last executing test programs: 13m16.668050294s ago: executing program 2 (id=3): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = socket$inet6_sctp(0xa, 0x5, 0x84) getsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER(r1, 0x84, 0x7b, 0x0, &(0x7f0000000180)) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket$netlink(0x10, 0x3, 0x0) r4 = socket(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r4, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={0x0, 0x14}}, 0x0) getsockname$packet(r4, &(0x7f00000002c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000080)=0x7) sendmsg$nl_route(r3, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000008c0)=ANY=[@ANYBLOB="480000001000050700000086d7c0d6c878f064eb", @ANYRES32=r5, @ANYBLOB="0000000000000000790012000c00010076657468"], 0x48}}, 0x2000a800) sendmsg$nl_route_sched(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f00000004c0)={&(0x7f0000000900)=@newqdisc={0x30, 0x24, 0xf1d, 0x0, 0x0, {0x0, 0x0, 0x0, r5, {0xa, 0x8}, {0xffe0, 0xffff}, {0x9}}, [@qdisc_kind_options=@q_clsact={0xb}]}, 0x30}, 0x1, 0x0, 0x0, 0x4000000}, 0x4000800) sendmsg$nl_route_sched(r2, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000200)=@delchain={0x24, 0x66, 0xf31, 0xfffffff8, 0x0, {0x0, 0x0, 0x0, r5, {0xb, 0xc}, {0x10, 0xffff}, {0xd, 0x1b}}}, 0x24}, 0x1, 0x0, 0x0, 0x10}, 0x0) r6 = socket(0x40000000015, 0x5, 0x0) sendmsg$alg(r6, &(0x7f0000000480)={0x0, 0x0, 0x0}, 0x4000000) r7 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000000), 0xffffffffffffffff) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000040)=@newqdisc={0x4c, 0x24, 0x4ee4e6a52ff56541, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, {}, {0xffff, 0xffff}, {0xffe3}}, [@qdisc_kind_options=@q_netem={{0xa}, {0x1c}}]}, 0x4c}}, 0x0) bpf$PROG_LOAD_XDP(0x5, &(0x7f00000001c0)={0x13, 0x4, &(0x7f0000001300)=ANY=[@ANYBLOB="1800000000000000000000000000000079104e000000000095"], &(0x7f0000000040)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x9}, 0x94) sendmsg$ETHTOOL_MSG_LINKMODES_SET(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000040)=ANY=[@ANYBLOB='<\x00\x00\x00', @ANYRES16=r7, @ANYBLOB="0700000000000000000005000000180001801400020073797a5f74756e0000000000000000001000038004"], 0x3c}}, 0x0) 13m16.308835766s ago: executing program 2 (id=6): r0 = bpf$PROG_LOAD_XDP(0x5, &(0x7f00000001c0)={0x6, 0x1, &(0x7f0000000000)=@raw=[@alu={0x7, 0x1, 0x2, 0x9, 0xb, 0xffffffffffffffc0, 0x10}], &(0x7f0000000040)='GPL\x00', 0x2a, 0x10, &(0x7f0000000080)=""/16, 0x41100, 0x22, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, &(0x7f00000000c0)={0x9, 0x3}, 0x8, 0x10, &(0x7f0000000100)={0x4, 0x7, 0x6, 0x6}, 0x10, 0x0, 0x0, 0x1, &(0x7f0000000140)=[0x1, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff], &(0x7f0000000180)=[{0x0, 0x1, 0xf, 0x9}], 0x10, 0xad}, 0x94) ioctl$ifreq_SIOCGIFINDEX_vcan(0xffffffffffffffff, 0x8933, &(0x7f0000000280)={'vxcan0\x00', 0x0}) r2 = bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f00000002c0)={r0, r1, 0x25, 0x0, @void}, 0x10) ioctl$BTRFS_IOC_GET_DEV_STATS(r2, 0xc4089434, &(0x7f0000000300)={0x0, 0x2, 0x1, [0x2f, 0x0, 0x8, 0x2, 0xc635], [0xfffffffffffffff4, 0x2, 0xffffffff, 0x1, 0x2, 0x4, 0x8000000000000001, 0x9, 0xda4, 0x0, 0xe, 0x9, 0xe3, 0x2, 0x5, 0x3, 0x5, 0x3, 0x2, 0xfffffffffffffff9, 0x7, 0x8, 0xb, 0x9, 0xcc, 0x7567, 0x9, 0x7f, 0x38000000, 0xfffffffffffffff8, 0xfffffffffffffffc, 0x8, 0x96d1, 0x200, 0x4, 0x7, 0x1f, 0x9, 0xde6, 0x8, 0xd86d, 0x6, 0x1, 0x8000000000000001, 0x2, 0x10, 0x53, 0x5, 0x3, 0x10001, 0x3, 0x3, 0x10000000000000, 0x3, 0x7, 0x100000001, 0xb19, 0xab06, 0x0, 0x4, 0x3, 0x80000000, 0x10, 0x0, 0x2, 0x8, 0x5, 0x7, 0xb4000000000, 0x7, 0x0, 0x100, 0x8, 0x3, 0x1, 0x1, 0x7, 0xfff, 0xc, 0x9, 0x5, 0x7, 0x1, 0x2, 0x2, 0x48e, 0xffff, 0x0, 0x1ec, 0xffffffffffff9b19, 0x3d, 0x2, 0x101, 0x100, 0x1000, 0x178c00000, 0x7ff, 0x2, 0x0, 0x3, 0x2, 0x100000001, 0x0, 0xfffffffffffffffd, 0x1000, 0xe, 0x8001, 0x7, 0x9, 0x8, 0x9, 0xf92, 0x6, 0x9779, 0x8001, 0xe3, 0x8, 0x3, 0x45aa, 0x0, 0x6]}) ioctl$BTRFS_IOC_DEV_INFO(r2, 0xd000941e, &(0x7f0000000740)={r3, "f4d17f8b1a292972fe3ed2428d6bfcf2"}) bpf$BPF_GET_PROG_INFO(0xf, &(0x7f0000001a00)={r0, 0xe0, &(0x7f0000001900)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, &(0x7f0000001740)=[0x0, 0x0, 0x0, 0x0], ""/16, 0x0, 0x0, 0x0, 0x0, 0x7, 0x5, &(0x7f0000001780)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], &(0x7f00000017c0)=[0x0, 0x0, 0x0, 0x0, 0x0], 0x0, 0x3b, &(0x7f0000001800)=[{}, {}, {}, {}, {}, {}], 0x30, 0x10, &(0x7f0000001840), &(0x7f0000001880), 0x8, 0x61, 0x8, 0x8, &(0x7f00000018c0)}}, 0x10) ioctl$FS_IOC_GET_ENCRYPTION_NONCE(r0, 0x8010661b, &(0x7f0000001a40)) r6 = epoll_create(0x2) epoll_ctl$EPOLL_CTL_ADD(r6, 0x1, r0, &(0x7f0000001a80)={0x40000000}) r7 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f0000001ac0)={0x1b, 0x0, 0x0, 0x7fffffff, 0x0, 0xffffffffffffffff, 0x3ff, '\x00', r1, r2, 0x3, 0x1, 0x4}, 0x50) bpf$BPF_MAP_CONST_STR_FREEZE(0x16, &(0x7f0000001b40)={0x1, 0xffffffffffffffff}, 0x4) r9 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000001d40)={0x2, 0x4, 0x8, 0x1, 0x80, 0xffffffffffffffff, 0x1, '\x00', r5, 0xffffffffffffffff, 0x4, 0x2, 0x2}, 0x50) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000001e40)={0x18, 0x14, &(0x7f0000001b80)=@ringbuf={{0x18, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x10001}, {{0x18, 0x1, 0x1, 0x0, r7}}, {}, [@map_fd={0x18, 0xa, 0x1, 0x0, r8}, @exit, @map_idx={0x18, 0x8, 0x5, 0x0, 0x10}], {{}, {0x7, 0x0, 0xb, 0x2, 0x0, 0x0, 0x2}, {0x85, 0x0, 0x0, 0x84}}}, &(0x7f0000001c40)='syzkaller\x00', 0x10001, 0x7, &(0x7f0000001c80)=""/7, 0x41100, 0x5, '\x00', r1, 0x0, 0xffffffffffffffff, 0x8, &(0x7f0000001cc0)={0xa, 0x5}, 0x8, 0x10, &(0x7f0000001d00)={0x3, 0x1, 0x9, 0x8}, 0x10, 0x0, 0x0, 0x3, &(0x7f0000001dc0)=[r9], &(0x7f0000001e00)=[{0x1, 0xfffffff9, 0xf, 0x4}, {0x0, 0x2, 0x2, 0x1}, {0x0, 0x1, 0xa, 0xa}], 0x10, 0x2}, 0x94) r10 = accept$inet(0xffffffffffffffff, &(0x7f0000001f00)={0x2, 0x0, @local}, &(0x7f0000001f40)=0x10) bind$inet(r10, &(0x7f0000001f80)={0x2, 0x4e22, @multicast1}, 0x10) r11 = socket$inet6_mptcp(0xa, 0x1, 0x106) sendto$inet6(r11, &(0x7f0000001fc0), 0x0, 0x40000, &(0x7f0000002000)={0xa, 0x4e23, 0x10, @dev={0xfe, 0x80, '\x00', 0x1b}}, 0x1c) r12 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL80211_CMD_SET_REG(r12, &(0x7f0000002100)={&(0x7f0000002040)={0x10, 0x0, 0x0, 0x4080400}, 0xc, &(0x7f00000020c0)={&(0x7f0000002080)={0x14, 0x0, 0x4, 0x70bd2b, 0x25dfdbfb}, 0x14}, 0x1, 0x0, 0x0, 0x4}, 0x4000004) socketpair$tipc(0x1e, 0x2, 0x0, &(0x7f0000002140)={0xffffffffffffffff}) unshare(0x2000000) ioctl$XFS_IOC_START_COMMIT(r13, 0x80585882, &(0x7f0000002180)={0xffffffffffffffff}) bpf$BPF_PROG_QUERY(0x10, &(0x7f0000002300)={@cgroup, 0x1d, 0x0, 0x26, &(0x7f0000002200)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0], 0x6, 0x0, &(0x7f0000002240)=[0x0, 0x0, 0x0, 0x0], &(0x7f0000002280)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], &(0x7f00000022c0)=[0x0, 0x0, 0x0, 0x0, 0x0], 0x0}, 0x40) bpf$BPF_PROG_DETACH(0x9, &(0x7f0000002340)={@fallback=r11, r14, 0x16, 0x20, 0x0, @void, @void, @void, @value=r4, r15}, 0x20) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r10, 0x8933, &(0x7f00000023c0)={'batadv0\x00', 0x0}) sendmsg$nl_route(r14, &(0x7f0000002480)={&(0x7f0000002380)={0x10, 0x0, 0x0, 0x400}, 0xc, &(0x7f0000002440)={&(0x7f0000002400)=@ipv4_getnetconf={0x34, 0x52, 0x400, 0x70bd2b, 0x25dfdbfc, {}, [@NETCONFA_IFINDEX={0x8, 0x1, r16}, @NETCONFA_IFINDEX={0x8, 0x1, r1}, @NETCONFA_PROXY_NEIGH={0x8, 0x5, 0x4}, @NETCONFA_RP_FILTER={0x8, 0x3, 0x8}]}, 0x34}, 0x1, 0x0, 0x0, 0x20040011}, 0x4) getsockopt$inet_sctp6_SCTP_SOCKOPT_PEELOFF(r14, 0x84, 0x66, &(0x7f00000024c0)={0x0, 0x7}, &(0x7f0000002500)=0x8) getsockopt$inet_sctp_SCTP_SOCKOPT_PEELOFF(r14, 0x84, 0x66, &(0x7f0000002540)={r17, 0xff}, &(0x7f0000002580)=0x8) setsockopt$MRT_ADD_VIF(r10, 0x0, 0xca, &(0x7f00000025c0)={0xffffffffffffffff, 0x4, 0xfd, 0x8, @vifc_lcl_ifindex=r1, @empty}, 0x10) ioctl$PPPIOCGCHAN(r14, 0x80047437, &(0x7f0000002600)) 13m16.203221907s ago: executing program 2 (id=7): socket$inet6_sctp(0xa, 0x5, 0x84) (async) r0 = socket$inet6_sctp(0xa, 0x5, 0x84) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r0, 0x84, 0x6f, &(0x7f0000000000)={0x0, 0x1c, &(0x7f0000000300)=[@in6={0xa, 0xdc9, 0x4, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, 0xb0e}]}, &(0x7f0000000240)=0x10) (async) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r0, 0x84, 0x6f, &(0x7f0000000000)={0x0, 0x1c, &(0x7f0000000300)=[@in6={0xa, 0xdc9, 0x4, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, 0xb0e}]}, &(0x7f0000000240)=0x10) r1 = accept$packet(0xffffffffffffffff, &(0x7f0000000040)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @multicast}, &(0x7f0000000080)=0x14) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(0xffffffffffffffff, 0x89f0, &(0x7f00000001c0)={'erspan0\x00', &(0x7f0000000100)={'erspan0\x00', 0x0, 0x1, 0x7, 0xfff, 0x8, {{0x5, 0x4, 0x0, 0x2, 0x14, 0x67, 0x0, 0x3, 0x2f, 0x0, @rand_addr=0x64010102, @loopback}}}}) r4 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f00000007c0)={0x1b, 0x0, 0x0, 0x40000, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0}, 0x48) socket$packet(0x11, 0x2, 0x300) (async) r5 = socket$packet(0x11, 0x2, 0x300) r6 = bpf$MAP_CREATE(0x0, &(0x7f0000000280)=ANY=[@ANYBLOB="0b00000008000000070000000300000001"], 0x50) r7 = bpf$MAP_CREATE(0x0, &(0x7f0000000280)=ANY=[], 0x50) bpf$MAP_CREATE(0x0, &(0x7f0000000640)=@base={0x1e, 0x0, 0x2, 0x200000ff, 0x4, 0x1}, 0x48) (async) r8 = bpf$MAP_CREATE(0x0, &(0x7f0000000640)=@base={0x1e, 0x0, 0x2, 0x200000ff, 0x4, 0x1}, 0x48) bpf$MAP_UPDATE_BATCH(0x1a, &(0x7f00000004c0)={0x0, 0x0, &(0x7f0000000640), &(0x7f0000000740), 0x20075, r7}, 0x38) (async) bpf$MAP_UPDATE_BATCH(0x1a, &(0x7f00000004c0)={0x0, 0x0, &(0x7f0000000640), &(0x7f0000000740), 0x20075, r7}, 0x38) r9 = bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r7, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000300000095"], 0x0, 0x0, 0xfffffffffffffe8b, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000200)={&(0x7f0000000000)=ANY=[@ANYBLOB="9feb010018000000000000004c0000004c0000001c000000000000000000000104000000200000000500000001000004040000000100000001000000000000001800000002000004080000001300000002000000000000000100000001000000200000000076616c006270665f7370696e5f6c6f636b006c6f636b0066"], 0x0, 0x80, 0x0, 0x0, 0x9}, 0x28) (async) r10 = bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000200)={&(0x7f0000000000)=ANY=[@ANYBLOB="9feb010018000000000000004c0000004c0000001c000000000000000000000104000000200000000500000001000004040000000100000001000000000000001800000002000004080000001300000002000000000000000100000001000000200000000076616c006270665f7370696e5f6c6f636b006c6f636b0066"], 0x0, 0x80, 0x0, 0x0, 0x9}, 0x28) r11 = bpf$MAP_CREATE(0x0, &(0x7f0000000040)=@base={0x23, 0x4, 0x8, 0xbc0, 0x1, 0xffffffffffffffff, 0x0, '\x00', 0x0, r10, 0x1, 0x3}, 0x50) bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000001980)={0x2, 0x4, 0x8, 0x1, 0x80, r7, 0x9, '\x00', 0x0, 0xffffffffffffffff, 0x5, 0x3, 0x1}, 0x50) (async) r12 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000001980)={0x2, 0x4, 0x8, 0x1, 0x80, r7, 0x9, '\x00', 0x0, 0xffffffffffffffff, 0x5, 0x3, 0x1}, 0x50) bpf$BPF_MAP_CONST_STR_FREEZE(0x16, &(0x7f00000006c0)={r6, 0xffffffffffffffff}, 0x4) bpf$MAP_UPDATE_CONST_STR(0x2, &(0x7f0000001e00)={{r7, 0xffffffffffffffff}, &(0x7f0000001d80), &(0x7f0000001dc0)='%-010d \x00'}, 0x20) ioctl$XFS_IOC_FD_TO_HANDLE(r4, 0xc038586a, &(0x7f0000001f40)={r12, &(0x7f0000001e40)='syzkaller\x00', 0x48301, &(0x7f0000001e80)={@align=0x9, {0x6, 0x3, 0x8, 0x10}}, 0x3, &(0x7f0000001ec0), &(0x7f0000001f00)=0x1}) bpf$PROG_LOAD(0x5, &(0x7f0000001fc0)={0x1f, 0x2b, &(0x7f0000001b40)=@raw=[@snprintf={{}, {}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0xfffffff8}, {}, {}, {}, {}, {}, {}, {0x18, 0x3, 0x2, 0x0, r11}}, @map_idx={0x18, 0xa, 0x5, 0x0, 0x5}, @snprintf={{}, {}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0x2d}, {}, {}, {}, {}, {}, {}, {0x18, 0x3, 0x2, 0x0, r12}}, @alu={0x7, 0x0, 0xa, 0xa, 0x4, 0x8}, @snprintf={{}, {}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0x2}, {}, {}, {}, {}, {}, {}, {0x18, 0x3, 0x2, 0x0, r13}}, @jmp={0x5, 0x1, 0x8, 0x5, 0x6, 0x18, 0x1}], &(0x7f0000001cc0)='syzkaller\x00', 0x5, 0x0, 0x0, 0x41100, 0x20, '\x00', r3, @fallback=0x9, r10, 0x8, &(0x7f0000001d00)={0x8, 0x2}, 0x8, 0x10, &(0x7f0000001d40)={0x3, 0x9, 0x6, 0x3a}, 0x10, 0x0, r9, 0x0, &(0x7f0000001f80)=[r14, r12, r12, r11, r15, r6, r4], 0x0, 0x10, 0x1}, 0x94) r16 = bpf$MAP_CREATE(0x0, &(0x7f0000000100)=@base={0x9, 0x4, 0x7fe2, 0x1, 0x2}, 0x50) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000400)={{r16}, &(0x7f0000000180), &(0x7f0000000340)}, 0x20) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000001a80)={0x11, 0x35, &(0x7f0000001640)=@ringbuf={{0x18, 0x0, 0x0, 0x0, 0x30a2, 0x0, 0x0, 0x0, 0xffff}, {{0x18, 0x1, 0x1, 0x0, r8}}, {}, [@exit, @snprintf={{}, {}, {}, {}, {}, {}, {}, {}, {}, {0x18, 0x3, 0x2, 0x0, r6}}, @exit, @map_fd={0x18, 0x9, 0x1, 0x0, r16}, @exit, @ldst={0x1, 0x2, 0x4, 0x2, 0xb, 0x30, 0x4}, @ringbuf_output={{0x18, 0x1, 0x1, 0x0, r8}, {}, {}, {}, {}, {}, {0x7, 0x0, 0xb, 0x4, 0x0, 0x0, 0x1}}, @btf_id={0x18, 0x0, 0x3, 0x0, 0x3}, @printk={@p, {}, {}, {}, {}, {0x7, 0x0, 0xb, 0x3, 0x0, 0x0, 0x7}}], {{}, {0x7, 0x0, 0xb, 0x2, 0x0, 0x0, 0x1}, {0x85, 0x0, 0x0, 0x85}}}, &(0x7f0000001800)='syzkaller\x00', 0x1ff, 0x86, &(0x7f0000001840)=""/134, 0x41100, 0x0, '\x00', r2, 0x0, r10, 0x8, &(0x7f0000001900)={0x4, 0x1}, 0x8, 0x10, &(0x7f0000001940)={0x5, 0x7, 0x5, 0x9}, 0x10, 0x0, 0x0, 0x2, &(0x7f0000001a00)=[r4, r12, r4, 0x1, r6, r7, 0xffffffffffffffff, r4, 0x1], &(0x7f0000001a40)=[{0x1, 0x5, 0x1, 0x7}, {0x0, 0x7, 0x4, 0x6}], 0x10, 0x80000001}, 0x94) bpf$PROG_LOAD(0x5, &(0x7f0000000880)={0x1, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x10, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) (async) r17 = bpf$PROG_LOAD(0x5, &(0x7f0000000880)={0x1, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x10, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) setsockopt$sock_attach_bpf(r5, 0x1, 0x32, &(0x7f0000000180)=r17, 0x4) bpf$BPF_GET_BTF_INFO(0xf, &(0x7f0000000680)={0xffffffffffffffff, 0x20, &(0x7f0000000640)={&(0x7f00000002c0)=""/35, 0x23, 0x0, &(0x7f0000000540)=""/238, 0xee}}, 0x10) r19 = bpf$PROG_LOAD(0x5, &(0x7f0000000380)={0xc, 0xe, &(0x7f0000000940)=ANY=[@ANYBLOB="b702000003000000bfa30000000000000703000000feffff7a0af0ff0100000079a4f0ff00000000b7060000ffffffff2d6405000000000065040400010000000404000001007d60b7030000000000006a0a00fe00000000850000000d000000b70000000000000095000000000000005ecefab8f2e85c6c1ca711fcd0cdfa146ec561750379585e5a076d839240d29c034055b67dafe6c8dc3d5d0f65acc0d06d1a1434e4d5b3185fec0e07004e60c08dc8b8dbf11e6e94d75938321a3aa502cd2424a66e6d2ef831ab7ea0c34f17e3946ef3bb622e03b538dfd8e012e79578e51bc53099e90f4580d760551b5b341a29f31e3106d1ddd6152f7cbdb9cd38bdb2209c67deca8eeb9c15ab3a14817ac61e4dd11183a13477bf7e860e3670ef0e789f65f1328d670490010000004b82d2789cb132b8667c2147661df28d9961b63e1a9cf6c2a660a1fe3c184b751c51160fb20b1c690220b87b20581e7be6ba0dc001c4110555850915148ba532e6ea09c346dfebd38608b3280080005d9a9500000000000000334d83239dd27080851dcac3c12233f9a1fb9c2aec61ce63a38d2fd50117b89a9ab359b4eea0c6e95767d42b4e54861d0227dbfd2e6d7f715a7f3deadd713089856f756436303767d2e24f29e5dad9796edb697a8ad004eea0182babd18cac1bd4f4390af9a9ceafd0002cab154ad029a1090000002780870014f51c3c975d5aec84222fc4a0ec4be3e563112f0b39501aafe234870072858dc06e7c337642d3e5a815232f5e16c1b30c3a6a71bc85018e5ff22dc518afc9ffc2cc788bee1b47683db01a2f9398685211dfbbae3e2ed0a50e7313bff5d4c391ddece00fc772dd6b4d4de2a41990f05ca3bdfc92c88c5b8dcd36e7487afa447e2edfae4f390a8337841cef386e22cc22ee17476d738952229682e24b92533ac2a9f5a699593f084419cae0b4532bcc97d3ae526aca54183fb01c73f979ca9857399537f5831808b0dc2a2d0e0000000000000578673f8b6e74ce23877a6b24db0e067345560942fa629fbef2461c96a088a22e8b15c3e233db00002e30d46a9d24d37cef099ece729aa218f9f44a3210223fdae7ed04935c3c90d3add8eebc8619d73415cda2130f5011e4845535a8b90dfae158b94f50adab988dd8e12baf5cc9398fff00404d5d99f82e20ee6a8c88e18c2977aab37d9ac4cfc1c7b400000000000007ff57c39495c826b956ba859ac8e3c177b91bd7d5e41ff868f7ca1664fe2f3ced846891180604b6dd2499d16d7d9158ffffffff00000000ef069dc42749a89f854797f29d0000002d8c38a967c1bbe09315c29877a308bcc87dc3addb08141bdee5d27874b2f663ddeef0005b3d96c7aabf4df517d90bdc01e73835d50200a90800c66ee2b1ad76dff9f9003f07000099d4894ee7f8249dc1e3428d2129369ee1b85af6eb2eea0d0df414b315f651c8412392191fa83ee830548f11e1036a8debd64cbe359454a3f2239cfe35f81b7a490f167e6d5c1109000000000000000042b8ff8c21ad702ccacad5b39eef213d1ca296d2a27798c8ce2a305c0c7d35cf4b22549a4bd92052188bd1f285f653b621491dc6aaee0200e2ff08644fb94c06006eff1be2f633c1d987591ec3db58a7bb3042ec3f771f7a1338a5c3dd35e926049fe86e09c58e273cd905deb28c13c1ed1c0d9cae846bcbfa8cce7b893e578af7dc7d5e87d44ff828de453f34c2b18660b080efc707e676e1fb4d5825c0ca177a4c7fbb4eda0545c00f576b2b5cc7f819abd0f885cc4806f40300966fcf1e54f5a2d38708294cd6f496e5dee734fe7da3770845cf442d488afd80e17000000000000000000000000000000000000000000000000000005205000000dc1c56d19f35d367632952a93466ae595c6a8cda690d192a070886df42b27098773b45198b4a34ac977ebd4450e121d01342703f5bf030e935878a6d169c80aa4252d4ea6b8f6216ff202b5b5a182cb5e838b307632d03a7ca6f6d0339f9953c3093c3690d10ecb65dc5b47481edbf1f000000000000004d16d29c28eb5167e9936ed327fb237a56224e49d9ea955a5f0dec1b3ccd35364600000000000000000000000000000000000000000000000000000000000026ded4dd6fe1518cc7802043ecfe69f743f1213bf8179ecd9e5a225d67521dc728eac7d80a5656ac2cbde21d3ebfbf69ff861f4394836ddf128d6d19079e64336e7c676505c78ad67548f4b192be1827fcd95cf107753cb0a6a979d3db08407081c6281e2d8429a8639034a75f4c7df3ea8fc2018d07af1491ef060cd4403a099f32468f65bd06b4092140faed0c329be610c3082d43e121861b5cc03f1a1561f0589e0d12969bc982ff5d8e9b986c0c6c747d9a1cc500bb892c3a16ff10feea20bdac0000000000000000ca06f256c8028e0f9b65f037b21f3289f86a6826c69fa35ba5cbc3f2db1516ffc5c6e3fa618b24a6ce16d6c7486af7a19f4a375b8974e69115d33394e86e4b838297ba20f96936b7e4746e92dea6c5d1d33d84d96b50fb000000ae07c65b71088dd7d5d1e1bab9000000000000000000000000b5ace293bec833c13e3229432ad71d646218b5229dd88137fc7c59aa242af3bb4efb82055a3b61227ad40f52c9f2500579aca11033bb9cc16bd83a00840e31d828ec78e116ae46c4897e2795b6ff92e9a1e24b0b855c02f2b7add58ffb25f339297729a7a51810134d3dfbf71f6516737be55c06d9cdcfb1e2bb10b50000eb4acff90756dba1ecf9f58afd3c19b5c4558ba9af6b7333c894a1fb29ade9ad75c9c022e8d03fe28bc3586844ae92aa771dbfe80745fe89ad349ffaad76ff9dd643796caffdf67af5dd476c37e7e9a84e2e5da2696e285a59b53f2fb0e16d8262c080c159ce1d9bc7ef3e3f40c14089c82759106f422582b42e3e8484ea5a6ad9aa52106eafe0e0caea1ad4cb23f3c2b8a0f455ba69ea284c268d54b43158a8b1d128d02af263b3dc1cab794c9ac57a2a7332f4d8764c302ccd5aac114482b619fc515aa0dd2777e881e29a854380e2f1e49db5a1517ec40bb3fa44f9959bad67ccaba76408da35c9f1534c8bd48bbd61627a2e0a74b5e6aefb7eee403502734137ff47257f164391c673b6079e65d7295eed164ca63e4ea26dce0fb3ce0f6591d80dfb8f386bb74b5589829b6b0679b5d6fccbecfae5553d9950d48c774eaa35b24fce69a20d8bc410d9f48bf7eac90529cd6af061c9e53addddc620ce73c5d177e3d097159f2768636fc10276c6a0adc57483b3f7083f66b87ef296ee85e9bb70a3009a5d30f479e293a3302e11350ea857b37e76ca2f50378e4092ce2c574ad278b9b7b717c571afb2077b019fd9d89efd59b41f051ec5a8ff87ecc8df917a1e386d849fcd10e2f9ca52e02339c2f4666b0c545e25f1cd62421c28d25994be0cff7271a0dee38d7ac4ac736b090e1d29f981179186e4000000000000646174b55d251f7f8ca5ccc22a5efb33b237eff5597a3c3a5f3a9bb54abb40e54593e1a7ce4cfa17b3c3fe91c06363496341eae20dcc59b6179b32ddddef5c34000096a54c0c571a91878f61f74912e2299e5501d4d6943bfd74c856511726f0ac8f7d17f1c6b4451c1bcdc6b6e1700e4cd87709d97afc5423c96fa981873d4369b04bbf1fb9f68f17991540868e408201ad1a74179e489aa61f021a437a3fa935588be2068f7ff9b253106326fde795e530b93626cc68e06e602198724249b4445eef08401cd1a3e266db41474e69902e4d8f5da4e94cc36794258fd4032de7ab36bc24c5efd5c8495c1ccd580033c55725f2d60354f8ad5914a0155eaa743350ddb388f486b6de0549ef3b1b3c3b7d4d3a830ff39885776119408029be3788dd8422b1ab7b4c9d5b7d8682fd759c713108e1bdfc64b9121bbf07099def5c0ce3c861ae4b5cad8bba5a0b6059b9ef90c2f96a59320309e25df89484522bb1d6eaa92164f9e4042cb689a45a898354c17b08705205a9189772bcbcb6414e44b33a2470d3bc16f761c33f565b9da5e7991ad8482579cc1b16c1fcec815a5482ae8b1779c5e339971a6ec1217bcfd1ef24284de8a0a9f068f297037d6478c2434a9a18dcc6c7c791e444a79d7ce37f9cf2a434b9048ca6a2fa254aa02cd098026798a6d336348af0fc11fa2809a5ebbe17ca4d6356e4450d043ed20d313cd56a56d2e4cdf26f19af9a41695a58a9b6b45af1ca939b18d7b57791b99cfc6ec2a0848c29fea4eb8b82395a38e8aca51d7eb313a9a390ab4bfc2ad8acf2e51b766f8ecd16194ad41ec097082f7fa32179ef99dafa6c2aa206a25ddc33e6f0a09169eeff428c71f54e1dfcfcd7cfc8f6e169f11c47d504cb363b56dfc9638a84db26c9d1cc1c1a79c14316a599b5ca9f904f7db85f8e7a387f183f42e2f04079c58f9e33925bd95e7c2369bc124fc786c72bfce792307d0ca4de6e3df5dfc9a93305e71f2ab791fa8df2895f5667b037edfa0db1e32c4a1adeb982a2e56b53b88e7de90f70f8ebe74c50ab3f991ce6bba7d91482a6276b144d5781fc04a30ba983b943efd5d57918966c6a5cc0714f9b3bd2f60f7756d5567a8ffcdc2a"], &(0x7f0000000340)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, r18}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000080)={r19, 0x18000000000002a0, 0x36, 0xfffffeb2, &(0x7f0000000500)="b9ff03076804268cb89e14f086dd47e0ffff2000002800000000ac141416e000000129a130112b92121f9ae0dd972fa104edcce40d8d", 0x0, 0x2800, 0x60000000, 0x0, 0x0, 0x0, 0x0}, 0x4c) r20 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r20, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000300)={0x20, 0x43, 0x1, 0x70bd2d, 0x0, {0x3, 0x1}, [@generic="0f000000", @typed={0x8, 0x1, 0x0, 0x0, @binary="00112233"}]}, 0x20}}, 0x0) sendto$packet(r1, &(0x7f00000000c0)="3af240fc3fabf7a25eba0708f038bbf6668a3dabe9a2b76bf6e07ca8bce50aebca0109f719aa99eb39b1c9b97fdc0b6b4586bfcf70cefc3d", 0x38, 0x4000004, &(0x7f0000000200)={0x11, 0x1a, r3, 0x1, 0x8, 0x6, @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x2}}, 0x14) (async) sendto$packet(r1, &(0x7f00000000c0)="3af240fc3fabf7a25eba0708f038bbf6668a3dabe9a2b76bf6e07ca8bce50aebca0109f719aa99eb39b1c9b97fdc0b6b4586bfcf70cefc3d", 0x38, 0x4000004, &(0x7f0000000200)={0x11, 0x1a, r3, 0x1, 0x8, 0x6, @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x2}}, 0x14) 13m12.677785633s ago: executing program 2 (id=19): r0 = socket$inet6_sctp(0xa, 0x801, 0x84) (async) close(0x3) (async) r1 = socket(0x2a, 0x3, 0x7) (async) r2 = socket$inet6_sctp(0xa, 0x5, 0x84) shutdown(r2, 0x0) (async) close(0x3) (async) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r2, 0x84, 0x6f, &(0x7f0000000200)={0x0, 0x10, &(0x7f00000001c0)=[@in={0x2, 0x4e23, @rand_addr=0x64010100}]}, &(0x7f0000001280)=0x10) getsockopt$inet_sctp6_SCTP_PRIMARY_ADDR(r2, 0x84, 0x7a, &(0x7f0000000340)={r3, @in6={{0xa, 0x3, 0x4, @mcast1}}}, &(0x7f0000000040)=0x84) (async) sendmmsg$inet_sctp(r1, &(0x7f0000000180)=[{0x0, 0x0, 0x0, 0x0, &(0x7f0000000700)=ANY=[@ANYBLOB="30000000000000008400000001000000000000017c"], 0x30}], 0x492492492492775, 0x0) getsockopt$inet_sctp_SCTP_ENABLE_STREAM_RESET(r1, 0x84, 0x76, &(0x7f0000000000)={r4, 0x1c0}, &(0x7f0000000080)=0x8) socket$inet_sctp(0x2, 0x5, 0x84) sendmsg$IPVS_CMD_SET_INFO(r1, &(0x7f0000000240)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x400}, 0xc, &(0x7f0000000140)={&(0x7f0000000100)={0x14, 0x0, 0x200, 0x70bd2b, 0x25dfdbfc}, 0x14}, 0x1, 0x0, 0x0, 0x60008010}, 0x800) setsockopt$inet_sctp6_SCTP_AUTH_ACTIVE_KEY(r0, 0x84, 0x83, &(0x7f0000000480)={r5, 0x2}, 0x8) 13m12.30959053s ago: executing program 32 (id=19): r0 = socket$inet6_sctp(0xa, 0x801, 0x84) (async) close(0x3) (async) r1 = socket(0x2a, 0x3, 0x7) (async) r2 = socket$inet6_sctp(0xa, 0x5, 0x84) shutdown(r2, 0x0) (async) close(0x3) (async) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r2, 0x84, 0x6f, &(0x7f0000000200)={0x0, 0x10, &(0x7f00000001c0)=[@in={0x2, 0x4e23, @rand_addr=0x64010100}]}, &(0x7f0000001280)=0x10) getsockopt$inet_sctp6_SCTP_PRIMARY_ADDR(r2, 0x84, 0x7a, &(0x7f0000000340)={r3, @in6={{0xa, 0x3, 0x4, @mcast1}}}, &(0x7f0000000040)=0x84) (async) sendmmsg$inet_sctp(r1, &(0x7f0000000180)=[{0x0, 0x0, 0x0, 0x0, &(0x7f0000000700)=ANY=[@ANYBLOB="30000000000000008400000001000000000000017c"], 0x30}], 0x492492492492775, 0x0) getsockopt$inet_sctp_SCTP_ENABLE_STREAM_RESET(r1, 0x84, 0x76, &(0x7f0000000000)={r4, 0x1c0}, &(0x7f0000000080)=0x8) socket$inet_sctp(0x2, 0x5, 0x84) sendmsg$IPVS_CMD_SET_INFO(r1, &(0x7f0000000240)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x400}, 0xc, &(0x7f0000000140)={&(0x7f0000000100)={0x14, 0x0, 0x200, 0x70bd2b, 0x25dfdbfc}, 0x14}, 0x1, 0x0, 0x0, 0x60008010}, 0x800) setsockopt$inet_sctp6_SCTP_AUTH_ACTIVE_KEY(r0, 0x84, 0x83, &(0x7f0000000480)={r5, 0x2}, 0x8) 7.614473762s ago: executing program 4 (id=5729): ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000500)={'syz_tun\x00', 0x0}) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000140), 0x48241, 0x0) r1 = syz_init_net_socket$bt_l2cap(0x1f, 0x5, 0x0) close(r1) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x6bf1c2d5adba8c32}) r2 = socket$kcm(0x2, 0xa, 0x2) ioctl$SIOCSIFHWADDR(r2, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local}) r3 = socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r3, 0x8933, &(0x7f00000000c0)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_SET_INTERFACE(r3, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000003c0)={0x30, r4, 0x205, 0xffffffff, 0x0, {{}, {@val={0x8, 0x3, r5}, @val={0xc, 0x99, {0x0, 0x17}}}}, [@NL80211_ATTR_IFTYPE={0x8, 0x5, 0x9}]}, 0x30}, 0x1, 0x0, 0x0, 0x4000}, 0x0) r6 = openat$cgroup(0xffffffffffffffff, &(0x7f0000000340)='syz0\x00', 0x200002, 0x0) openat$cgroup_ro(r6, &(0x7f0000000380)='freezer.state\x00', 0x0, 0x0) r7 = socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt$inet_sctp6_SCTP_INITMSG(r7, 0x84, 0x2, &(0x7f00000000c0)={0xfffc, 0xc}, 0x8) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r7, 0x84, 0x6f, &(0x7f0000000200)={0x0, 0x1e, &(0x7f00000001c0)=[@in6={0xa, 0x0, 0x0, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02', 0x8}]}, &(0x7f0000000640)=0x10) getsockopt$bt_hci(r7, 0x84, 0x1, &(0x7f0000000680)=""/4145, &(0x7f0000000040)=0x1031) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x2, 0x1032, 0xffffffffffffffff, 0x21d67000) sendmsg$NL80211_CMD_START_AP(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000840)={0x310, r4, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r5}, @void}}, [@beacon=[@NL80211_ATTR_BEACON_HEAD={0x30, 0xe, {{{}, {0x6}, @broadcast, @device_a, @from_mac}, 0x0, @default, 0x1, @void, @void, @void, @void, @void, @void, @void, @void, @void, @void, @val={0x72, 0x6}, @void, @void}}, @NL80211_ATTR_PROBE_RESP={0x2aa, 0x91, "8b722244c46a07c0e897786a5c5fe7828a52c7de59c31bc4276691afc2e4ff2bc69377f680a1a62c1a07d068abb9851b75395f865c1a18387cb0dd3e103be60e0e90a6f31b37d2d23ee71ad11445b3f3e48444f43a72ce8020001482dd2858ce005c733b7281f28bceb34f637373647f561278d753084b3ea30990345eff372d097a974cf031c7e90ddedaaf510a05b472858947eb02737c3faa0ec1ebad7be3b0815d160ce8d9805d8ebfe7659d04ae4717971ca4ffce768ceb516f259edcb2103876ae6b9c1a6cb49a540ea76e9ca0e360941c6ad0cfd8a192c0c604d0f793933f0c938b93a977020788e5c2a50cdb9108fd1ff9df2c433fe8923ababf727df82d881c5d81d33422a04be9fd3fbe43eeb8354bccba35cb28deec19e8466f0feae3841345f9246a4c917093a8aea8d31fa63dc4fb50721b94845a4fcb2bdbae122236bef1a45c3f3b4aa0f505f8aa190e01b10189f3164611c06867be65d18de3cb047a97d016907507c8f4bafcc9f4f6c2ff027e2561c057d72b64b358d0c76505a25c8419aa5daebc350663a3fbe0620cd77d5d2bd2f04c73f552dbad599450a4d6df2156be2aa4314be995e7474f44279b93cbe302da688d7e47248b2caf67e183477cf27d84de1fd6a89af12e74bb9b089266c590805c8e3bf94c0ebc74385112295b3f80f802d72318b8e520fdf2b87717fd521868773f73a9e279988ab0abfb348aec7e282b6feaff5a5c32e8091029300ad7578b8637ef8a53bce1a1afd69073991e023c02eb068e6ef52d4319a50fb1d95c9a737b541e5b0b39ba25a1950c26f8c47207583ccc8947e8fb2a922dc2aa0f5d2881333471b5a4c635368c3046766b91b4ffde892bc4c6a5e75be0aba95e3eb3953df707b78bd8b92890876eb980a424527cc7283fd61e38744500c58bfe769d52260d8cfa45424ab10a7109fff2b430"}], @chandef_params=[@NL80211_ATTR_WIPHY_FREQ={0x8}], @NL80211_ATTR_BEACON_INTERVAL={0x8}, @NL80211_ATTR_DTIM_PERIOD={0x8, 0xd, 0x8}]}, 0x310}}, 0x0) setsockopt$sock_void(r2, 0x1, 0x0, 0x0, 0x0) r8 = socket(0x1d, 0x802, 0x6) ioctl$sock_SIOCETHTOOL(r8, 0x8946, &(0x7f0000000040)={'syz_tun\x00', &(0x7f0000000180)=@ethtool_drvinfo={0x3, "79cb0b4ec479809e8aa80f6d3f1f2a9d81d5d22b12631df6c299cae005e8c567", "b52a42865228635c000000004b4881a764cdd47b3f61523bd7c1783fba13b7b2", "4bf016890723eef280b200", "390f0c5b9a0f574c17523423e44629bf446e8351d045e53743f1bc3fcdc20ea3", "8f59e7a58ec69f93a93497b0c16f890ba23a4cf4f95dc6d511751296a545c210", '\x00', 0x15b3, 0x2000002, 0x8, 0x3, 0x401}}) write$tun(r0, &(0x7f0000000280)={@val={0x70}, @void, @eth={@local, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x1a}, @void, {@ipv4={0x800, @tipc={{0x1b, 0x4, 0x3, 0x4, 0x9c, 0x65, 0x0, 0x4, 0x6, 0x0, @multicast1, @broadcast, {[@end, @lsrr={0x83, 0xf, 0x1b, [@private=0xa010102, @empty, @remote]}, @lsrr={0x83, 0x7, 0x2e, [@empty]}, @cipso={0x86, 0x32, 0x1, [{0x6, 0xa, "7c08fe985b0f9f87"}, {0x6, 0xb, "028edccd0d831e09ff"}, {0x2, 0xf, "1d765d7da9847cab88256350e1"}, {0x6, 0x8, "ff9ca7983a38"}]}, @ssrr={0x89, 0xf, 0x2d, [@remote, @initdev={0xac, 0x1e, 0x0, 0x0}, @dev={0xac, 0x14, 0x14, 0x13}]}]}}, @payload_named={{{{{0x30, 0x0, 0x1, 0x0, 0x1, 0xa, 0x1, 0x2, 0x6, 0x0, 0x3, 0x8, 0x2, 0x2, 0xfffa, 0x74, 0x2, 0x4e21, 0x4e23}, 0x2, 0x2}}}, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}}}}}}, 0xae) 6.606155702s ago: executing program 0 (id=5734): r0 = bpf$MAP_CREATE(0x0, &(0x7f00000005c0)=@base={0xb, 0x7, 0x10001, 0x9, 0x1, 0xffffffffffffffff, 0xfffffff8}, 0x50) bpf$MAP_GET_NEXT_KEY(0x2, &(0x7f0000000740)={r0, &(0x7f0000000000), &(0x7f00000000c0)=""/109}, 0x20) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0x3, &(0x7f0000000440)=@framed={{0x18, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0xfffffff7}}, &(0x7f0000000400)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x11, '\x00', 