last executing test programs:

2m53.580527035s ago: executing program 2 (id=2222):
r0 = socket$nl_xfrm(0x10, 0x3, 0x6)
sendmsg$nl_xfrm(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000780)=@newsa={0x144, 0x10, 0x200, 0xbffffffe, 0x100, {{@in6=@initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, @in=@local, 0x1, 0x794, 0x4e23, 0x5, 0x0, 0x0, 0x0, 0x3a}, {@in6=@mcast2, 0x400004d4, 0x6c}, @in=@loopback, {0x0, 0x9, 0x6, 0xffff, 0x8251c, 0x2, 0xfffffffffffffff8}, {0xffffffffffffffff, 0x0, 0x1f, 0x1ff}, {0x2, 0xfffffffc}, 0x70bd2a, 0x3504, 0x2, 0x1, 0xfd, 0x20}, [@algo_comp={0x48, 0x3, {{'deflate\x00'}}}, @mark={0xc, 0x15, {0x35075a, 0x3}}]}, 0x144}, 0x1, 0x0, 0x0, 0x8801}, 0x10) (async)
r1 = socket$nl_xfrm(0x10, 0x3, 0x6)
r2 = socket$nl_xfrm(0x10, 0x3, 0x6)
sendmsg$nl_xfrm(r2, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000016c0)=@newsa={0x138, 0x10, 0x1, 0xfff7fffe, 0x100, {{@in6=@initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, @in6=@private1={0xfc, 0x1, '\x00', 0x1}, 0x1, 0x714, 0x4e23, 0x5, 0x0, 0x0, 0x0, 0x3a}, {@in6=@remote, 0x4d4, 0x6c}, @in=@dev={0xac, 0x14, 0x14, 0x27}, {0x0, 0x192, 0x6, 0xffff, 0x8251c, 0x2, 0xfffffffffffffff8}, {0xffffffffffffffff, 0x0, 0x2, 0xfffffffffffffffe}, {0x2, 0xfffffffc, 0x40}, 0x70bd2a, 0x3503, 0x2, 0x1, 0x0, 0x20}, [@algo_comp={0x48, 0x3, {{'deflate\x00'}}}]}, 0x138}, 0x1, 0x0, 0x0, 0x8801}, 0x0)
r3 = socket$nl_netfilter(0x10, 0x3, 0xc)
r4 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendmsg$NFT_BATCH(r4, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000a00000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010400000000000000000a0000000900010073797a31000000000900030073797a310000000034000000030a010400000000000000000a0000000900010073797a31000000000900030073797a320000000008000a000000000440000000060a010400000000000000000a0000000900010073797a31000000000900020073797a320000000014000480100001800c000100636f756e746572006c000000060a010400000000000000000a0000000900010073797a31000000000900020073797a310000000040000a"], 0x15c}}, 0x0)
sendmsg$IPCTNL_MSG_CT_NEW(r3, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000380)={0x8c, 0x0, 0x1, 0x401, 0x0, 0x1a14, {0x2, 0x0, 0x10}, [@CTA_TUPLE_ORIG={0x24, 0x1, 0x0, 0x1, [@CTA_TUPLE_IP={0x14, 0x1, 0x0, 0x1, @ipv4={{0x8, 0x1, @multicast1}, {0x8, 0x2, @multicast1}}}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5}}]}, @CTA_TUPLE_REPLY={0x38, 0x2, 0x0, 0x1, [@CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @empty}, {0x14, 0x4, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01'}}}, @CTA_TUPLE_ZONE={0x6, 0x3, 0x1, 0x0, 0x2}]}, @CTA_TIMEOUT={0x8, 0x7, 0x1, 0x0, 0x1}, @CTA_LABELS={0x14, 0x16, 0x1, 0x0, [0x2, 0x3, 0xc3, 0x3]}]}, 0x8c}}, 0x0) (async)
r5 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendmsg$IPCTNL_MSG_CT_NEW(r5, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000005c0)={0x3c, 0x0, 0x1, 0x101, 0x0, 0x0, {0x2, 0x0, 0x2}, [@CTA_LABELS={0x4}, @CTA_TUPLE_ORIG={0x24, 0x1, 0x0, 0x1, [@CTA_TUPLE_IP={0x14, 0x1, 0x0, 0x1, @ipv4={{0x8, 0x1, @multicast1}, {0x8, 0x2, @multicast1}}}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5}}]}]}, 0x3c}, 0x1, 0x0, 0x0, 0x4004881}, 0x20008820) (async)
sendmsg$nl_xfrm(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="3801000010000100feffffff00010000fe880000000000000000000000000001fc010000000000000000000000000001000107144e230005000000003a000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="ff020000000000000000000000000001000004d46c0000007f000001000000000000000000000000000000000000000092010000000000000600000000000000ffff0000000000001c250800000000000200000000000000f8ffffffffffffff2000000000000000ffffffffffffffff00000000000000001f00000000000000feffffffffffffff02000000fcffffff000000002abd700004350000020001002000000000000000480003006409666c61746500000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000cfd6019a3725ae0fdc0178d26ab11c8b613979c89948548b8a112f25f5ab0e95cb1bbd375fe2212f2985586ae675f64f2e3ace07cf6437f9fbb473e15c7d91e5268acfded61abc32ad9f4646885469a078631eea8cedf57eba3926eca4245f9c84a0ce0795ed5a8739ca4a63d506b16120a1d68ed535245a6c7b4d019a86192e57cdfd272a6410e5212e3d9e5f6d089afbc14e30875dda8f57419327177848b994304bdbb01c52415fa9cc488cd9628a24390d783278b97758b8cf0864fc56d42822c9cf03676fed8bc38eacd22b0c4c7d9f291c8b271f79624d04be609fc09fb16f24ef271df14130aadc934f9e44b0b334340fe89b1da4a44f1d297397055c8cc77c32"], 0x138}, 0x1, 0x0, 0x0, 0x8801}, 0x0)

2m53.209688802s ago: executing program 2 (id=2229):
r0 = socket$inet6_udp(0xa, 0x2, 0x0)
bind$inet6(r0, &(0x7f0000000500)={0xa, 0x4e20, 0xffffffff, @empty, 0x4}, 0x1c)
setsockopt$SO_ATTACH_FILTER(r0, 0x1, 0x1a, &(0x7f0000000200)={0x1, &(0x7f0000000000)=[{0x6, 0x9, 0x8}]}, 0x10)
setsockopt$SO_ATTACH_FILTER(0xffffffffffffffff, 0x1, 0x1a, 0x0, 0x0)
mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x2, 0x31, 0xffffffffffffffff, 0x6000)
r1 = socket$inet_tcp(0x2, 0x1, 0x0)
setsockopt$IP_VS_SO_SET_DELDEST(r1, 0x6, 0x9, &(0x7f00000004c0)={{0x2, @rand_addr=0x1, 0xdffd, 0x2, 'nq\x00', 0x8, 0x3, 0x3}, {@private=0xa010300, 0xfffd, 0x3, 0x8, 0x0, 0x2000040}}, 0x44)
getsockopt$inet_tcp_int(r1, 0x6, 0x9, 0x0, &(0x7f0000000040))
syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff)
r2 = socket$igmp6(0xa, 0x3, 0x2)
syz_emit_ethernet(0x2a, &(0x7f0000000000)={@multicast, @multicast, @void, {@ipv4={0x800, @igmp={{0x5, 0x4, 0x0, 0x4, 0x1c, 0x69, 0x0, 0x7, 0x2, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @dev={0xac, 0x14, 0x14, 0x29}}, {0x16, 0xff, 0x0, @empty}}}}}, 0x0)
r3 = socket$packet(0x11, 0x3, 0x300)
ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r3, 0x8933, &(0x7f0000000080)={'batadv0\x00', <r4=>0x0})
sendto$packet(r3, &(0x7f0000000000)="114353012008ba00000037510800", 0x5b, 0x4008005, &(0x7f00000000c0)={0x11, 0xd, r4, 0x1, 0x7, 0x6, @local}, 0x14)
setsockopt$IP6T_SO_SET_REPLACE(r2, 0x29, 0x40, &(0x7f0000019200)=@raw={'raw\x00', 0x8, 0x3, 0x4d8, 0x180, 0xffffffff, 0xffffffff, 0x0, 0xffffffff, 0x408, 0xffffffff, 0xffffffff, 0x408, 0xffffffff, 0x3, 0x0, {[{{@ipv6={@loopback, @mcast2, [], [], 'veth0_macvtap\x00', 'bridge0\x00'}, 0x0, 0x158, 0x180, 0x0, {}, [@common=@unspec=@helper={{0x48}}, @common=@inet=@iprange={{0x68}, {@ipv6=@initdev={0xfe, 0x88, '\x00', 0x1, 0x0}, @ipv4=@multicast2, @ipv6=@loopback, @ipv6=@empty}}]}, @common=@unspec=@NFQUEUE0={0x28}}, {{@ipv6={@remote, @ipv4={'\x00', '\xff\xff', @dev}, [], [], 'erspan0\x00', 'gre0\x00', {0xff}, {}, 0x0, 0x0, 0x0, 0x4b}, 0x0, 0x258, 0x288, 0x0, {}, [@common=@inet=@hashlimit1={{0x58}, {'pim6reg\x00', {0x0, 0x0, 0x5, 0x0, 0x0, 0x7, 0x3ff}}}, @common=@inet=@hashlimit3={{0x158}, {'vcan0\x00', {0x3, 0x0, 0x41, 0xfffffffe, 0x2, 0x1000, 0x6, 0x3}}}]}, @common=@unspec=@CONNMARK={0x30}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28, '\x00', 0x7}}}}, 0x538)
syz_emit_ethernet(0x5e, &(0x7f0000000340)={@random="e33110355bfc", @dev, @void, {@ipv6={0x86dd, @icmpv6={0x0, 0x6, "cb653e", 0x28, 0x3a, 0x1, @dev={0xfe, 0x80, '\x00', 0x2c}, @local, {[], @ndisc_redir={0x89, 0x0, 0x0, '\x00', @ipv4={'\x00', '\xff\xff', @private=0xa010102}, @private1}}}}}}, 0x0)
r5 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendmsg$NFT_BATCH(r5, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x1}}, [@NFT_MSG_NEWTABLE={0x28, 0x0, 0xa, 0x301, 0x0, 0x0, {0x1, 0x0, 0x4}, [@NFTA_TABLE_NAME={0x9, 0x1, 'syz1\x00'}, @NFTA_TABLE_FLAGS={0x8, 0x2, 0x1, 0x0, 0x3}]}, @NFT_MSG_NEWCHAIN={0x40, 0x3, 0xa, 0x201, 0x0, 0x0, {0x1}, [@NFTA_CHAIN_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_CHAIN_HOOK={0x14, 0x4, 0x0, 0x1, [@NFTA_HOOK_PRIORITY={0x8}, @NFTA_HOOK_HOOKNUM={0x5, 0x1, 0x1, 0x0, 0x5}]}, @NFTA_CHAIN_NAME={0x9, 0x3, 'syz2\x00'}]}, @NFT_MSG_DELCHAIN={0x30, 0x5, 0xa, 0x201, 0x0, 0x0, {0x1, 0x0, 0x2000}, [@NFTA_CHAIN_HANDLE={0xc, 0x2, 0x1, 0x0, 0x1}, @NFTA_CHAIN_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_CHAIN_HOOK={0x4}]}, @NFT_MSG_DELTABLE={0x14, 0x2, 0xa, 0x301, 0x0, 0x0, {0x0, 0x0, 0x6}}, @NFT_MSG_NEWFLOWTABLE={0x7c, 0x16, 0xa, 0x401, 0x0, 0x0, {0x5, 0x0, 0xa}, [@NFTA_FLOWTABLE_HANDLE={0xc, 0x5, 0x1, 0x0, 0x5}, @NFTA_FLOWTABLE_HOOK={0x44, 0x3, 0x0, 0x1, [@NFTA_FLOWTABLE_HOOK_DEVS={0x40, 0x3, 0x0, 0x1, [{0x14, 0x1, 'team_slave_0\x00'}, {0x14, 0x1, 'xfrm0\x00'}, {0x14, 0x1, 'syzkaller0\x00'}]}]}, @NFTA_FLOWTABLE_NAME={0x9, 0x2, 'syz2\x00'}, @NFTA_FLOWTABLE_TABLE={0x9, 0x1, 'syz0\x00'}]}], {0x14}}, 0x150}}, 0x0)
ioctl$BTRFS_IOC_DEV_INFO(r2, 0xd000941e, &(0x7f0000000540)={0x0, "df9e60bea752380063fc1a72d3004d88"})
syz_emit_ethernet(0x3e, &(0x7f0000000240)={@multicast, @multicast, @void, {@ipv6={0x86dd, @udp={0xa, 0x6, "0100", 0x8, 0x11, 0x1, @private2, @mcast2, {[], {0x4e21, 0x4e20, 0x8}}}}}}, 0x0)

2m52.84336691s ago: executing program 2 (id=2232):
r0 = openat$nci(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0)
r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10)
bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000500)=@bpf_tracing={0x1a, 0xf, &(0x7f0000000380)=ANY=[@ANYBLOB="1800000000000000000000000000000008110000"], &(0x7f0000000180)='GPL\x00', 0x0, 0x0, 0x0, 0x40f00, 0x20, '\x00', 0x0, 0x19, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x1, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x10, 0x2}, 0x94)
r2 = syz_genetlink_get_family_id$nfc(&(0x7f0000000100), r1)
ioctl$IOCTL_GET_NCIDEV_IDX(r0, 0x0, &(0x7f0000000380)=<r3=>0x0)
sendmsg$NFC_CMD_DEV_UP(r1, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000d80)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r2, @ANYBLOB="010426bd7000f8dbdf250200000008000100", @ANYRES32=r3], 0x1c}}, 0x4008054)
write$nci(r0, &(0x7f0000000500)=ANY=[@ANYBLOB="710502"], 0x13)
r4 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000040), r1)
sendmsg$IEEE802154_LLSEC_LIST_SECLEVEL(r1, &(0x7f0000000240)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x40}, 0xc, &(0x7f0000000140)={&(0x7f00000000c0)={0x14, r4, 0x1, 0x70bd2d, 0x25dfdbfb, {}, ["", "", "", "", "", "", ""]}, 0x14}, 0x1, 0x0, 0x0, 0x10}, 0x24000010)

2m49.653232334s ago: executing program 2 (id=2238):
r0 = socket$netlink(0x10, 0x3, 0xc)
socket$inet_tcp(0x2, 0x1, 0x0)
r1 = socket$inet6_tcp(0xa, 0x1, 0x0)
socket$netlink(0x10, 0x3, 0x4)
mmap(&(0x7f0000ffc000/0x1000)=nil, 0x1000, 0x2000000, 0x10, r1, 0x3d2000)
r2 = socket(0x28, 0x5, 0x0)
setsockopt$MRT6_ADD_MFC_PROXY(r2, 0x29, 0xd2, 0x0, 0x0)
getsockopt$inet_buf(r2, 0x0, 0x11, &(0x7f0000000180)=""/154, &(0x7f0000695ffc)=0xfffffca5)
sendto(r0, &(0x7f0000000000)="6800000030000505010000000000000000000000540001805000018009000100676174650000000040000280180002000000000000000000000000000000000000000000180005801400018008fff5000000000008000300640000000c000700e803000000000000", 0x68, 0x0, 0x0, 0x0)
r3 = socket$unix(0x1, 0x2, 0x0)
r4 = socket$nl_generic(0x10, 0x3, 0x10)
getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000180)={<r5=>0x0, 0x0, <r6=>0x0}, 0x0)
r7 = socket(0x15, 0x80005, 0x0)
r8 = syz_genetlink_get_family_id$tipc(&(0x7f0000002dc0), 0xffffffffffffffff)
r9 = socket$nl_generic(0x10, 0x3, 0x10)
r10 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000080), 0xffffffffffffffff)
sendmsg$IPVS_CMD_SET_CONFIG(r9, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000280)={0x1c, r10, 0x1, 0x0, 0x25dfdbfc, {}, [@IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8}]}, 0x1c}, 0x1, 0x0, 0x0, 0x1}, 0x90)
mmap(0x0, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
r11 = bpf$MAP_CREATE(0x0, &(0x7f0000000400)=@base={0x6, 0x4, 0x4, 0x4, 0x0, 0x1}, 0x50)
r12 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x1f, 0x14, &(0x7f00000002c0)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r11, @ANYBLOB="0000000000000000b7080000fcffffff7b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b7040000000000008500000003000000180100002020732500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000000400000095"], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x14, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90)
bpf$BPF_GET_BTF_INFO(0xf, &(0x7f0000001980)={r12, 0x20, &(0x7f0000001880)={0x0, 0x0, 0x0, &(0x7f0000000880)=""/4096, 0x1000}}, 0x10)
sendmsg$TIPC_CMD_SET_LINK_PRI(r4, &(0x7f0000000380)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f0000000340)={&(0x7f00000002c0)={0x68, r8, 0x800, 0x70bd2c, 0x25dfdbfb, {{}, {}, {0x4c, 0x18, {0x6, @link='broadcast-link\x00'}}}, [""]}, 0x68}, 0x1, 0x0, 0x0, 0x8001}, 0x8000)
sendmsg$IPVS_CMD_ZERO(r7, &(0x7f0000000180)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x8}, 0xc, &(0x7f0000000140)={&(0x7f00000000c0)={0x78, r10, 0x4, 0x70bd25, 0x25dfdbfe, {}, [@IPVS_CMD_ATTR_TIMEOUT_UDP={0x8, 0x6, 0xd7}, @IPVS_CMD_ATTR_DAEMON={0x38, 0x3, 0x0, 0x1, [@IPVS_DAEMON_ATTR_MCAST_PORT={0x0, 0x7, 0x4e23}, @IPVS_DAEMON_ATTR_MCAST_IFN={0x14, 0x2, 'wg1\x00'}, @IPVS_DAEMON_ATTR_STATE={0x8, 0x1, 0x2}, @IPVS_DAEMON_ATTR_MCAST_PORT={0x6, 0x7, 0x4e21}, @IPVS_DAEMON_ATTR_MCAST_TTL={0xfffffffffffffe8f, 0x8, 0x7}]}, @IPVS_CMD_ATTR_DAEMON={0x1c, 0x3, 0x0, 0x1, [@IPVS_DAEMON_ATTR_MCAST_GROUP={0x8, 0x5, @empty}, @IPVS_DAEMON_ATTR_SYNC_ID={0xfffffffffffffc1a, 0x3, 0x2}, @IPVS_DAEMON_ATTR_STATE={0x8}]}, @IPVS_CMD_ATTR_TIMEOUT_UDP={0x0, 0x6, 0x7fff}]}, 0x78}}, 0x517e1f82c02b5feb)
sendmsg$TIPC_CMD_RESET_LINK_STATS(r4, &(0x7f0000002e80)={0x0, 0x0, &(0x7f0000000440)={&(0x7f0000000480)=ANY=[@ANYRESHEX, @ANYRES32, @ANYRESDEC=r7, @ANYRES16=r6, @ANYRES16=r5, @ANYRESOCT=r9, @ANYRES32=r10], 0x28}, 0x1, 0x0, 0x0, 0x14}, 0x40)
sendmsg$IPVS_CMD_GET_SERVICE(r2, &(0x7f0000000340)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x8000}, 0xc, &(0x7f0000000300)={&(0x7f0000000500)={0x80, r10, 0x300, 0x70bd26, 0x25dfdbfe, {}, [@IPVS_CMD_ATTR_SERVICE={0x20, 0x1, 0x0, 0x1, [@IPVS_SVC_ATTR_FLAGS={0xc, 0x7, {0x0, 0x4}}, @IPVS_SVC_ATTR_FWMARK={0x8, 0x5, 0x3}, @IPVS_SVC_ATTR_PROTOCOL={0x6, 0x2, 0x1d}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5, 0x689}, @IPVS_CMD_ATTR_DAEMON={0x3c, 0x3, 0x0, 0x1, [@IPVS_DAEMON_ATTR_MCAST_IFN={0x14, 0x2, 'pimreg\x00'}, @IPVS_DAEMON_ATTR_SYNC_ID={0x8, 0x3, 0x2}, @IPVS_DAEMON_ATTR_STATE={0x8}, @IPVS_DAEMON_ATTR_MCAST_GROUP6={0x14, 0x6, @private0}]}]}, 0x80}, 0x1, 0x0, 0x0, 0x4008085}, 0x4)
bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0x14, &(0x7f0000000400)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b70400000000000085000000010000001801000020756c2500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000020850000000400000095"], 0x0, 0x0, 0x0, 0x0, 0x40f00, 0x40, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)
bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000002c0)={0x3, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="18020000c1001000000000001c000000850000000e"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x94)
r13 = bpf$PROG_LOAD(0x5, &(0x7f0000000680)={0x11, 0x14, &(0x7f0000000400)=ANY=[@ANYBLOB="180000000000000000000000000000001801000020646c2100000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000000000000b7030000000007008500000073"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, @fallback=0x18, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1000}, 0x94)
bpf$PROG_BIND_MAP(0xa, &(0x7f00000004c0)={r13}, 0xc)
connect$unix(r3, 0x0, 0x0)

2m49.269878632s ago: executing program 2 (id=2243):
r0 = bpf$MAP_CREATE(0x0, &(0x7f00000007c0)=@base={0xa, 0xb, 0x42, 0x3e, 0x42}, 0x50)
bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000300)={{r0, <r1=>0xffffffffffffffff}, &(0x7f0000000100), &(0x7f0000000180)}, 0x20)
r2 = bpf$MAP_CREATE(0x100000000000000, &(0x7f0000000440)=ANY=[@ANYBLOB="1400000004000000080000000600000000000000", @ANYRES32=0x1, @ANYBLOB="010100"/20, @ANYRES32=0x0, @ANYRES32, @ANYBLOB], 0x48)
r3 = socket$inet6(0xa, 0x80002, 0x0)
setsockopt$sock_int(r3, 0x1, 0xf, &(0x7f0000000180)=0x80000004, 0x4)
bind$inet6(r3, &(0x7f0000000040)={0xa, 0x0, 0x0, @empty}, 0x1c)
bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000340)={r2, &(0x7f0000000280), &(0x7f0000001840)=@udp6=r3}, 0x20)
ioctl$ifreq_SIOCGIFINDEX_team(r3, 0x8933, &(0x7f0000000340))
mmap(&(0x7f0000001000/0xc00000)=nil, 0xc00000, 0x0, 0x3032, 0xffffffffffffffff, 0x0)
bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f00000002c0)={{r1, <r4=>0xffffffffffffffff}, &(0x7f00000000c0), &(0x7f0000000280)}, 0x20)
close(0x3)
r5 = socket$nl_route(0x10, 0x3, 0x0)
ioctl$sock_inet_SIOCGIFDSTADDR(r5, 0x8917, &(0x7f0000000140)={'wlan1\x00', {0x2, 0x0, @private}})
bpf$MAP_CREATE(0x0, &(0x7f00000006c0)=ANY=[@ANYBLOB="0f00000004000000040000000400000000000000", @ANYRES32=0x1, @ANYBLOB="000003000000000009f562a3a9100000003a0000", @ANYRES32=0x0, @ANYRES32, @ANYBLOB='\x00'/28], 0x50)
bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000000)={0x11, 0xc, &(0x7f00000001c0)=@framed={{}, [@ringbuf_output={{0x18, 0x1, 0x1, 0x0, r4}, {}, {}, {}, {}, {}, {}, {0x85, 0x0, 0x0, 0x3}}]}, &(0x7f0000000240)='GPL\x00', 0x4, 0x7, &(0x7f00000014c0)=""/4101, 0x0, 0xc}, 0x94)

2m48.977625156s ago: executing program 2 (id=2247):
ioctl$XFS_IOC_PATH_TO_FSHANDLE(0xffffffffffffffff, 0xc0385868, &(0x7f0000000180)={0xffffffffffffffff, &(0x7f0000000000)='cgroup\x00', 0x101, 0x0, 0xf, 0x0, 0x0})
r0 = socket$inet_tcp(0x2, 0x1, 0x0)
setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000180)='syz_tun\x00', 0x10)
connect$inet(r0, &(0x7f0000000040)={0x2, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}}, 0x10)
close(0xffffffffffffffff)
ioctl$XFS_IOC_FSCOUNTS(0xffffffffffffffff, 0x80205871, &(0x7f0000000000))
socket(0x1d, 0x2, 0x1)
mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000140)='./cgroup.cpu/syz1\x00', 0x1ff)
r1 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000100)='./cgroup/syz1\x00', 0x200002, 0x0)
r2 = openat$cgroup_type(r1, &(0x7f0000000080), 0x2, 0x0)
write$cgroup_type(r2, &(0x7f00000000c0), 0x9)
r3 = openat$cgroup_procs(r1, &(0x7f00000002c0)='cgroup.threads\x00', 0x2, 0x0)
write$cgroup_pid(r3, &(0x7f0000000c40), 0x12)
r4 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0)
r5 = syz_init_net_socket$nfc_llcp(0x27, 0x1, 0x1)
bind$nfc_llcp(r5, &(0x7f0000001040)={0x27, 0x0, 0xffffffffffffffff, 0x5, 0x0, 0x0, "d92984bd1ca44c226af5160e961711a077609475b78411e88509de050000000000f2170e65e3f50327e422000000000000000000000200000000001900", 0x3c}, 0x60)
listen(r5, 0xf5f)
accept(r5, 0x0, 0x0)
r6 = openat$cgroup_ro(r4, &(0x7f0000000040)='cgroup.freeze\x00', 0x275a, 0x0)
write$cgroup_int(r6, &(0x7f0000000200)=0x1, 0x12)
ioctl$sock_inet_SIOCDARP(r0, 0x8953, &(0x7f0000000300)={{0x2, 0x4e23, @initdev={0xac, 0x1e, 0x0, 0x0}}, {0x1}, 0x16, {0x2, 0x4e22, @initdev={0xac, 0x1e, 0x1, 0x0}}, 'syz_tun\x00'})
r7 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0)
r8 = openat$cgroup_subtree(r7, &(0x7f0000000040), 0x2, 0x0)
write$cgroup_subtree(r8, &(0x7f0000000080)=ANY=[@ANYBLOB="2bcd673c4fe9611d522ae381a275e6a7c66370752090be13d371d1bcac567aa58e85a67f473041d8057222255f366c23a1705df055b840be61320e4de6149274b8b8b346a90723c6a0819464eeb67403f638de6954fbbf6c70ce511346e7f9cf18696c37d9b93c78cf3ea6f1f7d772708bc881f078e7888592ca874992272c8c09cfffed0e57ccbb113de5aa46b78aa15b97dac7dc5bb6d1a7ff4f2d6a52ab1f219f595394b980e80f8ec21fde8405c59026937fa5d2"], 0x5)

2m33.928542908s ago: executing program 32 (id=2247):
ioctl$XFS_IOC_PATH_TO_FSHANDLE(0xffffffffffffffff, 0xc0385868, &(0x7f0000000180)={0xffffffffffffffff, &(0x7f0000000000)='cgroup\x00', 0x101, 0x0, 0xf, 0x0, 0x0})
r0 = socket$inet_tcp(0x2, 0x1, 0x0)
setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000180)='syz_tun\x00', 0x10)
connect$inet(r0, &(0x7f0000000040)={0x2, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}}, 0x10)
close(0xffffffffffffffff)
ioctl$XFS_IOC_FSCOUNTS(0xffffffffffffffff, 0x80205871, &(0x7f0000000000))
socket(0x1d, 0x2, 0x1)
mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000140)='./cgroup.cpu/syz1\x00', 0x1ff)
r1 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000100)='./cgroup/syz1\x00', 0x200002, 0x0)
r2 = openat$cgroup_type(r1, &(0x7f0000000080), 0x2, 0x0)
write$cgroup_type(r2, &(0x7f00000000c0), 0x9)
r3 = openat$cgroup_procs(r1, &(0x7f00000002c0)='cgroup.threads\x00', 0x2, 0x0)
write$cgroup_pid(r3, &(0x7f0000000c40), 0x12)
r4 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0)
r5 = syz_init_net_socket$nfc_llcp(0x27, 0x1, 0x1)
bind$nfc_llcp(r5, &(0x7f0000001040)={0x27, 0x0, 0xffffffffffffffff, 0x5, 0x0, 0x0, "d92984bd1ca44c226af5160e961711a077609475b78411e88509de050000000000f2170e65e3f50327e422000000000000000000000200000000001900", 0x3c}, 0x60)
listen(r5, 0xf5f)
accept(r5, 0x0, 0x0)
r6 = openat$cgroup_ro(r4, &(0x7f0000000040)='cgroup.freeze\x00', 0x275a, 0x0)
write$cgroup_int(r6, &(0x7f0000000200)=0x1, 0x12)
ioctl$sock_inet_SIOCDARP(r0, 0x8953, &(0x7f0000000300)={{0x2, 0x4e23, @initdev={0xac, 0x1e, 0x0, 0x0}}, {0x1}, 0x16, {0x2, 0x4e22, @initdev={0xac, 0x1e, 0x1, 0x0}}, 'syz_tun\x00'})
r7 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0)
r8 = openat$cgroup_subtree(r7, &(0x7f0000000040), 0x2, 0x0)
write$cgroup_subtree(r8, &(0x7f0000000080)=ANY=[@ANYBLOB="2bcd673c4fe9611d522ae381a275e6a7c66370752090be13d371d1bcac567aa58e85a67f473041d8057222255f366c23a1705df055b840be61320e4de6149274b8b8b346a90723c6a0819464eeb67403f638de6954fbbf6c70ce511346e7f9cf18696c37d9b93c78cf3ea6f1f7d772708bc881f078e7888592ca874992272c8c09cfffed0e57ccbb113de5aa46b78aa15b97dac7dc5bb6d1a7ff4f2d6a52ab1f219f595394b980e80f8ec21fde8405c59026937fa5d2"], 0x5)

4.494051453s ago: executing program 1 (id=3425):
r0 = socket$nl_route(0x10, 0x3, 0x0)
ioctl$ifreq_SIOCGIFINDEX_team(r0, 0x8933, &(0x7f0000000280)={'team0\x00', <r1=>0x0})
r2 = socket(0x1e, 0x5, 0x0)
r3 = socket$inet_udp(0x2, 0x2, 0x0)
bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f0000002380)={0xffffffffffffffff, 0x0, 0x2d, 0x0, @val=@netfilter={0x2, 0x4, 0x600, 0x1}}, 0x20)
bind$inet(r3, 0x0, 0x0)
sendmsg$nl_generic(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000240)={0x0}, 0x1, 0x0, 0x0, 0x4008}, 0x4044810)
setsockopt$sock_int(r3, 0x1, 0x6, &(0x7f0000000000)=0x4, 0x4)
connect$inet(r3, &(0x7f0000000280)={0x2, 0x0, @broadcast}, 0x10)
r4 = socket$pppl2tp(0x18, 0x1, 0x1)
connect$pppl2tp(r4, &(0x7f0000000140)=@pppol2tpin6={0x18, 0x1, {0x0, r3, 0x1, 0x0, 0x0, 0x0, {0xa, 0x0, 0x4000000, @mcast1}}}, 0x32)
sendmmsg(r4, &(0x7f0000004380)=[{{0x0, 0x0, 0x0}}], 0x34000, 0x0)
setsockopt$packet_tx_ring(r2, 0x10f, 0x87, &(0x7f0000000040)=@req3={0x80000000}, 0xfeda)
sendmsg$tipc(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, 0x0}, 0x0)
setsockopt$packet_tx_ring(0xffffffffffffffff, 0x10f, 0x87, &(0x7f00000000c0)=@req3={0x80000000, 0x0, 0x2}, 0x1c)
r5 = socket$nl_xfrm(0x10, 0x3, 0x6)
sendmsg$nl_xfrm(r5, &(0x7f00000035c0)={0x0, 0x0, &(0x7f0000003580)={&(0x7f0000000380)=@newsa={0x264, 0x10, 0x1, 0x0, 0x0, {{@in6=@private1, @in6=@remote, 0x0, 0xfff7, 0x2000, 0x1, 0x0, 0x0, 0x0, 0x3b, 0x0, 0xffffffffffffffff}, {@in=@rand_addr=0x64010102, 0x4d4, 0x6c}, @in6=@remote, {0x3, 0x0, 0x0, 0x0, 0x3, 0x0, 0x4}, {0x800000000000, 0x4, 0x40000000}, {}, 0x470bd25, 0x3506, 0x2, 0x0, 0x1}, [@algo_comp={0x6d, 0x3, {{'deflate\x00'}, 0x128, "72991bef5ac111808fa3786dc4d84015ff0100008061669e4e172c34d813cf7aeeedd5b590"}}, @algo_crypt={0x104, 0x2, {{'ecb(arc4)\x00'}, 0x5e0, "726659a753d7219ab5466bbf988e1c6765a272f406e997ad7ccecbe5e7c7365191c708be2002f4cbf2dd05903542d1116585cebedd0414c45a5c9240026c9bda869e317aa71e34b8dbcfbf0f64959dbc3477b599ba8d1aace2c045a9411342a722b8e066ec812307a162d16fb8cf2db425ad58e46d30a4306ae4de598bcc122bcfc998e37f1ab18d4199242769bb6c53fbdd5d00ab69768c6c50f75c264a371a9cd9bc3a32a8e109e6b35445fdf018125a991ef00b6a8583699c7560"}}]}, 0x264}}, 0x4810)
sendmsg$tipc(0xffffffffffffffff, 0x0, 0x20040001)
mmap(&(0x7f0000002000/0x2000)=nil, 0x2000, 0x8, 0x32, 0xffffffffffffffff, 0x0)
ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000180)={'geneve0\x00'})
sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x0)
r6 = socket$nl_route(0x10, 0x3, 0x0)
write(0xffffffffffffffff, &(0x7f0000000100), 0x0)
sendmsg$nl_route(r6, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000100)=ANY=[@ANYBLOB="50000000100001060100000000000000000000006400000000000000000000000c00030076786c616e300000240012800c00010076786c616e0000001400028005001900010000"], 0x50}}, 0x0)
sendmsg$nl_route(r6, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000300)=ANY=[@ANYBLOB="2c000000780001040200000000000000070000006400000014000180080003006400000008000200c8"], 0x2c}}, 0x0)
ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000340)={'geneve0\x00', <r7=>0x0})
sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000040)=@newlink={0x44, 0x10, 0xffffffffffffffff, 0x70bd26, 0x25dfdbf9, {0x0, 0x0, 0x0, 0x0, 0x3951d, 0x4b7bc}, [@IFLA_MASTER={0x8, 0xa, r1}, @IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @ipvlan={{0xb}, {0x4}}}, @IFLA_LINK={0x8, 0x5, r7}]}, 0x44}, 0x1, 0x0, 0x0, 0x24004854}, 0x8000002)

3.969723343s ago: executing program 1 (id=3429):
r0 = socket$nl_route(0x10, 0x3, 0x0)
ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000040)={'geneve0\x00'})
sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000140)=@newlink={0x58, 0x10, 0x401, 0x70bd28, 0x1, {0x0, 0x0, 0x0, 0x0, 0x8, 0x10001}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @macvtap={{0xc}, {0x4}}}, @IFLA_PHYS_SWITCH_ID={0x19, 0x24, "51c9ae402dd1f645ed048aba2e84b1bbd058931de0"}, @IFLA_MTU={0x8, 0x4, 0x800}]}, 0x58}, 0x1, 0x0, 0x0, 0x240008c4}, 0x0)

3.510822758s ago: executing program 1 (id=3433):
r0 = socket$inet6_tcp(0xa, 0x1, 0x0)
setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r0, 0x6, 0x14, &(0x7f0000000280)=0x1, 0x4)
connect$inet6(r0, &(0x7f0000000080)={0xa, 0x0, 0x0, @ipv4={'\x00', '\xff\xff', @remote}}, 0x1c)
sendmmsg$inet6(r0, &(0x7f0000003180)=[{{0x0, 0x0, &(0x7f0000000740)=[{&(0x7f00000007c0)="d9", 0x1}], 0x1}}], 0x1, 0x8800)
getsockopt$inet6_tcp_TCP_ZEROCOPY_RECEIVE(r0, 0x6, 0x23, &(0x7f0000000140)={&(0x7f0000ffc000/0x1000)=nil, 0x1000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, &(0x7f0000000000)=0x40)

