last executing test programs: 5m51.545915454s ago: executing program 4 (id=12735): r0 = socket$inet6_sctp(0xa, 0x5, 0x84) close(0x3) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) r2 = socket$inet6_mptcp(0xa, 0x1, 0x106) ioctl$XFS_IOC_FD_TO_HANDLE(r2, 0xc038586a, &(0x7f0000000f40)={r0, &(0x7f0000000180)='@-@/-\\/!-\\&{\x00', 0x101003, &(0x7f0000000380)={@_ha_fsid={[0x7, 0x5]}, {0x3, 0x100, 0x2, 0xffffffffffff1519}}, 0x3, &(0x7f0000000ec0), &(0x7f0000000f00)=0x8}) r4 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000fc0), 0xffffffffffffffff) sendmsg$IPVS_CMD_NEW_SERVICE(r3, &(0x7f0000001080)={&(0x7f0000000f80)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f0000001040)={&(0x7f0000001000)={0x2c, r4, 0x2, 0x70bd25, 0x25dfdbfe, {}, [@IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5, 0x10}, @IPVS_CMD_ATTR_TIMEOUT_UDP={0x8, 0x6, 0xfffffff7}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5, 0x3}]}, 0x2c}, 0x1, 0x0, 0x0, 0x48000}, 0x24040050) sendmmsg$inet6(r3, &(0x7f0000000e00)=[{{&(0x7f00000000c0)={0xa, 0x4e22, 0xe, @empty, 0xcc8}, 0x1c, &(0x7f0000000280)=[{&(0x7f0000000180)}, {&(0x7f00000001c0)="d4774b43f3e871a0ada4a0a9697791680509e682561548979654c831aac933ce26d5acb170e154df4a7774f1e39291421ed55289db8d3bbc8a09303bc878f86a3f4b5d1601d9d6dfe4bea1e794ba966cc63c6a980b3a095dc78a7381f12a3c0c462b821f2f5f259fe05a13cc8a15e1b154da5bf048f803180050cab6d436da6dc700b86381a7b36050bc094a602ab8c8a1beb85de47549feec84a2c51a61c3ec3206b9a0a3df", 0xa6}], 0x2, &(0x7f00000002c0)=[@dontfrag={{0x14, 0x29, 0x3e, 0x4}}, @dstopts_2292={{0x48, 0x29, 0x4, {0xf0, 0x5, '\x00', [@hao={0xc9, 0x10, @ipv4={'\x00', '\xff\xff', @multicast2}}, @hao={0xc9, 0x10, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01'}, @padn={0x1, 0x5, [0x0, 0x0, 0x0, 0x0, 0x0]}, @ra={0x5, 0x2, 0x9}]}}}], 0x60}}, {{&(0x7f0000000340)={0xa, 0x4e24, 0x80000000, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02', 0x10000}, 0x1c, &(0x7f00000008c0)=[{&(0x7f00000010c0)="7196698aab7375fcc4d7f74330f08ce8a762e6a0d08b16e7c034f1fd7bde7c78804f31af37e2453c74a5e927d23106776cd9dfc6fe150f8ec787826bb403fbd8c2261d346d781fb66b567385c72903fd904ba02512e020683a8f64eac50877c59d39e09b8ec0d6f6c751d8002a89149482e8178c463123e0bf91dc78c8f0cfc8d7a4c65945d9df0e917ed5c38aabb5af91fec9eb17a9e270663e48b6d569009f6b900b5222d4bc9b2fabbdb69ff351c606cddf1ffa0f8e1044f29e776d5713a69f7a1e49a6", 0xc5}, {&(0x7f0000000600)="5d5cdff519f43d15844cfe6679d80ca22343e19c8da9258de7d356210674b654d94e0ada10d66181d6e774803b973009bfbea9b9d52758550d651747f508ed15de2e9e56ede7e1018726e32f76be20f9856b5c08a953973806584bc87033877a4b984c86ae0bfb1facfda09f16afe8ba81483db5c4ee6d3c530681f219e7209ef846d65919e74237081d405726fa1e9c8328ed9497a964819935cf46f98a2c635b230004986aa9202e15cb48a098a7594ddc996f977f52453e4c1ce6b21cded451a1e5bbc34064c1ac6a3508771a2b68ea1fba924e93dbf1780af6", 0xdb}, {&(0x7f0000000700)="06f8714015289b940be734252678195e3f54a669b51b7e2967d3b83109eb652692ad40a3183d57c76bdf30b55bcf9e80b355235560f8f669bff3eaba266b2d7a916f24cbf642ed4ab36fee118c1fc3c42c14394f9708c69478269b37ab61b24251d1", 0x62}, {&(0x7f0000000780)="d69b6bc0ae02d502e5d870f4eee2fc42c0b1163b3d7ca260f58ce98e355118b3047610a89540c15e419866c71497816f607b08797ed5062152b5907e0592e2da7b9b2df977154a6e361083298098bb66ee1ddeadb4cd71a7eccb9cf6e3737a6c1d8523920be380d59fd21072ec984c217be215e3296f5fc5032be5d41bfe36046ca19df6be1f1d121afbc2aaa55bd40c99bfbe1826e7c99ea28097d197be5da481bb51916c3d182f08134ccb4187d52bda311259a92114c0b5", 0xb9}, {&(0x7f0000000840)="06a57f69dfa493bde9bbd0bd501c8806513f1c1ce12e27904283f70fa1a97d8f44d4f919eaa3ac1951f2b3a63d1510eaf8ae6d81cbacede91e00f964aef47f5f5cbff70636fc185b7ff47b57a670415395c44c17", 0x54}], 0x5, &(0x7f0000000c80)=[@rthdrdstopts={{0x50, 0x29, 0x37, {0xcf88828aefc74d5, 0x6, '\x00', [@jumbo={0xc2, 0x4, 0x59}, @jumbo={0xc2, 0x4, 0x3}, @calipso={0x7, 0x28, {0x2, 0x8, 0x4, 0x9, [0x10, 0xfffffffffffffffd, 0x9, 0x7]}}]}}}, @rthdrdstopts={{0x88, 0x29, 0x37, {0x10, 0xd, '\x00', [@generic={0x2, 0x63, "a25b7f36dc8a4f664a875deae59a3dc43c9cafa3f48307dc2d92643ffd9807ae371154d5ffdf34dab1a01dabeb957c4fd08315711d5c98632f4845d2598bbd85e5d3cf87dd348f2710ffdbb213a056633bebc85a0ed94ac5a00f2b021b60a3eb312e26"}, @pad1, @pad1]}}}], 0xd8}}, {{&(0x7f0000000a00)={0xa, 0x4e21, 0x380, @rand_addr=' \x01\x00', 0xd15}, 0x1c, &(0x7f0000000c40)=[{&(0x7f0000000a40)="da3288beec5d614ddf49a1e33fef015ef6d9fb36d8b6706cfb5d58f225d8df2192e83dacb90087bcd5e57a648e8b687e7f9e915be8e7d1a01b095c38c3951c60b7d51e43", 0x44}, {&(0x7f0000000ac0)="0d33d306c57412856064eb13b1fd66bccc02ef9338dc896eee998e421684f0bd2aef926ea7abbae9c575e21679b0e636555f08b17e6e75a28c600a8da0f5b6a628e262f4f0faaa2214af03268711ab399f3bb648dd7d12371b63a285dcdf126ad433ec7b04f0f7c36a113d5bd73ba62c063a20e79403d4f92619b29d59", 0x7d}, {&(0x7f0000000b40)="ac9a6e233ff4454ed8005c0a964963b56c301933393eb687f55486ee9534d71fae2b9cf95e52204b042eb5c393eb15ec619482a8cf2cc87760bd2bb6aa77ac3139052c47748503bcd82704a2e884f0894722fb47d8e7ab919e55b5f81948f3b23217a0b82cffbf989d3ab9d0064b5b811e8d6ca4d7081047b90febdbaa8bf0fb1d6c5c9032639dc62eb960f63204dcaa6e623a78862f54b7181e4da7e46e4e8345d3542fb054beb8967fdc123a25269a3bba346668c1955e95dec6d5ca20eefb474057b71eff3a228f767e0a8705a4aa25883e22ecf631a73a6f2ef7a1deb71c", 0xe0}], 0x3, &(0x7f00000013c0)=[@rthdrdstopts={{0x28, 0x29, 0x37, {0x1, 0x1, '\x00', [@jumbo={0xc2, 0x4, 0x1ff}, @pad1, @enc_lim={0x4, 0x1, 0x3}]}}}, @dstopts={{0xb0, 0x29, 0x37, {0x84, 0x12, '\x00', [@generic={0x6, 0x95, "0ad948b54921fd17f7f859272ab78b1dd2385acce340ffc3f23682e9a634cb7e3a8ecf40002e87d5e5a7d84e161ae19026a2e991faee1acfe02efc628eed787e03d253caac9c1cedc190ddb96c6b1b6338d241948b868a93c71fb689825c4887666955b4bd898401f00ed2e0ca23f1d0eb699e7573049c52d5624f2229d8c313c6b24b1b42519ca8630dc1d1b6120376b596c4e481"}]}}}, @hoplimit_2292={{0x14, 0x29, 0x8, 0x9}}, @hopopts={{0x18, 0x29, 0x36, {0x10}}}, @dontfrag={{0x14, 0x29, 0x3e, 0x80}}], 0x120}}], 0x3, 0x20008801) setsockopt$inet6_int(r1, 0x29, 0x2, &(0x7f0000000000)=0x7, 0x4) setsockopt$inet6_int(r1, 0x29, 0x42, &(0x7f0000000040)=0xf2b, 0x4) getsockopt$inet6_buf(r1, 0x29, 0x6, &(0x7f00000004c0)=""/17, &(0x7f00000003c0)=0xfffffffffffffe34) r5 = socket$inet6_sctp(0xa, 0x5, 0x84) setsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX_OLD(r5, 0x84, 0x6b, &(0x7f0000000100)=[@in6={0xa, 0x4e23, 0x35f, @private1, 0xfffffffe}], 0x1c) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r5, 0x84, 0x6f, &(0x7f0000000480)={0x0, 0x10, &(0x7f0000000400)=[@in={0x2, 0x4e22, @rand_addr=0x64010101}]}, &(0x7f00000004c0)=0x10) setsockopt(r5, 0x84, 0x7f, &(0x7f0000000040)="020000000980ffff", 0x8) shutdown(r0, 0x0) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r0, 0x84, 0x6f, &(0x7f0000000000)={0x0, 0x1c, &(0x7f0000000140)=[@in6={0xa, 0x4e20, 0x4, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02', 0x3}]}, &(0x7f0000000440)=0x10) getsockopt$inet_sctp6_SCTP_SOCKOPT_PEELOFF(r0, 0x84, 0x66, &(0x7f0000000080)={r6, 0x2}, &(0x7f0000000100)=0x8) 5m50.599554859s ago: executing program 4 (id=12754): bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0xe, 0x4, &(0x7f0000000040)=ANY=[@ANYBLOB="b405000018000000711078000000000063012c00000000009500000000000000"], &(0x7f0000000540)='GPL\x00', 0x5, 0xc3, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @sk_skb}, 0x94) ioctl$sock_ipv6_tunnel_SIOCCHGTUNNEL(0xffffffffffffffff, 0x89f3, &(0x7f0000000140)={'ip6_vti0\x00', &(0x7f00000000c0)={'ip6_vti0\x00', 0x0, 0x0, 0xe, 0x8, 0x2bbb, 0x4, @private1={0xfc, 0x1, '\x00', 0x1}, @empty, 0x80, 0x700, 0x1, 0x9}}) bpf$PROG_LOAD(0x5, &(0x7f0000000840)={0xd, 0xf, &(0x7f0000000040)=ANY=[@ANYBLOB="1808000006ba6d00000000000000000018000000", @ANYRES32, @ANYBLOB="0000000000000000b702000014000000b7030000000000008500000090000000bca900000000000035090100000000009500000000000000bf98000000000000560800000000000085000000b2b20000b70000000000000095"], &(0x7f00000001c0)='GPL\x00', 0x0, 0x0, 0x0, 0x40f00, 0x6, '\x00', r0, @fallback=0x34, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.net/syz0\x00', 0x1ff) r1 = syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10) ioctl$sock_ipv6_tunnel_SIOCADDTUNNEL(r1, 0x89f1, &(0x7f00000004c0)={'ip6gre0\x00', &(0x7f0000000340)={'syztnl0\x00', 0x0, 0x2f, 0x4, 0x73, 0x3, 0x20, @ipv4={'\x00', '\xff\xff', @multicast2}, @mcast1, 0x700, 0x8000, 0x2, 0x2}}) r2 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200), 0xffffffffffffffff) sendmsg$NL80211_CMD_DEL_PMKSA(0xffffffffffffffff, &(0x7f00000003c0)={&(0x7f0000000180), 0xc, &(0x7f0000000340)={&(0x7f0000000300)={0x34, r2, 0x200, 0x70bd2a, 0x25dfdbfe, {{}, {@void, @val={0xc, 0x99, {0x8, 0x23}}}}, [@NL80211_ATTR_MAC={0xa, 0x6, @from_mac=@broadcast}, @NL80211_ATTR_PMK_LIFETIME={0x8, 0x11f, 0x53}]}, 0x34}, 0x1, 0x0, 0x0, 0x4000004}, 0x0) r3 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r4 = socket(0x10, 0x3, 0x0) bind$netlink(r4, &(0x7f0000177ff4)={0x10, 0x0, 0x1}, 0xc) connect$netlink(r4, &(0x7f00000005c0)=@proc={0x10, 0x0, 0x1, 0x20000}, 0xc) ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8933, &(0x7f0000000480)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_JOIN_IBSS(r4, &(0x7f0000000c80)={&(0x7f0000000400)={0x10, 0x0, 0x0, 0x40}, 0xc, &(0x7f0000000c40)={&(0x7f0000000900)={0x2e8, r2, 0x100, 0x70bd27, 0x25dfdbfb, {{}, {@val={0x8, 0x3, r5}, @void}}, [@NL80211_ATTR_MCAST_RATE={0x8, 0x6b, 0x30000}, @NL80211_ATTR_BEACON_INTERVAL={0x8}, @NL80211_ATTR_CONTROL_PORT={0x4}, @NL80211_ATTR_MAC={0xa}, @NL80211_ATTR_MESH_CONFIG={0xc, 0x23, 0x0, 0x1, [@NL80211_MESHCONF_PATH_REFRESH_TIME={0x8, 0x9, 0xfffffed2}]}, @chandef_params=[@NL80211_ATTR_WIPHY_CHANNEL_TYPE={0x8}, @NL80211_ATTR_CENTER_FREQ2={0x8, 0xa1, 0x8}, @NL80211_ATTR_CENTER_FREQ1={0x8, 0xa0, 0x4}, @NL80211_ATTR_CENTER_FREQ1={0x8, 0xa0, 0x5}, @NL80211_ATTR_WIPHY_FREQ={0x8}, @NL80211_ATTR_CENTER_FREQ2={0x8, 0xa1, 0x5}, @NL80211_ATTR_CHANNEL_WIDTH={0x8, 0x9f, 0x4}, @NL80211_ATTR_WIPHY_FREQ={0x8, 0x26, @random=0x16ee}, @NL80211_ATTR_WIPHY_EDMG_BW_CONFIG={0x5, 0x119, 0x5}], @NL80211_ATTR_MESH_CONFIG={0x14, 0x23, 0x0, 0x1, [@NL80211_MESHCONF_AWAKE_WINDOW={0x6, 0x1b, 0xfff}, @NL80211_MESHCONF_HWMP_PREQ_MIN_INTERVAL={0x6, 0xc, 0x5}]}, @NL80211_ATTR_IE={0x220, 0x2a, [@random_vendor={0xdd, 0xfa, "1f742994b007c48f3b55b65d11051df6ee315f9798148f0da49bc040a4beadc26c826a4db6ece402847df3557123708e549d487acb776539622ca9879e4e52fd66b1b7c91b6403e2f1b35fde385fe2de455388a8755e901ae15c677f4a3ae5afa410b277ba82f90208e6be43050ed244c8d275334f65bf569b096d04ee55088710bdabbef373fefa9e1eebc7c7c94c4b5a30d85bf19d13b2d22b0e5a8a18bc0bb6b419585d47f178b25258e232e14563ee93fb3dd6f94be74deff80ec413f4b33558446634e0a7c872d915e5dc4ed070f36a8d4627d8178310e4c774f79e33adbfc3f974c8bef072901189e20de8e7409b94d4f2f1ec287c03f1"}, @ssid={0x0, 0x6, @default_ibss_ssid}, @perr={0x84, 0x116, {0x2, 0x12, [{{0x0, 0x1}, @broadcast, 0x8, @value=@broadcast, 0x2d}, {{}, @device_a, 0x9, @void, 0x31}, {{}, @device_b, 0x6, @void, 0xc}, {{0x0, 0x1}, @device_a, 0x1, @value, 0xc}, {{}, @broadcast, 0x9, @void, 0x2}, {{}, @device_b, 0x0, @void, 0x37}, {{0x0, 0x1}, @device_b, 0x3, @value, 0x2c}, {{}, @device_b, 0x6, @void, 0x17}, {{0x0, 0x1}, @device_b, 0xafd, @value=@broadcast, 0x31}, {{}, @device_a, 0x101, @void, 0x4}, {{}, @broadcast, 0x5, @void, 0x2a}, {{0x0, 0x1}, @broadcast, 0xffffffff, @value, 0x2b}, {{0x0, 0x1}, @broadcast, 0x7, @value=@broadcast, 0x3a}, {{}, @device_b, 0xd95, @void, 0x1c}, {{}, @broadcast, 0x0, @void, 0x3b}, {{}, @device_a, 0x7fff, @void, 0x1c}, {{0x0, 0x1}, @broadcast, 0x48, @value, 0x1b}, {{}, @device_b, 0x2, @void, 0xc}]}}]}, @NL80211_ATTR_CONTROL_PORT_OVER_NL80211={0x4}, @NL80211_ATTR_HT_CAPABILITY={0x1e, 0x1f, {0x2, 0x1, 0x3, 0x0, {0x4, 0x3, 0x0, 0x1, 0x0, 0x0, 0x1}, 0x1, 0x5, 0x4}}]}, 0x2e8}, 0x1, 0x0, 0x0, 0x9da63d9d35d9e69a}, 0x800) r6 = openat$cgroup_ro(r3, &(0x7f0000000380)='devices.list\x00', 0x0, 0x0) preadv(r6, &(0x7f0000000500)=[{&(0x7f0000000240)=""/130, 0x82}], 0x1, 0x1000000, 0xffffffff) r7 = socket$key(0xf, 0x3, 0x2) bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000080)={&(0x7f0000000300)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0xc, 0xc, 0x9, [@typedef={0x6, 0x0, 0x0, 0x8, 0x4}]}, {0x0, [0x2e, 0x30, 0x30, 0x5f, 0x61, 0x5f, 0x2e]}}, 0x0, 0x2d, 0x0, 0x1}, 0x28) bpf$PROG_LOAD(0x5, &(0x7f00000054c0)={0x2, 0x16, &(0x7f0000000180)=ANY=[@ANYBLOB="611230000000000061134c0000000000bf2000000000000016001000071b48013d030100000000000702000000b0ffb0bc26100000000000bf672000000000001602000000b0ffb06702000007000000360600000ee600f0bf050000000000000f650000000000006507f4ff02000000070700004c0040001f75000000000000bf54000000000000070500000300f9ffad430100000000009500000000000000050000000000000095000000000000004d9bd591d568253e9988431ec068e3a83683d58719d72183f2cb7f43dd55788be820b236dcb695dbfd737cbf5fe7030586"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0xfe}, 0x48) sendmsg$key(r7, &(0x7f0000000040)={0x3, 0x0, &(0x7f0000000340)={&(0x7f0000000440)={0x2, 0x6, 0xff, 0x3, 0x3, 0x0, 0x70bd2a, 0x25dfdbfb, [@sadb_key={0x1, 0x9}]}, 0x18}, 0x1, 0x7}, 0x0) socket$inet6_sctp(0xa, 0x5, 0x84) 5m50.039922703s ago: executing program 4 (id=12760): sendmsg$kcm(0xffffffffffffffff, 0x0, 0x4005) write$tun(0xffffffffffffffff, 0x0, 0xfd6c) r0 = socket$kcm(0x10, 0x2, 0x4) sendmsg$inet(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000580)=[{&(0x7f0000000440)}], 0x1, 0x0, 0x0, 0x1f00c00e}, 0x20000808) 5m49.909381488s ago: executing program 4 (id=12761): bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0x10, 0x4, &(0x7f0000000100)=ANY=[@ANYBLOB="b4000000000000007910480000000000c30040000000000095000000fe000000db74589d4b38cc306ac390649f72dea0e50e2317db042855d6c74ff3493c7e31e3f6c643155a8e2e01d50bc3347475750472719cc516fa14b769e7f385ba72c60242263c05ddab05e37efe81b8bffc35cdf2ac0d93263ff755d611c4cca1684b1470af6a83366aa430ad2d700b186da622d6fba70000000000000000000000000200"/173], &(0x7f0000003ff6)='GPL\x00', 0x2, 0xfd90, &(0x7f000000cf3d)=""/195, 0x0, 0x5, '\x00', 0x0, @sk_msg}, 0x48) 5m49.671949108s ago: executing program 4 (id=12765): r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f00000004c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000500)=ANY=[@ANYBLOB="bc010000130001010000000000000000fe8000000000000000000000000000bbffffffff0000000000000000000000000100000d040000090a00000000000000", @ANYRES32=0x0, @ANYRES32, @ANYBLOB="020000000000000000000000000000000000000000000000ffffffffffffffff00000000000000000300000000000000000000000000000008000000000000000000000000000000010000000000000000000200000000000001000000000000feffffff00000000000000000000000004010580ac1414bb000000000000000000000000000004d22b0000000a000000000000000000000000000000000000000000100001010100040000000200000001000080ff010000000000000000000000000001000004d5320000000a000000640101010000000000000000040000000000000030"], 0x1bc}, 0x1, 0x0, 0x0, 0x20048000}, 0x0) 5m49.566620755s ago: executing program 4 (id=12768): r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='memory.current\x00', 0x26e1, 0x0) mmap(&(0x7f0000001000/0xc00000)=nil, 0xc00000, 0x0, 0x3032, 0xffffffffffffffff, 0x0) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000000)={0x14, 0x27, 0x1, 0x70bd29, 0x0, {0x6, 0x1}}, 0x14}}, 0xc000) close(r0) socket$kcm(0x10, 0x2, 0x4) ioctl$SIOCSIFHWADDR(r0, 0x8b32, &(0x7f0000000000)={'virt_wifi0\x00', @random="030000000018"}) syz_emit_ethernet(0x86, &(0x7f00000003c0)={@broadcast, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x44}, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x78, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @time_exceeded={0xc, 0x1, 0x0, 0xe0, 0x0, 0xe000, {0x17, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x11, 0x0, @local, @dev, {[@lsrr={0x83, 0x3}, @lsrr={0x83, 0x7, 0x90, [@private=0xa010101]}, @timestamp_prespec={0x44, 0x3c, 0x0, 0x3, 0x0, [{@private=0xa01012f}, {@local}, {@initdev={0xac, 0x1e, 0x0, 0x0}}, {@remote}, {@loopback}, {@dev={0xac, 0x14, 0x14, 0x2b}, 0x800}, {@multicast2}]}]}}}}}}}, 0x0) 5m34.46221188s ago: executing program 32 (id=12768): r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='memory.current\x00', 0x26e1, 0x0) mmap(&(0x7f0000001000/0xc00000)=nil, 0xc00000, 0x0, 0x3032, 0xffffffffffffffff, 0x0) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000000)={0x14, 0x27, 0x1, 0x70bd29, 0x0, {0x6, 0x1}}, 0x14}}, 0xc000) close(r0) socket$kcm(0x10, 0x2, 0x4) ioctl$SIOCSIFHWADDR(r0, 0x8b32, &(0x7f0000000000)={'virt_wifi0\x00', @random="030000000018"}) syz_emit_ethernet(0x86, &(0x7f00000003c0)={@broadcast, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x44}, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x78, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @time_exceeded={0xc, 0x1, 0x0, 0xe0, 0x0, 0xe000, {0x17, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x11, 0x0, @local, @dev, {[@lsrr={0x83, 0x3}, @lsrr={0x83, 0x7, 0x90, [@private=0xa010101]}, @timestamp_prespec={0x44, 0x3c, 0x0, 0x3, 0x0, [{@private=0xa01012f}, {@local}, {@initdev={0xac, 0x1e, 0x0, 0x0}}, {@remote}, {@loopback}, {@dev={0xac, 0x14, 0x14, 0x2b}, 0x800}, {@multicast2}]}]}}}}}}}, 0x0) 2m37.641153837s ago: executing program 3 (id=14290): socket(0x10, 0x803, 0x0) socket$nl_route(0x10, 0x3, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) r0 = socket(0x10, 0x803, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000200)={'lo\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=@ipv6_newaddr={0x34, 0x14, 0x9535393fea6295b5, 0x70bd27, 0x25dfdbff, {0xa, 0x8, 0x0, 0xff, r1}, [@IFA_ADDRESS={0x14, 0x1, @empty}, @IFA_RT_PRIORITY={0x8, 0x9, 0x2}]}, 0x34}, 0x1, 0x0, 0x0, 0x2004c040}, 0x0) 2m37.403635484s ago: executing program 3 (id=14292): r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=@newlink={0x44, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x32b}, [@IFLA_LINKINFO={0x24, 0x12, 0x0, 0x1, @bond={{0x9}, {0x14, 0x2, 0x0, 0x1, [@IFLA_BOND_ARP_VALIDATE={0x8, 0x9, 0x2}, @IFLA_BOND_ARP_ALL_TARGETS={0x8, 0xa, 0x1}]}}}]}, 0x44}, 0x1, 0x0, 0x0, 0x4000ffc3}, 0x880) 2m37.106116272s ago: executing program 3 (id=14297): r0 = socket$netlink(0x10, 0x3, 0xf) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) accept4$phonet_pipe(r1, 0x0, 0x0, 0x80800) bind$netlink(r0, &(0x7f0000000a40)={0x10, 0x0, 0x25dfdbfb, 0x2ffffffff}, 0xc) setsockopt$sock_int(r0, 0x1, 0x8, &(0x7f0000000000), 0x4) setsockopt$netlink_NETLINK_NO_ENOBUFS(r0, 0x10e, 0x5, &(0x7f0000000040)=0x8, 0x4) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f00000006c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000140)=@newlink={0x34, 0x10, 0x40d, 0x70bd2c, 0x0, {0x0, 0x0, 0x0, 0x0, 0x99ffef750d96a51f}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @bond={{0x9}, {0x4}}}]}, 0x34}}, 0x0) 2m36.547599315s ago: executing program 3 (id=14305): r0 = accept4$phonet_pipe(0xffffffffffffffff, &(0x7f0000000200), &(0x7f0000000240)=0x10, 0x80000) recvfrom$phonet(r0, &(0x7f00000002c0)=""/121, 0x79, 0xc0002141, 0x0, 0x0) r1 = socket$nl_sock_diag(0x10, 0x3, 0x4) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000040)={'batadv_slave_0\x00', 0x0}) sendmsg$nl_route_sched(0xffffffffffffffff, 0x0, 0x4c840) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000180)=@newtfilter={0x64, 0x2c, 0xf3f, 0x30bd29, 0x25dfdbfd, {0x0, 0x0, 0x0, r2, {0xb, 0x9}, {0x0, 0xfff3}, {0xe, 0xb}}, [@filter_kind_options=@f_flower={{0xb}, {0x34, 0x2, [@TCA_FLOWER_KEY_ENC_KEY_ID={0x8, 0x1a, 0x7ff}, @TCA_FLOWER_KEY_ENC_IPV6_DST={0x14, 0x21, @mcast1}, @TCA_FLOWER_KEY_ENC_IPV6_DST_MASK={0x14, 0x22, [0x0, 0xff]}]}}]}, 0x64}, 0x1, 0x0, 0x0, 0x20041090}, 0x4000) socketpair$tipc(0x1e, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff}) r4 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r4, &(0x7f0000000100)={0x2, 0x4e21, @local}, 0x10) setsockopt$inet_tcp_int(r4, 0x6, 0x210000000013, &(0x7f00000000c0)=0x100000001, 0x4) setsockopt$inet_tcp_TCP_REPAIR_QUEUE(r4, 0x6, 0x14, &(0x7f0000000140)=0x2, 0x4) connect$inet(r4, &(0x7f0000000180)={0x2, 0x4e21, @local}, 0x10) socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f00000003c0)={'netdevsim0\x00', 0x0}) r6 = socket$inet6(0xa, 0x2, 0x3a) ioctl$sock_inet6_SIOCSIFADDR(r6, 0x8916, &(0x7f0000000000)={@loopback, 0x63, r5}) setsockopt$inet_tcp_TCP_REPAIR_OPTIONS(r4, 0x6, 0x16, &(0x7f0000000340)=[@sack_perm, @timestamp, @timestamp, @window={0x3, 0x6, 0xff81}, @window={0x3, 0x6, 0x6}, @timestamp, @sack_perm, @mss={0x2, 0xffff7fff}], 0x8) sendto$inet(r4, &(0x7f0000000000)="b8", 0x1, 0x2400a044, 0x0, 0x0) r7 = socket$nl_generic(0x10, 0x3, 0x10) r8 = syz_genetlink_get_family_id$nl80211(&(0x7f00000001c0), 0xffffffffffffffff) sendmsg$NL80211_CMD_SET_CQM(r7, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000480)=ANY=[@ANYBLOB='$\x00', @ANYRES16=r8, @ANYBLOB="010000000000000000003f00000008000300", @ANYRES32, @ANYBLOB="090000000000000070fdf3109407ee52c38e138d1e9566d0df005958eb8aa032f97ac28c70fbb870c0bd6f087fe670dc22bf857968701e1921e41016ba0c4df280088e1194d74654dcff5609f0bf1134be6b77a909e2cd6161ca26d6adf25ee5084807b829b369acc45c9974adc90c443b562e07ed8a29603beff0f6e4a4c0954a7d72fe6494ba6da79438baae15cac9633a209d867113ad1bb9894f5879f7868f29ac992cba36157c1980946698170125c113"], 0x24}}, 0x0) setsockopt$inet_tcp_TCP_REPAIR(r4, 0x6, 0x13, 0x0, 0x0) sendto$inet(r4, 0x0, 0x0, 0x480c1, 0x0, 0x0) bpf$ITER_CREATE(0x21, 0x0, 0x0) setsockopt$sock_attach_bpf(r3, 0x10f, 0x85, 0x0, 0x0) sendmsg$TCPDIAG_GETSOCK(r1, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000080)=ANY=[@ANYBLOB="60000000120001030000000000000000020d0000000000000000000000000000000000000000000000000000060000000000000000", @ANYRES32=0x0, @ANYBLOB="000000214e000000ffffffff000000001400010007101000"], 0x60}, 0x1, 0x0, 0x0, 0x20000090}, 0x0) 2m36.291818446s ago: executing program 3 (id=14308): r0 = socket$inet6(0xa, 0x3, 0xff) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000000100)=@filter={'filter\x00', 0xe, 0x4, 0x340, 0xffffffff, 0x0, 0x1a0, 0x270, 0xffffffff, 0xffffffff, 0xd0, 0x1a0, 0x270, 0xffffffff, 0x4, 0x0, {[{{@ipv6={@empty, @empty, [], [0x6000000], '\x00', '\x00', {}, {}, 0x6, 0x0, 0x1}, 0x0, 0xa8, 0xd0}, @common=@inet=@SYNPROXY={0x28, 'SYNPROXY\x00', 0x0, {0x1, 0x7, 0x5a0}}}, {{@uncond, 0x0, 0xa8, 0xd0}, @common=@unspec=@STANDARD={0x28, '\x00', 0x0, 0xfffffffe}}, {{@uncond, 0x0, 0xa8, 0xd0}, @common=@unspec=@STANDARD={0x28, '\x00', 0x0, 0xfffffffe}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x3a0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40a01, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) r2 = socket$kcm(0x2, 0xa, 0x2) ioctl$SIOCSIFHWADDR(r2, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local}) write$tun(r1, &(0x7f00000000c0)=ANY=[@ANYBLOB="001c86dd0700100000004000000060ec97000fc83c00fe8000000000000000000000000000aaff02000000f00f000000000000000001"], 0xffe) 2m35.888091926s ago: executing program 3 (id=14315): r0 = syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10) sendmsg$netlink(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)=[{&(0x7f0000002740)=ANY=[@ANYBLOB="14000000130001ffffff7f8cd913e90002"], 0x14}], 0x1, 0x0, 0x0, 0x44100}, 0x0) pipe(&(0x7f0000000480)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000000040)=@ipv6_newroute={0x38, 0x18, 0x1, 0x70bd2a, 0x25dfdbfc, {0xa, 0x20, 0x10, 0x0, 0x2, 0x0, 0xff, 0x5, 0x2800}, [@RTA_GATEWAY={0x14, 0x5, @empty}, @RTA_PRIORITY={0x8, 0x1e, 0xa}]}, 0x38}, 0x1, 0x0, 0x0, 0x20048440}, 0x20000814) ioctl$int_in(r1, 0x5452, &(0x7f0000000240)=0x80000000) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='memory.events\x00', 0x275a, 0x0) mmap(&(0x7f0000002000/0x3000)=nil, 0x3000, 0x0, 0x12, r3, 0x0) r4 = bpf$PROG_LOAD(0x5, &(0x7f0000000240)={0x20, 0xb, &(0x7f0000000000)=ANY=[@ANYBLOB="18000000000000000000000000000000180100002020702500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000000000000b703000000000000850000007300000095"], &(0x7f0000000140)='syzkaller\x00', 0x0, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, @fallback=0x19, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, r3, 0x0, 0x0, 0x0, 0x0}, 0x94) r5 = socket$packet(0x11, 0x3, 0x300) sendmsg$IPSET_CMD_LIST(0xffffffffffffffff, &(0x7f00000000c0)={&(0x7f0000000000)={0x2d, 0x0, 0x0, 0x20}, 0xc, &(0x7f0000000080)={0x0}, 0x1, 0x0, 0x0, 0x40}, 0x40041) setsockopt$sock_attach_bpf(r5, 0x1, 0x32, &(0x7f0000000180)=r4, 0x4) r6 = socket$nl_route(0x10, 0x3, 0x0) write(r6, &(0x7f0000000100)='P\x00', 0x2) r7 = syz_init_net_socket$802154_raw(0x24, 0x3, 0x0) r8 = socket$nl_generic(0x10, 0x3, 0x10) r9 = syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10) sendmsg$netlink(r9, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000001080)=[{&(0x7f0000000a00)={0x14, 0x30, 0x1, 0x0, 0x25dfdbfc, "", [@nested={0x4, 0xf2}]}, 0x14}], 0x1, 0x0, 0x0, 0x1}, 0x0) sendmsg$nl_generic(r8, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000300)={0x1c, 0x27, 0x9, 0x70bd25, 0x25dfdbfd, {0x11}, [@typed={0x8, 0x1, 0x0, 0x0, @u32=0x2e}]}, 0x1c}, 0x1, 0x0, 0x0, 0x4000002}, 0x4000080) ioctl$sock_inet_SIOCSIFADDR(r7, 0x8916, 0x0) recvmsg(r0, &(0x7f00000001c0)={0x0, 0x0, 0x0}, 0x12000) r10 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r10, &(0x7f00000096c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000000c0)=@newtaction={0x50, 0x30, 0x20, 0x0, 0x0, {}, [{0x3c, 0x1, [@m_vlan={0x38, 0x1, 0x0, 0x0, {{0x9}, {0xc, 0x2, 0x0, 0x1, [@TCA_VLAN_PUSH_VLAN_PRIORITY={0x5, 0x6, 0x7}]}, {0x4}, {0xc}, {0xc}}}]}]}, 0x50}}, 0x0) bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000340)=ANY=[@ANYBLOB="02000000040000000800000001"], 0x48) r11 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000340)=ANY=[@ANYBLOB="02000000040000000800000001"], 0x48) bpf$MAP_DELETE_ELEM(0x3, &(0x7f00000000c0)={r11, &(0x7f0000000040)}, 0x20) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000400)={0x18, 0x13, &(0x7f00000004c0)=@raw=[@map_idx_val={0x18, 0xb, 0x6, 0x0, 0xc, 0x0, 0x0, 0x0, 0x10001}, @initr0={0x18, 0x0, 0x0, 0x0, 0x13, 0x0, 0x0, 0x0, 0x9}, @snprintf={{}, {}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0xc8}, {}, {}, {}, {}, {}, {}, {0x18, 0x3, 0x2, 0x0, r11}}, @generic={0x8a, 0xf, 0x4, 0xe, 0xb}, @kfunc={0x85, 0x0, 0x2, 0x0, 0x2}], &(0x7f0000000300)='GPL\x00', 0xa, 0xff8, &(0x7f0000001e00)=""/4088}, 0x94) 2m30.221473141s ago: executing program 2 (id=14371): close(0x3) (async) r0 = socket(0x2, 0xa, 0x0) r1 = socket$inet6_sctp(0xa, 0x5, 0x84) shutdown(r1, 0x0) (async) close(0x3) (async) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r1, 0x84, 0x6f, &(0x7f0000000200)={0x0, 0x10, &(0x7f00000001c0)=[@in={0x2, 0x4e23, @rand_addr=0x64010100}]}, &(0x7f0000000140)=0x10) getsockopt$inet_sctp6_SCTP_PRIMARY_ADDR(r1, 0x84, 0x7a, &(0x7f0000000340)={r2, @in6={{0xa, 0x3, 0x3, @mcast1}}}, &(0x7f0000000040)=0x84) (async) sendmmsg$inet_sctp(r0, &(0x7f00000032c0)=[{0x0, 0x0, 0x0, 0x0, &(0x7f0000000700)=ANY=[@ANYBLOB="30000000000000008400000001000000000000017c"], 0x30}], 0x1, 0x0) (async) getsockopt$inet_sctp6_SCTP_LOCAL_AUTH_CHUNKS(r0, 0x84, 0x1b, &(0x7f00000002c0)={r2}, &(0x7f0000000400)=0x8) r3 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000740)=ANY=[@ANYBLOB="02000000040000000800488773ae3d53d819094186af9e16bbc85b24c3540895a9410000010000007fffffe7f019a132bd9c5f876a3dd41f0b9c98ac5b363b737fe2ac2163bd63c0a1bde2ba4952ff673e124fdf2bf1df8ce8da9f801b701a1b25a250a71a025d5a02edb310bd66284fbd426ac86834aa9b496982c4db420bbfd205703e5e00991748c4f8d3e178a1e614b83f97486e583f255c50c8d69a22a09551f751b2efa9d443b44f0a5670d3f4ac1c2417d54ed4773195f9008b7f840e3d8df66600299c434b62c2c93771408fec1e8a0aaafcf3201f9c01bc09152348db3e71c7a35a3cf8a3196bd82c8d3462b8856936730e1f449fca27e6a0adfde2b46f6644380628355da0f4936fd1f7a323a967406a82fdae5855950019981046748cd3bbaa843d47f9321c4f395b792cc38f0bb5ace5450222f33c99cd1e0703c5e9a20cb4aae798041c9aa646ffec89d0142b1e145d8ebf7faa45036e4a9f9041c87283de6e8b7d39e9d81c8ad6db61286e219a06fd13c176064b6e14e3d6e6e7097a279a0d855bbac5026fecc6775f84c4d9765b78cdc731df2651e0aac29a0aec9cbea553481cc401856a96c3dfe387f204a7062c75b79c3d37164a4f08443697ba3aa2054679e37d3b5079832dcdb2d157bfdbeca1b2ccf1d16c6bc129ea92818bee4d914ce35772de15c05e21e82248a1f368057f9ff0991a1daa", @ANYRES32=0x0, @ANYBLOB='\x00'/20, @ANYRES32=0x0, @ANYRES32, @ANYBLOB='\x00'/28], 0x50) (async) r4 = socket(0xa, 0x802, 0x0) sendmmsg$inet(r4, &(0x7f0000008100)=[{{0x0, 0x0, 0x0}}], 0x1, 0x40000) bind$inet6(r4, &(0x7f0000000000)={0xa, 0x0, 0xa, @mcast2, 0x6}, 0x1c) (async, rerun: 32) bpf$PROG_LOAD(0x5, &(0x7f00000004c0)={0x1, 0x10, &(0x7f0000000580)=ANY=[@ANYBLOB="18050000000000000000000001000000b7080000000000007b8af8ff00000000b7080000020000007b8af0ff00000000bfa100000000000007010000f8ffffffbfa400000000000007040000f0ffffffb70200000800000018230000", @ANYRES32=r3, @ANYBLOB="0000000000000000b70400000800000085000000950000007800000000000000"], &(0x7f0000000000)='syzkaller\x00', 0x8, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1}, 0x94) (rerun: 32) 2m30.043578798s ago: executing program 2 (id=14372): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000040)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a01020000000000000000010000000900010073797a30000000006c000000160a01000000000000010000010000000900010073797a30000000000900020073797a3000000000400003800800014000000000080002400000fbff2b0003801400010067656e6576653000000000000000000014000100776732000000000000000000c6e49c0f5c000000180a0101000b000000000000010000000900020073797a30000000000900010073797a300000000030000380"], 0x110}, 0x1, 0x0, 0x0, 0x800}, 0x0) 2m29.940457688s ago: executing program 2 (id=14374): r0 = socket$netlink(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000740)=ANY=[@ANYBLOB="140000001000010000000000000000000200000a20000000000a01040000000000000000020000000938010073797a300000000040000000030a01040000000000000000020000000900010073797a30000000000900030073797a3000000000140004800800014000000003080002400000000098000000060a01040000000000000000020000000900010073797a30000000000900020073797a30000000036c000480680001800a0001006d61746368000000580002800e000100686173686c696d697400000008000240000000013c0003"], 0x120}}, 0x0) 2m29.903210647s ago: executing program 2 (id=14376): r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000018c0)={0x1c, 0x2f, 0x5, 0x70bd27, 0x25dfdbfb, {0x4}, [@typed={0x4, 0x18}, @typed={0x4, 0x19}]}, 0x1c}, 0x1, 0x0, 0x0, 0x42914}, 0x4000014) r1 = socket$nl_generic(0x10, 0x3, 0x10) socket$nl_route(0x10, 0x3, 0x0) socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000a00)=ANY=[], 0x138}, 0x1, 0x0, 0x0, 0xc000}, 0x0) r2 = bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=@base={0x1b, 0x0, 0x0, 0x8000}, 0x48) bpf$PROG_LOAD(0x5, &(0x7f0000000340)={0xc, 0x1c, &(0x7f0000000400)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r2, @ANYBLOB="0000000000000000b702000014000000b7030000000000008500000083000000bf090000000000001509010000000000b500f8ffffff000018110000", @ANYRES32=r2, @ANYBLOB="0000000000000000b702000000a36c00850000001700000018110000", @ANYRES32=r2, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b7040000000000008500000082000000bf91000000000000b7020000000000008500000084000000b70000000000000095"], &(0x7f0000000000)='syzkaller\x00', 0x1, 0x0, 0x0, 0x0, 0x8, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_generic(r1, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000001c0)={0x14, 0x39, 0x301, 0x70bd25, 0xfffffffc, {0x12}}, 0x14}}, 0x40800) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) ioctl$TUNSETIFF(r3, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) r4 = socket$kcm(0x2, 0x3, 0x2) ioctl$SIOCSIFHWADDR(r4, 0x8914, &(0x7f0000000040)={'syzkaller1\x00', @broadcast}) write$tun(r3, &(0x7f0000002ec0)={@val={0x8, 0x800}, @val={0x3, 0x0, 0x4, 0xfffd, 0x14}, @ipv4=@generic={{0x5, 0x4, 0x1, 0x22, 0x1c, 0x69, 0x0, 0x60, 0x2, 0x0, @empty, @broadcast}, "14f3305280f125e6"}}, 0xfdef) syz_genetlink_get_family_id$batadv(&(0x7f0000000280), r1) write$cgroup_pid(0xffffffffffffffff, &(0x7f0000000000), 0xffffff98) r5 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000080), r0) sendmsg$IPVS_CMD_SET_DEST(r1, &(0x7f0000000400)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x200000}, 0xc, &(0x7f00000003c0)={&(0x7f00000002c0)={0xd0, r5, 0x200, 0x70bd26, 0x25dfdbfe, {}, [@IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5, 0x9}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5, 0x6}, @IPVS_CMD_ATTR_DEST={0x54, 0x2, 0x0, 0x1, [@IPVS_DEST_ATTR_ADDR_FAMILY={0x6, 0xb, 0xa}, @IPVS_DEST_ATTR_TUN_PORT={0x6, 0xe, 0x4e21}, @IPVS_DEST_ATTR_INACT_CONNS={0x8}, @IPVS_DEST_ATTR_L_THRESH={0x8, 0x6, 0x5}, @IPVS_DEST_ATTR_U_THRESH={0x8, 0x5, 0x4}, @IPVS_DEST_ATTR_ADDR_FAMILY={0x6, 0xb, 0x8}, @IPVS_DEST_ATTR_INACT_CONNS={0x8, 0x8, 0x8000}, @IPVS_DEST_ATTR_U_THRESH={0x8, 0x5, 0x5}, @IPVS_DEST_ATTR_INACT_CONNS={0x8, 0x8, 0x5}, @IPVS_DEST_ATTR_TUN_TYPE={0x5, 0xd, 0x1}]}, @IPVS_CMD_ATTR_DEST={0x14, 0x2, 0x0, 0x1, [@IPVS_DEST_ATTR_PORT={0x6, 0x2, 0x4e22}, @IPVS_DEST_ATTR_ADDR_FAMILY={0x6, 0xb, 0x2}]}, @IPVS_CMD_ATTR_DEST={0x44, 0x2, 0x0, 0x1, [@IPVS_DEST_ATTR_TUN_PORT={0x6, 0xe, 0x4e24}, @IPVS_DEST_ATTR_U_THRESH={0x8, 0x5, 0x8}, @IPVS_DEST_ATTR_FWD_METHOD={0x8, 0x3, 0x2}, @IPVS_DEST_ATTR_TUN_PORT={0x6, 0xe, 0x4e23}, @IPVS_DEST_ATTR_FWD_METHOD={0x8, 0x3, 0x2}, @IPVS_DEST_ATTR_FWD_METHOD={0x8, 0x3, 0x2}, @IPVS_DEST_ATTR_TUN_FLAGS={0x6, 0xf, 0x2}, @IPVS_DEST_ATTR_PORT={0x6, 0x2, 0x4e21}]}]}, 0xd0}, 0x1, 0x0, 0x0, 0x4086}, 0x4008800) write(0xffffffffffffffff, &(0x7f00000004c0)="9dfaf99ab5f946b14484329b2d1c6cdc", 0x10) sendmsg$inet(r0, &(0x7f00000009c0)={&(0x7f00000000c0)={0x2, 0x4e24, @private=0xa010102}, 