0x0, @fallback=0xd, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$PROG_BIND_MAP(0xa, &(0x7f00000003c0)={r1}, 0xc) 6.603672681s ago: executing program 3 (id=5735): bpf$BPF_GET_PROG_INFO(0xf, &(0x7f0000000140)={0xffffffffffffffff, 0xfffffffffffffdbc, &(0x7f0000000500)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, ""/16, 0x0, 0x0, 0x0, 0x0, 0x0, 0x46, 0x0, &(0x7f0000000000)=[0x0, 0x0, 0x0, 0x0], 0x0, 0x40, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50, 0x8, 0x0, 0x0}}, 0x10) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r2 = socket$l2tp(0x2, 0x2, 0x73) bind$inet(r2, &(0x7f00000002c0)={0x2, 0x4e20, @empty}, 0x10) connect$inet(r2, &(0x7f0000000000)={0x2, 0x0, @loopback}, 0x10) sendmmsg$inet(r2, &(0x7f0000000900)=[{{0x0, 0x0, 0x0}}], 0x40000cf, 0x0) setsockopt$SO_TIMESTAMP(r2, 0x1, 0x40, &(0x7f0000000040)=0x1ff, 0x4) write(r1, &(0x7f0000000000)="0a000000010001", 0x7) r3 = socket$nl_xfrm(0x10, 0x3, 0x6) r4 = socket$tipc(0x1e, 0x5, 0x0) listen(r4, 0x0) r5 = accept(r4, 0x0, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32, @ANYBLOB="0000000000000000b70800000d0000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) r6 = socket$nl_generic(0x10, 0x3, 0x10) r7 = syz_genetlink_get_family_id$l2tp(&(0x7f00000000c0), r6) sendmsg$L2TP_CMD_TUNNEL_MODIFY(r6, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000640)=ANY=[@ANYBLOB="140000002b15c0a149ab85627fa019cc520ed5a7553e464088475bd47580e0bc4f457d7e22ce1f702815fb4aaef9337186aa67d98f9d0594e6b6f0651b809e5a0921c613d093b0aaff271d8f1efdba052625272130245a11c67c707316637ca7c8f044cfca64ba04cd0453af2868d4ade94e1342ae1ccafdbd3e44ad462e82acfcc501012df5550b37384bd95ddbd71d82e4000000000000c63aaba29c005ed37f3422a6f6a179c2873f2d04a105ec97bd68171e1204e7d03fd036cdbf642b695beee936d587959560fa2debe9cc342f69cb4270", @ANYRES16=r7, @ANYBLOB="0100000000000000000003000000"], 0x14}}, 0x0) r8 = bpf$MAP_CREATE(0x0, &(0x7f0000000280)=ANY=[@ANYRESOCT=r0, @ANYRESDEC, @ANYRES64=r5], 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0xa, 0x4, &(0x7f0000000480)=ANY=[@ANYBLOB="18000000000000000000000000000000850000006d"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r9 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000d80)={0x18, 0x5, &(0x7f0000000480)=ANY=[@ANYBLOB="1801000021"], 0x0, 0x40, 0x0, 0x0, 0x0, 0xb4a02fe0ce239f93, '\x00', 0x0, 0x2}, 0x94) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0xe, 0x0, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000800000000000000000000018110000", @ANYRES32=r8], 0x0, 0x0, 0x0, 0x0, 0x41100, 0x59, '\x00', 0x0, @fallback=0x2a, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, r9, 0x0, 0x0, 0x0, 0x0}, 0x94) r10 = bpf$PROG_LOAD(0x5, &(0x7f0000000300)={0x6, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback=0x4, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000180)={r10, 0x2000000, 0xe, 0x0, &(0x7f0000000040)="630b008646dc3f0adf33c9f7b986", 0x0, 0xcf25, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x80}, 0x50) sendmsg$nl_xfrm(r3, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000480)=ANY=[@ANYBLOB="fc0000001900674c0000000000000000e0000001000000000000000000000000e000000200000000000000000000000000000000000000000a00000000000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="00000000000000000000000000004000000000000000000000000000000000000000000000000000010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000100000000000000440005"], 0xfc}}, 0x0) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f00000000c0)='./cgroup.net/syz0\x00', 0x1ff) r11 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r12 = openat$cgroup_int(r11, &(0x7f00000002c0)='blkio.throttle.write_iops_device\x00', 0x2, 0x0) write$cgroup_int(r12, &(0x7f0000000600)=0xfffffffffffffffa, 0x12) r13 = socket$tipc(0x1e, 0x5, 0x0) ioctl$sock_SIOCETHTOOL(r13, 0x8946, &(0x7f0000000d00)={'macvtap0\x00', &(0x7f0000000c80)=@ethtool_coalesce={0x1, 0x2, 0x115b, 0x2, 0x5, 0x2, 0x5, 0xb5, 0x7, 0x7, 0x2, 0xe464, 0x9, 0x9, 0xfffffff5, 0x6, 0x5, 0x400, 0x101, 0xa2, 0x8, 0x10000, 0xaa0}}) 6.252723313s ago: executing program 0 (id=5737): bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000500)={0x1f, 0xc, &(0x7f0000000440)=ANY=[], 0x0, 0x2, 0x0, 0x0, 0x0, 0x34}, 0x94) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x3, 0xc, &(0x7f0000000440)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sched_cls, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r0 = socket$packet(0x11, 0x2, 0x300) r1 = bpf$MAP_CREATE(0x0, &(0x7f00000007c0)=ANY=[@ANYBLOB="0a00ede9a8b28dd410ce00003e00000042000000", @ANYRES32, @ANYBLOB='\x00'/20, @ANYRES32=0x0, @ANYRES32, @ANYBLOB='\x00'/28], 0x50) r2 = socket(0xa, 0x3, 0x3a) setsockopt$MRT6_TABLE(r2, 0x29, 0x24, &(0x7f0000000040), 0x4) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f00000000c0)={{r1, 0xffffffffffffffff}, &(0x7f0000000100), &(0x7f0000000180)}, 0x20) mmap(&(0x7f0000001000/0xc00000)=nil, 0xc00000, 0x2000004, 0x3b071, 0xffffffffffffffff, 0x0) sendmsg$nl_generic(0xffffffffffffffff, 0x0, 0x4040004) r4 = syz_init_net_socket$bt_l2cap(0x1f, 0x3, 0x3) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000200)=ANY=[], 0xf8}, 0x1, 0x0, 0x0, 0x20000004}, 0x4) ioctl$FS_IOC_GETFSLABEL(r4, 0x800452d2, &(0x7f0000000100)) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, 0x0) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f00000002c0)={{r3, 0xffffffffffffffff}, &(0x7f0000000140), &(0x7f0000000280)}, 0x20) r6 = bpf$MAP_CREATE(0x0, &(0x7f0000000100)=ANY=[@ANYBLOB="010000000400100004112200a4e2000001"], 0x48) bpf$MAP_UPDATE_BATCH(0x1a, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000240), &(0x7f0000000580), 0x2000cc0, r6}, 0x38) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000300)={'bond_slave_1\x00'}) bpf$BPF_MAP_LOOKUP_AND_DELETE_BATCH(0x18, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000280), 0x0, 0x1, r6}, 0x38) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x2, 0x31, 0xffffffffffffffff, 0x0) close(0x3) bpf$MAP_CREATE(0x0, &(0x7f00000006c0)=ANY=[@ANYBLOB="170000000000000004000000ff"], 0x50) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000000)={0x11, 0xc, &(0x7f00000001c0)=ANY=[@ANYBLOB="184cc30200000000000000000000000018110000", @ANYRES32=r5, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b70400000000000085000000030000009500000000000000"], &(0x7f0000000240)='GPL\x00', 0x4, 0x7, &(0x7f00000014c0)=""/4101, 0x0, 0xc, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x35}, 0x94) r7 = bpf$PROG_LOAD(0x5, &(0x7f0000000880)={0x1, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x10, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) recvmsg(r0, &(0x7f0000000700)={0x0, 0x0, 0x0}, 0x20) setsockopt$sock_attach_bpf(r0, 0x1, 0x32, &(0x7f0000000180)=r7, 0x4) r8 = bpf$PROG_LOAD(0x5, 0x0, 0x0) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000002300)={r8, 0x18000000000002a0, 0x0, 0x0, &(0x7f0000000100), 0x0, 0x20, 0x60000000, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x50) r9 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r9, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000080)=[{&(0x7f0000000040)="2e00000011008188040f46ecdb4cb9cca7480ef410000000e3bd6efb440009000e000a000d000000ba8000001201", 0x2e}], 0x1}, 0x24000040) socketpair(0xf, 0x6, 0x4, &(0x7f0000000340)) 6.195150339s ago: executing program 5 (id=5738): r0 = socket$inet6_sctp(0xa, 0x1, 0x84) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_NEW(r1, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000100)=ANY=[@ANYBLOB="640000000001010400000000141a000002000000240001801400018008000100e000000108000200e00000010c00028005000100000000002400028014000180080001000000000008000200ac1e00010c00028005000100000000000800074000000001"], 0x64}}, 0x0) (async) sendmsg$IPCTNL_MSG_CT_NEW(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000840)={0x44, 0x0, 0x1, 0x401, 0x0, 0x0, {0x2}, [@CTA_TUPLE_ORIG={0x24, 0x1, 0x0, 0x1, [@CTA_TUPLE_IP={0x14, 0x1, 0x0, 0x1, @ipv4={{0x8, 0x1, @multicast1}, {0x8, 0x2, @multicast1}}}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5}}]}, @CTA_MARK={0x8, 0x8, 0x1, 0x0, 0xff16}, @CTA_SEQ_ADJ_ORIG={0x4}]}, 0x44}, 0x1, 0x0, 0x0, 0x8014}, 0x40c0) (async) setsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX_OLD(r0, 0x84, 0x6b, &(0x7f0000000340)=[@in6={0xa, 0x4e23, 0x8000, @ipv4={'\x00', '\xff\xff', @initdev={0xac, 0x1e, 0x0, 0x0}}, 0xfff7fff7}], 0x1c) listen(r0, 0xfffff789) (async) r2 = accept(r0, 0x0, 0x0) setsockopt$inet_sctp6_SCTP_PEER_ADDR_THLDS(r2, 0x84, 0x85, &(0x7f0000000140)={0x0, @in={{0x2, 0x4e23, @initdev={0xac, 0x1e, 0x0, 0x0}}}, 0xffff, 0x992f}, 0x90) (async) setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(r2, 0x84, 0x9, &(0x7f0000000180)={0x0, @in={{0x2, 0x4e22, @empty}}, 0x9, 0x8, 0x0, 0x0, 0xd0, 0x6, 0x2}, 0x9c) (async) setsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(r2, 0x84, 0x9, &(0x7f0000000240)={0x0, @in={{0x2, 0x4e20, @empty}}, 0x1000, 0x1000, 0x7ffe, 0xa, 0x2a, 0x4, 0xe0}, 0x9c) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0xe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41100, 0x59, '\x00', 0x0, @fallback=0x2a, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0}, 0x94) (async) writev(r0, &(0x7f0000000900)=[{&(0x7f0000000380)="0e359054a9b6ed5b47683a88b4262b619ef3aa0bf9857f1d86308cd5942206ab0877d89218a32ff7bf0a448f4a91d439c522c4b181f92c04ed8e74544b1dfdd18f2867fadcb554b6efa6abfae7e35037d96fb58149dd2ffaef82a8fcca3ceeb24ebf228667d4d5de911f08", 0x6b}, {&(0x7f0000000440)="7f960d39d3e2ece5b5d4435bd62968d5be3f994c326b713b7fcfc1877f773f85edd1301d6adf25257ddf38249f0bd6e45270b59c525c542021ae77d3a1c58f551dcf8fea483953dc4bd4a2b511c472e001f56a5cbaf2f4b2fe5c800ad4a9ad4a5ee030a80c96358ae87f1571ae17ec7429ef49b2a259ec5637259f98de70d2ec5ec12ccc2e53d702860ac23e50c2fe0726900ae895a0d044828d670013421a241da89637d8442489f9bcf7016ad0caf0db2149a44fec9afda63f805509d571eae5941324474beef6b1a9d2f018d4b79460d7657f87d8bdcb19c3bb42e06c757dfb01", 0xe2}, {&(0x7f0000000540)="646d3edf8311d058cc46815ac4648e41614dc34e59f4d069015786262284b763046858f6e55f935c4440aee59c4bdeb415dc97a38f2b61e2aac235e2820c6475af2ddfa537761cc5fc6c068664f0ddf8daa4c1a0ca811eb007da74e3e80fd9aa9be7f43e76150310bcd9eef56d5ab571b0a3a4f3a5f4f3eba912", 0xffffffffffffff2f}, {&(0x7f00000005c0)='T', 0x1}, {&(0x7f0000000600)="cfab830c99f6e6a518cc78214106f73461d31048584571e4f4170c76f432b4b97066bde2a24ca0df70264185b37a713476e6bd944b3fb503965cf06ac2d18e54bff36e674f7289f3e3d54c8670a9fd9e659ca421090c893441f195df7a18af27f0a9c67cba03620cdf2044a5b5c0231904c131a3b4f56df16810327e861e1d2f61815af62487b989fc64e80a36858d241b5a9927eb4c590df272e2f9b80e993be7cde0d48981a5fd245e312e9a5c497ba8974fb6efa422a7d515e7abbe108f350e089c901ea0b62dc7c006", 0xcb}, {&(0x7f0000000700)="5e5165829695dd2216addfbc3d5fd4a65e42b8d4bb904c2a1b7a43c92732a73160126fbcd2cf951db9f99f588402a72d975e9658793700cb1c547ed0e3e34e86bb5f064f7b4594186e252a059ea83fabe61d59dfb3486cf75048c84688c213468f09d9911435b644112f348ef5d16ffcb3c410c1", 0x74}, {&(0x7f0000000780)="5d0327e497515bc77cc48207bd50ee71241c373e41b67d2f7c4033294d1cba93b72375a86ae1de911d719b7d27cf6514997434f93de27171e314fb1c8acbf4e204b76bf88fa03d661b", 0x49}, {&(0x7f0000000800)="e40fc2f637c9d3ae190d7e420fc9b1ad15169129561c23fdce932c9e07fb33388e0d602a935617e809f24553e1a738715a4022a70878d93b36ec4d2a46e94c0128cb58d3fe0c2baac3c2fbaa25d9cb8f4506a76536ef5c2e3a80a2ee1608ab05062eaf60b52c720169ebabe90a36c86b66a132", 0x73}, {&(0x7f0000000880)="f9a784f5d0e05b4374f539e8a498e275df8a6153f047c336e93fac86f2615915da2cb16a8f8538868adefaa935671cff2abcac2e989bbde176fd17082938c701ea1e29fc4f86e0ac57680467b052350615cc2d99a5abb548942e8acaeae558c93403", 0x62}], 0x9) r3 = socket$inet(0x2, 0x2, 0x1) setsockopt$sock_int(r3, 0x1, 0x5, &(0x7f0000000340)=0x6, 0x4) (async) sendmsg$inet(r3, &(0x7f0000001040)={&(0x7f0000000040)={0x2, 0xffff, @multicast2}, 0x10, &(0x7f00000000c0)=[{&(0x7f0000000400)='\b\x00', 0x2}, {&(0x7f00000001c0)="2d0000008058", 0x6}], 0x2, &(0x7f0000000100)=ANY=[@ANYBLOB="1c000000000000000000000007000000830b040a0101027f00000100000000001c000000000000000000000008"], 0x40}, 0x20008024) 6.022566855s ago: executing program 1 (id=5739): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = socket$inet6_sctp(0xa, 0x5, 0x84) shutdown(r1, 0x0) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r1, 0x84, 0x6f, &(0x7f00000001c0)={0x0, 0x1c, &(0x7f0000000040)=[@in6={0xa, 0x4e22, 0x5, @dev={0xfe, 0x80, '\x00', 0x1c}, 0x8}]}, &(0x7f0000000180)=0x10) setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(r1, 0x84, 0x9, &(0x7f00000000c0)={r2, @in={{0x2, 0x4e23, @empty}}, 0x0, 0x2, 0x40000002, 0x7, 0xa17433da3c5d69a5, 0x2, 0x81}, 0x9c) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000003c0)={'netdevsim0\x00', 0x0}) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000400)={0x6, 0x5, &(0x7f0000000a00)=ANY=[@ANYBLOB="180000000700001300000000ff0000002600010008000000950000000000000095"], &(0x7f0000000100)='GPL\x00', 0x9, 0x0, 0x0, 0x0, 0x0, '\x00', r3, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x2}, 0x94) 5.764601405s ago: executing program 4 (id=5740): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f00000003c0), r0) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000400)={'wlan0\x00', 0x0}) r3 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL80211_CMD_SET_QOS_MAP(r3, &(0x7f0000000680)={0x0, 0x0, &(0x7f0000000640)={&(0x7f00000005c0)=ANY=[@ANYBLOB='4\x00\x00\x00', @ANYRES16=r1, @ANYBLOB="010028bd7000fcdbdf256800000008000300", @ANYRES32=r2], 0x34}, 0x1, 0x0, 0x0, 0x4000}, 0x24008800) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000640)={0x1f, 0x13, &(0x7f0000000000)=ANY=[], &(0x7f0000000140)='syzkaller\x00', 0x2, 0x0, 0x0, 0xc1100, 0x10}, 0x94) 5.49778416s ago: executing program 1 (id=5741): socket$nl_route(0x10, 0x3, 0x0) (async) socket$packet(0x11, 0x3, 0x300) (async) socket$kcm(0x29, 0x2, 0x0) (async) socket$inet6_icmp(0xa, 0x2, 0x3a) (async) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000580), 0x62a01, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000280), 0x1, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x2}) r2 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000580)={&(0x7f00000004c0)=@newqdisc={0x78, 0x24, 0x4ee4e6a52ff56541, 0x1, 0x25dfdbfd, {0x0, 0x0, 0x0, r3, {0x0, 0xb}, {0xffff, 0xffff}, {0xfff2}}, [@qdisc_kind_options=@q_netem={{0xa}, {0x48, 0x2, {{0x3, 0xae0, 0x6361, 0x5, 0xffffffff, 0x7}, [@TCA_NETEM_SLOT={0x2c, 0xc, {0x4, 0x7fffffffffffffff, 0x0, 0x1000, 0xc, 0x215}}]}}}]}, 0x78}, 0x1, 0x0, 0x0, 0x40088c1}, 0x0) (async) r4 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) close(r4) (async) r5 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r5, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000240)=@newqdisc={0x4c, 0x24, 0x4ee4e6a52ff56541, 0x70b926, 0x25dfdbff, {0x0, 0x0, 0x0, r6, {0x0, 0x8}, {0xc, 0xb}, {0x7, 0xffe0}}, [@qdisc_kind_options=@q_netem={{0xa}, {0x1c, 0x2, {{0x3ae, 0x4, 0x69b0, 0x9, 0xffffffff, 0xbb31}}}}]}, 0x4c}, 0x1, 0x0, 0x0, 0x8000}, 0x2000c080) ioctl$SIOCSIFHWADDR(r4, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) (async) r7 = socket$nl_generic(0x10, 0x3, 0x10) r8 = syz_genetlink_get_family_id$tipc(&(0x7f0000000380), r7) sendmsg$TIPC_CMD_ENABLE_BEARER(r7, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000680)=ANY=[@ANYBLOB='8\x00\x00\x00', @ANYRES16=r8, @ANYBLOB="010000000d0000000000010000000000000001410000001c001700000000000000006574683a73797a6b616c6c657230"], 0x38}, 0x1, 0x0, 0x0, 0x44081}, 0x0) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x5) close(0x4) (async) syz_open_procfs$namespace(0x0, &(0x7f0000000400)='ns/pid_for_children\x00') (async) r9 = socket$inet6(0xa, 0x2, 0x0) setsockopt$inet6_IPV6_DSTOPTS(r9, 0x29, 0x3b, &(0x7f00000002c0)=ANY=[], 0x8) bind$inet6(r9, &(0x7f0000f5dfe4)={0xa, 0x4e20, 0x0, @empty}, 0x1c) (async) recvmmsg(r9, &(0x7f0000000e80)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f0000000c40)=""/109, 0x6d}, 0x1004}], 0x1, 0x40001102, 0x0) setsockopt$inet6_int(r9, 0x29, 0x4, &(0x7f0000000000)=0x1, 0x4) sendto$inet6(r9, 0x0, 0x0, 0x0, &(0x7f0000000300)={0xa, 0x4e20, 0x0, @mcast1}, 0x1c) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f07ebbeef, 0x8031, 0xffffffffffffffff, 0x215eb000) 5.48435389s ago: executing program 3 (id=5742): r0 = socket$inet6_sctp(0xa, 0x5, 0x84) setsockopt(r0, 0x84, 0x81, &(0x7f0000000000)='\x00\x00\x00\x00', 0x4) sendmmsg$inet_sctp(0xffffffffffffffff, &(0x7f0000001f00)=[{&(0x7f0000000000)=@in={0x2, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}}, 0x10, 0x0}], 0x1, 0x0) r1 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$inet_MCAST_JOIN_GROUP(r1, 0x0, 0x2a, &(0x7f0000000b00)={0x2, {{0x2, 0x0, @multicast1}}}, 0x88) setsockopt$inet_group_source_req(r1, 0x0, 0x2e, &(0x7f00000006c0)={0x7, {{0x2, 0x4e21, @multicast1}}, {{0x2, 0x4e24, @private=0xa010101}}}, 0x108) setsockopt$inet_mreqn(0xffffffffffffffff, 0x0, 0x27, &(0x7f0000000000)={@multicast2, @local}, 0x1) getsockopt$inet_buf(r1, 0x0, 0x29, &(0x7f0000000000)=""/145, 0x0) r2 = socket$inet_sctp(0x2, 0x1, 0x84) getsockopt$inet_sctp_SCTP_MAX_BURST(r2, 0x84, 0xd, &(0x7f0000000000)=@assoc_value={0x0}, &(0x7f0000000280)=0x8) setsockopt$inet_sctp6_SCTP_AUTH_ACTIVE_KEY(r0, 0x84, 0x18, &(0x7f0000000400)={r3}, 0x8) r4 = socket$inet_icmp(0x2, 0x2, 0x1) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(r2, 0x81f8943c, &(0x7f00000004c0)) sendmmsg$inet(r4, &(0x7f0000000340)=[{{0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000400)='\b\x00\x00\x00(\x00\x00\x00', 0x8}], 0x1}}], 0x1, 0x40444c4) syz_emit_ethernet(0x36, &(0x7f0000000440)={@local, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x29}, @void, {@ipv4={0x800, @tcp={{0x5, 0x4, 0x0, 0x0, 0x28, 0x0, 0x0, 0x0, 0x2c, 0x0, @remote, @local}, {{0x0, 0x0, 0x41424344, 0x41424344, 0x0, 0x6, 0x5, 0x2}}}}}}, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000400)={0x3, 0x0, 0x0, &(0x7f0000000000)='syzkaller\x00', 0x5, 0x0, 0x0, 0x40f00}, 0x94) 5.250597705s ago: executing program 4 (id=5743): getsockopt$inet_int(0xffffffffffffffff, 0x0, 0x12, 0x0, &(0x7f0000000100)) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$sock_int(r0, 0x1, 0xf, &(0x7f0000000180)=0x800001, 0x4) bind$inet6(r0, &(0x7f0000000200)={0xa, 0x4e22, 0x2, @empty, 0x8}, 0x1c) bpf$BPF_PROG_ATTACH(0x8, &(0x7f0000000300)=ANY=[@ANYRES32, @ANYRES32, @ANYBLOB="1800000000000000", @ANYRES32, @ANYRES32=0x0, @ANYBLOB="8c"], 0x20) r1 = socket$inet6(0xa, 0x1, 0x0) setsockopt$sock_int(r1, 0x1, 0xf, &(0x7f0000000180)=0x20800001, 0x4) setsockopt$inet6_int(r1, 0x29, 0x4e, &(0x7f0000000000)=0x1, 0x4) bind$inet6(r1, &(0x7f0000000040)={0xa, 0x4e22, 0x87, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01', 0x4}, 0x1c) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000003c0)={0x11, 0xd, &(0x7f00000000c0)=@framed={{0x18, 0x0, 0x0, 0x0, 0x8000000}, [@func={0x85, 0x0, 0x1, 0x0, 0x1}, @exit, @printk={@ld={0x18, 0x0}, {0x3, 0x3, 0x3, 0xa, 0x1, 0xfe00}, {0x5}, {}, {}, {}, {0x85, 0x0, 0x0, 0x76}}]}, &(0x7f0000000180)='GPL\x00', 0x9, 0x0, 0x0, 0x40f00}, 0x94) 5.009749368s ago: executing program 3 (id=5744): r0 = socket$inet_sctp(0x2, 0x1, 0x84) setsockopt$IPT_SO_SET_REPLACE(r0, 0x0, 0x40, &(0x7f0000000480)=@raw={'raw\x00', 0x8, 0x3, 0x418, 0x288, 0xa, 0x148, 0x288, 0x10, 0x380, 0x2a8, 0x2a8, 0x380, 0x2a8, 0x3, 0x0, {[{{@uncond, 0x0, 0x220, 0x288, 0x0, {0x200003ae, 0x7f00}, [@common=@inet=@hashlimit1={{0x58}, {'geneve0\x00', {0x0, 0xe2, 0x9, 0x0, 0x0, 0xfffffffb, 0x7}, {0x4}}}, @common=@inet=@hashlimit3={{0x158}, {'veth0_virt_wifi\x00', {0x400, 0x0, 0x44, 0x7, 0xff, 0xff, 0xfffffaf9, 0xe, 0x20}, {0x9}}}]}, @unspec=@CT2={0x68, 'CT\x00', 0x2, {0x8, 0xafc, 0xf8, 0x10001, '\x00', 'syz0\x00', {0x4}}}}, {{@ip={@broadcast, @remote, 0x0, 0x0, 'bond_slave_1\x00', 'vcan0\x00', {0xff}, {}, 0x33, 0x3}, 0x0, 0xd0, 0xf8, 0x0, {}, [@inet=@rpfilter={{0x28}}, @common=@unspec=@time={{0x38}, {0x4, 0xdf, 0x7b72, 0x30e7, 0x393, 0x4, 0x2}}]}, @common=@unspec=@MARK={0x28, 'MARK\x00', 0x2, {0x3, 0x2}}}], {{'\x00', 0xc8, 0x70, 0x98}, {0x28}}}}, 0x478) r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="22000000040000001000"], 0x48) bpf$BPF_MAP_CONST_STR_FREEZE(0x16, &(0x7f00000000c0)={r1}, 0x4) r2 = socket(0x1, 0x803, 0x0) r3 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r3, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000001c0)=ANY=[@ANYRESOCT=r2], 0x18}, 0x1, 0x0, 0x0, 0x4000}, 0x0) recvmmsg(r3, &(0x7f0000002e80)=[{{0x0, 0x0, 0x0}, 0x3fffff}, {{0x0, 0x0, 0x0}, 0x6}, {{0x0, 0x0, &(0x7f0000003a40)=[{&(0x7f0000000ac0)=""/4096, 0x1000}, {&(0x7f0000000180)=""/33, 0x21}, {&(0x7f0000003740)=""/195, 0xc3}, {&(0x7f0000003840)=""/172, 0xac}, {&(0x7f0000003900)=""/151, 0x97}, {&(0x7f0000000280)=""/101, 0x65}], 0x6}, 0x9}, {{0x0, 0x0, 0x0}, 0xb91b}, {{0x0, 0x0, 0x0}, 0x8}], 0x5, 0x0, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000002c0)=0x14) r4 = socket$inet6(0xa, 0x1, 0x0) r5 = socket(0x400000000010, 0x3, 0x0) r6 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r6, &(0x7f0000000040)={0x1f, 0xffffffffffffffff, 0x3}, 0x6) ioctl$SIOCX25SFACILITIES(0xffffffffffffffff, 0x89e3, &(0x7f0000000080)={0x15, 0x0, 0x2000a, 0x9}) write$bt_hci(r6, &(0x7f0000000080)=ANY=[], 0x6) r7 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r7, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r8 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r8, 0x29, 0x40, &(0x7f0000000380)=@mangle={'mangle\x00', 0x2, 0x6, 0x640, 0x4a0, 0x4a0, 0x3b0, 0x3b0, 0x2e0, 0x570, 0x570, 0x570, 0x570, 0x570, 0x6, 0x0, {[{{@ipv6={@private2={0xfc, 0x2, '\x00', 0x1}, @mcast1, [0xff, 0xffffffff, 0x0, 0x1fe000000], [0xffffff00, 0xff000000, 0xffffffff, 0xffffff00], 'ip6erspan0\x00', 'veth0_to_team\x00', {0xff}, {0xff}, 0x11, 0x2, 0x4}, 0x0, 0x188, 0x1b0, 0x0, {0x7a00000010000000}, [@common=@srh1={{0x90}, {0x2f, 0x4, 0x0, 0x0, 0x0, @empty, @mcast2, @private2, [], [0x0, 0xffffffff], [], 0x0, 0x10}}, @common=@inet=@multiport={{0x50}, {0x0, 0xc, [0x0, 0x0, 0x0, 0x4e21, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffc], [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4]}}]}, @HL={0x28}}, {{@ipv6={@mcast2, @dev={0xfe, 0x80, '\x00', 0x2}, [0x0, 0x0, 0x0, 0xff], [], 'bridge0\x00', 'veth1_vlan\x00'}, 0x0, 0xf8, 0x130, 0x0, {}, [@inet=@rpfilter={{0x28}, {0x2}}, @inet=@rpfilter={{0x28}, {0xc}}]}, @common=@inet=@SET3={0x38, 'SET\x00', 0x3, {{}, {0x0, 0x2}, {0x0, 0xfd}, 0x300, 0x4}}}, {{@ipv6={@ipv4, @dev={0xfe, 0x80, '\x00', 0x32}, [], [], 'nicvf0\x00', 'bond_slave_0\x00', {0xff}, {}, 0x0, 0x2}, 0x0, 0xa8, 0xd0, 0x48000000}, @common=@inet=@SYNPROXY={0x28, 'SYNPROXY\x00', 0x0, {0x0, 0x1, 0x7ff}}}, {{@ipv6={@loopback, @local, [0xffffff00, 0x0, 0xff, 0xff000000], [0xff000000, 0xff000000, 0xffffffff, 0xffffff00], 'macvlan0\x00', 'veth1_to_bridge\x00', {0xff}, {0xff}, 0x8, 0x81, 0x1, 0x36}, 0x0, 0xa8, 0xf0}, @SNPT={0x48, 'SNPT\x00', 0x0, {@ipv4=@rand_addr=0x8, @ipv6=@private1, 0x1d, 0x35}}}, {{@uncond, 0x0, 0xa8, 0xd0}, @HL={0x28}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x6a0) r9 = socket(0x400000000010, 0x3, 0x0) r10 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r10, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r9, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000280)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0xffffffdf, {0x0, 0x0, 0x0, r11, {0x0, 0x9}, {0xffff, 0xffff}, {0xc, 0xf}}, [@qdisc_kind_options=@q_fq_codel={{0xd}, {0x4}}]}, 0x38}, 0x1, 0x0, 0x0, 0x2813}, 0x20008850) sendmsg$nl_route_sched(r9, &(0x7f0000000900)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000940)=@newtfilter={0x34, 0x2c, 0xd27, 0x70bd28, 0xfffff000, {0x0, 0x0, 0x0, r11, {0xf000, 0xffff}, {}, {0x7, 0xa}}, [@filter_kind_options=@f_route={{0xa}, {0x4}}]}, 0x34}, 0x1, 0x0, 0x0, 0x80}, 0x20000800) r12 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r12, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r5, &(0x7f0000000900)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000002c0)=@newtfilter={0x44, 0x2c, 0xd27, 0x70bd28, 0xfffff000, {0x0, 0x0, 0x0, r13, {0xf000, 0xffff}, {}, {0x7, 0xa}}, [@filter_kind_options=@f_route={{0xa}, {0x14, 0x2, [@TCA_ROUTE4_FROM={0x8, 0x3, 0xa0}, @TCA_ROUTE4_CLASSID={0x2, 0x1, {0xfff3, 0xfff2}}]}}]}, 0x44}, 0x1, 0x0, 0x0, 0x80}, 0x20000800) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r4, 0x29, 0x20, &(0x7f0000000080)={@rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02', 0x9c940000, 0x0, 0x3, 0x1}, 0x20) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r4, 0x29, 0x20, &(0x7f00000000c0)={@local, 0x0, 0x0, 0x1, 0x1}, 0x20) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r4, 0x29, 0x20, &(0x7f0000000380)={@private1, 0x9c940000, 0x0, 0x3, 0x8, 0x1, 0xfffe}, 0x20) 5.009307211s ago: executing program 5 (id=5745): r0 = socket(0x10, 0x803, 0x0) sendmsg$NL80211_CMD_CRIT_PROTOCOL_START(r0, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000540)={0x0, 0x1c}}, 0x0) r1 = bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000780)={0x6, 0x4, &(0x7f0000000580)=ANY=[@ANYBLOB="18020000000000020000000000000000850000001700000095"], &(0x7f00000005c0)='GPL\x00'}, 0x94) r2 = socket(0x10, 0x803, 0x8) sendmsg$IPVS_CMD_SET_INFO(r2, &(0x7f0000000b00)={0x0, 0x0, &(0x7f0000000ac0)={0x0, 0x2d}, 0x1, 0x0, 0x0, 0x8801}, 0x8000) r3 = socket$netlink(0x10, 0x3, 0x0) getsockname$packet(r2, &(0x7f0000000600)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000180)=0x14) socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$nl_route(r3, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000640)=ANY=[@ANYBLOB="3c0000001000850600000000ff6122314a000800", @ANYRES32=r4, @ANYBLOB="00001000252155b21c0012000c000100626f6e64"], 0x3c}}, 0x40000) bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f00000001c0)={r1, r4, 0x25, 0x0, @val=@netkit={@void, @value=r1}}, 0x1c) getsockname$packet(r0, &(0x7f0000000600)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000080)=0x14) clock_gettime(0x8, &(0x7f0000000280)) sendmsg$nl_route(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000480)=ANY=[@ANYBLOB="44000000100003052bbd70000007000000000000", @ANYRES32=0x0, @ANYBLOB="00000000001000001c00128009000100626f6e64000000000c000280050001000500000008000a00", @ANYRES32=r5], 0x44}, 0x1, 0x0, 0x0, 0x800}, 0x4000000) 4.718625075s ago: executing program 4 (id=5746): r0 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCBRDELBR(r0, 0x89a1, &(0x7f0000000000)='pim6reg0\x00') sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000400)={&(0x7f0000000500)=ANY=[@ANYBLOB="140000001000010000000000000000000200000a20000000000a010400000000000000000200000a0900010073797a300000000040000000030a01040000000000000000020000000020010073797a30000000000900030073797a300100000014000480080001400000000308000240000000004000000006852c1809000000000000000200000a0900010073797a000900020073797a30000000001400048010cb4880080001006c6f6700040002801400000011"], 0xc8}}, 0x0) sendmsg$IPSET_CMD_CREATE(0xffffffffffffffff, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000044c0)={&(0x7f0000000580)=ANY=[@ANYBLOB="5c000000020605000000000000000000000000000c00078005001500267d00000500010007000000050005000a000000050004"], 0x5c}}, 0x0) r1 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$ethtool(&(0x7f0000000040), r1) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r2, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000880)=@deltaction={0x38, 0x18, 0x1, 0x70bd2c, 0x25dfdc00, {0xa}, [@TCA_ACT_TAB={0x24, 0x1, [{0x10, 0xe, 0x0, 0x0, @TCA_ACT_KIND={0x9, 0x1, 'vlan\x00'}}, {0x10, 0x15, 0x0, 0x0, @TCA_ACT_KIND={0x9, 0x1, 'csum\x00'}}]}]}, 0x38}, 0x1, 0x0, 0x0, 0x44000}, 0x20040844) sendmsg$ETHTOOL_MSG_DEBUG_SET(r1, &(0x7f0000001540)={0x0, 0x0, &(0x7f0000001500)={&(0x7f0000000580)=ANY=[@ANYBLOB='8\x00\x00\x00', @ANYRES8=r2, @ANYBLOB="01000000040200f2c8dc1b000000180001801400020073797a5f74756e0000000000000000000c000280"], 0x38}, 0x1, 0x0, 0x0, 0x20000844}, 0x0) 3.556788414s ago: executing program 4 (id=5747): r0 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="0e000000040000000800000005"], 0x48) close(0x3) bpf$MAP_CREATE(0x0, &(0x7f0000000440)=ANY=[@ANYBLOB="19000000040000000400000002000000000000", @ANYRES8, @ANYRES64=r0, @ANYRES32=0x0, @ANYBLOB="412f7f276e5d91042f27df1cbdf827d4c49c96deeb64357c537d494ba0887c6f0bbec1288a0f19f024a1d80838950883bbdb1b3cc0efe5aac86971b744edec88451e05cc9bb17d6831a49c3170354869b02c213d2e6c6477716b08fe7cbfef8a405370d6d9c9248dedbc586ebec151d8f5f82682d959c4ad7efd75e217", @ANYBLOB='\x00'/28, @ANYRES8=r0], 0x50) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x6, 0xc, &(0x7f00000001c0)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bc82000000000000a6020000f8ffffffb703000008000000cd03000000000000850000003300000095"], &(0x7f0000000180)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @xdp=0xedf0e51957efc755, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) openat$nci(0xffffffffffffff9c, &(0x7f0000001640), 0x2, 0x0) openat$nci(0xffffffffffffff9c, 0x0, 0x2, 0x0) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r3 = socket$inet6(0xa, 0x80000, 0x2) setsockopt$SO_TIMESTAMPING(r3, 0x1, 0x25, &(0x7f0000000340)=0x152, 0x4) setsockopt$inet6_int(r3, 0x29, 0x31, &(0x7f0000000000)=0xb2, 0x4) r4 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route(r4, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000006c0)=ANY=[@ANYBLOB="d0000000120067fb27bd7000ffdbdf2500000000", @ANYRES32, @ANYBLOB="820000007002080008000f00080000001800128008000100736974000c0002", @ANYBLOB="0400140008001d000200000008002e"], 0xd0}, 0x1, 0x0, 0x0, 0x4000800}, 0x4800) r5 = bpf$MAP_CREATE(0x0, &(0x7f0000000280)=ANY=[], 0x50) bpf$MAP_GET_NEXT_KEY(0x4, &(0x7f0000000140)={r5, 0x0, &(0x7f0000000100)=""/7}, 0x20) sendmmsg$inet6(r3, &(0x7f00000002c0), 0x0, 0x404c001) recvmmsg(r3, &(0x7f0000000300)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f0000000600)=""/153, 0x99}, 0xdb31}], 0x1, 0x40002102, 0x0) r6 = socket$kcm(0xa, 0x2, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, 0x0) r7 = socket(0x2, 0x80805, 0x0) r8 = socket$inet_sctp(0x2, 0x1, 0x84) setsockopt$IP_VS_SO_SET_ADD(r8, 