last executing test programs: 56.818933239s ago: executing program 1 (id=4795): r0 = socket$inet_sctp(0x2, 0x1, 0x84) setsockopt(r0, 0x84, 0x80, &(0x7f0000000000)="000000000100", 0x6) setsockopt(r0, 0x84, 0x81, &(0x7f0000000040)="0000000001000000", 0x8) bind$inet(r0, &(0x7f0000000080)={0x2, 0x4e20, @loopback}, 0x10) listen(r0, 0x5) r1 = socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt(r1, 0x84, 0x80, &(0x7f0000000100)="0000000001000000", 0x8) setsockopt(r1, 0x84, 0x81, &(0x7f0000000140)="0000000001000000", 0x8) bind$inet6(r1, &(0x7f0000000180)={0xa, 0x0, 0x0, @loopback}, 0x1c) setsockopt$inet_sctp6_SCTP_SOCKOPT_BINDX_ADD(r1, 0x84, 0x64, &(0x7f00000001c0)=[@in={0x2, 0x0, @loopback}], 0x10) connect(r1, &(0x7f0000000200)=@in={0x2, 0x4e20, @loopback}, 0x80) setsockopt$inet_sctp6_SCTP_SOCKOPT_BINDX_REM(r1, 0x84, 0x65, &(0x7f0000000240)=[@in={0x2, 0x0, @loopback}], 0x10) setsockopt$inet_sctp6_SCTP_SOCKOPT_BINDX_ADD(r1, 0x84, 0x64, &(0x7f0000000280)=[@in], 0x10) 56.647799848s ago: executing program 4 (id=4796): r0 = socket$packet(0x11, 0x3, 0x300) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000240)={'gre0\x00', 0x0}) setsockopt$packet_int(r0, 0x107, 0xf, &(0x7f0000000140)=0x4, 0x4) sendto$packet(r0, &(0x7f0000000340)="05030006e8fe091c6202a0ffffffff006003000000007f141434e3177f43055762cb80948864113b0225", 0x2a, 0x0, &(0x7f0000000a80)={0x11, 0x88a8, r1, 0x1, 0x0, 0x6, @multicast}, 0x14) 56.288008571s ago: executing program 4 (id=4798): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$batadv(&(0x7f0000000400), 0xffffffffffffffff) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r0, 0x8933, &(0x7f0000000440)={'batadv0\x00', 0x0}) sendmsg$BATADV_CMD_SET_MESH(r0, &(0x7f0000000540)={0x0, 0x0, &(0x7f0000000500)={&(0x7f0000000040)={0x24, r1, 0x1, 0x70bd28, 0x4000001, {}, [@BATADV_ATTR_MESH_IFINDEX={0x8, 0x3, r2}, @BATADV_ATTR_DISTRIBUTED_ARP_TABLE_ENABLED={0x5, 0x2f, 0x1}]}, 0x24}}, 0x0) r3 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000700)={'wlan0\x00', 0x0}) r5 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r5, &(0x7f0000000800)={0x0, 0x0, &(0x7f0000000840)={&(0x7f0000000880)=@setlink={0x28, 0x13, 0x1, 0x0, 0x0, {0x0, 0x0, 0x0, r4}, [@IFLA_MASTER={0x8, 0xa, r2}]}, 0x28}}, 0x0) sendmsg$nl_route(r5, &(0x7f0000000a00)={0x0, 0x0, &(0x7f0000000a40)={&(0x7f0000000a80)=@setlink={0x20, 0x13, 0x1, 0x0, 0x0, {0x0, 0x0, 0x0, r2, 0x1, 0x1}}, 0x20}}, 0x0) r6 = socket$packet(0x11, 0x3, 0x300) bind$packet(r6, &(0x7f0000000b00)={0x11, 0x300, r2, 0x1, 0x0, 0x6, @broadcast}, 0x14) write(r6, &(0x7f0000000c00)="ffffffffffff52540012345608060001080006040001525400123456ac141414000000000000ac141420", 0x2a) write(r6, &(0x7f0000000c40)="ffffffffffff52540012345608060001080006040001525400123456c0a80101000000000000c0a80102", 0x2a) write(r6, &(0x7f0000000c80)="ffffffffffff525400123456080045000020000040004011b98fac141414ffffffff12341234000c000061626364", 0x32) r7 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$sock_int(r7, 0x1, 0x6, &(0x7f0000000d00)=0x1, 0x4) nanosleep(&(0x7f0000000e20)={0x1}, 0x0) 55.579390423s ago: executing program 1 (id=4802): r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000040)={0x1f, 0xffff, 0x3}, 0x6) write(r0, &(0x7f0000000100)="05000000010001", 0x7) read(r0, &(0x7f0000000400)=""/128, 0x80) write(r0, &(0x7f0000000140)="0d000000010001", 0x7) read(r0, &(0x7f0000000400)=""/128, 0x80) write(r0, &(0x7f0000000180)="3300000008000102030405060101", 0xe) read(r0, &(0x7f0000000400)=""/128, 0x80) write(r0, &(0x7f0000000280)='4\x00\x00\x00\a\x00\x00\x00\x00\x00\x00\x00\x00', 0xd) read(r0, &(0x7f0000000400)=""/128, 0x80) close(r0) 55.116167432s ago: executing program 4 (id=4805): r0 = socket$netlink(0x10, 0x3, 0xe) bind$netlink(r0, &(0x7f0000514ff4)={0x10, 0x0, 0x0, 0x1000}, 0xc) setsockopt$sock_int(r0, 0x1, 0x8, &(0x7f0000000300), 0x4) sendmsg$IPCTNL_MSG_TIMEOUT_DEFAULT_GET(r0, &(0x7f00000002c0)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x10}, 0xc, 0x0, 0x1, 0x0, 0x0, 0x4000000}, 0x4010) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = socket$nl_route(0x10, 0x3, 0x0) r4 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000000)={'bridge0\x00', 0x0}) r6 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r6, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000000c0)=@newlink={0x34, 0x10, 0x403, 0x0, 0x25dfdbfe, {0x0, 0x0, 0x74, r5, 0x5820, 0x55007}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @bridge={{0xb}, {0x4}}}]}, 0x34}, 0x1, 0x0, 0x0, 0x800}, 0x0) sendmsg$nl_route(r3, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000600)=@newlink={0x3c, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r5, 0x1bf5b}, [@IFLA_LINKINFO={0x1c, 0x12, 0x0, 0x1, @bridge={{0xb}, {0xc, 0x2, 0x0, 0x1, [@IFLA_BR_MCAST_QUERIER={0x5}]}}}]}, 0x3c}}, 0x0) r7 = syz_genetlink_get_family_id$batadv(&(0x7f0000000040), r2) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r1, 0x8933, &(0x7f0000000000)={'batadv0\x00', 0x0}) sendmsg$BATADV_CMD_GET_DAT_CACHE(r2, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000002c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r7, @ANYBLOB="05a300000000fedbdf250d00000008000300", @ANYRES32=r8], 0x1c}}, 0x20008000) r9 = socket$inet_udp(0x2, 0x2, 0x0) getsockopt$EBT_SO_GET_INFO(r9, 0x0, 0x80, &(0x7f0000000100)={'filter\x00', 0x0, 0x0, 0x0, [0xff, 0xfff, 0x6, 0x9, 0xfffffffffffffb69, 0x6]}, &(0x7f0000000000)=0x78) socket$netlink(0x10, 0x3, 0x10) r10 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) mmap(&(0x7f0000496000/0x2000)=nil, 0x2000, 0x0, 0x12, r10, 0x0) ioctl$FS_IOC_RESVSP(r10, 0x40305829, &(0x7f0000000180)={0x1100, 0x0, 0x52, 0x11000}) syz_genetlink_get_family_id$devlink(&(0x7f0000000040), 0xffffffffffffffff) r11 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$HCIINQUIRY(r11, 0x400448ca, 0x0) r12 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x22051, r12, 0x0) bpf$BPF_PROG_TEST_RUN_LIVE(0xa, &(0x7f0000000480)={r12, 0x0, 0xa5, 0x0, &(0x7f0000000340)="fcaaab55f676c36ba34345f2841ad9b32b3f196ee463263bcf6953fa7d4e01b58831080e16062d814bc3b2447bdfcc34cdcb6a76f3e35bf60bc35599af6396b612e0e7cb0671da643e253ba403055b00063ced2b4ff74d388b09f3dc27911f956eb25daec16bc20d3ed4035d7285f35140f695128681e6cd72206bc1bb4e6ab547148c80255cc8dae4ec3feb08b9d285113483d130a6951ed7c975aad8f3f47d76182ed839", 0x0, 0x4, 0x0, 0x4b, 0x0, &(0x7f0000000400)="36091653c559bcd5803298d042cd17ce1895eca39c66e013eb60563ea9ce1c471e772fc7dfb3865739bf44c84494e4097b54cfab51e2eab39054b7ccea1ab17913405eec2f332eef3b7a5d", 0x0, 0x2, 0x0, 0x6}, 0x50) bind$bt_hci(r11, &(0x7f0000000040)={0x1f, 0x0, 0x1}, 0x6) setsockopt$inet_sctp6_SCTP_AUTOCLOSE(r12, 0x84, 0x4, &(0x7f0000000240)=0x5, 0x4) pipe(&(0x7f0000000040)) 54.593401461s ago: executing program 0 (id=4806): r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$l2tp6(0xa, 0x2, 0x73) bind$l2tp6(r1, &(0x7f0000000000)={0xa, 0x0, 0x9, @initdev={0xfe, 0x88, '\x00', 0x1, 0x0}, 0xe226, 0x1}, 0x20) r2 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000040)={'netdevsim0\x00', &(0x7f0000000000)=@ethtool_pauseparam={0x3d, 0x1}}) sendmsg$nl_route_sched(r2, &(0x7f00000037c0)={0x0, 0x0, &(0x7f0000003780)={&(0x7f0000001340)=@newtaction={0x894, 0x30, 0x12f, 0x0, 0x0, {}, [{0x880, 0x1, [@m_police={0x87c, 0x1, 0x0, 0x0, {{0xb}, {0x850, 0x2, 0x0, 0x1, [[@TCA_POLICE_PEAKRATE={0x404, 0x3, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0xfffffffc, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x68, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1]}], [@TCA_POLICE_RATE={0x404, 0x2, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffc, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x419b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x200, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x8000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x100, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1]}, @TCA_POLICE_TBF={0x3c, 0x1, {0x0, 0x0, 0x0, 0x0, 0x0, {0x7, 0x0, 0x0, 0x0, 0x0, 0x7}, {0x7, 0x0, 0x0, 0x0, 0x0, 0x7}}}, @TCA_POLICE_RESULT={0x8, 0x5, 0x3}]]}, {0x4}, {0xc, 0xb}, {0xc, 0xa}}}]}]}, 0x894}}, 0x0) sendmsg$nl_route(r0, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=ANY=[@ANYBLOB="24000000200081dc28bd700003000000020000000000000310003200080018004e214e21"], 0x24}, 0x1, 0x0, 0x0, 0x81}, 0x40804) sendmsg$nl_route(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000180)=@newlink={0x3c, 0x10, 0x439, 0xffffffff, 0x0, {0x0, 0x0, 0x0, 0x0, 0x9801, 0x1313}, [@IFLA_LINKINFO={0x1c, 0x12, 0x0, 0x1, @ipip={{0x9}, {0xc, 0x2, 0x0, 0x1, [@IFLA_IPTUN_REMOTE={0x8, 0x3, @initdev={0xac, 0x1e, 0x0, 0x0}}]}}}]}, 0x3c}, 0x1, 0x0, 0x0, 0x5}, 0x40008c0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x1e, 0x4, &(0x7f0000000380)=ANY=[@ANYBLOB="1800000000000000000000000000000071121c4000ea13a98a69428693c19097ed3c0000009500000000000000f4ceba864f0e691de10c16ffda6aa4b0abad176bdb8f69bc09d0f71379ff7cdf7a1085664be354d316c901"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, 0x24}, 0x94) r3 = bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0x6, 0x5, &(0x7f0000000080)=ANY=[@ANYBLOB="18020000fbffffff19000000ffff000085000000d0000000850000002a0000009500000000000000"], &(0x7f00000001c0)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @xdp, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x800002}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000600)={r3, 0x0, 0x2107, 0x0, &(0x7f0000000100), 0x0, 0x1008, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9}, 0x50) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000140)={0x6, 0x3, &(0x7f0000000680)=ANY=[@ANYBLOB="1800000002000000000000000000000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x1}, 0x94) r4 = socket$unix(0x1, 0x2, 0x0) bind$unix(r4, &(0x7f0000000080)=@file={0x1, '\xe9\x1fq\x89Y\x1e\x923aK\x00'}, 0x6e) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000480)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r5, &(0x7f00000027c0)=@file={0x1, '\xe9\x1fq\x89Y\x1e\x923aK\x00'}, 0x6e) sendmmsg$unix(r5, &(0x7f00000bd000), 0x2d, 0x20040040) connect$unix(r5, &(0x7f0000000280)=@file={0x1, '\xe9\x1fq\x89Y\x1e\x923aK\x00'}, 0x6e) write$cgroup_subtree(0xffffffffffffffff, &(0x7f0000000000)=ANY=[@ANYBLOB="8fedcb79100a6c52d922ba2a05dd42"], 0xfdef) r6 = bpf$PROG_LOAD_XDP(0x5, &(0x7f00000007c0)={0x6, 0x3, &(0x7f0000000680)=ANY=[], &(0x7f00000002c0)='GPL\x00'}, 0x94) socket$inet(0x2, 0xa, 0x400) r7 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000280)=[{&(0x7f0000000040)="1400000016000b63d25a80648c2594f913", 0x11}], 0x1}, 0x0) sendmsg$NLBL_CIPSOV4_C_ADD(r7, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000540)={&(0x7f0000000040)=ANY=[], 0x34}, 0x1, 0x0, 0x0, 0x8814}, 0x0) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000600)={r6, 0x5, 0xb68, 0x4, &(0x7f0000000000)='%', 0x0, 0xd01, 0x80040000, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x48) socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$tipc2(&(0x7f0000000080), 0xffffffffffffffff) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff}) sendmmsg$unix(r8, &(0x7f0000002e40)=[{{0x0, 0x0, &(0x7f0000000340)=[{&(0x7f0000000200)="b2", 0x1}], 0x1, &(0x7f0000000540)=ANY=[@ANYBLOB="14"], 0x18, 0x4}}], 0x1, 0x4000000) 54.2361305s ago: executing program 1 (id=4807): r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$sock_bt_hci(r0, 0x400448ca, &(0x7f0000000000)='\x00\x00\x00\x00') r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r1, &(0x7f0000000040)={0x1f, 0xffff, 0x3}, 0x6) write(r1, &(0x7f0000000100)="05000000010001", 0x7) read(r1, &(0x7f0000000400)=""/128, 0x80) write(r1, &(0x7f0000000140)="0d000000010001", 0x7) write(r1, &(0x7f0000000280)='4\x00\x00\x00\a\x00\x00\x00\x00\x00\x00\x00\x00', 0xd) 53.35425349s ago: executing program 2 (id=4810): r0 = socket$inet_sctp(0x2, 0x1, 0x84) setsockopt$inet_sctp_SCTP_INITMSG(r0, 0x84, 0x2, &(0x7f0000000180)={0x7a2a, 0x9, 0x1}, 0x8) setsockopt$inet_sctp_SCTP_STREAM_SCHEDULER(r0, 0x84, 0x7b, &(0x7f0000000140)={0x0, 0x1}, 0x8) r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$WG_CMD_SET_DEVICE(0xffffffffffffffff, &(0x7f0000000540)={0x0, 0x0, &(0x7f0000000fc0)={&(0x7f0000000300)=ANY=[@ANYBLOB="78010000", @ANYRES16, @ANYBLOB="0100000000000000000001000000140002007767310000000000000000000000000024000300a0cb879a47f5bc644c0e693fa6d031c74a1553b6e901b9ff2f518c78042fb542080005000000000024010880f000008024000100975c9d81c983c8209ee781254b899f8ed925ae9f0923c23c62f53c57cdbf691ca400098028000080060001000a0000001c000200fe880000000000000000000000000001050003000300000028000080060001000a0000001400020000000000000000000000000000000001050003000000000028000080060001000a00000014000200fc0200000000000000000080"], 0x178}, 0x1, 0x0, 0x0, 0x4084}, 0x20000010) syz_genetlink_get_family_id$nl80211(&(0x7f0000000040), 0xffffffffffffffff) r2 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000100)={'wlan1\x00'}) sendmsg$NL80211_CMD_VENDOR(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={0x0, 0x30}}, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, 0x0) sendmsg$nl_route(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000080)=ANY=[@ANYBLOB="2c0000001c00357428bd7000fed3df2502000000", @ANYRES32, @ANYBLOB="1000a204080001000000000008000f0004"], 0x2c}, 0x1, 0x0, 0x0, 0x20040001}, 0x200080c0) sendmsg$inet_sctp(r0, &(0x7f0000000700)={&(0x7f0000000340)=@in={0x2, 0x4e21, @initdev={0xac, 0x1e, 0x1, 0x0}}, 0x10, &(0x7f00000006c0)=[{&(0x7f0000000640)="0c4a522d120d68306fc7e0f85f124d89a52a6a68d513ab1f0be2e6a230779569dcafbb154e94e72f47a2f08f31b0508665f7c8377d09adf4b06173d31011a9112f1b78bdc92e8cf952a4300ee3a3de6a526f7fc583c86b1aef3333", 0x5b}], 0x1, 0x0, 0x0, 0x2804c044}, 0x0) setsockopt$inet_sctp_SCTP_STREAM_SCHEDULER_VALUE(r0, 0x84, 0x7c, &(0x7f00000001c0)={0x0, 0x6, 0x9}, 0x8) setsockopt$inet_sctp_SCTP_STREAM_SCHEDULER_VALUE(r0, 0x84, 0x7c, &(0x7f0000000200)={0x0, 0x9, 0x9}, 0x8) shutdown(r0, 0x1) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000400)=@bpf_lsm={0x6, 0x3, &(0x7f0000000840)=ANY=[@ANYBLOB="1800000053d4000000000000000100049500000000000000e6ade9f07fb11fd2f74efa66a10cd17d0595555cb45b262582a31177db8a503f883c93b2319019b7d9f817a7632d482b49d73a21d28176a0ea9af07c200e890ba6653c322fb776271cf497311673dae29ae7ae7c2bdf24d59345cc3be779a8cbc8e278f28d9eabc9690f8282940b2583341c6b1c61db25fac93728bf745614dce918acd297e0394a3b53793b64850c16f9d43b68fb3e10fc0b165293a6273b0594ff2ab3671f1bffc16cceea8234b8d186d5f2ad6141d5704254d9dfb73770ced42db50b14ab"], &(0x7f0000000100)='GPL\x00', 0x8008, 0x0, 0x0, 0x40f00, 0x4, '\x00', 0x0, 0x1b, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x10, 0xb5}, 0x94) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)}, 0x4040) getsockopt$inet_sctp6_SCTP_GET_ASSOC_STATS(0xffffffffffffffff, 0x84, 0x70, &(0x7f0000000000)={0x0, @in={{0x2, 0x4e23, @loopback}}, [0x9c4, 0x6, 0x6, 0xffffffff, 0xa, 0x5, 0x9, 0x2, 0x6780000000000000, 0x4, 0x0, 0x80000001, 0x100000000, 0x2666, 0xfffffffffffffff2]}, &(0x7f0000000100)=0x100) setsockopt$inet_sctp_SCTP_STREAM_SCHEDULER_VALUE(r0, 0x84, 0x7c, &(0x7f0000000240)={r3, 0x1000, 0x5}, 0x8) r4 = bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="9feb01001800000000000000180000001800000004000000020000000100000c02000000000000000000000d0000000000005f"], 0x0, 0x34}, 0x20) r5 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r5, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000440)={&(0x7f0000000100)=ANY=[], 0x70}}, 0x0) r6 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000580)='blkio.bfq.empty_time\x00', 0x26e1, 0x0) close(0x3) r7 = socket$inet_tcp(0x2, 0x1, 0x6) setsockopt$inet_tcp_buf(r7, 0x6, 0x1f, &(0x7f0000000400)='espintcp', 0x8) sendmsg$NL80211_CMD_DEL_STATION(r6, &(0x7f0000000800)={0x0, 0x0, &(0x7f00000007c0)={0x0}, 0x1, 0x0, 0x0, 0x8d51d0cb139cbded}, 0x40010) r8 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x3, &(0x7f0000000100)=ANY=[@ANYBLOB="180000000100000000000000801800009500000000000000"], &(0x7f0000000000)='GPL\x00', 0xc, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, r4, 0x8, &(0x7f00000000c0)={0x0, 0x1}, 0x1}, 0x94) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000680)=@bpf_ext={0x1a, 0xb, &(0x7f00000004c0)=ANY=[@ANYBLOB="1800004f0c000000000000fcffefff18010000202075250000000000a6b96cbf280461b7e62020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b70300000500000085000000b90000009500000000000000"], &(0x7f0000000180)='syzkaller\x00', 0x7, 0x0, 0x0, 0x41000, 0x20, '\x00', 0x0, 0x18, r4, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x1, r8, 0x0, 0x0, 0x0, 0x10, 0x4aa}, 0x94) 52.286259175s ago: executing program 1 (id=4811): r0 = socket$inet6(0xa, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000040)={'sit0\x00', 0x0}) r2 = socket$inet6_icmp(0xa, 0x2, 0x3a) ioctl$sock_inet6_SIOCSIFDSTADDR(r2, 0x8918, &(0x7f0000000080)={@private1={0xfc, 0x1, '\x00', 0x1}, 0x52, r1}) r3 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r4 = socket(0x1f, 0x2, 0x0) bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f0000000740)=ANY=[@ANYBLOB="0300000004000000040000000a"], 0x48) r5 = socket$netlink(0x10, 0x3, 0x0) r6 = bpf$PROG_LOAD(0x5, &(0x7f0000000000)={0x1, 0x8, &(0x7f0000002fc0)=ANY=[@ANYBLOB="7a0af8ff75257078bfa100000000000007010000f8ffffffb702000005000000bf130000000000008500000006000000b700000000000000950000ff00000000b2595285faa6ead0169191d54f8196217fc560e2fc91f6da4dad4fdc2eb1b5986fc4a3f611a7c8edd3aa5d6ee7ab10b1a297cf52866651ddd73f30f2382f6cda4bfdd45be583823c0f09621f3c1c65ee19ee875daf45006a4c4ea5e15b2f9618d547244a22000000000000db453620ce72d75946c2b638d91dbef661962239c77edf2d34b12cd48a1b20fb7dd8432619f2c50d77bc0ea9b0af58e6fff4942eb613eff289026d5045ef76d7d864409eb2dc9518a09f4886afc26abba34635d0e8b598a51bc742135a6e1d33fe226c944bc76be40d435aa8b5208ff0df2db761014b1b999a12df6bee431a668135b8214afa5827b56a8074bf1e6cf5d84b35a3a3a4c66824fe12dbe20fcf50a194185b9e2d8b815fedb0d982936156be3cdda66fb977aef7c9cb92428ef25d9bf665bd60024c09e9eed544126fabe4cb8d826e1ec03cc492f5cad6227c94fea467aea7fa8b58abc37056433edf43fba5566a3e022034ac81fd48f9b7314ffa730017fbd37fdb23bc26992529402a520ef67e246415a6a8ca9d4aa797a95ca3314ded0d8a24abd57e042888a9141ab4e6c6b939aaefc248791464970c43120211b9bc82a85cd2fc18f535c7986c2d52ba62f74f00000000008000000000000000000000000040000000000000"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0xd}, 0x48) r7 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r7, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000023c0)=ANY=[@ANYBLOB="380000001000010125d57023fddbdf4aab3b62ff", @ANYRES32=0x0, @ANYBLOB="100804000100000008001b0000000000080029000000010008000d0080000000"], 0x38}, 0x1, 0x0, 0x0, 0x24040051}, 0x4000000) setsockopt$sock_attach_bpf(r5, 0x1, 0x32, &(0x7f0000002900)=r6, 0x4) bind$netlink(r5, &(0x7f00000000c0)={0x10, 0x0, 0x0, 0x2ffffffff}, 0xc) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r3, 0x8933, &(0x7f0000000280)={'batadv_slave_1\x00'}) socket$netlink(0x10, 0x3, 0x0) syz_genetlink_get_family_id$ethtool(&(0x7f0000000a80), r4) ioctl$sock_ipv6_tunnel_SIOCADDTUNNEL(0xffffffffffffffff, 0x89f1, 0x0) r8 = socket$nl_netfilter(0x10, 0x3, 0xc) ioctl$sock_SIOCGIFINDEX(r8, 0x8933, &(0x7f0000000380)={'veth0_vlan\x00', 0x0}) r10 = socket$nl_route(0x10, 0x3, 0x0) r11 = getpid() sendmsg$nl_route(r10, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000180)=ANY=[@ANYBLOB="300000001e00010026bd7000ffdbdf2507000000", @ANYRES32=0x0, @ANYBLOB="000000000a00020008001300", @ANYRES32=r11, @ANYBLOB="08000f00fbffffbfb053ac7a92ed8087898df5d589dfe846cc5dd182d4c4d6b464"], 0x30}, 0x1, 0x0, 0x0, 0x4048451}, 0x20000800) r12 = socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt$inet6_mreq(r12, 0x29, 0x1b, &(0x7f0000000040)={@private2, r9}, 0x14) socket$inet6(0xa, 0x80002, 0x0) r13 = socket$igmp(0x2, 0x3, 0x2) setsockopt$SO_BINDTODEVICE(r13, 0x1, 0x19, &(0x7f00000000c0)='veth1_to_team\x00', 0x10) setsockopt$inet_int(r13, 0x0, 0x5, &(0x7f0000000040)=0x3, 0x4) setsockopt$IP_VS_SO_SET_STARTDAEMON(r3, 0x0, 0x1a, &(0x7f0000000240)={0x1, 'veth0_to_team\x00'}, 0x18) syz_emit_ethernet(0x46, &(0x7f00000000c0)=ANY=[@ANYBLOB="0180c2000003aaaaaaaaaabb08004504003800000000fb019078ac1e0001ac1414aa03009078030100004500fffc00010000000100087f000001ac14090000007f0645aca055"], 0x0) 52.236749289s ago: executing program 4 (id=4812): r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000480)=@base={0xa, 0x4, 0x8, 0xd}, 0x50) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x11, 0xd, &(0x7f0000000280)=@framed={{0x18, 0x0, 0x0, 0x0, 0x2}, [@call={0x85, 0x0, 0x0, 0xf}, @ringbuf_output={{0x18, 0x1, 0x1, 0x0, r0}, {}, {}, {}, {}, {}, {0x7, 0x0, 0xb, 0x4, 0x0, 0x0, 0x2}, {0x85, 0x0, 0x0, 0x3}}]}, &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000500)={r1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000040)=ANY=[@ANYBLOB="28000000200081dc28bd700003000000020000000000000300000000000000000000000000000040"], 0x28}, 0x1, 0x0, 0x0, 0x81}, 0x40804) r3 = bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x3, 0xe, &(0x7f0000002240)=ANY=[@ANYBLOB="b702000000000000bfa300000000000007030000f0ffffff7a0af0ff0020000079a4f0ff00000000b706000000000081ad64020000000000450404000100ff0f1704000001130a00b7050000000000006a0af2fe0000000085000000a3000000b700000000000000950000000000000000e154cd8445974b26ffffffe4fbffffff55bb2007ee51050512b5b42128aa090a79507df79f298129daa7a6b2f91af50342115e17392ac627c87867c000006146001e04aeacea799a22a2fa798b5adc43eb27d53319d0ad229e5752548300000000dbc2777df150b7cdd77b85b941092314fd085f028f2ed1a4535550614e09d6378198a6097a670838337af2abd55a87ac0394b2f92ffab7d153d62058d0a413b2173619ccf55520f22c9ca8b6712f3024b7041b1df65b3e1b9bf115646d14ce53d13d0ccacda1ef0900094fa737c28b99938512c816fdcceaede3faedc51d29a47fc813a2ec00f4c7a53ac271d6d7f4ea6bf97f2f33e2ea2e534300bcb3fdc4b4861004eefbda7f54f82a804da4f86bb47a4a69bf9bc5fa96ee293fbd165a5a68488e40b030166565a097b1b44b451de736bb6d43db8db03d4b7745fef1d04ec633dee254a6d491b849a5a787e814c4fd21a18986252a70f8f92eb6f0e8c7db4bf23242a1f2c28159f09943b1b0452d1b72183aacf4a84f9130b775dd4e9e3070756f97ad91935a6ddfa8f90e79321a0574fb30ff0000001989328c8ddc20ea011bf5742e0e0d4334db8b20ce3f9f16cb7fc20fb4791ec85821d0c48fb657c29b309c73f0977e7cde65a82b94c461d7962b0d2277a84af326f37f3e2c25a61ec45c3af97a8f17da954aff3fc8c108755f75ca13fb7c8bbd8b6e7dac1aba4b20dc7de058a4dfa7e85a8bdf1d41a2d8bda74d66f47cc180f82c5f573c1f860d050d694cc7806d294d3665016a7b29da0fde4745db06753a7ac74a2d32f7528751313694bf5700b20ef0c248ddd3da32396a614cacad4aff2066bb5d40887c58559b7dcb98a6273b8c651e57f727041c62cea5b7bd24d9f679e4fbe948dfb4cc4a389469608241630459f0123fd39206000000000000eb55dad46de56ef907b059b90b8aa49afb9a79ae5498f6589880ed6eea7b9c670012be05e7de0940313c5870786554df26236ebced9390cb6941b83720eca291963eb2d537d8ee4de5c183c960119451c31539b22809e1d7f0cda06a9fa87d64cb89872a2cd8a104e16bb1a2bacf13464ca03aff14a9aa4bd9539f5096412b92012e095b84c20243ff98df3347f0e399d1b9f27e3c33269c0e153b28b2d4410572bc45b9d3fa02208d304d455c36300000000022320178b00cc6ed7966130b547dbf8b497af002000000cd1d0000002000000000000000000000000928ee53595a779d243a48cea769470424d28804c04b2c4324ab7f4a5c81921f0128dfd70b438af60b060000000000000056642b49b745f3bf2cf7908b6d7d748308eea09fc361b4735efbf3411718d6ee7aebed161980f2fde4f9ef679dbfae9fb4a79f8a836804ed3a1079b0282a12043408cd60b687dcff91af19010000000000000000456f7d2a42bd13da202274f20675eb781925441578e93046aaddea8ec4ca37f71c2710a7ea8ae0dc214e1cc275b26adfa892e6de92000000000000000000ddff004cff9ec780f535e62f4eeee50e5bafecea4d4134f9d006c8d6883eca5c9c58c9e9338c73de2f04f15d005387577f480000ea65559eb00e76e9d0ada201bcbb5c252b28a60ca770663da451790cc3600040543a34b195c6a8fc054282cd41b264906d5a9fad98c308e39bd5ffb6151d79c1cee1cd102e3c8e63e9fba05e3633be3f00000015762e5f5a3a0bc33fdbe28a5ffc83f2b485185cc92fe7f791e8f6429309d6adab4b7e508e4bf024ed8f8a005f2bbf96c89739f5cf1e750d50517a59a3ad09e8802e8f4f535447cc0fc9d5f99a73145dfcedad69da9cd4375c624600e78f4458542b14f29611f95d4a31838eeb20c20bb82aa31771cd379ec83554cea5e6539db7384e1f58d81f2f2653c4d9818708e27c89b552d7fcd116bce9c764c714c9402c21d181aac59efb28d4f91652f6750b6ec962802c0320f8059195729d60c534ee8e8ff0755b67fe4c25edb85bcff24c757aa8090000000000008c420eb4304f66e3a37aaf000000c42a570f0e9dd5fd545470f862f8c3c14fa9ecd1e877b0d8ca84c044859e85e6158f9184bc61a9a284db80e4636c25b96174327d82761c26e329555f9290af41000000000000007f5ab0d534b8d63e4ca3be71f2de1cdf519192c6b59a601fd419adc16e2055b85058f793484305d7a1759782e4c571ee855a47bc00edf5e9020c09ab004321610b857e8717764b633b21cb32f0e03280e09758bd445ab91d20baca005452b79d7b574a247f1d2fe45b3c4e93da3d51de647c10dd49944dc87c92332af0be61e58c79d497247d278888901d442ad7f8536607a644e9e3d769db497c3960dfde12182334caee994adc38a436367a54b9e182b78e9a0ceb9a2c4f63902c1ad1a7c5a08d0920a23c2a86abbdf357849a651733097f31019876026888c8ccb85c86b4f8ffffff7f000000002c331fca0e541b7ca211c28ed61c525708a13d115b43f8b1894c8fa8a14dc4810f61ae96c18cc7130000000000002100000000000000000001000027c9a46157a3609b6fd9843ee19ec647249a9375de5858818f3c4a4fa6ce46f4d42b07199de8b99231ace58c77819ee214e49666c464d35ca9b5143ed3b3dc8c17a23692759ccf5a205311b7ab22532697b861dfb54609fd88e6043bd52ae84c1bb0c8a6c769f952283a1f4e3842edb3d42c0e8ebc62887aa46e820a74f91381dcc198e353047db70686d147357024eb3cb94f1e89cb5ba0a56aa046b4dc521a3d9356b4b8b5917c4c860495b240e80063bde261fd00000000007271e28ef6806bc8e139c49b91c76bea3858f7f05b47d3e519f1634e8fbd8d31330d89069f9648a2ff93060ff073b3a113e47edf76f7d116d2b0976cf2ec447c030931651dd315003b7a6a5433a2bb560ae99e85b227eda2e63a1c31a2c2bd48a822cbe92b6524e0cd8020ecaa34e19e7141d5e221509342bfe7d294d1eb3de6a50ca0301f89c2ee627e949c68b3a4a426a996d503a26e9a714ee5f72d8805dd1bfbd081f6a5359dbdfbf31a562395020becaf3fd1f1289dfe14cb9194e26a44fac273461fc5c0e0a33db7f2d43ea8086cf059f40fa2640b6bfb74dd35f5a31059c01517cf4b6641fce9a24b96767b837ca037a1199735c375c705c798e0e208e4a5259d0bfa526b462af45a6eab34000000000000000000000000c4426344ec1a3366515dee221e747f55d7dd02534bc503b9b28277c253e410986bef2111a99cc448d652929f8a67a6a1d3f00dcad91aff428aade3f85714a1d3ef29acd4d49b62339c10c2ec0dac4b28288e78980c1184d8223edbc4bf9258b7374e79a1f8bf3fb73c8c6dbb7bbdfc399847a11921f97eba0ea14c4fed9a71eedb97c02461792e3a49dac16c60c3fcaab222025d78963c3ac899fa8b63f58a30212c9b2d7fe751e2046b78f86e22861b6504c667350244dd6d9189a8b9c45f8aaff9db694811ca86ed978f23eed7459c0382074170cf1e25b0e9ba3d1cc309353eea4cd8ab96bafda393276bdd8d32ead8db9e1b54d2d3d50e2815268fc1a6ec566981bc8ca2a4583f3d40e817433d0f4f25cfe6cc1897449ba5f26a9d66ac73e6f5c401376f23a314e0b9ff997d22f3e34b5524642c248aa813edaa626f0000000000000000000000000000000003ba5bac34b611569a451564d3a5400f9097ffe7a37e765bc652be71ee24250d6d9cf19878dd62c53062d6000c409de6a6135eae8a00000000008d797190a26c933f933aff5c521eeb7a84a62d148a846e74e76b515b6b8be29e8b69310fa130cf6d6b74f33205d3cc218ca554ed8085ae044f5bf2e89ad07963acbd4dd4dc5b4552591edde7a22ad06f7567e6fec2f65011b579bf609d61a3ff4d6f490824bb035995449fc34106ae6889f036d67b6aaee784f855ebc746ac871b5d2031ac0a252ac1f86e93e245f3793cea80b6de773899d49d11d3b1ed79163b111c976cf840a2ef6214a43338fba8c9edb6be26e68fcc5d47ed74a66ce8aba726ab955b9b32ab1890e84a5e2d7476252af25e5c95c5a8b2b1b5c8a2645b017d23c0f169d6ab529cc889bb07889d9e155114cf3e26a50c527ec6d4021cd2cacfea6d7e41e39e26b3967cad65c648b170f12ea9cc69dcee64be0c27b1f4f7f5ce3e62c35602c9d2921326891901661c85b9ee4a0a0b9636bef4c23788494f094abb91ed813b42828aa93105896e0aee851a8087e169a1d69e841257d9053d0cdc3a6ac4f12084cc6470abebe8b344b1f56690a2687b428686c854c21831da277e8b8a21b7b91a46d22ba083eca7b1f8268048cde7d6f237dca42035881b29ca9c8c2937971821b613894297ff6f7796053a4de1fd77e180cc22b205d43bb4a1b59962c1f605ea1b74587100e8d579f157cb45561c357f9976cec6a43388b3049a0d9c171ff6145266ba119d00000000001ef3794a930eb12f3a6215c510bf0bca70c127e9c70cc7bef921249a7f18a0034ce3264a9e96656b47233e2ed7c76520e649c3fd550bdafd77c5cd72b4446d3e157ddd97e7622a6891fb739acd3b2cdaf65ac78490f0641be6e8c6f55bf3d228786895ff5fd5970faacd8a5025aca0aa1931f477ba06aa60051298c8bf7f3b399194f98dc3f4e8513ad06da09dc393c1284515986b8c70ac69512f6c0c04f42edb3a097a11f2ab480e3e391abffae097752300576337c6dd24c4a98280684aa1fe8c7b43ee8bce05fe979b34da18cdb44dbb030b8009cd3b3b44fd8e7b534acd3f1839cb54817668ab446d3d47848429ea831a57f26c8b05dedddceb24483f8f998b05c3ddf85c3799c9000000000000000000000000001e57cf839eb3150d6a076fb7b86fae98dbb46014f483aecb4ec4f0877371bcae8912c78aff857c669760f0e55041563c5c3e8ee4a0eef885fd43fe34a1febc82370d1d07fdfe705ada4764320889000000000000000000000000000000a790af4fc17872b55b10db99e212d18193235659df45627da300959eafc8bfb44f70d250f8f2e86532700254c9a8b14999f59c8b9034c4bb2448eaeff5db21d4a7f3d974790d4c3cba7c402f50585b9289d86400679e5c2bcacb2841ca074d51fdb4a29e84d72b6c996cfbee06aa52cd632e82ba068e8e1572ef2eb414ba5fccfc3c03e64df6a9cc3936c604aa2c0e2ec7b777475023f29b146af003472ce146a5ff997ba53c51026c0096154f9280a34bbf21d66f57a250b5397766122fc86950ce5252e96868cd04df54764cf2082153d6cedd8aaf9700c734aa4a1cb33a2e0a13c5687be4de327511bff9816d13c3219dac1c1535f10243db6f96960ea6a621f5e1b7babbedf0a6bf0cf74123d2e78d01be2b048883a2459eec630fb0293d28d9799fd3a792caff693fd9f002f14c43fb5a1051cc686b7f114d7927eed559bdf2e8ddea3e61d5d942b63fe90230b2e1948fc563ef94d437281671d2fe5032d2a091fa842b0af2e116ba"], &(0x7f0000000b80)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sched_cls, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0xfffffedf, 