last executing test programs: 5.720393132s ago: executing program 4 (id=3940): r0 = socket(0x1d, 0x2, 0x6) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000080)={'vcan0\x00', 0x0}) bind$can_j1939(r0, &(0x7f0000000380)={0x1d, r1, 0x1, {0x2, 0x0, 0x1}, 0xfd}, 0x18) bpf$PROG_LOAD(0x5, &(0x7f00000017c0)={0x1, 0xe, &(0x7f0000000dc0)=ANY=[@ANYBLOB="b7000000a5517f5fbfa30000000000000703000028feffff720af0fff8ffffff71a4f0ff00000000b7060000000000012e400300000000006506020001cd000071187c0000000000c3640000f10000007b0a00fe00000000850000002e00000079a00000000000009500000000000000023bc065b7a379d179fc9e94af69912435f1b6a693172e6191a12bebf9f9804ea033388cd15b65877ad4b200000000000000000beca090f32050e436fe275daf51efd601b6bf01c8e8b1abe4fef3bef7074815ae98743d1ace4c46631256dd19aed0d600c0b6199fe3ff3128e599b0eaebbdbd7359a48f5b0afc3996792043a6787bac46aa7aa400000000000069669622208266f896ba2c9e73c2efeec2dc565fbafb2cb63f5fef9ab79ff8abaa8a08f54a062107e9bb3e980fff675c8d3e91df6648a7a6aebcb63e0867b75690152af27711f0cbb9c06018d21bf3f87b8eb65323b4267a526d53442db8e48dbc5ce47d67d07441a7975d5e41b14fd0154a8246249952a8b61633ce068220defe09d3b1136af6d03e9cf996c13d1bfcdc54567a9ca80dec2e943fe4ae7c617cc071f7add70cfbd48f8f6b50fe6a8297d88efa73e7e601040000b4a685969f28902bdecf66ef39755de79ed2c711477febc96231a53984d00877301d0ec62427a8e38618fdd1ce9aaed569ebc5f2e58d6028e66139a737cc7146a131d47dcebb32ed67021d76e983223c998aec22242ae54e87f438d26982876b58f9134366952f7399a733f07138a736924f3709000000e97f0c117ec439c6b7b965752bbc06eced08d97a32ae4b1ad4d11c5b6f68ee841975233e4cea13f3ef04b2cab9cc256d4539dbafd888c7097c1169e0bebcc81ca3da40bf34b6c9c1da2d6ed8acaf2a8091820ff4cf6be74ddca8bf2eed0e11b2139e8c3ec95436af5269d5792decda7d8b5dcf8640b504ba23c6d0a7f67cdfd27328100ebf9319a56f0f9cee17deecf747f3493f1dc39551f4c9a40b3e93fa80b8234ccbf39a9ef09bd97321f0dc20956f44ba2c5ec2e7569b05cf4690ddc189f174046a8b214acf23f42fb51ed4819e6b4cb5a8bf2b559d0c198fe0315483b8beb9801d06c58b22dd713fe3b7ef18e21081aacfd091b754125a488cea18255f79bebcb3051f622f8a1d9af1908e88a58774a24f35a4ccdbedea6212286c23dd89c2b4b90647f17231472af8dda7f3ab20f093aad3ce875f7458039ee6d0a50deb7bc8eb393f056a5e7725531c5485278e0362338e2e2710fe00465e0d182a322091022cf5b814eeb9b3cab21196581e4d92d0b6fe5525285eea359274f1f21d69233bbe94941f10ba292100000000000000000000000000000000c18e93a0c5231779f2ee201e9fe7e63e84b57b5f05ecd278919bad330ffcb594b8255b3085b352ca9533d6c31c1a30158c30352f8a126a65cb6582e58aa641007418611df53a601c3a8fb8d2286e86abf98136f345446730f68f5d6d1817a9e1b09e5650d2599fbe719a45337d29eb3fef5f7f565457660dec6fe903a1c2ea4f40a8ea1c179892afa219fc69a44163f0d731de418e9fd82a8c4661caea674b19242d1840d047882f640ea248457288c5ffb63e857da03ff5c0475c3cfff41c4806f1dc750eb1c45ec3a2a0b064834010604d6f88a29e8e9bda2bc9c18d1b53a08f25d62ccaa46bc0235c830a7b3fe64bc6031b431bcad6b698a1ba6027870ea9e55fafbbf140c5f82a33ee4ac793b989c12a5827a7957f4d8136cf918b7cbf5bc5fc64c8001992536584586edded6f65bdd371ac84fd5cc60ab79b84e9e85a1c54d5666a5d133e95eff121621dff14b9de7a188b8c5387f9da63c2cce405bc44079e34e2db2b275bfbb54841d647338cad74be91144b780cf381a6860f641446ef73bd11d45f5e4df8f3c6440d8425fd7382225cf8c2cada01bf3cd5cbc6a403173e0c89a491c75efc3c21b7825a521c6011945eef94abc3000000000000000000000000000000d71b794e9b4c145caf050429937eef4364d9e1cbe9150bccd9b2e73757f1f5e8ac50736cd3cbc029ede2869642841371bb4b9c1aaa8826889a909e6716b60e4b568b6761f8ccc7d35b0e66357746b10fc481b47e67f1e14408c1ef3e018a5e647e3f607654f3bf82bcfb42be038a272d82f8362944f608b3810000000019fda0b1b607f1ab34194ed954973f7a5accc0938d3364ab07574d0b32fc30f3ab73d012b63ee905e98ab6989ec2c840cd216eb18fedfb3b204e94e170bae930660368d3799c9b1bf7556ac57164966791626f06ad2e332341965f72141ec140b80efd7720ccdaa890b79bc4523386bd66553121543c9a35b7adcf2f6b257fefef1d6e1da2ee94d3f822bf45aad21e5b5a3788ab584090664065af39b0f43968dcd7c5f8e5a8dc6298691423fbf7e8e012260bc62f9422434a547ef7ca37953d435098d9b71edd1a03e46d0ade465d0c0db0a51f9e29cac05e5a04f94e"], &(0x7f00000001c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', r1, @fallback, 0xffffffffffffffff, 0x8, &(0x7f0000000000)={0xfffffffd}, 0x8, 0x10, &(0x7f0000000000)={0x0, 0x0, 0x3}, 0x10}, 0x94) r2 = socket(0x10, 0x3, 0x0) unshare(0x20000400) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) syz_emit_ethernet(0x15e, &(0x7f00000003c0)=ANY=[@ANYBLOB="e33110495bfdaaaaaaaaaa0086dd60cb653e01283afffe800000000000000000000000000000ff020000000000000000000000000001890090780000000020010000000000000000000000000000fc01000000000000000000000000000004209597f429ae08a565c9a41d416c70a44d2e6f790a3872d50bb14d25344dc5b3a281f175f5ee04aab21301b94d966c72c15affff00000000000055101cf44d89d9f6ee47d77c0d4e53e34b67c542fc6f6f6c60139c43b78286f5bb8f4f11d164af24e2633a45bf4ed944b0ef6a7b7167f73cf54e78686ac09402659c29eb0ce380654c1bb0f61d255b1556b7a311096b7aab867396997ffab76abca01185b08d1e29ee14d8fe61245487104b1c5205c6adc794ba413b92d2d208b86f40983c4819c33b59c1abe2a4b0aa661fcb54e0855d6bb5dd267878ff59bcfc6079e7a5e0135118be22dc6c97e730f7053d6ec34ca11b5c7c3830af6b26868600f042ff"], 0x0) write$cgroup_pid(r4, 0x0, 0x0) recvmsg$unix(r3, &(0x7f0000000240)={0x0, 0x0, &(0x7f00000000c0)=[{&(0x7f0000000140)=""/79, 0xbdef}], 0x300, 0x0, 0x4a}, 0x0) unshare(0x22020600) r5 = socket$inet_sctp(0x2, 0x1, 0x84) r6 = socket$inet_sctp(0x2, 0x5, 0x84) setsockopt$IP_VS_SO_SET_ADD(r6, 0x0, 0x482, 0x0, 0x0) setsockopt$IP_VS_SO_SET_ADDDEST(r6, 0x0, 0x487, &(0x7f0000000000)={{0x84, @broadcast, 0x4e21, 0x3, 'fo\x00', 0x11, 0x3240, 0x37}, {@loopback, 0x4e23, 0x4, 0xc3, 0x12d5c, 0x12d5c}}, 0x44) setsockopt$IP_VS_SO_SET_DELDEST(r5, 0x0, 0x488, &(0x7f0000000280)={{0x84, @rand_addr=0x64010102, 0x4e20, 0x3, 'nq\x00', 0x1d, 0x2, 0x2a}, {@loopback, 0x4e23, 0x2000, 0xc24, 0x9, 0xfffffff9}}, 0x44) sendmsg$nl_generic(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000280)=ANY=[@ANYBLOB="18000000190001002abd7000f9dbdf251d0109000d00000000000000e4c0eeeb94131ca0c15bb72e91f360543fed99a7d5c22a0c0a07c2bf898a7fbb0c6bed2a625f842750e798b9b2351581d09027f8ae2040df2b3b46af30cf617a932bc6e39b2ca99f748ada300b88b145261e248f19a87a0f99bdb7ee9ce0c9fbecb7b1ea31162094355980bcf1303b69addeffa15fc7253ce06614aab9f263d9f7"], 0x18}, 0x1, 0x0, 0x0, 0x4}, 0x0) 5.450916323s ago: executing program 4 (id=3942): r0 = socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt(r0, 0x84, 0x7f, &(0x7f0000000080)="020000000d800000", 0x45) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040), 0x20702, 0x0) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r2, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000100)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x0) sendmsg$NFT_BATCH(r2, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f0000000300)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a44000000090a010400000000000000000a0000040900010073797a310000000008000540000000020900020073797a310000000008000a40000000010800034000000014480000000c0a010100000000000000000a0000060900020073797a31000000000900010073797a31000000001c0003801800008008000340000000020c0004260000000000000c7f14000000110001"], 0xb4}, 0x1, 0x0, 0x0, 0x4000850}, 0x40) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_MSG_GETSETELEM(r3, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000200)={0x2c, 0xd, 0xa, 0x301, 0x0, 0x0, {0xa, 0x0, 0x1}, [@NFTA_SET_ELEM_LIST_SET={0x9, 0x2, 'syz1\x00'}, @NFTA_SET_ELEM_LIST_TABLE={0x9, 0x1, 'syz1\x00'}]}, 0x2c}, 0x1, 0x0, 0x0, 0x24000801}, 0x8000) r4 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r4, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=ANY=[@ANYBLOB="240000001a0001000000ff7f00000000800000", @ANYRES32], 0x24}}, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000080)={'syzkaller0\x00', 0xca58c30f81b6079f}) r5 = socket$key(0xf, 0x3, 0x2) socket$isdn(0x22, 0x2, 0x21) close(0x3) sendmsg$key(r5, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000240)={0x2, 0xe, 0x3, 0x0, 0x10, 0x0, 0x8, 0x0, [@sadb_address={0x3, 0x5, 0x0, 0x0, 0x0, @in={0x2, 0x2, @local}}, @sadb_address={0x3, 0x6}, @sadb_x_policy={0x8, 0x12, 0x4, 0x2, 0x0, 0x0, 0x0, {0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @in6=@mcast2, @in6=@dev={0xfe, 0x80, '\x00', 0x1f}}}]}, 0x80}}, 0x0) r6 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040), 0x80400, 0x0) ioctl$TUNSETIFF(r6, 0x400454ca, &(0x7f0000000180)={'veth0_to_hsr\x00', 0x10}) r7 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r7, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000100)={&(0x7f00000001c0)=ANY=[], 0x40c}, 0x1, 0x0, 0x0, 0x20000000}, 0x800) r8 = openat$tun(0xffffffffffffff9c, &(0x7f00000000c0), 0xc7c02, 0x0) r9 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r9, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000000)=ANY=[@ANYBLOB="5800000010000100"/20, @ANYRES32=0x0, @ANYBLOB="00010000316f0600240012800b00010067656e657665000014000280080001000100000005000300000000001400030067656e65766531000000000000000000"], 0x58}}, 0x2000000) ioctl$TUNSETIFF(r8, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) ioctl$TUNSETQUEUE(r1, 0x400454d9, &(0x7f0000000780)={'pim6reg0\x00', 0x400}) write$cgroup_int(r1, &(0x7f00000000c0)=0xa7, 0x12) close(0xffffffffffffffff) ioctl$BTRFS_IOC_QGROUP_ASSIGN(r7, 0x40189429, &(0x7f0000000200)={0x1, 0x3, 0x6bb}) ioctl$NILFS_IOCTL_GET_BDESCS(r0, 0xc0186e87, &(0x7f0000000000)={&(0x7f0000000100)=[{0x3, 0x12200000, 0x5, 0xfff, 0x3ff}, {0x79ac, 0x2, 0x1, 0x6, 0x4}], 0x2, 0x28, 0x5, 0x101}) 5.023195881s ago: executing program 4 (id=3947): sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000100)=@delsa={0x48, 0x12, 0x1, 0x0, 0x0, {@in=@dev}, [@srcaddr={0x14, 0xd, @in6=@rand_addr=' \x01\x00'}, @mark={0xc}]}, 0x48}}, 0x0) bpf$MAP_DELETE_ELEM(0x3, &(0x7f0000000140)={0xffffffffffffffff, 0x0}, 0x20) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000340)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000100)=@newlink={0x3c, 0x10, 0x401, 0x0, 0x25dfdbfd, {0x0, 0x0, 0x0, 0x0, 0x190, 0x5230}, [@IFLA_LINKINFO={0x1c, 0x12, 0x0, 0x1, @bond={{0x9}, {0xc, 0x2, 0x0, 0x1, [@IFLA_BOND_AD_SELECT={0x5, 0x16, 0x1}]}}}]}, 0x3c}}, 0x0) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000100)=ANY=[@ANYBLOB="500000001000010400"/20, @ANYRES32=0x0, @ANYBLOB="0000000000008000280012800a00010076786c616e00000018"], 0x50}}, 0x0) r1 = socket(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000000)={'lo\x00', 0x0}) r4 = socket$nl_generic(0x10, 0x3, 0x10) r5 = socket$inet6_udp(0xa, 0x2, 0x0) ioctl$sock_ipv6_tunnel_SIOCADDTUNNEL(r5, 0x89f1, &(0x7f0000000140)={'ip6_vti0\x00', &(0x7f00000000c0)={'syztnl0\x00', r3, 0x29, 0x8, 0x3, 0x1, 0x20, @mcast1, @mcast2, 0x80, 0x1, 0xe, 0xf760}}) setsockopt$sock_int(r2, 0x1, 0x28, &(0x7f0000000180)=0x8, 0x4) bpf$BPF_PROG_DETACH(0x9, &(0x7f0000000880)={@cgroup, 0xffffffffffffffff, 0x1a, 0x4}, 0x20) r6 = syz_genetlink_get_family_id$wireguard(&(0x7f0000000600), 0xffffffffffffffff) sendmsg$WG_CMD_SET_DEVICE(r4, &(0x7f0000000540)={0x0, 0x0, &(0x7f0000000fc0)={&(0x7f00000007c0)=ANY=[@ANYBLOB="fc000000", @ANYRES16=r6, @ANYBLOB="0100000000000000000001000000140002007767310000000000000000000000000024000300a0cb879a47f5bc644c0e693fa6d031c74a1553b6e901b9ff2f518c78042fb542b00008807c0000805400098028000080060001000a0000001400020000000000000000000000000000000001050003000000000028000080060001000a00000014000200000000000000000000000000000000000500030001000000240001"], 0xfc}, 0x1, 0x0, 0x0, 0x4084}, 0x20000010) ioctl$F2FS_IOC_RELEASE_VOLATILE_WRITE(r4, 0xf504, 0x0) sendmsg$nl_route_sched(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000500)=@newqdisc={0x38, 0x24, 0xd0f, 0x70bd2b, 0x25dfdc00, {0x60, 0x0, 0x0, r3, {0x0, 0x9}, {0xffff, 0xffff}, {0x8, 0xe}}, [@qdisc_kind_options=@q_pfifo={{0xa}, {0x8}}]}, 0x38}, 0x1, 0x0, 0x0, 0x4000041}, 0x0) 4.66098723s ago: executing program 4 (id=3952): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x13, &(0x7f0000000000)=0x100000001, 0x4) setsockopt$inet6_tcp_TCP_MD5SIG(r0, 0x6, 0xe, &(0x7f0000000300)={@in6={{0xa, 0x4e24, 0x2, @ipv4={'\x00', '\xff\xff', @multicast1}, 0xcac2d78a}}, 0x0, 0x0, 0x43, 0x0, "eead00000000000000f46d7fb980e989db9e8bf9b93129488f651a8de213eb94cd46e19d9c65a018444a131f4da55a02ddbe2665dca1add0a80939a8ebf07cb417308a3d40aa1c788df600"}, 0xd8) setsockopt$sock_int(r0, 0x1, 0x7, &(0x7f0000000400)=0x3, 0x4) connect$inet6(r0, &(0x7f0000000540)={0xa, 0x0, 0x1, @ipv4={'\x00', '\xff\xff', @local}, 0x100}, 0x1c) setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r0, 0x6, 0x14, &(0x7f0000000040)=0x2, 0x4) r1 = socket$kcm(0x2a, 0x2, 0x0) sendmsg$kcm(r1, &(0x7f0000001f80)={&(0x7f0000001d00)=@qipcrtr={0x2a, 0xffffffffffffffff, 0xfffffffe}, 0x80, 0x0}, 0x0) recvmsg(r1, &(0x7f0000000540)={0x0, 0x0, 0x0}, 0x40002182) writev(r1, &(0x7f0000000480)=[{&(0x7f00000000c0)="6f2e1f", 0x3}], 0x1) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000001540)={&(0x7f0000000040)=@qipcrtr={0x2a, 0x1, 0x4000}, 0x80, 0x0}, 0x0) writev(r0, &(0x7f0000000080)=[{&(0x7f00000002c0)="ec", 0xfdef}], 0x1) setsockopt$inet6_IPV6_ADDRFORM(r0, 0x29, 0x1, &(0x7f00000000c0), 0x4) listen(0xffffffffffffffff, 0x8) sendmsg$inet_sctp(0xffffffffffffffff, &(0x7f0000001640)={&(0x7f00000001c0)=@in={0x2, 0x4e24, @local}, 0x10, &(0x7f0000000140)=[{&(0x7f00000007c0)="d44255f11303d1f805314bbb66540e0b57d64770b960f0e6e48b26c2aac2fc2f8ab24155fcd4eb3735de242099e236ed9e43bdb3a9fcd4c4a3645a87f6ea0963bb509a99438ce51e7dbcc6bce997a72d49295bb7bd19eaf983e0884b6addda4e6582571d6062932cbc4c2fa002c61e6bd09c8beb0b3abbb02d6a6a6df35adbbc38b84535160c3326b4e061a1b775a77bed449bbeaeb6", 0x96}, {&(0x7f0000000880)="2c8355a4a04fdec602053da9a5b4ce033a7dffe8adb4a88fd69ee804594458a8d880d68baa0d215c74f2030be0831a600d09a9f9e10c686880e1eb0b95c3a926aa520a2fab52e86885fee5a72b12b551f8f16cad697bba5844098a109ad70e8bcd28da718d75d14994a162d7c15e2eee4e1e89cd98d13fd02604b26000f165ba2d0376a5832e", 0x86}, {&(0x7f0000000940)="57c8af0719495bfb26207e8175732af3f6970bd6253c4d5bcf8c13200170ec62c2c0c76f79cdf4e21d0ef363c943a1fe7bd2a65ef8859ca80f002e62198d055f20148c970c226d9129562bda534a26476998ab2919650856d9a8eb93c1e4b5933e565b41da9781b52695539747182f7b8689045f09a98bafa550bda6019c3203e6313eb7da1a7efff4dc1cbab0b20e2322fd21356812a90862f86bce", 0x9c}, {&(0x7f0000000a00)="20ddd67c8aac64a3f8b1117a49fc7e836f66b8d37b591a9eb79a6f23e99d67a44aeab20df58d4276cf99217c2a8ed2885828431a91618bcc5cc57e8f8b50f2da0d54c53ca6cdc6c3f7138cb2ae6512f9c8bf92b439a22644b7c13193df4e2199dd072d9a2892b783cc89a03f1a77d3c9ec0e952f988bb5632897c9a31d45bcf60b6c3ab24a13502f9a57f33dc73973f035333a0126b9e47912e66a877bfa9d85f6f08fd67856feb6e86476543d6d70634dcfd9757d7ef1ad9354d4192809ddfd689d666c96614f432d76728a22815f287347e7522f057dfcdb3c1d7f5cfa0368c914", 0xe2}, {&(0x7f0000000b00)="7e8766526c8ee765d44ac68dbaa44b29b05dfa064a5eb9f70916356540825fb561245ed9a865be8939e70f6e0ce810383adace0d66a56b56053436c8a57dc507a10dfa005852e5cb648aac400999696073146ff9243ec2cb0955d48d95d2e9ce6065c64a5cae2c4334dfc878f5591e80fe759f44cd9f37c0cfc287ecccca72385402344d61ba13a048b6a27ac913c25dd1b861d6d6b84b9102df59c7d2b6c1414dddae549445321fd89e0000967cd48a589f1d5875c881b299820892980bfc6054a733979bb30259bacac38aa95090c8dd102cba5e0afa82269a0dbb157fe08fc6d9edd4b4d3558e9b", 0xe9}], 0x5, &(0x7f00000007c0)=ANY=[], 0x18}, 0x280400d5) bpf$PROG_LOAD(0x5, &(0x7f0000000440)={0x16, 0x6, &(0x7f0000000000)=@framed={{0xffffffb4, 0x0, 0x0, 0x0, 0x0, 0x61, 0x11, 0x92}, [@func={0x85, 0x0, 0x1, 0x0, 0x2}, @call={0x85, 0x0, 0x0, 0xa4}, @exit]}, 0x0, 0x2, 0xc3, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @flow_dissector}, 0x94) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x5) r2 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_int(r2, 0x107, 0xa, &(0x7f0000000080)=0x400002, 0x4) r3 = bpf$MAP_CREATE(0x100000000000000, &(0x7f0000000340)=@base={0xf, 0x4, 0x8, 0x2}, 0x50) bpf$BPF_PROG_DETACH(0x8, &(0x7f00000000c0)=ANY=[@ANYRES32=r3, @ANYBLOB='\a'], 0x10) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000700)={0x6, 0x4, &(0x7f0000000100)=@framed={{0x18, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, [@jmp={0x5, 0x1, 0x0, 0x2, 0xd, 0x0, 0x1d}]}, &(0x7f0000000240)='GPL\x00', 0x1, 0xa0, &(0x7f0000000580)=""/160, 0x40f00, 0x8, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, &(0x7f0000000500)={0x5, 0x2}, 0x8, 0x10, &(0x7f0000000640)={0x5, 0x9, 0x4, 0x800}, 0x10, 0x0, 0x0, 0x0, &(0x7f00000006c0)=[0xffffffffffffffff, r3], 0x0, 0x10, 0x2}, 0x94) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) close(0x4) syz_open_procfs$namespace(0x0, &(0x7f0000000200)='ns/pid\x00') unshare(0x6a040000) r4 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$inet6_udp_int(r4, 0x11, 0xa, &(0x7f0000000040)=0x8, 0x4) epoll_create1(0x80000) 3.873904117s ago: executing program 2 (id=3958): r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x1, 0x5, &(0x7f0000001100)=ANY=[@ANYBLOB="bf16000000000000b70700000100f0ff4070000000000000400000000000e1ff95000000000000002ba76bb3019c1341056bd8174b79603123751c4e345c652fbc1626cca2a2ad75806150ae0209e62751ee00aa19ce670d25010000020000040000009fc404000000c788b277beee1cbf9b0a4def23d410f6accd3641110bec4e90a6341965dac05c04683712a0b09ec39e9ef8f6e396ad200e011ea665c45a3449abe802f5ab3e89cf40b8580218ce740068720000074e468eea3fcfcf498278a315f5b87e1c26433a8acd715f5888b2007f00000000000000000100000000000000010015d60605000053350000000034a70c2ab40c7cf5691db43a5c00000000000000f030007ce2c6f800000000000000e75a89faff01218087560cce39bf405f1e846c1242000000000040cad326ad7add65873d9f87463ad6f7c2e8ee1a39244960b318778f2a047f6d5bef5d7d617da7a6520655a805608df4d431623c850af895abba14f6fbd7fb5e2a431ab9142f3a06d55740a43088696daaed74b9c5c29647d2f950a959cf050000008600a62e96b7cb8e52cbdc2ba9d580609e31c30879d6fce424c2208af6c3784a1975fa657de38a3a32e4fd67ce446adb431d07db79241aca1dd9ba02453bbb5ee8babe1745e645f091231b986e952afdac972f342c6f184777d05d988d6edc71df0100000013a38300cabf2b554380ad215c789bef4cc574109b8df8d9a9db669557b3809d8c396d2c0361629d1822f722ec23812770d72cd00100000078a75dea785be550dbb420287e0789b8c7044f563a1f68d4efe895fdbc463f747c08f4010586903500000000000000e800000000000000000000000000000000000000003ddf4aa4b1c8b8a0ae6fb5425f1d581961471cdb51f8940290e99ccff4123f955267fe4a75c11448741f064fc7ce7e62ee4df874e086287547d4099aeec9f1538ee25a2a5ccf4a9b604e88e12ff25184d4e3c6f7f623559435b2c505fb711300000000040000000000000000000000000000e67ccc02148a4fc43021cce9f24f4b2f9492c32e7a92a557ac2b44b84e88bbf7a49789906d923e4916f390ab7edcd3f5b9fe14446dd446a52131c464f2c08efb46d934615c8631b7c42efd029406000000433f5c899119ec0c0acef5385c5a2720caeb68f1e9c05b0591d89467ded84da092dea262e51811e2d7fa515722516bd5ef6c8c4966e5937562a5648a696ad3a042a7097ddefe0671a5767014b09ddbf69b78f977fb145890f5bf41ba92b8c4c8b14f0d4a880ef4518bb32879d326497e21e041254f06bd7f3a067e147e82e841dba3867da8bfbc101d3960e07d282f483e7b49991be06b950ccd48f4e49833f3c4a02bbd06c84680549f9eb16682ecb722e8ffaca907a3eaaebfc8e0a47c0076d7cc9d32b3cc96aa751d890881c3c33bd91f6ecf45ab3f12f816318346f9b883427b9190024edc1eddd68f34ce3bfedb5fe5d7beae4d3ca561e37570587783f9673e7ab17f5a09efc1114777d2707d2996961203aedff1c52108d9c0d51dc30209872ec602af42eb29d54a37be0fdfdcd74c2d859a566ee5c30677173a2592a4617ae08bec07422d52d2ba7271550a5c20e3a8d1c8c8fd3025ff00607b2249ae9a18391e01b21b36169790b8e96f7955754b6b01a75165d3573d1dec5cf1b08b6115b43203a5654cce2277eb4c02ef4817b4cb989ac178895810eff7b697f2dc9b308aa2460e3cb85cdc4833571a62bf310700000000000000cc7f923284230ada8c756096a66119d4b6b2f159585c3cf8e7bfdd619e294b1d21cd491b8cfd4a253856e485fe29c6ad177a9fb078ca905782b9ed3c30675b89a784bb8031cac0de95178a5acff029a0f0fe972df22b20afe95fba722056f94ab15f1cf605c33df627311f1b614684d77549"], &(0x7f0000000140)='GPL\x00'}, 0x48) (async) r2 = socket$kcm(0x11, 0x200000000000002, 0x300) setsockopt$sock_attach_bpf(r2, 0x1, 0x32, &(0x7f0000001f80)=r1, 0x4) bpf$MAP_CREATE_RINGBUF(0x0, 0x0, 0x0) (async, rerun: 64) r3 = socket$inet6_icmp(0xa, 0x2, 0x3a) (rerun: 64) setsockopt$IP6T_SO_SET_REPLACE(r3, 0x29, 0x40, &(0x7f0000000000)=@raw={'raw\x00', 0x3c1, 0x3, 0x4e0, 0x320, 0x18c, 0x203, 0x0, 0x19030000, 0x410, 0x2e0, 0x2e0, 0x410, 0x2e0, 0x7fffffe, 0x0, {[{{@uncond, 0x300, 0x2d8, 0x320, 0x0, {0x1000000}, [@common=@unspec=@bpf0={{0x230}, {0x13, [{}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {0x0, 0x0, 0x0, 0xe}, {}, {0x0, 0x0, 0x3}, {0x2}, {0x0, 0x0, 0x0, 0x3}, {0x0, 0x0, 0x0, 0x1}, {}, {}, {0x16}, {0x0, 0x0, 0x0, 0x200}, {}, {0x7}, {}, {0x0, 0x0, 0x0, 0x101}, {}, {}, {}, {}, {0x0, 0x0, 0x0, 0xfffffffc}, {}, {0xfffe}, {}, {0x0, 0x0, 0x0, 0x8000}, {}, {0x0, 0xfd}, {}, {0x7a04}, {}, {}, {}, {0x0, 0x20}, {}, {}, {0x0, 0x0, 0x0, 0x1}, {}, {0xb84, 0x0, 0x0, 0xf00}, {0x0, 0x1, 0x0, 0x3}, {}, {}, {}, {}, {0x0, 0x8}, {}, {}, {0x7ff}, {}, {}, {}, {}, {}, {0x0, 0x8, 0x20}, {}, {}, {0x4}]}}]}, @common=@unspec=@LED={0x48, 'LED\x00', 0x0, {'syz0\x00', 0x1, 0x1, {0x5}}}}, {{@uncond, 0x0, 0xa8, 0xf0}, @common=@unspec=@IDLETIMER={0x48, 'IDLETIMER\x00', 0x0, {0xb, 'syz1\x00', {0x6c8}}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x540) (async) sendmsg$nl_route_sched(0xffffffffffffffff, 0x0, 0x0) (async, rerun: 64) sendmsg$nl_route_sched(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000880)=@newtaction={0x14, 0x30, 0xffff}, 0x14}, 0x1, 0x0, 0x0, 0xd94ac76b42879f9f}, 0x0) (rerun: 64) 3.167809278s ago: executing program 2 (id=3963): mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.cpu/syz1\x00', 0x1ff) (async) r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r1 = openat$cgroup_procs(r0, &(0x7f00000002c0)='cgroup.procs\x00', 0x2, 0x0) (async) mmap(&(0x7f0000001000/0xc00000)=nil, 0xc00000, 0x2000004, 0x3b071, 0xffffffffffffffff, 0x0) (async) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000040)={'wlan1\x00', &(0x7f0000000080)=@ethtool_ringparam={0x11, 0x9c, 0x7b5, 0x0, 0x0, 0x7579e159, 0x0, 0xfffffdfc, 0xef4}}) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000000)='blkio.throttle.io_serviced_recursive\x00', 0x26e1, 0x0) r3 = syz_init_net_socket$bt_rfcomm(0x1f, 0x1, 0x3) connect$bt_rfcomm(r3, &(0x7f0000000040)={0x1f, @none, 0x1}, 0xa) (async, rerun: 64) getsockopt$sock_buf(r3, 0x1, 0x1c, &(0x7f0000000080)=""/187, &(0x7f0000000140)=0xbb) (async, rerun: 64) close(r2) (async) r4 = socket$nl_generic(0x10, 0x3, 0x10) r5 = socket$nl_generic(0x10, 0x3, 0x10) r6 = syz_genetlink_get_family_id$fou(&(0x7f00000061c0), r5) sendmsg$FOU_CMD_GET(r5, &(0x7f0000006300)={0x0, 0x0, &(0x7f00000062c0)={&(0x7f0000000240)=ANY=[@ANYBLOB=',\x00\x00\x00', @ANYRES16=r6, @ANYBLOB="01002abd7000fedbdf250300000008000b"], 0x2c}, 0x1, 0x0, 0x0, 0x200000c0}, 0x44490) r7 = socket$nl_route(0x10, 0x3, 0x0) (async) r8 = socket$inet6(0xa, 0x80003, 0x1) ioctl$sock_SIOCGIFINDEX(r8, 0x8933, &(0x7f0000000040)={'lo\x00', 0x0}) sendmsg$nl_route(r7, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000080)=@ipv4_newroute={0x2c, 0x1a, 0x1, 0x70bd24, 0x0, {0x2, 0x20, 0x14, 0x0, 0xfc, 0x2, 0x0, 0x7, 0x200}, [@RTA_IIF={0x8, 0x3, r9}, @RTA_DST={0x8, 0x1, @multicast1}]}, 0x2c}}, 0xea5bc50b6199d7fe) (async) sendmsg$FOU_CMD_GET(r4, &(0x7f0000000280)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x8000}, 0xc, &(0x7f0000000240)={&(0x7f0000000200)={0x40, r6, 0x400, 0x70bd2b, 0x25dfdbfc, {}, [@FOU_ATTR_PEER_V6={0x14, 0x9, @ipv4={'\x00', '\xff\xff', @multicast1}}, @FOU_ATTR_PORT={0x6, 0x1, 0x4e20}, @FOU_ATTR_IFINDEX={0x8, 0xb, r9}, @FOU_ATTR_PORT={0x6, 0x1, 0x4e23}]}, 0x40}, 0x1, 0x0, 0x0, 0x24000000}, 0x800) (async, rerun: 64) ioctl$SIOCSIFHWADDR(r2, 0x8b26, &(0x7f0000000080)={'wlan1\x00', @random="000000f900"}) (async, rerun: 64) write$cgroup_pid(r1, &(0x7f00000000c0), 0x12) setsockopt$packet_rx_ring(r2, 0x107, 0x5, &(0x7f0000000180)=@req3={0x6, 0x3, 0x7, 0xff, 0x2, 0x2, 0x2}, 0x1c) (async, rerun: 64) pread64(r1, &(0x7f0000001840)=""/4096, 0x1000, 0x1) (rerun: 64) 3.058925566s ago: executing program 3 (id=3965): r0 = bpf$ITER_CREATE(0xb, &(0x7f0000000100), 0x0) close(r0) syz_open_procfs$namespace(0xffffffffffffffff, &(0x7f0000000300)='ns/net\x00') r1 = bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f00000003c0)=@bpf_lsm={0x1e, 0x3, &(0x7f00000000c0)=ANY=[@ANYBLOB="1800000001000000000000000000000095"], &(0x7f0000000280)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x24}, 0x80) bpf$BPF_PROG_TEST_RUN(0x1c, &(0x7f00000005c0)={r1, 0x0, 0x24, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, 0xa) r2 = socket$kcm(0x10, 0x2, 0x4) socket$inet_icmp_raw(0x2, 0x3, 0x1) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x5) socketpair$nbd(0x1, 0x1, 0x0, 0x0) close(0x4) syz_open_procfs$namespace(0x0, &(0x7f00000004c0)='ns/pid_for_children\x00') unshare(0x6a040000) r3 = socket(0x8, 0x3, 0x0) syz_genetlink_get_family_id$nl802154(&(0x7f0000001000), 0xffffffffffffffff) sendmsg$NL802154_CMD_GET_WPAN_PHY(0xffffffffffffffff, 0x0, 0x4000) ioctl$IMGETCOUNT(r3, 0x40106183, 0x0) r4 = bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f00000003c0)=@bpf_lsm={0x1e, 0x3, &(0x7f00000000c0)=ANY=[], &(0x7f0000000280)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x24}, 0x94) bpf$BPF_PROG_TEST_RUN(0x1c, &(0x7f00000005c0)={r4, 0x0, 0x24, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, 0xa) r5 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r6 = bpf$MAP_CREATE(0x100000000000000, 0x0, 0x0) r7 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_MSG_GETOBJ(r7, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x44891}, 0x44) r8 = syz_open_procfs$namespace(0x0, &(0x7f0000000200)='ns/pid_for_children\x00') ioctl$BTRFS_IOC_START_SYNC(r5, 0x80089418, &(0x7f00000002c0)=0x0) ioctl$BTRFS_IOC_BALANCE_PROGRESS(r7, 0x84009422, &(0x7f0000001e00)={0x0, 0x0, {0x0, @struct, 0x0}, {0x0, @usage, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @struct}}) ioctl$BTRFS_IOC_SUBVOL_CREATE_V2(r8, 0x50009418, &(0x7f0000000e00)={{r6}, r9, 0x2, @inherit={0x60, &(0x7f0000000300)={0x0, 0x3, 0x1, 0x7485, {0x20, 0x0, 0x9, 0x1, 0xddbc}, [0x7, 0x8c76, 0xb]}}, @devid=r10}) ioctl$BTRFS_IOC_SCRUB_PROGRESS(r2, 0xc400941d, &(0x7f0000000640)={r10, 0x8, 0x6}) sendmsg$inet(r2, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f00000000c0)="5c00000012006b000040017ea608601602f3650400010008000000000002009ee517c356a7b0251e616859ad3a78a76e807c857e21bea297bff435cf01c937e786a6d0bdc7fcf50e4509c5cc68b7ed9c232d786c3500000000000074", 0x5c}], 0x1, 0x0, 0x0, 0x1f00c00e}, 0x0) 2.999752786s ago: executing program 1 (id=3966): r0 = socket(0xa, 0x5, 0x0) setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(r0, 0x84, 0x64, &(0x7f0000000080)=[@in6={0xa, 0x4e24, 0xf1, @loopback, 0x19f49a9}], 0x1c) sendmsg$inet_sctp(r0, &(0x7f00000000c0)={&(0x7f0000000000)=@in6={0xa, 0x4e24, 0xff, @loopback, 0x5}, 0x1c, &(0x7f0000000140)=[{&(0x7f0000000100)="e6", 0x1a000}], 0x1, &(0x7f0000000240)=ANY=[@ANYBLOB="18000000000000008400400007000000ac1414aa00000000300000000000000084000000010000000100050001000000050000000900000001000080050000007b000000", @ANYRES32, @ANYBLOB="20000000000000008400000008000000000000000000ff"], 0x68, 0x4000094}, 0x24000052) getsockopt$inet6_IPV6_FLOWLABEL_MGR(0xffffffffffffffff, 0x29, 0x20, &(0x7f0000000100)={@dev, 0x0, 0x1, 0x0, 0xa}, 0x0) r1 = socket(0x2b, 0x80801, 0x1) setsockopt$inet6_mtu(r1, 0x29, 0x17, &(0x7f0000000040)=0x5, 0x4) r2 = syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x3) ioctl$FS_IOC_GETFSLABEL(r2, 0x400452c8, &(0x7f0000000100)) unshare(0x24020400) setsockopt$netrom_NETROM_N2(0xffffffffffffffff, 0x103, 0x3, 0x0, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) ioctl$OCFS2_IOC_RESVSP(r3, 0x40305828, &(0x7f0000000040)={0x0, 0x2, 0x8, 0x1, 0x1616, 0xb70b}) sendmsg$nl_route(r3, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000100)=@ipv6_newroute={0x3c, 0x18, 0xffffffffffffffff, 0x0, 0x0, {0xa, 0x0, 0x10, 0x0, 0xfd, 0x0, 0xc8, 0x7}, [@RTA_GATEWAY={0x14, 0x5, @private0}, @RTA_MULTIPATH={0xc, 0x9, {0x8, 0x10, 0x80}}]}, 0x3c}, 0x1, 0x0, 0x0, 0x2048800}, 0x0) r4 = socket$inet6_mptcp(0xa, 0x1, 0x106) setsockopt$inet6_int(r4, 0x29, 0x49, 0x0, 0x0) getsockopt$inet6_opts(r4, 0x29, 0x0, &(0x7f0000000300)=""/161, &(0x7f0000000200)=0xa1) 2.999190977s ago: executing program 0 (id=3967): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000480)={{0x14}, [@NFT_MSG_NEWTABLE={0x20, 0x0, 0xa, 0x5, 0x0, 0x0, {0x1}, [@NFTA_TABLE_NAME={0x9, 0x1, 'syz0\x00'}]}, @NFT_MSG_NEWCHAIN={0x2c, 0x3, 0xa, 0x201, 0x0, 0x0, {0x1}, [@NFTA_CHAIN_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_CHAIN_NAME={0x9, 0x3, 'syz1\x00'}]}, @NFT_MSG_NEWRULE={0x4c, 0x6, 0xa, 0x401, 0x0, 0x0, {0x1}, [@NFTA_RULE_CHAIN_ID={0x8}, @NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_RULE_EXPRESSIONS={0x24, 0x4, 0x0, 0x1, [{0x20, 0x1, 0x0, 0x1, @ct={{0x7}, @val={0x14, 0x2, 0x0, 0x1, [@NFTA_CT_DREG={0x8, 0x1, 0x1, 0x0, 0xf}, @NFTA_CT_KEY={0x8, 0x2, 0x1, 0x0, 0x3}]}}}]}]}], {0x14}}, 0xc0}}, 0x0) setsockopt$netlink_NETLINK_RX_RING(r0, 0x10e, 0x6, &(0x7f0000000540)={0x401, 0xffff8001, 0x0, 0x5}, 0x10) sendmsg$inet(0xffffffffffffffff, &(0x7f0000001180)={0x0, 