0x0, 0x482, &(0x7f0000000280)={0x84, @loopback, 0x4e22, 0x3, 'rr\x00', 0x34, 0x80001, 0x70}, 0x2c) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000000c0)={0x11, 0x3, &(0x7f0000000800)=ANY=[@ANYBLOB="1800"/13], &(0x7f0000000080)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x2e}, 0x94) bpf$MAP_CREATE(0x0, &(0x7f0000000240)=ANY=[@ANYRES8=0x0, @ANYRES16=r2, @ANYBLOB="7d2a55dd73c1832200d9492ac06d91e713743b43e574024ff1a7a806e6cc09c13c8c649950d85bc4c26a58f131894245", @ANYRES32=r1, @ANYRES32, @ANYRES8=r7], 0x50) close(0x3) connect$inet6(r3, &(0x7f0000000200)={0xa, 0x4e21, 0x7, @private1={0xfc, 0x1, '\x00', 0x1}, 0x1ff}, 0x1c) socket$kcm(0x2d, 0x2, 0x0) setsockopt$IP_VS_SO_SET_ADDDEST(r7, 0x0, 0x487, &(0x7f0000000000)={{0x84, @private=0xa010102, 0x4e61, 0x3, 'lc\x00', 0x8, 0x20000, 0x77}, {@remote, 0x4e20, 0xac91d2bf000ec5eb, 0xcd}}, 0x44) sendmsg$sock(r6, &(0x7f00000000c0)={&(0x7f0000000580)=@in6={0x2, 0x4e21, 0x0, @dev}, 0x80, 0x0, 0x0, &(0x7f0000000000)=[@mark={{0x14, 0x1, 0x24, 0x3}}], 0x18}, 0x0) setsockopt$IP_VS_SO_SET_FLUSH(r8, 0x0, 0x485, 0x0, 0x0) 3.411170426s ago: executing program 3 (id=5748): r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000a00)=@base={0x14, 0x4, 0x4, 0x22}, 0x50) r1 = socket$inet(0x2, 0x2, 0x0) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000180)={r0, &(0x7f0000000280), &(0x7f0000000100)=@tcp=r1, 0x1}, 0x20) bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000540)={&(0x7f0000000080)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0x2c, 0x2c, 0x3, [@func_proto={0x0, 0x1, 0x0, 0xd, 0x0, [{}]}, @struct={0x0, 0x1, 0x0, 0x4, 0x0, 0x0, [{0xffffffff, 0x1}]}]}, {0x0, [0x30]}}, &(0x7f0000000500)=""/16, 0x47, 0x10, 0x1}, 0x28) 3.022285492s ago: executing program 5 (id=5749): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r0, &(0x7f0000000080)={0xa, 0x2, 0x200, @loopback, 0x7}, 0x1c) sendto$inet6(r0, 0x0, 0x0, 0x24040001, &(0x7f0000000140)={0xa, 0x2, 0xffff, @loopback, 0x400d}, 0x1c) setsockopt$inet6_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f0000000180)='veno', 0x4) shutdown(r0, 0x1) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000340)={{0x1, 0xffffffffffffffff}, &(0x7f0000000100), &(0x7f00000001c0)}, 0x20) r2 = bpf$BPF_BTF_GET_FD_BY_ID(0x13, &(0x7f0000000600), 0x4) mmap(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0xe, 0x104011, r1, 0xe094a000) bpf$BPF_MAP_CONST_STR_FREEZE(0x16, &(0x7f00000006c0)={0xffffffffffffffff, 0xffffffffffffffff}, 0x4) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000780)={{0x1, 0xffffffffffffffff}, &(0x7f0000000700), &(0x7f0000000740)}, 0x20) bpf$TOKEN_CREATE(0x24, &(0x7f0000000280)={0x0, r0}, 0x8) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000380)=@bpf_tracing={0x1a, 0x15, &(0x7f0000000500)=@ringbuf={{0x18, 0x0, 0x0, 0x0, 0x1ab, 0x0, 0x0, 0x0, 0x7f}, {}, {}, [@ringbuf_query={{0x18, 0x1, 0x1, 0x0, r1}}, @map_idx={0x18, 0x4, 0x5, 0x0, 0x2}], {{}, {0x7, 0x0, 0xb, 0x2, 0x0, 0x0, 0x2}, {0x85, 0x0, 0x0, 0x84}}}, &(0x7f00000005c0)='syzkaller\x00', 0x400, 0x0, 0x0, 0x41100, 0x44, '\x00', 0x0, 0x19, r2, 0x8, &(0x7f0000000640)={0x6, 0x5}, 0x8, 0x10, &(0x7f0000000680)={0x0, 0x1, 0xb37, 0x6}, 0x10, 0x10a1d, 0xffffffffffffffff, 0x0, &(0x7f00000007c0)=[r3, r4], 0x0, 0x10, 0x3}, 0x94) bind$bt_hci(0xffffffffffffffff, &(0x7f00000000c0)={0x1f, 0xffffffffffffffff, 0x3}, 0x6) bpf$PROG_LOAD(0x5, &(0x7f0000000a40)={0x11, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="180000000000000000000000000001b518110000", @ANYRES32, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], 0x0, 0x4, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, @fallback=0x4, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x40000}, 0x94) r5 = bpf$PROG_LOAD(0x5, &(0x7f0000000800)={0x6, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, @fallback=0x26, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000000)={r5, 0x2000000, 0xe, 0x0, &(0x7f00000004c0)="630b008646dc3f0adf33c9f7b986", 0x0, 0x81ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x2}, 0x38) 2.909084132s ago: executing program 3 (id=5750): socket$packet(0x11, 0x3, 0x300) (async) socket$packet(0x11, 0x3, 0x300) syz_emit_ethernet(0x66, &(0x7f0000001a40)=ANY=[], 0x0) (async) syz_emit_ethernet(0x66, &(0x7f0000001a40)=ANY=[], 0x0) socket$inet6(0xa, 0x800000000000002, 0x0) (async) r0 = socket$inet6(0xa, 0x800000000000002, 0x0) setsockopt$inet6_mtu(r0, 0x29, 0x17, &(0x7f00000001c0)=0x3, 0x4) connect$inet6(r0, &(0x7f0000000100)={0xa, 0x4f20, 0xde, @empty, 0x3}, 0x1c) r1 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x0) socket(0x10, 0x80002, 0x0) (async) r2 = socket(0x10, 0x80002, 0x0) sendmsg$nl_route(r2, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000000000)=ANY=[@ANYBLOB="4c0000004800010029bd7000ffdbdf250a", @ANYRES32], 0x4c}}, 0x0) sendmmsg$alg(r2, &(0x7f00000000c0), 0x492492492492627, 0x0) sendmsg$nl_xfrm(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000500)={&(0x7f0000002140)=ANY=[@ANYBLOB="3c0200001900010029bd7000fbdbdf25fe880000000000000000000000000001ff020000000000000000000000000001000000004e2100000200000000000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="000000000000000004000000000000000000000000000000000000000000000000000000000000000200000000000000fdffffffffffffff000000000000000000000000000000000500000000000000000000000020000004000000040000000000000000000000010002020000000084010500fe880000000000000000000000000101000004d23c00000000000000ac1414aa0000000000000000000000000000000000020100ff7f0000070000005395214300000000000000000000000000000000000004d533000000020000007f00000100000000000000000000000000000000000122000500000001040000020000007f000001000000000000000000000000000004d23200000002000000fe88000000000000000000000000000101350000020101000400000008000000ffffff7ffe8000000000000000000000000000bb000004d23200"], 0x23c}, 0x1, 0x0, 0x0, 0x20000004}, 0x0) write(r0, 0x0, 0x0) setsockopt$inet6_tcp_int(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000040)=0x7, 0x4) (async) setsockopt$inet6_tcp_int(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000040)=0x7, 0x4) connect$inet6(0xffffffffffffffff, &(0x7f0000000100)={0xa, 0x0, 0x7, @ipv4={'\x00', '\xff\xff', @local}, 0x1}, 0x1c) setsockopt$inet6_tcp_TCP_ULP(0xffffffffffffffff, 0x6, 0x1f, &(0x7f00000002c0), 0x4) (async) setsockopt$inet6_tcp_TCP_ULP(0xffffffffffffffff, 0x6, 0x1f, &(0x7f00000002c0), 0x4) setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(0xffffffffffffffff, 0x6, 0x14, &(0x7f0000000400)=0x1, 0x4) setsockopt$inet6_tcp_TLS_TX(0xffffffffffffffff, 0x11a, 0x2, &(0x7f00000003c0)=@gcm_128={{0x303}, "77b4040000000008", "bb67102a8b090c32fc222da7007b00", "8c76287d", "3d8efa05fdffffff"}, 0x28) (async) setsockopt$inet6_tcp_TLS_TX(0xffffffffffffffff, 0x11a, 0x2, &(0x7f00000003c0)=@gcm_128={{0x303}, "77b4040000000008", "bb67102a8b090c32fc222da7007b00", "8c76287d", "3d8efa05fdffffff"}, 0x28) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='memory.events\x00', 0x275a, 0x0) write$tun(r3, &(0x7f0000000340)=ANY=[], 0x141) mmap(&(0x7f0000000000/0x4000)=nil, 0x4000, 0x1, 0x10012, r3, 0x0) setsockopt$inet6_tcp_TLS_TX(0xffffffffffffffff, 0x11a, 0x1, &(0x7f0000000080)=@gcm_128={{0x303}, "b7a41f2300", "d21b0e8a0e000000000000000600", "1d1cbe23", "ecba06893bcdc493"}, 0x28) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x8031, 0xffffffffffffffff, 0x0) recvfrom(0xffffffffffffffff, &(0x7f0000002800)=""/4071, 0xfffffffffffffdab, 0x17, 0x0, 0x0) writev(0xffffffffffffffff, &(0x7f00000005c0)=[{&(0x7f0000000140)='X', 0xfe04}], 0x1) (async) writev(0xffffffffffffffff, &(0x7f00000005c0)=[{&(0x7f0000000140)='X', 0xfe04}], 0x1) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x7, &(0x7f00000000c0)=0xffff1884, 0x4) 2.806121211s ago: executing program 0 (id=5751): r0 = socket(0x10, 0x803, 0x0) r1 = socket$unix(0x1, 0x5, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000100)={'team_slave_1\x00', 0x0}) sendmsg$nl_route_sched(r0, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=@newqdisc={0x48, 0x24, 0x4ee4e6a52ff56541, 0x70bd25, 0x25dfdbfe, {0x0, 0x0, 0x0, r2, {0x0, 0xfff1}, {0xffff, 0xffff}, {0xffe0, 0xfff3}}, [@qdisc_kind_options=@q_htb={{0x8}, {0x1c, 0x2, [@TCA_HTB_INIT={0x18, 0x2, {0x3, 0x4, 0x3c}}]}}]}, 0x48}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f0000000700)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000500)=@newtfilter={0xb8, 0x2c, 0xd2b, 0x70bd2b, 0x25dfdbfb, {0x0, 0x0, 0x0, r2, {0x5}, {}, {0x7, 0xfff3}}, [@filter_kind_options=@f_u32={{0x8}, {0x84, 0x2, [@TCA_U32_SEL={0x24, 0x5, {0xd, 0x7, 0x1, 0x3d3f, 0x0, 0xfff, 0x3, 0x58f, [{0x0, 0x20008000, 0x4, 0x1}]}}, @TCA_U32_POLICE={0x48, 0x6, [@TCA_POLICE_TBF={0x3c, 0x1, {0xf, 0x10000000, 0x6ed, 0xfffffff8, 0x1000, {0x4, 0x2, 0x1, 0x6ca, 0x8}, {0xc, 0x2, 0x5, 0xfffc, 0x4, 0x8}, 0x78, 0xfffffffe, 0x6}}, @TCA_POLICE_AVRATE={0x8, 0x4, 0x6}]}, @TCA_U32_INDEV={0x14, 0x8, 'veth0_to_hsr\x00'}]}}, @TCA_RATE={0x6, 0x5, {0x2, 0xe}}]}, 0xb8}}, 0x24040084) r3 = socket$inet_mptcp(0x2, 0x1, 0x106) setsockopt$inet_pktinfo(r3, 0x0, 0x8, 0x0, 0x0) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r4, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000640)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a03000000000000000000070000040900010073797a30000000004c000000090a010400000000000000000700000008000a40000000000900020073797a31000000000900010073797a30000000000800054000000021100011800c000100636f756e74657200180100000c0a010300000000000000000700fffe0900020073797a31000000000900010073797a3000000000ec000380e8000080d00001800c0002800800034000000002c00001000e80a01447354eade9fcdf54e99945b9a3f3c794c33b64481ae460b4f6a1f3f47fd758998e44e289e660caf11448beb9a1b0223267439fb295f7de371c718b20b37fb6f9b08ec9c3f8d9e1f88126c0c5187be18320bc17d5905212e23e70baafc77ed9ac47db01c34c9927fd4cb4bd9bb06c84fa5246e594ee48764c4f53dc42f0811a8b7bc8311bceacf982c449cb86b3ac46da849ef56d27cac1b59bf23320ff2d435e0a651ff2e842070000003d28a019f3d9b502c4cb050481dd140007800c000100636f756e746572"], 0x1ac}}, 0x0) 2.771831081s ago: executing program 1 (id=5752): bpf$BPF_GET_PROG_INFO(0xf, &(0x7f0000000140)={0xffffffffffffffff, 0xfffffffffffffdbc, &(0x7f0000000500)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, ""/16, 0x0, 0x0, 0x0, 0x0, 0x0, 0x46, 0x0, &(0x7f0000000000)=[0x0, 0x0, 0x0, 0x0], 0x0, 0x40, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50, 0x8, 0x0, 0x0}}, 0x10) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r2 = socket$l2tp(0x2, 0x2, 0x73) bind$inet(r2, &(0x7f00000002c0)={0x2, 0x4e20, @empty}, 0x10) connect$inet(r2, &(0x7f0000000000)={0x2, 0x0, @loopback}, 0x10) sendmmsg$inet(r2, &(0x7f0000000900)=[{{0x0, 0x0, 0x0}}], 0x40000cf, 0x0) bind$bt_hci(r1, &(0x7f0000000080)={0x1f, 0xffff, 0x3}, 0x6) write(r1, &(0x7f0000000000)="0a000000010001", 0x7) r3 = socket$nl_xfrm(0x10, 0x3, 0x6) r4 = socket$tipc(0x1e, 0x5, 0x0) listen(r4, 0x0) r5 = accept(r4, 0x0, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32, @ANYBLOB="0000000000000000b70800000d0000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) r6 = socket$nl_generic(0x10, 0x3, 0x10) r7 = syz_genetlink_get_family_id$l2tp(&(0x7f00000000c0), r6) sendmsg$L2TP_CMD_TUNNEL_MODIFY(r6, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000640)=ANY=[@ANYBLOB="140000002b15c0a149ab85627fa019cc520ed5a7553e464088475bd47580e0bc4f457d7e22ce1f702815fb4aaef9337186aa67d98f9d0594e6b6f0651b809e5a0921c613d093b0aaff271d8f1efdba052625272130245a11c67c707316637ca7c8f044cfca64ba04cd0453af2868d4ade94e1342ae1ccafdbd3e44ad462e82acfcc501012df5550b37384bd95ddbd71d82e4000000000000c63aaba29c005ed37f3422a6f6a179c2873f2d04a105ec97bd68171e1204e7d03fd036cdbf642b695beee936d587959560fa2debe9cc342f69cb4270", @ANYRES16=r7, @ANYBLOB="0100000000000000000003000000"], 0x14}}, 0x0) r8 = bpf$MAP_CREATE(0x0, &(0x7f0000000280)=ANY=[@ANYRESOCT=r0, @ANYRESDEC, @ANYRES64=r5], 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0xa, 0x4, &(0x7f0000000480)=ANY=[@ANYBLOB="18000000000000000000000000000000850000006d"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r9 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000d80)={0x18, 0x5, &(0x7f0000000480)=ANY=[@ANYBLOB="1801000021"], 0x0, 0x40, 0x0, 0x0, 0x0, 0xb4a02fe0ce239f93, '\x00', 0x0, 0x2}, 0x94) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0xe, 0x0, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000800000000000000000000018110000", @ANYRES32=r8], 0x0, 0x0, 0x0, 0x0, 0x41100, 0x59, '\x00', 0x0, @fallback=0x2a, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, r9, 0x0, 0x0, 0x0, 0x0}, 0x94) r10 = bpf$PROG_LOAD(0x5, &(0x7f0000000300)={0x6, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback=0x4, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000180)={r10, 0x2000000, 0xe, 0x0, &(0x7f0000000040)="630b008646dc3f0adf33c9f7b986", 0x0, 0xcf25, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x80}, 0x50) sendmsg$nl_xfrm(r3, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000480)=ANY=[@ANYBLOB="fc0000001900674c0000000000000000e0000001000000000000000000000000e000000200000000000000000000000000000000000000000a00000000000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="00000000000000000000000000004000000000000000000000000000000000000000000000000000010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000100000000000000440005"], 0xfc}}, 0x0) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f00000000c0)='./cgroup.net/syz0\x00', 0x1ff) r11 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r12 = openat$cgroup_int(r11, &(0x7f00000002c0)='blkio.throttle.write_iops_device\x00', 0x2, 0x0) write$cgroup_int(r12, &(0x7f0000000600)=0xfffffffffffffffa, 0x12) r13 = socket$tipc(0x1e, 0x5, 0x0) ioctl$sock_SIOCETHTOOL(r13, 0x8946, &(0x7f0000000d00)={'macvtap0\x00', &(0x7f0000000c80)=@ethtool_coalesce={0x1, 0x2, 0x115b, 0x2, 0x5, 0x2, 0x5, 0xb5, 0x7, 0x7, 0x2, 0xe464, 0x9, 0x9, 0xfffffff5, 0x6, 0x5, 0x400, 0x101, 0xa2, 0x8, 0x10000, 0xaa0}}) 2.38520921s ago: executing program 5 (id=5753): r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x5, 0x0) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r2 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r2, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000000)=@allocspi={0x100, 0x16, 0x1, 0x70bd2d, 0x25dfdbff, {{{@in6=@loopback, @in=@dev={0xac, 0x14, 0x14, 0x18}, 0x0, 0x8}, {@in=@dev={0xac, 0x14, 0x14, 0x1d}, 0x0, 0x6c}, @in=@broadcast, {0x0, 0x0, 0x1, 0x0, 0x88c}, {0x0, 0x0, 0x0, 0xffffffffffffffff}, {0x2}}, 0x0, 0x7fff}, [@iptfs_reorder_window={0x6, 0x25, 0x5}]}, 0x100}, 0x1, 0x0, 0x0, 0x80}, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) write(r1, &(0x7f0000000100)="4a00ffff11003ee0b4fdddd685986a49e00588f1ba", 0x15) nanosleep(&(0x7f0000000200)={0x0, 0x10000000}, 0x0) socket$tipc(0x1e, 0x2, 0x0) r3 = syz_init_net_socket$bt_hci(0x1f, 0x5, 0x8) bind(r3, &(0x7f0000000300)=@generic={0x1f, "0000000000000100"}, 0x9) ioctl$BTRFS_IOC_TREE_SEARCH(r0, 0xd0009411, 0x0) ioctl$BTRFS_IOC_INO_LOOKUP(r0, 0xd0009412, 0x0) bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0x10, 0x4, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sk_msg}, 0x94) r4 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r4, &(0x7f0000000040)={0x2, 0x4e20, @empty}, 0x10) syz_emit_ethernet(0x2a, &(0x7f0000000000)={@empty, @remote, @void, {@ipv4={0x800, @udp={{0x5, 0x4, 0x0, 0x0, 0x1c, 0x68, 0x0, 0x0, 0x11, 0x0, @empty, @empty}, {0x0, 0x4e20, 0x8}}}}}, 0x0) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f000000c2c0)={0x0, 0x0, 0x0}, 0x0) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000140)={0x6, 0x3, &(0x7f0000000680)=ANY=[@ANYBLOB="1800000002000000000000000000000095"], 0x0, 0x5, 0x0, 0x0, 0x60ff78ce1cb3c070}, 0x94) r5 = bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000480)={0x6, 0x3, &(0x7f0000000680)=ANY=[], &(0x7f00000002c0)='syzkaller\x00', 0x7}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000600)={r5, 0x5, 0xb68, 0x0, &(0x7f0000000000)='%', 0x0, 0xd01, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x48) recvmmsg(r4, 0x0, 0x0, 0x0, 0x0) 2.174077178s ago: executing program 0 (id=5754): r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f00000003c0)=@newlink={0x20, 0x10, 0x401, 0x70bd2d, 0x0, {0x0, 0x0, 0x0, 0x0, 0x2478a, 0x20681}}, 0x20}}, 0x80c0) 2.137553732s ago: executing program 4 (id=5755): socket$nl_route(0x10, 0x3, 0x0) (async) bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000080)={&(0x7f0000000000)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0x1c, 0x1c, 0x2, [@datasec={0x0, 0x0, 0x0, 0xf, 0x3, [], "63d038"}, @datasec={0x0, 0x0, 0x0, 0xf, 0x1, [], "de"}]}}, 0x0, 0x36}, 0x28) r0 = socket(0xa, 0x3, 0x4) ioctl$sock_SIOCBRDELBR(r0, 0x89a2, &(0x7f0000000000)='bridge0\x00') (async) r1 = socket$netlink(0x10, 0x3, 0x0) (async) r2 = socket(0x10, 0x3, 0x0) (async) mmap(&(0x7f0000001000/0xc00000)=nil, 0xc00000, 0x2000004, 0x3b071, 0xffffffffffffffff, 0x0) (async) r3 = accept4(0xffffffffffffffff, 0x0, &(0x7f0000000000), 0x80000) (async) r4 = socket$nl_generic(0x10, 0x3, 0x10) r5 = syz_genetlink_get_family_id$tipc(&(0x7f0000000080), r4) sendmsg$TIPC_CMD_GET_NODES(r2, &(0x7f0000000500)={0x0, 0x0, &(0x7f0000000540)={&(0x7f00000002c0)={0x1c, r5, 0x1, 0x70bd25, 0x25dfdbfb, {{}, {0x0, 0x6}}}, 0xfffffffffffffd4f}}, 0x5) sendmsg$TIPC_CMD_SET_LINK_TOL(r3, &(0x7f00000002c0)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x20000000}, 0xc, &(0x7f0000000240)={&(0x7f0000000680)=ANY=[@ANYBLOB="3000000024a35092a51ed6e8bbcc5615a8e6e64ce15b12300b7ca3cea6e741ed1c3f6cc379cda6ce151d1677efe8ddaa5c6e1b71d41ea60fe9d73eeb4974d5ec63794386e3467b7c0b0da771d8976f268956e85b24041ec9a49646b9d719b5f8f45fb7c46f8272bdb6e4cca7e50ae541b331e200bd394ec9b988c77a93b48448b3c5c855f0da2e68691f8359bed0633a1f696ee8008ae4ffd65b5b5dd5989034774f25947d39167dd60df60dad5d6e7a34b2aa1f2ee1589620347b7b3471e5bc3144205fd816e2b1c7f57a379d178c61d386eaad1e4dddedf4d9235d86d1aa6366bf6a3f2f670aa2e5acbbe4522c60af3924eb1282a981b4aa918865ea5164", @ANYRES16=r5, @ANYBLOB="000229bd7000fedbdf2501000000000000000741000000140018000000047564703a73797a3000000000"], 0x66}, 0x1, 0x0, 0x0, 0x40846}, 0x4000) sendmsg$TIPC_CMD_DISABLE_BEARER(r2, &(0x7f00000003c0)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x800}, 0xc, &(0x7f0000000380)={&(0x7f0000000340)=ANY=[@ANYBLOB="5e0d2cbd", @ANYRES16=r5, @ANYBLOB="000426bd7000fedbdf250100000000000000024100000010001369623a6d6163766c616e3100"], 0x2c}, 0x1, 0x0, 0x0, 0x44801}, 0x20000800) (async) r6 = accept4$bt_l2cap(r2, &(0x7f00000000c0)={0x1f, 0x0, @fixed}, &(0x7f0000000140)=0xe, 0x800) setsockopt$bt_BT_SECURITY(r6, 0x112, 0x4, &(0x7f0000000180)={0x7, 0x5}, 0x2) (async) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff}) sendmsg$inet(r7, &(0x7f0000000980)={0x0, 0x6000, &(0x7f0000000900)=[{&(0x7f0000000640)='U', 0xa00120}], 0x1}, 0x3) (async) ppoll(&(0x7f0000000280)=[{r7, 0x80}], 0x1, &(0x7f00000002c0), 0x0, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000001c0)={0x11, 0xb, &(0x7f0000000940)=@framed={{0x18, 0x0, 0x0, 0x0, 0x804, 0x0, 0x0, 0x0, 0xe0000000}, [@printk={@llu, {}, {}, {}, {}, {0x7, 0x0, 0xb, 0x3, 0x0, 0x0, 0x1}}]}, &(0x7f0000000040)='GPL\x00', 0xa, 0x1000, &(0x7f0000000cc0)=""/4096, 0x40f00, 0xc}, 0x94) (async) getsockname$packet(r2, &(0x7f00000002c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000100)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000008c0)=ANY=[@ANYBLOB="480000001000050700000086d7c0d6c878f064eb", @ANYRES32=r8, @ANYBLOB="0000000000000000280012000c00010076657468"], 0x48}}, 0x90) (async) sendmsg$nl_route_sched(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f00000004c0)={&(0x7f0000000900)=@newqdisc={0x30, 0x24, 0xf1d, 0x0, 0x0, {0x0, 0x0, 0x0, r8, {}, {0xfff1, 0xffff}}, [@qdisc_kind_options=@q_clsact={0xb}]}, 0x30}}, 0x4000800) socket$kcm(0x21, 0x2, 0x2) (async) r9 = syz_init_net_socket$llc(0x1a, 0x2, 0x0) recvmmsg(r9, &(0x7f0000007980)=[{{0x0, 0x0, 0x0}, 0x9}, {{0x0, 0x0, 0x0}, 0x5}], 0x2, 0x2181, 0x0) (async) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, &(0x7f0000000440)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) (async) bpf$MAP_CREATE(0x0, &(0x7f0000000740)=ANY=[@ANYBLOB="0b00000005000000000400000900000001"], 0x48) (async) socket$inet_tcp(0x2, 0x1, 0x0) (async) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0xe, 0x0, &(0x7f0000000400)=ANY=[@ANYBLOB="1800000000800000000000000000000018110000", @ANYRESOCT], 0x0, 0x0, 0x0, 0x0, 0x41100, 0x59, '\x00', 0x0, @fallback=0x2a, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0}, 0x94) (async) bpf$PROG_LOAD(0x5, &(0x7f0000000440)={0x4, 0xe, &(0x7f0000001cc0)=ANY=[], &(0x7f0000000300)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x54, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x8, 0x10, &(0x7f0000000100)={0x0, 0xffffffff}, 0x10}, 0x94) 1.809881531s ago: executing program 0 (id=5756): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x42082, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x2}) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) close(r1) r2 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000580)={&(0x7f00000007c0)=@newqdisc={0x60, 0x24, 0x4ee4e6a52ff56541, 0x4, 0x35dfdbfd, {0x0, 0x0, 0x0, r3, {0x0, 0xb}, {0xffff, 0xffff}, {0xfff2}}, [@qdisc_kind_options=@q_tbf={{0x8}, {0x34, 0x2, [@TCA_TBF_PARMS={0x28, 0x1, {{0x5, 0x1, 0x5, 0xd, 0xd9, 0x10}, {0x0, 0x2, 0x5, 0x3, 0x1}, 0x2, 0x5, 0x8d0}}, @TCA_TBF_BURST={0x8, 0x6, 0x10001}]}}]}, 0x60}, 0x1, 0x0, 0x0, 0x40088c1}, 0x0) sendmsg$nl_route_sched(r2, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=@newqdisc={0x3c, 0x24, 0x4ee4e6a52ff56541, 0x70b926, 0x25dfdbff, {0x0, 0x0, 0x0, r3, {0x0, 0xd}, {0x0, 0xb}, {0xffff, 0x6}}, [@qdisc_kind_options=@q_codel={{0xa}, {0xc, 0x2, [@TCA_CODEL_TARGET={0x8, 0x1, 0x40}]}}]}, 0x3c}, 0x1, 0x0, 0x0, 0x240048e4}, 0x40) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) socket$kcm(0x11, 0x3, 0x0) socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000480)=ANY=[], 0x18}}, 0x20004000) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000100)=@gettaction={0x44, 0x32, 0x1ff, 0x70bd25, 0x25dfdbfe, {}, [@action_gd=@TCA_ACT_TAB={0x1c, 0x1, [{0xc, 0x1c, 0x0, 0x0, @TCA_ACT_KIND={0x8, 0x1, 'bpf\x00'}}, {0xc, 0x1d, 0x0, 0x0, @TCA_ACT_KIND={0x8, 0x1, 'ife\x00'}}]}, @action_gd=@TCA_ACT_TAB={0x14, 0x1, [{0x10, 0x20, 0x0, 0x0, @TCA_ACT_KIND={0xb, 0x1, 'mirred\x00'}}]}]}, 0x44}, 0x1, 0x0, 0x0, 0x40000}, 0x4048840) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000100)=ANY=[@ANYBLOB="4800000010000d0428bd7000fcdbff2500008000", @ANYRES32=0x0, @ANYBLOB="1000000000000000280012800b0001006272696467650000180002"], 0x48}, 0x1, 0x0, 0x0, 0x10}, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000100)=ANY=[@ANYBLOB="500000001000010425bbe5ad600027842cf52300", @ANYRES32=0x0, @ANYBLOB="0300000000000000280012800a00010076786c616e00"], 0x50}, 0x1, 0x0, 0x0, 0x13d33d22cca65c15}, 0x4008840) r4 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='memory.events\x00', 0x275a, 0x0) mmap(&(0x7f0000002000/0x4000)=nil, 0x4000, 0xedc623580215bdcd, 0x12, r4, 0x0) ioctl$sock_inet6_tcp_SIOCOUTQ(r4, 0x5411, &(0x7f00000000c0)) r5 = socket$netlink(0x10, 0x3, 0x0) sendmmsg(r5, &(0x7f00000002c0), 0x40000000000009f, 0x0) r6 = socket$inet6_tcp(0xa, 0x1, 0x0) close(r6) r7 = socket$inet6_mptcp(0xa, 0x1, 0x106) bind$inet6(r6, &(0x7f0000000040)={0xa, 0x4e22, 0x0, @ipv4={'\x00', '\xff\xff', @empty}, 0xf}, 0x1c) listen(r7, 0x0) r8 = socket$inet_mptcp(0x2, 0x1, 0x106) connect$inet(r8, &(0x7f0000000000)={0x2, 0x4e22, @local}, 0x10) socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$mptcp(&(0x7f0000000000), 0xffffffffffffffff) sendmsg$IPCTNL_MSG_TIMEOUT_GET(0xffffffffffffffff, 0x0, 0x4) 1.526214074s ago: executing program 1 (id=5757): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000002c80)={0x3, 0xc, &(0x7f0000000680)=ANY=[@ANYBLOB="180200000000000000000000000000008500000030000000180100002020702500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b70300000000000085000000b000000095"], &(0x7f0000000080)='GPL\x00'}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f00000002c0)={r1, 0x0, 0xe, 0x0, &(0x7f0000000340)="53e04278c096ccc4a03dcfdd24db", 0x0, 0x40a5bb, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000400)={&(0x7f0000000500)=ANY=[@ANYBLOB="140000001000010000000000000000000200000a20000000000a010400000000000000000200000a0900010073797a300000000040000000030a01040000000000000000020000000020010073797a30000000000900030073797a300100000014000480080001400000000308000240000000004000000006852c1809000000000000000200000a0900010073797a000900020073797a30000000001400048010cb4880080001006c6f6700040002801400000011"], 0xc8}}, 0x0) r2 = socket$alg(0x26, 0x5, 0x0) bind$alg(r2, &(0x7f0000000000)={0x26, 'hash\x00', 0x0, 0x0, 'sha256\x00'}, 0x58) ioctl$XFS_IOC_ATTRLIST_BY_HANDLE(r0, 0x4058587a, &(0x7f00000005c0)={{r0, &(0x7f0000000140)='ethtool\x00', 0x8480, &(0x7f0000000180)={@_ha_fsid={[0x2, 0x1db62ab9]}, {0x3c96, 0x6, 0x8, 0x3}}, 0x0, &(0x7f0000000240)={@_ha_fsid}, &(0x7f0000000280)=0x4}, {[0x1, 0x3bd0, 0x1, 0x5]}, 0x0, 0xa0, &(0x7f0000000440)=""/160}) sendmsg$IPSET_CMD_TYPE(r3, &(0x7f0000000800)={&(0x7f0000000640)={0x10, 0x0, 0x0, 0x8000000}, 0xc, &(0x7f00000007c0)={&(0x7f0000000740)={0x50, 0xd, 0x6, 0x201, 0x0, 0x0, {0x1, 0x0, 0x2}, [@IPSET_ATTR_FAMILY={0x5, 0x5, 0xa}, @IPSET_ATTR_FAMILY={0x5, 0x5, 0xa}, @IPSET_ATTR_TYPENAME={0x12, 0x3, 'hash:net,port\x00'}, @IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_FAMILY={0x5, 0x5, 0x7}, @IPSET_ATTR_FAMILY={0x5, 0x5, 0x2}]}, 0x50}, 0x1, 0x0, 0x0, 0x2000}, 0x44840) r4 = accept$alg(r2, 0x0, 0x0) ioctl$sock_SIOCETHTOOL(r0, 0x8946, &(0x7f0000000100)={'veth1_virt_wifi\x00', &(0x7f0000000080)=@ethtool_eee={0x45, 0xff, 0x2, 0xf4, 0x5596, 0x2, 0x10001, 0x10, [0x5, 0xc00000]}}) sendmmsg$alg(r4, &(0x7f00000000c0)=[{0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f0000000700)="ca", 0x1}], 0x1, 0x0, 0x0, 0x4800}], 0x1, 0x42887) sendmsg$IPSET_CMD_CREATE(0xffffffffffffffff, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000044c0)={&(0x7f0000000580)=ANY=[@ANYBLOB="5c000000020605000000000000000000000000000c00078005001500267d00000500010007000000050005000a000000050004"], 0x5c}}, 0x0) r5 = socket$nl_generic(0x10, 0x3, 0x10) r6 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000040), r5) r7 = socket$nl_generic(0x10, 0x3, 0x10) r8 = syz_genetlink_get_family_id$devlink(&(0x7f00000003c0), r5) sendmsg$DEVLINK_CMD_SB_POOL_GET(r7, &(0x7f00000008c0)={&(0x7f0000000380)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000000880)={&(0x7f0000000840)={0x14, r8, 0x100, 0x70bd27, 0x25dfdbfc}, 0x14}, 0x1, 0x0, 0x0, 0x800}, 0x4000001) sendmsg$ETHTOOL_MSG_DEBUG_SET(r5, &(0x7f0000001540)={0x0, 0x0, &(0x7f0000001500)={&(0x7f0000000580)=ANY=[@ANYBLOB='8\x00\x00\x00', @ANYRES16=r6, @ANYBLOB="01000000040200f2c8dc1b000000180001801400020073797a5f74756e0000000000000000000c000280"], 0x38}, 0x1, 0x0, 0x0, 0x20000844}, 0x0) 708.072947ms ago: executing program 5 (id=5758): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) r1 = openat$tun(0xffffffffffffff9c, &(0x7f00000001c0), 0xc8000, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000340)={'nicvf0\x00', 0x2}) ioctl$XFS_IOC_READLINK_BY_HANDLE(r0, 0xc038586c, &(0x7f0000000200)={r0, &(0x7f0000000000)=':&\x00', 0xa6c0, &(0x7f0000000100)={@align=0x1, {0xa00, 0x3, 0x40, 0x5}}, 0x81, &(0x7f0000000140)={@_ha_fsid}, &(0x7f0000000180)=0x4eb}) r2 = socket$nl_sock_diag(0x10, 0x3, 0x4) r3 = socket(0x28, 0x5, 0x0) bind$vsock_stream(r3, &(0x7f0000000040), 0x10) listen(r3, 0x0) r4 = socket(0x28, 0x5, 0x0) connect$vsock_stream(r4, &(0x7f0000000080)={0x28, 0x0, 0x0, @local}, 0x10) r5 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000002c80)={0x3, 0xc, &(0x7f0000000140)=ANY=[@ANYBLOB="18020000010000000000000000000000850000008700000018010000646c6c2500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000007200000095"], &(0x7f0000000080)='GPL\x00', 0x0, 0x0, 0x0, 0x41000}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f00000002c0)={r5, 0x0, 0xe, 0x0, &(0x7f0000000000)="1cc1110ec1e9abc89b005bec0000", 0x0, 0x100, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) r6 = socket(0x10, 0x3, 0x0) setsockopt$netlink_NETLINK_TX_RING(r6, 0x10e, 0xc, &(0x7f0000000180)={0x80000020}, 0x10) sendmsg$nl_route(r6, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000440)={&(0x7f0000000200)=@getlink={0x20, 0x12, 0x18efde40b3708357, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x0, 0x2000}}, 0x20}}, 0x0) sendmsg$SOCK_DIAG_BY_FAMILY(r2, &(0x7f00000065c0)={0x0, 0x0, &(0x7f0000006580)={&(0x7f0000004d00)=ANY=[@ANYBLOB="28000000140011020000000000000009280011000100e7bdd191486e8e3bf0795161b20000000000"], 0x28}}, 0x0) ioctl$TUNSETLINK(r1, 0x400454cd, 0x1) sendmsg$IPSET_CMD_CREATE(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000044c0)={&(0x7f0000000240)=ANY=[@ANYBLOB="600000000206010800000000000000000100000814000780080012400000000508000640000000000500010006000000050005000a00000005000400000000000900020073797a30000000d6c922f30013000300686173683a6e65742c696661"], 0x60}, 0x1, 0x0, 0x0, 0xc0d1}, 0x8800) 333.234736ms ago: executing program 3 (id=5759): r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000040)='./cgroup/syz0\x00', 0x200002, 0x0) r1 = openat$cgroup_ro(r0, &(0x7f0000000000)='cgroup.events\x00', 0x275a, 0x0) r2 = socket$alg(0x26, 0x5, 0x0) bind$alg(r2, &(0x7f0000000100)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb(aes)\x00'}, 0x58) r3 = accept4(r2, 0x0, 0x0, 0x80000) setsockopt$ALG_SET_KEY(r2, 0x117, 0x1, &(0x7f0000000000)="c8ed0ec2aff22b790000000000000000", 0x10) recvmmsg(r3, &(0x7f0000007b00)=[{{&(0x7f0000000200)=@isdn, 0x80, &(0x7f0000000740)=[{&(0x7f0000000280)=""/181, 0xb5}, {&(0x7f0000000340)=""/251, 0xfb}, {&(0x7f0000000440)=""/223, 0xdf}, {&(0x7f0000000540)=""/171, 0xab}, {&(0x7f0000000600)=""/118, 0x76}, {&(0x7f0000000680)=""/10, 0xa}, {&(0x7f00000006c0)=""/86, 0x56}], 0x7, &(0x7f00000007c0)=""/185, 0xb9}, 0x8}, {{&(0x7f0000000880)=@can, 0x80, &(0x7f0000002cc0)=[{&(0x7f0000000900)=""/172, 0xac}, {&(0x7f00000009c0)=""/152, 0x98}, {&(0x7f0000000a80)=""/153, 