0x10, &(0x7f00000008c0)=[{&(0x7f0000000500)="6c09ec2b74696e4d91bd20a1cbe325fa0e480cfc36d3dd42dd1119ac85ee2d061af12bc6e873149aeba80f7fa5db885b503537c7c87402dcc3be860c3d4446e414f5e3c90317e132eaafc0dad50d618073a4f0bf65d88f738e1b163d39a4f3d8cb4045c2afd05d095a0ee78f450db1b1b4b0e88d4aa2fe4bd0e2a0c686ab952a36c9310c6323fd791df59a33564578493c6eee5a5a96a5efcf21344f6a157b8cbc683c8398e609b7779a34abc96733dff4479aa28f7a5a62e5fb9fcd76adc4a6a792c6e34e740dc0b2714bea671ed33f4c", 0xd1}, {&(0x7f0000000700)="cba5f54413b96606da3ae45609f115988c9d01ffea1c03b7c9b40779a85058c364c1c338381acbd462ddd709c91dccaf1bf1cadb185cce4d517601aa5ac16b2752f882b83a6a4296d0ff0a94bd00977a3ba579f3c96faddab27bf23b5748f7361e8bf0de638ded5a0651a4", 0x6b}, {&(0x7f0000000780)="c0912dd1da07dc6765b268c5c7e7f9ba0ac6", 0x12}, {&(0x7f00000007c0)="bb855418e00c0d261cdf4392686324832ab0c0ac10b8118e2f45c4f8aab2fb1f9f81f3b3f890e9bd175a348a3c6b97db219fe329681c2d3ecc7c95d7e0e2ea37957a75be2d39d3f1fe2c0e5cbaf38c4321675f76f5935a1fb3d963c0112ccb3e68a1ff0ada75b7e6a22e3ad817dcf3f48fb58e1b76b384e994fc2f3c31d269f11bea1a3725752019145b45003a0fbf7ec184587c16d737433f65f1815ba63d4fb6afd3a94e5ac700d85c4816de6efaebfa0169262ef75f57f4fe645022f4933b064a07b728", 0xc5}], 0x4}, 0x0) 2m29.475624308s ago: executing program 2 (id=14378): r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000680)={0x10, 0x4, &(0x7f0000000380)=ANY=[@ANYBLOB="1802000000c400000000000000000000850000003d00000095"], &(0x7f0000000200)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x4}, 0x94) bpf$BPF_PROG_QUERY(0x10, &(0x7f0000000140)={@ifindex, 0x2, 0x0, 0x9, &(0x7f0000000040)=[0x0, 0x0, 0x0], 0x3, 0x0, &(0x7f0000000080)=[0x0, 0x0, 0x0], &(0x7f00000000c0)=[0x0, 0x0], &(0x7f0000000100)=[0x0], 0x0}, 0x40) r2 = socket(0x200000000000011, 0x2, 0xd) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f00000000c0)={'syz_tun\x00', 0x0}) r4 = bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000480)=@bpf_tracing={0x1a, 0x1, &(0x7f00000001c0)=@raw=[@ldst={0x3, 0x3, 0x3, 0x7, 0x4, 0x2, 0x8}], &(0x7f0000000200)='syzkaller\x00', 0x9, 0x0, 0x0, 0x41000, 0x25, '\x00', 0x0, 0x1c, 0xffffffffffffffff, 0x8, &(0x7f0000000240)={0x7, 0x1}, 0x8, 0x10, &(0x7f0000000280)={0x5, 0xa, 0xe88, 0x1000}, 0x10, 0x39c8, 0xffffffffffffffff, 0x1, &(0x7f0000000340)=[0x1, 0x1, 0xffffffffffffffff, 0xffffffffffffffff], &(0x7f0000000380)=[{0x3, 0x2, 0x9, 0xb}], 0x10, 0x5}, 0x94) bpf$BPF_PROG_DETACH(0x9, &(0x7f0000000180)={@ifindex=r3, 0xffffffffffffffff, 0xa, 0x18, 0x0, @void, @value=r4, @void, @void, r1}, 0x20) r5 = openat$cgroup(0xffffffffffffffff, &(0x7f00000002c0)='syz1\x00', 0x200002, 0x0) bpf$BPF_LINK_CREATE(0x1c, &(0x7f0000000000)={r0, r5, 0x13, 0x0, @val=@tcx={@void, @value=r0, @void, @void, r1}}, 0x1c) 2m29.360937706s ago: executing program 2 (id=14379): r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='memory.events\x00', 0x275a, 0x0) r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$TIPC_CMD_SET_LINK_WINDOW(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, 0x0}, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000440)={0x1f, 0x13, &(0x7f0000000640)=ANY=[@ANYBLOB="1800000000000000000000000400000018010000756c6c2500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b70300000000000085000000bc000000180100002020692500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000f8ffff850000000400000095"], &(0x7f0000000040)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x11}, 0x94) r2 = socket(0x10, 0x3, 0x0) setsockopt$netlink_NETLINK_TX_RING(r2, 0x10e, 0xc, &(0x7f0000000040)={0x802}, 0x10) sendmsg$nl_generic(r2, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000000)=ANY=[@ANYBLOB="2c0000004a1e0000000a"], 0x28}, 0x1, 0x0, 0x0, 0x8004}, 0x4000010) sendmsg$nl_generic(r1, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000280)=ANY=[@ANYBLOB="2c0000003f00070100000000fddbdf25027c00001800378013000100717472283414d6bb", @ANYRES64=r2], 0x2c}, 0x1, 0x0, 0x0, 0xc880}, 0x0) bpf$BPF_PROG_ATTACH(0x8, &(0x7f0000000980)={@map, 0xffffffffffffffff, 0x22, 0x0, 0xffffffffffffffff, @void, @value=r0}, 0x20) r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) syz_emit_ethernet(0x3e, &(0x7f0000000180)={@local, @local, @void, {@ipv6={0x86dd, @udp={0x3, 0x6, "bb7a4e", 0x8, 0x11, 0x0, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02', @local, {[], {0x4e22, 0x4e22, 0x8}}}}}}, 0x0) r4 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r4, 0x8933, &(0x7f0000000100)={'wlan0\x00', 0x0}) r6 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$NL80211_CMD_SET_TX_BITRATE_MASK(r4, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000180)={0x2c, r6, 0x21, 0x72bd25, 0x0, {{}, {@val={0x8, 0x3, r5}, @void}}, [@NL80211_ATTR_TX_RATES={0x10, 0x5a, 0x0, 0x1, [@NL80211_BAND_2GHZ={0xc, 0x0, 0x0, 0x1, [@NL80211_TXRATE_HT={0x4}, @NL80211_TXRATE_LEGACY={0x4}]}]}]}, 0x2c}, 0x1, 0x0, 0x0, 0x24000000}, 0x0) sendmsg$nl_generic(r3, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000000)={0x14, 0x27, 0x1, 0x70bd29, 0x0, {0x6, 0x1}}, 0x14}}, 0xc000) 2m20.78117465s ago: executing program 33 (id=14315): r0 = syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10) sendmsg$netlink(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)=[{&(0x7f0000002740)=ANY=[@ANYBLOB="14000000130001ffffff7f8cd913e90002"], 0x14}], 0x1, 0x0, 0x0, 0x44100}, 0x0) pipe(&(0x7f0000000480)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000000040)=@ipv6_newroute={0x38, 0x18, 0x1, 0x70bd2a, 0x25dfdbfc, {0xa, 0x20, 0x10, 0x0, 0x2, 0x0, 0xff, 0x5, 0x2800}, [@RTA_GATEWAY={0x14, 0x5, @empty}, @RTA_PRIORITY={0x8, 0x1e, 0xa}]}, 0x38}, 0x1, 0x0, 0x0, 0x20048440}, 0x20000814) ioctl$int_in(r1, 0x5452, &(0x7f0000000240)=0x80000000) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='memory.events\x00', 0x275a, 0x0) mmap(&(0x7f0000002000/0x3000)=nil, 0x3000, 0x0, 0x12, r3, 0x0) r4 = bpf$PROG_LOAD(0x5, &(0x7f0000000240)={0x20, 0xb, &(0x7f0000000000)=ANY=[@ANYBLOB="18000000000000000000000000000000180100002020702500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000000000000b703000000000000850000007300000095"], &(0x7f0000000140)='syzkaller\x00', 0x0, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, @fallback=0x19, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, r3, 0x0, 0x0, 0x0, 0x0}, 0x94) r5 = socket$packet(0x11, 0x3, 0x300) sendmsg$IPSET_CMD_LIST(0xffffffffffffffff, &(0x7f00000000c0)={&(0x7f0000000000)={0x2d, 0x0, 0x0, 0x20}, 0xc, &(0x7f0000000080)={0x0}, 0x1, 0x0, 0x0, 0x40}, 0x40041) setsockopt$sock_attach_bpf(r5, 0x1, 0x32, &(0x7f0000000180)=r4, 0x4) r6 = socket$nl_route(0x10, 0x3, 0x0) write(r6, &(0x7f0000000100)='P\x00', 0x2) r7 = syz_init_net_socket$802154_raw(0x24, 0x3, 0x0) r8 = socket$nl_generic(0x10, 0x3, 0x10) r9 = syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10) sendmsg$netlink(r9, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000001080)=[{&(0x7f0000000a00)={0x14, 0x30, 0x1, 0x0, 0x25dfdbfc, "", [@nested={0x4, 0xf2}]}, 0x14}], 0x1, 0x0, 0x0, 0x1}, 0x0) sendmsg$nl_generic(r8, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000300)={0x1c, 0x27, 0x9, 0x70bd25, 0x25dfdbfd, {0x11}, [@typed={0x8, 0x1, 0x0, 0x0, @u32=0x2e}]}, 0x1c}, 0x1, 0x0, 0x0, 0x4000002}, 0x4000080) ioctl$sock_inet_SIOCSIFADDR(r7, 0x8916, 0x0) recvmsg(r0, &(0x7f00000001c0)={0x0, 0x0, 0x0}, 0x12000) r10 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r10, &(0x7f00000096c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000000c0)=@newtaction={0x50, 0x30, 0x20, 0x0, 0x0, {}, [{0x3c, 0x1, [@m_vlan={0x38, 0x1, 0x0, 0x0, {{0x9}, {0xc, 0x2, 0x0, 0x1, [@TCA_VLAN_PUSH_VLAN_PRIORITY={0x5, 0x6, 0x7}]}, {0x4}, {0xc}, {0xc}}}]}]}, 0x50}}, 0x0) bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000340)=ANY=[@ANYBLOB="02000000040000000800000001"], 0x48) r11 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000340)=ANY=[@ANYBLOB="02000000040000000800000001"], 0x48) bpf$MAP_DELETE_ELEM(0x3, &(0x7f00000000c0)={r11, &(0x7f0000000040)}, 0x20) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000400)={0x18, 0x13, &(0x7f00000004c0)=@raw=[@map_idx_val={0x18, 0xb, 0x6, 0x0, 0xc, 0x0, 0x0, 0x0, 0x10001}, @initr0={0x18, 0x0, 0x0, 0x0, 0x13, 0x0, 0x0, 0x0, 0x9}, @snprintf={{}, {}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0xc8}, {}, {}, {}, {}, {}, {}, {0x18, 0x3, 0x2, 0x0, r11}}, @generic={0x8a, 0xf, 0x4, 0xe, 0xb}, @kfunc={0x85, 0x0, 0x2, 0x0, 0x2}], &(0x7f0000000300)='GPL\x00', 0xa, 0xff8, &(0x7f0000001e00)=""/4088}, 0x94) 2m14.214486692s ago: executing program 34 (id=14379): r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='memory.events\x00', 0x275a, 0x0) r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$TIPC_CMD_SET_LINK_WINDOW(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, 0x0}, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000440)={0x1f, 0x13, &(0x7f0000000640)=ANY=[@ANYBLOB="1800000000000000000000000400000018010000756c6c2500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b70300000000000085000000bc000000180100002020692500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000f8ffff850000000400000095"], &(0x7f0000000040)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x11}, 0x94) r2 = socket(0x10, 0x3, 0x0) setsockopt$netlink_NETLINK_TX_RING(r2, 0x10e, 0xc, &(0x7f0000000040)={0x802}, 0x10) sendmsg$nl_generic(r2, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000000)=ANY=[@ANYBLOB="2c0000004a1e0000000a"], 0x28}, 0x1, 0x0, 0x0, 0x8004}, 0x4000010) sendmsg$nl_generic(r1, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000280)=ANY=[@ANYBLOB="2c0000003f00070100000000fddbdf25027c00001800378013000100717472283414d6bb", @ANYRES64=r2], 0x2c}, 0x1, 0x0, 0x0, 0xc880}, 0x0) bpf$BPF_PROG_ATTACH(0x8, &(0x7f0000000980)={@map, 0xffffffffffffffff, 0x22, 0x0, 0xffffffffffffffff, @void, @value=r0}, 0x20) r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) syz_emit_ethernet(0x3e, &(0x7f0000000180)={@local, @local, @void, {@ipv6={0x86dd, @udp={0x3, 0x6, "bb7a4e", 0x8, 0x11, 0x0, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02', @local, {[], {0x4e22, 0x4e22, 0x8}}}}}}, 0x0) r4 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r4, 0x8933, &(0x7f0000000100)={'wlan0\x00', 0x0}) r6 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$NL80211_CMD_SET_TX_BITRATE_MASK(r4, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000180)={0x2c, r6, 0x21, 0x72bd25, 0x0, {{}, {@val={0x8, 0x3, r5}, @void}}, [@NL80211_ATTR_TX_RATES={0x10, 0x5a, 0x0, 0x1, [@NL80211_BAND_2GHZ={0xc, 0x0, 0x0, 0x1, [@NL80211_TXRATE_HT={0x4}, @NL80211_TXRATE_LEGACY={0x4}]}]}]}, 0x2c}, 0x1, 0x0, 0x0, 0x24000000}, 0x0) sendmsg$nl_generic(r3, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000000)={0x14, 0x27, 0x1, 0x70bd29, 0x0, {0x6, 0x1}}, 0x14}}, 0xc000) 2.893329663s ago: executing program 5 (id=15517): r0 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000740)=ANY=[@ANYBLOB="02000000040000000800000001"], 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000004c0)={0x11, 0x10, &(0x7f0000000040)=@framed={{0x18, 0x5, 0x0, 0x0, 0x63, 0x0, 0x0, 0x0, 0xfffffffe}, [@snprintf={{}, {}, {}, {}, {}, {}, {}, {}, {}, {0x18, 0x3, 0x2, 0x0, r0}, {0x7, 0x0, 0xb, 0x4}, {0x85, 0x0, 0x0, 0x95}}]}, &(0x7f0000000000)='syzkaller\x00', 0xc000000, 0x0, 0x0, 0x0, 0x17, '\x00', 0x0, @fallback=0x26, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) 2.743454218s ago: executing program 5 (id=15520): socket$inet6_tcp(0xa, 0x1, 0x0) (async) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = accept$phonet_pipe(0xffffffffffffffff, &(0x7f0000000000), &(0x7f0000000100)=0x10) setsockopt$PNPIPE_HANDLE(r1, 0x113, 0x3, &(0x7f0000000140)=0xfffffc19, 0x4) (async) setsockopt$PNPIPE_HANDLE(r1, 0x113, 0x3, &(0x7f0000000140)=0xfffffc19, 0x4) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) (async) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) setsockopt$inet6_tcp_int(r0, 0x6, 0x13, &(0x7f0000000180)=0x100000001, 0x4) (async) setsockopt$inet6_tcp_int(r0, 0x6, 0x13, &(0x7f0000000180)=0x100000001, 0x4) connect$inet6(r0, &(0x7f0000000080)={0xa, 0x4e23, 0x1, @empty, 0x2}, 0x1c) setsockopt$inet6_tcp_TCP_ULP(r0, 0x6, 0x1f, &(0x7f0000000200), 0x3) socketpair(0x8, 0x800, 0x80, &(0x7f00000001c0)) (async) socketpair(0x8, 0x800, 0x80, &(0x7f00000001c0)={0xffffffffffffffff}) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) (async) r3 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r3, &(0x7f0000000080)={0x1f, 0xffff, 0x3}, 0x6) r4 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl80211(&(0x7f00000000c0), r4) sendmsg$NL80211_CMD_VENDOR(r4, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000c00)=ANY=[@ANYBLOB="38002000c4dde33567342911ffb09f80bf0bcfc07ba507f47b04344ee4d3dfdaba645a44314c21f545d09d14da92a6179cab6c98b7935872c50d0be60d38bcc9f1301ddd611eea5f06c314a689a0a463e1983355105d6c28a87e7d466e8fc5d8fe9e7b36e50d9fbfd2f51a9381d525da7a7b54cc5c29c0e3d15e2841a56bfce6d1d2ae72c50b68067e4be08cfbbfcad41a7eebf8b2d6a209f88ce86ebb0d5140b2fe719239c3347fba2b49aaac4d155bcb5518bd7f812b36701de7cca2fc2e34fe90ef1da2f247995d8b5a6ea99e136a1a261d2ead08d2b5c33d038270fc8bd8eb4f01684b9270883c87b99d553917ede1abe595594e0317432e78f395ab524642b5f867e378d356f0b99aa72b9ede452013", @ANYRES16=0x0, @ANYBLOB="010700000000fcdbdf256700000071ff0300", @ANYRES32=0x0, @ANYBLOB="f6fd99000800000029000000"], 0x38}}, 0x40) write(r3, &(0x7f0000000340)="18000000010003", 0x7) socket$alg(0x26, 0x5, 0x0) (async) r5 = socket$alg(0x26, 0x5, 0x0) bind$alg(r5, &(0x7f0000000540)={0x26, 'hash\x00', 0x0, 0x0, 'hmac(sha384)\x00'}, 0x58) r6 = socket$kcm(0x11, 0x3, 0x0) sendmsg$kcm(r6, &(0x7f0000000840)={&(0x7f0000000100)=@phonet={0x23, 0x5, 0xff, 0x13}, 0x80, &(0x7f0000000580)=[{&(0x7f0000000200)="88a872a1f721d2d10e81bb0d86dd", 0xe}], 0x1}, 0x890) r7 = accept4(r5, 0x0, 0x0, 0x800) accept4$bt_l2cap(r2, 0x0, 0x0, 0x80800) pipe(&(0x7f0000000000)={0xffffffffffffffff}) sendmsg$TIPC_NL_MEDIA_SET(r4, &(0x7f0000000780)={&(0x7f00000003c0)={0x10, 0x0, 0x0, 0x10}, 0xc, &(0x7f0000000740)={&(0x7f0000000640)=ANY=[@ANYBLOB="c8000000", @ANYRES16=0x0, @ANYBLOB="00042dbd7000fbdbdf250c000000900004800900010073797a31000000001300010062726f6164636173742d6c696e6b00001300010062726f6164636173742d6c696e6b00001300010062726f6164636173742d6c696e6b00001c000780080001001400000008000300af000000080002000e0000001300010062726f6164636173742d6c696e6b00001300010062726f6164636173742d6c696e6b00002400098008000200060000000800010008000000080002000900004008000100f8ffffff"], 0xc8}, 0x1, 0x0, 0x0, 0x4081}, 0x40000) close(r8) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x100000e, 0x13, r8, 0x0) openat$cgroup_ro(r8, &(0x7f0000000380)='blkio.bfq.io_service_bytes_recursive\x00', 0x0, 0x0) r9 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000480), r7) sendmsg$NL80211_CMD_DEL_INTERFACE(r3, &(0x7f00000005c0)={&(0x7f0000000440)={0x10, 0x0, 0x0, 0x8000000}, 0xc, &(0x7f0000000500)={&(0x7f00000004c0)=ANY=[@ANYBLOB="14000000", @ANYRES16=r9, @ANYBLOB="00042abd7000fedbdf25204549ac"], 0x14}, 0x1, 0x0, 0x0, 0x800}, 0x1) (async) sendmsg$NL80211_CMD_DEL_INTERFACE(r3, &(0x7f00000005c0)={&(0x7f0000000440)={0x10, 0x0, 0x0, 0x8000000}, 0xc, &(0x7f0000000500)={&(0x7f00000004c0)=ANY=[@ANYBLOB="14000000", @ANYRES16=r9, @ANYBLOB="00042abd7000fedbdf25204549ac"], 0x14}, 0x1, 0x0, 0x0, 0x800}, 0x1) sendmsg$NL80211_CMD_AUTHENTICATE(r2, &(0x7f0000000300)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x10000000}, 0xc, &(0x7f00000002c0)={&(0x7f0000000880)=ANY=[@ANYBLOB="10160a13f2cd14ae13f615217e69276e93d63f0ee00d18281fed4ea5edd8c9269d5d01ce0c55daccc21c1ec1bfc4c7c04d925821ab5d7d12ea2a7f299e0cc4895a298060a84d2f3c19fc8dcc6124f547e0e02b7350930c3629769afab86717d89c5624f3f4abe9bf9ca6b5be87bc4a94b7e70d03b236264cd309b4930a450c46489ceb2d9d55bfa6233e29161c5494925ceae78980d00268343c0960d8e8b71c2a788616339983d7a91d04382594bfa7960d43ca8122c59bf87f31cbb74b406cb0656558506991d751bb5141daf4f2dbd848e03f9d227f4582c827828865b3b84d95eea633b63e7a7fc7825cdb0b52c52ce757ab08f5b448dbb9f7b1", @ANYRES16=r9, @ANYBLOB="000227bd7000ffdbdf25250000000a00340001010101010100000a00060050505050505000000a0006005050505050500000"], 0x38}, 0x1, 0x0, 0x0, 0x20000080}, 0x4000010) (async) sendmsg$NL80211_CMD_AUTHENTICATE(r2, &(0x7f0000000300)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x10000000}, 0xc, &(0x7f00000002c0)={&(0x7f0000000880)=ANY=[@ANYBLOB="10160a13f2cd14ae13f615217e69276e93d63f0ee00d18281fed4ea5edd8c9269d5d01ce0c55daccc21c1ec1bfc4c7c04d925821ab5d7d12ea2a7f299e0cc4895a298060a84d2f3c19fc8dcc6124f547e0e02b7350930c3629769afab86717d89c5624f3f4abe9bf9ca6b5be87bc4a94b7e70d03b236264cd309b4930a450c46489ceb2d9d55bfa6233e29161c5494925ceae78980d00268343c0960d8e8b71c2a788616339983d7a91d04382594bfa7960d43ca8122c59bf87f31cbb74b406cb0656558506991d751bb5141daf4f2dbd848e03f9d227f4582c827828865b3b84d95eea633b63e7a7fc7825cdb0b52c52ce757ab08f5b448dbb9f7b1", @ANYRES16=r9, @ANYBLOB="000227bd7000ffdbdf25250000000a00340001010101010100000a00060050505050505000000a0006005050505050500000"], 0x38}, 0x1, 0x0, 0x0, 0x20000080}, 0x4000010) setsockopt$inet6_tcp_TLS_TX(r0, 0x11a, 0x1, &(0x7f0000000040)=@ccm_128={{0x303}, "0247da1041ba0e83", "bfa83cfb769ed72259454178b40196f6", "cec98c09", "5e5f40c08b26efd2"}, 0x28) (async) setsockopt$inet6_tcp_TLS_TX(r0, 0x11a, 0x1, &(0x7f0000000040)=@ccm_128={{0x303}, "0247da1041ba0e83", "bfa83cfb769ed72259454178b40196f6", "cec98c09", "5e5f40c08b26efd2"}, 0x28) writev(0xffffffffffffffff, &(0x7f0000000a80)=[{&(0x7f0000000ac0)="37d614adda8007817c6ce3191df4ba3c9fbbe89447f02b5ad1ab8cc713ef490f334c3e5934b6292c7598dd650f293de5283be84feeea64cebd2885352ee8b4ac73ee50ff614f22298c6fd34ec6d4ca66c18c95324eb02add622f074b96fc09f8cd5dcf7c6148c08692b9ee27930e293713426ba43de5c34548dd3836b2be569ded703a1964ffff2e337b3d7733fffe9d1d5eb4ced5917ef9025c5b92f2d56540f675cc5970731d80706b9cc88095844f9c4663e004b9c566a00e49c97341ac87cbf9735fd3ea04f218ccdb77dd4e6e88baae9d0e66acd2cb45e123f1a5a7dbb325166c711fa87c4bd112c0155840b711a12d27e3601926c62af4ff0a7dca6b61c851153454f01dd02ae0892ddb5f20d258fb9057", 0x114}, {&(0x7f00000009c0)="487490aa303447237ad9878ae194a8d99cba529b259108001cddfbf4a3740b20ef7cab3d8aca018b86f2959baa6b2c45a9a838e9363ad5303886933cced388435402772ade14bdbe866b073448ac7efcbf44c28d4d5dc699330ea0635374a99346df62c37d3c42a6b7f75a4a347d065722ebc80631b2124191e347ba4ec88cb3cf44eaadea13b43c2c7122f8b1e7d7a81a0f52012024913f7d08fb3d0589eca2a5bd593a154e4609f5", 0xa9}], 0x2) 2.607980417s ago: executing program 5 (id=15522): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) r1 = socket$kcm(0x2, 0xa, 0x2) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0xe}}) r2 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_int(r2, 0x107, 0x8, &(0x7f0000000100)=0x40049, 0x4) r3 = socket$unix(0x1, 0x2, 0x0) bind$unix(r3, &(0x7f0000000080)=@abs={0x1, 0x0, 0x4e24}, 0x6e) r4 = socket$can_j1939(0x1d, 0x2, 0x7) r5 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x2241, 0x0) ioctl$TUNSETIFF(r5, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x5005}) writev(r5, &(0x7f0000000240)=[{&(0x7f0000000140)="480000001400190d09004b", 0xb}, {0x0}], 0x2) r6 = socket$can_bcm(0x1d, 0x2, 0x2) connect$can_bcm(r6, &(0x7f0000000000), 0x10) sendmsg$can_bcm(r6, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000180)={0x4, 0x0, 0x400, {}, {}, {}, 0x1, @can={{}, 0x1, 0x0, 0x4, 0x0, "63bad47c2fbf2948"}}, 0x48}}, 0x0) r7 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r7, &(0x7f0000001100)={0x0, 0x0, &(0x7f0000001000)={&(0x7f0000002a40)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a01010000000000000000020000000900010073797a3000000000080002400000000350000000120a01010000000000000000020000000900010073797a3000000000070002006f303000080003400000000720000480060001000002000005000200110000000c000300080001000000001e50000000120a01010000000000000000020000000900010073797a3000000000070002006f303100080003400000000720000480060001000002000005000200110000000c000300080001000000001e50000000120a01010000000000000000020000000900010073797a3000000000070002006f303200080003400000000720000480060001000002000005000200110000000c000300080001000000001e50000000120a01010000000000000000020000000900010073797a3000000000070002006f303300080003400000000720000480060001000002000005000200110000000c000300080001000000001e50000000120a01010000000000000000020000000900010073797a3000000000070000006f303400080003400000000720000480060001000002000005000200110000000c000300080001000000001e50000000120a01010000000000000000020000000900010073797a3000000000070002006f303500080003400000000720000480060001000002000005000200110000000c000300080001000000001e50000000120a01010000000000000000020000000900010073797a3000000000070002006f303600080003400000000720000480060001000002000005000200110000000c000300080001000000001e50000000120a01010000000000000000020000000900010073797a3000000000070002006f303700080003400000000720000480060001000002000005000200110000000c000300080001000000001e50000000120a01010000000000000000020000000900010073797a3000000000070002006f303800080003400000000720000480060001000002000005000200110000000c000300080001000000001e50000000120a01010000000000000000020000000900010073797a3000000000070002006f303900080003400000000720000480060001000002000005000200110000000c000300080001000000001e50000000120a01010000000000000000020000000900010073797a3000000000070002006f313000080003400000000720000480060001000002000005000200110000000c000300080001000000001e50000000120a01010000000000000000020000000900010073797a3000000000070002006f313100080003400000000720000480060001000002000005000200110000000c000300080001000000001e50000000120a01010000000000000000020000000900010073797a3000000000070002006f313200080003400000000720000480060001000002000005000200110000000c000300080001000000001e50000000120a01010000000000000000020000000900010073797a3000000000070002006f313300080003400000000720000480060001000002000005000200110000000c000300080001000000001e50000000120a01010000000000000000020000000900010073797a3000000000070002006f313400080003400000000720000480060001000002000005000200110000000c000300080001000000001e50000000120a01010000000000000000020000000900010073797a3000000000070002006f313500080003400000000720000480060001000002000005000200110000000c000300080001000000001e50000000120a01010000000000000000020000000900010073797a3000000000070002006f313600080003400000000720000480060001000002000005000200110000000c000300080001000000001e50000000120a01010000000000000000020000000900010073797a3000000000070002006f313700080003400000000720000480060001000002000005000200110000000c000300080001000000001e50000000120a01010000000000000000020000000900010073797a3000000000070002006f313800080003400000000720000480060001000002000005000200110000000c000300080001000000001e50000000120a01010000000000000000020000000900010073797a3000000000070002006f313900080003400000000720000480060001000002000005000200110000000c000300080001000000001e50000000120a01010000000000000000020000000900010073797a3000000000070002006f323000080003400000000720000480060001000002000005000200110000000c000300080001000000001e50000000120a01010000000000000000020000000900010073797a3000000000070002006f323100080003400000000720000480060001000002000005000200110000000c000300080001000000001e50000000120a01010000000000000000020000000900010073797a3000000000070002006f323200080003400000000720000480060001000002000005000200110000000c000300080001000000001e50000000120a01010000000000000000020000000900010073797a3000000000070002006f323300080003400000000720000480060001000002000005000200110000000c000300080001000000001e50000000120a01010000000000000000020000000900010073797a3000000000070002006f323400080003400000000720000480060001000002000005000200110000000c000300080001000000001e50000000120a01010000000000000000020000000900010073797a3000000000070002006f323500080003400000000720000480060001000002000005000200110000000c000300080001000000001e50000000120a01010000000000000000020000000900010073797a3000000000070002006f323600080003400000000720000480060001000002000005000200110000000c000300080001000000001e50000000120a01010000000000000000020000000900010073797a3000000000070002006f323700080003400000000720000480060001000002000005000200110000000c000300080001000000001e50000000120a01010000000000000000020000000900010073797a3000000000070002006f323800080003400000000720000480060001000002000005000200110000000c000300080001000000001e50000000120a01010000000000000000020000000900010073797a3000000000070002006f3239000800034000000007200004800600010000020000050002000e0000000c0003"], 0xcd0}}, 0x0) ioctl$ifreq_SIOCGIFINDEX_vcan(r4, 0x8933, &(0x7f00000000c0)={'vcan0\x00', 0x0}) setsockopt$sock_int(r4, 0x1, 0x6, &(0x7f0000000040)=0x1, 0x4) connect$can_j1939(r4, &(0x7f0000000180)={0x1d, r8, 0x0, {0x0, 0xee}, 0xff}, 0x18) sendmsg$can_j1939(r4, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000280)="0807060504030201", 0x8}}, 0x0) recvmmsg(r2, &(0x7f0000000480)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f00000003c0)=""/11, 0x17}}], 0x400000000000179, 0x0, 0x0) 2.275793711s ago: executing program 7 (id=15528): sendmsg$BATADV_CMD_GET_NEIGHBORS(0xffffffffffffffff, &(0x7f0000004340)={0x0, 0x0, &(0x7f0000000280)={0x0, 0x1c}, 0x1, 0x0, 0x0, 0x4008000}, 0x4000000) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(0xffffffffffffffff, 0x8933, 0x0) sendmsg$BATADV_CMD_GET_HARDIF(0xffffffffffffffff, &(0x7f00000003c0)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x40}, 0x20000040) r0 = socket$inet_tcp(0x2, 0x1, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) socket$inet6_sctp(0xa, 0x5, 0x84) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f00000007c0)={'ip6gre0\x00'}) sendmsg$NL80211_CMD_JOIN_MESH(0xffffffffffffffff, &(0x7f0000000440)={0x0, 0x0, 0x0}, 0x0) sendmsg$NL80211_CMD_SET_WDS_PEER(0xffffffffffffffff, 0x0, 0x4080) bpf$MAP_CREATE(0x0, &(0x7f0000000100)=ANY=[@ANYBLOB="120000000400000008000000"], 0x50) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="18000000000000000000"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0xa, 0x4, &(0x7f0000000480)=ANY=[@ANYBLOB="1800"/11], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) socket$inet6_sctp(0xa, 0x1, 0x84) r2 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'lo\x00', 0x0}) sendmsg$nl_route(r1, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000200)=ANY=[@ANYBLOB="3c0000001400030500008000ffdbdf2502075bff", @ANYRES32=r3, @ANYBLOB="080002007f00000108000400ac1e000114"], 0x3c}, 0x1, 0x0, 0x0, 0xc090}, 0x0) ioctl$sock_inet_SIOCSIFADDR(r0, 0x8916, &(0x7f0000000180)={'lo\x00', {0x2, 0x4e21, @rand_addr=0x64010102}}) 1.900016005s ago: executing program 7 (id=15529): syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r0 = openat$nci(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$nfc(&(0x7f0000000100), r1) ioctl$IOCTL_GET_NCIDEV_IDX(r0, 0x0, &(0x7f00000000c0)=0x0) r4 = socket$nl_generic(0x10, 0x3, 0x10) r5 = syz_genetlink_get_family_id$batadv(&(0x7f0000000200), 0xffffffffffffffff) sendmsg$BATADV_CMD_GET_TRANSTABLE_LOCAL(r4, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)={0x14, r5, 0x701, 0x70bd2c, 0x25dfdbfc}, 0x14}, 0x1, 0x0, 0x0, 0x1}, 0x20000000) sendmsg$NFC_CMD_DEV_UP(r1, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000d80)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r2, @ANYBLOB="010426bd7000f8dbdf250200000008000100", @ANYRES32=r3], 0x1c}}, 0x4008054) write$nci(r0, &(0x7f0000000240)=ANY=[@ANYBLOB='p\x00\t'], 0xc) sendmsg$NLBL_MGMT_C_VERSION(r1, &(0x7f0000000380)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f0000000340)={&(0x7f0000000280)={0x84, 0x0, 0x400, 0x70bd2a, 0x25dfdbff, {}, [@NLBL_MGMT_A_PROTOCOL={0x8, 0x2, 0x5}, @NLBL_MGMT_A_IPV4MASK={0x8, 0x8, @private=0xa010100}, @NLBL_MGMT_A_IPV6MASK={0x14, 0x6, @mcast1}, @NLBL_MGMT_A_FAMILY={0x6, 0xb, 0x15}, @NLBL_MGMT_A_CV4DOI={0x8}, @NLBL_MGMT_A_IPV6MASK={0x14, 0x6, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}}, @NLBL_MGMT_A_PROTOCOL={0x8, 0x2, 0x7}, @NLBL_MGMT_A_DOMAIN={0x15, 0x1, '/dev/virtual_nci\x00'}, @NLBL_MGMT_A_IPV4MASK={0x8, 0x8, @remote}]}, 0x84}, 0x1, 0x0, 0x0, 0x20000000}, 0x8080) write$nci(r0, &(0x7f0000000dc0)=ANY=[@ANYBLOB="400104"], 0x14) r6 = socket(0x1e, 0x4, 0x0) write$nci(r0, &(0x7f0000000140)=ANY=[@ANYBLOB="5001", @ANYRES8=r1, @ANYRES16=r6], 0x14) 1.829591339s ago: executing program 0 (id=15532): r0 = bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000300)={0x6, 0x14, &(0x7f0000000040)=@ringbuf={{0x18, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x9}, {{0x18, 0x1, 0x1, 0x0, 0x1}}, {}, [@kfunc={0x85, 0x0, 0x2, 0x0, 0x1}, @exit, @kfunc={0x85, 0x0, 0x2, 0x0, 0x1}, @initr0={0x18, 0x0, 0x0, 0x0, 0x502, 0x0, 0x0, 0x0, 0x1}], {{}, {0x7, 0x0, 0xb, 0x2, 0x0, 0x0, 0x1}, {0x85, 0x0, 0x0, 0x84}}}, &(0x7f0000000100)='syzkaller\x00', 0x3f63, 0x0, 0x0, 0x41000, 0x22, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, &(0x7f0000000200)={0x8, 0x5}, 0x8, 0x10, &(0x7f0000000240)={0x1, 0x9, 0x0, 0x7f}, 0x10, 0x0, 0x0, 0x5, 0x0, &(0x7f0000000280)=[{0x5, 0x2, 0xc, 0x5}, {0x5, 0x1, 0x8, 0x3}, {0x4, 0x2, 0xb, 0x5}, {0x80003, 0x3, 0xe, 0x4}, {0x4, 0x2, 0x80e, 0x1}], 0x10, 0x6c2635f3}, 0x94) ioctl$OCFS2_IOC_UNRESVSP(r0, 0x40305829, &(0x7f0000000400)={0x3, 0x1, 0x5, 0x1, 0x5, 0x7}) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000140)={0x6, 0x5, &(0x7f0000000440)=@framed={{0x18, 0x2, 0x0, 0x0, 0xffbffffa, 0x0, 0x0, 0x0, 0x40}, [@call={0x85, 0x0, 0x0, 0xf}, @call={0x85, 0x0, 0x0, 0x11}]}, &(0x7f0000000000)='syzkaller\x00', 0x4, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @xdp, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x2}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000600)={r1, 0x0, 0xe, 0x0, &(0x7f00000003c0)="6f11ba816056a1827a33ae059cf3", 0x0, 0x1008, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x9}, 0x50) 1.760746546s ago: executing program 0 (id=15533): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000080)=ANY=[@ANYBLOB="3800000041000701fefffffffeffffff017c0000040042800c00018006000600800a000014000280100014800c0015"], 0x38}, 0x1, 0x0, 0x0, 0x4048011}, 0xc000) r2 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r2, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000300)=@updpolicy={0xb8, 0x19, 0x1, 0x70bd26, 0x0, {{@in=@multicast1=0xe0000002, @in, 0x0, 0x1, 0xfffd, 0x0, 0xa, 0x0, 0x0, 0x87}, {0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x20000000007, 0xfffffffffffffffb}, {0x0, 0x0, 0x0, 0xfffffffffffffffe}, 0x2}}, 0xb8}}, 0x10) sendmsg$nl_xfrm(r2, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000000)=@updpolicy={0xb8, 0x15, 0x1, 0x0, 0xfffffffe, {{@in=@multicast1=0xe0000002, @in6=@empty, 0x0, 0x0, 0x0, 0x0, 0xa, 0x10, 0x20}, {0x0, 0x1, 0x100, 0x0, 0x0, 0x9, 0xffffffff}, {}, 0x0, 0x6e6bb5}}, 0xb8}}, 0x0) sendmsg$IPSET_CMD_CREATE(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000044c0)={&(0x7f0000000000)={0x64, 0x2, 0x6, 0x101, 0x0, 0x0, {0x1, 0x0, 0xffff}, [@IPSET_ATTR_DATA={0x14, 0x7, 0x0, 0x1, [@IPSET_ATTR_HASHSIZE={0x8, 0x12, 0x1, 0x0, 0x5}, @IPSET_ATTR_BUCKETSIZE={0x5, 0x15, 0x9}]}, @IPSET_ATTR_PROTOCOL={0x5, 0x1, 0x6}, @IPSET_ATTR_FAMILY={0x5, 0x5, 0xa}, @IPSET_ATTR_REVISION={0x5}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}, @IPSET_ATTR_TYPENAME={0x15, 0x3, 'hash:ip,port,net\x00'}]}, 0x64}, 0x1, 0x0, 0x0, 0x4044081}, 0x0) 1.589583414s ago: executing program 7 (id=15534): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000340), 0xa2f01, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x6bf1c2d5adba8c32}) bind$inet6(0xffffffffffffffff, &(0x7f0000000080)={0xa, 0xe20, 0x7, @mcast1={0xff, 0x5}}, 0x1c) setsockopt$SO_BINDTODEVICE(0xffffffffffffffff, 0x1, 0x19, 0x0, 0x0) syz_emit_ethernet(0x42, &(0x7f0000000000)={@broadcast, @multicast, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x34, 0x0, 0x0, 0x0, 0x1, 0x0, @private=0xa010102, @local}, @redirect={0x3, 0x4, 0x0, @broadcast=0x1000000, {0x6, 0x4, 0x0, 0x0, 0x0, 0x68, 0x0, 0xff, 0x6c, 0x4, @multicast2, @remote, {[@timestamp_addr={0x44, 0x4, 0xf6}]}}}}}}}, 0x0) r1 = socket$nl_xfrm(0x10, 0x3, 0x6) r2 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r2, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000280)=ANY=[@ANYBLOB="b80000001300e9990000000000000000fc000000000000000100000000000000ac1e000100000000000000000000000000000000000000000a0060", @ANYRESOCT], 0xb8}}, 0x20040014) ioctl$sock_SIOCGPGRP(r1, 0x8904, &(0x7f0000000500)) sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000000)=@updpolicy={0xb8, 0x13, 0x100, 0x0, 0x25dfdbfb, {{@in6=@private0={0xfc, 0x0, '\x00', 0x1}, @in=@multicast2, 0x0, 0x4, 0x0, 0x0, 0xa, 0x60, 0x80, 0x3b, 0x0, 0xee01}, {0x0, 0x2, 0x0, 0x2000000000000, 0x40, 0xfffffffffffffdfd, 0x50}, {0x5}, 0x6, 0x40000000, 0x0, 0x1, 0x2}}, 0xb8}, 0x1, 0x0, 0x0, 0x80}, 0x50) sendmsg$nl_xfrm(r2, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000000)=ANY=[@ANYBLOB="b80000001300e9990000000000000000fc000000000000000100000000000000ac1e0001"], 0xb8}}, 0x20004000) sendmsg$nl_xfrm(r1, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000000)=ANY=[@ANYBLOB="b80000001300e9990000020000000000fc0000000000000000"], 0xb8}, 0x1, 0x0, 0x0, 0x80c0}, 0x0) sendmsg$nl_xfrm(r1, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000800)=ANY=[@ANYBLOB="b80000001300e9990500000000000000fc000000000000000000000000000000fc00000000000000000000000000000000000000000000000a0030"], 0xb8}}, 0x4000) unshare(0x2040600) vmsplice(0xffffffffffffffff, 0x0, 0x0, 0x1) r3 = socket$kcm(0x2, 0xa, 0x2) ioctl$SIOCSIFHWADDR(r3, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local}) r4 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000000), 0x3b14c0, 0x0) r5 = syz_init_net_socket$bt_l2cap(0x1f, 0x3, 0x3) ioctl$sock_SIOCINQ(r5, 0x541b, 0x0) ioctl$PPPIOCCONNECT(r4, 0x4004743a, &(0x7f0000000040)) getsockopt$inet_sctp_SCTP_PR_SUPPORTED(0xffffffffffffffff, 0x84, 0x71, &(0x7f0000000140)={0x0, 