last executing test programs: 3.909509781s ago: executing program 4 (id=8008): socket$nl_route(0x10, 0x3, 0x0) (async) r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0300000004000000040000000a00000000000000", @ANYRES32=0x1, @ANYBLOB='\x00'/20, @ANYRES32=0x0, @ANYRES32, @ANYBLOB="0200000000000300"/26], 0x50) r2 = socket$inet6_sctp(0xa, 0x5, 0x84) setsockopt(r2, 0x84, 0x81, &(0x7f00000002c0)="020000000980ffff", 0x8) ioctl$INCFS_IOC_GET_FILLED_BLOCKS(r1, 0x80286722, &(0x7f0000000100)={&(0x7f0000000080)=""/105, 0x69, 0x9, 0xffffffff}) sendmsg$nl_route(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000580)={&(0x7f00000002c0)=@newlink={0x4c, 0x10, 0x403, 0x800000, 0x0, {0x0, 0x0, 0x0, 0x0, 0x830}, [@IFLA_LINKINFO={0x2c, 0x12, 0x0, 0x1, @bond={{0x9}, {0x1c, 0x2, 0x0, 0x1, [@IFLA_BOND_AD_USER_PORT_KEY={0x6, 0x19, 0x7}, @IFLA_BOND_MODE={0x5, 0x1, 0x4}, @IFLA_BOND_AD_ACTOR_SYSTEM={0x8, 0x1a, @multicast2}]}}}]}, 0x4c}, 0x1, 0xba01}, 0x0) socket$nl_route(0x10, 0x3, 0x0) (async) socket$nl_route(0x10, 0x3, 0x0) r3 = socket$inet6(0xa, 0x80002, 0x0) setsockopt$sock_int(r3, 0x1, 0xf, &(0x7f0000000180)=0x80000004, 0x4) bind$inet6(r3, &(0x7f0000000200)={0xa, 0x4e20, 0x440007, @empty, 0xffff8000}, 0x1c) (async) bind$inet6(r3, &(0x7f0000000200)={0xa, 0x4e20, 0x440007, @empty, 0xffff8000}, 0x1c) socket$inet6(0xa, 0x80002, 0x0) (async) r4 = socket$inet6(0xa, 0x80002, 0x0) setsockopt$sock_int(r4, 0x1, 0xf, &(0x7f0000000180)=0x80000004, 0x4) setsockopt$SO_ATTACH_FILTER(r4, 0x1, 0x33, &(0x7f0000000000)={0x1, &(0x7f0000000140)=[{0x6, 0x0, 0x1}]}, 0x10) bind$inet6(r4, &(0x7f0000000200)={0xa, 0x4e20, 0x1, @ipv4={'\x00', '\xff\xff', @empty}, 0x8}, 0x1c) (async) bind$inet6(r4, &(0x7f0000000200)={0xa, 0x4e20, 0x1, @ipv4={'\x00', '\xff\xff', @empty}, 0x8}, 0x1c) ioctl$sock_ipv6_tunnel_SIOCADDTUNNEL(r0, 0x89f1, &(0x7f00000001c0)={'syztnl0\x00', &(0x7f0000000140)={'ip6gre0\x00', 0x0, 0x2f, 0x2, 0x7, 0x3, 0xc, @private1, @dev={0xfe, 0x80, '\x00', 0x3f}, 0x40, 0x7800, 0x9d, 0x200}}) r5 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000340)='./cgroup/syz0\x00', 0x200002, 0x0) r6 = openat$cgroup_ro(r5, &(0x7f0000000380)='memory.swap.current\x00', 0x275a, 0x0) writev(r6, &(0x7f00000009c0)=[{&(0x7f0000000400)="1e8fcce8f00c20c3713b0c220663c3b66bb174e7d57d1fe72dbb0d27d9cbe1ec30047462375528c2c005a0ccd366c1ab0b8e5e0d788c178dbbdea330a90fa9e7c51a1aaf175a9d59559f29c09ff5e337e791be17c1ef703647852fe9e1b3ab3e", 0x60}], 0x1) r7 = socket$inet6(0xa, 0x80003, 0xff) setsockopt$inet6_int(r7, 0x29, 0x16, &(0x7f0000fcb000), 0x4) (async) setsockopt$inet6_int(r7, 0x29, 0x16, &(0x7f0000fcb000), 0x4) socket$inet6(0xa, 0x3, 0xff) close(0x4) socket$inet6_udp(0xa, 0x2, 0x0) (async) r8 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r8, 0x29, 0x40, &(0x7f0000002880)=@raw={'raw\x00', 0x3c1, 0x3, 0x13c0, 0x11e0, 0xc8, 0x8, 0x4000000, 0x5803, 0x12f0, 0x2e8, 0x2e8, 0x12f0, 0x2e8, 0x3, 0x0, {[{{@uncond, 0x0, 0x1198, 0x11e0, 0x0, {0x0, 0x2000000000000}, [@common=@unspec=@string={{0xc0}, {0x0, 0x0, 'bm\x00', "cfcaf80c672f61cd17ae5119b5135c2aee68d23a465cd431e1ecef50c3234e082555f67222476147864fa03182f5df11d8c348cbd06dc8de1dcbde7d4e252c3394fed47bf78c70f607b0178fa5ea335019ac07a602061c96baebc989f1f35a214e67262c1fe4b124e0f7323a587d2a1fcfe36bbf12eca0a7b66c60c527bac2b5", 0x2, 0x3}}, @common=@unspec=@cgroup1={{0x1030}, {0x0, 0x1, 0x0, 0x0, './cgroup.cpu/syz1\x00', 0x0, {0xfffffffffffffffc}}}]}, @unspec=@CT0={0x48, 'CT\x00', 0x0, {0x1, 0x81, 0x8, 0xe, 'syz0\x00', {0x1}}}}, {{@uncond, 0x0, 0xa8, 0x110}, @unspec=@CT2={0x68, 'CT\x00', 0x2, {0x0, 0x0, 0x0, 0x0, 'snmp\x00', 'syz1\x00'}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x1420) socket$unix(0x1, 0x0, 0x0) mmap(&(0x7f0000000000/0x4000)=nil, 0x4000, 0x1, 0x10012, r6, 0x0) (async) mmap(&(0x7f0000000000/0x4000)=nil, 0x4000, 0x1, 0x10012, r6, 0x0) socket$nl_generic(0x10, 0x3, 0x10) (async) r9 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r9, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000b40)=ANY=[@ANYBLOB="3400000040000006800c00018006000600800afeffecfe56790002800c001780040002000400"/52], 0x34}, 0x1, 0x0, 0x0, 0x48811}, 0x800c010) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='pids.current\x00', 0x275a, 0x0) (async) r10 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='pids.current\x00', 0x275a, 0x0) mmap(&(0x7f0000002000/0x3000)=nil, 0x3000, 0x0, 0x12, r10, 0x0) 3.473370303s ago: executing program 4 (id=8015): syz_emit_ethernet(0x6e, &(0x7f00000003c0)={@multicast, @empty, @void, {@ipv6={0x86dd, @icmpv6={0x0, 0x6, "02adf7", 0x38, 0x3a, 0x0, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, @mcast2, {[], @time_exceed={0x2, 0x0, 0x0, 0x0, '\x00', {0x0, 0x6, "fd9063", 0x0, 0x32, 0x0, @local, @loopback, [@fragment={0x3c, 0x0, 0x8, 0x0, 0x0, 0x13, 0x65}]}}}}}}}, 0x0) r0 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000000)='cpuset.memory_pressure_enabled\x00', 0x0, 0x0) write$tun(r0, &(0x7f0000000040)={@void, @void, @ipv4=@icmp={{0x13, 0x4, 0x1, 0x26, 0x54, 0x66, 0x0, 0xc, 0x1, 0x0, @empty, @loopback, {[@timestamp_prespec={0x44, 0x24, 0xe5, 0x3, 0x3, [{@private=0xa010102, 0x9}, {@broadcast, 0xf}, {@initdev={0xac, 0x1e, 0x1, 0x0}, 0x5}, {@remote, 0x9}]}, @cipso={0x86, 0x12, 0xffffffffffffffff, [{0x6, 0xc, "ec121e252881dc9508c3"}]}]}}, @address_request={0x11, 0x0, 0x0, 0xb}}}, 0x54) ioctl$sock_ipv6_tunnel_SIOCADDTUNNEL(0xffffffffffffffff, 0x89f1, &(0x7f0000000040)={'syztnl2\x00', &(0x7f0000000140)={'syztnl1\x00', 0x0, 0x0, 0x0, 0xf9, 0x1, 0x50, @ipv4={'\x00', '\xff\xff', @loopback}, @loopback={0x0, 0xffff888101827518}, 0x80f, 0x20, 0x1, 0xfffffff8}}) socket$inet_mptcp(0x2, 0x1, 0x106) r2 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r2, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000001c0)=ANY=[@ANYBLOB="3800000040000100fcff0700040000000100000004004880140001801000108004000f8005000300000000000c0002", @ANYRESDEC=0x0, @ANYRESDEC=r1, @ANYRES32=r2], 0x38}, 0x1, 0x0, 0x0, 0x400c800}, 0x4809c) r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$netlbl_cipso(&(0x7f0000000540), r3) r5 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NLBL_CIPSOV4_C_ADD(r5, &(0x7f0000000700)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000880)={0x50, r4, 0x1, 0x0, 0x0, {}, [@NLBL_CIPSOV4_A_TAGLST={0x2c, 0x4, 0x0, 0x1, [{0x5, 0x3, 0x2}, {0x5, 0x3, 0x2}, {0x5}, {0x5}, {0x5, 0x3, 0x2}]}, @NLBL_CIPSOV4_A_DOI={0x8, 0x1, 0xffffffffffffffff}, @NLBL_CIPSOV4_A_MTYPE={0x8, 0x2, 0x2}]}, 0x50}}, 0x0) r6 = socket$nl_sock_diag(0x10, 0x3, 0x4) setsockopt$inet6_tcp_TCP_REPAIR_WINDOW(0xffffffffffffffff, 0x6, 0x1d, &(0x7f0000000240)={0x3, 0x207ff, 0x2, 0x100, 0x9}, 0x14) r7 = bpf$BPF_PROG_GET_FD_BY_ID(0xd, &(0x7f0000000000), 0x4) setsockopt$sock_attach_bpf(r6, 0x1, 0x32, &(0x7f0000000080)=r7, 0x4) bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000040)={&(0x7f0000000540)=ANY=[@ANYBLOB="9feb010018000000000000002800000028000000020000000100170f0300000000000001010000000300000044942d000000000000000f01000084002e2e2e5f61000000000000"], &(0x7f00000014c0)=""/2, 0x47, 0x2, 0x1}, 0x28) r8 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r8, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r9 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r9, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r9, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000880)=@newqdisc={0x70, 0x24, 0x4ee4e6a52ff56541, 0x1, 0x25dfdbfd, {0x0, 0x0, 0x0, r10, {0x0, 0xb}, {0xffff, 0xffff}, {0xfff2}}, [@qdisc_kind_options=@q_tbf={{0x8}, {0x44, 0x2, [@TCA_TBF_PARMS={0x28, 0x1, {{0x5a, 0x2, 0x84d, 0x9, 0x1, 0x800}, {0x8c, 0x1, 0xfffc, 0x7fff, 0x2, 0xb}, 0x5, 0x34, 0x91f}}, @TCA_TBF_PRATE64={0xc, 0x5, 0xc2240edb8ac75ac7}, @TCA_TBF_RATE64={0xc, 0x4, 0xdd31e353c9fd1eb}]}}]}, 0x70}, 0x1, 0x0, 0x0, 0x40088c1}, 0x50) sendmsg$nl_route_sched(r9, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000480)=@newqdisc={0x40, 0x24, 0x4ee4e6a52ff56541, 0x70b926, 0x25dfdc01, {0x0, 0x0, 0x0, r10, {0x0, 0x3}, {0x6, 0xb}, {0xe, 0xffea}}, [@qdisc_kind_options=@q_pfifo_head_drop={{0x14}, {0x8}}]}, 0x40}, 0x1, 0x0, 0x0, 0x2400c061}, 0x4890) socket$kcm(0x11, 0x3, 0x0) r11 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) close(r11) r12 = socket$inet6_sctp(0xa, 0x5, 0x84) setsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX_OLD(r12, 0x84, 0x6b, &(0x7f00000000c0)=[@in6={0xa, 0x4e24, 0x9, @remote, 0x5}], 0x1c) setsockopt(r12, 0x84, 0x7f, &(0x7f0000000040)="020000000980ffff", 0x8) recvmsg(r12, &(0x7f0000000300)={0x0, 0x0, 0x0}, 0x0) socket$nl_route(0x10, 0x3, 0x0) 3.415845117s ago: executing program 1 (id=8018): r0 = socket(0x10, 0x803, 0x0) sendmsg$nl_route(r0, &(0x7f00000006c0)={0x0, 0x0, &(0x7f0000000680)={0x0, 0x18}}, 0x0) getsockname$packet(r0, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) r2 = socket(0x10, 0x803, 0x0) ioctl$sock_ipv6_tunnel_SIOCADDTUNNEL(r2, 0x89f1, &(0x7f00000000c0)={'ip6_vti0\x00', &(0x7f0000000440)={'syztnl1\x00', r1, 0x0, 0x4, 0xfe, 0x100, 0x0, @dev={0xfe, 0x80, '\x00', 0x35}, @mcast2, 0x8000, 0x700, 0x2, 0x2aa1f153}}) ioctl$sock_ipv6_tunnel_SIOCCHGTUNNEL(r2, 0x89f3, &(0x7f0000000080)={'syztnl1\x00', &(0x7f0000000100)={'ip6tnl0\x00', r3, 0x0, 0x2, 0x64, 0x1ac9ee85, 0x0, @mcast1, @ipv4={'\x00', '\xff\xff', @multicast1}, 0x0, 0x1, 0xd, 0xa174}}) bpf$PROG_LOAD(0x5, &(0x7f0000000740)={0x1, 0x4, &(0x7f0000000580)=@framed={{0x18, 0x5, 0x0, 0x0, 0x40000}, [@call={0x85, 0x0, 0x0, 0x19}]}, &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8000}, 0x94) 3.372699181s ago: executing program 2 (id=8019): bpf$BPF_GET_PROG_INFO(0xf, &(0x7f0000000300)={0xffffffffffffffff, 0xe0, &(0x7f0000000200)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, &(0x7f0000000040)=[0x0, 0x0, 0x0, 0x0], ""/16, 0x0, 0x0, 0x0, 0x0, 0x6, 0x1, &(0x7f0000000080)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0], &(0x7f00000000c0)=[0x0], 0x0, 0x74, &(0x7f0000000100)=[{}, {}, {}, {}, {}, {}, {}], 0x38, 0x10, &(0x7f0000000140), &(0x7f0000000180), 0x8, 0xd3, 0x8, 0x8, &(0x7f00000001c0)}}, 0x10) sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000003c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f0000000380)={&(0x7f0000000340)=@ipv4_deladdr={0x28, 0x15, 0x4, 0x70bd29, 0x25dfdbfc, {0x2, 0x1, 0x22, 0xfe, r0}, [@IFA_LOCAL={0x8, 0x2, @local}, @IFA_BROADCAST={0x8, 0x4, @remote}]}, 0x28}, 0x1, 0x0, 0x0, 0x1}, 0x40000) r1 = socket$netlink(0x10, 0x3, 0xc) r2 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000440), 0xffffffffffffffff) sendmsg$IPVS_CMD_NEW_DAEMON(r1, &(0x7f00000005c0)={&(0x7f0000000400)={0x10, 0x0, 0x0, 0x20000}, 0xc, &(0x7f0000000580)={&(0x7f0000000480)={0xf4, r2, 0x8, 0x70bd27, 0x25dfdbfb, {}, [@IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5, 0x7}, @IPVS_CMD_ATTR_TIMEOUT_UDP={0x8, 0x6, 0xa}, @IPVS_CMD_ATTR_DAEMON={0x48, 0x3, 0x0, 0x1, [@IPVS_DAEMON_ATTR_MCAST_GROUP6={0x14, 0x6, @empty}, @IPVS_DAEMON_ATTR_SYNC_ID={0x8}, @IPVS_DAEMON_ATTR_STATE={0x8}, @IPVS_DAEMON_ATTR_SYNC_ID={0x8, 0x3, 0x1}, @IPVS_DAEMON_ATTR_SYNC_ID={0x8, 0x3, 0x2}, @IPVS_DAEMON_ATTR_MCAST_TTL={0x5, 0x8, 0xb}, @IPVS_DAEMON_ATTR_STATE={0x8, 0x1, 0x2}]}, @IPVS_CMD_ATTR_DEST={0x1c, 0x2, 0x0, 0x1, [@IPVS_DEST_ATTR_WEIGHT={0x8, 0x4, 0x4}, @IPVS_DEST_ATTR_TUN_FLAGS={0x6, 0xf, 0x5}, @IPVS_DEST_ATTR_U_THRESH={0x8, 0x5, 0x7ff}]}, @IPVS_CMD_ATTR_DEST={0x58, 0x2, 0x0, 0x1, [@IPVS_DEST_ATTR_TUN_TYPE={0x5}, @IPVS_DEST_ATTR_PORT={0x6, 0x2, 0x4e22}, @IPVS_DEST_ATTR_L_THRESH={0x8, 0x6, 0x6}, @IPVS_DEST_ATTR_ADDR_FAMILY={0x6, 0xb, 0x2}, @IPVS_DEST_ATTR_PERSIST_CONNS={0x8, 0x9, 0x89d}, @IPVS_DEST_ATTR_L_THRESH={0x8, 0x6, 0x7}, @IPVS_DEST_ATTR_ADDR={0x14, 0x1, @ipv4=@rand_addr=0x64010101}, @IPVS_DEST_ATTR_WEIGHT={0x8, 0x4, 0x4}, @IPVS_DEST_ATTR_TUN_PORT={0x6, 0xe, 0x4e24}]}, @IPVS_CMD_ATTR_DEST={0x14, 0x2, 0x0, 0x1, [@IPVS_DEST_ATTR_L_THRESH={0x8, 0x6, 0x3}, @IPVS_DEST_ATTR_INACT_CONNS={0x8, 0x8, 0x1}]}]}, 0xf4}, 0x1, 0x0, 0x0, 0x1}, 0x811) (async) r3 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000640), r1) (async, rerun: 32) ioctl$ifreq_SIOCGIFINDEX_vcan(r1, 0x8933, &(0x7f0000000680)={'vcan0\x00', 0x0}) (rerun: 32) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f00000006c0)={'dvmrp0\x00', 0x0}) sendmsg$ETHTOOL_MSG_DEBUG_SET(0xffffffffffffffff, &(0x7f0000001880)={&(0x7f0000000600)={0x10, 0x0, 0x0, 0x800000}, 0xc, &(0x7f0000001840)={&(0x7f0000000700)={0x1138, r3, 0x30c, 0x70bd27, 0x25dfdbfc, {}, [@ETHTOOL_A_DEBUG_HEADER={0x40, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'syzkaller0\x00'}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x2}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x1}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r0}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x3}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8}]}, @ETHTOOL_A_DEBUG_HEADER={0x14, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r0}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x2}]}, @ETHTOOL_A_DEBUG_MSGMASK={0x100c, 0x2, 0x0, 0x1, [@ETHTOOL_A_BITSET_NOMASK={0x4}, @ETHTOOL_A_BITSET_VALUE={0x1004, 0x4, "dab8c150a015ea786e79bd7399d3540cb14741b2ecd502fcaca8eca8baaacb4b784ca24346954b01a2edff35c4d36396b9d7456005e56926ae638cb9e4f4cfcb0995a43c66e49276d1534f6cc53233e2a0cff18873108fcd8042aa005865c9585d856f2386a02ab40677163a689aaadf80119a5a35c8072163c26bf6edf30ff64a81cbd279069910070872a49f1dcdc8ddece07f1b8b32befce3c6ab23101e8f9d7493e1c6c9810ca09ad05e3170b2d7509b4667b13246069de5db7df27aa4ba74ba5dfeded5c2346252922b0cd20585b975ce59d784c08a0a6884a6189f0c297f54d89adf27fbaba91fd72e68a9ea937ffc8e467788d3c8bc7404d18029a2a7b241da9df0cce40b687e709b5781bedacf70b3ee3f51e859a952882a00b6ab3f1c43939e94b0d7fc2fffc988f6f75321cb8160d6c20a2b383c7f895a86385366ad70aca8416ca3d0e1f3907f2c86a8b6392da8c6d269720e4f801e9c6247103a71b68156bb5e014ff1f5a5cfb9f855cbdd4617fa113fdd3f5c82559dbd845a47c9b66f018d763316880af9069c1b737fb7c429f4b150b91594b14fae9df769458e4b58e904ab1aa8a737ffe6af5b99342896d4db93bccfc4992772e3c7ac9efb70731ccfeb61634ed3fd1e704e0f67f6a55201a41647a5aa50415bba2ec1145fc3d7cffcfbe2eac2ce56d563bbb93957ff736c8087e52a0657c4c3f25b3b5cbc192b5e4ac545999adecf5e633285ae271f08406921635d5668f0b6bed34f0a26e3c939dea077a0ea4f2dedd850eaadeb4ffd325cf17daa75f9dbdd0b7980801d532beea3d0481980f26c39efb857f726859be3af6f0a64d48aa4b1ec80d184836ffb7d49dcbce2e0880df4b86fb653c181b2696e2bbd5aadf7de9d5f7a8544ce1880895e905c41802c5bb71a71201b141f0e1775e7f79de27914c3defb6be67d155c0190d944c68b68e31d15e1d1d90a157fd3cbf993799aeb5137574c79b3f7b998b95a7bbe70d63bb062da7d728b1e0c0bce5198f283c7113ef40b645d06b27871247aaaaf58adb2c2e5fad7fc89f14ca357ea882da0e6a59502f873d948d7cc9355334909f2cba12823f4620e12ac585f93107d0b4c367fba4d50ded73f22e17d071e3fe397c0a9fa1bc291d8d5c49bb12211636101ab53d3d406775c132c3f28981284ec285395d10946b56413001ae172662ca411d6f5f63eb9195bffa9676039d37c5415cc53fb40086d3eab53f322eabd9ac5168b321138f46f1bf66f051551fe1e03b98aadc1669456cda6104f78564c68bb947effb6b63e53c587c884cbb758e18bc77fd50a94f064a32220abbd23d3f94b53160c877f7f5cf20b4bc097d68e29fae36a8f9021f150a244913ed192ca9a59fecc58914e205fd8b955d57b0d5cc8cb090bd10b459127d8ddbe76a166d6ca64c4ec5e027183f24141183da58c5b96a3d6481da47cb1540d0d716da06fe8ef19cd8bf3130ceaa101098320742e7e71e15a1f349d2b9b6045cde574e3211d66e48de80104b54983a538999c6bae1df34d23cf01283690c0b1b413a0aca81ff7aff3801859c4648111212c2c792b38abc53ef0a6535a703fc7821eb2a8ca5a36daaa7ebc09ba135778658f1d2c018b343baf65b920e988df1c07466d3871427bc879b3658acddf14d7ebf93b3d1c2795823b87ea39a66e954aeb0d64677a2663455f522386f614c2e826911b29070090dc2bdb23013fef36b0b38dfe2a05014c84a8db482def9b7695705d11c82f2227dcd92a2810abc0407aecd864ecf0f45365ae822095e940fd0e55f21a78313f1a91f02ccf7c175355cc4b5798107086ef0f3dc19a55fcc82b0805c70927fbeba660ef093c56ee895d2c20168feec6c671f4a86c5e29a98ff966f74556995dcccdbe9140aae7ff8d450d97853df356364b9434c8640321aa6a088981a7f5dff228e97a94a93b4d277394be798cbf89a943f7fcbeaaf3a439477fea639cb9c6093dce9a5378d8cb4bec2d3d0140403d64ec35e603388d2761e5f349466e054af52fa41c0e846ed0824427d705daaea348cba658307e28f2bfc995f3536d9d3af77b7811b34e648e64536e3c1ab405e6a1c5a6675eec5cf6ae0b2c1fb9a24f292304050e559daec246691da5bfd6681597ddbb5ad9e1df4efe85c74271a41b45d27f1be4838db4864ee41f2e01b03d4c2b8b6da7fcb34ffc744561170cee6e9f9a81d37acd52bb474c6a709943999bf29644a52d489b8a764d621682f6929c4a8e927a007a77a4bad168d6246ee7bc6f283091abf0431c6bf1ce8725d42aca4fecda21dc526de0b575b8787af72116decf0bf6746ea8b526ee287c18deeeba3efa8a9e17305cd58e057e14645f46bdd62deecbb69c582d214ef125c6d96dee5d31b20f04e72b6f1ee7139907e9f2172541a42225356748d352946654047e06e64f0e0a96fe84d99932874bb4a5fb37f771d125f6cebc0877e6ddb9fd5a46b5901adc750c217ed6e4d5ca12738df11392a4ec7db974e06a8ed61d5416e1fcf28faa1919434512874de44871d4a7d91f41a917df6d080a84c949370bb14a2ab73edc07b649cbfef33f3224f9ee1636f36fec1f29aec2fb4257bee2dacdaa0bc9be19721ecf5659474ab7c84fefe6e383919ef440fd201060e5b7dfbec83fe718fc8ab921be7a6c5b6fc0be19debde59b503ffc17e376a869a9e07dbd3f831e1d01852ffa00b1c5963f831b4893a7cdb481afef330a76590565886b7659baf9a489a3ec800c608457ba675b89aa04ccc325a9c5e6d769ea4d1988f09c1aaedfd2094e2a1fb6cf70b56f46e752dfe0c408af2a460ac841f12912e0b172af505ec240353f6b796fa6875464141aba3e9a841a7d4fc37845afa637c9c81359e1933b09c149088c3de2b0edd3fef55af18fa03b5b51724ac16e0547177a3cc442441416bd212992bc6d99e91cb77325654f105903836f153527f4a24a5f44b291665f1774f22d7f4b71bd88c0dc879aa31320619bd5cdf7b135a846d07e0bc09401285510b9d9c48bd597aec9d70dbf797d334487f8611e72ca68cfb422d625cd2b8436d21276e53531efb614501601d91f11b4462a5c429b3b3ce4a19a9d3f25441843142af0ad811a14d7ce5e90e5417769cdba3597704f7def4989ef815dd4ce1cb0ffcba138444aa0c2d2006a933cc5bda114459f8e5f8497a498c3ff30cd9b02023ac85d3b2416802e90f515d2f60d35ef2e01f507d19dc8d64689dbf3272cf8b5cc8c54aba4b4cd8d4b62d0fd4cf9b87cade36f3df486b603813953fad9f876ef4965e871cf9a0737cf632ee1bf793c85e8e218f74fc5e480c6d5b5cd6b1ae02a36798f90940c0bc96c5dd2d1a3a5f80403f2aba25fb60094a615f3699696a2cb7ab518120a39828c8f4153b29ab343d26df027e1ce0f9ee0e5d48857e930bb104c3e412d1c65099bf4ad10ec5bc09b7055fbc139e17789ae98ef1ec10ca2dd2a2764fab39ce386f3acf1898422a8d5b637542711bee200cbb68c27cfcc5974f386dcf312dcaaecb008a2ce3e42701f5bac17af17e0aef380408f40eeb25ac742d00f455053f5c41bbfe156a7fe821db2f26dd3d4952a7c089a074ed0cb9b97d9dcaf0d568c29582f32cf34dfc0ea52a17ab364bd95f1ce557ee87d7edd1e0207a7cd9a3eaea9f6fdead31933bee1a8a036532d2962f8ace7e941137e4082ba72c4535c889dd7194994e190f368ef355e7af9f2d4403a43d59280b6b464dfaeba4e0c7ee88510a3d3939c70e4f837d1fd1cedffda800f809a07cb0695f7aeca00f49683e34e68f8bb9859faeda7fa89bf93bc547655100754fa3860a252bbd71063837b0daa9f004a8a2089c2d52d037900f45cabe844295672b7b21e854bfde66f1019b2e65591c9a2c44ba04d009efcebe8fa66dd457aa1d2dec79b6ac7a6f16d22fde449d06407d15790190dc30e0e6d2d52e18c8fd966b55d207ceb16c531dce21b54eea9014a672bec8f483568520e741f5cd37b73e11fb32c08addc9b526d1ceca90735b4a055e87bba449abf174c465bf9c3464e8ec1ea04e7cfc0e4e269938f5240e3273ddcfe140a8c7672e973ba5b2e2565ad5fd270d5b71f60a401eacea497880dc88f37627e02ad1d5b5c9dbd49736f3b14240ce69649dc6f261b63045ece7488474ffd35adc60e3334b2e30c8dd2a833e8bf904d2765088825bf39224de88261da74b1cd0a03474ac0db020e25dac3aa33a7607d891f5977f97e2e190767e46ad1b898c56a4cd1c91d6ad696f2e8c28536779e2b1b35d00810ea3a2c1616cce7e06e4ee3ca235c0638fbec2f5bde5cd37ffdf7ef189dbbebee357267e0eec4128385573fe24224c0ccfd8603f4d936ee75b7d68efbb9e9bc29ef2e0286fc07c02b7b83edf26f79cd3847691c33cd57fbb6f42f95d72e150bdd90269197afef87610e6f18910269ec73d6503c68247cbcecc2442bcfe0a5234f4e988010e7577d95df2e074f95a272011fb44f8c3a8857624677b5e15b20b024032938fbf81d6539fef8261a542a840f5d6e912ec1c7216f309111b3ed48c9a5f8063f952baac27d7da021408f553de69fb92bf68d23c6366cf568826fe3f6040ee781f6aaeb677ec743d06282572b75156b2ef388776505d8849e5b61fb9cc911015a7a4150ba40ced09818c32f5ac7a3a78ea36b27d33bdaa7af851cdf34169b7e683c067d5d1d091d80b2edcbbf64ee2acf13c932ee69f53d095d678d21a63c0da0b6da2fc8b8187c222e48b988b914d7286963418161fe594b895d371fbea66a67017d9dbc03874bc0aee5f123194bbe7873243ec8ed176c90947d182e1e4fb96b9056cd7e0653ed31bb17150d755ec2b7dde463cb5fb4925b0ffd723dc46e3ba1f894703df7b72ff37025f6e0c7704a8532be3f6bf4fae8fd0de9150e6778f1fde36ea4ef5e4c2fa51b3f63bab218b3626dba90572150ed75d960effa3fd16e5dc27f9aeb566ecf746a2f8c3e52a2cc31f466e6ff8c8badd9193ff17e46d91acafc6810beb5030d32646a952f4fad1d8e2d2375397ad11bf8fe214b551900c6f47726cc0148eda8b1b2cd679f0f19a9a44300b1b1047d87a7a00b65c43e92083136f83303a702baa7562f30aa8c7dd30088785f653f57439758ff50ca73f341ed3f354b21f0afe1246ee663701babd5c6455d511cbafa77645d6ad0df598cb29f673837c24e45574ed3b83de52ba553ad45c7454336dde2e8eba5d43efca36149b4e4a48f46e2a285ca88caaa852d8a6f6e508f2731274d07218531d470ee02e1342246a07964127aff76d688e5b8b55922602b91b1a378fe85c063b3084a99c34ac538253750573d0b7bd2f119f421fb984bd6fc32cd24b1d08be0b0427cdbc82a11cb1ffe85b1c72e44c400dbb56a498bc48980ef4714c11fad333a2855ecb3b9d7e5f3b61af25c88535e32f4d22cbd819aed026e3e552a2096c36caef79aa04e2e672f78474de929f737dbdaaac0fbb9ad5d39db2ca0160951ccfabc8dd74d42d8339f330fef5c5b8859186e1a82e559660886fc975e67414e1b7a0b991311ccc3bb6e26d77a2a52292a35ce835cc5689926a0b78c4fb5b561dae42139450a88748ffe5bb2001131a42e8d53d4cccaadf565058da02d2ce202a88850ef948bed0b0d92ae7de8fcec13a94a1f2f66750673ea34b8e5f4a7f718a5f4d89f2345aff0de32e49fd534169bced911cb0276a8ad9097dacaab673b7db9966055951a8f0889ceb462c194d6c66ca7218c020e87697dc019e782beb14352"}]}, @ETHTOOL_A_DEBUG_HEADER={0x34, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_FLAGS={0x8}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r0}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x1}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x3}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r0}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r0}]}, @ETHTOOL_A_DEBUG_HEADER={0x90, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r0}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'macsec0\x00'}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r4}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'veth0_to_bond\x00'}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x2}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'bridge_slave_0\x00'}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'pimreg\x00'}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x1}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r5}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'veth1_virt_wifi\x00'}]}]}, 0x1138}, 0x1, 0x0, 0x0, 0x801}, 0x20040001) (async) r6 = socket$nl_rdma(0x10, 0x3, 0x14) sendmsg$RDMA_NLDEV_CMD_STAT_GET(r6, &(0x7f00000019c0)={&(0x7f00000018c0)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f0000001980)={&(0x7f0000001900)={0x48, 0x1411, 0x20, 0x70bd29, 0x25dfdbfe, "", [@RDMA_NLDEV_ATTR_STAT_RES={0x8, 0x4b, 0x28}, @RDMA_NLDEV_ATTR_RES_MRN={0x8, 0x3e, 0x4}, @RDMA_NLDEV_ATTR_RES_MRN={0x8, 0x3e, 0x2}, @RDMA_NLDEV_ATTR_DEV_INDEX={0x8, 0x1, 0x1}, @RDMA_NLDEV_ATTR_STAT_MODE={0x8}, @RDMA_NLDEV_ATTR_RES_MRN={0x8, 0x3e, 0x2}, @RDMA_NLDEV_ATTR_RES_MRN={0x8, 0x3e, 0x3}]}, 0x48}, 0x1, 0x0, 0x0, 0x800}, 0x80) (async) sendmsg$IPSET_CMD_SAVE(r1, &(0x7f0000001ac0)={&(0x7f0000001a00)={0x10, 0x0, 0x0, 0x4}, 0xc, &(0x7f0000001a80)={&(0x7f0000001a40)={0x14, 0x8, 0x6, 0x201, 0x0, 0x0, {0x0, 0x0, 0x9}}, 0x14}, 0x1, 0x0, 0x0, 0x4400c}, 0x0) (async) getsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER_VALUE(0xffffffffffffffff, 0x84, 0x7c, &(0x7f0000001b00)={0x0, 0x0, 0x8}, &(0x7f0000001b40)=0x8) getsockopt$inet_sctp6_SCTP_PARTIAL_DELIVERY_POINT(0xffffffffffffffff, 0x84, 0x13, &(0x7f0000001b80)={r7, 0xc8f9}, &(0x7f0000001bc0)=0x8) r8 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_MSG_GETGEN(r8, &(0x7f0000001cc0)={&(0x7f0000001c00)={0x10, 0x0, 0x0, 0x8000}, 0xc, &(0x7f0000001c80)={&(0x7f0000001c40)={0x14, 0x10, 0xa, 0x401, 0x0, 0x0, {0x5, 0x0, 0x8}, ["", "", "", ""]}, 0x14}, 0x1, 0x0, 0x0, 0x4010}, 0x4) (async) write(r6, &(0x7f0000001d00)="3d493c336247afb13d4b3103011d190125cabc273fedd1c4e2cc1bd229c648b8e27fa395facabc1d936d13fb2b9f93fe19941ce56df53036d6167b4780ab011a992c8529effa200b5eef6d592e6708907add3577342fab1b3c9813418a29167c0e25184bbc5dc1b26e691428a1c0c287ea48bc87463637ad2f1261584908db78cc89a2103eb336b963f85be733794cbddeb311cafe8640d95af2b936250baed85953349b9d4a0013649afd1e2287ec5cfaba973ac656d304a2815ef96fa9", 0xbe) getsockopt$PNPIPE_IFINDEX(0xffffffffffffffff, 0x113, 0x2, &(0x7f0000001e00)=0x0, &(0x7f0000001e40)=0x4) sendmsg$nl_route_sched(r1, &(0x7f0000001f00)={&(0x7f0000001dc0)={0x10, 0x0, 0x0, 0x1000}, 0xc, &(0x7f0000001ec0)={&(0x7f0000001e80)=@delchain={0x34, 0x65, 0x4, 0x70bd2b, 0x5, {0x0, 0x0, 0x0, r9, {0x2, 0xc}, {0x4, 0x8}, {0x0, 0x9}}, [@TCA_CHAIN={0x8, 0xb, 0xdb1}, @TCA_CHAIN={0x8, 0xb, 0xae}]}, 0x34}}, 0x40000) r10 = socket$inet_smc(0x2b, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r10, 0x0, 0x80, &(0x7f0000002180)=@broute={'broute\x00', 0x20, 0x2, 0x1fc, [0x0, 0x0, 0x0, 0x0, 0x0, 0x200000001f80], 0x0, &(0x7f0000001f40), &(0x7f0000001f80)=[{0x0, '\x00', 0x0, 0xfffffffffffffffd}, {0x0, '\x00', 0x0, 0xfffffffffffffffc, 0x2, [{0x3, 0x0, 0x19, 'geneve1\x00', 'dvmrp1\x00', 'syzkaller0\x00', 'veth0_virt_wifi\x00', @link_local, [0x0, 0xff, 0xff], @multicast, [0x0, 0x0, 0x0, 0xff, 0x0, 0xff], 0x6e, 0x6e, 0xb6, [], [], @common=@ERROR={'ERROR\x00', 0x20, {"66fe3b7dc64539d8041a10412fea386ab90ad766d1069d87de46564d93f7"}}}, {0x5, 0x20, 0x1c, 'wg2\x00', 'ipvlan0\x00', 'tunl0\x00', 'wg0\x00', @empty, [0x0, 0x0, 0x0, 0xff, 0xff, 0xff], @remote, [0x0, 0xff, 0xff, 0xff, 0xff], 0x6e, 0x6e, 0xb6, [], [], @common=@RATEEST={'RATEEST\x00', 0x20, {{'syz1\x00', 0x40, 0x3}}}}]}, {0x0, '\x00', 0x2, 0xfffffffffffffffe}]}, 0x274) r11 = syz_genetlink_get_family_id$ipvs(&(0x7f0000002240), r1) sendmsg$IPVS_CMD_NEW_SERVICE(r1, &(0x7f0000002340)={&(0x7f0000002200)={0x10, 0x0, 0x0, 0x4000000}, 0xc, &(0x7f0000002300)={&(0x7f0000002280)={0x60, r11, 0x20, 0x70bd2a, 0x25dfdbfd, {}, [@IPVS_CMD_ATTR_DAEMON={0x20, 0x3, 0x0, 0x1, [@IPVS_DAEMON_ATTR_MCAST_GROUP6={0x14, 0x6, @dev={0xfe, 0x80, '\x00', 0x2a}}, @IPVS_DAEMON_ATTR_MCAST_TTL={0x5, 0x8, 0x7f}]}, @IPVS_CMD_ATTR_DAEMON={0x2c, 0x3, 0x0, 0x1, [@IPVS_DAEMON_ATTR_MCAST_GROUP6={0x14, 0x6, @empty}, @IPVS_DAEMON_ATTR_MCAST_GROUP6={0x14, 0x6, @private2={0xfc, 0x2, '\x00', 0x1}}]}]}, 0x60}, 0x1, 0x0, 0x0, 0x40000}, 0x4884) r12 = syz_genetlink_get_family_id$nl80211(&(0x7f00000023c0), r1) (async, rerun: 64) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f0000002400)={'wlan1\x00', 0x0}) (rerun: 64) sendmsg$NL80211_CMD_SET_STATION(r1, &(0x7f0000002500)={&(0x7f0000002380)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f00000024c0)={&(0x7f0000002440)={0x44, r12, 0x20d, 0x70bd27, 0x25dfdbfe, {{}, {@void, @val={0xc, 0x99, {0xb15, 0x1}}}}, [@NL80211_ATTR_REASON_CODE={0x6, 0x36, 0xff}, @NL80211_ATTR_STA_AID={0x6, 0x10, 0x1c}, @NL80211_ATTR_STA_VLAN={0x8, 0x14, r13}, @NL80211_ATTR_MAC={0xa}]}, 0x44}, 0x1, 0x0, 0x0, 0x40}, 0x4040000) ioctl$BTRFS_IOC_START_SYNC(r6, 0x80089418, &(0x7f0000002540)=0x0) (async) ioctl$BTRFS_IOC_SET_RECEIVED_SUBVOL(r10, 0xc0c89425, &(0x7f0000002580)={"274f89e81adc0e20b47ebf0d297ccbe5", 0x0, 0x0, {0x8, 0x4}, {0x0, 0x187}, 0x8000000000000000, [0xa, 0x1, 0x9, 0x8, 0xfff, 0xffffffffffffffff, 0x8, 0x5, 0x8000000000000001, 0x3, 0x6dc0000000000000, 0x75, 0x743, 0x7, 0x9, 0x3]}) ioctl$BTRFS_IOC_SET_RECEIVED_SUBVOL(r1, 0xc0c89425, &(0x7f0000002680)={"5adc9e76c984092dc5ef1e172bdeb5fb", r14, r15, {0x7, 0x2}, {0x3, 0x1000}, 0x4, [0x4604, 0x3, 0x5, 0x7, 0x7, 0x3, 0x2, 0x4, 0x100000001, 0x6, 0x9, 0x4, 0x0, 0xffffffffffffff77, 0x4, 0x1]}) (async) sendmsg$DEVLINK_CMD_SB_OCC_MAX_CLEAR(r1, &(0x7f00000029c0)={&(0x7f0000002780)={0x10, 0x0, 0x0, 0x20000}, 0xc, &(0x7f0000002980)={&(0x7f0000002800)={0x16c, 0x0, 0x8, 0x70bd25, 0x25dfdbfc, {}, [{@pci={{0x8}, {0x11}}, {0x8, 0xb, 0xb}}, {@pci={{0x8}, {0x11}}, {0x8, 0xb, 0x4}}, {@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, {0x8, 0xb, 0x4}}, {@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, {0x8, 0xb, 0x8}}, {@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, {0x8, 0xb, 0xa8}}, {@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, {0x8, 0xb, 0xb42e}}, {@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, {0x8, 0xb, 0xf}}, {@pci={{0x8}, {0x11}}, {0x8, 0xb, 0x8000}}, {@pci={{0x8}, {0x11}}, {0x8, 0xb, 0x9}}]}, 0x16c}, 0x1, 0x0, 0x0, 0x80}, 0x8000040) 3.256298767s ago: executing program 1 (id=8020): socket$netlink(0x10, 0x3, 0x0) r0 = socket(0x10, 0x803, 0x0) (async) r1 = socket$inet6_sctp(0xa, 0x5, 0x84) setsockopt$inet_sctp6_SCTP_RECVNXTINFO(r1, 0x84, 0x21, &(0x7f00000000c0)=0x7, 0x4) setsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX_OLD(r1, 0x84, 0x6b, &(0x7f0000000240)=[@in={0x2, 0x4e24, @private=0xa010101}], 0x10) setsockopt(r1, 0x84, 0x7f, &(0x7f0000000040)="020000000980ffff", 0x8) (async) recvmsg(r1, &(0x7f0000000300)={0x0, 0x0, 0x0}, 0x0) (async) sendmsg$NL80211_CMD_CRIT_PROTOCOL_START(r0, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000540)={0x0, 0x1c}}, 0x0) (async) socket$inet6(0xa, 0x3, 0xff) (async) socket$nl_route(0x10, 0x3, 0x0) (async) openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) socket$nl_generic(0x10, 0x3, 0x10) socket$nl_generic(0x10, 0x3, 0x10) (async) socket$nl_route(0x10, 0x3, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) (async) socket$nl_netfilter(0x10, 0x3, 0xc) (async) socket$packet(0x11, 0x2, 0x300) bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="06000000040000009c0000000b"], 0x50) bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="040000000400000004"], 0x48) (async) r2 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="0e"], 0x48) (async) r3 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="06000000040000000800000008"], 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=@framed={{}, [@ringbuf_output={{0x18, 0x1, 0x1, 0x0, r3}, {}, {}, {}, {}, {}, {}, {0x85, 0x0, 0x0, 0x3}}]}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x8, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1000}, 0x94) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x16, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @flow_dissector, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7}, 0x94) r4 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x6, 0xc, &(0x7f00000001c0)=ANY=[@ANYBLOB="1800000010000000000000000000000018110000", @ANYRES32=r2, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bc82000000000000a6020000f8ffffffb703000008000000ac03000000000000850000003300000095"], &(0x7f0000000780)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x2a, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000300)={{r2}, &(0x7f0000000080), &(0x7f0000000280)=r4}, 0x20) (async) r5 = socket$inet_tcp(0x2, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000180)={'syz_tun\x00', 0x0}) bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f00000002c0)={r4, r6, 0x25, 0x2}, 0x14) syz_emit_ethernet(0x12, &(0x7f0000000440)=ANY=[], 0x0) 3.167295706s ago: executing program 2 (id=8022): r0 = bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0xd, 0x4, &(0x7f0000000040)=@framed={{0xffffffb4, 0x0, 0x0, 0x0, 0x0, 0x79, 0x11, 0xa8}, [@ldst={0x6, 0x3}], {0x95, 0x0, 0xc00}}, &(0x7f0000003ff6)='GPL\x00', 0x2, 0xc3, &(0x7f000000cf3d)=""/195, 0x0, 0x20, '\x00', 0x0, @sock_ops, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x8, 