0x0, &(0x7f0000001080)=[{&(0x7f0000000040)="a72d11a15c048c0a7d63aebc5cea1f815108f6091475aeec600831aa9d3944e60bc2ad06a619c560aa0118b28f68f1eb14549d633b4b23f179fb680716faa43414787559be90843c35ab30acad8a6740140e00721abc2eb362f7bde53b3c992d3e28ccc20ec84fdc569947047f6c09a647ee8c0a747b951e66c068ccf1af93ee9e6f9528ff79e2f989383b05a690a6bec4634b867c9446c1c644b3010e8a3514c6328323b4bbdd602b8f0dace6aea70902c4ddd2a2f2810f1348b0d0df3c1e6a5938fcfdc87e7580c6be0c6a06eca62d6f787dd16add086a21391c4c707d8b61929d1252681b84c245e0efafe2e6e73ad86a3cf59235ab0eacbb414af92ec3cdac420a064a98e8cc18bdf63f8997f96436e0fe6f06fdbf47fff353b01a861babd4a38d126bfe3e29049e6cc883e6efae6e70ef9ed124b1b09887a58c991e223b6420dca5ae238027e91b17b1707dc5c0d5f59f0ca95614f1ea1d263c1ee54dfe31ae35eb3c8e3b931dff7920c57fbba89adf2e392c1ad719b90c7ade0d38ff9792934ef1fb12f51d8e2fad12486d5883d5b1a46696fad128c6805cfb25bc6487e1e407d6b266971b09d0d864a7a550284e24b6cdc9f4ae1081a638175dffef002c76ac5558d23e41edbe68f4b4950a13aa000326dae5a857603dc5a40d6c6618a98c7b6e1eebd325ea2c14601a25658965f40864fd015d9b2fff83ee5ed3212ebd9fa429f0140f633556ac07c0c08e67a1848c9942ecc47dd4ffede9a429e9e0472be7cdbcd117e621ddf745c00a814ffff0224634472577dc0b35a9c153409f1a2bddc193b20b4d244d9cbbd59816c46000c596865f58b4e640ed4a9ab6086cede697fb113560925498da83273e679e0e28b84961eb7b9c9b4fa916590965c76b48e5d453f27a821bd2bf0946ff2413ec30f7893d1f046e18f736c40ceda26dfc4a0a62f71a3606d3f72c0a858dfd7895e2572292e11af913c6b513a141d28e501ae7c49618d104aac9abb78466a636efb88120d0eef0a501558a5aa34784a9823f2802a0bcdf318f9b436b34b42a2a7cf513f80364ad9a699d2e23eb4f3a2bbce818bd20da61882b3dac699d05dc24f29b72471b712423ace6278c43df2be7a09e815517b86d8b3ce16af3d64a575958c5fd52aac53b391f3d2a67c24c6c13ec11428b61b80a6a58cbba1790a98d190a572070f63fc0b809669895ea9865c3066b06102f6f2c7171dc7f76e1931b3e4deb569ef9d07d5f86a848f50942e93c419c3a23489f14803b08182dfd48b8d4375be6b7", 0x394}], 0x1}, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x7, 0x3, &(0x7f00000001c0)=ANY=[@ANYBLOB="850000002a00000025000000000000009500000000000000afcd48d6493790710000000000080000b2c6161dba392176dd2963038e1d69ba7ea94c500dc4ef2fad96ed406f21caf5adcf920569c00cc1199684fa7c93836d9ea2cfb0e60436e05425cc4686b066707de94a4f4d5fc79c987d669f381faca0f9d9924be41a9169bdfaf16da915b2e249f21c6eee84309e7a23c19a394830f2539fcb4e0b6eab1aa7d55545a34effa077faa55c59e88254f54077f799bf168301000000bfb1c0e6b1244d35b213bda84cc172afcc2e47a7d8b85a5e3d77ac463920e231b7ae0da8616d2b7958f91f5da6c025d060ab186d94af98af1da2b5952eb15855933a212304e035f7a35dfc72c81256a55a25f8fe3b28d7e53c78fbb888b0255f347160ec83070000000000004015cf10453f6c0b973b81a484ebad04859d928365a7ea3fab2e4b380a00d72bc0480f94479757306720399379d9271cf555c14d56b51c2298237bebfc08e0d5976a942b844139f1111f2dc5e46ac1c60a9b030074bfbcd4b09012175484135f0e519f0b1e4aaa026d570ecb5e8cddbed65ff702000000a3ff4f8a4cf796b07a6ff61c5552417fd703f7f14d8b78a602ca3cdf6a662d8bc9c89c9120072a5d00dcdd8595356c9b2492aaf1264d4ef4a410c882834867bcd2b6e558d17879570c8ad943e392955f4f979ea13201bafe4f0f6ea508000000a0c548552b571bed5647323478a9968100000005"], 0x0, 0x5, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback=0x16, 0xffffffffffffffff, 0x8, 0x0, 0x9, 0x10, 0x0, 0xb}, 0x94) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) close(r2) recvmsg$unix(r1, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x0, &(0x7f00000003c0)=[@rights={{0x14, 0x1, 0x1, [0xffffffffffffffff]}}], 0x18}, 0x0) setsockopt$sock_attach_bpf(0xffffffffffffffff, 0x107, 0x12, &(0x7f00000008c0)=r3, 0x4) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000008c0)=ANY=[], 0x48}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f00000004c0)={&(0x7f0000000900)=@newqdisc={0x24, 0x24, 0xf1d, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, {0x0, 0x8}, {0xfff1, 0xffff}, {0x6}}}, 0x24}}, 0x4000800) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000280)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x10}, 0x0) bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f00000009c0)=ANY=[], 0x48) r4 = socket$vsock_stream(0x28, 0x1, 0x0) bind$vsock_stream(r4, &(0x7f0000000440), 0x10) listen(r4, 0x0) r5 = socket$vsock_stream(0x28, 0x1, 0x0) connect$vsock_stream(r5, &(0x7f0000000100)={0x28, 0x0, 0x0, @local}, 0x10) writev(r5, &(0x7f00000002c0)=[{&(0x7f0000000080)='?', 0x1}], 0x1) r6 = accept4$unix(r4, 0x0, 0x0, 0x0) recvmmsg(r6, &(0x7f0000001680)=[{{0x0, 0x0, &(0x7f0000003380)=[{&(0x7f0000000140)=""/120, 0x78}, {&(0x7f0000000040)=""/40, 0x28}, {&(0x7f0000003300)=""/107, 0x6b}], 0x3}}], 0x3fffffffffffed8, 0x2, 0x0) writev(r6, &(0x7f00000000c0)=[{&(0x7f00000001c0)="1c", 0x1}], 0x1) bpf$BPF_GET_PROG_INFO(0xf, &(0x7f00000007c0)={0xffffffffffffffff, 0xe0, &(0x7f00000006c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, ""/16, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000340)=[0x0], 0x0, 0x0, 0x75, 0x0, 0x0, 0x10, &(0x7f0000000400), &(0x7f0000000480), 0x8, 0xe7, 0x8, 0x0, 0x0}}, 0x10) syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x0) r8 = socket$kcm(0x10, 0x400000002, 0x0) setsockopt$packet_drop_memb(r3, 0x107, 0x2, &(0x7f0000000500)={r7, 0x1, 0x6, @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x2}}, 0x10) write$cgroup_subtree(r8, &(0x7f0000001a00)=ANY=[@ANYBLOB="13100000520091ef"], 0xfe33) recvmsg$kcm(r8, &(0x7f0000001340)={0x0, 0x0, 0x0}, 0x0) 2.72149861s ago: executing program 0 (id=3968): r0 = socket$nl_rdma(0x10, 0x3, 0x14) (async, rerun: 64) socket$packet(0x11, 0x3, 0x300) (rerun: 64) socket$netlink(0x10, 0x3, 0x4) (async, rerun: 32) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) (rerun: 32) socket$inet6_sctp(0xa, 0x5, 0x84) (async) write$cgroup_int(r1, 0x0, 0x0) (async, rerun: 32) socket(0x400000000010, 0x3, 0x0) (async, rerun: 32) socket$inet(0x2, 0x4000000000000001, 0x0) (async) socket$inet_icmp(0x2, 0x2, 0x1) (async, rerun: 32) socket(0x10, 0x3, 0x0) (async, rerun: 32) syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x0) (async) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) socket$packet(0x11, 0x2, 0x300) (async, rerun: 64) syz_genetlink_get_family_id$ethtool(0x0, 0xffffffffffffffff) (async, rerun: 64) r2 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f00000002c0)={'bridge_slave_0\x00', 0x0}) (async, rerun: 32) r4 = socket(0x10, 0x80002, 0x0) (rerun: 32) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, 0x0) (async) sendmsg$nl_route(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000280)=ANY=[@ANYBLOB="440000001100a7cc4a372eaf541d002007000000", @ANYRES32=r3, @ANYBLOB="00000000100000001c001a80080002802d00ff0008000200", @ANYRES16=r4, @ANYRES32=r4], 0x44}}, 0x2000800) (async) sendmsg$RDMA_NLDEV_CMD_PORT_GET(r0, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000000)={0x20, 0x1405, 0x1, 0x70bd26, 0x0, "", [{{0x8, 0x1, 0x1}, {0x8, 0x3, 0x3}}]}, 0x20}, 0x1, 0x0, 0x0, 0x1}, 0x0) 2.679820939s ago: executing program 1 (id=3969): socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) openat$tcp_mem(0xffffffffffffff9c, &(0x7f0000000000)='/proc/sys/net/ipv4/tcp_rmem\x00', 0x1, 0x0) poll(&(0x7f0000000000), 0x20000000000000b5, 0x9) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) setsockopt$SO_ATTACH_FILTER(r0, 0x1, 0x1a, &(0x7f0000000040)={0x2, &(0x7f0000000140)=[{0x20, 0xfd, 0x0, 0xfffff02c}, {0x6, 0x8, 0x4, 0x5}]}, 0x10) 2.483247428s ago: executing program 2 (id=3970): r0 = socket$kcm(0x2b, 0x1, 0x0) socket$kcm(0x2b, 0x1, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000700)=[{&(0x7f00000000c0)="6880a642beaf34317f0dd3122a90ad0d2b", 0x11}], 0x1}, 0x0) ioctl$ifreq_SIOCGIFINDEX_wireguard(r0, 0x8933, &(0x7f0000000040)={'wg2\x00'}) r1 = socket$kcm(0x10, 0x2, 0x4) sendmsg$inet(r1, &(0x7f0000000540)={0x0, 0xc027, &(0x7f0000000340)=[{&(0x7f00000000c0)="97eb000014006bcd9e", 0xeb97}], 0x1, 0x0, 0x0, 0x1f000000}, 0x600) recvmsg(r1, &(0x7f00000006c0)={0x0, 0x0, 0x0}, 0x2082) 2.482927176s ago: executing program 1 (id=3971): r0 = socket$inet(0x2, 0x3, 0x2) setsockopt$inet_int(r0, 0x0, 0xf, &(0x7f0000000040)=0x7, 0x4) r1 = socket$inet6(0x10, 0x2, 0x0) socket$isdn_base(0x22, 0x3, 0x0) socket$packet(0x11, 0x3, 0x300) bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="0900000004000000080000000d"], 0x48) r2 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[], 0x48) bpf$PROG_LOAD(0x5, &(0x7f0000000340)={0x11, 0x14, &(0x7f0000000280)=ANY=[@ANYBLOB="180000000000000000000000000000001801000020646c2100000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000083850000000400000018110000", @ANYRES32=r2, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) socket$nl_netfilter(0x10, 0x3, 0xc) r3 = socket$igmp6(0xa, 0x3, 0x2) getsockopt$IP6T_SO_GET_REVISION_MATCH(r3, 0x29, 0x44, &(0x7f0000000000)={'icmp6\x00'}, &(0x7f0000000040)=0x1e) sendmsg$nl_route_sched(0xffffffffffffffff, 0x0, 0x0) socket$netlink(0x10, 0x3, 0x0) r4 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="0e000000"], 0x48) r5 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x6, 0xc, &(0x7f00000001c0)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r4, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bc82000000000000a6020000f8ffffffb703000008000000cd03000000000000850000003300000095"], &(0x7f0000000180)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @xdp=0xedf0e51957efc755, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000080)={{r4}, &(0x7f0000000240), &(0x7f0000000380)=r5}, 0x20) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000000)={r5, 0x18000000000002a0, 0x5ee, 0x0, &(0x7f0000000580)="b9ff03076804268c989e14f088a8", 0x0, 0x500, 0x60000000, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x50) setsockopt$SO_ATTACH_FILTER(r1, 0x1, 0x1a, &(0x7f0000000040)={0x2, &(0x7f0000000000)=[{0x40, 0x55, 0x7, 0xfff00000}, {0x16, 0x0, 0x0, 0x40000000}]}, 0x10) sendto$inet6(r1, &(0x7f00000002c0)="1c0000001200050f0c1000000049b23e9b200a00080001c000000001", 0x1c, 0x408d6, 0x0, 0x0) bind$inet(r0, &(0x7f0000000000)={0x2, 0x0, @multicast1}, 0x10) 2.352590757s ago: executing program 4 (id=3972): sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000200)=ANY=[], 0xa0}}, 0x0) r0 = socket(0x10, 0x3, 0x0) sendmmsg(r0, &(0x7f0000000000), 0x4000000000001f2, 0x0) bind$bt_l2cap(r0, &(0x7f0000000800)={0x1f, 0x5, @none, 0x6, 0x1}, 0xe) getsockopt$inet_mreqn(r0, 0x0, 0x4b, &(0x7f0000000040)={@multicast2, @multicast1, 0x0}, &(0x7f0000000100)=0xc) r2 = syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0) r3 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$inet_IP_XFRM_POLICY(r3, 0x0, 0x11, &(0x7f00000002c0)={{{@in=@initdev={0xac, 0x1e, 0x1, 0x0}, @in6=@remote, 0x0, 0x0, 0x4e21, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0xee01}, {0x0, 0x0, 0x1, 0x0, 0x0, 0x1}}, {{@in=@rand_addr=0x64010102, 0xfffffffc, 0x33}, 0x0, @in6=@loopback, 0x0, 0x3, 0x0, 0xb9, 0x2, 0x8000000}}, 0xe8) setsockopt$inet_IP_XFRM_POLICY(r3, 0x0, 0x11, 0x0, 0x0) getsockopt$WPAN_SECURITY(r2, 0x0, 0x1, 0x0, &(0x7f0000000040)) sendmsg$sock(r0, &(0x7f00000007c0)={&(0x7f00000003c0)=@ll={0x11, 0x3, r1, 0x1, 0x8, 0x6, @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x1}}, 0x80, &(0x7f0000000140)=[{&(0x7f0000000440)="f2c38f3a0dc424c355324b762dfd2ba995b9fdf42375b1c14c1cc0d36456b9a92dcc0f47ad1512a7892ca26048ac28e7b9a6908c0aa244d626d92a96d1ec71ae94214d62601561f82da8698552229ae304d11de22e1bc4970930e683c69f67d910eefc580f92cf8354c3069ac8d22897bcfeb60059a3187f5c3f9bdf5dc4148c4982590d45ede2d7c5eb108597378d658f9dbb407e94b90e5d498ab058e6eed2e24ffe3a91f3b4fe1461c8c0b0448c4ed6bb761ee99a5a49c64900fd8384ba2be9fe655dad696dc35bbf954e58019734965e18a57a1078f1328ca5c0c667f94be1f9f581d57c7f349cc2271dc02396593de753d2cc2ff38a5cf925dc32e17c", 0xff}, {&(0x7f0000000540)="718b58e6b85b6d06a6f5edaa56ee8ef5a5e48340f581bbe99235392c49dd859aabadedbbb73340543fc66c554fc5368eead4ce6229a7a298583602743c961619e4566bde63b845f85a17f90c61c228c35dd9373f65638b0abf76cc9c10507200b8ccb6ecfdc92202beec5eab0dd9538158944992a0ed041d58deb787e5cb64dfc2eb270b7799c922560eb214ddbd", 0x8e}, {&(0x7f00000006c0)="51fe64524251aa4c391306847c67359a42d2767674e8947c32e82e9d0fe56ceb60b7bdfa1b7604f733cf374334396f088f4bc038809264d9752db40b07cf4e75ef02b9eeacd034215fb863fb", 0x4c}, {&(0x7f0000000740)="79093a769b680a59c8e53aa49105de248769808dfc7d2476039309bc017b4234820212379abc4d1befb419bd7b9f4d2e477e67cf6f3d9b4b2dd03b2e05651e6ce52720281e19f8b25acf57db3cf48c0761b7f313d224dd2f07d8d3ab8bb2a1aff9449a717545922105bd11572134ca2efa167d7fffa74de48ed9fb560c5485", 0x7f}], 0x4, &(0x7f0000000940)=[@timestamping={{0x14, 0x1, 0x25, 0xfffffff4}}, @timestamping={{0x14, 0x1, 0x25, 0x6}}], 0x30}, 0x4) r4 = socket(0x2, 0x80805, 0x0) getsockopt$inet_sctp_SCTP_RECONFIG_SUPPORTED(r4, 0x84, 0x75, &(0x7f00000000c0)={0x0, 0x2}, &(0x7f0000000140)=0x8) r5 = socket(0x10, 0x3, 0x0) close(0x3) r6 = syz_init_net_socket$netrom(0x6, 0x5, 0x0) connect$netrom(r6, &(0x7f0000000300)={{0x6, @rose, 0x1}, [@remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @null, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @default, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x2}, @default]}, 0x48) r7 = syz_init_net_socket$netrom(0x6, 0x5, 0x0) bind$netrom(r7, &(0x7f00000004c0)={{0x6, @rose, 0x1}, [@netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @null, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @default, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @null]}, 0x48) listen(r7, 0x80) accept$netrom(r7, 0x0, 0x0) writev(r5, &(0x7f00000008c0)=[{&(0x7f0000000040)="e62f26c3ac58544be3c0313d0ade858e958929f9f6539ec0a52baf4c09f2da1a1c3568712f8888afca94b145d84f4e93db86c4229879cce6eedf4fa0e79753c5095758bb927129329f4f0dae6e36ecddfc11075fc6b681081ebb8a8d92f48434c0af0d990415df6ab3552b4a100399", 0x6f}, {&(0x7f00000003c0)="d4ba91e948a4e75852579909e748141bba6164442e0e55e063629bb6772cd2a2c47eb12b17b67af340eeb4f63593c1f24ea610228096a08ca628a6d37d5d0d19590bd36c5d7d1d7d537b72eb2171737d06acb1378f2816dabe578aed9b16608f3dbf2a633b92385cb48e940bf8c1e46fa552b7638f92236e293e10f56ae944d5c887f2489a70c62decc0035e3e0102638774156611459ab10f04686433e6bb6ded2c286e500b6aaa33a668c54718d1b31f9b007f74943bfbe91a05fbe5b3719e846b6990bc61fe3a8be11a23976bab9cc8b98cf44276e39eeb1d9cdf4ab099499691b1aad044f7f831248af64f553f3b6234c3cd556203d3c9", 0xf9}, {&(0x7f0000000180)="4a606bc8077246fea2d2dcc1ce9e676baf59b1bd88cdb390e2ab20745c3d705932fa7d6df8ee8ecd3e022c6b9a7c30c7f66b8b50fe3923743d2b2c137f1bbd27578530a0559fa149a1d9309479021677998b1bbdf2233e3de2ec61d381eabb81542f6bab260b79485398e6f247544c0e", 0x70}, {&(0x7f0000000540)="5b34c206a6a9c17e83c9c59f0f7fd3b420ba57154024d39359b145483685449048284e59e38db20b51da5e249aab48c640c7ede259f667bfc53e8879acb311e9c926bf92d06438d3b01852e580b4661b09c6726100c996515ffc4d0890cef196ad5a09f78820c5bc12c9a6a3ea4e147d06c4497998576f284d654f30dfc00d42ea05f6b40429363c030f84e4df68345888628dfb8eb31fd23b898a6795d33936fbcead6d668d06a7edb5ff8be076df20478077d18a6f1543d4c41e3c52d5288b60b800de513a1a09b21ca4f37c93b0c4f0a57d5ce6b7a112", 0xd8}, {&(0x7f0000000240)="17353e3a59b481b3552e5bdf8906b0520d84f07784", 0x15}, {0x0}], 0x6) sendmsg$nl_route(r5, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000000)={0x0}}, 0x0) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000300)={0x6, 0x1c, &(0x7f0000000680)=ANY=[@ANYBLOB="1800000002000000000000000000000095"], 0x0}, 0x94) r8 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r8, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a2800000000"], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x0) sendmsg$NFT_BATCH(r8, 0x0, 0x40) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000200)={0x6, 0x3, &(0x7f0000000680)=ANY=[], &(0x7f00000002c0)='syzkaller\x00'}, 0x94) write$cgroup_subtree(0xffffffffffffffff, &(0x7f0000000000)=ANY=[@ANYBLOB="8fedcb7902009875f37538e486dd6317ce62667f2c00fe80000000000000875a65969ff57b00"/49], 0xfdef) ioctl$sock_netrom_SIOCDELRT(r7, 0x890c, &(0x7f0000000840)={0x0, @bcast, @netrom={'nr', 0x0}, 0x2, 'syz1\x00', @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, 0x9, 0x3, [@rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @null, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x2}, @null, @null]}) 2.324189626s ago: executing program 2 (id=3973): r0 = epoll_create1(0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f00000004c0)=@file={0x1, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) epoll_pwait(r0, &(0x7f0000000140)=[{}], 0x1, 0x2d516fb6, 0x0, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = epoll_create1(0x0) epoll_ctl$EPOLL_CTL_ADD(r0, 0x1, r2, &(0x7f0000000100)={0x20000014}) epoll_wait(r0, &(0x7f0000000040)=[{}], 0x1, 0x400) r4 = socket$inet6_sctp(0xa, 0x5, 0x84) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r4, 0x84, 0x6f, &(0x7f0000000040)={0x0, 0x0, 0x0}, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000140)={0x1f, 0x10, &(0x7f0000000880)=ANY=[@ANYBLOB="180000000000008000000000aec8000018110000a75b42d663c05d76ec44a00a3527c224bd3c481f8ad7a00583327ab941169240f7d1e733908d51e05d348cc024162ac1122178df120d058a393c4d57e1f9b3a12bcf2f540e1e56b85fb86b7fd4bd7ad4ea0ceb2157091ffd11889e15c672bf08e597475a3bf7d4f018e949aa9bb3b8b5", @ANYRES32], &(0x7f0000000840)='syzkaller\x00', 0x0, 0x0, 0x0, 0x41100, 0x38, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffff}, 0x94) r5 = socket$inet6_sctp(0xa, 0x5, 0x84) getsockopt$inet_sctp6_SCTP_GET_ASSOC_ID_LIST(r5, 0x84, 0x1d, &(0x7f0000000140)={0x1, [0x0]}, &(0x7f0000000240)=0x8) setsockopt$inet_sctp6_SCTP_PEER_ADDR_THLDS(r5, 0x84, 0x1f, &(0x7f0000000b40)={r6, @in={{0x2, 0x4e21, @empty}}, 0x0, 0xb92}, 0x90) unshare(0x2c020400) clock_gettime(0x0, 0x0) r7 = socket$inet6(0xa, 0x1, 0x8010800000000084) sendmmsg$inet6(r7, &(0x7f0000000300)=[{{&(0x7f0000000080)={0xa, 0x0, 0x0, @private0}, 0x1c, &(0x7f0000000600)=[{&(0x7f00000000c0)='/', 0x1}], 0x1}}, {{&(0x7f0000000400)={0xa, 0x201, 0x0, @private0}, 0x1c, &(0x7f00000002c0)=[{&(0x7f0000000d00)='[', 0x1}], 0x1}}], 0x2, 0x4008040) pselect6(0x40, &(0x7f0000000440)={0xa, 0x80000001, 0x2, 0x10000000000006, 0x12, 0x8, 0x80000000, 0x8}, 0x0, 0x0, 0x0, 0x0) setsockopt$inet6_tcp_TCP_CONGESTION(0xffffffffffffffff, 0x6, 0xd, &(0x7f0000000180)='cubic', 0x9) socket$nl_route(0x10, 0x3, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000600)={0x18, 0x3, &(0x7f00000001c0)=ANY=[@ANYRESDEC=r0], &(0x7f0000000480)='GPL\x00', 0x0, 0x0, 0x0, 0x41000}, 0x94) socket$netlink(0x10, 0x3, 0x8000000004) r8 = socket$netlink(0x10, 0x3, 0x0) r9 = socket(0x10, 0x803, 0x0) sendmsg$nl_route_sched(r9, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000380)={0x0, 0x24}}, 0x0) getsockname$packet(r9, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x2ba) sendmsg$nl_route(r8, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000280)=ANY=[@ANYBLOB="3c0000001000850619fbb7c75150926b00000000", @ANYRESDEC=r3, @ANYBLOB="fe000000000000001c0012000c000100626f6e64"], 0x3c}}, 0x0) socket(0x10, 0x803, 0x0) 2.155222982s ago: executing program 3 (id=3974): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000140)={0x60, 0x2, 0x6, 0x201, 0x0, 0x0, {}, [@IPSET_ATTR_REVISION={0x5}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz0\x00'}, @IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_FAMILY={0x5, 0x5, 0xa}, @IPSET_ATTR_DATA={0x14, 0x7, 0x0, 0x1, [@IPSET_ATTR_CADT_FLAGS={0x8, 0x11}, @IPSET_ATTR_BUCKETSIZE={0x5, 0x15, 0x6}]}, @IPSET_ATTR_TYPENAME={0x14, 0x3, 'hash:ip,port,ip\x00'}]}, 0x60}}, 0x0) r1 = bpf$MAP_CREATE(0x0, &(0x7f00000004c0)=ANY=[@ANYBLOB="12000000040000000400000008"], 0x48) r2 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x16, 0xd, &(0x7f0000000f80)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r1, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b7040000000000008500000003000000850000000700000095"], &(0x7f0000000340)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x3, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r3 = socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$ETHTOOL_MSG_WOL_SET(r3, &(0x7f0000000180)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f0000000080)={&(0x7f0000001000)={0x1320, r4, 0x0, 0x70bd27, 0x25dfdbfb, {}, [@ETHTOOL_A_WOL_SOPASS={0xb6, 0x3, "1c447ec89692b27f307d686d1203a8ba30a794adce49db87c94a1ee6b46aa843e14cace1545801a418a1f0bb660bb96ca2414aa633211d5552bc4cc70df47511b7d548296ff0c2ad9015f7eff53b99c2ce063debe58c10d211a0122de7468e9e2a9155c3e8f340976e44904c62fe766a169e28d114a4a8615bf0e6a6c11f2873045c6a90be84fb2b57ce08a820f2fb7581f23fd9436217ce8cfabfe9aa13b866ebff44e45ced8881caaf2d8c5bdb31e3f794"}, @ETHTOOL_A_WOL_SOPASS={0x5f, 0x3, "8d5c66678bac3f7eb57e84a1ba3477d233f820150f634bbd7cd0889523df9bb45d8ca6c34cfe87ebe00bbbcc20d03f216e42d31c405f41a74486f8b576e123270189e2b17e8a6aedb8a2058a7f6c167916dc9fbbbe9b84561c6549"}, @ETHTOOL_A_WOL_SOPASS={0x2a, 0x3, "3c40c1b1dc6107b3df4fd24f60fca4b63d20e239e5caf5aaa95b7b0ae7e2a837a6dd9636017a"}, @ETHTOOL_A_WOL_SOPASS={0x1004, 0x3, "b0363b6cbd558660909d5bab00565d5863fcdb39bc176ad7c38213801126b873d33fa08374cd09f20d2f1b42828d621574cc92eec0f548336671a36d399a9a642edcf5a4b63002278188f262d96e8d0a4a1db6fd763e7b7dd3d1c216ae9cc2d52714f342aa2ce5d65db096e83cabb2d6adc4715a49bcf47c883547797dda65138f62b33e19b90beb163cf26d1f8fb228335a6a9b6564f07e3a3a2801a8bf26f4d965430307736772bbf51aadc87f50cb566c58d4b30e0e8e7dd38654d50d2390dc99728641d92b5c154008d7841cc97f692479a83346c45208396cbe2696c2390e0d38c2a360e0847eb09f4883b590f9723fc0d0aadfe8fdd42a42f8fca89f5cbcd4eddeb09d3cb4e382ecc1315f5fb4e81d6f3332678e08bd43baa02ac8edf00ae32c59a22a296d807eb2bb14bff5014f5b09eba25b82739b511168ee64e1bb1619e533de7b5b54edd314e4b8dfcebb81832eb2f17d3ef69d9240c7aa02dd7dcdf7adcbf46534b616969fc85499814fe6fa269455d7132b65fbda273e0094a5164533b5eb961ff2f2f34ce6a24eef09bcf1bda325c07a2b1489414fd7af4d37245fb139a30d84e37ab0bb1b418102890ba8f23ec3f11e7b2a22e11af1acdc3e53d7370701406ae9c060ca1a9e418454bb3826ceeda864d89c94f5875c26d6fef73b5872c84856279dc5b63c47bcbaa2d4c36ac46866acdf0b6991aa034fd5603993ad03a3c61f473f7b6ec8f0b11f807fe3d676c0611cc61fd13a8ec7bbdeccca62344cd2ed26298d145f20e927fbb8bc1109699a64dc06cf8831920ae60e55fef311460b8594673e90fbbac46a6ec99dbe518c1174b25dce491623a76b457ef1bcf0eb0777ddcf94f83d411e085a417aa9316ae25f3df8392a16b1ee0c0d558e867e9b625fc9215b813e5db4a1150872a833f3ab33ca8563956085813cb21de5b19573d427e8fbb406eb1abd65ba9854da5c28771e8a58b43cc769b803572a9effeb9c6aa8c77b2cc10b1ec5a4838903c53180c4f5bcf21f07da48f5035414b66e764088f9947b158e0215170f4e0a5861d7bdd6b9c79161c6c65efc6db0940718c67238d0d868d526175a2a541b2bcd91686111b2549c1ac5d044d61341fb19f16a174fecbe320728a9bfaa903b48f0440a689396402e63f9d286b6ac610ac5f4d3adc97be85ab76fd0b5489ae08194bfc4bc25f38369918188f76363c62b9e8b9c01294d2995e0ba0b478307202e9c61f02252957f9a134e99680a0bf96525a602d3950cccbd76ece52a70e40e5cb1987220f6e4d364726ce92dc1965c2c2257dc126f0788b759787a19654ff834a1146486f1121e858ef5ce961d9be3888f02a6518eabd5a1ee54051b0339523e25c49441737ed42c7706e8491e594999ce367b1c17e3e8afe56cee7d96e40d110574129c000224a80556ded9c5654672690a9a7acb5b9c41411ce207e0fef6bc3cf9578a63564c028ab641080606926f03049869a17c9c14fde5e06f855b68fc3340c057bfb4c45ac6fdaf05e5818f338448b6d2b0e9bedef419361942704e35cd30b93b13765af4c44919d4051dfb191542c26882453ac3e5004978a883e4460f74015d62461448671a48d20361d3ea90d1aec30f78bf0dae736e829006c4b6772f0f9d3871129c46a87eef117f390c50c3de7da58a4b11f56e26ad973060faea73e4ee86216456016f9b2284abcee9f091ff6bfdcfe1b27ecc36ec9f78dd5d31c16c88b0cca30ecb0405f427108fe1c4a360f6a03c9f2fadb5649dea3462bb4202292650e1694c4546f26fba4902f3c39be8e6c4e8fed9aff1719c3e80fd9b4dc533129956b4517e08869a0b382994bb2795c1322bd278c396d406ad8a8f953434855d5f5e6ebc1cd72dd573da6f1f6baa8148505430d9e9c812c715338be7955b068c8b777a1fa4ba783287f304564e94a3f10cebdf2f1bdba344282049c8ab7da4d41bd7e15588b545208cea7efe38798c514920781b7010daf3633ea9c42f9a39415950a7220681f9252ff11089ab4adcd91820cbc90b165dc68af100cecb157f047029f4dd937d658a115d5bfe8587740d3bafb644110cb71e2aa5da6b4be1b452017d6af501173440f798de0204349501947d891afbb12f75d8366c407936c457da74a1129b97e22634466084131f14982dd998c2c4c05f58bfb27da3072721d9f9e26e8ccf7d878e3722088d9ef317c1be6ef7a2a5842489d45d764e594f6908400757497facdff360f6245ecbaf519d40470e54280b55c4b980ec75937e47824b75fc3530c7a2d82c5ca6f4f230d5d1e727b9bc3c87c258317daf414fa51e064858ed6ae65ce4aa4abb8f4ccd43e64650b7ecde3b6925ca7cf4e7b23ff8d04c060d7b3f181f16bf74f2722d0de56cea2b182e9b3c3c9b3c967e26deba6486ef5073158f1325eb62e4850b15118e7d0249abecd9dedcf60e0df6a46a7287e4d7544ff81e5f5adfba80fe8f6a3cf9a4c4cbc08b1868709ac447bb4e553214d1cd73a719cfc279a040f51242bd0458b469e226859680c245795694414af8f70d9bba9230993260e2e4038d9c6e3507921fa8db94ec5805692606157f394e0a7bc88d617dc3a7aa784c99633f3af1ba460945e03605fee44aca27c3b26660f5d6a27eaa93539a1b7b0f0dbb73af107b650b6a4a4fab26a163e1592af7f3ba25426e289b7937c5c221ce905a126b69e46751311ad1b100bb639134d951c48152a145a4bf7309b6683e98a5ec13535dc04121a036e764082be72bf300da07891471f861a537d356b46f222f9ad475735d5593da2fa3306ab66914822d4eb692b56298d92b01758f23fd82f98cf5dce3fed92df8cd6b682e3a4d42f92ac2be04763afe1473e2919a6295c9b55745f9a00eedeaee3e7124e6203f2b32f5e10ed2835d2593d6041814e64d57d7b192c6d26c05494b70d741a6ea7e0c89ddf8e74fea59939d12d095038d4661bfe518846ee30c1045177c7875d720518206a4b871b511217de7f3d29de10a7e118748c686748e037b176d5713fa733ac28b5f7bd632555eedd9d61e29ae309b0362b795e6d2e600dd203e1ebbe94cf52b06a96cbbd2eda8588963515ddfaec48758381d73d3efe18cb3139c140b2cf7199161a7d1a4428d969c6c172cab04138799f4cc375ee659201a61735a190da09fdfdc241a91649decc899898d4e60b3d0127a1cfa79fbb350c6093cdeb4ed7a77e03e34d5b44adf3b730d838844f9c2356c57d0a471606516420e1ece359e2b48dc36ff5d27fd3e5d03ce8449d28224b13e0bf29c5085a6d17fafe2f50af55a4d7b1b054db7435a99438f379c85a4ff0a194835e1f4ae2554282b38069d518d1c0d3a4a983fb07fb85fe73ef215171564c5c3a810261ff348037d7395e25b601352d240bd930f4896abb19fb7f6df76c75ffa94826951fe3a82c52f2492d536b0839b06a0629a74625be4e6c83435e5596a419b2601dc33888f8f6235a8a9d5873abf981349756e8c2006aeb7901b3ab38d41712336afadd7e54892b8908c5d3d7f8daff17acd0ef5995227367be79dfbb24a450882e395b7bd799a45f0df958d21d6fc6e9cbfa072c4cfc0a51c4d93668a349bf416d5eb1622d815af6f70ecc21073e1e41669c20b4d1665d33e57cec61d51a95db3bad86d0134393bb3e60552fff59ea8ffe85fd2d2f43e05f38ceee64358ff0327e53b2704acbd71eac89e29cdd84dac1cf2c39836bac69a9b6706e56207db58862a9ebe2983ce5f31414a0a45d4952c6d4bb2c94c1c915ae23a3312a618a4acc3dd5ab96ded578a36026954c047497edbfdef110a18c9bc6bf3941bc8070ae9ad73df8cded359bde885b8ebfd23b35138235a1a7b622c433f26ba5dd000450da14df186f9781aa92acadec5120818a379959c86ae037141e82b90bff5157481d87bab2e34b70d10827013a4a41f0518f62a3b1f1b0fd779f3b567eec53f4ad05e7d4c538560e4ccd2146625c732063f37a46c87823904c0b383f886b7dcab3fcb6f8add6dc1707ee0def7aea2416c3bc151a7a0078bc1879c66b618cd1bf017a4b23825db0fd2f2f36d03cf25772db44e0620af348834026aacfe0a819d7cbe0c820805a65589fb39c7afe21c62650256c488a28caecda1e256f289153871e6b2141c32782e129c4f3c88ae2eab665cf01d769e48a489dd2e350d839df5283d2d0051183d431e660ef910a256129f4a9a2c2b3f741dc56fd5fde97dafa634d9702b6b5e98eff70f9fa03a0c2f10bed91de9e39c3799301188a1923dbfa78a81f577cf1e4bdd2804161fdc135bfbb6d61c4ddd06121a7f414668c97ee63f4507f429b2cbaf7d447f23c93da1ad5e529445cd0a6c5a341874e70cc7f36739553deee47b51d015f2944d11c0781467ce250dd965232f94f8eb657edaa9f8e84aee1e5708641aa1d0b26731f4d8efc98a8cd64425fcf59cb4ef3f86d48e03c16c4489391d43874a38a472576f0e7e62829228cf8d561c0b28c852088dcc34c5bf18bd2e3289d7c5e98088e8a8f27eb3e170ce11e6ef26b73306283d23cb062daf8d412c457b4a051573a5cd5fda5beaa14430f09888d303deb9ce14de72a9316b257439eb55c3427cf7b020082f5245d2a22423f5b77a2a49d949d2b2e025d4bd81b678a350898f236614f1f652840926667fe588da36159a93f8ab3ba51b65e4634afbdabcda6cd868c7fe54c7a199907e2a4f432e2ddbc184a6de260da1f36cf3e1375303e575dd433fc6d2dafc7fddced28b6b2a554257dbc0ddd1b68d88e9a7a1b90899da3da47a5c78227ec8fe0140185a772473f11bc468ce1fb9173999e90a2398aa5dda688603a6ac9bc00901a3e8f5c1a07d8c0bec276ade27ea29a24d02b3acfb188c8a09a64ab6300ea000816964ce3914994d86e73f00750e6ecb85230737c2fef9a926742c0d494234e1fe9461db7a037f088020a3d7e078d8a9aec638f63fdd5dfe18807ef7fad50f33c1eafcdb770390e45e4da2a91e67c32b84b641566ee58dc69816d181e08c8b30ae9f2d16ebf5136c529c21749348ac475367d0fec61e547ba88c084d91b8bbaf7f90763b4ed9a0dbad66b17c036dd57301aa95addc1d25eb6124e0eb561e5fcc89ddc5d38b9c158665e5d10392818600d346a2a9b7087e466dfa9cf12db1445f05f57ec01bb45a7febe326f609be0e06f56acb2526a2b8713f8ea570cd1869cddfb71490f2de754f4f93cb9a13d51646ef88644792b66f2058fde8e2f28eb94fb02767d6dc8f1077ef8781f3af19588e1ed872c9e9dbe54bb5b7db17ef3e98fba2ca48042d5eb2e8e9ad48ba110aaf786b37b1a563c43b237ad78fb25642fb6bd27e548e124b062551200e4b2cc09427f1ef1c85b33ded116c46f69527d24833fa969d307c251994eed63a9c880e3b1971dae4a861f10a86121ffbfcd07deaf177430058d1c9fd0e4abd6b7bf7c323e024b87bcbfe9156988bce6ee0ce49407897259f4d280666fe3433d7c1102adbe1830180155d1ac07b9a57db23879ca8ed7fb9cf7de0cca2113e1936420c9396a7a901cf3b9a878cc346e937ee98a24f8d3045adf95301643c171db4b211c0845daf160b177568bcb98e1565a69692b3e5197bf38e9dd40d4ae135cf9e707b7761f0692f01b119348bd468aa00bcad1a98a7784f963cdaf7a9b484d7952f29d88205c562f36207c639ec9059e47b1a0b536061f95222efcf284ae5b6b79c7fe5496d852b4fa79ed50fcb9bd73e59ccc0159155be569a4c8b73f9ab476ba3969dce"}, @ETHTOOL_A_WOL_MODES={0xc4, 0x2, 0x0, 0x1, [@ETHTOOL_A_BITSET_BITS={0x54, 0x3, 0x0, 0x1, [{0x24, 0x1, 0x0, 0x1, [@ETHTOOL_A_BITSET_BIT_INDEX={0x8, 0x1, 0x6}, @ETHTOOL_A_BITSET_BIT_NAME={0x7, 0x2, '@\x8a\x00'}, @ETHTOOL_A_BITSET_BIT_NAME={0x8, 0x2, '@#@\x00'}, @ETHTOOL_A_BITSET_BIT_INDEX={0x8, 0x1, 0xb}]}, {0x28, 0x1, 0x0, 0x1, [@ETHTOOL_A_BITSET_BIT_VALUE={0x4}, @ETHTOOL_A_BITSET_BIT_VALUE={0x4}, @ETHTOOL_A_BITSET_BIT_NAME={0xe, 0x2, '.*!(\xbc*)@[\x00'}, @ETHTOOL_A_BITSET_BIT_NAME={0x8, 0x2, 'GPL\x00'}, @ETHTOOL_A_BITSET_BIT_VALUE={0x4}]}, {0x4}]}, @ETHTOOL_A_BITSET_MASK={0x1a, 0x5, "79edc561f8080ad0718d0d3a74ea96b48aee219e5f19"}, @ETHTOOL_A_BITSET_MASK={0x2f, 0x5, "bc25aa961c1b7b457e27fc4fb5da7d566f294bb50c991f6efb5fb3becbb31002729e7638f54b363759f4a5"}, @ETHTOOL_A_BITSET_MASK={0x1d, 0x5, "5555d2d85616ccb72a6db99261fbdbc5a98c089210272532c8"}]}, @ETHTOOL_A_WOL_SOPASS={0xb, 0x3, "dfb716c5964d8f"}, @ETHTOOL_A_WOL_SOPASS={0xf2, 0x3, "031ea7317f98402bd4c237aa3b914098a006fbbfe15eb9ed50d5f58d8f355b715f781a23e803746236684d1f7114f9170d3f4c8b3c5319369d13e126e52ee8d4e7a64730bda0e1fcdbc39f5f91c56e5bcc09f8334b4abad64fa23dc688b6cb646559795d15f7983214b89ced56265b3f54a8885e9943910909c35e8b1ea867cdb3eb3aaf6bd2ee0898d834839ce6ad76d7131a8f7d7821f939ba1934ac52100fbb8a47b0740689797a83a194d00a123ffb3a0576392d59947bc03390e65c847e26aac4d242cfdf09a5e9f7560e59e455b06bf2789c326353ec0c066532f5a7ce4531cabd8e91e52c315dc1ff6c77"}]}, 0x1320}, 0x1, 0x0, 0x0, 0x240080c0}, 0x0) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f00000002c0)={r2, 0x0, 0xe, 0x0, &(0x7f0000000100)="e0b9547ed387dbe9abc89b6f5bec", 0x0, 0x4002000, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) 2.154639237s ago: executing program 1 (id=3975): pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000480)={0x0}, &(0x7f00000004c0)=0xc) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000500)={0x0}, &(0x7f0000000540)=0xc) getsockopt$inet_IP_XFRM_POLICY(0xffffffffffffffff, 0x0, 0x11, &(0x7f00000008c0)={{{@in6=@local, @in6=@loopback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@multicast2}, 0x0, @in6=@remote}}, &(0x7f00000009c0)=0xe8) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000f80)={0x0, 0x0}, &(0x7f0000000fc0)=0xc) r6 = syz_init_net_socket$802154_raw(0x24, 0x3, 0x0) r7 = openat$cgroup_type(0xffffffffffffffff, &(0x7f00000012c0), 0x2, 0x0) r8 = accept4$nfc_llcp(0xffffffffffffffff, &(0x7f0000001300), &(0x7f0000001380)=0x60, 0x80800) r9 = syz_init_net_socket$nfc_llcp(0x27, 0x3, 0x1) r10 = syz_init_net_socket$bt_hidp(0x1f, 0x3, 0x6) r11 = socket$inet_mptcp(0x2, 0x1, 0x106) r12 = socket$inet6_udp(0xa, 0x2, 0x0) sendmsg$netlink(r0, &(0x7f0000001400)={&(0x7f0000000040)=@proc={0x10, 0x0, 0x25dfdbff, 0x4}, 0xc, &(0x7f0000001280)=[{&(0x7f0000000080)={0x3cc, 0x1a, 0x200, 0x70bd29, 0x25dfdbfb, "", [@typed={0x8, 0x2d, 0x0, 0x0, @pid=0xffffffffffffffff}, @typed={0xc, 0x1c, 0x0, 0x0, @u64=0xfffffffffffffffe}, @generic="bf23403ce440b66178bb486eb4286b", @nested={0x12f, 0x124, 0x0, 0x1, [@typed={0x14, 0x22, 0x0, 0x0, @ipv6=@loopback}, @nested={0x4, 0x49}, @generic="4a49eabcf4f70dc78295f25268c162ce61f4e66b9f331b595432c3cf901e54a895435612b104b08510e7aa4c17d25c015167fea41734f6d48c6d542e341d0935dc2a7a28c4d03c727e23ac5b43ccd53633016c4a45c16d09ceb862c1abfba32d01960f35536c0798b6156467f2449f1067f44f456b584516229e2f895a14e4ec2f67723efd911440bf1c68b3fa46e9aeb201b0a1b4d93fe2c3bdcee84476a9ef905806bfd410a9be35c3eb1dad2d286d53ae84f3dde6cc790d7cb4ab3e6aefdf4cf7f5353a7445bd6929231a952d3842efbb2ef25c7943dc204241a3f512bec47751474a7af7d46de32efb6473a94b59829b7df98349cf932981d4", @nested={0x4, 0x2a}, @typed={0xc, 0x69, 0x0, 0x0, @u64=0x1}, @nested={0x4, 0x123}, @typed={0x4, 0xb5}]}, @nested={0x234, 0x42, 0x0, 0x1, [@generic="33c7bf8cc58777f3f8adf04276ce9c416f1c5cb92df1bff8b673fc33d0cee351e2c4769cb59697e28e3858baf0af2395197743ee11498dc6c28df41ac5f33a70de361c8c960b18ca0365a1611b75c9cdeab82ec03921b286ceb5d1bc6cfb26bdd0ac0551125018a307fa5bf512f056005600aef43345dc", @nested={0x4, 0x98}, @generic="4a9eeac5af5e7f9dc89bc2112a96afdd1318859f6b9e010a7dcb457167643940fe5918ae68b2852f143c276a1680a16100449b3d9ac73f8f98fc64fb0b3adebad55365e0e2bb513850894bd6be761c8b7ea9e675079b60efd064bae212a4051e589f98fdc7ba0c10a5c2ac5a7a1545d4babb858d77bce8f08436aa517f9a91c1466d3b85046fc2614f0377bb4d8c7c7ac93e2b4e5c725acc20f617978bb90718ad25fe867b4b664f9c9230b2b3d7abe13be8b2f036c1fb284a0e04cb2a5dce56a015f912d7aa38403297503cc24534c1a4cb02ed5670bacf96397f", @typed={0xb, 0x26, 0x0, 0x0, @str='@]\\}.%\x00'}, @generic="ec10", @nested={0x4, 0x57}, @generic="e7747e7946a2e400e74e8e08f7dc80ae419209eedba42cc55e8706b505c3b5f4246814dbf5d799fb7225806e748be517fb6f86613610ed5a735db35d3dc624d14fb9bfd297bc20dfed5e70fc76ba782b23b66c52c5f3eea3df31bf7a84fd9dfcd1cdd3f87ad1e3751d0afbaf05b88171d2cc5d8f4eb290f371a6b84d632e8204d31b178b45903cceae864421c0f81d36de5b5b3e3a88dc8624d250e3130da4e32f8d1b89b56149e591db1f617be84c23b74aad26b067e6b490b8920967ced91f403f93d6", @nested={0x4, 0x109}]}, @nested={0x33, 0x12, 0x0, 0x1, [@generic="05cd604843021499012632fbe38ab321676ecee62eb54c5aca794d", @nested={0x4, 0x2d}, @nested={0x4, 0x4e}, @typed={0xc, 0xcd, 0x0, 0x0, @u64=0x4}]}]}, 0x3cc}, {&(0x7f0000000580)={0x330, 0x36, 0x2, 0x70bd2c, 0x25dfdbfd, "", [@generic="64b9a612138d9f767d5ae1f146a5ff839409708181cf3e6cfc399838cca3c1d2937f6a4a935a41e03b3c46ca6f04610a0ed15193804b27a33a0feb2d2397f1732d5ed4eaf02abbb135514ac82a8d3fb2d6eddfaa701f8affbe95ab0ccedcacfbe6dae821fde32284c12048ceefb68834ab74294d5e11a09debc5242742c739fd1e68e236f55d7179a81640112059b9d100da4476f1340d52ab4c1ff0875c1080fb9c3873691b6ef513d3", @nested={0x14, 0xf9, 0x0, 0x1, [@typed={0x8, 0x9a, 0x0, 0x0, @u32=0x9ff1}, @nested={0x4, 0xcd}, @typed={0x4, 0x6c}]}, @nested={0x5f, 0x6a, 0x0, 0x1, [@nested={0x4, 0xd9}, @typed={0x8, 0x123, 0x0, 0x0, @pid=r2}, @generic="8e29278eac5af387cc4248e18e4705b62e197efddbac5582681dcd75f31518e70d36cbc06f239610f2e248964000fbbe936d76e504a9eb8ef270a811ae9bd1441e0778d5636ec14563886e0e72176e"]}, @typed={0x8, 0x4e, 0x0, 0x0, @pid=r3}, @nested={0xe4, 0xfd, 0x0, 0x1, [@typed={0x6, 0xb0, 0x0, 0x0, @str='(\x00'}, @generic="93968d6c1a7229670429c70c45c216f475d15d456a", @nested={0x4, 0xa1}, @generic="fa8eedbed827e0cb99f992c3abd3ddcf2d5b587e", @generic="114f4c8738f2f9129d4dafa59f5f5a9335f0cf0c9ea1d7e866c47987b75668ce15328ca01a290ec19e83e70a0b51f7785eecdb594cfa101b4f814d30140f59263536a9dac787617fb0348ab6d9a0b67f44a04bd40449bc82c1038a7a11b640dba407b1321b92823a183ce9f1cd77f3b5bf824e7e880ed0fd4e928b2226ba476b82815ebe279c1012238b85c08b3b7079270d5cc96c327b76814fe4da05c9f0635e1499fcdc08f5ef2acfc8"]}, @generic="c8f9c32697b7f6603206be501d45118dea2cca932d7fb8c657ea1f", @nested={0xf1, 0xac, 0x0, 0x1, [@typed={0x14, 0x60, 0x0, 0x0, @ipv6=@private2}, @typed={0x8, 0x87, 0x0, 0x0, @u32}, @nested={0x4, 0xa9}, @generic="f9444486f4eed8884aa5a1d53008fbbe294eb6a06cb38eaaa10d79e54eda9bd1cb330376595572420c9cb761822ab9f1dc1dde78ad426494fd78c88157e5cce14c81d7d486bb72c17623713efa9e9d42e0a99dfc870f12ab15718080e36bffbdc46914bcef64c34fe1f8c0720a86db94094a135bf1751301e846605a3eb17e8068806966c9f3f5da18387797f94210ebd8aa47dd63c8b5378457188c6ffe4e912cbc9411f5198c2d17f9b7b44a7293ec963f6e4aac5529fec58495bb4e0652144e54911e40cf2158a2b097d66a"]}, @generic="460b63bf"]}, 0x330}, {&(0x7f0000000a00)={0x548, 0x18, 0x20, 0x70bd2b, 0x25dfdbfd, "", [@nested={0xf9, 0x108, 0x0, 0x1, [@generic="fe07c090067d5b637ee1e4b7fc684735c22c8d036c1fd712bc47596fffe8f15afc6382a8047bff52e466947b5623409e47b380bb2baecbd2db767cb9a7b0b445bf43473cf757a84ca65085412560ad4e82e5d608f9fa691d84db484e42e23f03303277df1e4ab64969e7a8e487741ad2e2d121f0636a0a0681118e6de69f5a418bb9dd506c4ee3567baac0feae9478da909b009dcfa19f9af6482dccc6c47860c72104138a3bcd139b4d7388c8a3e3fc6fb5fccbbf49aa7cf2cd875b85ba0d33230a2fa3a887d355930ae092753a099cfda1c12edf7f3fc1a9faf5cc7a54cea27d6e19c089b135d99be47282492c1d170ff09407e6"]}, @nested={0x174, 0x73, 0x0, 0x1, [@generic, @generic="84664374b122be5d1b56078bf1ed5b99aadb1c4539ced7521481546369188c2d143969c7e53e883963022f6bb4d74f4f3b3b43bf07641acf0a611759cc541dcaf47229fe6e99cb5690d53b8fc5696b35907d6de131523b6aa4344270bd5f539e9b3e4d8cd706779098e06fe4c021812cc39c9744827ab0ba77912b384364fc00216c88accb7f4a037ed2efce1d714de51764ae6076a14b306b4c614c0ec114f313dd9494e570ac706175e7d633b029fbbc4ef7064d304c32b89febd3784cacb8091d8678a91c64cfcd6924991d318ceee7", @nested={0x4, 0x23}, @typed={0x4, 0x10b}, @typed={0x8, 0x15, 0x0, 0x0, @uid=r4}, @generic="0b6f4c6740b449c7c57013ef3a96d6ad498f0b31804564ff016008575a8db823af1bea52785c07350b92afe4f5829e554c2c7c08a478bef82730b77e40a6c75d7841cc1608f145fe7c97dd4c8edcfc1fcce7c7990e5f51992ebb829f6660cf73297f2ab15786a7fcd7ef68eb9443f28cc49d807fa7032cbfd89ef0", @typed={0x14, 0x49, 0x0, 0x0, @ipv6=@private0={0xfc, 0x0, '\x00', 0x1}}]}, @nested={0x13d, 0x27, 0x0, 0x1, [@generic="375508bb7d1097b9dce32852ec7392a75eb552fae0452536a0ebd5a567049a710dc4dcb6b7bf8b2f14e68fbbbf11592201", @nested={0x4, 0xc3}, @generic="350b668e663de6b2ed1ee8b8d1a41d8462cd0a5aae8c12f4650ebc22fca8920130e40af43d0bca5c1edff476adb2e8762c550d15249343a2fa4a94dc3cff79afecdb58058dc8ceccdb7b3a3179562eabd5c8a679ac6150c4ee5ccf897f38b0c7f4e517a53bc1899eb1388302fbc131e89b92b3722549c6325a7ca367bcdab3335319cee97a6691a2b653981f7181cf04f4c9cae7ff5793631b1e6be68410526b1b00f8cadc14d8bcc2670a90daa8a851711811011139073bfbfb529f31c9c0d484ccdba0764a59749e9fe787dd06a62d", @nested={0x4, 0x66}, @typed={0x8, 0x3b, 0x0, 0x0, @fd}, @nested={0x4, 0xb5}, @generic="4738fa9430933a9201274072376f97d4f4c34ff58f6761c031811a28a25950c347820458"]}, @typed={0x4, 0xf5}, @nested={0x182, 0xff, 0x0, 0x1, [@generic="8910db7d7f519ac5733ea2127a71363fd2f5d732a4e915dd72f44ca6bfa587c7861bd69df1d9b11cecf7be8d2b110d8890d33884f9dfd51d62d9c51bed9b0acd5f7cdc3ec97cc60d0ebfe272b106e6a34368d7cfc9edca2ac71878869712e71a539a807ad92a91adec7902eaa90bc02254777834f547eeb95544f6581d7c34805f31c19127e9f839768943dd500f2d40f9ce360e164eb1", @typed={0x8, 0x22, 0x0, 0x0, @u32=0xf75}, @generic="58ae41052068d2c3a48011d5042c1db7fd667f092992b98ceadb3dddc7248589afd4074d9e6dc42fdd77a83832563b2da0548a2865ecf788e64ff269d722e4206ae87d24652cab52b59939cbef53b664ef6e988d583192d733fba2fac93a0c58b4a016f87d19cc9a8fd9749baffebe1258dd4a8a830aeb4a03d9f57c6cd8323258adc46f8057bff32254a7bc769a83d182911fc9aa8c7ccb8529c4df129fe48f770b7bff430d2ec4b4f6d2d32332522514ab517b808068517fb5c9233054e14753728d224bccf0af25aef3372699da52ae9868", @nested={0x4, 0x9b}, @nested={0x4, 0x159}, @nested={0x4, 0xae}]}]}, 0x548}, {&(0x7f0000001000)={0x254, 0x29, 0x100, 0x70bd27, 0x25dfdbfc, "", [@nested={0x1e5, 0x133, 0x0, 0x1, [@generic="043a61de5bf44eded95e8cc4aacf59ecd0378404624484d8a9a094a23ff471af42f39eb5a6aee20080c93bdbc80c0e08c0e5961f9810a14b26d274e0ccd851a8f3c1afd064ce586d8a17e47dfcd9118caead062c9000b50ee66e55e74ca0998013714c0b355b10a40f3283f6a030c8c8e599c6858e8da877fa45cb336efe7bb719badcfd732e2135b395fa775aa2050f1e8aae154fbb4612c545", @nested={0x4, 0x97}, @generic="187cfaa1ecda3a133d216ae289d6cadf2ee5260563bb20f863e457a809d1078fde25acf31b019c14345f9abc6f40cf8a6b8d0e8410f64ecf387f84", @nested={0x4, 0x89}, @typed={0xd4, 0x11d, 0x0, 0x0, @binary="79bc1ab6f895222564d96d6c1d79d64d96395e72a7412dbc5b96614ad6946bd721b7af9cf2ebc82823de4ed2b5e3302c60e784fc75302c87f2a299ab423681fb165422ea1dce2d77db848a16306e14ce68ddd0db60d502e36180ab8b0d41967cf213c6b88449787f51dd8b7ed5c8330b4a140faa71750685789b589bfd9e3232892f9d6b73c495f573384e5fbf597cfb2d5e3439cbfc56ac49f0eed89f6ef75c420c499b8e53201edbb8198789ea6b44d0d89dabe0d56f2e5ca2b6e63111ff144aae534eb04aba6bfd158c373092407a"}, @typed={0x8, 0x7a, 0x0, 0x0, @uid=r5}, @typed={0x14, 0x66, 0x0, 0x0, @ipv6=@private0={0xfc, 0x0, '\x00', 0x1}}, @typed={0x14, 0xd4, 0x0, 0x0, @ipv6=@loopback}]}, @generic="abcc6bb31e8741f5d48ed5579a22d9675316302e275fc488ae4e1024c6824007ab2bc75a28c2937dd00d21b83b354e973b79c71fb8e240d61f040635819aae546cc08b95b8cbbad2f000b34a973a0ef5105d5090a8ea70061ec35e06"]}, 0x254}], 0x4, &(0x7f00000013c0)=[@rights={{0x30, 0x1, 0x1, [r6, r7, r8, 0xffffffffffffffff, r9, r10, r11, r12]}}], 0x30, 0x10}, 0x4000) setsockopt$sock_attach_bpf(0xffffffffffffffff, 0x1, 0x32, &(0x7f0000001440)=r1, 0x4) r13 = syz_init_net_socket$rose(0xb, 0x5, 0x0) ioctl$sock_SIOCGIFINDEX(r13, 0x8933, &(0x7f0000001480)={'veth1_macvtap\x00'}) getsockopt$inet_opts(r11, 0x0, 0xd, &(0x7f00000014c0)=""/4096, &(0x7f00000024c0)=0x1000) r14 = socket$caif_stream(0x25, 0x1, 0x3) setsockopt$sock_attach_bpf(r14, 0x1, 0x32, &(0x7f0000002500)=r0, 0x4) socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$sock_linger(r13, 0x1, 0xd, &(0x7f0000002540)={0x0, 0x5}, 0x8) ioctl$XFS_IOC_FSGEOMETRY(r6, 0x8100587e, &(0x7f0000002580)) setsockopt$inet6_tcp_TLS_TX(r0, 0x11a, 0x1, &(0x7f0000002680)=@gcm_256={{0x303}, "eb334227891bca5d", "2705a997d1f38701c430db2c7ecb6b17eb12c19335ccdbb5061faf2834a5faa8", "8856852f", "7da0d7140005ca18"}, 0x38) r15 = syz_genetlink_get_family_id$nl80211(&(0x7f0000002700), r0) ioctl$sock_SIOCGIFINDEX_80211(r6, 0x8933, &(0x7f0000002740)={'wlan1\x00', 0x0}) ioctl$sock_SIOCGIFINDEX_80211(r12, 0x8933, &(0x7f0000002780)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_DEL_STATION(r0, &(0x7f0000002880)={&(0x7f00000026c0)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f0000002840)={&(0x7f00000027c0)={0x78, r15, 0x2, 0x70bd2b, 0x25dfdbfb, {{}, {@val={0x8, 0x3, r16}, @void}}, [@NL80211_ATTR_MESH_PEER_AID={0x6, 0xed, 0x774}, @NL80211_ATTR_MAC={0xa, 0x6, @broadcast}, @NL80211_ATTR_STA_TX_POWER={0x6, 0x114, 0x9f}, @NL80211_ATTR_MGMT_SUBTYPE={0x5, 0x29, 0xa}, @NL80211_ATTR_MESH_PEER_AID={0x6, 0xed, 0x396}, @NL80211_ATTR_STA_VLAN={0x8, 0x14, r17}, @NL80211_ATTR_STA_FLAGS={0x28, 0x11, 0x0, 0x1, [@NL80211_STA_FLAG_ASSOCIATED={0x4}, @NL80211_STA_FLAG_AUTHENTICATED={0x4}, @NL80211_STA_FLAG_TDLS_PEER={0x4}, @NL80211_STA_FLAG_AUTHORIZED={0x4}, @NL80211_STA_FLAG_WME={0x4}, @NL80211_STA_FLAG_WME={0x4}, @NL80211_STA_FLAG_AUTHENTICATED={0x4}, @NL80211_STA_FLAG_SHORT_PREAMBLE={0x4}, @NL80211_STA_FLAG_AUTHORIZED={0x4}]}]}, 0x78}, 0x1, 0x0, 0x0, 0x4048800}, 0x40) setsockopt$WPAN_SECURITY_LEVEL(0xffffffffffffffff, 0x0, 0x2, &(0x7f00000028c0)=0x4, 0x4) mmap(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x200000d, 0x4010, r11, 0xb5e54000) ioctl$EXT4_IOC_GROUP_ADD(r12, 0x40286608, &(0x7f0000002900)={0x7, 0x100000001, 0x8000000000000000, 0x8, 0x4, 0x8}) 2.154493263s ago: executing program 0 (id=3976): r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000000)=@newlink={0x64, 0x10, 0x403, 0x70bd2d, 0x0, {0x0, 0x0, 0x0, 0x0, 0x90646, 0x4a420}, [@IFLA_LINKINFO={0x44, 0x12, 0x0, 0x1, @ipoib={{0xa}, {0x34, 0x2, 0x0, 0x1, [@IFLA_IPOIB_UMCAST={0x6}, @IFLA_IPOIB_MODE={0x6}, @IFLA_IPOIB_UMCAST={0x6}, @IFLA_IPOIB_MODE={0x6}, @IFLA_IPOIB_UMCAST={0x6, 0x3, 0x1}, @IFLA_IPOIB_MODE={0x6}]}}}]}, 0x64}, 0x1, 0x0, 0x0, 0x600}, 0x0) 1.989997423s ago: executing program 0 (id=3977): r0 = socket(0x1a, 0x80000, 0x967) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000001c0)={0x6, 0xc, &(0x7f0000000840)=ANY=[@ANYBLOB="1800000000010000000000000000000018010000756c6c2500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b7030000f494000085000000a0000000890f000000000050372130dcc21a3827c242ba922aac67011a0983ff6d5dfb87250c93e5fe93c3cc84"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x4, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) socket$nl_rdma(0x10, 0x3, 0x14) socket$netlink(0x10, 0x3, 0x5) pipe(0x0) r2 = socket$packet(0x11, 0x2, 0x300) ioctl$XFS_IOC_FD_TO_HANDLE(r1, 0xc038586a, &(0x7f00000004c0)={r0, &(0x7f0000000280)='bpq0\x00', 0x2, &(0x7f0000000300)={@align=0x99, {0xfffc, 0x3, 0x1ff, 0x9}}, 0x1, &(0x7f0000000340)={@_ha_fsid}, &(0x7f0000000400)}) r3 = bpf$MAP_CREATE(0x0, &(0x7f0000000500)=@base={0xb, 0x8, 0xc, 0x80000000, 0x1}, 0x50) r4 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, &(0x7f0000000440)=@framed={{}, [@ringbuf_output={{0x18, 0x1, 0x1, 0x0, r3}, {}, {}, {}, {}, {}, {}, {0x85, 0x0, 0x0, 0x3}}]}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r5 = bpf$PROG_LOAD(0x5, &(0x7f0000000880)={0x1, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x10, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) setsockopt$sock_attach_bpf(r2, 0x1, 0x32, &(0x7f0000000180)=r5, 0x4) r6 = bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000b00)={0x6, 0x3, &(0x7f0000000680)=ANY=[@ANYBLOB="1800000002000000000000000000000095"], &(0x7f00000002c0)='syzkaller\x00'}, 0x94) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r2, 0x8933, &(0x7f0000000700)) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000600)={r6, 0x5, 0xb68, 0x560b0000, &(0x7f0000000000)="259a53f271a76d2673004c6588a8", 0x0, 0xd01, 0x2a0, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x48) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f00000006c0)={{r3}, &(0x7f0000000580), &(0x7f00000005c0)=r4}, 0x20) pipe(0x0) socket$nl_route(0x10, 0x3, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)) setsockopt$ax25_SO_BINDTODEVICE(0xffffffffffffffff, 0x101, 0x19, 0x0, 0x0) r7 = syz_init_net_socket$rose(0xb, 0x5, 0x0) r8 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r8, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000000)=@newlink={0x4c, 0x10, 0x1, 0x70bd2b, 0x25dfdbfc, {0x0, 0x0, 0x0, 0x0, 0x40938, 0x3}, [@IFLA_GROUP={0x8}, @IFLA_AF_SPEC={0x24, 0x1a, 0x0, 0x1, [@AF_INET6={0x20, 0xa, 0x0, 0x1, [@IFLA_INET6_TOKEN={0x14, 0x7, @mcast1}, @IFLA_INET6_ADDR_GEN_MODE={0x5, 0x8, 0x2}]}]}]}, 0x4c}, 0x1, 0x0, 0x0, 0x68010}, 0x0) ioctl$sock_rose_SIOCADDRT(r7, 0x890b, &(0x7f0000000740)={@remote={0xcc, 0xcc, 0xcc, 0xcc, 0x0}, 0x6, @null, @bpq0, 0x0, [@bcast, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x0}, @null, @bcast, @default, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}]}) r9 = syz_init_net_socket$rose(0xb, 0x5, 0x0) ioctl$sock_rose_SIOCADDRT(r7, 0x890b, &(0x7f0000000380)={@dev={0xbb, 0xbb, 0xbb, 0x1, 0x0}, 0x6, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @bpq0, 0x0, [@rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @default, @null, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @default, @bcast, @null]}) ioctl$sock_rose_SIOCDELRT(r9, 0x890c, &(0x7f00000000c0)={@remote={0xcc, 0xcc, 0xcc, 0xcc, 0x1}, 0x6, @null, @bpq0, 0x1, [@bcast, @default, @default, @default, @null, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @default]}) r10 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r10, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000040)=ANY=[@ANYBLOB="3400000040000701feffffff00000000017c0000040042800c00018006000600800a0000100002800c0009"], 0x34}, 0x1, 0x0, 0x0, 0x48815}, 0xc000) 1.763333446s ago: executing program 1 (id=3978): r0 = socket$inet6_sctp(0xa, 0x801, 0x84) sendmmsg$inet6(r0, &(0x7f0000001140)=[{{&(0x7f0000000300)={0xa, 0x4e21, 0x0, @mcast1, 0x4}, 0x1c, &(0x7f0000000000)=[{&(0x7f0000000540)='O', 0x1}], 0x1}}], 0x1, 0x0) (async) socket$nl_netfilter(0x10, 0x3, 0xc) (async) syz_emit_ethernet(0x6e, &(0x7f0000000040)=ANY=[@ANYBLOB="0180c2000002aaaaaaaaaaaa08004500006000000000002f9078640101000000000024806558000000000000000010000800000086dd"], 0x0) (async) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f00000002c0)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x5}}, [@NFT_MSG_DELTABLE={0x28, 0x2, 0xa, 0x201, 0x0, 0x0, {0xa, 0x0, 0x6}, [@NFTA_TABLE_NAME={0x9, 0x1, 'syz1\x00'}, @NFTA_TABLE_FLAGS={0x8, 0x2, 0x1, 0x0, 0x1}]}, @NFT_MSG_DELFLOWTABLE={0x3c, 0x18, 0xa, 0x0, 0x0, 0x0, {0x0, 0x0, 0x6}, [@NFTA_FLOWTABLE_NAME={0x9, 0x2, 'syz1\x00'}, @NFTA_FLOWTABLE_FLAGS={0x8}, @NFTA_FLOWTABLE_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_FLOWTABLE_FLAGS={0x8, 0x7, 0x1, 0x0, 0x1}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x1}}}, 0x8c}, 0x1, 0x0, 0x0, 0x2000c814}, 0x4000) (async) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a01020000000000000000010000000900010073797a30000000004000ffff0900010073797a30000000000900020073797a3100000000140003800800014000000000"], 0x138}, 0x1, 0x0, 0x0, 0x20040855}, 0x0) (async) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_EXP_NEW(r1, &(0x7f0000000500)={0x0, 0x0, &(0x7f00000004c0)={&(0x7f0000000080)={0x4c, 0x0, 0x2, 0x401, 0x0, 0x0, {0xa, 0x0, 0x5}, [@CTA_EXPECT_MASTER={0x4}, @CTA_EXPECT_MASK={0x4}, @CTA_EXPECT_TUPLE={0x30, 0x2, 0x0, 0x1, [@CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @mcast1}, {0x14, 0x4, @initdev={0xfe, 0x88, '\x00', 0x1, 0x0}}}}]}]}, 0x4c}, 0x1, 0x0, 0x0, 0xd4}, 0x0) (async) socket$kcm(0x10, 0x2, 0x10) (async) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000200), 0x10800, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r3 = socket(0x400000000010, 0x3, 0x0) r4 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r5 = syz_genetlink_get_family_id$nl802154(&(0x7f00000003c0), 0xffffffffffffffff) (async) ioctl$sock_SIOCGIFINDEX_802154(r4, 0x8933, &(0x7f0000000000)={'wpan0\x00', 0x0}) sendmsg$NL802154_CMD_NEW_SEC_DEVKEY(r4, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000540)={&(0x7f0000000400)={0x48, r5, 0x1, 0xfffffffd, 0x0, {}, [@NL802154_ATTR_IFINDEX={0x8, 0x3, r6}, @NL802154_ATTR_SEC_DEVKEY={0x2c, 0x2f, 0x0, 0x1, [@NL802154_DEVKEY_ATTR_EXTENDED_ADDR={0xc}, @NL802154_DEVKEY_ATTR_FRAME_COUNTER={0x8}, @NL802154_DEVKEY_ATTR_ID={0x14, 0x3, 0x0, 0x1, [@NL802154_KEY_ID_ATTR_INDEX={0x5, 0x2, 0x3}, @NL802154_KEY_ID_ATTR_MODE={0x8, 0x1, 0x1}]}]}]}, 0x48}}, 0x4000040) (async) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$sock_SIOCGIFINDEX(r7, 0x8933, &(0x7f00000000c0)={'ip6_vti0\x00', 0x0}) (async) r9 = gettid() socket$inet6_mptcp(0xa, 0x1, 0x106) r10 = socket(0x10, 0x803, 0x0) (async) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x5) sendmsg$nl_route(r10, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000180)=@newlink={0x28, 0x10, 0x403, 0xfffffff9, 0x25dfdbfe, {0x0, 0x0, 0x74, r8, 0x19c04, 0x55007}, [@IFLA_NET_NS_PID={0x8, 0x13, r9}]}, 0x28}, 0x1, 0x0, 0x0, 0x4802}, 0x0) (async) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000380)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r3, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000005c0)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0xffffffff, {0x0, 0x0, 0x0, r11, {0x0, 0xfff1}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_multiq={{0xb}, {0x8}}]}, 0x38}}, 0x0) r12 = socket$nl_generic(0x10, 0x3, 0x10) r13 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000000), 0xffffffffffffffff) sendmsg$ETHTOOL_MSG_LINKMODES_SET(r12, &(0x7f0000000240)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000280)={0x44, r13, 0x7, 0x0, 0x0, {}, [@ETHTOOL_A_LINKMODES_OURS={0x18, 0x3, 0x0, 0x1, [@ETHTOOL_A_BITSET_VALUE={0x8, 0x4, '\x00\x00\x00\x00'}, @ETHTOOL_A_BITSET_SIZE={0x8, 0x2, 0x20}, @ETHTOOL_A_BITSET_NOMASK={0x4}]}, @ETHTOOL_A_LINKMODES_HEADER={0x18, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'syz_tun\x00'}]}]}, 0x44}}, 0x0) (async) sendmsg$nl_route_sched(r3, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000001300)=@newtfilter={0x5c, 0x2c, 0xf25, 0x70bd25, 0x2, {0x0, 0x0, 0x0, r11, {0x0, 0x8}, {}, {0x8, 0x4}}, [@filter_kind_options=@f_flow={{0x9}, {0x2c, 0x2, [@TCA_FLOW_EMATCHES={0x28, 0xb, 0x0, 0x1, [@TCA_EMATCH_TREE_HDR={0x8, 0x1, {0x100}}, @TCA_EMATCH_TREE_LIST={0x1c, 0x2, 0x0, 0x1, [@TCF_EM_CMP={0x18, 0x1, 0x0, 0x0, {{0x7, 0x1, 0xbc}, {0x5, 0x100000, 0x3, 0x4, 0x0, 0x1, 0x1}}}]}]}]}}]}, 0x5c}, 0x1, 0x0, 0x0, 0x20000000}, 0x0) (async) sendmsg$NFT_BATCH(0xffffffffffffffff, 0x0, 0x54) 1.427096062s ago: executing program 1 (id=3979): r0 = socket$igmp6(0xa, 0x3, 0x2) socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = socket$inet6(0xa, 0x2, 0x0) setsockopt$inet6_int(r1, 0x29, 0x4e, &(0x7f00000000c0)=0xfffffff7, 0x4) sendmmsg$inet6(r1, &(0x7f0000001700)=[{{&(0x7f0000000100)={0xa, 0x4e21, 0x0, @empty, 0x1}, 0x1c, 0x0, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="2400000000000000290000003200000000000000000000000000ffffac1e0101", @ANYRES32=0x0, @ANYBLOB='\x00\x00\x00\x00('], 0x50, 0x7ffffff7}}], 0x1, 0xc050) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x5) socketpair$nbd(0x1, 0x1, 0x0, 0x0) close(0x4) syz_open_procfs$namespace(0x0, &(0x7f00000004c0)='ns/pid_for_children\x00') r2 = socket$nl_netfilter(0x10, 0x3, 0xc) close(r2) r3 = socket$inet_tcp(0x2, 0x1, 0x0) shutdown(r3, 0x1) setsockopt$inet_tcp_TCP_REPAIR(r3, 0x6, 0x13, &(0x7f00000000c0)=0x1, 0x4) connect$inet(r3, &(0x7f0000000200)={0x2, 0x4e24, @remote}, 0x10) setsockopt$inet_tcp_TCP_REPAIR(r3, 0x6, 0x13, &(0x7f00000001c0)=0xffffffffffffffff, 0x4) sendmsg$NFT_BATCH(r2, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={0x0}, 0x1, 0x0, 0x0, 0x4000850}, 0x40) sendmsg$NFT_BATCH(r2, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={0x0, 0x68}, 0x1, 0x0, 0x0, 0x4000850}, 0x40) unshare(0x6a040000) r4 = socket(0x8, 0x3, 0x0) syz_genetlink_get_family_id$nl802154(&(0x7f0000001000), 0xffffffffffffffff) sendmsg$NL802154_CMD_GET_WPAN_PHY(0xffffffffffffffff, 0x0, 0x4000) r5 = syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0) connect$802154_dgram(r5, &(0x7f0000000640)={0x24, @long={0x3, 0x3}}, 0x14) ioctl$IMGETCOUNT(r4, 0x40106183, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000000980)=@raw={'raw\x00', 0x8, 0x3, 0x4b8, 0x0, 0xffffffff, 0xffffffff, 0x0, 0xffffffff, 0x3e8, 0xffffffff, 0xffffffff, 0x3e8, 0xffffffff, 0x3, 0x0, {[{{@ipv6={@private0, @mcast2, [], [], 'veth0_macvtap\x00', 'bridge0\x00'}, 0x0, 0x138, 0x160, 0x0, {}, [@common=@unspec=@statistic={{0x38}, {0x1, 0x1, 0x6, 0x5c, 0x5, {0x9}}}, @common=@inet=@hashlimit1={{0x58}, {'bond_slave_1\x00', {0x41, 0x1ff, 0x6, 0xb0e2, 0x10001, 0x84e, 0xfffffffb, 0x18, 0x8}, {0x1}}}]}, @common=@unspec=@NFQUEUE0={0x28}}, {{@ipv6={@remote, @ipv4={'\x00', '\xff\xff', @dev}, [], [], 'erspan0\x00', 'gre0\x00', {0xff}, {}, 0x0, 0x0, 0x0, 0x4b}, 0x0, 0x258, 0x288, 0x0, {}, [@common=@inet=@hashlimit1={{0x58}, {'pim6reg\x00', {0x0, 0x0, 0x5, 0x0, 0x0, 0x7, 0x3ff}}}, @common=@inet=@hashlimit3={{0x158}, {'vcan0\x00', {0x3, 0x0, 0x41, 0xfffffffe, 0x2, 0x1000, 0x6}}}]}, @common=@unspec=@CONNMARK={0x30}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28, '\x00', 0x7}}}}, 0x518) 1.336244596s ago: executing program 4 (id=3980): mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup/syz1\x00', 0x1ff) r0 = socket(0x1e, 0x4, 0x0) setsockopt$packet_tx_ring(r0, 0x10f, 0x87, &(0x7f0000000140)=@req3={0x7810, 0x4000003, 0x2, 0x81, 0x1fe, 0x1, 0x1}, 0x1c) sendmmsg(r0, 0x0, 0x0, 0x9200000000000000) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000140), 0xffffffffffffffff) sendmsg$NL80211_CMD_DEL_MPATH(r0, &(0x7f0000000380)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x8000}, 0xc, &(0x7f0000000240)={&(0x7f0000000180)={0x74, r1, 0x10, 0x70bd2a, 0x25dfdbff, {{}, {@void, @val={0xc, 0x99, {0x7, 0x7f}}}}, [@NL80211_ATTR_MPATH_NEXT_HOP={0xa}, @NL80211_ATTR_MAC={0xa}, @NL80211_ATTR_MPATH_NEXT_HOP={0xa, 0x1a, @device_b}, @NL80211_ATTR_MPATH_NEXT_HOP={0xa, 0x1a, @broadcast}, @NL80211_ATTR_MAC={0xa}, @NL80211_ATTR_MPATH_NEXT_HOP={0xa, 0x1a, @broadcast}, @NL80211_ATTR_MPATH_NEXT_HOP={0xa, 0x1a, @device_b}]}, 0x74}, 0x1, 0x0, 0x0, 0x20040000}, 0x24040090) r2 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000100)='./cgroup/syz1\x00', 0x200002, 0x0) r3 = openat$cgroup_type(r2, &(0x7f0000000300), 0x2, 0x0) write$cgroup_type(r3, &(0x7f0000000280), 0x9) r4 = openat$cgroup_procs(r2, &(0x7f00000002c0)='cgroup.threads\x00', 0x2, 0x0) write$cgroup_pid(r4, &(0x7f0000000c40), 0x12) r5 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r6 = syz_init_net_socket$netrom(0x6, 0x5, 0x0) r7 = syz_init_net_socket$rose(0xb, 0x5, 0x0) connect$rose(r7, &(0x7f0000000040)=@short={0xb, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, 0x1, @null}, 0x1c) connect$rose(r7, &(0x7f00000000c0)=@full={0xb, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0x3}, @null, 0x3, [@bcast, @null, @default, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @bcast, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x2}]}, 0x40) connect$netrom(r6, &(0x7f0000000300)={{0x6, @rose, 0x8}, [@default, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @default, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x3}, @default]}, 0x48) listen(0xffffffffffffffff, 0xa1) accept4$bt_l2cap(0xffffffffffffffff, 0x0, 0x0, 0x800) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x7, &(0x7f0000000080), 0x4) r8 = openat$cgroup_ro(r5, &(0x7f0000000040)='cgroup.freeze\x00', 0x275a, 0x0) write$cgroup_int(r8, &(0x7f0000000200)=0x1, 0x12) 1.220883327s ago: executing program 0 (id=3981): socket$nl_netfilter(0x10, 0x3, 0xc) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000b80)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a05000000000000000000070000000900010073797a300000000084000000090a010400000000000000000700000008000a40000000000900020073797a31000000000900010073797a3000000000080005400000000d08000640ffffff00080003400000000838001180090001006c61737400000000280002800c00024000000000000000090800014000000ba308000140000010000800014000003f5e980000000c0a01010000000000000000070000000900020073797a31000000000900010073797a30000000006c0003806800008008000340000000025c0002800c00028008000340000000024c000280080003400000000408000180fffffffd0800f1d7fffffffd0800034000000003090002"], 0x164}, 0x1, 0x0, 0x0, 0x4000819}, 0x0) socket(0x400000000010, 0x3, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)) r1 = socket$inet_udp(0x2, 0x2, 0x0) r2 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000080)={'wlan1\x00', 0x0}) r4 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000000), 0xffffffffffffffff) sendmsg$NL80211_CMD_SET_CQM(r2, &(0x7f0000000200)={0x0, 0xfd4b, &(0x7f0000000280)={&(0x7f0000000100)={0x30, r4, 0x1, 0x0, 0x0, {{}, {@val={0x8, 0x3, r3}, @void}}, [@NL80211_ATTR_CQM={0x14, 0x5e, 0x0, 0x1, [@NL80211_ATTR_CQM_TXE_PKTS={0x0, 0x6, 0x3}, @NL80211_ATTR_CQM_RSSI_LEVEL={0x8, 0x9, 0x5}]}]}, 0x30}, 0x1, 0x0, 0x0, 0x48002}, 0x0) socket$nl_generic(0x10, 0x3, 0x10) r5 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r5, &(0x7f0000000680)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000500)=ANY=[@ANYBLOB="380000001800010000000000000000000a000000000000000000000008000400", @ANYRES32=r5, @ANYBLOB="06001500070000000c00168008000100", @ANYRES64=r1], 0x38}}, 0x10) 1.083025504s ago: executing program 3 (id=3982): mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x2, 0x31, 0xffffffffffffffff, 0x0) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff}) bpf$MAP_CREATE(0x0, &(0x7f00000001c0)=ANY=[@ANYBLOB="12000000060000000800000002"], 0x48) syz_init_net_socket$nfc_llcp(0x27, 0x1, 0x1) mmap(&(0x7f0000001000/0xc00000)=nil, 0xc00000, 0x0, 0x3032, 0xffffffffffffffff, 0x0) bpf$TOKEN_CREATE(0x24, &(0x7f0000000140)={0x0, r0}, 0x8) bpf$BPF_BTF_LOAD(0x12, &(0x7f0000001280)={&(0x7f0000000100)=ANY=[], &(0x7f00000012c0)=""/4119, 0x31, 0x1017, 0x9}, 0x28) socket(0x10, 0x803, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) socket$nl_route(0x10, 0x3, 0x0) r1 = socket(0x2b, 0x1, 0x1) connect$inet6(r1, 0x0, 0x0) setsockopt$IPT_SO_SET_REPLACE(r1, 0x29, 0x40, 0x0, 0x60) r2 = socket(0x10, 0x803, 0x0) socket(0x400000000010, 0x3, 0x0) socket$unix(0x1, 0x2, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) ioctl$IMGETCOUNT(r2, 0x80044943, &(0x7f0000000100)) r3 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r3, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000080)=ANY=[@ANYBLOB="280000001c00010429bd7000ffdbdf2507000000", @ANYRES32=r3, @ANYBLOB="e0ff8b0a0a0002"], 0x28}, 0x1, 0x0, 0x0, 0x1}, 0x24040040) sendmsg$nl_route(r3, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000080)=ANY=[@ANYBLOB="300000001d"], 0x30}, 0x1, 0x0, 0x0, 0x1}, 0xc31fe084736598c) 756.943512ms ago: executing program 3 (id=3983): r0 = socket$inet6(0xa, 0x2, 0x0) setsockopt$inet6_IPV6_DSTOPTS(r0, 0x29, 0x3b, &(0x7f00000002c0)=ANY=[], 0x8) bind$inet6(r0, &(0x7f0000f5dfe4)={0xa, 0x4e20, 0x0, @empty}, 0x1c) recvmmsg(r0, &(0x7f00000010c0)=[{{&(0x7f0000000c00)=@rxrpc=@in6={0x21, 0x0, 0x2, 0x0, {0xa, 0x0, 0x0, @dev}}, 0x0, &(0x7f0000000d00)=[{&(0x7f0000000c80)=""/125}, {&(0x7f0000000080)}, {&(0x7f0000000340)}], 0x0, &(0x7f0000000d40)=""/19}, 0x4}, {{&(0x7f0000000d80)=@ethernet={0x0, @remote}, 0x0, &(0x7f0000000f80)=[{&(0x7f0000001b00)=""/4096}, {&(0x7f0000000e00)=""/69}, {&(0x7f0000000e80)=""/252}], 0x0, &(0x7f0000000fc0)=""/193}}], 0x3fffffffffffe10, 0x4000002b, 0x0) setsockopt$inet6_int(r0, 0x29, 0x4, &(0x7f0000000000)=0x1, 0x4) r1 = socket$isdn_base(0x22, 0x3, 0x0) ioctl$IMSETDEVNAME(r1, 0x80184947, &(0x7f0000000040)={0x7, 'syz0\x00'}) mmap(&(0x7f0000002000/0x2000)=nil, 0x2000, 0x8, 0x32, 0xffffffffffffffff, 0x0) sendmmsg$inet(0xffffffffffffffff, &(0x7f0000001380)=[{{0x0, 0x0, &(0x7f0000000940)=[{&(0x7f0000001c80)="eced09c14f8d672fdf1c9abf972eb256c943bfb14b5025f78decdacde7a06af3949b1e4d84df6ab9023f900b60a4f902a069ec21839c468ac49145c33a2980dcbbbf1d79933e2b659815aaf84b6bcfc3b959a9d17f6f2a476a3b0f478f5ccda4263969fa85027036f7d49360b90f6d6db96cadebe5a84a52ba19235e93efd56a7d569d2d8cc8a9d6aeb2b649331df6666fe4bd023e868cc9d3ea1db1e6253250807302f59d1fc9a7b9a716c5fe98ad37f1cdd0407d196a608cde9c008f1b2ab6ea48ee93d08f4b99a9156ef53af0cbe7c733d8d771159c05495a9aed3efa5979b6e14f77abe4a9d21873ff03c05ee4d525544cd1a386951ef5bafdd5a7d221be5f257d6cd03a8b54557bd7b469a6a9f4040760b8f3bb14a34801300efd8582aebddac64516403da88386f131bd1783335b8411a0347ae73e798b43ef3837499d38a5d7c68c76ebe2fb2026b11ab349d74c939921f0f92af9ae0548180f5cbf679d715ba04aa878cc859904d2917b58c9f1072ecee373b2878525dca882c709d015c3cacef99b420afff509027b8b47ef53f428879988eef6930be04d8377b810a112d7f6bfcaadbcfab1ea334ea74f5f1ff5d3e9dc41922c999484f937cfaf31ea4f7c0ec907f0c4f20803c1a17a98db7d11a3926d72d92d1379316a351d2f228cd21617e3e96c11ed892ed98d6a1bb71b3348103ad51110bd6214317953d94d29184e899ae5dac43431cffbe164d1040fbed26699d7ecee78ac2513f8a3f98814b329de9b68e3f2832366e7c77a1fc7be482a1a4ccadd6f9c5bcb0fe21054a8969770d7fc70765c256bbb079288a69560c78fcca3fb6c40fc2f5c4379726a36c55655e8ae5729091548c4e047c2b388aa5d23a7f170a006b86067ec72fc6eec651054b3ad4d2db5c615303d4d7bc9a93a02e54e6b4026079b45b9432cfc6702af716ebbc5c5ed870b3d042bb8523a71694ae35665e91218f809f979901b4c769989f058eb4c788a012cf43e09a53c689e973a61b7135aabde156796b076e515321a3f305a174887e0c9c265872c839e064ad5559d6fb240fc0b3b15ffbfba9c2a1d29e530047dcbb8d32812ca268bcb1af959cba3054667a2d1325f170c1abb4cfe52a2f6e4719604e7a16004c38bc1bbec8a9bf3386e2d4c1d11a4e120f4d6a90dbfd5fef59df6e29c5f8b6dc7e579fde368135e928f6c16224163d9b44605bbde345f062f50c2bbd4e3c5ea23676f3d260f48a4c2fb710b4657c266c9707062", 0x381}], 0x1}}], 0x1, 0x8014) ioctl$EXT4_IOC_GETFSUUID(0xffffffffffffffff, 0x8008662c, 0x0) sendto$inet6(r0, 0x0, 0x0, 0x0, &(0x7f0000000300)={0xa, 0x4e20, 0x0, @mcast1}, 0x1c) 660.127766ms ago: executing program 0 (id=3984): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000240)={0x1, 0x4, &(0x7f0000000040)=ANY=[@ANYBLOB="b7050000000000007910a800000000005d0a0000000000009500000000000000"], &(0x7f00000002c0)='GPL\x00', 0x5, 0xfd90, &(0x7f0000000300)=""/188, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x1f3, 0x10, &(0x7f0000000080), 0xfffffffffffffc79, 0x0, 0xffffffffffffffff, 0x51}, 0x2a) socket$inet6_udp(0xa, 0x2, 0x0) r1 = socket$kcm(0x10, 0x2, 0x0) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000000), 0xffffffffffffffff) unshare(0x22020600) bpf$MAP_GET_NEXT_KEY(0x4, 0x0, 0x0) r4 = socket(0x40000000015, 0x805, 0x0) getsockopt(r4, 0x114, 0x5, 0x0, &(0x7f00000000c0)) sendmsg$ETHTOOL_MSG_FEATURES_GET(r2, &(0x7f0000000680)={0x0, 0x0, &(0x7f0000000600)={&(0x7f0000000540)={0x2c, r3, 0x301, 0x70bd29, 0x25dfdbfe, {}, [@HEADER={0x18, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'veth1_vlan\x00'}]}]}, 0x2c}, 0x1, 0x0, 0x0, 0x40080c0}, 0x20000000) sendmsg$kcm(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000300)=[{&(0x7f0000000500)="d8000000180081064e81f782db4cb904021e0800fd007c05e8fe55a10a000b000140020203600e41b0000900ac0006031100000016001500090002000000035c3b61c1d67f6f94007134cf6efbca4158858e796834b25ae5a3048000a007a290457f01a7cee4090000001fb7913fd25a21ce1b14d6d930dfe1d9d322fe7c9f8775730d16a4683f5ae24e25ccca9e00360db79826835d3a71d95667e006dcdf63951f215ce3bb9ad809d5e1cace81ed0bffece0b42a9ecbee5de6ccd40dd6e4edef3d93452a92954b43370e9703a90723f9000000008af26c", 0xd8}], 0x1}, 0x22040000) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000000000)=@raw={'raw\x00', 0x3c1, 0x1a6cc7, 0x288, 0xe8, 0x5802, 0x294, 0xe8, 0x294, 0x1b8, 0x378, 0x378, 0x1b8, 0x378, 0x3, 0x0, {[{{@uncond, 0x0, 0xa8, 0xc8, 0x52020000}, @common=@inet=@LOG={0x0, 'LOG\x00', 0x0, {0x9, 0x19, "90efa97ba643c2bdc34fb5a03c2ef5610d2da10f2e34d1cdfa8c76eab573"}}}, {{@uncond, 0x0, 0xa8, 0xf0}, @common=@inet=@SET1={0x0, 'SET\x00', 0x1, {{0x4, 0x1}, {0x1, 0x3, 0xc}}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x9) unshare(0x12000200) r5 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) mmap(&(0x7f00005d3000/0x4000)=nil, 0x4000, 0x0, 0x12, r5, 0xfffff000) mmap(&(0x7f00004a3000/0x1000)=nil, 0x1000, 0x0, 0x13, r5, 0x0) mmap(&(0x7f000086a000/0x2000)=nil, 0x2000, 0x4, 0x11, r5, 0x2000) sendmsg$BATADV_CMD_GET_DAT_CACHE(r5, &(0x7f0000000480)={&(0x7f00000003c0)={0x10, 0x0, 0x0, 0x8000}, 0xc, &(0x7f0000000440)={&(0x7f0000000400)={0x40, 0x0, 0x1, 0x70bd26, 0x25dfdbfc, {}, [@BATADV_ATTR_ELP_INTERVAL={0x8, 0x3a, 0x10001}, @BATADV_ATTR_HOP_PENALTY={0x5, 0x35, 0xfb}, @BATADV_ATTR_GW_BANDWIDTH_UP={0x8, 0x32, 0x84f2}, @BATADV_ATTR_TPMETER_TEST_TIME={0x8, 0xb, 0x7ff}, @BATADV_ATTR_ORIG_ADDRESS={0xa, 0x9, @multicast}]}, 0x40}, 0x1, 0x0, 0x0, 0x40000}, 0x20000000) 546.959971ms ago: executing program 3 (id=3985): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000040), r0) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000080)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_SET_BSS(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f00000000c0)={0x24, r1, 0xd572f675661c51a7, 0x70bd2d, 0x25dfdbfc, {{}, {@val={0x8, 0x3, r2}, @void}}, [@NL80211_ATTR_P2P_OPPPS={0x5, 0xa3, 0x1}]}, 0x24}, 0x1, 0x0, 0x0, 0x20008090}, 0x4000000) (fail_nth: 6) 118.714835ms ago: executing program 2 (id=3986): r0 = socket(0x10, 0x3, 0x0) ioctl$int_in(r0, 0x5452, &(0x7f0000000000)=0x7) sendmsg$kcm(r0, &(0x7f00000016c0)={0x0, 0x0, &(0x7f00000000c0)=[{&(0x7f0000000040)="1c0000004a008102e00f80ecdb4cb9020a", 0x11}, {&(0x7f0000001700)="0c74c75350f4a590e15c61", 0xb}], 0x2, 0x0, 0x0, 0x10}, 0x0) r1 = bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="1b00000000000000000000000080"], 0x48) bpf$PROG_LOAD(0x5, &(0x7f0000000700)={0x1f, 0xf, &(0x7f00000004c0)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r1, @ANYBLOB="0000000000000000b70200005245855db7030000000000008500000083000000bf0900000000000055090100000000009500000000000000bf91000000000000bf020000000000008500000084000000b70000000000000095"], &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x1d, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x21}, 0x94) 1.67397ms ago: executing program 2 (id=3987): r0 = socket$l2tp(0x2, 0x2, 0x73) bind$inet(r0, &(0x7f0000000080)={0x2, 0x0, @multicast1}, 0x10) bpf$MAP_CREATE(0x0, &(0x7f00000004c0)=ANY=[@ANYBLOB="0600000004000000080000000800000000000000", @ANYRES32, @ANYBLOB='\x00'/20, @ANYRES32=0x0, @ANYRES32, @ANYBLOB="00000000000000000000000000000000000000000000000000000000092fa86a8576a5e9138ad75f198f74b62d4f761e566d1e09e5e4cb46f091609451cb31147374f0e4bb72d97579246a78df4ef0db0b565fc2f952dc48f5ebb309869d7d6cfa63a2f7ca32aa89ba3d9df6041b4448349b85b7625c620562fa033f77903369d2d9a999e59bd445840b8cdd7ddbdf69c9a8dda551388e5f9d0a64aa11d2ff2c317121ea5481314d8af0eb52881cf502342f66adc79b539f641f4d2b8d3f0a35d67ad0d6e36f618a9ca351e5cb6c7ca48602006d9c70eaa5b77de9f12a6c17036d62d9f719f015f363bd91bf7cca971188820c8fe91515576a1943a554e34cd6ac732c8bdf1ed6dbd23553a4ba68949594cc6071ce39b352b3794a49bb3bddb13d716242066376c7410c86406e347b2bdce5b8a39fa623aa7168dff01bf41726da9d298f83bf430020f38d303a30287ae5713ffad6a8099f3dd68cf790be22e3c19d1c1d905aa1562315beaed70ccf4c24459d86bf9faa42b6fbfe667faa5d5a12b5726c"], 0x48) socket$inet6(0xa, 0x2, 0x0) socket$inet6(0xa, 0x2, 0x0) ioctl$XFS_IOC_PATH_TO_FSHANDLE(0xffffffffffffffff, 0xc0385868, 0x0) socket$nl_route(0x10, 0x3, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) r2 = socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt$inet_sctp6_SCTP_ENABLE_STREAM_RESET(r2, 0x84, 0x76, &(0x7f0000444ff8)={0x0, 0x7}, 0x8) ioctl$SIOCGSKNS(r2, 0x894c, &(0x7f0000000040)={'vlan1\x00', 0x200}) setsockopt$inet_sctp6_SCTP_RECONFIG_SUPPORTED(r2, 0x84, 0x75, &(0x7f0000000000)={0x0, 0x9}, 0x8) getsockopt$inet_sctp6_SCTP_GET_PEER_ADDR_INFO(0xffffffffffffffff, 0x84, 0xf, &(0x7f0000000180)={0x0, @in={{0x2, 0x4e22, @multicast1}}, 0x8, 0x8, 0x3, 0x9, 0x7f94eb3d}, &(0x7f00000000c0)=0x98) setsockopt$inet_sctp6_SCTP_ADD_STREAMS(0xffffffffffffffff, 0x84, 0x79, &(0x7f0000000100)={r3, 0x3, 0x7}, 0x8) setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(r2, 0x84, 0x64, &(0x7f0000000280)=[@in6={0xa, 0x4e23, 0x0, @loopback}], 0x1c) sendmmsg$inet6(r2, &(0x7f0000000480)=[{{&(0x7f0000000080)={0xa, 0x4e23, 0x0, @loopback, 0x80020}, 0x1c, &(0x7f0000000300)=[{&(0x7f00000034c0)='\x00', 0x1}], 0x1}}], 0x1, 0x34000811) r4 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) recvmmsg(r4, &(0x7f0000000580)=[{{0x0, 0x0, 0x0}}], 0x1, 0x63, 0x0) setsockopt$inet_sctp6_SCTP_RESET_STREAMS(r2, 0x84, 0x77, &(0x7f00000009c0)=ANY=[@ANYBLOB="12e01b3989dd", @ANYRES32=r1], 0x1000f) 0s ago: executing program 3 (id=3988): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000340)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0) sendmsg$NFT_BATCH(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000240)={{0x14}, [@NFT_MSG_NEWRULE={0x64, 0x6, 0xa, 0x40b, 0x0, 0x0, {0x2}, [@NFTA_RULE_EXPRESSIONS={0x38, 0x4, 0x0, 0x1, [{0x34, 0x1, 0x0, 0x1, @numgen={{0xb}, @val={0x24, 0x2, 0x0, 0x1, [@NFTA_NG_DREG={0x8, 0x1, 0x1, 0x0, 0x2}, @NFTA_NG_OFFSET={0x8, 0x4, 0x1, 0x0, 0x3}, @NFTA_NG_MODULUS={0x8, 0x2, 0x1, 0x0, 0x8b8}, @NFTA_NG_TYPE={0x8, 0x3, 0x1, 0x0, 0x1}]}}}]}, @NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_RULE_CHAIN={0x9, 0x2, 'syz2\x00'}]}], {0x14}}, 0x8c}}, 0x4) (async) bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="0500000004000000ff0f000007"], 0x48) (async) bpf$PROG_LOAD(0x5, &(0x7f0000000280)={0x1a, 0xc, &(0x7f00000000c0)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRESOCT, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000000000000b70400000000000085000000c300000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x29, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0}, 0x94) (async) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000800)={0x16, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x16, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000000)={r1, 0x2000000, 0x11, 0x0, &(0x7f0000000200)="63eced8e46dc3f0adf33c9f7b986", 0x0, 0x8001, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) (async) sendmsg$TIPC_NL_NET_SET(0xffffffffffffffff, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000600)=ANY=[@ANYBLOB="98000000", @ANYRES16, @ANYBLOB="230125bd7000fddbdf250f00000064000780080002"], 0x98}, 0x1, 0x0, 0x0, 0x44000}, 0x50) (async) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000005c0)=ANY=[@ANYBLOB="740000001000210400000000fcdbdf2500000000", @ANYRES32=0x0, @ANYBLOB="adffa8886004000024001280090001007866726d000000001400028008000100010000000800020011000000050021000000000008000a00", @ANYRES32, @ANYBLOB='\n\x00:'], 0x74}}, 0x0) kernel console output (not intermixed with test programs): 1b/0x210 [ 376.122763][T16081] netlink_sendmsg+0x813/0xb40 [ 376.122799][T16081] ? __pfx_netlink_sendmsg+0x10/0x10 [ 376.122827][T16081] ? aa_sock_msg_perm+0xf1/0x1b0 [ 376.122862][T16081] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 376.122897][T16081] ____sys_sendmsg+0x972/0x9f0 [ 376.122938][T16081] ? __pfx_____sys_sendmsg+0x10/0x10 [ 376.122977][T16081] ? import_iovec+0x73/0xa0 [ 376.123015][T16081] ___sys_sendmsg+0x2a5/0x360 [ 376.123050][T16081] ? __pfx____sys_sendmsg+0x10/0x10 [ 376.123128][T16081] ? __fget_files+0x2a/0x420 [ 376.123160][T16081] ? __fget_files+0x3a0/0x420 [ 376.123205][T16081] __x64_sys_sendmsg+0x1bd/0x2a0 [ 376.123238][T16081] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 376.123277][T16081] ? __pfx_ksys_write+0x10/0x10 [ 376.123316][T16081] do_syscall_64+0x14d/0xf80 [ 376.123353][T16081] ? trace_irq_disable+0x3b/0x150 [ 376.123373][T16081] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 376.123395][T16081] ? clear_bhb_loop+0x40/0x90 [ 376.123422][T16081] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 376.123453][T16081] RIP: 0033:0x7f361b39c799 [ 376.123475][T16081] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 376.123494][T16081] RSP: 002b:00007f361c1ba028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 376.123517][T16081] RAX: ffffffffffffffda RBX: 00007f361b615fa0 RCX: 00007f361b39c799 [ 376.123533][T16081] RDX: 0000000000000000 RSI: 00002000000000c0 RDI: 0000000000000003 [ 376.123547][T16081] RBP: 00007f361c1ba090 R08: 0000000000000000 R09: 0000000000000000 [ 376.123560][T16081] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 376.123572][T16081] R13: 00007f361b616038 R14: 00007f361b615fa0 R15: 00007ffc83349a08 [ 376.123606][T16081] [ 376.683971][T15885] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 376.925304][ T5835] Bluetooth: hci5: command tx timeout [ 377.153665][T15885] veth0_vlan: entered promiscuous mode [ 377.167157][T15885] veth1_vlan: entered promiscuous mode [ 377.202537][T15885] veth0_macvtap: entered promiscuous mode [ 377.212674][T15885] veth1_macvtap: entered promiscuous mode [ 377.232834][T15885] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 377.248369][T15885] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 377.263467][ T8255] netdevsim netdevsim4 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 377.274745][ T8255] netdevsim netdevsim4 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 377.294354][ T8255] netdevsim netdevsim4 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 377.304860][ T8255] netdevsim netdevsim4 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 378.996234][ T5835] Bluetooth: hci5: command tx timeout [ 379.012427][T16082] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 379.150564][ T49] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 379.170325][ T49] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 379.253827][ T8251] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 379.273150][ T8251] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 379.588879][T16144] netlink: 'syz.1.2697': attribute type 83 has an invalid length. [ 379.988675][T16166] netlink: 'syz.0.2703': attribute type 10 has an invalid length. [ 380.005734][T16166] netlink: 40 bytes leftover after parsing attributes in process `syz.0.2703'. [ 380.025738][T16166] team0: entered promiscuous mode [ 380.043718][T16166] C: entered promiscuous mode [ 380.062801][T16166] team_slave_1: entered promiscuous mode [ 380.082188][T16166] A link change request failed with some changes committed already. Interface team0 may have been left with an inconsistent configuration, please check. [ 380.125162][T16175] netlink: 212348 bytes leftover after parsing attributes in process `syz.2.2705'. [ 380.168262][T16175] netlink: Conntrack attr type has unexpected length (type=2, length=0, expected=2) [ 380.662583][T16195] netlink: 24 bytes leftover after parsing attributes in process `syz.3.2710'. [ 381.105932][T16217] netlink: 68 bytes leftover after parsing attributes in process `syz.1.2712'. [ 381.358404][T16209] wg1 speed is unknown, defaulting to 1000 [ 381.669406][T16222] netlink: 220 bytes leftover after parsing attributes in process `syz.3.2716'. [ 381.795883][ C1] ip6_tunnel: ip6gre2 xmit: Local address not yet configured! [ 381.808615][T16243] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 381.818355][T16243] openvswitch: netlink: EtherType 50a is less than min 600 [ 382.021177][T16209] lo speed is unknown, defaulting to 1000 [ 382.037407][T16209] lo speed is unknown, defaulting to 1000 [ 382.258803][T16242] tipc: Resetting bearer [ 382.292447][ T797] lo speed is unknown, defaulting to 1000 [ 382.329486][T16261] netlink: 'syz.4.2726': attribute type 1 has an invalid length. [ 382.357674][T16261] netlink: 236 bytes leftover after parsing attributes in process `syz.4.2726'. [ 382.376168][ T8251] bond3: (slave bridge4): link status up again after 0 ms [ 382.385764][ T8251] bond3: (slave bridge4): failed to get link speed/duplex [ 382.495805][ T8251] bond3: (slave bridge4): failed to get link speed/duplex [ 382.508493][T16271] netlink: 20 bytes leftover after parsing attributes in process `syz.4.2728'. [ 382.605838][ T8251] bond3: (slave bridge4): failed to get link speed/duplex [ 382.766265][ T8251] bond3: (slave bridge4): failed to get link speed/duplex [ 382.919669][ T8255] bond3: (slave bridge4): failed to get link speed/duplex [ 383.247561][T16301] netlink: 8 bytes leftover after parsing attributes in process `syz.2.2738'. [ 383.257010][T16301] netlink: 8 bytes leftover after parsing attributes in process `syz.2.2738'. [ 383.266382][T16301] netlink: 8 bytes leftover after parsing attributes in process `syz.2.2738'. [ 383.446395][T16306] wg1 speed is unknown, defaulting to 1000 [ 384.016541][T16321] veth1_macvtap: left promiscuous mode [ 384.123315][T16326] netlink: 'syz.1.2744': attribute type 2 has an invalid length. [ 384.523260][T16306] lo speed is unknown, defaulting to 1000 [ 384.532150][T16306] lo speed is unknown, defaulting to 1000 [ 384.646560][ T49] nci: nci_add_new_protocol: the target found does not have the desired protocol [ 384.861964][T16361] IPv6: NLM_F_CREATE should be specified when creating new route [ 384.870837][T16361] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 384.878213][T16361] IPv6: NLM_F_CREATE should be set when creating new route [ 384.885631][T16361] IPv6: NLM_F_CREATE should be set when creating new route [ 385.145718][ T49] net_ratelimit: 18 callbacks suppressed [ 385.145742][ T49] bond3: (slave bridge4): failed to get link speed/duplex [ 385.315956][ T8255] bond3: (slave bridge4): failed to get link speed/duplex [ 385.373116][T16365] netlink: 'syz.2.2754': attribute type 4 has an invalid length. [ 385.384041][ T797] lo speed is unknown, defaulting to 1000 [ 385.391027][ T797] syz2: Port: 1 Link DOWN [ 385.399010][T16365] netlink: 'syz.2.2754': attribute type 4 has an invalid length. [ 385.411203][ T797] lo speed is unknown, defaulting to 1000 [ 385.425790][ T797] syz2: Port: 1 Link ACTIVE [ 385.430465][ T8255] bond3: (slave bridge4): failed to get link speed/duplex [ 385.555893][ T8251] bond3: (slave bridge4): failed to get link speed/duplex [ 385.675837][ T8251] bond3: (slave bridge4): failed to get link speed/duplex [ 385.795769][ T9404] bond3: (slave bridge4): failed to get link speed/duplex [ 385.905788][ T8255] bond3: (slave bridge4): failed to get link speed/duplex [ 386.015809][ T9404] bond3: (slave bridge4): failed to get link speed/duplex [ 386.125909][ T49] bond3: (slave bridge4): failed to get link speed/duplex [ 386.235797][ T49] bond3: (slave bridge4): failed to get link speed/duplex [ 387.507797][T16344] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 387.912150][T16375] __nla_validate_parse: 4 callbacks suppressed [ 387.912173][T16375] netlink: 8 bytes leftover after parsing attributes in process `syz.3.2761'. [ 387.930020][T16375] netlink: 8 bytes leftover after parsing attributes in process `syz.3.2761'. [ 388.033138][T16383] sctp: [Deprecated]: syz.4.2762 (pid 16383) Use of int in maxseg socket option. [ 388.033138][T16383] Use struct sctp_assoc_value instead [ 388.277084][T16402] bond5: option primary: mode dependency failed, not supported in mode balance-rr(0) [ 388.320595][T16410] netlink: 'syz.4.2766': attribute type 3 has an invalid length. [ 388.323397][T16402] bond5 (unregistering): Released all slaves [ 388.354625][T16410] netlink: 48 bytes leftover after parsing attributes in process `syz.4.2766'. [ 388.436965][T16419] netlink: 64 bytes leftover after parsing attributes in process `syz.3.2768'. [ 388.520721][T16422] netlink: 32 bytes leftover after parsing attributes in process `syz.0.2769'. [ 388.541863][T16412] wg1 speed is unknown, defaulting to 1000 [ 388.593715][T16426] netlink: 146828 bytes leftover after parsing attributes in process `syz.4.2771'. [ 388.637284][T16428] netlink: 146828 bytes leftover after parsing attributes in process `syz.4.2771'. [ 388.724733][T16425] team0: Port device veth3 added [ 388.760626][T16432] netlink: 8 bytes leftover after parsing attributes in process `syz.0.2772'. [ 388.901747][T16432] sit3: entered allmulticast mode [ 389.171175][T16412] lo speed is unknown, defaulting to 1000 [ 389.200146][T16450] netlink: 211856 bytes leftover after parsing attributes in process `syz.0.2775'. [ 389.200972][T16412] lo speed is unknown, defaulting to 1000 [ 389.485403][T16466] geneve2: entered promiscuous mode [ 389.490891][T16466] geneve2: entered allmulticast mode [ 389.700077][T16473] netlink: 8 bytes leftover after parsing attributes in process `syz.0.2781'. [ 389.709387][T16473] IPVS: Unknown mcast interface: veth0_to_bond [ 390.050944][T16490] netlink: 'syz.3.2784': attribute type 1 has an invalid length. [ 390.123582][T16494] Freezing with imperfect legacy cgroup freezer. See cgroup.freeze of cgroup v2 [ 390.235719][ T9404] net_ratelimit: 29 callbacks suppressed [ 390.235741][ T9404] bond3: (slave bridge4): failed to get link speed/duplex [ 390.536245][ T8251] bond3: (slave bridge4): failed to get link speed/duplex [ 390.666021][ T9398] bond3: (slave bridge4): failed to get link speed/duplex [ 390.776250][ T9398] bond3: (slave bridge4): failed to get link speed/duplex [ 390.897849][ T8251] bond3: (slave bridge4): failed to get link speed/duplex [ 390.996784][T16525] bridge0: port 2(bridge_slave_1) entered disabled state [ 391.005833][T16525] bridge0: port 1(bridge_slave_0) entered disabled state [ 391.048425][ T9404] bond3: (slave bridge4): failed to get link speed/duplex [ 391.165878][ T9398] bond3: (slave bridge4): failed to get link speed/duplex [ 391.287166][ T8251] bond3: (slave bridge4): failed to get link speed/duplex [ 391.398009][ T8255] bond3: (slave bridge4): failed to get link speed/duplex [ 391.525752][ T8255] bond3: (slave bridge4): failed to get link speed/duplex [ 392.073593][T16607] netlink: 'syz.3.2815': attribute type 22 has an invalid length. [ 393.237435][T16638] __nla_validate_parse: 9 callbacks suppressed [ 393.237456][T16638] netlink: 76 bytes leftover after parsing attributes in process `syz.2.2822'. [ 393.327639][T16639] wg1 speed is unknown, defaulting to 1000 [ 393.987225][T16683] netlink: 312 bytes leftover after parsing attributes in process `syz.2.2829'. [ 394.295189][T16639] lo speed is unknown, defaulting to 1000 [ 394.317919][T16690] netlink: 'syz.3.2831': attribute type 3 has an invalid length. [ 394.341190][T16639] lo speed is unknown, defaulting to 1000 [ 394.406394][T16690] block nbd3: NBD_DISCONNECT [ 395.289145][ T8255] net_ratelimit: 27 callbacks suppressed [ 395.289178][ T8255] bond3: (slave bridge4): failed to get link speed/duplex [ 395.397288][ T1756] block nbd2: Possible stuck request ffff888027518000: control (read@0,1024B). Runtime 150 seconds [ 395.415761][ T1756] block nbd2: Possible stuck request ffff888027518200: control (read@1024,1024B). Runtime 150 seconds [ 395.433508][ T1756] block nbd2: Possible stuck request ffff888027518400: control (read@2048,1024B). Runtime 150 seconds [ 395.445190][ T9404] bond3: (slave bridge4): failed to get link speed/duplex [ 395.452968][ T1756] block nbd2: Possible stuck request ffff888027518600: control (read@3072,1024B). Runtime 150 seconds [ 395.571188][T16720] netlink: 'syz.2.2837': attribute type 2 has an invalid length. [ 395.654948][T16720] netlink: 'syz.2.2837': attribute type 1 has an invalid length. [ 395.681249][T16720] netlink: 224 bytes leftover after parsing attributes in process `syz.2.2837'. [ 395.764118][ T8255] bond3: (slave bridge4): failed to get link speed/duplex [ 395.925843][ T8255] bond3: (slave bridge4): failed to get link speed/duplex [ 395.984416][T16728] netlink: 'syz.1.2840': attribute type 1 has an invalid length. [ 396.001522][T16728] netlink: 728 bytes leftover after parsing attributes in process `syz.1.2840'. [ 396.012760][T16728] netlink: 8 bytes leftover after parsing attributes in process `syz.1.2840'. [ 396.045879][ T8255] bond3: (slave bridge4): failed to get link speed/duplex [ 396.155730][ T9404] bond3: (slave bridge4): failed to get link speed/duplex [ 396.218976][T16734] wg1 speed is unknown, defaulting to 1000 [ 396.337283][ T9398] bond3: (slave bridge4): failed to get link speed/duplex [ 396.445810][ T9404] bond3: (slave bridge4): failed to get link speed/duplex [ 396.501702][T16746] netlink: 16 bytes leftover after parsing attributes in process `syz.1.2845'. [ 396.570869][ T8257] bond3: (slave bridge4): failed to get link speed/duplex [ 396.693856][T16755] netlink: 'syz.1.2847': attribute type 1 has an invalid length. [ 396.702429][ T9404] bond3: (slave bridge4): failed to get link speed/duplex [ 396.712727][T16734] lo speed is unknown, defaulting to 1000 [ 396.728232][T16755] netlink: 96 bytes leftover after parsing attributes in process `syz.1.2847'. [ 396.748591][T16734] lo speed is unknown, defaulting to 1000 [ 396.758243][T16755] netlink: 1 bytes leftover after parsing attributes in process `syz.1.2847'. [ 396.772758][T16755] netlink: 658 bytes leftover after parsing attributes in process `syz.1.2847'. [ 396.823932][T16760] sctp: [Deprecated]: syz.3.2850 (pid 16760) Use of int in max_burst socket option. [ 396.823932][T16760] Use struct sctp_assoc_value instead [ 397.029436][T16774] netlink: 12 bytes leftover after parsing attributes in process `syz.1.2852'. [ 397.512457][T16792] wg1 speed is unknown, defaulting to 1000 [ 398.042336][T16792] lo speed is unknown, defaulting to 1000 [ 398.050216][T16792] lo speed is unknown, defaulting to 1000 [ 398.398867][T16822] netlink: 'syz.0.2862': attribute type 1 has an invalid length. [ 398.533996][T16822] 8021q: adding VLAN 0 to HW filter on device bond4 [ 398.611890][T16822] __nla_validate_parse: 1 callbacks suppressed [ 398.611914][T16822] netlink: 14 bytes leftover after parsing attributes in process `syz.0.2862'. [ 398.709763][T16825] bond4: (slave veth11): Enslaving as an active interface with a down link [ 398.743244][T16829] bond4: (slave dummy0): making interface the new active one [ 398.774652][T16829] dummy0: entered promiscuous mode [ 398.784988][T16829] bond4: (slave dummy0): Enslaving as an active interface with an up link [ 398.812569][T16822] bond4: (slave dummy0): Releasing active interface [ 398.824947][T16822] dummy0 (unregistering): left promiscuous mode [ 398.927440][T16843] netlink: 'syz.2.2866': attribute type 7 has an invalid length. [ 398.937001][T16843] netlink: 'syz.2.2866': attribute type 8 has an invalid length. [ 399.001539][ T5492] veth0_macvtap: left promiscuous mode [ 399.112209][T16833] wg1 speed is unknown, defaulting to 1000 [ 399.550248][T16849] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 399.560862][T16849] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 399.575829][T16849] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 399.593379][T16849] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 399.624731][T16849] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 400.032001][T16847] wg1 speed is unknown, defaulting to 1000 [ 400.073434][T16870] netlink: 44 bytes leftover after parsing attributes in process `syz.1.2872'. [ 400.248293][T16876] veth0_virt_wifi: entered allmulticast mode [ 400.385773][ T9404] net_ratelimit: 22 callbacks suppressed [ 400.385796][ T9404] bond3: (slave bridge4): failed to get link speed/duplex [ 400.411342][T16879] tipc: Started in network mode [ 400.422274][T16879] tipc: Node identity ac14140f, cluster identity 4711 [ 400.438846][T16879] tipc: New replicast peer: 255.255.255.255 [ 400.456181][T16879] tipc: Enabled bearer , priority 26 [ 400.527190][ T49] bond3: (slave bridge4): failed to get link speed/duplex [ 400.613576][T16847] lo speed is unknown, defaulting to 1000 [ 400.630876][T16833] lo speed is unknown, defaulting to 1000 [ 400.645720][ T49] bond3: (slave bridge4): failed to get link speed/duplex [ 400.673275][T16847] lo speed is unknown, defaulting to 1000 [ 400.718041][T16891] netlink: 8 bytes leftover after parsing attributes in process `syz.4.2876'. [ 400.922831][ T9404] bond3: (slave bridge4): failed