0x5}, &(0x7f00000001c0)=0x8) setsockopt$inet_sctp6_SCTP_ASSOCINFO(0xffffffffffffffff, 0x84, 0x1, &(0x7f0000000200)={r6, 0x7, 0x1, 0xfcfb, 0x4, 0x3ff}, 0x14) write$tun(r0, &(0x7f0000000280)=ANY=[@ANYBLOB="0a000000bbbbbbbbbbbbaaaaaaaaaa2986dd6d002008006411ff20010000000000000000000000000002ff0500000000000000000000000000014f194e20"], 0x9e) ioctl$TUNGETVNETLE(r0, 0x800454dd, &(0x7f0000000100)) 1.539804136s ago: executing program 0 (id=15535): r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000200)=ANY=[@ANYBLOB="140000003b00010324bd703a92dbdf250d000000"], 0x14}, 0x1, 0x0, 0x0, 0x4008}, 0x20040000) sendmsg$TIPC_NL_NET_GET(r0, &(0x7f0000000140)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x40095001}, 0xc, &(0x7f0000000100)={&(0x7f0000000080)={0x6c, 0x0, 0x400, 0x70bd2c, 0x25dfdbfd, {}, [@TIPC_NLA_MEDIA={0x18, 0x5, 0x0, 0x1, [@TIPC_NLA_MEDIA_NAME={0x7, 0x1, 'ib\x00'}, @TIPC_NLA_MEDIA_PROP={0xc, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_WIN={0x8, 0x3, 0x1}]}]}, @TIPC_NLA_NET={0x2c, 0x7, 0x0, 0x1, [@TIPC_NLA_NET_NODEID_W1={0xc, 0x4, 0x7}, @TIPC_NLA_NET_ADDR={0x8, 0x2, 0x7ff}, @TIPC_NLA_NET_ADDR={0x8, 0x2, 0x80000001}, @TIPC_NLA_NET_NODEID={0xc, 0x3, 0x4}]}, @TIPC_NLA_MON={0x4}, @TIPC_NLA_LINK={0x10, 0x4, 0x0, 0x1, [@TIPC_NLA_LINK_NAME={0x9, 0x1, 'syz0\x00'}]}]}, 0x6c}, 0x1, 0x0, 0x0, 0x24000040}, 0x1) syz_genetlink_get_family_id$devlink(&(0x7f0000000040), r0) 1.383563777s ago: executing program 1 (id=15538): r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000700)=ANY=[@ANYBLOB="3c020000190001000000000000000000fc0200000000000000000000000000000000000000000000000000000000000000000003000000000a00002008000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="00000000000000000100000000000000000000000000000000030000000000000000000000000000000000000000000000000000000000001d00000000000000000000000000000001000000000000000000000000000000dd020000000000000000000000000000000000000000000084010500ac141438000000000000000000000000000000002b00000000000000ac14140c000000000000000000000000000000000000ff00000000000000000000000000ffffffff000000000000000000000000000000003200000000000000000000000000000000000000000000000200000000000000000000000000000000000000ff020000000000000000000000000001000000003c00000002000000ac1414bb0000000000000000000000000000000001"], 0x23c}}, 0x0) 1.3670513s ago: executing program 5 (id=15539): ioctl$sock_bt_bnep_BNEPCONNDEL(0xffffffffffffffff, 0x400442c9, 0x0) ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8933, &(0x7f0000000540)={'wlan0\x00'}) r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$batadv(&(0x7f0000000300), r0) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r0, 0x8933, &(0x7f00000001c0)={'batadv0\x00', 0x0}) sendmsg$BATADV_CMD_GET_NEIGHBORS(r0, &(0x7f0000004340)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000640)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r1, @ANYBLOB="31032cbd7000fbdbdf250b00000008000300", @ANYRES32=r2], 0x1c}, 0x1, 0x0, 0x0, 0x4008010}, 0xc0) sendmsg$NL80211_CMD_NEW_KEY(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) r3 = socket$igmp(0x2, 0x3, 0x2) setsockopt$MRT_INIT(r3, 0x0, 0xc8, &(0x7f0000000080), 0x4) setsockopt$MRT_ADD_VIF(r3, 0x0, 0xca, &(0x7f0000003d80)={0x0, 0x4, 0x0, 0x0, @vifc_lcl_addr=@dev={0xac, 0x14, 0x14, 0x20}, @dev={0xac, 0x14, 0x14, 0xfd}}, 0x10) close(r3) 1.247316562s ago: executing program 1 (id=15540): r0 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000080)={'bridge0\x00'}) gettid() sendmsg$nl_route(r0, 0x0, 0x0) 1.246659851s ago: executing program 0 (id=15541): syz_emit_ethernet(0x5a, &(0x7f0000000080)={@local, @broadcast, @void, {@ipv6={0x86dd, @tcp={0x0, 0x6, "0200", 0x24, 0x6, 0x0, @initdev={0xfe, 0x88, '\x00', 0x1, 0x0}, @local, {[], {{0x8004, 0x4001, 0x41424344, 0x41424344, 0x0, 0x0, 0x9, 0x2, 0x100, 0x0, 0x0, {[@generic={0x13, 0x10, "9753d19222b83ecfdb6ebbe04c11"}]}}}}}}}}, 0x0) r0 = socket$nl_generic(0x10, 0x3, 0x10) (async) r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r1, 0x0, 0x0) (async) r2 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$IPVS_CMD_FLUSH(r0, &(0x7f0000000200)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x40000000}, 0xc, &(0x7f00000001c0)={&(0x7f0000001600)={0xb0, r2, 0x1da7b7b02c8526a0, 0x70bd25, 0x25dfdbfb, {}, [@IPVS_CMD_ATTR_SERVICE={0x30, 0x1, 0x0, 0x1, [@IPVS_SVC_ATTR_PE_NAME={0x8}, @IPVS_SVC_ATTR_FLAGS={0xc, 0x7, {0x12, 0x8}}, @IPVS_SVC_ATTR_PROTOCOL={0x6, 0x2, 0x87}, @IPVS_SVC_ATTR_SCHED_NAME={0x7, 0x6, 'fo\x00'}, @IPVS_SVC_ATTR_SCHED_NAME={0x8, 0x6, 'wrr\x00'}]}, @IPVS_CMD_ATTR_TIMEOUT_UDP={0x8, 0x6, 0x21af}, @IPVS_CMD_ATTR_TIMEOUT_UDP={0x8, 0x6, 0x6e}, @IPVS_CMD_ATTR_SERVICE={0x5c, 0x1, 0x0, 0x1, [@IPVS_SVC_ATTR_TIMEOUT={0x8, 0x8, 0x10001}, @IPVS_SVC_ATTR_FLAGS={0xc, 0x7, {0x1, 0x8}}, @IPVS_SVC_ATTR_FWMARK={0x8, 0x5, 0x4}, @IPVS_SVC_ATTR_ADDR={0x14, 0x3, @ipv6=@dev={0xfe, 0x80, '\x00', 0x39}}, @IPVS_SVC_ATTR_PE_NAME={0x8}, @IPVS_SVC_ATTR_FWMARK={0x8, 0x5, 0x2}, @IPVS_SVC_ATTR_SCHED_NAME={0x7, 0x6, 'rr\x00'}, @IPVS_SVC_ATTR_NETMASK={0x8, 0x9, 0x29}, @IPVS_SVC_ATTR_FWMARK={0x8, 0x5, 0x4}]}]}, 0xb0}, 0x1, 0x0, 0x0, 0x24008004}, 0x4020880) (async) bpf$PROG_LOAD(0x5, &(0x7f00000054c0)={0x3, 0x16, &(0x7f0000000e00)=ANY=[@ANYBLOB="61154c000000000061138c0000000000bfa000000000000007000000080000002d1501000000000095000000000000006916000000000000bf67000000000000350607000fff07206706000003000000160302000ee60060bf350000000000000f650000000000006507f9ff0100000007070000cddfffff1e75000000000000bf54000000000000070400000400f9ffad4301000000000095000000000000001500000000000000950000000000000032ed3c12dc8c27df8ecf264e0f84f9f17d3c30e32f1754558f2278af6d71d79a5e12814cb1d8a5d4601d295c45a6a0b9bdb7dd3997f9c9c4f6f3be4b369289aa6812b8e007e733a9a4f1b0af3dda82ee45a010fb94fe9de57b9d8a814261bdb94a05000000c6c60bf70d742a81762bab8395fa64810b5b40d893ea8fe0185473d51b546cad3f1d5ab2af27546e7c955ccefa1f6ab689b555202da2e0ec2871b4a7e65836429a527dc47ebe84a423b6c8d345dc8da3085b0ab71ca1b901627b562ed04ae76002d4519af619e3cca4d69e0dee5eb106774a8f3e6916dfec88158f0200000000c8fb730a5c1bf2b2bb71a629361997a75fd552bdc206438b8ef4901fd03c16dfda44e2a2235c8ac86d8a297dff0445a15f21dc725f431bcab0ef59b8f0e431e56723888fb126a163f16f920ae2fb494059bba8e3b680324a188076eb685d55c4e9b2ad9bc1172ba7cbebe174aba210d739a018f9bbec63222d20cecac4d03723f1c932b3a6aa0100000000000000b93716d20000009f0f53acbb40b4f8e2738270b31562ed834f2af97787f696649a462e7ee4bcf8b07a10d6735154beb4000000000000000000000000004000bc00f679629709e7e78f4ddc211bc3ebe6bd9d42ca0140a7afaab43176e65ec1118d50d1e827f3472f4445d253880800000000000000690884f800031e03a651bb96589a7e2e509bcc1d161347623cb5e7ac4629c8ab04871bc47287cd31cc43010000007b40407d000000210000000000000000005f37d83f84e98a523d80bd970d703f37ca364a601ae899a56715a0a62a34c6c94cce6994521629ab028acfc1d926a0f6a5489af8dc2f17923f3c40dfd1970a55c22fe3a5ac000000000000000000000000000000c1eb2d91fb79ea00000000000000bb0d00000000000000000000e4007be511fe32fbc90e2364a55e9bb66ac64423d2d00fea2594e190deae46e26c596f84eba9000000000000003cc3aa39ee4b1386bab561cda886fa642994cacd473b543ccb5f0d7b63924f17c67b13631d22a11dc3c693962895496d4ffcae1a8a793a7795a9214a92f66e9cc54db6c7205a6b068fff496d2da7d632bd1f61b007e1ff5f1be1969a1ba791ad46d800000000c7f26a0337302f3b41eae59809fd05d12f6186f117b062df67d3a63f3265dd1410eea68208a3f26b2989b832d8b34a34a4f08b34b3042065acaa10856e858d27adee7daf32903d3fc78700d429a2d4c8b6d803eb83eecfe4c7ff9e6ab5a52e83d089dad7a8710e0254f1b11cced7bc3c8da0c44d2ebf9f6f3ff3be4d1458077c2253b0c7c7a0a9fdd63bf910dc20e5cb2a88e59febc47f1212a21f631dbaa74f22bad050e9856b48ae3a03a497c37758537650fe6db88aa3c41fdc3d78e046f6160e1741299e8dc29906870e6431ed1eab5d067a183f064b060a8ec12725d42e3a74863d66bee966b1574f8e01b3f34a267ff0afa1e1c758a0079b747067312e9815a21cb3f1f8150d999d788535a4d3114dbc7e2bf2402a75fd7a55733360040855ed5d1c0d634fc5fb38f84d9d87b27f8a5d91217b728f13e3ee20e69e0ffb2780b1a7af137ff7b4ff139604faf0a4da65396174b4563d54b52f06c870edf0c5d744b5272b44c23488b2bdbff947c4dfa108cbb88202eeb81f428a5b3c299848649e1a6bff52f657a67463d7dbf85ae9321fc2b517dc4a29b9cba8ded5de8206c812439ab129ae818837ee1562078fc524b3baf49a0be9bb7d958d5e87c6c09bf71a894bad62934782cc3086936d7637e07c4a2a3bc87b0da23c00d9ef418cf19e7a8c4c328be0ce91798adc2dca871073f6bd61dc18402cde8bf777b2eaa45c940aabc86b94f8cbde4d470667bee722a6a2af483ad0d3415ed0f9db009acaba9eaea93f811d434e00000000000000000000d154baa8e51489a614e69722bac30000000000000000000000000000a006b178438e930b2494db1bf624a70a19a45b8b71869afb13cb2ac1d2f3ec0d93a3e4fd0ad076c7d826f218aa6ba8ec5e58b7c64dc8616127087901dc65418a4b25bfa7ae8b5ad9642815f319230425e8bd89c6983d816d97d81a739917eecd26f9a3aecaf0acdaf6cffab38eae3b10b122b4bf521a46bf01a0c136f745113b589459fbe1666087a7c554a55e2b42ab7e405a77f405a348a64e356b7fb61e48ea9c87bf13f97052c51fdd49f3dbccf9874cf61807ae4b1665ccdd026d4580a068395e8cb851eeadb1da6d1009513ca73a685c66fb15f27eb74a7a4eb5966e3ef4be3ca8ba81b2d17d797265390ce616c3d7b566fe956fb93c6a43f4dc6bfc194daeb7b998d550773bc14aca"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sched_cls, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0xffffffffffffffd2}, 0x48) (async) r3 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r3, &(0x7f00000029c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000100)=ANY=[@ANYBLOB="200000001000010700000000daa000000a0000000c0002006e6c383032313100"], 0x20}}, 0x0) (async) r4 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f00000004c0)=ANY=[@ANYBLOB="1b0000000000000000000000000004"], 0x50) bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x6, 0x10, &(0x7f0000000000)=@ringbuf={{0x18, 0x8}, {{0x18, 0x1, 0x1, 0x0, r4}, {}, {0x7, 0x0, 0xb, 0x6, 0x0, 0x0, 0xffffff1f}, {0x85, 0x0, 0x0, 0x5}}, {{0x6, 0x0, 0x2}}, [@alu={0x4, 0x1, 0x2, 0x8, 0x9}], {{0x7, 0x1, 0xb, 0x8}, {0x6, 0x0, 0x5, 0x8}, {0x85, 0x0, 0x0, 0x7}}}, &(0x7f0000000980)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x42, '\x00', 0x0, @fallback=0x2f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) (async) socket$kcm(0x29, 0x5, 0x0) (async) recvmmsg(r3, &(0x7f0000001b40)=[{}], 0x1, 0x0, 0x0) (async) r5 = socket$netlink(0x10, 0x3, 0x10) (async) r6 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000040), r0) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r5, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000006800)={&(0x7f0000000100)=ANY=[@ANYBLOB='D\x00\x00\x00', @ANYRES16=r6, @ANYBLOB="15060000f2ff01000000010000003000018014000400ff010000000000000000000000000001060005004e220000060001000a000000080006000100"], 0x44}, 0x5}, 0x0) (async) bpf$MAP_UPDATE_BATCH(0x1a, &(0x7f0000000000)={0x0, 0x0, 0x0, &(0x7f0000010040)}, 0x38) (async) sendmsg$IPSET_CMD_CREATE(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000500)=ANY=[@ANYBLOB="1c0000000206f5ffffff0300800000000000b00ad818de30558a0000480d3de53f5b54d2ae69681b115423539731c76849abd5116dda4430bc48419d4c3f7de94bb90ce007e574d1160b38be0c0fa84dd80e7ce1c9eaffc86550901e2c6f54af55a9c78b004300000000000000000000000000d7d44800edbb2836067f1107ba7f7f13f65e47864c2b8bbd1553e2b6864429c962"], 0x1c}, 0x1, 0x0, 0x0, 0x4000}, 0x4000) (async) bpf$PROG_LOAD(0x5, &(0x7f0000000240)={0x1a, 0x0, 0x0, 0x0, 0x80000002, 0x57, 0x0, 0x0, 0x0, '\x00', 0x0, @tracing=0x1c, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, &(0x7f0000000000)={0x0, 0x1000, 0x0, 0xde0}, 0x10, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x10, 0x6}, 0x94) (async) bpf$PROG_LOAD(0x5, &(0x7f0000000300)={0x5, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0xd, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x8}, 0x94) (async) r7 = socket$inet6_mptcp(0xa, 0x1, 0x106) (async) socket$xdp(0x2c, 0x3, 0x0) (async) r8 = socket$nl_generic(0x10, 0x3, 0x10) (async) r9 = socket$can_bcm(0x1d, 0x2, 0x2) connect$can_bcm(r9, &(0x7f0000000080), 0x10) ioctl$ifreq_SIOCGIFINDEX_vcan(r8, 0x8933, &(0x7f00000000c0)={'vxcan1\x00', 0x0}) sendmsg$can_bcm(r9, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000000400)=ANY=[@ANYBLOB="05"], 0x48}}, 0x80) (async) sendmsg$can_bcm(r9, &(0x7f00000002c0)={&(0x7f0000000000)={0x1d, r10}, 0x10, &(0x7f0000000280)={&(0x7f0000000140)=ANY=[@ANYRES32=r9], 0x48}, 0x1, 0x0, 0x0, 0x80}, 0x0) (async) listen(r7, 0x0) 1.244417068s ago: executing program 7 (id=15542): syz_emit_ethernet(0x4e, &(0x7f0000000b40)={@local, @remote, @void, {@ipv4={0x800, @tcp={{0xb, 0x4, 0x0, 0x0, 0x40, 0x0, 0x0, 0x0, 0x5, 0x0, @dev, @rand_addr=0x64010102, {[@timestamp_addr={0x44, 0xc, 0x5, 0x3, 0x0, [{@initdev={0xac, 0x1e, 0x0, 0x0}, 0x9}]}, @ssrr={0x89, 0x7, 0x77, [@local]}, @generic={0x7, 0x2}]}}, {{0x4, 0x0, 0x41424344, 0x41424344, 0x0, 0x6, 0x5}}}}}}, 0x0) r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$TIPC_NL_NET_SET(r0, &(0x7f0000000840)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x8000000}, 0xc, &(0x7f0000000800)={&(0x7f0000000640)={0x1c0, 0x0, 0x400, 0x70bd2d, 0x25dfdbfe, {}, [@TIPC_NLA_PUBL={0x2c, 0x3, 0x0, 0x1, [@TIPC_NLA_PUBL_TYPE={0x8, 0x1, 0x4}, @TIPC_NLA_PUBL_TYPE={0x8, 0x1, 0x7}, @TIPC_NLA_PUBL_UPPER={0x8, 0x3, 0x6808f2bd}, @TIPC_NLA_PUBL_TYPE={0x8, 0x1, 0x6}, @TIPC_NLA_PUBL_LOWER={0x8, 0x2, 0x7}]}, @TIPC_NLA_BEARER={0xd4, 0x1, 0x0, 0x1, [@TIPC_NLA_BEARER_PROP={0xc, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x16}]}, @TIPC_NLA_BEARER_PROP={0x1c, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x17}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0xc563}]}, @TIPC_NLA_BEARER_NAME={0x12, 0x1, @l2={'ib', 0x3a, 'netdevsim0\x00'}}, @TIPC_NLA_BEARER_DOMAIN={0x8, 0x3, 0xffff}, @TIPC_NLA_BEARER_DOMAIN={0x8, 0x3, 0x75d}, @TIPC_NLA_BEARER_DOMAIN={0x8, 0x3, 0x5}, @TIPC_NLA_BEARER_NAME={0xd, 0x1, @l2={'eth', 0x3a, 'sit0\x00'}}, @TIPC_NLA_BEARER_DOMAIN={0x8, 0x3, 0xe4b0}, @TIPC_NLA_BEARER_UDP_OPTS={0x2c, 0x4, {{0x14, 0x1, @in={0x2, 0x4e23, @local}}, {0x14, 0x2, @in={0x2, 0x4e24, @local}}}}, @TIPC_NLA_BEARER_UDP_OPTS={0x38, 0x4, {{0x14, 0x1, @in={0x2, 0x4e21, @rand_addr=0x64010102}}, {0x20, 0x2, @in6={0xa, 0x4e20, 0x6, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, 0x3}}}}]}, @TIPC_NLA_MEDIA={0xac, 0x5, 0x0, 0x1, [@TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'udp\x00'}, @TIPC_NLA_MEDIA_NAME={0x7, 0x1, 'ib\x00'}, @TIPC_NLA_MEDIA_PROP={0xc, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_TOL={0x8, 0x2, 0x8}]}, @TIPC_NLA_MEDIA_PROP={0x2c, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x1c}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x80000000}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x4}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x2}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x7}]}, @TIPC_NLA_MEDIA_PROP={0x24, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_WIN={0x8, 0x3, 0x4}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x5}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x8}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x7}]}, @TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'eth\x00'}, @TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'eth\x00'}, @TIPC_NLA_MEDIA_NAME={0x7, 0x1, 'ib\x00'}, @TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'eth\x00'}, @TIPC_NLA_MEDIA_PROP={0x1c, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_TOL={0x8, 0x2, 0x5}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0xd}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x1d}]}]}]}, 0x1c0}, 0x1, 0x0, 0x0, 0x8000}, 0x4000004) syz_genetlink_get_family_id$nl80211(&(0x7f0000000000), r0) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f0000000340)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a3c000000090a010400000000000000000a0000040900010073797a310000000008000540000000020900020073797afc3c0000000c0a010100000000000000000a0000060900020073797a31000000000900010073797a310000000010b615cd89f1b3621c000340000000022c00b3120e0a1f0200000000000000000a0000000900010073797a31000000000900020073797a310000000014000000110001"], 0xcc}}, 0x8001) sendmsg$TIPC_NL_MON_GET(0xffffffffffffffff, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000440)={&(0x7f0000000300)=ANY=[@ANYBLOB="28f80100", @ANYRES16, @ANYBLOB="04002abd7000fedbdf251200000014010180170001006574683a6261746164765f736c6176655f3100004c0002800800030009000000080002000c000000080002008a7b0000080002000500000008000400ff0000000800030000000000080002000104000008000300090000000800030000000100380004001400010002004e21ac1e01010000000000000000200002000a004e2100000009000000000000000000000000000000010c00000008000300040000003400028008000100"], 0x128}, 0x1, 0x0, 0x0, 0x4000}, 0x10) r1 = syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10) sendmsg$netlink(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f00000000c0)=[{&(0x7f0000000340)=ANY=[@ANYBLOB="180100003000010003000000fbdbdf2506"], 0x118}], 0x1, 0x0, 0x0, 0x1}, 0x0) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x2, 0x31, 0xffffffffffffffff, 0x0) r2 = socket$phonet_pipe(0x23, 0x5, 0x2) ioctl$sock_ifreq(r2, 0x8931, &(0x7f0000000080)={'virt_wifi0\x00', @ifru_names='ip6_vti0\x00'}) ioctl$sock_proto_private(r2, 0x8b22, &(0x7f0000000080)) r3 = socket$xdp(0x2c, 0x3, 0x0) pipe(&(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) splice(r7, 0x0, r5, 0x0, 0xf3a, 0x0) close(0x4) tee(r4, r8, 0x8f5, 0xb) ioctl$sock_inet_udp_SIOCINQ(r4, 0x541b, 0x0) write(r6, 0x0, 0x0) getsockopt$XDP_STATISTICS(r3, 0x11b, 0x7, &(0x7f0000001f40), &(0x7f00000022c0)=0x30) r9 = socket$kcm(0x29, 0x0, 0x0) setsockopt$SO_BINDTODEVICE_wg(r0, 0x1, 0x19, &(0x7f0000000080)='wg1\x00', 0x4) getsockopt$kcm_KCM_RECV_DISABLE(r9, 0x119, 0x1, &(0x7f0000000040), 0x4) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f00000004c0)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_SET_CQM(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000600)={&(0x7f0000000140)=ANY=[@ANYBLOB='L\x00\x00\x00', @ANYRESHEX=r3, @ANYRESDEC=0x0, @ANYRES32=r10, @ANYBLOB="00000091320000000002a6f42bef461c1044db1ced803400"], 0x4c}, 0x1, 0x0, 0x0, 0x4080}, 0x44000) 1.190518819s ago: executing program 6 (id=15543): r0 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000240)={0x2, 0x4, 0x8, 0x1, 0x80, 0x0, 0x0, '\x00', 0x0, 0x0}, 0x48) bpf$MAP_LOOKUP_BATCH(0x18, &(0x7f0000001f00)={&(0x7f0000000000)="80f8ffb5d5afecaa0167a0e31d60bdc75dcb61639f36da66fb361cc6cb4e726ac2df2540c7d25204dd4bf072f619ad5883f0aec6e1ba221dfa3d0b34acadadfa7ee55478e700fd77d419ce6d9da025de3eb091339a885c22c0aa1cb3e54ee098402f1c2833e03204c116abbe", &(0x7f0000000e00)=""/4096, &(0x7f0000001e00)="01750fb60e1b5dfa73f9272a02ce56a7e119c0675c4ade526e9b0ff90d9577e35c9f4ddf6e77a32dd5ff11efb482fc7fadfc072c868fce73e117ff05", &(0x7f0000001e40)="131e7311fcbf5317b82cc25dabb931c13879f19c1e30b41227b5f67d3efca6459352760957573026ce5bc3817d62022a7fc0abf82c0fdea94bf7a7eba282e4db84cbae5dde566bae6b842c6817ebb47aa79b9957dcb06c3551f106ecf6a84753f9351aeaf3b69d1a6a82667ab40f60a9c006aea9997522ab11a94961d6ba0c7b95de50ba9b28db96178890b60a1d95c5699c27b270", 0xb4, r0}, 0x38) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r1, 0x29, 0x40, &(0x7f0000001a00)=@filter={'filter\x00', 0x4, 0x4, 0x440, 0xffffffff, 0xd0, 0x1d8, 0xd0, 0xfeffffff, 0xffffffff, 0x370, 0x370, 0x370, 0xffffffff, 0x4, 0x0, {[{{@uncond, 0x2f2, 0xa8, 0xd0}, @REJECT={0x28, 'REJECT\x00', 0x0, {0x3}}}, {{@uncond, 0x0, 0xa8, 0x108}, @common=@inet=@HMARK={0x60, 'HMARK\x00', 0x0, {@ipv4=@multicast2, [0xff, 0xffffff00, 0xff], 0x4e20, 0x4e21, 0x4e21, 0x4e22, 0x5, 0x1, 0x9, 0x0, 0x1}}}, {{@ipv6={@private0, @loopback, [0xff, 0x0, 0xff000000, 0xffffffff], [0xff, 0xff, 0xff000000, 0xffffff00], 'team0\x00', 'batadv_slave_0\x00', {0xff}, {}, 0xff, 0xe7, 0x4}, 0x0, 0x138, 0x198, 0x0, {}, [@common=@srh1={{0x90}, {0x0, 0x26, 0x8, 0x8, 0x7, @ipv4={'\x00', '\xff\xff', @rand_addr=0x64010102}, @local, @private2={0xfc, 0x2, '\x00', 0x1}, [0xffffff, 0xffffff00, 0xff, 0xff], [0xffffffff, 0xffffff00, 0xff, 0xff000000], [0xff000000], 0x72, 0x1674}}]}, @common=@inet=@HMARK={0x60, 'HMARK\x00', 0x0, {@ipv4=@private=0xa010100, [0xffffff00, 0x0, 0xffffffff, 0xffffff00], 0xce24, 0x4e21, 0x4e21, 0x4e23, 0x8a, 0xffff, 0x5, 0x2, 0x3fd}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x4a0) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$nl_netfilter(r2, &(0x7f0000000740)={0x0, 0x0, &(0x7f0000000700)={&(0x7f00000005c0)={0x14, 0xf, 0xa, 0x201, 0x70bd28, 0x25dfdbfc, {0xe, 0x0, 0x4}}, 0x14}, 0x1, 0x0, 0x0, 0x8810}, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000840)={0x3, 0xf, &(0x7f0000000d80)=@ringbuf={{0x18, 0x8, 0x0, 0x0, 0xffb0, 0x0, 0x0, 0x0, 0xfffffff9}, {{0x18, 0x1, 0x1, 0x0, r0}, {}, {}, {0x85, 0x0, 0x0, 0x5}, {0x7, 0x1, 0xb, 0x9, 0x0, 0x20}}, {{0x5, 0x0, 0x3, 0x9, 0x0, 0x1, 0x600}}, [], {{0x5, 0x1, 0x7, 0x8}, {0x6, 0x0, 0x5, 0x8, 0x0, 0x0, 0x2}, {0x85, 0x0, 0x0, 0x5}}}, &(0x7f0000000980)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback=0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) ioctl$sock_kcm_SIOCKCMCLONE(0xffffffffffffffff, 0x89e2, &(0x7f0000000080)={r1}) r3 = socket$nl_generic(0x10, 0x3, 0x10) r4 = getuid() sendmsg$nl_generic(r3, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000100)={&(0x7f00000009c0)=ANY=[@ANYBLOB="700100003d00070125bd7000fbdbdf25067c3f005201358089a70da2a2d71a9b0fd89fb415417e6e07bf23823bb3a968c6c9c2c761d7debf40d64be3e1737d0eb2bee8979cd8bfb67b53555b6ae3a1ec00fcb6cccc7f680382664e573adeb7ea48ff08b09510558e19a90e54a7ba3d4d271ff657720350cb767d89739b72d885db80369ee82817d6d4bb2f5d6ee51da0ccc7ef58036aaf91d795fa46c27540ce0c4a7e88cf3e3260c668550235445bf31484f1cec1190df259be55c0ab9d669a288b8eceaf1731fa42fb460e0000000163ce2bdab984d6c1e303bc841c457122c813079a6d522a570b07284e8925ff7f877502c0efadf354b77a771973b47a6443fb048b7bc6328fc875997c668acea34a0d8a02427bb855ff28650c5997653f5f02966d07c3154afb299bdead97eacc8f13dc895ab30209c7f80cab357258904e07838e585ff1acfe8267450cd84cbc45854b6943d325b983b2c0f8e1605f48d473703ecd04000008004c0063990ef0b2d881523319baea2bfc751da5d7d1ac604bb4d6fe56c6a61094129b14c54c290c6eaf", @ANYRES64=r3, @ANYBLOB], 0x170}, 0x1, 0x0, 0x0, 0x4040895}, 0x20040010) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r6 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r6, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000940)={&(0x7f00000013c0)=ANY=[@ANYBLOB="640000001000030400"/20, @ANYRES32=0x0, @ANYBLOB="e5fda988000000002800128009000100766c616e00000000180002800c000200060000001f000000060001000000000008000500", @ANYRES32=r5], 0x64}, 0x1, 0x0, 0x0, 0x8811}, 0x0) bpf$MAP_CREATE(0x0, &(0x7f00000003c0)=ANY=[@ANYBLOB="0b00000008000000040000800800000001000000", @ANYRES32, @ANYBLOB="feffffff00"/20, @ANYRESOCT=r4, @ANYRESHEX=r7, @ANYBLOB="0000000000000000007d9ef07900"/28], 0x50) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000001340)={0x0, 0x0, 0x0}, &(0x7f0000001380)=0xc) sendmmsg$unix(0xffffffffffffffff, &(0x7f0000002f40)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f0000001580)=[@rights={{0x18, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff]}}, @rights={{0x14, 0x1, 0x1, [0xffffffffffffffff]}}, @cred={{0x1c, 0x1, 0x2, {r8, r9, r10}}}], 0x50, 0x40800}}], 0x1, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) getsockopt$sock_cred(r11, 0x1, 0x11, &(0x7f0000001340)={0x0, 0x0, 0x0}, &(0x7f0000001380)=0xc) sendmmsg$unix(r11, &(0x7f0000002f40)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f0000001580)=[@rights={{0x18, 0x1, 0x1, [r12, r12]}}, @rights={{0x14, 0x1, 0x1, [r12]}}, @cred={{0x1c, 0x1, 0x2, {r13, r14, r15}}}], 0x50, 0x40800}}], 0x1, 0x0) 1.039825007s ago: executing program 1 (id=15544): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x8080}, 0x20004450) sendmsg$NFT_BATCH(r0, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f0000000bc0)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x5}}, [@NFT_MSG_NEWRULE={0x74, 0x6, 0xa, 0x401, 0x0, 0x0, {0xa, 0x0, 0x1}, [@NFTA_RULE_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_RULE_EXPRESSIONS={0x48, 0x4, 0x0, 0x1, [{0x44, 0x1, 0x0, 0x1, @payload={{0xc}, @val={0x34, 0x2, 0x0, 0x1, [@NFTA_PAYLOAD_LEN={0x8, 0x4, 0x1, 0x0, 0xfe}, @NFTA_PAYLOAD_OFFSET={0x8, 0x3, 0x1, 0x0, 0x2c}, @NFTA_PAYLOAD_SREG={0x8, 0x5, 0x1, 0x0, 0x14}, @NFTA_PAYLOAD_BASE={0x8}, @NFTA_PAYLOAD_CSUM_FLAGS={0x8, 0x8, 0x1, 0x0, 0x1}, @NFTA_PAYLOAD_CSUM_TYPE={0x8}]}}}]}, @NFTA_RULE_CHAIN={0x9, 0x2, 'syz2\x00'}]}], {0x14}}, 0x9c}, 0x1, 0x0, 0x0, 0x20004000}, 0x24004854) bpf$PROG_LOAD(0x5, &(0x7f0000000440)={0x13, 0x6, &(0x7f0000000000)=@framed={{0x5, 0x0, 0x0, 0x0, 0x0, 0x73, 0x11, 0x6f}, [@func={0x85, 0x0, 0x1, 0x0, 0x2}, @call={0x85, 0x0, 0x0, 0xc4}, @exit], {0x95, 0x0, 0x5a5}}, &(0x7f0000000080)='GPL\x00', 0x5, 0x29e, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x6}, 0x70) 932.545206ms ago: executing program 1 (id=15545): socket$packet(0x11, 0x2, 0x300) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0x5001}) r1 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_inet_SIOCSIFFLAGS(r1, 0x8914, &(0x7f0000000200)={'syzkaller1\x00', 0x1}) write$tun(r0, &(0x7f0000000240)=ANY=[@ANYBLOB="02031b005500140006006332c5ab00d82fff00000000000000000000000000000000ff02000000000000000000d400000001"], 0x10a) 922.786032ms ago: executing program 6 (id=15546): r0 = syz_genetlink_get_family_id$nl80211(&(0x7f00000003c0), 0xffffffffffffffff) r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL80211_CMD_NEW_KEY(r1, &(0x7f00000006c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000007c0)=ANY=[@ANYBLOB='d\x00\x00\x00', @ANYRES16=r0, @ANYBLOB="010800000f9bff2adf250b00000008000300ceb6378e0a87e2f6d01e57fa9a8ccc385155450e8bacfb10733c90ae87cce762825499db7f8222a8c2d7c92cea9c91b0c3509c2b45d2a30726e944117add6a114b87b633933eb23bc94c4a7ccc2ad24254ab43070e02071479359d6d22217d0a614509bfbd0ea60eda3311fc43f63fd81a0ca4dcde901de7cfbd303a995e2c400a8a6c0b11946017de36946ee2f5cfe39b54c2fe89e73604db7ca572bbd635e261bba948afade9a1c8cfd75229357aeec9671c66916a04cc1bcd7050210f05791ddbe650b677493a829e3050e63b81dd4f23c4e3bbb563e156af2fcd0c98da8eab9a35e5e9d33bcd4d44ec09f69ccd1005242be54b4e6514494f108f06190231fe1201415f6baffcc10bfaff92e35bf78afe6bf0204377f8cf8daac92540990d38815f343a6e574856cc1ac779ee71310e3b55c52d6202fcd0f5080517f504414098438dd7fb689c7ef808a6b315238e228a9aae2897bea0", @ANYBLOB="28005080040006"], 0x64}, 0x1, 0x0, 0x0, 0x24004081}, 0x4004022) r3 = socket$netlink(0x10, 0x3, 0x0) r4 = socket(0x10, 0x803, 0x0) sendmsg$IPVS_CMD_SET_INFO(r4, &(0x7f0000000b00)={0x0, 0x0, &(0x7f0000000ac0)={0x0, 0x14}}, 0x0) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(0xffffffffffffffff, 0x84, 0x6f, &(0x7f0000000000)={0x0, 0x0, 0x0}, &(0x7f0000000080)=0x10) r5 = socket$inet6(0xa, 0x805, 0x0) getsockopt$bt_hci(r5, 0x84, 0x85, &(0x7f0000000080)=""/4060, &(0x7f0000002640)=0xfdc) getsockname$packet(r4, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000040)=0x14) ioctl$PPPIOCGIDLE64(r4, 0x8010743f, &(0x7f0000000180)) sendmsg$nl_route(r3, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000140)=ANY=[@ANYRES32=r6, @ANYRES64=r4, @ANYRESOCT=r6, @ANYRES16=r3, @ANYRES32=r3, @ANYRESHEX=r2], 0x3c}}, 0x881) sendmsg$nl_route(r4, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000240)=@newlink={0x54, 0x10, 0xffffff1f, 0xfffffffc, 0x25dfdbfd, {0x0, 0x0, 0x0, 0x0, 0x10000}, [@IFLA_LINKINFO={0x24, 0x12, 0x0, 0x1, @gretap={{0xb}, {0x14, 0x2, 0x0, 0x1, [@IFLA_GRE_REMOTE={0x8, 0x7, @dev={0xac, 0x14, 0x14, 0x28}}, @IFLA_GRE_OFLAGS={0x6, 0x3, 0x502e}]}}}, @IFLA_NUM_TX_QUEUES={0x8, 0x1f, 0x9}, @IFLA_MASTER={0x8, 0xa, r6}]}, 0x54}, 0x1, 0x0, 0x0, 0x40}, 0x0) getsockname$l2tp6(r4, &(0x7f0000000040)={0xa, 0x0, 0x0, @dev}, &(0x7f0000000080)=0x20) r7 = socket$inet6(0xa, 0x80003, 0xff) setsockopt$inet6_int(r7, 0x29, 0x16, &(0x7f0000fcb000)=0x200, 0x4) setsockopt$inet6_int(r7, 0x29, 0x16, &(0x7f0000000000)=0x9, 0x4) 803.689823ms ago: executing program 5 (id=15547): r0 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000300), 0xffffffffffffffff) r1 = socket$netlink(0x10, 0x3, 0x10) r2 = socket$netlink(0x10, 0x3, 0x5) bind$netlink(r2, &(0x7f0000514ff4)={0x10, 0x0, 0x0, 0x2ffffffff}, 0xc) setsockopt$netlink_NETLINK_BROADCAST_ERROR(r2, 0x10e, 0x4, &(0x7f0000000100)=0x1800, 0x4) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000500)={&(0x7f0000000600)=ANY=[@ANYBLOB="340000001000390400"/20, @ANYRES32=r0], 0x34}, 0x1, 0x0, 0x0, 0x400c040}, 0x0) r3 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCETHTOOL(r3, 0x8946, &(0x7f0000000040)={'syz_tun\x00', &(0x7f0000000180)=@ethtool_link_settings={0x4d, 0x600, 0xf, 0x80, 0x0, 0x0, 0xfc, 0x1, 0x80, 0x4, [0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x4]}}) mmap(&(0x7f0000196000/0x1000)=nil, 0x1000, 0x0, 0x840000000000a132, 0xffffffffffffffff, 0x0) r4 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000000)='hugetlb.2MB.rsvd.usage_in_bytes\x00', 0x275a, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000280)={0x1e, 0x4, &(0x7f00000000c0)=ANY=[@ANYBLOB="9f4b1800000000000000000000000000000071124000fcffffeb9500000000000000"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x24, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0xfffffffd}, 0x94) mmap(&(0x7f0000215000/0x1000)=nil, 0x1000, 0x0, 0x6011, r4, 0x0) setsockopt$inet6_buf(r4, 0x29, 0xd3, 0x0, 0x0) r5 = socket$nl_rdma(0x10, 0x3, 0x14) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r5, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000700)=ANY=[@ANYBLOB="38000000031401002dbd700002dcdf250900020073607a310000000008004100736977001400330073797a5f74756e00"], 0x38}, 0x1, 0x0, 0x0, 0x14f7325ddd07b80}, 0x44000) r6 = socket$nl_rdma(0x10, 0x3, 0x14) sendmsg$RDMA_NLDEV_CMD_SET(r6, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000000)=ANY=[@ANYBLOB="240000000214010023bd7000fddbdf080800010000000000090002007379"], 0x24}, 0x1, 0x0, 0x0, 0x60408a0}, 0x488c0) getsockopt$inet_tcp_int(0xffffffffffffffff, 0x6, 0x1, 0x0, 0x0) r7 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) mmap(&(0x7f0000691000/0x4000)=nil, 0x4000, 0x3, 0x28011, r7, 0x0) mmap(&(0x7f0000867000/0x2000)=nil, 0x2000, 0x0, 0x80010, r7, 0x1000) mmap(&(0x7f00005d3000/0x4000)=nil, 0x4000, 0x9, 0x12, 0xffffffffffffffff, 0xfffff000) r8 = socket$nl_route(0x10, 0x3, 0x0) bpf$BPF_PROG_QUERY(0x10, &(0x7f0000000180)={@fallback=r8, 0x2f, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x40) mmap(&(0x7f0000071000/0x4000)=nil, 0x4000, 0x0, 0x13, 0xffffffffffffffff, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPVS_CMD_NEW_SERVICE(r1, &(0x7f00000004c0)={&(0x7f0000000340), 0xc, &(0x7f0000000480)={&(0x7f0000000380)=ANY=[@ANYBLOB="1300feff", @ANYRES16=0x0, @ANYBLOB="000229bd7000fedbdf250100000034000380080001000000000008000500ac1414bb06000400ffff0000060007004e220000080003000100000008000300030000003c000180080009007300000008000500000000000600010002000000060004004e220000060001000a000000080008000300000008000b007369700044000280080005000900000008000500060000000800060099010000080009000104000008000500ff7f0000080009000000000005000d000000000006000f00010000001c000280080008001000000006000e004e20000008000600060000000800050023"], 0xec}, 0x1, 0x0, 0x0, 0x4008040}, 0x20000000) sendmsg$NFULNL_MSG_CONFIG(r4, &(0x7f0000002340)={0x0, 0x0, &(0x7f0000002300)={&(0x7f00000022c0)=ANY=[@ANYBLOB="38000000010401080000000000000000030000010800054000000001050001000100000008000440000000050a00020000000fff010c0000"], 0x38}, 0x1, 0x0, 0x0, 0x20000800}, 0x4000) mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff002, 0x0, 0x2000000000032, 0xffffffffffffffff, 0x0) 803.236182ms ago: executing program 0 (id=15548): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) ioctl$sock_ifreq(r0, 0x89f9, &(0x7f0000000040)={'lo\x00', @ifru_map={0x7fff, 0x9, 0x8, 0x3, 0x3}}) r1 = socket$can_bcm(0x1d, 0x2, 0x2) connect$can_bcm(r1, &(0x7f00000005c0), 0x10) recvmmsg(r1, &(0x7f0000000180)=[{{0x0, 0x0, &(0x7f0000000140)=[{&(0x7f0000000000)=""/97, 0x38}, {0x0}], 0x2}, 0x32}], 0x4000000000000be, 0x122, 0x0) sendmsg$can_bcm(r1, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000380)=ANY=[@ANYBLOB="050000007f0000000000010000000000", @ANYRES64=0x0, @ANYRES64=0x2710], 0x48}, 0x1, 0x0, 0x0, 0x4044080}, 0x20008800) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000100)=@delneigh={0x44, 0x1a, 0x1, 0x70bd28, 0xfffffffd, {0xa, 0x0, 0x0, 0x0, 0x1, 0x80}, [@NDA_CACHEINFO={0x14, 0x3, {0x2}}, @NDA_DST_IPV6={0x14, 0x1, @mcast1}]}, 0x44}, 0x1, 0x0, 0x0, 0xc1}, 0x0) sendmsg$NLBL_UNLABEL_C_STATICADD(0xffffffffffffffff, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000100)={0x0}, 0x8, 0x3000000000002}, 0x0) 747.94589ms ago: executing program 1 (id=15549): r0 = socket$nl_route(0x10, 0x3, 0x0) bpf$TOKEN_CREATE(0x24, &(0x7f0000000040)={0x0, r0}, 0x8) sendmsg$nl_route_sched(r0, &(0x7f00000009c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000440)=@newtaction={0x18, 0x1e, 0x109, 0x0, 0x25dfdc01, {}, [{0x4}]}, 0x18}, 0x1, 0x2b1e}, 0x58) ioctl$FS_IOC_SETFLAGS(r0, 0x40086602, &(0x7f0000000000)=0x10040400) 691.957445ms ago: executing program 7 (id=15550): r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000700)=@getsadinfo={0x14, 0x23, 0x1, 0x70bd2c, 0x25dfdbfc}, 0x14}, 0x1, 0x0, 0x0, 0x4040000}, 0x4000000) socket$inet_sctp(0x2, 0x1, 0x84) socket$kcm(0x10, 0x2, 0x4) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) close(r2) r3 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r3, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000580)={&(0x7f00000002c0)=@newqdisc={0x4c, 0x24, 0x4ee4e6a52ff56541, 0x1, 0x25dfdbfd, {0x0, 0x0, 0x0, r4, {0x0, 0x3}, {0xffff, 0xffff}, {0xfff2}}, [@qdisc_kind_options=@q_cake={{0x9}, {0x1c, 0x2, [@TCA_CAKE_MEMORY={0x8, 0xa, 0x7}, @TCA_CAKE_TARGET={0x8, 0x8, 0x1}, @TCA_CAKE_AUTORATE={0x8, 0x9, 0x80000001}]}}]}, 0x4c}, 0x1, 0x0, 0x0, 0x40088c1}, 0x0) ioctl$SIOCSIFHWADDR(r2, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, 0x0) r5 = socket$packet(0x11, 