0x99}, {&(0x7f0000000b40)=""/106, 0x6a}, {&(0x7f0000000bc0)=""/84, 0x54}, {&(0x7f0000000c40)=""/4096, 0x1000}, {&(0x7f0000001c40)=""/113, 0x71}, {&(0x7f0000001cc0)=""/4096, 0x1000}], 0x8, &(0x7f0000002d40)=""/151, 0x97}, 0x2}, {{&(0x7f0000002e00)=@pppoe={0x18, 0x0, {0x0, @multicast}}, 0x80, &(0x7f0000004880)=[{&(0x7f0000002e80)=""/82, 0x52}, {&(0x7f0000003540)=""/4096, 0x1000}, {&(0x7f0000004540)=""/101, 0x65}, {&(0x7f00000045c0)=""/199, 0xc7}, {&(0x7f00000046c0)=""/235, 0xeb}, {&(0x7f00000047c0)=""/189, 0xbd}], 0x6, &(0x7f0000004900)=""/91, 0x5b}, 0x5}, {{0x0, 0x0, &(0x7f0000005dc0)=[{&(0x7f0000004980)=""/231, 0xe7}, {&(0x7f0000004a80)=""/222, 0xde}, {&(0x7f0000004b80)=""/4096, 0x1000}, {&(0x7f0000005b80)=""/205, 0xcd}, {&(0x7f0000005c80)=""/139, 0x8b}, {&(0x7f0000005d40)=""/89, 0x59}], 0x6, &(0x7f0000005e40)=""/245, 0xf5}, 0xb}, {{&(0x7f0000005f40)=@xdp, 0x80, &(0x7f0000007200)=[{&(0x7f0000005fc0)=""/4096, 0x1000}, {&(0x7f0000006fc0)=""/151, 0x97}, {&(0x7f0000007080)=""/254, 0xfe}, {&(0x7f0000007180)=""/25, 0x19}, {&(0x7f00000071c0)=""/10, 0xa}], 0x5, &(0x7f0000007280)=""/59, 0x3b}, 0x80}, {{&(0x7f00000072c0)=@nfc_llcp, 0x80, &(0x7f0000007900)=[{&(0x7f0000007340)=""/144, 0x90}, {&(0x7f0000007400)=""/213, 0xd5}, {&(0x7f0000007500)=""/149, 0x95}, {&(0x7f00000075c0)=""/219, 0xdb}, {&(0x7f00000076c0)=""/212, 0xd4}, {&(0x7f00000077c0)=""/69, 0x45}, {&(0x7f0000007840)=""/183, 0xb7}], 0x7}, 0x7}, {{&(0x7f0000007980)=@rxrpc=@in6={0x21, 0x0, 0x2, 0x1c, {0xa, 0x0, 0x0, @remote}}, 0x80, &(0x7f0000007a80)=[{&(0x7f0000007a00)=""/119, 0x77}], 0x1, &(0x7f0000007ac0)=""/17, 0x11}, 0x1}], 0x7, 0x0, 0x0) syz_genetlink_get_family_id$ethtool(&(0x7f0000000080), r3) sendmsg$NFT_BATCH(r3, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f00000003c0)=ANY=[], 0x7c}, 0x1, 0x0, 0x0, 0x44800}, 0x4048000) sendmsg$NL80211_CMD_NEW_KEY(r3, &(0x7f0000002fc0)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x10}, 0xc, &(0x7f0000002f80)={&(0x7f0000002f00)={0x64, 0x0, 0x10, 0x70bd27, 0x25dfdbfe, {{}, {@void, @val={0xc, 0x99, {0x80, 0x15}}}}, [@NL80211_ATTR_KEY_DATA_WEP104={0x11, 0x7, "b19fa7b793ed60d86c9c816e92"}, @NL80211_ATTR_KEY_CIPHER={0x8, 0x9, 0x4}, @NL80211_ATTR_KEY_DATA_WEP40={0x9, 0x7, "61bc3d145a"}, @NL80211_ATTR_KEY_IDX={0x5, 0x8, 0x1}, @NL80211_ATTR_KEY_DATA_WEP40={0x9, 0x7, "9676e96485"}, @NL80211_ATTR_KEY_TYPE={0x8, 0x37, 0x2}]}, 0x64}, 0x1, 0x0, 0x0, 0x20008844}, 0x80) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x2000001, 0x12, r1, 0x0) write$cgroup_devices(r1, &(0x7f00000000c0)={'b', ' *:* ', 'm\x00'}, 0x8) writev(r1, &(0x7f0000003500)=[{0x0}, {&(0x7f0000000080)='C', 0x1}], 0x2) recvfrom$inet(r3, &(0x7f0000003000)=""/143, 0x8f, 0x40010000, &(0x7f00000030c0)={0x2, 0x4e21, @local}, 0x10) 294.981852ms ago: executing program 1 (id=5760): bpf$BPF_BTF_LOAD(0x12, &(0x7f0000001300)={&(0x7f0000000280)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0x30, 0x30, 0x2, [@enum, @union={0x0, 0x1, 0x0, 0x5, 0x0, 0x0, [{0x0, 0x3}]}, @volatile={0x0, 0x0, 0x0, 0x9, 0x1}]}}, &(0x7f0000000180)=""/220, 0x4a, 0xdc, 0x1}, 0x20) r0 = bpf$PROG_LOAD(0x5, &(0x7f00000005c0)={0x3, 0xc, &(0x7f0000000340)=ANY=[@ANYBLOB="180000000000000000000000000000008500000061000000180100002020702500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000009b00000095"], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sched_cls, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000140)={r0, 0x1f2f, 0x24, 0x0, &(0x7f0000000000)="1e749f447f700400684010a40800297a5d41726bb1d331200ce375083a37c86b7fd9d7da", 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) bpf$BPF_MAP_CONST_STR_FREEZE(0x16, &(0x7f0000000040)={0x1, 0xffffffffffffffff}, 0x4) bpf$MAP_UPDATE_CONST_STR(0x2, &(0x7f0000000100)={{r1}, &(0x7f0000000080), &(0x7f00000000c0)='%pK \x00'}, 0x20) 205.040669ms ago: executing program 1 (id=5761): r0 = syz_init_net_socket$bt_hidp(0x1f, 0x3, 0x6) syz_init_net_socket$bt_l2cap(0x1f, 0x2, 0x0) (async) r1 = syz_init_net_socket$bt_l2cap(0x1f, 0x2, 0x0) r2 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000001c0)={0x11, 0xa, &(0x7f0000000080)=@framed={{0x18, 0x3}, [@initr0, @generic={0x65, 0x0, 0x0, 0x0, 0x8}, @initr0={0x18, 0x0, 0x0, 0x0, 0x20000000}, @exit, @alu={0x4, 0x0, 0xa, 0x3, 0x0, 0xffffffffffffffc0, 0xfffffffffffffffc}]}, &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x45}, 0x94) setsockopt$sock_attach_bpf(r1, 0x1, 0x32, &(0x7f0000000100)=r2, 0x4) (async) setsockopt$sock_attach_bpf(r1, 0x1, 0x32, &(0x7f0000000100)=r2, 0x4) connect$bt_l2cap(r1, &(0x7f0000000080)={0x1f, 0x0, @fixed={'\xaa\xaa\xaa\xaa\xaa', 0x10}, 0x7ff}, 0xe) ioctl$sock_bt_hidp_HIDPCONNADD(r0, 0x400448c8, &(0x7f0000000340)={r1, r1, 0xd, 0x3, &(0x7f0000000040)="037c5e", 0xb, 0x1, 0xb57, 0x5df, 0x8b, 0x1, 0x9, 'syz1\x00'}) 110.954366ms ago: executing program 0 (id=5762): ioctl$XFS_IOC_FD_TO_HANDLE(0xffffffffffffffff, 0xc038586a, &(0x7f00000002c0)={0xffffffffffffffff, &(0x7f0000000080)='\x05!$\x00', 0x0, &(0x7f00000001c0)={@_ha_fsid={[0x8, 0x1]}, {0x2, 0x9, 0x7, 0x1}}, 0x6c6, &(0x7f0000000200)={@_ha_fsid}, &(0x7f0000000280)}) sendmsg$NFT_BATCH(r0, &(0x7f00000009c0)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f0000000980)={&(0x7f0000000a00)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x3}}, [@NFT_MSG_DELOBJ={0x2f0, 0x14, 0xa, 0x101, 0x0, 0x0, {0x3, 0x0, 0x1}, [@NFTA_OBJ_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_OBJ_NAME={0x9, 0x2, 'syz2\x00'}, @NFTA_OBJ_HANDLE={0xc, 0x6, 0x1, 0x0, 0x4}, @NFTA_OBJ_USERDATA={0xd6, 0x8, "c39b99e7294e6ff541df2423d3f1d6f6143956d2a30d9ba89aa06da88607bdb989adabd3b72a03de2466966e874fbf76c833c893507e9f2e733fa343e84c6ab8ad43c6cab7db4fbf45b60bf40284099b2789c7b41a4b4a2805fc99d8c78f85e412048ada198128ed2996f81699cd4c46b8236cfc07f21a1107700af8f69743f15402d926c326173ecc0cff0f3c49f37c9eefda27a1f17f7f27e00416a3e228fcdbb3cb859dd7d5223abf5c7de245a32352cd6be54022e4732ca4c45fe7599b964bb8978df970ff19e28682f74dc4b90fc294"}, @NFTA_OBJ_USERDATA={0xdf, 0x8, "8f988f55f61c85afaae4d48c7b3ff04e5fae388e54cb558cb03895511f334ceb815161bffa7e4d132ac6c49e529fbee18587b59951b1693a06784449335720cd08a607c116b3e697ff56ff01b8f96d1a003e03ad66691b869ffa75b04adec3ed6f2455016e011662b3a43c71c798158cd94e3beb88f55b7ce5cd92ca2b05c596932b123aa245ea515d579e69c5691f1eb5d6ba6b7668801600455d09e383e5b779d125236f8a7a7c5106999461a96f96c215232cfa59fee6f9f96a3b49e6a51d4211b56d925e4f0ac0715995e4f122a25393f594c413904ea8a82e"}, @NFTA_OBJ_USERDATA={0xf3, 0x8, "d9a10919c94e11c39b05b5f119741094d851c300c60f1eba6e841f5efbfd702761895967a1a851f32e617f2f3a65d30c05157a7d99cd3d34a90c02f88c76344008c39736d7039ee06a2a50db3bd85fee790ef5a7ca35bfd19d34dd414e8f301630f9dcce306911840583daf6330cbb28ebc8f5a7514708de4254781814398a8c9b75b05926af85f12435f40400db14b20457474dbf27cd5dcc84211f2469ab318859b028b9f615ccf6e0392047a4bab7fe0311995924a72ffbac056e04c08b5e5dc1292ff12dc1d4fc880cc1a84b4ee75875e2e552ae44e4561834901caf3906fe6f97b30641acc4b1458a082c5c29"}, @NFTA_OBJ_NAME={0x9, 0x2, 'syz2\x00'}]}, @NFT_MSG_DELSETELEM={0x30, 0xe, 0xa, 0x5, 0x0, 0x0, {0x0, 0x0, 0x9}, [@NFTA_SET_ELEM_LIST_SET_ID={0x8, 0x4, 0x1, 0x0, 0x1}, @NFTA_SET_ELEM_LIST_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_SET_ELEM_LIST_SET_ID={0x8, 0x4, 0x1, 0x0, 0x3}]}, @NFT_MSG_NEWRULE={0x68, 0x6, 0xa, 0x201, 0x0, 0x0, {0xa, 0x0, 0x8}, [@NFTA_RULE_ID={0x8, 0x9, 0x1, 0x0, 0x1}, @NFTA_RULE_USERDATA={0x3d, 0x7, 0x1, 0x0, "81e225324cd3b2234e67bb88a56e84218d0ec408e09cbed6d2a98cf283cc4cca0d33f624d4112863f4b2eb90c5ea23081ab82080c3a44a7de1"}, @NFTA_RULE_CHAIN={0x9, 0x2, 'syz1\x00'}]}, @NFT_MSG_DELSET={0x20, 0xb, 0xa, 0x201, 0x0, 0x0, {0xf, 0x0, 0x6}, [@NFTA_SET_TIMEOUT={0xc, 0xb, 0x1, 0x0, 0x3}]}, @NFT_MSG_NEWTABLE={0x90, 0x0, 0xa, 0x101, 0x0, 0x0, {0x5}, [@NFTA_TABLE_USERDATA={0x6f, 0x6, "15b7f830597aa731b3a5728905fe8f0cc32a44b6912837854766cfaf1770a3e9c776f947065380561db04a1cf6fd74f18765f22fec0e3e8edc4b4f9ec0873c71b77f617fe23070de510fff2bacf5f697d1ed9abf26da368da432f34491d0e827503169cb22f254a22d388f"}, @NFTA_TABLE_HANDLE={0xc, 0x4, 0x1, 0x0, 0x5}]}, @NFT_MSG_NEWSET={0x158, 0x9, 0xa, 0x201, 0x0, 0x0, {0x7, 0x0, 0xa}, [@NFTA_SET_EXPR={0x10, 0x11, 0x0, 0x1, @limit={{0xa}, @void}}, @NFTA_SET_GC_INTERVAL={0x8, 0xc, 0x1, 0x0, 0x3}, @NFTA_SET_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_SET_DATA_TYPE={0x8, 0x6, 0x1, 0x0, 0xffffff00}, @NFTA_SET_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_SET_EXPRESSIONS={0x10c, 0x12, 0x0, 0x1, [{0x40, 0x1, 0x0, 0x1, @nat={{0x8}, @val={0x34, 0x2, 0x0, 0x1, [@NFTA_NAT_TYPE={0x8}, @NFTA_NAT_REG_PROTO_MIN={0x8, 0x5, 0x1, 0x0, 0x11}, @NFTA_NAT_REG_PROTO_MIN={0x8, 0x5, 0x1, 0x0, 0xc}, @NFTA_NAT_REG_ADDR_MIN={0x8, 0x3, 0x1, 0x0, 0x4}, @NFTA_NAT_REG_PROTO_MAX={0x8, 0x6, 0x1, 0x0, 0x8}, @NFTA_NAT_REG_ADDR_MIN={0x8, 0x3, 0x1, 0x0, 0x9}]}}}, {0x2c, 0x1, 0x0, 0x1, @counter={{0xc}, @val={0x1c, 0x2, 0x0, 0x1, [@NFTA_COUNTER_PACKETS={0xc, 0x2, 0x1, 0x0, 0x8}, @NFTA_COUNTER_BYTES={0xc, 0x1, 0x1, 0x0, 0x4}]}}}, {0x38, 0x1, 0x0, 0x1, @rt={{0x7}, @val={0x2c, 0x2, 0x0, 0x1, [@NFTA_RT_KEY={0x8}, @NFTA_RT_DREG={0x8, 0x1, 0x1, 0x0, 0x12}, @NFTA_RT_KEY={0x8, 0x2, 0x1, 0x0, 0x3}, @NFTA_RT_KEY={0x8}, @NFTA_RT_DREG={0x8, 0x1, 0x1, 0x0, 0x9}]}}}, {0x10, 0x1, 0x0, 0x1, @numgen={{0xb}, @void}}, {0x20, 0x1, 0x0, 0x1, @dup={{0x8}, @val={0x14, 0x2, 0x0, 0x1, [@NFTA_DUP_SREG_DEV={0x8, 0x2, 0x1, 0x0, 0x2c0e2045573e0419}, @NFTA_DUP_SREG_DEV={0x8, 0x2, 0x1, 0x0, 0x10}]}}}, {0x34, 0x1, 0x0, 0x1, @payload={{0xc}, @val={0x24, 0x2, 0x0, 0x1, [@NFTA_PAYLOAD_BASE={0x8, 0x2, 0x1, 0x0, 0x2}, @NFTA_PAYLOAD_CSUM_FLAGS={0x8}, @NFTA_PAYLOAD_DREG={0x8, 0x1, 0x1, 0x0, 0x1}, @NFTA_PAYLOAD_CSUM_FLAGS={0x8, 0x8, 0x1, 0x0, 0x1}]}}}]}]}, @NFT_MSG_DELOBJ={0x34, 0x14, 0xa, 0x201, 0x0, 0x0, {0x0, 0x0, 0x1}, [@NFTA_OBJ_HANDLE={0xc, 0x6, 0x1, 0x0, 0x4}, @NFTA_OBJ_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_OBJ_TYPE={0x8, 0x3, 0x1, 0x0, 0x4}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x5}}}, 0x5ec}, 0x1, 0x0, 0x0, 0x80}, 0x0) (async) socketpair(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=@base={0x12, 0x7, 0x4, 0x2, 0x0, 0x1}, 0x50) (async) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r3, &(0x7f0000001080)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000840)={0x48, 0x2, 0x6, 0x1, 0x6000000, 0x0, {}, [@IPSET_ATTR_TYPENAME={0xe, 0x3, 'bitmap:ip\x00'}, @IPSET_ATTR_REVISION={0x5}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz2\x00'}, @IPSET_ATTR_FAMILY={0x5, 0x5, 0x3}, @IPSET_ATTR_PROTOCOL={0x5, 0x1, 0x6}]}, 0x48}, 0x1, 0x0, 0x0, 0x4}, 0x0) (async) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000180)={{r2, 0xffffffffffffffff}, &(0x7f0000000040), &(0x7f0000000140)=r1}, 0x20) bpf$MAP_GET_NEXT_KEY(0x4, &(0x7f0000000300)={r4, &(0x7f0000000080), 0x0}, 0x20) ioctl$EXT4_IOC_SETFSUUID(0xffffffffffffffff, 0x4008662c, &(0x7f0000000240)={0x10, 0x0, "a10ef03d7f919d6eb7cae2570256cb93"}) r5 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route(r5, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000240)=ANY=[], 0x20}}, 0x0) 0s ago: executing program 5 (id=5763): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r0, &(0x7f0000000080)={0xa, 0x2, 0x200, @loopback, 0x7}, 0x1c) sendto$inet6(r0, 0x0, 0x0, 0x24040001, &(0x7f0000000140)={0xa, 0x2, 0xffff, @loopback, 0x400d}, 0x1c) setsockopt$inet6_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f0000000180)='veno', 0x4) shutdown(r0, 0x1) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000340)={{0x1, 0xffffffffffffffff}, &(0x7f0000000100), &(0x7f00000001c0)}, 0x20) r2 = bpf$BPF_BTF_GET_FD_BY_ID(0x13, &(0x7f0000000600), 0x4) mmap(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0xe, 0x104011, r1, 0xe094a000) bpf$BPF_MAP_CONST_STR_FREEZE(0x16, &(0x7f00000006c0)={0xffffffffffffffff, 0xffffffffffffffff}, 0x4) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000780)={{0x1, 0xffffffffffffffff}, &(0x7f0000000700), &(0x7f0000000740)}, 0x20) bpf$TOKEN_CREATE(0x24, &(0x7f0000000280)={0x0, r0}, 0x8) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000380)=@bpf_tracing={0x1a, 0x15, &(0x7f0000000500)=@ringbuf={{0x18, 0x0, 0x0, 0x0, 0x1ab, 0x0, 0x0, 0x0, 0x7f}, {}, {}, [@ringbuf_query={{0x18, 0x1, 0x1, 0x0, r1}}, @map_idx={0x18, 0x4, 0x5, 0x0, 0x2}], {{}, {0x7, 0x0, 0xb, 0x2, 0x0, 0x0, 0x2}, {0x85, 0x0, 0x0, 0x84}}}, &(0x7f00000005c0)='syzkaller\x00', 0x400, 0x0, 0x0, 0x41100, 0x44, '\x00', 0x0, 0x19, r2, 0x8, &(0x7f0000000640)={0x6, 0x5}, 0x8, 0x10, &(0x7f0000000680)={0x0, 0x1, 0xb37, 0x6}, 0x10, 0x10a1d, 0xffffffffffffffff, 0x0, &(0x7f00000007c0)=[r3, r4], 0x0, 0x10, 0x3}, 0x94) bind$bt_hci(0xffffffffffffffff, &(0x7f00000000c0)={0x1f, 0xffffffffffffffff, 0x3}, 0x6) bpf$PROG_LOAD(0x5, &(0x7f0000000a40)={0x11, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="180000000000000000000000000001b518110000", @ANYRES32, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], 0x0, 0x4, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, @fallback=0x4, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x40000}, 0x94) r5 = bpf$PROG_LOAD(0x5, &(0x7f0000000800)={0x6, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, @fallback=0x26, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000000)={r5, 0x2000000, 0xe, 0x0, &(0x7f00000004c0)="630b008646dc3f0adf33c9f7b986", 0x0, 0x81ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x2}, 0x38) kernel console output (not intermixed with test programs): 0 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 758.493114][T25993] RSP: 002b:00007fadbb7b7028 EFLAGS: 00000246 ORIG_RAX: 000000000000012b [ 758.493134][T25993] RAX: ffffffffffffffda RBX: 00007fadbac25fa0 RCX: 00007fadba99e159 [ 758.493150][T25993] RDX: 0000000000000414 RSI: 0000200000000840 RDI: 0000000000000003 [ 758.493163][T25993] RBP: 00007fadbb7b7090 R08: 0000000000000000 R09: 0000000000000000 [ 758.493176][T25993] R10: 0000000000000406 R11: 0000000000000246 R12: 0000000000000002 [ 758.493189][T25993] R13: 00007fadbac26038 R14: 00007fadbac25fa0 R15: 00007fff51e07f38 [ 758.493221][T25993] [ 758.780203][T25984] tun0: tun_chr_ioctl cmd 1074025677 [ 758.780321][T25984] tun0: linktype set to 776 [ 759.015460][T26001] __nla_validate_parse: 1 callbacks suppressed [ 759.015485][T26001] netlink: 28 bytes leftover after parsing attributes in process `syz.4.5028'. [ 759.045220][T25999] bridge0: port 4(veth0) entered blocking state [ 759.045332][T25999] bridge0: port 4(veth0) entered disabled state [ 759.045526][T25999] veth0: entered allmulticast mode [ 759.133725][T25999] veth0: entered promiscuous mode [ 759.159543][T25999] bridge0: port 4(veth0) entered blocking state [ 759.159748][T25999] bridge0: port 4(veth0) entered forwarding state [ 759.712938][T26025] Unknown options in mask 6 [ 759.715555][T26025] netlink: 28 bytes leftover after parsing attributes in process `syz.3.5030'. [ 759.715595][T26025] netlink: 36 bytes leftover after parsing attributes in process `syz.3.5030'. [ 759.764202][T26025] netlink: 'syz.3.5030': attribute type 1 has an invalid length. [ 759.764260][T26025] netlink: 224 bytes leftover after parsing attributes in process `syz.3.5030'. [ 761.661779][T26081] netlink: 12 bytes leftover after parsing attributes in process `syz.4.5046'. [ 762.054129][T26086] netlink: 16 bytes leftover after parsing attributes in process `syz.0.5048'. [ 762.445913][T26094] bond7: ARP target 9.0.0.0 is already present [ 762.445946][T26094] bond7: option arp_ip_target: invalid value (9) [ 762.461288][T26094] bond7 (unregistering): Released all slaves [ 762.580927][T26097] xt_TPROXY: Can be used only with -p tcp or -p udp [ 764.084148][T26061] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 764.388274][T26104] mac80211_hwsim hwsim29 ..ãc¤±: renamed from wlan1 (while UP) [ 764.423564][T26104] netlink: 12 bytes leftover after parsing attributes in process `syz.1.5054'. [ 764.452135][T26104] x_tables: duplicate entry at hook 3 [ 764.475073][T26104] x_tables: duplicate entry at hook 3 [ 764.498565][T26118] trusted_key: syz.3.5058 sent an empty control message without MSG_MORE. [ 764.502867][T26115] netlink: 8 bytes leftover after parsing attributes in process `syz.5.5057'. [ 764.713855][T26121] block nbd8: shutting down sockets [ 764.805374][T26125] block nbd9: shutting down sockets [ 766.065124][T26172] netlink: 92 bytes leftover after parsing attributes in process `syz.4.5071'. [ 766.079079][T26172] netlink: 8 bytes leftover after parsing attributes in process `syz.4.5071'. [ 766.419877][T26191] xt_cgroup: invalid path, errno=-2 [ 766.506624][T26199] netlink: 'syz.5.5078': attribute type 4 has an invalid length. [ 766.951731][T26206] netlink: 56 bytes leftover after parsing attributes in process `syz.4.5079'. [ 767.058769][T26204] netlink: 'syz.4.5079': attribute type 1 has an invalid length. [ 767.114486][T26206] netlink: 8 bytes leftover after parsing attributes in process `syz.4.5079'. [ 767.114554][T26206] netlink: 20 bytes leftover after parsing attributes in process `syz.4.5079'. [ 767.800137][T26232] 8021q: adding VLAN 0 to HW filter on device macvlan2 [ 767.811144][T26232] team0: Device macvlan2 is up. Set it down before adding it as a team port [ 768.976377][T26262] netlink: 4 bytes leftover after parsing attributes in process `syz.4.5090'. [ 769.319938][T26270] syz.5.5093: vmalloc error: size 8589938688, exceeds total pages, mode:0x400dc0(GFP_KERNEL_ACCOUNT|__GFP_ZERO), nodemask=(null),cpuset=/,mems_allowed=0-1 [ 769.320068][T26270] CPU: 1 UID: 0 PID: 26270 Comm: syz.5.5093 Not tainted syzkaller #0 PREEMPT(full) [ 769.320095][T26270] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 769.320108][T26270] Call Trace: [ 769.320118][T26270] [ 769.320128][T26270] dump_stack_lvl+0xe8/0x150 [ 769.320167][T26270] warn_alloc+0x24d/0x270 [ 769.320191][T26270] ? kasan_save_track+0x4f/0x80 [ 769.320214][T26270] ? kasan_save_track+0x3e/0x80 [ 769.320239][T26270] ? __pfx_warn_alloc+0x10/0x10 [ 769.320257][T26270] ? __x64_sys_setsockopt+0x13d/0x1b0 [ 769.320286][T26270] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 769.320325][T26270] __vmalloc_node_range_noprof+0x127/0x1540 [ 769.320376][T26270] ? rcu_is_watching+0x16/0xb0 [ 769.320404][T26270] ? __pfx___vmalloc_node_range_noprof+0x10/0x10 [ 769.320432][T26270] ? __kmalloc_cache_noprof+0x321/0x600 [ 769.320451][T26270] ? __kmalloc_cache_noprof+0x14d/0x600 [ 769.320468][T26270] ? xskq_create+0x56/0x220 [ 769.320495][T26270] xskq_create+0x148/0x220 [ 769.320514][T26270] ? xsk_init_queue+0x8a/0xe0 [ 769.320546][T26270] xsk_init_queue+0x8a/0xe0 [ 769.320579][T26270] xsk_setsockopt+0x52a/0x960 [ 769.320612][T26270] ? __pfx_xsk_setsockopt+0x10/0x10 [ 769.320653][T26270] ? __pfx_aa_sk_perm+0x10/0x10 [ 769.320688][T26270] ? bpf_lsm_socket_setsockopt+0x9/0x20 [ 769.320717][T26270] ? __pfx_xsk_setsockopt+0x10/0x10 [ 769.320749][T26270] do_sock_setsockopt+0x17c/0x1b0 [ 769.320780][T26270] __x64_sys_setsockopt+0x13d/0x1b0 [ 769.320811][T26270] do_syscall_64+0x166/0x520 [ 769.320834][T26270] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 769.320855][T26270] ? clear_bhb_loop+0x70/0xc0 [ 769.320880][T26270] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 769.320901][T26270] RIP: 0033:0x7f9ed1d9e159 [ 769.320921][T26270] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 769.320939][T26270] RSP: 002b:00007f9ed2ce5028 EFLAGS: 00000246 ORIG_RAX: 0000000000000036 [ 769.320961][T26270] RAX: ffffffffffffffda RBX: 00007f9ed2025fa0 RCX: 00007f9ed1d9e159 [ 769.320977][T26270] RDX: 0000000000000006 RSI: 000000000000011b RDI: 0000000000000005 [ 769.320991][T26270] RBP: 00007f9ed1e3503b R08: 0000000000000004 R09: 0000000000000000 [ 769.321005][T26270] R10: 0000200000000000 R11: 0000000000000246 R12: 0000000000000000 [ 769.321019][T26270] R13: 00007f9ed2026038 R14: 00007f9ed2025fa0 R15: 00007ffee6347f18 [ 769.321054][T26270] [ 769.321341][T26270] Mem-Info: [ 769.321373][T26270] active_anon:10893 inactive_anon:0 isolated_anon:0 [ 769.321373][T26270] active_file:0 inactive_file:43949 isolated_file:0 [ 769.321373][T26270] unevictable:0 dirty:296 writeback:0 [ 769.321373][T26270] slab_reclaimable:11934 slab_unreclaimable:122563 [ 769.321373][T26270] mapped:35583 shmem:3035 pagetables:1493 [ 769.321373][T26270] sec_pagetables:0 bounce:0 [ 769.321373][T26270] kernel_misc_reclaimable:0 [ 769.321373][T26270] free:1245825 free_pcp:8121 free_cma:0 [ 769.321446][T26270] Node 0 active_anon:43572kB inactive_anon:0kB active_file:0kB inactive_file:175588kB unevictable:0kB isolated(anon):0kB isolated(file):0kB mapped:142332kB dirty:1184kB writeback:0kB shmem:12140kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB kernel_stack:16684kB pagetables:5880kB sec_pagetables:0kB all_unreclaimable? no Balloon:0kB gpu_active:0kB gpu_reclaim:0kB [ 769.321533][T26270] Node 1 active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:208kB unevictable:0kB isolated(anon):0kB isolated(file):0kB mapped:0kB dirty:0kB writeback:0kB shmem:0kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB kernel_stack:32kB pagetables:92kB sec_pagetables:0kB all_unreclaimable? no Balloon:0kB gpu_active:0kB gpu_reclaim:0kB [ 769.321608][T26270] Node 0 DMA free:15360kB boost:0kB min:208kB low:260kB high:312kB reserved_highatomic:0kB free_highatomic:0kB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB zspages:0kB present:15992kB managed:15360kB mlocked:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB [ 769.321730][T26270] lowmem_reserve[]: 0 2486 2486 2486 2486 [ 769.321802][T26270] Node 0 DMA32 free:1033100kB boost:0kB min:34140kB low:42672kB high:51204kB reserved_highatomic:0kB free_highatomic:0kB active_anon:43572kB inactive_anon:0kB active_file:0kB inactive_file:175588kB unevictable:0kB writepending:1184kB zspages:0kB present:3129332kB managed:2546620kB mlocked:0kB bounce:0kB free_pcp:32484kB local_pcp:15400kB free_cma:0kB [ 769.321893][T26270] lowmem_reserve[]: 0 0 0 0 0 [ 769.321958][T26270] Node 0 Normal free:0kB boost:0kB min:0kB low:0kB high:0kB reserved_highatomic:0kB free_highatomic:0kB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB zspages:0kB present:1048580kB managed:0kB mlocked:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB [ 769.322030][T26270] lowmem_reserve[]: 0 0 0 0 0 [ 769.322099][T26270] Node 1 Normal free:3934840kB boost:0kB min:55760kB low:69700kB high:83640kB reserved_highatomic:0kB free_highatomic:0kB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:208kB unevictable:0kB writepending:0kB zspages:0kB present:4194300kB managed:4111104kB mlocked:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB [ 769.322194][T26270] lowmem_reserve[]: 0 0 0 0 0 [ 769.322263][T26270] Node 0 DMA: 0*4kB 0*8kB 0*16kB 0*32kB 0*64kB 0*128kB 0*256kB 0*512kB 1*1024kB (U) 1*2048kB (M) 3*4096kB (M) = 15360kB [ 769.322747][T26270] Node 0 DMA32: 1102*4kB (UE) 459*8kB (UE) 217*16kB (UME) 793*32kB (UME) 969*64kB (UME) 256*128kB (UME) 83*256kB (UME) 15*512kB (UME) 12*1024kB (UM) 10*2048kB (UME) 205*4096kB (UM) = 1033088kB [ 769.323107][T26270] Node 0 Normal: 0*4kB 0*8kB 0*16kB 0*32kB 0*64kB 0*128kB 0*256kB 0*512kB 0*1024kB 0*2048kB 0*4096kB = 0kB [ 769.323337][T26270] Node 1 Normal: 4*4kB (UM) 13*8kB (UM) 12*16kB (UM) 2*32kB (UM) 4*64kB (UM) 6*128kB (UM) 3*256kB (UM) 3*512kB (UM) 1*1024kB (M) 1*2048kB (U) 959*4096kB (M) = 3934840kB [ 769.325073][T26270] Node 0 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 769.325110][T26270] Node 0 hugepages_total=2 hugepages_free=2 hugepages_surp=0 hugepages_size=2048kB [ 769.325143][T26270] Node 1 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 769.325178][T26270] Node 1 hugepages_total=2 hugepages_free=2 hugepages_surp=0 hugepages_size=2048kB [ 769.325212][T26270] 46980 total pagecache pages [ 769.325239][T26270] 0 pages in swap cache [ 769.325246][T26270] Free swap = 124996kB [ 769.325271][T26270] Total swap = 124996kB [ 769.325281][T26270] 2097051 pages RAM [ 769.325306][T26270] 0 pages HighMem/MovableOnly [ 769.325314][T26270] 428780 pages reserved [ 769.325338][T26270] 0 pages cma reserved [ 769.517194][T26270] llcp: llcp_sock_recvmsg: Recv datagram failed state 3 -6 0 [ 771.139653][T26292] netlink: 4 bytes leftover after parsing attributes in process `syz.4.5098'. [ 772.035861][T26334] netlink: 4 bytes leftover after parsing attributes in process `syz.3.5108'. [ 772.035953][T26334] team0: left allmulticast mode [ 772.035972][T26334] team_slave_0: left allmulticast mode [ 772.035992][T26334] team_slave_1: left allmulticast mode [ 772.036007][T26334] bridge5: left allmulticast mode [ 772.036319][T26334] team0: left promiscuous mode [ 772.036334][T26334] team_slave_0: left promiscuous mode [ 772.079308][T26334] team_slave_1: left promiscuous mode [ 772.079547][T26334] bridge5: left promiscuous mode [ 772.080461][T26334] bridge0: port 3(team0) entered disabled state [ 772.083554][T26334] bridge_slave_1: left allmulticast mode [ 772.083579][T26334] bridge_slave_1: left promiscuous mode [ 772.083784][T26334] bridge0: port 2(bridge_slave_1) entered disabled state [ 772.087574][T26334] bridge_slave_0: left allmulticast mode [ 772.087597][T26334] bridge_slave_0: left promiscuous mode [ 772.087789][T26334] bridge0: port 1(bridge_slave_0) entered disabled state [ 772.763976][T26346] ip_tables: iptables: counters copy to user failed while replacing table [ 773.086203][T26353] netlink: 4 bytes leftover after parsing attributes in process `syz.1.5114'. [ 773.101697][T26346] lo speed is unknown, defaulting to 1000 [ 773.175824][T26346] lo speed is unknown, defaulting to 1000 [ 773.200854][T26346] lo speed is unknown, defaulting to 1000 [ 773.264485][T26357] netlink: 12 bytes leftover after parsing attributes in process `syz.3.5115'. [ 773.375542][T26363] syzkaller0: entered promiscuous mode [ 773.375565][T26363] syzkaller0: entered allmulticast mode [ 774.489040][T26394] block nbd8: server does not support multiple connections per device. [ 774.489572][T26394] block nbd8: shutting down sockets [ 774.494835][T26391] netlink: 76 bytes leftover after parsing attributes in process `syz.4.5123'. [ 774.523117][T26395] netlink: 20 bytes leftover after parsing attributes in process `syz.1.5125'. [ 774.526732][T26396] netlink: 20 bytes leftover after parsing attributes in process `syz.1.5125'. [ 774.548703][T26395] ip6gre1: entered promiscuous mode [ 774.548724][T26395] ip6gre1: entered allmulticast mode [ 774.563704][T26396] netlink: 'syz.1.5125': attribute type 6 has an invalid length. [ 774.563724][T26396] netlink: 72 bytes leftover after parsing attributes in process `syz.1.5125'. [ 774.564763][T26395] netlink: 'syz.1.5125': attribute type 6 has an invalid length. [ 774.564781][T26395] netlink: 72 bytes leftover after parsing attributes in process `syz.1.5125'. [ 774.579412][T26396] netlink: 8 bytes leftover after parsing attributes in process `syz.1.5125'. [ 775.362801][T26420] syzkaller0: entered promiscuous mode [ 775.362855][T26420] syzkaller0: entered allmulticast mode [ 775.735851][T26434] batman_adv: batadv0: Adding interface: veth0 [ 775.735870][T26434] batman_adv: batadv0: The MTU of interface veth0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 775.736080][T26434] batman_adv: batadv0: Interface activated: veth0 [ 775.756083][T26443] batman_adv: batadv0: Removing interface: ipvlan2 [ 775.795757][T26443] batman_adv: batadv0: Interface deactivated: veth0 [ 775.795778][T26443] batman_adv: batadv0: Removing interface: veth0 [ 775.859613][T26439] netlink: get zone limit has 8 unknown bytes [ 775.922823][T26447] RDS: rds_bind could not find a transport for ::ffff:172.20.20.170, load rds_tcp or rds_rdma? [ 775.932751][T26440] lo speed is unknown, defaulting to 1000 [ 775.990392][T26440] lo speed is unknown, defaulting to 1000 [ 776.014771][T26440] lo speed is unknown, defaulting to 1000 [ 776.331948][ T6752] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 776.419480][T26462] __nla_validate_parse: 9 callbacks suppressed [ 776.419503][T26462] netlink: 16 bytes leftover after parsing attributes in process `syz.0.5141'. [ 776.476298][T26462] bond8: option broadcast_neighbor: mode dependency failed, not supported in mode balance-rr(0) [ 776.489594][T26462] bond8 (unregistering): Released all slaves [ 776.808391][T26470] ip_tables: iptables: counters copy to user failed while replacing table [ 776.892646][ T6752] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 776.923968][T26472] sctp: [Deprecated]: syz.3.5143 (pid 26472) Use of int in max_burst socket option deprecated. [ 776.923968][T26472] Use struct sctp_assoc_value instead [ 776.967051][T14807] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 777.491966][T26502] macvtap0: left promiscuous mode [ 777.502804][T26502] A link change request failed with some changes committed already. Interface wlan0 may have been left with an inconsistent configuration, please check. [ 777.608326][T26381] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 777.889976][T26512] syzkaller0: entered promiscuous mode [ 777.890001][T26512] syzkaller0: entered allmulticast mode [ 778.021627][T26506] bond9: option tlb_dynamic_lb: mode dependency failed, not supported in mode balance-rr(0) [ 778.041454][T26506] bond9 (unregistering): Released all slaves [ 778.045795][T26525] openvswitch: netlink: Multiple metadata blocks provided [ 778.125625][T26507] netlink: 16178 bytes leftover after parsing attributes in process `syz.3.5150'. [ 778.260679][ T55] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 778.346995][T26536] netlink: 8 bytes leftover after parsing attributes in process `syz.5.5156'. [ 778.347038][T26536] netlink: 4 bytes leftover after parsing attributes in process `syz.5.5156'. [ 778.738419][T26545] netlink: 12 bytes leftover after parsing attributes in process `syz.1.5159'. [ 778.898705][ T55] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 778.899886][T14807] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 778.900832][ T10] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 779.125036][T26558] nbd: couldn't find device at index 167837696 [ 781.450773][ T6745] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 