to get link speed/duplex [ 401.055725][ T9404] bond3: (slave bridge4): failed to get link speed/duplex [ 401.234324][T16907] 8021q: adding VLAN 0 to HW filter on device bond8 [ 401.261526][ T9404] bond3: (slave bridge4): failed to get link speed/duplex [ 401.310262][T16907] bond8: (slave ip6gretap1): making interface the new active one [ 401.321526][T16907] bond8: (slave ip6gretap1): Enslaving as an active interface with an up link [ 401.349496][T16915] netlink: 44 bytes leftover after parsing attributes in process `syz.4.2881'. [ 401.395724][ T9404] bond3: (slave bridge4): failed to get link speed/duplex [ 401.490590][T16833] lo speed is unknown, defaulting to 1000 [ 401.571798][ T8661] tipc: Node number set to 2886997007 [ 401.625740][ T8257] bond3: (slave bridge4): failed to get link speed/duplex [ 401.716698][T16849] Bluetooth: hci3: command tx timeout [ 401.846616][T16934] vlan3: entered promiscuous mode [ 401.862351][T16934] geneve1: entered promiscuous mode [ 401.887225][T16934] vlan3: entered allmulticast mode [ 401.912544][T16934] geneve1: entered allmulticast mode [ 401.927621][ T8257] bond3: (slave bridge4): failed to get link speed/duplex [ 401.943777][T16847] chnl_net:caif_netlink_parms(): no params data found [ 402.320308][T16943] netlink: 4 bytes leftover after parsing attributes in process `syz.0.2888'. [ 402.552615][T16959] netlink: 'syz.1.2892': attribute type 89 has an invalid length. [ 402.590603][T16959] netlink: 116 bytes leftover after parsing attributes in process `syz.1.2892'. [ 402.601030][ T8257] bond3: (slave bridge4): failed to get link speed/duplex [ 402.846147][T16847] bridge0: port 1(bridge_slave_0) entered blocking state [ 402.863648][T16847] bridge0: port 1(bridge_slave_0) entered disabled state [ 402.879960][T16847] bridge_slave_0: entered allmulticast mode [ 402.916986][T16847] bridge_slave_0: entered promiscuous mode [ 402.926771][T16847] bridge0: port 2(bridge_slave_1) entered blocking state [ 402.934137][T16847] bridge0: port 2(bridge_slave_1) entered disabled state [ 402.954615][T16847] bridge_slave_1: entered allmulticast mode [ 402.978455][T16847] bridge_slave_1: entered promiscuous mode [ 403.304784][T16976] netlink: 8 bytes leftover after parsing attributes in process `syz.0.2895'. [ 403.382774][ T8255] netdevsim netdevsim2 eth3 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 403.394849][ T8255] netdevsim netdevsim2 eth3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 403.407841][T16980] netlink: 8 bytes leftover after parsing attributes in process `syz.4.2896'. [ 403.477696][T16847] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 403.513326][T16847] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 403.588111][ T8255] netdevsim netdevsim2 eth2 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 403.615180][ T8255] netdevsim netdevsim2 eth2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 403.750673][ T8255] netdevsim netdevsim2 eth1 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 403.785969][ T8255] netdevsim netdevsim2 eth1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 403.803022][ T5835] Bluetooth: hci3: command tx timeout [ 403.864045][T16847] team0: Port device team_slave_0 added [ 403.884545][T16847] team0: Port device team_slave_1 added [ 403.907671][ T8255] netdevsim netdevsim2 eth0 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 403.917962][ T8255] netdevsim netdevsim2 eth0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 404.021148][T16847] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 404.035951][T16847] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 404.111262][T16847] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 404.138426][T16847] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 404.145436][T16847] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 404.224236][T16847] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 404.293840][T17014] netlink: 8 bytes leftover after parsing attributes in process `syz.1.2905'. [ 404.328507][T17014] vlan4: entered allmulticast mode [ 404.333789][T17014] bond0: entered allmulticast mode [ 404.347877][T17016] netlink: 14 bytes leftover after parsing attributes in process `syz.1.2905'. [ 404.410877][T17018] netlink: 8 bytes leftover after parsing attributes in process `syz.0.2906'. [ 404.444828][T16847] hsr_slave_0: entered promiscuous mode [ 404.462318][T16847] hsr_slave_1: entered promiscuous mode [ 404.486780][T16847] debugfs: 'hsr0' already exists in 'hsr' [ 404.502842][T16847] Cannot create hsr debugfs directory [ 404.727220][T17028] netlink: 32 bytes leftover after parsing attributes in process `syz.4.2910'. [ 404.770361][T17028] netlink: 28 bytes leftover after parsing attributes in process `syz.4.2910'. [ 404.954065][T17035] netlink: 312 bytes leftover after parsing attributes in process `syz.1.2911'. [ 405.541842][ T8255] bond3 (unregistering): (slave bridge4): Removing an active aggregator [ 405.553841][ T8255] bond3 (unregistering): (slave bridge4): Releasing backup interface [ 405.562595][ T8255] bond3 (unregistering): (slave bridge4): the permanent HWaddr of slave - 42:28:0f:d5:a2:5c - is still in use by bond - set the HWaddr of slave to a different address to avoid conflicts [ 405.581587][ T8255] bridge4 (unregistering): left promiscuous mode [ 405.588463][ T8255] bridge4 (unregistering): left allmulticast mode [ 405.651402][ T8255] bond3 (unregistering): (slave bridge5): Releasing backup interface [ 405.660302][ T8255] bridge5 (unregistering): left promiscuous mode [ 405.669412][ T8255] bridge5 (unregistering): left allmulticast mode [ 405.801660][ T8255] bond1 (unregistering): Released all slaves [ 405.816586][ T8255] bond2 (unregistering): Released all slaves [ 405.831468][ T8255] bond0 (unregistering): Released all slaves [ 405.847262][ T8255] bond3 (unregistering): Released all slaves [ 405.867979][ T8255] bond4 (unregistering): Released all slaves [ 405.876423][ T5835] Bluetooth: hci3: command 0x040f tx timeout [ 405.907017][T17033] netlink: 24 bytes leftover after parsing attributes in process `syz.1.2911'. [ 405.923229][T17024] netlink: 'syz.3.2909': attribute type 4 has an invalid length. [ 406.033961][T17054] Cannot find del_set index 3 as target [ 406.137700][ T8255] tipc: Disabling bearer [ 406.203186][ T8255] tipc: Disabling bearer [ 406.220283][ T8255] tipc: Disabling bearer [ 406.230047][ T8255] tipc: Left network mode [ 406.301841][T17062] netlink: 'syz.4.2919': attribute type 11 has an invalid length. [ 406.344748][T17060] netlink: 8 bytes leftover after parsing attributes in process `syz.1.2918'. [ 406.355508][T17067] netlink: 'syz.4.2919': attribute type 1 has an invalid length. [ 406.374130][T17067] netlink: 128 bytes leftover after parsing attributes in process `syz.4.2919'. [ 406.406424][ T8255] IPVS: stopping backup sync thread 9735 ... [ 407.267542][T17105] block nbd3: Unsupported socket: should be TCP or UNIX. [ 407.315942][T17105] netlink: 156 bytes leftover after parsing attributes in process `syz.4.2926'. [ 407.956050][T16849] Bluetooth: hci3: command 0x040f tx timeout [ 408.174412][T17119] xfrm0: entered promiscuous mode [ 408.216907][T17119] xfrm0: entered allmulticast mode [ 408.480629][T17135] wg1 speed is unknown, defaulting to 1000 [ 408.664818][T16847] netdevsim netdevsim2 netdevsim0: renamed from eth0 [ 408.718556][T16847] netdevsim netdevsim2 netdevsim1: renamed from eth1 [ 408.779529][T16847] netdevsim netdevsim2 netdevsim2: renamed from eth2 [ 408.809161][T16847] netdevsim netdevsim2 netdevsim3: renamed from eth3 [ 409.091268][T17135] lo speed is unknown, defaulting to 1000 [ 409.148929][T17135] lo speed is unknown, defaulting to 1000 [ 409.189078][T16847] 8021q: adding VLAN 0 to HW filter on device bond0 [ 409.235255][T17174] netlink: 'syz.4.2940': attribute type 15 has an invalid length. [ 409.298299][T17175] syzkaller0: entered promiscuous mode [ 409.314234][T17175] syzkaller0: entered allmulticast mode [ 409.347927][T16847] 8021q: adding VLAN 0 to HW filter on device team0 [ 409.553459][ T9402] bridge0: port 1(bridge_slave_0) entered blocking state [ 409.560703][ T9402] bridge0: port 1(bridge_slave_0) entered forwarding state [ 409.699554][ T9402] bridge0: port 2(bridge_slave_1) entered blocking state [ 409.706909][ T9402] bridge0: port 2(bridge_slave_1) entered forwarding state [ 410.036620][T16849] Bluetooth: hci3: command 0x040f tx timeout [ 410.419615][T17208] __nla_validate_parse: 1 callbacks suppressed [ 410.419639][T17208] netlink: 8 bytes leftover after parsing attributes in process `syz.4.2947'. [ 410.451324][ T8255] hsr_slave_0: left promiscuous mode [ 410.466182][ T8255] hsr_slave_1: left promiscuous mode [ 410.490093][ T8255] veth0_macvtap: left promiscuous mode [ 410.499043][ T8255] veth1_vlan: left promiscuous mode [ 410.504595][ T8255] veth0_vlan: left promiscuous mode [ 410.596318][ C1] ip6_tunnel: ip6gre2 xmit: Local address not yet configured! [ 411.236042][T17241] netlink: 28 bytes leftover after parsing attributes in process `syz.0.2953'. [ 411.319101][ T5816] lo speed is unknown, defaulting to 1000 [ 411.327606][ T5816] syz2: Port: 1 Link DOWN [ 411.404611][T17241] vlan2: entered promiscuous mode [ 411.430606][T17241] veth0_to_team: entered promiscuous mode [ 411.465933][T17241] vlan2: entered allmulticast mode [ 411.471135][T17241] veth0_to_team: entered allmulticast mode [ 411.541445][T16847] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 411.574328][T17246] netlink: 'syz.4.2955': attribute type 1 has an invalid length. [ 411.580399][T17247] netlink: 'syz.4.2955': attribute type 1 has an invalid length. [ 411.729862][T17252] netlink: 228 bytes leftover after parsing attributes in process `syz.0.2956'. [ 411.773144][T17247] 8021q: adding VLAN 0 to HW filter on device bond1 [ 411.823981][T17248] ipvlan2: entered promiscuous mode [ 411.856300][T17248] ipvlan2: entered allmulticast mode [ 411.861672][T17248] bond1: entered allmulticast mode [ 412.002941][T17257] wg1 speed is unknown, defaulting to 1000 [ 412.054236][T16847] veth0_vlan: entered promiscuous mode [ 412.079503][T17266] netlink: 8 bytes leftover after parsing attributes in process `syz.4.2960'. [ 412.158568][T16847] veth1_vlan: entered promiscuous mode [ 412.229994][T17273] netlink: 12 bytes leftover after parsing attributes in process `syz.0.2959'. [ 412.369367][T16847] veth0_macvtap: entered promiscuous mode [ 412.383276][T17276] netlink: 4 bytes leftover after parsing attributes in process `syz.4.2961'. [ 412.409298][T16847] veth1_macvtap: entered promiscuous mode [ 412.412489][ T8255] IPVS: stop unused estimator thread 0... [ 412.460967][T16847] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 412.515403][T16847] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 412.560635][ T9398] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 412.613110][ T9398] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 412.623493][ T9398] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 412.664584][ T9398] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 413.001803][ T8251] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 413.004385][T17294] netlink: 312 bytes leftover after parsing attributes in process `syz.0.2966'. [ 413.045653][ T8251] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 413.112359][T17257] lo speed is unknown, defaulting to 1000 [ 413.139598][ T8253] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 413.157768][ T8253] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 413.242922][T17300] netlink: 'syz.4.2968': attribute type 83 has an invalid length. [ 413.375728][T17300] nbd3: detected capacity change from 0 to 63 [ 413.392959][T16849] block nbd3: Receive control failed (result -104) [ 413.414450][T17301] 8021q: adding VLAN 0 to HW filter on device macvlan1 [ 414.089784][T17326] wg1 speed is unknown, defaulting to 1000 [ 414.136823][T17338] x_tables: duplicate underflow at hook 1 [ 414.309013][T17343] IPVS: Schedule: port zero only supported in persistent services, check your ipvs configuration [ 414.331864][T17340] netlink: 4 bytes leftover after parsing attributes in process `syz.3.2977'. [ 414.354660][T17340] tipc: Enabling of bearer rejected, already enabled [ 414.381705][T17344] netlink: 312 bytes leftover after parsing attributes in process `syz.4.2978'. [ 414.611967][T17351] ipt_ECN: cannot use operation on non-tcp rule [ 414.637541][T17326] lo speed is unknown, defaulting to 1000 [ 414.795034][T17368] netlink: 36 bytes leftover after parsing attributes in process `syz.4.2982'. [ 414.835330][T17368] netlink: 'syz.4.2982': attribute type 1 has an invalid length. [ 414.942730][ T5492] veth0_vlan: left promiscuous mode [ 415.001819][ T5492] veth0_vlan: entered promiscuous mode [ 415.087749][T17375] 8021q: adding VLAN 0 to HW filter on device bond12 [ 415.259532][T17354] wg1 speed is unknown, defaulting to 1000 [ 416.025377][T17411] netlink: 'syz.4.2989': attribute type 39 has an invalid length. [ 416.213244][T17354] lo speed is unknown, defaulting to 1000 [ 416.249208][T17420] __nla_validate_parse: 4 callbacks suppressed [ 416.249231][T17420] netlink: 72 bytes leftover after parsing attributes in process `syz.3.2991'. [ 416.459305][T17428] netlink: 12 bytes leftover after parsing attributes in process `syz.3.2993'. [ 416.616934][T17435] netlink: 'syz.3.2995': attribute type 4 has an invalid length. [ 416.634266][T17435] netlink: 'syz.3.2995': attribute type 4 has an invalid length. [ 417.583896][T17458] netlink: 12 bytes leftover after parsing attributes in process `syz.3.2999'. [ 417.607623][T17459] netlink: 12 bytes leftover after parsing attributes in process `syz.3.2999'. [ 418.074616][T17477] netlink: 8 bytes leftover after parsing attributes in process `syz.3.3002'. [ 418.156801][T17470] wg1 speed is unknown, defaulting to 1000 [ 418.548034][T17489] netlink: 'syz.3.3002': attribute type 1 has an invalid length. [ 418.618702][T17470] lo speed is unknown, defaulting to 1000 [ 419.069431][T17507] tipc: Enabling of bearer rejected, already enabled [ 419.076987][T17515] netlink: 8 bytes leftover after parsing attributes in process `syz.0.3010'. [ 419.611053][T17548] ip6tnl3: entered allmulticast mode [ 420.020065][T17564] net_ratelimit: 5 callbacks suppressed [ 420.020085][T17564] IPVS: sh: FWM 3 0x00000003 - no destination available [ 420.037895][ C1] IPVS: sh: FWM 3 0x00000003 - no destination available [ 420.191662][T17561] wg1 speed is unknown, defaulting to 1000 [ 420.360137][T17576] x_tables: ip_tables: ah match: only valid for protocol 51 [ 420.803330][T17586] tipc: Enabled bearer , priority 0 [ 420.855009][T17588] netlink: 8 bytes leftover after parsing attributes in process `syz.2.3024'. [ 420.880859][T17586] syzkaller0: entered promiscuous mode [ 420.887096][T17586] syzkaller0: entered allmulticast mode [ 420.893739][T17586] tipc: Resetting bearer [ 420.991386][T17585] tipc: Resetting bearer [ 421.088510][T17594] netlink: 24 bytes leftover after parsing attributes in process `syz.1.3026'. [ 421.496833][T17610] netlink: 12 bytes leftover after parsing attributes in process `syz.2.3025'. [ 422.797809][T17585] tipc: Disabling bearer [ 422.815458][T17561] lo speed is unknown, defaulting to 1000 [ 422.987643][T17619] netlink: 312 bytes leftover after parsing attributes in process `syz.4.3030'. [ 422.999908][T17619] FAULT_INJECTION: forcing a failure. [ 422.999908][T17619] name failslab, interval 1, probability 0, space 0, times 0 [ 423.016920][T17619] CPU: 0 UID: 0 PID: 17619 Comm: syz.4.3030 Not tainted syzkaller #0 PREEMPT(full) [ 423.016949][T17619] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 423.016963][T17619] Call Trace: [ 423.016972][T17619] [ 423.016981][T17619] dump_stack_lvl+0xe8/0x150 [ 423.017018][T17619] should_fail_ex+0x412/0x560 [ 423.017057][T17619] should_failslab+0xa8/0x100 [ 423.017088][T17619] __kmalloc_cache_noprof+0x88/0x660 [ 423.017115][T17619] ? nft_netdev_hook_alloc+0x5a/0x570 [ 423.017284][T17619] nft_netdev_hook_alloc+0x5a/0x570 [ 423.017331][T17619] nf_tables_parse_netdev_hooks+0x138/0x950 [ 423.017366][T17619] nft_flowtable_parse_hook+0x46a/0x920 [ 423.017404][T17619] ? __pfx_nft_flowtable_parse_hook+0x10/0x10 [ 423.017432][T17619] ? nft_pernet+0x23/0x240 [ 423.017503][T17619] nf_tables_delflowtable+0xa80/0x1980 [ 423.017547][T17619] ? __pfx_nf_tables_delflowtable+0x10/0x10 [ 423.017597][T17619] ? __nla_parse+0x40/0x60 [ 423.017624][T17619] nfnetlink_rcv+0x1240/0x27b0 [ 423.017703][T17619] ? __pfx_nfnetlink_rcv+0x10/0x10 [ 423.017741][T17619] ? ref_tracker_free+0x693/0x840 [ 423.017792][T17619] ? __netlink_deliver_tap+0x807/0x850 [ 423.017817][T17619] ? netlink_deliver_tap+0x2e/0x1b0 [ 423.017860][T17619] netlink_unicast+0x80f/0x9b0 [ 423.017903][T17619] ? __pfx_netlink_unicast+0x10/0x10 [ 423.017939][T17619] ? netlink_sendmsg+0x650/0xb40 [ 423.017961][T17619] ? skb_put+0x11b/0x210 [ 423.017991][T17619] netlink_sendmsg+0x813/0xb40 [ 423.018025][T17619] ? __pfx_netlink_sendmsg+0x10/0x10 [ 423.018053][T17619] ? aa_sock_msg_perm+0xf1/0x1b0 [ 423.018088][T17619] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 423.018117][T17619] ____sys_sendmsg+0x972/0x9f0 [ 423.018156][T17619] ? __pfx_____sys_sendmsg+0x10/0x10 [ 423.018195][T17619] ? import_iovec+0x73/0xa0 [ 423.018231][T17619] ___sys_sendmsg+0x2a5/0x360 [ 423.018266][T17619] ? __pfx____sys_sendmsg+0x10/0x10 [ 423.018335][T17619] ? __fget_files+0x2a/0x420 [ 423.018366][T17619] ? __fget_files+0x3a0/0x420 [ 423.018410][T17619] __x64_sys_sendmsg+0x1bd/0x2a0 [ 423.018442][T17619] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 423.018481][T17619] ? __pfx_ksys_write+0x10/0x10 [ 423.018519][T17619] do_syscall_64+0x14d/0xf80 [ 423.018551][T17619] ? trace_irq_disable+0x3b/0x150 [ 423.018575][T17619] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 423.018598][T17619] ? clear_bhb_loop+0x40/0x90 [ 423.018624][T17619] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 423.018646][T17619] RIP: 0033:0x7fcf5879c799 [ 423.018668][T17619] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 423.018687][T17619] RSP: 002b:00007fcf596dc028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 423.018710][T17619] RAX: ffffffffffffffda RBX: 00007fcf58a15fa0 RCX: 00007fcf5879c799 [ 423.018726][T17619] RDX: 0000000000000000 RSI: 0000200000000200 RDI: 0000000000000003 [ 423.018740][T17619] RBP: 00007fcf596dc090 R08: 0000000000000000 R09: 0000000000000000 [ 423.018753][T17619] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 423.018766][T17619] R13: 00007fcf58a16038 R14: 00007fcf58a15fa0 R15: 00007ffed0039fb8 [ 423.018802][T17619] [ 423.401386][T17621] netlink: 24 bytes leftover after parsing attributes in process `syz.0.3031'. [ 423.444848][T17625] netlink: 'syz.2.3033': attribute type 10 has an invalid length. [ 423.462474][T17625] netlink: 40 bytes leftover after parsing attributes in process `syz.2.3033'. [ 423.515929][T17625] dummy0: entered promiscuous mode [ 423.546917][T17632] netlink: 8 bytes leftover after parsing attributes in process `syz.4.3035'. [ 423.581055][T17625] bridge0: port 3(dummy0) entered blocking state [ 423.602292][T17625] bridge0: port 3(dummy0) entered disabled state [ 423.609620][T17625] dummy0: entered allmulticast mode [ 423.619585][T17625] bridge0: port 3(dummy0) entered blocking state [ 423.626128][T17625] bridge0: port 3(dummy0) entered forwarding state [ 423.707734][T17636] netlink: 8 bytes leftover after parsing attributes in process `syz.0.3036'. [ 423.723008][T17625] bridge0: port 4(syz_tun) entered blocking state [ 423.730298][T17625] bridge0: port 4(syz_tun) entered disabled state [ 423.740888][T17625] syz_tun: entered allmulticast mode [ 423.749970][T17625] syz_tun: entered promiscuous mode [ 423.766161][T17625] bridge0: port 4(syz_tun) entered blocking state [ 423.773174][T17625] bridge0: port 4(syz_tun) entered forwarding state [ 423.955079][ T5197] udevd[5197]: worker [10535] /devices/virtual/block/nbd2 timeout; kill it [ 423.972270][ T5197] udevd[5197]: seq 16732 '/devices/virtual/block/nbd2' killed [ 424.786224][T17665] bond2: option lp_interval: invalid value (0) [ 424.818798][T17665] bond2: option lp_interval: allowed values 1 - 2147483647 [ 424.865225][T17665] bond2 (unregistering): Released all slaves [ 424.977282][T17675] netlink: 16 bytes leftover after parsing attributes in process `syz.1.3045'. [ 425.195534][T17679] netlink: 8 bytes leftover after parsing attributes in process `syz.2.3047'. [ 425.217723][T17684] IPVS: sh: FWM 3 0x00000003 - no destination available [ 425.225105][ C1] IPVS: sh: FWM 3 0x00000003 - no destination available [ 425.406124][T17693] wg1 speed is unknown, defaulting to 1000 [ 425.588338][T17705] netlink: 8 bytes leftover after parsing attributes in process `syz.3.3052'. [ 425.597811][T17705] netlink: 4 bytes leftover after parsing attributes in process `syz.3.3052'. [ 425.609065][T17705] netlink: 'syz.3.3052': attribute type 6 has an invalid length. [ 425.619340][T17705] netlink: 'syz.3.3052': attribute type 6 has an invalid length. [ 425.774813][T17693] lo speed is unknown, defaulting to 1000 [ 425.973102][ T1756] block nbd2: Possible stuck request ffff888027518000: control (read@0,1024B). Runtime 180 seconds [ 425.984477][ T1756] block nbd2: Possible stuck request ffff888027518200: control (read@1024,1024B). Runtime 180 seconds [ 425.995715][ T1756] block nbd2: Possible stuck request ffff888027518400: control (read@2048,1024B). Runtime 180 seconds [ 426.006845][ T1756] block nbd2: Possible stuck request ffff888027518600: control (read@3072,1024B). Runtime 180 seconds [ 426.124663][T17686] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 426.556536][T17734] __nla_validate_parse: 2 callbacks suppressed [ 426.556559][T17734] netlink: 4 bytes leftover after parsing attributes in process `syz.0.3057'. [ 426.864551][T17749] xt_hashlimit: size too large, truncated to 1048576 [ 426.898441][T17749] xt_hashlimit: max too large, truncated to 1048576 [ 426.906323][T16849] Bluetooth: hci5: link tx timeout [ 426.913120][T16849] Bluetooth: hci5: killing stalled connection 11:aa:aa:aa:aa:aa [ 426.956223][T17748] netlink: 4 bytes leftover after parsing attributes in process `syz.0.3061'. [ 427.254912][T17758] netlink: 8 bytes leftover after parsing attributes in process `syz.1.3064'. [ 427.264616][T17758] netlink: 24 bytes leftover after parsing attributes in process `syz.1.3064'. [ 427.597315][T17769] netlink: 'syz.1.3067': attribute type 1 has an invalid length. [ 427.623384][T17769] netlink: 228 bytes leftover after parsing attributes in process `syz.1.3067'. [ 427.657346][T17774] sctp: [Deprecated]: syz.1.3067 (pid 17774) Use of int in max_burst socket option deprecated. [ 427.657346][T17774] Use struct sctp_assoc_value instead [ 427.676003][T17773] syzkaller0: entered promiscuous mode [ 427.685688][T17773] syzkaller0: entered allmulticast mode [ 427.700561][T17773] PF_CAN: dropped non conform CAN FD skbuff: dev type 280, len 65487 [ 427.816418][T17777] netlink: 12 bytes leftover after parsing attributes in process `syz.2.3070'. [ 428.132350][T17798] netlink: 'syz.4.3077': attribute type 10 has an invalid length. [ 428.163674][T17795] netlink: 80 bytes leftover after parsing attributes in process `syz.1.3076'. [ 428.184233][T17798] bond0: (slave dummy0): Enslaving as an active interface with an up link [ 428.425818][T17816] netlink: 8 bytes leftover after parsing attributes in process `syz.4.3082'. [ 428.479047][T17823] netlink: 96 bytes leftover after parsing attributes in process `syz.4.3082'. [ 428.721039][T17838] netlink: 28 bytes leftover after parsing attributes in process `syz.4.3089'. [ 428.833689][T17803] tipc: Resetting bearer [ 428.997976][T16849] Bluetooth: hci5: command 0x0406 tx timeout [ 429.184531][T17861] veth0_vlan: left promiscuous mode [ 429.223904][T17865] netlink: 'syz.4.3098': attribute type 1 has an invalid length. [ 429.255920][T17865] netlink: 'syz.4.3098': attribute type 2 has an invalid length. [ 429.276512][T17865] netlink: 'syz.4.3098': attribute type 1 has an invalid length. [ 429.450784][T17878] netlink: 'syz.4.3100': attribute type 34 has an invalid length. [ 430.066926][T16849] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 430.077821][T16849] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 430.088378][T16849] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 430.104665][T16849] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 430.113820][T16849] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 430.159272][T17867] delete_channel: no stack [ 430.200411][T17910] wg1 speed is unknown, defaulting to 1000 [ 430.546158][T17901] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 430.602944][T17910] lo speed is unknown, defaulting to 1000 [ 431.287710][T17959] netlink: 'syz.0.3119': attribute type 1 has an invalid length. [ 431.699596][T17971] __nla_validate_parse: 14 callbacks suppressed [ 431.699621][T17971] netlink: 8 bytes leftover after parsing attributes in process `syz.4.3121'. [ 432.159902][T17986] wg1 speed is unknown, defaulting to 1000 [ 432.199036][T16849] Bluetooth: hci1: command tx timeout [ 432.325198][T17910] chnl_net:caif_netlink_parms(): no params data found [ 432.470087][T17994] netlink: 12 bytes leftover after parsing attributes in process `syz.2.3128'. [ 432.502704][T17994] tipc: Started in network mode [ 432.538623][T17994] tipc: Node identity 7f000001, cluster identity 4711 [ 432.556921][T17994] tipc: Enabling of bearer rejected, failed to enable media [ 432.610423][T17998] netlink: 36 bytes leftover after parsing attributes in process `syz.2.3128'. [ 432.619905][T17986] lo speed is unknown, defaulting to 1000 [ 432.719135][T17910] bridge0: port 1(bridge_slave_0) entered blocking state [ 432.726611][T17910] bridge0: port 1(bridge_slave_0) entered disabled state [ 432.734001][T17910] bridge_slave_0: entered allmulticast mode [ 432.761707][T17910] bridge_slave_0: entered promiscuous mode [ 432.777309][T18006] netlink: 20 bytes leftover after parsing attributes in process `syz.2.3131'. [ 432.808408][T17910] bridge0: port 2(bridge_slave_1) entered blocking state [ 432.826088][T17910] bridge0: port 2(bridge_slave_1) entered disabled state [ 432.833439][T17910] bridge_slave_1: entered allmulticast mode [ 432.880623][T17910] bridge_slave_1: entered promiscuous mode [ 433.018621][T17910] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 433.057069][T17910] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 433.252629][ T49] veth5: left allmulticast mode [ 433.276371][ T49] veth5: left promiscuous mode [ 433.287949][ T49] bridge2: port 3(veth5) entered disabled state [ 433.311819][ T49] veth3: left allmulticast mode [ 433.317760][ T49] veth3: left promiscuous mode [ 433.322890][ T49] bridge2: port 1(veth3) entered disabled state [ 433.500116][ T49] bond8 (unregistering): (slave ip6gretap1): Releasing active interface [ 433.541492][T18033] netlink: 4 bytes leftover after parsing attributes in process `syz.0.3135'. [ 433.553025][T18033] netlink: 4 bytes leftover after parsing attributes in process `syz.0.3135'. [ 433.734819][T18035] netlink: 24 bytes leftover after parsing attributes in process `syz.4.3136'. [ 433.870920][ T49] bond1 (unregistering): Released all slaves [ 433.886559][ T49] bond2 (unregistering): Released all slaves [ 433.903666][ T49] bond3 (unregistering): Released all slaves [ 433.919393][ T49] bond4 (unregistering): Released all slaves [ 433.945238][ T49] bond5 (unregistering): Released all slaves [ 433.969843][ T49] bond0 (unregistering): (slave veth9): Releasing active interface [ 433.979187][ T49] bond0 (unregistering): Released all slaves [ 433.995001][ T49] bond6 (unregistering): Released all slaves [ 434.020593][ T49] bond7 (unregistering): Released all slaves [ 434.036037][ T49] bond8 (unregistering): Released all slaves [ 434.054561][T17910] team0: Port device team_slave_0 added [ 434.151003][T17910] team0: Port device team_slave_1 added [ 434.257888][ T49] tipc: Disabling bearer [ 434.263344][ T49] tipc: Left network mode [ 434.291102][T16849] Bluetooth: hci1: command tx timeout [ 434.328313][T18022] wg1 speed is unknown, defaulting to 1000 [ 434.336940][T17910] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 434.343943][T17910] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 434.384858][T17910] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 434.428276][ T49] IPVS: stopping backup sync thread 10031 ... [ 434.544342][T17910] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 434.554795][T17910] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 434.558624][T18042] Cannot find del_set index 0 as target [ 434.592827][T17910] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 434.759639][T17910] hsr_slave_0: entered promiscuous mode [ 434.766701][T17910] hsr_slave_1: entered promiscuous mode [ 434.773194][T17910] debugfs: 'hsr0' already exists in 'hsr' [ 434.779947][T17910] Cannot create hsr debugfs directory [ 434.937491][T18050] x_tables: duplicate underflow at hook 1 [ 435.099558][T18022] lo speed is unknown, defaulting to 1000 [ 436.356174][T16849] Bluetooth: hci1: command tx timeout [ 436.386790][T18103] netlink: 24 bytes leftover after parsing attributes in process `syz.4.3150'. [ 436.779355][T18110] netlink: 25 bytes leftover after parsing attributes in process `syz.2.3153'. [ 436.790855][T18110] netlink: 140 bytes leftover after parsing attributes in process `syz.2.3153'. [ 436.892034][T18110] netlink: 25 bytes leftover after parsing attributes in process `syz.2.3153'. [ 436.934803][ T49] hsr_slave_0: left promiscuous mode [ 436.943281][ T49] hsr_slave_1: left promiscuous mode [ 437.301779][ T9404] smc: removing ib device syz1 [ 437.833062][T18120] lo speed is unknown, defaulting to 1000 [ 437.969028][T17910] netdevsim netdevsim1 netdevsim0: renamed from eth0 [ 438.041485][T17910] netdevsim netdevsim1 netdevsim1: renamed from eth1 [ 438.096467][T17910] netdevsim netdevsim1 netdevsim2: renamed from eth2 [ 438.134328][T17910] netdevsim netdevsim1 netdevsim3: renamed from eth3 [ 438.438312][T16849] Bluetooth: hci1: command tx timeout [ 438.469458][T17910] 8021q: adding VLAN 0 to HW filter on device bond0 [ 438.500823][T18151] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 438.513164][T17910] 8021q: adding VLAN 0 to HW filter on device team0 [ 438.539241][ T9398] bridge0: port 1(bridge_slave_0) entered blocking state [ 438.546461][ T9398] bridge0: port 1(bridge_slave_0) entered forwarding state [ 438.581814][ T9398] bridge0: port 2(bridge_slave_1) entered blocking state [ 438.589066][ T9398] bridge0: port 2(bridge_slave_1) entered forwarding state [ 439.289024][T17910] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 439.460675][T17910] veth0_vlan: entered promiscuous mode [ 439.548751][T17910] veth1_vlan: entered promiscuous mode [ 439.790843][T17910] veth0_macvtap: entered promiscuous mode [ 439.811215][T17910] veth1_macvtap: entered promiscuous mode [ 439.834931][T18181] netlink: 8 bytes leftover after parsing attributes in process `syz.3.3164'. [ 439.900029][T18181] geneve3: entered promiscuous mode [ 439.938890][ T8253] netdevsim netdevsim3 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 439.970303][T18186] netlink: 'syz.2.3165': attribute type 4 has an invalid length. [ 439.970653][ T8253] netdevsim netdevsim3 eth1: set [1, 0] type 2 family 0 port 6081 - 0 [ 439.991559][ T8253] netdevsim netdevsim3 eth2: set [1, 0] type 2 family 0 port 6081 - 0 [ 440.012309][ T8253] netdevsim netdevsim3 eth3: set [1, 0] type 2 family 0 port 6081 - 0 [ 440.080818][T17910] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 440.159933][T17910] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 440.209384][ T9398] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 440.219351][ T9398] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 440.259454][ T9398] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 440.293272][ T9398] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 440.305996][T18192] netlink: 104 bytes leftover after parsing attributes in process `syz.3.3166'. [ 440.641148][ T9402] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 440.655622][ T9402] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 440.898066][ T8257] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 440.912430][ T8257] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 441.221916][T18221] netlink: 64 bytes leftover after parsing attributes in process `syz.1.3109'. [ 441.401166][ T49] IPVS: stop unused estimator thread 0... [ 442.202841][T18260] netlink: 24 bytes leftover after parsing attributes in process `syz.1.3180'. [ 442.566979][T18284] netlink: 'syz.0.3184': attribute type 4 has an invalid length. [ 442.618207][T18283] netlink: 'syz.0.3184': attribute type 4 has an invalid length. [ 442.776366][ T5835] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 442.795522][ T5835] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 442.805831][ T5835] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 442.815854][ T5835] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 442.823665][ T5835] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 442.933986][T18292] sit1: entered promiscuous mode [ 443.027644][T18293] netlink: 'syz.2.3185': attribute type 1 has an invalid length. [ 443.035486][T18293] netlink: 'syz.2.3185': attribute type 2 has an invalid length. [ 443.043662][T18298] netlink: 'syz.2.3185': attribute type 1 has an invalid length. [ 443.043684][T18298] netlink: 'syz.2.3185': attribute type 2 has an invalid length. [ 443.131012][T18289] lo speed is unknown, defaulting to 1000 [ 443.415511][T18308] netlink: 20 bytes leftover after parsing attributes in process `syz.2.3188'. [ 443.666281][ T36] netdevsim netdevsim3 eth3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 443.878870][ T36] netdevsim netdevsim3 eth2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 443.889374][ T1756] block nbd3: Possible stuck request ffff888027578000: control (read@0,1024B). Runtime 30 seconds [ 443.900333][ T1756] block nbd3: Possible stuck request ffff888027578200: control (read@1024,1024B). Runtime 30 seconds [ 443.911409][ T1756] block nbd3: Possible stuck request ffff888027578400: control (read@2048,1024B). Runtime 30 seconds [ 443.923514][ T1756] block nbd3: Possible stuck request ffff888027578600: control (read@3072,1024B). Runtime 30 seconds [ 443.978221][T18330] tipc: Enabled bearer , priority 0 [ 444.009085][T18327] syzkaller0: entered promiscuous mode [ 444.014638][T18327] syzkaller0: entered allmulticast mode [ 444.027190][T18335] netlink: 'syz.4.3193': attribute type 10 has an invalid length. [ 444.053552][T18333] netlink: 'syz.4.3193': attribute type 10 has an invalid length. [ 444.125360][T18327] tipc: Resetting bearer [ 444.150280][ T36] netdevsim netdevsim3 eth1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 444.247704][T18344] netlink: 8 bytes leftover after parsing attributes in process `syz.1.3195'. [ 444.259211][T18340] netlink: 'syz.0.3194': attribute type 2 has an invalid length. [ 444.292106][ T36] netdevsim netdevsim3 eth0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 444.384072][T18340] !©9: entered promiscuous mode [ 444.499380][T18327] lo speed is unknown, defaulting to 1000 [ 444.895448][T18330] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 444.902929][T18330] IPv6: NLM_F_CREATE should be set when creating new route [ 444.910292][T18330] IPv6: NLM_F_CREATE should be set when creating new route [ 444.918924][ T5835] Bluetooth: hci0: command tx timeout [ 445.023435][ T9] tipc: Node number set to 2130706433 [ 445.139658][T18325] tipc: Resetting bearer [ 445.201933][T18325] tipc: Disabling bearer [ 445.249879][ T36] batadv2: left allmulticast mode [ 445.259527][ T36] batadv2: left promiscuous mode [ 445.271904][ T36] bridge0: port 3(batadv2) entered disabled state [ 445.307081][ T36] batadv1: left allmulticast mode [ 445.312354][ T36] batadv1: left promiscuous mode [ 445.326192][ T36] bridge0: port 2(batadv1) entered disabled state [ 445.345173][ T36] gretap0: left allmulticast mode [ 445.361310][ T36] gretap0: left promiscuous mode [ 445.376276][ T36] bridge0: port 1(gretap0) entered disabled state [ 445.430701][T18385] netlink: 24 bytes leftover after parsing attributes in process `syz.1.3205'. [ 445.743573][ T36] bond2 (unregistering): (slave vti0): Releasing backup interface [ 446.334940][ T36] .` (unregistering): (slave bond_slave_0): Releasing backup interface [ 446.345030][ T36] .` (unregistering): (slave bond_slave_1): Releasing backup interface [ 446.355298][ T36] .` (unregistering): (slave dummy0): Releasing backup interface [ 446.365012][ T36] .` (unregistering): Released all slaves [ 446.377844][ T36] bond0 (unregistering): Released all slaves [ 446.392844][ T36] bond1 (unregistering): Released all slaves [ 446.411264][ T36] bond2 (unregistering): Released all slaves [ 446.426151][ T36] bond3 (unregistering): Released all slaves [ 446.447964][ T36] bond4 (unregistering): Released all slaves [ 446.468272][ T36] bond5 (unregistering): Released all slaves [ 446.482652][ T36] bond6 (unregistering): Released all slaves [ 446.503097][ T36] bond7 (unregistering): Released all slaves [ 446.519093][ T36] bond8 (unregistering): Released all slaves [ 446.547285][ T36] bond9 (unregistering): Released all slaves [ 446.562202][ T36] bond10 (unregistering): Released all slaves [ 446.584205][ T36] bond11 (unregistering): Released all slaves [ 446.600204][ T36] bond12 (unregistering): Released all slaves [ 446.645150][T18289] chnl_net:caif_netlink_parms(): no params data found [ 446.875378][ T36] tipc: Disabling bearer [ 446.914299][ T36] tipc: Left network mode [ 446.951364][ T36] IPVS: stopping backup sync thread 13281 ... [ 447.001133][ T5835] Bluetooth: hci0: command tx timeout [ 447.015900][T18413] IPVS: set_ctl: invalid protocol: 47 10.1.1.1:20001 [ 447.022930][ T981] IPVS: starting estimator thread 0... [ 447.036830][T18413] sctp: [Deprecated]: syz.1.3210 (pid 18413) Use of struct sctp_assoc_value in delayed_ack socket option. [ 447.036830][T18413] Use struct sctp_sack_info instead [ 447.074388][T18417] netlink: 28 bytes leftover after parsing attributes in process `syz.4.3211'. [ 447.086249][T18413] IPVS: lblc: FWM 3 0x00000003 - no destination available [ 447.145698][T18414] IPVS: using max 29 ests per chain, 69600 per kthread [ 447.322462][T18289] bridge0: port 1(bridge_slave_0) entered blocking state [ 447.340866][T18289] bridge0: port 1(bridge_slave_0) entered disabled state [ 447.390089][T18289] bridge_slave_0: entered allmulticast mode [ 447.538119][T18289] bridge_slave_0: entered promiscuous mode [ 447.557664][T18289] bridge0: port 2(bridge_slave_1) entered blocking state [ 447.599237][T18289] bridge0: port 2(bridge_slave_1) entered disabled state [ 447.622249][T18289] bridge_slave_1: entered allmulticast mode [ 447.652819][T18289] bridge_slave_1: entered promiscuous mode [ 447.999925][T18289] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 448.075840][T18460] netlink: 144 bytes leftover after parsing attributes in process `syz.0.3223'. [ 448.251924][T18289] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 448.466928][T18289] team0: Port device team_slave_0 added [ 448.492043][T18289] team0: Port device team_slave_1 added [ 448.661639][T18479] lo speed is unknown, defaulting to 1000 [ 448.668545][T18289] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 448.675534][T18289] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 448.780140][T18289] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 448.824800][T18289] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 448.989852][T18289] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 449.076295][ T5835] Bluetooth: hci0: command tx timeout [ 449.085838][T18289] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 449.451720][T18289] hsr_slave_0: entered promiscuous mode [ 449.484225][T18289] hsr_slave_1: entered promiscuous mode [ 449.717281][ T36] hsr_slave_0: left promiscuous mode [ 449.730803][ T36] hsr_slave_1: left promiscuous mode [ 449.748793][ T36] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 449.797649][ T36] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 450.138255][ T36] team0 (unregistering): Port device team_slave_1 removed [ 450.164082][ T36] team0 (unregistering): Port device team_slave_0 removed [ 450.300930][T18536] netlink: 24 bytes leftover after parsing attributes in process `syz.1.3238'. [ 450.404524][T18536] netlink: 4 bytes leftover after parsing attributes in process `syz.1.3238'. [ 450.679011][T18539] netlink: 12 bytes leftover after parsing attributes in process `syz.1.3239'. [ 450.792999][ T36] IPVS: stop unused estimator thread 0... [ 451.122742][T18544] bridge2: entered promiscuous mode [ 451.148371][T18545] lo speed is unknown, defaulting to 1000 [ 451.157707][ T5835] Bluetooth: hci0: command tx timeout [ 451.884353][T18563] validate_nla: 1 callbacks suppressed [ 451.884391][T18563] netlink: 'syz.4.3244': attribute type 5 has an invalid length. [ 452.372914][T18569] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 452.385337][T18569] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 452.425254][T18513] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 452.595318][T18289] netdevsim netdevsim3 netdevsim0: renamed from eth0 [ 452.632692][T18576] netlink: 'syz.1.3248': attribute type 1 has an invalid length. [ 452.644751][ T49] netdevsim netdevsim4 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 452.668388][ T49] netdevsim netdevsim4 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 452.690663][T18289] netdevsim netdevsim3 netdevsim1: renamed from eth1 [ 452.750263][T18575] vlan2: entered allmulticast mode [ 452.755477][T18575] netdevsim netdevsim1 netdevsim1: entered allmulticast mode [ 452.806086][ T49] netdevsim netdevsim4 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 452.815088][ T49] netdevsim netdevsim4 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 452.838973][T18289] netdevsim netdevsim3 netdevsim2: renamed from eth2 [ 452.890465][T18289] netdevsim netdevsim3 netdevsim3: renamed from eth3 [ 453.103055][T18599] netlink: 28 bytes leftover after parsing attributes in process `syz.2.3251'. [ 453.129244][T18602] netlink: 'syz.4.3253': attribute type 1 has an invalid length. [ 453.182141][T18602] workqueue: Failed to create a rescuer kthread for wq "bond2": -EINTR [ 453.300478][T18289] 8021q: adding VLAN 0 to HW filter on device bond0 [ 453.419491][T18289] 8021q: adding VLAN 0 to HW filter on device team0 [ 453.471475][ T49] bridge0: port 1(bridge_slave_0) entered blocking state [ 453.478714][ T49] bridge0: port 1(bridge_slave_0) entered forwarding state [ 453.534438][T18615] 8021q: adding VLAN 0 to HW filter on device macvlan2 [ 453.542266][T18615] team0: Device macvlan2 is already an upper device of the team interface [ 453.605693][T18619] TC_ACT_REPEAT abuse ? [ 453.613881][ T36] bridge0: port 2(bridge_slave_1) entered blocking state [ 453.621114][ T36] bridge0: port 2(bridge_slave_1) entered forwarding state [ 453.641880][T18617] netlink: 12 bytes leftover after parsing attributes in process `syz.2.3256'. [ 453.654608][T18620] pim6reg: entered allmulticast mode [ 454.021762][T18617] pim6reg: left allmulticast mode [ 454.081814][T18623] netlink: 16402 bytes leftover after parsing attributes in process `syz.2.3256'. [ 454.107078][T18620] netlink: 16402 bytes leftover after parsing attributes in process `syz.2.3256'. [ 454.320190][T18647] netlink: 24 bytes leftover after parsing attributes in process `syz.4.3262'. [ 454.396741][T18647] x_tables: ip6_tables: icmp6 match: only valid for protocol 58 [ 454.412747][T18647] netlink: 24 bytes leftover after parsing attributes in process `syz.4.3262'. [ 454.454151][T18653] Cannot find add_set index 0 as target [ 454.488397][T18657] netlink: 4 bytes leftover after parsing attributes in process `syz.1.3265'. [ 454.783203][T18289] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 454.818087][T18677] netlink: 'syz.1.3268': attribute type 1 has an invalid length. [ 454.866439][T18677] 8021q: adding VLAN 0 to HW filter on device bond1 [ 454.886461][T18677] 8021q: adding VLAN 0 to HW filter on device batadv1 [ 454.969298][T18289] veth0_vlan: entered promiscuous mode [ 455.003244][T18289] veth1_vlan: entered promiscuous mode [ 455.075174][T18289] veth0_macvtap: entered promiscuous mode [ 455.086736][T18289] veth1_macvtap: entered promiscuous mode [ 455.129656][T18289] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 455.156904][T18289] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 455.180067][ T9404] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 455.192955][ T9404] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 455.205076][ T9404] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 455.214496][ T9404] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 456.042814][ T1756] block nbd2: Possible stuck request ffff888027518000: control (read@0,1024B). Runtime 210 seconds [ 456.053803][ T1756] block nbd2: Possible stuck request ffff888027518200: control (read@1024,1024B). Runtime 210 seconds [ 456.065156][ T1756] block nbd2: Possible stuck request ffff888027518400: control (read@2048,1024B). Runtime 210 seconds [ 456.077018][ T1756] block nbd2: Possible stuck request ffff888027518600: control (read@3072,1024B). Runtime 210 seconds [ 457.221335][T18642] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 457.407097][ T36] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 457.414983][ T36] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 457.512710][T18765] netlink: 4 bytes leftover after parsing attributes in process `syz.1.3272'. [ 457.517754][T18760] netlink: 36 bytes leftover after parsing attributes in process `syz.2.3271'. [ 457.548998][ T36] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 457.566209][ T36] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 457.761511][T18769] bond5 (unregistering): Released all slaves [ 458.367865][T18803] netlink: 84 bytes leftover after parsing attributes in process `syz.4.3284'. [ 458.437145][T18803] netlink: 36 bytes leftover after parsing attributes in process `syz.4.3284'. [ 458.653929][T16849] Bluetooth: hci4: unexpected cc 0x0c03 length: 249 > 1 [ 458.674272][T16849] Bluetooth: hci4: unexpected cc 0x1003 length: 249 > 9 [ 458.693213][T16849] Bluetooth: hci4: unexpected cc 0x1001 length: 249 > 9 [ 458.711450][T16849] Bluetooth: hci4: unexpected cc 0x0c23 length: 249 > 4 [ 458.719750][T16849] Bluetooth: hci4: unexpected cc 0x0c38 length: 249 > 2 [ 458.741332][T18819] team0 (unregistering): Port device team_slave_0 removed [ 458.751643][T18818] netlink: 8 bytes leftover after parsing attributes in process `syz.4.3287'. [ 458.779338][T18824] netlink: 'syz.2.3289': attribute type 25 has an invalid length. [ 458.792097][T18819] team0 (unregistering): Port device team_slave_1 removed [ 458.812054][T18824] netlink: 4 bytes leftover after parsing attributes in process `syz.2.3289'. [ 458.937158][ T8257] netdevsim netdevsim2 netdevsim0: set [0, 0] type 1 family 0 port 8472 - 0 [ 458.947383][T18824] netlink: 'syz.2.3289': attribute type 25 has an invalid length. [ 458.977247][ T8257] netdevsim netdevsim2 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0 [ 458.986524][T18824] netlink: 4 bytes leftover after parsing attributes in process `syz.2.3289'. [ 459.013394][ T8257] netdevsim netdevsim2 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0 [ 459.025343][T18820] lo speed is unknown, defaulting to 1000 [ 459.036969][ T8257] netdevsim netdevsim2 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0 [ 459.127714][T18835] netlink: 4 bytes leftover after parsing attributes in process `syz.1.3291'. [ 459.175007][T18837] netdevsim netdevsim3: loading /lib/firmware/. failed with error -22 [ 459.193615][T18835] netlink: 4 bytes leftover after parsing attributes in process `syz.1.3291'. [ 459.227786][T18843] netlink: 8 bytes leftover after parsing attributes in process `syz.3.3292'. [ 459.268583][T18837] netdevsim netdevsim3: Direct firmware load for . failed with error -22 [ 459.279771][T18835] netlink: 4 bytes leftover after parsing attributes in process `syz.1.3291'. [ 459.306618][T18843] netlink: 8 bytes leftover after parsing attributes in process `syz.3.3292'. [ 459.336109][T18837] netdevsim netdevsim3: Falling back to sysfs fallback for: . [ 459.429926][T18847] syzkaller0: entered promiscuous mode [ 459.466424][T18847] syzkaller0: entered allmulticast mode [ 459.485866][T18846] tipc: Enabled bearer , priority 0 [ 459.896461][T18846] tipc: Resetting bearer [ 460.756451][ T5835] Bluetooth: hci4: command tx timeout [ 461.791141][T18846] tipc: Disabling bearer [ 462.024670][T18888] lo speed is unknown, defaulting to 1000 [ 462.103077][T18900] tc_dump_action: action bad kind [ 462.151482][T18901] tc_dump_action: action bad kind [ 462.439109][T18820] chnl_net:caif_netlink_parms(): no params data found [ 462.839202][ T5835] Bluetooth: hci4: command tx timeout [ 464.193800][T18907] lo speed is unknown, defaulting to 1000 [ 464.473244][T18946] __nla_validate_parse: 14 callbacks suppressed [ 464.473267][T18946] netlink: 4 bytes leftover after parsing attributes in process `syz.4.3309'. [ 464.527441][T18936] netlink: 36 bytes leftover after parsing attributes in process `syz.4.3309'. [ 464.584612][T18946] team0: Port device team_slave_0 removed [ 464.609410][T18820] bridge0: port 1(bridge_slave_0) entered blocking state [ 464.616832][T18820] bridge0: port 1(bridge_slave_0) entered disabled state [ 464.626824][T18820] bridge_slave_0: entered allmulticast mode [ 464.635890][T18820] bridge_slave_0: entered promiscuous mode [ 464.645399][T18820] bridge0: port 2(bridge_slave_1) entered blocking state [ 464.678421][T18820] bridge0: port 2(bridge_slave_1) entered disabled state [ 464.691175][T18820] bridge_slave_1: entered allmulticast mode [ 464.719883][T18820] bridge_slave_1: entered promiscuous mode [ 464.916148][ T5835] Bluetooth: hci4: command tx timeout [ 464.952886][T18820] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 464.978469][T18820] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 465.089381][T18820] team0: Port device team_slave_0 added [ 465.100144][T18820] team0: Port device team_slave_1 added [ 465.176972][T18820] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 465.198037][T18820] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 465.231268][T18820] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 465.253534][T18820] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 465.261129][T18820] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 465.287688][T18820] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 465.488024][T18820] hsr_slave_0: entered promiscuous mode [ 465.494675][T18820] hsr_slave_1: entered promiscuous mode [ 465.501200][T18820] debugfs: 'hsr0' already exists in 'hsr' [ 465.507052][T18820] Cannot create hsr debugfs directory [ 466.100075][T18980] netlink: 4 bytes leftover after parsing attributes in process `syz.3.3319'. [ 466.295424][T19000] netlink: 24 bytes leftover after parsing attributes in process `syz.1.3322'. [ 466.340023][T19000] netlink: 136 bytes leftover after parsing attributes in process `syz.1.3322'. [ 466.354834][T19000] netlink: 'syz.1.3322': attribute type 3 has an invalid length. [ 466.366104][T19000] netlink: 3 bytes leftover after parsing attributes in process `syz.1.3322'. [ 466.455492][T18820] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 466.501181][T18820] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 466.513790][T18820] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 466.523980][T18820] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 466.579967][T19003] netlink: 'syz.1.3323': attribute type 1 has an invalid length. [ 466.654275][T19013] tipc: Enabled bearer , priority 0 [ 466.680998][T19013] syzkaller0: entered promiscuous mode [ 466.695108][T19013] syzkaller0: entered allmulticast mode [ 466.717810][T19018] syzkaller1: entered promiscuous mode [ 466.723517][T19018] syzkaller1: entered allmulticast mode [ 466.778562][T19012] tipc: Resetting bearer [ 466.804700][T19012] tipc: Disabling bearer [ 466.823866][T19021] netlink: 8 bytes leftover after parsing attributes in process `syz.3.3326'. [ 466.973591][T19025] netlink: 12 bytes leftover after parsing attributes in process `syz.4.3329'. [ 466.994321][T18820] 8021q: adding VLAN 0 to HW filter on device bond0 [ 467.016130][ T5835] Bluetooth: hci4: command tx timeout [ 467.023547][T19028] netlink: 96 bytes leftover after parsing attributes in process `syz.2.3331'. [ 467.076249][T19025] vlan2: entered promiscuous mode [ 467.091587][T19025] bridge0: entered promiscuous mode [ 467.120237][T19034] netlink: 8 bytes leftover after parsing attributes in process `syz.2.3333'. [ 467.128251][T18820] 8021q: adding VLAN 0 to HW filter on device team0 [ 467.203099][ T9398] bridge0: port 1(bridge_slave_0) entered blocking state [ 467.210369][ T9398] bridge0: port 1(bridge_slave_0) entered forwarding state [ 467.281422][ T9398] bridge0: port 2(bridge_slave_1) entered blocking state [ 467.288671][ T9398] bridge0: port 2(bridge_slave_1) entered forwarding state [ 467.552496][T19053] netlink: 'syz.2.3337': attribute type 14 has an invalid length. [ 467.554322][T19021] Bluetooth: hci0: Opcode 0x0401 failed: -4 [ 467.586236][T19053] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 467.599518][T19053] bridge_slave_1: left allmulticast mode [ 467.615947][T19053] bridge_slave_1: left promiscuous mode [ 467.621816][T19053] bridge0: port 2(bridge_slave_1) entered disabled state [ 467.670429][T19053] A link change request failed with some changes committed already. Interface bridge_slave_1 may have been left with an inconsistent configuration, please check. [ 467.745161][T18820] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 467.793371][T19060] x_tables: duplicate underflow at hook 1 [ 467.806637][T19060] tipc: Invalid UDP bearer configuration [ 467.806698][T19060] tipc: Enabling of bearer rejected, failed to enable media [ 467.842824][T18820] veth0_vlan: entered promiscuous mode [ 467.874416][T18820] veth1_vlan: entered promiscuous mode [ 467.972548][T18820] veth0_macvtap: entered promiscuous mode [ 467.987507][T18820] veth1_macvtap: entered promiscuous mode [ 468.042642][T18820] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 468.108158][T18820] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 468.124683][ T36] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 468.149012][ T36] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 468.170995][ T36] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 468.203695][ T36] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 468.454533][ T9398] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 468.470905][ T9398] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 468.519936][ T212] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 468.545843][ T212] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 468.729910][ T30] audit: type=1800 audit(1774614964.741:5): pid=19096 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.4.3346" name=CB dev="tmpfs" ino=847 res=0 errno=0 [ 468.989223][T19105] tipc: Started in network mode [ 468.994327][T19105] tipc: Node identity ea29b4b7c16a, cluster identity 4711 [ 469.001563][ T5835] Bluetooth: hci0: command 0x0401 tx timeout [ 469.012099][T19105] tipc: Enabled bearer , priority 0 [ 469.020486][T19105] syzkaller0: entered promiscuous mode [ 469.028676][T19105] syzkaller0: entered allmulticast mode [ 469.063455][T19104] tipc: Resetting bearer [ 469.089066][T19104] tipc: Disabling bearer [ 469.161046][T19114] syzkaller0: entered promiscuous mode [ 469.167197][T19114] syzkaller0: entered allmulticast mode [ 469.188536][T19114] netlink: 'syz.3.3352': attribute type 5 has an invalid length. [ 469.726025][T19143] tipc: Started in network mode [ 469.730975][T19143] tipc: Node identity ac14140f, cluster identity 4711 [ 469.742493][T19143] tipc: New replicast peer: 255.255.255.255 [ 469.762928][T19143] tipc: Enabled bearer , priority 26 [ 469.818044][T19145] __nla_validate_parse: 8 callbacks suppressed [ 469.818065][T19145] netlink: 12 bytes leftover after parsing attributes in process `syz.0.3362'. [ 469.916294][T19145] 8021q: adding VLAN 0 to HW filter on device bond1 [ 469.954446][T19157] netlink: 12 bytes leftover after parsing attributes in process `syz.4.3363'. [ 469.995229][T19150] netlink: 8 bytes leftover after parsing attributes in process `syz.4.3363'. [ 470.021030][T19155] netlink: 'syz.2.3365': attribute type 1 has an invalid length. [ 470.056032][T19150] netlink: 'syz.4.3363': attribute type 1 has an invalid length. [ 470.080863][T19150] netlink: 'syz.4.3363': attribute type 2 has an invalid length. [ 470.125458][T19155] 8021q: adding VLAN 0 to HW filter on device bond2 [ 470.149374][T19163] bridge0: port 3(dummy0) entered disabled state [ 470.206756][T19163] dummy0: left allmulticast mode [ 470.211894][T19163] dummy0: left promiscuous mode [ 470.217266][T19163] bridge0: port 3(dummy0) entered disabled state [ 470.302429][T19163] bond2: (slave dummy0): making interface the new active one [ 470.322963][T19163] bond2: (slave dummy0): Enslaving as an active interface with an up link [ 470.358895][T19155] bond2 (unregistering): (slave dummy0): Releasing active interface [ 470.369885][T19163] netlink: 12 bytes leftover after parsing attributes in process `syz.2.3365'. [ 470.379920][T19163] netlink: 12 bytes leftover after parsing attributes in process `syz.2.3365'. [ 470.401218][T19155] bond2 (unregistering): Released all slaves [ 470.437898][T19177] netlink: 'syz.3.3370': attribute type 4 has an invalid length. [ 470.515527][T19179] bridge0: port 3(vlan2) entered blocking state [ 470.524538][T19179] bridge0: port 3(vlan2) entered disabled state [ 470.531867][T19179] vlan2: entered allmulticast mode [ 470.537630][T19179] bond0: entered allmulticast mode [ 470.542969][T19179] bond_slave_0: entered allmulticast mode [ 470.572263][T19179] bond_slave_1: entered allmulticast mode [ 470.584920][T19179] dummy0: entered allmulticast mode [ 470.607214][T19179] vlan2: entered promiscuous mode [ 470.619126][T19179] bond0: entered promiscuous mode [ 470.623457][T19184] netlink: 8 bytes leftover after parsing attributes in process `syz.1.3373'. [ 470.631183][T19179] bond_slave_0: entered promiscuous mode [ 470.640900][T19179] bond_slave_1: entered promiscuous mode [ 470.649271][T19179] dummy0: entered promiscuous mode [ 470.755859][ C1] ip6_tunnel: ip6gre2 xmit: Local address not yet configured! [ 470.875779][ T5816] tipc: Node number set to 2886997007 [ 471.097311][T19199] netlink: 'syz.4.3378': attribute type 1 has