0x10, &(0x7f0000000040)}, 0x48) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f00000002c0)={r3, 0x2f00020b, 0xe, 0x0, &(0x7f0000000200)="63eced8e46dc3f0adf33c9f7b986", 0x0, 0x7515, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) sendmsg$nl_route(r2, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000180)=@newlink={0x3c, 0x10, 0x439, 0xffffffff, 0x0, {0x0, 0x0, 0x0, 0x0, 0x9801, 0x1313}, [@IFLA_LINKINFO={0x1c, 0x12, 0x0, 0x1, @ipip={{0x9}, {0xc, 0x2, 0x0, 0x1, [@IFLA_IPTUN_REMOTE={0x8, 0x3, @initdev={0xac, 0x1e, 0x0, 0x0}}]}}}]}, 0x3c}, 0x1, 0x0, 0x0, 0x5}, 0x40008c0) 52.192538102s ago: executing program 0 (id=4813): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) r1 = socket(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000180)={'ip6tnl0\x00', 0x0}) r3 = socket(0x400000000010, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000100)={'bridge_slave_1\x00', 0x0}) sendmsg$nl_route_sched(r3, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000040)=@newqdisc={0x44, 0x24, 0x4ee4e6a52ff56541, 0x70bd2c, 0xfffffffd, {0x0, 0x0, 0x0, r4, {0x0, 0xffffffffffffffff}, {0xffff, 0xffff}, {0xfff3, 0xe}}, [@qdisc_kind_options=@q_hfsc={{0x9}, {0x14, 0x2, @TCA_HFSC_USC={0x10, 0x3, {0xffff, 0x3, 0x4}}}}]}, 0x44}}, 0x20000000) sendmsg$nl_route_sched(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000001300)=@newtfilter={0x38, 0x2c, 0xf3f, 0x70bd2c, 0x25dfdbfd, {0x0, 0x0, 0x0, r4, {0xb, 0x3}, {}, {0x7, 0x300}}, [@filter_kind_options=@f_fw={{0x7}, {0xc, 0x2, [@TCA_FW_CLASSID={0x8}]}}]}, 0x38}, 0x1, 0x0, 0x0, 0x20041090}, 0x0) sendmsg$nl_route_sched(r1, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=@newqdisc={0x148, 0x24, 0xf0b, 0x0, 0x25dfdbfe, {0x0, 0x0, 0x0, r2, {}, {0xffff, 0xffff}, {0x7, 0x5}}, [@qdisc_kind_options=@q_red={{0x8}, {0x11c, 0x2, [@TCA_RED_PARMS={0x14, 0x1, {0x6, 0x3, 0x1, 0x1f, 0x5, 0x3}}, @TCA_RED_STAB={0x104, 0x2, "5a34ac2f60dead43158c07f5c14d5c912fc826d5d5e7871f0b9e2fc0059bc09d425a10947824ca1e05eea192998b9f7c73fcad4304102f7c135209dff6909805890ae252cbcf7960c8d5044f9cd896ea3eb5d4db234861736a91f2a84d986bb3aac62fa2a6c359500be9839a357226daacf2d24030e027771f2e7e88bfae8406dff4bd6903403c2393638b1b09968dab9101000000000000002835be5f06b304782dedf5296357a94d64decff88db9aa1bdb01fe041a670c858964022df172191d23049c58b3f3a2630f05d5ef110f605b7c5e2a774ce92e52a320a65b481ff37b0b128074186a0df8210d271116dbeb3941bb4a76e200"}]}}]}, 0x148}, 0x1, 0x0, 0x0, 0x4044000}, 0x4000010) ioctl$SIOCPNGETOBJECT(r1, 0x89e0, &(0x7f0000003bc0)=0x5) sendmsg$IPCTNL_MSG_TIMEOUT_DEFAULT_SET(r0, &(0x7f0000003b80)={&(0x7f0000003a00)={0x10, 0x0, 0x0, 0x20}, 0xc, &(0x7f0000003b40)={&(0x7f0000003a40)={0xc8, 0x3, 0x8, 0x101, 0x0, 0x0, {0x0, 0x0, 0x8}, [@CTA_TIMEOUT_DATA={0x2c, 0x4, 0x0, 0x1, @icmp=[@CTA_TIMEOUT_ICMP_TIMEOUT={0x8, 0x1, 0x1, 0x0, 0x7b8}, @CTA_TIMEOUT_ICMP_TIMEOUT={0x8, 0x1, 0x1, 0x0, 0x3}, @CTA_TIMEOUT_ICMP_TIMEOUT={0x8, 0x1, 0x1, 0x0, 0xfffffffd}, @CTA_TIMEOUT_ICMP_TIMEOUT={0x8, 0x1, 0x1, 0x0, 0x5}, @CTA_TIMEOUT_ICMP_TIMEOUT={0x8, 0x1, 0x1, 0x0, 0x2000003e}]}, @CTA_TIMEOUT_DATA={0x4c, 0x4, 0x0, 0x1, @fccp=[@CTA_TIMEOUT_DCCP_OPEN={0x8, 0x4, 0x1, 0x0, 0x9}, @CTA_TIMEOUT_DCCP_CLOSING={0x8, 0x6, 0x1, 0x0, 0xffffffff}, @CTA_TIMEOUT_DCCP_CLOSING={0x8}, @CTA_TIMEOUT_DCCP_OPEN={0x8, 0x4, 0x1, 0x0, 0x9}, @CTA_TIMEOUT_DCCP_REQUEST={0x8, 0x1, 0x1, 0x0, 0x4}, @CTA_TIMEOUT_DCCP_OPEN={0x8, 0x4, 0x1, 0x0, 0x6}, @CTA_TIMEOUT_DCCP_CLOSEREQ={0x8, 0x5, 0x1, 0x0, 0x7}, @CTA_TIMEOUT_DCCP_REQUEST={0x8, 0x1, 0x1, 0x0, 0x5}, @CTA_TIMEOUT_DCCP_RESPOND={0x8, 0x2, 0x1, 0x0, 0x5}]}, @CTA_TIMEOUT_NAME={0x9, 0x1, 'syz0\x00'}, @CTA_TIMEOUT_DATA={0x24, 0x4, 0x0, 0x1, @fccp=[@CTA_TIMEOUT_DCCP_REQUEST={0x8, 0x1, 0x1, 0x0, 0x81}, @CTA_TIMEOUT_DCCP_CLOSING={0x8, 0x6, 0x1, 0x0, 0x9}, @CTA_TIMEOUT_DCCP_PARTOPEN={0x8, 0x3, 0x1, 0x0, 0x80002}, @CTA_TIMEOUT_DCCP_TIMEWAIT={0x8, 0x7, 0x1, 0x0, 0x4}]}, @CTA_TIMEOUT_NAME={0x9, 0x1, 'syz0\x00'}]}, 0xc8}, 0x1, 0x0, 0x0, 0x80}, 0x0) ioctl$BTRFS_IOC_SPACE_INFO(r0, 0xc0109414, &(0x7f0000000040)={0x265, 0x3, ['\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00']}) sendmsg(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)}, 0x4080) 52.173265054s ago: executing program 2 (id=4814): r0 = socket(0x200000000000011, 0x2, 0xd) bpf$PROG_LOAD(0x5, 0x0, 0x0) bind$packet(r0, &(0x7f0000000080)={0x11, 0x800, 0x0, 0x1, 0x0, 0x6, @multicast}, 0x14) setsockopt$packet_fanout(r0, 0x107, 0x12, &(0x7f0000000140)={0x0, 0x8000}, 0x4) syz_emit_ethernet(0x32, &(0x7f0000000040)=ANY=[@ANYBLOB="e90c610fac6f39d87f000002"], 0x0) syz_emit_ethernet(0x86, &(0x7f0000000380)={@link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0xe}, @multicast, @void, {@ipv4={0x800, @udp={{0x5, 0x4, 0x0, 0x0, 0x24, 0x0, 0x2, 0x0, 0x11, 0x0, @empty, @empty}, {0x0, 0xfffc, 0x64, 0x0, @wg=@response={0x2, 0x0, 0x2, "e5410e86db87a41f716be8e1fa0fe2fb143899778cc5c15c1337404bb397c0fc", "0c17d7b032591c2a7eb609eb8d2d9d15", {"28cbbe8b3bc8849d1e6124e7e5913283", "0080200000002000d300000000000400"}}}}}}}, 0x0) 51.663248974s ago: executing program 2 (id=4815): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$batadv(&(0x7f0000000400), 0xffffffffffffffff) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r0, 0x8933, &(0x7f0000000440)={'batadv0\x00', 0x0}) sendmsg$BATADV_CMD_SET_MESH(r0, &(0x7f0000000540)={0x0, 0x0, &(0x7f0000000500)={&(0x7f0000000040)={0x24, r1, 0x1, 0x70bd28, 0x4000001, {}, [@BATADV_ATTR_MESH_IFINDEX={0x8, 0x3, r2}, @BATADV_ATTR_DISTRIBUTED_ARP_TABLE_ENABLED={0x5, 0x2f, 0x1}]}, 0x24}}, 0x0) r3 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000700)={'wlan0\x00', 0x0}) r5 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r5, &(0x7f0000000800)={0x0, 0x0, &(0x7f0000000840)={&(0x7f0000000880)=@setlink={0x28, 0x13, 0x1, 0x0, 0x0, {0x0, 0x0, 0x0, r4}, [@IFLA_MASTER={0x8, 0xa, r2}]}, 0x28}}, 0x0) sendmsg$nl_route(r5, &(0x7f0000000a00)={0x0, 0x0, &(0x7f0000000a40)={&(0x7f0000000a80)=@setlink={0x20, 0x13, 0x1, 0x0, 0x0, {0x0, 0x0, 0x0, r2, 0x1, 0x1}}, 0x20}}, 0x0) r6 = socket$packet(0x11, 0x3, 0x300) bind$packet(r6, &(0x7f0000000b00)={0x11, 0x300, r2, 0x1, 0x0, 0x6, @broadcast}, 0x14) write(r6, &(0x7f0000000c00)="ffffffffffff52540012345608060001080006040001525400123456ac141414000000000000ac141420", 0x2a) write(r6, &(0x7f0000000c40)="ffffffffffff52540012345608060001080006040001525400123456c0a80101000000000000c0a80102", 0x2a) write(r6, &(0x7f0000000c80)="ffffffffffff525400123456080045000020000040004011b98fac141414ffffffff12341234000c000061626364", 0x32) r7 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$sock_int(r7, 0x1, 0x6, &(0x7f0000000d00)=0x1, 0x4) nanosleep(&(0x7f0000000e20)={0x1}, 0x0) 49.733531892s ago: executing program 3 (id=4817): bpf$PROG_LOAD(0x5, &(0x7f0000000640)={0x11, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018010000", @ANYRES32, @ANYBLOB="0000000000000000b70800000000396f7b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000002400000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x40, '\x00', 0x0, @fallback=0x2, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$PROG_LOAD(0x5, &(0x7f0000001a00)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="18090000000000000000000000000000850000006d0000001801000020696c25"], 0x0, 0x0, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r0 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x1f, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x1a, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$PROG_BIND_MAP(0xa, &(0x7f00000004c0)={r0}, 0xc) 49.595030947s ago: executing program 3 (id=4818): r0 = socket$inet_sctp(0x2, 0x1, 0x84) setsockopt$inet_sctp_SCTP_INITMSG(r0, 0x84, 0x2, &(0x7f0000000180)={0x7a2a, 0x9, 0x1}, 0x8) setsockopt$inet_sctp_SCTP_STREAM_SCHEDULER(r0, 0x84, 0x7b, &(0x7f0000000140)={0x0, 0x1}, 0x8) r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$WG_CMD_SET_DEVICE(0xffffffffffffffff, &(0x7f0000000540)={0x0, 0x0, &(0x7f0000000fc0)={&(0x7f0000000300)=ANY=[@ANYBLOB="78010000", @ANYRES16, @ANYBLOB="0100000000000000000001000000140002007767310000000000000000000000000024000300a0cb879a47f5bc644c0e693fa6d031c74a1553b6e901b9ff2f518c78042fb542080005000000000024010880f000008024000100975c9d81c983c8209ee781254b899f8ed925ae9f0923c23c62f53c57cdbf691ca400098028000080060001000a0000001c000200fe880000000000000000000000000001050003000300000028000080060001000a0000001400020000000000000000000000000000000001050003000000000028000080060001000a00000014000200fc0200000000000000000080"], 0x178}, 0x1, 0x0, 0x0, 0x4084}, 0x20000010) syz_genetlink_get_family_id$nl80211(&(0x7f0000000040), 0xffffffffffffffff) r2 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000100)={'wlan1\x00'}) sendmsg$NL80211_CMD_VENDOR(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={0x0, 0x30}}, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, 0x0) sendmsg$nl_route(r1, 0x0, 0x200080c0) sendmsg$inet_sctp(r0, &(0x7f0000000700)={&(0x7f0000000340)=@in={0x2, 0x4e21, @initdev={0xac, 0x1e, 0x1, 0x0}}, 0x10, &(0x7f00000006c0)=[{&(0x7f0000000640)="0c4a522d120d68306fc7e0f85f124d89a52a6a68d513ab1f0be2e6a230779569dcafbb154e94e72f47a2f08f31b0508665f7c8377d09adf4b06173d31011a9112f1b78bdc92e8cf952a4300ee3a3de6a526f7fc583c86b1aef3333", 0x5b}], 0x1, 0x0, 0x0, 0x2804c044}, 0x0) setsockopt$inet_sctp_SCTP_STREAM_SCHEDULER_VALUE(r0, 0x84, 0x7c, &(0x7f00000001c0)={0x0, 0x6, 0x9}, 0x8) setsockopt$inet_sctp_SCTP_STREAM_SCHEDULER_VALUE(r0, 0x84, 0x7c, &(0x7f0000000200)={0x0, 0x9, 0x9}, 0x8) shutdown(r0, 0x1) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000400)=@bpf_lsm={0x6, 0x3, &(0x7f0000000840)=ANY=[@ANYBLOB="1800000053d4000000000000000100049500000000000000e6ade9f07fb11fd2f74efa66a10cd17d0595555cb45b262582a31177db8a503f883c93b2319019b7d9f817a7632d482b49d73a21d28176a0ea9af07c200e890ba6653c322fb776271cf497311673dae29ae7ae7c2bdf24d59345cc3be779a8cbc8e278f28d9eabc9690f8282940b2583341c6b1c61db25fac93728bf745614dce918acd297e0394a3b53793b64850c16f9d43b68fb3e10fc0b165293a6273b0594ff2ab3671f1bffc16cceea8234b8d186d5f2ad6141d5704254d9dfb73770ced42db50b14ab"], &(0x7f0000000100)='GPL\x00', 0x8008, 0x0, 0x0, 0x40f00, 0x4, '\x00', 0x0, 0x1b, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x10, 0xb5}, 0x94) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)}, 0x4040) getsockopt$inet_sctp6_SCTP_GET_ASSOC_STATS(0xffffffffffffffff, 0x84, 0x70, &(0x7f0000000000)={0x0, @in={{0x2, 0x4e23, @loopback}}, [0x9c4, 0x6, 0x6, 0xffffffff, 0xa, 0x5, 0x9, 0x2, 0x6780000000000000, 0x4, 0x0, 0x80000001, 0x100000000, 0x2666, 0xfffffffffffffff2]}, &(0x7f0000000100)=0x100) setsockopt$inet_sctp_SCTP_STREAM_SCHEDULER_VALUE(r0, 0x84, 0x7c, &(0x7f0000000240)={r3, 0x1000, 0x5}, 0x8) r4 = bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="9feb01001800000000000000180000001800000004000000020000000100000c02000000000000000000000d0000000000005f"], 0x0, 0x34}, 0x20) r5 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r5, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000440)={&(0x7f0000000100)=ANY=[], 0x70}}, 0x0) r6 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000580)='blkio.bfq.empty_time\x00', 0x26e1, 0x0) close(0x3) r7 = socket$inet_tcp(0x2, 0x1, 0x6) setsockopt$inet_tcp_buf(r7, 0x6, 0x1f, &(0x7f0000000400)='espintcp', 0x8) sendmsg$NL80211_CMD_DEL_STATION(r6, &(0x7f0000000800)={0x0, 0x0, &(0x7f00000007c0)={0x0}, 0x1, 0x0, 0x0, 0x8d51d0cb139cbded}, 0x40010) r8 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x3, &(0x7f0000000100)=ANY=[@ANYBLOB="180000000100000000000000801800009500000000000000"], &(0x7f0000000000)='GPL\x00', 0xc, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, r4, 0x8, &(0x7f00000000c0)={0x0, 0x1}, 0x1}, 0x94) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000680)=@bpf_ext={0x1a, 0xb, &(0x7f00000004c0)=ANY=[@ANYBLOB="1800004f0c000000000000fcffefff18010000202075250000000000a6b96cbf280461b7e62020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b70300000500000085000000b90000009500000000000000"], &(0x7f0000000180)='syzkaller\x00', 0x7, 0x0, 0x0, 0x41000, 0x20, '\x00', 0x0, 0x18, r4, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x1, r8, 0x0, 0x0, 0x0, 0x10, 0x4aa}, 0x94) 49.363133955s ago: executing program 3 (id=4819): r0 = socket$nl_generic(0x10, 0x3, 0x10) socket$igmp(0x2, 0x3, 0x2) socket$netlink(0x10, 0x3, 0x0) socket(0x10, 0x3, 0x0) socket$inet(0x2, 0x2, 0x1) socket$nl_route(0x10, 0x3, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) bpf$PROG_LOAD(0x5, &(0x7f0000000740)={0xc, 0x8, &(0x7f0000000d80)=ANY=[@ANYBLOB="1800000000000000000000000000000018020000", @ANYRES32, @ANYBLOB="0000000000000000b703000000000000850000000d000000b70000000000000095"], &(0x7f00000000c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x16, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x94) socket(0x400000000010, 0x3, 0x0) r1 = socket$inet6(0xa, 0x3, 0x5) sendmmsg(r1, &(0x7f0000001500)=[{{&(0x7f0000000180)=@l2tp6={0xa, 0x500, 0x80000, @remote, 0x0, 0x3}, 0x80, 0x0}, 0x5b4}, {{&(0x7f0000000040)=@l2tp6={0xa, 0x0, 0x7080000, @loopback, 0xa, 0x1}, 0x80, 0x0, 0x0, &(0x7f0000001580)=ANY=[@ANYBLOB="120000000000000029000000", @ANYRES64=r1], 0x108}}], 0x2, 0xc040) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000000)={'wlan1\x00', 0x0}) r3 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000040)={'tunl0\x00', 0x0}) sendmsg$nl_route_sched(r3, &(0x7f0000001200)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000380)=@newqdisc={0x58, 0x24, 0x4ee4e6a52ff56541, 0x2000, 0x0, {0x0, 0x0, 0x0, r4, {0x0, 0xffff}, {0xffff, 0xffff}, {0x10}}, [@qdisc_kind_options=@q_pie={{0x8}, {0x4}}, @TCA_STAB={0x28, 0x8, 0x0, 0x1, [{{0x1c, 0x1, {0x0, 0x0, 0x0, 0x0, 0x2, 0x1, 0xb, 0x1}}, {0x6, 0x2, [0x4780]}}]}]}, 0x58}}, 0x4000010) r5 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000100), 0xffffffffffffffff) sendmsg$NL80211_CMD_FRAME(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000280)={0x40, r5, 0x1, 0x70bd29, 0x0, {{0x2}, {@val={0x8, 0x3, r2}, @val={0xc, 0x99, {0x41, 0x5f}}}}, [@chandef_params=[@NL80211_ATTR_WIPHY_FREQ={0x8, 0x26, @random=0x16fd}, @NL80211_ATTR_CENTER_FREQ2={0x8, 0xa1, 0x9}], @chandef_params=[@NL80211_ATTR_WIPHY_CHANNEL_TYPE={0x8, 0x27, 0x1}]]}, 0x40}}, 0x0) ioctl$BTRFS_IOC_GET_FEATURES(r0, 0x80189439, &(0x7f0000000080)) r6 = socket$igmp6(0xa, 0x3, 0x2) setsockopt$IP6T_SO_SET_REPLACE(r6, 0x29, 0x40, &(0x7f0000000980)=@raw={'raw\x00', 0x8, 0x3, 0x530, 0x1d8, 0xffffffff, 0xffffffff, 0x1d8, 0xffffffff, 0x460, 0xffffffff, 0xffffffff, 0x460, 0xffffffff, 0x3, 0x0, {[{{@ipv6={@private0, @mcast2, [], [], 'veth0_macvtap\x00', 'bridge0\x00'}, 0x0, 0x1b0, 0x1d8, 0x0, {}, [@common=@unspec=@helper={{0x48}, {0x0, 'amanda\x00'}}, @common=@unspec=@conntrack2={{0xc0}, {{@ipv6=@private1, [0xff000000, 0xffffffff, 0xff, 0xffffffff], @ipv6=@private1={0xfc, 0x1, '\x00', 0x1}, [0xffffff00, 0xff, 0xffffffff, 0xffffffff], @ipv6=@empty, [0xff000000, 0xff, 0xff, 0xff], @ipv6=@local, [0xffffffff, 0xff000000, 0xff000000, 0xffffff00], 0x80, 0x54, 0x3b, 0x4e20, 0x4e23, 0x4e21, 0x4e23, 0x446, 0x39a}, 0x100, 0x20}}]}, @common=@unspec=@NFQUEUE0={0x28}}, {{@ipv6={@remote, @ipv4={'\x00', '\xff\xff', @dev}, [], [], 'erspan0\x00', 'gre0\x00', {0xff}, {}, 0x0, 0x0, 0x0, 0x4b}, 0x0, 0x258, 0x288, 0x0, {}, [@common=@inet=@hashlimit1={{0x58}, {'pim6reg\x00', {0x0, 0x0, 0x5, 0x0, 0x0, 0x7, 0x3ff}}}, @common=@inet=@hashlimit3={{0x158}, {'vcan0\x00', {0x3, 0x0, 0x41, 0xfffffffe, 0xe, 0x1000, 0x6, 0x3}}}]}, @common=@unspec=@CONNMARK={0x30}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28, '\x00', 0x7}}}}, 0x590) syz_emit_ethernet(0x4a, &(0x7f0000000000)={@local, @remote, @void, {@ipv6={0x86dd, @tcp={0x0, 0x6, '\x00', 0x14, 0x6, 0x40, @remote, @local, {[], {{0x4e22, 0x4e22, 0x0, 0x0, 0x0, 0x0, 0x5, 0x38, 0x1000}}}}}}}, 0x0) 46.697068991s ago: executing program 0 (id=4820): bpf$BPF_BTF_LOAD(0x12, 0x0, 0xffffffffffffff23) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r1, &(0x7f00000008c0)={0x0, 0x0, &(0x7f0000000900)={&(0x7f0000000140)=@newqdisc={0x44, 0x24, 0x4ee4e6a52ff56541, 0x70bd26, 0xffffffff, {0x0, 0x0, 0x0, r2, {0x0, 0xfff1}, {0xffff, 0xffff}, {0xe}}, [@qdisc_kind_options=@q_hfsc={{0x9}, {0x14, 0x2, @TCA_HFSC_FSC={0x10, 0x2, {0x5, 0x7, 0xb3}}}}]}, 0x44}, 0x1, 0x0, 0x0, 0x4008004}, 0x0) r3 = socket(0x400000000010, 0x3, 0x0) r4 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000640)=@newtfilter={0x34, 0x2c, 0xd3f, 0x30bd2d, 0x25dfdbfb, {0x0, 0x0, 0x0, r5, {0xb, 0xfff3}, {}, {0x8, 0xc}}, [@filter_kind_options=@f_basic={{0xa}, {0x4}}]}, 0x34}, 0x1, 0x0, 0x0, 0x10}, 0x8800) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r7, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r6, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000000300)=@newqdisc={0x58, 0x28, 0x4ee4e6a52ff56541, 0x4001, 0xffffbddc, {0x0, 0x0, 0x0, r8, {0xfff3}, {}, {0x6, 0x1}}, [@qdisc_kind_options=@q_sfb={{0x8}, {0x2c, 0x2, @TCA_SFB_PARMS={0x28, 0x1, {0x7fffffff, 0xe, 0x7, 0x7, 0x9, 0x40, 0xffffffff, 0x2}}}}]}, 0x58}, 0x1, 0x0, 0x0, 0x4040098}, 0x4000) 46.339242578s ago: executing program 2 (id=4821): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x82c03, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000380)={'syzkaller0\x00', 0x0}) sendmsg$nl_route(r1, &(0x7f0000001500)={0x0, 0x0, &(0x7f00000000b0)={&(0x7f0000000500)=@setlink={0x20, 0x13, 0x1, 0x0, 0x0, {0x0, 0x0, 0x0, r2, 0x41, 0x1}}, 0x20}}, 0x0) r3 = socket$packet(0x11, 0x3, 0x300) bind$packet(r3, &(0x7f0000000700)={0x11, 0x300, r2}, 0x14) setsockopt$sock_int(r3, 0x1, 0xc, &(0x7f00000005c0)=0x10001, 0x4) write(r3, &(0x7f0000000600)='\x00'/1000, 0x3e8) 46.337987337s ago: executing program 4 (id=4822): bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000140)={0x6, 0x3, &(0x7f0000000680)=ANY=[@ANYBLOB="1800000002000000000000000000000095"], 0x0}, 0x90) r0 = bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000480)={0x6, 0x3, &(0x7f0000000680)=ANY=[], &(0x7f00000002c0)='syzkaller\x00'}, 0x90) write$cgroup_subtree(0xffffffffffffffff, &(0x7f0000000000)=ANY=[@ANYBLOB="9fedcb7968ddc36c8f263408008daa"], 0xfdef) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000600)={r0, 0x5, 0xb68, 0x0, &(0x7f0000000000)='%', 0x0, 0xd01, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x3000000}, 0x48) 46.300308632s ago: executing program 1 (id=4823): r0 = socket$inet_udp(0x2, 0x2, 0x0) getsockopt$inet_buf(r0, 0x0, 0x30, &(0x7f0000000340)=""/225, &(0x7f0000000180)=0xe1) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000900), 0xffffffffffffffff) r3 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r3, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000140)=ANY=[@ANYBLOB="200000006d0001002bbdf3e2938fb17b207c000091"], 0x20}, 0x1, 0xba01, 0x0, 0x20008802}, 0x20008004) r4 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r4, 0x8933, &(0x7f0000000400)={'wlan1\x00', 0x0}) r6 = syz_genetlink_get_family_id$nl80211(&(0x7f00000001c0), 0xffffffffffffffff) sendmsg$NL80211_CMD_CONTROL_PORT_FRAME(r4, &(0x7f0000003700)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000340)={0x4c, r6, 0x1, 0x0, 0x0, {{}, {@val={0x8, 0x3, r5}, @void}}, [@NL80211_ATTR_MAC={0xa}, @NL80211_ATTR_CONTROL_PORT_ETHERTYPE={0x6, 0x66, 0x88c7}, @NL80211_ATTR_FRAME={0x1c, 0x33, @data_frame={@msdu=@type10={{}, {}, @from_mac=@broadcast, @device_b}}}]}, 0x4c}}, 0x800) sendmsg$NL80211_CMD_GET_SCAN(r1, &(0x7f00000009c0)={&(0x7f00000008c0)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f0000000980)={&(0x7f0000000940)={0x28, r2, 0x20, 0x70bd27, 0x25dfdbfe, {{}, {@val={0x8, 0x3, r5}, @val={0xc, 0x99, {0xffffffff, 0x76}}}}, [""]}, 0x28}, 0x1, 0x0, 0x0, 0x840}, 0x0) r7 = bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000e40)={&(0x7f0000000c80)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0x9c, 0x9c, 0x4, [@array={0x0, 0x0, 0x0, 0x3, 0x0, {0x3, 0x5, 0x9}}, @array={0x0, 0x0, 0x0, 0x3, 0x0, {0x1, 0x1, 0x8}}, @union={0x8, 0x1, 0x0, 0x5, 0x1, 0x7fff, [{0xe, 0x3, 0x4}]}, @typedef={0x7, 0x0, 0x0, 0x8, 0x4}, @type_tag={0xa, 0x0, 0x0, 0x12, 0x2}, @enum={0x1, 0x6, 0x0, 0x6, 0x4, [{0x6, 0x200}, {0xd, 0x18}, {0x10}, {0xf, 0x1}, {0xc, 0x10}, {0x4, 0x399}]}]}, {0x0, [0x30, 0x30]}}, &(0x7f0000000d40)=""/216, 0xb8, 0xd8, 0x0, 0x1, 0x10000}, 0x28) getsockopt$PNPIPE_IFINDEX(0xffffffffffffffff, 0x113, 0x2, &(0x7f0000000b00)=0x0, &(0x7f0000000b40)=0x4) bpf$MAP_CREATE(0x0, &(0x7f0000000f00)=@bloom_filter={0x1e, 0x381, 0xe6e, 0x6, 0x42048, 0xffffffffffffffff, 0x1, '\x00', r8, r7, 0x4, 0x3, 0x0, 0xe}, 0x50) sendmsg$IPSET_CMD_CREATE(0xffffffffffffffff, &(0x7f0000000100)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f00000000c0)={&(0x7f0000000040)=ANY=[@ANYBLOB="58000000020605000000000000000000010000070d000300686173683a6d616300000000050005006e000000050001000700000005000100070700000012000300686173683a6e65742c85a9b0c295706f7274000000"], 0x58}, 0x1, 0x0, 0x0, 0x84}, 0x811) bpf$BPF_GET_BTF_INFO(0xf, &(0x7f0000000480)={0xffffffffffffffff, 0x20, &(0x7f0000000440)={&(0x7f0000000380)=""/77, 0x4d, 0x0, &(0x7f0000000400)=""/12, 0xc}}, 0x10) r10 = accept4(0xffffffffffffffff, &(0x7f0000000140)=@nl=@unspec, &(0x7f00000001c0)=0x80, 0x0) r11 = accept4$inet6(r10, &(0x7f00000007c0)={0xa, 0x0, 0x0, @mcast1}, &(0x7f0000000800)=0x1c, 0x80800) getsockopt$IP6T_SO_GET_ENTRIES(r11, 0x29, 0x41, &(0x7f0000000840)={'filter\x00', 0xc, "1b7509cb4ca66f3e2d077181"}, &(0x7f0000000880)=0x30) sendmsg$AUDIT_USER(r10, &(0x7f0000000780)={&(0x7f0000000580)={0x10, 0x0, 0x0, 0x8000}, 0xc, &(0x7f0000000740)={&(0x7f0000000c00)=ANY=[@ANYBLOB="2c000000ed03200029bd7000fddbdf25007d490694cddd4613748f192514e93ae5d229a99e5d79cc1272b6000000"], 0x2c}, 0x1, 0x0, 0x0, 0x840}, 0x4000800) bpf$TOKEN_CREATE(0x24, &(0x7f0000000240), 0x8) r12 = bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=@base={0x1b, 0x0, 0x0, 0x8000}, 0x48) r13 = bpf$MAP_CREATE(0x0, &(0x7f0000000040)=@base={0xe, 0x4, 0x4, 0x2, 0x0, 0x1, 0xfffffffc}, 0x50) r14 = bpf$PROG_LOAD(0x5, &(0x7f0000000500)={0x6, 0x10, &(0x7f0000000200)=@framed={{0x18, 0x0, 0x0, 0x0, 0x100}, [@ringbuf_query={{0x18, 0x1, 0x1, 0x0, r12}}, @ringbuf_output={{0x18, 0x1, 0x1, 0x0, r13}, {}, {}, {0x4}, {0x6, 0x0, 0xa}, {}, {}, {0x85, 0x0, 0x0, 0x33}}]}, &(0x7f0000000180)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback=0x38, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) sendmsg$NL80211_CMD_START_P2P_DEVICE(r10, &(0x7f0000000ac0)={&(0x7f0000000a00)={0x10, 0x0, 0x0, 0x10}, 0xc, &(0x7f0000000a80)={&(0x7f0000000a40)={0x20, r2, 0x100, 0x70bd29, 0x25dfdbfc, {{}, {@void, @val={0xc, 0x99, {0x4, 0x6}}}}, [""]}, 0x20}, 0x1, 0x0, 0x0, 0x801}, 0x4000) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000b80)={r14, 0x2000012, 0xe, 0x0, &(0x7f0000000c40)="63eced8e46dc3f2ddf33c9e9b986", 0x0, 0xfffffffe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0xb}, 0x50) r15 = bpf$MAP_CREATE(0x0, &(0x7f00000006c0)=ANY=[@ANYBLOB="1b00000000000000000000000080"], 0x48) r16 = bpf$PROG_LOAD(0x5, &(0x7f0000000440)={0x6, 0x1c, &(0x7f00000005c0)=ANY=[@ANYBLOB="1800000000000000000000000000000218110000", @ANYRES32=r15, @ANYBLOB="0000000000000000b702000014000000b7030000000000008500000083000000bf090000000000005509010000000000950000000000000018110000", @ANYRES32=r15, @ANYBLOB="0000000000000000b7080000050000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000001001000850000008200000018110000", @ANYRES32=r15, @ANYBLOB="0000000000000000b7020000000000008500000017000000bf91000000000000b7020000020000008500000085000000b70000000000000095"], &(0x7f0000000080)='GPL\x00', 0x0, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, @fallback=0x22, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000240)={r16, 0xfca804a0, 0x10, 0x38, &(0x7f00000002c0)="b800000500000000", &(0x7f0000000300)=""/8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x4c) bpf$PROG_LOAD(0x5, &(0x7f0000000f80)={0x1c, 0x3, &(0x7f0000000e80)=@framed={{0x18, 0x0, 0x0, 0x0, 0x40000}}, &(0x7f0000000700)='syzkaller\x00', 0x1, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x34, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, r9, r16, 0x0, 0x0, 0x0, 0x0}, 0x94) 46.275422711s ago: executing program 3 (id=4824): r0 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$tipc(&(0x7f0000000040), 0xffffffffffffffff) (async) r1 = syz_genetlink_get_family_id$tipc(&(0x7f0000000040), 