2.782067277s ago: executing program 3 (id=3440):
r0 = socket$inet6_tcp(0xa, 0x1, 0x0)
setsockopt$inet6_IPV6_FLOWLABEL_MGR(r0, 0x29, 0x1b, &(0x7f0000000240)={@remote, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x20)
setsockopt$inet6_IPV6_FLOWLABEL_MGR(r0, 0x29, 0x1b, &(0x7f00000000c0)={@remote={0xfe, 0x80, '\x00', 0xffffffffffffffff}}, 0x20) (async)
r1 = socket$inet6_tcp(0xa, 0x1, 0x0)
setsockopt$inet6_mreq(r1, 0x29, 0x1b, &(0x7f0000000200)={@dev}, 0x14) (async)
r2 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000140)=@mpls_delroute={0x28, 0x18, 0x9, 0x0, 0x0, {0x1c, 0x14, 0x0, 0x0, 0xfe, 0x0, 0x0, 0x1}, [@RTA_MULTIPATH={0xc, 0x12, {0x2}}]}, 0x28}}, 0x0)
syz_genetlink_get_family_id$ipvs(&(0x7f0000000000), 0xffffffffffffffff) (async)
ioctl$sock_SIOCGIFVLAN_GET_VLAN_REALDEV_NAME_CMD(r2, 0x8982, &(0x7f0000000040)={0x8, 'gre0\x00', {'lo\x00'}, 0x1})

2.565520826s ago: executing program 3 (id=3442):
socket$nl_generic(0x10, 0x3, 0x10)
r0 = openat$nci(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0)
r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10)
socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000240)={<r2=>0xffffffffffffffff})
r3 = socket$nl_generic(0x10, 0x3, 0x10)
r4 = syz_genetlink_get_family_id$fou(&(0x7f00000001c0), 0xffffffffffffffff)
sendmsg$FOU_CMD_GET(r3, &(0x7f00000005c0)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000500)={0x2c, r4, 0x5, 0x70bd2d, 0x25dfdbfc, {}, [@FOU_ATTR_LOCAL_V4={0x8, 0x6, @initdev={0xac, 0x1e, 0x1, 0x0}}, @FOU_ATTR_PORT={0x6, 0x1, 0x4e22}, @FOU_ATTR_IFINDEX={0x8}]}, 0x2c}, 0x1, 0x0, 0x0, 0x40}, 0x400c090)
socket$packet(0x11, 0x2, 0x300)
recvmmsg(r2, &(0x7f0000002040)=[{{&(0x7f0000000280)=@rxrpc=@in4={0x21, 0x0, 0x2, 0x10, {0x2, 0x0, @dev}}, 0x80, &(0x7f0000000f80)=[{&(0x7f0000000300)=""/55, 0x37}, {&(0x7f00000008c0)=""/230, 0xe6}, {&(0x7f00000009c0)=""/227, 0xe3}, {&(0x7f0000000ac0)=""/71, 0x47}, {&(0x7f0000000b40)=""/192, 0xc0}, {&(0x7f0000000c00)=""/126, 0x7e}, {&(0x7f0000000c80)=""/222, 0xde}, {&(0x7f0000000e00)=""/244, 0xf4}, {&(0x7f0000000f00)=""/53, 0x35}, {&(0x7f0000000f40)}], 0xa, &(0x7f0000001040)=""/4096, 0x1000}, 0x80000000}], 0x1, 0xa001, &(0x7f0000002080))
bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000880)={&(0x7f0000000080)=ANY=[@ANYBLOB="9feb010018000000000000002400000024000000020000000000000000000002030000000000000000000009000000000000000000000009"], 0x0, 0x3e}, 0x28)
socket$nl_generic(0x10, 0x3, 0x10)
r5 = syz_genetlink_get_family_id$nfc(&(0x7f0000000100), r1)
ioctl$IOCTL_GET_NCIDEV_IDX(r0, 0x0, &(0x7f00000000c0)=<r6=>0x0)
r7 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='memory.events\x00', 0x275a, 0x0)
mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x2000001, 0x12, r7, 0x0)
getsockopt$bt_BT_POWER(r7, 0x112, 0x9, &(0x7f0000000040)=0x8, &(0x7f0000000180)=0x1)
bpf$PROG_LOAD(0x5, &(0x7f0000000780)={0x5, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="18090000000000000000000000000000850000007d0000001801000020696c2500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000007000000095"], 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x2a, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x1ff}, 0x94)
bpf$PROG_LOAD(0x5, &(0x7f0000000680)={0x11, 0x14, &(0x7f0000000400)=ANY=[@ANYBLOB="180000000000000000000000000000001801000020646c2100000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb7"], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)
sendmsg$NFC_CMD_DEV_UP(r1, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000d80)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r5, @ANYBLOB="010426bd7000f8dbdf250200000008000100", @ANYRES32=r6], 0x1c}}, 0x4008054)
write$nci(r0, &(0x7f0000000240)=ANY=[@ANYBLOB='p\x00\t'], 0xc)
write$nci(r0, &(0x7f0000000dc0)=ANY=[@ANYBLOB="400104"], 0x14)
r8 = socket(0x1e, 0x4, 0x0)
write$nci(r0, &(0x7f0000000140)=ANY=[@ANYBLOB="5001", @ANYRES8=r1, @ANYRES16=r8], 0x14)

2.530987697s ago: executing program 1 (id=3444):
r0 = socket$netlink(0x10, 0x3, 0x0)
r1 = socket$inet_udp(0x2, 0x2, 0x0)
setsockopt$IPT_SO_SET_REPLACE(r1, 0x0, 0x40, &(0x7f0000000300)=@filter={'filter\x00', 0xe, 0x4, 0x290, 0xffffffff, 0x0, 0x98, 0x130, 0xffffffff, 0xffffffff, 0x0, 0x98, 0x1f8, 0xffffffff, 0x4, 0x0, {[{{@uncond, 0x0, 0x70, 0x98}, @common=@unspec=@STANDARD={0x28, '\x00', 0x0, 0xfffffffe}}, {{@uncond, 0x0, 0x70, 0x98}, @common=@unspec=@STANDARD={0x28, '\x00', 0x0, 0xfffffffe}}, {{@ip={@empty, @empty, 0x0, 0x0, '\x00', '\x00', {}, {}, 0x11}, 0x0, 0xa0, 0xc8, 0x0, {}, [@common=@inet=@l2tp={{0x30}, {0x1, 0x1, 0x2, 0x1, 0x9}}]}, @common=@unspec=@STANDARD={0x28, '\x00', 0x0, 0xfffffffe}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x2f0)
sendto$inet(r1, &(0x7f00000000c0)="3f6a0100", 0x4, 0x0, &(0x7f0000000200)={0x2, 0x1231, @empty}, 0x10)
r2 = socket$packet(0x11, 0x3, 0x300)
r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0)
ioctl$TUNSETIFF(r3, 0x400454ca, &(0x7f0000000080)={'syzkaller0\x00', 0x7101})
r4 = socket$unix(0x1, 0x1, 0x0)
ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', <r5=>0x0})
r6 = socket(0x400000000010, 0x3, 0x0)
r7 = socket$unix(0x1, 0x5, 0x0)
ioctl$sock_SIOCGIFINDEX(r7, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', <r8=>0x0})
r9 = socket(0x10, 0x3, 0x0)
sendmsg$nl_route_sched(r9, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000300)=@newqdisc={0x88, 0x24, 0xf0b, 0xf0bd26, 0x0, {0x0, 0x0, 0x0, r8, {0x0, 0xffff}, {0xffff, 0xffff}, {0x0, 0x1}}, [@qdisc_kind_options=@q_mqprio={{0xb}, {0x58, 0x2, {{0x1, [], 0x0, [0x1, 0x2, 0xfffe, 0x0, 0x0, 0x0, 0x10, 0x8, 0x0, 0x5c4, 0x8000, 0x0, 0x0, 0x3dc], [0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1000]}}}}]}, 0x88}}, 0x20000000)
sendmsg$nl_route_sched(r6, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000540)={&(0x7f0000000340)=@newqdisc={0x24, 0x29, 0x4ee4e6a52ff56541, 0x4001, 0xfffdfdfc, {0x0, 0x0, 0x0, r5, {0x2}, {0xe, 0xffff}, {0xffff, 0xc}}}, 0x24}}, 0x44840)
sendmsg$nl_generic(0xffffffffffffffff, 0x0, 0x0)
setsockopt$packet_tx_ring(r2, 0x107, 0xd, &(0x7f0000000080)=@req={0x800000, 0x1, 0x1000, 0x800}, 0x10)
r10 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendmsg$IPSET_CMD_CREATE(r10, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000040)=ANY=[@ANYBLOB="5c0000000206010200000000000000000700952e050004000100000005000100070000008c000780080006000000000005000500020000000900020073797a300000000016000300686173683a6e65742c706f72742c6e6574000000"], 0x5c}}, 0x0)
sendto$packet(r2, 0x0, 0x0, 0x0, &(0x7f0000000100)={0x11, 0x0, 0x1, 0x1, 0x0, 0x0}, 0x14)
sendmsg$nl_route(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000600)=ANY=[@ANYBLOB="3c00000010000305ffffffff0000000000000000", @ANYRES32=0x0, @ANYBLOB="15010000a10001001c00128009000100626f46b698346e64000000000c00028008000400286c0345a84b43da4f1e6eed3a910615a8ca64d23ba8e1fa923cf62d5cd6168a62e7068ed026c62a3663aba7a6e4f237a5dd3caa11ab233e4bd65e122eaa23594676718c4adb7a9e3ff48d896133fa9ffd"], 0x3c}}, 0x8000000)

2.449106196s ago: executing program 0 (id=3445):
r0 = socket$netlink(0x10, 0x3, 0x0)
r1 = socket(0x10, 0x803, 0x0)
sendmsg$NL80211_CMD_CRIT_PROTOCOL_START(r1, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000540)={0x0, 0x1c}}, 0x0)
getsockname$packet(r1, &(0x7f0000000600)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000080)=0x14)
sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000000c0)=ANY=[@ANYBLOB="3c0000001000850600000000ff6122314a000800", @ANYRESOCT=r1, @ANYBLOB="00001000252155b21c0012000c000100626f6e64000000000c0002000800010001"], 0x3c}}, 0x719e7f81a9bd2164)
mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.cpu/syz0\x00', 0x1ff)
r2 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0)
openat$cgroup_ro(r2, &(0x7f00000004c0)='memory.events\x00', 0x275a, 0x0)
r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10)
r4 = syz_genetlink_get_family_id$netlbl_mgmt(&(0x7f0000000040), r3)
socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000140)={<r5=>0xffffffffffffffff, <r6=>0xffffffffffffffff})
bpf$PROG_LOAD(0x5, 0x0, 0x0)
recvmsg$unix(r5, 0x0, 0x0)
sendmsg$inet(r6, 0x0, 0x200440c4)
bpf$MAP_CREATE(0x0, &(0x7f0000000200)=@base={0x4, 0x4, 0x4, 0x12, 0x0, 0xffffffffffffffff, 0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, 0x0, 0xfffffffd}, 0x50)
bpf$PROG_LOAD_XDP(0x5, 0x0, 0x0)
sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000440)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000100)=ANY=[@ANYBLOB="3800000010002ba99979f4474eec0000000e0000c045775f6fdbc5ee6f3f14a6a40a7fc5803974b5263829356b93225c9665d067ec4c0df36f4f8c139966810fa9404439efa536c3a3c84800"/87, @ANYRES32, @ANYBLOB="1100030000000000180012800b00010069703667726500000800028004"], 0x38}, 0x1, 0x0, 0x0, 0x40000}, 0x4000000)
r7 = socket$inet_udp(0x2, 0x2, 0x0)
sendmsg$NL80211_CMD_FRAME(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000fc0)={&(0x7f0000000080)=ANY=[@ANYBLOB='4\x00\x00\x00', @ANYRES16, @ANYBLOB="01002bbd7000000000000200000008000300", @ANYRES32, @ANYBLOB="08002700020001000800a0"], 0x34}}, 0x0)
setsockopt$ARPT_SO_SET_ADD_COUNTERS(r7, 0x0, 0x60, &(0x7f0000000080)={'filter\x00', 0x1058, [{0xa00}, {0x0, 0x100000000000000}]}, 0xa50)
sendmsg$NLBL_MGMT_C_ADDDEF(r3, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000140)=ANY=[@ANYBLOB='L\x00\x00\x00', @ANYRES16=r4, @ANYBLOB="01000000000000000000040000001400050003030000000a0000005dc00006000000080002000500000014000600ff01000a00f2f3f31f000a0000000001060001"], 0x4c}, 0x1, 0x0, 0x0, 0x8004}, 0x4040000)
r8 = bpf$ITER_CREATE(0xb, &(0x7f0000000100), 0x0)
close(r8)
syz_open_procfs$namespace(0xffffffffffffffff, &(0x7f0000000300)='ns/net\x00')
r9 = bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f00000003c0)=@bpf_lsm={0x1e, 0x3, &(0x7f00000000c0)=ANY=[@ANYBLOB="1800000000000000000000000000000095"], &(0x7f0000000280)='GPL\x00', 0x0, 0x0, 0x0, 0x41100, 0x20, '\x00', 0x0, 0x24}, 0x94)
setsockopt$SO_J1939_FILTER(r8, 0x6b, 0x1, &(0x7f0000000640)=[{0x2, 0x2, {0x2, 0xfe}, {0x2, 0xff}, 0xfd, 0xff}, {0x2, 0x2, {0x1, 0xf0, 0x1}, {0x1, 0x0, 0x4}, 0xfe}, {0xffffffffffffffff, 0x0, {}, {0x0, 0xff, 0x4}, 0xfd}, {0x0, 0x0, {0x0, 0x0, 0x1}, {0x2, 0xff, 0x2}, 0xfe, 0xfd}, {0x3, 0x2, {0x1, 0x0, 0x3}, {0x2, 0xf0, 0x1}, 0x1, 0xff}, {0x3, 0x1, {0x0, 0x0, 0x1}, {0x0, 0x0, 0x3}, 0x0, 0x2}, {0x0, 0x2, {0x2, 0xf0, 0x1}, {0x1, 0xf0, 0x4}, 0xfd, 0x2}, {0x2, 0x3, {0x0, 0xf0, 0x2}, {0x1, 0x0, 0x2}}, {0x3, 0x2, {0x1, 0xff, 0x2}, {0x1, 0xff, 0x1}, 0x1, 0xfe}, {0x2, 0x1, {0x1, 0x0, 0x2}, {0x1, 0xff, 0x1}, 0xff}], 0x140)
bpf$BPF_PROG_TEST_RUN(0x1c, &(0x7f00000005c0)={r9, 0x0, 0x24, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, 0xa)
ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, 0x0)
syz_emit_ethernet(0x36, &(0x7f0000000340)=ANY=[@ANYBLOB="aaaaaaaaaaaaaaaaaaaaaa1b080045f40028006700000206907864010101ac1414aa00004e22", @ANYRES32=0x41424344, @ANYRES32=0x41424344, @ANYBLOB="5cc2000090780000abea6edcfe5155a6cc35372f4e941c29"], 0x0)
connect$inet(0xffffffffffffffff, 0x0, 0x0)

2.289215427s ago: executing program 4 (id=3446):
sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000480)=ANY=[], 0x18}}, 0x20004000)
sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000080)={0x0, 0x48}, 0x1, 0x0, 0x0, 0x10}, 0x0)
sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000100)=@newqdisc={0x44, 0x24, 0x800, 0x70bd29, 0x25dfdc00, {0x60, 0x0, 0x0, 0x0, {0x8, 0xfff2}, {0x1, 0xc}, {0x8, 0x8}}, [@qdisc_kind_options=@q_cake={{0x9}, {0x14, 0x2, [@TCA_CAKE_MEMORY={0x8, 0xa, 0x80000000}, @TCA_CAKE_INGRESS={0x8, 0xf, 0x1}]}}]}, 0x44}, 0x1, 0x0, 0x0, 0x44045}, 0x10)
sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000100)=ANY=[@ANYBLOB="500000001000010425bbe5ad600027842cf52300", @ANYRES32=0x0, @ANYBLOB="0300000000000000280012800a00010076786c616e"], 0x50}, 0x1, 0x0, 0x0, 0x13d33d22cca65c15}, 0x4008840)
r0 = socket$netlink(0x10, 0x3, 0x0)
sendmmsg(r0, &(0x7f00000002c0), 0x40000000000009f, 0x0)
bind$netlink(r0, &(0x7f0000000040)={0x10, 0x0, 0x25dfdbfb, 0x4}, 0xc)
r1 = socket$nl_netfilter(0x10, 0x3, 0xc)
r2 = socket$nl_generic(0x10, 0x3, 0x10)
r3 = syz_genetlink_get_family_id$team(&(0x7f00000044c0), 0xffffffffffffffff)
ioctl$ifreq_SIOCGIFINDEX_team(r2, 0x8933, &(0x7f0000004700)={'team0\x00', <r4=>0x0})
sendmsg$TEAM_CMD_OPTIONS_SET(r2, &(0x7f0000004bc0)={0x0, 0x0, &(0x7f0000004b80)={&(0x7f00000000c0)={0x20, r3, 0x405, 0x70bd27, 0x25dfdbff, {}, [{{0x8, 0x1, r4}, {0x4}}]}, 0x20}, 0x1, 0x0, 0x0, 0x4000431}, 0x4044084)
sendmsg$NFT_BATCH(r1, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x0)
sendmsg$NFT_BATCH(r1, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f0000000640)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x5}}, [@NFT_MSG_NEWRULE={0x64, 0x6, 0xa, 0x401, 0x0, 0x0, {0xa, 0x0, 0x1}, [@NFTA_RULE_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_RULE_EXPRESSIONS={0x38, 0x4, 0x0, 0x1, [{0x34, 0x1, 0x0, 0x1, @xfrm={{0x9}, @val={0x24, 0x2, 0x0, 0x1, [@NFTA_XFRM_KEY={0x8, 0x2, 0x1, 0x0, 0x3}, @NFTA_XFRM_DIR={0x5}, @NFTA_XFRM_DREG={0x8, 0x1, 0x1, 0x0, 0x10}, @NFTA_XFRM_SPNUM={0x8, 0x4, 0x1, 0x0, 0x3}]}}}]}, @NFTA_RULE_CHAIN={0x9, 0x2, 'syz2\x00'}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x5}}}, 0x8c}, 0x1, 0x0, 0x0, 0x6040850}, 0x20000040)
sendmmsg$alg(0xffffffffffffffff, &(0x7f00000007c0)=[{0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000140)="ebe3a0ea796cfd16", 0x8}], 0x1}], 0x1, 0x40800)

2.281378749s ago: executing program 3 (id=3447):
r0 = socket$inet_udp(0x2, 0x2, 0x0)
bind$inet(r0, &(0x7f0000000040)={0x2, 0x4e20, @empty}, 0x10)
r1 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendmsg$IPCTNL_MSG_TIMEOUT_NEW(r1, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000440)={&(0x7f0000000340)={0x3c, 0x0, 0x8, 0x201, 0x0, 0x0, {0xa, 0x0, 0x2}, [@CTA_TIMEOUT_NAME={0x9, 0x1, 'syz1\x00'}, @CTA_TIMEOUT_L3PROTO={0x6, 0x2, 0x1, 0x0, 0x8863}, @CTA_TIMEOUT_L4PROTO={0x5, 0x3, 0x1}, @CTA_TIMEOUT_DATA={0xc, 0x4, 0x0, 0x1, @icmpv6=[@CTA_TIMEOUT_ICMPV6_TIMEOUT={0x8, 0x1, 0x1, 0x0, 0xb}]}]}, 0x3c}, 0x1, 0x0, 0x0, 0x8800}, 0x4000000)
syz_emit_ethernet(0x80, &(0x7f0000000100)={@local, @link_local, @void, {@ipv4={0x800, @udp={{0x5, 0x4, 0x0, 0x1, 0x61, 0x0, 0x0, 0x0, 0x11, 0x0, @empty, @empty}, {0x4e24, 0x4e20, 0x4d, 0x0, @wg=@initiation={0x1, 0x1, "65a252e7cb7a5918c004a9971a46afced2c32642b1ec9fe34818d8ccd82041b7", "c930713c550e74ee13c2638ac75b2a9666efd31a34fce4498df8105d8bd8ed283a220c3a9becd8a70d3607ea8270d351", "ae12e16b560f2f8ac4ca3e745ce285f12f6e8719e7f1e7f286a68f76", {"980aa8fb8f80d69f1fb587086447e93e", "55e824bb69e833bd36300b088233545a"}}}}}}}, 0x0)
ioctl$sock_inet_udp_SIOCINQ(r0, 0x541b, &(0x7f00000001c0))
pipe(&(0x7f0000000080)={0xffffffffffffffff, <r2=>0xffffffffffffffff})
vmsplice(r2, &(0x7f00000000c0)=[{&(0x7f0000000180)="77690addcfbe1f", 0x7}], 0x1, 0x1)
setsockopt$inet6_tcp_TCP_CONGESTION(r2, 0x6, 0xd, &(0x7f0000000000)='htcp', 0x4)

2.147084425s ago: executing program 3 (id=3448):
r0 = bpf$ITER_CREATE(0xb, &(0x7f0000000100), 0x0)
close(r0)
r1 = socket$inet6_sctp(0xa, 0x1, 0x84)
getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r1, 0x84, 0x6f, &(0x7f0000000280)={0x0, 0x1c, &(0x7f0000000000)=[@in6={0xa, 0x0, 0x0, @private0={0xfc, 0x0, '\x00', 0x1}, 0x9}]}, &(0x7f00000002c0)=0x10)
getsockopt$inet_sctp6_SCTP_MAX_BURST(r1, 0x84, 0x83, &(0x7f0000000000)=@assoc_value={<r2=>0x0}, &(0x7f0000000300)=0x8)
getsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER_VALUE(r0, 0x84, 0x7c, &(0x7f00000000c0)={r2, 0x4, 0x9}, &(0x7f0000000100)=0x8)
ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000180)={'vxcan1\x00', <r3=>0x0})
r4 = bpf$MAP_CREATE(0x0, &(0x7f0000000340)=@base={0xa, 0x4, 0x8, 0xa, 0x0, 0xffffffffffffffff, 0xfffffffd, '\x00', r3, 0xffffffffffffffff, 0x0, 0x0, 0x8000}, 0x50) (async)
r5 = socket$can_bcm(0x1d, 0x2, 0x2)
connect$can_bcm(r5, &(0x7f0000000140), 0x10)
sendmsg$can_bcm(r5, &(0x7f0000000a80)={0x0, 0x0, &(0x7f0000000a40)={&(0x7f0000000200)={0x5, 0xc06, 0xffffffff, {}, {}, {0x0, 0x0, 0x1}, 0x1, @canfd={{0x0, 0x0, 0x1}, 0x1a, 0x1, 0x0, 0x0, "8aee974fff186584d25af3abfe3e407370d621fd21a4b939372d2e9563a75eb616e70c2d99a8440a163e7e88f2e01967c14cf0c34c9258ec7685ffc3aba57e0f"}}, 0x80}, 0x1, 0x0, 0x0, 0x40084}, 0x30004084) (async, rerun: 32)
bpf$PROG_LOAD(0x5, &(0x7f00000004c0)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="18090000000000000000000000000000850000006d0000001801000020696c2500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000007100000095"], 0x0, 0x8000000, 0x0, 0x0, 0x0, 0x5, '\x00', 0x0, @fallback=0xa, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x5}, 0x94) (async, rerun: 32)
bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0x14, &(0x7f0000000400)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r4, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b7040000000000008500000001"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)
r6 = bpf$PROG_LOAD(0x5, &(0x7f0000000680)={0x11, 0x14, &(0x7f0000000400)=ANY=[], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x40f03, 0xe, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)
bpf$PROG_BIND_MAP(0xa, &(0x7f00000004c0)={r6}, 0xc)

2.070366883s ago: executing program 4 (id=3449):
r0 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendmsg$NFT_MSG_GETFLOWTABLE(r0, &(0x7f0000000780)={&(0x7f0000000540)={0x10, 0x0, 0x0, 0x10}, 0xc, &(0x7f0000000740)={&(0x7f0000000f40)={0x29c, 0x17, 0xa, 0x101, 0x0, 0x0, {0x0, 0x0, 0x2}, [@NFTA_FLOWTABLE_FLAGS={0x8, 0x7, 0x1, 0x0, 0x3}, @NFTA_FLOWTABLE_HANDLE={0xc, 0x5, 0x1, 0x0, 0x4}, @NFTA_FLOWTABLE_HOOK={0xb4, 0x3, 0x0, 0x1, [@NFTA_FLOWTABLE_HOOK_DEVS={0x68, 0x3, 0x0, 0x1, [{0x14, 0x1, 'caif0\x00'}, {0x14, 0x1, 'pimreg0\x00'}, {0x14, 0x1, 'batadv_slave_1\x00'}, {0x14, 0x1, 'wg2\x00'}, {0x14, 0x1, 'batadv_slave_0\x00'}]}, @NFTA_FLOWTABLE_HOOK_PRIORITY={0x8, 0x2, 0x1, 0x0, 0xb66e}, @NFTA_FLOWTABLE_HOOK_DEVS={0x40, 0x3, 0x0, 0x1, [{0x14, 0x1, 'team0\x00'}, {0x14, 0x1, 'dummy0\x00'}, {0x14, 0x1, 'veth1\x00'}]}]}, @NFTA_FLOWTABLE_FLAGS={0x8}, @NFTA_FLOWTABLE_HANDLE={0xc, 0x5, 0x1, 0x0, 0x4}, @NFTA_FLOWTABLE_NAME={0x9, 0x2, 'syz2\x00'}, @NFTA_FLOWTABLE_HOOK={0x194, 0x3, 0x0, 0x1, [@NFTA_FLOWTABLE_HOOK_DEVS={0x18, 0x3, 0x0, 0x1, [{0x14, 0x1, 'ipvlan1\x00'}]}, @NFTA_FLOWTABLE_HOOK_DEVS={0x54, 0x3, 0x0, 0x1, [{0x14, 0x1, 'macvtap0\x00'}, {0x14, 0x1, 'veth1_to_batadv\x00'}, {0x14, 0x1, 'xfrm0\x00'}, {0x14, 0x1, 'macsec0\x00'}]}, @NFTA_FLOWTABLE_HOOK_DEVS={0x40, 0x3, 0x0, 0x1, [{0x14, 0x1, 'nr0\x00'}, {0x14, 0x1, 'syz_tun\x00'}, {0x14, 0x1, 'veth1_to_hsr\x00'}]}, @NFTA_FLOWTABLE_HOOK_NUM={0x8}, @NFTA_FLOWTABLE_HOOK_DEVS={0xcc, 0x3, 0x0, 0x1, [{0x14, 0x1, 'syz_tun\x00'}, {0x14, 0x1, 'dvmrp1\x00'}, {0x14, 0x1, 'tunl0\x00'}, {0x14, 0x1, 'batadv0\x00'}, {0x14, 0x1, 'virt_wifi0\x00'}, {0x14, 0x1, 'vcan0\x00'}, {0x14, 0x1, 'dvmrp1\x00'}, {0x14, 0x1, 'xfrm0\x00'}, {0x14, 0x1, 'vlan0\x00'}, {0x14, 0x1, 'dummy0\x00'}]}, @NFTA_FLOWTABLE_HOOK_PRIORITY={0x8, 0x2, 0x1, 0x0, 0x1}, @NFTA_FLOWTABLE_HOOK_PRIORITY={0x8, 0x2, 0x1, 0x0, 0x8}]}, @NFTA_FLOWTABLE_NAME={0x9, 0x2, 'syz2\x00'}]}, 0x29c}, 0x1, 0x0, 0x0, 0x20000004}, 0x8000)
r1 = syz_init_net_socket$802154_raw(0x24, 0x3, 0x0)
listen(r1, 0x1000)

1.868941561s ago: executing program 5 (id=3450):
r0 = socket(0x10, 0x803, 0x0)
write(r0, &(0x7f0000000040)="1c0000005e001f3814584707f9f4ffffff000000250000001ff80020", 0x1c) (async)
r1 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000340)=ANY=[@ANYBLOB="02000000040000000800000001"], 0x48)
bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000400)={0x11, 0x10, &(0x7f0000000000)=ANY=[@ANYBLOB="18000000000000000000000000000000b7080000000000007b8af8ff00000000b7080000000000007b8af0ff00000000bf8100000000000007080000f8ffffffbfa400000000000007040000f0ffffffb70200000800000018210000", @ANYRES32=r1, @ANYBLOB="0000000002000000b70500000800000085000000c200000095"], &(0x7f0000000300)='GPL\x00', 0x4, 0x1002, &(0x7f00000014c0)=""/4098, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x1}, 0x94)

1.867449139s ago: executing program 4 (id=3451):
r0 = socket$inet6(0xa, 0x3, 0x2)
r1 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendmsg$NFQNL_MSG_CONFIG(r1, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000180)=ANY=[@ANYBLOB="1c000000020303000000000000000000000100000800010001"], 0x1c}}, 0x0)
sendmsg$NFQNL_MSG_CONFIG(r1, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000180)=ANY=[], 0x1c}}, 0x0)
setsockopt$inet6_tcp_TCP_FASTOPEN_KEY(r0, 0x6, 0x21, &(0x7f0000000040)="4aac9f2f5cb58ba14cc4a067dcf529f8", 0x10)
r2 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendmsg$NFT_BATCH(r2, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000100)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a03000000000000000000070000000900010073797a310000000044030000090a030000000000000009000700000008000a40000000000900020073797a32000000000900010073797a3000000000080005400000000d04001280080003400000011008000c400000edd8e8020980a00002"], 0x38c}}, 0x0)
connect$inet6(r0, &(0x7f0000000200)={0xa, 0x4e24, 0x6, @empty, 0x80000000}, 0x1c)
setsockopt$SO_TIMESTAMPING(r0, 0x1, 0x25, &(0x7f0000000140)=0x220, 0x4)
setsockopt$inet6_IPV6_RTHDRDSTOPTS(r0, 0x29, 0x37, &(0x7f0000000000)=ANY=[], 0x10)
sendmmsg(r0, &(0x7f00000092c0), 0x4ff, 0x0)
r3 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f00000003c0)=ANY=[@ANYBLOB="02000000040000000800000001"], 0x48)
bpf$PROG_LOAD(0x5, &(0x7f00000007c0)={0x6, 0x10, &(0x7f0000000580)=ANY=[@ANYBLOB="18050000000000000000000000000000b7080000000000007b8af8ff00000000b7080000000000007b8af0ff00000000bfa100000000000007010000f8ffffffbfa400000000000007040000f0ffffffb70200000800000018230000", @ANYRES32=r3, @ANYBLOB="0000000000000000b704000000000000850000001c00000095"], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @xdp, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90)

1.81397431s ago: executing program 0 (id=3452):
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$nl_generic(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000200)=ANY=[@ANYBLOB="14000000003b00010308007022ffdbdf25010000"], 0x14}}, 0x4044000)
r1 = socket$nl_generic(0x10, 0x3, 0x10)
r2 = socket$nl_generic(0x10, 0x3, 0x10) (async)
r3 = socket$inet_smc(0x2b, 0x1, 0x0)
getsockopt$inet_tcp_int(r3, 0x11e, 0x1, 0x0, &(0x7f0000000000))
r4 = syz_genetlink_get_family_id$batadv(&(0x7f0000000480), 0xffffffffffffffff) (async)
ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r1, 0x8933, &(0x7f0000000580)={'batadv0\x00', <r5=>0x0})
r6 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1)
bind$bt_hci(r6, &(0x7f0000000100)={0x1f, 0xffff, 0x3}, 0x6)
write(r6, &(0x7f0000000040)="4c00000011000d00"/23, 0x17)
ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r2, 0x8933, &(0x7f0000000080)={'batadv_slave_1\x00', <r7=>0x0})
sendmsg$BATADV_CMD_GET_ORIGINATORS(r2, &(0x7f0000000680)={0x0, 0x0, &(0x7f0000000640)={&(0x7f0000000140)=ANY=[@ANYBLOB='$\x00\x00\x00', @ANYRES16=r4, @ANYBLOB="090325bd7000fcdbdf250800000008000300", @ANYRES32=r5, @ANYBLOB="08000600", @ANYRES32=r7, @ANYBLOB], 0x24}, 0x1, 0x0, 0x0, 0x4090}, 0x24000890) (async, rerun: 32)
sendmsg$BATADV_CMD_SET_HARDIF(r0, &(0x7f0000000140)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000000100)={&(0x7f0000000080)={0x64, r4, 0x10, 0x70bd2d, 0x25dfdbfd, {}, [@BATADV_ATTR_NETWORK_CODING_ENABLED={0x5, 0x38, 0x1}, @BATADV_ATTR_AP_ISOLATION_ENABLED={0x5, 0x2a, 0x1}, @BATADV_ATTR_NETWORK_CODING_ENABLED={0x5, 0x38, 0x1}, @BATADV_ATTR_DISTRIBUTED_ARP_TABLE_ENABLED={0x5, 0x2f, 0x1}, @BATADV_ATTR_HARD_IFINDEX={0x8}, @BATADV_ATTR_MESH_IFINDEX={0x8}, @BATADV_ATTR_NETWORK_CODING_ENABLED={0x5, 0x38, 0x1}, @BATADV_ATTR_DISTRIBUTED_ARP_TABLE_ENABLED={0x5}, @BATADV_ATTR_HOP_PENALTY={0x5, 0x35, 0x10}, @BATADV_ATTR_GW_MODE={0x5}]}, 0x64}, 0x1, 0x0, 0x0, 0x4040}, 0x4044) (async, rerun: 32)
r8 = socket$key(0xf, 0x3, 0x2)
sendmsg$key(r8, &(0x7f0000000040)={0x3, 0x0, &(0x7f0000000340)={&(0x7f0000000440)={0x2, 0x6, 0xff, 0x3, 0x3, 0x0, 0x70bd2a, 0x25dfdbfb, [@sadb_key={0x1, 0x9}]}, 0x18}, 0x1, 0x7}, 0x0) (async)
syz_genetlink_get_family_id$devlink(&(0x7f00000001c0), r2)
syz_genetlink_get_family_id$l2tp(&(0x7f0000000000), r0)

1.588437302s ago: executing program 5 (id=3453):
r0 = socket$inet6_mptcp(0xa, 0x1, 0x106)
setsockopt$inet6_int(r0, 0x29, 0x5, 0x0, 0x0)
bpf$PROG_LOAD_XDP(0x5, &(0x7f0000001700)={0x6, 0x3, &(0x7f00000002c0)=@framed={{0x18, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x3}}, &(0x7f0000000380)='syzkaller\x00', 0x3, 0x1000, &(0x7f00000003c0)=""/4096, 0x41000, 0x70}, 0x94)
r1 = socket$inet6_tcp(0xa, 0x1, 0x0)
setsockopt$inet6_int(r1, 0x29, 0x8, 0x0, 0x0)
r2 = socket$netlink(0x10, 0x3, 0x0)
sendmsg$NL80211_CMD_GET_MPP(r2, &(0x7f0000000d00)={0x0, 0x0, &(0x7f0000000cc0)={&(0x7f0000000180)=ANY=[@ANYBLOB="28000000690005"], 0x28}}, 0x0)
clock_gettime(0x0, &(0x7f0000003d00)={<r3=>0x0, <r4=>0x0})
recvmmsg(r2, &(0x7f0000003c40)=[{{&(0x7f0000000000)=@nfc, 0x80, &(0x7f0000000280)=[{&(0x7f0000000080)=""/126, 0x7e}, {&(0x7f0000000100)=""/238, 0xee}, {&(0x7f0000000200)=""/113, 0x71}], 0x3, &(0x7f00000013c0)=""/249, 0xf9}, 0xfff}, {{&(0x7f00000014c0)=@in={0x2, 0x0, @broadcast}, 0x80, &(0x7f0000003880)=[{&(0x7f0000001540)=""/86, 0x56}, {&(0x7f00000015c0)=""/96, 0x60}, {&(0x7f0000001640)=""/101, 0x65}, {&(0x7f00000017c0)=""/4096, 0x1000}, {&(0x7f00000027c0)=""/92, 0x5c}, {&(0x7f0000002840)=""/3, 0x3}, {&(0x7f0000002880)=""/4096, 0x1000}], 0x7, &(0x7f0000003900)=""/253, 0xfd}, 0x6}, {{&(0x7f0000003a00)=@pppol2tpin6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @ipv4={""/10, ""/2, @dev}}}}, 0x80, &(0x7f0000003c00)=[{&(0x7f0000003a80)=""/161, 0xa1}, {&(0x7f0000003b40)=""/189, 0xbd}], 0x2}, 0x9}], 0x3, 0x2002, &(0x7f0000003d40)={r3, r4+60000000})

