_slave_1 added [ 461.279295][T17599] wg1 speed is unknown, defaulting to 1000 [ 461.355060][T17551] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 461.372910][T17551] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 461.383489][ T24] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 461.429709][T17551] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 461.464354][T17636] netlink: 8 bytes leftover after parsing attributes in process `syz.3.3021'. [ 461.464354][T17635] netlink: 8 bytes leftover after parsing attributes in process `syz.3.3021'. [ 461.464376][T17635] netlink: 12 bytes leftover after parsing attributes in process `syz.3.3021'. [ 461.509288][T17636] netlink: 12 bytes leftover after parsing attributes in process `syz.3.3021'. [ 461.601403][T17628] workqueue: Failed to create a rescuer kthread for wq "bond2": -EINTR [ 461.613144][T17551] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 461.631207][T17641] netlink: 8 bytes leftover after parsing attributes in process `syz.0.3023'. [ 461.631213][T17551] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 461.631238][T17551] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 461.747026][T17643] netlink: 8 bytes leftover after parsing attributes in process `syz.0.3023'. [ 461.784424][T17551] hsr_slave_0: entered promiscuous mode [ 461.787033][ T51] Bluetooth: hci3: command tx timeout [ 461.791377][T17551] hsr_slave_1: entered promiscuous mode [ 461.822199][T17551] debugfs: 'hsr0' already exists in 'hsr' [ 461.828096][T17551] Cannot create hsr debugfs directory [ 461.882693][T17647] netlink: 'syz.3.3025': attribute type 8 has an invalid length. [ 462.025773][ T5896] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 462.066272][T17658] netlink: 8 bytes leftover after parsing attributes in process `syz.2.3028'. [ 462.515348][T17551] netdevsim netdevsim4 eth3 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 462.552362][T17551] netdevsim netdevsim4 eth3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 462.676592][T17551] netdevsim netdevsim4 eth2 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 462.705095][T17551] netdevsim netdevsim4 eth2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 462.766532][T17682] netlink: 12 bytes leftover after parsing attributes in process `syz.2.3036'. [ 462.793060][T17551] netdevsim netdevsim4 eth1 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 462.811201][T17551] netdevsim netdevsim4 eth1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 462.843463][T17688] netlink: 'syz.1.3037': attribute type 4 has an invalid length. [ 462.934042][T17551] netdevsim netdevsim4 eth0 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 462.964075][T17551] netdevsim netdevsim4 eth0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 463.051503][T17697] netlink: 'syz.1.3041': attribute type 29 has an invalid length. [ 463.064926][ T5888] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 463.133358][ T24] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 463.281913][ C0] lec0: NETDEV WATCHDOG: CPU: 0: transmit queue 0 timed out 5010 ms [ 463.289997][ C0] lec:lec_tx_timeout: lec0 [ 463.302016][ C0] lec:lec_start_xmit: lec0:No lecd attached [ 463.556787][T17551] netdevsim netdevsim4 netdevsim0: renamed from eth0 [ 463.590615][T17551] netdevsim netdevsim4 netdevsim1: renamed from eth1 [ 463.638096][T17551] netdevsim netdevsim4 netdevsim2: renamed from eth2 [ 463.673681][T17551] netdevsim netdevsim4 netdevsim3: renamed from eth3 [ 463.852715][ T51] Bluetooth: hci3: command tx timeout [ 463.943766][T17730] netlink: 'syz.0.3050': attribute type 9 has an invalid length. [ 464.046167][T17551] 8021q: adding VLAN 0 to HW filter on device bond0 [ 464.059999][ T9518] IPVS: starting estimator thread 0... [ 464.073318][T17737] netlink: 'syz.3.3048': attribute type 1 has an invalid length. [ 464.080668][T17738] pim6reg1: entered promiscuous mode [ 464.089204][T17738] pim6reg1: entered allmulticast mode [ 464.108133][ T5896] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 464.152569][T17739] IPVS: using max 54 ests per chain, 129600 per kthread [ 464.223267][T17737] bond2: (slave gretap1): making interface the new active one [ 464.224599][T17747] netlink: 'syz.2.3053': attribute type 1 has an invalid length. [ 464.273447][T17737] bond2: (slave gretap1): Enslaving as an active interface with an up link [ 464.316080][T17743] vlan2: entered allmulticast mode [ 464.321261][T17743] bond2: entered allmulticast mode [ 464.329929][T17743] gretap1: entered allmulticast mode [ 464.346771][T17743] bond2: (slave vlan2): the slave hw address is in use by the bond; couldn't find a slave with a free hw address to give it (this should not have happened) [ 464.404670][T17551] 8021q: adding VLAN 0 to HW filter on device team0 [ 464.452799][ T13] bridge0: port 1(bridge_slave_0) entered blocking state [ 464.460029][ T13] bridge0: port 1(bridge_slave_0) entered forwarding state [ 464.534835][ T13] bridge0: port 2(bridge_slave_1) entered blocking state [ 464.542035][ T13] bridge0: port 2(bridge_slave_1) entered forwarding state [ 465.137169][ T5888] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 465.307234][T17551] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 465.569167][T17820] netlink: 'syz.2.3072': attribute type 11 has an invalid length. [ 465.728596][T17834] netlink: 'syz.3.3071': attribute type 8 has an invalid length. [ 465.872464][ T24] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 465.942527][ T51] Bluetooth: hci3: command tx timeout [ 465.992035][T17551] veth0_vlan: entered promiscuous mode [ 466.006752][T17551] veth1_vlan: entered promiscuous mode [ 466.089221][T17551] veth0_macvtap: entered promiscuous mode [ 466.162579][T17551] veth1_macvtap: entered promiscuous mode [ 466.177155][ T5896] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 466.214990][T17551] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 466.238127][T17551] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 466.497038][T17855] bridge0: port 2(bridge_slave_1) entered disabled state [ 466.505005][T17855] bridge0: port 1(bridge_slave_0) entered disabled state [ 466.658216][T17855] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 466.685013][T17855] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 466.817488][T17882] __nla_validate_parse: 9 callbacks suppressed [ 466.817508][T17882] netlink: 8 bytes leftover after parsing attributes in process `syz.0.3084'. [ 466.933403][ T13] netdevsim netdevsim1 eth0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 467.069990][ T13] netdevsim netdevsim1 eth1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 467.091404][ T13] netdevsim netdevsim1 eth2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 467.141783][T17882] lo speed is unknown, defaulting to 1000 [ 467.174055][ T13] netdevsim netdevsim1 eth3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 467.200585][ T13] netdevsim netdevsim4 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 467.226639][ T13] netdevsim netdevsim4 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 467.233607][ T982] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 467.253490][T17893] netlink: 'syz.2.3086': attribute type 13 has an invalid length. [ 467.261477][ T13] netdevsim netdevsim4 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 467.272602][T17893] netlink: 'syz.2.3086': attribute type 17 has an invalid length. [ 467.295328][T17882] wg1 speed is unknown, defaulting to 1000 [ 467.396570][T17893] syz_tun: entered promiscuous mode [ 467.419089][T17893] 8021q: adding VLAN 0 to HW filter on device bond0 [ 467.434691][T17893] 1X: left allmulticast mode [ 467.439725][T17893] A link change request failed with some changes committed already. Interface 61X may have been left with an inconsistent configuration, please check. [ 467.477367][ T13] netdevsim netdevsim4 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 467.536623][ T7442] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 467.572548][ T7442] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 467.684077][ T49] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 467.701243][ T49] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 467.775976][ T47] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 467.786826][ T9518] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 467.930329][T17914] netlink: 36 bytes leftover after parsing attributes in process `syz.3.3093'. [ 467.960616][T17914] netlink: 8 bytes leftover after parsing attributes in process `syz.3.3093'. [ 468.031574][ T51] Bluetooth: hci3: command tx timeout [ 468.085027][T17920] netlink: 36 bytes leftover after parsing attributes in process `syz.4.3095'. [ 468.207973][T17916] netlink: 36 bytes leftover after parsing attributes in process `syz.4.3095'. [ 468.264381][ T9] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 468.274780][T17916] netlink: 36 bytes leftover after parsing attributes in process `syz.4.3095'. [ 468.292904][T17916] netlink: 36 bytes leftover after parsing attributes in process `syz.4.3095'. [ 468.346538][T17916] netlink: 36 bytes leftover after parsing attributes in process `syz.4.3095'. [ 468.360133][T17928] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 468.395076][T17916] netlink: 36 bytes leftover after parsing attributes in process `syz.4.3095'. [ 468.414601][T17928] netlink: 8 bytes leftover after parsing attributes in process `syz.3.3098'. [ 468.506637][ T5832] Bluetooth: hci4: unexpected cc 0x0c03 length: 249 > 1 [ 468.537664][ T5832] Bluetooth: hci4: unexpected cc 0x1003 length: 249 > 9 [ 468.546542][ T5832] Bluetooth: hci4: unexpected cc 0x1001 length: 249 > 9 [ 468.558894][ T5832] Bluetooth: hci4: unexpected cc 0x0c23 length: 249 > 4 [ 