0xffffffffffffffff) syz_genetlink_get_family_id$mptcp(&(0x7f0000000180), r0) sendmsg$TIPC_CMD_SHOW_LINK_STATS(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000080)=ANY=[@ANYBLOB='(\x00\x00\x00', @ANYRES16=r1, @ANYBLOB="0180000000000000000001000000000000000b00000000030014"], 0x28}}, 0x40000) (async) sendmsg$TIPC_CMD_SHOW_LINK_STATS(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000080)=ANY=[@ANYBLOB='(\x00\x00\x00', @ANYRES16=r1, @ANYBLOB="0180000000000000000001000000000000000b00000000030014"], 0x28}}, 0x40000) r3 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000340)=ANY=[@ANYBLOB="02000000040000000800000001"], 0x48) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000000c0)={0x1, 0x10, &(0x7f0000000000)=ANY=[@ANYBLOB="18000000000000000000000001000000b7080000000000007b8af8ff00000000b508000000000000638af0ff00000000bfa100000000000007010000f8ffffffbfa400000000000007040000f0ffffffb70200000800000018240000", @ANYRES32=r3, @ANYRES64=r2], &(0x7f0000000080)='GPL\x00', 0x4a5, 0x0, 0x0, 0x0, 0x11}, 0x94) 45.833607745s ago: executing program 0 (id=4825): r0 = socket(0x200000000000011, 0x2, 0xd) bpf$PROG_LOAD(0x5, 0x0, 0x0) bind$packet(r0, &(0x7f0000000080)={0x11, 0x800, 0x0, 0x1, 0x0, 0x6, @multicast}, 0x14) setsockopt$packet_fanout(r0, 0x107, 0x12, &(0x7f0000000140)={0x0, 0x8000}, 0x4) syz_emit_ethernet(0x32, &(0x7f0000000040)=ANY=[@ANYBLOB="e90c610fac6f39d87f000002"], 0x0) syz_emit_ethernet(0x86, &(0x7f0000000380)={@link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0xe}, @multicast, @void, {@ipv4={0x800, @udp={{0x5, 0x4, 0x0, 0x0, 0x24, 0x0, 0x2, 0x0, 0x11, 0x0, @empty, @empty}, {0x0, 0xfffc, 0x64, 0x0, @wg=@response={0x2, 0x0, 0x2, "e5410e86db87a41f716be8e1fa0fe2fb143899778cc5c15c1337404bb397c0fc", "0c17d7b032591c2a7eb609eb8d2d9d15", {"28cbbe8b3bc8849d1e6124e7e5913283", "0080200000002000d300000000000400"}}}}}}}, 0x0) 45.775886242s ago: executing program 3 (id=4826): r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000300)=@base={0x9, 0x4, 0x8, 0x100, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0}, 0x50) bpf$PROG_LOAD(0x5, &(0x7f0000000140)={0x1, 0xb, &(0x7f0000000200)=@framed={{}, [@map_fd={0x18, 0x1, 0x1, 0x0, r0}, @generic={0xbf, 0x2, 0xa}, @generic={0x7, 0x2, 0x0, 0x0, 0xfffffff8}, @generic={0xbf, 0x3, 0xa}, @generic={0x7, 0x3, 0x0, 0x0, 0xfffffff0}, @generic={0xb7, 0x4, 0x0, 0x0, 0x4}, @generic={0x85, 0x0, 0x0, 0x0, 0x2}]}, &(0x7f0000000280)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r1 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_fanout(r1, 0x107, 0x12, &(0x7f0000000100)={0x2, 0x7}, 0x4) setsockopt$packet_int(r1, 0x107, 0x16, &(0x7f0000000000)=0x4, 0x4) r2 = socket(0x840000000002, 0x3, 0xff) sendmsg$inet(r2, &(0x7f0000000900)={&(0x7f00000006c0)={0x2, 0x4e23, @multicast1}, 0x10, &(0x7f00000007c0)=[{&(0x7f0000000040)="9744012000000000035bdb61ea02df7bc728d08701008cc5595c08", 0x1b}], 0x1, &(0x7f00000008c0)=[@ip_pktinfo={{0x1c, 0x0, 0x8, {0x0, @dev={0xac, 0x14, 0x14, 0x21}, @rand_addr=0x64010101}}}], 0x20}, 0xc884) 45.254435304s ago: executing program 2 (id=4827): bpf$PROG_LOAD(0x5, &(0x7f00000002c0)={0x3, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="18000000ff0700000000000000000000850000002a00000018010000646c6c2500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000000000000b70300000000"], 0x0, 0x0, 0x0, 0x0, 0x41100, 0x20, '\x00', 0x0, @sched_cls, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$PROG_LOAD(0x5, &(0x7f0000000380)={0x1, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x2, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r0 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_fanout(r0, 0x107, 0x12, &(0x7f0000000100)={0x0, 0x7}, 0x4) setsockopt$packet_int(r0, 0x107, 0x16, &(0x7f0000000000)=0x3, 0x4) syz_emit_ethernet(0x66, &(0x7f0000000340)={@multicast, @remote, @void, {@ipv6={0x86dd, @icmpv6={0x1, 0x6, '\x00', 0x30, 0x3a, 0x0, @private0, @mcast2, {[], @dest_unreach={0x1, 0x4, 0x0, 0x0, '\x00', {0xd, 0x6, "310300", 0xf4e, 0x0, 0x1, @ipv4={'\x00', '\xff\xff', @initdev={0xac, 0x1e, 0x1, 0x0}}, @private2={0xfc, 0x2, '\x00', 0x1}}}}}}}}, 0x0) 45.034507233s ago: executing program 0 (id=4828): bpf$PROG_LOAD(0x5, &(0x7f0000000640)={0x11, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018010000", @ANYRES32, @ANYBLOB="0000000000000000b70800000000396f7b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000002400000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x40, '\x00', 0x0, @fallback=0x2, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$PROG_LOAD(0x5, &(0x7f0000001a00)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="18090000000000000000000000000000850000006d0000001801000020696c25"], 0x0, 0x0, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r0 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x1f, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x1a, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$PROG_BIND_MAP(0xa, &(0x7f00000004c0)={r0}, 0xc) 44.983014804s ago: executing program 3 (id=4829): r0 = socket$inet_sctp(0x2, 0x1, 0x84) setsockopt$inet_sctp_SCTP_INITMSG(r0, 0x84, 0x2, &(0x7f0000000180)={0x7a2a, 0x9, 0x1}, 0x8) setsockopt$inet_sctp_SCTP_STREAM_SCHEDULER(r0, 0x84, 0x7b, &(0x7f0000000140)={0x0, 0x1}, 0x8) r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$WG_CMD_SET_DEVICE(0xffffffffffffffff, &(0x7f0000000540)={0x0, 0x0, &(0x7f0000000fc0)={&(0x7f0000000300)=ANY=[@ANYBLOB="78010000", @ANYRES16, @ANYBLOB="0100000000000000000001000000140002007767310000000000000000000000000024000300a0cb879a47f5bc644c0e693fa6d031c74a1553b6e901b9ff2f518c78042fb542080005000000000024010880f000008024000100975c9d81c983c8209ee781254b899f8ed925ae9f0923c23c62f53c57cdbf691ca400098028000080060001000a0000001c000200fe880000000000000000000000000001050003000300000028000080060001000a0000001400020000000000000000000000000000000001050003000000000028000080060001000a00000014000200fc0200000000000000000080"], 0x178}, 0x1, 0x0, 0x0, 0x4084}, 0x20000010) syz_genetlink_get_family_id$nl80211(&(0x7f0000000040), 0xffffffffffffffff) r2 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000100)={'wlan1\x00'}) sendmsg$NL80211_CMD_VENDOR(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={0x0, 0x30}}, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, 0x0) sendmsg$nl_route(r1, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x20040001}, 0x200080c0) sendmsg$inet_sctp(r0, &(0x7f0000000700)={&(0x7f0000000340)=@in={0x2, 0x4e21, @initdev={0xac, 0x1e, 0x1, 0x0}}, 0x10, &(0x7f00000006c0)=[{&(0x7f0000000640)="0c4a522d120d68306fc7e0f85f124d89a52a6a68d513ab1f0be2e6a230779569dcafbb154e94e72f47a2f08f31b0508665f7c8377d09adf4b06173d31011a9112f1b78bdc92e8cf952a4300ee3a3de6a526f7fc583c86b1aef3333", 0x5b}], 0x1, 0x0, 0x0, 0x2804c044}, 0x0) setsockopt$inet_sctp_SCTP_STREAM_SCHEDULER_VALUE(r0, 0x84, 0x7c, &(0x7f00000001c0)={0x0, 0x6, 0x9}, 0x8) setsockopt$inet_sctp_SCTP_STREAM_SCHEDULER_VALUE(r0, 0x84, 0x7c, &(0x7f0000000200)={0x0, 0x9, 0x9}, 0x8) shutdown(r0, 0x1) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000400)=@bpf_lsm={0x6, 0x3, &(0x7f0000000840)=ANY=[@ANYBLOB="1800000053d4000000000000000100049500000000000000e6ade9f07fb11fd2f74efa66a10cd17d0595555cb45b262582a31177db8a503f883c93b2319019b7d9f817a7632d482b49d73a21d28176a0ea9af07c200e890ba6653c322fb776271cf497311673dae29ae7ae7c2bdf24d59345cc3be779a8cbc8e278f28d9eabc9690f8282940b2583341c6b1c61db25fac93728bf745614dce918acd297e0394a3b53793b64850c16f9d43b68fb3e10fc0b165293a6273b0594ff2ab3671f1bffc16cceea8234b8d186d5f2ad6141d5704254d9dfb73770ced42db50b14ab"], &(0x7f0000000100)='GPL\x00', 0x8008, 0x0, 0x0, 0x40f00, 0x4, '\x00', 0x0, 0x1b, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x10, 0xb5}, 0x94) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)}, 0x4040) getsockopt$inet_sctp6_SCTP_GET_ASSOC_STATS(0xffffffffffffffff, 0x84, 0x70, &(0x7f0000000000)={0x0, @in={{0x2, 0x4e23, @loopback}}, [0x9c4, 0x6, 0x6, 0xffffffff, 0xa, 0x5, 0x9, 0x2, 0x6780000000000000, 0x4, 0x0, 0x80000001, 0x100000000, 0x2666, 0xfffffffffffffff2]}, &(0x7f0000000100)=0x100) setsockopt$inet_sctp_SCTP_STREAM_SCHEDULER_VALUE(r0, 0x84, 0x7c, &(0x7f0000000240)={r3, 0x1000, 0x5}, 0x8) r4 = bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="9feb01001800000000000000180000001800000004000000020000000100000c02000000000000000000000d0000000000005f"], 0x0, 0x34}, 0x20) r5 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r5, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000440)={&(0x7f0000000100)=ANY=[], 0x70}}, 0x0) r6 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000580)='blkio.bfq.empty_time\x00', 0x26e1, 0x0) close(0x3) r7 = socket$inet_tcp(0x2, 0x1, 0x6) setsockopt$inet_tcp_buf(r7, 0x6, 0x1f, &(0x7f0000000400)='espintcp', 0x8) sendmsg$NL80211_CMD_DEL_STATION(r6, &(0x7f0000000800)={0x0, 0x0, &(0x7f00000007c0)={0x0}, 0x1, 0x0, 0x0, 0x8d51d0cb139cbded}, 0x40010) r8 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x3, &(0x7f0000000100)=ANY=[@ANYBLOB="180000000100000000000000801800009500000000000000"], &(0x7f0000000000)='GPL\x00', 0xc, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, r4, 0x8, &(0x7f00000000c0)={0x0, 0x1}, 0x1}, 0x94) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000680)=@bpf_ext={0x1a, 0xb, &(0x7f00000004c0)=ANY=[@ANYBLOB="1800004f0c000000000000fcffefff18010000202075250000000000a6b96cbf280461b7e62020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b70300000500000085000000b90000009500000000000000"], &(0x7f0000000180)='syzkaller\x00', 0x7, 0x0, 0x0, 0x41000, 0x20, '\x00', 0x0, 0x18, r4, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x1, r8, 0x0, 0x0, 0x0, 0x10, 0x4aa}, 0x94) 44.910916492s ago: executing program 4 (id=4830): r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl(r0, 0x0, &(0x7f0000000080)="4c6601f187c8078c6fe52241679b93d0e54ed3fcbe8d3891986e873574558011367a4ec92b951cbc92a3515d82e0d52f444701f12388f2b31b2f96046e93ede25a5124bcbf4dea136babc78b48c9adbc01d92984e6bd0f93e7880c0181911064") r1 = socket(0xa, 0x3, 0x3a) r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0900000004000000060000000c00000000040000", @ANYRES32=0x1, @ANYBLOB='\x00'/20, @ANYRES32=0x0, @ANYRES32, @ANYBLOB='\x00'/28], 0x50) r3 = bpf$PROG_LOAD(0x5, &(0x7f0000000140)={0x11, 0xd, &(0x7f0000000300)=ANY=[@ANYBLOB="180000e7ff00000000000085b2085e71ea28924fea45f3e6ba5f55000831fc719359084846060000ae00"/53, @ANYRES32=r2, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b70400000000000085000000030000009500000000000000"], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x1f00, 0x0, '\x00', 0x0, @fallback=0x25, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$PROG_BIND_MAP(0xa, &(0x7f0000000080)={r3, r2}, 0xc) setsockopt$MRT6_ADD_MFC(r1, 0x29, 0xcc, &(0x7f0000000000)={{0xa, 0x0, 0x84, @local, 0x4}, {0xa, 0x0, 0x3, @mcast1}, 0x0, {[0x2, 0x8, 0xa, 0x0, 0x0, 0x0, 0x7ff, 0x4]}}, 0x5c) ioctl$SIOCGETSGCNT(r1, 0x89e1, &(0x7f0000000000)={@initdev={0xac, 0x1e, 0x1, 0x0}, @private=0xa010102}) sendmsg$nl_route(r0, &(0x7f00000006c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000000)=ANY=[@ANYBLOB="5800000010000704000000000080000000000000", @ANYRES32=0x0, @ANYBLOB="8100000008000000240012800c0001006d6163766c616e001400028008000100040000000800090001000000140035006d6163766c616e300000000000000000"], 0x58}}, 0x8000) r4 = socket(0x28, 0x5, 0x0) bind$vsock_stream(r4, &(0x7f0000000040), 0x10) listen(r4, 0x0) r5 = socket(0x28, 0x5, 0x0) connect$vsock_stream(r5, &(0x7f0000000080), 0x10) setsockopt$sock_linger(r5, 0x1, 0x3c, &(0x7f0000000180)={0x1, 0x5}, 0x8) sendmmsg(r5, &(0x7f0000000100)=[{{0x0, 0x0, &(0x7f00000000c0)=[{&(0x7f0000000000)="1b", 0x1}], 0x1}}], 0x1, 0x24008094) r6 = accept4$unix(r4, 0x0, 0x0, 0x0) recvfrom$unix(r6, &(0x7f0000000140)=""/263, 0x107, 0x0, 0x0, 0x0) pselect6(0x40, &(0x7f0000000100), 0x0, &(0x7f0000000240)={0x1f, 0xfffffffffffffffe, 0xe, 0x0, 0x7, 0x4, 0x0, 0xfffffffffffffffc}, &(0x7f0000000280)={0x0, 0x3938700}, 0x0) r7 = socket$nl_netfilter(0x10, 0x3, 0xc) r8 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) ioctl$TUNSETIFF(r8, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x1}) r9 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r9, 0x8933, &(0x7f0000000080)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r9, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000000)=@newqdisc={0x30, 0x24, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r10, {0x0, 0xffff}, {0xfff1, 0xffff}}, [@qdisc_kind_options=@q_ingress={0xc}]}, 0x30}}, 0x0) sendmsg$nl_route_sched(r9, &(0x7f0000000800)={0x0, 0x0, &(0x7f0000000600)={&(0x7f0000000840)=@newtfilter={0x48, 0x2c, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r10, {0x1}, {0x0, 0xffff}, {0x300, 0x1}}, [@filter_kind_options=@f_flower={{0xb}, {0x18, 0x2, [@TCA_FLOWER_INDEV={0x14, 0x2, 'dvmrp1\x00'}]}}]}, 0x48}}, 0x0) getsockopt$inet_sctp_SCTP_PR_ASSOC_STATUS(r1, 0x84, 0x73, &(0x7f0000000180)={0x0, 0x1, 0x20, 0x5e, 0x5}, &(0x7f00000001c0)=0x18) sendmsg$NFT_BATCH(r7, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000b00)=ANY=[@ANYBLOB="140000001052340000000000000000000000000a20000000000a01020000000000000000010000000900010073797a300000000040000000160a01000000000000000000010000040900020073797a31000000000900020073797a300000000014000380080001400000000008000240ffff000038000000180a0101000b0000000000000100000a0c000000030c00038008000140000000200900020073797a300000000000000000"], 0xc0}}, 0x0) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000140)) unshare(0x8000400) 44.815769583s ago: executing program 1 (id=4831): r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000480)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000d00)=@updpolicy={0xb8, 0x19, 0x1, 0x0, 0x0, {{@in6=@rand_addr=' \x01\x00', @in=@broadcast, 0x4e22, 0x5, 0x0, 0x0, 0xa, 0x0, 0x0, 0x2b, 0x0, 0xffffffffffffffff}, {0x0, 0xa9, 0x0, 0x0, 0x0, 0xffffffffffffffff}, {0x9, 0xa00, 0x40800000000000, 0x800000000000000}, 0x0, 0x0, 0x0, 0x1}}, 0xb8}}, 0x0) sendmsg$nl_xfrm(r0, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000400)={&(0x7f0000000500)=@migrate={0xa0, 0x21, 0x1, 0x0, 0xfffffffe, {{@in6=@local, @in6=@empty, 0xfffe, 0x0, 0x2, 0x0, 0xa, 0xe0, 0x80, 0x87}, 0x2}, [@migrate={0x50, 0x11, [{@in=@multicast2=0xfc020000, @in6=@mcast1, @in6=@mcast2, @in=@broadcast, 0x6c, 0x1, 0x0, 0x0, 0x2, 0xa}]}]}, 0xa0}, 0x1, 0x0, 0x0, 0x800}, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f00000003c0)={'veth1_to_hsr\x00', 0x0}) r3 = socket$inet6(0xa, 0x3, 0x2) connect$inet6(r3, &(0x7f0000000200)={0xa, 0x4e24, 0x6, @empty, 0x80000000}, 0x1c) setsockopt$SO_TIMESTAMPING(r3, 0x1, 0x25, &(0x7f0000000140)=0x220, 0x4) setsockopt$inet6_IPV6_RTHDRDSTOPTS(r3, 0x29, 0x37, &(0x7f0000000000)=ANY=[], 0x10) sendmmsg(r3, &(0x7f00000092c0), 0x4ff, 0x0) sendmsg$nl_route_sched(r1, &(0x7f0000001200)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000180)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70bd27, 0x4000000, {0x0, 0x0, 0x0, r2, {0x0, 0xa}, {0xffff, 0xffff}, {0x0, 0xb}}, [@qdisc_kind_options=@q_fq={{0x7}, {0xc, 0x2, [@TCA_FQ_RATE_ENABLE={0x8, 0x5, 0x4000}]}}]}, 0x38}, 0x1, 0x0, 0x0, 0x20000040}, 0x854) r4 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r5 = syz_genetlink_get_family_id$nbd(&(0x7f0000000000), 0xffffffffffffffff) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff}) sendmsg$NBD_CMD_CONNECT(r4, &(0x7f0000001ac0)={0x0, 0x0, &(0x7f0000001a80)={&(0x7f0000000100)={0x3c, r5, 0x1, 0xfffffffd, 0x3, {}, [@NBD_ATTR_TIMEOUT={0xc, 0x4, 0x5}, @NBD_ATTR_SOCKETS={0x10, 0x7, 0x0, 0x1, [{0xc, 0x1, 0x0, 0x1, {0x8, 0x1, r6}}]}, @NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x7fff}]}, 0x3c}}, 0xc800) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r6, 0x8933, &(0x7f00000013c0)={'batadv_slave_0\x00'}) ioctl$BTRFS_IOC_SET_RECEIVED_SUBVOL(r1, 0xc0c89425, &(0x7f0000001240)={"96684811738d8db660318beae4871ea2", 0x0, 0x0, {0x8000000000000001, 0x6}, {0x47ec, 0x8}, 0x7fffffff, [0x22, 0x100000000, 0x4, 0x6, 0x6, 0x2a86, 0x8001, 0xd, 0x8001, 0xd0a7, 0xb, 0xa131, 0x6, 0x7fffffff, 0x1, 0x7fffffff]}) ioctl$BTRFS_IOC_RM_DEV_V2(r1, 0x5000943a, &(0x7f0000001880)={{r1}, r7, 0x2, @inherit={0x78, &(0x7f0000001340)={0x0, 0x6, 0x6, 0x29, {0x30, 0x1000200, 0xc2d, 0x8, 0xffffffff}, [0x13e, 0x3, 0x200, 0x8000000000000001, 0xfffffffffffffffd, 0x7]}}, @subvolid=0x3}) bpf$PROG_LOAD(0x5, &(0x7f00000017c0)={0x2, 0xe, &(0x7f0000000200)=ANY=[@ANYBLOB="b70000001c000000bca30000000000002403000020feffff620a00fef8ffffff71a4f0ff000000001f03000000000000e5000600000000002604fdffff02000015010000033800001d13fcff000000007a0af0ff0000001f0f14000000000000b503f7fff80000009500000000000000033bc065b78111c6dfa041b63af4a3912435f1a864a7aad58db6a693002e7f3be361917adef6ee1c8a2a4f8ef1e50becb19bc461e91a7168e5181554a090f300020000fe275daf51efd601b6bf01c8e8b1b526375ee4dd6fcd82e4fee5bef7af9aa0d7d600c095199fe3ff3128e599b0eaebbdbd732c9cc00eec363e4a8f6456e2cc21557c0afc646cb7798b3e6440c2fbdb00a3e35208b0bb0d2cd829e65440000000000000000028610643a98d9ec21ead2ed51b104d4d91af25b845b9f7d08d123deda88c658d42ecbf28bf7076c15b463bebc72f526dd70252e79166d858fcd0e06dd31af9612fa402d0b11008e59a5923906f88b53987ad1714e72ba7a54f0c33d39000d06a59ff61623604000000000000006a89adaf17b0a6041bdeebdfd1f5089048ddff6da40f9411fe7226a40409d6e37c4f46756d31cb467600ade70063e5291569b33d21dae356e1c51f03a801be8189679a16da18ec0ae564163427afea62d84f3a10076443d643649393bf52d2105bd901128c7e0ec82701c8204a1deeed4155617572652d950ad31928b0b036dc2869f478341d02d0f5ad94b081fcd507acb4b9c67382f13d000000225d85ae49cee383dc5049076b98fb6853ab39a21514da60d2ae20cfb91d6a49964757cdf538f9ce2bdbb9893a5de817101a3062cd54f9ff51d355d84ce97bb0c6b6a595e487a2cc47c0efbb2d71cde2c10f0bc6980fe78683ac5c0c31032599dd273863be9261eee52216d009f4c52048ef8c126aeef5f510a8f1aded94a129e4aec6e8d9ab06faffc3a15d91c2ea3e2e04cfe031b287539d0540059fe6c7fe7cd8697502c7596566d674e425da5e7f009602a9f61d3804b3e0a1053abdc31282dfb15eb6841bb64a1b3045024a982f3c48153baae244e7bf573eac34b781337ad5905c6bbf1137548c7f1a4cad2422ee965a38f7defbd2960242b104e20dc2d9b0c35608d402ccdd9069bd50b994fda7a90144022a579dfc0229cc0dc98816106dec28eaeb883418f562ae00003ea96d10f172c0374d6eed826416050000000bfe9b4a9c5a90ff59d54d1f92ecc48899b212c55318294270a1ad10c80fef7c24d47afcc829ba0f85da6d888f18ea40ab959f6074ab2a40d85d1501783a7ab540b8d7b4ead35a385e0b4a26b702396df7e0c1e02b88c114f244a9bf93f04bf072f0861f5c0b000000000000eedcf2ba1a9508f9d6aba582a896a9f1ffa968eacea75caf822a7a63ba3401e6a52acb11883ad2a3b1832371fe5bc621426d1ed01b389708165b9cdbae2ed9dc7358f0ebadde0b727f27feeb7464dcd857ab15e355713767c536cbae2f5c7d951680f6f2f9a6a8346962a350845ffa0d82884f79adc287906943408e6df3c391e97ba48db0a5adbfd03aac93df8866fb010ae20e92bed1fe39af169d2a466f0db6f3d9436a7d55fc30511d00000000c95265b2bd83d64a532869d701723fedcbada1ee7baa19faf67256b56a41fd355b6a686b50f0937f778af083e055f6138a757ebd0ed91124a6b244f9acf41ac5d73a008364e0606a594817031fc2f52c8785fe0721719b3d654026c6ea08b83b123145ab5703dad844ced301efeb6dc5f6a9037d2283c42efc54fa84323afc4c10eff462c8843187f1dd48ef0981000000000000ff0f40b1888e1cdba94a6ea80c33ead5722c3293a493f1479531dd88261458f40d31fe8df15efaaeea831555877f9538c6ee6ba65893ff1f908ba7554ba583ec7932f5954f31a878e2fae6691d1aee1da02ba516467df3e7d1daac43738612e4fee18a22da19fc08001011e32f80fb60e14b9eee094277bbc170882c8890205f3a6da2819d2f9e77c7c64affa54fec0136cbafa5f62e3f753b639a924599c1f69219927ea5301fff0a6063d427180d61542c2571f983e96635600000554f327a3535e7c7542799493c31ac05a7b57f03ca91a01ba2a30ca99e969d6fd09dc28ebc15edb4d91675767999d146aef7799738b292fd64bb25b2969e2b15f36b788bce5ccdbaf75c94cb93499f6947a967a794963342aece449a0d80010f5c653d22d49030a8c2a4ab595bf4238f18ca428dafc7ac96d404607a0000000051a2104f22e6db5a62b5089c1b45282d38864daa3ae81d6b0968d1d2867b6ef9d12096833d6864da40b54783a17aaeb6737c323f9f98e354cc98dcfe23ad01bd1c61563e69ffe1c2c73e1661261173f359e93d2c5e424c17998809ec8f0232b3955e052a4cecd89008f70314a0bdd491ec035d232f89fe0120f64c62e8e3ed8bcb45202c204bbec8d722824c0ebca8db1ea4a05e41f6016ab5bbe4fe7ff5d785d0128171c90d9900ca2532b0f9d01c4b45294fbba468df3e1b393cb4e62e753b4172ba7ac1f2b51c94bc5d047899fd219f448bf9189c65c9d91eda6b52a373803a9efe44f86909bc90addb7b9aee813df534aac4b3093c91b8068cd849904568916694d461b76a58d88cf0f520310a1e9fdc18cde98d662eee077515d0a881192292ffff5392ab3d1311b82432662806add87047f601fa888400000000000000000000000000006acc19808d7cf29bc974b0ea92499a41b9b9a7c2bca311a28ee4952f2d325a56397c78f12205db653a536f9f3322405d1efd78e578dc6b3fb84f3738a4b6caa800000087efa51c5d95ecba4e50e529d1e8c89600e809dc3d0a2f65579e23457949a50f2d0455cf79a43746979f99f6a1527f004f1e37a3926937e84fb478199dc1020f4beb98b8074bf7df8b5e783637da740800000000000000c55a4385e9a617aa6c8e10d4202c5afeb06e2f9115558ea12f92d7ae633d44086b3f03b20d546fa66a72e38207c9d20035abc46271a30f1240de52536941242d23896ab74a3c6670fdc49c14f34fc4eadd6db8d80eba439772bf60a1db18c472dafc5569adc282928d2a1ffe29f1a57d3f18f4edaeb5d37918e6fddcd821da67a0785585a4443440dc65600e64a6a2740000000000000000000000000000000000000000000a0009dd14b38f2f4426d7cf5075047c31f6ce6adddfe3ac649c0643c8bfbeb14ba1fd7a485aa893915cf81e29aaf375e904bbe52691a4100260ffcd8f1d04166d291ebcef893e1b9ccb6797d0646fe0e7274434f28efb43e06e64f0698caca42f4e6018a455736c482a017e2b13dac4a90faa109f0e87cc94e3efb649692456463ca74aa6ad4bf50c1acb0000000000000005375e528285544d0064b98646f3109e9a4942ce42c6e7ec84b664f6c2770803f10baa804a707f0a1fcbfc309381aeba191950bae71f37f1eb7ceeffb3c0547ac6571603adbfde4c8b5f8d7f4b854441613633b48865b65bdc415e1e0dcf672d68cf4cebf04f4bc1eebf560a26d34d3757b1450fdb0a9a69f432e277f3a0386eb2bd3305c821c64757f786b79fef54dbe64c67d73934bc80b2133fb3c04cc7ea48bf97a6243c9f95dcbddecf45f008f1822c7868e1ff5a3cff5d6b6898335792749df7b1f51e91f8c1c3b1b93b33aaa3fab69cef08a9f6f6cf39dea3d878b2ed42545421970cc426e644332bc956d1c6adefdf0ede2c5c94aa632646ae225accdf031f611d01622921f1b922a5ac887cca3136133dce8d9f5f4da7bed2ea5d94362200000000000000000000f296b0c1484e5f781ad26bff696b05ff0a5e2270e07618b04273bd4075ea38ab463bfa6a38e7c537498ba3e4df8dfc9e040000003c3ffad44d2a376def42e41e9fc31678257e040fa7cf32c221aaac08000000000000001a00000000000000000000173570f0c11ae694b0f7a4f9c2f6790044a357e785af6e153d5f1ea460af92c7cbbd6295afe740f5e154346d483e0d641ef02e4d5295d756e110522a7a945b93fb705b95b6aae27a8fb33732ce1da1c0b1af8eb9222a06e984ab1e6984c8bdc12360627137ab67b6b68ab08acb29a74dc36b51209cfbc87f61182bbeb2772e9d5a1ffc477179be481efe46a4ce86be0b1d8eee42a611a3d44ca450b14586ed63dd92005c79e4a8ab8a94f0c6cb4bed8594a39bd76d3ef8a7ab014e787596db796bd93a36c2880423291e3bccc86f66ba792ff4d87b3f80e5908779e51c5e9055fc5b23605cd000c723187ef09dcf4b07b06a9342f3f62ee7acddff292082c1f4d8eb9561f80873a09a1ae0c9af1121175e5600f43a1179484502009759264a5729f07c2b218fa36ba2316a99aaad0130df83d0bda1e711290f78c143ea143967b00adcd77e6ad5e48d839ea61aadb83e4d071c54691924a3830d3e7b5c198bb0ed623153590000000000000000004b985ea1702f34f2f85b168c083e810ed567e3f1979b9ed1a4bf6a10dac825c96a0828b335de445a4880bb6474157efd1a72ca46ae4cbe3ab648c9bc4867a5a4cb87d7d6d55475b34b3cb6aa9e2337d4e04a37e35109752522ac9b186ddd80c47da6a2f4ef7bb909c975520000000000000000000000219cf5c1376ab33786f6b856d354e90a2733f78f2d188057cead3480eade49d55b770fad7fa000d23da6275768810b6b2df91d3a991ea98d929d271696c258d5b735d5db11df434e7dd1b7c1ca05cea3977df564115f4ec6ffab1d2ff8a642ca50934b3fbe44b0abeba9df209566984a29dfc0466e439a94e177b3c4d5f6e92b8176b9d6ddeeeb196fa964217f88e1acc180aaa4"], &(0x7f00000001c0)='GPL\x00', 0x2, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, &(0x7f0000000100), 0xffffffffffffff97, 0x10, &(0x7f00000000c0)={0x0, 0x3}, 0xfffffffffffffd27, 0x0, 0xffffffffffffffff, 0x1a}, 0x48) socket$kcm(0x10, 0x2, 0x4) r8 = socket$nl_generic(0x10, 0x3, 0x10) r9 = gettid() sendmsg$nl_generic(r8, &(0x7f0000000980)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x8}, 0xc, &(0x7f0000000940)={&(0x7f0000000f80)={0x1bc, 0x3d, 0x800, 0x70bd29, 0x25dfdbfb, {0x17}, [@nested={0x125, 0x38, 0x0, 0x1, [@generic="3a92ab34a081adb413c8536e26a2f7a9b1c6dda6015d5fa6ca459c70f201a9134b77b8c2d5f48f09c5e543a400ca318e3e60791a75dac4a1068af42bd5ba37d2d122f3bfcb8642ca7c9879db93bc321b3ce1f2498473a30828f9ad43794e8b2862a2eb148ce40b2c70f520e054aa1956c0035d62108223c4084a1ed21323020e3bf6f842d486bf1452ecd02496a13dce2af6114e2ed48ce1e7fad57b501b2180c3750668fda4e8854ff26276b9b8a594847161770f4e00b6cfadb5f1b692d801cf09c27e3c59798f7cd3531c17fd19b1f9632254117988cba1b9965b05c4f25d60f60bb29de459d7f7", @typed={0x2e, 0xab, 0x0, 0x0, @binary="57ea279e2d0f74638a97903f4b9e75311a5eda73385a8634916e51c66d0846ff6c097153760a5cf45600"}, @typed={0x4, 0x119}, @nested={0x4, 0x8b}]}, @typed={0x8, 0x147, 0x0, 0x0, @pid=r9}, @generic="c9b51184468c390aece88d32133df77d68b2726051a2de369ae3c4cff258b8af7dab80c4d9aeead4f8973cec2994280d03fe856029d682eadbd8fa78f30420e76061de30c3a3d74caa004cd39076645eeba93166f940816d8408e9edb76fa363d4a622c062d53c6617197cc726cc54da55290db2f306"]}, 0x1bc}, 0x1, 0x0, 0x0, 0x40840}, 0x5) r10 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="19000000040000000800000008"], 0x48) r11 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xd, &(0x7f00000002c0)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r10, @ANYBLOB="0000000000000000b7080000000002007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b7040000000000008500000001000000850000000700000095"], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) r12 = socket$nl_generic(0x10, 0x3, 0x10) r13 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), r12) ioctl$sock_SIOCGIFINDEX_80211(r12, 0x8933, &(0x7f0000000100)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_SET_TX_BITRATE_MASK(r12, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000140)={0x34, r13, 0x1, 0x72bd29, 0x0, {{}, {@val={0x8, 0x3, r14}, @void}}, [@NL80211_ATTR_TX_RATES={0x18, 0x5a, 0x0, 0x1, [@NL80211_BAND_6GHZ={0x14, 0x3, 0x0, 0x1, [@NL80211_TXRATE_HT={0x5, 0x2, [{0x5, 0xa}]}, @NL80211_TXRATE_LEGACY={0x5, 0x1, [0x30]}]}]}]}, 0x34}, 0x1, 0x0, 0x0, 0x4040000}, 0x0) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000280)={{r10}, &(0x7f0000000080), &(0x7f0000000200)=r11}, 0x20) 44.53916773s ago: executing program 2 (id=4832): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$batadv(&(0x7f0000000400), 0xffffffffffffffff) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r0, 0x8933, &(0x7f0000000440)={'batadv0\x00', 0x0}) sendmsg$BATADV_CMD_SET_MESH(r0, &(0x7f0000000540)={0x0, 0x0, &(0x7f0000000500)={&(0x7f0000000040)={0x24, r1, 0x1, 0x70bd28, 0x4000001, {}, [@BATADV_ATTR_MESH_IFINDEX={0x8, 0x3, r2}, @BATADV_ATTR_DISTRIBUTED_ARP_TABLE_ENABLED={0x5, 0x2f, 0x1}]}, 0x24}}, 0x0) r3 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000700)={'wlan0\x00', 0x0}) r5 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r5, &(0x7f0000000900)={0x0, 0x0, &(0x7f0000000940)={&(0x7f0000000980)=@setlink={0x20, 0x13, 0x1, 0x0, 0x0, {0x0, 0x0, 0x0, r4, 0x1, 0x1}}, 0x20}}, 0x0) sendmsg$nl_route(r5, &(0x7f0000000a00)={0x0, 0x0, &(0x7f0000000a40)={&(0x7f0000000a80)=@setlink={0x20, 