an invalid length. [ 471.105193][T19199] netlink: 224 bytes leftover after parsing attributes in process `syz.4.3378'. [ 471.125143][T19202] FAULT_INJECTION: forcing a failure. [ 471.125143][T19202] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 471.150995][T19199] workqueue: Failed to create a rescuer kthread for wq "phy4": -EINTR [ 471.152073][T19197] netlink: 'syz.4.3378': attribute type 1 has an invalid length. [ 471.162431][T19202] CPU: 0 UID: 0 PID: 19202 Comm: syz.2.3379 Not tainted syzkaller #0 PREEMPT(full) [ 471.162518][T19202] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 471.162551][T19202] Call Trace: [ 471.162572][T19202] [ 471.162593][T19202] dump_stack_lvl+0xe8/0x150 [ 471.162715][T19202] should_fail_ex+0x412/0x560 [ 471.162819][T19202] _copy_to_user+0x31/0xb0 [ 471.162971][T19202] simple_read_from_buffer+0xe1/0x170 [ 471.163074][T19202] proc_fail_nth_read+0x1bb/0x230 [ 471.163181][T19202] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 471.163275][T19202] ? rw_verify_area+0x2a6/0x4d0 [ 471.163344][T19202] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 471.163455][T19202] vfs_read+0x20c/0xa70 [ 471.163516][T19202] ? fdget_pos+0x246/0x320 [ 471.163573][T19202] ? __pfx___mutex_lock+0x10/0x10 [ 471.163647][T19202] ? __pfx_vfs_read+0x10/0x10 [ 471.163718][T19202] ? __fget_files+0x2a/0x420 [ 471.163812][T19202] ? __fget_files+0x3a0/0x420 [ 471.163886][T19202] ? __fget_files+0x2a/0x420 [ 471.163996][T19202] ksys_read+0x150/0x270 [ 471.164067][T19202] ? __pfx_ksys_read+0x10/0x10 [ 471.164147][T19202] do_syscall_64+0x14d/0xf80 [ 471.164231][T19202] ? trace_irq_disable+0x3b/0x150 [ 471.164276][T19202] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 471.164338][T19202] ? clear_bhb_loop+0x40/0x90 [ 471.164409][T19202] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 471.164468][T19202] RIP: 0033:0x7f301915cfce [ 471.164520][T19202] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 471.164564][T19202] RSP: 002b:00007f301a025fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 471.164626][T19202] RAX: ffffffffffffffda RBX: 00007f301a0266c0 RCX: 00007f301915cfce [ 471.164660][T19202] RDX: 000000000000000f RSI: 00007f301a0260a0 RDI: 0000000000000004 [ 471.164705][T19202] RBP: 00007f301a026090 R08: 0000000000000000 R09: 0000000000000000 [ 471.164752][T19202] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 471.164796][T19202] R13: 00007f3019416038 R14: 00007f3019415fa0 R15: 00007fff4ee66348 [ 471.164886][T19202] [ 471.405839][T19197] netlink: 224 bytes leftover after parsing attributes in process `syz.4.3378'. [ 471.417173][T19197] workqueue: Failed to create a rescuer kthread for wq "phy5": -EINTR [ 471.629538][T19214] workqueue: Failed to create a rescuer kthread for wq "nfc2_nci_tx_wq": -EINTR [ 471.780358][T19229] netlink: 212368 bytes leftover after parsing attributes in process `syz.3.3383'. [ 471.848482][T19234] netlink: 8 bytes leftover after parsing attributes in process `syz.4.3387'. [ 472.272067][T19262] bond_slave_0: entered promiscuous mode [ 472.278201][T19262] bond_slave_1: entered promiscuous mode [ 472.299652][T19262] 8021q: adding VLAN 0 to HW filter on device macvlan3 [ 472.310770][T19262] bond_slave_0: left promiscuous mode [ 472.316296][T19262] bond_slave_1: left promiscuous mode [ 472.469144][T19264] batman_adv: batadv0: Adding interface: gretap1 [ 472.497065][T19264] batman_adv: batadv0: The MTU of interface gretap1 is too small (1462) to handle the transport of batman-adv packets. If you experience problems getting traffic through try increasing the MTU to 1500. [ 472.553830][T19264] batman_adv: batadv0: Not using interface gretap1 (retrying later): interface not active [ 473.608017][T19296] xt_NFQUEUE: number of queues (65532) out of range (got 66665) [ 473.632022][T19295] lo speed is unknown, defaulting to 1000 [ 473.927590][T19300] lo speed is unknown, defaulting to 1000 [ 473.986059][ T1756] block nbd3: Possible stuck request ffff888027578000: control (read@0,1024B). Runtime 60 seconds [ 473.997718][ T1756] block nbd3: Possible stuck request ffff888027578200: control (read@1024,1024B). Runtime 60 seconds [ 474.011906][ T1756] block nbd3: Possible stuck request ffff888027578400: control (read@2048,1024B). Runtime 60 seconds [ 474.022965][ T1756] block nbd3: Possible stuck request ffff888027578600: control (read@3072,1024B). Runtime 60 seconds [ 474.800580][T19324] lo speed is unknown, defaulting to 1000 [ 474.918586][ T9402] wlan0: Trigger new scan to find an IBSS to join [ 475.217090][T19340] __nla_validate_parse: 4 callbacks suppressed [ 475.217110][T19340] netlink: 76 bytes leftover after parsing attributes in process `syz.1.3420'. [ 475.259361][T19341] netlink: 76 bytes leftover after parsing attributes in process `syz.1.3420'. [ 475.287949][T19340] syzkaller0: entered promiscuous mode [ 475.295702][T19340] syzkaller0: entered allmulticast mode [ 475.322428][T19343] tc action pedit offset must be on 32 bit boundaries [ 475.417752][T19345] netlink: 8 bytes leftover after parsing attributes in process `syz.0.3421'. [ 475.772383][T19350] netlink: 'syz.1.3423': attribute type 39 has an invalid length. [ 475.882371][ T5944] IPVS: starting estimator thread 0... [ 475.975968][T19357] IPVS: using max 29 ests per chain, 69600 per kthread [ 476.798143][T19375] IPVS: Unknown mcast interface: rose0 [ 477.056284][T19389] netlink: 4 bytes leftover after parsing attributes in process `syz.0.3432'. [ 477.359867][T19405] netlink: 496 bytes leftover after parsing attributes in process `syz.3.3435'. [ 477.412965][T19405] netlink: 'syz.3.3435': attribute type 1 has an invalid length. [ 477.502523][T19412] netlink: 28 bytes leftover after parsing attributes in process `syz.3.3435'. [ 477.595954][T19419] netlink: 'syz.3.3435': attribute type 2 has an invalid length. [ 477.597618][T19416] netlink: 4 bytes leftover after parsing attributes in process `syz.0.3438'. [ 477.684956][T19419] : entered promiscuous mode [ 477.854390][T19431] netlink: 199740 bytes leftover after parsing attributes in process `syz.0.3443'. [ 477.854671][T19428] netlink: 8 bytes leftover after parsing attributes in process `syz.4.3442'. [ 477.877168][ T212] wlan0: Trigger new scan to find an IBSS to join [ 477.888566][T19432] xt_TPROXY: Can be used only with -p tcp or -p udp [ 477.907243][T19432] netlink: 12 bytes leftover after parsing attributes in process `syz.3.3444'. [ 477.932087][T19428] netlink: 'syz.4.3442': attribute type 11 has an invalid length. [ 478.099684][T19446] tun0: tun_chr_ioctl cmd 1074025677 [ 478.105409][T19446] tun0: linktype set to 804 [ 478.168544][T19450] tipc: Enabled bearer , priority 0 [ 478.177708][T19447] syzkaller0: entered promiscuous mode [ 478.183469][T19447] syzkaller0: entered allmulticast mode [ 478.207458][T19447] tipc: Resetting bearer [ 478.262586][T19456] dvmrp0: entered allmulticast mode [ 478.274676][T19456] x_tables: ip_tables: sctp match: only valid for protocol 132 [ 478.304247][T19458] netlink: 'syz.0.3453': attribute type 11 has an invalid length. [ 478.429304][T19469] netlink: 'syz.3.3456': attribute type 1 has an invalid length. [ 478.450806][T19470] sctp: [Deprecated]: syz.0.3455 (pid 19470) Use of struct sctp_assoc_value in delayed_ack socket option. [ 478.450806][T19470] Use struct sctp_sack_info instead [ 478.474509][T19469] tap0: tun_chr_ioctl cmd 1074025680 [ 478.497102][T19470] lo speed is unknown, defaulting to 1000 [ 478.503125][T19470] lo speed is unknown, defaulting to 1000 [ 478.519971][T19470] lo speed is unknown, defaulting to 1000 [ 478.599104][T19470] infiniband syz2: RDMA CMA: cma_listen_on_dev, error -98 [ 478.686680][T19470] lo speed is unknown, defaulting to 1000 [ 478.705262][T19470] lo speed is unknown, defaulting to 1000 [ 478.728295][T19470] lo speed is unknown, defaulting to 1000 [ 478.736089][T19470] lo speed is unknown, defaulting to 1000 [ 478.743330][T19470] lo speed is unknown, defaulting to 1000 [ 478.768991][T19470] lo speed is unknown, defaulting to 1000 [ 478.780254][T19470] lo speed is unknown, defaulting to 1000 [ 478.928755][T19445] tipc: Resetting bearer [ 479.046467][T19445] tipc: Disabling bearer [ 479.151984][T19477] lo speed is unknown, defaulting to 1000 [ 479.343555][T19487] netdevsim netdevsim4 netdevsim0: entered allmulticast mode [ 479.389783][T19487] A link change request failed with some changes committed already. Interface netdevsim0 may have been left with an inconsistent configuration, please check. [ 479.472173][T19493] netlink: 'syz.3.3463': attribute type 1 has an invalid length. [ 479.551200][T19493] workqueue: Failed to create a rescuer kthread for wq "bond1": -EINTR [ 479.760264][T19477] lo speed is unknown, defaulting to 1000 [ 479.765007][T19511] syzkaller0: entered promiscuous mode [ 479.782517][T19511] syzkaller0: entered allmulticast mode [ 479.809370][T19511] netlink: 'syz.0.3467': attribute type 1 has an invalid length. [ 479.949050][T19511] 8021q: adding VLAN 0 to HW filter on device bond2 [ 480.271913][T19521] ip6t_REJECT: TCP_RESET illegal for non-tcp [ 480.501469][T19527] xt_hashlimit: size too large, truncated to 1048576 [ 480.513176][T19541] netlink: 'syz.3.3472': attribute type 1 has an invalid length. [ 480.602158][T19541] 8021q: adding VLAN 0 to HW filter on device bond1 [ 480.922040][ T9404] wlan0: Trigger new scan to find an IBSS to join [ 480.947265][T19559] __nla_validate_parse: 5 callbacks suppressed [ 480.947287][T19559] netlink: 24 bytes leftover after parsing attributes in process `syz.3.3476'. [ 481.195123][T19567] netlink: 16 bytes leftover after parsing attributes in process `syz.0.3480'. [ 481.318597][T19576] netlink: 4 bytes leftover after parsing attributes in process `syz.2.3483'. [ 481.341376][T19578] netlink: 24 bytes leftover after parsing attributes in process `syz.4.3484'. [ 481.487294][T19584] netlink: 36 bytes leftover after parsing attributes in process `syz.2.3486'. [ 481.525428][T19584] vlan2: entered promiscuous mode [ 481.542438][T19584] dummy0: entered promiscuous mode [ 481.569937][T19589] netlink: 'syz.4.3487': attribute type 8 has an invalid length. [ 481.778515][T19602] tipc: Enabled bearer , priority 0 [ 481.797114][T19602] syzkaller0: entered promiscuous mode [ 481.815715][T19602] syzkaller0: entered allmulticast mode [ 481.849389][ T212] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 481.899137][T19605] netlink: 'syz.2.3491': attribute type 3 has an invalid length. [ 481.910854][T19602] tipc: Resetting bearer [ 481.916886][ C0] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 481.916976][ C0] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 481.970565][T19602] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 481.979231][T19602] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 482.016457][T19601] tipc: Resetting bearer [ 482.017757][T19621] netlink: 76 bytes leftover after parsing attributes in process `syz.1.3495'. [ 482.057020][T19601] tipc: Disabling bearer [ 482.091470][T19617] lo speed is unknown, defaulting to 1000 [ 482.320973][T19634] netlink: 28 bytes leftover after parsing attributes in process `syz.4.3499'. [ 482.378054][T19617] lo speed is unknown, defaulting to 1000 [ 482.384903][T19622] lo speed is unknown, defaulting to 1000 [ 482.554805][T19634] syzkaller1: entered promiscuous mode [ 482.576886][T19634] syzkaller1: entered allmulticast mode [ 482.606385][T19642] netlink: 8 bytes leftover after parsing attributes in process `syz.4.3499'. [ 482.645779][T19640] netlink: 24 bytes leftover after parsing attributes in process `syz.1.3500'. [ 482.694925][T19644] netlink: 24 bytes leftover after parsing attributes in process `syz.1.3500'. [ 482.715241][T19634] xt_hashlimit: size too large, truncated to 1048576 [ 483.076138][T19622] lo speed is unknown, defaulting to 1000 [ 483.076154][T19641] lo speed is unknown, defaulting to 1000 [ 483.357334][T19664] netlink: 'syz.0.3506': attribute type 9 has an invalid length. [ 483.483923][T19637] lo speed is unknown, defaulting to 1000 [ 483.679683][T19674] bond3: option xmit_hash_policy: invalid value (10) [ 483.688917][T19674] bond3 (unregistering): Released all slaves [ 483.768038][T19637] lo speed is unknown, defaulting to 1000 [ 483.782622][T19668] lo speed is unknown, defaulting to 1000 [ 483.817370][T19641] lo speed is unknown, defaulting to 1000 [ 483.984712][T19680] netlink: 'syz.0.3511': attribute type 30 has an invalid length. [ 484.452341][T19668] lo speed is unknown, defaulting to 1000 [ 485.223014][T19707] 8021q: VLANs not supported on ip6gre0 [ 486.048064][T19745] __nla_validate_parse: 9 callbacks suppressed [ 486.048086][T19745] netlink: 8 bytes leftover after parsing attributes in process `syz.4.3530'. [ 486.121645][ T1756] block nbd2: Possible stuck request ffff888027518000: control (read@0,1024B). Runtime 240 seconds [ 486.133367][ T1756] block nbd2: Possible stuck request ffff888027518200: control (read@1024,1024B). Runtime 240 seconds [ 486.145021][ T1756] block nbd2: Possible stuck request ffff888027518400: control (read@2048,1024B). Runtime 240 seconds [ 486.156185][ T1756] block nbd2: Possible stuck request ffff888027518600: control (read@3072,1024B). Runtime 240 seconds [ 486.188793][T19737] netlink: 100 bytes leftover after parsing attributes in process `syz.4.3530'. [ 486.240406][T19737] netlink: 8 bytes leftover after parsing attributes in process `syz.4.3530'. [ 486.316053][T19753] netlink: 'syz.2.3533': attribute type 1 has an invalid length. [ 486.422766][T19753] 8021q: adding VLAN 0 to HW filter on device bond2 [ 486.440825][T19761] netlink: 8 bytes leftover after parsing attributes in process `syz.4.3535'. [ 486.531352][T19765] nbd: must specify at least one socket [ 486.596848][T19770] netlink: 'syz.2.3538': attribute type 2 has an invalid length. [ 486.604678][T19770] netlink: 'syz.2.3538': attribute type 2 has an invalid length. [ 486.668609][T19770] siw: device registration error -23 [ 486.970352][T19779] netlink: set zone limit has 4 unknown bytes [ 486.991511][T19791] netlink: 52 bytes leftover after parsing attributes in process `syz.1.3542'. [ 487.009273][T19781] netlink: set zone limit has 4 unknown bytes [ 487.233584][T19797] geneve2: entered promiscuous mode [ 487.241112][T19797] geneve2: entered allmulticast mode [ 487.299507][T19802] netlink: 'syz.3.3545': attribute type 1 has an invalid length. [ 487.432445][T19805] bond2: (slave vxcan3): The slave device specified does not support setting the MAC address [ 487.448732][T19805] bond2: (slave vxcan3): Error -95 calling set_mac_address [ 487.520763][T19802] bond2: (slave gretap1): making interface the new active one [ 487.554493][T19802] bond2: (slave gretap1): Enslaving as an active interface with an up link [ 487.607904][T19813] macvlan3: entered promiscuous mode [ 487.613469][T19813] macvlan3: entered allmulticast mode [ 487.620564][T19813] bond2: entered promiscuous mode [ 487.626738][T19813] gretap1: entered promiscuous mode [ 487.633512][T19813] 8021q: adding VLAN 0 to HW filter on device macvlan3 [ 487.662986][T19813] bond2: (slave macvlan3): the slave hw address is in use by the bond; giving it the hw address of gretap1 [ 487.677055][T19813] bond2: left promiscuous mode [ 487.682001][T19813] gretap1: left promiscuous mode [ 487.711613][T19822] netlink: 'syz.2.3549': attribute type 10 has an invalid length. [ 487.766990][T19822] bond0: (slave batadv0): Error -22 calling dev_set_mtu [ 487.933665][T19829] pim6reg: entered allmulticast mode [ 487.958932][T19831] pim6reg: left allmulticast mode [ 488.421722][T19852] lo speed is unknown, defaulting to 1000 [ 488.442252][T19856] netlink: 212368 bytes leftover after parsing attributes in process `syz.1.3559'. [ 488.492138][ T5816] IPVS: starting estimator thread 0... [ 488.507026][T19863] IPVS: sh: FWM 3 0x00000003 - no destination available [ 488.530169][ C1] IPVS: sh: FWM 3 0x00000003 - no destination available [ 488.554965][T19862] netlink: 'syz.4.3560': attribute type 39 has an invalid length. [ 488.602045][T19864] IPVS: using max 26 ests per chain, 62400 per kthread [ 488.782345][T19869] xt_AUDIT: Audit type out of range (valid range: 0..2) [ 488.856665][T19870] netlink: 8 bytes leftover after parsing attributes in process `syz.1.3562'. [ 489.077033][T19852] lo speed is unknown, defaulting to 1000 [ 489.150669][T19884] netlink: 'syz.2.3566': attribute type 58 has an invalid length. [ 489.164964][T19884] netlink: 20 bytes leftover after parsing attributes in process `syz.2.3566'. [ 489.285907][T19887] netlink: 8 bytes leftover after parsing attributes in process `syz.3.3564'. [ 489.469074][T19905] netlink: 4 bytes leftover after parsing attributes in process `syz.4.3571'. [ 489.549115][T19900] bond3: option mode: invalid value (254) [ 489.567901][T19900] bond3 (unregistering): Released all slaves [ 489.721601][T19915] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 490.761789][T19952] IPv6: NLM_F_CREATE should be specified when creating new route [ 490.784162][T19952] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 490.791525][T19952] IPv6: NLM_F_CREATE should be set when creating new route [ 490.798824][T19952] IPv6: NLM_F_CREATE should be set when creating new route [ 491.190105][T19968] __nla_validate_parse: 2 callbacks suppressed [ 491.190127][T19968] netlink: 8 bytes leftover after parsing attributes in process `syz.3.3589'. [ 491.205481][T19968] netdevsim netdevsim3 netdevsim0: entered allmulticast mode [ 491.385937][T19978] netlink: 12 bytes leftover after parsing attributes in process `syz.0.3593'. [ 491.410574][T19983] Cannot find set identified by id 0 to match [ 491.431813][T19981] xt_CHECKSUM: unsupported CHECKSUM operation 68 [ 491.582015][T19996] sch_tbf: peakrate 7 is lower than or equals to rate 6829859379779001161 ! [ 491.596076][T19994] netlink: 4 bytes leftover after parsing attributes in process `syz.4.3599'. [ 491.612906][T19994] vlan2: left allmulticast mode [ 491.637344][T19994] bond0: left allmulticast mode [ 491.656205][T19994] bond_slave_0: left allmulticast mode [ 491.674467][T19994] bond_slave_1: left allmulticast mode [ 491.704856][T19994] dummy0: left allmulticast mode [ 491.730494][T19994] vlan2: left promiscuous mode [ 491.748751][T19994] bond0: left promiscuous mode [ 491.770150][T19994] bond_slave_0: left promiscuous mode [ 491.802990][T19994] bond_slave_1: left promiscuous mode [ 491.828585][T19994] dummy0: left promiscuous mode [ 491.846433][T19994] bridge0: port 3(vlan2) entered disabled state [ 491.869427][T19994] bridge_slave_1: left allmulticast mode [ 491.884783][T19994] bridge_slave_1: left promiscuous mode [ 491.891273][T19994] bridge0: port 2(bridge_slave_1) entered disabled state [ 491.902220][T19994] bridge_slave_0: left allmulticast mode [ 491.911205][T19994] bridge_slave_0: left promiscuous mode [ 491.919071][T19994] bridge0: port 1(bridge_slave_0) entered disabled state [ 491.935480][T20011] Cannot find del_set index 0 as target [ 492.239416][T20018] netlink: 'syz.3.3607': attribute type 30 has an invalid length. [ 492.268475][T20024] netlink: 12 bytes leftover after parsing attributes in process `syz.4.3608'. [ 492.283241][T20025] geneve2: entered promiscuous mode [ 492.296494][T20025] geneve2: entered allmulticast mode [ 492.462830][T20022] lo speed is unknown, defaulting to 1000 [ 492.786293][T20022] lo speed is unknown, defaulting to 1000 [ 492.822098][T20063] netlink: 8 bytes leftover after parsing attributes in process `syz.2.3617'. [ 492.902444][T20068] netlink: 'syz.0.3619': attribute type 7 has an invalid length. [ 492.930700][T20068] netlink: 148 bytes leftover after parsing attributes in process `syz.0.3619'. [ 493.993097][T20112] netlink: 60 bytes leftover after parsing attributes in process `syz.3.3633'. [ 494.005752][T20112] netlink: 60 bytes leftover after parsing attributes in process `syz.3.3633'. [ 494.055788][T20112] netlink: 60 bytes leftover after parsing attributes in process `syz.3.3633'. [ 494.085237][T20112] netlink: 60 bytes leftover after parsing attributes in process `syz.3.3633'. [ 494.631377][T20159] syzkaller0: entered promiscuous mode [ 494.652647][T20159] syzkaller0: entered allmulticast mode [ 494.781932][T20161] syzkaller0: entered promiscuous mode [ 494.795977][T20161] syzkaller0: entered allmulticast mode [ 494.834102][T20161] macsec1: entered promiscuous mode [ 495.116062][T20182] lo: entered allmulticast mode [ 495.122425][T20182] lo: left allmulticast mode [ 495.459201][T20197] bridge1: entered promiscuous mode [ 495.482347][T20197] bridge1: port 1(macvtap1) entered blocking state [ 495.502986][T20197] bridge1: port 1(macvtap1) entered disabled state [ 495.510331][T20197] macvtap1: entered allmulticast mode [ 495.517428][T20197] bridge1: entered allmulticast mode [ 495.528441][T20197] macvtap1: left allmulticast mode [ 495.533846][T20197] bridge1: left allmulticast mode [ 495.562936][T20197] bridge1: left promiscuous mode [ 495.717319][T20207] xt_TCPMSS: Only works on TCP SYN packets [ 496.321905][T20215] netlink: 'syz.3.3663': attribute type 1 has an invalid length. [ 496.404752][T20215] 8021q: adding VLAN 0 to HW filter on device bond4 [ 496.447780][T20224] __nla_validate_parse: 7 callbacks suppressed [ 496.447801][T20224] netlink: 64 bytes leftover after parsing attributes in process `syz.4.3667'. [ 496.495140][T20221] vlan2: entered allmulticast mode [ 496.510389][T20221] bond4: entered allmulticast mode [ 496.572771][T20224] netlink: 40 bytes leftover after parsing attributes in process `syz.4.3667'. [ 496.597076][T20215] bond4: (slave geneve2): making interface the new active one [ 496.619375][T20215] geneve2: entered allmulticast mode [ 496.629656][T20215] bond4: (slave geneve2): Enslaving as an active interface with an up link [ 496.668619][T20234] netlink: 14 bytes leftover after parsing attributes in process `syz.0.3670'. [ 496.719781][T20234] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 496.789359][T20236] netlink: 12 bytes leftover after parsing attributes in process `syz.2.3672'. [ 496.800273][T20234] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 496.829549][T20234] bond0 (unregistering): Released all slaves [ 496.951853][T20252] netlink: 6 bytes leftover after parsing attributes in process `syz.3.3674'. [ 497.153089][T20263] netlink: 'syz.3.3678': attribute type 1 has an invalid length. [ 497.583469][ T5197] udevd[5197]: worker [10238] /devices/virtual/block/nbd3 is taking a long time [ 498.073100][T20278] netlink: 12 bytes leftover after parsing attributes in process `syz.1.3681'. [ 498.082459][T20278] netlink: 24 bytes leftover after parsing attributes in process `syz.1.3681'. [ 498.746649][T20263] workqueue: Failed to create a rescuer kthread for wq "bond5": -EINTR [ 498.802351][T20272] lo speed is unknown, defaulting to 1000 [ 498.946135][T20285] ip6tnl0: entered promiscuous mode [ 498.951412][T20285] ip6tnl0: entered allmulticast mode [ 499.004304][T20290] netlink: 12 bytes leftover after parsing attributes in process `syz.4.3685'. [ 499.024191][T20290] IPVS: set_ctl: invalid protocol: 58 224.0.0.1:20001 [ 499.076969][T20298] netlink: 'syz.3.3682': attribute type 1 has an invalid length. [ 499.085057][T20298] netlink: 4 bytes leftover after parsing attributes in process `syz.3.3682'. [ 499.294282][T20272] lo speed is unknown, defaulting to 1000 [ 499.412741][T20304] netlink: 220 bytes leftover after parsing attributes in process `syz.3.3688'. [ 499.422131][T20304] netlink: 'syz.3.3688': attribute type 2 has an invalid length. [ 499.490415][T20308] syzkaller1: entered allmulticast mode [ 499.566059][T20311] syzkaller0: entered promiscuous mode [ 499.572034][T20311] syzkaller0: entered allmulticast mode [ 499.968971][T20333] xt_addrtype: output interface limitation not valid in PREROUTING and INPUT [ 500.011617][T20333] netlink: 'syz.3.3695': attribute type 1 has an invalid length. [ 500.164716][T20341] bridge0: entered promiscuous mode [ 500.182218][T20341] bridge0: entered allmulticast mode [ 500.203069][T20341] team0: Port device bridge0 added [ 500.215963][T20343] bridge0: port 1(team0) entered blocking state [ 500.222344][T20343] bridge0: port 1(team0) entered disabled state [ 500.246118][T20343] team0: entered allmulticast mode [ 500.277130][T20343] team_slave_1: entered allmulticast mode [ 500.295706][T20343] veth3: entered allmulticast mode [ 500.325908][T20343] team0: left allmulticast mode [ 500.330830][T20343] team_slave_1: left allmulticast mode [ 500.346817][T20343] veth3: left allmulticast mode [ 500.401930][T20351] netlink: 'syz.2.3701': attribute type 10 has an invalid length. [ 500.460022][T20351] veth0_vlan: left promiscuous mode [ 500.488926][T20354] netlink: 'syz.0.3702': attribute type 1 has an invalid length. [ 500.507948][T20351] veth0_vlan: entered promiscuous mode [ 500.528492][T20351] team0: Device veth0_vlan failed to register rx_handler [ 500.545899][T20359] netlink: 'syz.0.3702': attribute type 1 has an invalid length. [ 500.643953][T20362] netlink: 'syz.4.3704': attribute type 13 has an invalid length. [ 500.787188][T20372] Bluetooth: MGMT ver 1.23 [ 500.791933][T20372] Bluetooth: hci1: too big key_count value 29096 [ 501.042103][T20376] netlink: 'syz.0.3708': attribute type 1 has an invalid length. [ 501.458560][T20396] __nla_validate_parse: 107 callbacks suppressed [ 501.458580][T20396] netlink: 36 bytes leftover after parsing attributes in process `syz.1.3716'. [ 501.596030][T20398] pimreg: tun_chr_ioctl cmd 1074025677 [ 501.625919][T20398] pimreg: linktype set to 0 [ 501.632990][T20398] tipc: Started in network mode [ 501.655757][T20398] tipc: Node identity be6ba8f1b0f3, cluster identity 4711 [ 501.663115][T20398] tipc: Enabled bearer , priority 0 [ 501.681073][T20399] syzkaller0: entered allmulticast mode [ 501.704503][T20403] netlink: 8 bytes leftover after parsing attributes in process `syz.2.3718'. [ 501.766100][T20400] tipc: Resetting bearer [ 501.779116][T20400] netlink: 'syz.1.3717': attribute type 3 has an invalid length. [ 501.818663][T20400] netlink: 'syz.1.3717': attribute type 1 has an invalid length. [ 501.852558][T20400] netlink: 224 bytes leftover after parsing attributes in process `syz.1.3717'. [ 501.876154][T20400] NCSI netlink: No device for ifindex 65572 [ 502.027494][T20420] netlink: 12 bytes leftover after parsing attributes in process `syz.3.3722'. [ 502.127634][T20397] tipc: Resetting bearer [ 502.174350][T20397] tipc: Disabling bearer [ 502.218429][T20428] netlink: 12 bytes leftover after parsing attributes in process `syz.0.3723'. [ 502.503176][T20441] netlink: 536 bytes leftover after parsing attributes in process `syz.4.3728'. [ 502.543156][T20443] netlink: 36 bytes leftover after parsing attributes in process `syz.0.3727'. [ 502.721040][T20455] netlink: 96 bytes leftover after parsing attributes in process `syz.4.3730'. [ 502.868477][T20459] syzkaller0: entered promiscuous mode [ 502.881427][T20459] syzkaller0: entered allmulticast mode [ 502.900730][T20459] netlink: 190972 bytes leftover after parsing attributes in process `syz.1.3731'. [ 503.241128][T20474] A link change request failed with some changes committed already. Interface syz_tun may have been left with an inconsistent configuration, please check. [ 503.296532][T20472] No such timeout policy "syz1" [ 503.430533][T20481] tap0: tun_chr_ioctl cmd 1074025676 [ 503.437611][T20481] tap0: owner set to 0 [ 503.664533][T20497] netlink: 4 bytes leftover after parsing attributes in process `syz.0.3746'. [ 503.986811][T20502] bridge0: port 2(bridge_slave_1) entered disabled state [ 503.994525][T20502] bridge0: port 1(bridge_slave_0) entered disabled state [ 504.098630][ T1756] block nbd3: Possible stuck request ffff888027578000: control (read@0,1024B). Runtime 90 seconds [ 504.111308][ T1756] block nbd3: Possible stuck request ffff888027578200: control (read@1024,1024B). Runtime 90 seconds [ 504.122481][ T1756] block nbd3: Possible stuck request ffff888027578400: control (read@2048,1024B). Runtime 90 seconds [ 504.135522][ T1756] block nbd3: Possible stuck request ffff888027578600: control (read@3072,1024B). Runtime 90 seconds [ 504.257049][T20502] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 504.340938][T20502] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 505.070889][T20497] team0: Port device team_slave_0 removed [ 505.188229][T20506] syzkaller1: entered promiscuous mode [ 505.196579][T20506] syzkaller1: entered allmulticast mode [ 505.237109][T20517] syzkaller1: entered allmulticast mode [ 505.242956][ T9404] netdevsim netdevsim1 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 505.257726][T20525] validate_nla: 2 callbacks suppressed [ 505.257747][T20525] netlink: 'syz.1.3751': attribute type 1 has an invalid length. [ 505.278893][ T9404] netdevsim netdevsim1 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 505.360930][T20525] 8021q: adding VLAN 0 to HW filter on device bond2 [ 505.440876][ T9404] netdevsim netdevsim1 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 505.474073][T20536] tipc: Enabling of bearer rejected, failed to enable media [ 505.512492][T20542] batadv_slave_1: entered promiscuous mode [ 505.529401][ T9404] netdevsim netdevsim1 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 505.568233][T20542] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 505.629927][T20542] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 505.686098][T20550] netlink: 'syz.2.3756': attribute type 6 has an invalid length. [ 505.704230][T20550] netlink: 'syz.2.3756': attribute type 5 has an invalid length. [ 505.740618][T20542] batadv_slave_1: left promiscuous mode [ 505.962069][T20562] vlan3: entered promiscuous mode [ 505.995807][T20562] geneve1: entered promiscuous mode [ 506.021754][T20562] vlan3: entered allmulticast mode [ 506.063405][T20562] geneve1: entered allmulticast mode [ 506.168691][T20567] ip6tnl1: entered allmulticast mode [ 506.489157][T20587] sctp: [Deprecated]: syz.2.3766 (pid 20587) Use of int in max_burst socket option. [ 506.489157][T20587] Use struct sctp_assoc_value instead [ 507.675668][T20636] __nla_validate_parse: 25 callbacks suppressed [ 507.675688][T20636] netlink: 4 bytes leftover after parsing attributes in process `syz.1.3775'. [ 507.754427][ T49] netdevsim netdevsim1 netdevsim0: set [0, 0] type 1 family 0 port 8472 - 0 [ 507.795677][ T49] netdevsim netdevsim1 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0 [ 507.815841][ T212] netdevsim netdevsim1 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0 [ 507.840066][ T212] netdevsim netdevsim1 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0 [ 507.906923][T20646] netlink: 20 bytes leftover after parsing attributes in process `syz.4.3779'. [ 507.916686][T20646] netlink: 28 bytes leftover after parsing attributes in process `syz.4.3779'. [ 508.168984][T20664] netlink: 44 bytes leftover after parsing attributes in process `syz.2.3783'. [ 508.428636][T20680] netlink: 'syz.3.3788': attribute type 13 has an invalid length. [ 509.299681][T20723] netlink: 8 bytes leftover after parsing attributes in process `syz.3.3797'. [ 509.349038][T20722] netlink: 24 bytes leftover after parsing attributes in process `syz.3.3797'. [ 509.389487][T20723] netlink: 8 bytes leftover after parsing attributes in process `syz.3.3797'. [ 509.470257][T20723] netlink: 8 bytes leftover after parsing attributes in process `syz.3.3797'. [ 509.511425][T20723] netlink: 8 bytes leftover after parsing attributes in process `syz.3.3797'. [ 509.522748][T20737] netlink: 8 bytes leftover after parsing attributes in process `syz.2.3800'. [ 510.290089][T20770] vxcan3: entered promiscuous mode [ 510.460759][T20776] vlan2: entered promiscuous mode [ 510.474738][T20776] veth0_to_team: entered promiscuous mode [ 510.495186][T20776] vlan2: entered allmulticast mode [ 510.501129][T20776] veth0_to_team: entered allmulticast mode [ 510.529797][T20785] xt_TCPMSS: Only works on TCP SYN packets [ 510.630960][T20790] lo: Caught tx_queue_len zero misconfig [ 511.225715][T20813] FAULT_INJECTION: forcing a failure. [ 511.225715][T20813] name failslab, interval 1, probability 0, space 0, times 0 [ 511.238965][T20813] CPU: 1 UID: 0 PID: 20813 Comm: syz.1.3821 Not tainted syzkaller #0 PREEMPT(full) [ 511.238995][T20813] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 511.239009][T20813] Call Trace: [ 511.239018][T20813] [ 511.239028][T20813] dump_stack_lvl+0xe8/0x150 [ 511.239064][T20813] should_fail_ex+0x412/0x560 [ 511.239102][T20813] should_failslab+0xa8/0x100 [ 511.239131][T20813] ? skb_clone+0x212/0x3a0 [ 511.239162][T20813] kmem_cache_alloc_noprof+0x87/0x650 [ 511.239184][T20813] ? apparmor_capable+0x126/0x170 [ 511.239218][T20813] skb_clone+0x212/0x3a0 [ 511.239244][T20813] ? nfnetlink_rcv+0x4b0/0x27b0 [ 511.239282][T20813] nfnetlink_rcv+0x4e2/0x27b0 [ 511.239300][T20813] ? is_bpf_text_address+0x26/0x2b0 [ 511.239329][T20813] ? is_bpf_text_address+0x292/0x2b0 [ 511.239351][T20813] ? is_bpf_text_address+0x26/0x2b0 [ 511.239380][T20813] ? __kernel_text_address+0xd/0x30 [ 511.239405][T20813] ? unwind_get_return_address+0x4d/0x90 [ 511.239438][T20813] ? __pfx_stack_trace_consume_entry+0x10/0x10 [ 511.239493][T20813] ? arch_stack_walk+0xfb/0x150 [ 511.239535][T20813] ? __lock_acquire+0x6b5/0x2cf0 [ 511.239561][T20813] ? __pfx_nfnetlink_rcv+0x10/0x10 [ 511.239593][T20813] ? __lock_acquire+0x6b5/0x2cf0 [ 511.239629][T20813] ? __lock_acquire+0x6b5/0x2cf0 [ 511.239663][T20813] ? __netlink_lookup+0xc6/0x8b0 [ 511.239694][T20813] ? __netlink_lookup+0x7e4/0x8b0 [ 511.239734][T20813] ? netlink_deliver_tap+0x2e/0x1b0 [ 511.239775][T20813] netlink_unicast+0x80f/0x9b0 [ 511.239818][T20813] ? __pfx_netlink_unicast+0x10/0x10 [ 511.239862][T20813] ? netlink_sendmsg+0x650/0xb40 [ 511.239884][T20813] ? skb_put+0x11b/0x210 [ 511.239913][T20813] netlink_sendmsg+0x813/0xb40 [ 511.239947][T20813] ? __pfx_netlink_sendmsg+0x10/0x10 [ 511.239974][T20813] ? aa_sock_msg_perm+0xf1/0x1b0 [ 511.240008][T20813] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 511.240037][T20813] ____sys_sendmsg+0x972/0x9f0 [ 511.240075][T20813] ? __pfx_____sys_sendmsg+0x10/0x10 [ 511.240113][T20813] ? import_iovec+0x73/0xa0 [ 511.240142][T20813] ___sys_sendmsg+0x2a5/0x360 [ 511.240176][T20813] ? __pfx____sys_sendmsg+0x10/0x10 [ 511.240242][T20813] ? __fget_files+0x2a/0x420 [ 511.240273][T20813] ? __fget_files+0x3a0/0x420 [ 511.240315][T20813] __x64_sys_sendmsg+0x1bd/0x2a0 [ 511.240347][T20813] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 511.240384][T20813] ? __pfx_ksys_write+0x10/0x10 [ 511.240421][T20813] do_syscall_64+0x14d/0xf80 [ 511.240453][T20813] ? trace_irq_disable+0x3b/0x150 [ 511.240471][T20813] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 511.240493][T20813] ? clear_bhb_loop+0x40/0x90 [ 511.240520][T20813] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 511.240541][T20813] RIP: 0033:0x7f76a699c799 [ 511.240562][T20813] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 511.240581][T20813] RSP: 002b:00007f76a7890028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 511.240604][T20813] RAX: ffffffffffffffda RBX: 00007f76a6c15fa0 RCX: 00007f76a699c799 [ 511.240620][T20813] RDX: 0000000000000000 RSI: 0000200000000200 RDI: 0000000000000003 [ 511.240633][T20813] RBP: 00007f76a7890090 R08: 0000000000000000 R09: 0000000000000000 [ 511.240646][T20813] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 511.240658][T20813] R13: 00007f76a6c16038 R14: 00007f76a6c15fa0 R15: 00007fffb101aee8 [ 511.240692][T20813] [ 511.668035][T20818] ip6_vti0: Caught tx_queue_len zero misconfig [ 511.748443][T20820] netdevsim netdevsim1: Firmware load for '..' refused, path contains '..' component [ 511.848771][T20818] lo speed is unknown, defaulting to 1000 [ 511.921636][T20831] vlan4: entered promiscuous mode [ 511.926893][T20831] geneve1: entered promiscuous mode [ 511.932614][T20831] vlan4: entered allmulticast mode [ 511.938064][T20831] geneve1: entered allmulticast mode [ 512.121671][T20837] dvmrp1: entered allmulticast mode [ 512.466117][T20818] lo speed is unknown, defaulting to 1000 [ 512.641867][T20867] x_tables: unsorted entry at hook 2 [ 512.779787][T20879] __nla_validate_parse: 66 callbacks suppressed [ 512.779807][T20879] netlink: 12 bytes leftover after parsing attributes in process `syz.2.3839'. [ 512.883581][T20884] netlink: 216 bytes leftover after parsing attributes in process `syz.4.3841'. [ 512.941957][T20884] netlink: 24 bytes leftover after parsing attributes in process `syz.4.3841'. [ 512.967267][T20884] netlink: 16 bytes leftover after parsing attributes in process `syz.4.3841'. [ 513.021734][T20887] netlink: 28 bytes leftover after parsing attributes in process `syz.2.3843'. [ 513.643108][T20929] netlink: 8 bytes leftover after parsing attributes in process `syz.1.3851'. [ 513.696068][T20929] netdevsim netdevsim1 netdevsim0: entered allmulticast mode [ 513.919088][T20939] netlink: 'syz.0.3854': attribute type 1 has an invalid length. [ 514.019732][T20944] netlink: 132 bytes leftover after parsing attributes in process `syz.0.3857'. [ 514.058494][T20949] netlink: 28 bytes leftover after parsing attributes in process `syz.3.3858'. [ 514.067946][T20949] openvswitch: netlink: Flow key attr not present in new flow. [ 514.158482][T20953] netlink: 28 bytes leftover after parsing attributes in process `syz.3.3858'. [ 514.169154][T20953] bridge0: port 2(bridge_slave_1) entered disabled state [ 514.176998][T20953] bridge0: port 1(bridge_slave_0) entered disabled state [ 514.236192][T20955] netlink: 8 bytes leftover after parsing attributes in process `syz.3.3858'. [ 514.277603][ T36] wlan0: No active IBSS STAs - trying to scan for other IBSS networks with same SSID (merge) [ 514.354893][T20959] netlink: 'syz.4.3862': attribute type 29 has an invalid length. [ 514.691523][T20970] x_tables: ip_tables: icmp match: only valid for protocol 1 [ 515.727651][T21007] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 515.757950][ T6648] lo speed is unknown, defaulting to 1000 [ 515.790305][T21012] batadv0: entered promiscuous mode [ 515.823000][T21012] 8021q: adding VLAN 0 to HW filter on device macvtap1 [ 515.913087][T21020] 8021q: adding VLAN 0 to HW filter on device bond3 [ 516.201222][ T1756] block nbd2: Possible stuck request ffff888027518000: control (read@0,1024B). Runtime 270 seconds [ 516.212253][ T1756] block nbd2: Possible stuck request ffff888027518200: control (read@1024,1024B). Runtime 270 seconds [ 516.224796][ T1756] block nbd2: Possible stuck request ffff888027518400: control (read@2048,1024B). Runtime 270 seconds [ 516.236379][ T1756] block nbd2: Possible stuck request ffff888027518600: control (read@3072,1024B). Runtime 270 seconds [ 516.344222][T21050] x_tables: unsorted entry at hook 2 [ 516.377447][T21049] block nbd4: Unsupported socket: should be TCP or UNIX. [ 516.383003][T21052] netlink: 'syz.2.3887': attribute type 2 has an invalid length. [ 516.541020][T21063] bridge0: port 3(gretap0) entered blocking state [ 516.561433][T21063] bridge0: port 3(gretap0) entered disabled state [ 516.581778][T21063] gretap0: entered allmulticast mode [ 516.612623][T21063] gretap0: entered promiscuous mode [ 516.619063][T21065] netlink: 'syz.0.3891': attribute type 4 has an invalid length. [ 516.641446][T21063] bridge0: port 3(gretap0) entered blocking state [ 516.648119][T21063] bridge0: port 3(gretap0) entered forwarding state [ 516.676495][T21058] syzkaller0: entered promiscuous mode [ 516.682181][T21058] syzkaller0: entered allmulticast mode [ 517.123299][T21085] netlink: 'syz.2.3899': attribute type 4 has an invalid length. [ 517.708634][T21108] netlink: 'syz.3.3906': attribute type 1 has an invalid length. [ 518.549555][T21134] __nla_validate_parse: 5 callbacks suppressed [ 518.549579][T21134] netlink: 12 bytes leftover after parsing attributes in process `syz.3.3913'. [ 518.750113][T21134] 8021q: adding VLAN 0 to HW filter on device bond5 [ 518.808635][T21136] macvtap2: entered promiscuous mode [ 519.587938][T21169] bridge1: trying to set multicast startup query interval below minimum, setting to 100 (1000ms) [ 519.674006][T21177] xt_bpf: check failed: parse error [ 519.684656][T21177] siw: device registration error -23 [ 519.759558][T21180] : renamed from veth0_to_bond (while UP) [ 519.875375][T21193] netlink: 'syz.2.3928': attribute type 1 has an invalid length. [ 519.921933][T21191] netlink: 'syz.0.3929': attribute type 3 has an invalid length. [ 519.930457][T21191] netlink: 'syz.0.3929': attribute type 3 has an invalid length. [ 520.395677][T21169] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 520.537555][T21202] tipc: Enabled bearer , priority 0 [ 520.545436][T21202] syzkaller0: entered promiscuous mode [ 520.551874][T21202] syzkaller0: entered allmulticast mode [ 520.648423][T21199] tipc: Resetting bearer [ 520.704908][T21199] tipc: Disabling bearer [ 520.806463][T21214] lo speed is unknown, defaulting to 1000 [ 521.109616][T21233] netlink: 4 bytes leftover after parsing attributes in process `syz.4.3940'. [ 521.437603][T21238] netlink: 8 bytes leftover after parsing attributes in process `syz.4.3942'. [ 521.514996][T21237] delete_channel: no stack [ 521.592115][T21214] lo speed is unknown, defaulting to 1000 [ 521.592225][T21210] lo speed is unknown, defaulting to 1000 [ 521.725839][T21258] netlink: 8 bytes leftover after parsing attributes in process `syz.4.3947'. [ 521.761994][T21258] netlink: 'syz.4.3947': attribute type 21 has an invalid length. [ 521.800042][T21260] netlink: 20 bytes leftover after parsing attributes in process `syz.3.3948'. [ 522.088896][T21275] Cannot find del_set index 1536 as target [ 522.166755][T21278] netlink: 'syz.1.3950': attribute type 39 has an invalid length. [ 522.316720][T21285] lo speed is unknown, defaulting to 1000 [ 522.328890][T21210] lo speed is unknown, defaulting to 1000 [ 522.483276][T21290] netlink: 12 bytes leftover after parsing attributes in process `syz.1.3954'. [ 522.503948][T21292] netlink: 'syz.1.3954': attribute type 64 has an invalid length. [ 522.517080][T21291] netlink: 8 bytes leftover after parsing attributes in process `syz.1.3954'. [ 522.568562][T21290] workqueue: Failed to create a rescuer kthread for wq "bond4": -EINTR [ 522.678962][T21297] netlink: 'syz.3.3956': attribute type 1 has an invalid length. [ 522.739630][T21298] netlink: 12 bytes leftover after parsing attributes in process `syz.3.3956'. [ 522.773843][T21298] netlink: 12 bytes leftover after parsing attributes in process `syz.3.3956'. [ 522.823482][T21285] lo speed is unknown, defaulting to 1000 [ 522.919153][T21301] netlink: 28 bytes leftover after parsing attributes in process `syz.1.3957'. [ 523.726530][T21324] Bluetooth: hci5: link tx timeout [ 523.731825][T21324] Bluetooth: hci5: killing stalled connection 10:aa:aa:aa:aa:aa [ 523.933633][T21333] lo speed is unknown, defaulting to 1000 [ 524.039111][T21332] Bluetooth: hci3: command 0x040f tx timeout [ 524.342910][T21333] lo speed is unknown, defaulting to 1000 [ 524.888258][T21377] __nla_validate_parse: 1 callbacks suppressed [ 524.888282][T21377] netlink: 28 bytes leftover after parsing attributes in process `syz.2.3973'. [ 524.932062][T21376] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 525.524749][T21392] xt_hashlimit: size too large, truncated to 1048576 [ 525.547224][T21392] xt_hashlimit: invalid interval [ 525.563715][T21390] lo speed is unknown, defaulting to 1000 [ 525.606527][T21394] netlink: 28 bytes leftover after parsing attributes in process `syz.0.3981'. [ 525.636426][ T5835] Bluetooth: hci4: command 0x0405 tx timeout [ 525.654284][T21397] bond_slave_0: entered promiscuous mode [ 525.660345][T21397] bond_slave_1: entered promiscuous mode [ 525.666966][T21397] netlink: 8 bytes leftover after parsing attributes in process `syz.3.3982'. [ 525.701941][T21397] bond_slave_0: left promiscuous mode [ 525.707469][T21397] bond_slave_1: left promiscuous mode [ 525.796894][T16849] Bluetooth: hci5: command 0x0406 tx timeout [ 526.191020][T21410] netlink: 'syz.0.3984': attribute type 11 has an invalid length. [ 526.208981][T21414] FAULT_INJECTION: forcing a failure. [ 526.208981][T21414] name failslab, interval 1, probability 0, space 0, times 0 [ 526.222284][T21414] CPU: 0 UID: 0 PID: 21414 Comm: syz.3.3985 Not tainted syzkaller #0 PREEMPT(full) [ 526.222312][T21414] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 526.222325][T21414] Call Trace: [ 526.222333][T21414] [ 526.222342][T21414] dump_stack_lvl+0xe8/0x150 [ 526.222379][T21414] should_fail_ex+0x412/0x560 [ 526.222418][T21414] should_failslab+0xa8/0x100 [ 526.222448][T21414] __kmalloc_noprof+0xe8/0x760 [ 526.222473][T21414] ? genl_family_rcv_msg_attrs_parse+0xd0/0x2f0 [ 526.222510][T21414] genl_family_rcv_msg_attrs_parse+0xd0/0x2f0 [ 526.222549][T21414] genl_family_rcv_msg_doit+0xd9/0x330 [ 526.222586][T21414] ? __pfx_genl_family_rcv_msg_doit+0x10/0x10 [ 526.222625][T21414] ? apparmor_capable+0x126/0x170 [ 526.222652][T21414] ? bpf_lsm_capable+0x9/0x20 [ 526.222682][T21414] ? security_capable+0x7e/0x2c0 [ 526.222840][T21414] genl_rcv_msg+0x61c/0x7a0 [ 526.222877][T21414] ? __pfx_genl_rcv_msg+0x10/0x10 [ 526.222912][T21414] ? __pfx_nl80211_pre_doit+0x10/0x10 [ 526.223013][T21414] ? __pfx_nl80211_set_bss+0x10/0x10 [ 526.223047][T21414] ? __pfx_nl80211_post_doit+0x10/0x10 [ 526.223075][T21414] ? __lock_acquire+0x6b5/0x2cf0 [ 526.223116][T21414] netlink_rcv_skb+0x232/0x4b0 [ 526.223140][T21414] ? __pfx_genl_rcv_msg+0x10/0x10 [ 526.223171][T21414] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 526.223214][T21414] ? down_read+0x272/0x2e0 [ 526.223234][T21414] ? genl_rcv+0xd/0x40 [ 526.223264][T21414] genl_rcv+0x28/0x40 [ 526.223290][T21414] netlink_unicast+0x80f/0x9b0 [ 526.223332][T21414] ? __pfx_netlink_unicast+0x10/0x10 [ 526.223368][T21414] ? netlink_sendmsg+0x650/0xb40 [ 526.223390][T21414] ? skb_put+0x11b/0x210 [ 526.223420][T21414] netlink_sendmsg+0x813/0xb40 [ 526.223455][T21414] ? __pfx_netlink_sendmsg+0x10/0x10 [ 526.223483][T21414] ? aa_sock_msg_perm+0xf1/0x1b0 [ 526.223516][T21414] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 526.223545][T21414] ____sys_sendmsg+0x972/0x9f0 [ 526.223584][T21414] ? __pfx_____sys_sendmsg+0x10/0x10 [ 526.223622][T21414] ? import_iovec+0x73/0xa0 [ 526.223651][T21414] ___sys_sendmsg+0x2a5/0x360 [ 526.223686][T21414] ? __pfx____sys_sendmsg+0x10/0x10 [ 526.223754][T21414] ? __fget_files+0x2a/0x420 [ 526.223785][T21414] ? __fget_files+0x3a0/0x420 [ 526.223829][T21414] __x64_sys_sendmsg+0x1bd/0x2a0 [ 526.223861][T21414] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 526.223900][T21414] ? __pfx_ksys_write+0x10/0x10 [ 526.223944][T21414] do_syscall_64+0x14d/0xf80 [ 526.223976][T21414] ? trace_irq_disable+0x3b/0x150 [ 526.223994][T21414] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 526.224016][T21414] ? clear_bhb_loop+0x40/0x90 [ 526.224042][T21414] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 526.224063][T21414] RIP: 0033:0x7f72b899c799 [ 526.224084][T21414] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 526.224103][T21414] RSP: 002b:00007f72b9879028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 526.224127][T21414] RAX: ffffffffffffffda RBX: 00007f72b8c15fa0 RCX: 00007f72b899c799 [ 526.224142][T21414] RDX: 0000000004000000 RSI: 0000200000000140 RDI: 0000000000000003 [ 526.224156][T21414] RBP: 00007f72b9879090 R08: 0000000000000000 R09: 0000000000000000 [ 526.224170][T21414] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 526.224182][T21414] R13: 00007f72b8c16038 R14: 00007f72b8c15fa0 R15: 00007ffdfe9bb9a8 [ 526.224218][T21414] [ 526.637832][T21395] ================================================================== [ 526.645971][T21395] BUG: KASAN: slab-use-after-free in rose_transmit_link+0xe0/0xac0 [ 526.653998][T21395] Read of size 8 at addr ffff888046300478 by task syz.4.3980/21395 [ 526.661919][T21395] [ 526.664285][T21395] CPU: 1 UID: 0 PID: 21395 Comm: syz.4.3980 Not tainted syzkaller #0 PREEMPT(full) [ 526.664313][T21395] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 526.664336][T21395] Call Trace: [ 526.664345][T21395] [ 526.664354][T21395] dump_stack_lvl+0xe8/0x150 [ 526.664391][T21395] print_report+0xba/0x230 [ 526.664443][T21395] ? rose_transmit_link+0xe0/0xac0 [ 526.664464][T21395] kasan_report+0x117/0x150 [ 526.664495][T21395] ? rose_transmit_link+0xe0/0xac0 [ 526.664521][T21395] rose_transmit_link+0xe0/0xac0 [ 526.664544][T21395] ? __alloc_skb+0x4e5/0x7d0 [ 526.664567][T21395] ? skb_put+0x11b/0x210 [ 526.664594][T21395] rose_write_internal+0x1256/0x1b60 [ 526.664621][T21395] ? lockdep_hardirqs_on+0x7a/0x110 [ 526.664710][T21395] ? __pfx_rose_write_internal+0x10/0x10 [ 526.664737][T21395] ? timer_delete+0x245/0x340 [ 526.664772][T21395] rose_release+0x25b/0x510 [ 526.664837][T21395] sock_close+0xc3/0x240 [ 526.664870][T21395] ? __pfx_sock_close+0x10/0x10 [ 526.664902][T21395] __fput+0x44f/0xa70 [ 526.664948][T21395] task_work_run+0x1d9/0x270 [ 526.664974][T21395] ? __pfx_task_work_run+0x10/0x10 [ 526.664998][T21395] ? task_work_add+0x395/0x440 [ 526.665022][T21395] ? __pfx_task_work_add+0x10/0x10 [ 526.665046][T21395] get_signal+0x11eb/0x1330 [ 526.665086][T21395] arch_do_signal_or_restart+0xbc/0x830 [ 526.665131][T21395] ? __pfx_arch_do_signal_or_restart+0x10/0x10 [ 526.665169][T21395] exit_to_user_mode_loop+0x86/0x480 [ 526.665195][T21395] ? rcu_is_watching+0x15/0xb0 [ 526.665228][T21395] do_syscall_64+0x32d/0xf80 [ 526.665260][T21395] ? trace_irq_disable+0x3b/0x150 [ 526.665279][T21395] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 526.665301][T21395] ? clear_bhb_loop+0x40/0x90 [ 526.665332][T21395] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 526.665354][T21395] RIP: 0033:0x7fcf5879c799 [ 526.665376][T21395] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 526.665396][T21395] RSP: 002b:00007fcf596bb028 EFLAGS: 00000246 ORIG_RAX: 000000000000002a [ 526.665421][T21395] RAX: fffffffffffffe00 RBX: 00007fcf58a16090 RCX: 00007fcf5879c799 [ 526.665437][T21395] RDX: 0000000000000040 RSI: 00002000000000c0 RDI: 000000000000000a [ 526.665453][T21395] RBP: 00007fcf58832c99 R08: 0000000000000000 R09: 0000000000000000 [ 526.665467][T21395] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 526.665481][T21395] R13: 00007fcf58a16128 R14: 00007fcf58a16090 R15: 00007ffed0039fb8 [ 526.665508][T21395] [ 526.665516][T21395] [ 526.917096][T21395] Allocated by task 5492: [ 526.921468][T21395] kasan_save_track+0x3e/0x80 [ 526.926201][T21395] __kasan_kmalloc+0x93/0xb0 [ 526.930839][T21395] __kvmalloc_node_noprof+0x528/0x8a0 [ 526.936230][T21395] alloc_netdev_mqs+0xa6/0x11b0 [ 526.941116][T21395] bpq_device_event+0x413/0x6a0 [ 526.946153][T21395] notifier_call_chain+0x1be/0x400 [ 526.951392][T21395] __dev_notify_flags+0x1a9/0x310 [ 526.956439][T21395] netif_change_flags+0xe8/0x1a0 [ 526.961432][T21395] dev_change_flags+0x130/0x260 [ 526.966306][T21395] devinet_ioctl+0x9f2/0x1b30 [ 526.971081][T21395] inet_ioctl+0x42a/0x560 [ 526.975433][T21395] sock_do_ioctl+0x101/0x320 [ 526.980052][T21395] sock_ioctl+0x5c6/0x7f0 [ 526.984411][T21395] __se_sys_ioctl+0xfc/0x170 [ 526.989060][T21395] do_syscall_64+0x14d/0xf80 [ 526.993721][T21395] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 526.999631][T21395] [ 527.001965][T21395] Freed by task 16508: [ 527.006043][T21395] kasan_save_track+0x3e/0x80 [ 527.010759][T21395] kasan_save_free_info+0x46/0x50 [ 527.015829][T21395] __kasan_slab_free+0x5c/0x80 [ 527.020704][T21395] kfree+0x1c1/0x630 [ 527.024617][T21395] device_release+0xc4/0x1f0 [ 527.029240][T21395] kobject_put+0x228/0x560 [ 527.033809][T21395] netdev_run_todo+0xc75/0xde0 [ 527.038602][T21395] unregister_netdev+0x191/0x200 [ 527.043576][T21395] bnep_session+0x29d1/0x2c00 [ 527.048458][T21395] kthread+0x388/0x470 [ 527.052551][T21395] ret_from_fork+0x51e/0xb90 [ 527.057161][T21395] ret_from_fork_asm+0x1a/0x30 [ 527.061955][T21395] [ 527.064298][T21395] The buggy address belongs to the object at ffff888046300000 [ 527.064298][T21395] which belongs to the cache kmalloc-cg-4k of size 4096 [ 527.079241][T21395] The buggy address is located 1144 bytes inside of [ 527.079241][T21395] freed 4096-byte region [ffff888046300000, ffff888046301000) [ 527.093259][T21395] [ 527.095613][T21395] The buggy address belongs to the physical page: [ 527.102059][T21395] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x46300 [ 527.110850][T21395] head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 527.119415][T21395] memcg:ffff888046301011 [ 527.123676][T21395] flags: 0xfff00000000040(head|node=0|zone=1|lastcpupid=0x7ff) [ 527.131249][T21395] page_type: f5(slab) [ 527.135248][T21395] raw: 00fff00000000040 ffff88813fe02500 dead000000000100 dead000000000122 [ 527.143849][T21395] raw: 0000000000000000 0000200000040004 00000000f5000000 ffff888046301011 [ 527.152540][T21395] head: 00fff00000000040 ffff88813fe02500 dead000000000100 dead000000000122 [ 527.161234][T21395] head: 0000000000000000 0000200000040004 00000000f5000000 ffff888046301011 [ 527.169925][T21395] head: 00fff00000000003 ffffea000118c001 00000000ffffffff 00000000ffffffff [ 527.178609][T21395] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000008 [ 527.187291][T21395] page dumped because: kasan: bad access detected [ 527.193740][T21395] page_owner tracks the page as allocated [ 527.199479][T21395] page last allocated via order 3, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 13164, tgid 13154 (syz.4.1860), ts 297740241826, free_ts 297156365167 [ 527.221068][T21395] post_alloc_hook+0x231/0x280 [ 527.225895][T21395] get_page_from_freelist+0x24dc/0x2580 [ 527.231464][T21395] __alloc_frozen_pages_noprof+0x18d/0x380 [ 527.237288][T21395] allocate_slab+0x77/0x660 [ 527.241826][T21395] refill_objects+0x331/0x3c0 [ 527.246613][T21395] __pcs_replace_empty_main+0x2e6/0x730 [ 527.252183][T21395] __kvmalloc_node_noprof+0x657/0x8a0 [ 527.257657][T21395] bpf_stack_liveness_init+0x29/0x90 [ 527.262988][T21395] bpf_check+0x217d/0x1ce00 [ 527.267518][T21395] bpf_prog_load+0x1484/0x1ae0 [ 527.272309][T21395] __sys_bpf+0x618/0x950 [ 527.276580][T21395] __x64_sys_bpf+0x7c/0x90 [ 527.281034][T21395] do_syscall_64+0x14d/0xf80 [ 527.285653][T21395] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 527.291567][T21395] page last free pid 5814 tgid 5814 stack trace: [ 527.297913][T21395] __free_frozen_pages+0xc2b/0xdb0 [ 527.303049][T21395] __folio_put+0x414/0x4f0 [ 527.307542][T21395] skb_release_data+0x4cb/0x940 [ 527.312417][T21395] __kfree_skb+0x5d/0x210 [ 527.316764][T21395] skb_defer_free_flush+0x191/0x260 [ 527.321978][T21395] net_rx_action+0x455/0xf70 [ 527.326588][T21395] handle_softirqs+0x22a/0x870 [ 527.331371][T21395] do_softirq+0x76/0xd0 [ 527.335544][T21395] __local_bh_enable_ip+0xf8/0x130 [ 527.340712][T21395] tcp_sendmsg+0x21/0x50 [ 527.345063][T21395] sock_write_iter+0x406/0x4f0 [ 527.349852][T21395] vfs_write+0x61d/0xb90 [ 527.354111][T21395] ksys_write+0x150/0x270 [ 527.358453][T21395] do_syscall_64+0x14d/0xf80 [ 527.363071][T21395] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 527.368983][T21395] [ 527.371326][T21395] Memory state around the buggy address: [ 527.376968][T21395] ffff888046300300: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 527.385048][T21395] ffff888046300380: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 527.393126][T21395] >ffff888046300400: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 527.401213][T21395] ^ [ 527.409250][T21395] ffff888046300480: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 527.417333][T21395] ffff888046300500: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 527.425403][T21395] ================================================================== [ 527.485732][T21423] netlink: 24 bytes leftover after parsing attributes in process `syz.3.3988'. [ 527.499138][T21390] lo speed is unknown, defaulting to 1000 [ 527.533310][T21395] Kernel panic - not syncing: KASAN: panic_on_warn set ... [ 527.540584][T21395] CPU: 1 UID: 0 PID: 21395 Comm: syz.4.3980 Not tainted syzkaller #0 PREEMPT(full) [ 527.549991][T21395] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 527.560184][T21395] Call Trace: [ 527.563491][T21395] [ 527.566449][T21395] vpanic+0x56c/0xa60 [ 527.570480][T21395] ? __pfx_vpanic+0x10/0x10 [ 527.575030][T21395] ? __pfx___schedule+0x10/0x10 [ 527.579936][T21395] panic+0xc5/0xd0 [ 527.583736][T21395] ? __pfx_panic+0x10/0x10 [ 527.588189][T21395] ? preempt_schedule_common+0x82/0xd0 [ 527.593697][T21395] ? rose_transmit_link+0xe0/0xac0 [ 527.598849][T21395] check_panic_on_warn+0x89/0xb0 [ 527.603823][T21395] ? rose_transmit_link+0xe0/0xac0 [ 527.609061][T21395] end_report+0x73/0x180 [ 527.613348][T21395] ? rose_transmit_link+0xe0/0xac0 [ 527.618505][T21395] kasan_report+0x128/0x150 [ 527.623077][T21395] ? rose_transmit_link+0xe0/0xac0 [ 527.628230][T21395] rose_transmit_link+0xe0/0xac0 [ 527.633217][T21395] ? __alloc_skb+0x4e5/0x7d0 [ 527.637852][T21395] ? skb_put+0x11b/0x210 [ 527.642142][T21395] rose_write_internal+0x1256/0x1b60 [ 527.647474][T21395] ? lockdep_hardirqs_on+0x7a/0x110 [ 527.652729][T21395] ? __pfx_rose_write_internal+0x10/0x10 [ 527.658401][T21395] ? timer_delete+0x245/0x340 [ 527.663131][T21395] rose_release+0x25b/0x510 [ 527.667683][T21395] sock_close+0xc3/0x240 [ 527.671972][T21395] ? __pfx_sock_close+0x10/0x10 [ 527.676863][T21395] __fput+0x44f/0xa70 [ 527.680900][T21395] task_work_run+0x1d9/0x270 [ 527.685534][T21395] ? __pfx_task_work_run+0x10/0x10 [ 527.690673][T21395] ? task_work_add+0x395/0x440 [ 527.695460][T21395] ? __pfx_task_work_add+0x10/0x10 [ 527.700598][T21395] get_signal+0x11eb/0x1330 [ 527.705142][T21395] arch_do_signal_or_restart+0xbc/0x830 [ 527.710736][T21395] ? __pfx_arch_do_signal_or_restart+0x10/0x10 [ 527.716952][T21395] exit_to_user_mode_loop+0x86/0x480 [ 527.722284][T21395] ? rcu_is_watching+0x15/0xb0 [ 527.727096][T21395] do_syscall_64+0x32d/0xf80 [ 527.731732][T21395] ? trace_irq_disable+0x3b/0x150 [ 527.736777][T21395] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 527.742894][T21395] ? clear_bhb_loop+0x40/0x90 [ 527.747604][T21395] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 527.753521][T21395] RIP: 0033:0x7fcf5879c799 [ 527.757960][T21395] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 527.777592][T21395] RSP: 002b:00007fcf596bb028 EFLAGS: 00000246 ORIG_RAX: 000000000000002a [ 527.786065][T21395] RAX: fffffffffffffe00 RBX: 00007fcf58a16090 RCX: 00007fcf5879c799 [ 527.794081][T21395] RDX: 0000000000000040 RSI: 00002000000000c0 RDI: 000000000000000a [ 527.802083][T21395] RBP: 00007fcf58832c99 R08: 0000000000000000 R09: 0000000000000000 [ 527.810084][T21395] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 527.818074][T21395] R13: 00007fcf58a16128 R14: 00007fcf58a16090 R15: 00007ffed0039fb8 [ 527.826071][T21395] [ 527.829712][T21395] Kernel Offset: disabled [ 527.834039][T21395] Rebooting in 86400 seconds..