468.568717][ T5832] Bluetooth: hci4: unexpected cc 0x0c38 length: 249 > 2 [ 468.670689][T17938] netlink: 'syz.3.3100': attribute type 2 has an invalid length. [ 468.771894][T17916] bridge0: port 2(bridge_slave_1) entered disabled state [ 468.779428][T17916] bridge0: port 1(bridge_slave_0) entered disabled state [ 468.897311][ T24] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 469.087154][T17916] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 469.124390][T17916] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 469.132011][ C0] lec0: NETDEV WATCHDOG: CPU: 0: transmit queue 0 timed out 5830 ms [ 469.140204][ C0] lec:lec_tx_timeout: lec0 [ 469.145395][ C0] lec:lec_start_xmit: lec0:No lecd attached [ 469.321560][ T982] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 469.593795][ T73] netdevsim netdevsim4 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 469.605977][ T73] netdevsim netdevsim4 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 469.919416][ T73] netdevsim netdevsim4 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 469.938801][ T73] netdevsim netdevsim4 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 470.014660][T17932] lo speed is unknown, defaulting to 1000 [ 470.056032][T17932] wg1 speed is unknown, defaulting to 1000 [ 470.204560][T17963] tipc: Started in network mode [ 470.209736][T17963] tipc: Node identity 9a54b3255299, cluster identity 4711 [ 470.221315][T17963] tipc: Enabled bearer , priority 0 [ 470.233615][T17963] syzkaller0: entered promiscuous mode [ 470.240752][T17963] syzkaller0: entered allmulticast mode [ 470.285913][T17963] tipc: Resetting bearer [ 470.302564][T17960] tipc: Resetting bearer [ 470.353429][T17960] tipc: Disabling bearer [ 470.418331][T17969] netlink: 'syz.1.3110': attribute type 4 has an invalid length. [ 470.656205][ T51] Bluetooth: hci4: command tx timeout [ 470.818319][T17932] chnl_net:caif_netlink_parms(): no params data found [ 470.906112][T17997] net_ratelimit: 2 callbacks suppressed [ 470.906131][T17997] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 470.921269][ C0] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 471.118411][T18006] 8021q: adding VLAN 0 to HW filter on device bond0 [ 471.143519][T18006] bond0: (slave xfrm1): The slave device specified does not support setting the MAC address [ 471.183498][T18006] bond0: (slave xfrm1): Error -95 calling set_mac_address [ 471.335561][T17932] bridge0: port 1(bridge_slave_0) entered blocking state [ 471.365823][T17932] bridge0: port 1(bridge_slave_0) entered disabled state [ 471.387666][ T5896] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 471.396805][T17932] bridge_slave_0: entered allmulticast mode [ 471.419706][T17932] bridge_slave_0: entered promiscuous mode [ 471.449989][T17932] bridge0: port 2(bridge_slave_1) entered blocking state [ 471.458796][T17932] bridge0: port 2(bridge_slave_1) entered disabled state [ 471.493279][T17932] bridge_slave_1: entered allmulticast mode [ 471.511648][T17932] bridge_slave_1: entered promiscuous mode [ 471.600708][T18032] netlink: 'syz.3.3129': attribute type 39 has an invalid length. [ 471.631081][T17932] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 471.746445][T17932] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 471.771631][T18046] FAULT_INJECTION: forcing a failure. [ 471.771631][T18046] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 471.787861][T18046] CPU: 0 UID: 0 PID: 18046 Comm: syz.4.3133 Not tainted syzkaller #0 PREEMPT(full) [ 471.787893][T18046] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 471.787914][T18046] Call Trace: [ 471.787921][T18046] [ 471.787929][T18046] dump_stack_lvl+0xe8/0x150 [ 471.787960][T18046] should_fail_ex+0x412/0x560 [ 471.787986][T18046] _copy_from_user+0x2d/0xb0 [ 471.788013][T18046] ___sys_sendmsg+0x1c6/0x360 [ 471.788043][T18046] ? __pfx____sys_sendmsg+0x10/0x10 [ 471.788102][T18046] ? __fget_files+0x2a/0x420 [ 471.788132][T18046] ? __fget_files+0x3a0/0x420 [ 471.788169][T18046] __x64_sys_sendmsg+0x1bd/0x2a0 [ 471.788198][T18046] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 471.788232][T18046] ? __pfx_ksys_write+0x10/0x10 [ 471.788259][T18046] do_syscall_64+0x14d/0xf80 [ 471.788286][T18046] ? trace_irq_disable+0x3b/0x150 [ 471.788308][T18046] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 471.788325][T18046] ? clear_bhb_loop+0x40/0x90 [ 471.788345][T18046] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 471.788363][T18046] RIP: 0033:0x7f4d7ff9c799 [ 471.788380][T18046] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 471.788393][T18046] RSP: 002b:00007f4d80e32028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 471.788412][T18046] RAX: ffffffffffffffda RBX: 00007f4d80215fa0 RCX: 00007f4d7ff9c799 [ 471.788424][T18046] RDX: 0000000000000000 RSI: 0000200000000000 RDI: 0000000000000004 [ 471.788433][T18046] RBP: 00007f4d80e32090 R08: 0000000000000000 R09: 0000000000000000 [ 471.788443][T18046] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 471.788452][T18046] R13: 00007f4d80216038 R14: 00007f4d80215fa0 R15: 00007ffd05bfaa88 [ 471.788482][T18046] [ 471.836075][T17932] team0: Port device team_slave_0 added [ 471.990090][ T9518] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 472.097399][T17932] team0: Port device team_slave_1 added [ 472.187651][T17932] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 472.224435][T17932] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 472.301771][T17932] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 472.356907][T17932] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 472.358237][T18060] netlink: 'syz.0.3136': attribute type 1 has an invalid length. [ 472.375634][T18060] __nla_validate_parse: 144 callbacks suppressed [ 472.375652][T18060] netlink: 224 bytes leftover after parsing attributes in process `syz.0.3136'. [ 472.381381][T17932] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 472.427843][ T5896] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 472.480722][T17932] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 472.587244][T18080] netlink: 24 bytes leftover after parsing attributes in process `syz.3.3138'. [ 472.619676][T18061] lo speed is unknown, defaulting to 1000 [ 472.681289][T18061] wg1 speed is unknown, defaulting to 1000 [ 472.742236][ T51] Bluetooth: hci4: command tx timeout [ 472.758150][T17932] hsr_slave_0: entered promiscuous mode [ 472.768891][T17932] hsr_slave_1: entered promiscuous mode [ 472.775829][T17932] debugfs: 'hsr0' already exists in 'hsr' [ 472.781698][T17932] Cannot create hsr debugfs directory [ 472.812982][T18087] erspan0: entered promiscuous mode [ 472.818382][T18087] netlink: 8 bytes leftover after parsing attributes in process `syz.1.3142'. [ 472.871099][T18092] FAULT_INJECTION: forcing a failure. [ 472.871099][T18092] name failslab, interval 1, probability 0, space 0, times 0 [ 472.888920][T18092] CPU: 1 UID: 0 PID: 18092 Comm: syz.0.3144 Not tainted syzkaller #0 PREEMPT(full) [ 472.888945][T18092] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 472.888955][T18092] Call Trace: [ 472.888962][T18092] [ 472.888969][T18092] dump_stack_lvl+0xe8/0x150 [ 472.888998][T18092] should_fail_ex+0x412/0x560 [ 472.889022][T18092] should_failslab+0xa8/0x100 [ 472.889044][T18092] kmem_cache_alloc_node_noprof+0x8f/0x690 [ 472.889071][T18092] ? __alloc_skb+0x186/0x7d0 [ 472.889092][T18092] ? __alloc_skb+0x1d0/0x7d0 [ 472.889111][T18092] ? __local_bh_enable_ip+0xd0/0x130 [ 472.889135][T18092] __alloc_skb+0x1d0/0x7d0 [ 472.889161][T18092] netlink_sendmsg+0x5d4/0xb40 [ 472.889188][T18092] ? __pfx_netlink_sendmsg+0x10/0x10 [ 472.889211][T18092] ? aa_sock_msg_perm+0xf1/0x1b0 [ 472.889233][T18092] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 472.889252][T18092] ? __pfx_netlink_sendmsg+0x10/0x10 [ 472.889270][T18092] ____sys_sendmsg+0xa68/0xad0 [ 472.889303][T18092] ? __pfx_____sys_sendmsg+0x10/0x10 [ 472.889335][T18092] ? import_iovec+0x73/0xa0 [ 472.889362][T18092] ___sys_sendmsg+0x2a5/0x360 [ 472.889392][T18092] ? __pfx____sys_sendmsg+0x10/0x10 [ 472.889446][T18092] ? __fget_files+0x2a/0x420 [ 472.889468][T18092] ? __fget_files+0x3a0/0x420 [ 472.889496][T18092] __x64_sys_sendmsg+0x1bd/0x2a0 [ 472.889527][T18092] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 472.889561][T18092] ? __pfx_ksys_write+0x10/0x10 [ 472.889594][T18092] do_syscall_64+0x14d/0xf80 [ 472.889618][T18092] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 472.889636][T18092] ? clear_bhb_loop+0x40/0x90 [ 472.889657][T18092] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 472.889674][T18092] RIP: 0033:0x7f98f5d9c799 [ 472.889691][T18092] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 472.889704][T18092] RSP: 002b:00007f98f6ce6028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 472.889722][T18092] RAX: ffffffffffffffda RBX: 00007f98f6015fa0 RCX: 00007f98f5d9c799 [ 472.889734][T18092] RDX: 0000000000000000 RSI: 0000200000000000 RDI: 0000000000000004 [ 472.889745][T18092] RBP: 00007f98f6ce6090 R08: 0000000000000000 R09: 0000000000000000 [ 472.889755][T18092] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 472.889764][T18092] R13: 00007f98f6016038 R14: 00007f98f6015fa0 R15: 00007ffdc73e3298 [ 472.889800][T18092] [ 473.445734][T18101] netlink: 4 bytes leftover after parsing attributes in process `syz.4.3149'. [ 473.458885][ T5896] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 473.619884][T18112] netlink: 56 bytes leftover after parsing attributes in process `syz.4.3151'. [ 473.674628][T18114] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 473.743431][T18114] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 473.910647][T18118] netlink: 16186 bytes leftover after parsing attributes in process `syz.1.3154'. [ 474.050642][T17932] netdevsim