0x13, 0x1, 0x0, 0x0, {0x0, 0x0, 0x0, r2, 0x1, 0x1}}, 0x20}}, 0x0) r6 = socket$packet(0x11, 0x3, 0x300) bind$packet(r6, &(0x7f0000000b00)={0x11, 0x300, r2, 0x1, 0x0, 0x6, @broadcast}, 0x14) write(r6, &(0x7f0000000c00)="ffffffffffff52540012345608060001080006040001525400123456ac141414000000000000ac141420", 0x2a) write(r6, &(0x7f0000000c40)="ffffffffffff52540012345608060001080006040001525400123456c0a80101000000000000c0a80102", 0x2a) write(r6, &(0x7f0000000c80)="ffffffffffff525400123456080045000020000040004011b98fac141414ffffffff12341234000c000061626364", 0x32) r7 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$sock_int(r7, 0x1, 0x6, &(0x7f0000000d00)=0x1, 0x4) nanosleep(&(0x7f0000000e20)={0x1}, 0x0) 44.41916898s ago: executing program 0 (id=4833): r0 = bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000040)={0x5, 0x0, 0x0, &(0x7f0000000100)='syzkaller\x00', 0x1000d, 0x0, 0x0, 0x41100}, 0x94) ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8933, &(0x7f0000000040)={'wlan1\x00'}) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl(r1, 0x8b2a, &(0x7f0000000040)) r2 = socket$netlink(0x10, 0x3, 0x6) bind$netlink(r2, &(0x7f0000514ff4)={0x10, 0x0, 0x0, 0x2ffffffff}, 0xc) setsockopt$sock_int(r2, 0x1, 0x8, &(0x7f0000000000), 0x4) setsockopt$netlink_NETLINK_BROADCAST_ERROR(r2, 0x10e, 0x4, &(0x7f0000000100)=0x1800, 0x4) r3 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r3, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000001cc0)=ANY=[@ANYBLOB="ac0100001700010000000000000000007f0000010000000000000000000000000000fefffffffffffd8000000000000000000000000000bbac1414bb000000000000000000000000ffffff2b6b57a470b83fce00000000004e210000000000000000006400000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="fc0200000000000000000000000000000000000000000000000000000000000100000000000000000a00802000000000", @ANYRES32=0x0, @ANYRES32=0xee00, @ANYBLOB="00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000200000200000000f9ffffff00000000000000000000000084000500ffffffff000000000000000000000000000004d33c0000000a00000000000000000000000000000000000001053500000200ac0003000000010000000900000000000000000000000000000000000001000004d56c"], 0x1ac}}, 0x0) r4 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r4, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000001f40)={&(0x7f0000000600)=@updpolicy={0xb8, 0x19, 0x1, 0x70bd27, 0x0, {{@in6=@loopback, @in6=@private2, 0x1, 0x0, 0x0, 0x0, 0xa, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff}, {0x0, 0xc, 0x0, 0x0, 0x3c, 0xffffffffffffffff, 0x200000000000}, {0xcdab, 0x2f, 0x5, 0x800000000000002}, 0x1, 0x0, 0x1}}, 0xb8}, 0x1, 0x0, 0x0, 0x20}, 0x4048050) r5 = socket$inet_smc(0x2b, 0x1, 0x0) setsockopt$sock_int(r5, 0x1, 0x7, &(0x7f0000000300)=0x3, 0x4) r6 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f00000001c0)='freezer.parent_freezing\x00', 0x0, 0x0) connect$inet(r5, &(0x7f0000000080)={0x2, 0x4e21, @dev={0xac, 0x14, 0x14, 0x3a}}, 0x10) socket(0x2, 0x80805, 0x0) r7 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r7, &(0x7f00000001c0)={0x1f, 0xffff, 0x3}, 0x6) write(r7, &(0x7f0000000340)="07000000010001", 0x7) r8 = socket$kcm(0x10, 0x3, 0x10) bind$alg(r0, &(0x7f0000000140)={0x26, 'rng\x00', 0x0, 0x0, 'drbg_nopr_sha512\x00'}, 0x58) bpf$PROG_LOAD(0x5, &(0x7f0000000780)={0x8, 0x2f, &(0x7f0000000380)=ANY=[@ANYBLOB="1800000007000000000000000f00000018110000", @ANYRES32=r6, @ANYBLOB="0000000000000000b702000014000000b7030000000000008500000083000000bf0900000000000055090100000000009500000000000000180100002020782500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000007000000850000000600000089010c00fcffffffb7080000000000007b8af8ff00000000b7080000020000007b8af0ff00000000bfa100000000000007010000f8ffffffbfa400000000000007040000f0ffffffb70200000800000018230000", @ANYRES32=r6, @ANYBLOB="0000000000000000b70500000800000085000000a500000018010000646c6c2500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b70300000900000085000000060000001851001f0b0000000000000000000000bf91000000000000b7020000010000008500000085000000b7000000000000009500000000000000"], &(0x7f0000000540)='syzkaller\x00', 0xc0000, 0x90, &(0x7f0000000580)=""/144, 0x40f00, 0x24, '\x00', 0x0, @fallback=0x2c, r6, 0x8, &(0x7f00000006c0)={0x7, 0x3}, 0x8, 0x10, &(0x7f0000000700)={0x1, 0xd, 0x5, 0x2}, 0x10, 0xffffffffffffffff, 0xffffffffffffffff, 0x0, &(0x7f0000000740)=[r6], 0x0, 0x10, 0x7270fef1}, 0x94) sendmsg$kcm(r8, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)=[{&(0x7f0000000080)="1400000016000b63d25a8064100094f90224fc05", 0x14}], 0x1, 0x0, 0x0, 0x10}, 0x0) connect$inet(r5, &(0x7f0000000340)={0x2, 0x4e21, @loopback}, 0x10) sendto$inet6(0xffffffffffffffff, 0x0, 0x0, 0x48000, &(0x7f000005ffe4)={0xa, 0x4e22, 0x0, @loopback={0xfec0ffffffffffff, 0x1c9ae7fffe9a6f34}}, 0x1c) r9 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r9, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000140)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a01030000000000000000010000000900010073797a310000000054000000030a01020000000000000000010000000900030073797a310000000028000480080002400000000008000140000000051400030076657468315f6d6163767461700000000900010073797a310000000094000000050a01020000000000000000010020000c00024000000000000000010900010073797a310000f8ff5b0004801400030076657468315f6d616376746170000000080001"], 0x130}}, 0x0) getsockopt$sock_cred(r1, 0x1, 0x11, &(0x7f0000000200), &(0x7f0000000240)=0xc) syz_80211_join_ibss(&(0x7f00000002c0)='wlan0\x00', &(0x7f0000001440)=@default_ap_ssid, 0x6, 0x0) 0s ago: executing program 32 (id=4833): r0 = bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000040)={0x5, 0x0, 0x0, &(0x7f0000000100)='syzkaller\x00', 0x1000d, 0x0, 0x0, 0x41100}, 0x94) ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8933, &(0x7f0000000040)={'wlan1\x00'}) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl(r1, 0x8b2a, &(0x7f0000000040)) r2 = socket$netlink(0x10, 0x3, 0x6) bind$netlink(r2, &(0x7f0000514ff4)={0x10, 0x0, 0x0, 0x2ffffffff}, 0xc) setsockopt$sock_int(r2, 0x1, 0x8, &(0x7f0000000000), 0x4) setsockopt$netlink_NETLINK_BROADCAST_ERROR(r2, 0x10e, 0x4, &(0x7f0000000100)=0x1800, 0x4) r3 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r3, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000001cc0)=ANY=[@ANYBLOB="ac0100001700010000000000000000007f0000010000000000000000000000000000fefffffffffffd8000000000000000000000000000bbac1414bb000000000000000000000000ffffff2b6b57a470b83fce00000000004e210000000000000000006400000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="fc0200000000000000000000000000000000000000000000000000000000000100000000000000000a00802000000000", @ANYRES32=0x0, @ANYRES32=0xee00, @ANYBLOB="00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000200000200000000f9ffffff00000000000000000000000084000500ffffffff000000000000000000000000000004d33c0000000a00000000000000000000000000000000000001053500000200ac0003000000010000000900000000000000000000000000000000000001000004d56c"], 0x1ac}}, 0x0) r4 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r4, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000001f40)={&(0x7f0000000600)=@updpolicy={0xb8, 0x19, 0x1, 0x70bd27, 0x0, {{@in6=@loopback, @in6=@private2, 0x1, 0x0, 0x0, 0x0, 0xa, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff}, {0x0, 0xc, 0x0, 0x0, 0x3c, 0xffffffffffffffff, 0x200000000000}, {0xcdab, 0x2f, 0x5, 0x800000000000002}, 0x1, 0x0, 0x1}}, 0xb8}, 0x1, 0x0, 0x0, 0x20}, 0x4048050) r5 = socket$inet_smc(0x2b, 0x1, 0x0) setsockopt$sock_int(r5, 0x1, 0x7, &(0x7f0000000300)=0x3, 0x4) r6 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f00000001c0)='freezer.parent_freezing\x00', 0x0, 0x0) connect$inet(r5, &(0x7f0000000080)={0x2, 0x4e21, @dev={0xac, 0x14, 0x14, 0x3a}}, 0x10) socket(0x2, 0x80805, 0x0) r7 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r7, &(0x7f00000001c0)={0x1f, 0xffff, 0x3}, 0x6) write(r7, &(0x7f0000000340)="07000000010001", 0x7) r8 = socket$kcm(0x10, 0x3, 0x10) bind$alg(r0, &(0x7f0000000140)={0x26, 'rng\x00', 0x0, 0x0, 'drbg_nopr_sha512\x00'}, 0x58) bpf$PROG_LOAD(0x5, &(0x7f0000000780)={0x8, 0x2f, &(0x7f0000000380)=ANY=[@ANYBLOB="1800000007000000000000000f00000018110000", @ANYRES32=r6, @ANYBLOB="0000000000000000b702000014000000b7030000000000008500000083000000bf0900000000000055090100000000009500000000000000180100002020782500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000007000000850000000600000089010c00fcffffffb7080000000000007b8af8ff00000000b7080000020000007b8af0ff00000000bfa100000000000007010000f8ffffffbfa400000000000007040000f0ffffffb70200000800000018230000", @ANYRES32=r6, @ANYBLOB="0000000000000000b70500000800000085000000a500000018010000646c6c2500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b70300000900000085000000060000001851001f0b0000000000000000000000bf91000000000000b7020000010000008500000085000000b7000000000000009500000000000000"], &(0x7f0000000540)='syzkaller\x00', 0xc0000, 0x90, &(0x7f0000000580)=""/144, 0x40f00, 0x24, '\x00', 0x0, @fallback=0x2c, r6, 0x8, &(0x7f00000006c0)={0x7, 0x3}, 0x8, 0x10, &(0x7f0000000700)={0x1, 0xd, 0x5, 0x2}, 0x10, 0xffffffffffffffff, 0xffffffffffffffff, 0x0, &(0x7f0000000740)=[r6], 0x0, 0x10, 0x7270fef1}, 0x94) sendmsg$kcm(r8, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)=[{&(0x7f0000000080)="1400000016000b63d25a8064100094f90224fc05", 0x14}], 0x1, 0x0, 0x0, 0x10}, 0x0) connect$inet(r5, &(0x7f0000000340)={0x2, 0x4e21, @loopback}, 0x10) sendto$inet6(0xffffffffffffffff, 0x0, 0x0, 0x48000, &(0x7f000005ffe4)={0xa, 0x4e22, 0x0, @loopback={0xfec0ffffffffffff, 0x1c9ae7fffe9a6f34}}, 0x1c) r9 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r9, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000140)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a01030000000000000000010000000900010073797a310000000054000000030a01020000000000000000010000000900030073797a310000000028000480080002400000000008000140000000051400030076657468315f6d6163767461700000000900010073797a310000000094000000050a01020000000000000000010020000c00024000000000000000010900010073797a310000f8ff5b0004801400030076657468315f6d616376746170000000080001"], 0x130}}, 0x0) getsockopt$sock_cred(r1, 0x1, 0x11, &(0x7f0000000200), &(0x7f0000000240)=0xc) syz_80211_join_ibss(&(0x7f00000002c0)='wlan0\x00', &(0x7f0000001440)=@default_ap_ssid, 0x6, 0x0) kernel console output (not intermixed with test programs): ile:196kB unevictable:0kB isolated(anon):0kB isolated(file):0kB mapped:0kB dirty:0kB writeback:0kB shmem:0kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB kernel_stack:64kB pagetables:140kB sec_pagetables:0kB all_unreclaimable? no Balloon:0kB gpu_active:0kB gpu_reclaim:0kB [ 565.650025][T18094] Node 0 DMA free:15360kB boost:0kB min:208kB low:260kB high:312kB reserved_highatomic:0kB free_highatomic:0kB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB zspages:0kB present:15992kB managed:15360kB mlocked:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB [ 565.650191][T18094] lowmem_reserve[]: 0 [ 565.660945][T18077] 8021q: adding VLAN 0 to HW filter on device bond4 [ 565.676111][T18094] 2487 2487 2487 2487 [ 565.676230][T18094] Node 0 DMA32 free:1279616kB boost:0kB min:34140kB low:42672kB high:51204kB reserved_highatomic:0kB free_highatomic:0kB active_anon:27276kB inactive_anon:0kB active_file:128kB inactive_file:174236kB unevictable:0kB writepending:776kB zspages:0kB present:3129332kB managed:2546940kB mlocked:0kB bounce:0kB free_pcp:38368kB local_pcp:20228kB free_cma:0kB [ 565.676431][T18094] lowmem_reserve[]: 0 0 0 0 0 [ 565.676546][T18094] Node 0 Normal free:0kB boost:0kB min:0kB low:0kB high:0kB reserved_highatomic:0kB free_highatomic:0kB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB zspages:0kB present:1048580kB managed:0kB mlocked:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB [ 565.676695][T18094] lowmem_reserve[]: 0 0 0 0 0 [ 565.676799][T18094] Node 1 Normal free:3944772kB boost:0kB min:55760kB low:69700kB high:83640kB reserved_highatomic:0kB free_highatomic:0kB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:196kB unevictable:0kB writepending:0kB zspages:0kB present:4194300kB managed:4111104kB mlocked:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB [ 565.676969][T18094] lowmem_reserve[]: 0 0 0 0 0 [ 565.677062][T18094] Node 0 DMA: 0*4kB 0*8kB 0*16kB 0*32kB 0*64kB 0*128kB 0*256kB 0*512kB 1*1024kB (U) 1*2048kB (M) 3*4096kB (M) = 15360kB [ 565.677423][T18094] Node 0 DMA32: 2126*4kB (UME) 825*8kB (UM) 318*16kB (UME) 2515*32kB (UM) 1024*64kB (UME) 362*128kB (UME) 74*256kB (UM) 11*512kB (UME) 38*1024kB (UM) 6*2048kB (UM) 242*4096kB (UM) = 1279552kB [ 565.677918][T18094] Node 0 Normal: 0*4kB 0*8kB 0*16kB 0*32kB 0*64kB 0*128kB 0*256kB 0*512kB 0*1024kB 0*2048kB 0*4096kB = 0kB [ 565.678201][T18094] Node 1 Normal: 3*4kB (UM) 3*8kB (UM) 4*16kB (UM) 9*32kB (UM) 13*64kB (UM) 3*128kB (UM) 3*256kB (UM) 2*512kB (M) 1*1024kB (M) 2*2048kB (U) 961*4096kB (M) = 3944772kB [ 565.678663][T18094] Node 0 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 565.678707][T18094] Node 0 hugepages_total=2 hugepages_free=2 hugepages_surp=0 hugepages_size=2048kB [ 565.678767][T18094] Node 1 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 565.678817][T18094] Node 1 hugepages_total=2 hugepages_free=2 hugepages_surp=0 hugepages_size=2048kB [ 565.678860][T18094] 44156 total pagecache pages [ 565.678894][T18094] 0 pages in swap cache [ 565.678916][T18094] Free swap = 124996kB [ 565.678937][T18094] Total swap = 124996kB [ 565.678967][T18094] 2097051 pages RAM [ 565.678996][T18094] 0 pages HighMem/MovableOnly [ 565.679019][T18094] 428700 pages reserved [ 565.679040][T18094] 0 pages cma reserved [ 565.834153][T18077] 8021q: adding VLAN 0 to HW filter on device bond5 [ 565.900338][T18077] 8021q: adding VLAN 0 to HW filter on device bond6 [ 565.917373][T18077] 8021q: adding VLAN 0 to HW filter on device bond7 [ 565.957210][T18077] mac80211_hwsim hwsim8 wlan0: entered promiscuous mode [ 566.566402][T18077] 8021q: adding VLAN 0 to HW filter on device bond10 [ 566.569550][T18077] A link change request failed with some changes committed already. Interface geneve3 may have been left with an inconsistent configuration, please check. [ 566.603934][ T5753] gretap1: entered promiscuous mode [ 566.692462][T15280] bridge3: port 1(veth3) entered blocking state [ 566.692585][T15280] bridge3: port 1(veth3) entered forwarding state [ 566.695644][T15280] bridge3: port 2(veth5) entered blocking state [ 566.695752][T15280] bridge3: port 2(veth5) entered forwarding state [ 566.753876][T18079] gretap0: entered allmulticast mode [ 566.817474][T17721] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 566.821091][ C1] ip6_tunnel: L xmit: Local address not yet configured! [ 567.126819][T18108] netlink: 12 bytes leftover after parsing attributes in process `syz.2.3227'. [ 567.175022][T16546] ip6_tunnel: ip6tnl1 xmit: Local address not yet configured! [ 567.235378][T18108] ipvlan2: entered allmulticast mode [ 567.235405][T18108] syz_tun: entered allmulticast mode [ 567.432156][T18125] netlink: 8 bytes leftover after parsing attributes in process `syz.2.3227'. [ 567.461519][T18126] netlink: 28 bytes leftover after parsing attributes in process `syz.3.3230'. [ 567.690364][T17721] veth0_vlan: entered promiscuous mode [ 567.752071][T17721] veth1_vlan: entered promiscuous mode [ 567.853081][T17721] veth0_macvtap: entered promiscuous mode [ 567.858433][T17721] veth1_macvtap: entered promiscuous mode [ 567.915744][T17721] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 568.015038][T17721] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 568.082869][T18131] netlink: 'syz.0.3233': attribute type 2 has an invalid length. [ 568.171801][ T12] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 568.172220][ T12] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 568.172314][ T12] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 568.172390][ T12] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 568.388353][T18141] atomic_op ffff8880564331e0 conn xmit_atomic 0000000000000000 [ 568.476372][T18144] netlink: 4 bytes leftover after parsing attributes in process `syz.3.3232'. [ 568.540380][T15249] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 568.540442][T15249] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 568.859665][ T6762] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 568.859689][ T6762] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 569.019860][T18148] netlink: 32 bytes leftover after parsing attributes in process `syz.2.3236'. [ 569.710208][T18148] bridge0: port 2(bridge_slave_1) entered disabled state [ 569.710942][T18148] bridge0: port 1(bridge_slave_0) entered disabled state [ 570.093400][ T5629] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 570.107613][ T5629] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 570.112772][ T5629] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 570.122486][ T5629] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 570.133475][ T5629] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 570.217328][T18148] A link change request failed with some changes committed already. Interface bridge_slave_0 may have been left with an inconsistent configuration, please check. [ 570.537352][T18169] syzkaller0: entered promiscuous mode [ 570.537380][T18169] syzkaller0: entered allmulticast mode [ 570.793410][T18176] netlink: 32 bytes leftover after parsing attributes in process `syz.4.3242'. [ 570.793437][T18176] openvswitch: netlink: Flow key attr not present in new flow. [ 571.430107][T18163] wlan0 speed is unknown, defaulting to 1000 [ 571.838921][T18211] netlink: 100 bytes leftover after parsing attributes in process `syz.1.3250'. [ 571.872532][T18203] netlink: 32 bytes leftover after parsing attributes in process `syz.4.3251'. [ 571.922828][T18207] netlink: 'syz.4.3251': attribute type 1 has an invalid length. [ 572.218089][T18215] netlink: 32 bytes leftover after parsing attributes in process `syz.0.3252'. [ 572.260902][ T52] Bluetooth: hci0: command tx timeout [ 572.269233][T18215] syzkaller0: entered promiscuous mode [ 572.269320][T18215] syzkaller0: entered allmulticast mode [ 572.537573][T18230] atomic_op ffff8880446f61e0 conn xmit_atomic 0000000000000000 [ 572.608555][T18230] netlink: 4 bytes leftover after parsing attributes in process `syz.1.3255'. [ 572.832756][T18230] bond0: (slave bond_slave_0): Releasing backup interface [ 573.329171][T18248] netlink: 20 bytes leftover after parsing attributes in process `syz.1.3260'. [ 573.352415][T18163] bridge0: port 1(bridge_slave_0) entered blocking state [ 573.352530][T18163] bridge0: port 1(bridge_slave_0) entered disabled state [ 573.352716][T18163] bridge_slave_0: entered allmulticast mode [ 573.357712][T18163] bridge_slave_0: entered promiscuous mode [ 573.419909][T18163] bridge0: port 2(bridge_slave_1) entered blocking state [ 573.420176][T18163] bridge0: port 2(bridge_slave_1) entered disabled state [ 573.441249][T18163] bridge_slave_1: entered allmulticast mode [ 573.457900][T18163] bridge_slave_1: entered promiscuous mode [ 573.471313][T18248] netlink: 8 bytes leftover after parsing attributes in process `syz.1.3260'. [ 573.471763][T18248] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 573.472233][T18245] tipc: Started in network mode [ 573.472262][T18245] tipc: Node identity 00000000000000000000000000000001, cluster identity 4711 [ 573.472313][T18245] tipc: Enabling of bearer rejected, failed to enable media [ 573.823349][T18265] FAULT_INJECTION: forcing a failure. [ 573.823349][T18265] name failslab, interval 1, probability 0, space 0, times 0 [ 573.823386][T18265] CPU: 0 UID: 0 PID: 18265 Comm: syz.2.3264 Not tainted syzkaller #0 PREEMPT(full) [ 573.823412][T18265] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 573.823426][T18265] Call Trace: [ 573.823436][T18265] [ 573.823446][T18265] dump_stack_lvl+0xe8/0x150 [ 573.823491][T18265] should_fail_ex+0x410/0x560 [ 573.823528][T18265] should_failslab+0xa8/0x100 [ 573.823559][T18265] __kvmalloc_node_noprof+0x176/0x820 [ 573.823588][T18265] ? __kvmalloc_node_noprof+0x345/0x820 [ 573.823615][T18265] ? bpf_compute_postorder+0xda/0x970 [ 573.823647][T18265] ? bpf_compute_postorder+0xda/0x970 [ 573.823679][T18265] bpf_compute_postorder+0xda/0x970 [ 573.823705][T18265] ? __pfx_check_and_resolve_insns+0x10/0x10 [ 573.823735][T18265] ? add_kfuncs+0x251/0x2e0 [ 573.823767][T18265] bpf_check+0x24d6/0x2e10 [ 573.823808][T18265] ? ktime_get_with_offset+0x93/0x2d0 [ 573.823839][T18265] ? __pfx_bpf_check+0x10/0x10 [ 573.823867][T18265] ? bpf_obj_name_cpy+0x194/0x1e0 [ 573.823906][T18265] bpf_prog_load+0x14d6/0x1c20 [ 573.823948][T18265] ? __pfx_bpf_prog_load+0x10/0x10 [ 573.824003][T18265] __sys_bpf+0xd0d/0xd90 [ 573.824039][T18265] ? __pfx___sys_bpf+0x10/0x10 [ 573.824078][T18265] ? __fget_files+0x2a/0x420 [ 573.824130][T18265] ? ksys_write+0x242/0x270 [ 573.824169][T18265] ? __pfx_ksys_write+0x10/0x10 [ 573.824211][T18265] __x64_sys_bpf+0xba/0xd0 [ 573.824236][T18265] do_syscall_64+0x166/0x520 [ 573.824264][T18265] ? trace_irq_disable+0x3b/0x140 [ 573.824287][T18265] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 573.824318][T18265] ? clear_bhb_loop+0x70/0xc0 [ 573.824346][T18265] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 573.824371][T18265] RIP: 0033:0x7fa5cb79e159 [ 573.824392][T18265] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 573.824417][T18265] RSP: 002b:00007fa5cc687028 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 573.824451][T18265] RAX: ffffffffffffffda RBX: 00007fa5cba25fa0 RCX: 00007fa5cb79e159 [ 573.824470][T18265] RDX: 0000000000000094 RSI: 0000200000000040 RDI: 0000000000000005 [ 573.824484][T18265] RBP: 00007fa5cc687090 R08: 0000000000000000 R09: 0000000000000000 [ 573.824499][T18265] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 573.824514][T18265] R13: 00007fa5cba26038 R14: 00007fa5cba25fa0 R15: 00007ffe1c47c9d8 [ 573.824560][T18265] [ 573.923189][T18163] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 574.043229][T18261] netlink: 8 bytes leftover after parsing attributes in process `syz.1.3262'. [ 574.055575][T18163] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 574.186705][T18163] team0: Port device team_slave_0 added [ 574.189974][T18163] team0: Port device team_slave_1 added [ 574.342328][ T52] Bluetooth: hci0: command tx timeout [ 574.400257][T18270] netlink: 8 bytes leftover after parsing attributes in process `syz.0.3265'. [ 574.422146][T18163] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 574.422167][T18163] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 574.422207][T18163] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 574.424331][T18163] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 574.424348][T18163] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 574.424378][T18163] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 574.993277][T18277] syzkaller0: entered promiscuous mode [ 574.993346][T18277] syzkaller0: entered allmulticast mode [ 575.169547][T18163] hsr_slave_0: entered promiscuous mode [ 575.178857][T18163] hsr_slave_1: entered promiscuous mode [ 575.189706][T18163] debugfs: 'hsr0' already exists in 'hsr' [ 575.189767][T18163] Cannot create hsr debugfs directory [ 575.934311][T16546] IPVS: starting estimator thread 0... [ 576.041106][T18303] IPVS: using max 38 ests per chain, 91200 per kthread [ 576.425713][ T52] Bluetooth: hci0: command tx timeout [ 576.663240][T18311] FAULT_INJECTION: forcing a failure. [ 576.663240][T18311] name failslab, interval 1, probability 0, space 0, times 0 [ 576.663279][T18311] CPU: 0 UID: 0 PID: 18311 Comm: syz.4.3275 Not tainted syzkaller #0 PREEMPT(full) [ 576.663306][T18311] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 576.663322][T18311] Call Trace: [ 576.663331][T18311] [ 576.663343][T18311] dump_stack_lvl+0xe8/0x150 [ 576.663383][T18311] should_fail_ex+0x410/0x560 [ 576.663416][T18311] should_failslab+0xa8/0x100 [ 576.663449][T18311] __kvmalloc_node_noprof+0x176/0x820 [ 576.663479][T18311] ? __kvmalloc_node_noprof+0x345/0x820 [ 576.663504][T18311] ? bpf_compute_postorder+0x131/0x970 [ 576.663528][T18311] ? bpf_compute_postorder+0x131/0x970 [ 576.663568][T18311] bpf_compute_postorder+0x131/0x970 [ 576.663595][T18311] ? __pfx_check_and_resolve_insns+0x10/0x10 [ 576.663627][T18311] ? add_kfuncs+0x251/0x2e0 [ 576.663658][T18311] bpf_check+0x24d6/0x2e10 [ 576.663697][T18311] ? ktime_get_with_offset+0x93/0x2d0 [ 576.663728][T18311] ? __pfx_bpf_check+0x10/0x10 [ 576.663757][T18311] ? bpf_obj_name_cpy+0x194/0x1e0 [ 576.663797][T18311] bpf_prog_load+0x14d6/0x1c20 [ 576.663838][T18311] ? __pfx_bpf_prog_load+0x10/0x10 [ 576.663894][T18311] __sys_bpf+0xd0d/0xd90 [ 576.663930][T18311] ? __pfx___sys_bpf+0x10/0x10 [ 576.663971][T18311] ? __fget_files+0x2a/0x420 [ 576.664023][T18311] ? ksys_write+0x242/0x270 [ 576.664063][T18311] ? __pfx_ksys_write+0x10/0x10 [ 576.664105][T18311] __x64_sys_bpf+0xba/0xd0 [ 576.664132][T18311] do_syscall_64+0x166/0x520 [ 576.664160][T18311] ? trace_irq_disable+0x3b/0x140 [ 576.664184][T18311] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 576.664207][T18311] ? clear_bhb_loop+0x70/0xc0 [ 576.664237][T18311] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 576.664261][T18311] RIP: 0033:0x7fc3b339e159 [ 576.664282][T18311] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 576.664302][T18311] RSP: 002b:00007fc3b41cd028 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 576.664328][T18311] RAX: ffffffffffffffda RBX: 00007fc3b3625fa0 RCX: 00007fc3b339e159 [ 576.664345][T18311] RDX: 0000000000000094 RSI: 0000200000000040 RDI: 0000000000000005 [ 576.664361][T18311] RBP: 00007fc3b41cd090 R08: 0000000000000000 R09: 0000000000000000 [ 576.664375][T18311] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 576.664389][T18311] R13: 00007fc3b3626038 R14: 00007fc3b3625fa0 R15: 00007ffeb2d0d618 [ 576.664426][T18311] [ 578.341063][ C1] ip6_tunnel: ip6gre1 xmit: Local address not yet configured! [ 578.512601][ T52] Bluetooth: hci0: command tx timeout [ 579.989329][T18297] tc_dump_action: action bad kind [ 579.989434][T18291] netlink: 'syz.0.3270': attribute type 7 has an invalid length. [ 579.989472][T18291] netlink: 'syz.0.3270': attribute type 8 has an invalid length. [ 579.989504][T18291] netlink: 'syz.0.3270': attribute type 13 has an invalid length. [ 580.901826][ C1] ip6_tunnel: ip6tnl1 xmit: Local address not yet configured! [ 581.314892][T18373] nbd: socks must be embedded in a SOCK_ITEM attr [ 581.597738][T18381] netlink: 6024 bytes leftover after parsing attributes in process `syz.0.3290'. [ 581.720207][T18380] ipvlan4: entered allmulticast mode [ 581.720264][T18380] macvlan1: entered allmulticast mode [ 581.799244][T18380] batman_adv: batadv0: Adding interface: ipvlan4 [ 581.799266][T18380] batman_adv: batadv0: The MTU of interface ipvlan4 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 581.799421][T18380] batman_adv: batadv0: Interface activated: ipvlan4 [ 581.855822][T18393] netlink: 36 bytes leftover after parsing attributes in process `syz.0.3292'. [ 581.967116][T18386] Bluetooth: MGMT ver 1.23 [ 581.967211][T18386] Bluetooth: hci0: unsupported parameter 5135 [ 581.967250][T18386] Bluetooth: hci0: invalid length 1, exp 2 for type 24 [ 581.989200][T18387] ipvlan5: entered allmulticast mode [ 581.995239][T18387] batman_adv: batadv0: Adding interface: ipvlan5 [ 581.995258][T18387] batman_adv: batadv0: The MTU of interface ipvlan5 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 581.995287][T18387] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:35) already exists on: ipvlan4 [ 581.995305][T18387] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 581.995320][T18387] batman_adv: batadv0: Interface activated: ipvlan5 [ 582.722365][T18401] netlink: 36 bytes leftover after parsing attributes in process `syz.0.3295'. [ 585.627736][T18407] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 585.717888][T18163] netdevsim netdevsim3 netdevsim0: renamed from eth0 [ 586.832433][T18163] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 586.833456][T18163] netdevsim netdevsim3 netdevsim1: renamed from eth1 [ 586.886530][T18163] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 586.944408][T18163] netdevsim netdevsim3 netdevsim2: renamed from eth2 [ 586.969109][T18163] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 586.982649][T18163] netdevsim netdevsim3 netdevsim3: renamed from eth3 [ 587.013434][T18163] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 587.454682][T18459] netlink: 8 bytes leftover after parsing attributes in process `syz.1.3308'. [ 587.589710][T18163] 8021q: adding VLAN 0 to HW filter on device bond0 [ 587.687729][T18163] 8021q: adding VLAN 0 to HW filter on device team0 [ 587.704770][T15249] bridge0: port 1(bridge_slave_0) entered blocking state [ 587.704896][T15249] bridge0: port 1(bridge_slave_0) entered forwarding state [ 587.765975][T18163] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 587.766005][T18163] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 587.802654][T16549] bridge0: port 2(bridge_slave_1) entered blocking state [ 587.802782][T16549] bridge0: port 2(bridge_slave_1) entered forwarding state [ 587.861991][T18459] IPVS: persistence engine module ip_vs_pe_G not found [ 588.581276][ C0] ip6_tunnel: ip6gretap2 xmit: Local address not yet configured! [ 588.667947][T18484] netlink: 8 bytes leftover after parsing attributes in process `syz.0.3315'. [ 589.064908][T18489] Bluetooth: MGMT ver 1.23 [ 590.426011][T18499] syzkaller0: entered promiscuous mode [ 590.427674][T18499] syzkaller0: entered allmulticast mode [ 590.809953][T18512] netlink: 8 bytes leftover after parsing attributes in process `syz.0.3319'. [ 594.532778][T18529] netlink: 'syz.2.3322': attribute type 14 has an invalid length. [ 594.926340][T18163] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 595.257814][T18554] x_tables: duplicate underflow at hook 2 [ 595.288926][T18163] veth0_vlan: entered promiscuous mode [ 595.372278][T18557] netlink: 'syz.4.3328': attribute type 12 has an invalid length. [ 595.376929][T18557] netlink: 4 bytes leftover after parsing attributes in process `syz.4.3328'. [ 595.402082][T18163] veth1_vlan: entered promiscuous mode [ 595.596738][T18163] veth0_macvtap: entered promiscuous mode [ 595.633859][T18163] veth1_macvtap: entered promiscuous mode [ 595.705987][T18163] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 595.778944][T18163] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 595.834658][T16546] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 595.908065][ T12] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 595.911104][ T12] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 595.911521][ T12] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 596.045497][T16545] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 596.045551][T16545] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 596.135273][T16546] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 596.135337][T16546] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 596.997109][T18584] openvswitch: netlink: IP tunnel attribute has 8 unknown bytes. [ 596.997152][T18584] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 597.024353][T18584] netlink: 52 bytes leftover after parsing attributes in process `syz.3.3336'. [ 597.057196][T18581] gre0: entered promiscuous mode [ 597.057226][T18581] gre0: entered allmulticast mode [ 597.078040][T18581] netlink: 12 bytes leftover after parsing attributes in process `syz.1.3334'. [ 597.533920][ T5629] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 597.537284][ T5629] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 597.540149][ T5629] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 597.586881][ T5629] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 597.590270][ T5629] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 597.909268][T18599] bridge_slave_0: left allmulticast mode [ 597.909299][T18599] bridge_slave_0: left promiscuous mode [ 597.909525][T18599] bridge0: port 1(bridge_slave_0) entered disabled state [ 597.955018][T18599] bridge_slave_1: left allmulticast mode [ 597.955060][T18599] bridge_slave_1: left promiscuous mode [ 597.955289][T18599] bridge0: port 2(bridge_slave_1) entered disabled state [ 598.031104][T18599] bond0: (slave bond_slave_0): Releasing backup interface [ 598.065289][T18599] bond0: (slave bond_slave_1): Releasing backup interface [ 598.105958][T18599] team0: Port device team_slave_0 removed [ 598.133934][T18599] team0: Port device team_slave_1 removed [ 598.139992][T18599] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 598.140030][T18599] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 598.166175][T18599] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 598.166202][T18599] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 598.254660][T18599] A link change request failed with some changes committed already. Interface hsr_slave_0 may have been left with an inconsistent configuration, please check. [ 598.526526][T15280] smbdirect: ib_dev[s`z1] removed [ 598.606682][ T9] infiniband s`z1: ib_query_port failed (-19) [ 598.826495][ C1] ip6_tunnel: ip6tnl1 xmit: Local address not yet configured! [ 599.166121][T18634] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 599.264029][T18643] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 599.700178][T18652] netlink: 16 bytes leftover after parsing attributes in process `syz.3.3349'. [ 599.703693][ T52] Bluetooth: hci1: command tx timeout [ 599.778759][T18590] wlan0 speed is unknown, defaulting to 1000 [ 600.041972][T18657] veth1_to_batadv: entered allmulticast mode [ 600.046952][T18658] openvswitch: netlink: nsh attribute has 4 unknown bytes. [ 600.065856][T18661] netlink: 32 bytes leftover after parsing attributes in process `syz.3.3352'. [ 600.494455][T18661] bond1 (unregistering): Released all slaves [ 600.798126][T18666] wlan0 speed is unknown, defaulting to 1000 [ 601.781006][ T52] Bluetooth: hci1: command tx timeout [ 601.826698][T18590] bridge0: port 1(bridge_slave_0) entered blocking state [ 601.826888][T18590] bridge0: port 1(bridge_slave_0) entered disabled state [ 601.827031][T18590] bridge_slave_0: entered allmulticast mode [ 601.828983][T18590] bridge_slave_0: entered promiscuous mode [ 601.838802][T18590] bridge0: port 2(bridge_slave_1) entered blocking state [ 601.838983][T18590] bridge0: port 2(bridge_slave_1) entered disabled state [ 601.839125][T18590] bridge_slave_1: entered allmulticast mode [ 601.844144][T18590] bridge_slave_1: entered promiscuous mode [ 602.009378][T18590] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 602.040163][T18590] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 602.172142][T18707] x_tables: duplicate underflow at hook 3 [ 602.217508][T18590] team0: Port device team_slave_0 added [ 602.298619][T18711] netlink: 8 bytes leftover after parsing attributes in process `syz.3.3363'. [ 602.477992][T18590] team0: Port device team_slave_1 added [ 602.689081][T18590] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 602.689101][T18590] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 602.689131][T18590] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 602.725956][T18590] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 602.725977][T18590] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 602.726007][T18590] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 603.054779][T18722] netlink: 80 bytes leftover after parsing attributes in process `syz.0.3367'. [ 603.211473][T18719] tipc: Started in network mode [ 603.211509][T18719] tipc: Node identity 00000000000000000000000000000001, cluster identity 4711 [ 603.211780][T18719] tipc: New replicast peer: 0000:0000:0000:0000:0000:0000:0000:0001 [ 603.212862][T18719] tipc: Enabled bearer , priority 10 [ 603.293251][T18590] hsr_slave_0: entered promiscuous mode [ 603.298499][T18590] hsr_slave_1: entered promiscuous mode [ 603.313004][T18590] debugfs: 'hsr0' already exists in 'hsr' [ 603.313028][T18590] Cannot create hsr debugfs directory [ 603.493651][T18728] netlink: 12 bytes leftover after parsing attributes in process `syz.3.3368'. [ 603.659798][T18724] wlan0 speed is unknown, defaulting to 1000 [ 603.860832][ T52] Bluetooth: hci1: command tx timeout [ 603.979875][T18735] xt_hashlimit: size too large, truncated to 1048576 [ 604.048224][T18736] xt_hashlimit: size too large, truncated to 1048576 [ 604.563928][ T5753] tipc: Node number set to 1 [ 604.746505][T18754] FAULT_INJECTION: forcing a failure. [ 604.746505][T18754] name failslab, interval 1, probability 0, space 0, times 0 [ 604.746544][T18754] CPU: 0 UID: 0 PID: 18754 Comm: syz.2.3374 Not tainted syzkaller #0 PREEMPT(full) [ 604.746580][T18754] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 604.746596][T18754] Call Trace: [ 604.746605][T18754] [ 604.746615][T18754] dump_stack_lvl+0xe8/0x150 [ 604.746659][T18754] should_fail_ex+0x410/0x560 [ 604.746694][T18754] should_failslab+0xa8/0x100 [ 604.746727][T18754] __kvmalloc_node_noprof+0x176/0x820 [ 604.746756][T18754] ? __kvmalloc_node_noprof+0x345/0x820 [ 604.746781][T18754] ? analyze_subprog+0x882/0x9e00 [ 604.746808][T18754] ? analyze_subprog+0x882/0x9e00 [ 604.746844][T18754] analyze_subprog+0x882/0x9e00 [ 604.746870][T18754] ? is_bpf_text_address+0x292/0x2b0 [ 604.746906][T18754] ? kernel_text_address+0xa5/0xe0 [ 604.746942][T18754] ? arch_stack_walk+0xfb/0x150 [ 604.747028][T18754] ? __pfx_stack_trace_save+0x10/0x10 [ 604.747078][T18754] ? call_instance+0x263/0x560 [ 604.747103][T18754] ? bpf_compute_subprog_arg_access+0x2a3/0x14d0 [ 604.747131][T18754] ? bpf_compute_live_registers+0x8d3/0x1ff0 [ 604.747159][T18754] ? __pfx_analyze_subprog+0x10/0x10 [ 604.747183][T18754] ? __x64_sys_bpf+0xba/0xd0 [ 604.747204][T18754] ? do_syscall_64+0x166/0x520 [ 604.747237][T18754] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 604.747305][T18754] ? call_instance+0x263/0x560 [ 604.747331][T18754] ? rcu_is_watching+0x16/0xb0 [ 604.747360][T18754] ? call_instance+0x263/0x560 [ 604.747385][T18754] ? trace_kmalloc+0x2a/0xf0 [ 604.747410][T18754] ? call_instance+0x263/0x560 [ 604.747435][T18754] ? __kvmalloc_node_noprof+0x52f/0x820 [ 604.747463][T18754] ? __kvmalloc_node_noprof+0x345/0x820 [ 604.747489][T18754] ? call_instance+0x263/0x560 [ 604.747514][T18754] ? call_instance+0x263/0x560 [ 604.747547][T18754] ? call_instance+0x42e/0x560 [ 604.747583][T18754] bpf_compute_subprog_arg_access+0x2c9/0x14d0 [ 604.747637][T18754] ? bpf_compute_live_registers+0x14f/0x1ff0 [ 604.747668][T18754] ? bpf_compute_live_registers+0x14f/0x1ff0 [ 604.747695][T18754] ? trace_kmalloc+0x2a/0xf0 [ 604.747717][T18754] ? __pfx_bpf_compute_subprog_arg_access+0x10/0x10 [ 604.747757][T18754] ? __kvmalloc_node_noprof+0x345/0x820 [ 604.747783][T18754] ? bpf_compute_live_registers+0x14f/0x1ff0 [ 604.747811][T18754] ? bpf_compute_live_registers+0x14f/0x1ff0 [ 604.747847][T18754] bpf_compute_live_registers+0x8d3/0x1ff0 [ 604.747897][T18754] ? __pfx_bpf_compute_live_registers+0x10/0x10 [ 604.747940][T18754] bpf_check+0x25ed/0x2e10 [ 604.747979][T18754] ? ktime_get_with_offset+0x93/0x2d0 [ 604.748018][T18754] ? __pfx_bpf_check+0x10/0x10 [ 604.748047][T18754] ? bpf_obj_name_cpy+0x194/0x1e0 [ 604.748114][T18754] bpf_prog_load+0x14d6/0x1c20 [ 604.748156][T18754] ? __pfx_bpf_prog_load+0x10/0x10 [ 604.748214][T18754] __sys_bpf+0xd0d/0xd90 [ 604.748251][T18754] ? __pfx___sys_bpf+0x10/0x10 [ 604.748291][T18754] ? __fget_files+0x2a/0x420 [ 604.748386][T18754] __x64_sys_bpf+0xba/0xd0 [ 604.748415][T18754] do_syscall_64+0x166/0x520 [ 604.748444][T18754] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 604.748468][T18754] ? clear_bhb_loop+0x70/0xc0 [ 604.748496][T18754] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 604.748520][T18754] RIP: 0033:0x7fa5cb79e159 [ 604.748541][T18754] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 604.748560][T18754] RSP: 002b:00007fa5cc687028 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 604.748636][T18754] RAX: ffffffffffffffda RBX: 00007fa5cba25fa0 RCX: 00007fa5cb79e159 [ 604.748656][T18754] RDX: 0000000000000094 RSI: 0000200000000040 RDI: 0000000000000005 [ 604.748672][T18754] RBP: 00007fa5cc687090 R08: 0000000000000000 R09: 0000000000000000 [ 604.748687][T18754] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 604.748701][T18754] R13: 00007fa5cba26038 R14: 00007fa5cba25fa0 R15: 00007ffe1c47c9d8 [ 604.748740][T18754] [ 605.329503][T18590] netdevsim netdevsim4 netdevsim3 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 605.329570][T18590] netdevsim netdevsim4 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 605.367147][T18757] netlink: 'syz.3.3375': attribute type 30 has an invalid length. [ 605.367173][T18757] netlink: 4 bytes leftover after parsing attributes in process `syz.3.3375'. [ 605.904834][T18590] netdevsim netdevsim4 netdevsim2 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 605.904877][T18590] netdevsim netdevsim4 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 605.940859][ T52] Bluetooth: hci1: command tx timeout [ 606.258188][T18590] netdevsim netdevsim4 netdevsim1 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 606.258231][T18590] netdevsim netdevsim4 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 606.447712][T18785] Cannot find map_set index 2 as target [ 606.558932][T18590] netdevsim netdevsim4 netdevsim0 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 606.559020][T18590] netdevsim netdevsim4 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 607.286623][T18805] FAULT_INJECTION: forcing a failure. [ 607.286623][T18805] name failslab, interval 1, probability 0, space 0, times 0 [ 607.286706][T18805] CPU: 1 UID: 0 PID: 18805 Comm: syz.3.3386 Not tainted syzkaller #0 PREEMPT(full) [ 607.286731][T18805] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 607.286752][T18805] Call Trace: [ 607.286761][T18805] [ 607.286771][T18805] dump_stack_lvl+0xe8/0x150 [ 607.286815][T18805] should_fail_ex+0x410/0x560 [ 607.286846][T18805] should_failslab+0xa8/0x100 [ 607.286877][T18805] __kvmalloc_node_noprof+0x176/0x820 [ 607.286905][T18805] ? __kvmalloc_node_noprof+0x345/0x820 [ 607.286930][T18805] ? analyze_subprog+0x882/0x9e00 [ 607.286956][T18805] ? analyze_subprog+0x882/0x9e00 [ 607.286991][T18805] analyze_subprog+0x882/0x9e00 [ 607.287018][T18805] ? is_bpf_text_address+0x292/0x2b0 [ 607.287053][T18805] ? kernel_text_address+0xa5/0xe0 [ 607.287086][T18805] ? arch_stack_walk+0xfb/0x150 [ 607.287129][T18805] ? __pfx_stack_trace_save+0x10/0x10 [ 607.287159][T18805] ? __pfx___css_rstat_updated+0x10/0x10 [ 607.287190][T18805] ? call_instance+0x263/0x560 [ 607.287213][T18805] ? bpf_compute_subprog_arg_access+0x2a3/0x14d0 [ 607.287239][T18805] ? bpf_compute_live_registers+0x8d3/0x1ff0 [ 607.287267][T18805] ? __pfx_analyze_subprog+0x10/0x10 [ 607.287291][T18805] ? __x64_sys_bpf+0xba/0xd0 [ 607.287312][T18805] ? do_syscall_64+0x166/0x520 [ 607.287339][T18805] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 607.287405][T18805] ? call_instance+0x263/0x560 [ 607.287430][T18805] ? rcu_is_watching+0x16/0xb0 [ 607.287458][T18805] ? call_instance+0x263/0x560 [ 607.287481][T18805] ? trace_kmalloc+0x2a/0xf0 [ 607.287506][T18805] ? call_instance+0x263/0x560 [ 607.287529][T18805] ? __kvmalloc_node_noprof+0x52f/0x820 [ 607.287556][T18805] ? __kvmalloc_node_noprof+0x345/0x820 [ 607.287580][T18805] ? call_instance+0x263/0x560 [ 607.287604][T18805] ? call_instance+0x263/0x560 [ 607.287637][T18805] ? call_instance+0x42e/0x560 [ 607.287671][T18805] bpf_compute_subprog_arg_access+0x2c9/0x14d0 [ 607.287736][T18805] ? bpf_compute_live_registers+0x14f/0x1ff0 [ 607.287772][T18805] ? bpf_compute_live_registers+0x14f/0x1ff0 [ 607.287798][T18805] ? trace_kmalloc+0x2a/0xf0 [ 607.287819][T18805] ? __pfx_bpf_compute_subprog_arg_access+0x10/0x10 [ 607.287854][T18805] ? __kvmalloc_node_noprof+0x345/0x820 [ 607.287880][T18805] ? bpf_compute_live_registers+0x14f/0x1ff0 [ 607.287906][T18805] ? bpf_compute_live_registers+0x14f/0x1ff0 [ 607.287941][T18805] bpf_compute_live_registers+0x8d3/0x1ff0 [ 607.287989][T18805] ? __pfx_bpf_compute_live_registers+0x10/0x10 [ 607.288031][T18805] bpf_check+0x25ed/0x2e10 [ 607.288069][T18805] ? ktime_get_with_offset+0x93/0x2d0 [ 607.288101][T18805] ? __pfx_bpf_check+0x10/0x10 [ 607.288130][T18805] ? bpf_obj_name_cpy+0x194/0x1e0 [ 607.288168][T18805] bpf_prog_load+0x14d6/0x1c20 [ 607.288210][T18805] ? __pfx_bpf_prog_load+0x10/0x10 [ 607.288267][T18805] __sys_bpf+0xd0d/0xd90 [ 607.288303][T18805] ? __pfx___sys_bpf+0x10/0x10 [ 607.288343][T18805] ? __fget_files+0x2a/0x420 [ 607.288396][T18805] ? ksys_write+0x242/0x270 [ 607.288433][T18805] ? __pfx_ksys_write+0x10/0x10 [ 607.288474][T18805] __x64_sys_bpf+0xba/0xd0 [ 607.288502][T18805] do_syscall_64+0x166/0x520 [ 607.288530][T18805] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 607.288554][T18805] ? clear_bhb_loop+0x70/0xc0 [ 607.288583][T18805] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 607.288607][T18805] RIP: 0033:0x7f0c01d9e159 [ 607.288629][T18805] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 607.288649][T18805] RSP: 002b:00007f0c02d29028 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 607.288675][T18805] RAX: ffffffffffffffda RBX: 00007f0c02025fa0 RCX: 00007f0c01d9e159 [ 607.288702][T18805] RDX: 0000000000000094 RSI: 0000200000000040 RDI: 0000000000000005 [ 607.288717][T18805] RBP: 00007f0c02d29090 R08: 0000000000000000 R09: 0000000000000000 [ 607.288732][T18805] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 607.288747][T18805] R13: 00007f0c02026038 R14: 00007f0c02025fa0 R15: 00007fffe011a1e8 [ 607.288785][T18805] [ 608.045494][T18590] netdevsim netdevsim4 netdevsim0: renamed from eth0 [ 608.080403][T18590] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 608.109599][T18590] netdevsim netdevsim4 netdevsim1: renamed from eth1 [ 608.133381][T18590] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 608.138309][T18590] netdevsim netdevsim4 netdevsim2: renamed from eth2 [ 608.167582][T18590] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 608.168594][T18590] netdevsim netdevsim4 netdevsim3: renamed from eth3 [ 608.194335][T18590] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 608.600726][T18590] 8021q: adding VLAN 0 to HW filter on device bond0 [ 608.728215][T18590] 8021q: adding VLAN 0 to HW filter on device team0 [ 608.766327][ T1171] bridge0: port 1(bridge_slave_0) entered blocking state [ 608.766442][ T1171] bridge0: port 1(bridge_slave_0) entered forwarding state [ 608.829420][T15280] bridge0: port 2(bridge_slave_1) entered blocking state [ 608.829534][T15280] bridge0: port 2(bridge_slave_1) entered forwarding state [ 609.025063][T18832] netlink: 'syz.1.3392': attribute type 1 has an invalid length. [ 609.209479][T18832] bond2: entered promiscuous mode [ 609.233953][T18832] 8021q: adding VLAN 0 to HW filter on device bond2 [ 609.287521][T18834] bond2: (slave ipvlan2): enslaved VLAN challenged slave. Adding VLANs will be blocked as long as it is part of bond. [ 609.287552][T18834] bond2: (slave ipvlan2): The slave device specified does not support setting the MAC address [ 609.287570][T18834] bond2: (slave ipvlan2): Setting fail_over_mac to active for active-backup mode [ 609.969523][T18857] syzkaller0: entered promiscuous mode [ 609.969583][T18857] syzkaller0: entered allmulticast mode [ 610.306777][ T30] IPVS: starting estimator thread 0... [ 610.310711][T18845] IPVS: wlc: UDP 224.0.0.2:0 - no destination available [ 610.400769][T18865] IPVS: using max 27 ests per chain, 64800 per kthread [ 610.762234][T18878] netlink: 12 bytes leftover after parsing attributes in process `syz.3.3402'. [ 611.014093][T18878] 8021q: adding VLAN 0 to HW filter on device bond1 [ 611.437414][T18896] tipc: Enabling of bearer rejected, failed to enable media [ 611.697173][T18590] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 611.814770][T18917] netlink: 'syz.2.3408': attribute type 2 has an invalid length. [ 611.814799][T18917] netlink: 'syz.2.3408': attribute type 2 has an invalid length. [ 612.430641][T18590] veth0_vlan: entered promiscuous mode [ 612.459058][T18590] veth1_vlan: entered promiscuous mode [ 612.606761][T18590] veth0_macvtap: entered promiscuous mode [ 612.629755][T18590] veth1_macvtap: entered promiscuous mode [ 612.697232][T18933] block nbd0: server does not support multiple connections per device. [ 612.697590][T18933] block nbd0: shutting down sockets [ 612.744809][T18930] wlan0 speed is unknown, defaulting to 1000 [ 613.003280][T18590] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 613.117350][T18590] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 613.212926][ T1171] netdevsim netdevsim4 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 613.212978][ T1171] netdevsim netdevsim4 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 613.213017][ T1171] netdevsim netdevsim4 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 613.213056][ T1171] netdevsim netdevsim4 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 613.864282][ T1171] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 613.864306][ T1171] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 613.968938][ T1171] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 613.968964][ T1171] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 614.282508][T18950] A link change request failed with some changes committed already. Interface dummy0 may have been left with an inconsistent configuration, please check. [ 614.669373][T18969] netlink: 40 bytes leftover after parsing attributes in process `syz.1.3423'. [ 615.295918][T18986] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 615.868910][T19013] tipc: Enabling of bearer rejected, already enabled [ 615.959391][T19015] netlink: 232 bytes leftover after parsing attributes in process `syz.2.3430'. [ 616.342177][T19027] netlink: 4 bytes leftover after parsing attributes in process `syz.2.3434'. [ 617.495870][T19050] netlink: 'syz.0.3439': attribute type 1 has an invalid length. [ 617.799214][T19050] 8021q: adding VLAN 0 to HW filter on device bond2 [ 617.896116][T19055] netlink: 28 bytes leftover after parsing attributes in process `syz.2.3440'. [ 617.938613][T19053] bond2 (unregistering): Released all slaves [ 617.997952][T19066] syzkaller0: entered promiscuous mode [ 618.023779][T19066] syzkaller0: entered allmulticast mode [ 618.043664][T19070] tipc: Started in network mode [ 618.043701][T19070] tipc: Node identity 00000000000000000000000000000001, cluster identity 4711 [ 618.044105][T19070] tipc: New replicast peer: 0000:0000:0000:0000:0000:0000:0000:0001 [ 618.044757][T19070] tipc: Enabled bearer , priority 10 [ 618.535214][T19078] netlink: 16 bytes leftover after parsing attributes in process `syz.4.3447'. [ 618.662606][T19080] netlink: 88 bytes leftover after parsing attributes in process `syz.0.3448'. [ 618.819337][T19093] ip_tables: iptables: counters copy to user failed while replacing table [ 619.162927][ T5623] tipc: Node number set to 1 [ 619.499090][T19118] netlink: 52 bytes leftover after parsing attributes in process `syz.1.3456'. [ 619.524841][T19118] bridge0: port 2(bridge_slave_1) entered disabled state [ 619.526347][T19118] bridge0: port 1(bridge_slave_0) entered disabled state [ 619.592947][T19123] netlink: 76 bytes leftover after parsing attributes in process `syz.1.3456'. [ 619.678966][T19123] bridge0: port 2(bridge_slave_1) entered blocking state [ 619.679238][T19123] bridge0: port 2(bridge_slave_1) entered forwarding state [ 619.679914][T19123] bridge0: port 1(bridge_slave_0) entered blocking state [ 619.680174][T19123] bridge0: port 1(bridge_slave_0) entered forwarding state [ 619.766170][T19123] netlink: 52 bytes leftover after parsing attributes in process `syz.1.3456'. [ 619.819678][T19123] bridge0: port 2(bridge_slave_1) entered disabled state [ 619.819918][T19123] bridge0: port 1(bridge_slave_0) entered disabled state [ 619.865296][T19126] netlink: 20 bytes leftover after parsing attributes in process `syz.4.3457'. [ 619.866051][T19126] netlink: 20 bytes leftover after parsing attributes in process `syz.4.3457'. [ 620.757282][T19146] bridge0: port 2(bridge_slave_1) entered blocking state [ 620.757420][T19146] bridge0: port 2(bridge_slave_1) entered forwarding state [ 620.796963][T19146] 8021q: adding VLAN 0 to HW filter on device bond0 [ 620.819709][T19146] 8021q: adding VLAN 0 to HW filter on device team0 [ 620.847539][T19146] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 620.938487][T19146] hsr0: A HSR master's MTU cannot be greater than the smallest MTU of its slaves minus the HSR Tag length (6 octets). [ 620.968974][T16547] bridge0: port 1(bridge_slave_0) entered blocking state [ 620.969102][T16547] bridge0: port 1(bridge_slave_0) entered forwarding state [ 621.099737][T19175] __nla_validate_parse: 57 callbacks suppressed [ 621.099761][T19175] netlink: 32 bytes leftover after parsing attributes in process `syz.1.3468'. [ 621.531671][T19164] 8021q: adding VLAN 0 to HW filter on device bond4 [ 621.536380][T19164] bond3: (slave bond4): Enslaving as an active interface with an