1.448800115s ago: executing program 0 (id=3454):
socket$nl_netfilter(0x10, 0x3, 0xc)
sendmsg$IPSET_CMD_CREATE(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000004c0)={&(0x7f0000000380)=ANY=[], 0x5c}, 0x1, 0x0, 0x0, 0x8888}, 0x24000804)
socket$nl_generic(0x10, 0x3, 0x10)
r0 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000340)=ANY=[@ANYBLOB="0200000004000000080000000100000080"], 0x50)
bpf$BPF_MAP_CONST_STR_FREEZE(0x16, &(0x7f0000000000)={r0}, 0x4)
bpf$PROG_LOAD(0x5, &(0x7f0000000280)={0x1, 0x11, &(0x7f00000003c0)=ANY=[@ANYBLOB="18000000000000000000000000000000850000002f000000b7080000000000007b8af8ff00000000b7080000000000007b8af0ff00000000bfa100000000000007010000f8ffffffbfa400000000000007040000f0ffffffb70200000800000018230000", @ANYRES32=r0, @ANYBLOB="0000000000000000b70500000000000085000000a500000095"], &(0x7f0000000080)='GPL\x00', 0x0, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, @fallback=0xf99017019b42da6b, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)
socket$packet(0x11, 0x3, 0x300)
r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='memory.events\x00', 0x275a, 0x0)
socket$nl_generic(0x10, 0x3, 0x10)
r2 = socket$pppl2tp(0x18, 0x1, 0x1)
socket$inet6_udp(0xa, 0x2, 0x0)
connect$pppl2tp(r2, 0x0, 0x0)
sendmmsg$inet(r2, &(0x7f0000001c00)=[{{&(0x7f0000000040)={0x2, 0x4e22, @initdev={0xac, 0x1e, 0x1, 0x0}}, 0x10, 0x0}}], 0x1, 0xc014)
r3 = socket$inet6_sctp(0xa, 0x1, 0x84)
r4 = bpf$PROG_LOAD(0x5, &(0x7f0000000740)={0xc, 0x8, &(0x7f0000000d80)=ANY=[@ANYBLOB="1800000000000000000000000000000018020000", @ANYRES32=r3, @ANYBLOB="0000000000000000b703000000000000850000000d000000b70000000000000095"], &(0x7f00000000c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x1b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x94)
bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f00000003c0)={r4, 0x3e8, 0xe80, 0x0, &(0x7f0000000000)="c1df07000000d30a298ee68886dd87", 0x0, 0x3ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, 0x50)
r5 = socket$inet_smc(0x2b, 0x1, 0x0)
getsockopt$PNPIPE_IFINDEX(r1, 0x113, 0x2, &(0x7f0000000140)=<r6=>0x0, &(0x7f0000000180)=0x4)
setsockopt$inet_pktinfo(r5, 0x0, 0x8, &(0x7f0000000200)={r6, @private=0xa010101, @initdev={0xac, 0x1e, 0x0, 0x0}}, 0xc)
write$tun(r1, &(0x7f0000000900)=ANY=[], 0x22e)
mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x2000001, 0x12, r1, 0x0)
r7 = openat$tun(0xffffffffffffff9c, &(0x7f00000001c0), 0xa2f01, 0x0)
r8 = epoll_create1(0x0)
socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000002c0)={0xffffffffffffffff, <r9=>0xffffffffffffffff})
epoll_ctl$EPOLL_CTL_ADD(r8, 0x1, r9, &(0x7f0000000100))
epoll_wait(r8, &(0x7f0000000000)=[{}], 0x1, 0x101)
epoll_ctl$EPOLL_CTL_MOD(r8, 0x3, r9, &(0x7f0000000240)={0x8000200f})
ioctl$TUNSETIFF(r7, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x6bf1c2d5adba8c32})
ioctl$TUNSETLINK(r7, 0x400454cd, 0x300)
getsockopt$PNPIPE_IFINDEX(r1, 0x113, 0x2, &(0x7f0000000040), &(0x7f0000000100)=0x4)

1.403594542s ago: executing program 1 (id=3455):
socket$nl_route(0x10, 0x3, 0x0) (async)
r0 = socket$nl_route(0x10, 0x3, 0x0)
r1 = socket$l2tp6(0xa, 0x2, 0x73)
connect$inet6(r1, &(0x7f00000000c0)={0xa, 0x4e24, 0x1, @remote, 0x9}, 0x1c) (async)
connect$inet6(r1, &(0x7f00000000c0)={0xa, 0x4e24, 0x1, @remote, 0x9}, 0x1c)
r2 = socket$netlink(0x10, 0x3, 0x0)
sendmsg$nl_route(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="700000001000030500000000ffdbdf2500000000", @ANYRES32=0x0, @ANYBLOB="35c60100ef000000500012800e0001006970366772657461700000003c00028014000600fe88000000000000000000000000010114000700ff8000000000000000000000000000bb060002000700000008000100", @ANYRES16=r2], 0x70}, 0x1, 0x0, 0x0, 0x240488c0}, 0x0)
r3 = socket(0x10, 0x803, 0x0)
bind$netlink(r3, &(0x7f0000000100)={0x10, 0x0, 0x25dfdbfd, 0x400}, 0xc) (async)
bind$netlink(r3, &(0x7f0000000100)={0x10, 0x0, 0x25dfdbfd, 0x400}, 0xc)
getsockname$packet(r3, &(0x7f0000000600)={0x11, 0x0, <r4=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000080)=0x14)
sendmsg$nl_route(r0, &(0x7f00000006c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000040)=ANY=[@ANYBLOB="3c00000010000d042abd70000000000000000000", @ANYRES32=r4, @ANYBLOB="9b060000003800001c00128009000100626f6e64000000000c0002800500010006"], 0x3c}, 0x1, 0x0, 0x0, 0x40040}, 0x4000000)
r5 = socket$inet(0x10, 0x3, 0x0)
ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000300)={'bond0\x00', <r6=>0x0})
r7 = socket$nl_route(0x10, 0x3, 0x0)
ioctl$BTRFS_IOC_SCRUB(r7, 0xc400941b, &(0x7f0000000700)={0x0, 0x1}) (async)
ioctl$BTRFS_IOC_SCRUB(r7, 0xc400941b, &(0x7f0000000700)={<r8=>0x0, 0x1})
ioctl$BTRFS_IOC_SCRUB_PROGRESS(r5, 0xc400941d, &(0x7f0000000b00)={r8, 0x18000000000000, 0x4, 0x1})
bind$netlink(0xffffffffffffffff, 0x0, 0x0)
accept4(r3, 0x0, 0x0, 0x800)
syz_genetlink_get_family_id$devlink(0x0, 0xffffffffffffffff) (async)
syz_genetlink_get_family_id$devlink(0x0, 0xffffffffffffffff)
sendmsg$nl_route(r7, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000001400)=@newlink={0x44, 0x10, 0x401, 0x2, 0x0, {0x0, 0x0, 0x0, 0x0, 0x900}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @macvlan={{0xc}, {0x4}}}, @IFLA_LINK={0x8, 0x5, r6}, @IFLA_MASTER={0x8, 0xa, r4}]}, 0x44}}, 0x4008010) (async)
sendmsg$nl_route(r7, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000001400)=@newlink={0x44, 0x10, 0x401, 0x2, 0x0, {0x0, 0x0, 0x0, 0x0, 0x900}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @macvlan={{0xc}, {0x4}}}, @IFLA_LINK={0x8, 0x5, r6}, @IFLA_MASTER={0x8, 0xa, r4}]}, 0x44}}, 0x4008010)

1.3373665s ago: executing program 5 (id=3456):
r0 = socket$nl_generic(0x10, 0x3, 0x10)
r1 = syz_genetlink_get_family_id$l2tp(&(0x7f00000005c0), 0xffffffffffffffff)
r2 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_SESSION_DELETE(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000680)=ANY=[@ANYBLOB='H\x00\x00\x00', @ANYRES16=r1, @ANYBLOB="01000cbd70100400000005000000080009000200000008000c00a80a000008000b00000000000600010007"], 0x48}, 0x1, 0x0, 0x0, 0x40811}, 0x20)
sendmsg$L2TP_CMD_TUNNEL_CREATE(r0, &(0x7f00000000c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f0000000080)={&(0x7f0000000040)={0x2c, r1, 0x400, 0x70bd27, 0x25dfdbfe, {}, [@L2TP_ATTR_RECV_SEQ={0x5, 0x12, 0x8}, @L2TP_ATTR_DATA_SEQ={0x5, 0x4, 0x6}, @L2TP_ATTR_LNS_MODE={0x5, 0x14, 0x5}]}, 0x2c}, 0x1, 0x0, 0x0, 0x4}, 0x24040815)
r3 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$nl_generic(r3, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000001c0)=ANY=[@ANYBLOB="4800000041000501010000000000000001010000000000001c0001000600060086dd0000100007007f0000017f00000184004000140002"], 0x48}, 0x1, 0x0, 0x0, 0x4048011}, 0xc000)

1.225011207s ago: executing program 4 (id=3457):
r0 = bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=@base={0x1b, 0x0, 0x0, 0x8000}, 0x48)
r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)=@base={0x10, 0x4, 0x4, 0x2, 0x0, 0x1, 0xfffffffc}, 0x50)
r2 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x6, 0x10, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000010000000000000000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b702000003000000850000008600000018110000", @ANYRES32=r1, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bca2000000000000a6020000f8ffffffb703000008000000b704000000000000850000003300000095"], &(0x7f0000000180)='GPL\x00', 0x1, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback=0x38, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)
bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000b80)={r2, 0x2000012, 0xe, 0x0, &(0x7f0000000c40)="63eced8e46dc3f2ddf33c9e9b986", 0x0, 0xfffffffe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0xb}, 0x50)

1.222383064s ago: executing program 5 (id=3458):
bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x3, 0x4, &(0x7f0000000000)=ANY=[@ANYBLOB="18000000010000000000000000000000711235000000000095"], &(0x7f0000000080)='GPL\x00', 0x0, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, @fallback=0x38, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)
r0 = socket$key(0xf, 0x3, 0x2)
sendmsg$key(r0, &(0x7f0000000100)={0x3, 0x0, &(0x7f0000000280)={&(0x7f00000001c0)={0x2, 0x5, 0x0, 0x9, 0xe, 0x0, 0x0, 0x25dfdbfb, [@sadb_address={0x5, 0x6, 0x0, 0x0, 0x0, @in6={0xa, 0x4e24, 0x7c7ef8b2, @ipv4={'\x00', '\xff\xff', @remote}}}, @sadb_sa={0x2, 0x1, 0x0, 0x1, 0x0, 0x4, 0x0, 0x20000000}, @sadb_address={0x5, 0x5, 0x0, 0x0, 0x0, @in6={0xa, 0x4e20, 0x6, @initdev={0xfe, 0x88, '\x00', 0x1, 0x0}, 0xc60c}}]}, 0x70}, 0x1, 0x7}, 0x0)
r1 = bpf$BPF_MAP_GET_FD_BY_ID(0xe, &(0x7f0000000040)={0xffffffffffffffff, 0x10001}, 0xc)
ioctl$sock_ipv6_tunnel_SIOCCHGTUNNEL(0xffffffffffffffff, 0x89f3, &(0x7f0000000200)={'syztnl1\x00', &(0x7f0000000180)={'syztnl0\x00', <r2=>0x0, 0x2f, 0x3, 0x3, 0x0, 0x3, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02', @private0={0xfc, 0x0, '\x00', 0x1}, 0x700, 0x700, 0x5f7, 0x2}})
r3 = bpf$BPF_BTF_GET_FD_BY_ID(0x13, &(0x7f00000002c0)=0xffffffffffffffff, 0x4)
bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f0000000240)={0x1b, 0x0, 0x0, 0xf, 0x0, r1, 0x101, '\x00', r2, r3, 0x4, 0x4}, 0x50)

1.145749229s ago: executing program 3 (id=3459):
socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000040)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
sendmsg$inet(r1, &(0x7f0000001b00)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001d80)=ANY=[@ANYBLOB="28010000000000000100000001"], 0x128}, 0x8000)
recvmsg$unix(r0, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000080), 0x100}, 0x0)
socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)={<r2=>0xffffffffffffffff})
recvmsg$unix(r2, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000080), 0x100}, 0x0)
bpf$PROG_LOAD(0x5, &(0x7f00002a0fb8)={0x16, 0x4, &(0x7f0000000400)=ANY=[@ANYBLOB="85000000070000006a0a00ff000000000c00000000000000950000000000000018100000", @ANYRES32, @ANYBLOB="000000000000000005000000000000009500000000000000b1f8306e05d1e4aab009c16b5c05077115d0749619ca39f89974785ae0619b77c6585f678ac92a3b6b4148f56b43c3dd75d75f97c8f92f60a2def458df05e2fbfb3e849b2b3cffd4f29446ae60dd76654b2639b2bc14350706214a6ab7a712d4317fbc3ca01d0d3ed6110b3775903141a5091a4d3db8eb335414fbdb288aba73aaf6d18000a3a2a069cf7f9402e1425bb6bc370576aa1faea0fe222671ecf99038fce8dba53dcb11f87cca"], &(0x7f0000000140)='GPL\x00', 0x2, 0xffa0, &(0x7f0000000180)=""/149, 0x0, 0x0, '\x00', 0x0, @flow_dissector, 0xffffffffffffffff, 0x8, 0x0, 0x1e, 0x10, 0x0, 0x1e}, 0x2d)
r3 = socket$inet(0x2, 0x4000000000000001, 0x0)
bind$inet(r3, &(0x7f0000000080)={0x2, 0x4e23, @multicast1}, 0x10)
r4 = socket$inet_tcp(0x2, 0x1, 0x0)
setsockopt$IPT_SO_SET_REPLACE(r4, 0x0, 0x40, &(0x7f0000000000)=@mangle={'mangle\x00', 0x1f, 0x6, 0x390, 0x0, 0x98, 0x130, 0x1c8, 0x2f8, 0x0, 0x98, 0x130, 0x260, 0x2f8, 0x6, 0x0, {[{{@uncond, 0x0, 0x70, 0x98}, @common=@unspec=@STANDARD={0x28, '\x00', 0x0, 0xfffffffe}}, {{@uncond, 0x0, 0x70, 0x98}, @common=@unspec=@STANDARD={0x28, '\x00', 0x0, 0xfffffffe}}, {{@uncond, 0x0, 0x70, 0x98}, @common=@unspec=@STANDARD={0x28, '\x00', 0x0, 0xfffffffe}}, {{@ip={@empty, @empty, 0x0, 0x0, '\x00', '\x00', {}, {}, 0x6}, 0x0, 0x70, 0x98}, @ECN={0x28, 'ECN\x00', 0x0, {0x30, 0x0, 0x3}}}, {{@uncond, 0x0, 0x70, 0x98}, @common=@unspec=@STANDARD={0x28, '\x00', 0x0, 0xfffffffe}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x3f0)
sendto$inet(r3, 0x0, 0x0, 0x200007fd, &(0x7f0000e68000)={0x2, 0x4e23, @local}, 0x10)
bpf$MAP_GET_NEXT_KEY(0x4, &(0x7f0000000240)={0xffffffffffffffff, &(0x7f0000000140), 0x0}, 0x20)
sendmmsg$inet(r3, &(0x7f0000001680)=[{{0x0, 0x0, &(0x7f0000001dc0)=[{&(0x7f0000000c80)="91f8a984", 0x4}], 0x1}}], 0x1, 0x2090)
socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={<r5=>0xffffffffffffffff, <r6=>0xffffffffffffffff})
r7 = socket(0x10, 0x802, 0x0)
write(r7, &(0x7f0000000000)="fc0000004800071fab092504090007000aab60ff0a0000000008e293210001c0000000000000000000000000c0fe00ea05001ec28656aaa79bb94b46fe000000bc000200000300f12fbe780196370d1151ffd633d450000000e5d18064b1ed548d59c40a366c57c6a55e00008934d07302ade01720d7d5bbc91a3e2e80772c05defd5a32e280fc83ab82f605f70cce190a60aa47e988399ddef2fe082038f4f8b29d97f391064e763b6f380f5bd92c83170e5bba4a463a1e00d66ff5b22a95792e2891cfded815b6ccd243f295ed94e0ad91bd0734babc7c737d670133750800000000000000000000000000a6b567b4d5715587e6d8a1ad0a4f0108", 0xfc)
sendmsg$inet(r6, &(0x7f0000001b00)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001d80)=ANY=[], 0x128}, 0x0)
recvmsg$unix(r5, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000900), 0x100}, 0x0)
socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={<r8=>0xffffffffffffffff, <r9=>0xffffffffffffffff})
sendmsg$inet(r9, &(0x7f0000001b00)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001d80)=ANY=[], 0x128}, 0x0)
r10 = accept4$llc(0xffffffffffffffff, 0x0, &(0x7f0000000180), 0x80000)
recvfrom$llc(r10, &(0x7f00000001c0)=""/192, 0xc0, 0x2, &(0x7f0000000280)={0x1a, 0x3, 0x7, 0x6, 0xf, 0xfc, @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x3}}, 0x10)
recvmsg(r8, &(0x7f00000005c0)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001dc0)=""/4096, 0x1000}, 0x40)
bpf$PROG_LOAD(0x5, &(0x7f0000000380)={0x16, 0x3, &(0x7f00000000c0)=ANY=[@ANYBLOB="1800006200d1000c00000000000100009500000000000000153ae0a442c205ea84a9b34954c8f93e91d5fd5175821c27d1ce306033b5e5cda9e054e11fb825be5bc12170c9c79d3e9792f113792af3b9491b0b08a4f076545398dfc2527f000000ebb9eeb23a05cffcb9282601252fab8527f4e4b20655d41b4f17761133a64758e93cdd255bc523d4ae3e5c1e4a994fee6515e6760532d0cbccc8a63213b6ae61b4f1826de52d4876d4b4cc59c72e896fe9fdf0a8fdde30df3fd4f5193f017b"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x41100, 0x1, '\x00', 0x0, @flow_dissector, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)
socket$inet_udp(0x2, 0x2, 0x0)

1.116969331s ago: executing program 5 (id=3460):
r0 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendmsg$IPCTNL_MSG_EXP_NEW(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000580)=ANY=[@ANYBLOB="6c00000000020104000000000000000002000000240002801400018008000100e000000208000200ac1414000c0002800500ff0000000000300003802c00018014000300fe88000000000000000000000000000114000400fe880000000000000000000000000101040001"], 0x6c}}, 0x0) (async)
recvmsg(r0, &(0x7f0000000440)={&(0x7f0000000200)=@rxrpc=@in6={0x21, 0x0, 0x2, 0x1c, {0xa, 0x0, 0x0, @ipv4={""/10, ""/2, @multicast1}}}, 0x80, &(0x7f0000000380)=[{&(0x7f0000000280)=""/36, 0x24}, {&(0x7f00000002c0)=""/189, 0xbd}], 0x2, &(0x7f00000003c0)=""/88, 0x58}, 0x20)
sendmsg$key(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000001c0)=ANY=[@ANYBLOB="0202000311000000000000000000000005000500000000000a00000000000000fe8000000000000000000000000000bb"], 0x88}}, 0x0)
r1 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$nl_generic(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000040)=ANY=[@ANYBLOB="30000000410007012bbd700000000000047c00000400c2800c000180060006cc09e1154ea76b4d02fd843b00000c00028008000d9b9621e3e5c62e844706f48bca4fb54c6ba543e7279888267ea10f9ff0ed96c770fa508b484f99f2319b805b7a6aa6bf5daf7650258eb5a1a051b388267557ff3dfbf9f34d7aee3eccfc36e93129797378ecae58c28c0178b7bc90b9526fe6a98b8602516372bd1c6b0b504fbaf3fa47aa82bb58bf7d7f19866a2ad7716bb9872726799c2c72728b4ab5dad045d08c3d7dbbde696703e9b6d6ac5bf099e0cc97bacf5f2cc66e90d9ee7527682e9e"], 0x30}, 0x1, 0x0, 0x0, 0x4048011}, 0x4008051)

968.458886ms ago: executing program 5 (id=3461):
openat$tun(0xffffffffffffff9c, &(0x7f0000000040), 0x1c1341, 0x0)
socket$nl_netfilter(0x10, 0x3, 0xc) (async)
r0 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendmsg$NFT_BATCH(r0, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000008c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0) (async)
sendmsg$NFT_BATCH(r0, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000008c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0)
sendmsg$NFT_BATCH(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000003c0)={{0x14}, [@NFT_MSG_NEWRULE={0x6c, 0x6, 0xa, 0x40b, 0x0, 0x0, {0x2}, [@NFTA_RULE_EXPRESSIONS={0x40, 0x4, 0x0, 0x1, [{0x18, 0x1, 0x0, 0x1, @osf={{0x8}, @val={0xc, 0x2, 0x0, 0x1, [@NFTA_OSF_DREG={0x8, 0x1, 0x1, 0x0, 0x13}]}}}, {0x24, 0x1, 0x0, 0x1, @meta={{0x9}, @val={0x14, 0x2, 0x0, 0x1, [@NFTA_META_KEY={0x8, 0x2, 0x1, 0x0, 0xe}, @NFTA_META_SREG={0x8, 0x3, 0x1, 0x0, 0x4}]}}}]}, @NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_RULE_CHAIN={0x9, 0x2, 'syz2\x00'}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x1}}}, 0x94}}, 0x0)
sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000000c0)=@newlink={0x58, 0x10, 0x401, 0x70bd2a, 0x0, {0x0, 0x0, 0x0, 0x0, 0x38099, 0x4}, [@IFLA_LINKINFO={0x38, 0x12, 0x0, 0x1, @ip6gre={{0xb}, {0x28, 0x2, 0x0, 0x1, [@IFLA_GRE_LOCAL={0x14, 0x6, @private1}, @IFLA_GRE_ENCAP_SPORT={0x6, 0x10, 0x4e24}, @IFLA_GRE_ENCAP_DPORT={0x6, 0x11, 0x4e21}]}}}]}, 0x58}, 0x1, 0x0, 0x0, 0x8c1}, 0x0)
socket$nl_generic(0x10, 0x3, 0x10) (async)
socket$nl_generic(0x10, 0x3, 0x10)
socket$inet6_tcp(0xa, 0x1, 0x0) (async)
r1 = socket$inet6_tcp(0xa, 0x1, 0x0)
socketpair$tipc(0x1e, 0x1, 0x0, &(0x7f0000000000)={<r2=>0xffffffffffffffff, <r3=>0xffffffffffffffff})
r4 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1)
bind$bt_hci(r4, &(0x7f0000000000)={0x1f, 0xffffffffffffffff, 0x3}, 0x6)
getsockopt$inet_tcp_buf(0xffffffffffffffff, 0x6, 0x23, &(0x7f0000000040)=""/32, &(0x7f0000000080)=0x20)
write$bt_hci(r4, &(0x7f0000000080)=ANY=[], 0x6)
epoll_ctl$EPOLL_CTL_ADD(0xffffffffffffffff, 0x1, r3, &(0x7f00000000c0)={0x2000})
recvmsg(r2, &(0x7f0000000500)={&(0x7f0000000040)=@hci, 0x80, &(0x7f0000000100)=[{&(0x7f0000000400)=""/248, 0x200105d0}], 0x1, 0x0, 0x300}, 0x1f00)
sendmsg$tipc(r3, &(0x7f0000000240)={0x0, 0xfffffff5, &(0x7f0000000200)=[{&(0x7f0000000140)="a2", 0xfffffdef}], 0x1}, 0x0)
unshare(0x20000400)
r5 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0)
ioctl$TUNSETOFFLOAD(r5, 0xc004743e, 0x110e22fff6) (async)
ioctl$TUNSETOFFLOAD(r5, 0xc004743e, 0x110e22fff6)
ioctl$PPPIOCGNPMODE(r5, 0xc008744c, 0x0)
bind$inet6(0xffffffffffffffff, &(0x7f0000000000)={0xa, 0x4e22, 0x0, @private1={0xfc, 0x1, '\x00', 0x81}}, 0x1c)
r6 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendmsg$NFT_BATCH(r6, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000500)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x7}}, [@NFT_MSG_NEWTABLE={0x20, 0x0, 0xa, 0x5, 0x0, 0x0, {0x1}, [@NFTA_TABLE_NAME={0x9, 0x1, 'syz0\x00'}]}, @NFT_MSG_NEWCHAIN={0x48, 0x3, 0xa, 0x201, 0x0, 0x0, {0x1}, [@NFTA_CHAIN_NAME={0x9, 0x3, 'syz2\x00'}, @NFTA_CHAIN_HOOK={0x14, 0x4, 0x0, 0x1, [@NFTA_HOOK_PRIORITY={0x8}, @NFTA_HOOK_HOOKNUM={0x8}]}, @NFTA_CHAIN_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_CHAIN_TYPE={0xffffffffffffffd2, 0x7, 'nat\x00'}]}, @NFT_MSG_NEWRULE={0x40, 0x6, 0xa, 0x401, 0x0, 0x0, {0x1}, [@NFTA_RULE_CHAIN_ID={0x8}, @NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_RULE_EXPRESSIONS={0x18, 0x4, 0x0, 0x1, [{0x14, 0x1, 0x0, 0x1, @redir={{0xa}, @val={0x4}}}]}]}], {0x14}}, 0xd0}, 0x1, 0x0, 0x0, 0x20004000}, 0x10)
ioctl$BTRFS_IOC_SPACE_INFO(r6, 0xc0109414, &(0x7f00000004c0)={0x81c, 0x2, ['\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00']})
listen(r1, 0x0) (async)
listen(r1, 0x0)
syz_emit_ethernet(0x75, &(0x7f0000000200)={@local, @empty, @void, {@ipv6={0x86dd, @tcp={0x0, 0x6, "0a8435", 0x3f, 0x6, 0x0, @remote, @local, {[], {{0x4e24, 0x4e22, 0x41424344, 0x41424344, 0x0, 0x0, 0x5, 0x2}, {"43943dcfc26104897fbf779b02e68dd984cdab6041f484e3207fa0e33e52b9184f175b39108c2d12c61ebd"}}}}}}}, 0x0) (async)
syz_emit_ethernet(0x75, &(0x7f0000000200)={@local, @empty, @void, {@ipv6={0x86dd, @tcp={0x0, 0x6, "0a8435", 0x3f, 0x6, 0x0, @remote, @local, {[], {{0x4e24, 0x4e22, 0x41424344, 0x41424344, 0x0, 0x0, 0x5, 0x2}, {"43943dcfc26104897fbf779b02e68dd984cdab6041f484e3207fa0e33e52b9184f175b39108c2d12c61ebd"}}}}}}}, 0x0)
getsockopt$inet_sctp_SCTP_GET_LOCAL_ADDRS(0xffffffffffffffff, 0x84, 0x6d, &(0x7f0000000140), &(0x7f0000000280)=0x8) (async)
getsockopt$inet_sctp_SCTP_GET_LOCAL_ADDRS(0xffffffffffffffff, 0x84, 0x6d, &(0x7f0000000140)={<r7=>0x0}, &(0x7f0000000280)=0x8)
getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(0xffffffffffffffff, 0x84, 0x6f, &(0x7f0000000400)={r7, 0x9c, &(0x7f000000c780)=[@in6={0xa, 0x4621, 0xfee, @dev={0xfe, 0x80, '\x00', 0x10}, 0x6}, @in6={0xa, 0x4e21, 0x2, @private0, 0x9}, @in={0x2, 0x4e20, @empty}, @in6={0xa, 0x4e20, 0x1, @dev={0xfe, 0x80, '\x00', 0x1e}, 0x800}, @in6={0xa, 0x4e24, 0x7ff, @dev={0xfe, 0x80, '\x00', 0x1b}, 0x2}, @in6={0xa, 0x4e22, 0x6c02, @empty, 0x4}]}, &(0x7f0000000440)=0x10) (async)
getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(0xffffffffffffffff, 0x84, 0x6f, &(0x7f0000000400)={r7, 0x9c, &(0x7f000000c780)=[@in6={0xa, 0x4621, 0xfee, @dev={0xfe, 0x80, '\x00', 0x10}, 0x6}, @in6={0xa, 0x4e21, 0x2, @private0, 0x9}, @in={0x2, 0x4e20, @empty}, @in6={0xa, 0x4e20, 0x1, @dev={0xfe, 0x80, '\x00', 0x1e}, 0x800}, @in6={0xa, 0x4e24, 0x7ff, @dev={0xfe, 0x80, '\x00', 0x1b}, 0x2}, @in6={0xa, 0x4e22, 0x6c02, @empty, 0x4}]}, &(0x7f0000000440)=0x10)
syz_emit_ethernet(0x4a, &(0x7f0000000180)={@local, @broadcast, @void, {@ipv6={0x86dd, @tcp={0x0, 0x6, '\x00', 0x14, 0x6, 0x0, @local, @local, {[], {{0xfffc, 0x4e22, 0x41424344, 0x41424344, 0x0, 0x0, 0x5, 0xc2, 0x5, 0x0, 0xf500}}}}}}}, 0x0)
close(0x4)

488.652216ms ago: executing program 0 (id=3462):
r0 = socket$inet_sctp(0x2, 0x1, 0x84)
getsockopt$inet_sctp6_SCTP_AUTH_ACTIVE_KEY(0xffffffffffffffff, 0x84, 0x18, &(0x7f0000000040)={<r1=>0x0, 0xa}, &(0x7f00000000c0)=0x8)
getsockopt$inet_sctp_SCTP_CONTEXT(r0, 0x84, 0x11, &(0x7f00000001c0)={r1, 0x6}, &(0x7f0000000200)=0x8)
r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="020000000400000008000000010000001010"], 0x50)
bpf$BPF_MAP_CONST_STR_FREEZE(0x16, &(0x7f0000000080)={r2, <r3=>0xffffffffffffffff}, 0x4)
bpf$PROG_LOAD(0x5, &(0x7f0000000100)={0x2, 0x6, &(0x7f0000000280)=@raw=[@map_val={0x18, 0x2, 0x2, 0x0, r3, 0x0, 0x0, 0x0, 0x2}, @map_fd={0x18, 0x1, 0x1, 0x0, r2}, @generic={0x85, 0x0, 0x0, 0x0, 0x2}, @generic={0x95}], &(0x7f0000000300)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0x0, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0}, 0x94)
socket$key(0xf, 0x3, 0x2)

294.028033ms ago: executing program 0 (id=3463):
r0 = socket$pppl2tp(0x18, 0x1, 0x1)
r1 = socket$inet6_udp(0xa, 0x2, 0x0)
connect$pppl2tp(r0, &(0x7f0000000000)=@pppol2tpv3={0x18, 0x1, {0x3, r1, {0x2, 0x0, @dev}, 0x2}}, 0x2e)
r2 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f00000007c0)=ANY=[@ANYBLOB="1b0000000000000000000000000004"], 0x50)
bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x11, &(0x7f00000000c0)=@ringbuf={{0x18, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x9}, {{0x18, 0x1, 0x1, 0x0, r2}, {}, {0x7, 0x0, 0xb, 0x3, 0x0, 0x0, 0x700}, {0x85, 0x0, 0x0, 0x86}}, {{0x5, 0x0, 0x5, 0x9, 0x0, 0x1, 0x41}}, [@jmp={0x5, 0x0, 0x3, 0x0, 0x0, 0xfffffffffffffffc, 0xfffffffffffffffc}, @jmp={0x5, 0x1, 0x2, 0x0, 0xdad1124f55525050, 0xfffffffffffffff8}], {{}, {}, {0x85, 0x0, 0x0, 0x84}}}, &(0x7f0000000180)='GPL\x00', 0x7, 0x0, 0x0, 0x40f00, 0x27}, 0x94)
r3 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000340), 0xffffffffffffffff)
r4 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_SESSION_DELETE(r4, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000380)={0x34, r3, 0x1, 0x70bd26, 0x25dfdbfe, {0x5}, [@L2TP_ATTR_CONN_ID={0x8, 0x9, 0x2}, @L2TP_ATTR_PW_TYPE={0x6, 0x1, 0x5}, @L2TP_ATTR_PEER_SESSION_ID={0x8, 0xc, 0xaaa}, @L2TP_ATTR_SESSION_ID={0x8, 0xb, 0x4}]}, 0x34}, 0x1, 0x0, 0x0, 0x20006911}, 0x0)
r5 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f0000000180)={0x1b, 0x0, 0x0, 0x40000, 0x0, 0x0, 0x9}, 0x50)
bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x10, &(0x7f00000000c0)=@ringbuf={{0x18, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x6}, {{0x18, 0x1, 0x1, 0x0, r5}, {}, {0x7, 0x0, 0xb, 0x3, 0x0, 0x0, 0x700}, {0x85, 0x0, 0x0, 0x86}}, {{0x5, 0x0, 0x5, 0x9, 0x0, 0x1, 0x41}}, [@jmp={0x5, 0x1, 0x6, 0x0, 0xdad1124f55525050, 0xfffffffffffffffc}], {{}, {0x7, 0x0, 0xb, 0x2, 0x0, 0x0, 0x3}, {0x85, 0x0, 0x0, 0x85}}}, &(0x7f0000000080)='GPL\x00', 0x1, 0x0, 0x0, 0x41100, 0x23, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0xcd8000}, 0x94)
syz_genetlink_get_family_id$mptcp(&(0x7f0000000000), 0xffffffffffffffff)
syz_open_procfs$namespace(0x0, &(0x7f0000000000))
bpf$MAP_UPDATE_CONST_STR(0x2, &(0x7f0000000300)={{0x1, <r6=>0xffffffffffffffff}, &(0x7f0000000040), &(0x7f00000002c0)='%-010d \x00'}, 0x20)
ioctl$XFS_IOC_START_COMMIT(r6, 0x80585882, &(0x7f00000003c0))

245.174776ms ago: executing program 4 (id=3464):
socketpair(0x1d, 0x2, 0x2, &(0x7f0000000280)={0xffffffffffffffff, <r0=>0xffffffffffffffff})
ioctl$XFS_IOC_ATTRLIST_BY_HANDLE(r0, 0x4058587a, &(0x7f00000012c0)={{<r1=>r0, &(0x7f0000000000)='\xb5\x00', 0x8002, &(0x7f0000000040)={@_ha_fsid={[0x9, 0xd2]}, {0x0, 0x4, 0x401}}, 0x7, &(0x7f0000000080)={@_ha_fsid}, &(0x7f00000000c0)=0x7f}, {[0x1, 0xaa, 0x1, 0xf]}, 0x5, 0x1000, &(0x7f00000002c0)=""/4096})
r2 = socket$inet6_sctp(0xa, 0x5, 0x84)
shutdown(r2, 0x0)
getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r2, 0x84, 0x6f, &(0x7f0000000000)={0x0, 0x1c, &(0x7f00000000c0)=[@in6={0xa, 0x0, 0x0, @private2}]}, &(0x7f0000000180)=0x10)
r3 = socket$inet_sctp(0x2, 0x1, 0x84)
getsockopt$inet_sctp_SCTP_MAX_BURST(r3, 0x84, 0xd, &(0x7f0000000000)=@assoc_value={<r4=>0x0}, &(0x7f0000000040)=0x8)
setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(r2, 0x84, 0x9, &(0x7f00000001c0)={r4, @in={{0x2, 0x0, @empty}}, 0x0, 0x0, 0x0, 0x0, 0xd4}, 0x9c)
getsockopt$inet_sctp6_SCTP_RTOINFO(r1, 0x84, 0x0, &(0x7f0000001340)={r4, 0x1000, 0x0, 0xc}, &(0x7f0000001380)=0x10)