0x3, 0x300) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000040)={'syzkaller0\x00', 0x0}) sendto$packet(r5, &(0x7f0000000280)="05", 0x1, 0x4088, &(0x7f0000000140)={0x11, 0x86dd, r6, 0x1, 0x3, 0x6, @remote}, 0x14) 619.892589ms ago: executing program 5 (id=15551): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f0000000100)='dctcp', 0x5) bind$inet6(r0, &(0x7f0000000080)={0xa, 0x2, 0x200, @loopback, 0x7}, 0x1c) r1 = syz_init_net_socket$802154_raw(0x24, 0x3, 0x0) recvmsg(r1, &(0x7f0000001880)={0x0, 0x0, 0x0}, 0x3c65e5a12d2f864f) setsockopt$inet6_tcp_int(r0, 0x6, 0x2000000000000022, &(0x7f0000000200)=0x1, 0x4) sendto$inet6(r0, &(0x7f0000000980)="b20cae6844af93eb58927902ce9cf427f2ac3d0a0becad46763faf944051226822a1c5d62964ca0c12b5e39ffdc1de4f8b8ec643f1ed6d1466e64a7e1b268712685fd111882d38af6a536ab518a4dff04b5620a58cfbc1783957770158a9844e40434f7424b285b8ce0f6c27737e2a3d28021e865fa1904e3fdb5bb08776fbb0", 0x80, 0x24000045, &(0x7f0000000400)={0xa, 0x2, 0xffff, @loopback, 0x9}, 0x1c) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r3 = socket(0x400000000010, 0x3, 0x0) r4 = socket$unix(0x1, 0x5, 0x0) r5 = socket(0x400000000010, 0x3, 0x0) r6 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r6, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r5, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000400)=@newqdisc={0x58, 0x24, 0x4ee4e6a52ff56541, 0x70bd27, 0xffffffff, {0x0, 0x0, 0x0, r7, {0x0, 0xfff1}, {0xffff, 0xffff}, {0x7ff8, 0x2}}, [@qdisc_kind_options=@q_sfb={{0x8}, {0x2c, 0x2, @TCA_SFB_PARMS={0x28, 0x1, {0x4, 0xffff2153, 0x2, 0x2, 0xd, 0x1c4, 0x7, 0x2}}}}]}, 0x58}}, 0x0) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r3, &(0x7f0000006040)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000002c0)=@gettfilter={0x24, 0x2e, 0x205, 0x70bd2c, 0x25dfdafd, {0x0, 0x0, 0x0, r8, {0xc, 0xc}, {0xe, 0xfff1}, {0x9}}}, 0x24}, 0x1, 0x0, 0x0, 0x20000801}, 0x4041080) r9 = syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x3) shutdown(r9, 0x0) r10 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) ioctl$sock_SIOCETHTOOL(r10, 0x8946, &(0x7f0000000040)={'wlan0\x00', &(0x7f0000000000)=@ethtool_ts_info}) recvmmsg(r9, &(0x7f00000055c0), 0x400023c, 0x300, 0x0) r11 = socket$vsock_stream(0x28, 0x1, 0x0) r12 = socket$inet6_icmp(0xa, 0x2, 0x3a) setsockopt$IP6T_SO_SET_REPLACE(r12, 0x29, 0x40, &(0x7f0000000600)=@mangle={'mangle\x00', 0x1f, 0x2, 0x550, 0x1a8, 0xd8, 0x368, 0x1a8, 0xd8, 0x480, 0x480, 0x480, 0x480, 0x480, 0x6, 0x0, {[{{@ipv6={@private0={0xfc, 0x0, '\x00', 0x1}, @ipv4={'\x00', '\xff\xff', @rand_addr=0x64010101}, [0xffffff00, 0xffffffff, 0x0, 0xffffff00], [0x0, 0xff000000, 0xff000000], 'macvlan0\x00', 'caif0\x00', {0xff}, {}, 0x8, 0x0, 0x2, 0x22}, 0x0, 0xa8, 0xd8}, @common=@inet=@SET2={0x30, 'SET\x00', 0x2, {{}, {}, 0x0, 0x7}}}, {{@ipv6={@rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02', @empty, [0xffffffff, 0x0, 0x0, 0xffff00], [], 'pim6reg1\x00', 'geneve1\x00', {}, {}, 0x0, 0x0, 0x0, 0x8}, 0x0, 0xa8, 0xd0}, @HL={0x28}}, {{@uncond, 0x0, 0xa8, 0xd0}, @unspec=@CHECKSUM={0x28}}, {{@ipv6={@ipv4={'\x00', '\xff\xff', @multicast2}, @remote, [0x0, 0xff0000ff], [0xff], 'veth0_to_bond\x00', 'batadv_slave_0\x00', {}, {}, 0x0, 0x0, 0x0, 0x43}, 0x0, 0xa8, 0xf0}, @SNPT={0x48, 'SNPT\x00', 0x0, {@ipv6=@rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01', @ipv6=@empty, 0x0, 0x20, 0x10}}}, {{@ipv6={@mcast1, @rand_addr=' \x01\x00', [0xff000000, 0xff000000, 0x0, 0xffffffff], [0xff, 0x0, 0xffffffff, 0xff], 'syzkaller1\x00', 'ipvlan0\x00', {}, {0xff}, 0x2c, 0x8, 0x4, 0x4}, 0x0, 0xa8, 0x118}, @common=@unspec=@NFLOG={0x70, 'NFLOG\x00', 0x0, {0x9f, 0x7, 0xfbcf, 0x0, 0x0, "e1a85d7789b50a758833a322ed3ecb9c52dd1eae1c46c7d6da71ef62cc9070c679d9fd6a41aa78a2c8d0b5630f46b141f084b7c56bcd5e2dc3024aff57487378"}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x5b0) bind$vsock_stream(r11, &(0x7f0000000440), 0x10) listen(r11, 0x5) r13 = socket$vsock_stream(0x28, 0x1, 0x0) connect$vsock_stream(r13, &(0x7f0000000100)={0x28, 0x0, 0x0, @local}, 0x10) sendto$packet(r13, &(0x7f0000000600)="5f0efc3e1792a50972d2eb21bdff9ca4ac804c2847689e7fd3f3fe7bf05ddc63ff512d4074687760a5fbd1fc97777a6e55123f04cc8437b15f4b2c6f5027dcea15b6658d", 0xfffffffffffffcaa, 0x408c4, 0x0, 0xffffffffffffff10) 555.318994ms ago: executing program 1 (id=15552): sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000380)=@newchain={0x24, 0x64, 0x800, 0x70bd25, 0x25dfdbfd, {0x0, 0x0, 0x0, 0x0, {0x4, 0xfff1}, {0x3, 0xc}, {0x1b, 0xfff2}}}, 0x24}, 0x1, 0x0, 0x0, 0x4000845}, 0x2000c8c1) r0 = openat$nci(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$nfc(&(0x7f0000000100), r1) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0xfffffffffffffe3c, &(0x7f0000000b00)={&(0x7f0000000280)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x3}}, [], {0x14}}, 0x28}}, 0x4) bind$tipc(0xffffffffffffffff, &(0x7f0000000100)=@nameseq={0x1e, 0x1, 0x2, {0x43, 0x3, 0x3}}, 0x10) r3 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r3, &(0x7f00005f5000)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000040)=ANY=[@ANYBLOB="020300091b0000000000000000000000040003000000000000000000000000000000000000000000000000000000000005000600000000000a00000000000000fe8000000000000000000000000000bb00000000000000000400040000000000000000000000000000000000000000000000000000000000020001000000000000000000000000ff05000500000000000a00000000000000fe8896380000000000000001000000010000000000000000030007000000000002004e24ac14141f0000000000000000020013"], 0xd8}}, 0x0) ioctl$IOCTL_GET_NCIDEV_IDX(r0, 0x0, &(0x7f00000000c0)=0x0) unshare(0x8000400) r5 = socket$alg(0x26, 0x5, 0x0) bind$alg(r5, &(0x7f00000004c0)={0x26, 'aead\x00', 0x0, 0x0, 'ccm(aes)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r5, 0x117, 0x1, &(0x7f0000000280)="ad56b6c5820fae9d6dcd3292ea54c7beef915d564c90c200", 0x18) r6 = accept4(r5, 0x0, 0x0, 0x80000) sendmsg$ETHTOOL_MSG_CHANNELS_GET(r6, &(0x7f0000000940)={0x0, 0x0, &(0x7f0000000900)={0x0}, 0x1, 0x0, 0x0, 0x4000000}, 0x20008004) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000000)={'veth1\x00', &(0x7f0000000440)=@ethtool_per_queue_op={0x4b, 0xf, [0xdc45, 0x1, 0x7fff, 0x1, 0x4, 0x9, 0xa4, 0xffb, 0x9, 0x4000b69, 0x4000c1, 0x4, 0x1, 0x6, 0x5, 0x101, 0x1080, 0xd, 0x5, 0x3, 0x1, 0xfffffffa, 0x0, 0x800006, 0x9, 0x4, 0x9, 0x4, 0x2, 0x762, 0x3, 0x80, 0x3, 0x2b12, 0xff, 0x9, 0x4, 0xb, 0x0, 0xbed4, 0x8, 0x80000fc, 0x7, 0x0, 0x11000, 0x80000000, 0x2, 0x79b, 0x2, 0x1, 0x7d, 0x8, 0x2, 0x7, 0xd, 0x101, 0xd7, 0x1fa0860a, 0x7, 0xaa, 0x81, 0x6, 0x180000, 0x400a, 0x8b, 0x805, 0x2af, 0x0, 0x5, 0x5, 0x6, 0x5, 0x9, 0xb, 0x4009, 0x0, 0x4, 0xffffff01, 0x7, 0x752, 0x0, 0xd, 0x8, 0xffff, 0x6, 0xffffffff, 0x6, 0x4, 0x9, 0x7ffffffe, 0xfdffffff, 0xfffffffe, 0x6, 0x87, 0x800100, 0x5, 0x255, 0x81, 0xb, 0x5, 0x20006, 0x5, 0xffffffff, 0xb, 0x2, 0xd9a, 0xd, 0x2a2, 0xfffffffd, 0x2, 0x2, 0x7, 0x1, 0x0, 0xfffffffd, 0x2, 0x40, 0x8, 0x4, 0x0, 0x401, 0x66cd, 0x8, 0x9, 0x1, 0x1fc, 0x45c, 0xffffffff]}}) unshare(0x22020600) poll(&(0x7f0000000000), 0x20000000000000b5, 0x9) sendmsg$NFC_CMD_DEV_UP(r1, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000d80)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r2, @ANYBLOB="010426bd7000f8dbdf250200000008000100", @ANYRES32=r4], 0x1c}}, 0x4008054) write$nci(r0, &(0x7f0000000240)=ANY=[@ANYBLOB='p\x00\t'], 0xc) write$nci(r0, &(0x7f0000000280)=ANY=[@ANYRES8=r1], 0x87) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000400)={0x18, 0x5, &(0x7f0000000700)=ANY=[@ANYBLOB="18000000000000000000000000000000184800"/40], &(0x7f0000000300)='GPL\x00', 0x8}, 0x94) 554.698673ms ago: executing program 6 (id=15553): r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$inet6_sctp(0xa, 0x5, 0x84) getsockopt$inet_sctp6_SCTP_STATUS(r1, 0x84, 0xe, 0x0, &(0x7f0000000280)) sendmsg$nl_route(r0, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000000)=ANY=[@ANYBLOB="340000002000010025bd7000fedbdf25029f1c2adb5ae79d620000000800010064010101080002"], 0x34}}, 0x40010) socket$nl_route(0x10, 0x3, 0x0) (async) socket$inet6_sctp(0xa, 0x5, 0x84) (async) getsockopt$inet_sctp6_SCTP_STATUS(r1, 0x84, 0xe, 0x0, &(0x7f0000000280)) (async) sendmsg$nl_route(r0, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000000)=ANY=[@ANYBLOB="340000002000010025bd7000fedbdf25029f1c2adb5ae79d620000000800010064010101080002"], 0x34}}, 0x40010) (async) 502.637417ms ago: executing program 0 (id=15554): sendmsg$NBD_CMD_CONNECT(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000003c0)=ANY=[@ANYBLOB="00001a00", @ANYRES16, @ANYBLOB="0100000000000000000001"], 0x6c}}, 0x51) gettid() r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$nl_route(r2, &(0x7f0000000380)={0x0, 0x4076cbba9945d516, &(0x7f0000000340)={0x0, 0x14}}, 0x0) getsockname$packet(r2, &(0x7f0000001140)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000400)=0x14) sendmsg$nl_route(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000500)={&(0x7f0000001180)=@newlink={0x40, 0x10, 0x439, 0x0, 0x60000, {0x0, 0x0, 0x0, r3, 0x15809}, [@IFLA_LINKINFO={0x20, 0x12, 0x0, 0x1, @gre={{0x8}, {0x14, 0x2, 0x0, 0x1, [@IFLA_GRE_REMOTE={0x8, 0x7, @broadcast}, @IFLA_GRE_TTL={0x5, 0x8, 0x80}]}}}]}, 0x40}, 0x1, 0x0, 0x0, 0x80}, 0x0) sendmsg$nl_route(r0, &(0x7f0000001200)={0x0, 0x0, &(0x7f0000001240)={&(0x7f0000000180)=@bridge_delneigh={0x3c, 0x1c, 0xc07, 0x70bd2e, 0x25dfdbfe, {0xa, 0x0, 0x0, r3, 0x40, 0x58, 0x72748f52b8af0932}, [@NDA_DST_IPV6={0x14, 0x1, @mcast1}, @NDA_LLADDR={0xa, 0x2, @remote}]}, 0x3c}}, 0x20024090) r4 = socket$nl_generic(0x10, 0x3, 0x10) readv(r4, &(0x7f0000000680)=[{&(0x7f0000002540)=""/4108, 0x100c}, {&(0x7f0000000080)=""/157, 0x9d}, {&(0x7f0000000540)=""/225, 0xe1}, {&(0x7f0000000640)=""/12, 0xc}], 0x4) syz_genetlink_get_family_id$batadv(&(0x7f00000002c0), r4) r5 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r5, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000140)=ANY=[@ANYBLOB="140000001000010007000000000000000000000a20000000000a03000000000000000000010000000900010073797a300000000048000000090a010400000000000000000100000008000a40000000000900020073797a32000000000900010073797a3000000000080005400000001f0c00098008000140000000075c0000000e0a01020000000000000000010000000900020073797a32000000000900010073797a3000000000300003802c00008028000180230001"], 0xec}}, 0x0) sendmsg$nl_generic(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000003c0)=ANY=[@ANYBLOB="1400000015000103"], 0x14}, 0x1, 0x0, 0x0, 0x4}, 0x0) r6 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='memory.events\x00', 0x275a, 0x0) r7 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000004c0)={&(0x7f0000000100)=@newqdisc={0x44, 0x24, 0x1, 0x70bd29, 0x25dfdbfd, {0x60, 0x0, 0x0, 0x0, {0xffff, 0x756c51182137b80d}, {0xfff3, 0x5}, {0x2, 0x9}}, [@qdisc_kind_options=@q_cake={{0x9}, {0x14, 0x2, [@TCA_CAKE_NAT={0x8}, @TCA_CAKE_TARGET={0x8, 0x8, 0xbf32}]}}]}, 0x44}, 0x1, 0x0, 0x0, 0x204c0c5}, 0x14) sendmsg$nl_route(r7, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000100)=ANY=[@ANYBLOB="500000001000010425bbe5ad600027842cf52300", @ANYRES32=0x0, @ANYBLOB="0000000000008000280012800a00010076786c616e"], 0x50}}, 0x4000000) r8 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000080), 0x60200, 0x0) ioctl$TUNSETOFFLOAD(r8, 0xc004743e, 0x110e22fff6) r9 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000080), 0x1, 0x0) sendto$inet6(0xffffffffffffffff, &(0x7f00000004c0)="b0", 0x1, 0x0, &(0x7f0000000240)={0xa, 0x4e23, 0x7, @loopback, 0x4}, 0x18) ioctl$TUNSETOFFLOAD(r9, 0x4004743d, 0x110e22fff6) close(0x4) write$tun(r6, &(0x7f0000000340)=ANY=[], 0x141) mmap(&(0x7f0000000000/0x4000)=nil, 0x4000, 0x1, 0x10012, r6, 0x0) getsockopt$inet_pktinfo(0xffffffffffffffff, 0x0, 0x8, &(0x7f0000000040)={0x0, @loopback, @initdev}, &(0x7f0000000200)=0xc) sendmsg$TIPC_NL_BEARER_ENABLE(r2, &(0x7f0000000bc0)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x8000}, 0xc, &(0x7f0000000b80)={&(0x7f00000006c0)={0x4c0, 0x0, 0x4, 0x70bd29, 0x25dfdbfd, {}, [@TIPC_NLA_LINK={0x88, 0x4, 0x0, 0x1, [@TIPC_NLA_LINK_PROP={0x2c, 0x7, 0x0, 0x1, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0x1}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0xc3e0}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0xe50}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x1}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x53}]}, @TIPC_NLA_LINK_NAME={0x9, 0x1, 'syz1\x00'}, @TIPC_NLA_LINK_PROP={0x14, 0x7, 0x0, 0x1, [@TIPC_NLA_PROP_WIN={0x8, 0x3, 0x100}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x6}]}, @TIPC_NLA_LINK_NAME={0x9, 0x1, 'syz0\x00'}, @TIPC_NLA_LINK_NAME={0x13, 0x1, 'broadcast-link\x00'}, @TIPC_NLA_LINK_NAME={0x9, 0x1, 'syz1\x00'}, @TIPC_NLA_LINK_NAME={0x9, 0x1, 'syz0\x00'}]}, @TIPC_NLA_LINK={0x88, 0x4, 0x0, 0x1, [@TIPC_NLA_LINK_PROP={0x1c, 0x7, 0x0, 0x1, [@TIPC_NLA_PROP_TOL={0x8, 0x2, 0x94}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x8}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x101}]}, @TIPC_NLA_LINK_NAME={0x9, 0x1, 'syz1\x00'}, @TIPC_NLA_LINK_NAME={0x9, 0x1, 'syz1\x00'}, @TIPC_NLA_LINK_NAME={0x13, 0x1, 'broadcast-link\x00'}, @TIPC_NLA_LINK_NAME={0x13, 0x1, 'broadcast-link\x00'}, @TIPC_NLA_LINK_NAME={0x13, 0x1, 'broadcast-link\x00'}, @TIPC_NLA_LINK_NAME={0x13, 0x1, 'broadcast-link\x00'}]}, @TIPC_NLA_NODE={0x80, 0x6, 0x0, 0x1, [@TIPC_NLA_NODE_KEY={0x4c, 0x4, {'gcm(aes)\x00', 0x24, "73847bc7c719d30d0a5deaf6e334feb923a4df9b72152bc2942f2b0afd279200f63adc37"}}, @TIPC_NLA_NODE_ADDR={0x8, 0x1, 0x59}, @TIPC_NLA_NODE_ID={0x16, 0x3, "a898e879979b08e5344cb14c5093bdb93b33"}, @TIPC_NLA_NODE_ADDR={0x8, 0x1, 0x4}, @TIPC_NLA_NODE_KEY_MASTER={0x4}, @TIPC_NLA_NODE_UP={0x4}]}, @TIPC_NLA_NODE={0x154, 0x6, 0x0, 0x1, [@TIPC_NLA_NODE_ID={0xa2, 0x3, "dcf71ab08632021de9d9de3642233f663ddeccaca12295a1cb502a6a757e10331c119d5854405a4724fe8c650d8ef0f71b3751ccaf86753e965c8a6cbaa30a309065b49fe688979ce778b202b7312af51cf2b1ff47a982f52f24fef30da47e316dd3e4741e05077227e72a14076b13ee7a716ce74004d2a157b2f8d7354a719187804affbe8295b1d2b05b8c576d4251f658c242b3ca232bc4ae4828c89b"}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_REKEYING={0x8, 0x6, 0x11}, @TIPC_NLA_NODE_KEY_MASTER={0x4}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_ID={0x97, 0x3, "610402cc84282f395c41143ae0c8027442e2bcf53a2df8e47053ba7d61001841535fb9bd80331183854ff956bafef4f32d78dfed2bb25580b5addc9b4171dbd8c8fd274f5600fc70b766804be820dca135f65da8d774eee4bfa2d5b7d0fa8c427bce6c2e7e6948bfe1c2dc760d422d7aa5016209b6e7eb0bb626e4da84fc8aa10d15588d5b3e5d552e70c30e204d441010b3cc"}]}, @TIPC_NLA_PUBL={0x44, 0x3, 0x0, 0x1, [@TIPC_NLA_PUBL_LOWER={0x8, 0x2, 0x7ff}, @TIPC_NLA_PUBL_UPPER={0x8, 0x3, 0x1}, @TIPC_NLA_PUBL_UPPER={0x8, 0x3, 0x400000}, @TIPC_NLA_PUBL_UPPER={0x8, 0x3, 0x8}, @TIPC_NLA_PUBL_TYPE={0x8, 0x1, 0x4}, @TIPC_NLA_PUBL_LOWER={0x8, 0x2, 0x5}, @TIPC_NLA_PUBL_TYPE={0x8, 0x1, 0xe}, @TIPC_NLA_PUBL_UPPER={0x8, 0x3, 0xfff}]}, @TIPC_NLA_LINK={0xd8, 0x4, 0x0, 0x1, [@TIPC_NLA_LINK_NAME={0x13, 0x1, 'broadcast-link\x00'}, @TIPC_NLA_LINK_PROP={0x4}, @TIPC_NLA_LINK_NAME={0x9, 0x1, 'syz0\x00'}, @TIPC_NLA_LINK_NAME={0x13, 0x1, 'broadcast-link\x00'}, @TIPC_NLA_LINK_PROP={0x34, 0x7, 0x0, 0x1, [@TIPC_NLA_PROP_TOL={0x8, 0x2, 0x6}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x13}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x15}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0xe}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x7ff}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x9}]}, @TIPC_NLA_LINK_NAME={0x9, 0x1, 'syz0\x00'}, @TIPC_NLA_LINK_PROP={0x1c, 0x7, 0x0, 0x1, [@TIPC_NLA_PROP_WIN={0x8, 0x3, 0x4f}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x9}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x3}]}, @TIPC_NLA_LINK_PROP={0x14, 0x7, 0x0, 0x1, [@TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x5}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0xc}]}, @TIPC_NLA_LINK_PROP={0x2c, 0x7, 0x0, 0x1, [@TIPC_NLA_PROP_WIN={0x8, 0x3, 0x75e}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x9}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x6}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x18}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x1a}]}]}, @TIPC_NLA_NODE={0x10, 0x6, 0x0, 0x1, [@TIPC_NLA_NODE_ADDR={0x8, 0x1, 0x4}, @TIPC_NLA_NODE_UP={0x4}]}, @TIPC_NLA_MON={0x44, 0x9, 0x0, 0x1, [@TIPC_NLA_MON_REF={0x8}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8, 0x1, 0xe}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8, 0x1, 0x401}, @TIPC_NLA_MON_REF={0x8}, @TIPC_NLA_MON_REF={0x8, 0x2, 0x7}, @TIPC_NLA_MON_REF={0x8, 0x2, 0x80}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8, 0x1, 0x6}, @TIPC_NLA_MON_REF={0x8, 0x2, 0x200}]}, @TIPC_NLA_MON={0x14, 0x9, 0x0, 0x1, [@TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8, 0x1, 0x1c}, @TIPC_NLA_MON_REF={0x8, 0x2, 0xec0}]}, @TIPC_NLA_PUBL={0x44, 0x3, 0x0, 0x1, [@TIPC_NLA_PUBL_LOWER={0x8, 0x2, 0x6}, @TIPC_NLA_PUBL_LOWER={0x8, 0x2, 0x6}, @TIPC_NLA_PUBL_LOWER={0x8, 0x2, 0x5}, @TIPC_NLA_PUBL_LOWER={0x8, 0x2, 0x81}, @TIPC_NLA_PUBL_UPPER={0x8, 0x3, 0x5480}, @TIPC_NLA_PUBL_TYPE={0x8, 0x1, 0x8}, @TIPC_NLA_PUBL_TYPE={0x8, 0x1, 0x7fffffff}, @TIPC_NLA_PUBL_TYPE={0x8, 0x1, 0x1}]}]}, 0x4c0}, 0x1, 0x0, 0x0, 0x40}, 0x200050c4) 365.859734ms ago: executing program 6 (id=15555): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x0) socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NFT_BATCH(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f0000000480)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x5}}, [@NFT_MSG_NEWRULE={0x58, 0x6, 0xa, 0x401, 0x0, 0x0, {0xa, 0x0, 0xa}, [@NFTA_RULE_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_RULE_EXPRESSIONS={0x2c, 0x4, 0x0, 0x1, [{0x28, 0x1, 0x0, 0x1, @last={{0x9}, @val={0x18, 0x2, 0x0, 0x1, [@NFTA_LAST_SET={0x8, 0x1, 0x1, 0x0, 0x5}, @NFTA_LAST_MSECS={0xc, 0x2, 0x1, 0x0, 0x8000000000000001}]}}}]}, @NFTA_RULE_CHAIN={0x9, 0x2, 'syz2\x00'}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x5}}}, 0x80}, 0x1, 0x0, 0x0, 0x6040850}, 0x20000040) 224.383044ms ago: executing program 6 (id=15556): r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000000c0)={'bridge0\x00'}) socket$nl_route(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r2, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000002c0)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x7}}, [@NFT_MSG_NEWTABLE={0x20, 0x0, 0xa, 0x5, 0x0, 0x0, {0x5}, [@NFTA_TABLE_NAME={0x9, 0x1, 'syz0\x00'}]}, @NFT_MSG_NEWCHAIN={0x2c, 0x3, 0xa, 0x101, 0x0, 0x0, {0x5}, [@NFTA_CHAIN_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_CHAIN_NAME={0x9, 0x3, 'syz2\x00'}]}, @NFT_MSG_NEWRULE={0x4c, 0x6, 0xa, 0x401, 0x0, 0x0, {0x5}, [@NFTA_RULE_CHAIN_ID={0x8}, @NFTA_RULE_EXPRESSIONS={0x24, 0x4, 0x0, 0x1, [{0x20, 0x1, 0x0, 0x1, @ct={{0x7}, @val={0x14, 0x2, 0x0, 0x1, [@NFTA_CT_DREG={0x8, 0x1, 0x1, 0x0, 0x15}, @NFTA_CT_KEY={0x8, 0x2, 0x1, 0x0, 0x7}]}}}]}, @NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x3}}}, 0xc0}}, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r3, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000380)=ANY=[@ANYBLOB="4c0000001000010400"/20, @ANYRES32=0x0, @ANYBLOB="00030000000000001c0012800c0001006d6163766c616e000c0002800800", @ANYRES32=r1], 0x4c}}, 0x884) sendmsg$nl_route(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000180)=@newlink={0x20, 0x10, 0x401, 0xfffffffc, 0x25dfdbff, {0x0, 0x0, 0x0, 0x0, 0x31943}}, 0x20}, 0x1, 0x0, 0x0, 0x2004d808}, 0x0) 153.458899ms ago: executing program 7 (id=15557): r0 = accept4$phonet_pipe(0xffffffffffffffff, &(0x7f0000000200), &(0x7f0000000240)=0x10, 0x80000) recvfrom$phonet(r0, &(0x7f00000002c0)=""/121, 0x79, 0xc0002141, 0x0, 0x0) r1 = socket$nl_sock_diag(0x10, 0x3, 0x4) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000040)={'batadv_slave_0\x00', 0x0}) sendmsg$nl_route_sched(0xffffffffffffffff, 0x0, 0x4c840) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000180)=@newtfilter={0x64, 0x2c, 0xf3f, 0x30bd29, 0x25dfdbfd, {0x0, 0x0, 0x0, r2, {0xb, 0x9}, {0x0, 0xfff3}, {0xe, 0xb}}, [@filter_kind_options=@f_flower={{0xb}, {0x34, 0x2, [@TCA_FLOWER_KEY_ENC_KEY_ID={0x8, 0x1a, 0x7ff}, @TCA_FLOWER_KEY_ENC_IPV6_DST={0x14, 0x21, @mcast1}, @TCA_FLOWER_KEY_ENC_IPV6_DST_MASK={0x14, 0x22, [0x0, 0xff]}]}}]}, 0x64}, 0x1, 0x0, 0x0, 0x20041090}, 0x4000) socketpair$tipc(0x1e, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff}) r4 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r4, &(0x7f0000000100)={0x2, 0x4e21, @local}, 0x10) setsockopt$inet_tcp_int(r4, 0x6, 0x210000000013, &(0x7f00000000c0)=0x100000001, 0x4) setsockopt$inet_tcp_TCP_REPAIR_QUEUE(r4, 0x6, 0x14, &(0x7f0000000140)=0x2, 0x4) connect$inet(r4, &(0x7f0000000180)={0x2, 0x4e21, @local}, 0x10) socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f00000003c0)={'netdevsim0\x00', 0x0}) r6 = socket$inet6(0xa, 0x2, 0x3a) ioctl$sock_inet6_SIOCSIFADDR(r6, 0x8916, &(0x7f0000000000)={@loopback, 0x63, r5}) setsockopt$inet_tcp_TCP_REPAIR_OPTIONS(r4, 0x6, 0x16, &(0x7f0000000340)=[@sack_perm, @timestamp, @timestamp, @window={0x3, 0x6, 0xff81}, @window={0x3, 0x6, 0x6}, @timestamp, @sack_perm, @mss={0x2, 0xffff7fff}], 0x8) sendto$inet(r4, &(0x7f0000000000)="b8", 0x1, 0x2400a044, 0x0, 0x0) r7 = socket$nl_generic(0x10, 0x3, 0x10) r8 = syz_genetlink_get_family_id$nl80211(&(0x7f00000001c0), 0xffffffffffffffff) sendmsg$NL80211_CMD_SET_CQM(r7, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000480)=ANY=[@ANYBLOB='$\x00', @ANYRES16=r8, @ANYBLOB="010000000000000000003f00000008000300", @ANYRES32, @ANYBLOB="090000000000000070fdf3109407ee52c38e138d1e9566d0df005958eb8aa032f97ac28c70fbb870c0bd6f087fe670dc22bf857968701e1921e41016ba0c4df280088e1194d74654dcff5609f0bf1134be6b77a909e2cd6161ca26d6adf25ee5084807b829b369acc45c9974adc90c443b562e07ed8a29603beff0f6e4a4c0954a7d72fe6494ba6da79438baae15cac9633a209d867113ad1bb9894f5879f7868f29ac992cba36157c1980946698170125c113"], 0x24}}, 0x0) setsockopt$inet_tcp_TCP_REPAIR(r4, 0x6, 0x13, 0x0, 0x0) sendto$inet(r4, 0x0, 0x0, 0x480c1, 0x0, 0x0) bpf$ITER_CREATE(0x21, 0x0, 0x0) setsockopt$sock_attach_bpf(r3, 0x10f, 0x85, 0x0, 0x0) sendmsg$TCPDIAG_GETSOCK(r1, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000080)=ANY=[@ANYBLOB="60000000120001030000000000000000020d0000000000000000000000000000000000000000000000000000060000000000000000", @ANYRES32=0x0, @ANYBLOB="0000000000000000ffffffff000000001400010007101000"], 0x60}, 0x1, 0xfeffffffffffffff, 0x0, 0x20000090}, 0x0) 0s ago: executing program 6 (id=15558): r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x0) connect$bt_l2cap(r0, &(0x7f00000000c0)={0x1f, 0x82, @fixed={'\xaa\xaa\xaa\xaa\xaa', 0x5}, 0x0, 0x3}, 0xe) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x48241, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x6bf1c2d5adba8c32}) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000640)={0x1f, 0x13, &(0x7f0000000000)=ANY=[@ANYBLOB="1800000000000000000000000400000018010000756c6c2500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b7030000000000008500000089000000180100002020692500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000f8ffff850000000400000095"], &(0x7f0000000140)='GPL\x00', 0x2, 0x0, 0x0, 0xc1100, 0x10}, 0x94) r2 = socket$kcm(0x2, 0xa, 0x2) r3 = bpf$MAP_CREATE(0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="0b00000007000000010001000900000001"], 0x48) r4 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$IPT_SO_SET_REPLACE(r4, 0x0, 0x40, &(0x7f0000000000)=@raw={'raw\x00', 0x8, 0x3, 0x368, 0x1e8, 0x43, 0xa0, 0x0, 0x98, 0x2d0, 0x178, 0x178, 0x2d0, 0x178, 0x49, 0x0, {[{{@ip={@loopback, @local, 0x0, 0x0, 'veth0_to_bond\x00', 'ip6erspan0\x00'}, 0x12a, 0x1a0, 0x1e8, 0x0, {0x0, 0x7a010000}, [@common=@inet=@recent0={{0xf8}, {0x0, 0x0, 0x8, 0x0, 'syz0\x00'}}, @common=@unspec=@quota={{0x38}, {0x0, 0x0, 0x3, {0x100000001}}}]}, @unspec=@CT0={0x48, 'CT\x00', 0x0, {0x1, 0x6, 0xfff, 0x4, 'syz1\x00', {0x1}}}}, {{@uncond, 0x0, 0xa8, 0xe8, 0x0, {}, [@common=@unspec=@connbytes={{0x38}, {[{0xb}]}}]}, @common=@unspec=@ERROR={0x40, 'ERROR\x00', 0x0, "f1c098b60204ed02d82cf440fef5497b80c29d381d41116000"}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28, '\x00', 0x4}}}}, 0x3c8) r5 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r5, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000300)=[{&(0x7f0000000400)=ANY=[@ANYBLOB="30000000240005050000000000000000000000000300000000000100ffffffff000000000c00010063616b655f6d71"], 0x30}], 0x1}, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x13, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x44, '\x00', 0x0, @fallback=0x38, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff}) sendmsg$inet(r6, &(0x7f0000000980)={0x0, 0x6000, &(0x7f0000000900)=[{&(0x7f0000000640)='U', 0xa00120}], 0x1}, 0x3) close(0x4) bpf$MAP_UPDATE_BATCH(0x1a, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000000c0), &(0x7f0000000140), 0x5, r3}, 0x38) ioctl$SIOCSIFHWADDR(r2, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local}) r7 = socket$inet6(0xa, 0x2, 0x0) r8 = socket(0x10, 0x803, 0x0) syz_genetlink_get_family_id$gtp(&(0x7f0000000c80), r8) getsockname$packet(r8, &(0x7f0000000040)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000000c0)=0xd) sendmsg$nl_route(r8, &(0x7f0000000380)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000580)=ANY=[@ANYBLOB="640000001000370403000000ffffffff00000000", @ANYRES32=r9, @ANYBLOB="0b1b050000000000440012800b00010069703667726500003400028008000100", @ANYRES32, @ANYBLOB="14000600fe8000000000000000000000000000aa1400070000000000000000000000000000bb"], 0x64}, 0x1, 0x0, 0x0, 0x48810}, 0x4000010) r10 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f0000000540)=ANY=[@ANYBLOB="1b0000000000000000000000000004"], 0x50) syz_80211_join_ibss(&(0x7f00000004c0)='wlan0\x00', &(0x7f0000000500)=@random="0e", 0x1, 0x1) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000400)={0x11, 0x11, &(0x7f0000000340)=@ringbuf={{0x18, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x9}, {{0x18, 0x1, 0x1, 0x0, r10}, {}, {}, {0x85, 0x0, 0x0, 0x1b}}, {}, [@map_idx={0x18, 0x8, 0x5, 0x0, 0xd}], {{}, {0x7, 0x0, 0xb, 0x2, 0x0, 0x0, 0x1}, {0x85, 0x0, 0x0, 0x84}}}, &(0x7f0000000040)='GPL\x00', 0xf, 0x1001, &(0x7f0000001cc0)=""/4097, 0x40f00, 0x4d, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x4}, 0x94) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f0000000400), &(0x7f0000000480)=0xc) sendmmsg$inet(r7, &(0x7f0000000440)=[{{&(0x7f0000000000)={0x2, 0x4e24, @multicast2}, 0x10, 0x0, 0x0, &(0x7f0000000600)=ANY=[@ANYBLOB="100000000000000029000000070000001c000000000000000000000008000000", @ANYRES32=r9], 0x30}}], 0x1, 0xc0) write$tun(r1, &(0x7f0000000040)=ANY=[@ANYBLOB="00000000ffffffffffffaaaaaaaaaabb080045000043fffe0000002f9078ac1e0001e0000001000086dd002f90782104000196e3c7f96837a34000eec6bb218b4fe44f0847df6a3b5c5274fcaff1c7a195f93c7c"], 0x55) kernel console output (not intermixed with test programs): 1442.689214][T20636] ? trace_irq_disable+0x3b/0x140 [ 1442.689233][T20636] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1442.689253][T20636] ? clear_bhb_loop+0x70/0xc0 [ 1442.689277][T20636] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1442.689296][T20636] RIP: 0033:0x7f2a9559e159 [ 1442.689313][T20636] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1442.689329][T20636] RSP: 002b:00007f2a964f0028 EFLAGS: 00000246 ORIG_RAX: 000000000000012b [ 1442.689349][T20636] RAX: ffffffffffffffda RBX: 00007f2a95825fa0 RCX: 00007f2a9559e159 [ 1442.689363][T20636] RDX: 00101f2043b8267e RSI: 0000200000000fc0 RDI: 0000000000000005 [ 1442.689381][T20636] RBP: 00007f2a964f0090 R08: 0000000000000000 R09: 0000000000000000 [ 1442.689394][T20636] R10: 0000000000010120 R11: 0000000000000246 R12: 0000000000000002 [ 1442.689406][T20636] R13: 00007f2a95826038 R14: 00007f2a95825fa0 R15: 00007ffd71af14c8 [ 1442.689440][T20636] [ 1442.921028][T20632] bond5: entered promiscuous mode [ 1442.922739][T20632] 8021q: adding VLAN 0 to HW filter on device bond5 [ 1442.963236][T20640] netlink: 'syz.0.14301': attribute type 1 has an invalid length. [ 1443.144238][T20640] 8021q: adding VLAN 0 to HW filter on device bond7 [ 1443.161187][T20642] bond7: entered promiscuous mode [ 1443.161210][T20642] bond7: entered allmulticast mode [ 1443.290741][T20661] netlink: 8 bytes leftover after parsing attributes in process `syz.0.14307'. [ 1443.348122][T20664] netlink: 8 bytes leftover after parsing attributes in process `syz.0.14307'. [ 1443.442911][T20668] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 1443.479167][T20674] netlink: 4 bytes leftover after parsing attributes in process `syz.1.14310'. [ 1443.481820][T20670] netlink: 28 bytes leftover after parsing attributes in process `syz.2.14311'. [ 1443.902738][T20695] ip_tables: iptables: counters copy to user failed while replacing table [ 1444.041523][T20703] 8021q: adding VLAN 0 to HW filter on device ipvlan2 [ 1444.091998][T20703] 8021q: adding VLAN 0 to HW filter on device ipvlan3 [ 1444.149835][T20707] 8021q: adding VLAN 0 to HW filter on device ipvlan4 [ 1444.197870][T20703] 8021q: adding VLAN 0 to HW filter on device ipvlan5 [ 1444.405486][T20725] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 1444.469909][T20728] netlink: 'syz.0.14326': attribute type 8 has an invalid length. [ 1444.933017][T20748] __nla_validate_parse: 9 callbacks suppressed [ 1444.933037][T20748] netlink: 20 bytes leftover after parsing attributes in process `syz.1.14332'. [ 1444.956391][T20748] openvswitch: netlink: IP tunnel attribute has 5393 unknown bytes. [ 1445.401982][T20765] netlink: 'syz.0.14336': attribute type 2 has an invalid length. [ 1445.485711][T20769] netlink: 'syz.5.14337': attribute type 21 has an invalid length. [ 1445.485733][T20769] netlink: 128 bytes leftover after parsing attributes in process `syz.5.14337'. [ 1445.487330][T20768] netlink: 'syz.5.14337': attribute type 21 has an invalid length. [ 1445.487347][T20768] netlink: 128 bytes leftover after parsing attributes in process `syz.5.14337'. [ 1445.529017][T20769] netlink: 'syz.5.14337': attribute type 4 has an invalid length. [ 1445.529034][T20769] netlink: 'syz.5.14337': attribute type 3 has an invalid length. [ 1445.529045][T20769] netlink: 3 bytes leftover after parsing attributes in process `syz.5.14337'. [ 1445.529350][T20768] netlink: 'syz.5.14337': attribute type 4 has an invalid length. [ 1445.529363][T20768] netlink: 'syz.5.14337': attribute type 3 has an invalid length. [ 1445.529374][T20768] netlink: 3 bytes leftover after parsing attributes in process `syz.5.14337'. [ 1445.726713][T20776] netlink: 8 bytes leftover after parsing attributes in process `syz.0.14338'. [ 1445.750979][T20777] netlink: 'syz.0.14338': attribute type 10 has an invalid length. [ 1445.796465][T20781] netlink: 8 bytes leftover after parsing attributes in process `syz.1.14339'. [ 1445.888106][T20786] FAULT_INJECTION: forcing a failure. [ 1445.888106][T20786] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1445.888137][T20786] CPU: 1 UID: 0 PID: 20786 Comm: syz.0.14342 Not tainted syzkaller #0 PREEMPT(full) [ 1445.888158][T20786] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 1445.888169][T20786] Call Trace: [ 1445.888177][T20786] [ 1445.888185][T20786] dump_stack_lvl+0xe8/0x150 [ 1445.888217][T20786] should_fail_ex+0x410/0x560 [ 1445.888244][T20786] _copy_from_iter+0x1d3/0x1660 [ 1445.888268][T20786] ? __alloc_skb+0x27a/0x7a0 [ 1445.888292][T20786] ? __alloc_skb+0x27a/0x7a0 [ 1445.888316][T20786] ? __alloc_skb+0x27a/0x7a0 [ 1445.888338][T20786] ? __pfx__copy_from_iter+0x10/0x10 [ 1445.888358][T20786] ? kmem_cache_alloc_node_noprof+0x1f9/0x610 [ 1445.888386][T20786] ? __alloc_skb+0x27a/0x7a0 [ 1445.888405][T20786] ? __alloc_skb+0x27a/0x7a0 [ 1445.888432][T20786] ? netlink_sendmsg+0x650/0xb40 [ 1445.888452][T20786] ? skb_put+0x112/0x210 [ 1445.888477][T20786] netlink_sendmsg+0x6c0/0xb40 [ 1445.888505][T20786] ? __pfx_netlink_sendmsg+0x10/0x10 [ 1445.888533][T20786] ? apparmor_socket_sendmsg+0x18b/0x360 [ 1445.888557][T20786] ? __pfx_netlink_sendmsg+0x10/0x10 [ 1445.888575][T20786] sock_sendmsg_nosec+0x14e/0x190 [ 1445.888598][T20786] ____sys_sendmsg+0x54e/0x850 [ 1445.888627][T20786] ? __pfx_____sys_sendmsg+0x10/0x10 [ 1445.888669][T20786] ? import_iovec+0x73/0xa0 [ 1445.888696][T20786] ___sys_sendmsg+0x2a5/0x360 [ 1445.888719][T20786] ? __lock_acquire+0x747/0x2de0 [ 1445.888744][T20786] ? __pfx____sys_sendmsg+0x10/0x10 [ 1445.888809][T20786] ? __fget_files+0x2a/0x420 [ 1445.888832][T20786] ? __fget_files+0x3a2/0x420 [ 1445.888864][T20786] __x64_sys_sendmsg+0x1b1/0x290 [ 1445.888889][T20786] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 1445.888936][T20786] do_syscall_64+0x166/0x520 [ 1445.888960][T20786] ? trace_irq_disable+0x3b/0x140 [ 1445.888979][T20786] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1445.888998][T20786] ? clear_bhb_loop+0x70/0xc0 [ 1445.889023][T20786] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1445.889041][T20786] RIP: 0033:0x7fecad19e159 [ 1445.889059][T20786] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1445.889074][T20786] RSP: 002b:00007fecae149028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 1445.889095][T20786] RAX: ffffffffffffffda RBX: 00007fecad425fa0 RCX: 00007fecad19e159 [ 1445.889109][T20786] RDX: 0000000020000880 RSI: 0000200000000280 RDI: 0000000000000003 [ 1445.889122][T20786] RBP: 00007fecae149090 R08: 0000000000000000 R09: 0000000000000000 [ 1445.889134][T20786] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1445.889145][T20786] R13: 00007fecad426038 R14: 00007fecad425fa0 R15: 00007fff9e5dec78 [ 