up link [ 621.557966][T19165] 8021q: adding VLAN 0 to HW filter on device bond3 [ 621.728301][T19153] A link change request failed with some changes committed already. Interface hsr_slave_0 may have been left with an inconsistent configuration, please check. [ 621.897087][T19191] netlink: 'syz.1.3472': attribute type 1 has an invalid length. [ 622.048726][T19191] 8021q: adding VLAN 0 to HW filter on device bond5 [ 622.066260][T19184] smbdirect: ib_dev[syz1]: added: RNIC max_fast_reg_page_list_len=256 device_cap_flags=0x200000 kernel_cap_flags=0x10 page_size_cap=0x1000 [ 622.066322][T19184] smbdirect: ib_dev[syz1]: num_ports=1 max_qp_rd_atom=128 max_qp_init_rd_atom=128 max_sgl_rd=0 max_sge_rd=1 max_cqe=3276800 max_qp_wr=32768 max_send_sge=6 max_recv_sge=6 [ 622.066386][T19184] smbdirect: ib_dev[syz1]PORT[1]: iwarp=1 ib=0 roce=0 v1=0 v2=0 core_cap_flags=0x400008 [ 622.188086][T19193] netlink: 28 bytes leftover after parsing attributes in process `syz.1.3472'. [ 622.188120][T19193] netlink: 28 bytes leftover after parsing attributes in process `syz.1.3472'. [ 622.234968][T19184] infiniband syz1: RDMA CMA: cma_listen_on_dev, error -98 [ 622.344469][T19191] bond5: (slave geneve2): making interface the new active one [ 622.377437][T19191] bond5: (slave geneve2): Enslaving as an active interface with an up link [ 622.776069][T19211] netlink: 8 bytes leftover after parsing attributes in process `syz.1.3477'. [ 622.791470][T19211] netlink: 8 bytes leftover after parsing attributes in process `syz.1.3477'. [ 622.975385][T19211] bond6: option broadcast_neighbor: invalid value (3) [ 623.013977][T19211] bond6 (unregistering): Released all slaves [ 623.079900][T19218] netlink: 'syz.0.3479': attribute type 1 has an invalid length. [ 623.079973][T19218] netlink: 'syz.0.3479': attribute type 2 has an invalid length. [ 623.152901][T19225] netlink: 'syz.0.3479': attribute type 1 has an invalid length. [ 623.152931][T19225] netlink: 'syz.0.3479': attribute type 2 has an invalid length. [ 623.189120][T19222] netlink: 'syz.4.3480': attribute type 11 has an invalid length. [ 623.362314][T19222] pim6reg: entered allmulticast mode [ 623.385360][T19229] netlink: 4 bytes leftover after parsing attributes in process `syz.3.3482'. [ 624.038812][T19250] netlink: 28 bytes leftover after parsing attributes in process `syz.0.3488'. [ 624.191362][T19257] x_tables: duplicate underflow at hook 1 [ 624.366893][T19265] netlink: 52 bytes leftover after parsing attributes in process `syz.4.3491'. [ 624.392388][T19265] bridge0: port 2(bridge_slave_1) entered disabled state [ 624.392727][T19265] bridge0: port 1(bridge_slave_0) entered disabled state [ 624.418047][T19265] netlink: 52 bytes leftover after parsing attributes in process `syz.4.3491'. [ 626.438952][T19307] vlan0: entered promiscuous mode [ 626.439015][T19307] bridge0: entered promiscuous mode [ 626.485903][T19314] netlink: 'syz.4.3508': attribute type 1 has an invalid length. [ 626.925282][T19323] 8021q: adding VLAN 0 to HW filter on device bond2 [ 626.948791][T19323] bond2: (slave lo): enslaved VLAN challenged slave. Adding VLANs will be blocked as long as it is part of bond. [ 627.000099][T19323] 8021q: adding VLAN 0 to HW filter on device bond2 [ 627.054566][T19323] bond2: (slave lo): Enslaving as an active interface with an up link [ 627.090363][T19323] A link change request failed with some changes committed already. Interface tunl0 may have been left with an inconsistent configuration, please check. [ 627.179569][T19327] af_packet: tpacket_rcv: packet too big, clamped from 42 to 4294967286. macoff=82 [ 627.550236][T19332] netlink: 4 bytes leftover after parsing attributes in process `syz.3.3515'. [ 627.768808][T19341] netlink: 'syz.2.3519': attribute type 8 has an invalid length. [ 627.909863][T19343] gre1: entered promiscuous mode [ 629.040641][T19367] bond0: option packets_per_slave: invalid value (868050663) [ 629.040673][T19367] bond0: option packets_per_slave: allowed values 0 - 65535 [ 629.452910][T19379] netlink: 12 bytes leftover after parsing attributes in process `syz.2.3535'. [ 629.452975][T19379] netlink: 20 bytes leftover after parsing attributes in process `syz.2.3535'. [ 630.065459][T19388] veth3: entered allmulticast mode [ 630.361257][T19405] syzkaller0: left promiscuous mode [ 630.361282][T19405] syzkaller0: left allmulticast mode [ 632.394683][T19442] ipip0: entered promiscuous mode [ 632.394749][T19442] ipip0: entered allmulticast mode [ 632.404232][T19442] team0: Device ipip0 is of different type [ 632.465118][T19447] netlink: 'syz.1.3565': attribute type 2 has an invalid length. [ 632.492913][T19447] netlink: 'syz.1.3565': attribute type 2 has an invalid length. [ 632.492941][T19447] netlink: 8 bytes leftover after parsing attributes in process `syz.1.3565'. [ 634.660962][ C1] ip6_tunnel: L xmit: Local address not yet configured! [ 634.662659][ C1] ip6_tunnel: ip6tnl1 xmit: Local address not yet configured! [ 635.841388][T19533] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 635.935128][T19539] netlink: 4 bytes leftover after parsing attributes in process `syz.1.3605'. [ 636.258301][T19545] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 636.390083][T19548] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 636.468854][T19552] netlink: 16 bytes leftover after parsing attributes in process `syz.3.3611'. [ 636.503786][T14157] wlan1: authenticate with 08:02:11:00:00:00 (local address=08:02:11:00:00:01) [ 636.503887][T14157] wlan1: send auth to 08:02:11:00:00:00 (try 1/3) [ 636.530389][T19545] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 636.554639][T16547] wlan1: authenticated [ 636.566060][T16547] wlan1: associate with 08:02:11:00:00:00 (try 1/3) [ 636.674676][T16548] wlan1: associate with 08:02:11:00:00:00 (try 2/3) [ 636.741318][ T5629] Bluetooth: hci5: command 0x0406 tx timeout [ 636.781404][ T1171] wlan1: associate with 08:02:11:00:00:00 (try 3/3) [ 636.894689][ T30] wlan1: association with 08:02:11:00:00:00 timed out [ 637.246812][T19568] bridge0: port 2(bridge_slave_1) entered blocking state [ 637.247054][T19568] bridge0: port 2(bridge_slave_1) entered forwarding state [ 637.249639][T19568] bridge0: port 1(bridge_slave_0) entered blocking state [ 637.249893][T19568] bridge0: port 1(bridge_slave_0) entered forwarding state [ 637.280365][T19568] bridge_slave_0: left allmulticast mode [ 637.280439][T19568] bridge_slave_0: left promiscuous mode [ 637.281023][T19568] bridge0: port 1(bridge_slave_0) entered disabled state [ 637.371793][T19569] netlink: 100 bytes leftover after parsing attributes in process `syz.0.3619'. [ 637.427035][T19570] bridge_slave_1: left allmulticast mode [ 637.427141][T19570] bridge_slave_1: left promiscuous mode [ 637.427375][T19570] bridge0: port 2(bridge_slave_1) entered disabled state [ 637.987403][T19582] pimreg: entered allmulticast mode [ 638.152947][T19596] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 638.366792][T19580] pimreg: left allmulticast mode [ 638.396620][T19601] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 638.396650][T19601] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 638.400051][T19601] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 638.400080][T19601] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 639.114704][T16548] IPVS: starting estimator thread 0... [ 639.201003][T19623] IPVS: using max 24 ests per chain, 57600 per kthread [ 639.468988][T19638] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 639.527878][ T5626] wlan1: authenticate with 08:02:11:00:00:00 (local address=08:02:11:00:00:01) [ 639.527907][ T5626] wlan1: send auth to 08:02:11:00:00:00 (try 1/3) [ 639.528206][ T30] wlan1: send auth to 08:02:11:00:00:00 (try 2/3) [ 639.528367][ T30] wlan1: send auth to 08:02:11:00:00:00 (try 3/3) [ 639.528516][ T30] wlan1: authentication with 08:02:11:00:00:00 timed out [ 639.571281][T19640] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 639.626972][T19638] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 639.681854][T19638] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 640.049456][T19650] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 640.465532][T19654] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 640.538165][T19655] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 640.633431][T19655] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 641.009862][T19673] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 641.114000][T19678] netlink: 'syz.0.3647': attribute type 8 has an invalid length. [ 641.448549][T19671] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 641.448585][T19671] nci: nci_start_poll: failed to set listen parameters [ 641.466821][T19671] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 641.486008][T19662] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 641.727671][T19692] tipc: Enabled bearer , priority 0 [ 641.968736][T19697] tipc: Cannot configure node identity twice [ 641.984389][T19697] tipc: Enabled bearer , priority 0 [ 642.388388][T19708] syz_tun: entered allmulticast mode [ 642.401996][T19706] syz_tun: left allmulticast mode [ 642.468520][T19713] netlink: 4 bytes leftover after parsing attributes in process `syz.0.3662'. [ 643.101335][ T10] tipc: Node number set to 1 [ 643.249549][T19734] netlink: 20 bytes leftover after parsing attributes in process `syz.1.3669'. [ 643.249702][T19734] netlink: 20 bytes leftover after parsing attributes in process `syz.1.3669'. [ 643.649126][T19744] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 643.777781][T19750] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 643.831970][T19750] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 643.854875][ T5731] wlan1: authenticate with 08:02:11:00:00:00 (local address=08:02:11:00:00:01) [ 643.854910][ T5731] wlan1: send auth to 08:02:11:00:00:00 (try 1/3) [ 643.857550][T15277] wlan1: send auth to 08:02:11:00:00:00 (try 2/3) [ 643.857730][T15277] wlan1: send auth to 08:02:11:00:00:00 (try 3/3) [ 643.857860][T15277] wlan1: authentication with 08:02:11:00:00:00 timed out [ 643.900136][T19751] netlink: 4 bytes leftover after parsing attributes in process `syz.2.3676'. [ 643.917294][T19750] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 644.012197][T19752] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 644.394382][T19765] netlink: 28 bytes leftover after parsing attributes in process `syz.2.3681'. [ 644.398281][T19765] netlink: 4 bytes leftover after parsing attributes in process `syz.2.3681'. [ 645.835995][T19799] batman_adv: batadv0: Adding interface: wlan0 [ 645.836053][T19799] batman_adv: batadv0: The MTU of interface wlan0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 645.836100][T19799] batman_adv: batadv0: Interface activated: wlan0 [ 645.848526][T19799] batman_adv: batadv0: Adding interface: virt_wifi0 [ 645.848576][T19799] batman_adv: batadv0: The MTU of interface virt_wifi0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 645.848670][T19799] batman_adv: batadv0: Interface activated: virt_wifi0 [ 646.078871][T19804] xt_CT: You must specify a L4 protocol and not use inversions on it [ 646.474744][T19808] infiniband syz0: set active [ 646.474769][T19808] infiniband syz0: added veth0 [ 646.498575][T19808] smbdirect: ib_dev[syz0]: added: IB_CA max_fast_reg_page_list_len=512 device_cap_flags=0x1c001223c76 kernel_cap_flags=0x14 page_size_cap=0xfffff000 [ 646.498607][T19808] smbdirect: ib_dev[syz0]: num_ports=1 max_qp_rd_atom=128 max_qp_init_rd_atom=128 max_sgl_rd=0 max_sge_rd=32 max_cqe=32767 max_qp_wr=1048576 max_send_sge=32 max_recv_sge=32 [ 646.498639][T19808] smbdirect: ib_dev[syz0]PORT[1]: iwarp=0 ib=0 roce=1 v1=0 v2=1 core_cap_flags=0x803005 [ 646.561442][T19808] RDS/IB: syz0: added [ 646.561504][T19808] smc: adding ib device syz0 with port count 1 [ 646.561526][T19808] smc: ib device syz0 port 1 has no pnetid [ 647.367195][T19777] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 647.367221][T19777] nci: nci_start_poll: failed to set local general bytes [ 647.426078][T19764] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 647.779063][T19816] IPVS: sync thread started: state = BACKUP, mcast_ifn = lo, syncid = 0, id = 0 [ 647.812133][T19813] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 647.835307][T19811] IPVS: stopping backup sync thread 19816 ... [ 647.854667][T19819] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 647.895266][T19820] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 647.934259][T14157] wlan1: authenticate with 08:02:11:00:00:00 (local address=08:02:11:00:00:01) [ 647.934328][T14157] wlan1: send auth to 08:02:11:00:00:00 (try 1/3) [ 647.963021][T15280] wlan1: send auth to 08:02:11:00:00:00 (try 2/3) [ 647.963208][T15280] wlan1: send auth to 08:02:11:00:00:00 (try 3/3) [ 647.963332][T15280] wlan1: authentication with 08:02:11:00:00:00 timed out [ 647.999020][T19820] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 648.055979][T19820] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 648.654107][T19834] netlink: 24 bytes leftover after parsing attributes in process `syz.2.3709'. [ 649.424342][T19856] xt_recent: hitcount (134217728) is larger than allowed maximum (65535) [ 649.490727][T19859] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 650.388431][T19878] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 650.414078][ T10] wlan1: authenticate with 08:02:11:00:00:00 (local address=08:02:11:00:00:01) [ 650.414105][ T10] wlan1: send auth to 08:02:11:00:00:00 (try 1/3) [ 650.415587][T15249] wlan1: send auth to 08:02:11:00:00:00 (try 2/3) [ 650.415752][T15249] wlan1: send auth to 08:02:11:00:00:00 (try 3/3) [ 650.415874][T15249] wlan1: authentication with 08:02:11:00:00:00 timed out [ 650.457123][T19878] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 650.529886][T19878] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 651.004966][T19848] rdma_rxe: rxe_newlink: failed to add lo [ 651.005011][T19850] rdma_rxe: rxe_newlink: failed to add lo [ 651.010810][T19852] rdma_rxe: rxe_newlink: failed to add veth0 [ 651.047988][T19875] rdma_rxe: rxe_newlink: failed to add lo [ 651.353633][T19885] rdma_rxe: rxe_newlink: failed to add lo [ 651.548063][T19887] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 651.615343][T19894] tipc: New replicast peer: 172.20.20.187 [ 651.618818][T19894] tipc: Enabled bearer , priority 10 [ 651.744536][T19896] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 651.770389][T19898] rdma_rxe: rxe_newlink: failed to add lo [ 651.916354][T19903] netlink: 4 bytes leftover after parsing attributes in process `syz.0.3735'. [ 651.917092][T19903] netlink: 4 bytes leftover after parsing attributes in process `syz.0.3735'. [ 651.924906][T19903] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 652.720154][T19923] netlink: 88 bytes leftover after parsing attributes in process `syz.0.3743'. [ 652.920109][T19927] rdma_rxe: rxe_newlink: failed to add veth0 [ 653.036822][T19929] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 653.113943][T19933] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 653.251150][T19937] netlink: 16 bytes leftover after parsing attributes in process `syz.4.3748'. [ 653.519647][T19944] netlink: 8 bytes leftover after parsing attributes in process `syz.3.3754'. [ 654.256382][T19955] wlan0 speed is unknown, defaulting to 1000 [ 654.722748][T19969] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 654.786494][T19977] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 654.786778][T19975] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 654.850955][T19979] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 654.897084][T19969] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 654.931307][T19981] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 654.971930][T19982] netlink: 44 bytes leftover after parsing attributes in process `syz.4.3766'. [ 654.976451][T19980] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 655.006856][T19975] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 655.085102][T19977] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 655.130390][T19979] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 655.130857][T19969] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 655.809958][T19988] No such timeout policy "syz1" [ 656.086264][T19985] rdma_rxe: rxe_newlink: failed to add lo [ 656.219454][T19997] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 657.191844][T20030] tipc: Started in network mode [ 657.191880][T20030] tipc: Node identity 7f000001, cluster identity 4711 [ 657.192152][T20030] tipc: New replicast peer: 127.0.0.1 [ 657.193292][T20030] tipc: Enabled bearer , priority 10 [ 657.452904][T20034] tipc: Enabled bearer , priority 0 [ 658.191052][ T5753] tipc: Node number set to 2130706433 [ 658.211002][T20050] bridge0: port 3(syz_tun) entered blocking state [ 658.211276][T20050] bridge0: port 3(syz_tun) entered disabled state [ 658.277304][T20050] syz_tun: entered promiscuous mode [ 658.297474][T20050] bridge0: port 3(syz_tun) entered blocking state [ 658.297600][T20050] bridge0: port 3(syz_tun) entered forwarding state [ 658.468911][T20059] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 658.539852][T20059] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 658.640057][T20064] netlink: 32 bytes leftover after parsing attributes in process `syz.0.3798'. [ 658.669746][T20060] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 658.958309][T20060] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 659.014403][T20061] batman_adv: batadv0: Interface deactivated: macsec0 [ 659.014435][T20061] batman_adv: batadv0: Removing interface: macsec0 [ 659.032442][T20061] batman_adv: batadv0: Interface deactivated: wlan0 [ 659.032469][T20061] batman_adv: batadv0: Removing interface: wlan0 [ 659.034318][T20061] batman_adv: batadv0: Interface deactivated: virt_wifi0 [ 659.034341][T20061] batman_adv: batadv0: Removing interface: virt_wifi0 [ 659.170282][T20076] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 659.252860][T20081] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 659.275402][T20068] netlink: 20 bytes leftover after parsing attributes in process `syz.1.3799'. [ 659.312053][T20073] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 659.339241][T20078] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 659.340445][T20083] syz_tun: entered allmulticast mode [ 659.364410][T20079] syz_tun: left allmulticast mode [ 659.427431][T20078] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 659.524629][T20082] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 659.585306][T20082] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 659.641288][T20087] netlink: 32 bytes leftover after parsing attributes in process `syz.1.3804'. [ 659.677801][T20090] netlink: 20 bytes leftover after parsing attributes in process `syz.0.3807'. [ 659.728268][T20091] wlan0 speed is unknown, defaulting to 1000 [ 659.916412][T20094] wlan0 speed is unknown, defaulting to 1000 [ 660.940360][T20118] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 660.963678][T20118] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 662.212908][T20151] pimreg: entered allmulticast mode [ 662.278430][T20150] pimreg: left allmulticast mode [ 662.449700][T20160] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 662.524898][T20160] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 662.645757][T20168] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 662.785166][T20168] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 662.856731][T20168] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 662.939138][T20168] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 663.019755][T20168] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 663.087414][T20160] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 663.110722][T20160] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 663.537228][T20189] netlink: 'syz.0.3844': attribute type 48 has an invalid length. [ 663.638978][T20192] rdma_rxe: rxe_newlink: failed to add lo [ 663.697680][T20196] openvswitch: netlink: Key 22 has unexpected len 32 expected 4 [ 663.775726][T20193] ovs-dp0: entered promiscuous mode [ 664.225611][T20204] netlink: 16 bytes leftover after parsing attributes in process `syz.1.3848'. [ 664.247530][T20204] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 664.720399][T20215] syz0: rxe_newlink: already configured on veth0 [ 665.178969][T20224] rdma_rxe: rxe_newlink: failed to add veth0 [ 665.475492][T20235] rdma_rxe: rxe_newlink: failed to add veth1 [ 666.822369][T20271] sch_tbf: burst 65537 is lower than device lo mtu (65550) ! [ 667.352915][T20289] Bluetooth: MGMT ver 1.23 [ 667.607889][T20296] rdma_rxe: rxe_newlink: failed to add lo [ 667.729573][T20298] rdma_rxe: rxe_newlink: failed to add veth0 [ 668.421509][ T5629] Bluetooth: hci0: Opcode 0x0c03 failed: -110 [ 668.479748][T20324] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 668.516511][T20326] netlink: 8 bytes leftover after parsing attributes in process `syz.3.3885'. [ 669.090622][ C0] llcp: nfc_llcp_symm_timer: SYMM timeout [ 669.242976][T20345] ip_tables: iptables: counters copy to user failed while replacing table [ 669.689641][T20357] ip_tables: iptables: counters copy to user failed while replacing table [ 669.744788][T20360] netlink: 16 bytes leftover after parsing attributes in process `syz.4.3900'. [ 669.943040][T20365] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 671.716863][T20330] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 672.584436][ T5629] Bluetooth: hci3: command 0x0406 tx timeout [ 673.647601][T20385] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 673.647629][T20385] nci: nci_start_poll: failed to set listen parameters [ 673.647743][T20385] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 673.665362][T20374] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 673.955148][T20427] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 674.153865][T20435] netlink: 'syz.1.3926': attribute type 2 has an invalid length. [ 674.156101][T20434] syz0: rxe_newlink: already configured on veth0 [ 674.241776][T20438] wlan0 speed is unknown, defaulting to 1000 [ 675.528797][T20463] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 675.948925][T20472] netlink: 32 bytes leftover after parsing attributes in process `syz.1.3938'. [ 676.468470][T20487] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 676.636601][T20490] netlink: 16 bytes leftover after parsing attributes in process `syz.3.3947'. [ 676.636641][T20490] netlink: 'syz.3.3947': attribute type 6 has an invalid length. [ 676.741701][T20495] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 676.893780][T20502] netlink: 4 bytes leftover after parsing attributes in process `syz.4.3949'. [ 677.405818][T20520] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 677.703641][ T5629] Bluetooth: hci4: command 0x0406 tx timeout [ 678.134383][T20537] netlink: 4 bytes leftover after parsing attributes in process `syz.2.3960'. [ 678.335583][ T10] nfc nfc0: NFC: nfcsim_send: Device is down [ 678.335609][ T10] digital: digital_wq_cmd: in_send_command returned err -19 [ 678.508668][T20556] netlink: 8 bytes leftover after parsing attributes in process `syz.1.3966'. [ 678.685034][T20566] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 679.448522][T20577] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 679.470329][T20579] netlink: 'syz.4.3974': attribute type 2 has an invalid length. [ 679.470354][T20579] netlink: 'syz.4.3974': attribute type 1 has an invalid length. [ 679.566001][T20581] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 679.569346][T20583] tipc: Enabling of bearer rejected, already enabled [ 679.676403][T20581] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 679.749695][T20581] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 685.733169][T20620] netlink: 8 bytes leftover after parsing attributes in process `syz.0.3990'. [ 685.733825][T20620] netlink: 8 bytes leftover after parsing attributes in process `syz.0.3990'. [ 685.778277][T20602] wlan0 speed is unknown, defaulting to 1000 [ 685.857637][T20618] bridge0: port 1(bridge_slave_0) entered disabled state [ 685.929445][T20618] bridge_slave_0 (unregistering): left allmulticast mode [ 685.929511][T20618] bridge_slave_0 (unregistering): left promiscuous mode [ 685.929701][T20618] bridge0: port 1(bridge_slave_0) entered disabled state [ 686.031126][T20626] tipc: Enabled bearer , priority 0 [ 686.055662][T20624] tipc: Disabling bearer [ 686.403904][T20633] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 686.864813][T20642] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 686.964252][T20642] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 687.004095][T20649] netlink: 16 bytes leftover after parsing attributes in process `syz.0.4002'. [ 687.007116][T20647] syz0: rxe_newlink: already configured on veth0 [ 687.086277][T20650] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 687.172640][T20655] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 687.233582][T20655] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 687.294355][T20657] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 687.365379][T20657] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 687.558147][T20659] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 688.465058][T20679] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 688.482539][T20681] netlink: 40 bytes leftover after parsing attributes in process `syz.1.4010'. [ 688.541596][T20683] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 688.634544][T20679] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 688.707793][T20683] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 688.778445][T20679] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 688.918426][T20694] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 688.930870][T20693] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 689.085162][T20698] netlink: 8 bytes leftover after parsing attributes in process `syz.2.4015'. [ 689.404865][T20705] netlink: 'syz.2.4018': attribute type 2 has an invalid length. [ 690.269763][ T30] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 690.269788][ T30] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 690.528926][T20740] tipc: Enabled bearer , priority 0 [ 690.562480][T20740] tipc: Disabling bearer [ 690.651222][T20743] netlink: 28 bytes leftover after parsing attributes in process `syz.4.4030'. [ 690.651292][T20743] netlink: 28 bytes leftover after parsing attributes in process `syz.4.4030'. [ 