last executing test programs: 3.858654686s ago: executing program 4 (id=4370): r0 = socket$inet_mptcp(0x2, 0x1, 0x106) connect$inet(r0, &(0x7f0000000100)={0x2, 0x4e24, @dev={0xac, 0x14, 0x14, 0x3f}}, 0x10) (async) setsockopt$sock_int(r0, 0x1, 0x1d, &(0x7f0000000000)=0x1ffffd, 0x4) (async, rerun: 64) r1 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000040)={0x2, 0x4, 0x8, 0x1, 0x80, 0x0}, 0x50) (rerun: 64) r2 = bpf$PROG_LOAD(0x5, &(0x7f00000004c0)={0x1, 0x10, &(0x7f00000001c0)=ANY=[@ANYBLOB="18050000000000000000b00000000000b7080000000000007b8af8ff00000000b7080000000000007b8af0ff00000000bfa10000000000004e38aadcf8ffffffbfa400000000000007040000f0ffff09b8020000d4ef13bd580800000018230000a726d862c4d90999212b054268c57a8ae30ffdf14033a0c7a1", @ANYRES32=r1, @ANYBLOB="0000000000000000b70400000800000085000000950000009500000000000000"], &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x5, '\x00', 0x0, @fallback=0x34, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8}, 0x94) socket$packet(0x11, 0x2, 0x300) (async) r3 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_fanout(r3, 0x107, 0x12, &(0x7f0000000100)={0x0, 0x7005}, 0x4) (async) r4 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000400)=ANY=[], 0x20}}, 0x0) (async) bpf$BPF_GET_PROG_INFO(0xf, &(0x7f00000006c0)={r2, 0xe0, &(0x7f00000005c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, ""/16, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xa, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xe6, 0x8, 0x0, 0x0}}, 0x10) 2.884839734s ago: executing program 4 (id=4375): r0 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000040), 0x161042, 0x0) ioctl$PPPIOCNEWUNIT(r0, 0xc004743e, &(0x7f00000001c0)=0x3) (async, rerun: 32) ioctl$PPPIOCSPASS(r0, 0x40107447, &(0x7f0000000080)={0x2, &(0x7f0000000100)=[{0x54, 0xff, 0x0, 0x8}, {0x6, 0x74, 0x6}]}) (rerun: 32) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = socket$packet(0x11, 0x3, 0x300) (async) r3 = socket$nl_route(0x10, 0x3, 0x0) r4 = socket(0x10, 0x3, 0x0) sendmsg$nl_route(r4, &(0x7f0000000380)={0x0, 0x4076cbba9945d516, &(0x7f0000000340)={0x0, 0x14}}, 0x0) getsockname$packet(r4, &(0x7f0000000140)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) (async) unshare(0x60600) (async, rerun: 32) r6 = syz_init_net_socket$x25(0x9, 0x5, 0x0) (async, rerun: 32) unshare(0x20000400) pipe(&(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) close(r8) (async) pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) tee(r7, r9, 0x8f5, 0x0) (async) getsockopt$X25_QBITINCL(r6, 0x106, 0x1, 0x0, 0x0) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r1, 0x8933, &(0x7f0000000040)={'batadv0\x00', 0x0}) sendmsg$nl_route(r3, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000500)={&(0x7f0000000240)=@newlink={0x40, 0x10, 0x439, 0x10000000, 0x0, {0x0, 0x0, 0x0, r10, 0x69801}, [@IFLA_LINKINFO={0x20, 0x12, 0x0, 0x1, @macsec={{}, {0x0, 0x2, 0x0, 0x1, [@IFLA_MACSEC_REPLAY_PROTECT={0x0, 0xc, 0xe}, @IFLA_MACSEC_WINDOW={0x0, 0x5, 0xa}, @IFLA_MACSEC_WINDOW={0x0, 0x5, 0x1}, @IFLA_MACSEC_SCI, @IFLA_MACSEC_SCB={0x0, 0xb, 0xf7}]}}}]}, 0x40}, 0x1, 0x0, 0x0, 0x20040000}, 0x0) (async) sendto$packet(r2, &(0x7f00000001c0)="11eb0300fc0baf745836da8886dd", 0xe, 0x2404c081, &(0x7f0000000200)={0x11, 0x88a8, r5, 0x1, 0x4, 0x6, @multicast}, 0x14) (async, rerun: 32) r11 = syz_genetlink_get_family_id$smc(&(0x7f0000000000), 0xffffffffffffffff) (rerun: 32) sendmsg$SMC_PNETID_GET(r1, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000100)={0x20, r11, 0x1, 0x70bd26, 0x25dfdbfe, {}, [@SMC_PNETID_IBNAME={0x9, 0x3, 'syz2\x00'}]}, 0x20}, 0x1, 0x0, 0x0, 0x8010}, 0x850) 2.806710668s ago: executing program 1 (id=4376): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket$phonet(0x23, 0x2, 0x1) r3 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)=@base={0x11, 0x4, 0x4, 0xff}, 0x48) bpf$MAP_DELETE_ELEM(0x3, &(0x7f0000000080)={r3, &(0x7f00000000c0)="328ab2b3e5"}, 0x20) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f00000001c0)={'ip6gre0\x00'}) (async) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f00000001c0)={'ip6gre0\x00', 0x0}) socket(0x2, 0x5, 0x0) (async) r5 = socket(0x2, 0x5, 0x0) socket$inet6_sctp(0xa, 0x5, 0x84) (async) r6 = socket$inet6_sctp(0xa, 0x5, 0x84) shutdown(r6, 0x0) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r6, 0x84, 0x6f, &(0x7f0000000200)={0x0, 0x10, &(0x7f00000001c0)=[@in={0x2, 0x4e21, @rand_addr=0x64010100}]}, &(0x7f0000000140)=0x10) setsockopt$inet_sctp_SCTP_RTOINFO(r5, 0x84, 0x0, &(0x7f0000000080)={r7, 0xff, 0x8000, 0x400}, 0x10) (async) setsockopt$inet_sctp_SCTP_RTOINFO(r5, 0x84, 0x0, &(0x7f0000000080)={r7, 0xff, 0x8000, 0x400}, 0x10) sendmsg$TCPDIAG_GETSOCK(r5, &(0x7f00000016c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f0000001680)={&(0x7f00000002c0)={0x1394, 0x12, 0x8, 0x70bd2d, 0x25dfdbfc, {0x1, 0x92, 0xc8, 0x1, {0x4e22, 0x4e20, [0x5, 0xf, 0xfa4, 0x3], [0x80, 0x172, 0xf815], r4, [0x80000000, 0x7]}, 0x2, 0x800}, [@INET_DIAG_REQ_BYTECODE={0x43, 0x1, "9b81c30325e28defeca8eeaa5dac9f705819f65595affe8b3f7b74463f42ec394c31d5aa4831292516e8820b1c3d751280c87e367b7617da0fedc7604fe254"}, @INET_DIAG_REQ_BYTECODE={0xde, 0x1, "c5726fc145e2431d015b83bf5824431df7992e32ba34e903e61cd796b5472e69f6389a4c598ed801411bee8ca31167692ebfd1575837712ade5eb1c2a8beefb43c709b4ab754beb647e5971f80fdbc4b0570b138570f993fa52b4c0e84b1758a58aab73dc0bcf7966e53c22dc89fd22136572a1601b19bfbf1635d07d783f79e608d45907883a23a107228995303fd83f314c8ac0bc0b9bb9dcad0246baa7afd52d2289d5db625a0fd223915632766317d7b181c184d9d1888dbeefe23684a032f9916c010d2f0278859cac8f15e35dfeb3b07453cc92a2c21db"}, @INET_DIAG_REQ_BYTECODE={0xeb, 0x1, "de246508733c7c81ad24bec19f1ef325a73fc62fca8f5cdcc670a172a5f1c626f5c32783f99085d1b3d87a506221520ff3143eda705b836aa271ab547188876e66d3f126b2cef16f9022389044d300d7d275efbc11af48c170167c209cab3b7a0f38c9a9db55725feddb2bdc0cf5d48c0e28f8ce898844623a7768407e1c3a406c89eb48ea988dd89e6a12e637fb3e0b56c66c0f370e9dcef861d12df1d7f15e619105136bade1fa71bb5e14af0d098865c890ad919b186a3b791dfff3bccc56946052f7b2bbb7f67b583797a0ff9a844ee10b66f8a4843787a6e8640c3a5c4e1e2fedfbca5701"}, @INET_DIAG_REQ_BYTECODE={0x31, 0x1, "81f9877fd6a0aeb5938f59b0a916f449985535131f208322caf9c46560e42742449d4db22a905b038b5c4c6f15"}, @INET_DIAG_REQ_BYTECODE={0xff, 0x1, "1a81f1030de4b4a8dace5616742036e1f0dc97cea56c757077f373fc136547359ce201e6c81bb8300913cac54bc71e376cf2136d9af80e345bca6f6a65ee1c3201f78cd83e1dcc85368297449fd227b292e947b6713ba555b4c14bb5a707d09aff7dea3eb1cda545bebd37c065c13931da9bbca57dd39b73f47600c72e65643543f112c69e100fdfeae6ee743f58411f1d33e95d4bddd8bf59227e06d39ec146f9011247024f526050d2999dfcb008d2c64599a9064bfa5c22c767bc491689f32f051fcc23f03af38a4ad4b103df5b93a54945eead6652f379576c68b8241f5915c467183157cda0ccd8436af7461b494adccc2c43dc85968e3585"}, @INET_DIAG_REQ_BYTECODE={0x1004, 0x1, "dac7ee12282c596fa92aa28c3758d576339e0950abfc3c84c9cc7a7fbe23667b069ca8a09593fdca42bb645b49453270a4283daff348da0c632c7ae483affc5cd1fa87a9177abb581a8b0e885913c371c72656689af993f6d8f43d3666f91d75b96c4047f60d592d2f11add6fa16c3ae3d585a99343748b76912a949ec309f05ccc16f746e432c962d06449b2e3d37ab33ae2476e6d17ff566078a207ad35058e6dcc4b3bd3dc59b84ff8afca82bcf6ef2d09ccf47b28cd8b81318b936f0745cb18e8341932399c735ae9eb78821e0b99c1457dac1be33555c77c588f53dbc24ab5cb19c8e61c4aed76c1c75c2ad8522a572f8b44ac20819e9d73726c39dafaa9cd37ee8fbd300efc6cc264f6c418fd12b41bf939660b400570d37dce9857704642f686051c0f6a114fef9fb7846a33c1bb4513b30ee43a7e13605fcb17f595291284a08a9b7ad3bf08a6fbe81d16126ec2cfe120664e9d0977f5c36e0542e4563ca343b1c43d4614cee695d6c47e9f90d8811adbc67854ca02b25131d2fb3a6b02420755265415b812e5d7067249c9218395c6882a29ff605986c33b7613e2e370bec42426c07028caba75d482c65399f9d4e005912f187e63aa791cc422a4d59308169758c704a0f7978daf368cb0f18570b57dd07180fc7fddc041cbe65d2cc62b367e9a0a81a43d1b61ec9155aef0d09a78f754ebbe72dde40ba3608a68735ec744806ab12dbb387d3e72e9563f54346d9c9e358f5c85783163cd95f7195f1f865afcd8aeafed4091117377c2bc04953dccfb3443a4e0e7cb71e1bd25b67a434e6a909d1bb1cea4b2e4c18faca351ebd6b268d3f46e2c1405d2c0071f13ceedb3e273f60d393fb390b938fb6cb61e36c1bdf3759c89e2dc66d2780d2c3ef95b529a740ba31c70805866f5850a057ceeed413be2d71a488fb12e02064806d8da0e373e23dfbba811421c5477ad206558e73873cd562e0f7c9e10d5665a21ea5e0e4440eb24020999411a1a88ff168a5b3cab6a1bd44da5cb8c2650a936e97d188cb7a9a099d45160c980b4253699880f1d8993969960f21cef231f1196d41ccd1bc65cc3aea3fe6b8dae9e505779957d1bcbcfa9283cbefcb400ad7a3f21583c7876ded7d1f2b76f63a9e5eba190daa48d2276d01df477699920654f4a0d61dfbef6b3078f312bb2af179cba1f401da9ce8306c11eba4f32172f2e9c7a466089da567f98e2f0dafe790ca6e8f431c7ead6fd587f3602ba03316f41906ba2f904ccd6da02efadc9d27c2e66e230fdea4e7f15995846212fe0d0237efb1a3317f18f67dcb6b68612ff7ba94b2828b6d9a8bb3ead7cc0e9239de4b021a76c035d089c98fcb1036aece60274e553f5eafa7b78da1ab93ffe14cbfa82ed15b36a28cc5291d1be219c509b9292a89a62587d12df04e1c3a00a3dd82404f6c8081a1a36d341a05416c23bac92b3a5e56530dde1ad11678bec1d17a8d4aa62b0f53d0cad93b31486bdc934467a53473a3b30a6c8e1e6474058de62853fb575cc38ce6705db0bcc8161b23182db75b1bafe4aedfc48a64b9eb5f20f0fbe52882722929ee4fe5eedc7eed9e2bc708a0884dbce7ace26788bfef568690c5246929df253415e35d3c5f72f23534b24a4d7144c604826c1b81b1db7d09595445deb8ca8bb3128a91fa2b50a04c5d2c591a32b9e7c2eeeb3f83bd124d2aa28c24ba06a3be7949d9b2f24aab5f0acc4471dab8e5d7a3a2ec6900e993af64743c88a721182ff364d05ece5bdc5b08e6d22e007f71b3049060d9e74a8c86a2c11c9a498e0a13b227b5a1d38c18f481b8ff4887ca3f87d72f17f470f0682163ed9cd6819f0075f8edc35fdfc8b8df5b658b2ff2361d78f883948fdcef8c46394b07cdafc7e13a85923808b96e124ba3f3c15e3daac65b0cd848f7e9265e253df10a5fa97589f0b1809c2a579fa42b46d8cae4ca2ef90b81faaa0bdf815f4adc696cd2e0447a6240ae344f5406de1acd7dcb63822343edcf7de70bcb3d3fb968cec6b89f42121be30072d74cf9a5ed38344bce107faccb6650fbbbfd0c16f5946ecf1e43e2d620f05f94523812ec20fd113256924a49c03d27b8af39e5abd6003de2398ae1721468ef6f590a2fe4704c8b3622f7cb30f6d3db562af453bdef5a15e90a1db222a3331d86dea553b3eeb69a7bb04ccb1a77ae3eda9f799f9aab2d60030162fe8a745760f8a7bf812716efc414eb2bc1fdb01daf7b640a73c8992b1a0db9004e6cc005beadb2abbe08524ff274325755ec680cb2838625f36eb629263311cabe2c67ff790c63fd2a9281e0061d45bd00c896cfcb52b2a3156175a5d3227010da81c9d65a36dc544b5ef28e430ea04583f884cfcecd99c45a93c542207823bf46af2a5d2c2ea4d3e15963d2958622d44e26c0faa88ad7913758c5dd3419735083a8d6bab535e9977cf9b4215c7770a6909fbecdd2c61d12286973b1c2369b80716f7ed52084f50facd8e00bb38830abcfa77796d50bf10ae5acedc9a0d014dbc157e4095e6c515544f40a4c866f043cd79ae4911f5c0a9bb8a0dd9142be36b7ef8a93c087f0ccea24ffa47872d1ddb947d62e1743caf99052308b8b2c4cbc0c44f0f115ed0e4abfe7cfd080fe490e3972027050659895fc3845aa136b8cbec161699f90c15456123ee8f06e286ebbdb09450496176e7c54654bf66e7cdc9fe4be75c184922b327b5bf5bcdb300315a72e527a4d6bea12cbe191973e9611bd6827be7d1708d78607d7a636b8037eb5ce85a2bc02a62318cb32069655ddf42f985e3fd74197d3e27636629e9ea719e3a2498f29d164c0156af6c6d51e8e2e57b520f3df6d01221b23f04236f07c26b9bfc45f3efcbd2c4f334e6640aed26c2772bdea8b7709ad57eab0d2e521156ee194878dbd3404196a5d6b3a88781ca5b2e613f78a442672951d87d89defc399508000afc7ba79362ab295fb00e25aac5cbe2c5b3e1e869cd42974c27c16c24e43873c3bc4cd6b17029d7dd629e56a0867c15b15368dd6433ee8b027fb448f1cd98adbd917dd6a61cdf6ade916507129d0b9667e9c648fbe2dfd7b7b3bba83680860e26e9271fff636a543f520d7e9ea046313ee5739fa1d96d1d333e089b3c868135490ca2f9a8efd7a768dcf5ceb144973fbeda2360e0921435eb3e69c7222b22f61f40fa3934a76f8d7ab0872c1182abe2313658407401461c9e955192c2e73dbada5c2ae3a9ae776b6b58557699fe5ff6feebc6b2b61ff318cb238d635f54076997ee53301e03e8f4375af193b89bf653d5e47726aeeb0e657205be4f08d4c4386d2c45d0b4484bd86fb8960255f1ac2f07f84e83e6e45d68a7506b36a8b572b66a3f2132978a7b9d5618c1ce7d72905df21452239bc6c47918723b0556e453e5b40a755eae1dff6898db83e02c5d3c8146e9a9fcd374bf1f5526188224fe2178f9495e02e894f802d060767073f744d51d383807f4ab61d7513761e20f7247766843fbdd1901ace177e474c16718ac97cf4208c83f0a13b6366fbf7caa7f053b8ff84b9a48b5d868e54226379110771a52378a1cec5c5d2ed94863976d6c059109e60d06e190cf5f26027eb2aea979b992abdca86c1a2be1ced6e88d51e6d6ba12bf1628f432c3138220716cb648d9fb671bf7c06e45674f2e11457331e2b08f4662fac338059a7ac2c3ee91348426c36653fc680266775ffbdec0686df1ede212f7c41148ea1943ccb24d91f92fd1515f11afcc08162578bbb83a28bc96bb1929c56493ca41ad8811a00405508555836e584cec87ffe67ce267c7bd85346d378dc2913d6f8e9e0edf634bc357e0e0e73ceb21c7d03b2c343a91dc9b64ac7b18815a0ef9782e734f49ef9e12787b9808c9c1216010f78caf613c3d668effb65a394d18bed51e74e2579b76d219a6156d255631378d289d802ca0fa5cb8272e9e038947898056b09c80d6b6f247a3ad34868d75bed05ebdf29d3eadbb492feec2b645a5759833c194ceb495a9d1f9269594361006cb0868ae51fbf79397e94ef93c51452c67cdc2e20fa54d6705ddc4f1b5aeb36ed48e1229101466b188623f012f8147a61679d1e2a841455a66cde8dcddd9ba7a314c02d4675a15ace60089793fa251cdcff10a5cd3bd5be2b4a2fa80fda0fc038ed8a71f9ddfef0cea14bdb2afa438f124c3c84625887a2dbf2153653fdc468811bce7456f4a99f478da975b266e1dc9425bc8825d0c605a0df4fa6d2cd38daac03c978bb184f4f506cc614c034f2fcf7e0050157ae51c69c3bb810d43d339fc23843dca08702d9bc04b2f1eb6836929cc753b7df093216e440cfc3bd64b814c24f22e01d3e2c8c6748f2a1588726a8eb07d4025e7020014c3e5c7be04cf0de48fabf9f8047e314018e724b68ddfc058bc93715df0882388a40ef3a120c67e3188c4ec9c3a734cbad30b7eded7c2b5a4ff93dd483b9ed7056b022bd1acfc39a3c0326b90b980dea7414d87fb9bf402aead046f84f4e8c6cbe5cffbe0853772b0033740287e29308dd5752240f3f8742409295379e38c71138110e81416ac0c3b679c13c424f5e0d81f9d13766cf3fd9f722b00b3f7acdc93145a3bf66cc62a25ef77d4843a97252cf0b91e2432817747ec6dc4b92bc59a457a5c5fcfa4502ba7bf547d428d42a2a19e20f30ecfd500997ac1830d3d5443757cb1326bf9e85b4954f8a9660fcd2e860acf157d95e534f96aa83177f1720531320c97e3d6b9d28b864d2ca15214788f148a4ff0fb2d7dd2f2f49e41937b504af62e445a0cbf174d815a239dfeead4ebbfd2ad072a78500e8839617d72f175845e704ff56c4d7185f3bd967a86e94a203559c4d2174271c1e791c73a555f2ab09067d31c21abfacdb715b2c170fc7c6eb534b93841da63ea8dd6294fddcb80366baa66e7efb75748b22b52639e5a3e0985c01217a56e4212b5397ecc156a5057960879f150176e2edb74ff781e1d49c2939dc36ba8be83fa26e9c4a8418689e9cfeb4a1bd52e84f610938d52891ad2746a281eff73dd41407b87aaa2daf77051d2f19622db165d12566216e247c748bc50140c58ca17b1ad952d7b067270172c8b052c3251138ff5360233f30ce6670c0da3589b330679409be65297967e7e3c4a959783c43519a16720cea6c1b1071096253d0add75e8e3c2bcc81431104928e8ac0e7342bbc484f0b63b45504bb7ea138895d867c6dc320333d38d7c86fe1e15fd07c9a12536f17dd199cbb896af4397c51e50ebf204b7613863a349a485207da8d5e9feb00becaf7a6253b31a765341da794eaa955c56ec8f638df2655fa90bb191bf03df02125520ca385cf40191951df405e552b61b334af9f450e4e93f829f8e58a31b7e9721671242d172145f5ef23c4e0449529e2f640d70df0a3e6385523c35ab7008a8dc9f5bdf98bbdf9ffee667f326d8a5df3d67261e9f246a5d168c1a691ef43d911579a1a59da79d17e599396ec3c86b7c630abb5fc8973bd1585d630ceb5ebe38a51928efea39101c6d3da46768c4de9462fa2dfbfb053683d1c88136f338bf4ddc7c22d7e15fa653e80e29945877b53f2d323e3cb7658cf9f6ab6c6c823a52627f2fd53591e506029855fe02e71f0829f60c132d4708d19571ec1f2b10034f960184c6629e2e8034f31aa000625ebe941610e7e55538aed4d391dfe59c2c2b400482f9ea674c959502c093b9017590e9a42c5b2f8787a4a209683a25b1e0107d20e60c6ae0cd439e744bc7c02306f60c6d5ab6e00e61b87ff9c5ea1bf56b920"}]}, 0x1394}, 0x1, 0x0, 0x0, 0x800}, 0x4000890) sendmsg$nl_route(r1, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000280)=ANY=[@ANYBLOB="1800000000022abd7000ffdbdf257ee37233fb00", @ANYRES32=r4], 0x18}}, 0x0) setsockopt$sock_int(r0, 0x1, 0x20, &(0x7f0000000080)=0x80000000, 0x4) 2.710177833s ago: executing program 1 (id=4378): r0 = accept4$phonet_pipe(0xffffffffffffffff, 0x0, &(0x7f0000003c40), 0x80000) sendmmsg(0xffffffffffffffff, 0x0, 0x0, 0x804) r1 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r1, &(0x7f0000002a00)={0x0, 0x0, &(0x7f00000029c0)={&(0x7f0000002940)={0x2, 0xa, 0x7, 0x7, 0x7, 0x0, 0x70bd2b, 0x25dfdbfd, [@sadb_x_filter={0x5, 0x1a, @in=@remote, @in6=@dev={0xfe, 0x80, '\x00', 0xc}, 0x26, 0x14, 0x9f12443852f025ca}]}, 0x38}}, 0x4) r2 = accept(r1, 0x0, &(0x7f00000004c0)) setsockopt$TIPC_DEST_DROPPABLE(r2, 0x10f, 0x81, &(0x7f0000000500)=0x7, 0x4) r3 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r3, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000001c40)=@newlink={0x20, 0x10, 0x401}, 0x20}}, 0x0) socket(0x10, 0x803, 0x0) r4 = socket$inet6_tcp(0xa, 0x1, 0x0) r5 = socket$nl_generic(0x10, 0x3, 0x10) r6 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$TIPC_NL_LINK_SET(r5, &(0x7f0000000540)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000380)=ANY=[@ANYBLOB='8\x00\x00\x00', @ANYRES16=r6, @ANYBLOB="0106000000000000000009"], 0x38}}, 0x0) setsockopt$inet6_tcp_int(r4, 0x6, 0x13, &(0x7f0000000040)=0x100000001, 0x4) r7 = socket$nl_route(0x10, 0x3, 0x0) bpf$BPF_GET_PROG_INFO(0xf, &(0x7f0000000680)={0xffffffffffffffff, 0xe0, &(0x7f0000000580)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, &(0x7f0000000080)=[0x0, 0x0, 0x0], ""/16, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, &(0x7f0000000100)=[0x0], &(0x7f0000000140)=[0x0], 0x0, 0x85, &(0x7f00000001c0)=[{}], 0x8, 0x10, &(0x7f0000000240), &(0x7f0000000280), 0x8, 0xa4, 0x8, 0x8, &(0x7f00000002c0)}}, 0x10) r9 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000001980)={0xe, 0x13, &(0x7f0000000300)=ANY=[@ANYRES32=r0, @ANYRES16=r4], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x41100, 0x11, '\x00', r8}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000480)={r9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) sendmsg$nl_route(r7, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000000)=ANY=[@ANYBLOB="30000000100001006c4789ec390bca4900000000", @ANYRES32=0x0, @ANYBLOB="211000000300000008001b0000000000080004000180"], 0x30}, 0x1, 0x0, 0x0, 0x801}, 0x4000000) socket$inet_udp(0x2, 0x2, 0x0) socket$nl_route(0x10, 0x3, 0x0) r10 = socket$inet6(0xa, 0x3, 0x2) connect$inet6(r10, &(0x7f0000000200)={0xa, 0x4e25, 0x0, @empty, 0x7}, 0x1c) sendmmsg(r10, &(0x7f00000092c0), 0x4ff, 0x0) 2.546826119s ago: executing program 4 (id=4380): r0 = socket$rxrpc(0x21, 0x2, 0xa) r1 = socket$inet6(0xa, 0x2, 0x0) r2 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$SO_BINDTODEVICE(r2, 0x1, 0x19, &(0x7f0000000140)='veth1_to_bridge\x00', 0x10) getsockopt$sock_buf(r2, 0x1, 0x19, &(0x7f0000006080)=""/241, &(0x7f0000000280)=0xf1) r3 = socket(0x10, 0x803, 0x0) syz_genetlink_get_family_id$gtp(&(0x7f0000000c80), r3) getsockname$packet(r3, &(0x7f0000000180)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000000c0)=0x14) sendmsg$nl_route(r3, &(0x7f0000000380)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000580)=ANY=[@ANYBLOB="640000001000370403000000ffffffff00000000", @ANYRES32=r4, @ANYBLOB="0b1b050000000000440012800b00010069703667726500003400028008000100", @ANYRES32, @ANYBLOB="14000600fe8000000000000000000000000000aa1400070000000000000000000000000000bb"], 0x64}, 0x1, 0x0, 0x0, 0x48810}, 0x4000010) sendmmsg$inet(r1, &(0x7f0000000440)=[{{&(0x7f0000000000)={0x2, 0x4e24, @multicast2}, 0x10, 0x0, 0x0, &(0x7f0000000600)=ANY=[@ANYBLOB="100000000000000000000000070000001c000000000000000000000008000000", @ANYRES32=r4], 0x30}}], 0x1, 0xc0) bind$rxrpc(r0, &(0x7f00000005c0)=@in4={0x21, 0x1, 0x2, 0x10, {0x2, 0x4e23, @local}}, 0x24) 2.45657388s ago: executing program 1 (id=4382): r0 = socket$nl_generic(0x10, 0x3, 0x10) bpf$TOKEN_CREATE(0x24, &(0x7f0000000040)={0x0, r0}, 0x8) bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0xb, 0x1c, &(0x7f0000000000)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32, @ANYBLOB="0000000000000000b702000014000000b7"], 0x0, 0xb, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) syz_genetlink_get_family_id$batadv(&(0x7f0000000400), 0xffffffffffffffff) r1 = socket$inet6(0xa, 0x5, 0x0) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r2, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000044c0)={&(0x7f0000000080)={0x1c, 0x2, 0x6, 0x801, 0x0, 0x0, {}, [@IPSET_ATTR_PROTOCOL={0x5, 0x1, 0x6}]}, 0x1c}}, 0x0) ioctl$sock_SIOCETHTOOL(r1, 0x8946, &(0x7f00000006c0)={'wlan0\x00', &(0x7f0000001000)=@ethtool_stats={0x11, 0x3, [0x1, 0x200, 0x200000000]}}) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r0, 0x8933, &(0x7f0000000440)) socket$inet_udp(0x2, 0x2, 0x0) socket(0x2, 0x80805, 0x0) r3 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r3, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000001f40)={&(0x7f00000004c0)=@updpolicy={0xfc, 0x19, 0x1, 0x70bd2d, 0x0, {{@in6=@ipv4={'\x00', '\xff\xff', @broadcast}, @in=@private=0xa010101, 0x0, 0x0, 0x0, 0x0, 0xa, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff}, {0x0, 0xc, 0xfffffffffffffffc, 0x3, 0x0, 0xffffffffffffffff}, {0x0, 0xa00, 0x407ffffffffffe, 0x800000000000002}, 0xffffffff, 0x0, 0x1, 0x0, 0x4, 0x1}, [@tmpl={0x44, 0x5, [{{@in=@private=0xa010101, 0x0, 0x32}, 0xa, @in=@local, 0x6, 0x4, 0x3}]}]}, 0xfc}, 0x1, 0x0, 0x0, 0x24008010}, 0x4000) r4 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r4, &(0x7f0000000000)={0x40000000, 0x0, &(0x7f0000000040)={&(0x7f0000000240)=ANY=[@ANYBLOB="0207000902"], 0x10}}, 0x0) r5 = socket$inet6_sctp(0xa, 0x801, 0x84) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r5, 0x84, 0x6f, 0x0, &(0x7f0000000500)) r6 = socket$inet6(0xa, 0x3, 0x7) setsockopt$inet6_buf(r6, 0x29, 0x39, &(0x7f0000000040)="ff02040000ffffffffffffffff1f2be82db1af0000000000", 0x18) connect$inet6(r6, &(0x7f0000001940)={0xa, 0x0, 0x1000006, @private0, 0x4005}, 0x1c) sendmmsg$inet6(r6, &(0x7f0000002200), 0x0, 0x0) setsockopt$inet6_opts(r6, 0x29, 0x37, 0x0, 0x0) shutdown(r5, 0x1) r7 = socket(0x10, 0x3, 0x0) r8 = socket(0x2, 0x80805, 0x0) r9 = socket$inet6_sctp(0xa, 0x1, 0x84) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r9, 0x84, 0x6f, &(0x7f0000000280)={0x0, 0x10, &(0x7f0000000000)=[@in={0x2, 0x4e20, @private=0xa010102}]}, 0x0) getsockopt$inet_sctp_SCTP_GET_ASSOC_ID_LIST(r8, 0x84, 0x1d, &(0x7f0000000000)={0x1, [0x0]}, &(0x7f0000000040)=0x8) getsockopt$inet_sctp6_SCTP_RECONFIG_SUPPORTED(r9, 0x84, 0x75, &(0x7f0000000080)={r10, 0x3}, &(0x7f00000000c0)=0x8) ioctl$sock_SIOCGIFINDEX(r7, 0x8933, &(0x7f0000001800)={'wg2\x00'}) 2.308635675s ago: executing program 0 (id=4383): r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000980)=ANY=[@ANYBLOB="540100001800010027bd7000fddbdf251d010400080005004221fb051e01060006060302ff71ec6d721744cd5200080000f8cfcad4c4ec6111ec028c5028564abce83afe14c93e15e556c2baed7f897fe841c155a2b2a4b9f3052995cdf66a9c7922ff0300005b6c67281d1519cd7c32c2bf7563b9652575505da99ea128d37616896be8764a2c78edbad5bde7a5e405bda693770338925f824bd246893d221a5568fc3aaa9ad0d7766d8ea8d3bf1006e3df494e2f373148ecb4adafdd39874e9808b118301f1e76054a64c6d243523f5de7b347f3b752e105d0ed18fae7289635301ebd8949268090b3bcd4cbed5f1cfe93cff41a9630802f96defe9e8ea850529827c5e301953a8abaafa1f121e590f74e28233f4129d4587eee87ec5d42c3ef0619022c03551cdd9226016700000000000000000000000000000015000300030000200503000054831bdbae1d82b306"], 0x154}, 0x1, 0x0, 0x0, 0x5b10df4d84c3f683}, 0x0) (async) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) r2 = socket$inet_udp(0x2, 0x2, 0x0) getsockopt$sock_int(r2, 0x1, 0x4, 0x0, &(0x7f00000000c0)) (async) sendmsg$NFT_BATCH(r1, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000100)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a05000000000000000000050000000900010073797a30000000002c000000030a05000000000000000000050000000900010073797a30000000000900030073797a30000000005c000000060a010400040000000000000500000008000b40000000000900010073797a300000000034000480300001800b00010074617267657400002000028008000300d614404208000240000000010c0001004e465155455545"], 0xd0}}, 0x0) 2.195059482s ago: executing program 4 (id=4385): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) sendfile(r1, r0, 0x0, 0x401) r2 = bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0xe, 0x4, &(0x7f0000000540)=ANY=[@ANYBLOB="b4050000fdff7f006110580000000000c60000000000000095000000000000009f33ef60916e6e713f1eeb0b725ad99b817fd98cd824498949714ffaac8a6f770600dcca55f21f3ca9e822d182054d54d53cd2b6db714e4beb5447000001000000008f2b9000f22425e4097ed62cbc891061017cfa6fa26fa7088c60897d4a6148a1c1e43f00001bde60beac671e8e8fdecb03588aa623fa71f31bf0f871ab5c2ff88afc60027f4e5b5271ed58e835cf0d0000000098b51fe6b1b8d9dbe87dcff414ed000000000000000000000000000000000000000000000000000000b347abe6352a080f8140e5fd10747b6ecdb3540546bf636e3d6e700e5b0500000000000000eb9e1403e6c8f7a187eaf60f3a17f0f046a307a403c19d9829c90bd2114252581567acae715cbe1b57d5cda432c5b910400623d24195405f2e76ccb7b37b41215c184e731fb1"], &(0x7f0000003ff6)='GPL\x00', 0x4, 0xfd90, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @sk_skb, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x366, 0x10, &(0x7f0000000000), 0x1dd}, 0x48) r3 = socket(0x11, 0x3, 0x0) sendmmsg(r3, &(0x7f00000000c0)=[{{&(0x7f0000000640)=@qipcrtr={0x2a, 0x4, 0x4000}, 0x80, &(0x7f0000000180)=[{&(0x7f0000000140)="d479183d7d98d181a4b5f3e38100", 0xe}, {&(0x7f0000000300)="d80b4a35784e5b04f3dda101257c0fbbdd695e7caafb88add238f12f007969b87b4f62a8b266a0f7bc9249850a9e511baf796edde094c6eda7bd4f4972b95cd4d0dd36af1be4e80bd01b3b08145f2287b4a2f1bddf064ace6823b2fe00d00000000000000000000000000061b98bba20b02e8af10ae54199d9add301642109121ba29a16a5088f2158948c595e1be9b4be8cbd94024e1fd8b43b0fbf76c85a897320598988b13934e7fd41fd24e5d57cf822b31786ebcf0546a0d87021a8d0bcbed1d5164833310ce54cc827e973fb6e55eb18c7b58e8ae16378e971f96accded32cd414bde44170df4e747c43cc616be28a0dffe9982cd2c64f2c92dd95", 0xfe}], 0x2}}], 0x1, 0x404c011) r4 = socket$netlink(0x10, 0x3, 0x13) bpf$MAP_CREATE(0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="0f000000040000000400000012"], 0x48) r5 = socket$kcm(0x21, 0x0, 0xa) sendmsg$kcm(r5, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000240)=ANY=[@ANYBLOB="50000000000000001001000001000000000000e0ffffff001000000000000000100100000e000000706ecafcfeec437201d7ac65086ef1f2bdd1ae6d433fcc1f386873fe6c5b4ef4ae6415bfe9d637366f367d601e6ac9284652ee2bd4e6568a7ed6b5746a80a79858480cdabac6a83bd3b871d9806840277f64c1647584645e14e82a375bf31c374ac3a68b904f164ab7aaf0dc4b8b6823536f5171bba83952de92ffc5356653e2208d6704d5"], 0x28}, 0x800) r6 = socket$inet_tcp(0x2, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r6, 0x8933, &(0x7f0000000180)={'pimreg0\x00', 0x0}) r8 = bpf$PROG_LOAD(0x5, &(0x7f00000002c0)={0x6, 0x3, &(0x7f0000000440)=@framed={{0x18, 0x0, 0x0, 0x0, 0x100}}, &(0x7f0000000080)='syzkaller\x00', 0x0, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, @xdp, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f0000000140)={r8, r7, 0x25, 0x0, @val=@netfilter={0x1, 0x0, 0x7}}, 0x20) sendmsg$DCCPDIAG_GETSOCK(r3, &(0x7f00000004c0)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x20000}, 0xc, &(0x7f0000000480)={&(0x7f00000001c0)=ANY=[@ANYRES64=0x0, @ANYRES32=r7, @ANYBLOB="000000f300000007000037c8850400"/24], 0x4c}, 0x1, 0x0, 0x0, 0x40000}, 0x40010) r9 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000080)='./cgroup/syz0\x00', 0x200002, 0x0) r10 = bpf$BPF_LINK_CREATE(0x1c, &(0x7f0000000040)={r2, r9, 0x1, 0x0, @val=@perf_event={0x5}}, 0x18) close(r10) r11 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000500), 0xffffffffffffffff) ioctl$ifreq_SIOCGIFINDEX_team(r3, 0x8933, &(0x7f00000006c0)={'team0\x00', 0x0}) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r5, 0x8933, &(0x7f0000000700)={'batadv0\x00', 0x0}) sendmsg$ETHTOOL_MSG_PRIVFLAGS_SET(r4, &(0x7f0000000940)={&(0x7f0000000400)={0x10, 0x0, 0x0, 0x8000000}, 0xc, &(0x7f0000000900)={&(0x7f0000000740)={0x1b8, r11, 0x10, 0x70bd2d, 0x25dfdbff, {}, [@ETHTOOL_A_PRIVFLAGS_HEADER={0x40, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'ip6erspan0\x00'}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r7}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x3}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r12}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r7}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r13}]}, @ETHTOOL_A_PRIVFLAGS_HEADER={0x14, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_FLAGS={0x8}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x3}]}, @ETHTOOL_A_PRIVFLAGS_FLAGS={0x78, 0x2, 0x0, 0x1, [@ETHTOOL_A_BITSET_SIZE={0x8, 0x2, 0xac}, @ETHTOOL_A_BITSET_SIZE={0x8, 0x2, 0x2}, @ETHTOOL_A_BITSET_MASK={0x63, 0x5, "bbefac10158fe1d69d2d161e05fc7fe538acb806fd987ad7488a638f389d508f87a78d0b0a732366b636e213d58581e8331672ac938a1b09d6d9435f0ee5c04fbda18922d25bf70078b105c9455891d083ca1e230ef794ad28f4c42d08ecba"}]}, @ETHTOOL_A_PRIVFLAGS_FLAGS={0xa8, 0x2, 0x0, 0x1, [@ETHTOOL_A_BITSET_VALUE={0xa4, 0x4, "faa1aa23a2347aded4ea7197dee874ffbb10f2f6c0567ed33626eca5b9e21aabce85be0e5346970ecca35df40418d0e91d2e70f51dce97f075ae7d13b8148004f6a70156c606b18b04a3ef15a1028d6579fa7563d6b41742a0ab4862836dc6a6d0c201575e616bb8ef30d810c6782df7498c093eb868c357fb45f237f5ca4258b2aae1107a79598c1b0d20f4b08fda2a326abeb0c27e6a698e677af526135887"}]}, @ETHTOOL_A_PRIVFLAGS_FLAGS={0x8, 0x2, 0x0, 0x1, [@ETHTOOL_A_BITSET_BITS={0x4}]}, @ETHTOOL_A_PRIVFLAGS_HEADER={0x28, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'wg1\x00'}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r7}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r7}]}]}, 0x1b8}, 0x1, 0x0, 0x0, 0x4008084}, 0x40000) 2.186487147s ago: executing program 2 (id=4386): socket$nl_route(0x10, 0x3, 0x0) (async) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x1c1342, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f00000000c0)={'syzkaller0\x00', 0x84aebfbd6349b7f2}) (async) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) close(r1) (async, rerun: 32) socket$nl_generic(0x10, 0x3, 0x10) (rerun: 32) syz_genetlink_get_family_id$tipc(&(0x7f0000000300), 0xffffffffffffffff) (async) r2 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000000c0)={0x18, 0x2, &(0x7f00000001c0)=ANY=[@ANYBLOB="d3a11000ffffffff95"], &(0x7f0000000040)='syzkaller\x00', 0x3, 0x4, &(0x7f0000000080)=""/4, 0x40f00, 0x68, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0xe000}, 0x94) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) writev(r0, &(0x7f00000001c0)=[{&(0x7f0000000040)="89e7ee0c7cdad9b4b47380c988cafb", 0x2a}, {&(0x7f0000000340)="448b7cff000000000000", 0xa}, {&(0x7f0000000100)="301ed9f9a338ef93c403155b88695211f0", 0x11}], 0x3) (async) mmap(&(0x7f0000001000/0xc00000)=nil, 0xc00000, 0x0, 0x3032, 0xffffffffffffffff, 0x66960000) setsockopt$netlink_NETLINK_TX_RING(0xffffffffffffffff, 0x10e, 0xc, 0x0, 0x0) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x0) (async) r3 = bpf$MAP_CREATE_RINGBUF(0x0, 0x0, 0x50) (async) r4 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$inet_MCAST_JOIN_GROUP(r4, 0x0, 0x2a, &(0x7f0000000180)={0x2, {{0x2, 0x0, @multicast2}}}, 0x88) setsockopt$inet_MCAST_MSFILTER(r4, 0x0, 0x30, &(0x7f0000000800)={0x2, {{0x2, 0x2, @multicast2}}, 0x1}, 0x90) (async) socket$netlink(0x10, 0x3, 0x0) (async) r5 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r5, &(0x7f0000000040)={0x2, 0x4e20, @empty}, 0x10) syz_emit_ethernet(0x2a, &(0x7f0000000240)={@local, @empty, @void, {@ipv4={0x800, @udp={{0x5, 0x4, 0x0, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x11, 0x0, @empty, @empty}, {0x0, 0x4e20, 0x8}}}}}, 0x0) (async) recvmmsg(r5, &(0x7f0000004400)=[{{0x0, 0x0, 0x0}, 0x1000}], 0x1, 0x2, 0x0) sendto$inet6(0xffffffffffffffff, 0x0, 0x0, 0x40000, 0x0, 0x0) (async) readv(r5, &(0x7f0000000080)=[{&(0x7f0000000180)=""/53, 0x35}], 0x1) (async) r6 = socket$nl_route(0x10, 0x3, 0x0) (async, rerun: 64) r7 = bpf$MAP_CREATE(0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="22000000040000001000000012"], 0x48) (rerun: 64) bpf$MAP_UPDATE_CONST_STR(0x2, &(0x7f0000000100)={{r7}, &(0x7f0000000080), &(0x7f00000000c0)='%-010d \x00'}, 0x20) (async) ioctl$XFS_IOC_FD_TO_HANDLE(r0, 0xc038586a, &(0x7f0000000440)={r6, &(0x7f0000000240)='!,}\x00', 0x1100, &(0x7f00000002c0)={@align=0x5, {0x1, 0x4, 0xfff, 0x2}}, 