last executing test programs: 13.463782582s ago: executing program 2 (id=3249): socket$nl_generic(0x10, 0x3, 0x10) (async) r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$tipc2(&(0x7f0000005880), 0xffffffffffffffff) sendmsg$TIPC_NL_LINK_SET(r0, &(0x7f0000005d00)={0x0, 0x0, &(0x7f0000005cc0)={&(0x7f0000000180)={0x18, r1, 0x1, 0x70bd2c, 0x25dfdbfb, {}, [@TIPC_NLA_LINK={0x4}]}, 0x18}}, 0x8040) r2 = socket(0x10, 0x803, 0x0) getsockname$packet(r2, &(0x7f0000000040)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000000c0)=0xd) sendmsg$nl_route(r2, &(0x7f0000000380)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000580)=ANY=[@ANYBLOB="640000001000370403000000ffffffff00000000", @ANYRES32=r3, @ANYBLOB="0b1b050000000000440012800b00010069703667726500003400028008000100", @ANYRES32, @ANYBLOB="14000600fe8000000000000000000000000000aa1400070000000000000000000000000000bb"], 0x64}, 0x1, 0x0, 0x0, 0x48810}, 0x4000010) (async) sendmsg$nl_route(r2, &(0x7f0000000380)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000580)=ANY=[@ANYBLOB="640000001000370403000000ffffffff00000000", @ANYRES32=r3, @ANYBLOB="0b1b050000000000440012800b00010069703667726500003400028008000100", @ANYRES32, @ANYBLOB="14000600fe8000000000000000000000000000aa1400070000000000000000000000000000bb"], 0x64}, 0x1, 0x0, 0x0, 0x48810}, 0x4000010) ioctl$sock_ipv6_tunnel_SIOCADDTUNNEL(r2, 0x89f1, &(0x7f0000000180)={'syztnl0\x00', &(0x7f0000000100)={'syztnl1\x00', r3, 0x4, 0x7, 0x6, 0x42b, 0x2, @local, @remote, 0x1, 0x7800, 0xfffffff7, 0x4}}) 12.940417114s ago: executing program 2 (id=3253): r0 = socket$inet6_sctp(0xa, 0x5, 0x84) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r0, 0x84, 0x6f, &(0x7f0000000280)={0x0, 0x10, &(0x7f0000000440)=[@in={0x2, 0x0, @loopback}]}, &(0x7f00000001c0)=0x10) (async) socket$inet_sctp(0x2, 0x5, 0x84) (async) r1 = socket$inet6_sctp(0xa, 0x5, 0x84) getsockopt$inet_sctp6_SCTP_MAX_BURST(r1, 0x84, 0xc, &(0x7f0000000480)=@assoc_value={0x0}, &(0x7f0000000040)=0x8) setsockopt$inet_sctp6_SCTP_ENABLE_STREAM_RESET(r0, 0x84, 0x76, &(0x7f0000000200)={r2, 0x1}, 0x8) 11.900392264s ago: executing program 2 (id=3261): r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$inet6_udp(0xa, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000c80)={'lo\x00', 0x0}) sendmsg$nl_route_sched(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000003c0)=@newqdisc={0x138, 0x24, 0xd0f, 0x200000, 0x0, {0x60, 0x0, 0x0, r2, {}, {0xffff, 0xffff}, {0x0, 0x10}}, [@qdisc_kind_options=@q_gred={{0x9}, {0x108, 0x2, [@TCA_GRED_STAB={0x104, 0x2, "abcc61b4e508c02286f1bafc7a22c407a52b0e13291c865d493f15736245f220cd4e40006df455836aa3bd3aaa2c9b95578719c46f89e0179832927deecf7465ea95bd97b018b7afaccdcb28bb42d677b73c44e790f0875fb4b795ca95b7dd712d2c5d69945535f92f74a71236749b077cc85e96554beb53c986a216051bd5979a8cfcfe9f98be58ff7944f6cfda8579dbaedceee578bfd1fb554b6e185e9315425ef0a3fc69d17ede93fc7c46357990604b9f12033688caa0b04adecfc926b3f6ca25bcb5432905e3f30ccbf10cf0f2d00858ba2bbd2702b8d4a7a7c744fbaa2fa35b1c586020d600"}]}}]}, 0x138}}, 0x24008004) r3 = openat$6lowpan_control(0xffffffffffffff9c, &(0x7f0000001bc0), 0x2, 0x0) r4 = socket$kcm(0x11, 0x3, 0x0) sendfile(r4, r3, &(0x7f0000000b80)=0x1349cdec, 0x80000001) setsockopt$sock_void(r4, 0x1, 0x24, 0x0, 0x0) 11.635201569s ago: executing program 2 (id=3262): r0 = bpf$PROG_LOAD(0x5, &(0x7f0000000040)={0x2, 0x4, &(0x7f0000000200)=ANY=[@ANYBLOB="180000000300000000000000feffff10850000000700000095"], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x100, 0x0, '\x00', 0x0, @fallback=0x30, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r1 = bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f0000000180)={r0, 0x0, 0x30, 0x0, @val=@uprobe_multi={&(0x7f00000002c0)='./cgroup/cgroup.procs\x00', &(0x7f0000000300)=[0x0], 0x0, 0x0, 0x1}}, 0x40) sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000004c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000010c0)=@newlink={0x3c, 0x10, 0x403, 0xfffffffc, 0x0, {0x0, 0x0, 0x4, 0x0, 0x12000, 0x2000}, [@IFLA_LINKINFO={0x1c, 0x12, 0x0, 0x1, @bond={{0x9}, {0xc, 0x2, 0x0, 0x1, [@IFLA_BOND_MIN_LINKS={0x8, 0x12, 0x1}]}}}]}, 0x3c}, 0x1, 0x0, 0x0, 0x20040011}, 0x40050) bpf$BPF_GET_BTF_INFO(0xf, &(0x7f0000000100)={r1, 0x83, &(0x7f00000010c0)={0x0, 0x0, 0x0, &(0x7f0000000340)=""/194, 0xc2}}, 0x10) r2 = socket$inet6_mptcp(0xa, 0x1, 0x106) setsockopt$SO_TIMESTAMP(r2, 0x1, 0x24, &(0x7f0000000340)=0x7e, 0x4) listen(r2, 0x0) 11.304979132s ago: executing program 2 (id=3264): r0 = socket$inet_sctp(0x2, 0x1, 0x84) (async) r1 = socket$inet_udp(0x2, 0x2, 0x0) getsockopt$inet_opts(r1, 0x0, 0x0, &(0x7f0000000400)=""/204, &(0x7f0000000500)=0xcc) (async) r2 = socket$inet6_sctp(0xa, 0x5, 0x84) getsockopt$inet6_buf(r2, 0x29, 0x3d, &(0x7f0000002600)=""/99, &(0x7f0000002680)=0x63) (async, rerun: 32) r3 = socket$inet6_sctp(0xa, 0x5, 0x84) (rerun: 32) shutdown(r3, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000002c80)={0x3, 0xc, &(0x7f0000000140)=ANY=[@ANYBLOB="1802000000020000000000000900000085000000070000001801000020756c2500000000002020207b1af8ff00000000bfa100000000000007010000feffffffb702000008000000b703000000000000850000001700000095"], &(0x7f0000000040)='syzkaller\x00'}, 0x94) (async, rerun: 64) close(0x3) (async, rerun: 64) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r3, 0x84, 0x6f, &(0x7f0000000200)={0x0, 0x10, &(0x7f00000001c0)=[@in={0x2, 0x4e23, @rand_addr=0x64010100}]}, &(0x7f0000000140)=0x10) getsockopt$inet_sctp6_SCTP_DEFAULT_PRINFO(r2, 0x84, 0x72, &(0x7f0000000080)={r4, 0x6, 0x30}, &(0x7f00000000c0)=0xc) getsockopt$inet_sctp6_SCTP_LOCAL_AUTH_CHUNKS(r2, 0x84, 0x1b, &(0x7f0000000100)={r5, 0x16, "57ad07cded23a1d4db39d1d496f3e427f36996ffd828"}, &(0x7f0000000240)=0x1e) getsockopt$inet_sctp6_SCTP_PRIMARY_ADDR(r3, 0x84, 0x7a, &(0x7f0000000340)={r4, @in6={{0xa, 0x3, 0x4, @mcast1}}}, &(0x7f0000000040)=0x84) setsockopt$inet_sctp_SCTP_ADD_STREAMS(r0, 0x84, 0x79, &(0x7f0000000000)={r6, 0x0, 0x3}, 0x8) 10.876353978s ago: executing program 2 (id=3267): r0 = socket$inet_sctp(0x2, 0x1, 0x84) r1 = socket$inet_sctp(0x2, 0x1, 0x84) setsockopt$sock_int(r1, 0x1, 0xf, &(0x7f0000000600)=0x9, 0x4) listen(r1, 0x7) getsockopt$sock_buf(r1, 0x1, 0x3d, &(0x7f0000000140)=""/198, &(0x7f0000000240)=0xc6) r2 = socket(0x2, 0x80805, 0x0) setsockopt$RXRPC_SECURITY_KEYRING(r2, 0x110, 0x2, &(0x7f00000002c0)='*\x00', 0x2) bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000100)={&(0x7f00000001c0)=ANY=[@ANYBLOB="9feb010026"], &(0x7f0000001f80)=""/212, 0x26, 0xd4, 0x1}, 0x28) sendmmsg$inet(r2, &(0x7f00000008c0)=[{{&(0x7f0000000300)={0x2, 0x4e23, @private=0xa010101}, 0x10, &(0x7f0000001740)=[{&(0x7f0000000200)='\f', 0x1}], 0x1}}, {{&(0x7f0000000540)={0x2, 0x4e22, @private=0xa010101}, 0x10, &(0x7f0000001c80)=[{&(0x7f0000000980)='\x00', 0x1}], 0x1}}], 0x2, 0x4000800) getsockopt$inet_sctp_SCTP_MAX_BURST(r2, 0x84, 0xc, &(0x7f0000000100)=@assoc_value={0x0}, &(0x7f0000000000)=0x8) setsockopt$inet_sctp_SCTP_CONTEXT(r2, 0x84, 0x11, &(0x7f0000000040)={r3, 0x4}, 0x8) getsockopt$inet_sctp_SCTP_DEFAULT_PRINFO(r1, 0x84, 0x72, &(0x7f0000000040)={r3, 0x2, 0x30}, &(0x7f0000000280)=0xc) r4 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r4, &(0x7f0000000080)={0x1f, 0xffff, 0x3}, 0x6) write(r4, &(0x7f0000000000)="0c000000010001", 0x7) connect$inet(r0, &(0x7f0000000000)={0x2, 0x4e20, @dev={0xac, 0x14, 0x14, 0x2f}}, 0x10) r5 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000380), r2) sendmsg$TIPC_NL_PEER_REMOVE(r2, &(0x7f0000000500)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x10}, 0xc, &(0x7f00000004c0)={&(0x7f00000003c0)={0xd4, r5, 0x100, 0x70bd2a, 0x25dfdbfc, {}, [@TIPC_NLA_PUBL={0x24, 0x3, 0x0, 0x1, [@TIPC_NLA_PUBL_TYPE={0x8, 0x1, 0x26ba}, @TIPC_NLA_PUBL_LOWER={0x8, 0x2, 0x6}, @TIPC_NLA_PUBL_TYPE={0x8, 0x1, 0x10}, @TIPC_NLA_PUBL_UPPER={0x8, 0x3, 0x3}]}, @TIPC_NLA_MON={0x14, 0x9, 0x0, 0x1, [@TIPC_NLA_MON_REF={0x8, 0x2, 0x2}, @TIPC_NLA_MON_REF={0x8, 0x2, 0x7}]}, @TIPC_NLA_SOCK={0x84, 0x2, 0x0, 0x1, [@TIPC_NLA_SOCK_ADDR={0x8}, @TIPC_NLA_SOCK_CON={0x1c, 0x3, 0x0, 0x1, [@TIPC_NLA_CON_FLAG={0x8, 0x1, 0x2}, @TIPC_NLA_CON_NODE={0x8, 0x2, 0x8}, @TIPC_NLA_CON_NODE={0x8, 0x2, 0x8}]}, @TIPC_NLA_SOCK_ADDR={0x8, 0x1, 0x46e}, @TIPC_NLA_SOCK_REF={0x8, 0x2, 0x7}, @TIPC_NLA_SOCK_ADDR={0x8, 0x1, 0x8001}, @TIPC_NLA_SOCK_HAS_PUBL={0x4}, @TIPC_NLA_SOCK_CON={0x2c, 0x3, 0x0, 0x1, [@TIPC_NLA_CON_NODE={0x8, 0x2, 0x5}, @TIPC_NLA_CON_FLAG={0x8, 0x1, 0x6}, @TIPC_NLA_CON_NODE={0x8, 0x2, 0xff}, @TIPC_NLA_CON_FLAG={0x8, 0x1, 0x24695f6c}, @TIPC_NLA_CON_NODE={0x8, 0x2, 0x79}]}, @TIPC_NLA_SOCK_ADDR={0x8, 0x1, 0x400}, @TIPC_NLA_SOCK_ADDR={0x8, 0x1, 0x5}, @TIPC_NLA_SOCK_HAS_PUBL={0x4}]}, @TIPC_NLA_NET={0x4}]}, 0xd4}, 0x1, 0x0, 0x0, 0x20044010}, 0x0) r6 = socket$inet_mptcp(0x2, 0x1, 0x106) bind$inet(r6, 0x0, 0x0) getsockopt$inet_mptcp_buf(r6, 0x11c, 0x3, &(0x7f0000000040)=""/185, &(0x7f0000000140)=0xb9) sendto$inet(r1, &(0x7f0000000640)="ab947256ed7ca7f8fd18a2da780ec8efd20a8c1d61b22776ca00947e485499fe982336803d637f9b663e4bcb8cb2c9bc7374b93de3b996fac645525e77b2d7a3c4733ef191f809ff415e2fda862e2654992dff0a5807a94c3c281d79cbe3a003760d238716a721a65179efcc7a1766c2d54b0288fcf9b949f41d0eaade7aff51dc71abb72fdc9c5b7f27adb92073f137447bdf216704069d450891c56afedb67df6e7788cdae650db2645f83c3f202ba3f1ce200"/195, 0xc3, 0x26000854, &(0x7f0000000100)={0x2, 0x4e22, @initdev={0xac, 0x1e, 0x0, 0x0}}, 0x10) 5.421790974s ago: executing program 1 (id=3314): mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x2, 0x21031, 0xffffffffffffffff, 0x21d63000) (async) r0 = socket$nl_rdma(0x10, 0x3, 0x14) sendmsg$RDMA_NLDEV_CMD_GET(r0, &(0x7f0000000680)={0x0, 0x0, &(0x7f0000000600)={&(0x7f0000000100)=ANY=[@ANYBLOB="180000001b14010026bd7000fedb9f2508"], 0x18}, 0x1, 0x0, 0x0, 0x80}, 0x8000) r1 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r1, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000940)=ANY=[@ANYBLOB="3c020000190001000000000000000000fc0200000000000000000000000000000000000000000000000000000000000000000003000000000a00002008000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="00000000000000000100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001d00000000000000000000000000000000000000000000000000000000000000dd020000000000000000000000000000000000020000000084010500ac14143b000000000000000000000000000000002b00000000000000ac14140c000000000000000000000000000000000000ff00000000000000000000000000ffffffff00000000000000000000000010000000320000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffff64010102000000003c00000002000000ac1e01010000000000000000000000000000000001030000000000000000000000000000ff020000000000000000000000000001000000003c00000002000000ac1414aa00000000000000000000000000000000000004000000000003000000000000007f000001000000000000000000000000000000003c00000002"], 0x23c}}, 0x0) r2 = openat$nci(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) (async, rerun: 64) r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) (rerun: 64) r4 = syz_genetlink_get_family_id$nfc(&(0x7f0000000300), r3) ioctl$IOCTL_GET_NCIDEV_IDX(r2, 0x0, &(0x7f00000000c0)) (async, rerun: 32) sendmsg$NFC_CMD_DEV_UP(r3, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000580)=ANY=[@ANYRES32=r3], 0x1c}}, 0x4008054) (async, rerun: 32) write$nci(r2, &(0x7f0000000240)=ANY=[@ANYBLOB="710501030105000606090772bfb2ad96d5b0905869d585d72d0505dbc6d6d5f3a4894ef84797af99eff016e597b3fc9c7ffcd1c645abd1a2a549a2bd3683e97df41fb453cee7e1c9372693d301994c6a942d1bfaf4526b969b302613caee3a2a5fdaa6c677ad8202cd23acad410d8b75f852070ec31e030800"/133], 0x85) (async) r5 = bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000c40)=@bpf_ext={0x1c, 0xf, &(0x7f0000000b40)=ANY=[@ANYBLOB="1800000007000000000000000400000018110000", @ANYRES32, @ANYBLOB="0000000000000000b7050902000014000000b70300000000080085000000d08426d45764b883000000bf0900000000000055090100000000009500000000000000bf91000000000000b7020000000000008500000085000000b700000000000000956700468e38cbfe5cb539505112696993a9c59ca4e68417b17972580b80cd5b5e118cced08850f8eef7c94133ea3eead6c256ed3985b8148ba3eaca1628f5aab4cbc34bca22ae474edd518cbbce07bfa58d6f"], &(0x7f0000000ec0)='GPL\x00', 0x3, 0x0, 0x0, 0x40f00, 0x11, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, &(0x7f0000001040)={0x2, 0x1}, 0x8, 0x10, &(0x7f0000001080)={0x4, 0x0, 0x5, 0x12000}, 0x10, 0x165e2, 0xffffffffffffffff, 0x7, &(0x7f00000011c0)=[0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff], &(0x7f0000001980)=[{0x3, 0x1, 0x5}, {0x3, 0x2, 0xb, 0x8}, {0x1, 0x1, 0x2, 0x7}, {0x0, 0x4, 0x2, 0xd}, {0x3, 0x4, 0x6, 0x1}, {0x3, 0x3, 0x9, 0x8}, {0x1, 0x4, 0x4}], 0x10, 0x1}, 0x94) r6 = bpf$PROG_LOAD(0x5, &(0x7f0000000f80)={0x20, 0x4, &(0x7f0000000540)=ANY=[@ANYRES32, @ANYRESHEX, @ANYRES8=r4, @ANYRESOCT=0x0, @ANYRES8], &(0x7f0000000180)='syzkaller\x00', 0x4004, 0xc3, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @fallback=0x23, 0xffffffffffffffff, 0x8, &(0x7f0000000000)={0x0, 0x1}, 0x8, 0x10, &(0x7f0000000000)={0x0, 0x4}, 0x10, 0x0, r5}, 0x94) r7 = bpf$MAP_CREATE(0x0, &(0x7f0000001100)=ANY=[@ANYBLOB="12000000040000000400000012"], 0x50) r8 = socket$inet6_icmp(0xa, 0x2, 0x3a) r9 = socket$inet_sctp(0x2, 0x5, 0x84) sendmmsg$inet(r9, &(0x7f0000000940)=[{{&(0x7f0000000000)={0x2, 0x4e22, @remote}, 0x10, &(0x7f0000000480)}}, {{&(0x7f00000000c0)={0x2, 0x4e24, @private=0xa010100}, 0x10, &(0x7f00000002c0)=[{&(0x7f0000000dc0)="d2a534b308834d054586feb5c9428624db4b878120e41be144acec28b091f1237c91d74cf1ce0c17632e8dce6ac8c6822c2382fc3ac7c89f2d955bc265df5364df0d56866c920de52e29535b686bb2b4e7e485d65da8513267bc112d12e86bf2a6c815e7e152ecfcde4de24108b1", 0x6e}, {&(0x7f0000001280)="d26f4a894505e4cb435268490fef3ab82e09dc74120d1fe735ac577f50976089bf7b715147d38cf5484e357c07c0184822dfa6ee88a786404855d6086b61189c0602d0056d86a8490a443bfaa3ed6da25bf296a08acb3a3f59b7c9eabd7b51297a4515fdb4eb9c9f6f44c8ce8390cc64160cf457e992e94b36ea829b521e86b15fbe03b246962339a650eab941391339220bde5e16e11123b7ca6b0a3675dd7fe035187b73d43de9423d1357f4b15883d530e7db10b2f0bac6ee95ca0b7e96589c8ef1fc6c183df637a200ac059e59baa215a117a57000ee2b6f40c4ae379d95eab435556aa89edcd0a7453bdf38c1f8fd4b9a04466d2d9517f812a4fbeba1cdcb2429101240e5adcabbfe440e4f326a6f50f59ca934b0c214936df5a338cf4c24e05d0efd8d932a3fd01f6fe596d186e08d2fc77b297f972530a81226294e2fda3d9dec706dbcaa9a1ad5b497d7f8989f6d9e689db0aab831d0b82184e88d6f45924b90744b898912bf3df4e6257723b490e56d93f5f38f4bceb5b43f30da82120d92655f4fc2ec1635a072892a12c462479a4480c46012b9df1f0b9971d0da6c5bfebd60af31c9492d9b3f4da64f7e8a6a760ea96242f9beac499b4e492777c1849ecb0207e1a0b095ac55cf137bd941c13099245069ef52e8a9b0e6c5cab4933962766e47b2ff97c1d0a4f4cc3284a3db70b2eb1fad2ec3b81b2fc65bc354a33caa38c2f6ff1fb9938ae9f0edb9ade42f53b7de7d09ac2ff6de81414917fa0a9ce6515f0f130327f3a0c47c0fcadc315309b06966f945de26b5a445423f22b8474a41f58d12eb8acbf8bdf9087b3b2bb98a802e791f57a86bc325ff6f3fd56b0eb828aea29575fc843902317423459d4e6fbfa3816b70bfbe17bc447d8501e22f0137b56781e8d89a0432bcff4923a5f2b480ee06d502346b0ca8ddeb42afca64179fb1076da91dfe1b19af87df73365ef29f482bea712301f685fcc9f779f9413973c395fee168036c181ede168c8dcd79f5b595f12cd79a1848a7ed9a2c39ffc4e2e0bb73a295a2d263f220d903d79e18c18d4f59d5b6622cdbda6aa9b165d9f3eb26bf5d977100cc722378b4462ad324854974e7bae6a82954f46f83124a73214f23f7baffe3d2f78b87dfa3d29d1f3efdf7cf0f022f96346473b3ad60c6e6885f1b1205d615866cf0837e04371f04e190af232329e39c70f4a89ad5476054c99cc01427ea12a7afd17531daae2661ab625c5e65aa09697adc3a00c04825fa5d6c4d36acaa41de2dfc531504658e12f77d6134ffa61880ad2b5c0b2e236042de25eeabb06f1d0a20a480d684e21c69cdb44f5cbf9e7ad51fa0023cf6240682ee66ead1b5fc3060f5dcaa74ecac0adfafcd68b6254ab01eb8ab49f96128991f33d84477810862780da272bab1fd74d34445a640cd2c82b4ad6cd5c3fb455fd55c787151a17a822ae8341bdbe89d4d69b81c43ba9c1abc4bef75cbc89e278d2a15974f92fdf8687041c5d37a0d469f8de70ce88d82dd505194360b0096ac45a9cea6c3003b2831a538513b3798737fc941c88e31b5334c47d2a774ca3da487ae43ddbd6d8661e26248ba77b30ba719c9c057e0f128f11b8d2ce44b0cb20a7170618c9ea92ef6ec05ddf29b2fabc6d3467b8ad1f683733e9238bdacd953ed0a731f8972113da633d8465adceac30c9e0d0259dbe0301f13bfaceff1d5927b56e5d2bb23b3d8511426829373754292e8564174ba481d395a2f75cfdb0b166434ea9ffde5b55174ab921c061b4da022de1a7ab6736e21ea8db56a7c618b72f64c14eaea2a9ece5cf3b53732a45174a4a45b303ca4f9d79e447aa3e276554fac324c4a211fafd3baf9d2d77c4344bd54bc7f57ed3268daa5e5039d8200000000", 0x540}], 0x2}}], 0x4000000000000ba, 0x40) (async, rerun: 64) getsockopt$inet6_IPV6_IPSEC_POLICY(r8, 0x29, 0x22, &(0x7f0000000040)={{{@in6=@loopback, @in6=@private2}}, {{@in6}, 0x0, @in=@multicast1}}, &(0x7f0000000140)=0xe8) (rerun: 64) r10 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x21c000, 0x0) ioctl$TUNSETQUEUE(r10, 0x400454d9, &(0x7f0000000040)={'ipvlan0\x00'}) bpf$BPF_LINK_CREATE(0x1c, &(0x7f0000001240)={r6, r7, 0x5, 0x0, @val=@kprobe_multi=@syms={0x0, 0x0, 0x0, 0x0, 0x40}}, 0x30) socket$kcm(0x29, 0x7, 0x0) (async) sendmsg$inet(0xffffffffffffffff, &(0x7f0000000880)={&(0x7f0000000340)={0x2, 0x4e22, @dev={0xac, 0x14, 0x14, 0x21}}, 0x10, &(0x7f00000008c0)=[{&(0x7f0000000380)="c9072a819093ef6c5cc9bc044b193500e8045e9c37b8801d576aece58910a2761a30a09ae6d9bdfa29e95de7a23f0ab243fa4ad7ca3a85d72b13d78d00eedfccecb7ce08b6e2bdb5b1d95d3b1cbb27d90af88316f41a32dfe8c0961fdc694daa9a9e3b2695c0a40ad1612971b3f60fd20de18b93e0a46d6ce863afc36513b496e7d153e094f6986822ac9aa4c6b98467f5b408f634d5f1be127685f930d78b5c55dcd1955a9b38be46130cf2c82931842ed6b6cd99dd413837429b5ec62226f0adea2a41c983888c3c9b92df7764359a74e3", 0xc9}, {&(0x7f0000000480)="77354a8537f873507e6a25171b35fb6c0603442f197c217bd7e737e31fec3ce31dadca6f9702ab845a9085bfd9b972ef4f756ea30d263610e89c5ce5d6de4b0b9c9574f0965c179af6dfff24a250a032626b93052bc29bd69b092ef71f8a2255ec65ea443ddb5e9ff52e214414effb6c50f39564567690a8d896d5434dea2f135e03e79df74cf6d1ea65cf10c0c2", 0x8e}, {&(0x7f00000006c0)='Y(', 0x2}, {&(0x7f0000000700)="a3dba582e821741fcb8f9e60076acaf82cba44e079ab098b1a64ac69230991d9daf90bd734379969571bcf4370545611ed3c7a8c35fc3ab0b894e86a2a837fd0d2f30575c1867081cf7142b08cef9af0763000795c163c9b78bb21c0907d7b75f5d88fb462685d578a268905260d925f2aecdf7a6740b48b0038c062584df644e2d39a68dd86b1040c56", 0x8a}, {&(0x7f00000005c0)="3a819f3cb1f668fba4929eb1dc1cc8de9b1469c597e178724922d984e86487201b5bd00e1ab61a25e47d888949f23c041c7fdfa86d53e9c582533f3ca311baf1f3f41b739bd77ca19587b7d32c2cf607c9f977d40163318f098c7c5c793e0e3da55d9c1a198d3defae9c19f01bb0524b7b7a9361c8301621b6b98c848a6cb4094f4a910127dae55709c76d48886df8e47ab28a46fb7ad4d52bb605e0ac9d62898ca3656d08f17b16671baa8449a8"}], 0x4, &(0x7f0000000800)=ANY=[@ANYRES32], 0x78}, 0x4000) (async) socketpair$unix(0x1, 0x2, 0x0, 0x0) (async) r11 = socket$inet6_sctp(0xa, 0x1, 0x84) (async) ioctl$BTRFS_IOC_SET_RECEIVED_SUBVOL(0xffffffffffffffff, 0xc0c89425, 0x0) setsockopt$inet_sctp6_SCTP_EVENTS(r11, 0x84, 0xb, &(0x7f0000000100)={0x2, 0x15, 0xe, 0x20, 0x80, 0x3, 0xd, 0x3, 0x2c, 0x31, 0xa2, 0xa, 0x10, 0x84}, 0xe) (async) r12 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r12, &(0x7f0000000040), 0x6) (async) ioctl$sock_bt_hci(r12, 0x400448e6, &(0x7f0000000500)) 4.956736382s ago: executing program 1 (id=3317): socket$nl_route(0x10, 0x3, 0x0) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000300)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x5}}, [@NFT_MSG_NEWTABLE={0x20, 0x0, 0xa, 0x3, 0x0, 0x0, {0x7}, [@NFTA_TABLE_NAME={0x9, 0x1, 'syz0\x00'}]}, @NFT_MSG_NEWSET={0xa8, 0x9, 0xa, 0x401, 0x0, 0x0, {0x3}, [@NFTA_SET_ID={0x8}, @NFTA_SET_NAME={0x9, 0x2, 'syz2\x00'}, @NFTA_SET_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_SET_KEY_LEN={0x8, 0x5, 0x1, 0x0, 0xd}, @NFTA_SET_EXPRESSIONS={0x64, 0x12, 0x0, 0x1, [{0x2c, 0x1, 0x0, 0x1, @limit={{0xa}, @val={0x1c, 0x2, 0x0, 0x1, [@NFTA_LIMIT_UNIT={0xc, 0x2, 0x1, 0x0, 0x1000}, @NFTA_LIMIT_RATE={0xc, 0x1, 0x1, 0x0, 0x87}]}}}, {0x34, 0x1, 0x0, 0x1, @limit={{0xa}, @val={0x24, 0x2, 0x0, 0x1, [@NFTA_LIMIT_UNIT={0xc, 0x2, 0x1, 0x0, 0xd236}, @NFTA_LIMIT_RATE={0xc, 0x1, 0x1, 0x0, 0x7}, @NFTA_LIMIT_TYPE={0x8, 0x4, 0x1, 0x0, 0x1}]}}}]}, @NFTA_SET_FLAGS={0x8, 0x3, 0x1, 0x0, 0x110}]}], {0x14, 0x10, 0x1, 0x0, 0x0, {0x5, 0x84}}}, 0xf0}, 0x1, 0x0, 0x0, 0x20004010}, 0x20050800) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x5) close(0x4) syz_open_procfs$namespace(0x0, &(0x7f0000000040)='ns/cgroup\x00') mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f07ebbeef, 0x8031, 0xffffffffffffffff, 0x215eb000) r1 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000000)='blkio.bfq.group_wait_time\x00', 0x0, 0x0) r2 = socket$nl_route(0x10, 0x3, 0x0) accept4$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000140)=0x14, 0x800) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFULNL_MSG_CONFIG(r3, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f00000009c0)=ANY=[@ANYBLOB="2400000001040102020000c9fd0000000000000008000340000100000500010001"], 0x24}, 0x1, 0x0, 0x0, 0x4000000}, 0x200000c0) sendmsg$NFULNL_MSG_CONFIG(r3, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000180)={0x1c, 0x1, 0x4, 0x301, 0x0, 0x0, {0xa}, [@NFULA_CFG_FLAGS={0x6}]}, 0x1c}, 0x1, 0x0, 0x0, 0xc010}, 0x22000004) sendmsg$nl_route(r2, &(0x7f0000000300)={0x0, 0xfffffdc5, &(0x7f00000007c0)={&(0x7f0000000380)=ANY=[@ANYBLOB="340000001a00010028bd700089dbdf250a808000000000200100100006001c004e24000005001b0006000000080019"], 0x34}}, 0x20000050) socket(0x14, 0x2, 0x4) r4 = socket$inet6_sctp(0xa, 0x801, 0x84) sendmmsg$inet6(r4, &(0x7f0000001ac0)=[{{&(0x7f0000000440)={0xa, 0x4e20, 0x4, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, 0x7}, 0x1c, &(0x7f00000015c0)=[{&(0x7f0000000080)="ce46cdd53247b585490ce9ce527efcc98f668aae0812a8ebac93f9564bb4a9d0972783845d8483f02b7d51585fa484d4be167caa10ec25ffcd32d7c30fa234a8e6441b01", 0x44}], 0x1}}], 0x1, 0x20008000) setsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER_VALUE(r4, 0x84, 0x7c, 0x0, 0x0) socket$nl_route(0x10, 0x3, 0x0) (async) socket$nl_netfilter(0x10, 0x3, 0xc) (async) sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000300)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x5}}, [@NFT_MSG_NEWTABLE={0x20, 0x0, 0xa, 0x3, 0x0, 0x0, {0x7}, [@NFTA_TABLE_NAME={0x9, 0x1, 'syz0\x00'}]}, @NFT_MSG_NEWSET={0xa8, 0x9, 0xa, 0x401, 0x0, 0x0, {0x3}, [@NFTA_SET_ID={0x8}, @NFTA_SET_NAME={0x9, 0x2, 'syz2\x00'}, @NFTA_SET_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_SET_KEY_LEN={0x8, 0x5, 0x1, 0x0, 0xd}, @NFTA_SET_EXPRESSIONS={0x64, 0x12, 0x0, 0x1, [{0x2c, 0x1, 0x0, 0x1, @limit={{0xa}, @val={0x1c, 0x2, 0x0, 0x1, [@NFTA_LIMIT_UNIT={0xc, 0x2, 0x1, 0x0, 0x1000}, @NFTA_LIMIT_RATE={0xc, 0x1, 0x1, 0x0, 0x87}]}}}, {0x34, 0x1, 0x0, 0x1, @limit={{0xa}, @val={0x24, 0x2, 0x0, 0x1, [@NFTA_LIMIT_UNIT={0xc, 0x2, 0x1, 0x0, 0xd236}, @NFTA_LIMIT_RATE={0xc, 0x1, 0x1, 0x0, 0x7}, @NFTA_LIMIT_TYPE={0x8, 0x4, 0x1, 0x0, 0x1}]}}}]}, @NFTA_SET_FLAGS={0x8, 0x3, 0x1, 0x0, 0x110}]}], {0x14, 0x10, 0x1, 0x0, 0x0, {0x5, 0x84}}}, 0xf0}, 0x1, 0x0, 0x0, 0x20004010}, 0x20050800) (async) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x5) (async) close(0x4) (async) syz_open_procfs$namespace(0x0, &(0x7f0000000040)='ns/cgroup\x00') (async) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f07ebbeef, 0x8031, 0xffffffffffffffff, 0x215eb000) (async) openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000000)='blkio.bfq.group_wait_time\x00', 0x0, 0x0) (async) socket$nl_route(0x10, 0x3, 0x0) (async) accept4$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000140)=0x14, 0x800) (async) socket$nl_netfilter(0x10, 0x3, 0xc) (async) sendmsg$NFULNL_MSG_CONFIG(r3, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f00000009c0)=ANY=[@ANYBLOB="2400000001040102020000c9fd0000000000000008000340000100000500010001"], 0x24}, 0x1, 0x0, 0x0, 0x4000000}, 0x200000c0) (async) sendmsg$NFULNL_MSG_CONFIG(r3, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000180)={0x1c, 0x1, 0x4, 0x301, 0x0, 0x0, {0xa}, [@NFULA_CFG_FLAGS={0x6}]}, 0x1c}, 0x1, 0x0, 0x0, 0xc010}, 0x22000004) (async) sendmsg$nl_route(r2, &(0x7f0000000300)={0x0, 0xfffffdc5, &(0x7f00000007c0)={&(0x7f0000000380)=ANY=[@ANYBLOB="340000001a00010028bd700089dbdf250a808000000000200100100006001c004e24000005001b0006000000080019"], 0x34}}, 0x20000050) (async) socket(0x14, 0x2, 0x4) (async) socket$inet6_sctp(0xa, 0x801, 0x84) (async) sendmmsg$inet6(r4, &(0x7f0000001ac0)=[{{&(0x7f0000000440)={0xa, 0x4e20, 0x4, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, 0x7}, 0x1c, &(0x7f00000015c0)=[{&(0x7f0000000080)="ce46cdd53247b585490ce9ce527efcc98f668aae0812a8ebac93f9564bb4a9d0972783845d8483f02b7d51585fa484d4be167caa10ec25ffcd32d7c30fa234a8e6441b01", 0x44}], 0x1}}], 0x1, 0x20008000) (async) setsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER_VALUE(r4, 0x84, 0x7c, 0x0, 0x0) (async) 3.985678178s ago: executing program 1 (id=3322): r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000000), 0x40082, 0x0) ioctl$PPPIOCNEWUNIT(r1, 0xc004743e, &(0x7f0000000140)) ioctl$PPPIOCSFLAGS1(r1, 0x40047459, &(0x7f00000000c0)=0x41) pwritev(r1, &(0x7f0000000040)=[{&(0x7f0000000180)="80fd02000040", 0x42}], 0x1, 0x0, 0x0) r2 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000000), 0xc0802, 0x0) pwritev(r2, &(0x7f0000000540)=[{&(0x7f00000003c0)='\x00!G', 0x3}], 0x14, 0x0, 0x0) sendmsg$nl_route(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000012c0)=ANY=[@ANYBLOB="3c0000001000110f26bd7000feffffff00000000", @ANYRES32=0x0, @ANYBLOB="c40e0000000000dd448aa2001c0012800900010062d1142fec1e536f6e6400"/42], 0x3c}, 0x1, 0x0, 0x0, 0x44001}, 0x0) r3 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route(r3, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000002c0)=ANY=[@ANYBLOB="38000000120005ff00000000000000000000004a", @ANYRES32=0x0, @ANYBLOB="0000000000000000180012800e00080077617265677561726400000004"], 0x38}}, 0x0) r4 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$TUNSETIFF(r4, 0x400454ca, &(0x7f0000000140)={'pim6reg1\x00', 0x2}) read(r3, &(0x7f0000000140)=""/166, 0xa6) ioctl$INCFS_IOC_GET_FILLED_BLOCKS(r0, 0x80286722, &(0x7f0000001280)={&(0x7f0000000280)=""/4096, 0x1000, 0x1000, 0x5}) 3.656220063s ago: executing program 4 (id=3324): socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000fc0)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000001080)=ANY=[@ANYBLOB="0200000004000000080000000100000080000000", @ANYRES32=r0, @ANYRES8=0x0, @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB='\x00'/28], 0x50) bpf$MAP_UPDATE_CONST_STR(0x2, &(0x7f00000002c0)={{r2, 0xffffffffffffffff}, &(0x7f0000000200), &(0x7f00000003c0)='%ps \x00'}, 0x20) bpf$BPF_MAP_CONST_STR_FREEZE(0x16, &(0x7f0000000080), 0xfffffffffffffec5) r4 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000380)={0x1f, 0x25, &(0x7f0000000840)=ANY=[@ANYBLOB="18000000feffffff0000000000000000b7080000000000007b8af8ff00000000b7080000010000807b8af0ff00000000bfa100000000000007010000f8ffffffbfa400000000000007040000f0ffffffb70200000800000018230000", @ANYRES32=r3, @ANYBLOB="0000000000000000b70500000800000085000000a5000000180100002020642500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b70300000000000085000000b0000000b7080000000000007b8af8ff00000000b7080000050000007b8af0ff00000000bfa100000000000007010000f8ffffffbfa400000000000007040000f0ffffffb70200000800000018230000", @ANYRES32=r3, @ANYBLOB="0000000000000000b70500000800000085000000a500000095"], &(0x7f0000000180)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x11, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x2}, 0x94) bpf$PROG_BIND_MAP(0xa, &(0x7f00000004c0)={r4}, 0xc) sendmsg$inet(r0, &(0x7f0000001580)={0x0, 0x60, &(0x7f0000001400), 0x0, &(0x7f0000001000)=[@ip_tos_int={{0x14, 0x0, 0x1, 0xffffefff}}], 0x18}, 