690.651356][T20743] netlink: 'syz.4.4030': attribute type 6 has an invalid length. [ 690.727859][T20746] netlink: 32 bytes leftover after parsing attributes in process `syz.0.4031'. [ 690.730584][T20746] netlink: 'syz.0.4031': attribute type 1 has an invalid length. [ 690.730608][T20746] netlink: 'syz.0.4031': attribute type 2 has an invalid length. [ 690.739793][T20746] netlink: 'syz.0.4031': attribute type 1 has an invalid length. [ 690.739873][T20746] netlink: 'syz.0.4031': attribute type 2 has an invalid length. [ 690.782170][T20746] openvswitch: netlink: Message has 46 unknown bytes. [ 690.794200][T20746] openvswitch: netlink: Message has 46 unknown bytes. [ 690.814368][T20747] syz_tun: entered allmulticast mode [ 690.834137][T20745] syz_tun: left allmulticast mode [ 690.961557][T20749] netlink: 4 bytes leftover after parsing attributes in process `syz.4.4032'. [ 691.446773][T20770] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 691.575504][T20771] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 692.157807][T20785] tipc: Enabling of bearer rejected, already enabled [ 692.370039][T16547] IPVS: starting estimator thread 0... [ 692.461887][T20794] IPVS: using max 29 ests per chain, 69600 per kthread [ 693.648687][T20830] wlan0 speed is unknown, defaulting to 1000 [ 693.874674][T20833] wlan0 speed is unknown, defaulting to 1000 [ 694.187318][T20837] wlan0 speed is unknown, defaulting to 1000 [ 694.365523][T20838] wlan0 speed is unknown, defaulting to 1000 [ 694.412669][T20845] batman_adv: batadv0: Adding interface: wlan0 [ 694.412697][T20845] batman_adv: batadv0: Interface activated: wlan0 [ 695.517278][T20863] ovs-system: entered promiscuous mode [ 695.593740][T20861] wlan0 speed is unknown, defaulting to 1000 [ 695.596689][T20863] ovs-system: left promiscuous mode [ 696.281645][T20876] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 696.383372][T20874] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 696.465817][T20874] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 697.036912][T20893] netlink: 'syz.2.4081': attribute type 11 has an invalid length. [ 697.037682][T20893] netlink: 'syz.2.4081': attribute type 11 has an invalid length. [ 697.060933][T20893] netlink: 8 bytes leftover after parsing attributes in process `syz.2.4081'. [ 697.061273][T20893] netlink: 8 bytes leftover after parsing attributes in process `syz.2.4081'. [ 697.061593][T20893] netlink: 'syz.2.4081': attribute type 1 has an invalid length. [ 697.061611][T20893] netlink: 'syz.2.4081': attribute type 3 has an invalid length. [ 697.070371][T20893] netlink: 'syz.2.4081': attribute type 1 has an invalid length. [ 697.070397][T20893] netlink: 'syz.2.4081': attribute type 3 has an invalid length. [ 697.134138][T20895] netlink: 'syz.2.4081': attribute type 3 has an invalid length. [ 697.135613][T20893] netlink: 'syz.2.4081': attribute type 3 has an invalid length. [ 697.136692][T20893] netlink: 'syz.2.4081': attribute type 1 has an invalid length. [ 697.157007][T20893] netlink: 'syz.2.4081': attribute type 1 has an invalid length. [ 697.171000][T20893] netlink: 'syz.2.4081': attribute type 1 has an invalid length. [ 697.171063][T20893] netlink: 'syz.2.4081': attribute type 3 has an invalid length. [ 697.190984][T20892] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 698.213267][T20908] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 698.294328][T20909] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 698.349591][T20908] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 698.416783][T20908] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 698.760069][T20912] digital: digital_start_poll: A target is already active [ 699.512754][T20918] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 699.626907][T20921] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 699.709618][T20921] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 699.780691][T20927] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 699.815391][T20921] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 699.842278][T20927] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 699.895322][T20927] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 699.977918][T20929] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 700.051573][T20935] netlink: 8 bytes leftover after parsing attributes in process `syz.4.4096'. [ 702.146580][T20989] netlink: 8 bytes leftover after parsing attributes in process `syz.4.4114'. [ 702.759948][T21011] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 702.759984][T21011] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 704.255598][T20967] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 704.586997][T21022] netlink: 76 bytes leftover after parsing attributes in process `syz.1.4123'. [ 705.120264][T21037] bridge0: port 2(bridge_slave_1) entered blocking state [ 705.120562][T21037] bridge0: port 2(bridge_slave_1) entered forwarding state [ 705.121220][T21037] bridge0: port 1(bridge_slave_0) entered blocking state [ 705.121450][T21037] bridge0: port 1(bridge_slave_0) entered forwarding state [ 705.208673][T21040] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 705.797141][T21055] ip_tables: iptables: counters copy to user failed while replacing table [ 706.341277][ C1] ip6_tunnel: ip6tnl1 xmit: Local address not yet configured! [ 706.343802][ C1] ip6_tunnel: ip6gre1 xmit: Local address not yet configured! [ 706.466668][T21075] validate_nla: 2 callbacks suppressed [ 706.466691][T21075] netlink: 'syz.2.4145': attribute type 1 has an invalid length. [ 706.467488][T21075] netlink: 'syz.2.4145': attribute type 1 has an invalid length. [ 706.567142][ T52] Bluetooth: hci1: link tx timeout [ 706.572494][ T52] Bluetooth: hci1: killing stalled connection 11:aa:aa:aa:aa:aa [ 706.617920][T21080] bridge_slave_0: left allmulticast mode [ 706.617954][T21080] bridge_slave_0: left promiscuous mode [ 706.618204][T21080] bridge0: port 1(bridge_slave_0) entered disabled state [ 706.950224][T21092] bridge0: port 1(batadv0) entered blocking state [ 706.950350][T21092] bridge0: port 1(batadv0) entered disabled state [ 706.966495][T21092] batadv0: entered allmulticast mode [ 706.999322][T21092] batadv0: entered promiscuous mode [ 707.000280][T21092] bridge0: port 1(batadv0) entered blocking state [ 707.000431][T21092] bridge0: port 1(batadv0) entered forwarding state [ 707.027684][T21095] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 707.166243][T21099] digital: digital_start_poll: A target is already active [ 707.167688][T21097] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 707.223256][T21095] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 707.270988][T16550] batman_adv: batadv0: IGMP Querier appeared [ 707.271011][T16550] batman_adv: batadv0: No MLD Querier present - multicast optimizations disabled [ 707.276903][T21095] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 708.203382][T21118] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 708.273007][T21122] wlan0 speed is unknown, defaulting to 1000 [ 708.313176][T21118] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 708.414175][T21131] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 708.542414][T21135] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 708.580765][ T5629] Bluetooth: hci1: command 0x0406 tx timeout [ 708.821262][ T30] batman_adv: batadv0: MLD Querier appeared [ 709.234915][T21147] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 709.234946][T21147] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 709.275069][T21147] bridge0: port 1(batadv0) entered disabled state [ 709.293619][T21147] batadv0 (unregistering): left allmulticast mode [ 709.293651][T21147] batadv0 (unregistering): left promiscuous mode [ 709.293736][T21147] bridge0: port 1(batadv0) entered disabled state [ 709.516893][T21154] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 709.870709][T21157] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 709.903271][T21158] netlink: 8 bytes leftover after parsing attributes in process `syz.2.4164'. [ 709.952800][T21162] netlink: 20 bytes leftover after parsing attributes in process `syz.0.4167'. [ 710.136779][T21166] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 710.215786][T21166] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 710.280027][T21170] netlink: 16 bytes leftover after parsing attributes in process `syz.3.4170'. [ 710.332177][T21171] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 711.175687][T21194] tipc: Started in network mode [ 711.175749][T21194] tipc: Node identity 1, cluster identity 4711 [ 711.175784][T21194] tipc: Node number set to 1 [ 711.217502][T21193] wlan0 speed is unknown, defaulting to 1000 [ 711.446356][T21194] wlan0 speed is unknown, defaulting to 1000 [ 711.763202][T21209] syz_tun: left promiscuous mode [ 711.763826][T21209] bridge0: port 3(syz_tun) entered disabled state [ 711.788115][T21209] bridge_slave_1: left allmulticast mode [ 711.788147][T21209] bridge_slave_1: left promiscuous mode [ 711.788400][T21209] bridge0: port 2(bridge_slave_1) entered disabled state [ 711.850193][T21212] ip_tables: iptables: counters copy to user failed while replacing table [ 711.886533][T21212] ip_tables: iptables: counters copy to user failed while replacing table [ 712.036646][T21211] 8021q: adding VLAN 0 to HW filter on device team0 [ 712.285161][T21217] netlink: 4 bytes leftover after parsing attributes in process `syz.3.4189'. [ 712.285218][T21217] netlink: 4 bytes leftover after parsing attributes in process `syz.3.4189'. [ 713.033688][T16550] netdevsim netdevsim0 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0 [ 713.033868][T16563] netdevsim netdevsim0 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0 [ 713.033915][T16563] netdevsim netdevsim0 netdevsim0: set [0, 0] type 1 family 0 port 8472 - 0 [ 713.033956][T16563] netdevsim netdevsim0 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0 [ 713.100088][T21225] gre2: entered promiscuous mode [ 714.633797][T21257] netlink: 12 bytes leftover after parsing attributes in process `syz.0.4202'. [ 716.601021][ C0] ip6_tunnel: ip6gretap2 xmit: Local address not yet configured! [ 719.315989][T21257] workqueue: Failed to create a rescuer kthread for wq "bond2": -EINTR [ 719.872770][T21274] xt_hashlimit: size too large, truncated to 1048576 [ 720.398520][T21291] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 720.754749][T21298] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 721.949954][T21332] netlink: 48 bytes leftover after parsing attributes in process `syz.0.4229'. [ 722.460248][T21350] netlink: 12 bytes leftover after parsing attributes in process `syz.0.4238'. [ 725.253971][T21432] netlink: 72 bytes leftover after parsing attributes in process `syz.1.4273'. [ 725.257464][T21432] netlink: 72 bytes leftover after parsing attributes in process `syz.1.4273'. [ 726.223433][T21462] netlink: 'syz.0.4284': attribute type 2 has an invalid length. [ 726.223471][T21462] netlink: 8 bytes leftover after parsing attributes in process `syz.0.4284'. [ 727.818917][T16547] bond0: (slave bond_slave_0): interface is now down [ 727.818945][T16547] bond0: (slave bond_slave_1): interface is now down [ 727.843602][T16547] bond0: (slave bond_slave_0): interface is now down [ 727.843630][T16547] bond0: (slave bond_slave_1): interface is now down [ 727.878431][T16547] bond0: (slave bond_slave_0): interface is now down [ 727.878493][T16547] bond0: (slave bond_slave_1): interface is now down [ 727.917795][T16547] bond0: now running without any active interface! [ 734.010324][T21538] netlink: 48 bytes leftover after parsing attributes in process `syz.3.4317'. [ 734.353313][T21560] digital: digital_start_poll: A target is already active [ 734.876498][T21580] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 734.947456][T21580] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 735.024592][T21580] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 735.580545][ C1] llcp: nfc_llcp_symm_timer: SYMM timeout [ 737.302046][ T52] Bluetooth: hci0: Opcode 0x0c03 failed: -110 [ 738.078315][T21581] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 741.559214][T21745] digital: digital_start_poll: A target is already active [ 742.901036][ T52] Bluetooth: hci0: Opcode 0x0c03 failed: -110 [ 743.195571][T21789] digital: digital_start_poll: A target is already active [ 744.982359][ T52] Bluetooth: hci0: Opcode 0x0c03 failed: -110 [ 745.457449][T21843] tipc: Enabling of bearer rejected, already enabled [ 746.154035][T21872] atomic_op ffff8880408bf9e0 conn xmit_atomic 0000000000000000 [ 746.170154][T21872] netlink: 4 bytes leftover after parsing attributes in process `syz.3.4453'. [ 747.785680][ T52] Bluetooth: hci0: Opcode 0x0c03 failed: -110 [ 748.152478][T21934] digital: digital_start_poll: A target is already active [ 749.660371][T21973] atomic_op ffff88804d7ac9e0 conn xmit_atomic 0000000000000000 [ 749.971117][T21983] atomic_op ffff88803424d1e0 conn xmit_atomic 0000000000000000 [ 751.202890][T22011] syzkaller0: entered promiscuous mode [ 751.202919][T22011] syzkaller0: entered allmulticast mode [ 751.428160][T22018] tipc: Enabling of bearer rejected, already enabled [ 751.509346][T22025] atomic_op ffff8880419221e0 conn xmit_atomic 0000000000000000 [ 751.586747][T22030] FAULT_INJECTION: forcing a failure. [ 751.586747][T22030] name failslab, interval 1, probability 0, space 0, times 0 [ 751.586785][T22030] CPU: 0 UID: 0 PID: 22030 Comm: syz.1.4513 Not tainted syzkaller #0 PREEMPT(full) [ 751.586812][T22030] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 751.586827][T22030] Call Trace: [ 751.586837][T22030] [ 751.586848][T22030] dump_stack_lvl+0xe8/0x150 [ 751.586891][T22030] should_fail_ex+0x410/0x560 [ 751.586926][T22030] should_failslab+0xa8/0x100 [ 751.586960][T22030] __kvmalloc_node_noprof+0x176/0x820 [ 751.586991][T22030] ? bpf_compute_postorder+0x83/0x970 [ 751.587015][T22030] ? bpf_compute_postorder+0x83/0x970 [ 751.587050][T22030] bpf_compute_postorder+0x83/0x970 [ 751.587077][T22030] ? __pfx_check_and_resolve_insns+0x10/0x10 [ 751.587109][T22030] ? add_kfuncs+0x251/0x2e0 [ 751.587141][T22030] bpf_check+0x24d6/0x2e10 [ 751.587180][T22030] ? ktime_get_with_offset+0x93/0x2d0 [ 751.587211][T22030] ? __pfx_bpf_check+0x10/0x10 [ 751.587250][T22030] ? bpf_obj_name_cpy+0x194/0x1e0 [ 751.587290][T22030] bpf_prog_load+0x14d6/0x1c20 [ 751.587332][T22030] ? __pfx_bpf_prog_load+0x10/0x10 [ 751.587390][T22030] __sys_bpf+0xd0d/0xd90 [ 751.587426][T22030] ? __pfx___sys_bpf+0x10/0x10 [ 751.587467][T22030] ? __fget_files+0x2a/0x420 [ 751.587521][T22030] ? ksys_write+0x242/0x270 [ 751.587560][T22030] ? __pfx_ksys_write+0x10/0x10 [ 751.587601][T22030] __x64_sys_bpf+0xba/0xd0 [ 751.587630][T22030] do_syscall_64+0x166/0x520 [ 751.587661][T22030] ? trace_irq_disable+0x3b/0x140 [ 751.587685][T22030] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 751.587711][T22030] ? clear_bhb_loop+0x70/0xc0 [ 751.587740][T22030] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 751.587764][T22030] RIP: 0033:0x7f160399e159 [ 751.587786][T22030] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 751.587807][T22030] RSP: 002b:00007f1604838028 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 751.587835][T22030] RAX: ffffffffffffffda RBX: 00007f1603c25fa0 RCX: 00007f160399e159 [ 751.587853][T22030] RDX: 0000000000000094 RSI: 0000200000000b40 RDI: 0000000000000005 [ 751.587869][T22030] RBP: 00007f1604838090 R08: 0000000000000000 R09: 0000000000000000 [ 751.587884][T22030] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 751.587898][T22030] R13: 00007f1603c26038 R14: 00007f1603c25fa0 R15: 00007ffea9327c88 [ 751.587936][T22030] [ 752.838369][T22059] tipc: New replicast peer: 0000:0000:0000:0000:0000:0000:0000:0001 [ 752.838955][T22059] tipc: Enabled bearer , priority 10 [ 753.899290][T22098] netlink: 8 bytes leftover after parsing attributes in process `syz.1.4532'. [ 753.935449][T22098] ip6gre1: entered promiscuous mode [ 753.935476][T22098] ip6gre1: entered allmulticast mode [ 753.980836][T16547] ip6_tunnel: ip6gre1 xmit: Local address not yet configured! [ 753.981124][T16547] ip6_tunnel: ip6gre1 xmit: Local address not yet configured! [ 754.007543][ T10] ip6_tunnel: ip6gre1 xmit: Local address not yet configured! [ 754.018054][T22094] netlink: 8 bytes leftover after parsing attributes in process `syz.1.4532'. [ 754.158825][T22102] bond0: option packets_per_slave: invalid value (868050663) [ 754.158891][T22102] bond0: option packets_per_slave: allowed values 0 - 65535 [ 754.330787][ T10] ip6_tunnel: ip6gre1 xmit: Local address not yet configured! [ 754.498197][T22110] xt_CT: You must specify a L4 protocol and not use inversions on it [ 754.600887][ T1561] ip6_tunnel: ip6gre1 xmit: Local address not yet configured! [ 754.635572][T22118] digital: digital_start_poll: A target is already active [ 754.811087][T22120] tipc: Enabling of bearer rejected, already enabled [ 754.834004][T22125] FAULT_INJECTION: forcing a failure. [ 754.834004][T22125] name failslab, interval 1, probability 0, space 0, times 0 [ 754.834044][T22125] CPU: 0 UID: 0 PID: 22125 Comm: syz.3.4543 Not tainted syzkaller #0 PREEMPT(full) [ 754.834070][T22125] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 754.834085][T22125] Call Trace: [ 754.834095][T22125] [ 754.834105][T22125] dump_stack_lvl+0xe8/0x150 [ 754.834146][T22125] should_fail_ex+0x410/0x560 [ 754.834183][T22125] should_failslab+0xa8/0x100 [ 754.834216][T22125] __kvmalloc_node_noprof+0x176/0x820 [ 754.834246][T22125] ? __kvmalloc_node_noprof+0x345/0x820 [ 754.834272][T22125] ? bpf_compute_postorder+0xda/0x970 [ 754.834295][T22125] ? bpf_compute_postorder+0xda/0x970 [ 754.834326][T22125] bpf_compute_postorder+0xda/0x970 [ 754.834352][T22125] ? __pfx_check_and_resolve_insns+0x10/0x10 [ 754.834385][T22125] ? add_kfuncs+0x251/0x2e0 [ 754.834417][T22125] bpf_check+0x24d6/0x2e10 [ 754.834457][T22125] ? ktime_get_with_offset+0x93/0x2d0 [ 754.834488][T22125] ? __pfx_bpf_check+0x10/0x10 [ 754.834518][T22125] ? bpf_obj_name_cpy+0x194/0x1e0 [ 754.834557][T22125] bpf_prog_load+0x14d6/0x1c20 [ 754.834607][T22125] ? __pfx_bpf_prog_load+0x10/0x10 [ 754.834664][T22125] __sys_bpf+0xd0d/0xd90 [ 754.834702][T22125] ? __pfx___sys_bpf+0x10/0x10 [ 754.834742][T22125] ? __fget_files+0x2a/0x420 [ 754.834796][T22125] ? ksys_write+0x242/0x270 [ 754.834835][T22125] ? __pfx_ksys_write+0x10/0x10 [ 754.834877][T22125] __x64_sys_bpf+0xba/0xd0 [ 754.834904][T22125] do_syscall_64+0x166/0x520 [ 754.834933][T22125] ? trace_irq_disable+0x3b/0x140 [ 754.834957][T22125] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 754.834981][T22125] ? clear_bhb_loop+0x70/0xc0 [ 754.835011][T22125] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 754.835035][T22125] RIP: 0033:0x7f0c01d9e159 [ 754.835057][T22125] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 754.835077][T22125] RSP: 002b:00007f0c02d29028 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 754.835103][T22125] RAX: ffffffffffffffda RBX: 00007f0c02025fa0 RCX: 00007f0c01d9e159 [ 754.835120][T22125] RDX: 0000000000000094 RSI: 0000200000000b40 RDI: 0000000000000005 [ 754.835136][T22125] RBP: 00007f0c02d29090 R08: 0000000000000000 R09: 0000000000000000 [ 754.835151][T22125] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 754.835165][T22125] R13: 00007f0c02026038 R14: 00007f0c02025fa0 R15: 00007fffe011a1e8 [ 754.835203][T22125] [ 755.540616][T22137] ICMPv6: RA: ndisc_router_discovery failed to add default route [ 755.540796][T22137] ICMPv6: RA: ndisc_router_discovery failed to add default route [ 755.540960][T22137] ICMPv6: RA: ndisc_router_discovery failed to add default route [ 755.541121][T22137] ICMPv6: RA: ndisc_router_discovery failed to add default route [ 755.541286][T22137] ICMPv6: RA: ndisc_router_discovery failed to add default route [ 755.541447][T22137] ICMPv6: RA: ndisc_router_discovery failed to add default route [ 755.541615][T22137] ICMPv6: RA: ndisc_router_discovery failed to add default route [ 755.541778][T22137] ICMPv6: RA: ndisc_router_discovery failed to add default route [ 755.541939][T22137] ICMPv6: RA: ndisc_router_discovery failed to add default route [ 755.542103][T22137] ICMPv6: RA: ndisc_router_discovery failed to add default route [ 755.632408][ T52] Bluetooth: hci0: Opcode 0x0c03 failed: -110 [ 755.659390][T22145] FAULT_INJECTION: forcing a failure. [ 755.659390][T22145] name failslab, interval 1, probability 0, space 0, times 0 [ 755.659450][T22145] CPU: 1 UID: 0 PID: 22145 Comm: syz.4.4550 Not tainted syzkaller #0 PREEMPT(full) [ 755.659480][T22145] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 755.659496][T22145] Call Trace: [ 755.659506][T22145] [ 755.659516][T22145] dump_stack_lvl+0xe8/0x150 [ 755.659557][T22145] should_fail_ex+0x410/0x560 [ 755.659589][T22145] should_failslab+0xa8/0x100 [ 755.659619][T22145] ? sctp_get_port_local+0x6bd/0x1700 [ 755.659756][T22145] kmem_cache_alloc_noprof+0xa1/0x600 [ 755.659791][T22145] ? __pfx_do_raw_spin_lock+0x10/0x10 [ 755.659828][T22145] ? sctp_get_port_local+0x6bd/0x1700 [ 755.659864][T22145] sctp_get_port_local+0x6bd/0x1700 [ 755.659891][T22145] ? lock_acquire+0x115/0x350 [ 755.659929][T22145] ? __pfx_sctp_get_port_local+0x10/0x10 [ 755.659959][T22145] ? sctp_bind_addr_match+0x30/0x2b0 [ 755.660033][T22145] ? sctp_bind_addr_match+0x28b/0x2b0 [ 755.660072][T22145] sctp_do_bind+0x4d9/0x9a0 [ 755.660111][T22145] sctp_connect_new_asoc+0x270/0x6b0 [ 755.660140][T22145] ? __pfx_sctp_connect_new_asoc+0x10/0x10 [ 755.660176][T22145] ? __local_bh_enable_ip+0xd6/0x140 [ 755.660214][T22145] ? bpf_lsm_sctp_bind_connect+0x9/0x20 [ 755.660258][T22145] ? security_sctp_bind_connect+0x7e/0x2c0 [ 755.660325][T22145] sctp_sendmsg+0x159b/0x2d00 [ 755.660365][T22145] ? kstrtouint+0x6e/0xe0 [ 755.660403][T22145] ? __pfx_sctp_sendmsg+0x10/0x10 [ 755.660431][T22145] ? irqentry_exit+0x218/0x910 [ 755.660457][T22145] ? lockdep_hardirqs_on+0x7b/0x110 [ 755.660483][T22145] ? irqentry_exit+0x218/0x910 [ 755.660506][T22145] ? trace_irq_disable+0x3b/0x140 [ 755.660547][T22145] ? aa_sock_msg_perm+0xf5/0x210 [ 755.660575][T22145] ? sock_rps_record_flow+0x19/0x350 [ 755.660646][T22145] ? inet_sendmsg+0x298/0x320 [ 755.660672][T22145] ? __pfx_inet_sendmsg+0x10/0x10 [ 755.660693][T22145] sock_sendmsg_nosec+0x10e/0x180 [ 755.660721][T22145] __sys_sendto+0x408/0x5a0 [ 755.660748][T22145] ? ksys_write+0x1e6/0x270 [ 755.660788][T22145] ? __pfx___sys_sendto+0x10/0x10 [ 755.660814][T22145] ? __mutex_unlock_slowpath+0x731/0x900 [ 755.660875][T22145] ? __pfx_ksys_write+0x10/0x10 [ 755.660960][T22145] __x64_sys_sendto+0xde/0x100 [ 755.661002][T22145] do_syscall_64+0x166/0x520 [ 755.661031][T22145] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 755.661056][T22145] ? clear_bhb_loop+0x70/0xc0 [ 755.661085][T22145] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 755.661108][T22145] RIP: 0033:0x7fede919e159 [ 755.661131][T22145] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 755.661151][T22145] RSP: 002b:00007fede73f6028 EFLAGS: 00000246 ORIG_RAX: 000000000000002c [ 755.661176][T22145] RAX: ffffffffffffffda RBX: 00007fede9425fa0 RCX: 00007fede919e159 [ 755.661195][T22145] RDX: 0000000000034000 RSI: 0000200000847fff RDI: 0000000000000003 [ 755.661210][T22145] RBP: 00007fede73f6090 R08: 000020000005ffe4 R09: 000000000000001c [ 755.661226][T22145] R10: 00000000000000e0 R11: 0000000000000246 R12: 0000000000000001 [ 755.661241][T22145] R13: 00007fede9426038 R14: 00007fede9425fa0 R15: 00007fffc6915c08 [ 755.661280][T22145] [ 757.542316][ C1] ip6_tunnel: L xmit: Local address not yet configured! [ 757.860764][ C0] ip6_tunnel: ip6gre1 xmit: Local address not yet configured! [ 758.045989][T22206] xt_hashlimit: size too large, truncated to 1048576 [ 758.189514][T22207] atomic_op ffff88802938f1e0 conn xmit_atomic 0000000000000000 [ 758.200922][T22207] netlink: 4 bytes leftover after parsing attributes in process `syz.4.4565'. [ 759.354465][T22242] netlink: 'syz.3.4579': attribute type 1 has an invalid length. [ 759.736634][T22250] tipc: Enabling of bearer rejected, already enabled [ 759.785422][T22253] geneve2: entered allmulticast mode [ 759.879377][T22260] netlink: 'syz.0.4582': attribute type 17 has an invalid length. [ 760.170785][T22241] Bluetooth: hci0: Opcode 0x0c03 failed: -4 [ 761.427772][T22300] FAULT_INJECTION: forcing a failure. [ 761.427772][T22300] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 761.427810][T22300] CPU: 0 UID: 0 PID: 22300 Comm: syz.2.4598 Not tainted syzkaller #0 PREEMPT(full) [ 761.427883][T22300] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 761.427898][T22300] Call Trace: [ 761.427908][T22300] [ 761.427919][T22300] dump_stack_lvl+0xe8/0x150 [ 761.427961][T22300] should_fail_ex+0x410/0x560 [ 761.427994][T22300] _copy_from_iter+0x1d3/0x1660 [ 761.428023][T22300] ? __alloc_skb+0x27a/0x7a0 [ 761.428054][T22300] ? __alloc_skb+0x27a/0x7a0 [ 761.428084][T22300] ? __alloc_skb+0x27a/0x7a0 [ 761.428112][T22300] ? __pfx__copy_from_iter+0x10/0x10 [ 761.428137][T22300] ? kmem_cache_alloc_node_noprof+0x1f9/0x610 [ 761.428174][T22300] ? __alloc_skb+0x27a/0x7a0 [ 761.428199][T22300] ? __alloc_skb+0x27a/0x7a0 [ 761.428233][T22300] ? netlink_sendmsg+0x650/0xb40 [ 761.428278][T22300] ? skb_put+0x112/0x210 [ 761.428310][T22300] netlink_sendmsg+0x6c0/0xb40 [ 761.428360][T22300] ? __pfx_netlink_sendmsg+0x10/0x10 [ 761.428406][T22300] ? apparmor_socket_sendmsg+0x98/0x360 [ 761.428436][T22300] ? __pfx_netlink_sendmsg+0x10/0x10 [ 761.428471][T22300] sock_sendmsg_nosec+0x13a/0x180 [ 761.428499][T22300] ____sys_sendmsg+0x54e/0x850 [ 761.428537][T22300] ? __pfx_____sys_sendmsg+0x10/0x10 [ 761.428580][T22300] ? import_iovec+0x73/0xa0 [ 761.428614][T22300] ___sys_sendmsg+0x2a5/0x360 [ 761.428645][T22300] ? __lock_acquire+0x747/0x2de0 [ 761.428674][T22300] ? __pfx____sys_sendmsg+0x10/0x10 [ 761.428746][T22300] ? __fget_files+0x2a/0x420 [ 761.428779][T22300] ? __fget_files+0x3a2/0x420 [ 761.428824][T22300] __x64_sys_sendmsg+0x1b1/0x290 [ 761.428859][T22300] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 761.428916][T22300] do_syscall_64+0x166/0x520 [ 761.428944][T22300] ? trace_irq_disable+0x3b/0x140 [ 761.428967][T22300] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 761.428991][T22300] ? clear_bhb_loop+0x70/0xc0 [ 761.429040][T22300] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 761.429064][T22300] RIP: 0033:0x7fa5cb79e159 [ 761.429087][T22300] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 761.429107][T22300] RSP: 002b:00007fa5cc687028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 