0x10, &(0x7f0000000000), 0x10}, 0x94) r1 = accept$inet(0xffffffffffffffff, &(0x7f0000000240)={0x2, 0x0, @remote}, &(0x7f0000000280)=0x10) setsockopt$IP_VS_SO_SET_ADD(r1, 0x0, 0x482, &(0x7f00000002c0)={0x2c, @rand_addr=0x64010102, 0x4e20, 0x1, 'sed\x00', 0xb, 0x2, 0x3b}, 0x2c) bpf$BPF_PROG_ATTACH(0x8, &(0x7f00000001c0)={@ifindex, r0, 0x3}, 0x12) ioctl$XFS_IOC_PATH_TO_FSHANDLE(r0, 0xc0385868, &(0x7f0000000180)={r0, &(0x7f0000000080)='(+-:\x00', 0x18000, &(0x7f00000000c0)={@_ha_fsid={[0x4, 0x200]}, {0x8, 0x7, 0x2, 0x14}}, 0x6, &(0x7f0000000100)={@_ha_fsid}, &(0x7f0000000140)=0x7ff}) r3 = socket(0x1d, 0x2, 0x6) getsockopt$inet_sctp_SCTP_SOCKOPT_CONNECTX3(r3, 0x6a, 0x3, 0x0, &(0x7f0000000440)) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) ioctl$SIOCSIFHWADDR(r2, 0x8924, &(0x7f0000000200)={'ip6gre0\x00', @remote}) 3.109672794s ago: executing program 2 (id=8023): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x13, &(0x7f0000000000)=0x100000001, 0x4) connect$inet6(r0, &(0x7f0000000200)={0xa, 0x0, 0x0, @loopback}, 0x1c) setsockopt$inet6_tcp_TCP_ULP(r0, 0x6, 0x1f, &(0x7f00000000c0), 0x4) setsockopt$inet6_tcp_TLS_TX(r0, 0x11a, 0x1, &(0x7f0000000540)=@gcm_128={{0x303}, "ffffffffffffffe2", "8e083700daf38a6d69e9b5e9c2f133d7", "6a3a05b9", "12772541f8eb02bb"}, 0x28) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='freezer.state\x00', 0x275a, 0x0) write$cgroup_int(r1, &(0x7f0000000000), 0xffffff6a) setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r0, 0x6, 0x14, &(0x7f0000000040)=0x2, 0x4) sendfile(r0, r1, 0x0, 0xffffffff004) r2 = bpf$MAP_CREATE(0x100000000000000, &(0x7f0000000440)=@base={0xa, 0x9, 0x8, 0x2, 0x0, 0xffffffffffffffff, 0x2}, 0x50) r3 = bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000040)={0x3, 0x6, &(0x7f0000000300)=@framed={{0x18, 0x2}, [@map_fd={0x18, 0x3, 0x1, 0x0, r2}, @call={0x85, 0x0, 0x0, 0xc0}]}, &(0x7f0000000000)='GPL\x00'}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000140)={r3, 0x18000000000002a0, 0xe, 0x0, &(0x7f00000004c0)="e036d448b3887a428a23e955eeaa", 0x0, 0xbffffffe, 0xe8030000, 0x0, 0x0, 0x0, 0x0}, 0x4c) 3.039979468s ago: executing program 1 (id=8025): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x2000}) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket$unix(0x1, 0x1, 0x0) r3 = socket$inet6_icmp(0xa, 0x2, 0x3a) sendmsg$inet6(r3, &(0x7f0000000880)={&(0x7f0000000000)={0xa, 0x4e22, 0x2b, @loopback, 0x5}, 0x1c, &(0x7f0000000140)=[{&(0x7f0000000040)="8000e8beec9dbc13", 0x8}], 0x1, &(0x7f00000000c0)=[@hoplimit_2292={{0x18, 0x29, 0x8, 0x7f}}], 0x18}, 0x800) r4 = socket$packet(0x11, 0x3, 0x300) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000080)={'veth0_to_bond\x00', 0x0}) sendmsg$L2TP_CMD_NOOP(0xffffffffffffffff, 0x0, 0x4000000) r6 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_DESTROY(r6, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000007c0)=ANY=[@ANYBLOB="1c0000000306010200000000000000000700000a0500010007"], 0x1c}, 0x1, 0x0, 0x0, 0x4000000}, 0x40814) sendmsg$inet(0xffffffffffffffff, &(0x7f0000001580)={0x0, 0x0, &(0x7f0000001400)=[{&(0x7f0000000300)="87fb74cf4d67adbbd062637f514c1f5eb18d7b442e6457a356c6cb1f71a43dfae773c8489cce5145f92615d4bdb13ef54d6ae90ec7733180fcf5adf3e13fdb05b57b748bd14eda042a97fdd844", 0x4d}], 0x1}, 0x0) r7 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r7, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000780)=ANY=[@ANYBLOB="580000000206030000000000000000000300000705000100070000000900020073797a31000000000c00078008001240000000050500050002000000050004000100000011000300686173683a69702c706f727400"], 0x58}, 0x1, 0x0, 0x0, 0x4000}, 0x20004000) r8 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_ADD(r8, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000300)=ANY=[@ANYBLOB="50000000090601020000000000000000020000840900020073797a31000000000500010007000000280007800c00018008000140fffffff70500070088000000060004404e22000006000540"], 0x50}, 0x1, 0x0, 0x0, 0x10000082}, 0x90) r9 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_LIST(r9, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000180)={0x1c, 0x7, 0x6, 0x301, 0x0, 0x0, {0x1}, [@IPSET_ATTR_PROTOCOL={0x5}]}, 0x1c}, 0x1, 0x0, 0x0, 0x20000800}, 0x20000040) setsockopt$packet_int(r4, 0x107, 0x14, &(0x7f0000000180)=0x19ca, 0x4) setsockopt$packet_int(r4, 0x107, 0xf, &(0x7f0000000000)=0xf3f, 0x4) sendto$packet(r4, &(0x7f00000000c0)="3f03fe7feee8140006001e0089e9aaa911d7c2290f0086dd1327c9167c643c4a1b7880610cc96655b1b141ab059b24d0fbc50df71548a3f6c5609063382a0c153cfdf9435e3ffe46", 0xe90c, 0x0, &(0x7f0000000540)={0xc9, 0x0, r5, 0x1, 0x0, 0x6, @multicast}, 0x14) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'syzkaller0\x00'}) sendmsg$nl_route_sched(r1, &(0x7f00000012c0)={0x0, 0x0, 0x0}, 0x24040084) r10 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$sock_bt_hci(r10, 0x400448e0, &(0x7f0000000140)) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000340)={0x6, 0x5, &(0x7f0000000140)=@framed={{0x18, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x7}, [@map_idx_val={0x18, 0xa, 0x6, 0x0, 0x7, 0x0, 0x0, 0x0, 0x5}]}, &(0x7f00000001c0)='syzkaller\x00', 0x6, 0x10, &(0x7f0000000200)=""/16, 0x41100, 0x40, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0xe0}, 0x94) sendmsg$nl_route_sched(0xffffffffffffffff, 0x0, 0x20004804) 2.387910918s ago: executing program 4 (id=8028): r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f00000004c0)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb(camellia)\x00'}, 0x58) r1 = socket$rds(0x15, 0x5, 0x0) bind$rds(r1, &(0x7f0000000040)={0x2, 0x4e21, @local}, 0x10) r2 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$devlink(0x0, r2) sendmsg$inet(r1, &(0x7f0000000480)={&(0x7f0000000000)={0x2, 0x4e22, @initdev={0xac, 0x1e, 0x1, 0x0}}, 0x10, &(0x7f0000000380)=[{&(0x7f00000001c0)="91cf", 0x2}], 0x1}, 0x0) sendmsg$rds(r1, &(0x7f0000000140)={&(0x7f00000000c0)={0x2, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}}, 0x10, 0x0, 0x0, 0x0, 0x0, 0x4}, 0x0) setsockopt$RDS_CANCEL_SENT_TO(r1, 0x114, 0x1, &(0x7f0000000100)={0x2, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}}, 0x10) sendmsg$nl_generic(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000080)=ANY=[@ANYBLOB="38000000400007012bbd7000fadbdfd311d56b6b25b60de05e76a75cb894f125027c00000400c2801c0001801800108014000d0000000000"], 0x38}, 0x1, 0x0, 0x0, 0x4c090}, 0xc000) r3 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r3, 0x29, 0x40, &(0x7f0000001280)=@nat={'nat\x00', 0x2, 0x5, 0x4b0, 0xf0, 0xf0, 0xffffffff, 0x310, 0xf0, 0x3e0, 0x3e0, 0xffffffff, 0x3e0, 0x3e0, 0x5, 0x0, {[{{@ipv6={@rand_addr=' \x01\x00', @remote, [], [], 'batadv0\x00', 'veth0_to_batadv\x00'}, 0x0, 0xa8, 0xf0}, @MASQUERADE={0x48, 'MASQUERADE\x00', 0x0, {0x33, @ipv4=@empty, @ipv4=@rand_addr=0x64010102}}}, {{@uncond, 0x0, 0xe8, 0x130, 0x0, {}, [@common=@unspec=@connlimit={{0x40}, {[], 0x0, 0x2}}]}, @unspec=@SNAT1={0x48, 'SNAT\x00', 0x1, {0x0, @ipv4=@loopback, @ipv6=@private0, @icmp_id, @port=0x4e22}}}, {{@ipv6={@ipv4={'\x00', '\xff\xff', @multicast2}, @private0, [0xffffff00, 0xff000000, 0xffffff00, 0xffffff00], [0xffffffff, 0xffffffff, 0xffffffff, 0xffffffff], 'syzkaller1\x00', 'pim6reg1\x00', {0xff}, {0xff}, 0x33, 0x2, 0x5, 0x20}, 0x0, 0xa8, 0xf0}, @NETMAP={0x48, 'NETMAP\x00', 0x0, {0x0, @ipv6=@ipv4={'\x00', '\xff\xff', @multicast1}, @ipv6=@rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02', @gre_key, @gre_key}}}, {{@ipv6={@remote, @mcast1, [], [], 'ipvlan0\x00', 'pim6reg\x00'}, 0x0, 0xa8, 0xd0}, @common=@unspec=@NFQUEUE1={0x28}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x510) socket$inet6_sctp(0xa, 0x5, 0x84) r4 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r4, &(0x7f0000000080)={0x1f, 0xffff, 0x3}, 0x6) r5 = socket$nl_route(0x10, 0x3, 0x0) r6 = socket$netlink(0x10, 0x3, 0x0) r7 = socket(0x10, 0x3, 0x0) syz_genetlink_get_family_id$ethtool(&(0x7f0000000200), r7) getsockname$packet(r7, &(0x7f00000002c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000100)=0x14) sendmsg$nl_route(r6, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000008c0)=ANY=[@ANYBLOB="480000001000050700000086d7c0d6c878f064eb", @ANYRES32=r8], 0x48}}, 0x0) sendmsg$nl_route_sched(r6, &(0x7f00000001c0)={0x0, 0x0, &(0x7f00000004c0)={&(0x7f0000000900)=@newqdisc={0x30, 0x24, 0xf1d, 0x0, 0x0, {0x0, 0x0, 0x0, r8, {}, {0xfff1, 0xffff}}, [@qdisc_kind_options=@q_clsact={0xb}]}, 0x30}}, 0x4000800) sendmsg$nl_route_sched(r5, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000580)=@delchain={0x2c, 0x64, 0xf31, 0xfffffffb, 0x0, {0x0, 0x0, 0x0, r8, {0xffe0, 0xb}, {0xfff3, 0xffff}, {0xf, 0x3}}, [@TCA_CHAIN={0x8, 0xb, 0x5594b08a}]}, 0x2c}, 0x1, 0x0, 0x0, 0x40045}, 0x4804) write(r4, &(0x7f0000000340)="4700000001003f", 0x7) socket$inet_sctp(0x2, 0x1, 0x84) bpf$PROG_LOAD(0x5, &(0x7f0000000540)={0x7, 0x0, 0x0, &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000000}, 0x94) close(0x3) socket(0x2, 0x80805, 0x0) socket$inet6_sctp(0xa, 0x5, 0x84) 2.187345773s ago: executing program 0 (id=8030): r0 = socket$xdp(0x2c, 0x3, 0x0) mmap(&(0x7f0000004000/0x3000)=nil, 0x3000, 0x6, 0x8012, r0, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x3, 0x4, &(0x7f0000000040)=@framed={{0x18, 0x2, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x1}, [@call={0x85, 0x0, 0x0, 0x19}]}, &(0x7f00000000c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x1}, 0x94) r1 = bpf$MAP_CREATE(0x0, &(0x7f00000004c0)=ANY=[@ANYBLOB="0200000004000000ff07000009"], 0x50) r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000540)=ANY=[@ANYBLOB="0d000000ff0f0000040000000600000001000000", @ANYRES32=r1], 0x50) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000440)={{r2, 0xffffffffffffffff}, &(0x7f0000000840), &(0x7f0000000340)=r1}, 0x20) bpf$BPF_MAP_LOOKUP_AND_DELETE_BATCH(0x19, &(0x7f0000000680)={0x0, 0x0, 0x0, 0x0, 0x7fff, r3}, 0x38) bpf$TOKEN_CREATE(0x24, &(0x7f0000000040)={0x0, r0}, 0x8) r4 = socket$inet6_mptcp(0xa, 0x1, 0x106) setsockopt$inet6_tcp_int(r4, 0x6, 0x1e, &(0x7f0000000000)=0x4a, 0x4) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000140)={0x11, 0x13, &(0x7f0000000240)=ANY=[], &(0x7f0000000200)='GPL\x00', 0x2, 0xde, &(0x7f0000000340)=""/222, 0x40f00, 0xc, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x80000}, 0x94) 1.946175821s ago: executing program 2 (id=8031): r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$netlink(0x10, 0x3, 0x10) sendmsg$IPSET_CMD_GET_BYINDEX(r1, &(0x7f0000000200)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x2000}, 0xc, &(0x7f00000001c0)={&(0x7f0000000180)={0x2c, 0xf, 0x6, 0x104, 0x0, 0x0, {0x1, 0x0, 0x8}, [@IPSET_ATTR_INDEX={0x6, 0xb, 0x1}, @IPSET_ATTR_INDEX={0x6}, @IPSET_ATTR_INDEX={0x6, 0xb, 0x2}]}, 0x2c}, 0x1, 0x0, 0x0, 0x24008050}, 0x40001) r2 = socket$inet_mptcp(0x2, 0x1, 0x106) connect$inet(r2, &(0x7f0000000040)={0x2, 0x7, @private=0xa010101}, 0x10) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r0, 0x8933, &(0x7f0000000080)={'batadv0\x00', 0x0}) r4 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_ipv6_tunnel_SIOCGETTUNNEL(0xffffffffffffffff, 0x89f0, &(0x7f0000000480)={'ip6tnl0\x00', &(0x7f0000000400)={'syztnl2\x00', r3, 0x29, 0x8, 0xd3, 0x9, 0x8, @mcast1, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, 0x7800, 0x20, 0x64, 0x5}}) r6 = socket$inet(0xa, 0x801, 0x84) connect$inet(r6, &(0x7f0000000340)={0x2, 0x0, @remote={0xac, 0x14, 0xffffffffffffffff}}, 0x10) listen(r6, 0xffffffff) r7 = accept4(r6, 0x0, 0x0, 0x0) r8 = syz_genetlink_get_family_id$tipc(&(0x7f0000000280), r4) sendmsg$TIPC_CMD_GET_REMOTE_MNG(r4, &(0x7f00000005c0)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x8000000}, 0xc, &(0x7f0000000580)={&(0x7f00000002c0)={0x1c, r8, 0x2, 0x70bd2a, 0x25dfdbff}, 0x1c}, 0x1, 0x0, 0x0, 0x40000}, 0x20000004) sendmmsg$unix(r7, &(0x7f0000001840)=[{{0x0, 0x0, &(0x7f00000000c0)=[{&(0x7f0000000140)="c7", 0x1}], 0x1, 0x0, 0x0, 0x8054}}], 0x1, 0x4000045) sendmsg$netlink(r7, &(0x7f0000000800)={0x0, 0xd, &(0x7f0000000540)=[{&(0x7f0000000ac0)={0x10, 0x2a, 0x800, 0x70bd27, 0x25dfdbfc}, 0x10}], 0x1, 0x0, 0x0, 0x2000c040}, 0x20000000) setsockopt$inet_sctp6_SCTP_DEFAULT_SNDINFO(r7, 0x84, 0x22, &(0x7f0000000100)={0x3}, 0x10) sendmmsg$alg(r7, &(0x7f000000c600)=[{0x0, 0x0, &(0x7f00000039c0)=[{&(0x7f0000000000)='L', 0x1}], 0x1, 0x0, 0x0, 0x4000080}], 0x1, 0x4008010) setsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER(r7, 0x84, 0x7b, &(0x7f00000003c0)={0x0, 0x1}, 0x8) close(r7) sendmsg$nl_route(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000004c0)=@bridge_newneigh={0x48, 0x1c, 0x1, 0x70bd25, 0x25dfdbfb, {0x7, 0x0, 0x0, r5, 0x4, 0x20, 0xa}, [@NDA_VLAN={0x6, 0x5, 0x1}, @NDA_IFINDEX={0x8, 0x8, r3}, @NDA_DST_MAC={0xa, 0x1, @random="0bdd816cfe40"}, @NDA_VNI={0x8, 0x7, 0x7}, @NDA_IFINDEX={0x8, 0x8, r3}]}, 0x48}, 0x1, 0x0, 0x0, 0x240420d4}, 0x0) r9 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(r9, 0x89f0, &(0x7f00000003c0)={'syztnl1\x00', &(0x7f0000000300)={'syztnl0\x00', r3, 0x700, 0x1, 0xe, 0xb6df, {{0x26, 0x4, 0x1, 0x3, 0x98, 0x264, 0x0, 0xe, 0x4, 0x0, @loopback, @broadcast, {[@noop, @ra={0x94, 0x4}, @rr={0x7, 0x17, 0xc0, [@private=0xa010102, @multicast2, @empty, @private=0xa010102, @broadcast]}, @timestamp_addr={0x44, 0x24, 0xb0, 0x1, 0x3, [{@local, 0x3ff}, {@remote, 0x64}, {@remote, 0x1}, {@loopback, 0xa}]}, @timestamp_prespec={0x44, 0x3c, 0x43, 0x3, 0x3, [{@empty, 0x3}, {@private=0xa010100, 0x9}, {@empty, 0x4}, {@loopback, 0x61}, {@local, 0x9}, {@local, 0x7}, {@empty, 0x4}]}, @timestamp={0x44, 0x8, 0x79, 0x0, 0x3, [0x7]}]}}}}}) 1.9239006s ago: executing program 4 (id=8032): r0 = socket$inet6_sctp(0xa, 0x5, 0x84) setsockopt(r0, 0x84, 0x81, &(0x7f00000002c0)="1a00000002000000", 0x8) (async) setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(0xffffffffffffffff, 0x84, 0x64, &(0x7f0000000400)=[@in6={0xa, 0x4e23, 0x5, @dev={0xfe, 0x80, '\x00', 0x30}, 0x4}, @in={0x2, 0x4e24, @remote}, @in={0x2, 0x4e20, @private=0xa010100}, @in6={0xa, 0x4e22, 0x80000000, @mcast2, 0x7}, @in6={0xa, 0x4e23, 0xffffff22, @ipv4={'\x00', '\xff\xff', @rand_addr=0x64010102}, 0x1}, @in6={0xa, 0x4e22, 0x6, @private1={0xfc, 0x1, '\x00', 0x1}, 0x2000ed3e}], 0x90) setsockopt$inet_sctp6_SCTP_AUTH_CHUNK(r0, 0x84, 0x15, &(0x7f0000000080), 0x1) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup/syz0\x00', 0x1ff) (async) r1 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000180)='./cgroup.net/syz0\x00', 0x200002, 0x0) r2 = openat$cgroup_pressure(r1, &(0x7f0000000240)='io.pressure\x00', 0x2, 0x0) write$cgroup_pressure(r2, &(0x7f0000000080)={'some', 0x20, 0x2000000008, 0x20, 0x10000000fffff}, 0x2f) close(0x4) r3 = bpf$ITER_CREATE(0xb, &(0x7f0000000100), 0x0) close(r3) (async) setsockopt$inet6_tcp_TCP_MD5SIG(r3, 0x6, 0xe, &(0x7f0000000300)={@in={{0x2, 0x4e20, @multicast2}}, 0x0, 0x0, 0x24, 0x0, "2c004d46dc15b929250d4ac91f4f1fb55e59000000007d3f548a717f5302c278903462d20a1536d3e0dbebbed8a4146dfa98c60d4175e09f04905f35f5789457049d1eb4f48635594016249d1200"}, 0xd8) syz_emit_ethernet(0x0, 0x0, 0x0) (async) sendmsg$ETHTOOL_MSG_COALESCE_SET(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000180)=ANY=[], 0x44}}, 0x0) (async) r4 = openat$cgroup_root(0xffffffffffffff9c, 0x0, 0x200002, 0x0) openat$cgroup_ro(r4, &(0x7f00000000c0)='blkio.bfq.idle_time\x00', 0x0, 0x0) (async) sendmsg$NFT_BATCH(0xffffffffffffffff, 0x0, 0x40) (async) r5 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r5, &(0x7f0000000100)={0x2, 0x2, @dev={0xac, 0x14, 0x14, 0x42}}, 0x10) (async) connect$inet(r5, &(0x7f0000000040)={0x2, 0x0, @multicast1}, 0x10) (async) sendmmsg$inet(r5, &(0x7f0000004d00)=[{{0x0, 0x6000, 0x0, 0x0, 0x0, 0x0, 0x30000}}], 0x400000000000284, 0xf00) (async) r6 = socket$inet6_sctp(0xa, 0x1, 0x84) (async) close(0x3) (async) r7 = socket$inet6_sctp(0xa, 0x1, 0x84) close(r6) (async) r8 = socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt$inet6_int(r8, 0x29, 0x1a, &(0x7f0000000280)=0xfffffffb, 0x4) (async) setsockopt(r7, 0x84, 0x80, &(0x7f0000000000)="1400000009000000", 0x8) connect$inet6(r6, &(0x7f0000000000)={0xa, 0x0, 0x1, @mcast2, 0x6}, 0x1c) (async) syz_init_net_socket$bt_l2cap(0x1f, 0x3, 0x3) 1.913035514s ago: executing program 0 (id=8033): r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$netlbl_cipso(&(0x7f0000000280), r0) syz_emit_ethernet(0x46, &(0x7f0000000000)=ANY=[@ANYBLOB="0380c2000000bbbbbbbbbbbb0800450000380000000000019078ac1e0001ac1414f6030490781200183f2500000000000000000100007f"], 0x0) r1 = socket$kcm(0xa, 0x5, 0x0) bpf$MAP_CREATE(0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="1e000000000000000700400009"], 0x50) socket$inet6_udp(0xa, 0x2, 0x0) r2 = socket$kcm(0xa, 0x922000000003, 0x11) setsockopt$sock_attach_bpf(r2, 0x29, 0x24, &(0x7f00000000c0), 0x4) sendmsg$kcm(r2, &(0x7f0000000000)={&(0x7f00000007c0)=@l2tp6={0xa, 0x0, 0xefffffff, @mcast1, 0x5}, 0x80, &(0x7f0000000080)=[{&(0x7f00000001c0)="f4000900062b2b25fe80000000000000dc8b850f238466cc00007a000000ad6e911b51818462b400", 0x28}], 0x1}, 0x400800c) r3 = socket$packet(0x11, 0x2, 0x300) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r1, 0x8933, &(0x7f0000000680)={'batadv_slave_1\x00', 0x0}) sendmmsg$alg(0xffffffffffffffff, &(0x7f0000000040)=[{0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)="f78d9ca38fff48f3be52163448412ba8", 0x10}, {&(0x7f0000000140)="ebe3a0e9796cfd1647e299f4e376fdba128280b372219d205e81f4a7f71c1926aae1efd7e0054a863f3d5cfe6cb55b5bb9fa6935849e6098ed884e7cb51726b360fbb37b4fe035bbb095", 0x4a}, {&(0x7f0000000c00)="e8700e444d50a969ff67347cff6127e6ef12ee3819271482a4975a52c1ab9b8b4db3945d1032005eabe97b4dc33a47d3a158da988456d30026b433186f53cdcdb93a4722bf306a10470d50f5cb68ce9ead3459bab1cf", 0x56}], 0x3, &(0x7f0000000340)=[@assoc={0x18, 0x117, 0x4, 0xa0}], 0x18}], 0x1, 0x4000090) bpf$PROG_LOAD(0x5, &(0x7f0000000040)={0x2, 0x4, &(0x7f0000000200)=ANY=[@ANYBLOB="180000000300000000000000feffff10850000000700000095"], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x100, 0x70, '\x00', 0x0, @fallback=0x30, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) recvmmsg$unix(0xffffffffffffffff, &(0x7f0000001780)=[{{0x0, 0x0, &(0x7f00000002c0)=[{&(0x7f0000000580)=""/223, 0xdf}], 0x1}}], 0x1, 0x42, 0x0) setsockopt$packet_add_memb(r3, 0x107, 0x1, &(0x7f0000000240)={r4, 0x1, 0x6, @random="00000200"}, 0x10) ioctl$sock_kcm_SIOCKCMCLONE(r1, 0x890c, &(0x7f0000000000)) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000980)={0xffffffffffffffff}) r6 = socket$igmp(0x2, 0x3, 0x2) setsockopt$MRT_FLUSH(r6, 0x0, 0xd4, &(0x7f0000000040)=0x2, 0x4) ioctl$SIOCSIFHWADDR(r5, 0x8924, &(0x7f00000002c0)={'macsec0\x00', @random="0100061f8145"}) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000440)={0x11, 0xf, &(0x7f00000006c0)=ANY=[@ANYBLOB="030000000000040000000000000a00008510000006000000180000000000000000000000000000009500000000000000180100000020782500000000cc002020207b1af8ff00000000bfa1ffff00e0000007010000f8feffffb702000700000000b5040000000000b45774e1dcd01e4f730832b4dc04cb93fc2a84731835bae95d1cae2235d01519a68831b953bc949db84e1a20aa997d33eb6f723b587cd6763a61147fb5065a18d1b9ac189c25a2f5b4defd5962d9d448590ce94d48a06850fd3d"], &(0x7f0000000000)='GPL\x00', 0x2, 0x0, 0x0, 0x0, 0xc}, 0x94) socket$nl_generic(0x10, 0x3, 0x10) r7 = socket$netlink(0x10, 0x3, 0x10) bind$netlink(r7, &(0x7f0000514ff4)={0x10, 0x0, 0x0, 0x2ffffffff}, 0xc) setsockopt$sock_int(r7, 0x1, 0x8, &(0x7f0000000000), 0x4) setsockopt$netlink_NETLINK_BROADCAST_ERROR(r7, 0x10e, 0x4, &(0x7f0000000100)=0x1800, 0x4) r8 = syz_init_net_socket$bt_bnep(0x1f, 0x3, 0x4) ioctl$sock_bt_bnep_BNEPGETSUPPFEAT(r8, 0x800442d4, &(0x7f0000000080)=0x280) syz_genetlink_get_family_id$nl80211(&(0x7f00000002c0), r7) 1.848609698s ago: executing program 3 (id=8034): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = socket(0xa, 0x5, 0x0) sendmsg$inet_sctp(r1, &(0x7f0000000380)={&(0x7f0000000200)=@in6={0xa, 0x4e24, 0xb, @mcast2, 0x3}, 0x1c, &(0x7f00000001c0)=[{&(0x7f0000000240)="af", 0x1}], 0x1, &(0x7f00000006c0)=ANY=[@ANYBLOB="18000000000000008400000000000000ffff"], 0x18, 0x20000001}, 0x20008000) ioctl$F2FS_IOC_GET_PIN_FILE(r0, 0x8004f50e, &(0x7f0000000180)) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000200)={0x6, 0x0, 0x0, &(0x7f00000002c0)='GPL\x00', 0x0, 0x0, 0x0, 0x40f00}, 0x94) sendmsg$netlink(0xffffffffffffffff, &(0x7f00000047c0)={0x0, 0x0, &(0x7f0000000e40)=[{&(0x7f0000000200)=ANY=[@ANYBLOB="180000007a00010600000000fbdbdf2507"], 0x18}], 0x1, 0x0, 0x0, 0x4000050}, 0x80) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000200)=ANY=[], 0xa0}}, 0x40080) r2 = socket(0x10, 0x3, 0x0) sendmmsg(r2, &(0x7f0000000000), 0x4000000000001f2, 0x0) r3 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000140), 0x0, 0x0) ioctl$PPPIOCNEWUNIT(r3, 0xc004743e, &(0x7f0000000080)) ioctl$PPPIOCSMRU1(r3, 0x40047452, 0x0) accept4$inet(r1, 0x0, 0x0, 0x800) r4 = socket$nl_rdma(0x10, 0x3, 0x14) r5 = epoll_create(0x5) r6 = openat$tcp_mem(0xffffffffffffff9c, &(0x7f0000000000)='/proc/sys/net/ipv4/tcp_rmem\x00', 0x1, 0x0) epoll_ctl$EPOLL_CTL_ADD(r5, 0x1, r6, &(0x7f0000000040)={0x10}) epoll_ctl$EPOLL_CTL_MOD(r5, 0x3, r6, &(0x7f00000000c0)={0xa}) ioctl$EXT4_IOC_GROUP_EXTEND(0xffffffffffffffff, 0x80e8662d, 0x0) socket$pppl2tp(0x18, 0x1, 0x1) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r4, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000700)=ANY=[@ANYBLOB="38000000031401002cbd7000fcdbdf25090002007379fa32000000000800410073697700140033006c6f"], 0x38}, 0x1, 0x0, 0x0, 0x4}, 0x810) accept4$nfc_llcp(r2, 0x0, 0x0, 0x0) r7 = socket$nl_generic(0x10, 0x3, 0x10) r8 = syz_genetlink_get_family_id$devlink(&(0x7f0000000dc0), 0xffffffffffffffff) sendmsg$DEVLINK_CMD_TRAP_GET(r7, &(0x7f0000000640)={0x0, 0x0, &(0x7f0000000600)={&(0x7f0000000540)=ANY=[@ANYBLOB='P\x00\x00\x00', @ANYRES16=r8, @ANYBLOB="010000000000fbdbdf25270000000e0001006e657464657673696d0000000f0002006e657464657673696d3000001c0053"], 0x50}, 0x1, 0x0, 0x0, 0x24040011}, 0x0) sendmsg$DEVLINK_CMD_PORT_SET(r1, &(0x7f0000000140)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x10}, 0xc, &(0x7f0000000100)={&(0x7f00000003c0)=ANY=[@ANYBLOB='l\x00\x00\x00', @ANYRES16=r8, @ANYBLOB="fd6dcbde200028bd7000fddbdf2506000000080001007063690011000200303030303a30303a31302e3000000000080003000c0000000000000000000000080001007063690011000200303030303a30303a31302e30000000000800030000000000064004008a3dc7d75b23e910b6767ce21223ce9b8cdf9cfcce5328ab9ab0ec07af2ca0be855a5362a3b491684e98a861ef87f868b5e1135a84e1b9d27fea8bd600927377900313cfe0f923abaef8241c318c45623720dca12f1801910101000000000000a9511b4c61a3ed29b6675fd6fa31320621ebc438aea65742eb9a080caefb15fabecc8849e17d1222f450c73f4b096b4fd3e5c3b4c324ff81d12b3de5496c"], 0x6c}, 0x1, 0x0, 0x0, 0x10}, 0x41) socket$inet6(0xa, 0x2, 0x0) r9 = socket(0x10, 0x803, 0x0) syz_genetlink_get_family_id$batadv(&(0x7f0000000200), r9) getsockname$packet(r9, &(0x7f0000000180)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000000c0)=0x14) 1.737868811s ago: executing program 1 (id=8035): r0 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=@base={0x6, 0x4, 0x9, 0x8}, 0x50) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_TCP_MD5SIG(r1, 0x6, 0xe, &(0x7f0000000000)={@in6={{0xa, 0x0, 0x0, @private0={0xfc, 0x0, '\x00', 0x1}, 0x39e39fc3}}, 0x0, 0x0, 0x31, 0x0, "24b7ffff080000000000e33294f56c7556fd3f13097bd007250ea4fbc5b07a3205e28634322c08fee7ddab72b1b8fc87f208ad6db80d8dfe2500"}, 0xd8) close(0x3) r2 = socket$nl_rdma(0x10, 0x3, 0x14) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r2, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000040)={0x38, 0x1403, 0x1, 0x70bd28, 0x25dfdc02, "", [{{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'ip6gre0\x00'}}]}, 0x38}, 0x1, 0x0, 0x0, 0xc890}, 0x20000000) bpf$PROG_LOAD(0x5, &(0x7f0000000140)={0x3, 0xc, &(0x7f00000000c0)=@framed={{0x18, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81}, [@ringbuf_output={{0x18, 0x5, 0x1, 0x0, r0}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0x8}, {}, {}, {}, {}, {}, {0x85, 0x0, 0x0, 0x1d}}]}, &(0x7f0000000200)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x4, '\x00', 0x0, @sched_cls=0x36, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) 1.471192575s ago: executing program 1 (id=8036): r0 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$SO_TIMESTAMPING(r0, 0x1, 0x25, &(0x7f0000000080)=0x474e, 0x4) setsockopt$inet_int(r0, 0x0, 0x17, &(0x7f00000001c0)=0x5, 0x4) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000240)=@newlink={0x60, 0x10, 0x439, 0x70bd2b, 0x4000, {}, [@IFLA_LINKINFO={0x40, 0x12, 0x0, 0x1, @ip6gre={{0xb}, {0x30, 0x2, 0x0, 0x1, [@IFLA_GRE_REMOTE={0x14, 0x7, @mcast1}, @IFLA_GRE_ENCAP_TYPE={0x6, 0xe, 0x2}, @IFLA_GRE_OFLAGS={0x6, 0x3, 0x7}, @IFLA_GRE_FLOWINFO={0x8, 0xc, 0x401}]}}}]}, 0x60}}, 0x0) bind$inet(r0, &(0x7f0000000240)={0x2, 0x0, @local}, 0x6f) (async) bind$inet(r0, &(0x7f0000000240)={0x2, 0x0, @local}, 0x6f) connect$inet(r0, &(0x7f0000000480)={0x2, 0x0, @multicast2}, 0x10) (async) connect$inet(r0, &(0x7f0000000480)={0x2, 0x0, @multicast2}, 0x10) sendmmsg(r0, &(0x7f0000007fc0), 0x800001d, 0x300) setsockopt$inet_int(r0, 0x0, 0x14, &(0x7f0000000000)=0x1f5, 0x4) socket$inet6_tcp(0xa, 0x1, 0x0) (async) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) r2 = socket$netlink(0x10, 0x3, 0x0) close(r1) socket$inet6_mptcp(0xa, 0x1, 0x106) setsockopt$inet6_tcp_int(r1, 0x6, 0x18, 0x0, 0x0) syz_genetlink_get_family_id$tipc(&(0x7f0000000100), r2) recvmmsg(r0, &(0x7f0000000900)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f0000000800)=""/224, 0xe0}}], 0x1, 0x45833af92e4b39ff, 0x0) (async) recvmmsg(r0, &(0x7f0000000900)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f0000000800)=""/224, 0xe0}}], 0x1, 0x45833af92e4b39ff, 0x0) openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x48241, 0x0) (async) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x48241, 0x0) ioctl$TUNSETIFF(r3, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x6bf1c2d5adba8c32}) r4 = socket$kcm(0x2, 0xa, 0x2) syz_init_net_socket$bt_l2cap(0x1f, 0x2, 0x0) (async) r5 = syz_init_net_socket$bt_l2cap(0x1f, 0x2, 0x0) connect$bt_l2cap(r5, &(0x7f0000000080)={0x1f, 0x0, @fixed={'\xaa\xaa\xaa\xaa\xaa', 0x10}, 0x7ff}, 0xe) r6 = syz_init_net_socket$bt_hidp(0x1f, 0x3, 0x6) ioctl$sock_bt_hidp_HIDPCONNADD(r6, 0x400448c8, &(0x7f00000000c0)={r5, r5, 0x206, 0x0, 0x0, 0x2, 0x72, 0x1, 0x3, 0x7, 0x0, 0x8, 'syz1\x00'}) (async) ioctl$sock_bt_hidp_HIDPCONNADD(r6, 0x400448c8, &(0x7f00000000c0)={r5, r5, 0x206, 0x0, 0x0, 0x2, 0x72, 0x1, 0x3, 0x7, 0x0, 0x8, 'syz1\x00'}) ioctl$F2FS_IOC_GET_FEATURES(r5, 0x8004f50c, &(0x7f0000000140)) ioctl$SIOCSIFHWADDR(r4, 0x8914, &(0x7f0000000040)={'syzkaller1\x00', @link_local}) write$tun(r3, &(0x7f0000001080)={@void, @void, @eth={@broadcast, @link_local, @val={@void}, {@ipv4={0x800, @udp={{0x5, 0x4, 0x0, 0x2, 0x2c, 0x68, 0x0, 0x0, 0x11, 0x0, @initdev={0xac, 0x1e, 0x2, 0x0}, @multicast1}, {0x0, 0x17c1, 0x18, 0x0, @wg=@data={0x4, 0x4, 0x2}}}}}}}, 0x3e) (async) write$tun(r3, &(0x7f0000001080)={@void, @void, @eth={@broadcast, @link_local, @val={@void}, {@ipv4={0x800, @udp={{0x5, 0x4, 0x0, 0x2, 0x2c, 0x68, 0x0, 0x0, 0x11, 0x0, @initdev={0xac, 0x1e, 0x2, 0x0}, @multicast1}, {0x0, 0x17c1, 0x18, 0x0, @wg=@data={0x4, 0x4, 0x2}}}}}}}, 0x3e) 1.398722026s ago: executing program 3 (id=8037): bpf$PROG_LOAD(0x5, &(0x7f00000017c0)={0x2, 0xe, &(0x7f0000001880)=ANY=[], &(0x7f00000001c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x1, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x8, 0x10, &(0x7f00000000c0), 0x10}, 0x94) r0 = bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000140)={&(0x7f0000000040)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0xc, 0xc, 0x2, [@ptr]}}, 0x0, 0x26}, 0x20) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000a00)={0x6, 0xf, &(0x7f0000000380)=@ringbuf={{0x18, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x7f}, {}, {}, [], {{}, {0x7, 0x0, 0xb, 0x2, 0x0, 0x0, 0x1}, {0x85, 0x0, 0x0, 0x84}}}, &(0x7f0000000740)='GPL\x00', 0x6, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x25, r0, 0x8, 0x0, 0x0, 0x2, &(0x7f00000000c0)={0x0, 0x0, 0xffffffff}, 0x10}, 0x94) r1 = socket$nl_route(0x10, 0x3, 0x0) socketpair$tipc(0x1e, 0x2, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$tipc(r2, &(0x7f0000000c00)={&(0x7f0000000100)=@name={0x1e, 0x2, 0x2, {{0x43, 0x2}, 0x2}}, 0x10, &(0x7f0000000ac0)=[{&(0x7f0000000180)="f441d45957f3800ecbfdd769fc0580a486712ec1a7e6c3b19ff5ecbf477420021327bbb31333649020839628", 0x2c}, {&(0x7f0000000200)="1996b65634d44ceaf823bffe4bda1f90ea4b8bad82d3548904f415d8265fef9f6e0d735700fabf7bea7d705a919954f08b2343950a80753b6d079da1e71635f8c10d066ce66b2c2c2c534c5241fb03bdf27563f8e84c2c1a376f5d0601a5645609b205e2d0695e4a95432d0e07e2f16f911d792a02d4bdd318", 0x79}, {&(0x7f0000000400)="c74930fc209f9e0457138834c4b543a36fe090410d92d52e6d8d8df60b510d1e723a3939791cd7170d551dbe3e96c1d9a3b7b7893ad723e8b2761ccb30a91e750234c9e9b631f99d", 0x48}, {&(0x7f0000000480)="4bc4a5940621f10514f25c8346458fb635f8d4da14f5dbf4930b12446785b643eb651459293610878cef2dd942f9f60700bb6756291252e0e3410f1c6c209491033ecd02eab314c0a2f9c542db576b36cb36e14bba59a6deeaf4eeb90e421243162770fe64be896ae780979996e0b7f2b301ee7208ae8eebb7bd71baa779977760362c06d44ceb3f84f0c49b5196dc9168f46095ea39efaeca9b2f464cf6d8104cc70fd7e4187aecdda68d7cb72ca777ad5425d41284b0213e4db05ba14799a998a9a2380f54c1629ab95d21f6d8a7cb3b3dfdd5cbc310a5611115f91c9ee20114ebc0", 0xe3}, {&(0x7f0000000580)}, {&(0x7f00000006c0)="d8c2da982726aa0255691853a665cdd32880f71e347207e660b4fb95359aa5a8031dc1a26b04edc893636659e185c7e6132bc9eabf3e93a3c1ebf9799043c221068c8f623e7aef958d52c126d0e6e35af2156ae5cfe9abdfdd65", 0x5a}, {&(0x7f0000000780)="81ed05fd58a0f382e4b7478af65e9f82ed0c5c79b6f3fdef2ad9cba07b1699b605900adf36c21266359352e225486860c3090f6ef2c65b3ec77ba452f7da325023afedcae42c6dbbadfb0881bac32fd0b464591ba71bcf26e2c6898cb45fe1c45980981627ddc9204b611540dce8fe4308195aeb1ae57cb2eb23612bc57f66abd9a1ac6191456521bdd5179f464320268aba24a7c0ca086105d4f88e8a4f17c7c7ce98d7740ee269cbfc398349c609", 0xaf}, {&(0x7f0000000840)="160ddda5aa0185713f458377203597d55ff0a1aaf9f3f1451f1ecc", 0x1b}, {&(0x7f0000000880)="6596c548a22119b6f338b17dd706d53972c7d478e95a37784d359ef4cf096bb4ca7d3b3ddda49cb75c392d2b4f2c65dd88701e3215fd1d5cecb5db88fbda448b786ba336f6f65fe765307cec1efd80908701feb8fdfd388da660d1a07a8f0c74aa989b1d249d48c8a920f9663c4e7f79e850f83c4835bf5145c8360ba820ed843006f0fde6514d024cb13ad683a4764390565e1f5d83723b5caefd6bd76eb887a3437486cf351fdc646189863f41a687aeef9af284b1c633a59e24509dce2ef496915e1e1b38bffd991d0b44a61a900c660eaae8421260e4f36ec858247588", 0xdf}], 0x9, &(0x7f0000000b80)="c71dc105bb7917c3495b2dde84184dc2a48995d2527833c5651a95fcd056d5220f4c43f2939d89efc157db5184410050236a99fac1812e76ae53a3cae6dfd3d8ea7205f9197a61215efc561430c12456fe1776cbc3625e8f9644a2d2caaa5b989e2934318f63d21590", 0x69, 0x24000841}, 0x851) sendmsg$nl_route_sched(r1, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000600)=@newtaction={0xc0, 0x30, 0x1, 0x0, 0x25dfdbfe, {}, [{0xac, 0x1, [@m_tunnel_key={0x60, 0x1, 0x0, 0x0, {{0xf}, {0x30, 0x2, 0x0, 0x1, [@TCA_TUNNEL_KEY_ENC_IPV4_DST={0x8, 0x4, @initdev={0xac, 0x1e, 0x0, 0x0}}, @TCA_TUNNEL_KEY_ENC_IPV4_SRC={0x8, 0x3, @initdev={0xac, 0x1e, 0x0, 0x0}}, @TCA_TUNNEL_KEY_PARMS={0x1c, 