netdevsim2 netdevsim0: renamed from eth0 [ 474.072041][T17932] netdevsim netdevsim2 netdevsim1: renamed from eth1 [ 474.094444][T17932] netdevsim netdevsim2 netdevsim2: renamed from eth2 [ 474.108796][T17932] netdevsim netdevsim2 netdevsim3: renamed from eth3 [ 474.118456][T18127] netlink: 'syz.4.3157': attribute type 16 has an invalid length. [ 474.126846][T18127] netlink: 'syz.4.3157': attribute type 3 has an invalid length. [ 474.134981][T18127] netlink: 64066 bytes leftover after parsing attributes in process `syz.4.3157'. [ 474.151891][ C0] lec0: NETDEV WATCHDOG: CPU: 0: transmit queue 0 timed out 5010 ms [ 474.160057][ C0] lec:lec_tx_timeout: lec0 [ 474.164725][ C0] lec:lec_start_xmit: lec0:No lecd attached [ 474.167545][T18128] netlink: 16 bytes leftover after parsing attributes in process `syz.1.3158'. [ 474.181719][T18128] siw: device registration error -23 [ 474.236170][T17932] 8021q: adding VLAN 0 to HW filter on device bond0 [ 474.295164][T17932] 8021q: adding VLAN 0 to HW filter on device team0 [ 474.348006][T10720] bridge0: port 1(bridge_slave_0) entered blocking state [ 474.355225][T10720] bridge0: port 1(bridge_slave_0) entered forwarding state [ 474.399039][ T49] bridge0: port 2(bridge_slave_1) entered blocking state [ 474.406353][ T49] bridge0: port 2(bridge_slave_1) entered forwarding state [ 474.497420][ T5896] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 474.812105][ T51] Bluetooth: hci4: command tx timeout [ 475.033392][T17932] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 475.052933][ T9518] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 475.147422][T17932] veth0_vlan: entered promiscuous mode [ 475.167119][T17932] veth1_vlan: entered promiscuous mode [ 475.231079][T17932] veth0_macvtap: entered promiscuous mode [ 475.268397][T17932] veth1_macvtap: entered promiscuous mode [ 475.346370][T17932] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 475.395624][T17932] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 475.439616][T18181] syzkaller0: entered promiscuous mode [ 475.445788][T18181] syzkaller0: entered allmulticast mode [ 475.461257][ T7442] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 475.479353][ T7442] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 475.501775][ T7442] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 475.544955][ T5896] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 475.558666][T18186] netlink: 12 bytes leftover after parsing attributes in process `syz.3.3171'. [ 475.568995][T18186] 8021q: VLANs not supported on caif0 [ 475.579659][ T7442] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 475.809273][T10720] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 475.834605][T10720] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 475.893058][T18198] sctp: [Deprecated]: syz.3.3176 (pid 18198) Use of int in maxseg socket option. [ 475.893058][T18198] Use struct sctp_assoc_value instead [ 475.916623][ T7447] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 475.938532][ T7447] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 476.064704][T18206] netlink: 8 bytes leftover after parsing attributes in process `syz.3.3179'. [ 476.083794][T18210] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 476.099444][ T9] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 476.380593][T18223] netlink: 'syz.3.3183': attribute type 11 has an invalid length. [ 476.457338][T18228] FAULT_INJECTION: forcing a failure. [ 476.457338][T18228] name failslab, interval 1, probability 0, space 0, times 0 [ 476.495633][T18228] CPU: 1 UID: 0 PID: 18228 Comm: syz.0.3184 Not tainted syzkaller #0 PREEMPT(full) [ 476.495661][T18228] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 476.495672][T18228] Call Trace: [ 476.495679][T18228] [ 476.495685][T18228] dump_stack_lvl+0xe8/0x150 [ 476.495717][T18228] should_fail_ex+0x412/0x560 [ 476.495743][T18228] should_failslab+0xa8/0x100 [ 476.495772][T18228] ? skb_clone+0x212/0x3a0 [ 476.495798][T18228] kmem_cache_alloc_noprof+0x87/0x650 [ 476.495824][T18228] ? __netlink_lookup+0xc6/0x8b0 [ 476.495857][T18228] skb_clone+0x212/0x3a0 [ 476.495886][T18228] __netlink_deliver_tap+0x404/0x850 [ 476.495918][T18228] ? netlink_deliver_tap+0x2e/0x1b0 [ 476.495941][T18228] netlink_deliver_tap+0x19c/0x1b0 [ 476.495964][T18228] netlink_unicast+0x7e3/0x9b0 [ 476.495990][T18228] ? __pfx_netlink_unicast+0x10/0x10 [ 476.496011][T18228] ? netlink_sendmsg+0x650/0xb40 [ 476.496031][T18228] ? skb_put+0x11b/0x210 [ 476.496056][T18228] netlink_sendmsg+0x813/0xb40 [ 476.496086][T18228] ? __pfx_netlink_sendmsg+0x10/0x10 [ 476.496108][T18228] ? aa_sock_msg_perm+0xf1/0x1b0 [ 476.496128][T18228] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 476.496148][T18228] ? __pfx_netlink_sendmsg+0x10/0x10 [ 476.496168][T18228] ____sys_sendmsg+0xa68/0xad0 [ 476.496198][T18228] ? __pfx_____sys_sendmsg+0x10/0x10 [ 476.496231][T18228] ? import_iovec+0x73/0xa0 [ 476.496259][T18228] ___sys_sendmsg+0x2a5/0x360 [ 476.496289][T18228] ? __pfx____sys_sendmsg+0x10/0x10 [ 476.496369][T18228] ? __fget_files+0x2a/0x420 [ 476.496393][T18228] ? __fget_files+0x3a0/0x420 [ 476.496425][T18228] __x64_sys_sendmsg+0x1bd/0x2a0 [ 476.496454][T18228] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 476.496488][T18228] ? __pfx_ksys_write+0x10/0x10 [ 476.496517][T18228] do_syscall_64+0x14d/0xf80 [ 476.496539][T18228] ? trace_irq_disable+0x3b/0x150 [ 476.496567][T18228] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 476.496583][T18228] ? clear_bhb_loop+0x40/0x90 [ 476.496604][T18228] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 476.496621][T18228] RIP: 0033:0x7f98f5d9c799 [ 476.496639][T18228] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 476.496654][T18228] RSP: 002b:00007f98f6ce6028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 476.496673][T18228] RAX: ffffffffffffffda RBX: 00007f98f6015fa0 RCX: 00007f98f5d9c799 [ 476.496685][T18228] RDX: 0000000000000000 RSI: 0000200000000000 RDI: 0000000000000004 [ 476.496696][T18228] RBP: 00007f98f6ce6090 R08: 0000000000000000 R09: 0000000000000000 [ 476.496707][T18228] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 476.496717][T18228] R13: 00007f98f6016038 R14: 00007f98f6015fa0 R15: 00007ffdc73e3298 [ 476.496746][T18228] [ 476.787577][ T9] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 476.900325][ T51] Bluetooth: hci4: command tx timeout [ 477.029001][T18240] syzkaller0: entered promiscuous mode [ 477.043337][T18240] syzkaller0: entered allmulticast mode [ 477.079815][ T5832] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 477.095149][ T5832] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 477.105043][ T5832] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 477.114377][ T5832] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 477.122657][ T5832] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 477.281229][T18243] lo speed is unknown, defaulting to 1000 [ 477.344786][T18243] wg1 speed is unknown, defaulting to 1000 [ 477.376212][ T47] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 477.449597][T18259] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 477.471012][T18260] xt_hashlimit: max too large, truncated to 1048576 [ 477.614127][T18264] __nla_validate_parse: 3 callbacks suppressed [ 477.614157][T18264] netlink: 8 bytes leftover after parsing attributes in process `syz.4.3196'. [ 477.652762][T18264] netlink: 4 bytes leftover after parsing attributes in process `syz.4.3196'. [ 477.687353][T18264] netlink: 'syz.4.3196': attribute type 14 has an invalid length. [ 477.720759][T18264] netlink: 'syz.4.3196': attribute type 13 has an invalid length. [ 477.865492][ T10] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 478.014348][ T47] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 478.119715][T18290] netlink: 12 bytes leftover after parsing attributes in process `syz.2.3202'. [ 478.149114][ T73] netdevsim netdevsim0 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 478.301513][T18299] netlink: 8 bytes leftover after parsing attributes in process `syz.4.3203'. [ 478.563361][ T47] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 478.610711][T18312] netlink: 4 bytes leftover after parsing attributes in process `syz.1.3206'. [ 478.620808][T18313] netlink: 4 bytes leftover after parsing attributes in process `syz.1.3206'. [ 478.754928][ T73] netdevsim netdevsim0 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 478.897830][ T10] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 478.936673][ T73] netdevsim netdevsim0 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 478.974212][T18314] lo speed is unknown, defaulting to 1000 [ 478.983816][T18304] lo speed is unknown, defaulting to 1000 [ 479.007856][T18331] netlink: 8 bytes leftover after parsing attributes in process `syz.1.3210'. [ 479.019921][T18331] netlink: 24 bytes leftover after parsing attributes in process `syz.1.3210'. [ 479.040194][T18314] wg1 speed is unknown, defaulting to 1000 [ 479.073246][ T10] wg1 speed is unknown, defaulting to 1000 [ 479.079999][ T10] sz0: Port: 1 Link DOWN [ 479.133628][ T47] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 479.135740][ T73] netdevsim netdevsim0 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 479.152901][T18334] sctp: [Deprecated]: syz.2.3212 (pid 18334) Use of struct sctp_assoc_value in delayed_ack socket option. [ 479.152901][T18334] Use struct sctp_sack_info instead [ 479.173260][ C0] lec0: NETDEV WATCHDOG: CPU: 0: transmit queue 0 timed out 5010 ms [ 479.181442][ C0] lec:lec_tx_timeout: lec0 [ 479.182594][T18334] sctp: [Deprecated]: syz.2.3212 (pid 18334) Use of struct sctp_assoc_value in delayed_ack socket option. [ 479.182594][T18334] Use struct sctp_sack_info instead [ 479.187008][ C0] lec:lec_start_xmit: lec0:No lecd attached [ 479.212942][ T51] Bluetooth: hci1: command tx timeout [ 479.221969][ T9] wg1 speed is unknown, defaulting to 1000 [ 479.494695][T18243] chnl_net:caif_netlink_parms(): no params data found [ 479.516682][T18350] netlink: 'syz.1.3216': attribute type 2 has an invalid length. [ 479.568860][T18350] : entered promiscuous mode [ 480.258489][ T73] bond0 (unregistering): Released all slaves [ 480.268487][ T73] bond1 (unregistering): Released all slaves [ 480.286776][ T73] bond2 (unregistering): (slave batadv0): Releasing active interface [ 480.295208][ T73] batadv0: left promiscuous mode [ 480.300457][ T73] batadv0: left allmulticast mode [ 480.307251][ T73] bond2 (unregistering): Released all slaves [ 480.325945][ T73] bond3 (unregistering): Released all slaves [ 480.391228][T18304] wg1 speed is unknown, defaulting to 1000 [ 480.482463][ T73] 9: left promiscuous mode [ 480.635041][ T73] m1Ie5n: left promiscuous mode [ 480.667636][T18367] x_tables: ip6_tables: TCPOPTSTRIP target: only valid in mangle table, not filter [ 480.711357][T18363] ip6erspan0: entered promiscuous mode [ 480.715343][T18367] netlink: 64 bytes leftover after parsing attributes in process `syz.1.3220'. [ 480.730944][T18367] netlink: 8 bytes leftover after parsing attributes in process `syz.1.3220'. [ 480.784622][T18243] bridge0: port 1(bridge_slave_0) entered blocking state [ 480.794081][T18243] bridge0: port 1(bridge_slave_0) entered disabled state [ 480.803675][T18243] bridge_slave_0: entered allmulticast mode [ 480.854186][T18243] bridge_slave_0: entered promiscuous mode [ 480.906095][ T73] tipc: Left network mode [ 480.969612][T18243] bridge0: port 2(bridge_slave_1) entered blocking state [ 481.002760][T18243] bridge0: port 2(bridge_slave_1) entered disabled state [ 481.021519][T18243] bridge_slave_1: entered allmulticast mode [ 481.043225][T18243] bridge_slave_1: entered promiscuous mode [ 481.194120][T18243] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 481.293528][ T51] Bluetooth: hci1: command tx timeout [ 481.299303][T18380] IPVS: Error connecting to the multicast addr [ 481.333082][T18243] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 481.488606][T18243] team0: Port device team_slave_0 added [ 481.556702][T18243] team0: Port device team_slave_1 added [ 481.900493][T18404] netlink: 'syz.2.3227': attribute type 3 has an invalid length. [ 481.959612][T18405] pim6reg0: tun_chr_ioctl cmd 1074025675 [ 481.982764][T18405] pim6reg0: persist disabled [ 482.030737][ T5888] net_ratelimit: 4 callbacks suppressed [ 482.030756][ T5888] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 482.047943][T18243] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 482.062157][T18243] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 482.116727][T18243] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 482.138287][T18243] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 482.145821][T18243] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 482.172600][ T47] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 482.175272][T18243] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 482.356976][T18243] hsr_slave_0: entered promiscuous mode [ 482.384226][T18243] hsr_slave_1: entered promiscuous mode [ 482.390881][T18243] debugfs: 'hsr0' already exists in 'hsr' [ 482.398571][T18243] Cannot create hsr debugfs directory [ 482.414758][T18424] netlink: 'syz.1.3231': attribute type 2 has an invalid length. [ 482.711405][T18441] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 483.063657][ T5888] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 483.374813][ T51] Bluetooth: hci1: command tx timeout [ 483.508706][ T73] hsr_slave_0: left promiscuous mode [ 483.541089][ T73] hsr_slave_1: left promiscuous mode [ 483.577066][ T73] veth1_macvtap: left promiscuous mode [ 483.580171][T18478] __nla_validate_parse: 3 callbacks suppressed [ 483.580188][T18478] netlink: 228 bytes leftover after parsing attributes in process `syz.3.3243'. [ 483.592712][ T73] veth1_vlan: left promiscuous mode [ 483.606010][T18479] netlink: 'syz.2.3241': attribute type 13 has an invalid length. [ 483.614095][T18478] netlink: 228 bytes leftover after parsing attributes in process `syz.3.3243'. [ 483.623891][T18482] netlink: 56 bytes leftover after parsing attributes in process `syz.1.3244'. [ 483.656235][T18479] netlink: 'syz.2.3241': attribute type 17 has an invalid length. [ 484.115398][ T9] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 484.211959][ C0] lec0: NETDEV WATCHDOG: CPU: 0: transmit queue 0 timed out 5010 ms [ 484.220292][ C0] lec:lec_tx_timeout: lec0 [ 484.225074][ C0] lec:lec_start_xmit: lec0:No lecd attached [ 484.410772][T10720] smc: removing ib device sz0 [ 484.713275][T18479] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 484.774204][T18492] pimreg3: entered allmulticast mode [ 484.806503][T18460] lo speed is unknown, defaulting to 1000 [ 484.868168][T18492] pimreg3: left allmulticast mode [ 485.144271][ T10] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 485.214290][ T24] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 485.352465][T18514] netlink: 56 bytes leftover after parsing attributes in process `syz.3.3248'. [ 485.453610][ T51] Bluetooth: hci1: command tx timeout [ 485.525305][T18502] netlink: 16 bytes leftover after parsing attributes in process `syz.3.3248'. [ 485.975446][T18529] netlink: 8 bytes leftover after parsing attributes in process `syz.2.3252'. [ 486.073711][T18535] netlink: 8 bytes leftover after parsing attributes in process `syz.3.3255'. [ 486.186786][ T10] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 486.388600][T18243] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 486.448608][T18243] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 486.481209][T18243] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 486.536774][T18243] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 486.622507][T18560] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 486.775956][T18567] bridge_slave_1: left allmulticast mode [ 486.781776][T18567] bridge_slave_1: left promiscuous mode [ 486.798962][T18567] bridge0: port 2(bridge_slave_1) entered disabled state [ 486.849999][T18567] bridge_slave_0: left allmulticast mode [ 486.905031][T18567] bridge_slave_0: left promiscuous mode [ 486.966345][T18567] bridge0: port 1(bridge_slave_0) entered disabled state [ 487.236865][T18243] 8021q: adding VLAN 0 to HW filter on device bond0 [ 487.252818][ T5888] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 487.308917][T18243] 8021q: adding VLAN 0 to HW filter on device team0 [ 487.369420][T18575] netlink: 16 bytes leftover after parsing attributes in process `syz.1.3264'. [ 487.373574][ T1170] bridge0: port 1(bridge_slave_0) entered blocking state [ 487.385570][ T1170] bridge0: port 1(bridge_slave_0) entered forwarding state [ 487.415699][ T1170] bridge0: port 2(bridge_slave_1) entered blocking state [ 487.422649][T18575] netlink: 'syz.1.3264': attribute type 21 has an invalid length. [ 487.422932][ T1170] bridge0: port 2(bridge_slave_1) entered forwarding state [ 487.466002][T18575] netlink: 156 bytes leftover after parsing attributes in process `syz.1.3264'. [ 487.506876][T18575] netlink: 10 bytes leftover after parsing attributes in process `syz.1.3264'. [ 487.613357][ T24] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 487.763442][T18585] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 487.783333][T18585] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 487.799210][T18585] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 487.808478][T18585] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 487.833595][T18590] tap0: tun_chr_ioctl cmd 1074025692 [ 487.846031][T18585] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 487.874072][T18585] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 487.892576][T18585] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 487.901098][T18585] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 488.261233][ T1988] block nbd2: Possible stuck request ffff888026f90000: control (read@0,1024B). Runtime 210 seconds [ 488.279955][T18243] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 488.280343][ T1988] block nbd2: Possible stuck request ffff888026f90200: control (read@1024,1024B). Runtime 210 seconds [ 488.298345][ T1988] block nbd2: Possible stuck request ffff888026f90400: control (read@2048,1024B). Runtime 210 seconds [ 488.310317][ T1988] block nbd2: Possible stuck request ffff888026f90600: control (read@3072,1024B). Runtime 210 seconds [ 488.327728][T18594] xt_connbytes: Forcing CT accounting to be enabled [ 488.408164][T18612] tipc: Failed to remove unknown binding: 66,1,1/0:272947475/272947476 [ 488.704778][ T73] IPVS: stop unused estimator thread 0... [ 488.824975][T18243] veth0_vlan: entered promiscuous mode [ 489.115770][T18638] __nla_validate_parse: 2 callbacks suppressed [ 489.115790][T18638] netlink: 8 bytes leftover after parsing attributes in process `syz.1.3273'. [ 489.124908][T18243] veth1_vlan: entered promiscuous mode [ 489.231904][ C0] lec0: NETDEV WATCHDOG: CPU: 0: transmit queue 0 timed out 5010 ms [ 489.240148][ C0] lec:lec_tx_timeout: lec0 [ 489.244797][ C0] lec:lec_start_xmit: lec0:No lecd attached [ 489.455456][T18243] veth0_macvtap: entered promiscuous mode [ 489.490570][T18243] veth1_macvtap: entered promiscuous mode [ 489.540612][T18663] tipc: Enabling of bearer rejected, failed to enable media [ 489.581447][T18658] lo speed is unknown, defaulting to 1000 [ 489.606138][T18243] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 489.757682][T18243] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 489.905493][ T3519] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 