0x80) r5 = socket$vsock_stream(0x28, 0x1, 0x0) bind$vsock_stream(r5, &(0x7f0000000440), 0x10) listen(r5, 0xfffffffe) r6 = socket$vsock_stream(0x28, 0x1, 0x0) connect$vsock_stream(r6, &(0x7f0000000100)={0x28, 0x0, 0x0, @local}, 0x10) writev(r6, &(0x7f0000000800)=[{&(0x7f0000000840)="1db6ed74c7", 0x5}], 0x1) r7 = accept4$unix(r5, 0x0, 0x0, 0x0) recvmmsg(r7, &(0x7f0000001680)=[{{0x0, 0x0, &(0x7f0000001100)=[{&(0x7f0000000140)=""/120, 0x78}, {&(0x7f0000003300)=""/107, 0x6b}, {&(0x7f00000010c0)=""/40, 0x28}], 0x3}}], 0x1, 0x2, 0x0) r8 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='memory.events\x00', 0x275a, 0x0) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x300000c, 0x12, r8, 0x0) recvfrom$unix(r0, &(0x7f00000001c0)=""/227, 0xe3, 0x40010120, 0x0, 0x0) recvmsg$unix(r1, &(0x7f0000001140)={0x0, 0x0, &(0x7f0000001040)=[{&(0x7f00000015c0)=""/4096, 0x7ffff000}], 0x1, 0x0, 0x2}, 0x40000300) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x4000010, 0xffffffffffffffff, 0xfffff000) syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) socket(0xa, 0xa, 0x3a) socket$nl_generic(0x10, 0x3, 0x10) r9 = socket$inet6_tcp(0xa, 0x1, 0x0) listen(r9, 0x204) r10 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_tx_ring(r10, 0x107, 0xd, &(0x7f0000000000)=@req={0x3, 0x8, 0x1, 0x1}, 0x10) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000fc0)) unshare(0xa020480) pselect6(0x40, &(0x7f0000000100)={0x1ff, 0x0, 0x0, 0x0, 0x800, 0x4, 0x8000100ffffe}, 0x0, 0x0, 0x0, 0x0) 3.160993907s ago: executing program 3 (id=3326): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0x4002}) writev(r0, &(0x7f00000002c0)=[{&(0x7f0000000040)="0500ff", 0x3}, {&(0x7f00000000c0)="2e1f05dec7", 0x56}, {&(0x7f0000000100)="e688dbe2", 0x4}], 0x3) (async) r1 = socket$xdp(0x2c, 0x3, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) (async) pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r6 = socket$packet(0x11, 0x3, 0x300) (async) r7 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='memory.events\x00', 0x275a, 0x0) write$cgroup_subtree(r7, &(0x7f0000000080)=ANY=[], 0x10448) (async) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x2000001, 0x13, r4, 0x4997f000) (async) setsockopt$packet_drop_memb(r6, 0x107, 0x2, &(0x7f0000000180)={0x0, 0x1, 0x6, @remote}, 0x10) splice(r3, 0x0, r5, 0x0, 0xf3a, 0x0) (async) close(r4) ioctl$OCFS2_IOC_UNRESVSP(r1, 0x40305829, &(0x7f0000000380)={0x0, 0x0, 0x9, 0x0, 0x2, 0xffffffcc}) (async) write(r2, 0x0, 0x0) (async) mmap(&(0x7f00009fd000/0x600000)=nil, 0x600000, 0x100000d, 0x6031, 0xffffffffffffffff, 0x0) (async) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x2, 0x31, 0xffffffffffffffff, 0x0) r8 = socket$inet6_tcp(0xa, 0x1, 0x0) getsockopt$inet6_tcp_buf(r8, 0x6, 0x1c, 0x0, &(0x7f0000000300)) (async) bpf$BPF_PROG_DETACH(0x8, &(0x7f0000000640)=ANY=[@ANYRES32, @ANYRES32, @ANYBLOB='&\x00\x00\x00\x00', @ANYRES32], 0x20) (async) socket$nl_netfilter(0x10, 0x3, 0xc) r9 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000580)={0x2, 0x4, 0x8, 0x1, 0x80, 0x1, 0x4, '\x00', 0x0, 0xffffffffffffffff, 0x1, 0xffffffff, 0x5}, 0x50) (async) r10 = socket$kcm(0x11, 0x3, 0x0) (async) r11 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r11, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r11, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000500)=@getchain={0x0, 0x66, 0x20, 0x70bd29, 0x25dfdbfc, {0x0, 0x0, 0x0, r12, {0x5, 0xfffc}, {0xc, 0xfff6}, {0xe, 0xe}}, [{0x0, 0xb, 0x2}, {0x0, 0xb, 0x8}, {0x0, 0xb, 0x1ff}, {0x0, 0xb, 0x1}, {0x0, 0xb, 0x9}, {0x0, 0xb, 0xffff3e2d}]}, 0x4a}, 0x1, 0x0, 0x0, 0x40088c1}, 0x0) sendmsg$nl_route_sched(r11, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000600)=@getchain={0x4c, 0x66, 0x2, 0x70bd2c, 0x25dfdbfd, {0x0, 0x0, 0x0, r12, {0xfff1, 0x3}, {0xf, 0xfff3}, {0xd, 0x6}}, [{0x8, 0xb, 0x9}, {0x8, 0xb, 0x3}, {0x8, 0xb, 0x7fff}, {0x8, 0xb, 0x7ff}, {0x8, 0xb, 0xffffffff}]}, 0x4c}, 0x1, 0x0, 0x0, 0x240040a1}, 0x4890) (async) sendmsg$kcm(r10, &(0x7f0000000140)={&(0x7f0000000440)=@ll={0x11, 0x17, r12, 0x1, 0xc, 0x6, @multicast}, 0x80, &(0x7f0000002080)=[{&(0x7f00000004c0)="006aba88bb", 0x5}], 0x1}, 0x0) (async, rerun: 64) bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f0000000240)=ANY=[@ANYBLOB="1b00000000000000000000000000804700000000", @ANYRES32=r9, @ANYBLOB="cb4c000000000000009300000000000002ef0000abb12d84e2d2f5df58222eca", @ANYRES32=r12, @ANYRES32, @ANYBLOB="0200"/28], 0x50) (async, rerun: 64) bind$netlink(0xffffffffffffffff, &(0x7f0000514ff4)={0x10, 0x0, 0x0, 0x2ffffffff}, 0xc) 3.000337018s ago: executing program 1 (id=3327): r0 = socket$alg(0x26, 0x5, 0x0) r1 = socket$inet(0x10, 0x3, 0x0) ioctl$sock_SIOCETHTOOL(r1, 0x8946, &(0x7f0000000540)={'bond0\x00', &(0x7f0000000040)=@ethtool_sfeatures={0x3b, 0x2, [{0x301}, {0xfffffffd, 0x80000}]}}) bind$alg(r0, &(0x7f00000004c0)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb-twofish-avx\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000000280)="ad56b6c5820fae9d6dcd3292ea54c7beef915d564c90c200", 0x18) r2 = accept4(r0, 0x0, 0x0, 0x0) sendmmsg$alg(r2, &(0x7f0000000040)=[{0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)="f78d9ca38fff48f3be52163448412ba8", 0xfffffe3f}, {&(0x7f0000000140)="ebe3a0e9796cfd1647e299f4e376fdba128280b372219d205e81f4a7f71c1926aae1efd7e0054a863f3d5cfe6cb55b5bb9fa6935849e6098ed884e7cb51726b360fbb37b4fe035bbb095873048"}, {&(0x7f00000003c0)="e8700e444d50a969ff67347cff6127e6ef12ee3819271482a4975a52c1ab9b8b4db3945d1032005eabe97b45c33a47d3a158da980000000000000bea6f53cdcdb93a4722bf306a10470d50f5cb1ece9ead3459bab1cf1538cd0b157653c5e892962c80f158c443e9c6ad7d2a8103ef2f4b93766b9a21501f94c1568b13756b66f74f46cf801704d2da8b96c34070b233af0afcc436712e58ed25e721193af05a045ad3fdc928f02f3dbad19d3e66eebda2e63f3f46ef4511cee26d7b48241847bf9e343ef4674c45e2a085060f11"}], 0x1, &(0x7f00000002c0)=[@assoc={0x0, 0x117, 0x4, 0x5e}], 0xa}], 0x1, 0x4008880) recvmsg$can_raw(r2, &(0x7f0000001880)={0x0, 0x0, &(0x7f0000001800)=[{&(0x7f0000000600)=""/70, 0x46}, {0x0}], 0x2}, 0x0) r3 = socket$inet_tcp(0x2, 0x1, 0x0) r4 = bpf$MAP_CREATE(0x0, &(0x7f0000000700)=ANY=[@ANYBLOB="0f000000040000000400000012"], 0x50) listen(r3, 0x0) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000100)={r4, &(0x7f0000000340), &(0x7f0000000040)=@tcp=r3}, 0x20) ioctl$ifreq_SIOCGIFINDEX_wireguard(r3, 0x8933, &(0x7f0000000080)={'wg2\x00'}) recvmsg(r2, &(0x7f00000005c0)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f00000000c0)=""/81, 0x7ffff000}, {&(0x7f0000000200)=""/83, 0x20000253}], 0x2}, 0xf0ff) 2.9043067s ago: executing program 3 (id=3329): sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000240)=@newtaction={0x70, 0x30, 0x53b, 0xfffffffb, 0x0, {0x9}, [{0x5c, 0x1, [@m_sample={0x58, 0x1, 0x0, 0x0, {{0xb}, {0x2c, 0x2, 0x0, 0x1, [@TCA_SAMPLE_PSAMPLE_GROUP={0x8, 0x5, 0xe4}, @TCA_SAMPLE_RATE={0x8, 0x3, 0x526}, @TCA_SAMPLE_PARMS={0x18, 0x2, {0x300, 0x0, 0x4, 0x80000}}]}, {0x4}, {0xc}, {0xc, 0x4}}}]}]}, 0x70}, 0x1, 0x0, 0x0, 0x2400c080}, 0x4001) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='memory.events\x00', 0x275a, 0x0) write$cgroup_subtree(r0, &(0x7f0000000100)=ANY=[], 0x32600) mmap(&(0x7f0000001000/0x4000)=nil, 0x4000, 0x2000001, 0x12, r0, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000480)={0x3, 0x4, &(0x7f00000001c0)=@framed={{0x18, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x8}, [@generic={0x91, 0x1, 0x1, 0x7c}]}, &(0x7f0000000c40)='GPL\x00', 0x0, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, @fallback=0x1b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffb}, 0x94) r1 = socket(0x2d, 0x2, 0x0) bind$xdp(r1, &(0x7f0000000080)={0x2d, 0x0, 0x0, 0xc}, 0x10) r2 = socket(0x10, 0x803, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000400)={'veth0_to_hsr\x00', 0x0}) r4 = socket(0x2d, 0x2, 0x0) bind$xdp(r4, &(0x7f0000000080)={0x2d, 0x0, r3, 0xc}, 0x10) r5 = socket(0x2d, 0x2, 0x0) bind$xdp(r5, &(0x7f0000000080)={0x2d, 0x0, 0x0, 0xc}, 0x10) r6 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f0000000380)={0x3, 0x4, 0x4, 0xa, 0x0, 0xffffffffffffffff, 0x0, '\x00', 0x0, 0xffffffffffffffff, 0xfffffffe, 0x2, 0x5}, 0x50) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000002c0)={0x1, 0xe, &(0x7f0000000180)=ANY=[@ANYBLOB="18230000", @ANYRES32=r6, @ANYBLOB="00900000", @ANYRES32=r6, @ANYBLOB="0000000000000000b70200000000000085000000860000001801000020756c2500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b7030000100000008500000006000000"], &(0x7f0000000000)='GPL\x00'}, 0x94) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000640)={0x1e, 0x4, &(0x7f0000000040)=ANY=[@ANYBLOB="18000000000000000000000000000000611934000000000095"], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x24}, 0x94) bpf$ITER_CREATE(0x21, &(0x7f0000000040)={r0}, 0x8) 2.728428806s ago: executing program 4 (id=3330): bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32, @ANYBLOB="0000000000000000b70800000d0000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000740)=ANY=[@ANYBLOB="0b00000005000000000400000900000001"], 0x48) (async) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0xa, 0x4, &(0x7f0000000480)=ANY=[@ANYBLOB="18000000000000000000000000000000850000006d"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) (async) r1 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000d80)={0x18, 0x5, &(0x7f0000000480)=ANY=[@ANYBLOB="1801000021"], 0x0, 0x40, 0x0, 0x0, 0x0, 0xb4a02fe0ce239f93, '\x00', 0x0, 0x2}, 0x94) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0xe, 0x0, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000800000000000000000000018110000", @ANYRES32=r0], 0x0, 0x0, 0x0, 0x0, 0x41100, 0x59, '\x00', 0x0, @fallback=0x2a, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, r1, 0x0, 0x0, 0x0, 0x0}, 0x94) (async, rerun: 64) bpf$PROG_LOAD(0x5, &(0x7f0000000300)={0x6, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback=0x4, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x68}, 0x94) (async, rerun: 64) r2 = socket$alg(0x26, 0x5, 0x0) bind$alg(r2, &(0x7f0000010400)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc-cast6-avx\x00'}, 0x58) (async) r3 = socket$nl_generic(0x10, 0x3, 0x10) (async) r4 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000000), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r3, 0x8933, &(0x7f00000001c0)={'wlan0\x00'}) (async, rerun: 64) sendmsg$NL80211_CMD_GET_SCAN(r3, &(0x7f0000000f00)={0x0, 0x0, &(0x7f0000000ec0)={&(0x7f0000000380)={0x14, r4, 0xf21, 0x0, 0x0, {{}, {@void, @void}}}, 0x14}, 0x1, 0x0, 0x0, 0x20000015}, 0x44000) (async, rerun: 64) syz_emit_ethernet(0x131, &(0x7f00000001c0)={@broadcast, @random, @void, {@ipv4={0x800, @igmp={{0x30, 0x4, 0x2, 0x6, 0x123, 0x67, 0x0, 0x6, 0x2, 0x0, @rand_addr=0x64010101, @private=0xa010100, {[@rr={0x7, 0x23, 0x53, [@multicast2, @multicast2, @rand_addr=0x64010101, @loopback, @dev={0xac, 0x14, 0x14, 0x44}, @loopback, @local, @initdev={0xac, 0x1e, 0x1, 0x0}]}, @noop, @rr={0x7, 0x1f, 0x4b, [@remote, @multicast2, @multicast1, @loopback, @multicast1, @private=0xa010102, @loopback]}, @cipso={0x86, 0x23, 0x0, [{0x0, 0x11, "25283c79d61ce8efe42e1611674cb4"}, {0x2, 0x2}, {0x1, 0xa, "323d863198759377"}]}, @ra={0x94, 0x4, 0x1}, @timestamp_prespec={0x44, 0xc, 0xd0, 0x3, 0x0, [{@remote, 0x4}]}, @cipso={0x86, 0x31, 0xffffffffffffffff, [{0x1, 0xd, "498a939fc63b8192da2189"}, {0x7, 0x8, "3b3e64792de6"}, {0x1, 0xb, "5c1b899dad26a82a96"}, {0x6, 0xb, "016c36a48c658f5b9b"}]}, @noop, @end, @generic={0x83, 0x2}]}}, {0x11, 0x5, 0x0, @rand_addr=0x64010100, "d78936f8dada21329797edfd44edb65b3fbecdb74420c5b00967707233fe25a5cfc2b110280788fdcbcf29bd816f946d182b9ddc0b0f4878391b67442d5040a2d13278350744a24c4ad235a6c789a3fdd4a804fb1ffef62b12a9b4"}}}}}, 0x0) (async, rerun: 32) r5 = socket$nl_netfilter(0x10, 0x3, 0xc) (async, rerun: 32) r6 = socket$nl_netfilter(0x10, 0x3, 0xc) (async) r7 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) ioctl$TUNSETIFF(r7, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) (async) write$tun(r7, &(0x7f0000000600)={@val={0x0, 0x6006}, @val={0x1, 0x5, 0x7, 0x3, 0x80, 0x6}, @mpls={[], @ipv6=@udp={0x7, 0x6, "b21358", 0x61, 0x11, 0xff, @rand_addr=' \x01\x00', @empty, {[@dstopts={0x89, 0x2, '\x00', [@hao={0xc9, 0x10, @loopback}]}], {0x4e24, 0x4e21, 0x41, 0x0, @opaque="5c012022f78f2747cd6ec1de9cea4b333be8cab2b2498696d5032ffbddb186c9328e061359aa17cb64066f5893cc6e2a2b2cbc158f3cf666fd"}}}}}, 0x97) (async) sendmsg$IPCTNL_MSG_CT_NEW(r6, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000100)=ANY=[@ANYBLOB="640000000001010400000000141a000002000000240001801400018008000100e000000108000200e00000010c00028005000100000000002400028014000180080001000000000008000200ac1e00010c00028005000100000000000800074000000001"], 0x64}}, 0x0) (async) r8 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_NEW(r8, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000001300)=ANY=[@ANYBLOB="38010000000101040000000000000000020000002c0001801400018008000100ac14143208000200ac1414000c00028005000100000000000600034000020000240002801400018008000100e000000108000200e00000010c00028005000100000000000800074000000000cc0006"], 0x138}}, 0x4) (async) sendmsg$NFT_BATCH(r5, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000000c0)=ANY=[@ANYBLOB="140000001000010600000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff1b000000020000000900010073797a30000001000900030073797a320000000014000000110001"], 0x7c}}, 0x0) (async) r9 = bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0xc, 0xe, &(0x7f0000000a80)=ANY=[@ANYBLOB="b702000003000000bfa30000000000000703000000feffff7a0af0fff8ffffff79a4f0ff00000000b7060000ffffffff2d640500000000006504040001001f000404000001007d60b7030000000000006a0a00fe00000100850000000d000000b7000000000000009500000000000000c74396c8e3ebbadc20e5a7ef8c9ac1465cbf188ef10871b81ac7553358380b3a1f59916ffc9bf0bdf81524f07fb2819bf5774fedda52e39c90af27db5b56024df96b4673b4e8d5467e114604ea09b290a248a120c9c6cd87cef9000000a39c15a7ef365cc27dfeac7b9b0e9048517354b0ca4f9cf8b59ee6fa003fe1f2c4c15f20a07db4583a462d8be6602186fd68ee14a19ea2eb42122b8635a66ce6b5b92356081bc0f18a0ca83dbc089a9813c1efa26001b3f486ebfaae85c4d0b96778478ae5355e6f923b11056969f486f80a35f7f2339704fa93fa915ab8e1e0d7f31ebd19455e6827cd493907bf9d0000000000000000000000004e1fa60acabcf0553910ca2e5ea499fd5889dde9261f0848a5b8af657bfc96049308e8953431b269053627a1523551c160c813969925a892d266792352ec0204596a37ce8d6d260b32239bddbce2e79f93cb5a0ad897adb53b397d07c50f84b74f2605a565ee149016aa75ea31c0087dcd821b47c8b36efc6da4fb2ea7f1f36c85856b73ac9872babc62149699b6b8c796a79d833eb4b5ca668d430db5653a2b3c5b87e17ca1"], &(0x7f0000000340)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x1e, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x8, 0x10, &(0x7f0000000000)={0x0, 0x100000}, 0x10}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000080)={r9, 0x18000000000002a0, 0x2f9, 0xffffca88, &(0x7f0000000040)="b90103600040f000009e0ff008001fffffe100004000632f77fb7f0200017f020001be3e7d2a182fff", 0x0, 0x104, 0x6000000000000000, 0x0, 0xfeb9, &(0x7f0000000400)="9209558f0c5fb25cd57f98113135c3171b8b331fbc04f0e6955a796ff8e3aae3cac46cec3030dfc999058aea01f0e6dcf2f9d480d328655aca003927bd50ed49d4843c8a0a2a4b26ceb747947200bd644c85e7a8a7d7cfce840c02a7d69c9e0bca410f64d43290abbbf3131e1fa8bd8c3e5f19d5a491d3d4c1a0fe47de9eebaf073ac3da6256bdb681d18fbd607c9b0d710442bcf78bc36fd3c035812bde582a262bff0e4d6181c818fccf542868c6e602d97bea23a101955dc76bcc984142ab305387aa348566d688edd291a3e9d08952adbdf60462bb7f7faebcdfccf17115708b0d73d0f3a469ce7d8374219b3f92c92bcec4958d474bb281c26691949d054b784a5866f081e53eb9cfd7"}, 0x28) (async) r10 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$sock_inet_SIOCSIFFLAGS(r10, 0x8924, &(0x7f00000000c0)={'wlan0\x00', 0x1}) (async) r11 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r11, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000000c0)=ANY=[@ANYBLOB="6c000000020605000000000000000000000000070e0003006269746d61703a697000000005000400010000000900020073797a3000000000240007800c00028008005e00000000020c0001800800014000000004080008400000005c05000500020000000500010006"], 0x6c}, 0x1, 0x0, 0x0, 0x4000000}, 0x8000) (async, rerun: 64) setsockopt$ALG_SET_KEY(r2, 0x117, 0x1, &(0x7f0000c18000)="ad56b6c5820fae9d6dcd3292ea54c7beef915d564c90c200", 0x18) (rerun: 64) accept4(r2, 0x0, 0x0, 0x80800) 2.704223564s ago: executing program 3 (id=3331): r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x3, 0x0) bind$bt_l2cap(r0, &(0x7f0000000000)={0x1f, 0xe4, @fixed, 0x0, 0x1}, 0xe) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f00000000c0), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000003540)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_FRAME(r2, &(0x7f0000003740)={0x0, 0x0, &(0x7f0000003700)={&(0x7f0000000000)=ANY=[@ANYBLOB='L\x00\x00\x00', @ANYRES16=r3, @ANYBLOB="01002abd7000fbdbdf253b00000008000300", @ANYRES32=r4, @ANYBLOB="30003300c0100e00ffff07ffffff08021100"], 0xfeac}, 0x1, 0x0, 0x0, 0x20040085}, 0x28004800) r5 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000000), 0xffffffffffffffff) sendmsg$ETHTOOL_MSG_LINKMODES_SET(r1, &(0x7f0000000240)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000580)={0x34, r5, 0x4b24f17eae29800b, 0x0, 0x2, {}, [@ETHTOOL_A_LINKMODES_AUTONEG={0x5}, @ETHTOOL_A_LINKMODES_HEADER={0x18, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'syz_tun\x00'}]}]}, 0x34}}, 0x8020) bpf$MAP_CREATE(0x0, 0x0, 0x0) socket$inet6_sctp(0xa, 0x1, 0x84) r6 = socket(0x2, 0x80805, 0x0) sendmmsg$inet(r6, &(0x7f00000008c0)=[{{&(0x7f0000000300)={0x2, 0x4e23, @private=0xa010102}, 0x10, &(0x7f0000001740)=[{&(0x7f0000000200)='\f', 0x1}], 0x1}}], 0x1, 0x4000800) getsockopt$inet_sctp_SCTP_MAX_BURST(r6, 0x84, 0xc, &(0x7f0000000240)=@assoc_value={0x0}, &(0x7f0000000280)=0x8) setsockopt$inet_sctp_SCTP_DELAYED_SACK(r6, 0x84, 0x10, &(0x7f00000000c0)=@sack_info={r7, 0x4, 0x8}, 0xc) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0xf, &(0x7f0000000180)=0x80000004, 0x4) connect$inet6(0xffffffffffffffff, &(0x7f0000000080)={0xa, 0x4e24, 0xcb42, @dev={0xfe, 0x80, '\x00', 0x14}, 0xbf}, 0x1c) setsockopt$SO_ATTACH_FILTER(0xffffffffffffffff, 0x1, 0x33, &(0x7f0000000000)={0x1, &(0x7f0000000140)=[{0x6}]}, 0x10) r8 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r8, &(0x7f00000018c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000001c0)=@bridge_delneigh={0x24, 0x1e, 0x1, 0x0, 0x0, {0x7, 0x0, 0x0, 0x0, 0x0, 0x2}, [@NDA_VNI={0x8, 0x7, 0x4}]}, 0x24}}, 0x0) r9 = socket$l2tp6(0xa, 0x2, 0x73) sendmsg$inet6(r9, &(0x7f0000000040)={&(0x7f0000000000)={0xa, 0xfffe, 0x0, @dev={0xfe, 0x80, '\x00', 0xe}, 0x805}, 0x1c, 0x0, 0x0, &(0x7f0000000340)=ANY=[@ANYBLOB="280000000000000029000000390000008402020100edff00ff02000000000000000000000000310118000000000000002900000037"], 0x40}, 0x24004800) 2.685834209s ago: executing program 0 (id=3332): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000340)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x0) sendmsg$NFT_BATCH(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f00000003c0)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x3}}, [@NFT_MSG_NEWRULE={0x44, 0x6, 0xa, 0x401, 0x0, 0x0, {0xa, 0x0, 0x4}, [@NFTA_RULE_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_RULE_CHAIN={0x9, 0x2, 'syz2\x00'}, @NFTA_RULE_EXPRESSIONS={0x18, 0x4, 0x0, 0x1, [{0x14, 0x1, 0x0, 0x1, @counter={{0xc}, @val={0x4}}}]}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x1}}}, 0x6c}, 0x1, 0x0, 0xf5ffffff, 0x4000850}, 0x24044010) 2.556833703s ago: executing program 4 (id=3333): r0 = openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) preadv(r0, &(0x7f00000007c0)=[{0x0}, {&(0x7f00000001c0)=""/21, 0x15}, {&(0x7f0000000240)=""/110, 0x6e}, {&(0x7f00000002c0)=""/31, 0x1f}, {&(0x7f00000005c0)=""/108, 0x6c}], 0x5, 0x0, 0x0) r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f0000000340)={0x26, 'aead\x00', 0x0, 0x0, 'aegis128\x00'}, 0x58) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000340)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$sock_SIOCETHTOOL(r2, 0x8946, &(0x7f0000000040)={'ip6tnl0\x00', &(0x7f0000000080)=@ethtool_perm_addr={0x4b, 0x16, "5c83276f6c0200000000aae21f084c884bdd3d51a62a"}}) bind$alg(0xffffffffffffffff, &(0x7f0000000000)={0x26, 'aead\x00', 0x0, 0x0, 'rfc4106(gcm(aes))\x00'}, 0x58) setsockopt$ALG_SET_KEY(0xffffffffffffffff, 0x117, 0x1, &(0x7f00000009c0), 0x0) setsockopt$ALG_SET_KEY(r1, 0x117, 0x7, &(0x7f00000000c0)="fdddab5e", 0x4) r3 = socket$inet6_sctp(0xa, 0x1, 0x84) syz_emit_ethernet(0x72, &(0x7f0000000440)={@multicast, @random="fd137b07daa7", @void, {@ipv6={0x86dd, @icmpv6={0x0, 0x6, "02adf7", 0x3c, 0x3a, 0x0, @ipv4={'\x00', '\xff\xff', @private}, @mcast2, {[], @time_exceed={0x3, 0x1, 0x0, 0x0, '\x00', {0x0, 0x6, "fd9063", 0x0, 0x2f, 0x0, @mcast1, @loopback={0x0, 0xffffac1414aa}, [], "8d0022eb00000000d9dedb35"}}}}}}}, 0x0) setsockopt$inet6_int(r3, 0x29, 0x1a, &(0x7f0000000100)=0x8001, 0x4) bind$inet6(r3, &(0x7f00000000c0)={0xa, 0x4e23, 0xa, @empty, 0x9}, 0x1c) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r4, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000000c0)={0x20, 0x2, 0x6, 0x301, 0x0, 0x0, {}, [@IPSET_ATTR_SETNAME={0x9, 0x2, 'syz2\x00'}]}, 0x20}}, 0x0) sendmmsg$inet6(r3, &(0x7f0000000480)=[{{&(0x7f0000000040)={0xa, 0x4e23, 0xb, @loopback, 0x1}, 0x1c, &(0x7f0000000380)=[{&(0x7f0000000140)='2', 0x1}], 0x1}}], 0x1, 0x8000) r5 = socket$inet6_sctp(0xa, 0x1, 0x84) bind$inet6(r5, &(0x7f0000000140)={0xa, 0x4e23, 0x100002, @ipv4={'\x00', '\xff\xff', @local}, 0xffff}, 0x1c) sendmmsg$inet6(r5, &(0x7f0000000680)=[{{&(0x7f0000000080)={0xa, 0x4e23, 0xab, @loopback, 0x8}, 0x1c, &(0x7f0000000780)=[{&(0x7f0000000900)='2', 0x1}], 0x1}}], 0x1, 0x20000014) shutdown(r5, 0x1) r6 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r6, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000340)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x40000) sendmsg$NFT_BATCH(r6, &(0x7f0000000680)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000003c0)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x7}}, [@NFT_MSG_NEWRULE={0x1a0, 0x6, 0xa, 0x40b, 0x0, 0x0, {0x2}, [@NFTA_RULE_EXPRESSIONS={0x174, 0x4, 0x0, 0x1, [{0x160, 0x1, 0x0, 0x1, @match={{0xa}, @val={0x150, 0x2, 0x0, 0x1, [@NFTA_MATCH_REV={0x8}, @NFTA_MATCH_NAME={0xb, 0x1, 'policy\x00'}, @NFTA_MATCH_INFO={0x138, 0x3, "ebae551382395afa4d23edfcbe6d55b57cb15e63c15c46395916e2b388abc3d6ce2316334e8278ad51f6d123a616cf3eb44b275fe6bc6bf402a3f9335458bb7a92f23fc0aa88f2495ff70157ea6b29f7fab11ec362920cab3350208c749f342b38e0df9334cea6fe1e331d76beb7094102d5d409992dcd236e3fd7a8785f97ae9d01b0822c161a491bef0501f8e81ddd66d1b676e8c9f0b2159c2cc0b069669b5af546f644c39bedd627181d27d9c185aae5d910550f08822c6fec60302779b9e812403a2ff826781b4c761bd14eb7515ae224260c9534891afdd05d18b2ffe91f4052766a0b9fe3955bfb1866142e7c1caceb88de7d6e8a5c08ce052bb461f0c7ee914ca5c98c19442d0262a6d04a8e3e29360a9b5871812e08542d54775f5843d70b15871bc247e30d66b83560c014f5000000"}]}}}, {0x10, 0x1, 0x0, 0x1, @log={{0x8}, @val={0x4}}}]}, @NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_RULE_CHAIN={0x9, 0x2, 'syz2\x00'}]}], {0x14, 0x11, 0x20, 0x0, 0x0, {0x7}}}, 0x1c8}, 0x1, 0x0, 0x0, 0x8010}, 0x4000800) 2.553152701s ago: executing program 3 (id=3334): r0 = socket$nl_generic(0x10, 0x3, 0x10) socketpair$tipc(0x1e, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$tipc(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000200)=[{&(0x7f0000000b40)="a2", 0xfffffd2a}], 0x1, 0x0, 0x0, 0x20000000}, 0x4000041) close(r2) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f00000000c0), r0) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000100)={'wlan1\x00', 0x0}) r5 = socket$inet6(0xa, 0x2, 0x0) setsockopt$sock_int(r5, 0x1, 0xf, &(0x7f0000000000)=0x6, 0xa) r6 = socket$nl_crypto(0x10, 0x3, 0x15) ioctl$sock_SIOCGIFVLAN_SET_VLAN_NAME_TYPE_CMD(r6, 0x8982, &(0x7f0000000300)={0x6, 'pimreg\x00', {0xa26d}, 0x1}) bind$inet6(r5, &(0x7f0000f67fe4)={0xa, 0x4e20, 0x0, @ipv4={'\x00', '\xff\xff', @multicast2}}, 0x1c) r7 = socket$inet6(0xa, 0x2, 0x0) r8 = socket$inet6_sctp(0xa, 0x5, 0x84) r9 = socket$inet6_sctp(0xa, 0x1, 0x84) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r9, 0x84, 0x6f, &(0x7f0000000280)={0x0, 0x1c, &(0x7f0000000000)=[@in6={0xa, 0x0, 0x0, @private1, 0x9}]}, &(0x7f00000002c0)=0x10) getsockopt$inet_sctp6_SCTP_MAX_BURST(r9, 0x84, 0x83, &(0x7f0000000000)=@assoc_value={0x0}, &(0x7f0000000080)=0x8) setsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER(r8, 0x84, 0x7b, &(0x7f0000000000)={r10}, 0x8) bind$inet6(r7, &(0x7f0000f67fe4)={0xa, 0x4e20, 0x9, @ipv4={'\x00', '\xff\xff', @multicast2}}, 0x1c) sendmsg$NL80211_CMD_UNEXPECTED_FRAME(r0, &(0x7f00000002c0)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f00000001c0)={&(0x7f0000000180)={0x28, r3, 0x4, 0x70bd29, 0x25dfdbff, {{}, {@val={0x8, 0x3, r4}, @val={0xc, 0x99, {0x6b54da41, 0x56}}}}, [""]}, 0x28}, 0x1, 0x0, 0x0, 0x20000800}, 0x4008000) close(r1) r11 = syz_genetlink_get_family_id$batadv(&(0x7f0000000040), r0) sendmsg$BATADV_CMD_GET_DAT_CACHE(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000500)={0x1c, r11, 0x83625fc5352ba305, 0x70bd2b, 0x0, {}, [@BATADV_ATTR_GW_BANDWIDTH_DOWN={0x8, 0x31, 0x3}]}, 0x1c}}, 0x80) 2.547352738s ago: executing program 0 (id=3335): r0 = socket(0x10, 0x3, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) (async) r2 = socket(0x10, 0x803, 0x2) syz_genetlink_get_family_id$mptcp(&(0x7f00000000c0), r2) bpf$BPF_PROG_ATTACH(0x8, &(0x7f0000000000)={@ifindex, 0xffffffffffffffff, 0x36, 0x4}, 0x20) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000003c0)=0x14) (async) r4 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="0100000004000000080000000d"], 0x48) (async) r5 = bpf$MAP_CREATE(0x0, &(0x7f0000000440)=@base={0x1b, 0x0, 0x0, 0x8000}, 0x50) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0x10, &(0x7f0000000180)=ANY=[@ANYBLOB="1800000020000000000000000000000018110000", @ANYRES32=r5, @ANYBLOB="0000000000000000b702000002000000850000008600000018110000", @ANYRES32=r4, @ANYBLOB="0000000000000000b7080000810000087b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000300000095"], 0x0, 0x0, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x94) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) (async) socket$nl_route(0x10, 0x3, 0x0) (async) socket$packet(0x11, 0x3, 0x300) (async) socket$nl_netfilter(0x10, 0x3, 0xc) r8 = syz_init_net_socket$llc(0x1a, 0x2, 0x0) bind$llc(r8, &(0x7f0000000140)={0x1a, 0x0, 0x0, 0xff, 0x2, 0x9}, 0x10) r9 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='blkio.bfq.io_queued\x00', 0x275a, 0x0) write$cgroup_int(r9, &(0x7f0000000000), 0xffffff6a) sendfile(r8, r9, 0x0, 0xffffffff000) (async) socket$tipc(0x1e, 0x5, 0x0) (async) socket$tipc(0x1e, 0x5, 0x0) (async) pselect6(0x40, &(0x7f00000001c0)={0x0, 0x0, 0x3, 0xfffffffffffffffd}, 0x0, &(0x7f00000002c0)={0x3ff, 0x0, 0x0, 0x9, 0x0, 0x0, 0x7fffffff}, 0x0, 0x0) (async) ioctl$int_in(r8, 0x5452, &(0x7f00000001c0)=0x3) r10 = bpf$PROG_LOAD(0x5, &(0x7f0000000880)={0x1, 0x10, &(0x7f0000000180)=ANY=[], &(0x7f0000000980)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) setsockopt$sock_attach_bpf(r6, 0x1, 0x32, &(0x7f00000000c0)=r10, 0x4) (async) sendmsg$unix(r7, &(0x7f00000006c0)={0x0, 0x0, 0x0}, 0x0) (async) sendmsg$nl_route(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="3c0000001000010400eeffff11ffffffff000000", @ANYRES32=r3, @ANYBLOB="01000000010000001c0012000c000100627269646765"], 0x3c}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f0000005840)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000200)=@newqdisc={0x48, 0x24, 0x5820a61ca228651, 0x0, 0x0, {0x0, 0x0, 0x0, r3, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_htb={{0x8}, {0x1c, 0x2, [@TCA_HTB_INIT={0x18, 0x2, {0x3, 0xfffffffe, 0x8}}]}}]}, 0x48}}, 0x0) (async) sendmsg$nl_route_sched(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000400)=@newtfilter={0x24, 0x28, 0x1, 0x0, 0x0, {0x0, 0x0, 0x0, r3, {}, {}, {0xfff1, 0xfff3}}}, 0x24}, 0x1, 0x0, 0x0, 0x10}, 0x0) 2.296964441s ago: executing program 0 (id=3336): r0 = socket(0x2, 0x80805, 0x0) r1 = socket$inet6_sctp(0xa, 0x5, 0x84) shutdown(r1, 0x0) close(0x3) (async) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(0xffffffffffffffff, 0x84, 0x6f, &(0x7f0000000200)={0x0, 0x10, &(0x7f0000000180)=[@in={0x2, 0x4e22, @loopback}]}, &(0x7f0000000140)=0x10) getsockopt$inet_sctp6_SCTP_PRIMARY_ADDR(r1, 0x84, 0x7a, &(0x7f0000000340)={r2, @in6={{0xa, 0x3, 0x4, @mcast1}}}, &(0x7f0000000040)=0x84) (async) sendmmsg$inet_sctp(r0, &(0x7f00000032c0)=[{0x0, 0x0, 0x0, 0x0, &(0x7f0000000700)=ANY=[@ANYBLOB="30000000000000008400000001000000000000017c"], 0x30}], 0x1, 0x0) (async) setsockopt$inet_sctp6_SCTP_DEFAULT_SNDINFO(r0, 0x84, 0x22, &(0x7f0000000100)={0xfffc, 0x2, 0x5, 0x5}, 0x10) r3 = socket$nl_route(0x10, 0x3, 0x0) (async) r4 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) ioctl$TUNSETIFF(r4, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x2}) r5 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) ioctl$AUTOFS_IOC_FAIL(r4, 0x9361, 0x6) close(r5) ioctl$sock_SIOCETHTOOL(r3, 0x8946, &(0x7f0000000580)={'batadv_slave_0\x00', &(0x7f0000000440)=@ethtool_dump={0x40, 0x8, 0x0, 0xe2, "b8a67993aac99fcecca5e98776b78aeea2499c0dad4418dbbc133dc5ba2d5f7ceb2076a7414a362a8ce3dae8e25f564dabc1a164e5bd945f69c15530692a18aacf3c66de3a47068a3c9fe88d3f4f3977813035f99e553a4cba62c3a1e2e0bf6b5c7c5506dee172f95ffa448b743135f8b2e14852a686e797d7a8b2aba61bdecbc9456a6a6156b548617fac8d6ec7a4668f999a82d5a2cab3cf5291be96dfa9799fbe5223faf4df8001a2268720661b939809c07eb981005bac2d4bf01d3160f63593818ea7ef8a927cf8835edf9f1de163413fa7a221c0a551ebffa0c8a9e3e62a44"}}) (async) r6 = socket$nl_generic(0x10, 0x3, 0x10) r7 = syz_genetlink_get_family_id$tipc(&(0x7f00000000c0), r6) sendmsg$TIPC_CMD_ENABLE_BEARER(r6, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000680)=ANY=[@ANYBLOB='8\x00\x00\x00', @ANYRES16=r7, @ANYBLOB="010000000d0000000000010000000000000001410000001c001700000000000000006574683a73797a6b616c6c657230"], 0x38}}, 0x0) (async) ioctl$SIOCSIFHWADDR(r5, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) (async) r8 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r6, 0x8933, &(0x7f0000000540)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r8, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000880)=@newqdisc={0x6c, 0x24, 0x4ee4e6a52ff56541, 0x1001, 0x25dfdbfd, {0x0, 0x0, 0x0, r9, {0x0, 0xb}, {0xffff, 0xffff}, {0xfff2}}, [@qdisc_kind_options=@q_tbf={{0x8}, {0x40, 0x2, [@TCA_TBF_PRATE64={0xc, 0x5, 0xc2240edb8ac75ac7}, @TCA_TBF_BURST={0x8, 0x6, 0xff}, @TCA_TBF_PARMS={0x28, 0x1, {{0x4, 0x2, 0x84a, 0x9, 0x1, 0x7fd}, {0x8c, 0x1, 0xfffc, 0x7fff, 0x4, 0xb}, 0x5, 0x34, 0x91f}}]}}]}, 0x6c}, 0x1, 0x0, 0x0, 0x40088c1}, 0x50) r10 = socket$nl_route(0x10, 0x3, 0x0) (async) openat$tun(0xffffffffffffff9c, &(0x7f00000001c0), 0x101801, 0x0) r11 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) (async) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000600)=[{&(0x7f0000000080)='H', 0x1}], 0x1}, 0x0) bind$bt_hci(r11, &(0x7f0000000000)={0x1f, 0xffffffffffffffff, 0x3}, 0x6) write$bt_hci(r11, &(0x7f0000000080)=ANY=[], 0x6) ioctl$sock_SIOCGIFINDEX(r10, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r10, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000140)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70b926, 0x25dfdbfe, {0x0, 0x0, 0x0, r12, {0x0, 0x8}, {0xffff, 0xb}, {0xffff, 0xffe0}}, [@qdisc_kind_options=@q_pfifo={{0xa}, {0x8, 0x2, 0x5}}]}, 0x38}, 0x1, 0x0, 0x0, 0x40000b0}, 0x4000) 2.296024692s ago: executing program 4 (id=3337): r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f00000001c0)={0x26, 'skcipher\x00', 0x0, 0x0, 'xchacha20\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000000240)="c99b57381801238c09d25f95b10dbd301e5a47b2f3caa73dcd2a6a370554375a", 0x20) r1 = accept4(r0, 0x0, 0x0, 0x80000) sendto$inet6(r1, &(0x7f0000000000)="6bed67b3d6dc76", 0x7, 0x4000000, 0x0, 0x0) recvmmsg(r1, &(0x7f0000000300)=[{{0x0, 0x0, &(0x7f0000001b80)=[{&(0x7f0000000100)=""/70, 0x46}], 0x1}, 0x2}], 0x1, 0x40000180, 0x0) sendmsg$NFNL_MSG_CTHELPER_NEW(r1, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[], 0xd4}}, 0x0) r2 = socket$inet_sctp(0x2, 0x1, 0x84) setsockopt$sock_linger(r2, 0x1, 0xd, &(0x7f0000000100)={0x1, 0x2}, 0x8) close(r2) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(0xffffffffffffffff, 0x89f0, &(0x7f0000000240)={'syztnl0\x00', &(0x7f00000001c0)={'syztnl0\x00', 0x0, 0x8, 0x7800, 0x1, 0x9, {{0xd, 0x4, 0x3, 0x27, 0x34, 0x65, 0x0, 0xfb, 0x4, 0x0, @broadcast, @broadcast, {[@timestamp={0x44, 0x20, 0xd9, 0x0, 0x7, [0x100, 0x3, 0x10000, 0x8c02, 0x6, 0xfffffff7, 0xb9cd]}]}}}}}) r4 = bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000540)={&(0x7f00000002c0)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0x140, 0x140, 0x3, [@decl_tag={0xb, 0x0, 0x0, 0x11, 0x3, 0x4}, @func={0x2, 0x0, 0x0, 0xc, 0x3}, @enum64={0x3, 0x9, 0x0, 0x13, 0x0, 0x4, [{0xe, 0x7, 0xfffffc01}, {0x7, 0x45, 0x3}, {0x8, 0x80000000, 0xff0000}, {0x4, 0xffffffff, 0x7fffffff}, {0xf, 0x8, 0x9c0d}, {0xf, 0x37, 0x2}, {0x9, 0xc, 0x8fb}, {0x2, 0x7, 0x2}, {0x1, 0xa, 0x81}]}, @ptr={0xc, 0x0, 0x0, 0x2, 0x2}, @volatile={0x4, 0x0, 0x0, 0x9, 0x1}, @array={0x0, 0x0, 0x0, 0x3, 0x0, {0x1, 0x1, 0x7}}, @struct={0x5, 0x1, 0x0, 0x4, 0x1, 0xd87c, [{0xb, 0x1, 0x401}]}, @volatile={0xb, 0x0, 0x0, 0x9, 0x3}, @fwd={0xf}, @enum={0xf, 0x8, 0x0, 0x6, 0x4, [{0xb, 0x1}, {0x4, 0x7}, {0x7, 0x4}, {0x2, 0x7}, {0x9, 0x2}, {0x0, 0x2}, {0x7, 0x5}, {0xb, 0x3}]}]}, {0x0, [0x30]}}, &(0x7f0000000500)=""/53, 0x15b, 0x35, 0x1, 0xbaf3}, 0x28) bpf$PROG_LOAD(0x5, &(0x7f0000000440)={0xc, 0x3, &(0x7f0000000280)=@framed={{0x5, 0x0, 0x0, 0x0, 0x0, 0x73, 0x11, 0x43}, [], {0x95, 0x0, 0x5a5}}, &(0x7f0000000080)='GPL\x00', 0x5, 0xc3, &(0x7f00000000c0)=""/195, 0x0, 0x21, '\x00', r3, @fallback, r4, 0x6}, 0x94) 2.116185777s ago: executing program 1 (id=3338): socket$unix(0x1, 0x5, 0x0) socket$nl_generic(0x10, 0x3, 0x10) r0 = socket(0x1e, 0x4, 0x0) setsockopt$packet_tx_ring(r0, 0x10f, 0x87, &(0x7f0000000100)=@req={0x3fc, 0x0, 0x0, 0x6}, 0x10) r1 = socket(0xe, 0x2, 0x2000) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x48241, 0x0) r3 = socket$igmp6(0xa, 0x3, 0x2) syz_genetlink_get_family_id$mptcp(&(0x7f0000000240), r1) r4 = socket$kcm(0x2, 0xa, 0x2) ioctl$SIOCSIFHWADDR(r4, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @random="2b0436d23321"}) ioctl$sock_SIOCSIFVLAN_ADD_VLAN_CMD(r3, 0x8983, &(0x7f0000000480)={0x0, 'veth0_to_hsr\x00', {0x2}, 0x51}) write$tun(r2, &(0x7f0000000340)=ANY=[@ANYBLOB="aaaaaaaaaabb0180c200000e88a800008100007eab91b32dd80cffd20adf8cf828782802010045fc006953d778f6c9a77f00"], 0x32) setsockopt$packet_tx_ring(r1, 0x10f, 0x87, &(0x7f0000000440)=@req={0x3fc}, 0x10) r5 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r6 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r7 = syz_genetlink_get_family_id$nbd(&(0x7f0000000000), 0xffffffffffffffff) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000300)={0xffffffffffffffff}) sendmsg$NBD_CMD_CONNECT(r6, &(0x7f0000001ac0)={0x0, 0x0, &(0x7f0000001a80)={&(0x7f0000000140)={0x38, r7, 0x1, 0xffffffff, 0x0, {}, [@NBD_ATTR_SOCKETS={0x10, 0x7, 0x0, 0x1, [{0xc, 0x1, 0x0, 0x1, {0x8, 0x1, r8}}]}, @NBD_ATTR_INDEX={0x8, 0x1, 0x0}, @NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x7fff}]}, 0x38}}, 0x20000000) sendmsg$NBD_CMD_DISCONNECT(r5, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000200)={0x1c, r7, 0x1, 0x70bd2d, 0x25dfdbfb, {}, [@NBD_ATTR_INDEX={0x8, 0x1, 0x0}]}, 0x1c}, 0x1, 0x0, 0x0, 0x20000011}, 0x4000810) recvmmsg$unix(r0, &(0x7f0000001bc0)=[{{0x0, 0x0, &(0x7f0000000080)}}], 0x1, 0x0, 0x0) r9 = socket$inet6_tcp(0xa, 0x1, 0x0) r10 = socket$nl_route(0x10, 0x3, 0x0) unshare(0x20020600) r11 = socket(0x1d, 0x2, 0x6) getsockopt$inet_mreqn(r11, 0x6a, 0x24, 0x0, &(0x7f00000000c0)) sendmsg$nl_route(r10, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000100)=@newlink={0x30, 0x10, 0x1, 0x70bd25, 0x25dfdbf9, {0x0, 0x0, 0x600, 0x0, 0x48815, 0x40103}, [@IFLA_GROUP={0x8}, @IFLA_TXQLEN={0x8, 0xd, 0x3}]}, 0x30}, 0x1, 0x0, 0x0, 0x40801}, 0x4000000) readv(r9, &(0x7f0000000780), 0x0) recvmmsg(r0, &(0x7f0000008280)=[{{0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f0000000040)=""/55, 0x37}], 0x1}, 0x8}], 0x1, 0x40000180, 0x0) preadv(r4, &(0x7f0000003c00)=[{&(0x7f0000001480)=""/255, 0xff}, {&(0x7f00000000c0)=""/1, 0x1}, {0x0}, {&(0x7f0000001c00)=""/4096, 0x1000}, {&(0x7f0000002c00)=""/4096, 0x1000}], 0x5, 0x23a1, 0x1) close(r1) 2.095719899s ago: executing program 4 (id=3339): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x2000}) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket$unix(0x1, 0x1, 0x0) r3 = socket$packet(0x11, 0x3, 0x300) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000080)={'veth0_to_bond\x00', 0x0}) sendmsg$L2TP_CMD_NOOP(0xffffffffffffffff, 0x0, 0x4000000) sendmsg$IPSET_CMD_DESTROY(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000007c0)=ANY=[@ANYBLOB="1c0000000306010200000000000000000700000a0500010007"], 0x1c}, 0x1, 0x0, 0x0, 0x4000000}, 0x40814) socket$nl_netfilter(0x10, 0x3, 0xc) r5 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r5, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000780)=ANY=[@ANYBLOB="580000000206030000000000000000000300000705000100070000000900020073797a31000000000c00078008001240000000050500050002000000050004000100000011000300686173683a69702c706f727400"], 0x58}, 0x1, 0x0, 0x0, 0x4000}, 0x20004000) sendmsg$IPCTNL_MSG_TIMEOUT_DELETE(r5, &(0x7f00000005c0)={&(0x7f0000000400)={0x10, 0x0, 0x0, 0x40000}, 0xc, &(0x7f0000000580)={&(0x7f0000000440)=ANY=[@ANYBLOB="cf0000000208050000000000000000000000000205000300be0000000900010073797a31000000000900010073797a31000000003400048008000140000000070800014080000001080001400000000f0800014063796bb8080001400000000608000140007fff00540004800800054000000cc60800084000000005080004400000000208000440000000060800014000000003080008407fffffff0800064000000005080006400000000108000740000000050800024000000005060002400016000006000240000c000005000300840000000900010073797a31000000000500030001000000"], 0xe8}, 0x1, 0x0, 0x0, 0x14}, 0x0) r6 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_ADD(r6, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000300)=ANY=[@ANYBLOB="50000000090601020000000000000000020000840900020073797a31000000000500010007000000280007800c00018008000140fffffff70500070088000000060004404e22000006000540"], 0x50}, 0x1, 0x0, 0x0, 0x10000082}, 0x90) r7 = socket$nl_netfilter(0x10, 0x3, 0xc) r8 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_DELETE(r8, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000500)={0x50, 0x2, 0x1, 0x3, 0x0, 0x0, {0xa, 0x0, 0x4}, [@CTA_FILTER={0xc, 0x19, 0x0, 0x1, [@CTA_FILTER_REPLY_FLAGS={0x8, 0x2, 0x1}]}, @CTA_TUPLE_REPLY={0x30, 0x2, 0x0, 0x1, [@CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @mcast1}, {0x14, 0x4, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}}}}]}]}, 0x50}, 0x1, 0x0, 0x0, 0x44008000}, 0x40008d2) sendmsg$IPSET_CMD_LIST(r7, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000180)={0x1c, 0x7, 0x6, 0x301, 0x0, 0x0, {0x1}, [@IPSET_ATTR_PROTOCOL={0x5}]}, 0x1c}, 0x1, 0x0, 0x0, 0x20000800}, 0x20000040) setsockopt$packet_int(r3, 0x107, 0x14, &(0x7f0000000180)=0x19ca, 0x4) setsockopt$packet_int(r3, 0x107, 0xb, &(0x7f0000000000)=0xf43, 0x1c) sendto$packet(r3, &(0x7f00000000c0)="3f03fe7feee8140006001e0089e9aaa911d7c2290f0086dd1327c9167c643c4a1b7880610cc96655b1b141ab059b24d0fbc50df71548a3f6c5609063382a0c153cfdf9435e3ffe46", 0xe90c, 0x0, &(0x7f0000000540)={0xc9, 0x0, r4, 0x1, 0x0, 0x6, @multicast}, 0x14) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'syzkaller0\x00'}) sendmsg$nl_route_sched(r1, &(0x7f00000012c0)={0x0, 0x0, 0x0}, 0x24040084) r9 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$sock_bt_hci(r9, 0x400448e0, &(0x7f0000000140)) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000340)={0x6, 0x5, &(0x7f0000000140)=@framed={{0x18, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x7}, [@map_idx_val={0x18, 0xa, 0x6, 0x0, 0x7, 0x0, 0x0, 0x0, 0x5}]}, &(0x7f00000001c0)='syzkaller\x00', 0x6, 0x10, &(0x7f0000000200)=""/16, 0x41100, 0x40, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0xe0}, 0x94) r10 = socket$inet6_sctp(0xa, 0x5, 0x84) shutdown(r10, 0x0) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r10, 0x84, 0x6f, &(0x7f00000001c0)={0x0, 0x10, &(0x7f0000000080)=[@in={0x2, 0x4e22, @initdev={0xac, 0x1e, 0x0, 0x0}}]}, &(0x7f0000000180)=0x10) setsockopt$inet_sctp6_SCTP_RESET_ASSOC(r10, 0x84, 0x78, &(0x7f0000000680)=r11, 0x4) 1.892398635s ago: executing program 0 (id=3340): r0 = socket(0x10, 0x3, 0xfffffffc) setsockopt$netlink_NETLINK_TX_RING(r0, 0x10e, 0xc, &(0x7f0000000180)={0x6}, 0x10) clock_gettime(0xffffffea, 0x0) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000040)=ANY=[@ANYBLOB="300000001a00010000000000000000001c0000000014"], 0x30}}, 0x0) 1.709248325s ago: executing program 0 (id=3341): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) ioctl$FS_IOC_GETFLAGS(r0, 0x80086601, &(0x7f0000000080)) setsockopt$inet6_tcp_int(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000180)=0x100000001, 0x4) connect$inet6(0xffffffffffffffff, &(0x7f0000000300)={0xa, 0x4e24, 0x6bb, @ipv4={'\x00', '\xff\xff', @local}, 0x5}, 0x1c) setsockopt$inet6_tcp_int(0xffffffffffffffff, 0x6, 0xc, &(0x7f0000000080)=0x1, 0x4) socket$inet(0x2, 0x2, 0x73) shutdown(0xffffffffffffffff, 0x0) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000044c0)={&(0x7f0000000440)=ANY=[@ANYBLOB="4c000000020601080000000000000000000000400500010006000000050005000200000005000400000000000900020073797a31000000001100f6e1dee26ce60300686173683a69702c6d61726b00000000"], 0x4c}}, 0x0) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_ADD(r2, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=ANY=[@ANYBLOB="480000000906010200000000000000000200ffff200007800c00018008000140e000000208000a400000000205000300020000000900"], 0x48}, 0x1, 0x0, 0x0, 0x800}, 0x40c0080) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_LIST(r3, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000040)={0x1c, 0x7, 0x6, 0x801, 0x0, 0x0, {0xa, 0x0, 0x4}, [@IPSET_ATTR_PROTOCOL={0x5}]}, 0x1c}, 0x1, 0x0, 0x0, 0x20000005}, 0x80) ioctl$XFS_IOC_FD_TO_HANDLE(0xffffffffffffffff, 0xc038586a, &(0x7f0000000340)={0xffffffffffffffff, &(0x7f0000001240)='+}\\)>&^}\x00', 0xa0882, &(0x7f00000001c0)={@align=0x2, {0xa, 0x4, 0x7, 0xf80000000000}}, 0xf6, 0x0, 0x0}) getsockopt$TIPC_IMPORTANCE(r4, 0x10f, 0x7f, 0x0, &(0x7f00000003c0)) socket$kcm(0x10, 0x2, 0x4) r5 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r5, &(0x7f0000000100)={0x1f, 0xffff}, 0x6) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket$inet6(0xa, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r7, 0x8933, &(0x7f0000000300)={'veth1_virt_wifi\x00', 0x0}) setsockopt$inet6_mreq(r7, 0x29, 0x1b, &(0x7f0000000000)={@remote, r8}, 0x14) sendmsg$nl_route_sched(r6, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000004c0)=@newtfilter={0x24, 0x11, 0xd27, 0x2000, 0x25dfdbfd, {0x0, 0x0, 0x74, r8, {0x4, 0xfff2}, {0xafabc05531515610, 0xd}, {0x8, 0x2}}}, 0x24}, 0x1, 0xf0ffffffffffff, 0x0, 0x1c005}, 0x24048004) setsockopt$inet6_mreq(r7, 0x29, 0x1c, &(0x7f0000000040)={@remote, r8}, 0x14) sendmsg$IPCTNL_MSG_CT_NEW(r0, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000180)=ANY=[@ANYBLOB="88000000000101040000000000000000020000002c00018014000180080001007f00000108000200e00000020c000280050001000000000006000340000300002400028014000180080001000000000008000200ac1414bb0c000280050001000000000008000740000000001c000f800800014000e7ffff07000340"], 0x88}}, 0x0) r9 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000280)='devices.list\x00', 0x26e1, 0x0) close(r9) r10 = getpid() sendmsg$unix(r9, &(0x7f0000000e40)={0x0, 0x0, &(0x7f0000000dc0)=[{&(0x7f0000000240)='C', 0x1}], 0x1, &(0x7f0000000e00)=[@cred={{0x1c, 0x1, 0x2, {r10, 0x0, 0xee01}}}], 0x20, 0x10}, 0x80) write$cgroup_pid(r9, &(0x7f0000000400), 0x12) 1.564312253s ago: executing program 3 (id=3342): r0 = socket$alg(0x26, 0x5, 0x0) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$wireguard(&(0x7f0000000040), 0xffffffffffffffff) ioctl$ifreq_SIOCGIFINDEX_wireguard(r1, 0x8933, &(0x7f0000000200)={'wg2\x00', 0x0}) sendmsg$WG_CMD_SET_DEVICE(r1, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000001c00)=ANY=[@ANYBLOB="28040000", @ANYRES16=r2, @ANYBLOB="05002abd7000fddbdf2501000000060006004e24000004040880bc00008024000100d1732899f611cd8994034d7f413dc957630e5493c285aca40065cb6311be696b240001000000000000000000000000000000000000000000000000000000000000000000200004000a004e2000000001ff01000000000000000000000000000102000000240002001171ee8da334a5099295af229a5d237a7f4102f01f28b34347d6cbbe135d83ec24000100975c9d81c983c8209ee781254b899f8ed925ae9f0923c23c62f53c57cdbf691c08000300070000004c02008024000100dbffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff2402098058000080060001000200000041000200ac1e00010500030001000000060001000a00000014000200000000000000000000000000000000010500030000000000060001000200000008000200ffffffff050003000100000064000080060001000a00000014000200000000000000000000000000000000010500030002000000060001000200000008000200ac1414bb0500030002000000060001000a00000014000200000000000000000000000000000000010500030002000000dc000080060001000a0000001400020000000000000000000000ffffac1414aa05000300030000000600010002000000080002000a01010205000300020000000600010002000000080002007f00000105000300000000000600010002000000080002000a0101010500030003000000060001000200000008000200e00000010500030003000000060001000a00000014000200fc0100000000000000000000000000000500030001000000060001000200000008000200640101000500030000000000060001000200000008000200ac1e0101050003000200000088000080060001000a00000014000200fe8000000000000000000000000000aa0500030001000000060001000200000008000200ac1414aa0500030002000000060001000a00000014000200fe8800000000000000000000000001010500030002000000060001000a00000014000200ff020000000000000000000000000001050003000200000064000080080003000000000008000a000100000024000100f44da367a88ee6564f020211456727082f5cebee8b1bf5eb7337341b459b3922080003000300000024000200379aa288b2244a5b504ba04bea45625d328fb93b62e607a1b2e4da2f7f76a5499400008024000100975c9d81c983c8209ee781254b899f8ed925ae9f0923c23c62f53c57cdbf691c080003000400000024000100f44da367a88ee6564f020211456727082f5cebee8b1bf5eb7337341b459b3922080003000000000024000100d1732899f611cd8994034d7f413dc957630e5493c285aca40065cb6311be696b1400040002004e2200000000000000000000000008000100", @ANYRES32=r3], 0x428}, 0x1, 0x0, 0x0, 0x4000}, 0x40) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r4, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000340)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0) sendmsg$NFT_BATCH(r4, 0x0, 0x4000800) bind$alg(r0, &(0x7f0000000000)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb(des3_ede)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000c18000)="ad56b6c5820fae9d6dcd3292ea54c7beef915d564c90c200", 0x18) unshare(0x2a020400) r5 = bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000280)={&(0x7f0000000340)=ANY=[@ANYBLOB="9feb010018000000000000003c0000003c000000020000000000000002000084ffffffff000000000300000000000000000000000200000000000000000000000000000a030000000000000000000002"], 0x0, 0x56}, 0x20) bpf$MAP_CREATE(0x0, &(0x7f00000005c0)=@base={0x1a, 0x4, 0x0, 0x1, 0x8000, 0x1, 0xffffffff, '\x00', 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x4, 0x0, @value=r5}, 0x50) r6 = accept4(r0, 0x0, 0x0, 0x80800) recvmsg(r6, 0x0, 0x2120) syz_genetlink_get_family_id$gtp(&(0x7f0000000140), r6) r7 = socket$nl_netfilter(0x10, 0x3, 0xc) r8 = socket$alg(0x26, 0x5, 0x0) r9 = socket$phonet_pipe(0x23, 0x5, 0x2) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000003c0)={&(0x7f0000000440)=ANY=[@ANYBLOB], 0x0, 0x96}, 0x28) bpf$PROG_LOAD_XDP(0x5, &(0x7f00000005c0)={0x6, 0x3, &(0x7f0000000180)=ANY=[@ANYBLOB="18009500000000000000"], &(0x7f0000000280)='GPL\x00', 0x8}, 0x94) getsockopt$PNPIPE_IFINDEX(r9, 0x113, 0x11, 0xffffffffffffffff, &(0x7f0000000080)) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000200)={0x0, 0xffffffffffffff8a}}, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000240)=ANY=[@ANYBLOB="4800000010001fff0000056842bb002552d215f6", @ANYRES32=0x0, @ANYBLOB="0000000000000000280012800a00010076786c616e00000018000280140011"], 0x48}}, 0x0) r10 = socket(0x10, 0x3, 0x0) sendmmsg$alg(r10, &(0x7f0000000140), 0x4924b68, 0x0) bind$alg(r8, &(0x7f0000000400)={0x26, 'rng\x00', 0x0, 0x0, 'drbg_nopr_ctr_aes256\x00'}, 0x58) setsockopt$ALG_SET_KEY(r8, 0x117, 0x1, &(0x7f0000c18000)="ad56b6c5910fae9d6dcd3292ea54c7b6", 0x10) socket(0x2b, 0x1, 0x1) getsockname$netlink(r7, &(0x7f00000000c0), &(0x7f0000000100)=0xc) 351.009393ms ago: executing program 3 (id=3343): r0 = socket$kcm(0x11, 0x3, 0x0) setsockopt$sock_attach_bpf(r0, 0x107, 0xf, &(0x7f0000000000), 0x4) sendmsg$kcm(r0, &(0x7f0000000180)={&(0x7f0000000100)=@hci={0x1f, 0x0, 0x4}, 0x80, &(0x7f0000000500)=[{&(0x7f0000000040)="2703020217f914001200002f1eafbcf706e105000000894f000f1102ee1680ca82973d2bd4b8bf4a8291a14b8a34f90186cee844000000080000000019b0fb0bba", 0x41}, {&(0x7f0000000840)="63f805d7649496db72959832930469edc7b7d050139bf7ada300c9e37eed1153ecb716cdb8981cd819af0b33254465cc904b7b31789d65c0e0d3333ce2c236205dd154e363bcadf8f2ea93f45503c6d9fd8dfe5a638cfeb9f79c930a4d18260e5a08ffd35ed8371cff78119319b2b62c7cd9378c73ae90c801681f55ef26cb0000000000000000", 0xfec2}, {&(0x7f0000000280)="fe112162c63e6da8bc8432294ef18af53cc330a62a2c7035246635093ba4d30fcf19a90804f04a10939db8f4e13069cda6d167bf1b68c94d8d694d6ad1a4d51a715975560ad48770706eb1b88d021e1119f2eb75275cfe77f862368649be0f7aff5e7826729816e3d3e7986d9434f891c71ca6e4210c6757083cfd8e732048c504f28b6d309fc129ed8eb5a82e224eb648f90134d1d315977c6ea360a7fece4baa3dd7dcc970759f29df0e86469e954e2b050e87b203ca27a2a519b7555c3b73f2681d49442d9647ff5ea64110cc5020fdeafe53a7d8be70f3260816bc376bcdc5352771fa55d9733e27730ec7103520e8359c78edd21ee6c68feb3685a55722f5da09ffe8ba9f05081a8d214156376f99906245f2f390ad717979d98f0574f8c5b52dcc2fa494f461be6c2560ddbaafb80c5b4583cbe56d24f14ab78fd718947077ea736251c7b8eee267267534c84daa6f095e94bfb85986a03ddea362cc7e6682884e710727c1163cd4f336c13b844605b7a815fe39e43bd0d2e414410a82958455b8a6bd9194c631d66295675fed64c04107a595c421111a3af6e9fadab5c9", 0x1a1}, {&(0x7f0000000540)="6fe4dd9eeb85271de1b87ef9440284", 0xf}], 0x4}, 0x200400c4) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket$inet_tcp(0x2, 0x1, 0x0) getsockopt$inet_tcp_TCP_REPAIR_WINDOW(r2, 0x6, 0x23, &(0x7f0000000040), &(0x7f00000001c0)=0x18) r3 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x5) close(0x4) syz_open_procfs$namespace(0x0, &(0x7f0000000200)='ns/uts\x00') unshare(0x6a040000) r4 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='memory.events\x00', 0x275a, 0x0) getsockopt$bt_BT_RCVMTU(r3, 0x112, 0xd, &(0x7f00000000c0)=0x3, &(0x7f0000000100)=0x2) sendmmsg$unix(r4, &(0x7f00000053c0)=[{{&(0x7f0000000540)=@abs={0x0, 0x0, 0x4e24}, 0x6e, 0x0, 0x0, 0x0, 0x0, 0x20040085}}], 0x1, 0x2) write$cgroup_subtree(r4, &(0x7f0000000000)=ANY=[@ANYRESHEX, @ANYRESHEX=r4, @ANYRES64=r3, @ANYRES16=r4, @ANYRESDEC=r4, @ANYRESOCT=r3, @ANYRES32=r3, @ANYRESOCT=r1, @ANYRESHEX=r4], 0x10448) r5 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40a000, 0x0) ioctl$TUNSETIFF(r5, 0x400454ca, &(0x7f0000000240)={'wlan1\x00', 0x1000}) r6 = socket$kcm(0x2, 0xa, 0x2) ioctl$SIOCSIFHWADDR(r6, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0xe}}) writev(r5, &(0x7f0000000a80)=[{&(0x7f0000000440)="2e9b3d0007e03dd65193dfb6c575963f88a8", 0x12}, {&(0x7f0000000300)="31020002", 0x4}, {&(0x7f0000000a40)="04a0", 0x2}], 0x3) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x2000001, 0x12, r4, 0x0) r7 = socket$rds(0x15, 0x5, 0x0) syz_emit_ethernet(0x3e, &(0x7f0000000040)=ANY=[@ANYBLOB="aaaaaaaaaaaa1780c206050086dd6018232500082c01fe8000000000000000000000000000bbfeda"], 0x0) setsockopt$SO_RDS_TRANSPORT(r7, 0x114, 0x8, &(0x7f00000004c0)=0x2, 0x4) 183.724886ms ago: executing program 1 (id=3344): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000340)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x0) sendmsg$NFT_BATCH(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f00000003c0)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x3}}, [@NFT_MSG_NEWRULE={0x44, 0x6, 0xa, 0x401, 0x0, 0x0, {0xa, 0x0, 0x4}, [@NFTA_RULE_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_RULE_CHAIN={0x9, 0x2, 'syz2\x00'}, @NFTA_RULE_EXPRESSIONS={0x18, 0x4, 0x0, 0x1, [{0x14, 0x1, 0x0, 0x1, @counter={{0xc}, @val={0x4}}}]}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x1}}}, 0x6c}, 0x1, 0x0, 0xfffffff5, 0x4000850}, 0x24044010) 4.061997ms ago: executing program 4 (id=3345): socket$inet_sctp(0x2, 0x5, 0x84) (async) r0 = socket$inet_sctp(0x2, 0x5, 0x84) setsockopt$IP_VS_SO_SET_STARTDAEMON(r0, 0x0, 0x48b, &(0x7f0000000780)={0x2, 'lo\x00', 0x1}, 0x18) unshare(0x26020480) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000180)='cgroup.controllers\x00', 0x275a, 0x0) close(r1) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) listen(r2, 0x0) r3 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000003c0)={0x10, 0x4, &(0x7f0000000380)=ANY=[@ANYBLOB="1802000000c400000000000000000000850000003e00000095"], &(0x7f00000000c0)='GPL\x00'}, 0x94) shutdown(r1, 0x0) bpf$MAP_CREATE(0x0, &(0x7f0000000240)=ANY=[@ANYBLOB="1200000004000000080000000b"], 0x48) (async) r4 = bpf$MAP_CREATE(0x0, &(0x7f0000000240)=ANY=[@ANYBLOB="1200000004000000080000000b"], 0x48) bpf$BPF_PROG_DETACH(0x8, &(0x7f0000000300)=ANY=[@ANYRES32=r4, @ANYRES32=r3, @ANYBLOB='\a'], 0x10) (async) bpf$BPF_PROG_DETACH(0x8, &(0x7f0000000300)=ANY=[@ANYRES32=r4, @ANYRES32=r3, @ANYBLOB='\a'], 0x10) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000140)={r4, &(0x7f0000000240), &(0x7f00000004c0)=@tcp6=r2}, 0x20) syz_genetlink_get_family_id$nl80211(&(0x7f00000001c0), r1) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32, @ANYBLOB="0000000000000000b70800000d0000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) r5 = bpf$MAP_CREATE(0x0, &(0x7f0000000740)=ANY=[@ANYBLOB="0b00000005000000000400000900000001"], 0x48) bpf$PROG_LOAD(0x5, &(0x7f0000000680)={0xd, 0x4, &(0x7f0000000480)=ANY=[@ANYBLOB="18000000000000000000000000000000850000006d"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x15, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) (async) bpf$PROG_LOAD(0x5, &(0x7f0000000680)={0xd, 0x4, &(0x7f0000000480)=ANY=[@ANYBLOB="18000000000000000000000000000000850000006d"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x15, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r7, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000600)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x2}}, [@NFT_MSG_NEWTABLE={0x20, 0x0, 0xa, 0x5, 0x0, 0x0, {0x1, 0x0, 0xfffc}, [@NFTA_TABLE_NAME={0x9, 0x1, 'syz0\x00'}]}, @NFT_MSG_NEWCHAIN={0x40, 0x3, 0xa, 0x101, 0x0, 0x0, {0x1}, [@NFTA_CHAIN_NAME={0x9, 0x3, 'syz0\x00'}, @NFTA_CHAIN_HOOK={0x14, 0x4, 0x0, 0x1, [@NFTA_HOOK_PRIORITY={0x8}, @NFTA_HOOK_HOOKNUM={0x8}]}, @NFTA_CHAIN_TABLE={0x9, 0x1, 'syz0\x00'}]}, @NFT_MSG_NEWRULE={0x4c, 0x6, 0xa, 0x401, 0x0, 0x0, {0x1}, [@NFTA_RULE_EXPRESSIONS={0x24, 0x4, 0x0, 0x1, [{0x20, 0x1, 0x0, 0x1, @rt={{0x7}, @val={0x14, 0x2, 0x0, 0x1, [@NFTA_RT_DREG={0x8, 0x1, 0x1, 0x0, 0x14}, @NFTA_RT_KEY={0x8, 0x2, 0x1, 0x0, 0x2}]}}}]}, @NFTA_RULE_CHAIN_ID={0x8}, @NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}]}], {0x14}}, 0xd4}, 0x1, 0x0, 0x0, 0x480c0}, 0x0) sendmsg$nl_route(r6, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000040)=@ipv6_newnexthop={0x24, 0x68, 0x309, 0x70bd28, 0x0, {0xa, 0x0, 0x2}, [@NHA_FDB={0x4}, @NHA_ID={0x8, 0x1, 0x1}]}, 0x24}}, 0x0) (async) sendmsg$nl_route(r6, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000040)=@ipv6_newnexthop={0x24, 0x68, 0x309, 0x70bd28, 0x0, {0xa, 0x0, 0x2}, [@NHA_FDB={0x4}, @NHA_ID={0x8, 0x1, 0x1}]}, 0x24}}, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000d80)={0x18, 0x5, &(0x7f0000000480)=ANY=[@ANYBLOB="1801000021"], 0x0, 0x40, 0x0, 0x0, 0x0, 0xb4a02fe0ce239f93, '\x00', 0x0, 0x2}, 0x94) (async) r8 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000d80)={0x18, 0x5, &(0x7f0000000480)=ANY=[@ANYBLOB="1801000021"], 0x0, 0x40, 0x0, 0x0, 0x0, 0xb4a02fe0ce239f93, '\x00', 0x0, 0x2}, 0x94) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0xf, 0x0, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000800000000000000000000018110000", @ANYRES32=r5], 0x0, 0x0, 0x0, 0x0, 0x40f00, 0x59, '\x00', 0x0, @fallback=0x2a, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, r8, 0x0, 0x0, 0x0, 0x0}, 0x94) (async) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0xf, 0x0, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000800000000000000000000018110000", @ANYRES32=r5], 0x0, 0x0, 0x0, 0x0, 0x40f00, 0x59, '\x00', 0x0, @fallback=0x2a, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, r8, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$PROG_LOAD(0x5, &(0x7f0000000300)={0x6, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback=0x4, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) (async) r9 = bpf$PROG_LOAD(0x5, &(0x7f0000000300)={0x6, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback=0x4, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000180)={r9, 0x2000000, 0xe, 0x0, &(0x7f0000000040)="630b008646dc3f0adf33c9f7b986", 0x0, 0xcf25, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x80}, 0x50) 0s ago: executing program 0 (id=3346): bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000180)={0x11, 0xa, &(0x7f0000000100)=@framed={{0x18, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1001}, [@initr0={0x18, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8000}, @generic={0x65}, @initr0={0x18, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xd01}, @exit, @alu={0x4, 0x0, 0x5, 0x3, 0x0, 0x1}]}, &(0x7f0000000000)='GPL\x00'}, 0x94) kernel console output (not intermixed with test programs): e ip6gretap1): failed to get link speed/duplex [ 508.126484][ T5728] syz2: Port: 1 Link ACTIVE [ 508.189989][T15411] xt_hashlimit: size too large, truncated to 1048576 [ 508.259779][T15412] netlink: 'syz.4.2405': attribute type 1 has an invalid length. [ 508.318990][T15412] netlink: 224 bytes leftover after parsing attributes in process `syz.4.2405'. [ 508.321953][ T180] bond1: (slave ip6gretap1): failed to get link speed/duplex [ 508.567979][ T6361] bond1: (slave ip6gretap1): failed to get link speed/duplex [ 508.689093][ T180] bond1: (slave ip6gretap1): failed to get link speed/duplex [ 508.798358][ T54] bond1: (slave ip6gretap1): failed to get link speed/duplex [ 508.938557][ T6361] bond1: (slave ip6gretap1): failed to get link speed/duplex [ 509.198906][ T6361] bond1: (slave ip6gretap1): failed to get link speed/duplex [ 509.388605][ T6361] bond1: (slave ip6gretap1): failed to get link speed/duplex [ 509.526097][T15465] netlink: 'syz.3.2418': attribute type 11 has an invalid length. [ 509.548424][ T29] bond1: (slave ip6gretap1): failed to get link speed/duplex [ 509.886310][T15481] netlink: 44 bytes leftover after parsing attributes in process `syz.0.2423'. [ 510.217560][T15477] syzkaller1: entered promiscuous mode [ 510.245093][T15477] syzkaller1: entered allmulticast mode [ 510.319962][T15494] netlink: 'syz.0.2426': attribute type 11 has an invalid length. [ 510.827023][T15514] netlink: 15 bytes leftover after parsing attributes in process `syz.3.2435'. [ 510.849858][T15514] geneve5: entered promiscuous mode [ 510.862460][ T6361] netdevsim netdevsim3 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 510.941786][ T6361] netdevsim netdevsim3 eth1: set [1, 0] type 2 family 0 port 6081 - 0 [ 510.968801][ T6361] netdevsim netdevsim3 eth2: set [1, 0] type 2 family 0 port 6081 - 0 [ 511.000771][ T6361] netdevsim netdevsim3 eth3: set [1, 0] type 2 family 0 port 6081 - 0 [ 511.055149][T15522] netlink: 8 bytes leftover after parsing attributes in process `syz.3.2436'. [ 511.479809][T15538] netlink: 'syz.0.2442': attribute type 1 has an invalid length. [ 511.562514][T15537] netlink: 8 bytes leftover after parsing attributes in process `syz.4.2441'. [ 511.582962][T15537] netlink: 16 bytes leftover after parsing attributes in process `syz.4.2441'. [ 511.620130][T15543] bond14: (slave bridge10): making interface the new active one [ 511.632360][T15543] bond14: (slave bridge10): Enslaving as an active interface with an up link [ 511.706684][T15538] bridge0: port 1(vxlan0) entered blocking state [ 511.713272][T15538] bridge0: port 1(vxlan0) entered listening state [ 511.979718][T15538] netdevsim netdevsim0 netdevsim0: left allmulticast mode [ 511.994823][T15538] mac80211_hwsim hwsim8 wlan0: left allmulticast mode [ 512.032466][T15561] x_tables: ip_tables: DNAT target: used from hooks POSTROUTING, but only usable from PREROUTING/OUTPUT [ 512.076154][T15561] netlink: 40 bytes leftover after parsing attributes in process `syz.3.2446'. [ 512.112042][T15538] gretap1: left allmulticast mode [ 512.136162][T15538] geneve2: left allmulticast mode [ 512.272620][T15538] mac80211_hwsim hwsim8 syzkaller0: left promiscuous mode [ 512.323791][T15538] mac80211_hwsim hwsim8 syzkaller0: left allmulticast mode [ 512.591258][T15577] netlink: 209808 bytes leftover after parsing attributes in process `syz.4.2449'. [ 512.631484][T15579] netlink: 209808 bytes leftover after parsing attributes in process `syz.4.2449'. [ 512.998136][T15595] netlink: 4 bytes leftover after parsing attributes in process `syz.3.2455'. [ 513.022782][ T5630] Bluetooth: hci4: command 0x0405 tx timeout [ 513.029600][T15591] veth0_macvtap: entered allmulticast mode [ 513.031908][T15591] net_ratelimit: 37 callbacks suppressed [ 513.031961][T15591] A link change request failed with some changes committed already. Interface veth0_macvtap may have been left with an inconsistent configuration, please check. [ 513.087383][ T29] bond1: (slave ip6gretap1): failed to get link speed/duplex [ 513.237930][ T29] bond1: (slave ip6gretap1): failed to get link speed/duplex [ 513.375415][ T29] bond1: (slave ip6gretap1): failed to get link speed/duplex [ 513.486002][T15615] netlink: 'syz.3.2460': attribute type 1 has an invalid length. [ 513.509467][T15615] netlink: 'syz.3.2460': attribute type 3 has an invalid length. [ 513.523462][T15615] netlink: 224 bytes leftover after parsing attributes in process `syz.3.2460'. [ 513.538062][ T29] bond1: (slave ip6gretap1): failed to get link speed/duplex [ 513.656963][T15620] syzkaller1: entered promiscuous mode [ 513.666046][T15620] syzkaller1: entered allmulticast mode [ 513.678370][ T29] bond1: (slave ip6gretap1): failed to get link speed/duplex [ 513.797833][ T6361] bond1: (slave ip6gretap1): failed to get link speed/duplex [ 513.908113][ T6361] bond1: (slave ip6gretap1): failed to get link speed/duplex [ 514.038489][ T6361] bond1: (slave ip6gretap1): failed to get link speed/duplex [ 514.227825][ T13] bond1: (slave ip6gretap1): failed to get link speed/duplex [ 514.513176][T15649] netlink: 28 bytes leftover after parsing attributes in process `syz.0.2472'. [ 514.522805][T15649] netlink: 28 bytes leftover after parsing attributes in process `syz.0.2472'. [ 514.532418][T15649] netlink: 8 bytes leftover after parsing attributes in process `syz.0.2472'. [ 514.703373][T15653] netlink: 120 bytes leftover after parsing attributes in process `syz.0.2474'. [ 514.712772][T15653] netlink: 'syz.0.2474': attribute type 1 has an invalid length. [ 514.721168][T15653] netlink: 64 bytes leftover after parsing attributes in process `syz.0.2474'. [ 515.537392][T15671] netlink: 12 bytes leftover after parsing attributes in process `syz.2.2478'. [ 516.038093][T15683] netlink: 12 bytes leftover after parsing attributes in process `syz.2.2483'. [ 516.128632][T15688] netlink: 4 bytes leftover after parsing attributes in process `syz.4.2485'. [ 516.153429][T15690] netlink: 212368 bytes leftover after parsing attributes in process `syz.1.2484'. [ 516.338648][T15680] syzkaller1: entered promiscuous mode [ 516.346086][T15680] syzkaller1: entered allmulticast mode [ 516.415124][T15683] veth11: entered allmulticast mode [ 516.453740][T15683] bond6: (slave veth11): Enslaving as an active interface with an up link [ 517.112346][T15720] netlink: 'syz.2.2493': attribute type 10 has an invalid length. [ 518.027897][T15758] netlink: 'syz.1.2502': attribute type 10 has an invalid length. [ 518.086808][T15759] net_ratelimit: 26 callbacks suppressed [ 518.086829][T15759] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 518.437828][ T13] bond1: (slave ip6gretap1): failed to get link speed/duplex [ 518.768073][ T29] bond1: (slave ip6gretap1): failed to get link speed/duplex [ 518.903166][T15781] netlink: 'syz.3.2508': attribute type 13 has an invalid length. [ 518.913262][ T180] bond1: (slave ip6gretap1): failed to get link speed/duplex [ 519.034157][T15784] sch_tbf: burst 6 is lower than device gretap0 mtu (1476) ! [ 519.098162][ T180] bond1: (slave ip6gretap1): failed to get link speed/duplex [ 519.238015][ T180] bond1: (slave ip6gretap1): failed to get link speed/duplex [ 519.257256][T15791] __nla_validate_parse: 2 callbacks suppressed [ 519.257276][T15791] netlink: 8 bytes leftover after parsing attributes in process `syz.1.2512'. [ 519.330047][T15794] syzkaller1: entered promiscuous mode [ 519.354917][T15794] syzkaller1: entered allmulticast mode [ 519.407071][T15794] netlink: 32 bytes leftover after parsing attributes in process `syz.4.2513'. [ 519.418315][ T1170] bond1: (slave ip6gretap1): failed to get link speed/duplex [ 519.464386][T15795] netlink: 32 bytes leftover after parsing attributes in process `syz.4.2513'. [ 519.718110][ T6361] bond1: (slave ip6gretap1): failed to get link speed/duplex [ 519.867946][ T54] bond1: (slave ip6gretap1): failed to get link speed/duplex [ 520.019528][ T180] bond1: (slave ip6gretap1): failed to get link speed/duplex [ 520.191925][T15831] netlink: 32 bytes leftover after parsing attributes in process `syz.2.2522'. [ 520.241880][T15833] netlink: 8 bytes leftover after parsing attributes in process `syz.3.2519'. [ 520.267346][T15825] netlink: 28 bytes leftover after parsing attributes in process `syz.1.2520'. [ 520.286623][T15825] netlink: 8 bytes leftover after parsing attributes in process `syz.1.2520'. [ 520.293990][T15833] netlink: 168 bytes leftover after parsing attributes in process `syz.3.2519'. [ 520.319234][T15825] netlink: 20 bytes leftover after parsing attributes in process `syz.1.2520'. [ 520.329916][T15833] netlink: 8 bytes leftover after parsing attributes in process `syz.3.2519'. [ 520.528462][T15836] xt_CT: No such helper "snmp_trap" [ 520.660054][T15845] GUP no longer grows the stack in syz.0.2526 (15845): 200000003000-20000000a000 (200000001000) [ 520.671625][T15845] CPU: 1 UID: 0 PID: 15845 Comm: syz.0.2526 Not tainted syzkaller #0 PREEMPT(full) [ 520.671655][T15845] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 520.671669][T15845] Call Trace: [ 520.671677][T15845] [ 520.671686][T15845] dump_stack_lvl+0xe8/0x150 [ 520.671719][T15845] __get_user_pages+0x238c/0x2720 [ 520.671778][T15845] ? down_read_killable+0x1bb/0x340 [ 520.671827][T15845] __gup_longterm_locked+0xd52/0x15c0 [ 520.671860][T15845] ? lock_acquire+0x106/0x350 [ 520.671908][T15845] gup_fast_fallback+0x1d82/0x20d0 [ 520.671975][T15845] ? __pfx_gup_fast_fallback+0x10/0x10 [ 520.672003][T15845] ? futex_unqueue+0x22/0x240 [ 520.672065][T15845] ? is_valid_gup_args+0x11f/0x200 [ 520.672094][T15845] ? get_user_pages_fast+0x4d/0xb0 [ 520.672125][T15845] __iov_iter_get_pages_alloc+0x378/0xa40 [ 520.672159][T15845] ? __pfx_pipe_clear_nowait+0x10/0x10 [ 520.672207][T15845] iov_iter_get_pages2+0x5e/0xa0 [ 520.672237][T15845] __se_sys_vmsplice+0x7b5/0x1660 [ 520.672291][T15845] ? __pfx___se_sys_vmsplice+0x10/0x10 [ 520.672324][T15845] ? __pfx_futex_wait+0x10/0x10 [ 520.672392][T15845] ? put_files_struct+0x24f/0x350 [ 520.672454][T15845] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 520.672478][T15845] do_syscall_64+0x174/0x580 [ 520.672504][T15845] ? clear_bhb_loop+0x40/0x90 [ 520.672529][T15845] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 520.672547][T15845] RIP: 0033:0x7f9c15d9ce59 [ 520.672566][T15845] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 520.672585][T15845] RSP: 002b:00007f9c16d0a028 EFLAGS: 00000246 ORIG_RAX: 0000000000000116 [ 520.672606][T15845] RAX: ffffffffffffffda RBX: 00007f9c16015fa0 RCX: 00007f9c15d9ce59 [ 520.672622][T15845] RDX: 0000000000000001 RSI: 00002000000000c0 RDI: 0000000000000008 [ 520.672635][T15845] RBP: 00007f9c15e32d6f R08: 0000000000000000 R09: 0000000000000000 [ 520.672649][T15845] R10: 0000000000000001 R11: 0000000000000246 R12: 0000000000000000 [ 520.672661][T15845] R13: 00007f9c16016038 R14: 00007f9c16015fa0 R15: 00007ffcfe523498 [ 520.672699][T15845] [ 520.990106][T15852] netlink: 'syz.3.2528': attribute type 10 has an invalid length. [ 523.097993][ T54] net_ratelimit: 1 callbacks suppressed [ 523.098015][ T54] bond1: (slave ip6gretap1): failed to get link speed/duplex [ 523.238205][ T54] bond1: (slave ip6gretap1): failed to get link speed/duplex [ 523.489496][ T54] bond1: (slave ip6gretap1): failed to get link speed/duplex [ 523.619181][ T1170] bond1: (slave ip6gretap1): failed to get link speed/duplex [ 523.769593][ T13] bond1: (slave ip6gretap1): failed to get link speed/duplex [ 523.910190][ T54] bond1: (slave ip6gretap1): failed to get link speed/duplex [ 524.057894][ T54] bond1: (slave ip6gretap1): failed to get link speed/duplex [ 524.198200][ T6361] bond1: (slave ip6gretap1): failed to get link speed/duplex [ 524.228312][T15899] netlink: 'syz.0.2540': attribute type 2 has an invalid length. [ 524.273688][T15899] netlink: 'syz.0.2540': attribute type 1 has an invalid length. [ 524.310556][T15899] netlink: 'syz.0.2540': attribute type 1 has an invalid length. [ 524.337989][ T1170] bond1: (slave ip6gretap1): failed to get link speed/duplex [ 524.402764][T15899] netlink: 'syz.0.2540': attribute type 2 has an invalid length. [ 524.489210][ T54] bond1: (slave ip6gretap1): failed to get link speed/duplex [ 524.520717][T15899] netlink: 'syz.0.2540': attribute type 1 has an invalid length. [ 524.592969][T15899] netlink: 'syz.0.2540': attribute type 2 has an invalid length. [ 524.753833][T15919] __nla_validate_parse: 7 callbacks suppressed [ 524.753884][T15919] netlink: 4 bytes leftover after parsing attributes in process `syz.2.2544'. [ 525.522552][T15939] bridge0: port 1(vxlan0) entered disabled state [ 525.556919][T15940] lo: entered promiscuous mode [ 525.570915][T15940] tunl0: entered promiscuous mode [ 525.578168][T15940] gre0: entered promiscuous mode [ 525.599061][T15940] gretap0: entered promiscuous mode [ 525.608047][T15940] erspan0: entered promiscuous mode [ 525.621014][T15940] ip_vti0: entered promiscuous mode [ 525.630491][T15940] ip6_vti0: entered promiscuous mode [ 525.644386][T15940] sit0: entered promiscuous mode [ 525.653681][T15940] ip6tnl0: entered promiscuous mode [ 525.662051][T15940] ip6gre0: entered promiscuous mode [ 525.673745][T15940] ip6gretap0: entered promiscuous mode [ 525.682278][T15940] bond0: entered promiscuous mode [ 525.689495][T15940] team0: entered promiscuous mode [ 525.695963][T15940] dummy0: entered promiscuous mode [ 525.702834][T15940] nlmon0: entered promiscuous mode [ 525.709661][T15940] veth0: entered promiscuous mode [ 525.716252][T15940] veth1: entered promiscuous mode [ 525.723943][T15940] wg0: entered promiscuous mode [ 525.730640][T15940] wg2: entered promiscuous mode [ 525.737038][T15940] veth0_to_bridge: entered promiscuous mode [ 525.769994][T15940] bridge_slave_0: entered promiscuous mode [ 525.788687][T15940] veth1_to_bridge: entered promiscuous mode [ 525.804372][T15940] bridge_slave_1: entered promiscuous mode [ 525.834205][T15940] veth0_to_bond: entered promiscuous mode [ 525.861441][T15940] bond_slave_0: entered promiscuous mode [ 525.877562][T15940] veth1_to_bond: entered promiscuous mode [ 525.892452][T15940] bond_slave_1: entered promiscuous mode [ 525.909925][T15940] veth1_to_team: entered promiscuous mode [ 525.917491][T15940] team_slave_1: entered promiscuous mode [ 525.935322][T15940] veth0_to_batadv: entered promiscuous mode [ 525.946296][T15940] batadv_slave_0: entered promiscuous mode [ 525.966210][T15940] veth1_to_batadv: entered promiscuous mode [ 525.996333][T15940] batadv_slave_1: entered promiscuous mode [ 526.014461][T15940] xfrm0: entered promiscuous mode [ 526.021745][T15940] veth0_to_hsr: entered promiscuous mode [ 526.039869][T15940] hsr0: entered promiscuous mode [ 526.056881][T15940] vlan0: entered promiscuous mode [ 526.072045][T15940] vlan1: entered promiscuous mode [ 526.083650][T15940] macvlan0: entered promiscuous mode [ 526.091759][T15940] macvlan1: entered promiscuous mode [ 526.101216][T15940] ipvlan0: entered promiscuous mode [ 526.108741][T15940] ipvlan1: entered promiscuous mode [ 526.126012][T15940] macvtap0: entered promiscuous mode [ 526.140433][T15940] macsec0: entered promiscuous mode [ 526.154557][T15940] geneve0: entered promiscuous mode [ 526.165767][T15940] geneve1: entered promiscuous mode [ 526.176097][T15940] netdevsim netdevsim0 netdevsim0: entered promiscuous mode [ 526.187695][T15940] netdevsim netdevsim0 netdevsim1: entered promiscuous mode [ 526.199649][T15940] netdevsim netdevsim0 netdevsim2: entered promiscuous mode [ 526.214595][T15940] netdevsim netdevsim0 netdevsim3: entered promiscuous mode [ 526.226594][T15940] mac80211_hwsim hwsim8 wlan0: entered promiscuous mode [ 526.237109][T15940] mac80211_hwsim hwsim11 wlan1: entered promiscuous mode [ 526.247295][T15940] mac80211_hwsim hwsim13 wlan2: entered promiscuous mode [ 526.260861][T15940] erspan1: entered promiscuous mode [ 526.270602][T15940] bond1: entered promiscuous mode [ 526.276492][T15940] ip6gretap1: entered promiscuous mode [ 526.286460][T15940] veth3: entered promiscuous mode [ 526.300751][T15940] veth2: entered promiscuous mode [ 526.313946][T15940] mac80211_hwsim hwsim15 wlan3: entered promiscuous mode [ 526.326703][T15940] vlan2: entered promiscuous mode [ 526.336559][T15940] bridge1: entered promiscuous mode [ 526.351207][T15940] veth4: entered promiscuous mode [ 526.358577][T15940] veth5: entered promiscuous mode [ 526.367041][T15940] bond2: entered promiscuous mode [ 526.373989][T15940] veth7: entered promiscuous mode [ 526.389647][T15940] veth6: entered promiscuous mode [ 526.404556][T15940] veth8: entered promiscuous mode [ 526.412375][T15940] veth9: entered promiscuous mode [ 526.421501][T15940] bond3: entered promiscuous mode [ 526.432316][T15940] mac80211_hwsim hwsim22 wlan4: entered promiscuous mode [ 526.441498][T15940] mac80211_hwsim hwsim24 wlan5: entered promiscuous mode [ 526.453848][T15940] bridge0: port 1(vxlan0) entered blocking state [ 526.461249][T15940] bridge0: port 1(vxlan0) entered listening state [ 526.470744][T15940] gretap1: entered promiscuous mode [ 526.483722][T15940] geneve2: entered promiscuous mode [ 526.492837][T15940] bond4: entered promiscuous mode [ 526.501056][T15940] gretap2: entered promiscuous mode [ 526.510337][T15940] bridge2: entered promiscuous mode [ 526.521516][T15940] bond5: entered promiscuous mode [ 526.536262][T15940] sit1: entered promiscuous mode [ 526.547205][T15940] gre1: entered promiscuous mode [ 526.556120][T15940] bridge3: entered promiscuous mode [ 526.565974][T15940] mac80211_hwsim hwsim27 wlan6: entered promiscuous mode [ 526.576830][T15940] netdevsim0.0: entered promiscuous mode [ 526.585518][T15940] bond6: entered promiscuous mode [ 526.595893][T15940] gre2: entered promiscuous mode [ 526.605958][T15940] veth0_to_hsr.2: entered promiscuous mode [ 526.616088][T15940] mac80211_hwsim hwsim8 syzkaller0: entered promiscuous mode [ 526.625978][T15940] veth10: entered promiscuous mode [ 526.632364][T15940] veth11: entered promiscuous mode [ 526.639135][T15940] bond7: entered promiscuous mode [ 526.647405][T15940] ip6erspan0: entered promiscuous mode [ 526.664381][T15940] sit2: entered promiscuous mode [ 526.670866][T15940] 7: entered promiscuous mode [ 526.676538][T15940] bridge4: entered promiscuous mode [ 526.683850][T15940] sit3: entered promiscuous mode [ 526.690436][T15940] macsec1: entered promiscuous mode [ 526.696893][T15940] bridge5: entered promiscuous mode [ 526.705643][T15940] gtp0: entered promiscuous mode [ 526.712074][T15940] bond8: entered promiscuous mode [ 526.718253][T15940] gretap3: entered promiscuous mode [ 526.725174][T15940] mac80211_hwsim hwsim38 wlan7: entered promiscuous mode [ 526.734061][T15940] mac80211_hwsim hwsim39 wlan8: entered promiscuous mode [ 526.746084][T15940] pimreg9: entered promiscuous mode [ 526.753149][T15940] bond10: entered promiscuous mode [ 526.761677][T15940] veth12: entered promiscuous mode [ 526.767676][T15940] veth13: entered promiscuous mode [ 526.776166][T15940] mac80211_hwsim hwsim44 wlan9: entered promiscuous mode [ 526.786867][T15940] bond11: entered promiscuous mode [ 526.795433][T15940] bridge8: entered promiscuous mode [ 526.815089][T15940] syztnl2: entered promiscuous mode [ 526.821414][T15940] bond14: entered promiscuous mode [ 526.827414][T15940] bridge10: entered promiscuous mode [ 527.034866][T15954] tipc: Enabling of bearer rejected, failed to enable media [ 527.074578][T15955] tipc: Enabling of bearer rejected, failed to enable media [ 527.505366][T15977] netlink: 8 bytes leftover after parsing attributes in process `syz.1.2561'. [ 527.704360][T15981] netlink: 'syz.0.2562': attribute type 1 has an invalid length. [ 527.744351][T15981] netlink: 'syz.0.2562': attribute type 2 has an invalid length. [ 527.771313][T15981] netlink: 'syz.0.2562': attribute type 3 has an invalid length. [ 528.106559][T15987] tipc: Enabled bearer , priority 0 [ 528.249878][T15987] syzkaller0: entered promiscuous mode [ 528.255559][T15987] syzkaller0: entered allmulticast mode [ 528.262382][T15987] tipc: Resetting bearer [ 528.303991][T15999] veth0_to_hsr: entered promiscuous mode [ 528.334483][T15999] veth0_to_hsr: left promiscuous mode [ 528.400348][T15986] tipc: Resetting bearer [ 528.409090][T16003] netlink: 72 bytes leftover after parsing attributes in process `syz.0.2569'. [ 529.572369][T16025] netlink: 8 bytes leftover after parsing attributes in process `syz.0.2574'. [ 531.329210][T15986] tipc: Disabling bearer [ 531.344317][ T7454] tipc: Node number set to 4205395079 [ 531.473910][T16027] bridge0: port 1(vxlan0) entered disabled state [ 531.931252][ T5801] lo speed is unknown, defaulting to 1000 [ 531.937109][ T5801] syz2: Port: 1 Link DOWN [ 532.014208][ T13] netdevsim netdevsim0 netdevsim0: unset [0, 0] type 1 family 0 port 8472 - 0 [ 532.052925][ T13] netdevsim netdevsim0 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 532.089009][ T13] netdevsim netdevsim0 netdevsim1: unset [0, 0] type 1 family 0 port 8472 - 0 [ 532.130436][ T13] netdevsim netdevsim0 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 532.178805][ T13] netdevsim netdevsim0 netdevsim2: unset [0, 0] type 1 family 0 port 8472 - 0 [ 532.230873][ T13] netdevsim netdevsim0 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 532.263059][ T13] netdevsim netdevsim0 netdevsim3: unset [0, 0] type 1 family 0 port 8472 - 0 [ 532.286012][ T13] netdevsim netdevsim0 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 532.400567][T16051] netlink: 'syz.4.2581': attribute type 1 has an invalid length. [ 532.592048][T16051] bond3: entered promiscuous mode [ 532.597557][T16051] 8021q: adding VLAN 0 to HW filter on device bond3 [ 532.676969][T16058] bond3: (slave veth13): making interface the new active one [ 532.704450][T16058] veth13: entered promiscuous mode [ 532.744902][T16058] bond3: (slave veth13): Enslaving as an active interface with an up link [ 532.800969][T16072] veth0: entered promiscuous mode [ 533.035733][T16061] lo speed is unknown, defaulting to 1000 [ 533.569853][T16086] netlink: 10 bytes leftover after parsing attributes in process `syz.3.2587'. [ 533.694871][T16090] netlink: 8 bytes leftover after parsing attributes in process `syz.4.2588'. [ 533.947145][T16108] netlink: 28 bytes leftover after parsing attributes in process `syz.0.2590'. [ 534.630633][T16098] tipc: Enabling of bearer rejected, failed to enable media [ 535.072869][T16120] netlink: 64 bytes leftover after parsing attributes in process `syz.0.2595'. [ 537.272344][T16061] lo speed is unknown, defaulting to 1000 [ 537.345342][T16123] netlink: 8 bytes leftover after parsing attributes in process `syz.0.2595'. [ 537.953795][T16139] netlink: 'syz.3.2598': attribute type 10 has an invalid length. [ 537.970004][T16139] netlink: 228 bytes leftover after parsing attributes in process `syz.3.2598'. [ 538.223316][T16161] netlink: 8 bytes leftover after parsing attributes in process `syz.4.2602'. [ 538.987909][T16163] lo speed is unknown, defaulting to 1000 [ 539.373310][T16185] netlink: 24 bytes leftover after parsing attributes in process `syz.3.2606'. [ 539.422898][T16184] netlink: 28 bytes leftover after parsing attributes in process `syz.0.2607'. [ 539.473057][T16184] netlink: 28 bytes leftover after parsing attributes in process `syz.0.2607'. [ 539.506847][T16197] netlink: 212368 bytes leftover after parsing attributes in process `syz.0.2607'. [ 540.143167][T16163] lo speed is unknown, defaulting to 1000 [ 540.781004][T16229] netlink: 8 bytes leftover after parsing attributes in process `syz.4.2618'. [ 541.425820][T16256] netlink: 'syz.1.2623': attribute type 30 has an invalid length. [ 541.584064][T16256] bond4: option arp_missed_max: invalid value (0) [ 541.591063][T16256] bond4: option arp_missed_max: allowed values 1 - 255 [ 541.603849][T16256] bond4 (unregistering): Released all slaves [ 541.955883][T16274] sctp: [Deprecated]: syz.1.2628 (pid 16274) Use of int in max_burst socket option. [ 541.955883][T16274] Use struct sctp_assoc_value instead [ 541.974976][T16271] mac80211_hwsim hwsim8 syzkaller0: entered allmulticast mode [ 542.020037][T16271] netlink: 'syz.0.2627': attribute type 3 has an invalid length. [ 542.617947][T16294] netlink: 8 bytes leftover after parsing attributes in process `syz.2.2635'. [ 542.639625][T16300] netlink: 44 bytes leftover after parsing attributes in process `syz.0.2632'. [ 542.709633][T16300] netlink: 192 bytes leftover after parsing attributes in process `syz.0.2632'. [ 542.795169][T16300] netlink: 44 bytes leftover after parsing attributes in process `syz.0.2632'. [ 543.260961][ T6366] netdevsim netdevsim2 netdevsim0: unset [0, 0] type 1 family 0 port 8472 - 0 [ 543.296703][ T6366] netdevsim netdevsim2 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 543.327465][ T6366] netdevsim netdevsim2 netdevsim1: unset [0, 0] type 1 family 0 port 8472 - 0 [ 543.362875][ T6366] netdevsim netdevsim2 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 543.414813][ T6366] netdevsim netdevsim2 netdevsim2: unset [0, 0] type 1 family 0 port 8472 - 0 [ 543.461716][ T6366] netdevsim netdevsim2 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 543.511149][ T6366] netdevsim netdevsim2 netdevsim3: unset [0, 0] type 1 family 0 port 8472 - 0 [ 543.554195][ T6366] netdevsim netdevsim2 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 543.713435][T16327] netlink: 'syz.0.2639': attribute type 5 has an invalid length. [ 544.075545][T16342] netlink: 804 bytes leftover after parsing attributes in process `syz.1.2644'. [ 544.541335][T16359] lo: left promiscuous mode [ 544.611723][T16359] tunl0: left promiscuous mode [ 544.657585][T16359] gre0: left promiscuous mode [ 544.702152][T16359] gretap0: left promiscuous mode [ 544.740300][T16359] ip_vti0: left promiscuous mode [ 544.760123][T16359] ip6_vti0: left promiscuous mode [ 544.782083][T16359] sit0: left promiscuous mode [ 544.806288][T16359] ip6tnl0: left promiscuous mode [ 544.822512][T16359] ip6gre0: left promiscuous mode [ 544.856105][T16359] ip6gretap0: left promiscuous mode [ 544.918542][T16359] bond0: left promiscuous mode [ 544.970211][T16359] team0: left promiscuous mode [ 544.990369][T16359] 8021q: adding VLAN 0 to HW filter on device team0 [ 545.040536][T16359] dummy0: left promiscuous mode [ 545.091239][T16359] nlmon0: left promiscuous mode [ 545.123740][T16359] veth0: left promiscuous mode [ 545.175525][T16359] veth1: left promiscuous mode [ 545.202190][T16359] wg0: left promiscuous mode [ 545.240887][T16359] wg2: left promiscuous mode [ 545.281401][T16359] veth0_to_bridge: left promiscuous mode [ 545.325593][T16359] bridge_slave_0: left promiscuous mode [ 545.363381][T16359] veth1_to_bridge: left promiscuous mode [ 545.415656][T16359] bridge_slave_1: left promiscuous mode [ 545.439206][T16359] veth0_to_bond: left promiscuous mode [ 545.502448][T16359] bond_slave_0: left promiscuous mode [ 545.517200][T16359] veth1_to_bond: left promiscuous mode [ 545.549912][T16359] bond_slave_1: left promiscuous mode [ 545.579916][T16359] veth1_to_team: left promiscuous mode [ 545.602798][T16359] team_slave_1: left promiscuous mode [ 545.648869][T16359] veth0_to_batadv: left promiscuous mode [ 545.690159][T16359] batadv_slave_0: left promiscuous mode [ 545.754877][T16359] veth1_to_batadv: left promiscuous mode [ 545.781263][T16359] batadv_slave_1: left promiscuous mode [ 545.806128][T16359] xfrm0: left promiscuous mode [ 545.833963][T16359] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 545.883143][T16359] hsr0: left promiscuous mode [ 545.922778][T16359] veth1_vlan: left promiscuous mode [ 545.946789][T16359] vlan0: left promiscuous mode [ 545.969704][T16359] vlan1: left promiscuous mode [ 545.995259][T16359] veth1_vlan: entered promiscuous mode [ 546.013516][T16359] macvlan0: left promiscuous mode [ 546.040228][T16359] macvlan1: left promiscuous mode [ 546.061990][T16359] ipvlan0: left promiscuous mode [ 546.082469][T16359] ipvlan1: left promiscuous mode [ 546.104801][T16359] veth1_macvtap: left promiscuous mode [ 546.129456][T16359] veth0_macvtap: left promiscuous mode [ 546.152945][T16359] veth0_macvtap: entered promiscuous mode [ 546.172952][T16359] macvtap0: left promiscuous mode [ 546.195779][T16359] veth1_macvtap: entered promiscuous mode [ 546.208176][T16359] macsec0: left promiscuous mode [ 546.225027][T16359] geneve0: left promiscuous mode [ 546.237489][T16359] geneve1: left promiscuous mode [ 546.259622][T16359] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 546.281223][T16359] netdevsim netdevsim0 netdevsim1: left promiscuous mode [ 546.298324][T16359] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 546.313660][T16359] netdevsim netdevsim0 netdevsim2: left promiscuous mode [ 546.333008][T16359] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 546.358321][T16359] netdevsim netdevsim0 netdevsim3: left promiscuous mode [ 546.383953][T16359] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 546.412990][T16359] mac80211_hwsim hwsim8 wlan0: left promiscuous mode [ 546.440180][T16359] mac80211_hwsim hwsim11 wlan1: left promiscuous mode [ 546.465837][T16359] mac80211_hwsim hwsim13 wlan2: left promiscuous mode [ 546.496847][T16359] erspan1: left promiscuous mode [ 546.530039][T16359] bond1: left promiscuous mode [ 546.545058][T16359] 8021q: adding VLAN 0 to HW filter on device bond1 [ 546.570326][T16359] ip6gretap1: left promiscuous mode [ 546.588087][ T13] net_ratelimit: 92 callbacks suppressed [ 546.588107][ T13] bond1: (slave ip6gretap1): link status up again after 0 ms [ 546.605454][T16359] veth2: left promiscuous mode [ 546.632658][T16359] veth3: left promiscuous mode [ 546.648449][ T6361] bond1: (slave ip6gretap1): link status up again after 0 ms [ 546.654761][T16359] mac80211_hwsim hwsim15 wlan3: left promiscuous mode [ 546.682980][T16359] vlan2: left promiscuous mode [ 546.691547][ T13] bond1: (slave ip6gretap1): link status up again after 0 ms [ 546.708018][T16359] erspan0: left promiscuous mode [ 546.730112][T16359] bridge1: left promiscuous mode [ 546.749546][ T13] bond1: (slave ip6gretap1): link status up again after 0 ms [ 546.760694][T16359] veth4: left promiscuous mode [ 546.779026][T16359] veth5: left promiscuous mode [ 546.788398][ T13] bond1: (slave ip6gretap1): link status up again after 0 ms [ 546.796920][T16359] bond2: left promiscuous mode [ 546.811188][T16359] 8021q: adding VLAN 0 to HW filter on device bond2 [ 546.828809][ T6361] bond1: (slave ip6gretap1): link status up again after 0 ms [ 546.837421][T16359] veth6: left promiscuous mode [ 546.850240][T16359] veth7: left promiscuous mode [ 546.858377][ T6361] bond1: (slave ip6gretap1): link status up again after 0 ms [ 546.870134][T16359] veth8: left promiscuous mode [ 546.888965][T16359] veth9: left promiscuous mode [ 546.895363][T16359] bond3: left promiscuous mode [ 546.908018][ T6361] bond1: (slave ip6gretap1): link status up again after 0 ms [ 546.915971][T16359] 8021q: adding VLAN 0 to HW filter on device bond3 [ 546.932028][T16359] mac80211_hwsim hwsim22 wlan4: left promiscuous mode [ 546.940862][ T6361] bond1: (slave ip6gretap1): link status up again after 0 ms [ 546.959611][T16359] mac80211_hwsim hwsim24 wlan5: left promiscuous mode [ 546.977914][ T1170] bond1: (slave ip6gretap1): link status up again after 0 ms [ 546.987560][T16359] bridge0: port 1(vxlan0) entered blocking state [ 546.994081][T16359] bridge0: port 1(vxlan0) entered listening state [ 547.018653][T16359] gretap1: left promiscuous mode [ 547.029269][T16359] geneve2: left promiscuous mode [ 547.041120][T16359] bond4: left promiscuous mode [ 547.057657][T16359] 8021q: adding VLAN 0 to HW filter on device bond4 [ 547.077640][T16359] gretap2: left promiscuous mode [ 547.088908][T16359] bridge2: left promiscuous mode [ 547.110580][T16359] bond5: left promiscuous mode [ 547.117335][T16359] 8021q: adding VLAN 0 to HW filter on device bond5 [ 547.139074][T16359] sit1: left promiscuous mode [ 547.209885][T16359] gre1: left promiscuous mode [ 547.229973][T16359] bridge3: left promiscuous mode [ 547.245790][T16359] mac80211_hwsim hwsim27 wlan6: left promiscuous mode [ 547.259624][T16359] netdevsim0.0: left promiscuous mode [ 547.265257][T16359] netdevsim netdevsim0 netdevsim0: left promiscuous mode [ 547.277586][T16359] bond6: left promiscuous mode [ 547.283714][T16359] 8021q: adding VLAN 0 to HW filter on device bond6 [ 547.292182][T16359] gre2: left promiscuous mode [ 547.327396][T16359] veth0_to_hsr.2: left promiscuous mode [ 547.350470][T16359] veth0_to_hsr: left promiscuous mode [ 547.361517][T16359] mac80211_hwsim hwsim8 syzkaller0: left promiscuous mode [ 547.368886][ T7453] lo speed is unknown, defaulting to 1000 [ 547.393162][ T7453] syz2: Port: 1 Link ACTIVE [ 547.442287][T16365] bond2: left promiscuous mode [ 547.470435][T16365] bond3: left promiscuous mode [ 547.484166][T16365] veth13: left promiscuous mode [ 547.699586][ T29] netdevsim netdevsim0 netdevsim0: set [0, 0] type 1 family 0 port 8472 - 0 [ 547.725367][ T29] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 547.803838][ T29] netdevsim netdevsim0 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0 [ 547.838254][ T29] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 547.869039][ T29] netdevsim netdevsim0 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0 [ 547.925280][ T29] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 547.983437][ T29] netdevsim netdevsim0 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0 [ 548.027088][ T29] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 548.504715][T16442] __nla_validate_parse: 1 callbacks suppressed [ 548.504735][T16442] netlink: 20 bytes leftover after parsing attributes in process `syz.0.2658'. [ 549.061462][T16457] batadv_slave_1: entered promiscuous mode [ 549.115368][T16452] batadv_slave_1: left promiscuous mode [ 549.393701][T16479] netlink: 'syz.3.2666': attribute type 8 has an invalid length. [ 549.540031][T16487] netlink: 'syz.0.2668': attribute type 1 has an invalid length. [ 549.620361][T16487] netlink: 'syz.0.2668': attribute type 2 has an invalid length. [ 549.644113][T16492] netlink: 56 bytes leftover after parsing attributes in process `syz.2.2670'. [ 549.707153][T16487] netlink: 'syz.0.2668': attribute type 3 has an invalid length. [ 549.945957][T16498] netlink: 12 bytes leftover after parsing attributes in process `syz.3.2672'. [ 550.129791][T16498] vlan3: entered promiscuous mode [ 550.148766][T16498] bridge0: entered promiscuous mode [ 550.302299][T16515] netlink: 'syz.1.2677': attribute type 21 has an invalid length. [ 550.311767][T16515] netlink: 128 bytes leftover after parsing attributes in process `syz.1.2677'. [ 550.325470][T16512] netlink: 8 bytes leftover after parsing attributes in process `syz.2.2676'. [ 550.718124][T16525] netlink: 48 bytes leftover after parsing attributes in process `syz.1.2677'. [ 551.477035][T16557] netlink: 8 bytes leftover after parsing attributes in process `syz.1.2686'. [ 551.657649][T16568] netlink: 'syz.0.2687': attribute type 2 has an invalid length. [ 551.690406][T16568] netlink: 8 bytes leftover after parsing attributes in process `syz.0.2687'. [ 551.723732][T16568] FAULT_INJECTION: forcing a failure. [ 551.723732][T16568] name failslab, interval 1, probability 0, space 0, times 0 [ 551.771536][T16568] CPU: 1 UID: 0 PID: 16568 Comm: syz.0.2687 Not tainted syzkaller #0 PREEMPT(full) [ 551.771567][T16568] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 551.771579][T16568] Call Trace: [ 551.771588][T16568] [ 551.771597][T16568] dump_stack_lvl+0xe8/0x150 [ 551.771628][T16568] should_fail_ex+0x40c/0x560 [ 551.771670][T16568] should_failslab+0xa8/0x100 [ 551.771695][T16568] __kvmalloc_node_noprof+0x16e/0x890 [ 551.771729][T16568] ? nf_hook_entries_grow+0x287/0x740 [ 551.771844][T16568] ? __pfx___mutex_lock+0x10/0x10 [ 551.771877][T16568] nf_hook_entries_grow+0x287/0x740 [ 551.771920][T16568] __nf_register_net_hook+0x2c9/0x930 [ 551.771960][T16568] nf_register_net_hook+0xb2/0x190 [ 551.771991][T16568] nf_register_net_hooks+0x44/0x1b0 [ 551.772023][T16568] nf_ct_netns_do_get+0x212/0x5c0 [ 551.772086][T16568] ? __pfx_nf_ct_netns_do_get+0x10/0x10 [ 551.772117][T16568] ? synproxy_pernet+0x45/0x270 [ 551.772192][T16568] ? synproxy_pernet+0x45/0x270 [ 551.772223][T16568] ? nf_ct_netns_get+0xe9/0x320 [ 551.772254][T16568] nft_synproxy_do_init+0x1d1/0x4c0 [ 551.772291][T16568] nf_tables_newrule+0x179e/0x28a0 [ 551.772395][T16568] ? __pfx_nf_tables_newrule+0x10/0x10 [ 551.772424][T16568] ? nfnl_pernet+0x23/0x240 [ 551.772481][T16568] ? nfnl_pernet+0x23/0x240 [ 551.772526][T16568] ? __nla_parse+0x40/0x60 [ 551.772586][T16568] nfnetlink_rcv+0x1288/0x28c0 [ 551.772661][T16568] ? __pfx_nfnetlink_rcv+0x10/0x10 [ 551.772715][T16568] ? ref_tracker_free+0x689/0x830 [ 551.772811][T16568] ? skb_clone+0x246/0x3a0 [ 551.772841][T16568] ? __netlink_deliver_tap+0x811/0x860 [ 551.772878][T16568] ? netlink_deliver_tap+0x2e/0x1b0 [ 551.772901][T16568] ? netlink_deliver_tap+0x2e/0x1b0 [ 551.772933][T16568] netlink_unicast+0x7bb/0x940 [ 551.772982][T16568] netlink_sendmsg+0x813/0xb40 [ 551.773020][T16568] ? __pfx_netlink_sendmsg+0x10/0x10 [ 551.773050][T16568] ? aa_sock_msg_perm+0xf1/0x1b0 [ 551.773086][T16568] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 551.773115][T16568] ? __pfx_netlink_sendmsg+0x10/0x10 [ 551.773143][T16568] ____sys_sendmsg+0x9b9/0xa20 [ 551.773167][T16568] ? __might_fault+0xaf/0x130 [ 551.773205][T16568] ? __pfx_____sys_sendmsg+0x10/0x10 [ 551.773241][T16568] ? import_iovec+0x73/0xa0 [ 551.773273][T16568] ___sys_sendmsg+0x2a5/0x360 [ 551.773296][T16568] ? __lock_acquire+0x683/0x2cd0 [ 551.773325][T16568] ? __pfx____sys_sendmsg+0x10/0x10 [ 551.773394][T16568] ? __fget_files+0x2a/0x420 [ 551.773421][T16568] ? __fget_files+0x3a2/0x420 [ 551.773462][T16568] __x64_sys_sendmsg+0x1bd/0x2a0 [ 551.773491][T16568] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 551.773528][T16568] ? __pfx_ksys_write+0x10/0x10 [ 551.773573][T16568] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 551.773599][T16568] do_syscall_64+0x174/0x580 [ 551.773624][T16568] ? trace_irq_disable+0x3b/0x140 [ 551.773657][T16568] ? clear_bhb_loop+0x40/0x90 [ 551.773686][T16568] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 551.773708][T16568] RIP: 0033:0x7f9c15d9ce59 [ 551.773730][T16568] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 551.773749][T16568] RSP: 002b:00007f9c16d0a028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 551.773773][T16568] RAX: ffffffffffffffda RBX: 00007f9c16015fa0 RCX: 00007f9c15d9ce59 [ 551.773795][T16568] RDX: 0000000024044010 RSI: 0000200000000100 RDI: 0000000000000003 [ 551.773810][T16568] RBP: 00007f9c16d0a090 R08: 0000000000000000 R09: 0000000000000000 [ 551.773824][T16568] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 551.773836][T16568] R13: 00007f9c16016038 R14: 00007f9c16015fa0 R15: 00007ffcfe523498 [ 551.773875][T16568] [ 552.190514][ T54] net_ratelimit: 60 callbacks suppressed [ 552.190575][ T54] bond1: (slave ip6gretap1): failed to get link speed/duplex [ 552.259448][ T29] netdevsim netdevsim1 netdevsim0: unset [0, 0] type 1 family 0 port 8472 - 0 [ 552.268542][ T29] netdevsim netdevsim1 netdevsim1: unset [0, 0] type 1 family 0 port 8472 - 0 [ 552.277457][ T29] netdevsim netdevsim1 netdevsim2: unset [0, 0] type 1 family 0 port 8472 - 0 [ 552.286658][ T29] netdevsim netdevsim1 netdevsim3: unset [0, 0] type 1 family 0 port 8472 - 0 [ 552.427945][T16574] IPVS: set_ctl: invalid protocol: 68 0.0.0.0:20004 [ 552.568732][ T13] bond1: (slave ip6gretap1): failed to get link speed/duplex [ 552.768023][ T13] bond1: (slave ip6gretap1): failed to get link speed/duplex [ 552.887992][ T6366] bond1: (slave ip6gretap1): failed to get link speed/duplex [ 552.980808][T16603] netlink: 8 bytes leftover after parsing attributes in process `syz.3.2692'. [ 553.008022][ T6366] bond1: (slave ip6gretap1): failed to get link speed/duplex [ 553.183446][T16612] FAULT_INJECTION: forcing a failure. [ 553.183446][T16612] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 553.219332][T16612] CPU: 1 UID: 0 PID: 16612 Comm: syz.1.2696 Not tainted syzkaller #0 PREEMPT(full) [ 553.219364][T16612] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 553.219378][T16612] Call Trace: [ 553.219386][T16612] [ 553.219396][T16612] dump_stack_lvl+0xe8/0x150 [ 553.219428][T16612] should_fail_ex+0x40c/0x560 [ 553.219470][T16612] _copy_from_user+0x2d/0xb0 [ 553.219498][T16612] ___sys_sendmsg+0x1c6/0x360 [ 553.219523][T16612] ? __lock_acquire+0x683/0x2cd0 [ 553.219552][T16612] ? __pfx____sys_sendmsg+0x10/0x10 [ 553.219582][T16612] ? kstrtouint+0x6e/0xe0 [ 553.219751][T16612] ? __fget_files+0x2a/0x420 [ 553.219777][T16612] ? __fget_files+0x3a2/0x420 [ 553.219814][T16612] __sys_sendmmsg+0x27c/0x4e0 [ 553.219844][T16612] ? __pfx___sys_sendmmsg+0x10/0x10 [ 553.219865][T16612] ? __mutex_unlock_slowpath+0x1be/0x6f0 [ 553.219922][T16612] ? ksys_write+0x242/0x270 [ 553.219956][T16612] ? __pfx_ksys_write+0x10/0x10 [ 553.219995][T16612] __x64_sys_sendmmsg+0xa0/0xc0 [ 553.220019][T16612] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 553.220042][T16612] do_syscall_64+0x174/0x580 [ 553.220066][T16612] ? trace_irq_disable+0x3b/0x140 [ 553.220099][T16612] ? clear_bhb_loop+0x40/0x90 [ 553.220125][T16612] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 553.220146][T16612] RIP: 0033:0x7f188179ce59 [ 553.220166][T16612] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 553.220185][T16612] RSP: 002b:00007f1882588028 EFLAGS: 00000246 ORIG_RAX: 0000000000000133 [ 553.220207][T16612] RAX: ffffffffffffffda RBX: 00007f1881a15fa0 RCX: 00007f188179ce59 [ 553.220223][T16612] RDX: 0000000000034000 RSI: 0000200000004380 RDI: 0000000000000006 [ 553.220238][T16612] RBP: 00007f1882588090 R08: 0000000000000000 R09: 0000000000000000 [ 553.220251][T16612] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 553.220264][T16612] R13: 00007f1881a16038 R14: 00007f1881a15fa0 R15: 00007fff7cad49b8 [ 553.220298][T16612] [ 553.239613][ T6366] bond1: (slave ip6gretap1): failed to get link speed/duplex [ 553.948090][ T29] bond1: (slave ip6gretap1): failed to get link speed/duplex [ 553.994371][T16622] netlink: 8 bytes leftover after parsing attributes in process `syz.0.2700'. [ 554.331918][T16630] bridge0: port 1(vxlan0) entered disabled state [ 554.624292][T16630] veth0_vlan: left promiscuous mode [ 554.704727][T16656] FAULT_INJECTION: forcing a failure. [ 554.704727][T16656] name failslab, interval 1, probability 0, space 0, times 0 [ 554.718055][T16656] CPU: 1 UID: 0 PID: 16656 Comm: syz.1.2707 Not tainted syzkaller #0 PREEMPT(full) [ 554.718083][T16656] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 554.718097][T16656] Call Trace: [ 554.718105][T16656] [ 554.718114][T16656] dump_stack_lvl+0xe8/0x150 [ 554.718145][T16656] should_fail_ex+0x40c/0x560 [ 554.718185][T16656] should_failslab+0xa8/0x100 [ 554.718208][T16656] kmem_cache_alloc_node_noprof+0x8f/0x680 [ 554.718238][T16656] ? __alloc_skb+0x189/0x7a0 [ 554.718272][T16656] ? __alloc_skb+0x1d7/0x7a0 [ 554.718302][T16656] ? __local_bh_enable_ip+0xd0/0x130 [ 554.718369][T16656] __alloc_skb+0x1d7/0x7a0 [ 554.718404][T16656] sock_wmalloc+0xb2/0x130 [ 554.718430][T16656] pppol2tp_sendmsg+0x17d/0x610 [ 554.718567][T16656] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 554.718596][T16656] ? __pfx_pppol2tp_sendmsg+0x10/0x10 [ 554.718627][T16656] ____sys_sendmsg+0x9b9/0xa20 [ 554.718650][T16656] ? __might_fault+0xaf/0x130 [ 554.718690][T16656] ? __pfx_____sys_sendmsg+0x10/0x10 [ 554.718725][T16656] ? import_iovec+0x73/0xa0 [ 554.718766][T16656] ___sys_sendmsg+0x2a5/0x360 [ 554.718788][T16656] ? __lock_acquire+0x683/0x2cd0 [ 554.718833][T16656] ? __pfx____sys_sendmsg+0x10/0x10 [ 554.718864][T16656] ? kstrtouint+0x6e/0xe0 [ 554.718927][T16656] ? __fget_files+0x2a/0x420 [ 554.718953][T16656] ? __fget_files+0x3a2/0x420 [ 554.718998][T16656] __sys_sendmmsg+0x27c/0x4e0 [ 554.719028][T16656] ? __pfx___sys_sendmmsg+0x10/0x10 [ 554.719049][T16656] ? __mutex_unlock_slowpath+0x1be/0x6f0 [ 554.719106][T16656] ? ksys_write+0x242/0x270 [ 554.719141][T16656] ? __pfx_ksys_write+0x10/0x10 [ 554.719182][T16656] __x64_sys_sendmmsg+0xa0/0xc0 [ 554.719206][T16656] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 554.719230][T16656] do_syscall_64+0x174/0x580 [ 554.719255][T16656] ? trace_irq_disable+0x3b/0x140 [ 554.719287][T16656] ? clear_bhb_loop+0x40/0x90 [ 554.719315][T16656] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 554.719337][T16656] RIP: 0033:0x7f188179ce59 [ 554.719358][T16656] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 554.719378][T16656] RSP: 002b:00007f1882588028 EFLAGS: 00000246 ORIG_RAX: 0000000000000133 [ 554.719401][T16656] RAX: ffffffffffffffda RBX: 00007f1881a15fa0 RCX: 00007f188179ce59 [ 554.719418][T16656] RDX: 0000000000034000 RSI: 0000200000004380 RDI: 0000000000000006 [ 554.719432][T16656] RBP: 00007f1882588090 R08: 0000000000000000 R09: 0000000000000000 [ 554.719446][T16656] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 554.719459][T16656] R13: 00007f1881a16038 R14: 00007f1881a15fa0 R15: 00007fff7cad49b8 [ 554.719495][T16656] [ 555.313082][ T7483] lo speed is unknown, defaulting to 1000 [ 555.322755][ T7483] syz2: Port: 1 Link DOWN [ 555.428299][T16636] syzkaller0: entered promiscuous mode [ 555.436249][T16636] syzkaller0: entered allmulticast mode [ 557.788861][ T29] netdevsim netdevsim0 netdevsim0: unset [0, 0] type 1 family 0 port 8472 - 0 [ 557.797863][ T29] netdevsim netdevsim0 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 557.806842][ T29] netdevsim netdevsim0 netdevsim1: unset [0, 0] type 1 family 0 port 8472 - 0 [ 557.816382][ T29] netdevsim netdevsim0 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 557.838371][ T29] netdevsim netdevsim0 netdevsim2: unset [0, 0] type 1 family 0 port 8472 - 0 [ 557.858059][ T29] netdevsim netdevsim0 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 557.897224][ T29] netdevsim netdevsim0 netdevsim3: unset [0, 0] type 1 family 0 port 8472 - 0 [ 557.952225][ T29] netdevsim netdevsim0 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 558.300310][T16699] netlink: 24 bytes leftover after parsing attributes in process `syz.2.2716'. [ 558.480670][T16699] netlink: 'syz.2.2716': attribute type 10 has an invalid length. [ 558.505223][T16699] netlink: 40 bytes leftover after parsing attributes in process `syz.2.2716'. [ 558.530490][T16699] team0: Port device geneve1 added [ 558.539792][ T29] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 558.567266][T16703] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 558.589634][ T29] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 558.614054][ T29] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 558.627477][ T29] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 558.905106][T16725] netlink: 8 bytes leftover after parsing attributes in process `syz.3.2719'. [ 560.001711][T16764] netlink: 8 bytes leftover after parsing attributes in process `syz.2.2728'. [ 560.047833][T16764] netlink: 8 bytes leftover after parsing attributes in process `syz.2.2728'. [ 560.221863][T16757] lo speed is unknown, defaulting to 1000 [ 560.709238][ T5630] Bluetooth: hci5: unexpected cc 0x0c03 length: 249 > 1 [ 560.722832][ T5630] Bluetooth: hci5: unexpected cc 0x1003 length: 249 > 9 [ 560.731084][ T5630] Bluetooth: hci5: unexpected cc 0x1001 length: 249 > 9 [ 560.739628][ T5630] Bluetooth: hci5: unexpected cc 0x0c23 length: 249 > 4 [ 560.755551][ T5630] Bluetooth: hci5: unexpected cc 0x0c38 length: 249 > 2 [ 561.347026][T16787] netlink: 12 bytes leftover after parsing attributes in process `syz.2.2734'. [ 561.465758][T16794] netlink: 24 bytes leftover after parsing attributes in process `syz.3.2735'. [ 561.704078][T16803] netlink: 8 bytes leftover after parsing attributes in process `syz.2.2737'. [ 561.729482][T16803] netlink: 8 bytes leftover after parsing attributes in process `syz.2.2737'. [ 561.786855][T16757] lo speed is unknown, defaulting to 1000 [ 562.078305][T16811] netlink: 1056 bytes leftover after parsing attributes in process `syz.2.2740'. [ 562.094310][T16811] netlink: 104 bytes leftover after parsing attributes in process `syz.2.2740'. [ 562.590785][T16775] lo speed is unknown, defaulting to 1000 [ 562.859783][ T1317] ieee802154 phy0 wpan0: encryption failed: -22 [ 562.868957][ T7894] Bluetooth: hci5: command tx timeout [ 562.981119][T16836] sch_fq: defrate 4294967293 ignored. [ 563.373386][T16849] FAULT_INJECTION: forcing a failure. [ 563.373386][T16849] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 563.400292][T16849] CPU: 1 UID: 0 PID: 16849 Comm: syz.1.2748 Not tainted syzkaller #0 PREEMPT(full) [ 563.400334][T16849] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 563.400348][T16849] Call Trace: [ 563.400357][T16849] [ 563.400366][T16849] dump_stack_lvl+0xe8/0x150 [ 563.400397][T16849] should_fail_ex+0x40c/0x560 [ 563.400439][T16849] _copy_from_user+0x2d/0xb0 [ 563.400467][T16849] kstrtouint_from_user+0xd6/0x180 [ 563.400505][T16849] ? __pfx_kstrtouint_from_user+0x10/0x10 [ 563.400559][T16849] proc_fail_nth_write+0x8e/0x210 [ 563.400591][T16849] ? __pfx_proc_fail_nth_write+0x10/0x10 [ 563.400629][T16849] ? __pfx_proc_fail_nth_write+0x10/0x10 [ 563.400657][T16849] vfs_write+0x296/0xba0 [ 563.400699][T16849] ? __pfx_vfs_write+0x10/0x10 [ 563.400734][T16849] ? __fget_files+0x2a/0x420 [ 563.400767][T16849] ? __fget_files+0x3a2/0x420 [ 563.400792][T16849] ? __fget_files+0x2a/0x420 [ 563.400829][T16849] ksys_write+0x150/0x270 [ 563.400865][T16849] ? __pfx_ksys_write+0x10/0x10 [ 563.400907][T16849] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 563.400933][T16849] do_syscall_64+0x174/0x580 [ 563.400962][T16849] ? clear_bhb_loop+0x40/0x90 [ 563.400990][T16849] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 563.401012][T16849] RIP: 0033:0x7f188175d68e [ 563.401032][T16849] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 563.401051][T16849] RSP: 002b:00007f1882587fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 563.401075][T16849] RAX: ffffffffffffffda RBX: 00007f18825886c0 RCX: 00007f188175d68e [ 563.401092][T16849] RDX: 0000000000000001 RSI: 00007f18825880a0 RDI: 0000000000000004 [ 563.401106][T16849] RBP: 00007f1882588090 R08: 0000000000000000 R09: 0000000000000000 [ 563.401119][T16849] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 563.401132][T16849] R13: 00007f1881a16038 R14: 00007f1881a15fa0 R15: 00007fff7cad49b8 [ 563.401178][T16849] [ 563.405723][T16837] syzkaller0: entered promiscuous mode [ 563.635113][T16837] syzkaller0: entered allmulticast mode [ 564.947913][ T7894] Bluetooth: hci5: command tx timeout [ 566.235599][T16853] hsr0: A HSR master's MTU cannot be greater than the smallest MTU of its slaves minus the HSR Tag length (6 octets). [ 566.269412][T16775] lo speed is unknown, defaulting to 1000 [ 566.316208][T16864] netlink: 16 bytes leftover after parsing attributes in process `syz.2.2751'. [ 566.410587][ T6366] vxlan0: left allmulticast mode [ 566.426768][ T6366] vxlan0: left promiscuous mode [ 566.455771][ T6366] bridge0: port 1(vxlan0) entered disabled state [ 566.822944][ T6366] pimreg9: left allmulticast mode [ 566.960891][ T6366] bond1 (unregistering): (slave ip6gretap1): Releasing backup interface [ 566.979841][ T6366] bond1 (unregistering): (slave ip6gretap1): the permanent HWaddr of slave - 82:23:89:46:33:df - is still in use by bond - set the HWaddr of slave to a different address to avoid conflicts [ 567.018743][ T7894] Bluetooth: hci5: command tx timeout [ 567.451637][ T6366] bond4 (unregistering): (slave gretap2): Releasing active interface [ 567.460450][ T6366] bond4 (unregistering): (slave gretap2): the permanent HWaddr of slave - e2:e4:5d:80:39:f8 - is still in use by bond - set the HWaddr of slave to a different address to avoid conflicts [ 567.577261][ T6366] bond8 (unregistering): (slave gretap3): Releasing active interface [ 567.708703][ T6366] bond4 (unregistering): (slave bridge2): Releasing active interface [ 567.761253][ T6366] bond9 (unregistering): (slave bridge7): Releasing backup interface [ 567.795866][ T6366] bond12 (unregistering): (slave bridge9): Releasing backup interface [ 567.810475][ T6366] bond14 (unregistering): (slave bridge10): Releasing active interface [ 567.834028][ T6366] bond0 (unregistering): Released all slaves [ 567.848061][ T6366] bond1 (unregistering): (slave veth3): Releasing backup interface [ 567.857334][ T6366] bond1 (unregistering): Released all slaves [ 567.879527][ T6366] bond2 (unregistering): (slave veth7): Releasing active interface [ 567.895330][ T6366] bond2 (unregistering): (slave veth9): Releasing active interface [ 567.905003][ T6366] bond2 (unregistering): Released all slaves [ 567.925381][ T6366] bond3 (unregistering): Released all slaves [ 567.947550][ T6366] bond4 (unregistering): Released all slaves [ 567.978420][ T6366] bond5 (unregistering): Released all slaves [ 567.998603][ T6366] bond6 (unregistering): Released all slaves [ 568.018486][ T6366] bond7 (unregistering): Released all slaves [ 568.042104][ T6366] bond8 (unregistering): Released all slaves [ 568.069702][ T6366] bond9 (unregistering): Released all slaves [ 568.096505][ T6366] bond10 (unregistering): (slave veth13): Releasing active interface [ 568.105972][ T6366] bond10 (unregistering): Released all slaves [ 568.132157][ T6366] bond11 (unregistering): Released all slaves [ 568.154280][ T6366] bond12 (unregistering): Released all slaves [ 568.175453][ T6366] bond13 (unregistering): Released all slaves [ 568.195704][ T6366] bond14 (unregistering): Released all slaves [ 568.281194][T16867] netlink: 8 bytes leftover after parsing attributes in process `syz.2.2752'. [ 568.417529][ T5290] 8021q: adding VLAN 0 to HW filter on device eth1 [ 568.592515][T16900] netlink: 40 bytes leftover after parsing attributes in process `syz.4.2757'. [ 568.670096][T16901] netlink: 48 bytes leftover after parsing attributes in process `syz.3.2758'. [ 568.684769][ T6366] tipc: Left network mode [ 568.736735][T16903] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 569.011978][T16916] netlink: 'syz.1.2761': attribute type 2 has an invalid length. [ 569.021102][T16916] netlink: 8 bytes leftover after parsing attributes in process `syz.1.2761'. [ 569.098016][ T7894] Bluetooth: hci5: command tx timeout [ 569.243384][T16916] FAULT_INJECTION: forcing a failure. [ 569.243384][T16916] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 569.307797][T16916] CPU: 1 UID: 0 PID: 16916 Comm: syz.1.2761 Not tainted syzkaller #0 PREEMPT(full) [ 569.307826][T16916] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 569.307839][T16916] Call Trace: [ 569.307847][T16916] [ 569.307856][T16916] dump_stack_lvl+0xe8/0x150 [ 569.307886][T16916] should_fail_ex+0x40c/0x560 [ 569.307928][T16916] _copy_to_user+0x31/0xb0 [ 569.307959][T16916] simple_read_from_buffer+0xe1/0x170 [ 569.307992][T16916] proc_fail_nth_read+0x1bb/0x230 [ 569.308024][T16916] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 569.308062][T16916] ? rw_verify_area+0x24a/0x4c0 [ 569.308096][T16916] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 569.308124][T16916] vfs_read+0x213/0xa80 [ 569.308160][T16916] ? __pfx___mutex_lock+0x10/0x10 [ 569.308188][T16916] ? __pfx_vfs_read+0x10/0x10 [ 569.308221][T16916] ? __fget_files+0x2a/0x420 [ 569.308252][T16916] ? __fget_files+0x3a2/0x420 [ 569.308289][T16916] ? __fget_files+0x2a/0x420 [ 569.308323][T16916] ksys_read+0x150/0x270 [ 569.308355][T16916] ? __pfx_ksys_read+0x10/0x10 [ 569.308392][T16916] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 569.308414][T16916] do_syscall_64+0x174/0x580 [ 569.308439][T16916] ? clear_bhb_loop+0x40/0x90 [ 569.308464][T16916] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 569.308484][T16916] RIP: 0033:0x7f188175d68e [ 569.308503][T16916] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 569.308521][T16916] RSP: 002b:00007f1882587fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 569.308540][T16916] RAX: ffffffffffffffda RBX: 00007f18825886c0 RCX: 00007f188175d68e [ 569.308555][T16916] RDX: 000000000000000f RSI: 00007f18825880a0 RDI: 0000000000000004 [ 569.308568][T16916] RBP: 00007f1882588090 R08: 0000000000000000 R09: 0000000000000000 [ 569.308580][T16916] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 569.308591][T16916] R13: 00007f1881a16038 R14: 00007f1881a15fa0 R15: 00007fff7cad49b8 [ 569.308625][T16916] [ 570.238586][T16934] lo speed is unknown, defaulting to 1000 [ 570.285545][T16940] netlink: 8 bytes leftover after parsing attributes in process `syz.3.2764'. [ 571.286228][ T5290] 8021q: adding VLAN 0 to HW filter on device eth2 [ 571.699295][T16775] bridge0: port 1(bridge_slave_0) entered blocking state [ 571.741503][T16775] bridge0: port 1(bridge_slave_0) entered disabled state [ 571.761014][T16775] bridge_slave_0: entered allmulticast mode [ 571.778880][T16775] bridge_slave_0: entered promiscuous mode [ 571.815188][T16934] lo speed is unknown, defaulting to 1000 [ 571.823485][T16775] bridge0: port 2(bridge_slave_1) entered blocking state [ 571.860348][T16775] bridge0: port 2(bridge_slave_1) entered disabled state [ 571.876240][T16775] bridge_slave_1: entered allmulticast mode [ 571.894242][T16775] bridge_slave_1: entered promiscuous mode [ 572.203775][T16775] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 572.217011][T16775] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 572.626321][T16775] team0: Port device team_slave_0 added [ 572.714217][T16775] team0: Port device team_slave_1 added [ 572.714918][T17011] netlink: 28 bytes leftover after parsing attributes in process `syz.2.2777'. [ 572.884347][T17017] netlink: 8 bytes leftover after parsing attributes in process `syz.3.2778'. [ 572.937016][T17017] netlink: 'syz.3.2778': attribute type 61 has an invalid length. [ 573.042293][T17017] netlink: 264 bytes leftover after parsing attributes in process `syz.3.2778'. [ 573.083746][T17024] xt_hashlimit: size too large, truncated to 1048576 [ 573.119774][T16775] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 573.141416][T16775] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 573.235267][T16775] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 573.305534][T17018] openvswitch: netlink: Unexpected mask (mask=240, allowed=10048) [ 573.617154][T16775] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 573.642497][T16775] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 573.681946][T16775] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 573.980277][T16775] hsr_slave_0: entered promiscuous mode [ 574.023384][T16775] hsr_slave_1: entered promiscuous mode [ 574.051583][T16775] debugfs: 'hsr0' already exists in 'hsr' [ 574.075272][T16775] Cannot create hsr debugfs directory [ 574.091074][T17040] ip6tnl0: Caught tx_queue_len zero misconfig [ 574.288554][ T5290] 8021q: adding VLAN 0 to HW filter on device eth3 [ 574.460641][T17049] netlink: 4 bytes leftover after parsing attributes in process `syz.2.2784'. [ 574.788096][T17056] netlink: 4 bytes leftover after parsing attributes in process `syz.3.2786'. [ 574.880697][T17065] xt_hashlimit: size too large, truncated to 1048576 [ 575.046076][T17069] netlink: 'syz.2.2789': attribute type 1 has an invalid length. [ 575.370974][T17084] netlink: 'syz.2.2789': attribute type 10 has an invalid length. [ 575.411276][T17084] netlink: 40 bytes leftover after parsing attributes in process `syz.2.2789'. [ 575.512169][T17082] netlink: 12 bytes leftover after parsing attributes in process `syz.3.2791'. [ 575.521506][T17070] bond7: (slave veth15): Enslaving as an active interface with a down link [ 575.646707][T17075] bond7: (slave dummy0): making interface the new active one [ 575.687096][T17075] bond7: (slave dummy0): Enslaving as an active interface with an up link [ 575.924867][T17084] dummy0: entered promiscuous mode [ 575.954387][T17084] bond7: (slave dummy0): Releasing active interface [ 576.321152][T17099] netlink: 8 bytes leftover after parsing attributes in process `syz.3.2794'. [ 576.417158][T17110] netlink: 36 bytes leftover after parsing attributes in process `syz.4.2796'. [ 576.619975][ T5728] lo speed is unknown, defaulting to 1000 [ 576.631414][ T5728] syz0: Port: 1 Link DOWN [ 576.668002][ T6366] hsr_slave_0: left promiscuous mode [ 576.690473][T17121] netlink: 204 bytes leftover after parsing attributes in process `syz.1.2797'. [ 577.035331][T17126] openvswitch: netlink: nsh attribute has 1 unknown bytes. [ 577.466855][T17134] netlink: 'syz.2.2800': attribute type 3 has an invalid length. [ 577.638863][T17110] vlan0: entered promiscuous mode [ 577.644208][T17110] geneve1: entered promiscuous mode [ 577.652660][T17110] vlan0: entered allmulticast mode [ 577.665583][T17110] geneve1: entered allmulticast mode [ 577.677405][ T13] smbdirect: ib_dev[syz2] removed [ 577.707053][ T180] netdevsim netdevsim3 eth0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 577.731436][ T180] netdevsim netdevsim3 eth1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 577.774364][ T5728] lo speed is unknown, defaulting to 1000 [ 577.794803][ T5290] 8021q: adding VLAN 0 to HW filter on device eth4 [ 577.982787][ T180] netdevsim netdevsim3 eth2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 577.991993][ T180] netdevsim netdevsim3 eth3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 578.270531][T17158] __nla_validate_parse: 1 callbacks suppressed [ 578.270551][T17158] netlink: 8 bytes leftover after parsing attributes in process `syz.3.2805'. [ 578.299561][ T180] netdevsim netdevsim2 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 578.315906][T17156] netlink: 8 bytes leftover after parsing attributes in process `syz.4.2804'. [ 578.345024][T17156] netlink: 36 bytes leftover after parsing attributes in process `syz.4.2804'. [ 578.355969][ T180] netdevsim netdevsim2 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 579.298078][ T180] netdevsim netdevsim2 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 579.325841][ T180] netdevsim netdevsim2 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 579.612000][T17176] pimreg: entered allmulticast mode [ 579.690646][ T6366] IPVS: stop unused estimator thread 0... [ 579.748746][T17176] netlink: 8 bytes leftover after parsing attributes in process `syz.4.2807'. [ 580.372896][T17200] netlink: 'syz.3.2813': attribute type 4 has an invalid length. [ 580.594030][T17200] netlink: 32 bytes leftover after parsing attributes in process `syz.3.2813'. [ 580.633626][T17209] netlink: 308 bytes leftover after parsing attributes in process `syz.3.2813'. [ 580.796058][T16775] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 580.835034][T16775] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 580.860518][T16775] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 580.908121][T16775] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 580.937094][T16775] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 580.994096][T16775] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 581.030877][T16775] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 581.165962][T17228] netlink: 4 bytes leftover after parsing attributes in process `syz.3.2817'. [ 581.218575][T17226] netlink: 212368 bytes leftover after parsing attributes in process `syz.3.2817'. [ 581.593070][T16775] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 581.698907][T17235] tipc: Enabled bearer , priority 0 [ 581.885771][T17235] tipc: Disabling bearer [ 581.947370][T17242] netlink: 'syz.2.2819': attribute type 1 has an invalid length. [ 581.970005][T17242] netlink: 2096 bytes leftover after parsing attributes in process `syz.2.2819'. [ 582.293276][T16775] 8021q: adding VLAN 0 to HW filter on device bond0 [ 582.330819][T17276] netlink: 4 bytes leftover after parsing attributes in process `syz.3.2823'. [ 582.480685][T16775] 8021q: adding VLAN 0 to HW filter on device team0 [ 582.527555][ T13] bridge0: port 1(bridge_slave_0) entered blocking state [ 582.534781][ T13] bridge0: port 1(bridge_slave_0) entered forwarding state [ 582.646820][ T29] bridge0: port 2(bridge_slave_1) entered blocking state [ 582.655111][ T29] bridge0: port 2(bridge_slave_1) entered forwarding state [ 582.953093][T17296] sctp: [Deprecated]: syz.2.2829 (pid 17296) Use of int in max_burst socket option. [ 582.953093][T17296] Use struct sctp_assoc_value instead [ 583.072829][T17301] netlink: 'syz.3.2832': attribute type 3 has an invalid length. [ 583.529931][T17317] xt_hashlimit: size too large, truncated to 1048576 [ 583.709983][T17325] netlink: 'syz.4.2833': attribute type 1 has an invalid length. [ 583.789823][T17325] __nla_validate_parse: 4 callbacks suppressed [ 583.789842][T17325] netlink: 224 bytes leftover after parsing attributes in process `syz.4.2833'. [ 583.972506][T17331] netlink: 12 bytes leftover after parsing attributes in process `syz.2.2838'. [ 584.017223][T17330] netlink: 207952 bytes leftover after parsing attributes in process `syz.1.2837'. [ 584.039280][T17333] netlink: 8 bytes leftover after parsing attributes in process `syz.2.2838'. [ 584.210840][T17331] bond8: entered promiscuous mode [ 584.229835][T17331] 8021q: adding VLAN 0 to HW filter on device bond8 [ 585.118784][T17363] netlink: 24 bytes leftover after parsing attributes in process `syz.4.2843'. [ 585.165471][T17369] netlink: 'syz.2.2845': attribute type 10 has an invalid length. [ 585.173600][T17368] tipc: Can't bind to reserved service type 0 [ 585.181949][T17371] netlink: 'syz.4.2843': attribute type 1 has an invalid length. [ 585.405867][T17371] 8021q: adding VLAN 0 to HW filter on device bond4 [ 585.479869][T17369] 8021q: adding VLAN 0 to HW filter on device team0 [ 585.721042][T17363] bond4: (slave geneve3): making interface the new active one [ 585.775412][T17363] bond4: (slave geneve3): Enslaving as an active interface with an up link [ 585.812737][ T29] netdevsim netdevsim4 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 585.858925][ T29] netdevsim netdevsim4 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 585.916654][ T29] netdevsim netdevsim4 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 585.986117][T16775] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 586.022885][ T29] netdevsim netdevsim4 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 586.121235][T17396] pim6reg: left allmulticast mode [ 586.203906][T17404] netlink: 12 bytes leftover after parsing attributes in process `syz.1.2850'. [ 586.273922][T17408] netlink: 36 bytes leftover after parsing attributes in process `syz.4.2851'. [ 586.303195][T17406] vlan0: left promiscuous mode [ 586.317197][T17406] geneve1: left promiscuous mode [ 586.726656][ T1170] netdevsim netdevsim4 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 586.758709][ T1170] netdevsim netdevsim4 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 586.810786][T17414] bond4 (unregistering): Released all slaves [ 586.968893][ T1170] netdevsim netdevsim4 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 587.000766][ T1170] netdevsim netdevsim4 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 587.145249][T17429] netlink: 'syz.3.2853': attribute type 1 has an invalid length. [ 587.153357][T17429] netlink: 224 bytes leftover after parsing attributes in process `syz.3.2853'. [ 587.261316][T16775] veth0_vlan: entered promiscuous mode [ 587.316109][T16775] veth1_vlan: entered promiscuous mode [ 587.433367][T17432] netlink: 28 bytes leftover after parsing attributes in process `syz.1.2854'. [ 587.468289][T16775] veth0_macvtap: entered promiscuous mode [ 587.511685][T16775] veth1_macvtap: entered promiscuous mode [ 587.628696][T16775] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 587.724089][T16775] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 587.773636][T17439] xt_CT: You must specify a L4 protocol and not use inversions on it [ 587.862198][ T1170] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 587.929181][T17445] netlink: 12 bytes leftover after parsing attributes in process `syz.3.2857'. [ 587.954823][ T1170] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 588.012810][ T1170] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 588.065603][ T1170] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 588.181269][T17453] hsr_slave_0: left promiscuous mode [ 588.211421][T17453] hsr_slave_1: left promiscuous mode [ 588.624428][ T6364] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 588.682441][ T6364] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 588.749265][T17468] IPv6: NLM_F_CREATE should be specified when creating new route [ 588.822082][ T180] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 588.827467][T17468] __nla_validate_parse: 2 callbacks suppressed [ 588.827508][T17468] netlink: 24 bytes leftover after parsing attributes in process `syz.2.2862'. [ 588.854407][ T180] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 589.240791][T17483] tipc: New replicast peer: 255.255.255.255 [ 589.288437][T17483] tipc: Enabled bearer , priority 10 [ 589.324749][T17483] netlink: 'syz.1.2866': attribute type 1 has an invalid length. [ 589.350277][T17483] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 589.557407][T17504] netlink: 'syz.0.2869': attribute type 10 has an invalid length. [ 589.642908][T17504] 8021q: adding VLAN 0 to HW filter on device team0 [ 589.703630][T17504] bond0: (slave team0): Enslaving as an active interface with an up link [ 590.256587][ T7894] block nbd0: Receive control failed (result -32) [ 590.697512][T17542] smc: removing ib device syz0 [ 590.736171][T17547] netlink: 12 bytes leftover after parsing attributes in process `syz.0.2875'. [ 590.771236][T17550] netlink: 'syz.3.2877': attribute type 1 has an invalid length. [ 590.911609][T17556] netlink: 'syz.2.2879': attribute type 1 has an invalid length. [ 590.955002][T17542] smbdirect: ib_dev[syz0] removed [ 591.528940][ T5630] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 591.558119][ T5630] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 591.569336][ T5630] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 591.582730][ T5630] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 591.592023][ T5630] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 592.624000][ T5637] syz_tun (unregistering): left allmulticast mode [ 593.076055][T17616] syzkaller0: entered promiscuous mode [ 593.114902][T17616] syzkaller0: entered allmulticast mode [ 593.516777][T17623] netlink: 100 bytes leftover after parsing attributes in process `syz.4.2890'. [ 593.659072][ T5630] Bluetooth: hci1: command tx timeout [ 593.864938][T17634] openvswitch: netlink: Actions may not be safe on all matching packets [ 594.044350][T17638] netlink: 40 bytes leftover after parsing attributes in process `syz.3.2894'. [ 594.749443][T17656] tipc: Enabling of bearer rejected, failed to enable media [ 595.446484][T17668] netlink: 68 bytes leftover after parsing attributes in process `syz.4.2900'. [ 595.663475][T17677] netlink: 76 bytes leftover after parsing attributes in process `syz.4.2900'. [ 595.738289][ T5630] Bluetooth: hci1: command tx timeout [ 595.823763][T17689] netlink: 72 bytes leftover after parsing attributes in process `syz.3.2904'. [ 595.844801][T17689] netlink: 12 bytes leftover after parsing attributes in process `syz.3.2904'. [ 595.866614][T17689] netlink: 4 bytes leftover after parsing attributes in process `syz.3.2904'. [ 596.495110][T17566] bridge0: port 1(bridge_slave_0) entered blocking state [ 596.542842][T17566] bridge0: port 1(bridge_slave_0) entered disabled state [ 596.577471][T17566] bridge_slave_0: entered allmulticast mode [ 596.623045][T17566] bridge_slave_0: entered promiscuous mode [ 596.655501][T17566] bridge0: port 2(bridge_slave_1) entered blocking state [ 596.694502][T17566] bridge0: port 2(bridge_slave_1) entered disabled state [ 596.725364][T17566] bridge_slave_1: entered allmulticast mode [ 596.762043][T17566] bridge_slave_1: entered promiscuous mode [ 596.982766][T17722] netlink: 212368 bytes leftover after parsing attributes in process `syz.0.2910'. [ 597.011561][T17566] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 597.073699][T17723] netlink: 76 bytes leftover after parsing attributes in process `syz.3.2909'. [ 597.411683][T17566] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 597.710926][T17566] team0: Port device team_slave_0 added [ 597.720351][T17566] team0: Port device team_slave_1 added [ 597.745398][T17750] Cannot find del_set index 3 as target [ 597.817884][ T5630] Bluetooth: hci1: command tx timeout [ 597.932717][T17755] netlink: 32 bytes leftover after parsing attributes in process `syz.3.2916'. [ 597.946799][T17566] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 597.982370][T17566] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 598.121774][T17566] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 598.211886][T17566] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 598.222636][T17566] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 598.308296][T17566] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 598.458446][T17770] netlink: 8 bytes leftover after parsing attributes in process `syz.4.2920'. [ 598.489419][T17771] sctp: [Deprecated]: syz.3.2919 (pid 17771) Use of int in maxseg socket option. [ 598.489419][T17771] Use struct sctp_assoc_value instead [ 598.791000][T17776] sctp: [Deprecated]: syz.4.2920 (pid 17776) Use of struct sctp_assoc_value in delayed_ack socket option. [ 598.791000][T17776] Use struct sctp_sack_info instead [ 599.008965][T17566] hsr_slave_0: entered promiscuous mode [ 599.026861][T17566] hsr_slave_1: entered promiscuous mode [ 599.049627][T17566] debugfs: 'hsr0' already exists in 'hsr' [ 599.070928][T17566] Cannot create hsr debugfs directory [ 599.149944][T17783] __nla_validate_parse: 2 callbacks suppressed [ 599.149963][T17783] netlink: 260 bytes leftover after parsing attributes in process `syz.3.2922'. [ 599.247302][T17787] netlink: 24 bytes leftover after parsing attributes in process `syz.0.2923'. [ 599.504304][T17802] netlink: 68 bytes leftover after parsing attributes in process `syz.2.2925'. [ 599.900185][ T5630] Bluetooth: hci1: command tx timeout [ 599.996951][T17819] netlink: 24 bytes leftover after parsing attributes in process `syz.0.2930'. [ 600.058697][T17819] netlink: 'syz.0.2930': attribute type 1 has an invalid length. [ 600.135155][T17815] netlink: 40 bytes leftover after parsing attributes in process `syz.0.2930'. [ 600.740172][T17824] ip6gretap1: default qdisc (pfifo_fast) fail, fallback to noqueue [ 601.277344][T17851] netlink: 8 bytes leftover after parsing attributes in process `syz.0.2936'. [ 601.614886][T17868] netlink: 8 bytes leftover after parsing attributes in process `syz.2.2941'. [ 602.474674][T17886] can: request_module (can-proto-0) failed. [ 602.766534][T17906] netlink: 8 bytes leftover after parsing attributes in process `syz.3.2947'. [ 602.872138][T17898] vlan2: entered allmulticast mode [ 602.878524][T17898] hsr_slave_1: entered allmulticast mode [ 603.016124][T17906] bond7: option ad_actor_sys_prio: invalid value (0) [ 603.024455][T17906] bond7: option ad_actor_sys_prio: allowed values 1 - 65535 [ 603.039520][T17906] bond7 (unregistering): Released all slaves [ 603.443364][T17908] nbd2: detected capacity change from 0 to 63 [ 603.467493][T17914] block nbd2: NBD_DISCONNECT [ 603.500904][T17914] block nbd2: Disconnected due to user request. [ 603.526132][T17914] block nbd2: shutting down sockets [ 603.551626][ C0] blk_print_req_error: 138 callbacks suppressed [ 603.551655][ C0] I/O error, dev nbd2, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 603.568495][ C0] buffer_io_error: 138 callbacks suppressed [ 603.568505][ C0] Buffer I/O error on dev nbd2, logical block 0, async page read [ 603.589602][ C0] I/O error, dev nbd2, sector 2 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 603.599371][ C0] Buffer I/O error on dev nbd2, logical block 1, async page read [ 603.608054][ C0] I/O error, dev nbd2, sector 4 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 603.618218][ C0] Buffer I/O error on dev nbd2, logical block 2, async page read [ 603.626867][ C0] I/O error, dev nbd2, sector 6 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 603.636999][ C0] Buffer I/O error on dev nbd2, logical block 3, async page read [ 603.640275][T17928] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 603.659933][T10511] I/O error, dev nbd2, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 603.670221][T10511] Buffer I/O error on dev nbd2, logical block 0, async page read [ 603.704891][T10511] I/O error, dev nbd2, sector 2 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 603.714705][T10511] Buffer I/O error on dev nbd2, logical block 1, async page read [ 603.724078][T10511] I/O error, dev nbd2, sector 4 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 603.733525][T10511] Buffer I/O error on dev nbd2, logical block 2, async page read [ 603.743470][T10511] I/O error, dev nbd2, sector 6 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 603.753453][T10511] Buffer I/O error on dev nbd2, logical block 3, async page read [ 603.773445][T10511] I/O error, dev nbd2, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 603.783597][T10511] Buffer I/O error on dev nbd2, logical block 0, async page read [ 603.791880][T10511] I/O error, dev nbd2, sector 2 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 603.802332][T10511] Buffer I/O error on dev nbd2, logical block 1, async page read [ 603.813981][T10511] ldm_validate_partition_table(): Disk read failed. [ 603.823711][T10511] Dev nbd2: unable to read RDB block 0 [ 603.833517][T10511] nbd2: unable to read partition table [ 603.856875][T10511] ldm_validate_partition_table(): Disk read failed. [ 603.864827][T17566] netdevsim netdevsim1 netdevsim0: renamed from eth0 [ 603.881557][T17566] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 603.890350][T10511] Dev nbd2: unable to read RDB block 0 [ 603.914776][T10511] nbd2: unable to read partition table [ 603.937350][T17566] netdevsim netdevsim1 netdevsim1: renamed from eth1 [ 603.996503][T17566] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 604.083870][T17566] netdevsim netdevsim1 netdevsim2: renamed from eth2 [ 604.144676][T17566] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 604.169826][T17566] netdevsim netdevsim1 netdevsim3: renamed from eth3 [ 604.226844][T17566] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 604.252215][T17940] netlink: 12 bytes leftover after parsing attributes in process `syz.0.2956'. [ 604.281824][T17941] netlink: 16 bytes leftover after parsing attributes in process `syz.3.2954'. [ 604.527602][T17955] netlink: 7 bytes leftover after parsing attributes in process `syz.3.2957'. [ 604.831222][T17566] 8021q: adding VLAN 0 to HW filter on device bond0 [ 605.010240][T17566] 8021q: adding VLAN 0 to HW filter on device team0 [ 605.029164][T17975] netlink: 8 bytes leftover after parsing attributes in process `syz.2.2963'. [ 605.059224][ T6361] bridge0: port 1(bridge_slave_0) entered blocking state [ 605.066432][ T6361] bridge0: port 1(bridge_slave_0) entered forwarding state [ 605.075000][T17978] netlink: 8 bytes leftover after parsing attributes in process `syz.4.2962'. [ 605.089805][T17979] x_tables: ip_tables: icmp match: only valid for protocol 1 [ 605.099754][ T180] bridge0: port 2(bridge_slave_1) entered blocking state [ 605.106982][ T180] bridge0: port 2(bridge_slave_1) entered forwarding state [ 605.260064][T17987] netlink: 'syz.0.2965': attribute type 3 has an invalid length. [ 605.293274][T17987] netlink: 224 bytes leftover after parsing attributes in process `syz.0.2965'. [ 605.542562][T17993] syzkaller0: entered promiscuous mode [ 605.556228][T17993] syzkaller0: entered allmulticast mode [ 605.726221][T17997] netlink: 44 bytes leftover after parsing attributes in process `syz.3.2966'. [ 605.773829][T18005] netlink: 24 bytes leftover after parsing attributes in process `syz.0.2969'. [ 608.713050][T18039] netlink: 24 bytes leftover after parsing attributes in process `syz.2.2973'. [ 608.805026][T18039] ip6gre3: entered promiscuous mode [ 608.823376][T18039] ip6gre3: entered allmulticast mode [ 609.016577][T17566] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 609.176671][T17566] veth0_vlan: entered promiscuous mode [ 609.204905][T17566] veth1_vlan: entered promiscuous mode [ 609.229878][ T12] ip6_tunnel: ip6gre3 xmit: Local address not yet configured! [ 609.254519][ T12] ip6_tunnel: ip6gre3 xmit: Local address not yet configured! [ 609.268102][ T5728] ip6_tunnel: ip6gre3 xmit: Local address not yet configured! [ 609.378124][ T5728] ip6_tunnel: ip6gre3 xmit: Local address not yet configured! [ 609.388763][T17566] veth0_macvtap: entered promiscuous mode [ 609.429365][T18062] netlink: 16 bytes leftover after parsing attributes in process `syz.4.2980'. [ 609.429643][T17566] veth1_macvtap: entered promiscuous mode [ 609.559928][T17566] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 609.614030][T17566] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 609.634773][ T1170] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 609.644675][ T1170] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 609.657383][ T1170] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 609.669379][ T1170] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 609.709345][ T7483] ip6_tunnel: ip6gre3 xmit: Local address not yet configured! [ 610.172046][T18076] x_tables: duplicate underflow at hook 2 [ 612.413650][T18063] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 612.520189][ T54] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 612.534624][ T54] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 612.674643][ T1170] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 612.709135][ T1170] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 612.723466][T18086] netlink: 65039 bytes leftover after parsing attributes in process `syz.3.2987'. [ 612.848005][T18089] netlink: 'syz.0.2989': attribute type 1 has an invalid length. [ 612.889286][T18091] xt_TCPMSS: Only works on TCP SYN packets [ 613.080438][T18089] bond1: entered promiscuous mode [ 613.089117][T18089] 8021q: adding VLAN 0 to HW filter on device bond1 [ 613.189048][T18094] 8021q: adding VLAN 0 to HW filter on device bond1 [ 613.243080][T18094] bond1: (slave ip6gre1): The slave device specified does not support setting the MAC address [ 613.285147][T18094] bond1: (slave ip6gre1): Setting fail_over_mac to active for active-backup mode [ 613.366481][T18094] bond1: (slave ip6gre1): making interface the new active one [ 613.402445][T18094] ip6gre1: entered promiscuous mode [ 613.447425][T18094] bond1: (slave ip6gre1): Enslaving as an active interface with an up link [ 613.658486][ C1] ip6_tunnel: ip6gre3 xmit: Local address not yet configured! [ 614.271258][T18155] netlink: 'syz.3.3002': attribute type 1 has an invalid length. [ 614.326753][T18158] netlink: 'syz.0.3004': attribute type 1 has an invalid length. [ 614.339237][T18154] xt_addrtype: ipv6 PROHIBIT (THROW, NAT ..) matching not supported [ 614.437081][T18163] x_tables: duplicate underflow at hook 1 [ 614.462359][T18155] 8021q: adding VLAN 0 to HW filter on device bond7 [ 614.586165][T18159] bond7: (slave gretap2): making interface the new active one [ 614.645938][T18159] bond7: (slave gretap2): Enslaving as an active interface with an up link [ 615.018850][T18165] bond3 (unregistering): Released all slaves [ 615.298401][T18184] netlink: 8 bytes leftover after parsing attributes in process `syz.3.3008'. [ 615.495992][T18189] netlink: 8 bytes leftover after parsing attributes in process `syz.1.3010'. [ 615.527627][T18189] netlink: 'syz.1.3010': attribute type 30 has an invalid length. [ 615.605321][ T6361] netdevsim netdevsim1 netdevsim0: set [0, 0] type 1 family 0 port 8472 - 0 [ 615.620001][T18194] netlink: 8 bytes leftover after parsing attributes in process `syz.1.3010'. [ 615.633803][ T6361] netdevsim netdevsim1 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0 [ 615.673959][ T6361] netdevsim netdevsim1 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0 [ 615.686543][T18194] netlink: 'syz.1.3010': attribute type 30 has an invalid length. [ 615.699345][T18196] netlink: 'syz.4.3012': attribute type 10 has an invalid length. [ 615.712403][ T6361] netdevsim netdevsim1 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0 [ 615.723989][T18196] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 615.755837][T18196] team0: Port device netdevsim1 added [ 615.817172][T18198] bridge0: port 1(vlan4) entered blocking state [ 615.879456][T18198] bridge0: port 1(vlan4) entered disabled state [ 615.891150][T18198] vlan4: entered allmulticast mode [ 615.915444][T18198] geneve0: entered allmulticast mode [ 615.936280][T18198] vlan4: entered promiscuous mode [ 615.950986][T18198] geneve0: entered promiscuous mode [ 616.050478][T18200] netlink: 260 bytes leftover after parsing attributes in process `syz.3.3013'. [ 617.077909][T18226] sctp: [Deprecated]: syz.3.3020 (pid 18226) Use of int in maxseg socket option. [ 617.077909][T18226] Use struct sctp_assoc_value instead [ 617.208029][ T7894] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 617.228427][ T7894] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 617.239349][ T7894] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 617.263651][ T7894] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 617.274483][ T7894] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 618.110999][T18254] netlink: 'syz.3.3023': attribute type 1 has an invalid length. [ 618.330584][T18254] 8021q: adding VLAN 0 to HW filter on device bond8 [ 618.446081][T18259] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 618.862539][T18270] netlink: 12 bytes leftover after parsing attributes in process `syz.0.3027'. [ 618.885133][T18270] netlink: 60 bytes leftover after parsing attributes in process `syz.0.3027'. [ 619.089279][T18274] netlink: 24 bytes leftover after parsing attributes in process `syz.3.3028'. [ 619.337857][ T5630] Bluetooth: hci3: command tx timeout [ 619.733715][T18262] infiniband uyz0: set down [ 619.767497][T18262] infiniband uyz0: added bridge_slave_1 [ 619.849940][T18262] workqueue: Failed to create a rescuer kthread for wq "ib_mad1": -EINTR [ 619.900208][T18262] infiniband uyz0: Couldn't open port 1 [ 619.933649][T18300] netlink: 40 bytes leftover after parsing attributes in process `syz.3.3034'. [ 619.958409][T18262] smbdirect: ib_dev[uyz0]: added: IB_CA max_fast_reg_page_list_len=512 device_cap_flags=0x1c001223c76 kernel_cap_flags=0x14 page_size_cap=0xfffff000 [ 619.976552][T18262] smbdirect: ib_dev[uyz0]: num_ports=1 max_qp_rd_atom=128 max_qp_init_rd_atom=128 max_sgl_rd=0 max_sge_rd=32 max_cqe=32767 max_qp_wr=1048576 max_send_sge=32 max_recv_sge=32 [ 619.997730][T18262] smbdirect: ib_dev[uyz0]PORT[1]: iwarp=0 ib=0 roce=1 v1=0 v2=1 core_cap_flags=0x803005 [ 620.010184][T18301] netlink: 60 bytes leftover after parsing attributes in process `syz.3.3034'. [ 620.020651][T18291] bond3 (unregistering): Released all slaves [ 620.146627][T18262] RDS/IB: uyz0: added [ 620.151738][T18262] smc: adding ib device uyz0 with port count 1 [ 620.176324][T18262] smc: ib device uyz0 port 1 has no pnetid [ 620.185486][T18293] A link change request failed with some changes committed already. Interface hsr_slave_0 may have been left with an inconsistent configuration, please check. [ 620.334321][T18304] netlink: 'syz.1.3036': attribute type 1 has an invalid length. [ 620.657328][T18303] syzkaller1: entered promiscuous mode [ 620.687281][T18303] syzkaller1: entered allmulticast mode [ 621.023656][T18316] netlink: 12 bytes leftover after parsing attributes in process `syz.0.3041'. [ 621.121878][T18324] netlink: 16 bytes leftover after parsing attributes in process `syz.0.3041'. [ 621.283127][ T13] nci: nci_extract_activation_params_iso_dep: unsupported activation_rf_tech_and_mode 0x80 [ 621.401293][T18331] netlink: 192 bytes leftover after parsing attributes in process `syz.1.3043'. [ 621.418537][ T5630] Bluetooth: hci3: command tx timeout [ 621.446863][T18331] openvswitch: netlink: Flow actions attr not present in new flow. [ 621.713584][T18336] bridge0: port 3(syz_tun) entered blocking state [ 621.722061][T18336] bridge0: port 3(syz_tun) entered disabled state [ 621.730746][T18336] syz_tun: entered allmulticast mode [ 621.748812][T18336] syz_tun: entered promiscuous mode [ 621.768694][T18336] bridge0: port 3(syz_tun) entered blocking state [ 621.777142][T18336] bridge0: port 3(syz_tun) entered forwarding state [ 621.885121][T18319] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 622.072305][T18228] bridge0: port 1(bridge_slave_0) entered blocking state [ 622.116528][T18228] bridge0: port 1(bridge_slave_0) entered disabled state [ 622.156150][T18228] bridge_slave_0: entered allmulticast mode [ 622.208898][T18228] bridge_slave_0: entered promiscuous mode [ 622.255950][T18228] bridge0: port 2(bridge_slave_1) entered blocking state [ 622.288137][T18228] bridge0: port 2(bridge_slave_1) entered disabled state [ 622.320227][T18228] bridge_slave_1: entered allmulticast mode [ 622.351835][T18228] bridge_slave_1: entered promiscuous mode [ 622.380798][ C1] ip6_tunnel: ip6gre3 xmit: Local address not yet configured! [ 622.396555][T18344] netlink: 56 bytes leftover after parsing attributes in process `syz.0.3044'. [ 622.871927][T18228] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 623.135686][T18228] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 623.361691][T18228] team0: Port device team_slave_0 added [ 623.411838][T18228] team0: Port device team_slave_1 added [ 623.498378][ T5630] Bluetooth: hci3: command tx timeout [ 623.603479][T18228] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 623.615775][T18376] netlink: 12 bytes leftover after parsing attributes in process `syz.3.3048'. [ 623.639877][T18228] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 623.671756][T18228] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 623.690283][T18380] tipc: Started in network mode [ 623.703253][T18380] tipc: Node identity ff, cluster identity 4711 [ 623.711378][T18380] tipc: Enabling of bearer rejected, failed to enable media [ 623.790288][T18228] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 623.824589][T18228] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 623.904412][T18228] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 624.208621][T18228] hsr_slave_0: entered promiscuous mode [ 624.243414][T18228] hsr_slave_1: entered promiscuous mode [ 624.251421][ T30] audit: type=1804 audit(1781648504.745:6): pid=18391 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=open_writers comm="syz.1.3052" name="/newroot/19/memory.events" dev="tmpfs" ino=115 res=1 errno=0 [ 624.277560][T18228] debugfs: 'hsr0' already exists in 'hsr' [ 624.289935][T18228] Cannot create hsr debugfs directory [ 624.312943][ T1317] ieee802154 phy0 wpan0: encryption failed: -22 [ 624.611639][T18398] Bluetooth: MGMT ver 1.23 [ 625.123875][T18410] netlink: 40 bytes leftover after parsing attributes in process `syz.3.3055'. [ 625.148189][T18410] netlink: 4 bytes leftover after parsing attributes in process `syz.3.3055'. [ 625.578194][ T5630] Bluetooth: hci3: command tx timeout [ 626.026505][T18430] netlink: 8 bytes leftover after parsing attributes in process `syz.3.3061'. [ 626.042501][T18228] team0: Port device netdevsim1 removed [ 626.488715][T18435] IPVS: set_ctl: invalid protocol: 60 172.20.20.56:20004 [ 626.948030][T18228] netdevsim netdevsim4 netdevsim0: renamed from eth0 [ 627.002262][T18228] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 627.062889][T18228] netdevsim netdevsim4 netdevsim1: renamed from eth1 [ 627.112603][T18228] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 627.133345][T18451] netlink: 8 bytes leftover after parsing attributes in process `syz.1.3067'. [ 627.145937][T18228] netdevsim netdevsim4 netdevsim2: renamed from eth2 [ 627.168280][T18228] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 627.277387][T18228] netdevsim netdevsim4 netdevsim3: renamed from eth3 [ 627.306161][T18228] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 627.318059][T18452] netlink: 80 bytes leftover after parsing attributes in process `syz.1.3067'. [ 627.907470][T18228] 8021q: adding VLAN 0 to HW filter on device bond0 [ 628.039771][T18228] 8021q: adding VLAN 0 to HW filter on device team0 [ 628.075269][T18474] netlink: 24 bytes leftover after parsing attributes in process `syz.3.3073'. [ 628.120141][ T12] bridge0: port 1(bridge_slave_0) entered blocking state [ 628.127366][ T12] bridge0: port 1(bridge_slave_0) entered forwarding state [ 628.203800][ T12] bridge0: port 2(bridge_slave_1) entered blocking state [ 628.211039][ T12] bridge0: port 2(bridge_slave_1) entered forwarding state [ 628.323846][T18474] IPVS: Scheduler module ip_vs_sip not found [ 628.405194][T18485] netlink: 17 bytes leftover after parsing attributes in process `syz.0.3076'. [ 628.456769][T18485] netlink: 100 bytes leftover after parsing attributes in process `syz.0.3076'. [ 628.510716][T18487] netlink: 32 bytes leftover after parsing attributes in process `syz.0.3076'. [ 628.824303][T18494] IPVS: set_ctl: invalid protocol: 19 10.1.1.2:20003 [ 628.842031][T18494] dummy0: entered promiscuous mode [ 628.859781][T18493] dummy0: left promiscuous mode [ 629.444697][T18512] netlink: 4 bytes leftover after parsing attributes in process `syz.3.3081'. [ 629.854544][T18523] netlink: 8 bytes leftover after parsing attributes in process `syz.2.3083'. [ 630.047451][T18531] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 630.069062][T18528] netlink: 296 bytes leftover after parsing attributes in process `syz.0.3084'. [ 630.093641][T18531] netlink: 20 bytes leftover after parsing attributes in process `syz.2.3086'. [ 630.400246][T18228] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 630.701811][T18552] sctp: [Deprecated]: syz.3.3093 (pid 18552) Use of int in maxseg socket option. [ 630.701811][T18552] Use struct sctp_assoc_value instead [ 631.069554][T18565] netlink: 'syz.3.3097': attribute type 89 has an invalid length. [ 631.099159][T18565] netlink: 'syz.3.3097': attribute type 89 has an invalid length. [ 631.699788][T18589] syzkaller0: entered promiscuous mode [ 631.715684][T18589] syzkaller0: entered allmulticast mode [ 631.732708][T18586] syzkaller0: entered promiscuous mode [ 631.751584][T18586] syzkaller0: entered allmulticast mode [ 631.926953][T18228] veth0_vlan: entered promiscuous mode [ 631.995265][T18228] veth1_vlan: entered promiscuous mode [ 632.223337][T18609] __nla_validate_parse: 4 callbacks suppressed [ 632.223357][T18609] netlink: 16 bytes leftover after parsing attributes in process `syz.1.3113'. [ 632.250700][T18228] veth0_macvtap: entered promiscuous mode [ 632.310739][T18228] veth1_macvtap: entered promiscuous mode [ 632.474652][T18228] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 632.531675][T18616] netlink: 8 bytes leftover after parsing attributes in process `syz.2.3114'. [ 632.595898][T18228] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 632.609225][ T7483] IPVS: starting estimator thread 0... [ 632.671592][ T54] netdevsim netdevsim4 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 632.704075][ T54] netdevsim netdevsim4 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 632.748032][T18628] IPVS: using max 28 ests per chain, 67200 per kthread [ 632.806602][ T54] netdevsim netdevsim4 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 632.849368][ T54] netdevsim netdevsim4 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 632.916389][T18627] netlink: 48 bytes leftover after parsing attributes in process `syz.0.3118'. [ 633.167264][ T13] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 633.207055][ T13] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 633.295480][ T13] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 633.322354][ T13] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 633.428624][T18649] netlink: 27 bytes leftover after parsing attributes in process `syz.2.3123'. [ 633.679334][T18656] syzkaller0: entered promiscuous mode [ 633.692304][T18656] syzkaller0: entered allmulticast mode [ 634.035377][T18665] netlink: 8 bytes leftover after parsing attributes in process `syz.4.3129'. [ 634.150407][ T7894] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 634.162858][ T7894] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 634.173762][ T7894] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 634.186948][ T7894] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 634.195952][ T7894] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 634.216769][T18668] ip6_tunnel: ip6gre3 xmit: Local address not yet configured! [ 634.863573][T18688] FAULT_INJECTION: forcing a failure. [ 634.863573][T18688] name failslab, interval 1, probability 0, space 0, times 0 [ 634.881869][T18690] netlink: 8 bytes leftover after parsing attributes in process `syz.1.3134'. [ 634.899506][T18688] CPU: 1 UID: 0 PID: 18688 Comm: syz.2.3135 Not tainted syzkaller #0 PREEMPT(full) [ 634.899543][T18688] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 634.899558][T18688] Call Trace: [ 634.899566][T18688] [ 634.899575][T18688] dump_stack_lvl+0xe8/0x150 [ 634.899609][T18688] should_fail_ex+0x40c/0x560 [ 634.899652][T18688] should_failslab+0xa8/0x100 [ 634.899676][T18688] kmem_cache_alloc_node_noprof+0x8f/0x680 [ 634.899708][T18688] ? __alloc_skb+0x189/0x7a0 [ 634.899743][T18688] ? __alloc_skb+0x1d7/0x7a0 [ 634.899772][T18688] ? __local_bh_enable_ip+0xd0/0x130 [ 634.899801][T18688] __alloc_skb+0x1d7/0x7a0 [ 634.899838][T18688] netlink_sendmsg+0x5d4/0xb40 [ 634.899872][T18688] ? __pfx_netlink_sendmsg+0x10/0x10 [ 634.899899][T18688] ? aa_sock_msg_perm+0xf1/0x1b0 [ 634.899933][T18688] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 634.899961][T18688] ? __pfx_netlink_sendmsg+0x10/0x10 [ 634.899987][T18688] ____sys_sendmsg+0x9b9/0xa20 [ 634.900011][T18688] ? __might_fault+0xaf/0x130 [ 634.900050][T18688] ? __pfx_____sys_sendmsg+0x10/0x10 [ 634.900083][T18688] ? import_iovec+0x73/0xa0 [ 634.900113][T18688] ___sys_sendmsg+0x2a5/0x360 [ 634.900134][T18688] ? __lock_acquire+0x683/0x2cd0 [ 634.900163][T18688] ? __pfx____sys_sendmsg+0x10/0x10 [ 634.900225][T18688] ? __fget_files+0x2a/0x420 [ 634.900252][T18688] ? __fget_files+0x3a2/0x420 [ 634.900291][T18688] __x64_sys_sendmsg+0x1bd/0x2a0 [ 634.900318][T18688] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 634.900351][T18688] ? rcu_is_watching+0x15/0xb0 [ 634.900386][T18688] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 634.900411][T18688] do_syscall_64+0x174/0x580 [ 634.900438][T18688] ? trace_irq_disable+0x3b/0x140 [ 634.900471][T18688] ? clear_bhb_loop+0x40/0x90 [ 634.900498][T18688] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 634.900519][T18688] RIP: 0033:0x7fd71c19ce59 [ 634.900553][T18688] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 634.900573][T18688] RSP: 002b:00007fd71d0d8028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 634.900595][T18688] RAX: ffffffffffffffda RBX: 00007fd71c415fa0 RCX: 00007fd71c19ce59 [ 634.900612][T18688] RDX: 0000000000000004 RSI: 0000200000000340 RDI: 0000000000000003 [ 634.900625][T18688] RBP: 00007fd71d0d8090 R08: 0000000000000000 R09: 0000000000000000 [ 634.900638][T18688] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 634.900651][T18688] R13: 00007fd71c416038 R14: 00007fd71c415fa0 R15: 00007fffc21be258 [ 634.900686][T18688] [ 635.388968][T18698] netlink: 'syz.2.3137': attribute type 1 has an invalid length. [ 635.466155][T18699] netlink: 24 bytes leftover after parsing attributes in process `syz.4.3136'. [ 635.722737][T18710] xt_CT: You must specify a L4 protocol and not use inversions on it [ 636.304306][ T5630] Bluetooth: hci0: command tx timeout [ 636.442950][T18725] vlan2: entered promiscuous mode [ 636.449530][T18725] bridge0: entered promiscuous mode [ 636.570731][T18725] netlink: 'syz.2.3142': attribute type 4 has an invalid length. [ 637.342454][ T99] vlan4: left allmulticast mode [ 637.367137][ T99] geneve0: left allmulticast mode [ 637.395752][ T99] vlan4: left promiscuous mode [ 637.422304][ T99] geneve0: left promiscuous mode [ 637.464048][ T99] bridge0: port 1(vlan4) entered disabled state [ 637.603167][ T99] veth5: left allmulticast mode [ 637.624125][ T99] veth5: left promiscuous mode [ 637.652922][ T99] bridge4: port 1(veth5) entered disabled state [ 637.665894][T18751] netlink: 24 bytes leftover after parsing attributes in process `syz.2.3147'. [ 637.799615][ T99] tunl0: left allmulticast mode [ 637.816350][ T99] pimreg: left allmulticast mode [ 637.840191][ T99] pimreg9: left allmulticast mode [ 638.071214][T18762] bridge0: received packet on syz_tun with own address as source address (addr:aa:aa:aa:aa:aa:aa, vlan:0) [ 638.573563][ T99] bond0 (unregistering): (slave gretap1): Releasing backup interface [ 638.802707][ T99] bond7 (unregistering): (slave gretap2): Releasing active interface [ 638.899864][ T99] bond4 (unregistering): (slave geneve4): Releasing active interface [ 638.929095][ T99] bond3 (unregistering): (slave geneve2): Releasing active interface [ 639.005599][ T99] bond2 (unregistering): (slave bridge1): Releasing backup interface [ 639.055541][ T99] bond6 (unregistering): (slave bridge5): Releasing backup interface [ 639.064143][ T99] bridge5 (unregistering): left promiscuous mode [ 639.109747][ T99] team0: Port device macvlan2 removed [ 639.121498][ T99] bond1 (unregistering): Released all slaves [ 639.165655][ T99] bond2 (unregistering): Released all slaves [ 639.188843][ T99] bond0 (unregistering): Released all slaves [ 639.209818][ T99] bond3 (unregistering): Released all slaves [ 639.227267][ T99] bond4 (unregistering): Released all slaves [ 639.255105][ T99] bond5 (unregistering): Released all slaves [ 639.285550][ T99] bond6 (unregistering): Released all slaves [ 639.310131][ T99] bond7 (unregistering): Released all slaves [ 639.340785][ T99] bond8 (unregistering): Released all slaves [ 639.386962][T18774] workqueue: Failed to create a rescuer kthread for wq "bond1": -EINTR [ 639.393540][ T5290] 8021q: adding VLAN 0 to HW filter on device eth1 [ 639.711749][T18785] sch_tbf: peakrate 7 is lower than or equals to rate 6829859379779001161 ! [ 639.752059][T18787] netlink: 36 bytes leftover after parsing attributes in process `syz.2.3154'. [ 639.796811][T18786] sch_tbf: peakrate 7 is lower than or equals to rate 6829859379779001161 ! [ 639.870490][ T99] tipc: Disabling bearer [ 639.911627][ T99] tipc: Left network mode [ 640.298835][ C1] ip6_tunnel: ip6gre3 xmit: Local address not yet configured! [ 640.829652][T18802] IPVS: set_ctl: invalid protocol: 47 100.1.1.1:20002 [ 641.142083][T18813] syzkaller0: entered promiscuous mode [ 641.152115][T18813] syzkaller0: entered allmulticast mode [ 641.467973][T18845] netlink: 'syz.1.3164': attribute type 1 has an invalid length. [ 641.487921][T18845] netlink: 212408 bytes leftover after parsing attributes in process `syz.1.3164'. [ 642.426322][T18863] netlink: 550 bytes leftover after parsing attributes in process `syz.2.3167'. [ 644.472979][ T5290] 8021q: adding VLAN 0 to HW filter on device eth2 [ 644.914955][T18889] netlink: 12 bytes leftover after parsing attributes in process `syz.1.3170'. [ 645.498559][T18667] bridge0: port 1(bridge_slave_0) entered blocking state [ 645.537996][T18667] bridge0: port 1(bridge_slave_0) entered disabled state [ 645.555584][T18667] bridge_slave_0: entered allmulticast mode [ 645.594124][T18667] bridge_slave_0: entered promiscuous mode [ 645.634903][T18667] bridge0: port 2(bridge_slave_1) entered blocking state [ 645.679285][T18667] bridge0: port 2(bridge_slave_1) entered disabled state [ 645.707282][T18667] bridge_slave_1: entered allmulticast mode [ 645.745939][T18667] bridge_slave_1: entered promiscuous mode [ 646.063231][T18667] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 646.177041][T18667] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 646.624305][T18945] netlink: 36 bytes leftover after parsing attributes in process `syz.0.3183'. [ 646.697126][T18667] team0: Port device team_slave_0 added [ 646.841710][T18667] team0: Port device team_slave_1 added [ 647.067811][T18959] Bluetooth: hci0: Opcode 0x0c03 failed: -4 [ 647.148441][T18667] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 647.155591][T18667] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 647.184609][T18667] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 647.206059][T18667] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 647.227025][T18667] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 647.257785][T18667] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 647.271475][T18960] syzkaller0: entered promiscuous mode [ 647.277889][T18960] syzkaller0: entered allmulticast mode [ 647.285521][T18963] tipc: Started in network mode [ 647.290430][T18963] tipc: Node identity 2a252f29a48c, cluster identity 4711 [ 647.300991][T18963] tipc: Enabled bearer , priority 0 [ 647.449703][T18973] netlink: 40 bytes leftover after parsing attributes in process `syz.4.3189'. [ 647.464283][T18974] netlink: 40 bytes leftover after parsing attributes in process `syz.4.3189'. [ 647.477585][T18968] syzkaller0: entered promiscuous mode [ 647.484170][T18968] syzkaller0: entered allmulticast mode [ 647.490479][T18968] tipc: Resetting bearer [ 647.518268][T18961] tipc: Resetting bearer [ 647.559393][T18976] netlink: 8 bytes leftover after parsing attributes in process `syz.4.3190'. [ 647.570399][T18976] netlink: 108 bytes leftover after parsing attributes in process `syz.4.3190'. [ 649.867550][T18961] tipc: Disabling bearer [ 649.999620][T18979] netlink: 20 bytes leftover after parsing attributes in process `syz.0.3191'. [ 650.009424][T18979] Bluetooth: MGMT ver 1.23 [ 650.227801][ T5290] 8021q: adding VLAN 0 to HW filter on device eth3 [ 650.417798][ T5752] tipc: Node number set to 2393452329 [ 650.676241][T18667] hsr_slave_0: entered promiscuous mode [ 650.706860][T18993] netlink: 16 bytes leftover after parsing attributes in process `syz.0.3195'. [ 650.736709][T18993] netlink: 36 bytes leftover after parsing attributes in process `syz.0.3195'. [ 650.747205][T18667] hsr_slave_1: entered promiscuous mode [ 650.774905][T18993] netlink: 36 bytes leftover after parsing attributes in process `syz.0.3195'. [ 650.788314][T18667] debugfs: 'hsr0' already exists in 'hsr' [ 650.830787][T18667] Cannot create hsr debugfs directory [ 650.837880][T18995] netlink: 12 bytes leftover after parsing attributes in process `syz.0.3195'. [ 650.910017][T18999] netlink: 40 bytes leftover after parsing