0x2, {{0x0, 0x0, 0x0, 0x0, 0x4}, 0x1}}]}, {0x4}, {0xc}, {0xc}}}, @m_gact={0x48, 0x2, 0x0, 0x0, {{0x9}, {0x1c, 0x2, 0x0, 0x1, [@TCA_GACT_PARMS={0x18, 0x2, {0x9, 0xb, 0x20000000, 0x6, 0x695}}]}, {0x4}, {0xc}, {0xc}}}]}]}, 0xc0}}, 0x0) 1.296238976s ago: executing program 4 (id=8038): r0 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000340)=ANY=[@ANYBLOB="02000000040000000800000001"], 0x48) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000100)={0x1f, 0x11, &(0x7f0000000200)=ANY=[@ANYBLOB="18000000ffffffff000000000000000085000000a8000000b7080000000000007b8af8ff00000000b7080000000000007b8af0ff00000000bfa100000000000007010000f8ffffffbfa400000000000007040000f0ffffffb70200000800000018230000", @ANYRES32=r0, @ANYBLOB="0000000000000000b70500000000000085000000a800000095"], &(0x7f00000001c0)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x1a, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x3}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000340)={r1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x48) bpf$PROG_BIND_MAP(0xa, &(0x7f0000000680)={r1}, 0xc) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r2, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f00000003c0)=ANY=[@ANYBLOB="140000001000010000000000000000000300000a1c000000000a0500000000000000000013000003080002400000000428000000000a010400000000000000000300008a0900010073797a30000000000800024000000007000000000000000000000000e3001411000100000a"], 0x6c}, 0x1, 0x0, 0x0, 0x24040010}, 0x20004040) socket$inet6(0xa, 0x2, 0x0) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x2, 0x31, 0xffffffffffffffff, 0xdfbd5000) r3 = socket$rds(0x15, 0x5, 0x0) bind$rds(r3, &(0x7f0000000040)={0x2, 0x2, @loopback}, 0x10) r4 = socket$igmp(0x2, 0x3, 0x2) setsockopt$MRT_ADD_MFC(r4, 0x0, 0xcc, &(0x7f0000000140)={@multicast2, @multicast1, 0x0, "aaa517d60f2811d48c8a2cc60c4380bc23b510d442ff13482864280a9c0f4eb5", 0x0, 0x0, 0x0, 0x3}, 0x3c) setsockopt$MRT_ADD_MFC_PROXY(r4, 0x0, 0xd2, &(0x7f0000000040)={@multicast2, @multicast1, 0x2, "4f6fb4d1af0f724e6118ecd4ac1100843af297baebb0efcdf5a284da144a011a", 0x4}, 0x3c) setsockopt$MRT_DEL_MFC_PROXY(r4, 0x0, 0xd3, &(0x7f0000000100)={@multicast2, @multicast1, 0x0, "c6c0e6ec8755b5dc4e305886d95f086707764f8d0e5a0358ea21274f844a69e9", 0x9, 0x201, 0x489c, 0x6}, 0x3c) mmap(&(0x7f0000000000/0x400000)=nil, 0x1e9000, 0x16, 0x200000006c832, 0xffffffffffffffff, 0x0) sendmsg$rds(r3, &(0x7f0000001600)={&(0x7f0000000000)={0x2, 0x0, @remote}, 0x10, 0x0, 0x0, &(0x7f0000000780)=[@rdma_args={0x48, 0x114, 0x1, {{}, {0x0, 0x2c}, &(0x7f00000006c0)=[{&(0x7f0000000100)=""/44, 0x410200}], 0x1}}], 0x48}, 0x0) bpf$BPF_MAP_CONST_STR_FREEZE(0x16, &(0x7f0000000340)={r3}, 0x4) r5 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r5, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000300)=ANY=[@ANYBLOB="30000000200001"], 0x30}, 0x1, 0x0, 0x0, 0x24048860}, 0x0) r6 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r6, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000300)=ANY=[@ANYBLOB='\\\x00\x00\x00!'], 0x5c}, 0x1, 0x0, 0x0, 0x8840}, 0x40080) getsockopt$inet6_tcp_TCP_ZEROCOPY_RECEIVE(0xffffffffffffffff, 0x6, 0x23, 0x0, 0x0) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x2, 0x31, 0xffffffffffffffff, 0x0) syz_emit_ethernet(0x86, &(0x7f0000000000)={@dev={'\xaa\xaa\xaa\xaa\xaa', 0x23}, @remote, @void, {@ipv4={0x800, @udp={{0x5, 0x4, 0x0, 0x0, 0x78, 0x0, 0x0, 0x0, 0x11, 0x0, @empty, @empty}, {0x0, 0x4e20, 0x64, 0x0, @wg=@response={0x2, 0x3, 0x1, "56805c734ee222c29de4125f81f6e030a5441a99f362cd24e0a1ac2291500733", "467f517bd818d5a4a8d26ae61b4cbf13", {"31ffc21d2e9bfb1eb3c03976ed837b6f", "876605ac29dcb96a8901e0711afb3db3"}}}}}}}, 0x0) bpf$PROG_LOAD_XDP(0x5, 0x0, 0x0) bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="1b001d1000000000000000002080000000000000", @ANYRES32, @ANYBLOB='\x00'/20, @ANYRES32=0x0, @ANYRES32, @ANYBLOB="00000000000100"/28], 0x50) r7 = bpf$PROG_LOAD(0x5, &(0x7f0000000240)={0x1f, 0x10, &(0x7f0000000800)=ANY=[@ANYBLOB="18000000630500000000000081000000b7080000000000007baaf8ff00000000b5080000020000047b8af0ff00000000bfa100000000000007010000f8ffffffbfa400000000000007040000f0ffffffb70200000800000018230000", @ANYRES32, @ANYBLOB="0000000000000000b70500000800003e85000000b30000fbb400000000000000ff0257a8737e50d913fa54cb547bad85d9991ba4120411cd98d56f1735db86c44e0b2b502658addfdb5ec1d61e4a6eedc52ee638dcb460ecb43d1359a034dc2e8c8fa15d09539bc39612034cf881b0b4f91abe438f76a2c458857b32b066506041ee6e78cf435e0b92c0fa074d54e73a8b223dd80cd7ef"], &(0x7f0000000ac0)='syzkaller\x00', 0x3, 0x0, 0x0, 0x41000, 0x18, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$PROG_BIND_MAP(0xa, &(0x7f0000000000)={r7}, 0xc) r8 = bpf$PROG_LOAD(0x5, &(0x7f00000001c0)={0x3, 0xc, &(0x7f00000005c0)=ANY=[@ANYBLOB="1800000000000000000000000000000085000000610000001801000020786c2500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b7030000110b0008850000000500000095"], &(0x7f0000000500)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0xd, '\x00', 0x0, @sched_cls=0x37, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f00000002c0)={r8, 0x0, 0x12, 0x0, &(0x7f0000000080)="dc188619b95d02ff4284860188a86a4e0800", 0x0, 0x8001ff, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) 1.244278174s ago: executing program 0 (id=8039): r0 = socket(0x10, 0x3, 0x0) sendmsg$nl_generic(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000840)={0x14, 0x1d, 0x21, 0x20, 0x0, {0x7}}, 0x14}, 0x1, 0x0, 0x0, 0x80800}, 0x0) r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000440)=ANY=[@ANYBLOB="2c00000040000100fcff070004000000020000000400488014000180100010800400108008000100e9"], 0x2c}, 0x1, 0x0, 0x0, 0x400c801}, 0x4008094) ioctl$TUNSETQUEUE(0xffffffffffffffff, 0x400454d9, &(0x7f0000000000)={'ipvlan1\x00', 0x200}) 1.182984454s ago: executing program 2 (id=8040): r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000340)=@base={0x6, 0x4, 0x400, 0xf, 0x0, 0x1}, 0x50) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0x14, &(0x7f0000000280)=ANY=[@ANYBLOB="180000000000000000000000000000001801000020646c2100000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b7030000fffffff8850000002d00000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b70400000000000085000000c300000095"], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$PROG_BIND_MAP(0xa, &(0x7f0000000080)={r1}, 0xc) r2 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$nbd(&(0x7f0000000000), 0xffffffffffffffff) r4 = socket$netlink(0x10, 0x3, 0x0) setsockopt$netlink_NETLINK_DROP_MEMBERSHIP(r4, 0x10e, 0xc, &(0x7f0000000640)=0x4, 0x4) sendmsg$netlink(r4, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000680)=ANY=[@ANYBLOB=' \x00\x00\x00_\x00]', @ANYRESHEX], 0x20}], 0x1}, 0x40) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff}) syz_genetlink_get_family_id$nfc(0x0, r2) sendmsg$NBD_CMD_CONNECT(r2, &(0x7f0000001ac0)={0x0, 0x0, &(0x7f0000001a80)={&(0x7f00000001c0)=ANY=[@ANYBLOB='|\x00\x00\x00', @ANYRES16=r3, @ANYBLOB="0100ffffffff0000000001000000100007800c00018008000100", @ANYRES32=r5, @ANYBLOB="0c0005006c010000000000000c000200ff", @ANYRES32=r5], 0x7c}}, 0x20000000) bpf$MAP_CREATE(0x0, &(0x7f0000000340)=@base={0x6, 0x4, 0x400, 0xf, 0x0, 0x1}, 0x50) (async) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0x14, &(0x7f0000000280)=ANY=[@ANYBLOB="180000000000000000000000000000001801000020646c2100000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b7030000fffffff8850000002d00000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b70400000000000085000000c300000095"], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) (async) bpf$PROG_BIND_MAP(0xa, &(0x7f0000000080)={r1}, 0xc) (async) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) (async) syz_genetlink_get_family_id$nbd(&(0x7f0000000000), 0xffffffffffffffff) (async) socket$netlink(0x10, 0x3, 0x0) (async) setsockopt$netlink_NETLINK_DROP_MEMBERSHIP(r4, 0x10e, 0xc, &(0x7f0000000640)=0x4, 0x4) (async) sendmsg$netlink(r4, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000680)=ANY=[@ANYBLOB=' \x00\x00\x00_\x00]', @ANYRESHEX], 0x20}], 0x1}, 0x40) (async) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000100)) (async) syz_genetlink_get_family_id$nfc(0x0, r2) (async) sendmsg$NBD_CMD_CONNECT(r2, &(0x7f0000001ac0)={0x0, 0x0, &(0x7f0000001a80)={&(0x7f00000001c0)=ANY=[@ANYBLOB='|\x00\x00\x00', @ANYRES16=r3, @ANYBLOB="0100ffffffff0000000001000000100007800c00018008000100", @ANYRES32=r5, @ANYBLOB="0c0005006c010000000000000c000200ff", @ANYRES32=r5], 0x7c}}, 0x20000000) (async) 1.092042295s ago: executing program 3 (id=8041): bind$inet(0xffffffffffffffff, &(0x7f0000000000)={0x2, 0x4e1f, @private=0xa010102}, 0x9) r0 = socket$kcm(0x2, 0x922000000001, 0x106) r1 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_generic(r1, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000002c0)={0x28, 0x4a, 0x1, 0x0, 0x0, {0xa, 0x0, 0x6e80}, [@typed={0x14, 0x0, 0x0, 0x0, @ipv6=@loopback}]}, 0x28}}, 0x0) setsockopt$sock_attach_bpf(r0, 0x1, 0x43, &(0x7f0000000000), 0xff7b) 931.696229ms ago: executing program 0 (id=8042): r0 = socket$unix(0x1, 0x1, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) (async) r2 = socket$inet6(0xa, 0x1, 0x0) setsockopt$inet6_int(r2, 0x29, 0x46, &(0x7f0000000180)=0x7, 0x4) (async) connect$inet6(r2, &(0x7f0000000480)={0xa, 0x4e22, 0x380000, @empty}, 0x1c) r3 = socket(0x400000000010, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r3, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000280)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0xffffffff, {0x0, 0x0, 0x0, r4, {0x0, 0xfff1}, {0xffff, 0xffff}, {0x0, 0xb}}, [@qdisc_kind_options=@q_fq_codel={{0xd}, {0x4}}]}, 0x38}}, 0x0) (async, rerun: 32) r5 = socket$unix(0x1, 0x1, 0x0) (rerun: 32) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) (async) syz_genetlink_get_family_id$tipc2(&(0x7f0000000140), r3) (async, rerun: 32) r7 = openat$tun(0xffffffffffffff9c, &(0x7f00000004c0), 0x0, 0x0) (rerun: 32) close(r7) socket$unix(0x1, 0x2, 0x0) (async, rerun: 32) ioctl$SIOCSIFHWADDR(r7, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x1}}) (async, rerun: 32) r8 = socket$inet6_sctp(0xa, 0x5, 0x84) setsockopt$inet_sctp6_SCTP_INITMSG(r8, 0x84, 0x2, &(0x7f00000000c0)={0xfffc}, 0x8) sendto$inet6(r8, &(0x7f0000000580)="81", 0x1, 0xc001, &(0x7f0000000280)={0xa, 0x0, 0x0, @loopback, 0x81}, 0x1c) (async) setsockopt$inet6_mreq(r8, 0x29, 0x15, 0x0, 0x0) (async) r9 = socket$kcm(0x11, 0x3, 0x0) r10 = socket(0x400000000010, 0x3, 0x0) r11 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r11, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r10, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000002940)=@newtfilter={0xea4, 0x2c, 0xd27, 0x30bd29, 0x25dfdc00, {0x0, 0x0, 0x0, r12, {0x1, 0x4}, {}, {0x8}}, [@filter_kind_options=@f_matchall={{0xd}, {0xe70, 0x2, [@TCA_MATCHALL_ACT={0xe6c, 0x2, [@m_pedit={0xe68, 0x1, 0x0, 0x0, {{0xa}, {0xe3c, 0x2, 0x0, 0x1, [@TCA_PEDIT_PARMS={0xe38, 0x2, {{{0x2, 0x9, 0x20000000, 0x6}, 0x1, 0xfb, [{0x3, 0x80000000, 0x80000000, 0x1, 0x2e7d0b0c, 0x400}]}, [{0x2, 0x9c, 0x81, 0x6, 0x2, 0x7}, {0x1, 0x10, 0x21e, 0x3, 0xfffffffd, 0x81}, {0x1, 0x80000001, 0x8, 0x101, 0x3}, {0x3, 0x9, 0x8, 0x7, 0x5, 0x4}, {0xf, 0x7, 0x9, 0x51, 0x8}, {0x3, 0x4, 0xc, 0x101, 0x3, 0x84b5}, {0x9c, 0x4, 0x9, 0x2, 0x487, 0x8}, {0x1, 0x10000, 0x5, 0x4, 0x3, 0x8000}, {0x7, 0x1, 0x1bf, 0x8, 0x2, 0x7fff}, {0x439356e7, 0x609, 0x16, 0x0, 0x10000, 0x6}, {0x5, 0x3, 0x8, 0x3, 0x0, 0xffffffff}, {0x5, 0x0, 0x7, 0x7, 0x8, 0x5}, {0x5, 0x8, 0x9, 0x5, 0xfffff000, 0x7}, {0x768d, 0xcd, 0x8, 0x7, 0x5, 0x9}, {0x1, 0xfffffffb, 0x6, 0x5, 0x7ff, 0x6}, {0xfffffffb, 0x3, 0xfffffffe, 0x6, 0x2}, {0xfffff9fd, 0x9, 0xa5f, 0xa, 0x5, 0x2}, {0xffff997c, 0x9, 0x167, 0x2, 0x71, 0xa2}, {0x140, 0x8, 0xc, 0x8, 0x87, 0x60}, {0x5, 0xa, 0x2, 0x4, 0x3, 0x2000}, {0x32d, 0x8, 0x7fff, 0x4, 0x8, 0x9}, {0x8, 0x200, 0x58fe, 0x7ff, 0x4, 0x3}, {0x101, 0xd, 0x101, 0x1, 0x3, 0x8}, {0x0, 0x3, 0x1ff, 0xf8, 0x2, 0x9}, {0xffffffff, 0x1, 0x9, 0xfffffffd, 0x1, 0x4}, {0xc, 0xe, 0x0, 0x3, 0x8, 0x81}, {0x3, 0x3, 0x6, 0xe, 0x0, 0x80}, {0xd, 0x0, 0x7ff, 0x0, 0x80000000, 0x2}, {0x4, 0xb, 0x6c5f1878, 0x57c4, 0x8, 0x25ff}, {0x4, 0xd, 0x1fadd976, 0x3071, 0x0, 0x1}, {0x5, 0x800, 0x3, 0x3, 0x3, 0x9}, {0x9, 0x1ff, 0x81, 0x9c, 0x1, 0x5}, {0x9, 0xd76, 0x6, 0xdc2, 0xa16a, 0x2}, {0x1ff, 0x5, 0x7, 0x2, 0x2, 0x1}, {0x1, 0x32158140, 0x0, 0x8, 0x6, 0x7}, {0xe, 0x4, 0x9000, 0x5, 0x2, 0x7f}, {0x3, 0x2ec74d53, 0x0, 0x0, 0x8, 0x2}, {0x5, 0xfff, 0xffffff13, 0x6, 0x2, 0x6}, {0x1, 0x6, 0x1, 0x4, 0xffb, 0xc}, {0x6, 0x6, 0x1ff, 0x8, 0x7ff, 0x8001}, {0x74, 0xffffffff, 0x0, 0xfffff740, 0x4, 0x4}, {0xffff, 0x5, 0x7, 0xac, 0xf}, {0x5, 0x3, 0x6, 0x1000, 0xd8fe, 0x8001}, {0xd, 0x3, 0x80000002, 0x0, 0xffffff81, 0x7ff}, {0xfffffffb, 0x2, 0x1ff, 0xf9, 0xffff8001}, {0x0, 0x6, 0x7ffc, 0x9, 0x500, 0x7}, {0x1, 0xffffffff, 0x834, 0x7, 0x0, 0x3}, {0x7fff, 0x6, 0x0, 0x2002, 0x2, 0x8}, {0xf61, 0x101, 0x9, 0x2, 0x80000000, 0x7fff}, {0xc7, 0x1, 0x8, 0x2, 0xffff, 0x20000000}, {0x0, 0x5, 0x1, 0xffff, 0x3, 0x3}, {0x8, 0x10001, 0x9f98, 0x1, 0x8, 0x66a}, {0xfff, 0x6, 0x8, 0x80000001, 0x0, 0x7f}, {0x8, 0x6, 0x7f, 0x5, 0x3, 0xb}, {0x4, 0x4b, 0x10, 0x1, 0x7f, 0x7fffffff}, {0xfff, 0x47e4, 0x1, 0x0, 0x80000001, 0x9}, {0x3, 0x9, 0x7, 0x6, 0x3e6b7592, 0xe5}, {0x9, 0x9, 0x1, 0x9, 0x0, 0x2}, {0x8, 0x80000001, 0x7fff, 0xb2d9, 0xfffffffe, 0x8}, {0x80000001, 0x9, 0x5202, 0x2, 0x53ce, 0x3}, {0x6, 0x7, 0x8, 0x8, 0x7f, 0x80000000}, {0xfffffff9, 0x9, 0x6, 0x6, 0x9, 0x3}, {0xfffffffd, 0x8, 0x6, 0x5, 0x3, 0x8f}, {0x741, 0x0, 0x9, 0x7fffffff, 0x2, 0x200}, {0x401, 0x2, 0x8, 0x6, 0x4, 0xc6e9}, {0x1, 0x2d73, 0x3ff, 0x5, 0x9f17, 0xffffff7f}, {0x2, 0x401, 0x2b00, 0xfffff57b, 0xfffffc00, 0xd}, {0x3, 0x4, 0xc52b, 0x9, 0x5, 0xff}, {0x0, 0x4, 0x401, 0x0, 0x1, 0x9}, {0x8, 0x4, 0x1, 0x2, 0x10, 0x1}, {0xff, 0x8, 0x3, 0x5, 0xff, 0x5}, {0x2, 0xb15ce2d, 0x80000001, 0xbeab, 0x1, 0x5}, {0x3, 0x8, 0x3, 0x7, 0x8, 0x4}, {0xfff, 0x9, 0x6, 0x3, 0x100, 0x57}, {0x9, 0x5, 0x4, 0x3, 0xa, 0x2}, {0xb3, 0xe, 0x3, 0x8000, 0x7, 0x9}, {0xff, 0x7, 0x5, 0x10001, 0x6, 0x6}, {0x2, 0x8f, 0x9, 0xffffff46, 0x4, 0x80000000}, {0x9, 0x2, 0xfffffffc, 0x1, 0xd50, 0x3}, {0xd203, 0x7, 0x1, 0x10000, 0x43, 0x1ff}, {0x4, 0x3ff, 0xffffffff, 0x1, 0x5, 0x100}, {0x1ff, 0x3, 0x7ff, 0xfffffff8, 0x1ff, 0xfffffffc}, {0x7, 0x9, 0x3ff, 0x1, 0x7, 0x4}, {0x0, 0x6, 0x0, 0x9, 0xffff0001, 0xcca}, {0x7, 0x1, 0xfffffff1, 0x3ff, 0x100, 0x4}, {0x3, 0x9, 0x0, 0xed4, 0x4, 0x6}, {0x9, 0x7, 0x8001, 0x7, 0x7, 0x2}, {0x3, 0xfff, 0x9, 0x5, 0xb5, 0x3}, {0x0, 0x1, 0x1, 0x5, 0xffffff01, 0xfff}, {0x7, 0x5, 0x2, 0x2, 0x0, 0xfffff9de}, {0x5, 0xfffffffc, 0xe6b, 0xb, 0xb, 0x4}, {0x1d, 0xffffff10, 0x1, 0x2, 0xff, 0x52e2}, {0x0, 0x9, 0x0, 0x7, 0xdb, 0x5}, {0x2, 0x2, 0x9, 0x1000, 0xa, 0x100}, {0x81, 0x4, 0x988, 0x0, 0x0, 0x7}, {0xdc03, 0x7, 0x402c, 0xffff, 0xfffffff9, 0x4}, {0xa, 0xfffffffe, 0x1, 0x1ff, 0x1ff, 0xc1b7}, {0xa24b, 0x947d, 0x40, 0x4, 0x9, 0x2}, {0x9, 0x401, 0xa89, 0x5ef, 0x9, 0x8}, {0x4, 0x7fff, 0x0, 0x4, 0x7fffffff}, {0x3, 0xb8c, 0x6, 0x21761f6a, 0x1, 0x4}, {0xfff, 0xda, 0x1f, 0x4, 0x8, 0x2}, {0x8, 0x10, 0x100, 0x0, 0xfffffff7, 0x43}, {0xfffff000, 0x8, 0xe96, 0x9, 0x9, 0x34b0}, {0x4, 0x8, 0x8, 0x3, 0x6cf4, 0x1}, {0x3, 0x3, 0x7, 0x4, 0xbe, 0x81}, {0x4, 0x800, 0x0, 0x5, 0x8, 0xfa2f}, {0x3, 0x8d, 0x81, 0x8001, 0x8, 0x6}, {0x9, 0x2, 0x6, 0x2, 0xf, 0x5}, {0x100, 0x1, 0x2, 0xffffffff, 0x9, 0x74}, {0x4, 0x4, 0x8, 0x1, 0x0, 0x3}, {0xfffffff8, 0xfffffffb, 0xffffffff, 0x62f, 0x401, 0x30564e0}, {0x9a2f, 0x800, 0x8, 0x7, 0x7}, {0x20000006, 0x2, 0x800, 0x200, 0x9, 0x4}, {0x7, 0x6, 0x8936, 0xdcb, 0x0, 0x2}, {0x6, 0x80000000, 0x8, 0xe, 0xfffffffa, 0x8de3}, {0x0, 0x9, 0x8, 0xfff, 0x6, 0x1ff}, {0x8195, 0x2, 0x1000}, {0x1, 0x5, 0xff, 0x9e0f, 0x40005, 0x6}, {0x7fff, 0x6, 0x0, 0x5, 0x8000, 0x3}, {0x7ff, 0x9, 0xa, 0x6, 0x7, 0xe77}, {0x1, 0x5e12, 0x3, 0xfffffffa, 0x2, 0x80000001}, {0xffffff8c, 0x2, 0x1, 0x1, 0x10, 0x5}, {0x4, 0x7, 0x104, 0x78d, 0xffffcff9, 0x9}, {0x1, 0xe, 0x7, 0x2, 0xfffffffa, 0x207f}, {0x10, 0x5, 0xfffffffa, 0xff, 0x80000, 0xfffffffa}, {0x1, 0x7ff, 0x696e, 0xa, 0x49d, 0xb}, {0x3, 0x0, 0x5, 0x3, 0x3, 0x1000}], [{0x1}, {0x2, 0x1}, {0x5}, {0x2}, {0x2, 0x745e81639ff0f356}, {0x4}, {0x5}, {0x3, 0x1}, {0x3}, {0x2}, {0x4}, {0x4, 0x1}, {0x0, 0x1}, {0x2}, {0x2}, {}, {0x3, 0x1}, {0x0, 0x1}, {0x0, 0x1}, {0x5, 0x1}, {0x3, 0x1}, {0x1}, {0x2, 0x1}, {0x2}, {0x3, 0x1}, {0x2}, {0x5}, {0x2}, {0x1, 0x1}, {0x1}, {0x1, 0x1}, {0x5}, {0x4}, {0x4, 0x1}, {0x5, 0x1}, {}, {0x4, 0x1}, {0x3, 0x1}, {0x4, 0x1}, {0x1, 0x1}, {0x5}, {0xa}, {0x3}, {0x3}, {0x2, 0x1}, {0x3}, {0x4, 0x1}, {0x2, 0x1}, {0x0, 0x1}, {0x0, 0x1}, {0x2}, {0x4}, {0x4, 0x1}, {0x4}, {0x4}, {0x2, 0x1}, {0x2, 0x55d81519de704440}, {0x5, 0x3}, {0x4, 0x1}, {0x1}, {0x4}, {0x0, 0x1}, {0x2}, {0x1, 0x1}, {0x3, 0x1}, {0x5}, {0x3, 0x1}, {0x1, 0x1}, {0x5, 0x1}, {0x0, 0x1}, {0x2, 0x1}, {0x3, 0x1}, {0x0, 0x1}, {0x0, 0x1}, {0x3}, {0x6}, {0xa}, {0x3, 0x1}, {}, {0x2, 0x1}, {0x1}, {0x4}, {0x5}, {0x3}, {0x3, 0x1}, {0x4}, {0x0, 0x1}, {0x5, 0x1}, {0x6}, {}, {0xb82e57098c7a44ef}, {0x3, 0x1}, {0x1}, {0x0, 0x1}, {0x2}, {0x1, 0x1}, {0x5}, {0x0, 0x1}, {0x4}, {0x4}, {0x0, 0x1}, {0x2}, {0x4, 0x1}, {0x1, 0x1}, {0x1, 0x1}, {0x2}, {0x3}, {0x1, 0x1}, {}, {0x4}, {0x3}, {0x5}, {0x1}, {0x5}, {0x3, 0x1}, {0x4}, {0x3, 0x1}, {0x0, 0x1}, {0x1}, {0x4, 0x1}, {0x1}, {0x5, 0x1}, {0x4}, {0x0, 0x1}, {0x3}, {0x1}, {0x0, 0x1}, {0x4}], 0x1}}]}, {0x4}, {0xc, 0x7, {0x0, 0x1}}, {0xc, 0x8, {0x0, 0x1}}}}]}]}}]}, 0xea4}, 0x1, 0x0, 0x0, 0x10}, 0x0) (async) sendmsg$kcm(r9, &(0x7f0000002900)={&(0x7f0000000500)=@xdp={0x2c, 0x8, r6, 0x10c}, 0x80, &(0x7f00000000c0)=[{&(0x7f0000000380)="da", 0x5dc}], 0x1}, 0x4000880) r13 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000080)=ANY=[@ANYBLOB="02000000040000000800000001"], 0xe) bpf$PROG_LOAD(0x5, &(0x7f0000001b00)={0xe, 0x10, &(0x7f0000000740)=ANY=[@ANYBLOB="18000000000000000000000000000000b7080000020000007b8a00fe00000000a4080000000048027b8af0ff00000000bda100000000000007000000f8ffffffbfa400000000000007040000f0ffffffb70200000800000018230000", @ANYRES32=r13, @ANYBLOB="0000000000000000b704000008000000850000001a00000095"], &(0x7f0000000100)='syzkaller\x00', 0x0, 0x0, 0x0, 0x41100, 0x20, '\x00', 0x0, @fallback=0x12, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) 880.053588ms ago: executing program 3 (id=8043): socket$nl_route(0x10, 0x3, 0x0) r0 = socket$inet6(0xa, 0x2, 0x0) setsockopt$inet6_int(r0, 0x29, 0x1a, &(0x7f0000000000)=0x6, 0x4) (async) syz_emit_ethernet(0xb9, &(0x7f00000009c0)=ANY=[@ANYBLOB="aaaaaaaaaaaaaa420e78d9aa0011bcfc3fe4780fabfec176e59d0affb124f23d4a0ffd9265b270ff79c6ddb8ec26cb8b02d99430e49d5628e84515f4298ebb80b0fa7ee00272e8bcd36e200f0a9fd065fae18db48fed8de93ca89509ba5ccbc09929b9bf1865bb6da499afafc9653d0fbfb49ec77f57dcc1b3aa0a2ac7babb3a01b225029325ca4f0262fe3325555f1341847d8b11703e907a5daa8107736476ebb2055957c941ac8ea6541184aa9fba18e6616460795bcdc0"], 0x0) (async) openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x275a, 0x0) (async) socket$inet6_icmp_raw(0xa, 0x3, 0x3a) (async) socket$inet6_icmp_raw(0xa, 0x3, 0x3a) (async) r1 = socket$netlink(0x10, 0x3, 0x4) writev(r1, &(0x7f0000000300)=[{&(0x7f0000000000)="580000001400192340834b80040d8c560aff820fffff5bab003a0000002058000b4824ca945f6400940f6a0325010ebc000000000000008000f0fffeffe809005300fff5dd00000010000100090c100000000100224e0000", 0x58}], 0x1) (async) r2 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000340)=ANY=[@ANYBLOB="02000000040000000800000001"], 0x48) bpf$PROG_LOAD(0x5, &(0x7f0000000bc0)={0x13, 0x10, &(0x7f0000000e40)=ANY=[@ANYBLOB="18050000000000000000000000000000b7080000000000007b8af8ff00000000b7080000000000007b8af0ff00000000bfa100000000000007010000f8ffffffbfa400000000000007040000f0ffffffb70200000300000018230000", @ANYRES32=r2, @ANYBLOB="0000000000000000b704000008000000850000001c00000095"], &(0x7f0000000000)='GPL\x00', 0x5, 0x0, 0x0, 0x40f00, 0x9, '\x00', 0x0, @fallback=0x16, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffc}, 0x94) (async) r3 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000700)=ANY=[@ANYBLOB="0200000004000000080000000100000080000000", @ANYRES32=0x0, @ANYBLOB="000000000000000000000000000200000000000055afab16dda838cb0753f7cbecd45d31820c81ff82b87a3c833ab357cc46e3ecb2830c8d2118a3cce0b6af4dceddbf4b1d6f3e6d48c22af05e482538969dcaef5d4d9eca0c591d9ecfcc070f448411aad75d44645e276d426a2e782d5631571e45c6334ebd9bf56641c2e78f3b6732955643a951c6c576284d72418be048a9f2b61e3c3a100ce17557421e", @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB='\x00'/28], 0x48) bpf$PROG_LOAD(0x5, &(0x7f0000000840)={0x3, 0x1c, &(0x7f0000000d80)=ANY=[@ANYBLOB="1808000058000000000000000000000018110000", @ANYRES32=r3, @ANYBLOB="0000000000000000b702000014000000b7030000000000008500000005000000bf0900000000000035090100000000409500000000000000b7020000000000007b9af8ff00000000b5090000010000007baaf0ff00000000bf2700000000000007080000fffdffffbfa400000000000007040000f0ffffff740200000800000018090000", @ANYRES32=r3, @ANYBLOB="0000000000000000b7050000080000004608f0ff760000007ea000000000000056080000000000008500000081000000b70000000000000095"], &(0x7f0000000300)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sched_cls=0x36, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) (async) r4 = socket$inet_tcp(0x2, 0x1, 0x0) (async) r5 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$NL80211_CMD_RELOAD_REGDB(0xffffffffffffffff, &(0x7f00000006c0)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000340)={0x14, r5, 0x1, 0x70bd2d, 0x25dfdbfe}, 0x14}, 0x1, 0x0, 0x0, 0x20000000}, 0x20008004) socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_inet_SIOCADDRT(r4, 0x890b, &(0x7f0000000140)={0x0, {0x2, 0x4e24, @private=0xa010100}, {0x2, 0x4e21, @dev={0xac, 0x14, 0x14, 0x19}}, {0x2, 0x4e22, @local}, 0x83, 0x0, 0x0, 0x0, 0x7, &(0x7f0000000040)='syzkaller0\x00', 0x9, 0x9, 0x4}) (async) r6 = socket$alg(0x26, 0x5, 0x0) bind$alg(r6, &(0x7f00000004c0)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc-serpent-avx\x00'}, 0x58) (async) setsockopt$ALG_SET_KEY(r6, 0x117, 0x1, 0x0, 0x0) (async) r7 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r8 = syz_genetlink_get_family_id$netlbl_unlabel(&(0x7f0000000100), r7) sendmsg$NLBL_UNLABEL_C_STATICREMOVEDEF(r7, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000008c0)={0x14, r8, 0x1, 0x0, 0x0, {0x4, 0x74, 0x609}}, 0x14}, 0x1, 0xffffffff00000003, 0x0, 0x60040}, 0x0) (async) r9 = accept4(r6, 0x0, 0x0, 0x800) setsockopt$sock_int(r9, 0x1, 0x7, &(0x7f00000014c0)=0x10000b, 0x4) sendmmsg$alg(r9, &(0x7f0000000040)=[{0x0, 0x0, &(0x7f0000000540)=[{&(0x7f0000000080)="f78d9ca38fff48f3be52163448412ba8", 0xfffffe3f}, {&(0x7f0000000140)="ebe3a0e9796cfd1647e299f4e376fdba128280b372219d205e81f4a7f71c1926aae1efd7e0054a863f3d5cfe6cb55b5bb9fa6935849e6098ed884e7cb51726b360fbb37b4fe035bbb095873048"}, {&(0x7f00000003c0)="e8700e444d50a969ff67347cff6127e6ef12ee3819271482a4975a52c1ab9b8b4db3945d1032005eabe97b4dc33a47d3a158da988456d30026b433186f53cdcdb93a4722bf306a10470d50f5cb1ece9ead3459bab1cf1538cd0b157653c5e892962c80f158c443e9c6ad7d2a8103ef2f4b93766b9a21501f94c1568b13756b66f74f46cf801704d2da8b96c34070b233af0afcc436712e58ed25e721193af05a045ad3fdc928f02f3dbad19d3e66eebda2e63f3f46ef4511cee26d7b48241847bf9e343ef4674c45e2a085060f11"}], 0x1, &(0x7f0000000380)=[@op={0x18, 0x117, 0x3, 0x1}], 0x3}], 0x1, 0x40800) recvmsg(r9, &(0x7f00000005c0)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f00000000c0)=""/71, 0x47}, {&(0x7f0000000200)=""/83, 0x53}], 0x2}, 0x0) r10 = socket$alg(0x26, 0x5, 0x0) bind$alg(r10, &(0x7f0000000640)={0x26, 'aead\x00', 0x0, 0x0, 'gcm(anubis)\x00'}, 0x58) 708.86099ms ago: executing program 0 (id=8044): r0 = syz_init_net_socket$802154_raw(0x24, 0x3, 0x0) bind$802154_raw(r0, &(0x7f0000000440)={0x24, @short={0x2, 0x1}}, 0x14) sendmsg$netlink(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000500)=ANY=[], 0x118}], 0x1, 0x0, 0x0, 0x4000}, 0x0) r1 = socket$inet6_sctp(0xa, 0x5, 0x84) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r1, 0x84, 0x6f, &(0x7f0000000040)={0x0, 0x1c, &(0x7f0000000080)=[@in6={0xa, 0x0, 0x100000, @rand_addr=' \x01\x00'}]}, &(0x7f0000000180)=0x10) r2 = socket$inet_sctp(0x2, 0x1, 0x84) getsockopt$inet_sctp_SCTP_MAX_BURST(r2, 0x84, 0xd, &(0x7f0000000000)=@assoc_value={0x0}, &(0x7f0000000200)=0x8) r4 = socket(0x2, 0x80805, 0x0) getsockopt$inet_sctp_SCTP_MAX_BURST(r4, 0x84, 0xc, &(0x7f0000000040)=@assoc_value, &(0x7f0000000000)=0x8) getsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(r4, 0x84, 0x9, &(0x7f00000000c0)={r3, @in={{0x2, 0x4e24, @multicast2}}}, &(0x7f00000001c0)=0x9c) (async) r5 = socket$nl_route(0x10, 0x3, 0x0) (async) syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10) (async) r6 = socket$rds(0x15, 0x5, 0x0) bind$rds(r6, &(0x7f0000000040)={0x2, 0x4e21, @local}, 0x10) (async) setsockopt$RDS_CANCEL_SENT_TO(r6, 0x114, 0x1, 0x0, 0x0) r7 = socket$nl_route(0x10, 0x3, 0x0) (async) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r5, 0x8933, &(0x7f00000001c0)={'batadv_slave_0\x00', 0x0}) (async) r9 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000340)=ANY=[@ANYBLOB="0200000004000000080000000100000080"], 0x48) bpf$BPF_MAP_CONST_STR_FREEZE(0x16, &(0x7f00000005c0)={r9}, 0x4) (async) r10 = bpf$PROG_LOAD(0x5, &(0x7f0000000b80)={0x6, 0x10, &(0x7f0000000100)=@framed={{0x18, 0x2, 0x0, 0x0, 0x800000e2, 0x0, 0x0, 0x0, 0x2000000}, [@snprintf={{}, {}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0x8006}, {}, {}, {}, {}, {}, {}, {0x18, 0x3, 0x2, 0x0, r9}}]}, &(0x7f00000001c0)='GPL\x00', 0x0, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, @fallback=0x5c298795369ca04f, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r11 = socket$inet_tcp(0x2, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r11, 0x8933, &(0x7f0000000000)={'syz_tun\x00', 0x0}) bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f0000000800)={r10, r12, 0x25, 0x0, @val=@uprobe_multi={0x0, 0x0, 0x0, 0x0, 0x0, 0x1}}, 0x40) syz_emit_ethernet(0x16, &(0x7f0000000c40)=ANY=[@ANYBLOB="000000000000aa1712aaaa0a001101aa12777ddc00f5"], 0x0) (async) sendmsg$nl_route_sched(r7, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000680)=@delchain={0x34, 0x5f, 0x333, 0x0, 0x0, {0x0, 0x0, 0x0, r8, {}, {0xf, 0x2}, {0x1, 0xe}}, [@filter_kind_options=@f_basic={{0xa}, {0x4}}]}, 0x34}, 0x1, 0x0, 0x0, 0x8000}, 0x0) 608.071119ms ago: executing program 3 (id=8045): r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$IPT_SO_SET_REPLACE(r0, 0x4000000000000, 0x40, &(0x7f00000004c0)=@raw={'raw\x00', 0x4001, 0x3, 0x308, 0x0, 0x700001b, 0x148, 0xe0, 0x148, 0x270, 0x206, 0x240, 0x270, 0x240, 0x7fffffe, 0x0, {[{{@uncond, 0x1ea, 0x98, 0x90, 0x0, {0x390, 0x8f00}, [@inet=@rpfilter={{0x28}, {0x1}}]}, @common=@unspec=@LED={0x48, 'LED\x00', 0x0, {'syz1\x00', 0x0, 0x7f, {0xfffffffffffffff8}}}}, {{@ip={@multicast1, @rand_addr=0x64010102, 0xffffff00, 0xff, 'veth1_to_batadv\x00', 'sit0\x00', {0xff}, {0xff}, 0x5c, 0x3}, 0x0, 0x150, 0x190, 0x0, {}, [@inet=@rpfilter={{0x28}, {0x2}}, @common=@unspec=@conntrack1={{0xb8}, {{@ipv6=@empty, [0xffffffff, 0xff, 0xff000000, 0xff000000], @ipv6=@ipv4={'\x00', '\xff\xff', @broadcast}, [0xff, 0xffffff00, 0xffffff], @ipv6=@private2, [0xff000000, 0xffffff00, 0xffffffff, 0xff], @ipv4=@dev={0xac, 0x14, 0x14, 0x26}, [0xff000000, 0xffffff00, 0xffffff00, 0xffffff00], 0xfffffffc, 0xa5, 0x2c, 0x4e22, 0x4e24, 0x4e21, 0x4e24, 0x198, 0x80}, 0x0, 0x8c}}]}, @common=@unspec=@RATEEST={0x40, 'RATEEST\x00', 0x0, {'syz1\x00', 0x5, 0xff, {0x9184}}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x368) r1 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f0000000740)=ANY=[@ANYBLOB="0300000004000000040000000a"], 0x48) r2 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f0000000200)="d8000000180081054e81f782db4cb90402200800fe007c05e8fe55a10a0015000200142603600e1208001e007f370401a8000900200006000400027c035c0461c1d67f6f94007134cf6efb8000a007a290457f0189b316277ce06bbace8017cbec4c2e98a61e284ce5a7cef4090000001fb791643a5ee4ce1b14d6d930dfe1d9d322fe7c9f8775730d16a4683f5aeb4edbb57a5025ccca9e00360db798262f3d40fad95667e006dcdf63951f215ce3bb9ad809d5e1cace81ed0bffece0b42a9ecbee5de6ccd40dd6e4edef3d93452a92954b43370e970392", 0xd8}], 0x1}, 0x0) r3 = bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f00000009c0)=@bpf_tracing={0x1a, 0x2, &(0x7f0000000000)=@raw=[@map_idx_val={0x18, 0x9, 0x6, 0x0, 0x5, 0x0, 0x0, 0x0, 0x608d}], &(0x7f0000000040)='GPL\x00', 0x7, 0x85, &(0x7f0000000300)=""/133, 0x61800, 0x10, '\x00', 0x0, 0x36, r2, 0x8, &(0x7f00000003c0)={0xa, 0x1}, 0x8, 0x10, 0x0, 0x0, 0x24b78, 0xffffffffffffffff, 0x1, &(0x7f0000000400)=[r1], &(0x7f0000000440)=[{0x0, 0x1, 0xa, 0x6}], 0x10, 0xcd84}, 0x94) bpf$PROG_LOAD(0x5, &(0x7f0000000880)={0x3, 0x10, &(0x7f0000000080)=ANY=[@ANYBLOB="1808000004000000000000000000000418120000", @ANYRES32=r1, @ANYBLOB="0000000000000000b703000000000000850000000c000000b707000000000000180100002020752500000000002020207b1af8ff00000000bfa100000000000000000000f8ffffffb702000008000000b703000001000000850000000600000095000000000000053fa2c125f9494a653543e4b300"], &(0x7f0000000980)='GPL\x00', 0x3, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sched_cls, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, r3, 0x0, 0x0, 0x0, 0x0, 0x9}, 0x94) 473.080226ms ago: executing program 3 (id=8046): r0 = socket(0x26, 0x6, 0x7fff) unshare(0x6a040000) openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) unshare(0x24020400) r1 = socket(0x1d, 0x2, 0x6) unshare(0x24020400) r2 = socket$unix(0x1, 0x1, 0x0) r3 = socket$inet_tcp(0x2, 0x1, 0x0) sendmsg$TIPC_NL_KEY_SET(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000700)={&(0x7f0000000480)=ANY=[@ANYRES16=r3, @ANYBLOB="0100000000000000000017000000540006803c00040067636d28616573290000000000000000000000000000000000000000037647f2bd4ff2973b3385ff22549c9b0000000014000000e3de3d7b4cd07ec3ee777de774fc7987cca41989140003"], 0x68}, 0x1, 0x0, 0x0, 0x4}, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, 0x0) pwritev(r1, &(0x7f0000000880)=[{&(0x7f0000000140)="325d2d7a9bb036f1b426a4956e57159a632a5e4dcea8774e60b1c88653a7a317659f4f1f37568395da10c24936bbf73ded0c54a4f3", 0x35}, {&(0x7f0000000280)="f8e427ec00e95b0746af356b54486219b8beee9414c1e7d9f837a7b508c3cc04174d86e29b404ba50f8ee97b89f4bde1081832d7eb92042dbe067c0a7eaa7316cd3d1072d034bb18e251c81e3addc3d94eaab743fbe8571de0986e0569b9d106d2fe89625f3db7853708c77416df424425b53ce924fb22e318906f6558fbcb065739b700ea3832b95bb58a585d6e657e7f08763daf4793e56436068ca5d169d6bcc47cc7e57a2b63e504330293ab8f21c155402fd8b9fceeb5fe0108fb02509a7b421d27d26d0cbd631812dc140a9299f4166e74bf6b48cb", 0xd8}, {&(0x7f0000000540)="1a304cdecdac5553cfa2bbde5a6d5b2d6b5d954d5894bcba8dee61a6915980940ba5430f36966a2e3ef109ea6ecb90943ba4a4318401d1c7bf0c0329b3cb30942ed7c83e180b0e703f73fac5653720dcd249dee29aa552f008bfcc34fc98bcf31dfc", 0x62}, {&(0x7f0000000740)="6b5e03c0a7076fc3cfb8fa36529aa7ecc39434b17893c0db009d276397b77fbc102f1dbc9d2f21700109c680705cfbf810197efd707b1a739119685ab02b130a7d6a008fd31a2039682c992f8ba20b3fa067be610980e864f8f896640310cc440a5becd34986b174075c1f6d19323f09c96e7da1073829828f518dbe47deb907e83a1c30f4bd900c210028972de60a2bab212041987de063832340d4e62f68d7f9f25e8a9d45d83d323b92a9dc9ee8338605edf6a8b4fd9e847fe02c14b62bc6fa1b78ea77d5fde60456e546c546f0c8d013039bf74842e22989c70ecbb032f64b4374362ed5385c11", 