1445.889176][T20786] [ 1446.082185][T20792] netlink: 'syz.5.14341': attribute type 1 has an invalid length. [ 1447.199808][T20816] 8021q: adding VLAN 0 to HW filter on device bond4 [ 1447.263468][T20817] bond4: (slave veth5): Enslaving as an active interface with an up link [ 1447.279951][T20818] bond4: (slave dummy0): Enslaving as an active interface with an up link [ 1447.294193][T20824] netlink: 12 bytes leftover after parsing attributes in process `syz.0.14349'. [ 1447.334864][T20823] 8021q: adding VLAN 0 to HW filter on device bond10 [ 1447.579339][T20839] netlink: 8 bytes leftover after parsing attributes in process `syz.0.14351'. [ 1447.661139][T20841] openvswitch: netlink: Key 3 has unexpected len 1384 expected 4 [ 1448.348190][T20868] netlink: 40 bytes leftover after parsing attributes in process `syz.0.14359'. [ 1448.932172][T20882] GUP no longer grows the stack in syz.1.14365 (20882): 200000003000-20000000a000 (200000001000) [ 1448.932207][T20882] CPU: 0 UID: 0 PID: 20882 Comm: syz.1.14365 Not tainted syzkaller #0 PREEMPT(full) [ 1448.932230][T20882] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 1448.932243][T20882] Call Trace: [ 1448.932252][T20882] [ 1448.932261][T20882] dump_stack_lvl+0xe8/0x150 [ 1448.932295][T20882] __get_user_pages+0x23b6/0x2750 [ 1448.932329][T20882] ? lock_acquire+0x115/0x350 [ 1448.932367][T20882] ? __gup_longterm_locked+0xc3b/0x15c0 [ 1448.932402][T20882] __gup_longterm_locked+0xd52/0x15c0 [ 1448.932432][T20882] ? lock_acquire+0x115/0x350 [ 1448.932468][T20882] gup_fast_fallback+0x1d92/0x20e0 [ 1448.932528][T20882] ? __pfx_gup_fast_fallback+0x10/0x10 [ 1448.932555][T20882] ? futex_unqueue+0x22/0x240 [ 1448.932578][T20882] ? is_valid_gup_args+0x11f/0x200 [ 1448.932606][T20882] ? get_user_pages_fast+0x4d/0xb0 [ 1448.932633][T20882] __iov_iter_get_pages_alloc+0x378/0xa40 [ 1448.932666][T20882] ? __pfx_pipe_clear_nowait+0x10/0x10 [ 1448.932691][T20882] iov_iter_get_pages2+0x5e/0xa0 [ 1448.932720][T20882] __se_sys_vmsplice+0x7b5/0x1660 [ 1448.932771][T20882] ? __pfx___se_sys_vmsplice+0x10/0x10 [ 1448.932800][T20882] ? __pfx_futex_wait+0x10/0x10 [ 1448.932902][T20882] do_syscall_64+0x166/0x520 [ 1448.932925][T20882] ? trace_irq_disable+0x3b/0x140 [ 1448.932945][T20882] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1448.932972][T20882] ? clear_bhb_loop+0x70/0xc0 [ 1448.932998][T20882] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1448.933018][T20882] RIP: 0033:0x7fd1db39e159 [ 1448.933037][T20882] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1448.933055][T20882] RSP: 002b:00007fd1dc251028 EFLAGS: 00000246 ORIG_RAX: 0000000000000116 [ 1448.933077][T20882] RAX: ffffffffffffffda RBX: 00007fd1db625fa0 RCX: 00007fd1db39e159 [ 1448.933092][T20882] RDX: 0000000000000001 RSI: 00002000000000c0 RDI: 000000000000000c [ 1448.933104][T20882] RBP: 00007fd1db43506b R08: 0000000000000000 R09: 0000000000000000 [ 1448.933117][T20882] R10: 0000000000000001 R11: 0000000000000246 R12: 0000000000000000 [ 1448.933129][T20882] R13: 00007fd1db626038 R14: 00007fd1db625fa0 R15: 00007fff1112c158 [ 1448.933164][T20882] [ 1449.354172][T20890] sctp: [Deprecated]: syz.2.14368 (pid 20890) Use of int in maxseg socket option. [ 1449.354172][T20890] Use struct sctp_assoc_value instead [ 1449.552886][T20894] tun0: tun_chr_ioctl cmd 2148553947 [ 1449.928322][T20914] syzkaller1: entered promiscuous mode [ 1449.928344][T20914] syzkaller1: entered allmulticast mode [ 1450.869431][T20952] __nla_validate_parse: 4 callbacks suppressed [ 1450.869451][T20952] netlink: 44 bytes leftover after parsing attributes in process `syz.0.14384'. [ 1451.752774][T21004] netlink: 76 bytes leftover after parsing attributes in process `syz.1.14398'. [ 1452.221059][T21022] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 1452.353002][T21026] Cannot find set identified by id 0 to match [ 1452.440674][T21028] 8021q: adding VLAN 0 to HW filter on device ipvlan3 [ 1452.662554][T21041] caif0: tun_chr_ioctl cmd 2147767507 [ 1452.686957][T21035] nla_validate_range_unsigned: 23 callbacks suppressed [ 1452.686976][T21035] netlink: 'syz.5.14404': attribute type 11 has an invalid length. [ 1453.078562][T21063] validate_nla: 3 callbacks suppressed [ 1453.078575][T21063] netlink: 'syz.5.14421': attribute type 2 has an invalid length. [ 1453.083221][T21063] tap0: tun_chr_ioctl cmd 2147767520 [ 1453.233161][T21065] syzkaller0: entered promiscuous mode [ 1453.233183][T21065] syzkaller0: entered allmulticast mode [ 1456.410170][T21097] bond11: option lp_interval: invalid value (0) [ 1456.410195][T21097] bond11: option lp_interval: allowed values 1 - 2147483647 [ 1456.411698][T21097] bond11 (unregistering): Released all slaves [ 1456.627528][T21113] netlink: 120 bytes leftover after parsing attributes in process `syz.1.14435'. [ 1456.631444][T21113] netlink: 44 bytes leftover after parsing attributes in process `syz.1.14435'. [ 1457.050754][T21138] syzkaller0: entered promiscuous mode [ 1457.050775][T21138] syzkaller0: entered allmulticast mode [ 1457.245062][T21148] FAULT_INJECTION: forcing a failure. [ 1457.245062][T21148] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1457.245093][T21148] CPU: 0 UID: 0 PID: 21148 Comm: syz.1.14445 Not tainted syzkaller #0 PREEMPT(full) [ 1457.245115][T21148] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 1457.245127][T21148] Call Trace: [ 1457.245134][T21148] [ 1457.245143][T21148] dump_stack_lvl+0xe8/0x150 [ 1457.245175][T21148] should_fail_ex+0x410/0x560 [ 1457.245203][T21148] _copy_from_user+0x2d/0xb0 [ 1457.245228][T21148] ___sys_recvmsg+0x173/0x5a0 [ 1457.245262][T21148] ? __pfx____sys_recvmsg+0x10/0x10 [ 1457.245293][T21148] ? lock_acquire+0x115/0x350 [ 1457.245344][T21148] do_recvmmsg+0x31a/0x7f0 [ 1457.245378][T21148] ? __pfx_do_recvmmsg+0x10/0x10 [ 1457.245417][T21148] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 1457.245443][T21148] ? __fget_files+0x3a2/0x420 [ 1457.245479][T21148] __x64_sys_recvmmsg+0x198/0x250 [ 1457.245509][T21148] ? __pfx___x64_sys_recvmmsg+0x10/0x10 [ 1457.245547][T21148] do_syscall_64+0x166/0x520 [ 1457.245570][T21148] ? trace_irq_disable+0x3b/0x140 [ 1457.245589][T21148] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1457.245608][T21148] ? clear_bhb_loop+0x70/0xc0 [ 1457.245632][T21148] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1457.245651][T21148] RIP: 0033:0x7fd1db39e159 [ 1457.245669][T21148] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1457.245685][T21148] RSP: 002b:00007fd1dc251028 EFLAGS: 00000246 ORIG_RAX: 000000000000012b [ 1457.245705][T21148] RAX: ffffffffffffffda RBX: 00007fd1db625fa0 RCX: 00007fd1db39e159 [ 1457.245719][T21148] RDX: 00101f2043b8267e RSI: 0000200000000fc0 RDI: 0000000000000005 [ 1457.245731][T21148] RBP: 00007fd1dc251090 R08: 0000000000000000 R09: 0000000000000000 [ 1457.245743][T21148] R10: 0000000000010120 R11: 0000000000000246 R12: 0000000000000002 [ 1457.245755][T21148] R13: 00007fd1db626038 R14: 00007fd1db625fa0 R15: 00007fff1112c158 [ 1457.245785][T21148] [ 1457.628111][T21162] xt_NETMAP: bad MAP_IPS. [ 1457.762346][ C0] vxcan1: j1939_tp_rxtimer: 0xffff88805b8ecc00: rx timeout, send abort [ 1458.145243][T21186] netlink: 'syz.0.14450': attribute type 4 has an invalid length. [ 1458.262386][ C0] vxcan1: j1939_tp_rxtimer: 0xffff88805b8ecc00: abort rx timeout. Force session deactivation [ 1458.391657][T21198] netlink: 'syz.0.14453': attribute type 61 has an invalid length. [ 1458.391675][T21198] netlink: 'syz.0.14453': attribute type 62 has an invalid length. [ 1458.479552][T21206] netlink: 20 bytes leftover after parsing attributes in process `syz.5.14458'. [ 1458.663022][T21216] sit0: entered promiscuous mode [ 1458.672901][T21216] netlink: 'syz.5.14463': attribute type 1 has an invalid length. [ 1458.672916][T21216] netlink: 1 bytes leftover after parsing attributes in process `syz.5.14463'. [ 1458.944441][T21229] syzkaller0: entered promiscuous mode [ 1458.944462][T21229] syzkaller0: entered allmulticast mode [ 1459.015219][T10536] Bluetooth: hci6: unexpected cc 0x0c03 length: 249 > 1 [ 1459.022520][T10536] Bluetooth: hci6: unexpected cc 0x1003 length: 249 > 9 [ 1459.032381][T10536] Bluetooth: hci6: unexpected cc 0x1001 length: 249 > 9 [ 1459.049724][T10536] Bluetooth: hci6: unexpected cc 0x0c23 length: 249 > 4 [ 1459.050335][T10536] Bluetooth: hci6: unexpected cc 0x0c38 length: 249 > 2 [ 1459.085852][T24039] Bluetooth: hci6: unexpected cc 0x0c03 length: 249 > 1 [ 1459.090304][T24039] Bluetooth: hci6: unexpected cc 0x1003 length: 249 > 9 [ 1459.110006][T24039] Bluetooth: hci6: unexpected cc 0x1001 length: 249 > 9 [ 1459.143763][T24039] Bluetooth: hci6: unexpected cc 0x0c23 length: 249 > 4 [ 1459.172873][T24039] Bluetooth: hci6: unexpected cc 0x0c38 length: 249 > 2 [ 1459.641124][T21263] netlink: 'syz.1.14474': attribute type 12 has an invalid length. [ 1459.653282][T21263] netlink: 4 bytes leftover after parsing attributes in process `syz.1.14474'. [ 1460.009741][T21274] syzkaller0: entered promiscuous mode [ 1460.009764][T21274] syzkaller0: entered allmulticast mode [ 1460.252076][T21288] sctp: [Deprecated]: syz.1.14484 (pid 21288) Use of int in maxseg socket option. [ 1460.252076][T21288] Use struct sctp_assoc_value instead [ 1460.268933][T21290] IPv6: addrconf: prefix option has invalid lifetime [ 1460.270390][T21288] netlink: 36 bytes leftover after parsing attributes in process `syz.1.14484'. [ 1460.702185][T21230] bridge0: port 1(bridge_slave_0) entered blocking state [ 1460.702364][T21230] bridge0: port 1(bridge_slave_0) entered disabled state [ 1460.702494][T21230] bridge_slave_0: entered allmulticast mode [ 1460.725475][T21230] bridge_slave_0: entered promiscuous mode [ 1460.734557][T21230] bridge0: port 2(bridge_slave_1) entered blocking state [ 1460.734728][T21230] bridge0: port 2(bridge_slave_1) entered disabled state [ 1460.734864][T21230] bridge_slave_1: entered allmulticast mode [ 1460.736708][T21230] bridge_slave_1: entered promiscuous mode [ 1460.800456][T21230] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 1460.803275][T21230] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 1460.858295][T21230] team0: Port device team_slave_0 added [ 1460.867114][T21230] team0: Port device team_slave_1 added [ 1460.938357][T21327] sctp: [Deprecated]: syz.5.14496 (pid 21327) Use of int in maxseg socket option. [ 1460.938357][T21327] Use struct sctp_assoc_value instead [ 1460.945639][T21230] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 1460.945653][T21230] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 1460.945676][T21230] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 1460.949327][T21230] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 1460.949340][T21230] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 1460.949363][T21230] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 1461.065664][T21323] x_tables: duplicate underflow at hook 1 [ 1461.065760][T21323] x_tables: duplicate underflow at hook 1 [ 1461.065841][T21323] x_tables: duplicate underflow at hook 1 [ 1461.065919][T21323] x_tables: duplicate underflow at hook 1 [ 1461.065996][T21323] x_tables: duplicate underflow at hook 1 [ 1461.066076][T21323] x_tables: duplicate underflow at hook 1 [ 1461.066153][T21323] x_tables: duplicate underflow at hook 1 [ 1461.066228][T21323] x_tables: duplicate underflow at hook 1 [ 1461.066365][T21323] x_tables: duplicate underflow at hook 1 [ 1461.066445][T21323] x_tables: duplicate underflow at hook 1 [ 1461.168745][T21230] hsr_slave_0: entered promiscuous mode [ 1461.169867][T21230] hsr_slave_1: entered promiscuous mode [ 1461.224493][T10536] Bluetooth: hci6: command tx timeout [ 1461.767173][T21230] netdevsim netdevsim6 netdevsim0: renamed from eth0 [ 1461.788461][T21230] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 1461.790164][T21230] netdevsim netdevsim6 netdevsim1: renamed from eth1 [ 1461.805778][T21359] sctp: [Deprecated]: syz.5.14506 (pid 21359) Use of int in maxseg socket option. [ 1461.805778][T21359] Use struct sctp_assoc_value instead [ 1461.825591][T21230] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 1461.827027][T21230] netdevsim netdevsim6 netdevsim2: renamed from eth2 [ 1461.830471][T21230] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 1461.831545][T21230] netdevsim netdevsim6 netdevsim3: renamed from eth3 [ 1461.866030][T21230] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 1462.023137][T21230] 8021q: adding VLAN 0 to HW filter on device bond0 [ 1462.050306][T21230] 8021q: adding VLAN 0 to HW filter on device team0 [ 1462.062566][T12451] bridge0: port 1(bridge_slave_0) entered blocking state [ 1462.062681][T12451] bridge0: port 1(bridge_slave_0) entered forwarding state [ 1462.073417][T12451] bridge0: port 2(bridge_slave_1) entered blocking state [ 1462.073519][T12451] bridge0: port 2(bridge_slave_1) entered forwarding state [ 1462.655238][T21382] batman_adv: batadv0: Interface deactivated: macvtap1 [ 1462.720569][T21382] batman_adv: batadv0: Interface deactivated: ip6gretap1 [ 1462.773897][T12451] netdevsim netdevsim0 netdevsim3: unset [0, 0] type 1 family 0 port 8472 - 0 [ 1462.773926][T12451] netdevsim netdevsim0 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 1462.775115][T21405] netlink: 'syz.1.14515': attribute type 1 has an invalid length. [ 1462.775133][T21405] netlink: 224 bytes leftover after parsing attributes in process `syz.1.14515'. [ 1462.915081][ T1341] netdevsim netdevsim0 netdevsim0: unset [0, 0] type 1 family 0 port 8472 - 0 [ 1462.915115][ T1341] netdevsim netdevsim0 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 1462.917217][ T1341] netdevsim netdevsim0 netdevsim2: unset [0, 0] type 1 family 0 port 8472 - 0 [ 1462.917248][ T1341] netdevsim netdevsim0 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 1462.917791][ T1341] netdevsim netdevsim0 netdevsim1: unset [0, 0] type 1 family 0 port 8472 - 0 [ 1462.917817][ T1341] netdevsim netdevsim0 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 1463.197582][T21419] syzkaller0: entered promiscuous mode [ 1463.197608][T21419] syzkaller0: entered allmulticast mode [ 1463.304820][T10536] Bluetooth: hci6: command tx timeout [ 1463.313188][T21427] netlink: 28 bytes leftover after parsing attributes in process `syz.0.14519'. [ 1463.345792][T21230] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 1463.745796][T21230] veth0_vlan: entered promiscuous mode [ 1463.761983][T21230] veth1_vlan: entered promiscuous mode [ 1463.804857][T21230] veth0_macvtap: entered promiscuous mode [ 1463.812188][T21230] veth1_macvtap: entered promiscuous mode [ 1463.842715][T21230] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 1463.852826][T21230] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 1463.913598][T12451] netdevsim netdevsim6 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 1463.913653][T12451] netdevsim netdevsim6 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 1463.913685][T12451] netdevsim netdevsim6 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 1463.913715][T12451] netdevsim netdevsim6 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 1464.051166][T12454] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1464.051188][T12454] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1464.087451][T21459] netlink: 'syz.5.14528': attribute type 10 has an invalid length. [ 1464.103007][T21459] bond4: (slave dummy0): Releasing backup interface [ 1464.107512][T21459] team0: Device dummy0 is of different type [ 1464.126989][T12454] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1464.127009][T12454] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1465.106203][T21494] netlink: 24 bytes leftover after parsing attributes in process `syz.5.14534'. [ 1465.106273][T21494] bond0: ARP target 0.0.0.2 is already present [ 1465.106314][T21494] bond0: option arp_ip_target: invalid value (33554432) [ 1465.181338][T21497] syzkaller0: entered promiscuous mode [ 1465.181360][T21497] syzkaller0: entered allmulticast mode [ 1465.384079][T10536] Bluetooth: hci6: command tx timeout [ 1465.984484][T21511] tipc: Failed to remove unknown binding: 66,0,0/2127623017:3827308307/3827308309 [ 1465.984532][T21511] tipc: Failed to remove unknown binding: 66,0,0/2127623017:3827308307/3827308308 [ 1465.989342][T24039] Bluetooth: hci7: unexpected cc 0x0c03 length: 249 > 1 [ 1466.034740][T24039] Bluetooth: hci7: unexpected cc 0x1003 length: 249 > 9 [ 1466.037589][T24039] Bluetooth: hci7: unexpected cc 0x1001 length: 249 > 9 [ 1466.040491][T24039] Bluetooth: hci7: unexpected cc 0x0c23 length: 249 > 4 [ 1466.041896][T24039] Bluetooth: hci7: unexpected cc 0x0c38 length: 249 > 2 [ 1466.081885][T21511] tipc: Failed to remove unknown binding: 66,0,0/2127623017:3827308307/3827308309 [ 1466.081914][T21511] tipc: Failed to remove unknown binding: 66,0,0/2127623017:3827308307/3827308308 [ 1466.301895][T21517] netlink: 16 bytes leftover after parsing attributes in process `syz.6.14541'. [ 1466.859096][T21539] netlink: 44 bytes leftover after parsing attributes in process `syz.5.14548'. [ 1466.902532][T21541] netlink: 20 bytes leftover after parsing attributes in process `syz.1.14549'. [ 1467.071751][T21547] netlink: 8 bytes leftover after parsing attributes in process `syz.5.14550'. [ 1467.098682][T21551] netlink: 8 bytes leftover after parsing attributes in process `syz.6.14552'. [ 1467.141645][T21551] vlan2: entered allmulticast mode [ 1467.141667][T21551] bridge0: entered allmulticast mode [ 1467.142004][T21551] bridge0: port 3(vlan2) entered blocking state [ 1467.142114][T21551] bridge0: port 3(vlan2) entered disabled state [ 1467.459576][T21548] syzkaller0: entered promiscuous mode [ 1467.459598][T21548] syzkaller0: entered allmulticast mode [ 1467.461439][T21562] netlink: 8 bytes leftover after parsing attributes in process `syz.1.14555'. [ 1467.468247][T10536] Bluetooth: hci6: command tx timeout [ 1468.074687][T21581] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 1468.118196][T10536] Bluetooth: hci7: command tx timeout [ 1469.299465][T21512] bridge0: port 1(bridge_slave_0) entered blocking state [ 1469.302596][T21512] bridge0: port 1(bridge_slave_0) entered disabled state [ 1469.302736][T21512] bridge_slave_0: entered allmulticast mode [ 1469.304631][T21512] bridge_slave_0: entered promiscuous mode [ 1469.352657][T21512] bridge0: port 2(bridge_slave_1) entered blocking state [ 1469.352812][T21512] bridge0: port 2(bridge_slave_1) entered disabled state [ 1469.352962][T21512] bridge_slave_1: entered allmulticast mode [ 1469.394921][T21512] bridge_slave_1: entered promiscuous mode [ 1469.519914][T21512] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 1469.538695][T21512] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 1469.615359][T21512] team0: Port device team_slave_0 added [ 1469.626931][T21512] team0: Port device team_slave_1 added [ 1469.685398][T21632] netlink: 24 bytes leftover after parsing attributes in process `syz.5.14571'. [ 1469.711185][T21636] netlink: 16 bytes leftover after parsing attributes in process `syz.6.14572'. [ 1469.713398][T21635] xt_l2tp: v2 sid > 0xffff: 33554432 [ 1469.767444][T21636] netlink: 'syz.6.14572': attribute type 1 has an invalid length. [ 1469.767507][T21636] netlink: 200 bytes leftover after parsing attributes in process `syz.6.14572'. [ 1469.830427][T21512] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 1469.830445][T21512] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 1469.830468][T21512] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 1469.836462][T21512] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 1469.836478][T21512] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 1469.836501][T21512] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 1469.848445][T21636] netdevsim netdevsim6 netdevsim0: IPsec offload requires 128 bit authentication [ 1469.857001][T21640] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 1470.090190][T21512] hsr_slave_0: entered promiscuous mode [ 1470.091317][T21512] hsr_slave_1: entered promiscuous mode [ 1470.092150][T21512] debugfs: 'hsr0' already exists in 'hsr' [ 1470.092168][T21512] Cannot create hsr debugfs directory [ 1470.196747][T10536] Bluetooth: hci7: command tx timeout [ 1470.202327][T21652] netlink: 12 bytes leftover after parsing attributes in process `syz.1.14578'. [ 1470.283805][T21659] netlink: 8 bytes leftover after parsing attributes in process `syz.5.14580'. [ 1470.320542][T21659] vlan2: entered allmulticast mode [ 1470.320870][T21659] bridge0: port 2(vlan2) entered blocking state [ 1470.321056][T21659] bridge0: port 2(vlan2) entered disabled state [ 1472.265178][T24039] Bluetooth: hci7: command tx timeout [ 1473.417981][T21663] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 1473.452778][T21512] netdevsim netdevsim7 netdevsim0: renamed from eth0 [ 1473.479417][T21512] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 1473.480241][T21512] netdevsim netdevsim7 netdevsim1: renamed from eth1 [ 1473.515794][T21512] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 1473.516404][T21512] netdevsim netdevsim7 netdevsim2: renamed from eth2 [ 1473.574933][T21512] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 1473.576166][T21512] netdevsim netdevsim7 netdevsim3: renamed from eth3 [ 1473.591867][T21512] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 1473.667872][T21708] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 1473.711506][T21712] ip_tables: iptables: counters copy to user failed while replacing table [ 1473.790111][T21712] netlink: 48 bytes leftover after parsing attributes in process `syz.6.14589'. [ 1473.869723][T21719] netlink: 8 bytes leftover after parsing attributes in process `syz.1.14594'. [ 1473.871709][T21719] netlink: 8 bytes leftover after parsing attributes in process `syz.1.14594'. [ 1473.871807][T21719] netlink: 8 bytes leftover after parsing attributes in process `syz.1.14594'. [ 1473.871905][T21719] netlink: 8 bytes leftover after parsing attributes in process `syz.1.14594'. [ 1474.237224][T21512] 8021q: adding VLAN 0 to HW filter on device bond0 [ 1474.266513][T21512] 8021q: adding VLAN 0 to HW filter on device team0 [ 1474.279429][T12454] bridge0: port 1(bridge_slave_0) entered blocking state [ 1474.279531][T12454] bridge0: port 1(bridge_slave_0) entered forwarding state [ 1474.303215][T12454] bridge0: port 2(bridge_slave_1) entered blocking state [ 1474.303400][T12454] bridge0: port 2(bridge_slave_1) entered forwarding state [ 1474.347738][T24039] Bluetooth: hci7: command tx timeout [ 1474.839262][T21763] __nla_validate_parse: 62 callbacks suppressed [ 1474.839282][T21763] netlink: 28 bytes leftover after parsing attributes in process `syz.0.14600'. [ 1474.852577][T21763] bridge0: entered promiscuous mode [ 1474.852632][T21763] bridge0: entered allmulticast mode [ 1475.052496][T21769] sctp: [Deprecated]: syz.1.14601 (pid 21769) Use of int in maxseg socket option. [ 1475.052496][T21769] Use struct sctp_assoc_value instead [ 1475.057070][T21769] netlink: 36 bytes leftover after parsing attributes in process `syz.1.14601'. [ 1475.168561][T21512] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 1475.461484][T21512] veth0_vlan: entered promiscuous mode [ 1475.481147][T21512] veth1_vlan: entered promiscuous mode [ 1475.519260][T21512] veth0_macvtap: entered promiscuous mode [ 1475.522861][T21512] veth1_macvtap: entered promiscuous mode [ 1475.537180][T21512] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 1475.541137][T21512] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 1475.625495][ T1341] netdevsim netdevsim7 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 1475.628913][ T1341] netdevsim netdevsim7 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 1475.629775][ T1341] netdevsim netdevsim7 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 1475.630039][ T1341] netdevsim netdevsim7 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 1477.352077][T21739] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 1477.574926][T21785] FAULT_INJECTION: forcing a failure. [ 1477.574926][T21785] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1477.574957][T21785] CPU: 0 UID: 0 PID: 21785 Comm: syz.1.14605 Not tainted syzkaller #0 PREEMPT(full) [ 1477.574978][T21785] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 1477.574988][T21785] Call Trace: [ 1477.574996][T21785] [ 1477.575005][T21785] dump_stack_lvl+0xe8/0x150 [ 1477.575038][T21785] should_fail_ex+0x410/0x560 [ 1477.575064][T21785] _copy_from_user+0x2d/0xb0 [ 1477.575090][T21785] ___sys_recvmsg+0x173/0x5a0 [ 1477.575123][T21785] ? __pfx____sys_recvmsg+0x10/0x10 [ 1477.575154][T21785] ? lock_acquire+0x115/0x350 [ 1477.575203][T21785] do_recvmmsg+0x31a/0x7f0 [ 1477.575237][T21785] ? __pfx_do_recvmmsg+0x10/0x10 [ 1477.575275][T21785] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 1477.575300][T21785] ? __fget_files+0x3a2/0x420 [ 1477.575336][T21785] __x64_sys_recvmmsg+0x198/0x250 [ 1477.575365][T21785] ? __pfx___x64_sys_recvmmsg+0x10/0x10 [ 1477.575403][T21785] do_syscall_64+0x166/0x520 [ 1477.575425][T21785] ? trace_irq_disable+0x3b/0x140 [ 1477.575443][T21785] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1477.575463][T21785] ? clear_bhb_loop+0x70/0xc0 [ 1477.575486][T21785] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1477.575505][T21785] RIP: 0033:0x7fd1db39e159 [ 1477.575522][T21785] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1477.575537][T21785] RSP: 002b:00007fd1dc251028 EFLAGS: 00000246 ORIG_RAX: 000000000000012b [ 1477.575564][T21785] RAX: ffffffffffffffda RBX: 00007fd1db625fa0 RCX: 00007fd1db39e159 [ 1477.575577][T21785] RDX: 00101f2043b8267e RSI: 0000200000000fc0 RDI: 0000000000000005 [ 1477.575591][T21785] RBP: 00007fd1dc251090 R08: 0000000000000000 R09: 0000000000000000 [ 1477.575601][T21785] R10: 0000000000010120 R11: 0000000000000246 R12: 0000000000000002 [ 1477.575613][T21785] R13: 00007fd1db626038 R14: 00007fd1db625fa0 R15: 00007fff1112c158 [ 1477.575644][T21785] [ 1477.670826][T21788] netlink: 'syz.1.14608': attribute type 1 has an invalid length. [ 1477.699599][T12454] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1477.699619][T12454] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1477.808140][T21788] bond11: entered promiscuous mode [ 1477.808838][T21788] 8021q: adding VLAN 0 to HW filter on device bond11 [ 1477.911061][T21800] netlink: 12 bytes leftover after parsing attributes in process `syz.5.14607'. [ 1477.912955][T21797] 8021q: adding VLAN 0 to HW filter on device bond11 [ 1477.916288][T21797] bond11: (slave gre3): The slave device specified does not support setting the MAC address [ 1477.916308][T21797] bond11: (slave gre3): Setting fail_over_mac to active for active-backup mode [ 1477.927398][T21797] bond11: (slave gre3): making interface the new active one [ 1477.927417][T21797] gre3: entered promiscuous mode [ 1477.928941][T21797] bond11: (slave gre3): Enslaving as an active interface with an up link [ 1477.981252][T21786] netlink: 495 bytes leftover after parsing attributes in process `syz.0.14604'. [ 1478.015485][T12452] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1478.015504][T12452] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1478.150132][T12454] nci: nci_rx_work: unknown MT 0x6 [ 1478.151603][T21793] netlink: 'syz.6.14606': attribute type 4 has an invalid length. [ 1478.151623][T21793] netlink: 152 bytes leftover after parsing attributes in process `syz.6.14606'. [ 1478.173257][T21793] A link change request failed with some changes committed already. Interface bond0 may have been left with an inconsistent configuration, please check. [ 1478.264261][T21815] sctp: [Deprecated]: syz.5.14611 (pid 21815) Use of int in maxseg socket option. [ 1478.264261][T21815] Use struct sctp_assoc_value instead [ 1478.265099][T21815] netlink: 36 bytes leftover after parsing attributes in process `syz.5.14611'. [ 1478.351120][T21819] netlink: 28 bytes leftover after parsing attributes in process `syz.0.14613'. [ 1478.351158][T21819] netlink: 28 bytes leftover after parsing attributes in process `syz.0.14613'. [ 1478.391579][T21819] 0ªî{X¹¦: entered promiscuous mode [ 1478.399620][T21819] 0ªî{X¹¦: left promiscuous mode [ 1478.445239][T21825] netlink: 44 bytes leftover after parsing attributes in process `syz.7.14615'. [ 1478.560511][T21828] can: request_module (can-proto-0) failed. [ 1478.786991][T21841] netlink: 8 bytes leftover after parsing attributes in process `syz.0.14618'. [ 1479.722729][T21854] openvswitch: netlink: Unknown key attributes 1 [ 1479.896825][T21858] team0: Device xfrm0 is of different type [ 1480.698262][T21790] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 1480.952403][T21874] __nla_validate_parse: 4 callbacks suppressed [ 1480.952423][T21874] netlink: 44 bytes leftover after parsing attributes in process `syz.0.14627'. [ 1481.451508][T21892] pim6reg1: entered promiscuous mode [ 1481.451530][T21892] pim6reg1: entered allmulticast mode [ 1481.480438][T21892] netlink: 8 bytes leftover after parsing attributes in process `syz.7.14630'. [ 1481.502321][T21900] netlink: 12 bytes leftover after parsing attributes in process `syz.6.14632'. [ 1481.523077][ T31] audit: type=1804 audit(1790723459.331:21): pid=21905 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=open_writers comm="syz.0.14634" name="/newroot/460/cgroup.controllers" dev="tmpfs" ino=2351 res=1 errno=0 [ 1481.523334][ T31] audit: type=1800 audit(1790723459.331:22): pid=21905 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.0.14634" name="cgroup.controllers" dev="tmpfs" ino=2351 res=0 errno=0 [ 1481.597980][ T31] audit: type=1804 audit(1790723459.401:23): pid=21906 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=ToMToU comm="syz.0.14634" name="/newroot/460/cgroup.controllers" dev="tmpfs" ino=2351 res=1 errno=0 [ 1481.826906][T21917] team0: Device xfrm0 is of different type [ 1482.018953][T21925] netlink: 44 bytes leftover after parsing attributes in process `syz.0.14641'. [ 1482.103296][T21934] netlink: 8 bytes leftover after parsing attributes in process `syz.5.14642'. [ 1482.542820][T21963] netlink: 12 bytes leftover after parsing attributes in process `syz.7.14648'. [ 1482.637691][T21965] netlink: 24 bytes leftover after parsing attributes in process `syz.1.14649'. [ 1482.700110][T21968] team0: Device xfrm0 is of different type [ 1485.029459][T21927] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 1485.268976][T21983] netlink: 'syz.5.14656': attribute type 12 has an invalid length. [ 1485.455965][ T31] audit: type=1804 audit(1790723463.251:24): pid=21998 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=open_writers comm="syz.7.14658" name="/newroot/18/cgroup.controllers" dev="tmpfs" ino=109 res=1 errno=0 [ 1485.456016][ T31] audit: type=1800 audit(1790723463.251:25): pid=21998 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.7.14658" name="cgroup.controllers" dev="tmpfs" ino=109 res=0 errno=0 [ 1485.463322][T21998] No such timeout policy "syz0" [ 1485.504783][T21994] netlink: 12 bytes leftover after parsing attributes in process `syz.0.14660'. [ 1485.675501][T22003] netlink: 4 bytes leftover after parsing attributes in process `syz.6.14662'. [ 1485.830204][T10536] Bluetooth: hci8: unexpected cc 0x0c03 length: 249 > 1 [ 1485.848465][T10536] Bluetooth: hci8: unexpected cc 0x1003 length: 249 > 9 [ 1485.849423][T10536] Bluetooth: hci8: unexpected cc 0x1001 length: 249 > 9 [ 1485.850349][T10536] Bluetooth: hci8: unexpected cc 0x0c23 length: 249 > 4 [ 1485.851915][T10536] Bluetooth: hci8: unexpected cc 0x0c38 length: 249 > 2 [ 1486.042305][T22011] syzkaller0: entered promiscuous mode [ 1486.042327][T22011] syzkaller0: entered allmulticast mode [ 1486.282064][T22029] netlink: 8 bytes leftover after parsing attributes in process `syz.7.14667'. [ 1486.332547][T22030] netlink: 4 bytes leftover after parsing attributes in process `syz.6.14669'. [ 1486.332668][T22030] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 1486.363111][T22030] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 1486.915945][T22045] IPVS: length: 24 != 8 [ 1487.545408][T22131] syz.6.14681: vmalloc error: size 8589938688, exceeds total pages, mode:0x400dc0(GFP_KERNEL_ACCOUNT|__GFP_ZERO), nodemask=(null),cpuset=/,mems_allowed=0-1 [ 1487.545520][T22131] CPU: 1 UID: 0 PID: 22131 Comm: syz.6.14681 Not tainted syzkaller #0 PREEMPT(full) [ 1487.545542][T22131] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 1487.545555][T22131] Call Trace: [ 1487.545563][T22131] [ 1487.545572][T22131] dump_stack_lvl+0xe8/0x150 [ 1487.545605][T22131] warn_alloc+0x24d/0x270 [ 1487.545626][T22131] ? kasan_save_track+0x4f/0x80 [ 1487.545646][T22131] ? kasan_save_track+0x3e/0x80 [ 1487.545669][T22131] ? __pfx_warn_alloc+0x10/0x10 [ 1487.545686][T22131] ? __x64_sys_setsockopt+0x13d/0x1b0 [ 1487.545712][T22131] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1487.545754][T22131] __vmalloc_node_range_noprof+0x127/0x1540 [ 1487.545807][T22131] ? rcu_is_watching+0x16/0xb0 [ 1487.545835][T22131] ? __pfx___vmalloc_node_range_noprof+0x10/0x10 [ 1487.545864][T22131] ? __kmalloc_cache_noprof+0x321/0x600 [ 1487.545885][T22131] ? __kmalloc_cache_noprof+0x14d/0x600 [ 1487.545903][T22131] ? xskq_create+0x56/0x220 [ 1487.546020][T22131] xskq_create+0x148/0x220 [ 1487.546041][T22131] ? xsk_init_queue+0x8a/0xe0 [ 1487.546066][T22131] xsk_init_queue+0x8a/0xe0 [ 