0xb, &(0x7f0000000380)={@_ha_fsid}, &(0x7f00000003c0)=0x4}) (async) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(r2, 0x89f2, &(0x7f00000006c0)={'syztnl1\x00', &(0x7f0000000600)={'ip6tnl0\x00', 0x0, 0x0, 0x0, 0xb, 0x4, 0x8, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, @private1, 0x20, 0x1, 0x6, 0x3}}) ioctl$XFS_IOC_PATH_TO_FSHANDLE(r3, 0xc0385868, &(0x7f0000000980)={r1, &(0x7f0000000700)='\xbb\xbb\xbb\xbb\xbb\xbb', 0x8000, &(0x7f0000000740)={@align=0x1ff, {0x400, 0x9, 0x9df2, 0x4}}, 0x3, &(0x7f0000000780)={@_ha_fsid}, &(0x7f00000007c0)=0x3}) 2.132631428s ago: executing program 0 (id=4387): r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000100)={0x26, 'skcipher\x00', 0x0, 0x0, 'cts(cbc(serpent))\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, 0x0, 0x0) r1 = accept4(r0, 0x0, 0x0, 0x0) r2 = openat$ppp(0xffffffffffffff9c, &(0x7f00000001c0), 0x101042, 0x0) ioctl$PPPIOCNEWUNIT(r2, 0xc004743e, &(0x7f0000000100)) ioctl$PPPIOCSACTIVE(r2, 0x40107446, &(0x7f0000000240)={0x2, &(0x7f0000000000)=[{0x48, 0x6, 0xbc, 0x80000066}, {0x6, 0x1, 0xfb, 0x2}]}) write(r2, &(0x7f0000000280)="73a3", 0x2) sendmsg$alg(r1, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001600)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18, 0x24008090}, 0x40000) sendmsg$nl_generic(r1, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000080)={&(0x7f000000a1c0)=ANY=[], 0x3bfc}, 0x1, 0x0, 0x0, 0x4000}, 0x40040) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="18000000000000001001000001"], 0x18, 0x68000000}, 0x0) r3 = socket$kcm(0x21, 0x2, 0xa) sendmsg$kcm(r3, &(0x7f0000000080)={&(0x7f0000000100)=@rxrpc=@in6={0x21, 0x0, 0x2, 0x1c, {0xa, 0x4e23, 0x0, @private1}}, 0x80, 0x0, 0x0, &(0x7f0000000180)=ANY=[], 0x18, 0x68000000}, 0x0) r4 = socket$kcm(0x21, 0x2, 0xa) sendmsg$kcm(r4, &(0x7f0000000080)={&(0x7f0000000100)=@rxrpc=@in4={0x21, 0x1, 0x2, 0x10, {0x2, 0x4e21, @dev={0xac, 0x14, 0x14, 0x28}}}, 0x80, 0x0, 0x0, &(0x7f0000000180)=ANY=[], 0x18, 0x68000000}, 0x0) recvmsg$can_raw(r1, &(0x7f0000000840)={0x0, 0x0, &(0x7f0000000700)=[{&(0x7f00000000c0)=""/35, 0x23}], 0x1}, 0x1021) syz_emit_ethernet(0x4e, &(0x7f0000000140)={@local, @link_local={0x17, 0x80, 0xc2, 0x6, 0x5}, @void, {@ipv6={0x86dd, @generic={0x0, 0x6, "182325", 0x18, 0x2c, 0x0, @remote, @local, {[@routing={0x8, 0x2, 0x2, 0x9, 0x0, [@initdev={0xfe, 0x88, '\x00', 0x0, 0x0}]}]}}}}}, 0x0) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000400)=@bpf_lsm={0x6, 0x4, &(0x7f0000000000)=@framed={{0x18, 0x0, 0x0, 0x0, 0x7}, [@call={0x85, 0x0, 0x0, 0xb2}]}, &(0x7f0000000100)='GPL\x00'}, 0x94) syz_emit_ethernet(0x46, &(0x7f0000000880)={@local, @link_local, @void, {@ipv6={0x86dd, @generic={0x0, 0x6, "182325", 0x10, 0x2c, 0x0, @remote, @local, {[@routing={0x89, 0x0, 0x2, 0x1}, @hopopts]}}}}}, 0x0) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000040)={0x5, 0x4, &(0x7f0000000280)=ANY=[@ANYBLOB="18000000ffb000000000000000000000c600feff0000000a950000000000000043e96cbece53bffb00dec8be8ba5c57a36d472b6e2442edfff4eda3afa8b5d9edd2b29cedeb2eb4753a7d72d0d587e7f3d82ad2cd9f93d3865429de11f38b5172282f3dd9850f8a0be1ac3f27b5f33f157de4f09247186b6cde3b71eaaba88ad392fa2994ae2fe76079ef3775d311c555772d2ab2986234a2c744405b2db9b"], &(0x7f0000000000)='syzkaller\x00', 0x5, 0x0, 0x0, 0x7000000}, 0x94) 1.986617663s ago: executing program 3 (id=4388): r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$ieee802154(&(0x7f00000006c0), r0) r2 = syz_genetlink_get_family_id$netlbl_calipso(&(0x7f0000000040), r0) socket$inet6_mptcp(0xa, 0x1, 0x106) unshare(0x20000480) bpf$PROG_LOAD_XDP(0x5, &(0x7f00000000c0)={0x3, 0x0, 0x0, 0x0, 0x8}, 0x94) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='memory.events\x00', 0x275a, 0x0) write$cgroup_subtree(r3, &(0x7f0000000080)=ANY=[], 0x10448) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x2000001, 0x12, r3, 0x0) r4 = socket$kcm(0x29, 0x2, 0x0) ioctl$sock_kcm_SIOCKCMATTACH(r4, 0x89e0, &(0x7f0000000040)) sendmsg$NLBL_CALIPSO_C_REMOVE(r0, &(0x7f0000000100)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x2000}, 0xc, &(0x7f00000000c0)={&(0x7f0000000080)={0x2c, r2, 0x2, 0x70bd2b, 0x25dfdbfb, {}, [@NLBL_CALIPSO_A_DOI={0x8}, @NLBL_CALIPSO_A_DOI={0x8, 0x1, 0x3}, @NLBL_CALIPSO_A_MTYPE={0x8}]}, 0x2c}, 0x1, 0x0, 0x0, 0x20000000}, 0x80) sendmsg$IEEE802154_LIST_IFACE(r0, &(0x7f0000000780)={0x0, 0x0, &(0x7f0000000740)={&(0x7f00000007c0)=ANY=[@ANYBLOB="14000000", @ANYRES16=r1, @ANYBLOB="030725bd7000000000001f0000001e9febd23f69cf300c4d38acb6b8ddc37c5ac4d92d129475e40873fefcc457115758083509ac53774177eb911e3d1a164c1bea94efedab05a2"], 0x14}, 0x1, 0x0, 0x0, 0x2000c094}, 0x0) syz_genetlink_get_family_id$nl802154(&(0x7f0000000280), r0) 1.874051466s ago: executing program 2 (id=4389): r0 = syz_open_procfs$namespace(0xffffffffffffffff, &(0x7f00000006c0)='ns/pid\x00') ioctl$NS_GET_USERNS(r0, 0xb701, 0x0) r1 = socket$kcm(0x10, 0x2, 0x10) sendmsg$kcm(r1, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000480)=[{&(0x7f0000000000)="1400000010003507d25a806f8c6394f90324fc60", 0x14}], 0x1}, 0x0) (async) recvmmsg(r1, &(0x7f0000001180)=[{{0x0, 0x0, 0x0}, 0x4}, {{0x0, 0x0, &(0x7f0000001b80)=[{&(0x7f0000000040)=""/116, 0x74}, {&(0x7f00000004c0)=""/249, 0xf9}, {&(0x7f0000003380)=""/4096, 0x1000}, {&(0x7f0000001a00)=""/50, 0x32}], 0x4}, 0xfffffffc}], 0x2, 0x42, 0x0) 1.781407116s ago: executing program 0 (id=4390): r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000000c0)={0x38, 0x40, 0x107, 0x70bd25, 0x0, {0x1, 0x7c}, [@nested={0x4, 0x142}, @nested={0x1c, 0x1, 0x0, 0x1, [@typed={0x6, 0x6, 0x0, 0x0, @str='\x80\n'}, @typed={0x8, 0x15, 0x0, 0x0, @uid}, @typed={0x6, 0xc, 0x0, 0x0, @str='\x80\n'}]}, @nested={0x4, 0x2}]}, 0x38}, 0x1, 0x0, 0x0, 0x48815}, 0xc000) (async) r1 = socket$nl_generic(0x10, 0x3, 0x10) (async, rerun: 32) r2 = syz_genetlink_get_family_id$nl80211(&(0x7f00000000c0), 0xffffffffffffffff) (async, rerun: 32) r3 = bpf$MAP_CREATE(0x0, &(0x7f0000000180)=@base={0x5, 0x4, 0x4, 0x9, 0x0, 0x1}, 0x50) r4 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0x14, &(0x7f0000000280)=ANY=[@ANYBLOB="180000000000000000000000000000001801000020646c2100000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000000400000018110000", @ANYRES32=r3, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b70400000000000085000000c300000095"], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$PROG_BIND_MAP(0xa, &(0x7f0000000080)={r4}, 0xc) (async) r5 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='memory.events\x00', 0x275a, 0x0) write$cgroup_subtree(r5, &(0x7f0000000100)=ANY=[], 0x32600) r6 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r6, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000780)=ANY=[@ANYBLOB="580000000206030000000000000000000300000705000100070000000900020073797a31000000000c00078008001240000000050500050002000000050004000100000011000300686173683a69702c706f727400"], 0x58}, 0x1, 0x0, 0x0, 0x4000}, 0x20004000) (async) mmap(&(0x7f0000001000/0x4000)=nil, 0x4000, 0x2000001, 0x89013, r6, 0x0) (async) setsockopt$inet_tcp_int(0xffffffffffffffff, 0x6, 0x10, &(0x7f0000000380)=0xffffffff, 0x4) (async) r7 = socket$inet6_udp(0xa, 0x2, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000600)=@newqdisc={0x24, 0x24, 0x4ee4e6a52ff56541, 0x1, 0x25dfdbfd, {0x0, 0x0, 0x0, 0x0, {0x0, 0xb}, {0xffff, 0xffff}, {0xfff2}}}, 0x24}, 0x1, 0x0, 0x0, 0x40088c1}, 0x0) (async) r8 = syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10) sendmsg$netlink(r8, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f00000001c0)=ANY=[@ANYBLOB="140100002c0001000000000000000000030100800a000400776c616e30000000140002000000000000000000000000000000000150bb2d6f67d29d6fabadb107d0def49c88ea04abde1d5e8d3fb22a1b50467e8bdafefc46b0449ade68bf84b36ec72dd71265fc2e882348c26c2126237dd5b37f5ae655b1086cda40e0f60d431f3884b3f8d750351dc076eb43d9621dc08c029d1608a487f26fbe816b89f7cb81bff81a8b9482565856555ee923c65973deb0a99b962bc0fe94a3fcae3697bd7b85b3a682167c43dbf137115a40ebddcad74875ec58e9a3ddb9ad02a078cf0d972df9e99f079767734f69ce475f55ac64337803f5eb4e5842f4d98fe3fa370d47eb640dc5061dc35817c8a66c29be82fd3f8c00"], 0x114}], 0x1}, 0x20044000) (async) r9 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000340)=ANY=[@ANYBLOB="0200000004000000080000000100000080"], 0x50) bpf$MAP_UPDATE_CONST_STR(0x2, &(0x7f00000001c0)={{r9, 0xffffffffffffffff}, &(0x7f0000000180), &(0x7f0000000240)='%pB \x00'}, 0x20) bpf$BPF_MAP_CONST_STR_FREEZE(0x16, &(0x7f0000000040)={r10}, 0x4) (async) r11 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x3, 0x11, &(0x7f0000000480)=ANY=[@ANYBLOB="180000000000000000000000000400008500000061000000b7080000000000007b8af8ff00000000b7080000000000007b8af0ff00000000bfa100000000000007010000f8ffffffbfa400000000000007040000f0ffffffb70200000800000018230000", @ANYRES32=r9, @ANYBLOB="0000000000000000b70500000800000085000000a500000095"], &(0x7f0000000400)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x2, '\x00', 0x0, @fallback=0x1b, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffd}, 0x94) ioctl$sock_inet6_tcp_SIOCINQ(r5, 0x541b, &(0x7f0000000080)) (async) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000580)={r11, 0x18000000000002a0, 0x48, 0x62, &(0x7f0000000600)="b9ff03075fe9008cb89e08e086dd", 0x0, 0xfe6, 0x60000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1000000}, 0x28) setsockopt$IP6T_SO_SET_REPLACE(r7, 0x29, 0x40, &(0x7f0000002880)=@raw={'raw\x00', 0x3c1, 0x3, 0x13c0, 0x11e0, 0xc8, 0x8, 0x4000000, 0x5803, 0x12f0, 0x2e8, 0x2e8, 0x12f0, 0x2e8, 0x3, 0x0, {[{{@uncond, 0x0, 0x1198, 0x11e0, 0x0, {0x0, 0x2000000000000}, [@common=@unspec=@string={{0xc0}, {0x0, 0x0, 'bm\x00', "cfcaf80c672f61cd17ae5119b5135c2aee68d23a465cd431e1ecef50c3234e082555f67222476147864fa03182f5df11d8c348cbd06dc8de1dcbde7d4e252c3394fed47bf78c70f607b0178fa5ea335019ac07a602061c96baebc989f1f35a214e67262c1fe4b124e0f7323a587d2a1fcfe36bbf12eca0a7b66c60c527bac2b5", 0x2, 0x3}}, @common=@unspec=@cgroup1={{0x1030}, {0x0, 0x1, 0x0, 0x0, './cgroup.cpu/syz1\x00', 0x0, {0xfffffffffffffffc}}}]}, @unspec=@CT0={0x48, 'CT\x00', 0x0, {0x1, 0x81, 0x8, 0xe, 'syz0\x00', {0x1}}}}, {{@uncond, 0x0, 0xa8, 0x110}, @unspec=@CT2={0x68, 'CT\x00', 0x2, {0x0, 0x0, 0x0, 0x0, 'snmp\x00', 'syz1\x00'}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x1420) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f0000000680)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_NEW_INTERFACE(r1, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000001340)={0x3c, r2, 0x1, 0x70bd28, 0x25dfdbfd, {{}, {@void, @val={0x8, 0x3, r12}, @void}}, [@NL80211_ATTR_SOCKET_OWNER={0x4}, @NL80211_ATTR_IFTYPE={0x8, 0x5, 0x2}, @NL80211_ATTR_IFNAME={0x14, 0x4, 'team_slave_1\x00'}]}, 0x3c}, 0x1, 0x0, 0x0, 0x81}, 0x240048c1) ioctl$FS_IOC_ENABLE_VERITY(r0, 0x40806685, &(0x7f00000012c0)={0x1, 0x6, 0x1000, 0xef, &(0x7f00000001c0)="c95ed7c6c0163bb60361446c3b35000e0c4909c6cb119ce78005044858c70e247819dc30a524650dddd1dfa7f7d9e09a1d3f33cef04b80648a9ed33312ef286d46a731b7cc134643e4830c9f058db8526daf4ed60c57d9614c5bb4e48498e815311891b5fdfeb783294a02269bda20396a71273f72fd3e5549ed81bde243560b5547d4f7c60187304258418ee00091e1855315b70913df49b1654f2942241b9e04355092292e1bde945a964d729e864eff8ec5555461e82f81f261d2933bb1c5563804f2e5dd89ba77edb20c4d354aa5360121b68d622f22a63e3f254c27a45de270b72a1e1df34bdab48deb5d8282", 0x1000, 0x0, &(0x7f00000002c0)="01c19e6d671e6550654b8368327751abd1e6aa27f54ef3e8392a3c958b2a9cb452b5116f3d93e7ac7ef89fe8fd8721f77a0b1b39e3e9928a9daa29f9bbfc410e887ec686448b7ca14960c13a4e26b4b96318b4488ed23725e6e1078fe16b74483d50e48cf74779889bd0e3a04892ee532caa798eac6b72f60cc17455152dd7e79d1d032509590e68681782d31eb03e3be9141bfb8887351bcf442126fb47bcca75fa9f75b0c7c519ef84db5ec864a29c34f852b924176e92d86b269f71bf6d5d8ff8e2598d3ac45dd207271905ba4b6eff7edca8e372e5eeca27b615661ffa04a22b01fcaa2de7dfdcd9e5c8ea3a8816897e6141bfa322e56645e9a4acda56d543b106dac1bedfcc7a2db3ed6321c0b36d2c357a5bccaa6bf0904ea726dd9a9e2b3fc2d8b76a8d959d7ef82ec81ee3d6be6328bfcddb397426cced605ec25c9376bfdcd7d7b91a70967f9a269c6242b01e1bd3a9c6892e013ee0a0559a3c583e58635142b710f9bb0140228b7faaca4b0ffe672042faa9bdf4d605e4ae54dbf71af7bb15752d71763f658982798d46b31743416932e62bee105ff0636e3cef710ada609c5f1325084fe133499442eeee81410de6b9944ad1b8f41293b03514f173414f2c1a707223765d030eb5a2d8fe128cf69addb685c7836ee148536f2b72ae727b1bfe2c5f67abad6b0c20bb66cefb682d892cec86286dbcd977aa6f8d9ecd9292418a7008710ea8690542b010a7686de022b856187619edcc3a3b63b08508c18e1da9dcbf0c3e83cb006d7d159e90111c4c922e5840a2eab443d3ff20048c4bc658e17319789972f492be413314be94ddd022b16da75cf4021ca9988f4472bd893ac72cd9944dc248d2ccebe72925038b4691abf932e63ed6adb51b5f1c00216ea4b329a728b694be036cd04c560236309fff07b70e20685f447fbb9ccf32deca86f4ae88744fd19a3f8923f6528abf23ef6f96380bea567115b5088b2c3e66cd042d321ce5a29c955a259e89409beccffc988c677fe5eab2193c8c89751c15b200f3ec1fedde064200f892ab1587ca6d04a233472fabccd46654dc86dcc99bdedd50f10675ad481ba1db4d0cc296204cb658f903e1dc3448dac5af0d9fa04bc76d5d7cb3eb7d4107d1f487d1b003e46a718f8fca8a33f499321f6781b8c9920dc67a790d351988b29e7d5c15a982ee8d85fc04597fbe8316a06c151676c6c56f9e8e027de8d50fe1653e6a4bfd70a738e4077297c9249c6a6faf668a1369e8db42b11e4196b1df6c9fcc99f21e8029e03b80ec9ecdf5a3f41dc5c864c215df0d08581a784d8eba8efba7c26cbbea0587900f23b0c755ef27347be1624fb6db01daff68523a4c0de2f1c07f549a2ba5860ffed7f011bca78044af0195a337570244290903a6e46e6c2ca7823fa1b95e7ee5e71eda304dcf69b03ce804b6efe866cd18c83c9611df1669a943ca081dd78198719bc3be6abfdccbd6f03f7f03e64d6726ca1c793fe043fd7d9dae202c97e5a424e24337595e8a5b4120f980227fff699eeff775379e00baed86367d20f61b3ab200a27bf1f3005d0e0bfae33c142f18f604756828278858517cbd7ee3a6e827f4a77897d5a1491cc8eeef53bffec4e1c1c67ed54df09dd7edc5051b2485346d710a5ee4806622409fed9d7e6a4682c2af9a653740ea35b35ef8dd2257f2af30bac6c1d44190d738943706de78743f4fbde9b8fe899ec1f420630b875241229285f89b387923bb980d209c55bb994a3a39a6ffa6a57babec14fb5798da68f6014ce017230e43b3ece74351717f83e473936f932902e70ff3d4333a8e7513d7d66450d427ed83f5cb713470096eeadbafcb8d81665bff1a02696030da6cd2e2e5f48e490163f2f97f8a0713cb36df97d89043cf223e9b5e83eded35814a9084a29de61ea3420b05559674620018ffd36b2cb9754fc40c94dbaa1bce910488ca8711f9e6529c71024d085e1c5dcaaa1445a3a892f6d9dd733ea39a9ef3382a7054718b50b2c9e722bc3f6f7dcfad314baee77f3f776d3304a09cb497206df7cc7ec6081a23ba578aa2c8756fa3e7c6913e3238ae96e423f516a2df347786b15846c254b3dc9af30d705aab7674702e84d4b0c78f4c17e5c38731ff3e1d7f9cd5ca27d773f54a9a9870b578bd6d77e7714e1bc42ea5de9d3f5bae54ff3c770714f4974436e818291c8ad43682f16a77edd73eb78b2034cf74b64bc6ce9baff5fada86bb9f3d0edb44c903ff0468326e170beef7342e70d01ea102caa8cc29b4c47ff76a731df1a84b9b6bf1a42569b15e9c6ad97d30825975ae98617c7fd79a974507f077e00fa0d86bcbe99bd17851eff1522d732533e06f7febb77f49f5af4f3827e7e0eb546338b55e9d1ac17238930e4368018851caa1104376ec9ec5c86cfeaf8afb316a6d9013ac9698d3349d0fc3823c70424b43afdb1f85f4524acfed85e6aacf83382e3fbd049233f3764a92190d412900cd37cbfb3660c69af9a59bf5de0fab10b33a266275ce7ea863015f85658d0eb4df804df769939a145f27172b14dd996f36b6d6d392b53278b0b757d1dd4f42c087da1d3ceee0bed4328d0973cfd9f00444ef6781d6e71c8a35fa303380866244b8b9c858c45b97ded1287064ec061b437223bc06e5543b284f0e2858ee8b947504009b20cea68019384087c2ed3e016ab37825e6e3086beb6ab34962d38856d2e029a341cbfcc407a45a37e37f9c2ed6172d60f986fe82b5288d88df7cf7091e87b3e625a3931e6551f6da30f4620b4494571f3884a576059d993498b724dabf3eff483b2f7a289c5cff2520bd698e0db34d90b83a3be3befd5e14912d78a0a861ac6ce358a3856c1ee69f04a55ef3f3e8f0f40a6ab32f73cc455483751d861843b8dbc2160cefeca0307f258d7fb0c90b6922156cd93682dbf1664964c3747e922bcc79b3c72cb82909fe1925902cddb4944a78e864552e02b661ba3a5f2608ea0777988115049b260ac4570bf47baddf512a7ed182c80fc543778b291aacf9e1b27f6b5ae490b32f6302bf9c2574ad9f208b70565197ea902617c67a785f3539272e70adb1a41ae0648ed01e72c564ae24f2a741cf65f675bc6625dab4ca9fa735ce62c32fcaac6aed0c804af014fbc7d34f521747b98817af93450a72928e9d0905b89900254ea035de3b882f05e960166b1425ca4ca0ee4bf1784d308ec1ee22cd7c6fba85d86d4c973c790e64f50c9961cb817364f7a5b1f5e26da6e645bd890037805652f53c3843030d704ef185d4cb8759afe02389aff40262fec1fc0cbb45419b612c8051c8764cf43347acacd2e9d00be7bba203bc230b5a4f91f9157f8f81d8aeff4ed39eac3fc9e56fd9431069ec67ffbd689c858f2ae41aa85a2d2c4893116b972837dd6f8c69c28ae2b0b88511208d5c416a8634e00edee6fb87bd5d7a511426c9779a99e79f6a7ca324a1a90458c93cd91510980f5780b77e1d767cb602d9ae361fe520522cf6f83dc3643cb3b6ff5719ba9245fb0bdf6618fc63f31ef89761f1c99e7280830bdc4506c2f0e8c005eb8f01ea97b1c3df01e51303583611e9d1f0fb252e71147c07a5ef4e1c547af26fae66f62c1333822deba9f2bf055ea0d8b5ee7fe1ea4479eb7b9cddc184ddf75cef8e71d1fb28e82f8cf1ce10fa01814b3c23afd0b16bf10c754a9d73807d7e1f29df665aa4c595dca85919b641749054d989a2c0c8694d4279e90a8afa350722cb942722215c50feb3911ed280f956eb5d991cab1da995e4b3c44f42b56c48ee72199d27d34fdd401c0e7c3139d94c45864a68a05a703abc9a90d23545dea6422980d955d447c67266ab9b392a1a5c6562e3da68a404d32e96cf47f54d38cbe874799671496cd8efd9ef42cf969747b2877dbc52e1207f8c063988d4496f8f82f217e165ecf8e340166d35339d9a6420ccf490bab6248943b00905aa990676e047ac614b0925df1caedbbdb1df83449eda9b72767704487ef4bff844d64c1828ef6581c5ec5cd7078884a1955b850345fc246dac592a2dd290a25ce335c54d22398815271ee2f9b3fb981719e33a03578d7676a2d3b22a8be941bae437b4d888f98a7e852d6f50920003e9410a5187fc5e04d72a3091ab4283885da52b2fd97a740d8d1e0e1c6b92f06e0a91dd1798c93f3a90ea1c07968aedeff74d3d2194ef49426d73faa90234d11a20530df3def516c72c181ebab69fb5761488a029d7c502e873044dbeac2e5bc218db06b9d0f42051e823da0cf6bba0917554ef23f4891d0db29c61c0067b13c39602255e9559fa8db1c90456758665b7163a8b67d63d35dd8da01237db08612686bcad72b5acff2dcdb477ff1e1cdf12177068dfdb5e586de16d81566a617b58b2173d6dae09f28ed70148f7381c0e4b758a5560719347e6bc1f70382c12e593fb93f41f973e1d5fb7863b9aea9fa24ab56b93d5aab1bd84a38ad656df1635dc00c043d78d8e77786c68caa75acb2eddc46e1f01ad778bd0d5d35218c13733529857a7ad7b159d24dd3f89ff29e1dc8ee28b0f5c37c2a8a69434b0b2e33fe306a539c1ce756d78ec0236dd48ec7c1ddca41a881516aa893dea4e756fb86a30d3499481f715355f1e9491ade2a260f3ab05cd484ea7420ebe79bb73b84d13c91cc3ae2d3c697ad385ad0d0d9b7da10be5f8dbe1cca1bfdad3e28510cac9dc3201f04154e8cc39210f4531a4e56571d7a81cd4f5795b2926969f172150eff70c21e2ae08af9262dc15bfc28e01e2709a042cfb87cdf0a021d3f3c3fa2c384f8a437e1225ba803d87d7a17243fa7cdc1cea3e949a6affdeeb7eaac0ac1bb6997b5ffb95efd874844d30fa1a8f1ed4d4d52e20d60c5b007df4f83e58c4a1aee250d07220f32247aa9cf87d2ffd80ea51da9035ce1cf5cfb59eb34bfb2283b22479f3a7c5c613b3c5391f4867e7da3dcd809eeaddee9a566ef8f67130a52edbec7f071eae6b101274ae61681ae020b13cf28d7975c45a718943ed3ca2ae187493cffd3ce2e5e017e77c9ea895c20a423a03c16900d0c12bb2bc41f9a8b60fd04fbb2b3906cfc0c1b78707eb0140c76a7f534689916a2badce22951392f05113c033ef83228ec56d7b7b0eba7a23170b8f898175d1d1fc38af6f8eb22083957cf6333007525a1d27ea2ed29cf81a6fb39e06a07d0a7afbf8b51a1578b3a91e02dd03a3a6ec074f17ff0cb83222c0ca3796ab92d06374ca37cdf12e9d7c70fa7f502c87455e44ba65f20ccbfa8650fdbebc2ec55bc88164b58e915818ee682a92cfe5d52329edb333ec14553987960c22546e2e5f3b9b71c47149dcaa1fbdc6f172a9815e2db57b29cde7645f3cd8fffa0ac944753db019889d458434bb33a158e58e8be520233f700fae202cc6a2d7f95121b1894c3f1ca3c08d11d35847a6492640a9fb2bcf452ea49ebf78d7f0a38cee2b5f46c21be56a4bf571556170f9319b539cdb0b887f610dedb727c07593b1076b38bdcb7135077b3af4ca2d32702bd5ac4d30a20e3a770c341d9bc0bc003688dc2c0ce81efbdc01bd1058adc3e44be5a0f7e1d1f247351ac460471c990e8fda851f779c6563783d95abd05372b0c243b78e41d813062c13e2b1f12c7d536b1a545883cc2b345b86c6008ff5b3894c4800add8808201a23d6632cb5be8e406afba236abd94ec921e6bbe15e6a24da59eb36ac34f140ff512a143f6393d929bc6a0ca586b89b6f91dc625bd23dd86e24bdb3c646960f8c32496c2b4323b1df23375c3590215f2f50ec2"}) 1.685229126s ago: executing program 2 (id=4391): r0 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$XFS_IOC_FD_TO_HANDLE(r0, 0xc038586a, &(0x7f00000001c0)={r0, &(0x7f0000000040)='\x00', 0x40000, &(0x7f00000000c0)={@align=0x9, {0xa4, 0x7, 0x400, 0x100000001}}, 0x100, &(0x7f0000000100), &(0x7f0000000140)=0x10001}) bind$alg(r1, &(0x7f0000000200)={0x26, 'hash\x00', 0x0, 0x0, 'sha384-avx2\x00'}, 0x58) sendmsg$nl_generic(r0, &(0x7f00000008c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000400)=ANY=[@ANYBLOB="5c0800002c0007012bbdd3c800000000077c"], 0x85c}, 0x1, 0x0, 0x0, 0x24048011}, 0xc000) r2 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000c80)={'veth0_to_bridge\x00', 0x0}) r4 = socket(0xa, 0x3, 0x87) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000080)={'gretap0\x00', 0x0}) socket$inet_tcp(0x2, 0x1, 0x0) ioctl$sock_inet6_SIOCSIFADDR(r4, 0x8916, &(0x7f0000000000)={@dev={0xfe, 0x80, '\x00', 0xa}, 0x78, r5}) ioctl$sock_inet6_tcp_SIOCINQ(r4, 0x8936, &(0x7f0000000000)) sendmsg$nl_route_sched(r2, &(0x7f0000001200)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000840)=@newqdisc={0x2c, 0x24, 0x4ee4e6a52ff56541, 0x0, 0x0, {0x0, 0x0, 0x0, r3, {}, {0xe, 0xa}, {0x4, 0x2}}, [@TCA_INGRESS_BLOCK={0x8, 0xd, 0xffff}]}, 0x2c}, 0x1, 0x0, 0x0, 0x44010}, 0x40000) 1.68303313s ago: executing program 4 (id=4392): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = socket$netlink(0x10, 0x3, 0x10) bind$netlink(r1, &(0x7f0000514ff4)={0x10, 0x0, 0x0, 0x2ffffffff}, 0xc) (async, rerun: 32) r2 = socket$nl_generic(0x10, 0x3, 0x10) (rerun: 32) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000340), 0xffffffffffffffff) (async) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000080)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_TRIGGER_SCAN(r2, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000005fc0)={&(0x7f0000000000)=ANY=[@ANYBLOB='D\x00\x00\x00', @ANYRES16=r3, @ANYBLOB="01002dbd0600ffdbdb252100000008000300", @ANYRES32=r4, @ANYBLOB="0600eb00000800000400ec000a00060008021100000100000600f70000ff000008009e"], 0x44}, 0x1, 0x0, 0x0, 0x4048020}, 0x20000) (async) sendmsg$NL80211_CMD_NEW_STATION(r1, &(0x7f0000000800)={&(0x7f00000006c0)={0x10, 0x0, 0x0, 0x4000}, 0xc, &(0x7f00000007c0)={&(0x7f0000000700)={0xbc, r3, 0x8, 0x70bd28, 0x25dfdbfe, {{}, {@void, @void}}, [@NL80211_ATTR_STA_EXT_CAPABILITY={0x9f, 0xac, "4a4fcfb61b6d70c129a2df4399db64f9b3a5299db604ba5b65124c33666008bca1706b8cebbeda12ef5941cc44b198f49188a0a71eeb723b8dbf66a45d4b8372e3c8c0bb334062ac056852aee8eef50437a453d739b609d9c6e5565daead831adc321d7e69d181ac5e453fda38c4dc14fcf80e4d99660e96623ba0b8040061e6366962f01afb2109e659940de55f271130f0f18a09085460de98f9"}, @NL80211_ATTR_STA_CAPABILITY={0x6, 0xab, 0xb}]}, 0xbc}, 0x1, 0x0, 0x0, 0x1}, 0x40) (async) setsockopt$sock_int(r1, 0x1, 0x8, &(0x7f0000000300), 0x4) (async, rerun: 32) r5 = socket(0x2, 0x80805, 0x0) (rerun: 32) sendmmsg$inet(r5, &(0x7f0000001d80)=[{{&(0x7f0000000280)={0x2, 0x4e22, @private=0xa010101}, 0x10, &(0x7f0000000980)=[{&(0x7f0000000200)="9c", 0x1}], 0x1}}, {{&(0x7f0000000080)={0x2, 0x4e22, @rand_addr=0x64010104}, 0x10, &(0x7f0000000180)=[{&(0x7f00000000c0)="99", 0x1}], 0x1}}, {{&(0x7f0000000380)={0x2, 0x4e21, @private=0xa010101}, 0x10, &(0x7f0000001c80)=[{&(0x7f0000000b00)='>', 0x1}], 0x1, &(0x7f0000001f40)=ANY=[@ANYBLOB="110000000000000000000000010000000b000000000000001400000000000000000000000200000001000080000000004c"], 0x80}}], 0x3, 0x48000) (async) close(0x3) (async) setsockopt$netlink_NETLINK_BROADCAST_ERROR(r1, 0x10e, 0x4, &(0x7f0000000640)=0xcde, 0x4) syz_genetlink_get_family_id$nl80211(&(0x7f0000000180), r1) (async) getsockopt$IP_SET_OP_GET_BYINDEX(r0, 0x1, 0x53, &(0x7f00000001c0)={0x7, 0x7, 0x3}, &(0x7f0000000240)=0x28) (async) r6 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000040), 0xffffffffffffffff) r7 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) (async, rerun: 32) r8 = socket$inet6_mptcp(0xa, 0x1, 0x106) (rerun: 32) setsockopt$sock_int(r8, 0x1, 0x21, &(0x7f0000000100), 0x4) (async) setsockopt$sock_int(r8, 0x1, 0x12, &(0x7f00000000c0), 0x4) (async) close(r7) (async) sendmsg$ETHTOOL_MSG_CHANNELS_SET(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000080)={0x34, r6, 0x205, 0x0, 0x25dfdbfd, {}, [@ETHTOOL_A_CHANNELS_TX_COUNT={0x8, 0x7, 0x1}, @ETHTOOL_A_CHANNELS_HEADER={0x18, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'bond_slave_1\x00'}]}]}, 0x34}}, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x13, 0xe, &(0x7f0000000c00)=ANY=[@ANYBLOB="b702000004000080bfa30000000000000703000000feffff7a0af0fff8ffff1971a4f0ff00000000b7060000080000001e6400000000000045040400010000001704000001000a00b7040000000100006a0af2fe00000000850000004a000000b70000000000000095000000000000008e17f199a68b061b93d83298a8cdda1ce784909b849d5550ad855dab54d8ff07000000000000caa10350e11cb97ce8df1bc9a0c4eeceb9971e43405d621ffbc9b0d8ca56b50f0c010ddb03cf1c62d57c08a90b189d190c341035de53a9a53608c10556e5734eb84049761451ce540c772e069f80cb201b2de17dfdb4b60939d5d6aed4062049b87e03e2cd18a77dda613e0c64497fcc059c062234d5595f6fbaa187b81d1106000000000f0000fd9ac3d09e29a9d542ca9d85a5c9c88474895d679838def0a83a733dc6a39b63a5ed69d32394c53361d7480884d88000000000000000b91c61bd99dc89f12907af7dccd106cb937b450f859ce8292a79c3e40000b5ffffff7f000000000a882add4e1179bd4a44f231a2d73148be428ba953df4aece69311687f4122073a236c3a32efa04137d46f0247d2638da3261c8162bb7c7824be6195a66d2e17e122040e11001131ce319045e5b3334e68475ac3f46aa2837f9004600daded9b19b35eebe52613c346e255421b23a278fd00004270b1cd5fc9aa2286cb0cf127e2a46cfbdf63eea190d86a4d1b75ae98480100bd5828954a7d093a54f7e75b3753508ca3c41685d1e407315e59d626c23b3f89a926e9382966853774e7dd1f1a2177cdf2802237c177d543e8da47a01f05e113e53518270239b69c117e2637c31085f4d8a596b6edab26afaf6605b231199f38a6dc7eb83714387450ea18eafbace8eec18a4b2c442e7b88a7611c1283bec84e1715fb9f4fcaf52c08058fc4f21c0ad71adabdd850aed3eeec6eaab347bdf474e17b9aa345d1e6e3bb83f90230bdf53e7d0e5c3f914d905422b83f30936674ba8f0bffaf2305c0972df71fe5f4e01506471e897bced7798509e64df360d95f9a4099f86438ac2bbcbdbd1d9db21a1d5c065567fd70aae68096827fa5c2d9bd20292344c7dcf6241447cfbb05b5d0fdb4e08afbac5397b64aa369922ed7ed8918f97294b6854210d2b93aaf92159dbaa2f186d4a420c68d6baf1c31de4f0bf478bfd51bb1e96ea849a80ae5a89be7e38474c7aade344d68324f9e12a6b9770e6bd12ae69efffaee58040753701af84c2924c1b5aea1650f42c9ae9820a33095f062fb88313d035ea405515a61a4be64f9fa0985c5be592090cc48291004609fdac2ab6100000000000000a84570c7c00d647daf8af334050b61e9b2d3f0adad1d1ff47be19b8da2799e9ecef8efabe73f92dbd0760f8bbd9c710bd1371e2b5d9a2ea2190f5e4f5cd641cdfe5d89f84a368ef7e6ff1eacdc0ec9e97b8f9c9e314661ea0aa8a104008d188b66b3a4aedeed9df4238a08fc2fb1007233cc2c87fcaa0cccd8ec03444471c1dd660c73acc17bff740d199a7c0c52c63c0408b5158e0000000c275eedb02f141113cf2c55b2c08c2c68cc99d2bb5840fba332e1c82862ec9b90106248f81d32a47ac94ddee815dba8aeb5d3121cf247a81aef7805b020e9eec44cbe3055be69fe066824ba2292b9cdce41635fc00df96fb10a3a8cc60c4a76c65ebbb0640e0a29de94edf5cbefac1c5fa96e7080af804b22cabce10ea52f1018527f4aa39cdafa3eff63de2a7f50d042667820f6f8301e031351ee13013137e9d5cec0c84d7e3f82c6fd12eb98f9ea654bcb9ce59a2015183c6e65bb0537e611b830d74c30fb8207fca0990acdbb51e4e234026e00000000b3ebae3eb52c140953a350fcf0124b1a30b1afc29ea56f8413686d912eb8118d73ef9c6d3843ebcb555301c0205dd3bd9b1d742e334319c8979c322e92fbc2c400"/1423], &(0x7f0000000380)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x49, 0x10, &(0x7f0000000340)}, 0x42) (async) sendmsg$rds(r5, &(0x7f0000003680)={&(0x7f00000002c0)={0x2, 0x4e20, @rand_addr=0x64010101}, 0x10, &(0x7f0000000540)=[{&(0x7f00000003c0)=""/102, 0x66}, {&(0x7f0000000440)=""/255, 0xff}], 0x2, &(0x7f0000003580)=[@rdma_args={0x48, 0x114, 0x1, {{0x80000001, 0x10}, {&(0x7f0000000580)=""/162, 0xa2}, &(0x7f00000030c0)=[{&(0x7f0000000680)=""/1, 0x1}, {&(0x7f0000001f80)=""/4096, 0x1000}, {&(0x7f0000002f80)=""/134, 0x86}, {&(0x7f0000003040)=""/34, 0x22}, {&(0x7f0000003080)=""/55, 0x37}], 0x5, 0x34, 0x4}}, @rdma_map={0x30, 0x114, 0x3, {{&(0x7f0000003140)=""/205, 0xcd}, &(0x7f0000003240), 0x8}}, @rdma_args={0x48, 0x114, 0x1, {{0xb1a, 0xc}, {&(0x7f0000003280)=""/208, 0xd0}, &(0x7f0000003540)=[{&(0x7f0000003380)=""/226, 0xe2}, {&(0x7f0000003480)=""/4, 0x4}, {&(0x7f00000034c0)=""/60, 0x3c}, {&(0x7f0000003500)=""/44, 0x2c}], 0x4, 0x8, 0x7}}, @zcopy_cookie={0x18, 0x114, 0xc, 0x8}], 0xd8, 0x40}, 0x800) 1.68196404s ago: executing program 3 (id=4393): sendmsg$IPCTNL_MSG_CT_DELETE(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000500)={&(0x7f0000000040)=ANY=[@ANYBLOB="2800000002"], 0x28}, 0x1, 0x0, 0x0, 0x24000083}, 0x20044804) bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000540)={&(0x7f0000000000)=ANY=[@ANYBLOB="9feb0118000000000000aaffc637809ac22ddb00000f0000004c76137ad1b97564c997e64c0f00ed"], 0x0, 0x2a, 0x0, 0x0, 0x7ff}, 0x28) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='memory.events\x00', 0x275a, 0x0) write$cgroup_subtree(r0, &(0x7f0000000000)=ANY=[], 0x3261e) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x2000001, 0x12, r0, 0x0) r1 = socket$inet_smc(0x2b, 0x1, 0x0) setsockopt$ARPT_SO_SET_REPLACE(r1, 0x0, 0x60, &(0x7f0000000000)={'filter\x00', 0x7, 0x4, 0x3e0, 0x110, 0x110, 0x210, 0x2f8, 0x2f8, 0x2f8, 0x4, 0x0, {[{{@uncond, 0xc0, 0x110}, @mangle={0x50, 'mangle\x00', 0x0, {@mac, @mac=@remote, @loopback, @local, 0x1, 0x1}}}, {{@uncond, 0xc0, 0x100}, @unspec=@ERROR={0x40, 'ERROR\x00', 0x0, "716ebd2e1aa0cc683e62f312359594df00da56317f76121697127951fdba"}}, {{@uncond, 0xc0, 0xe8}, @unspec=@NFQUEUE0={0x28}}], {{'\x00', 0xc0, 0xe8}, {0x28}}}}, 0x430) r2 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r2, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000080), 0x1}, 0x0) 1.57298094s ago: executing program 0 (id=4394): sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=@newtaction={0x58, 0x30, 0xb, 0x5, 0x0, {}, [{0x44, 0x1, [@m_ct={0x40, 0x1, 0x0, 0x0, {{0x7}, {0x18, 0x2, 0x0, 0x1, [@TCA_CT_LABELS_MASK={0x14, 0x8, "2c693b7b2f748e36c1cbde6d4db950c3"}]}, {0x4}, {0xc, 0x7, {0x0, 0x1}}, {0xc}}}]}]}, 0x58}, 0x1, 0x0, 0x0, 0xf646d5f7286d7fdb}, 0x480c0) r0 = bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000100)={0x6, 0x3, &(0x7f00000000c0)=ANY=[@ANYBLOB="1800000002000000000000000008082295"], &(0x7f0000000240)='syzkaller\x00'}, 0x94) r1 = socket$igmp6(0xa, 0x3, 0x2) setsockopt$IP6T_SO_SET_REPLACE(r1, 0x29, 0x40, &(0x7f0000000980)=@raw={'raw\x00', 0x8, 0x3, 0x530, 0x1d8, 0xffffffff, 0xffffffff, 0x1d8, 0xffffffff, 0x460, 0xffffffff, 0xffffffff, 0x460, 0xffffffff, 0x3, 0x0, {[{{@ipv6={@private0, @mcast2, [], [], 'veth0_macvtap\x00', 'bridge0\x00'}, 0x0, 0x1b0, 0x1d8, 0x0, {}, [@common=@unspec=@helper={{0x48}, {0x0, 'amanda\x00'}}, @common=@unspec=@conntrack2={{0xc0}, {{@ipv6=@private1, [0xff000000, 0xffffffff, 0xff, 0xffffffff], @ipv6=@private1={0xfc, 0x1, '\x00', 0x1}, [0xffffff00, 0xff, 0xffffffff, 0xffffffff], @ipv6=@empty, [0xff000000, 0xff, 0xff, 0xff], @ipv6=@local, [0xffffffff, 0xff000000, 0xff000000, 0xffffff00], 0x80, 0x54, 0x3b, 0x4e20, 0x4e23, 0x4e21, 0x4e23, 0x446, 0x39a}, 0x100, 0x20}}]}, @common=@unspec=@NFQUEUE0={0x28}}, {{@ipv6={@remote, @ipv4={'\x00', '\xff\xff', @dev}, [], [], 'erspan0\x00', 'gre0\x00', {0xff}, {}, 0x0, 0x0, 0x0, 0x4b}, 0x0, 0x258, 0x288, 0x0, {}, [@common=@inet=@hashlimit1={{0x58}, {'pim6reg\x00', {0x0, 0x0, 0x5, 0x0, 0x0, 0x7, 0x3ff}}}, @common=@inet=@hashlimit3={{0x158}, {'vcan0\x00', {0x3, 0x0, 0x41, 0xfffffffe, 0xe, 0x1000, 0x6, 0x3}}}]}, @common=@unspec=@CONNMARK={0x30}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28, '\x00', 0x7}}}}, 0x590) syz_emit_ethernet(0x4e, &(0x7f0000000000)={@local, @remote, @void, {@ipv6={0x86dd, @tcp={0x9, 0x6, "8b0f00", 0x18, 0x6, 0x0, @dev={0xfe, 0x80, '\x00', 0x39}, @local, {[], {{0x4e22, 0x4e24, 0x41424344, 0x41424344, 0x1, 0x0, 0x6, 0xc2, 0x1, 0x0, 0xffd, {[@sack_perm={0x4, 0x2}]}}}}}}}}, 0x0) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000600)={r0, 0x5, 0xb68, 0xffffffffffffff6b, &(0x7f0000000000)="ff", 0x0, 0x149c, 0x503, 0x0, 0x0, 0x0, 0x0, 0x2, 0xffff80fe}, 0x48) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x2}) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) close(r3) r4 = socket$nl_generic(0x10, 0x3, 0x10) r5 = syz_genetlink_get_family_id$tipc(&(0x7f00000000c0), r4) sendmsg$TIPC_CMD_ENABLE_BEARER(r4, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000680)=ANY=[@ANYBLOB='8\x00\x00\x00', @ANYRES16=r5, @ANYBLOB="010000000d0000000000010000000000000001410000001c001700000000000000006574683a73797a6b616c6c657230"], 0x38}, 0x1, 0x0, 0x0, 0x44081}, 0x0) ioctl$SIOCSIFHWADDR(r3, 0x8914, &(0x7f00000001c0)={'syzkaller0\x00', @broadcast}) r6 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x100, 0x0) close(r6) r7 = socket$unix(0x1, 0x1, 0x0) r8 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r7, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r8, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000340)=@newqdisc={0x70, 0x24, 0x4ee4e6a52ff56541, 0x70bd2b, 0xfffffffe, {0x0, 0x0, 0x0, r9, {0x0, 0xb}, {0xffff, 0xffff}, {0xfff2, 0x2}}, [@qdisc_kind_options=@q_cbs={{0x8}, {0x1c, 0x2, @TCA_CBS_PARMS={0x18, 0x1, {0x0, '\x00', 0x1, 0x3, 0x100, 0x8}}}}, @TCA_STAB={0x28, 0x8, 0x0, 0x1, [{{0x1c, 0x1, {0x3, 0x9, 0x81, 0x7fffffff, 0x2, 0x4, 0x2, 0x1}}, {0x6, 0x2, [0x9]}}]}]}, 0x70}, 0x1, 0x0, 0x0, 0x20000001}, 0x0) ioctl$SIOCSIFHWADDR(r6, 0x8922, &(0x7f0000002280)={'syzkaller0\x00', @random="2b0100004ec6"}) 1.445531194s ago: executing program 2 (id=4395): r0 = socket$inet_mptcp(0x2, 0x1, 0x106) connect$inet(r0, &(0x7f0000000000)={0x2, 0x4e22, @empty}, 0x10) getsockopt$inet_tcp_int(r0, 0x6, 0x2, 0x0, &(0x7f00000001c0)) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000200)={'ip6_vti0\x00', 0x0}) sendmsg$nl_route_sched(r1, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000240)=@newqdisc={0x78, 0x24, 0x4ee4e6a52ff56541, 0x2000008, 0x0, {0x0, 0x0, 0x0, r2, {}, {0xfff1, 0xffff}}, [@qdisc_kind_options=@q_clsact={0xb}, @TCA_STAB={0x48, 0x8, 0x0, 0x1, [{{0x11, 0x1, {0x6, 0x7, 0x0, 0x9, 0x0, 0x8, 0xff}}, {0x4d}}, {{0x1c, 0x1, {0x3, 0x0, 0x80, 0x0, 0x2, 0x0, 0x200, 0x2}}, {0x8, 0x2, [0x2, 0xfffc]}}]}]}, 0x78}}, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x6, 0x13, &(0x7f0000000240)=ANY=[@ANYBLOB="18020000000000000000000000000000180000002020702500000000002020207baaf8ff00000000bda1060000000000470179b8f8ffffffb702000008002000b703000000000000850000000500000018010000646c6c250000000000202020db1af8ff41000000bda10000000000000701e0441092ffffb702000008000000b7030000000000008500000006000000950015000000ca18"], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x2a, '\x00', 0x0, @xdp, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) 1.334311979s ago: executing program 3 (id=4396): r0 = socket$inet6_sctp(0xa, 0x5, 0x84) getsockopt$inet_sctp6_SCTP_STATUS(r0, 0x84, 0xe, &(0x7f0000001500)={0x0, 0x4, 0x3, 0x1165, 0x2, 0xe8a2, 0x1, 0x3, {0x0, @in={{0x2, 0x4e21, @initdev={0xac, 0x1e, 0x1, 0x0}}}, 0x9, 0x7, 0x42bb}}, &(0x7f00000015c0)=0xb0) socket$pppl2tp(0x18, 0x1, 0x1) r1 = socket$kcm(0xa, 0x5, 0x0) socket(0x400000000010, 0x3, 0x0) socket$unix(0x1, 0x1, 0x0) socket$inet6_icmp_raw(0xa, 0x3, 0x3a) socketpair(0x1, 0x1, 0x0, &(0x7f0000000000)) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000029c0)) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)) socket(0x2, 0x80805, 0x0) socket$inet_sctp(0x2, 0x1, 0x84) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000740)={0x0, 0x4, &(0x7f0000000000)=ANY=[@ANYBLOB="1800000000000000000000000000000071127f000000000095"], 0x0, 0x0, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, 0x24, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x9}, 0x94) r2 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f00000000c0), 0x34) bpf$MAP_LOOKUP_ELEM(0x5, &(0x7f00000000c0)={r2, &(0x7f0000000000), &(0x7f0000000040)=""/73}, 0x70) r3 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) getsockopt$inet6_int(r3, 0x29, 0xb, 0x0, &(0x7f0000000100)) sendmsg$kcm(r1, &(0x7f0000002dc0)={&(0x7f0000001640)=@l2tp6={0xa, 0x0, 0x0, @local, 0x8, 0x10000000}, 0x80, &(0x7f00000002c0)=[{&(0x7f0000000800)="e3bc03a46f04", 0x6}], 0x1}, 0x41) setsockopt$sock_attach_bpf(r1, 0x84, 0x1e, &(0x7f0000000000), 0x4) r4 = socket$kcm(0x10, 0x2, 0x0) sendmsg$IPSET_CMD_SWAP(0xffffffffffffffff, 0x0, 0x800) sendmsg$kcm(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f00000002c0)="2e00000011008b88040f80ee59acbc04130800480f0000005e2900421803001825800000000000000280000c0012", 0x2e}], 0x1}, 0x0) 1.332999587s ago: executing program 1 (id=4397): r0 = socket$nl_route(0x10, 0x3, 0x0) (async) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$netlbl_cipso(&(0x7f0000000100), r1) sendmsg$NLBL_CIPSOV4_C_REMOVE(r1, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000140)=ANY=[@ANYBLOB='\x00\x00\x00\x00', @ANYRES16=r2, @ANYBLOB="01002cbd7000fddbdf25020000000800010003000000"], 0x1c}, 0x1, 0x0, 0x0, 0x4}, 0x4000000) sendmsg$nl_route(r0, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000040)=@newlink={0x40, 0x10, 0x403, 0x2, 0x2, {0x0, 0x0, 0x4, 0x0, 0x4300, 0x1000000}, [@IFLA_LINKINFO={0x20, 0x12, 0x0, 0x1, @gtp={{0x8}, {0x14, 0x2, 0x0, 0x1, [@IFLA_GTP_FD0={0x8, 0x1, @udp6}, @IFLA_GTP_PDP_HASHSIZE={0x8, 0x3, 0xf}]}}}]}, 0x40}, 0x1, 0x1000000, 0x0, 0x20000044}, 0x24028044) 1.291410704s ago: executing program 4 (id=4398): r0 = socket$inet6(0xa, 0x80e, 0x902) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000140), 0x1, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000000)={'syzkaller1\x00', 0xc201}) socket$nl_route(0x10, 0x3, 0x0) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x5) close(0x4) syz_open_procfs$namespace(0x0, &(0x7f0000000200)='ns/uts\x00') unshare(0x6a040000) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='memory.events\x00', 0x275a, 0x0) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x2000001, 0x12, r2, 0x0) r3 = socket(0x8, 0x4, 0x3) getsockopt$inet6_mreq(r3, 0x29, 0x1b, 0x0, 0x0) bpf$MAP_CREATE(0x0, &(0x7f0000000380)=@bloom_filter={0x1e, 0x6, 0x8, 0x3, 0x4080, r2, 0x9, '\x00', 0x0, 0xffffffffffffffff, 0x0, 0x3, 0x0, 0xb}, 0x50) r4 = socket$kcm(0x2, 0xa, 0x2) ioctl$SIOCSIFHWADDR(r4, 0x8914, &(0x7f0000000240)={'syzkaller1\x00', @link_local}) write$tun(r1, &(0x7f0000000240)=ANY=[@ANYBLOB="000086dd0500560008005400000060ec970001981100fc000018c6ba35000000000000000700ff020000000000000000000000000001"], 0xfdef) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000000300)=@raw={'raw\x00', 0x3c1, 0x3, 0x4b0, 0x0, 0x8, 0x7f02ae, 0x0, 0x200, 0x3e0, 0x2e8, 0x2e8, 0x3e0, 0x2e8, 0x3, 0x0, {[{{@uncond, 0x0, 0x260, 0x288, 0x0, {}, [@common=@unspec=@physdev={{0x68}, {'wg1\x00', {}, '\x00', {0xff}, 0xc, 0x17}}, @common=@inet=@hashlimit2={{0x150}, {'batadv0\x00', {0x5, 0x3, 0x24, 0x9, 0xd353, 0x10001, 0x0, 0x40, 0x40}, {0x5a2f}}}]}, @common=@inet=@SYNPROXY={0x28, 'SYNPROXY\x00', 0x0, {0xa, 0x6, 0x3}}}, {{@ipv6={@private2, @private2={0xfc, 0x2, '\x00', 0x1}, [0xff, 0x0, 0xffffff00], [0x0, 0xffffffff], 'wlan0\x00', 'netdevsim0\x00', {}, {0xff}, 0x2c, 0x0, 0x1, 0x7b}, 0x0, 0xf0, 0x158, 0x0, {}, [@common=@dst={{0x48}, {0xa, 0x0, 0x1, [0xff, 0x6, 0xff, 0x4608, 0x3, 0xe, 0x2, 0x8000, 0x4, 0x400, 0x800, 0x0, 0x8, 0x7, 0x0, 0x50], 0x2}}]}, @unspec=@CT1={0x68, 'CT\x00', 0x1, {0x13, 0x0, 0x8, 0x400, 'snmp\x00', 'syz1\x00', {0xffffffff8cdbbefd}}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x510) 1.057888818s ago: executing program 1 (id=4399): mmap(&(0x7f0000001000/0xc00000)=nil, 0xc00000, 0x200000d, 0x10, 0xffffffffffffffff, 0x0) r0 = socket$rds(0x15, 0x5, 0x0) bind$rds(r0, &(0x7f0000000840)={0x2, 0x0, @loopback}, 0x10) sendmsg$inet(0xffffffffffffffff, &(0x7f0000001b00)={0x0, 0x29, &(0x7f0000000740)=[{&(0x7f0000000880)="e09d89cdc2862da7bc9c270ddf312725cf2386aa6cc67d29949a46b8c82c77b00951c2aac4cd1f62edad77f4c937e459896fd29ba44bbfc4238273f1590c5f90fb3f196bbef3000ad3e0977e26c4f346ebd0f548ed23cf2621f5d0c853766d527dae8a77a7b2ff3a7b4f0e49293e8c42482d3bb6a4ac6d91a7d29e7f4719685c9e08dd5a4667a2e263d02a322e78d30bae47807302a1f729f6647d8f118a210d0295b60e5fb850ba5e825ef677f2cd71ed8d868c6c4a52aba5248b19c0f76dcd86659b529356ffd197dbf43fbd99fa0772de8153a0ca0c10bf5f4e5692882800000000", 0xffffffffffffff47}, {&(0x7f0000000640)="f3e6e1192356599b685814d423f79e14f32f18aba6426e1d9b2b64b1ca9e5dc910f3223bcd56fee3e9c59f61b57e554a08bf9b489409ccd3884e7f3befde342ae6c4df75cef6b0b5d8f5bc758a8f6ecaff518d6622803361369eb1dd0bb1523c9fb7a3d5b23b4fafc0ac740df3ce87951f5b66d23550ff8adb57bc8a5cece54e2909ea4c786426aeaaca44b5deac358e4c8edc809c6442c6b5c37c9527ade114bce99a8ca7fc17295c07505a6e49dba92d20591aebba4b9c164bd6e2e0cdedc6ccacadac487f5bd051e6375515fc70dc4cefef8bb3a3b47af89285549740b1dbbf53085091a18f34ace7dc939c93a76140e53d4e01ff98", 0xf7}], 0x2}, 0x20000004) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$net_dm(&(0x7f0000001140), r2) sendmsg$NET_DM_CMD_STOP(r1, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000001c0)={0x14, r3, 0x1, 0x70bd28, 0x25dfdbff}, 0x14}, 0x1, 0x0, 0x0, 0x20040000}, 0x8800) r4 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='memory.events\x00', 0x275a, 0x0) sendmsg$kcm(0xffffffffffffffff, &(0x7f00000016c0)={0x0, 0x0, &(0x7f0000000180)}, 0x0) r5 = bpf$MAP_CREATE(0x0, &(0x7f00000007c0)=ANY=[@ANYBLOB='\n\x00\x00\x00\v\x00\x00\x00B\x00\x00\x00>'], 0x50) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000300)={{r5, 0xffffffffffffffff}, &(0x7f0000000100), &(0x7f0000000180)}, 0x20) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f00000002c0)={{r6, 0xffffffffffffffff}, &(0x7f0000000140), &(0x7f0000000280)}, 0x20) close(0x3) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000100)={0x1f, 0xd, &(0x7f0000000040)=ANY=[@ANYBLOB="1800000005080000000000008200000018010000", @ANYRES32, @ANYBLOB], &(0x7f00000001c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x35}, 0x94) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000004c0)={0x11, 0xc, &(0x7f0000000980)=ANY=[@ANYBLOB="1800000000000200000000000000000018110000f18131f0e799165157dffa97a7cd5bb76061f8598a67cd24203ffc4750134fdd2caf9b0ccc23fdae02469a69ddb5dbfa5fd007a295e52c9a809c62fe52e892a8b5ec5c1f9824c2646287783a9eeddad72882383cbcf133cb5b606654a4c82b21dfe12297f2031e1501e3d743648958756d7ee5e010a55ccf0e7fab12bbd90c55c00e8379affc1201c23ab3f469f50ea491", @ANYRES32=r7, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000"], &(0x7f0000000240)='GPL\x00', 0x4, 0x1006, &(0x7f0000002500)=""/4102, 0x0, 0xc}, 0x94) r8 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_group_source_req(r8, 0x29, 0x2b, &(0x7f0000000440)={0x9, {{0xa, 0x4e21, 0x4, @empty, 0x7}}, {{0xa, 0x4e21, 0x0, @ipv4={'\x00', '\xff\xff', @initdev={0xac, 0x1e, 0x1, 0x0}}, 0xe}}}, 0x108) r9 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r9, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000003c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0) sendmsg$NFT_BATCH(r9, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000680)={{0x14}, [], {0x14, 0x11, 0x1, 0x0, 0x0, {0x1}}}, 0xfffffffffffffe7d}, 0x1, 0x0, 0x0, 0x100}, 0x800) sendmsg$NFT_BATCH(r9, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000240)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x1}}, [@NFT_MSG_NEWFLOWTABLE={0x5c, 0x16, 0xa, 0x801, 0x0, 0x0, {0x2}, [@NFTA_FLOWTABLE_NAME={0x9, 0x2, 'syz0\x00'}, @NFTA_FLOWTABLE_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_FLOWTABLE_HOOK={0x30, 0x3, 0x0, 0x1, [@NFTA_FLOWTABLE_HOOK_DEVS={0x2c, 0x3, 0x0, 0x1, [{0x14, 0x1, 'geneve0\x00'}, {0x14, 0x1, 'erspan0\x00'}]}]}]}], {0x14}}, 0x84}}, 0x24040884) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000280)=@newqdisc={0x28, 0x10, 0x1, 0x70bd25, 0x25dfdbfc, {0x6, 0x0, 0x8100, 0x0, {0x1, 0x10}, {0xfff1}, {0x4, 0x3}}, [@TCA_STAB={0x4}]}, 0x28}, 0x1, 0x0, 0x0, 0x400c800}, 0x0) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f00000001c0)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000020a010200000000000000000a0000060900010073797a310000000008000240000000018c000000020a010100000000000000000000000369000600e62807258a6d38caf4cb1d7a776a7a05e57912414e63207c5e61d47bb4016b21bd5593b033b0968722f2f0f4818a1a13fbb43e79d0ae674d071c0164df9d3701cc15211300766b6ebe326ada9e49ccadc2a07460e46e35eabfb48a4cd9cd83790d7e705b010000000900010073797a31000000001c000000090a030000000000000000000a00000208000c"], 0xf8}}, 0x20044900) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a01020000000000000000010000000900010073797a30000000004000ffff0900010073797a30000000000900020073797a3100000000140003800800014000000000"], 0x138}, 0x1, 0x0, 0x0, 0x20040855}, 0x0) r10 = syz_genetlink_get_family_id$devlink(&(0x7f00000002c0), r4) sendmsg$DEVLINK_CMD_RATE_NEW(0xffffffffffffffff, &(0x7f000001c7c0)={&(0x7f0000000080), 0xc, &(0x7f000001c780)={&(0x7f0000003540)=ANY=[@ANYBLOB="40110000", @ANYRES16=r10, @ANYBLOB="000429bd7000fedbdf254c000000fa00a80098e4989f578033e6bb9a0726c90ea21a94b8c52285aec9031b8323c4fe0e74d1da7c26a5f0c67e27e3ffddf8973bf835897f61acdd54385a5cd5b0d54f802589cf077c087e0151a7e12ab96091f9a5b62e71257741df8738316e6552a1b760636a71de6f7ea2ce8c4a575e5ba6516a51d6c9a6634ff4e60b992678e89fd888eaedc5a56995c5fc6679cb5867bd5c4144be4725f2fcfcb5ae05da789d905f27ce76ee1a839cd24756dc46c46a183b167a773bf7d70c919cb918d0f1b41606abbf1ba5151df5c1072329f72c4562bdc2a137dfb8a5681fe5e62f54e9a6b5496b55f58e607bffb324acb51d40e1dfd9e315e4d353046ab400000e00a80066697273746e616d650000000410a800450483bc6140610bc36953b305be73e3dcb800cf56269039992f8e17085d465ab34a47defa790abefe96180ba8725d4b865b5a8c15f1db524b811ce12efee802f75b80a8be6570877b17efdc83f172e4d880b3f0d5d9fc910433d8ab629354dcee27e9a551eb0452c2f8480a6d82d67f1339568ddfc9f61ff43f7b64894d142f1c60e1b3948979f08309185b8dcc1af6abd6c8c25249721e5f748953826a5ee300d561b82d8b9a3facbe89ca4b976a414cfbbd6d03cd44d44377c5b1909d4390b4fdd6e925a384e16fe2a69a99ead281e6fdb9b425b4fde083aa498fdef85789c0121fa4a05b43bd8418f9eba0dd35e603fd91a65cc19675d8cb0faf85be5ec7adf853ae2256ab51d7660fcfdc545296cba7757c93b4a648a8e26170034445d1b3cf1dd53d0132e14afa0175783348ffd078b1c35b21869e1ea543afff7b959d710cc6bae6524cd6c7b11ca26a4349550e6dff49e8bf709d35a115cf723cf9e181e675678a123c58b49aac70e1235a12d6f2401b5976619df0edc0d40ec950d06c1ae4e9a97c6fd9b87e71dea6efb73038b0ee09aec10c71993b106a3a4f3f042fa22a94492274ac276fa37c03d3b0581a3f82f38fd524e05d9ae99cf1ede0631eec35bc76dabfefc949b75a2c9f7a95e217885944a7dfa9e3e2824c1b6c81476a90875f8f3b17abf9202df00c659ddfeb8d4d261e4986bdc7ceaa7bd4e14ee33fc7628ef7b982d644e882a386018d13e28a26c0b635d33f940cc6f3476067dd11ceea826970a96850cb0b589d48a702945507fc8ee26952c63029555e1ee9916b266e4024d62039c2ca5a61efe15b6f8086f19a0deabd019ed60a693193112b6333aa8d172ec4f35996e176da35a54c9587a4e94a66ca3d280ac13caa7a53e92ade5086750dc1a97bea67ca930c5f69dc148d413530d7ca66cd6f4d30f270d31266afd70ca61c8d1957a180f2b6662fe1b2949d7921a3289dfd49a00e070788047cd3d6d07efc0e85af86eeeeb3e5296d8c6f0c3c8913167ca912ae7a20dff6fa6b649d896107c15c786bfc3c9f7599a3f75da2553a12df6e4b69a00f6bd927336ef7ac091e1fe876f55a45ba809fd7ae8b5fccd044b4404347b5c677c97853c472286a506a33aa28b9af4ad4b6420e77aab8bd034f6d621d757f093920f3f092734d5e864ff489f6678c6d13e236e27d0b03a42627d3b2df1f8cf0d6c7ac6a1f06454f61bae210afc12cb6bb09f921fa4087fd41be766cd5bb06e4bb2006591cb25ce1ea7d481537297f3970f2792362dba2aba7fbabdf4ebf99664629aad175a2cf739382069f7b826fda907a487e4112b098967c44522e2e2713bceb98e81556191eafb57957c2496e2ac4691add7b44982d4d311becfc468495b73f84524451761988ab63cb95ee87b99e315118a6e875135e96d2a0fc6ce2a64b7ca3a53ccd8ca6c5c9e63a4f11c86d74bfc4f366b56187822eff7d8260914b329be4bec4e447d5a790337e89fba2e166f15e5b6a4ccc6c113013168caa06cbb755fead9eff0948f91bfb67834b658c6ed700df7ee4751416ba5fd87842a8586bff83df996ba80c0cbc57a1e2604e61c676aadf99fb5da9fe189a61c212f164db8ff445c6fb8534fa771c76b4731723e60bf0e5c2f06dea27c638e114a42d62229aae24aeebc454cf0e45617edd585984e44ad01bc682c8346eaaa8218847a1982b57673ddd5e5083a57586eca16da2a5abb2eb9fc8c65b6f9ee80fa5014862382d6fba3f64847af3a261848618a4175244bccbcb0d3a0edb97d7631117a116a86067d193ab496075ca99043bb7ab0e05637f56bf81ba7b23ebf89eedd45cb2ab8557d06a05c768f1843798b2d6757c48c8703a8c32067e3c842d084e80fe17c5524a33f0845ebba7b0279ca91c0246e758c7cee955cd18f1708ff8a7436a2defa1a5fca15f820bfa69b2edec74f847fe334d768ca28ac7f483b1b1e69ce1ed39750109ac693f12e9415f502839dc6ab79f011caf1765b8df2231ccc1892959315db6a9a3c63fdb4d453bb8ea4dc42053b40efb82343ab9ddc676d1ce92c08f3b02f04e7541ee557b138d3699f750f40cb8319cb69e9841613366a13da8aa67c3a0ec39e9e1873cc74559eff460214fbb55dfcc9c2ae1cc8f2acbe1bdf60b1e3bb4205f777308e6ee2a5770ca58414ce81e033645272e4ffff14d09dfcb32f48d46752fee56fdfecd51191fb1a9c0f49ac1db71ee1abb41bfb4cda5c2763f905ac30d0867d964216b39cbb19d05c0826a09a4c04c792fc2873c9eaf56474e535f8e413ce248eb9fb9eedd719ef2bf0ed22b6e31a267286945497b7b5a6034bc3b64e9affd0ed1894577e343fc1838c6abfe5a49de54fa7390733c02328f2b3bc521ecce89c14779cf6bcc379778df2706cf5dc0f19ce13b42d190a0445824c4ffd194a7662b414775346758321df38705e5e1894ad2ebec6e167450498a5c2b8301fdf7973bd392b87daa1b1454cb9073b485ae2a57cbaf03ff266d9322c244ea69798eb7607eb1dbd58c4abe1650900386853c25f93c3d5499d378f911fada773f854014a377b1f4747839ab4c6ed79f3f3215f8b5b16d9db661be21fa0cf9210a7b1bd57395aee3213854be678e91d5178fd916a2e83fb9439ddcc93f1c68e3d1db376c96d9a58c2141da67025653b7dee500bd9cc30f8bb28cca46faa56b9329fbd9376ad01aed7de22d51d0dc7c85ac9f75e1048d0e0e728031c4fb30fd18f6314acd3c0fa124b80fe61e34d513948df0d52356da39ea5e64737a02a5cec8acccff1f73a8dca4f5be7c153ca022f84d47204af1f236ca27e64ef4140a2dfd07ef8ef38ae4d42ece679d8a26f513cb851ead0ffdf3b2b4e94a6ba53daefcee295d29756a3219f43eb711ba584215f9f865fcc3f2195b7751a75bdc7fa58b92f3d4fa7d134fb750e2d06c6f4a050792a8dc3bdeace4d8e55b15b5e155b432788c791bf680f278b2f6a5561f434ac74f01d61845b64025d9af02f64bca86c945f576064c1e88d66a10b367350a8c0487e607205e9ae5d897d92a20a699f6e49a2d0ed456bb9b9160a4d13e7307ef3f2c6f9aeaf4f2ac90cebb23a4a49060364092b4074f4526f947d9231d37847e9a06bcb67ec4fdff96ddc368662e6d8834a2d5cad21e0ff59427c7d002663a1077f937dd6e6647ddee251f7019dd49f8dc86e1fc452e1b7a38adad6ae3672cdab62b5751cde2edfd75476ad0992cb662bb35b753a76f5777c31d8121e1e38465b4cc4ce94ec657a575ea85dffc6ade1d42e78d9fcc2704398f90dfa9d978d007aa71737d1ecc6900bdcec53319f7cc76890890a07377b13e9d568f772909ade627e6fe3ba372c22ff578d9643978e2883431c98f8e78c3681cfa65f9c10c9b5a894fcb319bff885bdc6f3d88ad782fe503440c271cc3d64cda4d0f13d56c14719624cc42078907283848c263f3397f011149a88a6f5d8aa090b1070fe20c3222354dcf6bcaa93785df3ce4b6ed5d53ed616be1f323149da38bb71e9dcf6885c03f1387d5886fe21e8146b49217fd0ba5a4a1f51114d93661ca6c074dc2e9bac67d882657de49bc2988aa2ddf2ede972af2ac5da21f0af18f212e5751efce01caf648268d77fe4990612181f59be389532e61984b08c26e33496aa901f5390a0015902fade9bd1a3a04b6762d9eed83fd04b2600271a8b13d2e8b3562bd40eddf410e273eaf716b63f386a0fa1c67b7a9d5514427b00ea5db243430ea1f92bbf8812c96c65280921edf6da1c1d541b227ec7d24c5afaf4e40acbf40aaf8f77e3677ac204805c8a8af323662c5f52b2147e9229de739877b7fdb2fee1883368347511220c1d0269daf7a3fb4fe5bac93fb682ac3d5b8e9310eeff0f04bebf8ea587448730251befa763a64e23e438b5e695a6d215b2b430a737f2618f3051fec4bd2143bdf060685c730858facf15349f006103d2da6246fb57062ce4b16b35d3231ae62dc661c09886ce596bd7f5c56366ccc12f8ab86f4ddb829f2845bd5f4004d663e07b14f9f5d5969dbc2df3f31e787f78d75dc053852e8b1205994cbc739295c032ee45fa62785995ccf8e73a2a815f962cfad07e82e8174a782dea1cd6c75213a92ed07b31ac6a9142d54fdaffddf0ecc62ee57ba21aebe177b39a5485d9860fb429218af0c0f72f259a1c46e083f074d94c0b7074506c1ad8ccfa212492ee75d415afbb770f8b493279065beb8781aa2ae39938ebaaae039750bf6061d4b335c5fd540450d7e2d789dc41bdded9c816f8fc5280bd5c34a77b8ab58daf48d27af28e5336c42bb418a0b2d8520fe957a9fab3d90a71678379571b924757f3ed57c08d6ddaa4ff15519bba96aa0bf9e12a186f104c094408a826526051d964af4a19a688da475246dbb0982677b99a1427752e0e8b16ac960b69eab9905af6fae4f6bbe982ec1fd15904f382cf6bae587fe2238d6eec855dcea4b9d903e98f13b86d9cdf7974a500369436667f4fbcd0e6c42555c3bfd856fab09665ffec58e0fbcb61f0892bed825ebb669bda34d0ff9626ceb4356dd9844d5af9a8fa4af176745fd052b1bfacca6bccaf4874be89a720f0e4fffd7dba5299eb2b94b5d40e50fe1f52fccb26e274ca10eb6bd1ef29a6ff80b0e2481f2ccbed771954352549abdc975586ed73d0b260f6ce3cd9fc3172a0ee8b060b34772aa590d42b0cd7210b53b6fd2db3f22552c35f11d4c20dea902ab34f207ec9a3fe2a105b393c215071215f345eb7afbf922c9c6ce846e78036b50cdde7201249b3c60c1286fb34daddd227e5966afe1f0580da8f1f58a0bc0addbf5902e4d9f23cc61a602955e27684864643f425e5aadec9a6aa8f3c7aa650434325fc1d44f734288c5195a6842610c151e92f4b9946761318a48974686bc1b8498bb585b7a6ff87e808231f6cda9132746cb926adb76f41363233c37baa97936f304ee599d6f74299b6cc1f4c10ad404fc1603199e84b956f3b069493d4eb171cf4ce9ee612c3fc7dbb4ff1ab75295b28b24be309064bf187936044b925ce851892c60b4ddffb8b3df0ff616cdab746c69e467d1abfc05d1ea720169468cb26475036095ea028fa240e823696b110662807538156ac7b87f652091815f9677a2db1c50c03e4571da751ea879fb9fb29435014bb5bd6525488d47496d48c84c88600e017c281986cac6cc6674c8e03cb6b2d33a7e3ff43c880a11a354fc3a0acf5569ffd69ee52f52c06fc589119f079f9cbf0436f9bd2f4b0a2d94f40985d95ff507445e82f41effdd234e47b6340b874331ea1959900048b6ac78ebdb55a835601cb95ac0b8613fb0f461d529f52f5203ea9b39aaa1d9b78f0261bdc2cf7617595851009f0d30c3bc52af2ed74c0a6891d7dfa7c68618f63198584d29b0b4019ece7a9bc8d53a6eb208dbb362f9a1e557b5485a8084bc83a7665adeb040ba82bb68bb4276d49bb88b35d0414e556da89342b6cfbd36a49e59fd061603da0a1270a4f72ae2289f2915a873e51b1c60edfa49f38ecc6555debe42be6c9126ad9b4496b4922767bf328b3e14bb7dfe04bc5a3b4e23d2554e77e713ed451ecb8b70a8b9bfd5bd2195413c9ed3b85c0f4ffe1441e4fad0c1aff52045dd3d8d7df0d47e0fc128d1351df07379e0e2a1e6a857b95cb7264fdb02c6f0d2ad590764100117717f893d25f1a74b4c0b9f5324b90d74a27b1408ad53cce8a4bc0c3a2e2a61b2c4bfebacec299fd1e96aa31fcee495aa4e12e567003fba0c539935eaf3d0a323e9335917bf059879628f26f73dd8fbcd30395612bc0e00a90066697273746e616d650000000c00a6000500000000000000"], 0x1140}, 0x1, 0x0, 0x0, 0xa0}, 0xb9520cb7b7509856) socket$kcm(0x10, 0x2, 0x10) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000480)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a03000000000000000000070000040900010073797a30000000009c000000090a010400000000000000000700000308000a40000000000900020073797a30000000000900010073797a3000000000080005400000000d58001280200001800e000100636f6e6e6c696d69740000000c0002800800014000000008200001800e000100636f6e6e6c696d69740000000c00028008000140000000001400017b090001006cdbf80789f3f947dd0002800800", @ANYRESDEC=r2, @ANYBLOB="3df57c3017fbfdfe7f525918bd68998d95362fd5878fa140195f19f30541036eea195afed08e841834edb5588c1805921780ac685f8e2d39a9a58ca85b4730627abfbbd1382661f88f5f0b7c5856242d0ce6e0ce2a9d75a1fb62cd1f324ed3b12a1a65022240419c2414c9bfd9dc401226d5c9c57e8ef67eab38bde628aaee6f0866bad9e03fd5a6c9935746763a441ac2d552f0bf7e7aadfcb8eea008d95ef30e7674791afa37ff133cae2dcdac41cdc621b7fbb8a8dc3834cc66dd7428f92dda9defad95da85"], 0xe4}, 0x1, 0x0, 0x0, 0x8001}, 0x20050850) write$cgroup_subtree(r4, &(0x7f0000000380)=ANY=[], 0x32600) 815.404843ms ago: executing program 1 (id=4400): r0 = socket$rds(0x15, 0x5, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000140), 0x0, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x4c02}) readv(r1, &(0x7f0000000080)=[{&(0x7f0000000980)=""/4096, 0x1000}], 0x1) r2 = socket$kcm(0x2, 0xa, 0x2) ioctl$TUNSETVNETHDRSZ(r1, 0x400454d8, &(0x7f0000000100)=0x730) ioctl$SIOCSIFHWADDR(r2, 0x8914, &(0x7f0000000000)={'syzkaller1\x00', @link_local}) ioctl$sock_proto_private(r0, 0x89e1, &(0x7f0000001080)) r3 = accept4$unix(0xffffffffffffffff, &(0x7f0000000040), &(0x7f00000000c0)=0x6e, 0x800) ioctl$XFS_IOC_INUMBERS(r3, 0x80405880, &(0x7f0000000100)={{0x1, 0x0, 0x0, 0x750}, [{0x4, 0x5, 0x3, 0x5}, {0xb27, 0x1, 0x8d, 0x10}]}) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r4, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000008c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0) r5 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$IPVS_CMD_GET_SERVICE(r5, &(0x7f00000022c0)={0x0, 0x0, &(0x7f0000002280)={&(0x7f0000000100)={0x28, 0x0, 0x1, 0x70bd2d, 0x25dfdbff, {}, [@IPVS_CMD_ATTR_SERVICE={0x14, 0x1, 0x0, 0x1, [@IPVS_SVC_ATTR_FWMARK={0x8, 0x5, 0x3}, @IPVS_SVC_ATTR_AF={0x6, 0x1, 0x2}]}]}, 0x28}, 0x1, 0x0, 0x0, 0x40}, 0x12) socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFQNL_MSG_CONFIG(r4, &(0x7f00000002c0)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x20}, 0xc, &(0x7f0000000280)={&(0x7f00000001c0)={0x38, 0x2, 0x3, 0x5, 0x0, 0x0, {0x1, 0x0, 0x3}, [@NFQA_CFG_CMD={0x8, 0x1, {0x1, 0x0, 0x26}}, @NFQA_CFG_MASK={0x8, 0x4, 0x1, 0x0, 0x1}, @NFQA_CFG_PARAMS={0x9, 0x2, {0x3}}, @NFQA_CFG_MASK={0x8, 0x4, 0x1, 0x0, 0x23}]}, 0x38}, 0x1, 0x0, 0x0, 0x20000800}, 0x800) r6 = socket$inet_udp(0x2, 0x2, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000240)=ANY=[@ANYBLOB="3cfaffff0f00010400eeff0dca000000ff030000", @ANYRES32, @ANYRES16], 0x3c}, 0x1, 0x0, 0x0, 0x40020c1}, 0x0) sendmsg$MPTCP_PM_CMD_FLUSH_ADDRS(0xffffffffffffffff, &(0x7f0000000600)={&(0x7f00000004c0)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f00000005c0)={&(0x7f0000000540)={0x2c, 0x0, 0x300, 0x70bd2d, 0x25dfdbfc, {}, [@MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x8}, @MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x6}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8}]}, 0x2c}}, 0x20008804) bind$inet(r6, &(0x7f0000000100)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0x42}}, 0x10) connect$inet(r6, &(0x7f0000000040)={0x2, 0x0, @multicast2}, 0x10) sendmmsg$inet(r6, &(0x7f0000004d00)=[{{0x0, 0x6000, 0x0, 0x0, 0x0, 0x0, 0x30000}}], 0x400000000000284, 0xf00) socket$packet(0x11, 0x2, 0x300) r7 = bpf$MAP_CREATE(0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="1e000000000000000400000007"], 0x50) r8 = socket(0x10, 0x3, 0x0) write(r8, &(0x7f0000000580)="240000001e005f031400ff01000000f80700b3586ff606c2e553797c080008e467dc0000", 0x24) bpf$MAP_LOOKUP_ELEM(0x2, &(0x7f0000001740)={r7, 0x0, &(0x7f0000001700)=""/53}, 0x20) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000a40)={0x3, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r7, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000005900000095"], 0x0}, 0x94) r9 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r9, &(0x7f00000008c0)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x24048011}, 0xc000) 745.188315ms ago: executing program 3 (id=4401): r0 = socket$inet_tcp(0x2, 0x1, 0x0) shutdown(r0, 0x0) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) r2 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r2, &(0x7f00000001c0)={0x2, 0x1, @local}, 0x10) connect$inet(r2, 0x0, 0x0) sendmmsg(r2, &(0x7f0000007fc0), 0x800001d, 0x0) socket$nl_route(0x10, 0x3, 0x0) r3 = socket$inet6_sctp(0xa, 0x801, 0x84) shutdown(r3, 0x1) getsockopt$inet_sctp6_SCTP_DEFAULT_SNDINFO(r3, 0x84, 0x22, &(0x7f00000002c0)={0x0, 0x4, 0x6, 0x800}, &(0x7f0000000340)=0x10) sendmsg$IPSET_CMD_CREATE(r1, &(0x7f0000001240)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000100)=ANY=[@ANYBLOB="0000000500"/20], 0x14}}, 0x40880) r4 = socket(0x2b, 0x1, 0x1) setsockopt$inet6_MCAST_MSFILTER(r4, 0x29, 0x30, &(0x7f0000000080)=ANY=[@ANYBLOB="02000000000000000a004e24ffffefda000000000000000000000000000000010700"/144], 0x90) bind$inet(r2, &(0x7f0000000040)={0x2, 0x4e21, @local}, 0x10) connect$inet(r0, &(0x7f0000000180)={0x2, 0x4e21, @local}, 0x10) r5 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x48241, 0x0) ioctl$TUNSETIFF(r5, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x6bf1c2d5adba8c32}) r6 = socket$kcm(0x2, 0xa, 0x2) ioctl$SIOCSIFHWADDR(r6, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local}) r7 = socket$igmp6(0xa, 0x3, 0x2) ioctl$sock_SIOCSIFVLAN_ADD_VLAN_CMD(r7, 0x8983, &(0x7f0000000300)={0x0, 'syzkaller1\x00', {0x2}}) write$tun(r5, &(0x7f0000000340)=ANY=[@ANYRES16], 0xc6) setsockopt$inet_tcp_TCP_REPAIR(r0, 0x6, 0x13, 0x0, 0x0) sendto$inet(r0, &(0x7f00000004c0)='<', 0x381, 0x805, 0x0, 0x0) r8 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$IPT_SO_SET_REPLACE(r8, 0x0, 0x40, &(0x7f0000000600)=@filter={'filter\x00', 0xc, 0x4, 0x268, 0xffffffff, 0x130, 0x130, 0x98, 0x98, 0xffffffff, 0x1d0, 0x98, 0x1d0, 0x98, 0x4, 0x0, {[{{@uncond, 0x0, 0x70, 0x98}, @REJECT={0x20}}, {{@uncond, 0x0, 0x70, 0x98}, @common=@unspec=@STANDARD={0x28, '\x00', 0x0, 0xffffffffffffffff}}, {{@ip={@local, @broadcast, 0x0, 0x0, 'ip6tnl0\x00', 'hsr0\x00'}, 0x0, 0x70, 0xa0}, @common=@unspec=@CONNMARK={0x30}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x2c8) r9 = socket$inet6(0xa, 0x3, 0x5) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r9, 0x29, 0x20, &(0x7f0000000100)={@dev={0xfe, 0x80, '\x00', 0x41}, 0x800, 0x0, 0x3, 0x9, 0x1}, 0x20) 502.295637ms ago: executing program 0 (id=4402): socket$inet6_sctp(0xa, 0x1, 0x84) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x13, &(0x7f0000000000)=0x100000001, 0x4) connect$inet6(r0, &(0x7f0000000300)={0xa, 0x1, 0xfffffffe, @ipv4={'\x00', '\xff\xff', @dev={0xac, 0x14, 0x14, 0x2e}}}, 0x1c) (async) connect$inet6(r0, &(0x7f0000000300)={0xa, 0x1, 0xfffffffe, @ipv4={'\x00', '\xff\xff', @dev={0xac, 0x14, 0x14, 0x2e}}}, 0x1c) setsockopt$inet6_tcp_TCP_ULP(r0, 0x6, 0x1f, &(0x7f00000000c0), 0x4) setsockopt$inet6_tcp_TLS_TX(r0, 0x11a, 0x1, &(0x7f0000000280)=@gcm_256={{0x303}, "1afc7c14d332bcc6", "a9ba0c85d68723369f51322151d9f41aaa2832bb07cc1e49ad714beac6f1ade8", "49960d8f", "bff2a81527ae4190"}, 0x38) (async) setsockopt$inet6_tcp_TLS_TX(r0, 0x11a, 0x1, &(0x7f0000000280)=@gcm_256={{0x303}, "1afc7c14d332bcc6", "a9ba0c85d68723369f51322151d9f41aaa2832bb07cc1e49ad714beac6f1ade8", "49960d8f", "bff2a81527ae4190"}, 0x38) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$nbd(&(0x7f0000000200), r1) sendmsg$NBD_CMD_CONNECT(r1, &(0x7f00000027c0)={0x0, 0x0, &(0x7f0000002780)={&(0x7f00000002c0)=ANY=[@ANYBLOB='<\x00\x00\x00', @ANYRES16=r2, @ANYBLOB="010029bd7000fbdbdf25010000000c00020000000000000000001c0007801800018008000100", @ANYBLOB="04"], 0x3c}, 0x1, 0x0, 0x0, 0x4000004}, 0x4000) (async) sendmsg$NBD_CMD_CONNECT(r1, &(0x7f00000027c0)={0x0, 0x0, &(0x7f0000002780)={&(0x7f00000002c0)=ANY=[@ANYBLOB='<\x00\x00\x00', @ANYRES16=r2, @ANYBLOB="010029bd7000fbdbdf25010000000c00020000000000000000001c0007801800018008000100", @ANYBLOB="04"], 0x3c}, 0x1, 0x0, 0x0, 0x4000004}, 0x4000) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='freezer.state\x00', 0x275a, 0x0) write$cgroup_int(r3, &(0x7f0000000000), 0xffffff6a) getsockopt$inet_sctp6_SCTP_GET_ASSOC_ID_LIST(r3, 0x84, 0x1d, &(0x7f0000000100)={0x6, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}, &(0x7f00000001c0)=0x1c) (async) getsockopt$inet_sctp6_SCTP_GET_ASSOC_ID_LIST(r3, 0x84, 0x1d, &(0x7f0000000100)={0x6, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}, &(0x7f00000001c0)=0x1c) r4 = socket$inet6_sctp(0xa, 0x1, 0x84) socket$inet6_sctp(0xa, 0x6, 0x84) (async) r5 = socket$inet6_sctp(0xa, 0x6, 0x84) setsockopt$MRT_DEL_VIF(r3, 0x0, 0xcb, &(0x7f0000000480)={0x0, 0x0, 0x7, 0x2b, @vifc_lcl_addr=@local, @broadcast}, 0x10) (async) setsockopt$MRT_DEL_VIF(r3, 0x0, 0xcb, &(0x7f0000000480)={0x0, 0x0, 0x7, 0x2b, @vifc_lcl_addr=@local, @broadcast}, 0x10) r6 = socket$nl_netfilter(0x10, 0x3, 0xc) r7 = socket$nl_crypto(0x10, 0x3, 0x15) sendmsg$nl_crypto(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000240)=ANY=[@ANYBLOB="e00000001300100000000000000000007374726565626f673531322d67656e657269"], 0xe0}}, 0x0) sendmsg$nl_crypto(r7, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000340)=ANY=[], 0xf0}, 0x1, 0x0, 0x0, 0x4004080}, 0x0) sendmsg$NFT_MSG_GETCHAIN(r6, &(0x7f0000000440)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x800800}, 0xc, &(0x7f0000000400)={&(0x7f00000004c0)=ANY=[@ANYBLOB="20000000040a010100000000000000000a0000010900030073797a320000000083df0a63f183422e4215036c08a6377775327d731a22565a505990290b084f38d7af564b530c79f51a3b1c74ad86292d882cae"], 0x20}, 0x1, 0x0, 0x0, 0x40}, 0x80) r8 = socket$tipc(0x1e, 0x2, 0x0) bind$bt_hci(r8, &(0x7f0000000040), 0x6) setsockopt$inet_sctp6_SCTP_SOCKOPT_BINDX_ADD(r5, 0x84, 