0xe9}, {&(0x7f0000000840)="df0eb9f33eb0a4de9789942890956daa7bc02c424c6ed944b062e49a9ce8db2b747f0b85fa2da7397c9e445ccf235c", 0x2f}], 0x5, 0x3, 0x8001) sendto(0xffffffffffffffff, 0x0, 0x0, 0x800, 0x0, 0x0) syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10) r4 = socket$nl_generic(0x10, 0x3, 0x10) unshare(0x6020400) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000a00)={0xffffffffffffffff, 0xffffffffffffffff}) getsockopt$sock_buf(r5, 0x1, 0x4d, 0xffffffffffffffff, &(0x7f00000003c0)=0x16) socket$packet(0x11, 0x3, 0x300) setsockopt$packet_add_memb(r1, 0x107, 0x1, &(0x7f0000000200)={0x0, 0x1, 0xfff6}, 0x10) r6 = socket$inet(0x2, 0x3, 0x100) setsockopt$sock_int(r6, 0x1, 0x6, &(0x7f0000000500)=0x8, 0x4) connect$inet(r6, &(0x7f0000000080)={0x2, 0x0, @broadcast}, 0x10) r7 = socket$nl_xfrm(0x10, 0x3, 0x6) ioctl$sock_SIOCGIFCONF(r7, 0x8912, &(0x7f00000001c0)=@req={0x28, &(0x7f0000000180)={'wg2\x00', @ifru_ivalue=0x296}}) writev(r6, &(0x7f0000000000)=[{&(0x7f00000000c0)="aefd", 0xfdef}], 0x1) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000680)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000440)=ANY=[@ANYBLOB="380000001800010000000000000000000a000000000000000000000008000400", @ANYRES32, @ANYBLOB="06001500070000000c00168008000100", @ANYRES32=r4], 0x38}}, 0x10) setsockopt$inet6_int(r0, 0x29, 0x4d, &(0x7f0000000040)=0x7, 0x4) recvmmsg(r0, &(0x7f0000007380)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f0000000940)=""/14, 0xe}, 0x4}], 0x1, 0x40000022, 0x0) ioctl$SIOCGSTAMPNS(r0, 0x8907, 0x0) 442.721965ms ago: executing program 0 (id=8047): r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(r1, 0x89f0, &(0x7f0000000140)={'erspan0\x00', &(0x7f0000000100)={'sit0\x00', 0x0, 0x700, 0x8000, 0x7, 0xaa, {{0x6, 0x4, 0x1, 0x3, 0x18, 0x68, 0x0, 0x6, 0x2f, 0x0, @multicast1, @multicast1, {[@ra={0x94, 0x4, 0x1}]}}}}}) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(r1, 0x89f0, &(0x7f0000000380)={'syztnl1\x00', &(0x7f0000000280)={'sit0\x00', r2, 0x10, 0x10, 0x7fffffff, 0x1, {{0x2a, 0x4, 0x3, 0x2f, 0xa8, 0x68, 0x0, 0x9, 0x2f, 0x0, @rand_addr=0x64010100, @multicast2, {[@ssrr={0x89, 0x2b, 0x33, [@loopback, @multicast2, @local, @initdev={0xac, 0x1e, 0x0, 0x0}, @multicast2, @private=0xa010100, @multicast2, @initdev={0xac, 0x1e, 0x1, 0x0}, @loopback, @local]}, @generic={0x82, 0x2}, @generic={0x89, 0x11, "036e3d7823d95b3899059714fb0261"}, @ra={0x94, 0x4}, @ra={0x94, 0x4, 0x1}, @cipso={0x86, 0x28, 0x0, [{0x6, 0x11, "14a30a98eb2e391e6031c247f665cb"}, {0x2, 0x7, "607b3e888e"}, {0x2, 0xa, "6c1f236b56f3231e"}]}, @ssrr={0x89, 0x1f, 0x42, [@rand_addr=0x64010102, @empty, @private=0xa010101, @rand_addr=0x64010101, @private=0xa010102, @empty, @broadcast]}, @ra={0x94, 0x4, 0x1}, @noop, @noop]}}}}}) bind$inet(r1, &(0x7f0000000240)={0x2, 0x0, @local}, 0x6f) connect$inet(r1, &(0x7f0000000480)={0x2, 0x0, @multicast1}, 0x10) ioctl$F2FS_IOC_WRITE_CHECKPOINT(r1, 0xf507, 0x0) setsockopt$IP_VS_SO_SET_ZERO(r1, 0x0, 0x48f, &(0x7f00000001c0)={0x1d, @loopback, 0x4e23, 0x0, 'lblc\x00', 0x14, 0x5, 0x54}, 0x2c) sendmmsg(r1, &(0x7f0000007fc0), 0x800001d, 0x300) sendmsg$nl_route(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000040)=ANY=[@ANYBLOB="8100000010e2474400"/23, @ANYRES32=0x0, @ANYBLOB="158804000301040008001b0000000000"], 0x28}, 0x1, 0x0, 0x0, 0x40801}, 0x4000000) r3 = syz_init_net_socket$802154_raw(0x24, 0x3, 0x0) r4 = socket$inet6_mptcp(0xa, 0x1, 0x106) ioctl$XFS_IOC_START_COMMIT(r3, 0x80585882, &(0x7f0000000080)) connect$inet6(r4, &(0x7f0000000000)={0xa, 0x4001, 0x1, @dev={0xfe, 0x80, '\x00', 0x39}, 0x3e}, 0x1c) 59.914624ms ago: executing program 2 (id=8048): sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x0) (async) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x0) sendmsg$DEVLINK_CMD_SB_OCC_SNAPSHOT(0xffffffffffffffff, 0x0, 0x44010) socket$netlink(0x10, 0x3, 0x0) (async) socket$netlink(0x10, 0x3, 0x0) socket$xdp(0x2c, 0x3, 0x0) socket$inet_tcp(0x2, 0x1, 0x0) (async) socket$inet_tcp(0x2, 0x1, 0x0) r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_TX_RING(r1, 0x11b, 0x3, &(0x7f0000000140)=0x40, 0x4) (async) setsockopt$XDP_TX_RING(r1, 0x11b, 0x3, &(0x7f0000000140)=0x40, 0x4) r2 = socket$xdp(0x2c, 0x3, 0x0) syz_emit_ethernet(0x6a, &(0x7f0000000200)={@local, @random="302bd0ac46a2", @void, {@ipv4={0x800, @udp={{0x5, 0x4, 0x0, 0x0, 0x5c, 0x0, 0x0, 0x0, 0x33, 0x0, @private, @broadcast}, {0x0, 0x0, 0x48, 0x0, @wg=@cookie={0x3, 0x4, "1fa3883e21cd040100035c9b000031d14c91cf0d35507989", "6e447a58f2e6a88933307fb477ae5a40740446707740eb6dcb6c5545363eff42"}}}}}}, 0x0) setsockopt$XDP_UMEM_REG(r2, 0x11b, 0x4, &(0x7f0000000340)={&(0x7f00000000c0)=""/62, 0x220000, 0x800, 0x8, 0x3}, 0x20) socket$nl_route(0x10, 0x3, 0x0) r3 = socket(0xa, 0x3, 0x3a) setsockopt$MRT6_INIT(r3, 0x29, 0xc8, &(0x7f0000000340), 0x4) setsockopt$MRT6_ADD_MIF(r3, 0x29, 0xca, &(0x7f0000000040)={0x1, 0x1, 0x40}, 0xc) close(0x4) setsockopt$XDP_UMEM_COMPLETION_RING(r1, 0x11b, 0x6, &(0x7f0000000080)=0x1, 0x4) (async) setsockopt$XDP_UMEM_COMPLETION_RING(r1, 0x11b, 0x6, &(0x7f0000000080)=0x1, 0x4) setsockopt$XDP_RX_RING(r2, 0x11b, 0x2, &(0x7f0000001980)=0x100, 0x4) (async) setsockopt$XDP_RX_RING(r2, 0x11b, 0x2, &(0x7f0000001980)=0x100, 0x4) r4 = bpf$PROG_LOAD(0x5, &(0x7f0000000400)={0x11, 0xc, &(0x7f00000004c0)=@framed={{}, [@printk={@d, {}, {}, {}, {}, {0x7, 0x0, 0xb, 0x3, 0x0, 0x0, 0x8f}}, @call={0x85, 0x0, 0x0, 0x5b}]}, &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x2d, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$PROG_BIND_MAP(0xa, &(0x7f0000000080)={r4}, 0xc) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r0, 0x8933, &(0x7f0000000580)={'batadv_slave_1\x00', 0x0}) setsockopt$XDP_UMEM_FILL_RING(r2, 0x11b, 0x5, &(0x7f0000000300)=0x2, 0x4) (async) setsockopt$XDP_UMEM_FILL_RING(r2, 0x11b, 0x5, &(0x7f0000000300)=0x2, 0x4) bind$xdp(r2, &(0x7f0000000100)={0x2c, 0x0, r5}, 0x10) bind$xdp(r1, &(0x7f0000000240)={0x2c, 0x1, r5, 0x0, r2}, 0x10) socket$nl_route(0x10, 0x3, 0x0) (async) r6 = socket$nl_route(0x10, 0x3, 0x0) socket$packet(0x11, 0x2, 0x300) (async) r7 = socket$packet(0x11, 0x2, 0x300) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r7, 0x8933, &(0x7f00000001c0)={'batadv_slave_1\x00', 0x0}) sendmsg$nl_route_sched(r6, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000080)=@getchain={0x24, 0x11, 0x43d, 0x0, 0x25dfdbff, {0x0, 0x0, 0x0, r8, {0x3, 0xfff1}, {0x4, 0xa}, {0x0, 0xffe0}}}, 0x24}, 0x1, 0x0, 0x0, 0x4048080}, 0x0) 59.341598ms ago: executing program 4 (id=8049): r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket$packet(0x11, 0x2, 0x300) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000080)={'ip6tnl0\x00', 0x0}) (async) r3 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r3, &(0x7f0000000040)={0x2, 0x4e20, @empty}, 0x10) (async) syz_emit_ethernet(0x3a, &(0x7f0000001c00)={@local, @empty, @void, {@ipv4={0x800, @udp={{0x5, 0x4, 0x0, 0x0, 0x2c, 0x2, 0x0, 0x0, 0x11, 0x0, @empty, @empty}, {0x0, 0x4e20, 0x18, 0x0, @wg=@data={0x4, 0x7407, 0xfffffffffffffffd}}}}}}, 0x0) (async) recvmmsg(r3, &(0x7f0000004400)=[{{0x0, 0x0, 0x0}, 0x1000}], 0x1, 0x2, 0x0) (async) readv(r3, &(0x7f0000000080)=[{&(0x7f0000000100)=""/59, 0x3b}], 0x1) (async) unshare(0x20000400) (async) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) ppoll(&(0x7f0000000180)=[{r4, 0x100}], 0x1, 0x0, 0x0, 0x0) (async) sendmsg$nl_route_sched(r0, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000740)=@newqdisc={0x50, 0x24, 0xf0b, 0x70bd2d, 0x0, {0x0, 0x0, 0x0, r2, {0x0, 0x10}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_cake={{0x9}, {0x20, 0x2, [@TCA_CAKE_NAT={0x8, 0xb, 0x1}, @TCA_CAKE_DIFFSERV_MODE={0x8, 0x3, 0x3}, @TCA_CAKE_BASE_RATE64={0xc, 0x2, 0x40000001}]}}]}, 0x50}}, 0x0) 0s ago: executing program 1 (id=8050): r0 = syz_init_net_socket$802154_raw(0x24, 0x3, 0x0) sendmmsg$sock(r0, &(0x7f00000006c0)=[{{&(0x7f0000000000)=@in={0x2, 0x4e24, @rand_addr=0x64010101}, 0x80, &(0x7f0000000440)=[{&(0x7f0000000080)="1622d8c97a27e39ac5ed3b1b2466010dc9d8fa0c2d2d2fba94860c2d7e07efbeb8160f69ad3c33a9b1a522456c4b09cc91d5d9e59853144fb5da16340ff6a9d4910cc5ed8cc2aa6b2f88f34ecd55a45d87cf3948d60191e2a14592286e3ec8d2bde8de629d05967b2fae87fc3c102255c7c5fc49fb27d1aea0ef7b0db09a60c03115a383c058903eeae3b15e0c668133ad843cc9e41f309c4de2af90ead7b70a0a377ca697700b2880585921ef5d077e7f2cca7bb0e6f75e662046691db32142dd51", 0xc2}, {&(0x7f0000000180)="220d8d8e2c9c7598cc427abda342d19a17fdc1e98c8272854f2d91088254321bcca60c25e22ec2bb22c9e7fcc58916fb02c33767fa06d736c2ae66c981a9942374ce8488153b", 0x46}, {&(0x7f0000000200)="411c0b261c98b16ed7e51afd58b0b430f5f549ccd773a63eee1dbe1d034f0e4bc5f38255a8eb218551aaf6f58df3ad3e40b6962a959ea2c0f4df0ddcd04d6f850c", 0x41}, {&(0x7f0000000280)="b14387361015aee31c03179b4f7c61015efa9bd5bf86f4427e6c2f290d2760dd91e22b992a2a4ddd0209681b8435bee3ab9aeff1ed1c1b2f5b4f0aee207e5675b3ee0947475f103f751ad59e50ea2a30fff6f6557ecef6a30041d0018e242c51a09e9f7100d46cec01f26f93a0f210bb407c6315aeb30a5017929f61d847", 0x7e}, {&(0x7f0000000300)="ddca530b587987d6e87f870c1811258fcc5055fd07a562089c8017d4a8a61d8e1e62ec38e73b3e05d0621a7fa3157649ee593430f046110fdbc569147440211338d519e5c6d178a46d51c4ee", 0x4c}, {&(0x7f0000000380)="10173f75e6dac7bd761d39e91e6e4d6fb1abd97316aeef318ea642621f19634f4752db134f7992b83616f6c44a5b7e610d891753b98782d13b4ac17d4723d467472c6a6bd1d602e9ff406919a819545b0e8c28cb8f530c016ffd731fe7c63d70473e1e5e43dcd070236f5572e8150a97c844ed0441a3f632636a45b3c3b28a1b633fb1b4b277e7048e436f79fbd7ba6479d6f787371f1488cc6f8098d44b0c0bb43ea435ed3082f4e83e0392e968b70d053ba335c34ea285", 0xb8}], 0x6, &(0x7f00000004c0)=[@timestamping={{0x14, 0x1, 0x25, 0x1d9}}, @txtime={{0x18}}, @timestamping={{0x14, 0x1, 0x25, 0xda00}}], 0x48}}, {{0x0, 0x0, &(0x7f0000000680)=[{&(0x7f0000000540)="54f3f2743722dfdf23c3258e6e15b940945ff42e6a99fed0e0f1fad5509297108c7b2c8ee7acf1c58baf5a5be3a674f26dee3d39933eac27758aaa2e3c37d067492ffc6c677b26f1a1a1cd7880803c901df449c90b491cdfed6542549e4ab674988f6cd9a42a13dd27f530fee5d8419cbeedb08b039a5349f1fff89b4250ecd45b9ab3715f0ff2e52bceb5ca16e84d710f517d493912691be65b68c4700939d15e64d0ad95287f40a0356b04e2e44f7fc77fd3f0526552303c5fea76c1c9615b0307a6debff55dd9185f15abb60e2c6192f4fc988ec035289eeddfd8ce603a0d84fd515a87c7a74b62", 0xe9}, {&(0x7f0000000640)="9051df7dfed568b74d7d787f0f8081547ebaa235b245bb809febe5ea9c44e5c9694fe8eeea96c3f4025c4f3080", 0x2d}], 0x2}}], 0x2, 0x20004881) r1 = bpf$OBJ_GET_MAP(0x7, &(0x7f0000000780)=@generic={&(0x7f0000000740)='./file0\x00', 0x0, 0x8}, 0x18) bpf$MAP_UPDATE_CONST_STR(0x2, &(0x7f0000000840)={{r1, 0xffffffffffffffff}, &(0x7f00000007c0), &(0x7f0000000800)='%+9llu \x00'}, 0x20) sendfile(r2, r1, &(0x7f0000000880)=0x6, 0x4) ioctl$sock_FIOGETOWN(r0, 0x8903, &(0x7f00000008c0)) ioctl$sock_kcm_SIOCKCMCLONE(0xffffffffffffffff, 0x89e2, &(0x7f0000000900)={r0}) ioctl$sock_bt_hidp_HIDPGETCONNLIST(r3, 0x800448d2, &(0x7f0000000a00)={0x1, &(0x7f0000000940)=[{}]}) close(r3) r4 = socket$nl_route(0x10, 0x3, 0x0) r5 = syz_genetlink_get_family_id$devlink(&(0x7f0000000a80), r3) sendmsg$DEVLINK_CMD_GET(r3, &(0x7f0000000c40)={&(0x7f0000000a40)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f0000000c00)={&(0x7f0000000ac0)={0x12c, r5, 0x10, 0x70bd2a, 0x25dfdbfc, {}, [@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, @nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, @nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, @nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, @pci={{0x8}, {0x11}}, @nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, @pci={{0x8}, {0x11}}, @nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, @nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}]}, 0x12c}, 0x1, 0x0, 0x0, 0x4800}, 0x4000804) r6 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000cc0), r3) sendmsg$TIPC_NL_MON_SET(r3, &(0x7f0000000d80)={&(0x7f0000000c80)={0x10, 0x0, 0x0, 0x10}, 0xc, &(0x7f0000000d40)={&(0x7f0000000d00)={0x14, r6, 0x0, 0x70bd26, 0x25dfdbfc}, 0x14}, 0x1, 0x0, 0x0, 0x4004000}, 0x4) r7 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000e00), r3) ioctl$sock_SIOCGIFINDEX_80211(r3, 0x8933, &(0x7f0000000e40)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_JOIN_IBSS(r1, &(0x7f0000000f00)={&(0x7f0000000dc0)={0x10, 0x0, 0x0, 0x1000}, 0xc, &(0x7f0000000ec0)={&(0x7f0000000e80)={0x20, r7, 0x400, 0x70bd2d, 0x25dfdbfc, {{}, {@val={0x8, 0x3, r8}, @void}}, [@NL80211_ATTR_CONTROL_PORT={0x4}]}, 0x20}, 0x1, 0x0, 0x0, 0x24048844}, 0x63) r9 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000f80), r3) sendmsg$IPVS_CMD_SET_INFO(r3, &(0x7f00000010c0)={&(0x7f0000000f40)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f0000001080)={&(0x7f0000000fc0)={0x88, r9, 0x100, 0x70bd27, 0x25dfdbfb, {}, [@IPVS_CMD_ATTR_DAEMON={0x20, 0x3, 0x0, 0x1, [@IPVS_DAEMON_ATTR_SYNC_MAXLEN={0x6, 0x4, 0x7f}, @IPVS_DAEMON_ATTR_MCAST_IFN={0x14, 0x2, 'bridge_slave_1\x00'}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5, 0x1}, @IPVS_CMD_ATTR_DAEMON={0xc, 0x3, 0x0, 0x1, [@IPVS_DAEMON_ATTR_MCAST_TTL={0x5, 0x8, 0xff}]}, @IPVS_CMD_ATTR_DEST={0x2c, 0x2, 0x0, 0x1, [@IPVS_DEST_ATTR_ACTIVE_CONNS={0x8, 0x7, 0x3}, @IPVS_DEST_ATTR_WEIGHT={0x8, 0x4, 0x6}, @IPVS_DEST_ATTR_U_THRESH={0x8, 0x5, 0x2}, @IPVS_DEST_ATTR_TUN_TYPE={0x5, 0xd, 0x1}, @IPVS_DEST_ATTR_FWD_METHOD={0x8, 0x3, 0x1}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5, 0x3}, @IPVS_CMD_ATTR_DEST={0xc, 0x2, 0x0, 0x1, [@IPVS_DEST_ATTR_PERSIST_CONNS={0x8, 0x9, 0x3}]}]}, 0x88}, 0x1, 0x0, 0x0, 0x4000000}, 0x4c080) setsockopt$inet_sctp6_SCTP_SOCKOPT_BINDX_ADD(r3, 0x84, 0x64, &(0x7f0000001100)=[@in={0x2, 0x4e24, @broadcast}, @in6={0xa, 0x4e23, 0xffff, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01', 0xc8}], 0x2c) r10 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000001480)={0x11, 0x21, &(0x7f0000001140)=@framed={{0x18, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x1}, [@map_val={0x18, 0x0, 0x2, 0x0, r1, 0x0, 0x0, 0x0, 0x400}, @btf_id={0x18, 0x0, 0x3, 0x0, 0x3}, @ringbuf_output={{0x18, 0x1, 0x1, 0x0, r1}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0x6fb3}}, @printk={@ld, {}, {}, {}, {}, {0x7, 0x0, 0xb, 0x3, 0x0, 0x0, 0xfffffffc}}, @map_idx={0x18, 0x0, 0x5, 0x0, 0x7}, @tail_call={{0x18, 0x2, 0x1, 0x0, r1}}, @initr0={0x18, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x1}]}, &(0x7f0000001280)='GPL\x00', 0xc, 0xb5, &(0x7f00000012c0)=""/181, 0x41000, 0x20, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, &(0x7f0000001380)={0x9, 0x1}, 0x8, 0x10, 0x0, 0x0, 0x0, 0x0, 0x8, &(0x7f00000013c0)=[r1], &(0x7f0000001400)=[{0x5, 0x1, 0xb, 0x6}, {0x0, 0x4, 0x4, 0x2}, {0x3, 0x4, 0x0, 0x4}, {0x1, 0x2, 0xa, 0xa}, {0x5, 0x5, 0x3, 0x5}, {0x5, 0x2, 0xe, 0xc}, {0x5, 0x3, 0x2, 0x1}, {0x7, 0x3, 0x5, 0x6}], 0x10, 0x5}, 0x94) setsockopt$sock_attach_bpf(r0, 0x1, 0x32, &(0x7f0000001540)=r10, 0x4) r11 = socket(0x5, 0x800, 0x0) sendmsg$DEVLINK_CMD_PORT_SET(r4, &(0x7f00000016c0)={&(0x7f0000001580)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f0000001680)={&(0x7f00000015c0)={0x9c, r5, 0x100, 0x70bd2a, 0x25dfdbff, {}, [{{@pci={{0x8}, {0x11}}, {0x8, 0x3, 0x1}}, {0x6, 0x4, 0x3}}, {{@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, {0x8, 0x3, 0x1}}, {0x6, 0x4, 0x3}}, {{@pci={{0x8}, {0x11}}, {0x8, 0x3, 0x1}}, {0x6, 0x4, 0x3}}]}, 0x9c}, 0x1, 0x0, 0x0, 0x804}, 0x800) ioctl$F2FS_IOC_SEC_TRIM_FILE(r11, 0x4018f514, &(0x7f0000001700)={0x8, 0x1, 0x1}) ioctl$F2FS_IOC_DECOMPRESS_FILE(0xffffffffffffffff, 0xf517, 0x0) r12 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r13 = syz_genetlink_get_family_id$nfc(&(0x7f0000001780), 0xffffffffffffffff) sendmsg$NFC_CMD_DEP_LINK_DOWN(r12, &(0x7f0000001840)={&(0x7f0000001740)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f0000001800)={&(0x7f00000017c0)={0x1c, r13, 0x308, 0x70bd25, 0x25dfdbfc, {}, [@NFC_ATTR_TARGET_INDEX={0x8, 0x4, 0xffffffffffffffff}]}, 0x1c}, 0x1, 0x0, 0x0, 0x40000}, 0x4008050) ioctl$XFS_IOC_PATH_TO_HANDLE(r2, 0xc0385869, &(0x7f0000001980)={r11, &(0x7f0000001880)='#\x00', 0x40, &(0x7f00000018c0)={@_ha_fsid={[0x29, 0x8]}, {0x7, 0x401, 0x10, 0x3ff}}, 0x5, &(0x7f0000001900)={@_ha_fsid}, &(0x7f0000001940)=0x8001}) kernel console output (not intermixed with test programs): ink_rcv+0x10/0x10 [ 915.536942][T32674] ? ref_tracker_free+0x693/0x840 [ 915.536988][T32674] ? __netlink_deliver_tap+0x807/0x850 [ 915.537016][T32674] ? netlink_deliver_tap+0x2e/0x1b0 [ 915.537034][T32674] ? netlink_deliver_tap+0x2e/0x1b0 [ 915.537059][T32674] netlink_unicast+0x75c/0x8e0 [ 915.537089][T32674] netlink_sendmsg+0x813/0xb40 [ 915.537119][T32674] ? __pfx_netlink_sendmsg+0x10/0x10 [ 915.537144][T32674] ? aa_sock_msg_perm+0xf1/0x1b0 [ 915.537171][T32674] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 915.537199][T32674] ____sys_sendmsg+0x972/0x9f0 [ 915.537219][T32674] ? __might_fault+0xaf/0x130 [ 915.537249][T32674] ? __pfx_____sys_sendmsg+0x10/0x10 [ 915.537279][T32674] ? import_iovec+0x73/0xa0 [ 915.537304][T32674] ___sys_sendmsg+0x2a5/0x360 [ 915.537324][T32674] ? __lock_acquire+0x6b5/0x2cf0 [ 915.537348][T32674] ? __pfx____sys_sendmsg+0x10/0x10 [ 915.537404][T32674] ? __fget_files+0x2a/0x420 [ 915.537425][T32674] ? __fget_files+0x3a0/0x420 [ 915.537457][T32674] __x64_sys_sendmsg+0x1bd/0x2a0 [ 915.537480][T32674] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 915.537509][T32674] ? __pfx_ksys_write+0x10/0x10 [ 915.537543][T32674] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 915.537564][T32674] do_syscall_64+0x174/0x580 [ 915.537580][T32674] ? trace_irq_disable+0x3b/0x140 [ 915.537603][T32674] ? clear_bhb_loop+0x40/0x90 [ 915.537623][T32674] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 915.537639][T32674] RIP: 0033:0x7f69e1f9ce59 [ 915.537660][T32674] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 915.537682][T32674] RSP: 002b:00007f69e2ee6028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 915.537700][T32674] RAX: ffffffffffffffda RBX: 00007f69e2215fa0 RCX: 00007f69e1f9ce59 [ 915.537712][T32674] RDX: 0000000000000000 RSI: 00002000000000c0 RDI: 0000000000000003 [ 915.537723][T32674] RBP: 00007f69e2ee6090 R08: 0000000000000000 R09: 0000000000000000 [ 915.537735][T32674] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 915.537746][T32674] R13: 00007f69e2216038 R14: 00007f69e2215fa0 R15: 00007ffc68311628 [ 915.537772][T32674] [ 916.836123][ C1] ip6_tunnel: ip6gretap1 xmit: Local address not yet configured! [ 917.214403][T32726] syzkaller0: entered promiscuous mode [ 917.230471][T32726] syzkaller0: entered allmulticast mode [ 917.429029][T32744] netlink: 'syz.2.6389': attribute type 1 has an invalid length. [ 917.470276][T32336] netdevsim netdevsim4 netdevsim0: renamed from eth0 [ 917.500814][T32336] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 917.541313][T32753] netlink: 44 bytes leftover after parsing attributes in process `syz.1.6390'. [ 917.663020][T32755] netlink: 16 bytes leftover after parsing attributes in process `syz.2.6389'. [ 917.684140][T32744] 8021q: adding VLAN 0 to HW filter on device bond3 [ 917.761707][T32750] bond3: (slave veth3): Enslaving as an active interface with a down link [ 917.793045][T32336] netdevsim netdevsim4 netdevsim1: renamed from eth1 [ 917.793524][ T300] atomic_op ffff88807ef9b998 conn xmit_atomic 0000000000000000 [ 917.834593][T32336] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 917.850951][T32336] netdevsim netdevsim4 netdevsim2: renamed from eth2 [ 917.873828][T32336] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 917.926459][T32744] 8021q: adding VLAN 0 to HW filter on device batadv1 [ 917.968346][T32744] bond3: (slave batadv1): making interface the new active one [ 918.000297][T32744] batadv1: entered promiscuous mode [ 918.028979][T32744] bond3: (slave batadv1): Enslaving as an active interface with an up link [ 918.065412][T32336] netdevsim netdevsim4 netdevsim3: renamed from eth3 [ 918.113089][T32336] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 918.348944][ T327] Bluetooth: MGMT ver 1.23 [ 918.545267][T32336] 8021q: adding VLAN 0 to HW filter on device bond0 [ 918.659427][T32336] 8021q: adding VLAN 0 to HW filter on device team0 [ 918.720225][T25061] bridge0: port 1(bridge_slave_0) entered blocking state [ 918.727489][T25061] bridge0: port 1(bridge_slave_0) entered forwarding state [ 918.785143][T25061] bridge0: port 2(bridge_slave_1) entered blocking state [ 918.792368][T25061] bridge0: port 2(bridge_slave_1) entered forwarding state [ 918.860910][ T345] netlink: 88 bytes leftover after parsing attributes in process `syz.1.6401'. [ 918.943325][ T351] netlink: 80 bytes leftover after parsing attributes in process `syz.0.6403'. [ 918.961602][ T351] netlink: 4 bytes leftover after parsing attributes in process `syz.0.6403'. [ 918.990770][ T352] netlink: 32 bytes leftover after parsing attributes in process `syz.2.6402'. [ 919.113411][ T357] netlink: 72 bytes leftover after parsing attributes in process `syz.0.6404'. [ 919.137273][ T357] sock: sock_timestamping_bind_phc: sock not bind to device [ 919.299341][ T364] macsec1: entered promiscuous mode [ 919.909011][ T392] netlink: 8 bytes leftover after parsing attributes in process `syz.3.6411'. [ 920.201481][ T406] ip6_tunnel: non-ECT from fc00:0000:0000:0000:0000:0000:0000:0000 with DS=0x5 [ 920.386267][ T415] netlink: 'syz.0.6414': attribute type 10 has an invalid length. [ 920.409162][ T420] netlink: 'syz.1.6418': attribute type 2 has an invalid length. [ 920.422767][T32336] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 920.426967][ T415] netlink: 40 bytes leftover after parsing attributes in process `syz.0.6414'. [ 920.443091][ T5639] Bluetooth: hci2: command 0x0401 tx timeout [ 920.448932][ T4950] Bluetooth: hci2: Opcode 0x0401 failed: -110 [ 920.534294][ T422] syzkaller0: entered promiscuous mode [ 920.557223][ T422] syzkaller0: entered allmulticast mode [ 920.670726][ T431] netlink: 'syz.1.6419': attribute type 4 has an invalid length. [ 920.698186][ T431] netlink: 'syz.1.6419': attribute type 8 has an invalid length. [ 920.721959][ T431] netlink: 'syz.1.6419': attribute type 1 has an invalid length. [ 920.731036][ T431] netlink: 164 bytes leftover after parsing attributes in process `syz.1.6419'. [ 920.769682][ T431] NCSI netlink: No device for ifindex 0 [ 921.132760][T32336] veth0_vlan: entered promiscuous mode [ 921.170132][T32336] veth1_vlan: entered promiscuous mode [ 921.173122][ T454] nbd: couldn't find a device at index 0 [ 921.220442][ T458] netlink: 36 bytes leftover after parsing attributes in process `syz.3.6426'. [ 921.296675][ T462] netlink: 52 bytes leftover after parsing attributes in process `syz.0.6427'. [ 921.305474][ T458] netlink: 20 bytes leftover after parsing attributes in process `syz.3.6426'. [ 921.349957][ T464] netlink: 52 bytes leftover after parsing attributes in process `syz.0.6427'. [ 921.362068][T32336] veth0_macvtap: entered promiscuous mode [ 921.384014][T32336] veth1_macvtap: entered promiscuous mode [ 921.408191][T32336] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 921.420707][T32336] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 921.488059][T32740] netdevsim netdevsim4 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 921.498351][ T468] netlink: 20 bytes leftover after parsing attributes in process `syz.3.6426'. [ 921.531795][T32740] netdevsim netdevsim4 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 921.547892][ T468] nbd: device at index 64 is going down [ 921.594223][T32740] netdevsim netdevsim4 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 921.628567][T32740] netdevsim netdevsim4 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 921.865830][T31729] udevd[31729]: inotify_add_watch(7, /dev/nbd64, 10) failed: No such file or directory [ 922.031561][ T493] netlink: 'syz.1.6431': attribute type 62 has an invalid length. [ 922.140082][T10811] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 922.181146][T10811] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 922.245281][T10811] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 922.273079][T10811] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 922.431945][ T511] xt_addrtype: ipv6 PROHIBIT (THROW, NAT ..) matching not supported [ 922.665249][ T527] netlink: 8 bytes leftover after parsing attributes in process `syz.1.6437'. [ 922.776042][ T533] netlink: 8 bytes leftover after parsing attributes in process `syz.1.6437'. [ 922.790394][ T533] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 923.691153][ T566] netdevsim netdevsim4 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 924.083916][ T566] netdevsim netdevsim4 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 924.314445][ T566] netdevsim netdevsim4 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 924.484197][ T619] openvswitch: netlink: Flow actions attr not present in new flow. [ 924.535654][ T566] netdevsim netdevsim4 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 924.635858][ T619] bond0: Unable to set peer notification delay as MII monitoring is disabled [ 925.009019][ T3284] netdevsim netdevsim4 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 925.113931][T25056] netdevsim netdevsim4 eth1: set [1, 0] type 2 family 0 port 6081 - 0 [ 925.129117][ T647] netlink: 'syz.2.6459': attribute type 10 has an invalid length. [ 925.181492][T32739] netdevsim netdevsim4 eth2: set [1, 0] type 2 family 0 port 6081 - 0 [ 925.198692][ T647] __nla_validate_parse: 8 callbacks suppressed [ 925.198712][ T647] netlink: 8 bytes leftover after parsing attributes in process `syz.2.6459'. [ 925.235571][ T647] netlink: 40 bytes leftover after parsing attributes in process `syz.2.6459'. [ 925.236732][ T649] netlink: 8 bytes leftover after parsing attributes in process `syz.3.6460'. [ 925.282361][T25056] netdevsim netdevsim4 eth3: set [1, 0] type 2 family 0 port 6081 - 0 [ 925.362972][ T653] FAULT_INJECTION: forcing a failure. [ 925.362972][ T653] name failslab, interval 1, probability 0, space 0, times 0 [ 925.417338][ T653] CPU: 1 UID: 0 PID: 653 Comm: syz.2.6461 Not tainted syzkaller #0 PREEMPT(full) [ 925.417363][ T653] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 925.417373][ T653] Call Trace: [ 925.417381][ T653] [ 925.417389][ T653] dump_stack_lvl+0xe8/0x150 [ 925.417415][ T653] should_fail_ex+0x412/0x560 [ 925.417439][ T653] should_failslab+0xa8/0x100 [ 925.417460][ T653] __kvmalloc_node_noprof+0x178/0x8a0 [ 925.417483][ T653] ? nla_strdup+0xb8/0x140 [ 925.417503][ T653] ? nf_tables_newchain+0x1c7a/0x2890 [ 925.417537][ T653] nf_tables_newchain+0x1c7a/0x2890 [ 925.417575][ T653] ? __pfx_nf_tables_newchain+0x10/0x10 [ 925.417636][ T653] ? nfnl_pernet+0x23/0x240 [ 925.417654][ T653] ? nfnl_pernet+0x23/0x240 [ 925.417680][ T653] ? __nla_parse+0x40/0x60 [ 925.417703][ T653] nfnetlink_rcv+0x123e/0x27b0 [ 925.417751][ T653] ? __pfx_nfnetlink_rcv+0x10/0x10 [ 925.417783][ T653] ? ref_tracker_free+0x693/0x840 [ 925.417826][ T653] ? __netlink_deliver_tap+0x807/0x850 [ 925.417853][ T653] ? netlink_deliver_tap+0x2e/0x1b0 [ 925.417870][ T653] ? netlink_deliver_tap+0x2e/0x1b0 [ 925.417892][ T653] netlink_unicast+0x75c/0x8e0 [ 925.417921][ T653] netlink_sendmsg+0x813/0xb40 [ 925.417953][ T653] ? __pfx_netlink_sendmsg+0x10/0x10 [ 925.417976][ T653] ? aa_sock_msg_perm+0xf1/0x1b0 [ 925.418004][ T653] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 925.418031][ T653] ____sys_sendmsg+0x972/0x9f0 [ 925.418052][ T653] ? __might_fault+0xaf/0x130 [ 925.418081][ T653] ? __pfx_____sys_sendmsg+0x10/0x10 [ 925.418111][ T653] ? import_iovec+0x73/0xa0 [ 925.418137][ T653] ___sys_sendmsg+0x2a5/0x360 [ 925.418156][ T653] ? __lock_acquire+0x6b5/0x2cf0 [ 925.418180][ T653] ? __pfx____sys_sendmsg+0x10/0x10 [ 925.418237][ T653] ? __fget_files+0x2a/0x420 [ 925.418258][ T653] ? __fget_files+0x3a0/0x420 [ 925.418290][ T653] __x64_sys_sendmsg+0x1bd/0x2a0 [ 925.418313][ T653] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 925.418332][ T653] ? sched_clock_cpu+0x74/0x440 [ 925.418360][ T653] ? rcu_is_watching+0x15/0xb0 [ 925.418393][ T653] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 925.418413][ T653] do_syscall_64+0x174/0x580 [ 925.418434][ T653] ? clear_bhb_loop+0x40/0x90 [ 925.418456][ T653] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 925.418475][ T653] RIP: 0033:0x7f89c359ce59 [ 925.418491][ T653] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 925.418507][ T653] RSP: 002b:00007f89c445e028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 925.418526][ T653] RAX: ffffffffffffffda RBX: 00007f89c3815fa0 RCX: 00007f89c359ce59 [ 925.418539][ T653] RDX: 0000000000000000 RSI: 00002000000000c0 RDI: 0000000000000003 [ 925.418551][ T653] RBP: 00007f89c445e090 R08: 0000000000000000 R09: 0000000000000000 [ 925.418562][ T653] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 925.418573][ T653] R13: 00007f89c3816038 R14: 00007f89c3815fa0 R15: 00007fffe2fd3018 [ 925.418605][ T653] [ 925.921878][ T681] netlink: 8 bytes leftover after parsing attributes in process `syz.0.6464'. [ 926.573115][ T722] netlink: 16 bytes leftover after parsing attributes in process `syz.0.6472'. [ 926.767406][ T730] FAULT_INJECTION: forcing a failure. [ 926.767406][ T730] name failslab, interval 1, probability 0, space 0, times 0 [ 926.781709][ T728] ip6gre2: entered promiscuous mode [ 926.787179][ T726] netlink: 'syz.1.6473': attribute type 29 has an invalid length. [ 926.787203][ T726] netlink: 8 bytes leftover after parsing attributes in process `syz.1.6473'. [ 926.804407][ T730] CPU: 1 UID: 0 PID: 730 Comm: syz.0.6475 Not tainted syzkaller #0 PREEMPT(full) [ 926.804433][ T730] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 926.804443][ T730] Call Trace: [ 926.804451][ T730] [ 926.804459][ T730] dump_stack_lvl+0xe8/0x150 [ 926.804484][ T730] should_fail_ex+0x412/0x560 [ 926.804509][ T730] should_failslab+0xa8/0x100 [ 926.804528][ T730] __kvmalloc_node_noprof+0x178/0x8a0 [ 926.804553][ T730] ? nla_strdup+0xb8/0x140 [ 926.804570][ T730] ? nf_tables_newchain+0x1c7a/0x2890 [ 926.804600][ T730] nf_tables_newchain+0x1c7a/0x2890 [ 926.804636][ T730] ? __pfx_nf_tables_newchain+0x10/0x10 [ 926.804692][ T730] ? nfnl_pernet+0x23/0x240 [ 926.804711][ T730] ? nfnl_pernet+0x23/0x240 [ 926.804739][ T730] ? __nla_parse+0x40/0x60 [ 926.804771][ T730] nfnetlink_rcv+0x123e/0x27b0 [ 926.804826][ T730] ? __pfx_nfnetlink_rcv+0x10/0x10 [ 926.804862][ T730] ? ref_tracker_free+0x693/0x840 [ 926.804909][ T730] ? __netlink_deliver_tap+0x807/0x850 [ 926.804938][ T730] ? netlink_deliver_tap+0x2e/0x1b0 [ 926.804956][ T730] ? netlink_deliver_tap+0x2e/0x1b0 [ 926.804980][ T730] netlink_unicast+0x75c/0x8e0 [ 926.805009][ T730] netlink_sendmsg+0x813/0xb40 [ 926.805038][ T730] ? __pfx_netlink_sendmsg+0x10/0x10 [ 926.805061][ T730] ? aa_sock_msg_perm+0xf1/0x1b0 [ 926.805088][ T730] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 926.805114][ T730] ____sys_sendmsg+0x972/0x9f0 [ 926.805134][ T730] ? __might_fault+0xaf/0x130 [ 926.805165][ T730] ? __pfx_____sys_sendmsg+0x10/0x10 [ 926.805194][ T730] ? import_iovec+0x73/0xa0 [ 926.805218][ T730] ___sys_sendmsg+0x2a5/0x360 [ 926.805236][ T730] ? __lock_acquire+0x6b5/0x2cf0 [ 