1487.546089][T22131] xsk_setsockopt+0x52a/0x960 [ 1487.546111][T22131] ? __pfx_xsk_setsockopt+0x10/0x10 [ 1487.546131][T22131] ? __pfx_aa_sk_perm+0x10/0x10 [ 1487.546167][T22131] ? bpf_lsm_socket_setsockopt+0x9/0x20 [ 1487.546192][T22131] ? __pfx_xsk_setsockopt+0x10/0x10 [ 1487.546215][T22131] do_sock_setsockopt+0x17c/0x1b0 [ 1487.546246][T22131] __x64_sys_setsockopt+0x13d/0x1b0 [ 1487.546277][T22131] do_syscall_64+0x166/0x520 [ 1487.546301][T22131] ? trace_irq_disable+0x3b/0x140 [ 1487.546329][T22131] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1487.546349][T22131] ? clear_bhb_loop+0x70/0xc0 [ 1487.546374][T22131] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1487.546395][T22131] RIP: 0033:0x7f373359e159 [ 1487.546414][T22131] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1487.546430][T22131] RSP: 002b:00007f37343d1028 EFLAGS: 00000246 ORIG_RAX: 0000000000000036 [ 1487.546451][T22131] RAX: ffffffffffffffda RBX: 00007f3733825fa0 RCX: 00007f373359e159 [ 1487.546466][T22131] RDX: 0000000000000006 RSI: 000000000000011b RDI: 0000000000000005 [ 1487.546478][T22131] RBP: 00007f373363506b R08: 0000000000000004 R09: 0000000000000000 [ 1487.546491][T22131] R10: 0000200000000000 R11: 0000000000000246 R12: 0000000000000000 [ 1487.546503][T22131] R13: 00007f3733826038 R14: 00007f3733825fa0 R15: 00007ffdbac96778 [ 1487.546535][T22131] [ 1487.546543][T22131] Mem-Info: [ 1487.546552][T22131] active_anon:10494 inactive_anon:0 isolated_anon:0 [ 1487.546552][T22131] active_file:17 inactive_file:44496 isolated_file:0 [ 1487.546552][T22131] unevictable:0 dirty:168 writeback:0 [ 1487.546552][T22131] slab_reclaimable:13300 slab_unreclaimable:131460 [ 1487.546552][T22131] mapped:45477 shmem:657 pagetables:3623 [ 1487.546552][T22131] sec_pagetables:0 bounce:0 [ 1487.546552][T22131] kernel_misc_reclaimable:0 [ 1487.546552][T22131] free:1238430 free_pcp:14568 free_cma:0 [ 1487.546599][T22131] Node 0 active_anon:41976kB inactive_anon:0kB active_file:68kB inactive_file:177788kB unevictable:0kB isolated(anon):0kB isolated(file):0kB mapped:181908kB dirty:672kB writeback:0kB shmem:2628kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB kernel_stack:18624kB pagetables:14356kB sec_pagetables:0kB all_unreclaimable? no Balloon:0kB gpu_active:0kB gpu_reclaim:0kB [ 1487.546647][T22131] Node 1 active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:196kB unevictable:0kB isolated(anon):0kB isolated(file):0kB mapped:0kB dirty:0kB writeback:0kB shmem:0kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB kernel_stack:64kB pagetables:136kB sec_pagetables:0kB all_unreclaimable? no Balloon:0kB gpu_active:0kB gpu_reclaim:0kB [ 1487.546692][T22131] Node 0 DMA free:15360kB boost:0kB min:208kB low:260kB high:312kB reserved_highatomic:0kB free_highatomic:0kB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB zspages:0kB present:15992kB managed:15360kB mlocked:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB [ 1487.546744][T22131] lowmem_reserve[]: 0 2487 2487 2487 2487 [ 1487.546779][T22131] Node 0 DMA32 free:1013148kB boost:0kB min:34140kB low:42672kB high:51204kB reserved_highatomic:0kB free_highatomic:0kB active_anon:41976kB inactive_anon:0kB active_file:68kB inactive_file:177788kB unevictable:0kB writepending:672kB zspages:0kB present:3129332kB managed:2546840kB mlocked:0kB bounce:0kB free_pcp:46184kB local_pcp:16388kB free_cma:0kB [ 1487.546832][T22131] lowmem_reserve[]: 0 0 0 0 0 [ 1487.546865][T22131] Node 0 Normal free:0kB boost:0kB min:0kB low:0kB high:0kB reserved_highatomic:0kB free_highatomic:0kB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB zspages:0kB present:1048580kB managed:0kB mlocked:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB [ 1487.546915][T22131] lowmem_reserve[]: 0 0 0 0 0 [ 1487.546943][T22131] Node 1 Normal free:3925212kB boost:0kB min:55760kB low:69700kB high:83640kB reserved_highatomic:0kB free_highatomic:0kB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:196kB unevictable:0kB writepending:0kB zspages:0kB present:4194300kB managed:4111104kB mlocked:0kB bounce:0kB free_pcp:12088kB local_pcp:8060kB free_cma:0kB [ 1487.546994][T22131] lowmem_reserve[]: 0 0 0 0 0 [ 1487.547027][T22131] Node 0 DMA: 0*4kB 0*8kB 0*16kB 0*32kB 0*64kB 0*128kB 0*256kB 0*512kB 1*1024kB (U) 1*2048kB (M) 3*4096kB (M) = 15360kB [ 1487.547131][T22131] Node 0 DMA32: 1217*4kB (UME) 2040*8kB (UME) 1476*16kB (UME) 250*32kB (UME) 338*64kB (UME) 635*128kB (UME) 415*256kB (UME) 195*512kB (UM) 132*1024kB (UM) 8*2048kB (UME) 122*4096kB (UM) = 1013060kB [ 1487.547271][T22131] Node 0 Normal: 0*4kB 0*8kB 0*16kB 0*32kB 0*64kB 0*128kB 0*256kB 0*512kB 0*1024kB 0*2048kB 0*4096kB = 0kB [ 1487.547376][T22131] Node 1 Normal: 2*4kB (M) 1*8kB (M) 2*16kB (UM) 2*32kB (UM) 1*64kB (M) 2*128kB (UM) 3*256kB (UM) 2*512kB (M) 1*1024kB (M) 1*2048kB (U) 957*4096kB (M) = 3925168kB [ 1487.547506][T22131] Node 0 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 1487.547522][T22131] Node 0 hugepages_total=2 hugepages_free=2 hugepages_surp=0 hugepages_size=2048kB [ 1487.547538][T22131] Node 1 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 1487.547553][T22131] Node 1 hugepages_total=2 hugepages_free=2 hugepages_surp=0 hugepages_size=2048kB [ 1487.547569][T22131] 45166 total pagecache pages [ 1487.547577][T22131] 0 pages in swap cache [ 1487.547584][T22131] Free swap = 124996kB [ 1487.547592][T22131] Total swap = 124996kB [ 1487.547600][T22131] 2097051 pages RAM [ 1487.547607][T22131] 0 pages HighMem/MovableOnly [ 1487.547615][T22131] 428725 pages reserved [ 1487.547622][T22131] 0 pages cma reserved [ 1487.962725][T10536] Bluetooth: hci8: command tx timeout [ 1488.607298][T12452] netdevsim netdevsim1 eth3: set [1, 0] type 2 family 0 port 6081 - 0 [ 1488.607718][T12452] netdevsim netdevsim1 eth2: set [1, 0] type 2 family 0 port 6081 - 0 [ 1488.607761][T12452] netdevsim netdevsim1 eth1: set [1, 0] type 2 family 0 port 6081 - 0 [ 1488.733928][T12452] netdevsim netdevsim1 eth4: set [1, 0] type 2 family 0 port 6081 - 0 [ 1488.871566][T12451] pim6reg99999999: left allmulticast mode [ 1489.284406][T22225] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 1489.449398][T22046] workqueue: Failed to create a rescuer kthread for wq "nfc3_nci_tx_wq": -EINTR [ 1489.505702][T12451] team0: Port device xfrm0 removed [ 1489.564838][ C0] ip6_tunnel: ip6tnl1 xmit: Local address not yet configured! [ 1489.682143][T12451] batman_adv: batadv0: Removing interface: gretap0 [ 1489.846563][T12451] bond7 (unregistering): (slave gretap1): Releasing backup interface [ 1489.902781][T12451] bond11 (unregistering): (slave gre3): Releasing backup interface [ 1489.902808][T12451] gre3 (unregistering): left promiscuous mode [ 1489.958829][T12451] bond6 (unregistering): (slave gre2): Releasing backup interface [ 1489.958856][T12451] gre2 (unregistering): left promiscuous mode [ 1490.049633][T10536] Bluetooth: hci8: command tx timeout [ 1490.325964][T12451] bond3 (unregistering): (slave bridge2): Releasing backup interface [ 1490.325986][T12451] bond3 (unregistering): (slave bridge2): the permanent HWaddr of slave - d6:8a:2f:35:16:78 - is still in use by bond - set the HWaddr of slave to a different address to avoid conflicts [ 1490.326010][T12451] bridge2 (unregistering): left promiscuous mode [ 1490.326026][T12451] bridge2 (unregistering): left allmulticast mode [ 1490.326043][T12451] bond3 (unregistering): (slave bridge3): making interface the new active one [ 1490.326056][T12451] bridge3 (unregistering): entered promiscuous mode [ 1490.326087][T12451] bridge3 (unregistering): entered allmulticast mode [ 1490.335568][T22252] netlink: 12 bytes leftover after parsing attributes in process `syz.6.14688'. [ 1490.390807][T12451] bond3 (unregistering): (slave bridge3): Releasing backup interface [ 1490.390833][T12451] bridge3 (unregistering): left promiscuous mode [ 1490.390850][T12451] bridge3 (unregistering): left allmulticast mode [ 1490.514418][T12451] bond0 (unregistering): Released all slaves [ 1490.541966][ T1340] smbdirect: ib_dev[syz1] removed [ 1490.563659][T12451] bond1 (unregistering): Released all slaves [ 1490.611801][T12451] bond2 (unregistering): Released all slaves [ 1490.699225][T12451] bond3 (unregistering): Released all slaves [ 1490.725898][T12451] bond4 (unregistering): Released all slaves [ 1490.745040][T12451] bond5 (unregistering): Released all slaves [ 1490.777390][T12451] bond6 (unregistering): Released all slaves [ 1490.824001][T12451] bond7 (unregistering): (slave bond8): Releasing backup interface [ 1490.847227][T12451] bond7 (unregistering): Released all slaves [ 1490.879887][T12451] bond8 (unregistering): Released all slaves [ 1490.921801][T12451] bond9 (unregistering): Released all slaves [ 1490.962338][T12451] bond10 (unregistering): Released all slaves [ 1490.992150][T12451] bond11 (unregistering): Released all slaves [ 1491.095880][T22258] FAULT_INJECTION: forcing a failure. [ 1491.095880][T22258] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1491.095911][T22258] CPU: 0 UID: 0 PID: 22258 Comm: syz.0.14690 Not tainted syzkaller #0 PREEMPT(full) [ 1491.095931][T22258] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 1491.095942][T22258] Call Trace: [ 1491.095950][T22258] [ 1491.095958][T22258] dump_stack_lvl+0xe8/0x150 [ 1491.095989][T22258] should_fail_ex+0x410/0x560 [ 1491.096015][T22258] _copy_from_user+0x2d/0xb0 [ 1491.096039][T22258] ___sys_recvmsg+0x173/0x5a0 [ 1491.096071][T22258] ? __pfx____sys_recvmsg+0x10/0x10 [ 1491.096101][T22258] ? lock_acquire+0x115/0x350 [ 1491.096147][T22258] do_recvmmsg+0x31a/0x7f0 [ 1491.096173][T22258] ? __pfx_do_recvmmsg+0x10/0x10 [ 1491.096204][T22258] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 1491.096226][T22258] ? __fget_files+0x3a2/0x420 [ 1491.096256][T22258] __x64_sys_recvmmsg+0x198/0x250 [ 1491.096284][T22258] ? __pfx___x64_sys_recvmmsg+0x10/0x10 [ 1491.096319][T22258] do_syscall_64+0x166/0x520 [ 1491.096341][T22258] ? trace_irq_disable+0x3b/0x140 [ 1491.096359][T22258] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1491.096378][T22258] ? clear_bhb_loop+0x70/0xc0 [ 1491.096400][T22258] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1491.096420][T22258] RIP: 0033:0x7fecad19e159 [ 1491.096437][T22258] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1491.096452][T22258] RSP: 002b:00007fecae149028 EFLAGS: 00000246 ORIG_RAX: 000000000000012b [ 1491.096472][T22258] RAX: ffffffffffffffda RBX: 00007fecad425fa0 RCX: 00007fecad19e159 [ 1491.096486][T22258] RDX: 00101f2043b8267e RSI: 0000200000000fc0 RDI: 0000000000000005 [ 1491.096499][T22258] RBP: 00007fecae149090 R08: 0000000000000000 R09: 0000000000000000 [ 1491.096511][T22258] R10: 0000000000010120 R11: 0000000000000246 R12: 0000000000000002 [ 1491.096523][T22258] R13: 00007fecad426038 R14: 00007fecad425fa0 R15: 00007fff9e5dec78 [ 1491.096556][T22258] [ 1491.508904][T12451] þ: left promiscuous mode [ 1491.574272][T22264] netlink: 44 bytes leftover after parsing attributes in process `syz.6.14692'. [ 1492.027670][T22286] netlink: 4 bytes leftover after parsing attributes in process `syz.0.14693'. [ 1492.116671][T10536] Bluetooth: hci8: command tx timeout [ 1494.193747][T10536] Bluetooth: hci8: command tx timeout [ 1494.635096][T22278] netlink: 48 bytes leftover after parsing attributes in process `syz.7.14694'. [ 1494.667313][ C0] ip6_tunnel: ip6gretap1 xmit: Local address not yet configured! [ 1494.684168][T22297] netlink: 28 bytes leftover after parsing attributes in process `syz.6.14695'. [ 1494.737847][T22299] netlink: 48 bytes leftover after parsing attributes in process `syz.6.14695'. [ 1494.918991][ T5280] 8021q: adding VLAN 0 to HW filter on device eth1 [ 1494.932725][T12451] tipc: Disabling bearer [ 1494.954748][T12451] tipc: Left network mode [ 1495.209764][T12451] IPVS: stopping master sync thread 14434 ... [ 1495.372697][T22007] bridge0: port 1(bridge_slave_0) entered blocking state [ 1495.372803][T22007] bridge0: port 1(bridge_slave_0) entered disabled state [ 1495.372957][T22007] bridge_slave_0: entered allmulticast mode [ 1495.374726][T22007] bridge_slave_0: entered promiscuous mode [ 1495.379152][T22007] bridge0: port 2(bridge_slave_1) entered blocking state [ 1495.379248][T22007] bridge0: port 2(bridge_slave_1) entered disabled state [ 1495.379377][T22007] bridge_slave_1: entered allmulticast mode [ 1495.380998][T22007] bridge_slave_1: entered promiscuous mode [ 1495.592881][T22007] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 1495.655738][T22007] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 1495.863985][T22326] netlink: 12 bytes leftover after parsing attributes in process `syz.0.14701'. [ 1495.998711][T22007] team0: Port device team_slave_0 added [ 1496.011687][T22007] team0: Port device team_slave_1 added [ 1496.679852][T22363] netlink: 20 bytes leftover after parsing attributes in process `syz.0.14711'. [ 1496.679877][T22363] nbd: socks must be embedded in a SOCK_ITEM attr [ 1496.787545][T22374] ip_tables: iptables: counters copy to user failed while replacing table [ 1496.813305][T22374] netlink: 16 bytes leftover after parsing attributes in process `syz.6.14712'. [ 1496.939367][T22384] IPVS: set_ctl: invalid protocol: 0 0.0.0.0:0 [ 1499.327288][T22007] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 1499.327307][T22007] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 1499.327331][T22007] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 1499.329851][T22007] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 1499.329865][T22007] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 1499.329887][T22007] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 1499.479177][ T5280] 8021q: adding VLAN 0 to HW filter on device eth2 [ 1499.480449][T22380] workqueue: Failed to create a rescuer kthread for wq "bond8": -EINTR [ 1499.483411][T22384] workqueue: Failed to create a rescuer kthread for wq "bond8": -EINTR [ 1499.672248][T22399] netlink: 44 bytes leftover after parsing attributes in process `syz.6.14716'. [ 1499.863658][T22394] 8021q: adding VLAN 0 to HW filter on device bond1 [ 1499.908828][T22410] netlink: 12 bytes leftover after parsing attributes in process `syz.5.14718'. [ 1499.944931][T22394] 8021q: adding VLAN 0 to HW filter on device bond2 [ 1500.006903][T22007] hsr_slave_0: entered promiscuous mode [ 1500.007849][T22007] hsr_slave_1: entered promiscuous mode [ 1500.008481][T22007] debugfs: 'hsr0' already exists in 'hsr' [ 1500.008498][T22007] Cannot create hsr debugfs directory [ 1500.129755][T22394] 8021q: adding VLAN 0 to HW filter on device bond3 [ 1500.214768][T22394] 8021q: adding VLAN 0 to HW filter on device bond4 [ 1500.449535][T22426] netlink: 24 bytes leftover after parsing attributes in process `syz.5.14721'. [ 1500.449778][T22426] netlink: 24 bytes leftover after parsing attributes in process `syz.5.14721'. [ 1500.519078][T22394] 8021q: adding VLAN 0 to HW filter on device bond5 [ 1501.055375][T28528] netdevsim netdevsim6 netdevsim0: set [0, 0] type 1 family 0 port 8472 - 0 [ 1501.055447][T28528] netdevsim netdevsim6 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0 [ 1501.055482][T28528] netdevsim netdevsim6 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0 [ 1501.055517][T28528] netdevsim netdevsim6 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0 [ 1501.401875][T22453] bond8: entered promiscuous mode [ 1501.401939][T22453] bond8: entered allmulticast mode [ 1501.402306][T22453] 8021q: adding VLAN 0 to HW filter on device bond8 [ 1501.411195][T22442] netlink: 12 bytes leftover after parsing attributes in process `syz.5.14723'. [ 1501.914951][T22471] sch_tbf: burst 7 is lower than device bridge0 mtu (1514) ! [ 1502.014810][T22473] netlink: 8 bytes leftover after parsing attributes in process `syz.0.14728'. [ 1502.015070][T22473] sch_tbf: peakrate 896 is lower than or equals to rate 3850 ! [ 1502.015887][T22475] netlink: 8 bytes leftover after parsing attributes in process `syz.0.14728'. [ 1502.015904][T22475] sch_tbf: peakrate 896 is lower than or equals to rate 3850 ! [ 1502.084895][T22476] netlink: 8 bytes leftover after parsing attributes in process `syz.0.14728'. [ 1502.084918][T22476] sch_tbf: peakrate 896 is lower than or equals to rate 3850 ! [ 1502.130903][ T5280] 8021q: adding VLAN 0 to HW filter on device eth3 [ 1502.179639][T22484] netlink: 12 bytes leftover after parsing attributes in process `syz.7.14730'. [ 1502.505940][T22489] netlink: 8 bytes leftover after parsing attributes in process `syz.6.14732'. [ 1502.539399][T22007] netdevsim netdevsim1 eth4 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1502.864210][T22501] netlink: 76 bytes leftover after parsing attributes in process `syz.0.14736'. [ 1502.952242][T22504] netlink: 4 bytes leftover after parsing attributes in process `syz.7.14737'. [ 1502.963626][T22504] netlink: 4 bytes leftover after parsing attributes in process `syz.7.14737'. [ 1503.010513][T22504] IPVS: set_ctl: invalid protocol: 43 172.20.20.187:20001 [ 1503.015900][T22504] netlink: 4 bytes leftover after parsing attributes in process `syz.7.14737'. [ 1503.086612][T22007] netdevsim netdevsim1 eth3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1503.278523][T22504] hsr_slave_1 (unregistering): left promiscuous mode [ 1503.419938][T22007] netdevsim netdevsim1 eth2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1503.767055][T22534] netlink: 44 bytes leftover after parsing attributes in process `syz.5.14745'. [ 1503.852637][T22007] netdevsim netdevsim1 eth1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1504.207746][T12451] hsr_slave_0: left promiscuous mode [ 1504.213354][T12451] hsr_slave_1: left promiscuous mode [ 1504.217220][T12451] batman_adv: batadv0: Removing interface: dummy0 [ 1504.432300][T22563] netlink: 'syz.5.14751': attribute type 1 has an invalid length. [ 1505.029814][T22567] sit0: left promiscuous mode [ 1505.132236][T22584] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 1505.381026][T22567] 8021q: adding VLAN 0 to HW filter on device bond1 [ 1505.382083][T22567] gretap1: left allmulticast mode [ 1505.412864][T22567] 8021q: adding VLAN 0 to HW filter on device eth0 [ 1505.415359][T22567] 8021q: adding VLAN 0 to HW filter on device eth1 [ 1505.421663][T22567] 8021q: adding VLAN 0 to HW filter on device eth2 [ 1505.424101][T22567] 8021q: adding VLAN 0 to HW filter on device eth3 [ 1505.823862][T22603] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 1506.119332][T12451] IPVS: stop unused estimator thread 0... [ 1506.235257][ T1341] ip6_tunnel: ip6tnl1 xmit: Local address not yet configured! [ 1506.235479][ T1341] ip6_tunnel: ip6tnl1 xmit: Local address not yet configured! [ 1506.239614][T22007] netdevsim netdevsim1 netdevsim0: renamed from eth0 [ 1506.259817][T22007] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 1506.260667][T22007] netdevsim netdevsim1 netdevsim1: renamed from eth1 [ 1506.268890][ T7517] ip6_tunnel: ip6tnl1 xmit: Local address not yet configured! [ 1506.319275][T22007] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 1506.320133][T22007] netdevsim netdevsim1 netdevsim2: renamed from eth2 [ 1506.359415][T22007] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 1506.363482][T22007] netdevsim netdevsim1 netdevsim3: renamed from eth3 [ 1506.384197][T22007] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 1506.565626][T22007] 8021q: adding VLAN 0 to HW filter on device bond0 [ 1506.600107][T22007] 8021q: adding VLAN 0 to HW filter on device team0 [ 1506.613012][ T1341] bridge0: port 1(bridge_slave_0) entered blocking state [ 1506.613100][ T1341] bridge0: port 1(bridge_slave_0) entered forwarding state [ 1506.664027][T28528] bridge0: port 2(bridge_slave_1) entered blocking state [ 1506.664135][T28528] bridge0: port 2(bridge_slave_1) entered forwarding state [ 1506.777504][ T7517] ip6_tunnel: ip6tnl1 xmit: Local address not yet configured! [ 1506.818262][ T7517] ip6_tunnel: ip6tnl1 xmit: Local address not yet configured! [ 1506.936069][T22641] syzkaller0: entered promiscuous mode [ 1506.936091][T22641] syzkaller0: entered allmulticast mode [ 1507.012279][T22651] FAULT_INJECTION: forcing a failure. [ 1507.012279][T22651] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1507.012311][T22651] CPU: 1 UID: 0 PID: 22651 Comm: syz.0.14766 Not tainted syzkaller #0 PREEMPT(full) [ 1507.012332][T22651] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 1507.012343][T22651] Call Trace: [ 1507.012352][T22651] [ 1507.012361][T22651] dump_stack_lvl+0xe8/0x150 [ 1507.012392][T22651] should_fail_ex+0x410/0x560 [ 1507.012420][T22651] _copy_from_user+0x2d/0xb0 [ 1507.012446][T22651] ___sys_recvmsg+0x173/0x5a0 [ 1507.012479][T22651] ? __pfx____sys_recvmsg+0x10/0x10 [ 1507.012518][T22651] ? lock_acquire+0x115/0x350 [ 1507.012567][T22651] do_recvmmsg+0x31a/0x7f0 [ 1507.012602][T22651] ? __pfx_do_recvmmsg+0x10/0x10 [ 1507.012639][T22651] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 1507.012665][T22651] ? __fget_files+0x3a2/0x420 [ 1507.012702][T22651] __x64_sys_recvmmsg+0x198/0x250 [ 1507.012731][T22651] ? __pfx___x64_sys_recvmmsg+0x10/0x10 [ 1507.012769][T22651] do_syscall_64+0x166/0x520 [ 1507.012792][T22651] ? trace_irq_disable+0x3b/0x140 [ 1507.012810][T22651] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1507.012830][T22651] ? clear_bhb_loop+0x70/0xc0 [ 1507.012853][T22651] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1507.012872][T22651] RIP: 0033:0x7fecad19e159 [ 1507.012890][T22651] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1507.012905][T22651] RSP: 002b:00007fecae149028 EFLAGS: 00000246 ORIG_RAX: 000000000000012b [ 1507.012925][T22651] RAX: ffffffffffffffda RBX: 00007fecad425fa0 RCX: 00007fecad19e159 [ 1507.012940][T22651] RDX: 00101f2043b8267e RSI: 0000200000000fc0 RDI: 0000000000000005 [ 1507.012953][T22651] RBP: 00007fecae149090 R08: 0000000000000000 R09: 0000000000000000 [ 1507.012965][T22651] R10: 0000000000010120 R11: 0000000000000246 R12: 0000000000000003 [ 1507.012976][T22651] R13: 00007fecad426038 R14: 00007fecad425fa0 R15: 00007fff9e5dec78 [ 1507.013007][T22651] [ 1507.518936][T22660] netlink: 'syz.0.14770': attribute type 4 has an invalid length. [ 1508.481139][T22007] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 1508.734807][T22007] veth0_vlan: entered promiscuous mode [ 1508.777747][T22007] veth1_vlan: entered promiscuous mode [ 1509.130449][T22007] veth0_macvtap: entered promiscuous mode [ 1509.444769][T22007] veth1_macvtap: entered promiscuous mode [ 1509.960790][T22007] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 1510.292118][T22769] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 1510.453198][T22007] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 1510.600828][ C1] ip6_tunnel: ip6tnl1 xmit: Local address not yet configured! [ 1510.679850][T10536] Bluetooth: hci7: SCO packet too small [ 1510.710193][ T1369] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 1510.711344][ T1369] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 1510.712115][ T1369] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 1510.712400][ T1369] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 1510.897150][T22787] sctp: [Deprecated]: syz.0.14792 (pid 22787) Use of int in maxseg socket option. [ 1510.897150][T22787] Use struct sctp_assoc_value instead [ 1510.988617][ T1369] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1510.988637][ T1369] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1511.470413][T22815] __nla_validate_parse: 3 callbacks suppressed [ 1511.470433][T22815] netlink: 20 bytes leftover after parsing attributes in process `syz.7.14797'. [ 1511.709383][T22828] netlink: 9 bytes leftover after parsing attributes in process `syz.7.14798'. [ 1511.711838][T22828] gretap0: entered promiscuous mode [ 1511.729095][T22828] smbdirect: ib_dev[syz1]: added: RNIC max_fast_reg_page_list_len=256 device_cap_flags=0x200000 kernel_cap_flags=0x10 page_size_cap=0x1000 [ 1511.729129][T22828] smbdirect: ib_dev[syz1]: num_ports=1 max_qp_rd_atom=128 max_qp_init_rd_atom=128 max_sgl_rd=0 max_sge_rd=1 max_cqe=3276800 max_qp_wr=32768 max_send_sge=6 max_recv_sge=6 [ 1511.729164][T22828] smbdirect: ib_dev[syz1]PORT[1]: iwarp=1 ib=0 roce=0 v1=0 v2=0 core_cap_flags=0x400008 [ 1511.749006][T22828] infiniband syz1: RDMA CMA: cma_listen_on_dev, error -98 [ 1511.851152][T22828] netlink: 5 bytes leftover after parsing attributes in process `syz.7.14798'. [ 1511.851225][T22828] 0ªî{X¹¦: renamed from gretap0 [ 1511.852547][T22828] 0ªî{X¹¦: left promiscuous mode [ 1511.852558][T22828] 0ªî{X¹¦: entered allmulticast mode [ 1511.857355][T22828] A link change request failed with some changes committed already. Interface 30ªî{X¹¦ may have been left with an inconsistent configuration, please check. [ 1513.856784][T22784] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 1513.978113][ T1369] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1513.978134][ T1369] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1514.068268][T22833] netlink: 8 bytes leftover after parsing attributes in process `syz.6.14799'. [ 1514.078982][T22833] vlan1: entered allmulticast mode [ 1514.079320][T22833] bridge0: port 3(vlan1) entered blocking state [ 1514.117874][T22833] bridge0: port 3(vlan1) entered disabled state [ 1514.398370][T22849] netlink: 12 bytes leftover after parsing attributes in process `syz.6.14807'. [ 1514.432594][T22859] netlink: 76 bytes leftover after parsing attributes in process `syz.5.14809'. [ 1514.533278][T22866] syzkaller1: tun_chr_ioctl cmd 1074025677 [ 1514.533401][T22866] syzkaller1: linktype set to 823 [ 1514.694852][T22871] netlink: 8 bytes leftover after parsing attributes in process `syz.0.14812'. [ 1514.694887][T22871] netlink: 'syz.0.14812': attribute type 10 has an invalid length. [ 1514.694903][T22871] netlink: 'syz.0.14812': attribute type 5 has an invalid length. [ 1514.694915][T22871] netlink: 4 bytes leftover after parsing attributes in process `syz.0.14812'. [ 1514.748439][T22871] geneve3: entered promiscuous mode [ 1514.748460][T22871] geneve3: entered allmulticast mode [ 1514.766722][ T1369] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 57567 - 0 [ 1514.776397][T25978] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 57567 - 0 [ 1514.778815][ T1369] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 57567 - 0 [ 1514.778851][ T1369] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 57567 - 0 [ 1514.844720][T22873] netlink: 8 bytes leftover after parsing attributes in process `syz.5.14813'. [ 1514.953852][T22875] netlink: 8 bytes leftover after parsing attributes in process `syz.0.14814'. [ 1514.980085][T22875] vlan3: entered allmulticast mode [ 1514.989289][T22875] bridge0: port 1(vlan3) entered blocking state [ 1514.989403][T22875] bridge0: port 1(vlan3) entered disabled state [ 1515.398565][T22887] bond6: Unable to set peer notification delay as MII monitoring is disabled [ 1515.402000][T22887] bond6 (unregistering): Released all slaves [ 1515.500029][T22892] netlink: 'syz.6.14821': attribute type 10 has an invalid length. [ 1515.532362][T22892] 8021q: adding VLAN 0 to HW filter on device team0 [ 1515.542108][T22892] bond0: (slave team0): Enslaving as an active interface with an up link [ 1516.157484][T22914] netlink: 'syz.7.14826': attribute type 4 has an invalid length. [ 1516.180702][T22914] netlink: 'syz.7.14826': attribute type 4 has an invalid length. [ 1516.442055][T22920] netlink: 'syz.5.14829': attribute type 3 has an invalid length. [ 1516.537104][T22924] __nla_validate_parse: 2 callbacks suppressed [ 1516.537123][T22924] netlink: 8 bytes leftover after parsing attributes in process `syz.0.14831'. [ 1516.566548][T22924] vlan3: entered allmulticast mode [ 1516.566879][T22924] bridge0: port 1(vlan3) entered blocking state [ 1516.567050][T22924] bridge0: port 1(vlan3) entered disabled state [ 1516.780507][T22932] netlink: 8 bytes leftover after parsing attributes in process `syz.7.14833'. [ 1516.912698][T22937] netlink: 8 bytes leftover after parsing attributes in process `syz.1.14836'. [ 1516.912752][T22937] openvswitch: netlink: Missing key (keys=c0, expected=40300) [ 1517.936932][T22964] netlink: 'syz.7.14844': attribute type 1 has an invalid length. [ 1518.025319][T22971] netlink: 12 bytes leftover after parsing attributes in process `syz.7.14844'. [ 1518.060420][T22964] gretap0: entered allmulticast mode [ 1518.100577][T22979] netlink: 'syz.7.14844': attribute type 1 has an invalid length. [ 1518.137140][T22971] netlink: 12 bytes leftover after parsing attributes in process `syz.7.14844'. [ 1518.145099][T22976] netlink: 152 bytes leftover after parsing attributes in process `syz.6.14848'. [ 1518.157929][T22976] sctp: [Deprecated]: syz.6.14848 (pid 22976) Use of int in maxseg socket option. [ 1518.157929][T22976] Use struct sctp_assoc_value instead [ 1518.286301][T22986] syzkaller1: entered promiscuous mode [ 1518.286323][T22986] syzkaller1: entered allmulticast mode [ 1518.443841][T22994] netlink: 8 bytes leftover after parsing attributes in process `syz.7.14853'. [ 1518.443863][T22994] netlink: 4 bytes leftover after parsing attributes in process `syz.7.14853'. [ 1518.443887][T22994] netlink: 'syz.7.14853': attribute type 6 has an invalid length. [ 1518.505779][T22994] netlink: 8 bytes leftover after parsing attributes in process `syz.7.14853'. [ 1518.505800][T22994] netlink: 4 bytes leftover after parsing attributes in process `syz.7.14853'. [ 1518.505823][T22994] netlink: 'syz.7.14853': attribute type 6 has an invalid length. [ 1518.534493][T12451] netdevsim netdevsim7 netdevsim0: set [0, 0] type 1 family 0 port 8472 - 0 [ 1518.534543][T12451] netdevsim netdevsim7 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0 [ 1518.534575][T12451] netdevsim netdevsim7 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0 [ 1518.534604][T12451] netdevsim netdevsim7 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0 [ 1518.679367][T23003] xt_cgroup: path and classid specified [ 1518.987467][ C1] ip6_tunnel: ip6tnl1 xmit: Local address not yet configured! [ 1519.732052][T23043] sctp: [Deprecated]: syz.6.14870 (pid 23043) Use of int in maxseg socket option. [ 1519.732052][T23043] Use struct sctp_assoc_value instead [ 1520.876171][T23076] ip_tunnel: non-ECT from 172.20.20.187 with TOS=0x2 [ 1521.172964][T23095] nbd: must specify at least one socket [ 1521.194217][T23089] netlink: 'syz.1.14886': attribute type 1 has an invalid length. [ 1521.339234][T23095] bond9: option primary: mode dependency failed, not supported in mode balance-rr(0) [ 1521.359128][T23095] bond9 (unregistering): Released all slaves [ 1521.598416][T23109] xt_check_table_hooks: 23 callbacks suppressed [ 1521.598436][T23109] x_tables: duplicate underflow at hook 1 [ 1521.866269][T23125] __nla_validate_parse: 3 callbacks suppressed [ 1521.866289][T23125] netlink: 4 bytes leftover after parsing attributes in process `syz.6.14894'. [ 1522.870399][T23157] netlink: 44 bytes leftover after parsing attributes in process `syz.0.14905'. [ 1523.202102][T23162] vlan2: entered promiscuous mode [ 1523.202123][T23162] bridge0: entered promiscuous mode [ 1523.777556][T23189] netlink: 8 bytes leftover after parsing attributes in process `syz.5.14916'. [ 1523.777598][T23189] netlink: 44 bytes leftover after parsing attributes in process `syz.5.14916'. [ 1523.783620][T23189] netlink: 8 bytes leftover after parsing attributes in process `syz.5.14916'. [ 1523.783656][T23189] netlink: 44 bytes leftover after parsing attributes in process `syz.5.14916'. [ 1523.879901][T28529] IPVS: starting estimator thread 0... [ 1523.880527][T23191] IPVS: nq: TCP 127.0.0.1:21 - no destination available [ 1524.001358][T23193] IPVS: using max 31 ests per chain, 74400 per kthread [ 1524.403540][T23213] syzkaller0: entered promiscuous mode [ 1524.403564][T23213] syzkaller0: entered allmulticast mode [ 1524.909887][ C1] IPVS: nq: TCP 127.0.0.1:21 - no destination available [ 1528.774785][T23285] netlink: 'syz.0.14943': attribute type 11 has an invalid length. [ 1528.888950][T23290] Cannot find del_set index 0 as target [ 1529.238403][T23301] netlink: 12 bytes leftover after parsing attributes in process `syz.6.14947'. [ 1529.238430][T23301] block nbd0: Unsupported socket: should be TCP or UNIX. [ 1529.423154][T23302] syzkaller0: entered promiscuous mode [ 1529.423176][T23302] syzkaller0: entered allmulticast mode [ 1529.571120][T23307] netlink: 'syz.6.14951': attribute type 12 has an invalid length. [ 1529.594051][T23307] netlink: 4 bytes leftover after parsing attributes in process `syz.6.14951'. [ 1529.760991][T23309] netlink: 'syz.5.14952': attribute type 12 has an invalid length. [ 1529.781592][T23309] netlink: 4 bytes leftover after parsing attributes in process `syz.5.14952'. [ 1529.959512][T23316] netlink: 'syz.5.14955': attribute type 10 has an invalid length. [ 1529.961397][T23317] netlink: 'syz.5.14955': attribute type 10 has an invalid length. [ 1530.029684][T23316] ªªªªªª: renamed from vlan0 (while UP) [ 1530.061684][T23316] netlink: 'syz.5.14955': attribute type 10 has an invalid length. [ 1530.214304][T23326] netlink: 8 bytes leftover after parsing attributes in process `syz.5.14958'. [ 1530.214638][T23321] netlink: 24 bytes leftover after parsing attributes in process `syz.6.14956'. [ 1530.414563][T23328] netlink: 12 bytes leftover after parsing attributes in process `syz.6.14959'. [ 