489.938882][ T3519] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 490.056754][T18682] PF_CAN: dropped non conform CAN XL skbuff: dev type 65534, len 40 [ 490.065943][T18682] netlink: 8 bytes leftover after parsing attributes in process `syz.4.3278'. [ 490.074954][T18682] netlink: 24 bytes leftover after parsing attributes in process `syz.4.3278'. [ 490.084664][ T3519] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 490.096557][ T3519] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 490.304864][T18691] netlink: 8 bytes leftover after parsing attributes in process `syz.2.3280'. [ 490.478507][ T3519] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 490.528952][ T3519] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 490.567860][T18702] netlink: 'syz.2.3282': attribute type 3 has an invalid length. [ 490.652999][ T3519] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 490.685121][ T3519] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 491.139708][T18723] lo speed is unknown, defaulting to 1000 [ 491.163096][T18728] syzkaller1: entered promiscuous mode [ 491.181363][T18728] syzkaller1: entered allmulticast mode [ 491.297861][T18741] netlink: 'syz.1.3290': attribute type 9 has an invalid length. [ 491.366234][T18739] syzkaller0: entered promiscuous mode [ 491.372890][T18739] syzkaller0: entered allmulticast mode [ 491.405563][T18742] netlink: 8 bytes leftover after parsing attributes in process `syz.0.3292'. [ 491.464302][T18750] netlink: 4 bytes leftover after parsing attributes in process `syz.3.3293'. [ 491.506018][T18747] 8021q: adding VLAN 0 to HW filter on device bond2 [ 491.751181][T18753] syzkaller0: entered promiscuous mode [ 491.768118][T18766] netlink: 24 bytes leftover after parsing attributes in process `syz.2.3297'. [ 491.777738][T18753] syzkaller0: entered allmulticast mode [ 491.785949][T18753] tipc: Started in network mode [ 491.791018][T18753] tipc: Node identity 4664970c1c95, cluster identity 4711 [ 491.798966][T18753] tipc: Enabled bearer , priority 0 [ 491.816884][T18744] lo speed is unknown, defaulting to 1000 [ 491.849828][T18768] netlink: 60 bytes leftover after parsing attributes in process `syz.4.3298'. [ 491.936664][T18753] tipc: Resetting bearer [ 492.021503][T18753] tipc: Disabling bearer [ 492.243814][T18782] xt_TCPMSS: Only works on TCP SYN packets [ 492.284589][T18780] netlink: 'syz.3.3302': attribute type 29 has an invalid length. [ 492.289175][T18788] netlink: 596 bytes leftover after parsing attributes in process `syz.3.3302'. [ 492.296465][T18787] netlink: 'syz.3.3302': attribute type 29 has an invalid length. [ 492.328638][T18792] netlink: 'syz.0.3305': attribute type 4 has an invalid length. [ 492.492488][ T5888] net_ratelimit: 1027 callbacks suppressed [ 492.492508][ T5888] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 492.527978][T18797] netlink: 140 bytes leftover after parsing attributes in process `syz.4.3308'. [ 492.614893][T18808] openvswitch: netlink: Tunnel attr 10416 out of range max 16 [ 493.095778][T18815] bond0: entered promiscuous mode [ 493.099937][T18827] xt_l2tp: v2 sid > 0xffff: 4294967294 [ 493.100860][T18815] bond_slave_0: entered promiscuous mode [ 493.101068][T18815] bond_slave_1: entered promiscuous mode [ 493.137928][T18815] batadv0: entered promiscuous mode [ 493.145049][T18815] debugfs: 'hsr1' already exists in 'hsr' [ 493.175706][T18815] Cannot create hsr debugfs directory [ 493.231088][T18815] 8021q: adding VLAN 0 to HW filter on device hsr1 [ 493.536814][ T5888] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 493.643691][T18853] netlink: 'syz.3.3322': attribute type 2 has an invalid length. [ 493.685096][T18853] : entered promiscuous mode [ 493.701562][T18853] netlink: 'syz.3.3322': attribute type 2 has an invalid length. [ 493.741777][T18853] : left promiscuous mode [ 493.789438][T18862] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 493.929433][T18871] netlink: 'syz.0.3331': attribute type 1 has an invalid length. [ 494.015574][T18866] netlink: 'syz.1.3329': attribute type 1 has an invalid length. [ 494.065828][T18866] bond1: entered promiscuous mode [ 494.071709][T18866] 8021q: adding VLAN 0 to HW filter on device bond1 [ 494.116800][T18875] bond1: (slave veth3): making interface the new active one [ 494.124704][T18875] veth3: entered promiscuous mode [ 494.134058][T18875] bond1: (slave veth3): Enslaving as an active interface with an up link [ 494.155695][T18866] mac80211_hwsim hwsim35 ;: renamed from wlan0 [ 494.252131][ C0] lec0: NETDEV WATCHDOG: CPU: 0: transmit queue 0 timed out 5010 ms [ 494.260392][ C0] lec:lec_tx_timeout: lec0 [ 494.265475][ C0] lec:lec_start_xmit: lec0:No lecd attached [ 494.333159][ T47] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 494.572788][ T10] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 494.967029][T18906] tipc: Resetting bearer [ 495.257120][T18922] __nla_validate_parse: 11 callbacks suppressed [ 495.257142][T18922] netlink: 68 bytes leftover after parsing attributes in process `syz.2.3340'. [ 495.613482][ T5896] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 495.655514][T18906] Bluetooth: hci5: Opcode 0x0c1a failed: -4 [ 495.664610][T18906] Bluetooth: hci5: Error when powering off device on rfkill (-4) [ 495.699977][T18906] Bluetooth: hci2: Opcode 0x0c1a failed: -4 [ 495.711542][T18906] Bluetooth: hci2: Error when powering off device on rfkill (-4) [ 495.726097][T18939] netlink: 28 bytes leftover after parsing attributes in process `syz.3.3345'. [ 495.760557][T18906] Bluetooth: hci3: Opcode 0x0c1a failed: -4 [ 495.779079][T18906] Bluetooth: hci3: Error when powering off device on rfkill (-4) [ 495.806096][T18906] Bluetooth: hci4: Opcode 0x0c1a failed: -4 [ 495.822644][T18906] Bluetooth: hci4: Error when powering off device on rfkill (-4) [ 495.894085][T18906] Bluetooth: hci1: Opcode 0x0c1a failed: -4 [ 495.900029][T18906] Bluetooth: hci1: Error when powering off device on rfkill (-4) [ 496.105169][T18946] netlink: 'syz.1.3347': attribute type 39 has an invalid length. [ 496.195041][T18955] bond0: (slave gre0): The slave device specified does not support setting the MAC address [ 496.205884][T18955] bond0: (slave gre0): Error -95 calling set_mac_address [ 496.366043][T18958] vlan2: entered promiscuous mode [ 496.384560][T18958] geneve1: entered promiscuous mode [ 496.390079][T18958] vlan2: entered allmulticast mode [ 496.421350][T18958] geneve1: entered allmulticast mode [ 496.422031][T18966] ieee802154 phy1 wpan1: encryption failed: -22 [ 496.660964][ T5888] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 496.724770][T18977] tipc: Started in network mode [ 496.729684][T18977] tipc: Node identity ae86ba897e13, cluster identity 4711 [ 496.777353][T18977] tipc: Enabled bearer , priority 0 [ 496.813042][T18985] openvswitch: netlink: Either Ethernet header or EtherType is required. [ 496.894788][T18988] netlink: 8 bytes leftover after parsing attributes in process `syz.0.3357'. [ 496.908514][T18985] syzkaller0: entered promiscuous mode [ 496.914758][T18985] syzkaller0: entered allmulticast mode [ 497.373119][ T5833] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 497.497312][T18991] gtp0: entered promiscuous mode [ 497.515879][T18991] gtp0: entered allmulticast mode [ 497.605780][T18992] lo speed is unknown, defaulting to 1000 [ 497.693270][ T5888] net_ratelimit: 2 callbacks suppressed [ 497.693289][ T5888] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 497.852052][T19014] netlink: 212360 bytes leftover after parsing attributes in process `syz.4.3366'. [ 497.931474][ T5888] tipc: Node number set to 3499473545 [ 498.036254][T19008] xt_TCPMSS: Only works on TCP SYN packets [ 498.164574][T17932] syz-executor invoked oom-killer: gfp_mask=0x100cca(GFP_HIGHUSER_MOVABLE), order=0, oom_score_adj=0 [ 498.258022][T17932] CPU: 1 UID: 0 PID: 17932 Comm: syz-executor Not tainted syzkaller #0 PREEMPT(full) [ 498.258050][T17932] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 498.258061][T17932] Call Trace: [ 498.258069][T17932] [ 498.258077][T17932] dump_stack_lvl+0xe8/0x150 [ 498.258107][T17932] dump_header+0xd3/0x4c0 [ 498.258131][T17932] oom_kill_process+0x3ab/0x970 [ 498.258154][T17932] out_of_memory+0x106c/0x1410 [ 498.258171][T17932] ? percpu_ref_put+0x19/0x180 [ 498.258202][T17932] ? __pfx___mutex_lock+0x10/0x10 [ 498.258237][T17932] ? __pfx_out_of_memory+0x10/0x10 [ 498.258252][T17932] ? do_raw_spin_unlock+0xf5/0x210 [ 498.258277][T17932] try_charge_memcg+0xc53/0x1560 [ 498.258312][T17932] ? __pfx_try_charge_memcg+0x10/0x10 [ 498.258332][T17932] ? get_mem_cgroup_from_mm+0x38/0x290 [ 498.258360][T17932] ? get_mem_cgroup_from_mm+0x38/0x290 [ 498.258382][T17932] ? get_mem_cgroup_from_mm+0x38/0x290 [ 498.258403][T17932] ? get_mem_cgroup_from_mm+0x1b2/0x290 [ 498.258428][T17932] __mem_cgroup_charge+0xab/0x1e0 [ 498.258449][T17932] filemap_add_folio+0x152/0x530 [ 498.258483][T17932] __filemap_get_folio_mpol+0x500/0xb00 [ 498.258512][T17932] filemap_fault+0x9ac/0x1320 [ 498.258546][T17932] ? __pfx_filemap_fault+0x10/0x10 [ 498.258573][T17932] ? __pfx_filemap_map_pages+0x10/0x10 [ 498.258605][T17932] __do_fault+0x138/0x390 [ 498.258627][T17932] do_pte_missing+0x228f/0x3750 [ 498.258645][T17932] ? do_pte_missing+0x130a/0x3750 [ 498.258674][T17932] ? handle_mm_fault+0xee/0x3310 [ 498.258703][T17932] handle_mm_fault+0x1bec/0x3310 [ 498.258742][T17932] ? handle_mm_fault+0xee/0x3310 [ 498.258776][T17932] ? __pfx_handle_mm_fault+0x10/0x10 [ 498.258798][T17932] ? lock_vma_under_rcu+0x45a/0x500 [ 498.258843][T17932] do_user_addr_fault+0xa73/0x1340 [ 498.258874][T17932] ? rcu_is_watching+0x15/0xb0 [ 498.258897][T17932] ? trace_page_fault_user+0x84/0x210 [ 498.258921][T17932] exc_page_fault+0x6a/0xc0 [ 498.258946][T17932] asm_exc_page_fault+0x26/0x30 [ 498.258964][T17932] RIP: 0033:0x7feca9c6a7b4 [ 498.258982][T17932] Code: 85 62 0a 00 00 48 b8 db 34 b6 d7 82 de 1b 43 48 f7 a4 24 98 00 00 00 48 8b 05 00 b0 ed 00 48 69 8c 24 90 00 00 00 e8 03 00 00 <8b> 78 08 48 8b 44 24 18 48 c1 ea 12 4c 8b 0d f9 ae ed 00 48 01 d1 [ 498.258997][T17932] RSP: 002b:00007ffd28ad2b80 EFLAGS: 00010202 [ 498.259013][T17932] RAX: 0000001b2ce24000 RBX: 0000000000000092 RCX: 0000000000079568 [ 498.259025][T17932] RDX: 000000000ebb2835 RSI: 00007ffd28ad2c10 RDI: 000000003831d292 [ 498.259037][T17932] RBP: 00007ffd28ad2bbc R08: 7fffffffffffffff R09: 3fffffffffffffff [ 498.259049][T17932] R10: 4000000000000000 R11: 0000000000000246 R12: 0000000000001388 [ 498.259061][T17932] R13: 00000000000927c0 R14: 000000000007988a R15: 00007ffd28ad2c10 [ 498.259091][T17932] [ 498.259099][T17932] memory: usage 307200kB, limit 307200kB, failcnt 770 [ 498.562038][T17932] memory+swap: usage 307828kB, limit 9007199254740988kB, failcnt 0 [ 498.592415][T17932] kmem: usage 307184kB, limit 9007199254740988kB, failcnt 0 [ 498.615051][T17932] Memory cgroup stats for /syz2: [ 498.615392][T17932] cache 0 [ 498.635322][T17932] rss 0 [ 498.641698][T17932] rss_huge 0 [ 498.675349][T17932] shmem 0 [ 498.685402][T19030] bridge2: trying to set multicast startup query interval below minimum, setting to 100 (1000ms) [ 498.696413][T17932] mapped_file 0 [ 498.708026][T17932] dirty 0 [ 498.718003][T17932] writeback 0 [ 498.723473][T17932] workingset_refault_anon 5 [ 498.733410][ T5896] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 498.755487][T17932] workingset_refault_file 0 [ 498.772500][T17932] swap 643072 [ 498.783912][T17932] swapcached 659456 [ 498.802126][T17932] pgpgin 103214 [ 498.816532][T17932] pgpgout 103210 [ 498.820969][T17932] pgfault 182912 [ 498.862987][T17932] pgmajfault 7 [ 498.869519][T17932] inactive_anon 16384 [ 498.882014][T17932] active_anon 0 [ 498.885617][T17932] inactive_file 0 [ 498.889359][T17932] active_file 0 [ 498.901357][T17932] unevictable 0 [ 498.911970][T17932] hierarchical_memory_limit 314572800 [ 498.922354][T17932] hierarchical_memsw_limit 9223372036854771712 [ 498.935543][T17932] total_cache 0 [ 498.947444][T17932] total_rss 0 [ 498.964672][T17932] total_rss_huge 0 [ 498.968532][T17932] total_shmem 0 [ 499.002121][T17932] total_mapped_file 0 [ 499.006154][T17932] total_dirty 0 [ 499.009626][T17932] total_writeback 0 [ 499.042782][T17932] total_workingset_refault_anon 5 [ 499.048222][T17932] total_workingset_refault_file 0 [ 499.082012][T17932] total_swap 643072 [ 499.087484][T17932] total_swapcached 659456 [ 499.112005][T17932] total_pgpgin 103939 [ 499.116135][T17932] total_pgpgout 103935 [ 499.136372][T17932] total_pgfault 183657 [ 499.141401][T17932] total_pgmajfault 7 [ 499.151186][T17932] total_inactive_anon 16384 [ 499.169387][T17932] total_active_anon 0 [ 499.190179][T17932] total_inactive_file 0 [ 499.203525][T17932] total_active_file 0 [ 499.212326][T17932] total_unevictable 0 [ 499.222244][T17932] anon_cost 0 [ 499.225565][T17932] file_cost 0 [ 499.228877][T17932] oom-kill:constraint=CONSTRAINT_MEMCG,nodemask=(null),cpuset=/,mems_allowed=0-1,oom_memcg=/syz2,task_memcg=/syz2,task=syz.2.3359,pid=18990,uid=0 [ 499.272253][ C0] lec0: NETDEV WATCHDOG: CPU: 0: transmit queue 0 timed out 5010 ms [ 499.280740][ C0] lec:lec_tx_timeout: lec0 [ 499.286414][ C0] lec:lec_start_xmit: lec0:No lecd attached [ 499.324110][T17932] Memory cgroup out of memory: Killed process 18990 (syz.2.3359) total-vm:98576kB, anon-rss:1244kB, file-rss:21720kB, shmem-rss:0kB, UID:0 pgtables:120kB oom_score_adj:1000 [ 499.396147][T19051] netlink: 20 bytes leftover after parsing attributes in process `syz.3.3376'. [ 499.442491][T19051] vlan2: entered promiscuous mode [ 499.460840][T19051] erspan0: entered promiscuous mode [ 499.585086][T19061] netlink: 4 bytes leftover after parsing attributes in process `syz.2.3379'. [ 499.772843][ T5888] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 499.897353][ T9518] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 500.064642][T19071] tipc: Started in network mode [ 500.070117][T19071] tipc: Node identity c690ffa82763, cluster identity 4711 [ 500.129621][T19071] tipc: Enabled bearer , priority 0 [ 500.148930][T19080] netlink: 388 bytes leftover after parsing attributes in process `syz.1.3383'. [ 500.149872][T19079] netlink: 'syz.3.3385': attribute type 9 has an invalid length. [ 500.163573][T19082] netlink: 4 bytes leftover after parsing attributes in process `syz.2.3384'. [ 500.176386][T19079] netlink: 'syz.3.3385': attribute type 11 has an invalid length. [ 500.184201][T19075] netlink: 'syz.1.3383': attribute type 4 has an invalid length. [ 500.235048][T19079] netlink: 'syz.3.3385': attribute type 12 has an invalid length. [ 500.266402][T19079] netlink: 210020 bytes leftover after parsing attributes in process `syz.3.3385'. [ 500.294268][T19052] tipc: Disabling bearer [ 500.311389][T19079] netlink: 4 bytes leftover after parsing attributes in process `syz.3.3385'. [ 500.338326][T19082] 8021q: adding VLAN 0 to HW filter on device bond3 [ 500.413866][ T24] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 500.425122][ T5833] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 500.461609][T19092] netlink: 32 bytes leftover after parsing attributes in process `syz.1.3387'. [ 500.812308][ T5896] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 501.705262][ T1302] ieee802154 phy1 wpan1: encryption failed: -22 [ 501.853376][ T5896] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 502.640906][ T5194] udevd[5194]: worker [9611] /devices/virtual/block/nbd2 timeout; kill it [ 502.650251][ T5194] udevd[5194]: seq 15455 '/devices/virtual/block/nbd2' killed [ 502.897334][ T5888] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 503.453131][ T24] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 503.932168][ T5896] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 504.302099][ C0] lec0: NETDEV WATCHDOG: CPU: 0: transmit queue 0 timed out 5010 ms [ 504.310290][ C0] lec:lec_tx_timeout: lec0 [ 504.314912][ C0] lec:lec_start_xmit: lec0:No lecd attached [ 504.982918][ T5896] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 505.532557][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 506.012224][ T10] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 506.493596][ T5833] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 507.062300][ T10] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 507.452314][ T5888] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 508.093078][ T10] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 509.132870][ T5888] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 510.012573][ T5833] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 510.172589][ T5888] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 510.492675][ T5833] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 510.652011][ C0] lec0: NETDEV WATCHDOG: CPU: 0: transmit queue 0 timed out 6340 ms [ 510.660124][ C0] lec:lec_tx_timeout: lec0 [ 510.665008][ C0] lec:lec_start_xmit: lec0:No lecd attached [ 511.213783][ T5888] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 512.252330][ T5888] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 513.292734][ T5888] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 513.532868][ T5833] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 514.342735][ T5888] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 515.372214][ T5896] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 516.411910][ C0] lec0: NETDEV WATCHDOG: CPU: 0: transmit queue 0 timed out 5750 ms [ 516.419978][ C0] lec:lec_tx_timeout: lec0 [ 516.425870][ C0] lec:lec_start_xmit: lec0:No lecd attached [ 516.432121][ T5888] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 516.573483][ T5833] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 517.462543][ T5896] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 518.333864][ T1988] block nbd2: Possible stuck request ffff888026f90000: control (read@0,1024B). Runtime 240 seconds [ 518.344809][ T1988] block nbd2: Possible stuck request ffff888026f90200: control (read@1024,1024B). Runtime 240 seconds [ 518.355854][ T1988] block nbd2: Possible stuck request ffff888026f90400: control (read@2048,1024B). Runtime 240 seconds [ 518.367014][ T1988] block nbd2: Possible stuck request ffff888026f90600: control (read@3072,1024B). Runtime 240 seconds [ 518.492178][ T5896] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 519.532886][ T5896] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 519.612964][ T47] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 519.621364][ T5833] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 520.572588][ T5896] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 521.612308][ T5896] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 522.171982][ C0] lec0: NETDEV WATCHDOG: CPU: 0: transmit queue 0 timed out 5740 ms [ 522.180032][ C0] lec:lec_tx_timeout: lec0 [ 522.186532][ C0] lec:lec_start_xmit: lec0:No lecd attached [ 522.652437][ T10] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 522.660739][ T47] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 523.692593][ T10] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 524.742355][ T5896] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 525.695366][ T24] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 525.772475][ T5896] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 526.822831][ T5896] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 527.211951][ C0] lec0: NETDEV WATCHDOG: CPU: 0: transmit queue 0 timed out 5020 ms [ 527.220068][ C0] lec:lec_tx_timeout: lec0 [ 527.224863][ C0] lec:lec_start_xmit: lec0:No lecd attached [ 527.862504][ T5888] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 528.732712][ T24] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 528.892292][ T5896] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 529.212858][ T24] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 529.933517][ T5896] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 530.982265][ T5896] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 531.773334][ T47] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 532.012296][ T5888] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 532.231972][ C0] lec0: NETDEV WATCHDOG: CPU: 0: transmit queue 0 timed out 5010 ms [ 532.240017][ C0] lec:lec_tx_timeout: lec0 [ 532.244597][ C0] lec:lec_start_xmit: lec0:No lecd attached [ 533.058017][ T5896] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 534.092558][ T5888] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 534.812539][ T47] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 535.132245][ T5888] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 536.173794][ T5896] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 537.222202][ T5896] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 537.251921][ C0] lec0: NETDEV WATCHDOG: CPU: 0: transmit queue 0 timed out 5010 ms [ 537.259952][ C0] lec:lec_tx_timeout: lec0 [ 537.264528][ C0] lec:lec_start_xmit: lec0:No lecd attached [ 537.852544][ T47] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 538.252147][ T5888] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 538.813379][ T24] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 539.303183][ T5896] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 540.332380][ T5888] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 540.893510][ T47] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 541.373344][ T5888] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 542.271907][ C0] lec0: NETDEV WATCHDOG: CPU: 0: transmit queue 0 timed out 5010 ms [ 542.279941][ C0] lec:lec_tx_timeout: lec0 [ 542.284671][ C0] lec:lec_start_xmit: lec0:No lecd attached [ 542.422843][ T10] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 543.452324][ T10] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 543.934874][ T24] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 544.492302][ T10] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 545.534761][ T5896] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 546.582471][ T10] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 546.973361][ T24] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 547.302016][ C0] lec0: NETDEV WATCHDOG: CPU: 0: transmit queue 0 timed out 5020 ms [ 547.310047][ C0] lec:lec_tx_timeout: lec0 [ 547.314739][ C0] lec:lec_start_xmit: lec0:No lecd attached [ 547.612225][ T5888] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 548.413091][ T1988] block nbd2: Possible stuck request ffff888026f90000: control (read@0,1024B). Runtime 270 seconds [ 548.424200][ T1988] block nbd2: Possible stuck request ffff888026f90200: control (read@1024,1024B). Runtime 270 seconds [ 548.435438][ T1988] block nbd2: Possible stuck request ffff888026f90400: control (read@2048,1024B). Runtime 270 seconds [ 548.446495][ T1988] block nbd2: Possible stuck request ffff888026f90600: control (read@3072,1024B). Runtime 270 seconds [ 548.458064][ T24] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 548.662560][ T10] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 549.692312][ T5896] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 550.012407][ T5833] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 550.255653][T19103] netlink: 'syz.1.3389': attribute type 1 has an invalid length. [ 550.264229][T19103] netlink: 'syz.1.3389': attribute type 2 has an invalid length. [ 550.272931][T19103] netlink: 'syz.1.3389': attribute type 1 has an invalid length. [ 550.280676][T19103] netlink: 16 bytes leftover after parsing attributes in process `syz.1.3389'. [ 550.439312][T19121] openvswitch: netlink: Flow get message rejected, Key attribute missing. [ 550.443303][T19120] netlink: 12 bytes leftover after parsing attributes in process `syz.3.3395'. [ 550.663643][T19140] netlink: 56 bytes leftover after parsing attributes in process `syz.2.3400'. [ 550.693583][T19140] netlink: 12 bytes leftover after parsing attributes in process `syz.2.3400'. [ 550.701652][T19141] lo speed is unknown, defaulting to 1000 [ 550.721679][T19144] netlink: 28 bytes leftover after parsing attributes in process `syz.3.3401'. [ 550.736400][ T10] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 551.153623][T19160] lo speed is unknown, defaulting to 1000 [ 551.174469][T19164] netlink: 24 bytes leftover after parsing attributes in process `syz.3.3407'. [ 551.235904][T19168] x_tables: duplicate underflow at hook 1 [ 551.286826][T19164] netlink: 4 bytes leftover after parsing attributes in process `syz.3.3407'. [ 551.407986][T19180] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 551.452279][T19183] netlink: 8 bytes leftover after parsing attributes in process `syz.0.3413'. [ 551.464536][T19183] netlink: 8 bytes leftover after parsing attributes in process `syz.0.3413'. [ 551.492918][T19183] netlink: 8 bytes leftover after parsing attributes in process `syz.0.3413'. [ 551.705008][T19194] lo speed is unknown, defaulting to 1000 [ 552.084816][T19203] netdevsim netdevsim3 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 552.237582][T19203] netdevsim netdevsim3 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 552.432300][T19203] netdevsim netdevsim3 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 552.547523][T19231] tipc: Started in network mode [ 552.554902][T19231] tipc: Node identity cab6dfc3e887, cluster identity 4711 [ 552.567541][T19231] tipc: Enabled bearer , priority 0 [ 552.582500][T19241] netlink: 'syz.1.3427': attribute type 3 has an invalid length. [ 552.609788][T19203] netdevsim netdevsim3 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 552.635234][T19236] syzkaller0: entered promiscuous mode [ 552.640826][T19236] syzkaller0: entered allmulticast mode [ 552.655880][T19247] netlink: 'syz.4.3430': attribute type 4 has an invalid length. [ 552.749140][T19249] netlink: 'syz.0.3431': attribute type 18 has an invalid length. [ 552.761525][T19231] tipc: Resetting bearer [ 552.801181][T19230] tipc: Resetting bearer [ 552.837532][T19230] tipc: Disabling bearer [ 552.879933][ T13] netdevsim netdevsim3 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 552.888932][ T13] netdevsim netdevsim3 eth1: set [1, 0] type 2 family 0 port 6081 - 0 [ 552.924403][ T13] netdevsim netdevsim3 eth2: set [1, 0] type 2 family 0 port 6081 - 0 [ 552.938290][T19254] syzkaller0: entered promiscuous mode [ 552.947926][T19254] syzkaller0: entered allmulticast mode [ 553.016943][ T3519] netdevsim netdevsim3 eth3: set [1, 0] type 2 family 0 port 6081 - 0 [ 553.383931][T19281] sch_tbf: burst 127 is lower than device syzkaller0 mtu (1514) ! [ 553.427014][T19281] syzkaller0: entered promiscuous mode [ 553.445168][T19281] syzkaller0: entered allmulticast mode [ 553.531832][ C0] lec0: NETDEV WATCHDOG: CPU: 0: transmit queue 0 timed out 6220 ms [ 553.539869][ C0] lec:lec_tx_timeout: lec0 [ 553.544529][ C0] lec:lec_start_xmit: lec0:No lecd attached [ 553.807934][T19304] lo speed is unknown, defaulting to 1000 [ 554.227373][T19338] lo speed is unknown, defaulting to 1000 [ 554.576115][T19359] netlink: 'syz.2.3463': attribute type 7 has an invalid length. [ 554.728979][T19363] netlink: zone id is out of range [ 554.735614][T19363] 8021q: VLANs not supported on syzkaller1 [ 555.306877][T19383] x_tables: ip6_tables: MASQUERADE target: used from hooks INPUT, but only usable from POSTROUTING [ 555.519677][T19395] __nla_validate_parse: 42 callbacks suppressed [ 555.519697][T19395] netlink: 8 bytes leftover after parsing attributes in process `syz.2.3475'. [ 555.720838][T19403] netlink: 12 bytes leftover after parsing attributes in process `syz.4.3479'. [ 555.721049][T19400] netlink: 24 bytes leftover after parsing attributes in process `syz.3.3477'. [ 555.744796][T19403] netlink: 12 bytes leftover after parsing attributes in process `syz.4.3479'. [ 556.205215][T19422] syzkaller1: entered promiscuous mode [ 556.210743][T19422] syzkaller1: entered allmulticast mode [ 556.398984][T19430] netlink: 4 bytes leftover after parsing attributes in process `syz.4.3488'. [ 556.626989][T19442] bridge0: port 2(bridge_slave_1) entered disabled state [ 556.634716][T19442] bridge0: port 1(bridge_slave_0) entered disabled state [ 556.688735][T19442] bridge0: entered allmulticast mode [ 556.730254][T19442] A link change request failed with some changes committed already. Interface bridge0 may have been left with an inconsistent configuration, please check. [ 556.808258][T19449] netlink: 40 bytes leftover after parsing attributes in process `syz.4.3495'. [ 556.835989][T19451] netlink: 40 bytes leftover after parsing attributes in process `syz.1.3496'. [ 556.875911][T19457] netlink: 'syz.3.3497': attribute type 1 has an invalid length. [ 557.172868][T19476] netlink: 44 bytes leftover after parsing attributes in process `syz.2.3504'. [ 557.388792][T19481] lo speed is unknown, defaulting to 1000 [ 557.413577][T19485] netlink: 36 bytes leftover after parsing attributes in process `syz.4.3506'. [ 557.456378][T19485] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 557.513451][T19485] syzkaller1: entered promiscuous mode [ 557.534385][T19485] syzkaller1: entered allmulticast mode [ 557.778026][T19505] tap0: tun_chr_ioctl cmd 1074025676 [ 557.786399][T19505] tap0: owner set to 0 [ 557.804431][T19499] syzkaller0: entered promiscuous mode [ 557.809924][T19499] syzkaller0: entered allmulticast mode [ 558.394213][T19527] netlink: 40 bytes leftover after parsing attributes in process `syz.3.3518'. [ 558.474623][T19527] tipc: Enabled bearer , priority 0 [ 558.492884][T19527] syzkaller0: entered promiscuous mode [ 558.502913][T19527] syzkaller0: entered allmulticast mode [ 558.541380][T19529] delete_channel: no stack [ 558.566092][T19524] tipc: Resetting bearer [ 558.624994][T19536] netlink: 'syz.2.3523': attribute type 1 has an invalid length. [ 558.634237][T19524] tipc: Disabling bearer [ 559.130340][T19566] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 559.156448][T19568] xt_hashlimit: size too large, truncated to 1048576 [ 559.291819][ C0] lec0: NETDEV WATCHDOG: CPU: 0: transmit queue 0 timed out 5750 ms [ 559.299965][ C0] lec:lec_tx_timeout: lec0 [ 559.304651][ C0] lec:lec_start_xmit: lec0:No lecd attached [ 559.435658][T19578] netlink: 'syz.0.3537': attribute type 8 has an invalid length. [ 559.575472][T19584] lo speed is unknown, defaulting to 1000 [ 559.770922][T19597] bridge: RTM_NEWNEIGH bridge0 with NTF_USE is not supported [ 560.196022][T19618] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 560.623499][T19636] __nla_validate_parse: 6 callbacks suppressed [ 560.623513][T19636] netlink: 12 bytes leftover after parsing attributes in process `syz.2.3557'. [ 560.852565][ T29] audit: type=1107 audit(1772368546.472:8): pid=19640 uid=0 auid=4294967295 ses=4294967295 subj=unconfined msg='뻧Ay=n\YWYr74=q'j?