782.087833][T26381] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 782.128033][T26535] workqueue: Failed to create a rescuer kthread for wq "bond7": -EINTR [ 782.146648][T26545] workqueue: Failed to create a rescuer kthread for wq "bond7": -EINTR [ 782.573654][T26579] syzkaller0: entered promiscuous mode [ 782.573876][T26579] syzkaller0: entered allmulticast mode [ 782.586845][T26581] 0: reclassify loop, rule prio 0, protocol 800 [ 782.590279][T26583] 0: reclassify loop, rule prio 0, protocol 800 [ 782.620411][T26586] openvswitch: netlink: VXLAN extension 129 out of range max 1 [ 782.631062][T26586] netlink: 'syz.4.5169': attribute type 11 has an invalid length. [ 782.685546][T26574] xt_CT: No such helper "snmp_trap" [ 783.050391][T26591] 8021q: VLANs not supported on ip6_vti0 [ 783.341133][T26600] netlink: 56 bytes leftover after parsing attributes in process `syz.3.5175'. [ 783.378587][ T6693] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 783.572723][T26608] bond0: up delay (5) is not a multiple of miimon (4), value rounded to 4 ms [ 783.956852][T26624] netlink: 92 bytes leftover after parsing attributes in process `syz.3.5181'. [ 784.014425][ T55] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 784.151147][T26630] netlink: 'syz.1.5184': attribute type 16 has an invalid length. [ 784.151174][T26630] netlink: 'syz.1.5184': attribute type 17 has an invalid length. [ 784.151202][T26630] lo: entered promiscuous mode [ 784.151218][T26630] lo: entered allmulticast mode [ 784.154854][T26630] tunl0: entered promiscuous mode [ 784.154875][T26630] tunl0: entered allmulticast mode [ 784.155580][T26630] gre0: entered promiscuous mode [ 784.155598][T26630] gre0: entered allmulticast mode [ 784.186161][T26630] gretap0: entered promiscuous mode [ 784.186183][T26630] gretap0: entered allmulticast mode [ 784.219352][T26630] erspan0: entered promiscuous mode [ 784.219376][T26630] erspan0: entered allmulticast mode [ 784.219933][T26630] ip_vti0: entered promiscuous mode [ 784.219950][T26630] ip_vti0: entered allmulticast mode [ 784.220709][T26630] ip6_vti0: entered promiscuous mode [ 784.220732][T26630] ip6_vti0: entered allmulticast mode [ 784.221274][T26630] sit0: entered promiscuous mode [ 784.221289][T26630] sit0: entered allmulticast mode [ 784.221885][T26630] ip6tnl0: entered promiscuous mode [ 784.221901][T26630] ip6tnl0: entered allmulticast mode [ 784.222384][T26630] ip6gre0: entered promiscuous mode [ 784.222398][T26630] ip6gre0: entered allmulticast mode [ 784.224628][T26630] syz_tun: entered promiscuous mode [ 784.224644][T26630] syz_tun: entered allmulticast mode [ 784.225216][T26630] ip6gretap0: entered promiscuous mode [ 784.277274][T26630] bond0: entered promiscuous mode [ 784.277377][T26630] bond0: entered allmulticast mode [ 784.314596][T26630] dummy0: entered promiscuous mode [ 784.314656][T26630] dummy0: entered allmulticast mode [ 784.328419][T26630] nlmon0: entered promiscuous mode [ 784.328458][T26630] nlmon0: entered allmulticast mode [ 784.343995][T26630] batadv0: entered promiscuous mode [ 784.344051][T26630] batadv0: entered allmulticast mode [ 784.365996][T26630] vxcan0: entered promiscuous mode [ 784.366012][T26630] vxcan0: entered allmulticast mode [ 784.380000][T26630] vxcan1: entered promiscuous mode [ 784.380027][T26630] vxcan1: entered allmulticast mode [ 784.380579][T26630] veth0: entered promiscuous mode [ 784.380589][T26630] veth0: entered allmulticast mode [ 784.405604][T26630] veth1: entered promiscuous mode [ 784.405656][T26630] veth1: entered allmulticast mode [ 784.435668][T26630] wg0: entered promiscuous mode [ 784.435694][T26630] wg0: entered allmulticast mode [ 784.436367][T26630] wg1: entered promiscuous mode [ 784.436390][T26630] wg1: entered allmulticast mode [ 784.462965][T26630] wg2: entered promiscuous mode [ 784.462993][T26630] wg2: entered allmulticast mode [ 784.463715][T26630] veth0_to_bridge: entered promiscuous mode [ 784.463726][T26630] veth0_to_bridge: entered allmulticast mode [ 784.464334][T26630] bridge_slave_0: entered promiscuous mode [ 784.464346][T26630] bridge_slave_0: entered allmulticast mode [ 784.464863][T26630] veth0_to_bond: entered promiscuous mode [ 784.464872][T26630] veth0_to_bond: entered allmulticast mode [ 784.511101][T26630] bond_slave_0: entered promiscuous mode [ 784.511142][T26630] bond_slave_0: entered allmulticast mode [ 784.534040][T26630] veth1_to_bond: entered promiscuous mode [ 784.534068][T26630] veth1_to_bond: entered allmulticast mode [ 784.534707][T26630] bond_slave_1: entered promiscuous mode [ 784.534740][T26630] bond_slave_1: entered allmulticast mode [ 784.535381][T26630] veth1_to_team: entered promiscuous mode [ 784.535398][T26630] veth1_to_team: entered allmulticast mode [ 784.552270][T26630] team_slave_1: entered promiscuous mode [ 784.552308][T26630] team_slave_1: entered allmulticast mode [ 784.564777][T26630] veth0_to_batadv: entered promiscuous mode [ 784.564843][T26630] veth0_to_batadv: entered allmulticast mode [ 784.566228][T26630] batadv_slave_0: entered promiscuous mode [ 784.566261][T26630] batadv_slave_0: entered allmulticast mode [ 784.575164][T26630] veth1_to_batadv: entered promiscuous mode [ 784.575202][T26630] veth1_to_batadv: entered allmulticast mode [ 784.576312][T26630] batadv_slave_1: entered allmulticast mode [ 784.612753][T26630] xfrm0: entered promiscuous mode [ 784.612793][T26630] xfrm0: entered allmulticast mode [ 784.635047][T26630] veth0_to_hsr: entered promiscuous mode [ 784.635101][T26630] veth0_to_hsr: entered allmulticast mode [ 784.652211][ T55] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 784.667234][T26630] hsr_slave_0: entered allmulticast mode [ 784.668052][T26630] veth1_to_hsr: entered promiscuous mode [ 784.668070][T26630] veth1_to_hsr: entered allmulticast mode [ 784.669167][T26630] hsr_slave_1: entered allmulticast mode [ 784.669863][T26630] hsr0: entered promiscuous mode [ 784.669881][T26630] hsr0: entered allmulticast mode [ 784.670850][T26630] veth1_macvtap: entered allmulticast mode [ 784.671538][T26630] veth0_macvtap: entered allmulticast mode [ 784.672180][T26630] macvtap0: entered promiscuous mode [ 784.672334][T26630] macvtap0: entered allmulticast mode [ 784.673093][T26630] macsec0: entered promiscuous mode [ 784.673255][T26630] macsec0: entered allmulticast mode [ 784.673900][T26630] geneve0: entered promiscuous mode [ 784.673916][T26630] geneve0: entered allmulticast mode [ 784.674479][T26630] geneve1: entered promiscuous mode [ 784.674495][T26630] geneve1: entered allmulticast mode [ 784.676200][T26630] netdevsim netdevsim1 netdevsim0: entered promiscuous mode [ 784.676221][T26630] netdevsim netdevsim1 netdevsim0: entered allmulticast mode [ 784.680195][ T943] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 784.710045][T26630] netdevsim netdevsim1 netdevsim1: entered promiscuous mode [ 784.710090][T26630] netdevsim netdevsim1 netdevsim1: entered allmulticast mode [ 784.726048][T26630] netdevsim netdevsim1 netdevsim2: entered promiscuous mode [ 784.726106][T26630] netdevsim netdevsim1 netdevsim2: entered allmulticast mode [ 784.743284][T26630] mac80211_hwsim hwsim28 wlan0: entered promiscuous mode [ 784.743343][T26630] mac80211_hwsim hwsim28 wlan0: entered allmulticast mode [ 784.743377][T26630] A link change request failed with some changes committed already. Interface wlan0 may have been left with an inconsistent configuration, please check. [ 784.766011][T26640] netlink: 36 bytes leftover after parsing attributes in process `syz.0.5185'. [ 784.807733][T26639] netlink: 8 bytes leftover after parsing attributes in process `syz.0.5185'. [ 784.823231][T26643] netlink: 20 bytes leftover after parsing attributes in process `syz.0.5185'. [ 784.823491][T26640] netlink: 20 bytes leftover after parsing attributes in process `syz.0.5185'. [ 784.900002][ T10] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 785.316607][T26660] netlink: 8 bytes leftover after parsing attributes in process `syz.1.5188'. [ 785.316929][T26660] netlink: 24 bytes leftover after parsing attributes in process `syz.1.5188'. [ 785.389054][T26650] gretap0: entered promiscuous mode [ 785.391089][T26641] netlink: 'syz.4.5186': attribute type 10 has an invalid length. [ 785.710716][T26665] netlink: 199836 bytes leftover after parsing attributes in process `syz.3.5191'. [ 785.805042][T26685] netlink: 4 bytes leftover after parsing attributes in process `syz.5.5193'. [ 786.436984][T26701] FAULT_INJECTION: forcing a failure. [ 786.436984][T26701] name fail_page_alloc, interval 1, probability 0, space 0, times 0 [ 786.437023][T26701] CPU: 0 UID: 0 PID: 26701 Comm: syz.5.5199 Not tainted syzkaller #0 PREEMPT(full) [ 786.437045][T26701] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 786.437059][T26701] Call Trace: [ 786.437069][T26701] [ 786.437078][T26701] dump_stack_lvl+0xe8/0x150 [ 786.437128][T26701] should_fail_ex+0x410/0x560 [ 786.437159][T26701] prepare_alloc_pages+0x223/0x600 [ 786.437195][T26701] __alloc_frozen_pages_noprof+0x185/0x5a0 [ 786.437221][T26701] ? __pfx___alloc_frozen_pages_noprof+0x10/0x10 [ 786.437242][T26701] ? __alloc_frozen_pages_noprof+0x29e/0x5a0 [ 786.437267][T26701] ? __pfx___alloc_frozen_pages_noprof+0x10/0x10 [ 786.437294][T26701] ? __pfx_policy_nodemask+0x10/0x10 [ 786.437319][T26701] ? __get_vm_area_node+0x155/0x2f0 [ 786.437346][T26701] ? __vmalloc_node_range_noprof+0x343/0x1540 [ 786.437373][T26701] ? __vmalloc_noprof+0xd2/0x120 [ 786.437403][T26701] __alloc_pages_noprof+0x10/0x100 [ 786.437426][T26701] alloc_pages_bulk_noprof+0x5fa/0x7c0 [ 786.437455][T26701] ? alloc_pages_noprof+0x140/0x2b0 [ 786.437484][T26701] __kasan_populate_vmalloc+0xb7/0x1c0 [ 786.437511][T26701] alloc_vmap_area+0xd1a/0x1420 [ 786.437554][T26701] ? __pfx_alloc_vmap_area+0x10/0x10 [ 786.437579][T26701] ? __kmalloc_cache_node_noprof+0x3d1/0x620 [ 786.437600][T26701] ? __kmalloc_cache_node_noprof+0x1f7/0x620 [ 786.437619][T26701] ? __get_vm_area_node+0x155/0x2f0 [ 786.437650][T26701] __get_vm_area_node+0x200/0x2f0 [ 786.437683][T26701] __vmalloc_node_range_noprof+0x343/0x1540 [ 786.437712][T26701] ? bpf_check+0x10ee/0x2e10 [ 786.437747][T26701] ? lruvec_stat_mod_folio+0x6e/0x3e0 [ 786.437778][T26701] ? lruvec_stat_mod_folio+0x6e/0x3e0 [ 786.437816][T26701] ? __pfx___vmalloc_node_range_noprof+0x10/0x10 [ 786.437846][T26701] ? apparmor_capable+0x126/0x170 [ 786.437877][T26701] ? bpf_lsm_capable+0x9/0x20 [ 786.437895][T26701] ? security_capable+0x7e/0x2c0 [ 786.437920][T26701] ? bpf_check+0x10ee/0x2e10 [ 786.437938][T26701] __vmalloc_noprof+0xd2/0x120 [ 786.437966][T26701] ? bpf_check+0x10ee/0x2e10 [ 786.437989][T26701] bpf_check+0x10ee/0x2e10 [ 786.438021][T26701] ? ktime_get_with_offset+0x93/0x2d0 [ 786.438047][T26701] ? __pfx_bpf_check+0x10/0x10 [ 786.438071][T26701] ? bpf_obj_name_cpy+0x194/0x1e0 [ 786.438105][T26701] bpf_prog_load+0x14d6/0x1c20 [ 786.438141][T26701] ? __pfx_bpf_prog_load+0x10/0x10 [ 786.438195][T26701] __sys_bpf+0xd0d/0xd90 [ 786.438225][T26701] ? __pfx___sys_bpf+0x10/0x10 [ 786.438257][T26701] ? __fget_files+0x2a/0x420 [ 786.438303][T26701] ? ksys_write+0x242/0x270 [ 786.438335][T26701] ? __pfx_ksys_write+0x10/0x10 [ 786.438368][T26701] __x64_sys_bpf+0xba/0xd0 [ 786.438392][T26701] do_syscall_64+0x166/0x520 [ 786.438436][T26701] ? trace_irq_disable+0x3b/0x140 [ 786.438456][T26701] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 786.438477][T26701] ? clear_bhb_loop+0x70/0xc0 [ 786.438500][T26701] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 786.438519][T26701] RIP: 0033:0x7f9ed1d9e159 [ 786.438539][T26701] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 786.438555][T26701] RSP: 002b:00007f9ed2ce5028 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 786.438578][T26701] RAX: ffffffffffffffda RBX: 00007f9ed2025fa0 RCX: 00007f9ed1d9e159 [ 786.438593][T26701] RDX: 0000000000000070 RSI: 00002000000000c0 RDI: 0000000000000005 [ 786.438606][T26701] RBP: 00007f9ed2ce5090 R08: 0000000000000000 R09: 0000000000000000 [ 786.438619][T26701] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 786.438632][T26701] R13: 00007f9ed2026038 R14: 00007f9ed2025fa0 R15: 00007ffee6347f18 [ 786.438663][T26701] [ 786.488230][T26701] syz.5.5199: vmalloc error: size 544, align 0x1, vm_struct allocation failed, mode:0x400dc0(GFP_KERNEL_ACCOUNT|__GFP_ZERO), nodemask=(null),cpuset=/,mems_allowed=0-1 [ 786.488338][T26701] CPU: 1 UID: 0 PID: 26701 Comm: syz.5.5199 Not tainted syzkaller #0 PREEMPT(full) [ 786.488358][T26701] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 786.488370][T26701] Call Trace: [ 786.488377][T26701] [ 786.488385][T26701] dump_stack_lvl+0xe8/0x150 [ 786.488418][T26701] warn_alloc+0x24d/0x270 [ 786.488440][T26701] ? lockdep_hardirqs_on+0x7b/0x110 [ 786.488466][T26701] ? __pfx_warn_alloc+0x10/0x10 [ 786.488484][T26701] ? kfree+0x1c5/0x650 [ 786.488515][T26701] ? __get_vm_area_node+0x219/0x2f0 [ 786.488550][T26701] __vmalloc_node_range_noprof+0x36b/0x1540 [ 786.488587][T26701] ? lruvec_stat_mod_folio+0x6e/0x3e0 [ 786.488614][T26701] ? lruvec_stat_mod_folio+0x6e/0x3e0 [ 786.488648][T26701] ? __pfx___vmalloc_node_range_noprof+0x10/0x10 [ 786.488683][T26701] ? apparmor_capable+0x126/0x170 [ 786.488710][T26701] ? bpf_lsm_capable+0x9/0x20 [ 786.488726][T26701] ? security_capable+0x7e/0x2c0 [ 786.488748][T26701] ? bpf_check+0x10ee/0x2e10 [ 786.488767][T26701] __vmalloc_noprof+0xd2/0x120 [ 786.488792][T26701] ? bpf_check+0x10ee/0x2e10 [ 786.488814][T26701] bpf_check+0x10ee/0x2e10 [ 786.488842][T26701] ? ktime_get_with_offset+0x93/0x2d0 [ 786.488865][T26701] ? __pfx_bpf_check+0x10/0x10 [ 786.488889][T26701] ? bpf_obj_name_cpy+0x194/0x1e0 [ 786.488919][T26701] bpf_prog_load+0x14d6/0x1c20 [ 786.488954][T26701] ? __pfx_bpf_prog_load+0x10/0x10 [ 786.489000][T26701] __sys_bpf+0xd0d/0xd90 [ 786.489031][T26701] ? __pfx___sys_bpf+0x10/0x10 [ 786.489066][T26701] ? __fget_files+0x2a/0x420 [ 786.489112][T26701] ? ksys_write+0x242/0x270 [ 786.489145][T26701] ? __pfx_ksys_write+0x10/0x10 [ 786.489178][T26701] __x64_sys_bpf+0xba/0xd0 [ 786.489202][T26701] do_syscall_64+0x166/0x520 [ 786.489224][T26701] ? trace_irq_disable+0x3b/0x140 [ 786.489245][T26701] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 786.489266][T26701] ? clear_bhb_loop+0x70/0xc0 [ 786.489292][T26701] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 786.489313][T26701] RIP: 0033:0x7f9ed1d9e159 [ 786.489333][T26701] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 786.489351][T26701] RSP: 002b:00007f9ed2ce5028 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 786.489373][T26701] RAX: ffffffffffffffda RBX: 00007f9ed2025fa0 RCX: 00007f9ed1d9e159 [ 786.489388][T26701] RDX: 0000000000000070 RSI: 00002000000000c0 RDI: 0000000000000005 [ 786.489401][T26701] RBP: 00007f9ed2ce5090 R08: 0000000000000000 R09: 0000000000000000 [ 786.489414][T26701] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 786.489427][T26701] R13: 00007f9ed2026038 R14: 00007f9ed2025fa0 R15: 00007ffee6347f18 [ 786.489460][T26701] [ 786.492486][T26701] Mem-Info: [ 786.492516][T26701] active_anon:8320 inactive_anon:0 isolated_anon:0 [ 786.492516][T26701] active_file:0 inactive_file:43955 isolated_file:0 [ 786.492516][T26701] unevictable:0 dirty:126 writeback:0 [ 786.492516][T26701] slab_reclaimable:12062 slab_unreclaimable:122414 [ 786.492516][T26701] mapped:29965 shmem:548 pagetables:1406 [ 786.492516][T26701] sec_pagetables:0 bounce:0 [ 786.492516][T26701] kernel_misc_reclaimable:0 [ 786.492516][T26701] free:1248620 free_pcp:8046 free_cma:0 [ 786.493567][T26701] Node 0 active_anon:33280kB inactive_anon:0kB active_file:0kB inactive_file:175612kB unevictable:0kB isolated(anon):0kB isolated(file):0kB mapped:119860kB dirty:504kB writeback:0kB shmem:2192kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB kernel_stack:16416kB pagetables:5532kB sec_pagetables:0kB all_unreclaimable? no Balloon:0kB gpu_active:0kB gpu_reclaim:0kB [ 786.493657][T26701] Node 1 active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:208kB unevictable:0kB isolated(anon):0kB isolated(file):0kB mapped:0kB dirty:0kB writeback:0kB shmem:0kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB kernel_stack:32kB pagetables:92kB sec_pagetables:0kB all_unreclaimable? no Balloon:0kB gpu_active:0kB gpu_reclaim:0kB [ 786.493732][T26701] Node 0 DMA free:15360kB boost:0kB min:208kB low:260kB high:312kB reserved_highatomic:0kB free_highatomic:0kB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB zspages:0kB present:15992kB managed:15360kB mlocked:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB [ 786.493823][T26701] lowmem_reserve[]: 0 2486 2486 2486 2486 [ 786.493891][T26701] Node 0 DMA32 free:1044088kB boost:0kB min:34140kB low:42672kB high:51204kB reserved_highatomic:0kB free_highatomic:0kB active_anon:33280kB inactive_anon:0kB active_file:0kB inactive_file:175612kB unevictable:0kB writepending:504kB zspages:0kB present:3129332kB managed:2546620kB mlocked:0kB bounce:0kB free_pcp:32184kB local_pcp:20236kB free_cma:0kB [ 786.493967][T26701] lowmem_reserve[]: 0 0 0 0 0 [ 786.494031][T26701] Node 0 Normal free:0kB boost:0kB min:0kB low:0kB high:0kB reserved_highatomic:0kB free_highatomic:0kB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB zspages:0kB present:1048580kB managed:0kB mlocked:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB [ 786.494117][T26701] lowmem_reserve[]: 0 0 0 0 0 [ 786.494165][T26701] Node 1 Normal free:3935032kB boost:0kB min:55760kB low:69700kB high:83640kB reserved_highatomic:0kB free_highatomic:0kB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:208kB unevictable:0kB writepending:0kB zspages:0kB present:4194300kB managed:4111104kB mlocked:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB [ 786.494254][T26701] lowmem_reserve[]: 0 0 0 0 0 [ 786.494318][T26701] Node 0 DMA: 0*4kB 0*8kB 0*16kB 0*32kB 0*64kB 0*128kB 0*256kB 0*512kB 1*1024kB (U) 1*2048kB (M) 3*4096kB (M) = 15360kB [ 786.494520][T26701] Node 0 DMA32: 3624*4kB (UME) 1029*8kB (UM) 415*16kB (UM) 608*32kB (UME) 972*64kB (UME) 255*128kB (UME) 83*256kB (UME) 13*512kB (UME) 12*1024kB (UM) 10*2048kB (UME) 205*4096kB (UM) = 1044024kB [ 786.494881][T26701] Node 0 Normal: 0*4kB 0*8kB 0*16kB 0*32kB 0*64kB 0*128kB 0*256kB 0*512kB 0*1024kB 0*2048kB 0*4096kB = 0kB [ 786.495067][T26701] Node 1 Normal: 4*4kB (UM) 13*8kB (UM) 12*16kB (UM) 2*32kB (UM) 5*64kB (UM) 7*128kB (UM) 3*256kB (UM) 3*512kB (UM) 1*1024kB (M) 1*2048kB (U) 959*4096kB (M) = 3935032kB [ 786.495338][T26701] Node 0 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 786.495369][T26701] Node 0 hugepages_total=2 hugepages_free=2 hugepages_surp=0 hugepages_size=2048kB [ 786.495401][T26701] Node 1 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 786.495433][T26701] Node 1 hugepages_total=2 hugepages_free=2 hugepages_surp=0 hugepages_size=2048kB [ 786.495465][T26701] 44499 total pagecache pages [ 786.495474][T26701] 0 pages in swap cache [ 786.495495][T26701] Free swap = 124996kB [ 786.495503][T26701] Total swap = 124996kB [ 786.495527][T26701] 2097051 pages RAM [ 786.495534][T26701] 0 pages HighMem/MovableOnly [ 786.502539][T26701] 428780 pages reserved [ 786.502550][T26701] 0 pages cma reserved [ 787.095985][T26712] netlink: 'syz.5.5201': attribute type 1 has an invalid length. [ 787.208065][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 787.210297][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 787.216286][ T6693] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 787.310493][T26712] Bluetooth: hci0: invalid length 0, exp 2 for type 21 [ 787.819656][T26719] sctp: [Deprecated]: syz.1.5203 (pid 26719) Use of struct sctp_assoc_value in delayed_ack socket option. [ 787.819656][T26719] Use struct sctp_sack_info instead [ 787.852025][ T6745] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 788.490979][ T91] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 788.618460][T26749] netdevsim netdevsim0 netdevsim0: entered allmulticast mode [ 788.764385][T26756] syzkaller0: left promiscuous mode [ 788.764429][T26756] syzkaller0: left allmulticast mode [ 788.790929][T26759] netlink: 68 bytes leftover after parsing attributes in process `syz.3.5216'. [ 789.008909][T26770] bridge0: port 1(bond0) entered blocking state [ 789.010759][T26770] bridge0: port 1(bond0) entered disabled state [ 789.145334][T26770] netlink: 12 bytes leftover after parsing attributes in process `syz.1.5219'. [ 789.254856][T26777] netlink: 16 bytes leftover after parsing attributes in process `syz.0.5220'. [ 789.344027][T26780] FAULT_INJECTION: forcing a failure. [ 789.344027][T26780] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 789.344066][T26780] CPU: 0 UID: 0 PID: 26780 Comm: syz.5.5221 Not tainted syzkaller #0 PREEMPT(full) [ 789.344090][T26780] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 789.344103][T26780] Call Trace: [ 789.344112][T26780] [ 789.344122][T26780] dump_stack_lvl+0xe8/0x150 [ 789.344163][T26780] should_fail_ex+0x410/0x560 [ 789.344194][T26780] _copy_from_user+0x2d/0xb0 [ 789.344222][T26780] ___sys_recvmsg+0x173/0x5a0 [ 789.344260][T26780] ? __pfx____sys_recvmsg+0x10/0x10 [ 789.344292][T26780] ? lock_acquire+0x115/0x350 [ 789.344344][T26780] do_recvmmsg+0x31a/0x7f0 [ 789.344381][T26780] ? __pfx_do_recvmmsg+0x10/0x10 [ 789.344419][T26780] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 789.344450][T26780] ? __fget_files+0x3a2/0x420 [ 789.344492][T26780] __x64_sys_recvmmsg+0x198/0x250 [ 789.344521][T26780] ? __pfx___x64_sys_recvmmsg+0x10/0x10 [ 789.344566][T26780] do_syscall_64+0x166/0x520 [ 789.344587][T26780] ? trace_irq_disable+0x3b/0x140 [ 789.344609][T26780] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 789.344631][T26780] ? clear_bhb_loop+0x70/0xc0 [ 789.344656][T26780] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 789.344677][T26780] RIP: 0033:0x7f9ed1d9e159 [ 789.344698][T26780] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 789.344715][T26780] RSP: 002b:00007f9ed2ce5028 EFLAGS: 00000246 ORIG_RAX: 000000000000012b [ 789.344738][T26780] RAX: ffffffffffffffda RBX: 00007f9ed2025fa0 RCX: 00007f9ed1d9e159 [ 789.344753][T26780] RDX: 0000000000000414 RSI: 0000200000000840 RDI: 0000000000000003 [ 789.344766][T26780] RBP: 00007f9ed2ce5090 R08: 0000000000000000 R09: 0000000000000000 [ 789.344780][T26780] R10: 0000000000000406 R11: 0000000000000246 R12: 0000000000000002 [ 789.344792][T26780] R13: 00007f9ed2026038 R14: 00007f9ed2025fa0 R15: 00007ffee6347f18 [ 789.344824][T26780] [ 789.770593][ T6752] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 789.795954][T26785] netlink: 40 bytes leftover after parsing attributes in process `syz.4.5224'. [ 789.808578][T26785] netlink: 40 bytes leftover after parsing attributes in process `syz.4.5224'. [ 789.811262][T26785] netlink: 'syz.4.5224': attribute type 10 has an invalid length. [ 789.849835][T26785] vxcan0: entered promiscuous mode [ 789.850200][T26785] team0: Device vxcan0 is of different type [ 790.200362][T26792] netlink: 23 bytes leftover after parsing attributes in process `syz.4.5225'. [ 790.225733][T26793] netlink: 'syz.5.5228': attribute type 12 has an invalid length. [ 790.238275][T26795] IPVS: set_ctl: invalid protocol: 163 0.0.0.0:20001 [ 790.239249][T26793] IPVS: set_ctl: invalid protocol: 163 0.0.0.0:20001 [ 790.249262][T26796] netlink: 'syz.1.5227': attribute type 1 has an invalid length. [ 790.311694][T26799] netlink: 52 bytes leftover after parsing attributes in process `syz.1.5227'. [ 790.357386][T26796] 8021q: adding VLAN 0 to HW filter on device bond7 [ 790.510812][T26803] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 790.510846][T26803] IPv6: NLM_F_CREATE should be set when creating new route [ 790.510912][T26803] IPv6: NLM_F_CREATE should be set when creating new route [ 790.807960][T26814] netlink: 324 bytes leftover after parsing attributes in process `syz.5.5232'. [ 790.864759][T26819] netlink: 22 bytes leftover after parsing attributes in process `syz.1.5234'. [ 791.643020][T26818] workqueue: Failed to create a rescuer kthread for wq "nfc10_nci_rx_wq": -EINTR [ 792.248587][T26874] netlink: 8 bytes leftover after parsing attributes in process `syz.1.5239'. [ 792.337763][T26874] syzkaller1: entered promiscuous mode [ 792.337792][T26874] syzkaller1: entered allmulticast mode [ 792.657969][T26894] xt_ipcomp: unknown flags 1D [ 792.956189][T26902] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 792.959626][ C0] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 792.970243][ T6752] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 793.460079][T26888] virtio_blk virtio5: 1/0/0 default/read/poll queues [ 793.477227][T26888] virtio_blk virtio5: [vdb] 262144 512-byte logical blocks (134 MB/128 MiB) [ 793.550634][T26888] vdb: unable to read partition table [ 793.563158][T26889] netlink: 'syz.0.5243': attribute type 10 has an invalid length. [ 793.614668][ T91] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 793.993507][T26912] netlink: 'syz.4.5249': attribute type 11 has an invalid length. [ 794.248944][ T10] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 794.250511][ T6752] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 794.370030][T26930] __nla_validate_parse: 3 callbacks suppressed [ 794.370054][T26930] netlink: 24 bytes leftover after parsing attributes in process `syz.1.5253'. [ 794.629168][T26940] IPVS: nq: FWM 3 0x00000003 - no destination available [ 794.629608][ T6745] IPVS: starting estimator thread 0... [ 794.650721][T26940] xt_physdev: --physdev-out and --physdev-is-out only supported in the FORWARD and POSTROUTING chains with bridged traffic [ 794.731166][T26941] IPVS: using max 32 ests per chain, 76800 per kthread [ 794.799939][T26945] netlink: 32 bytes leftover after parsing attributes in process `syz.5.5258'. [ 794.971545][T26947] netlink: 44 bytes leftover after parsing attributes in process `syz.5.5258'. [ 794.971580][T26947] netlink: 44 bytes leftover after parsing attributes in process `syz.5.5258'. [ 795.031606][T26955] netlink: 4 bytes leftover after parsing attributes in process `syz.0.5261'. [ 795.229096][T26964] netlink: 48 bytes leftover after parsing attributes in process `syz.3.5260'. [ 795.273341][T26945] A link change request failed with some changes committed already. Interface bond0 may have been left with an inconsistent configuration, please check. [ 795.273437][T26952] netlink: 'syz.0.5261': attribute type 12 has an invalid length. [ 795.323771][T26951] A link change request failed with some changes committed already. Interface bond0 may have been left with an inconsistent configuration, please check. [ 795.528570][ T6745] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 795.559551][T26969] FAULT_INJECTION: forcing a failure. [ 795.559551][T26969] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 795.559587][T26969] CPU: 0 UID: 0 PID: 26969 Comm: syz.0.5264 Not tainted syzkaller #0 PREEMPT(full) [ 795.559612][T26969] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 795.559625][T26969] Call Trace: [ 795.559634][T26969] [ 795.559644][T26969] dump_stack_lvl+0xe8/0x150 [ 795.559682][T26969] should_fail_ex+0x410/0x560 [ 795.559712][T26969] _copy_from_user+0x2d/0xb0 [ 795.559741][T26969] ___sys_recvmsg+0x173/0x5a0 [ 795.559777][T26969] ? __pfx____sys_recvmsg+0x10/0x10 [ 795.559810][T26969] ? lock_acquire+0x115/0x350 [ 795.559861][T26969] do_recvmmsg+0x31a/0x7f0 [ 795.559896][T26969] ? __pfx_do_recvmmsg+0x10/0x10 [ 795.559933][T26969] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 795.559960][T26969] ? __fget_files+0x3a2/0x420 [ 795.559999][T26969] __x64_sys_recvmmsg+0x198/0x250 [ 795.560029][T26969] ? __pfx___x64_sys_recvmmsg+0x10/0x10 [ 795.560069][T26969] do_syscall_64+0x166/0x520 [ 795.560091][T26969] ? trace_irq_disable+0x3b/0x140 [ 795.560113][T26969] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 795.560134][T26969] ? clear_bhb_loop+0x70/0xc0 [ 795.560160][T26969] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 795.560179][T26969] RIP: 0033:0x7fa283f9e159 [ 795.560199][T26969] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 795.560217][T26969] RSP: 002b:00007fa284ea5028 EFLAGS: 00000246 ORIG_RAX: 000000000000012b [ 795.560240][T26969] RAX: ffffffffffffffda RBX: 00007fa284225fa0 RCX: 00007fa283f9e159 [ 795.560255][T26969] RDX: 0000000000000414 RSI: 0000200000000840 RDI: 0000000000000003 [ 795.560269][T26969] RBP: 00007fa284ea5090 R08: 0000000000000000 R09: 0000000000000000 [ 795.560281][T26969] R10: 0000000000000406 R11: 0000000000000246 R12: 0000000000000002 [ 795.560294][T26969] R13: 00007fa284226038 R14: 00007fa284225fa0 R15: 00007fff8e0ea3a8 [ 795.560326][T26969] [ 795.593855][T26974] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 795.666671][T26982] netlink: 4 bytes leftover after parsing attributes in process `syz.5.5263'. [ 795.731949][T26972] x_tables: duplicate underflow at hook 2 [ 795.938275][T26988] netlink: 4 bytes leftover after parsing attributes in process `syz.0.5267'. [ 796.779971][T27007] netlink: 32 bytes leftover after parsing attributes in process `syz.0.5274'. [ 796.801945][T27009] netlink: 32 bytes leftover after parsing attributes in process `syz.0.5274'. [ 796.978440][T27019] FAULT_INJECTION: forcing a failure. [ 796.978440][T27019] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 796.978474][T27019] CPU: 0 UID: 0 PID: 27019 Comm: syz.1.5277 Not tainted syzkaller #0 PREEMPT(full) [ 796.978498][T27019] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 796.978510][T27019] Call Trace: [ 796.978518][T27019] [ 796.978527][T27019] dump_stack_lvl+0xe8/0x150 [ 796.978561][T27019] should_fail_ex+0x410/0x560 [ 796.978590][T27019] _copy_from_user+0x2d/0xb0 [ 796.978616][T27019] ___sys_recvmsg+0x173/0x5a0 [ 796.978649][T27019] ? __pfx____sys_recvmsg+0x10/0x10 [ 796.978681][T27019] ? lock_acquire+0x115/0x350 [ 796.978732][T27019] do_recvmmsg+0x31a/0x7f0 [ 796.978767][T27019] ? __pfx_do_recvmmsg+0x10/0x10 [ 796.978814][T27019] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 796.978840][T27019] ? __fget_files+0x3a2/0x420 [ 796.978877][T27019] __x64_sys_recvmmsg+0x198/0x250 [ 796.978905][T27019] ? __pfx___x64_sys_recvmmsg+0x10/0x10 [ 796.978942][T27019] do_syscall_64+0x166/0x520 [ 796.978964][T27019] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 796.978984][T27019] ? clear_bhb_loop+0x70/0xc0 [ 796.979007][T27019] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 796.979026][T27019] RIP: 0033:0x7fadba99e159 [ 796.979045][T27019] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 796.979062][T27019] RSP: 002b:00007fadbb7b7028 EFLAGS: 00000246 ORIG_RAX: 000000000000012b [ 796.979085][T27019] RAX: ffffffffffffffda RBX: 00007fadbac25fa0 RCX: 00007fadba99e159 [ 796.979101][T27019] RDX: 0000000000000414 RSI: 0000200000000840 RDI: 0000000000000003 [ 796.979115][T27019] RBP: 00007fadbb7b7090 R08: 0000000000000000 R09: 0000000000000000 [ 796.979128][T27019] R10: 0000000000000406 R11: 0000000000000246 R12: 0000000000000002 [ 796.979140][T27019] R13: 00007fadbac26038 R14: 00007fadbac25fa0 R15: 00007fff51e07f38 [ 796.979172][T27019] [ 797.363680][T27032] netlink: Conntrack attr type has unexpected length (type=0, length=8, expected=0) [ 797.363722][T27032] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 797.522340][T27028] tipc: Enabled bearer , priority 0 [ 797.581334][T27026] tipc: Disabling bearer [ 798.195955][T27054] netlink: 'syz.5.5288': attribute type 1 has an invalid length. [ 798.515359][T27063] FAULT_INJECTION: forcing a failure. [ 798.515359][T27063] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 798.515425][T27063] CPU: 1 UID: 0 PID: 27063 Comm: syz.4.5291 Not tainted syzkaller #0 PREEMPT(full) [ 798.515451][T27063] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 798.515463][T27063] Call Trace: [ 798.515472][T27063] [ 798.515482][T27063] dump_stack_lvl+0xe8/0x150 [ 798.515517][T27063] should_fail_ex+0x410/0x560 [ 798.515543][T27063] _copy_from_user+0x2d/0xb0 [ 798.515569][T27063] ___sys_recvmsg+0x173/0x5a0 [ 798.515600][T27063] ? __pfx____sys_recvmsg+0x10/0x10 [ 798.515662][T27063] do_recvmmsg+0x31a/0x7f0 [ 798.515696][T27063] ? __pfx_do_recvmmsg+0x10/0x10 [ 798.515734][T27063] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 798.515760][T27063] ? __fget_files+0x3a2/0x420 [ 798.515797][T27063] __x64_sys_recvmmsg+0x198/0x250 [ 798.515827][T27063] ? __pfx___x64_sys_recvmmsg+0x10/0x10 [ 798.515865][T27063] do_syscall_64+0x166/0x520 [ 798.515883][T27063] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 798.515904][T27063] ? clear_bhb_loop+0x70/0xc0 [ 798.515928][T27063] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 798.515948][T27063] RIP: 0033:0x7fec4659e159 [ 798.515968][T27063] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 798.515983][T27063] RSP: 002b:00007fec47399028 EFLAGS: 00000246 ORIG_RAX: 000000000000012b [ 798.516005][T27063] RAX: ffffffffffffffda RBX: 00007fec46826090 RCX: 00007fec4659e159 [ 798.516027][T27063] RDX: 0000000000000414 RSI: 0000200000000840 RDI: 0000000000000003 [ 798.516040][T27063] RBP: 00007fec47399090 R08: 0000000000000000 R09: 0000000000000000 [ 798.516053][T27063] R10: 0000000000000406 R11: 0000000000000246 R12: 0000000000000002 [ 798.516066][T27063] R13: 00007fec46826128 R14: 00007fec46826090 R15: 00007ffcbbcbc628 [ 798.516096][T27063] [ 798.742236][ T91] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 799.073024][T27076] macsec2: entered allmulticast mode [ 799.368659][ T6752] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 799.369540][ T6752] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 799.452950][ T52] block nbd8: Receive control failed (result -32) [ 799.456003][ T5623] block nbd8: Receive control failed (result -32) [ 799.692099][T27082] __nla_validate_parse: 2 callbacks suppressed [ 799.692153][T27082] netlink: 32 bytes leftover after parsing attributes in process `syz.0.5297'. [ 799.767466][T27082] netlink: 12 bytes leftover after parsing attributes in process `syz.0.5297'. [ 800.247833][T27099] netlink: Unknown conntrack attr (0) [ 800.344921][T27101] IPVS: set_ctl: invalid protocol: 135 172.30.1.1:20002 [ 800.355174][T27101] ±: renamed from veth1_virt_wifi [ 800.579516][T27109] netlink: 'syz.0.5307': attribute type 3 has an invalid length. [ 800.651681][ T6745] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 800.845262][T27116] netlink: 4 bytes leftover after parsing attributes in process `syz.1.5308'. [ 800.845662][T27116] netlink: 4 bytes leftover after parsing attributes in process `syz.1.5308'. [ 800.846027][T27116] netlink: 4 bytes leftover after parsing attributes in process `syz.1.5308'. [ 800.846384][T27116] netlink: 4 bytes leftover after parsing attributes in process `syz.1.5308'. [ 800.870421][T27117] netlink: 20 bytes leftover after parsing attributes in process `syz.5.5309'. [ 800.906060][T27116] netlink: 4 bytes leftover after parsing attributes in process `syz.1.5308'. [ 800.906513][T27116] netlink: 4 bytes leftover after parsing attributes in process `syz.1.5308'. [ 800.906902][T27116] netlink: 4 bytes leftover after parsing attributes in process `syz.1.5308'. [ 801.476004][T27143] netlink: 'syz.5.5313': attribute type 1 has an invalid length. [ 801.491356][T27138] netlink: 'syz.5.5313': attribute type 1 has an invalid length. [ 801.722516][T27151] netlink: 'syz.0.5315': attribute type 1 has an invalid length. [ 801.775883][T27151] 8021q: adding VLAN 0 to HW filter on device bond8 [ 802.099148][T27154] bond8: (slave veth9): Enslaving as an active interface with a down link [ 802.155789][T27151] gretap0: left promiscuous mode [ 802.278907][T27151] bridge0: entered promiscuous mode [ 802.281637][T27163] netlink: 'syz.5.5319': attribute type 2 has an invalid length. [ 802.288439][T27151] 8021q: adding VLAN 0 to HW filter on device bond0 [ 802.318798][T27151] 8021q: adding VLAN 0 to HW filter on device team0 [ 802.578826][T27151] batadv_slave_1: entered promiscuous mode [ 802.604228][T27151] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 802.604265][T27151] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 802.638268][T27151] A link change request failed with some changes committed already. Interface virt_wifi0 may have been left with an inconsistent configuration, please check. [ 802.679781][T27157] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 802.685841][T27157] bond8: (slave batadv0): making interface the new active one [ 802.693961][T27157] batadv0: entered promiscuous mode [ 802.701369][T27157] bond8: (slave batadv0): Enslaving as an active interface with an up link [ 802.997146][T27189] batadv0: entered promiscuous mode [ 803.399566][T27198] netlink: zone id is out of range [ 803.399585][T27198] netlink: zone id is out of range [ 803.399594][T27198] netlink: zone id is out of range [ 803.399603][T27198] netlink: zone id is out of range [ 803.592274][T27212] netlink: 'syz.4.5328': attribute type 10 has an invalid length. [ 803.717634][T27212] geneve3: entered promiscuous mode [ 803.717672][T27212] geneve3: entered allmulticast mode [ 803.822851][T27222] FAULT_INJECTION: forcing a failure. [ 803.822851][T27222] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 803.822891][T27222] CPU: 0 UID: 0 PID: 27222 Comm: syz.0.5331 Not tainted syzkaller #0 PREEMPT(full) [ 803.822914][T27222] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 803.822926][T27222] Call Trace: [ 803.822935][T27222] [ 803.822945][T27222] dump_stack_lvl+0xe8/0x150 [ 803.822982][T27222] should_fail_ex+0x410/0x560 [ 803.823012][T27222] _copy_from_user+0x2d/0xb0 [ 803.823039][T27222] ___sys_recvmsg+0x173/0x5a0 [ 803.823076][T27222] ? __pfx____sys_recvmsg+0x10/0x10 [ 803.823109][T27222] ? lock_acquire+0x115/0x350 [ 803.823158][T27222] do_recvmmsg+0x31a/0x7f0 [ 803.823193][T27222] ? __pfx_do_recvmmsg+0x10/0x10 [ 803.823240][T27222] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 803.823266][T27222] ? __fget_files+0x3a2/0x420 [ 803.823306][T27222] __x64_sys_recvmmsg+0x198/0x250 [ 803.823336][T27222] ? __pfx___x64_sys_recvmmsg+0x10/0x10 [ 803.823374][T27222] do_syscall_64+0x166/0x520 [ 803.823396][T27222] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 803.823416][T27222] ? clear_bhb_loop+0x70/0xc0 [ 803.823443][T27222] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 803.823464][T27222] RIP: 0033:0x7fa283f9e159 [ 803.823484][T27222] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 803.823502][T27222] RSP: 002b:00007fa284ea5028 EFLAGS: 00000246 ORIG_RAX: 000000000000012b [ 803.823525][T27222] RAX: ffffffffffffffda RBX: 00007fa284225fa0 RCX: 00007fa283f9e159 [ 803.823540][T27222] RDX: 0000000000000414 RSI: 0000200000000840 RDI: 0000000000000003 [ 803.823554][T27222] RBP: 00007fa284ea5090 R08: 0000000000000000 R09: 0000000000000000 [ 803.823568][T27222] R10: 0000000000000406 R11: 0000000000000246 R12: 0000000000000002 [ 803.823580][T27222] R13: 00007fa284226038 R14: 00007fa284225fa0 R15: 00007fff8e0ea3a8 [ 803.823613][T27222] [ 803.866228][ T5756] net_ratelimit: 7 callbacks suppressed [ 803.866249][ T5756] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 804.407185][T27237] IPVS: Unknown mcast interface: vcan0 [ 804.489076][ T6693] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 804.489926][ T6693] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 804.744102][T27241] __nla_validate_parse: 40 callbacks suppressed [ 804.744149][T27241] netlink: 20 bytes leftover after parsing attributes in process `syz.0.5336'. [ 804.744188][T27241] nbd: socks must be embedded in a SOCK_ITEM attr [ 804.921369][T27247] netlink: 36 bytes leftover after parsing attributes in process `syz.4.5332'. [ 804.921398][T27247] netlink: 16 bytes leftover after parsing attributes in process `syz.4.5332'. [ 804.921416][T27247] netlink: 36 bytes leftover after parsing attributes in process `syz.4.5332'. [ 805.127531][ T91] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 805.131121][T27258] FAULT_INJECTION: forcing a failure. [ 805.131121][T27258] name fail_page_alloc, interval 1, probability 0, space 0, times 0 [ 805.131172][T27258] CPU: 1 UID: 0 PID: 27258 Comm: syz.5.5340 Not tainted syzkaller #0 PREEMPT(full) [ 805.131195][T27258] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 805.131206][T27258] Call Trace: [ 805.131215][T27258] [ 805.131225][T27258] dump_stack_lvl+0xe8/0x150 [ 805.131262][T27258] should_fail_ex+0x410/0x560 [ 805.131291][T27258] prepare_alloc_pages+0x223/0x600 [ 805.131322][T27258] __alloc_frozen_pages_noprof+0x185/0x5a0 [ 805.131347][T27258] ? __pfx___alloc_frozen_pages_noprof+0x10/0x10 [ 805.131373][T27258] ? __pfx_policy_nodemask+0x10/0x10 [ 805.131404][T27258] ? irqentry_exit+0x218/0x910 [ 805.131428][T27258] alloc_pages_mpol+0x21e/0x390 [ 805.131454][T27258] alloc_pages_noprof+0xb1/0x2b0 [ 805.131476][T27258] get_free_pages_noprof+0xf/0x80 [ 805.131494][T27258] __kasan_populate_vmalloc+0x38/0x1c0 [ 805.131513][T27258] ? do_raw_spin_unlock+0xf5/0x200 [ 805.131549][T27258] alloc_vmap_area+0xd1a/0x1420 [ 805.131584][T27258] ? __pfx_alloc_vmap_area+0x10/0x10 [ 805.131604][T27258] ? __kmalloc_cache_node_noprof+0x3d1/0x620 [ 805.131624][T27258] ? __kmalloc_cache_node_noprof+0x1f7/0x620 [ 805.131644][T27258] ? __get_vm_area_node+0x155/0x2f0 [ 805.131672][T27258] __get_vm_area_node+0x200/0x2f0 [ 805.131701][T27258] __vmalloc_node_range_noprof+0x343/0x1540 [ 805.131730][T27258] ? bpf_prog_calc_tag+0x51/0x370 [ 805.131754][T27258] ? __sys_bpf+0xcd1/0xd90 [ 805.131773][T27258] ? __x64_sys_bpf+0xba/0xd0 [ 805.131789][T27258] ? do_syscall_64+0x166/0x520 [ 805.131813][T27258] ? __kasan_kmalloc+0x93/0xb0 [ 805.131835][T27258] ? bpf_prog_load+0x14d6/0x1c20 [ 805.131855][T27258] ? __sys_bpf+0xd0d/0xd90 [ 805.131873][T27258] ? __x64_sys_bpf+0xba/0xd0 [ 805.131903][T27258] ? __pfx___vmalloc_node_range_noprof+0x10/0x10 [ 805.131943][T27258] ? bpf_prog_calc_tag+0x51/0x370 [ 805.131964][T27258] __vmalloc_noprof+0xd2/0x120 [ 805.131992][T27258] ? bpf_prog_calc_tag+0x51/0x370 [ 805.132016][T27258] bpf_prog_calc_tag+0x51/0x370 [ 805.132038][T27258] ? __pfx_cmp_subprogs+0x10/0x10 [ 805.132065][T27258] check_and_resolve_insns+0xbb/0x21d0 [ 805.132090][T27258] ? __pfx_bpf_check_btf_info+0x10/0x10 [ 805.132114][T27258] ? add_subprog+0x2e2/0x3f0 [ 805.132139][T27258] ? __pfx_check_and_resolve_insns+0x10/0x10 [ 805.132172][T27258] bpf_check+0x180a/0x2e10 [ 805.132204][T27258] ? ktime_get_with_offset+0x93/0x2d0 [ 805.132230][T27258] ? __pfx_bpf_check+0x10/0x10 [ 805.132252][T27258] ? bpf_obj_name_cpy+0x194/0x1e0 [ 805.132284][T27258] bpf_prog_load+0x14d6/0x1c20 [ 805.132316][T27258] ? __pfx_bpf_prog_load+0x10/0x10 [ 805.132355][T27258] __sys_bpf+0xd0d/0xd90 [ 805.132383][T27258] ? __pfx___sys_bpf+0x10/0x10 [ 805.132414][T27258] ? __fget_files+0x2a/0x420 [ 805.132455][T27258] ? ksys_write+0x242/0x270 [ 805.132487][T27258] ? __pfx_ksys_write+0x10/0x10 [ 805.132519][T27258] __x64_sys_bpf+0xba/0xd0 [ 805.132553][T27258] do_syscall_64+0x166/0x520 [ 805.132573][T27258] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 805.132593][T27258] ? clear_bhb_loop+0x70/0xc0 [ 805.132616][T27258] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 805.132632][T27258] RIP: 0033:0x7f9ed1d9e159 [ 805.132650][T27258] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 805.132667][T27258] RSP: 002b:00007f9ed2ce5028 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 805.132690][T27258] RAX: ffffffffffffffda RBX: 00007f9ed2025fa0 RCX: 00007f9ed1d9e159 [ 805.132705][T27258] RDX: 0000000000000070 RSI: 00002000000000c0 RDI: 0000000000000005 [ 805.132718][T27258] RBP: 00007f9ed2ce5090 R08: 0000000000000000 R09: 0000000000000000 [ 805.132730][T27258] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 805.132742][T27258] R13: 00007f9ed2026038 R14: 00007f9ed2025fa0 R15: 00007ffee6347f18 [ 805.132773][T27258] [ 805.157805][T27258] syz.5.5340: vmalloc error: size 32, align 0x1, vm_struct allocation failed, mode:0x400cc0(GFP_KERNEL_ACCOUNT), nodemask=(null),cpuset=/,mems_allowed=0-1 [ 805.157929][T27258] CPU: 1 UID: 0 PID: 27258 Comm: syz.5.5340 Not tainted syzkaller #0 PREEMPT(full) [ 805.157954][T27258] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 805.157966][T27258] Call Trace: [ 805.157974][T27258] [ 805.157983][T27258] dump_stack_lvl+0xe8/0x150 [ 805.158018][T27258] warn_alloc+0x24d/0x270 [ 805.158041][T27258] ? lockdep_hardirqs_on+0x7b/0x110 [ 805.158066][T27258] ? __pfx_warn_alloc+0x10/0x10 [ 805.158084][T27258] ? kfree+0x1c5/0x650 [ 805.158118][T27258] ? __get_vm_area_node+0x219/0x2f0 [ 805.158153][T27258] __vmalloc_node_range_noprof+0x36b/0x1540 [ 805.158181][T27258] ? __sys_bpf+0xcd1/0xd90 [ 805.158201][T27258] ? __x64_sys_bpf+0xba/0xd0 [ 805.158217][T27258] ? do_syscall_64+0x166/0x520 [ 805.158243][T27258] ? __kasan_kmalloc+0x93/0xb0 [ 805.158264][T27258] ? bpf_prog_load+0x14d6/0x1c20 [ 805.158284][T27258] ? __sys_bpf+0xd0d/0xd90 [ 805.158302][T27258] ? __x64_sys_bpf+0xba/0xd0 [ 805.158332][T27258] ? __pfx___vmalloc_node_range_noprof+0x10/0x10 [ 805.158369][T27258] ? bpf_prog_calc_tag+0x51/0x370 [ 805.158390][T27258] __vmalloc_noprof+0xd2/0x120 [ 805.158417][T27258] ? bpf_prog_calc_tag+0x51/0x370 [ 805.158442][T27258] bpf_prog_calc_tag+0x51/0x370 [ 805.158462][T27258] ? __pfx_cmp_subprogs+0x10/0x10 [ 805.158488][T27258] check_and_resolve_insns+0xbb/0x21d0 [ 805.158513][T27258] ? __pfx_bpf_check_btf_info+0x10/0x10 [ 805.158534][T27258] ? add_subprog+0x2e2/0x3f0 [ 805.158565][T27258] ? __pfx_check_and_resolve_insns+0x10/0x10 [ 805.158597][T27258] bpf_check+0x180a/0x2e10 [ 805.158628][T27258] ? ktime_get_with_offset+0x93/0x2d0 [ 805.158653][T27258] ? __pfx_bpf_check+0x10/0x10 [ 805.158675][T27258] ? bpf_obj_name_cpy+0x194/0x1e0 [ 805.158707][T27258] bpf_prog_load+0x14d6/0x1c20 [ 805.158740][T27258] ? __pfx_bpf_prog_load+0x10/0x10 [ 805.158786][T27258] __sys_bpf+0xd0d/0xd90 [ 805.158813][T27258] ? __pfx___sys_bpf+0x10/0x10 [ 805.158842][T27258] ? __fget_files+0x2a/0x420 [ 805.158883][T27258] ? ksys_write+0x242/0x270 [ 805.158912][T27258] ? __pfx_ksys_write+0x10/0x10 [ 805.158943][T27258] __x64_sys_bpf+0xba/0xd0 [ 805.158963][T27258] do_syscall_64+0x166/0x520 [ 805.158982][T27258] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 805.159002][T27258] ? clear_bhb_loop+0x70/0xc0 [ 805.159033][T27258] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 805.159052][T27258] RIP: 0033:0x7f9ed1d9e159 [ 805.159071][T27258] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 805.159087][T27258] RSP: 002b:00007f9ed2ce5028 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 805.159105][T27258] RAX: ffffffffffffffda RBX: 00007f9ed2025fa0 RCX: 00007f9ed1d9e159 [ 805.159118][T27258] RDX: 0000000000000070 RSI: 00002000000000c0 RDI: 0000000000000005 [ 805.159131][T27258] RBP: 00007f9ed2ce5090 R08: 0000000000000000 R09: 0000000000000000 [ 805.159143][T27258] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 805.159155][T27258] R13: 00007f9ed2026038 R14: 00007f9ed2025fa0 R15: 00007ffee6347f18 [ 805.159183][T27258] [ 805.159339][T27258] Mem-Info: [ 805.159366][T27258] active_anon:10607 inactive_anon:0 isolated_anon:0 [ 805.159366][T27258] active_file:0 inactive_file:43963 isolated_file:0 [ 805.159366][T27258] unevictable:0 dirty:263 writeback:0 [ 805.159366][T27258] slab_reclaimable:12100 slab_unreclaimable:123039 [ 805.159366][T27258] mapped:29990 shmem:2882 pagetables:1347 [ 805.159366][T27258] sec_pagetables:0 bounce:0 [ 805.159366][T27258] kernel_misc_reclaimable:0 [ 805.159366][T27258] free:1204178 free_pcp:12252 free_cma:0 [ 805.159437][T27258] Node 0 active_anon:42428kB inactive_anon:0kB active_file:0kB inactive_file:175644kB unevictable:0kB isolated(anon):0kB isolated(file):0kB mapped:119960kB dirty:1048kB writeback:0kB shmem:11528kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB kernel_stack:16500kB pagetables:5296kB sec_pagetables:0kB all_unreclaimable? no Balloon:0kB gpu_active:0kB gpu_reclaim:0kB [ 805.159526][T27258] Node 1 active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:208kB unevictable:0kB isolated(anon):0kB isolated(file):0kB mapped:0kB dirty:4kB writeback:0kB shmem:0kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB kernel_stack:32kB pagetables:92kB sec_pagetables:0kB all_unreclaimable? no Balloon:0kB gpu_active:0kB gpu_reclaim:0kB [ 805.159601][T27258] Node 0 DMA free:15360kB boost:0kB min:208kB low:260kB high:312kB reserved_highatomic:0kB free_highatomic:0kB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB zspages:0kB present:15992kB managed:15360kB mlocked:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB [ 805.159692][T27258] lowmem_reserve[]: 0 2486 2486 2486 2486 [ 805.159759][T27258] Node 0 DMA32 free:866320kB boost:0kB min:34140kB low:42672kB high:51204kB reserved_highatomic:0kB free_highatomic:0kB active_anon:42428kB inactive_anon:0kB active_file:0kB inactive_file:175644kB unevictable:0kB writepending:1048kB zspages:0kB present:3129332kB managed:2546620kB mlocked:0kB bounce:0kB free_pcp:49064kB local_pcp:16984kB free_cma:0kB [ 805.159853][T27258] lowmem_reserve[]: 0 0 0 0 0 [ 805.159902][T27258] Node 0 Normal free:0kB boost:0kB min:0kB low:0kB high:0kB reserved_highatomic:0kB free_highatomic:0kB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB zspages:0kB present:1048580kB managed:0kB mlocked:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB [ 805.174108][T27258] lowmem_reserve[]: 0 0 0 0 0 [ 805.174182][T27258] Node 1 Normal free:3935032kB boost:0kB min:55760kB low:69700kB high:83640kB reserved_highatomic:0kB free_highatomic:0kB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:208kB unevictable:0kB writepending:4kB zspages:0kB present:4194300kB managed:4111104kB mlocked:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB [ 805.174275][T27258] lowmem_reserve[]: 0 0 0 0 0 [ 805.174339][T27258] Node 0 DMA: 0*4kB 0*8kB 0*16kB 0*32kB 0*64kB 0*128kB 0*256kB 0*512kB 1*1024kB (U) 1*2048kB (M) 3*4096kB (M) = 15360kB [ 805.174546][T27258] Node 0 DMA32: 0*4kB 222*8kB (UME) 410*16kB (UME) 246*32kB (UME) 789*64kB (UME) 257*128kB (UME) 85*256kB (UME) 13*512kB (UME) 11*1024kB (UM) 9*2048kB (UME) 173*4096kB (M) = 866320kB [ 805.174811][T27258] Node 0 Normal: 0*4kB 0*8kB 0*16kB 0*32kB 0*64kB 0*128kB 0*256kB 0*512kB 0*1024kB 0*2048kB 0*4096kB = 0kB [ 805.174994][T27258] Node 1 Normal: 4*4kB (UM) 13*8kB (UM) 12*16kB (UM) 2*32kB (UM) 5*64kB (UM) 7*128kB (UM) 3*256kB (UM) 3*512kB (UM) 1*1024kB (M) 1*2048kB (U) 959*4096kB (M) = 3935032kB [ 805.175261][T27258] Node 0 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 805.175293][T27258] Node 0 hugepages_total=2 hugepages_free=2 hugepages_surp=0 hugepages_size=2048kB [ 805.175324][T27258] Node 1 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 805.175355][T27258] Node 1 hugepages_total=2 hugepages_free=2 hugepages_surp=0 hugepages_size=2048kB [ 805.175386][T27258] 46841 total pagecache pages [ 805.175395][T27258] 0 pages in swap cache [ 805.175402][T27258] Free swap = 124996kB [ 805.175424][T27258] Total swap = 124996kB [ 805.175433][T27258] 2097051 pages RAM [ 805.175455][T27258] 0 pages HighMem/MovableOnly [ 805.175462][T27258] 428780 pages reserved [ 805.175484][T27258] 0 pages cma reserved [ 805.990857][T27250] A link change request failed with some changes committed already. Interface virt_wifi0 may have been left with an inconsistent configuration, please check. [ 806.417138][ T91] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 806.485037][T27266] geneve0: entered promiscuous mode [ 806.522240][T27266] geneve0: left promiscuous mode [ 806.780845][T27270] netlink: 'syz.4.5345': attribute type 12 has an invalid length. [ 806.780875][T27270] netlink: 'syz.4.5345': attribute type 29 has an invalid length. [ 806.780888][T27270] netlink: 148 bytes leftover after parsing attributes in process `syz.4.5345'. [ 806.780910][T27270] netlink: 'syz.4.5345': attribute type 1 has an invalid length. [ 806.780923][T27270] netlink: 31 bytes leftover after parsing attributes in process `syz.4.5345'. [ 806.977037][T27285] netlink: 8 bytes leftover after parsing attributes in process `syz.1.5348'. [ 806.977331][T27285] netlink: 8 bytes leftover after parsing attributes in process `syz.1.5348'. [ 806.977526][T27285] netlink: 8 bytes leftover after parsing attributes in process `syz.1.5348'. [ 806.977714][T27285] netlink: 8 bytes leftover after parsing attributes in process `syz.1.5348'. [ 807.248204][T27296] netlink: 'syz.3.5350': attribute type 1 has an invalid length. [ 807.248261][T27296] netlink: 'syz.3.5350': attribute type 4 has an invalid length. [ 807.417775][T27303] FAULT_INJECTION: forcing a failure. [ 807.417775][T27303] name fail_page_alloc, interval 1, probability 0, space 0, times 0 [ 807.417814][T27303] CPU: 0 UID: 0 PID: 27303 Comm: syz.0.5354 Not tainted syzkaller #0 PREEMPT(full) [ 807.417837][T27303] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 807.417849][T27303] Call Trace: [ 807.417858][T27303] [ 807.417868][T27303] dump_stack_lvl+0xe8/0x150 [ 807.417905][T27303] should_fail_ex+0x410/0x560 [ 807.417934][T27303] prepare_alloc_pages+0x223/0x600 [ 807.417964][T27303] __alloc_frozen_pages_noprof+0x185/0x5a0 [ 807.417991][T27303] ? __pfx___alloc_frozen_pages_noprof+0x10/0x10 [ 807.418012][T27303] ? __alloc_frozen_pages_noprof+0x29e/0x5a0 [ 807.418038][T27303] ? __pfx___alloc_frozen_pages_noprof+0x10/0x10 [ 807.418064][T27303] ? __pfx_policy_nodemask+0x10/0x10 [ 807.418105][T27303] __alloc_pages_noprof+0x10/0x100 [ 807.418127][T27303] alloc_pages_bulk_noprof+0x5fa/0x7c0 [ 807.418157][T27303] ? alloc_pages_noprof+0x140/0x2b0 [ 807.418188][T27303] __kasan_populate_vmalloc+0xb7/0x1c0 [ 807.418211][T27303] alloc_vmap_area+0xd1a/0x1420 [ 807.418253][T27303] ? __pfx_alloc_vmap_area+0x10/0x10 [ 807.418277][T27303] ? __kmalloc_cache_node_noprof+0x3d1/0x620 [ 807.418299][T27303] ? __kmalloc_cache_node_noprof+0x1f7/0x620 [ 807.418318][T27303] ? __get_vm_area_node+0x155/0x2f0 [ 807.418349][T27303] __get_vm_area_node+0x200/0x2f0 [ 807.418383][T27303] __vmalloc_node_range_noprof+0x343/0x1540 [ 807.418412][T27303] ? bpf_prog_calc_tag+0x51/0x370 [ 807.418437][T27303] ? __sys_bpf+0xcd1/0xd90 [ 807.418457][T27303] ? __x64_sys_bpf+0xba/0xd0 [ 807.418474][T27303] ? do_syscall_64+0x166/0x520 [ 807.418503][T27303] ? __kasan_kmalloc+0x93/0xb0 [ 807.418527][T27303] ? bpf_prog_load+0x14d6/0x1c20 [ 807.418548][T27303] ? __sys_bpf+0xd0d/0xd90 [ 807.418567][T27303] ? __x64_sys_bpf+0xba/0xd0 [ 807.418598][T27303] ? __pfx___vmalloc_node_range_noprof+0x10/0x10 [ 807.418637][T27303] ? bpf_prog_calc_tag+0x51/0x370 [ 807.418658][T27303] __vmalloc_noprof+0xd2/0x120 [ 807.418686][T27303] ? bpf_prog_calc_tag+0x51/0x370 [ 807.418712][T27303] bpf_prog_calc_tag+0x51/0x370 [ 807.418733][T27303] ? __pfx_cmp_subprogs+0x10/0x10 [ 807.418761][T27303] check_and_resolve_insns+0xbb/0x21d0 [ 807.418787][T27303] ? __pfx_bpf_check_btf_info+0x10/0x10 [ 807.418810][T27303] ? add_subprog+0x2e2/0x3f0 [ 807.418836][T27303] ? __pfx_check_and_resolve_insns+0x10/0x10 [ 807.418868][T27303] bpf_check+0x180a/0x2e10 [ 807.418899][T27303] ? ktime_get_with_offset+0x93/0x2d0 [ 807.418925][T27303] ? __pfx_bpf_check+0x10/0x10 [ 807.418949][T27303] ? bpf_obj_name_cpy+0x194/0x1e0 [ 807.418981][T27303] bpf_prog_load+0x14d6/0x1c20 [ 807.419017][T27303] ? __pfx_bpf_prog_load+0x10/0x10 [ 807.419064][T27303] __sys_bpf+0xd0d/0xd90 [ 807.419102][T27303] ? __pfx___sys_bpf+0x10/0x10 [ 807.419135][T27303] ? __fget_files+0x2a/0x420 [ 807.419181][T27303] ? ksys_write+0x242/0x270 [ 807.419214][T27303] ? __pfx_ksys_write+0x10/0x10 [ 807.419248][T27303] __x64_sys_bpf+0xba/0xd0 [ 807.419271][T27303] do_syscall_64+0x166/0x520 [ 807.419292][T27303] ? trace_irq_disable+0x3b/0x140 [ 807.419311][T27303] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 807.419333][T27303] ? clear_bhb_loop+0x70/0xc0 [ 807.419357][T27303] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 807.419377][T27303] RIP: 0033:0x7fa283f9e159 [ 807.419396][T27303] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 807.419414][T27303] RSP: 002b:00007fa284ea5028 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 807.419438][T27303] RAX: ffffffffffffffda RBX: 00007fa284225fa0 RCX: 00007fa283f9e159 [ 807.419453][T27303] RDX: 0000000000000070 RSI: 00002000000000c0 RDI: 0000000000000005 [ 807.419467][T27303] RBP: 00007fa284ea5090 R08: 0000000000000000 R09: 0000000000000000 [ 807.419480][T27303] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 807.419493][T27303] R13: 00007fa284226038 R14: 00007fa284225fa0 R15: 00007fff8e0ea3a8 [ 807.419525][T27303] [ 808.047882][T27311] veth11: entered allmulticast mode [ 810.253927][ T55] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 810.268865][ T6696] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 810.894066][ T6696] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 811.553839][ T6752] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 811.783388][T27321] workqueue: Failed to create a rescuer kthread for wq "bond9": -EINTR [ 812.031689][T27348] __nla_validate_parse: 64 callbacks suppressed [ 812.031740][T27348] netlink: 28 bytes leftover after parsing attributes in process `syz.3.5365'. [ 812.031778][T27348] netlink: 28 bytes leftover after parsing attributes in process `syz.3.5365'. [ 812.031810][T27348] netlink: 28 bytes leftover after parsing attributes in process `syz.3.5365'. [ 812.158505][T27351] §: renamed from sit0 (while UP) [ 812.985906][T27385] netlink: 8 bytes leftover after parsing attributes in process `syz.1.5374'. [ 813.152178][T27391] netlink: 12 bytes leftover after parsing attributes in process `syz.4.5375'. [ 813.450387][ T5727] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 813.453444][ T5756] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 813.953090][ T6745] batadv0: left promiscuous mode [ 814.051018][T27419] netlink: 4 bytes leftover after parsing attributes in process `syz.5.5381'. [ 814.131361][T27432] ip_tables: iptables: counters copy to user failed while replacing table [ 814.452005][T27440] netlink: 8 bytes leftover after parsing attributes in process `syz.4.5389'. [ 814.507865][T27440] gretap0: entered promiscuous mode [ 814.526574][T27444] netlink: 8 bytes leftover after parsing attributes in process `syz.3.5391'. [ 815.253464][T27470] netlink: 28 bytes leftover after parsing attributes in process `syz.3.5397'. [ 815.253529][T27470] netlink: 28 bytes leftover after parsing attributes in process `syz.3.5397'. [ 815.631485][T27485] ip_tables: iptables: counters copy to user failed while replacing table [ 815.712819][T27489] syzkaller1: entered promiscuous mode [ 815.712842][T27489] syzkaller1: entered allmulticast mode [ 816.009492][ T6745] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 816.009988][ T6745] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 816.152526][T27511] FAULT_INJECTION: forcing a failure. [ 816.152526][T27511] name failslab, interval 1, probability 0, space 0, times 0 [ 816.152564][T27511] CPU: 0 UID: 0 PID: 27511 Comm: syz.1.5410 Not tainted syzkaller #0 PREEMPT(full) [ 816.152587][T27511] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 816.152600][T27511] Call Trace: [ 816.152609][T27511] [ 816.152618][T27511] dump_stack_lvl+0xe8/0x150 [ 816.152655][T27511] should_fail_ex+0x410/0x560 [ 816.152684][T27511] should_failslab+0xa8/0x100 [ 816.152713][T27511] __kvmalloc_node_noprof+0x176/0x820 [ 816.152741][T27511] ? bpf_compute_postorder+0x83/0x970 [ 816.152761][T27511] ? bpf_compute_postorder+0x83/0x970 [ 816.152788][T27511] bpf_compute_postorder+0x83/0x970 [ 816.152808][T27511] ? __pfx_check_and_resolve_insns+0x10/0x10 [ 816.152836][T27511] ? add_kfuncs+0x251/0x2e0 [ 816.152862][T27511] bpf_check+0x24d6/0x2e10 [ 816.152902][T27511] ? ktime_get_with_offset+0x93/0x2d0 [ 816.152931][T27511] ? __pfx_bpf_check+0x10/0x10 [ 816.152956][T27511] ? bpf_obj_name_cpy+0x194/0x1e0 [ 816.152988][T27511] bpf_prog_load+0x14d6/0x1c20 [ 