last executing test programs: 8m13.353359381s ago: executing program 4 (id=3263): r0 = socket$inet6(0xa, 0x1, 0x0) setsockopt$inet6_buf(r0, 0x29, 0x39, &(0x7f0000000cc0)="0022040000ffffebfffffffeffffff0700000000ff000207835eeb1317b208feefaf234b4ff8b4cc4c39bdc8451792b903f4b7d8c8cf2153622652328c19ef68234f905557c4070000008735e9ab2f77c62e0a5cdd2cf9984c070400000000000003ff23353d8b2fc6a3ae1ebfcb49004a3ccd3560ae01010000079c60ed7449b842f3e253be8a62b37f820fe75a9ea937ea4efbfb9b4a128f2dbe2837496d00ad7765abaac2ec0f91c88a1ea1ff6ee308c72febedcf00798d41991ac25bb6fce2220c25ea380c7e112ab358c3a6bd8a59c100000001b4e82cb03419544a3988bc226a85abe6eb60cd7cf8d103d38c31c7c86d16c4d86cbe4ab190c092d077ce70590fbbd4f8bf4d6ab1cea6dbe9d4a54c17aac0db6e3845", 0x118) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket$inet6_udp(0xa, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000c80)={'lo\x00', 0x0}) sendmsg$nl_route_sched(r1, &(0x7f0000001200)={0x0, 0xfffffffffffffff5, &(0x7f0000000000)={&(0x7f00000002c0)=@newqdisc={0x48, 0x24, 0x4ee4e6a52ff56541, 0x0, 0x0, {0x0, 0x0, 0x0, r3, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_fq={{0x7}, {0x1c, 0x2, [@TCA_FQ_FLOW_DEFAULT_RATE={0x18, 0x10, 0x3}, @TCA_FQ_FLOW_MAX_RATE={0xffffffffffffff01, 0x2}, @TCA_FQ_PLIMIT={0x0, 0x1, 0x5}]}}]}, 0x48}}, 0x0) connect$inet6(r0, &(0x7f0000000000)={0xa, 0x4e24, 0x5, @loopback, 0xa}, 0x1c) 8m12.34515649s ago: executing program 4 (id=3269): r0 = socket$inet6(0xa, 0x2, 0x0) setsockopt$inet6_IPV6_XFRM_POLICY(r0, 0x29, 0x23, &(0x7f00000004c0)={{{@in=@remote, @in=@broadcast, 0x0, 0x0, 0x0, 0x0, 0xa, 0x0, 0x20}, {}, {0x0, 0x9}}, {{@in6=@mcast2, 0x0, 0x2b}, 0x0, @in=@empty}}, 0xe8) r1 = socket$key(0xf, 0x3, 0x2) setsockopt$sock_int(r1, 0x1, 0x8, &(0x7f00000001c0), 0x4) sendmsg$key(r1, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000005c0)=ANY=[@ANYBLOB="020b000102"], 0x10}}, 0x0) sendmsg$key(r1, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000240)=ANY=[], 0x10}}, 0x40) write(0xca, &(0x7f0000000040)="040e0c", 0x3) sendmsg$nl_generic(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000000c0)=ANY=[@ANYBLOB="1400000015000103"], 0x14}}, 0x0) socketpair(0xf, 0x3, 0x2, &(0x7f00000001c0)) r2 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000240)={0x11, 0x3, &(0x7f0000000040)=ANY=[@ANYBLOB="1800000000000000000000000000000095"], &(0x7f0000000000)='GPL\x00', 0x3}, 0x90) bpf$BPF_GET_PROG_INFO(0xf, &(0x7f0000000680)={r2, 0x143, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, ""/16, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xc7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0}}, 0x10) r3 = socket(0x200000000000011, 0x2, 0x0) r4 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route(r4, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000001140)={&(0x7f0000000140)=@newlink={0x3c, 0x10, 0x503, 0xfffffffc, 0x0, {0x0, 0x0, 0x0, 0x0, 0x21111, 0x8831}, [@IFLA_LINKINFO={0x1c, 0x12, 0x0, 0x1, @macsec={{0xb}, {0xc, 0x2, 0x0, 0x1, [@IFLA_MACSEC_ICV_LEN={0x5, 0x3, 0x10}]}}}]}, 0x3c}, 0x1, 0x0, 0x0, 0x48890}, 0x4000) connect$packet(r3, 0x0, 0x0) close(r0) socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000000c0)=ANY=[], 0xb8}}, 0x0) 8m11.851198098s ago: executing program 4 (id=3270): r0 = socket$inet(0x2, 0x2, 0x1) sendmsg$inet(r0, &(0x7f0000000080)={&(0x7f0000000000)={0x2, 0x0, @multicast2}, 0x10, &(0x7f0000000240)=[{&(0x7f0000000400)='\b\x00', 0x2}, {&(0x7f0000000180)="96bc1480bb58", 0xfcbe}], 0x2, &(0x7f0000000040)=[@ip_tos_u8={{0x11, 0x0, 0x7}}, @ip_pktinfo={{0x1c, 0x0, 0x8, {0x0, @local, @loopback}}}], 0x38}, 0x40010) socket$key(0xf, 0x3, 0x2) socket$inet(0x2, 0x2, 0x1) (async) sendmsg$inet(r0, &(0x7f0000000080)={&(0x7f0000000000)={0x2, 0x0, @multicast2}, 0x10, &(0x7f0000000240)=[{&(0x7f0000000400)='\b\x00', 0x2}, {&(0x7f0000000180)="96bc1480bb58", 0xfcbe}], 0x2, &(0x7f0000000040)=[@ip_tos_u8={{0x11, 0x0, 0x7}}, @ip_pktinfo={{0x1c, 0x0, 0x8, {0x0, @local, @loopback}}}], 0x38}, 0x40010) (async) socket$key(0xf, 0x3, 0x2) (async) 8m11.603881879s ago: executing program 4 (id=3272): socket$nl_route(0x10, 0x3, 0x0) (async) r0 = socket$nl_route(0x10, 0x3, 0x0) socket$packet(0x11, 0x2, 0x300) (async) r1 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_fanout(r1, 0x107, 0x12, &(0x7f0000000040)={0x0, 0x6}, 0x4) (async) setsockopt$packet_fanout(r1, 0x107, 0x12, &(0x7f0000000040)={0x0, 0x6}, 0x4) mmap(&(0x7f0000000000/0x400000)=nil, 0x400000, 0xb, 0xc3072, 0xffffffffffffffff, 0x4000) bpf$PROG_LOAD(0x5, &(0x7f0000002400)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x1, 0x0, &(0x7f0000002680)=[{0x0, 0x2}]}, 0x90) r2 = bpf$BPF_BTF_LOAD(0x12, &(0x7f0000001280)={&(0x7f00000000c0)=ANY=[@ANYBLOB="9feb010018000000000000000c0000000c000000020000000000000000000004"], 0x0, 0x26}, 0x20) bpf$BPF_GET_MAP_INFO(0xf, &(0x7f0000000080)={r2, 0x86, &(0x7f0000002600)}, 0x10) (async) bpf$BPF_GET_MAP_INFO(0xf, &(0x7f0000000080)={r2, 0x86, &(0x7f0000002600)}, 0x10) setsockopt$packet_fanout_data(r1, 0x107, 0x16, &(0x7f0000000100)={0x0, 0x0}, 0x10) (async) setsockopt$packet_fanout_data(r1, 0x107, 0x16, &(0x7f0000000100)={0x0, 0x0}, 0x10) socket$inet6_udp(0xa, 0x2, 0x0) (async) r3 = socket$inet6_udp(0xa, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000c80)={'lo\x00', 0x0}) r5 = socket$nl_generic(0x10, 0x3, 0x10) r6 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000740), 0xffffffffffffffff) r7 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r7, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7001}) r8 = socket$nl_route(0x10, 0x3, 0x0) r9 = socket$unix(0x1, 0x1, 0x0) r10 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r10, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000400)={&(0x7f0000000440)=ANY=[@ANYBLOB="d40000001b000301000000000000000000000000000000000000000000000000e000000100"/64, @ANYRES32=0x0, @ANYRES32=0xee00, @ANYBLOB="0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000a0010008a"], 0xd4}}, 0x0) ioctl$sock_SIOCGIFINDEX(r9, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_generic(0xffffffffffffffff, 0x0, 0x8010) sendmsg$nl_route_sched(r8, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000140)=@newqdisc={0x44, 0x24, 0x601, 0x0, 0x0, {0x0, 0x0, 0x0, r11, {0x0, 0x1}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_hfsc={{0x9}, {0x14, 0x2, @TCA_HFSC_FSC={0x10, 0x2, {0x0, 0x0, 0x3e8}}}}]}, 0x44}, 0x1, 0x0, 0x0, 0x4000081}, 0x84) sendmsg$nl_route_sched(r8, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000300)=@newtclass={0x44, 0x28, 0x601, 0x0, 0x0, {0x0, 0x0, 0x0, r11, {0x4, 0x1}, {0x0, 0x1}}, [@tclass_kind_options=@c_hfsc={{0x9}, {0x14, 0x2, [@TCA_HFSC_FSC={0x10, 0x2, {0x0, 0x0, 0x3e8}}]}}]}, 0x44}, 0x1, 0x0, 0x0, 0x4000000}, 0x0) sendmsg$nl_route_sched(r8, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000300)={&(0x7f00000008c0)=@newtfilter={0x40, 0x2c, 0x601, 0x0, 0x0, {0x0, 0x0, 0x0, r11, {}, {0x0, 0x1}, {0x300, 0x1}}, [@filter_kind_options=@f_matchall={{0xd}, {0xc, 0x2, [@TCA_MATCHALL_CLASSID={0x8, 0x1, {0xffff, 0x1}}]}}]}, 0x40}}, 0x0) (async) sendmsg$nl_route_sched(r8, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000300)={&(0x7f00000008c0)=@newtfilter={0x40, 0x2c, 0x601, 0x0, 0x0, {0x0, 0x0, 0x0, r11, {}, {0x0, 0x1}, {0x300, 0x1}}, [@filter_kind_options=@f_matchall={{0xd}, {0xc, 0x2, [@TCA_MATCHALL_CLASSID={0x8, 0x1, {0xffff, 0x1}}]}}]}, 0x40}}, 0x0) r12 = socket$inet(0x2, 0x2, 0x0) ioctl$sock_inet_SIOCSIFFLAGS(r12, 0x8914, &(0x7f0000000400)={'syzkaller0\x00', 0x1}) (async) ioctl$sock_inet_SIOCSIFFLAGS(r12, 0x8914, &(0x7f0000000400)={'syzkaller0\x00', 0x1}) r13 = socket$packet(0x11, 0x3, 0x300) bind$packet(r13, &(0x7f0000000500)={0x11, 0x0, r11}, 0x14) sendto(r13, &(0x7f0000000600)='\x00', 0x1, 0x0, 0x0, 0x0) (async) sendto(r13, &(0x7f0000000600)='\x00', 0x1, 0x0, 0x0, 0x0) sendmsg$TIPC_NL_UDP_GET_REMOTEIP(r5, &(0x7f00000001c0)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000900)=ANY=[@ANYBLOB='(\x00\x00\x00', @ANYRES16=r6, @ANYBLOB="ffffffff000000005219e8bffaa270431fcfb3272b0026a50000b7adf8a97676f786c714000180100001006574683a696036755a87124d5b2b540a3e385f908a284e428e5249ec32e40445a942f1ec1d49a9da2c464dbab15916848172e42af7ec3ff8bc890027136510f0415b7118b5fb4afff13ec79f0dc49c32fee468fb4ba7d27cee30cfad384024b85208617467a541fcf1f4c72641cf269f469b02df2553f5a1e6271fc525ac88c5c7d23c0440e8ec4f32400f4f9e293c6658cef280ead6caf0fbce09b7cbbeb83598a89a8a311007ccc2b39562d0ba9b2a074d8214e5b3b6b4e7227b1f2f2ee3ffffffffffffff7fdc7e0293a19f327ee85c126df6cd0fe9dcf75bea1d8ad9a529c967ba73af02cf1a88df4a1ef8bc4d0a14587d8b9d49e17ffe76019efc197cb9612a564b26fc872af717a12ead7e7b94089f3f70907f697b25f5dd94d65f4af40d089eaf0729c9d610a5eb629309f4e7c600b56b8819e29b3305d4a382bb5853f9b604dfb19d1752fbec00667bdba80fa0f03557a521e7749acffc990d70c7ee905ddbf8acf13f59e6f808fafa4187f7729734d728545e209e36567bd69748854b6cccf40ad9f1ebaacb2775409eb7d013978ee9d0102be6d4601803e3b1dcdfff3ed8e70b0042b2f9f1ee3046d16543bb5ad0553be87dd27f88038530d0d58c9e3ce0ab4212bfbd288cd5c941c220fa370beb35130c3a02afbda30336297e4576ff6aa91d3dfddbe3c480c5ad23dfc28d2000"/557], 0x28}}, 0x4000000) (async) sendmsg$TIPC_NL_UDP_GET_REMOTEIP(r5, &(0x7f00000001c0)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000900)=ANY=[@ANYBLOB='(\x00\x00\x00', @ANYRES16=r6, @ANYBLOB="ffffffff000000005219e8bffaa270431fcfb3272b0026a50000b7adf8a97676f786c714000180100001006574683a696036755a87124d5b2b540a3e385f908a284e428e5249ec32e40445a942f1ec1d49a9da2c464dbab15916848172e42af7ec3ff8bc890027136510f0415b7118b5fb4afff13ec79f0dc49c32fee468fb4ba7d27cee30cfad384024b85208617467a541fcf1f4c72641cf269f469b02df2553f5a1e6271fc525ac88c5c7d23c0440e8ec4f32400f4f9e293c6658cef280ead6caf0fbce09b7cbbeb83598a89a8a311007ccc2b39562d0ba9b2a074d8214e5b3b6b4e7227b1f2f2ee3ffffffffffffff7fdc7e0293a19f327ee85c126df6cd0fe9dcf75bea1d8ad9a529c967ba73af02cf1a88df4a1ef8bc4d0a14587d8b9d49e17ffe76019efc197cb9612a564b26fc872af717a12ead7e7b94089f3f70907f697b25f5dd94d65f4af40d089eaf0729c9d610a5eb629309f4e7c600b56b8819e29b3305d4a382bb5853f9b604dfb19d1752fbec00667bdba80fa0f03557a521e7749acffc990d70c7ee905ddbf8acf13f59e6f808fafa4187f7729734d728545e209e36567bd69748854b6cccf40ad9f1ebaacb2775409eb7d013978ee9d0102be6d4601803e3b1dcdfff3ed8e70b0042b2f9f1ee3046d16543bb5ad0553be87dd27f88038530d0d58c9e3ce0ab4212bfbd288cd5c941c220fa370beb35130c3a02afbda30336297e4576ff6aa91d3dfddbe3c480c5ad23dfc28d2000"/557], 0x28}}, 0x4000000) sendmsg$nl_route_sched(r0, &(0x7f0000001200)={0x0, 0xfffffffffffffff5, &(0x7f0000000000)={&(0x7f00000002c0)=@newqdisc={0x48, 0x24, 0x4ee4e6a52ff56541, 0x0, 0x0, {0x0, 0x0, 0x0, r4, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_fq={{0x7}, {0x1c, 0x2, [@TCA_FQ_FLOW_DEFAULT_RATE={0x18, 0x10, 0x3}, @TCA_FQ_PLIMIT={0x0, 0x1, 0x6}, @TCA_FQ_PLIMIT={0x0, 0x1, 0x5}]}}]}, 0x48}}, 0x0) 8m11.170495815s ago: executing program 4 (id=3274): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000a00)=ANY=[@ANYBLOB="140000001000010000000000000000000200000a20000000000a01080000000000000000020000000900010073797a300000000064000000090a010400000000000000000200000008000a40000000010900020073797a31000000000900010073797a300000000008000540000000080800034000000084200009801c0002800c00018008000140000000010c0001800800014000000004440000000c0a01010000000000000000020000000900020073797a31000000000900010073797a30000000001800038014000080100001800c0001"], 0xf0}}, 0x0) (async) r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000014c0)=ANY=[@ANYBLOB="d40000001000010400400000000000000000ffff", @ANYRES32=0x0, @ANYBLOB="0891040000000000a000128009000100766c616e000000009000028006000100030000000c0002001a000000010000001c0004800c0001005fe7fd35ffffff7f0c00010004000000070000001c0004800c0001000100008057010000000000000000ffff06000000400003800c000100ffff0000070000000c0001000100000030636a5e0c00010001000000040200000c0001000100000009000000bdfd0100100000000000800014000300766c616e30"], 0xd4}, 0x1, 0x0, 0x0, 0x40000}, 0x0) (async) sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000300)=@flushpolicy={0x10, 0x12, 0x105, 0x6, 0x25dfdbff}, 0x10}}, 0x20040840) (async) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r2, &(0x7f0000000080)={0xa, 0x2, 0x200, @loopback, 0x7}, 0x1c) (async) setsockopt$inet6_tcp_int(r2, 0x6, 0x2000000000000022, &(0x7f0000000200)=0x1, 0x4) (async) sendto$inet6(r2, &(0x7f00000003c0)="a6", 0x1, 0x24000045, &(0x7f00000001c0)={0xa, 0x2, 0xffff, @loopback, 0x9}, 0x1c) setsockopt$inet6_tcp_TCP_CONGESTION(r2, 0x6, 0xd, &(0x7f00000002c0)='htcp', 0x4) (async) shutdown(r2, 0x1) (async) syz_emit_ethernet(0x3a, &(0x7f00000030c0)=ANY=[@ANYBLOB="0180c20067f6b5b11b5811a6843eff0000aaaab35a36855fbcb0ff002c00000002001190780000fef500780400000005"], 0x0) 8m10.811498459s ago: executing program 4 (id=3276): sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000000)=ANY=[@ANYBLOB="240000002100010000000000000000000a0000200000000000000000050019"], 0x24}, 0x1, 0x0, 0x0, 0x4008000}, 0x20000000) (async) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000440)) (async) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='memory.swap.events\x00', 0x275a, 0x0) (async) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000001c0)={0xffffffffffffffff}) (async) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='memory.swap.events\x00', 0x275a, 0x0) setsockopt$sock_attach_bpf(r1, 0x1, 0x41, &(0x7f0000000100)=r2, 0x8) (async) setsockopt$sock_attach_bpf(r1, 0x1, 0x25, &(0x7f0000000100)=r0, 0x4) sendto$inet6(0xffffffffffffffff, &(0x7f0000000000)="9000000020", 0x5, 0x0, 0x0, 0x0) r3 = socket$inet6(0x10, 0x3, 0x0) sendto$inet6(r3, &(0x7f0000000000)='.', 0x10a73, 0x800, 0x0, 0x4b6ae4f95a5de35b) (async) r4 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f00000001c0)="d80000001e0081054e81f782060000000000000006007c095dd2466518000e800a00142603600e1208000f0000000406a80016c00800094013000000035c0461c1d67f6f94007134cf6efb8007a290457f0189b316277ce06bbace8017cbec4c2ee5a7cef4090000001fb791433a5ee4ce1b14d6d930dfe1d9d33dfe7c9f8775730d16a4683f5aeb4edbb57a5025ccca9e00360db798262f3d40fad95667e006dcdf63951f215ce3bb9ad909d5e1cace81ed0bffece0b42a9eca0200e6ccd40dd6e4edef3d93452a92954b43370e9703920723f9a9410000", 0xd8}], 0x1}, 0x8084) (async) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f00000000c0)={{0x1, 0xffffffffffffffff}, &(0x7f0000000040), &(0x7f0000000080)}, 0x20) (async) r6 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000040)='cpuacct.usage_sys\x00', 0x275a, 0x0) mmap(&(0x7f0000000000/0x400000)=nil, 0x400000, 0x0, 0x10012, r6, 0x0) (async) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(0xffffffffffffffff, 0x89f0, &(0x7f0000000580)={'syztnl2\x00', &(0x7f00000004c0)={'ip_vti0\x00', 0x0, 0x8000, 0x8000, 0x7, 0x2, {{0x1d, 0x4, 0x3, 0x4, 0x74, 0x68, 0x0, 0xba, 0x29, 0x0, @loopback, @multicast2, {[@timestamp={0x44, 0x28, 0xc7, 0x0, 0x9, [0x3, 0x6fab77a6, 0x2, 0x7ff, 0x8, 0x8, 0x9, 0x7, 0xba]}, @generic={0x88, 0xe, "a879baf7ccc9e310c17fd8f7"}, @rr={0x7, 0x1b, 0x13, [@private=0xa010101, @multicast2, @broadcast, @broadcast, @empty, @local]}, @timestamp_addr={0x44, 0xc, 0x87, 0x1, 0x8, [{@loopback, 0x101}]}]}}}}}) r8 = bpf$MAP_CREATE(0x0, &(0x7f0000000200)=@base={0x1, 0x9, 0x3, 0xc4f, 0x1, 0x1}, 0x50) bpf$MAP_UPDATE_BATCH(0x1a, &(0x7f0000000680)={0x0, 0x0, &(0x7f0000000100), &(0x7f0000000100), 0x6c7, r8, 0x0, 0x200000000000000}, 0x38) bpf$BPF_MAP_CONST_STR_FREEZE(0x16, &(0x7f0000000640)={0x1, 0xffffffffffffffff}, 0x4) (async) ioctl$FS_IOC_FIEMAP(r8, 0xc020660b, &(0x7f0000000a00)={0x2, 0x9, 0x3, 0x9, 0x2, 0x0, [{0x8, 0x11, 0x3, '\x00', 0x3001}, {0xffffffffffff4609, 0x2, 0xffff, '\x00', 0xa08}]}) (async) r10 = bpf$OBJ_GET_MAP(0x7, &(0x7f00000006c0)=@o_path={&(0x7f0000000140)='./file0\x00', 0x0, 0x18, r5}, 0x18) r11 = bpf$MAP_CREATE(0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="0100000009000000030000004f8c000001000000", @ANYRES32=0x1, @ANYBLOB='\x00'/20, @ANYRES32=0x0, @ANYRES32, @ANYBLOB='\x00'/28], 0x50) bpf$MAP_UPDATE_BATCH(0x1a, &(0x7f0000000680)={0x0, 0x0, &(0x7f0000000100), &(0x7f0000000900)="bc835e1ba1a0aabe2c9d7f8442b4cc0800000000000000968a94243d77924a6c745ab18caa9e7570e52db0864760a8392db1f5de4db964247c87072e670edbd44754ec5e96ca72714b40136bb7b51dbe8f9fc58e3d7e0496a9376ca4104c7d95824159371a4916b0dd3880298de11d9f605e97bcb87bcfe644ace693224e7505ec04e88aecb9677ddf548148dedd802747c0efa9d6632dad49b9e800faecd74b0300c93c4589cd7ef95d85522eeede5b876006254264621a453165517f33450aa03b6b29dc54d3d2930c414411ec73", 0x40007ff, r8, 0x0, 0x200000000000000}, 0x38) (async) bpf$MAP_UPDATE_CONST_STR(0x2, &(0x7f0000000780)={{0x1, 0xffffffffffffffff}, &(0x7f0000000700), &(0x7f0000000740)='%-5lx \x00'}, 0x20) bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0xa, 0x4, &(0x7f0000000040)=@framed={{}, [@ldst={0x3, 0x0, 0x3, 0x1, 0x0, 0x20}]}, &(0x7f0000000140)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) (async) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000840)={0x18, 0x1e, &(0x7f00000002c0)=ANY=[@ANYBLOB="18200000070000cbfc6e0000000000ae41d46eca", @ANYRES32=r4, @ANYBLOB="0000000000000000b702000014000000b7030000000000008500000083000000bf0900000000000055090100000000009500000000000000852000000500000035351800f0ffffff18110000", @ANYRES32=r5, @ANYBLOB="0000000000000000b702000000000000850000008600000018110000", @ANYRES32=r6, @ANYBLOB="0000000000000000b7080000040000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b7040000000000008500000082000000bf91000000000000b7020000000000008500000085000000b7000000000000009500000000000000"], &(0x7f00000003c0)='GPL\x00', 0x9, 0xb2, &(0x7f0000000400)=""/178, 0x40f00, 0x2, '\x00', r7, 0x0, r4, 0x8, &(0x7f00000005c0)={0x6, 0x4}, 0x8, 0x10, &(0x7f0000000600)={0x1, 0x1, 0x8000, 0x9}, 0x10, 0x0, 0x0, 0x3, &(0x7f00000007c0)=[r8, r9, r10, r11, r12], &(0x7f0000000800)=[{0x4, 0x5, 0x7, 0x5}, {0x4, 0x1, 0x9, 0xa}, {0x1, 0x5, 0x6, 0x2}], 0x10, 0x9}, 0x94) 7m55.766277282s ago: executing program 32 (id=3276): sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000000)=ANY=[@ANYBLOB="240000002100010000000000000000000a0000200000000000000000050019"], 0x24}, 0x1, 0x0, 0x0, 0x4008000}, 0x20000000) (async) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000440)) (async) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='memory.swap.events\x00', 0x275a, 0x0) (async) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000001c0)={0xffffffffffffffff}) (async) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='memory.swap.events\x00', 0x275a, 0x0) setsockopt$sock_attach_bpf(r1, 0x1, 0x41, &(0x7f0000000100)=r2, 0x8) (async) setsockopt$sock_attach_bpf(r1, 0x1, 0x25, &(0x7f0000000100)=r0, 0x4) sendto$inet6(0xffffffffffffffff, &(0x7f0000000000)="9000000020", 0x5, 0x0, 0x0, 0x0) r3 = socket$inet6(0x10, 0x3, 0x0) sendto$inet6(r3, &(0x7f0000000000)='.', 0x10a73, 0x800, 0x0, 0x4b6ae4f95a5de35b) (async) r4 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f00000001c0)="d80000001e0081054e81f782060000000000000006007c095dd2466518000e800a00142603600e1208000f0000000406a80016c00800094013000000035c0461c1d67f6f94007134cf6efb8007a290457f0189b316277ce06bbace8017cbec4c2ee5a7cef4090000001fb791433a5ee4ce1b14d6d930dfe1d9d33dfe7c9f8775730d16a4683f5aeb4edbb57a5025ccca9e00360db798262f3d40fad95667e006dcdf63951f215ce3bb9ad909d5e1cace81ed0bffece0b42a9eca0200e6ccd40dd6e4edef3d93452a92954b43370e9703920723f9a9410000", 0xd8}], 0x1}, 0x8084) (async) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f00000000c0)={{0x1, 0xffffffffffffffff}, &(0x7f0000000040), &(0x7f0000000080)}, 0x20) (async) r6 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000040)='cpuacct.usage_sys\x00', 0x275a, 0x0) mmap(&(0x7f0000000000/0x400000)=nil, 0x400000, 0x0, 0x10012, r6, 0x0) (async) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(0xffffffffffffffff, 0x89f0, &(0x7f0000000580)={'syztnl2\x00', &(0x7f00000004c0)={'ip_vti0\x00', 0x0, 0x8000, 0x8000, 0x7, 0x2, {{0x1d, 0x4, 0x3, 0x4, 0x74, 0x68, 0x0, 0xba, 0x29, 0x0, @loopback, @multicast2, {[@timestamp={0x44, 0x28, 0xc7, 0x0, 0x9, [0x3, 0x6fab77a6, 0x2, 0x7ff, 0x8, 0x8, 0x9, 0x7, 0xba]}, @generic={0x88, 0xe, "a879baf7ccc9e310c17fd8f7"}, @rr={0x7, 0x1b, 0x13, [@private=0xa010101, @multicast2, @broadcast, @broadcast, @empty, @local]}, @timestamp_addr={0x44, 0xc, 0x87, 0x1, 0x8, [{@loopback, 0x101}]}]}}}}}) r8 = bpf$MAP_CREATE(0x0, &(0x7f0000000200)=@base={0x1, 0x9, 0x3, 0xc4f, 0x1, 0x1}, 0x50) bpf$MAP_UPDATE_BATCH(0x1a, &(0x7f0000000680)={0x0, 0x0, &(0x7f0000000100), &(0x7f0000000100), 0x6c7, r8, 0x0, 0x200000000000000}, 0x38) bpf$BPF_MAP_CONST_STR_FREEZE(0x16, &(0x7f0000000640)={0x1, 0xffffffffffffffff}, 0x4) (async) ioctl$FS_IOC_FIEMAP(r8, 0xc020660b, &(0x7f0000000a00)={0x2, 0x9, 0x3, 0x9, 0x2, 0x0, [{0x8, 0x11, 0x3, '\x00', 0x3001}, {0xffffffffffff4609, 0x2, 0xffff, '\x00', 0xa08}]}) (async) r10 = bpf$OBJ_GET_MAP(0x7, &(0x7f00000006c0)=@o_path={&(0x7f0000000140)='./file0\x00', 0x0, 0x18, r5}, 0x18) r11 = bpf$MAP_CREATE(0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="0100000009000000030000004f8c000001000000", @ANYRES32=0x1, @ANYBLOB='\x00'/20, @ANYRES32=0x0, @ANYRES32, @ANYBLOB='\x00'/28], 0x50) bpf$MAP_UPDATE_BATCH(0x1a, &(0x7f0000000680)={0x0, 0x0, &(0x7f0000000100), &(0x7f0000000900)="bc835e1ba1a0aabe2c9d7f8442b4cc0800000000000000968a94243d77924a6c745ab18caa9e7570e52db0864760a8392db1f5de4db964247c87072e670edbd44754ec5e96ca72714b40136bb7b51dbe8f9fc58e3d7e0496a9376ca4104c7d95824159371a4916b0dd3880298de11d9f605e97bcb87bcfe644ace693224e7505ec04e88aecb9677ddf548148dedd802747c0efa9d6632dad49b9e800faecd74b0300c93c4589cd7ef95d85522eeede5b876006254264621a453165517f33450aa03b6b29dc54d3d2930c414411ec73", 0x40007ff, r8, 0x0, 0x200000000000000}, 0x38) (async) bpf$MAP_UPDATE_CONST_STR(0x2, &(0x7f0000000780)={{0x1, 0xffffffffffffffff}, &(0x7f0000000700), &(0x7f0000000740)='%-5lx \x00'}, 0x20) bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0xa, 0x4, &(0x7f0000000040)=@framed={{}, [@ldst={0x3, 0x0, 0x3, 0x1, 0x0, 0x20}]}, &(0x7f0000000140)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) (async) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000840)={0x18, 0x1e, &(0x7f00000002c0)=ANY=[@ANYBLOB="18200000070000cbfc6e0000000000ae41d46eca", @ANYRES32=r4, @ANYBLOB="0000000000000000b702000014000000b7030000000000008500000083000000bf0900000000000055090100000000009500000000000000852000000500000035351800f0ffffff18110000", @ANYRES32=r5, @ANYBLOB="0000000000000000b702000000000000850000008600000018110000", @ANYRES32=r6, @ANYBLOB="0000000000000000b7080000040000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b7040000000000008500000082000000bf91000000000000b7020000000000008500000085000000b7000000000000009500000000000000"], &(0x7f00000003c0)='GPL\x00', 0x9, 0xb2, &(0x7f0000000400)=""/178, 0x40f00, 0x2, '\x00', r7, 0x0, r4, 0x8, &(0x7f00000005c0)={0x6, 0x4}, 0x8, 0x10, &(0x7f0000000600)={0x1, 0x1, 0x8000, 0x9}, 0x10, 0x0, 0x0, 0x3, &(0x7f00000007c0)=[r8, r9, r10, r11, r12], &(0x7f0000000800)=[{0x4, 0x5, 0x7, 0x5}, {0x4, 0x1, 0x9, 0xa}, {0x1, 0x5, 0x6, 0x2}], 0x10, 0x9}, 0x94) 3.339422408s ago: executing program 2 (id=8056): r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$inet6_sctp(0xa, 0x801, 0x84) r2 = socket$inet6_sctp(0xa, 0x5, 0x84) shutdown(r2, 0x0) close(0x3) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r2, 0x84, 0x6f, &(0x7f0000000200)={0x0, 0x10, &(0x7f00000001c0)=[@in={0x2, 0x4e23, @rand_addr=0x64010100}]}, &(0x7f0000000140)=0x10) getsockopt$inet_sctp6_SCTP_PRIMARY_ADDR(r2, 0x84, 0x7a, &(0x7f0000000440)={r3, @in={{0x2, 0x4e23, @empty}}}, &(0x7f0000000040)=0x84) getsockopt$inet_sctp6_SCTP_PEER_ADDR_THLDS(r1, 0x84, 0x85, &(0x7f0000000040)={0x0, @in6={{0xa, 0x4e23, 0x5, @mcast1, 0x9}}}, &(0x7f0000000300)=0x90) r4 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r4, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0xca02}) r5 = socket$netlink(0x10, 0x3, 0x0) r6 = socket$packet(0x11, 0x3, 0x300) r7 = socket$inet_mptcp(0x2, 0x1, 0x106) ioctl$sock_inet_SIOCSARP(r7, 0x8955, &(0x7f0000000240)={{0x2, 0x4e24, @multicast2}, {0x0, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x3b}}, 0x6, {0x2, 0x4e20, @local}, 'bridge0\x00'}) setsockopt$packet_int(r6, 0x107, 0xa, &(0x7f0000000080)=0x2, 0x4) mmap(&(0x7f0000000000/0xc00000)=nil, 0xc00000, 0x0, 0x42073, 0xffffffffffffffff, 0x0) setsockopt$packet_rx_ring(r6, 0x107, 0x5, &(0x7f0000000040)=@req3={0x1000, 0x3a, 0x1000, 0x3a, 0x9, 0x0, 0xffffffff}, 0x1c) r8 = epoll_create(0x2) epoll_ctl$EPOLL_CTL_ADD(r8, 0x1, r4, &(0x7f0000000340)={0x2}) syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0) r9 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r9, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000c40)=ANY=[@ANYBLOB="881200002f00090027bd7000fbdbdf25040000006c121880"], 0x1288}, 0x1, 0x0, 0x0, 0x42014}, 0x4088010) r10 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r11 = syz_genetlink_get_family_id$nfc(&(0x7f0000000d00), r10) sendmsg$NFC_CMD_ACTIVATE_TARGET(r10, &(0x7f0000000dc0)={0x0, 0x0, &(0x7f0000000d80)={&(0x7f0000000d40)={0x14, r11, 0x1, 0x70bd26, 0x25dfdbfd}, 0x14}, 0x1, 0x0, 0x0, 0x4014}, 0x410) r12 = socket$inet6(0xa, 0x1, 0x0) setsockopt$inet6_int(r12, 0x29, 0x18, &(0x7f0000000100)=0xff, 0x4) ioctl$SIOCSIFHWADDR(r5, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x2}}) sendmsg$nl_route(r0, &(0x7f00000006c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000000)=ANY=[@ANYBLOB="3c00000010000d0426ffffff0000000000000000", @ANYRES32=0x0, @ANYBLOB="cb840400000000001c00128009000100626f6e64000000000c00028008000f00ff7f0000"], 0x3c}}, 0x0) 3.155026848s ago: executing program 3 (id=8059): r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl802154(&(0x7f0000000080), 0xffffffffffffffff) (async) r1 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000080), 0xffffffffffffffff) r2 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r3 = bpf$MAP_CREATE(0x0, &(0x7f0000000b00)=ANY=[@ANYBLOB="1b00000000000000000000000080"], 0x50) bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x1, 0xa, &(0x7f0000000200)=ANY=[@ANYBLOB="18110000", @ANYRES32=r3, @ANYBLOB="0000000000000000b7080000020000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000001000500850000008200000095"], &(0x7f0000000380)='syzkaller\x00', 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) (async) r4 = bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x1, 0xa, &(0x7f0000000200)=ANY=[@ANYBLOB="18110000", @ANYRES32=r3, @ANYBLOB="0000000000000000b7080000020000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000001000500850000008200000095"], &(0x7f0000000380)='syzkaller\x00', 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_LINK_CREATE_XDP(0x25, &(0x7f00000002c0)={r4, 0x0, 0x25, 0x12, @val=@tcx={@void, @value=r4}}, 0x1c) ioctl$sock_SIOCGIFINDEX_802154(r2, 0x8933, &(0x7f0000000000)={'wpan0\x00'}) (async) ioctl$sock_SIOCGIFINDEX_802154(r2, 0x8933, &(0x7f0000000000)={'wpan0\x00', 0x0}) sendmsg$NL802154_CMD_DEL_SEC_DEVKEY(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f00000000c0)={0x54, r1, 0x1, 0x70bd28, 0x25dfdbfb, {}, [@NL802154_ATTR_IFINDEX={0x8, 0x3, r5}, @NL802154_ATTR_SEC_DEVKEY={0x2c, 0x2f, 0x0, 0x1, [@NL802154_DEVKEY_ATTR_EXTENDED_ADDR={0xc, 0x2, {0xaaaaaaaaaaaa0202}}, @NL802154_DEVKEY_ATTR_ID={0x1c, 0x3, 0x0, 0x1, [@NL802154_KEY_ID_ATTR_SOURCE_SHORT={0x8, 0x4, 0x9}, @NL802154_KEY_ID_ATTR_INDEX={0x5, 0x2, 0x2}, @NL802154_KEY_ID_ATTR_MODE={0x8, 0x1, 0x2}]}]}, @NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x2}]}, 0x54}, 0x1, 0x0, 0x0, 0x4}, 0x20000080) r6 = bpf$MAP_CREATE(0x0, &(0x7f00000004c0)=@base={0x2, 0x4, 0x4, 0x9}, 0x48) r7 = bpf$MAP_CREATE(0x0, &(0x7f0000000040)=@base={0xd, 0x6, 0x4, 0x1, 0x0, r6}, 0x50) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000040)={0x1f, 0x3c, &(0x7f0000001c40)=ANY=[@ANYBLOB="85000000a800000095"], &(0x7f00000000c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x14}, 0x90) (async) r8 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000040)={0x1f, 0x3c, &(0x7f0000001c40)=ANY=[@ANYBLOB="85000000a800000095"], &(0x7f00000000c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x14}, 0x90) bpf$PROG_BIND_MAP(0x23, &(0x7f0000000140)={r8, r7}, 0xc) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f00000008c0)={{r7}, &(0x7f0000000840), &(0x7f0000000880)=r6}, 0x20) close(r6) bpf$MAP_DELETE_ELEM(0x3, &(0x7f0000000380)={r7, &(0x7f0000000900)}, 0x20) bpf$PROG_LOAD(0x5, &(0x7f00000006c0)={0x6, 0xe, &(0x7f00000008c0)=ANY=[@ANYBLOB="b702000000070000bfa30000000000000703000000feffff7bfef0fff8ffff1971a4f0ff00000000b7060000080000006f6400000000000045040400010000001704000001000a00b7040000ff0100006a0a00fe0000000085000000be000000b70000000000000095000000000000009e17f199a68b06d83298a8cdc21ce784909b849d5550ad857d0454d8877a6db61d69f2ffcaa10350e11cb97c8adf1bc9a0c4eeceb9971e43405d621ffbc9ce000000d8ca56b50d0c010d631f6dde53a9a53608c10556e5734eb84049761451ce540c772e2d9f8004e26f7fcc059c062234d5595f6fbaa187b81d1106000000000fd60000fd9ac3d09e29a9d542ca9d85a5c9c88474895d679838def0a83a733dc6a39b63a5ed69d32394c53361d7e43c5cbd80450f859ce8122a79c3e40000b59b0fc46d6cec3c0802882add4e3179bd4a44f231b6d753a7be428ba953df4aece69311687f4122073a236c3a32efa04137d4524847d2638da3261c8162bb7c7824be6195a66d2e17e122040e1100000000928612a29fc691e4f1f7bd053abb885f39381f1759410b1059f05684261f332d606834669b49ec99320ca7712d7e79bd5bf5ed818ecc7640917f6a559a47db608fcf9f6c131b84e41c354c66838f72b9e12d36e996f316f0812ca83efb30c7f6c6d57c4a64590401eec22523dd712c680013e87f649a1ede7142ca9d5d8a8c9f9b440fe4331ad5532c74d9a31a5d737537f7a2caa30581253d14dd3e92af7dc836686365ae01bdec561c0402b67801267a8df97d2f85426a5963d4fa3e26cc05972c162f223f000000d999e80de00fcbcc02d0aed7bb8f7ba337d59c14f39dcd4aad4139ef6425a9367f1bd1467fc6b95a4df7669839771ce9d5788029901e5a79d8b9990ace8f74087f25ad50c46088000000008000"/686], &(0x7f0000000040)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @xdp, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x3a, 