0x64, &(0x7f0000000000)=[@in={0x2, 0x4e22, @empty}], 0x10) (async) setsockopt$inet_sctp6_SCTP_SOCKOPT_BINDX_ADD(r5, 0x84, 0x64, &(0x7f0000000000)=[@in={0x2, 0x4e22, @empty}], 0x10) listen(r5, 0x3) sendmsg$inet6(r4, &(0x7f0000001dc0)={&(0x7f0000000840)={0xa, 0x4e22, 0x906, @loopback, 0x7}, 0x1c, &(0x7f0000001d40)=[{&(0x7f0000000880)="fa", 0x1}], 0x1}, 0x40085) (async) sendmsg$inet6(r4, &(0x7f0000001dc0)={&(0x7f0000000840)={0xa, 0x4e22, 0x906, @loopback, 0x7}, 0x1c, &(0x7f0000001d40)=[{&(0x7f0000000880)="fa", 0x1}], 0x1}, 0x40085) socket$netlink(0x10, 0x3, 0x4) (async) socket$netlink(0x10, 0x3, 0x4) ioctl$sock_SIOCGIFINDEX_802154(r1, 0x8933, &(0x7f0000000140)={'wpan4\x00'}) (async) ioctl$sock_SIOCGIFINDEX_802154(r1, 0x8933, &(0x7f0000000140)={'wpan4\x00'}) writev(r4, &(0x7f0000000380)=[{&(0x7f0000000340)="c92d1e3b0a6074a0cc43557ba36afdd7855ae9a1422e6e9c787d6b9e77c9289297de25de5c8e8a52ff185f5b58a103b4f7129a28782700c1049f1533"}], 0x10000000000003a2) writev(0xffffffffffffffff, &(0x7f0000000000)=[{&(0x7f0000000540)="480000001400190d09004b87000000000000006080ffe00600004e22590000a2bc5603ca00000f7f89000000200000000101ff0000000309ff5bffff00c7e5ed5e000000000000001895a9eab28438823aba7f9b2dc4274390ccf715f256a710e20fe9c4a026e9c7b304238b7f73829772c86f85480cb58e78186648f9f583", 0xab}], 0x1) sendfile(r0, r3, 0x0, 0x20000000002) 452.445763ms ago: executing program 3 (id=4403): r0 = socket$nl_xfrm(0x10, 0x3, 0x6) r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f00000004c0)={0x26, 'aead\x00', 0x0, 0x0, 'gcm(anubis)\x00'}, 0x58) ioctl$NILFS_IOCTL_SYNC(r1, 0x80086e8a, &(0x7f0000000180)) r2 = socket(0x80000000000000a, 0x2, 0x0) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_GET_CTRZERO(r3, &(0x7f0000005f80)={0x0, 0x0, &(0x7f0000005f40)={&(0x7f0000000280)=ANY=[@ANYBLOB="480000000301010800000000000000000200000806001240000100002c0002800c0002801b00010088000000060003400004000014000180080001000a010102080002"], 0x48}, 0x1, 0x0, 0x0, 0x8000}, 0x20000040) setsockopt$EBT_SO_SET_COUNTERS(r2, 0x0, 0x81, 0x0, 0x0) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, &(0x7f0000c18000)="ad56b6c5820fae9d6dcd3292ea54c7beef915d564c90c200", 0x18) sendmmsg$alg(0xffffffffffffffff, &(0x7f0000000380)=[{0x0, 0x0, &(0x7f0000000140)=[{&(0x7f0000000080)="f78d9ca38fff48f3be52163448412ba8", 0x10}, {&(0x7f0000000440)="ebe3a0e9796cfd1647e299f4e376fdba128280b372219d205e81f4a7f71c1926aae1efd7e0054a863f3d5cfe6cb55b5bb9fa6935849e6098ed884e7cbc812ff5b517", 0x42}], 0x2, &(0x7f0000000940)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18, 0x28044854}], 0x1, 0x40800) recvmsg(0xffffffffffffffff, &(0x7f00000005c0)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f00000000c0)=""/81, 0x51}, {&(0x7f0000000200)=""/74, 0x4a}], 0x2}, 0x0) setsockopt$bt_l2cap_L2CAP_OPTIONS(r2, 0x6, 0x1, &(0x7f0000000540)={0x7, 0x4, 0x4, 0x6b, 0x8, 0xd0, 0x81}, 0xc) ioctl$FIOCLEX(0xffffffffffffffff, 0x5451) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(0xffffffffffffffff, 0x89f0, &(0x7f0000000300)={'syztnl2\x00', &(0x7f0000000280)={'ip_vti0\x00', 0x0, 0x7, 0x700, 0x2, 0x0, {{0x12, 0x4, 0x2, 0x5, 0x48, 0x64, 0x0, 0x4, 0x29, 0x0, @broadcast, @rand_addr=0x64010100, {[@generic={0xc, 0x2}, @timestamp_prespec={0x44, 0x1c, 0xa4, 0x3, 0x8, [{@empty, 0x4}, {@loopback, 0x1ff}, {@remote, 0x5}]}, @timestamp_addr={0x44, 0x14, 0xb3, 0x1, 0xd, [{@remote, 0xb2f2}, {@multicast2, 0x9}]}]}}}}}) sendmsg$nl_xfrm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000340)=@newsa={0x16c, 0x10, 0x713, 0x0, 0x25dfdbfc, {{@in=@rand_addr=0x64010101, @in6=@ipv4={'\x00', '\xff\xff', @private=0xa010102}, 0xffff, 0x0, 0x4e21, 0x2, 0xa, 0x0, 0x0, 0x1d, r4}, {@in6=@local, 0xfe, 0x32}, @in6=@empty, {0x0, 0x0, 0xfffffffffffffffd, 0x8, 0x1, 0xb, 0x7fffffff, 0x543}, {0x4, 0x8000000000000002}, {0x2}, 0x70bd2c, 0x3500, 0xa, 0x2, 0x0, 0x50}, [@encap={0x1c, 0x4, {0x7, 0x4e24, 0x4e20, @in6=@dev={0xfe, 0x80, '\x00', 0x2d}}}, @algo_aead={0x60, 0x12, {{'rfc4106(gcm(aes))\x00'}, 0xa0, 0x40, "210466d38547aa140db9a200000000c538c7cb7a"}}]}, 0x16c}, 0x1, 0x0, 0x0, 0x880}, 0x0) 414.014421ms ago: executing program 2 (id=4404): r0 = socket$nl_route(0x10, 0x3, 0x0) setsockopt$netlink_NETLINK_TX_RING(r0, 0x10e, 0xc, &(0x7f0000000040)={0x80}, 0x10) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000007c0)={&(0x7f00000000c0)=@ipv4_newroute={0x24, 0x1a, 0x1, 0x80000000, 0x25dfdbfb, {0xa, 0x80, 0x80}, [@RTA_IP_PROTO={0x5, 0x1b, 0x11}]}, 0x24}, 0x1, 0x0, 0x0, 0x14}, 0x20000050) r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f0000010400)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc-cast6-avx\x00'}, 0x58) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, &(0x7f0000c18000)="ad56b6c5820fae9d6dcd3292ea54c7beef915d564c90c200", 0x18) r2 = accept4(r1, 0x0, 0x0, 0x80800) sendmmsg$alg(r2, &(0x7f0000000040)=[{0x0, 0x0, 0x0, 0x0, &(0x7f0000000540)=ANY=[@ANYBLOB="18000000000000001701000003000000010000000000000018000000000000001701000003000000010000000000000050"], 0x80}], 0x1, 0x40800) bpf$PROG_LOAD(0x5, &(0x7f00000017c0)={0x1, 0xe, &(0x7f0000000d00)=ANY=[@ANYBLOB="b70000008100003bbfa30000000000000703000000feffff720af0fff8ffffff71a4f0ff0000000071105400000000001d400500000000004704000001ed00000f030000000000001d440000000000006b0a18fe000000007313f80000000000b5000000000000009500000000000000023bc065b58111c6dfa041b63af4a3912435f1a864a710aad58db6a693002e7f3be361917adef6ee1c8a2a4f8ef1e50becb19bc461e91a7168c50000000190f32050e436fe275daf51efd601b6bf01c8e8b1b526375ec4dd6fcd82e4fee5bef7af9aa0d7d600c095199fe3ff31a8fd3c0fd8b7ff831028e599b0eaebbdbd732c9cc00eec363e4a8f6456e2cc21557c0afc646c0200000000000000020000e35208b0bb0d2cd829e654400e2438ec649dc76128610643a98d9ec21ead2ed51b104d4d91af25b845d8a7925c3109b151b8b9f75dd08d123deda82fc9c4d7ecc7a803bf28bf7076c15b463bebc72f526d8e8afcb913466aaa7f6df70252e79166d858fcd0e06dd31af9612f2460d0b11008e59a5923906f88b53987ad1714f62ba7a54f0c33d39000d0bfed3a6a59ff616236fd8f2477184bdef728d236619074d6ebdfd1f5089048ddff6da40f9411fe722631cb467600ade70063e5291569b33d21dae356e1c51f03a801be8189679a16da18ec0ae564162a27afea62d84f3a10746443d6438e959532e0617d419c6bc6ea9f2bca4464f56e24e6d2105bd901204a1deeed4155617572652d950ad31928b0b0c3dc2869f478341d02d0f5ad94b081fcd507acb4b9c65fee9d5a17f48a7382f13d000000225d85ae49cee383dc5049076b989b40000000000000da60d2ae20cfb91d6a49964757cdf538f9ce2bdb1ab062cd54e67011d355d84ce97bb0c6b4a595e487efbb2d71cde2c140952f9a0f0bc6980fe78683ac5c0c31032599ddd71063be9261b2e1aab1675b34a22048ef8c126aeef5f510a8f1aded94a129e4aec6f8d9ab06fa2e04cfe0649226c697d9e8eaade69d0540059fe6c7fe7cd8697502c7596566d674e425da5e87e59602a9f6590521d31d3804b3e0a1053abdc31282dfb15eb6841bb64a1b304502dda787343ce3c953992e4a982f3c48153baae244e7bf37548c7f1a4cad2422ee965a38f7defbd2160242b104e20dc2d9b0c35608d402ccdd9069bd50b994fda7a9de44028d6112a0c2d21b2dc98816106dec28eaeb883418f562ae00023ea96d10f172c0374d6eed826416050000000bfe9b4a9c5a90ff59d54d1f92ecc4e95dd2d18383117c039862198899b212c55318294270a1ad10c80fef7c24d47afce829ba0f85da6d888f18ea40ab959f6074ab2a40d85d15017ab513cdc6c0e57fb1c1ca571380d7b4ead35a385e0b4a26b702396df7e0c1e02b6e4114f244a9bf93f04bf072f0861f7580e69db384ac7eeedcf2ba1a9508f9d6aba582a896a9f1ffa968eacea75caf822a7a63ba34015ea5aacb1188883ad2a3b1832371fe5bc621426d1ed0a4a99702cc1b6912a1e717d29135753208165b9cdbae2ed9dc7358f0ebadde0b727f27feeb744ddcc536cbae315c7d1fe1399562ba6824840bd2951680f6f2f9a6a83469620c6e74e1f46132559c4f8700a350845ffa0d829e4f79adc287906943408e6df3c391e97ba48db0a5adbfd03aac93df8866fb010aec0e92bed1fe39af169d2a466f0db6f3d9436a7d55fc30511d00000000c95265b2bd83d64a532869d701723fedcbada1ee7baa5b6a686b50f0937f778af083e055f6138a757ebd0ed91124a6b244f9acf41ac5d73a008364e0606a594817031fc2f52c8785fe0721719b3d654026c6ea08b83b123145ab5703dad844ceb201ddeb6dc5f6a903792283c42efc54fa84323afc4c10eff462c8843187f1dd48ef3fa293774d582956ff0f40b10ca94f6feeb2893c17888e1cdba94a6ea80c33ead5722c3293a493f1479531dd88f15efaaeea831555877f9538d6ee6ba65893ff1f908ba7554ba583fef3ec7932f5954f31a878e2fae6691d1aee1da02ba516467df3e7d1daac43738012e4fee18a22da19fcdb4c2890cda1f96b952511e3a69d694d625e0b2f808890205f3a6da2819d2f9e77c7c64affa54fec0136cbafa5f6f096753b639a920099c1f69219927ea5301fff0a6063d427f0688430754c02180d61542c2571f983e9673560000000000000000005a7b57f03ca91a01ba2e30ca99e8ebc15ecb4d91675767999d146aef7799738b292fd640dfef6b04d086f737a159d7e0c6e4d81ad64a8bbca48568325b2969e2b15f36b788bce5ccdbaf75c94cb93499f6947a967a7bce14c6de4e7c0660d80010f5c653d22d49030a8c2a4ab595bf4238f18ca428dafc7ac96d404607a0000000051a2104f22e6db5a62b5089c1b45282d38864daa3ae81d6b0968d1d2867b91b7d120617d12d91db2633d6864da40fc5d2f55ff07c53147de202ce517b54783a17aaeb6737c323f9f98e354cc98dcfe23ad01bd1c61563e69ffe1c2c73e1661061173f359e9052a4cecd89008f70314a0bdd491ec86a4555d89fe0120f64c62e8e3ed8bcb45202c3d4bbec8d722824c0ebca8db1ea4a003d2fbdc1f9be78537756ab5bbe4fe9af5d785d0128171c90d9900ce2532b0f9d01c4b45294fbba468df3e1b393cb4e62e754598e47df6bd06431c94bc5d047899fd219f448bf9189c65c9d91eda6b52a373803a9efe44f86909bc90addb7b9aee813df534aac4b3093c91b8068cd84990453f006694d461b76a58d88cf0f520310a1e9fdc18cde98d662eee077515d0a8811922929e085392ab3d1311b8243266d87047f601fa88a0da36b9f302e8262395174328f2482d14008de83070744f143fdec90ba5a82668d5fac114c13955ad6dca5db2231d8ba14c54c47ed04a4b4ace17e357e1d6432399f87a7a14245bbd796a09313b247b95d37ff40a404bdad74bd20000000000000000000099fef7cd7af3ce64a92f95d89d125b1e641240d7e5e27a3d1f7684448c3e3822d617e205061298b939a191be4b48e169bde2cae3accc5bd40a2968b59c93d35f8e42366fdef9a2abae1cf01ce68abff26b61aac8aaa54ebbcefd23f21ce8153b9926e12e925cb56119df72c7533a48d028ad0c74e2a9478fa3ba18a1a2b65079cc1c7bc46dd12305a1ae9dd19e8d525206c0a728cfd42193abe8130bc01a2d69841f3d7799ac04bdc590bb1c89b9c695f163e57343c9bfb59909433c9001c5f8b23e26534a538fc933cac6c2a92d038df638a0f226df9fb857bd414c2cd69985e8053e3dfa41614d7c74d04d8c2471041d17c730fad28395f8d4688898cd58b9d600c851626529bb58aa364b55e73f053450665e7b94ad1012fd7a8139166fd5e59c84f4ab279b1b99c028db4cb9680c8035f967db18de738844da7e260a830c1ffa49f5af3c15423a0e315acb82a3e89218cb314e68fda4d94aa1d815babc13b9fd336dfaa6d5d164301190bc2d4c04087729033342045804a28082abc3b4762302a271722fb515f31e0dd115a292f1e68481a62c49d15ea5460a29c60b1058fb7aa9bf4ee3cbe11b03711a15d730646b72d074dab1e8c429339f3460d324c17a4a8bfc7d7eab45bef00664d6dc82300000000000"], &(0x7f00000001c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x0, 0x10, &(0x7f0000000000), 0xfffffffffffffd00}, 0x48) 154.280743ms ago: executing program 2 (id=4405): socket$pppl2tp(0x18, 0x1, 0x1) (async) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000240)={0xffffffffffffffff, 0xfca804a0, 0x0, 0x8, &(0x7f00000002c0), &(0x7f0000000300)=""/8, 0x2f00, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) r0 = socket$packet(0x11, 0x2, 0x300) (async, rerun: 64) bpf$PROG_LOAD(0x5, &(0x7f0000000280)={0x15, 0x2000000000000216, 0x0, 0x0, 0xffffffff, 0x0, 0x0, 0x0, 0x1c, '\x00', 0x0, @fallback=0x28, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0xfffffffc}, 0x94) (rerun: 64) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000880)={0x1, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x10, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) setsockopt$sock_attach_bpf(r0, 0x1, 0x32, &(0x7f0000000180)=r1, 0x4) (async) r2 = socket$netlink(0x10, 0x3, 0x10) bind$netlink(r2, &(0x7f0000514ff4)={0x10, 0x0, 0x0, 0x2ffffffff}, 0xc) (async) r3 = socket$netlink(0x10, 0x3, 0x10) bind$netlink(r3, &(0x7f0000514ff4)={0x10, 0x0, 0x25dfdbfd, 0x2ffffffff}, 0xc) (async) setsockopt$sock_int(r3, 0x1, 0x8, &(0x7f0000000000)=0x80, 0x4) (async, rerun: 64) syz_genetlink_get_family_id$nl80211(0x0, r3) (async, rerun: 64) r4 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r4, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000440)={0x14, 0x2e, 0x9, 0x70bd27, 0x0, {0x4}}, 0x14}, 0x1, 0x0, 0x0, 0x42804}, 0x0) (async) r5 = socket$netlink(0x10, 0x3, 0x8000000004) r6 = bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=@base={0x1b, 0x0, 0x0, 0x8000}, 0x50) r7 = bpf$PROG_LOAD(0x5, &(0x7f0000000400)={0x1, 0x14, &(0x7f0000000540)=@ringbuf={{0x18, 0x0, 0x0, 0x0, 0x107a655, 0x0, 0x0, 0x0, 0x10}, {{0x18, 0x1, 0x1, 0x0, r6}}, {}, [@ringbuf_query={{0x18, 0x1, 0x1, 0x0, r6}, {0x7, 0x0, 0xb, 0x2, 0x0, 0x0, 0x3}}, @call={0x85, 0x0, 0x0, 0x7}], {{}, {}, {0x85, 0x0, 0x0, 0x85}}}, &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, @fallback=0x6, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffc6, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000240)={r7, 0xfca804a0, 0x10, 0x38, &(0x7f00000002c0)="b800000500000000", &(0x7f0000000300)=""/8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x4c) syz_emit_ethernet(0x7a, &(0x7f0000000180)=ANY=[@ANYBLOB="0180c2000003ffffffffffff86dd6800080000442f01fc010000000000000000000000000000ff0200000000000000000000000000010c2086dd0000000100000800080086dd080088be00000000150e0cc00100000000000003080022eb000000042f0157400200000000000004000207100800655800000204ecbf204ac6e2491a26816280c87cd80b98d567eae9cce4788dabc07cca733e963e5e16812e329abf8233e69ef2d38b492704f05bafc745c510c3e4d43b4da39e943f00f159a437d5b3ea29ccb3d116a9dc2f75bfa983bf6c91823238233d53969e83bc10cd4d674ff887910fda45c83190fbf50306723dd677e0555d38b0ed15dccff453435b50296a22de3d"], 0x0) (async) writev(r5, &(0x7f0000000140)=[{&(0x7f0000000080)="580000001400192340834b80040d8c560a067f020004000000000000000058000b4824ca945f64009400ff0325010ebc000b00000000008000f0fffeffe809005300fff5dd000000100001d80cf42098da03870000000000", 0x58}], 0x1) (async) syz_genetlink_get_family_id$ipvs(&(0x7f0000000040), r5) 124.148337ms ago: executing program 3 (id=4406): syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000940)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f0000000000)="d8000000100081046881f782db44b904021d080b01000000e8fe55a11800150006001400030000120800040043000000a80016000a0001", 0x37}], 0x1}, 0x0) r0 = bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000300)={0x6, 0x3, &(0x7f0000000680)=ANY=[@ANYBLOB="1800000002000000000000000000000095"], 0x0}, 0xe4) r1 = bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000200)={0x6, 0x3, &(0x7f0000000680)=ANY=[], &(0x7f00000002c0)='syzkaller\x00'}, 0x94) write$cgroup_subtree(0xffffffffffffffff, &(0x7f0000000000)=ANY=[@ANYBLOB="8fed007907001175f37538e486dd63"], 0xcfa4) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000600)={r1, 0x5, 0xb68, 0x0, &(0x7f0000000000)='%', 0x0, 0xd01, 0x88be, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x48) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) r3 = socket(0x40000000015, 0x5, 0x0) getsockopt(r3, 0x200000000114, 0x3, 0x0, &(0x7f00000003c0)) sendmsg$NFT_BATCH(r2, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000003c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a05000000000000000000010000000900010073797a30000000002c000000030a01020000000000000000010000000900010073797a30000000000900030073797a310000000068000000060a010400000000000000000100000008000b4000000000400004802800018007000100637400001c000280080001"], 0xdc}, 0x1, 0x0, 0x0, 0x15}, 0x4000000) socketpair(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff}) r5 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r6 = syz_genetlink_get_family_id$nbd(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$NBD_CMD_CONNECT(r5, &(0x7f0000001ac0)={0x0, 0x0, &(0x7f0000001a80)={&(0x7f0000001600)={0x48, r6, 0x1, 0x70bd2c, 0x1000, {}, [@NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x2}, @NBD_ATTR_SOCKETS={0x1c, 0x7, 0x0, 0x1, [{0xc, 0x1, 0x0, 0x1, {0x8, 0x1, r4}}, {0xc, 0x1, 0x0, 0x1, {0x8, 0x1, r4}}]}, @NBD_ATTR_SERVER_FLAGS={0xc, 0x5, 0x128}]}, 0x48}}, 0x4) r7 = socket$inet6(0xa, 0x1, 0x0) getsockopt$inet6_int(r7, 0x29, 0x2, 0x0, &(0x7f0000000000)=0xfffffffffffffd96) getsockopt$inet_sctp_SCTP_SOCKOPT_PEELOFF(0xffffffffffffffff, 0x84, 0x66, &(0x7f0000000040)={0x0, 0x1}, &(0x7f0000000080)=0x8) r9 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000340)=ANY=[@ANYBLOB="02000000040000000800000001"], 0x48) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000400)={0xd, 0x10, &(0x7f0000000180)=ANY=[@ANYBLOB="18000000000000000000000000000000b7080000000000007b8af8ff00000000b7080000000000007b8af0ff00000000bf8100000000000007080000f8ffffffbfa400000000000007040000f0ffffffb70200000800000018210000", @ANYRES32=r9, @ANYBLOB="0000000002000000b705000008000000850000005d00000095"], 0x0, 0x2, 0x0, 0x0, 0x0, 0x5}, 0x94) bpf$PROG_LOAD(0x5, &(0x7f0000000a40)={0xd, 0x10, &(0x7f0000000180)=ANY=[], &(0x7f0000000980)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x40, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffc}, 0x94) getsockopt$inet_sctp6_SCTP_PARTIAL_DELIVERY_POINT(r7, 0x84, 0x13, &(0x7f00000000c0)={r8, 0x100}, &(0x7f0000000100)=0x8) mmap(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x8, 0x2010, r0, 0xb0e7a000) 0s ago: executing program 0 (id=4407): socketpair$tipc(0x1e, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = bpf$PROG_LOAD(0x5, &(0x7f0000000040)={0x1, 0x4, &(0x7f0000000400)=ANY=[@ANYBLOB="1800000000000000000000000000000085000000a000000095"], &(0x7f0000000100)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x2a, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r3 = socket$inet_tcp(0x2, 0x1, 0x0) r4 = socket$nl_route(0x10, 0x3, 0x0) r5 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000100)={'veth1_to_team\x00', 0x0}) sendmsg$nl_route(r4, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000080)=@dellinkprop={0x20, 0x6c, 0x1, 0x70bd23, 0x25dfdbfd, {0x0, 0x0, 0x0, r6, 0x1a, 0x2800}}, 0x20}, 0x1, 0x0, 0x0, 0x4044064}, 0x40000) setsockopt$sock_int(r3, 0x1, 0xf, &(0x7f0000000000)=0x20, 0x4) setsockopt$sock_attach_bpf(r3, 0x1, 0x34, &(0x7f00000000c0)=r2, 0x4) bind$inet(r3, &(0x7f0000000140)={0x2, 0x4e23, @multicast2}, 0x10) listen(r3, 0x0) getsockopt$IPT_SO_GET_ENTRIES(r3, 0x0, 0x41, &(0x7f0000000200)={'raw\x00', 0x4c, "1236cc401f86593199e6a60b8b52acb4e0895243048952d3820c3742fabe827c2d2e9861206dcc96902cfb811d4873e52f1b27fcc357b02832d4983faec18968b7de492b5b6918423fbc58a9"}, &(0x7f0000000280)=0x70) r7 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) getsockopt$bt_BT_FLUSHABLE(r7, 0x112, 0x8, &(0x7f0000000180)=0x4, &(0x7f00000002c0)=0x4) recvmsg(r0, &(0x7f0000000140)={&(0x7f0000000040)=@hci, 0x80, &(0x7f0000000100)=[{&(0x7f0000000400)=""/248, 0xf8}], 0x1, 0x0, 0xfffffffffffffe4d}, 0x1e02) mmap(&(0x7f00004f1000/0x3000)=nil, 0x3000, 0x2000006, 0x110, 0xffffffffffffffff, 0x533e6000) socket$inet_smc(0x2b, 0x1, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000500)={0x0}}, 0x4854) r8 = socket$alg(0x26, 0x5, 0x0) sendmsg$NL80211_CMD_CRIT_PROTOCOL_START(0xffffffffffffffff, &(0x7f0000000600)={&(0x7f0000000300)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f00000005c0)={&(0x7f0000000540)=ANY=[@ANYBLOB='P\x00\x00\x00', @ANYRES16=0x0, @ANYBLOB="040027bd7000ffdbdf256200000008000300", @ANYRES32=0x0, @ANYBLOB="0c0099000104000021b300020000000600b400560000000600b300020000000600b300020000000600b300030000000000000000"], 0x50}, 0x1, 0x0, 0x0, 0x40800}, 0x20004040) bind$alg(r8, &(0x7f00000001c0)={0x26, 'aead\x00', 0x0, 0x0, 'gcm(aes)\x00'}, 0x4c) accept4(r8, 0x0, 0x0, 0x0) socket$nl_route(0x10, 0x3, 0x0) bpf$MAP_CREATE(0x0, &(0x7f0000000180)=@base={0x1b, 0x0, 0x0, 0x8000, 0x80004}, 0x50) socket$inet6_tcp(0xa, 0x1, 0x0) socket$phonet_pipe(0x23, 0x5, 0x2) socket$inet6_tcp(0xa, 0x1, 0x0) unshare(0x2c020400) pselect6(0x40, &(0x7f00000001c0)={0x0, 0x1, 0x3, 0xffffffffffffbffd, 0x0, 0x100000001}, 0x0, &(0x7f00000002c0)={0x3ff, 0xb, 0x0, 0x4b, 0x0, 0x0, 0x7fffffff}, 0x0, 0x0) close(r1) kernel console output (not intermixed with test programs): ): interface not active [ 483.693772][T18173] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 483.732082][T18173] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 483.802798][T18173] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 483.970770][T18364] netlink: 'syz.3.3135': attribute type 1 has an invalid length. [ 483.990684][T18173] hsr_slave_0: entered promiscuous mode [ 484.010146][T18364] netlink: 'syz.3.3135': attribute type 2 has an invalid length. [ 484.025116][T18173] hsr_slave_1: entered promiscuous mode [ 484.044930][T18364] netlink: 'syz.3.3135': attribute type 1 has an invalid length. [ 484.061990][T18364] netlink: 'syz.3.3135': attribute type 3 has an invalid length. [ 484.071049][T18173] debugfs: 'hsr0' already exists in 'hsr' [ 484.077795][T18173] Cannot create hsr debugfs directory [ 484.090297][T18364] netlink: 4 bytes leftover after parsing attributes in process `syz.3.3135'. [ 484.603135][T18383] netlink: 'syz.4.3140': attribute type 22 has an invalid length. [ 484.637406][T18383] netlink: 4 bytes leftover after parsing attributes in process `syz.4.3140'. [ 484.780477][T18387] netlink: 'syz.3.3141': attribute type 10 has an invalid length. [ 484.814709][T18387] netlink: 152 bytes leftover after parsing attributes in process `syz.3.3141'. [ 484.906179][T18389] netlink: 8 bytes leftover after parsing attributes in process `syz.1.3142'. [ 484.952857][T18389] netlink: 12 bytes leftover after parsing attributes in process `syz.1.3142'. [ 485.033088][T18395] IPVS: sync thread started: state = MASTER, mcast_ifn = bridge_slave_0, syncid = 3, id = 0 [ 485.073821][ T5632] Bluetooth: hci1: command tx timeout [ 485.318756][T18173] netdevsim netdevsim2 netdevsim0: renamed from eth0 [ 485.365638][T18173] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 485.390514][T18173] netdevsim netdevsim2 netdevsim1: renamed from eth1 [ 485.431007][T18173] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 485.454567][T18173] netdevsim netdevsim2 netdevsim2: renamed from eth2 [ 485.501291][T18173] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 485.528736][T18173] netdevsim netdevsim2 netdevsim3: renamed from eth3 [ 485.576121][T18173] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 487.153040][ T5632] Bluetooth: hci1: command tx timeout [ 488.830912][T18173] 8021q: adding VLAN 0 to HW filter on device bond0 [ 488.925991][T18173] 8021q: adding VLAN 0 to HW filter on device team0 [ 488.966929][T18454] netlink: 32 bytes leftover after parsing attributes in process `syz.1.3155'. [ 488.989014][T18459] netlink: 'syz.3.3156': attribute type 1 has an invalid length. [ 489.030420][ T9260] bridge0: port 1(bridge_slave_0) entered blocking state [ 489.037702][ T9260] bridge0: port 1(bridge_slave_0) entered forwarding state [ 489.117353][ T9260] bridge0: port 2(bridge_slave_1) entered blocking state [ 489.124649][ T9260] bridge0: port 2(bridge_slave_1) entered forwarding state [ 489.310569][ T5632] block nbd36: Receive control failed (result -32) [ 489.519081][T18477] x_tables: ip_tables: HMARK.0 target: invalid size 64 (kernel) != (user) 72 [ 489.819255][T18486] netlink: 'syz.4.3162': attribute type 17 has an invalid length. [ 489.838762][T18486] netlink: 'syz.4.3162': attribute type 49 has an invalid length. [ 490.107714][T18173] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 490.232409][T18499] x_tables: arp_tables: NFQUEUE target: not valid for this family [ 490.245317][T18173] veth0_vlan: entered promiscuous mode [ 490.281918][T18173] veth1_vlan: entered promiscuous mode [ 490.344373][T18501] lo speed is unknown, defaulting to 1000 [ 490.410982][T18173] veth0_macvtap: entered promiscuous mode [ 490.455757][T18173] veth1_macvtap: entered promiscuous mode [ 490.527240][T18173] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 490.610415][T18173] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 490.658607][ T9258] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 490.696373][ T9258] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 490.715008][ T9258] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 490.795449][ T9258] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 491.100919][ T9260] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 491.136491][T18516] netlink: 16 bytes leftover after parsing attributes in process `syz.0.3169'. [ 491.138006][ T9260] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 491.267963][T18501] ±ÿŸÂnÖ8î· speed is unknown, defaulting to 1000 [ 491.278556][ T9260] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 491.324062][ T9260] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 491.498113][T18527] netlink: 'syz.0.3171': attribute type 4 has an invalid length. [ 492.054211][ T5635] Bluetooth: hci4: unexpected cc 0x0c03 length: 249 > 1 [ 492.066326][ T5635] Bluetooth: hci4: unexpected cc 0x1003 length: 249 > 9 [ 492.075625][ T5635] Bluetooth: hci4: unexpected cc 0x1001 length: 249 > 9 [ 492.089502][ T5635] Bluetooth: hci4: unexpected cc 0x0c23 length: 249 > 4 [ 492.097949][ T5635] Bluetooth: hci4: unexpected cc 0x0c38 length: 249 > 2 [ 492.342506][T18528] bridge0: port 2(bridge_slave_1) entered disabled state [ 492.350236][T18528] bridge0: port 1(bridge_slave_0) entered disabled state [ 493.022400][T18528] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 493.093910][T18528] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 493.881083][ T36] netdevsim netdevsim0 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 493.907930][T18540] netlink: 4 bytes leftover after parsing attributes in process `syz.1.3174'. [ 493.951502][ T36] netdevsim netdevsim0 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 494.005420][T18547] nbd: nbd0 already in use [ 494.022571][T18547] block nbd0: NBD_DISCONNECT [ 494.043051][T18547] block nbd0: Send disconnect failed -32 [ 494.072815][T18547] block nbd0: Send disconnect failed -32 [ 494.081701][T18547] block nbd0: shutting down sockets [ 494.082571][ T36] netdevsim netdevsim0 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 494.098717][ T36] netdevsim netdevsim0 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 494.194300][ T5635] Bluetooth: hci4: command tx timeout [ 494.345151][T18549] netlink: 'syz.2.3176': attribute type 4 has an invalid length. [ 494.479314][T18567] netlink: 'syz.0.3178': attribute type 16 has an invalid length. [ 494.498978][T18567] netlink: 'syz.0.3178': attribute type 17 has an invalid length. [ 494.619904][T18570] netlink: 248 bytes leftover after parsing attributes in process `syz.1.3180'. [ 494.788522][T18572] netlink: 'syz.1.3181': attribute type 1 has an invalid length. [ 494.818778][T18567] 8021q: adding VLAN 0 to HW filter on device bond0 [ 494.839542][T18567] 8021q: adding VLAN 0 to HW filter on device team0 [ 494.889247][T18567] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 495.055874][T18567] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 495.089226][T18567] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 495.131254][T18567] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 495.147473][T18581] netlink: 20 bytes leftover after parsing attributes in process `syz.1.3181'. [ 495.167328][T18567] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 495.201217][T18567] veth1_vlan: left promiscuous mode [ 495.221601][T18582] netlink: 28 bytes leftover after parsing attributes in process `syz.1.3181'. [ 495.231683][T18567] veth0_vlan: left promiscuous mode [ 495.244551][T18567] veth0_vlan: entered promiscuous mode [ 495.268065][T18567] veth1_vlan: entered promiscuous mode [ 495.287520][T18567] veth1_macvtap: left promiscuous mode [ 495.294337][T18567] veth0_macvtap: left promiscuous mode [ 495.300836][T18567] veth0_macvtap: entered promiscuous mode [ 495.308127][T18567] veth1_macvtap: entered promiscuous mode [ 495.320002][T18567] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 495.329404][T18567] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 495.337806][T18567] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 495.345963][T18567] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 495.441738][T18573] bond12: (slave vxcan5): The slave device specified does not support setting the MAC address [ 495.453699][T18573] bond12: (slave vxcan5): Error -95 calling set_mac_address [ 495.474482][ T9260] bridge0: port 1(bridge_slave_0) entered blocking state [ 495.481788][ T9260] bridge0: port 1(bridge_slave_0) entered forwarding state [ 495.492813][ T9260] bridge0: port 2(bridge_slave_1) entered blocking state [ 495.500101][ T9260] bridge0: port 2(bridge_slave_1) entered forwarding state [ 495.578517][T18581] bond12: (slave bridge10): Enslaving as an active interface with a down link [ 495.588880][T18582] 8021q: adding VLAN 0 to HW filter on device bond12 [ 495.609391][ T36] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 495.622624][T18585] 8021q: VLANs not supported on ip6_vti0 [ 495.655579][ T36] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 495.670927][ T36] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 495.689301][T18586] 8021q: VLANs not supported on ip6_vti0 [ 495.730801][ T36] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 495.771412][T18535] lo speed is unknown, defaulting to 1000 [ 495.808706][T18593] netlink: 32 bytes leftover after parsing attributes in process `syz.1.3184'. [ 495.844109][T18593] netlink: 16 bytes leftover after parsing attributes in process `syz.1.3184'. [ 496.168674][T18609] netlink: 24 bytes leftover after parsing attributes in process `syz.1.3188'. [ 496.275089][ T5635] Bluetooth: hci4: command tx timeout [ 496.646258][T18535] ±ÿŸÂnÖ8î· speed is unknown, defaulting to 1000 [ 496.859222][ T5635] block nbd0: Receive control failed (result -32) [ 496.860633][ T5632] block nbd0: Receive control failed (result -32) [ 496.988004][T18635] workqueue: Failed to create a rescuer kthread for wq "nfc3_nci_rx_wq": -EINTR [ 497.248842][T18659] netlink: 24 bytes leftover after parsing attributes in process `syz.1.3197'. [ 497.352948][T18666] netlink: 8 bytes leftover after parsing attributes in process `syz.4.3196'. [ 497.418321][T18658] netlink: 216 bytes leftover after parsing attributes in process `syz.4.3196'. [ 497.427733][T18658] netlink: 24 bytes leftover after parsing attributes in process `syz.4.3196'. [ 497.438020][T18658] netlink: 16 bytes leftover after parsing attributes in process `syz.4.3196'. [ 497.791854][T18677] netlink: 256 bytes leftover after parsing attributes in process `syz.0.3199'. [ 497.839648][T18677] netlink: 32 bytes leftover after parsing attributes in process `syz.0.3199'. [ 498.049110][T18686] netlink: 68 bytes leftover after parsing attributes in process `syz.1.3202'. [ 498.080395][T18686] netlink: 64 bytes leftover after parsing attributes in process `syz.1.3202'. [ 498.353299][ T5632] Bluetooth: hci4: command tx timeout [ 498.581467][T18535] bridge0: port 1(bridge_slave_0) entered blocking state [ 498.589009][T18535] bridge0: port 1(bridge_slave_0) entered disabled state [ 498.597883][T18535] bridge_slave_0: entered allmulticast mode [ 498.607967][T18535] bridge_slave_0: entered promiscuous mode [ 498.655494][T18535] bridge0: port 2(bridge_slave_1) entered blocking state [ 498.665056][T18535] bridge0: port 2(bridge_slave_1) entered disabled state [ 498.672400][T18535] bridge_slave_1: entered allmulticast mode [ 498.683159][T18535] bridge_slave_1: entered promiscuous mode [ 498.741227][T18535] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 498.789340][T18535] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 498.799824][T18718] netlink: 'syz.2.3211': attribute type 11 has an invalid length. [ 498.967032][T18535] team0: Port device team_slave_0 added [ 498.994322][T18535] team0: Port device team_slave_1 added [ 499.097031][T18535] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 499.122315][T18535] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 499.156259][T18535] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 