193.615652ms ago: executing program 0 (id=3465):
r0 = socket(0x40000000015, 0x5, 0x0)
bind$inet6(r0, &(0x7f0000000040)={0xa, 0x0, 0x0, @loopback}, 0x1c) (async)
sendto$inet6(r0, 0x0, 0x0, 0x0, &(0x7f0000000240)={0xa, 0x0, 0x0, @dev, 0xfffffffc}, 0x1c) (async, rerun: 32)
r1 = socket(0x1e, 0x4, 0x0) (rerun: 32)
setsockopt$packet_tx_ring(r1, 0x10f, 0x87, &(0x7f0000000140)=@req3={0x7813, 0x3, 0x0, 0x81, 0x1ff, 0x1, 0x1}, 0x1c)
recvmmsg$unix(r1, &(0x7f0000000b00)=[{{0x0, 0x0, &(0x7f0000000300)=[{&(0x7f0000000b80)=""/4100, 0x1004}], 0x1}}], 0x1, 0x400122a0, 0x0) (async, rerun: 32)
sendmmsg(r1, &(0x7f00000030c0)=[{{0x0, 0xa9cc7003, &(0x7f0000000400)=[{&(0x7f00000000c0)="ee", 0x101d0}], 0x1}}], 0x400000000000181, 0x9200000000000000) (async, rerun: 32)
setsockopt$TIPC_GROUP_LEAVE(r1, 0x10f, 0x88) (async, rerun: 32)
sendmmsg$inet6(r1, &(0x7f00000006c0)=[{{0x0, 0x0, &(0x7f0000000640)=[{&(0x7f00000002c0)="2b4e9e37eaec413e26196e83efdf92d0d5a3899d1f60329a208e60dbd96d51286f0b2afbbe00499af3b5caed8f6aa43f958b04bbb3504ab719bcbab725e1d2598ce7fe342d52a4b19b5256525bc8a93f4dea694dcf5fe2dc98f2c58c69b8feea0c4340ae503dd5f91daa3305c99ca8bfb11b894e468bf37f3511e69809d16a7c06dbbaa924b2eacd8c4d592905008afc2d5b78e7bd902630dbbe4b766c54aef61743e90c8459995cabc7271df076e308e7d29864", 0xb4}, {&(0x7f0000000380)="c8ed3fb33c1dab46fbe981cfe4e30f51fb5415e18f8604162ca48defe662c17d1be5205e8796c9d70c53603fafc3c37b957034d908bff23c340366516ece74b5104b4c920e771c9affba66fe23d2bf2d6872ce265bddfdfe95d98bbacb056a88759d50815b375184465bce8ab2b5e97112f9c3a7a44fcfe85813c096057a9cea10081f8090212c810ff80cd1e494f78215dc9cf7f845242ee86c212ba4d7928b6ad423134c8c48ee4d1c0fa662b961013d47fbd64e0d2e2b061e911e52dd6feff3587bc36734cc03f5fd6a1f85da4824c8ff1b4944ecfd09b447bb8e46c26e1127b29b", 0xe3}, {&(0x7f0000000480)="b3ed84034ca92ab897b2934b22f097adb4a4", 0x12}, {&(0x7f00000004c0)="15efc5f05de0efb2910a0f0267979e0b8fe0fdbcb1b6b3ad9112605a371ac6fd55eef70a1bb7028977d7be51aa2d9d5a674371a577368116a1fb30f0bc4b809401b49c152f2d3c621550d5ba6a4847535368f057c580094db8dc8ea18a48bdc0dbfb7bdc75ee1d2b1f9c6e208aa8d2afee5d6f089de60a1d005e86d32f4f6024dee50d5bb30affc9b7867081c30174f41dc25c1017ad3c1fffc99470ec75bfaf50134b63794b4b78b061238bd959360a58159018d1b18442a7022b1f19c4f1a5adc5c3ecfc21cca8d6b0bb5f579a11488ddd522709e2a8236852d2d80b", 0xdd}, {&(0x7f00000005c0)='&', 0x1}, {&(0x7f0000000600)="003d85b9d26e25be57969b45efbb996620ac7a08eeb18dbcf33a6e6d9a78899a734a8610af", 0x25}], 0x6}}], 0x1, 0x20000851) (async, rerun: 32)
r2 = socket$nl_generic(0x10, 0x3, 0x10)
r3 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000000), r2)
sendmsg$TIPC_NL_KEY_SET(r2, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000540)={0x18, r3, 0x1, 0x10, 0x0, {}, [@TIPC_NLA_NODE={0x4}]}, 0x18}}, 0x0) (async, rerun: 64)
ioctl$sock_ipv4_tunnel_SIOCDELTUNNEL(r0, 0x89f2, &(0x7f0000000140)={'syztnl0\x00', &(0x7f0000000080)={'syztnl2\x00', <r4=>0x0, 0x20, 0x80, 0x9, 0x9, {{0x1c, 0x4, 0x0, 0x32, 0x70, 0x67, 0x0, 0xf9, 0x29, 0x0, @private=0xa010102, @private=0xa010102, {[@generic={0x86, 0x8, "56f772a65f23"}, @cipso={0x86, 0x53, 0x3, [{0x7, 0xd, "dca363e4a5b31540c80523"}, {0x2, 0xd, "80679a649c0f2e9a3b4f00"}, {0x1, 0xb, "befcbb3f8f009fece4"}, {0x5, 0xb, "51c289aca75218d7a1"}, {0x0, 0xd, "8ef29c9a09ab5f3ecce5a7"}, {0x7, 0x6, "72ba39a7"}, {0x5, 0xa, "f144ba9921209f9e"}]}]}}}}}) (rerun: 64)
ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(r0, 0x89f1, &(0x7f0000000280)={'tunl0\x00', &(0x7f0000000180)={'syztnl0\x00', r4, 0x8, 0x40, 0x3ff, 0xfffffe00, {{0x25, 0x4, 0x0, 0x2a, 0x94, 0x68, 0x0, 0x9, 0x29, 0x0, @initdev={0xac, 0x1e, 0x1, 0x0}, @initdev={0xac, 0x1e, 0x1, 0x0}, {[@cipso={0x86, 0x1e, 0x1, [{0x0, 0x7, "fc1dc0731c"}, {0x2, 0x11, "d68fed09ea99e4ec19d8ba5dc01c89"}]}, @noop, @lsrr={0x83, 0x1b, 0xd2, [@remote, @empty, @private=0xa010102, @loopback, @broadcast, @remote]}, @timestamp={0x44, 0x24, 0x34, 0x0, 0x4, [0x4, 0x8, 0x8, 0xb, 0x9, 0xfffffffa, 0x80000000, 0x5]}, @cipso={0x86, 0x1a, 0x0, [{0x0, 0x8, "b343e0e9174e"}, {0x2, 0xc, "6a4f507103c0d572ab86"}]}, @ssrr={0x89, 0x7, 0x93, [@rand_addr=0x64010100]}]}}}}})

168.859486ms ago: executing program 1 (id=3466):
syz_emit_ethernet(0x46, &(0x7f0000000000)={@broadcast, @empty, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x38, 0x4, 0x0, 0xfe, 0x1, 0x0, @rand_addr=0x64010101, @dev={0xac, 0x14, 0x14, 0xc}}, @time_exceeded={0x5, 0x0, 0x0, 0xe0, 0x1, 0xe000, {0x5, 0x4, 0x0, 0x0, 0x3, 0x4, 0x0, 0x0, 0x11, 0x0, @initdev={0xac, 0x1e, 0x1, 0x0}, @multicast1}, "83a03dadfcd78479"}}}}}, 0x0)
mmap(&(0x7f0000001000/0xc00000)=nil, 0xc00000, 0x2000004, 0x3b071, 0xffffffffffffffff, 0x0)
bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=@base={0x1b, 0x0, 0x0, 0x8000}, 0x2c)
bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={&(0x7f0000000100)=ANY=[@ANYBLOB="9feb011018"], &(0x7f0000000f80)=""/4115, 0x31, 0x1013, 0x9}, 0x28)
syz_emit_ethernet(0x46, &(0x7f0000000000)={@broadcast, @empty, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x38, 0x4, 0x0, 0xfe, 0x1, 0x0, @rand_addr=0x64010101, @dev={0xac, 0x14, 0x14, 0xc}}, @time_exceeded={0x5, 0x0, 0x0, 0xe0, 0x1, 0xe000, {0x5, 0x4, 0x0, 0x0, 0x3, 0x4, 0x0, 0x0, 0x11, 0x0, @initdev={0xac, 0x1e, 0x1, 0x0}, @multicast1}, "83a03dadfcd78479"}}}}}, 0x0) (async)
mmap(&(0x7f0000001000/0xc00000)=nil, 0xc00000, 0x2000004, 0x3b071, 0xffffffffffffffff, 0x0) (async)
bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=@base={0x1b, 0x0, 0x0, 0x8000}, 0x2c) (async)
bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={&(0x7f0000000100)=ANY=[@ANYBLOB="9feb011018"], &(0x7f0000000f80)=""/4115, 0x31, 0x1013, 0x9}, 0x28) (async)

89.502767ms ago: executing program 3 (id=3467):
r0 = bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0x10, 0x4, &(0x7f0000000040)=ANY=[@ANYBLOB="b4000000000000007910480000000000610400000000000095000000"], &(0x7f0000003ff6)='GPL\x00', 0x2, 0xfd90, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @sk_msg}, 0x48)
close(r0)
socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000940)={<r1=>0xffffffffffffffff})
r2 = bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0xe, 0x4, &(0x7f0000000540)=ANY=[@ANYBLOB="b4050000fdff7f006110580000000000c60000000000000095000000000000009f33ef60916e6e713f1eeb0b725ad99b817fd98cd824498949714ffaac8a6f770600dcca55f21f3ca9e822d182054d54d53cd2b6db714e4beb5447000001000000008f2b9000f22425e4097ed62cbc891061017cfa6fa26fa7088c60897d4a6148a1c1e43f00001bde60beac671e8e8fdecb03588aa623fa71f31bf0f871ab5c2ff88afc60027f4e5b5271ed58e835cf0d0000000098b51fe6b1b8d9dbe87dcff414ed000000000000000000000000000000000000000000000000000000b347abe6352a080f8140e5fd10747b6ecdb3540546bf636e3d6e700e5b0500000000000000eb9e1403e6c8f7a187eaf60f3a17f0f046a307a403c19d9829c90bd2114252581567acae715cbe1b57d5cda432c5b910400623d24195405f2e76ccb7b37b41215c184e731fb1"], &(0x7f0000003ff6)='GPL\x00', 0x4, 0xc6, &(0x7f0000000740)=""/198, 0x0, 0x13, '\x00', 0x0, @sk_skb, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x8, 0x10, &(0x7f0000000000), 0x10, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x10, 0xfffffffe}, 0x94)
r3 = bpf$MAP_CREATE(0x0, &(0x7f0000000200)=@base={0xf, 0x4, 0x4, 0x12}, 0x48)
bpf$BPF_PROG_DETACH(0x8, &(0x7f0000000980)={@map=r3, r2, 0x26}, 0x20)
bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f00000000c0)={{r3}, &(0x7f0000000000), &(0x7f0000000080)=r0}, 0x20)
r4 = socket$nl_generic(0x10, 0x3, 0x10)
r5 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200), 0xffffffffffffffff)
r6 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route(r6, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000200)=ANY=[@ANYBLOB="60000000100001060000000000000000000000000000000000000000000000000d000300626172657564703000000000300012000c00010062617265756470002000020006000100b5120000060002008847000006000300e8030000040004"], 0x60}}, 0x0)
mmap(&(0x7f0000002000/0x3000)=nil, 0x3000, 0x3000001, 0x32, 0xffffffffffffffff, 0x0)
bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x18, 0xb, 0x0, &(0x7f0000000180)='GPL\x00', 0x4, 0xde, &(0x7f0000003e40)=""/222}, 0x94)
socketpair(0x1, 0x1, 0x0, &(0x7f0000000000)={<r7=>0xffffffffffffffff})
r8 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10)
r9 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10)
syz_genetlink_get_family_id$netlbl_cipso(&(0x7f0000000bc0), r9)
sendmsg$NLBL_CIPSOV4_C_ADD(r9, 0x0, 0x0)
r10 = syz_genetlink_get_family_id$nbd(&(0x7f0000000040), 0xffffffffffffffff)
sendmsg$NBD_CMD_CONNECT(r8, &(0x7f0000001ac0)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f0000000140)=ANY=[@ANYBLOB='H\x00\x00\x00', @ANYRES16=r10, @ANYBLOB="01002bbd700000100000010000000c00020009000000000000001c0007800c00018008000100", @ANYRES32=r7, @ANYBLOB="0c00018008000100", @ANYRES32=r7, @ANYBLOB="0c000500220100000000"], 0x48}}, 0x400400c)
bpf$MAP_DELETE_BATCH(0x1b, &(0x7f0000000500)={&(0x7f00000002c0)="6a05848e44b57035b8051a1d05cc6ca5dd7f2f57685e8f5a18e446fe07601a54e200a06aa402495206a603a515f8b35e631709baaaf48abc0382948b9bae7d4c0939e90695f589ba497e9258bcf0c23695bd4f543e5f7dec99c956d379ba8b58cc5925c988d70254b3456e6ebc5b9ec792c62f8d4a0bf02d3bfc6157a6305cf05dc5f4409b64b0daa7e55ad8ab3ba03d496276651818b310b07b743892a404c25004eceb3ce119d117ace6ecdd0b507b6a", &(0x7f00000003c0)=""/138, &(0x7f0000000480)="34e8f9a2a8564c1b58d638bd304155c12674575cca3b75f34f562d3ed9f15cad3a5ef255885720be5687cd8d72f0ac52793cea319972ae3afc766b", &(0x7f00000004c0)="db22baac04568bcb2337d57e", 0x6}, 0x38)
bpf$MAP_UPDATE_BATCH(0x1a, &(0x7f0000000900)={0x0, 0x0, &(0x7f0000000880)="7497ab0b2a60809b1b83d6472beecc7aec1f7a975f28e2501ef1e3411ccfbfc8d32246272f4c13a96196042e4c1915e782ab1eb835faf334feb12ac6b3cb717c863127d81890f5b05918db49e81a78cd", &(0x7f0000000280), 0xffff}, 0x38)
bpf$MAP_UPDATE_BATCH(0x1a, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000003c0), &(0x7f00000002c0), 0x1006, 0xffffffffffffffff, 0x0, 0xd88d02a0}, 0x38)
ioctl$sock_SIOCGIFINDEX_80211(r4, 0x8933, &(0x7f0000000700)={'wlan1\x00', <r11=>0x0})
setsockopt$inet_sctp_SCTP_ADAPTATION_LAYER(0xffffffffffffffff, 0x84, 0x7, &(0x7f0000000380), 0x4)
sendmsg$NL80211_CMD_JOIN_MESH(r4, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000040)=ANY=[@ANYBLOB='|\x00\x00\x00', @ANYRES16=r5, @ANYBLOB="050000000000000002004400000008000300", @ANYRES32=r11, @ANYBLOB="0a001800030303030303000040007000050001"], 0x7c}}, 0x44050)
ioctl$XFS_IOC_ATTRLIST_BY_HANDLE(r4, 0x4058587a, &(0x7f0000000180)={{<r12=>r4, &(0x7f0000000000)='nl80211\x00', 0x8100, &(0x7f0000000840)={@align, {0x7, 0x1, 0x7, 0x80000000488b}}, 0x1, &(0x7f00000000c0)={@_ha_fsid}, &(0x7f0000000100)}, {[0x8, 0x800, 0x37fffffe, 0x1000]}, 0x10003, 0x24, &(0x7f0000000140)=""/36})
getpeername$packet(0xffffffffffffffff, &(0x7f0000000240)={0x11, 0x0, <r13=>0x0, 0x1, 0x0, 0x6, @multicast}, &(0x7f0000000280)=0x14)
setsockopt$inet_pktinfo(r12, 0x0, 0x8, &(0x7f00000002c0)={r13, @local, @multicast2}, 0xc)
recvmsg$unix(r1, &(0x7f00000004c0)={0x0, 0x0, &(0x7f0000000300)=[{&(0x7f0000001780)=""/4071, 0xfe7}], 0x1}, 0x40000102)

0s ago: executing program 4 (id=3468):
r0 = socket$nl_route(0x10, 0x3, 0x0)
r1 = socket$kcm(0x2, 0x3, 0x2)
sendmsg$inet(r1, &(0x7f0000001640)={&(0x7f0000000300)={0x2, 0x1, @broadcast}, 0x10, 0x0, 0x0, &(0x7f00000000c0)=[@ip_pktinfo={{0x1c, 0x0, 0x8, {0x0, @dev={0xac, 0x14, 0x14, 0x3c}, @multicast1}}}, @ip_retopts={{0x10}}], 0x30}, 0x20000084)
r2 = socket(0x23, 0x801, 0x8e)
connect$vsock_stream(r2, &(0x7f0000000880)={0x28, 0x0, 0x0, @local}, 0x10)
socket$vsock_stream(0x28, 0x1, 0x0)
bpf$MAP_CREATE(0x0, &(0x7f0000000640)=ANY=[], 0x48)
setsockopt$IP6T_SO_SET_REPLACE(r2, 0x29, 0x40, &(0x7f0000000a00)=@filter={'filter\x00', 0xe, 0x4, 0x358, 0xffffffff, 0xe8, 0xe8, 0xc8, 0xffffffff, 0xffffffff, 0xe8, 0x288, 0xe8, 0xffffffff, 0x4, 0x0, {[{{@uncond, 0x0, 0xa8, 0xe8}, @common=@inet=@TCPOPTSTRIP={0x40}}, {{@uncond, 0x0, 0xa8, 0xd0}, @common=@unspec=@STANDARD={0x28, '\x00', 0x0, 0xffffffffffffffff}}, {{@uncond, 0x0, 0xa8, 0xd0}, @common=@inet=@SYNPROXY={0x28}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x3b8)
r3 = socket$inet6(0xa, 0x3, 0xff)
setsockopt$IP6T_SO_SET_REPLACE(r3, 0x29, 0x40, &(0x7f0000000100)=@filter={'filter\x00', 0xe, 0x4, 0x368, 0xffffffff, 0x0, 0xd0, 0x1a0, 0xffffffff, 0xffffffff, 0x0, 0xd0, 0x298, 0xffffffff, 0x4, 0x0, {[{{@uncond, 0x0, 0xa8, 0xd0}, @common=@unspec=@STANDARD={0x28, '\x00', 0x0, 0xfffffffe}}, {{@uncond, 0x0, 0xa8, 0xd0}, @common=@unspec=@STANDARD={0x28, '\x00', 0x0, 0xfffffffe}}, {{@ipv6={@empty, @empty}, 0x0, 0xd0, 0xf8, 0x0, {}, [@common=@inet=@dscp={{0x28}}]}, @common=@unspec=@STANDARD={0x28, '\x00', 0x0, 0xfffffffe}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x3c8)
r4 = socket(0xa, 0x3, 0xff)
sendmsg$inet6(r4, &(0x7f0000001c00)={&(0x7f0000000140)={0xa, 0xa, 0x7, @dev={0xfe, 0x80, '\x00', 0x35}}, 0x1c, &(0x7f0000000480)=[{&(0x7f00000009c0)="671723d7c60133", 0x7}, {&(0x7f00000006c0)="9e91d91a92dc796fff655bb539e2ffb332820636ab4a4f2ba30000", 0x1b}, {&(0x7f0000000400)="dcdd61e53a41", 0x6}], 0x3}, 0x20008b88)
pselect6(0x40, &(0x7f0000000100)={0xffffffffffffffff, 0x8000000000000, 0x0, 0x7ffffffffff, 0x0, 0xfffffffffffff30a, 0x1}, &(0x7f0000000000)={0x1f, 0x8000000000000401, 0x0, 0x0, 0x6, 0x0, 0xb, 0xa}, 0x0, 0x0, 0x0)
sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=ANY=[@ANYBLOB="2000000010001e00000000000000000000000000e4bbf49ed5a9519539b4eae030747da3d9d9f67ba2097ec8ff26671113d7c1fad404068871548dd6f50bf4664fced9b820e07f130760a5a20ca1d67a3778156e1432a4128020bbdd95aa5865841c2432c90186850fc0e524eb20ae82b167e7d2e7f08346449e1e9434c90e5bdb6b986d373d3a834b8001cbc89ee0979c751b16730dfaf0f0e56e4faffd1578aabe29e1073ab866fbfbe29fdfa7754e9aeae93125ba91017824f100904d7c5b586b", @ANYRES32=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], 0x20}}, 0x0)
setsockopt$WPAN_SECURITY(0xffffffffffffffff, 0x0, 0x1, &(0x7f0000000040)=0x1, 0x4)
ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8b1a, &(0x7f0000000140)={'wlan0\x00'})

kernel console output (not intermixed with test programs):