0x10, &(0x7f0000000340), 0xd58495bc, 0x0, 0xffffffffffffffff, 0xffffffffffffff5b}, 0x42) (async) bpf$PROG_LOAD(0x5, &(0x7f00000006c0)={0x6, 0xe, &(0x7f00000008c0)=ANY=[@ANYBLOB="b702000000070000bfa30000000000000703000000feffff7bfef0fff8ffff1971a4f0ff00000000b7060000080000006f6400000000000045040400010000001704000001000a00b7040000ff0100006a0a00fe0000000085000000be000000b70000000000000095000000000000009e17f199a68b06d83298a8cdc21ce784909b849d5550ad857d0454d8877a6db61d69f2ffcaa10350e11cb97c8adf1bc9a0c4eeceb9971e43405d621ffbc9ce000000d8ca56b50d0c010d631f6dde53a9a53608c10556e5734eb84049761451ce540c772e2d9f8004e26f7fcc059c062234d5595f6fbaa187b81d1106000000000fd60000fd9ac3d09e29a9d542ca9d85a5c9c88474895d679838def0a83a733dc6a39b63a5ed69d32394c53361d7e43c5cbd80450f859ce8122a79c3e40000b59b0fc46d6cec3c0802882add4e3179bd4a44f231b6d753a7be428ba953df4aece69311687f4122073a236c3a32efa04137d4524847d2638da3261c8162bb7c7824be6195a66d2e17e122040e1100000000928612a29fc691e4f1f7bd053abb885f39381f1759410b1059f05684261f332d606834669b49ec99320ca7712d7e79bd5bf5ed818ecc7640917f6a559a47db608fcf9f6c131b84e41c354c66838f72b9e12d36e996f316f0812ca83efb30c7f6c6d57c4a64590401eec22523dd712c680013e87f649a1ede7142ca9d5d8a8c9f9b440fe4331ad5532c74d9a31a5d737537f7a2caa30581253d14dd3e92af7dc836686365ae01bdec561c0402b67801267a8df97d2f85426a5963d4fa3e26cc05972c162f223f000000d999e80de00fcbcc02d0aed7bb8f7ba337d59c14f39dcd4aad4139ef6425a9367f1bd1467fc6b95a4df7669839771ce9d5788029901e5a79d8b9990ace8f74087f25ad50c46088000000008000"/686], &(0x7f0000000040)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @xdp, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x3a, 0x10, &(0x7f0000000340), 0xd58495bc, 0x0, 0xffffffffffffffff, 0xffffffffffffff5b}, 0x42) 2.949693982s ago: executing program 3 (id=8062): syz_init_net_socket$nfc_raw(0x27, 0x5, 0x0) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) close(r0) sendmsg$NFT_BATCH(r0, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f0000000200)=ANY=[@ANYBLOB="140000001000010000000000000000000700000a400000000c0a010100000000000000000a0000060900020073797a31000000000900010073797a310000000014000380100000800c0001800600010012ad0000140000001100010000000000000000000300000a2908ca133dd6d84b2da7e2840de189a606f4382b3f51194fd3fc9aad8c700d4cc9"], 0x68}, 0x1, 0x0, 0x0, 0x4000850}, 0x40) sendmsg$NFT_BATCH(r0, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f00000002c0)=ANY=[], 0x68}, 0x1, 0x0, 0x0, 0x4000850}, 0x40) recvmsg(r0, &(0x7f00000033c0)={0x0, 0x0, 0x0}, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000140)={0x1e, 0x4, &(0x7f0000000000)=ANY=[@ANYBLOB="180000000000000000000000000000e470122f00000000009500000000000000"], &(0x7f0000000080)='syzkaller\x00', 0x0, 0xfffffffffffffef0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x24}, 0x90) 2.838263182s ago: executing program 2 (id=8064): syz_genetlink_get_family_id$nl80211(&(0x7f0000000380), 0xffffffffffffffff) (async) r0 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000380), 0xffffffffffffffff) r1 = epoll_create1(0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000bc0)={0x15, 0x3, &(0x7f0000000000)=@framed={{0x6a, 0xa, 0x0, 0xffc4, 0x0, 0x69, 0x10, 0x16}}, &(0x7f00000000c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x5c, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0xfffffffffffffe45}, 0x94) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, 0xffffffffffffffff, 0x0) epoll_ctl$EPOLL_CTL_MOD(r1, 0x3, 0xffffffffffffffff, 0x0) ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8933, 0x0) r2 = socket(0x10, 0x803, 0x0) r3 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000100)={0x2, 0x4, 0x8, 0x1, 0x80, 0x0, 0x7, '\x00', 0x0, 0x0}, 0x50) bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f00000007c0)=ANY=[@ANYBLOB="1b0000000000000000000000000004"], 0x48) (async) r4 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f00000007c0)=ANY=[@ANYBLOB="1b0000000000000000000000000004"], 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000003c0)={0x1, 0x1c, &(0x7f0000000d80)=@ringbuf={{0x18, 0x8, 0x0, 0x0, 0xff, 0x0, 0x0, 0x0, 0xfffffffb}, {{0x18, 0x1, 0x1, 0x0, r4}, {}, {0x7, 0x0, 0xb, 0x3, 0x0, 0x0, 0x3}, {0x85, 0x0, 0x0, 0x5}}, {}, [@snprintf={{0x7, 0x0, 0xb, 0x2, 0x0, 0x0, 0x1200}, {0x3, 0x3, 0x3, 0xa, 0x2, 0xfff0}, {0x6, 0x0, 0xd, 0x9, 0x0, 0x8, 0x8}, {0x3, 0x3, 0x6, 0xa, 0x9, 0xfff0, 0x41}, {0x7, 0x1, 0xb, 0x6, 0x8}, {0x7, 0x0, 0x0, 0x8}, {}, {}, {}, {0x18, 0x8, 0x2, 0x0, r3}, {}, {0x15, 0x0, 0x0, 0x76}}], {{0x7, 0x1, 0xb, 0x8}, {0x6, 0x0, 0x5, 0x8, 0x0, 0x0, 0x2}, {0x85, 0x0, 0x0, 0x7}}}, &(0x7f00000002c0)='GPL\x00', 0x9, 0x0, 0x0, 0x40f00, 0x46, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$MAP_CREATE(0x0, &(0x7f0000000640)=@base={0x1, 0x8, 0x4, 0xff, 0x0, 0x1}, 0x50) (async) r5 = bpf$MAP_CREATE(0x0, &(0x7f0000000640)=@base={0x1, 0x8, 0x4, 0xff, 0x0, 0x1}, 0x50) bpf$BPF_MAP_LOOKUP_AND_DELETE_ELEM(0x15, &(0x7f0000000980)={r5, &(0x7f0000000380), 0x0}, 0x20) r6 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f0000000900)={0x1b, 0x0, 0x0, 0x3a, 0x0, 0x1, 0x8, '\x00', 0x0, 0xffffffffffffffff, 0x2, 0x2, 0x2}, 0x50) bpf$BPF_MAP_GET_FD_BY_ID(0xe, &(0x7f0000000980)={0x0, 0x400, 0x10}, 0xc) (async) r7 = bpf$BPF_MAP_GET_FD_BY_ID(0xe, &(0x7f0000000980)={0x0, 0x400, 0x10}, 0xc) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000a40)={0x6, 0x10, &(0x7f0000000180)=@ringbuf={{0x18, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, {}, {}, [@ldst={0x1, 0x3, 0x1, 0x4, 0x3, 0x4b, 0xfffffffffffffff0}], {{}, {0x7, 0x0, 0xb, 0x2, 0x0, 0x0, 0x2}, {0x85, 0x0, 0x0, 0x18f}}}, &(0x7f00000005c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x5, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, &(0x7f0000000800)={0x8, 0x2}, 0x8, 0x10, &(0x7f0000000840)={0x0, 0x8, 0x5e8, 0x8bf9}, 0x10, 0x0, 0x0, 0x0, &(0x7f00000009c0)=[0xffffffffffffffff, r4, r5, r6, r7, 0x1, 0x1, 0x1], &(0x7f0000000a00), 0x10, 0xe10}, 0x94) (async) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000a40)={0x6, 0x10, &(0x7f0000000180)=@ringbuf={{0x18, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, {}, {}, [@ldst={0x1, 0x3, 0x1, 0x4, 0x3, 0x4b, 0xfffffffffffffff0}], {{}, {0x7, 0x0, 0xb, 0x2, 0x0, 0x0, 0x2}, {0x85, 0x0, 0x0, 0x18f}}}, &(0x7f00000005c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x5, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, &(0x7f0000000800)={0x8, 0x2}, 0x8, 0x10, &(0x7f0000000840)={0x0, 0x8, 0x5e8, 0x8bf9}, 0x10, 0x0, 0x0, 0x0, &(0x7f00000009c0)=[0xffffffffffffffff, r4, r5, r6, r7, 0x1, 0x1, 0x1], &(0x7f0000000a00), 0x10, 0xe10}, 0x94) sendmsg$nl_route(r2, &(0x7f0000000380)={0x0, 0x4076cbba9945d516, &(0x7f0000000340)={0x0, 0x14}}, 0x0) (async) sendmsg$nl_route(r2, &(0x7f0000000380)={0x0, 0x4076cbba9945d516, &(0x7f0000000340)={0x0, 0x14}}, 0x0) getsockname$packet(r2, &(0x7f0000000140)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000240)=ANY=[@ANYBLOB="4c000000100039042abd70000000000000000000", @ANYRES32=r8, @ANYBLOB="01180200031100002c0012800e00010069703665727370616e0000001800028008001500a8bc0d00040012"], 0x4c}, 0x1, 0x0, 0x0, 0x90c49c71b979d2da}, 0x0) r9 = socket$nl_route(0x10, 0x3, 0x0) setsockopt$sock_attach_bpf(0xffffffffffffffff, 0x1, 0x4c, &(0x7f0000000000), 0x4) (async) setsockopt$sock_attach_bpf(0xffffffffffffffff, 0x1, 0x4c, &(0x7f0000000000), 0x4) sendmsg$inet(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, 0x0}, 0x0) sendmsg$NL80211_CMD_NEW_INTERFACE(0xffffffffffffffff, &(0x7f0000000700)={&(0x7f00000003c0)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f00000006c0)={&(0x7f0000000b00)={0x98, r0, 0x200, 0x70bd25, 0x25dfdbfc, {{}, {@val={0x8, 0x1, 0x3a}, @void, @void}}, [@NL80211_ATTR_SOCKET_OWNER={0x4}, @NL80211_ATTR_IFNAME={0x14, 0x4, 'pimreg\x00'}, @NL80211_ATTR_IFTYPE={0x8, 0x5, 0x4}, @NL80211_ATTR_MESH_ID={0xa}, @NL80211_ATTR_SOCKET_OWNER={0x4}, @NL80211_ATTR_4ADDR={0x5}, @mon_options=[@NL80211_ATTR_MU_MIMO_FOLLOW_MAC_ADDR={0xa, 0xe8, @device_b}, @NL80211_ATTR_MU_MIMO_GROUP_DATA={0x1c, 0xe7, "4d72cb5b75a4200587eb69b9b353d1e0bc3f880661b95038"}, @NL80211_ATTR_MNTR_FLAGS={0x1c, 0x17, 0x0, 0x1, [@NL80211_MNTR_FLAG_PLCPFAIL={0x4}, @NL80211_MNTR_FLAG_FCSFAIL={0x4}, @NL80211_MNTR_FLAG_OTHER_BSS={0x4}, @NL80211_MNTR_FLAG_ACTIVE={0x4}, @NL80211_MNTR_FLAG_COOK_FRAMES={0x4}, @NL80211_MNTR_FLAG_PLCPFAIL={0x4}]}]]}, 0x98}, 0x1, 0x0, 0x0, 0x40}, 0x0) sendmsg$nl_route(r9, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000440)={&(0x7f0000000740)=@newlink={0x60, 0x10, 0x401, 0x70bd25, 0x25dfdbff, {0x0, 0x0, 0x0, r8, 0x42035, 0x2ed85}, [@IFLA_LINKINFO={0x40, 0x12, 0x0, 0x1, @ip6erspan={{0xe}, {0x2c, 0x2, 0x0, 0x1, [@IFLA_GRE_ERSPAN_VER={0x5, 0x16, 0x2}, @IFLA_GRE_FWMARK={0x8, 0x14, 0x7}, @IFLA_GRE_REMOTE={0x14, 0x7, @private2}, @IFLA_GRE_COLLECT_METADATA={0x4}]}}}]}, 0x60}, 0x1, 0x0, 0x0, 0x4040014}, 0x20040850) r10 = socket(0x10, 0x3, 0x0) syz_emit_ethernet(0x3b6, &(0x7f0000000200)=ANY=[@ANYBLOB="aaaaaaaaaaaaaaaaaaaaaa2286dd60cabf0003803afffe8000000000000000000000000000bbff02000000000000000000000000000186009078000000000000000000000000000aa78ce54006598080a8030037004023493b87aafaffffffffffffff23732472eefa45ad96579269748e254c1e4a8a8b3f0ab0c430d3be27df3e34066d42ca0a5c15b37adac15084dbaf736b41e5af250200010000000500000000260004000018fe906d26efe39393fe08f73eabc5977b1190a3a6ad8338f1511cdd10c35d8f6de79fc7fd175f75649fa368a32c829af02d7f44d92324a7051e460a13ddde25a5b85b9d930914625d8a049b4cf0d129806a610ad8477a2499a9a0527f75b655a6653d0363a979acf93f88eea07d68423e90280409de1657275f716a2bf2915d1783e8eb477b0d1170f0ecbdef4c23e1b76e9ab3d2fbe4b34438d2a77577edd0ebed9682b851b380ae0cab282af9d7ebe668177704c5fd4698c934de4731f3f61effc978001d06aa85616177c41bc943afcb84619755403946b0730a18d5c38cf7dcad830f2dc8674b87ba8b58f81ece27975cc39e595e9af90b4fe92a38d25551c2d9ebfc5dfc5a2a501b7e483de3f808895c5f4a1a2367bc591dd8b094822ff0dea07c9a1f643c822a18b79f7c5eba31fb68b2d734a6671e27182aee96f24a4a5cf390dab23b500b0c0272479611e4f7f4299ec4d926d443367b105185e6ecd9602ba95392343e9bbd447ef6bc1ba42399907ccd0a562db212baa39eb8164e240069f656d3a05fecf894222a141123f5ac010000000000000090aa235a670670ffc5dc49dfb58d00000000000000040b17dcea46805d4809c20547406b18901b0aeff04c0300f3c75dc2d227a83b89483be298af1084743475671545e65eb2e9ac946a3f0e2bc4619f91394c02bcfbbb7d71138537d68e2d2c6393a9f3becd1a9f51a948b5b3032107b8a3e100908f61640000000200fe80ffff00000000000000ff0bc0fe00000000008879e66485201a0015ca83747357a02745000400000000145e14f0e74d2d42cfb3f27fafb60845f90b6dfc2e37bc87c6905bbc94d33e1ea71a28105f543e868a8a53b360a9d33e2b1e26eb1d18065daa7628cf9ef083611c9f6ae2e1eb3d8bf9c6ab2642c4808288e62afbf03269f1f98aea6ab3beb5fdc5fdaabc2c676d8800871a6aa54155dea2d995cb22c9924e0ad38c6967052cc7786d779b8353aac33a57d79b05613a12328f61129017fb632dbf04542188b196e213408c0005d5170000dce9674a36da018dff16e70b8b14c4b7a94fe18e88605aa6be1a02a326a6bce65f81ed"], 0x0) (async) syz_emit_ethernet(0x3b6, &(0x7f0000000200)=ANY=[@ANYBLOB="aaaaaaaaaaaaaaaaaaaaaa2286dd60cabf0003803afffe8000000000000000000000000000bbff02000000000000000000000000000186009078000000000000000000000000000aa78ce54006598080a8030037004023493b87aafaffffffffffffff23732472eefa45ad96579269748e254c1e4a8a8b3f0ab0c430d3be27df3e34066d42ca0a5c15b37adac15084dbaf736b41e5af250200010000000500000000260004000018fe906d26efe39393fe08f73eabc5977b1190a3a6ad8338f1511cdd10c35d8f6de79fc7fd175f75649fa368a32c829af02d7f44d92324a7051e460a13ddde25a5b85b9d930914625d8a049b4cf0d129806a610ad8477a2499a9a0527f75b655a6653d0363a979acf93f88eea07d68423e90280409de1657275f716a2bf2915d1783e8eb477b0d1170f0ecbdef4c23e1b76e9ab3d2fbe4b34438d2a77577edd0ebed9682b851b380ae0cab282af9d7ebe668177704c5fd4698c934de4731f3f61effc978001d06aa85616177c41bc943afcb84619755403946b0730a18d5c38cf7dcad830f2dc8674b87ba8b58f81ece27975cc39e595e9af90b4fe92a38d25551c2d9ebfc5dfc5a2a501b7e483de3f808895c5f4a1a2367bc591dd8b094822ff0dea07c9a1f643c822a18b79f7c5eba31fb68b2d734a6671e27182aee96f24a4a5cf390dab23b500b0c0272479611e4f7f4299ec4d926d443367b105185e6ecd9602ba95392343e9bbd447ef6bc1ba42399907ccd0a562db212baa39eb8164e240069f656d3a05fecf894222a141123f5ac010000000000000090aa235a670670ffc5dc49dfb58d00000000000000040b17dcea46805d4809c20547406b18901b0aeff04c0300f3c75dc2d227a83b89483be298af1084743475671545e65eb2e9ac946a3f0e2bc4619f91394c02bcfbbb7d71138537d68e2d2c6393a9f3becd1a9f51a948b5b3032107b8a3e100908f61640000000200fe80ffff00000000000000ff0bc0fe00000000008879e66485201a0015ca83747357a02745000400000000145e14f0e74d2d42cfb3f27fafb60845f90b6dfc2e37bc87c6905bbc94d33e1ea71a28105f543e868a8a53b360a9d33e2b1e26eb1d18065daa7628cf9ef083611c9f6ae2e1eb3d8bf9c6ab2642c4808288e62afbf03269f1f98aea6ab3beb5fdc5fdaabc2c676d8800871a6aa54155dea2d995cb22c9924e0ad38c6967052cc7786d779b8353aac33a57d79b05613a12328f61129017fb632dbf04542188b196e213408c0005d5170000dce9674a36da018dff16e70b8b14c4b7a94fe18e88605aa6be1a02a326a6bce65f81ed"], 0x0) sendmmsg(r10, &(0x7f0000000000), 0x4000000000001f2, 0x600) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000000)) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x6) (async) r11 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x6) ioctl$sock_bt_hci(r11, 0x400448c8, &(0x7f0000000000)) write(r10, &(0x7f0000000040)="9e61f2b85c6c0bfbb2dac213", 0xc) (async) write(r10, &(0x7f0000000040)="9e61f2b85c6c0bfbb2dac213", 0xc) 2.749749808s ago: executing program 3 (id=8066): r0 = syz_open_procfs$namespace(0xffffffffffffffff, &(0x7f00000004c0)='ns/uts\x00') socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$inet(r2, &(0x7f0000001b00)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001d80)=ANY=[@ANYBLOB="28010000000000000100000001"], 0x128}, 0x0) recvmsg$unix(r1, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000080), 0x100}, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$inet(r4, &(0x7f0000001b00)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001d80)=ANY=[], 0x128}, 0x0) recvmsg$unix(r3, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000080), 0x100}, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$inet(r6, &(0x7f0000001b00)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001d80)=ANY=[], 0x128}, 0x0) recvmsg$unix(r5, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000900), 0x100}, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$inet(r8, &(0x7f0000001b00)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001d80)=ANY=[], 0x128}, 0x0) r9 = bpf$ITER_CREATE(0x21, &(0x7f0000000080), 0x8) r10 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000140), 0xffffffffffffffff) sendmsg$ETHTOOL_MSG_PRIVFLAGS_GET(r9, &(0x7f0000000200)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x10000000}, 0xc, &(0x7f00000001c0)={&(0x7f0000000180)=ANY=[@ANYBLOB='<\x00\x00\x00', @ANYRES16=r10, @ANYBLOB="85e528bd7000fcdbdf250d0000002800018008000300000000001400020076657468305f746f5f7465616d0000000800030000000000"], 0x3c}, 0x1, 0x0, 0x0, 0xc014}, 0x8000) r11 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r11, 0x6, 0x210000000013, &(0x7f00000000c0)=0x100000001, 0x4) mmap(&(0x7f0000000000/0x4000)=nil, 0x4000, 0x3000001, 0x31, 0xffffffffffffffff, 0x0) setsockopt$inet_tcp_int(r11, 0x6, 0x18, &(0x7f0000000000)=0xf3, 0x4) recvmsg(r7, &(0x7f00000005c0)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001dc0)=""/4096, 0x1000}, 0x0) ioctl$NS_GET_USERNS(r0, 0xb701, 0x0) socket$kcm(0x10, 0x2, 0x0) r12 = socket$nl_audit(0x10, 0x3, 0x9) sendmsg$AUDIT_USER(r12, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000400)=ANY=[@ANYBLOB="e03f0300eb03"], 0x33fe0}}, 0x0) sendmsg$AUDIT_GET(r12, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000080)={0x10}, 0x10}}, 0x0) socket$inet_mptcp(0x2, 0x1, 0x106) 2.518905811s ago: executing program 2 (id=8070): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000003c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0) sendmsg$NFT_BATCH(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000440)={{0x14}, [@NFT_MSG_NEWRULE={0x4c, 0x6, 0xa, 0x201, 0x0, 0x0, {0x2, 0x0, 0x7}, [@NFTA_RULE_EXPRESSIONS={0x20, 0x4, 0x0, 0x1, [{0x1c, 0x1, 0x0, 0x1, @range={{0xa}, @val={0xc, 0x2, 0x0, 0x1, [@NFTA_RANGE_SREG={0x8, 0x1, 0x1, 0x0, 0x12}]}}}]}, @NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_RULE_CHAIN={0x9, 0x2, 'syz2\x00'}]}], {0x14}}, 0x74}}, 0x20000080) bpf$PROG_LOAD(0x5, &(0x7f0000000240)={0x1, 0x4, &(0x7f0000000040)=@framed={{0xffffffb7, 0x5, 0x0, 0x0, 0x0, 0x61, 0x10, 0x30}, [@ldst={0x7, 0x3, 0x0, 0x0, 0xa}]}, &(0x7f00000002c0)='GPL\x00', 0x5, 0xfd90, &(0x7f0000000300)=""/188, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x1f3, 0x10, &(0x7f0000000080), 0xfffffffffffffc79}, 0x2a) 2.227860467s ago: executing program 1 (id=8075): r0 = socket(0x2b, 0x1, 0x1) setsockopt$inet_opts(r0, 0x0, 0x480, 0x0, 0x0) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$NL80211_CMD_REMAIN_ON_CHANNEL(r1, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000100)=ANY=[@ANYBLOB=' \x00\x00\x00', @ANYRES16=r2, @ANYBLOB="7961fdffffff000000007e32"], 0x20}, 0x1, 0x0, 0x0, 0x20008081}, 0x4000054) sendmsg$NL80211_CMD_RELOAD_REGDB(r1, &(0x7f00000006c0)={0x0, 0x0, &(0x7f0000000440)={&(0x7f0000000340)={0x14, r2, 0x1, 0x70bd2d, 0x25dfdbfe}, 0x14}, 0x1, 0x0, 0x0, 0x20000000}, 0x20008004) 2.18832272s ago: executing program 2 (id=8076): r0 = socket$netlink(0x10, 0x3, 0x0) r1 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000000)='cgroup.kill\x00', 0x0, 0x0) r2 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r2, &(0x7f0000000000)={0x0, 0x29, &(0x7f0000001500)=[{&(0x7f0000001580)="d80000001a0081044e81f782db4cb904021d08007b490d4f1e81f8d815001000ff05142603600e12080005007a010401a80016002000034004000000035c0461c9d67f6f940071342e875fab7cb6cec6cf6efb8000a007a290457f0189b316277ce06bbace8017cbec4c2ee5a7cef4090000001fb791643a5ee4ce1b141993c034e653fe8efe7c9f8775730d16a4683f5aeb4edbb57a5025ccca9ee5350db798262f3d40fad95667e006dcdf63951f215ce3bb9ad809d5e1cace81ed0bffece0b42a9ecbee5de6ccd40dd6e4edef3d93452a92954b43370e", 0xd8}], 0x1}, 0x0) setsockopt$inet6_tcp_TCP_QUEUE_SEQ(r1, 0x6, 0x15, &(0x7f0000000040)=0x5, 0x4) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000004c0)={&(0x7f0000000540)=@newlink={0x44, 0x10, 0x439, 0x0, 0x0, {0x0, 0x0, 0xe403, 0x0, 0x20000}, [@IFLA_LINKINFO={0x24, 0x12, 0x0, 0x1, @bond={{0x9}, {0x14, 0x2, 0x0, 0x1, [@IFLA_BOND_MODE={0x5, 0x1, 0x5}, @IFLA_BOND_ARP_VALIDATE={0x8}]}}}]}, 0x44}, 0x1, 0x0, 0x0, 0x41}, 0x4048010) 2.087420607s ago: executing program 3 (id=8077): ioctl$sock_bt_hci(0xffffffffffffffff, 0x800448d2, 0x0) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) r1 = socket(0x11, 0x3, 0x0) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000080)=@newlink={0x44, 0x10, 0x1, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x18, 0x12, 0x0, 0x1, @ip6erspan={{0xe}, {0x4}}}, @IFLA_ADDRESS={0xa}]}, 0x44}}, 0x0) setsockopt(r1, 0x107, 0xf, &(0x7f0000000100)="00008634", 0x4) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000180)={'geneve0\x00', 0x0}) sendmsg(0xffffffffffffffff, &(0x7f0000000100)={&(0x7f0000000040)=@ll={0x11, 0x17, r3, 0x1, 0xe5, 0x6, @broadcast}, 0x80, &(0x7f0000000240)}, 0x44000) r4 = socket$inet_udp(0x2, 0x2, 0x0) bind$rxrpc(0xffffffffffffffff, 0x0, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) r5 = socket$kcm(0x2, 0x200000000000001, 0x106) sendmsg$inet(r5, &(0x7f0000000940)={&(0x7f00000001c0)={0x2, 0x4001, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10, 0x0}, 0x30004081) r6 = socket$kcm(0x10, 0x2, 0x4) pipe(&(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) close(r8) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='memory.events\x00', 0x275a, 0x0) splice(r7, 0x0, r8, &(0x7f00000002c0), 0x6, 0x0) sendmsg$inet(r6, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000580)=[{&(0x7f00000002c0)="5c00000012006bab9e3fe3d86e6c1d000014a10da6000000000004b68675f8001d000a00a0e69ee517d34460bc24eab556a705251e6182949a36c23d3b48dfd8cdbf9367b4fa51f60a64e9f4080003000601000004000200d700b2b7", 0x5c}], 0x1, 0x0, 0x0, 0x1f00c00e}, 0x4080) socket$phonet_pipe(0x23, 0x5, 0x2) r9 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r9, &(0x7f00000002c0)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000300)=ANY=[@ANYBLOB="640000000206030000000000000000000000000005000100070000000900020073797a310000000014000780050015000000000008001240000000000500050002000000050004000000000016000300686173683a6e65742c706f72742c6e6574"], 0x64}}, 0x0) setsockopt$IPT_SO_SET_REPLACE(r4, 0x0, 0x40, &(0x7f0000000a80)=@mangle={'mangle\x00', 0x1f, 0x6, 0x3a8, 0x0, 0x148, 0x1e0, 0x278, 0x310, 0xb0, 0x148, 0x1e0, 0x278, 0x310, 0x6, 0x0, {[{{@ip={@empty, @empty, 0x0, 0x0, '\x00', '\x00', {}, {}, 0x11}, 0x0, 0x70, 0xb0}, @inet=@TPROXY1={0x40, 'TPROXY\x00', 0x1, {0x0, 0x0, @ipv6=@initdev={0xfe, 0x88, '\x00', 0x1, 0x0}}}}, {{@uncond, 0x0, 0x70, 0x98}, @common=@unspec=@STANDARD={0x28, '\x00', 0x0, 0xfffffffffffffffe}}, {{@uncond, 0x0, 0x70, 0x98}, @common=@unspec=@STANDARD={0x28, '\x00', 0x0, 0xfffffffffffffffe}}, {{@uncond, 0x0, 0x70, 0x98}, @common=@unspec=@STANDARD={0x28, '\x00', 0x0, 0xfffffffffffffffe}}, {{@uncond, 0x0, 0x70, 0x98}, @common=@unspec=@STANDARD={0x28, '\x00', 0x0, 0xfffffffffffffffe}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28, '\x00', 0x0, 0xfffffffffffffffe}}}}, 0x408) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) r10 = socket$kcm(0x2, 0x3, 0x2) ioctl$SIOCSIFHWADDR(r10, 0x8914, &(0x7f0000000040)={'syzkaller1\x00', @broadcast}) r11 = syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x3) bind$bt_l2cap(r11, &(0x7f0000000280)={0x1f, 0xfffe}, 0xe) listen(r11, 0x0) clock_gettime(0x5, &(0x7f0000000080)) 2.050198635s ago: executing program 0 (id=8078): r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000040)={0x0}}, 0x80000) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$ethtool(&(0x7f00000000c0), 0xffffffffffffffff) bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x6, 0x4, &(0x7f0000000000)=@framed={{}, [@ldst={0x1, 0x0, 0x3, 0x0, 0x1, 0xc}]}, &(0x7f0000000100)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @xdp, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) ioctl$sock_SIOCSIFVLAN_GET_VLAN_EGRESS_PRIORITY_CMD(r1, 0x8983, &(0x7f0000000080)) sendmsg$ETHTOOL_MSG_COALESCE_SET(r1, &(0x7f0000000540)={0x0, 0x0, &(0x7f0000000500)={&(0x7f0000000180)=ANY=[@ANYBLOB='\\\x00\x00\x00', @ANYRES16=r2, @ANYBLOB="010000000000000000001400000008000a00fc00000018000180140002006e657464657673696d300000000000000800080000fcffff0800090000000000080011000000000008000e00800000000800", @ANYRES64=r1], 0x5c}, 0x1, 0x0, 0x0, 0x4844}, 0x20000001) sendmsg$MPTCP_PM_CMD_GET_ADDR(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000080)=ANY=[], 0x68}}, 0xc00d1) r3 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route(r3, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000003c0)=ANY=[@ANYBLOB="540000001000010427bd70000000000000000000", @ANYRES32=0x0, @ANYBLOB="91400300000000002000128008000100736974001400028008000300ac1e010106000d0009000000140003006e6963"], 0x54}, 0x1, 0x0, 0x0, 0x24048c00}, 0x8010) sendmmsg(r3, &(0x7f00000002c0), 0x40000000000009f, 0x0) 1.842873807s ago: executing program 5 (id=8079): ioctl$sock_kcm_SIOCKCMCLONE(0xffffffffffffffff, 0x89e2, &(0x7f0000000080)={0xffffffffffffffff}) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$nl802154(&(0x7f00000000c0), r1) sendmsg$NL802154_CMD_GET_SEC_LEVEL(r1, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000000000)={0x14, r2, 0x301, 0x70bd2b, 0x25dfdbfe, {0x2b}}, 0x14}, 0x1, 0x0, 0x0, 0x20004080}, 0x0) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000100), 0xffffffffffffffff) r4 = socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_UMEM_REG(r4, 0x11b, 0x4, &(0x7f0000000140)={0x0, 0x1000, 0x800, 0x80000000, 0x3}, 0x20) sendmsg$NL80211_CMD_SET_PMKSA(r0, &(0x7f00000001c0)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x8}, 0xc, &(0x7f0000000180)={&(0x7f0000000140)={0x1c, r3, 0x200, 0x70bd26, 0x25dfdbfc, {{}, {@void, @void}}, [@NL80211_ATTR_PMK_REAUTH_THRESHOLD={0x5, 0x120, 0x23}]}, 0x1c}, 0x1, 0x0, 0x0, 0x40}, 0x81) (async) r5 = syz_init_net_socket$llc(0x1a, 0x2, 0x0) getsockopt$llc_int(r5, 0x10c, 0x7, &(0x7f0000000000), &(0x7f0000000040)=0x4) 1.788017741s ago: executing program 0 (id=8080): r0 = socket(0x10, 0x3, 0x0) (async) r1 = socket$inet6_udp(0xa, 0x2, 0x0) bind$inet6(r1, &(0x7f0000000000)={0xa, 0xe22, 0xfffffffd, @empty, 0x12}, 0x1c) (async) r2 = socket$pppl2tp(0x18, 0x1, 0x1) connect$pppl2tp(r2, &(0x7f0000000100)=@pppol2tpv3={0x18, 0x1, {0x0, r1, {0x2, 0xffff, @loopback}, 0x4}}, 0x2e) (async, rerun: 64) r3 = socket$nl_generic(0x10, 0x3, 0x10) (rerun: 64) r4 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000440), 0xffffffffffffffff) sendmsg$L2TP_CMD_SESSION_GET(r3, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000004c0)={&(0x7f0000000200)={0x30, r4, 0x1, 0x70bd25, 0x3, {0x7}, [@L2TP_ATTR_RECV_SEQ={0x5, 0x12, 0x7}, @L2TP_ATTR_IFNAME={0x14}]}, 0x30}, 0x1, 0x0, 0x0, 0x14}, 0x2400c046) (async) syz_emit_ethernet(0x4c, &(0x7f0000000140)={@link_local, @random="ece65fbcee55", @void, {@ipv6={0x86dd, @udp={0x0, 0x6, "010100", 0x16, 0x11, 0x0, @remote, @local, {[], {0x3, 0xe22, 0x16, 0x0, @gue={{0x2, 0x0, 0x0, 0x3}, "ffb00afe4e70"}}}}}}}, 0x0) (async) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000009c0)=ANY=[@ANYBLOB="1400000010000100ffef0000000000000300000a440000000c0a010100000000000000000a0000060900020073797a310000000009000171c5797a3100000000801400008004000180080003c000000001040002801400000011"], 0x6c}, 0x1, 0x0, 0x0, 0x4000850}, 0x40) (async, rerun: 64) socket$netlink(0x10, 0x3, 0x0) (async, rerun: 64) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000880)=ANY=[@ANYBLOB="700200001300290a000000000000000007000000", @ANYRES32, @ANYBLOB="000000000000000010011a801000f4800400058008000900000000000800038030000180050006000000000014000500714abbd2547de97cbbf6efb226f19bf90d0002003a288e5e5b5b5a40000000006000078014000400293a02149f3b75a67093c28fd6f55a2314000400e48f01e49713f0c2d839f940d9f088d80500060000000000130002006272696467655f736c6176655f30000007000200293a00000500060000000000080001000000000018000180140004004d2906d0880fc8acc30fe2020f9849675000018014000500a1085e7df341b9dc3d8008a2fe5bdaad140004009c7e472c916020fe41bcc5aa8f56c9471400050080ab8be51421cfa3c9e5cbfe8217e0af080001000000000008000100000000006000018005000600000000000500060000000000080001000000000005000600000000000c00020073797a746e6c30000800010000000000130002006272696467655f736c6176655f30000014000500e078d277f38ed3a40a448f3f6b6763e83c000c8008002c"], 0x270}}, 0x0) (async) sendmmsg(r0, &(0x7f0000000000), 0x4000000000001f2, 0xfc) 1.756723208s ago: executing program 1 (id=8081): r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=ANY=[@ANYBLOB="4800000020000103000000000000000002000002000000071f0002000500160011000000080001006401010108000b004900000008000200ac14141e0c0018"], 0x48}, 0x1, 0x0, 0x0, 0x4008010}, 0x44890) r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r1, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000001140)={&(0x7f0000000140)=@newlink={0x3c, 0x10, 0x503, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x40}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @vlan={{0x9}, {0x4}}}, @IFLA_OPERSTATE={0x5, 0x10, 0x9}]}, 0x3c}}, 0x0) r2 = syz_init_net_socket$bt_rfcomm(0x1f, 0x1, 0x3) setsockopt$bt_rfcomm_RFCOMM_LM(r2, 0x12, 0x3, &(0x7f0000001c80)=0x2, 0x4) r3 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r3, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000040)=@setlink={0x48, 0x13, 0x5, 0x70bd26, 0x0, {0x0, 0x0, 0x0, 0x0, 0x208e2}, [@IFLA_IFNAME={0x14, 0x3, 'bond_slave_1\x00'}, @IFLA_PHYS_SWITCH_ID={0x12, 0x24, "35658f9b00e55fbe305dad5e0b33"}]}, 0x48}, 0x1, 0x0, 0x0, 0x40000}, 0x8004) 1.479171073s ago: executing program 1 (id=8082): r0 = socket$nl_route(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff}) getsockopt$sock_buf(r1, 0x1, 0x1f, 0x0, &(0x7f0000001040)) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000080)=@newnexthop={0x1c, 0x68, 0x200, 0x3, 0x25dfdbfb, {0x0, 0x0, 0x1, 0x0, 0xc}, [@NHA_BLACKHOLE={0x4}]}, 0x1c}, 0x1, 0x0, 0x0, 0x40}, 0x20008090) 1.352307888s ago: executing program 1 (id=8083): r0 = socket$nl_route(0x10, 0x3, 0x0) (async) r1 = accept$packet(0xffffffffffffffff, &(0x7f0000000000)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @link_local}, &(0x7f0000000040)=0x14) setsockopt$packet_int(r1, 0x107, 0x14, &(0x7f0000000080)=0x6, 0x4) (async, rerun: 32) sendmsg$nl_route(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000240)=@newlink={0x34, 0x10, 0x403, 0x3, 0x0, {0x0, 0x0, 0x0, 0x0, 0x90646, 0x1080}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @bond={{0x9}, {0xfffffca3}}}]}, 0x34}, 0x1, 0x0, 0x0, 0x44680}, 0x20048040) (rerun: 32) 1.351680795s ago: executing program 5 (id=8084): pipe(&(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r1, 0x6, 0x10000000013, &(0x7f0000000000)=0x1, 0x4) r2 = socket$nl_route(0x10, 0x3, 0x0) pipe(&(0x7f0000000040)) write(r2, &(0x7f0000000300)="600000001800050601000000000000000a400000fe040001000000001400200020010db800010000000000000000000108000400010000000600150003000000200016800c0001001234567890abcdef0500080020867eb27894f961fa2d7d39", 0x60) setsockopt$inet_tcp_int(r1, 0x6, 0x14, &(0x7f00000000c0)=0x100000001, 0x4) connect$inet(r1, &(0x7f0000000300)={0x2, 0x0, @remote}, 0x10) sendto$inet(r1, &(0x7f0000000080)="e19dabcf", 0x4, 0x20000040, 0x0, 0x0) ioctl$int_in(r1, 0x5421, &(0x7f0000000400)=0x83) splice(r1, 0x0, r0, 0x0, 0xfea5, 0xa) 1.308370501s ago: executing program 2 (id=8085): r0 = socket$inet6_sctp(0xa, 0x1, 0x84) bind$inet6(r0, &(0x7f0000000040)={0xa, 0x4e23, 0x4, @loopback}, 0x1c) (async) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) shutdown(r1, 0x1) (async) sendto$inet6(r0, &(0x7f00000003c0)='\x00', 0x1, 0x0, &(0x7f0000000480)={0xa, 0x4e23, 0x20, @loopback, 0x1}, 0x1c) (async) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r2, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000340)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0) (async) sendmsg$NFT_BATCH(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)={{0x14}, [@NFT_MSG_NEWRULE={0x50, 0x6, 0xa, 0x40b, 0x0, 0x0, {0x2}, [@NFTA_RULE_EXPRESSIONS={0x24, 0x4, 0x0, 0x1, [{0x20, 0x1, 0x0, 0x1, @log={{0x8}, @val={0x14, 0x2, 0x0, 0x1, [@NFTA_LOG_GROUP={0x6}, @NFTA_LOG_FLAGS={0x8}]}}}]}, @NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_RULE_CHAIN={0x9, 0x2, 'syz0\x00'}]}], {0x14}}, 0x78}}, 0x0) (async) socket$kcm(0x29, 0x5, 0x0) 1.286292608s ago: executing program 3 (id=8086): r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$NL80211_CMD_JOIN_MESH(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f00000002c0)=ANY=[@ANYBLOB="1c000008", @ANYRES16=0x0, @ANYBLOB="010028bd7000fbdbdf254400000008000300", @ANYRES32=0x0, @ANYBLOB], 0x1c}, 0x1, 0x0, 0x0, 0x85}, 0x4c040) ppoll(&(0x7f00000000c0)=[{}, {}], 0x20000000000000dc, 0x0, 0x0, 0x0) sendmsg$nl_route(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000280)=ANY=[@ANYBLOB="60000000100005040100000000000000000000000003000000000000000000000a00030076657468300000003400128009000100766574680000000024000280200001"], 0x60}}, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000600)={0x3, 0x3, &(0x7f0000000000)=ANY=[@ANYBLOB="7a0a00ff000000007110bd000000000095"], &(0x7f0000000480)='syzkaller\x00'}, 0x90) r1 = socket$inet_udp(0x2, 0x2, 0x0) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket$netlink(0x10, 0x3, 0x0) r4 = socket(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r4, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={0x0, 0x14}}, 0x0) getsockname$packet(r4, &(0x7f00000002c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000100)=0x14) r6 = socket$nl_netfilter(0x10, 0x3, 0xc) r7 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(r7, 0x6, 0x13, &(0x7f0000000500)=0x1, 0x4) connect$inet(r7, &(0x7f0000000000)={0x2, 0x4e21, @dev={0xac, 0x14, 0x14, 0x1a}}, 0x10) setsockopt$inet_tcp_int(r7, 0x6, 0x2, &(0x7f0000000040)=0x2800, 0x4) getsockopt$inet_tcp_int(r7, 0x6, 0x2, 0x0, &(0x7f0000000180)) sendmsg$NFT_BATCH(r6, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000340)=ANY=[@ANYBLOB="1400000010000f0000000000000000000a00000a20000000000a05290000000001000000070000000900010073797a300000000048000000090a01040000000000000000070000000900010073797a30000000000c00098008000140e0000000080005400000003c08000a4000000000090002"], 0x90}, 0x1, 0x0, 0x0, 0x20000080}, 0x48020) sendmsg$nl_route(r3, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000008c0)=ANY=[@ANYBLOB="480000001000050700000086d7c0d6c878f064eb", @ANYRES32=r5, @ANYBLOB="0000000000000000280012000c00010076657468"], 0x48}}, 0x0) sendmsg$nl_route_sched(r3, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000004c0)={&(0x7f0000000900)=@newqdisc={0x30, 0x24, 0xf1d, 0x0, 0x0, {0x0, 0x0, 0x0, r5, {}, {0xfff1, 0xffff}}, [@qdisc_kind_options=@q_ingress={0xc}]}, 0x30}}, 0x0) sendmsg$nl_route_sched(r2, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000940)=@delchain={0x24, 0x64, 0xf31, 0x0, 0x0, {0x0, 0x0, 0x0, r5, {0x9}, {0x10, 0xffff}}}, 0x24}}, 0x4040004) getsockopt$CAN_RAW_LOOPBACK(r4, 0x65, 0x3, &(0x7f0000000080), &(0x7f0000000300)=0x4) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(r1, 0x89f1, &(0x7f0000000180)={'syztnl0\x00', &(0x7f0000000100)={'syztnl2\x00', r5, 0x8000, 0x8, 0x3, 0x3, {{0xa, 0x4, 0x1, 0x9, 0x28, 0x68, 0x0, 0x0, 0x29, 0x0, @broadcast, @initdev={0xac, 0x1e, 0x1, 0x0}, {[@ssrr={0x89, 0x13, 0xe3, [@initdev={0xac, 0x1e, 0x0, 0x0}, @local, @multicast1, @remote]}]}}}}}) 1.155404448s ago: executing program 0 (id=8087): r0 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000040)={'macvlan0\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000280)=ANY=[@ANYBLOB="480000001c00110c0000001400000f0007000000", @ANYRES32=r1, @ANYBLOB="800202000a0002"], 0x48}}, 0x0) pipe(&(0x7f0000000000)={0xffffffffffffffff}) socket$l2tp6(0xa, 0x2, 0x73) getsockopt$inet_sctp_SCTP_RESET_STREAMS(0xffffffffffffffff, 0x84, 0x77, &(0x7f0000000180)={0x0, 0x1, 0x6, [0x3, 0x1, 0x8, 0x7, 0x4, 0x5]}, &(0x7f0000000240)=0x14) setsockopt$inet_sctp6_SCTP_DELAYED_SACK(r2, 0x84, 0x10, &(0x7f0000001380)=@assoc_value={r3, 0x8}, 0x8) ioctl$BTRFS_IOC_SET_RECEIVED_SUBVOL(r0, 0xc0c89425, &(0x7f0000000080)={"4583a6c9298d869e771364938226a3b9", 0x0, 0x0, {0x200, 0x6}, {0xd}, 0x6, [0x7fff, 0x5a2, 0x5, 0x9, 0x4, 0x8000000000000001, 0x3, 0x3, 0x7, 0xe, 0x7fff, 0x1, 0x8, 0x8000, 0x4, 0x7ff]}) ioctl$BTRFS_IOC_RM_DEV_V2(r0, 0x5000943a, &(0x7f0000000380)={{r0}, r4, 0x12, @inherit={0x88, &(0x7f00000002c0)={0x1, 0x8, 0x5, 0x6, {0x0, 0x5, 0x3}, [0x1, 0x8, 0x7d, 0xff, 0x809, 0x0, 0x7fff, 0x4]}}, @devid}) 1.137997883s ago: executing program 5 (id=8088): r0 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="02000000040000000800000001"], 0x50) bpf$MAP_CREATE(0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="220000000400000010"], 0x48) r1 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="04000000040000000400000005"], 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x1b, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r1, @ANYBLOB="0000000000000000b70800000000e7057b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000001600000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x9, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xe8c}, 0x94) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000023c0)={0x0, 0x4, &(0x7f0000000480)=ANY=[@ANYBLOB="18020000000000000000"], 0x0}, 0x94) r2 = bpf$PROG_LOAD(0x5, &(0x7f0000000500)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000280)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x7, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$PROG_BIND_MAP(0xa, &(0x7f0000000240)={r2}, 0xc) r3 = bpf$MAP_CREATE(0x0, &(0x7f0000000200)=ANY=[], 0x48) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_NEW(r4, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000100)=ANY=[@ANYBLOB="640000000001010400000000141a000002000000240001801400018008000100e000000108000200e00000010c00028005000100000000002400028014000180080001000000000008000200ac1e00010c00028005000100000000000800074000000001"], 0x64}}, 0x0) r5 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_NEW(r5, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000300)=ANY=[@ANYBLOB="4c000000000101040d0000000000000002000000240002801400018008000100e000000108000200e00000010c0002800500010000000000140005800e000100736e6d705f7472", @ANYRES64=r4], 0x4c}, 0x1, 0x0, 0x0, 0x811}, 0x0) bpf$BPF_MAP_CONST_STR_FREEZE(0x16, &(0x7f00000000c0)={r3}, 0x4) bpf$PROG_LOAD(0x5, &(0x7f0000000340)={0xf, 0x1c, &(0x7f0000000400)=ANY=[@ANYBLOB="18080000cbb60000000000000000000018110000", @ANYRES32=r3, @ANYBLOB="0000000000000000b702000014000000b7030000000000008500000008000000bf0920000000000035090100000000009500000000000000b7080000000000007b8af8ff00000000b7080000020000007b8af0ff00000000bfa100000000000007010000f8ffffffbfa400000000000007040000f0ffffffb70200000800000018230000", @ANYRES32=r0, @ANYBLOB="0000000001000000b7050000080000001c00000000000000bf9800000000000056080000000000008500000005000000b70000000200000095"], &(0x7f0000000000)='GPL\x00', 0x5, 0x0, 0x0, 0x40f00, 0x8, '\x00', 0x0, @fallback=0xc, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000000}, 0x94) bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0x10, 0x4, &(0x7f0000000040)=ANY=[@ANYBLOB="b4000000000000007910480000000000710421000000000095000000"], &(0x7f0000003ff6)='GPL\x00', 0x2, 0xfd90, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @sk_msg}, 0x48) r6 = bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000280)=@bpf_lsm={0x6, 0x3, &(0x7f00000003c0)=ANY=[@ANYBLOB="18000000003f000000000000000000f195"], &(0x7f0000000140)='GPL\x00'}, 0x80) r7 = bpf$ITER_CREATE(0xb, &(0x7f00000004c0)={r6}, 0x8) epoll_ctl$EPOLL_CTL_ADD(r7, 0x1, r3, &(0x7f00000001c0)={0xc0000018}) close(r7) r8 = bpf$MAP_CREATE(0x0, &(0x7f0000000200)=ANY=[], 0x40) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000001c00)={{r8, 0xffffffffffffffff}, &(0x7f0000001b80), &(0x7f0000001bc0)=r6}, 0x20) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000180)={{r9}, &(0x7f00000000c0), &(0x7f0000000100)=r7}, 0x20) bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f00000002c0)={0x3, 0x4, 0x4, 0xa, 0x0, r0, 0xf3a2, '\x00', 0x0, r7, 0x1, 0x5}, 0x50) getsockopt$nfc_llcp(0xffffffffffffffff, 0x118, 0x3, &(0x7f0000000040)=""/42, 0x2a) r10 = socket$l2tp(0x2, 0x2, 0x73) r11 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r11, &(0x7f00000002c0)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f00000003c0)={0x54, 0x2, 0x6, 0x3, 0x0, 0x0, {0x7, 0x0, 0x2}, [@IPSET_ATTR_FAMILY={0x5, 0x5, 0xa}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}, @IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_TYPENAME={0x10, 0x3, 'hash:ip,mac\x00'}, @IPSET_ATTR_DATA={0xc, 0x7, 0x0, 0x1, [@IPSET_ATTR_TIMEOUT={0x8, 0x6, 0x1, 0x0, 0xafa2}]}, @IPSET_ATTR_REVISION={0x5, 0x4, 0x1}]}, 0x54}, 0x1, 0x0, 0x0, 0x4008051}, 0x4000) setsockopt$SO_TIMESTAMP(r10, 0x1, 0x40, &(0x7f0000000000)=0x4, 0x4) getsockopt$SO_TIMESTAMP(r10, 0x1, 0x23, 0x0, &(0x7f0000000080)) syz_emit_ethernet(0x82, &(0x7f00000005c0)=ANY=[@ANYBLOB="bbbbbbbbbbbbaaaaaaaaaabb0800450000740000000000019078ac1e0001ac1414aa03019078036100004600000000004000002f0009ac141410ac1414bb44440001000086ddffffffffac1414bb00000000ac14143200000000000000000000004fac1e0001000000007f00000100000000ac1414aa00000004e0000001000000009c8eeb1b62ce159c66105f3f9fb7fbb5392d5585394c1d812fb9e9d33fe1c445ed2ff366d637695058c4b2d5b5c69fe4d5a00eb5a36fefdd688bac63946e"], 0x0) 935.526184ms ago: executing program 5 (id=8089): r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$FS_IOC_SETFSLABEL(r0, 0x41009432, &(0x7f0000000200)="0ac35589308c01000000000000003227378cdd536bf3edf3620c00000000000000acf760498759539c307644bf261300000005a86660fed62fe762d5cb65a310cc89c679bafa62d51e06bbd1e2c5f94df89ea4aa76022e2dddda322979ed1d6595091341308bd7d9ccb6320abee0339579c12921a347f4a1f316ad00afd1e7869676439c9226788200a3d1a02843d0cdedd5cdfc92691f8709772784ccb30bc7e84ef5422534e634f9ffffffffffffff2d16bbeaed2e76c47ff70b72703f9aebd440947e4bf880b0b9de2d4612ea245faaec6c6bff33a12e72b988a3051f71c1d6f949ad7ad5af745bf7e2d57cb0beb551d767f99cbe44828297cf58089500") sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f00000004c0)=@newlink={0x4c, 0x10, 0x401, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x18, 0x12, 0x0, 0x1, @geneve={{0xb}, {0x8, 0x2, 0x0, 0x1, [@IFLA_GENEVE_COLLECT_METADATA={0x4}]}}}, @IFLA_IFNAME={0x14, 0x3, 'geneve1\x00'}]}, 0x4c}}, 0x0) r1 = accept4$inet6(0xffffffffffffffff, 0x0, &(0x7f0000000000), 0xc0c00) ioctl$sock_inet6_SIOCSIFADDR(r1, 0x8916, &(0x7f0000000040)={@empty, 0x4a}) 851.829898ms ago: executing program 0 (id=8090): pipe(&(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) vmsplice(r0, &(0x7f00000000c0)=[{&(0x7f0000000180)="77690addcfbe1fbb66ec", 0xff3b}], 0x1, 0x1) ioctl$sock_inet_tcp_SIOCINQ(r0, 0x541b, &(0x7f0000000680)) r1 = socket(0x28, 0x5, 0x0) connect$vsock_stream(r1, &(0x7f0000000080), 0x10) 663.038233ms ago: executing program 0 (id=8091): r0 = socket$packet(0x11, 0x3, 0x300) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x1, 0xe, &(0x7f00000004c0)=ANY=[@ANYBLOB="b702000000000000bfa30000000000000703000000feffff7a0af0fff8ffff1971a4f0ff00000000b7060000080000001e6400000000000045040400010000001704000001000a00b7040000000100006a0af2fe00000000850000001a000000b7000000000000009500000000000000455781a5feee5e1ce784909b849d5550adf200000000000000b61d69f2ffdaa10350e11cb97c8ad51bcda0c4ee6d9674c77404ceb9971e43405d621ffbc9a4fd39b0631f6dde53a9a53608c10556e5734eb84049761471ce540c772e2d9f8004e26f7fcc059c062234d5595f6dba87b81d0806fb0289ce67a66afd9ac3d09e29a9d542ca9d85a5c9c88474895d679838def0a83a733dc6a39b63a5ed69d32394c53361d7480884bd8048a967d9b912ef9f1dcc4ff8546fee53f5b2e7b91c61ced1ebad000000000000e8122a793c080a882add4e1179bd4a44f231b6d753a7be428ba953df4aece69311687f4122073a236c3ad198e3f3a532efa04137d452ff47d2638da3261c8362bb7c7824be6195a66d2e17e122040e11e3bd4a69fc6e8d9f7043e09b9e10dc7777bfae5884e4ba1e9cc4a2bbe99e30816127f46a1aae33d4d63d716c0975e1ce4a655362e7062ff6ab3934555c0184021b829472adefa06d3482c7b2711b98eabdca89b77efd13e6dba4a431ce47910000118093b6cabaa17a57727474e1785ee234835088445aa4a9b677d3d342640e328504aea02a2d727e62b7f097a02dbf8fe1d704765de7482040b2fc3000000000000000008947baeaaf954aff687deaa2f80492461d273ee26d8115cbca081a14cba24788779291745083fccdddc90d7af35c528df8000000d8d79c79ddca066da478c197d4a550470557bc99cca336bd88cd28a5ee651627e3a6fbf6ea53b95ddb64c69c7d8d2f4baddc239828760459564124bad68209d2a1d16ad085886c017679cfcda8b1e152ac1e2bcc5ede5b5687aa418abfa29acd7339e73b2cd185c9eb5fb34fccd20ffa155b16c0c309ed6f6663677df37de0ec0d0f548b273940be5d1fe0bae14d1a76bf741330dacd9cc19c0163bcc93059e8d2d1bfa928e2ba458ecd989cb3581a3f270ad48255ac0dad4923e3e36629589ff6b0ceb3438e4b432dd454c04be2d538aaf60c9f7a7281d32142f2fdbc3d37e5a072b5d7f0a349f1a75f01b5c203d4bdde6ff12de9a37f7fb9a16059ad97e2edefb5e0b0326bd25f6fd1d108efa9d30a9883815654486fe42cf2f676cdbb91f7582ab314be"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x0, 0x10, &(0x7f0000000340), 0xfffffffffffffe19}, 0x42) r2 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000001d80)=[{&(0x7f0000000100)=ANY=[@ANYBLOB="340000002e0003050000000000000000200000f8ffffffffffffff0008000000", @ANYRES32, @ANYBLOB="0c000f"], 0x34}], 0x1}, 0x0) setsockopt$sock_attach_bpf(r0, 0x1, 0x32, &(0x7f00000008c0)=r1, 0x4) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup/syz1\x00', 0x1ff) r3 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) openat$cgroup_subtree(r3, &(0x7f0000000200), 0x2, 0x0) unshare(0x22020400) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000500)={'veth1\x00', &(0x7f0000000200)=@ethtool_per_queue_op={0x4b, 0xf, [0xa, 0x1, 0x7fff, 0x1, 0x4, 0x9, 0xa4, 0xffb, 0x7, 0x1, 0xc1, 0x4, 0x1, 0x3, 0x0, 0x101, 0x1000, 0x9, 0x3, 0x3, 0x1, 0xfffffffa, 0x1, 0x6, 0x9, 0x4, 0x5, 0x5, 0x100000, 0x762, 0x3, 0x10, 0xe, 0x2b12, 0x100, 0x6, 0x1c02, 0xb, 0xfda, 0xbed4, 0x8, 0x8000100, 0x3, 0x0, 0x11000, 0x8, 0x5, 0x79b, 0x2, 0x1, 0x7f, 0x4, 0xa, 0x7, 0xf, 0x101, 0xd7, 0x1fa0860a, 0x7, 0xaa, 0x81, 0x2, 0x180000, 0x4003, 0x8b, 0x5, 0x2af, 0xf7, 0x5, 0x2, 0x6, 0x9, 0x4, 0x7, 0x4009, 0x5, 0x4, 0x100002, 0x8, 0x752, 0x0, 0x3, 0x0, 0x10001, 0x2, 0xffffffff, 0x6, 0x6, 0x9, 0x80000000, 0xfdffffff, 0x2, 0x2, 0x84, 0x100, 0x5, 0x252, 0x81, 0xb, 0x5, 0x20006, 0x5, 0x2, 0xb, 0x2, 0xd9a, 0xd, 0x2a2, 0xfffffffd, 0x3, 0x2, 0x5, 0x8, 0x3, 0x4, 0x2, 0x40, 0x8, 0x4, 0x4, 0x401, 0x66cd, 0x8, 0x6, 0x1, 0x1fc, 0xc5c, 0xffffffff]}}) poll(&(0x7f0000000000), 0x20000000000000b5, 0x9) r4 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r4, &(0x7f0000000600)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000300)="200000001100818804", 0x9}], 0x1}, 0x0) 632.630597ms ago: executing program 5 (id=8092): r0 = socket(0x2b, 0x1, 0x1) setsockopt$inet6_IPV6_RTHDR(r0, 0x29, 0x39, &(0x7f0000000080)={0x0, 0x2, 0x2, 0x1, 0x0, [@mcast2]}, 0x18) setsockopt$sock_timeval(r0, 0x1, 0x15, &(0x7f0000000000)={0x0, 0xea60}, 0x10) connect$inet6(r0, &(0x7f0000000040)={0xa, 0x0, 0x0, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02'}, 0x1c) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32, @ANYBLOB="0000000000000000b70800000d0000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000740)=ANY=[@ANYBLOB="0b00000005000000000400000900000001"], 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0xa, 0x4, &(0x7f0000000480)=ANY=[@ANYBLOB="18000000000000000000000000000000850000006d"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r2 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000d80)={0x18, 0x5, &(0x7f0000000480)=ANY=[@ANYBLOB="1801000021"], 0x0, 0x40, 0x0, 0x0, 0x0, 0xb4a02fe0ce239f93, '\x00', 0x0, 0x2}, 0x94) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0xe, 0x0, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000800000000000000000000018110000", @ANYRES32=r1], 0x0, 0x0, 0x0, 0x0, 0x41100, 0x59, '\x00', 0x0, @fallback=0x2a, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, r2, 0x0, 0x0, 0x0, 0x0}, 0x94) r3 = bpf$PROG_LOAD(0x5, &(0x7f0000000300)={0x6, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback=0x4, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000180)={r3, 0x2000000, 0xe, 0x0, &(0x7f0000000040)="630b008646dc3f0adf33c9f7b986", 0x0, 0xcf25, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x80}, 0x50) socket(0x28, 0x0, 0x28) r4 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$IP_VS_SO_SET_ADD(r4, 0x0, 0x482, &(0x7f0000000080)={0x11, @loopback, 0x15, 0x0, 'wlc\x00', 0x39, 0x6, 0x1f}, 0x2c) r5 = socket$netlink(0x10, 0x3, 0x0) r6 = socket$inet(0x2, 0x3, 0xa) setsockopt$inet_mreqsrc(r6, 0x0, 0x27, &(0x7f0000000280)={@multicast2, @local, @remote}, 0xc) r7 = socket$inet(0x2, 0x3, 0x2) setsockopt$inet_mreqsrc(r7, 0x0, 0x27, &(0x7f0000000040)={@multicast2, @local, @loopback}, 0xc) setsockopt$inet_msfilter(r7, 0x0, 0x29, &(0x7f0000000180)=ANY=[@ANYBLOB="e0000002ac1414aa0100000002"], 0x18) syz_emit_ethernet(0x36, &(0x7f0000001800)={@link_local, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x32}, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x28, 0x64, 0x0, 0x4, 0x2, 0x0, @empty, @multicast2}, @timestamp_reply={0x11, 0x0, 0x0, 0xe000, 0x2, 0x10001}}}}}, 0x0) r8 = socket(0x27, 0x2, 0xffffffff) ioctl$sock_kcm_SIOCKCMUNATTACH(r8, 0x89e1, &(0x7f0000000080)={r5}) sendto$inet(r4, 0x0, 0x0, 0x200007fd, &(0x7f0000000180)={0x2, 0x14, @dev={0xac, 0x14, 0x14, 0x16}}, 0x10) bpf$PROG_LOAD(0x5, &(0x7f00000054c0)={0x3, 0x16, &(0x7f0000000780)=ANY=[@ANYBLOB="61123000000000006113340000000000bf20000000000000160003000ee600f03d030100000000008701000000000000bc26000000000000bf67000000000000560300000ee60070670200001f000000160300000ee600f0bf050000000000000f610000000000006507f4ff02000400070700004c0040001f75000000000000bf54000000000000070500000300f9ffad430100000000009500000000000000050000000000000095000000000000004d9bd591d568253e9988431ec068e3a82983d58719d72183f2cb7f43dd55788be820b236dcb695dbfd737cbf719506d2d6b05fe7030586e3f640f9f7e9a73b761ad4f0952a70046270d2b6436fdeecd791614ed46de741eb8cf91c046ef9beca574b350021c7ec6ef130f53748068ca432dae4e248b22b9ad8b2811f67916a1764578cba4b069037bfb3362d5691ac397f7e207145d970f0d97867552629b146645c785fb77dbeca38e49a9d5221f1f45f0a25890d04d91a15a05ae7e7ed6252c3d6c1973fb858de1da70d67317e7872b0603ce47ed2c1520e71b527bb42aa2e20e1e85df73736ed0a782ab7e7278dd54358cfdf6313d40f926332623625b49626481054787ab2dff85a9bebd6b317f26c691a65aa97bb3d1506a3a565e9c7ea5ad4611d2d77ee8a5c1b23814a26b6a20061fbb65bdd03770fa849f2a29ba69f90625f42592a70ba890f7a92878ae73574c3a233ee5954119931a1905210715fa77a8795f2fbec3797cb90f59fe8a4abec25f40c87bf25b750bbaa"], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x40f00, 0xc, '\x00', 0x0, @sched_cls=0x2f, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x10, 0xffffffff}, 0x94) 403.415199ms ago: executing program 1 (id=8093): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$ETHTOOL_MSG_COALESCE_SET(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000000)={0x2c, r1, 0x1, 0x0, 0x0, {0x10}, [@ETHTOOL_A_COALESCE_HEADER={0x18, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'veth0\x00'}]}]}, 0x2c}}, 0x0) r2 = syz_genetlink_get_family_id$nl80211(&(0x7f00000000c0), r0) sendmsg$NL80211_CMD_SET_PMKSA(r0, &(0x7f00000001c0)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x2000}, 0xc, &(0x7f0000000180)={&(0x7f0000000100)={0x7c, r2, 0x200, 0x70bd28, 0x25dfdbff, {{}, {@void, @val={0xc, 0x99, {0x22, 0x50}}}}, [@NL80211_ATTR_PMK_REAUTH_THRESHOLD={0x5, 0x120, 0x3c}, @NL80211_ATTR_MAC={0xa, 0x6, @from_mac}, @NL80211_ATTR_MAC={0xa, 0x6, @random="e5a66289599d"}, @NL80211_ATTR_SSID={0x22, 0x34, @random="4967ddc851eeac2e26bf8e907ced97dc46b8e0d3cb50bb484610e4e4d043"}, @NL80211_ATTR_MAC={0xa, 0x6, @from_mac}, @NL80211_ATTR_SSID={0xa, 0x34, @default_ibss_ssid}]}, 0x7c}, 0x1, 0x0, 0x0, 0x40881}, 0x40031) socket$nl_generic(0x10, 0x3, 0x10) (async) syz_genetlink_get_family_id$ethtool(&(0x7f0000000040), 0xffffffffffffffff) (async) sendmsg$ETHTOOL_MSG_COALESCE_SET(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000000)={0x2c, r1, 0x1, 0x0, 0x0, {0x10}, [@ETHTOOL_A_COALESCE_HEADER={0x18, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'veth0\x00'}]}]}, 0x2c}}, 0x0) (async) syz_genetlink_get_family_id$nl80211(&(0x7f00000000c0), r0) (async) sendmsg$NL80211_CMD_SET_PMKSA(r0, &(0x7f00000001c0)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x2000}, 0xc, &(0x7f0000000180)={&(0x7f0000000100)={0x7c, r2, 0x200, 0x70bd28, 0x25dfdbff, {{}, {@void, @val={0xc, 0x99, {0x22, 0x50}}}}, [@NL80211_ATTR_PMK_REAUTH_THRESHOLD={0x5, 0x120, 0x3c}, @NL80211_ATTR_MAC={0xa, 0x6, @from_mac}, @NL80211_ATTR_MAC={0xa, 0x6, @random="e5a66289599d"}, @NL80211_ATTR_SSID={0x22, 0x34, @random="4967ddc851eeac2e26bf8e907ced97dc46b8e0d3cb50bb484610e4e4d043"}, @NL80211_ATTR_MAC={0xa, 0x6, @from_mac}, @NL80211_ATTR_SSID={0xa, 0x34, @default_ibss_ssid}]}, 0x7c}, 0x1, 0x0, 0x0, 0x40881}, 0x40031) (async) 402.59514ms ago: executing program 3 (id=8094): r0 = socket$vsock_stream(0x28, 0x1, 0x0) setsockopt$sock_int(r0, 0x28, 0x2, 0x0, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000080)=@newlink={0x44, 0x10, 0x401, 0x70bd2a, 0x0, {0x0, 0x0, 0x0, 0x0, 0x21, 0x10128}, [@IFLA_LINKINFO={0x24, 0x12, 0x0, 0x1, @bridge={{0xb}, {0x14, 0x2, 0x0, 0x1, [@IFLA_BR_MCAST_ROUTER={0x5}, @IFLA_BR_GROUP_FWD_MASK={0x6, 0x9, 0xfffb}]}}}]}, 0x44}, 0x1, 0x0, 0x0, 0x400c824}, 0x0) (async) syz_emit_ethernet(0x3b6, &(0x7f0000000680)={@local, @broadcast, @void, {@ipv6={0x86dd, @icmpv6={0x0, 0x6, '!\x00', 0x380, 0x3a, 0xff, @dev, @mcast2, {[], @ndisc_ra={0x86, 0x0, 0x0, 0x0, 0x0, 0x19, 0x300, 0x2000000, [{0x5, 0xa, "a78ce5400659808000000000004023493b87aafaffffffffffffff23732472eefa45ad96579269748e254c1e4a8a8b3f0ab0c430d3be27df3e34066d42ca0a5c15b37adac15084dbaf736b41e5af1802"}, {0x0, 0x1, "000000000000001991319c00"}, {0x19, 0x18, "fe906d26efe39393fe08f73eabc5977b1190a3a6ad8338f1511cdd10c35d8f6de79fc7fd175f75649fa368a32c829af02d7f44d92324a7051e460a13ddde27a5b85b9d930914625d8a049b4cf0d129806a610ad8467a6b2600000000000055a6653d0363a979acf93f88eea07d68423e90280409de1657275f716a2bf2915d1783e8eb477b0d1170f0ecbdef5523e1b76e9ab3d2fbe4b34438d2a77577edd0ebed9682b851b380ae0cab282af9d7ebe668177704c5fd4698c934de4731f3f61effc978"}, {0x0, 0x1d, "06aa85616177c61bc943afcb84619755403946b0730a18d5c38cf7dcad830f2dc8674b87ba8b58f81ece27975cc39e595e9af90b4fe92a38d25551c2d9ebfc5dfc5a2a501b7e483de3f808895c5f4a1a2367bc591dd8b094822ff0822a18989f7c5eba31fb68b2d734a6671e27182aee4df24a4a5c6186c0d3baa75af390dab23b500b0c0272479611e4f7f4299ec4d926d443367b105185e6ecd9602ba95392343e9bbd047ef6bc1ba42399907ccd0a562db212baa39eb8164e240069f656d3a05fecf894222a141123f5acaa556b9f30dcab2b90aa235a670670ffc5dc49dfb58d89310000000000"}, {0x0, 0xb, "d47ae6e8805d4809c20547406b18901b0aeff04c0300f3c75dc2d227a83b89483b1084743475671545e65eb2e9ac946a3f0e2bc4619f91394c02bcfbbb7d71138537d68e2d2c6393a9f3becd1a9f51a948b5b303f4f003"}, {0x21, 0x7, "fcf98a102ec1876d4e6fa3b20519bbaa8a029cee00b8d3485e3b63ed09bdb581c9fe68a356f542b01b9387f85932e740e077e1d16212fb"}, {0x0, 0x14, "5e14f0e74d2d42cfb3f27fafb60845f90b6dfc87c6905bbc94d33e1ea71a28105f543e868a8a53b360a9d33e2b1e26eb1d18065daa76ffff9ef083611c9f6ae2e1eb3d8bf9c6ab2642c4828288e62afbf03269f1f98aea6a58cf45d7c5fdaabc2c676d8800871a6aa54155dea2d995cb22c9924e0ad38c6967052cc7786d779b8353aac33a57d79b05613a12328f61129017fb632dbf04542188b196e213408c258a6f"}, {0x0, 0x5, "d5170000dce9674a36da018dff16e70b8b14c4b7a94fe18e88605aa6be1a02c226a6bce65f81ed"}]}}}}}}, 0x0) (async) r3 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r3, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000340)=@newlink={0x3c, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0xffff}, [@IFLA_LINKINFO={0x1c, 0x12, 0x0, 0x1, @xfrm={{0x9}, {0xc, 0x2, 0x0, 0x1, [@IFLA_XFRM_IF_ID={0x8, 0x2, 0xea}]}}}]}, 0x3c}}, 0x0) (async) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000080)=ANY=[@ANYBLOB="98020000110001040000000000000000000017ff", @ANYRES32=r1, @ANYBLOB="000004000000000024001280090001007866726d000000001400028008000200020000000800020001000000140003007866726d30", @ANYRES16=r1], 0x298}}, 0x0) r4 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) (async) r5 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r6 = syz_genetlink_get_family_id$nl802154(&(0x7f00000003c0), r5) ioctl$sock_SIOCGIFINDEX_802154(r5, 0x8933, &(0x7f0000000000)={'wpan0\x00', 0x0}) sendmsg$NL802154_CMD_NEW_SEC_DEVKEY(r5, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000540)={&(0x7f0000000280)={0x54, r6, 0x1, 0xfffffffd, 0x0, {}, [@NL802154_ATTR_IFINDEX={0x8, 0x3, r7}, @NL802154_ATTR_SEC_DEVKEY={0x38, 0x2f, 0x0, 0x1, [@NL802154_DEVKEY_ATTR_ID={0x20, 0x3, 0x0, 0x1, [@NL802154_KEY_ID_ATTR_MODE={0x8}, @NL802154_KEY_ID_ATTR_IMPLICIT={0x14, 0x3, 0x0, 0x1, [@NL802154_DEV_ADDR_ATTR_MODE={0x8, 0x2, 0x3}, @NL802154_DEV_ADDR_ATTR_PAN_ID={0x6, 0x1, 0xffff}]}]}, @NL802154_DEVKEY_ATTR_EXTENDED_ADDR={0xc, 0x2, {0x5555555555550101}}, @NL802154_DEVKEY_ATTR_FRAME_COUNTER={0x8, 0x1, 0xfffffffc}]}]}, 0x54}, 0x1, 0x0, 0x0, 0xd49920d352514f42}, 0x4000000) ioctl$sock_SIOCGIFINDEX_802154(0xffffffffffffffff, 0x8933, &(0x7f0000000200)={'wpan0\x00', 0x0}) r9 = accept4(r2, 0x0, &(0x7f0000000400), 0x800) connect$inet(r9, &(0x7f0000000440)={0x2, 0x4e20, @private=0xa010100}, 0x10) (async) ioctl$sock_SIOCGIFINDEX_802154(0xffffffffffffffff, 0x8933, &(0x7f0000000240)={'wpan0\x00', 0x0}) (async) bpf$MAP_CREATE(0x0, &(0x7f0000000000)=@base={0x3, 0x4, 0x1, 0xbf22}, 0x50) (async) ioctl$sock_SIOCGIFINDEX_802154(0xffffffffffffffff, 0x8933, &(0x7f0000000280)={'wpan0\x00', 0x0}) sendmsg$NL802154_CMD_SET_ACKREQ_DEFAULT(r4, &(0x7f0000000380)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000000300)={&(0x7f00000002c0)={0x38, r6, 0x100, 0x70bd2d, 0x25dfdbfd, {}, [@NL802154_ATTR_IFINDEX={0x8, 0x3, r8}, @NL802154_ATTR_IFINDEX={0x8, 0x3, r10}, @NL802154_ATTR_IFINDEX={0x8, 0x3, r11}, @NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x200000002}]}, 0x38}, 0x1, 0x0, 0x0, 0x810}, 0x0) (async, rerun: 64) r12 = socket$phonet(0x23, 0x2, 0x1) (rerun: 64) ioctl$sock_proto_private(r12, 0x89ee, &(0x7f0000007880)="0ecd") (async) ioctl$sock_SIOCGIFINDEX_80211(r3, 0x8933, &(0x7f0000000180)={'wlan1\x00'}) (async) ioctl$F2FS_IOC_MOVE_RANGE(r1, 0xc020f509, &(0x7f0000000000)={r3, 0x8, 0x4, 0x1}) close(r13) write$cgroup_subtree(r13, &(0x7f0000000100)={[{0x2b, 'cpuacct'}]}, 0x9) 393.986851ms ago: executing program 0 (id=8095): r0 = socket$nl_route(0x10, 0x3, 0x0) socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000140)=ANY=[@ANYBLOB="4000000010009d04000000525bdbdf2500000000", @ANYRES32=0x0, @ANYBLOB="d4d00000500000001400128009000100626f6e6400000000040002800a0001000000000000000000"], 0x40}, 0x1, 0x0, 0x0, 0x2000400a}, 0x0) sendmsg$nl_route(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=@newlink={0x3c, 0x10, 0x403, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x1c, 0x12, 0x0, 0x1, @bond={{0x9}, {0xc, 0x2, 0x0, 0x1, [@IFLA_BOND_UPDELAY={0x8}]}}}]}, 0x3c}, 0x1, 0x2000000000000000}, 0x0) 316.482734ms ago: executing program 2 (id=8096): r0 = socket(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000080)={0xffffffffffffffff, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=@ipv6_newnexthop={0x24, 0x68, 0x1, 0x0, 0x0, {0x2}, [@NHA_BLACKHOLE={0x4}, @NHA_OIF={0x8}]}, 0x24}}, 0x0) r1 = socket$inet_sctp(0x2, 0x5, 0x84) r2 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000340)={0x20, 0x10, 0x701, 0x0, 0x0, {0xa}, [@typed={0xc, 0x2, 0x0, 0x0, @str='nl80211\x00'}]}, 0x20}}, 0x0) r3 = socket$inet6_sctp(0xa, 0x1, 0x84) getsockopt$inet_sctp6_SCTP_MAX_BURST(r3, 0x84, 0x83, &(0x7f0000000000)=@assoc_value={0x0}, &(0x7f0000000240)=0x8) getsockopt$inet_sctp_SCTP_PR_ASSOC_STATUS(r1, 0x84, 0x73, &(0x7f00000003c0)={r4, 0x0, 0x10, 0x0, 0x9}, &(0x7f0000000380)=0x18) setsockopt$inet_sctp_SCTP_SET_PEER_PRIMARY_ADDR(r0, 0x84, 0x5, &(0x7f0000000040)={r4, @in={{0x2, 0x4e23, @loopback}}}, 0x84) r5 = socket$nl_route(0x10, 0x3, 0x0) r6 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) ioctl$TUNSETIFF(r6, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x2}) r7 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) close(r7) socket$nl_generic(0x10, 0x3, 0x10) ioctl$SIOCSIFHWADDR(r7, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) r8 = socket$kcm(0x11, 0x3, 0x0) r9 = socket$unix(0x1, 0x5, 0x0) ioctl$sock_SIOCGIFINDEX(r9, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) setsockopt$sock_attach_bpf(r8, 0x107, 0xf, &(0x7f0000000600), 0x56) sendmsg$kcm(r8, &(0x7f00000000c0)={&(0x7f0000000580)=@xdp={0x2c, 0x0, r10, 0x3e}, 0x80, &(0x7f0000000080)=[{&(0x7f0000000180)="27030200affd14000600002fb96dbcf706e10500000086ddffff1144ee1611d4b8bf4a31accb", 0xfdef}], 0x1}, 0x0) sendmsg$nl_route(r5, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000003c0)=ANY=[@ANYBLOB="40000000100001042dde0000000000", @ANYRES32=0x0, @ANYBLOB="00000000000000002000128008000100736974001400028008000200ac14141b06000e0000020000"], 0x40}}, 0x0) socket$nl_route(0x10, 0x3, 0x0) r11 = openat$tun(0xffffffffffffff9c, &(0x7f0000000140), 0x48241, 0x0) socket$kcm(0x10, 0x2, 0x4) ioctl$TUNSETIFF(r11, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x6bf1c2d5adba8c32}) socket$nl_route(0x10, 0x3, 0x0) socket$unix(0x1, 0x3, 0x0) r12 = socket$alg(0x26, 0x5, 0x0) setsockopt$ALG_SET_KEY(r12, 0x117, 0x1, 0x0, 0x0) 151.827309ms ago: executing program 5 (id=8097): socket$igmp6(0xa, 0x3, 0x2) r0 = bpf$PROG_LOAD(0x5, &(0x7f0000000040)={0x2, 0x4, &(0x7f0000000200)=ANY=[@ANYBLOB="180000000300000000000000feffff10850000000700000095"], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x100, 0x70, '\x00', 0x0, @fallback=0x30, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r1 = bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f0000000180)={r0, 0x0, 0x30, 0x0, @val=@uprobe_multi={&(0x7f00000002c0)='./cgroup/cgroup.procs\x00', &(0x7f0000000300)=[0x0], 0x0, 0x0, 0x1}}, 0x40) bpf$ITER_CREATE(0x21, &(0x7f0000000540)={r1}, 0x8) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x5) close(0x4) syz_open_procfs$namespace(0x0, &(0x7f0000000040)='ns/cgroup\x00') mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f07ebbeef, 0x8031, 0xffffffffffffffff, 0x215eb000) shutdown(0xffffffffffffffff, 0x1) r2 = socket(0x8, 0x3, 0x3) r3 = socket(0xa, 0x3, 0xff) sendmsg$inet6(r3, &(0x7f0000000080)={&(0x7f0000000140)={0xa, 0xa, 0x0, @private2={0xfc, 0x2, '\x00', 0x1}}, 0x1c, 0x0, 0x0, &(0x7f0000000040)=[@flowinfo={{0x14, 0x29, 0xb, 0x14}}], 0x18}, 0x922bac8556bda5ce) setsockopt$inet_mreq(r3, 0x0, 0x3, 0x0, 0x0) ioctl$sock_inet_tcp_SIOCINQ(r2, 0x541b, 0x0) 0s ago: executing program 1 (id=8098): r0 = socket(0xa, 0x5, 0x0) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000000), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f0000000100)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_SET_INTERFACE(r1, 0x0, 0x0) sendmsg$NL80211_CMD_DEL_INTERFACE(r1, &(0x7f0000000800)={0x0, 0x0, &(0x7f0000000900)={&(0x7f0000000840)={0x1c, r2, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r3}, @void}}}, 0x1c}}, 0x0) getsockopt$inet_sctp_SCTP_LOCAL_AUTH_CHUNKS(r0, 0x84, 0x1b, &(0x7f0000000940)={0x0, 0x1000, "7f41eda5e80038623cb4951575a4e1950b0c81840463ab9ae908e2722e658ac7331852e47ebb4ee4c1f713b32d305ee78d594b76eb9d399aa9c498018e42e600a8f18fc5770dec62b36883d1fde68576e7245e68a5c1de25efbdf93abaae30897f5a1c0261528de1503bacc2fa14a31fc2edc2dc4b2cc32080939107a927d990bf1fe6b178a6a6d0643e989b904288960798d8d82bb3e4230ec62c05732ae4397a46917f3205b0c33793eb1f796c0fd83ea2be28385660e7b43763e17dacc1f51f2e89c5bc7bbbe54aa56c7ac15f0f39677850bf528fb69b211b9e026aaed3ebc75b3bb6b1b6fa717ffed937e6bf3b257bec798848d3c618e860d0c387323356502975bde2de90377690337a74d5dd06b9b9200d3ff486d3505bfacf801b32d17d09f85ab0ab59fcdfb3e8f403b1fb8d8f0698f9399ca3889387b42f6e2ec7b97eaecae98ff50ecf49dab7cd3e3af8a1c94b77205e39dc598254d0e74529d98386060d759fbad144c434fe5c3608a32734c6f93843caaf338e414e4a0159b24ad2dba886fa629803dc0a632cbc858dadac05faccab966d830b17279e19b6a81f76e1d29b799b6d67834aecc803826842f848e0cb44261461846d76f8a1e2869865caa2ce56c559665199b7e3310f090ff23bc4fc5d1c87ba4391052fa04c7ac21274204810474718b901019284814161231902ef4b7abccf995a2b63bfb550abab3c89806035f80fce7660abb238d0bde7cf09f40ff108d699a242a653fd7f68daf534650f7b830f7ba3132be4a33e6f8824d423ec6646d465ea77cf70f8a97e7d66f496bb290d520f18dd63ebadb298358fc331f063c3ed8fafed2e8fe53877e2b6f05f21979c190d176a458b27bee48f078b12d84b54ba4ca7a62cc2c1d0d64087ab78f391ae702aa1f47c7b60403fa31d52942333fc41c7750cf26ea285369f3cca71d998f920ec8fe824849f2d8f44d54a775d58c05c257d85a676330ce79c144b411dd108649d302f700d4401488627a7edfa1ae6dafae3a1600b0b9fc92fd8ed3da204ecebf9dc2d957128e3825beb4c4cfcf46a56dee60674bd69babca8b49834f4fb3ef4628579a5d0ce8e8f4e6964c1d7c11cad463258dd57742defec7094c570cbd7537b061d03066337e7e02ab587f4c516a42b19a57dd9b78f06cac4da86dae7d8c6d23e225d8eac1d256af6ef3d698242f6b2e0db64951e0402c1aa4da50f809b397dc32a62036cecf23103c33053a76aed7508e7ea61bef83bee87613bbd3248346e359caadebd4e5fdcd980e414971a41f8dfd163aa4219beee6e07e28a3202461c7e434a2c67434e81165c29abb6f17b75bd762e4d5e22b396524aea322e9c859024d9bbaf195b41ad964d8f0ccc0496a5ec7b31c9bf8fd3242faea150921dc3e55d0f5de699b84ccf29a498d41088f803207a464c19485a632d86c6e76a5ceea1caae0af725abb3058880dd5b085dc261d87d1a875666f359f137bb8731286e47fe1689ed6183202bb16df1e2f7861ae48135be5080254a5c0073c5ce3cded0a62cac2afe1b19b31fcdb3260196b77220fea2e112de58c862f37750726291116d128b8e9c66dcebd1cb9e5d97185734dcbf697d6083d5c6e86668d3abd6b7e6908834cb8e9f2d8160c3ab4ea20406ad1ee5040da2883bcbc5d16f3c0e22e92959d542bc105dda4e4eb19ff7454d1f92f509add22f65df260472767dc148cfff93df0302550c43b2bb2165233587e9e92c37509b7d7fef9cc8590e4120ba3d2f379a68f69109ff32f077c3d1d54cd4e539f1507e006bcf5788999b7d31cd317488eb45ffe67aa98d2faea5e31ea8c6816b2671243e040c47c851ca9eae636dfaf390498a5f899fed1b01df32d66d0b2251e85e21958d2ab2f818ee0ff6cfe37ff61216a7e733028035a84d6fba3992bcb6ada16993b9d8c168b802a8213f8b1af79aa373b0a16da732c6b54e118f10d843c5f0e302ca55c85b66910e296f6bd33afac36fe0976bb5f19eed5d99c27be2ff36050e831ea6f8453a4985367acbd8ec414392b9c0ada5c2b50fd9be50189c093439d8da14609bf99c56af78e0879c55206cb13f1b58102ac8a2c9252b3644077aca64c14e4831391d5c22557dbb581ec8e12f58ccdecc75493d22d83afb350f09fd1238aac8eda1f8594d03d792f0647c3b7ce643ba516ee5c347342248a631ff19925d082e3fdf7a98d812bb2d57a545e2203e9945bade16e0d66ab3f913e76fc1124aee5dc41cc9a32fc5f430f080614644ba4dd9f9dc9db1c21f7ec8e6a0715963c02f8d66aebc6f35da1628338765b8998f3e6ddd49e8955db17f02ecf374b52bc91794c7986a823c7f39fe58d6594fde4486ea817ac8587306af89505470b813f005e1c7b66464bc997792220fac6004299cd1c5c5f9614a1cedececd68f225670118910993905823c506185ae95c3d63eb700326698f9eec8cf15635bbf9dcc3414e24077929c4ea0dc11c6cd3b465804efcfa8f4e56cfe275c2bda3e22d684b79498a49ee5854c44c264550b51c50e7013f9179f40ef9e9b226a88fa114f6ae2c56abec4e46284900321db8635026f9fa1bae961449ece5ffca4598ff6e05f9f2e350e13ec580091a8e331ae4f65531c49214d3bdf9b787b99da6ae2d0e046b08aa56293781be29051f251d2e5713fdd6abcbd1453a08ddda0989459f889f69d9c86352e138643c11e79f57d3cff14b56904b0c9779d59a98b5b4f41357ae46b6f39e39a68d84e43ea2f80636b179f46f286177003d41ef52b3449d0b016f3be025d397dc7a18289a708e4867a02d2f7deb8bcd74e8816114d28a44b9f78c5a194805c98f7a6225d33a2505e1f2e7e64a0cad3de64f036101cbf11fcd34ac976aae715e33d6aa279f335181b81b58f45653a5a59adbe449d5d5e6e8a4529a023d0aef2b3f6ef677f23bfbfa866c28e863ad6948766ae88b0c6482856509ac3bde7d2f407bd67f34c1b55c3227026392b7efaab57510f303b8ddef23aab629efde437c246942d9f500e8a3ee61d4cc68a6adb144757bf4f04d9f72450ec78cf480caa9c37ad2bb3490af83ed93b19c790e257644c0eeaf1f7bb3260643f4e4903122d20796ca7624dda7cdcb187793432456915804b2bf8cd0cd0cff2bdced8cfd45934d3df38ae351e5fbcae8849a5322bdfa622132552028c94fb593ba6ccea8ca65127598a08500fa5fefe9a7dbd4b8b16fa25f16badd2e784f6c016321e8445678038432189aea33ecebd5dd774654870ad0e4488879065df0ca83ed725a1ce75d3935e2ffb95fee30d034d1b68572302158aade4b73694861b7e4633f7a3697b4d2623b54e65c18d15649ca99eb28c8fc6d974bc8f5078f593e5f9f5ddcdc3229990dc9e54f3a0e2e943ffbad2b1f7fbd6023532c8c2ba97845035882e8cf4299ff8aadc4f5226b57e5a525b177003f60be0d57b8bb0ed648734b99bb9f6c5f06b51a40f7b99daece0b0ca926a932460690014e523fb27445eac91ce2abfd7a7fd8e9b2ebc49bf5da3b464fcac428c916d87736d164fcdb2b9b5387ee641b9610dbaa856e6717c81123758505c36ee3c70c8c4b23493ac5fe733787ee82c846fb062fd3faf970167e861d8b679110a5dd7840c6117b5e2ec0e7ed3519676c281ed75afc7112f98496587ab11cf04598a4c221c754149bda32eac7c13bcfdd77f9a0d31d041ebd9e5e53aadc497976d3c5ab2175ac56a24d38ae8ae6520499aa1730444163582859111159a883a43081e7b464f213bb1510e6d2e6da0dea260eaafccf29db2eb817a40eb12c40f696288b006a6328c169b4f0bcef41618ff42f8fdc948c9c7a605b187f85bf3c737f07148bd60d44b0878cc278c1269904fcbe7a6fd2db4363186662b7bf95858959aebee544dea339541e4ad8f2d3345b8ec28c81ab326b620480b8bf4ceff0ec9991ead1ca59a4ea1a3dde65186a2536e630fb6dd7026000f1088116fadadb02d969aeffb8ef60cbb68d15aa530b0854d6a3e30b7bdbb9635159f9a97c87983c25569a3009b02c99dc493a3a12d77fb5babaab2a6ad24c551efbca1c92a3a5e4813d1a58b79dfa22870d0a6fb6dcc48ddffee749dd4a00868a9f390e7c022cb68b948b0b78ccca79b6191394fedc02909b9dcb2da764bb63a955f12ba4ad6f701a576755cb1a9d447729cf9861e0a6778e4b0afd4bcf5984ea3b0b4a87892c9a58f09d17185d7193f9b999680ee38c18b598901245bb4c8ebeb610f2746e51b874ba2e9db30f676f0c90ab6600427e44dbe3ae498319d3d594bbf3e00ea45a448aff8099e963ed6a485cf40459087f5d4ba046f512c2034288e838db0e3f13577cecd0fcbc2932228546e34a23dd86c88d593288a2a4a40cc180c85bfa2ddf311ded8c6a424d30a64e7ce54d215afbb3d2363234c578173451fd6cbfbf189aee9981b737659e2b771b0d6f01a481366e3b7c334a2cb2877a49058317eb2e6dd523ad77281ffeb56eb55b872643856998deaa7bd607e9efb40e5c718e461bcc5839406fece4fb79474ddc40c8fcd06d3ce814083a62df394ad2c58d7a64bb5a2d5b43e63c62e815fbc212d99620e99dc6346020d1688bb5a9fd1acae3109297cc9a9d5d05046976619f958907dc724887c71fa6fdb78e2e2f76b09f5c925139147d56f418acbbdb3d9a8578e33170244e740acc151685ee4dc550cc89b3958bee64502c1d0267729acf5b60fa01a7340015f74ca3d7ff8c4a88e7fea2dfb966d0774c3e876755de081b1c69bb3f2e796e03aa7f379cbdbf3526f73c323d22478545bd180c9e6a62317220527529d44f812f84ff8e39c5af1c7f9c2459ec7f940fd7ea6bfc299d8e3e075ebfd622f373348916a8e303c95206b8af04f3addbc18eef68ea85862483cbfd48868465c5c18702e46acacf2150983307e8d36c92c4fe79f26ccfd86cf1b057dd35344739492a1c429db376737ea09b0b2145985d90295abf7ba9ae23057bc300afc9cf2323235a65caf469bfcd1fb790c13da53be262df2e65620854c295594649013d38d8b75f78544fd7f630c568a5cff07c5e0a7d3f0121e4629829e8075ec8db7d4fae3187047271d85ee62150e05dd568636fb8ba34850fa33f5e98eb244e0ee55dfe32b41585c1914b2b62b41f0c785f8973045d8434589b8a1807922afb853abc8f83258cb23acea1bceb19ab0b60b43d3bcc6df081abb76bf8246362e65827634811590a731e90cd9a5fcecfbaaa03f22491120570eb20346fa0739dfc265ea98f93c511ada00dad68d5b969f845ad00a46b18ca2bc068eaa87b95a2199d649301007abd3c99725fd74ac5daf51052a50e6cc7837aada22bd2240c122174db01e67ec3d69573838de703d8448ef5d59b7b6c63ba42afffe3070aec0859be0e1278da86d768d84131afa56ad6c0bdbc9756240b35b4c737fdf202d8423bf0ea0a243eed6fe29a70284216f2d241d96e050c48ded40976db4eb085c6d9e82a57b0eb26d851224c9dd16ed5497a80e0602e626b99b82e328d6c78c5f82cf23de883c7e71f29995ade79c7ed585eb4bf1ac69af3e351a9c4a2313c7c467aa50d17f84d41b3ba9459ab33b6711c6205b6019e33bf5d9781ea747ec5b56c387ae9d87d60283b813d0d98ef799697bfd02958a62ed550ed1e3c1a6fdedb061bdf1229fc81c3f01848559608072817c9fbf61cf8a2d8fae6b96626f09dde9985b11803d5d9878370667e6704329ac30115df409c90d5e7be5c2b981759d45c5ed8f4bba7228e40de851"}, &(0x7f0000001980)=0x1008) sendmsg$inet_sctp(r0, &(0x7f00000000c0)={&(0x7f0000000000)=@in={0x2, 0x4e20, @private=0xa010101}, 0x10, &(0x7f00000002c0)=[{&(0x7f0000000040)="1b", 0x1}], 0x1, &(0x7f00000019c0)=[@dstaddrv6={0x20, 0x84, 0x8, @local}], 0x20, 0x4845}, 0x24000052) kernel console output (not intermixed with test programs): tman_adv: Cannot find parent device. Skipping batadv-on-batadv check for gretap1 [ 708.419166][T32276] batman_adv: batadv0: Adding interface: gretap1 [ 708.419182][T32276] batman_adv: batadv0: The MTU of interface gretap1 is too small (1462) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 708.419209][T32276] batman_adv: batadv0: Interface activated: gretap1 [ 708.500082][T32285] netlink: 24 bytes leftover after parsing attributes in process `syz.2.6514'. [ 709.106521][ C0] IPVS: sh: UDP 224.0.0.2:0 - no destination available [ 709.115225][T32287] macvlan0: entered promiscuous mode [ 709.274299][T32304] netlink: 'syz.1.6520': attribute type 3 has an invalid length. [ 709.443952][T32309] netlink: 'syz.2.6521': attribute type 1 has an invalid length. [ 709.787931][T32334] syz.0.6528: vmalloc error: size 34359742464, exceeds total pages, mode:0x400dc0(GFP_KERNEL_ACCOUNT|__GFP_ZERO), nodemask=(null),cpuset=/,mems_allowed=0-1 [ 709.819052][T32334] CPU: 1 UID: 0 PID: 32334 Comm: syz.0.6528 Not tainted syzkaller #0 PREEMPT(full) [ 709.819078][T32334] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 709.819089][T32334] Call Trace: [ 709.819098][T32334] [ 709.819106][T32334] dump_stack_lvl+0xe8/0x150 [ 709.819140][T32334] warn_alloc+0x24d/0x270 [ 709.819169][T32334] ? kasan_save_track+0x4f/0x80 [ 709.819221][T32334] ? kasan_save_track+0x3e/0x80 [ 709.819242][T32334] ? __pfx_warn_alloc+0x10/0x10 [ 709.819264][T32334] ? __x64_sys_setsockopt+0x13d/0x1b0 [ 709.819285][T32334] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 709.819322][T32334] __vmalloc_node_range_noprof+0x127/0x1540 [ 709.819374][T32334] ? rcu_is_watching+0x16/0xb0 [ 709.819401][T32334] ? __pfx___vmalloc_node_range_noprof+0x10/0x10 [ 709.819425][T32334] ? __kmalloc_cache_noprof+0x321/0x600 [ 709.819451][T32334] ? __kmalloc_cache_noprof+0x14d/0x600 [ 709.819476][T32334] ? xskq_create+0x56/0x220 [ 709.819505][T32334] xskq_create+0x148/0x220 [ 709.819530][T32334] ? xsk_init_queue+0x8a/0xe0 [ 709.819556][T32334] xsk_init_queue+0x8a/0xe0 [ 709.819582][T32334] xsk_setsockopt+0x5e0/0x960 [ 709.819608][T32334] ? __pfx_xsk_setsockopt+0x10/0x10 [ 709.819632][T32334] ? __pfx_aa_sk_perm+0x10/0x10 [ 709.819656][T32334] ? aa_sock_opt_perm+0x142/0x1e0 [ 709.819681][T32334] ? bpf_lsm_socket_setsockopt+0x9/0x20 [ 709.819713][T32334] ? __pfx_xsk_setsockopt+0x10/0x10 [ 709.819737][T32334] do_sock_setsockopt+0x17c/0x1b0 [ 709.819761][T32334] __x64_sys_setsockopt+0x13d/0x1b0 [ 709.819786][T32334] do_syscall_64+0x166/0x520 [ 709.819813][T32334] ? trace_irq_disable+0x3b/0x140 [ 709.819844][T32334] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 709.819862][T32334] ? clear_bhb_loop+0x70/0xc0 [ 709.819884][T32334] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 709.819902][T32334] RIP: 0033:0x7f3f20d9e159 [ 709.819918][T32334] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 709.819932][T32334] RSP: 002b:00007f3f21cbb028 EFLAGS: 00000246 ORIG_RAX: 0000000000000036 [ 709.819951][T32334] RAX: ffffffffffffffda RBX: 00007f3f21025fa0 RCX: 00007f3f20d9e159 [ 709.819964][T32334] RDX: 0000000000000003 RSI: 000000000000011b RDI: 0000000000000004 [ 709.819974][T32334] RBP: 00007f3f20e35024 R08: 0000000000000004 R09: 0000000000000000 [ 709.819986][T32334] R10: 0000200000000000 R11: 0000000000000246 R12: 0000000000000000 [ 709.819996][T32334] R13: 00007f3f21026038 R14: 00007f3f21025fa0 R15: 00007ffe5c96a828 [ 709.820025][T32334] [ 709.820045][T32334] Mem-Info: [ 709.820054][T32334] active_anon:6602 inactive_anon:0 isolated_anon:0 [ 709.820054][T32334] active_file:0 inactive_file:43361 isolated_file:0 [ 709.820054][T32334] unevictable:25 dirty:135 writeback:0 [ 709.820054][T32334] slab_reclaimable:12702 slab_unreclaimable:129252 [ 709.820054][T32334] mapped:29512 shmem:557 pagetables:1392 [ 709.820054][T32334] sec_pagetables:0 bounce:0 [ 709.820054][T32334] kernel_misc_reclaimable:0 [ 709.820054][T32334] free:1252369 free_pcp:11551 free_cma:0 [ 709.820107][T32334] Node 0 active_anon:26408kB inactive_anon:0kB active_file:0kB inactive_file:173236kB unevictable:100kB isolated(anon):0kB isolated(file):0kB mapped:118048kB dirty:540kB writeback:0kB shmem:2228kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB kernel_stack:17968kB pagetables:5432kB sec_pagetables:0kB all_unreclaimable? no Balloon:0kB gpu_active:0kB gpu_reclaim:0kB [ 709.820156][T32334] Node 1 active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:208kB unevictable:0kB isolated(anon):0kB isolated(file):0kB mapped:0kB dirty:0kB writeback:0kB shmem:0kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB kernel_stack:64kB pagetables:136kB sec_pagetables:0kB all_unreclaimable? no Balloon:0kB gpu_active:0kB gpu_reclaim:0kB [ 709.820199][T32334] Node 0 DMA free:15360kB boost:0kB min:208kB low:260kB high:312kB reserved_highatomic:0kB free_highatomic:0kB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB zspages:0kB present:15992kB managed:15360kB mlocked:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB [ 709.820247][T32334] lowmem_reserve[]: 0 2487 2487 2487 2487 [ 709.820281][T32334] Node 0 DMA32 free:1044932kB boost:0kB min:34140kB low:42672kB high:51204kB reserved_highatomic:0kB free_highatomic:0kB active_anon:26408kB inactive_anon:0kB active_file:0kB inactive_file:173236kB unevictable:100kB writepending:540kB zspages:0kB present:3129332kB managed:2546704kB mlocked:100kB bounce:0kB free_pcp:46204kB local_pcp:23736kB free_cma:0kB [ 709.820331][T32334] lowmem_reserve[]: 0 0 0 0 0 [ 709.820360][T32334] Node 0 Normal free:0kB boost:0kB min:0kB low:0kB high:0kB reserved_highatomic:0kB free_highatomic:0kB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB zspages:0kB present:1048580kB managed:0kB mlocked:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB [ 709.820404][T32334] lowmem_reserve[]: 0 0 0 0 0 [ 709.820433][T32334] Node 1 Normal free:3949184kB boost:0kB min:55760kB low:69700kB high:83640kB reserved_highatomic:0kB free_highatomic:0kB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:208kB unevictable:0kB writepending:0kB zspages:0kB present:4194300kB managed:4111104kB mlocked:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB [ 710.021150][T32334] lowmem_reserve[]: 0 0 0 0 0 [ 710.021197][T32334] Node 0 DMA: 0*4kB 0*8kB 0*16kB 0*32kB 0*64kB 0*128kB 0*256kB 0*512kB 1*1024kB (U) 1*2048kB (M) 3*4096kB (M) = 15360kB [ 710.021302][T32334] Node 0 DMA32: 1003*4kB (UM) 159*8kB (UME) 165*16kB (UM) 228*32kB (UME) 81*64kB (UME) 34*128kB (UM) 6*256kB (UME) 3*512kB (UME) 6*1024kB (UME) 8*2048kB (UME) 243*4096kB (UM) = 1045684kB [ 710.021515][T32334] Node 0 Normal: 0*4kB 0*8kB 0*16kB 0*32kB 0*64kB 0*128kB 0*256kB 0*512kB 0*1024kB 0*2048kB 0*4096kB = 0kB [ 710.021604][T32334] Node 1 Normal: 4*4kB (UM) 2*8kB (UM) 2*16kB (UM) 4*32kB (UM) 3*64kB (UM) 4*128kB (UM) 3*256kB (UM) 2*512kB (M) 2*1024kB (UM) 0*2048kB 963*4096kB (UM) = 3949184kB [ 710.021741][T32334] Node 0 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 710.021756][T32334] Node 0 hugepages_total=2 hugepages_free=2 hugepages_surp=0 hugepages_size=2048kB [ 710.021771][T32334] Node 1 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 710.021786][T32334] Node 1 hugepages_total=2 hugepages_free=2 hugepages_surp=0 hugepages_size=2048kB [ 710.021800][T32334] 43891 total pagecache pages [ 710.021808][T32334] 0 pages in swap cache [ 710.021815][T32334] Free swap = 124996kB [ 710.021822][T32334] Total swap = 124996kB [ 710.021830][T32334] 2097051 pages RAM [ 710.021837][T32334] 0 pages HighMem/MovableOnly [ 710.021845][T32334] 428759 pages reserved [ 710.021852][T32334] 0 pages cma reserved [ 710.064704][T32350] __nla_validate_parse: 4 callbacks suppressed [ 710.064723][T32350] netlink: 4 bytes leftover after parsing attributes in process `syz.1.6529'. [ 710.146561][ C0] IPVS: sh: UDP 224.0.0.2:0 - no destination available [ 710.194472][T32355] netlink: 8 bytes leftover after parsing attributes in process `syz.5.6531'. [ 710.234427][T32341] bond3: Invalid ad_actor_system MAC address. [ 710.234447][T32341] bond3: option ad_actor_system: invalid value (1) [ 710.245351][T32341] bond3 (unregistering): Released all slaves [ 710.542862][T32350] bond3: Invalid ad_actor_system MAC address. [ 710.542886][T32350] bond3: option ad_actor_system: invalid value (1) [ 710.558006][T32350] bond3 (unregistering): Released all slaves [ 710.743294][T32379] netlink: 'syz.1.6537': attribute type 1 has an invalid length. [ 710.820616][T32384] netlink: 16 bytes leftover after parsing attributes in process `syz.5.6538'. [ 710.830176][T32384] nbd: must specify at least one socket [ 710.844652][T32379] netlink: 8 bytes leftover after parsing attributes in process `syz.1.6537'. [ 710.917287][T32379] bond3: (slave bridge1): making interface the new active one [ 710.929780][T32379] bond3: (slave bridge1): Enslaving as an active interface with an up link [ 710.954927][T32387] netlink: 8 bytes leftover after parsing attributes in process `syz.0.6539'. [ 711.020396][T32389] netlink: 8 bytes leftover after parsing attributes in process `syz.5.6540'. [ 711.020444][T32389] netlink: 12 bytes leftover after parsing attributes in process `syz.5.6540'. [ 711.184265][T32391] syzkaller0: entered promiscuous mode [ 711.184306][T32391] syzkaller0: entered allmulticast mode [ 711.186542][ C0] IPVS: sh: UDP 224.0.0.2:0 - no destination available [ 711.238081][T32395] netlink: 'syz.5.6543': attribute type 5 has an invalid length. [ 711.422844][T32399] netlink: 'syz.1.6544': attribute type 4 has an invalid length. [ 711.487672][T32401] netlink: 4 bytes leftover after parsing attributes in process `syz.0.6545'. [ 711.492822][T32401] netlink: 28 bytes leftover after parsing attributes in process `syz.0.6545'. [ 711.566264][T32407] netlink: 8 bytes leftover after parsing attributes in process `syz.3.6547'. [ 711.753758][T32416] netlink: 'syz.5.6550': attribute type 29 has an invalid length. [ 711.754092][T32417] netlink: 'syz.5.6550': attribute type 29 has an invalid length. [ 712.090508][T32440] batman_adv: batadv0: Interface deactivated: wlan1 [ 712.226629][ C0] IPVS: sh: UDP 224.0.0.2:0 - no destination available [ 712.455677][T32452] syzkaller0: entered promiscuous mode [ 712.455707][T32452] syzkaller0: entered allmulticast mode [ 712.660581][T32426] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 712.834477][T32440] Bluetooth: hci3: Opcode 0x0c1a failed: -4 [ 712.834531][T32440] Bluetooth: hci3: Error when powering off device on rfkill (-4) [ 713.052474][T32440] Bluetooth: hci0: Opcode 0x0c1a failed: -4 [ 713.052518][T32440] Bluetooth: hci0: Error when powering off device on rfkill (-4) [ 713.262614][T32440] Bluetooth: hci4: Opcode 0x0c1a failed: -4 [ 713.262660][T32440] Bluetooth: hci4: Error when powering off device on rfkill (-4) [ 713.268781][ C0] IPVS: sh: UDP 224.0.0.2:0 - no destination available [ 713.365962][T32480] bond6: entered promiscuous mode [ 713.366024][T32480] bond6: entered allmulticast mode [ 713.368658][T32480] 8021q: adding VLAN 0 to HW filter on device bond6 [ 713.445000][T32440] Bluetooth: hci5: Opcode 0x0c1a failed: -4 [ 713.445045][T32440] Bluetooth: hci5: Error when powering off device on rfkill (-4) [ 713.611048][T32440] Bluetooth: hci2: Opcode 0x0c1a failed: -4 [ 713.618368][T32440] Bluetooth: hci2: Error when powering off device on rfkill (-4) [ 713.713559][T32498] bond7: entered promiscuous mode [ 713.722047][T32498] 8021q: adding VLAN 0 to HW filter on device bond7 [ 713.776149][T32499] 8021q: adding VLAN 0 to HW filter on device bond7 [ 713.786258][T32499] bond7: (slave ipip1): The slave device specified does not support setting the MAC address [ 713.801201][T32499] bond7: (slave ipip1): Error -95 calling set_mac_address [ 713.987328][T31638] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 714.056714][T32514] Cannot find add_set index 1 as target [ 714.081422][T32511] netdevsim netdevsim3 netdevsim0: entered promiscuous mode [ 714.089581][T32511] A link change request failed with some changes committed already. Interface netdevsim0 may have been left with an inconsistent configuration, please check. [ 714.306493][ C0] IPVS: sh: UDP 224.0.0.2:0 - no destination available [ 714.433521][T32537] netlink: 'syz.2.6579': attribute type 1 has an invalid length. [ 714.555528][T32537] bond1: entered promiscuous mode [ 714.565518][T32537] 8021q: adding VLAN 0 to HW filter on device bond1 [ 714.578542][T32547] netlink: 'syz.5.6581': attribute type 10 has an invalid length. [ 714.578620][T32547] team0: entered allmulticast mode [ 714.579079][T32545] netlink: 'syz.5.6581': attribute type 10 has an invalid length. [ 714.579498][T32547] team_slave_0: entered allmulticast mode [ 714.579517][T32547] team_slave_1: entered allmulticast mode [ 714.579808][T32547] bridge0: port 3(team0) entered blocking state [ 714.581278][T32547] bridge0: port 3(team0) entered disabled state [ 714.584519][T32547] team0: entered promiscuous mode [ 714.584535][T32547] team_slave_0: entered promiscuous mode [ 714.584709][T32547] team_slave_1: entered promiscuous mode [ 714.587741][T32547] bridge0: port 3(team0) entered blocking state [ 714.587849][T32547] bridge0: port 3(team0) entered forwarding state [ 714.695559][T32546] 8021q: adding VLAN 0 to HW filter on device bond1 [ 714.695975][T32546] bond1: (slave ip6gre2): The slave device specified does not support setting the MAC address [ 714.695995][T32546] bond1: (slave ip6gre2): Setting fail_over_mac to active for active-backup mode [ 714.821375][T32546] bond1: (slave ip6gre2): making interface the new active one [ 714.821422][T32546] ip6gre2: entered promiscuous mode [ 714.829091][T32546] bond1: (slave ip6gre2): Enslaving as an active interface with an up link [ 714.965102][T30060] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 714.974406][T30060] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 714.983936][T30060] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 715.023735][T30060] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 715.045315][T30060] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 715.108284][ T5630] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 715.118556][ T5630] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 715.134375][ T5630] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 715.143565][ T5630] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 715.155536][ T5630] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 715.346479][ C0] IPVS: sh: UDP 224.0.0.2:0 - no destination available [ 715.622273][T32583] netlink: 'syz.3.6592': attribute type 2 has an invalid length. [ 715.926329][T32592] __nla_validate_parse: 77 callbacks suppressed [ 715.926782][T32592] netlink: 4 bytes leftover after parsing attributes in process `syz.3.6594'. [ 716.194169][T31638] netdevsim netdevsim0 netdevsim3 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 716.205297][T31638] netdevsim netdevsim0 netdevsim3 (unregistering): unset [0, 1] type 1 family 0 port 256 - 0 [ 716.215762][T31638] netdevsim netdevsim0 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 716.385805][T31638] netdevsim netdevsim0 netdevsim2 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 716.385866][T31638] netdevsim netdevsim0 netdevsim2 (unregistering): unset [0, 1] type 1 family 0 port 256 - 0 [ 716.385890][T31638] netdevsim netdevsim0 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 716.396277][ C0] IPVS: sh: UDP 224.0.0.2:0 - no destination available [ 716.460012][T32607] netlink: 8 bytes leftover after parsing attributes in process `syz.3.6597'. [ 716.646268][T31638] netdevsim netdevsim0 netdevsim1 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 716.646330][T31638] netdevsim netdevsim0 netdevsim1 (unregistering): unset [0, 1] type 1 family 0 port 256 - 0 [ 716.646369][T31638] netdevsim netdevsim0 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 716.831098][T31638] netdevsim netdevsim0 netdevsim0 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 716.831158][T31638] netdevsim netdevsim0 netdevsim0 (unregistering): unset [0, 1] type 1 family 0 port 256 - 0 [ 716.831181][T31638] netdevsim netdevsim0 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 716.891819][T32556] lo speed is unknown, defaulting to 1000 [ 717.168313][ T61] netdevsim netdevsim0 eth5: set [0, 0] type 1 family 0 port 8472 - 0 [ 717.266969][ T5630] Bluetooth: hci1: command tx timeout [ 717.311013][T32633] netlink: 'syz.2.6603': attribute type 7 has an invalid length. [ 717.339197][T32623] netlink: 'syz.5.6601': attribute type 5 has an invalid length. [ 717.339234][T32623] netlink: 'syz.5.6601': attribute type 5 has an invalid length. [ 717.339621][T32623] netlink: 'syz.5.6601': attribute type 8 has an invalid length. [ 717.348677][T31660] netdevsim netdevsim0 eth6: set [0, 0] type 1 family 0 port 8472 - 0 [ 717.394480][T32633] netlink: 'syz.2.6603': attribute type 6 has an invalid length. [ 717.419082][ T3333] netdevsim netdevsim0 eth7: set [0, 0] type 1 family 0 port 8472 - 0 [ 717.429145][ C0] IPVS: sh: UDP 224.0.0.2:0 - no destination available [ 717.460217][ T3333] netdevsim netdevsim0 eth8: set [0, 0] type 1 family 0 port 8472 - 0 [ 717.488249][T32645] netlink: 'syz.2.6603': attribute type 6 has an invalid length. [ 717.496180][T31638] bridge_slave_1: left promiscuous mode [ 717.498306][T31638] bridge0: port 2(bridge_slave_1) entered disabled state [ 717.555978][T32646] netlink: 40 bytes leftover after parsing attributes in process `syz.1.6604'. [ 717.638069][T31638] batman_adv: batadv0: Interface deactivated: gretap0 [ 717.727620][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 718.042963][T32665] netlink: 8 bytes leftover after parsing attributes in process `syz.3.6609'. [ 718.251053][T31638] batman_adv: batadv0: Removing interface: gretap0 [ 718.409310][T31638] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 718.420080][T31638] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 718.431628][T31638] bond0 (unregistering): (slave veth0_to_bond): Releasing backup interface [ 718.441475][T31638] bond0 (unregistering): Released all slaves [ 718.451044][T31638] bond1 (unregistering): Released all slaves [ 718.463368][T31638] bond2 (unregistering): Released all slaves [ 718.470640][ C0] IPVS: sh: UDP 224.0.0.2:0 - no destination available [ 718.476089][T31638] bond3 (unregistering): Released all slaves [ 718.479376][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 718.502707][T31638] bond4 (unregistering): (slave veth7): Releasing active interface [ 718.512628][T31638] bond4 (unregistering): Released all slaves [ 718.524826][T31638] bond5 (unregistering): Released all slaves [ 718.535278][T31638] bond6 (unregistering): Released all slaves [ 718.550128][T31638] bond7 (unregistering): Released all slaves [ 718.665392][T32677] netlink: 256 bytes leftover after parsing attributes in process `syz.2.6611'. [ 718.728656][ T5279] 8021q: adding VLAN 0 to HW filter on device eth5 [ 718.833345][T31638] tipc: Left network mode [ 719.287977][T32702] netlink: 212 bytes leftover after parsing attributes in process `syz.5.6614'. [ 719.297499][T32702] NCSI netlink: No device for ifindex 813332851 [ 719.347766][ T5630] Bluetooth: hci1: command tx timeout [ 719.506562][ C0] IPVS: sh: UDP 224.0.0.2:0 - no destination available [ 719.989374][T32721] ipt_ECN: cannot use operation on non-tcp rule [ 720.339697][T32746] netlink: 8 bytes leftover after parsing attributes in process `syz.2.6622'. [ 720.383848][ T5279] 8021q: adding VLAN 0 to HW filter on device eth6 [ 720.519411][T32556] bridge0: port 1(bridge_slave_0) entered blocking state [ 720.519530][T32556] bridge0: port 1(bridge_slave_0) entered disabled state [ 720.519715][T32556] bridge_slave_0: entered allmulticast mode [ 720.541964][T32556] bridge_slave_0: entered promiscuous mode [ 720.546492][ C0] IPVS: sh: UDP 224.0.0.2:0 - no destination available [ 720.567414][T32556] bridge0: port 2(bridge_slave_1) entered blocking state [ 720.575044][T32556] bridge0: port 2(bridge_slave_1) entered disabled state [ 720.582936][T32556] bridge_slave_1: entered allmulticast mode [ 720.584200][T32753] netlink: 32 bytes leftover after parsing attributes in process `syz.2.6626'. [ 720.603796][T32556] bridge_slave_1: entered promiscuous mode [ 720.617278][T32756] netlink: 32 bytes leftover after parsing attributes in process `syz.2.6626'. [ 720.708173][T32764] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 720.725823][T32759] netlink: 28 bytes leftover after parsing attributes in process `syz.3.6627'. [ 720.801116][T32767] can: request_module (can-proto-0) failed. [ 720.894159][T32556] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 721.008404][T32556] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 721.280163][T32556] team0: Port device team_slave_0 added [ 721.285914][T32556] team0: Port device team_slave_1 added [ 721.338904][ T330] __nla_validate_parse: 1 callbacks suppressed [ 721.339301][ T330] netlink: 20 bytes leftover after parsing attributes in process `syz.2.6633'. [ 721.422829][ T332] veth0: entered promiscuous mode [ 721.429961][ T332] nbd: socks must be embedded in a SOCK_ITEM attr [ 721.430885][ T5630] Bluetooth: hci1: command tx timeout [ 721.525521][ T334] veth0: left promiscuous mode [ 721.530865][T32556] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 721.530893][T32556] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 721.530932][T32556] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 721.546273][T32556] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 721.546291][T32556] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 721.546315][T32556] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 721.586489][ C0] IPVS: sh: UDP 224.0.0.2:0 - no destination available [ 721.602017][ T346] netlink: 8 bytes leftover after parsing attributes in process `syz.2.6636'. [ 721.886945][T32556] hsr_slave_0: entered promiscuous mode [ 721.887938][T32556] hsr_slave_1: entered promiscuous mode [ 721.890386][T32556] debugfs: 'hsr0' already exists in 'hsr' [ 721.890405][T32556] Cannot create hsr debugfs directory [ 721.896125][ T5279] 8021q: adding VLAN 0 to HW filter on device eth7 [ 721.978894][ T359] netlink: 8 bytes leftover after parsing attributes in process `syz.1.6640'. [ 722.189386][ T366] validate_nla: 3 callbacks suppressed [ 722.189433][ T366] netlink: 'syz.3.6641': attribute type 10 has an invalid length. [ 722.250145][ T366] bond0: (slave virt_wifi0): The slave device specified does not support setting the MAC address [ 722.270768][ T366] bond0: (slave virt_wifi0): Error -95 calling set_mac_address [ 722.546639][ T383] netlink: 8 bytes leftover after parsing attributes in process `syz.3.6646'. [ 722.546688][ T383] netlink: 'syz.3.6646': attribute type 10 has an invalid length. [ 722.546718][ T383] netlink: 32 bytes leftover after parsing attributes in process `syz.3.6646'. [ 722.626471][ C0] IPVS: sh: UDP 224.0.0.2:0 - no destination available [ 722.678134][ T383] geneve2: entered promiscuous mode [ 722.678180][ T383] geneve2: entered allmulticast mode [ 723.014902][ T402] netlink: 12 bytes leftover after parsing attributes in process `syz.2.6648'. [ 723.100775][ T409] netlink: 8 bytes leftover after parsing attributes in process `syz.5.6649'. [ 723.205018][ T400] netlink: 244 bytes leftover after parsing attributes in process `syz.2.6648'. [ 723.405249][T31638] hsr_slave_0: left promiscuous mode [ 723.411209][T31638] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 723.419203][T31638] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 723.429312][T31638] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 723.437138][T31638] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 723.448844][T31638] veth1_macvtap: left promiscuous mode [ 723.448888][T31638] veth0_macvtap: left promiscuous mode [ 723.448989][T31638] veth1_vlan: left promiscuous mode [ 723.508387][ T5630] Bluetooth: hci1: command tx timeout [ 723.666858][ C0] IPVS: sh: UDP 224.0.0.2:0 - no destination available [ 723.753550][T31638] team0 (unregistering): Port device team_slave_1 removed [ 723.765182][T31638] team0 (unregistering): Port device team_slave_0 removed [ 723.992932][ T5279] 8021q: adding VLAN 0 to HW filter on device eth8 [ 724.245203][ T434] netlink: 'syz.2.6653': attribute type 4 has an invalid length. [ 724.245241][ T434] netlink: 224 bytes leftover after parsing attributes in process `syz.2.6653'. [ 724.245400][ T434] netlink: 'syz.2.6653': attribute type 4 has an invalid length. [ 724.245417][ T434] netlink: 224 bytes leftover after parsing attributes in process `syz.2.6653'. [ 724.245549][ T434] netlink: 'syz.2.6653': attribute type 4 has an invalid length. [ 724.245693][ T434] netlink: 'syz.2.6653': attribute type 4 has an invalid length. [ 724.245829][ T434] netlink: 'syz.2.6653': attribute type 4 has an invalid length. [ 724.245962][ T434] netlink: 'syz.2.6653': attribute type 4 has an invalid length. [ 724.246093][ T434] netlink: 'syz.2.6653': attribute type 4 has an invalid length. [ 724.246224][ T434] netlink: 'syz.2.6653': attribute type 4 has an invalid length. [ 724.503797][T32556] netdevsim netdevsim0 eth8 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 724.505797][ T446] Bluetooth: hci0: unsupported parameter 5161 [ 724.505816][ T446] Bluetooth: hci0: unsupported parameter 8192 [ 724.505828][ T446] Bluetooth: hci0: unsupported parameter 5161 [ 724.505840][ T446] Bluetooth: hci0: unsupported parameter 8192 [ 724.707679][ C0] IPVS: sh: UDP 224.0.0.2:0 - no destination available [ 724.827538][T32556] netdevsim netdevsim0 eth7 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 724.883288][T31638] IPVS: stop unused estimator thread 0... [ 724.993415][ T465] gretap1: entered promiscuous mode [ 724.996122][ T465] batman_adv: batadv0: Adding interface: gretap1 [ 724.996138][ T465] batman_adv: batadv0: The MTU of interface gretap1 is too small (1462) to handle the transport of batman-adv packets. If you experience problems getting traffic through try increasing the MTU to 1500. [ 724.996170][ T465] batman_adv: batadv0: Not using interface gretap1 (retrying later): interface not active [ 725.004201][ T459] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 725.184796][T32556] netdevsim netdevsim0 eth6 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 725.341775][T32556] netdevsim netdevsim0 eth5 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 725.746561][ C0] IPVS: sh: UDP 224.0.0.2:0 - no destination available [ 725.979296][T32556] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 726.072354][ T510] 0: reclassify loop, rule prio 0, protocol 800 [ 726.072415][ T509] 0: reclassify loop, rule prio 0, protocol 800 [ 726.073112][T32556] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 726.073952][T32556] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 726.076268][ T509] 0: reclassify loop, rule prio 0, protocol 800 [ 726.076606][ T509] 0: reclassify loop, rule prio 0, protocol 800 [ 726.077498][ T509] 0: reclassify loop, rule prio 0, protocol 800 [ 726.078198][ T509] 0: reclassify loop, rule prio 0, protocol 800 [ 726.364096][ T492] __nla_validate_parse: 66 callbacks suppressed [ 726.364141][ T492] netlink: 8 bytes leftover after parsing attributes in process `syz.2.6666'. [ 726.471207][T32556] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 726.473179][T32556] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 726.498492][T32556] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 726.527943][ T489] lo speed is unknown, defaulting to 1000 [ 726.554387][T32556] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 726.580145][T32556] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 726.660721][ T540] netlink: 96 bytes leftover after parsing attributes in process `syz.1.6676'. [ 726.783258][ T545] netlink: 12 bytes leftover after parsing attributes in process `syz.3.6675'. [ 726.814317][ T545] vlan2: entered promiscuous mode [ 726.814368][ T545] gretap0: entered promiscuous mode [ 726.933749][ T549] netlink: 8 bytes leftover after parsing attributes in process `syz.1.6677'. [ 727.020875][ T552] tipc: Enabling of bearer rejected, media not registered [ 727.030520][ T553] tipc: Enabling of bearer rejected, media not registered [ 727.065811][T32556] 8021q: adding VLAN 0 to HW filter on device bond0 [ 727.174758][T16838] tipc: Subscription rejected, illegal request [ 727.253643][T32556] 8021q: adding VLAN 0 to HW filter on device team0 [ 727.276893][T31706] bridge0: port 1(bridge_slave_0) entered blocking state [ 727.277029][T31706] bridge0: port 1(bridge_slave_0) entered forwarding state [ 727.291962][T31706] bridge0: port 2(bridge_slave_1) entered blocking state [ 727.292060][T31706] bridge0: port 2(bridge_slave_1) entered forwarding state [ 727.690684][ T572] syzkaller0: entered promiscuous mode [ 727.690723][ T572] syzkaller0: entered allmulticast mode [ 727.751197][ T576] netlink: 28 bytes leftover after parsing attributes in process `syz.3.6684'. [ 727.808476][ T582] netlink: 28 bytes leftover after parsing attributes in process `syz.3.6684'. [ 727.852313][ T576] netlink: 8 bytes leftover after parsing attributes in process `syz.3.6684'. [ 727.868377][ T576] GUP no longer grows the stack in syz.3.6684 (576): 200000003000-20000000a000 (200000001000) [ 727.868430][ T576] CPU: 1 UID: 0 PID: 576 Comm: syz.3.6684 Not tainted syzkaller #0 PREEMPT(full) [ 727.868453][ T576] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 727.868466][ T576] Call Trace: [ 727.868475][ T576] [ 727.868484][ T576] dump_stack_lvl+0xe8/0x150 [ 727.868519][ T576] __get_user_pages+0x23b6/0x2750 [ 727.868549][ T576] ? lock_acquire+0x115/0x350 [ 727.868622][ T576] ? __gup_longterm_locked+0xc3b/0x15c0 [ 727.868656][ T576] __gup_longterm_locked+0xd52/0x15c0 [ 727.868685][ T576] ? lock_acquire+0x115/0x350 [ 727.868723][ T576] gup_fast_fallback+0x1d92/0x20e0 [ 727.868779][ T576] ? __pfx_gup_fast_fallback+0x10/0x10 [ 727.868807][ T576] ? lock_acquire+0x115/0x350 [ 727.868824][ T576] ? is_valid_gup_args+0x11f/0x200 [ 727.868851][ T576] ? get_user_pages_fast+0x4d/0xb0 [ 727.868878][ T576] __iov_iter_get_pages_alloc+0x378/0xa40 [ 727.869008][ T576] ? __pfx_pipe_clear_nowait+0x10/0x10 [ 727.869063][ T576] iov_iter_get_pages2+0x5e/0xa0 [ 727.869089][ T576] __se_sys_vmsplice+0x7b5/0x1660 [ 727.869138][ T576] ? __pfx___se_sys_vmsplice+0x10/0x10 [ 727.869167][ T576] ? __pfx_futex_wait+0x10/0x10 [ 727.869277][ T576] do_syscall_64+0x166/0x520 [ 727.869305][ T576] ? trace_irq_disable+0x3b/0x140 [ 727.869324][ T576] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 727.869346][ T576] ? clear_bhb_loop+0x70/0xc0 [ 727.869371][ T576] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 727.869391][ T576] RIP: 0033:0x7f5436d9e159 [ 727.869410][ T576] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 727.869428][ T576] RSP: 002b:00007f5437c56028 EFLAGS: 00000246 ORIG_RAX: 0000000000000116 [ 727.869450][ T576] RAX: ffffffffffffffda RBX: 00007f5437025fa0 RCX: 00007f5436d9e159 [ 727.869466][ T576] RDX: 0000000000000001 RSI: 00002000000000c0 RDI: 0000000000000008 [ 727.869479][ T576] RBP: 00007f5436e35024 R08: 0000000000000000 R09: 0000000000000000 [ 727.869493][ T576] R10: 0000000000000001 R11: 0000000000000246 R12: 0000000000000000 [ 727.869505][ T576] R13: 00007f5437026038 R14: 00007f5437025fa0 R15: 00007ffd73964228 [ 727.869540][ T576] [ 727.870414][ T580] bridge: RTM_NEWNEIGH bridge0 with NTF_USE is not supported [ 728.742841][ T617] validate_nla: 57 callbacks suppressed [ 728.742890][ T617] netlink: 'syz.5.6690': attribute type 21 has an invalid length. [ 728.743282][ T617] netlink: 'syz.5.6690': attribute type 21 has an invalid length. [ 728.743508][ T617] netlink: 'syz.5.6690': attribute type 21 has an invalid length. [ 728.743711][ T617] netlink: 'syz.5.6690': attribute type 21 has an invalid length. [ 728.743907][ T617] netlink: 'syz.5.6690': attribute type 21 has an invalid length. [ 728.744095][ T617] netlink: 'syz.5.6690': attribute type 21 has an invalid length. [ 728.744282][ T617] netlink: 'syz.5.6690': attribute type 21 has an invalid length. [ 728.755682][ T617] netlink: 'syz.5.6690': attribute type 21 has an invalid length. [ 728.755892][ T617] netlink: 'syz.5.6690': attribute type 21 has an invalid length. [ 728.756083][ T617] netlink: 'syz.5.6690': attribute type 21 has an invalid length. [ 728.859796][T32556] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 728.866794][ C0] net_ratelimit: 504 callbacks suppressed [ 728.866815][ C0] IPVS: sh: UDP 224.0.0.2:0 - no destination available [ 729.062735][ T628] netlink: 8 bytes leftover after parsing attributes in process `syz.3.6691'. [ 729.095473][T32556] veth0_vlan: entered promiscuous mode [ 729.131820][T32556] veth1_vlan: entered promiscuous mode [ 729.221845][ T629] netlink: 68 bytes leftover after parsing attributes in process `syz.1.6692'. [ 729.293672][T32556] veth0_macvtap: entered promiscuous mode [ 729.327185][T32556] veth1_macvtap: entered promiscuous mode [ 729.625241][T32556] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 729.643681][T32556] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 729.784681][ T654] batman_adv: batadv0: Adding interface: dummy0 [ 729.784717][ T654] batman_adv: batadv0: The MTU of interface dummy0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 729.784745][ T654] batman_adv: batadv0: Interface activated: dummy0 [ 729.800979][ T654] batadv0: mtu less than device minimum [ 729.802434][ T654] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (-320) [ 729.805592][ T654] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (-320) [ 729.807006][ T654] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (-320) [ 729.808379][ T654] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (-320) [ 729.809715][ T654] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (-320) [ 729.811082][ T654] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (-320) [ 729.813962][ T654] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (-320) [ 729.815320][ T654] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (-320) [ 729.907029][T31706] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 729.907729][T31706] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 729.907764][T31706] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 729.907797][T31706] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 730.159164][T31638] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 730.159207][T31638] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 730.272912][ T673] netlink: 48 bytes leftover after parsing attributes in process `syz.1.6705'. [ 730.354039][T31654] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 730.354084][T31654] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 730.725840][ T698] hsr0: entered allmulticast mode [ 730.733449][ T698] hsr_slave_0: entered allmulticast mode [ 730.733503][ T698] hsr_slave_1: entered allmulticast mode [ 731.436836][ T755] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 731.477136][ T755] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 731.487830][ T755] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 731.544552][ T755] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 731.554246][ T755] batman_adv: batadv0: Interface deactivated: dummy0 [ 731.565841][ T755] batman_adv: batadv0: Removing interface: dummy0 [ 731.762847][ T756] bond2: entered promiscuous mode [ 731.770091][ T756] 8021q: adding VLAN 0 to HW filter on device bond2 [ 731.840144][ T761] bond2: (slave bridge1): making interface the new active one [ 731.840187][ T761] bridge1: entered promiscuous mode [ 731.848793][ T761] bond2: (slave bridge1): Enslaving as an active interface with an up link [ 731.902443][ T771] bond2: (slave bridge2): Enslaving as a backup interface with an up link [ 732.126173][ T799] __nla_validate_parse: 4 callbacks suppressed [ 732.127100][ T799] netlink: 24 bytes leftover after parsing attributes in process `syz.5.6724'. [ 732.275572][ T805] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 732.275617][ T805] IPv6: NLM_F_CREATE should be set when creating new route [ 732.276686][ T805] syzkaller1: entered promiscuous mode [ 732.276705][ T805] syzkaller1: entered allmulticast mode [ 734.066463][ C0] net_ratelimit: 57 callbacks suppressed [ 734.066499][ C0] IPVS: sh: UDP 224.0.0.2:0 - no destination available [ 734.328057][ T746] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 734.557791][ T844] netlink: 60 bytes leftover after parsing attributes in process `syz.2.6731'. [ 734.625502][ T847] Bluetooth: MGMT ver 1.23 [ 734.625564][ T847] Bluetooth: hci1: too big key_count value 32778 [ 734.728334][ T857] netlink: 60 bytes leftover after parsing attributes in process `syz.2.6731'. [ 734.984030][ T867] netlink: 12 bytes leftover after parsing attributes in process `syz.3.6738'. [ 735.107929][ C0] IPVS: sh: UDP 224.0.0.2:0 - no destination available [ 735.295504][ T903] tap0: tun_chr_ioctl cmd 1074025672 [ 735.295542][ T903] tap0: ignored: set checksum disabled [ 735.363487][ T905] tap0: tun_chr_ioctl cmd 1074025673 [ 735.363553][ T903] tap0: tun_chr_ioctl cmd 1074025672 [ 735.363565][ T903] tap0: ignored: set checksum disabled [ 735.433455][ T915] netlink: 12 bytes leftover after parsing attributes in process `syz.3.6743'. [ 735.442896][ T915] openvswitch: netlink: Missing key (keys=c0, expected=40300) [ 735.662229][ T933] netlink: 32 bytes leftover after parsing attributes in process `syz.2.6748'. [ 736.006293][ T952] netlink: 40 bytes leftover after parsing attributes in process `syz.5.6752'. [ 736.146490][ C0] IPVS: sh: UDP 224.0.0.2:0 - no destination available [ 736.292774][ T977] IPVS: length: 74 != 8 [ 736.294222][T16838] IPVS: starting estimator thread 0... [ 736.393308][ T979] IPVS: using max 30 ests per chain, 72000 per kthread [ 736.706300][ T1007] netlink: 'syz.1.6762': attribute type 11 has an invalid length. [ 736.732153][ T1010] validate_nla: 57 callbacks suppressed [ 736.732523][ T1010] netlink: 'syz.2.6763': attribute type 1 has an invalid length. [ 736.732543][ T1010] netlink: 8 bytes leftover after parsing attributes in process `syz.2.6763'. [ 736.734088][ T1011] netlink: 'syz.2.6763': attribute type 1 has an invalid length. [ 736.734105][ T1011] netlink: 8 bytes leftover after parsing attributes in process `syz.2.6763'. [ 737.186490][ C0] IPVS: sh: UDP 224.0.0.2:0 - no destination available [ 737.291759][ T1039] netlink: 'syz.2.6770': attribute type 8 has an invalid length. [ 737.387679][ T1045] netlink: 36 bytes leftover after parsing attributes in process `syz.3.6771'. [ 737.535591][ T1036] netlink: Failed to add  helper -22 [ 737.535659][ T1036] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 737.682203][ T1061] netlink: 'syz.1.6776': attribute type 1 has an invalid length. [ 737.682241][ T1061] netlink: 208 bytes leftover after parsing attributes in process `syz.1.6776'. [ 737.734845][ T1063] netlink: 'syz.1.6776': attribute type 1 has an invalid length. [ 737.734873][ T1063] netlink: 208 bytes leftover after parsing attributes in process `syz.1.6776'. [ 737.786645][ T1021] lo speed is unknown, defaulting to 1000 [ 737.945795][ T1079] netlink: 20 bytes leftover after parsing attributes in process `syz.1.6779'. [ 738.226471][ C0] IPVS: sh: UDP 224.0.0.2:0 - no destination available [ 738.277942][ T1095] netlink: 88 bytes leftover after parsing attributes in process `syz.5.6784'. [ 738.278010][ T1095] netlink: 24 bytes leftover after parsing attributes in process `syz.5.6784'. [ 738.278038][ T1095] netlink: 24 bytes leftover after parsing attributes in process `syz.5.6784'. [ 738.333801][ T1095] openvswitch: netlink: Either Ethernet header or EtherType is required. [ 738.412420][ T1109] IPVS: sync thread started: state = MASTER, mcast_ifn = veth1_to_bridge, syncid = 32, id = 0 [ 738.417905][ T1100] IPVS: stopping master sync thread 1109 ... [ 738.733169][ T1128] netlink: 8 bytes leftover after parsing attributes in process `syz.3.6792'. [ 739.115711][ T1149] netlink: 277 bytes leftover after parsing attributes in process `syz.1.6795'. [ 739.115929][ T1149] netlink: 277 bytes leftover after parsing attributes in process `syz.1.6795'. [ 739.266930][ C0] IPVS: sh: UDP 224.0.0.2:0 - no destination available [ 740.306465][ C0] IPVS: sh: UDP 224.0.0.2:0 - no destination available [ 740.393992][ T1176] netlink: 'syz.0.6802': attribute type 1 has an invalid length. [ 740.411559][ T1176] erspan1: entered allmulticast mode [ 741.346465][ C0] IPVS: sh: UDP 224.0.0.2:0 - no destination available [ 741.775416][ T1249] netlink: 'syz.5.6817': attribute type 4 has an invalid length. [ 741.809374][ T1253] netlink: 'syz.5.6817': attribute type 4 has an invalid length. [ 742.386784][ C0] IPVS: sh: UDP 224.0.0.2:0 - no destination available [ 742.716219][ T1315] __nla_validate_parse: 142 callbacks suppressed [ 742.727894][ T1315] netlink: 12 bytes leftover after parsing attributes in process `syz.0.6833'. [ 743.254554][ T1336] netlink: 64 bytes leftover after parsing attributes in process `syz.1.6840'. [ 743.258930][ T1343] netlink: 4 bytes leftover after parsing attributes in process `syz.2.6842'. [ 743.286056][ T1343] team_slave_0: left allmulticast mode [ 743.299763][ T1343] team0 (unregistering): Port device team_slave_0 removed [ 743.300249][ T1343] team_slave_1: left allmulticast mode [ 743.343777][ T1343] team0 (unregistering): Port device team_slave_1 removed [ 743.403349][ T1351] netlink: 32 bytes leftover after parsing attributes in process `syz.1.6840'. [ 743.427195][ C0] IPVS: sh: UDP 224.0.0.2:0 - no destination available [ 743.730787][ T1366] netlink: 24 bytes leftover after parsing attributes in process `syz.1.6847'. [ 743.859951][ T1380] netlink: Unknown nat attribute (0) [ 743.866507][ T1380] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 743.950753][ T1386] netlink: 'syz.0.6853': attribute type 10 has an invalid length. [ 743.950781][ T1386] netlink: 4 bytes leftover after parsing attributes in process `syz.0.6853'. [ 744.031095][ T1391] netlink: 'syz.0.6854': attribute type 5 has an invalid length. [ 744.123222][ T1398] netlink: 'syz.0.6856': attribute type 1 has an invalid length. [ 744.159439][ T1400] netlink: 28 bytes leftover after parsing attributes in process `syz.0.6856'. [ 744.176218][ T1398] bond1: (slave veth3): Enslaving as an active interface with a down link [ 744.274415][ T1404] bridge0: port 2(bridge_slave_1) entered disabled state [ 744.274990][ T1404] bridge0: port 1(bridge_slave_0) entered disabled state [ 744.379615][ T1404] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 744.392845][ T1404] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 744.459008][ T1407] netlink: 8 bytes leftover after parsing attributes in process `syz.0.6857'. [ 744.459051][ T1407] netlink: 12 bytes leftover after parsing attributes in process `syz.0.6857'. [ 744.468342][ C0] IPVS: sh: UDP 224.0.0.2:0 - no destination available [ 744.667463][T31638] netdevsim netdevsim0 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 744.689424][ T49] netdevsim netdevsim0 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 744.689484][ T49] netdevsim netdevsim0 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 744.689554][ T49] netdevsim netdevsim0 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 744.974273][ T1441] netlink: 524 bytes leftover after parsing attributes in process `syz.5.6864'. [ 745.506489][ C0] IPVS: sh: UDP 224.0.0.2:0 - no destination available [ 745.586085][ T1479] No such timeout policy "syz0" [ 745.731426][ T1486] IPVS: set_ctl: invalid protocol: 135 224.0.0.2:20004 [ 746.168256][ T1508] netlink: Failed to add  helper -22 [ 746.168330][ T1508] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 746.250554][ T1514] IPVS: set_ctl: invalid protocol: 25965 114.121.46.101:30309 [ 746.409871][ T1530] openvswitch: netlink: IP tunnel dst address not specified [ 746.409922][ T1530] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 746.550952][ C0] IPVS: sh: UDP 224.0.0.2:0 - no destination available [ 746.721800][ T1533] rdma_rxe: rxe_newlink: failed to add team_slave_1 [ 747.399853][ T1562] bridge0: port 2(bridge_slave_1) entered disabled state [ 747.400503][ T1562] bridge0: port 1(bridge_slave_0) entered disabled state [ 747.586615][ C0] IPVS: sh: UDP 224.0.0.2:0 - no destination available [ 747.713494][ T1562] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 747.746547][ T1562] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 748.312153][T31638] netdevsim netdevsim2 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 748.314281][ T49] netdevsim netdevsim2 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 748.314344][ T49] netdevsim netdevsim2 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 748.314379][ T49] netdevsim netdevsim2 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 748.626459][ C0] IPVS: sh: UDP 224.0.0.2:0 - no destination available [ 748.715164][ T1624] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 748.983277][ T1634] __nla_validate_parse: 7 callbacks suppressed [ 748.996637][ T1634] netlink: 16 bytes leftover after parsing attributes in process `syz.0.6912'. [ 749.222827][ T1649] netlink: 36 bytes leftover after parsing attributes in process `syz.2.6916'. [ 749.666466][ C0] IPVS: sh: UDP 224.0.0.2:0 - no destination available [ 749.693430][ T1670] netlink: 12 bytes leftover after parsing attributes in process `syz.2.6921'. [ 749.964067][ T1680] netlink: 8 bytes leftover after parsing attributes in process `syz.2.6922'. [ 750.597562][ T1703] netlink: 'syz.3.6927': attribute type 18 has an invalid length. [ 750.605724][ T1703] netlink: 4 bytes leftover after parsing attributes in process `syz.3.6927'. [ 750.630000][ T1703] netlink: 'syz.3.6927': attribute type 18 has an invalid length. [ 750.638551][T31638] netdevsim netdevsim3 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0 [ 750.638606][T31638] netdevsim netdevsim3 netdevsim0: set [0, 0] type 1 family 0 port 8472 - 0 [ 750.648077][T31638] netdevsim netdevsim3 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0 [ 750.656572][ T1703] netlink: 4 bytes leftover after parsing attributes in process `syz.3.6927'. [ 750.658526][T31638] netdevsim netdevsim3 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0 [ 750.664430][ T1703] netlink: 4 bytes leftover after parsing attributes in process `syz.3.6927'. [ 750.706471][ C0] IPVS: sh: UDP 224.0.0.2:0 - no destination available [ 750.971811][ T1710] netlink: 'syz.5.6929': attribute type 1 has an invalid length. [ 751.195894][ T1710] veth5: entered allmulticast mode [ 751.200487][ T1729] netlink: 8 bytes leftover after parsing attributes in process `syz.3.6935'. [ 751.221226][ T1728] bond3: (slave veth0_to_bond): making interface the new active one [ 751.253506][ T1728] bond3: (slave veth0_to_bond): Enslaving as an active interface with an up link [ 751.307666][ T1733] netlink: 12 bytes leftover after parsing attributes in process `syz.1.6936'. [ 751.350997][ T1738] netlink: 12 bytes leftover after parsing attributes in process `syz.1.6936'. [ 751.468835][ T1744] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 751.588732][ T1749] openvswitch: netlink: IP tunnel dst address not specified [ 751.682942][ T1760] sch_tbf: burst 0 is lower than device lo mtu (65550) ! [ 751.708530][ T1759] sch_tbf: burst 0 is lower than device lo mtu (65550) ! [ 751.746550][ C0] IPVS: sh: UDP 224.0.0.2:0 - no destination available [ 751.775535][ T1764] xt_time: invalid argument - start or stop time greater than 23:59:59 [ 751.903414][ T1768] x_tables: duplicate underflow at hook 1 [ 751.941597][ T1770] IPVS: set_ctl: invalid protocol: 32 172.20.20.187:0 [ 751.972497][ T1767] netdevsim netdevsim5: Direct firmware load for .. failed with error -2 [ 751.983789][ T1767] netdevsim netdevsim5: Falling back to sysfs fallback for: .. [ 752.786477][ C0] IPVS: sh: UDP 224.0.0.2:0 - no destination available [ 753.150152][ T1841] netlink: 'syz.2.6968': attribute type 49 has an invalid length. [ 753.166245][ T1840] netlink: 'syz.0.6967': attribute type 7 has an invalid length. [ 753.312136][ T1841] ip6gretap0: entered promiscuous mode [ 753.312183][ T1841] ip6gretap0: entered allmulticast mode [ 753.690927][ T1869] netlink: 'syz.5.6975': attribute type 1 has an invalid length. [ 753.737760][ T1869] 8021q: adding VLAN 0 to HW filter on device bond4 [ 753.747515][ T1869] openvswitch: netlink: nsh attribute has 1 unknown bytes. [ 753.826463][ C0] IPVS: sh: UDP 224.0.0.2:0 - no destination available [ 754.524460][ T1910] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 754.534081][ T1910] __nla_validate_parse: 80 callbacks suppressed [ 754.534121][ T1910] netlink: 8 bytes leftover after parsing attributes in process `syz.3.6985'. [ 754.534141][ T1910] netlink: 2 bytes leftover after parsing attributes in process `syz.3.6985'. [ 754.866463][ C0] IPVS: sh: UDP 224.0.0.2:0 - no destination available [ 755.514720][ T1940] netlink: 8 bytes leftover after parsing attributes in process `syz.0.6990'. [ 755.528619][ T1941] netlink: 16 bytes leftover after parsing attributes in process `syz.5.6987'. [ 755.538583][ T1941] netlink: 32 bytes leftover after parsing attributes in process `syz.5.6987'. [ 755.558233][ T1945] netlink: 8 bytes leftover after parsing attributes in process `syz.2.6988'. [ 755.559055][ T1945] netlink: 8 bytes leftover after parsing attributes in process `syz.2.6988'. [ 755.559197][ T1945] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 755.587784][ T1946] x_tables: ip6_tables: SYNPROXY target: used from hooks OUTPUT, but only usable from INPUT/FORWARD [ 755.685545][ T1950] IPVS: Schedule: port zero only supported in persistent services, check your ipvs configuration [ 755.704811][ T1950] netlink: 45349 bytes leftover after parsing attributes in process `syz.2.6991'. [ 755.704944][ T1950] 0猉功D龌: renamed from gretap0 [ 755.722453][ T1950] 0猉功D龌: entered allmulticast mode [ 755.827975][ T1954] netlink: 24 bytes leftover after parsing attributes in process `syz.1.6993'. [ 755.906524][ C0] IPVS: sh: UDP 224.0.0.2:0 - no destination available [ 756.549068][ T1997] netlink: 12 bytes leftover after parsing attributes in process `syz.3.7002'. [ 756.723449][ T2004] netlink: 'syz.1.7004': attribute type 1 has an invalid length. [ 756.815128][ T2004] 8021q: adding VLAN 0 to HW filter on device bond5 [ 756.829527][ T2004] netlink: 'syz.1.7004': attribute type 1 has an invalid length. [ 756.840685][ T2004] netlink: 'syz.1.7004': attribute type 1 has an invalid length. [ 756.946474][ C0] IPVS: sh: UDP 224.0.0.2:0 - no destination available [ 756.953672][ T2010] bond5: (slave geneve2): making interface the new active one [ 756.966969][ T2010] bond5: (slave geneve2): Enslaving as an active interface with an up link [ 757.271899][ T2037] x_tables: duplicate underflow at hook 2 [ 757.285512][ T2038] Cannot find add_set index 2 as target [ 757.479252][ T2053] netlink: 'syz.5.7014': attribute type 9 has an invalid length. [ 757.986497][ C0] IPVS: sh: UDP 224.0.0.2:0 - no destination available [ 759.026478][ C0] IPVS: sh: UDP 224.0.0.2:0 - no destination available [ 760.066614][ C0] IPVS: sh: UDP 224.0.0.2:0 - no destination available [ 760.251501][ T2038] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 761.027524][ T2125] netlink: 'syz.0.7034': attribute type 1 has an invalid length. [ 761.044795][ T2124] nbd: nbd3 already in use [ 761.046103][ T2124] block nbd3: NBD_DISCONNECT [ 761.046130][ T2124] block nbd3: Send disconnect failed -32 [ 761.046146][ T2124] block nbd3: shutting down sockets [ 761.095960][ T2126] batadv_slave_0: entered promiscuous mode [ 761.106505][ C0] IPVS: sh: UDP 224.0.0.2:0 - no destination available [ 761.109139][ T2127] ip6t_REJECT: ECHOREPLY is not supported [ 761.125984][ T2126] __nla_validate_parse: 6 callbacks suppressed [ 761.126041][ T2126] netlink: 4 bytes leftover after parsing attributes in process `syz.2.7030'. [ 761.132902][ T6767] bridge_slave_1: left allmulticast mode [ 761.132934][ T6767] bridge_slave_1: left promiscuous mode [ 761.133140][ T6767] bridge0: port 2(bridge_slave_1) entered disabled state [ 761.213533][ T6767] dvmrp0: left allmulticast mode [ 761.213656][ T6767] dvmrp1: left allmulticast mode [ 761.252059][ T2136] Bluetooth: hci0: unsupported parameter 5161 [ 761.254617][ T2132] netlink: 8 bytes leftover after parsing attributes in process `syz.5.7037'. [ 761.265137][ T2136] Bluetooth: hci0: unsupported parameter 8192 [ 761.265162][ T2136] Bluetooth: hci0: unsupported parameter 5161 [ 761.265174][ T2136] Bluetooth: hci0: unsupported parameter 8192 [ 761.290565][ T2138] netlink: 12 bytes leftover after parsing attributes in process `syz.0.7038'. [ 761.312223][ T2136] IPVS: set_ctl: invalid protocol: 183 0.0.0.0:0 [ 761.539675][ T6767] bond2 (unregistering): (slave erspan2): Releasing active interface [ 761.539717][ T6767] erspan2 (unregistering): left promiscuous mode [ 761.592054][ T6767] bond4 (unregistering): (slave ipip0): Releasing backup interface [ 761.592084][ T6767] ipip0 (unregistering): left promiscuous mode [ 761.628225][ T6767] bond11 (unregistering): (slave geneve6): Releasing active interface [ 761.644181][ T6767] bond3 (unregistering): (slave geneve4): Releasing active interface [ 761.747909][ T6767] bond1 (unregistering): (slave .`): Releasing active interface [ 761.768219][ T6767] .` (unregistering): (slave bond_slave_0): Releasing backup interface [ 761.779954][ T6767] .` (unregistering): (slave bond_slave_1): Releasing backup interface [ 761.790680][ T6767] .` (unregistering): (slave team0): Releasing backup interface [ 761.800928][ T6767] .` (unregistering): Released all slaves [ 761.807876][ T6767] bond1 (unregistering): Released all slaves [ 761.818834][ T6767] bond0 (unregistering): Released all slaves [ 761.831684][ T6767] bond2 (unregistering): Released all slaves [ 761.858752][ T6767] bond3 (unregistering): Released all slaves [ 761.869862][ T6767] bond4 (unregistering): Released all slaves [ 761.880129][ T6767] bond5 (unregistering): Released all slaves [ 761.892028][ T6767] bond6 (unregistering): Released all slaves [ 761.905012][ T6767] bond7 (unregistering): Released all slaves [ 761.921087][ T6767] bond8 (unregistering): Released all slaves [ 761.935450][ T6767] bond9 (unregistering): Released all slaves [ 761.951176][ T6767] bond10 (unregistering): Released all slaves [ 761.962648][ T6767] bond11 (unregistering): Released all slaves [ 761.980831][ T6767] bond12 (unregistering): (slave batadv_slave_0): Removing an active aggregator [ 761.981448][ T6767] bond12 (unregistering): (slave batadv_slave_0): Releasing backup interface [ 762.001540][ T6767] bond12 (unregistering): Released all slaves [ 762.015027][ T6767] bond13 (unregistering): Released all slaves [ 762.029382][ T6767] bond14 (unregistering): (slave veth3): Releasing active interface [ 762.039289][ T6767] bond14 (unregistering): Released all slaves [ 762.070373][ T2126] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 762.090789][ T2124] kthread_run failed with err -4 [ 762.143240][ T2138] workqueue: Failed to create a rescuer kthread for wq "bond2": -EINTR [ 762.147120][ C0] IPVS: sh: UDP 224.0.0.2:0 - no destination available [ 762.213335][ T2143] netlink: 20 bytes leftover after parsing attributes in process `syz.1.7039'. [ 762.331712][ T2146] netlink: 56 bytes leftover after parsing attributes in process `syz.1.7039'. [ 762.348759][ T2145] netlink: 20 bytes leftover after parsing attributes in process `syz.1.7039'. [ 762.348813][ T2145] nbd: nbd64 already in use [ 762.382091][ T2148] netlink: 20 bytes leftover after parsing attributes in process `syz.3.7040'. [ 762.433326][ T6767] ovs-system: left promiscuous mode [ 762.456898][ T2148] netlink: 20 bytes leftover after parsing attributes in process `syz.3.7040'. [ 762.456942][ T2148] nbd: device at index 64 is going down [ 762.503687][ T2155] netlink: 8 bytes leftover after parsing attributes in process `syz.2.7043'. [ 762.768468][ T2163] sctp: [Deprecated]: syz.3.7044 (pid 2163) Use of struct sctp_assoc_value in delayed_ack socket option. [ 762.768468][ T2163] Use struct sctp_sack_info instead [ 762.792541][T20592] udevd[20592]: inotify_add_watch(7, /dev/nbd64, 10) failed: No such file or directory [ 762.800911][T20592] udevd[20592]: inotify_add_watch(7, /dev/nbd64, 10) failed: No such file or directory [ 762.807518][ T2157] bond5: up delay (5) is not a multiple of miimon (4), value rounded to 4 ms [ 762.807548][ T2157] bond5: entered allmulticast mode [ 762.808438][ T6767] tipc: Disabling bearer [ 762.808565][ T6767] tipc: Left network mode [ 762.907501][ T2167] netlink: 'syz.0.7046': attribute type 2 has an invalid length. [ 762.926163][ T2169] netlink: 'syz.1.7045': attribute type 9 has an invalid length. [ 762.926208][ T2169] netlink: 4 bytes leftover after parsing attributes in process `syz.1.7045'. [ 763.032895][ T3333] netdevsim netdevsim1 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0 [ 763.032952][ T3333] netdevsim netdevsim1 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0 [ 763.033305][ T3333] netdevsim netdevsim1 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0 [ 763.033337][ T3333] netdevsim netdevsim1 netdevsim0: set [0, 0] type 1 family 0 port 8472 - 0 [ 763.186482][ C0] IPVS: sh: UDP 224.0.0.2:0 - no destination available [ 763.362647][ T2193] mac80211_hwsim hwsim64 syzkaller0: entered promiscuous mode [ 763.371250][ T2193] mac80211_hwsim hwsim64 syzkaller0: entered allmulticast mode [ 763.509875][ T2196] bond6: Invalid ad_actor_system MAC address. [ 763.509920][ T2196] bond6: option ad_actor_system: invalid value (1) [ 763.524671][ T2196] bond6 (unregistering): Released all slaves [ 763.812876][ T2211] IPv6: NLM_F_CREATE should be specified when creating new route [ 764.209036][ T31] audit: type=1804 audit(1788717539.101:11): pid=2227 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=open_writers comm="syz.3.7064" name="/newroot/210/cgroup.controllers" dev="tmpfs" ino=1093 res=1 errno=0 [ 764.226531][ C0] IPVS: sh: UDP 224.0.0.2:0 - no destination available [ 764.239026][ T31] audit: type=1800 audit(1788717539.101:12): pid=2227 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.3.7064" name="cgroup.controllers" dev="tmpfs" ino=1093 res=0 errno=0 [ 765.148034][ T2257] netlink: 'syz.2.7072': attribute type 2 has an invalid length. [ 765.266487][ C0] IPVS: sh: UDP 224.0.0.2:0 - no destination available [ 765.404643][ T2260] bond6: Unable to set down delay as MII monitoring is disabled [ 765.414397][ T2260] bond6 (unregistering): Released all slaves [ 765.493825][ T5630] Bluetooth: hci1: link tx timeout [ 765.496334][ T5630] Bluetooth: hci1: killing stalled connection 11:aa:aa:aa:aa:aa [ 765.560219][ T2276] netlink: 'syz.3.7075': attribute type 26 has an invalid length. [ 765.591636][ T6767] hsr_slave_0: left promiscuous mode [ 765.600434][ T6767] hsr_slave_1: left promiscuous mode [ 765.624413][ T6767] veth1_macvtap: left promiscuous mode [ 765.624482][ T6767] veth0_macvtap: left promiscuous mode [ 765.624611][ T6767] veth1_vlan: left promiscuous mode [ 765.624719][ T6767] veth0_vlan: left promiscuous mode [ 765.693384][ T2283] netlink: 'syz.5.7079': attribute type 1 has an invalid length. [ 766.107723][ T2300] netlink: 'syz.2.7081': attribute type 39 has an invalid length. [ 766.129556][ T6767] team0 (unregistering): Port device team_slave_1 removed [ 766.138772][T16851] smc: removing ib device syz2 [ 766.184977][ T6767] team0 (unregistering): Port device team_slave_0 removed [ 766.306491][ C0] IPVS: sh: UDP 224.0.0.2:0 - no destination available [ 766.332283][ T61] smbdirect: ib_dev[syz_device_name_32_chars_1234567] removed [ 766.343209][ T2276] netlink: 'syz.3.7075': attribute type 26 has an invalid length. [ 766.343250][ T2276] __nla_validate_parse: 15 callbacks suppressed [ 766.343274][ T2276] netlink: 4 bytes leftover after parsing attributes in process `syz.3.7075'. [ 766.492516][ T2284] syzkaller1: entered allmulticast mode [ 766.523768][ T2305] netlink: 16 bytes leftover after parsing attributes in process `syz.0.7082'. [ 766.542457][T16851] smbdirect: ib_dev[syz2] removed [ 766.621900][ T2292] syzkaller0: entered promiscuous mode [ 766.621931][ T2292] syzkaller0: entered allmulticast mode [ 767.106266][ T2319] netlink: 56 bytes leftover after parsing attributes in process `syz.1.7086'. [ 767.176085][ T2321] netlink: 68 bytes leftover after parsing attributes in process `syz.1.7086'. [ 767.346442][ C0] IPVS: sh: UDP 224.0.0.2:0 - no destination available [ 767.480020][ T2328] netlink: 16 bytes leftover after parsing attributes in process `syz.0.7088'. [ 767.514030][ T5630] Bluetooth: hci1: command 0x0406 tx timeout [ 768.387001][ C0] IPVS: sh: UDP 224.0.0.2:0 - no destination available [ 769.426474][ C0] IPVS: sh: UDP 224.0.0.2:0 - no destination available [ 770.466552][ C0] IPVS: sh: UDP 224.0.0.2:0 - no destination available [ 771.195754][ T6767] IPVS: stop unused estimator thread 0... [ 771.332620][ T2343] netlink: 20 bytes leftover after parsing attributes in process `syz.0.7091'. [ 771.420480][ T2348] netlink: 'syz.3.7093': attribute type 83 has an invalid length. [ 771.506481][ C0] IPVS: sh: UDP 224.0.0.2:0 - no destination available [ 771.619820][ T2370] netlink: 596 bytes leftover after parsing attributes in process `syz.2.7096'. [ 771.641504][ T2372] netlink: 8 bytes leftover after parsing attributes in process `syz.5.7095'. [ 771.641553][ T2372] netlink: 'syz.5.7095': attribute type 5 has an invalid length. [ 771.642331][ T2372] netlink: 20 bytes leftover after parsing attributes in process `syz.5.7095'. [ 771.661991][ T2372] geneve2: entered promiscuous mode [ 771.662014][ T2372] geneve2: entered allmulticast mode [ 771.694386][ T49] netdevsim netdevsim5 netdevsim3: set [1, 1] type 2 family 0 port 256 - 0 [ 771.694463][ T49] netdevsim netdevsim5 netdevsim2: set [1, 1] type 2 family 0 port 256 - 0 [ 771.694519][ T49] netdevsim netdevsim5 netdevsim1: set [1, 1] type 2 family 0 port 256 - 0 [ 771.694573][ T49] netdevsim netdevsim5 netdevsim0: set [1, 1] type 2 family 0 port 256 - 0 [ 771.719881][ T2374] netlink: 8 bytes leftover after parsing attributes in process `syz.0.7097'. [ 772.005876][ T2391] netlink: 48 bytes leftover after parsing attributes in process `syz.3.7101'. [ 772.063476][ T2391] bridge_slave_0: invalid flags given to default FDB implementation [ 772.238639][ T2409] netlink: 4 bytes leftover after parsing attributes in process `syz.0.7102'. [ 772.255122][ T2410] netlink: 4 bytes leftover after parsing attributes in process `syz.0.7102'. [ 772.275858][ T2410] netlink: 4 bytes leftover after parsing attributes in process `syz.0.7102'. [ 772.288085][ T49] netdevsim netdevsim0 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0 [ 772.288250][ T49] netdevsim netdevsim0 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0 [ 772.302624][ T49] netdevsim netdevsim0 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0 [ 772.302690][ T49] netdevsim netdevsim0 netdevsim0: set [0, 0] type 1 family 0 port 8472 - 0 [ 772.378590][ T2424] veth1_macvtap: left promiscuous mode [ 772.420268][ T2424] netlink: 72 bytes leftover after parsing attributes in process `syz.5.7105'. [ 772.546486][ C0] IPVS: sh: UDP 224.0.0.2:0 - no destination available [ 772.934628][ T2474] netlink: 4 bytes leftover after parsing attributes in process `syz.1.7112'. [ 773.360661][ T2504] netlink: 'syz.3.7117': attribute type 1 has an invalid length. [ 773.442036][ T2504] 8021q: adding VLAN 0 to HW filter on device bond2 [ 773.485320][ T2509] bond0: (slave veth0_to_bond): Releasing backup interface [ 773.500973][ T2509] veth0_to_bond: left allmulticast mode [ 773.528700][ T2509] bond2: (slave veth0_to_bond): Enslaving as an active interface with an up link [ 773.578323][ T2510] ref_ctr_offset mismatch. inode: 0x46 offset: 0x0 ref_ctr_offset(old): 0x0 ref_ctr_offset(new): 0x12 [ 773.589575][ C0] IPVS: sh: UDP 224.0.0.2:0 - no destination available [ 773.597255][ T2507] ref_ctr_offset mismatch. inode: 0x46 offset: 0x0 ref_ctr_offset(old): 0x0 ref_ctr_offset(new): 0x12 [ 773.950735][ T2529] netlink: 'syz.1.7122': attribute type 1 has an invalid length. [ 774.045382][ T2530] 0猉功D龌: renamed from gretap0 (while UP) [ 774.054549][ T2530] 0猉功D龌: entered allmulticast mode [ 774.626448][ C0] IPVS: sh: UDP 224.0.0.2:0 - no destination available [ 774.654296][ T2567] netlink: 'syz.5.7131': attribute type 7 has an invalid length. [ 774.656905][ T2564] netlink: 'syz.5.7131': attribute type 7 has an invalid length. [ 774.689718][ T2567] netlink: 'syz.5.7131': attribute type 7 has an invalid length. [ 774.697714][ T49] netdevsim netdevsim5 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0 [ 774.697757][ T49] netdevsim netdevsim5 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0 [ 774.697787][ T49] netdevsim netdevsim5 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0 [ 774.697815][ T49] netdevsim netdevsim5 netdevsim0: set [0, 0] type 1 family 0 port 8472 - 0 [ 774.734245][ T2564] netlink: 'syz.5.7131': attribute type 7 has an invalid length. [ 775.221342][ T2601] macvlan0: left promiscuous mode [ 775.254482][ T2601] veth1_macvtap: entered promiscuous mode [ 775.269510][ T2601] 8021q: adding VLAN 0 to HW filter on device bond1 [ 775.279204][ T2601] bond2: left promiscuous mode [ 775.284469][ T2601] bridge1: left promiscuous mode [ 775.302013][ T2601] 8021q: adding VLAN 0 to HW filter on device bond3 [ 775.315498][ T2601] 8021q: adding VLAN 0 to HW filter on device bond5 [ 775.326463][ T2601] geneve2: left promiscuous mode [ 775.666461][ C0] IPVS: sh: UDP 224.0.0.2:0 - no destination available [ 775.842324][ T2655] vxcan1: entered promiscuous mode [ 775.849508][ T2647] sch_tbf: peakrate 4 is lower than or equals to rate 24576 ! [ 776.024256][ T2663] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 776.567211][ T2711] sctp: [Deprecated]: syz.1.7161 (pid 2711) Use of int in maxseg socket option. [ 776.567211][ T2711] Use struct sctp_assoc_value instead [ 776.706562][ C0] IPVS: sh: UDP 224.0.0.2:0 - no destination available [ 776.809760][ T2725] openvswitch: netlink: IPv6 tunnel dst address is zero [ 776.970380][ T2740] netlink: 'syz.1.7167': attribute type 15 has an invalid length. [ 776.970419][ T2740] __nla_validate_parse: 6 callbacks suppressed [ 776.970447][ T2740] netlink: 24 bytes leftover after parsing attributes in process `syz.1.7167'. [ 777.135635][ T2738] netlink: 12 bytes leftover after parsing attributes in process `syz.1.7167'. [ 777.206961][ T2760] netlink: 28 bytes leftover after parsing attributes in process `syz.5.7170'. [ 777.223562][ T2763] netlink: 'syz.3.7174': attribute type 1 has an invalid length. [ 777.246130][ T2771] netlink: 252 bytes leftover after parsing attributes in process `syz.2.7173'. [ 777.330566][ T2756] netlink: 8 bytes leftover after parsing attributes in process `syz.0.7172'. [ 777.330616][ T2756] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 777.415427][ T2778] netlink: 40 bytes leftover after parsing attributes in process `syz.3.7175'. [ 777.505428][ T2778] netlink: 28 bytes leftover after parsing attributes in process `syz.3.7175'. [ 777.583978][ T2789] syzkaller1: entered promiscuous mode [ 777.584027][ T2789] syzkaller1: entered allmulticast mode [ 777.715057][ T2793] netdevsim netdevsim3: Direct firmware load for .. failed with error -2 [ 777.715103][ T2793] netdevsim netdevsim3: Falling back to sysfs fallback for: .. [ 777.746442][ C0] IPVS: sh: UDP 224.0.0.2:0 - no destination available [ 778.131110][ T2834] smc: net device lo erased user defined pnetid SYZ0 [ 778.166309][ T2838] netlink: 12 bytes leftover after parsing attributes in process `syz.0.7192'. [ 778.221279][ T2834] smc: smcd device lo erased user defined pnetid SYZ0 [ 778.786498][ C0] IPVS: sh: UDP 224.0.0.2:0 - no destination available [ 778.935428][ T2866] bridge0: port 1(bridge_slave_0) entered forwarding state [ 779.826508][ C0] IPVS: sh: UDP 224.0.0.2:0 - no destination available [ 780.866462][ C0] IPVS: sh: UDP 224.0.0.2:0 - no destination available [ 781.053116][ T2839] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 781.164767][ T2872] netlink: 'syz.3.7199': attribute type 1 has an invalid length. [ 781.284255][ T2884] mac80211_hwsim hwsim75 wlan0: entered promiscuous mode [ 781.298241][ T2875] netlink: 8 bytes leftover after parsing attributes in process `syz.5.7200'. [ 781.363102][ T2885] netlink: 165 bytes leftover after parsing attributes in process `syz.3.7199'. [ 781.799965][ T2908] netlink: 'syz.3.7208': attribute type 1 has an invalid length. [ 781.906966][ C0] IPVS: sh: UDP 224.0.0.2:0 - no destination available [ 782.043142][ T2928] __nla_validate_parse: 3 callbacks suppressed [ 782.049866][ T2928] netlink: 20 bytes leftover after parsing attributes in process `syz.1.7214'. [ 782.151619][ T2933] netlink: 'syz.2.7216': attribute type 2 has an invalid length. [ 782.209819][ T2936] netlink: 24 bytes leftover after parsing attributes in process `syz.0.7217'. [ 782.244051][ T2938] netlink: 124 bytes leftover after parsing attributes in process `syz.1.7218'. [ 782.344519][ T2936] netlink: 4 bytes leftover after parsing attributes in process `syz.0.7217'. [ 782.401556][ T2944] 0猉功D龌: entered promiscuous mode [ 782.404376][ T2941] IPVS: Schedule: port zero only supported in persistent services, check your ipvs configuration [ 782.420667][ T2944] vlan2: entered promiscuous mode [ 782.452532][ T2945] vcan0: entered allmulticast mode [ 782.460467][ T2948] netlink: 4 bytes leftover after parsing attributes in process `syz.5.7219'. [ 782.467748][ T2948] netlink: 132 bytes leftover after parsing attributes in process `syz.5.7219'. [ 782.546777][ T2950] netlink: 'syz.0.7222': attribute type 1 has an invalid length. [ 782.734934][ T2959] netlink: 8 bytes leftover after parsing attributes in process `syz.0.7225'. [ 782.734977][ T2959] netlink: 20 bytes leftover after parsing attributes in process `syz.0.7225'. [ 782.915825][ T2965] openvswitch: netlink: Flow actions attr not present in new flow. [ 782.946677][ C0] IPVS: sh: UDP 224.0.0.2:0 - no destination available [ 783.474437][ T3004] netlink: 12 bytes leftover after parsing attributes in process `syz.3.7240'. [ 783.656181][ T3018] netlink: 12 bytes leftover after parsing attributes in process `syz.1.7243'. [ 783.986479][ C0] IPVS: sh: UDP 224.0.0.2:0 - no destination available [ 784.080001][ T3045] netlink: 'syz.0.7250': attribute type 10 has an invalid length. [ 784.090402][ T3045] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 784.100548][ T3045] bond0: (slave netdevsim1): Enslaving as an active interface with a down link [ 784.374875][ T3021] ip_tables: iptables: counters copy to user failed while replacing table [ 784.401903][ T3067] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 784.405886][ T3073] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 784.423215][ T3063] veth0_vlan: entered allmulticast mode [ 784.870129][ T3088] bridge_slave_1: left allmulticast mode [ 784.870178][ T3088] bridge_slave_1: left promiscuous mode [ 784.870419][ T3088] bridge0: port 2(bridge_slave_1) entered disabled state [ 785.003954][ T3088] bridge_slave_0: left allmulticast mode [ 785.011289][ T3088] bridge_slave_0: left promiscuous mode [ 785.017897][ T3088] bridge0: port 1(bridge_slave_0) entered disabled state [ 785.026612][ C0] IPVS: sh: UDP 224.0.0.2:0 - no destination available [ 785.560125][ T3133] Bluetooth: hci0: unsupported parameter 5135 [ 785.560168][ T3133] Bluetooth: hci0: unsupported parameter 8192 [ 785.560190][ T3133] Bluetooth: hci0: unsupported parameter 5135 [ 785.560201][ T3133] Bluetooth: hci0: unsupported parameter 8192 [ 785.713154][ T3140] netlink: 'syz.0.7273': attribute type 30 has an invalid length. [ 785.789164][ T3140] xt_esp: unknown flags DD [ 785.980333][ T3166] openvswitch: netlink: Missing key (keys=40, expected=200000) [ 786.066509][ C0] IPVS: sh: UDP 224.0.0.2:0 - no destination available [ 786.363043][ T3180] 8021q: VLANs not supported on ip_vti0 [ 786.535212][ T3198] xt_IDLETIMER: label is empty or not nul-terminated [ 786.799896][ T3206] ipvlan3: entered allmulticast mode [ 786.799947][ T3206] mac80211_hwsim hwsim61 wlan0: entered allmulticast mode [ 786.821193][ T3206] batman_adv: batadv0: Adding interface: ipvlan3 [ 786.821232][ T3206] batman_adv: batadv0: The MTU of interface ipvlan3 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 786.821263][ T3206] batman_adv: batadv0: Interface activated: ipvlan3 [ 786.899358][ T3220] netdevsim netdevsim3: Direct firmware load for .. failed with error -2 [ 786.899409][ T3220] netdevsim netdevsim3: Falling back to sysfs fallback for: .. [ 787.106490][ C0] IPVS: sh: UDP 224.0.0.2:0 - no destination available [ 787.154070][ T3237] sctp: [Deprecated]: syz.0.7295 (pid 3237) Use of struct sctp_assoc_value in delayed_ack socket option. [ 787.154070][ T3237] Use struct sctp_sack_info instead [ 787.298246][ T3246] __nla_validate_parse: 9 callbacks suppressed [ 787.304961][ T3246] netlink: 72 bytes leftover after parsing attributes in process `syz.2.7297'. [ 787.470587][ T3260] IPVS: set_ctl: invalid protocol: 22 10.1.1.1:20004 [ 787.483905][ T3260] IPVS: set_ctl: invalid protocol: 22 10.1.1.1:20004 [ 787.729579][ T3272] Bluetooth: hci0: unsupported parameter 5135 [ 787.729615][ T3272] Bluetooth: hci0: unsupported parameter 8192 [ 787.729640][ T3272] Bluetooth: hci0: unsupported parameter 5135 [ 787.729653][ T3272] Bluetooth: hci0: unsupported parameter 8192 [ 787.871484][ T3277] sctp: [Deprecated]: syz.3.7304 (pid 3277) Use of struct sctp_assoc_value in delayed_ack socket option. [ 787.871484][ T3277] Use struct sctp_sack_info instead [ 787.871544][ T3277] sctp: [Deprecated]: syz.3.7304 (pid 3277) Use of struct sctp_assoc_value in delayed_ack socket option. [ 787.871544][ T3277] Use struct sctp_sack_info instead [ 787.871567][ T3277] sctp: [Deprecated]: syz.3.7304 (pid 3277) Use of struct sctp_assoc_value in delayed_ack socket option. [ 787.871567][ T3277] Use struct sctp_sack_info instead [ 787.871586][ T3277] sctp: [Deprecated]: syz.3.7304 (pid 3277) Use of struct sctp_assoc_value in delayed_ack socket option. [ 787.871586][ T3277] Use struct sctp_sack_info instead [ 787.871605][ T3277] sctp: [Deprecated]: syz.3.7304 (pid 3277) Use of struct sctp_assoc_value in delayed_ack socket option. [ 787.871605][ T3277] Use struct sctp_sack_info instead [ 787.871626][ T3277] sctp: [Deprecated]: syz.3.7304 (pid 3277) Use of struct sctp_assoc_value in delayed_ack socket option. [ 787.871626][ T3277] Use struct sctp_sack_info instead [ 787.871649][ T3277] sctp: [Deprecated]: syz.3.7304 (pid 3277) Use of struct sctp_assoc_value in delayed_ack socket option. [ 787.871649][ T3277] Use struct sctp_sack_info instead [ 787.871672][ T3277] sctp: [Deprecated]: syz.3.7304 (pid 3277) Use of struct sctp_assoc_value in delayed_ack socket option. [ 787.871672][ T3277] Use struct sctp_sack_info instead [ 787.871694][ T3277] sctp: [Deprecated]: syz.3.7304 (pid 3277) Use of struct sctp_assoc_value in delayed_ack socket option. [ 787.871694][ T3277] Use struct sctp_sack_info instead [ 788.118645][ T3294] h: entered promiscuous mode [ 788.134690][ T3294] netlink: 68 bytes leftover after parsing attributes in process `syz.5.7308'. [ 788.146453][ C0] IPVS: sh: UDP 224.0.0.2:0 - no destination available [ 788.180197][ T3301] netlink: 68 bytes leftover after parsing attributes in process `syz.5.7308'. [ 788.535522][ T3319] netlink: 60 bytes leftover after parsing attributes in process `syz.5.7313'. [ 788.535570][ T3319] netlink: 60 bytes leftover after parsing attributes in process `syz.5.7313'. [ 788.567782][ T3319] netlink: 60 bytes leftover after parsing attributes in process `syz.5.7313'. [ 788.567825][ T3319] netlink: 60 bytes leftover after parsing attributes in process `syz.5.7313'. [ 788.888589][ T3352] netlink: 'syz.3.7321': attribute type 4 has an invalid length. [ 789.140404][ T3367] netlink: 36 bytes leftover after parsing attributes in process `syz.1.7326'. [ 789.162736][ T3370] netlink: 144 bytes leftover after parsing attributes in process `syz.2.7327'. [ 789.186486][ C0] IPVS: sh: UDP 224.0.0.2:0 - no destination available [ 789.274424][ T3374] siw: device registration error -23 [ 789.449461][ T3382] openvswitch: netlink: IP tunnel attribute has 5393 unknown bytes. [ 789.714726][ T3396] netlink: 'syz.2.7337': attribute type 1 has an invalid length. [ 789.714764][ T3396] netlink: 200 bytes leftover after parsing attributes in process `syz.2.7337'. [ 789.754182][ T3398] netlink: 'syz.1.7338': attribute type 2 has an invalid length. [ 789.828963][ T3402] macsec1: entered promiscuous mode [ 790.157301][ T3424] veth3: entered promiscuous mode [ 790.167323][ T3424] netlink: 'syz.3.7347': attribute type 10 has an invalid length. [ 790.226444][ C0] IPVS: sh: UDP 224.0.0.2:0 - no destination available [ 790.410865][ T3437] IPVS: set_ctl: invalid protocol: 60 10.1.1.2:17408 [ 790.449272][ T3438] Cannot find map_set index 2 as target [ 790.614743][ T3441] syzkaller1: entered promiscuous mode [ 790.614769][ T3441] syzkaller1: entered allmulticast mode [ 790.718499][ T3455] openvswitch: netlink: Multiple metadata blocks provided [ 790.825896][ T3457] hsr_slave_1 (unregistering): left promiscuous mode [ 790.833567][ T3461] sctp: [Deprecated]: syz.5.7358 (pid 3461) Use of int in maxseg socket option. [ 790.833567][ T3461] Use struct sctp_assoc_value instead [ 790.882176][ T3460] dvmrp0: entered allmulticast mode [ 790.960647][ T3469] netlink: 'syz.1.7361': attribute type 1 has an invalid length. [ 791.024707][ T3469] 8021q: adding VLAN 0 to HW filter on device bond7 [ 791.266481][ C0] IPVS: sh: UDP 224.0.0.2:0 - no destination available [ 791.597951][ T3502] syzkaller0: entered promiscuous mode [ 791.598001][ T3502] syzkaller0: entered allmulticast mode [ 791.599425][ T3510] netlink: 'syz.3.7372': attribute type 12 has an invalid length. [ 792.306528][ C0] IPVS: sh: UDP 224.0.0.2:0 - no destination available [ 793.355622][ C0] IPVS: sh: UDP 224.0.0.2:0 - no destination available [ 794.386437][ C0] IPVS: sh: UDP 224.0.0.2:0 - no destination available [ 794.503596][ T3547] netlink: 'syz.5.7385': attribute type 29 has an invalid length. [ 794.678902][ T3558] __nla_validate_parse: 18 callbacks suppressed [ 794.678946][ T3558] netlink: 524 bytes leftover after parsing attributes in process `syz.0.7386'. [ 794.738420][ T3568] netlink: 11680 bytes leftover after parsing attributes in process `syz.5.7387'. [ 794.851113][ T3568] hsr_slave_1 (unregistering): left promiscuous mode [ 795.068849][ T3585] bond1: option mode: unable to set because the bond device is up [ 795.167288][ T3590] netlink: 'syz.0.7397': attribute type 27 has an invalid length. [ 795.206170][ T3585] bond1: (slave vlan2): Enslaving as an active interface with an up link [ 795.261475][ T3592] netlink: 9 bytes leftover after parsing attributes in process `syz.2.7396'. [ 795.272704][ T3596] netlink: 5 bytes leftover after parsing attributes in process `syz.2.7396'. [ 795.293996][ T3592] 0猉功D龌: left allmulticast mode [ 795.302920][ T3596] 0{X功: renamed from 00猉功D龌 [ 795.320671][ T3596] 0{X功: entered allmulticast mode [ 795.329927][ T3596] A link change request failed with some changes committed already. Interface 30{X功 may have been left with an inconsistent configuration, please check. [ 795.372935][ T3600] netdevsim netdevsim0 netdevsim0: entered promiscuous mode [ 795.426462][ C0] IPVS: sh: UDP 224.0.0.2:0 - no destination available [ 795.527205][ T3604] ip6_vti0: entered promiscuous mode [ 795.527364][ T3604] netlink: 8 bytes leftover after parsing attributes in process `syz.0.7401'. [ 795.573378][ T3613] syzkaller1: left promiscuous mode [ 795.573430][ T3613] syzkaller1: left allmulticast mode [ 795.946748][ T3633] netlink: 8 bytes leftover after parsing attributes in process `syz.1.7408'. [ 796.100046][ T3638] netlink: 8 bytes leftover after parsing attributes in process `syz.5.7409'. [ 796.109500][ T3638] netlink: 4 bytes leftover after parsing attributes in process `syz.5.7409'. [ 796.118970][ T3638] netlink: 'syz.5.7409': attribute type 15 has an invalid length. [ 796.144268][ T3638] netlink: 8 bytes leftover after parsing attributes in process `syz.5.7409'. [ 796.144312][ T3638] netlink: 4 bytes leftover after parsing attributes in process `syz.5.7409'. [ 796.144349][ T3638] netlink: 'syz.5.7409': attribute type 15 has an invalid length. [ 796.388107][ T3641] pim6reg527: entered allmulticast mode [ 796.394263][ T3643] tipc: Enabling of bearer rejected, failed to enable media [ 796.428822][ T3646] openvswitch: netlink: Duplicate key (type 6). [ 796.433224][ T3646] openvswitch: netlink: Duplicate key (type 6). [ 796.466473][ C0] IPVS: sh: UDP 224.0.0.2:0 - no destination available [ 796.621878][ T3655] veth0_macvtap: left promiscuous mode [ 797.068527][ T3683] netlink: 'syz.0.7423': attribute type 34 has an invalid length. [ 797.506466][ C0] IPVS: sh: UDP 224.0.0.2:0 - no destination available [ 798.079301][ T3762] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 798.546425][ C0] IPVS: sh: UDP 224.0.0.2:0 - no destination available [ 798.835781][ T3806] x_tables: ip_tables: tcpmss match: only valid for protocol 6 [ 798.859083][ T3806] gretap1: default qdisc (pfifo_fast) fail, fallback to noqueue [ 798.860839][ T3806] gretap1: entered promiscuous mode [ 798.860856][ T3806] gretap1: entered allmulticast mode [ 798.964513][ T3796] bond4: entered promiscuous mode [ 798.965273][ T3796] bond4: entered allmulticast mode [ 798.965607][ T3796] 8021q: adding VLAN 0 to HW filter on device bond4 [ 799.083557][ T3823] syzkaller0: entered promiscuous mode [ 799.089834][ T3823] syzkaller0: entered allmulticast mode [ 799.264038][ T3838] batman_adv: batadv0: Adding interface: veth0 [ 799.266436][ T3838] batman_adv: batadv0: The MTU of interface veth0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 799.266470][ T3838] batman_adv: batadv0: Interface activated: veth0 [ 799.283595][ T3838] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 799.312150][ T3838] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 799.314844][ T3838] batman_adv: batadv0: Interface deactivated: veth0 [ 799.314866][ T3838] batman_adv: batadv0: Removing interface: veth0 [ 799.586469][ C0] IPVS: sh: UDP 224.0.0.2:0 - no destination available [ 799.733005][ T3858] __nla_validate_parse: 21 callbacks suppressed [ 799.733076][ T3858] netlink: 60 bytes leftover after parsing attributes in process `syz.2.7474'. [ 800.263829][ T3873] netlink: 24 bytes leftover after parsing attributes in process `syz.2.7480'. [ 800.339147][ T3877] netlink: 4 bytes leftover after parsing attributes in process `syz.3.7481'. [ 800.626431][ C0] IPVS: sh: UDP 224.0.0.2:0 - no destination available [ 800.804469][ T3898] netlink: 'syz.2.7489': attribute type 5 has an invalid length. [ 800.841045][ T3902] netlink: 12 bytes leftover after parsing attributes in process `syz.0.7487'. [ 801.521958][ T3933] netlink: 'syz.0.7498': attribute type 5 has an invalid length. [ 801.521996][ T3933] netlink: 'syz.0.7498': attribute type 9 has an invalid length. [ 801.522029][ T3933] netlink: 4 bytes leftover after parsing attributes in process `syz.0.7498'. [ 801.525628][ T3937] batadv_slave_1: entered promiscuous mode [ 801.632213][ T3937] batadv_slave_1: left promiscuous mode [ 801.666475][ C0] IPVS: sh: UDP 224.0.0.2:0 - no destination available [ 801.704394][ T3942] netlink: 'syz.0.7503': attribute type 9 has an invalid length. [ 801.798231][ T3944] netlink: 20 bytes leftover after parsing attributes in process `syz.3.7502'. [ 801.856243][ T3954] netlink: 16186 bytes leftover after parsing attributes in process `syz.5.7501'. [ 801.911251][ T3959] netlink: 'syz.3.7507': attribute type 33 has an invalid length. [ 802.060180][ T3963] netlink: 12 bytes leftover after parsing attributes in process `syz.2.7508'. [ 802.251480][ T3981] netlink: 12 bytes leftover after parsing attributes in process `syz.2.7513'. [ 802.330989][ T3986] netlink: 12 bytes leftover after parsing attributes in process `syz.0.7515'. [ 802.429176][ T3994] ksmbd: Daemon and kernel module version mismatch. ksmbd: 0, kernel module: 1. User-space ksmbd should terminate. [ 802.430680][ T3994] ksmbd: Daemon and kernel module version mismatch. ksmbd: 0, kernel module: 1. User-space ksmbd should terminate. [ 802.706441][ C0] IPVS: sh: UDP 224.0.0.2:0 - no destination available [ 802.864825][ T4013] netlink: 'syz.2.7520': attribute type 11 has an invalid length. [ 803.746476][ C0] IPVS: sh: UDP 224.0.0.2:0 - no destination available [ 803.792996][ T4072] netlink: 'syz.1.7536': attribute type 1 has an invalid length. [ 803.793024][ T4072] netlink: 'syz.1.7536': attribute type 3 has an invalid length. [ 803.849059][ T4078] bond5: option ad_actor_sys_prio: mode dependency failed, not supported in mode balance-rr(0) [ 803.863327][ T4078] bond5 (unregistering): Released all slaves [ 803.952089][ T4071] sch_tbf: burst 0 is lower than device syzkaller0 mtu (1514) ! [ 803.961889][ T4076] sch_tbf: burst 0 is lower than device syzkaller0 mtu (1514) ! [ 803.971261][ T4087] syzkaller0: entered promiscuous mode [ 803.971345][ T4087] syzkaller0: entered allmulticast mode [ 804.602026][ T4138] netlink: 'syz.3.7552': attribute type 1 has an invalid length. [ 804.662155][ T4140] bond2: (slave veth0_to_bond): Releasing backup interface [ 804.697895][ T4140] bond4: (slave veth0_to_bond): making interface the new active one [ 804.715132][ T4140] bond4: (slave veth0_to_bond): Enslaving as an active interface with an up link [ 804.786796][ C0] IPVS: sh: UDP 224.0.0.2:0 - no destination available [ 804.837288][ T4155] 8021q: adding VLAN 0 to HW filter on device bond8 [ 804.932689][ T4163] __nla_validate_parse: 6 callbacks suppressed [ 804.941081][ T4163] netlink: 16 bytes leftover after parsing attributes in process `syz.2.7561'. [ 804.953398][ T4163] netlink: 'syz.2.7561': attribute type 5 has an invalid length. [ 805.180188][ T4179] netlink: 68 bytes leftover after parsing attributes in process `syz.1.7564'. [ 805.291009][ T4187] netlink: 156 bytes leftover after parsing attributes in process `syz.5.7566'. [ 805.321580][ T4183] syzkaller0: entered promiscuous mode [ 805.321628][ T4183] syzkaller0: entered allmulticast mode [ 805.425808][ T4197] netlink: 128 bytes leftover after parsing attributes in process `syz.3.7571'. [ 805.477880][ T4198] netlink: 128 bytes leftover after parsing attributes in process `syz.3.7571'. [ 805.620680][ T4206] netlink: 60 bytes leftover after parsing attributes in process `syz.2.7573'. [ 805.835984][ C0] IPVS: sh: UDP 224.0.0.2:0 - no destination available [ 806.145722][ T4227] netlink: 8 bytes leftover after parsing attributes in process `syz.0.7574'. [ 806.875219][ C0] IPVS: sh: UDP 224.0.0.2:0 - no destination available [ 807.906836][ C0] IPVS: sh: UDP 224.0.0.2:0 - no destination available [ 808.277896][ T4191] bond2: (slave lo): Releasing backup interface [ 808.284909][ T4191] bond2: (slave lo): last VLAN challenged slave left bond - VLAN blocking is removed [ 808.486056][ T4191] bridge0: port 2(bridge_slave_1) entered disabled state [ 808.488316][ T4191] bridge0: port 1(bridge_slave_0) entered disabled state [ 808.523565][ T4239] netlink: 108 bytes leftover after parsing attributes in process `syz.5.7575'. [ 808.534202][ T4239] validate_nla: 3 callbacks suppressed [ 808.540273][ T4239] netlink: 'syz.5.7575': attribute type 2 has an invalid length. [ 808.724622][ T4191] bridge_slave_0: left allmulticast mode [ 808.724681][ T4191] bridge_slave_0: left promiscuous mode [ 808.724866][ T4191] bridge0: port 1(bridge_slave_0) entered disabled state [ 808.762438][ T4191] bridge_slave_1: left allmulticast mode [ 808.762467][ T4191] bridge_slave_1: left promiscuous mode [ 808.762673][ T4191] bridge0: port 2(bridge_slave_1) entered disabled state [ 808.783627][ T4191] bond0: (slave veth0_to_bond): Releasing backup interface [ 808.799076][ T4191] bond0: (slave bond_slave_0): Releasing backup interface [ 808.812805][ T4191] bond0: (slave bond_slave_1): Releasing backup interface [ 808.839121][ T4191] team0: Port device team_slave_0 removed [ 808.867653][ T4191] team0: Port device team_slave_1 removed [ 808.879709][ T4191] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 808.894857][ T4191] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 808.912144][ T4191] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 808.927692][ T4191] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 808.946719][ C0] IPVS: sh: UDP 224.0.0.2:0 - no destination available [ 808.973656][ T4191] A link change request failed with some changes committed already. Interface hsr_slave_0 may have been left with an inconsistent configuration, please check. [ 808.973785][ T4197] netlink: 'syz.3.7571': attribute type 4 has an invalid length. [ 808.973800][ T4197] netlink: 'syz.3.7571': attribute type 5 has an invalid length. [ 808.973812][ T4197] netlink: 3 bytes leftover after parsing attributes in process `syz.3.7571'. [ 808.977344][ T4198] netlink: 'syz.3.7571': attribute type 4 has an invalid length. [ 808.977364][ T4198] netlink: 'syz.3.7571': attribute type 5 has an invalid length. [ 808.977375][ T4198] netlink: 3 bytes leftover after parsing attributes in process `syz.3.7571'. [ 809.266295][ T4256] tipc: Failed to obtain node identity [ 809.266428][ T4256] tipc: Enabling of bearer rejected, failed to enable media [ 809.266599][ T4256] tipc: Failed to obtain node identity [ 809.266628][ T4256] tipc: Enabling of bearer rejected, failed to enable media [ 809.266772][ T4256] tipc: Failed to obtain node identity [ 809.266800][ T4256] tipc: Enabling of bearer rejected, failed to enable media [ 809.266944][ T4256] tipc: Failed to obtain node identity [ 809.266967][ T4256] tipc: Enabling of bearer rejected, failed to enable media [ 809.267115][ T4256] tipc: Failed to obtain node identity [ 809.267141][ T4256] tipc: Enabling of bearer rejected, failed to enable media [ 809.267318][ T4256] tipc: Failed to obtain node identity [ 809.267372][ T4256] tipc: Enabling of bearer rejected, failed to enable media [ 809.267522][ T4256] tipc: Failed to obtain node identity [ 809.267547][ T4256] tipc: Enabling of bearer rejected, failed to enable media [ 809.276540][ T4256] tipc: Failed to obtain node identity [ 809.276571][ T4256] tipc: Enabling of bearer rejected, failed to enable media [ 809.609979][ T4271] netlink: 'syz.1.7583': attribute type 3 has an invalid length. [ 809.618542][ T4271] netlink: 'syz.1.7583': attribute type 3 has an invalid length. [ 809.839719][ T4282] netlink: 'syz.1.7588': attribute type 5 has an invalid length. [ 809.859588][ T4282] geneve4: entered promiscuous mode [ 809.859613][ T4282] geneve4: entered allmulticast mode [ 809.898082][ T6767] netdevsim netdevsim1 netdevsim0: set [1, 1] type 2 family 0 port 256 - 0 [ 809.908253][ T6767] netdevsim netdevsim1 netdevsim1: set [1, 1] type 2 family 0 port 256 - 0 [ 809.919583][ T61] netdevsim netdevsim1 netdevsim2: set [1, 1] type 2 family 0 port 256 - 0 [ 809.919755][ T61] netdevsim netdevsim1 netdevsim3: set [1, 1] type 2 family 0 port 256 - 0 [ 809.986670][ C0] IPVS: sh: UDP 224.0.0.2:0 - no destination available [ 810.116652][ T4304] netlink: 'syz.3.7592': attribute type 1 has an invalid length. [ 810.124557][ T4304] netlink: 'syz.3.7592': attribute type 2 has an invalid length. [ 810.124576][ T4304] __nla_validate_parse: 70 callbacks suppressed [ 810.124587][ T4304] netlink: 16 bytes leftover after parsing attributes in process `syz.3.7592'. [ 811.026439][ C0] IPVS: sh: UDP 224.0.0.2:0 - no destination available [ 812.066446][ C0] IPVS: sh: UDP 224.0.0.2:0 - no destination available [ 813.055724][ T4295] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 813.106430][ C0] IPVS: sh: UDP 224.0.0.2:0 - no destination available [ 813.361571][ T4343] sch_fq: defrate 0 ignored. [ 813.369730][ T4345] sch_fq: defrate 0 ignored. [ 813.450628][ T4354] netlink: 8 bytes leftover after parsing attributes in process `syz.0.7606'. [ 813.480473][ T4348] Cannot find add_set index 0 as target [ 813.510938][ T4363] netlink: 8 bytes leftover after parsing attributes in process `syz.5.7608'. [ 813.523778][ T4363] netlink: 4 bytes leftover after parsing attributes in process `syz.5.7608'. [ 813.575092][ T4360] A link change request failed with some changes committed already. Interface hsr_slave_0 may have been left with an inconsistent configuration, please check. [ 814.001662][ T4383] tipc: Enabling of bearer rejected, failed to enable media [ 814.146423][ C0] IPVS: sh: UDP 224.0.0.2:0 - no destination available [ 814.293775][ T4391] syzkaller1: entered promiscuous mode [ 814.293830][ T4391] syzkaller1: entered allmulticast mode [ 814.713199][ T4411] x_tables: ip_tables: TPROXY target: used from hooks FORWARD, but only usable from PREROUTING [ 814.943038][ T4421] IPVS: Error connecting to the multicast addr [ 814.960879][ T4423] IPVS: Unknown mcast interface:  [ 815.186431][ C0] IPVS: sh: UDP 224.0.0.2:0 - no destination available [ 816.162258][ T4457] syzkaller0: entered promiscuous mode [ 816.162287][ T4457] syzkaller0: entered allmulticast mode [ 816.226442][ C0] IPVS: sh: UDP 224.0.0.2:0 - no destination available [ 817.266440][ C0] IPVS: sh: UDP 224.0.0.2:0 - no destination available [ 817.902570][ T4416] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 818.158823][ T4466] netlink: 12 bytes leftover after parsing attributes in process `syz.5.7632'. [ 818.172547][ T4466] netlink: 12 bytes leftover after parsing attributes in process `syz.5.7632'. [ 818.173723][ T4463] syzkaller1: entered promiscuous mode [ 818.173743][ T4463] syzkaller1: entered allmulticast mode [ 818.306470][ C0] IPVS: sh: UDP 224.0.0.2:0 - no destination available [ 818.384865][ T4479] IPVS: set_ctl: invalid protocol: 47 172.20.20.187:20000 [ 818.407695][ T4469] netlink: 20 bytes leftover after parsing attributes in process `syz.2.7633'. [ 818.422110][ T4469] netlink: 104 bytes leftover after parsing attributes in process `syz.2.7633'. [ 818.454742][ T4482] mac80211_hwsim hwsim76 wlan1: (WE) : Wireless Event (cmd=0x8B1A) too big (33) [ 818.635966][ T4492] netlink: 136 bytes leftover after parsing attributes in process `syz.1.7639'. [ 818.665896][ T4490] netlink: 40 bytes leftover after parsing attributes in process `syz.0.7641'. [ 818.748846][ T4496] Bluetooth: hci0: Opcode 0x080f failed: -22 [ 819.063812][ T4514] xt_CT: You must specify a L4 protocol and not use inversions on it [ 819.233682][ T4523] netlink: 8 bytes leftover after parsing attributes in process `syz.3.7651'. [ 819.338955][ T4529] netlink: 144 bytes leftover after parsing attributes in process `syz.3.7651'. [ 819.348224][ C0] IPVS: sh: UDP 224.0.0.2:0 - no destination available [ 819.580882][ T4547] netlink: 32 bytes leftover after parsing attributes in process `syz.2.7659'. [ 819.751558][ T4556] netlink: 40 bytes leftover after parsing attributes in process `syz.1.7662'. [ 819.893851][ T4562] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 819.909792][ T4564] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 820.386470][ C0] IPVS: sh: UDP 224.0.0.2:0 - no destination available [ 821.426423][ C0] IPVS: sh: UDP 224.0.0.2:0 - no destination available [ 821.964875][ T4649] SET target dimension over the limit! [ 821.991872][ T4649] validate_nla: 2 callbacks suppressed [ 821.991952][ T4649] netlink: 'syz.5.7691': attribute type 1 has an invalid length. [ 822.194296][ T4656] netlink: 'syz.2.7694': attribute type 4 has an invalid length. [ 822.466427][ C0] IPVS: sh: UDP 224.0.0.2:0 - no destination available [ 823.481223][ T4703] netlink: 'syz.0.7712': attribute type 10 has an invalid length. [ 823.506422][ C0] IPVS: sh: UDP 224.0.0.2:0 - no destination available [ 823.547437][ T4705] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 823.550127][ T4705] syzkaller0: entered promiscuous mode [ 823.550148][ T4705] syzkaller0: entered allmulticast mode [ 823.962646][ T4725] __nla_validate_parse: 12 callbacks suppressed [ 823.962702][ T4725] netlink: 80 bytes leftover after parsing attributes in process `syz.3.7717'. [ 824.032539][ T4725] netlink: 'syz.3.7717': attribute type 4 has an invalid length. [ 824.217207][ T4732] netlink: 'syz.2.7721': attribute type 1 has an invalid length. [ 824.546442][ C0] IPVS: sh: UDP 224.0.0.2:0 - no destination available [ 824.704928][ T4761] netlink: 156 bytes leftover after parsing attributes in process `syz.3.7727'. [ 824.915720][ T4766] netlink: 71 bytes leftover after parsing attributes in process `syz.3.7728'. [ 825.236823][ T4772] netlink: 8 bytes leftover after parsing attributes in process `syz.3.7730'. [ 825.240435][ T4772] netlink: 'syz.3.7730': attribute type 21 has an invalid length. [ 825.240488][ T4772] netlink: 128 bytes leftover after parsing attributes in process `syz.3.7730'. [ 825.240545][ T4772] netlink: 'syz.3.7730': attribute type 4 has an invalid length. [ 825.240562][ T4772] netlink: 'syz.3.7730': attribute type 5 has an invalid length. [ 825.240577][ T4772] netlink: 3 bytes leftover after parsing attributes in process `syz.3.7730'. [ 825.242853][ T4772] IPVS: set_ctl: invalid protocol: 51 172.20.20.31:20001 [ 825.333905][ T4770] netlink: 12 bytes leftover after parsing attributes in process `syz.3.7730'. [ 825.353488][ T4770] openvswitch: netlink: Missing key (keys=40, expected=100) [ 825.485672][ T4774] bond0: entered allmulticast mode [ 825.485712][ T4774] bond_slave_0: entered allmulticast mode [ 825.485734][ T4774] bond_slave_1: entered allmulticast mode [ 825.485766][ T4774] netdevsim netdevsim0 netdevsim1: entered allmulticast mode [ 825.567821][ T4779] netlink: 'syz.2.7732': attribute type 1 has an invalid length. [ 825.586427][ C0] IPVS: sh: UDP 224.0.0.2:0 - no destination available [ 825.808398][ T4791] A link change request failed with some changes committed already. Interface geneve0 may have been left with an inconsistent configuration, please check. [ 825.840098][ T4791] xt_addrtype: input interface limitation not valid in POSTROUTING and OUTPUT [ 825.849359][ T4784] xt_addrtype: input interface limitation not valid in POSTROUTING and OUTPUT [ 826.052399][ T4800] netlink: 12 bytes leftover after parsing attributes in process `syz.2.7736'. [ 826.171855][ T4803] netlink: 'syz.2.7741': attribute type 10 has an invalid length. [ 826.424720][ T4819] netlink: 12 bytes leftover after parsing attributes in process `syz.0.7740'. [ 826.424916][ T4819] netlink: 12 bytes leftover after parsing attributes in process `syz.0.7740'. [ 826.449594][ T4824] batadv_slave_0: entered promiscuous mode [ 826.456621][ T4823] batadv_slave_0: left promiscuous mode [ 826.626752][ C0] IPVS: sh: UDP 224.0.0.2:0 - no destination available [ 827.504974][ T4869] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 827.520880][ T4867] netlink: 'syz.5.7753': attribute type 39 has an invalid length. [ 827.666574][ C0] IPVS: sh: UDP 224.0.0.2:0 - no destination available [ 827.825968][ T4882] sch_tbf: burst 0 is lower than device lo mtu (65550) ! [ 827.971370][ T4890] ipt_ECN: cannot use operation on non-tcp rule [ 828.263050][ T4900] ip6_vti0: left promiscuous mode [ 828.706638][ C0] IPVS: sh: UDP 224.0.0.2:0 - no destination available [ 828.965583][ T4934] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 829.223628][ T4951] syzkaller1: left promiscuous mode [ 829.223674][ T4951] syzkaller1: left allmulticast mode [ 829.309922][ T4956] ip_tables: iptables: counters copy to user failed while replacing table [ 829.747397][ C0] IPVS: sh: UDP 224.0.0.2:0 - no destination available [ 829.924536][ T4995] __nla_validate_parse: 2 callbacks suppressed [ 829.924928][ T4995] netlink: 28 bytes leftover after parsing attributes in process `syz.0.7779'. [ 829.941205][ T4995] netlink: 28 bytes leftover after parsing attributes in process `syz.0.7779'. [ 829.941666][ T4995] netlink: 28 bytes leftover after parsing attributes in process `syz.0.7779'. [ 829.944018][ T4998] netlink: 28 bytes leftover after parsing attributes in process `syz.0.7779'. [ 829.944527][ T4997] netlink: 28 bytes leftover after parsing attributes in process `syz.0.7779'. [ 829.946174][ T4999] netlink: 28 bytes leftover after parsing attributes in process `syz.0.7779'. [ 829.991557][T31650] IPVS: starting estimator thread 0... [ 829.991752][ T5000] IPVS: ip_vs_add_dest(): server weight less than zero [ 829.994040][ T5000] netlink: 8 bytes leftover after parsing attributes in process `syz.1.7780'. [ 829.998805][ T5000] mac80211_hwsim hwsim61 wlan0: entered promiscuous mode [ 830.071177][ T5003] netlink: 28 bytes leftover after parsing attributes in process `syz.0.7781'. [ 830.081107][ T5001] IPVS: using max 33 ests per chain, 79200 per kthread [ 830.162301][ T5005] netlink: 8 bytes leftover after parsing attributes in process `syz.1.7782'. [ 830.162361][ T5005] netlink: 20 bytes leftover after parsing attributes in process `syz.1.7782'. [ 830.332577][ T5011] openvswitch: netlink: IP tunnel attribute has 5413 unknown bytes. [ 830.345252][ T5011] netlink: NAT flags may be given only when NAT range (SRC or DST) is also specified. [ 830.345310][ T5011] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 830.355505][ T5011] netlink: 'syz.0.7784': attribute type 2 has an invalid length. [ 830.450465][ T5011] : entered promiscuous mode [ 830.644958][ T5019] bond5: option resend_igmp: invalid value (32767) [ 830.645008][ T5019] bond5: option resend_igmp: allowed values 0 - 255 [ 830.661463][ T5019] bond5 (unregistering): Released all slaves [ 830.787272][ C0] IPVS: sh: UDP 224.0.0.2:0 - no destination available [ 831.174432][ T5046] netlink: 'syz.3.7792': attribute type 1 has an invalid length. [ 831.266676][ T5630] Bluetooth: hci1: command 0x0406 tx timeout [ 832.192096][ T5084] nbd: illegal input index 65508 [ 832.866414][ C0] net_ratelimit: 2 callbacks suppressed [ 832.866463][ C0] IPVS: sh: UDP 224.0.0.2:0 - no destination available [ 833.268873][ T5133] ip6t_REJECT: TCP_RESET illegal for non-tcp [ 833.276226][ T5137] FAULT_INJECTION: forcing a failure. [ 833.276226][ T5137] name fail_usercopy, interval 1, probability 0, space 0, times 1 [ 833.292193][ T5137] CPU: 0 UID: 0 PID: 5137 Comm: syz.5.7814 Not tainted syzkaller #0 PREEMPT(full) [ 833.292219][ T5137] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 833.292231][ T5137] Call Trace: [ 833.292247][ T5137] [ 833.292256][ T5137] dump_stack_lvl+0xe8/0x150 [ 833.292292][ T5137] should_fail_ex+0x410/0x560 [ 833.292416][ T5137] _copy_from_user+0x2d/0xb0 [ 833.292469][ T5137] ___sys_sendmsg+0x1c6/0x360 [ 833.292493][ T5137] ? __lock_acquire+0x6df/0x2e50 [ 833.292517][ T5137] ? __pfx____sys_sendmsg+0x10/0x10 [ 833.292573][ T5137] ? __fget_files+0x2a/0x420 [ 833.292597][ T5137] ? __fget_files+0x3a2/0x420 [ 833.292631][ T5137] __x64_sys_sendmsg+0x1b1/0x290 [ 833.292655][ T5137] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 833.292696][ T5137] do_syscall_64+0x166/0x520 [ 833.292725][ T5137] ? trace_irq_disable+0x3b/0x140 [ 833.292743][ T5137] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 833.292763][ T5137] ? clear_bhb_loop+0x70/0xc0 [ 833.292787][ T5137] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 833.292807][ T5137] RIP: 0033:0x7fb985f9e159 [ 833.292825][ T5137] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 833.292843][ T5137] RSP: 002b:00007fb986de2028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 833.292864][ T5137] RAX: ffffffffffffffda RBX: 00007fb986226090 RCX: 00007fb985f9e159 [ 833.292878][ T5137] RDX: 0000000020040054 RSI: 0000200000000200 RDI: 0000000000000004 [ 833.292892][ T5137] RBP: 00007fb986de2090 R08: 0000000000000000 R09: 0000000000000000 [ 833.292904][ T5137] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 833.292915][ T5137] R13: 00007fb986226128 R14: 00007fb986226090 R15: 00007fff52886db8 [ 833.292945][ T5137] [ 833.906461][ C0] IPVS: sh: UDP 224.0.0.2:0 - no destination available [ 834.615558][ T5197] FAULT_INJECTION: forcing a failure. [ 834.615558][ T5197] name failslab, interval 1, probability 0, space 0, times 0 [ 834.615767][ T5197] CPU: 0 UID: 0 PID: 5197 Comm: syz.0.7832 Not tainted syzkaller #0 PREEMPT(full) [ 834.615789][ T5197] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 834.615800][ T5197] Call Trace: [ 834.615808][ T5197] [ 834.615817][ T5197] dump_stack_lvl+0xe8/0x150 [ 834.615848][ T5197] should_fail_ex+0x410/0x560 [ 834.615881][ T5197] ? __alloc_skb+0x1db/0x7a0 [ 834.616025][ T5197] should_failslab+0xa8/0x100 [ 834.616049][ T5197] ? __alloc_skb+0x1db/0x7a0 [ 834.616073][ T5197] kmem_cache_alloc_node_noprof+0xa1/0x610 [ 834.616100][ T5197] ? __alloc_skb+0x18d/0x7a0 [ 834.616127][ T5197] ? __alloc_skb+0x1db/0x7a0 [ 834.616160][ T5197] __alloc_skb+0x1db/0x7a0 [ 834.616192][ T5197] netlink_sendmsg+0x5d4/0xb40 [ 834.616278][ T5197] ? __pfx_netlink_sendmsg+0x10/0x10 [ 834.616307][ T5197] ? apparmor_socket_sendmsg+0x18b/0x360 [ 834.616422][ T5197] ? __pfx_netlink_sendmsg+0x10/0x10 [ 834.616444][ T5197] sock_sendmsg_nosec+0x13a/0x180 [ 834.616474][ T5197] ____sys_sendmsg+0x54e/0x850 [ 834.616500][ T5197] ? __pfx_____sys_sendmsg+0x10/0x10 [ 834.616530][ T5197] ? import_iovec+0x73/0xa0 [ 834.616562][ T5197] ___sys_sendmsg+0x2a5/0x360 [ 834.616582][ T5197] ? __lock_acquire+0x6df/0x2e50 [ 834.616606][ T5197] ? __pfx____sys_sendmsg+0x10/0x10 [ 834.616663][ T5197] ? __fget_files+0x2a/0x420 [ 834.616686][ T5197] ? __fget_files+0x3a2/0x420 [ 834.616720][ T5197] __x64_sys_sendmsg+0x1b1/0x290 [ 834.616740][ T5197] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 834.616783][ T5197] do_syscall_64+0x166/0x520 [ 834.616810][ T5197] ? trace_irq_disable+0x3b/0x140 [ 834.616827][ T5197] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 834.616847][ T5197] ? clear_bhb_loop+0x70/0xc0 [ 834.616869][ T5197] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 834.616887][ T5197] RIP: 0033:0x7f9d76f9e159 [ 834.616905][ T5197] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 834.616921][ T5197] RSP: 002b:00007f9d77e30028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 834.616942][ T5197] RAX: ffffffffffffffda RBX: 00007f9d77226090 RCX: 00007f9d76f9e159 [ 834.616955][ T5197] RDX: 0000000020040054 RSI: 0000200000000200 RDI: 0000000000000004 [ 834.616967][ T5197] RBP: 00007f9d77e30090 R08: 0000000000000000 R09: 0000000000000000 [ 834.616979][ T5197] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 834.616991][ T5197] R13: 00007f9d77226128 R14: 00007f9d77226090 R15: 00007ffe248b85a8 [ 834.617023][ T5197] [ 834.838054][ T5204] IPv6: NLM_F_REPLACE set, but no existing node found! [ 834.946413][ C0] IPVS: sh: UDP 224.0.0.2:0 - no destination available [ 835.334741][ T5220] tipc: Failed to remove unknown binding: 66,0,0/0:2943384632/2943384633 [ 835.344733][ T5212] __nla_validate_parse: 10 callbacks suppressed [ 835.344997][ T5212] netlink: 576 bytes leftover after parsing attributes in process `syz.3.7836'. [ 835.464124][ T5211] syzkaller0: entered promiscuous mode [ 835.471551][ T5211] syzkaller0: entered allmulticast mode [ 835.483360][ T5215] tipc: Started in network mode [ 835.483405][ T5215] tipc: Node identity , cluster identity 4711 [ 835.485804][ T5215] tipc: Failed to obtain node identity [ 835.485835][ T5215] tipc: Enabling of bearer rejected, failed to enable media [ 835.486264][ T5211] tipc: Started in network mode [ 835.486275][ T5211] tipc: Node identity , cluster identity 4711 [ 835.486287][ T5211] tipc: Failed to obtain node identity [ 835.486310][ T5211] tipc: Enabling of bearer rejected, failed to enable media [ 835.537114][ T5224] netlink: 'syz.0.7838': attribute type 11 has an invalid length. [ 835.537137][ T5224] netlink: 224 bytes leftover after parsing attributes in process `syz.0.7838'. [ 835.718204][ T5199] ICMPv6: RA: ndisc_router_discovery failed to add default route [ 835.718381][ T5199] ICMPv6: RA: ndisc_router_discovery failed to add default route [ 835.718555][ T5199] ICMPv6: RA: ndisc_router_discovery failed to add default route [ 835.718694][ T5199] ICMPv6: RA: ndisc_router_discovery failed to add default route [ 835.718887][ T5199] ICMPv6: RA: ndisc_router_discovery failed to add default route [ 835.719027][ T5199] ICMPv6: RA: ndisc_router_discovery failed to add default route [ 835.719166][ T5199] ICMPv6: RA: ndisc_router_discovery failed to add default route [ 836.301234][ T5251] netlink: 6040 bytes leftover after parsing attributes in process `syz.1.7844'. [ 836.301571][ T5251] netlink: 'syz.1.7844': attribute type 142 has an invalid length. [ 836.435511][ T5256] netlink: 12 bytes leftover after parsing attributes in process `syz.0.7845'. [ 836.752729][ T5271] netlink: 'syz.5.7851': attribute type 25 has an invalid length. [ 836.761690][ T5273] netlink: 'syz.1.7852': attribute type 1 has an invalid length. [ 836.792946][ T5271] netlink: 'syz.5.7851': attribute type 20 has an invalid length. [ 836.792991][ T5271] netlink: 4 bytes leftover after parsing attributes in process `syz.5.7851'. [ 836.795014][ T5271] netlink: 'syz.5.7851': attribute type 20 has an invalid length. [ 836.795031][ T5271] netlink: 4 bytes leftover after parsing attributes in process `syz.5.7851'. [ 836.848393][ T5273] 8021q: adding VLAN 0 to HW filter on device bond10 [ 836.855263][ T5273] bond9: (slave bond10): making interface the new active one [ 836.862873][ T5273] bond9: (slave bond10): Enslaving as an active interface with an up link [ 836.934466][ T5284] bond9: (slave gretap2): Enslaving as a backup interface with an up link [ 836.943774][ T5283] netlink: 8 bytes leftover after parsing attributes in process `syz.0.7850'. [ 836.944113][ T5285] netlink: 8 bytes leftover after parsing attributes in process `syz.0.7850'. [ 836.962457][ T5273] veth0_to_bridge: entered promiscuous mode [ 836.988733][ T5273] netlink: 28 bytes leftover after parsing attributes in process `syz.1.7852'. [ 836.989965][ T5273] 8021q: adding VLAN 0 to HW filter on device bond9 [ 836.997609][ T5272] veth0_to_bridge: left promiscuous mode [ 837.059313][ T5283] netlink: 'syz.0.7850': attribute type 39 has an invalid length. [ 837.313905][ T5289] netlink: 132 bytes leftover after parsing attributes in process `syz.5.7853'. [ 838.066418][ C0] net_ratelimit: 49 callbacks suppressed [ 838.066466][ C0] IPVS: sh: UDP 224.0.0.2:0 - no destination available [ 838.439759][ T5344] netlink: 'syz.3.7866': attribute type 1 has an invalid length. [ 838.521939][ T5345] bond4 (unregistering): Released all slaves [ 838.698290][ T5344] bond5: entered promiscuous mode [ 838.699691][ T5344] 8021q: adding VLAN 0 to HW filter on device bond5 [ 839.033740][ T5371] 8021q: adding VLAN 0 to HW filter on device bond4 [ 839.082379][ T5371] bond0: left allmulticast mode [ 839.082428][ T5371] bond_slave_0: left allmulticast mode [ 839.082469][ T5371] bond_slave_1: left allmulticast mode [ 839.082488][ T5371] netdevsim netdevsim0 netdevsim1: left allmulticast mode [ 839.101675][ T5371] 8021q: adding VLAN 0 to HW filter on device bond0 [ 839.107666][ C0] IPVS: sh: UDP 224.0.0.2:0 - no destination available [ 839.136025][ T5371] bond4: (slave bond0): making interface the new active one [ 839.159243][ T5371] bond4: (slave bond0): Enslaving as an active interface with an up link [ 839.170157][ T5376] netlink: 'syz.0.7872': attribute type 4 has an invalid length. [ 839.200397][ T5376] .`: renamed from bond0 (while UP) [ 839.280285][ T5386] ipt_rpfilter: only valid in 'raw' or 'mangle' table, not '' [ 839.329788][ T3333] bond4: (slave .`): link status definitely down, disabling slave [ 839.463182][ T3333] bond4: now running without any active interface! [ 839.573341][ T5388] x_tables: duplicate underflow at hook 2 [ 840.143568][ T5409] Bluetooth: hci0: Opcode 0x080f failed: -22 [ 840.151522][ C0] IPVS: sh: UDP 224.0.0.2:0 - no destination available [ 840.155350][ T5411] block nbd2: Unsupported socket: should be TCP or UNIX. [ 840.384625][ T5414] netlink: 'syz.5.7883': attribute type 1 has an invalid length. [ 840.417195][ T5420] netlink: 'syz.2.7885': attribute type 1 has an invalid length. [ 840.417233][ T5420] __nla_validate_parse: 6 callbacks suppressed [ 840.417260][ T5420] netlink: 228 bytes leftover after parsing attributes in process `syz.2.7885'. [ 840.435425][ T5414] 8021q: adding VLAN 0 to HW filter on device bond6 [ 840.618761][ T5435] netlink: 4 bytes leftover after parsing attributes in process `syz.2.7885'. [ 841.005440][ T5434] nbd2: detected capacity change from 0 to 63 [ 841.013189][ T5630] block nbd2: Receive control failed (result -104) [ 841.072329][ T5445] netlink: 28 bytes leftover after parsing attributes in process `syz.5.7890'. [ 841.076298][ T5456] netlink: 24 bytes leftover after parsing attributes in process `syz.3.7892'. [ 841.186408][ C0] IPVS: sh: UDP 224.0.0.2:0 - no destination available [ 841.294395][ T5462] netlink: 56 bytes leftover after parsing attributes in process `syz.1.7894'. [ 841.348085][ T5469] netlink: NAT flags may be given only when NAT range (SRC or DST) is also specified. [ 841.357971][ T5469] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 841.414615][ T5476] netlink: 64 bytes leftover after parsing attributes in process `syz.2.7898'. [ 841.414711][ T5476] netlink: 64 bytes leftover after parsing attributes in process `syz.2.7898'. [ 841.449971][ T5462] bond11 (unregistering): Released all slaves [ 841.471071][ T5478] netlink: 64 bytes leftover after parsing attributes in process `syz.2.7898'. [ 841.471158][ T5478] netlink: 64 bytes leftover after parsing attributes in process `syz.2.7898'. [ 842.020743][ T5497] netlink: 4 bytes leftover after parsing attributes in process `syz.5.7904'. [ 842.081558][ T5506] validate_nla: 2 callbacks suppressed [ 842.081606][ T5506] netlink: 'syz.2.7906': attribute type 39 has an invalid length. [ 842.226407][ C0] IPVS: sh: UDP 224.0.0.2:0 - no destination available [ 842.851766][ T5542] bridge0: port 3(team0) entered disabled state [ 842.877617][ T5542] team0 (unregistering): left promiscuous mode [ 842.877661][ T5542] team_slave_0: left promiscuous mode [ 842.877872][ T5542] team_slave_1: left promiscuous mode [ 842.878128][ T5542] bridge0: port 3(team0) entered disabled state [ 842.925691][ T5542] team_slave_0: left allmulticast mode [ 842.940549][ T5542] team0 (unregistering): Port device team_slave_0 removed [ 842.940964][ T5542] team_slave_1: left allmulticast mode [ 843.003160][ T5542] team0 (unregistering): Port device team_slave_1 removed [ 843.266541][ C0] IPVS: sh: UDP 224.0.0.2:0 - no destination available [ 843.392081][ T5568] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 844.055467][ T5586] bridge0: entered promiscuous mode [ 844.055514][ T5586] bridge0: entered allmulticast mode [ 844.306414][ C0] IPVS: sh: UDP 224.0.0.2:0 - no destination available [ 845.169577][ T5617] openvswitch: netlink: push_nsh: missing base or metadata attributes [ 845.285315][ T5620] netlink: NAT flags may be given only when NAT range (SRC or DST) is also specified. [ 845.285370][ T5620] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 845.346414][ C0] IPVS: sh: UDP 224.0.0.2:0 - no destination available [ 845.378567][ T5624] IPVS: Schedule: port zero only supported in persistent services, check your ipvs configuration [ 845.607073][ T5628] syzkaller1: entered promiscuous mode [ 845.607727][ T5628] syzkaller1: entered allmulticast mode [ 845.611746][ T5628] __nla_validate_parse: 36 callbacks suppressed [ 845.611764][ T5628] netlink: 36 bytes leftover after parsing attributes in process `syz.1.7935'. [ 845.635584][ T5635] netlink: 8 bytes leftover after parsing attributes in process `syz.0.7936'. [ 845.844333][ T5636] netlink: Failed to add ︹梜\ helper -22 [ 845.844415][ T5636] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 845.888961][ T5636] netlink: 4 bytes leftover after parsing attributes in process `syz.3.7937'. [ 845.901038][ T5636] netlink: 4 bytes leftover after parsing attributes in process `syz.3.7937'. [ 846.089629][ T5650] netlink: 8 bytes leftover after parsing attributes in process `syz.2.7941'. [ 846.386417][ C0] IPVS: sh: UDP 224.0.0.2:0 - no destination available [ 846.388712][ C1] IPVS: Schedule: port zero only supported in persistent services, check your ipvs configuration [ 846.618099][ T5664] syzkaller0: entered promiscuous mode [ 846.623943][ T5664] syzkaller0: entered allmulticast mode [ 847.050865][ T5687] netlink: 4 bytes leftover after parsing attributes in process `syz.3.7949'. [ 847.068969][ T5691] netlink: 'syz.0.7950': attribute type 23 has an invalid length. [ 848.466442][ C0] net_ratelimit: 3 callbacks suppressed [ 848.466514][ C0] IPVS: sh: UDP 224.0.0.2:0 - no destination available [ 849.506427][ C0] IPVS: sh: UDP 224.0.0.2:0 - no destination available [ 850.546481][ C0] IPVS: sh: UDP 224.0.0.2:0 - no destination available [ 851.042055][ T5706] netlink: 'syz.3.7954': attribute type 9 has an invalid length. [ 851.313681][ T5717] netlink: 'syz.0.7956': attribute type 8 has an invalid length. [ 851.470873][ T5723] vlan3: entered promiscuous mode [ 851.476233][ T5723] bridge0: entered promiscuous mode [ 851.488921][ T5723] vlan3: entered allmulticast mode [ 851.494230][ T5723] bridge0: entered allmulticast mode [ 851.586459][ C0] IPVS: sh: UDP 224.0.0.2:0 - no destination available [ 851.738661][ T5727] team0 (unregistering): Port device team_slave_0 removed [ 851.799426][ T5727] team0 (unregistering): Port device team_slave_1 removed [ 851.912410][ T5754] netlink: 28 bytes leftover after parsing attributes in process `syz.0.7963'. [ 852.054626][ T5761] netlink: 4 bytes leftover after parsing attributes in process `syz.1.7965'. [ 852.626408][ C0] IPVS: sh: UDP 224.0.0.2:0 - no destination available [ 852.713687][ T5783] netlink: 10 bytes leftover after parsing attributes in process `syz.2.7971'. [ 852.833053][ T5785] netlink: 104 bytes leftover after parsing attributes in process `syz.3.7972'. [ 853.040835][ T5794] ip_tables: iptables: counters copy to user failed while replacing table [ 853.109553][ T5800] netlink: 60 bytes leftover after parsing attributes in process `syz.2.7976'. [ 853.176108][ T5800] netlink: 8 bytes leftover after parsing attributes in process `syz.2.7976'. [ 853.212342][ T5813] netlink: 'syz.5.7978': attribute type 15 has an invalid length. [ 853.228504][ T5813] netlink: 24 bytes leftover after parsing attributes in process `syz.5.7978'. [ 853.483993][ T5820] netlink: 3080 bytes leftover after parsing attributes in process `syz.1.7982'. [ 853.495312][ T5820] netlink: 199828 bytes leftover after parsing attributes in process `syz.1.7982'. [ 853.666595][ C0] IPVS: sh: UDP 224.0.0.2:0 - no destination available [ 853.734113][ T5832] netlink: 76 bytes leftover after parsing attributes in process `syz.2.7981'. [ 854.661261][ T5874] netlink: 'syz.0.7996': attribute type 21 has an invalid length. [ 854.699386][ T5865] SET target dimension over the limit! [ 854.706409][ C0] IPVS: sh: UDP 224.0.0.2:0 - no destination available [ 855.705980][ T5920] tipc: Enabling of bearer rejected, failed to enable media [ 855.746508][ C0] IPVS: sh: UDP 224.0.0.2:0 - no destination available [ 856.516447][T31650] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 856.516546][T31650] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 856.516593][T31650] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 856.516628][T31650] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 856.588611][ T5942] netlink: 'syz.2.8013': attribute type 4 has an invalid length. [ 856.706352][ T5928] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 856.786497][ C0] IPVS: sh: UDP 224.0.0.2:0 - no destination available [ 857.019353][ T5957] bond0: option ad_user_port_key: mode dependency failed, not supported in mode balance-rr(0) [ 857.038133][ T5957] bond0: option ad_user_port_key: mode dependency failed, not supported in mode balance-rr(0) [ 857.658152][ T5994] __nla_validate_parse: 7 callbacks suppressed [ 857.673121][ T5994] netlink: 8 bytes leftover after parsing attributes in process `syz.1.8027'. [ 857.810185][ T5994] 8021q: adding VLAN 0 to HW filter on device bond12 [ 857.826464][ C0] IPVS: sh: UDP 224.0.0.2:0 - no destination available [ 857.982339][ T6010] netlink: 'syz.3.8032': attribute type 9 has an invalid length. [ 858.197622][ T6015] netlink: 12 bytes leftover after parsing attributes in process `syz.1.8033'. [ 858.261554][ T6020] netlink: 8 bytes leftover after parsing attributes in process `syz.0.8035'. [ 858.261624][ T6020] netlink: 4 bytes leftover after parsing attributes in process `syz.0.8035'. [ 858.261665][ T6020] netlink: 'syz.0.8035': attribute type 15 has an invalid length. [ 858.355768][ T6028] netlink: 92 bytes leftover after parsing attributes in process `syz.1.8033'. [ 858.366620][T31672] netdevsim netdevsim0 netdevsim3: set [0, 1] type 1 family 0 port 256 - 0 [ 858.366667][T31672] netdevsim netdevsim0 netdevsim2: set [0, 1] type 1 family 0 port 256 - 0 [ 858.366703][T31672] netdevsim netdevsim0 netdevsim1: set [0, 1] type 1 family 0 port 256 - 0 [ 858.366736][T31672] netdevsim netdevsim0 netdevsim0: set [0, 1] type 1 family 0 port 256 - 0 [ 858.501724][ T6029] netlink: 92 bytes leftover after parsing attributes in process `syz.1.8033'. [ 858.795378][ T6042] IPVS: Schedule: port zero only supported in persistent services, check your ipvs configuration [ 858.866500][ C0] IPVS: sh: UDP 224.0.0.2:0 - no destination available [ 858.988029][ T6049] netlink: 'syz.3.8042': attribute type 21 has an invalid length. [ 859.907405][ C0] IPVS: sh: UDP 224.0.0.2:0 - no destination available [ 860.201760][ T6090] netlink: 'syz.0.8057': attribute type 21 has an invalid length. [ 860.223773][ T6090] netlink: 156 bytes leftover after parsing attributes in process `syz.0.8057'. [ 860.662853][ T6106] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 860.800505][ T6109] netlink: 8 bytes leftover after parsing attributes in process `syz.2.8064'. [ 860.942771][ T6118] bond13: entered promiscuous mode [ 860.946441][ C0] IPVS: sh: UDP 224.0.0.2:0 - no destination available [ 860.956386][ T6118] bond13: entered allmulticast mode [ 861.330399][ T6138] netlink: 12 bytes leftover after parsing attributes in process `syz.1.8075'. [ 861.444720][ T5630] Bluetooth: hci1: link tx timeout [ 861.444752][ T5630] Bluetooth: hci1: killing stalled connection 10:aa:aa:aa:aa:aa [ 861.487418][ T6146] netlink: 'syz.2.8076': attribute type 16 has an invalid length. [ 861.487603][ T6146] netlink: 'syz.2.8076': attribute type 3 has an invalid length. [ 861.487618][ T6146] netlink: 132 bytes leftover after parsing attributes in process `syz.2.8076'. [ 861.617117][ T6147] ip_tables: iptables: counters copy to user failed while replacing table [ 861.812297][ T6146] bond5: option arp_validate: mode dependency failed, not supported in mode balance-tlb(5) [ 861.827454][ T6146] bond5 (unregistering): Released all slaves [ 861.865488][ T6148] syzkaller1: entered promiscuous mode [ 861.871183][ T6148] syzkaller1: entered allmulticast mode [ 861.986397][ C0] IPVS: sh: UDP 224.0.0.2:0 - no destination available [ 862.675419][ T6170] __nla_validate_parse: 8 callbacks suppressed [ 862.684802][ T6170] netlink: 4 bytes leftover after parsing attributes in process `syz.1.8083'. [ 862.817159][ T6170] netlink: 4 bytes leftover after parsing attributes in process `syz.1.8083'. [ 862.886052][ T6204] netlink: 4 bytes leftover after parsing attributes in process `syz.0.8091'. [ 863.026440][ C0] IPVS: sh: UDP 224.0.0.2:0 - no destination available [ 863.167127][ T6213] syzkaller0: entered promiscuous mode [ 863.172809][ T6213] syzkaller0: entered allmulticast mode [ 863.181384][ T6213] netlink: 32 bytes leftover after parsing attributes in process `syz.2.8096'. [ 863.241710][ T6216] netlink: 576 bytes leftover after parsing attributes in process `syz.3.8094'. [ 863.253575][ T6218] netlink: 576 bytes leftover after parsing attributes in process `syz.3.8094'. [ 863.506425][T30060] Bluetooth: hci1: command 0x0406 tx timeout [ 863.541554][ T5630] [ 863.543924][ T5630] ====================================================== [ 863.550945][ T5630] WARNING: possible circular locking dependency detected [ 863.557981][ T5630] syzkaller #0 Not tainted [ 863.562404][ T5630] ------------------------------------------------------ [ 863.569424][ T5630] kworker/u9:4/5630 is trying to acquire lock: [ 863.575577][ T5630] ffffffff8ee8f980 (fs_reclaim){+.+.}-{0:0}, at: __kmalloc_noprof+0xbc/0x720 [ 863.584401][ T5630] [ 863.584401][ T5630] but task is already holding lock: [ 863.591770][ T5630] ffffffff8f8120c0 (dpm_list_mtx){+.+.}-{4:4}, at: device_move+0x3c/0x720 [ 863.600439][ T5630] [ 863.600439][ T5630] which lock already depends on the new lock. [ 863.600439][ T5630] [ 863.610851][ T5630] [ 863.610851][ T5630] the existing dependency chain (in reverse order) is: [ 863.619880][ T5630] [ 863.619880][ T5630] -> #8 (dpm_list_mtx){+.+.}-{4:4}: [ 863.627279][ T5630] __mutex_lock+0x19d/0x1550 [ 863.632513][ T5630] device_pm_add+0x7d/0x350 [ 863.637589][ T5630] device_add+0x4eb/0xb80 [ 863.642476][ T5630] device_create+0x269/0x300 [ 863.647592][ T5630] msr_device_create+0x33/0x50 [ 863.652901][ T5630] cpuhp_invoke_callback+0x434/0x810 [ 863.658728][ T5630] cpuhp_thread_fun+0x362/0x780 [ 863.664112][ T5630] smpboot_thread_fn+0x565/0xa70 [ 863.669575][ T5630] kthread+0x38b/0x480 [ 863.674165][ T5630] ret_from_fork+0x514/0xb70 [ 863.679318][ T5630] ret_from_fork_asm+0x1a/0x30 [ 863.684614][ T5630] [ 863.684614][ T5630] -> #7 (cpuhp_state-up){+.+.}-{0:0}: [ 863.692172][ T5630] cpuhp_thread_fun+0x127/0x780 [ 863.697554][ T5630] smpboot_thread_fn+0x565/0xa70 [ 863.703025][ T5630] kthread+0x38b/0x480 [ 863.707611][ T5630] ret_from_fork+0x514/0xb70 [ 863.712722][ T5630] ret_from_fork_asm+0x1a/0x30 [ 863.718019][ T5630] [ 863.718019][ T5630] -> #6 (cpu_hotplug_lock){++++}-{0:0}: [ 863.725754][ T5630] cpus_read_lock+0x42/0x160 [ 863.730871][ T5630] static_key_slow_inc+0x12/0x30 [ 863.736365][ T5630] nbd_genl_reconnect_sock_cb+0x69a/0xbb0 [ 863.742684][ T5630] nbd_genl_foreach_sock+0x265/0x450 [ 863.748551][ T5630] nbd_genl_reconfigure+0xbbb/0x1040 [ 863.754372][ T5630] genl_family_rcv_msg_doit+0x233/0x340 [ 863.760452][ T5630] genl_rcv_msg+0x614/0x7a0 [ 863.765487][ T5630] netlink_rcv_skb+0x226/0x4a0 [ 863.770783][ T5630] genl_rcv+0x28/0x40 [ 863.775301][ T5630] netlink_unicast+0x7bd/0x940 [ 863.780589][ T5630] netlink_sendmsg+0x813/0xb40 [ 863.785876][ T5630] sock_sendmsg_nosec+0x13a/0x180 [ 863.791425][ T5630] ____sys_sendmsg+0x54e/0x850 [ 863.796708][ T5630] ___sys_sendmsg+0x2a5/0x360 [ 863.801906][ T5630] __x64_sys_sendmsg+0x1b1/0x290 [ 863.807362][ T5630] do_syscall_64+0x166/0x520 [ 863.812478][ T5630] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 863.818891][ T5630] [ 863.818891][ T5630] -> #5 (&nsock->tx_lock){+.+.}-{4:4}: [ 863.826542][ T5630] __mutex_lock+0x19d/0x1550 [ 863.831670][ T5630] nbd_queue_rq+0x373/0xff0 [ 863.836706][ T5630] blk_mq_dispatch_rq_list+0x499/0x1990 [ 863.842907][ T5630] __blk_mq_sched_dispatch_requests+0xd36/0x1580 [ 863.849790][ T5630] blk_mq_sched_dispatch_requests+0xd7/0x190 [ 863.856290][ T5630] blk_mq_run_work_fn+0x16c/0x300 [ 863.861835][ T5630] process_scheduled_works+0xc3d/0x1630 [ 863.867915][ T5630] worker_thread+0xa47/0xfb0 [ 863.873034][ T5630] kthread+0x38b/0x480 [ 863.877621][ T5630] ret_from_fork+0x514/0xb70 [ 863.882730][ T5630] ret_from_fork_asm+0x1a/0x30 [ 863.888020][ T5630] [ 863.888020][ T5630] -> #4 (&cmd->lock){+.+.}-{4:4}: [ 863.895236][ T5630] __mutex_lock+0x19d/0x1550 [ 863.897301][ T6217] bond0: Unable to set up delay as MII monitoring is disabled [ 863.907797][ T5630] nbd_queue_rq+0xc1/0xff0 [ 863.912749][ T5630] blk_mq_dispatch_rq_list+0x499/0x1990 [ 863.918822][ T5630] __blk_mq_sched_dispatch_requests+0xd36/0x1580 [ 863.925669][ T5630] blk_mq_sched_dispatch_requests+0xd7/0x190 [ 863.932168][ T5630] blk_mq_run_work_fn+0x16c/0x300 [ 863.937717][ T5630] process_scheduled_works+0xc3d/0x1630 [ 863.943790][ T5630] worker_thread+0xa47/0xfb0 [ 863.948901][ T5630] kthread+0x38b/0x480 [ 863.953487][ T5630] ret_from_fork+0x514/0xb70 [ 863.958594][ T5630] ret_from_fork_asm+0x1a/0x30 [ 863.963887][ T5630] [ 863.963887][ T5630] -> #3 (set->srcu){.+.+}-{0:0}: [ 863.971010][ T5630] __synchronize_srcu+0xc9/0x2f0 [ 863.976473][ T5630] elevator_switch+0x1e8/0x7b0 [ 863.981878][ T5630] elevator_change+0x2fa/0x480 [ 863.987170][ T5630] elevator_set_default+0x375/0x440 [ 863.992898][ T5630] blk_register_queue+0x3f3/0x4e0 [ 863.998503][ T5630] __add_disk+0x6cb/0xe30 [ 864.003352][ T5630] add_disk_fwnode+0x100/0x3a0 [ 864.008637][ T5630] nbd_dev_add+0x733/0xb60 [ 864.013576][ T5630] nbd_init+0x168/0x1f0 [ 864.018314][ T5630] do_one_initcall+0x250/0x870 [ 864.023615][ T5630] do_initcall_level+0x10a/0x1a0 [ 864.029090][ T5630] do_initcalls+0x59/0xa0 [ 864.033938][ T5630] kernel_init_freeable+0x29d/0x3e0 [ 864.039661][ T5630] kernel_init+0x22/0x1d0 [ 864.044517][ T5630] ret_from_fork+0x514/0xb70 [ 864.049623][ T5630] ret_from_fork_asm+0x1a/0x30 [ 864.054913][ T5630] [ 864.054913][ T5630] -> #2 (&q->elevator_lock){+.+.}-{4:4}: [ 864.062740][ T5630] __mutex_lock+0x19d/0x1550 [ 864.066394][ C0] IPVS: sh: UDP 224.0.0.2:0 - no destination available [ 864.074689][ T5630] elevator_change+0x1af/0x480 [ 864.079991][ T5630] elevator_set_none+0xb5/0x140 [ 864.085375][ T5630] blk_mq_update_nr_hw_queues+0x5ef/0x19f0 [ 864.091704][ T5630] nbd_start_device+0x189/0xb30 [ 864.097085][ T5630] nbd_genl_connect+0x167d/0x1cd0 [ 864.102632][ T5630] genl_family_rcv_msg_doit+0x233/0x340 [ 864.108706][ T5630] genl_rcv_msg+0x614/0x7a0 [ 864.113738][ T5630] netlink_rcv_skb+0x226/0x4a0 [ 864.119025][ T5630] genl_rcv+0x28/0x40 [ 864.123532][ T5630] netlink_unicast+0x7bd/0x940 [ 864.128815][ T5630] netlink_sendmsg+0x813/0xb40 [ 864.134105][ T5630] sock_sendmsg_nosec+0x13a/0x180 [ 864.139653][ T5630] ____sys_sendmsg+0x54e/0x850 [ 864.144938][ T5630] ___sys_sendmsg+0x2a5/0x360 [ 864.150139][ T5630] __x64_sys_sendmsg+0x1b1/0x290 [ 864.155600][ T5630] do_syscall_64+0x166/0x520 [ 864.160728][ T5630] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 864.167147][ T5630] [ 864.167147][ T5630] -> #1 (&q->q_usage_counter(io)#51){++++}-{0:0}: [ 864.175758][ T5630] blk_alloc_queue+0x544/0x690 [ 864.181052][ T5630] __blk_mq_alloc_disk+0x194/0x390 [ 864.186693][ T5630] nbd_dev_add+0x494/0xb60 [ 864.191637][ T5630] nbd_init+0x168/0x1f0 [ 864.196314][ T5630] do_one_initcall+0x250/0x870 [ 864.201619][ T5630] do_initcall_level+0x10a/0x1a0 [ 864.207073][ T5630] do_initcalls+0x59/0xa0 [ 864.211931][ T5630] kernel_init_freeable+0x29d/0x3e0 [ 864.217660][ T5630] kernel_init+0x22/0x1d0 [ 864.222513][ T5630] ret_from_fork+0x514/0xb70 [ 864.227623][ T5630] ret_from_fork_asm+0x1a/0x30 [ 864.232923][ T5630] [ 864.232923][ T5630] -> #0 (fs_reclaim){+.+.}-{0:0}: [ 864.240143][ T5630] __lock_acquire+0x15ff/0x2e50 [ 864.245525][ T5630] lock_acquire+0x115/0x350 [ 864.250555][ T5630] fs_reclaim_acquire+0x71/0x100 [ 864.256025][ T5630] __kmalloc_noprof+0xbc/0x720 [ 864.261319][ T5630] kobject_get_path+0xc5/0x2f0 [ 864.266699][ T5630] kobject_move+0x2fa/0x720 [ 864.271729][ T5630] device_move+0xe0/0x720 [ 864.276580][ T5630] hci_conn_del_sysfs+0xb8/0x1a0 [ 864.282132][ T5630] hci_conn_del+0xc3d/0x1200 [ 864.287298][ T5630] hci_abort_conn_sync+0xdd0/0x1190 [ 864.293090][ T5630] hci_cmd_sync_work+0x20b/0x3f0 [ 864.298607][ T5630] process_scheduled_works+0xc3d/0x1630 [ 864.304683][ T5630] worker_thread+0xa47/0xfb0 [ 864.309803][ T5630] kthread+0x38b/0x480 [ 864.314399][ T5630] ret_from_fork+0x514/0xb70 [ 864.319514][ T5630] ret_from_fork_asm+0x1a/0x30 [ 864.324813][ T5630] [ 864.324813][ T5630] other info that might help us debug this: [ 864.324813][ T5630] [ 864.335040][ T5630] Chain exists of: [ 864.335040][ T5630] fs_reclaim --> cpuhp_state-up --> dpm_list_mtx [ 864.335040][ T5630] [ 864.347306][ T5630] Possible unsafe locking scenario: [ 864.347306][ T5630] [ 864.354756][ T5630] CPU0 CPU1 [ 864.360120][ T5630] ---- ---- [ 864.365471][ T5630] lock(dpm_list_mtx); [ 864.369629][ T5630] lock(cpuhp_state-up); [ 864.376480][ T5630] lock(dpm_list_mtx); [ 864.383149][ T5630] lock(fs_reclaim); [ 864.387123][ T5630] [ 864.387123][ T5630] *** DEADLOCK *** [ 864.387123][ T5630] [ 864.395259][ T5630] locks held by kworker/u9:4/5630: 5, last CPU#1: [ 864.401662][ T5630] #0: ffff888035bb4940 ((wq_completion)hci1){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 [ 864.412471][ T5630] #1: ffffc900040d7c40 ((work_completion)(&hdev->cmd_sync_work)){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 [ 864.425017][ T5630] #2: ffff888077e9cea0 (&hdev->req_lock){+.+.}-{4:4}, at: hci_cmd_sync_work+0x1cb/0x3f0 [ 864.434874][ T5630] #3: ffff888077e9c0b8 (&hdev->lock){+.+.}-{4:4}, at: hci_abort_conn_sync+0xa6f/0x1190 [ 864.444638][ T5630] #4: ffffffff8f8120c0 (dpm_list_mtx){+.+.}-{4:4}, at: device_move+0x3c/0x720 [ 864.453595][ T5630] [ 864.453595][ T5630] stack backtrace: [ 864.459477][ T5630] CPU: 1 UID: 0 PID: 5630 Comm: kworker/u9:4 Not tainted syzkaller #0 PREEMPT(full) [ 864.468923][ T5630] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 864.478987][ T5630] Workqueue: hci1 hci_cmd_sync_work [ 864.484203][ T5630] Call Trace: [ 864.487478][ T5630] [ 864.490408][ T5630] dump_stack_lvl+0xe8/0x150 [ 864.495001][ T5630] print_circular_bug+0x2e2/0x300 [ 864.500038][ T5630] check_noncircular+0x12f/0x150 [ 864.504983][ T5630] __lock_acquire+0x15ff/0x2e50 [ 864.509836][ T5630] ? __bfs+0x153/0x290 [ 864.513914][ T5630] ? __pfx_hlock_conflict+0x10/0x10 [ 864.519127][ T5630] lock_acquire+0x115/0x350 [ 864.523638][ T5630] ? __kmalloc_noprof+0xbc/0x720 [ 864.528592][ T5630] ? __lock_acquire+0x14b9/0x2e50 [ 864.533616][ T5630] ? kobject_get_path+0xc5/0x2f0 [ 864.538561][ T5630] fs_reclaim_acquire+0x71/0x100 [ 864.543509][ T5630] ? __kmalloc_noprof+0xbc/0x720 [ 864.548453][ T5630] __kmalloc_noprof+0xbc/0x720 [ 864.553225][ T5630] ? get_device_parent+0x20d/0x3a0 [ 864.558343][ T5630] ? kobject_get_path+0xc5/0x2f0 [ 864.563281][ T5630] ? kobject_get_path+0xc5/0x2f0 [ 864.568221][ T5630] kobject_get_path+0xc5/0x2f0 [ 864.572983][ T5630] kobject_move+0x2fa/0x720 [ 864.577493][ T5630] ? __pfx_kobject_move+0x10/0x10 [ 864.582518][ T5630] ? do_raw_spin_unlock+0xf5/0x200 [ 864.587628][ T5630] ? get_device_parent+0x366/0x3a0 [ 864.592749][ T5630] device_move+0xe0/0x720 [ 864.597080][ T5630] hci_conn_del_sysfs+0xb8/0x1a0 [ 864.602014][ T5630] hci_conn_del+0xc3d/0x1200 [ 864.606606][ T5630] ? hci_abort_conn_sync+0xa7b/0x1190 [ 864.611986][ T5630] hci_abort_conn_sync+0xdd0/0x1190 [ 864.617196][ T5630] ? __pfx_hci_abort_conn_sync+0x10/0x10 [ 864.622840][ T5630] ? abort_conn_sync+0x26/0x210 [ 864.627691][ T5630] ? abort_conn_sync+0x26/0x210 [ 864.632550][ T5630] ? abort_conn_sync+0x19c/0x210 [ 864.637496][ T5630] ? __pfx_abort_conn_sync+0x10/0x10 [ 864.642791][ T5630] hci_cmd_sync_work+0x20b/0x3f0 [ 864.647739][ T5630] ? process_scheduled_works+0x97a/0x1630 [ 864.653461][ T5630] process_scheduled_works+0xc3d/0x1630 [ 864.659020][ T5630] ? __pfx_process_scheduled_works+0x10/0x10 [ 864.665010][ T5630] ? assign_work+0x3cf/0x5d0 [ 864.669596][ T5630] worker_thread+0xa47/0xfb0 [ 864.674199][ T5630] kthread+0x38b/0x480 [ 864.678260][ T5630] ? __pfx_worker_thread+0x10/0x10 [ 864.683383][ T5630] ? __pfx_kthread+0x10/0x10 [ 864.687972][ T5630] ret_from_fork+0x514/0xb70 [ 864.692563][ T5630] ? __pfx_ret_from_fork+0x10/0x10 [ 864.697672][ T5630] ? __switch_to+0xc89/0x1420 [ 864.702362][ T5630] ? __pfx_kthread+0x10/0x10 [ 864.706952][ T5630] ret_from_fork_asm+0x1a/0x30 [ 864.711719][ T5630] [ 864.732005][ T6217] bond0 (unregistering): Released all slaves [ 865.106395][ C0] IPVS: sh: UDP 224.0.0.2:0 - no destination available [ 866.146388][ C0] IPVS: sh: UDP 224.0.0.2:0 - no destination available [ 867.186375][ C0] IPVS: sh: UDP 224.0.0.2:0 - no destination available [ 868.226409][ C0] IPVS: sh: UDP 224.0.0.2:0 - no destination available [ 869.266385][ C0] IPVS: sh: UDP 224.0.0.2:0 - no destination available [ 870.306375][ C0] IPVS: sh: UDP 224.0.0.2:0 - no destination available [ 871.346379][ C0] IPVS: sh: UDP 224.0.0.2:0 - no destination available [ 871.427196][ T2542] block nbd2: Possible stuck request ffff888068b65080: control (read@0,1024B). Runtime 30 seconds [ 871.427248][ T2542] block nbd2: Possible stuck request ffff888068b65240: control (read@1024,1024B). Runtime 30 seconds [ 871.427283][ T2542] block nbd2: Possible stuck request ffff888068b65400: control (read@2048,1024B). Runtime 30 seconds [ 871.427309][ T2542] block nbd2: Possible stuck request ffff888068b655c0: control (read@3072,1024B). Runtime 30 seconds [ 872.386372][ C0] IPVS: sh: UDP 224.0.0.2:0 - no destination available [ 873.426372][ C0] IPVS: sh: UDP 224.0.0.2:0 - no destination available