1530.830222][T23340] netlink: 44 bytes leftover after parsing attributes in process `syz.7.14961'. [ 1530.921586][T23342] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 1531.008400][T23319] infiniband syz2: set active [ 1531.008478][T23319] infiniband syz2: added team_slave_0 [ 1531.028832][T23319] workqueue: Failed to create a rescuer kthread for wq "ib_mad1": -EINTR [ 1531.036203][T23319] infiniband syz2: Couldn't open port 1 [ 1531.036458][T23319] smbdirect: ib_dev[syz2]: added: IB_CA max_fast_reg_page_list_len=512 device_cap_flags=0x1c001223c76 kernel_cap_flags=0x14 page_size_cap=0xfffff000 [ 1531.036487][T23319] smbdirect: ib_dev[syz2]: num_ports=1 max_qp_rd_atom=128 max_qp_init_rd_atom=128 max_sgl_rd=0 max_sge_rd=32 max_cqe=32767 max_qp_wr=1048576 max_send_sge=32 max_recv_sge=32 [ 1531.036524][T23319] smbdirect: ib_dev[syz2]PORT[1]: iwarp=0 ib=0 roce=1 v1=0 v2=1 core_cap_flags=0x803005 [ 1531.169013][T23319] RDS/IB: syz2: added [ 1531.169737][T23319] smc: adding ib device syz2 with port count 1 [ 1531.169883][T23319] smc: ib device syz2 port 1 has no pnetid [ 1531.325323][T23352] netlink: 'syz.5.14966': attribute type 12 has an invalid length. [ 1531.331144][T23352] netlink: 4 bytes leftover after parsing attributes in process `syz.5.14966'. [ 1531.561962][T23354] netlink: 128 bytes leftover after parsing attributes in process `syz.7.14967'. [ 1531.610527][T23356] netlink: 8 bytes leftover after parsing attributes in process `syz.5.14968'. [ 1532.708152][T23390] netlink: 'syz.7.14978': attribute type 12 has an invalid length. [ 1532.742093][T23387] netlink: 'syz.5.14976': attribute type 10 has an invalid length. [ 1532.765533][T23387] team0: Device dummy0 is of different type [ 1534.977493][T23445] netlink: 'syz.5.14991': attribute type 12 has an invalid length. [ 1535.002859][T23445] __nla_validate_parse: 21 callbacks suppressed [ 1535.002878][T23445] netlink: 4 bytes leftover after parsing attributes in process `syz.5.14991'. [ 1535.426466][T23453] netlink: 20 bytes leftover after parsing attributes in process `syz.5.14992'. [ 1536.032866][T23463] netlink: 12 bytes leftover after parsing attributes in process `syz.0.14993'. [ 1536.273722][ C1] ip6_tunnel: ip6tnl1 xmit: Local address not yet configured! [ 1536.382492][T23472] netlink: 20 bytes leftover after parsing attributes in process `syz.6.14997'. [ 1536.978356][T23487] netlink: 100 bytes leftover after parsing attributes in process `syz.5.15000'. [ 1537.002086][T23493] netlink: 'syz.7.15002': attribute type 12 has an invalid length. [ 1537.026456][T23493] netlink: 4 bytes leftover after parsing attributes in process `syz.7.15002'. [ 1537.193086][T23499] netlink: 'syz.0.15004': attribute type 4 has an invalid length. [ 1537.474173][T23503] team0: Device xfrm0 is of different type [ 1537.676669][T23512] netlink: 8 bytes leftover after parsing attributes in process `syz.0.15009'. [ 1537.719433][T23512] bridge6: entered promiscuous mode [ 1537.719509][T23512] bridge6: entered allmulticast mode [ 1537.729877][T23514] netlink: 8 bytes leftover after parsing attributes in process `syz.0.15009'. [ 1537.802598][T23514] bridge7: entered promiscuous mode [ 1537.805879][T23514] bridge7: entered allmulticast mode [ 1537.964383][T23519] netlink: 12 bytes leftover after parsing attributes in process `syz.7.15013'. [ 1538.022369][T23523] netlink: 128 bytes leftover after parsing attributes in process `syz.6.15015'. [ 1538.076188][T23525] netlink: 'syz.0.15016': attribute type 12 has an invalid length. [ 1538.259903][T23519] virtio_blk virtio4: 1/0/0 default/read/poll queues [ 1538.281137][T23519] virtio_blk virtio4: [vda] 262144 512-byte logical blocks (134 MB/128 MiB) [ 1538.754917][T23536] bond1: Removing last arp target with arp_interval on [ 1539.340109][T23567] netlink: 'syz.5.15027': attribute type 1 has an invalid length. [ 1539.589727][T23571] IPVS: set_ctl: invalid protocol: 4 0.0.0.0:20004 [ 1539.617689][T23574] team0: Device xfrm0 is of different type [ 1539.887356][T23582] netlink: 'syz.0.15032': attribute type 12 has an invalid length. [ 1540.101451][T23583] smc: net device lo applied user defined pnetid SYZ0 [ 1540.163036][T23594] geneve2: entered allmulticast mode [ 1540.380578][T23605] __nla_validate_parse: 7 callbacks suppressed [ 1540.380597][T23605] netlink: 84 bytes leftover after parsing attributes in process `syz.5.15037'. [ 1540.382846][T23605] netlink: 84 bytes leftover after parsing attributes in process `syz.5.15037'. [ 1540.914982][T23629] team0: Device xfrm0 is of different type [ 1541.079625][T23630] netlink: 'syz.5.15041': attribute type 4 has an invalid length. [ 1541.079646][T23630] netlink: 152 bytes leftover after parsing attributes in process `syz.5.15041'. [ 1541.236554][T23639] netlink: 4 bytes leftover after parsing attributes in process `syz.1.15046'. [ 1541.281257][T23636] netlink: 'syz.1.15046': attribute type 12 has an invalid length. [ 1541.416466][T23638] netlink: 8 bytes leftover after parsing attributes in process `syz.6.15047'. [ 1541.416490][T23638] netlink: 24 bytes leftover after parsing attributes in process `syz.6.15047'. [ 1541.449251][T28529] netdevsim netdevsim0 netdevsim3: unset [1, 0] type 2 family 0 port 57567 - 0 [ 1541.450193][T28529] netdevsim netdevsim0 netdevsim2: unset [1, 0] type 2 family 0 port 57567 - 0 [ 1541.450230][T28529] netdevsim netdevsim0 netdevsim1: unset [1, 0] type 2 family 0 port 57567 - 0 [ 1541.450263][T28529] netdevsim netdevsim0 netdevsim0: unset [1, 0] type 2 family 0 port 57567 - 0 [ 1542.296441][T23677] netlink: 8 bytes leftover after parsing attributes in process `syz.0.15058'. [ 1542.298603][T23676] veth1_to_bond: entered allmulticast mode [ 1542.307223][T23679] veth1_to_bond: entered promiscuous mode [ 1542.361324][T23684] netlink: 'syz.1.15057': attribute type 2 has an invalid length. [ 1542.361344][T23684] netlink: 'syz.1.15057': attribute type 5 has an invalid length. [ 1542.373256][T23675] netlink: NAT attribute has 8 unknown bytes [ 1542.377998][T23675] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 1542.420835][T23674] veth1_to_bond: left promiscuous mode [ 1542.421006][T23674] veth1_to_bond: left allmulticast mode [ 1542.429362][T23685] syzkaller1: tun_chr_ioctl cmd 1074025677 [ 1542.429452][T23685] syzkaller1: linktype set to 776 [ 1542.459856][T23685] netlink: 'syz.7.15059': attribute type 3 has an invalid length. [ 1542.461906][T23685] netlink: 'syz.7.15059': attribute type 49 has an invalid length. [ 1542.666609][T23685] ip6gretap0: entered promiscuous mode [ 1542.666630][T23685] ip6gretap0: entered allmulticast mode [ 1542.695877][T23693] netlink: 4 bytes leftover after parsing attributes in process `syz.1.15061'. [ 1542.710185][T23692] netlink: 'syz.1.15061': attribute type 12 has an invalid length. [ 1543.390693][T23720] netlink: 12 bytes leftover after parsing attributes in process `syz.7.15071'. [ 1543.477928][T23720] bond6: Unable to set peer notification delay as MII monitoring is disabled [ 1543.501955][T23720] bond6 (unregistering): Released all slaves [ 1543.623836][T23726] syzkaller1: tun_chr_ioctl cmd 2147767506 [ 1543.665999][T23726] ip6tnl1: entered allmulticast mode [ 1544.004525][T11980] syzkaller1: tun_net_xmit 90 [ 1544.021946][T23747] netlink: 'syz.6.15078': attribute type 12 has an invalid length. [ 1544.031152][T23747] netlink: 4 bytes leftover after parsing attributes in process `syz.6.15078'. [ 1544.724019][T12452] ip6_tunnel: ip6tnl1 xmit: Local address not yet configured! [ 1544.724253][T12452] ip6_tunnel: ip6tnl1 xmit: Local address not yet configured! [ 1544.751326][ T7517] ip6_tunnel: ip6tnl1 xmit: Local address not yet configured! [ 1545.064053][T23785] netlink: 'syz.7.15090': attribute type 5 has an invalid length. [ 1545.185749][T15065] ip6_tunnel: ip6tnl1 xmit: Local address not yet configured! [ 1545.307684][T23791] netlink: 'syz.5.15093': attribute type 12 has an invalid length. [ 1545.438804][T23800] __nla_validate_parse: 3 callbacks suppressed [ 1545.446937][T23800] netlink: 8 bytes leftover after parsing attributes in process `syz.1.15097'. [ 1545.569570][T23802] vlan3: entered promiscuous mode [ 1545.706889][T15065] ip6_tunnel: ip6tnl1 xmit: Local address not yet configured! [ 1545.708244][T23807] xt_connbytes: Forcing CT accounting to be enabled [ 1545.708261][T23807] ip6t_REJECT: TCP_RESET illegal for non-tcp [ 1545.776754][T23807] syzkaller0: entered promiscuous mode [ 1545.776776][T23807] syzkaller0: entered allmulticast mode [ 1545.973146][T23813] dvmrp0: entered allmulticast mode [ 1546.003188][T23816] dvmrp0: left allmulticast mode [ 1546.417809][T23832] netlink: 'syz.6.15109': attribute type 4 has an invalid length. [ 1546.794110][T23850] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 1547.389088][T23876] nbd: socks must be embedded in a SOCK_ITEM attr [ 1547.610752][T23895] netlink: 28 bytes leftover after parsing attributes in process `syz.0.15129'. [ 1547.649060][T23899] netlink: 'syz.1.15130': attribute type 10 has an invalid length. [ 1547.668686][T23899] syz_tun: entered promiscuous mode [ 1547.689581][T23844] udevd[23844]: inotify_add_watch(7, /dev/nbd0, 10) failed: No such file or directory [ 1547.715653][T23899] bond0: (slave syz_tun): Enslaving as an active interface with an up link [ 1548.357503][T23931] netlink: 76 bytes leftover after parsing attributes in process `syz.1.15141'. [ 1548.584375][ C1] ip6_tunnel: ip6tnl1 xmit: Local address not yet configured! [ 1548.753493][T23942] smbdirect: ib_dev[s`z1]: added: RNIC max_fast_reg_page_list_len=256 device_cap_flags=0x200000 kernel_cap_flags=0x10 page_size_cap=0x1000 [ 1548.753527][T23942] smbdirect: ib_dev[s`z1]: num_ports=1 max_qp_rd_atom=128 max_qp_init_rd_atom=128 max_sgl_rd=0 max_sge_rd=1 max_cqe=3276800 max_qp_wr=32768 max_send_sge=6 max_recv_sge=6 [ 1548.753560][T23942] smbdirect: ib_dev[s`z1]PORT[1]: iwarp=1 ib=0 roce=0 v1=0 v2=0 core_cap_flags=0x400008 [ 1548.808483][T23942] infiniband s`z1: RDMA CMA: cma_listen_on_dev, error -98 [ 1549.359255][T23961] netlink: 12 bytes leftover after parsing attributes in process `syz.0.15150'. [ 1549.656706][T23977] netlink: 44 bytes leftover after parsing attributes in process `syz.7.15155'. [ 1549.862257][T23985] netlink: 8 bytes leftover after parsing attributes in process `syz.1.15159'. [ 1549.885476][T23985] netlink: 24 bytes leftover after parsing attributes in process `syz.1.15159'. [ 1550.574527][T24025] mac80211_hwsim hwsim219 wlan0: entered promiscuous mode [ 1550.614866][T24025] batman_adv: batadv0: Adding interface: macvlan2 [ 1550.614884][T24025] batman_adv: batadv0: The MTU of interface macvlan2 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 1550.614913][T24025] batman_adv: batadv0: Interface activated: macvlan2 [ 1550.821648][T10536] Bluetooth: hci8: link tx timeout [ 1550.821808][T10536] Bluetooth: hci8: killing stalled connection 11:aa:aa:aa:aa:aa [ 1551.000172][T24049] netlink: 4 bytes leftover after parsing attributes in process `syz.7.15172'. [ 1551.000257][T24049] bridge_slave_1: left promiscuous mode [ 1551.000488][T24049] bridge0: port 2(bridge_slave_1) entered disabled state [ 1551.195856][T24049] bridge_slave_0: left allmulticast mode [ 1551.195884][T24049] bridge_slave_0: left promiscuous mode [ 1551.196114][T24049] bridge0: port 1(bridge_slave_0) entered disabled state [ 1551.316935][T10536] Bluetooth: hci8: link tx timeout [ 1551.316954][T10536] Bluetooth: hci8: killing stalled connection 11:aa:aa:aa:aa:aa [ 1551.317980][T24053] netlink: 8 bytes leftover after parsing attributes in process `syz.7.15172'. [ 1551.366100][T10536] Bluetooth: hci8: link tx timeout [ 1551.366118][T10536] Bluetooth: hci8: killing stalled connection 11:aa:aa:aa:aa:aa [ 1551.602118][T10536] Bluetooth: hci8: link tx timeout [ 1551.602140][T10536] Bluetooth: hci8: killing stalled connection 11:aa:aa:aa:aa:aa [ 1552.197391][T10536] Bluetooth: hci8: link tx timeout [ 1552.197411][T10536] Bluetooth: hci8: killing stalled connection 11:aa:aa:aa:aa:aa [ 1552.371341][T24096] x_tables: duplicate underflow at hook 3 [ 1552.401079][T24096] x_tables: unsorted entry at hook 4 [ 1552.535337][T24098] syzkaller0: entered promiscuous mode [ 1552.535358][T24098] syzkaller0: entered allmulticast mode [ 1552.621334][T24103] netlink: 20 bytes leftover after parsing attributes in process `syz.0.15184'. [ 1552.622572][T24103] netlink: 4 bytes leftover after parsing attributes in process `syz.0.15184'. [ 1552.673032][T24110] netlink: 20 bytes leftover after parsing attributes in process `syz.6.15183'. [ 1552.914420][T10536] Bluetooth: hci8: command 0x0406 tx timeout [ 1553.452579][T24141] netlink: 8 bytes leftover after parsing attributes in process `syz.7.15190'. [ 1553.531864][T24150] netlink: 20 bytes leftover after parsing attributes in process `syz.6.15191'. [ 1553.532331][T24150] netlink: 20 bytes leftover after parsing attributes in process `syz.6.15191'. [ 1553.565911][T24150] netlink: 20 bytes leftover after parsing attributes in process `syz.6.15191'. [ 1553.566093][T24150] netlink: 20 bytes leftover after parsing attributes in process `syz.6.15191'. [ 1553.669032][T24149] tipc: Started in network mode [ 1553.669061][T24149] tipc: Node identity 6e9ac7d55fd5, cluster identity 4711 [ 1553.670449][T24149] tipc: Enabled bearer , priority 0 [ 1553.692272][T24150] tipc: Resetting bearer [ 1553.801964][T24158] netlink: 'syz.5.15193': attribute type 12 has an invalid length. [ 1553.993804][T24148] tipc: Disabling bearer [ 1555.074487][T24194] team0: Port device xfrm0 removed [ 1555.075443][T24194] A link change request failed with some changes committed already. Interface hsr_slave_0 may have been left with an inconsistent configuration, please check. [ 1555.077011][T24204] syzkaller1: entered promiscuous mode [ 1555.077029][T24204] syzkaller1: entered allmulticast mode [ 1555.748211][T24227] –: renamed from virt_wifi0 [ 1555.820368][T24228] netlink: 'syz.1.15205': attribute type 12 has an invalid length. [ 1556.201508][T24175] Bluetooth: hci6: Opcode 0x0c1a failed: -4 [ 1556.201528][T24175] Bluetooth: hci6: Error when powering off device on rfkill (-4) [ 1556.423020][T24175] Bluetooth: hci7: Opcode 0x0c1a failed: -4 [ 1556.423042][T24175] Bluetooth: hci7: Error when powering off device on rfkill (-4) [ 1556.723607][T24175] Bluetooth: hci8: Opcode 0x0c1a failed: -4 [ 1556.723629][T24175] Bluetooth: hci8: Error when powering off device on rfkill (-4) [ 1556.745676][ C1] ip6_tunnel: ip6tnl1 xmit: Local address not yet configured! [ 1556.922004][T24271] __nla_validate_parse: 64 callbacks suppressed [ 1556.922025][T24271] netlink: 4 bytes leftover after parsing attributes in process `syz.6.15207'. [ 1556.974233][T24275] netlink: 8 bytes leftover after parsing attributes in process `syz.1.15214'. [ 1557.001893][T24271] bond0: (slave bond_slave_1): Releasing backup interface [ 1557.109608][T24247] workqueue: Failed to create a rescuer kthread for wq "nfc3_nci_cmd_wq": -EINTR [ 1557.119417][T24234] workqueue: Failed to create a rescuer kthread for wq "nfc3_nci_cmd_wq": -EINTR [ 1557.691983][T24299] syzkaller0: entered promiscuous mode [ 1557.692006][T24299] syzkaller0: entered allmulticast mode [ 1557.711005][T24299] tipc: Started in network mode [ 1557.711032][T24299] tipc: Node identity c616ace1d20b, cluster identity 4711 [ 1557.711166][T24299] tipc: Enabled bearer , priority 0 [ 1557.897458][T24314] netlink: 'syz.0.15220': attribute type 12 has an invalid length. [ 1557.912095][T24314] netlink: 4 bytes leftover after parsing attributes in process `syz.0.15220'. [ 1558.132492][T24319] xt_policy: input policy not valid in POSTROUTING and OUTPUT [ 1558.344537][T24298] tipc: Resetting bearer [ 1558.489137][T24340] netlink: 12 bytes leftover after parsing attributes in process `syz.0.15228'. [ 1559.030987][T24298] tipc: Disabling bearer [ 1559.299531][T24340] 8021q: adding VLAN 0 to HW filter on device bond9 [ 1559.310396][T24359] netlink: 8 bytes leftover after parsing attributes in process `syz.5.15230'. [ 1559.383820][ T1222] tipc: Node number set to 337489121 [ 1559.708284][T24374] syzkaller0: entered promiscuous mode [ 1559.708309][T24374] syzkaller0: entered allmulticast mode [ 1559.931044][T24401] netlink: 4 bytes leftover after parsing attributes in process `syz.0.15234'. [ 1560.169674][T24411] netlink: 4 bytes leftover after parsing attributes in process `syz.7.15236'. [ 1563.242591][T24398] netlink: 'syz.0.15234': attribute type 12 has an invalid length. [ 1563.343004][T24420] syzkaller0: entered promiscuous mode [ 1563.343027][T24420] syzkaller0: entered allmulticast mode [ 1563.472195][T24437] netlink: 44 bytes leftover after parsing attributes in process `syz.6.15240'. [ 1563.596860][T24446] netlink: 20 bytes leftover after parsing attributes in process `syz.5.15244'. [ 1563.596885][T24446] netlink: 20 bytes leftover after parsing attributes in process `syz.5.15244'. [ 1563.692398][T24450] team0: Port device xfrm0 added [ 1563.941672][T24466] netlink: 'syz.7.15251': attribute type 12 has an invalid length. [ 1563.971652][T24466] netlink: 4 bytes leftover after parsing attributes in process `syz.7.15251'. [ 1564.243608][T24483] IPVS: Unknown mcast interface: nicvf0 [ 1564.290795][T24485] x_tables: ip6_tables: cgroup match: used from hooks PREROUTING, but only valid from INPUT/OUTPUT/POSTROUTING [ 1565.199148][T24507] netlink: 8 bytes leftover after parsing attributes in process `syz.5.15259'. [ 1565.301341][T24507] vlan0: entered allmulticast mode [ 1565.301671][T24507] bridge0: port 2(vlan0) entered blocking state [ 1565.317993][T24507] bridge0: port 2(vlan0) entered disabled state [ 1565.531819][T24518] bond0: (slave bond_slave_0): Releasing backup interface [ 1565.665302][T24518] bond0: (slave bond_slave_1): Releasing backup interface [ 1565.758686][T24518] team0: Port device team_slave_0 removed [ 1565.931823][T24518] team0: Port device team_slave_1 removed [ 1565.932731][T24518] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 1565.932751][T24518] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 1565.993383][T24518] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 1565.993407][T24518] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 1566.003307][T22009] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 1566.012311][T22009] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 1566.013198][T22009] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 1566.014078][T22009] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 1566.014662][T22009] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 1566.043069][T24540] netlink: 4 bytes leftover after parsing attributes in process `syz.5.15264'. [ 1566.135320][T24518] A link change request failed with some changes committed already. Interface hsr_slave_0 may have been left with an inconsistent configuration, please check. [ 1566.196312][ T1222] syz1: Port: 1 Link DOWN [ 1566.202312][T24531] netlink: 'syz.5.15264': attribute type 12 has an invalid length. [ 1566.263595][T24039] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 1566.267029][T24039] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 1566.267349][T24039] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 1566.277994][T24039] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 1566.279351][T24039] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 1566.778756][T24567] netlink: 8 bytes leftover after parsing attributes in process `syz.6.15268'. [ 1566.932705][T24575] netlink: 76 bytes leftover after parsing attributes in process `syz.1.15270'. [ 1566.969160][T24571] batman_adv: batadv0: Interface deactivated: macvlan2 [ 1567.019041][T24571] batman_adv: batadv0: Removing interface: macvlan2 [ 1567.217867][T24586] netlink: 8 bytes leftover after parsing attributes in process `syz.1.15274'. [ 1567.297401][T24586] vlan2: entered allmulticast mode [ 1567.297423][T24586] bridge0: entered allmulticast mode [ 1567.298035][T24586] bridge0: port 3(vlan2) entered blocking state [ 1567.298204][T24586] bridge0: port 3(vlan2) entered disabled state [ 1567.340388][T24591] netlink: 'syz.6.15276': attribute type 12 has an invalid length. [ 1567.364399][T24591] netlink: 4 bytes leftover after parsing attributes in process `syz.6.15276'. [ 1567.772594][T24602] team0: Device xfrm0 is of different type [ 1568.283488][T24617] FAULT_INJECTION: forcing a failure. [ 1568.283488][T24617] name failslab, interval 1, probability 0, space 0, times 0 [ 1568.283521][T24617] CPU: 1 UID: 0 PID: 24617 Comm: syz.6.15283 Not tainted syzkaller #0 PREEMPT(full) [ 1568.283542][T24617] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 1568.283554][T24617] Call Trace: [ 1568.283562][T24617] [ 1568.283571][T24617] dump_stack_lvl+0xe8/0x150 [ 1568.283602][T24617] should_fail_ex+0x410/0x560 [ 1568.283631][T24617] should_failslab+0xa8/0x100 [ 1568.283656][T24617] __kvmalloc_node_noprof+0x176/0x820 [ 1568.283681][T24617] ? bpf_test_run_xdp_live+0x1ef/0x1c20 [ 1568.283700][T24617] ? bpf_test_run_xdp_live+0x1ef/0x1c20 [ 1568.283726][T24617] bpf_test_run_xdp_live+0x1ef/0x1c20 [ 1568.283749][T24617] ? bpf_dispatcher_change_prog+0xc4c/0xf20 [ 1568.283775][T24617] ? __mutex_unlock_slowpath+0x731/0x900 [ 1568.283807][T24617] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 1568.283835][T24617] ? __pfx_bpf_test_run_xdp_live+0x10/0x10 [ 1568.283854][T24617] ? bpf_dispatcher_xdp+0x800/0x1000 [ 1568.283921][T24617] ? __pfx_xdp_test_run_init_page+0x10/0x10 [ 1568.283948][T24617] ? _copy_from_user+0x94/0xb0 [ 1568.283974][T24617] ? bpf_test_init+0x113/0x150 [ 1568.284000][T24617] ? xdp_convert_md_to_buff+0x5b/0x330 [ 1568.284022][T24617] bpf_prog_test_run_xdp+0x7d8/0x11d0 [ 1568.284057][T24617] ? __pfx_bpf_prog_test_run_xdp+0x10/0x10 [ 1568.284082][T24617] ? __fget_files+0x2a/0x420 [ 1568.284112][T24617] ? __pfx_bpf_prog_test_run_xdp+0x10/0x10 [ 1568.284133][T24617] bpf_prog_test_run+0x2c5/0x340 [ 1568.284160][T24617] __sys_bpf+0xa22/0xd90 [ 1568.284190][T24617] ? __pfx___sys_bpf+0x10/0x10 [ 1568.284223][T24617] ? __fget_files+0x2a/0x420 [ 1568.284265][T24617] ? ksys_write+0x242/0x270 [ 1568.284296][T24617] ? __pfx_ksys_write+0x10/0x10 [ 1568.284328][T24617] __x64_sys_bpf+0xba/0xd0 [ 1568.284358][T24617] do_syscall_64+0x166/0x520 [ 1568.284382][T24617] ? trace_irq_disable+0x3b/0x140 [ 1568.284400][T24617] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1568.284420][T24617] ? clear_bhb_loop+0x70/0xc0 [ 1568.284442][T24617] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1568.284459][T24617] RIP: 0033:0x7f373359e159 [ 1568.284476][T24617] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1568.284491][T24617] RSP: 002b:00007f37343d1028 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 1568.284512][T24617] RAX: ffffffffffffffda RBX: 00007f3733825fa0 RCX: 00007f373359e159 [ 1568.284525][T24617] RDX: 0000000000000050 RSI: 0000200000000b80 RDI: 000000000000000a [ 1568.284538][T24617] RBP: 00007f37343d1090 R08: 0000000000000000 R09: 0000000000000000 [ 1568.284550][T24617] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1568.284562][T24617] R13: 00007f3733826038 R14: 00007f3733825fa0 R15: 00007ffdbac96778 [ 1568.284594][T24617] [ 1568.438288][T22009] Bluetooth: hci2: command tx timeout [ 1568.547280][T24623] __nla_validate_parse: 2 callbacks suppressed [ 1568.547301][T24623] netlink: 44 bytes leftover after parsing attributes in process `syz.1.15287'. [ 1568.673501][T24626] netlink: 8 bytes leftover after parsing attributes in process `syz.5.15286'. [ 1568.726539][T24626] vlan0: entered allmulticast mode [ 1568.726846][T24626] bridge0: port 2(vlan0) entered blocking state [ 1568.759582][T24626] bridge0: port 2(vlan0) entered disabled state [ 1568.921229][T24643] netlink: 'syz.1.15292': attribute type 4 has an invalid length. [ 1569.125654][ T3734] netdevsim netdevsim0 eth1: set [1, 0] type 2 family 0 port 6081 - 0 [ 1569.292835][ T1369] netdevsim netdevsim0 eth4: set [1, 0] type 2 family 0 port 6081 - 0 [ 1569.305252][ T1369] netdevsim netdevsim0 eth2: set [1, 0] type 2 family 0 port 6081 - 0 [ 1569.306246][ T1369] netdevsim netdevsim0 eth3: set [1, 0] type 2 family 0 port 6081 - 0 [ 1569.354189][T24656] FAULT_INJECTION: forcing a failure. [ 1569.354189][T24656] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1569.354220][T24656] CPU: 0 UID: 0 PID: 24656 Comm: syz.7.15296 Not tainted syzkaller #0 PREEMPT(full) [ 1569.354241][T24656] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 1569.354253][T24656] Call Trace: [ 1569.354261][T24656] [ 1569.354269][T24656] dump_stack_lvl+0xe8/0x150 [ 1569.354306][T24656] should_fail_ex+0x410/0x560 [ 1569.354332][T24656] _copy_from_user+0x2d/0xb0 [ 1569.354359][T24656] ___sys_sendmsg+0x1c6/0x360 [ 1569.354384][T24656] ? __lock_acquire+0x747/0x2de0 [ 1569.354406][T24656] ? __pfx____sys_sendmsg+0x10/0x10 [ 1569.354460][T24656] ? __fget_files+0x2a/0x420 [ 1569.354484][T24656] ? __fget_files+0x3a2/0x420 [ 1569.354519][T24656] __x64_sys_sendmsg+0x1b1/0x290 [ 1569.354546][T24656] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 1569.354593][T24656] do_syscall_64+0x166/0x520 [ 1569.354615][T24656] ? trace_irq_disable+0x3b/0x140 [ 1569.354634][T24656] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1569.354653][T24656] ? clear_bhb_loop+0x70/0xc0 [ 1569.354675][T24656] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1569.354693][T24656] RIP: 0033:0x7ff293f9e159 [ 1569.354711][T24656] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1569.354726][T24656] RSP: 002b:00007ff294de3028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 1569.354748][T24656] RAX: ffffffffffffffda RBX: 00007ff294225fa0 RCX: 00007ff293f9e159 [ 1569.354762][T24656] RDX: 0000000000000000 RSI: 0000200000004380 RDI: 0000000000000003 [ 1569.354774][T24656] RBP: 00007ff294de3090 R08: 0000000000000000 R09: 0000000000000000 [ 1569.354785][T24656] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1569.354796][T24656] R13: 00007ff294226038 R14: 00007ff294225fa0 R15: 00007ffc6e5384d8 [ 1569.354827][T24656] [ 1569.587655][ T1341] batman_adv: batadv0: Removing interface: ip6gretap1 [ 1569.922420][ T1341] team0: Port device xfrm0 removed [ 1570.093867][T24690] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 1570.422191][ T1341] bond0 (unregistering): Released all slaves [ 1570.440950][ T1341] bond1 (unregistering): Released all slaves [ 1570.472626][ T1341] bond2 (unregistering): Released all slaves [ 1570.492016][ T1341] bond3 (unregistering): Released all slaves [ 1570.515430][T22009] Bluetooth: hci2: command tx timeout [ 1570.527211][ T1341] bond4 (unregistering): Released all slaves [ 1570.549578][ T1341] bond5 (unregistering): Released all slaves [ 1570.569081][ T1341] bond6 (unregistering): Released all slaves [ 1570.585485][ T1341] bond7 (unregistering): Released all slaves [ 1570.619543][ T1341] bond8 (unregistering): Released all slaves [ 1570.634681][ T1341] bond9 (unregistering): Released all slaves [ 1570.698576][T24674] workqueue: Failed to create a rescuer kthread for wq "bond5": -EINTR [ 1570.824237][ C1] ip6_tunnel: ip6tnl1 xmit: Local address not yet configured! [ 1570.900792][ T5280] 8021q: adding VLAN 0 to HW filter on device eth1 [ 1570.901365][ T1341] ´: left promiscuous mode [ 1570.949068][T24707] netlink: 4 bytes leftover after parsing attributes in process `syz.1.15303'. [ 1571.157333][ T1341] ovs-s!: left promiscuous mode [ 1571.275351][ T1341] tipc: Left network mode [ 1571.280052][T24711] netlink: 256 bytes leftover after parsing attributes in process `syz.5.15302'. [ 1571.397528][ T1341] IPVS: stopping master sync thread 14506 ... [ 1571.483432][T24717] netlink: 164 bytes leftover after parsing attributes in process `syz.6.15305'. [ 1571.561709][T24717] netlink: 8 bytes leftover after parsing attributes in process `syz.6.15305'. [ 1571.697095][T24727] netlink: 4 bytes leftover after parsing attributes in process `syz.6.15305'. [ 1571.737031][T24731] netlink: 'syz.1.15306': attribute type 10 has an invalid length. [ 1571.860439][T24731] bridge0: port 2(bridge_slave_1) entered disabled state [ 1571.861054][T24731] bridge0: port 1(bridge_slave_0) entered disabled state [ 1571.886331][T24731] bridge0: port 2(bridge_slave_1) entered blocking state [ 1571.886455][T24731] bridge0: port 2(bridge_slave_1) entered forwarding state [ 1571.886748][T24731] bridge0: port 1(bridge_slave_0) entered blocking state [ 1571.886872][T24731] bridge0: port 1(bridge_slave_0) entered forwarding state [ 1571.890860][T24731] bond0: (slave bridge0): Enslaving as an active interface with an up link [ 1572.123924][T24742] netlink: 76 bytes leftover after parsing attributes in process `syz.7.15309'. [ 1572.344577][T24752] netlink: 4 bytes leftover after parsing attributes in process `syz.5.15311'. [ 1572.593958][T22009] Bluetooth: hci2: command tx timeout [ 1572.747036][ C1] ip6_tunnel: ip6tnl1 xmit: Local address not yet configured! [ 1572.857423][ T5280] 8021q: adding VLAN 0 to HW filter on device eth2 [ 1572.962606][T24778] netlink: 8 bytes leftover after parsing attributes in process `syz.5.15316'. [ 1573.038036][T24778] vlan0: entered allmulticast mode [ 1573.038345][T24778] bridge0: port 2(vlan0) entered blocking state [ 1573.038533][T24778] bridge0: port 2(vlan0) entered disabled state [ 1573.781144][T24813] netlink: 4 bytes leftover after parsing attributes in process `syz.5.15321'. [ 1574.070740][T24538] bridge0: port 1(bridge_slave_0) entered blocking state [ 1574.070850][T24538] bridge0: port 1(bridge_slave_0) entered disabled state [ 1574.071042][T24538] bridge_slave_0: entered allmulticast mode [ 1574.072864][T24538] bridge_slave_0: entered promiscuous mode [ 1574.084196][T24808] netlink: 'syz.5.15321': attribute type 12 has an invalid length. [ 1574.084870][T24797] syzkaller0: entered promiscuous mode [ 1574.084887][T24797] syzkaller0: entered allmulticast mode [ 1574.089931][ T5280] 8021q: adding VLAN 0 to HW filter on device eth3 [ 1574.288143][T24538] bridge0: port 2(bridge_slave_1) entered blocking state [ 1574.288272][T24538] bridge0: port 2(bridge_slave_1) entered disabled state [ 1574.288433][T24538] bridge_slave_1: entered allmulticast mode [ 1574.292458][T24538] bridge_slave_1: entered promiscuous mode [ 1574.332650][T24825] netlink: 'syz.5.15324': attribute type 4 has an invalid length. [ 1574.332670][T24825] netlink: 152 bytes leftover after parsing attributes in process `syz.5.15324'. [ 1574.377306][T24833] netlink: 4 bytes leftover after parsing attributes in process `syz.6.15325'. [ 1574.402383][T24538] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 1574.416139][T24538] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 1574.417429][T24825] A link change request failed with some changes committed already. Interface bond0 may have been left with an inconsistent configuration, please check. [ 1574.498327][T24836] FAULT_INJECTION: forcing a failure. [ 1574.498327][T24836] name failslab, interval 1, probability 0, space 0, times 0 [ 1574.498358][T24836] CPU: 0 UID: 0 PID: 24836 Comm: syz.7.15326 Not tainted syzkaller #0 PREEMPT(full) [ 1574.498379][T24836] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 1574.498391][T24836] Call Trace: [ 1574.498399][T24836] [ 1574.498407][T24836] dump_stack_lvl+0xe8/0x150 [ 1574.498438][T24836] should_fail_ex+0x410/0x560 [ 1574.498466][T24836] should_failslab+0xa8/0x100 [ 1574.498490][T24836] ? skb_clone+0x212/0x3a0 [ 1574.498515][T24836] kmem_cache_alloc_noprof+0xa1/0x600 [ 1574.498545][T24836] ? skb_clone+0x212/0x3a0 [ 1574.498577][T24836] skb_clone+0x212/0x3a0 [ 1574.498607][T24836] __netlink_deliver_tap+0x355/0x6e0 [ 1574.498647][T24836] ? netlink_deliver_tap+0x2e/0x1b0 [ 1574.498676][T24836] netlink_deliver_tap+0x19c/0x1b0 [ 1574.498706][T24836] netlink_unicast+0x781/0x940 [ 1574.498742][T24836] netlink_sendmsg+0x813/0xb40 [ 1574.498769][T24836] ? __pfx_netlink_sendmsg+0x10/0x10 [ 1574.498796][T24836] ? apparmor_socket_sendmsg+0x98/0x360 [ 1574.498816][T24836] ? lock_acquire+0x115/0x350 [ 1574.498836][T24836] ? __pfx_netlink_sendmsg+0x10/0x10 [ 1574.498854][T24836] sock_sendmsg_nosec+0x14e/0x190 [ 1574.498878][T24836] sock_write_iter+0x2de/0x3e0 [ 1574.498909][T24836] ? __pfx_sock_write_iter+0x10/0x10 [ 1574.498954][T24836] ? bpf_lsm_file_permission+0x9/0x20 [ 1574.498979][T24836] ? security_file_permission+0x75/0x260 [ 1574.499009][T24836] vfs_write+0x612/0xba0 [ 1574.499046][T24836] ? __pfx_vfs_write+0x10/0x10 [ 1574.499084][T24836] ? __fget_files+0x2a/0x420 [ 1574.499120][T24836] ksys_write+0x150/0x270 [ 1574.499150][T24836] ? __pfx_ksys_write+0x10/0x10 [ 1574.499190][T24836] do_syscall_64+0x166/0x520 [ 1574.499214][T24836] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1574.499234][T24836] ? clear_bhb_loop+0x70/0xc0 [ 1574.499257][T24836] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1574.499276][T24836] RIP: 0033:0x7ff293f9e159 [ 1574.499294][T24836] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1574.499309][T24836] RSP: 002b:00007ff294de3028 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 1574.499330][T24836] RAX: ffffffffffffffda RBX: 00007ff294225fa0 RCX: 00007ff293f9e159 [ 1574.499344][T24836] RDX: 00000000000000fc RSI: 00002000000002c0 RDI: 0000000000000003 [ 1574.499356][T24836] RBP: 00007ff294de3090 R08: 0000000000000000 R09: 0000000000000000 [ 1574.499368][T24836] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1574.499380][T24836] R13: 00007ff294226038 R14: 00007ff294225fa0 