ntered allmulticast mode
[  440.764376][T17823] netlink: 12 bytes leftover after parsing attributes in process `syz.5.2816'.
[  441.029697][T17835] openvswitch: netlink: IPv4 tunnel dst address is zero
[  441.029730][T17835] openvswitch: netlink: Flow actions may not be safe on all matching packets.
[  441.451750][ T5625] Bluetooth: hci4: command tx timeout
[  441.828035][T17845] netlink: 80 bytes leftover after parsing attributes in process `syz.3.2820'.
[  442.366960][T17869] netlink: 6984 bytes leftover after parsing attributes in process `syz.3.2825'.
[  442.984122][T17891] netlink: 20 bytes leftover after parsing attributes in process `syz.4.2829'.
[  443.071872][T17863] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium
[  443.483860][T17913] netlink: 4 bytes leftover after parsing attributes in process `syz.3.2833'.
[  443.570937][T17915] netlink: 'syz.5.2835': attribute type 58 has an invalid length.
[  443.570958][T17915] netlink: 20 bytes leftover after parsing attributes in process `syz.5.2835'.
[  443.640532][T17918] netlink: 12 bytes leftover after parsing attributes in process `syz.3.2836'.
[  443.979194][T17931] syzkaller0: entered promiscuous mode
[  443.979216][T17931] syzkaller0: entered allmulticast mode
[  444.100177][T17943] netlink: 16 bytes leftover after parsing attributes in process `syz.4.2840'.
[  444.923428][T17962] netlink: 'syz.4.2846': attribute type 1 has an invalid length.
[  444.978469][T17962] 8021q: adding VLAN 0 to HW filter on device bond20
[  445.064698][T17959] bond20: (slave geneve3): making interface the new active one
[  445.067633][T17959] bond20: (slave geneve3): Enslaving as an active interface with an up link
[  445.582656][T17982] openvswitch: netlink: Encap mask attribute is set for non-VLAN frame.
[  445.590112][T17989] openvswitch: netlink: Encap mask attribute is set for non-VLAN frame.
[  446.759111][T17921] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512
[  446.982706][    C1] ip6_tunnel: ip6gretap3 xmit: Local address not yet configured!
[  447.000870][T18000] netlink: 'syz.3.2855': attribute type 61 has an invalid length.
[  447.025127][T17996] __nla_validate_parse: 4 callbacks suppressed
[  447.025146][T17996] netlink: 24 bytes leftover after parsing attributes in process `syz.0.2854'.
[  447.152157][T18002] netlink: 32 bytes leftover after parsing attributes in process `syz.1.2857'.
[  447.168375][T18003] netlink: 32 bytes leftover after parsing attributes in process `syz.1.2857'.
[  447.204041][T18014] netlink: 'syz.1.2857': attribute type 1 has an invalid length.
[  447.264597][T18016] netlink: 16 bytes leftover after parsing attributes in process `syz.1.2857'.
[  447.389364][T18006] sch_tbf: burst 88 is lower than device veth11 mtu (1514) !
[  447.390342][T18002] netlink: 12 bytes leftover after parsing attributes in process `syz.1.2857'.
[  447.390522][T18003] netlink: 12 bytes leftover after parsing attributes in process `syz.1.2857'.
[  447.438670][ T1095] tipc: Subscription rejected, illegal request
[  447.460456][T18019] netlink: 'syz.4.2860': attribute type 1 has an invalid length.
[  447.460476][T18019] netlink: 224 bytes leftover after parsing attributes in process `syz.4.2860'.
[  447.552344][T18027] netlink: 'syz.0.2862': attribute type 1 has an invalid length.
[  447.552365][T18027] netlink: 244 bytes leftover after parsing attributes in process `syz.0.2862'.
[  447.553264][T18027] xt_NFQUEUE: number of total queues is 0
[  447.759865][T18032] IPVS: ip_vs_edit_dest(): server weight less than zero
[  447.761653][T18032] IPVS: ip_vs_edit_dest(): server weight less than zero
[  447.787744][T18032] netlink: 44 bytes leftover after parsing attributes in process `syz.0.2864'.
[  447.994814][T18049] openvswitch: netlink: IP tunnel attribute has 8 unknown bytes.
[  447.994849][T18049] openvswitch: netlink: Flow actions may not be safe on all matching packets.
[  448.069109][T18049] netlink: 44 bytes leftover after parsing attributes in process `syz.3.2866'.
[  448.325292][T18062] openvswitch: netlink: nsh attr 251 is out of range max 3
[  448.392477][T18062] bond11: entered promiscuous mode
[  448.393087][T18062] 8021q: adding VLAN 0 to HW filter on device bond11
[  448.750599][T18084] xt_recent: Unsupported userspace flags (000000c5)
[  449.271061][T18118] syzkaller0: entered promiscuous mode
[  449.271083][T18118] syzkaller0: entered allmulticast mode
[  449.394963][T18119] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check.
[  449.710769][T18136] netlink: 'syz.1.2887': attribute type 1 has an invalid length.
[  449.763065][T18132] netlink: 'syz.4.2886': attribute type 39 has an invalid length.
[  449.797251][T18139] bridge: RTM_NEWNEIGH with unconfigured vlan 1 on bridge0
[  450.264669][T18149] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check.
[  450.269622][T18153] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check.
[  450.909312][T18172] tc_dump_action: action bad kind
[  450.949094][T18173] tc_dump_action: action bad kind
[  451.190374][T18196] ip6_tables: ip6tables: counters copy to user failed while replacing table
[  451.989362][T18221] openvswitch: netlink: Flow key attr not present in new flow.
[  452.086080][    C1] ip6_tunnel: L xmit: Local address not yet configured!
[  452.355027][T18241] __nla_validate_parse: 15 callbacks suppressed
[  452.355046][T18241] netlink: 100 bytes leftover after parsing attributes in process `syz.4.2913'.
[  452.355065][T18241] netlink: 239 bytes leftover after parsing attributes in process `syz.4.2913'.
[  452.355243][T18243] netlink: 100 bytes leftover after parsing attributes in process `syz.4.2913'.
[  452.355258][T18243] netlink: 239 bytes leftover after parsing attributes in process `syz.4.2913'.
[  452.464232][ T1095] IPVS: starting estimator thread 0...
[  452.479853][T18241] netlink: 'syz.4.2913': attribute type 2 has an invalid length.
[  452.479875][T18241] netlink: 228 bytes leftover after parsing attributes in process `syz.4.2913'.
[  452.484017][T18223] IPVS: set_ctl: invalid protocol: 0 0.0.0.0:0
[  452.549451][T18248] IPVS: using max 42 ests per chain, 100800 per kthread
[  452.565343][T18243] netlink: zone id is out of range
[  452.565357][T18243] netlink: zone id is out of range
[  452.565365][T18243] netlink: zone id is out of range
[  452.565372][T18243] netlink: zone id is out of range
[  452.565379][T18243] netlink: zone id is out of range
[  452.565385][T18243] netlink: zone id is out of range
[  452.565392][T18243] netlink: zone id is out of range
[  452.565398][T18243] netlink: zone id is out of range
[  452.605437][T18253] netlink: 'syz.0.2916': attribute type 16 has an invalid length.
[  452.605457][T18253] netlink: 'syz.0.2916': attribute type 17 has an invalid length.
[  452.890831][T18264] netlink: 20 bytes leftover after parsing attributes in process `syz.1.2918'.
[  453.144503][T18253] bridge0: port 2(bridge_slave_1) entered disabled state
[  453.407859][T18253] batman_adv: batadv0: Interface deactivated: batadv_slave_0
[  453.524947][T18253] bond6: left allmulticast mode
[  453.524965][T18253] ip6gretap3: left allmulticast mode
[  453.524973][T18253] bond6: left promiscuous mode
[  453.524979][T18253] ip6gretap3: left promiscuous mode
[  453.528294][T18253] macvlan4: left promiscuous mode
[  453.528313][T18253] macvlan4: left allmulticast mode
[  453.631046][T18253] bond8: left promiscuous mode
[  453.649856][T18253] ip6erspan1: left allmulticast mode
[  453.652299][T18253] bond11: left promiscuous mode
[  453.656952][T10675] netdevsim netdevsim0 netdevsim0: unset [0, 0] type 1 family 0 port 8472 - 0
[  453.657013][T10675] netdevsim netdevsim0 netdevsim1: unset [0, 0] type 1 family 0 port 8472 - 0
[  453.657046][T10675] netdevsim netdevsim0 netdevsim2: unset [0, 0] type 1 family 0 port 8472 - 0
[  453.657078][T10675] netdevsim netdevsim0 netdevsim3: unset [0, 0] type 1 family 0 port 8472 - 0
[  453.753939][T18265] virt_wifi0: entered promiscuous mode
[  453.753960][T18265] virt_wifi0: entered allmulticast mode
[  453.809762][T18276] netlink: 4 bytes leftover after parsing attributes in process `syz.5.2917'.
[  454.098113][T18286] nbd2: detected capacity change from 0 to 63
[  454.231979][T18288] veth0_to_batadv: Caught tx_queue_len zero misconfig
[  454.271418][ T5625] block nbd2: Receive control failed (result -104)
[  454.464406][T18301] netlink: 9900 bytes leftover after parsing attributes in process `syz.0.2925'.
[  454.464430][T18301] batman_adv: batadv0: Removing interface: batadv_slave_0
[  454.478428][T18301] batman_adv: batadv0: Removing interface: ip6gretap1
[  454.758727][T18317] can: request_module (can-proto-0) failed.
[  455.041882][T18335] netlink: 'syz.5.2933': attribute type 1 has an invalid length.
[  455.205082][T18335] bond2: entered promiscuous mode
[  455.210120][T18335] 8021q: adding VLAN 0 to HW filter on device bond2
[  455.274658][T18335] bond2: (slave bridge1): making interface the new active one
[  455.274683][T18335] bridge1: entered promiscuous mode
[  455.289676][T18335] bond2: (slave bridge1): Enslaving as an active interface with an up link
[  455.434727][T18354] netlink: 'syz.4.2936': attribute type 1 has an invalid length.
[  455.434749][T18354] netlink: 248 bytes leftover after parsing attributes in process `syz.4.2936'.
[  455.457347][T18353] netlink: 59 bytes leftover after parsing attributes in process `syz.5.2938'.
[  455.812260][T18361] xt_hashlimit: size too large, truncated to 1048576
[  455.974185][T18366] batadv0: entered promiscuous mode
[  455.977117][T18366] macvtap1: entered promiscuous mode
[  455.980313][T18366] macvtap1: entered allmulticast mode
[  455.980332][T18366] batadv0: entered allmulticast mode
[  455.981552][T18366] 8021q: adding VLAN 0 to HW filter on device macvtap1
[  456.073538][T18366] batadv0: left allmulticast mode
[  456.073900][T18366] batadv0: left promiscuous mode
[  456.204871][ T5628] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1
[  456.223032][ T5628] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9
[  456.233771][ T5628] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9
[  456.258880][ T5628] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4
[  456.262850][ T5628] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2
[  456.319131][T18369] ip6tnl0: Caught tx_queue_len zero misconfig
[  456.363389][ T5620] syz_tun (unregistering): left allmulticast mode
[  456.624132][T18389] net_ratelimit: 6 callbacks suppressed
[  456.624150][T18389] openvswitch: netlink: Flow actions may not be safe on all matching packets.
[  457.047628][T18405] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check.
[  457.058268][T18408] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check.
[  457.639467][T18374] bridge0: port 1(bridge_slave_0) entered blocking state
[  457.639669][T18374] bridge0: port 1(bridge_slave_0) entered disabled state
[  457.642169][T18374] bridge_slave_0: entered allmulticast mode
[  457.666076][T18374] bridge_slave_0: entered promiscuous mode
[  457.669992][T18374] bridge0: port 2(bridge_slave_1) entered blocking state
[  457.670090][T18374] bridge0: port 2(bridge_slave_1) entered disabled state
[  457.670215][T18374] bridge_slave_1: entered allmulticast mode
[  457.675117][T18374] bridge_slave_1: entered promiscuous mode
[  457.786847][T18431] IPVS: persistence engine module ip_vs_pe_À not found
[  457.821206][T18374] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link
[  457.836222][T18374] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link
[  457.978244][T18444] __nla_validate_parse: 2 callbacks suppressed
[  457.978264][T18444] netlink: 4 bytes leftover after parsing attributes in process `syz.4.2959'.
[  458.030077][T18445] netlink: 8 bytes leftover after parsing attributes in process `syz.4.2959'.
[  458.032741][T18445] netlink: 4 bytes leftover after parsing attributes in process `syz.4.2959'.
[  458.326039][ T5625] Bluetooth: hci3: command tx timeout
[  460.406522][ T5625] Bluetooth: hci3: command tx timeout
[  460.737900][T18374] team0: Port device team_slave_0 added
[  460.770262][T18456] netlink: 4 bytes leftover after parsing attributes in process `syz.5.2961'.
[  460.823039][T18459] netlink: 12 bytes leftover after parsing attributes in process `syz.5.2961'.
[  460.829894][T18374] team0: Port device team_slave_1 added
[  460.898582][T18458] block nbd0: reconnected socket
[  460.898601][T18458] nbd: socks must be embedded in a SOCK_ITEM attr
[  460.901263][T18462] xt_hashlimit: size too large, truncated to 1048576
[  460.952535][ T5625] block nbd0: Receive control failed (result -32)
[  460.970253][T18374] batman_adv: batadv0: Adding interface: batadv_slave_0
[  460.970270][T18374] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem.
[  460.970293][T18374] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active
[  460.984412][T18374] batman_adv: batadv0: Adding interface: batadv_slave_1
[  460.984427][T18374] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem.
[  460.984450][T18374] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active
[  461.104557][T18469] xt_hashlimit: size too large, truncated to 1048576
[  461.213130][T18374] hsr_slave_0: entered promiscuous mode
[  461.214266][T18374] hsr_slave_1: entered promiscuous mode
[  461.215131][T18374] debugfs: 'hsr0' already exists in 'hsr'
[  461.215149][T18374] Cannot create hsr debugfs directory
[  461.245385][T18456] netlink: 24 bytes leftover after parsing attributes in process `syz.5.2961'.
[  461.384209][T18480] netlink: 160 bytes leftover after parsing attributes in process `syz.3.2965'.
[  461.740164][T18496] netlink: 8 bytes leftover after parsing attributes in process `syz.1.2969'.
[  461.812730][T18498] netlink: 48 bytes leftover after parsing attributes in process `syz.5.2970'.
[  462.337017][T10675] team0: Port device netdevsim0 removed
[  462.486740][ T5625] Bluetooth: hci3: command tx timeout
[  462.832671][T10675] bridge_slave_1: left allmulticast mode
[  462.832695][T10675] bridge_slave_1: left promiscuous mode
[  462.832927][T10675] bridge0: port 2(bridge_slave_1) entered disabled state
[  462.972649][T18532] netlink: 'syz.3.2979': attribute type 2 has an invalid length.
[  462.972671][T18532] netlink: 40 bytes leftover after parsing attributes in process `syz.3.2979'.
[  463.008088][T10675] bond6 (unregistering): (slave ip6gretap3): Releasing active interface
[  463.081348][T18538] netlink: 20 bytes leftover after parsing attributes in process `syz.3.2979'.
[  463.112424][T18537] xt_l2tp: invalid flags combination: 8
[  463.419783][ T5816] hid-generic 0005:0008:0009.0001: item fetching failed at offset 2/3
[  463.420620][ T5816] hid-generic 0005:0008:0009.0001: probe with driver hid-generic failed with error -22
[  463.530469][T10675] bond9 (unregistering): (slave gretap1): Releasing active interface
[  463.630678][T10675] bond4 (unregistering): (slave geneve3): Releasing active interface
[  463.880324][T10675] bond3 (unregistering): (slave macvlan3): Releasing active interface
[  463.885200][T10675] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface
[  463.904242][T10675] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface
[  463.905294][T10675] bond0 (unregistering): Released all slaves
[  463.917162][T10675] bond1 (unregistering): Released all slaves
[  463.931409][T10675] bond2 (unregistering): Released all slaves
[  463.941396][T10675] bond3 (unregistering): Released all slaves
[  463.954682][T10675] bond4 (unregistering): Released all slaves
[  463.965160][T10675] bond5 (unregistering): Released all slaves
[  463.981144][T10675] team0: Port device macvlan4 removed
[  463.984715][T10675] bond6 (unregistering): Released all slaves
[  464.013828][T10675] bond7 (unregistering): Released all slaves
[  464.025076][T10675] bond8 (unregistering): Released all slaves
[  464.036733][T10675] bond9 (unregistering): Released all slaves
[  464.053976][T10675] bond10 (unregistering): Released all slaves
[  464.071216][T10675] bond11 (unregistering): Released all slaves
[  464.102163][T18532] : entered promiscuous mode
[  464.233861][T10675] 
þ: left promiscuous mode
[  464.389133][T18556] netlink: 4 bytes leftover after parsing attributes in process `syz.3.2982'.
[  464.433997][T10675] tipc: Disabling bearer <udp:syz2>
[  464.434790][T10675] tipc: Left network mode
[  464.575473][ T5625] Bluetooth: hci3: command tx timeout
[  465.000305][T10675] veth1_to_team: left promiscuous mode
[  465.004520][T10675] hsr_slave_0: left promiscuous mode
[  465.004993][T10675] hsr_slave_1: left promiscuous mode
[  465.230003][T18514] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512
[  465.356712][T10675] team0 (unregistering): Port device team_slave_1 removed
[  465.444738][T18561] netlink: 'syz.3.2983': attribute type 2 has an invalid length.
[  465.470248][T10675] team0 (unregistering): Port device team_slave_0 removed
[  465.552437][T18569] netlink: 12 bytes leftover after parsing attributes in process `syz.4.2986'.
[  465.552474][T18569] openvswitch: netlink: Flow actions may not be safe on all matching packets.
[  465.708813][T18574] netlink: 12 bytes leftover after parsing attributes in process `syz.1.2987'.
[  465.800111][T18374] netdevsim netdevsim0 netdevsim0: renamed from eth0
[  465.818451][T18374] 8021q: adding VLAN 0 to HW filter on device netdevsim0
[  465.835078][T18561] 
þ: entered promiscuous mode
[  465.873702][T18374] netdevsim netdevsim0 netdevsim1: renamed from eth1
[  465.900856][T18374] 8021q: adding VLAN 0 to HW filter on device netdevsim1
[  465.930853][T18374] netdevsim netdevsim0 netdevsim2: renamed from eth2
[  465.962751][T18374] 8021q: adding VLAN 0 to HW filter on device netdevsim2
[  465.963682][T18374] netdevsim netdevsim0 netdevsim3: renamed from eth3
[  465.997176][T18374] 8021q: adding VLAN 0 to HW filter on device netdevsim3
[  466.175785][T18374] 8021q: adding VLAN 0 to HW filter on device bond0
[  466.244488][T18374] 8021q: adding VLAN 0 to HW filter on device team0
[  466.272510][ T1401] bridge0: port 1(bridge_slave_0) entered blocking state
[  466.272623][ T1401] bridge0: port 1(bridge_slave_0) entered forwarding state
[  466.311691][ T1401] bridge0: port 2(bridge_slave_1) entered blocking state
[  466.311793][ T1401] bridge0: port 2(bridge_slave_1) entered forwarding state
[  466.558853][T10675] IPVS: stop unused estimator thread 0...
[  466.702522][T18603] bond21 (unregistering): Released all slaves
[  466.924132][T18610] syzkaller1: tun_chr_ioctl cmd 1074025677
[  466.924245][T18610] syzkaller1: linktype set to 825
[  466.925379][T18610] syzkaller1: tun_chr_ioctl cmd 1074025692
[  466.929911][T18610] netlink: 16 bytes leftover after parsing attributes in process `syz.5.2993'.
[  467.139029][T18627] netlink: 12 bytes leftover after parsing attributes in process `syz.3.2997'.
[  467.513090][T18646] netlink: 160 bytes leftover after parsing attributes in process `syz.4.3000'.
[  467.513114][T18646] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check.
[  467.923269][T18633] virtio_blk virtio4: 1/0/0 default/read/poll queues
[  467.981001][T18633] virtio_blk virtio4: [vda] 262144 512-byte logical blocks (134 MB/128 MiB)
[  468.381366][T18374] 8021q: adding VLAN 0 to HW filter on device batadv0
[  468.552666][T18374] veth0_vlan: entered promiscuous mode
[  468.607140][T18374] veth1_vlan: entered promiscuous mode
[  468.962925][T18374] veth0_macvtap: entered promiscuous mode
[  468.987790][T18374] veth1_macvtap: entered promiscuous mode
[  469.134474][T18374] batman_adv: batadv0: Interface activated: batadv_slave_0
[  469.179662][T18374] batman_adv: batadv0: Interface activated: batadv_slave_1
[  469.237155][  T225] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0
[  469.237762][  T225] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0
[  469.239589][ T1095] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0
[  469.239625][ T1095] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0
[  469.491746][ T1401] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[  469.491766][ T1401] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50
[  469.575202][ T1401] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[  469.575221][ T1401] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50
[  470.023573][T18720] FAULT_INJECTION: forcing a failure.
[  470.023573][T18720] name fail_page_alloc, interval 1, probability 0, space 0, times 0
[  470.023604][T18720] CPU: 1 UID: 0 PID: 18720 Comm: syz.3.3008 Not tainted syzkaller #0 PREEMPT(full) 
[  470.023624][T18720] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026
[  470.023636][T18720] Call Trace:
[  470.023693][T18720]  <TASK>
[  470.023760][T18720]  dump_stack_lvl+0xe8/0x150
[  470.023903][T18720]  should_fail_ex+0x410/0x560
[  470.023991][T18720]  prepare_alloc_pages+0x223/0x600
[  470.024041][T18720]  __alloc_frozen_pages_noprof+0x185/0x5a0
[  470.024067][T18720]  ? __pfx___alloc_frozen_pages_noprof+0x10/0x10
[  470.024123][T18720]  ? __pfx_policy_nodemask+0x10/0x10
[  470.024151][T18720]  ? __get_vm_area_node+0x155/0x2f0
[  470.024184][T18720]  ? __vmalloc_node_range_noprof+0x343/0x1540
[  470.024210][T18720]  ? __vmalloc_noprof+0xd2/0x120
[  470.024233][T18720]  ? bpf_prog_calc_tag+0x51/0x370
[  470.024273][T18720]  ? check_and_resolve_insns+0xbb/0x21d0
[  470.024303][T18720]  ? bpf_prog_load+0x14d6/0x1c20
[  470.024322][T18720]  ? __sys_bpf+0xd0d/0xd90
[  470.024339][T18720]  ? __x64_sys_bpf+0xba/0xd0
[  470.024355][T18720]  ? do_syscall_64+0x166/0x520
[  470.024473][T18720]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  470.024514][T18720]  alloc_pages_mpol+0x21e/0x390
[  470.024543][T18720]  alloc_pages_noprof+0xb1/0x2b0
[  470.024569][T18720]  get_free_pages_noprof+0xf/0x80
[  470.024590][T18720]  __kasan_populate_vmalloc+0x38/0x1c0
[  470.024609][T18720]  ? do_raw_spin_unlock+0xf5/0x200
[  470.024663][T18720]  alloc_vmap_area+0xd1a/0x1420
[  470.024703][T18720]  ? __pfx_alloc_vmap_area+0x10/0x10
[  470.024726][T18720]  ? __kmalloc_cache_node_noprof+0x3d1/0x620
[  470.024747][T18720]  ? __kmalloc_cache_node_noprof+0x1f7/0x620
[  470.024765][T18720]  ? __get_vm_area_node+0x155/0x2f0
[  470.024795][T18720]  __get_vm_area_node+0x200/0x2f0
[  470.024828][T18720]  __vmalloc_node_range_noprof+0x343/0x1540
[  470.024856][T18720]  ? bpf_prog_calc_tag+0x51/0x370
[  470.024878][T18720]  ? lock_acquire+0x115/0x350
[  470.024922][T18720]  ? __pfx___vmalloc_node_range_noprof+0x10/0x10
[  470.024949][T18720]  ? bpf_verifier_vlog+0x58d/0x900
[  470.024975][T18720]  ? bpf_prog_calc_tag+0x51/0x370
[  470.024995][T18720]  __vmalloc_noprof+0xd2/0x120
[  470.025021][T18720]  ? bpf_prog_calc_tag+0x51/0x370
[  470.025045][T18720]  bpf_prog_calc_tag+0x51/0x370
[  470.025072][T18720]  check_and_resolve_insns+0xbb/0x21d0
[  470.025098][T18720]  ? add_subprog+0x2e2/0x3f0
[  470.025122][T18720]  ? __pfx_check_and_resolve_insns+0x10/0x10
[  470.025155][T18720]  bpf_check+0x18f9/0x2ef0
[  470.025192][T18720]  ? __pfx_bpf_check+0x10/0x10
[  470.025215][T18720]  ? bpf_obj_name_cpy+0x194/0x1e0
[  470.025245][T18720]  bpf_prog_load+0x14d6/0x1c20
[  470.025277][T18720]  ? __pfx_bpf_prog_load+0x10/0x10
[  470.025325][T18720]  __sys_bpf+0xd0d/0xd90
[  470.025355][T18720]  ? __pfx___sys_bpf+0x10/0x10
[  470.025387][T18720]  ? __fget_files+0x2a/0x420
[  470.025443][T18720]  ? ksys_write+0x242/0x270
[  470.025478][T18720]  ? __pfx_ksys_write+0x10/0x10
[  470.025510][T18720]  __x64_sys_bpf+0xba/0xd0
[  470.025533][T18720]  do_syscall_64+0x166/0x520
[  470.025558][T18720]  ? trace_irq_disable+0x3b/0x140
[  470.025573][T18720]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  470.025590][T18720]  ? clear_bhb_loop+0x70/0xc0
[  470.025610][T18720]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  470.025626][T18720] RIP: 0033:0x7f01e559e159
[  470.025682][T18720] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
[  470.025696][T18720] RSP: 002b:00007f01e64a4028 EFLAGS: 00000246 ORIG_RAX: 0000000000000141
[  470.025745][T18720] RAX: ffffffffffffffda RBX: 00007f01e5826090 RCX: 00007f01e559e159
[  470.025760][T18720] RDX: 0000000000000094 RSI: 0000200000000080 RDI: 0000000000000005
[  470.025772][T18720] RBP: 00007f01e64a4090 R08: 0000000000000000 R09: 0000000000000000
[  470.025782][T18720] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002
[  470.025793][T18720] R13: 00007f01e5826128 R14: 00007f01e5826090 R15: 00007ffd599967a8
[  470.025823][T18720]  </TASK>
[  470.037478][T18720] syz.3.3008: vmalloc error: size 88, align 0x1, vm_struct allocation failed, mode:0x400cc0(GFP_KERNEL_ACCOUNT), nodemask=(null),cpuset=/,mems_allowed=0-1
[  470.037698][T18720] CPU: 1 UID: 0 PID: 18720 Comm: syz.3.3008 Not tainted syzkaller #0 PREEMPT(full) 
[  470.037719][T18720] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026
[  470.037730][T18720] Call Trace:
[  470.037737][T18720]  <TASK>
[  470.037744][T18720]  dump_stack_lvl+0xe8/0x150
[  470.037775][T18720]  warn_alloc+0x24d/0x270
[  470.037794][T18720]  ? lockdep_hardirqs_on+0x7b/0x110
[  470.037888][T18720]  ? __pfx_warn_alloc+0x10/0x10
[  470.037905][T18720]  ? kfree+0x1c5/0x650
[  470.037936][T18720]  ? __get_vm_area_node+0x219/0x2f0
[  470.037969][T18720]  __vmalloc_node_range_noprof+0x36b/0x1540
[  470.037996][T18720]  ? lock_acquire+0x115/0x350
[  470.038039][T18720]  ? __pfx___vmalloc_node_range_noprof+0x10/0x10
[  470.038066][T18720]  ? bpf_verifier_vlog+0x58d/0x900
[  470.038092][T18720]  ? bpf_prog_calc_tag+0x51/0x370
[  470.038111][T18720]  __vmalloc_noprof+0xd2/0x120
[  470.038139][T18720]  ? bpf_prog_calc_tag+0x51/0x370
[  470.038162][T18720]  bpf_prog_calc_tag+0x51/0x370
[  470.038187][T18720]  check_and_resolve_insns+0xbb/0x21d0
[  470.038213][T18720]  ? add_subprog+0x2e2/0x3f0
[  470.038236][T18720]  ? __pfx_check_and_resolve_insns+0x10/0x10
[  470.038266][T18720]  bpf_check+0x18f9/0x2ef0
[  470.038303][T18720]  ? __pfx_bpf_check+0x10/0x10
[  470.038324][T18720]  ? bpf_obj_name_cpy+0x194/0x1e0
[  470.038353][T18720]  bpf_prog_load+0x14d6/0x1c20
[  470.038386][T18720]  ? __pfx_bpf_prog_load+0x10/0x10
[  470.038430][T18720]  __sys_bpf+0xd0d/0xd90
[  470.038458][T18720]  ? __pfx___sys_bpf+0x10/0x10
[  470.038489][T18720]  ? __fget_files+0x2a/0x420
[  470.038529][T18720]  ? ksys_write+0x242/0x270
[  470.038557][T18720]  ? __pfx_ksys_write+0x10/0x10
[  470.038588][T18720]  __x64_sys_bpf+0xba/0xd0
[  470.038609][T18720]  do_syscall_64+0x166/0x520
[  470.038632][T18720]  ? trace_irq_disable+0x3b/0x140
[  470.038650][T18720]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  470.038673][T18720]  ? clear_bhb_loop+0x70/0xc0
[  470.038696][T18720]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  470.038712][T18720] RIP: 0033:0x7f01e559e159
[  470.038730][T18720] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
[  470.038745][T18720] RSP: 002b:00007f01e64a4028 EFLAGS: 00000246 ORIG_RAX: 0000000000000141
[  470.038762][T18720] RAX: ffffffffffffffda RBX: 00007f01e5826090 RCX: 00007f01e559e159
[  470.038776][T18720] RDX: 0000000000000094 RSI: 0000200000000080 RDI: 0000000000000005
[  470.038788][T18720] RBP: 00007f01e64a4090 R08: 0000000000000000 R09: 0000000000000000
[  470.038799][T18720] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002
[  470.038809][T18720] R13: 00007f01e5826128 R14: 00007f01e5826090 R15: 00007ffd599967a8
[  470.038838][T18720]  </TASK>
[  470.041389][T18720] Mem-Info:
[  470.041402][T18720] active_anon:6354 inactive_anon:0 isolated_anon:0
[  470.041402][T18720]  active_file:80 inactive_file:43249 isolated_file:0
[  470.041402][T18720]  unevictable:3061 dirty:168 writeback:0
[  470.041402][T18720]  slab_reclaimable:11816 slab_unreclaimable:110501
[  470.041402][T18720]  mapped:32713 shmem:3587 pagetables:4166
[  470.041402][T18720]  sec_pagetables:0 bounce:0
[  470.041402][T18720]  kernel_misc_reclaimable:0
[  470.041402][T18720]  free:1260664 free_pcp:17006 free_cma:0
[  470.041449][T18720] Node 0 active_anon:25416kB inactive_anon:0kB active_file:320kB inactive_file:172796kB unevictable:12244kB isolated(anon):0kB isolated(file):0kB mapped:118564kB dirty:668kB writeback:0kB shmem:14348kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB kernel_stack:15124kB pagetables:16420kB sec_pagetables:0kB all_unreclaimable? no Balloon:0kB gpu_active:0kB gpu_reclaim:0kB
[  470.041498][T18720] Node 1 active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:200kB unevictable:0kB isolated(anon):0kB isolated(file):0kB mapped:12288kB dirty:4kB writeback:0kB shmem:0kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB kernel_stack:64kB pagetables:244kB sec_pagetables:0kB all_unreclaimable? no Balloon:0kB gpu_active:0kB gpu_reclaim:0kB
[  470.043180][T18720] Node 0 DMA free:11196kB boost:0kB min:208kB low:260kB high:312kB reserved_highatomic:0kB free_highatomic:0kB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB zspages:0kB present:15992kB managed:15360kB mlocked:0kB bounce:0kB free_pcp:52kB local_pcp:20kB free_cma:0kB
[  470.043237][T18720] lowmem_reserve[]: 0 2487 2487 2487 2487
[  470.043270][T18720] Node 0 DMA32 free:1249640kB boost:0kB min:34140kB low:42672kB high:51204kB reserved_highatomic:0kB free_highatomic:0kB active_anon:25416kB inactive_anon:0kB active_file:320kB inactive_file:172796kB unevictable:12244kB writepending:668kB zspages:0kB present:3129332kB managed:2546840kB mlocked:12240kB bounce:0kB free_pcp:36508kB local_pcp:15604kB free_cma:0kB
[  470.043324][T18720] lowmem_reserve[]: 0 0 0 0 0
[  470.043354][T18720] Node 0 Normal free:0kB boost:0kB min:0kB low:0kB high:0kB reserved_highatomic:0kB free_highatomic:0kB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB zspages:0kB present:1048580kB managed:0kB mlocked:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB
[  470.043400][T18720] lowmem_reserve[]: 0 0 0 0 0
[  470.043431][T18720] Node 1 Normal free:3781820kB boost:0kB min:55760kB low:69700kB high:83640kB reserved_highatomic:0kB free_highatomic:0kB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:200kB unevictable:0kB writepending:4kB zspages:0kB present:4194300kB managed:4111104kB mlocked:0kB bounce:0kB free_pcp:31432kB local_pcp:19464kB free_cma:0kB
[  470.043482][T18720] lowmem_reserve[]: 0 0 0 0 0
[  470.043512][T18720] Node 0 DMA: 7*4kB (U) 6*8kB (U) 5*16kB (U) 7*32kB (U) 5*64kB (U) 6*128kB (U) 4*256kB (U) 1*512kB (U) 2*1024kB (U) 1*2048kB (M) 1*4096kB (M) = 11196kB
[  470.043650][T18720] Node 0 DMA32: 0*4kB 3*8kB (UME) 2339*16kB (UM) 1921*32kB (UM) 1902*64kB (UME) 1311*128kB (UM) 1010*256kB (UM) 563*512kB (UM) 239*1024kB (U) 34*2048kB (UME) 0*4096kB = 1249640kB
[  470.043787][T18720] Node 0 Normal: 0*4kB 0*8kB 0*16kB 0*32kB 0*64kB 0*128kB 0*256kB 0*512kB 0*1024kB 0*2048kB 0*4096kB = 0kB
[  470.043873][T18720] Node 1 Normal: 59*4kB (UM) 50*8kB (UM) 62*16kB (UM) 59*32kB (UM) 64*64kB (UM) 48*128kB (UM) 37*256kB (UM) 27*512kB (UM) 11*1024kB (UM) 1*2048kB (U) 911*4096kB (UM) = 3781820kB
[  470.047328][T18720] Node 0 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB
[  470.047343][T18720] Node 0 hugepages_total=2 hugepages_free=2 hugepages_surp=0 hugepages_size=2048kB
[  470.047361][T18720] Node 1 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB
[  470.047375][T18720] Node 1 hugepages_total=2 hugepages_free=2 hugepages_surp=0 hugepages_size=2048kB
[  470.047389][T18720] 46913 total pagecache pages
[  470.047399][T18720] 0 pages in swap cache
[  470.047406][T18720] Free swap  = 124996kB
[  470.047412][T18720] Total swap = 124996kB
[  470.047433][T18720] 2097051 pages RAM
[  470.047440][T18720] 0 pages HighMem/MovableOnly
[  470.047446][T18720] 428725 pages reserved
[  470.047452][T18720] 0 pages cma reserved
[  470.444968][T18725] netlink: 12 bytes leftover after parsing attributes in process `syz.0.3012'.
[  471.290224][T18751] netlink: 24 bytes leftover after parsing attributes in process `syz.4.3021'.
[  471.310383][T18750] RDS: rds_bind could not find a transport for ::ffff:172.20.20.170, load rds_tcp or rds_rdma?
[  471.340478][T18739] netlink: 'syz.1.3018': attribute type 2 has an invalid length.
[  471.340499][T18739] netlink: 8 bytes leftover after parsing attributes in process `syz.1.3018'.
[  471.589523][ T5628] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1
[  471.603027][ T5628] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9
[  471.619700][ T5628] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9
[  471.624670][ T5628] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4
[  471.625405][ T5628] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2
[  471.851384][T18767] netlink: 12 bytes leftover after parsing attributes in process `syz.4.3025'.
[  471.948824][T18767] Bluetooth: MGMT ver 1.23
[  471.948861][T18767] Bluetooth: hci0: invalid length 0, exp 2 for type 26
[  471.992035][T18770] netlink: 8 bytes leftover after parsing attributes in process `syz.0.3026'.
[  471.993343][T18770] netlink: 8 bytes leftover after parsing attributes in process `syz.0.3026'.
[  472.209308][T18779] netlink: 12 bytes leftover after parsing attributes in process `syz.4.3028'.
[  472.339100][T18782] netlink: 28 bytes leftover after parsing attributes in process `syz.4.3028'.
[  472.360951][T18785] netlink: 24 bytes leftover after parsing attributes in process `syz.0.3029'.
[  472.380726][T18782] bond21: (slave ip6tnl2): The slave device specified does not support setting the MAC address
[  472.381634][T18782] bond21: (slave ip6tnl2): Error -95 calling set_mac_address
[  472.695020][T18799] netlink: 'syz.1.3034': attribute type 1 has an invalid length.
[  472.759058][T18806] netlink: 36 bytes leftover after parsing attributes in process `syz.0.3035'.
[  472.853297][T18804] bond1: (slave geneve2): making interface the new active one
[  472.853798][T18804] bond1: (slave geneve2): Enslaving as an active interface with an up link
[  472.854051][T18807] tc_dump_action: action bad kind
[  472.876731][T10675] netdevsim netdevsim1 netdevsim3: set [1, 1] type 2 family 0 port 20004 - 0
[  472.876804][T10675] netdevsim netdevsim1 netdevsim2: set [1, 1] type 2 family 0 port 20004 - 0
[  472.876835][T10675] netdevsim netdevsim1 netdevsim1: set [1, 1] type 2 family 0 port 20004 - 0
[  472.876865][T10675] netdevsim netdevsim1 netdevsim0: set [1, 1] type 2 family 0 port 20004 - 0
[  473.484204][T18820] netlink: 'syz.5.3037': attribute type 4 has an invalid length.
[  473.696326][ T5625] Bluetooth: hci0: command tx timeout
[  473.946522][T18843] openvswitch: netlink: Flow actions may not be safe on all matching packets.
[  473.984873][T18758] bridge0: port 1(bridge_slave_0) entered blocking state
[  473.984985][T18758] bridge0: port 1(bridge_slave_0) entered disabled state
[  473.985118][T18758] bridge_slave_0: entered allmulticast mode
[  473.989719][T18758] bridge_slave_0: entered promiscuous mode
[  473.995750][T18758] bridge0: port 2(bridge_slave_1) entered blocking state
[  473.995850][T18758] bridge0: port 2(bridge_slave_1) entered disabled state
[  473.996092][T18758] bridge_slave_1: entered allmulticast mode
[  473.998045][T18758] bridge_slave_1: entered promiscuous mode
[  474.177878][T18758] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link
[  474.193793][T18758] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link
[  474.348160][T18758] team0: Port device team_slave_0 added
[  474.466888][T18866] FAULT_INJECTION: forcing a failure.
[  474.466888][T18866] name fail_usercopy, interval 1, probability 0, space 0, times 0