761.429133][T22300] RAX: ffffffffffffffda RBX: 00007fa5cba25fa0 RCX: 00007fa5cb79e159 [ 761.429151][T22300] RDX: 0000000000044830 RSI: 0000200000000180 RDI: 0000000000000003 [ 761.429167][T22300] RBP: 00007fa5cc687090 R08: 0000000000000000 R09: 0000000000000000 [ 761.429182][T22300] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 761.429197][T22300] R13: 00007fa5cba26038 R14: 00007fa5cba25fa0 R15: 00007ffe1c47c9d8 [ 761.429235][T22300] [ 763.158205][T22334] atomic_op ffff8880476461e0 conn xmit_atomic 0000000000000000 [ 763.158636][T22334] netlink: 4 bytes leftover after parsing attributes in process `syz.2.4609'. [ 763.862455][ T52] Bluetooth: hci0: Opcode 0x0c03 failed: -110 [ 765.506753][T22403] FAULT_INJECTION: forcing a failure. [ 765.506753][T22403] name failslab, interval 1, probability 0, space 0, times 0 [ 765.506826][T22403] CPU: 1 UID: 0 PID: 22403 Comm: syz.0.4634 Not tainted syzkaller #0 PREEMPT(full) [ 765.506855][T22403] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 765.506870][T22403] Call Trace: [ 765.506880][T22403] [ 765.506890][T22403] dump_stack_lvl+0xe8/0x150 [ 765.506928][T22403] should_fail_ex+0x410/0x560 [ 765.506970][T22403] should_failslab+0xa8/0x100 [ 765.507002][T22403] __kmalloc_noprof+0xfe/0x720 [ 765.507026][T22403] ? bpf_test_init+0x9f/0x150 [ 765.507150][T22403] ? bpf_test_init+0x9f/0x150 [ 765.507191][T22403] bpf_test_init+0x9f/0x150 [ 765.507229][T22403] bpf_prog_test_run_xdp+0x4cc/0x11d0 [ 765.507283][T22403] ? __pfx_bpf_prog_test_run_xdp+0x10/0x10 [ 765.507326][T22403] ? __fget_files+0x2a/0x420 [ 765.507363][T22403] ? __pfx_bpf_prog_test_run_xdp+0x10/0x10 [ 765.507399][T22403] bpf_prog_test_run+0x2c5/0x340 [ 765.507434][T22403] __sys_bpf+0xa22/0xd90 [ 765.507470][T22403] ? __pfx___sys_bpf+0x10/0x10 [ 765.507497][T22403] ? taprio_dequeue+0x250/0x540 [ 765.507599][T22403] ? sched_clock_cpu+0x74/0x440 [ 765.507647][T22403] ? __irq_exit_rcu+0xcb/0x220 [ 765.507683][T22403] ? handle_softirqs+0x720/0x860 [ 765.507718][T22403] __x64_sys_bpf+0xba/0xd0 [ 765.507747][T22403] do_syscall_64+0x166/0x520 [ 765.507775][T22403] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 765.507800][T22403] ? clear_bhb_loop+0x70/0xc0 [ 765.507829][T22403] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 765.507852][T22403] RIP: 0033:0x7f6d5039e159 [ 765.507874][T22403] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 765.507894][T22403] RSP: 002b:00007f6d51352028 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 765.507920][T22403] RAX: ffffffffffffffda RBX: 00007f6d50625fa0 RCX: 00007f6d5039e159 [ 765.507937][T22403] RDX: 0000000000000048 RSI: 0000200000000600 RDI: 000000000000000a [ 765.507970][T22403] RBP: 00007f6d51352090 R08: 0000000000000000 R09: 0000000000000000 [ 765.507985][T22403] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 765.508000][T22403] R13: 00007f6d50626038 R14: 00007f6d50625fa0 R15: 00007ffca5668538 [ 765.508038][T22403] [ 765.860748][ C0] ip6_tunnel: ip6gre1 xmit: Local address not yet configured! [ 766.256822][T22417] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 766.256845][T22417] IPv6: NLM_F_CREATE should be set when creating new route [ 766.374158][T22420] net_ratelimit: 47 callbacks suppressed [ 766.374216][T22420] openvswitch: netlink: IP tunnel dst address not specified [ 766.469089][T22420] netlink: 'syz.1.4640': attribute type 27 has an invalid length. [ 767.142634][T16548] netdevsim netdevsim1 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 767.145762][T16548] netdevsim netdevsim1 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 767.146468][T16548] netdevsim netdevsim1 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 767.146601][T16548] netdevsim netdevsim1 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 767.301409][ T52] Bluetooth: hci0: Opcode 0x0c03 failed: -110 [ 767.485278][T22447] netlink: 68 bytes leftover after parsing attributes in process `syz.4.4651'. [ 768.784765][T22483] syzkaller0: entered promiscuous mode [ 768.784792][T22483] syzkaller0: entered allmulticast mode [ 769.750330][T22513] bond0: option packets_per_slave: invalid value (868050663) [ 769.750364][T22513] bond0: option packets_per_slave: allowed values 0 - 65535 [ 769.941968][ T52] Bluetooth: hci0: Opcode 0x0c03 failed: -110 [ 770.212097][T22518] netlink: 8 bytes leftover after parsing attributes in process `syz.4.4675'. [ 770.731278][T22529] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 770.996864][T22534] netlink: 24 bytes leftover after parsing attributes in process `syz.1.4681'. [ 771.968969][T22558] FAULT_INJECTION: forcing a failure. [ 771.968969][T22558] name failslab, interval 1, probability 0, space 0, times 0 [ 771.969007][T22558] CPU: 0 UID: 0 PID: 22558 Comm: syz.0.4691 Not tainted syzkaller #0 PREEMPT(full) [ 771.969033][T22558] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 771.969048][T22558] Call Trace: [ 771.969058][T22558] [ 771.969070][T22558] dump_stack_lvl+0xe8/0x150 [ 771.969112][T22558] should_fail_ex+0x410/0x560 [ 771.969145][T22558] should_failslab+0xa8/0x100 [ 771.969179][T22558] __kmalloc_noprof+0xfe/0x720 [ 771.969203][T22558] ? iovec_from_user+0x87/0x250 [ 771.969242][T22558] ? iovec_from_user+0x87/0x250 [ 771.969282][T22558] iovec_from_user+0x87/0x250 [ 771.969316][T22558] __import_iovec+0x15e/0x7e0 [ 771.969358][T22558] import_iovec+0x73/0xa0 [ 771.969392][T22558] ___sys_recvmsg+0x4c9/0x5a0 [ 771.969441][T22558] ? __pfx____sys_recvmsg+0x10/0x10 [ 771.969482][T22558] ? lock_acquire+0x115/0x350 [ 771.969524][T22558] ? __fget_files+0x3a2/0x420 [ 771.969575][T22558] do_recvmmsg+0x31a/0x7f0 [ 771.969619][T22558] ? __pfx_do_recvmmsg+0x10/0x10 [ 771.969666][T22558] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 771.969699][T22558] ? __fget_files+0x3a2/0x420 [ 771.969744][T22558] __x64_sys_recvmmsg+0x198/0x250 [ 771.969781][T22558] ? __pfx___x64_sys_recvmmsg+0x10/0x10 [ 771.969829][T22558] do_syscall_64+0x166/0x520 [ 771.969857][T22558] ? trace_irq_disable+0x3b/0x140 [ 771.969882][T22558] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 771.969906][T22558] ? clear_bhb_loop+0x70/0xc0 [ 771.969935][T22558] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 771.969959][T22558] RIP: 0033:0x7f6d5039e159 [ 771.969982][T22558] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 771.970002][T22558] RSP: 002b:00007f6d51352028 EFLAGS: 00000246 ORIG_RAX: 000000000000012b [ 771.970028][T22558] RAX: ffffffffffffffda RBX: 00007f6d50625fa0 RCX: 00007f6d5039e159 [ 771.970046][T22558] RDX: 0000000000000001 RSI: 0000200000000900 RDI: 0000000000000003 [ 771.970062][T22558] RBP: 00007f6d51352090 R08: 0000000000000000 R09: 0000000000000000 [ 771.970077][T22558] R10: 000000000001822b R11: 0000000000000246 R12: 0000000000000001 [ 771.970092][T22558] R13: 00007f6d50626038 R14: 00007f6d50625fa0 R15: 00007ffca5668538 [ 771.970130][T22558] [ 772.292299][T22560] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 773.012822][T22576] xt_hashlimit: size too large, truncated to 1048576 [ 773.432730][T22598] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 773.542276][ T52] Bluetooth: hci0: Opcode 0x0c03 failed: -110 [ 773.891224][T22604] syzkaller0: entered promiscuous mode [ 773.891297][T22604] syzkaller0: entered allmulticast mode [ 773.962605][T22604] netlink: 20 bytes leftover after parsing attributes in process `syz.2.4708'. [ 773.962666][T22604] nbd: must specify at least one socket [ 774.147944][T22604] netlink: 6 bytes leftover after parsing attributes in process `syz.2.4708'. [ 774.524645][T22610] netlink: 4 bytes leftover after parsing attributes in process `syz.1.4711'. [ 774.858981][T22632] netlink: 4 bytes leftover after parsing attributes in process `syz.4.4718'. [ 775.000188][T22636] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 776.342813][T22632] bond0: (slave bond_slave_0): Releasing backup interface [ 776.837694][T22678] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 777.421077][T22673] bond0: option packets_per_slave: invalid value (868050663) [ 777.421109][T22673] bond0: option packets_per_slave: allowed values 0 - 65535 [ 777.453329][T22678] macsec1: entered promiscuous mode [ 777.453354][T22678] bridge0: entered promiscuous mode [ 777.781540][ T52] Bluetooth: hci0: Opcode 0x0c03 failed: -110 [ 777.843933][T22698] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 780.032908][T22729] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 780.472601][T22736] xt_hashlimit: size too large, truncated to 1048576 [ 781.709612][T22753] bridge1: entered promiscuous mode [ 781.709651][T22753] bridge1: entered allmulticast mode [ 782.233133][T22765] netlink: 8 bytes leftover after parsing attributes in process `syz.4.4753'. [ 782.420969][ T52] Bluetooth: hci0: Opcode 0x0c03 failed: -110 [ 782.508211][T22772] FAULT_INJECTION: forcing a failure. [ 782.508211][T22772] name failslab, interval 1, probability 0, space 0, times 0 [ 782.508249][T22772] CPU: 0 UID: 0 PID: 22772 Comm: syz.2.4755 Not tainted syzkaller #0 PREEMPT(full) [ 782.508275][T22772] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 782.508290][T22772] Call Trace: [ 782.508300][T22772] [ 782.508312][T22772] dump_stack_lvl+0xe8/0x150 [ 782.508354][T22772] should_fail_ex+0x410/0x560 [ 782.508387][T22772] ? __pfx_debugfs_alloc_inode+0x10/0x10 [ 782.508523][T22772] should_failslab+0xa8/0x100 [ 782.508549][T22772] ? __pfx_debugfs_alloc_inode+0x10/0x10 [ 782.508570][T22772] kmem_cache_alloc_lru_noprof+0xa7/0x5f0 [ 782.508610][T22772] ? alloc_inode+0x6a/0x1b0 [ 782.508639][T22772] ? alloc_inode+0x6a/0x1b0 [ 782.508675][T22772] ? __pfx_debugfs_alloc_inode+0x10/0x10 [ 782.508697][T22772] alloc_inode+0x6a/0x1b0 [ 782.508730][T22772] new_inode+0x1f/0x170 [ 782.508767][T22772] __debugfs_create_file+0xb8/0x400 [ 782.508873][T22772] debugfs_create_file_full+0x3f/0x60 [ 782.508914][T22772] ref_tracker_dir_debugfs+0x197/0x360 [ 782.508947][T22772] ? __pfx_ref_tracker_dir_debugfs+0x10/0x10 [ 782.509017][T22772] ? __kvmalloc_node_noprof+0x52f/0x820 [ 782.509047][T22772] ? __kvmalloc_node_noprof+0x345/0x820 [ 782.509078][T22772] ? __raw_spin_lock_init+0x45/0x100 [ 782.509116][T22772] alloc_netdev_mqs+0x275/0x12a0 [ 782.509209][T22772] ? __pfx_snprintf+0x10/0x10 [ 782.509271][T22772] ? __pfx_ipip_tunnel_setup+0x10/0x10 [ 782.509350][T22772] rtnl_create_link+0x321/0xd70 [ 782.509406][T22772] rtnl_newlink_create+0x258/0x7b0 [ 782.509471][T22772] ? __pfx_rtnl_newlink_create+0x10/0x10 [ 782.509509][T22772] ? __pfx___mutex_lock+0x10/0x10 [ 782.509552][T22772] ? ns_capable+0x89/0xe0 [ 782.509590][T22772] rtnl_newlink+0x167a/0x1c30 [ 782.509640][T22772] ? __pfx_rtnl_newlink+0x10/0x10 [ 782.509667][T22772] ? sock_sendmsg_nosec+0x13a/0x180 [ 782.509689][T22772] ? ____sys_sendmsg+0x54e/0x850 [ 782.509719][T22772] ? ___sys_sendmsg+0x2a5/0x360 [ 782.509748][T22772] ? __x64_sys_sendmsg+0x1b1/0x290 [ 782.509777][T22772] ? do_syscall_64+0x166/0x520 [ 782.509805][T22772] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 782.509874][T22772] ? kasan_quarantine_put+0xbb/0x1f0 [ 782.509900][T22772] ? lockdep_hardirqs_on+0x7b/0x110 [ 782.509933][T22772] ? nlmon_xmit+0xb0/0x100 [ 782.510023][T22772] ? kmem_cache_free+0x182/0x650 [ 782.510063][T22772] ? __lock_acquire+0x747/0x2de0 [ 782.510099][T22772] ? __local_bh_enable_ip+0xd6/0x140 [ 782.510132][T22772] ? lockdep_hardirqs_on+0x7b/0x110 [ 782.510159][T22772] ? __dev_queue_xmit+0x29b/0x3820 [ 782.510192][T22772] ? __local_bh_enable_ip+0xd6/0x140 [ 782.510222][T22772] ? __dev_queue_xmit+0x29b/0x3820 [ 782.510288][T22772] ? __pfx_rtnl_newlink+0x10/0x10 [ 782.510317][T22772] rtnetlink_rcv_msg+0x802/0xc00 [ 782.510350][T22772] ? rtnetlink_rcv_msg+0x1c9/0xc00 [ 782.510379][T22772] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 782.510406][T22772] ? ref_tracker_free+0x689/0x830 [ 782.510433][T22772] ? __pfx_ref_tracker_free+0x10/0x10 [ 782.510475][T22772] netlink_rcv_skb+0x226/0x4a0 [ 782.510514][T22772] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 782.510548][T22772] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 782.510600][T22772] ? netlink_deliver_tap+0x2e/0x1b0 [ 782.510637][T22772] ? netlink_deliver_tap+0x2e/0x1b0 [ 782.510681][T22772] netlink_unicast+0x7bd/0x940 [ 782.510729][T22772] netlink_sendmsg+0x813/0xb40 [ 782.510779][T22772] ? __pfx_netlink_sendmsg+0x10/0x10 [ 782.510824][T22772] ? apparmor_socket_sendmsg+0x98/0x360 [ 782.510854][T22772] ? __pfx_netlink_sendmsg+0x10/0x10 [ 782.510890][T22772] sock_sendmsg_nosec+0x13a/0x180 [ 782.510919][T22772] ____sys_sendmsg+0x54e/0x850 [ 782.510960][T22772] ? __pfx_____sys_sendmsg+0x10/0x10 [ 782.511012][T22772] ? import_iovec+0x73/0xa0 [ 782.511048][T22772] ___sys_sendmsg+0x2a5/0x360 [ 782.511080][T22772] ? __lock_acquire+0x747/0x2de0 [ 782.511109][T22772] ? __pfx____sys_sendmsg+0x10/0x10 [ 782.511186][T22772] ? __fget_files+0x2a/0x420 [ 782.511220][T22772] ? __fget_files+0x3a2/0x420 [ 782.511265][T22772] __x64_sys_sendmsg+0x1b1/0x290 [ 782.511300][T22772] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 782.511359][T22772] do_syscall_64+0x166/0x520 [ 782.511387][T22772] ? trace_irq_disable+0x3b/0x140 [ 782.511411][T22772] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 782.511436][T22772] ? clear_bhb_loop+0x70/0xc0 [ 782.511466][T22772] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 782.511490][T22772] RIP: 0033:0x7fa5cb79e159 [ 782.511514][T22772] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 782.511535][T22772] RSP: 002b:00007fa5cc687028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 782.511562][T22772] RAX: ffffffffffffffda RBX: 00007fa5cba25fa0 RCX: 00007fa5cb79e159 [ 782.511579][T22772] RDX: 00000000040008c0 RSI: 0000200000000280 RDI: 0000000000000003 [ 782.511596][T22772] RBP: 00007fa5cc687090 R08: 0000000000000000 R09: 0000000000000000 [ 782.511611][T22772] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 782.511626][T22772] R13: 00007fa5cba26038 R14: 00007fa5cba25fa0 R15: 00007ffe1c47c9d8 [ 782.511666][T22772] [ 782.737027][ C1] sched: DL replenish lagged too much [ 782.978635][T22772] debugfs: out of free dentries, can not create file 'netdev@ffff88807d026700' [ 783.007225][T22773] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 784.184788][T22791] FAULT_INJECTION: forcing a failure. [ 784.184788][T22791] name failslab, interval 1, probability 0, space 0, times 0 [ 784.184827][T22791] CPU: 0 UID: 0 PID: 22791 Comm: syz.0.4763 Not tainted syzkaller #0 PREEMPT(full) [ 784.184854][T22791] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 784.184869][T22791] Call Trace: [ 784.184879][T22791] [ 784.184889][T22791] dump_stack_lvl+0xe8/0x150 [ 784.184931][T22791] should_fail_ex+0x410/0x560 [ 784.184965][T22791] should_failslab+0xa8/0x100 [ 784.184998][T22791] __kvmalloc_node_noprof+0x176/0x820 [ 784.185028][T22791] ? __kvmalloc_node_noprof+0x345/0x820 [ 784.185054][T22791] ? bpf_compute_scc+0xa26/0xb10 [ 784.185077][T22791] ? bpf_compute_scc+0xa26/0xb10 [ 784.185108][T22791] bpf_compute_scc+0xa26/0xb10 [ 784.185152][T22791] bpf_check+0x25c9/0x2e10 [ 784.185191][T22791] ? ktime_get_with_offset+0x93/0x2d0 [ 784.185222][T22791] ? __pfx_bpf_check+0x10/0x10 [ 784.185252][T22791] ? bpf_obj_name_cpy+0x194/0x1e0 [ 784.185294][T22791] bpf_prog_load+0x14d6/0x1c20 [ 784.185336][T22791] ? __pfx_bpf_prog_load+0x10/0x10 [ 784.185401][T22791] __sys_bpf+0xd0d/0xd90 [ 784.185438][T22791] ? __pfx___sys_bpf+0x10/0x10 [ 784.185478][T22791] ? __fget_files+0x2a/0x420 [ 784.185532][T22791] ? ksys_write+0x242/0x270 [ 784.185571][T22791] ? __pfx_ksys_write+0x10/0x10 [ 784.185612][T22791] __x64_sys_bpf+0xba/0xd0 [ 784.185641][T22791] do_syscall_64+0x166/0x520 [ 784.185670][T22791] ? trace_irq_disable+0x3b/0x140 [ 784.185694][T22791] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 784.185718][T22791] ? clear_bhb_loop+0x70/0xc0 [ 784.185747][T22791] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 784.185772][T22791] RIP: 0033:0x7f6d5039e159 [ 784.185795][T22791] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 784.185814][T22791] RSP: 002b:00007f6d51352028 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 784.185841][T22791] RAX: ffffffffffffffda RBX: 00007f6d50625fa0 RCX: 00007f6d5039e159 [ 784.185859][T22791] RDX: 0000000000000094 RSI: 0000200000000b40 RDI: 0000000000000005 [ 784.185875][T22791] RBP: 00007f6d51352090 R08: 0000000000000000 R09: 0000000000000000 [ 784.185890][T22791] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 784.185904][T22791] R13: 00007f6d50626038 R14: 00007f6d50625fa0 R15: 00007ffca5668538 [ 784.185942][T22791] [ 785.096253][T22800] netlink: 100 bytes leftover after parsing attributes in process `syz.4.4767'. [ 785.248131][T22805] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 785.365664][T22809] xt_hashlimit: size too large, truncated to 1048576 [ 786.026690][T22818] netlink: 80 bytes leftover after parsing attributes in process `syz.3.4772'. [ 787.607819][T22843] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 788.779976][T22865] syzkaller0: entered promiscuous mode [ 788.780207][T22865] syzkaller0: entered allmulticast mode [ 790.639200][T22894] IPVS: set_ctl: invalid protocol: 0 172.20.20.170:20000 [ 792.195817][T22925] bridge0: port 2(bridge_slave_1) entered disabled state [ 792.381577][T22927] bridge0: port 2(bridge_slave_1) entered blocking state [ 792.381713][T22927] bridge0: port 2(bridge_slave_1) entered forwarding state [ 792.382437][T22927] bridge0: entered allmulticast mode [ 793.701061][ T52] Bluetooth: hci0: Opcode 0x0c03 failed: -110 [ 794.485058][T16548] bond3: left allmulticast mode [ 794.485094][T16548] bond3: left promiscuous mode [ 794.489072][T16548] bridge0: port 3(bond3) entered disabled state [ 794.615371][T16548] bridge_slave_1: left allmulticast mode [ 794.615404][T16548] bridge_slave_1: left promiscuous mode [ 794.615758][T16548] bridge0: port 2(bridge_slave_1) entered disabled state [ 794.841857][T16548] dvmrp6: left allmulticast mode [ 795.088996][T22955] netlink: 12 bytes leftover after parsing attributes in process `syz.4.4812'. [ 797.728303][T22982] xt_hashlimit: size too large, truncated to 1048576 [ 799.283770][T16548] batman_adv: batadv0: Removing interface: gretap2 [ 799.440144][T16548] bond4 (unregistering): (slave gretap1): Releasing active interface [ 799.834148][T16548] bond1 (unregistering): (slave veth3): Releasing active interface [ 799.882477][T16548] bond1 (unregistering): (slave veth5): Releasing active interface [ 799.902093][T16548] bond1 (unregistering): Released all slaves [ 799.935587][T16548] bond2 (unregistering): (slave batadv0): Removing an active aggregator [ 799.936341][T16548] bond2 (unregistering): (slave batadv0): Releasing backup interface [ 799.962525][T16548] bond2 (unregistering): Released all slaves [ 799.991573][T16548] bond3 (unregistering): Released all slaves [ 800.016059][T16548] bond4 (unregistering): Released all slaves [ 800.054362][T16548] bond0 (unregistering): Released all slaves [ 800.884256][T16548] tipc: Disabling bearer [ 800.884398][T16548] tipc: Disabling bearer [ 800.977535][T16548] tipc: Left network mode [ 802.746552][T23018] nbd0: detected capacity change from 0 to 63 [ 802.881066][T23011] netlink: 24 bytes leftover after parsing attributes in process `syz.4.4830'. [ 820.778176][ T2694] block nbd0: Connection timed out, retrying (1/1 alive) [ 820.780133][ T2694] block nbd0: Connection timed out, retrying (0/1 alive) [ 820.780196][ T2694] block nbd0: Connection timed out, retrying (0/1 alive) [ 820.780244][ T2694] block nbd0: Connection timed out, retrying (0/1 alive) [ 820.829993][ T2694] block nbd0: Dead connection, failed to find a fallback [ 820.830025][ T2694] block nbd0: shutting down sockets [ 820.830151][ T2694] I/O error, dev nbd0, sector 6 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 820.830296][ T2694] Buffer I/O error on dev nbd0, logical block 3, async page read [ 820.830384][ T2694] I/O error, dev nbd0, sector 4 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 821.060942][ T2694] Buffer I/O error on dev nbd0, logical block 2, async page read [ 821.060995][ T2694] I/O error, dev nbd0, sector 2 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 821.061022][ T2694] Buffer I/O error on dev nbd0, logical block 1, async page read [ 821.061047][ T2694] I/O error, dev nbd0, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 821.061073][ T2694] Buffer I/O error on dev nbd0, logical block 0, async page read [ 821.098586][ T2694] I/O error, dev nbd0, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 4 prio class 2 [ 821.098647][ T2694] Buffer I/O error on dev nbd0, logical block 0, async page read [ 821.098689][ T2694] Buffer I/O error on dev nbd0, logical block 1, async page read [ 821.098708][ T2694] Buffer I/O error on dev nbd0, logical block 2, async page read [ 821.098726][ T2694] Buffer I/O error on dev nbd0, logical block 3, async page read [ 821.100293][ T2694] I/O error, dev nbd0, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 4 prio class 2 [ 821.100332][ T2694] Buffer I/O error on dev nbd0, logical block 0, async page read [ 821.100353][ T2694] Buffer I/O error on dev nbd0, logical block 1, async page read [ 821.116528][ T2694] I/O error, dev nbd0, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 4 prio class 2 [ 821.116762][ T2694] I/O error, dev nbd0, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 4 prio class 2 [ 821.117001][ T2694] I/O error, dev nbd0, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 4 prio class 2 [ 821.117221][ T2694] I/O error, dev nbd0, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 4 prio class 2 [ 821.117476][T21555] ldm_validate_partition_table(): Disk read failed. [ 821.118159][T21555] Dev nbd0: unable to read RDB block 0 [ 821.119036][T21555] nbd0: unable to read partition table [ 844.603215][ C1] ip6_tunnel: ip6tnl1 xmit: Local address not yet configured! [ 872.790925][ T5629] Bluetooth: hci1: command 0x0406 tx timeout [ 957.225129][ C1] ip6_tunnel: ip6gre1 xmit: Local address not yet configured! [ 963.668212][ T4985] udevd[4985]: worker [21555] /devices/virtual/block/nbd0 is taking a long time [ 965.960376][ C0] rcu: INFO: rcu_preempt detected stalls on CPUs/tasks: [ 965.967482][ C0] rcu: Tasks blocked on level-0 rcu_node (CPUs 0-1): P23018/1:b..l [ 965.975615][ C0] rcu: (detected by 0, t=10502 jiffies, g=153169, q=644223 ncpus=2) [ 965.983749][ C0] task:syz.1.4831 state:R running task stack:25536 pid:23018 tgid:23013 ppid:17721 task_flags:0x40054c flags:0x00080002 [ 965.997334][ C0] Call Trace: [ 966.000656][ C0] [ 966.003632][ C0] __schedule+0x17db/0x58f0 [ 966.008230][ C0] ? is_bpf_text_address+0x26/0x2b0 [ 966.013489][ C0] ? is_bpf_text_address+0x292/0x2b0 [ 966.018831][ C0] ? is_bpf_text_address+0x26/0x2b0 [ 966.024081][ C0] ? kernel_text_address+0xa5/0xe0 [ 966.029244][ C0] ? __pfx___schedule+0x10/0x10 [ 966.034150][ C0] ? __lock_acquire+0x747/0x2de0 [ 966.039146][ C0] preempt_schedule_irq+0x4b/0x90 [ 966.044219][ C0] irqentry_exit+0x14f/0x910 [ 966.048858][ C0] ? trace_irq_disable+0x3b/0x140 [ 966.053941][ C0] asm_sysvec_apic_timer_interrupt+0x1a/0x20 [ 966.059985][ C0] RIP: 0010:lock_acquire+0x232/0x350 [ 966.065321][ C0] Code: ff ff ff e8 50 e5 42 0a f7 44 24 10 00 02 00 00 0f 84 38 ff ff ff 65 48 8b 05 a2 00 f2 11 48 3b 44 24 50 75 33 fb 48 83 c4 58 <5b> 41 5c 41 5d 41 5e 41 5f 5d e9 bf e9 45 0a cc 48 8d 3d 97 52 da [ 966.084971][ C0] RSP: 0018:ffffc900067ef240 EFLAGS: 00000292 [ 966.091099][ C0] RAX: b29ca7ee7e6ccf00 RBX: 0000000000000000 RCX: 0000000000000046 [ 966.099117][ C0] RDX: 00000000f40e1e5c RSI: ffffffff8e69bb10 RDI: ffffffff8c6da080 [ 966.107137][ C0] RBP: ffff888033de5dc0 R08: ffffffff8241f09e R09: 0000000000000000 [ 966.115153][ C0] R10: 000000000000000f R11: ffffffff81b28ab0 R12: ffffffff8ed5c8e0 [ 966.123177][ C0] R13: 0000000000000002 R14: 0000000000000000 R15: 0000000000000246 [ 966.131203][ C0] ? __pfx_stack_trace_consume_entry+0x10/0x10 [ 966.137429][ C0] ? __update_page_owner_free_handle+0x2e/0x4a0 [ 966.143744][ C0] ? __update_page_owner_free_handle+0x2e/0x4a0 [ 966.150034][ C0] __update_page_owner_free_handle+0x4b/0x4a0 [ 966.156145][ C0] ? __update_page_owner_free_handle+0x2e/0x4a0 [ 966.162478][ C0] ? page_ext_put+0x97/0xc0 [ 966.167062][ C0] __reset_page_owner+0x85/0x1f0 [ 966.172064][ C0] free_unref_folios+0xdc2/0x14e0 [ 966.177185][ C0] ? folios_put_refs+0x991/0xb30 [ 966.182194][ C0] folios_put_refs+0x9e9/0xb30 [ 966.187016][ C0] ? arch_do_signal_or_restart+0xbb/0x860 [ 966.192865][ C0] ? exit_to_user_mode_loop+0x10e/0x770 [ 966.198452][ C0] ? do_syscall_64+0x328/0x520 [ 966.203280][ C0] ? __pfx_folios_put_refs+0x10/0x10 [ 966.208630][ C0] ? free_swap_cache+0x109/0x300 [ 966.213638][ C0] free_pages_and_swap_cache+0x2ba/0x490 [ 966.219355][ C0] ? __pfx_free_pages_and_swap_cache+0x10/0x10 [ 966.225560][ C0] ? free_pgd_range+0x1356/0x13c0 [ 966.230658][ C0] ? __virt_addr_valid+0x137/0x390 [ 966.235850][ C0] tlb_flush_mmu+0x6d3/0xa30 [ 966.240497][ C0] tlb_finish_mmu+0xf4/0x220 [ 966.245135][ C0] exit_mmap+0x4b2/0x9f0 [ 966.249465][ C0] ? __pfx_exit_mmap+0x10/0x10 [ 966.254310][ C0] ? __pfx_exit_aio+0x10/0x10 [ 966.259187][ C0] ? uprobe_clear_state+0x2a4/0x3d0 [ 966.264443][ C0] __mmput+0x118/0x420 [ 966.268560][ C0] exit_mm+0x221/0x2d0 [ 966.272669][ C0] do_exit+0x6cd/0x2360 [ 966.276873][ C0] ? __pfx_do_exit+0x10/0x10 [ 966.281501][ C0] ? do_raw_spin_lock+0x12b/0x2f0 [ 966.286584][ C0] do_group_exit+0x22d/0x2f0 [ 966.291225][ C0] ? _raw_spin_unlock_irq+0x23/0x50 [ 966.296482][ C0] get_signal+0x121b/0x12c0 [ 966.301067][ C0] arch_do_signal_or_restart+0xbb/0x860 [ 966.306679][ C0] ? __pfx_arch_do_signal_or_restart+0x10/0x10 [ 966.312915][ C0] exit_to_user_mode_loop+0x10e/0x770 [ 966.318338][ C0] ? rcu_is_watching+0x16/0xb0 [ 966.323151][ C0] do_syscall_64+0x328/0x520 [ 966.327832][ C0] ? trace_irq_disable+0x3b/0x140 [ 966.332903][ C0] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 966.339026][ C0] ? clear_bhb_loop+0x70/0xc0 [ 966.343753][ C0] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 966.349681][ C0] RIP: 0033:0x7f160399e159 [ 966.354141][ C0] RSP: 002b:00007f16048170e8 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca [ 966.362606][ C0] RAX: fffffffffffffe00 RBX: 00007f1603c26098 RCX: 00007f160399e159 [ 966.370624][ C0] RDX: 0000000000000000 RSI: 0000000000000080 RDI: 00007f1603c26098 [ 966.378636][ C0] RBP: 00007f1603c26090 R08: 0000000000000000 R09: 0000000000000000 [ 966.386646][ C0] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 966.394666][ C0] R13: 00007f1603c26128 R14: 00007ffea9327ba0 R15: 00007ffea9327c88 [ 966.402761][ C0]