лcoLi^_ʴ 5TUM1+wMGh'+O&y(ɴGg>ևH~k7s$kv=^)ug꺍' [ 560.856719][T19633] netlink: 'syz.0.3556': attribute type 1 has an invalid length. [ 560.974371][T19633] erspan1: entered allmulticast mode [ 561.103684][T19649] geneve2: entered promiscuous mode [ 561.108945][T19649] geneve2: entered allmulticast mode [ 561.185262][T19651] vlan2: entered promiscuous mode [ 561.192497][T19651] veth0_to_bridge: entered promiscuous mode [ 561.412586][T19667] netlink: 'syz.0.3566': attribute type 4 has an invalid length. [ 561.432345][T19671] netlink: 'syz.1.3567': attribute type 5 has an invalid length. [ 561.462695][T19667] netlink: 152 bytes leftover after parsing attributes in process `syz.0.3566'. [ 561.495306][ T29] audit: type=1800 audit(1772368547.122:9): pid=19637 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.2.3557" name="cgroup.controllers" dev="tmpfs" ino=464 res=0 errno=0 [ 561.550666][T19667] .`: renamed from bond0 (while UP) [ 561.824216][T19684] lo speed is unknown, defaulting to 1000 [ 562.440868][T19725] netlink: 'syz.2.3578': attribute type 4 has an invalid length. [ 562.754025][T19742] netlink: 'syz.3.3582': attribute type 1 has an invalid length. [ 562.756568][T19744] xt_hashlimit: size too large, truncated to 1048576 [ 562.762756][T19742] netlink: 'syz.3.3582': attribute type 4 has an invalid length. [ 562.778112][T19742] netlink: 9462 bytes leftover after parsing attributes in process `syz.3.3582'. [ 562.797794][T19749] netlink: 'syz.0.3585': attribute type 1 has an invalid length. [ 562.822884][T19742] netlink: 'syz.3.3582': attribute type 1 has an invalid length. [ 562.852717][T19742] netlink: 'syz.3.3582': attribute type 4 has an invalid length. [ 562.860572][T19742] netlink: 9462 bytes leftover after parsing attributes in process `syz.3.3582'. [ 562.880176][T19756] xt_hashlimit: size too large, truncated to 1048576 [ 562.914990][T19749] 8021q: adding VLAN 0 to HW filter on device bond0 [ 563.045965][T19764] x_tables: ip_tables: socket match: used from hooks OUTPUT, but only valid from PREROUTING/INPUT [ 563.081664][T19755] bond0: (slave veth3): Enslaving as an active interface with a down link [ 563.109036][T19749] 8021q: adding VLAN 0 to HW filter on device batadv1 [ 563.126164][T19749] bond0: (slave batadv1): making interface the new active one [ 563.149090][ T1302] ieee802154 phy1 wpan1: encryption failed: -22 [ 563.174389][T19749] batadv1: entered promiscuous mode [ 563.194107][T19749] bond0: (slave batadv1): Enslaving as an active interface with an up link [ 563.307429][T19769] sctp: [Deprecated]: syz.2.3587 (pid 19769) Use of int in max_burst socket option. [ 563.307429][T19769] Use struct sctp_assoc_value instead [ 563.445265][T19776] netlink: 'syz.1.3589': attribute type 1 has an invalid length. [ 563.524632][T19776] bond2: entered promiscuous mode [ 563.530216][T19776] 8021q: adding VLAN 0 to HW filter on device bond2 [ 563.789396][T19800] netlink: 12 bytes leftover after parsing attributes in process `syz.2.3594'. [ 563.822814][T19800] netlink: 8 bytes leftover after parsing attributes in process `syz.2.3594'. [ 564.010727][T19776] 8021q: adding VLAN 0 to HW filter on device bond2 [ 564.033109][T19776] bond2: (slave gre1): The slave device specified does not support setting the MAC address [ 564.094315][T19778] netlink: 'syz.0.3591': attribute type 11 has an invalid length. [ 564.111959][T19776] bond2: (slave gre1): Setting fail_over_mac to active for active-backup mode [ 564.124203][T19776] bond2: (slave gre1): making interface the new active one [ 564.152970][T19776] gre1: entered promiscuous mode [ 564.159530][T19776] bond2: (slave gre1): Enslaving as an active interface with an up link [ 564.197991][T19778] netlink: 199828 bytes leftover after parsing attributes in process `syz.0.3591'. [ 564.212918][T19814] netlink: 'syz.0.3591': attribute type 1 has an invalid length. [ 564.226791][ T5888] ------------[ cut here ]------------ [ 564.232880][ T5888] kernel BUG at net/core/skbuff.c:2295! [ 564.238548][ T5888] Oops: invalid opcode: 0000 [#1] SMP KASAN PTI [ 564.244802][ T5888] CPU: 0 UID: 0 PID: 5888 Comm: kworker/0:5 Not tainted syzkaller #0 PREEMPT(full) [ 564.254264][ T5888] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 564.264317][ T5888] Workqueue: mld mld_ifc_work [ 564.269092][ T5888] RIP: 0010:pskb_expand_head+0x12da/0x1320 [ 564.274895][ T5888] Code: f8 e9 81 f3 ff ff 44 89 f9 80 e1 07 80 c1 03 38 c1 0f 8c e0 f3 ff ff 4c 89 ff e8 71 7a ba f8 e9 d3 f3 ff ff e8 47 55 50 f8 90 <0f> 0b e8 3f 55 50 f8 90 0f 0b 44 89 f9 80 e1 07 80 c1 03 38 c1 0f [ 564.294597][ T5888] RSP: 0000:ffffc90003d87590 EFLAGS: 00010293 [ 564.300664][ T5888] RAX: ffffffff89753669 RBX: ffff888030ad2dc0 RCX: ffff88805c889e40 [ 564.308821][ T5888] RDX: 0000000000000000 RSI: 0000000093ca53c0 RDI: 0000000000000000 [ 564.316888][ T5888] RBP: 0000000000000000 R08: 0000000000000000 R09: 000000000000004c [ 564.324853][ T5888] R10: dffffc0000000000 R11: ffffffff8a32c890 R12: dffffc0000000000 [ 564.332829][ T5888] R13: 0000000000000820 R14: 0000000093ca53c0 R15: 00000000000006c0 [ 564.340794][ T5888] FS: 0000000000000000(0000) GS:ffff888125467000(0000) knlGS:0000000000000000 [ 564.350151][ T5888] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 564.356737][ T5888] CR2: 000000110c36218e CR3: 000000005baa8000 CR4: 00000000003526f0 [ 564.364796][ T5888] Call Trace: [ 564.368074][ T5888] [ 564.371000][ T5888] ? neigh_connected_output+0x1ea/0x460 [ 564.376756][ T5888] ipgre_header+0xd5/0x350 [ 564.381259][ T5888] ? __pfx_ipgre_header+0x10/0x10 [ 564.386300][ T5888] neigh_connected_output+0x286/0x460 [ 564.391945][ T5888] ? ip6_output+0x126/0x550 [ 564.396453][ T5888] ip6_output+0x340/0x550 [ 564.400776][ T5888] NF_HOOK+0xa2/0x3a0 [ 564.404761][ T5888] ? NF_HOOK+0xf9/0x3a0 [ 564.408926][ T5888] ? __pfx_NF_HOOK+0x10/0x10 [ 564.413513][ T5888] ? __pfx_dst_output+0x10/0x10 [ 564.418448][ T5888] ? lockdep_hardirqs_on+0x7a/0x110 [ 564.423651][ T5888] ? __local_bh_enable_ip+0xd0/0x130 [ 564.428943][ T5888] ? icmp6_dst_alloc+0x3a6/0x440 [ 564.433878][ T5888] mld_sendpack+0x8b4/0xe40 [ 564.438418][ T5888] ? look_up_lock_class+0x57/0x110 [ 564.443535][ T5888] ? mld_sendpack+0x213/0xe40 [ 564.448211][ T5888] ? __pfx_mld_sendpack+0x10/0x10 [ 564.453243][ T5888] mld_ifc_work+0x835/0xe70 [ 564.457746][ T5888] ? process_scheduled_works+0xa25/0x1830 [ 564.463464][ T5888] process_scheduled_works+0xb02/0x1830 [ 564.469022][ T5888] ? __pfx_process_scheduled_works+0x10/0x10 [ 564.474999][ T5888] ? assign_work+0x3d5/0x5e0 [ 564.479585][ T5888] worker_thread+0xa50/0xfc0 [ 564.484194][ T5888] kthread+0x388/0x470 [ 564.488260][ T5888] ? __pfx_worker_thread+0x10/0x10 [ 564.493362][ T5888] ? __pfx_kthread+0x10/0x10 [ 564.497943][ T5888] ret_from_fork+0x51e/0xb90 [ 564.502528][ T5888] ? __pfx_ret_from_fork+0x10/0x10 [ 564.507653][ T5888] ? __switch_to+0xc7d/0x1450 [ 564.512349][ T5888] ? __pfx_kthread+0x10/0x10 [ 564.516940][ T5888] ret_from_fork_asm+0x1a/0x30 [ 564.521833][ T5888] [ 564.524867][ T5888] Modules linked in: [ 564.529930][ T5888] ---[ end trace 0000000000000000 ]--- [ 564.536881][T19814] netlink: 16 bytes leftover after parsing attributes in process `syz.0.3591'. [ 564.586810][ T5888] RIP: 0010:pskb_expand_head+0x12da/0x1320 [ 564.601878][ T5888] Code: f8 e9 81 f3 ff ff 44 89 f9 80 e1 07 80 c1 03 38 c1 0f 8c e0 f3 ff ff 4c 89 ff e8 71 7a ba f8 e9 d3 f3 ff ff e8 47 55 50 f8 90 <0f> 0b e8 3f 55 50 f8 90 0f 0b 44 89 f9 80 e1 07 80 c1 03 38 c1 0f [ 564.644918][ T5888] RSP: 0000:ffffc90003d87590 EFLAGS: 00010293 [ 564.653511][ T5888] RAX: ffffffff89753669 RBX: ffff888030ad2dc0 RCX: ffff88805c889e40 [ 564.675063][ T5888] RDX: 0000000000000000 RSI: 0000000093ca53c0 RDI: 0000000000000000 [ 564.691821][ T5888] RBP: 0000000000000000 R08: 0000000000000000 R09: 000000000000004c [ 564.710107][ T5888] R10: dffffc0000000000 R11: ffffffff8a32c890 R12: dffffc0000000000 [ 564.725096][ T5888] R13: 0000000000000820 R14: 0000000093ca53c0 R15: 00000000000006c0 [ 564.740261][ T5888] FS: 0000000000000000(0000) GS:ffff888125467000(0000) knlGS:0000000000000000 [ 564.759713][ T5888] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 564.779332][ T5888] CR2: 00007f2dd96317e8 CR3: 000000005248c000 CR4: 00000000003526f0 [ 564.791826][ T5888] Kernel panic - not syncing: Fatal exception [ 564.798187][ T5888] Kernel Offset: disabled [ 564.802556][ T5888] Rebooting in 86400 seconds..