R15: 00007ffc6e5384d8 [ 1574.499413][T24836] [ 1574.499561][T24836] netlink: 'syz.7.15326': attribute type 12 has an invalid length. [ 1574.501266][T24836] netlink: 4 bytes leftover after parsing attributes in process `syz.7.15326'. [ 1574.668830][T22009] Bluetooth: hci2: command tx timeout [ 1574.804757][T24538] team0: Port device team_slave_0 added [ 1574.896880][T24538] team0: Port device team_slave_1 added [ 1575.069884][T24847] netlink: 44 bytes leftover after parsing attributes in process `syz.7.15329'. [ 1575.121882][T24850] bridge0: port 3(batadv1) entered blocking state [ 1575.122065][T24850] bridge0: port 3(batadv1) entered disabled state [ 1575.122290][T24850] batadv1: entered allmulticast mode [ 1575.159616][T24850] batadv1: entered promiscuous mode [ 1575.172137][T24538] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 1575.172152][T24538] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 1575.172171][T24538] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 1575.174188][T24538] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 1575.174202][T24538] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 1575.174224][T24538] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 1575.428329][ T1341] batman_adv: batadv0: Removing interface: macvtap1 [ 1575.452951][T24865] netlink: 4 bytes leftover after parsing attributes in process `syz.7.15337'. [ 1575.585870][ T31] audit: type=1804 audit(1790723553.391:26): pid=24867 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=open_writers comm="syz.1.15333" name="/newroot/97/cgroup.controllers" dev="tmpfs" ino=517 res=1 errno=0 [ 1575.585924][ T31] audit: type=1800 audit(1790723553.391:27): pid=24867 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.1.15333" name="cgroup.controllers" dev="tmpfs" ino=517 res=0 errno=0 [ 1575.593374][T24867] No such timeout policy "syz0" [ 1575.648596][T28529] batman_adv: batadv1: No IGMP Querier present - multicast optimizations disabled [ 1575.648614][T28529] batman_adv: batadv1: No MLD Querier present - multicast optimizations disabled [ 1575.721578][T24860] syzkaller0: entered promiscuous mode [ 1575.721600][T24860] syzkaller0: entered allmulticast mode [ 1576.004122][T24538] hsr_slave_0: entered promiscuous mode [ 1576.005209][T24538] hsr_slave_1: entered promiscuous mode [ 1576.006080][T24538] debugfs: 'hsr0' already exists in 'hsr' [ 1576.006100][T24538] Cannot create hsr debugfs directory [ 1576.216742][T24895] netlink: 8 bytes leftover after parsing attributes in process `syz.1.15340'. [ 1576.216773][T24895] netlink: 8 bytes leftover after parsing attributes in process `syz.1.15340'. [ 1576.371343][ T5280] 8021q: adding VLAN 0 to HW filter on device eth4 [ 1576.943898][T24914] netlink: zone id is out of range [ 1576.943944][T24914] netlink: zone id is out of range [ 1576.944059][T24914] netlink: zone id is out of range [ 1576.944099][T24914] netlink: zone id is out of range [ 1576.944107][T24914] netlink: zone id is out of range [ 1576.944114][T24914] netlink: zone id is out of range [ 1576.944122][T24914] netlink: zone id is out of range [ 1576.944130][T24914] netlink: zone id is out of range [ 1576.944137][T24914] netlink: zone id is out of range [ 1577.333719][T24538] netdevsim netdevsim0 eth4 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1577.439168][ T1341] hsr_slave_0: left promiscuous mode [ 1577.439931][ T1341] hsr_slave_1: left promiscuous mode [ 1577.804599][T24938] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 1577.896657][T24944] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 1577.953616][T24938] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 1577.995498][T24946] netlink: 4 bytes leftover after parsing attributes in process `syz.7.15348'. [ 1578.299252][T24922] workqueue: Failed to create a rescuer kthread for wq "bond2": -EINTR [ 1578.400766][T24954] netlink: 6024 bytes leftover after parsing attributes in process `syz.6.15349'. [ 1578.461673][T24538] netdevsim netdevsim0 eth3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1578.744156][T24538] netdevsim netdevsim0 eth2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1578.904164][T24963] syzkaller0: entered promiscuous mode [ 1578.904187][T24963] syzkaller0: entered allmulticast mode [ 1579.047491][T24538] netdevsim netdevsim0 eth1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1579.096909][T24974] netlink: 12 bytes leftover after parsing attributes in process `syz.7.15351'. [ 1579.139656][T24977] netlink: 44 bytes leftover after parsing attributes in process `syz.6.15352'. [ 1579.400210][T24974] ipvlan2: entered allmulticast mode [ 1579.400232][T24974] syz_tun: entered allmulticast mode [ 1579.582880][T24986] team0: Device xfrm0 is of different type [ 1579.636346][ T1341] IPVS: stop unused estimator thread 0... [ 1580.160351][T25008] x_tables: duplicate entry at hook 1 [ 1580.176283][T25004] tipc: Started in network mode [ 1580.176312][T25004] tipc: Node identity 00000000000000000000000000000001, cluster identity 4711 [ 1580.176863][T25004] tipc: New replicast peer: fe80:0000:0000:0000:0000:0000:0000:00bb [ 1580.177180][T25004] tipc: Enabled bearer , priority 10 [ 1580.177302][T25009] netlink: 8 bytes leftover after parsing attributes in process `syz.7.15358'. [ 1580.369632][T25008] netlink: 12 bytes leftover after parsing attributes in process `syz.5.15360'. [ 1580.388114][T24538] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 1580.394125][T25008] netlink: 60 bytes leftover after parsing attributes in process `syz.5.15360'. [ 1580.427173][T24538] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 1580.429492][T24538] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 1580.471949][T24538] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 1580.477416][T24538] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 1580.486258][T25008] netlink: 12 bytes leftover after parsing attributes in process `syz.5.15360'. [ 1580.502916][T24538] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 1580.503728][T24538] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 1580.514866][T25013] siw: device registration error -23 [ 1580.555726][T24538] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 1580.997712][T24538] 8021q: adding VLAN 0 to HW filter on device bond0 [ 1581.024414][T25049] veth0_vlan: left promiscuous mode [ 1581.024471][T25049] vlan0: entered promiscuous mode [ 1581.024484][T25049] veth0_vlan: entered promiscuous mode [ 1581.082267][T25049] team0: Port device vlan0 added [ 1581.090942][T25049] netlink: 'syz.6.15368': attribute type 2 has an invalid length. [ 1581.112021][T24538] 8021q: adding VLAN 0 to HW filter on device team0 [ 1581.148942][T12454] bridge0: port 1(bridge_slave_0) entered blocking state [ 1581.149054][T12454] bridge0: port 1(bridge_slave_0) entered forwarding state [ 1581.187913][T12452] bridge0: port 2(bridge_slave_1) entered blocking state [ 1581.188027][T12452] bridge0: port 2(bridge_slave_1) entered forwarding state [ 1581.202127][T19785] tipc: Node number set to 1 [ 1581.362821][T25054] žÿ: renamed from team_slave_1 (while UP) [ 1581.412563][T25054] syzkaller0: entered promiscuous mode [ 1581.412584][T25054] syzkaller0: entered allmulticast mode [ 1582.642679][T24538] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 1582.844703][T24538] veth0_vlan: entered promiscuous mode [ 1582.860424][T24538] veth1_vlan: entered promiscuous mode [ 1582.995205][T24538] veth0_macvtap: entered promiscuous mode [ 1582.999178][T24538] veth1_macvtap: entered promiscuous mode [ 1583.056590][T24538] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 1583.099718][T24538] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 1583.460704][T25144] tipc: New replicast peer: 172.20.20.187 [ 1583.460957][T25144] tipc: Enabled bearer , priority 10 [ 1583.521849][ T3734] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 1583.521901][ T3734] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 1583.521931][ T3734] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 1583.521958][ T3734] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 1583.771801][ T1341] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1583.771824][ T1341] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1583.890185][T12454] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1583.890204][T12454] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1584.019813][T25166] netlink: 16 bytes leftover after parsing attributes in process `syz.0.15261'. [ 1584.019848][T25166] netlink: 468 bytes leftover after parsing attributes in process `syz.0.15261'. [ 1584.019866][T25166] netlink: 16 bytes leftover after parsing attributes in process `syz.0.15261'. [ 1584.784559][T25193] netlink: 8 bytes leftover after parsing attributes in process `syz.1.15400'. [ 1584.785235][T25193] netlink: 8 bytes leftover after parsing attributes in process `syz.1.15400'. [ 1584.791556][T25195] netlink: 52 bytes leftover after parsing attributes in process `syz.5.15401'. [ 1585.025276][T25204] netlink: 'syz.7.15402': attribute type 12 has an invalid length. [ 1585.050165][T25204] netlink: 4 bytes leftover after parsing attributes in process `syz.7.15402'. [ 1585.140730][T25206] netlink: 44 bytes leftover after parsing attributes in process `syz.0.15404'. [ 1585.511210][T25240] netlink: 'syz.6.15416': attribute type 12 has an invalid length. [ 1585.513017][T25226] netdevsim netdevsim0 netdevsim0: entered allmulticast mode [ 1585.519707][T25240] netlink: 4 bytes leftover after parsing attributes in process `syz.6.15416'. [ 1585.546695][T25226] net_ratelimit: 61 callbacks suppressed [ 1585.546711][T25226] A link change request failed with some changes committed already. Interface netdevsim0 may have been left with an inconsistent configuration, please check. [ 1585.811282][T25254] netlink: 8 bytes leftover after parsing attributes in process `syz.5.15418'. [ 1585.811303][T25254] netlink: 24 bytes leftover after parsing attributes in process `syz.5.15418'. [ 1585.937254][T25258] bond0: entered promiscuous mode [ 1585.937279][T25258] bond_slave_0: entered promiscuous mode [ 1585.937421][T25258] team0: entered promiscuous mode [ 1585.937435][T25258] team_slave_0: entered promiscuous mode [ 1585.937569][T25258] team_slave_1: entered promiscuous mode [ 1585.940424][T25258] bond0: entered allmulticast mode [ 1585.940444][T25258] bond_slave_0: entered allmulticast mode [ 1585.940460][T25258] team0: entered allmulticast mode [ 1585.940471][T25258] team_slave_0: entered allmulticast mode [ 1585.940485][T25258] team_slave_1: entered allmulticast mode [ 1585.940499][T25258] vlan0: entered allmulticast mode [ 1585.940511][T25258] veth0_vlan: entered allmulticast mode [ 1586.781765][T25301] netlink: 8 bytes leftover after parsing attributes in process `syz.6.15429'. [ 1586.781800][T25301] netlink: 'syz.6.15429': attribute type 10 has an invalid length. [ 1586.781817][T25301] netlink: 12 bytes leftover after parsing attributes in process `syz.6.15429'. [ 1587.009512][T25309] netlink: 'syz.1.15433': attribute type 12 has an invalid length. [ 1587.481341][ T1341] nci: nci_rf_intf_activated_ntf_packet: unsupported activation_rf_tech_and_mode 0x30 [ 1587.498230][T25324] veth0: entered promiscuous mode [ 1587.864534][T19785] ip6_tunnel: ip6tnl1 xmit: Local address not yet configured! [ 1587.870465][T25340] netlink: 'syz.1.15441': attribute type 2 has an invalid length. [ 1588.464304][T19785] ip6_tunnel: ip6tnl1 xmit: Local address not yet configured! [ 1588.825253][T25340] : entered promiscuous mode [ 1588.826876][T25322] veth0: left promiscuous mode [ 1588.841669][T25359] netlink: 'syz.5.15448': attribute type 12 has an invalid length. [ 1589.649916][T22009] block nbd1: Receive control failed (result -1) [ 1589.862570][T25405] __nla_validate_parse: 4 callbacks suppressed [ 1589.862591][T25405] netlink: 4 bytes leftover after parsing attributes in process `syz.7.15462'. [ 1589.984330][T25408] netlink: 4 bytes leftover after parsing attributes in process `syz.7.15462'. [ 1590.506815][T25427] lo: entered promiscuous mode [ 1590.506843][T25427] lo: entered allmulticast mode [ 1590.539054][T25429] netlink: 4 bytes leftover after parsing attributes in process `syz.7.15471'. [ 1590.561646][T25427] netlink: 40 bytes leftover after parsing attributes in process `syz.1.15466'. [ 1590.561670][T25427] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 1590.662835][T25443] netlink: 20 bytes leftover after parsing attributes in process `syz.1.15466'. [ 1590.895067][T25448] netlink: 52 bytes leftover after parsing attributes in process `syz.0.15473'. [ 1593.331721][T25419] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 1593.564365][T25459] ip_tables: iptables: counters copy to user failed while replacing table [ 1593.587599][T25462] netlink: 4 bytes leftover after parsing attributes in process `syz.6.15478'. [ 1593.625625][T25462] netlink: 4 bytes leftover after parsing attributes in process `syz.6.15478'. [ 1593.674388][T25470] netlink: 16 bytes leftover after parsing attributes in process `syz.5.15479'. [ 1593.674410][T25470] tipc: Started in network mode [ 1593.674424][T25470] tipc: Node identity 4, cluster identity 4711 [ 1593.674435][T25470] tipc: Node number set to 4 [ 1593.699366][T25465] netlink: 20 bytes leftover after parsing attributes in process `syz.5.15479'. [ 1593.837535][T25475] netlink: 'syz.0.15481': attribute type 25 has an invalid length. [ 1593.837567][T25475] bond0: option ad_user_port_key: mode dependency failed, not supported in mode balance-rr(0) [ 1594.316090][T25506] syzkaller0: entered promiscuous mode [ 1594.316110][T25506] syzkaller0: entered allmulticast mode [ 1595.019139][ T31] audit: type=1804 audit(1790723572.821:28): pid=25541 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=open_writers comm="syz.6.15499" name="/newroot/219/cgroup.controllers" dev="tmpfs" ino=1133 res=1 errno=0 [ 1595.019194][ T31] audit: type=1800 audit(1790723572.821:29): pid=25541 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.6.15499" name="cgroup.controllers" dev="tmpfs" ino=1133 res=0 errno=0 [ 1595.082683][T25541] No such timeout policy "syz0" [ 1595.094612][T25547] netlink: 'syz.0.15503': attribute type 12 has an invalid length. [ 1595.112489][T25547] __nla_validate_parse: 4 callbacks suppressed [ 1595.112506][T25547] netlink: 4 bytes leftover after parsing attributes in process `syz.0.15503'. [ 1595.267744][T25552] syzkaller0: entered promiscuous mode [ 1595.267766][T25552] syzkaller0: entered allmulticast mode [ 1595.438984][T25559] netlink: 36 bytes leftover after parsing attributes in process `syz.1.15505'. [ 1595.727032][T25566] netlink: 8 bytes leftover after parsing attributes in process `syz.6.15507'. [ 1595.727063][T25566] netlink: 20 bytes leftover after parsing attributes in process `syz.6.15507'. [ 1595.761908][T25580] netlink: 'syz.5.15508': attribute type 2 has an invalid length. [ 1595.768478][T25580] netlink: 'syz.5.15508': attribute type 12 has an invalid length. [ 1595.778220][T25580] netlink: 4 bytes leftover after parsing attributes in process `syz.5.15508'. [ 1595.799565][T25580] netlink: 12 bytes leftover after parsing attributes in process `syz.5.15508'. [ 1595.834232][T25581] netlink: 24 bytes leftover after parsing attributes in process `syz.7.15506'. [ 1596.429369][ T1340] IPVS: starting estimator thread 0... [ 1596.521257][T25607] IPVS: using max 29 ests per chain, 69600 per kthread [ 1596.624413][ T1222] ip6_tunnel: ip6tnl1 xmit: Local address not yet configured! [ 1596.927561][T25623] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 1596.951610][T25618] syzkaller0: entered promiscuous mode [ 1596.951631][T25618] syzkaller0: entered allmulticast mode [ 1597.065928][T25627] netlink: 76 bytes leftover after parsing attributes in process `syz.7.15521'. [ 1597.388713][T25647] netlink: 'syz.0.15525': attribute type 16 has an invalid length. [ 1597.388738][T25647] netlink: 'syz.0.15525': attribute type 17 has an invalid length. [ 1597.398935][ T1222] ip6_tunnel: ip6tnl1 xmit: Local address not yet configured! [ 1597.624333][T25647] netdevsim netdevsim0 netdevsim0: left allmulticast mode [ 1597.916920][T25670] netlink: 8 bytes leftover after parsing attributes in process `syz.0.15533'. [ 1597.916955][T25670] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 1597.918288][T25670] netlink: 104 bytes leftover after parsing attributes in process `syz.0.15533'. [ 1598.375159][T25682] netlink: 'syz.6.15537': attribute type 1 has an invalid length. [ 1598.477818][T25685] pimreg: entered allmulticast mode [ 1598.494004][T25685] pimreg: left allmulticast mode [ 1598.521697][T25693] netlink: 'syz.7.15542': attribute type 1 has an invalid length. [ 1598.646591][T25695] 8021q: VLANs not supported on ip6tnl0 [ 1598.946466][T25712] siw: device registration error -23 [ 1599.121106][T25724] syzkaller0: entered promiscuous mode [ 1599.121201][T25724] syzkaller0: entered allmulticast mode [ 1599.517716][T25735] netlink: 'syz.0.15554': attribute type 11 has an invalid length. [ 1599.633883][ T32] INFO: task syz.3.14315:20692 blocked for more than 143 seconds. [ 1599.633906][ T32] Not tainted syzkaller #0 [ 1599.633916][ T32] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. [ 1599.633925][ T32] task:syz.3.14315 state:D stack:25624 pid:20692 tgid:20691 ppid:13094 task_flags:0x400140 flags:0x000 ** replaying previous printk message ** [ 1599.633925][ T32] task:syz.3.14315 state:D stack:25624 pid:20692 tgid:20691 ppid:13094 task_flags:0x400140 flags:0x00080002 [ 1599.634009][ T32] Call Trace: [ 1599.634017][ T32] [ 1599.634030][ T32] __schedule+0x17db/0x58f0 [ 1599.634089][ T32] ? __pfx___schedule+0x10/0x10 [ 1599.634121][ T32] ? schedule+0x90/0x2b0 [ 1599.634147][ T32] schedule+0x164/0x2b0 [ 1599.634172][ T32] schedule_preempt_disabled+0x13/0x30 [ 1599.634193][ T32] __mutex_lock+0x7c1/0x1550 [ 1599.634229][ T32] ? __mutex_lock+0x5d4/0x1550 [ 1599.634257][ T32] ? nfsd_nl_unlock_filesystem_doit+0x2af/0x410 [ 1599.634360][ T32] ? __pfx___mutex_lock+0x10/0x10 [ 1599.634383][ T32] ? lockdep_hardirqs_on+0x7b/0x110 [ 1599.634427][ T32] nfsd_nl_unlock_filesystem_doit+0x2af/0x410 [ 1599.634452][ T32] ? __nla_parse+0x40/0x60 [ 1599.634479][ T32] ? __pfx_nfsd_nl_unlock_filesystem_doit+0x10/0x10 [ 1599.634506][ T32] ? genl_family_rcv_msg_attrs_parse+0x20b/0x2f0 [ 1599.634531][ T32] ? genl_family_rcv_msg_attrs_parse+0x265/0x2f0 [ 1599.634564][ T32] genl_family_rcv_msg_doit+0x233/0x340 [ 1599.634596][ T32] ? __pfx_genl_family_rcv_msg_doit+0x10/0x10 [ 1599.634634][ T32] ? bpf_lsm_capable+0x9/0x20 [ 1599.634651][ T32] ? security_capable+0x7e/0x2c0 [ 1599.634682][ T32] genl_rcv_msg+0x614/0x7a0 [ 1599.634713][ T32] ? __pfx_genl_rcv_msg+0x10/0x10 [ 1599.634735][ T32] ? __pfx_nfsd_nl_unlock_filesystem_doit+0x10/0x10 [ 1599.634777][ T32] netlink_rcv_skb+0x226/0x4a0 [ 1599.634807][ T32] ? __pfx_genl_rcv_msg+0x10/0x10 [ 1599.634833][ T32] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 1599.634878][ T32] ? down_read+0x2be/0x330 [ 1599.634908][ T32] genl_rcv+0x28/0x40 [ 1599.634928][ T32] netlink_unicast+0x7bd/0x940 [ 1599.634967][ T32] netlink_sendmsg+0x813/0xb40 [ 1599.634997][ T32] ? __pfx_netlink_sendmsg+0x10/0x10 [ 1599.635025][ T32] ? apparmor_socket_sendmsg+0x98/0x360 [ 1599.635051][ T32] ? __pfx_netlink_sendmsg+0x10/0x10 [ 1599.635069][ T32] sock_sendmsg_nosec+0x14e/0x190 [ 1599.635093][ T32] ____sys_sendmsg+0x54e/0x850 [ 1599.635125][ T32] ? __pfx_____sys_sendmsg+0x10/0x10 [ 1599.635161][ T32] ? import_iovec+0x73/0xa0 [ 1599.635190][ T32] ___sys_sendmsg+0x2a5/0x360 [ 1599.656817][ T32] ? __lock_acquire+0x747/0x2de0 [ 1599.656851][ T32] ? __pfx____sys_sendmsg+0x10/0x10 [ 1599.656881][ T32] ? futex_wait+0x2a2/0x390 [ 1599.656938][ T32] ? __fget_files+0x2a/0x420 [ 1599.656962][ T32] ? __fget_files+0x3a2/0x420 [ 1599.656998][ T32] __x64_sys_sendmsg+0x1b1/0x290 [ 1599.657112][ T32] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 1599.657610][ T32] do_syscall_64+0x166/0x520 [ 1599.657637][ T32] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1599.657657][ T32] ? clear_bhb_loop+0x70/0xc0 [ 1599.657679][ T32] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1599.657698][ T32] RIP: 0033:0x7f4d8dd9e159 [ 1599.657716][ T32] RSP: 002b:00007f4d8ecf1028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 1599.657736][ T32] RAX: ffffffffffffffda RBX: 00007f4d8e025fa0 RCX: 00007f4d8dd9e159 [ 1599.657750][ T32] RDX: 0000000004000080 RSI: 0000200000000100 RDI: 000000000000000a [ 1599.657762][ T32] RBP: 00007f4d8de3506b R08: 0000000000000000 R09: 0000000000000000 [ 1599.657775][ T32] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 1599.657786][ T32] R13: 00007f4d8e026038 R14: 00007f4d8e025fa0 R15: 00007ffc206c8c88 [ 1599.657817][ T32] [ 1599.657828][ T32] INFO: task syz.2.14379:20937 blocked for more than 143 seconds. [ 1599.657842][ T32] Not tainted syzkaller #0 [ 1599.657852][ T32] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. [ 1599.657861][ T32] task:syz.2.14379 state:D stack:26000 pid:20937 tgid:20935 ppid:11882 task_flags:0x400140 flags:0x00080002 [ 1599.657908][ T32] Call Trace: [ 1599.657915][ T32] [ 1599.657927][ T32] __schedule+0x17db/0x58f0 [ 1599.657976][ T32] ? __pfx___schedule+0x10/0x10 [ 1599.658006][ T32] ? schedule+0x90/0x2b0 [ 1599.658030][ T32] schedule+0x164/0x2b0 [ 1599.658053][ T32] schedule_preempt_disabled+0x13/0x30 [ 1599.658073][ T32] __mutex_lock+0x7c1/0x1550 [ 1599.658100][ T32] ? __mutex_lock+0x5d4/0x1550 [ 1599.660433][ T32] ? nfsd_nl_listener_set_doit+0x53d/0x1ab0 [ 1599.660465][ T32] ? __pfx___mutex_lock+0x10/0x10 [ 1599.660488][ T32] ? __kasan_kmalloc+0x93/0xb0 [ 1599.660516][ T32] ? __nla_validate_parse+0x2429/0x2d50 [ 1599.660540][ T32] ? do_syscall_64+0x166/0x520 [ 1599.660562][ T32] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1599.661600][ T32] nfsd_nl_listener_set_doit+0x53d/0x1ab0 [ 1599.661635][ T32] ? __pfx___nla_validate_parse+0x10/0x10 [ 1599.661676][ T32] ? __pfx_nfsd_nl_listener_set_doit+0x10/0x10 [ 1599.661700][ T32] ? trace_kmalloc+0x2a/0xf0 [ 1599.661722][ T32] ? __kmalloc_noprof+0x38c/0x720 [ 1599.661744][ T32] ? __nla_parse+0x40/0x60 [ 1599.661771][ T32] ? genl_family_rcv_msg_attrs_parse+0x20b/0x2f0 [ 1599.661794][ T32] ? genl_family_rcv_msg_attrs_parse+0x265/0x2f0 [ 1599.661826][ T32] genl_family_rcv_msg_doit+0x233/0x340 [ 1599.661856][ T32] ? __pfx_genl_family_rcv_msg_doit+0x10/0x10 [ 1599.661892][ T32] ? bpf_lsm_capable+0x9/0x20 [ 1599.661909][ T32] ? security_capable+0x7e/0x2c0 [ 1599.663910][ T32] genl_rcv_msg+0x614/0x7a0 [ 1599.663945][ T32] ? __pfx_genl_rcv_msg+0x10/0x10 [ 1599.663968][ T32] ? __pfx_nfsd_nl_listener_set_doit+0x10/0x10 [ 1599.664007][ T32] netlink_rcv_skb+0x226/0x4a0 [ 1599.664036][ T32] ? __pfx_genl_rcv_msg+0x10/0x10 [ 1599.664060][ T32] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 1599.664104][ T32] ? down_read+0x2be/0x330 [ 1599.664132][ T32] genl_rcv+0x28/0x40 [ 1599.664152][ T32] netlink_unicast+0x7bd/0x940 [ 1599.664189][ T32] netlink_sendmsg+0x813/0xb40 [ 1599.664217][ T32] ? __pfx_netlink_sendmsg+0x10/0x10 [ 1599.664254][ T32] ? apparmor_socket_sendmsg+0x98/0x360 [ 1599.664278][ T32] ? __pfx_netlink_sendmsg+0x10/0x10 [ 1599.664295][ T32] sock_sendmsg_nosec+0x14e/0x190 [ 1599.664318][ T32] ____sys_sendmsg+0x54e/0x850 [ 1599.664348][ T32] ? __pfx_____sys_sendmsg+0x10/0x10 [ 1599.664382][ T32] ? import_iovec+0x73/0xa0 [ 1599.664423][ T32] ___sys_sendmsg+0x2a5/0x360 [ 1599.664447][ T32] ? __lock_acquire+0x747/0x2de0 [ 1599.664470][ T32] ? __pfx____sys_sendmsg+0x10/0x10 [ 1599.664499][ T32] ? futex_wait+0x2a2/0x390 [ 1599.664555][ T32] ? __fget_files+0x2a/0x420 [ 1599.664579][ T32] ? __fget_files+0x3a2/0x420 [ 1599.664614][ T32] __x64_sys_sendmsg+0x1b1/0x290 [ 1599.664641][ T32] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 1599.664687][ T32] do_syscall_64+0x166/0x520 [ 1599.664709][ T32] ? trace_irq_disable+0x3b/0x140 [ 1599.664726][ T32] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1599.664745][ T32] ? clear_bhb_loop+0x70/0xc0 [ 1599.664769][ T32] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1599.664787][ T32] RIP: 0033:0x7f020b19e159 [ 1599.664803][ T32] RSP: 002b:00007f020bfdd028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 1599.664822][ T32] RAX: ffffffffffffffda RBX: 00007f020b425fa0 RCX: 00007f020b19e159 [ 1599.664835][ T32] RDX: 000000000000c000 RSI: 0000200000000100 RDI: 0000000000000007 [ 1599.664848][ T32] RBP: 00007f020b23506b R08: 0000000000000000 R09: 0000000000000000 [ 1599.664863][ T32] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 1599.668093][ T32] R13: 00007f020b426038 R14: 00007f020b425fa0 R15: 00007ffddeeb11d8 [ 1599.668129][ T32] [ 1599.668190][ T32] [ 1599.668190][ T32] Showing all locks held in the system: [ 1599.668201][ T32] locks held by pr/ttyS0/16: 2, last CPU#1: [ 1599.668215][ T32] #0: ffffffff8ec36538 (console_srcu){....}-{0:0}, at: console_srcu_read_lock+0x30/0x60 [ 1599.668271][ T32] #1: ffffffff9ad462d8 (&port_lock_key){-.-.}-{3:3}, at: univ8250_console_device_lock+0x67/0xc0 [ 1599.668405][ T32] locks held by khungtaskd/32: 1, last CPU#0: [ 1599.668418][ T32] #0: ffffffff8ed5c920 (rcu_read_lock){....}-{1:3}, at: debug_show_all_locks+0x2e/0x180 [ 1599.668484][ T32] locks held by getty/5373: 2, on CPU#1: [ 1599.668497][ T32] #0: ffff888035ffc0a0 (&tty->ldisc_sem){++++}-{0:0}, at: tty_ldisc_ref_wait+0x25/0x70 [ 1599.672072][ T32] #1: ffffc9000322b2e8 (&ldata->atomic_read_lock){+.+.}-{4:4}, at: n_tty_read+0x45a/0x1360 [ 1599.672127][ T32] locks held by kworker/1:11/7517: 3, on CPU#1: [ 1599.672142][ T32] #0: ffff88801b06b140 ((wq_completion)events){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 [ 1599.672193][ T32] #1: ffffc900052ffc40 ((work_completion)(&data->fib_event_work)){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 [ 1599.674026][ T32] #2: ffff8880226a6250 (&data->fib_lock){+.+.}-{4:4}, at: nsim_fib_event_work+0x1fd/0x3b0 [ 1599.674780][ T32] locks held by kworker/u8:27/1340: 3, last CPU#0: [ 1599.674796][ T32] #0: ffff88801b0ac140 ((wq_completion)events_unbound){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 [ 1599.674848][ T32] #1: ffffc900034d7c40 ((work_completion)(&(&nsim_dev->trap_data->trap_report_dw)->work)){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 [ 1599.674897][ T32] #2: ffff88802af2c258 (&devlink->lock_key#27){+.+.}-{4:4}, at: nsim_dev_trap_report_work+0x57/0xb40 [ 1599.674959][ T32] locks held by syz.4.12768/15469: 2, on CPU#0: [ 1599.674972][ T32] #0: ffffffff902c5ca8 (cb_lock){++++}-{4:4}, at: genl_rcv+0x19/0x40 [ 1599.675016][ T32] #1: ffffffff8f09f900 (nfsd_mutex){+.+.}-{4:4}, at: nfsd_nl_listener_set_doit+0x53d/0x1ab0 [ 1599.675066][ T32] locks held by syz.3.14315/20692: 2, on CPU#1: [ 1599.675080][ T32] #0: ffffffff902c5ca8 (cb_lock){++++}-{4:4}, at: genl_rcv+0x19/0x40 [ 1599.675136][ T32] #1: ffffffff8f09f900 (nfsd_mutex){+.+.}-{4:4}, at: nfsd_nl_unlock_filesystem_doit+0x2af/0x410 [ 1599.675184][ T32] locks held by syz.2.14379/20937: 2, on CPU#1: [ 1599.676778][ T32] #0: ffffffff902c5ca8 (cb_lock){++++}-{4:4}, at: genl_rcv+0x19/0x40 [ 1599.676828][ T32] #1: ffffffff8f09f900 (nfsd_mutex){+.+.}-{4:4}, at: nfsd_nl_listener_set_doit+0x53d/0x1ab0 [ 1599.676886][ T32] locks held by syz.1.15552/25728: 4, on CPU#0: [ 1599.676899][ T32] #0: ffffffff902c5ca8 (cb_lock){++++}-{4:4}, at: genl_rcv+0x19/0x40 [ 1599.676942][ T32] #1: ffffffff902c5ae0 (genl_mutex){+.+.}-{4:4}, at: genl_rcv_msg+0x10b/0x7a0 [ 1599.676988][ T32] #2: ffff888025fb4140 (&dev->mutex){....}-{4:4}, at: nfc_dev_up+0x3c/0x350 [ 1599.677111][ T32] #3: ffff888054538348 (&ndev->req_lock){+.+.}-{4:4}, at: nci_dev_up+0xa3/0xdc0 [ 1599.677245][ T32] locks held by syz.0.15554/25743: 2, on CPU#1: [ 1599.677259][ T32] #0: ffffffff902c5ca8 (cb_lock){++++}-{4:4}, at: genl_rcv+0x19/0x40 [ 1599.677302][ T32] #1: ffffffff902c5ae0 (genl_mutex){+.+.}-{4:4}, at: genl_rcv_msg+0x10b/0x7a0 [ 1599.677347][ T32] locks held by syz.7.15557/25748: 2, on CPU#0: [ 1599.677361][ T32] #0: ffffffff902c5ca8 (cb_lock){++++}-{4:4}, at: genl_rcv+0x19/0x40 [ 1599.677404][ T32] #1: ffffffff902c5ae0 (genl_mutex){+.+.}-{4:4}, at: genl_rcv_msg+0x10b/0x7a0 [ 1599.678427][ T32] locks held by syz.7.15557/25751: 1, last CPU#0: [ 1599.678441][ T32] #0: ffff88801d3bb6e8 (nlk_cb_mutex-SOCK_DIAG){+.+.}-{4:4}, at: __netlink_dump_start+0xf4/0x7b0 [ 1599.678495][ T32] [ 1599.678501][ T32] ============================================= [ 1599.678501][ T32] [ 1599.678518][ T32] NMI backtrace for cpu 0 [ 1599.678534][ T32] CPU: 0 UID: 0 PID: 32 Comm: khungtaskd Not tainted syzkaller #0 PREEMPT(full) [ 1599.678553][ T32] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 1599.678564][ T32] Call Trace: [ 1599.678573][ T32] [ 1599.678580][ T32] dump_stack_lvl+0xe8/0x150 [ 1599.678608][ T32] nmi_cpu_backtrace+0x274/0x2d0 [ 1599.678627][ T32] ? __pfx_nmi_raise_cpu_backtrace+0x10/0x10 [ 1599.678656][ T32] nmi_trigger_cpumask_backtrace+0x17d/0x390 [ 1599.678678][ T32] sys_info+0x135/0x170 [ 1599.678702][ T32] watchdog+0xfd7/0x1030 [ 1599.678728][ T32] ? watchdog+0x1c7/0x1030 [ 1599.678753][ T32] kthread+0x38b/0x480 [ 1599.678771][ T32] ? __pfx_watchdog+0x10/0x10 [ 1599.678787][ T32] ? __pfx_kthread+0x10/0x10 [ 1599.678806][ T32] ret_from_fork+0x514/0xb70 [ 1599.678827][ T32] ? __pfx_ret_from_fork+0x10/0x10 [ 1599.678844][ T32] ? __switch_to+0xc89/0x1420 [ 1599.678871][ T32] ? __pfx_kthread+0x10/0x10 [ 1599.678890][ T32] ret_from_fork_asm+0x1a/0x30 [ 1599.678932][ T32] [ 1599.678985][ T32] Sending NMI from CPU 0 to CPUs 1: [ 1599.679054][ C1] NMI backtrace for cpu 1 [ 1599.679068][ C1] CPU: 1 UID: 0 PID: 16 Comm: pr/ttyS0 Not tainted syzkaller #0 PREEMPT(full) [ 1599.679089][ C1] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 1599.679101][ C1] RIP: 0010:io_serial_in+0x77/0xc0 [ 1599.679127][ C1] Code: e8 be 9a 54 fc 44 89 f9 d3 e3 49 83 c6 40 4c 89 f0 48 c1 e8 03 42 80 3c 20 00 74 08 4c 89 f7 e8 ff 9e c4 fc 41 03 1e 89 da ec <0f> b6 c0 5b 41 5c 41 5e 41 5f c3 cc cc cc cc cc 44 89 f9 80 e1 07 [ 1599.679143][ C1] RSP: 0018:ffffc900001578b8 EFLAGS: 00000002 [ 1599.679160][ C1] RAX: 1ffffffff35a8c00 RBX: 00000000000003fd RCX: 0000000000000000 [ 1599.679174][ C1] RDX: 00000000000003fd RSI: 0000000000000000 RDI: 0000000000000020 [ 1599.679186][ C1] RBP: dffffc0000000000 R08: 0000000000000003 R09: 0000000000000004 [ 1599.679199][ C1] R10: dffffc0000000000 R11: ffffffff857340f0 R12: dffffc0000000000 [ 1599.679214][ C1] R13: 0000000000000000 R14: ffffffff9ad46300 R15: 0000000000000000 [ 1599.679227][ C1] FS: 0000000000000000(0000) GS:ffff888124dc5000(0000) knlGS:0000000000000000 [ 1599.679243][ C1] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 1599.679257][ C1] CR2: 00002000001e4030 CR3: 000000002589e000 CR4: 00000000003526f0 [ 1599.679274][ C1] Call Trace: [ 1599.679282][ C1] [ 1599.679291][ C1] wait_for_lsr+0x184/0x2f0 [ 1599.679315][ C1] __serial8250_console_fifo_write+0xcd/0x3e0 [ 1599.679348][ C1] serial8250_console_write+0xaa1/0x1200 [ 1599.679369][ C1] ? lockdep_hardirqs_on+0x7b/0x110 [ 1599.679396][ C1] ? __pfx_serial8250_console_write+0x10/0x10 [ 1599.679418][ C1] ? __schedule+0x17f1/0x58f0 [ 1599.679447][ C1] nbcon_emit_next_record+0xef5/0x1a90 [ 1599.679477][ C1] ? __pfx_nbcon_emit_next_record+0x10/0x10 [ 1599.679502][ C1] ? nbcon_context_try_acquire+0x819/0xbd0 [ 1599.679530][ C1] ? _raw_spin_lock_irqsave+0x4c/0x60 [ 1599.679608][ C1] nbcon_kthread_func+0x679/0x880 [ 1599.679632][ C1] ? nbcon_kthread_func+0x163/0x880 [ 1599.679651][ C1] ? __pfx_nbcon_kthread_func+0x10/0x10 [ 1599.679675][ C1] ? __kthread_parkme+0x71/0x1f0 [ 1599.679726][ C1] ? __kthread_parkme+0x199/0x1f0 [ 1599.679757][ C1] kthread+0x38b/0x480 [ 1599.679774][ C1] ? __pfx_nbcon_kthread_func+0x10/0x10 [ 1599.679793][ C1] ? __pfx_kthread+0x10/0x10 [ 1599.679813][ C1] ret_from_fork+0x514/0xb70 [ 1599.679832][ C1] ? __pfx_ret_from_fork+0x10/0x10 [ 1599.679849][ C1] ? __switch_to+0xc89/0x1420 [ 1599.679876][ C1] ? __pfx_kthread+0x10/0x10 [ 1599.679895][ C1] ret_from_fork_asm+0x1a/0x30 [ 1599.679932][ C1] [ 1599.683865][ T32] Kernel panic - not syncing: hung_task: blocked tasks [ 1601.085764][ T32] CPU: 0 UID: 0 PID: 32 Comm: khungtaskd Not tainted syzkaller #0 PREEMPT(full) [ 1601.094877][ T32] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 1601.104938][ T32] Call Trace: [ 1601.108223][ T32] [ 1601.111155][ T32] vpanic+0x56d/0xa60 [ 1601.115149][ T32] ? __pfx___schedule+0x10/0x10 [ 1601.120011][ T32] ? __pfx_vpanic+0x10/0x10 [ 1601.124537][ T32] panic+0xc5/0xd0 [ 1601.128263][ T32] ? __pfx_panic+0x10/0x10 [ 1601.132681][ T32] ? preempt_schedule_common+0x7f/0xd0 [ 1601.138146][ T32] ? preempt_schedule_thunk+0x16/0x40 [ 1601.143525][ T32] ? nmi_trigger_cpumask_backtrace+0x31a/0x390 [ 1601.149686][ T32] ? nmi_trigger_cpumask_backtrace+0x31f/0x390 [ 1601.155844][ T32] watchdog+0x1030/0x1030 [ 1601.160184][ T32] ? watchdog+0x1c7/0x1030 [ 1601.164610][ T32] kthread+0x38b/0x480 [ 1601.168682][ T32] ? __pfx_watchdog+0x10/0x10 [ 1601.173354][ T32] ? __pfx_kthread+0x10/0x10 [ 1601.177949][ T32] ret_from_fork+0x514/0xb70 [ 1601.182546][ T32] ? __pfx_ret_from_fork+0x10/0x10 [ 1601.187655][ T32] ? __switch_to+0xc89/0x1420 [ 1601.192338][ T32] ? __pfx_kthread+0x10/0x10 [ 1601.196929][ T32] ret_from_fork_asm+0x1a/0x30 [ 1601.201719][ T32] [ 1601.205002][ T32] Kernel Offset: disabled [ 1601.209317][ T32] Rebooting in 86400 seconds..