[  474.466923][T18866] CPU: 1 UID: 0 PID: 18866 Comm: syz.5.3051 Not tainted syzkaller #0 PREEMPT(full) 
[  474.466946][T18866] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026
[  474.466957][T18866] Call Trace:
[  474.466964][T18866]  <TASK>
[  474.466973][T18866]  dump_stack_lvl+0xe8/0x150
[  474.467003][T18866]  should_fail_ex+0x410/0x560
[  474.467030][T18866]  _copy_from_user+0x2d/0xb0
[  474.467146][T18866]  sock_do_ioctl+0x195/0x320
[  474.467228][T18866]  ? __pfx_sock_do_ioctl+0x10/0x10
[  474.467246][T18866]  ? hook_file_ioctl+0x1f2/0x600
[  474.467325][T18866]  sock_ioctl+0x57a/0x7e0
[  474.467346][T18866]  ? __pfx_sock_ioctl+0x10/0x10
[  474.467364][T18866]  ? __fget_files+0x2a/0x420
[  474.467389][T18866]  ? __fget_files+0x3a2/0x420
[  474.467412][T18866]  ? __fget_files+0x2a/0x420
[  474.467440][T18866]  ? bpf_lsm_file_ioctl+0x9/0x20
[  474.467472][T18866]  ? __pfx_sock_ioctl+0x10/0x10
[  474.467490][T18866]  __se_sys_ioctl+0xfc/0x170
[  474.467513][T18866]  do_syscall_64+0x166/0x520
[  474.467538][T18866]  ? trace_irq_disable+0x3b/0x140
[  474.467556][T18866]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  474.467576][T18866]  ? clear_bhb_loop+0x70/0xc0
[  474.467599][T18866]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  474.467618][T18866] RIP: 0033:0x7f8625f9e159
[  474.467635][T18866] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
[  474.467650][T18866] RSP: 002b:00007f8626daf028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
[  474.467671][T18866] RAX: ffffffffffffffda RBX: 00007f8626226180 RCX: 00007f8625f9e159
[  474.467684][T18866] RDX: 0000200000002280 RSI: 0000000000008914 RDI: 000000000000000a
[  474.467696][T18866] RBP: 00007f8626daf090 R08: 0000000000000000 R09: 0000000000000000
[  474.467708][T18866] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001
[  474.467719][T18866] R13: 00007f8626226218 R14: 00007f8626226180 R15: 00007ffcf3db8038
[  474.467750][T18866]  </TASK>
[  474.528310][T18867] netlink: zone id is out of range
[  474.528325][T18867] netlink: zone id is out of range
[  474.528332][T18867] netlink: zone id is out of range
[  474.528339][T18867] netlink: zone id is out of range
[  474.528345][T18867] netlink: zone id is out of range
[  474.528353][T18867] netlink: zone id is out of range
[  474.528363][T18867] netlink: zone id is out of range
[  474.528370][T18867] netlink: zone id is out of range
[  474.528377][T18867] netlink: zone id is out of range
[  474.856396][T18857] bridge0: port 2(bridge_slave_1) entered disabled state
[  474.857453][T18857] bridge0: port 1(bridge_slave_0) entered disabled state
[  475.153587][T18857] batman_adv: batadv0: Interface deactivated: batadv_slave_0
[  475.196403][T18857] batman_adv: batadv0: Interface deactivated: batadv_slave_1
[  475.573797][T18758] team0: Port device team_slave_1 added
[  475.719813][T18865] bridge0: port 2(bridge_slave_1) entered disabled state
[  475.720212][T18865] bridge0: port 1(bridge_slave_0) entered disabled state
[  475.766542][ T5625] Bluetooth: hci0: command tx timeout
[  475.825335][T18865] batman_adv: batadv0: Interface deactivated: batadv_slave_0
[  475.832917][T18865] batman_adv: batadv0: Interface deactivated: batadv_slave_1
[  475.845259][T18874] netlink: 'syz.1.3054': attribute type 1 has an invalid length.
[  475.905545][T18875] __nla_validate_parse: 5 callbacks suppressed
[  475.912565][T18875] netlink: 28 bytes leftover after parsing attributes in process `syz.1.3054'.
[  475.956622][ T1095] netdevsim netdevsim0 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0
[  475.956664][ T1095] netdevsim netdevsim0 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0
[  475.956700][ T1095] netdevsim netdevsim1 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0
[  475.956722][ T1095] netdevsim netdevsim1 netdevsim3: unset [1, 1] type 2 family 0 port 20004 - 0
[  476.031670][T18873] tipc: Started in network mode
[  476.031699][T18873] tipc: Node identity ac14140f, cluster identity 4711
[  476.031928][T18873] tipc: New replicast peer: 255.255.255.255
[  476.032607][T18873] tipc: Enabled bearer <udp:syz2>, priority 10
[  476.039445][T18758] batman_adv: batadv0: Adding interface: batadv_slave_0
[  476.039459][T18758] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem.
[  476.039480][T18758] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active
[  476.127733][T18879] netlink: 12 bytes leftover after parsing attributes in process `syz.0.3055'.
[  476.161721][T18874] bond2: entered promiscuous mode
[  476.162208][T18874] 8021q: adding VLAN 0 to HW filter on device bond2
[  476.164384][T18758] batman_adv: batadv0: Adding interface: batadv_slave_1
[  476.164397][T18758] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem.
[  476.164419][T18758] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active
[  476.405975][    C1] ip6_tunnel: ip6gretap3 xmit: Local address not yet configured!
[  476.456350][ T1095] netdevsim netdevsim1 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0
[  476.456384][ T1095] netdevsim netdevsim1 netdevsim0: unset [1, 1] type 2 family 0 port 20004 - 0
[  476.457297][  T225] netdevsim netdevsim0 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0
[  476.457408][  T225] netdevsim netdevsim1 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0
[  476.457433][  T225] netdevsim netdevsim1 netdevsim1: unset [1, 1] type 2 family 0 port 20004 - 0
[  476.457465][  T225] netdevsim netdevsim0 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0
[  476.457498][  T225] netdevsim netdevsim1 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0
[  476.457520][  T225] netdevsim netdevsim1 netdevsim2: unset [1, 1] type 2 family 0 port 20004 - 0
[  476.477416][T18758] hsr_slave_0: entered promiscuous mode
[  476.481623][T18758] hsr_slave_1: entered promiscuous mode
[  476.487122][T18758] debugfs: 'hsr0' already exists in 'hsr'
[  476.487141][T18758] Cannot create hsr debugfs directory
[  476.613468][T18898] netlink: 8 bytes leftover after parsing attributes in process `syz.0.3060'.
[  476.660852][T18893] tipc: Enabled bearer <eth:syzkaller0>, priority 0
[  476.821096][T18893] syzkaller0: entered promiscuous mode
[  476.821121][T18893] syzkaller0: entered allmulticast mode
[  476.821906][T18893] tipc: Resetting bearer <eth:syzkaller0>
[  476.844004][T18907] netlink: 40 bytes leftover after parsing attributes in process `syz.0.3063'.
[  476.847624][T18906] netlink: 8 bytes leftover after parsing attributes in process `syz.0.3063'.
[  476.864065][T18891] tipc: Resetting bearer <eth:syzkaller0>
[  476.894180][T18906] netlink: 60 bytes leftover after parsing attributes in process `syz.0.3063'.
[  477.864234][ T5625] Bluetooth: hci0: command tx timeout
[  479.505388][T18891] tipc: Disabling bearer <eth:syzkaller0>
[  479.514544][T18907] bridge0: entered promiscuous mode
[  479.514580][T18907] bridge0: entered allmulticast mode
[  479.587395][T10055] tipc: Node number set to 2886997007
[  479.926611][ T5625] Bluetooth: hci0: command tx timeout
[  479.986938][T18959] netlink: 8 bytes leftover after parsing attributes in process `syz.5.3069'.
[  480.098684][T18958] FAULT_INJECTION: forcing a failure.
[  480.098684][T18958] name failslab, interval 1, probability 0, space 0, times 0
[  480.098726][T18958] CPU: 1 UID: 0 PID: 18958 Comm: syz.1.3066 Not tainted syzkaller #0 PREEMPT(full) 
[  480.098747][T18958] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026
[  480.098758][T18958] Call Trace:
[  480.098767][T18958]  <TASK>
[  480.098775][T18958]  dump_stack_lvl+0xe8/0x150
[  480.098807][T18958]  should_fail_ex+0x410/0x560
[  480.098837][T18958]  should_failslab+0xa8/0x100
[  480.098863][T18958]  __kmalloc_node_noprof+0x100/0x720
[  480.098885][T18958]  ? qdisc_alloc+0x92/0x9d0
[  480.099026][T18958]  ? qdisc_alloc+0x92/0x9d0
[  480.099059][T18958]  qdisc_alloc+0x92/0x9d0
[  480.099093][T18958]  qdisc_create_dflt+0x8e/0x4e0
[  480.099123][T18958]  dev_activate+0x37a/0x1150
[  480.099162][T18958]  __dev_open+0x699/0x850
[  480.099242][T18958]  ? __pfx___dev_open+0x10/0x10
[  480.099261][T18958]  ? __dev_change_flags+0x2e2/0x820
[  480.099315][T18958]  ? __local_bh_enable_ip+0xd6/0x140
[  480.099354][T18958]  __dev_change_flags+0x329/0x820
[  480.099386][T18958]  ? __pfx___dev_change_flags+0x10/0x10
[  480.099411][T18958]  ? dev_ioctl+0x7a4/0x1150
[  480.099487][T18958]  ? __pfx___mutex_lock+0x10/0x10
[  480.099542][T18958]  ? full_name_hash+0x92/0xe0
[  480.099573][T18958]  netif_change_flags+0x7c/0x1b0
[  480.099603][T18958]  dev_change_flags+0x128/0x260
[  480.099657][T18958]  dev_ioctl+0x7b4/0x1150
[  480.099683][T18958]  sock_do_ioctl+0x23e/0x320
[  480.099713][T18958]  ? __pfx_sock_do_ioctl+0x10/0x10
[  480.099730][T18958]  ? hook_file_ioctl+0x1f2/0x600
[  480.099768][T18958]  sock_ioctl+0x57a/0x7e0
[  480.099790][T18958]  ? __pfx_sock_ioctl+0x10/0x10
[  480.099809][T18958]  ? __fget_files+0x2a/0x420
[  480.099834][T18958]  ? __fget_files+0x3a2/0x420
[  480.099858][T18958]  ? __fget_files+0x2a/0x420
[  480.099886][T18958]  ? bpf_lsm_file_ioctl+0x9/0x20
[  480.099913][T18958]  ? __pfx_sock_ioctl+0x10/0x10
[  480.099932][T18958]  __se_sys_ioctl+0xfc/0x170
[  480.099955][T18958]  do_syscall_64+0x166/0x520
[  480.099978][T18958]  ? trace_irq_disable+0x3b/0x140
[  480.099997][T18958]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  480.100015][T18958]  ? clear_bhb_loop+0x70/0xc0
[  480.100037][T18958]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  480.100059][T18958] RIP: 0033:0x7f0b2719e159
[  480.100076][T18958] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
[  480.100091][T18958] RSP: 002b:00007f0b280f2028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
[  480.100111][T18958] RAX: ffffffffffffffda RBX: 00007f0b27426180 RCX: 00007f0b2719e159
[  480.100124][T18958] RDX: 0000200000002280 RSI: 0000000000008914 RDI: 000000000000000a
[  480.100136][T18958] RBP: 00007f0b280f2090 R08: 0000000000000000 R09: 0000000000000000
[  480.100148][T18958] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001
[  480.100159][T18958] R13: 00007f0b27426218 R14: 00007f0b27426180 R15: 00007ffd56d55688
[  480.100191][T18958]  </TASK>
[  480.105013][T18958] syzkaller0: default qdisc (pfifo_fast) fail, fallback to noqueue
[  480.105089][T18958] syzkaller0: entered promiscuous mode
[  480.105104][T18958] syzkaller0: entered allmulticast mode
[  480.265196][T18959] netlink: 20 bytes leftover after parsing attributes in process `syz.5.3069'.
[  480.286589][T18969] netlink: 5 bytes leftover after parsing attributes in process `syz.0.3072'.
[  480.286608][T18969] netlink: 236 bytes leftover after parsing attributes in process `syz.0.3072'.
[  480.377247][T18758] netdevsim netdevsim3 netdevsim2 (unregistering): unset [0, 0] type 1 family 0 port 4352 - 0
[  480.398546][T18758] netdevsim netdevsim3 netdevsim2 (unregistering): unset [0, 1] type 1 family 0 port 8472 - 0
[  480.398576][T18758] netdevsim netdevsim3 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[  480.721601][T18982] netlink: 'syz.0.3073': attribute type 1 has an invalid length.
[  480.721622][T18982] netlink: 'syz.0.3073': attribute type 2 has an invalid length.
[  480.790443][T18758] netdevsim netdevsim3 netdevsim1 (unregistering): unset [0, 0] type 1 family 0 port 4352 - 0
[  480.790476][T18758] netdevsim netdevsim3 netdevsim1 (unregistering): unset [0, 1] type 1 family 0 port 8472 - 0
[  480.790500][T18758] netdevsim netdevsim3 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[  481.171028][T18997] __nla_validate_parse: 1 callbacks suppressed
[  481.171049][T18997] netlink: 4 bytes leftover after parsing attributes in process `syz.1.3076'.
[  481.224368][T18758] netdevsim netdevsim3 netdevsim0 (unregistering): unset [0, 0] type 1 family 0 port 4352 - 0
[  481.224402][T18758] netdevsim netdevsim3 netdevsim0 (unregistering): unset [0, 1] type 1 family 0 port 8472 - 0
[  481.224426][T18758] netdevsim netdevsim3 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[  481.287380][T18997] batman_adv: batadv0: Removing interface: batadv_slave_1
[  481.610979][T19017] netlink: 100 bytes leftover after parsing attributes in process `syz.1.3079'.
[  482.409525][T19060] netlink: 'syz.1.3086': attribute type 4 has an invalid length.
[  482.409546][T19060] netlink: 17 bytes leftover after parsing attributes in process `syz.1.3086'.
[  482.437472][T19049] v: renamed from veth0_vlan
[  482.637685][T19060] netlink: 168 bytes leftover after parsing attributes in process `syz.1.3086'.
[  482.778662][T19061] netlink: 8 bytes leftover after parsing attributes in process `syz.1.3086'.
[  482.778684][T19061] netlink: 8 bytes leftover after parsing attributes in process `syz.1.3086'.
[  482.961109][T18758] netdevsim netdevsim3 netdevsim0: renamed from eth0
[  482.987890][T18758] 8021q: adding VLAN 0 to HW filter on device netdevsim0
[  482.990119][T18758] netdevsim netdevsim3 netdevsim1: renamed from eth1
[  483.001821][T19074] netlink: 1200 bytes leftover after parsing attributes in process `syz.1.3091'.
[  483.001923][T19074] netlink: 1200 bytes leftover after parsing attributes in process `syz.1.3091'.
[  483.034121][T18758] 8021q: adding VLAN 0 to HW filter on device netdevsim1
[  483.075231][T18758] netdevsim netdevsim3 netdevsim2: renamed from eth2
[  483.101676][T18758] 8021q: adding VLAN 0 to HW filter on device netdevsim2
[  483.104433][T18758] netdevsim netdevsim3 netdevsim3: renamed from eth3
[  483.133856][T18758] 8021q: adding VLAN 0 to HW filter on device netdevsim3
[  483.164001][T19081] netlink: 20 bytes leftover after parsing attributes in process `syz.0.3092'.
[  483.464472][T19101] netlink: 152 bytes leftover after parsing attributes in process `syz.0.3095'.
[  483.532650][T18758] 8021q: adding VLAN 0 to HW filter on device bond0
[  483.885295][T18758] 8021q: adding VLAN 0 to HW filter on device team0
[  483.914421][T18945] bridge0: port 1(bridge_slave_0) entered blocking state
[  483.914592][T18945] bridge0: port 1(bridge_slave_0) entered forwarding state
[  483.979947][T13426] bridge0: port 2(bridge_slave_1) entered blocking state
[  483.980074][T13426] bridge0: port 2(bridge_slave_1) entered forwarding state
[  484.733400][ T2035] block nbd2: Possible stuck request ffff888027240000: control (read@0,1024B). Runtime 30 seconds
[  484.734117][ T2035] block nbd2: Possible stuck request ffff8880272401c0: control (read@1024,1024B). Runtime 30 seconds
[  484.734147][ T2035] block nbd2: Possible stuck request ffff888027240380: control (read@2048,1024B). Runtime 30 seconds
[  484.738071][ T2035] block nbd2: Possible stuck request ffff888027240540: control (read@3072,1024B). Runtime 30 seconds
[  484.782600][T19140] net_ratelimit: 388 callbacks suppressed
[  484.782703][T19140] ip_tables: iptables: counters copy to user failed while replacing table
[  484.934738][T19139] netlink: 'syz.5.3099': attribute type 16 has an invalid length.
[  484.934759][T19139] netlink: 'syz.5.3099': attribute type 17 has an invalid length.
[  485.088534][T19141] bridge0: port 1(bridge_slave_0) entered disabled state
[  485.098991][T19141] bridge0: port 2(bridge_slave_1) entered disabled state
[  485.267747][T19139] bridge0: port 1(bridge_slave_0) entered blocking state
[  485.267875][T19139] bridge0: port 1(bridge_slave_0) entered forwarding state
[  485.270465][T19139] bridge0: port 2(bridge_slave_1) entered blocking state
[  485.270581][T19139] bridge0: port 2(bridge_slave_1) entered forwarding state
[  485.364450][T19139] netdevsim netdevsim5 netdevsim0: left allmulticast mode
[  485.378778][T19139] bond1: left promiscuous mode
[  485.379716][T19139] hsr1: left promiscuous mode
[  485.380649][T19139] macsec1: left promiscuous mode
[  485.380789][T19139] macsec1: left allmulticast mode
[  485.380797][T19139] virt_wifi0: left allmulticast mode
[  485.381680][T19139] erspan1: left promiscuous mode
[  485.381690][T19139] erspan1: left allmulticast mode
[  485.384231][T19139] bond2: left promiscuous mode
[  485.384243][T19139] bridge1: left promiscuous mode
[  485.858044][T19177] openvswitch: netlink: Missing key (keys=c0, expected=500)
[  486.114466][T19190] netlink: 'syz.5.3109': attribute type 11 has an invalid length.
[  486.335151][T18758] 8021q: adding VLAN 0 to HW filter on device batadv0
[  486.374313][T19199] netlink: 'syz.5.3111': attribute type 30 has an invalid length.
[  486.471524][T19204] netlink: 'syz.5.3111': attribute type 30 has an invalid length.
[  486.507636][T19217] __nla_validate_parse: 4 callbacks suppressed
[  486.507655][T19217] netlink: 88 bytes leftover after parsing attributes in process `syz.0.3112'.
[  486.508397][T19199] bond3: option arp_missed_max: invalid value (0)
[  486.508415][T19199] bond3: option arp_missed_max: allowed values 1 - 255
[  486.510117][T19199] bond3 (unregistering): Released all slaves
[  486.540720][T19218] netlink: 'syz.4.3113': attribute type 4 has an invalid length.
[  486.738941][T19204] bond3: option arp_missed_max: invalid value (0)
[  486.738964][T19204] bond3: option arp_missed_max: allowed values 1 - 255
[  486.750742][T19204] bond3 (unregistering): Released all slaves
[  486.808788][T19228] FAULT_INJECTION: forcing a failure.
[  486.808788][T19228] name failslab, interval 1, probability 0, space 0, times 0
[  486.808819][T19228] CPU: 1 UID: 0 PID: 19228 Comm: syz.1.3110 Not tainted syzkaller #0 PREEMPT(full) 
[  486.808841][T19228] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026
[  486.808852][T19228] Call Trace:
[  486.808859][T19228]  <TASK>
[  486.808867][T19228]  dump_stack_lvl+0xe8/0x150
[  486.808897][T19228]  should_fail_ex+0x410/0x560
[  486.808922][T19228]  should_failslab+0xa8/0x100
[  486.808945][T19228]  __kmalloc_node_noprof+0x100/0x720
[  486.808962][T19228]  ? __get_vm_area_node+0x200/0x2f0
[  486.808985][T19228]  ? __get_vm_area_node+0x283/0x2f0
[  486.809006][T19228]  ? __vmalloc_node_range_noprof+0x5b4/0x1540
[  486.809029][T19228]  ? __vmalloc_node_range_noprof+0x5b4/0x1540
[  486.809065][T19228]  __vmalloc_node_range_noprof+0x5b4/0x1540
[  486.809092][T19228]  ? lock_acquire+0x115/0x350
[  486.809133][T19228]  ? __pfx___vmalloc_node_range_noprof+0x10/0x10
[  486.809159][T19228]  ? bpf_verifier_vlog+0x58d/0x900
[  486.809184][T19228]  ? bpf_prog_calc_tag+0x51/0x370
[  486.809202][T19228]  __vmalloc_noprof+0xd2/0x120
[  486.809229][T19228]  ? bpf_prog_calc_tag+0x51/0x370
[  486.809251][T19228]  bpf_prog_calc_tag+0x51/0x370
[  486.809277][T19228]  check_and_resolve_insns+0xbb/0x21d0
[  486.809303][T19228]  ? add_subprog+0x2e2/0x3f0
[  486.809327][T19228]  ? __pfx_check_and_resolve_insns+0x10/0x10
[  486.809358][T19228]  bpf_check+0x18f9/0x2ef0
[  486.809395][T19228]  ? __pfx_bpf_check+0x10/0x10
[  486.809418][T19228]  ? bpf_obj_name_cpy+0x194/0x1e0
[  486.809447][T19228]  bpf_prog_load+0x14d6/0x1c20
[  486.809481][T19228]  ? __pfx_bpf_prog_load+0x10/0x10
[  486.809528][T19228]  __sys_bpf+0xd0d/0xd90
[  486.809558][T19228]  ? __pfx___sys_bpf+0x10/0x10
[  486.809588][T19228]  ? __fget_files+0x2a/0x420
[  486.809634][T19228]  ? ksys_write+0x242/0x270
[  486.809663][T19228]  ? __pfx_ksys_write+0x10/0x10
[  486.809694][T19228]  __x64_sys_bpf+0xba/0xd0
[  486.809715][T19228]  do_syscall_64+0x166/0x520
[  486.809739][T19228]  ? trace_irq_disable+0x3b/0x140
[  486.809758][T19228]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  486.809776][T19228]  ? clear_bhb_loop+0x70/0xc0
[  486.809798][T19228]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  486.809815][T19228] RIP: 0033:0x7f0b2719e159
[  486.809832][T19228] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
[  486.809847][T19228] RSP: 002b:00007f0b28113028 EFLAGS: 00000246 ORIG_RAX: 0000000000000141
[  486.809868][T19228] RAX: ffffffffffffffda RBX: 00007f0b27426090 RCX: 00007f0b2719e159
[  486.809881][T19228] RDX: 0000000000000094 RSI: 0000200000000080 RDI: 0000000000000005
[  486.809893][T19228] RBP: 00007f0b28113090 R08: 0000000000000000 R09: 0000000000000000
[  486.809905][T19228] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002
[  486.809916][T19228] R13: 00007f0b27426128 R14: 00007f0b27426090 R15: 00007ffd56d55688
[  486.809947][T19228]  </TASK>
[  486.812040][T19228] syz.1.3110: vmalloc error: size 4096, failed to allocated page array size 8, mode:0x400cc2(GFP_KERNEL_ACCOUNT|__GFP_HIGHMEM), nodemask=(null),cpuset=/,mems_allowed=0-1
[  486.812099][T19228] CPU: 1 UID: 0 PID: 19228 Comm: syz.1.3110 Not tainted syzkaller #0 PREEMPT(full) 
[  486.812119][T19228] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026
[  486.812129][T19228] Call Trace:
[  486.812136][T19228]  <TASK>
[  486.812144][T19228]  dump_stack_lvl+0xe8/0x150
[  486.812174][T19228]  warn_alloc+0x24d/0x270
[  486.812197][T19228]  ? __pfx_warn_alloc+0x10/0x10
[  486.812221][T19228]  ? __kmalloc_node_noprof+0x4d7/0x720
[  486.812237][T19228]  ? __get_vm_area_node+0x200/0x2f0
[  486.812260][T19228]  ? __get_vm_area_node+0x283/0x2f0
[  486.812282][T19228]  ? __vmalloc_node_range_noprof+0x5b4/0x1540
[  486.812304][T19228]  ? __vmalloc_node_range_noprof+0x5b4/0x1540
[  486.812334][T19228]  __vmalloc_node_range_noprof+0x969/0x1540
[  486.812362][T19228]  ? lock_acquire+0x115/0x350
[  486.812401][T19228]  ? __pfx___vmalloc_node_range_noprof+0x10/0x10
[  486.812428][T19228]  ? bpf_verifier_vlog+0x58d/0x900
[  486.812455][T19228]  ? bpf_prog_calc_tag+0x51/0x370
[  486.812474][T19228]  __vmalloc_noprof+0xd2/0x120
[  486.812500][T19228]  ? bpf_prog_calc_tag+0x51/0x370
[  486.812523][T19228]  bpf_prog_calc_tag+0x51/0x370
[  486.812550][T19228]  check_and_resolve_insns+0xbb/0x21d0
[  486.812577][T19228]  ? add_subprog+0x2e2/0x3f0
[  486.812601][T19228]  ? __pfx_check_and_resolve_insns+0x10/0x10
[  486.812641][T19228]  bpf_check+0x18f9/0x2ef0
[  486.812679][T19228]  ? __pfx_bpf_check+0x10/0x10
[  486.812701][T19228]  ? bpf_obj_name_cpy+0x194/0x1e0
[  486.812732][T19228]  bpf_prog_load+0x14d6/0x1c20
[  486.812765][T19228]  ? __pfx_bpf_prog_load+0x10/0x10
[  486.812812][T19228]  __sys_bpf+0xd0d/0xd90
[  486.812841][T19228]  ? __pfx___sys_bpf+0x10/0x10
[  486.812873][T19228]  ? __fget_files+0x2a/0x420
[  486.812913][T19228]  ? ksys_write+0x242/0x270
[  486.812940][T19228]  ? __pfx_ksys_write+0x10/0x10
[  486.812970][T19228]  __x64_sys_bpf+0xba/0xd0
[  486.812992][T19228]  do_syscall_64+0x166/0x520
[  486.813016][T19228]  ? trace_irq_disable+0x3b/0x140
[  486.813035][T19228]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  486.813054][T19228]  ? clear_bhb_loop+0x70/0xc0
[  486.813077][T19228]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  486.813095][T19228] RIP: 0033:0x7f0b2719e159
[  486.813112][T19228] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
[  486.813127][T19228] RSP: 002b:00007f0b28113028 EFLAGS: 00000246 ORIG_RAX: 0000000000000141
[  486.813145][T19228] RAX: ffffffffffffffda RBX: 00007f0b27426090 RCX: 00007f0b2719e159
[  486.813158][T19228] RDX: 0000000000000094 RSI: 0000200000000080 RDI: 0000000000000005
[  486.813170][T19228] RBP: 00007f0b28113090 R08: 0000000000000000 R09: 0000000000000000
[  486.813181][T19228] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002
[  486.813192][T19228] R13: 00007f0b27426128 R14: 00007f0b27426090 R15: 00007ffd56d55688
[  486.813220][T19228]  </TASK>
[  486.813227][T19228] Mem-Info:
[  486.813235][T19228] active_anon:6406 inactive_anon:0 isolated_anon:0
[  486.813235][T19228]  active_file:80 inactive_file:43257 isolated_file:0
[  486.813235][T19228]  unevictable:3072 dirty:176 writeback:0
[  486.813235][T19228]  slab_reclaimable:11681 slab_unreclaimable:113553
[  486.813235][T19228]  mapped:33783 shmem:3601 pagetables:4164
[  486.813235][T19228]  sec_pagetables:0 bounce:0
[  486.813235][T19228]  kernel_misc_reclaimable:0
[  486.813235][T19228]  free:1256012 free_pcp:15414 free_cma:0
[  486.813281][T19228] Node 0 active_anon:25624kB inactive_anon:0kB active_file:320kB inactive_file:172828kB unevictable:12288kB isolated(anon):0kB isolated(file):0kB mapped:106460kB dirty:704kB writeback:0kB shmem:14404kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB kernel_stack:16312kB pagetables:16412kB sec_pagetables:0kB all_unreclaimable? no Balloon:0kB gpu_active:0kB gpu_reclaim:0kB
[  486.813330][T19228] Node 1 active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:200kB unevictable:0kB isolated(anon):0kB isolated(file):0kB mapped:28672kB dirty:0kB writeback:0kB shmem:0kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB kernel_stack:64kB pagetables:244kB sec_pagetables:0kB all_unreclaimable? no Balloon:0kB gpu_active:0kB gpu_reclaim:0kB
[  486.813375][T19228] Node 0 DMA free:11196kB boost:0kB min:208kB low:260kB high:312kB reserved_highatomic:0kB free_highatomic:0kB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB zspages:0kB present:15992kB managed:15360kB mlocked:0kB bounce:0kB free_pcp:52kB local_pcp:20kB free_cma:0kB
[  486.813424][T19228] lowmem_reserve[]: 0 2487 2487 2487 2487
[  486.813457][T19228] Node 0 DMA32 free:1263800kB boost:0kB min:34140kB low:42672kB high:51204kB reserved_highatomic:0kB free_highatomic:0kB active_anon:25624kB inactive_anon:0kB active_file:320kB inactive_file:172828kB unevictable:12288kB writepending:704kB zspages:0kB present:3129332kB managed:2546840kB mlocked:12288kB bounce:0kB free_pcp:30168kB local_pcp:20976kB free_cma:0kB
[  486.813508][T19228] lowmem_reserve[]: 0 0 0 0 0
[  486.813540][T19228] Node 0 Normal free:0kB boost:0kB min:0kB low:0kB high:0kB reserved_highatomic:0kB free_highatomic:0kB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB zspages:0kB present:1048580kB managed:0kB mlocked:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB
[  486.813589][T19228] lowmem_reserve[]: 0 0 0 0 0
[  486.813619][T19228] Node 1 Normal free:3749052kB boost:0kB min:55760kB low:69700kB high:83640kB reserved_highatomic:0kB free_highatomic:0kB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:200kB unevictable:0kB writepending:0kB zspages:0kB present:4194300kB managed:4111104kB mlocked:0kB bounce:0kB free_pcp:31432kB local_pcp:19464kB free_cma:0kB
[  486.828119][T19228] lowmem_reserve[]: 0 0 0 0 0
[  486.828158][T19228] Node 0 DMA: 7*4kB (U) 6*8kB (U) 5*16kB (U) 7*32kB (U) 5*64kB (U) 6*128kB (U) 4*256kB (U) 1*512kB (U) 2*1024kB (U) 1*2048kB (M) 1*4096kB (M) = 11196kB
[  486.828296][T19228] Node 0 DMA32: 1024*4kB (UME) 757*8kB (UME) 1632*16kB (UM) 1613*32kB (UME) 1892*64kB (UME) 1311*128kB (UME) 1013*256kB (UME) 564*512kB (UME) 241*1024kB (UE) 33*2048kB (UM) 6*4096kB (U) = 1263816kB
[  486.828435][T19228] Node 0 Normal: 0*4kB 0*8kB 0*16kB 0*32kB 0*64kB 0*128kB 0*256kB 0*512kB 0*1024kB 0*2048kB 0*4096kB = 0kB
[  486.828520][T19228] Node 1 Normal: 59*4kB (UM) 50*8kB (UM) 62*16kB (UM) 59*32kB (UM) 64*64kB (UM) 48*128kB (UM) 37*256kB (UM) 27*512kB (UM) 11*1024kB (UM) 1*2048kB (U) 903*4096kB (UM) = 3749052kB
[  486.828668][T19228] Node 0 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB
[  486.828681][T19228] Node 0 hugepages_total=2 hugepages_free=2 hugepages_surp=0 hugepages_size=2048kB
[  486.828695][T19228] Node 1 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB
[  486.828707][T19228] Node 1 hugepages_total=2 hugepages_free=2 hugepages_surp=0 hugepages_size=2048kB
[  486.828719][T19228] 46934 total pagecache pages
[  486.828725][T19228] 0 pages in swap cache
[  486.828731][T19228] Free swap  = 124996kB
[  486.828737][T19228] Total swap = 124996kB
[  486.828750][T19228] 2097051 pages RAM
[  486.828756][T19228] 0 pages HighMem/MovableOnly
[  486.828762][T19228] 428725 pages reserved
[  486.828767][T19228] 0 pages cma reserved
[  486.935762][T19224] tunl0: Caught tx_queue_len zero misconfig
[  486.935823][T19224] sch_tbf: peakrate 7 is lower than or equals to rate 7 !
[  487.137313][T18758] veth0_vlan: entered promiscuous mode
[  487.192884][T18758] veth1_vlan: entered promiscuous mode
[  487.615300][T18758] veth0_macvtap: entered promiscuous mode
[  487.676123][T18758] veth1_macvtap: entered promiscuous mode
[  487.678299][T19234] netlink: 8 bytes leftover after parsing attributes in process `syz.0.3115'.
[  487.678329][T19234] netlink: 'syz.0.3115': attribute type 10 has an invalid length.
[  487.678343][T19234] netlink: 'syz.0.3115': attribute type 5 has an invalid length.
[  487.678354][T19234] netlink: 4 bytes leftover after parsing attributes in process `syz.0.3115'.
[  487.784798][T19234] geneve2: entered promiscuous mode
[  487.784821][T19234] geneve2: entered allmulticast mode
[  487.858456][T18949] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 46439 - 0
[  487.906309][T18951] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 46439 - 0
[  487.908261][T18945] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 46439 - 0
[  487.908300][T18945] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 46439 - 0
[  488.007769][T18758] batman_adv: batadv0: Interface activated: batadv_slave_0
[  488.052096][T18758] batman_adv: batadv0: Interface activated: batadv_slave_1
[  488.142444][T13426] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0
[  488.142573][T13426] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0
[  488.142639][T13426] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0
[  488.196574][T18951] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0
[  488.493105][T19250] netlink: 'syz.1.3118': attribute type 11 has an invalid length.
[  488.539756][T19257] x_tables: duplicate underflow at hook 1
[  488.628527][T18942] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[  488.628545][T18942] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50
[  488.736874][T18951] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[  488.736897][T18951] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50
[  488.948483][T19285] netlink: 8 bytes leftover after parsing attributes in process `syz.5.3122'.
[  488.948513][T19285] netlink: 4 bytes leftover after parsing attributes in process `syz.5.3122'.
[  489.019673][T19286] netlink: 32 bytes leftover after parsing attributes in process `syz.0.3121'.
[  489.050579][T19285] netlink: 8 bytes leftover after parsing attributes in process `syz.5.3122'.
[  489.050600][T19285] netlink: 4 bytes leftover after parsing attributes in process `syz.5.3122'.
[  489.066490][T18945] netdevsim netdevsim5 netdevsim0: set [0, 1] type 1 family 0 port 8472 - 0
[  489.067046][T18945] netdevsim netdevsim5 netdevsim1: set [0, 1] type 1 family 0 port 8472 - 0
[  489.067079][T18945] netdevsim netdevsim5 netdevsim2: set [0, 1] type 1 family 0 port 8472 - 0
[  489.067149][T18945] netdevsim netdevsim5 netdevsim3: set [0, 1] type 1 family 0 port 8472 - 0
[  489.214102][T19298] netlink: 'syz.4.3123': attribute type 61 has an invalid length.
[  489.355299][T19291] netlink: 20 bytes leftover after parsing attributes in process `syz.4.3123'.
[  489.369075][T19286] bridge0: left promiscuous mode
[  489.372056][T19286] 8021q: adding VLAN 0 to HW filter on device bond0
[  489.373545][T19286] 8021q: adding VLAN 0 to HW filter on device team0
[  489.400768][T19286] 8021q: adding VLAN 0 to HW filter on device batadv0
[  489.924274][T19286] batman_adv: batadv0: Interface activated: batadv_slave_0
[  489.942078][T19286] batman_adv: batadv0: Interface activated: batadv_slave_1
[  489.957480][T19286] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network
[  489.957506][T19286] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network
[  489.962938][T19286] veth1_vlan: left promiscuous mode
[  489.964513][T19286] veth0_vlan: left promiscuous mode
[  489.981427][T19286] veth0_vlan: entered promiscuous mode
[  489.986318][T19286] veth1_vlan: entered promiscuous mode
[  490.003000][T19286] veth1_macvtap: left promiscuous mode
[  490.009078][T19286] veth0_macvtap: left promiscuous mode
[  490.010239][T19286] veth0_macvtap: entered promiscuous mode
[  490.013368][T19286] veth1_macvtap: entered promiscuous mode
[  490.027811][T19286] 8021q: adding VLAN 0 to HW filter on device netdevsim0
[  490.031027][T19286] 8021q: adding VLAN 0 to HW filter on device netdevsim1
[  490.036742][T19286] 8021q: adding VLAN 0 to HW filter on device netdevsim2
[  490.040819][T19286] 8021q: adding VLAN 0 to HW filter on device netdevsim3
[  490.050145][T19286] geneve2: left promiscuous mode
[  490.055846][T18942] netdevsim netdevsim0 netdevsim1: set [1, 1] type 2 family 0 port 6081 - 0
[  490.055890][T18942] netdevsim netdevsim0 netdevsim2: set [1, 1] type 2 family 0 port 6081 - 0
[  490.055923][T18942] netdevsim netdevsim0 netdevsim3: set [1, 1] type 2 family 0 port 6081 - 0
[  490.127675][T18947] netdevsim netdevsim0 netdevsim0: set [1, 1] type 2 family 0 port 6081 - 0
[  490.167469][T18945] bridge0: port 1(bridge_slave_0) entered blocking state
[  490.167585][T18945] bridge0: port 1(bridge_slave_0) entered forwarding state
[  490.184310][T18945] bridge0: port 2(bridge_slave_1) entered blocking state
[  490.184417][T18945] bridge0: port 2(bridge_slave_1) entered forwarding state
[  490.600019][T19341] netlink: 4 bytes leftover after parsing attributes in process `syz.0.3133'.
[  490.750183][T19349] FAULT_INJECTION: forcing a failure.
[  490.750183][T19349] name failslab, interval 1, probability 0, space 0, times 0
[  490.750215][T19349] CPU: 1 UID: 0 PID: 19349 Comm: syz.3.3127 Not tainted syzkaller #0 PREEMPT(full) 
[  490.750239][T19349] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026
[  490.750249][T19349] Call Trace:
[  490.750257][T19349]  <TASK>
[  490.750265][T19349]  dump_stack_lvl+0xe8/0x150
[  490.750296][T19349]  should_fail_ex+0x410/0x560
[  490.750323][T19349]  should_failslab+0xa8/0x100
[  490.750348][T19349]  __kvmalloc_node_noprof+0x176/0x820
[  490.750372][T19349]  ? bpf_check_cfg+0x13f/0x3840
[  490.750416][T19349]  ? bpf_check_cfg+0x13f/0x3840
[  490.750438][T19349]  bpf_check_cfg+0x13f/0x3840
[  490.750479][T19349]  ? kasan_quarantine_put+0xbb/0x1f0
[  490.750497][T19349]  ? lockdep_hardirqs_on+0x7b/0x110
[  490.750526][T19349]  ? __pfx_bpf_check_cfg+0x10/0x10
[  490.750542][T19349]  ? bpf_prog_calc_tag+0x310/0x370
[  490.750562][T19349]  ? vfree+0x42b/0x490
[  490.750590][T19349]  ? bpf_prog_calc_tag+0x310/0x370
[  490.750616][T19349]  ? check_and_resolve_insns+0x1d54/0x21d0
[  490.750647][T19349]  ? __pfx_check_and_resolve_insns+0x10/0x10
[  490.750671][T19349]  ? add_kfuncs+0x251/0x2e0
[  490.750703][T19349]  bpf_check+0x25fd/0x2ef0
[  490.750742][T19349]  ? __pfx_bpf_check+0x10/0x10
[  490.750765][T19349]  ? bpf_obj_name_cpy+0x194/0x1e0
[  490.750795][T19349]  bpf_prog_load+0x14d6/0x1c20
[  490.750828][T19349]  ? __pfx_bpf_prog_load+0x10/0x10
[  490.750872][T19349]  __sys_bpf+0xd0d/0xd90
[  490.750900][T19349]  ? __pfx___sys_bpf+0x10/0x10
[  490.750932][T19349]  ? __fget_files+0x2a/0x420
[  490.750975][T19349]  ? ksys_write+0x242/0x270
[  490.751003][T19349]  ? __pfx_ksys_write+0x10/0x10
[  490.751035][T19349]  __x64_sys_bpf+0xba/0xd0
[  490.751057][T19349]  do_syscall_64+0x166/0x520
[  490.751080][T19349]  ? trace_irq_disable+0x3b/0x140
[  490.751098][T19349]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  490.751117][T19349]  ? clear_bhb_loop+0x70/0xc0
[  490.751139][T19349]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  490.751158][T19349] RIP: 0033:0x7fa49959e159
[  490.751175][T19349] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
[  490.751190][T19349] RSP: 002b:00007fa4977d5028 EFLAGS: 00000246 ORIG_RAX: 0000000000000141
[  490.751210][T19349] RAX: ffffffffffffffda RBX: 00007fa499826090 RCX: 00007fa49959e159
[  490.751223][T19349] RDX: 0000000000000094 RSI: 0000200000000080 RDI: 0000000000000005
[  490.751235][T19349] RBP: 00007fa4977d5090 R08: 0000000000000000 R09: 0000000000000000
[  490.751246][T19349] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002
[  490.751257][T19349] R13: 00007fa499826128 R14: 00007fa499826090 R15: 00007ffddd2cbf38
[  490.751288][T19349]  </TASK>
[  491.361956][T19368] netlink: 'syz.3.3136': attribute type 1 has an invalid length.
[  491.361980][T19368] netlink: 'syz.3.3136': attribute type 4 has an invalid length.
[  491.362790][T19368] netlink: 'syz.3.3136': attribute type 1 has an invalid length.
[  491.362807][T19368] netlink: 'syz.3.3136': attribute type 4 has an invalid length.
[  491.881059][T19382] __nla_validate_parse: 2 callbacks suppressed
[  491.881081][T19382] netlink: 48 bytes leftover after parsing attributes in process `syz.5.3139'.
[  493.804759][T19395] netlink: 32 bytes leftover after parsing attributes in process `syz.4.3144'.
[  494.516234][T19422] netlink: 'syz.1.3149': attribute type 1 has an invalid length.
[  494.524913][T19422] netlink: 12 bytes leftover after parsing attributes in process `syz.1.3149'.
[  494.673817][T19424] FAULT_INJECTION: forcing a failure.
[  494.673817][T19424] name failslab, interval 1, probability 0, space 0, times 0
[  494.673847][T19424] CPU: 0 UID: 0 PID: 19424 Comm: syz.4.3146 Not tainted syzkaller #0 PREEMPT(full) 
[  494.673868][T19424] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026
[  494.673880][T19424] Call Trace:
[  494.673887][T19424]  <TASK>
[  494.673895][T19424]  dump_stack_lvl+0xe8/0x150
[  494.673927][T19424]  should_fail_ex+0x410/0x560
[  494.673954][T19424]  should_failslab+0xa8/0x100
[  494.673977][T19424]  __kvmalloc_node_noprof+0x176/0x820
[  494.674001][T19424]  ? __kvmalloc_node_noprof+0x345/0x820
[  494.674021][T19424]  ? bpf_check_cfg+0x1ad/0x3840
[  494.674038][T19424]  ? bpf_check_cfg+0x1ad/0x3840
[  494.674062][T19424]  bpf_check_cfg+0x1ad/0x3840
[  494.674101][T19424]  ? kasan_quarantine_put+0xbb/0x1f0
[  494.674120][T19424]  ? lockdep_hardirqs_on+0x7b/0x110
[  494.674150][T19424]  ? __pfx_bpf_check_cfg+0x10/0x10
[  494.674168][T19424]  ? bpf_prog_calc_tag+0x310/0x370
[  494.674188][T19424]  ? vfree+0x42b/0x490
[  494.674216][T19424]  ? bpf_prog_calc_tag+0x310/0x370
[  494.674242][T19424]  ? check_and_resolve_insns+0x1d54/0x21d0
[  494.674273][T19424]  ? __pfx_check_and_resolve_insns+0x10/0x10
[  494.674298][T19424]  ? add_kfuncs+0x251/0x2e0
[  494.674323][T19424]  bpf_check+0x25fd/0x2ef0
[  494.674361][T19424]  ? __pfx_bpf_check+0x10/0x10
[  494.674384][T19424]  ? bpf_obj_name_cpy+0x194/0x1e0
[  494.674413][T19424]  bpf_prog_load+0x14d6/0x1c20
[  494.674447][T19424]  ? __pfx_bpf_prog_load+0x10/0x10
[  494.674501][T19424]  __sys_bpf+0xd0d/0xd90
[  494.674531][T19424]  ? __pfx___sys_bpf+0x10/0x10
[  494.674563][T19424]  ? __fget_files+0x2a/0x420
[  494.674604][T19424]  ? ksys_write+0x242/0x270
[  494.674635][T19424]  ? __pfx_ksys_write+0x10/0x10
[  494.674664][T19424]  __x64_sys_bpf+0xba/0xd0
[  494.674685][T19424]  do_syscall_64+0x166/0x520
[  494.674709][T19424]  ? trace_irq_disable+0x3b/0x140
[  494.674727][T19424]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  494.674746][T19424]  ? clear_bhb_loop+0x70/0xc0
[  494.674769][T19424]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  494.674787][T19424] RIP: 0033:0x7fe83d79e159
[  494.674805][T19424] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
[  494.674820][T19424] RSP: 002b:00007fe83e696028 EFLAGS: 00000246 ORIG_RAX: 0000000000000141
[  494.674840][T19424] RAX: ffffffffffffffda RBX: 00007fe83da26090 RCX: 00007fe83d79e159
[  494.674853][T19424] RDX: 0000000000000094 RSI: 0000200000000080 RDI: 0000000000000005
[  494.674865][T19424] RBP: 00007fe83e696090 R08: 0000000000000000 R09: 0000000000000000
[  494.674876][T19424] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002
[  494.674886][T19424] R13: 00007fe83da26128 R14: 00007fe83da26090 R15: 00007ffd7d54bbf8
[  494.674917][T19424]  </TASK>
[  495.003548][T19435] netlink: 36 bytes leftover after parsing attributes in process `syz.0.3152'.
[  495.071439][T19435] netlink: 8 bytes leftover after parsing attributes in process `syz.0.3152'.
[  495.158673][T19441] netlink: 40 bytes leftover after parsing attributes in process `syz.5.3153'.
[  495.384301][T19453] netlink: 132 bytes leftover after parsing attributes in process `syz.1.3156'.
[  495.572814][T19453] 8021q: adding VLAN 0 to HW filter on device bond3
[  495.579502][ T5628] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1
[  495.588384][ T5628] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9
[  495.593911][ T5628] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9
[  495.610980][ T5628] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4
[  495.611876][ T5628] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2
[  495.619908][T19460] netlink: 'syz.5.3157': attribute type 10 has an invalid length.
[  495.648408][T19447] netlink: 4 bytes leftover after parsing attributes in process `syz.3.3154'.
[  495.672986][T19463] netlink: 'syz.5.3157': attribute type 10 has an invalid length.
[  495.699444][T19460] 8021q: adding VLAN 0 to HW filter on device netdevsim1
[  495.702608][T19451] netlink: 12 bytes leftover after parsing attributes in process `syz.3.3154'.
[  495.717728][T19460] team0: Port device netdevsim1 added
[  495.777244][T19463] team0: Port device netdevsim1 removed
[  495.784648][T19463] 8021q: adding VLAN 0 to HW filter on device netdevsim1
[  495.808332][T19463] bond0: (slave netdevsim1): Enslaving as an active interface with an up link
[  496.113940][T19477] netlink: 44 bytes leftover after parsing attributes in process `syz.5.3160'.
[  496.287482][T19477] syzkaller1: entered promiscuous mode
[  496.287502][T19477] syzkaller1: entered allmulticast mode
[  496.292109][T19488] FAULT_INJECTION: forcing a failure.
[  496.292109][T19488] name failslab, interval 1, probability 0, space 0, times 0
[  496.292135][T19488] CPU: 0 UID: 0 PID: 19488 Comm: syz.0.3164 Not tainted syzkaller #0 PREEMPT(full) 
[  496.292153][T19488] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026
[  496.292163][T19488] Call Trace:
[  496.292170][T19488]  <TASK>
[  496.292178][T19488]  dump_stack_lvl+0xe8/0x150
[  496.292210][T19488]  should_fail_ex+0x410/0x560
[  496.292237][T19488]  should_failslab+0xa8/0x100
[  496.292260][T19488]  ? skb_clone+0x212/0x3a0
[  496.292382][T19488]  kmem_cache_alloc_noprof+0xa1/0x600
[  496.292405][T19488]  ? __pfx__copy_from_iter+0x10/0x10
[  496.292424][T19488]  ? skb_clone+0x212/0x3a0
[  496.292456][T19488]  skb_clone+0x212/0x3a0
[  496.292484][T19488]  pfkey_sendmsg+0x4d6/0x11d0
[  496.292599][T19488]  ? __pfx_pfkey_sendmsg+0x10/0x10
[  496.292648][T19488]  ? aa_sock_msg_perm+0x144/0x210
[  496.292729][T19488]  ? apparmor_socket_sendmsg+0x98/0x360
[  496.292760][T19488]  ? __pfx_pfkey_sendmsg+0x10/0x10
[  496.292784][T19488]  sock_sendmsg_nosec+0x13a/0x180
[  496.292808][T19488]  ____sys_sendmsg+0x54e/0x850
[  496.292865][T19488]  ? __pfx_____sys_sendmsg+0x10/0x10
[  496.292900][T19488]  ? import_iovec+0x73/0xa0
[  496.292927][T19488]  ___sys_sendmsg+0x2a5/0x360
[  496.292952][T19488]  ? __lock_acquire+0x747/0x2de0
[  496.292977][T19488]  ? __pfx____sys_sendmsg+0x10/0x10
[  496.293040][T19488]  ? __fget_files+0x2a/0x420
[  496.293062][T19488]  ? __fget_files+0x3a2/0x420
[  496.293097][T19488]  __x64_sys_sendmsg+0x1b1/0x290
[  496.293126][T19488]  ? __pfx___x64_sys_sendmsg+0x10/0x10
[  496.293175][T19488]  do_syscall_64+0x166/0x520
[  496.293198][T19488]  ? trace_irq_disable+0x3b/0x140
[  496.293217][T19488]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  496.293236][T19488]  ? clear_bhb_loop+0x70/0xc0
[  496.293258][T19488]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  496.293275][T19488] RIP: 0033:0x7fd8a1f9e159
[  496.293292][T19488] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
[  496.293306][T19488] RSP: 002b:00007fd8a2ef9028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e
[  496.293327][T19488] RAX: ffffffffffffffda RBX: 00007fd8a2225fa0 RCX: 00007fd8a1f9e159
[  496.293341][T19488] RDX: 0000000000000000 RSI: 00002000000014c0 RDI: 0000000000000003
[  496.293352][T19488] RBP: 00007fd8a2ef9090 R08: 0000000000000000 R09: 0000000000000000
[  496.293363][T19488] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001
[  496.293372][T19488] R13: 00007fd8a2226038 R14: 00007fd8a2225fa0 R15: 00007ffd516da8a8
[  496.293403][T19488]  </TASK>
[  496.704766][T19489] netlink: 'syz.1.3163': attribute type 39 has an invalid length.
[  497.202763][T19526] hsr_slave_0: left promiscuous mode
[  497.212955][T19526] hsr_slave_1: left promiscuous mode
[  497.264741][T19522] __nla_validate_parse: 2 callbacks suppressed
[  497.264760][T19522] netlink: 4 bytes leftover after parsing attributes in process `syz.0.3171'.
[  497.289712][T19522] batman_adv: batadv0: Interface deactivated: batadv_slave_1
[  497.347977][T19522] batman_adv: batadv0: Removing interface: batadv_slave_1
[  497.380348][T19532] openvswitch: netlink: Tunnel attr 4 has unexpected len 0 expected 1
[  497.703454][ T5625] Bluetooth: hci1: command tx timeout
[  498.073309][T19553] netlink: 8 bytes leftover after parsing attributes in process `syz.0.3177'.
[  498.073402][T19553] netlink: 8 bytes leftover after parsing attributes in process `syz.0.3177'.
[  498.091856][T19555] xt_hashlimit: size too large, truncated to 1048576
[  498.147560][T19558] openvswitch: netlink: Message has 4 unknown bytes.
[  498.150833][T19556] openvswitch: netlink: Message has 4 unknown bytes.
[  498.181986][T19552] bridge0: port 2(bridge_slave_1) entered disabled state
[  498.184525][T19552] bridge0: port 1(bridge_slave_0) entered disabled state
[  498.414704][T19552] batman_adv: batadv0: Interface deactivated: batadv_slave_0
[  498.729644][   T42] netdevsim netdevsim0 netdevsim2: unset [1, 0] type 2 family 0 port 46439 - 0
[  498.729677][   T42] netdevsim netdevsim0 netdevsim2: unset [1, 1] type 2 family 0 port 6081 - 0
[  498.730208][T18945] netdevsim netdevsim0 netdevsim1: unset [1, 0] type 2 family 0 port 46439 - 0
[  498.730232][T18945] netdevsim netdevsim0 netdevsim1: unset [1, 1] type 2 family 0 port 6081 - 0
[  498.730265][T18945] netdevsim netdevsim0 netdevsim0: unset [1, 0] type 2 family 0 port 46439 - 0
[  498.730284][T18945] netdevsim netdevsim0 netdevsim0: unset [1, 1] type 2 family 0 port 6081 - 0
[  498.870774][T19581] netlink: 24 bytes leftover after parsing attributes in process `syz.0.3182'.
[  499.067910][T19457] bridge0: port 1(bridge_slave_0) entered blocking state
[  499.068876][T19457] bridge0: port 1(bridge_slave_0) entered disabled state
[  499.069023][T19457] bridge_slave_0: entered allmulticast mode
[  499.070836][T19457] bridge_slave_0: entered promiscuous mode
[  499.101406][T19457] bridge0: port 2(bridge_slave_1) entered blocking state
[  499.101576][T19457] bridge0: port 2(bridge_slave_1) entered disabled state
[  499.101726][T19457] bridge_slave_1: entered allmulticast mode
[  499.103347][T19457] bridge_slave_1: entered promiscuous mode
[  499.176797][T19595] FAULT_INJECTION: forcing a failure.
[  499.176797][T19595] name failslab, interval 1, probability 0, space 0, times 0
[  499.176826][T19595] CPU: 0 UID: 0 PID: 19595 Comm: syz.1.3186 Not tainted syzkaller #0 PREEMPT(full) 
[  499.176846][T19595] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026
[  499.176860][T19595] Call Trace:
[  499.176867][T19595]  <TASK>
[  499.176874][T19595]  dump_stack_lvl+0xe8/0x150
[  499.176905][T19595]  should_fail_ex+0x410/0x560
[  499.176931][T19595]  ? __alloc_skb+0x1db/0x7a0
[  499.176953][T19595]  should_failslab+0xa8/0x100
[  499.176976][T19595]  ? __alloc_skb+0x1db/0x7a0
[  499.176995][T19595]  kmem_cache_alloc_node_noprof+0xa1/0x610
[  499.177022][T19595]  ? __alloc_skb+0x18d/0x7a0
[  499.177044][T19595]  ? __alloc_skb+0x1db/0x7a0
[  499.177072][T19595]  __alloc_skb+0x1db/0x7a0
[  499.177096][T19595]  pfkey_sendmsg+0xddc/0x11d0
[  499.177135][T19595]  ? __pfx_pfkey_sendmsg+0x10/0x10
[  499.177182][T19595]  ? aa_sock_msg_perm+0x144/0x210
[  499.177209][T19595]  ? apparmor_socket_sendmsg+0x98/0x360
[  499.177230][T19595]  ? __pfx_pfkey_sendmsg+0x10/0x10
[  499.177254][T19595]  sock_sendmsg_nosec+0x13a/0x180
[  499.177275][T19595]  ____sys_sendmsg+0x54e/0x850
[  499.177305][T19595]  ? __pfx_____sys_sendmsg+0x10/0x10
[  499.177334][T19595]  ? import_iovec+0x73/0xa0
[  499.177358][T19595]  ___sys_sendmsg+0x2a5/0x360
[  499.177380][T19595]  ? __lock_acquire+0x747/0x2de0
[  499.177404][T19595]  ? __pfx____sys_sendmsg+0x10/0x10
[  499.177464][T19595]  ? __fget_files+0x2a/0x420
[  499.177488][T19595]  ? __fget_files+0x3a2/0x420
[  499.177523][T19595]  __x64_sys_sendmsg+0x1b1/0x290
[  499.177552][T19595]  ? __pfx___x64_sys_sendmsg+0x10/0x10
[  499.177604][T19595]  do_syscall_64+0x166/0x520
[  499.177628][T19595]  ? trace_irq_disable+0x3b/0x140
[  499.177646][T19595]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  499.177665][T19595]  ? clear_bhb_loop+0x70/0xc0
[  499.177687][T19595]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  499.177705][T19595] RIP: 0033:0x7f0b2719e159
[  499.177723][T19595] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
[  499.177738][T19595] RSP: 002b:00007f0b28134028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e
[  499.177758][T19595] RAX: ffffffffffffffda RBX: 00007f0b27425fa0 RCX: 00007f0b2719e159
[  499.177772][T19595] RDX: 0000000000000000 RSI: 00002000000014c0 RDI: 0000000000000003
[  499.177783][T19595] RBP: 00007f0b28134090 R08: 0000000000000000 R09: 0000000000000000
[  499.177794][T19595] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001
[  499.177805][T19595] R13: 00007f0b27426038 R14: 00007f0b27425fa0 R15: 00007ffd56d55688
[  499.177835][T19595]  </TASK>
[  499.260551][T19457] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link
[  499.279948][T19457] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link
[  499.427361][T19457] team0: Port device team_slave_0 added
[  499.432261][T19457] team0: Port device team_slave_1 added
[  499.519138][T19597] netlink: 4 bytes leftover after parsing attributes in process `syz.3.3187'.
[  499.593593][T19457] batman_adv: batadv0: Adding interface: batadv_slave_0
[  499.593610][T19457] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem.
[  499.593632][T19457] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active
[  499.609119][T19457] batman_adv: batadv0: Adding interface: batadv_slave_1
[  499.609135][T19457] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem.
[  499.609156][T19457] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active
[  499.776560][ T5625] Bluetooth: hci1: command tx timeout
[  499.880850][T19457] hsr_slave_0: entered promiscuous mode
[  499.890369][T19457] hsr_slave_1: entered promiscuous mode
[  499.895140][T19457] debugfs: 'hsr0' already exists in 'hsr'
[  499.895161][T19457] Cannot create hsr debugfs directory
[  501.846768][ T5625] Bluetooth: hci1: command tx timeout
[  503.034173][T19621] netlink: 20 bytes leftover after parsing attributes in process `syz.0.3194'.
[  503.168700][T18946] netdevsim netdevsim0 netdevsim3: unset [1, 0] type 2 family 0 port 46439 - 0
[  503.168732][T18946] netdevsim netdevsim0 netdevsim3: unset [1, 1] type 2 family 0 port 6081 - 0
[  503.269344][T19457] netdevsim netdevsim4 eth3 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0
[  503.269379][T19457] netdevsim netdevsim4 eth3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[  503.446982][ T5625] Bluetooth: hci5: command 0x0406 tx timeout
[  503.517870][T19645] syzkaller0: entered promiscuous mode
[  503.517892][T19645] syzkaller0: entered allmulticast mode
[  503.720727][T19457] netdevsim netdevsim4 eth2 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0
[  503.720761][T19457] netdevsim netdevsim4 eth2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[  503.926669][ T5628] Bluetooth: hci1: command tx timeout
[  504.034458][T19457] netdevsim netdevsim4 eth1 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0
[  504.034507][T19457] netdevsim netdevsim4 eth1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[  504.222494][T19457] netdevsim netdevsim4 eth0 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0
[  504.222527][T19457] netdevsim netdevsim4 eth0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[  504.373070][T19684] ipt_rpfilter: unknown options
[  504.393951][T19684] netlink: 'syz.5.3205': attribute type 3 has an invalid length.
[  505.085876][T19703] Cannot find map_set index 4 as target
[  505.287271][T19712] netlink: 32 bytes leftover after parsing attributes in process `syz.3.3208'.
[  505.372712][T19457] netdevsim netdevsim4 netdevsim0: renamed from eth0
[  505.400595][T19457] 8021q: adding VLAN 0 to HW filter on device netdevsim0
[  505.514932][T19708] A link change request failed with some changes committed already. Interface dummy0 may have been left with an inconsistent configuration, please check.
[  505.515468][T19457] netdevsim netdevsim4 netdevsim1: renamed from eth1
[  505.555404][T19457] 8021q: adding VLAN 0 to HW filter on device netdevsim1
[  505.563089][T19457] netdevsim netdevsim4 netdevsim2: renamed from eth2
[  505.588141][T19457] 8021q: adding VLAN 0 to HW filter on device netdevsim2
[  505.591443][T19457] netdevsim netdevsim4 netdevsim3: renamed from eth3
[  505.644051][T19457] 8021q: adding VLAN 0 to HW filter on device netdevsim3
[  505.843651][T19743] netlink: 12 bytes leftover after parsing attributes in process `syz.1.3213'.
[  506.220913][T19758] netlink: 4 bytes leftover after parsing attributes in process `syz.3.3217'.
[  506.413693][T19766] netlink: 8 bytes leftover after parsing attributes in process `syz.0.3218'.
[  506.413714][T19766] netlink: 4 bytes leftover after parsing attributes in process `syz.0.3218'.
[  506.417004][T19457] 8021q: adding VLAN 0 to HW filter on device bond0
[  506.458815][T18949] netdevsim netdevsim0 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0
[  506.458859][T18949] netdevsim netdevsim0 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0
[  506.458891][T18949] netdevsim netdevsim0 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0
[  506.458921][T18949] netdevsim netdevsim0 netdevsim0: set [0, 0] type 1 family 0 port 8472 - 0
[  506.520471][T19457] 8021q: adding VLAN 0 to HW filter on device team0
[  506.538057][T19775] netlink: 'syz.5.3220': attribute type 1 has an invalid length.
[  506.642643][T19775] 8021q: adding VLAN 0 to HW filter on device bond3
[  506.644633][T18949] bridge0: port 1(bridge_slave_0) entered blocking state
[  506.644735][T18949] bridge0: port 1(bridge_slave_0) entered forwarding state
[  506.749834][T19779] bond3: (slave veth0_to_bond): making interface the new active one
[  506.752897][T19779] bond3: (slave veth0_to_bond): Enslaving as an active interface with an up link
[  506.763698][T18945] bridge0: port 2(bridge_slave_1) entered blocking state
[  506.763818][T18945] bridge0: port 2(bridge_slave_1) entered forwarding state
[  506.777273][T19775] macvlan3: entered promiscuous mode
[  506.777293][T19775] macvlan3: entered allmulticast mode
[  506.777859][T19775] bond3: entered promiscuous mode
[  506.777873][T19775] veth0_to_bond: entered promiscuous mode
[  506.778799][T19775] 8021q: adding VLAN 0 to HW filter on device macvlan3
[  506.779435][T19775] bond3: (slave macvlan3): the slave hw address is in use by the bond; couldn't find a slave with a free hw address to give it (this should not have happened)
[  506.779549][T19775] bond3: left promiscuous mode
[  506.779561][T19775] veth0_to_bond: left promiscuous mode
[  506.912873][T19800] netlink: 'syz.5.3220': attribute type 4 has an invalid length.
[  507.002267][T19775] netlink: 'syz.5.3220': attribute type 4 has an invalid length.
[  507.736476][T19835] netlink: 44 bytes leftover after parsing attributes in process `syz.3.3231'.
[  507.893948][T19846] netlink: 72 bytes leftover after parsing attributes in process `syz.5.3233'.
[  507.951260][T19837] 8021q: adding VLAN 0 to HW filter on device bond0
[  507.960169][T19837] 8021q: adding VLAN 0 to HW filter on device team0
[  507.983343][T19837] 8021q: adding VLAN 0 to HW filter on device batadv0
[  507.995304][T19850] netlink: 32 bytes leftover after parsing attributes in process `syz.3.3234'.
[  508.104341][T19837] batman_adv: batadv0: Interface activated: batadv_slave_0
[  508.114044][T19837] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network
[  508.114066][T19837] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network
[  508.121025][T19837] veth1_vlan: left promiscuous mode
[  508.122854][T19837] veth0_vlan: left promiscuous mode
[  508.124356][T19837] veth0_vlan: entered promiscuous mode
[  508.129533][T19837] veth1_vlan: entered promiscuous mode
[  508.136312][T19837] veth1_macvtap: left promiscuous mode
[  508.137491][T19837] veth0_macvtap: left promiscuous mode
[  508.138782][T19837] veth0_macvtap: entered promiscuous mode
[  508.139951][T19837] veth1_macvtap: entered promiscuous mode
[  508.147838][T19837] 8021q: adding VLAN 0 to HW filter on device netdevsim0
[  508.149643][T19837] 8021q: adding VLAN 0 to HW filter on device netdevsim1
[  508.150732][T19837] 8021q: adding VLAN 0 to HW filter on device netdevsim2
[  508.151750][T19837] 8021q: adding VLAN 0 to HW filter on device netdevsim3
[  508.158995][T19837] 8021q: adding VLAN 0 to HW filter on device bond1
[  508.179452][T18947] netdevsim netdevsim1 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0
[  508.179484][T18947] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0
[  508.179506][T18947] netdevsim netdevsim1 netdevsim1: set [1, 1] type 2 family 0 port 20004 - 0
[  508.190486][T18947] netdevsim netdevsim1 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0
[  508.190516][T18947] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0
[  508.190537][T18947] netdevsim netdevsim1 netdevsim2: set [1, 1] type 2 family 0 port 20004 - 0
[  508.190912][T18947] netdevsim netdevsim1 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0
[  508.190935][T18947] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0
[  508.190957][T18947] netdevsim netdevsim1 netdevsim3: set [1, 1] type 2 family 0 port 20004 - 0
[  508.191164][T18947] netdevsim netdevsim1 netdevsim0: set [0, 0] type 1 family 0 port 8472 - 0
[  508.191186][T18947] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0
[  508.191208][T18947] netdevsim netdevsim1 netdevsim0: set [1, 1] type 2 family 0 port 20004 - 0
[  508.209015][T18945] bridge0: port 1(bridge_slave_0) entered blocking state
[  508.209132][T18945] bridge0: port 1(bridge_slave_0) entered forwarding state
[  508.221305][T18945] bridge0: port 2(bridge_slave_1) entered blocking state
[  508.221404][T18945] bridge0: port 2(bridge_slave_1) entered forwarding state
[  508.630660][T19877] netlink: 68 bytes leftover after parsing attributes in process `syz.1.3237'.
[  508.711604][T19852] bridge0: port 2(bridge_slave_1) entered disabled state
[  508.712233][T19852] bridge0: port 1(bridge_slave_0) entered disabled state
[  508.894872][T19891] netlink: 124 bytes leftover after parsing attributes in process `syz.1.3240'.
[  508.914689][T19892] netlink: 'syz.1.3240': attribute type 1 has an invalid length.
[  508.971923][T19898] block nbd0: reconnected socket
[  508.971943][T19898] nbd: socks must be embedded in a SOCK_ITEM attr
[  508.985807][ T5628] block nbd0: Receive control failed (result -32)
[  509.028951][T19852] batman_adv: batadv0: Interface deactivated: batadv_slave_0
[  509.065169][T19852] batman_adv: batadv0: Interface deactivated: batadv_slave_1
[  509.224427][T19907] netlink: 'syz.0.3243': attribute type 4 has an invalid length.
[  509.341272][T19859] tap0: tun_chr_ioctl cmd 1074025672
[  509.341294][T19859] tap0: ignored: set checksum disabled
[  509.342785][   T42] netdevsim netdevsim3 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0
[  509.342826][   T42] netdevsim netdevsim3 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0
[  509.342859][   T42] netdevsim netdevsim3 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0
[  509.368750][T19457] 8021q: adding VLAN 0 to HW filter on device batadv0
[  509.413555][T19894] gretap1: entered allmulticast mode
[  509.453975][T18942] bond0: left allmulticast mode
[  509.483010][T18942] bond0: left promiscuous mode
[  509.488425][T18942] bridge0: port 1(bond0) entered disabled state
[  509.539381][T18942] pim6reg: left allmulticast mode
[  509.567772][T18942] batman_adv: batadv0: Interface deactivated: ip6gretap1
[  509.813015][T18942] batman_adv: batadv0: Removing interface: ip6gretap1
[  510.203965][T19935] 0: reclassify loop, rule prio 0, protocol 800
[  510.219728][T19935] 0: reclassify loop, rule prio 0, protocol 800
[  510.220033][T19935] 0: reclassify loop, rule prio 0, protocol 800
[  510.220315][T19935] 0: reclassify loop, rule prio 0, protocol 800
[  510.220601][T19935] 0: reclassify loop, rule prio 0, protocol 800
[  510.220923][T19935] 0: reclassify loop, rule prio 0, protocol 800
[  510.221218][T19935] 0: reclassify loop, rule prio 0, protocol 800
[  510.221503][T19935] 0: reclassify loop, rule prio 0, protocol 800
[  510.221782][T19935] 0: reclassify loop, rule prio 0, protocol 800
[  510.268375][T18942] bond10 (unregistering): (slave gretap2): Releasing backup interface
[  510.560589][T18942] bond7 (unregistering): (slave geneve3): Releasing active interface
[  510.589169][T18942] bond1 (unregistering): (slave bridge1): Releasing backup interface
[  510.640987][T18942] bond0 (unregistering): Released all slaves
[  510.645196][T18942] bond1 (unregistering): Released all slaves
[  510.661926][T18942] bond2 (unregistering): Released all slaves
[  510.686662][T18942] bond3 (unregistering): Released all slaves
[  510.694292][T18942] bond5 (unregistering): Released all slaves
[  510.709478][T18942] bond4 (unregistering): Released all slaves
[  510.719048][T18942] bond6 (unregistering): Released all slaves
[  510.732409][T18942] bond7 (unregistering): Released all slaves
[  510.765751][T18942] bond8 (unregistering): Released all slaves
[  510.774765][T18942] bond9 (unregistering): Released all slaves
[  510.794672][T18942] bond10 (unregistering): Released all slaves
[  510.814951][T18942] bond11 (unregistering): Released all slaves
[  510.832810][T18942] bond12 (unregistering): (slave veth5): Releasing active interface
[  510.832833][T18942] batadv1: entered promiscuous mode
[  510.835225][T18942] bond12 (unregistering): (slave batadv1): Releasing active interface
[  510.835249][T18942] batadv1: left promiscuous mode
[  510.870634][T18942] bond12 (unregistering): Released all slaves
[  511.008349][T19938] bridge2: entered promiscuous mode
[  511.008364][T19938] bridge2: entered allmulticast mode
[  511.198790][T18951] netdevsim netdevsim3 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0
[  511.233030][T18942] : left promiscuous mode
[  511.571785][T18942] 
þ: left promiscuous mode
[  511.802727][T19972] netlink: 8 bytes leftover after parsing attributes in process `syz.0.3254'.
[  511.802755][T19972] netlink: 8 bytes leftover after parsing attributes in process `syz.0.3254'.
[  511.882783][T19972] netlink: 8 bytes leftover after parsing attributes in process `syz.0.3254'.
[  511.922430][T18942] tipc: Left network mode
[  512.051375][T19457] veth0_vlan: entered promiscuous mode
[  512.139327][T19457] veth1_vlan: entered promiscuous mode
[  512.243524][T19457] veth0_macvtap: entered promiscuous mode
[  512.275926][T19457] veth1_macvtap: entered promiscuous mode
[  512.317442][T19457] batman_adv: batadv0: Interface activated: batadv_slave_0
[  512.336624][T19457] batman_adv: batadv0: Interface activated: batadv_slave_1
[  512.500168][T18950] netdevsim netdevsim4 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0
[  512.500600][T18950] netdevsim netdevsim4 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0
[  512.501024][T18950] netdevsim netdevsim4 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0
[  512.501294][T18950] netdevsim netdevsim4 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0
[  512.672644][T18946] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[  512.672665][T18946] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50
[  512.884147][T18945] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[  512.884168][T18945] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50
[  513.271835][T20008] block nbd5: not configured, cannot reconfigure
[  513.290861][ T5625] Bluetooth: hci5: connection err: -111
[  513.391311][T20008] 8021q: adding VLAN 0 to HW filter on device ipvlan2
[  513.391923][T20008] team0: Device ipvlan2 is already an upper device of the team interface
[  513.534779][T20013] vlan2: entered promiscuous mode
[  513.534800][T20013] bridge0: entered promiscuous mode
[  513.603722][T20012] netlink: 65039 bytes leftover after parsing attributes in process `syz.3.3262'.
[  513.686917][ T5628] block nbd3: Receive control failed (result -32)
[  514.274019][T20060] netlink: 284 bytes leftover after parsing attributes in process `syz.4.3269'.
[  514.522999][T20062] netlink: 112 bytes leftover after parsing attributes in process `syz.0.3270'.
[  514.818807][ T2035] block nbd2: Possible stuck request ffff888027240000: control (read@0,1024B). Runtime 60 seconds
[  514.818877][ T2035] block nbd2: Possible stuck request ffff8880272401c0: control (read@1024,1024B). Runtime 60 seconds
[  514.818902][ T2035] block nbd2: Possible stuck request ffff888027240380: control (read@2048,1024B). Runtime 60 seconds
[  514.818925][ T2035] block nbd2: Possible stuck request ffff888027240540: control (read@3072,1024B). Runtime 60 seconds
[  515.211841][T20105] netlink: 4 bytes leftover after parsing attributes in process `syz.5.3276'.
[  515.297132][T20112] net_ratelimit: 303 callbacks suppressed
[  515.297153][T20112] openvswitch: netlink: IP tunnel TTL not specified.
[  515.896303][T20089] netlink: 24 bytes leftover after parsing attributes in process `syz.1.3277'.
[  515.940335][T20117] Bluetooth: hci0: Opcode 0x0c1a failed: -4
[  515.954317][T20085] netlink: 'syz.5.3276': attribute type 1 has an invalid length.
[  515.987628][T20125] netlink: 'syz.0.3281': attribute type 4 has an invalid length.
[  516.097678][T20125] bridge_slave_0: left allmulticast mode
[  516.097702][T20125] bridge_slave_0: left promiscuous mode
[  516.097935][T20125] bridge0: port 1(bridge_slave_0) entered disabled state
[  516.156136][T20125] bridge_slave_1: left allmulticast mode
[  516.156162][T20125] bridge_slave_1: left promiscuous mode
[  516.156378][T20125] bridge0: port 2(bridge_slave_1) entered disabled state
[  516.259760][T20125] bond0: (slave bond_slave_0): Releasing backup interface
[  516.275194][T20143] netlink: 8 bytes leftover after parsing attributes in process `syz.4.3284'.
[  516.275217][T20143] netlink: 8 bytes leftover after parsing attributes in process `syz.4.3284'.
[  516.303774][T20125] bond0: (slave bond_slave_1): Releasing backup interface
[  516.334248][T20125] team0: Port device team_slave_0 removed
[  516.350273][T20125] team0: Port device team_slave_1 removed
[  516.350507][T20125] batman_adv: batadv0: Removing interface: batadv_slave_0
[  516.361335][T20139] x_tables: ip_tables: icmp match: only valid for protocol 1
[  516.389078][T20137] netlink: 'syz.5.3283': attribute type 4 has an invalid length.
[  516.522048][T20138] bond1: Removing last ns target with arp_interval on
[  516.789958][T20158] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium
[  516.837556][T20158] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium
[  516.934686][T20168] netlink: 12 bytes leftover after parsing attributes in process `syz.5.3289'.
[  516.971607][T18942] batman_adv: batadv0: Interface deactivated: macvlan5
[  517.009600][T18942] batman_adv: batadv0: Removing interface: macvlan5
[  517.130343][T20171] syz.3.3292: vmalloc error: size 8589938688, exceeds total pages, mode:0x400dc0(GFP_KERNEL_ACCOUNT|__GFP_ZERO), nodemask=(null),cpuset=/,mems_allowed=0-1
[  517.134264][T20171] CPU: 0 UID: 0 PID: 20171 Comm: syz.3.3292 Not tainted syzkaller #0 PREEMPT(full) 
[  517.134288][T20171] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026
[  517.134300][T20171] Call Trace:
[  517.134308][T20171]  <TASK>
[  517.134318][T20171]  dump_stack_lvl+0xe8/0x150
[  517.134353][T20171]  warn_alloc+0x24d/0x270
[  517.134378][T20171]  ? kasan_save_track+0x4f/0x80
[  517.134398][T20171]  ? kasan_save_track+0x3e/0x80
[  517.134421][T20171]  ? __pfx_warn_alloc+0x10/0x10
[  517.134437][T20171]  ? __x64_sys_setsockopt+0x13d/0x1b0
[  517.134464][T20171]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  517.134504][T20171]  __vmalloc_node_range_noprof+0x127/0x1540
[  517.134557][T20171]  ? rcu_is_watching+0x16/0xb0
[  517.134620][T20171]  ? __pfx___vmalloc_node_range_noprof+0x10/0x10
[  517.134647][T20171]  ? __kmalloc_cache_noprof+0x321/0x600
[  517.134666][T20171]  ? __kmalloc_cache_noprof+0x14d/0x600
[  517.134682][T20171]  ? xskq_create+0x56/0x220
[  517.134779][T20171]  xskq_create+0x148/0x220
[  517.134803][T20171]  ? xsk_init_queue+0x8a/0xe0
[  517.134829][T20171]  xsk_init_queue+0x8a/0xe0
[  517.134856][T20171]  xsk_setsockopt+0x52a/0x960
[  517.134881][T20171]  ? __pfx_xsk_setsockopt+0x10/0x10
[  517.134904][T20171]  ? __pfx_aa_sk_perm+0x10/0x10
[  517.134939][T20171]  ? bpf_lsm_socket_setsockopt+0x9/0x20
[  517.134963][T20171]  ? __pfx_xsk_setsockopt+0x10/0x10
[  517.134988][T20171]  do_sock_setsockopt+0x17c/0x1b0
[  517.135018][T20171]  __x64_sys_setsockopt+0x13d/0x1b0
[  517.135051][T20171]  do_syscall_64+0x166/0x520
[  517.135076][T20171]  ? trace_irq_disable+0x3b/0x140
[  517.135095][T20171]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  517.135114][T20171]  ? clear_bhb_loop+0x70/0xc0
[  517.135138][T20171]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  517.135158][T20171] RIP: 0033:0x7fa49959e159
[  517.135175][T20171] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
[  517.135192][T20171] RSP: 002b:00007fa4977f6028 EFLAGS: 00000246 ORIG_RAX: 0000000000000036
[  517.135212][T20171] RAX: ffffffffffffffda RBX: 00007fa499825fa0 RCX: 00007fa49959e159
[  517.135233][T20171] RDX: 0000000000000006 RSI: 000000000000011b RDI: 0000000000000005
[  517.135246][T20171] RBP: 00007fa49963506b R08: 0000000000000004 R09: 0000000000000000
[  517.135259][T20171] R10: 0000200000000000 R11: 0000000000000246 R12: 0000000000000000
[  517.135271][T20171] R13: 00007fa499826038 R14: 00007fa499825fa0 R15: 00007ffddd2cbf38
[  517.135306][T20171]  </TASK>
[  517.372250][T20171] Mem-Info:
[  517.372269][T20171] active_anon:6513 inactive_anon:0 isolated_anon:0
[  517.372269][T20171]  active_file:80 inactive_file:43273 isolated_file:0
[  517.372269][T20171]  unevictable:0 dirty:179 writeback:0
[  517.372269][T20171]  slab_reclaimable:11968 slab_unreclaimable:112192
[  517.372269][T20171]  mapped:29746 shmem:578 pagetables:4147
[  517.372269][T20171]  sec_pagetables:0 bounce:0
[  517.372269][T20171]  kernel_misc_reclaimable:0
[  517.372269][T20171]  free:1255742 free_pcp:18737 free_cma:0
[  517.372318][T20171] Node 0 active_anon:26052kB inactive_anon:0kB active_file:320kB inactive_file:172892kB unevictable:0kB isolated(anon):0kB isolated(file):0kB mapped:86216kB dirty:712kB writeback:0kB shmem:2312kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB kernel_stack:15932kB pagetables:16344kB sec_pagetables:0kB all_unreclaimable? no Balloon:0kB gpu_active:0kB gpu_reclaim:0kB