816.153022][T27511] ? __pfx_bpf_prog_load+0x10/0x10 [ 816.153070][T27511] __sys_bpf+0xd0d/0xd90 [ 816.153102][T27511] ? __pfx___sys_bpf+0x10/0x10 [ 816.153135][T27511] ? __fget_files+0x2a/0x420 [ 816.153181][T27511] ? ksys_write+0x242/0x270 [ 816.153214][T27511] ? __pfx_ksys_write+0x10/0x10 [ 816.153249][T27511] __x64_sys_bpf+0xba/0xd0 [ 816.153272][T27511] do_syscall_64+0x166/0x520 [ 816.153295][T27511] ? trace_irq_disable+0x3b/0x140 [ 816.153315][T27511] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 816.153337][T27511] ? clear_bhb_loop+0x70/0xc0 [ 816.153362][T27511] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 816.153382][T27511] RIP: 0033:0x7fadba99e159 [ 816.153402][T27511] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 816.153420][T27511] RSP: 002b:00007fadbb7b7028 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 816.153442][T27511] RAX: ffffffffffffffda RBX: 00007fadbac25fa0 RCX: 00007fadba99e159 [ 816.153458][T27511] RDX: 0000000000000070 RSI: 00002000000000c0 RDI: 0000000000000005 [ 816.153471][T27511] RBP: 00007fadbb7b7090 R08: 0000000000000000 R09: 0000000000000000 [ 816.153484][T27511] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 816.153497][T27511] R13: 00007fadbac26038 R14: 00007fadbac25fa0 R15: 00007fff51e07f38 [ 816.153529][T27511] [ 816.648480][T26381] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 816.780468][T27526] syzkaller1: default qdisc (pfifo_fast) fail, fallback to noqueue [ 816.918104][T27530] FAULT_INJECTION: forcing a failure. [ 816.918104][T27530] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 816.918144][T27530] CPU: 0 UID: 0 PID: 27530 Comm: syz.4.5416 Not tainted syzkaller #0 PREEMPT(full) [ 816.918167][T27530] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 816.918179][T27530] Call Trace: [ 816.918189][T27530] [ 816.918198][T27530] dump_stack_lvl+0xe8/0x150 [ 816.918236][T27530] should_fail_ex+0x410/0x560 [ 816.918265][T27530] _copy_from_user+0x2d/0xb0 [ 816.918293][T27530] ___sys_recvmsg+0x173/0x5a0 [ 816.918329][T27530] ? __pfx____sys_recvmsg+0x10/0x10 [ 816.918361][T27530] ? lock_acquire+0x115/0x350 [ 816.918414][T27530] do_recvmmsg+0x31a/0x7f0 [ 816.918458][T27530] ? __pfx_do_recvmmsg+0x10/0x10 [ 816.918498][T27530] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 816.918528][T27530] ? __fget_files+0x3a2/0x420 [ 816.918568][T27530] __x64_sys_recvmmsg+0x198/0x250 [ 816.918598][T27530] ? __pfx___x64_sys_recvmmsg+0x10/0x10 [ 816.918638][T27530] do_syscall_64+0x166/0x520 [ 816.918660][T27530] ? trace_irq_disable+0x3b/0x140 [ 816.918681][T27530] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 816.918703][T27530] ? clear_bhb_loop+0x70/0xc0 [ 816.918728][T27530] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 816.918749][T27530] RIP: 0033:0x7fec4659e159 [ 816.918768][T27530] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 816.918787][T27530] RSP: 002b:00007fec473ba028 EFLAGS: 00000246 ORIG_RAX: 000000000000012b [ 816.918811][T27530] RAX: ffffffffffffffda RBX: 00007fec46825fa0 RCX: 00007fec4659e159 [ 816.918827][T27530] RDX: 0000000000000414 RSI: 0000200000000840 RDI: 0000000000000003 [ 816.918841][T27530] RBP: 00007fec473ba090 R08: 0000000000000000 R09: 0000000000000000 [ 816.918855][T27530] R10: 0000000000000406 R11: 0000000000000246 R12: 0000000000000002 [ 816.918867][T27530] R13: 00007fec46826038 R14: 00007fec46825fa0 R15: 00007ffcbbcbc628 [ 816.918901][T27530] [ 817.184834][T27534] __nla_validate_parse: 2 callbacks suppressed [ 817.184857][T27534] netlink: 16 bytes leftover after parsing attributes in process `syz.4.5417'. [ 817.184900][T27534] netlink: 20 bytes leftover after parsing attributes in process `syz.4.5417'. [ 817.291788][ T6693] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 817.329606][T27542] x_tables: duplicate underflow at hook 1 [ 817.515279][T27546] lo speed is unknown, defaulting to 1000 [ 817.532968][T27546] lo speed is unknown, defaulting to 1000 [ 817.536031][T27546] lo speed is unknown, defaulting to 1000 [ 817.735710][T27552] FAULT_INJECTION: forcing a failure. [ 817.735710][T27552] name failslab, interval 1, probability 0, space 0, times 0 [ 817.735748][T27552] CPU: 0 UID: 0 PID: 27552 Comm: syz.1.5422 Not tainted syzkaller #0 PREEMPT(full) [ 817.735772][T27552] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 817.735784][T27552] Call Trace: [ 817.735793][T27552] [ 817.735803][T27552] dump_stack_lvl+0xe8/0x150 [ 817.735840][T27552] should_fail_ex+0x410/0x560 [ 817.735870][T27552] should_failslab+0xa8/0x100 [ 817.735898][T27552] __kvmalloc_node_noprof+0x176/0x820 [ 817.735925][T27552] ? bpf_compute_postorder+0x83/0x970 [ 817.735945][T27552] ? bpf_compute_postorder+0x83/0x970 [ 817.735971][T27552] bpf_compute_postorder+0x83/0x970 [ 817.735992][T27552] ? __pfx_check_and_resolve_insns+0x10/0x10 [ 817.736020][T27552] ? add_kfuncs+0x251/0x2e0 [ 817.736049][T27552] bpf_check+0x24d6/0x2e10 [ 817.736081][T27552] ? ktime_get_with_offset+0x93/0x2d0 [ 817.736107][T27552] ? __pfx_bpf_check+0x10/0x10 [ 817.736132][T27552] ? bpf_obj_name_cpy+0x194/0x1e0 [ 817.736163][T27552] bpf_prog_load+0x14d6/0x1c20 [ 817.736199][T27552] ? __pfx_bpf_prog_load+0x10/0x10 [ 817.736245][T27552] __sys_bpf+0xd0d/0xd90 [ 817.736276][T27552] ? __pfx___sys_bpf+0x10/0x10 [ 817.736309][T27552] ? __fget_files+0x2a/0x420 [ 817.736355][T27552] ? ksys_write+0x242/0x270 [ 817.736388][T27552] ? __pfx_ksys_write+0x10/0x10 [ 817.736418][T27552] __x64_sys_bpf+0xba/0xd0 [ 817.736439][T27552] do_syscall_64+0x166/0x520 [ 817.736468][T27552] ? trace_irq_disable+0x3b/0x140 [ 817.736487][T27552] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 817.736508][T27552] ? clear_bhb_loop+0x70/0xc0 [ 817.736555][T27552] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 817.736573][T27552] RIP: 0033:0x7fadba99e159 [ 817.736592][T27552] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 817.736608][T27552] RSP: 002b:00007fadbb7b7028 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 817.736630][T27552] RAX: ffffffffffffffda RBX: 00007fadbac25fa0 RCX: 00007fadba99e159 [ 817.736645][T27552] RDX: 0000000000000070 RSI: 00002000000000c0 RDI: 0000000000000005 [ 817.736659][T27552] RBP: 00007fadbb7b7090 R08: 0000000000000000 R09: 0000000000000000 [ 817.736670][T27552] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 817.736682][T27552] R13: 00007fadbac26038 R14: 00007fadbac25fa0 R15: 00007fff51e07f38 [ 817.736711][T27552] [ 817.863276][T27549] syzkaller1: entered promiscuous mode [ 817.863317][T27549] syzkaller1: entered allmulticast mode [ 818.465077][T27567] FAULT_INJECTION: forcing a failure. [ 818.465077][T27567] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 818.465134][T27567] CPU: 1 UID: 0 PID: 27567 Comm: syz.1.5427 Not tainted syzkaller #0 PREEMPT(full) [ 818.465158][T27567] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 818.465171][T27567] Call Trace: [ 818.465181][T27567] [ 818.465190][T27567] dump_stack_lvl+0xe8/0x150 [ 818.465225][T27567] should_fail_ex+0x410/0x560 [ 818.465260][T27567] _copy_from_user+0x2d/0xb0 [ 818.465287][T27567] ___sys_recvmsg+0x173/0x5a0 [ 818.465322][T27567] ? __pfx____sys_recvmsg+0x10/0x10 [ 818.465356][T27567] ? irqentry_exit+0x218/0x910 [ 818.465409][T27567] do_recvmmsg+0x31a/0x7f0 [ 818.465445][T27567] ? __pfx_do_recvmmsg+0x10/0x10 [ 818.465471][T27567] ? irqentry_exit+0x218/0x910 [ 818.465519][T27567] __x64_sys_recvmmsg+0x198/0x250 [ 818.465549][T27567] ? __pfx___x64_sys_recvmmsg+0x10/0x10 [ 818.465588][T27567] do_syscall_64+0x166/0x520 [ 818.465610][T27567] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 818.465632][T27567] ? clear_bhb_loop+0x70/0xc0 [ 818.465657][T27567] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 818.465677][T27567] RIP: 0033:0x7fadba99e159 [ 818.465697][T27567] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 818.465715][T27567] RSP: 002b:00007fadbb7b7028 EFLAGS: 00000246 ORIG_RAX: 000000000000012b [ 818.465738][T27567] RAX: ffffffffffffffda RBX: 00007fadbac25fa0 RCX: 00007fadba99e159 [ 818.465774][T27567] RDX: 0000000000000414 RSI: 0000200000000840 RDI: 0000000000000003 [ 818.465789][T27567] RBP: 00007fadbb7b7090 R08: 0000000000000000 R09: 0000000000000000 [ 818.465803][T27567] R10: 0000000000000406 R11: 0000000000000246 R12: 0000000000000002 [ 818.465816][T27567] R13: 00007fadbac26038 R14: 00007fadbac25fa0 R15: 00007fff51e07f38 [ 818.465848][T27567] [ 818.771331][T27565] netlink: 28 bytes leftover after parsing attributes in process `syz.4.5426'. [ 818.903890][T27577] netlink: 12 bytes leftover after parsing attributes in process `syz.1.5430'. [ 818.925816][T27578] netlink: 'syz.0.5428': attribute type 9 has an invalid length. [ 818.930402][T27571] 8021q: adding VLAN 0 to HW filter on device bond10 [ 818.939581][T27571] bond9: (slave bond10): Enslaving as an active interface with an up link [ 818.996096][T27571] netlink: 4 bytes leftover after parsing attributes in process `syz.4.5426'. [ 819.283205][T27572] bond9: (slave gretap2): Enslaving as an active interface with an up link [ 819.285977][T27565] 8021q: adding VLAN 0 to HW filter on device bond9 [ 819.433128][T27596] netlink: 8 bytes leftover after parsing attributes in process `syz.1.5434'. [ 819.549420][T27600] tipc: New replicast peer: 255.255.126.16 [ 819.549772][T27600] tipc: Enabled bearer , priority 10 [ 819.550918][T27600] netlink: 12 bytes leftover after parsing attributes in process `syz.1.5435'. [ 819.842196][T27610] netlink: 8 bytes leftover after parsing attributes in process `syz.3.5437'. [ 819.869267][T27611] netlink: 8 bytes leftover after parsing attributes in process `syz.3.5437'. [ 820.533256][T27630] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 820.702173][ T10] tipc: Node number set to 3542905293 [ 820.851573][T27643] netlink: 4 bytes leftover after parsing attributes in process `syz.0.5447'. [ 821.687900][ T6696] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 821.772288][ T6696] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 821.772785][ T6696] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 822.410859][T27668] nbd: nbd4 already in use [ 822.412191][T27670] block nbd4: NBD_DISCONNECT [ 822.412220][T27670] block nbd4: Send disconnect failed -32 [ 822.412240][T27670] block nbd4: Send disconnect failed -32 [ 822.412257][T27670] block nbd4: shutting down sockets [ 822.452548][T27676] netlink: 'syz.0.5455': attribute type 1 has an invalid length. [ 822.452573][T27676] netlink: 12 bytes leftover after parsing attributes in process `syz.0.5455'. [ 822.452589][T27676] netlink: 13 bytes leftover after parsing attributes in process `syz.0.5455'. [ 822.747205][T27685] netlink: 8 bytes leftover after parsing attributes in process `syz.5.5456'. [ 823.047486][ T10] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 823.050924][ T6696] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 825.979611][T27715] netlink: 16 bytes leftover after parsing attributes in process `syz.4.5463'. [ 826.109312][T27716] netlink: 12 bytes leftover after parsing attributes in process `syz.5.5462'. [ 826.109340][T27716] A link change request failed with some changes committed already. Interface macvtap0 may have been left with an inconsistent configuration, please check. [ 826.399762][T27690] netdevsim netdevsim1 netdevsim2 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 826.399802][T27690] netdevsim netdevsim1 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 826.792668][T27690] netdevsim netdevsim1 netdevsim1 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 826.792730][T27690] netdevsim netdevsim1 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 826.888418][ T91] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 826.889340][ T91] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 827.205986][T27690] netdevsim netdevsim1 netdevsim0 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 827.206048][T27690] netdevsim netdevsim1 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 827.322023][T27757] IPVS: nq: FWM 3 0x00000003 - no destination available [ 827.427836][ T91] netdevsim netdevsim1 eth1: set [0, 0] type 1 family 0 port 8472 - 0 [ 827.427895][ T91] netdevsim netdevsim1 eth1: set [1, 0] type 2 family 0 port 6081 - 0 [ 827.438148][ T6745] netdevsim netdevsim1 eth3: set [0, 0] type 1 family 0 port 8472 - 0 [ 827.438213][ T6745] netdevsim netdevsim1 eth3: set [1, 0] type 2 family 0 port 6081 - 0 [ 827.438321][ T6745] netdevsim netdevsim1 eth0: set [0, 0] type 1 family 0 port 8472 - 0 [ 827.438376][ T6745] netdevsim netdevsim1 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 827.438440][ T6745] netdevsim netdevsim1 eth2: set [0, 0] type 1 family 0 port 8472 - 0 [ 827.438481][ T6745] netdevsim netdevsim1 eth2: set [1, 0] type 2 family 0 port 6081 - 0 [ 827.539903][ T91] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 827.554880][T27758] netlink: 'syz.4.5469': attribute type 34 has an invalid length. [ 827.691033][T27770] IPVS: set_ctl: invalid protocol: 135 10.1.1.3:20001 [ 828.042050][T27784] netlink: 14 bytes leftover after parsing attributes in process `syz.0.5475'. [ 828.584253][T27796] syzkaller0: entered promiscuous mode [ 828.584350][T27796] syzkaller0: entered allmulticast mode [ 828.619841][T27804] netlink: 20 bytes leftover after parsing attributes in process `syz.4.5482'. [ 828.669601][T27806] netlink: 20 bytes leftover after parsing attributes in process `syz.4.5482'. [ 828.817363][ T91] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 829.551685][T27812] netlink: 'syz.4.5485': attribute type 1 has an invalid length. [ 829.629366][T27821] netlink: 'syz.5.5487': attribute type 1 has an invalid length. [ 829.649827][T27812] bond11: entered promiscuous mode [ 829.650336][T27812] 8021q: adding VLAN 0 to HW filter on device bond11 [ 829.675209][T27816] veth11: entered allmulticast mode [ 829.701603][T27816] bond11: (slave veth11): making interface the new active one [ 829.701641][T27816] veth11: entered promiscuous mode [ 829.721917][T27816] bond11: (slave veth11): Enslaving as an active interface with an up link [ 830.362880][T27846] netlink: 20 bytes leftover after parsing attributes in process `syz.5.5495'. [ 830.365653][T27846] netlink: 8 bytes leftover after parsing attributes in process `syz.5.5495'. [ 830.365673][T27846] netlink: 23 bytes leftover after parsing attributes in process `syz.5.5495'. [ 830.389878][T27846] netlink: 8 bytes leftover after parsing attributes in process `syz.5.5495'. [ 830.389901][T27846] netlink: 23 bytes leftover after parsing attributes in process `syz.5.5495'. [ 830.624928][T27852] netlink: 8 bytes leftover after parsing attributes in process `syz.5.5496'. [ 830.624959][T27852] netlink: 4 bytes leftover after parsing attributes in process `syz.5.5496'. [ 831.097225][T27868] macsec2: entered allmulticast mode [ 831.097261][T27868] veth1_macvtap: entered allmulticast mode [ 831.113725][T27868] veth1_macvtap: left allmulticast mode [ 831.317110][T27872] bond0: Device is already in use. [ 831.503909][ T31] audit: type=1804 audit(1789150757.849:97): pid=27890 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=open_writers comm="syz.4.5505" name="/newroot/443/cgroup.controllers" dev="tmpfs" ino=2283 res=1 errno=0 [ 831.504172][ T31] audit: type=1800 audit(1789150757.849:98): pid=27890 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.4.5505" name="cgroup.controllers" dev="tmpfs" ino=2283 res=0 errno=0 [ 831.718741][ T52] block nbd4: Receive control failed (result -32) [ 831.718989][ T5623] block nbd4: Receive control failed (result -32) [ 832.008410][ T91] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 832.033931][T27904] xt_IDLETIMER: label is empty or not nul-terminated [ 832.652872][ T55] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 832.676470][ T5756] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 833.288355][T26381] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 833.936989][ T6696] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 834.209803][T27943] bridge0: port 4(veth0) entered disabled state [ 834.230082][T27943] bridge0: port 1(bridge_slave_0) entered disabled state [ 834.232397][T27943] bridge0: port 2(bridge_slave_1) entered disabled state [ 834.252209][T27945] netlink: 'syz.4.5516': attribute type 16 has an invalid length. [ 834.252230][T27945] netlink: 'syz.4.5516': attribute type 17 has an invalid length. [ 834.866035][T27945] bridge0: port 4(veth0) entered blocking state [ 834.866257][T27945] bridge0: port 4(veth0) entered forwarding state [ 834.895924][T27945] bridge0: port 1(bridge_slave_0) entered blocking state [ 834.896081][T27945] bridge0: port 1(bridge_slave_0) entered forwarding state [ 834.908499][T27945] bridge0: port 2(bridge_slave_1) entered blocking state [ 834.908633][T27945] bridge0: port 2(bridge_slave_1) entered forwarding state [ 835.043867][T27945] A link change request failed with some changes committed already. Interface virt_wifi0 may have been left with an inconsistent configuration, please check. [ 835.090417][T27964] xt_hashlimit: overflow, try lower: 2147483649/0 [ 835.125246][T27967] FAULT_INJECTION: forcing a failure. [ 835.125246][T27967] name failslab, interval 1, probability 0, space 0, times 0 [ 835.125284][T27967] CPU: 0 UID: 0 PID: 27967 Comm: syz.1.5525 Not tainted syzkaller #0 PREEMPT(full) [ 835.125307][T27967] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 835.125323][T27967] Call Trace: [ 835.125332][T27967] [ 835.125341][T27967] dump_stack_lvl+0xe8/0x150 [ 835.125380][T27967] should_fail_ex+0x410/0x560 [ 835.125409][T27967] should_failslab+0xa8/0x100 [ 835.125439][T27967] __kvmalloc_node_noprof+0x176/0x820 [ 835.125461][T27967] ? rcu_is_watching+0x16/0xb0 [ 835.125486][T27967] ? bpf_compute_subprog_arg_access+0x187/0x14d0 [ 835.125512][T27967] ? trace_kmalloc+0x2a/0xf0 [ 835.125541][T27967] ? call_instance+0x263/0x560 [ 835.125561][T27967] ? call_instance+0x263/0x560 [ 835.125589][T27967] call_instance+0x263/0x560 [ 835.125619][T27967] bpf_compute_subprog_arg_access+0x2a3/0x14d0 [ 835.125664][T27967] ? bpf_compute_live_registers+0x14f/0x1ff0 [ 835.125690][T27967] ? bpf_compute_live_registers+0x14f/0x1ff0 [ 835.125712][T27967] ? trace_kmalloc+0x2a/0xf0 [ 835.125740][T27967] ? __pfx_bpf_compute_subprog_arg_access+0x10/0x10 [ 835.125769][T27967] ? __kvmalloc_node_noprof+0x345/0x820 [ 835.125790][T27967] ? bpf_compute_live_registers+0x14f/0x1ff0 [ 835.125812][T27967] ? bpf_compute_live_registers+0x14f/0x1ff0 [ 835.125843][T27967] bpf_compute_live_registers+0x8d3/0x1ff0 [ 835.125885][T27967] ? __pfx_bpf_compute_live_registers+0x10/0x10 [ 835.125920][T27967] bpf_check+0x25ed/0x2e10 [ 835.125954][T27967] ? ktime_get_with_offset+0x93/0x2d0 [ 835.125980][T27967] ? __pfx_bpf_check+0x10/0x10 [ 835.126004][T27967] ? bpf_obj_name_cpy+0x194/0x1e0 [ 835.126036][T27967] bpf_prog_load+0x14d6/0x1c20 [ 835.126071][T27967] ? __pfx_bpf_prog_load+0x10/0x10 [ 835.126119][T27967] __sys_bpf+0xd0d/0xd90 [ 835.126150][T27967] ? __pfx___sys_bpf+0x10/0x10 [ 835.126184][T27967] ? __fget_files+0x2a/0x420 [ 835.126236][T27967] ? ksys_write+0x242/0x270 [ 835.126268][T27967] ? __pfx_ksys_write+0x10/0x10 [ 835.126302][T27967] __x64_sys_bpf+0xba/0xd0 [ 835.126325][T27967] do_syscall_64+0x166/0x520 [ 835.126347][T27967] ? trace_irq_disable+0x3b/0x140 [ 835.126367][T27967] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 835.126388][T27967] ? clear_bhb_loop+0x70/0xc0 [ 835.126412][T27967] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 835.126433][T27967] RIP: 0033:0x7fadba99e159 [ 835.126450][T27967] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 835.126468][T27967] RSP: 002b:00007fadbb7b7028 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 835.126491][T27967] RAX: ffffffffffffffda RBX: 00007fadbac25fa0 RCX: 00007fadba99e159 [ 835.126505][T27967] RDX: 0000000000000070 RSI: 00002000000000c0 RDI: 0000000000000005 [ 835.126517][T27967] RBP: 00007fadbb7b7090 R08: 0000000000000000 R09: 0000000000000000 [ 835.126531][T27967] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 835.126543][T27967] R13: 00007fadbac26038 R14: 00007fadbac25fa0 R15: 00007fff51e07f38 [ 835.126575][T27967] [ 835.385690][T27978] netlink: 'syz.0.5526': attribute type 21 has an invalid length. [ 835.388282][T27978] netlink: 156 bytes leftover after parsing attributes in process `syz.0.5526'. [ 836.173775][T28006] netlink: 8 bytes leftover after parsing attributes in process `syz.0.5533'. [ 836.362290][T28016] netlink: 12 bytes leftover after parsing attributes in process `syz.4.5536'. [ 836.573691][T28025] netlink: 'syz.3.5535': attribute type 7 has an invalid length. [ 836.725798][T28034] netlink: 12 bytes leftover after parsing attributes in process `syz.5.5539'. [ 837.422266][T28056] lo speed is unknown, defaulting to 1000 [ 837.455972][T28056] lo speed is unknown, defaulting to 1000 [ 837.463291][T28056] lo speed is unknown, defaulting to 1000 [ 837.511595][T28063] netlink: 8 bytes leftover after parsing attributes in process `syz.1.5544'. [ 837.511637][T28063] netlink: 4 bytes leftover after parsing attributes in process `syz.1.5544'. [ 837.511702][T28063] netlink: 'syz.1.5544': attribute type 19 has an invalid length. [ 837.511735][T28063] netlink: 'syz.1.5544': attribute type 20 has an invalid length. [ 837.689185][ T6745] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 837.775096][T17267] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 837.829126][T28070] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 837.858531][T28076] A link change request failed with some changes committed already. Interface netdevsim0 may have been left with an inconsistent configuration, please check. [ 837.887850][T28078] netlink: 16 bytes leftover after parsing attributes in process `syz.0.5547'. [ 838.261261][T28091] netlink: zone id is out of range [ 838.261307][T28091] netlink: zone id is out of range [ 838.266819][T28091] netlink: zone id is out of range [ 838.266863][T28091] netlink: zone id is out of range [ 838.266872][T28091] netlink: zone id is out of range [ 838.266878][T28091] netlink: zone id is out of range [ 838.358134][T28086] netlink: 8 bytes leftover after parsing attributes in process `syz.5.5548'. [ 838.880497][T28097] syz_tun: entered promiscuous mode [ 838.884330][T28097] macsec2: entered promiscuous mode [ 839.131278][T28097] syz_tun: left promiscuous mode [ 839.250125][T28111] netlink: 4 bytes leftover after parsing attributes in process `syz.0.5554'. [ 839.269151][T28114] netlink: 24 bytes leftover after parsing attributes in process `syz.5.5555'. [ 839.645220][ T52] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 839.654852][ T52] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 839.665391][ T52] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 839.671231][ T52] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 839.690231][ T52] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 839.772707][T28131] syzkaller1: entered promiscuous mode [ 839.772733][T28131] syzkaller1: entered allmulticast mode [ 839.782617][T28126] sctp: [Deprecated]: syz.3.5557 (pid 28126) Use of int in max_burst socket option deprecated. [ 839.782617][T28126] Use struct sctp_assoc_value instead [ 839.840698][ T5623] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 839.842316][ T5623] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 839.842729][ T5623] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 839.872141][ T5623] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 839.872549][T28137] sctp: [Deprecated]: syz.3.5557 (pid 28137) Use of int in max_burst socket option deprecated. [ 839.872549][T28137] Use struct sctp_assoc_value instead [ 839.888547][ T5623] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 840.690925][T28158] xt_addrtype: ipv6 PROHIBIT (THROW, NAT ..) matching not supported [ 840.809572][T28158] netdevsim netdevsim3 netdevsim0: entered allmulticast mode [ 841.294052][T28180] syzkaller0: entered promiscuous mode [ 841.294078][T28180] syzkaller0: entered allmulticast mode [ 842.027979][ T5623] Bluetooth: hci3: command tx timeout [ 843.529419][ T6694] net_ratelimit: 74 callbacks suppressed [ 843.529447][ T6694] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 843.529907][ T6694] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 844.094533][ T5623] Bluetooth: hci3: command tx timeout [ 844.808914][ T6696] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 844.963273][T28128] lo speed is unknown, defaulting to 1000 [ 844.972758][T28128] lo speed is unknown, defaulting to 1000 [ 844.979904][T28128] lo speed is unknown, defaulting to 1000 [ 845.017511][T28205] __nla_validate_parse: 2 callbacks suppressed [ 845.017556][T28205] netlink: 8 bytes leftover after parsing attributes in process `syz.4.5576'. [ 845.017860][T28206] netlink: 8 bytes leftover after parsing attributes in process `syz.4.5576'. [ 845.458662][T17267] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 845.555882][T28221] syzkaller1: entered promiscuous mode [ 845.555910][T28221] syzkaller1: entered allmulticast mode [ 845.916247][T28234] netlink: 24 bytes leftover after parsing attributes in process `syz.3.5582'. [ 846.142350][T28241] netlink: 16 bytes leftover after parsing attributes in process `syz.5.5581'. [ 846.168094][ T5623] Bluetooth: hci3: command tx timeout [ 846.248594][T28238] netlink: 32 bytes leftover after parsing attributes in process `syz.3.5582'. [ 846.280168][T28232] netlink: 'syz.5.5581': attribute type 4 has an invalid length. [ 846.493675][T28128] bridge0: port 1(bridge_slave_0) entered blocking state [ 846.494344][T28128] bridge0: port 1(bridge_slave_0) entered disabled state [ 846.494558][T28128] bridge_slave_0: entered allmulticast mode [ 846.504408][T28128] bridge_slave_0: entered promiscuous mode [ 846.510487][T28128] bridge0: port 2(bridge_slave_1) entered blocking state [ 846.510584][T28128] bridge0: port 2(bridge_slave_1) entered disabled state [ 846.510707][T28128] bridge_slave_1: entered allmulticast mode [ 846.519709][T28128] bridge_slave_1: entered promiscuous mode [ 846.655937][T28253] netlink: 8 bytes leftover after parsing attributes in process `syz.3.5585'. [ 846.915541][T28261] openvswitch: netlink: IP tunnel dst address not specified [ 846.915616][T28261] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 846.955862][T28267] openvswitch: netlink: IP tunnel dst address not specified [ 846.957945][T28267] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 847.023256][T28128] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 847.665048][T28128] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 847.776083][T28128] team0: Port device team_slave_0 added [ 847.793956][T28128] team0: Port device team_slave_1 added [ 847.898024][T28128] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 847.898061][T28128] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 847.898116][T28128] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 847.902091][T28128] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 847.902122][T28128] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 847.902179][T28128] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 848.249053][ T52] Bluetooth: hci3: command tx timeout [ 848.399714][T28128] hsr_slave_0: entered promiscuous mode [ 848.402043][T28128] hsr_slave_1: entered promiscuous mode [ 848.648819][ T6696] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 849.289897][T26381] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 849.334646][T28305] netlink: 'syz.4.5600': attribute type 4 has an invalid length. [ 849.334705][T28305] netlink: 152 bytes leftover after parsing attributes in process `syz.4.5600'. [ 849.378229][T28305] A link change request failed with some changes committed already. Interface bond0 may have been left with an inconsistent configuration, please check. [ 849.383470][T28317] syzkaller1: entered promiscuous mode [ 849.383493][T28317] syzkaller1: entered allmulticast mode [ 849.437558][T28330] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 850.051831][T28128] netdevsim netdevsim1 eth3 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 850.051894][T28128] netdevsim netdevsim1 eth3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 850.275498][T28128] netdevsim netdevsim1 eth2 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 850.275537][T28128] netdevsim netdevsim1 eth2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 850.326633][ T52] Bluetooth: hci3: command 0x0405 tx timeout [ 850.394257][T28128] netdevsim netdevsim1 eth1 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 850.394298][T28128] netdevsim netdevsim1 eth1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 850.631317][T28128] netdevsim netdevsim1 eth0 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 850.631356][T28128] netdevsim netdevsim1 eth0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 851.208412][T17267] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 851.781187][T28302] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 851.783701][T28342] netlink: 260 bytes leftover after parsing attributes in process `syz.5.5609'. [ 851.819067][T28128] netdevsim netdevsim1 netdevsim0: renamed from eth0 [ 851.843590][T28128] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 851.854301][ T10] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 851.862216][T17267] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 851.907800][T28128] netdevsim netdevsim1 netdevsim1: renamed from eth1 [ 851.912022][T28128] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 851.913227][T28128] netdevsim netdevsim1 netdevsim2: renamed from eth2 [ 851.945343][T28128] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 851.946222][T28128] netdevsim netdevsim1 netdevsim3: renamed from eth3 [ 851.978827][T28128] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 852.233760][T28367] bridge0: port 4(veth0) entered