926.805260][ T730] ? __pfx____sys_sendmsg+0x10/0x10 [ 926.805314][ T730] ? __fget_files+0x2a/0x420 [ 926.805334][ T730] ? __fget_files+0x3a0/0x420 [ 926.805364][ T730] __x64_sys_sendmsg+0x1bd/0x2a0 [ 926.805387][ T730] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 926.805416][ T730] ? __pfx_ksys_write+0x10/0x10 [ 926.805449][ T730] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 926.805468][ T730] do_syscall_64+0x174/0x580 [ 926.805486][ T730] ? trace_irq_disable+0x3b/0x140 [ 926.805509][ T730] ? clear_bhb_loop+0x40/0x90 [ 926.805531][ T730] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 926.805548][ T730] RIP: 0033:0x7f118259ce59 [ 926.805565][ T730] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 926.805579][ T730] RSP: 002b:00007f11834c5028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 926.805597][ T730] RAX: ffffffffffffffda RBX: 00007f1182815fa0 RCX: 00007f118259ce59 [ 926.805610][ T730] RDX: 0000000000000000 RSI: 00002000000000c0 RDI: 0000000000000003 [ 926.805621][ T730] RBP: 00007f11834c5090 R08: 0000000000000000 R09: 0000000000000000 [ 926.805631][ T730] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 926.805642][ T730] R13: 00007f1182816038 R14: 00007f1182815fa0 R15: 00007ffc4c96dbf8 [ 926.805671][ T730] [ 927.143417][ T728] ip6gre2: entered allmulticast mode [ 927.240551][ T736] hsr0: entered promiscuous mode [ 927.301677][ T752] netlink: 8 bytes leftover after parsing attributes in process `syz.0.6477'. [ 927.399998][ T758] netlink: 'syz.2.6478': attribute type 361 has an invalid length. [ 927.460195][ T755] IPVS: set_ctl: invalid protocol: 94 255.255.255.255:20002 [ 927.503165][ T765] netlink: 179640 bytes leftover after parsing attributes in process `syz.1.6481'. [ 927.526717][ T762] netlink: 179640 bytes leftover after parsing attributes in process `syz.1.6481'. [ 927.748580][ T780] netlink: 'syz.0.6484': attribute type 3 has an invalid length. [ 928.038639][ T801] FAULT_INJECTION: forcing a failure. [ 928.038639][ T801] name failslab, interval 1, probability 0, space 0, times 0 [ 928.083882][ T801] CPU: 0 UID: 0 PID: 801 Comm: syz.3.6487 Not tainted syzkaller #0 PREEMPT(full) [ 928.083908][ T801] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 928.083919][ T801] Call Trace: [ 928.083927][ T801] [ 928.083935][ T801] dump_stack_lvl+0xe8/0x150 [ 928.083962][ T801] should_fail_ex+0x412/0x560 [ 928.083987][ T801] should_failslab+0xa8/0x100 [ 928.084006][ T801] ? skb_clone+0x212/0x3a0 [ 928.084027][ T801] kmem_cache_alloc_noprof+0x87/0x650 [ 928.084060][ T801] skb_clone+0x212/0x3a0 [ 928.084085][ T801] __netlink_deliver_tap+0x404/0x850 [ 928.084119][ T801] ? netlink_deliver_tap+0x2e/0x1b0 [ 928.084142][ T801] netlink_deliver_tap+0x19c/0x1b0 [ 928.084163][ T801] netlink_sendskb+0x68/0x140 [ 928.084185][ T801] nfnetlink_rcv+0x251a/0x27b0 [ 928.084237][ T801] ? __pfx_nfnetlink_rcv+0x10/0x10 [ 928.084273][ T801] ? ref_tracker_free+0x693/0x840 [ 928.084323][ T801] ? __netlink_deliver_tap+0x807/0x850 [ 928.084354][ T801] ? netlink_deliver_tap+0x2e/0x1b0 [ 928.084373][ T801] ? netlink_deliver_tap+0x2e/0x1b0 [ 928.084398][ T801] netlink_unicast+0x75c/0x8e0 [ 928.084428][ T801] netlink_sendmsg+0x813/0xb40 [ 928.084459][ T801] ? __pfx_netlink_sendmsg+0x10/0x10 [ 928.084484][ T801] ? aa_sock_msg_perm+0xf1/0x1b0 [ 928.084512][ T801] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 928.084540][ T801] ____sys_sendmsg+0x972/0x9f0 [ 928.084560][ T801] ? __might_fault+0xaf/0x130 [ 928.084589][ T801] ? __pfx_____sys_sendmsg+0x10/0x10 [ 928.084620][ T801] ? import_iovec+0x73/0xa0 [ 928.084652][ T801] ___sys_sendmsg+0x2a5/0x360 [ 928.084671][ T801] ? __lock_acquire+0x6b5/0x2cf0 [ 928.084696][ T801] ? __pfx____sys_sendmsg+0x10/0x10 [ 928.084754][ T801] ? __fget_files+0x2a/0x420 [ 928.084774][ T801] ? __fget_files+0x3a0/0x420 [ 928.084807][ T801] __x64_sys_sendmsg+0x1bd/0x2a0 [ 928.084830][ T801] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 928.084859][ T801] ? __pfx_ksys_write+0x10/0x10 [ 928.084892][ T801] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 928.084913][ T801] do_syscall_64+0x174/0x580 [ 928.084931][ T801] ? trace_irq_disable+0x3b/0x140 [ 928.084957][ T801] ? clear_bhb_loop+0x40/0x90 [ 928.084980][ T801] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 928.084997][ T801] RIP: 0033:0x7fc7a639ce59 [ 928.085018][ T801] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 928.085034][ T801] RSP: 002b:00007fc7a7258028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 928.085053][ T801] RAX: ffffffffffffffda RBX: 00007fc7a6615fa0 RCX: 00007fc7a639ce59 [ 928.085067][ T801] RDX: 0000000000000000 RSI: 00002000000000c0 RDI: 0000000000000003 [ 928.085078][ T801] RBP: 00007fc7a7258090 R08: 0000000000000000 R09: 0000000000000000 [ 928.085090][ T801] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 928.085101][ T801] R13: 00007fc7a6616038 R14: 00007fc7a6615fa0 R15: 00007ffe2244c408 [ 928.085133][ T801] [ 928.526310][ T4950] Bluetooth: hci5: command 0x0406 tx timeout [ 928.648883][ T811] syz_tun: entered allmulticast mode [ 928.661052][ T811] pim6reg: entered allmulticast mode [ 928.848463][ T819] netlink: 24 bytes leftover after parsing attributes in process `syz.1.6492'. [ 929.253607][ T847] netlink: 'syz.3.6499': attribute type 3 has an invalid length. [ 929.253667][ T844] tipc: Enabling of bearer rejected, failed to enable media [ 929.272006][ T847] netlink: 'syz.3.6499': attribute type 2 has an invalid length. [ 929.288979][ T847] netlink: 'syz.3.6499': attribute type 2 has an invalid length. [ 929.759909][ T859] syzkaller0: entered promiscuous mode [ 929.777821][ T859] syzkaller0: entered allmulticast mode [ 929.805604][ T29] audit: type=1804 audit(1780154949.897:38): pid=878 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=open_writers comm="syz.4.6506" name="/newroot/5/memory.events" dev="tmpfs" ino=44 res=1 errno=0 [ 929.881591][ T29] audit: type=1800 audit(1780154949.897:39): pid=878 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.4.6506" name="memory.events" dev="tmpfs" ino=44 res=0 errno=0 [ 929.926533][ T29] audit: type=1800 audit(1780154949.907:40): pid=875 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.4.6506" name="memory.events" dev="tmpfs" ino=44 res=0 errno=0 [ 929.953747][ T29] audit: type=1804 audit(1780154949.907:41): pid=874 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=ToMToU comm="syz.4.6506" name="/newroot/5/memory.events" dev="tmpfs" ino=44 res=1 errno=0 [ 929.980655][ T888] netlink: 'syz.4.6509': attribute type 5 has an invalid length. [ 930.255674][ T900] FAULT_INJECTION: forcing a failure. [ 930.255674][ T900] name failslab, interval 1, probability 0, space 0, times 0 [ 930.275990][ T900] CPU: 0 UID: 0 PID: 900 Comm: syz.4.6512 Not tainted syzkaller #0 PREEMPT(full) [ 930.276014][ T900] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 930.276024][ T900] Call Trace: [ 930.276031][ T900] [ 930.276038][ T900] dump_stack_lvl+0xe8/0x150 [ 930.276061][ T900] should_fail_ex+0x412/0x560 [ 930.276083][ T900] should_failslab+0xa8/0x100 [ 930.276102][ T900] __kmalloc_noprof+0xe8/0x760 [ 930.276123][ T900] ? nf_tables_newrule+0x152c/0x28b0 [ 930.276150][ T900] nf_tables_newrule+0x152c/0x28b0 [ 930.276185][ T900] ? __pfx_nf_tables_newrule+0x10/0x10 [ 930.276204][ T900] ? nfnl_pernet+0x23/0x240 [ 930.276220][ T900] ? nfnl_pernet+0x23/0x240 [ 930.276244][ T900] ? __nla_parse+0x40/0x60 [ 930.276266][ T900] nfnetlink_rcv+0x123e/0x27b0 [ 930.276313][ T900] ? __pfx_nfnetlink_rcv+0x10/0x10 [ 930.276343][ T900] ? ref_tracker_free+0x693/0x840 [ 930.276387][ T900] ? __netlink_deliver_tap+0x807/0x850 [ 930.276414][ T900] ? netlink_deliver_tap+0x2e/0x1b0 [ 930.276430][ T900] ? netlink_deliver_tap+0x2e/0x1b0 [ 930.276452][ T900] netlink_unicast+0x75c/0x8e0 [ 930.276478][ T900] netlink_sendmsg+0x813/0xb40 [ 930.276511][ T900] ? __pfx_netlink_sendmsg+0x10/0x10 [ 930.276532][ T900] ? aa_sock_msg_perm+0xf1/0x1b0 [ 930.276555][ T900] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 930.276578][ T900] ____sys_sendmsg+0x972/0x9f0 [ 930.276596][ T900] ? __might_fault+0xaf/0x130 [ 930.276621][ T900] ? __pfx_____sys_sendmsg+0x10/0x10 [ 930.276646][ T900] ? import_iovec+0x73/0xa0 [ 930.276668][ T900] ___sys_sendmsg+0x2a5/0x360 [ 930.276683][ T900] ? __lock_acquire+0x6b5/0x2cf0 [ 930.276704][ T900] ? __pfx____sys_sendmsg+0x10/0x10 [ 930.276754][ T900] ? __fget_files+0x2a/0x420 [ 930.276772][ T900] ? __fget_files+0x3a0/0x420 [ 930.276799][ T900] __x64_sys_sendmsg+0x1bd/0x2a0 [ 930.276820][ T900] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 930.276846][ T900] ? __pfx_ksys_write+0x10/0x10 [ 930.276875][ T900] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 930.276892][ T900] do_syscall_64+0x174/0x580 [ 930.276908][ T900] ? trace_irq_disable+0x3b/0x140 [ 930.276930][ T900] ? clear_bhb_loop+0x40/0x90 [ 930.276949][ T900] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 930.276964][ T900] RIP: 0033:0x7fe42ff9ce59 [ 930.276980][ T900] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 930.276992][ T900] RSP: 002b:00007fe430e79028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 930.277009][ T900] RAX: ffffffffffffffda RBX: 00007fe430215fa0 RCX: 00007fe42ff9ce59 [ 930.277020][ T900] RDX: 0000000000000000 RSI: 00002000000000c0 RDI: 0000000000000003 [ 930.277029][ T900] RBP: 00007fe430e79090 R08: 0000000000000000 R09: 0000000000000000 [ 930.277039][ T900] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 930.277048][ T900] R13: 00007fe430216038 R14: 00007fe430215fa0 R15: 00007fff23dc8a88 [ 930.277075][ T900] [ 932.728520][ T872] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 932.848127][ C1] ip6_tunnel: ip6gretap1 xmit: Local address not yet configured! [ 932.962843][ T919] __nla_validate_parse: 5 callbacks suppressed [ 932.962860][ T919] netlink: 16 bytes leftover after parsing attributes in process `syz.3.6517'. [ 933.119843][ T931] netlink: 24 bytes leftover after parsing attributes in process `syz.2.6519'. [ 933.212040][ T921] tipc: Enabling of bearer rejected, failed to enable media [ 933.246322][T32739] batadv1: left promiscuous mode [ 933.301757][ T916] netlink: 16 bytes leftover after parsing attributes in process `syz.4.6516'. [ 933.333954][ T947] sock: sock_set_timeout: `syz.0.6520' (pid 947) tries to set negative timeout [ 933.348366][ T945] netlink: 'syz.0.6520': attribute type 1 has an invalid length. [ 933.358630][ T945] netlink: 96 bytes leftover after parsing attributes in process `syz.0.6520'. [ 933.375726][ T945] netlink: 658 bytes leftover after parsing attributes in process `syz.0.6520'. [ 933.386274][ T945] netlink: 1 bytes leftover after parsing attributes in process `syz.0.6520'. [ 933.575074][ T967] netlink: 20 bytes leftover after parsing attributes in process `syz.0.6523'. [ 933.693455][ T963] netlink: 12 bytes leftover after parsing attributes in process `syz.0.6523'. [ 933.694568][ T976] netlink: 20 bytes leftover after parsing attributes in process `syz.4.6524'. [ 933.711106][ T974] syzkaller0: entered promiscuous mode [ 933.739909][ T974] syzkaller0: entered allmulticast mode [ 933.743090][ T976] netlink: 16 bytes leftover after parsing attributes in process `syz.4.6524'. [ 933.766798][ T974] sch_tbf: burst 255 is lower than device syzkaller0 mtu (1514) ! [ 934.445520][ T1013] sctp: [Deprecated]: syz.1.6533 (pid 1013) Use of int in max_burst socket option. [ 934.445520][ T1013] Use struct sctp_assoc_value instead [ 934.456011][ T1010] nbd: must specify at least one socket [ 934.594698][ T5294] veth0_vlan: left promiscuous mode [ 934.628664][ T5294] veth0_vlan: entered promiscuous mode [ 934.781041][ T1038] Bluetooth: MGMT ver 1.23 [ 935.236580][ T5639] Bluetooth: hci3: command tx timeout [ 935.417644][ T1076] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 935.922691][ T1114] netlink: 'syz.3.6549': attribute type 1 has an invalid length. [ 937.120054][ T1139] netlink: 'syz.3.6556': attribute type 3 has an invalid length. [ 937.655402][ T1153] netlink: 'syz.4.6561': attribute type 1 has an invalid length. [ 937.762520][ T1157] sctp: [Deprecated]: syz.2.6562 (pid 1157) Use of int in max_burst socket option. [ 937.762520][ T1157] Use struct sctp_assoc_value instead [ 938.031869][ T1169] __nla_validate_parse: 6 callbacks suppressed [ 938.032080][ T1169] netlink: 52 bytes leftover after parsing attributes in process `syz.4.6564'. [ 938.253880][ T1177] netlink: zone id is out of range [ 938.271198][ T1177] netlink: zone id is out of range [ 938.293229][ T1177] netlink: zone id is out of range [ 938.307074][ T1177] netlink: zone id is out of range [ 938.321121][ T1177] netlink: zone id is out of range [ 938.351863][ T1177] netlink: zone id is out of range [ 938.373026][ T1177] netlink: zone id is out of range [ 938.400053][ T1177] netlink: zone id is out of range [ 938.430265][ T1177] netlink: zone id is out of range [ 938.453198][ T1177] netlink: zone id is out of range [ 938.477121][ T1177] netlink: zone id is out of range [ 938.503195][ T1177] netlink: zone id is out of range [ 938.534360][ T1177] netlink: zone id is out of range [ 938.560627][ T1177] netlink: zone id is out of range [ 938.581110][ T1177] netlink: zone id is out of range [ 939.053238][ T1220] netlink: 4 bytes leftover after parsing attributes in process `syz.0.6578'. [ 939.147561][ T1226] netlink: 48 bytes leftover after parsing attributes in process `syz.0.6578'. [ 939.706704][ T1243] netlink: 20 bytes leftover after parsing attributes in process `syz.0.6584'. [ 939.706834][ T1241] netlink: 36 bytes leftover after parsing attributes in process `syz.4.6583'. [ 940.129804][ T1250] syzkaller0: entered promiscuous mode [ 940.154183][ T1250] syzkaller0: entered allmulticast mode [ 940.191047][ T1250] bridge0: port 2(bridge_slave_1) entered disabled state [ 940.198776][ T1250] bridge0: port 1(bridge_slave_0) entered disabled state [ 940.227754][ T1250] bridge0: entered promiscuous mode [ 940.269424][ T1250] netlink: 8 bytes leftover after parsing attributes in process `syz.4.6586'. [ 940.702784][ T1269] netlink: 24 bytes leftover after parsing attributes in process `syz.4.6590'. [ 940.893482][ T1271] netlink: 12 bytes leftover after parsing attributes in process `syz.4.6591'. [ 941.669582][ T1288] tun0: tun_chr_ioctl cmd 1074812118 [ 942.277382][ T1304] netlink: 'syz.4.6600': attribute type 1 has an invalid length. [ 943.281313][ T1323] sch_tbf: burst 19872 is lower than device lo mtu (65550) ! [ 943.613079][ T1338] syzkaller0: entered promiscuous mode [ 943.636910][ T1338] syzkaller0: entered allmulticast mode [ 943.656511][ T1337] netlink: 48 bytes leftover after parsing attributes in process `syz.0.6607'. [ 943.945351][ T1347] syzkaller0: entered promiscuous mode [ 943.982492][ T1347] syzkaller0: entered allmulticast mode [ 944.465449][ T1366] netlink: 'syz.1.6617': attribute type 4 has an invalid length. [ 944.475270][ T1366] netlink: 8 bytes leftover after parsing attributes in process `syz.1.6617'. [ 944.486831][ T1366] netlink: 8 bytes leftover after parsing attributes in process `syz.1.6617'. [ 944.766594][ T1373] netlink: 8 bytes leftover after parsing attributes in process `syz.0.6619'. [ 944.968289][ T1383] netlink: 28 bytes leftover after parsing attributes in process `syz.1.6623'. [ 945.345803][ T1400] netlink: 4 bytes leftover after parsing attributes in process `syz.4.6628'. [ 946.041921][ T1429] netlink: 'syz.4.6633': attribute type 83 has an invalid length. [ 946.079652][ T1429] netlink: 20 bytes leftover after parsing attributes in process `syz.4.6633'. [ 946.322650][ T1443] netlink: 4 bytes leftover after parsing attributes in process `syz.3.6637'. [ 946.389964][ T1443] netlink: 12 bytes leftover after parsing attributes in process `syz.3.6637'. [ 946.465235][ T1451] sctp: [Deprecated]: syz.2.6639 (pid 1451) Use of struct sctp_assoc_value in delayed_ack socket option. [ 946.465235][ T1451] Use struct sctp_sack_info instead [ 946.663694][ T1463] netlink: 8 bytes leftover after parsing attributes in process `syz.2.6641'. [ 946.960222][ T1483] veth0: entered promiscuous mode [ 947.737091][ T1509] netlink: 'syz.2.6651': attribute type 9 has an invalid length. [ 948.264070][ T1529] netlink: 'syz.1.6655': attribute type 3 has an invalid length. [ 949.021643][ T1435] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 949.203341][ T1534] netlink: 'syz.1.6660': attribute type 1 has an invalid length. [ 949.211045][ T1538] __nla_validate_parse: 6 callbacks suppressed [ 949.211063][ T1538] netlink: 4 bytes leftover after parsing attributes in process `syz.4.6659'. [ 949.238345][ T1538] netlink: 4 bytes leftover after parsing attributes in process `syz.4.6659'. [ 949.294618][ T1543] netlink: 4 bytes leftover after parsing attributes in process `syz.0.6656'. [ 949.482061][ T1547] netlink: 4 bytes leftover after parsing attributes in process `syz.1.6661'. [ 949.722915][ T1562] x_tables: duplicate underflow at hook 2 [ 949.755829][ T1563] netlink: 332 bytes leftover after parsing attributes in process `syz.1.6664'. [ 949.776229][ T1563] netlink: 'syz.1.6664': attribute type 9 has an invalid length. [ 949.791235][ T1563] netlink: 108 bytes leftover after parsing attributes in process `syz.1.6664'. [ 949.811164][ T1563] netlink: 32 bytes leftover after parsing attributes in process `syz.1.6664'. [ 949.955558][ T1574] netlink: 28 bytes leftover after parsing attributes in process `syz.4.6666'. [ 950.041040][ T1579] tipc: Started in network mode [ 950.067579][ T1579] tipc: Node identity e26defae06c5, cluster identity 4711 [ 950.074920][ T1579] tipc: Enabled bearer , priority 0 [ 950.133139][ T1579] tipc: Disabling bearer [ 950.213838][ T1592] net_ratelimit: 39 callbacks suppressed [ 950.213857][ T1592] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 950.248658][ T1592] v: renamed from sit0 (while UP) [ 950.482820][ T1608] netlink: 12 bytes leftover after parsing attributes in process `syz.2.6674'. [ 950.521787][ T1608] netlink: 12 bytes leftover after parsing attributes in process `syz.2.6674'. [ 950.610871][T14727] bond_slave_0: entered promiscuous mode [ 950.618179][T14727] bond_slave_1: entered promiscuous mode [ 950.755467][ T1622] netlink: 'syz.3.6679': attribute type 3 has an invalid length. [ 950.927972][ T1635] --map-set only usable from mangle table [ 951.158336][ T1646] bond1: entered allmulticast mode [ 951.164005][ T1646] 8021q: adding VLAN 0 to HW filter on device bond1 [ 952.075160][ T1712] netlink: 'syz.4.6704': attribute type 1 has an invalid length. [ 952.293068][ T1722] netlink: 'syz.1.6705': attribute type 1 has an invalid length. [ 952.373181][ T1719] bond1: (slave gretap1): making interface the new active one [ 952.385776][ T1719] bond1: (slave gretap1): Enslaving as an active interface with an up link [ 952.410489][ T1712] macvlan0: entered promiscuous mode [ 952.424007][ T1712] macvlan0: entered allmulticast mode [ 952.431459][ T1712] bond1: entered promiscuous mode [ 952.439704][ T1712] gretap1: entered promiscuous mode [ 952.446667][ T1712] 8021q: adding VLAN 0 to HW filter on device macvlan0 [ 952.463327][ T1712] bond1: (slave macvlan0): the slave hw address is in use by the bond; couldn't find a slave with a free hw address to give it (this should not have happened) [ 952.480954][ T1712] bond1: left promiscuous mode [ 952.486509][ T1712] gretap1: left promiscuous mode [ 952.554022][ T1722] bond4: entered promiscuous mode [ 952.559768][ T1722] 8021q: adding VLAN 0 to HW filter on device bond4 [ 952.601095][ T1729] bond4: (slave bridge2): making interface the new active one [ 952.609161][ T1729] bridge2: entered promiscuous mode [ 952.623243][ T1729] bridge2: left promiscuous mode [ 952.969120][ T1758] netlink: 'syz.1.6714': attribute type 2 has an invalid length. [ 953.026224][ T1767] netlink: 'syz.0.6717': attribute type 10 has an invalid length. [ 953.054347][ T1767] team0: Port device geneve1 added [ 953.111791][ T1769] ip6erspan0: entered allmulticast mode [ 953.294097][ T1786] tipc: Started in network mode [ 953.313201][ T1786] tipc: Node identity 02bb5e183698, cluster identity 4711 [ 953.326971][ T1786] tipc: Enabled bearer , priority 0 [ 953.337227][ T1786] syzkaller0: entered promiscuous mode [ 953.342910][ T1786] syzkaller0: entered allmulticast mode [ 953.378873][ T1786] veth0: mtu greater than device maximum [ 953.424682][ T1785] tipc: Resetting bearer [ 953.519634][ T1785] tipc: Disabling bearer [ 954.366284][ T1852] vlan0: entered promiscuous mode [ 954.371401][ T1852] gretap0: entered promiscuous mode [ 954.378604][ T1852] vlan0: entered allmulticast mode [ 954.383773][ T1852] gretap0: entered allmulticast mode [ 954.391630][ T1854] __nla_validate_parse: 12 callbacks suppressed [ 954.391647][ T1854] netlink: 16 bytes leftover after parsing attributes in process `syz.3.6741'. [ 954.689738][ T1862] netlink: 10184 bytes leftover after parsing attributes in process `syz.1.6744'. [ 954.747850][ T1862] netlink: 20 bytes leftover after parsing attributes in process `syz.1.6744'. [ 954.772097][ T1874] netlink: 'syz.1.6744': attribute type 3 has an invalid length. [ 954.790695][ T1875] netlink: 'syz.2.6747': attribute type 1 has an invalid length. [ 954.936506][ T1875] 8021q: adding VLAN 0 to HW filter on device bond4 [ 954.984465][ T1875] vlan2: entered allmulticast mode [ 954.997196][ T1875] bond4: entered allmulticast mode [ 955.009297][ T1879] netlink: 8 bytes leftover after parsing attributes in process `syz.4.6748'. [ 955.042260][ T1879] netlink: 24 bytes leftover after parsing attributes in process `syz.4.6748'. [ 955.097253][ T1875] bond4: (slave geneve2): making interface the new active one [ 955.113056][ T1875] geneve2: entered allmulticast mode [ 955.145005][ T1875] bond4: (slave geneve2): Enslaving as an active interface with an up link [ 955.445512][ T1916] vlan3: entered promiscuous mode [ 955.450920][ T1916] bridge0: entered promiscuous mode [ 955.464673][ T1918] xt_l2tp: v2 doesn't support IP mode [ 955.477300][ T1915] syzkaller1: entered promiscuous mode [ 955.490162][ T1915] syzkaller1: entered allmulticast mode [ 955.508331][ T1918] netlink: 'syz.0.6756': attribute type 1 has an invalid length. [ 955.518451][ T1922] netlink: 12 bytes leftover after parsing attributes in process `syz.3.6757'. [ 955.533542][ T1912] netlink: 'syz.2.6754': attribute type 4 has an invalid length. [ 955.545497][ T1922] workqueue: Failed to create a rescuer kthread for wq "bond1": -EINTR [ 955.665097][ T1929] netlink: 4 bytes leftover after parsing attributes in process `syz.0.6758'. [ 955.721172][ T1929] vlan3: entered promiscuous mode [ 955.727605][ T1929] bridge0: entered promiscuous mode [ 955.779803][ T1933] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 955.988576][ T1933] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 956.005531][ T1957] netlink: 44 bytes leftover after parsing attributes in process `syz.4.6761'. [ 956.016563][ T1929] netlink: 'syz.0.6758': attribute type 4 has an invalid length. [ 956.077420][ T1945] bond5: option tlb_dynamic_lb: invalid value (5) [ 956.094412][ T1945] bond5 (unregistering): Released all slaves [ 956.155200][ T1949] netlink: 8 bytes leftover after parsing attributes in process `syz.3.6759'. [ 956.197727][ T1947] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 956.324677][ T1971] netlink: 'syz.1.6769': attribute type 4 has an invalid length. [ 956.482061][ T1982] netlink: 88 bytes leftover after parsing attributes in process `syz.2.6771'. [ 956.670595][ T1991] tipc: Enabling of bearer rejected, failed to enable media [ 956.833073][ T2004] tipc: Enabling not permitted [ 956.850110][ T2004] tipc: Enabling of bearer rejected, failed to enable media [ 956.926778][ T2004] sctp: [Deprecated]: syz.3.6779 (pid 2004) Use of struct sctp_assoc_value in delayed_ack socket option. [ 956.926778][ T2004] Use struct sctp_sack_info instead [ 957.447756][ T2023] xt_bpf: check failed: parse error [ 957.477147][ T2023] veth0_virt_wifi: mtu greater than device maximum [ 957.566049][ T2023] pim6reg: left allmulticast mode [ 957.590274][ T2023] syz_tun: left allmulticast mode [ 958.138788][ T2022] netdevsim netdevsim0 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 958.591010][ T2040] tipc: Started in network mode [ 958.600405][ T2040] tipc: Node identity d2d44e85cac7, cluster identity 4711 [ 958.613760][ T2040] tipc: Enabled bearer , priority 0 [ 958.623246][ T2046] syzkaller0: entered promiscuous mode [ 958.639033][ T2046] syzkaller0: entered allmulticast mode [ 958.689091][ T2056] netlink: 'syz.3.6793': attribute type 11 has an invalid length. [ 958.696507][ T2022] netdevsim netdevsim0 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 958.768665][ T2053] tipc: Resetting bearer [ 958.781729][ T2030] tipc: Resetting bearer [ 958.866243][ T2030] tipc: Disabling bearer [ 959.101135][ T2022] netdevsim netdevsim0 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 959.356352][ T2022] netdevsim netdevsim0 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 959.414366][ T2074] __nla_validate_parse: 10 callbacks suppressed [ 959.414385][ T2074] netlink: 28 bytes leftover after parsing attributes in process `syz.2.6798'. [ 959.436508][ T2074] netlink: 28 bytes leftover after parsing attributes in process `syz.2.6798'. [ 959.451021][ T2076] netlink: 12 bytes leftover after parsing attributes in process `syz.3.6799'. [ 959.459361][ T2077] netlink: 28 bytes leftover after parsing attributes in process `syz.2.6798'. [ 959.486111][ T2077] netlink: 28 bytes leftover after parsing attributes in process `syz.2.6798'. [ 959.504296][ T2077] netlink: 28 bytes leftover after parsing attributes in process `syz.2.6798'. [ 959.515958][ T2077] netlink: 28 bytes leftover after parsing attributes in process `syz.2.6798'. [ 959.643506][ T2084] netlink: 104 bytes leftover after parsing attributes in process `syz.2.6802'. [ 959.783077][ T3324] netdevsim netdevsim0 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 959.889976][T25061] netdevsim netdevsim0 eth1: set [1, 0] type 2 family 0 port 6081 - 0 [ 959.965569][ T2100] : option downdelay: invalid value (18446744073709547007) [ 959.973356][ T2100] : option downdelay: allowed values 0 - 2147483647 [ 959.982831][ T2100]  (unregistering): Released all slaves [ 960.105410][ T3324] netdevsim netdevsim0 eth2: set [1, 0] type 2 family 0 port 6081 - 0 [ 960.258072][ T3324] netdevsim netdevsim0 eth3: set [1, 0] type 2 family 0 port 6081 - 0 [ 960.308295][ T2121] netlink: 16 bytes leftover after parsing attributes in process `syz.2.6807'. [ 960.438501][ T2125] ipt_REJECT: ECHOREPLY no longer supported. [ 960.582957][ T2133] netlink: 204 bytes leftover after parsing attributes in process `syz.0.6808'. [ 960.637512][ T2135] netlink: 'syz.2.6810': attribute type 1 has an invalid length. [ 961.742921][ T2153] ip_tunnel: non-ECT from 172.20.20.187 with TOS=0x2 [ 962.751877][ T2178] netlink: 'syz.0.6820': attribute type 4 has an invalid length. [ 962.828297][ T2190] netlink: 'syz.0.6820': attribute type 4 has an invalid length. [ 963.455709][ T2218] 8021q: adding VLAN 0 to HW filter on device ipvlan0 [ 963.901035][ T2246] xt_CHECKSUM: unsupported CHECKSUM operation 68 [ 964.196158][ C1] ip6_tunnel: ip6gretap1 xmit: Local address not yet configured! [ 964.741145][ T2266] bridge0: port 2(bridge_slave_1) entered disabled state [ 964.748878][ T2266] bridge0: port 1(bridge_slave_0) entered disabled state [ 964.799164][ T2288] netlink: 'syz.2.6853': attribute type 49 has an invalid length. [ 964.988220][ T2266] A link change request failed with some changes committed already. Interface bridge_slave_0 may have been left with an inconsistent configuration, please check. [ 965.010984][ T2277] geneve3: entered promiscuous mode [ 965.027207][ T2277] geneve3: entered allmulticast mode [ 965.069853][ T2295] workqueue: Failed to create a rescuer kthread for wq "bond5": -EINTR [ 965.189873][ T2306] FAULT_INJECTION: forcing a failure. [ 965.189873][ T2306] name failslab, interval 1, probability 0, space 0, times 0 [ 965.243009][ T2306] CPU: 1 UID: 0 PID: 2306 Comm: syz.1.6858 Not tainted syzkaller #0 PREEMPT(full) [ 965.243056][ T2306] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 965.243080][ T2306] Call Trace: [ 965.243088][ T2306] [ 965.243097][ T2306] dump_stack_lvl+0xe8/0x150 [ 965.243122][ T2306] should_fail_ex+0x412/0x560 [ 965.243148][ T2306] should_failslab+0xa8/0x100 [ 965.243166][ T2306] ? skb_clone+0x212/0x3a0 [ 965.243187][ T2306] kmem_cache_alloc_noprof+0x87/0x650 [ 965.243216][ T2306] ? __netlink_lookup+0xc6/0x8b0 [ 965.243243][ T2306] skb_clone+0x212/0x3a0 [ 965.243267][ T2306] __netlink_deliver_tap+0x404/0x850 [ 965.243298][ T2306] ? netlink_deliver_tap+0x2e/0x1b0 [ 965.243320][ T2306] netlink_deliver_tap+0x19c/0x1b0 [ 965.243342][ T2306] netlink_unicast+0x730/0x8e0 [ 965.243371][ T2306] netlink_sendmsg+0x813/0xb40 [ 965.243407][ T2306] ? __pfx_netlink_sendmsg+0x10/0x10 [ 965.243432][ T2306] ? aa_sock_msg_perm+0xf1/0x1b0 [ 965.243459][ T2306] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 965.243485][ T2306] ____sys_sendmsg+0x972/0x9f0 [ 965.243506][ T2306] ? __might_fault+0xaf/0x130 [ 965.243535][ T2306] ? __pfx_____sys_sendmsg+0x10/0x10 [ 965.243565][ T2306] ? import_iovec+0x73/0xa0 [ 965.243590][ T2306] ___sys_sendmsg+0x2a5/0x360 [ 965.243608][ T2306] ? __lock_acquire+0x6b5/0x2cf0 [ 965.243630][ T2306] ? __pfx____sys_sendmsg+0x10/0x10 [ 965.243681][ T2306] ? __fget_files+0x2a/0x420 [ 965.243703][ T2306] ? __fget_files+0x3a0/0x420 [ 965.243733][ T2306] __x64_sys_sendmsg+0x1bd/0x2a0 [ 965.243756][ T2306] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 965.243785][ T2306] ? rcu_is_watching+0x15/0xb0 [ 965.243814][ T2306] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 965.243834][ T2306] do_syscall_64+0x174/0x580 [ 965.243853][ T2306] ? trace_irq_disable+0x3b/0x140 [ 965.243878][ T2306] ? clear_bhb_loop+0x40/0x90 [ 965.243900][ T2306] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 965.243918][ T2306] RIP: 0033:0x7f69e1f9ce59 [ 965.243936][ T2306] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 965.243951][ T2306] RSP: 002b:00007f69e2ee6028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 965.243970][ T2306] RAX: ffffffffffffffda RBX: 00007f69e2215fa0 RCX: 00007f69e1f9ce59 [ 965.243983][ T2306] RDX: 0000000000000000 RSI: 00002000000065c0 RDI: 0000000000000003 [ 965.243994][ T2306] RBP: 00007f69e2ee6090 R08: 0000000000000000 R09: 0000000000000000 [ 965.244005][ T2306] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 965.244016][ T2306] R13: 00007f69e2216038 R14: 00007f69e2215fa0 R15: 00007ffc68311628 [ 965.244047][ T2306] [ 966.106856][ T2345] __nla_validate_parse: 15 callbacks suppressed [ 966.106874][ T2345] netlink: 64 bytes leftover after parsing attributes in process `syz.3.6871'. [ 966.118292][ T2341] syzkaller0: entered promiscuous mode [ 966.156035][ T2341] syzkaller0: entered allmulticast mode [ 966.342012][ T2360] netlink: 8 bytes leftover after parsing attributes in process `syz.1.6875'. [ 966.366330][ T2361] netlink: 8 bytes leftover after parsing attributes in process `syz.1.6875'. [ 966.392449][ T2363] netlink: 'syz.2.6876': attribute type 1 has an invalid length. [ 966.412514][ T2363] netlink: 228 bytes leftover after parsing attributes in process `syz.2.6876'. [ 966.434862][ T2363] netlink: 'syz.2.6876': attribute type 8 has an invalid length. [ 966.447122][ T2363] netlink: 209840 bytes leftover after parsing attributes in process `syz.2.6876'. [ 966.479887][ T2363] netlink: 48 bytes leftover after parsing attributes in process `syz.2.6876'. [ 966.482239][ T2368] netlink: 'syz.1.6878': attribute type 9 has an invalid length. [ 966.512571][ T2369] netlink: 'syz.1.6878': attribute type 9 has an invalid length. [ 966.537877][ T2372] netlink: 16 bytes leftover after parsing attributes in process `syz.2.6876'. [ 966.547024][ T2372] netlink: 24 bytes leftover after parsing attributes in process `syz.2.6876'. [ 966.826172][ T2390] netlink: 'syz.2.6884': attribute type 2 has an invalid length. [ 966.851067][ T2390] netlink: 8 bytes leftover after parsing attributes in process `syz.2.6884'. [ 966.879932][ T2392] x_tables: duplicate underflow at hook 2 [ 968.140461][ T2470] netlink: 8 bytes leftover after parsing attributes in process `syz.4.6904'. [ 968.260240][ T3324] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 968.269637][ T2479] mac80211_hwsim hwsim66 ªªªªª>: renamed from wlan0 (while UP) [ 968.294579][ T3324] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 968.759296][ T2521] netlink: 'syz.4.6918': attribute type 2 has an invalid length. [ 969.090447][ T2548] netlink: 'syz.2.6925': attribute type 4 has an invalid length. [ 969.139536][ T2548] A link change request failed with some changes committed already. Interface bond0 may have been left with an inconsistent configuration, please check. [ 969.214043][ T2548] tipc: Started in network mode [ 969.227183][ T2548] tipc: Node identity 5, cluster identity 4711 [ 969.242212][ T2548] tipc: Node number set to 5 [ 969.261767][ T2538] RDS: rds_bind could not find a transport for ::ffff:172.30.1.2, load rds_tcp or rds_rdma? [ 969.273990][ T2556] IPVS: sync thread started: state = BACKUP, mcast_ifn = veth0_to_bond, syncid = 3, id = 0 [ 969.644339][ T2533] infiniband s–z1: set down [ 969.663509][ T2533] infiniband s–z1: added bond0 [ 969.666853][ T2582] A link change request failed with some changes committed already. Interface bridge_slave_0 may have been left with an inconsistent configuration, please check. [ 969.716293][ T2533] smbdirect: ib_dev[s–z1]: added: IB_CA max_fast_reg_page_list_len=512 device_cap_flags=0x1c001223c76 kernel_cap_flags=0x14 page_size_cap=0xfffff000 [ 969.758245][ T2533] smbdirect: ib_dev[s–z1]: num_ports=1 max_qp_rd_atom=128 max_qp_init_rd_atom=128 max_sgl_rd=0 max_sge_rd=32 max_cqe=32767 max_qp_wr=1048576 max_send_sge=32 max_recv_sge=32 [ 969.851555][ T2533] smbdirect: ib_dev[s–z1]PORT[1]: iwarp=0 ib=0 roce=1 v1=0 v2=1 core_cap_flags=0x803005 [ 969.910833][ T2533] RDS/IB: s–z1: added [ 969.915631][ T2533] smc: adding ib device s–z1 with port count 1 [ 969.918959][ T2600] netlink: 'syz.0.6934': attribute type 1 has an invalid length. [ 969.922000][ T2533] smc: ib device s–z1 port 1 has no pnetid [ 969.930613][ T2600] netlink: 'syz.0.6934': attribute type 2 has an invalid length. [ 969.987273][ T2600] openvswitch: netlink: Invalid VLAN frame [ 970.960233][ T2634] batadv_slave_1: entered promiscuous mode [ 971.075264][ T2635] batadv_slave_1: left promiscuous mode [ 971.125047][ T2647] __nla_validate_parse: 16 callbacks suppressed [ 971.125065][ T2647] netlink: 8 bytes leftover after parsing attributes in process `syz.3.6947'. [ 971.182578][ T2652] netlink: 'syz.4.6948': attribute type 1 has an invalid length. [ 971.204967][ T2652] netlink: 9172 bytes leftover after parsing attributes in process `syz.4.6948'. [ 971.331570][ T2668] netlink: 32 bytes leftover after parsing attributes in process `syz.4.6948'. [ 971.441504][ T2676] netlink: 104 bytes leftover after parsing attributes in process `syz.3.6951'. [ 971.457568][ T2676] C: renamed from veth1_to_team (while UP) [ 971.466727][ T2676] validate_nla: 1 callbacks suppressed [ 971.466806][ T2676] netlink: 'syz.3.6951': attribute type 8 has an invalid length. [ 971.490094][ T2676] A link change request failed with some changes committed already. Interface C may have been left with an inconsistent configuration, please check. [ 971.798791][ T2582] Bluetooth: hci1: Opcode 0x0c1a failed: -110 [ 971.809137][ T2687] sctp: [Deprecated]: syz.3.6953 (pid 2687) Use of int in maxseg socket option. [ 971.809137][ T2687] Use struct sctp_assoc_value instead [ 971.829560][ T2582] Bluetooth: hci1: Error when powering off device on rfkill (-110) [ 972.020576][ T2687] netlink: 47 bytes leftover after parsing attributes in process `syz.3.6953'. [ 972.589884][ T2582] Bluetooth: hci5: Opcode 0x0c1a failed: -4 [ 972.595990][ T2582] Bluetooth: hci5: Error when powering off device on rfkill (-4) [ 972.619459][ T2582] Bluetooth: hci2: Opcode 0x0c1a failed: -4 [ 972.628001][ T2582] Bluetooth: hci2: Error when powering off device on rfkill (-4) [ 972.672282][ T2582] Bluetooth: hci4: Opcode 0x0c1a failed: -4 [ 972.681056][ T2582] Bluetooth: hci4: Error when powering off device on rfkill (-4) [ 972.725204][ T2582] Bluetooth: hci3: Opcode 0x0c1a failed: -4 [ 972.734063][ T2582] Bluetooth: hci3: Error when powering off device on rfkill (-4) [ 972.952085][ T2708] netlink: 24 bytes leftover after parsing attributes in process `syz.3.6955'. [ 973.266618][ T2744] netlink: 12 bytes leftover after parsing attributes in process `syz.3.6961'. [ 973.606479][ T2756] netlink: 8 bytes leftover after parsing attributes in process `syz.4.6964'. [ 973.616307][ T2756] netlink: 'syz.4.6964': attribute type 9 has an invalid length. [ 973.648836][ T2759] netlink: 212368 bytes leftover after parsing attributes in process `syz.1.6963'. [ 973.741259][ T29] audit: type=1107 audit(1780154993.837:42): pid=2761 uid=0 auid=4294967295 ses=4294967295 subj=unconfined msg='aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa [ 973.788003][ T2764] tipc: Enabled bearer , priority 0 [ 973.852654][ T2772] netlink: 44 bytes leftover after parsing attributes in process `syz.4.6967'. [ 974.084266][ T2767] syzkaller0: entered promiscuous mode [ 974.090108][ T2767] syzkaller0: entered allmulticast mode [ 974.096789][ T2767] tipc: Resetting bearer [ 974.166821][ T2775] netlink: 'syz.4.6968': attribute type 1 has an invalid length. [ 974.190549][ T2767] tipc: Resetting bearer [ 976.967688][ T2767] tipc: Disabling bearer [ 976.990656][ T2775] 8021q: adding VLAN 0 to HW filter on device bond2 [ 977.011957][ T2780] bond2: (slave ip6gretap1): making interface the new active one [ 977.023105][ T2780] bond2: (slave ip6gretap1): Enslaving as an active interface with an up link [ 977.045324][T15786] tipc: Node number set to 3737135951 [ 977.134552][ T2798] erspan0: entered promiscuous mode [ 977.201534][ T2800] __nla_validate_parse: 4 callbacks suppressed [ 977.201553][ T2800] netlink: 12 bytes leftover after parsing attributes in process `syz.4.6973'. [ 977.420953][ T2808] Freezing with imperfect legacy cgroup freezer. See cgroup.freeze of cgroup v2 [ 977.456794][ T2809] netlink: 16 bytes leftover after parsing attributes in process `syz.2.6977'. [ 977.582882][ T2806] bond_slave_0: left promiscuous mode [ 977.591758][ T2806] bond_slave_1: left promiscuous mode [ 977.822787][ T2806] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 977.863426][ T2806] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 978.193576][T32740] netdevsim netdevsim4 eth0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 978.215162][T32740] netdevsim netdevsim4 eth1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 978.284631][T32740] netdevsim netdevsim4 eth2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 978.310926][T32740] netdevsim netdevsim4 eth3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 978.903186][ T2855] netlink: 24 bytes leftover after parsing attributes in process `syz.2.6987'. [ 979.081857][ T2866] netlink: 128 bytes leftover after parsing attributes in process `syz.4.6988'. [ 979.095379][ T2866] netlink: 56 bytes leftover after parsing attributes in process `syz.4.6988'. [ 979.181220][ T2871] veth0_virt_wifi: entered promiscuous mode [ 979.192517][ T2871] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 979.206998][ T2869] veth0_virt_wifi: left promiscuous mode [ 979.432377][ T2873] netlink: 'syz.0.6991': attribute type 13 has an invalid length. [ 979.440826][ T2873] netlink: 4 bytes leftover after parsing attributes in process `syz.0.6991'. [ 979.482136][ T2880] x_tables: duplicate entry at hook 1 [ 979.575712][ T2889] netlink: 28 bytes leftover after parsing attributes in process `syz.3.6994'. [ 979.595184][ T2891] netlink: 8 bytes leftover after parsing attributes in process `syz.0.6995'. [ 979.771868][ T2903] netlink: 12 bytes leftover after parsing attributes in process `syz.1.6998'. [ 979.848294][ T2904] tipc: Failed to remove unknown binding: 66,0,0/3737135951:11639726/11639727 [ 979.919608][ T2903] tipc: Failed to remove unknown binding: 66,0,0/3737135951:11639726/11639727 [ 980.136967][ T2911] ip6t_REJECT: TCP_RESET illegal for non-tcp [ 980.492372][ T2932] netlink: 12 bytes leftover after parsing attributes in process `syz.2.7010'. [ 980.853222][ T2959] veth0_macvtap: left promiscuous mode [ 981.105495][ T2966] syzkaller0: entered promiscuous mode [ 981.119366][ T2966] syzkaller0: entered allmulticast mode [ 981.195490][ T2966] tipc: Enabled bearer , priority 0 [ 981.229488][ T2965] tipc: Resetting bearer [ 981.259199][ T2982] xt_physdev: --physdev-out and --physdev-is-out only supported in the FORWARD and POSTROUTING chains with bridged traffic [ 981.297458][ T2965] tipc: Disabling bearer [ 981.532205][ T3016] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 981.865209][ T3031] netlink: 'syz.3.7033': attribute type 1 has an invalid length. [ 981.953862][ T3031] 8021q: adding VLAN 0 to HW filter on device bond1 [ 982.006671][ T3038] xt_policy: too many policy elements [ 982.303886][ T3058] __nla_validate_parse: 25 callbacks suppressed [ 982.303905][ T3058] netlink: 4 bytes leftover after parsing attributes in process `syz.4.7037'. [ 982.334812][ T3058] netlink: 4 bytes leftover after parsing attributes in process `syz.4.7037'. [ 982.554071][ T3065] bond2: option ad_user_port_key: mode dependency failed, not supported in mode balance-rr(0) [ 982.568977][ T3065] bond2 (unregistering): Released all slaves [ 982.780102][ T3076] netlink: 8 bytes leftover after parsing attributes in process `syz.2.7045'. [ 982.964403][ T3085] netlink: 8 bytes leftover after parsing attributes in process `syz.0.7048'. [ 984.819849][ T3148] netlink: 64 bytes leftover after parsing attributes in process `syz.2.7068'. [ 984.826452][ T3146] netlink: 64 bytes leftover after parsing attributes in process `syz.2.7068'. [ 984.971376][ T3155] netlink: 212368 bytes leftover after parsing attributes in process `syz.4.7070'. [ 985.177647][ T3167] netlink: 8 bytes leftover after parsing attributes in process `syz.4.7074'. [ 985.375149][ T3169] netlink: 'syz.2.7076': attribute type 5 has an invalid length. [ 985.707240][ T3203] netlink: 16 bytes leftover after parsing attributes in process `syz.2.7080'. [ 985.787627][ T3206] netlink: 'syz.4.7084': attribute type 1 has an invalid length. [ 985.964252][ T3230] netlink: 4 bytes leftover after parsing attributes in process `syz.1.7088'. [ 986.277803][ T3254] x_tables: ip_tables: icmp match: only valid for protocol 1 [ 986.362237][ T3260] macvlan2: entered promiscuous mode [ 986.378384][ T3260] bond0: entered promiscuous mode [ 986.398475][ T3260] bond_slave_0: entered promiscuous mode [ 986.407237][ T3260] bond_slave_1: entered promiscuous mode [ 986.414899][ T3260] 8021q: adding VLAN 0 to HW filter on device macvlan2 [ 986.441572][ T3262] batman_adv: batadv0: Adding interface: vlan2 [ 986.456562][ T3262] batman_adv: batadv0: The MTU of interface vlan2 is too small (1462) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 986.483270][ T3262] batman_adv: batadv0: Not using interface vlan2 (retrying later): interface not active [ 986.584211][ T3276] netlink: 'syz.2.7100': attribute type 1 has an invalid length. [ 986.628730][ T3276] bond5: entered promiscuous mode [ 986.634345][ T3276] 8021q: adding VLAN 0 to HW filter on device bond5 [ 986.691349][ T3282] bond5: (slave veth5): making interface the new active one [ 986.698992][ T3282] veth5: entered promiscuous mode [ 986.707272][ T3282] bond5: (slave veth5): Enslaving as an active interface with an up link [ 986.719371][ T3283] netlink: 'syz.0.7101': attribute type 21 has an invalid length. [ 986.750770][ T3283] netlink: 'syz.0.7101': attribute type 22 has an invalid length. [ 986.793021][ T3283] netlink: 'syz.0.7101': attribute type 23 has an invalid length. [ 986.822575][ T3283] netlink: 'syz.0.7101': attribute type 25 has an invalid length. [ 986.852392][ T3283] netlink: 'syz.0.7101': attribute type 26 has an invalid length. [ 987.117125][ T3308] bond2: (slave bridge5): Enslaving as an active interface with an up link [ 987.210129][ T3301] macvlan2: entered promiscuous mode [ 987.239405][ T3301] macvlan2: entered allmulticast mode [ 987.250459][ T3301] bond2: (slave macvlan2): Error -98 calling set_mac_address [ 987.474168][ T3329] __nla_validate_parse: 7 callbacks suppressed [ 987.474187][ T3329] netlink: 8 bytes leftover after parsing attributes in process `syz.3.7114'. [ 987.519142][ T3329] netlink: 12 bytes leftover after parsing attributes in process `syz.3.7114'. [ 987.611474][ T3329] sctp: [Deprecated]: syz.3.7114 (pid 3329) Use of int in max_burst socket option deprecated. [ 987.611474][ T3329] Use struct sctp_assoc_value instead [ 987.664602][ T3343] netlink: 'syz.0.7118': attribute type 1 has an invalid length. [ 987.802731][ T3343] bond2: entered promiscuous mode [ 987.816618][ T3343] 8021q: adding VLAN 0 to HW filter on device bond2 [ 988.494989][ T3347] 8021q: adding VLAN 0 to HW filter on device bond2 [ 988.502972][ T3347] bond2: (slave gre1): The slave device specified does not support setting the MAC address [ 988.513253][ T3347] bond2: (slave gre1): Setting fail_over_mac to active for active-backup mode [ 988.535969][ T3347] bond2: (slave gre1): making interface the new active one [ 988.543234][ T3347] gre1: entered promiscuous mode [ 988.549610][ T3347] bond2: (slave gre1): Enslaving as an active interface with an up link [ 988.846887][T14727] ip6_tunnel: ip6gretap1 xmit: Local address not yet configured! [ 989.176498][ T3015] ip6_tunnel: ip6gretap1 xmit: Local address not yet configured! [ 989.196160][T31728] ip6_tunnel: ip6gretap1 xmit: Local address not yet configured! [ 989.971296][ T3407] IPVS: set_ctl: invalid protocol: 44 10.1.1.0:20000 [ 990.200932][ T3419] ip6_vti0: entered promiscuous mode [ 990.214455][ T3419] ip6_vti0: entered allmulticast mode [ 990.405235][ T3421] netlink: 'syz.0.7137': attribute type 1 has an invalid length. [ 990.573014][ T3423] openvswitch: netlink: Tunnel attr 3 has unexpected len 4 expected 1 [ 991.020091][ T3444] netlink: 9 bytes leftover after parsing attributes in process `syz.1.7144'. [ 991.056112][ T3451] netlink: 28 bytes leftover after parsing attributes in process `syz.2.7146'. [ 991.074680][ T3451] netlink: 28 bytes leftover after parsing attributes in process `syz.2.7146'. [ 991.166777][ T3444] gretap0: entered promiscuous mode [ 991.192444][ T3450] netlink: 28 bytes leftover after parsing attributes in process `syz.2.7146'. [ 991.205738][ T3450] netlink: 28 bytes leftover after parsing attributes in process `syz.2.7146'. [ 991.313127][ T3444] netlink: 5 bytes leftover after parsing attributes in process `syz.1.7144'. [ 991.346849][ T3444] 0ªî{X¹¦: renamed from gretap0 [ 991.374757][ T3444] 0ªî{X¹¦: left promiscuous mode [ 991.381211][ T3465] netlink: 16 bytes leftover after parsing attributes in process `syz.2.7151'. [ 991.396051][ T3444] 0ªî{X¹¦: entered allmulticast mode [ 991.432697][ T3444] A link change request failed with some changes committed already. Interface 30ªî{X¹¦ may have been left with an inconsistent configuration, please check. [ 991.676206][ T3479] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 991.703801][ T3481] netlink: 36 bytes leftover after parsing attributes in process `syz.2.7156'. [ 992.120261][ T3502] bridge0: port 2(bridge_slave_1) entered disabled state [ 992.128009][ T3502] bridge0: port 1(bridge_slave_0) entered disabled state [ 992.584825][ T3529] netlink: 16 bytes leftover after parsing attributes in process `syz.4.7170'. [ 992.630692][ T3529] veth0_to_batadv: entered promiscuous mode [ 992.651678][ T3529] veth0_to_batadv: entered allmulticast mode [ 992.870392][ T3542] x_tables: ip6_tables: TEE.1 target: invalid size 40 (kernel) != (user) 112 [ 992.896324][ T3544] netlink: 'syz.4.7174': attribute type 10 has an invalid length. [ 992.905191][ T3544] syz_tun: entered promiscuous mode [ 992.920010][ T3544] bond0: (slave syz_tun): Enslaving as an active interface with an up link [ 992.930002][ T3516] infiniband syz0: set down [ 992.934757][ T3516] infiniband syz0: added bond_slave_1 [ 992.944277][ T3544] netlink: 41 bytes leftover after parsing attributes in process `syz.4.7174'. [ 992.974268][ T3544] netlink: 140 bytes leftover after parsing attributes in process `syz.4.7174'. [ 993.012756][ T3544] netlink: 41 bytes leftover after parsing attributes in process `syz.4.7174'. [ 993.033140][ T3516] smbdirect: ib_dev[syz0]: added: IB_CA max_fast_reg_page_list_len=512 device_cap_flags=0x1c001223c76 kernel_cap_flags=0x14 page_size_cap=0xfffff000 [ 993.070659][ T3516] smbdirect: ib_dev[syz0]: num_ports=1 max_qp_rd_atom=128 max_qp_init_rd_atom=128 max_sgl_rd=0 max_sge_rd=32 max_cqe=32767 max_qp_wr=1048576 max_send_sge=32 max_recv_sge=32 [ 993.112780][ T3516] smbdirect: ib_dev[syz0]PORT[1]: iwarp=0 ib=0 roce=1 v1=0 v2=1 core_cap_flags=0x803005 [ 993.224165][ T3516] RDS/IB: syz0: added [ 993.229404][ T3516] smc: adding ib device syz0 with port count 1 [ 993.238573][ T3516] smc: ib device syz0 port 1 has no pnetid [ 993.255048][ T3554] syzkaller0: entered promiscuous mode [ 993.267599][ T3554] syzkaller0: entered allmulticast mode [ 993.707522][ T3564] netlink: 2 bytes leftover after parsing attributes in process `syz.0.7182'. [ 993.758946][ T3567] netlink: 24 bytes leftover after parsing attributes in process `syz.4.7183'. [ 993.887542][ T3574] netlink: 16186 bytes leftover after parsing attributes in process `syz.0.7185'. [ 993.939321][ T3579] netlink: 'syz.0.7185': attribute type 3 has an invalid length. [ 994.036356][ C0] ip6_tunnel: ip6gretap1 xmit: Local address not yet configured! [ 994.353442][ T3600] netlink: 24 bytes leftover after parsing attributes in process `syz.0.7190'. [ 994.421221][ T3598] netlink: 108 bytes leftover after parsing attributes in process `syz.0.7190'. [ 994.463709][ T3598] netlink: 108 bytes leftover after parsing attributes in process `syz.0.7190'. [ 994.660095][ T3608] netlink: 'syz.0.7192': attribute type 1 has an invalid length. [ 994.933110][ T3617] ip6t_srh: unknown srh match flags 4000 [ 995.452027][ T3635] 8021q: adding VLAN 0 to HW filter on device bond3 [ 996.188224][ T3665] netlink: 'syz.0.7210': attribute type 1 has an invalid length. [ 996.688437][ T3685] ip6gre1: entered promiscuous mode [ 996.697717][ T3685] ip6gre1: entered allmulticast mode [ 996.978982][ T3699] veth1_vlan: entered allmulticast mode [ 997.846932][ T3732] __nla_validate_parse: 9 callbacks suppressed [ 997.846951][ T3732] netlink: 212368 bytes leftover after parsing attributes in process `syz.4.7230'. [ 997.880454][ T3733] netdevsim netdevsim1 netdevsim0: entered allmulticast mode [ 997.925142][ T3736] netlink: 'syz.2.7232': attribute type 1 has an invalid length. [ 997.940916][ T3733] A link change request failed with some changes committed already. Interface netdevsim0 may have been left with an inconsistent configuration, please check. [ 998.048319][ T3736] bond6: entered promiscuous mode [ 998.054299][ T3736] 8021q: adding VLAN 0 to HW filter on device bond6 [ 998.070143][ T3745] vlan4: entered allmulticast mode [ 998.075544][ T3745] bond6: entered allmulticast mode [ 998.081543][ T3740] bond_slave_0: entered allmulticast mode [ 998.215301][ T3755] netlink: 24 bytes leftover after parsing attributes in process `syz.2.7233'. [ 998.237910][ T3757] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 998.304920][ T3755] veth7: entered allmulticast mode [ 998.488409][ T3763] netlink: 84 bytes leftover after parsing attributes in process `syz.1.7236'. [ 998.592698][ T3771] netlink: 124 bytes leftover after parsing attributes in process `syz.1.7236'. [ 999.191711][ T3790] bond5 (unregistering): Released all slaves [ 999.275803][ T3801] netlink: 36 bytes leftover after parsing attributes in process `syz.2.7247'. [ 999.373431][ T3803] netlink: 24 bytes leftover after parsing attributes in process `syz.2.7247'. [ 999.923716][ T3816] bond4: entered promiscuous mode [ 999.932901][ T3816] 8021q: adding VLAN 0 to HW filter on device bond4 [ 999.975218][ T3828] sctp: [Deprecated]: syz.3.7254 (pid 3828) Use of struct sctp_assoc_value in delayed_ack socket option. [ 999.975218][ T3828] Use struct sctp_sack_info instead [ 999.975240][ T3816] netlink: 36 bytes leftover after parsing attributes in process `syz.0.7253'. [ 1000.050048][ T3816] bridge2: entered promiscuous mode [ 1000.068630][ T3816] bond4: (slave bridge2): Enslaving as an active interface with an up link [ 1000.824720][ T3856] netlink: 8 bytes leftover after parsing attributes in process `syz.0.7260'. [ 1001.031293][ T3870] netlink: 'syz.3.7262': attribute type 1 has an invalid length. [ 1001.119659][ T3875] netlink: 8 bytes leftover after parsing attributes in process `syz.1.7263'. [ 1001.154040][ T3875] netlink: 12 bytes leftover after parsing attributes in process `syz.1.7263'. [ 1001.191989][ T3874] bond3: (slave bridge6): making interface the new active one [ 1001.201057][ T3874] bond3: (slave bridge6): Enslaving as an active interface with an up link [ 1001.211702][ T3868] bond3: entered promiscuous mode [ 1001.224810][ T3868] bridge6: entered promiscuous mode [ 1001.231790][ T3868] bond3: entered allmulticast mode [ 1001.237945][ T3868] bridge6: entered allmulticast mode [ 1001.244999][ T3868] 8021q: adding VLAN 0 to HW filter on device bond3 [ 1001.505749][ T29] audit: type=1800 audit(1780155021.597:43): pid=3881 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.1.7265" name=20 dev="tmpfs" ino=1617 res=0 errno=0 [ 1001.568836][ T29] audit: type=1800 audit(1780155021.627:44): pid=3881 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.1.7265" name=20 dev="tmpfs" ino=1617 res=0 errno=0 [ 1002.296430][T31728] page_pool_release_retry() stalled pool shutdown: id 316, 1 inflight 60 sec [ 1002.596630][ C0] ip6_tunnel: ip6gretap1 xmit: Local address not yet configured! [ 1003.243835][ T3945] netlink: 'syz.2.7281': attribute type 1 has an invalid length. [ 1003.262837][ T3945] nbd: error processing sock list [ 1003.283492][ T3945] __nla_validate_parse: 8 callbacks suppressed [ 1003.283511][ T3945] netlink: 8 bytes leftover after parsing attributes in process `syz.2.7281'. [ 1003.347708][ T3945] netlink: 4 bytes leftover after parsing attributes in process `syz.2.7281'. [ 1003.487891][ T3956] netlink: 12 bytes leftover after parsing attributes in process `syz.1.7284'. [ 1003.493007][ T3959] netlink: 'syz.2.7286': attribute type 164 has an invalid length. [ 1003.521340][ T3961] netlink: 'syz.4.7285': attribute type 1 has an invalid length. [ 1003.875071][ T3972] netlink: 12 bytes leftover after parsing attributes in process `syz.2.7289'. [ 1003.958902][ T3975] netlink: 16 bytes leftover after parsing attributes in process `syz.3.7290'. [ 1004.129988][ T3968] tipc: Started in network mode [ 1004.143815][ T3968] tipc: Node identity 32e85f9123f5, cluster identity 4711 [ 1004.166372][ T3968] tipc: Enabled bearer , priority 0 [ 1004.177025][ T3968] syzkaller0: entered promiscuous mode [ 1004.201119][ T3968] syzkaller0: entered allmulticast mode [ 1004.254845][ T3985] netlink: 24 bytes leftover after parsing attributes in process `syz.3.7292'. [ 1004.266034][ T3970] tipc: Resetting bearer [ 1004.288584][ T3967] tipc: Resetting bearer [ 1004.334118][ T3967] tipc: Disabling bearer [ 1004.520193][ T4001] netlink: 12 bytes leftover after parsing attributes in process `syz.4.7296'. [ 1004.658645][ T4001] netlink: 12 bytes leftover after parsing attributes in process `syz.4.7296'. [ 1005.005452][ T4037] netlink: 8 bytes leftover after parsing attributes in process `syz.1.7305'. [ 1005.035655][ T4037] netlink: 8 bytes leftover after parsing attributes in process `syz.1.7305'. [ 1005.453133][ T4051] 8021q: adding VLAN 0 to HW filter on device bond5 [ 1005.889298][ T4079] IPVS: set_ctl: invalid protocol: 22 224.0.0.1:20003 [ 1005.949273][ T4082] tipc: Enabling of bearer rejected, failed to enable media [ 1006.283997][ T4096] ip6tnl1: entered allmulticast mode [ 1006.445480][ T4111] bridge0: trying to set multicast startup query interval below minimum, setting to 100 (1000ms) [ 1006.566762][ T4114] ip6tnl1: entered allmulticast mode [ 1006.580635][ T4122] batadv_slave_0: entered promiscuous mode [ 1006.691263][ T4102] macsec2: entered allmulticast mode [ 1006.716402][ T4102] 8021q: adding VLAN 0 to HW filter on device macsec2 [ 1006.799370][ T4124] bridge0: port 1(ipvlan2) entered blocking state [ 1006.822513][ T4124] bridge0: port 1(ipvlan2) entered disabled state [ 1006.852343][ T4124] ipvlan2: entered allmulticast mode [ 1006.872104][ T4124] bridge0: entered allmulticast mode [ 1006.893834][ T4124] ipvlan2: left allmulticast mode [ 1006.918721][ T4124] bridge0: left allmulticast mode [ 1006.963826][ T4120] batadv_slave_0: left promiscuous mode [ 1007.005818][ T4135] bond5: option primary: mode dependency failed, not supported in mode balance-rr(0) [ 1007.021841][ T4135] bond5 (unregistering): Released all slaves [ 1007.221108][ T4141] IPVS: Scheduler module ip_vs_ not found [ 1007.311097][ T4147] x_tables: duplicate underflow at hook 3 [ 1007.590557][ T4166] bond5: (slave lo): enslaved VLAN challenged slave. Adding VLANs will be blocked as long as it is part of bond. [ 1007.670365][ T4166] bond5: (slave lo): Enslaving as an active interface with an up link [ 1007.687867][ T4166] A link change request failed with some changes committed already. Interface tunl0 may have been left with an inconsistent configuration, please check. [ 1007.744454][ T4174] bond5: option tlb_dynamic_lb: invalid value (5) [ 1007.757159][ T4174] bond5 (unregistering): Released all slaves [ 1007.945089][ T4182] SET target dimension over the limit! [ 1008.749904][ T4226] __nla_validate_parse: 12 callbacks suppressed [ 1008.749943][ T4226] netlink: 16 bytes leftover after parsing attributes in process `syz.2.7354'. [ 1008.791799][ T4228] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 1009.509492][ T4260] netlink: 20 bytes leftover after parsing attributes in process `syz.4.7361'. [ 1009.522929][ T4258] netlink: 4 bytes leftover after parsing attributes in process `syz.0.7360'. [ 1009.535000][ T4258] netlink: 4 bytes leftover after parsing attributes in process `syz.0.7360'. [ 1009.545667][ T4258] A link change request failed with some changes committed already. Interface batadv0 may have been left with an inconsistent configuration, please check. [ 1009.930563][ T4280] netlink: 'syz.0.7366': attribute type 1 has an invalid length. [ 1009.958238][ T4280] netlink: 224 bytes leftover after parsing attributes in process `syz.0.7366'. [ 1010.010474][ T4280] netlink: 4 bytes leftover after parsing attributes in process `syz.0.7366'. [ 1010.056430][ T4280] netlink: 'syz.0.7366': attribute type 10 has an invalid length. [ 1010.066913][ T4280] netlink: 'syz.0.7366': attribute type 10 has an invalid length. [ 1010.456084][ T4299] netlink: 44 bytes leftover after parsing attributes in process `syz.1.7370'. [ 1010.524292][ T4299] netlink: 43 bytes leftover after parsing attributes in process `syz.1.7370'. [ 1010.562126][ T4305] mac80211_hwsim hwsim70 syzkaller0: entered promiscuous mode [ 1010.596895][ T4305] mac80211_hwsim hwsim70 syzkaller0: entered allmulticast mode [ 1010.624462][ T4299] netlink: 'syz.1.7370': attribute type 5 has an invalid length. [ 1010.688090][ T4299] netlink: 43 bytes leftover after parsing attributes in process `syz.1.7370'. [ 1011.064782][ T4315] netlink: 4 bytes leftover after parsing attributes in process `syz.4.7374'. [ 1011.364922][ T4334] netlink: 'syz.1.7377': attribute type 13 has an invalid length. [ 1012.588435][ T4384] bridge0: port 2(bridge_slave_1) entered blocking state [ 1012.596110][ T4384] bridge0: port 2(bridge_slave_1) entered listening state [ 1012.605927][ T4384] bridge0: port 1(bridge_slave_0) entered blocking state [ 1012.613532][ T4384] bridge0: port 1(bridge_slave_0) entered listening state [ 1012.661205][ T4384] 8021q: adding VLAN 0 to HW filter on device team0 [ 1012.726890][ T4384] A link change request failed with some changes committed already. Interface virt_wifi0 may have been left with an inconsistent configuration, please check. [ 1012.790685][ T4387] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 1013.723316][ T4437] --map-set only usable from mangle table [ 1013.802216][ T4438] tipc: Enabled bearer , priority 0 [ 1013.812564][ T4438] mac80211_hwsim hwsim72 syzkaller0: entered promiscuous mode [ 1013.831158][ T4438] mac80211_hwsim hwsim72 syzkaller0: entered allmulticast mode [ 1013.894989][ T4438] syzkaller0: mtu less than device minimum [ 1014.205164][ T4452] __nla_validate_parse: 9 callbacks suppressed [ 1014.205183][ T4452] netlink: 72 bytes leftover after parsing attributes in process `syz.4.7409'. [ 1014.226016][ T4452] netlink: 'syz.4.7409': attribute type 1 has an invalid length. [ 1014.284368][ T4459] bridge0: port 2(bridge_slave_1) entered disabled state [ 1014.292182][ T4459] bridge0: port 1(bridge_slave_0) entered disabled state [ 1014.339168][ T4461] netlink: 12 bytes leftover after parsing attributes in process `syz.4.7411'. [ 1014.407130][ T4461] 8021q: adding VLAN 0 to HW filter on device bond4 [ 1014.660531][ T4462] bridge0: port 2(bridge_slave_1) entered disabled state [ 1014.668111][ T4462] bridge0: port 1(bridge_slave_0) entered disabled state [ 1014.862834][ T4462] A link change request failed with some changes committed already. Interface bridge_slave_0 may have been left with an inconsistent configuration, please check. [ 1014.891478][ T4466] gretap2: entered allmulticast mode [ 1014.905227][ T4466] bond4: (slave gretap2): Enslaving as an active interface with an up link [ 1014.940421][ T4461] bond4 (unregistering): (slave gretap2): Releasing backup interface [ 1014.975440][ T4461] bond4 (unregistering): Released all slaves [ 1015.075438][ T4472] tipc: Node number set to 3836276654 [ 1015.590967][ T4504] bond4: option fail_over_mac: invalid value (127) [ 1015.621693][ T4504] bond4 (unregistering): Released all slaves [ 1015.641180][ T4507] netlink: 'syz.2.7420': attribute type 1 has an invalid length. [ 1015.734687][ T4507] 8021q: adding VLAN 0 to HW filter on device bond7 [ 1015.763925][ T4516] netlink: 'syz.2.7420': attribute type 10 has an invalid length. [ 1015.787525][ T4511] bond7: (slave dummy0): making interface the new active one [ 1015.794270][ T4516] netlink: 40 bytes leftover after parsing attributes in process `syz.2.7420'. [ 1015.833650][ T4511] bond7: (slave dummy0): Enslaving as an active interface with an up link [ 1015.852374][ T4519] netlink: 4 bytes leftover after parsing attributes in process `syz.4.7423'. [ 1015.865552][ T4516] dummy0: entered promiscuous mode [ 1015.869723][ T4519] xt_TCPMSS: Only works on TCP SYN packets [ 1015.880068][ T4519] netlink: 4 bytes leftover after parsing attributes in process `syz.4.7423'. [ 1015.899601][ T4516] bond7: (slave dummy0): Releasing active interface [ 1015.925299][ T4519] netlink: 4 bytes leftover after parsing attributes in process `syz.4.7423'. [ 1016.269607][ T4534] netlink: 8 bytes leftover after parsing attributes in process `syz.3.7427'. [ 1016.915260][ T4557] netlink: 24 bytes leftover after parsing attributes in process `syz.3.7434'. [ 1017.327148][ T4576] netlink: 104 bytes leftover after parsing attributes in process `syz.4.7441'. [ 1017.363998][ T4576] netlink: 104 bytes leftover after parsing attributes in process `syz.4.7441'. [ 1018.452950][ T4593] bridge0: port 2(bridge_slave_1) entered blocking state [ 1018.460196][ T4593] bridge0: port 2(bridge_slave_1) entered listening state [ 1018.524640][ T4593] 8021q: adding VLAN 0 to HW filter on device bond0 [ 1018.560857][ T4593] 8021q: adding VLAN 0 to HW filter on device team0 [ 1018.579146][ T4593] dummy0: left promiscuous mode [ 1018.591714][ T4593] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 1018.600442][ C0] ip6_tunnel: ip6gretap1 xmit: Local address not yet configured! [ 1018.822555][ T4593] A link change request failed with some changes committed already. Interface wlan0 may have been left with an inconsistent configuration, please check. [ 1018.854744][ T3006] bridge0: port 1(bridge_slave_0) entered blocking state [ 1018.864118][ T3006] bridge0: port 1(bridge_slave_0) entered listening state [ 1019.475097][ T4633] __nla_validate_parse: 4 callbacks suppressed [ 1019.475134][ T4633] netlink: 8 bytes leftover after parsing attributes in process `syz.2.7455'. [ 1019.494729][ T4633] netlink: 224 bytes leftover after parsing attributes in process `syz.2.7455'. [ 1019.532111][ T4637] netlink: 'syz.4.7453': attribute type 1 has an invalid length. [ 1019.662592][ T4645] netlink: 'syz.2.7458': attribute type 1 has an invalid length. [ 1019.686659][ T4646] bond8: Unable to set down delay as MII monitoring is disabled [ 1019.697061][ T4646] bond8 (unregistering): Released all slaves [ 1019.747880][ T4645] workqueue: Failed to create a rescuer kthread for wq "bond8": -EINTR [ 1019.910146][ T4658] netlink: 44 bytes leftover after parsing attributes in process `syz.2.7461'. [ 1019.958433][ T4661] bond5: option coupled_control: mode dependency failed, not supported in mode balance-rr(0) [ 1019.972941][ T4661] bond5 (unregistering): Released all slaves [ 1020.101206][ T4665] netlink: 12 bytes leftover after parsing attributes in process `syz.2.7463'. [ 1020.230175][ T4667] bridge_slave_0 (unregistering): left allmulticast mode [ 1020.237447][ T4667] bridge_slave_0 (unregistering): left promiscuous mode [ 1020.244513][ T4667] bridge0: port 1(bridge_slave_0) entered disabled state [ 1020.338771][ T4669] netlink: 40 bytes leftover after parsing attributes in process `syz.0.7465'. [ 1020.637939][ T4685] netlink: 8 bytes leftover after parsing attributes in process `syz.0.7468'. [ 1020.975136][ C1] vcan0: j1939_tp_rxtimer: 0xffff8880494a3c00: rx timeout, send abort [ 1020.990592][ C1] vcan0: j1939_xtp_rx_abort_one: 0xffff8880494a3c00: 0x20000: (3) A timeout occurred and this is the connection abort to close the session. [ 1022.030839][ T4710] netlink: 8 bytes leftover after parsing attributes in process `syz.0.7476'. [ 1022.043147][ T4701] lo speed is unknown, defaulting to 1000 [ 1022.046658][ T4710] netlink: 8 bytes leftover after parsing attributes in process `syz.0.7476'. [ 1022.056723][ T4701] lo speed is unknown, defaulting to 1000 [ 1022.076342][ T4709] netlink: 20 bytes leftover after parsing attributes in process `syz.3.7475'. [ 1022.087013][ T4701] lo speed is unknown, defaulting to 1000 [ 1022.103340][ T4701] smbdirect: ib_dev[syú2]: added: RNIC max_fast_reg_page_list_len=256 device_cap_flags=0x200000 kernel_cap_flags=0x10 page_size_cap=0x1000 [ 1022.126767][ T4709] netlink: 44 bytes leftover after parsing attributes in process `syz.3.7475'. [ 1022.168864][ T4701] smbdirect: ib_dev[syú2]: num_ports=1 max_qp_rd_atom=128 max_qp_init_rd_atom=128 max_sgl_rd=0 max_sge_rd=1 max_cqe=3276800 max_qp_wr=32768 max_send_sge=6 max_recv_sge=6 [ 1022.195674][ T4701] smbdirect: ib_dev[syú2]PORT[1]: iwarp=1 ib=0 roce=0 v1=0 v2=0 core_cap_flags=0x400008 [ 1022.225665][ T4701] infiniband syú2: RDMA CMA: cma_listen_on_dev, error -98 [ 1022.321034][ T4701] lo speed is unknown, defaulting to 1000 [ 1022.344210][ T4701] lo speed is unknown, defaulting to 1000 [ 1022.364171][ T4701] lo speed is unknown, defaulting to 1000 [ 1022.403626][ T4701] lo speed is unknown, defaulting to 1000 [ 1022.436386][ T4701] lo speed is unknown, defaulting to 1000 [ 1022.461229][ T4701] lo speed is unknown, defaulting to 1000 [ 1022.505064][ T4701] lo speed is unknown, defaulting to 1000 [ 1022.548602][ T4701] lo speed is unknown, defaulting to 1000 [ 1022.699777][ T4742] netlink: 'syz.0.7485': attribute type 1 has an invalid length. [ 1022.804349][ T4743] bond5: Unable to set up delay as MII monitoring is disabled [ 1022.815323][ T4743] bond5 (unregistering): Released all slaves [ 1022.954929][ T4742] 8021q: adding VLAN 0 to HW filter on device bond5 [ 1022.974349][ T4742] netlink: 'syz.0.7485': attribute type 1 has an invalid length. [ 1022.985760][ T4743] bond5: up delay (136) is not a multiple of miimon (100), value rounded to 100 ms [ 1023.011180][ T4743] bond5: entered allmulticast mode [ 1023.030306][ T4743] bond5: up delay (136) is not a multiple of miimon (100), value rounded to 100 ms [ 1023.042831][ T4742] netlink: 'syz.0.7485': attribute type 1 has an invalid length. [ 1023.063671][ T4743] bond5: up delay (136) is not a multiple of miimon (100), value rounded to 100 ms [ 1023.076329][ T4743] bond5: up delay (136) is not a multiple of miimon (100), value rounded to 100 ms [ 1023.087477][ T4758] openvswitch: netlink: nsh attribute has 4 unknown bytes. [ 1023.095517][ T4743] bond5: up delay (136) is not a multiple of miimon (100), value rounded to 100 ms [ 1023.106607][ T4758] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 1023.127108][ T4743] bond5: up delay (136) is not a multiple of miimon (100), value rounded to 100 ms [ 1023.141291][ T4742] netlink: 'syz.0.7485': attribute type 1 has an invalid length. [ 1023.165736][ T4742] netlink: 'syz.0.7485': attribute type 1 has an invalid length. [ 1023.196242][ T4743] bond5: up delay (136) is not a multiple of miimon (100), value rounded to 100 ms [ 1023.235043][ T4742] netlink: 'syz.0.7485': attribute type 1 has an invalid length. [ 1023.264035][ T4743] bond5: up delay (136) is not a multiple of miimon (100), value rounded to 100 ms [ 1023.278947][ T4742] netlink: 'syz.0.7485': attribute type 1 has an invalid length. [ 1023.287971][ T4743] bond5: up delay (136) is not a multiple of miimon (100), value rounded to 100 ms [ 1023.298888][ T4766] netlink: zone id is out of range [ 1023.301560][ T4742] netlink: 'syz.0.7485': attribute type 1 has an invalid length. [ 1023.322769][ T4766] netlink: zone id is out of range [ 1023.326301][ T4743] bond5: up delay (136) is not a multiple of miimon (100), value rounded to 100 ms [ 1023.354358][ T4766] netlink: zone id is out of range [ 1023.373708][ T4766] netlink: zone id is out of range [ 1023.377023][ T4742] netlink: 'syz.0.7485': attribute type 1 has an invalid length. [ 1023.392163][ T4766] netlink: zone id is out of range [ 1023.414106][ T4766] netlink: zone id is out of range [ 1023.429460][ T4743] bond5: up delay (136) is not a multiple of miimon (100), value rounded to 100 ms [ 1023.430100][ T4766] netlink: zone id is out of range [ 1023.472649][ T4743] bond5: up delay (136) is not a multiple of miimon (100), value rounded to 100 ms [ 1024.109968][ T29] audit: type=1800 audit(1780155044.207:45): pid=4798 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.2.7498" name="memory.events" dev="tmpfs" ino=1389 res=0 errno=0 [ 1024.379999][ T4810] block nbd3: not configured, cannot reconfigure [ 1024.381372][ T4812] netlink: 'syz.2.7502': attribute type 1 has an invalid length. [ 1024.508294][ T4817] __nla_validate_parse: 6 callbacks suppressed [ 1024.508333][ T4817] netlink: 20 bytes leftover after parsing attributes in process `syz.3.7503'. [ 1024.693568][ T4820] geneve3: entered promiscuous mode [ 1024.726052][ T4820] geneve3: entered allmulticast mode [ 1024.946908][ T4829] : renamed from veth0_to_bond (while UP) [ 1025.020944][ T4834] xt_hashlimit: size too large, truncated to 1048576 [ 1025.058959][ T4834] xt_hashlimit: max too large, truncated to 1048576 [ 1025.243039][ T4838] netlink: 28 bytes leftover after parsing attributes in process `syz.4.7509'. [ 1025.268067][ T4838] netlink: 28 bytes leftover after parsing attributes in process `syz.4.7509'. [ 1025.310826][ T4838] netlink: 112 bytes leftover after parsing attributes in process `syz.4.7509'. [ 1025.421943][ T4844] netlink: 16 bytes leftover after parsing attributes in process `syz.1.7511'. [ 1026.089410][ T4863] netlink: 152 bytes leftover after parsing attributes in process `syz.1.7516'. [ 1026.106627][ T4863] netlink: 16 bytes leftover after parsing attributes in process `syz.1.7516'. [ 1026.497744][ T4887] macsec1: entered promiscuous mode [ 1026.518974][ T4887] veth1: entered promiscuous mode [ 1026.530764][ T4887] macsec1: entered allmulticast mode [ 1026.543557][ T4887] veth1: entered allmulticast mode [ 1026.557830][ T4887] batman_adv: batadv0: Adding interface: macsec1 [ 1026.565127][ T4887] batman_adv: batadv0: The MTU of interface macsec1 is too small (1468) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 1026.622184][ T4887] batman_adv: batadv0: Interface activated: macsec1 [ 1026.729512][ T4903] netlink: 16 bytes leftover after parsing attributes in process `syz.2.7530'. [ 1026.780387][ T4903] netlink: 11 bytes leftover after parsing attributes in process `syz.2.7530'. [ 1026.787588][ T4905] netlink: 212368 bytes leftover after parsing attributes in process `syz.2.7530'. [ 1028.156768][ T5001] validate_nla: 5 callbacks suppressed [ 1028.156787][ T5001] netlink: 'syz.1.7550': attribute type 1 has an invalid length. [ 1028.168781][ T4994] bond6: option tlb_dynamic_lb: invalid value (115) [ 1028.185603][ T4994] bond6 (unregistering): Released all slaves [ 1028.350029][ T4971] net_ratelimit: 380 callbacks suppressed [ 1028.350048][ T4971] A link change request failed with some changes committed already. Interface wlan0 may have been left with an inconsistent configuration, please check. [ 1028.401840][ T5001] 8021q: adding VLAN 0 to HW filter on device bond6 [ 1028.425558][ T5005] bond6: (slave geneve2): making interface the new active one [ 1028.435525][ T5005] bond6: (slave geneve2): Enslaving as an active interface with an up link [ 1028.450302][ T809] lo speed is unknown, defaulting to 1000 [ 1028.662806][ T5025] openvswitch: netlink: Message has 2 unknown bytes. [ 1028.836379][ C1] ip6_tunnel: ip6gretap1 xmit: Local address not yet configured! [ 1030.176360][ T4996] lo speed is unknown, defaulting to 1000 [ 1048.676236][ C0] bridge0: port 2(bridge_slave_1) entered learning state [ 1049.316602][ C1] bridge0: port 1(bridge_slave_0) entered learning state [ 1049.316769][ C0] ip6_tunnel: ip6gretap1 xmit: Local address not yet configured! [ 1052.079221][ T5089] __nla_validate_parse: 12 callbacks suppressed [ 1052.079240][ T5089] netlink: 8 bytes leftover after parsing attributes in process `syz.0.7574'. [ 1052.167104][ T5089] macvlan3: entered allmulticast mode [ 1052.190170][ T5089] gretap0: entered allmulticast mode [ 1052.345314][ T5105] netlink: 'syz.4.7583': attribute type 6 has an invalid length. [ 1052.361924][ T5105] netlink: 'syz.4.7583': attribute type 5 has an invalid length. [ 1052.376100][ T5105] netlink: 40 bytes leftover after parsing attributes in process `syz.4.7583'. [ 1052.391280][ T5105] openvswitch: netlink: Flow key attr not present in new flow. [ 1052.639127][ T5120] netlink: 16 bytes leftover after parsing attributes in process `syz.4.7587'. [ 1052.794149][ T5122] bond6: entered promiscuous mode [ 1052.811824][ T5122] bond6: entered allmulticast mode [ 1052.827081][ T5122] 8021q: adding VLAN 0 to HW filter on device bond6 [ 1052.832993][ T5141] netlink: 20 bytes leftover after parsing attributes in process `syz.2.7593'. [ 1053.300229][ T5163] netlink: 20 bytes leftover after parsing attributes in process `syz.2.7603'. [ 1053.333747][ T5172] netlink: 212368 bytes leftover after parsing attributes in process `syz.0.7605'. [ 1053.379845][ T5170] nicvf0: tun_chr_ioctl cmd 1074025677 [ 1053.398923][ T5170] nicvf0: linktype set to 1 [ 1053.481379][ T5174] bridge9: entered allmulticast mode [ 1053.660743][ T5196] IPVS: sync thread started: state = BACKUP, mcast_ifn = lo, syncid = 1, id = 0 [ 1053.807204][ T5204] gretap0: entered promiscuous mode [ 1054.134907][ T5222] netlink: 12 bytes leftover after parsing attributes in process `syz.1.7619'. [ 1054.168763][ T5222] netlink: 4 bytes leftover after parsing attributes in process `syz.1.7619'. [ 1054.525575][ T3001] dvmrp0: left allmulticast mode [ 1055.346871][ T3001] bond6 (unregistering): (slave ipip1): Releasing backup interface [ 1055.354853][ T3001] ipip1 (unregistering): left promiscuous mode [ 1055.376967][ T3001] bond7 (unregistering): (slave geneve3): Releasing active interface [ 1055.461205][ T3001] bond1 (unregistering): Released all slaves [ 1055.484242][ T3001] bond2 (unregistering): Released all slaves [ 1055.520862][ T3011] smc: removing ib device syz1 [ 1055.526800][ T3001] bond0 (unregistering): Released all slaves [ 1055.553527][ T3001] bond3 (unregistering): Released all slaves [ 1055.575307][ T3001] bond4 (unregistering): Released all slaves [ 1055.600745][ T3001] bond5 (unregistering): Released all slaves [ 1055.623769][ T3001] bond6 (unregistering): Released all slaves [ 1055.643509][ T3001] bond7 (unregistering): Released all slaves [ 1055.661708][ T3001] bond8 (unregistering): Released all slaves [ 1055.680712][ T3001] bond9 (unregistering): Released all slaves [ 1055.706404][ T3001] bond10 (unregistering): Released all slaves [ 1055.763422][ T5268] sctp: [Deprecated]: syz.1.7628 (pid 5268) Use of int in maxseg socket option. [ 1055.763422][ T5268] Use struct sctp_assoc_value instead [ 1055.857351][ T5263] bond7: (slave lo): enslaved VLAN challenged slave. Adding VLANs will be blocked as long as it is part of bond. [ 1055.887101][ T5263] bond7: (slave lo): Enslaving as an active interface with an up link [ 1055.896532][ T5263] A link change request failed with some changes committed already. Interface tunl0 may have been left with an inconsistent configuration, please check. [ 1055.933573][ T5267] hmac(sha2: entered promiscuous mode [ 1056.112217][ T3011] smbdirect: ib_dev[syz1] removed [ 1057.242888][ T5324] netlink: 4 bytes leftover after parsing attributes in process `syz.4.7640'. [ 1057.362691][ T5329] netlink: 44 bytes leftover after parsing attributes in process `syz.2.7642'. [ 1057.389705][ T5329] netlink: 12 bytes leftover after parsing attributes in process `syz.2.7642'. [ 1057.435400][ T5329] netlink: 8 bytes leftover after parsing attributes in process `syz.2.7642'. [ 1057.468251][ T5332] netlink: 76 bytes leftover after parsing attributes in process `syz.2.7642'. [ 1057.722825][ T5336] netlink: 24 bytes leftover after parsing attributes in process `syz.3.7645'. [ 1057.892588][ T5342] netlink: 8 bytes leftover after parsing attributes in process `syz.2.7646'. [ 1057.944857][ T5342] netlink: 112 bytes leftover after parsing attributes in process `syz.2.7646'. [ 1057.962227][ T5344] netlink: 'syz.1.7647': attribute type 1 has an invalid length. [ 1057.972009][ T5344] netlink: 36 bytes leftover after parsing attributes in process `syz.1.7647'. [ 1058.178402][ T5350] netlink: 'syz.4.7649': attribute type 16 has an invalid length. [ 1058.215681][ T5350] netlink: 'syz.4.7649': attribute type 3 has an invalid length. [ 1058.249521][ T5350] netlink: 64066 bytes leftover after parsing attributes in process `syz.4.7649'. [ 1058.462653][ T5352] bond8: option active_slave: mode dependency failed, not supported in mode balance-rr(0) [ 1058.512587][ T5352] bond8 (unregistering): Released all slaves [ 1058.598120][ T5361] netlink: 'syz.3.7651': attribute type 3 has an invalid length. [ 1058.630048][ T5371] netlink: 'syz.0.7654': attribute type 32 has an invalid length. [ 1059.359883][ T5392] netlink: 'syz.0.7660': attribute type 4 has an invalid length. [ 1059.421431][ T5396] netlink: 'syz.0.7660': attribute type 39 has an invalid length. [ 1059.462953][ T5400] batadv0: entered promiscuous mode [ 1059.488868][ T5400] A link change request failed with some changes committed already. Interface batadv0 may have been left with an inconsistent configuration, please check. [ 1063.642969][ T5426] bond0: entered promiscuous mode [ 1063.683765][ T5426] batadv0: entered promiscuous mode [ 1063.740962][ T5426] hsr1: Slave A (bond0) is not up; please bring it up to get a fully working HSR network [ 1063.780101][ T5426] 8021q: adding VLAN 0 to HW filter on device hsr1 [ 1063.819031][ T5439] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 1063.841344][ T5426] bond0: left promiscuous mode [ 1063.868472][ T5426] batadv0: left promiscuous mode [ 1063.923714][ T3001] tipc: Left network mode [ 1064.202953][ T5464] xt_physdev: --physdev-out and --physdev-is-out only supported in the FORWARD and POSTROUTING chains with bridged traffic [ 1064.842557][ T5495] ip6gre2: entered promiscuous mode [ 1064.856357][ T5495] ip6gre2: entered allmulticast mode [ 1064.908008][ T3008] ip6_tunnel: ip6gre2 xmit: Local address not yet configured! [ 1064.915464][ T5499] ip6_tunnel: ip6gre2 xmit: Local address not yet configured! [ 1064.933269][ T3008] ip6_tunnel: ip6gre2 xmit: Local address not yet configured! [ 1064.941217][T31728] ip6_tunnel: ip6gre2 xmit: Local address not yet configured! [ 1065.111237][ T5511] netlink: del zone limit has 4 unknown bytes [ 1065.138781][ T5513] __nla_validate_parse: 11 callbacks suppressed [ 1065.138801][ T5513] netlink: 27 bytes leftover after parsing attributes in process `syz.1.7686'. [ 1065.177565][ T5506] bond8: option primary_reselect: invalid value (6) [ 1065.210601][ T5506] bond8 (unregistering): Released all slaves [ 1065.442509][ T5514] syzkaller1: entered promiscuous mode [ 1065.451537][ T5514] syzkaller1: entered allmulticast mode [ 1065.457813][ T5525] netlink: 8 bytes leftover after parsing attributes in process `syz.4.7690'. [ 1065.614210][ T5527] netlink: 4 bytes leftover after parsing attributes in process `syz.1.7691'. [ 1065.638457][ T5529] netlink: 'syz.4.7692': attribute type 1 has an invalid length. [ 1065.716165][ T4472] ip6_tunnel: ip6gre2 xmit: Local address not yet configured! [ 1065.807557][ T4472] ip6_tunnel: ip6gre2 xmit: Local address not yet configured! [ 1065.845582][ T5532] bond5: (slave lo): enslaved VLAN challenged slave. Adding VLANs will be blocked as long as it is part of bond. [ 1065.871417][ T5532] bond5: (slave lo): Enslaving as an active interface with an up link [ 1065.887432][ T5532] A link change request failed with some changes committed already. Interface tunl0 may have been left with an inconsistent configuration, please check. [ 1066.092684][ T5550] gretap0: entered promiscuous mode [ 1066.273497][ T5564] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 1066.383512][ T5552] netlink: 8 bytes leftover after parsing attributes in process `syz.4.7698'. [ 1067.090010][ T5587] netlink: 28 bytes leftover after parsing attributes in process `syz.4.7706'. [ 1067.160213][ T5590] netlink: 12 bytes leftover after parsing attributes in process `syz.4.7706'. [ 1067.169549][ T5589] netlink: 4 bytes leftover after parsing attributes in process `syz.2.7707'. [ 1067.195335][ T5590] netlink: 12 bytes leftover after parsing attributes in process `syz.4.7706'. [ 1067.755283][T31563] IPVS: starting estimator thread 0... [ 1067.804037][ T5607] netlink: 12 bytes leftover after parsing attributes in process `syz.4.7712'. [ 1067.874882][ T5627] IPVS: using max 39 ests per chain, 93600 per kthread [ 1068.497291][ T5668] netlink: 4 bytes leftover after parsing attributes in process `syz.3.7724'. [ 1069.156057][ C1] ip6_tunnel: ip6gre2 xmit: Local address not yet configured! [ 1072.444098][ T5661] workqueue: Failed to create a rescuer kthread for wq "bond6": -EINTR [ 1072.519387][ T5668] hsr_slave_1 (unregistering): left promiscuous mode [ 1072.815150][ T5701] __nla_validate_parse: 3 callbacks suppressed [ 1072.815168][ T5701] netlink: 8 bytes leftover after parsing attributes in process `syz.3.7730'. [ 1073.018200][ T5701] bond7: entered promiscuous mode [ 1073.046376][ T5701] 8021q: adding VLAN 0 to HW filter on device bond7 [ 1073.138111][ T4472] ip6_tunnel: ip6gretap3 xmit: Local address not yet configured! [ 1073.484057][ T5718] netlink: 8 bytes leftover after parsing attributes in process `syz.1.7734'. [ 1073.800095][ T3015] ip6_tunnel: ip6gretap3 xmit: Local address not yet configured! [ 1073.810284][ T3015] ip6_tunnel: ip6gretap3 xmit: Local address not yet configured! [ 1073.996685][ T3001] IPVS: stop unused estimator thread 0... [ 1074.284116][ T5687] lo speed is unknown, defaulting to 1000 [ 1074.399486][ T5763] netlink: 'syz.3.7741': attribute type 1 has an invalid length. [ 1074.417185][ T5763] netlink: 224 bytes leftover after parsing attributes in process `syz.3.7741'. [ 1074.484961][ T5768] tipc: Enabling of bearer rejected, already enabled [ 1074.519898][ T5767] netlink: 4 bytes leftover after parsing attributes in process `syz.1.7742'. [ 1074.613202][ T5762] tipc: Resetting bearer [ 1074.829032][ T5773] vlan0: entered promiscuous mode [ 1074.840223][ T5773] bridge0: entered promiscuous mode [ 1074.932182][ T3003] ip6_tunnel: ip6gretap3 xmit: Local address not yet configured! [ 1074.953316][ T3003] ip6_tunnel: ip6gretap3 xmit: Local address not yet configured! [ 1075.244892][ T5796] xt_addrtype: ipv6 PROHIBIT (THROW, NAT ..) matching not supported [ 1075.330357][ T3003] netdevsim netdevsim3 netdevsim0: unset [0, 0] type 1 family 0 port 8472 - 0 [ 1075.344334][ T3003] netdevsim netdevsim3 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 1075.372955][ T3003] netdevsim netdevsim3 netdevsim0: unset [1, 1] type 2 family 0 port 20004 - 0 [ 1075.471505][ T5798] netlink: 12 bytes leftover after parsing attributes in process `syz.3.7750'. [ 1075.813479][ T5800] netdevsim netdevsim3 netdevsim3 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 1075.828552][ T5800] netdevsim netdevsim3 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1075.840130][ T5800] netdevsim netdevsim3 netdevsim3 (unregistering): unset [1, 1] type 2 family 0 port 20004 - 0 [ 1075.876296][ T4472] ip6_tunnel: ip6gretap3 xmit: Local address not yet configured! [ 1075.935474][ T5798] bridge0: trying to set multicast startup query interval below minimum, setting to 100 (1000ms) [ 1075.962844][ T5807] netlink: 202340 bytes leftover after parsing attributes in process `syz.0.7753'. [ 1076.139228][ T5800] netdevsim netdevsim3 netdevsim2 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 1076.164661][ T5800] netdevsim netdevsim3 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1076.194157][ T5800] netdevsim netdevsim3 netdevsim2 (unregistering): unset [1, 1] type 2 family 0 port 20004 - 0 [ 1076.238342][ T5809] syzkaller1: entered promiscuous mode [ 1076.245510][ T5809] syzkaller1: entered allmulticast mode [ 1076.487287][ T5828] netlink: 52 bytes leftover after parsing attributes in process `syz.0.7758'. [ 1076.497769][ T5828] netlink: 8 bytes leftover after parsing attributes in process `syz.0.7758'. [ 1076.507518][ T5828] netlink: 52 bytes leftover after parsing attributes in process `syz.0.7758'. [ 1076.519736][ T5828] netlink: 8 bytes leftover after parsing attributes in process `syz.0.7758'. [ 1076.953693][ T5789] lo speed is unknown, defaulting to 1000 [ 1076.956681][ T5827] A link change request failed with some changes committed already. Interface ip6gre0 may have been left with an inconsistent configuration, please check. [ 1077.015278][ T5800] netdevsim netdevsim3 netdevsim1 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 1077.027496][ T5800] netdevsim netdevsim3 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1077.039287][ T5800] netdevsim netdevsim3 netdevsim1 (unregistering): unset [1, 1] type 2 family 0 port 20004 - 0 [ 1077.076463][ T5829] 8021q: adding VLAN 0 to HW filter on device macvlan4 [ 1077.923441][ T5864] __nla_validate_parse: 3 callbacks suppressed [ 1077.923459][ T5864] netlink: 132 bytes leftover after parsing attributes in process `syz.2.7766'. [ 1077.998145][ T5866] netlink: 'syz.2.7766': attribute type 1 has an invalid length. [ 1078.009247][ T5867] netlink: 4 bytes leftover after parsing attributes in process `syz.0.7767'. [ 1078.044485][ T3001] netdevsim netdevsim3 eth0: set [0, 0] type 1 family 0 port 8472 - 0 [ 1078.064551][ T3001] netdevsim netdevsim3 eth0: set [1, 0] type 2 family 0 port 20004 - 0 [ 1078.082677][ T3001] netdevsim netdevsim3 eth0: set [1, 1] type 2 family 0 port 6081 - 0 [ 1078.099966][ T3001] netdevsim netdevsim3 eth1: set [0, 0] type 1 family 0 port 8472 - 0 [ 1078.109939][ T3001] netdevsim netdevsim3 eth1: set [1, 0] type 2 family 0 port 20004 - 0 [ 1078.118985][ C1] ip6_tunnel: ip6gre2 xmit: Local address not yet configured! [ 1078.128513][ T3001] netdevsim netdevsim3 eth1: set [1, 1] type 2 family 0 port 6081 - 0 [ 1078.180292][ T5862] gretap1: entered allmulticast mode [ 1078.353795][ T5869] tipc: Enabling of bearer rejected, already enabled [ 1078.371535][ T3014] netdevsim netdevsim3 eth2: set [0, 0] type 1 family 0 port 8472 - 0 [ 1078.389453][ T5871] x_tables: ip6_tables: TCPMSS target: only valid for protocol 6 [ 1078.402035][ T3014] netdevsim netdevsim3 eth2: set [1, 0] type 2 family 0 port 20004 - 0 [ 1078.437632][ T3014] netdevsim netdevsim3 eth2: set [1, 1] type 2 family 0 port 6081 - 0 [ 1078.482789][ T5874] nbd: couldn't find a device at index 0 [ 1078.590500][ T3011] netdevsim netdevsim3 eth3: set [0, 0] type 1 family 0 port 8472 - 0 [ 1078.622036][ T3011] netdevsim netdevsim3 eth3: set [1, 0] type 2 family 0 port 20004 - 0 [ 1078.632492][ T3011] netdevsim netdevsim3 eth3: set [1, 1] type 2 family 0 port 6081 - 0 [ 1078.757147][ C0] bridge0: port 2(bridge_slave_1) entered forwarding state [ 1078.764450][ C0] bridge0: topology change detected, propagating [ 1078.916476][ C0] ip6_tunnel: ip6gretap3 xmit: Local address not yet configured! [ 1079.025358][ T5894] netlink: 'syz.1.7776': attribute type 17 has an invalid length. [ 1079.225605][ T5907] netlink: 4 bytes leftover after parsing attributes in process `syz.1.7776'. [ 1079.395932][ C1] bridge0: port 1(bridge_slave_0) entered forwarding state [ 1079.403677][ C1] bridge0: topology change detected, propagating [ 1080.129252][ T5894] 0ªî{X¹¦: left allmulticast mode [ 1080.137691][ T5894] erspan0: left promiscuous mode [ 1080.170923][ T5894] 8021q: adding VLAN 0 to HW filter on device bond0 [ 1080.227967][ T5894] hsr0: left promiscuous mode [ 1080.235659][ T5894] veth1_vlan: left promiscuous mode [ 1080.242338][ T5894] veth0_vlan: left promiscuous mode [ 1080.249294][ T5894] veth0_vlan: entered promiscuous mode [ 1080.260850][ T5894] veth1_vlan: entered promiscuous mode [ 1080.273545][ T5894] veth1_macvtap: left promiscuous mode [ 1080.280547][ T5894] veth0_macvtap: left promiscuous mode [ 1080.288217][ T5894] veth0_macvtap: entered promiscuous mode [ 1080.296733][ T5894] veth1_macvtap: entered promiscuous mode [ 1080.309609][ T5894] netdevsim netdevsim1 netdevsim0: left allmulticast mode [ 1080.317882][ T5894] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 1080.330908][ T5894] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 1080.340165][ T5894] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 1080.348768][ T5894] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 1080.357289][ T5894] A link change request failed with some changes committed already. Interface wlan0 may have been left with an inconsistent configuration, please check. [ 1080.382600][ T5885] sysfs: cannot create duplicate filename '/class/ieee80211/!' [ 1080.393703][ T5885] CPU: 0 UID: 0 PID: 5885 Comm: syz.2.7774 Not tainted syzkaller #0 PREEMPT(full) [ 1080.393736][ T5885] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 1080.393750][ T5885] Call Trace: [ 1080.393760][ T5885] [ 1080.393769][ T5885] dump_stack_lvl+0xe8/0x150 [ 1080.393799][ T5885] sysfs_warn_dup+0x8e/0xa0 [ 1080.393827][ T5885] sysfs_do_create_link_sd+0xc0/0x110 [ 1080.393857][ T5885] device_add_class_symlinks+0x1cf/0x240 [ 1080.393894][ T5885] device_add+0x475/0xbb0 [ 1080.393930][ T5885] wiphy_register+0x1fb1/0x2fe0 [ 1080.393979][ T5885] ? __pfx_wiphy_register+0x10/0x10 [ 1080.394010][ T5885] ? __pfx_netdev_run_todo+0x10/0x10 [ 1080.394036][ T5885] ? minstrel_ht_alloc+0x6e0/0x7e0 [ 1080.394070][ T5885] ? ieee80211_init_rate_ctrl_alg+0x55d/0x5d0 [ 1080.394107][ T5885] ieee80211_register_hw+0x3c53/0x4910 [ 1080.394143][ T5885] ? ieee80211_register_hw+0x1971/0x4910 [ 1080.394227][ T5885] ? __pfx_ieee80211_register_hw+0x10/0x10 [ 1080.394253][ T5885] ? __asan_memset+0x22/0x50 [ 1080.394280][ T5885] ? __hrtimer_setup+0x1b7/0x260 [ 1080.394305][ T5885] ? __pfx_mac80211_hwsim_beacon+0x10/0x10 [ 1080.394332][ T5885] mac80211_hwsim_new_radio+0x3306/0x57b0 [ 1080.394388][ T5885] ? __pfx_mac80211_hwsim_new_radio+0x10/0x10 [ 1080.394414][ T5885] ? __asan_memcpy+0x40/0x70 [ 1080.394446][ T5885] hwsim_new_radio_nl+0xd96/0xfa0 [ 1080.394490][ T5885] genl_family_rcv_msg_doit+0x22a/0x330 [ 1080.394528][ T5885] ? __pfx_genl_family_rcv_msg_doit+0x10/0x10 [ 1080.394572][ T5885] ? bpf_lsm_capable+0x9/0x20 [ 1080.394592][ T5885] ? security_capable+0x7e/0x2c0 [ 1080.394629][ T5885] genl_rcv_msg+0x61c/0x7a0 [ 1080.394665][ T5885] ? __pfx_genl_rcv_msg+0x10/0x10 [ 1080.394694][ T5885] ? __pfx_hwsim_new_radio_nl+0x10/0x10 [ 1080.394732][ T5885] netlink_rcv_skb+0x232/0x4b0 [ 1080.394756][ T5885] ? __pfx_genl_rcv_msg+0x10/0x10 [ 1080.394787][ T5885] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 1080.394829][ T5885] ? down_read+0x270/0x2e0 [ 1080.394851][ T5885] ? genl_rcv+0xd/0x40 [ 1080.394881][ T5885] genl_rcv+0x28/0x40 [ 1080.394907][ T5885] netlink_unicast+0x75c/0x8e0 [ 1080.394941][ T5885] netlink_sendmsg+0x813/0xb40 [ 1080.394975][ T5885] ? __pfx_netlink_sendmsg+0x10/0x10 [ 1080.395004][ T5885] ? aa_sock_msg_perm+0xf1/0x1b0 [ 1080.395036][ T5885] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 1080.395067][ T5885] ____sys_sendmsg+0x972/0x9f0 [ 1080.395090][ T5885] ? __might_fault+0xaf/0x130 [ 1080.395125][ T5885] ? __pfx_____sys_sendmsg+0x10/0x10 [ 1080.395165][ T5885] ? import_iovec+0x73/0xa0 [ 1080.395196][ T5885] ___sys_sendmsg+0x2a5/0x360 [ 1080.395218][ T5885] ? __lock_acquire+0x6b5/0x2cf0 [ 1080.395246][ T5885] ? __pfx____sys_sendmsg+0x10/0x10 [ 1080.395278][ T5885] ? futex_wake+0x4ac/0x580 [ 1080.395337][ T5885] ? __fget_files+0x2a/0x420 [ 1080.395360][ T5885] ? __fget_files+0x3a0/0x420 [ 1080.395396][ T5885] __x64_sys_sendmsg+0x1bd/0x2a0 [ 1080.395423][ T5885] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 1080.395458][ T5885] ? rcu_is_watching+0x15/0xb0 [ 1080.395493][ T5885] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1080.395516][ T5885] do_syscall_64+0x174/0x580 [ 1080.395536][ T5885] ? trace_irq_disable+0x3b/0x140 [ 1080.395566][ T5885] ? clear_bhb_loop+0x40/0x90 [ 1080.395592][ T5885] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1080.395611][ T5885] RIP: 0033:0x7f89c359ce59 [ 1080.395631][ T5885] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1080.395649][ T5885] RSP: 002b:00007f89c445e028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 1080.395671][ T5885] RAX: ffffffffffffffda RBX: 00007f89c3815fa0 RCX: 00007f89c359ce59 [ 1080.395686][ T5885] RDX: 0000000000000300 RSI: 0000200000000040 RDI: 0000000000000004 [ 1080.395699][ T5885] RBP: 00007f89c3632d6f R08: 0000000000000000 R09: 0000000000000000 [ 1080.395712][ T5885] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 1080.395725][ T5885] R13: 00007f89c3816038 R14: 00007f89c3815fa0 R15: 00007fffe2fd3018 [ 1080.395761][ T5885] [ 1080.831207][ T5921] netlink: 45 bytes leftover after parsing attributes in process `syz.3.7779'. [ 1080.912968][ T5925] netlink: 'syz.1.7781': attribute type 21 has an invalid length. [ 1080.950573][ T3008] netdevsim netdevsim1 netdevsim0: unset [0, 0] type 1 family 0 port 8472 - 0 [ 1080.960610][ T3008] netdevsim netdevsim1 netdevsim1: unset [0, 0] type 1 family 0 port 8472 - 0 [ 1080.971007][ T5919] syz0: Port: 1 Link ACTIVE [ 1080.992068][ T5925] netlink: 156 bytes leftover after parsing attributes in process `syz.1.7781'. [ 1081.041015][ T3008] netdevsim netdevsim1 netdevsim2: unset [0, 0] type 1 family 0 port 8472 - 0 [ 1081.047867][ T5933] netlink: 4 bytes leftover after parsing attributes in process `syz.0.7783'. [ 1081.059968][ T3008] netdevsim netdevsim1 netdevsim3: unset [0, 0] type 1 family 0 port 8472 - 0 [ 1081.111171][ T5925] netlink: 'syz.1.7781': attribute type 1 has an invalid length. [ 1081.212554][ T5935] netlink: 'syz.0.7783': attribute type 4 has an invalid length. [ 1081.246647][ T5937] netlink: 8 bytes leftover after parsing attributes in process `syz.2.7785'. [ 1081.266390][ T5933] netlink: 'syz.0.7783': attribute type 4 has an invalid length. [ 1081.326746][ T5945] netlink: 14 bytes leftover after parsing attributes in process `syz.1.7781'. [ 1081.393321][ T5955] netlink: 12 bytes leftover after parsing attributes in process `syz.1.7781'. [ 1081.429964][ T5937] bond8: option broadcast_neighbor: invalid value (30) [ 1081.446908][ T5937] bond8 (unregistering): Released all slaves [ 1081.521632][ T5937] netlink: 8 bytes leftover after parsing attributes in process `syz.2.7785'. [ 1081.620046][ T5961] netlink: 'syz.0.7788': attribute type 4 has an invalid length. [ 1081.630207][ T5937] bond8: option broadcast_neighbor: invalid value (30) [ 1081.646912][ T5937] bond8 (unregistering): Released all slaves [ 1081.777393][ T5966] netlink: 'syz.0.7789': attribute type 11 has an invalid length. [ 1081.813211][ T5937] bond8: option broadcast_neighbor: invalid value (30) [ 1081.824601][ T5937] bond8 (unregistering): Released all slaves [ 1081.992374][ T5937] bond8: option broadcast_neighbor: invalid value (30) [ 1082.004091][ T5937] bond8 (unregistering): Released all slaves [ 1083.393565][ T5982] lo speed is unknown, defaulting to 1000 [ 1083.600042][ T6016] sctp: [Deprecated]: syz.0.7800 (pid 6016) Use of int in max_burst socket option deprecated. [ 1083.600042][ T6016] Use struct sctp_assoc_value instead [ 1083.637531][ T6018] ipt_REJECT: TCP_RESET invalid for non-tcp [ 1083.676216][ T6020] xt_TCPMSS: Only works on TCP SYN packets [ 1084.075620][ T6029] ip6erspan0: entered allmulticast mode [ 1085.267633][ T6049] bridge0: port 2(bridge_slave_1) entered disabled state [ 1085.275029][ T6049] bridge0: port 1(bridge_slave_0) entered disabled state [ 1085.433680][ T6049] bridge_slave_0: left allmulticast mode [ 1085.441915][ T6049] bridge_slave_0: left promiscuous mode [ 1085.448405][ T6049] bridge0: port 1(bridge_slave_0) entered disabled state [ 1085.479020][ T6049] bridge_slave_1: left allmulticast mode [ 1085.484872][ T6049] bridge_slave_1: left promiscuous mode [ 1085.492786][ T6049] bridge0: port 2(bridge_slave_1) entered disabled state [ 1085.523670][ T6049] bond0: (slave bond_slave_0): Releasing backup interface [ 1085.549456][ T6049] bond0: (slave bond_slave_1): Releasing backup interface [ 1085.576284][ T6049] team0: Port device team_slave_0 removed [ 1085.595397][ T6049] team0: Port device team_slave_1 removed [ 1085.609485][ T6049] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 1085.623982][ T6049] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 1085.642764][ T6049] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 1085.655298][ T6049] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 1085.680067][ T6049] A link change request failed with some changes committed already. Interface hsr_slave_0 may have been left with an inconsistent configuration, please check. [ 1085.711466][ T6045] __nla_validate_parse: 4 callbacks suppressed [ 1085.711486][ T6045] netlink: 8 bytes leftover after parsing attributes in process `syz.1.7808'. [ 1085.728997][ T6047] workqueue: Failed to create a rescuer kthread for wq "bond8": -EINTR [ 1085.729409][ T5900] lo speed is unknown, defaulting to 1000 [ 1085.745959][ T5900] syú2: Port: 1 Link DOWN [ 1085.770084][ T6058] netdevsim netdevsim0 eth3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1085.912677][ T6058] netdevsim netdevsim0 eth2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1085.991631][ T6085] netlink: 4 bytes leftover after parsing attributes in process `syz.3.7815'. [ 1086.103490][ T6058] netdevsim netdevsim0 eth1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1086.176916][ T6089] netlink: 4 bytes leftover after parsing attributes in process `syz.3.7817'. [ 1086.288770][ T6058] netdevsim netdevsim0 eth0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1086.413713][ T6104] netlink: 156 bytes leftover after parsing attributes in process `syz.3.7821'. [ 1086.436437][ T6104] netlink: 'syz.3.7821': attribute type 2 has an invalid length. [ 1086.457044][ T6109] netlink: 20 bytes leftover after parsing attributes in process `syz.1.7823'. [ 1086.483371][ T3014] netdevsim netdevsim0 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 1086.537497][ T6111] netlink: 8 bytes leftover after parsing attributes in process `syz.3.7824'. [ 1086.558786][ T3014] netdevsim netdevsim0 eth1: set [1, 0] type 2 family 0 port 6081 - 0 [ 1086.570941][ T6109] syzkaller1: entered promiscuous mode [ 1086.583588][ T6109] syzkaller1: entered allmulticast mode [ 1086.609555][ T6118] netlink: 8 bytes leftover after parsing attributes in process `syz.3.7824'. [ 1086.700780][ T3011] netdevsim netdevsim0 eth2: set [1, 0] type 2 family 0 port 6081 - 0 [ 1086.753427][ T3015] netdevsim netdevsim0 eth3: set [1, 0] type 2 family 0 port 6081 - 0 [ 1087.272261][ T6147] syz_tun: entered promiscuous mode [ 1087.307670][ T6147] vlan2: entered promiscuous mode [ 1087.532242][ T6156] Cannot find add_set index 2 as target [ 1090.199802][ T6158] netlink: 16 bytes leftover after parsing attributes in process `syz.3.7839'. [ 1090.298866][ T6160] netlink: 8 bytes leftover after parsing attributes in process `syz.3.7839'. [ 1090.581532][ T6131] lo speed is unknown, defaulting to 1000 [ 1091.214929][ T6212] mac80211_hwsim hwsim75 syzkaller0: entered promiscuous mode [ 1091.222991][ T6212] mac80211_hwsim hwsim75 syzkaller0: entered allmulticast mode [ 1091.376787][ T6223] netlink: 4 bytes leftover after parsing attributes in process `syz.1.7857'. [ 1091.388649][ T6225] A link change request failed with some changes committed already. Interface hsr_slave_0 may have been left with an inconsistent configuration, please check. [ 1091.400730][ T6223] netlink: 'syz.1.7857': attribute type 2 has an invalid length. [ 1091.737420][ T6238] x_tables: duplicate underflow at hook 1 [ 1091.988692][ T6246] netlink: 36 bytes leftover after parsing attributes in process `syz.4.7865'. [ 1092.026446][ T6249] tipc: Enabled bearer , priority 0 [ 1092.114109][ T6249] tipc: Resetting bearer [ 1092.409070][ T6270] netlink: 8 bytes leftover after parsing attributes in process `syz.2.7872'. [ 1092.441724][ T6270] netlink: 12 bytes leftover after parsing attributes in process `syz.2.7872'. [ 1093.035576][ T6300] syzkaller0: entered promiscuous mode [ 1093.067410][ T6300] syzkaller0: entered allmulticast mode [ 1093.111560][ T6304] syzkaller1: entered promiscuous mode [ 1093.144120][ T6304] syzkaller1: entered allmulticast mode [ 1093.343232][ T6313] netlink: 24 bytes leftover after parsing attributes in process `syz.0.7880'. [ 1093.519438][ T6324] netlink: 12 bytes leftover after parsing attributes in process `syz.2.7883'. [ 1093.567422][ T6324] tipc: Enabling of bearer rejected, already enabled [ 1093.684042][ T6332] pim6reg1: entered promiscuous mode [ 1093.703534][ T6332] pim6reg1: entered allmulticast mode [ 1093.897674][ T6347] netlink: 88 bytes leftover after parsing attributes in process `syz.0.7889'. [ 1093.921453][ T6347] nbd: must specify a size in bytes for the device [ 1094.692992][ T3014] netdevsim netdevsim2 eth0: set [0, 0] type 1 family 0 port 8472 - 0 [ 1094.726466][ T3014] netdevsim netdevsim2 eth1: set [0, 0] type 1 family 0 port 8472 - 0 [ 1094.741424][ T3014] netdevsim netdevsim2 eth2: set [0, 0] type 1 family 0 port 8472 - 0 [ 1094.781842][ T3014] netdevsim netdevsim2 eth3: set [0, 0] type 1 family 0 port 8472 - 0 [ 1094.821281][ T6393] netlink: 40 bytes leftover after parsing attributes in process `syz.3.7899'. [ 1094.869462][ T6393] netlink: 40 bytes leftover after parsing attributes in process `syz.3.7899'. [ 1095.209597][ T6419] netlink: 12 bytes leftover after parsing attributes in process `syz.1.7900'. [ 1095.344263][ T6426] bond0: option active_slave: mode dependency failed, not supported in mode balance-rr(0) [ 1095.396751][ C1] ip6_tunnel: ip6gre2 xmit: Local address not yet configured! [ 1095.493290][ T6434] mac80211_hwsim hwsim72 syzkaller0: left promiscuous mode [ 1095.517303][ T6434] mac80211_hwsim hwsim72 syzkaller0: left allmulticast mode [ 1095.752954][ T6445] vlan0: left promiscuous mode [ 1095.762148][ T6445] vlan0: entered allmulticast mode [ 1095.768476][ T6445] veth0_vlan: entered allmulticast mode [ 1096.179946][ T6471] ipvlan2: entered allmulticast mode [ 1096.201413][ T6471] syz_tun: entered allmulticast mode [ 1096.388018][ T6486] tap0: tun_chr_ioctl cmd 1074025681 [ 1096.599113][ T6497] __nla_validate_parse: 3 callbacks suppressed [ 1096.599134][ T6497] netlink: 8 bytes leftover after parsing attributes in process `syz.1.7921'. [ 1096.634885][ T6490] geneve3: entered promiscuous mode [ 1096.642523][ T6490] geneve3: entered allmulticast mode [ 1096.685220][ T3010] netdevsim netdevsim2 eth0: set [1, 1] type 2 family 0 port 20003 - 0 [ 1096.781136][ T3010] netdevsim netdevsim2 eth1: set [1, 1] type 2 family 0 port 20003 - 0 [ 1096.822278][ T3010] netdevsim netdevsim2 eth2: set [1, 1] type 2 family 0 port 20003 - 0 [ 1096.907349][ T6512] netlink: 4 bytes leftover after parsing attributes in process `syz.2.7929'. [ 1096.938346][ T6512] openvswitch: netlink: Flow actions attr not present in new flow. [ 1097.116445][ T3010] netdevsim netdevsim2 eth3: set [1, 1] type 2 family 0 port 20003 - 0 [ 1097.152533][ T6520] netlink: 24 bytes leftover after parsing attributes in process `syz.3.7930'. [ 1097.571499][ T6541] netlink: 277 bytes leftover after parsing attributes in process `syz.3.7935'. [ 1097.844305][ T6548] xt_addrtype: input interface limitation not valid in POSTROUTING and OUTPUT [ 1103.039652][ T6566] syzkaller0: entered promiscuous mode [ 1103.050850][ T6566] syzkaller0: entered allmulticast mode [ 1104.102923][ T6555] lo speed is unknown, defaulting to 1000 [ 1104.525354][ T6619] netlink: 'syz.1.7951': attribute type 10 has an invalid length. [ 1104.643353][ T6619] bond0: (slave syz_tun): Enslaving as an active interface with an up link [ 1104.962114][ T6633] syzkaller0: entered promiscuous mode [ 1104.985661][ T6633] syzkaller0: entered allmulticast mode [ 1105.021832][ T6633] 0: reclassify loop, rule prio 0, protocol 800 [ 1105.099347][ T6576] lo speed is unknown, defaulting to 1000 [ 1105.553149][ T6661] RDS: rds_bind could not find a transport for ::ffff:172.20.20.170, load rds_tcp or rds_rdma? [ 1105.909045][ T6674] netlink: 36764 bytes leftover after parsing attributes in process `syz.2.7962'. [ 1106.111410][ T6676] netlink: 'syz.3.7961': attribute type 1 has an invalid length. [ 1106.299366][ T6683] netlink: 'syz.2.7964': attribute type 10 has an invalid length. [ 1106.313663][ T6684] netlink: 40 bytes leftover after parsing attributes in process `syz.3.7961'. [ 1106.558950][ T6676] 8021q: adding VLAN 0 to HW filter on device bond8 [ 1106.714507][ T6678] bond8: entered allmulticast mode [ 1106.750966][ T6683] 8021q: adding VLAN 0 to HW filter on device bond0 [ 1106.764476][ T6683] team0: Port device bond0 added [ 1106.900936][ T6693] netlink: 8 bytes leftover after parsing attributes in process `syz.2.7966'. [ 1107.015027][ T6707] netlink: 72 bytes leftover after parsing attributes in process `syz.3.7967'. [ 1107.188642][ T6713] netlink: 'syz.2.7969': attribute type 3 has an invalid length. [ 1107.201913][ T6714] x_tables: ip_tables: DNAT target: used from hooks POSTROUTING, but only usable from PREROUTING/OUTPUT [ 1107.226205][ T6713] netlink: 60 bytes leftover after parsing attributes in process `syz.2.7969'. [ 1107.270951][ T6713] netlink: 60 bytes leftover after parsing attributes in process `syz.2.7969'. [ 1107.351826][ T6723] netlink: 44 bytes leftover after parsing attributes in process `syz.1.7972'. [ 1107.425090][ T6727] netlink: 4 bytes leftover after parsing attributes in process `syz.4.7974'. [ 1107.457416][ T6725] netlink: 8 bytes leftover after parsing attributes in process `syz.0.7973'. [ 1107.469266][ T6728] netlink: 4 bytes leftover after parsing attributes in process `syz.4.7974'. [ 1108.304004][ T6765] openvswitch: netlink: IPv4 tun info is not correct [ 1108.316748][ T6765] batman_adv: batadv0: Adding interface: dummy0 [ 1108.327557][ T6765] batman_adv: batadv0: Not using interface dummy0 (retrying later): interface not active [ 1109.185767][ T6818] openvswitch: netlink: Key type 29 is not supported [ 1113.372620][ T6842] syz_tun: Device is already in use. [ 1113.582671][ T6863] bond6 (unregistering): Released all slaves [ 1113.683543][ T6864] xt_CT: You must specify a L4 protocol and not use inversions on it [ 1113.877228][ T6891] openvswitch: netlink: Flow actions attr not present in new flow. [ 1114.290172][ T6922] __nla_validate_parse: 11 callbacks suppressed [ 1114.290193][ T6922] netlink: 4 bytes leftover after parsing attributes in process `syz.0.8024'. [ 1114.310712][ T6922] netlink: 'syz.0.8024': attribute type 1 has an invalid length. [ 1114.322350][ T6922] netlink: 52 bytes leftover after parsing attributes in process `syz.0.8024'. [ 1114.422069][ T6929] netlink: 'syz.0.8026': attribute type 1 has an invalid length. [ 1115.053994][ T6957] netlink: 40 bytes leftover after parsing attributes in process `syz.4.8028'. [ 1115.543325][ T6968] batadv_slave_1: entered promiscuous mode [ 1115.644754][ T6975] siw: device registration error -23 [ 1115.699851][ T6975] netlink: 'syz.3.8034': attribute type 83 has an invalid length. [ 1115.877607][ C0] ip6_tunnel: ip6gretap1 xmit: Local address not yet configured! [ 1115.881806][ T1316] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1115.905765][ T6966] batadv_slave_1: left promiscuous mode [ 1116.204141][ T7001] openvswitch: netlink: IPv4 tun info is not correct [ 1116.323393][ T7006] netlink: 12 bytes leftover after parsing attributes in process `syz.3.8041'. [ 1116.348331][ T7003] netlink: 64 bytes leftover after parsing attributes in process `syz.2.8040'. [ 1116.762385][ T7028] netlink: 'syz.3.8045': attribute type 21 has an invalid length. [ 1117.086947][ T7040] IPVS: set_ctl: invalid protocol: 29 127.0.0.1:20003 [ 1117.121277][ T7003] nbd3: detected capacity change from 0 to 3 [ 1117.170742][ T6859] Buffer I/O error on dev nbd3, logical block 1, async page read [ 1117.193045][ T4950] block nbd3: Receive control failed (result -104) [ 1117.359365][ T3008] [ 1117.361744][ T3008] ====================================================== [ 1117.368758][ T3008] WARNING: possible circular locking dependency detected [ 1117.375769][ T3008] syzkaller #0 Not tainted [ 1117.380167][ T3008] ------------------------------------------------------ [ 1117.387161][ T3008] kworker/u8:14/3008 is trying to acquire lock: [ 1117.393389][ T3008] ffffffff8ea85640 (fs_reclaim){+.+.}-{0:0}, at: kmem_cache_alloc_node_noprof+0x4a/0x690 [ 1117.403213][ T3008] [ 1117.403213][ T3008] but task is already holding lock: [ 1117.410558][ T3008] ffff88808083aae0 (k-sk_lock-AF_INET6){+.+.}-{0:0}, at: inet_stream_connect+0x51/0xa0 [ 1117.420209][ T3008] [ 1117.420209][ T3008] which lock already depends on the new lock. [ 1117.420209][ T3008] [ 1117.430592][ T3008] [ 1117.430592][ T3008] the existing dependency chain (in reverse order) is: [ 1117.439718][ T3008] [ 1117.439718][ T3008] -> #7 (k-sk_lock-AF_INET6){+.+.}-{0:0}: [ 1117.447622][ T3008] lock_sock_nested+0x41/0x100 [ 1117.452907][ T3008] mptcp_sendmsg_fastopen+0x128/0x580 [ 1117.458808][ T3008] mptcp_sendmsg+0x1b0c/0x1dc0 [ 1117.464086][ T3008] ____sys_sendmsg+0x5c7/0x9f0 [ 1117.469357][ T3008] ___sys_sendmsg+0x2a5/0x360 [ 1117.474539][ T3008] __x64_sys_sendmsg+0x1bd/0x2a0 [ 1117.479992][ T3008] do_syscall_64+0x174/0x580 [ 1117.485105][ T3008] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1117.491511][ T3008] [ 1117.491511][ T3008] -> #6 (sk_lock-AF_INET6){+.+.}-{0:0}: [ 1117.499231][ T3008] lock_sock_nested+0x41/0x100 [ 1117.504506][ T3008] inet_shutdown+0x6a/0x390 [ 1117.509522][ T3008] nbd_mark_nsock_dead+0x2e9/0x560 [ 1117.515148][ T3008] recv_work+0x1c2e/0x1d40 [ 1117.520065][ T3008] process_scheduled_works+0xb5d/0x1860 [ 1117.526115][ T3008] worker_thread+0xa53/0xfc0 [ 1117.531209][ T3008] kthread+0x389/0x470 [ 1117.535781][ T3008] ret_from_fork+0x514/0xb70 [ 1117.540876][ T3008] ret_from_fork_asm+0x1a/0x30 [ 1117.546146][ T3008] [ 1117.546146][ T3008] -> #5 (&nsock->tx_lock){+.+.}-{4:4}: [ 1117.553774][ T3008] __mutex_lock+0x1a3/0x1550 [ 1117.558869][ T3008] nbd_queue_rq+0x37b/0x1100 [ 1117.563976][ T3008] blk_mq_dispatch_rq_list+0xa70/0x1910 [ 1117.570025][ T3008] __blk_mq_sched_dispatch_requests+0xdcc/0x1600 [ 1117.576864][ T3008] blk_mq_sched_dispatch_requests+0xd7/0x190 [ 1117.583347][ T3008] blk_mq_run_hw_queue+0x348/0x4f0 [ 1117.588963][ T3008] blk_mq_dispatch_list+0xd16/0xe10 [ 1117.594664][ T3008] blk_mq_flush_plug_list+0x48d/0x570 [ 1117.600539][ T3008] __blk_flush_plug+0x3ed/0x4d0 [ 1117.605894][ T3008] __submit_bio+0x28d/0x580 [ 1117.610903][ T3008] submit_bio_noacct_nocheck+0x2f4/0xa40 [ 1117.617070][ T3008] block_read_full_folio+0x599/0x830 [ 1117.622873][ T3008] filemap_read_folio+0x137/0x3b0 [ 1117.628404][ T3008] do_read_cache_folio+0x358/0x590 [ 1117.634027][ T3008] read_part_sector+0xb6/0x2b0 [ 1117.639296][ T3008] adfspart_check_ICS+0xb1/0x960 [ 1117.644738][ T3008] bdev_disk_changed+0x817/0x1770 [ 1117.650267][ T3008] blkdev_get_whole+0x380/0x510 [ 1117.655624][ T3008] bdev_open+0x31e/0xd30 [ 1117.660402][ T3008] blkdev_open+0x470/0x610 [ 1117.665332][ T3008] do_dentry_open+0x822/0x13a0 [ 1117.670603][ T3008] vfs_open+0x3b/0x340 [ 1117.675176][ T3008] path_openat+0x2e08/0x3860 [ 1117.680276][ T3008] do_file_open+0x23e/0x4a0 [ 1117.685289][ T3008] do_sys_openat2+0x113/0x200 [ 1117.690470][ T3008] __x64_sys_openat+0x138/0x170 [ 1117.695828][ T3008] do_syscall_64+0x174/0x580 [ 1117.700922][ T3008] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1117.707320][ T3008] [ 1117.707320][ T3008] -> #4 (&cmd->lock){+.+.}-{4:4}: [ 1117.714515][ T3008] __mutex_lock+0x1a3/0x1550 [ 1117.719608][ T3008] nbd_queue_rq+0xc6/0x1100 [ 1117.724619][ T3008] blk_mq_dispatch_rq_list+0xa70/0x1910 [ 1117.730667][ T3008] __blk_mq_sched_dispatch_requests+0xdcc/0x1600 [ 1117.737504][ T3008] blk_mq_sched_dispatch_requests+0xd7/0x190 [ 1117.743995][ T3008] blk_mq_run_hw_queue+0x348/0x4f0 [ 1117.749609][ T3008] blk_mq_dispatch_list+0xd16/0xe10 [ 1117.755313][ T3008] blk_mq_flush_plug_list+0x48d/0x570 [ 1117.761190][ T3008] __blk_flush_plug+0x3ed/0x4d0 [ 1117.766564][ T3008] __submit_bio+0x28d/0x580 [ 1117.771571][ T3008] submit_bio_noacct_nocheck+0x2f4/0xa40 [ 1117.777708][ T3008] block_read_full_folio+0x599/0x830 [ 1117.783503][ T3008] filemap_read_folio+0x137/0x3b0 [ 1117.789032][ T3008] do_read_cache_folio+0x358/0x590 [ 1117.794650][ T3008] read_part_sector+0xb6/0x2b0 [ 1117.799921][ T3008] adfspart_check_ICS+0xb1/0x960 [ 1117.805393][ T3008] bdev_disk_changed+0x817/0x1770 [ 1117.810928][ T3008] blkdev_get_whole+0x380/0x510 [ 1117.816377][ T3008] bdev_open+0x31e/0xd30 [ 1117.821123][ T3008] blkdev_open+0x470/0x610 [ 1117.826044][ T3008] do_dentry_open+0x822/0x13a0 [ 1117.831311][ T3008] vfs_open+0x3b/0x340 [ 1117.835884][ T3008] path_openat+0x2e08/0x3860 [ 1117.840981][ T3008] do_file_open+0x23e/0x4a0 [ 1117.845993][ T3008] do_sys_openat2+0x113/0x200 [ 1117.851174][ T3008] __x64_sys_openat+0x138/0x170 [ 1117.856537][ T3008] do_syscall_64+0x174/0x580 [ 1117.861634][ T3008] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1117.868030][ T3008] [ 1117.868030][ T3008] -> #3 (set->srcu){.+.+}-{0:0}: [ 1117.875139][ T3008] __synchronize_srcu+0xca/0x300 [ 1117.880579][ T3008] elevator_switch+0x1e8/0x7a0 [ 1117.885851][ T3008] elevator_change+0x2cc/0x450 [ 1117.891116][ T3008] elevator_set_default+0x36c/0x430 [ 1117.896837][ T3008] blk_register_queue+0x3e9/0x4e0 [ 1117.902388][ T3008] __add_disk+0x677/0xd50 [ 1117.907239][ T3008] add_disk_fwnode+0xfb/0x480 [ 1117.912430][ T3008] nbd_dev_add+0x72c/0xb50 [ 1117.917355][ T3008] nbd_init+0x168/0x1f0 [ 1117.922013][ T3008] do_one_initcall+0x250/0x870 [ 1117.927282][ T3008] do_initcall_level+0x104/0x190 [ 1117.932726][ T3008] do_initcalls+0x59/0xa0 [ 1117.937564][ T3008] kernel_init_freeable+0x2a6/0x3e0 [ 1117.943276][ T3008] kernel_init+0x1d/0x1d0 [ 1117.948115][ T3008] ret_from_fork+0x514/0xb70 [ 1117.953211][ T3008] ret_from_fork_asm+0x1a/0x30 [ 1117.958482][ T3008] [ 1117.958482][ T3008] -> #2 (&q->elevator_lock){+.+.}-{4:4}: [ 1117.966306][ T3008] __mutex_lock+0x1a3/0x1550 [ 1117.971416][ T3008] elevator_change+0x1b3/0x450 [ 1117.976688][ T3008] elevator_set_none+0xb5/0x140 [ 1117.982058][ T3008] blk_mq_update_nr_hw_queues+0x5e7/0x1a60 [ 1117.988375][ T3008] nbd_start_device+0x17f/0xb10 [ 1117.993737][ T3008] nbd_genl_connect+0x165b/0x1cf0 [ 1117.999268][ T3008] genl_family_rcv_msg_doit+0x22a/0x330 [ 1118.005328][ T3008] genl_rcv_msg+0x61c/0x7a0 [ 1118.010339][ T3008] netlink_rcv_skb+0x232/0x4b0 [ 1118.015609][ T3008] genl_rcv+0x28/0x40 [ 1118.020094][ T3008] netlink_unicast+0x75c/0x8e0 [ 1118.025364][ T3008] netlink_sendmsg+0x813/0xb40 [ 1118.030632][ T3008] ____sys_sendmsg+0x972/0x9f0 [ 1118.035902][ T3008] ___sys_sendmsg+0x2a5/0x360 [ 1118.041081][ T3008] __x64_sys_sendmsg+0x1bd/0x2a0 [ 1118.046522][ T3008] do_syscall_64+0x174/0x580 [ 1118.051617][ T3008] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1118.058012][ T3008] [ 1118.058012][ T3008] -> #1 (&q->q_usage_counter(io)#50){++++}-{0:0}: [ 1118.066602][ T3008] blk_alloc_queue+0x546/0x680 [ 1118.071870][ T3008] __blk_mq_alloc_disk+0x197/0x390 [ 1118.077485][ T3008] nbd_dev_add+0x499/0xb50 [ 1118.082414][ T3008] nbd_init+0x168/0x1f0 [ 1118.087075][ T3008] do_one_initcall+0x250/0x870 [ 1118.092354][ T3008] do_initcall_level+0x104/0x190 [ 1118.097816][ T3008] do_initcalls+0x59/0xa0 [ 1118.102754][ T3008] kernel_init_freeable+0x2a6/0x3e0 [ 1118.108464][ T3008] kernel_init+0x1d/0x1d0 [ 1118.113305][ T3008] ret_from_fork+0x514/0xb70 [ 1118.118405][ T3008] ret_from_fork_asm+0x1a/0x30 [ 1118.123679][ T3008] [ 1118.123679][ T3008] -> #0 (fs_reclaim){+.+.}-{0:0}: [ 1118.130877][ T3008] __lock_acquire+0x15a5/0x2cf0 [ 1118.136232][ T3008] lock_acquire+0x106/0x350 [ 1118.141239][ T3008] fs_reclaim_acquire+0x71/0x100 [ 1118.146683][ T3008] kmem_cache_alloc_node_noprof+0x4a/0x690 [ 1118.153005][ T3008] __alloc_skb+0x1d0/0x7d0 [ 1118.157932][ T3008] tcp_stream_alloc_skb+0x3f/0x580 [ 1118.163569][ T3008] tcp_connect+0x1570/0x5400 [ 1118.168677][ T3008] tcp_v6_connect+0x1295/0x1b10 [ 1118.174035][ T3008] __inet_stream_connect+0x25a/0xdd0 [ 1118.179830][ T3008] inet_stream_connect+0x66/0xa0 [ 1118.185277][ T3008] kernel_connect+0x141/0x1c0 [ 1118.190464][ T3008] rds_tcp_conn_path_connect+0x6f6/0x930 [ 1118.196604][ T3008] rds_connect_worker+0x1d8/0x290 [ 1118.202136][ T3008] process_scheduled_works+0xb5d/0x1860 [ 1118.208188][ T3008] worker_thread+0xa53/0xfc0 [ 1118.213282][ T3008] kthread+0x389/0x470 [ 1118.217854][ T3008] ret_from_fork+0x514/0xb70 [ 1118.222950][ T3008] ret_from_fork_asm+0x1a/0x30 [ 1118.228217][ T3008] [ 1118.228217][ T3008] other info that might help us debug this: [ 1118.228217][ T3008] [ 1118.238423][ T3008] Chain exists of: [ 1118.238423][ T3008] fs_reclaim --> sk_lock-AF_INET6 --> k-sk_lock-AF_INET6 [ 1118.238423][ T3008] [ 1118.251358][ T3008] Possible unsafe locking scenario: [ 1118.251358][ T3008] [ 1118.258792][ T3008] CPU0 CPU1 [ 1118.264147][ T3008] ---- ---- [ 1118.269494][ T3008] lock(k-sk_lock-AF_INET6); [ 1118.274154][ T3008] lock(sk_lock-AF_INET6); [ 1118.281164][ T3008] lock(k-sk_lock-AF_INET6); [ 1118.288350][ T3008] lock(fs_reclaim); [ 1118.292325][ T3008] [ 1118.292325][ T3008] *** DEADLOCK *** [ 1118.292325][ T3008] [ 1118.300446][ T3008] 4 locks held by kworker/u8:14/3008: [ 1118.305798][ T3008] #0: ffff888081527940 ((wq_completion)krds_cp_wq#18/0#4){+.+.}-{0:0}, at: process_scheduled_works+0xa35/0x1860 [ 1118.317717][ T3008] #1: ffffc900065bfc40 ((work_completion)(&(&cp->cp_conn_w)->work)){+.+.}-{0:0}, at: process_scheduled_works+0xa70/0x1860 [ 1118.330488][ T3008] #2: ffff888047228680 (&tc->t_conn_path_lock){+.+.}-{4:4}, at: rds_tcp_conn_path_connect+0x1cc/0x930 [ 1118.341519][ T3008] #3: ffff88808083aae0 (k-sk_lock-AF_INET6){+.+.}-{0:0}, at: inet_stream_connect+0x51/0xa0 [ 1118.351596][ T3008] [ 1118.351596][ T3008] stack backtrace: [ 1118.357469][ T3008] CPU: 1 UID: 0 PID: 3008 Comm: kworker/u8:14 Not tainted syzkaller #0 PREEMPT(full) [ 1118.357486][ T3008] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 1118.357495][ T3008] Workqueue: krds_cp_wq#18/0 rds_connect_worker [ 1118.357513][ T3008] Call Trace: [ 1118.357519][ T3008] [ 1118.357524][ T3008] dump_stack_lvl+0xe8/0x150 [ 1118.357541][ T3008] print_circular_bug+0x2e1/0x300 [ 1118.357560][ T3008] check_noncircular+0x12e/0x150 [ 1118.357579][ T3008] __lock_acquire+0x15a5/0x2cf0 [ 1118.357596][ T3008] ? finish_task_switch+0x15f/0xbe0 [ 1118.357612][ T3008] ? kmem_cache_alloc_node_noprof+0x4a/0x690 [ 1118.357630][ T3008] lock_acquire+0x106/0x350 [ 1118.357643][ T3008] ? kmem_cache_alloc_node_noprof+0x4a/0x690 [ 1118.357661][ T3008] ? ip6_dst_check+0xe2/0x7e0 [ 1118.357679][ T3008] fs_reclaim_acquire+0x71/0x100 [ 1118.357697][ T3008] ? kmem_cache_alloc_node_noprof+0x4a/0x690 [ 1118.357713][ T3008] kmem_cache_alloc_node_noprof+0x4a/0x690 [ 1118.357731][ T3008] ? ip6_default_advmss+0x80/0x3b0 [ 1118.357749][ T3008] ? __alloc_skb+0x1d0/0x7d0 [ 1118.357763][ T3008] __alloc_skb+0x1d0/0x7d0 [ 1118.357778][ T3008] tcp_stream_alloc_skb+0x3f/0x580 [ 1118.357793][ T3008] ? __asan_memset+0x22/0x50 [ 1118.357809][ T3008] tcp_connect+0x1570/0x5400 [ 1118.357836][ T3008] ? ktime_get_with_offset+0x93/0x2d0 [ 1118.357856][ T3008] ? __pfx_tcp_connect+0x10/0x10 [ 1118.357873][ T3008] ? seqcount_lockdep_reader_access+0xea/0x100 [ 1118.357893][ T3008] ? seqcount_lockdep_reader_access+0xec/0x100 [ 1118.357915][ T3008] ? __asan_memset+0x22/0x50 [ 1118.357932][ T3008] ? __pfx_tcp_fastopen_defer_connect+0x10/0x10 [ 1118.357951][ T3008] ? inet6_hash_connect+0xeb/0x170 [ 1118.357966][ T3008] tcp_v6_connect+0x1295/0x1b10 [ 1118.357980][ T3008] ? timerqueue_linked_add+0x287/0x2e0 [ 1118.358000][ T3008] ? __pfx_tcp_v6_connect+0x10/0x10 [ 1118.358013][ T3008] ? finish_task_switch+0x41f/0xbe0 [ 1118.358025][ T3008] ? lockdep_hardirqs_on+0x7a/0x110 [ 1118.358038][ T3008] ? finish_task_switch+0x41f/0xbe0 [ 1118.358051][ T3008] __inet_stream_connect+0x25a/0xdd0 [ 1118.358073][ T3008] ? do_raw_spin_lock+0x12b/0x2f0 [ 1118.358089][ T3008] ? lock_sock_nested+0x6a/0x100 [ 1118.358107][ T3008] ? __pfx___inet_stream_connect+0x10/0x10 [ 1118.358131][ T3008] ? inet_stream_connect+0x51/0xa0 [ 1118.358149][ T3008] ? __local_bh_enable_ip+0xd0/0x130 [ 1118.358164][ T3008] inet_stream_connect+0x66/0xa0 [ 1118.358183][ T3008] kernel_connect+0x141/0x1c0 [ 1118.358198][ T3008] ? lock_acquire+0x106/0x350 [ 1118.358212][ T3008] ? __pfx_kernel_connect+0x10/0x10 [ 1118.358232][ T3008] ? preempt_schedule_thunk+0x16/0x30 [ 1118.358252][ T3008] rds_tcp_conn_path_connect+0x6f6/0x930 [ 1118.358274][ T3008] ? __pfx_rds_tcp_conn_path_connect+0x10/0x10 [ 1118.358293][ T3008] ? process_scheduled_works+0xa70/0x1860 [ 1118.358310][ T3008] rds_connect_worker+0x1d8/0x290 [ 1118.358323][ T3008] ? process_scheduled_works+0xa70/0x1860 [ 1118.358337][ T3008] process_scheduled_works+0xb5d/0x1860 [ 1118.358361][ T3008] ? __pfx_process_scheduled_works+0x10/0x10 [ 1118.358377][ T3008] ? assign_work+0x3d5/0x5e0 [ 1118.358391][ T3008] worker_thread+0xa53/0xfc0 [ 1118.358414][ T3008] kthread+0x389/0x470 [ 1118.358431][ T3008] ? __pfx_worker_thread+0x10/0x10 [ 1118.358443][ T3008] ? __pfx_kthread+0x10/0x10 [ 1118.358459][ T3008] ret_from_fork+0x514/0xb70 [ 1118.358474][ T3008] ? __pfx_ret_from_fork+0x10/0x10 [ 1118.358488][ T3008] ? __switch_to+0xc79/0x1410 [ 1118.358506][ T3008] ? __pfx_kthread+0x10/0x10 [ 1118.358522][ T3008] ret_from_fork_asm+0x1a/0x30 [ 1118.358542][ T3008] [ 1118.831594][ T7046] pim6reg: entered allmulticast mode [ 1118.847797][ T7046] netlink: 4 bytes leftover after parsing attributes in process `syz.2.8048'. [ 1118.979173][ T7045] pim6reg: left allmulticast mode [ 1119.021516][ T7034] lo speed is unknown, defaulting to 1000