499.175963][T18535] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 499.183305][T18535] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 499.209933][T18535] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 499.308069][T18535] hsr_slave_0: entered promiscuous mode [ 499.315692][T18535] hsr_slave_1: entered promiscuous mode [ 499.324991][T18535] debugfs: 'hsr0' already exists in 'hsr' [ 499.330919][T18535] Cannot create hsr debugfs directory [ 499.483366][T18535] netdevsim netdevsim3 eth3 (unregistering): unset [1, 0] type 2 family 0 port 42069 - 0 [ 499.510677][T18742] smbdirect: ib_dev[syz0]: added: RNIC max_fast_reg_page_list_len=256 device_cap_flags=0x200000 kernel_cap_flags=0x10 page_size_cap=0x1000 [ 499.525604][T18742] smbdirect: ib_dev[syz0]: num_ports=1 max_qp_rd_atom=128 max_qp_init_rd_atom=128 max_sgl_rd=0 max_sge_rd=1 max_cqe=3276800 max_qp_wr=32768 max_send_sge=6 max_recv_sge=6 [ 499.553351][T18742] smbdirect: ib_dev[syz0]PORT[1]: iwarp=1 ib=0 roce=0 v1=0 v2=0 core_cap_flags=0x400008 [ 499.575338][T18535] netdevsim netdevsim3 eth2 (unregistering): unset [1, 0] type 2 family 0 port 42069 - 0 [ 499.594283][ T5635] block nbd37: Receive control failed (result -32) [ 499.594288][ T5632] block nbd37: Receive control failed (result -32) [ 499.627115][T18742] infiniband syz0: RDMA CMA: cma_listen_on_dev, error -98 [ 499.875898][T18535] netdevsim netdevsim3 eth1 (unregistering): unset [1, 0] type 2 family 0 port 42069 - 0 [ 500.126249][T18756] bond1: option active_slave: mode dependency failed, not supported in mode balance-xor(2) [ 500.216025][T18756] bond1 (unregistering): Released all slaves [ 500.239218][ T30] audit: type=1804 audit(1777741421.326:17): pid=18768 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=open_writers comm="syz.1.3225" name="/newroot/644/memory.events" dev="tmpfs" ino=3338 res=1 errno=0 [ 500.273669][ T30] audit: type=1800 audit(1777741421.346:18): pid=18768 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.1.3225" name="memory.events" dev="tmpfs" ino=3338 res=0 errno=0 [ 500.432955][ T5632] Bluetooth: hci4: command tx timeout [ 500.528519][T18535] netdevsim netdevsim3 eth0 (unregistering): unset [1, 0] type 2 family 0 port 42069 - 0 [ 500.815088][T18779] FAULT_INJECTION: forcing a failure. [ 500.815088][T18779] name failslab, interval 1, probability 0, space 0, times 0 [ 500.828257][T18779] CPU: 0 UID: 0 PID: 18779 Comm: syz.4.3228 Not tainted syzkaller #0 PREEMPT(full) [ 500.828299][T18779] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 500.828315][T18779] Call Trace: [ 500.828323][T18779] [ 500.828331][T18779] dump_stack_lvl+0xe8/0x150 [ 500.828361][T18779] should_fail_ex+0x412/0x560 [ 500.828400][T18779] should_failslab+0xa8/0x100 [ 500.828460][T18779] __kmalloc_cache_noprof+0x88/0x660 [ 500.828493][T18779] ? nfnetlink_rcv+0xfdf/0x27b0 [ 500.828524][T18779] nfnetlink_rcv+0xfdf/0x27b0 [ 500.828588][T18779] ? __pfx_nfnetlink_rcv+0x10/0x10 [ 500.828632][T18779] ? ref_tracker_free+0x693/0x840 [ 500.828694][T18779] ? __netlink_deliver_tap+0x807/0x850 [ 500.828733][T18779] ? netlink_deliver_tap+0x2e/0x1b0 [ 500.828760][T18779] ? netlink_deliver_tap+0x2e/0x1b0 [ 500.828794][T18779] netlink_unicast+0x75c/0x8e0 [ 500.828831][T18779] netlink_sendmsg+0x813/0xb40 [ 500.828869][T18779] ? __pfx_netlink_sendmsg+0x10/0x10 [ 500.828901][T18779] ? aa_sock_msg_perm+0xf1/0x1b0 [ 500.828931][T18779] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 500.828964][T18779] ____sys_sendmsg+0x972/0x9f0 [ 500.828992][T18779] ? __might_fault+0xaf/0x130 [ 500.829026][T18779] ? __pfx_____sys_sendmsg+0x10/0x10 [ 500.829064][T18779] ? import_iovec+0x73/0xa0 [ 500.829097][T18779] ___sys_sendmsg+0x2a5/0x360 [ 500.829123][T18779] ? __lock_acquire+0x6b5/0x2cf0 [ 500.829152][T18779] ? __pfx____sys_sendmsg+0x10/0x10 [ 500.829221][T18779] ? __fget_files+0x2a/0x420 [ 500.829251][T18779] ? __fget_files+0x3a0/0x420 [ 500.829287][T18779] __x64_sys_sendmsg+0x1bd/0x2a0 [ 500.829319][T18779] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 500.829358][T18779] ? __pfx_ksys_write+0x10/0x10 [ 500.829396][T18779] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 500.829420][T18779] do_syscall_64+0x15f/0xf80 [ 500.829453][T18779] ? trace_irq_disable+0x3b/0x140 [ 500.829485][T18779] ? clear_bhb_loop+0x40/0x90 [ 500.829511][T18779] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 500.829533][T18779] RIP: 0033:0x7f57f519cdd9 [ 500.829551][T18779] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 500.829568][T18779] RSP: 002b:00007f57f602b028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 500.829588][T18779] RAX: ffffffffffffffda RBX: 00007f57f5415fa0 RCX: 00007f57f519cdd9 [ 500.829602][T18779] RDX: 0000000000000000 RSI: 00002000000000c0 RDI: 0000000000000003 [ 500.829614][T18779] RBP: 00007f57f602b090 R08: 0000000000000000 R09: 0000000000000000 [ 500.829625][T18779] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 500.829636][T18779] R13: 00007f57f5416038 R14: 00007f57f5415fa0 R15: 00007ffdeac3afe8 [ 500.829667][T18779] [ 501.452042][T18535] netdevsim netdevsim3 netdevsim0: renamed from eth0 [ 501.465346][ T5635] block nbd38: Receive control failed (result -32) [ 501.465873][ T5632] block nbd38: Receive control failed (result -32) [ 501.485864][T18535] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 501.494019][T18535] netdevsim netdevsim3 netdevsim1: renamed from eth1 [ 501.518701][T18535] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 501.528144][T18535] netdevsim netdevsim3 netdevsim2: renamed from eth2 [ 501.552525][T18535] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 501.568505][T18535] netdevsim netdevsim3 netdevsim3: renamed from eth3 [ 501.607187][T18535] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 501.646568][T18791] __nla_validate_parse: 1 callbacks suppressed [ 501.646586][T18791] netlink: 40 bytes leftover after parsing attributes in process `syz.1.3233'. [ 501.670318][T18799] netlink: 'syz.4.3234': attribute type 21 has an invalid length. [ 501.684080][T18791] netlink: 40 bytes leftover after parsing attributes in process `syz.1.3233'. [ 501.741687][T18802] netlink: 40 bytes leftover after parsing attributes in process `syz.2.3235'. [ 501.827512][T18806] openvswitch: netlink: IP tunnel attribute has 4460 unknown bytes. [ 502.067934][T18819] FAULT_INJECTION: forcing a failure. [ 502.067934][T18819] name failslab, interval 1, probability 0, space 0, times 0 [ 502.080817][T18819] CPU: 0 UID: 0 PID: 18819 Comm: syz.4.3240 Not tainted syzkaller #0 PREEMPT(full) [ 502.080836][T18819] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 502.080846][T18819] Call Trace: [ 502.080852][T18819] [ 502.080858][T18819] dump_stack_lvl+0xe8/0x150 [ 502.080879][T18819] should_fail_ex+0x412/0x560 [ 502.080901][T18819] should_failslab+0xa8/0x100 [ 502.080926][T18819] __kmalloc_cache_noprof+0x88/0x660 [ 502.080947][T18819] ? nfnetlink_rcv+0xfdf/0x27b0 [ 502.080968][T18819] nfnetlink_rcv+0xfdf/0x27b0 [ 502.081008][T18819] ? __pfx_nfnetlink_rcv+0x10/0x10 [ 502.081036][T18819] ? ref_tracker_free+0x693/0x840 [ 502.081077][T18819] ? __netlink_deliver_tap+0x807/0x850 [ 502.081102][T18819] ? netlink_deliver_tap+0x2e/0x1b0 [ 502.081124][T18819] ? netlink_deliver_tap+0x2e/0x1b0 [ 502.081147][T18819] netlink_unicast+0x75c/0x8e0 [ 502.081170][T18819] netlink_sendmsg+0x813/0xb40 [ 502.081196][T18819] ? __pfx_netlink_sendmsg+0x10/0x10 [ 502.081236][T18819] ? aa_sock_msg_perm+0xf1/0x1b0 [ 502.081258][T18819] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 502.081287][T18819] ____sys_sendmsg+0x972/0x9f0 [ 502.081307][T18819] ? __might_fault+0xaf/0x130 [ 502.081331][T18819] ? __pfx_____sys_sendmsg+0x10/0x10 [ 502.081358][T18819] ? import_iovec+0x73/0xa0 [ 502.081383][T18819] ___sys_sendmsg+0x2a5/0x360 [ 502.081402][T18819] ? __lock_acquire+0x6b5/0x2cf0 [ 502.081422][T18819] ? __pfx____sys_sendmsg+0x10/0x10 [ 502.081468][T18819] ? __fget_files+0x2a/0x420 [ 502.081485][T18819] ? __fget_files+0x3a0/0x420 [ 502.081511][T18819] __x64_sys_sendmsg+0x1bd/0x2a0 [ 502.081535][T18819] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 502.081562][T18819] ? __pfx_ksys_write+0x10/0x10 [ 502.081596][T18819] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 502.081613][T18819] do_syscall_64+0x15f/0xf80 [ 502.081631][T18819] ? trace_irq_disable+0x3b/0x140 [ 502.081655][T18819] ? clear_bhb_loop+0x40/0x90 [ 502.081700][T18819] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 502.081722][T18819] RIP: 0033:0x7f57f519cdd9 [ 502.081743][T18819] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 502.081762][T18819] RSP: 002b:00007f57f602b028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 502.081778][T18819] RAX: ffffffffffffffda RBX: 00007f57f5415fa0 RCX: 00007f57f519cdd9 [ 502.081789][T18819] RDX: 0000000000000000 RSI: 00002000000000c0 RDI: 0000000000000003 [ 502.081798][T18819] RBP: 00007f57f602b090 R08: 0000000000000000 R09: 0000000000000000 [ 502.081807][T18819] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 502.081815][T18819] R13: 00007f57f5416038 R14: 00007f57f5415fa0 R15: 00007ffdeac3afe8 [ 502.081839][T18819] [ 502.359840][ T5635] block nbd39: Receive control failed (result -32) [ 502.375505][ T5632] block nbd39: Receive control failed (result -32) [ 502.424698][T18822] netlink: 44 bytes leftover after parsing attributes in process `syz.4.3241'. [ 502.801001][T18841] netlink: 20 bytes leftover after parsing attributes in process `syz.4.3243'. [ 502.839369][T18841] netlink: 36 bytes leftover after parsing attributes in process `syz.4.3243'. [ 502.862665][T18846] netlink: 20 bytes leftover after parsing attributes in process `syz.2.3248'. [ 502.922538][T18846] netlink: 16 bytes leftover after parsing attributes in process `syz.2.3248'. [ 502.940563][T18535] 8021q: adding VLAN 0 to HW filter on device bond0 [ 503.040047][T18535] 8021q: adding VLAN 0 to HW filter on device team0 [ 503.060879][ T9260] bridge0: port 1(bridge_slave_0) entered blocking state [ 503.068141][ T9260] bridge0: port 1(bridge_slave_0) entered forwarding state [ 503.086843][ T9258] bridge0: port 2(bridge_slave_1) entered blocking state [ 503.094086][ T9258] bridge0: port 2(bridge_slave_1) entered forwarding state [ 503.191952][ T5632] block nbd40: Receive control failed (result -32) [ 503.191983][ T5635] block nbd40: Receive control failed (result -32) [ 503.439177][T18860] xt_HMARK: spi-set and port-set can't be combined [ 504.095465][T18887] netlink: 24 bytes leftover after parsing attributes in process `syz.2.3256'. [ 504.111146][T18892] netlink: 'syz.4.3257': attribute type 8 has an invalid length. [ 504.235265][T18535] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 504.366802][T18535] veth0_vlan: entered promiscuous mode [ 504.421065][T18535] veth1_vlan: entered promiscuous mode [ 504.615236][T18535] veth0_macvtap: entered promiscuous mode [ 504.631087][T18896] block nbd41: Unsupported socket: should be TCP or UNIX. [ 504.652108][T18535] veth1_macvtap: entered promiscuous mode [ 504.701669][T18535] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 504.740504][T18535] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 504.790338][ T9260] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 504.819181][ T9260] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 504.843716][ T9260] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 504.878330][ T9260] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 504.963753][T18907] netlink: 64 bytes leftover after parsing attributes in process `syz.1.3259'. [ 505.047860][T18904] lo speed is unknown, defaulting to 1000 [ 505.259166][T18916] ip6gre1: entered promiscuous mode [ 505.299384][T18916] ip6gre1: entered allmulticast mode [ 505.427721][ T9258] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 505.456353][ T9258] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 505.587001][ T9258] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 505.608169][ T9258] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 505.921418][T18904] ±ÿŸÂnÖ8î· speed is unknown, defaulting to 1000 [ 506.259612][T18941] sctp: [Deprecated]: syz.4.3271 (pid 18941) Use of int in maxseg socket option. [ 506.259612][T18941] Use struct sctp_assoc_value instead [ 506.495100][ T5635] block nbd41: Receive control failed (result -32) [ 506.495718][ T5632] block nbd41: Receive control failed (result -32) [ 506.548465][T18945] netlink: 'syz.4.3273': attribute type 13 has an invalid length. [ 506.586876][T18945] netlink: 'syz.4.3273': attribute type 12 has an invalid length. [ 506.664765][T18947] netlink: 'syz.3.3274': attribute type 12 has an invalid length. [ 506.804460][T18957] IPv6: addrconf: prefix option has invalid lifetime [ 506.855200][T18958] netlink: 'syz.2.3276': attribute type 83 has an invalid length. [ 506.871029][T18957] netlink: 'syz.2.3276': attribute type 83 has an invalid length. [ 508.157980][T18971] syzkaller1: entered promiscuous mode [ 508.164584][T18971] syzkaller1: entered allmulticast mode [ 509.601015][T18988] syzkaller1: entered allmulticast mode [ 509.652470][T18993] __nla_validate_parse: 4 callbacks suppressed [ 509.652489][T18993] netlink: 76 bytes leftover after parsing attributes in process `syz.0.3282'. [ 509.691471][T18993] netlink: 28 bytes leftover after parsing attributes in process `syz.0.3282'. [ 509.824367][T19000] netlink: 'syz.2.3283': attribute type 1 has an invalid length. [ 509.832331][T19000] netlink: 'syz.2.3283': attribute type 4 has an invalid length. [ 509.854323][T19000] netlink: 9462 bytes leftover after parsing attributes in process `syz.2.3283'. [ 509.878880][T19002] bond0: (slave bond_slave_1): Releasing backup interface [ 510.315337][ T5632] block nbd42: Receive control failed (result -32) [ 510.315337][ T5635] block nbd42: Receive control failed (result -32) [ 510.435377][ T5635] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 510.448413][ T5635] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 510.464553][ T5635] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 510.479789][ T5635] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 510.493078][ T5635] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 510.624543][T19018] xt_time: invalid argument - start or stop time greater than 23:59:59 [ 510.673555][T19023] netlink: 'syz.3.3290': attribute type 1 has an invalid length. [ 510.710180][T19021] netlink: 'syz.3.3290': attribute type 1 has an invalid length. [ 510.964521][T19031] netlink: 'syz.4.3292': attribute type 1 has an invalid length. [ 510.972627][T19031] netlink: 212400 bytes leftover after parsing attributes in process `syz.4.3292'. [ 512.367966][T19045] sctp: [Deprecated]: syz.3.3295 (pid 19045) Use of int in maxseg socket option. [ 512.367966][T19045] Use struct sctp_assoc_value instead [ 512.603750][ T5635] Bluetooth: hci0: command tx timeout [ 513.358877][T19013] lo speed is unknown, defaulting to 1000 [ 513.372854][T19063] openvswitch: netlink: Missing key (keys=40, expected=10000000) [ 513.909410][ T5632] block nbd43: Receive control failed (result -32) [ 513.916371][ T5635] block nbd43: Receive control failed (result -32) [ 514.133596][T19013] ±ÿŸÂnÖ8î· speed is unknown, defaulting to 1000 [ 514.140758][T19087] netlink: 'syz.2.3306': attribute type 1 has an invalid length. [ 514.267111][T19087] workqueue: Failed to create a rescuer kthread for wq "bond2": -EINTR [ 514.682830][ T5632] Bluetooth: hci0: command tx timeout [ 515.632075][T19013] bridge0: port 1(bridge_slave_0) entered blocking state [ 515.651804][T19013] bridge0: port 1(bridge_slave_0) entered disabled state [ 515.669906][T19013] bridge_slave_0: entered allmulticast mode [ 515.690172][T19013] bridge_slave_0: entered promiscuous mode [ 515.744491][T19013] bridge0: port 2(bridge_slave_1) entered blocking state [ 515.762027][T19013] bridge0: port 2(bridge_slave_1) entered disabled state [ 515.777178][T19128] openvswitch: netlink: IP tunnel dst address not specified [ 515.785105][T19013] bridge_slave_1: entered allmulticast mode [ 515.798080][T19013] bridge_slave_1: entered promiscuous mode [ 515.927925][T19013] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 515.974397][T19013] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 515.984132][T19135] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 515.992052][T19135] batadv_slave_0: entered promiscuous mode [ 515.999270][T19135] batadv_slave_0: entered allmulticast mode [ 516.058166][T19135] netlink: 12 bytes leftover after parsing attributes in process `syz.2.3314'. [ 516.110083][T19013] team0: Port device team_slave_0 added [ 516.150330][T19013] team0: Port device team_slave_1 added [ 516.196769][T19139] netlink: 8 bytes leftover after parsing attributes in process `syz.4.3315'. [ 516.243996][T19139] netlink: 'syz.4.3315': attribute type 5 has an invalid length. [ 516.252897][T19139] netlink: 20 bytes leftover after parsing attributes in process `syz.4.3315'. [ 516.311627][T19139] geneve2: entered promiscuous mode [ 516.318957][T19139] geneve2: entered allmulticast mode [ 516.332067][T19013] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 516.346587][T19013] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 516.403813][T19013] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 516.428190][T19013] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 516.456024][T19013] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 516.505205][T19013] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 516.516704][ T3335] netdevsim netdevsim4 netdevsim0: set [1, 1] type 2 family 0 port 256 - 0 [ 516.563135][ T3335] netdevsim netdevsim4 netdevsim1: set [1, 1] type 2 family 0 port 256 - 0 [ 516.630642][ T3335] netdevsim netdevsim4 netdevsim2: set [1, 1] type 2 family 0 port 256 - 0 [ 516.693988][ T3335] netdevsim netdevsim4 netdevsim3: set [1, 1] type 2 family 0 port 256 - 0 [ 516.740806][T19013] hsr_slave_0: entered promiscuous mode [ 516.752866][ T5632] Bluetooth: hci0: command tx timeout [ 516.769880][T19013] hsr_slave_1: entered promiscuous mode [ 516.783710][T19013] debugfs: 'hsr0' already exists in 'hsr' [ 516.797983][T19013] Cannot create hsr debugfs directory [ 517.346006][T19013] netdevsim netdevsim1 eth3 (unregistering): unset [1, 0] type 2 family 0 port 20004 - 0 [ 517.578586][T19013] netdevsim netdevsim1 eth2 (unregistering): unset [1, 0] type 2 family 0 port 20004 - 0 [ 517.749519][ T5632] block nbd44: Receive control failed (result -32) [ 517.756993][ T5635] block nbd44: Receive control failed (result -32) [ 517.777342][T19013] netdevsim netdevsim1 eth1 (unregistering): unset [1, 0] type 2 family 0 port 20004 - 0 [ 517.887416][T19185] netlink: 68 bytes leftover after parsing attributes in process `syz.0.3325'. [ 517.982435][T19013] netdevsim netdevsim1 eth0 (unregistering): unset [1, 0] type 2 family 0 port 20004 - 0 [ 518.100012][T19193] netlink: 8 bytes leftover after parsing attributes in process `syz.3.3327'. [ 518.127469][T19193] netlink: 8 bytes leftover after parsing attributes in process `syz.3.3327'. [ 518.149358][T19193] netlink: 8 bytes leftover after parsing attributes in process `syz.3.3327'. [ 518.161575][T19191] netlink: 24 bytes leftover after parsing attributes in process `syz.3.3327'. [ 518.168684][T19193] netlink: 8 bytes leftover after parsing attributes in process `syz.3.3327'. [ 518.181280][T19193] netlink: 8 bytes leftover after parsing attributes in process `syz.3.3327'. [ 518.488425][T19013] netdevsim netdevsim1 netdevsim0: renamed from eth0 [ 518.501014][T19013] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 518.510071][T19013] netdevsim netdevsim1 netdevsim1: renamed from eth1 [ 518.521762][T19013] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 518.531640][T19013] netdevsim netdevsim1 netdevsim2: renamed from eth2 [ 518.542630][T19206] x_tables: ip6_tables: mh match: only valid for protocol 135 [ 518.546261][T19013] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 518.560221][T19206] netlink: 'syz.3.3331': attribute type 1 has an invalid length. [ 518.568376][T19013] netdevsim netdevsim1 netdevsim3: renamed from eth3 [ 518.580385][T19013] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 518.698528][T19214] bridge_slave_0: left allmulticast mode [ 518.704488][T19214] bridge_slave_0: left promiscuous mode [ 518.710309][T19214] bridge0: port 1(bridge_slave_0) entered disabled state [ 518.722604][T19214] bridge_slave_1: left allmulticast mode [ 518.731301][T19214] bridge_slave_1: left promiscuous mode [ 518.739153][T19214] bridge0: port 2(bridge_slave_1) entered disabled state [ 518.755003][T19214] bond0: (slave bond_slave_0): Releasing backup interface [ 518.772607][T19214] bond0: (slave bond_slave_1): Releasing backup interface [ 518.801384][T19214] team0: Port device team_slave_0 removed [ 518.824015][T19214] team0: Port device team_slave_1 removed [ 518.832890][ T5635] Bluetooth: hci0: command tx timeout [ 518.840846][T19214] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 518.856806][T19214] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 518.866269][T19214] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 518.874127][T19214] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 518.883592][T19214] A link change request failed with some changes committed already. Interface hsr_slave_0 may have been left with an inconsistent configuration, please check. [ 518.901687][T19215] team0: Mode changed to "broadcast" [ 519.050710][T19013] 8021q: adding VLAN 0 to HW filter on device bond0 [ 519.073413][ C0] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 519.083715][ C0] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 519.092132][ C0] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 519.100557][ C0] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 519.110427][ T5774] page_pool_release_retry() stalled pool shutdown: id 191, 1 inflight 60 sec [ 519.156093][T19222] xt_hashlimit: size too large, truncated to 1048576 [ 519.195878][T19013] 8021q: adding VLAN 0 to HW filter on device team0 [ 519.224256][T15596] bridge0: port 1(bridge_slave_0) entered blocking state [ 519.231492][T15596] bridge0: port 1(bridge_slave_0) entered forwarding state [ 519.299612][T15596] bridge0: port 2(bridge_slave_1) entered blocking state [ 519.306832][T15596] bridge0: port 2(bridge_slave_1) entered forwarding state [ 519.673539][ T5632] block nbd45: Receive control failed (result -32) [ 519.680929][ T5635] block nbd45: Receive control failed (result -32) [ 520.335331][T19013] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 520.484912][T19013] veth0_vlan: entered promiscuous mode [ 520.510212][T19013] veth1_vlan: entered promiscuous mode [ 520.610352][T19013] veth0_macvtap: entered promiscuous mode [ 520.642035][T19013] veth1_macvtap: entered promiscuous mode [ 520.699919][T19013] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 520.731717][T19013] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 520.769541][T15594] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 520.792301][T15594] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 520.821077][T15594] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 520.865876][T15594] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 521.257742][ T9260] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 521.286922][ T9260] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 521.677361][ T5635] block nbd46: Receive control failed (result -32) [ 521.684511][ T5632] block nbd46: Receive control failed (result -32) [ 521.867841][T15594] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 521.896860][T15594] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 521.918737][T19307] __nla_validate_parse: 71 callbacks suppressed [ 521.918753][T19307] netlink: 24 bytes leftover after parsing attributes in process `syz.0.3354'. [ 522.068946][ T8509] IPVS: starting estimator thread 0... [ 522.159127][T19309] lo speed is unknown, defaulting to 1000 [ 522.166680][T19317] IPVS: using max 35 ests per chain, 84000 per kthread [ 522.760184][T19351] netlink: 20 bytes leftover after parsing attributes in process `syz.0.3363'. [ 522.980804][ T5635] block nbd47: Receive control failed (result -32) [ 522.988278][ T5632] block nbd47: Receive control failed (result -32) [ 523.296128][T19335] geneve2: left promiscuous mode [ 523.431427][T19309] ±ÿŸÂnÖ8î· speed is unknown, defaulting to 1000 [ 523.452368][T19348] netlink: 60 bytes leftover after parsing attributes in process `syz.4.3361'. [ 523.946315][T19373] lo speed is unknown, defaulting to 1000 [ 524.891765][T19373] ±ÿŸÂnÖ8î· speed is unknown, defaulting to 1000 [ 524.923060][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 524.931528][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 524.939970][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 524.948353][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 527.612750][T19404] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 527.866340][T19446] netlink: 4 bytes leftover after parsing attributes in process `syz.0.3390'. [ 527.900301][T19446] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 527.929314][T19446] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 527.972507][T19446] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 528.037612][T19446] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 528.062204][T19457] netlink: 60 bytes leftover after parsing attributes in process `syz.4.3394'. [ 528.103795][T19450] netem: change failed [ 528.211719][T19461] netlink: 1244 bytes leftover after parsing attributes in process `syz.2.3395'. [ 528.238071][T19468] netlink: 8 bytes leftover after parsing attributes in process `syz.1.3397'. [ 528.365234][T19471] netlink: 'syz.4.3396': attribute type 1 has an invalid length. [ 528.403036][T19471] netlink: 244 bytes leftover after parsing attributes in process `syz.4.3396'. [ 528.928137][T19505] ip6_tunnel: non-ECT from fc00:0000:0000:0000:0000:0000:0000:0000 with DS=0x5 [ 529.066670][T19507] netlink: 8 bytes leftover after parsing attributes in process `syz.3.3407'. [ 529.196571][T19514] netlink: 20 bytes leftover after parsing attributes in process `syz.2.3409'. [ 529.222815][T19514] netlink: 24 bytes leftover after parsing attributes in process `syz.2.3409'. [ 529.316815][T19521] netlink: 28 bytes leftover after parsing attributes in process `syz.4.3412'. [ 529.570108][T19532] netlink: 40 bytes leftover after parsing attributes in process `syz.3.3414'. [ 529.586291][T19524] bridge0: port 2(bridge_slave_1) entered disabled state [ 529.594393][T19524] bridge0: port 1(bridge_slave_0) entered disabled state [ 529.859965][T19524] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 529.894890][T19524] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 530.033407][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 530.041937][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 530.050358][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 530.058758][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 530.332266][T19536] A link change request failed with some changes committed already. Interface hsr_slave_0 may have been left with an inconsistent configuration, please check. [ 530.453956][ T9255] netdevsim netdevsim4 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 530.491046][ T9255] netdevsim netdevsim4 netdevsim0: unset [1, 1] type 2 family 0 port 256 - 0 [ 530.524794][ T9255] netdevsim netdevsim4 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 530.554671][ T9255] netdevsim netdevsim4 netdevsim1: unset [1, 1] type 2 family 0 port 256 - 0 [ 530.580698][ T9255] netdevsim netdevsim4 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 530.635912][ T9255] netdevsim netdevsim4 netdevsim2: unset [1, 1] type 2 family 0 port 256 - 0 [ 530.711684][ T9255] netdevsim netdevsim4 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 530.729941][ T9255] netdevsim netdevsim4 netdevsim3: unset [1, 1] type 2 family 0 port 256 - 0 [ 531.129752][T19573] netlink: 'syz.4.3423': attribute type 5 has an invalid length. [ 531.686594][ T8514] hid-generic 0005:16C0:5505.0003: hidraw0: BLUETOOTH HID v0.8b Device [syz0] on aa:aa:aa:aa:aa:aa [ 532.027493][T19590] lo: entered allmulticast mode [ 532.040752][T19598] fido_id[19598]: Failed to open report descriptor at '/sys/devices/virtual/bluetooth/hci0/hci0:200/report_descriptor': No such file or directory [ 532.321063][T19612] xt_hashlimit: size too large, truncated to 1048576 [ 532.517879][T19614] vlan3: entered allmulticast mode [ 532.538919][T19614] macvtap0: entered allmulticast mode [ 532.721815][T19615] openvswitch: netlink: Unexpected mask (mask=240, allowed=10048) [ 532.969373][T19638] __nla_validate_parse: 10 callbacks suppressed [ 532.969396][T19638] netlink: 28 bytes leftover after parsing attributes in process `syz.1.3440'. [ 532.997017][T19638] netlink: 'syz.1.3440': attribute type 1 has an invalid length. [ 533.133566][T19645] netlink: 8 bytes leftover after parsing attributes in process `syz.2.3441'. [ 533.287379][T19658] netlink: 32 bytes leftover after parsing attributes in process `syz.4.3444'. [ 533.446910][T19666] netlink: 8 bytes leftover after parsing attributes in process `syz.1.3447'. [ 533.470987][T19666] IPv6: NLM_F_CREATE should be specified when creating new route [ 533.550410][ T8514] IPVS: starting estimator thread 0... [ 533.621806][T19675] netlink: 4 bytes leftover after parsing attributes in process `syz.4.3452'. [ 533.663381][T19673] IPVS: using max 29 ests per chain, 69600 per kthread [ 533.693039][T19675] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 533.822094][T19686] netlink: 8 bytes leftover after parsing attributes in process `syz.1.3454'. [ 533.877080][T19687] syzkaller1: entered promiscuous mode [ 533.899690][T19687] syzkaller1: entered allmulticast mode [ 534.286008][T19706] tipc: Enabling of bearer rejected, failed to enable media [ 534.713418][T19726] netlink: 'syz.0.3464': attribute type 13 has an invalid length. [ 534.979977][T19726] bridge0: port 2(bridge_slave_1) entered disabled state [ 534.987618][T19726] bridge0: port 1(bridge_slave_0) entered disabled state [ 535.477777][T19739] netlink: 12 bytes leftover after parsing attributes in process `syz.1.3468'. [ 535.507408][T19744] netlink: 12 bytes leftover after parsing attributes in process `syz.1.3468'. [ 535.542164][T12274] syz0: Port: 1 Link DOWN [ 535.547056][T15594] netdevsim netdevsim0 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 535.565906][T15594] netdevsim netdevsim0 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 535.637665][T15594] netdevsim netdevsim0 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 535.653786][T15596] netdevsim netdevsim0 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 535.970730][T19776] netlink: 'syz.2.3478': attribute type 3 has an invalid length. [ 535.998402][T19776] netlink: 8 bytes leftover after parsing attributes in process `syz.2.3478'. [ 536.025266][T19777] bridge1: the hash_elasticity option has been deprecated and is always 16 [ 536.065971][T19777] bridge1: entered allmulticast mode [ 536.219198][T19785] syz_tun: entered allmulticast mode [ 536.370402][T19792] batadv_slave_0: left promiscuous mode [ 536.410981][T19800] xt_hashlimit: size too large, truncated to 1048576 [ 536.419890][T19792] batadv_slave_0: left allmulticast mode [ 536.474941][T19792] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 536.489254][T19800] x_tables: ip6_tables: TCPMSS target: only valid for protocol 6 [ 536.746838][T19792] ip6gre1: left promiscuous mode [ 536.758156][T19792] ip6gre1: left allmulticast mode [ 536.772101][T19792] 8021q: adding VLAN 0 to HW filter on device bond1 [ 536.796977][T19792] 8021q: adding VLAN 0 to HW filter on device bond2 [ 537.195611][T19816] FAULT_INJECTION: forcing a failure. [ 537.195611][T19816] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 537.240723][T19816] CPU: 1 UID: 0 PID: 19816 Comm: syz.0.3488 Not tainted syzkaller #0 PREEMPT(full) [ 537.240752][T19816] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 537.240765][T19816] Call Trace: [ 537.240773][T19816] [ 537.240782][T19816] dump_stack_lvl+0xe8/0x150 [ 537.240813][T19816] should_fail_ex+0x412/0x560 [ 537.240847][T19816] _copy_from_user+0x2d/0xb0 [ 537.240878][T19816] ___sys_sendmsg+0x1c6/0x360 [ 537.240906][T19816] ? __lock_acquire+0x6b5/0x2cf0 [ 537.240934][T19816] ? __pfx____sys_sendmsg+0x10/0x10 [ 537.241007][T19816] ? __fget_files+0x2a/0x420 [ 537.241031][T19816] ? __fget_files+0x3a0/0x420 [ 537.241067][T19816] __x64_sys_sendmsg+0x1bd/0x2a0 [ 537.241098][T19816] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 537.241141][T19816] ? __pfx_ksys_write+0x10/0x10 [ 537.241181][T19816] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 537.241204][T19816] do_syscall_64+0x15f/0xf80 [ 537.241228][T19816] ? trace_irq_disable+0x3b/0x140 [ 537.241260][T19816] ? clear_bhb_loop+0x40/0x90 [ 537.241287][T19816] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 537.241308][T19816] RIP: 0033:0x7f9e38b9cdd9 [ 537.241327][T19816] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 537.241346][T19816] RSP: 002b:00007f9e39a5a028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 537.241368][T19816] RAX: ffffffffffffffda RBX: 00007f9e38e15fa0 RCX: 00007f9e38b9cdd9 [ 537.241383][T19816] RDX: 0000000000000000 RSI: 0000200000000400 RDI: 0000000000000003 [ 537.241397][T19816] RBP: 00007f9e39a5a090 R08: 0000000000000000 R09: 0000000000000000 [ 537.241410][T19816] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 537.241422][T19816] R13: 00007f9e38e16038 R14: 00007f9e38e15fa0 R15: 00007ffff5996018 [ 537.241456][T19816] [ 537.663434][T19831] netlink: 24 bytes leftover after parsing attributes in process `syz.4.3492'. [ 537.794743][T19833] netlink: 'syz.4.3493': attribute type 13 has an invalid length. [ 537.914745][T19838] tipc: Enabling of bearer rejected, failed to enable media [ 538.083494][T19854] netlink: 'syz.4.3498': attribute type 1 has an invalid length. [ 538.091444][T19854] __nla_validate_parse: 1 callbacks suppressed [ 538.091460][T19854] netlink: 76 bytes leftover after parsing attributes in process `syz.4.3498'. [ 538.167236][T19860] netlink: 244 bytes leftover after parsing attributes in process `syz.0.3499'. [ 538.272567][T19863] Bluetooth: MGMT ver 1.23 [ 538.383137][T19865] netlink: 24 bytes leftover after parsing attributes in process `syz.3.3501'. [ 538.457001][T19865] netlink: 'syz.3.3501': attribute type 3 has an invalid length. [ 538.465980][T19865] netlink: 'syz.3.3501': attribute type 3 has an invalid length. [ 538.535436][T19871] xt_nfacct: accounting object `syz0' does not exist [ 538.994795][T19876] bond1: down delay (5) is not a multiple of miimon (2), value rounded to 4 ms [ 539.041860][T19876] bond1: entered promiscuous mode [ 540.231521][T19910] netlink: 'syz.0.3514': attribute type 1 has an invalid length. [ 540.285016][T19910] 8021q: adding VLAN 0 to HW filter on device bond2 [ 540.350991][T19916] bond2: (slave veth5): Enslaving as an active interface with a down link [ 540.353752][ T5635] Bluetooth: hci0: command tx timeout [ 540.380907][T19910] bond2: (slave dummy0): making interface the new active one [ 540.391646][T19910] dummy0: entered promiscuous mode [ 540.397384][T19910] bond2: (slave dummy0): Enslaving as an active interface with an up link [ 540.412195][T19910] netlink: 14 bytes leftover after parsing attributes in process `syz.0.3514'. [ 540.438191][T19910] bond2: (slave dummy0): Releasing active interface [ 540.447567][T19910] dummy0 (unregistering): left promiscuous mode [ 541.967585][T19879] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 542.176482][T19933] netlink: 32 bytes leftover after parsing attributes in process `syz.1.3524'. [ 542.208641][T19933] openvswitch: netlink: Flow key attr not present in new flow. [ 542.250068][T19933] tipc: Started in network mode [ 542.260017][T19933] tipc: Node identity 0000000000002e000000000000000001, cluster identity 4711 [ 542.270182][T19933] tipc: Enabling of bearer rejected, failed to enable media [ 542.333693][T19935] syzkaller0: entered promiscuous mode [ 542.342001][T19935] syzkaller0: entered allmulticast mode [ 542.354012][T19940] netlink: 12 bytes leftover after parsing attributes in process `syz.1.3524'. [ 542.370782][T19939] netlink: 24 bytes leftover after parsing attributes in process `syz.3.3523'. [ 542.459059][T19942] x_tables: duplicate underflow at hook 2 [ 544.883121][T19976] syzkaller0: entered promiscuous mode [ 544.889262][T19974] netlink: 8 bytes leftover after parsing attributes in process `syz.1.3530'. [ 544.905041][T19976] syzkaller0: entered allmulticast mode [ 544.919070][T19981] netlink: 8 bytes leftover after parsing attributes in process `syz.2.3532'. [ 544.930514][T19981] netlink: 104 bytes leftover after parsing attributes in process `syz.2.3532'. [ 544.953644][T19977] netlink: 300 bytes leftover after parsing attributes in process `syz.4.3531'. [ 544.968467][T19977] netlink: 300 bytes leftover after parsing attributes in process `syz.4.3531'. [ 544.993568][T19978] netlink: 300 bytes leftover after parsing attributes in process `syz.4.3531'. [ 545.016146][T19978] netlink: 300 bytes leftover after parsing attributes in process `syz.4.3531'. [ 545.270726][T19995] netlink: 16 bytes leftover after parsing attributes in process `syz.1.3538'. [ 545.372543][T20002] batman_adv: batadv0: Adding interface: gretap1 [ 545.394471][T20002] batman_adv: batadv0: The MTU of interface gretap1 is too small (1382) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 545.424739][T20004] netlink: 332 bytes leftover after parsing attributes in process `syz.4.3537'. [ 545.438176][T20004] netlink: 'syz.4.3537': attribute type 9 has an invalid length. [ 545.456603][T20002] batman_adv: batadv0: Interface activated: gretap1 [ 545.487603][T20004] netlink: 108 bytes leftover after parsing attributes in process `syz.4.3537'. [ 545.738571][T20012] 8021q: adding VLAN 0 to HW filter on device bond0 [ 545.749229][T20012] 8021q: adding VLAN 0 to HW filter on device team0 [ 545.768262][T20012] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 545.839137][T20012] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 545.850828][T20012] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 545.869293][T20012] hsr0: A HSR master's MTU cannot be greater than the smallest MTU of its slaves minus the HSR Tag length (6 octets). [ 545.918562][ T36] bridge0: port 1(bridge_slave_0) entered blocking state [ 545.925822][ T36] bridge0: port 1(bridge_slave_0) entered forwarding state [ 545.936722][ T36] bridge0: port 2(bridge_slave_1) entered blocking state [ 545.943896][ T36] bridge0: port 2(bridge_slave_1) entered forwarding state [ 546.414758][T20051] syzkaller0: entered promiscuous mode [ 546.420496][T20051] syzkaller0: entered allmulticast mode [ 549.624472][T20108] workqueue: Failed to create a rescuer kthread for wq "bond1": -EINTR [ 549.627755][T20110] workqueue: Failed to create a rescuer kthread for wq "bond1": -EINTR [ 549.713805][T20122] tipc: Enabled bearer , priority 0 [ 549.786322][T20107] lo speed is unknown, defaulting to 1000 [ 549.884664][T20124] tipc: Disabling bearer [ 549.963666][T20121] lo speed is unknown, defaulting to 1000 [ 550.042585][T20139] __nla_validate_parse: 6 callbacks suppressed [ 550.042606][T20139] netlink: 12 bytes leftover after parsing attributes in process `syz.0.3565'. [ 550.822252][T20107] ±ÿŸÂnÖ8î· speed is unknown, defaulting to 1000 [ 551.201212][ T5635] block nbd48: Receive control failed (result -32) [ 551.208543][ T5632] block nbd48: Receive control failed (result -32) [ 552.076068][T20121] ±ÿŸÂnÖ8î· speed is unknown, defaulting to 1000 [ 552.480814][T20237] netlink: 4 bytes leftover after parsing attributes in process `syz.1.3577'. [ 552.563839][T20238] tipc: Enabling of bearer rejected, failed to enable media [ 553.429924][T20268] netlink: 36 bytes leftover after parsing attributes in process `syz.3.3585'. [ 553.440355][T20268] netlink: 16 bytes leftover after parsing attributes in process `syz.3.3585'. [ 553.454378][T20268] netlink: 36 bytes leftover after parsing attributes in process `syz.3.3585'. [ 553.619557][T20274] netlink: 40 bytes leftover after parsing attributes in process `syz.1.3586'. [ 553.643587][T20275] netlink: 'syz.0.3587': attribute type 4 has an invalid length. [ 553.690602][T20276] netlink: 24 bytes leftover after parsing attributes in process `syz.1.3586'. [ 553.702085][T20277] netlink: 'syz.0.3587': attribute type 1 has an invalid length. [ 553.718776][T20277] netlink: 'syz.0.3587': attribute type 4 has an invalid length. [ 553.763254][T20276] netlink: 11 bytes leftover after parsing attributes in process `syz.1.3586'. [ 553.873283][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 554.073305][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 554.726346][T20299] RDS: rds_bind could not find a transport for ::a00:0:0:0, load rds_tcp or rds_rdma? [ 554.898562][T20297] netdevsim netdevsim1 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 554.957783][T20312] batman_adv: batadv0: Adding interface: dummy0 [ 554.968944][T20312] batman_adv: batadv0: The MTU of interface dummy0 is too small (1280) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1312 would solve the problem. [ 555.037661][T20312] batman_adv: batadv0: Interface activated: dummy0 [ 555.058654][T20315] netlink: 'syz.3.3598': attribute type 2 has an invalid length. [ 555.159952][T20297] netdevsim netdevsim1 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 555.200894][T20303] lo speed is unknown, defaulting to 1000 [ 555.306409][T20297] netdevsim netdevsim1 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 555.549058][T20297] netdevsim netdevsim1 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 555.843452][T20333] netlink: 'syz.2.3604': attribute type 20 has an invalid length. [ 555.867390][T20333] netlink: 4 bytes leftover after parsing attributes in process `syz.2.3604'. [ 555.895318][T20303] ±ÿŸÂnÖ8î· speed is unknown, defaulting to 1000 [ 555.895357][ T3335] netdevsim netdevsim1 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 555.968443][T20333] netlink: 'syz.2.3604': attribute type 20 has an invalid length. [ 555.997871][T20333] netlink: 4 bytes leftover after parsing attributes in process `syz.2.3604'. [ 556.038922][ T3335] netdevsim netdevsim2 netdevsim0: set [0, 0] type 1 family 0 port 8472 - 0 [ 556.058325][ T3335] netdevsim netdevsim2 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0 [ 556.097460][ T3335] netdevsim netdevsim2 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0 [ 556.107698][ T3335] netdevsim netdevsim2 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0 [ 556.240433][ T3335] netdevsim netdevsim1 eth1: set [1, 0] type 2 family 0 port 6081 - 0 [ 556.261724][ T3335] netdevsim netdevsim1 eth2: set [1, 0] type 2 family 0 port 6081 - 0 [ 556.291664][ T3335] netdevsim netdevsim1 eth3: set [1, 0] type 2 family 0 port 6081 - 0 [ 556.403910][T20339] netlink: 'syz.2.3606': attribute type 1 has an invalid length. [ 556.476357][T20343] netlink: 5 bytes leftover after parsing attributes in process `syz.2.3606'. [ 556.655780][T20348] bond1: option lacp_rate: mode dependency failed, not supported in mode active-backup(1) [ 556.669793][T20348] bond1 (unregistering): Released all slaves [ 556.699560][T20339] tipc: Enabling of bearer rejected, failed to enable media [ 556.715522][T20354] netlink: 8 bytes leftover after parsing attributes in process `syz.3.3609'. [ 556.762090][T20354] netlink: 4 bytes leftover after parsing attributes in process `syz.3.3609'. [ 556.771921][T20339] veth3: entered promiscuous mode [ 556.778997][T20347] netlink: 28 bytes leftover after parsing attributes in process `syz.2.3606'. [ 556.859809][T20345] lo speed is unknown, defaulting to 1000 [ 556.981732][T20357] netlink: 24 bytes leftover after parsing attributes in process `syz.2.3610'. [ 557.012922][T20357] netlink: 24 bytes leftover after parsing attributes in process `syz.2.3610'. [ 557.408627][T20364] netlink: 28 bytes leftover after parsing attributes in process `syz.2.3612'. [ 557.520329][T20345] ±ÿŸÂnÖ8î· speed is unknown, defaulting to 1000 [ 558.037139][T20374] sch_tbf: burst 19872 is lower than device lo mtu (32783) ! [ 558.509373][T20379] netlink: 207952 bytes leftover after parsing attributes in process `syz.3.3616'. [ 559.003023][T20387] sch_tbf: burst 3 is lower than device ip6tnl0 mtu (32769) ! [ 559.732005][T20412] veth1_to_bond: entered allmulticast mode [ 559.942377][T20413] veth1_to_bond (unregistering): left allmulticast mode [ 560.205623][T20413] bond0: (slave bond_slave_1): Releasing backup interface [ 560.244897][T20420] llcp: llcp_sock_recvmsg: Recv datagram failed state 4 -11 0 [ 560.255689][T20420] llcp: llcp_sock_recvmsg: Recv datagram failed state 4 -11 0 [ 560.540731][T20432] IPVS: sed: FWM 3 0x00000003 - no destination available [ 560.733676][T20440] lo speed is unknown, defaulting to 1000 [ 560.812054][T20447] netlink: 'syz.0.3632': attribute type 29 has an invalid length. [ 560.856891][T20447] netlink: 'syz.0.3632': attribute type 29 has an invalid length. [ 560.899387][T20447] netlink: 'syz.0.3632': attribute type 32 has an invalid length. [ 560.936562][T20447] __nla_validate_parse: 3 callbacks suppressed [ 560.936581][T20447] netlink: 500 bytes leftover after parsing attributes in process `syz.0.3632'. [ 561.239756][T20459] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 561.250478][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 561.496754][T20440] ±ÿŸÂnÖ8î· speed is unknown, defaulting to 1000 [ 561.546653][T20471] netlink: 'syz.4.3637': attribute type 1 has an invalid length. [ 561.680608][T20471] 8021q: adding VLAN 0 to HW filter on device bond1 [ 561.690652][T20476] netlink: 8 bytes leftover after parsing attributes in process `syz.3.3638'. [ 561.732636][T20479] can: request_module (can-proto-0) failed. [ 562.238817][T20491] syzkaller0: entered promiscuous mode [ 562.251195][T20491] syzkaller0: entered allmulticast mode [ 562.612202][T20506] netlink: 12 bytes leftover after parsing attributes in process `syz.3.3648'. [ 562.632068][T20506] netem: incorrect ge model size [ 562.662222][T20506] netem: change failed [ 562.899249][T20517] netlink: 8 bytes leftover after parsing attributes in process `syz.3.3649'. [ 563.809760][T20533] lo speed is unknown, defaulting to 1000 [ 564.429356][T20564] netlink: 40 bytes leftover after parsing attributes in process `syz.2.3660'. [ 564.506298][T20564] netlink: 40 bytes leftover after parsing attributes in process `syz.2.3660'. [ 564.573418][T20556] netlink: 16 bytes leftover after parsing attributes in process `syz.2.3660'. [ 564.583395][T20556] netlink: 'syz.2.3660': attribute type 8 has an invalid length. [ 564.599434][T20556] netlink: 96 bytes leftover after parsing attributes in process `syz.2.3660'. [ 564.626192][T20556] workqueue: Failed to create a rescuer kthread for wq "nfc3_nci_cmd_wq": -EINTR [ 564.640044][T20533] ±ÿŸÂnÖ8î· speed is unknown, defaulting to 1000 [ 567.370663][T20625] netlink: 240 bytes leftover after parsing attributes in process `syz.4.3672'. [ 568.172465][T20637] netlink: zone id is out of range [ 568.187778][T20637] netlink: zone id is out of range [ 568.194828][T20637] netlink: zone id is out of range [ 568.205693][T20637] netlink: zone id is out of range [ 568.216917][T20637] netlink: zone id is out of range [ 568.230159][T20637] netlink: zone id is out of range [ 568.245937][T20637] netlink: zone id is out of range [ 568.257358][T20637] netlink: zone id is out of range [ 568.269358][T20637] netlink: zone id is out of range [ 568.280924][T20637] netlink: zone id is out of range [ 568.481667][T20627] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 568.644069][T20644] lo speed is unknown, defaulting to 1000 [ 569.044587][T20659] netlink: 24 bytes leftover after parsing attributes in process `syz.3.3681'. [ 569.372220][T12290] IPVS: starting estimator thread 0... [ 569.420484][T20666] lo speed is unknown, defaulting to 1000 [ 569.513125][T20667] IPVS: using max 31 ests per chain, 74400 per kthread [ 569.624468][T20644] ±ÿŸÂnÖ8î· speed is unknown, defaulting to 1000 [ 569.669472][T20671] netlink: 8 bytes leftover after parsing attributes in process `syz.3.3684'. [ 570.501285][T20666] ±ÿŸÂnÖ8î· speed is unknown, defaulting to 1000 [ 570.867098][T20693] dvmrp6: entered allmulticast mode [ 570.956462][T20694] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 570.986606][T20694] netlink: 24 bytes leftover after parsing attributes in process `syz.1.3689'. [ 572.171286][T20716] netlink: 'syz.3.3696': attribute type 16 has an invalid length. [ 572.196321][T20716] netlink: 'syz.3.3696': attribute type 17 has an invalid length. [ 572.592261][T20725] netlink: 20 bytes leftover after parsing attributes in process `syz.1.3699'. [ 572.699626][T20727] netlink: 12 bytes leftover after parsing attributes in process `syz.3.3700'. [ 573.385326][T20750] netlink: 12 bytes leftover after parsing attributes in process `syz.0.3705'. [ 573.607281][T20752] syzkaller0: entered promiscuous mode [ 573.624327][T20752] syzkaller0: entered allmulticast mode [ 573.664275][T20758] netlink: 4 bytes leftover after parsing attributes in process `syz.3.3708'. [ 574.723697][T20778] netlink: 'syz.4.3712': attribute type 13 has an invalid length. [ 574.845302][T20785] syz_tun: left allmulticast mode [ 574.857275][T20785] netlink: 12 bytes leftover after parsing attributes in process `syz.4.3714'. [ 574.907169][T20789] net_ratelimit: 8 callbacks suppressed [ 574.907191][T20789] openvswitch: netlink: Key type 1542 is out of range max 32 [ 576.241307][T20743] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 576.477899][T20803] netlink: 28 bytes leftover after parsing attributes in process `syz.4.3717'. [ 579.128222][T20820] lo speed is unknown, defaulting to 1000 [ 579.142930][T20815] netlink: 12 bytes leftover after parsing attributes in process `syz.2.3723'. [ 579.451571][T20820] ±ÿŸÂnÖ8î· speed is unknown, defaulting to 1000 [ 579.459937][T20799] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 579.472969][ T8514] page_pool_release_retry() stalled pool shutdown: id 191, 1 inflight 120 sec [ 579.814154][T20839] nbd49: detected capacity change from 0 to 63 [ 579.829850][ T5632] block nbd49: Receive control failed (result -32) [ 579.861495][T18917] block nbd49: Dead connection, failed to find a fallback [ 579.907399][T18917] block nbd49: shutting down sockets [ 579.932140][T18917] I/O error, dev nbd49, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 579.999351][T18917] Buffer I/O error on dev nbd49, logical block 0, async page read [ 580.043445][T18917] I/O error, dev nbd49, sector 2 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 580.076282][T18917] Buffer I/O error on dev nbd49, logical block 1, async page read [ 580.095229][T20854] x_tables: duplicate underflow at hook 1 [ 580.123354][T18917] I/O error, dev nbd49, sector 4 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 580.141925][T18917] Buffer I/O error on dev nbd49, logical block 2, async page read [ 580.165890][T18917] I/O error, dev nbd49, sector 6 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 580.185781][T18917] Buffer I/O error on dev nbd49, logical block 3, async page read [ 580.210585][T18917] I/O error, dev nbd49, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 580.222016][T18917] Buffer I/O error on dev nbd49, logical block 0, async page read [ 580.252004][T18917] I/O error, dev nbd49, sector 2 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 580.273555][T18917] Buffer I/O error on dev nbd49, logical block 1, async page read [ 580.281711][T18917] I/O error, dev nbd49, sector 4 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 580.302548][T18917] Buffer I/O error on dev nbd49, logical block 2, async page read [ 580.341354][T18917] I/O error, dev nbd49, sector 6 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 580.366386][T18917] Buffer I/O error on dev nbd49, logical block 3, async page read [ 580.371001][T20859] netlink: 8 bytes leftover after parsing attributes in process `syz.3.3736'. [ 580.404786][T20859] netlink: 4 bytes leftover after parsing attributes in process `syz.3.3736'. [ 580.406651][T18917] I/O error, dev nbd49, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 580.457079][T18917] Buffer I/O error on dev nbd49, logical block 0, async page read [ 580.472261][T18917] I/O error, dev nbd49, sector 2 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 580.485033][T18917] Buffer I/O error on dev nbd49, logical block 1, async page read [ 580.497568][T18917] ldm_validate_partition_table(): Disk read failed. [ 580.505795][T20859] macsec1: entered promiscuous mode [ 580.516072][T18917] Dev nbd49: unable to read RDB block 0 [ 580.522063][T20859] team0: entered promiscuous mode [ 580.522248][T20859] macsec1: entered allmulticast mode [ 580.522265][T20859] team0: entered allmulticast mode [ 580.523885][T20859] 8021q: adding VLAN 0 to HW filter on device macsec1 [ 580.548005][T20865] netlink: 4 bytes leftover after parsing attributes in process `syz.4.3738'. [ 580.590146][T18917] nbd49: unable to read partition table [ 580.637896][T18917] ldm_validate_partition_table(): Disk read failed. [ 580.654117][T20866] netlink: 12 bytes leftover after parsing attributes in process `syz.4.3738'. [ 580.667506][T18917] Dev nbd49: unable to read RDB block 0 [ 580.681280][T18917] nbd49: unable to read partition table [ 580.765174][T20864] lo: entered allmulticast mode [ 581.146373][T20886] netlink: 24 bytes leftover after parsing attributes in process `syz.4.3744'. [ 581.219735][T20891] netlink: 8 bytes leftover after parsing attributes in process `syz.1.3746'. [ 581.284629][T20892] bridge_slave_1: left allmulticast mode [ 581.302783][T20892] bridge_slave_1: left promiscuous mode [ 581.308778][T20892] bridge0: port 2(bridge_slave_1) entered disabled state [ 581.344023][T20892] bridge_slave_0: left allmulticast mode [ 581.354993][T20892] bridge_slave_0: left promiscuous mode [ 581.360867][T20892] bridge0: port 1(bridge_slave_0) entered disabled state [ 581.736642][T20904] netlink: 20 bytes leftover after parsing attributes in process `syz.1.3748'. [ 581.924834][T20910] syzkaller0: entered promiscuous mode [ 581.940138][T20910] syzkaller0: entered allmulticast mode [ 581.967986][T20914] netlink: 4 bytes leftover after parsing attributes in process `syz.1.3751'. [ 581.978031][T20912] netlink: 8 bytes leftover after parsing attributes in process `syz.3.3753'. [ 582.151119][T20912] syzkaller1: entered promiscuous mode [ 582.162990][T20912] syzkaller1: entered allmulticast mode [ 582.318175][T20919] lo speed is unknown, defaulting to 1000 [ 582.522279][T20936] netlink: 'syz.4.3760': attribute type 10 has an invalid length. [ 582.526167][T20932] bond4: entered promiscuous mode [ 582.536037][T20932] 8021q: adding VLAN 0 to HW filter on device bond4 [ 582.632070][T20939] bridge2: entered promiscuous mode [ 582.638786][T20939] bond4: (slave bridge2): Enslaving as an active interface with an up link [ 582.648850][T20936] veth1_virt_wifi: entered promiscuous mode [ 582.691042][T20936] bridge0: port 3(veth1_virt_wifi) entered blocking state [ 582.717125][T20936] bridge0: port 3(veth1_virt_wifi) entered disabled state [ 582.733199][T20936] veth1_virt_wifi: entered allmulticast mode [ 582.746795][T20936] veth1_virt_wifi: left allmulticast mode [ 582.790253][T20932] bond4 (unregistering): (slave bridge2): Releasing backup interface [ 582.807654][T20932] bridge2: left promiscuous mode [ 582.819245][T20932] bond4 (unregistering): Released all slaves [ 582.947052][T20919] ±ÿŸÂnÖ8î· speed is unknown, defaulting to 1000 [ 582.958815][T20943] netlink: 'syz.4.3760': attribute type 27 has an invalid length. [ 583.043727][T20950] netlink: 'syz.1.3763': attribute type 1 has an invalid length. [ 583.070254][T20950] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 583.584757][T20976] "syz.1.3769" (20976) uses obsolete ecb(arc4) skcipher [ 583.916477][T20988] netlink: 'syz.2.3771': attribute type 10 has an invalid length. [ 583.937738][T20994] veth0_to_bridge: entered promiscuous mode [ 583.949362][ T5632] block nbd50: Receive control failed (result -32) [ 583.949425][ T5642] block nbd50: Receive control failed (result -32) [ 583.976141][T20994] veth0_to_bridge: entered allmulticast mode [ 584.033104][ C0] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 584.260348][T21007] __nla_validate_parse: 6 callbacks suppressed [ 584.260366][T21007] netlink: 12 bytes leftover after parsing attributes in process `syz.3.3776'. [ 584.283833][T21007] netlink: 12 bytes leftover after parsing attributes in process `syz.3.3776'. [ 584.324054][T21007] netlink: 58 bytes leftover after parsing attributes in process `syz.3.3776'. [ 584.452282][T21007] team0 (unregistering): left allmulticast mode [ 584.483261][T21007] team0 (unregistering): left promiscuous mode [ 585.095131][T21031] netlink: 20 bytes leftover after parsing attributes in process `syz.1.3780'. [ 585.219779][ T5632] block nbd51: Receive control failed (result -32) [ 585.227039][ T5642] block nbd51: Receive control failed (result -32) [ 585.316922][ T5642] Bluetooth: hci5: command 0x0406 tx timeout [ 585.609611][T21044] lo speed is unknown, defaulting to 1000 [ 585.658991][T21057] xt_TPROXY: Can be used only with -p tcp or -p udp [ 585.773294][T21062] netlink: 8 bytes leftover after parsing attributes in process `syz.0.3789'. [ 585.816153][T21062] workqueue: Failed to create a rescuer kthread for wq "bond3": -EINTR [ 585.903993][T21071] netlink: 'syz.4.3792': attribute type 2 has an invalid length. [ 585.954892][T21073] netlink: 40 bytes leftover after parsing attributes in process `syz.1.3791'. [ 586.168014][T21081] netlink: 32 bytes leftover after parsing attributes in process `syz.4.3796'. [ 586.230667][T21044] ±ÿŸÂnÖ8î· speed is unknown, defaulting to 1000 [ 586.515076][T21109] netlink: 'syz.3.3800': attribute type 4 has an invalid length. [ 589.139451][T21081] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 589.743070][T21155] netlink: 36 bytes leftover after parsing attributes in process `syz.3.3812'. [ 589.777641][T21156] macvtap1: entered promiscuous mode [ 589.791347][T21156] macvtap1: entered allmulticast mode [ 589.801975][T21156] veth1_vlan: entered allmulticast mode [ 589.848521][T21155] macvtap2: entered promiscuous mode [ 589.880416][T21155] macvtap2: entered allmulticast mode [ 589.922823][T21161] lo: Caught tx_queue_len zero misconfig [ 590.294290][T21189] netlink: 28 bytes leftover after parsing attributes in process `syz.0.3822'. [ 590.670094][T21213] openvswitch: netlink: Unexpected mask (mask=100000000, allowed=10048) [ 590.972526][T21223] lo speed is unknown, defaulting to 1000 [ 591.123105][ T8514] ip6_tunnel: ip6gretap1 xmit: Local address not yet configured! [ 591.769833][T21223] ±ÿŸÂnÖ8î· speed is unknown, defaulting to 1000 [ 591.795035][ T9258] ip6_tunnel: ip6gretap1 xmit: Local address not yet configured! [ 591.865988][T21251] netlink: 'syz.3.3837': attribute type 1 has an invalid length. [ 591.874747][T12290] ip6_tunnel: ip6gretap1 xmit: Local address not yet configured! [ 592.013194][T21249] bond1: (slave bridge3): making interface the new active one [ 592.021553][T21249] bond1: (slave bridge3): Enslaving as an active interface with an up link [ 592.063385][ T5642] block nbd52: Receive control failed (result -32) [ 592.071824][ T5635] block nbd52: Receive control failed (result -32) [ 592.670960][T21279] syzkaller1: entered promiscuous mode [ 592.679278][T21279] syzkaller1: entered allmulticast mode [ 592.836303][T15594] ip6_tunnel: ip6gretap1 xmit: Local address not yet configured! [ 592.859131][T15594] ip6_tunnel: ip6gretap1 xmit: Local address not yet configured! [ 592.936845][T21285] lo: left allmulticast mode [ 593.203414][T12290] ip6_tunnel: ip6gretap1 xmit: Local address not yet configured! [ 593.419153][T21285] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 593.479926][T21285] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 593.961633][T21285] syzkaller1: left promiscuous mode [ 593.986205][T21285] syzkaller1: left allmulticast mode [ 594.082869][ T9258] netdevsim netdevsim1 eth0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 594.106085][ T9258] netdevsim netdevsim1 eth1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 594.127783][ T9258] netdevsim netdevsim1 eth2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 594.238321][ T9258] netdevsim netdevsim1 eth3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 594.940397][T21343] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 594.979411][T21343] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 595.000695][T21343] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 595.101503][T21339] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 595.152416][T21339] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 595.355084][T21355] IPVS: set_ctl: invalid protocol: 135 172.30.1.1:20004 [ 595.956071][T21379] netlink: 76 bytes leftover after parsing attributes in process `syz.4.3863'. [ 595.986879][T21382] netlink: 'syz.0.3864': attribute type 10 has an invalid length. [ 596.025669][T21382] netlink: 156 bytes leftover after parsing attributes in process `syz.0.3864'. [ 596.045500][T21384] netlink: 56 bytes leftover after parsing attributes in process `syz.0.3864'. [ 596.512913][ C0] ip6_tunnel: ip6gretap1 xmit: Local address not yet configured! [ 596.619701][T21406] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 596.628322][ C0] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 596.909065][T21413] netlink: 16 bytes leftover after parsing attributes in process `syz.0.3873'. [ 596.932511][T21413] veth1_to_team: entered promiscuous mode [ 596.947580][T21413] gretap0: entered promiscuous mode [ 596.964196][T21413] debugfs: 'hsr1' already exists in 'hsr' [ 596.984435][T21413] Cannot create hsr debugfs directory [ 596.989945][T21413] hsr1: entered promiscuous mode [ 597.857286][T21457] netlink: 16 bytes leftover after parsing attributes in process `syz.3.3881'. [ 597.941524][T21441] veth1_vlan (unregistering): left allmulticast mode [ 598.056840][T21465] netlink: 8 bytes leftover after parsing attributes in process `syz.1.3886'. [ 598.607919][T21459] can: request_module (can-proto-4) failed. [ 598.675907][T21455] bond3: down delay (5) is not a multiple of miimon (2), value rounded to 4 ms [ 598.685060][T21455] bond3: entered promiscuous mode [ 599.169288][T21496] netlink: 'syz.0.3892': attribute type 3 has an invalid length. [ 599.187368][T21498] netlink: 12 bytes leftover after parsing attributes in process `syz.3.3894'. [ 599.198325][T21496] netlink: 8 bytes leftover after parsing attributes in process `syz.0.3892'. [ 599.207795][T21496] netlink: 52 bytes leftover after parsing attributes in process `syz.0.3892'. [ 599.215140][T21492] netlink: 32 bytes