[  517.372369][T20171] Node 1 active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:200kB unevictable:0kB isolated(anon):0kB isolated(file):0kB mapped:32768kB dirty:4kB writeback:0kB shmem:0kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB kernel_stack:64kB pagetables:244kB sec_pagetables:0kB all_unreclaimable? no Balloon:0kB gpu_active:0kB gpu_reclaim:0kB
[  517.372416][T20171] Node 0 DMA free:11196kB boost:0kB min:208kB low:260kB high:312kB reserved_highatomic:0kB free_highatomic:0kB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB zspages:0kB present:15992kB managed:15360kB mlocked:0kB bounce:0kB free_pcp:52kB local_pcp:20kB free_cma:0kB
[  517.372469][T20171] lowmem_reserve[]: 0 2487 2487 2487 2487
[  517.372503][T20171] Node 0 DMA32 free:1274252kB boost:0kB min:34140kB low:42672kB high:51204kB reserved_highatomic:0kB free_highatomic:0kB active_anon:26052kB inactive_anon:0kB active_file:320kB inactive_file:172892kB unevictable:0kB writepending:712kB zspages:0kB present:3129332kB managed:2546840kB mlocked:0kB bounce:0kB free_pcp:44220kB local_pcp:23540kB free_cma:0kB
[  517.372558][T20171] lowmem_reserve[]: 0 0 0 0 0
[  517.372589][T20171] Node 0 Normal free:0kB boost:0kB min:0kB low:0kB high:0kB reserved_highatomic:0kB free_highatomic:0kB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB zspages:0kB present:1048580kB managed:0kB mlocked:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB
[  517.372639][T20171] lowmem_reserve[]: 0 0 0 0 0
[  517.372671][T20171] Node 1 Normal free:3737520kB boost:0kB min:55760kB low:69700kB high:83640kB reserved_highatomic:0kB free_highatomic:0kB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:200kB unevictable:0kB writepending:4kB zspages:0kB present:4194300kB managed:4111104kB mlocked:0kB bounce:0kB free_pcp:30676kB local_pcp:18708kB free_cma:0kB
[  517.372745][T20171] lowmem_reserve[]: 0 0 0 0 0
[  517.372777][T20171] Node 0 DMA: 7*4kB (U) 6*8kB (U) 5*16kB (U) 7*32kB (U) 5*64kB (U) 6*128kB (U) 4*256kB (U) 1*512kB (U) 2*1024kB (U) 1*2048kB (M) 1*4096kB (M) = 11196kB
[  517.372923][T20171] Node 0 DMA32: 1697*4kB (UME) 995*8kB (UME) 979*16kB (UME) 1390*32kB (UME) 1898*64kB (UM) 1318*128kB (UME) 1012*256kB (UME) 574*512kB (UME) 246*1024kB (UE) 33*2048kB (UM) 9*4096kB (U) = 1274380kB
[  517.373076][T20171] Node 0 Normal: 0*4kB 0*8kB 0*16kB 0*32kB 0*64kB 0*128kB 0*256kB 0*512kB 0*1024kB 0*2048kB 0*4096kB = 0kB
[  517.373166][T20171] Node 1 Normal: 56*4kB (UM) 50*8kB (UM) 60*16kB (UM) 58*32kB (UM) 61*64kB (UM) 44*128kB (UM) 37*256kB (UM) 26*512kB (UM) 11*1024kB (UM) 2*2048kB (U) 900*4096kB (UM) = 3737520kB
[  517.373310][T20171] Node 0 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB
[  517.373325][T20171] Node 0 hugepages_total=2 hugepages_free=2 hugepages_surp=0 hugepages_size=2048kB
[  517.373340][T20171] Node 1 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB
[  517.373354][T20171] Node 1 hugepages_total=2 hugepages_free=2 hugepages_surp=0 hugepages_size=2048kB
[  517.373369][T20171] 43927 total pagecache pages
[  517.373376][T20171] 0 pages in swap cache
[  517.373382][T20171] Free swap  = 124996kB
[  517.373389][T20171] Total swap = 124996kB
[  517.373396][T20171] 2097051 pages RAM
[  517.373402][T20171] 0 pages HighMem/MovableOnly
[  517.373409][T20171] 428725 pages reserved
[  517.373415][T20171] 0 pages cma reserved
[  517.544182][ T5628] Bluetooth: hci0: command 0x0c1a tx timeout
[  517.733328][T18942] veth0_to_team: left promiscuous mode
[  517.733476][T18942] veth1_vlan: left promiscuous mode
[  517.733511][T18942] veth0_vlan: left promiscuous mode
[  517.850246][T20194] x_tables: duplicate underflow at hook 2
[  517.852469][T20200] netlink: 12 bytes leftover after parsing attributes in process `syz.0.3296'.
[  518.984613][T20221] ip_tables: iptables: counters copy to user failed while replacing table
[  519.002172][T20221] netlink: 4 bytes leftover after parsing attributes in process `syz.3.3302'.
[  519.131816][T20224] netlink: 16 bytes leftover after parsing attributes in process `syz.0.3303'.
[  519.222589][T20227] tipc: Can't bind to reserved service type 2
[  519.259262][T18942] IPVS: stop unused estimator thread 0...
[  519.272890][T20228] x_tables: duplicate underflow at hook 1
[  519.387069][T20240] ip6_tables: ip6tables: counters copy to user failed while replacing table
[  519.565246][T20246] netlink: 'syz.4.3306': attribute type 12 has an invalid length.
[  519.603384][T20252] syzkaller1: tun_chr_ioctl cmd 1074025677
[  519.603471][T20252] syzkaller1: linktype set to 823
[  519.627910][T20253] __nla_validate_parse: 2 callbacks suppressed
[  519.627922][T20253] netlink: 632 bytes leftover after parsing attributes in process `syz.5.3309'.
[  519.679378][T20245] netlink: 12 bytes leftover after parsing attributes in process `syz.0.3308'.
[  519.885535][T20257] sctp: [Deprecated]: syz.5.3312 (pid 20257) Use of int in max_burst socket option.
[  519.885535][T20257] Use struct sctp_assoc_value instead
[  519.922436][T20266] netlink: 24 bytes leftover after parsing attributes in process `syz.0.3314'.
[  520.092383][T20280] netlink: 32 bytes leftover after parsing attributes in process `syz.3.3320'.
[  520.092578][T20280] netlink: 8 bytes leftover after parsing attributes in process `syz.3.3320'.
[  520.147133][T20278] netlink: 12 bytes leftover after parsing attributes in process `syz.1.3317'.
[  520.191563][T20290] netlink: 8 bytes leftover after parsing attributes in process `syz.3.3322'.
[  520.626780][T20303] netlink: 4 bytes leftover after parsing attributes in process `syz.3.3327'.
[  520.633975][T20303] netlink: 4 bytes leftover after parsing attributes in process `syz.3.3327'.
[  520.689429][T20303] IPVS: set_ctl: invalid protocol: 43 172.20.20.187:20001
[  521.002095][T20323] netlink: 'syz.4.3333': attribute type 21 has an invalid length.
[  521.049003][T20327] netlink: 'syz.0.3335': attribute type 1 has an invalid length.
[  521.102167][T20329] netlink: 4 bytes leftover after parsing attributes in process `syz.5.3334'.
[  521.158322][T20327] 8021q: adding VLAN 0 to HW filter on device bond1
[  521.289426][T20327] bond1: (slave gretap1): making interface the new active one
[  521.290660][T20327] bond1: (slave gretap1): Enslaving as an active interface with an up link
[  521.550455][T20350] xt_hashlimit: size too large, truncated to 1048576
[  521.918953][T20365] ip6_tables: ip6tables: counters copy to user failed while replacing table
[  521.936486][T20365] syzkaller1: entered promiscuous mode
[  521.936506][T20365] syzkaller1: entered allmulticast mode
[  521.942208][T20365] ip_tables: iptables: counters copy to user failed while replacing table
[  521.945068][T20365] syzkaller1: left promiscuous mode
[  521.945085][T20365] syzkaller1: left allmulticast mode
[  522.287182][T20382] GUP no longer grows the stack in syz.3.3350 (20382): 200000003000-20000000a000 (200000001000)
[  522.287214][T20382] CPU: 1 UID: 0 PID: 20382 Comm: syz.3.3350 Not tainted syzkaller #0 PREEMPT(full) 
[  522.287233][T20382] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026
[  522.287244][T20382] Call Trace:
[  522.287251][T20382]  <TASK>
[  522.287259][T20382]  dump_stack_lvl+0xe8/0x150
[  522.287290][T20382]  __get_user_pages+0x23b6/0x2750
[  522.287320][T20382]  ? lock_acquire+0x115/0x350
[  522.287355][T20382]  ? __gup_longterm_locked+0xc3b/0x15c0
[  522.287388][T20382]  __gup_longterm_locked+0xd52/0x15c0
[  522.287416][T20382]  ? lock_acquire+0x115/0x350
[  522.287452][T20382]  gup_fast_fallback+0x1d92/0x20e0
[  522.287510][T20382]  ? __pfx_gup_fast_fallback+0x10/0x10
[  522.287537][T20382]  ? lock_acquire+0x115/0x350
[  522.287552][T20382]  ? is_valid_gup_args+0x11f/0x200
[  522.287578][T20382]  ? get_user_pages_fast+0x4d/0xb0
[  522.287605][T20382]  __iov_iter_get_pages_alloc+0x378/0xa40
[  522.287636][T20382]  ? __pfx_pipe_clear_nowait+0x10/0x10
[  522.287661][T20382]  iov_iter_get_pages2+0x5e/0xa0
[  522.287687][T20382]  __se_sys_vmsplice+0x7b5/0x1660
[  522.287733][T20382]  ? __pfx___se_sys_vmsplice+0x10/0x10
[  522.287757][T20382]  ? __pfx_futex_wait+0x10/0x10
[  522.287877][T20382]  do_syscall_64+0x166/0x520
[  522.287899][T20382]  ? trace_irq_disable+0x3b/0x140
[  522.287914][T20382]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  522.287930][T20382]  ? clear_bhb_loop+0x70/0xc0
[  522.287950][T20382]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  522.287965][T20382] RIP: 0033:0x7fa49959e159
[  522.287981][T20382] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
[  522.287994][T20382] RSP: 002b:00007fa4977d5028 EFLAGS: 00000246 ORIG_RAX: 0000000000000116
[  522.288012][T20382] RAX: ffffffffffffffda RBX: 00007fa499826090 RCX: 00007fa49959e159
[  522.288023][T20382] RDX: 0000000000000001 RSI: 00002000000000c0 RDI: 000000000000000c
[  522.288033][T20382] RBP: 00007fa49963506b R08: 0000000000000000 R09: 0000000000000000
[  522.288042][T20382] R10: 0000000000000001 R11: 0000000000000246 R12: 0000000000000000
[  522.288051][T20382] R13: 00007fa499826128 R14: 00007fa499826090 R15: 00007ffddd2cbf38
[  522.288079][T20382]  </TASK>
[  522.890967][T20408] netlink: 'syz.4.3360': attribute type 1 has an invalid length.
[  522.978794][T20408] 8021q: adding VLAN 0 to HW filter on device bond1
[  523.019460][T20419] netlink: 'syz.5.3361': attribute type 1 has an invalid length.
[  523.082160][T20409] bond1: (slave veth3): Enslaving as an active interface with a down link
[  523.128612][ T5628] Bluetooth: hci0: Opcode 0x1407 failed: -110
[  523.129245][ T5628] Bluetooth: hci0: command 0x0c1a tx timeout
[  523.139022][T20415] 8021q: adding VLAN 0 to HW filter on device batadv1
[  523.148004][T20415] bond1: (slave batadv1): making interface the new active one
[  523.173303][T20415] batadv1: entered promiscuous mode
[  523.183086][T20415] bond1: (slave batadv1): Enslaving as an active interface with an up link
[  523.257030][T20425] bond1 (unregistering): (slave veth3): Releasing active interface
[  523.275091][T20425] bond1 (unregistering): (slave batadv1): Releasing active interface
[  523.275117][T20425] batadv1: left promiscuous mode
[  523.279878][T20425] bond1 (unregistering): Released all slaves
[  523.524870][T20439] tipc: Started in network mode
[  523.524897][T20439] tipc: Node identity ac14140f, cluster identity 4711
[  523.525156][T20439] tipc: New replicast peer: 255.255.255.255
[  523.547312][T20439] tipc: Enabled bearer <udp:syz2>, priority 10
[  523.547655][T20443] netlink: 'syz.1.3359': attribute type 7 has an invalid length.
[  523.547672][T20443] netlink: 'syz.1.3359': attribute type 8 has an invalid length.
[  524.294327][T20471] SET target dimension over the limit!
[  524.385449][T20478] openvswitch: netlink: Flow actions may not be safe on all matching packets.
[  524.393983][T20478] netlink: 'syz.0.3372': attribute type 4 has an invalid length.
[  524.591289][T18947] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[  524.591309][T18947] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50
[  524.645813][ T5798] tipc: Node number set to 2886997007
[  524.730723][T20498] IPv6: sit1: Disabled Multicast RS
[  524.949887][T20504] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium
[  525.005018][T20510] netlink: 'syz.4.3381': attribute type 29 has an invalid length.
[  525.005064][T20510] __nla_validate_parse: 11 callbacks suppressed
[  525.005075][T20510] netlink: 20 bytes leftover after parsing attributes in process `syz.4.3381'.
[  525.180621][T20526] netlink: 36 bytes leftover after parsing attributes in process `syz.1.3384'.
[  525.379667][T20535] batman_adv: batadv0: Adding interface: veth0
[  525.379685][T20535] batman_adv: batadv0: The MTU of interface veth0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem.
[  525.379711][T20535] batman_adv: batadv0: Interface activated: veth0
[  525.384290][T20535] batman_adv: batadv0: Interface deactivated: batadv_slave_0
[  525.384311][T20535] batman_adv: batadv0: Removing interface: batadv_slave_0
[  525.444700][T20535] batman_adv: batadv0: Interface deactivated: batadv_slave_1
[  525.444722][T20535] batman_adv: batadv0: Removing interface: batadv_slave_1
[  525.478890][T20535] batman_adv: batadv0: Interface deactivated: veth0
[  525.478912][T20535] batman_adv: batadv0: Removing interface: veth0
[  525.543566][T20543] sctp: [Deprecated]: syz.5.3385 (pid 20543) Use of struct sctp_assoc_value in delayed_ack socket option.
[  525.543566][T20543] Use struct sctp_sack_info instead
[  525.624278][T20536] netlink: 8 bytes leftover after parsing attributes in process `syz.5.3385'.
[  525.625497][T20536] netlink: 76 bytes leftover after parsing attributes in process `syz.5.3385'.
[  525.665405][T20557] IPVS: sync thread started: state = BACKUP, mcast_ifn = xfrm0, syncid = 2, id = 0
[  525.766064][ T5628] Bluetooth: hci1: command 0x0405 tx timeout
[  526.259426][T20583] netlink: 48 bytes leftover after parsing attributes in process `syz.3.3400'.
[  526.260334][T20583] netlink: 48 bytes leftover after parsing attributes in process `syz.3.3400'.
[  526.267333][T20583] xt_IDLETIMER: timeout value is zero
[  527.133946][T20605] netlink: 'syz.3.3406': attribute type 1 has an invalid length.
[  527.133967][T20605] netlink: 248 bytes leftover after parsing attributes in process `syz.3.3406'.
[  527.282328][T20607] netlink: 12 bytes leftover after parsing attributes in process `syz.5.3407'.
[  527.500231][T20614] netlink: 36 bytes leftover after parsing attributes in process `syz.4.3409'.
[  527.640312][T20629] ip_tables: iptables: counters copy to user failed while replacing table
[  527.644247][ T5718] hid-generic 0005:0008:0009.0002: hidraw0: BLUETOOTH HID v0.03 Device [syz1] on aa:aa:aa:aa:aa:aa
[  527.673662][T20629] IPVS: set_ctl: invalid protocol: 58 172.30.0.4:20004
[  527.788070][T20631] netlink: 8 bytes leftover after parsing attributes in process `syz.0.3415'.
[  527.853089][T20639] netlink: 'syz.0.3415': attribute type 1 has an invalid length.
[  527.938351][T20638] fido_id[20638]: Failed to open report descriptor at '/sys/devices/virtual/bluetooth/hci1/hci1:200/report_descriptor': No such file or directory
[  528.072307][T20645] netlink: 'syz.3.3418': attribute type 83 has an invalid length.
[  528.197702][T20653] bridge_slave_0: left allmulticast mode
[  528.197737][T20653] bridge_slave_0: left promiscuous mode
[  528.197979][T20653] bridge0: port 1(bridge_slave_0) entered disabled state
[  528.226952][T20653] bridge_slave_1: left allmulticast mode
[  528.226975][T20653] bridge_slave_1: left promiscuous mode
[  528.227195][T20653] bridge0: port 2(bridge_slave_1) entered disabled state
[  528.257250][T20653] bond0: (slave bond_slave_0): Releasing backup interface
[  528.275139][T20653] bond0: (slave bond_slave_1): Releasing backup interface
[  528.286841][T20653] team0: Port device team_slave_0 removed
[  528.288071][T20653] team0: Port device team_slave_1 removed
[  528.288290][T20653] batman_adv: batadv0: Removing interface: batadv_slave_0
[  528.288857][T20653] batman_adv: batadv0: Removing interface: batadv_slave_1
[  528.289374][T20653] A link change request failed with some changes committed already. Interface hsr_slave_0 may have been left with an inconsistent configuration, please check.
[  528.713385][T20672] tc_dump_action: action bad kind
[  529.014532][T20680] ipvlan2: entered promiscuous mode
[  529.023272][T20680] team0: Device ipvlan2 failed to register rx_handler
[  529.337229][T18946] IPVS: starting estimator thread 0...
[  529.430101][T20700] IPVS: using max 41 ests per chain, 98400 per kthread
[  530.085414][T20728] __nla_validate_parse: 5 callbacks suppressed
[  530.085431][T20728] netlink: 148 bytes leftover after parsing attributes in process `syz.5.3434'.
[  530.179330][T20731] netlink: 48 bytes leftover after parsing attributes in process `syz.4.3436'.
[  530.382310][T20735] netlink: 8 bytes leftover after parsing attributes in process `syz.0.3437'.
[  530.382361][T20735] netlink: 4 bytes leftover after parsing attributes in process `syz.0.3437'.
[  530.409543][T20735] netlink: 24 bytes leftover after parsing attributes in process `syz.0.3437'.
[  530.761398][T20752] netlink: 20 bytes leftover after parsing attributes in process `syz.0.3441'.
[  530.907587][T20761] ip_tables: iptables: counters copy to user failed while replacing table
[  531.066671][T20764] netlink: 56 bytes leftover after parsing attributes in process `syz.1.3444'.
[  531.068395][T20764] netlink: 12 bytes leftover after parsing attributes in process `syz.1.3444'.
[  531.087548][T20766] netlink: 8 bytes leftover after parsing attributes in process `syz.4.3446'.
[  531.087569][T20766] netlink: 4 bytes leftover after parsing attributes in process `syz.4.3446'.
[  531.087593][T20766] netlink: 'syz.4.3446': attribute type 15 has an invalid length.
[  531.113355][T20766] netlink: 'syz.4.3446': attribute type 15 has an invalid length.
[  531.125900][T18950] netdevsim netdevsim4 netdevsim3: set [0, 0] type 1 family 0 port 256 - 0
[  531.125954][T18950] netdevsim netdevsim4 netdevsim2: set [0, 0] type 1 family 0 port 256 - 0
[  531.125991][T18950] netdevsim netdevsim4 netdevsim1: set [0, 0] type 1 family 0 port 256 - 0
[  531.126021][T18950] netdevsim netdevsim4 netdevsim0: set [0, 0] type 1 family 0 port 256 - 0
[  531.358586][    C1] vcan0: j1939_tp_rxtimer: 0xffff888033d34000: rx timeout, send abort
[  531.359185][    C1] vcan0: j1939_xtp_rx_abort_one: 0xffff888033d34000: 0x3ff02: (3) A timeout occurred and this is the connection abort to close the session.
[  531.557702][T20785] Bluetooth: hci0: invalid length 0, exp 2 for type 13
[  532.060506][T20801] openvswitch: netlink: Missing key (keys=c0, expected=20100)
[  532.149808][T10062] ip6_tunnel: ip6gretap1 xmit: Local address not yet configured!
[  532.211001][T20802] macvlan2: entered promiscuous mode
[  532.227867][T20802] bond0: entered promiscuous mode
[  532.227887][T20802] bond_slave_0: entered promiscuous mode
[  532.228123][T20802] bond_slave_1: entered promiscuous mode
[  532.240189][T20802] 8021q: adding VLAN 0 to HW filter on device macvlan2
[  532.259695][T20802] bond4: (slave macvlan2): making interface the new active one
[  532.273864][T20802] bond4: (slave macvlan2): Enslaving as an active interface with an up link
[  532.294021][T20798] macvlan3: entered promiscuous mode
[  532.294493][T20798] bond4: (slave macvlan3): Error -98 calling set_mac_address
[  532.336907][T20813] ip_tables: iptables: counters copy to user failed while replacing table
[  533.046366][T10062] ip6_tunnel: ip6gretap1 xmit: Local address not yet configured!
[  533.194674][T18945] ip6_tunnel: ip6gretap1 xmit: Local address not yet configured!
[  533.411603][T20839] 
[  533.413968][T20839] ======================================================
[  533.421012][T20839] WARNING: possible circular locking dependency detected
[  533.428080][T20839] syzkaller #0 Not tainted
[  533.432496][T20839] ------------------------------------------------------
[  533.439582][T20839] syz.3.3467/20839 is trying to acquire lock:
[  533.445650][T20839] ffff8880271b3418 (&q->elevator_lock){+.+.}-{4:4}, at: elevator_change+0x1af/0x480
[  533.455220][T20839] 
SYZFAIL: failed to recv rpc
fd=3 want=4 recv=0 n=0 (errno 9: Bad file descriptor)
[  533.455220][T20839] but task is already holding lock:
[  533.462586][T20839] ffff8880271b2ef0 (&q->q_usage_counter(io)#53){++++}-{0:0}, at: elevator_change+0x194/0x480
[  533.472814][T20839] 
[  533.472814][T20839] which lock already depends on the new lock.
[  533.472814][T20839] 
[  533.483219][T20839] 
[  533.483219][T20839] the existing dependency chain (in reverse order) is:
[  533.492241][T20839] 
[  533.492241][T20839] -> #6 (&q->q_usage_counter(io)#53){++++}-{0:0}:
[  533.500964][T20839]        blk_alloc_queue+0x544/0x690
[  533.506316][T20839]        __blk_mq_alloc_disk+0x194/0x390
[  533.512042][T20839]        nbd_dev_add+0x494/0xb60
[  533.513192][T20849] ip6_tables: ip6tables: counters copy to user failed while replacing table
[  533.525712][T20839]        nbd_init+0x168/0x1f0
[  533.530520][T20839]        do_one_initcall+0x250/0x870
[  533.535800][T20839]        do_initcall_level+0x10a/0x1a0
[  533.541329][T20839]        do_initcalls+0x59/0xa0
[  533.546167][T20839]        kernel_init_freeable+0x29d/0x3e0
[  533.551875][T20839]        kernel_init+0x22/0x1d0
[  533.556711][T20839]        ret_from_fork+0x514/0xb70
[  533.561825][T20839]        ret_from_fork_asm+0x1a/0x30
[  533.567100][T20839] 
[  533.567100][T20839] -> #5 (fs_reclaim){+.+.}-{0:0}:
[  533.574297][T20839]        fs_reclaim_acquire+0x71/0x100
[  533.579760][T20839]        __kmalloc_cache_node_noprof+0x66/0x620
[  533.585998][T20839]        create_worker+0x112/0x7c0
[  533.591126][T20839]        workqueue_prepare_cpu+0xe4/0x170
[  533.596836][T20839]        cpuhp_invoke_callback+0x434/0x810
[  533.602642][T20839]        _cpu_up+0x2ce/0x5b0
[  533.607227][T20839]        cpu_up+0x1d2/0x220
[  533.611722][T20839]        cpuhp_bringup_mask+0xb2/0x1a0
[  533.617273][T20839]        cpuhp_bringup_cpus_parallel+0x109/0x120
[  533.623606][T20839]        bringup_nonboot_cpus+0x17/0x30
[  533.629143][T20839]        smp_init+0x32/0x110
[  533.633778][T20839]        kernel_init_freeable+0x27f/0x3e0
[  533.639496][T20839]        kernel_init+0x22/0x1d0
[  533.644334][T20839]        ret_from_fork+0x514/0xb70
[  533.649438][T20839]        ret_from_fork_asm+0x1a/0x30
[  533.654725][T20839] 
[  533.654725][T20839] -> #4 (cpu_hotplug_lock){++++}-{0:0}:
[  533.662453][T20839]        cpus_read_lock+0x42/0x160
[  533.667556][T20839]        static_key_slow_inc+0x12/0x30
[  533.673025][T20839]        nbd_genl_reconnect_sock_cb+0x69a/0xbb0
[  533.679258][T20839]        nbd_genl_foreach_sock+0x265/0x450
[  533.685050][T20839]        nbd_genl_reconfigure+0xbbb/0x1040
[  533.690843][T20839]        genl_family_rcv_msg_doit+0x233/0x340
[  533.696997][T20839]        genl_rcv_msg+0x614/0x7a0
[  533.702011][T20839]        netlink_rcv_skb+0x226/0x4a0
[  533.707298][T20839]        genl_rcv+0x28/0x40
[  533.711793][T20839]        netlink_unicast+0x7bd/0x940
[  533.717121][T20839]        netlink_sendmsg+0x813/0xb40
[  533.722393][T20839]        sock_sendmsg_nosec+0x13a/0x180
[  533.727924][T20839]        ____sys_sendmsg+0x54e/0x850
[  533.733197][T20839]        ___sys_sendmsg+0x2a5/0x360
[  533.738385][T20839]        __x64_sys_sendmsg+0x1b1/0x290
[  533.743833][T20839]        do_syscall_64+0x166/0x520
[  533.748934][T20839]        entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  533.755330][T20839] 
[  533.755330][T20839] -> #3 (&nsock->tx_lock){+.+.}-{4:4}:
[  533.762959][T20839]        __mutex_lock+0x19d/0x1550
[  533.768063][T20839]        nbd_queue_rq+0x373/0xff0
[  533.773071][T20839]        blk_mq_dispatch_rq_list+0x499/0x1990
[  533.779124][T20839]        __blk_mq_sched_dispatch_requests+0xd36/0x1580
[  533.786023][T20839]        blk_mq_sched_dispatch_requests+0xd7/0x190
[  533.792527][T20839]        blk_mq_run_work_fn+0x16c/0x300
[  533.798078][T20839]        process_scheduled_works+0xc3d/0x1630
[  533.804149][T20839]        worker_thread+0xa47/0xfb0
[  533.809258][T20839]        kthread+0x38b/0x480
[  533.813840][T20839]        ret_from_fork+0x514/0xb70
[  533.818943][T20839]        ret_from_fork_asm+0x1a/0x30
[  533.824223][T20839] 
[  533.824223][T20839] -> #2 (&cmd->lock){+.+.}-{4:4}:
[  533.831420][T20839]        __mutex_lock+0x19d/0x1550
[  533.836528][T20839]        nbd_queue_rq+0xc1/0xff0
[  533.841468][T20839]        blk_mq_dispatch_rq_list+0x499/0x1990
[  533.847539][T20839]        __blk_mq_sched_dispatch_requests+0xd36/0x1580
[  533.854392][T20839]        blk_mq_sched_dispatch_requests+0xd7/0x190
[  533.860901][T20839]        blk_mq_run_work_fn+0x16c/0x300
[  533.866449][T20839]        process_scheduled_works+0xc3d/0x1630
[  533.872525][T20839]        worker_thread+0xa47/0xfb0
[  533.877637][T20839]        kthread+0x38b/0x480
[  533.882228][T20839]        ret_from_fork+0x514/0xb70
[  533.887358][T20839]        ret_from_fork_asm+0x1a/0x30
[  533.892649][T20839] 
[  533.892649][T20839] -> #1 (set->srcu){.+.+}-{0:0}:
[  533.899769][T20839]        __synchronize_srcu+0xc9/0x2f0
[  533.905221][T20839]        elevator_switch+0x1e8/0x7b0
[  533.910495][T20839]        elevator_change+0x2fa/0x480
[  533.915776][T20839]        elevator_set_default+0x375/0x440
[  533.921576][T20839]        blk_register_queue+0x3f3/0x4e0
[  533.927195][T20839]        __add_disk+0x6b8/0xdb0
[  533.932052][T20839]        add_disk_fwnode+0x100/0x3a0
[  533.937344][T20839]        nbd_dev_add+0x733/0xb60
[  533.942272][T20839]        nbd_init+0x168/0x1f0
[  533.946951][T20839]        do_one_initcall+0x250/0x870
[  533.952247][T20839]        do_initcall_level+0x10a/0x1a0
[  533.957709][T20839]        do_initcalls+0x59/0xa0
[  533.962558][T20839]        kernel_init_freeable+0x29d/0x3e0
[  533.968280][T20839]        kernel_init+0x22/0x1d0
[  533.973126][T20839]        ret_from_fork+0x514/0xb70
[  533.978232][T20839]        ret_from_fork_asm+0x1a/0x30
[  533.983516][T20839] 
[  533.983516][T20839] -> #0 (&q->elevator_lock){+.+.}-{4:4}:
[  533.991325][T20839]        __lock_acquire+0x164c/0x2de0
[  533.996720][T20839]        lock_acquire+0x115/0x350
[  534.001733][T20839]        __mutex_lock+0x19d/0x1550
[  534.006839][T20839]        elevator_change+0x1af/0x480
[  534.012108][T20839]        elevator_set_none+0xb5/0x140
[  534.017637][T20839]        blk_mq_update_nr_hw_queues+0x5ef/0x19f0
[  534.023957][T20839]        nbd_start_device+0x189/0xb30
[  534.029314][T20839]        nbd_genl_connect+0x167d/0x1cd0
[  534.034842][T20839]        genl_family_rcv_msg_doit+0x233/0x340
[  534.040898][T20839]        genl_rcv_msg+0x614/0x7a0
[  534.045999][T20839]        netlink_rcv_skb+0x226/0x4a0
[  534.051265][T20839]        genl_rcv+0x28/0x40
[  534.055755][T20839]        netlink_unicast+0x7bd/0x940
[  534.061040][T20839]        netlink_sendmsg+0x813/0xb40
[  534.066306][T20839]        sock_sendmsg_nosec+0x13a/0x180
[  534.071842][T20839]        ____sys_sendmsg+0x54e/0x850
[  534.077116][T20839]        ___sys_sendmsg+0x2a5/0x360
[  534.082305][T20839]        __x64_sys_sendmsg+0x1b1/0x290
[  534.087754][T20839]        do_syscall_64+0x166/0x520
[  534.092863][T20839]        entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  534.099281][T20839] 
[  534.099281][T20839] other info that might help us debug this:
[  534.099281][T20839] 
[  534.109498][T20839] Chain exists of:
[  534.109498][T20839]   &q->elevator_lock --> fs_reclaim --> &q->q_usage_counter(io)#53
[  534.109498][T20839] 
[  534.123231][T20839]  Possible unsafe locking scenario:
[  534.123231][T20839] 
[  534.130736][T20839]        CPU0                    CPU1
[  534.136101][T20839]        ----                    ----
[  534.141460][T20839]   lock(&q->q_usage_counter(io)#53);
[  534.146824][T20839]                                lock(fs_reclaim);
[  534.153309][T20839]                                lock(&q->q_usage_counter(io)#53);
[  534.161193][T20839]   lock(&q->elevator_lock);
[  534.165771][T20839] 
[  534.165771][T20839]  *** DEADLOCK ***
[  534.165771][T20839] 
[  534.173957][T20839] locks held by syz.3.3467/20839: 6, last CPU#1:
[  534.180314][T20839]  #0: ffffffff902c6228 (cb_lock){++++}-{4:4}, at: genl_rcv+0x19/0x40
[  534.188533][T20839]  #1: ffffffff902c6060 (genl_mutex){+.+.}-{4:4}, at: genl_rcv_msg+0x10b/0x7a0
[  534.197486][T20839]  #2: ffff88802719e1c0 (&set->update_nr_hwq_lock){++++}-{4:4}, at: blk_mq_update_nr_hw_queues+0xab/0x19f0
[  534.208872][T20839]  #3: ffff88802719e0d0 (&set->tag_list_lock){+.+.}-{4:4}, at: blk_mq_update_nr_hw_queues+0xbe/0x19f0
[  534.219818][T20839]  #4: ffff8880271b2ef0 (&q->q_usage_counter(io)#53){++++}-{0:0}, at: elevator_change+0x194/0x480
[  534.230421][T20839]  #5: ffff8880271b2f28 (&q->q_usage_counter(queue)#37){+.+.}-{0:0}, at: elevator_change+0x194/0x480
[  534.241289][T20839] 
[  534.241289][T20839] stack backtrace:
[  534.247169][T20839] CPU: 1 UID: 0 PID: 20839 Comm: syz.3.3467 Not tainted syzkaller #0 PREEMPT(full) 
[  534.256522][T20839] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026
[  534.266562][T20839] Call Trace:
[  534.269832][T20839]  <TASK>
[  534.272750][T20839]  dump_stack_lvl+0xe8/0x150
[  534.277337][T20839]  print_circular_bug+0x2e2/0x300
[  534.282353][T20839]  check_noncircular+0x12f/0x150
[  534.287286][T20839]  __lock_acquire+0x164c/0x2de0
[  534.292132][T20839]  lock_acquire+0x115/0x350
[  534.296622][T20839]  ? elevator_change+0x1af/0x480
[  534.301558][T20839]  __mutex_lock+0x19d/0x1550
[  534.306146][T20839]  ? elevator_change+0x1af/0x480
[  534.311070][T20839]  ? rcu_is_watching+0x16/0xb0
[  534.315824][T20839]  ? elevator_change+0x1af/0x480
[  534.320756][T20839]  ? __pfx___mutex_lock+0x10/0x10
[  534.325769][T20839]  ? enable_work+0x17f/0x230
[  534.330353][T20839]  ? lockdep_hardirqs_on+0x7b/0x110
[  534.335541][T20839]  ? __cancel_work_sync+0xf8/0x110
[  534.340655][T20839]  ? blk_mq_cancel_work_sync+0xa5/0xe0
[  534.346110][T20839]  elevator_change+0x1af/0x480
[  534.350873][T20839]  elevator_set_none+0xb5/0x140
[  534.355711][T20839]  ? __pfx_elevator_set_none+0x10/0x10
[  534.361163][T20839]  ? xa_load+0x1db/0x210
[  534.365401][T20839]  blk_mq_update_nr_hw_queues+0x5ef/0x19f0
[  534.371198][T20839]  ? kernfs_add_one+0xfc/0x6f0
[  534.375979][T20839]  ? nbd_start_device+0x17d/0xb30
[  534.380990][T20839]  ? __pfx_blk_mq_update_nr_hw_queues+0x10/0x10
[  534.387224][T20839]  ? sysfs_add_file_mode_ns+0x258/0x300
[  534.392761][T20839]  nbd_start_device+0x189/0xb30
[  534.397599][T20839]  ? device_create_file+0xf4/0x1b0
[  534.402763][T20839]  nbd_genl_connect+0x167d/0x1cd0
[  534.407778][T20839]  ? __pfx_nbd_genl_connect+0x10/0x10
[  534.413139][T20839]  ? rcu_is_watching+0x16/0xb0
[  534.417892][T20839]  ? __nla_parse+0x40/0x60
[  534.422300][T20839]  ? genl_family_rcv_msg_attrs_parse+0x265/0x2f0
[  534.428622][T20839]  genl_family_rcv_msg_doit+0x233/0x340
[  534.434166][T20839]  ? __pfx_genl_family_rcv_msg_doit+0x10/0x10
[  534.440226][T20839]  ? __lock_acquire+0x747/0x2de0
[  534.445156][T20839]  genl_rcv_msg+0x614/0x7a0
[  534.449652][T20839]  ? __pfx_genl_rcv_msg+0x10/0x10
[  534.454665][T20839]  ? __pfx_nbd_genl_connect+0x10/0x10
[  534.460025][T20839]  netlink_rcv_skb+0x226/0x4a0
[  534.464775][T20839]  ? __pfx_genl_rcv_msg+0x10/0x10
[  534.469789][T20839]  ? __pfx_netlink_rcv_skb+0x10/0x10
[  534.475061][T20839]  ? down_read+0x2be/0x330
[  534.479485][T20839]  genl_rcv+0x28/0x40
[  534.483473][T20839]  netlink_unicast+0x7bd/0x940
[  534.488263][T20839]  netlink_sendmsg+0x813/0xb40
[  534.493037][T20839]  ? __pfx_netlink_sendmsg+0x10/0x10
[  534.498342][T20839]  ? apparmor_socket_sendmsg+0x98/0x360
[  534.503883][T20839]  ? __pfx_netlink_sendmsg+0x10/0x10
[  534.509159][T20839]  sock_sendmsg_nosec+0x13a/0x180
[  534.514202][T20839]  ____sys_sendmsg+0x54e/0x850
[  534.519229][T20839]  ? __pfx_____sys_sendmsg+0x10/0x10
[  534.524518][T20839]  ? import_iovec+0x73/0xa0
[  534.529014][T20839]  ___sys_sendmsg+0x2a5/0x360
[  534.533683][T20839]  ? __lock_acquire+0x747/0x2de0
[  534.538611][T20839]  ? __pfx____sys_sendmsg+0x10/0x10
[  534.543802][T20839]  ? futex_wake+0x51b/0x5f0
[  534.548328][T20839]  ? __fget_files+0x2a/0x420
[  534.552909][T20839]  ? __fget_files+0x3a2/0x420
[  534.557576][T20839]  __x64_sys_sendmsg+0x1b1/0x290
[  534.562532][T20839]  ? __pfx___x64_sys_sendmsg+0x10/0x10
[  534.567990][T20839]  do_syscall_64+0x166/0x520
[  534.572585][T20839]  ? trace_irq_disable+0x3b/0x140
[  534.577630][T20839]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  534.583692][T20839]  ? clear_bhb_loop+0x70/0xc0
[  534.588357][T20839]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  534.594235][T20839] RIP: 0033:0x7fa49959e159
[  534.598637][T20839] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
[  534.618231][T20839] RSP: 002b:00007fa4977f6028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e
[  534.626632][T20839] RAX: ffffffffffffffda RBX: 00007fa499825fa0 RCX: 00007fa49959e159
[  534.634592][T20839] RDX: 000000000400400c RSI: 0000200000001ac0 RDI: 000000000000000b
[  534.642552][T20839] RBP: 00007fa49963506b R08: 0000000000000000 R09: 0000000000000000
[  534.650510][T20839] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
[  534.658464][T20839] R13: 00007fa499826038 R14: 00007fa499825fa0 R15: 00007ffddd2cbf38
[  534.666431][T20839]  </TASK>
[  534.745155][   T42] ip6_tunnel: ip6gretap1 xmit: Local address not yet configured!
[  534.745300][   T42] ip6_tunnel: ip6gretap1 xmit: Local address not yet configured!
[  534.921806][ T5625] block nbd4: Receive control failed (result -32)
[  534.921893][ T5625] block nbd4: Receive control failed (result -32)
[  535.289453][T10035] ip6_tunnel: ip6gretap1 xmit: Local address not yet configured!
[  535.443732][T18950] netdevsim netdevsim4 netdevsim3 (unregistering): unset [0, 0] type 1 family 0 port 256 - 0
[  535.443766][T18950] netdevsim netdevsim4 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[  535.482301][T18950] netdevsim netdevsim4 netdevsim2 (unregistering): unset [0, 0] type 1 family 0 port 256 - 0
[  535.482323][T18950] netdevsim netdevsim4 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[  535.530173][T18950] netdevsim netdevsim4 netdevsim1 (unregistering): unset [0, 0] type 1 family 0 port 256 - 0
[  535.530206][T18950] netdevsim netdevsim4 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[  535.570619][T18950] netdevsim netdevsim4 netdevsim0 (unregistering): unset [0, 0] type 1 family 0 port 256 - 0
[  535.570640][T18950] netdevsim netdevsim4 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[  535.635374][T18950] bridge_slave_1: left allmulticast mode
[  535.635398][T18950] bridge_slave_1: left promiscuous mode
[  535.635526][T18950] bridge0: port 2(bridge_slave_1) entered disabled state
[  535.658606][T18950] bridge_slave_0: left allmulticast mode
[  535.658627][T18950] bridge_slave_0: left promiscuous mode
[  535.658799][T18950] bridge0: port 1(bridge_slave_0) entered disabled state
[  535.740097][T18950] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface
[  535.741338][T18950] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface
[  535.742427][T18950] bond0 (unregistering): Released all slaves
[  535.970221][T18950] hsr_slave_0: left promiscuous mode
[  535.970633][T18950] hsr_slave_1: left promiscuous mode
[  535.973768][T18950] veth1_macvtap: left promiscuous mode
[  535.973792][T18950] veth0_macvtap: left promiscuous mode
[  535.973850][T18950] veth1_vlan: left promiscuous mode
[  535.973890][T18950] veth0_vlan: left promiscuous mode
[  536.112852][T18950] team0 (unregistering): Port device team_slave_1 removed
[  536.122897][T18950] team0 (unregistering): Port device team_slave_0 removed
[  536.168310][ T5285] 8021q: adding VLAN 0 to HW filter on device eth5
[  536.461444][ T5285] 8021q: adding VLAN 0 to HW filter on device eth6
[  536.652455][ T5285] 8021q: adding VLAN 0 to HW filter on device eth7
[  536.854871][ T5285] 8021q: adding VLAN 0 to HW filter on device eth8
[  537.205910][    C1] ip6_tunnel: ip6gretap3 xmit: Local address not yet configured!
[  538.645728][    C1] ip6_tunnel: ip6gretap1 xmit: Local address not yet configured!
[  539.356425][ T4990] udevd[4990]: worker [12804] /devices/virtual/block/nbd2 is taking a long time