attributes in process `syz.2.3198'. [ 650.921848][T18998] netlink: 8 bytes leftover after parsing attributes in process `syz.1.3197'. [ 651.004073][T18995] veth1_to_batadv: entered allmulticast mode [ 651.074729][T19000] vlan2: entered allmulticast mode [ 651.084799][T18998] netlink: 'syz.1.3197': attribute type 3 has an invalid length. [ 651.097248][T19000] bridge0: port 3(vlan2) entered blocking state [ 651.117911][T19000] bridge0: port 3(vlan2) entered disabled state [ 651.131566][T19000] vlan2: entered promiscuous mode [ 651.221857][ T99] hsr_slave_0: left promiscuous mode [ 651.235230][ T99] hsr_slave_1: left promiscuous mode [ 651.667577][T19021] netlink: 32 bytes leftover after parsing attributes in process `syz.2.3199'. [ 652.243285][T19026] netlink: 40 bytes leftover after parsing attributes in process `syz.4.3200'. [ 652.372111][T19023] syzkaller0: entered promiscuous mode [ 652.379687][T19023] syzkaller0: entered allmulticast mode [ 652.390236][ T5290] 8021q: adding VLAN 0 to HW filter on device eth4 [ 652.421945][T19039] netlink: 60 bytes leftover after parsing attributes in process `syz.4.3203'. [ 655.127022][ T99] IPVS: stop unused estimator thread 0... [ 655.158405][T19073] __nla_validate_parse: 1 callbacks suppressed [ 655.158425][T19073] netlink: 4 bytes leftover after parsing attributes in process `syz.4.3212'. [ 655.196464][T19073] openvswitch: netlink: Message has 2 unknown bytes. [ 655.246460][T19077] netlink: 44 bytes leftover after parsing attributes in process `syz.1.3214'. [ 655.256740][T19077] netlink: 8 bytes leftover after parsing attributes in process `syz.1.3214'. [ 655.634657][T19096] netlink: 300 bytes leftover after parsing attributes in process `syz.4.3218'. [ 655.690283][T19096] openvswitch: netlink: Flow key attr not present in new flow. [ 655.949135][T19116] netlink: 'syz.0.3223': attribute type 29 has an invalid length. [ 656.026920][T19120] netlink: 'syz.0.3223': attribute type 29 has an invalid length. [ 656.218796][T19124] syzkaller0: entered promiscuous mode [ 656.225304][T19124] syzkaller0: entered allmulticast mode [ 656.729691][T19151] sctp: [Deprecated]: syz.1.3229 (pid 19151) Use of struct sctp_assoc_value in delayed_ack socket option. [ 656.729691][T19151] Use struct sctp_sack_info instead [ 657.222258][T19175] openvswitch: netlink: IP tunnel dst address not specified [ 657.390270][T19155] netdevsim netdevsim0 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 657.539402][T18667] netdevsim netdevsim3 netdevsim0: renamed from eth0 [ 657.564701][T18667] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 657.710727][T19155] netdevsim netdevsim0 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 657.724200][T19198] netlink: 8 bytes leftover after parsing attributes in process `syz.4.3237'. [ 657.757344][T18667] netdevsim netdevsim3 netdevsim1: renamed from eth1 [ 657.793475][T18667] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 657.879865][T18667] netdevsim netdevsim3 netdevsim2: renamed from eth2 [ 657.918535][T18667] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 657.935145][T18667] netdevsim netdevsim3 netdevsim3: renamed from eth3 [ 657.983313][T18667] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 658.111238][T19221] netlink: 76 bytes leftover after parsing attributes in process `syz.1.3239'. [ 658.260462][T19155] netdevsim netdevsim0 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 658.314936][T19227] sctp: [Deprecated]: syz.4.3242 (pid 19227) Use of struct sctp_assoc_value in delayed_ack socket option. [ 658.314936][T19227] Use struct sctp_sack_info instead [ 658.505977][T19155] netdevsim netdevsim0 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 658.620423][T19244] netlink: 'syz.2.3245': attribute type 10 has an invalid length. [ 658.639894][T19244] netlink: 40 bytes leftover after parsing attributes in process `syz.2.3245'. [ 658.757098][T19244] IPv6: NLM_F_CREATE should be specified when creating new route [ 658.810903][ T3260] netdevsim netdevsim0 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 658.875139][T19250] bridge0: port 1(bridge_slave_0) entered disabled state [ 658.893284][T19250] bridge0: port 2(bridge_slave_1) entered disabled state [ 659.051903][ T13] netdevsim netdevsim0 eth1: set [1, 0] type 2 family 0 port 6081 - 0 [ 659.090638][T19250] bridge0: port 1(bridge_slave_0) entered blocking state [ 659.097908][T19250] bridge0: port 1(bridge_slave_0) entered forwarding state [ 659.112695][T19250] bridge0: port 2(bridge_slave_1) entered blocking state [ 659.119949][T19250] bridge0: port 2(bridge_slave_1) entered forwarding state [ 659.291301][T19258] ip6gre4: entered promiscuous mode [ 659.306893][T19258] ip6gre4: entered allmulticast mode [ 659.386414][ T3260] netdevsim netdevsim0 eth2: set [1, 0] type 2 family 0 port 6081 - 0 [ 659.455184][ T13] netdevsim netdevsim0 eth3: set [1, 0] type 2 family 0 port 6081 - 0 [ 659.488606][T18667] 8021q: adding VLAN 0 to HW filter on device bond0 [ 659.576729][T18667] 8021q: adding VLAN 0 to HW filter on device team0 [ 659.628728][ T6361] bridge0: port 1(bridge_slave_0) entered blocking state [ 659.635934][ T6361] bridge0: port 1(bridge_slave_0) entered forwarding state [ 659.723795][ T6361] bridge0: port 2(bridge_slave_1) entered blocking state [ 659.731059][ T6361] bridge0: port 2(bridge_slave_1) entered forwarding state [ 659.764840][T19285] netlink: 12 bytes leftover after parsing attributes in process `syz.1.3252'. [ 660.320995][ T13] ip6_tunnel: ip6gre4 xmit: Local address not yet configured! [ 660.348385][ T13] ip6_tunnel: ip6gre4 xmit: Local address not yet configured! [ 660.356253][ T5728] ip6_tunnel: ip6gre4 xmit: Local address not yet configured! [ 660.372737][T19308] netlink: 2 bytes leftover after parsing attributes in process `syz.4.3257'. [ 660.395110][T19308] netlink: 2 bytes leftover after parsing attributes in process `syz.4.3257'. [ 660.413617][T19308] netlink: 28 bytes leftover after parsing attributes in process `syz.4.3257'. [ 660.580688][ T7478] ip6_tunnel: ip6gre4 xmit: Local address not yet configured! [ 660.665466][ T30] audit: type=1804 audit(1781648541.155:7): pid=19320 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=open_writers comm="syz.1.3259" name="/newroot/71/cgroup.controllers" dev="tmpfs" ino=382 res=1 errno=0 [ 660.751876][ T30] audit: type=1800 audit(1781648541.155:8): pid=19320 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.1.3259" name="cgroup.controllers" dev="tmpfs" ino=382 res=0 errno=0 [ 660.831654][ T30] audit: type=1804 audit(1781648541.215:9): pid=19320 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=ToMToU comm="syz.1.3259" name="/newroot/71/cgroup.controllers" dev="tmpfs" ino=382 res=1 errno=0 [ 661.252147][T18667] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 661.268523][ T5728] ip6_tunnel: ip6gre4 xmit: Local address not yet configured! [ 661.433985][T18667] veth0_vlan: entered promiscuous mode [ 661.483181][T18667] veth1_vlan: entered promiscuous mode [ 661.609975][T18667] veth0_macvtap: entered promiscuous mode [ 661.669357][T18667] veth1_macvtap: entered promiscuous mode [ 661.765595][T18667] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 661.863794][T18667] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 661.908853][ T99] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 661.930416][ T99] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 661.954884][ T99] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 661.979431][ T12] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 662.232789][T19378] netlink: 84 bytes leftover after parsing attributes in process `syz.1.3272'. [ 662.289041][T19380] netlink: 8 bytes leftover after parsing attributes in process `syz.1.3272'. [ 662.325436][ T13] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 662.359290][ T13] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 662.392126][T19382] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 662.423608][ T6361] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 662.459757][ T6361] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 662.714166][T19395] netlink: 32 bytes leftover after parsing attributes in process `syz.3.3127'. [ 662.736839][T19396] netlink: 72 bytes leftover after parsing attributes in process `syz.3.3127'. [ 662.899394][T19406] netlink: 8 bytes leftover after parsing attributes in process `syz.3.3278'. [ 662.915051][T19407] netlink: 36 bytes leftover after parsing attributes in process `syz.0.3274'. [ 663.216461][T19412] netlink: 2 bytes leftover after parsing attributes in process `syz.3.3279'. [ 663.254720][T19412] openvswitch: netlink: Missing key (keys=40, expected=10000000) [ 663.277285][ T7894] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 663.291651][ T7894] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 663.303307][ T7894] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 663.315832][ T7894] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 663.324656][ T7894] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 663.611925][T19430] block nbd3: not configured, cannot reconfigure [ 664.109795][T19450] netlink: 'syz.3.3286': attribute type 11 has an invalid length. [ 664.592803][T19470] gretap1: entered promiscuous mode [ 664.666999][T19466] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 664.698237][ C1] ip6_tunnel: ip6gre4 xmit: Local address not yet configured! [ 665.418304][ T5630] Bluetooth: hci2: command tx timeout [ 665.470208][T19504] sch_tbf: burst 240 is lower than device lo mtu (65550) ! [ 665.496318][T19507] __nla_validate_parse: 14 callbacks suppressed [ 665.496338][T19507] netlink: 44 bytes leftover after parsing attributes in process `syz.4.3299'. [ 665.538145][T19507] netlink: 192 bytes leftover after parsing attributes in process `syz.4.3299'. [ 665.560750][T19507] netlink: 44 bytes leftover after parsing attributes in process `syz.4.3299'. [ 665.604007][T19500] syzkaller0: entered promiscuous mode [ 665.619220][T19500] syzkaller0: entered allmulticast mode [ 665.840608][T19524] netlink: 7 bytes leftover after parsing attributes in process `syz.3.3300'. [ 666.849533][T19577] netlink: 24 bytes leftover after parsing attributes in process `syz.4.3311'. [ 667.054009][T19578] netlink: 24 bytes leftover after parsing attributes in process `syz.4.3311'. [ 667.063374][T19413] bridge0: port 1(bridge_slave_0) entered blocking state [ 667.089173][T19413] bridge0: port 1(bridge_slave_0) entered disabled state [ 667.110599][T19413] bridge_slave_0: entered allmulticast mode [ 667.126611][T19413] bridge_slave_0: entered promiscuous mode [ 667.143925][T19413] bridge0: port 2(bridge_slave_1) entered blocking state [ 667.159548][T19413] bridge0: port 2(bridge_slave_1) entered disabled state [ 667.170310][T19413] bridge_slave_1: entered allmulticast mode [ 667.206758][T19413] bridge_slave_1: entered promiscuous mode [ 667.325477][T19413] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 667.342772][T19413] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 667.372743][T19600] workqueue: Failed to create a rescuer kthread for wq "nfc3_nci_rx_wq": -EINTR [ 667.385968][T19413] team0: Port device team_slave_0 added [ 667.405307][T19413] team0: Port device team_slave_1 added [ 667.509156][ T5630] Bluetooth: hci2: command tx timeout [ 667.670763][T19413] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 667.697419][T19413] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 667.758497][T19413] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 667.826692][T19413] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 667.858726][T19413] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 667.887968][T19413] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 667.926747][T19625] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 667.961109][T19413] hsr_slave_0: entered promiscuous mode [ 667.976538][T19413] hsr_slave_1: entered promiscuous mode [ 668.068620][T19636] team0: entered promiscuous mode [ 668.086836][T19636] team_slave_0: entered promiscuous mode [ 668.151897][T19636] team_slave_1: entered promiscuous mode [ 668.273468][T19641] netlink: 12 bytes leftover after parsing attributes in process `syz.3.3321'. [ 668.703469][T19648] netlink: 28 bytes leftover after parsing attributes in process `syz.1.3322'. [ 668.829787][T19641] ipvlan2: entered allmulticast mode [ 668.835125][T19641] gretap0: entered allmulticast mode [ 669.465485][T19663] netlink: 4 bytes leftover after parsing attributes in process `syz.0.3325'. [ 669.577956][ T5630] Bluetooth: hci2: command tx timeout [ 670.206380][T19413] netdevsim netdevsim2 netdevsim0: renamed from eth0 [ 670.217327][T19413] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 670.233542][T19413] netdevsim netdevsim2 netdevsim1: renamed from eth1 [ 670.253568][T19413] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 670.268710][T19413] netdevsim netdevsim2 netdevsim2: renamed from eth2 [ 670.290881][T19413] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 670.308158][T19413] netdevsim netdevsim2 netdevsim3: renamed from eth3 [ 670.323142][T19413] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 670.349852][T19705] tipc: Enabled bearer , priority 0 [ 670.357549][T19706] syzkaller0: entered promiscuous mode [ 670.364636][T19706] syzkaller0: entered allmulticast mode [ 670.372980][T19713] sch_tbf: burst 255 is lower than device syzkaller0 mtu (1514) ! [ 670.408388][T19703] tipc: Resetting bearer [ 670.457143][T19703] tipc: Disabling bearer [ 670.493253][T19719] netlink: 3 bytes leftover after parsing attributes in process `syz.4.3339'. [ 670.700792][T19716] nbd: nbd1 already in use [ 670.715076][T19716] block nbd1: NBD_DISCONNECT [ 670.720380][T19413] 8021q: adding VLAN 0 to HW filter on device bond0 [ 670.730513][T19716] block nbd1: Send disconnect failed -32 [ 670.742108][T19716] block nbd1: shutting down sockets [ 670.771551][T19413] 8021q: adding VLAN 0 to HW filter on device team0 [ 671.014242][T19732] netlink: 8 bytes leftover after parsing attributes in process `syz.0.3341'. [ 671.066202][T19728] A link change request failed with some changes committed already. Interface vxlan2 may have been left with an inconsistent configuration, please check. [ 671.167322][ T99] dvmrp0: left allmulticast mode [ 671.181273][ T99] pimreg: left allmulticast mode [ 671.190237][ T99] pimreg9: left allmulticast mode [ 671.202424][T19737] netlink: 4 bytes leftover after parsing attributes in process `syz.0.3341'. [ 671.276394][T19739] netlink: 'syz.0.3341': attribute type 3 has an invalid length. [ 671.658924][ T5630] Bluetooth: hci2: command tx timeout [ 671.866301][ T99] bond4 (unregistering): (slave geneve3): Releasing active interface [ 671.916994][ T99] team0: Port device bridge1 removed [ 671.932459][ T99] team0: Port device bridge2 removed [ 671.949326][ T99] team0: Port device bridge4 removed [ 672.006251][ T99] bond1 (unregistering): Released all slaves [ 672.022265][ T99] bond0 (unregistering): Released all slaves [ 672.043494][ T99] bond2 (unregistering): Released all slaves [ 672.062390][ T99] bond3 (unregistering): (slave veth13): Releasing backup interface [ 672.071507][ T99] bond3 (unregistering): Released all slaves [ 672.088788][ T99] bond4 (unregistering): Released all slaves [ 672.113433][T19734] kthread_run failed with err -4 [ 672.360259][ T12] bridge0: port 1(bridge_slave_0) entered blocking state [ 672.367601][ T12] bridge0: port 1(bridge_slave_0) entered forwarding state [ 672.424812][ T99] tipc: Disabling bearer [ 672.439468][ T99] tipc: Left network mode [ 672.459381][ T12] bridge0: port 2(bridge_slave_1) entered blocking state [ 672.466604][ T12] bridge0: port 2(bridge_slave_1) entered forwarding state [ 672.619649][ T99] ================================================================== [ 672.627789][ T99] BUG: KASAN: slab-use-after-free in fib_rules_lookup+0x15e/0xeb0 [ 672.635731][ T99] Read of size 8 at addr ffff88801b7b1980 by task kworker/u8:5/99 [ 672.643560][ T99] [ 672.645927][ T99] CPU: 0 UID: 0 PID: 99 Comm: kworker/u8:5 Not tainted syzkaller #0 PREEMPT(full) [ 672.645947][ T99] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 672.645959][ T99] Workqueue: netns cleanup_net [ 672.646067][ T99] Call Trace: [ 672.646073][ T99] [ 672.646081][ T99] dump_stack_lvl+0xe8/0x150 [ 672.646101][ T99] print_address_description+0x55/0x1e0 [ 672.646127][ T99] ? fib_rules_lookup+0x15e/0xeb0 [ 672.646155][ T99] print_report+0x58/0x70 [ 672.646169][ T99] kasan_report+0x117/0x150 [ 672.646196][ T99] ? fib_rules_lookup+0x15e/0xeb0 [ 672.646215][ T99] ? fib_rules_lookup+0x99/0xeb0 [ 672.646231][ T99] fib_rules_lookup+0x15e/0xeb0 [ 672.646268][ T99] ? fib_rules_lookup+0x99/0xeb0 [ 672.646289][ T99] ? __pfx_fib_rules_lookup+0x10/0x10 [ 672.646308][ T99] ? l3mdev_update_flow+0x26/0x610 [ 672.646367][ T99] ? l3mdev_update_flow+0x4ad/0x610 [ 672.646389][ T99] __fib_lookup+0x106/0x210 [ 672.646435][ T99] ? stack_depot_save_flags+0x33/0x800 [ 672.646454][ T99] ? __pfx___fib_lookup+0x10/0x10 [ 672.646471][ T99] ? kasan_record_aux_stack+0xbd/0xd0 [ 672.646490][ T99] ? call_rcu+0xee/0x8b0 [ 672.646509][ T99] ? evict+0x987/0xb50 [ 672.646533][ T99] ? fou_exit_net+0x17d/0x1f0 [ 672.646551][ T99] ? fib_lookup+0x49/0x440 [ 672.646596][ T99] ? ip_route_output_key_hash_rcu+0x274/0x2720 [ 672.646642][ T99] ip_route_output_key_hash_rcu+0x294/0x2720 [ 672.646670][ T99] ? ip_route_output_key_hash+0xd8/0x2a0 [ 672.646693][ T99] ? ip_route_output_key_hash+0xd8/0x2a0 [ 672.646716][ T99] ip_route_output_key_hash+0x18d/0x2a0 [ 672.646741][ T99] ? __pfx_ip_route_output_key_hash+0x10/0x10 [ 672.646766][ T99] ? lock_acquire+0x106/0x350 [ 672.646786][ T99] ip_route_output_flow+0x2a/0x150 [ 672.646810][ T99] ip4_datagram_release_cb+0x89d/0xbe0 [ 672.646850][ T99] ? ip4_datagram_release_cb+0xa2/0xbe0 [ 672.646873][ T99] ? __pfx_ip4_datagram_release_cb+0x10/0x10 [ 672.646893][ T99] ? do_raw_spin_lock+0x12b/0x2f0 [ 672.646928][ T99] ? release_sock+0x2f/0x260 [ 672.646952][ T99] release_sock+0x206/0x260 [ 672.646975][ T99] inet_shutdown+0x2b1/0x390 [ 672.647046][ T99] udp_tunnel_sock_release+0x6d/0x80 [ 672.647089][ T99] fou_exit_net+0x17d/0x1f0 [ 672.647109][ T99] ops_undo_list+0x43d/0x8d0 [ 672.647137][ T99] ? __pfx_ops_undo_list+0x10/0x10 [ 672.647161][ T99] ? idr_destroy+0x218/0x290 [ 672.647195][ T99] ? do_raw_spin_unlock+0xf5/0x210 [ 672.647220][ T99] cleanup_net+0x572/0x810 [ 672.647245][ T99] ? __pfx_cleanup_net+0x10/0x10 [ 672.647271][ T99] ? rcu_is_watching+0x15/0xb0 [ 672.647290][ T99] ? process_scheduled_works+0xa20/0x14e0 [ 672.647311][ T99] process_scheduled_works+0xa8e/0x14e0 [ 672.647339][ T99] ? __pfx_process_scheduled_works+0x10/0x10 [ 672.647357][ T99] ? assign_work+0x3cf/0x5d0 [ 672.647373][ T99] worker_thread+0xa47/0xfb0 [ 672.647396][ T99] ? __kthread_parkme+0x71/0x1f0 [ 672.647419][ T99] kthread+0x389/0x470 [ 672.647439][ T99] ? __pfx_worker_thread+0x10/0x10 [ 672.647454][ T99] ? __pfx_kthread+0x10/0x10 [ 672.647473][ T99] ret_from_fork+0x514/0xb70 [ 672.647504][ T99] ? __pfx_ret_from_fork+0x10/0x10 [ 672.647519][ T99] ? __switch_to+0xc89/0x1420 [ 672.647543][ T99] ? __pfx_kthread+0x10/0x10 [ 672.647563][ T99] ret_from_fork_asm+0x1a/0x30 [ 672.647609][ T99] [ 672.647615][ T99] [ 672.973337][ T99] Allocated by task 5627: [ 672.977684][ T99] kasan_save_track+0x3e/0x80 [ 672.982396][ T99] __kasan_kmalloc+0x93/0xb0 [ 672.987007][ T99] __kmalloc_node_track_caller_noprof+0x4d7/0x7b0 [ 672.993455][ T99] kmemdup_noprof+0x2b/0x70 [ 672.998019][ T99] fib_rules_register+0x2f/0x400 [ 673.002977][ T99] fib4_rules_init+0x21/0x160 [ 673.007670][ T99] fib_net_init+0x17a/0x3e0 [ 673.012242][ T99] ops_init+0x35d/0x5d0 [ 673.016429][ T99] setup_net+0x118/0x350 [ 673.020681][ T99] copy_net_ns+0x4f9/0x720 [ 673.025116][ T99] create_new_namespaces+0x3f0/0x6b0 [ 673.030407][ T99] unshare_nsproxy_namespaces+0x149/0x190 [ 673.036136][ T99] ksys_unshare+0x57d/0xa00 [ 673.040649][ T99] __x64_sys_unshare+0x38/0x50 [ 673.045433][ T99] do_syscall_64+0x174/0x580 [ 673.050045][ T99] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 673.055959][ T99] [ 673.058298][ T99] Freed by task 19716: [ 673.062378][ T99] kasan_save_track+0x3e/0x80 [ 673.067080][ T99] kasan_save_free_info+0x40/0x50 [ 673.072138][ T99] __kasan_slab_free+0x5c/0x80 [ 673.076931][ T99] __rcu_free_sheaf_prepare+0x12d/0x2a0 [ 673.082495][ T99] rcu_free_sheaf+0x31/0x200 [ 673.087141][ T99] rcu_core+0x78b/0x10a0 [ 673.091401][ T99] handle_softirqs+0x225/0x840 [ 673.096182][ T99] do_softirq+0x76/0xd0 [ 673.100345][ T99] __local_bh_enable_ip+0xf8/0x130 [ 673.105470][ T99] tipc_wait_for_rcvmsg+0x342/0x640 [ 673.110773][ T99] tipc_recvmsg+0x1f8/0x13e0 [ 673.115390][ T99] sock_recvmsg+0x172/0x1b0 [ 673.119938][ T99] ____sys_recvmsg+0x1e6/0x4a0 [ 673.124719][ T99] ___sys_recvmsg+0x213/0x590 [ 673.129417][ T99] do_recvmmsg+0x329/0x810 [ 673.133858][ T99] __x64_sys_recvmmsg+0x198/0x250 [ 673.138905][ T99] do_syscall_64+0x174/0x580 [ 673.143602][ T99] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 673.149510][ T99] [ 673.151871][ T99] The buggy address belongs to the object at ffff88801b7b1900 [ 673.151871][ T99] which belongs to the cache kmalloc-192 of size 192 [ 673.165940][ T99] The buggy address is located 128 bytes inside of [ 673.165940][ T99] freed 192-byte region [ffff88801b7b1900, ffff88801b7b19c0) [ 673.179744][ T99] [ 673.182086][ T99] The buggy address belongs to the physical page: [ 673.188511][ T99] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0xffff88801b7b1300 pfn:0x1b7b1 [ 673.198589][ T99] flags: 0xfff00000000200(workingset|node=0|zone=1|lastcpupid=0x7ff) [ 673.206665][ T99] page_type: f5(slab) [ 673.210741][ T99] raw: 00fff00000000200 ffff88813fe163c0 ffffea0000a8ab50 ffffea00006de5d0 [ 673.219368][ T99] raw: ffff88801b7b1300 000000080010000f 00000000f5000000 0000000000000000 [ 673.227962][ T99] page dumped because: kasan: bad access detected [ 673.234389][ T99] page_owner tracks the page as allocated [ 673.240118][ T99] page last allocated via order 0, migratetype Unmovable, gfp_mask 0xd2cc0(GFP_KERNEL|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 1, tgid 1 (swapper/0), ts 4749282220, free_ts 0 [ 673.259406][ T99] post_alloc_hook+0x22d/0x280 [ 673.264200][ T99] get_page_from_freelist+0x24ae/0x2530 [ 673.269787][ T99] __alloc_frozen_pages_noprof+0x18d/0x380 [ 673.275625][ T99] allocate_slab+0x77/0x660 [ 673.280148][ T99] refill_objects+0x336/0x3d0 [ 673.284849][ T99] __pcs_replace_empty_main+0x320/0x720 [ 673.290415][ T99] __kmalloc_cache_noprof+0x388/0x660 [ 673.295812][ T99] call_usermodehelper_setup+0x8e/0x270 [ 673.301387][ T99] kobject_uevent_env+0x662/0x9e0 [ 673.306521][ T99] tty_register_device_attr+0x573/0x950 [ 673.312163][ T99] tty_register_driver+0x82c/0xdf0 [ 673.317299][ T99] vty_init+0x1e4/0x2d0 [ 673.321554][ T99] tty_init+0x118/0x150 [ 673.325754][ T99] do_one_initcall+0x250/0x870 [ 673.330538][ T99] do_initcall_level+0x10a/0x1a0 [ 673.335513][ T99] do_initcalls+0x59/0xa0 [ 673.339868][ T99] page_owner free stack trace missing [ 673.345247][ T99] [ 673.347592][ T99] Memory state around the buggy address: [ 673.353320][ T99] ffff88801b7b1880: 00 00 00 00 00 00 00 06 fc fc fc fc fc fc fc fc [ 673.361395][ T99] ffff88801b7b1900: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 673.369466][ T99] >ffff88801b7b1980: fb fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc [ 673.377538][ T99] ^ [ 673.381625][ T99] ffff88801b7b1a00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 673.389701][ T99] ffff88801b7b1a80: 00 00 00 00 00 00 00 00 fc fc fc fc fc fc fc fc [ 673.397859][ T99] ================================================================== [ 673.406129][ T99] Kernel panic - not syncing: KASAN: panic_on_warn set ... [ 673.413396][ T99] CPU: 0 UID: 0 PID: 99 Comm: kworker/u8:5 Not tainted syzkaller #0 PREEMPT(full) [ 673.422705][ T99] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 673.432782][ T99] Workqueue: netns cleanup_net [ 673.437621][ T99] Call Trace: [ 673.440924][ T99] [ 673.443892][ T99] vpanic+0x56c/0xa60 [ 673.447905][ T99] ? rcu_is_watching+0x15/0xb0 [ 673.452701][ T99] ? __pfx_vpanic+0x10/0x10 [ 673.457244][ T99] panic+0xc5/0xd0 [ 673.461005][ T99] ? __pfx_panic+0x10/0x10 [ 673.465459][ T99] ? fib_rules_lookup+0x15e/0xeb0 [ 673.470538][ T99] ? fib_rules_lookup+0x15e/0xeb0 [ 673.475598][ T99] check_panic_on_warn+0x89/0xb0 [ 673.480580][ T99] ? fib_rules_lookup+0x15e/0xeb0 [ 673.485643][ T99] end_report+0x73/0x170 [ 673.490015][ T99] ? fib_rules_lookup+0x15e/0xeb0 [ 673.495071][ T99] kasan_report+0x128/0x150 [ 673.499618][ T99] ? fib_rules_lookup+0x15e/0xeb0 [ 673.504688][ T99] ? fib_rules_lookup+0x99/0xeb0 [ 673.509745][ T99] fib_rules_lookup+0x15e/0xeb0 [ 673.514635][ T99] ? fib_rules_lookup+0x99/0xeb0 [ 673.519607][ T99] ? __pfx_fib_rules_lookup+0x10/0x10 [ 673.525012][ T99] ? l3mdev_update_flow+0x26/0x610 [ 673.530165][ T99] ? l3mdev_update_flow+0x4ad/0x610 [ 673.535395][ T99] __fib_lookup+0x106/0x210 [ 673.539927][ T99] ? stack_depot_save_flags+0x33/0x800 [ 673.545418][ T99] ? __pfx___fib_lookup+0x10/0x10 [ 673.550480][ T99] ? kasan_record_aux_stack+0xbd/0xd0 [ 673.555895][ T99] ? call_rcu+0xee/0x8b0 [ 673.560194][ T99] ? evict+0x987/0xb50 [ 673.564296][ T99] ? fou_exit_net+0x17d/0x1f0 [ 673.569012][ T99] ? fib_lookup+0x49/0x440 [ 673.573485][ T99] ? ip_route_output_key_hash_rcu+0x274/0x2720 [ 673.579682][ T99] ip_route_output_key_hash_rcu+0x294/0x2720 [ 673.585695][ T99] ? ip_route_output_key_hash+0xd8/0x2a0 [ 673.591422][ T99] ? ip_route_output_key_hash+0xd8/0x2a0 [ 673.597094][ T99] ip_route_output_key_hash+0x18d/0x2a0 [ 673.602728][ T99] ? __pfx_ip_route_output_key_hash+0x10/0x10 [ 673.608838][ T99] ? lock_acquire+0x106/0x350 [ 673.613552][ T99] ip_route_output_flow+0x2a/0x150 [ 673.618702][ T99] ip4_datagram_release_cb+0x89d/0xbe0 [ 673.624202][ T99] ? ip4_datagram_release_cb+0xa2/0xbe0 [ 673.629789][ T99] ? __pfx_ip4_datagram_release_cb+0x10/0x10 [ 673.635795][ T99] ? do_raw_spin_lock+0x12b/0x2f0 [ 673.640856][ T99] ? release_sock+0x2f/0x260 [ 673.645499][ T99] release_sock+0x206/0x260 [ 673.650075][ T99] inet_shutdown+0x2b1/0x390 [ 673.654723][ T99] udp_tunnel_sock_release+0x6d/0x80 [ 673.660060][ T99] fou_exit_net+0x17d/0x1f0 [ 673.664605][ T99] ops_undo_list+0x43d/0x8d0 [ 673.669260][ T99] ? __pfx_ops_undo_list+0x10/0x10 [ 673.674418][ T99] ? idr_destroy+0x218/0x290 [ 673.679038][ T99] ? do_raw_spin_unlock+0xf5/0x210 [ 673.684222][ T99] cleanup_net+0x572/0x810 [ 673.688680][ T99] ? __pfx_cleanup_net+0x10/0x10 [ 673.693649][ T99] ? rcu_is_watching+0x15/0xb0 [ 673.698447][ T99] ? process_scheduled_works+0xa20/0x14e0 [ 673.704186][ T99] process_scheduled_works+0xa8e/0x14e0 [ 673.709778][ T99] ? __pfx_process_scheduled_works+0x10/0x10 [ 673.715795][ T99] ? assign_work+0x3cf/0x5d0 [ 673.720415][ T99] worker_thread+0xa47/0xfb0 [ 673.725035][ T99] ? __kthread_parkme+0x71/0x1f0 [ 673.730008][ T99] kthread+0x389/0x470 [ 673.734098][ T99] ? __pfx_worker_thread+0x10/0x10 [ 673.739238][ T99] ? __pfx_kthread+0x10/0x10 [ 673.743876][ T99] ret_from_fork+0x514/0xb70 [ 673.748507][ T99] ? __pfx_ret_from_fork+0x10/0x10 [ 673.753654][ T99] ? __switch_to+0xc89/0x1420 [ 673.758378][ T99] ? __pfx_kthread+0x10/0x10 [ 673.763012][ T99] ret_from_fork_asm+0x1a/0x30 [ 673.767827][ T99] [ 673.771482][ T99] Kernel Offset: disabled [ 673.775814][ T99] Rebooting in 86400 seconds..