leftover after parsing attributes in process `syz.1.3891'. [ 599.258678][T21498] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 599.555792][T21499] bridge0: port 2(bridge_slave_1) entered disabled state [ 599.563665][T21499] bridge0: port 1(bridge_slave_0) entered disabled state [ 599.745432][T21499] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 599.760138][T21499] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 599.893688][ T5635] block nbd53: Receive control failed (result -32) [ 599.893703][ T5632] block nbd53: Receive control failed (result -32) [ 600.156121][T21499] veth3: left promiscuous mode [ 600.273922][T21509] team1: entered promiscuous mode [ 600.295347][T21509] team1: entered allmulticast mode [ 600.312263][T21509] 8021q: adding VLAN 0 to HW filter on device team1 [ 600.331578][ T77] netdevsim netdevsim2 netdevsim0: unset [0, 0] type 1 family 0 port 8472 - 0 [ 600.346199][ T77] netdevsim netdevsim2 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 600.357360][ T77] netdevsim netdevsim2 netdevsim1: unset [0, 0] type 1 family 0 port 8472 - 0 [ 600.377934][ T77] netdevsim netdevsim2 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 600.390592][T21524] FAULT_INJECTION: forcing a failure. [ 600.390592][T21524] name failslab, interval 1, probability 0, space 0, times 0 [ 600.417147][T21524] CPU: 0 UID: 0 PID: 21524 Comm: syz.0.3902 Not tainted syzkaller #0 PREEMPT(full) [ 600.417190][T21524] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 600.417205][T21524] Call Trace: [ 600.417213][T21524] [ 600.417222][T21524] dump_stack_lvl+0xe8/0x150 [ 600.417255][T21524] should_fail_ex+0x412/0x560 [ 600.417287][T21524] should_failslab+0xa8/0x100 [ 600.417322][T21524] kmem_cache_alloc_node_noprof+0x8f/0x690 [ 600.417358][T21524] ? __alloc_skb+0x186/0x7d0 [ 600.417382][T21524] ? __alloc_skb+0x1d0/0x7d0 [ 600.417403][T21524] ? __local_bh_enable_ip+0xd0/0x130 [ 600.417430][T21524] __alloc_skb+0x1d0/0x7d0 [ 600.417453][T21524] ? netlink_ack_tlv_len+0x6c/0x210 [ 600.417482][T21524] netlink_ack+0x146/0xa50 [ 600.417505][T21524] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 600.417530][T21524] ? __lock_acquire+0x6b5/0x2cf0 [ 600.417566][T21524] netlink_rcv_skb+0x2b6/0x4b0 [ 600.417593][T21524] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 600.417619][T21524] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 600.417659][T21524] ? netlink_deliver_tap+0x2e/0x1b0 [ 600.417684][T21524] ? netlink_deliver_tap+0x2e/0x1b0 [ 600.417716][T21524] netlink_unicast+0x75c/0x8e0 [ 600.417751][T21524] netlink_sendmsg+0x813/0xb40 [ 600.417787][T21524] ? __pfx_netlink_sendmsg+0x10/0x10 [ 600.417817][T21524] ? aa_sock_msg_perm+0xf1/0x1b0 [ 600.417845][T21524] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 600.417877][T21524] ____sys_sendmsg+0x972/0x9f0 [ 600.417903][T21524] ? __might_fault+0xaf/0x130 [ 600.417936][T21524] ? __pfx_____sys_sendmsg+0x10/0x10 [ 600.417973][T21524] ? import_iovec+0x73/0xa0 [ 600.418006][T21524] ___sys_sendmsg+0x2a5/0x360 [ 600.418042][T21524] ? __lock_acquire+0x6b5/0x2cf0 [ 600.418067][T21524] ? __pfx____sys_sendmsg+0x10/0x10 [ 600.418128][T21524] ? __fget_files+0x2a/0x420 [ 600.418151][T21524] ? __fget_files+0x3a0/0x420 [ 600.418184][T21524] __x64_sys_sendmsg+0x1bd/0x2a0 [ 600.418213][T21524] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 600.418249][T21524] ? __pfx_ksys_write+0x10/0x10 [ 600.418285][T21524] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 600.418307][T21524] do_syscall_64+0x15f/0xf80 [ 600.418329][T21524] ? trace_irq_disable+0x3b/0x140 [ 600.418364][T21524] ? clear_bhb_loop+0x40/0x90 [ 600.418389][T21524] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 600.418409][T21524] RIP: 0033:0x7f9e38b9cdd9 [ 600.418427][T21524] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 600.418443][T21524] RSP: 002b:00007f9e39a5a028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 600.418465][T21524] RAX: ffffffffffffffda RBX: 00007f9e38e15fa0 RCX: 00007f9e38b9cdd9 [ 600.418479][T21524] RDX: 0000000000000000 RSI: 0000200000000400 RDI: 0000000000000003 [ 600.418491][T21524] RBP: 00007f9e39a5a090 R08: 0000000000000000 R09: 0000000000000000 [ 600.418503][T21524] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 600.418514][T21524] R13: 00007f9e38e16038 R14: 00007f9e38e15fa0 R15: 00007ffff5996018 [ 600.418546][T21524] [ 600.421504][T21537] macvlan2: entered allmulticast mode [ 600.716764][ T5635] Bluetooth: hci3: command 0x0406 tx timeout [ 600.771660][T21537] batadv0: entered allmulticast mode [ 600.791255][T21537] 8021q: adding VLAN 0 to HW filter on device macvlan2 [ 600.802286][T21537] batadv0: left allmulticast mode [ 600.871988][ T77] netdevsim netdevsim2 netdevsim2: unset [0, 0] type 1 family 0 port 8472 - 0 [ 600.907219][ T77] netdevsim netdevsim2 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 600.938515][ T77] netdevsim netdevsim2 netdevsim3: unset [0, 0] type 1 family 0 port 8472 - 0 [ 600.963993][T21549] __nla_validate_parse: 6 callbacks suppressed [ 600.964014][T21549] netlink: 484 bytes leftover after parsing attributes in process `syz.1.3910'. [ 600.993408][ T77] netdevsim netdevsim2 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 601.068663][T21556] netlink: 36 bytes leftover after parsing attributes in process `syz.1.3910'. [ 601.149451][T21564] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 601.158675][ C0] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 601.182173][T21565] RDS: rds_bind could not find a transport for fc00::1, load rds_tcp or rds_rdma? [ 601.293871][T21567] netlink: 'syz.2.3914': attribute type 1 has an invalid length. [ 601.542359][T21579] ip6erspan0: entered allmulticast mode [ 601.586248][T21586] FAULT_INJECTION: forcing a failure. [ 601.586248][T21586] name failslab, interval 1, probability 0, space 0, times 0 [ 601.622203][T21586] CPU: 0 UID: 0 PID: 21586 Comm: syz.2.3919 Not tainted syzkaller #0 PREEMPT(full) [ 601.622234][T21586] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 601.622248][T21586] Call Trace: [ 601.622257][T21586] [ 601.622266][T21586] dump_stack_lvl+0xe8/0x150 [ 601.622298][T21586] should_fail_ex+0x412/0x560 [ 601.622332][T21586] should_failslab+0xa8/0x100 [ 601.622380][T21586] __kmalloc_cache_noprof+0x88/0x660 [ 601.622411][T21586] ? tcf_block_get_ext+0x140/0x17d0 [ 601.622440][T21586] tcf_block_get_ext+0x140/0x17d0 [ 601.622478][T21586] tcf_block_get+0x67/0xa0 [ 601.622500][T21586] ? __pfx_tcf_chain_head_change_dflt+0x10/0x10 [ 601.622528][T21586] cake_init+0x26c/0xc70 [ 601.622555][T21586] ? __raw_spin_lock_init+0x45/0x100 [ 601.622593][T21586] ? __pfx_cake_init+0x10/0x10 [ 601.622619][T21586] qdisc_create+0x7c4/0xf20 [ 601.622643][T21586] ? lockdep_rtnl_is_held+0x26/0x40 [ 601.622681][T21586] tc_modify_qdisc+0x16f0/0x2290 [ 601.622701][T21586] ? rcu_is_watching+0x15/0xb0 [ 601.622740][T21586] ? __pfx_tc_modify_qdisc+0x10/0x10 [ 601.622790][T21586] ? __pfx_tc_modify_qdisc+0x10/0x10 [ 601.622809][T21586] rtnetlink_rcv_msg+0x77e/0xbe0 [ 601.622831][T21586] ? kmem_cache_alloc_node_noprof+0x384/0x690 [ 601.622857][T21586] ? netlink_sendmsg+0x5d4/0xb40 [ 601.622884][T21586] ? rtnetlink_rcv_msg+0x1b9/0xbe0 [ 601.622906][T21586] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 601.622931][T21586] ? __lock_acquire+0x6b5/0x2cf0 [ 601.622965][T21586] netlink_rcv_skb+0x232/0x4b0 [ 601.622992][T21586] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 601.623019][T21586] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 601.623058][T21586] ? netlink_deliver_tap+0x2e/0x1b0 [ 601.623084][T21586] ? netlink_deliver_tap+0x2e/0x1b0 [ 601.623116][T21586] netlink_unicast+0x75c/0x8e0 [ 601.623160][T21586] netlink_sendmsg+0x813/0xb40 [ 601.623197][T21586] ? __pfx_netlink_sendmsg+0x10/0x10 [ 601.623228][T21586] ? aa_sock_msg_perm+0xf1/0x1b0 [ 601.623257][T21586] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 601.623289][T21586] ____sys_sendmsg+0x972/0x9f0 [ 601.623317][T21586] ? __might_fault+0xaf/0x130 [ 601.623362][T21586] ? __pfx_____sys_sendmsg+0x10/0x10 [ 601.623397][T21586] ? import_iovec+0x73/0xa0 [ 601.623428][T21586] ___sys_sendmsg+0x2a5/0x360 [ 601.623453][T21586] ? __lock_acquire+0x6b5/0x2cf0 [ 601.623479][T21586] ? __pfx____sys_sendmsg+0x10/0x10 [ 601.623541][T21586] ? __fget_files+0x2a/0x420 [ 601.623564][T21586] ? __fget_files+0x3a0/0x420 [ 601.623597][T21586] __x64_sys_sendmsg+0x1bd/0x2a0 [ 601.623644][T21586] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 601.623682][T21586] ? __pfx_ksys_write+0x10/0x10 [ 601.623722][T21586] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 601.623745][T21586] do_syscall_64+0x15f/0xf80 [ 601.623770][T21586] ? trace_irq_disable+0x3b/0x140 [ 601.623801][T21586] ? clear_bhb_loop+0x40/0x90 [ 601.623828][T21586] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 601.623849][T21586] RIP: 0033:0x7f7d4d99cdd9 [ 601.623868][T21586] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 601.623885][T21586] RSP: 002b:00007f7d4e8b4028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 601.623907][T21586] RAX: ffffffffffffffda RBX: 00007f7d4dc15fa0 RCX: 00007f7d4d99cdd9 [ 601.623921][T21586] RDX: 0000000000000000 RSI: 0000200000000400 RDI: 0000000000000003 [ 601.623934][T21586] RBP: 00007f7d4e8b4090 R08: 0000000000000000 R09: 0000000000000000 [ 601.623947][T21586] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 601.623959][T21586] R13: 00007f7d4dc16038 R14: 00007f7d4dc15fa0 R15: 00007ffce1ae0208 [ 601.623993][T21586] [ 602.147552][T21588] ipt_ECN: cannot use operation on non-tcp rule [ 602.345298][T21600] netlink: 'syz.0.3924': attribute type 21 has an invalid length. [ 602.368621][T21600] IPv6: NLM_F_CREATE should be specified when creating new route [ 602.376813][T21600] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 602.384105][T21600] IPv6: NLM_F_CREATE should be set when creating new route [ 602.391442][T21600] IPv6: NLM_F_CREATE should be set when creating new route [ 602.398746][T21600] IPv6: NLM_F_CREATE should be set when creating new route [ 602.414485][T21601] netlink: 52 bytes leftover after parsing attributes in process `syz.4.3926'. [ 602.433111][T21601] ip6tnl0: Caught tx_queue_len zero misconfig [ 602.492579][T21606] netlink: 32 bytes leftover after parsing attributes in process `syz.3.3925'. [ 602.514841][T21601] netlink: 52 bytes leftover after parsing attributes in process `syz.4.3926'. [ 602.718371][T21622] netlink: 'syz.1.3932': attribute type 1 has an invalid length. [ 602.726338][T21622] netlink: 64 bytes leftover after parsing attributes in process `syz.1.3932'. [ 602.737146][T21622] netlink: 658 bytes leftover after parsing attributes in process `syz.1.3932'. [ 602.747162][T21622] netlink: 'syz.1.3932': attribute type 1 has an invalid length. [ 602.795298][T21626] netlink: 28 bytes leftover after parsing attributes in process `syz.2.3933'. [ 602.853606][T21628] netlink: 'syz.3.3934': attribute type 1 has an invalid length. [ 602.878493][T21622] xt_TCPMSS: Only works on TCP SYN packets [ 602.984749][T21628] 8021q: adding VLAN 0 to HW filter on device bond2 [ 603.005134][T21640] netlink: 8 bytes leftover after parsing attributes in process `syz.4.3936'. [ 603.129098][T21634] bond2: (slave geneve2): making interface the new active one [ 603.154698][T21634] bond2: (slave geneve2): Enslaving as an active interface with an up link [ 603.328497][T21656] netlink: 'syz.3.3942': attribute type 1 has an invalid length. [ 603.429231][T21656] bond3: entered promiscuous mode [ 603.435939][T21656] 8021q: adding VLAN 0 to HW filter on device bond3 [ 603.639588][T21674] netlink: 12 bytes leftover after parsing attributes in process `syz.3.3946'. [ 603.713213][ C0] ip6_tunnel: ip6gretap1 xmit: Local address not yet configured! [ 603.725204][ T5635] block nbd54: Receive control failed (result -32) [ 603.735409][ T5642] block nbd54: Receive control failed (result -32) [ 603.844497][T21679] netlink: ct family unspecified [ 603.849540][T21679] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 604.156114][T21690] 8021q: adding VLAN 0 to HW filter on device bond0 [ 604.174855][T21690] 8021q: adding VLAN 0 to HW filter on device team0 [ 604.222340][T21690] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 604.324262][T21690] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 604.365296][T21690] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 604.399796][T21690] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 604.420809][T21690] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 604.456798][T21690] veth1_vlan: left promiscuous mode [ 604.474115][T21690] veth0_vlan: left promiscuous mode [ 604.482068][T21690] veth0_vlan: entered promiscuous mode [ 604.505272][T21690] veth1_vlan: entered promiscuous mode [ 604.530668][T21690] veth1_macvtap: left promiscuous mode [ 604.549603][T21690] veth0_macvtap: left promiscuous mode [ 604.572715][T21690] veth0_macvtap: entered promiscuous mode [ 604.601582][T21690] veth1_macvtap: entered promiscuous mode [ 604.637037][T21690] 8021q: adding VLAN 0 to HW filter on device eth0 [ 604.664939][T21690] 8021q: adding VLAN 0 to HW filter on device eth1 [ 604.684815][T21690] 8021q: adding VLAN 0 to HW filter on device eth2 [ 604.696931][T21690] 8021q: adding VLAN 0 to HW filter on device eth3 [ 604.708672][T21690] team1: left promiscuous mode [ 604.714869][T21690] team1: left allmulticast mode [ 604.824338][ T3335] netdevsim netdevsim1 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 604.851061][ T3335] netdevsim netdevsim1 eth1: set [1, 0] type 2 family 0 port 6081 - 0 [ 604.914522][ T3335] netdevsim netdevsim1 eth2: set [1, 0] type 2 family 0 port 6081 - 0 [ 604.943886][ T3335] netdevsim netdevsim1 eth3: set [1, 0] type 2 family 0 port 6081 - 0 [ 605.068746][T21710] netlink: 'syz.3.3957': attribute type 1 has an invalid length. [ 605.188019][T21704] syzkaller1: entered promiscuous mode [ 605.239903][T21704] syzkaller1: entered allmulticast mode [ 605.409941][T21729] openvswitch: netlink: Key type 310 is out of range max 32 [ 605.792768][T21677] Bluetooth: hci1: command 0x0406 tx timeout [ 605.854253][T21745] netlink: 'syz.0.3966': attribute type 12 has an invalid length. [ 605.952392][T21745] bond0: option primary_reselect: invalid value (191) [ 606.255060][T21757] vlan2: entered promiscuous mode [ 606.260416][T21757] gretap0: entered promiscuous mode [ 606.545842][T21772] __nla_validate_parse: 74 callbacks suppressed [ 606.545863][T21772] netlink: 24 bytes leftover after parsing attributes in process `syz.2.3975'. [ 606.592315][T21774] netlink: 'syz.3.3976': attribute type 1 has an invalid length. [ 606.657422][T21774] netlink: 'syz.3.3976': attribute type 2 has an invalid length. [ 606.701281][T21774] netlink: 'syz.3.3976': attribute type 2 has an invalid length. [ 606.741562][T21774] netlink: 'syz.3.3976': attribute type 2 has an invalid length. [ 606.785294][T21774] netlink: 'syz.3.3976': attribute type 1 has an invalid length. [ 606.817617][T21774] netlink: 'syz.3.3976': attribute type 2 has an invalid length. [ 606.840793][T21790] syzkaller1: entered promiscuous mode [ 606.847029][T21790] syzkaller1: entered allmulticast mode [ 607.074671][T21801] netlink: 28 bytes leftover after parsing attributes in process `syz.3.3984'. [ 607.431551][T21818] netlink: 'syz.4.3988': attribute type 16 has an invalid length. [ 607.473878][T21818] netlink: 28 bytes leftover after parsing attributes in process `syz.4.3988'. [ 607.526165][T21819] netlink: 'syz.4.3988': attribute type 8 has an invalid length. [ 607.607188][T21812] ip6gre1: entered promiscuous mode [ 607.630056][T21812] ip6gre1: entered allmulticast mode [ 607.837968][T21832] netlink: 8 bytes leftover after parsing attributes in process `syz.0.3991'. [ 608.121183][ T77] ip6_tunnel: ip6gre1 xmit: Local address not yet configured! [ 608.141293][ T77] ip6_tunnel: ip6gre1 xmit: Local address not yet configured! [ 608.150134][T12274] ip6_tunnel: ip6gre1 xmit: Local address not yet configured! [ 608.169097][T21832] bond0: Unable to set down delay as MII monitoring is disabled [ 608.273952][T12274] ip6_tunnel: ip6gre1 xmit: Local address not yet configured! [ 608.286226][ T5642] block nbd55: Receive control failed (result -32) [ 608.289119][T21677] block nbd55: Receive control failed (result -32) [ 608.390603][T21841] netlink: 3 bytes leftover after parsing attributes in process `syz.0.3995'. [ 608.532153][T21849] netlink: 4 bytes leftover after parsing attributes in process `syz.3.3998'. [ 608.565371][T21849] openvswitch: netlink: nsh attribute has 4 unknown bytes. [ 608.729762][T21860] netlink: 964 bytes leftover after parsing attributes in process `syz.4.4001'. [ 608.798058][T21860] A link change request failed with some changes committed already. Interface gre0 may have been left with an inconsistent configuration, please check. [ 608.907558][T21861] 8021q: adding VLAN 0 to HW filter on device macvlan2 [ 608.923518][T12274] ip6_tunnel: ip6gre1 xmit: Local address not yet configured! [ 609.487628][T21900] xt_hashlimit: size too large, truncated to 1048576 [ 609.771336][T21886] bridge0: port 2(bridge_slave_1) entered disabled state [ 609.778891][T21886] bridge0: port 1(bridge_slave_0) entered disabled state [ 610.011799][T21886] batman_adv: batadv0: Interface deactivated: dummy0 [ 610.046021][ T5642] block nbd56: Receive control failed (result -32) [ 610.061896][ T5642] block nbd56: Receive control failed (result -32) [ 610.324800][T21934] netlink: 20 bytes leftover after parsing attributes in process `syz.1.4016'. [ 610.400936][T21937] netlink: 40 bytes leftover after parsing attributes in process `syz.2.4014'. [ 610.645717][T21886] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 610.698601][T21886] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 611.050075][T21926] bond4 (unregistering): Released all slaves [ 611.655401][T21979] netlink: 12 bytes leftover after parsing attributes in process `syz.3.4028'. [ 611.732556][T21983] x_tables: unsorted underflow at hook 2 [ 611.750369][T21981] x_tables: unsorted underflow at hook 2 [ 611.866716][T21987] validate_nla: 3 callbacks suppressed [ 611.866742][T21987] netlink: 'syz.4.4029': attribute type 1 has an invalid length. [ 611.932645][T21987] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 612.433022][ C1] ip6_tunnel: ip6gre1 xmit: Local address not yet configured! [ 612.828962][T22009] sctp: [Deprecated]: syz.4.4035 (pid 22009) Use of struct sctp_assoc_value in delayed_ack socket option. [ 612.828962][T22009] Use struct sctp_sack_info instead [ 613.826430][T22053] netlink: 20 bytes leftover after parsing attributes in process `syz.4.4043'. [ 613.835671][T22053] netlink: 20 bytes leftover after parsing attributes in process `syz.4.4043'. [ 615.540824][T22000] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 615.810332][T22065] netlink: 16178 bytes leftover after parsing attributes in process `syz.0.4045'. [ 615.917063][T22058] vlan2: entered promiscuous mode [ 615.963546][T22058] bridge0: entered promiscuous mode [ 615.996890][T22077] netlink: 4 bytes leftover after parsing attributes in process `syz.4.4048'. [ 616.007356][T22077] openvswitch: netlink: nsh attribute has 4 unknown bytes. [ 616.036654][T21677] Bluetooth: hci4: command 0x0406 tx timeout [ 616.080332][T22080] netlink: 36 bytes leftover after parsing attributes in process `syz.4.4048'. [ 616.132977][T22083] netlink: 8 bytes leftover after parsing attributes in process `syz.3.4050'. [ 616.282058][T22093] tipc: Enabling not permitted [ 616.317340][T22093] tipc: Enabling of bearer rejected, failed to enable media [ 616.390265][T22094] netlink: 8 bytes leftover after parsing attributes in process `syz.2.4052'. [ 616.500228][T22100] input: Bluetooth HID Boot Protocol Device as /devices/virtual/bluetooth/hci0/hci0:200/input32 [ 616.597717][T22109] netlink: 'syz.1.4056': attribute type 1 has an invalid length. [ 616.698450][T22100] tipc: Enabled bearer , priority 0 [ 616.859527][T22106] syzkaller0: entered promiscuous mode [ 616.878725][T22106] syzkaller0: entered allmulticast mode [ 616.898702][T22106] tipc: Resetting bearer [ 617.100618][T15594] tipc: Resetting bearer [ 617.110693][T22096] tipc: Resetting bearer [ 617.282276][T22148] netlink: 'syz.3.4060': attribute type 10 has an invalid length. [ 617.760850][T22130] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 618.433556][ C0] ip6_tunnel: ip6gretap1 xmit: Local address not yet configured! [ 619.510896][T22096] tipc: Disabling bearer [ 619.628887][ T5755] tipc: Node number set to 3898401892 [ 619.684311][T22141] lo speed is unknown, defaulting to 1000 [ 619.738234][T22156] netlink: 20 bytes leftover after parsing attributes in process `syz.1.4064'. [ 619.818213][T22158] xt_hashlimit: size too large, truncated to 1048576 [ 620.392515][T22162] syzkaller1: entered promiscuous mode [ 620.421472][T22162] syzkaller1: entered allmulticast mode [ 620.462576][T22141] ±ÿŸÂnÖ8î· speed is unknown, defaulting to 1000 [ 620.733370][T22189] netlink: 8 bytes leftover after parsing attributes in process `syz.4.4070'. [ 621.001029][T22197] netlink: 'syz.2.4073': attribute type 7 has an invalid length. [ 621.057217][T22197] netlink: 'syz.2.4073': attribute type 23 has an invalid length. [ 621.090052][T22204] netlink: 'syz.4.4076': attribute type 1 has an invalid length. [ 621.101945][T22203] syzkaller1: entered promiscuous mode [ 621.108400][T22203] syzkaller1: entered allmulticast mode [ 621.115361][T22204] netlink: 240 bytes leftover after parsing attributes in process `syz.4.4076'. [ 621.128590][T22203] netlink: 12 bytes leftover after parsing attributes in process `syz.3.4075'. [ 621.148264][T22197] netlink: 'syz.2.4073': attribute type 16 has an invalid length. [ 621.165908][T22197] netlink: 'syz.2.4073': attribute type 17 has an invalid length. [ 621.307921][T22197] ip6gretap0: entered promiscuous mode [ 621.343542][T22197] 8021q: adding VLAN 0 to HW filter on device bond0 [ 621.365436][T22197] 8021q: adding VLAN 0 to HW filter on device team0 [ 621.387608][T22197] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 621.477158][T22197] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 621.496818][T22197] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 621.525378][T22197] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 621.535956][T22197] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 621.553210][T22197] veth1_vlan: left promiscuous mode [ 621.559977][T22197] veth0_vlan: left promiscuous mode [ 621.566928][T22197] veth0_vlan: entered promiscuous mode [ 621.577245][T22197] veth1_vlan: entered promiscuous mode [ 621.588742][T22197] veth1_macvtap: left promiscuous mode [ 621.597257][T22197] veth0_macvtap: left promiscuous mode [ 621.604389][T22197] veth0_macvtap: entered promiscuous mode [ 621.611591][T22197] veth1_macvtap: entered promiscuous mode [ 621.630503][T22197] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 621.640573][T22197] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 621.643243][ C1] ip6_tunnel: ip6gre1 xmit: Local address not yet configured! [ 621.657333][T22197] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 621.675521][T22197] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 621.688638][T22197] 8021q: adding VLAN 0 to HW filter on device bond1 [ 621.698842][T22197] 8021q: adding VLAN 0 to HW filter on device bond2 [ 621.721652][T22197] 8021q: adding VLAN 0 to HW filter on device bond3 [ 621.760355][ T9258] bridge0: port 1(bridge_slave_0) entered blocking state [ 621.767635][ T9258] bridge0: port 1(bridge_slave_0) entered forwarding state [ 621.801654][ T9258] bridge0: port 2(bridge_slave_1) entered blocking state [ 621.808895][ T9258] bridge0: port 2(bridge_slave_1) entered forwarding state [ 622.003914][ T77] netdevsim netdevsim2 netdevsim0: set [0, 0] type 1 family 0 port 8472 - 0 [ 622.022796][ T77] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 622.038802][ T77] netdevsim netdevsim2 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0 [ 622.074614][ T77] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 622.101902][ T77] netdevsim netdevsim2 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0 [ 622.129207][ T77] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 622.151738][ T77] netdevsim netdevsim2 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0 [ 622.182786][ T77] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 622.418361][T22226] syzkaller0: entered promiscuous mode [ 622.446121][T22226] syzkaller0: entered allmulticast mode [ 622.680257][T22240] netlink: 830 bytes leftover after parsing attributes in process `syz.3.4083'. [ 622.884431][T22245] netlink: 'syz.2.4085': attribute type 1 has an invalid length. [ 622.905070][T22245] netlink: 88 bytes leftover after parsing attributes in process `syz.2.4085'. [ 622.922308][T22245] netlink: 1 bytes leftover after parsing attributes in process `syz.2.4085'. [ 622.955352][T22245] netlink: 658 bytes leftover after parsing attributes in process `syz.2.4085'. [ 623.314018][T22262] netlink: 'syz.4.4090': attribute type 8 has an invalid length. [ 623.371957][T22266] netlink: 'syz.1.4092': attribute type 39 has an invalid length. [ 623.410409][T22267] netlink: 84 bytes leftover after parsing attributes in process `syz.3.4093'. [ 623.435857][T22269] netlink: 'syz.1.4092': attribute type 39 has an invalid length. [ 623.444846][T22267] netlink: 8 bytes leftover after parsing attributes in process `syz.3.4093'. [ 623.561310][T22276] syzkaller0: entered promiscuous mode [ 623.597126][T22276] syzkaller0: entered allmulticast mode [ 623.754139][T22276] sch_tbf: burst 2 is lower than device syzkaller0 mtu (1514) ! [ 624.228459][ T5642] block nbd57: Receive control failed (result -32) [ 624.232643][T21677] block nbd57: Receive control failed (result -32) [ 624.456386][T22314] vlan0: entered promiscuous mode [ 624.831720][T22340] __nla_validate_parse: 3 callbacks suppressed [ 624.831740][T22340] netlink: 4 bytes leftover after parsing attributes in process `syz.3.4106'. [ 625.039421][T22349] netlink: 48 bytes leftover after parsing attributes in process `syz.0.4108'. [ 625.181446][T22352] netlink: 24 bytes leftover after parsing attributes in process `syz.1.4110'. [ 625.242577][T22352] netlink: 'syz.1.4110': attribute type 13 has an invalid length. [ 625.292606][T22359] netlink: 24 bytes leftover after parsing attributes in process `syz.1.4110'. [ 625.609782][T22375] syzkaller1: entered promiscuous mode [ 625.625876][T22375] syzkaller1: entered allmulticast mode [ 625.776705][T22381] netlink: 80 bytes leftover after parsing attributes in process `syz.1.4118'. [ 625.954715][T22395] netlink: 7064 bytes leftover after parsing attributes in process `syz.3.4122'. [ 625.975278][T22395] openvswitch: netlink: Missing key (keys=40, expected=2000) [ 626.238716][T22403] netlink: 'syz.2.4125': attribute type 1 has an invalid length. [ 626.444042][T22412] geneve3: entered promiscuous mode [ 626.526380][T22415] netlink: 8 bytes leftover after parsing attributes in process `syz.0.4129'. [ 626.553476][T22415] netlink: 16 bytes leftover after parsing attributes in process `syz.0.4129'. [ 626.772015][T22429] netlink: 'syz.3.4133': attribute type 5 has an invalid length. [ 626.930850][T22437] netlink: 804 bytes leftover after parsing attributes in process `syz.2.4136'. [ 626.942627][T22437] A link change request failed with some changes committed already. Interface vcan0 may have been left with an inconsistent configuration, please check. [ 627.185261][T22448] netlink: 244 bytes leftover after parsing attributes in process `syz.4.4139'. [ 627.216891][T22449] netlink: 'syz.2.4140': attribute type 4 has an invalid length. [ 627.272562][ T5642] block nbd58: Receive control failed (result -32) [ 627.272574][T21677] block nbd58: Receive control failed (result -32) [ 627.589305][T22463] openvswitch: netlink: ufid size 20 bytes exceeds the range (1, 16) [ 627.621528][T22463] openvswitch: netlink: Flow set message rejected, Key attribute missing. [ 627.771493][T22473] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 628.003659][T22485] 8021q: adding VLAN 0 to HW filter on device bond4 [ 628.158310][T22498] netlink: 'syz.1.4152': attribute type 1 has an invalid length. [ 628.528366][T22522] syzkaller0: entered promiscuous mode [ 628.567261][T22522] syzkaller0: entered allmulticast mode [ 628.742235][T22536] tipc: Failed to remove unknown binding: 66,0,0/0:1254776942/1254776944 [ 628.754913][T22536] tipc: Failed to remove unknown binding: 66,0,0/0:1254776942/1254776943 [ 628.800895][T22526] bridge_slave_0: Caught tx_queue_len zero misconfig [ 628.817133][T22536] tipc: Failed to remove unknown binding: 66,0,0/0:1254776942/1254776944 [ 628.832496][T22536] tipc: Failed to remove unknown binding: 66,0,0/0:1254776942/1254776943 [ 629.044497][T22537] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 629.069203][T22543] netdevsim netdevsim2: loading /lib/firmware/. failed with error -22 [ 629.079919][T22543] netdevsim netdevsim2: Direct firmware load for . failed with error -22 [ 629.090442][T22543] netdevsim netdevsim2: Falling back to sysfs fallback for: . [ 629.491661][T22571] lo speed is unknown, defaulting to 1000 [ 629.815468][T22571] ±ÿŸÂnÖ8î· speed is unknown, defaulting to 1000 [ 630.355864][ T9260] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 630.393870][ T9260] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 630.418006][T22607] __nla_validate_parse: 12 callbacks suppressed [ 630.418025][T22607] netlink: 24 bytes leftover after parsing attributes in process `syz.0.4180'. [ 630.435764][T22610] netlink: 8 bytes leftover after parsing attributes in process `syz.2.4181'. [ 630.484905][T22607] netlink: 8 bytes leftover after parsing attributes in process `syz.0.4180'. [ 630.698784][T22623] netlink: 'syz.4.4183': attribute type 10 has an invalid length. [ 630.729748][T22623] netlink: 40 bytes leftover after parsing attributes in process `syz.4.4183'. [ 630.765820][T22623] veth1_vlan: left promiscuous mode [ 630.794611][T22623] A link change request failed with some changes committed already. Interface veth1_vlan may have been left with an inconsistent configuration, please check. [ 631.067576][T22641] netlink: 8 bytes leftover after parsing attributes in process `syz.0.4187'. [ 631.169290][T22651] netlink: 'syz.2.4189': attribute type 10 has an invalid length. [ 631.191358][T22651] bridge0: port 3(netdevsim1) entered blocking state [ 631.204731][T22651] bridge0: port 3(netdevsim1) entered disabled state [ 631.208693][T22643] netlink: 8 bytes leftover after parsing attributes in process `syz.0.4187'. [ 631.212564][T22651] netdevsim netdevsim2 netdevsim1: entered allmulticast mode [ 631.259949][T22651] netdevsim netdevsim2 netdevsim1: entered promiscuous mode [ 631.522204][T22655] netlink: 28 bytes leftover after parsing attributes in process `syz.4.4190'. [ 631.561183][T22655] netlink: 28 bytes leftover after parsing attributes in process `syz.4.4190'. [ 631.930702][T22661] netlink: 1 bytes leftover after parsing attributes in process `syz.2.4191'. [ 631.985224][T22657] syzkaller0: entered promiscuous mode [ 632.007979][T22657] syzkaller0: entered allmulticast mode [ 632.098480][T22683] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 634.647677][T22694] netlink: 352 bytes leftover after parsing attributes in process `syz.2.4199'. [ 634.760753][T22698] bond3: entered allmulticast mode [ 634.803987][T22707] sctp: [Deprecated]: syz.1.4202 (pid 22707) Use of int in max_burst socket option deprecated. [ 634.803987][T22707] Use struct sctp_assoc_value instead [ 635.096449][T22722] ip6gre1: entered promiscuous mode [ 635.107308][T22722] ip6gre1: entered allmulticast mode [ 635.432322][T22739] __nla_validate_parse: 2 callbacks suppressed [ 635.432342][T22739] netlink: 4 bytes leftover after parsing attributes in process `syz.0.4211'. [ 635.473805][T22739] openvswitch: netlink: Flow get message rejected, Key attribute missing. [ 635.851728][ T9258] nci: nci_extract_activation_params_nfc_dep: unsupported activation_rf_tech_and_mode 0x6 [ 635.874179][T22759] netlink: 8 bytes leftover after parsing attributes in process `syz.0.4217'. [ 635.993853][T22764] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 636.020583][T22764] tipc: Enabling of bearer rejected, failed to enable media [ 636.078919][T22769] netlink: 'syz.0.4219': attribute type 7 has an invalid length. [ 636.138741][ T144] nci: nci_rsp_packet: unsupported rsp opcode 0xf00 [ 636.258237][T22777] netlink: 88 bytes leftover after parsing attributes in process `syz.4.4221'. [ 636.276624][T22734] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 636.289021][T22771] xt_connbytes: Forcing CT accounting to be enabled [ 636.298426][T22778] rdma_rxe: rxe_newlink: failed to add lo [ 636.311331][T22780] netlink: 24 bytes leftover after parsing attributes in process `syz.0.4222'. [ 636.326565][T22771] ip6t_REJECT: TCP_RESET illegal for non-tcp [ 636.344618][T22777] rdma_rxe: rxe_newlink: failed to add lo [ 637.042076][T22818] netlink: 'syz.2.4230': attribute type 1 has an invalid length. [ 637.316416][T22826] vlan0: left promiscuous mode [ 637.349024][T22826] ip6gre1: left promiscuous mode [ 637.368474][T22826] 8021q: adding VLAN 0 to HW filter on device bond1 [ 637.383367][T12286] ip6_tunnel: ip6gre1 xmit: Local address not yet configured! [ 637.651507][T22830] input: Bluetooth HID Boot Protocol Device as /devices/virtual/bluetooth/hci0/hci0:200/input33 [ 637.731730][T22830] syzkaller0: entered promiscuous mode [ 637.738165][T22830] syzkaller0: entered allmulticast mode [ 637.923064][ T8512] ip6_tunnel: ip6gre1 xmit: Local address not yet configured! [ 639.274682][T22780] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 639.285821][T22790] netlink: 'syz.4.4223': attribute type 1 has an invalid length. [ 639.563428][ C1] ip6_tunnel: ip6gre1 xmit: Local address not yet configured! [ 639.872951][ T8512] page_pool_release_retry() stalled pool shutdown: id 191, 1 inflight 181 sec [ 640.972001][T22840] netlink: 4 bytes leftover after parsing attributes in process `syz.0.4236'. [ 640.995601][T22842] netlink: 20 bytes leftover after parsing attributes in process `syz.4.4238'. [ 641.035846][T22842] ip6gre2: entered promiscuous mode [ 641.046260][T22842] ip6gre2: entered allmulticast mode [ 641.100596][T22844] bond5: option all_slaves_active: invalid value (5) [ 641.112239][T22844] bond5 (unregistering): Released all slaves [ 641.156233][T22854] sctp: [Deprecated]: syz.0.4241 (pid 22854) Use of int in maxseg socket option. [ 641.156233][T22854] Use struct sctp_assoc_value instead [ 641.213248][T22854] sctp: [Deprecated]: syz.0.4241 (pid 22854) Use of int in maxseg socket option. [ 641.213248][T22854] Use struct sctp_assoc_value instead [ 642.232780][T22863] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 642.269556][T22863] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 642.667583][T15594] netdevsim netdevsim1 eth0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 642.696866][T15594] netdevsim netdevsim1 eth1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 642.722762][T15594] netdevsim netdevsim1 eth2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 642.731930][T15594] netdevsim netdevsim1 eth3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 649.153696][ C0] ip6_tunnel: ip6gretap1 xmit: Local address not yet configured! [ 667.850232][T22896] netlink: 'syz.2.4247': attribute type 7 has an invalid length. [ 667.943618][T22896] netlink: 24 bytes leftover after parsing attributes in process `syz.2.4247'. [ 668.067504][T22904] : entered promiscuous mode [ 668.086149][T22897] lo speed is unknown, defaulting to 1000 [ 668.126106][T22906] 8021q: adding VLAN 0 to HW filter on device ipvlan0 [ 668.313508][T22916] netlink: 'syz.0.4254': attribute type 4 has an invalid length. [ 668.515133][T22925] A link change request failed with some changes committed already. Interface bridge_slave_0 may have been left with an inconsistent configuration, please check. [ 668.798227][T22897] ±ÿŸÂnÖ8î· speed is unknown, defaulting to 1000 [ 668.885171][T22938] netlink: 'syz.3.4260': attribute type 32 has an invalid length. [ 668.936809][T22939] team0: No ports can be present during mode change [ 669.178463][T22947] netlink: 8 bytes leftover after parsing attributes in process `syz.3.4263'. [ 669.400225][T22951] netlink: 24 bytes leftover after parsing attributes in process `syz.3.4264'. [ 669.938293][T22966] netlink: 12 bytes leftover after parsing attributes in process `syz.4.4268'. [ 670.346346][T22976] veth0_macvtap: Caught tx_queue_len zero misconfig [ 670.723498][T22986] nbd: must specify a device to reconfigure [ 670.740093][T22987] netlink: 12 bytes leftover after parsing attributes in process `syz.1.4274'. [ 670.774887][T22987] veth1_to_batadv: entered allmulticast mode [ 670.810011][T22987] netlink: 16 bytes leftover after parsing attributes in process `syz.1.4274'. [ 671.024210][T22994] netlink: 12 bytes leftover after parsing attributes in process `syz.1.4277'. [ 671.039295][T22995] openvswitch: netlink: Unknown VXLAN extension attribute 0 [ 671.097355][T22991] bond5: option arp_interval: invalid value (18446744073709551615) [ 671.117734][T22991] bond5: option arp_interval: allowed values 0 - 2147483647 [ 671.250359][T23001] netlink: 'syz.1.4277': attribute type 1 has an invalid length. [ 671.272342][T23001] netlink: 224 bytes leftover after parsing attributes in process `syz.1.4277'. [ 671.298618][T22991] bond5 (unregistering): Released all slaves [ 671.724369][T23011] x_tables: duplicate underflow at hook 1 [ 672.056827][T23026] netlink: 8 bytes leftover after parsing attributes in process `syz.3.4284'. [ 672.191783][T23027] syzkaller1: entered promiscuous mode [ 672.204714][T23027] syzkaller1: entered allmulticast mode [ 672.484805][T23048] pim6reg: entered allmulticast mode [ 672.495787][T23048] pim6reg: left allmulticast mode [ 672.549332][T23051] netlink: 40 bytes leftover after parsing attributes in process `syz.4.4291'. [ 672.572429][T23054] workqueue: Failed to create a rescuer kthread for wq "nfc2_nci_cmd_wq": -EINTR [ 672.651236][T23053] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 672.849796][T23066] syzkaller1: entered promiscuous mode [ 672.865552][T23066] syzkaller1: entered allmulticast mode [ 673.200239][T23078] netlink: 8 bytes leftover after parsing attributes in process `syz.4.4296'. [ 673.418502][T23084] netlink: 56 bytes leftover after parsing attributes in process `syz.0.4299'. [ 673.463172][T23084] netlink: 8 bytes leftover after parsing attributes in process `syz.0.4299'. [ 673.572611][T23083] lo speed is unknown, defaulting to 1000 [ 674.100405][T23107] netlink: 'syz.3.4303': attribute type 12 has an invalid length. [ 674.189373][T23107] bond5: option resend_igmp: invalid value (2876) [ 674.197238][T23107] bond5: option resend_igmp: allowed values 0 - 255 [ 674.210365][T23107] bond5 (unregistering): Released all slaves [ 674.413790][T23083] ±ÿŸÂnÖ8î· speed is unknown, defaulting to 1000 [ 674.647653][T23131] ip6t_rpfilter: unknown options [ 674.697796][T23135] openvswitch: netlink: Flow actions attr not present in new flow. [ 674.736964][T23131] bridge4: trying to set multicast startup query interval above maximum, setting to 8640000 (86400000ms) [ 674.958059][T23152] netlink: 'syz.0.4315': attribute type 1 has an invalid length. [ 675.065003][T23152] bond4: entered promiscuous mode [ 675.079651][T23152] 8021q: adding VLAN 0 to HW filter on device bond4 [ 675.115097][T23156] ipvlan3: entered allmulticast mode [ 675.120637][T23156] bond4: entered allmulticast mode [ 675.122333][T23163] netlink: 20 bytes leftover after parsing attributes in process `syz.3.4316'. [ 675.237067][T23152] bond4: (slave bridge2): making interface the new active one [ 675.260424][T23152] bridge2: entered promiscuous mode [ 675.283048][T23152] bridge2: entered allmulticast mode [ 675.304884][T23152] bond4: (slave bridge2): Enslaving as an active interface with an up link [ 675.316794][T23165] netlink: 8 bytes leftover after parsing attributes in process `syz.4.4318'. [ 675.359448][T23165] bridge_slave_1: left allmulticast mode [ 675.368514][T23165] bridge_slave_1: left promiscuous mode [ 675.374613][T23165] bridge0: port 2(bridge_slave_1) entered disabled state [ 675.384877][T23165] bridge_slave_0: left allmulticast mode [ 675.395772][T23165] bridge_slave_0: left promiscuous mode [ 675.401636][T23165] bridge0: port 1(bridge_slave_0) entered disabled state [ 675.449682][T23172] x_tables: ip6_tables: icmp6 match: only valid for protocol 58 [ 675.746095][T23185] netlink: 20 bytes leftover after parsing attributes in process `syz.0.4323'. [ 676.300285][T23212] rdma_op ffff8880561059f0 conn xmit_rdma 0000000000000000 [ 676.347979][T23213] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 676.959747][T23235] A link change request failed with some changes committed already. Interface geneve0 may have been left with an inconsistent configuration, please check. [ 677.005529][T23239] tipc: Enabling of bearer rejected, failed to enable media [ 677.014661][T23237] netlink: 16 bytes leftover after parsing attributes in process `syz.3.4340'. [ 677.156125][T23237] netlink: 'syz.3.4340': attribute type 3 has an invalid length. [ 677.189777][T23237] netlink: 36 bytes leftover after parsing attributes in process `syz.3.4340'. [ 677.405293][T23256] netlink: 8 bytes leftover after parsing attributes in process `syz.3.4345'. [ 677.458185][T23258] netlink: 'syz.2.4346': attribute type 21 has an invalid length. [ 677.467468][T23258] netlink: 128 bytes leftover after parsing attributes in process `syz.2.4346'. [ 677.497322][T23258] netlink: 'syz.2.4346': attribute type 4 has an invalid length. [ 677.523276][T23258] netlink: 'syz.2.4346': attribute type 5 has an invalid length. [ 677.983566][T23276] A link change request failed with some changes committed already. Interface gre0 may have been left with an inconsistent configuration, please check. [ 678.065353][T23276] A link change request failed with some changes committed already. Interface gre0 may have been left with an inconsistent configuration, please check. [ 678.226895][T23285] lo speed is unknown, defaulting to 1000 [ 678.296088][T23292] __nla_validate_parse: 3 callbacks suppressed [ 678.296110][T23292] netlink: 8 bytes leftover after parsing attributes in process `syz.0.4352'. [ 678.352855][ C1] af_packet: tpacket_rcv: packet too big, clamped from 60 to 4294967292. macoff=76 [ 678.358250][T23292] netlink: 4 bytes leftover after parsing attributes in process `syz.0.4352'. [ 678.421983][T23292] netlink: 'syz.0.4352': attribute type 15 has an invalid length. [ 678.609714][T23303] x_tables: unsorted entry at hook 2 [ 678.631440][T23303] x_tables: unsorted entry at hook 2 [ 678.651152][T23303] x_tables: unsorted entry at hook 2 [ 678.668447][T23303] x_tables: unsorted entry at hook 2 [ 678.695644][T23303] x_tables: unsorted entry at hook 2 [ 678.721120][T23303] x_tables: unsorted entry at hook 2 [ 678.748246][T23303] x_tables: unsorted entry at hook 2 [ 678.776547][T23303] x_tables: unsorted entry at hook 2 [ 678.805095][T23303] x_tables: unsorted entry at hook 2 [ 678.830670][T23303] x_tables: unsorted entry at hook 2 [ 678.922369][T23314] sch_tbf: burst 240 is lower than device lo mtu (11337746) ! [ 679.008589][T23278] netlink: 8 bytes leftover after parsing attributes in process `syz.3.4351'. [ 679.078436][T23285] ±ÿŸÂnÖ8î· speed is unknown, defaulting to 1000 [ 679.088534][T23316] netlink: 'syz.2.4358': attribute type 13 has an invalid length. [ 679.202497][T23320] netlink: 4 bytes leftover after parsing attributes in process `syz.2.4358'. [ 679.595568][T23316] bridge0: port 2(bridge_slave_1) entered disabled state [ 679.603336][T23316] bridge0: port 1(bridge_slave_0) entered disabled state [ 679.690282][T23316] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 679.704195][T23316] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 679.841299][ T5642] block nbd59: Receive control failed (result -32) [ 679.842568][T21677] block nbd59: Receive control failed (result -32) [ 679.958954][ T57] netdevsim netdevsim2 netdevsim0: unset [0, 0] type 1 family 0 port 8472 - 0 [ 679.975292][ T57] netdevsim netdevsim2 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 679.985564][ T57] netdevsim netdevsim2 netdevsim1: unset [0, 0] type 1 family 0 port 8472 - 0 [ 679.994965][ T57] netdevsim netdevsim2 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 680.029870][ T57] netdevsim netdevsim2 netdevsim2: unset [0, 0] type 1 family 0 port 8472 - 0 [ 680.039260][ T57] netdevsim netdevsim2 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 680.054339][ T57] netdevsim netdevsim2 netdevsim3: unset [0, 0] type 1 family 0 port 8472 - 0 [ 680.065722][ T57] netdevsim netdevsim2 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 680.261514][T23345] netlink: 4 bytes leftover after parsing attributes in process `syz.1.4366'. [ 680.281438][T23345] openvswitch: netlink: Invalid VLAN frame [ 680.293323][T23339] netlink: 28 bytes leftover after parsing attributes in process `syz.3.4365'. [ 680.458031][T23351] netlink: 'syz.1.4367': attribute type 11 has an invalid length. [ 680.484400][T23351] netlink: 'syz.1.4367': attribute type 4 has an invalid length. [ 680.492546][T23351] netlink: 199780 bytes leftover after parsing attributes in process `syz.1.4367'. [ 680.507168][T23350] team0 (unregistering): Port device team_slave_0 removed [ 680.517734][T23350] team0 (unregistering): Port device team_slave_1 removed [ 680.826165][T23369] netlink: 'syz.2.4369': attribute type 39 has an invalid length. [ 680.835479][T23367] netlink: 12 bytes leftover after parsing attributes in process `syz.1.4371'. [ 681.041515][T23381] netlink: 20 bytes leftover after parsing attributes in process `syz.2.4369'. [ 681.854078][T23407] netlink: 36 bytes leftover after parsing attributes in process `syz.1.4378'. [ 682.078108][T23409] 8021q: adding VLAN 0 to HW filter on device bond5 [ 682.109036][T23410] bond5: (slave ip6gretap1): Enslaving as a backup interface with an up link [ 682.129392][T23415] ip6gre3: entered promiscuous mode [ 682.135183][T23415] ip6gre3: entered allmulticast mode [ 682.160769][T23420] netlink: 'syz.2.4381': attribute type 1 has an invalid length. [ 682.193089][ T36] bond5: Warning: No 802.3ad response from the link partner for any adapters in the bond [ 682.353434][ T36] bond5: Warning: No 802.3ad response from the link partner for any adapters in the bond [ 682.824283][T23466] openvswitch: netlink: Unexpected mask (mask=201040, allowed=10048) [ 683.170788][ T3335] ip6_tunnel: ip6gre3 xmit: Local address not yet configured! [ 683.229695][ T3335] ip6_tunnel: ip6gre3 xmit: Local address not yet configured! [ 683.238070][T12794] ip6_tunnel: ip6gre3 xmit: Local address not yet configured! [ 683.246384][T23490] xt_hashlimit: size too large, truncated to 1048576 [ 683.387150][T23499] __nla_validate_parse: 4 callbacks suppressed [ 683.387172][T23499] netlink: 14 bytes leftover after parsing attributes in process `syz.3.4396'. [ 683.409896][T23503] tipc: Started in network mode [ 683.433184][T23503] tipc: Node identity 226b60535136, cluster identity 4 [ 683.443827][T12794] ip6_tunnel: ip6gre3 xmit: Local address not yet configured! [ 683.494610][T23503] tipc: Enabled bearer , priority 0 [ 683.651950][T23499] bond0 (unregistering): Released all slaves [ 683.690713][T23508] syzkaller0: entered promiscuous mode [ 683.701983][T23508] syzkaller0: entered allmulticast mode [ 683.717869][T23505] lo speed is unknown, defaulting to 1000 [ 683.760350][T23493] tipc: Resetting bearer [ 683.775465][T23489] tipc: Resetting bearer [ 683.827709][T23489] tipc: Disabling bearer [ 683.885174][T23513] xt_check_table_hooks: 23 callbacks suppressed [ 683.885193][T23513] x_tables: unsorted entry at hook 3 [ 684.179554][T23522] netlink: 8 bytes leftover after parsing attributes in process `syz.3.4403'. [ 684.209607][T23517] netlink: 12 bytes leftover after parsing attributes in process `syz.0.4402'. [ 684.269390][ T5642] block nbd60: Receive control failed (result -1) [ 684.280153][ T10] ip6_tunnel: ip6gre3 xmit: Local address not yet configured! [ 684.316273][T23505] ±ÿŸÂnÖ8î· speed is unknown, defaulting to 1000 [ 684.346054][T23516] workqueue: Failed to create a rescuer kthread for wq "nbd61-recv": -EINTR [ 684.346393][T23516] block (null): Could not allocate knbd recv work queue. [ 684.411369][T23516] nbd: failed to add new device [ 684.595401][T23534] netlink: 12 bytes leftover after parsing attributes in process `syz.3.4406'. [ 684.733737][T23537] [ 684.736140][T23537] ====================================================== [ 684.743182][T23537] WARNING: possible circular locking dependency detected [ 684.750240][T23537] syzkaller #0 Not tainted [ 684.754697][T23537] ------------------------------------------------------ [ 684.761761][T23537] syz.3.4406/23537 is trying to acquire lock: [ 684.767856][T23537] ffff888054ec0c18 (set->srcu){.+.+}-{0:0}, at: __synchronize_srcu+0xb6/0x300 [ 684.776778][T23537] [ 684.776778][T23537] but task is already holding lock: [ 684.784181][T23537] ffff888029f77548 (&q->elevator_lock){+.+.}-{4:4}, at: elevator_change+0x1b3/0x450 [ 684.793655][T23537] [ 684.793655][T23537] which lock already depends on the new lock. [ 684.793655][T23537] [ 684.804176][T23537] [ 684.804176][T23537] the existing dependency chain (in reverse order) is: [ 684.813228][T23537] [ 684.813228][T23537] -> #6 (&q->elevator_lock){+.+.}-{4:4}: [ 684.821095][T23537] __mutex_lock+0x1a3/0x1550 [ 684.826260][T23537] elevator_change+0x1b3/0x450 [ 684.831592][T23537] elevator_set_none+0xb5/0x140 [ 684.837015][T23537] blk_mq_update_nr_hw_queues+0x5e7/0x1a60 [ 684.843365][T23537] nbd_start_device+0x17f/0xb10 [ 684.848769][T23537] nbd_genl_connect+0x165b/0x1cf0 [ 684.854341][T23537] genl_family_rcv_msg_doit+0x22a/0x330 [ 684.860447][T23537] genl_rcv_msg+0x61c/0x7a0 [ 684.865503][T23537] netlink_rcv_skb+0x232/0x4b0 [ 684.870805][T23537] genl_rcv+0x28/0x40 [ 684.875334][T23537] netlink_unicast+0x75c/0x8e0 [ 684.880644][T23537] netlink_sendmsg+0x813/0xb40 [ 684.885949][T23537] ____sys_sendmsg+0x972/0x9f0 [ 684.891277][T23537] ___sys_sendmsg+0x2a5/0x360 [ 684.896497][T23537] __x64_sys_sendmsg+0x1bd/0x2a0 [ 684.901983][T23537] do_syscall_64+0x15f/0xf80 [ 684.907116][T23537] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 684.913551][T23537] [ 684.913551][T23537] -> #5 (&q->q_usage_counter(io)#49){++++}-{0:0}: [ 684.922184][T23537] blk_alloc_queue+0x546/0x680 [ 684.927499][T23537] __blk_mq_alloc_disk+0x197/0x390 [ 684.933162][T23537] nbd_dev_add+0x499/0xb50 [ 684.938120][T23537] nbd_init+0x168/0x1f0 [ 684.942823][T23537] do_one_initcall+0x250/0x870 [ 684.948140][T23537] do_initcall_level+0x104/0x190 [ 684.953633][T23537] do_initcalls+0x59/0xa0 [ 684.958500][T23537] kernel_init_freeable+0x2a6/0x3e0 [ 684.964236][T23537] kernel_init+0x1d/0x1d0 [ 684.969108][T23537] ret_from_fork+0x514/0xb70 [ 684.974228][T23537] ret_from_fork_asm+0x1a/0x30 [ 684.979547][T23537] [ 684.979547][T23537] -> #4 (fs_reclaim){+.+.}-{0:0}: [ 684.986799][T23537] fs_reclaim_acquire+0x71/0x100 [ 684.992285][T23537] kmem_cache_alloc_node_noprof+0x4a/0x690 [ 684.998636][T23537] __alloc_skb+0x1d0/0x7d0 [ 685.003623][T23537] __ip6_append_data+0x2c7c/0x3e90 [ 685.009295][T23537] ip6_append_data+0x10f/0x280 [ 685.014592][T23537] rawv6_sendmsg+0x12d3/0x18e0 [ 685.019972][T23537] ____sys_sendmsg+0x80a/0x9f0 [ 685.025270][T23537] ___sys_sendmsg+0x2a5/0x360 [ 685.030486][T23537] __x64_sys_sendmsg+0x1bd/0x2a0 [ 685.035966][T23537] do_syscall_64+0x15f/0xf80 [ 685.041091][T23537] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 685.047518][T23537] [ 685.047518][T23537] -> #3 (sk_lock-AF_INET6){+.+.}-{0:0}: [ 685.055287][T23537] lock_sock_nested+0x41/0x100 [ 685.060603][T23537] inet_shutdown+0x6a/0x390 [ 685.065655][T23537] nbd_mark_nsock_dead+0x2e9/0x560 [ 685.071304][T23537] recv_work+0x1c2e/0x1d40 [ 685.076361][T23537] process_scheduled_works+0xb5d/0x1860 [ 685.082444][T23537] worker_thread+0xa53/0xfc0 [ 685.087566][T23537] kthread+0x388/0x470 [ 685.092167][T23537] ret_from_fork+0x514/0xb70 [ 685.097294][T23537] ret_from_fork_asm+0x1a/0x30 [ 685.102606][T23537] [ 685.102606][T23537] -> #2 (&nsock->tx_lock){+.+.}-{4:4}: [ 685.110284][T23537] __mutex_lock+0x1a3/0x1550 [ 685.115424][T23537] nbd_queue_rq+0x37b/0x1100 [ 685.120547][T23537] blk_mq_dispatch_rq_list+0xa70/0x1910 [ 685.126635][T23537] __blk_mq_sched_dispatch_requests+0xdcc/0x1600 [ 685.133510][T23537] blk_mq_sched_dispatch_requests+0xd7/0x190 [ 685.140034][T23537] blk_mq_run_hw_queue+0x348/0x4f0 [ 685.145682][T23537] blk_mq_dispatch_list+0xd16/0xe10 [ 685.151425][T23537] blk_mq_flush_plug_list+0x48d/0x570 [ 685.157350][T23537] __blk_flush_plug+0x3ed/0x4d0 [ 685.162750][T23537] __submit_bio+0x28d/0x580 [ 685.167817][T23537] submit_bio_noacct_nocheck+0x2f4/0xa40 [ 685.173992][T23537] block_read_full_folio+0x599/0x830 [ 685.179811][T23537] filemap_read_folio+0x137/0x3b0 [ 685.185386][T23537] do_read_cache_folio+0x358/0x590 [ 685.191036][T23537] read_part_sector+0xb6/0x2b0 [ 685.196349][T23537] adfspart_check_ICS+0xb1/0x960 [ 685.201837][T23537] bdev_disk_changed+0x817/0x1770 [ 685.207410][T23537] blkdev_get_whole+0x380/0x510 [ 685.212978][T23537] bdev_open+0x31e/0xd30 [ 685.217765][T23537] blkdev_open+0x470/0x610 [ 685.222720][T23537] do_dentry_open+0x785/0x14e0 [ 685.228053][T23537] vfs_open+0x3b/0x340 [ 685.232761][T23537] path_openat+0x2e08/0x3860 [ 685.237888][T23537] do_file_open+0x23e/0x4a0 [ 685.242935][T23537] do_sys_openat2+0x113/0x200 [ 685.248160][T23537] __x64_sys_openat+0x138/0x170 [ 685.253577][T23537] do_syscall_64+0x15f/0xf80 [ 685.258798][T23537] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 685.265226][T23537] [ 685.265226][T23537] -> #1 (&cmd->lock){+.+.}-{4:4}: [ 685.272459][T23537] __mutex_lock+0x1a3/0x1550 [ 685.277588][T23537] nbd_queue_rq+0xc6/0x1100 [ 685.282631][T23537] blk_mq_dispatch_rq_list+0xa70/0x1910 [ 685.288729][T23537] __blk_mq_sched_dispatch_requests+0xdcc/0x1600 [ 685.295608][T23537] blk_mq_sched_dispatch_requests+0xd7/0x190 [ 685.302137][T23537] blk_mq_run_hw_queue+0x348/0x4f0 [ 685.307789][T23537] blk_mq_dispatch_list+0xd16/0xe10 [ 685.313535][T23537] blk_mq_flush_plug_list+0x48d/0x570 [ 685.319460][T23537] __blk_flush_plug+0x3ed/0x4d0 [ 685.324854][T23537] __submit_bio+0x28d/0x580 [ 685.329904][T23537] submit_bio_noacct_nocheck+0x2f4/0xa40 [ 685.336077][T23537] block_read_full_folio+0x599/0x830 [ 685.341904][T23537] filemap_read_folio+0x137/0x3b0 [ 685.347478][T23537] do_read_cache_folio+0x358/0x590 [ 685.353135][T23537] read_part_sector+0xb6/0x2b0 [ 685.358438][T23537] adfspart_check_ICS+0xb1/0x960 [ 685.363918][T23537] bdev_disk_changed+0x817/0x1770 [ 685.369575][T23537] blkdev_get_whole+0x380/0x510 [ 685.374967][T23537] bdev_open+0x31e/0xd30 [ 685.379755][T23537] blkdev_open+0x470/0x610 [ 685.384705][T23537] do_dentry_open+0x785/0x14e0 [ 685.390017][T23537] vfs_open+0x3b/0x340 [ 685.394630][T23537] path_openat+0x2e08/0x3860 [ 685.399779][T23537] do_file_open+0x23e/0x4a0 [ 685.404828][T23537] do_sys_openat2+0x113/0x200 [ 685.410048][T23537] __x64_sys_openat+0x138/0x170 [ 685.415443][T23537] do_syscall_64+0x15f/0xf80 [ 685.420577][T23537] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 685.427013][T23537] [ 685.427013][T23537] -> #0 (set->srcu){.+.+}-{0:0}: [ 685.434404][T23537] __lock_acquire+0x15a5/0x2cf0 [ 685.439806][T23537] lock_sync+0x9d/0x120 [ 685.444509][T23537] __synchronize_srcu+0xca/0x300 [ 685.450000][T23537] elevator_switch+0x1e8/0x7a0 [ 685.455318][T23537] elevator_change+0x2cc/0x450 [ 685.460642][T23537] elevator_set_default+0x36c/0x430 [ 685.466397][T23537] blk_register_queue+0x3e9/0x4e0 [ 685.471987][T23537] __add_disk+0x677/0xd50 [ 685.476862][T23537] add_disk_fwnode+0xfb/0x480 [ 685.482076][T23537] nbd_dev_add+0x72c/0xb50 [ 685.487033][T23537] nbd_genl_connect+0x962/0x1cf0 [ 685.492507][T23537] genl_family_rcv_msg_doit+0x22a/0x330 [ 685.498602][T23537] genl_rcv_msg+0x61c/0x7a0 [ 685.503653][T23537] netlink_rcv_skb+0x232/0x4b0 [ 685.508957][T23537] genl_rcv+0x28/0x40 [ 685.513482][T23537] netlink_unicast+0x75c/0x8e0 [ 685.518786][T23537] netlink_sendmsg+0x813/0xb40 [ 685.524134][T23537] ____sys_sendmsg+0x972/0x9f0 [ 685.529453][T23537] ___sys_sendmsg+0x2a5/0x360 [ 685.534683][T23537] __x64_sys_sendmsg+0x1bd/0x2a0 [ 685.540169][T23537] do_syscall_64+0x15f/0xf80 [ 685.545744][T23537] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 685.552189][T23537] [ 685.552189][T23537] other info that might help us debug this: [ 685.552189][T23537] [ 685.562434][T23537] Chain exists of: [ 685.562434][T23537] set->srcu --> &q->q_usage_counter(io)#49 --> &q->elevator_lock [ 685.562434][T23537] [ 685.576297][T23537] Possible unsafe locking scenario: [ 685.576297][T23537] [ 685.583763][T23537] CPU0 CPU1 [ 685.589151][T23537] ---- ---- [ 685.594562][T23537] lock(&q->elevator_lock); [ 685.599177][T23537] lock(&q->q_usage_counter(io)#49); [ 685.607098][T23537] lock(&q->elevator_lock); [ 685.614235][T23537] sync(set->srcu); [ 685.618157][T23537] [ 685.618157][T23537] *** DEADLOCK *** [ 685.618157][T23537] [ 685.626316][T23537] 6 locks held by syz.3.4406/23537: [ 685.631528][T23537] #0: ffffffff8fe3e608 (cb_lock){++++}-{4:4}, at: genl_rcv+0x19/0x40 [ 685.639755][T23537] #1: ffffffff8fe3e440 (genl_mutex){+.+.}-{4:4}, at: genl_rcv_msg+0x10b/0x7a0 [ 685.648778][T23537] #2: ffff888029b399c0 (&set->update_nr_hwq_lock){++++}-{4:4}, at: add_disk_fwnode+0xe7/0x480 [ 685.659164][T23537] #3: ffff888029f775d0 (&q->sysfs_lock){+.+.}-{4:4}, at: blk_register_queue+0x119/0x4e0 [ 685.669039][T23537] #4: ffff888029f77058 (&q->q_usage_counter(queue)#98){+.+.}-{0:0}, at: elevator_change+0x198/0x450 [ 685.679951][T23537] #5: ffff888029f77548 (&q->elevator_lock){+.+.}-{4:4}, at: elevator_change+0x1b3/0x450 [ 685.689830][T23537] [ 685.689830][T23537] stack backtrace: [ 685.695735][T23537] CPU: 1 UID: 0 PID: 23537 Comm: syz.3.4406 Not tainted syzkaller #0 PREEMPT(full) [ 685.695762][T23537] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 685.695774][T23537] Call Trace: [ 685.695781][T23537] [ 685.695790][T23537] dump_stack_lvl+0xe8/0x150 [ 685.695812][T23537] print_circular_bug+0x2e1/0x300 [ 685.695838][T23537] check_noncircular+0x12e/0x150 [ 685.695865][T23537] __lock_acquire+0x15a5/0x2cf0 [ 685.695889][T23537] ? lockdep_unlock+0x5d/0xd0 [ 685.695904][T23537] ? __lock_acquire+0x146e/0x2cf0 [ 685.695939][T23537] ? __synchronize_srcu+0xb6/0x300 [ 685.695955][T23537] lock_sync+0x9d/0x120 [ 685.695972][T23537] ? __synchronize_srcu+0xb6/0x300 [ 685.695991][T23537] __synchronize_srcu+0xca/0x300 [ 685.696009][T23537] ? do_raw_spin_lock+0x12b/0x2f0 [ 685.696034][T23537] ? __pfx___synchronize_srcu+0x10/0x10 [ 685.696056][T23537] ? _raw_spin_unlock_irqrestore+0x30/0x80 [ 685.696074][T23537] ? ktime_get_mono_fast_ns+0x2d2/0x2f0 [ 685.696102][T23537] ? synchronize_srcu+0x20d/0x270 [ 685.696120][T23537] elevator_switch+0x1e8/0x7a0 [ 685.696145][T23537] ? blk_mq_cancel_work_sync+0xa5/0xe0 [ 685.696174][T23537] elevator_change+0x2cc/0x450 [ 685.696198][T23537] ? do_raw_spin_unlock+0xf5/0x210 [ 685.696225][T23537] elevator_set_default+0x36c/0x430 [ 685.696250][T23537] ? __pfx_elevator_set_default+0x10/0x10 [ 685.696279][T23537] ? disk_register_independent_access_ranges+0x2db/0x380 [ 685.696303][T23537] ? blk_crypto_sysfs_register+0x11c/0x170 [ 685.696326][T23537] blk_register_queue+0x3e9/0x4e0 [ 685.696358][T23537] __add_disk+0x677/0xd50 [ 685.696377][T23537] ? down_read+0x270/0x2e0 [ 685.696400][T23537] add_disk_fwnode+0xfb/0x480 [ 685.696420][T23537] nbd_dev_add+0x72c/0xb50 [ 685.696439][T23537] ? __pfx_nbd_dev_add+0x10/0x10 [ 685.696465][T23537] ? bpf_lsm_capable+0x9/0x20 [ 685.696482][T23537] ? security_capable+0x7e/0x2c0 [ 685.696506][T23537] nbd_genl_connect+0x962/0x1cf0 [ 685.696523][T23537] ? __pfx___nla_validate_parse+0x10/0x10 [ 685.696553][T23537] ? __pfx_nbd_genl_connect+0x10/0x10 [ 685.696572][T23537] ? rcu_is_watching+0x15/0xb0 [ 685.696593][T23537] ? trace_kmalloc+0x2a/0xf0 [ 685.696619][T23537] ? __nla_parse+0x40/0x60 [ 685.696645][T23537] ? genl_family_rcv_msg_attrs_parse+0x20b/0x2f0 [ 685.696675][T23537] ? genl_family_rcv_msg_attrs_parse+0x265/0x2f0 [ 685.696706][T23537] genl_family_rcv_msg_doit+0x22a/0x330 [ 685.696737][T23537] ? __pfx_genl_family_rcv_msg_doit+0x10/0x10 [ 685.696775][T23537] ? __lock_acquire+0x6b5/0x2cf0 [ 685.696798][T23537] genl_rcv_msg+0x61c/0x7a0 [ 685.696826][T23537] ? __pfx_genl_rcv_msg+0x10/0x10 [ 685.696852][T23537] ? __pfx_nbd_genl_connect+0x10/0x10 [ 685.696874][T23537] netlink_rcv_skb+0x232/0x4b0 [ 685.696896][T23537] ? __pfx_genl_rcv_msg+0x10/0x10 [ 685.696923][T23537] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 685.696950][T23537] ? down_read+0x270/0x2e0 [ 685.696971][T23537] ? genl_rcv+0xd/0x40 [ 685.696997][T23537] genl_rcv+0x28/0x40 [ 685.697021][T23537] netlink_unicast+0x75c/0x8e0 [ 685.697044][T23537] netlink_sendmsg+0x813/0xb40 [ 685.697070][T23537] ? __pfx_netlink_sendmsg+0x10/0x10 [ 685.697093][T23537] ? aa_sock_msg_perm+0xf1/0x1b0 [ 685.697116][T23537] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 685.697141][T23537] ____sys_sendmsg+0x972/0x9f0 [ 685.697164][T23537] ? __might_fault+0xaf/0x130 [ 685.697188][T23537] ? __pfx_____sys_sendmsg+0x10/0x10 [ 685.697214][T23537] ? import_iovec+0x73/0xa0 [ 685.697240][T23537] ___sys_sendmsg+0x2a5/0x360 [ 685.697261][T23537] ? __lock_acquire+0x6b5/0x2cf0 [ 685.697281][T23537] ? __pfx____sys_sendmsg+0x10/0x10 [ 685.697306][T23537] ? futex_wait+0x2a2/0x390 [ 685.697342][T23537] ? __fget_files+0x2a/0x420 [ 685.697362][T23537] ? __fget_files+0x3a0/0x420 [ 685.697386][T23537] __x64_sys_sendmsg+0x1bd/0x2a0 [ 685.697410][T23537] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 685.697437][T23537] ? rcu_is_watching+0x15/0xb0 [ 685.697461][T23537] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 685.697480][T23537] do_syscall_64+0x15f/0xf80 [ 685.697500][T23537] ? trace_irq_disable+0x3b/0x140 [ 685.697526][T23537] ? clear_bhb_loop+0x40/0x90 [ 685.697546][T23537] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 685.697564][T23537] RIP: 0033:0x7f7c5199cdd9 [ 685.697581][T23537] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 685.697597][T23537] RSP: 002b:00007f7c52799028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 685.697616][T23537] RAX: ffffffffffffffda RBX: 00007f7c51c16180 RCX: 00007f7c5199cdd9 [ 685.697630][T23537] RDX: 0000000000000004 RSI: 0000200000001ac0 RDI: 000000000000000a [ 685.697641][T23537] RBP: 00007f7c51a32d69 R08: 0000000000000000 R09: 0000000000000000 [ 685.697653][T23537] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 685.697664][T23537] R13: 00007f7c51c16218 R14: 00007f7c51c16180 R15: 00007ffdb6bc27e8 [ 685.697686][T23537] [ 687.392841][ C0] ip6_tunnel: ip6gre3 xmit: Local address not yet configured!