disabled state [ 852.235191][T28367] bridge0: port 2(bridge_slave_1) entered disabled state [ 852.235491][T28367] bridge0: port 1(bridge_slave_0) entered disabled state [ 852.238434][T28367] bridge0: entered allmulticast mode [ 852.325112][T28367] veth0: left allmulticast mode [ 852.325177][T28367] veth0: left promiscuous mode [ 852.331148][T28367] bridge0: port 4(veth0) entered disabled state [ 852.401781][T28367] vlan2: left allmulticast mode [ 852.401811][T28367] geneve0: left allmulticast mode [ 852.401884][T28367] vlan2: left promiscuous mode [ 852.401898][T28367] geneve0: left promiscuous mode [ 852.402287][T28367] bridge0: port 3(vlan2) entered disabled state [ 852.437932][T28367] bridge_slave_1: left allmulticast mode [ 852.437963][T28367] bridge_slave_1: left promiscuous mode [ 852.438160][T28367] bridge0: port 2(bridge_slave_1) entered disabled state [ 852.472629][T28367] bridge_slave_0: left allmulticast mode [ 852.472661][T28367] bridge_slave_0: left promiscuous mode [ 852.472904][T28367] bridge0: port 1(bridge_slave_0) entered disabled state [ 852.735707][T28384] netlink: 32 bytes leftover after parsing attributes in process `syz.5.5617'. [ 852.741995][T28384] sctp: [Deprecated]: syz.5.5617 (pid 28384) Use of int in maxseg socket option. [ 852.741995][T28384] Use struct sctp_assoc_value instead [ 853.361231][T28381] tc_dump_action: action bad kind [ 853.733614][T28128] 8021q: adding VLAN 0 to HW filter on device bond0 [ 853.761165][T28128] 8021q: adding VLAN 0 to HW filter on device team0 [ 853.767693][ T6745] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 853.791136][T17267] bridge0: port 1(bridge_slave_0) entered blocking state [ 853.791241][T17267] bridge0: port 1(bridge_slave_0) entered forwarding state [ 853.815642][T17267] bridge0: port 2(bridge_slave_1) entered blocking state [ 853.815778][T17267] bridge0: port 2(bridge_slave_1) entered forwarding state [ 854.343720][T28416] sock: sock_timestamping_bind_phc: sock not bind to device [ 855.018949][ T6745] nci: nci_add_new_protocol: the target found does not have the desired protocol [ 855.055155][ T6752] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 855.425825][T28128] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 855.634411][T28437] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 855.911420][T28128] veth0_vlan: entered promiscuous mode [ 856.095846][T28461] bond9 (unregistering): Released all slaves [ 856.208949][T28128] veth1_vlan: entered promiscuous mode [ 856.451990][T28128] veth0_macvtap: entered promiscuous mode [ 856.484070][T28128] veth1_macvtap: entered promiscuous mode [ 856.540832][T28128] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 856.558484][T28128] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 856.634670][T17267] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 856.782881][ T6694] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 856.782995][ T6694] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 856.783039][ T6694] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 856.967672][T17267] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 857.105069][ T6693] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 857.105122][ T6693] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 857.195146][ T6752] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 857.195204][ T6752] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 857.499079][T28496] bond8: option min_links: invalid value (18446744073709551612) [ 857.499109][T28496] bond8: option min_links: allowed values 0 - 2147483647 [ 857.505046][T28496] bond8 (unregistering): Released all slaves [ 857.937497][T28504] mac80211_hwsim hwsim34 wlan0: left promiscuous mode [ 857.937528][T28504] mac80211_hwsim hwsim34 wlan0: left allmulticast mode [ 858.027891][T28507] netlink: 16 bytes leftover after parsing attributes in process `syz.4.5643'. [ 858.045920][T28507] netlink: 12 bytes leftover after parsing attributes in process `syz.4.5643'. [ 858.096617][T28512] netlink: 412 bytes leftover after parsing attributes in process `syz.3.5645'. [ 858.096729][T28512] openvswitch: netlink: push_nsh: missing base or metadata attributes [ 858.100671][T28507] netlink: 'syz.4.5643': attribute type 32 has an invalid length. [ 858.268517][T28508] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 858.433157][T28517] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 858.433379][T28517] netlink: 16 bytes leftover after parsing attributes in process `syz.0.5647'. [ 858.433877][T28517] A link change request failed with some changes committed already. Interface netdevsim0 may have been left with an inconsistent configuration, please check. [ 858.625995][T28524] netlink: 'syz.0.5652': attribute type 1 has an invalid length. [ 859.186936][T28547] netlink: 'syz.3.5656': attribute type 1 has an invalid length. [ 859.187011][T28547] netlink: 'syz.3.5656': attribute type 1 has an invalid length. [ 859.198142][T28547] netlink: 8 bytes leftover after parsing attributes in process `syz.3.5656'. [ 859.443387][T28553] sctp: [Deprecated]: syz.0.5658 (pid 28553) Use of int in max_burst socket option. [ 859.443387][T28553] Use struct sctp_assoc_value instead [ 859.542503][ T6693] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 859.855234][T28551] netdevsim netdevsim4 netdevsim0: entered allmulticast mode [ 859.855659][T28551] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 859.858303][T28551] A link change request failed with some changes committed already. Interface netdevsim0 may have been left with an inconsistent configuration, please check. [ 859.965302][T28558] IPVS: Unknown mcast interface: macsec0 [ 860.351491][T28580] netlink: 4 bytes leftover after parsing attributes in process `syz.4.5665'. [ 860.351605][T28580] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 860.351624][T28580] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 860.808760][ T6693] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 860.852753][T28598] netlink: 112 bytes leftover after parsing attributes in process `syz.4.5672'. [ 860.971041][T28611] netlink: 12 bytes leftover after parsing attributes in process `syz.1.5674'. [ 861.097647][T28609] netlink: 8 bytes leftover after parsing attributes in process `syz.3.5673'. [ 861.097688][T28609] netlink: 20 bytes leftover after parsing attributes in process `syz.3.5673'. [ 861.146280][T28609] geneve0: entered promiscuous mode [ 861.146305][T28609] geneve0: entered allmulticast mode [ 861.178444][ T6696] netdevsim netdevsim2 eth1: set [1, 0] type 2 family 0 port 6081 - 0 [ 861.186856][ T6752] netdevsim netdevsim2 eth2: set [1, 0] type 2 family 0 port 6081 - 0 [ 861.191062][ T6696] netdevsim netdevsim2 eth3: set [1, 0] type 2 family 0 port 6081 - 0 [ 861.191129][ T6696] netdevsim netdevsim2 eth4: set [1, 0] type 2 family 0 port 6081 - 0 [ 861.448164][ T5727] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 862.081336][T28638] hsr0: entered promiscuous mode [ 862.297995][T28642] hsr_slave_0: left promiscuous mode [ 862.302551][T28642] hsr_slave_1: left promiscuous mode [ 862.371239][T28642] hsr0 (unregistering): left promiscuous mode [ 862.462038][T28653] openvswitch: netlink: Either Ethernet header or EtherType is required. [ 862.533476][T28653] block nbd4: NBD_DISCONNECT [ 862.533541][T28653] block nbd4: Send disconnect failed -32 [ 862.533599][T28653] block nbd4: Send disconnect failed -32 [ 862.533630][T28653] block nbd4: shutting down sockets [ 862.728284][ T6693] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 863.112742][T28666] netlink: 'syz.5.5681': attribute type 4 has an invalid length. [ 863.393727][T28672] xt_hashlimit: size too large, truncated to 1048576 [ 863.393755][T28672] xt_hashlimit: max too large, truncated to 1048576 [ 864.286022][T28694] __nla_validate_parse: 3 callbacks suppressed [ 864.286048][T28694] netlink: 8 bytes leftover after parsing attributes in process `syz.5.5689'. [ 864.286076][T28694] netlink: 4 bytes leftover after parsing attributes in process `syz.5.5689'. [ 864.286108][T28694] netlink: 'syz.5.5689': attribute type 18 has an invalid length. [ 864.771432][T28707] netlink: 28 bytes leftover after parsing attributes in process `syz.5.5692'. [ 864.771486][T28707] netlink: 28 bytes leftover after parsing attributes in process `syz.5.5692'. [ 864.869838][T28709] netlink: 28 bytes leftover after parsing attributes in process `syz.5.5692'. [ 864.869929][T28709] netlink: 28 bytes leftover after parsing attributes in process `syz.5.5692'. [ 865.007421][T28712] IPVS: sed: TCP 127.0.0.1:21 - no destination available [ 865.290844][T26381] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 865.293079][ T6752] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 865.857113][ T6745] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 866.034345][T28729] openvswitch: netlink: Either Ethernet header or EtherType is required. [ 866.035367][T28729] netlink: 12 bytes leftover after parsing attributes in process `syz.3.5699'. [ 866.035422][T28729] nbd: must specify a size in bytes for the device [ 866.051117][T28729] block nbd0: NBD_DISCONNECT [ 866.151324][T28729] block nbd0: Send disconnect failed -104 [ 866.151392][T28729] block nbd0: shutting down sockets [ 866.820333][T28742] netlink: 16 bytes leftover after parsing attributes in process `syz.5.5703'. [ 866.944575][ T55] batadv1: left allmulticast mode [ 866.944639][ T55] batadv1: left promiscuous mode [ 866.945229][ T55] bridge0: port 4(batadv1) entered disabled state [ 867.105690][ T55] vlan2: left allmulticast mode [ 867.105735][ T55] geneve0: left allmulticast mode [ 867.105791][ T55] vlan2: left promiscuous mode [ 867.105821][ T55] geneve0: left promiscuous mode [ 867.119511][ T55] bridge0: port 3(vlan2) entered disabled state [ 867.197908][ T55] bridge_slave_1: left allmulticast mode [ 867.197974][ T55] bridge_slave_1: left promiscuous mode [ 867.198405][ T55] bridge0: port 2(bridge_slave_1) entered disabled state [ 867.398119][T28764] netlink: 4 bytes leftover after parsing attributes in process `syz.0.5707'. [ 867.445255][ T55] veth7: left allmulticast mode [ 867.445318][ T55] veth7: left promiscuous mode [ 867.445778][ T55] bridge6: port 2(veth7) entered disabled state [ 867.464081][T28760] netlink: 12 bytes leftover after parsing attributes in process `syz.0.5707'. [ 867.503343][ T55] veth5: left allmulticast mode [ 867.503411][ T55] veth5: left promiscuous mode [ 867.504025][ T55] bridge6: port 1(veth5) entered disabled state [ 867.569575][ T55] pimreg9: left allmulticast mode [ 868.028249][ T55] erspan0 (unregistering): left promiscuous mode [ 868.400980][ T55] bridge0 (unregistering): left promiscuous mode [ 868.495591][ T6696] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 868.674967][ T55] bond5 (unregistering): (slave bridge3): Releasing backup interface [ 868.799496][ T55] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 868.803741][ T55] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 868.804951][ T55] bond0 (unregistering): Released all slaves [ 868.844737][ T55] bond1 (unregistering): Released all slaves [ 868.875357][ T55] bond2 (unregistering): Released all slaves [ 868.900307][ T55] bond3 (unregistering): Released all slaves [ 868.923058][ T55] bond4 (unregistering): Released all slaves [ 868.948252][ T55] bond5 (unregistering): Released all slaves [ 868.968343][ T55] bond6 (unregistering): Released all slaves [ 868.998768][ T55] bond7 (unregistering): Released all slaves [ 869.018388][ T55] bond8 (unregistering): Released all slaves [ 869.041228][ T55] bond9 (unregistering): Released all slaves [ 869.068754][ T55] bond10 (unregistering): Released all slaves [ 869.471968][ T55] tipc: Disabling bearer [ 869.472235][ T55] tipc: Left network mode [ 869.627392][T28799] __nla_validate_parse: 3 callbacks suppressed [ 869.627418][T28799] netlink: 32 bytes leftover after parsing attributes in process `syz.1.5718'. [ 870.409497][T26381] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 870.412678][T26381] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 870.630545][ T55] hsr_slave_0: left promiscuous mode [ 871.047934][ T5756] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 871.378705][ T55] team0 (unregistering): Port device team_slave_1 removed [ 871.426297][ T55] team0 (unregistering): Port device team_slave_0 removed [ 871.688818][ T6699] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 873.139566][ T55] IPVS: stop unused estimator thread 0... [ 873.492866][T28883] netlink: 24 bytes leftover after parsing attributes in process `syz.4.5740'. [ 873.706789][T28885] syzkaller0: entered promiscuous mode [ 873.706815][T28885] syzkaller0: entered allmulticast mode [ 873.744212][T28885] tipc: Started in network mode [ 873.744247][T28885] tipc: Node identity 8aac696ff186, cluster identity 4711 [ 873.744612][T28885] tipc: Enabled bearer , priority 0 [ 874.158969][T28898] xt_CT: You must specify a L4 protocol and not use inversions on it [ 874.163642][T28899] netlink: 12 bytes leftover after parsing attributes in process `syz.5.5745'. [ 874.247999][T26381] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 874.342603][T28884] tipc: Resetting bearer [ 874.440955][T28910] netlink: 'syz.4.5746': attribute type 21 has an invalid length. [ 874.501418][T28911] SET target dimension over the limit! [ 874.612931][T28884] tipc: Disabling bearer [ 874.826359][T28871] netlink: 'syz.0.5737': attribute type 10 has an invalid length. [ 875.013387][T28903] 8021q: adding VLAN 0 to HW filter on device bond9 [ 875.103573][T28903] bond9 (unregistering): Released all slaves [ 875.236762][T28918] netlink: 8 bytes leftover after parsing attributes in process `syz.3.5744'. [ 875.425124][T28871] team0 (unregistering): Port device macvlan5 removed [ 875.463274][T28871] team0 (unregistering): Port device batadv1 removed [ 875.529880][ T6752] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 875.763771][T28930] netlink: 144 bytes leftover after parsing attributes in process `syz.4.5747'. [ 876.175931][T17267] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 876.275978][T28941] netlink: 48 bytes leftover after parsing attributes in process `syz.3.5750'. [ 876.289329][T28941] netlink: 48 bytes leftover after parsing attributes in process `syz.3.5750'. [ 876.519003][T28948] netlink: 4 bytes leftover after parsing attributes in process `syz.0.5751'. [ 877.461091][ T55] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 877.485493][T28970] netlink: 8 bytes leftover after parsing attributes in process `syz.0.5756'. [ 877.485535][T28970] netlink: 'syz.0.5756': attribute type 32 has an invalid length. [ 877.485750][T28970] netlink: 8 bytes leftover after parsing attributes in process `syz.0.5756'. [ 877.485772][T28970] netlink: 'syz.0.5756': attribute type 32 has an invalid length. [ 877.789792][T28960] netlink: 24 bytes leftover after parsing attributes in process `syz.4.5755'. [ 877.984946][T28969] syzkaller0: entered promiscuous mode [ 877.984976][T28969] syzkaller0: entered allmulticast mode [ 878.410375][T28989] netlink: 20 bytes leftover after parsing attributes in process `syz.5.5758'. [ 878.885677][ T5727] hid-generic 0005:0B57:05DF.0003: item fetching failed at offset 0/3 [ 878.886329][ T5727] hid-generic 0005:0B57:05DF.0003: probe with driver hid-generic failed with error -22 [ 878.886732][ T5727] [ 878.906862][ T5727] ====================================================== [ 878.913919][ T5727] WARNING: possible circular locking dependency detected [ 878.921081][ T5727] syzkaller #0 Not tainted [ 878.925513][ T5727] ------------------------------------------------------ [ 878.932607][ T5727] kworker/0:5/5727 is trying to acquire lock: [ 878.938681][ T5727] ffff88801c2d4a10 (&root->kernfs_iattr_rwsem){++++}-{4:4}, at: __kernfs_remove+0x174/0x8e0 [ 878.949421][ T5727] [ 878.949421][ T5727] but task is already holding lock: [ 878.956786][ T5727] ffff88801c2d4980 (&root->kernfs_rwsem){++++}-{4:4}, at: kernfs_remove_by_name_ns+0x4e/0x140 [ 878.967086][ T5727] [ 878.967086][ T5727] which lock already depends on the new lock. [ 878.967086][ T5727] [ 878.977490][ T5727] [ 878.977490][ T5727] the existing dependency chain (in reverse order) is: [ 878.986504][ T5727] [ 878.986504][ T5727] -> #11 (&root->kernfs_rwsem){++++}-{4:4}: [ 878.994719][ T5727] down_write+0x96/0x200 [ 878.999497][ T5727] kernfs_add_one+0x41/0x6f0 [ 879.004607][ T5727] kernfs_create_dir_ns+0x1a1/0x230 [ 879.010323][ T5727] internal_create_group+0x440/0x1180 [ 879.016315][ T5727] cpuhp_invoke_callback+0x434/0x810 [ 879.022212][ T5727] cpuhp_issue_call+0x3f0/0x750 [ 879.027685][ T5727] __cpuhp_setup_state_cpuslocked+0x3f4/0x6f0 [ 879.034302][ T5727] __cpuhp_setup_state+0x3f/0x60 [ 879.039760][ T5727] do_one_initcall+0x250/0x870 [ 879.045049][ T5727] do_initcall_level+0x10a/0x1a0 [ 879.050632][ T5727] do_initcalls+0x59/0xa0 [ 879.055510][ T5727] kernel_init_freeable+0x29d/0x3e0 [ 879.061236][ T5727] kernel_init+0x22/0x1d0 [ 879.066092][ T5727] ret_from_fork+0x514/0xb70 [ 879.071289][ T5727] ret_from_fork_asm+0x1a/0x30 [ 879.076616][ T5727] [ 879.076616][ T5727] -> #10 (cpuhp_state_mutex){+.+.}-{4:4}: [ 879.084606][ T5727] [ 879.084606][ T5727] -> #9 (cpu_hotplug_lock){++++}-{0:0}: [ 879.092339][ T5727] cpus_read_lock+0x42/0x160 [ 879.097540][ T5727] static_key_slow_inc+0x12/0x30 [ 879.103027][ T5727] setup_udp_tunnel_sock+0x2df/0x4f0 [ 879.108952][ T5727] l2tp_tunnel_register+0xe77/0x1570 [ 879.114851][ T5727] pppol2tp_connect+0x8e3/0x18b0 [ 879.120316][ T5727] __sys_connect+0x316/0x450 [ 879.125422][ T5727] __x64_sys_connect+0x7a/0x90 [ 879.130702][ T5727] do_syscall_64+0x166/0x520 [ 879.135811][ T5727] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 879.142226][ T5727] [ 879.142226][ T5727] -> #8 (sk_lock-AF_INET6){+.+.}-{0:0}: [ 879.150045][ T5727] lock_sock_nested+0x41/0x100 [ 879.155336][ T5727] tls_sw_sendmsg+0x15f/0x2b50 [ 879.160692][ T5727] sock_sendmsg_nosec+0x90/0x180 [ 879.166181][ T5727] sock_write_iter+0x2de/0x3e0 [ 879.171552][ T5727] do_iter_readv_writev+0x612/0x8c0 [ 879.177272][ T5727] vfs_writev+0x343/0x990 [ 879.182119][ T5727] do_writev+0x154/0x2e0 [ 879.186879][ T5727] do_syscall_64+0x166/0x520 [ 879.191981][ T5727] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 879.198388][ T5727] [ 879.198388][ T5727] -> #7 (&ctx->tx_lock){+.+.}-{4:4}: [ 879.205859][ T5727] __mutex_lock+0x19d/0x1550 [ 879.210972][ T5727] tls_sw_sendmsg+0x13a/0x2b50 [ 879.216255][ T5727] sock_sendmsg_nosec+0x90/0x180 [ 879.221741][ T5727] sock_sendmsg+0x1ca/0x2d0 [ 879.226833][ T5727] __sock_xmit+0x245/0x4f0 [ 879.231828][ T5727] nbd_disconnect+0x3ad/0x560 [ 879.237059][ T5727] nbd_disconnect_and_put+0x32/0x280 [ 879.243392][ T5727] nbd_genl_disconnect+0x4af/0x590 [ 879.249100][ T5727] genl_family_rcv_msg_doit+0x233/0x340 [ 879.255174][ T5727] genl_rcv_msg+0x614/0x7a0 [ 879.260204][ T5727] netlink_rcv_skb+0x226/0x4a0 [ 879.265585][ T5727] genl_rcv+0x28/0x40 [ 879.270120][ T5727] netlink_unicast+0x7bd/0x940 [ 879.275497][ T5727] netlink_sendmsg+0x813/0xb40 [ 879.280783][ T5727] sock_sendmsg_nosec+0x13a/0x180 [ 879.286364][ T5727] ____sys_sendmsg+0x54e/0x850 [ 879.291715][ T5727] ___sys_sendmsg+0x2a5/0x360 [ 879.297031][ T5727] __x64_sys_sendmsg+0x1b1/0x290 [ 879.302494][ T5727] do_syscall_64+0x166/0x520 [ 879.307599][ T5727] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 879.314008][ T5727] [ 879.314008][ T5727] -> #6 (&nsock->tx_lock){+.+.}-{4:4}: [ 879.321739][ T5727] __mutex_lock+0x19d/0x1550 [ 879.326853][ T5727] nbd_queue_rq+0x373/0xff0 [ 879.331878][ T5727] blk_mq_dispatch_rq_list+0x499/0x1990 [ 879.338069][ T5727] __blk_mq_sched_dispatch_requests+0xd36/0x1580 [ 879.344958][ T5727] blk_mq_sched_dispatch_requests+0xd7/0x190 [ 879.351454][ T5727] blk_mq_run_work_fn+0x16c/0x300 [ 879.357001][ T5727] process_scheduled_works+0xc3d/0x1630 [ 879.363077][ T5727] worker_thread+0xa47/0xfb0 [ 879.368185][ T5727] kthread+0x38b/0x480 [ 879.372765][ T5727] ret_from_fork+0x514/0xb70 [ 879.377882][ T5727] ret_from_fork_asm+0x1a/0x30 [ 879.383171][ T5727] [ 879.383171][ T5727] -> #5 (&cmd->lock){+.+.}-{4:4}: [ 879.390392][ T5727] __mutex_lock+0x19d/0x1550 [ 879.395513][ T5727] nbd_queue_rq+0xc1/0xff0 [ 879.400494][ T5727] blk_mq_dispatch_rq_list+0x499/0x1990 [ 879.406567][ T5727] __blk_mq_sched_dispatch_requests+0xd36/0x1580 [ 879.413418][ T5727] blk_mq_sched_dispatch_requests+0xd7/0x190 [ 879.419931][ T5727] blk_mq_run_work_fn+0x16c/0x300 [ 879.425481][ T5727] process_scheduled_works+0xc3d/0x1630 [ 879.431671][ T5727] worker_thread+0xa47/0xfb0 [ 879.436785][ T5727] kthread+0x38b/0x480 [ 879.441374][ T5727] ret_from_fork+0x514/0xb70 [ 879.446488][ T5727] ret_from_fork_asm+0x1a/0x30 [ 879.451774][ T5727] [ 879.451774][ T5727] -> #4 (set->srcu){.+.+}-{0:0}: [ 879.459333][ T5727] __synchronize_srcu+0xc9/0x2f0 [ 879.464804][ T5727] elevator_switch+0x1e8/0x7b0 [ 879.470213][ T5727] elevator_change+0x2fa/0x480 [ 879.475492][ T5727] elevator_set_default+0x375/0x440 [ 879.481205][ T5727] blk_register_queue+0x3f3/0x4e0 [ 879.486995][ T5727] __add_disk+0x6b8/0xdb0 [ 879.491849][ T5727] add_disk_fwnode+0x100/0x3a0 [ 879.497231][ T5727] nbd_dev_add+0x733/0xb60 [ 879.502163][ T5727] nbd_init+0x168/0x1f0 [ 879.506941][ T5727] do_one_initcall+0x250/0x870 [ 879.512227][ T5727] do_initcall_level+0x10a/0x1a0 [ 879.517679][ T5727] do_initcalls+0x59/0xa0 [ 879.522519][ T5727] kernel_init_freeable+0x29d/0x3e0 [ 879.528230][ T5727] kernel_init+0x22/0x1d0 [ 879.533075][ T5727] ret_from_fork+0x514/0xb70 [ 879.538183][ T5727] ret_from_fork_asm+0x1a/0x30 [ 879.543470][ T5727] [ 879.543470][ T5727] -> #3 (&q->elevator_lock){+.+.}-{4:4}: [ 879.551291][ T5727] __mutex_lock+0x19d/0x1550 [ 879.556402][ T5727] elevator_change+0x1af/0x480 [ 879.561686][ T5727] elevator_set_none+0xb5/0x140 [ 879.567057][ T5727] blk_mq_update_nr_hw_queues+0x5ef/0x19f0 [ 879.573396][ T5727] nbd_start_device+0x189/0xb30 [ 879.578763][ T5727] nbd_genl_connect+0x167d/0x1cd0 [ 879.584310][ T5727] genl_family_rcv_msg_doit+0x233/0x340 [ 879.590372][ T5727] genl_rcv_msg+0x614/0x7a0 [ 879.595387][ T5727] netlink_rcv_skb+0x226/0x4a0 [ 879.600669][ T5727] genl_rcv+0x28/0x40 [ 879.605163][ T5727] netlink_unicast+0x7bd/0x940 [ 879.610455][ T5727] netlink_sendmsg+0x813/0xb40 [ 879.615738][ T5727] sock_sendmsg_nosec+0x13a/0x180 [ 879.621285][ T5727] ____sys_sendmsg+0x54e/0x850 [ 879.626567][ T5727] ___sys_sendmsg+0x2a5/0x360 [ 879.631763][ T5727] __x64_sys_sendmsg+0x1b1/0x290 [ 879.637214][ T5727] do_syscall_64+0x166/0x520 [ 879.642320][ T5727] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 879.648727][ T5727] [ 879.648727][ T5727] -> #2 (&q->q_usage_counter(io)#53){++++}-{0:0}: [ 879.657440][ T5727] blk_alloc_queue+0x544/0x690 [ 879.662722][ T5727] __blk_mq_alloc_disk+0x194/0x390 [ 879.668372][ T5727] nbd_dev_add+0x494/0xb60 [ 879.673302][ T5727] nbd_init+0x168/0x1f0 [ 879.677974][ T5727] do_one_initcall+0x250/0x870 [ 879.683256][ T5727] do_initcall_level+0x10a/0x1a0 [ 879.688708][ T5727] do_initcalls+0x59/0xa0 [ 879.693550][ T5727] kernel_init_freeable+0x29d/0x3e0 [ 879.699262][ T5727] kernel_init+0x22/0x1d0 [ 879.704116][ T5727] ret_from_fork+0x514/0xb70 [ 879.709213][ T5727] ret_from_fork_asm+0x1a/0x30 [ 879.714496][ T5727] [ 879.714496][ T5727] -> #1 (fs_reclaim){+.+.}-{0:0}: [ 879.721698][ T5727] fs_reclaim_acquire+0x71/0x100 [ 879.727150][ T5727] kmem_cache_alloc_noprof+0x5f/0x600 [ 879.733044][ T5727] __kernfs_iattrs+0xdd/0x380 [ 879.738247][ T5727] kernfs_iop_setattr+0xe6/0x3f0 [ 879.743719][ T5727] notify_change+0xbba/0xea0 [ 879.748833][ T5727] do_truncate+0x1c2/0x250 [ 879.753784][ T5727] path_openat+0x15b5/0x1d60 [ 879.758892][ T5727] do_file_open+0x23e/0x4a0 [ 879.763907][ T5727] do_sys_openat2+0x115/0x200 [ 879.769112][ T5727] __x64_sys_openat+0x138/0x170 [ 879.774491][ T5727] do_syscall_64+0x166/0x520 [ 879.779597][ T5727] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 879.786004][ T5727] [ 879.786004][ T5727] -> #0 (&root->kernfs_iattr_rwsem){++++}-{4:4}: [ 879.794518][ T5727] __lock_acquire+0x164c/0x2de0 [ 879.799891][ T5727] lock_acquire+0x115/0x350 [ 879.804909][ T5727] down_write+0x96/0x200 [ 879.809669][ T5727] __kernfs_remove+0x174/0x8e0 [ 879.814946][ T5727] kernfs_remove_by_name_ns+0xc0/0x140 [ 879.820922][ T5727] really_probe+0x36e/0xae0 [ 879.826024][ T5727] __driver_probe_device+0x1e8/0x360 [ 879.831831][ T5727] driver_probe_device+0x4f/0x240 [ 879.837384][ T5727] __device_attach_driver+0x270/0x410 [ 879.843286][ T5727] bus_for_each_drv+0x258/0x2f0 [ 879.848665][ T5727] __device_attach+0x2c4/0x450 [ 879.853951][ T5727] device_initial_probe+0xa1/0xd0 [ 879.859497][ T5727] bus_probe_device+0x12a/0x220 [ 879.864869][ T5727] device_add+0x7d7/0xb80 [ 879.869717][ T5727] hid_add_device+0x272/0x3e0 [ 879.875055][ T5727] hidp_session_dev_work+0x45/0x160 [ 879.880816][ T5727] process_scheduled_works+0xc3d/0x1630 [ 879.886877][ T5727] worker_thread+0xa47/0xfb0 [ 879.891990][ T5727] kthread+0x38b/0x480 [ 879.896572][ T5727] ret_from_fork+0x514/0xb70 [ 879.901670][ T5727] ret_from_fork_asm+0x1a/0x30 [ 879.906954][ T5727] [ 879.906954][ T5727] other info that might help us debug this: [ 879.906954][ T5727] [ 879.917174][ T5727] Chain exists of: [ 879.917174][ T5727] &root->kernfs_iattr_rwsem --> cpuhp_state_mutex --> &root->kernfs_rwsem [ 879.917174][ T5727] [ 879.931669][ T5727] Possible unsafe locking scenario: [ 879.931669][ T5727] [ 879.939162][ T5727] CPU0 CPU1 [ 879.944518][ T5727] ---- ---- [ 879.949895][ T5727] lock(&root->kernfs_rwsem); [ 879.954655][ T5727] lock(cpuhp_state_mutex); [ 879.961757][ T5727] lock(&root->kernfs_rwsem); [ 879.969046][ T5727] lock(&root->kernfs_iattr_rwsem); [ 879.974323][ T5727] [ 879.974323][ T5727] *** DEADLOCK *** [ 879.974323][ T5727] [ 879.982520][ T5727] locks held by kworker/0:5/5727: 5, last CPU#0: [ 879.988946][ T5727] #0: ffff88801b06b140 ((wq_completion)events){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 [ 879.999924][ T5727] #1: ffffc90004a3fc40 ((work_completion)(&session->dev_init)){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 [ 880.012285][ T5727] #2: ffff88809b0d1a58 (&dev->mutex){....}-{4:4}, at: __device_attach+0x88/0x450 [ 880.021528][ T5727] #3: ffff88801c2d4aa0 (&root->kernfs_supers_rwsem){++++}-{4:4}, at: kernfs_remove_by_name_ns+0x3f/0x140 [ 880.032844][ T5727] #4: ffff88801c2d4980 (&root->kernfs_rwsem){++++}-{4:4}, at: kernfs_remove_by_name_ns+0x4e/0x140 [ 880.043555][ T5727] [ 880.043555][ T5727] stack backtrace: [ 880.049446][ T5727] CPU: 0 UID: 0 PID: 5727 Comm: kworker/0:5 Not tainted syzkaller #0 PREEMPT(full) [ 880.058812][ T5727] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 880.068862][ T5727] Workqueue: events hidp_session_dev_work [ 880.074595][ T5727] Call Trace: [ 880.077878][ T5727] [ 880.080804][ T5727] dump_stack_lvl+0xe8/0x150 [ 880.085397][ T5727] print_circular_bug+0x2e2/0x300 [ 880.090427][ T5727] check_noncircular+0x12f/0x150 [ 880.095364][ T5727] __lock_acquire+0x164c/0x2de0 [ 880.100216][ T5727] ? __lock_acquire+0x747/0x2de0 [ 880.105152][ T5727] lock_acquire+0x115/0x350 [ 880.109663][ T5727] ? __kernfs_remove+0x174/0x8e0 [ 880.114606][ T5727] down_write+0x96/0x200 [ 880.118847][ T5727] ? __kernfs_remove+0x174/0x8e0 [ 880.123789][ T5727] ? __pfx_down_write+0x10/0x10 [ 880.128635][ T5727] ? kernfs_root+0x1c/0x230 [ 880.133132][ T5727] ? kernfs_root+0x1c/0x230 [ 880.137632][ T5727] ? kernfs_root+0x1ea/0x230 [ 880.142220][ T5727] __kernfs_remove+0x174/0x8e0 [ 880.146981][ T5727] ? kernfs_find_ns+0x6f8/0x770 [ 880.151829][ T5727] kernfs_remove_by_name_ns+0xc0/0x140 [ 880.157291][ T5727] really_probe+0x36e/0xae0 [ 880.161796][ T5727] __driver_probe_device+0x1e8/0x360 [ 880.167092][ T5727] driver_probe_device+0x4f/0x240 [ 880.172125][ T5727] __device_attach_driver+0x270/0x410 [ 880.177498][ T5727] bus_for_each_drv+0x258/0x2f0 [ 880.182441][ T5727] ? __pfx___device_attach_driver+0x10/0x10 [ 880.188414][ T5727] ? __pfx_bus_for_each_drv+0x10/0x10 [ 880.193795][ T5727] ? _raw_spin_unlock_irqrestore+0x4c/0x80 [ 880.199615][ T5727] __device_attach+0x2c4/0x450 [ 880.204376][ T5727] ? __pfx___device_attach+0x10/0x10 [ 880.209656][ T5727] ? _raw_spin_unlock+0x28/0x50 [ 880.214508][ T5727] device_initial_probe+0xa1/0xd0 [ 880.219528][ T5727] bus_probe_device+0x12a/0x220 [ 880.224381][ T5727] device_add+0x7d7/0xb80 [ 880.228703][ T5727] hid_add_device+0x272/0x3e0 [ 880.233379][ T5727] ? hidp_session_dev_work+0x1e/0x160 [ 880.238751][ T5727] ? process_scheduled_works+0x97a/0x1630 [ 880.244555][ T5727] hidp_session_dev_work+0x45/0x160 [ 880.249752][ T5727] process_scheduled_works+0xc3d/0x1630 [ 880.255317][ T5727] ? __pfx_process_scheduled_works+0x10/0x10 [ 880.261311][ T5727] ? assign_work+0x3cf/0x5d0 [ 880.265904][ T5727] worker_thread+0xa47/0xfb0 [ 880.270506][ T5727] ? __kthread_parkme+0x71/0x1f0 [ 880.275462][ T5727] kthread+0x38b/0x480 [ 880.279533][ T5727] ? __pfx_worker_thread+0x10/0x10 [ 880.284660][ T5727] ? __pfx_kthread+0x10/0x10 [ 880.289253][ T5727] ret_from_fork+0x514/0xb70 [ 880.293845][ T5727] ? __pfx_ret_from_fork+0x10/0x10 [ 880.299227][ T5727] ? __switch_to+0xc89/0x1420 [ 880.303906][ T5727] ? __pfx_kthread+0x10/0x10 [ 880.308504][ T5727] ret_from_fork_asm+0x1a/0x30 [ 880.313364][ T5727] [ 880.377828][T17267] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 880.647638][ T10] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 881.287742][ T6693] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 881.927497][ T55] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 883.207485][ T6693] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 885.446922][ T6699] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 887.057469][ T6699] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 887.688349][T17267] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 888.337121][T17267] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog