last executing test programs: 3.505071699s ago: executing program 1 (id=3826): bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000600)={0x15, 0x3, &(0x7f0000000000)=ANY=[@ANYBLOB="7daa00000000000071101b000000000095"], &(0x7f0000000480)='syzkaller\x00'}, 0x90) r0 = socket(0x400000000010, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000100)={'wg2\x00', 0x0}) r2 = socket(0x2b, 0x1, 0x1) getsockopt$inet_pktinfo(r2, 0x0, 0x8, &(0x7f0000000340)={0x0, @multicast2, @loopback}, &(0x7f00000003c0)=0x3) sendmsg$nl_route_sched(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000000c0)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0xfffffffd, {0x0, 0x0, 0x0, r1, {0x0, 0xf}, {0xffff, 0xffff}, {0xfff3, 0x9}}, [@qdisc_kind_options=@q_multiq={{0xb}, {0x8}}]}, 0x38}}, 0x4c840) sendmsg$nl_route_sched(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000180)=@newtfilter={0x4c, 0x2c, 0xf3f, 0x30bd28, 0x25dfdbfd, {0x0, 0x0, 0x0, r1, {0x5, 0xfff1}, {0x0, 0xfff3}, {0x9, 0xf}}, [@filter_kind_options=@f_flower={{0xb}, {0x1c, 0x2, [@TCA_FLOWER_KEY_ETH_TYPE={0x6, 0x8, 0x86dd}, @TCA_FLOWER_KEY_IP_TTL={0x5, 0x4b, 0x4}, @TCA_FLOWER_KEY_IP_TOS={0x5, 0x49, 0x3}]}}]}, 0x4c}, 0x1, 0x0, 0x0, 0x20041891}, 0x24000010) sendmsg$MPTCP_PM_CMD_DEL_ADDR(r0, &(0x7f0000001d00)={&(0x7f0000000380)={0x10, 0x0, 0x0, 0x4}, 0xc, &(0x7f00000005c0)={&(0x7f0000000540)={0x4c, 0x0, 0x300, 0x70bd25, 0x25dfdbfe, {}, [@MPTCP_PM_ATTR_SUBFLOWS={0x8}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x5}, @MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x8}, @MPTCP_PM_ATTR_ADDR={0x14, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_IF_IDX={0x8}, @MPTCP_PM_ADDR_ATTR_ID={0x5, 0x2, 0x5}]}, @MPTCP_PM_ATTR_ADDR_REMOTE={0xc, 0x6, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_IF_IDX={0x8}]}]}, 0x4c}}, 0x84000) r3 = accept$unix(0xffffffffffffffff, &(0x7f0000000040)=@abs, &(0x7f00000000c0)=0x6e) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000001900), &(0x7f0000001940)=0xc) ioctl$EXT4_IOC_GET_ES_CACHE(r3, 0xc020662a, &(0x7f0000001b80)={0x3de0000000000000, 0x4, 0x4, 0x3, 0x6, 0x0, [{0x9, 0x5, 0x2, '\x00', 0x4}, {0xb, 0x9649, 0x0, '\x00', 0x1000}, {0x7, 0x8, 0x4, '\x00', 0x800}, {0x7, 0x400, 0x40000000000000, '\x00', 0x400}, {0x7, 0x80000000, 0xd2, '\x00', 0x802}, {0x7, 0x8, 0xfffffffffffffe01}]}) getsockopt$inet6_IPV6_IPSEC_POLICY(r0, 0x29, 0x22, &(0x7f00000006c0)={{{@in=@empty, @in=@loopback}}, {{@in6=@mcast2}, 0x0, @in6=@initdev}}, &(0x7f00000004c0)=0xfd35) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) r5 = syz_init_net_socket$nfc_llcp(0x27, 0x3, 0x1) r6 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r7 = bpf$ITER_CREATE(0xb, &(0x7f0000000440), 0x0) close(r7) bpf$BPF_LINK_CREATE(0x1c, &(0x7f0000000840)={r7, r7, 0x1f, 0x0, @val=@netkit={@void, @value=r7}}, 0x1c) bpf$ITER_CREATE(0x21, &(0x7f0000000880)={r7}, 0x8) r8 = syz_genetlink_get_family_id$netlbl_unlabel(&(0x7f0000000000), r6) sendmsg$NLBL_UNLABEL_C_STATICADDDEF(r6, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000007c0)={0x44, r8, 0x1, 0x70bd2b, 0x0, {}, [@NLBL_UNLABEL_A_IPV4ADDR={0x8, 0x4, @loopback}, @NLBL_UNLABEL_A_SECCTX={0x43, 0x7, 'system_u:object_r:usb_device_t:s0\x00'}, @NLBL_UNLABEL_A_IPV4MASK={0x8, 0x5, @multicast2}]}, 0x44}}, 0x0) syz_genetlink_get_family_id$netlbl_unlabel(&(0x7f0000000140), 0xffffffffffffffff) sendmsg$NLBL_UNLABEL_C_STATICLISTDEF(r6, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000000500)={&(0x7f0000000600)={0x14, r8, 0x301}, 0x14}}, 0x0) getsockopt$inet_sctp_SCTP_MAX_BURST(r0, 0x84, 0x14, &(0x7f0000000240)=@assoc_value, &(0x7f00000002c0)=0x8) sendmsg$NLBL_UNLABEL_C_STATICADDDEF(r6, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000300)={0x34, r8, 0x1, 0x0, 0x0, {}, [@NLBL_UNLABEL_A_IPV4ADDR={0x8, 0x4, @loopback}, @NLBL_UNLABEL_A_SECCTX={0xf, 0x7, 'unconfined\x00'}, @NLBL_UNLABEL_A_IPV4MASK={0x8, 0x5, @multicast2}]}, 0x34}}, 0x0) pwrite64(r7, &(0x7f00000008c0)="b362050fe47a3d383cc494cb953e181d0c9c87357e90cbc89e52aa0954e3720d7d3ce14cde714d2c11922ac944b61eb3fd01f6eb1f40001d351a60fa2d729da4cc8540ca40d1f85b352757de110968400d4496424b42db9f5abde101b4a0ad6c8daffabc9d2949f127993f8eda0f6d6e15c137d2274f563a68e66169f27bba8df4a8e02ac068fb5b28416f247ebd91c7ebbc01ac62cbde123146ff8171e6ee3279d787fd21822da1b14a79f5d1246848d5626f117da152657080b74c6cef89e0df41de215f26cc18d2870a4e8a6bbd37bc90d5a1ce589004ccd15d18d79b3f91ecca904ba32118cde5b821ed", 0xec, 0xffffffffffff55d9) bind$nfc_llcp(r5, &(0x7f0000001040)={0x27, 0x0, 0xffffffffffffffff, 0x2, 0x2, 0x0, "d32984bd1ca44c066af5160e961701a0cf660000f2170e65e3f503a7e422000000000000000000001200000000001900", 0x3c}, 0x60) r9 = syz_init_net_socket$nfc_llcp(0x27, 0x3, 0x1) bind$nfc_llcp(r9, &(0x7f00000000c0)={0x27, 0x0, 0x1, 0x4, 0x0, 0xff, "bac5115c7dad488702b535116fad55baf63cdd52fc30106310abb622a1c3c01c13c04df6b906288e64e96754059e65c39c5759b069d6e6d9589e5f2348878c", 0x24}, 0x60) getsockopt$sock_cred(r4, 0x1, 0x11, &(0x7f0000001340), &(0x7f0000001380)=0xc) 2.977316733s ago: executing program 4 (id=3828): socket$nl_xfrm(0x10, 0x3, 0x6) (async) close(0xffffffffffffffff) (async) socket$inet_udp(0x2, 0x2, 0x0) shutdown(0xffffffffffffffff, 0x0) (async) recvmmsg(0xffffffffffffffff, &(0x7f0000000100), 0x400023c, 0x300, 0x0) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x1, 0x110, 0xffffffffffffffff, 0xa13a7000) (async) read(0xffffffffffffffff, &(0x7f0000000140)=""/31, 0x1f) (async) r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000000)={'ipvlan0\x00', 0x0}) sendmsg$nl_route_sched(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000000c0)=@delqdisc={0x24, 0x26, 0x1f, 0x60bd2d, 0x25dfdbfd, {0x0, 0x0, 0x0, r1, {}, {0xffff, 0xffff}, {0xf, 0xa}}}, 0x24}, 0x1, 0x0, 0x0, 0x4081}, 0x2400c800) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000480)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f00000002c0)=@ipv6_newrule={0x2c, 0x20, 0x2d2c6d60ea1da725, 0x70bd29, 0x25dfdbfd, {0xa, 0x0, 0x0, 0xcd, 0xff, 0x0, 0x0, 0x1, 0x12}, [@FIB_RULE_POLICY=@FRA_PRIORITY={0x8}, @FIB_RULE_POLICY=@FRA_SUPPRESS_IFGROUP={0x8, 0xd, 0x6}]}, 0x2c}}, 0x0) 2.8416366s ago: executing program 1 (id=3829): socket$inet6(0xa, 0x80001, 0x0) (async) r0 = socket$inet6(0xa, 0x80001, 0x0) setsockopt$inet6_MCAST_JOIN_GROUP(r0, 0x29, 0x2a, &(0x7f0000000180)={0x100000001, {{0xa, 0x0, 0x0, @mcast1}}}, 0x88) setsockopt$inet6_MCAST_JOIN_GROUP(r0, 0x29, 0x2a, &(0x7f0000000240)={0x1, {{0xa, 0x4e1f, 0x3ff, @mcast2, 0x6}}}, 0x88) (async) setsockopt$inet6_MCAST_JOIN_GROUP(r0, 0x29, 0x2a, &(0x7f0000000240)={0x1, {{0xa, 0x4e1f, 0x3ff, @mcast2, 0x6}}}, 0x88) setsockopt$inet6_MCAST_MSFILTER(r0, 0x29, 0x30, &(0x7f0000000300)={0x1, {{0xa, 0x4e20, 0x0, @mcast1}}, 0x1, 0x1, [{{0xa, 0x4e22, 0x9, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01', 0x3}}]}, 0x110) openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x58102, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) (async) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) sendto$inet6(r1, 0x0, 0x0, 0xc01, &(0x7f0000000040)={0xa, 0x3, 0xffff6dc8, @local, 0x8}, 0x1c) setsockopt$sock_int(r1, 0x1, 0x14, &(0x7f00000000c0), 0x50) socket$inet_sctp(0x2, 0x1, 0x84) (async) r2 = socket$inet_sctp(0x2, 0x1, 0x84) getsockopt$inet_sctp_SCTP_MAX_BURST(r2, 0x84, 0xd, &(0x7f0000000000)=@assoc_value, &(0x7f0000000100)=0x8) (async) getsockopt$inet_sctp_SCTP_MAX_BURST(r2, 0x84, 0xd, &(0x7f0000000000)=@assoc_value={0x0}, &(0x7f0000000100)=0x8) r4 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000440)='blkio.bfq.dequeue\x00', 0x0, 0x0) sendmsg$IPCTNL_MSG_CT_DELETE(r4, &(0x7f0000000540)={&(0x7f0000000480)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f0000000500)={&(0x7f00000004c0)={0x18, 0x2, 0x1, 0x101, 0x0, 0x0, {0x3, 0x0, 0x6}, [@CTA_TUPLE_REPLY={0x4}]}, 0x18}, 0x1, 0x0, 0x0, 0x20000010}, 0x40) r5 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0x275a, 0x0) r6 = accept$inet6_tcp(r4, &(0x7f0000000580)={0xa, 0x0, 0x0, @mcast2}, &(0x7f00000005c0)=0x1c) ioctl$FS_IOC_FSSETXATTR(r6, 0x401c5820, &(0x7f0000000600)={0x1, 0x101, 0x3ff, 0x5, 0xfffffff9}) write$tun(r5, &(0x7f0000000140)=ANY=[@ANYRES32=r3, @ANYRES8=r5], 0x38) mmap(&(0x7f0000000000/0x1000)=nil, 0x1000, 0x0, 0x20010, r5, 0x0) (async) mmap(&(0x7f0000000000/0x1000)=nil, 0x1000, 0x0, 0x20010, r5, 0x0) openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x472881, 0x0) 2.840586081s ago: executing program 2 (id=3830): r0 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$SO_TIMESTAMP(r0, 0x1, 0x40, &(0x7f0000000000)=0xfffffffa, 0x4) bind$inet(r0, &(0x7f0000000040)={0x2, 0x4e23, @multicast1}, 0x10) sendto$inet(r0, 0x0, 0x0, 0x28040041, &(0x7f0000000080)={0x2, 0x24e23, @loopback}, 0x10) sendmsg$inet(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000140)="17", 0x1}], 0x1}, 0x200008c0) setsockopt$SO_TIMESTAMPING(r0, 0x1, 0x25, &(0x7f0000000180)=0x193a, 0x4) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000380)='memory.events\x00', 0x275a, 0x0) write$cgroup_subtree(r1, &(0x7f00000003c0)=ANY=[], 0x32600) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x2000001, 0x12, r1, 0x0) r2 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000440)={'wlan1\x00', 0x0}) r4 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000480), 0xffffffffffffffff) sendmsg$NL80211_CMD_SET_CQM(r2, &(0x7f00000004c0)={0x0, 0x0, &(0x7f0000000500)={&(0x7f0000000540)={0x24, r4, 0x1, 0x70bd25, 0x1, {{}, {@val={0x8, 0x3, r3}, @void}}, [@NL80211_ATTR_CQM={0x8, 0x5e, 0x0, 0x1, [@NL80211_ATTR_CQM_RSSI_THOLD={0x4}]}]}, 0x24}, 0x1, 0x0, 0x0, 0x20}, 0x0) ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8933, &(0x7f0000000580)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_NEW_INTERFACE(r1, &(0x7f0000000680)={&(0x7f0000000400)={0x10, 0x0, 0x0, 0x40000000}, 0xc, &(0x7f0000000640)={&(0x7f00000005c0)={0x54, r4, 0x200, 0x70bd26, 0x25dfdbff, {{}, {@val={0x8, 0x1, 0x68}, @val={0x8, 0x3, r5}, @val={0xc, 0x99, {0x5, 0x2a}}}}, [@NL80211_ATTR_IFNAME={0x14, 0x4, 'bridge_slave_0\x00'}, @NL80211_ATTR_4ADDR={0x5, 0x53, 0x1}, @NL80211_ATTR_IFTYPE={0x8}]}, 0x54}, 0x1, 0x0, 0x0, 0x1}, 0x4040050) recvmmsg(r0, &(0x7f00000001c0)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f0000000240)=""/188, 0xbc}, 0x2e0d}, {{0x0, 0x0, &(0x7f0000000300)=[{&(0x7f0000000340)=""/61, 0x3d}], 0x1}, 0x9}], 0x2, 0x20, 0x0) r6 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r6, &(0x7f0000000b40)={0x0, 0x0, &(0x7f0000000b80)={&(0x7f0000000bc0)=@deltaction={0x60, 0x18, 0x8a69b65b1f51401, 0x70bd2c, 0x25dfdc00, {0xa}, [@TCA_ACT_TAB={0x4c, 0x1, [{0xc, 0x8d, 0x0, 0x0, @TCA_ACT_INDEX={0x8, 0x3, 0x7}}, {0x14, 0x5, 0x0, 0x0, @TCA_ACT_KIND={0xf, 0x1, 'tunnel_key\x00'}}, {0xc, 0x9, 0x0, 0x0, @TCA_ACT_INDEX={0x8, 0x3, 0x6}}, {0x10, 0x16, 0x0, 0x0, @TCA_ACT_KIND={0xa, 0x1, 'pedit\x00'}}, {0xc, 0x15, 0x0, 0x0, @TCA_ACT_KIND={0x7, 0x1, 'xt\x00'}}]}]}, 0x60}, 0x1, 0x0, 0x0, 0x44000}, 0x20040844) 2.745183147s ago: executing program 1 (id=3832): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000440), 0xffffffffffffffff) r2 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$NL802154_CMD_GET_SEC_LEVEL(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000100)={0x14, r3, 0x701, 0x74bd2b, 0x0, {0x5}}, 0x14}, 0x1, 0x0, 0x0, 0x20004074}, 0x0) r4 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000140), 0xffffffffffffffff) r5 = socket$inet_udp(0x2, 0x2, 0x0) getsockopt$inet_buf(r5, 0x0, 0x30, 0x0, &(0x7f0000000180)) r6 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$ETHTOOL_MSG_STRSET_GET(r6, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000240)={0x28, r4, 0x527, 0x70bd25, 0x25dfdbfd, {}, [@ETHTOOL_A_STRSET_STRINGSETS={0x10, 0x2, 0x0, 0x1, [{0xc, 0x1, 0x0, 0x1, [@ETHTOOL_A_STRINGSET_ID={0x34, 0x1, 0x1c}]}]}, @ETHTOOL_A_STRSET_HEADER={0x4}]}, 0x28}, 0x1, 0x0, 0x0, 0x80}, 0x24000814) r7 = socket$nl_generic(0x10, 0x3, 0x10) getsockopt$inet6_mreq(0xffffffffffffffff, 0x29, 0x15, &(0x7f0000000280)={@private0, 0x0}, &(0x7f00000002c0)=0x14) ioctl$ifreq_SIOCGIFINDEX_team(r6, 0x8933, &(0x7f0000000300)={'team0\x00', 0x0}) r10 = socket$nl_route(0x10, 0x3, 0x0) r11 = socket$unix(0x1, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r11, 0x8933, &(0x7f0000000340)={'syzkaller1\x00', 0x0}) sendmsg$nl_route_sched(r10, &(0x7f0000000380)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000400)=@newqdisc={0x30, 0x24, 0x601, 0x70bd29, 0x25dfdbfc, {0x0, 0x0, 0x0, r12, {0x0, 0xffff}, {0xfff1, 0xffff}, {0x3}}, [@qdisc_kind_options=@q_ingress={0xc}]}, 0x30}}, 0x26000000) r13 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r13, 0x29, 0x40, &(0x7f0000002900)=@raw={'raw\x00', 0x8, 0x3, 0x418, 0x0, 0xffffffff, 0xffffffff, 0x228, 0xffffffff, 0x348, 0xffffffff, 0xffffffff, 0x348, 0xffffffff, 0x3, 0x0, {[{{@uncond, 0x0, 0x1c0, 0x228, 0x0, {}, [@common=@unspec=@string={{0xc0}, {0x4, 0x9, 'kmp\x00', "8720b47ff1417a3bff3c9fb7cb7997b7514931bd2f540a0169229b60036088bc4b070ddf15ad01f5487588c1ed8d19aeeffe74207d6c3fbc5c8908dfd46a2d73e34d3682f1902e6fe9931f5c46655ac763857fb1f199f35e4b6bd971c28e3406ee0818032d78766642778cb5355db37c410a656d9819fc9d0d4593b98a6d48f4", 0x33, 0x6, {0x7}}}, @common=@inet=@hashlimit1={{0x58}, {'bond_slave_1\x00', {0x41, 0x1ff, 0x6, 0xb0e2, 0x10001, 0x84e, 0x52e6, 0x18, 0x8}, {0x7800}}}]}, @unspec=@CT1={0x68, 'CT\x00', 0x1, {0x0, 0xa, 0x0, 0x9d6, '\x00', 'syz1\x00', {0x7fffffffffffffff}}}}, {{@ipv6={@ipv4={'\x00', '\xff\xff', @loopback}, @local, [], [], 'macvlan1\x00', 'gre0\x00', {}, {}, 0x0, 0x0, 0x0, 0x10}, 0x0, 0x100, 0x120, 0x0, {}, [@common=@frag={{0x30}, {[0x10, 0x5], 0x0, 0x0, 0x2}}, @common=@icmp6={{0x28}, {0x11, "b6a7"}}]}, @unspec=@NOTRACK={0x20}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28, '\x00', 0x7}}}}, 0x478) sendmsg$ETHTOOL_MSG_EEE_SET(r6, &(0x7f0000000f40)={&(0x7f0000000e80)={0x10, 0x0, 0x0, 0x4000}, 0xc, &(0x7f0000000f00)={&(0x7f0000000ec0)={0x1c, 0x0, 0x1, 0x70bd2d, 0x25dfdbfb, {}, [@ETHTOOL_A_EEE_TX_LPI_TIMER={0x8, 0x7, 0xa}]}, 0x1c}, 0x1, 0x0, 0x0, 0x4}, 0x15) sendmsg$nl_route_sched(r10, &(0x7f0000000480)={0x0, 0x0, &(0x7f00000004c0)={&(0x7f0000000500)=@deltclass={0xf4, 0x29, 0x800, 0x70bd29, 0x25dfdbfb, {0x0, 0x0, 0x0, r8, {0x3, 0xfff1}, {0x1, 0xd}, {0x0, 0xb}}, [@TCA_RATE={0x6, 0x5, {0x1, 0x69}}, @tclass_kind_options=@c_qfq={{0x8}, {0x4}}, @tclass_kind_options=@c_sfq={0x8}, @tclass_kind_options=@c_skbprio={0xc}, @tclass_kind_options=@c_hfsc={{0x9}, {0x94, 0x2, [@TCA_HFSC_FSC={0x10, 0x2, {0x2, 0xa, 0x77}}, @TCA_HFSC_RSC={0x10, 0x1, {0x9, 0x897, 0x7}}, @TCA_HFSC_FSC={0x10, 0x2, {0x7, 0x1, 0x5}}, @TCA_HFSC_FSC={0x10, 0x2, {0x0, 0xb, 0xf5c}}, @TCA_HFSC_RSC={0x10, 0x1, {0x563, 0x1000, 0x5}}, @TCA_HFSC_FSC={0x10, 0x2, {0x3, 0xfde0, 0x200}}, @TCA_HFSC_RSC={0x10, 0x1, {0x8, 0x6, 0x8001}}, @TCA_HFSC_USC={0x10, 0x3, {0x68, 0x7ce, 0xfffffff7}}, @TCA_HFSC_RSC={0x10, 0x1, {0x3, 0x3, 0xfffffff7}}]}}, @TCA_RATE={0x6, 0x5, {0x9}}]}, 0xf4}}, 0x0) sendmsg$ETHTOOL_MSG_FEATURES_SET(r7, &(0x7f0000000680)={&(0x7f00000006c0)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000700)={&(0x7f0000001200)={0x4a4, r4, 0x800, 0x70bd2a, 0x25dfdbfc, {}, [@ETHTOOL_A_FEATURES_HEADER={0x24, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x1}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r8}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r9}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x2}]}, @ETHTOOL_A_FEATURES_WANTED={0x100, 0x3, 0x0, 0x1, [@ETHTOOL_A_BITSET_BITS={0xfc, 0x3, 0x0, 0x1, [{0x1c, 0x1, 0x0, 0x1, [@ETHTOOL_A_BITSET_BIT_NAME={0xd, 0x2, 'nl802154\x00'}, @ETHTOOL_A_BITSET_BIT_NAME={0x7, 0x2, '\'\x14\x00'}]}, {0x30, 0x1, 0x0, 0x1, [@ETHTOOL_A_BITSET_BIT_NAME={0xa, 0x2, 'wlan0\x00'}, @ETHTOOL_A_BITSET_BIT_NAME={0xc, 0x2, 'ethtool\x00'}, @ETHTOOL_A_BITSET_BIT_NAME={0xd, 0x2, 'nl802154\x00'}, @ETHTOOL_A_BITSET_BIT_VALUE={0x4}]}, {0x34, 0x1, 0x0, 0x1, [@ETHTOOL_A_BITSET_BIT_NAME={0x7, 0x2, '\x1b-\x00'}, @ETHTOOL_A_BITSET_BIT_VALUE={0x4}, @ETHTOOL_A_BITSET_BIT_NAME={0xe, 0x2, '!/[(^(*}[\x00'}, @ETHTOOL_A_BITSET_BIT_VALUE={0x4}, @ETHTOOL_A_BITSET_BIT_INDEX={0x8, 0x1, 0x9}, @ETHTOOL_A_BITSET_BIT_INDEX={0x8, 0x1, 0x1ff}]}, {0x38, 0x1, 0x0, 0x1, [@ETHTOOL_A_BITSET_BIT_VALUE={0x4}, @ETHTOOL_A_BITSET_BIT_INDEX={0x8, 0x1, 0x7}, @ETHTOOL_A_BITSET_BIT_INDEX={0x8, 0x1, 0x8}, @ETHTOOL_A_BITSET_BIT_NAME={0xc, 0x2, 'ethtool\x00'}, @ETHTOOL_A_BITSET_BIT_NAME={0xc, 0x2, 'ethtool\x00'}, @ETHTOOL_A_BITSET_BIT_NAME={0x7, 0x2, '%{\x00'}]}, {0x38, 0x1, 0x0, 0x1, [@ETHTOOL_A_BITSET_BIT_VALUE={0x4}, @ETHTOOL_A_BITSET_BIT_NAME={0xc, 0x2, 'ethtool\x00'}, @ETHTOOL_A_BITSET_BIT_INDEX={0x8, 0x1, 0x3}, @ETHTOOL_A_BITSET_BIT_INDEX={0x8, 0x1, 0x7f}, @ETHTOOL_A_BITSET_BIT_VALUE={0x4}, @ETHTOOL_A_BITSET_BIT_INDEX={0x8, 0x1, 0x7ff}, @ETHTOOL_A_BITSET_BIT_INDEX={0x8, 0x1, 0x800800}]}, {0x8, 0x1, 0x0, 0x1, [@ETHTOOL_A_BITSET_BIT_VALUE={0x4}]}]}]}, @ETHTOOL_A_FEATURES_WANTED={0x88, 0x3, 0x0, 0x1, [@ETHTOOL_A_BITSET_BITS={0x4}, @ETHTOOL_A_BITSET_BITS={0x28, 0x3, 0x0, 0x1, [{0x20, 0x1, 0x0, 0x1, [@ETHTOOL_A_BITSET_BIT_NAME={0xc, 0x2, 'nl80211\x00'}, @ETHTOOL_A_BITSET_BIT_INDEX={0x8, 0x1, 0x5}, @ETHTOOL_A_BITSET_BIT_VALUE={0x4}, @ETHTOOL_A_BITSET_BIT_VALUE={0x4}]}, {0x4}]}, @ETHTOOL_A_BITSET_SIZE={0x8, 0x2, 0x1}, @ETHTOOL_A_BITSET_MASK={0x45, 0x5, "2e00f803fbd20d9caec0964292adc1330da61c6918972b10f8332060e74682d8f4101723ff383616c19bfc081f6183b520ce9edecc3beed614a1c7f6914b6a4c61"}, @ETHTOOL_A_BITSET_SIZE={0x8, 0x2, 0x4a}]}, @ETHTOOL_A_FEATURES_WANTED={0x234, 0x3, 0x0, 0x1, [@ETHTOOL_A_BITSET_BITS={0x134, 0x3, 0x0, 0x1, [{0x48, 0x1, 0x0, 0x1, [@ETHTOOL_A_BITSET_BIT_VALUE={0x4}, @ETHTOOL_A_BITSET_BIT_INDEX={0x8, 0x1, 0x100}, @ETHTOOL_A_BITSET_BIT_VALUE={0x4}, @ETHTOOL_A_BITSET_BIT_VALUE={0x4}, @ETHTOOL_A_BITSET_BIT_INDEX={0x8}, @ETHTOOL_A_BITSET_BIT_INDEX={0x8, 0x1, 0x2}, @ETHTOOL_A_BITSET_BIT_NAME={0x8, 0x2, '\xea.\n\x00'}, @ETHTOOL_A_BITSET_BIT_VALUE={0x4}, @ETHTOOL_A_BITSET_BIT_INDEX={0x8, 0x1, 0xa8}, @ETHTOOL_A_BITSET_BIT_NAME={0xa, 0x2, 'wlan0\x00'}]}, {0x38, 0x1, 0x0, 0x1, [@ETHTOOL_A_BITSET_BIT_NAME={0x7, 0x2, '@*\x00'}, @ETHTOOL_A_BITSET_BIT_VALUE={0x4}, @ETHTOOL_A_BITSET_BIT_INDEX={0x8, 0x1, 0xff}, @ETHTOOL_A_BITSET_BIT_INDEX={0x8, 0x1, 0x8000}, @ETHTOOL_A_BITSET_BIT_VALUE={0x4}, @ETHTOOL_A_BITSET_BIT_INDEX={0x8, 0x1, 0x200}, @ETHTOOL_A_BITSET_BIT_VALUE={0x4}, @ETHTOOL_A_BITSET_BIT_VALUE={0x4}, @ETHTOOL_A_BITSET_BIT_VALUE={0x4}]}, {0x2c, 0x1, 0x0, 0x1, [@ETHTOOL_A_BITSET_BIT_NAME={0xa, 0x2, 'wlan0\x00'}, @ETHTOOL_A_BITSET_BIT_VALUE={0x4}, @ETHTOOL_A_BITSET_BIT_NAME={0x7, 0x2, '\'\x92\x00'}, @ETHTOOL_A_BITSET_BIT_VALUE={0x4}, @ETHTOOL_A_BITSET_BIT_VALUE={0x4}, @ETHTOOL_A_BITSET_BIT_INDEX={0x8, 0x1, 0xd18}]}, {0x44, 0x1, 0x0, 0x1, [@ETHTOOL_A_BITSET_BIT_VALUE={0x4}, @ETHTOOL_A_BITSET_BIT_NAME={0xc, 0x2, 'nl80211\x00'}, @ETHTOOL_A_BITSET_BIT_VALUE={0x4}, @ETHTOOL_A_BITSET_BIT_NAME={0x8, 0x2, '(/\'\x00'}, @ETHTOOL_A_BITSET_BIT_INDEX={0x8, 0x1, 0x6}, @ETHTOOL_A_BITSET_BIT_VALUE={0x4}, @ETHTOOL_A_BITSET_BIT_NAME={0xc, 0x2, 'ethtool\x00'}, @ETHTOOL_A_BITSET_BIT_VALUE={0x4}, @ETHTOOL_A_BITSET_BIT_INDEX={0x8}]}, {0x18, 0x1, 0x0, 0x1, [@ETHTOOL_A_BITSET_BIT_INDEX={0x8, 0x1, 0xffffffc0}, @ETHTOOL_A_BITSET_BIT_NAME={0xc, 0x2, 'ethtool\x00'}]}, {0x28, 0x1, 0x0, 0x1, [@ETHTOOL_A_BITSET_BIT_INDEX={0x8, 0x1, 0x2}, @ETHTOOL_A_BITSET_BIT_INDEX={0x8, 0x1, 0x9}, @ETHTOOL_A_BITSET_BIT_VALUE={0x4}, @ETHTOOL_A_BITSET_BIT_INDEX={0x8, 0x1, 0x582}, @ETHTOOL_A_BITSET_BIT_INDEX={0x8}]}]}, @ETHTOOL_A_BITSET_BITS={0x9c, 0x3, 0x0, 0x1, [{0x24, 0x1, 0x0, 0x1, [@ETHTOOL_A_BITSET_BIT_INDEX={0x8, 0x1, 0x2}, @ETHTOOL_A_BITSET_BIT_NAME={0xc, 0x2, 'ingress\x00'}, @ETHTOOL_A_BITSET_BIT_INDEX={0x8, 0x1, 0x1}, @ETHTOOL_A_BITSET_BIT_VALUE={0x4}]}, {0x40, 0x1, 0x0, 0x1, [@ETHTOOL_A_BITSET_BIT_VALUE={0x4}, @ETHTOOL_A_BITSET_BIT_INDEX={0x8, 0x1, 0x1}, @ETHTOOL_A_BITSET_BIT_VALUE={0x4}, @ETHTOOL_A_BITSET_BIT_VALUE={0x4}, @ETHTOOL_A_BITSET_BIT_INDEX={0x8, 0x1, 0xa}, @ETHTOOL_A_BITSET_BIT_NAME={0xc, 0x2, 'nl80211\x00'}, @ETHTOOL_A_BITSET_BIT_INDEX={0x8, 0x1, 0x4}, @ETHTOOL_A_BITSET_BIT_VALUE={0x4}, @ETHTOOL_A_BITSET_BIT_INDEX={0x8, 0x1, 0x60}]}, {0x34, 0x1, 0x0, 0x1, [@ETHTOOL_A_BITSET_BIT_VALUE={0x4}, @ETHTOOL_A_BITSET_BIT_INDEX={0x8, 0x1, 0x3}, @ETHTOOL_A_BITSET_BIT_VALUE={0x4}, @ETHTOOL_A_BITSET_BIT_VALUE={0x4}, @ETHTOOL_A_BITSET_BIT_VALUE={0x4}, @ETHTOOL_A_BITSET_BIT_VALUE={0x4}, @ETHTOOL_A_BITSET_BIT_INDEX={0x8, 0x1, 0xc5}, @ETHTOOL_A_BITSET_BIT_VALUE={0x4}, @ETHTOOL_A_BITSET_BIT_INDEX={0x8, 0x1, 0x9}]}]}, @ETHTOOL_A_BITSET_MASK={0x54, 0x5, "3fa4f13265f8b15364d4b609c9cb5e876b56e18082a104d3b570e3c5e7af8c62e94f19b1dbcbeb54e3f9e4a0a404caab69857b1ad0346b0b8d5eed8cebd6ff3d71088d0f15ab6f3b05effc340f6cd91a"}, @ETHTOOL_A_BITSET_BITS={0x4}, @ETHTOOL_A_BITSET_NOMASK={0x4}, @ETHTOOL_A_BITSET_NOMASK={0x4}]}, @ETHTOOL_A_FEATURES_WANTED={0x5c, 0x3, 0x0, 0x1, [@ETHTOOL_A_BITSET_SIZE={0x8, 0x2, 0x3}, @ETHTOOL_A_BITSET_SIZE={0x8}, @ETHTOOL_A_BITSET_VALUE={0x46, 0x4, "8cc93c7d7c0236cfab2d9a509dc161072c4b37bbbaa0b3b0d9ee204b8c4a93c64553cfcb9486dbda34202da02cafcb1a39497923a4e2d031e6cc124bd736fc9dac7e"}]}, @ETHTOOL_A_FEATURES_HEADER={0x54, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x3}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x3}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r12}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'syzkaller0\x00'}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x3}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'vcan0\x00'}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x3}]}]}, 0x4a4}, 0x1, 0x0, 0x0, 0x10040981}, 0x9) ioctl$sock_kcm_SIOCKCMCLONE(0xffffffffffffffff, 0x89e2, &(0x7f0000000600)={0xffffffffffffffff}) sendmsg$kcm(r14, &(0x7f00000028c0)={&(0x7f0000000740)=@tipc=@nameseq={0x1e, 0x1, 0x0, {0x40, 0x0, 0x4}}, 0x80, &(0x7f0000000900)=[{&(0x7f00000007c0)="84ed0cea7b667cc1b2227b530b75bccbd858b80b5ffc45063b815fdb3dd9c93ec20844aafce8ddbb0da306be0e2bc46369a503516425ef28bb1a73c90cd551c2288db87027208d380f47ed6f7e27f6f5729433e29cb32e5ad7abc9b2ca0b21c37b49f7fa4aaef01925ff3cae53fd0044e48af3ba15c190ef400f359660578f824b840d422c71a0350c4db1f0e346a26418ffbcfb6e1647a21e0aa79448c9ccb88695cbb716fe18f6a6a9db0c4bd8196b4f321292435ed79cf73488188691ddd1a628b7627c9c", 0xc6}, {&(0x7f00000008c0)="1862a6c5", 0x4}], 0x2, &(0x7f00000016c0)=[{0x1010, 0x10a, 0x5, "49f88377bee316d84fb44bde454bc455cdf4d6875763bf08921b05b93ac6640e20ba683a53631425bbf9c7c0292f7d9acdf37eebf330bc533d18e41f0e5812dbd0031ce5b96b78806ef04a73d0f2fa889610cb49010bc241dcac56471caa1306bc2cc53499c42308186d5999b0bfeae3e88e4f19336f2d6cb6cc06268714fad586a0804c192ca7f86ffcb76f2d192ac6204804194fd3dc3e351ca58e4a2287f519ac13146189dfcf51be846e1bca0738c60a05abf013f4e71cc99f5dc69318be2bb0b691a70a3b8cc9463d9719b4f3db158bf13454a9d62869ecc6508126678db467efc7a05dc2cbf57df9e2e5c3fce752ee78281c272ca1785b9eb43f2cd7b1ad95da2e6c10cd63dbe383106537e5b0360778dcc7f5654c7727b1295aef1db351b1b2eb9c02264c0e75188073228c93910d2df524eb34b7476f99dc2991f6b8ec99e5bb9a5a94e70ce00bc4ba902f74cb9366ffeff18d581ca6418739067cb4c3874abe8ea5cfcc1846bb3e75d22a34b5f054916c8fc61b8ded9cf390e156281ef16a61dfb75d3a56313383e83937752892153d17f2855f04cef9fd75699b89a25d22ce5711db20e83104824958c58eb328d8d777ca2fe220b6e37396d6e47b02d2df576e18a1ac5844ea2d96d6da062da9d8ad871a9e6f6e66fa6cf2f15fbd8ddf9612f8cff2ce23b39ab66aa726a33c0765ef0c85e8b6860a3f89d225d2317db34508ab67ab3ae4a5cc3fea4c7a88a290dc7d928410895e4af9cab383428d447fd045944d8a31038e25ca1f0199f9c09c8acc57eb3539df51d4f01d6b5714ab189f0ac7ca14eb1ac40ccd1d2eaa585fb1b2edb2be95337e6b91f1e0d5a1796d4e0b25e305cadd0d688486d2fe5c4aa99a0ea1214dae61e71e00f505d9e04aee1e2aa8f581b5821455adc5220d7c231c9cdc5e929c0a9b523a5042dbfa1407794478cfa98f73f34f4f42c9ef70f2319a6ea623d91952b8cd3f79212d5d5e81ba795c719c9ad247507a4f933381bacc0a52eb12c79b8457795f6a714190ab61a6aef5f1d92e120e6b26d527851cb77f0592f8e5e6d40e28eac841e5d8f19c4050501cc779ec543a740a785a53da5e993c835e351b9f4fc804830292d2020ba53958218388ce10d9d09ce1137fa65e571835b325ee6b76f31dcadfa7f0878f4d61b0642a2a19b72ab7d834bab31952a9022441bb32f46b8c46b8794cf9f5e058ee39df1efe7f217016017bf628c686d881e52ad21a48514104bf91df75f0b1adfc5c86aba4489abcd7009e7318916c72581b134f932938fdf2ae32d75719c668bc025776b92684177b5eff0bd30b6edf9bdf4467c137e88f9990d67cd06c24b5b8e42c35c8a8e56bfe897deef3579113720f0ac90162b66034ec6ddf748aaad9bd74b3cbca24d5da89ade252ab7906d3f3bbeb0de35f8d17dd64234a9120a65adc286050f7c2f5f65aef4b8b3d9e80506828279392a8cf75f0577e0f313856606b1cdacd4dbd4ca70ceeb19969ac08394f1105a89d263d7f3fca08d305de63eb37af48acf5e13999a7b780494e162acb55c7a071af12d03d35f66206df864bd05c482ced23de2e503212f86398737d82e8cab772a30e0980bb0fcc2e796b53ca57512abf20a57a55d02a89b1e00fe972498628dd96d982790dacf0bbde6fa6188bf826db19a71453c1fe7b5006027225196fef0a354e5902820c4fdfe17485dc2ea604276d8b14f5f71e17a87a2db7cd50c7854e82760acd89fe7f83c8d4a17f319db7004ab7e4cab6e2b290edf1aec6759ad34568d4bf2815daefbe4dc0807f186b8b949d5753dc661f2e13ba835240c8834b3a6a497bc335d31078e89b203bcac59ac32e65ef1fef40ebb290ec0460b3572fa169d115c5067660f32a140daee84502dfd7b034a8a514f18df0bc5e687e30942e8003092462e89d593beb567b1c718e195d044c4447ad51b6e03e1f8853bb7e488c73a632d335a5ca65a419b6da0a4e3f40b4e8d91c9c234bd4d8c26b000b77192a9799971fafd179386f5c4b23adb052f74d0339524166a3d53118a93ccdb459cf85345a0c3a4a7545e65a615ff88eed8957bf7004fe0378a5674d06c158791f70becc19b489fd8d992cdab329d6722a971d32e2cd287297153447fa9b45ec4b2983b4d678e8ba0aaab3596ac9cd118c6cecec3b8714e6c2cabca01c5f5dd34ccb85e6ed6d3c9bff7fde390b24f4b814e34fb5794cb3c104cf79af924ad48e9c26e4c5240c5d20603c3ac5c2d56622f9c63fac9e72e9c90c6c30e8016ad352e63f64c7120dc85f83ae96173b91de808cf176fa6413ad74daf8bb3cbfa4430520c22c793d9cc6bd83ee379f8aa42e88cc05d81ab22185ce0e766edd68c8e0b3eb667d3327a32470282938c4fa1b48b76cfa6431404fa0f82090633bb112c31f6065c78b392fb5484629210175f268bad737fed5666d049de3e9c268432c166b31fc92d87a80d02c7de3f932a558ec179ac4eb149d443d3bde9c839e243952b409031997408ebde45106bb4dd2f2c12005f23ed776d4f438c00c1cd973dab9d747dac6ef6e48d6f4c8374f98cec3648440d7e07bde0b84e5162c36ac89d2aa423b8aed1d3f78cc378ad871f9e12f02d5d9530aaf7c07beed0e51eb013b5ca8ac8bce8668c27962a716cdedb0016df568f03e92412d313cdb190601d6dfbedc19ead66c39303724255c7618f606843f073485b24b687e87784d6ff39752e2d4d0f29e1a9e20298178f823841cc5aecbc08a9c9b26d93c95b261e588a0422ab077387004889329edfa340ce7de5723a1dc7c64b20bd3e7806b298448a9543070b0474ade30a99b12ce03870279434d7a56abe5e46cf517a31b0155a66532b0cf0542315d82334c15b7734df8cec1d2eaa5ab570752e982f460ba821f658a9fa61bef8a2699e3b01e6a7ea6677e386c68a6619e9a36f36d4c4f9a2f84565a273c83f5ffa4fa2f6809117e4206e9d66045d4d958bdcfea68eb634cbe1f6b94261b4dfe5d07e02865c2c998c1aa55ca096e341877bac2efd75f2572d26d090f5e404234762480ae6acd3b5bf83f0cfbd377f0fc3a8be686e4f928f4d626aa41db12db2d194bd757c59ee7b58835b56cb805cd97314bb91009f28de4280b85869901b100ee63ad34a29b1861f7fcc33221ab3c68ae6b699b409dc7f2ef48a6839b29c19fa9ddf0a899a4035a6023d34e83b93cb61f6591512e6a214571656b41240166bc29190b0f1a88cc453919a0807b673c00a6629ed2d4453648d789aae185f14a0a72e240829fca3a8adb849457f35a7e52ed5f8d06e74e0253400faaaa4ed79aa3f47714b6c399c93293622aae463fd648e013413e6da3e7ad01e12b2328144ed8f3effe5ea74c3d69080cf25e5647203f3d347db51c9e82d6b59a1d3083e0b50fde67290bc6cb275cc16a3ccc74e2811914f1038b324fe36791a4c9dfa616b27bea57cb5f521b830166d007da43b0ec2f38c8c8df16b3ac38a08970121565909c1d990d3273b1095ad2d90cf27c02f1f0922f91df707eb51e62cedb820e3a9612d5e79ba0bf66fa3e0be64f2bc2a35d4751f5466e2f12f1734ef775b62253abdbd0bd86bbd3a66244c98e2a190ce48b025850f248a4cce9b1cdda5ccb30f39fad052ef5c8c0ce794230b6e0ce82626eafbd7eb527030bf3bfd385d9c4c8a4a1c9311e082919b6528956ba53f824a5837f87606c2c5adf9b1ed8f895da7d4c8108a663468d54251735a6cfa3fd0dcdc0a5df45d980530806bf896e9692047137ab66d6172ed4861c293d33d389982a4154a9155a9657156657e117c46409f7d880be0f216c9544cd266e7b7b29257af00b38b942334ab5684221d1642df590af493718f02da1e04c6ee3f6547a80497d0857e089e4929823dbc8dce86a33be36671513defbacabd9ad5e6fcaaff9ff37d09dbb6e7f9ae85bd164b6272b3d9ed07693284c0b0d17c87aa803642ebbf0eadd2689ce90ad618b8b4f4f15c41bbee57a65058594e4bd2ee0ae900c7d776c5c4e186eca366687c1688bd7397cf74401178dad264ecb076653e2a7d45c7d055ac12ec27036933bfbc3eec1fb77f98a62ad99936f86b42624d43879781042ba4d276a44361ad28b6eefbe51b128ef58d8328820c7794a8d93e2441dc589ec83c4240bf3ddff7dd6da5d39e7dd226133cd36cbbecc1e302047f9ba0bc60ba3e03fb893ff4d8f0f7df1ce08999ea33e7453e3fb3718ea80871f704f132fbb7416cfec7eb5cd0dcb24b601090126d85a35595c6f81eb4fb0baf5e54605a85c4db4d84b59189f114a90136b52274f70c6ac7a2128691ac09b1eeac1a16b906adb2acd083f5b0763bfba506804191679934b8d087733bc4141b7bc5d645c4191c60cae78aaf7e5f51399db90af8a131bb80d7e3136b30f8a9c60c6cc4edb02fc1f548b520cd31c5660bd7ab44b585df6af29e02a7eb47d44ddf57fc55219db085c848dbafd8bdb14539dd8f1af9444a904e2675256600cf6e94bcd9ea59f1f338a5d0795b13d48ca843e4d67681de18e2d8e4cf543141df6b5cf5f30178ce002c7e4b2549638ea26fdcc3f20f24fe6435725e8e61bda8da2b527b2989eab97ab71ff1a3329d4b76bf38747a8dee5a6342cabc236c296e4a294e74ef334dc8bbf029c8a0372ca1843641611d6fd0b6ab2542534965a7a84345518b781e7cd5174eab6b8b3db6a9c657603600b92059986fa8a7405213088a9430b28345f589396c31154e4e900184eda659385394dc67550fc74c38b88f392a1ec473900793a0c1aefde1ceca433aa73f7312a827506409aefcb1f7b59df296d293823b7af8618e79a0706b44d442ba56881cf1467def6c741fef3c08220c0d1817e8782bb12bb1560307fc12097727eaab45976df1b17778c749443d78b14d1ea91300e3c795f93884f7bb8b44ab031b1934ef21304d98d29914be806be9f4d22a077996b5f28fea54c532a52f5602d231671e94fd486034a31a253f04d02f986698bc6a46f93b7f1d0cd299f9561786e4487db12feecf2d0d256c13ee84864ac10cce2c3160e9294dec896a80a94b147e7bf1a857190e83d9ab3eaf3541dec9673b01fc2c00d9cc977f2baef3d54cdf90c32358630eecc1d6ec365d550c908cf4bd98ae2aa13292848cddc2a993d22b4589a614fe900b9941006850765cec85db9d39612e0e16a68f80a7a83bc9fe4be913c3dcd291a6474a37e3a708f86e261c6e52b56f8a40375b9a8eaa578335aad122d1295d7cac994916633d0ab34d34476033478dc3a6b03df8068602eecd24c9edd886b32298874b2ce3036f828a6b176e567cd1b615d1ae48fd7c31a123c2614500cde14630a65f8a3b43748dfacfbc2bc1009835fe30be0e2df9bbbd24046edd1a8a7329d2104e714e146964b31d79e5c14bb15c6d1a525688eac65e514a3cd031bc8076e337a7afaa3234abfbb64df856bb131e28f0270c388a15e48a4343f5296c5f7edb95fff39899e91d13c1bed410fc046338b5620e08d7d18b5df1aa648e5f594fe395ebfa248615eef56da363f67b2c3d3b77247eb71226cdbd129684bd92f98da6cdf6d1a3b032c00aa0cf2f194d164ed2bb8588c7f52be69ec76e7ff33f2cb49a177394431dd371920a1e612a64ca2f1b9a7b07e0b667a1e2c056ff8793ab8762a37225ada478a9c160a6f568d0f8419c4907a671c75629e9027808a4c45c4e3a25c0ea512f884eb93baad960c1e9a2ac43ae4b9c44baac6896154399c2c20faeb58a023ba6bb08dbcd276fc0e2206c6"}, {0xa0, 0x10f, 0x80000001, "6f1894a3f063f10d6e4d4cb208b51b666e7bf1051380cea54c998478e3d1d5c9d54038352cc1a5c4b4d6a357ce0dc005f70558aede892c29d91e00094081a3c8540ead39045dace11f76c67c62f0e6890bfc0326931727554b52f510363d9a51c5d942ac11522532dfc63f597145d9880e9a3d35a4e3d227097858faf9b73f2877c5c0300a9a7cbe62cf1bc638374f71"}, {0x88, 0x116, 0xf381, "3b48628f4d5c85caae36857035437be5d8060b591c23de23429dde96e66e5aa746ad24b629e98e670eb5d7abfb4500570dace145eac7585c05f84b8a2cde99a6e7bf2ce3e963be56a1188a6f807d0bff6489b178668cfecad90883e85882da5baffe68404b8f3ad840b0d6c1549d7a72ab8d5e8b79f2bdd5"}, {0x38, 0x108, 0x7, "4583dffb6a0b2382dc94783073a68ee6d2589f1b400ca3846070a8e49ebcdf68ac29a37ab3c69e0e"}, {0x80, 0x11, 0x5, "d47ede2ac63a8e845cdb202ff30152126b36a10d11ca799612b17415c30503f6bbd2af8216aed43d0ee38db1986f4d0587f794a41d5bc69b4a9415e7f94ee8bdf94b872a7a0a3c7a85fbe1df7f356776dc3f53318c8e77cdb9713505b8a3fa266305cecdb62058f24b"}], 0x11f0}, 0x20008840) ioctl$sock_SIOCGIFINDEX_80211(r7, 0x8933, &(0x7f0000000c40)={'wlan0\x00', 0x0}) r16 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r16, &(0x7f0000000c80)={0x0, 0x0, &(0x7f0000000cc0)={&(0x7f0000000d00)=@delqdisc={0x24, 0x25, 0x1, 0x0, 0x0, {0x0, 0x0, 0x0, 0x1, {0x0, 0xffff}, {0x6, 0xffff}, {0x0, 0x5}}}, 0x24}}, 0x0) r17 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000d40), r7) sendmsg$NL80211_CMD_NEW_INTERFACE(r7, &(0x7f0000000d80)={0x0, 0x0, &(0x7f0000000dc0)={&(0x7f0000000e00)=ANY=[@ANYBLOB='L\x00\x00\x00', @ANYRES16=r17, @ANYBLOB="01002bbd7000ffc18e250700000008000300", @ANYRES32=r15, @ANYBLOB="0c009900010000005b00000005005300010000001400040064766d727030000000000000000000000800050004"], 0x4c}, 0x1, 0x0, 0x0, 0x62b4e7cbb8b4f193}, 0x8040) sendmsg$ETHTOOL_MSG_CHANNELS_SET(r0, &(0x7f00000011c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000010c0)=ANY=[@ANYBLOB='4\x00\x00\x00', @ANYRES16=r1, @ANYBLOB="010300000020000000ee15660000080006000200000018000180140002007665746830"], 0x34}}, 0x44800) 2.588525723s ago: executing program 4 (id=3834): socket$nl_route(0x10, 0x3, 0x0) r0 = socket(0x10, 0x803, 0xfffffffb) socket$nl_netfilter(0x10, 0x3, 0xc) r1 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_generic(r1, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000380)=ANY=[@ANYBLOB="240000002e0029022ac77000fadbdf25", @ANYRES32, @ANYBLOB], 0x24}, 0x1, 0x0, 0x0, 0x4000840}, 0x0) socketpair(0x2b, 0x800, 0xf, &(0x7f00000003c0)) r2 = socket$inet6_sctp(0xa, 0x1, 0x84) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r3, &(0x7f0000000480)={0x0, 0x0, &(0x7f00000004c0)={&(0x7f0000000000)=ANY=[@ANYBLOB="140000001000010000000000000000000200000a20000000000a01080000000000000000020000000900010073797a300000000064000000090a010400000000000000000200000208000a40000000010900020073797a31000000000900010073797a300000000008000540000000080800034000000084200009801c0002800c00018008000140000000000c0a01010000000000000000020000000900020073797a31000000000900010073797a300000000028006b0e24000080100001800c000100e7ffff7f0000000010000a800c000100f81f3fe70a58a0771400000011000100000000005f000000000200000a00"/257], 0x100}}, 0x24000001) r4 = socket(0x10, 0x3, 0x0) setsockopt$netlink_NETLINK_TX_RING(r4, 0x10e, 0xc, &(0x7f0000000640)={0x1, 0x0, 0x3, 0x1}, 0x10) write(r4, &(0x7f0000000680)="240000001a005f0214f9f407000904001f00000000000000000000000800040001000000", 0x24) r5 = socket$inet_tcp(0x2, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f00000006c0)={'syz_tun\x00', 0x0}) r7 = bpf$MAP_CREATE(0x0, &(0x7f0000000700)=ANY=[@ANYBLOB="10000000040000000800000005"], 0x48) r8 = bpf$PROG_LOAD(0x5, &(0x7f0000000740)={0x6, 0xc, &(0x7f0000000800)=ANY=[@ANYBLOB="18000000181100"/20, @ANYRES32=r7, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bc82000000000000a6020000f8ffffffb703000008900000b703000000000000850000003300000095"], &(0x7f0000000880)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @xdp=0x25, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f00000008c0)={{r7}, &(0x7f0000000900), &(0x7f0000000940)=r8}, 0x20) bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f0000000980)={r8, r6, 0x25, 0x0, @void}, 0x10) syz_emit_ethernet(0xfe4f, &(0x7f00000009c0)=ANY=[], 0x0) r9 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000a00)='blkio.bfq.io_queued\x00', 0x275a, 0x0) sendfile(0xffffffffffffffff, r9, 0x0, 0xffffffff000) r10 = socket$inet6_sctp(0xa, 0x5, 0x84) shutdown(r10, 0x0) close(0x3) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r10, 0x84, 0x6f, &(0x7f0000000a40)={0x0, 0x0, 0x0}, &(0x7f0000000a80)=0x10) getsockopt$inet_sctp6_SCTP_PRIMARY_ADDR(r10, 0x84, 0x7a, &(0x7f0000000b40)={r11, @in6={{0xa, 0x3, 0x4, @mcast1}}}, &(0x7f0000000c00)=0x84) getsockopt$bt_hci(r2, 0x84, 0x84, &(0x7f0000000c40)=""/4096, &(0x7f0000001c40)=0x1000) r12 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_LIST(r12, &(0x7f0000001c80)={&(0x7f0000001cc0)={0x10, 0x0, 0x0, 0x1000}, 0xc, &(0x7f0000001d00)={&(0x7f0000001d40)=ANY=[@ANYBLOB="2000000007060104000d000000000000050000090900020073797a3000000000"], 0x20}, 0x1, 0x0, 0x0, 0x200040c0}, 0x20004000) sendmsg$IPVS_CMD_SET_INFO(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000ac0)={0x0}}, 0x20040014) 2.364350755s ago: executing program 1 (id=3836): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) close(r0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r1, 0x6, 0x13, &(0x7f0000000780)=0x100000001, 0x4) connect$inet6(r1, &(0x7f00000007c0)={0xa, 0x1, 0xfffffffe, @ipv4={'\x00', '\xff\xff', @dev={0xac, 0x14, 0x14, 0x2e}}}, 0x1c) r2 = socket$inet6_mptcp(0xa, 0x1, 0x106) getsockopt$inet6_mptcp_MPTCP_SUBFLOW_ADDRS(r2, 0x11c, 0x3, &(0x7f00000028c0)={{0x10, 0x0, 0x0, 0xc6}, [{@in6={{0xa, 0x0, 0x0, @mcast1}}, @in6={{0xa, 0x0, 0x0, @private2}}}, {@in={{0x2, 0x0, @broadcast}}, @in={{0x2, 0x0, @local}}}]}, &(0x7f0000002b00)=0x210) setsockopt$inet6_tcp_TCP_ULP(r1, 0x6, 0x1f, &(0x7f0000000800), 0x4) setsockopt$inet6_tcp_TLS_TX(r1, 0x11a, 0x1, &(0x7f0000000840)=ANY=[@ANYBLOB="03033700af0e8d7de848fd9f1c90cebc5f3aaab072214956f99a29"], 0x28) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$inet(r4, &(0x7f0000000040)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000080)=ANY=[@ANYBLOB="28010000000000000100000001"], 0x128}, 0x4004000) bpf$BPF_GET_MAP_INFO(0xf, &(0x7f0000002000)={0xffffffffffffffff, 0x58, &(0x7f0000001f80)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, ""/16, 0x0}}, 0x10) sendmmsg(r4, &(0x7f0000002400)=[{{&(0x7f0000000240)=@vsock={0x28, 0x0, 0xffffffff, @hyper}, 0x80, &(0x7f0000000400)=[{&(0x7f00000002c0)="df22928c089ba38711141fab10ae7aca17edf8b1c66b2ca0003e070c8bc010de39966697e88fdf839cb30635881a56336618e2f4115ea66499dd4125f82c8dd3f33dea2cd084ce7f87c8c6153f255075d9fb4093d43243bc05416c708cac6665378398c1cbdc4301e2dc04d450928eb6", 0x70}, {&(0x7f0000000340)="bb2461a4dff77028f7ba38fa0afeaf9fdd28bd14233a9aeeae025f98861bc4504c246bc58a4bece031b3412e365b31d4d4975a149d9a7ad784fb4a17b55379aaaf41e533848b3cb31edd", 0x4a}, {&(0x7f00000003c0)="5142d87678b3a7466fe82709904c01150411d0e0f209262bba9268609604a4d3a37aebc2ecf33512a7a023", 0x2b}], 0x3, &(0x7f0000001c80)=[{0x48, 0x84, 0xe5, "6a0da266886d0b5d914ea8688ef836867c724fde4d4ebfa7a4ba5124403146272f8720a1ae28315ef291ac3fc46383ae8f94d361ce"}, {0x30, 0x0, 0xe, "98e31d783474336cddbd531bbfd2ca73ed20f2daa8c719e78b363504"}, {0xa8, 0x116, 0x4, "d1607300bed3d77f9b8ba5ba31874e6a9306a6a7667a106383553c7d2cf1bbeab8413d6ba5f9a8c02e27930ff8a5ac1da2405b8297d4ca8cdc1325c5dd7b3cf81e3f0773c0440912c8ac31ef6d4534cb2f60e24bb12cf27cac8f8b57e7e2a47e9501ea154012f7ca2729d4fb3266f8ea484670adc5438633c14315b43ed1f1164a979b966ebcbfde199ccbf6050b65ce96"}, {0xa8, 0x10c, 0x1c24, "c244427ab94756f7e0cee6f140aab7f723c29348213e31b10c18112a01c73d21f2a0fa458d6f052bccbd2766f5efe10d6ece8cbad1d481fcec5033818227dd5f5b236ec329e798f85f9b869497e31a3fcfaff5684a37bad47579cdd30390d1fc3a5321822fbd47191b436797017c1d37664297cb9fa1bf11de8c264cb6986b1eb4017b95852a032e16980c7093b0930a9e"}, {0x38, 0x107, 0x7, "5421e2ece3974973c52a021e9d91a11c39763bb6767c8cf2724a30c586758255599755a5c9cc8c"}, {0x38, 0x107, 0x3, "1a0ed10fef39ba628ff4378220c2e161ce05301597c8710484d1ffde74e2c4a2ad"}, {0xc0, 0x10c, 0x0, "a00fcdddf92c603c3aa32d06525ad1593eee85a8181c64f03b718627ad3dd392aafeac169c6bfcf9d09a3a47f068ae1ad815a95e2b17cb4ff2d292046bb92998942d532b0ac8935cf830ba7fefe37c221f49888a8eaada7609e0b212b471baea2ec9a828fb1f51259c61fe9dd0d930f05af2eb1db151df90a4df0e73a770ef8d414bca8739afa44f9558d4430a640442c06e21faad85fc3fee20b13825bf793f713330ef8e0ce5073e"}], 0x2f8}}, {{&(0x7f0000002040)=@xdp={0x2c, 0x2, r5, 0x18}, 0x80, &(0x7f0000002380)=[{&(0x7f00000020c0)="8a1fa30f5dd333a2a3a05df78c4c8e", 0xf}, {&(0x7f0000002100)="c9bbc831772508889cf8b148", 0xc}, {&(0x7f0000002140)="74b24db8d723f39b599b8cbb87088980297852b4816ae2c2a52bcb714d40bd4b3f612c6c9a8578b87f4c4e06cd7add90fac1e2853d5c9b68bf359eb9d3d2a7480263e641170ae80c33efe2db1c2b5e9cfc08e299896e297228", 0x59}, {&(0x7f00000021c0)="30f84a31152e61f2a56e77b6ce4be6ac7d4aef9b053b9cbb4c5a6b5a0b689ab914bbe9d3b21775e72fa920dc028a3c096c1cede4ef73d1319f249be2ac9cbc4a68b1c0771abd121d2212a5188c60f092f3efa3218be458625ce3db20bdb8d8daf7c8c8d3a84bb5b7337306bfadd3048a6e2fd6d917f8c5071e000567424819f95b1129495cf80f8adfa89f94ef2fe6d1484ddfa8f53e5811d868b8cda6cf749098bd212ae116689a92d05bf5465f85ddd9", 0xb1}, {&(0x7f0000002280)="455749972b9d4ef5b9f72c2ed7c07ec536a0f5dea6f3b512872ca14ec7a6d812f0092eb967d6abc54c89439f02ef95eb610ab11c40a0eb8fa04256609a34a0ac7918fbaeb31b8eb90c1263c4a0bfd999f6924a45088ccf4b2cd119167f0ef276925268051facc0d2882889d53225620c00f6770e417407a92d9d1398652b5754cfabe70f22769a898a1c6352b3ca4704af3e65a4c4a490550c4530e99e94bb880a76b643d8a1028894af7f3a1b7e7e4dfb01ee38156e984cdaa8e6a28320c3e724cee716b6d044e0ef9e2ef6768be128b9a89d", 0xd3}], 0x5}}], 0x2, 0x41) recvmmsg(r3, &(0x7f00000000c0)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f0000000880)=""/4096, 0x1000}, 0x7}, {{0x0, 0x0, 0x0, 0x0, &(0x7f0000001880)=""/119, 0x77}, 0xff}, {{0x0, 0x0, 0x0, 0x0, &(0x7f0000001900)=""/255, 0xff}, 0x80}, {{0x0, 0x0, 0x0, 0x0, &(0x7f0000001a00)=""/201, 0xc9}, 0x2}, {{0x0, 0x0, 0x0, 0x0, &(0x7f0000001b00)=""/32, 0xffffffd7}}, {{0x0, 0x0, 0x0, 0x0, &(0x7f0000001b40)=""/144, 0x90}, 0x8000}], 0x4000000000002ba, 0x40000002, 0x0) bpf$MAP_CREATE(0x0, &(0x7f0000001c00)=@base={0x9, 0x3, 0x4, 0xfe, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0}, 0x50) r6 = socket$kcm(0x29, 0x6, 0x0) sendmsg$kcm(r6, &(0x7f0000002880)={0x0, 0x0, &(0x7f0000002600)=[{&(0x7f0000000440)="987df46feba756a5ff3e6e7ee8d2de9924d31acc4ea277d731f7b6006601ec0a794b234416902d7c3da1b51cd2e29365a8742c98f39eb68b8e145ec7d0d3d2a6b6e85598ceebcc2a3f02124947cbafea4e7577f84366573c5a31d8bebe028b9864401fd62e574f0fb55ccee37cb56adddcc7decc57e66b0c745ab8b6edff1a0a83cd786df87f7d1167440d92d8ef12ee16b9cd13f761e1e8c5d1b76b685bb15058d1d37a5cfd850b19848998bd3a9280c9a3b57562fb5d6cf376ff99b617c0d6ad466a2ca89b13636fd09c8ad93dc9b1745512131b", 0xd5}, {&(0x7f0000000540)="5a659601c9b07b033b3f6489c4e34495648648fd97885c9d314b311fc03770895bf478c5a088e65cd8712d89e36e1287fbfb6c230072c9723cdbc60d6947b980ef5c377e09c87a7e2d1403009d97f0567f26360f113e69a5d8201a97d4ae4d4fa71eb81db664b3ee5aefd3b276cd3b2e5fd36ca85ffc70209c6fdf82c6a6ac4bef76a207", 0x84}, {&(0x7f0000000680)="64fcd6a118460a0d2f4f4a3a067726d9365eb1c963763147e4fb17677f00bc55566c7c09342cf21b0bb9ee72b364a01aa9c48fe0dc31993e56ab5ed757d7e07be239438be72a766fd45f57241f7188087222e0fa5d4f8e22e7171a7a01a6ffae992af641c80ec727b5c1c322e6a9d98d5a603863ce7f5c655a671f0e022f9de15a06809a42fcb987d20d64dc4d44a2527e8cd0efe4c4e061c2e360883735adf7f5ea0cf417c24458347180c260dc56592a3dc8105c8059f9f3b0b4a309c815", 0xbf}, {&(0x7f0000002480)="93ab50722d2a0459dd07c5e667eb2d81c646f35490daecba245b6288d350f71d1f065b3f9537987cb7070d900c7e7749df48d39427ef1ea2bdccc071ccd1099e90dfcb291c4bac895df58ad90687e43716a3efbbbee23e27054aa1076331538281f6dff3a3ae8486b03339629321fecb9914fdd3e37ea92018b643863747d1911927afc7fec37e59bda71e2286caca57b03bce4d82b2c9053715e322fc216db242b729b59f9ed844e6fdf7b611dc8b6108c298ae79d49c0f7a790fe6c3e31028d8a55c4dfc6ecd9f75b1e6f1428bf813d49491a3dea24ca4c5d045a9f6f2aa4f604a4be149eb7b46", 0xe8}, {&(0x7f0000002580)="71c72ec0989f8256131fb04baa701a79779d2d0671a7f5b8f793bd69c44d3f7d4791c778c6faa7c64389b2856af0ded175626b276de6500bd698263f730321f3ebe4718243", 0x45}], 0x5, &(0x7f0000002680)=[{0x88, 0x118, 0x7, "6956e877682b41a7aeea1a0ee0cd333a3e0ee4659e4812e29d3a08c1dcfe525384b4f83a164187ac1461655d145cdf710809739c18cb8e40f255a33ecdea9d15827ced9f4b8aca0e11dd7c8cc1153ff757e441709bed557449b3f4fbc5cf0ce2eac7a1f8c982d95bb10114403e8d0afc32801f7ca52d5a"}, {0x80, 0x10d, 0x1fb, "3def8ac9858e8a812edeb0006ca89f09b4d6f58c53192b76cc88c76d24c53b9ebbbe0713b201a4c8e441ceb168158b4abe9ada04310395c06e9f45206158b7d968901e3ad5720ecc57c35205f88d3ed57674145dee2589d34f6f1b28ebcef8613da480ca5bc0e9463e23"}, {0xf8, 0x1c6, 0xffff, "9012505558feeea1a61ff8d3e8853b9b5f9fbd18a9e337ab26a290b611763de6f7181086c2663e80067b3f2e6bd16198cf86c0bf9c302f6926287af85861c5d96f0dab4b5ef71b8ccc5b3573dfb2b92db39a494c32e11100f674203cc40aa021d311e9859ed693c621dd44e88440bb99d9075fe146f13b4fb501155b98d008810a4924e4c891d50a34e21c6810d20873a5a641c4b515f8d1fec1c7b87cd5b90bacd7d295ef0e91377b76766c0941badcb839baab073eef1e1b574273733a79dd75e993b825b121acc3607a72160af2d7e4ec88dc3d8736152066e331c471822a8d9a3bba"}], 0x200}, 0x850) sendmsg$NFT_BATCH(r0, &(0x7f0000000600)={0x0, 0x0, &(0x7f0000000640)={&(0x7f0000000680)=ANY=[], 0x74}, 0x1, 0x0, 0x0, 0x4000850}, 0x40) 2.276475699s ago: executing program 3 (id=3837): bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000080)={0x3, 0x3, &(0x7f0000000140)=@raw=[@initr0={0x18, 0x0, 0x0, 0x0, 0xfffff000, 0x0, 0x0, 0x0, 0x2}, @btf_id={0x18, 0xb, 0x3, 0x0, 0x3}], &(0x7f0000000180)='GPL\x00', 0xa, 0x0, 0x0, 0x0, 0x9}, 0x94) r0 = socket$kcm(0x10, 0x2, 0x0) ioctl$sock_SIOCETHTOOL(r0, 0x89f1, &(0x7f0000000040)={'tunl0\x00', &(0x7f00000004c0)=@ethtool_cmd={0x4c, 0x8, 0x0, 0x400, 0x0, 0x0, 0xe7, 0x0, 0x87, 0x0, 0x1000, 0x0, 0xfffd, 0x8, 0x0, 0x82000045, [0x2, 0x89ff]}}) 2.15592614s ago: executing program 3 (id=3839): openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x612140, 0x0) ioctl$FIGETBSZ(0xffffffffffffffff, 0x2, 0x0) r0 = bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="0200000004000000080000000c"], 0x50) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000100)={0x11, 0xd, &(0x7f00000001c0)=@framed={{}, [@call={0x85, 0x0, 0x0, 0x5}, @ringbuf_output={{0x18, 0x1, 0x1, 0x0, r0}, {}, {}, {}, {}, {}, {}, {0x85, 0x0, 0x0, 0x3}}]}, &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0xd, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$PROG_BIND_MAP(0xa, &(0x7f0000000280)={r1, r0}, 0xc) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r2 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$IP_VS_SO_SET_ADDDEST(r2, 0x0, 0x487, &(0x7f0000000040)={{0x84, @dev={0xac, 0x14, 0x14, 0x35}, 0x4e24, 0x3, 'lc\x00', 0x25, 0x9a9, 0x46}, {@loopback, 0x4e23, 0x12000, 0xfffffffa, 0x9, 0x93}}, 0x44) r3 = bpf$PROG_LOAD(0x5, &(0x7f0000000500)={0x1, 0x4, &(0x7f0000000700)=@framed={{0x18, 0x0, 0x0, 0x0, 0x7ff, 0x0, 0x0, 0x0, 0x200}, [@generic={0x81, 0x1, 0x1, 0x63}]}, &(0x7f0000000c40)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x8eceb2e30985c02b, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffd}, 0x94) ioctl$FS_IOC_FIEMAP(r3, 0xc020660b, &(0x7f00000002c0)={0x2, 0x3, 0x2, 0x6, 0x5, 0x0, [{0x7, 0x99, 0x85a, '\x00', 0x4}, {0x7, 0x0, 0x8001, '\x00', 0x18c}, {0xffffffff80000000, 0xffffffffffffffff, 0x3, '\x00', 0x1}, {0x3, 0x7ff, 0x10000, '\x00', 0x3e80}, {0x10000, 0x1680000000, 0x23c, '\x00', 0x4}]}) 2.04165721s ago: executing program 4 (id=3840): socketpair(0x1e, 0x80005, 0x0, &(0x7f0000000000)={0x0, 0x0}) syz_genetlink_get_family_id$mptcp(&(0x7f00000000c0), r1) recvmmsg(r1, &(0x7f0000006100)=[{{0x0, 0x0, &(0x7f0000000540)=[{&(0x7f0000000200)=""/98, 0x62}], 0x1, &(0x7f0000001640)=""/106, 0x6a}, 0x100}], 0x40000000000008f, 0x12300, 0x0) r2 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r2, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000100)={0x58, 0x41, 0x1, 0x0, 0x0, {0x3, 0x1}, [@generic="000000002600010000112233445566778899aabb88a845000014aa00000001170000010203040506070800000c00020006002000080000000c0003000800", @nested={0x1, 0x12e}]}, 0x58}, 0x1, 0x0, 0x0, 0x4800}, 0x4000000) close(r0) 2.040897539s ago: executing program 1 (id=3841): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) pipe(&(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) splice(r0, 0x0, r1, 0x0, 0xf3a, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000240)={0x18, 0x5, &(0x7f0000000300)=ANY=[@ANYBLOB="1801000021"], 0x0, 0x40, 0x0, 0x0, 0x0, 0xb4a02fe0ce239f93, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x5, @value=r1}, 0x94) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000340)=@bpf_ext={0x1c, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x41100, 0x50, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x1313f, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x10, 0x3}, 0x94) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000100), 0xffffffffffffffff) sendmsg$NL80211_CMD_GET_SURVEY(r2, &(0x7f0000000140)={&(0x7f0000000400)={0x10, 0x0, 0x0, 0x10010000}, 0xc, &(0x7f0000000440)={&(0x7f0000000480)={0x20, r3, 0x2, 0x70bd28, 0x25dfdbfe, {{}, {@void, @val={0xc, 0x99, {0x81, 0x37}}}}, [""]}, 0x20}}, 0x20044010) r4 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r4, &(0x7f00000004c0)={0x0, 0x0, &(0x7f0000000500)={&(0x7f0000000540)=@newlink={0x58, 0x10, 0xffffffffffffffff, 0x70bd27, 0x25dfdbfe, {0x0, 0x0, 0x0, 0x0, 0xc15}, [@IFLA_LINKINFO={0x2c, 0x12, 0x0, 0x1, @ip6gretap={{0xe}, {0xffffffffffffff4c, 0x2, 0x0, 0x1, [@IFLA_GRE_REMOTE={0x14, 0x7, @private1={0xfc, 0x1, '\x00', 0x1}}]}}}, @IFLA_ADDRESS={0xa, 0x1, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x16}}]}, 0x58}, 0x1, 0x0, 0x0, 0x28001}, 0x8000) r5 = socket$unix(0x1, 0x2, 0x0) bind$unix(r5, &(0x7f00000005c0)=@file={0x1, '\xe9\x1fq\x89Y\x1e\x923aK\x00'}, 0x6e) r6 = socket$unix(0x1, 0x2, 0x0) connect$unix(r6, &(0x7f0000000640)=@file={0x1, '\xe9\x1fq\x89Y\x1e\x923aK\x00'}, 0x6e) sendmmsg(r6, &(0x7f00000006c0), 0x307017fdb7a66cb, 0x0) connect$unix(0xffffffffffffffff, &(0x7f0000000700)=@file={0x1, '\xe9\x1fq\x89Y\x1e\x923aK\x00'}, 0x6e) ppoll(&(0x7f0000000780)=[{r6, 0x3328}, {0xffffffffffffffff, 0x4236}], 0x2, 0x0, 0x0, 0x0) unshare(0x22020400) close(r5) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000007c0)={0xffffffffffffffff}) recvmsg(r6, &(0x7f0000000800)={0x0, 0x0, 0x0}, 0x100) recvmmsg(r7, &(0x7f0000000840), 0x10106, 0x2, 0x0) bind$alg(0xffffffffffffffff, &(0x7f0000000880)={0x26, 'hash\x00', 0x0, 0x0, 'sha512\x00'}, 0x58) r8 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r8, &(0x7f0000000900)={0x0, 0x0, &(0x7f0000000940)={&(0x7f0000000980)={0x14, 0x16, 0x707, 0xfffffffc, 0x25dfdbfc, {0x4, 0x7c}}, 0x14}, 0x1, 0x0, 0x0, 0x488c0}, 0xc000) setsockopt$MRT_INIT(0xffffffffffffffff, 0x0, 0xc8, &(0x7f00000009c0), 0x4) setsockopt$MRT_ADD_MFC_PROXY(0xffffffffffffffff, 0x0, 0xd2, &(0x7f0000000a00)={@initdev={0xac, 0x1e, 0x0, 0x0}, @multicast1, 0x0, "614a63abd0f993af802179cd01e03d64a831683fdc3fd44082ff82ae00", 0x7}, 0x3c) setsockopt$MRT_FLUSH(0xffffffffffffffff, 0x0, 0xd4, &(0x7f0000000a40)=0x2, 0x4) setsockopt(0xffffffffffffffff, 0x0, 0x485, &(0x7f0000000a80)="060000007f00000102000000000000006d6800000000000000000000000000000000000000000000000000007f00"/68, 0x44) close(0xffffffffffffffff) 2.032123932s ago: executing program 3 (id=3843): bpf$PROG_LOAD_XDP(0x5, &(0x7f00000006c0)={0x6, 0x3, &(0x7f0000000680)=ANY=[@ANYBLOB="1800000002000000000000000000000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x55}, 0x94) r0 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000000c00)=@filter={'filter\x00', 0xe, 0x4, 0x368, 0xffffffff, 0xf8, 0x0, 0x0, 0xffffffff, 0xffffffff, 0x2b0, 0x2b0, 0x2b0, 0xffffffff, 0x4, 0x0, {[{{@uncond, 0x0, 0xd0, 0xf8, 0x0, {}, [@common=@ipv6header={{}, {0x9, 0xc1, 0x1}}]}, @common=@unspec=@STANDARD={0x28, '\x00', 0x0, 0x1c8}}, {{@uncond, 0x0, 0xa8, 0xd0}, @common=@unspec=@AUDIT}, {{@uncond, 0x0, 0xa8, 0xd0}, @common=@inet=@LOG={0x0, 'LOG\x00', 0x0, {0xf7, 0x0, "d100975bb89532d2d5cb43525b50e520cda9cd2249f70741246d1fe722b1"}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0xfffffffffffffdab, '\x00', 0x0, 0xffffffff}}}}, 0xff12) socket$kcm(0x10, 0x2, 0x0) unshare(0x8040480) r1 = bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="0e00000004000000080000000b"], 0x50) r2 = bpf$PROG_LOAD(0x5, &(0x7f0000001100)={0x6, 0xb, &(0x7f00000002c0)=ANY=[@ANYBLOB="18000000000000000000000000000000180100002020782500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000005000000b7030000fcffffff850000007300000095"], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, @fallback=0x21, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000100)={{r1}, &(0x7f0000000380), &(0x7f00000000c0)=r2}, 0x20) write$cgroup_subtree(0xffffffffffffffff, &(0x7f0000000000)=ANY=[@ANYBLOB="8fedcb010789005e107538e486dd6317ce22000000fffe80000000000000101000007f0600080000000000000071273fa7b49301641184"], 0xfdef) r3 = bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000480)={0x6, 0x3, &(0x7f0000000680)=ANY=[], &(0x7f0000000200)='syzkaller\x00'}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000600)={r3, 0x5, 0xb68, 0x0, &(0x7f0000000000)='%', 0x0, 0xd01, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x1100}, 0x48) pipe(&(0x7f0000000580)={0xffffffffffffffff, 0xffffffffffffffff}) r6 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000240)='memory.swap.events\x00', 0x275a, 0x0) splice(r4, 0x0, 0xffffffffffffffff, 0x0, 0x7fff, 0x0) sendfile(r5, r6, 0x0, 0x0) r7 = socket$nl_generic(0x10, 0x3, 0x10) getsockopt$sock_cred(r7, 0x1, 0x11, &(0x7f0000000e80)={0x0, 0x0}, &(0x7f0000000ec0)=0xc) r9 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r9, &(0x7f0000001600)={0x0, 0x0, &(0x7f00000015c0)={&(0x7f0000001580)=ANY=[@ANYBLOB="2400000645350d0027bd7000fbdbdf250a3f20ab0202c8050070000008001900", @ANYRES32=r8, @ANYBLOB], 0x24}, 0x1, 0x0, 0x0, 0x4048005}, 0x10) ioctl$NS_GET_OWNER_UID(r4, 0xb704, &(0x7f00000003c0)) getgid() getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f0000000140), &(0x7f00000001c0)=0xc) setsockopt$EBT_SO_SET_ENTRIES(0xffffffffffffffff, 0x0, 0x80, 0x0, 0x698) openat$ppp(0xffffffffffffff9c, 0x0, 0xc0802, 0x0) r10 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r10, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000200)=ANY=[@ANYBLOB="600000000206010800000000000000000000000005000400000000000900020073797a31000000001400078008001240000000000500140008000000050005000a000000050001000600000011000300686173683a69702c706f7274"], 0x60}}, 0x24000800) r11 = socket$nl_netfilter(0x10, 0x3, 0xc) accept4(0xffffffffffffffff, 0x0, 0x0, 0x80800) sendmsg$IPSET_CMD_ADD(r11, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000c80)=ANY=[@ANYBLOB="5c000000090601080000000000000000070000000900020073797a31000000000500010007000000340007801800018014000240fe8000000000000000000000000000bb060004400e1f00cd050007008800000006000540"], 0x5c}, 0x1, 0x0, 0x0, 0x10000042}, 0x90) sendmsg$IPSET_CMD_DESTROY(r10, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000340)=ANY=[@ANYBLOB="4000000003060300000000000000000001000007090002fc73797a3100000000050001000703"], 0x40}, 0x1, 0x0, 0x0, 0x10}, 0x28880) 1.910542648s ago: executing program 2 (id=3844): r0 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f0000000000)={0x1b, 0x0, 0x0, 0x40000, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0}, 0x48) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000800)={0x6, 0xd, &(0x7f0000000200)=@framed={{0x18, 0x2, 0x0, 0x0, 0xfffffffb}, [@call={0x85, 0x0, 0x0, 0x17}, @ringbuf_output={{0x18, 0x1, 0x1, 0x0, r0}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0xf}}]}, &(0x7f0000000900)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback=0x1, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$ethtool(&(0x7f00000000c0), 0xffffffffffffffff) getsockopt$PNPIPE_IFINDEX(0xffffffffffffffff, 0x113, 0x2, &(0x7f0000000100)=0x0, &(0x7f0000000140)=0x4) getsockopt$inet_mreqn(0xffffffffffffffff, 0x0, 0x20, &(0x7f0000000180)={@remote, @empty, 0x0}, &(0x7f00000001c0)=0xc) r6 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r6, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000380)={&(0x7f00000003c0)=ANY=[@ANYBLOB="5800000010000d000000000000e15bb69b000000", @ANYRES32=0x0, @ANYBLOB="0000000008000000240012800c0001006d6163766c616e001400028008000100040000000800030000000000140035006d6163766c616e300000000000000000"], 0x58}}, 0x8000) getsockopt$PNPIPE_IFINDEX(0xffffffffffffffff, 0x113, 0x2, &(0x7f0000000280)=0x0, &(0x7f00000002c0)=0x4) r8 = socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_UMEM_REG(r8, 0x11b, 0x4, &(0x7f0000000300)={&(0x7f0000000a00)=""/8153, 0x113000, 0x800, 0xfff}, 0x20) setsockopt$XDP_TX_RING(r8, 0x11b, 0x3, &(0x7f0000002a00)=0x10, 0x4) setsockopt$XDP_UMEM_COMPLETION_RING(r8, 0x11b, 0x6, &(0x7f0000002a40)=0x10, 0x4) setsockopt$XDP_UMEM_FILL_RING(r8, 0x11b, 0x5, &(0x7f0000002a80)=0x10, 0x4) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000002ac0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$sock_SIOCGIFINDEX(r9, 0x8933, &(0x7f0000002b00)={'lo\x00', 0x0}) bind$xdp(r8, &(0x7f0000002b40)={0x2c, 0x1, r10}, 0x10) bpf$PROG_LOAD(0x5, &(0x7f0000002b80)={0x6, 0xf, 0x0, &(0x7f0000002c40)='GPL\x00', 0x0, 0x0, 0x0, 0x41100, 0x64, '\x00', r10, @xdp, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(r0, 0x89f1, &(0x7f00000005c0)={'syztnl1\x00', &(0x7f0000000540)={'syztnl2\x00', r4, 0x1, 0x8000, 0x1, 0x7, {{0x14, 0x4, 0x2, 0x0, 0x50, 0x67, 0x0, 0x81, 0x4, 0x0, @private=0xa010100, @broadcast, {[@ra={0x94, 0x4}, @timestamp_addr={0x44, 0x34, 0x8b, 0x1, 0x7, [{@initdev={0xac, 0x1e, 0x0, 0x0}, 0x7}, {@broadcast}, {@local, 0x7}, {@local, 0xa0f3}, {@dev={0xac, 0x14, 0x14, 0x3a}, 0x6ef12e03}, {@remote, 0x40}]}, @end]}}}}}) ioctl$sock_ipv6_tunnel_SIOCCHGTUNNEL(0xffffffffffffffff, 0x89f3, &(0x7f0000002d00)={'ip6tnl0\x00', &(0x7f0000002c80)={'ip6gre0\x00', 0x0, 0x2f, 0xfe, 0x30, 0xe8, 0x2, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02', @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01', 0x7800, 0x40, 0x1, 0x2aeb}}) sendmsg$ETHTOOL_MSG_PAUSE_GET(r2, &(0x7f0000002f00)={&(0x7f0000000080), 0xc, &(0x7f0000002ec0)={&(0x7f0000000600)=ANY=[@ANYBLOB="50010000", @ANYRES16=r3, @ANYBLOB="010025ad7000ffdbdf2515000000200001808788b66895b2bce3bbc60d14fff90064766d7270310000000000000000000008000100", @ANYRES32=r4, @ANYBLOB="2000018008000300030000001400020064766d727030000000000000000000005c0001800800030000000000080003000000000008000300000000000800030003000000080003000200000014000200726f7365300000000000000000000000140002006e723000000000000000000000000000080003000100000034000180140002006272696467655f736c6176655f3000000800030003000000140002006d6163736563300000000000000000006c0001800800030000000000080003000100000008000100", @ANYRES32=r5, @ANYBLOB="08000100", @ANYRES32=r7, @ANYBLOB="0800030001000000140002006261746164765f736c6176655f30000008000100", @ANYRES32=r10, @ANYBLOB="080003000200000014000200776c616e31000000000000000000000008000100", @ANYRES32=r11, @ANYBLOB], 0x150}, 0x1, 0x0, 0x0, 0x4004011}, 0x4080) r12 = socket$inet(0xa, 0x801, 0x84) socket$netlink(0x10, 0x3, 0xf) listen(r12, 0x8) setsockopt$inet_sctp_SCTP_SOCKOPT_CONNECTX(r12, 0x84, 0x6e, &(0x7f0000000440)=[@in={0x2, 0x4e22, @remote}], 0x10) setsockopt$IP_VS_SO_SET_DEL(r12, 0x0, 0x484, &(0x7f0000000480)={0x6, @loopback, 0x4e21, 0x2, 'rr\x00', 0x4, 0x76, 0x62}, 0x2c) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000940)={r1, 0x0, 0xe, 0x0, &(0x7f00000009c0)="ffd9035e71d0284ad32a5f49f175", 0x0, 0x1008, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x9}, 0x50) r13 = socket$unix(0x1, 0x1, 0x0) ioctl$BTRFS_IOC_RESIZE(r12, 0x50009403, &(0x7f0000000500)={{r13}, {@void, @actul_num={@val=0x2d, 0x5, 0x6d}}}) connect$can_bcm(0xffffffffffffffff, &(0x7f00000004c0)={0x1d, r4}, 0x10) 1.836655591s ago: executing program 4 (id=3845): r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000080)=ANY=[@ANYBLOB="c40000001900674c2cbd70000000000000000000000000000000000000000000ac1eff0100000000000000000000000000000000000000000a00000000000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="0100000000000000000000000000000000000020000000000000000000000000000000000000000000008000000000000000000000000000fcffffffffffffff0000000000000000b0ac00000000000000000000000000000000000000000000000400000000000000000002000000000a00100001"], 0xc4}}, 0x4c050) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000140), 0x202c00, 0x0) sendmsg$nl_xfrm(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000700)=@newpolicy={0x128, 0x13, 0x101, 0xfffffffd, 0x0, {{@in=@multicast1, @in6=@empty, 0x100, 0xb, 0x400, 0x9, 0xa}, {0x2, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x4, 0x0, 0x8}, {0x2, 0x1, 0x400000000000, 0x100}, 0xfffffffe}, [@tmpl={0x44, 0x5, [{{@in=@dev={0xac, 0x14, 0x14, 0xa}, 0x4d4, 0x2b}, 0xa, @in=@multicast1, 0x8, 0x2, 0x0, 0x3, 0xfffffff9, 0x10400, 0xd9}]}, @user_kmaddress={0x2c, 0x13, {@in6=@empty, @in6=@remote, 0x0, 0xa}}]}, 0x128}, 0x1, 0x0, 0x0, 0x20048080}, 0x10) openat$tun(0xffffffffffffff9c, &(0x7f0000000200), 0x0, 0x0) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000340)='memory.events\x00', 0x275a, 0x0) write$cgroup_subtree(r2, &(0x7f0000000380)={[{0x2b, 'rlimit'}, {0x2d, 'net_cls'}, {0x2b, 'memory'}, {0x2b, 'hugetlb'}, {0x2b, 'cpu'}, {0x2d, 'net'}, {0x2b, 'pids'}, {0x2d, 'net'}, {0x2d, 'cpu'}]}, 0x3c) write$cgroup_subtree(r2, &(0x7f0000000480)=ANY=[], 0x32600) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x2000001, 0x12, r2, 0x0) syz_open_procfs$namespace(0x0, &(0x7f00000004c0)='ns/ipc\x00') ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000640)={'syzkaller1\x00', 0xc201}) r3 = socket$kcm(0x2, 0xa, 0x2) ioctl$SIOCSIFHWADDR(r3, 0x8914, &(0x7f0000000680)={'syzkaller1\x00', @link_local}) write$tun(r1, &(0x7f00000006c0)=ANY=[@ANYBLOB="034886dd010000000000140000006000000003082f00fe88a43de1a400000000000000007d01ff020000000000000000000000000001"], 0xfdef) r4 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="0600000004000000990000000d"], 0x50) r5 = bpf$PROG_LOAD(0x5, &(0x7f00000003c0)={0x11, 0x14, &(0x7f0000000280)=ANY=[@ANYBLOB="180000000000000000000000000000001801000020646c2100000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000000600000018110000", @ANYRES32=r4, @ANYBLOB="0000000000000000b708000000000000738af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b70400000000000085000000c300000095"], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1}, 0x94) bpf$PROG_BIND_MAP(0xa, &(0x7f0000000500)={r5}, 0xc) 1.681715499s ago: executing program 3 (id=3846): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000280), 0x48241, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f00000002c0)={'syzkaller1\x00', 0x6bf1c2d5adba8c32}) r1 = socket$kcm(0x2, 0xa, 0x2) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket$unix(0x1, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000900)={'team_slave_0\x00'}) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000300)={'syzkaller1\x00', 0x0}) sendmsg$nl_route_sched(r2, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000380)={&(0x7f00000003c0)=@newqdisc={0x30, 0x24, 0x601, 0x0, 0x0, {0x0, 0x0, 0x0, r4, {0x0, 0xfff3}, {0xfff1, 0xffff}}, [@qdisc_kind_options=@q_ingress={0xc}]}, 0x30}}, 0x0) sendmsg$nl_route_sched(r2, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000000440)={&(0x7f0000000480)=@newtfilter={0x44, 0x2c, 0x601, 0x0, 0x0, {0x0, 0x0, 0x0, r4, {0xb, 0x7}, {0xfff2, 0xffff}, {0x300}}, [@filter_kind_options=@f_flow={{0x9}, {0x14, 0x2, [@TCA_FLOW_MODE={0x8, 0x2, 0x1}, @TCA_FLOW_KEYS={0x8, 0x1, 0x5b7b}]}}]}, 0x44}}, 0x4044004) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000000500)={'syzkaller1\x00', @link_local}) write$tun(r0, &(0x7f0000000540)={@val={0x0, 0x88f5}, @void, @eth={@link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x3}, @multicast, @val={@val, {0x8100, 0x0, 0x0, 0x22}}, {@x25={0x805, {0x1, 0xdf, 0xb}}}}}, 0x1d) mmap(&(0x7f0000001000/0xc00000)=nil, 0xc00000, 0x200000c, 0x3032, 0xffffffffffffffff, 0x0) r5 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_int(r5, 0x107, 0xf, &(0x7f0000000580)=0x80000001, 0x4) setsockopt$packet_fanout(r5, 0x107, 0x12, &(0x7f00000005c0)={0x4, 0x3}, 0x4) r6 = bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000600)={0x6, 0x3, &(0x7f00000006c0)=ANY=[@ANYBLOB="1800000002000000000000000000000095"], &(0x7f0000000700)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x21}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000740)={r6, 0x5, 0xb68, 0x560b0000, &(0x7f00000007c0)="259a53f271a76d2673004c6588a8", 0x0, 0xd01, 0x2a0, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x48) r7 = socket$igmp(0x2, 0x3, 0x2) setsockopt$MRT_TABLE(r7, 0x0, 0xcf, &(0x7f00000008c0)=0x1, 0x4) recvmmsg(r5, &(0x7f0000000800)=[{{0x0, 0x0, 0x0}, 0x1}], 0x1, 0x0, 0x0) ioctl$XFS_IOC_FD_TO_HANDLE(0xffffffffffffffff, 0xc038586a, &(0x7f0000000100)={0xffffffffffffffff, &(0x7f0000000000)='\xee\xff', 0x40, &(0x7f0000000040)={@_ha_fsid={[0x5, 0x5]}, {0x2, 0x4, 0x612, 0x9}}, 0xb, &(0x7f0000000080)={@_ha_fsid}, &(0x7f00000000c0)=0x6}) sendmsg$NL80211_CMD_JOIN_OCB(r8, &(0x7f0000000240)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x20}, 0xc, &(0x7f0000000200)={&(0x7f0000000180)=ANY=[@ANYBLOB="fe000000", @ANYRES16=0x0, @ANYBLOB="000227bd7000fedbdf256c0000000c009900000000001d00000008009f00000000000800a100ff07000005001901090000000800270001000000050018010f0000000800220184000000080026006c090000050019010d000000"], 0x60}, 0x1, 0x0, 0x0, 0x800}, 0x24000800) getsockopt$inet_sctp6_SCTP_AUTOCLOSE(r0, 0x84, 0x4, &(0x7f0000000840), &(0x7f0000000880)=0x4) 1.574667315s ago: executing program 0 (id=3847): r0 = socket$kcm(0x2b, 0x1, 0x0) sendmsg$inet(r0, &(0x7f0000000000)={&(0x7f0000000080)={0x2, 0x4001, @dev={0xac, 0x14, 0x14, 0x32}}, 0x10, 0x0, 0x0, 0x0, 0x0, 0x300}, 0x200048cc) (async) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) listen(r1, 0x0) r2 = socket$inet6_mptcp(0xa, 0x1, 0x106) listen(r2, 0xfffffffc) r3 = socket$netlink(0x10, 0x3, 0x8000000004) (async) r4 = socket$inet6_mptcp(0xa, 0x1, 0x106) listen(r4, 0x7d4165c9) (async) r5 = socket$inet6_tcp(0xa, 0x1, 0x0) listen(r5, 0x0) (async) r6 = socket$inet6_tcp(0xa, 0x1, 0x0) (async) r7 = socket$inet6_mptcp(0xa, 0x1, 0x106) listen(r7, 0x7d4165c9) (async) listen(r6, 0x0) listen(0xffffffffffffffff, 0x0) (async) writev(r3, &(0x7f0000000100)=[{&(0x7f0000000140)="580000001400192340834b80040d8c560a067f0200ff000000000000000058000b4824ca945f64009400ff0325010ebc000000000000008000f0fffeffe809005300fff5dd000000100001000a0c100000000000000fff00", 0x58}], 0x1) (async) syz_genetlink_get_family_id$nl80211(&(0x7f00000001c0), r3) (async) r8 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_ipv6_tunnel_SIOCADD6RD(r8, 0x89f9, &(0x7f00000000c0)={'sit0\x00', &(0x7f0000000040)={@mcast2, @loopback, 0x2, 0x14}}) (async) close(r0) 1.516152077s ago: executing program 4 (id=3848): r0 = socket$netlink(0x10, 0x3, 0x0) setsockopt$netlink_NETLINK_ADD_MEMBERSHIP(r0, 0x10e, 0xb, &(0x7f00000001c0)=0x15, 0x4) sendmsg$netlink(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000280)=[{&(0x7f00000002c0)=ANY=[@ANYBLOB="280000002600230700000000000000001800a9801400418008000e8004007f8008000580040001"], 0x28}], 0x1, 0x0, 0x0, 0x24008015}, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) (async) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_TIMEOUT_NEW(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000180)=ANY=[@ANYBLOB="3c0000000008010400000000000000000100000a05000300010000000c00048008000140000000060600024000600000090001007300003100000000"], 0x3c}, 0x1, 0x0, 0x0, 0x4000080}, 0x40000) r2 = socket$nl_route(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000340)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$sock_SIOCGIFINDEX_80211(r3, 0x8933, &(0x7f0000000380)={'wlan1\x00'}) r4 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x2, 0x0) socket$nl_generic(0x10, 0x3, 0x10) (async) r5 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r5, &(0x7f0000000680)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f0000000700)=ANY=[@ANYBLOB="4800000040000701fcffffff00000100017c0000040042800c00018006000600800a00002400028020001480080007"], 0x48}, 0x1, 0x0, 0x0, 0x4048011}, 0xc000) (async) sendmsg$nl_generic(r5, &(0x7f0000000680)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f0000000700)=ANY=[@ANYBLOB="4800000040000701fcffffff00000100017c0000040042800c00018006000600800a00002400028020001480080007"], 0x48}, 0x1, 0x0, 0x0, 0x4048011}, 0xc000) ioctl$TUNSETIFF(r4, 0x400454ca, &(0x7f0000000040)={'syzkaller1\x00', 0x1}) socket$unix(0x1, 0x3, 0x0) (async) r6 = socket$unix(0x1, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r6, 0x8933, &(0x7f0000000100)={'syzkaller1\x00'}) (async) ioctl$sock_SIOCGIFINDEX(r6, 0x8933, &(0x7f0000000100)={'syzkaller1\x00', 0x0}) sendmsg$nl_route_sched(r2, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000000c0)=@delqdisc={0x24, 0x25, 0x400, 0x70bd25, 0x25dfdbfe, {0x0, 0x0, 0x0, r7, {0x9, 0xffff}, {0xc, 0xfff1}, {0xb}}}, 0x24}}, 0x4041) (async) sendmsg$nl_route_sched(r2, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000000c0)=@delqdisc={0x24, 0x25, 0x400, 0x70bd25, 0x25dfdbfe, {0x0, 0x0, 0x0, r7, {0x9, 0xffff}, {0xc, 0xfff1}, {0xb}}}, 0x24}}, 0x4041) r8 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r9 = syz_genetlink_get_family_id$ieee802154(&(0x7f00000003c0), r8) ioctl$sock_SIOCGIFINDEX_802154(r8, 0x8933, &(0x7f0000000400)={'wpan1\x00', 0x0}) sendmsg$IEEE802154_LLSEC_ADD_KEY(r8, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000480)={&(0x7f00000004c0)=ANY=[@ANYBLOB='\\\x00\x00\x00', @ANYRES16=r9, @ANYBLOB="290e29bd7000fbdbdf0527960000050031000e0000001400300053e0e85290ceb080fb816d3cdadf198b08000200", @ANYRES32=r10, @ANYBLOB='$\x002'], 0x5c}, 0x1, 0x0, 0x0, 0x4000800}, 0x0) syz_genetlink_get_family_id$ieee802154(&(0x7f0000000540), 0xffffffffffffffff) (async) r11 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000540), 0xffffffffffffffff) sendmsg$IEEE802154_LLSEC_LIST_DEV(r8, &(0x7f0000000640)={&(0x7f0000000500)={0x10, 0x0, 0x0, 0x20000000}, 0xc, &(0x7f0000000600)={&(0x7f00000005c0)={0x14, r11, 0x100, 0x70bd29, 0x25dfdbfc, {}, ["", "", "", "", "", ""]}, 0x14}, 0x1, 0x0, 0x0, 0x24008000}, 0x40005) sendmsg$nl_route_sched(r2, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000001300)=@newtfilter={0x30, 0x2c, 0x601, 0x0, 0x0, {0x0, 0x0, 0x0, r7, {}, {0xfff1, 0xffff}, {0x8, 0x3}}, [@filter_kind_options=@f_u32={{0x8}, {0x4}}]}, 0x30}}, 0x0) 1.51399268s ago: executing program 2 (id=3849): r0 = socket$packet(0x11, 0x2, 0x300) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000008c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$SIOCSIFHWADDR(r2, 0x8b04, &(0x7f0000000940)={'virt_wifi0\x00', @random="e4ff00"}) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000000c0)={'hsr0\x00', 0x0}) ioctl$TUNSETGROUP(0xffffffffffffffff, 0x541b, 0x0) socket$netlink(0x10, 0x3, 0x0) openat$tun(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) socket$nl_route(0x10, 0x3, 0x0) r4 = socket$can_bcm(0x1d, 0x2, 0x2) connect$can_bcm(r4, &(0x7f00000001c0), 0x10) (async) connect$can_bcm(r4, &(0x7f00000001c0), 0x10) sendmsg$can_bcm(r4, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f00000003c0)=ANY=[@ANYBLOB="0500000008000000ed00000000000000", @ANYRES64=0x0, @ANYRES64=0x0, @ANYRES64=0x0, @ANYRES64=0x0, @ANYBLOB="03"], 0x48}, 0x1, 0x0, 0x0, 0x2000c014}, 0x800) sendmsg$can_bcm(r4, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000000440)={&(0x7f0000000000)=ANY=[@ANYRESHEX=r1], 0x48}, 0x1, 0x0, 0x0, 0x48850}, 0x200008c1) ioctl$ifreq_SIOCGIFINDEX_vcan(r4, 0x8933, &(0x7f0000000880)={'vcan0\x00'}) (async) ioctl$ifreq_SIOCGIFINDEX_vcan(r4, 0x8933, &(0x7f0000000880)={'vcan0\x00', 0x0}) sendmsg$can_bcm(r4, &(0x7f0000000980)={&(0x7f00000009c0)={0x1d, r5}, 0x10, &(0x7f0000000a00)={&(0x7f0000000a40)=ANY=[@ANYRES64=r4], 0x48}, 0x1, 0x0, 0x0, 0x4}, 0x8001) (async) sendmsg$can_bcm(r4, &(0x7f0000000980)={&(0x7f00000009c0)={0x1d, r5}, 0x10, &(0x7f0000000a00)={&(0x7f0000000a40)=ANY=[@ANYRES64=r4], 0x48}, 0x1, 0x0, 0x0, 0x4}, 0x8001) syz_init_net_socket$x25(0x9, 0x5, 0x0) (async) r6 = syz_init_net_socket$x25(0x9, 0x5, 0x0) ioctl$sock_proto_private(r6, 0x89e7, 0x0) (async) ioctl$sock_proto_private(r6, 0x89e7, 0x0) setsockopt$packet_add_memb(r0, 0x107, 0x1, &(0x7f0000000100)={r3, 0x2, 0x6, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x24}}, 0x10) (async) setsockopt$packet_add_memb(r0, 0x107, 0x1, &(0x7f0000000100)={r3, 0x2, 0x6, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x24}}, 0x10) r7 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000280)='hugetlb.1GB.rsvd.usage_in_bytes\x00', 0x0, 0x0) r8 = socket(0x10, 0x3, 0x0) sendto$inet6(r8, &(0x7f0000000740)="7800000018002507b9409b14ffff00000200be040205fe056402040c5c0009003f0020030a0000000d0085a168d0bf46d32345653600648d27000b000a00000049935ade4a460c89b6ec0cff3959547f509058ba86c902007a00004a32000402160008000a0000000000e000e218d1ddf66ed538f2523250", 0x78, 0x20008810, 0x0, 0x0) bpf$BPF_PROG_TEST_RUN(0xa, 0x0, 0x0) (async) bpf$BPF_PROG_TEST_RUN(0xa, 0x0, 0x0) ioctl$TUNSETOFFLOAD(r7, 0x400454d0, 0x0) syz_genetlink_get_family_id$mptcp(&(0x7f0000000080), r7) getsockopt$inet_mptcp_MPTCP_INFO(r7, 0x11c, 0x1, &(0x7f0000000140), &(0x7f0000000200)=0x60) socket$inet_mptcp(0x2, 0x1, 0x106) (async) r9 = socket$inet_mptcp(0x2, 0x1, 0x106) bind$inet(r9, 0x0, 0x0) connect$inet(r9, &(0x7f0000000240)={0x2, 0x4e21, @remote}, 0x10) (async) connect$inet(r9, &(0x7f0000000240)={0x2, 0x4e21, @remote}, 0x10) getsockopt$inet_mptcp_MPTCP_INFO(r9, 0x11c, 0x1, &(0x7f0000000480), &(0x7f0000000500)=0x60) socket$nl_netfilter(0x10, 0x3, 0xc) (async) r10 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r10, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000800)={&(0x7f0000000340)=ANY=[], 0x50}}, 0x4000000) 1.296505547s ago: executing program 0 (id=3850): mmap(&(0x7f0000002000/0x1000)=nil, 0x1000, 0x1, 0x32, 0xffffffffffffffff, 0xa2fac000) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000001cc0)={0x11, 0x13, &(0x7f0000001d80)=ANY=[@ANYBLOB="18080000000000000000000010000000851000000600000018020000", @ANYRES32, @ANYBLOB="00000000200000006600020080ffffff18000000fffffffe00000000000000009500040000000000360a020000000000180100002020782500000000002020207b1a00fe00000000bfa100000000000007010000f8ffffffb702000008000000b50afdff0000000085000000060000009500000000000000"], &(0x7f0000001e40)='GPL\x00', 0x2, 0xff5c, &(0x7f0000001e80)=""/222}, 0x78) r0 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f0000000000)={0x3, 0x4, 0x4, 0xa, 0x0, 0xffffffffffffffff, 0x6, '\x00', 0x0, 0xffffffffffffffff, 0x3, 0x3, 0x1}, 0x50) bpf$BPF_MAP_FREEZE(0x16, &(0x7f0000000080)=r0, 0x4) 918.688458ms ago: executing program 4 (id=3851): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$tipc(&(0x7f0000000080), r0) sendmsg(0xffffffffffffffff, &(0x7f0000000700)={0x0, 0x0, &(0x7f0000000740), 0x0, 0x0, 0x2c}, 0x0) r2 = socket$rxrpc(0x21, 0x2, 0x2) bind$rxrpc(r2, &(0x7f0000000780)=@in4={0x21, 0x1234, 0x2, 0x10, {0x2, 0x5678, @empty}}, 0x24) (async) listen(r2, 0x1) (async) sendmsg(r2, &(0x7f00000007c0)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000800)=[{0x18, 0x110, 0x1, "02"}, {0x10, 0x110, 0xe}], 0x28}, 0x0) r3 = socket$rxrpc(0x21, 0x2, 0x2) sendmsg(r3, &(0x7f0000000840)={&(0x7f0000000880)=@rxrpc=@in6={0x21, 0x2, 0x2, 0xffffffffffffff16, {0xa, 0x4e20, 0x1, @dev={0xfe, 0x80, '\x00', 0x3e}, 0x8}}, 0x80, &(0x7f0000000900)=[{&(0x7f0000000b00)="d8d8c93eeee2a8ac2e7d1fe0db5bbe0512998c842190542dbfbbd4661aedbb92733a5289420008ec52f5e1cfa1dfd22caebe44294cfd21cfc780a4a627eec2ac4cc0308d5b7cbaa4cd309c22e6381fbd71f99b8a4d30a1e6d43c47b47416265944f1b8fc5a7926b7e4d719ca466ad9c6f344d67790eb6bd8da99a33f78f91531cce013ca4608000000000000006ae36abbcafe0d01a78b", 0x97}], 0x1, &(0x7f0000000980)=[{0x18, 0x10d, 0x1, "0100000000000000"}], 0xfffffffffffffc56}, 0x0) (async) recvmsg(r2, &(0x7f00000009c0)={0x0, 0x0, &(0x7f0000000a00)=[{0x0}, {&(0x7f0000000a40)=""/138, 0x8a}], 0x2}, 0x0) (async, rerun: 64) r4 = openat$tun(0xffffffffffffff9c, &(0x7f0000000740), 0x501100, 0x0) (rerun: 64) ioctl$TUNSETLINK(r4, 0x400454cd, 0x306) r5 = socket(0x11, 0x3, 0x0) (async, rerun: 64) r6 = socket$nl_generic(0x10, 0x3, 0x10) (rerun: 64) r7 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000340), r6) (async, rerun: 32) ioctl$sock_SIOCGIFINDEX_80211(r6, 0x8933, &(0x7f0000000380)={'wlan1\x00', 0x0}) (rerun: 32) sendmsg$NL80211_CMD_SET_CQM(r6, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000400)={&(0x7f0000000440)=ANY=[@ANYBLOB="8c000000", @ANYRES16=r7, @ANYBLOB="010025bd7000fcdbdf253f00000008000300", @ANYRES32=r8, @ANYBLOB="04005e801c005e8008000700c5f133694bbd07cb55000000080003006e8f000030005e800800020003000000080002491acf00000e0001"], 0x8c}, 0x1, 0x0, 0x0, 0x4080}, 0x4004000) sendmsg$NL80211_CMD_SET_MESH_CONFIG(0xffffffffffffffff, &(0x7f0000000540)={&(0x7f0000000300)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f0000000500)={&(0x7f00000004c0)={0x28, r7, 0x1, 0x70bd29, 0x25dfdbfe, {{}, {@void, @val={0xc, 0x99, {0x0, 0x6b}}}}, [@NL80211_ATTR_WIPHY={0x8, 0x1, 0x12}]}, 0x28}, 0x1, 0x0, 0x0, 0x80005}, 0x0) (async, rerun: 32) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000180)={'ip6gretap0\x00', 0x0}) (rerun: 32) bind$packet(r5, &(0x7f00000001c0)={0x11, 0x0, r9, 0x1, 0x0, 0x6, @remote}, 0x14) (async) setsockopt$packet_int(r5, 0x107, 0xf, &(0x7f0000000200)=0xe9, 0x4) sendmsg$netlink(r5, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000280)=[{&(0x7f00000002c0)=ANY=[@ANYBLOB="3f011400dcdc14"], 0xdd12}], 0x1}, 0x200400d1) (async, rerun: 32) write$bt_hci(r5, &(0x7f00000006c0)={0x1, @le_set_scan_enable={{0x200c, 0x2}, {0xf7, 0x5}}}, 0x6) (async, rerun: 32) r10 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r11 = syz_genetlink_get_family_id$netlbl_cipso(&(0x7f0000000580), r10) sendmsg$NLBL_CIPSOV4_C_ADD(r10, &(0x7f00000005c0)={0x0, 0x0, &(0x7f0000000600)={&(0x7f0000000640)=ANY=[@ANYBLOB='P\x00\x00\x00', @ANYRES16=r11, @ANYBLOB="010025bd7000020000000100000008000100010000002c00048005000300010000000500030002000000050003000100000005000300020000000500030080ff00000800020002"], 0x50}, 0x1, 0x0, 0x0, 0xc082}, 0x24004080) (async) sendmsg$TIPC_CMD_ENABLE_BEARER(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000140)=ANY=[@ANYBLOB='8\x00\x00\x00', @ANYRES16=r1, @ANYBLOB="010000000d000000000001000000000000000141"], 0x38}, 0x1, 0x0, 0x0, 0x40000}, 0x0) (async) r12 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000001140)=ANY=[@ANYRES64, @ANYRES32=r1, @ANYBLOB="0000001331"], 0x50) bpf$PROG_LOAD(0x5, &(0x7f00000011c0)={0x1, 0xf, &(0x7f0000000000)=@ringbuf={{0x18, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20}, {{0x18, 0x1, 0x1, 0x0, r12}, {}, {0x7, 0x0, 0xb, 0x3, 0x0, 0x0, 0x1ab92b}, {0x85, 0x0, 0x0, 0x8}, {0x4}}, {{0x5, 0x0, 0x4, 0x9, 0x0, 0x1, 0x2000}}, [], {{0x7, 0x1, 0xb, 0x8}, {0x6, 0x0, 0x5, 0x9, 0x0, 0xfffd, 0x2}, {0x85, 0x0, 0x0, 0x85}}}, &(0x7f0000001300)='GPL\x00', 0x7, 0x0, 0x0, 0x41000, 0x29, '\x00', 0x0, @fallback=0x22, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4000000}, 0x94) 784.663291ms ago: executing program 3 (id=3852): r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$XFS_IOC_START_COMMIT(r0, 0x80585882, &(0x7f0000000240)={0xffffffffffffffff}) bind$inet(r1, &(0x7f00000002c0)={0x2, 0x4e22, @remote}, 0x10) ioctl$XFS_IOC_FSCOUNTS(r0, 0x80205871, &(0x7f0000000040)) r2 = socket$nl_rdma(0x10, 0x3, 0x14) r3 = syz_open_procfs$namespace(0xffffffffffffffff, &(0x7f0000000100)='ns/net\x00') sendmsg$RDMA_NLDEV_CMD_SET(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000200)=ANY=[@ANYBLOB="2c000000021401002cbd7000fedbdf250900020073797a3000000000080001000200000008004400", @ANYRES32=r3], 0x2c}, 0x1, 0x0, 0x0, 0x4008004}, 0xc4800) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000000)={'team_slave_0\x00', 0x0}) r5 = syz_init_net_socket$bt_rfcomm(0x1f, 0x1, 0x3) ioctl$sock_SIOCGIFVLAN_SET_VLAN_FLAG_CMD(r5, 0x8982, &(0x7f0000000300)={0x7, 'veth0_virt_wifi\x00', {0x2}, 0x849}) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000000c0)=@ipv6_newaddr={0x40, 0x14, 0x119, 0x70bd26, 0x25dfdbf8, {0xa, 0x40, 0x19, 0xfe, r4}, [@IFA_ADDRESS={0x14, 0x1, @dev={0xfe, 0x80, '\x00', 0x21}}, @IFA_CACHEINFO={0x14, 0x6, {0x40000000, 0xffffffff, 0x100}}]}, 0x40}}, 0x4040014) 632.37078ms ago: executing program 3 (id=3853): unshare(0x22020600) r0 = socket(0x2d, 0x2, 0x0) bind$xdp(r0, 0x0, 0x0) r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000001c0)=ANY=[@ANYRESDEC=r1], 0x38}, 0x1, 0x0, 0x0, 0x40000}, 0xc000) bpf$LINK_GET_NEXT_ID(0x1f, &(0x7f0000000040)={0x1}, 0x8) ioctl$XFS_IOC_GETBMAPA(r1, 0xc020582c, &(0x7f0000000000)={0x9, 0x101, 0x4ad, 0x91, 0x6}) epoll_create(0x4) pipe(&(0x7f0000000080)={0xffffffffffffffff}) epoll_ctl$EPOLL_CTL_ADD(r2, 0x1, r2, &(0x7f00000000c0)={0x50000000}) r3 = openat$rfkill(0xffffffffffffff9c, &(0x7f0000000100), 0x22883, 0x0) r4 = epoll_create1(0x80000) epoll_ctl$EPOLL_CTL_ADD(r4, 0x1, r3, &(0x7f0000001700)={0x90000019}) epoll_pwait(r4, &(0x7f0000001780)=[{}], 0x1, 0x1, 0x0, 0x0) read(r2, &(0x7f0000000200)=""/4096, 0x1000) r5 = bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000001380)=@bpf_tracing={0x1a, 0xe, &(0x7f0000001200)=@raw=[@ringbuf_output={{0x18, 0x1, 0x1, 0x0, 0x1}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0x6}}, @tail_call={{0x18, 0x2, 0x1, 0x0, r1}}], &(0x7f0000001280)='GPL\x00', 0x6, 0x0, 0x0, 0x41000, 0x4, '\x00', 0x0, 0x17, 0xffffffffffffffff, 0x8, &(0x7f00000012c0)={0x0, 0x2}, 0x8, 0x10, &(0x7f0000001300)={0x2, 0x8, 0x6, 0x2}, 0x10, 0x9560, 0xffffffffffffffff, 0x2, 0x0, &(0x7f0000001340)=[{0x4, 0x5, 0x4, 0x7}, {0x3, 0x3, 0xa, 0xb}], 0x10, 0xfffffe11}, 0x94) r6 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000001440)=ANY=[@ANYBLOB="0200000004000000080000000100000080"], 0x48) bpf$BPF_MAP_CONST_STR_FREEZE(0x16, &(0x7f0000001480)={r6}, 0x1) r7 = bpf$PROG_LOAD(0x5, &(0x7f00000014c0)={0x6, 0x11, &(0x7f0000001580)=ANY=[@ANYBLOB="18020000e3f9ffff00000000000000008500000041000000b7080000000000007b8af8ff00000000b7080000000000007b8af0ff00000000bfa100000000000007010000f8ffffffbfa400000000000007040000f0ffffffb70200000800000018230000", @ANYRES32=r6, @ANYBLOB="0000000000000000b70500000000000085000000a500000095"], &(0x7f0000001640)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @xdp, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000001680)={r7, 0x0, 0x2100, 0x0, &(0x7f0000001700), 0x0, 0x11, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9}, 0x50) ioctl$XFS_IOC_FSGEOMETRY_V1(r4, 0x80705864, &(0x7f0000001800)) bpf$BPF_LINK_UPDATE(0x1d, &(0x7f0000001740)={r2, r5, 0x0, r7}, 0x10) bpf$LINK_GET_NEXT_ID(0x1f, &(0x7f00000017c0)={0x326f}, 0x8) 523.846286ms ago: executing program 2 (id=3854): r0 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000280)={'wlan1\x00'}) ioctl$XFS_IOC_ATTRLIST_BY_HANDLE(r0, 0x4058587a, &(0x7f0000000440)={{r0, &(0x7f0000000300)='GPL\x00', 0x600000, &(0x7f0000000340)={@_ha_fsid={[0x3, 0x1]}, {0xffff, 0x1, 0xfffffffd, 0xc4}}, 0x2, &(0x7f0000000380), &(0x7f00000003c0)=0x6}, {[0x1, 0xb86b, 0x2, 0x200]}, 0x1, 0x30, &(0x7f0000000400)=""/48}) sendmsg$IPCTNL_MSG_CT_DELETE(r1, &(0x7f00000005c0)={&(0x7f00000004c0)={0x10, 0x0, 0x0, 0x800000}, 0xc, &(0x7f0000000580)={&(0x7f0000000600)={0x34, 0x2, 0x1, 0x801, 0x0, 0x0, {0x7, 0x0, 0x1}, [@CTA_PROTOINFO={0x20, 0x4, 0x0, 0x1, @CTA_PROTOINFO_TCP={0x1c, 0x1, 0x0, 0x1, [@CTA_PROTOINFO_TCP_FLAGS_ORIGINAL={0x6, 0x4, {0x9, 0xb7}}, @CTA_PROTOINFO_TCP_WSCALE_ORIGINAL={0x5, 0x2, 0x3}, @CTA_PROTOINFO_TCP_FLAGS_ORIGINAL={0x6, 0x4, {0x4, 0x5}}]}}]}, 0x34}}, 0x800) syz_genetlink_get_family_id$nl80211(&(0x7f00000002c0), 0xffffffffffffffff) socket$nl_generic(0x10, 0x3, 0x10) r2 = socket$netlink(0x10, 0x3, 0x10) bind$netlink(r2, &(0x7f0000000000)={0x10, 0x0, 0x0, 0x2ffffffff}, 0xc) setsockopt$sock_int(r2, 0x1, 0x8, &(0x7f0000000040), 0x4) r3 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) setsockopt$bt_BT_VOICE(r3, 0x112, 0xb, 0x0, 0x0) setsockopt$netlink_NETLINK_BROADCAST_ERROR(r2, 0x10e, 0x4, &(0x7f00000000c0)=0xcde, 0x4) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r4, &(0x7f0000000640)={0x0, 0x0, &(0x7f0000000740)={&(0x7f0000000780)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x0) sendmsg$NFT_BATCH(r4, &(0x7f0000000800)={0x0, 0x0, &(0x7f0000000840)={&(0x7f0000000980)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a4c000000090a010400000000000000000a0000040900010073797a310000000008000540000000020900020073797a310000000008000a40fffffffc080003400000001408000c4000000e45400000000c0a010100000000000000000a0000060900020073797a31000000000900010073797a310000000014000380100000800c00018006000100d103000014000000110001"], 0xb4}, 0x1, 0x0, 0x0, 0x4000850}, 0x40) sendmsg$NFT_BATCH(r4, &(0x7f0000000a40)={0x0, 0x0, &(0x7f0000000a80)={&(0x7f0000000ac0)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a54000000090a010400000000000000000a0000040900010073797a310000000008000a40fffffffc08000540000000020900020073797ab10000000008000640ffffff000800084000000001080003400000011c14000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x4004840}, 0x8044) close(0x3) syz_genetlink_get_family_id$nl80211(&(0x7f0000000100), r2) r5 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000140), 0xffffffffffffffff) r6 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r6, 0x8933, &(0x7f0000000180)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_VENDOR(r6, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000240)=ANY=[@ANYBLOB='8\x00\x00\x00', @ANYRES16=r5, @ANYBLOB="010000000000000000006700000008000300", @ANYRES32=r7, @ANYBLOB="0800c300741300000800c400010000000c00c5800800080001000000"], 0x38}}, 0x0) r8 = socket$inet6_mptcp(0xa, 0x1, 0x106) r9 = openat$rfkill(0xffffffffffffff9c, &(0x7f0000000500), 0x0, 0x0) ioctl$RFKILL_IOCTL_NOINPUT(r9, 0x5201) setsockopt$SO_BINDTODEVICE_wg(r8, 0x1, 0x19, 0x0, 0x18) syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff) r10 = bpf$MAP_CREATE(0x0, &(0x7f0000000700)=ANY=[@ANYBLOB="19000000040000000800000008"], 0x48) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f00000008c0)={{r10}, &(0x7f0000000900), &(0x7f0000000940)}, 0x20) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, 0x0, 0x0) 468.623374ms ago: executing program 0 (id=3855): r0 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000000)={0x2, 0x4, 0x8, 0x1, 0x80, 0x0, 0x0, '\x00', 0x0, 0x0}, 0x48) bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0x1, 0x1, &(0x7f00000002c0)=ANY=[@ANYBLOB="fb2af8ff50"], &(0x7f0000000300)='GPL\x00', 0x1, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000080)={0xd, 0x10, &(0x7f0000000140)=ANY=[@ANYBLOB="18000000000000000000000000000000b7080000000000007b8af8ff00000000b7080000000000007b8af0ff00000000bf8100000000000007080000f8ffffffbfa400000000000007040000f0ffffffb70200000800000018210000", @ANYRES32=r0, @ANYBLOB="0000000002000000b705000008000000850000009400000095"], &(0x7f00000001c0)='GPL\x00', 0x9, 0x1002, &(0x7f0000000a00)=""/4098}, 0x90) bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="0300000004000000040000000a"], 0x50) 348.135686ms ago: executing program 0 (id=3856): r0 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="02000000040000000800000001"], 0x50) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$batadv(&(0x7f0000000080), r1) sendmsg$BATADV_CMD_GET_DAT_CACHE(r1, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000140)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r2, @ANYBLOB="05a300000000fedbdf250d00000008000300", @ANYRES32=r1], 0x1c}}, 0x20008000) (async) bpf$MAP_CREATE(0x0, &(0x7f0000000040)=ANY=[@ANYBLOB='\"\x00'], 0x48) r3 = socket$inet6(0xa, 0x3, 0xff) ioctl$F2FS_IOC_MOVE_RANGE(r0, 0xc020f509, &(0x7f0000000180)={r3, 0x700000000000000, 0x47, 0x42}) sendmsg$NFT_BATCH(r4, &(0x7f0000000380)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x200000}, 0xc, &(0x7f0000000340)={&(0x7f0000000200)={{0x14}, [@NFT_MSG_DELFLOWTABLE={0x40, 0x18, 0xa, 0x401, 0x0, 0x0, {0x1, 0x0, 0x9}, [@NFTA_FLOWTABLE_NAME={0x9, 0x2, 'syz2\x00'}, @NFTA_FLOWTABLE_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_FLOWTABLE_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_FLOWTABLE_FLAGS={0x8, 0x7, 0x1, 0x0, 0x3}]}, @NFT_MSG_DELCHAIN={0x58, 0x5, 0xa, 0x201, 0x0, 0x0, {0x2}, [@NFTA_CHAIN_NAME={0x9, 0x3, 'syz1\x00'}, @NFTA_CHAIN_ID={0x8, 0xb, 0x1, 0x0, 0x2}, @NFTA_CHAIN_HANDLE={0xc, 0x2, 0x1, 0x0, 0x2}, @NFTA_CHAIN_HANDLE={0xc, 0x2, 0x1, 0x0, 0x2}, @NFTA_CHAIN_TYPE={0x8, 0x7, 'nat\x00'}, @NFTA_CHAIN_ID={0x8, 0xb, 0x1, 0x0, 0x3}, @NFTA_CHAIN_FLAGS={0x8, 0xa, 0x1, 0x0, 0x2}]}, @NFT_MSG_NEWSET={0x48, 0x9, 0xa, 0x3, 0x0, 0x0, {0x2, 0x0, 0x8}, [@NFTA_SET_EXPRESSIONS={0x18, 0x12, 0x0, 0x1, [{0x14, 0x1, 0x0, 0x1, @connlimit={{0xe}, @void}}]}, @NFTA_SET_TIMEOUT={0xc, 0xb, 0x1, 0x0, 0xffffffffffffffff}, @NFTA_SET_ID={0x8}, @NFTA_SET_POLICY={0x8}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x3}}}, 0x108}, 0x1, 0x0, 0x0, 0x4004}, 0x4000000) (async) setsockopt$IP6T_SO_SET_REPLACE(r3, 0x29, 0x40, &(0x7f0000000940)=@filter={'filter\x00', 0xe, 0x4, 0x388, 0xffffffff, 0x0, 0xd0, 0x1a0, 0xffffffff, 0xffffffff, 0x0, 0xd0, 0x2b8, 0xffffffff, 0x4, 0x0, {[{{@uncond, 0x0, 0xa8, 0xd0}, @common=@unspec=@STANDARD={0x28, '\x00', 0x0, 0xfffffffe}}, {{@uncond, 0x0, 0xa8, 0xd0}, @common=@unspec=@STANDARD={0x28, '\x00', 0x0, 0xfffffffe}}, {{@uncond, 0x0, 0xf0, 0x118, 0x0, {}, [@common=@hbh={{0x48}, {0x8, 0x1}}]}, @common=@unspec=@STANDARD={0x28, '\x00', 0x0, 0xfffffffe}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x3e8) 256.107372ms ago: executing program 1 (id=3857): r0 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r0, &(0x7f00000007c0)={0x2, 0x4e20, @multicast1}, 0x10) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x10, &(0x7f0000000000)=0x1, 0x4) socket$inet_icmp_raw(0x2, 0x3, 0x1) unshare(0x2c060000) getsockname$packet(0xffffffffffffffff, &(0x7f0000000400)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @remote}, &(0x7f0000000440)=0x14) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x5) close(0x4) syz_open_procfs$namespace(0x0, &(0x7f0000000040)='ns/ipc\x00') setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x9, 0x0, 0x0) r1 = socket$inet_udp(0x2, 0x2, 0x0) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_LIST(r2, &(0x7f00000002c0)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x40}, 0xc, &(0x7f0000000280)={&(0x7f0000000240)={0x28, 0x7, 0x6, 0x5, 0x0, 0x0, {0x0, 0x0, 0x8}, [@IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}, @IPSET_ATTR_PROTOCOL={0x5}]}, 0x28}, 0x1, 0x0, 0x0, 0x1}, 0x24018044) setsockopt$sock_int(r1, 0x1, 0xf, &(0x7f0000000080)=0x100000b3, 0x4) bind$inet(r1, &(0x7f00000000c0)={0x2, 0x4e20, @local}, 0x10) r3 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$sock_int(r3, 0x1, 0xf, &(0x7f0000000100)=0x100000b3, 0x4) bind$inet(r3, &(0x7f0000000140)={0x2, 0x4e20, @empty}, 0x10) connect$inet(r3, &(0x7f0000000180)={0x2, 0x4e27, @local}, 0x10) syz_emit_ethernet(0x2a, &(0x7f00000001c0)={@link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0xe}, @remote, @void, {@ipv4={0x800, @udp={{0x5, 0x4, 0x0, 0xe, 0x1c, 0x66, 0x0, 0xf, 0x11, 0x0, @empty, @empty=0xe0000001}, {0x4e24, 0x4e20, 0x8}}}}}, 0x0) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(0xffffffffffffffff, 0x84, 0x6f, 0x0, 0x0) connect$inet(r0, &(0x7f0000000800)={0x2, 0x4e20, @dev={0xac, 0x14, 0x14, 0x18}}, 0x10) getsockopt$inet_sctp6_SCTP_SOCKOPT_PEELOFF_FLAGS(0xffffffffffffffff, 0x84, 0x7a, &(0x7f0000000300)={0x2, 0xffffffffffffffff, 0x800}, &(0x7f0000000340)=0xc) setsockopt$inet6_opts(r4, 0x29, 0x39, &(0x7f0000000480)=ANY=[@ANYBLOB="6208001100000000fc020000000000000000000000000001fc02000000000000000e00000000000020010000050000000048bc7ce92dd5d0c8d7c52097bae400000000800000267a70ebad8f00"/92], 0x48) r5 = socket(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000840)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$sock_SIOCGIFINDEX(r6, 0x8933, &(0x7f0000000880)={'lo\x00', 0x0}) sendmsg$nl_route_sched(r5, &(0x7f00000008c0)={0x0, 0x0, &(0x7f0000000900)={&(0x7f0000000940)=@newqdisc={0x60, 0x24, 0xd0f, 0x70bd2d, 0x0, {0x60, 0x0, 0x0, r7, {0x0, 0xa}, {0xffff, 0xffff}, {0x0, 0xffff}}, [@qdisc_kind_options=@q_tbf={{0x8}, {0x34, 0x2, [@TCA_TBF_PARMS={0x28, 0x1, {{0xea, 0x0, 0xfffd, 0x0, 0xc, 0x5}, {0x12, 0x2, 0x0, 0x401, 0x8001, 0x1400}, 0xa5, 0x5, 0x10000000}}, @TCA_TBF_BURST={0x8, 0x6, 0x8058}]}}]}, 0x60}}, 0x44080) sendmsg$nl_route_sched(r5, &(0x7f00000009c0)={0x0, 0x0, &(0x7f0000000a00)={&(0x7f0000000a40)=@newqdisc={0x34, 0x24, 0xd0f, 0x70bd27, 0x25dfdbfc, {0x60, 0x0, 0x0, r7, {}, {0xffe0, 0xa}, {0xfff3, 0xe}}, [@qdisc_kind_options=@q_pfifo_fast={0xf}]}, 0x34}, 0x1, 0x0, 0x0, 0x845}, 0x2000c050) sendmsg$inet(r0, &(0x7f0000000a80)={0x0, 0x0, &(0x7f0000000ac0)=[{&(0x7f0000000b00)=' ', 0x1}], 0x1}, 0x4) 152.578124ms ago: executing program 2 (id=3858): r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="0e000000040000000800000001"], 0x50) r1 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000080)={0x11, 0xc, &(0x7f0000000180)=@framed={{}, [@ringbuf_output={{0x18, 0x1, 0x1, 0x0, r0}, {}, {}, {}, {}, {}, {}, {0x85, 0x0, 0x0, 0x3}}]}, &(0x7f0000000200)='GPL\x00', 0x4, 0x1005, &(0x7f0000001340)=""/4101, 0x0, 0xc}, 0x94) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r2, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000140)=@newqdisc={0x38, 0x24, 0x601, 0x0, 0x0, {0x0, 0x0, 0x0, 0x1, {}, {0xfff1, 0xffff}}, [@qdisc_kind_options=@q_clsact={0xb}, @TCA_INGRESS_BLOCK={0x8, 0xd, 0x1}]}, 0x38}}, 0x0) getsockopt$inet6_mreq(0xffffffffffffffff, 0x29, 0x1b, &(0x7f0000000240)={@local, 0x0}, &(0x7f0000000280)=0x14) r4 = socket(0x1, 0x2, 0x7ff) sendmsg$kcm(r4, &(0x7f0000000840)={&(0x7f0000000500)=@alg={0x26, 'rng\x00', 0x0, 0x0, 'drbg_pr_hmac_sha512\x00'}, 0x80, &(0x7f00000006c0)=[{&(0x7f00000005c0)="1e8789bf74952954772fe55533a1d4836960ceb828ad8b48f7dc1d6e65fb991b4fa4fb1b9bf4def94c17638b7a63a984448409105dde8458e462bafa75441c05db9b8088d1e8fdbf520defa2433549d1b83dc7d2c6abdb48d324b003988764ce6ba86ad274efd486d79cb740d00c8833e1cd654c44ba8b410b7897e238d03aa51bd39eacbdab0845cf663f6f093acdf8c59bcbb5b4951bbe13c0e010ee0c12c51ba3da85bccdf0b091a24f8851769b72dd9bc6f0bfd2126467589e042a4fc175e246cd67d3716122", 0xc8}], 0x1, &(0x7f0000000700)=[{0x30, 0x10e, 0x2, "320e07b859470befed5ebc5a64d0c2172c379c3a1341928d412a9aecbb52"}, {0x100, 0x11, 0x8, "40fef37e51a5624aee4d40c4b010a7b4e75584702e11a77364dd183f8a00d3b9e9489715d90247b056d6f7f9cc55b222a57d5d449f0e345e16ce3f0daa0cba6d37d12a1dc9d4b4d8c8ad9989a9fb67100cbc70cd6f9cf933b2caa16aa97207c8ae6468fd4dd6cf1cf3856cb3bb13521ad4ed040a3f375111700f353255cc442c7d51134a14377e322136d97cbe516cd8c9b68ce90e5e5a4861c9fb0459c5a08c22799988b977ae439ec0564f130979219f7f16e781c4fe74bfdefa76077672cd593c9fc1f54659a612aa886ed6572d7347cfd9076f2442d1c0f240885c35a889ff6ae3757355e5e384c9573097e55b95"}], 0x130}, 0x80) bpf$MAP_CREATE(0x0, &(0x7f00000002c0)=@base={0x17, 0x2, 0x2, 0x7, 0x820, 0xffffffffffffffff, 0x6, '\x00', r3, r0, 0x5, 0x4, 0x5}, 0x50) getsockopt$IP_SET_OP_GET_BYINDEX(r2, 0x1, 0x53, &(0x7f0000000480)={0x7, 0x7, 0x3}, &(0x7f00000004c0)=0x28) sendmsg$nl_route_sched(r2, &(0x7f0000001300)={0x0, 0xffffffffffffff6c, &(0x7f0000000580)={&(0x7f0000000000)=@newtfilter={0x2c, 0x2c, 0x609, 0x0, 0x25dfdbff, {0x0, 0x0, 0x0, 0xffffffff, {0xfff1, 0x2}, {0x5, 0xffe3}, {0x11, 0x1}}, [@TCA_CHAIN={0x8, 0xb, 0x4}]}, 0x2c}, 0x1, 0x0, 0x0, 0x20048081}, 0x0) bpf$BPF_PROG_QUERY(0x10, &(0x7f0000000440)={@fallback=r1, 0x31, 0x1, 0xa1f, &(0x7f0000000340)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], 0x8, 0x0, &(0x7f0000000380)=[0x0, 0x0], &(0x7f00000003c0)=[0x0, 0x0, 0x0, 0x0, 0x0], &(0x7f0000000400)=[0x0, 0x0]}, 0x40) 150.942596ms ago: executing program 0 (id=3859): r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$OSF_MSG_ADD(r1, &(0x7f0000001500)={0x0, 0x0, &(0x7f0000001540)={&(0x7f0000001580)=ANY=[@ANYBLOB="64090000000501040000000000000000000000095402010000000000a40a0000820507000100090073797a30000000000000000000000000000000000000000000000000000000009d14cdaaf9a37e6e4d6a674feab69ee91e1ce3892f51e8b20446a775fcb7b1c9a5b2c5b71dd6509f1e78dc4191a18a68cbf3136aa59b5176356cb472ca542045050061000100000092060000090006000300000001000000030f040001000000000000000700b20300000000080000004e087f001ed372d208000000870006000300000009000000001001fe000000000c0000000600e601000000000000000093af0100000000000400000000000300020000000ba200000500000e010000000700000003000000010000000000010001010200030000004c0b00000900060003000000000800000700000402000000080000002b00000007000000020000000900f8ff0300000002000000000007000300000001000000ff070500030000004399000005004000030000000400000002000100000000000200000007005f700300000005000000000080000100000004000000090001000200000007000000c7000300030000000100000000000004000000000400000005000200000000000a0000000800000002000000feffffff0004080002000000040000007b0ffaff0000000008000000ff0000080100000009000000010005000300000007000000090001010200000003000000020003000100000008000000020004000000000000000000588e10000100000000000000030008000000000009000000018004000100000005000000ff000c0000000000000000000500010000000000040000005402010003000000070000000402ff7f0500230073797630000000000000000000000000000000000000000000000000000000006e54f456ccd8014d52e6d50cde7d21c527deefcfd57a9d80eabd920f98340e5a2af6c42225d5327de2cacbbcf4464b3cc0f6b8262832bc07c57821301a9439bbf4070a0002000000000000005312ff03010000000900000002000800000000000400000010000300020000000000000001008100030000000300000001010200030000007323727660000100845454bb000000009e0cf30e030000000f6aad55ac0a0f0002000000000100000000000403000000f2ffffff05000900010000000d8e1658ff00ff0f02000000800000003e16000001000000a60400000500020002000000080000000000080000000000280a000009000900020000000c0000001300fcff03000000010000000000ff01020000000a0000000600060003000000020000000800060003000000ff0f00000900050003000000b7f4ffff0000205d030000000600000006000c0001000000ffff000000c00700010000000700000009004391030000000f0000001835050001000000fdffffff0300240002000000ec0000003cb6000002000000050000000500040001000000010000000500090003000000010400000100c20c0100000003000000040000020200000003000000ff7f080000000000030000000900e50000000000040000000800ff0301000000230000000900010101000000070000006109040000000000010000000500070001000000070000000400400002000000ffffff7f0400000000000000080000005402010003"], 0x964}, 0x1, 0x0, 0x0, 0x8000}, 0x4810) r2 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r2, &(0x7f0000000080)={0x2, 0x4e20, @empty}, 0x10) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) r4 = syz_genetlink_get_family_id$tipc2(&(0x7f00000023c0), 0xffffffffffffffff) sendmsg$TIPC_NL_UDP_GET_REMOTEIP(0xffffffffffffffff, &(0x7f0000002700)={&(0x7f0000002380)={0x10, 0x0, 0x0, 0x8}, 0xc, &(0x7f00000026c0)={&(0x7f0000002740)={0x21c, r4, 0x800, 0x70bd2d, 0x25dfdbfd, {}, [@TIPC_NLA_SOCK={0x4}, @TIPC_NLA_MON={0x1c, 0x9, 0x0, 0x1, [@TIPC_NLA_MON_REF={0x8, 0x2, 0x1}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8}, @TIPC_NLA_MON_REF={0x8, 0x2, 0x7}]}, @TIPC_NLA_MON={0x14, 0x9, 0x0, 0x1, [@TIPC_NLA_MON_REF={0x8, 0x2, 0x3}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8, 0x1, 0x9}]}, @TIPC_NLA_NET={0x4c, 0x7, 0x0, 0x1, [@TIPC_NLA_NET_NODEID_W1={0xc, 0x4, 0x1}, @TIPC_NLA_NET_NODEID_W1={0xc, 0x4, 0x3ff}, @TIPC_NLA_NET_NODEID_W1={0xc, 0x4, 0x7}, @TIPC_NLA_NET_NODEID={0xc, 0x3, 0x4}, @TIPC_NLA_NET_NODEID_W1={0xc, 0x4, 0x7ff}, @TIPC_NLA_NET_NODEID_W1={0xc, 0x4, 0x3}]}, @TIPC_NLA_MEDIA={0x60, 0x5, 0x0, 0x1, [@TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'eth\x00'}, @TIPC_NLA_MEDIA_PROP={0x2c, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_TOL={0x8, 0x2, 0x9}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x2}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x14}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x10}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x4}]}, @TIPC_NLA_MEDIA_PROP={0x4}, @TIPC_NLA_MEDIA_NAME={0x7, 0x1, 'ib\x00'}, @TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'eth\x00'}, @TIPC_NLA_MEDIA_PROP={0xc, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x9}]}, @TIPC_NLA_MEDIA_NAME={0x7, 0x1, 'ib\x00'}]}, @TIPC_NLA_MEDIA={0x110, 0x5, 0x0, 0x1, [@TIPC_NLA_MEDIA_NAME={0x7, 0x1, 'ib\x00'}, @TIPC_NLA_MEDIA_PROP={0xc, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_TOL={0x8, 0x2, 0x454b}]}, @TIPC_NLA_MEDIA_PROP={0x2c, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_TOL={0x8, 0x2, 0x2}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x5eb4}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x3}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x8}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0xfffffff7}]}, @TIPC_NLA_MEDIA_PROP={0x2c, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0x3}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x7}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x7fffffff}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x1}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x4}]}, @TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'udp\x00'}, @TIPC_NLA_MEDIA_PROP={0x34, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_TOL={0x8, 0x2, 0xda}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x10}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x29e}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0xff}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x4}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x72ce}]}, @TIPC_NLA_MEDIA_NAME={0x7, 0x1, 'ib\x00'}, @TIPC_NLA_MEDIA_PROP={0x54, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_WIN={0x8, 0x3, 0x9}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0xb}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x7f}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0xd}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x39}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x8}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x20}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x6}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x1}]}, @TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'eth\x00'}]}, @TIPC_NLA_NET={0x18, 0x7, 0x0, 0x1, [@TIPC_NLA_NET_NODEID_W1={0xc, 0x4, 0x9}, @TIPC_NLA_NET_ADDR={0x8, 0x2, 0xd1f9}]}]}, 0x21c}, 0x1, 0x0, 0x0, 0x80}, 0x800) r5 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$inet6(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000001e40)=[{&(0x7f0000001f00)="fa5cf2e9f531fb0969f9185e70e92cdc9c578dfad370ac8bf37435a70fd07e734b398c2615a9cd7a34ee41cc51b26e2829bf8dc17401669862766a05bf9a9c9c175d2e9c2de6f5b8b77a38e616fca1db5a2c1d4f69b8d64b5d4ce3a9bde53e5c3e6103421a38ad276686161286b64996b09b5d09f78cfb7e27c38be8e0e7346f8ba3453065c6d01bcece056fb93efd3997d82531970613a7c7e55d0e22f3b107774ca1bb3526e6c5524e8307b9", 0xad}], 0x1}, 0x0) sendmsg$NFT_BATCH(r5, &(0x7f0000001fc0)={0x0, 0x0, &(0x7f0000002000)={&(0x7f0000002040)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x4080) r6 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$ETHTOOL_MSG_COALESCE_SET(0xffffffffffffffff, &(0x7f00000020c0)={0x0, 0x0, &(0x7f0000002100)={&(0x7f0000002140)=ANY=[@ANYBLOB='\\\x00\x00\x00', @ANYRES16, @ANYBLOB="010000000000000000001400000008000200fc0000001800018014000200"], 0x5c}, 0x1, 0x0, 0x0, 0x4000800}, 0x0) sendmsg$NFT_MSG_GETRULE(r6, &(0x7f0000002180)={0x0, 0x0, &(0x7f00000021c0)={&(0x7f0000002200)=ANY=[@ANYBLOB="38000000070a010100000006000000000a0040010900010073797a3100"], 0x38}, 0x1, 0x0, 0x0, 0x20040850}, 0x44054) socket$packet(0x11, 0x3, 0x300) sendmsg$NFQNL_MSG_CONFIG(r3, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000001e80)={0x44, 0x2, 0x3, 0x101, 0x0, 0x0, {0xa}, [@NFQA_CFG_CMD={0x8, 0x1, {0x1, 0x0, 0x2}}, @NFQA_CFG_PARAMS={0x9, 0x2, {0x1, 0x2}}, @NFQA_CFG_PARAMS={0x9, 0x2, {0x6, 0x1}}, @NFQA_CFG_CMD={0x8, 0x1, {0x1, 0x0, 0xf}}, @NFQA_CFG_MASK={0x8}]}, 0x44}, 0x1, 0x0, 0x0, 0x8000}, 0x0) ioctl$XFS_IOC_START_COMMIT(r3, 0x80585882, &(0x7f0000001ac0)={0xffffffffffffffff}) r8 = syz_genetlink_get_family_id$l2tp(&(0x7f0000001b80), 0xffffffffffffffff) sendmsg$L2TP_CMD_NOOP(r7, &(0x7f0000001c80)={&(0x7f0000001b40)={0x10, 0x0, 0x0, 0x200000}, 0xc, &(0x7f0000001c40)={&(0x7f0000002240)=ANY=[@ANYBLOB="78000000b62c7cff55b77e3a04320b7c93416c7367e9abeb3cc6827d5ccfae4e61deb1c1505c3c9bc3c178f4c9420271bb12716904ff8de50499b231b5e548276edb3eeb2962eb5e9e8de0c2bb04353e289520bc28db1be9d7984bb3ddbf2d8f1bc89d91671ab7eb157f47f7033a6486593101059d8f8b808d36532043095850b4c3cd28d4220dc76688e7281864005425aaf9e5bdf65f6af868de5b2f624114b6a5896d10bc9c81c102f0", @ANYRES16=r8, @ANYBLOB="080026bd7000ffdbdf25000000000c00100009000000000000000c00160001f0ffffffffffff1400080070696d3672656700000000000000000006001b004e22000008000a0003000000050021000000000008001900ac1414aa08000c000200000005000500010000000600010005000000"], 0x78}, 0x1, 0x0, 0x0, 0x20008804}, 0x26008004) r9 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_FIOGETOWN(r0, 0x8903, &(0x7f0000001a80)) setsockopt$IPT_SO_SET_REPLACE(r9, 0x0, 0x40, &(0x7f00000001c0)=@filter={'filter\x00', 0xe, 0x4, 0x298, 0xffffffff, 0x0, 0xd0, 0x168, 0xffffffff, 0xffffffff, 0xd0, 0x168, 0x200, 0xffffffff, 0x4, 0x0, {[{{@uncond, 0x0, 0xa8, 0xd0, 0x0, {}, [@common=@unspec=@time={{0x38}, {0x0, 0x7fffffff, 0x0, 0x1517f, 0xffffffff, 0xfe}}]}, @common=@unspec=@STANDARD={0x28, '\x00', 0x0, 0xfffffffc}}, {{@uncond, 0x0, 0x70, 0x98}, @common=@unspec=@STANDARD={0x28, '\x00', 0x0, 0xffffffff}}, {{@uncond, 0x0, 0x70, 0x98}, @common=@unspec=@STANDARD={0x28, '\x00', 0x0, 0xffffffff}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28, '\x00', 0x0, 0xffffffff}}}}, 0x1000) r10 = socket$inet6_sctp(0xa, 0x801, 0x84) sendto$inet6(r10, &(0x7f0000001cc0)="f9", 0x1, 0x20000040, &(0x7f0000001d00)={0xa, 0x0, 0x2, @private2}, 0x1c) sendto$inet6(r10, &(0x7f0000001d40)="ed1afe65", 0x4, 0x808d1, &(0x7f0000001d80)={0xa, 0x4e22, 0x1, @private0, 0x6}, 0x1c) shutdown(r10, 0x1) getsockopt$inet_sctp6_SCTP_PR_ASSOC_STATUS(r10, 0x84, 0x74, &(0x7f0000001dc0)={0x0, 0x0, 0x10, 0xafa}, &(0x7f0000001e00)=0x18) syz_emit_ethernet(0x102b, &(0x7f00000004c0)={@local, @empty, @void, {@ipv4={0x800, @udp={{0x5, 0x4, 0x0, 0x0, 0x101d, 0x2, 0x0, 0x0, 0x11, 0x0, @loopback, @empty}, {0x0, 0x4e20, 0x1009, 0x0, @wg=@data={0x4, 0x7407, 0xfffffffffffffffd, "9c67524ed6ed152d4f775bbc411126513b67aa2818e6f3aeb55bee6ae1049f195705bc8bd9b1085cd41af77353267df8a1d4cecdb01908186ea04e641c89a2ee0432e9c0894a8d7aff0c865e96548d507f048f907320b0f8b1e83b5f1425b63ad9c6adfd09578bbda92c9bd8f57d6efd752a6f20487ebea241d612212e3ccb077a5150c08f56aed6ee45acd4439043886b78cc5562b00bc57cf509d90b02a7bc86919f1b882f556e6aac5e9b93ee545b2b68bd014e2a49c332432ef4adeb61ac418aa4e20ee299f1a8b7a72e985223996b11a8913f3b1c23b10f88c3de28660457a37126fd3b6394536da0cd962f532ff22c496e1df4ffe049b193514c02571399d3618383a287068f4f15d51d1781cc0bc2af66ddc68135bfd33634e1a75be80630ce76ef79c86c9abb2fdc6d84367ea10fd8a6ee3c99eaec83c66bf5ffce6eb5ccc2546b6df905ff1aea223029ba2f7eb2469c5b8637b79347361f8cf0fa9d58a039e7811f343961b22c23d68b2c04eb8b5aeee7c6f71ce95cab886bf2694e0643d18761043e2d1dcb8ce0bdd15817a75f591b05146424797f729689e2a7bd53cb6c02fd15c339057c714794b407b342d12e69ec383b6ea6c99f845d04fd5128203c78a388fb0a1caf1f725f7636eb41e415951f8284a9c475760eb9312f7d6307037d472fbda509d56a0cf8e36d44f3f0b67fabdd2842ab4241cbfc7d309188d3a634129a13bfcac3b39b75d46bed585550ff7b41746dfd7e0f0c8a25e9f39deb7e2a4f0e068b86c6593b3b37838d2809eef3eb2f3120fde2fe3e9fef4e4bea1ddf3d17c40f753b37baaa110a8b4ad805d500e0235e9371b828993da25c5697d1001c8971b3862eef047730b242350403c851cd74cdea94501c0e2875a5830aa71733a0f022cb37e1cfffaee8eb0a23d51181a0691dadcd6b30a86a5fbf5c499120e265938f6430ffde09eb173327c2e25bdf22ae0d742141db856c4beee07af0ce37c078f6e59b41a29502cc01737c984185f6622a3ce02ed04daf2a7eb03c92a5a5ecce5973ef704aba9efcb99bf52f5c662d52f4399a13af760f9f9ff3d5930c3fae014b92ee0aded4ba51d95cf946d5f55f5b5d4603f8b76087d681ad77fc385fe114331c24a4ada85eaebf5405467dbe656b31b79a0f893864a13bda309a2fec2f4fc4858d9daf946df31f4077338bfc3116a45827ce8907ad691d241d3a8859a3672aeee3878e45b0be6f68194638dee30ba6735a6424e51f8b9a4965d37ab7ca96e167a5c32c8a935ff34693e24d067039db0f4ffe4dc5fe7c56a0d6e52a7cef9a6f1cc8b88d61d2258e3e0e8f2d7b699d4a22ab661f6afae5b48cc8fbc9ddfe57e76f274e65b210994fd96cd4deb6fdb795df4147ca0d876b1b08b64d20a28a358f48086c0f8d1f0741260f95adabba51f2d3f36107d49d46ba0c666232597bf08bfab60b5a432a1652e2c503fcf977ea6ff15c8e8f3bd9b7a3017c36be787d5a6579f5236b17d7bdc2c3918d9257e266bdf7929bb366d98d2b225c08c3c5ed22113b8c051c811bd1e52ecbe619dbc9579270c7cf69ac129e84a7141e689d9745d56e1cda6affdc1856757a6e39039b17d5286cf393186b99b20c54987087ece9972c39b4a05f1ca218c35254c666e7fcb7df4aa401cc79e1aade63732064ca80af164709a85fcf8ac72fa5ace60aa04d2ee0d5f051cb032f7c25100facb7ec1c247812b0de4f1c3c1ab98f904d9752cc427bc0445d8e27b51d5a8084087ea61f82ccc1114679f673753eddc7cfc00ba7e25db3391579ecdf638ab73078133e49b522d3d16bf2ebd06e7cefc24154088965ad3c9291c68f19f7cdd2943abc716ecf0b33fe249108da2b1f9abdbcb4dba89746a8c5711a41556efe5537327e253bd9ac68dc56516392292152b86ef118e25cac4e3c7c2b20bbc5bbc2d825c8dc14e9807aa6a423fdebfa7deee913c8f9f58bd967d43af1d65dc5ce72b2cd1a17ce34facd199bf2c62beeb752d156d6f31ea0323bc3ec0500587c485d8141f5b5ac81457df9396fbf98222212ef70527b6ed8d6e4d11156c8ecaee4692e068a72cb3b12686436028a7297956c48ee8fc393907edd3695fddbb786808c0a48182e3334e73fedcef0ee1bfbb13dce8a79b8822fd1ca0ed645f64d134c240844be5a7ac3aa15419ae79e7b1d721ae5abe1b0896c6189f23b65d79f5c3677b89f40aceff98dfca244a160dff264a2b14a3774064e1152fe0cabfc23e3e16dba5f46ea6af09fb3b8529022837c7e9303e3ecd0170fcc0e6fb0f3981d9f8f838412eae1a3dd13b7a980a642739e8abebed29db34c06460f09e27ddba1ed76b4ac6290235f6f81fcd3eb12af9821575b050aaf80d5c6c695807f7480f24e4bc0159744f9045a2d37574508d7e687482f775d0a4c471c4914e6a64b0d444037407b8d079751ddf4b14ed0ee6f1e622952a331a1a147f3a805fb7ca29c3c7feb2dddd0db795ac0ca327d95b19ff37bd8d553703014e5137f8c41b947d199f95f245d3354f9679876db736da5cfbd7cb9f80a12e50c895b999b670c9e161aa12e82c79d98fed5017e11674158a2f258ecc7c550f10dee6bb9d159316c567e3973e8aa30f157f6d30f239877021e7161c0a93c7b6bedccc7a3d8c9313f6f860d33ae0c162236853ae29d7a619bc306998e51c5d91a73475119a648700fbf3a41701ef87b440b83573a44339aea5806c0883470613e38baa518466dee2c671d96768f8d842feb5a812ea3ecd1e307a913a1032f06af2656b0a969b38366c39ca149205540391f36c897efb80aa43707c12e21544386fc232a45c9eb40a64c35edd4db20bd4970d642c0c2a0ee43ce8bf4d1bd84b3c3fa198cfc8d1f83960a1c3cd85a164926dc962a9078c5b079e0f4bb0b4e94b0aec3d13e7c47edc936927da2e6e7fe9485b0489bc4fdd1699611aeb00d767057602b8e53dfb4a6651c0f2873e5f60fdd7e2542d6aba79f491f87522f77427323e87386c89e1df9dd6e4f32be85c9eefbd6e6b177dde573b0d0bb8df828185aedc7aba2e6c3d4d9df393b203c1147f005860a6dd44dbcebead0eeb29fe3216930ef4a5994a93851df960d3be82d4294b64ba8295a59d099fd10afe39c2a79727a5447fa27909d53df6a00a63897261619e853036a6852e95ac6da62276007f2f3f386267cd8a0d136e645247e76db84e466e56ba42618b4fdef3e6d8c48dae5d03e1e369cd74042146e361cd6b4e654c8adc75446c454d3275a7d91646c4fb721966df9df3f761f10bebd212bfc87db9c48ffa0c6efcb17db3955f4a6f58919a036cda4f0a0c07a7306d2909adeeb474bd0bbec58865c4a5804108a014838673ff26438c162ec61e71bb880b154d475c71d500bfda3128b9fac2bccecb790dbd3075f424b1244f111c7eb5cbb7af0b6f3ec9cac20f82b1631822b940c03d697e213747627a5a7ed57414f2826888e515b88e61e69b742b053fe086ffc916abe00a41870cd332201d96c96bd174b369094b0da81ddc50affefa3709a358a5c00308d30a41d10b1c3f91a011bd246588336ff76dd60c10c3bbc8eec06adb3e73cc21d218b83eb9306e0650dd4e41bd65e15bb99a0653fc312251c174abed9e3ed04ef0378feaf78d839ebf61fda85c290f140cd3690cff881c348c57f504c50ca61986b29e58fdb0cbe276e42c982154762110c0f65b240aebe4291c66157629f0a45ea48e8e6a5dfe062214d635c5f828d1c888ec83a279ddac80f748c00e984248bef8e884590dcc1322aceb2d3b525618450fa0649e4ae8722769c6a32eb47161f7bf08bd59f903240ab9f790313b41607554b21ce45f10cde937f9f68fbb23ace0eaebd86b1201ea230c7f4c57f6594e655904db2a6d3d294f98fe630a524573f52c145b19eea382bc3adac7c7b62863bfa04f2d9fb9b93e7cda0fff4af897281580b879912ebd2c9c9d433ef479e886a477ce4538590179049aaff5e8e51b25db6c0300393a37c25c350e1e4effdd657f26de15199d39e134d1e7fe278b68377674a0e31a12e67096d44f62bd0353147041050fe44d9fbfc95fa8aa368e5868148a9e7a6f5551cf55f677b48ac2b4cd29a300d3cb9cd3a5ef486b9b3138018fb1568ce3f59385b98e93b7113dc85cd242bb57e545d6c151727d1c33ced565b2e29419bc6c458b45ab2107a55793618d20bd476e81ff79543cbace7b26a53a67a3f17ad0e2f2c0cc55f45d374ddc3cf8ada0c52cf1251cc4a6e1c7e84a1536cf328a0a392a3b79bbef1b40ad6e69811f3ec73b971c7cf6d64bfd0b183135d76fbb121aa99c753dce310f3288d460a1158a0c1c2ca4a66eadb38c6669dae4742a1da14b007555ffdae4e60f535ee23018dde93863b028346edc0f8da3ee5208b06fb107e921492ed9f2f2064d865afb5f955c80b1a6c5dbc540f1af7dd68925353d288fce304243f09d1791661027ea11f21ade9abb81a71343f1d405f35b01a504a99e08514f3b8307dce0b7c4305c0e531a538c6c11d8021183a87c2de3e1e384d114559601b948359f153d9845067683d8ef3dc75829a46211368ddf4837c021bf3ba1cc8005ab6902e094635f86f2f090851d5ac0af51c3aec46bdf9024ebe196351e2acd483f71821f033aa02d7bdee2fe987412bda115a5ce7f51dfdb78ce378485801fa10180339d3c5372a65cc46d2f0ef8ad3317062af5c243f81d920075e4874ea69081ba22d8be502422e973128c657da28f4f63d34919b5a4663544e244524263bae0a9a6c7455a16b5b860aedea7a2ea87abb402e151461d8310d05dd611e063e278628420a3f7bf0fd9acfb6dc82741cb588b4d1d8a5b2b5db58e052b07c4e354034842102305c0b070dbe2cea7a59b306054ffcb08432c67d272f40d6d9f42826ed660e6558f80f8522499e0f89335c18297ee395bcbf0ad1af122434e9319177f9ad9c5c140841551733282f74ea025e4e3c4ae11dc64df48497d747ab0d08a2de58abff2242c6267a7498b7ae4fc1ebabc8dc5ede8a053000fe8af5ade0f6868c22d4b2602c36cfc3605a616850973edcc5ebec3e18dea4a4e3f4e11f1c979991b636233ae70f0cb42d592e5bc5b7b3773820b22c386f365738d4ba6a0e76e6e5ab480a77336b394fc807950df4939f6dda4cf088b318660da8b487b1cd0b8b8aaf69bc5c1f7330d1cfc7a7ab84f01a5f4d8ee0b887bd91d8af80be32e171ca03e9a906c6c8b342baec668db3ff9522002d5f60e751e712031d3cbeff0d47523625b3d41633e7c0d3ef3b5b4336b17c36075debcdea4b6357ab468114ae7265eaa39545973a602af35dfbd0ed03a3c6b717eefb92c52291a0b014ae4467a233db1d48c625228733262acf9d08c98e2aba18df6dde6160fe748bbaf217cae345449c1cb5e22ef26e6e8ef2666a307a3ca7a08ab2a7e3a938eab61b772a69aa4dce0ace312136870dadad35c98d2911b4d37dfcf31c3c36cd26177e3cda3049aecc9928545c2e102d2586225cfc96e9884042923e2874ebf71dc81060970705aba2a7ad1127b218e4ade098a41285ff7bee3a0b8dfcddf9933730183c92158d0bbc8dd874e3fab555c30075d7985ad56808387a44610c2b0890de328bb3eeae9fbd6da1b50153ad6d1cf108b7eca8880293643bc836ee65f5c5b0515a61825e38a579129d67bee7e6330e87c8f63064fa1abb7b3af74c16b90b450e781e2243d84bd8191f589ecd2f50cc9b8e07f76ea782d8cecdf9ec"}}}}}}, 0x0) bind$bt_hci(r0, &(0x7f0000000100)={0x1f, 0xffff, 0x3}, 0x6) write(r0, &(0x7f0000000000)="21000000460010aaaaaaaaaa00000000000000000000000000bf4400"/76, 0x4c) 50.69576ms ago: executing program 2 (id=3860): r0 = socket(0x400000000010, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000100)={'bond_slave_0\x00', 0x0}) sendmsg$nl_route_sched(r0, 0x0, 0x4c840) sendmsg$nl_route_sched(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000280)=@newtfilter={0x44, 0x2c, 0xf3f, 0x30bd29, 0x25ffdbfd, {0x0, 0x0, 0x0, r1, {0x0, 0xf}, {0x0, 0xfff3}, {0xfff1, 0x300}}, [@filter_kind_options=@f_flower={{0xb}, {0x14, 0x2, [@TCA_FLOWER_KEY_VLAN_ID={0x6, 0x17, 0xb8a}, @TCA_FLOWER_KEY_ETH_TYPE={0x6, 0x8, 0x88a8}]}}]}, 0x44}, 0x1, 0x0, 0x0, 0x20049854}, 0x0) socket$nl_route(0x10, 0x3, 0x0) r2 = socket$netlink(0x10, 0x3, 0x0) r3 = socket(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r3, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={0x0, 0x14}}, 0x0) getsockname$packet(r3, &(0x7f00000002c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000080)=0x7) syz_genetlink_get_family_id$nl80211(&(0x7f00000001c0), r2) r4 = socket(0x10, 0x3, 0x0) sendmsg$nl_generic(r4, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000010c0)=ANY=[@ANYRES16=r4], 0x20}, 0x1, 0x0, 0x0, 0x240c0811}, 0x0) r5 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r5, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000340)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x2000c881}, 0x40014) sendmsg$NFT_BATCH(r5, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000400)={&(0x7f0000000440)=ANY=[@ANYBLOB="140000001000010000000000000000000700000a50000000060a030400000000000000000a0000050900010073797a31000000002400048020000180080001006e617400140002800800014006000000080005400000001f0900020073797a3200"], 0x78}, 0x1, 0x0, 0x0, 0x10}, 0x20008040) r6 = socket$nl_generic(0x10, 0x3, 0x10) r7 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000a00), 0xffffffffffffffff) socket(0x10, 0x5, 0xd) r8 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r8, 0x8933, &(0x7f0000000040)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_VENDOR(r8, &(0x7f0000002300)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f00000022c0)={&(0x7f0000001100)={0x1198, r7, 0x10, 0x70bd29, 0x25dfdbfb, {{}, {@void, @void, @void}}, [@NL80211_ATTR_VENDOR_SUBCMD={0x8, 0xc4, 0x8}, @NL80211_ATTR_VENDOR_SUBCMD={0x8, 0xc4, 0x2}, @NL80211_ATTR_VENDOR_DATA={0x1004, 0xc5, "11cba44425d029dc93253ab3ffd9d39f0affc98b3db3d5bb65d3004fb454ace770f11de36b2fdbd4674f5b56c0c036ab98b78b5429521a5eac1b1806b1d35bb1da230a36f7b8563a5af4a156b211f12e5657dadaa6da9d09435652f300da827b006aa364fe62bb0a9d7a57de6d7e32618cc80e7760dce59926888384a5cd004ae41acb600f16f1f6caaad53880000cdfbe125de891adbe3c6e041f27de6c39e41f27b3b66483e9ba8e082eafb256bfbe64d7341846c552c0c73c8f9932e589ca0d20267fbd04a89049416a7e2226af5492ff8f1948e28185f9319991259c2965b49a4fb964a919b098e69737d15891a221990423a9288a0ba520e30d77dfe9f19640a73a52e29b93cc9da868fba5af037676f5b94ab3d7ca9e53444b783aeda77233b95d08914c0c776aabcad974d86df0bf6f2276063db0de65f41e4a00a7c6a74e473daafe143d35a3b5defb15ae443e944eb360b6fad66038c7a6914a616726fe5cb3ac8b68247e57047036a961b673be01578cb764b6fc4cc1bb4f01f9e7caaa917797e6f77ddd488b312bcd658aa3f658fc8a022ab28e989dd6abc182ca60687824439e6d25725db7c9edd7057fb2a07a16cd1af61c43e1798720c930e7393f045593d1e8ff73c31de477bcbaf1a750813ca7a276fbda9841c09f0ce6f88ed421d6b243f867073d08f53c049e6e38dc2ff488203044fc625744be9a9c76e7db4601b082dd2398d9fe0102d903b73e47739ce994218c3a3e9b7491b1f463cc20cec966d483d8deb178dbc93a42b25c297930ddd42a2ae28de4c4bb1b0c761745f06f1ce0a10a0bd92c945067ce3f823676f13098533fdfd900b6ab87d9c010e2d8738489938dfb9becc67f65e96b67f08a99678247cef87ea7b9c5e391d1a891a26d86678bcc0558a2817b85ac919f56febacab144a498f64e3d05867f40aead2c50b5e13c85a72fee50e89cefd9223a421ffee1a7b17cc451b8a3705206e956057878882493969abfe705532bbcaf48b66532796a0e87f747c3b277079e0b72b19053999941a5afd0c2c1abeba50aecbdb284707f666c2665e66275e9bd95eb93937872dabe4d2a11099a7e59004d1bf38cc70343a460287230e78ba311d865c630a092256acda4bdbe9a400587635c3a16ace75a7c0977429e78f3a0f74dabe3ded9f684c21179c5b51d4dbd2e0f1b689997a6eb462aefe7a4733959647f2970c9d4cc2c1fdc8842fc5c5a8b5037059b22275b5431e140e664016c0d5c9e204d932bb38ebf39a349812d9e50819118b31973c3186a32fa76ed81224b53e0e793a9b9deef7a484ed44a52b4cabdd4fc618d07afb79dbd6ed6809a490416d87eeeefab67062509813587620526c6c4ebad922fdd3e21e057560fe8ff3bf56740bf4e4b2af64857132873911702aa95646f3c937e4c27d942867c8444764c0d83100151f296f2c423ef53be67f49b5e0f0260ad6f8e1d9fc7b132d3cb6592405271875eb003b6677d0de9eca17c4b6259a16ed3178dff030f655cca8039945b8432ec59a54f61ba126d7fa31661d8d37ca06bfe093b802568be8450b9c3a509551d191c74ca841f28f0e97d77f198acf2c55a5ef558665e78fcd4ad50be587005cf02f7aa3432e35a1cb09e431f698618512a6755dd714d1e67049c3a1467c68187cff915cd24445e8ec6545062ce8a56d9c4420d1dce54480580d22c74dba0ad70e5169b3db339aa3556e584b56c0662185571f336fea4b03afb6af3d6cf57665834f9bba9447982d8d1949591da4c65fb890090cf8f3fa6502ef91057b058c2b5241dcf03f357c8936e18741e988750a20ee3f9a413b615db93c3116edef264887ae8d10224b85eafb785fe8714daf7b7a401c9be8aadaf41bf61f33f88bd13eaf4086c5832afd4d12708b62543801937b75dd90bbb8720f9cff48cd4f6c4660f19ded9c788ab36725802aaba11c1fde2e41d5f192aac9258d7742089c9fd722366ed8360260b1b369615b2d721b4aa1c7ce951273eaa25f894a33f3a6c1569f72a21eb18eeea12d485515a6824822f1b1f76e55cf8132b0202ffaeb4e2f7fb1fad916e2dfa56964561da5e7cace13cd097416bcd1ff31f0e36c3f2e0538d54f5430800b26fa1ed316899ba7468e70b7fccf81225db3eef6f5af4e0e871c2e00fb568f00a17de14f0a3e2c4ce2cadb94fbcd3d46dc1622d482db81d8af616753f4e76e91fad95ec9c3d98ead832c99ff6b85726f3e27c0e6d98b6c0f4ee559a4603cef812169ed622d2d7649dd4ec2c507d73549332753650556c7e0233c6911a89aaf4cbcfde7773b737e9283306c6c6bd886cf767505c694524673cfb6432854194201680a8ba7b4578f16beb239fe1f67d7b836436717801174e4733a5e796762138b2e15018a49caa05170de9b5d5f6345c6c3d57a996243e15ff727a9f493794406a7c2004157f79f14661d5bc557ea3ead48c72526af2b198b6edb1b13ec742769db0790fd0ad79e35c676cde7f5c98e671ff8d09f2cea2ad223be96fda79e2c636693acdb6c4aa57af72c89ba451c286be5e60e394c3cf569f6ed91d9f66571187a66b97832db26d8991582ecab141ace7c45dcfe707306fb9309922d4ef73016b6c6555e0022d489b4054502446949e8851bcef051be22e14f697a1516d4d7648ebfa08a569c98a17898369a0fd824e0882e5b90a37c9a5c81a978e41af8f8b91afc6ff14ee44ab7c17f21cd7860a53abc42fe979dd38b87929ff0e94e963d5ae3338079881b73d91c74ddd9ef44f2df43a0249e799287ffbdc74f8cfb3cffce51774c90198cff927c0705d846796ad6b170e79db89a002bb44d3f92243020311e0a7a8e980a589ba6a97cd2d271969b448d672a373ecb35071d06309a048b1d55c11618e44280bd2a46a048e505f3ebe49953ccfb6725f39a66ee84936bff08015f5a5456f214c0281aaa9b5e1d125307ac67acd472093c117e54e71d3b1f41b89b18f3780c2a4d7a13b19efcd0299ddaa5cd4afd5e316b95d2063068d369eb56665ac92e7dfb15bc2afe65e2441bb37aa1842365e8753802dffc3b716e7a1fb9d6e81f6a322a1d892ba8d4798d6826e0ebe3397cbaf389ad1b23920a67e1d69499b52bb5041d68d66564f8b073ef708236a895c0400ba705759676648e81bfdd2b276011f8351b202a23bb65720c6633674dd0e25000cf48bf3f59e1987ad2d13d18abe547b0beedee4b4efa0be8568475120aa01ceecbc5f522e444f60cb4b04607b0e4e7904c13927a5593dfdb4ee2c05a886cd59277e4c44b43c2291c9badf4daabc49a7b9c00e63c366ec20947cf2686097f608d739b432e870f7576fd5aa8a9627462a7cfa2df564ab0ab922f3a893a45dda2ee4dfc1101692d1933803187712995a2c928982f8c5b4c913f5fd154afa70623e7f1f34df4f4cb636c961a3429c70e8cb11e4d95cc974f9c2cf65596c56892712dbd271b48f7dba9a41efd3639f36c5134b79ee22d77fb444066e2639a06e9e7f56cc2407a7bcd97e86e2022c0ff2268f1744f4c0f965e996f09de28cbdadcbc44c6b4991e3ea45e2b175293588cc52d17c23e7a8ca7ba96d33715dfd4a68f70df435eded799e53756cb9a04eeaa1623e5fb4093df022937c54064d4e481437cd74e03632f6592839e2cb62f5074055c681e7eea9c91bd3cffde1c95829345c4c62fe9407860768f03174239b52e03d80c242d182601089610bb7ab1c2e0a14fa7aeeca91fe04f3bb8f7f050922e886e501894ac69f67f20f5282985446c80bba6639f76b42fb74b9930bf3bb8f6991af4101cadd95311ddb6744281d0fe3917b8c28ca27ce9d26eddd5917e8a4d64bcce97d0d8aa35c7f5478eb4ba813741adbcda899522864b652fa6dd4d3cb874e4fda187c0a66ccfe94b631fb45636d797a0f4443b7780f4d8b928d0c638360cf6c9cde25d7d87cc0c750c0345dcd547b8b6b4ed620c870fac6d77d0cafb89ba9cd9a5b8b3c7981dc4a7d902329abefa11cafb70d71a3390baf7926b9c45067988880778371e84d79ef9d18403f042d4161bb0ddbe448e2a380fd10b253177eaf683a41e249f726c5ee5878c6444553ae2a3c229400c6af7055ac1018262b7c8318bcb31570ea3c02a7aabb84ad8ff042ad634dceff02c1f8bcca31d043119070c57b759cbad12e1c083585735353867169e9f533b34e8c888cb011cebe45560d0d76ba1d2ed2d95649e185ecbc467e052fabab8e231d75efb85890625e416da1ad6450a15f07f177ac5010b8cf432ec5cd6f0ef8cc571c02c7f6597397b54c398a5ee9a10d2c72d11cf1ebfa62edaa73ab3e0e93b455931702b72423d3949267c7045a70ada07cb50135fdb6ac1e561a009abe6332f952ff622c80bd331cd17eb860a37806d78cd0fb4c5bb376711b2ce5f3c908675c2d302b64c64ec90c57febe85a2b5a55ff150d6f15b0efdbb0e8ba49d272e5be74b9c32a8f8c6b0e5a7920ede465f85235a2bc45cfa5f603b624af8f9f3e50cc91376e4730cb08ceee5b7c39552f7971ad591f59d938af9786ddcd2c3107d23c23a1e4d7d5920c634900634abba7893c3d8ee94445b2dfdc9595187fc414b1c33c694e6c8e78f0ea5cc6406b9f6712d8a0f85413af1e5a9264d2808e65bbbe35b7baa0ab743cb4738d4dd06cf39ec8dfd74f7690b1e77837b46c8c6b329106faa5260ae7508d49e3938765d294c983610d5e790ed02cc3647ae6e356f9ead991256cfaf6f09d082346ca6f51817c9c9fef7e7b59328c521a1954b8dfda45bf0152517628959bf36d74188c8c319a1e0e41df581eb99241c1d87e26a0c5cc27d165ab72753fd0bc69865db26002864a7dcc39519c3cc22729f87c441c5ecb803be2e09a4eb15beafc8d4eaca6f7c65cd5a420213fdb34cb5b92f4672d170363f7abe558e064fe7a17828d51714a6597549882977c6439d6619e3ba43563fbb3e42342e9aa55d8258794c720e3b11b13658356d3fa14d951fffe77ac75487f573ef83cb4f730a34f63a9612a47d83168c127783e0902b971ecdaa3dc6fc02ec3b1a8601a87bdaddbdd989543e80d058e348019b423462c51a1d3e672208b770b5ac008d3f2050600da4e95cd28511feb48a8a021fbf27d813b0f93a150410e320e501bede0f07c07b6dda20aa779eb18863e741084e83bbace04aedc7d756cef673fc1faca50e6cb8ae854fe7c57d0a63facb5bec250aaa291db26576e4635b5efadc26c29a81ff3e431d3f25e53df290908f2a56ff9e8c30cbf4b9de9478e4c1fb8a6e67da4c7c580cb8eecc1486169631ca9446e9154da2af03cd733e420241c0e5bbd1708df4830dabf1998ab5c5de996ef88a9504bebdbbc4456b01201e7b49ce1ae14b52d98304b6ab10194c1e1048807968e3fd04ac641669d6b4fba7d8c731c50139b1f1cbafd3dee9817496af13081a4604a8d7a6162b11507fcced8ba9dde76329c3716ae78145211979e5fac53142c83006fa875bccf1432d40f5592f3595b9638b6e11e88e00094ef09ee194dd6bcafc878a3bc136a0d3d3870e5cdac395b7112222f4e457a817146f8ddfcc5b8c0caf7144b4671dbabe8673161cb9c97bcaf6f58cde95c4a87d8dae2c5955e291baea5fa2a0d48eab3dc9412e08b6a8f2b4b0bfd5637254bd7cf83658c8def10c5900fe689ae0ee22fa28d7042cf0e9f1e844f4dbe5088b2acd9ba3eadf0556ff7e9d92ff930ad2edb68543b9840da312e4a053b48691a58fb4e866ee78be4be21895980792b34b287c814f8b"}, @NL80211_ATTR_VENDOR_SUBCMD={0x8, 0xc4, 0x6914}, @NL80211_ATTR_VENDOR_DATA={0x64, 0xc5, "f0a88c44d7180aae6a1734293db3d9e442a3c0a3860151f388394c62310245c1171c88b0bee27051624999a80fedd47e9180b5d365fd341e6d706fc744cd07d1b31525e5faa93cbb2655fc0b3b2cb8679686e6a4da4463c4167421a42b6b565d"}, @NL80211_ATTR_VENDOR_ID={0x8}, @NL80211_ATTR_VENDOR_ID={0x8, 0xc3, 0x3}, @NL80211_ATTR_VENDOR_DATA={0xec, 0xc5, "9dc4ef40d08427a0a6bce93af1cf093dd8cfd9ac8e71ce125b14c0a1c1aada107af53922dc7bc992f0f7b140386b6bb6ae5f1b94d3c72dccc4fd9db1686cb7171f2fd6e877323afef84cd617f2ee1df9986d010e30f601e4bb2b1899009cd143b149f7d2f478d3491338fa12832c84807b4a84232ccc28e9032cb2bc6412f0134aa1173d0297e5bd6363e4f895056d4e81a1ad6cc07e4f31d61bc11819385a26b6a003a1eaee1b4d47dccd38c46143bc1538f43b6d80ac4b14dcf968da8942e726fd7262e5c61f3554f8fa64b2d711614b8743246a6e1c943897b44fd7d6c6590f9a0fd671a2eb40"}, @NL80211_ATTR_VENDOR_SUBCMD={0x8, 0xc4, 0x7}]}, 0x1198}, 0x1, 0x0, 0x0, 0x24008044}, 0x20040000) sendmsg$NL80211_CMD_SET_COALESCE(r6, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000b00)={&(0x7f0000000280)=ANY=[@ANYBLOB='$\x00\x00\x00', @ANYRES16=r7, @ANYBLOB="010000004000ffffffff0200000008000300", @ANYRES32=r9, @ANYBLOB="080002002e"], 0x24}, 0x1, 0x6c00, 0x0, 0x4d080}, 0x0) 0s ago: executing program 0 (id=3861): r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000001c0)=ANY=[@ANYBLOB="c40000001900674c2cbd70000000000000000000000000000000000000000000ac1eff0100000000000000000000000000000000000000000a00000000000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="0100000000000000000000000000000000000020000000000000000000000000000000000000000000008000000000000000000000000000fcffffffffffffff0000000000000000b0ac00000000000000000000000000000000000000000000000400000000000000000002000000000a00100001"], 0xc4}, 0x1, 0x0, 0x0, 0x4002004}, 0x4c050) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000280), 0x40241, 0x0) r2 = socket$nl_xfrm(0x10, 0x3, 0x6) setsockopt$inet_IP_IPSEC_POLICY(0xffffffffffffffff, 0x0, 0x10, 0x0, 0x0) sendmsg$nl_xfrm(r2, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000380)=@newpolicy={0x17c, 0x13, 0x101, 0x0, 0x0, {{@in6=@initdev={0xfe, 0x88, '\x00', 0x1, 0x0}, @in=@empty, 0x4e20, 0xd, 0x400, 0x9, 0xa}, {0x2, 0x0, 0x0, 0x0, 0x6, 0x3, 0x5, 0x8}, {0x0, 0x1, 0x0, 0x100}, 0x8}, [@tmpl={0xc4, 0x5, [{{@in6=@rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02', 0x4d2, 0x2b}, 0xa, @in=@rand_addr=0x64010100, 0x0, 0x1, 0x1, 0x1, 0x5, 0x2, 0x80000009}, {{@in6=@initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, 0x4d4, 0x32}, 0xa, @in=@empty, 0x0, 0x2, 0x2, 0x3, 0x0, 0x2, 0x6}, {{@in=@multicast2, 0x4d4, 0x2b}, 0xa, @in=@rand_addr=0x64010100, 0x0, 0x4, 0x0, 0x3, 0xfffffff9, 0x103ff, 0xd9}]}]}, 0x17c}, 0x1, 0x0, 0x0, 0x20048000}, 0x4000840) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000540)={'syzkaller1\x00', 0xc201}) r3 = socket$kcm(0x2, 0xa, 0x2) ioctl$SIOCSIFHWADDR(r3, 0x8914, &(0x7f0000000580)={'syzkaller1\x00', @link_local}) write$tun(r1, &(0x7f00000005c0)=ANY=[@ANYBLOB="034886dd010000000000140000006000000003082f00fe88a43de1a400000000070000007d01ff020000000000000000000000000001"], 0xfdef) kernel console output (not intermixed with test programs): d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 461.323807][T17665] RSP: 002b:00007fe5ec1d3028 EFLAGS: 00000246 ORIG_RAX: 000000000000012b [ 461.323828][T17665] RAX: ffffffffffffffda RBX: 00007fe5eb625fa0 RCX: 00007fe5eb3a8f19 [ 461.323841][T17665] RDX: 03fffffffffffe83 RSI: 00002000000018c0 RDI: 0000000000000003 [ 461.323854][T17665] RBP: 00007fe5ec1d3090 R08: 0000000000000000 R09: 0000000000000000 [ 461.323866][T17665] R10: 0000000000000002 R11: 0000000000000246 R12: 0000000000000002 [ 461.323878][T17665] R13: 00007fe5eb626038 R14: 00007fe5eb625fa0 R15: 00007ffdc8708658 [ 461.323911][T17665] [ 461.632864][ T4952] Bluetooth: hci4: command 0x041b tx timeout [ 461.658917][T17667] netlink: 32 bytes leftover after parsing attributes in process `syz.0.2946'. [ 461.763884][T17678] netlink: 4 bytes leftover after parsing attributes in process `syz.1.2948'. [ 461.849384][T17496] hsr_slave_0: entered promiscuous mode [ 461.850548][T17496] hsr_slave_1: entered promiscuous mode [ 461.851400][T17496] debugfs: 'hsr0' already exists in 'hsr' [ 461.851418][T17496] Cannot create hsr debugfs directory [ 462.186250][T17699] netlink: 12 bytes leftover after parsing attributes in process `syz.4.2950'. [ 462.186283][T17699] block nbd4: Unsupported socket: should be TCP or UNIX. [ 462.301211][T17704] netlink: 104 bytes leftover after parsing attributes in process `syz.3.2951'. [ 462.614673][T17714] gretap2: entered promiscuous mode [ 463.078076][T17729] FAULT_INJECTION: forcing a failure. [ 463.078076][T17729] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 463.078111][T17729] CPU: 1 UID: 0 PID: 17729 Comm: syz.4.2957 Not tainted syzkaller #0 PREEMPT(full) [ 463.078134][T17729] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 11/06/2026 [ 463.078146][T17729] Call Trace: [ 463.078155][T17729] [ 463.078165][T17729] dump_stack_lvl+0xe8/0x150 [ 463.078202][T17729] should_fail_ex+0x3eb/0x540 [ 463.078242][T17729] _copy_from_user+0x2d/0xb0 [ 463.078269][T17729] ___sys_recvmsg+0x173/0x5a0 [ 463.078301][T17729] ? __pfx____sys_recvmsg+0x10/0x10 [ 463.078329][T17729] ? lock_acquire+0x115/0x350 [ 463.078388][T17729] do_recvmmsg+0x31a/0x800 [ 463.078423][T17729] ? __pfx_do_recvmmsg+0x10/0x10 [ 463.078461][T17729] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 463.078493][T17729] ? fdget+0x1ac/0x250 [ 463.078527][T17729] __x64_sys_recvmmsg+0x198/0x250 [ 463.078555][T17729] ? __pfx___x64_sys_recvmmsg+0x10/0x10 [ 463.078594][T17729] do_syscall_64+0x166/0x520 [ 463.078618][T17729] ? trace_irq_disable+0x3b/0x140 [ 463.078645][T17729] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 463.078666][T17729] ? clear_bhb_loop+0x70/0xc0 [ 463.078693][T17729] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 463.078714][T17729] RIP: 0033:0x7f44edda8f19 [ 463.078733][T17729] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 463.078751][T17729] RSP: 002b:00007f44eeb7f028 EFLAGS: 00000246 ORIG_RAX: 000000000000012b [ 463.078775][T17729] RAX: ffffffffffffffda RBX: 00007f44ee025fa0 RCX: 00007f44edda8f19 [ 463.078790][T17729] RDX: 03fffffffffffe83 RSI: 00002000000018c0 RDI: 0000000000000003 [ 463.078804][T17729] RBP: 00007f44eeb7f090 R08: 0000000000000000 R09: 0000000000000000 [ 463.078816][T17729] R10: 0000000000000002 R11: 0000000000000246 R12: 0000000000000002 [ 463.078829][T17729] R13: 00007f44ee026038 R14: 00007f44ee025fa0 R15: 00007fff5ea906b8 [ 463.078863][T17729] [ 463.135613][T17734] netlink: 67 bytes leftover after parsing attributes in process `syz.3.2958'. [ 463.218576][ T5296] 8021q: adding VLAN 0 to HW filter on device eth2 [ 463.673057][T17747] netlink: 36 bytes leftover after parsing attributes in process `syz.4.2959'. [ 463.700220][ T4952] Bluetooth: hci4: command 0x041b tx timeout [ 464.165673][T17766] batadv_slave_1: entered allmulticast mode [ 465.170921][T17797] ip_tables: iptables: counters copy to user failed while replacing table [ 465.258963][T17796] netlink: 2 bytes leftover after parsing attributes in process `syz.1.2967'. [ 465.513810][ T6954] hsr_slave_0: left promiscuous mode [ 465.516368][ T6954] hsr_slave_1: left promiscuous mode [ 465.517692][ T6954] batman_adv: batadv0: Interface deactivated: veth0 [ 465.517732][ T6954] batman_adv: batadv0: Removing interface: veth0 [ 465.574512][ T6954] veth1_macvtap: left promiscuous mode [ 465.574665][ T6954] veth0_macvtap: left promiscuous mode [ 465.574838][ T6954] veth1_vlan: left promiscuous mode [ 465.687505][T17815] FAULT_INJECTION: forcing a failure. [ 465.687505][T17815] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 465.687542][T17815] CPU: 1 UID: 0 PID: 17815 Comm: syz.4.2968 Not tainted syzkaller #0 PREEMPT(full) [ 465.687565][T17815] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 11/06/2026 [ 465.687578][T17815] Call Trace: [ 465.687587][T17815] [ 465.687596][T17815] dump_stack_lvl+0xe8/0x150 [ 465.687634][T17815] should_fail_ex+0x3eb/0x540 [ 465.687665][T17815] _copy_from_user+0x2d/0xb0 [ 465.687699][T17815] ___sys_recvmsg+0x173/0x5a0 [ 465.687732][T17815] ? __pfx____sys_recvmsg+0x10/0x10 [ 465.687761][T17815] ? lock_acquire+0x115/0x350 [ 465.687821][T17815] do_recvmmsg+0x31a/0x800 [ 465.687859][T17815] ? __pfx_do_recvmmsg+0x10/0x10 [ 465.687897][T17815] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 465.687928][T17815] ? fdget+0x1ac/0x250 [ 465.687961][T17815] __x64_sys_recvmmsg+0x198/0x250 [ 465.687990][T17815] ? __pfx___x64_sys_recvmmsg+0x10/0x10 [ 465.688027][T17815] do_syscall_64+0x166/0x520 [ 465.688052][T17815] ? trace_irq_disable+0x3b/0x140 [ 465.688078][T17815] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 465.688099][T17815] ? clear_bhb_loop+0x70/0xc0 [ 465.688123][T17815] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 465.688144][T17815] RIP: 0033:0x7f44edda8f19 [ 465.688164][T17815] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 465.688180][T17815] RSP: 002b:00007f44eeb7f028 EFLAGS: 00000246 ORIG_RAX: 000000000000012b [ 465.688202][T17815] RAX: ffffffffffffffda RBX: 00007f44ee025fa0 RCX: 00007f44edda8f19 [ 465.688218][T17815] RDX: 03fffffffffffe83 RSI: 00002000000018c0 RDI: 0000000000000003 [ 465.688231][T17815] RBP: 00007f44eeb7f090 R08: 0000000000000000 R09: 0000000000000000 [ 465.688244][T17815] R10: 0000000000000002 R11: 0000000000000246 R12: 0000000000000002 [ 465.688256][T17815] R13: 00007f44ee026038 R14: 00007f44ee025fa0 R15: 00007fff5ea906b8 [ 465.688290][T17815] [ 465.789772][ T5636] Bluetooth: hci4: command 0x041b tx timeout [ 465.900728][T17822] netlink: 16 bytes leftover after parsing attributes in process `syz.4.2970'. [ 466.875584][ T6954] team0 (unregistering): Port device vlan0 removed [ 467.074131][ T7420] smbdirect: ib_dev[syz2] removed [ 467.335803][T17496] netdevsim netdevsim2 netdevsim0: renamed from eth0 [ 467.347427][ T4952] block nbd4: Receive control failed (result -32) [ 467.360708][T17496] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 467.361771][T17496] netdevsim netdevsim2 netdevsim1: renamed from eth1 [ 467.416581][T17496] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 467.426131][T17496] netdevsim netdevsim2 netdevsim2: renamed from eth2 [ 467.466310][T17496] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 467.469982][T17496] netdevsim netdevsim2 netdevsim3: renamed from eth3 [ 467.498358][T17496] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 467.856646][T17496] 8021q: adding VLAN 0 to HW filter on device bond0 [ 467.926532][T17496] 8021q: adding VLAN 0 to HW filter on device team0 [ 467.932722][ T6954] IPVS: stop unused estimator thread 0... [ 467.943020][T13289] bridge0: port 1(bridge_slave_0) entered blocking state [ 467.943134][T13289] bridge0: port 1(bridge_slave_0) entered forwarding state [ 467.954405][T13289] bridge0: port 2(bridge_slave_1) entered blocking state [ 467.954512][T13289] bridge0: port 2(bridge_slave_1) entered forwarding state [ 468.480810][T17866] smbdirect: ib_dev[syz1]: added: RNIC max_fast_reg_page_list_len=256 device_cap_flags=0x200000 kernel_cap_flags=0x10 page_size_cap=0x1000 [ 468.480846][T17866] smbdirect: ib_dev[syz1]: num_ports=1 max_qp_rd_atom=128 max_qp_init_rd_atom=128 max_sgl_rd=0 max_sge_rd=1 max_cqe=3276800 max_qp_wr=32768 max_send_sge=6 max_recv_sge=6 [ 468.480914][T17866] smbdirect: ib_dev[syz1]PORT[1]: iwarp=1 ib=0 roce=0 v1=0 v2=0 core_cap_flags=0x400008 [ 468.528711][T17864] netlink: 'syz.1.2976': attribute type 2 has an invalid length. [ 468.528734][T17864] netlink: 224 bytes leftover after parsing attributes in process `syz.1.2976'. [ 468.851113][T17882] hsr0 speed is unknown, defaulting to 1000 [ 468.851205][T17882] hsr0 speed is unknown, defaulting to 1000 [ 468.874042][T17882] hsr0 speed is unknown, defaulting to 1000 [ 468.875063][T17882] smbdirect: ib_dev[syz2]: added: RNIC max_fast_reg_page_list_len=256 device_cap_flags=0x200000 kernel_cap_flags=0x10 page_size_cap=0x1000 [ 468.875092][T17882] smbdirect: ib_dev[syz2]: num_ports=1 max_qp_rd_atom=128 max_qp_init_rd_atom=128 max_sgl_rd=0 max_sge_rd=1 max_cqe=3276800 max_qp_wr=32768 max_send_sge=6 max_recv_sge=6 [ 468.875126][T17882] smbdirect: ib_dev[syz2]PORT[1]: iwarp=1 ib=0 roce=0 v1=0 v2=0 core_cap_flags=0x400008 [ 469.003235][T17882] hsr0 speed is unknown, defaulting to 1000 [ 469.006191][T17882] hsr0 speed is unknown, defaulting to 1000 [ 469.008203][T17882] hsr0 speed is unknown, defaulting to 1000 [ 469.033543][T17882] hsr0 speed is unknown, defaulting to 1000 [ 469.035685][T17882] hsr0 speed is unknown, defaulting to 1000 [ 469.037640][T17882] hsr0 speed is unknown, defaulting to 1000 [ 469.366477][T17908] netlink: 12 bytes leftover after parsing attributes in process `syz.0.2983'. [ 469.410217][T17910] netlink: 28 bytes leftover after parsing attributes in process `syz.4.2982'. [ 469.411098][T17904] openvswitch: netlink: Actions may not be safe on all matching packets [ 469.471525][T17911] netlink: 16 bytes leftover after parsing attributes in process `syz.1.2985'. [ 469.676380][T17496] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 469.855171][T17921] tipc: Failed to remove unknown binding: 66,0,0/2886997007:1800275646/1800275648 [ 469.855206][T17921] tipc: Failed to remove unknown binding: 66,0,0/2886997007:1800275646/1800275647 [ 469.855844][T17921] tipc: Failed to remove unknown binding: 66,0,0/2886997007:1800275646/1800275648 [ 469.855872][T17921] tipc: Failed to remove unknown binding: 66,0,0/2886997007:1800275646/1800275647 [ 469.888782][T17496] veth0_vlan: entered promiscuous mode [ 469.903729][T17919] netlink: 16 bytes leftover after parsing attributes in process `syz.1.2986'. [ 469.926461][T17496] veth1_vlan: entered promiscuous mode [ 470.176842][T17496] veth0_macvtap: entered promiscuous mode [ 470.206887][T17496] veth1_macvtap: entered promiscuous mode [ 470.373556][T17496] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 470.431634][T17496] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 470.477358][T17936] netlink: 8 bytes leftover after parsing attributes in process `syz.1.2990'. [ 470.477384][T17936] netlink: 24 bytes leftover after parsing attributes in process `syz.1.2990'. [ 470.500643][ T7420] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 470.522160][ T6954] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 470.522207][ T6954] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 470.522249][ T6954] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 470.594591][T17943] netlink: 12 bytes leftover after parsing attributes in process `syz.3.2992'. [ 470.775801][T17954] netlink: 16 bytes leftover after parsing attributes in process `syz.1.2994'. [ 470.787792][T17943] 8021q: adding VLAN 0 to HW filter on device bond12 [ 471.135281][ T6954] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 471.135310][ T6954] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 471.236088][T13288] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 471.236112][T13288] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 471.394224][T17970] netlink: 12 bytes leftover after parsing attributes in process `syz.3.2996'. [ 471.414381][T17977] netlink: 32 bytes leftover after parsing attributes in process `syz.1.2999'. [ 471.427884][T17978] FAULT_INJECTION: forcing a failure. [ 471.427884][T17978] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 471.427914][T17978] CPU: 1 UID: 0 PID: 17978 Comm: syz.4.2997 Not tainted syzkaller #0 PREEMPT(full) [ 471.427935][T17978] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 11/06/2026 [ 471.427947][T17978] Call Trace: [ 471.427955][T17978] [ 471.427964][T17978] dump_stack_lvl+0xe8/0x150 [ 471.427998][T17978] should_fail_ex+0x3eb/0x540 [ 471.428026][T17978] _copy_from_user+0x2d/0xb0 [ 471.428050][T17978] ___sys_recvmsg+0x173/0x5a0 [ 471.428077][T17978] ? __pfx____sys_recvmsg+0x10/0x10 [ 471.428103][T17978] ? lock_acquire+0x115/0x350 [ 471.428155][T17978] do_recvmmsg+0x31a/0x800 [ 471.428185][T17978] ? __pfx_do_recvmmsg+0x10/0x10 [ 471.428245][T17978] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 471.428274][T17978] ? fdget+0x1ac/0x250 [ 471.428303][T17978] __x64_sys_recvmmsg+0x198/0x250 [ 471.428328][T17978] ? __pfx___x64_sys_recvmmsg+0x10/0x10 [ 471.428361][T17978] do_syscall_64+0x166/0x520 [ 471.428382][T17978] ? trace_irq_disable+0x3b/0x140 [ 471.428405][T17978] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 471.428423][T17978] ? clear_bhb_loop+0x70/0xc0 [ 471.428446][T17978] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 471.428463][T17978] RIP: 0033:0x7f44edda8f19 [ 471.428481][T17978] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 471.428497][T17978] RSP: 002b:00007f44eeb7f028 EFLAGS: 00000246 ORIG_RAX: 000000000000012b [ 471.428518][T17978] RAX: ffffffffffffffda RBX: 00007f44ee025fa0 RCX: 00007f44edda8f19 [ 471.428531][T17978] RDX: 03fffffffffffe83 RSI: 00002000000018c0 RDI: 0000000000000003 [ 471.428544][T17978] RBP: 00007f44eeb7f090 R08: 0000000000000000 R09: 0000000000000000 [ 471.428556][T17978] R10: 0000000000000002 R11: 0000000000000246 R12: 0000000000000002 [ 471.428567][T17978] R13: 00007f44ee026038 R14: 00007f44ee025fa0 R15: 00007fff5ea906b8 [ 471.428598][T17978] [ 472.354239][T18011] x_tables: ip6_tables: rpfilter match: used from hooks OUTPUT, but only valid from PREROUTING [ 472.428196][T18008] syzkaller0: entered promiscuous mode [ 472.428222][T18008] syzkaller0: entered allmulticast mode [ 472.571378][ T5636] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 472.587670][ T5636] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 472.594119][ T5636] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 472.596362][ T5636] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 472.600401][ T5636] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 472.885776][T18032] FAULT_INJECTION: forcing a failure. [ 472.885776][T18032] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 472.885809][T18032] CPU: 1 UID: 0 PID: 18032 Comm: syz.1.3011 Not tainted syzkaller #0 PREEMPT(full) [ 472.885831][T18032] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 11/06/2026 [ 472.885842][T18032] Call Trace: [ 472.885851][T18032] [ 472.885860][T18032] dump_stack_lvl+0xe8/0x150 [ 472.885898][T18032] should_fail_ex+0x3eb/0x540 [ 472.885926][T18032] _copy_from_user+0x2d/0xb0 [ 472.885952][T18032] ___sys_recvmsg+0x173/0x5a0 [ 472.885983][T18032] ? __pfx____sys_recvmsg+0x10/0x10 [ 472.886011][T18032] ? lock_acquire+0x115/0x350 [ 472.886071][T18032] do_recvmmsg+0x31a/0x800 [ 472.886105][T18032] ? __pfx_do_recvmmsg+0x10/0x10 [ 472.886140][T18032] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 472.886173][T18032] ? fdget+0x1ac/0x250 [ 472.886206][T18032] __x64_sys_recvmmsg+0x198/0x250 [ 472.886344][T18032] ? __pfx___x64_sys_recvmmsg+0x10/0x10 [ 472.886391][T18032] do_syscall_64+0x166/0x520 [ 472.886414][T18032] ? trace_irq_disable+0x3b/0x140 [ 472.886440][T18032] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 472.886460][T18032] ? clear_bhb_loop+0x70/0xc0 [ 472.886485][T18032] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 472.886503][T18032] RIP: 0033:0x7fe5eb3a8f19 [ 472.886523][T18032] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 472.886539][T18032] RSP: 002b:00007fe5ec1d3028 EFLAGS: 00000246 ORIG_RAX: 000000000000012b [ 472.886566][T18032] RAX: ffffffffffffffda RBX: 00007fe5eb625fa0 RCX: 00007fe5eb3a8f19 [ 472.886580][T18032] RDX: 03fffffffffffe83 RSI: 00002000000018c0 RDI: 0000000000000003 [ 472.886593][T18032] RBP: 00007fe5ec1d3090 R08: 0000000000000000 R09: 0000000000000000 [ 472.886605][T18032] R10: 0000000000000002 R11: 0000000000000246 R12: 0000000000000002 [ 472.886617][T18032] R13: 00007fe5eb626038 R14: 00007fe5eb625fa0 R15: 00007ffdc8708658 [ 472.886649][T18032] [ 473.366040][T18049] netlink: 'syz.0.3014': attribute type 11 has an invalid length. [ 473.380860][T18052] syzkaller0: entered promiscuous mode [ 473.380885][T18052] syzkaller0: entered allmulticast mode [ 473.403179][T18052] IPv6: NLM_F_CREATE should be specified when creating new route [ 473.424892][T18049] bond0: left promiscuous mode [ 473.424917][T18049] bond_slave_0: left promiscuous mode [ 473.425203][T18049] ¬0Ù: left promiscuous mode [ 473.428514][T18049] gretap0: left promiscuous mode [ 473.455089][T18049] dummy0: left promiscuous mode [ 473.491291][T18054] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 473.622997][T18049] bond0: entered promiscuous mode [ 473.623022][T18049] bond_slave_0: entered promiscuous mode [ 473.623256][T18049] ¬0Ù: entered promiscuous mode [ 473.637073][T18049] gretap0: entered promiscuous mode [ 473.637912][T18049] dummy0: entered promiscuous mode [ 473.677608][T18049] debugfs: 'hsr0' already exists in 'hsr' [ 473.677632][T18049] Cannot create hsr debugfs directory [ 474.007805][T18065] netlink: 'syz.3.3016': attribute type 4 has an invalid length. [ 474.218322][T18087] netlink: 'syz.2.3020': attribute type 4 has an invalid length. [ 474.277784][T18089] sock: sock_timestamping_bind_phc: sock not bind to device [ 474.305051][T18022] rxe_eth0 speed is unknown, defaulting to 1000 [ 474.444352][T18091] FAULT_INJECTION: forcing a failure. [ 474.444352][T18091] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 474.444385][T18091] CPU: 1 UID: 0 PID: 18091 Comm: syz.1.3022 Not tainted syzkaller #0 PREEMPT(full) [ 474.444406][T18091] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 11/06/2026 [ 474.444418][T18091] Call Trace: [ 474.444427][T18091] [ 474.444436][T18091] dump_stack_lvl+0xe8/0x150 [ 474.444473][T18091] should_fail_ex+0x3eb/0x540 [ 474.444502][T18091] _copy_from_user+0x2d/0xb0 [ 474.444528][T18091] ___sys_recvmsg+0x173/0x5a0 [ 474.444558][T18091] ? __pfx____sys_recvmsg+0x10/0x10 [ 474.444585][T18091] ? lock_acquire+0x115/0x350 [ 474.444640][T18091] do_recvmmsg+0x31a/0x800 [ 474.444684][T18091] ? __pfx_do_recvmmsg+0x10/0x10 [ 474.444719][T18091] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 474.444755][T18091] ? fdget+0x1ac/0x250 [ 474.444787][T18091] __x64_sys_recvmmsg+0x198/0x250 [ 474.444815][T18091] ? __pfx___x64_sys_recvmmsg+0x10/0x10 [ 474.444854][T18091] do_syscall_64+0x166/0x520 [ 474.444877][T18091] ? trace_irq_disable+0x3b/0x140 [ 474.444901][T18091] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 474.444921][T18091] ? clear_bhb_loop+0x70/0xc0 [ 474.444945][T18091] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 474.444965][T18091] RIP: 0033:0x7fe5eb3a8f19 [ 474.444986][T18091] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 474.445004][T18091] RSP: 002b:00007fe5ec1d3028 EFLAGS: 00000246 ORIG_RAX: 000000000000012b [ 474.445027][T18091] RAX: ffffffffffffffda RBX: 00007fe5eb625fa0 RCX: 00007fe5eb3a8f19 [ 474.445042][T18091] RDX: 03fffffffffffe83 RSI: 00002000000018c0 RDI: 0000000000000003 [ 474.445056][T18091] RBP: 00007fe5ec1d3090 R08: 0000000000000000 R09: 0000000000000000 [ 474.445068][T18091] R10: 0000000000000002 R11: 0000000000000246 R12: 0000000000000002 [ 474.445080][T18091] R13: 00007fe5eb626038 R14: 00007fe5eb625fa0 R15: 00007ffdc8708658 [ 474.445115][T18091] [ 474.750827][ T5636] Bluetooth: hci3: command tx timeout [ 475.137676][T18122] syzkaller0: entered promiscuous mode [ 475.137702][T18122] syzkaller0: entered allmulticast mode [ 475.165659][T18122] IPv6: NLM_F_CREATE should be specified when creating new route [ 475.333880][T18022] lo speed is unknown, defaulting to 1000 [ 475.377088][T18131] openvswitch: netlink: Actions may not be safe on all matching packets [ 475.652588][T18141] __nla_validate_parse: 4 callbacks suppressed [ 475.652611][T18141] netlink: 24 bytes leftover after parsing attributes in process `syz.1.3030'. [ 475.761506][T18141] bridge0: port 3(syz_tun) entered blocking state [ 475.761645][T18141] bridge0: port 3(syz_tun) entered disabled state [ 475.761815][T18141] syz_tun: entered allmulticast mode [ 475.777393][T18141] syz_tun: entered promiscuous mode [ 475.785938][T18141] bridge0: port 3(syz_tun) entered blocking state [ 475.786060][T18141] bridge0: port 3(syz_tun) entered forwarding state [ 475.826105][T18141] netlink: 20 bytes leftover after parsing attributes in process `syz.1.3030'. [ 476.041370][T18022] hsr0 speed is unknown, defaulting to 1000 [ 476.284877][T18168] FAULT_INJECTION: forcing a failure. [ 476.284877][T18168] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 476.284910][T18168] CPU: 0 UID: 0 PID: 18168 Comm: syz.3.3034 Not tainted syzkaller #0 PREEMPT(full) [ 476.284936][T18168] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 11/06/2026 [ 476.284948][T18168] Call Trace: [ 476.284956][T18168] [ 476.284966][T18168] dump_stack_lvl+0xe8/0x150 [ 476.285002][T18168] should_fail_ex+0x3eb/0x540 [ 476.285032][T18168] _copy_from_user+0x2d/0xb0 [ 476.285056][T18168] ___sys_recvmsg+0x173/0x5a0 [ 476.285086][T18168] ? __pfx____sys_recvmsg+0x10/0x10 [ 476.285113][T18168] ? lock_acquire+0x115/0x350 [ 476.285165][T18168] do_recvmmsg+0x31a/0x800 [ 476.285199][T18168] ? __pfx_do_recvmmsg+0x10/0x10 [ 476.285233][T18168] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 476.285265][T18168] ? fdget+0x1ac/0x250 [ 476.285306][T18168] __x64_sys_recvmmsg+0x198/0x250 [ 476.285332][T18168] ? __pfx___x64_sys_recvmmsg+0x10/0x10 [ 476.285370][T18168] do_syscall_64+0x166/0x520 [ 476.285393][T18168] ? trace_irq_disable+0x3b/0x140 [ 476.285419][T18168] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 476.285439][T18168] ? clear_bhb_loop+0x70/0xc0 [ 476.285465][T18168] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 476.285484][T18168] RIP: 0033:0x7f8794fa8f19 [ 476.285505][T18168] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 476.285523][T18168] RSP: 002b:00007f8795e8b028 EFLAGS: 00000246 ORIG_RAX: 000000000000012b [ 476.285547][T18168] RAX: ffffffffffffffda RBX: 00007f8795225fa0 RCX: 00007f8794fa8f19 [ 476.285562][T18168] RDX: 03fffffffffffe83 RSI: 00002000000018c0 RDI: 0000000000000003 [ 476.285576][T18168] RBP: 00007f8795e8b090 R08: 0000000000000000 R09: 0000000000000000 [ 476.285588][T18168] R10: 0000000000000002 R11: 0000000000000246 R12: 0000000000000002 [ 476.285599][T18168] R13: 00007f8795226038 R14: 00007f8795225fa0 R15: 00007ffff1a484b8 [ 476.285631][T18168] [ 476.390143][T18176] xt_hashlimit: size too large, truncated to 1048576 [ 476.542884][T18177] vxlan0: entered promiscuous mode [ 476.570190][T13293] netdevsim netdevsim1 netdevsim0: set [0, 0] type 1 family 0 port 8472 - 0 [ 476.570336][T13293] netdevsim netdevsim1 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0 [ 476.570411][T13293] netdevsim netdevsim1 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0 [ 476.570548][T13293] netdevsim netdevsim1 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0 [ 476.820938][ T5636] Bluetooth: hci3: command tx timeout [ 476.978199][T18193] netlink: 164 bytes leftover after parsing attributes in process `syz.2.3037'. [ 476.978458][T18193] netlink: 36 bytes leftover after parsing attributes in process `syz.2.3037'. [ 477.041891][T18022] bridge0: port 1(bridge_slave_0) entered blocking state [ 477.042638][T18022] bridge0: port 1(bridge_slave_0) entered disabled state [ 477.042796][T18022] bridge_slave_0: entered allmulticast mode [ 477.045360][T18022] bridge_slave_0: entered promiscuous mode [ 477.086350][T18022] bridge0: port 2(bridge_slave_1) entered blocking state [ 477.086417][T18022] bridge0: port 2(bridge_slave_1) entered disabled state [ 477.086519][T18022] bridge_slave_1: entered allmulticast mode [ 477.100102][T18022] bridge_slave_1: entered promiscuous mode [ 477.145692][T18022] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 477.164416][T18022] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 477.243038][T18022] team0: Port device team_slave_0 added [ 477.257693][T18022] team0: Port device team_slave_1 added [ 477.312687][T18022] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 477.312707][T18022] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 477.312734][T18022] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 477.313631][T18204] ip_tables: iptables: counters copy to user failed while replacing table [ 477.315201][T18022] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 477.315216][T18022] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 477.315240][T18022] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 477.477391][T18022] hsr_slave_0: entered promiscuous mode [ 477.478131][T18022] hsr_slave_1: entered promiscuous mode [ 477.478797][T18022] debugfs: 'hsr0' already exists in 'hsr' [ 477.478814][T18022] Cannot create hsr debugfs directory [ 477.482532][T18207] syzkaller0: entered promiscuous mode [ 477.482552][T18207] syzkaller0: entered allmulticast mode [ 477.817423][T18213] openvswitch: netlink: Actions may not be safe on all matching packets [ 477.841041][T18022] netdevsim netdevsim4 eth3 (unregistering): unset [1, 0] type 2 family 0 port 36348 - 0 [ 477.938624][T18022] netdevsim netdevsim4 eth2 (unregistering): unset [1, 0] type 2 family 0 port 36348 - 0 [ 477.978963][T18217] pimreg0: tun_chr_ioctl cmd 1074025673 [ 477.979067][T18217] pimreg0: tun_chr_ioctl cmd 1074025673 [ 477.980037][T18216] pimreg0: tun_chr_ioctl cmd 2148560645 [ 477.980133][T18216] pimreg0: tun_chr_ioctl cmd 2148560645 [ 477.980212][T18216] pimreg0: tun_chr_ioctl cmd 2148560645 [ 477.980293][T18216] pimreg0: tun_chr_ioctl cmd 2148560645 [ 477.980372][T18216] pimreg0: tun_chr_ioctl cmd 2148560645 [ 477.980450][T18216] pimreg0: tun_chr_ioctl cmd 2148560645 [ 477.980529][T18216] pimreg0: tun_chr_ioctl cmd 2148560645 [ 477.980611][T18216] pimreg0: tun_chr_ioctl cmd 2148560645 [ 477.980689][T18216] pimreg0: tun_chr_ioctl cmd 2148560645 [ 477.980783][T18216] pimreg0: tun_chr_ioctl cmd 2148560645 [ 477.980863][T18216] pimreg0: tun_chr_ioctl cmd 2148560645 [ 477.980942][T18216] pimreg0: tun_chr_ioctl cmd 2148560645 [ 477.981060][T18216] pimreg0: tun_chr_ioctl cmd 2148560645 [ 477.981152][T18216] pimreg0: tun_chr_ioctl cmd 2148560645 [ 477.981233][T18216] pimreg0: tun_chr_ioctl cmd 2148560645 [ 477.981755][T18216] pimreg0: tun_chr_ioctl cmd 2148560645 [ 477.981834][T18216] pimreg0: tun_chr_ioctl cmd 2148560645 [ 477.983570][T18217] pimreg0: tun_chr_ioctl cmd 1074025673 [ 477.983671][T18217] pimreg0: tun_chr_ioctl cmd 1074025673 [ 477.983751][T18217] pimreg0: tun_chr_ioctl cmd 1074025673 [ 477.983834][T18217] pimreg0: tun_chr_ioctl cmd 1074025673 [ 477.983912][T18217] pimreg0: tun_chr_ioctl cmd 1074025673 [ 477.983993][T18217] pimreg0: tun_chr_ioctl cmd 1074025673 [ 477.984197][T18217] pimreg0: tun_chr_ioctl cmd 1074025673 [ 477.984285][T18217] pimreg0: tun_chr_ioctl cmd 1074025673 [ 477.984363][T18217] pimreg0: tun_chr_ioctl cmd 1074025673 [ 477.984460][T18217] pimreg0: tun_chr_ioctl cmd 1074025673 [ 477.984540][T18217] pimreg0: tun_chr_ioctl cmd 1074025673 [ 477.984622][T18217] pimreg0: tun_chr_ioctl cmd 1074025673 [ 477.984700][T18217] pimreg0: tun_chr_ioctl cmd 1074025673 [ 477.984779][T18217] pimreg0: tun_chr_ioctl cmd 1074025673 [ 477.984868][T18218] pimreg0: tun_chr_ioctl cmd 1074025677 [ 477.984948][T18218] pimreg0: linktype set to 776 [ 477.985247][T18218] pimreg0: tun_chr_ioctl cmd 1074025677 [ 477.985292][T18218] pimreg0: linktype set to 776 [ 477.985533][T18218] pimreg0: tun_chr_ioctl cmd 1074025677 [ 477.985583][T18218] pimreg0: linktype set to 776 [ 477.985805][T18218] pimreg0: tun_chr_ioctl cmd 1074025677 [ 477.985849][T18218] pimreg0: linktype set to 776 [ 477.986068][T18218] pimreg0: tun_chr_ioctl cmd 1074025677 [ 477.986111][T18218] pimreg0: linktype set to 776 [ 477.986337][T18218] pimreg0: tun_chr_ioctl cmd 1074025677 [ 477.986381][T18218] pimreg0: linktype set to 776 [ 477.986705][T18217] pimreg0: tun_chr_ioctl cmd 1074025673 [ 477.986787][T18217] pimreg0: tun_chr_ioctl cmd 1074025673 [ 477.986863][T18217] pimreg0: tun_chr_ioctl cmd 1074025673 [ 477.986938][T18217] pimreg0: tun_chr_ioctl cmd 1074025673 [ 477.987014][T18217] pimreg0: tun_chr_ioctl cmd 1074025673 [ 477.987094][T18217] pimreg0: tun_chr_ioctl cmd 1074025673 [ 477.987180][T18217] pimreg0: tun_chr_ioctl cmd 1074025673 [ 477.987256][T18217] pimreg0: tun_chr_ioctl cmd 1074025673 [ 477.987332][T18217] pimreg0: tun_chr_ioctl cmd 1074025673 [ 477.987411][T18217] pimreg0: tun_chr_ioctl cmd 1074025673 [ 477.987489][T18217] pimreg0: tun_chr_ioctl cmd 1074025673 [ 477.987565][T18217] pimreg0: tun_chr_ioctl cmd 1074025673 [ 477.987641][T18217] pimreg0: tun_chr_ioctl cmd 1074025673 [ 477.987875][T18216] pimreg0: tun_chr_ioctl cmd 2148560645 [ 477.987953][T18216] pimreg0: tun_chr_ioctl cmd 2148560645 [ 477.988029][T18216] pimreg0: tun_chr_ioctl cmd 2148560645 [ 477.988107][T18216] pimreg0: tun_chr_ioctl cmd 2148560645 [ 477.988192][T18216] pimreg0: tun_chr_ioctl cmd 2148560645 [ 477.988268][T18216] pimreg0: tun_chr_ioctl cmd 2148560645 [ 477.988344][T18216] pimreg0: tun_chr_ioctl cmd 2148560645 [ 477.988423][T18216] pimreg0: tun_chr_ioctl cmd 2148560645 [ 477.988499][T18216] pimreg0: tun_chr_ioctl cmd 2148560645 [ 477.988575][T18216] pimreg0: tun_chr_ioctl cmd 2148560645 [ 477.988652][T18216] pimreg0: tun_chr_ioctl cmd 2148560645 [ 477.988730][T18216] pimreg0: tun_chr_ioctl cmd 2148560645 [ 477.988910][T18218] pimreg0: tun_chr_ioctl cmd 1074025677 [ 477.988962][T18218] pimreg0: linktype set to 776 [ 477.989324][T18218] pimreg0: tun_chr_ioctl cmd 1074025677 [ 477.989371][T18218] pimreg0: linktype set to 776 [ 477.989593][T18218] pimreg0: tun_chr_ioctl cmd 1074025677 [ 477.989636][T18218] pimreg0: linktype set to 776 [ 477.993474][T18217] pimreg0: tun_chr_ioctl cmd 1074025673 [ 477.993561][T18217] pimreg0: tun_chr_ioctl cmd 1074025673 [ 477.993660][T18217] pimreg0: tun_chr_ioctl cmd 1074025673 [ 477.994179][T18216] pimreg0: tun_chr_ioctl cmd 2148560645 [ 477.994262][T18216] pimreg0: tun_chr_ioctl cmd 2148560645 [ 477.995387][T18218] pimreg0: tun_chr_ioctl cmd 1074025677 [ 477.995551][T18218] pimreg0: linktype set to 776 [ 477.995795][T18218] pimreg0: tun_chr_ioctl cmd 1074025677 [ 477.995855][T18218] pimreg0: linktype set to 776 [ 477.997914][T18216] pimreg0: tun_chr_ioctl cmd 2148560645 [ 477.998026][T18218] pimreg0: tun_chr_ioctl cmd 1074025677 [ 477.998077][T18218] pimreg0: linktype set to 776 [ 477.998347][T18218] pimreg0: tun_chr_ioctl cmd 1074025677 [ 477.998390][T18218] pimreg0: linktype set to 776 [ 477.998605][T18218] pimreg0: tun_chr_ioctl cmd 1074025677 [ 477.998646][T18218] pimreg0: linktype set to 776 [ 477.998972][T18218] pimreg0: tun_chr_ioctl cmd 1074025677 [ 477.999016][T18218] pimreg0: linktype set to 776 [ 477.999828][T18218] pimreg0: tun_chr_ioctl cmd 1074025677 [ 477.999984][T18218] pimreg0: linktype set to 776 [ 478.000583][T18218] pimreg0: tun_chr_ioctl cmd 1074025677 [ 478.000627][T18218] pimreg0: linktype set to 776 [ 478.000841][T18218] pimreg0: tun_chr_ioctl cmd 1074025677 [ 478.000884][T18218] pimreg0: linktype set to 776 [ 478.001209][T18218] pimreg0: tun_chr_ioctl cmd 1074025677 [ 478.001254][T18218] pimreg0: linktype set to 776 [ 478.001507][T18218] pimreg0: tun_chr_ioctl cmd 1074025677 [ 478.001551][T18218] pimreg0: linktype set to 776 [ 478.001792][T18218] pimreg0: tun_chr_ioctl cmd 1074025677 [ 478.001835][T18218] pimreg0: linktype set to 776 [ 478.002046][T18218] pimreg0: tun_chr_ioctl cmd 1074025677 [ 478.002195][T18218] pimreg0: linktype set to 776 [ 478.002449][T18218] pimreg0: tun_chr_ioctl cmd 1074025677 [ 478.002492][T18218] pimreg0: linktype set to 776 [ 478.002709][T18218] pimreg0: tun_chr_ioctl cmd 1074025677 [ 478.002754][T18218] pimreg0: linktype set to 776 [ 478.003089][T18218] pimreg0: tun_chr_ioctl cmd 1074025677 [ 478.003142][T18218] pimreg0: linktype set to 776 [ 478.003942][T18218] pimreg0: tun_chr_ioctl cmd 1074025677 [ 478.003989][T18218] pimreg0: linktype set to 776 [ 478.004232][T18218] pimreg0: tun_chr_ioctl cmd 1074025677 [ 478.004275][T18218] pimreg0: linktype set to 776 [ 478.004708][T18218] pimreg0: tun_chr_ioctl cmd 1074025677 [ 478.004753][T18218] pimreg0: linktype set to 776 [ 478.004969][T18218] pimreg0: tun_chr_ioctl cmd 1074025677 [ 478.005012][T18218] pimreg0: linktype set to 776 [ 478.005233][T18218] pimreg0: tun_chr_ioctl cmd 1074025677 [ 478.005277][T18218] pimreg0: linktype set to 776 [ 478.005639][T18218] pimreg0: tun_chr_ioctl cmd 1074025677 [ 478.005685][T18218] pimreg0: linktype set to 776 [ 478.005930][T18218] pimreg0: tun_chr_ioctl cmd 1074025677 [ 478.005973][T18218] pimreg0: linktype set to 776 [ 478.006195][T18218] pimreg0: tun_chr_ioctl cmd 1074025677 [ 478.006238][T18218] pimreg0: linktype set to 776 [ 478.029020][T18022] netdevsim netdevsim4 eth1 (unregistering): unset [1, 0] type 2 family 0 port 36348 - 0 [ 478.110685][T18022] netdevsim netdevsim4 eth0 (unregistering): unset [1, 0] type 2 family 0 port 36348 - 0 [ 478.577954][T18143] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 478.717945][T18022] netdevsim netdevsim4 netdevsim0: renamed from eth0 [ 478.756564][T18022] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 478.757457][T18022] netdevsim netdevsim4 netdevsim1: renamed from eth1 [ 478.796074][T18022] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 478.809840][T18022] netdevsim netdevsim4 netdevsim2: renamed from eth2 [ 478.839259][T18022] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 478.840577][T18022] netdevsim netdevsim4 netdevsim3: renamed from eth3 [ 478.873423][T18022] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 478.876251][T18228] netlink: 4 bytes leftover after parsing attributes in process `syz.2.3044'. [ 478.910592][ T5636] Bluetooth: hci3: command tx timeout [ 478.931110][T18228] 8021q: adding VLAN 0 to HW filter on device ipvlan2 [ 478.960517][T18239] netlink: 'syz.0.3047': attribute type 1 has an invalid length. [ 479.217244][T18022] 8021q: adding VLAN 0 to HW filter on device bond0 [ 479.296736][T18022] 8021q: adding VLAN 0 to HW filter on device team0 [ 479.324866][ T7420] bridge0: port 1(bridge_slave_0) entered blocking state [ 479.324973][ T7420] bridge0: port 1(bridge_slave_0) entered forwarding state [ 479.423075][T13294] bridge0: port 2(bridge_slave_1) entered blocking state [ 479.423262][T13294] bridge0: port 2(bridge_slave_1) entered forwarding state [ 479.506135][T18260] syzkaller0: entered promiscuous mode [ 479.506152][T18260] syzkaller0: entered allmulticast mode [ 479.855755][T18268] syzkaller0: entered promiscuous mode [ 479.855781][T18268] syzkaller0: entered allmulticast mode [ 480.223009][T18275] syzkaller1: entered promiscuous mode [ 480.223032][T18275] syzkaller1: entered allmulticast mode [ 480.383045][T18278] IPv6: sit3: Disabled Multicast RS [ 480.804630][T18310] ip_tables: iptables: counters copy to user failed while replacing table [ 480.806898][T18309] netlink: 'syz.3.3063': attribute type 1 has an invalid length. [ 480.865350][T18309] bond13: entered promiscuous mode [ 480.865853][T18309] 8021q: adding VLAN 0 to HW filter on device bond13 [ 480.942967][T18309] 8021q: adding VLAN 0 to HW filter on device bond13 [ 480.943438][T18309] bond13: (slave ip6gre1): The slave device specified does not support setting the MAC address [ 480.943461][T18309] bond13: (slave ip6gre1): Setting fail_over_mac to active for active-backup mode [ 480.985341][T18309] bond13: (slave ip6gre1): making interface the new active one [ 480.985369][T18309] ip6gre1: entered promiscuous mode [ 480.989893][ T4952] Bluetooth: hci3: command tx timeout [ 480.997684][ T5636] Bluetooth: hci0: Opcode 0x0c03 failed: -110 [ 481.020300][T18320] xt_hashlimit: size too large, truncated to 1048576 [ 481.023457][T18309] bond13: (slave ip6gre1): Enslaving as an active interface with an up link [ 481.081957][T18321] netlink: 64 bytes leftover after parsing attributes in process `syz.0.3064'. [ 481.175404][T18328] netlink: 64 bytes leftover after parsing attributes in process `syz.0.3064'. [ 481.402967][T18022] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 481.905887][T18343] FAULT_INJECTION: forcing a failure. [ 481.905887][T18343] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 481.905919][T18343] CPU: 1 UID: 0 PID: 18343 Comm: syz.0.3066 Not tainted syzkaller #0 PREEMPT(full) [ 481.905942][T18343] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 11/06/2026 [ 481.905954][T18343] Call Trace: [ 481.905963][T18343] [ 481.905971][T18343] dump_stack_lvl+0xe8/0x150 [ 481.906010][T18343] should_fail_ex+0x3eb/0x540 [ 481.906040][T18343] _copy_from_user+0x2d/0xb0 [ 481.906065][T18343] ___sys_recvmsg+0x173/0x5a0 [ 481.906103][T18343] ? __pfx____sys_recvmsg+0x10/0x10 [ 481.906131][T18343] ? lock_acquire+0x115/0x350 [ 481.906190][T18343] do_recvmmsg+0x31a/0x800 [ 481.906225][T18343] ? __pfx_do_recvmmsg+0x10/0x10 [ 481.906262][T18343] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 481.906300][T18343] ? fdget+0x1ac/0x250 [ 481.906335][T18343] __x64_sys_recvmmsg+0x198/0x250 [ 481.906364][T18343] ? __pfx___x64_sys_recvmmsg+0x10/0x10 [ 481.906403][T18343] do_syscall_64+0x166/0x520 [ 481.906428][T18343] ? trace_irq_disable+0x3b/0x140 [ 481.906455][T18343] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 481.906474][T18343] ? clear_bhb_loop+0x70/0xc0 [ 481.906499][T18343] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 481.906518][T18343] RIP: 0033:0x7f59733a8f19 [ 481.906538][T18343] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 481.906555][T18343] RSP: 002b:00007f5974320028 EFLAGS: 00000246 ORIG_RAX: 000000000000012b [ 481.906578][T18343] RAX: ffffffffffffffda RBX: 00007f5973625fa0 RCX: 00007f59733a8f19 [ 481.906591][T18343] RDX: 03fffffffffffe83 RSI: 00002000000018c0 RDI: 0000000000000003 [ 481.906602][T18343] RBP: 00007f5974320090 R08: 0000000000000000 R09: 0000000000000000 [ 481.906612][T18343] R10: 0000000000000002 R11: 0000000000000246 R12: 0000000000000002 [ 481.906625][T18343] R13: 00007f5973626038 R14: 00007f5973625fa0 R15: 00007ffdc8194f98 [ 481.906660][T18343] [ 482.767314][T18367] bond0: invalid flags given to default FDB implementation [ 482.883990][T18022] veth0_vlan: entered promiscuous mode [ 482.916387][T18022] veth1_vlan: entered promiscuous mode [ 483.034238][T18383] netlink: 8 bytes leftover after parsing attributes in process `syz.1.3076'. [ 483.046458][T18022] veth0_macvtap: entered promiscuous mode [ 483.065799][T18022] veth1_macvtap: entered promiscuous mode [ 483.108789][T18022] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 483.147556][T18022] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 483.181089][T13292] netdevsim netdevsim4 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 483.231787][T13289] netdevsim netdevsim4 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 483.279780][ T7420] netdevsim netdevsim4 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 483.280248][ T7420] netdevsim netdevsim4 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 483.325048][T18398] netlink: 14 bytes leftover after parsing attributes in process `syz.0.3077'. [ 483.351784][T18398] dummy0 (unregistering): left promiscuous mode [ 483.658285][T18419] netlink: 'syz.2.3079': attribute type 2 has an invalid length. [ 483.672549][T18417] FAULT_INJECTION: forcing a failure. [ 483.672549][T18417] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 483.672583][T18417] CPU: 1 UID: 0 PID: 18417 Comm: syz.0.3080 Not tainted syzkaller #0 PREEMPT(full) [ 483.672615][T18417] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 11/06/2026 [ 483.672627][T18417] Call Trace: [ 483.672636][T18417] [ 483.672645][T18417] dump_stack_lvl+0xe8/0x150 [ 483.672684][T18417] should_fail_ex+0x3eb/0x540 [ 483.672720][T18417] _copy_from_user+0x2d/0xb0 [ 483.672746][T18417] ___sys_recvmsg+0x173/0x5a0 [ 483.672773][T18417] ? __pfx____sys_recvmsg+0x10/0x10 [ 483.672798][T18417] ? lock_acquire+0x115/0x350 [ 483.672850][T18417] do_recvmmsg+0x31a/0x800 [ 483.672878][T18417] ? __pfx_do_recvmmsg+0x10/0x10 [ 483.672909][T18417] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 483.672935][T18417] ? fdget+0x1ac/0x250 [ 483.672964][T18417] __x64_sys_recvmmsg+0x198/0x250 [ 483.672986][T18417] ? __pfx___x64_sys_recvmmsg+0x10/0x10 [ 483.673016][T18417] do_syscall_64+0x166/0x520 [ 483.673036][T18417] ? trace_irq_disable+0x3b/0x140 [ 483.673059][T18417] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 483.673075][T18417] ? clear_bhb_loop+0x70/0xc0 [ 483.673096][T18417] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 483.673113][T18417] RIP: 0033:0x7f59733a8f19 [ 483.673130][T18417] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 483.673145][T18417] RSP: 002b:00007f5974320028 EFLAGS: 00000246 ORIG_RAX: 000000000000012b [ 483.673165][T18417] RAX: ffffffffffffffda RBX: 00007f5973625fa0 RCX: 00007f59733a8f19 [ 483.673177][T18417] RDX: 03fffffffffffe83 RSI: 00002000000018c0 RDI: 0000000000000003 [ 483.673189][T18417] RBP: 00007f5974320090 R08: 0000000000000000 R09: 0000000000000000 [ 483.673199][T18417] R10: 0000000000000002 R11: 0000000000000246 R12: 0000000000000002 [ 483.673210][T18417] R13: 00007f5973626038 R14: 00007f5973625fa0 R15: 00007ffdc8194f98 [ 483.673241][T18417] [ 483.796423][T18419] !: entered promiscuous mode [ 483.917621][T18422] netlink: 12 bytes leftover after parsing attributes in process `syz.2.3079'. [ 483.986960][T18422] !: left promiscuous mode [ 484.051241][T18430] netlink: 'syz.0.3082': attribute type 1 has an invalid length. [ 484.051267][T18430] netlink: 'syz.0.3082': attribute type 2 has an invalid length. [ 484.068028][T18430] netlink: 'syz.0.3082': attribute type 1 has an invalid length. [ 484.068051][T18430] netlink: 'syz.0.3082': attribute type 2 has an invalid length. [ 484.193753][T18435] netlink: 28 bytes leftover after parsing attributes in process `syz.2.3084'. [ 484.374083][T18444] dummy0: entered allmulticast mode [ 484.374739][T18444] netlink: 24 bytes leftover after parsing attributes in process `syz.2.3087'. [ 484.375192][T18444] sch_tbf: burst 88 is lower than device wlan0 mtu (1514) ! [ 484.375626][T18443] dummy0: left allmulticast mode [ 484.754102][T18453] netlink: 'syz.2.3091': attribute type 10 has an invalid length. [ 484.777048][T18453] team0: Port device dummy0 added [ 486.022994][T18383] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 486.113045][T13288] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 486.113070][T13288] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 486.178526][T18455] netlink: 260 bytes leftover after parsing attributes in process `syz.2.3092'. [ 486.220112][T13288] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 486.220137][T13288] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 486.697101][T18478] netlink: 'syz.4.3004': attribute type 5 has an invalid length. [ 486.697101][T18480] netlink: 'syz.4.3004': attribute type 5 has an invalid length. [ 486.883333][T18484] netlink: 8 bytes leftover after parsing attributes in process `syz.3.3101'. [ 487.061820][T18486] netlink: 16 bytes leftover after parsing attributes in process `syz.1.3103'. [ 487.062213][T18486] netlink: 16 bytes leftover after parsing attributes in process `syz.1.3103'. [ 487.076830][T18486] netlink: 16 bytes leftover after parsing attributes in process `syz.1.3103'. [ 487.077174][T18486] netlink: 16 bytes leftover after parsing attributes in process `syz.1.3103'. [ 487.077488][T18486] netlink: 16 bytes leftover after parsing attributes in process `syz.1.3103'. [ 487.077807][T18486] netlink: 16 bytes leftover after parsing attributes in process `syz.1.3103'. [ 487.078130][T18486] netlink: 16 bytes leftover after parsing attributes in process `syz.1.3103'. [ 487.082927][T18486] netlink: 16 bytes leftover after parsing attributes in process `syz.1.3103'. [ 487.352168][T18499] x_tables: duplicate underflow at hook 3 [ 487.365200][T18497] 0: reclassify loop, rule prio 0, protocol 03 [ 487.607851][ T4952] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 487.632040][ T4952] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 487.632995][ T4952] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 487.634103][ T4952] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 487.634814][ T4952] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 488.000959][T18519] ip_tables: iptables: counters copy to user failed while replacing table [ 488.013636][T18526] xt_HMARK: proto mask must be zero with L3 mode [ 488.105075][T18519] netlink: 'syz.3.3111': attribute type 4 has an invalid length. [ 488.105213][T18519] netlink: 'syz.3.3111': attribute type 4 has an invalid length. [ 488.105399][T18519] netlink: 'syz.3.3111': attribute type 4 has an invalid length. [ 488.105517][T18519] netlink: 'syz.3.3111': attribute type 4 has an invalid length. [ 488.105694][T18519] netlink: 'syz.3.3111': attribute type 4 has an invalid length. [ 488.105829][T18519] netlink: 'syz.3.3111': attribute type 4 has an invalid length. [ 488.106026][T18519] netlink: 'syz.3.3111': attribute type 4 has an invalid length. [ 488.106145][T18519] netlink: 'syz.3.3111': attribute type 4 has an invalid length. [ 488.336207][T18530] bond1: up delay (10) is not a multiple of miimon (7), value rounded to 7 ms [ 488.341765][T18530] bond1 (unregistering): Released all slaves [ 488.370908][T18544] openvswitch: netlink: EtherType 520 is less than min 600 [ 488.866987][T18510] rxe_eth0 speed is unknown, defaulting to 1000 [ 489.293281][T18510] lo speed is unknown, defaulting to 1000 [ 489.630731][T18510] hsr0 speed is unknown, defaulting to 1000 [ 489.789823][ T5636] Bluetooth: hci1: command tx timeout [ 490.344179][T18510] bridge0: port 1(bridge_slave_0) entered blocking state [ 490.344379][T18510] bridge0: port 1(bridge_slave_0) entered disabled state [ 490.344512][T18510] bridge_slave_0: entered allmulticast mode [ 490.346869][T18510] bridge_slave_0: entered promiscuous mode [ 490.350716][T18510] bridge0: port 2(bridge_slave_1) entered blocking state [ 490.350880][T18510] bridge0: port 2(bridge_slave_1) entered disabled state [ 490.351324][T18510] bridge_slave_1: entered allmulticast mode [ 490.353066][T18510] bridge_slave_1: entered promiscuous mode [ 490.390331][T18510] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 490.393869][T18510] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 490.433075][T18510] team0: Port device team_slave_0 added [ 490.443710][T18510] team0: Port device team_slave_1 added [ 490.486359][T18510] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 490.486378][T18510] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 490.486404][T18510] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 490.492416][T18510] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 490.492432][T18510] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 490.492455][T18510] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 490.548724][T18510] hsr_slave_0: entered promiscuous mode [ 490.552694][T18510] hsr_slave_1: entered promiscuous mode [ 490.554028][T18510] debugfs: 'hsr0' already exists in 'hsr' [ 490.554045][T18510] Cannot create hsr debugfs directory [ 491.870715][ T5636] Bluetooth: hci1: command tx timeout [ 491.997994][T18595] validate_nla: 26 callbacks suppressed [ 491.998018][T18595] netlink: 'syz.4.3124': attribute type 11 has an invalid length. [ 491.998033][T18595] netlink: 'syz.4.3124': attribute type 5 has an invalid length. [ 492.173129][T18510] netdevsim netdevsim0 eth3 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 492.173170][T18510] netdevsim netdevsim0 eth3 (unregistering): unset [1, 0] type 2 family 0 port 20000 - 0 [ 492.173197][T18510] netdevsim netdevsim0 eth3 (unregistering): unset [1, 1] type 2 family 0 port 6081 - 0 [ 492.198946][T18587] __nla_validate_parse: 63 callbacks suppressed [ 492.198966][T18587] netlink: 48 bytes leftover after parsing attributes in process `syz.2.3123'. [ 492.343120][T18510] netdevsim netdevsim0 eth2 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 492.343160][T18510] netdevsim netdevsim0 eth2 (unregistering): unset [1, 0] type 2 family 0 port 20000 - 0 [ 492.343185][T18510] netdevsim netdevsim0 eth2 (unregistering): unset [1, 1] type 2 family 0 port 6081 - 0 [ 492.431052][T18613] netlink: 'syz.1.3128': attribute type 4 has an invalid length. [ 492.450314][T18616] netlink: 'syz.1.3128': attribute type 4 has an invalid length. [ 492.513267][T18510] netdevsim netdevsim0 eth1 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 492.513306][T18510] netdevsim netdevsim0 eth1 (unregistering): unset [1, 0] type 2 family 0 port 20000 - 0 [ 492.513332][T18510] netdevsim netdevsim0 eth1 (unregistering): unset [1, 1] type 2 family 0 port 6081 - 0 [ 492.617351][T18510] netdevsim netdevsim0 eth0 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 492.617391][T18510] netdevsim netdevsim0 eth0 (unregistering): unset [1, 0] type 2 family 0 port 20000 - 0 [ 492.617419][T18510] netdevsim netdevsim0 eth0 (unregistering): unset [1, 1] type 2 family 0 port 6081 - 0 [ 492.713746][T18627] xt_hashlimit: size too large, truncated to 1048576 [ 492.864395][T18631] bridge0: port 1(bridge_slave_0) entered disabled state [ 492.921571][T18631] bridge_slave_0 (unregistering): left allmulticast mode [ 492.940467][T18631] bridge_slave_0 (unregistering): left promiscuous mode [ 492.940570][T18631] bridge0: port 1(bridge_slave_0) entered disabled state [ 493.091318][T18628] erspan0: entered promiscuous mode [ 493.283245][T18639] ip_tables: iptables: counters copy to user failed while replacing table [ 493.393906][T18510] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 493.398567][T18510] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 493.417410][T18510] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 493.432831][T18510] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 493.435406][T18510] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 493.457658][T18510] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 493.458666][T18510] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 493.488637][T18510] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 493.528950][T18650] netlink: 20 bytes leftover after parsing attributes in process `syz.4.3134'. [ 493.708554][T18666] netlink: 4 bytes leftover after parsing attributes in process `syz.2.3137'. [ 493.708580][T18666] netlink: 14 bytes leftover after parsing attributes in process `syz.2.3137'. [ 493.901524][T18510] 8021q: adding VLAN 0 to HW filter on device bond0 [ 493.939348][ T5636] Bluetooth: hci1: command tx timeout [ 493.941756][T18510] 8021q: adding VLAN 0 to HW filter on device team0 [ 493.974893][ T6954] bridge0: port 1(bridge_slave_0) entered blocking state [ 493.975020][ T6954] bridge0: port 1(bridge_slave_0) entered forwarding state [ 494.010853][ T6954] bridge0: port 2(bridge_slave_1) entered blocking state [ 494.010975][ T6954] bridge0: port 2(bridge_slave_1) entered forwarding state [ 494.465751][T18704] netlink: 36 bytes leftover after parsing attributes in process `syz.4.3144'. [ 494.768821][T13293] IPVS: starting estimator thread 0... [ 494.848421][T18713] IPVS: Error connecting to the multicast addr [ 494.861187][T18722] IPVS: using max 26 ests per chain, 62400 per kthread [ 494.864309][T18712] netlink: 'syz.2.3146': attribute type 11 has an invalid length. [ 495.138642][T18738] netlink: 8 bytes leftover after parsing attributes in process `syz.4.3151'. [ 495.158318][T18738] netlink: 8 bytes leftover after parsing attributes in process `syz.4.3151'. [ 495.158668][T18738] netlink: 8 bytes leftover after parsing attributes in process `syz.4.3151'. [ 495.185452][T18738] netlink: 8 bytes leftover after parsing attributes in process `syz.4.3151'. [ 495.186946][T18738] netlink: 8 bytes leftover after parsing attributes in process `syz.4.3151'. [ 495.422536][T18510] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 495.538877][T18510] veth0_vlan: entered promiscuous mode [ 495.591680][T18510] veth1_vlan: entered promiscuous mode [ 495.802808][T18510] veth0_macvtap: entered promiscuous mode [ 495.824462][T18510] veth1_macvtap: entered promiscuous mode [ 495.908915][T18510] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 495.943630][T18510] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 495.966287][T18751] Cannot find set identified by id 1 to match [ 496.019454][ T5636] Bluetooth: hci1: command tx timeout [ 496.048478][T13293] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 496.063454][T13293] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 496.165081][ T174] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 496.208274][T18755] netlink: 'syz.4.3156': attribute type 1 has an invalid length. [ 496.229848][ T174] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 496.234903][T18758] netlink: 'syz.3.3157': attribute type 12 has an invalid length. [ 496.236624][ T7420] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 496.236646][ T7420] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 496.313432][T18761] input: Bluetooth HID Boot Protocol Device as /devices/virtual/bluetooth/hci1/hci1:200/input8 [ 496.334678][T18755] veth3: entered allmulticast mode [ 496.463592][T13288] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 496.463617][T13288] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 497.715377][T18801] __nla_validate_parse: 2 callbacks suppressed [ 497.715398][T18801] netlink: 56 bytes leftover after parsing attributes in process `syz.0.3165'. [ 497.726551][T18797] netlink: 'syz.1.3166': attribute type 1 has an invalid length. [ 497.726572][T18797] netlink: 36 bytes leftover after parsing attributes in process `syz.1.3166'. [ 497.734960][T18795] netlink: 'syz.4.3169': attribute type 8 has an invalid length. [ 497.734981][T18795] netlink: 'syz.4.3169': attribute type 4 has an invalid length. [ 497.734993][T18795] netlink: 224 bytes leftover after parsing attributes in process `syz.4.3169'. [ 497.742380][T18795] netlink: 8 bytes leftover after parsing attributes in process `syz.4.3169'. [ 497.884581][T18805] syzkaller0: entered promiscuous mode [ 497.884608][T18805] syzkaller0: entered allmulticast mode [ 497.917407][T18802] netlink: 20 bytes leftover after parsing attributes in process `syz.0.3165'. [ 498.143912][T18812] netlink: 12 bytes leftover after parsing attributes in process `syz.3.3172'. [ 498.146723][T18812] netlink: 32 bytes leftover after parsing attributes in process `syz.3.3172'. [ 498.266427][T18825] syzkaller1: entered promiscuous mode [ 498.266454][T18825] syzkaller1: entered allmulticast mode [ 498.606935][T18840] netlink: 16 bytes leftover after parsing attributes in process `syz.4.3178'. [ 499.107558][T18859] bridge0: received packet on syz_tun with own address as source address (addr:aa:aa:aa:aa:aa:aa, vlan:0) [ 499.176567][T18862] netlink: 8 bytes leftover after parsing attributes in process `syz.3.3183'. [ 499.685538][ T4952] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 499.696870][ T4952] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 499.707858][ T4952] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 499.730090][ T4952] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 499.730829][ T4952] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 500.414307][T18886] bond1: option mode: invalid value (7) [ 500.435378][T18886] bond1 (unregistering): Released all slaves [ 500.514933][T18891] bridge0: port 1(bond0) entered blocking state [ 500.515035][T18891] bridge0: port 1(bond0) entered disabled state [ 500.515505][T18891] bond0: entered allmulticast mode [ 500.515523][T18891] bond_slave_0: entered allmulticast mode [ 500.515566][T18891] bond_slave_1: entered allmulticast mode [ 500.531781][T18891] bond0: entered promiscuous mode [ 500.531803][T18891] bond_slave_0: entered promiscuous mode [ 500.531976][T18891] bond_slave_1: entered promiscuous mode [ 500.544645][T18891] bridge0: port 1(bond0) entered blocking state [ 500.544739][T18891] bridge0: port 1(bond0) entered forwarding state [ 500.574646][T18905] IPv6: NLM_F_CREATE should be specified when creating new route [ 500.735077][T18903] syzkaller0: entered promiscuous mode [ 500.735105][T18903] syzkaller0: entered allmulticast mode [ 501.119853][T18918] tipc: Enabling of bearer rejected, failed to enable media [ 501.152923][T18923] netlink: 'syz.1.3193': attribute type 1 has an invalid length. [ 501.439730][T18942] netlink: 20 bytes leftover after parsing attributes in process `syz.4.3194'. [ 501.653712][T18954] netlink: 'syz.1.3195': attribute type 1 has an invalid length. [ 501.653739][T18954] netlink: 'syz.1.3195': attribute type 2 has an invalid length. [ 501.685311][T18877] rxe_eth0 speed is unknown, defaulting to 1000 [ 501.864610][ T4952] Bluetooth: hci0: command tx timeout [ 502.066595][T18966] wg2: entered allmulticast mode [ 502.151229][T18976] x_tables: duplicate underflow at hook 2 [ 502.300569][T18877] lo speed is unknown, defaulting to 1000 [ 502.630530][T18983] syzkaller0: entered promiscuous mode [ 502.630621][T18983] syzkaller0: entered allmulticast mode [ 502.676519][T18992] netlink: 'syz.2.3204': attribute type 5 has an invalid length. [ 502.980979][T18992] __nla_validate_parse: 1 callbacks suppressed [ 502.981002][T18992] netlink: 52 bytes leftover after parsing attributes in process `syz.2.3204'. [ 502.981024][T18992] netlink: 8 bytes leftover after parsing attributes in process `syz.2.3204'. [ 503.946551][ T4952] Bluetooth: hci0: command tx timeout [ 506.026567][ T4952] Bluetooth: hci0: command tx timeout [ 506.351038][T18877] hsr0 speed is unknown, defaulting to 1000 [ 506.358992][T19005] netlink: 28 bytes leftover after parsing attributes in process `syz.1.3208'. [ 506.359018][T19005] netlink: 28 bytes leftover after parsing attributes in process `syz.1.3208'. [ 506.389013][T19013] syzkaller0: entered promiscuous mode [ 506.389038][T19013] syzkaller0: entered allmulticast mode [ 506.617708][T19030] bond1: option min_links: invalid value (18446744073709551612) [ 506.617737][T19030] bond1: option min_links: allowed values 0 - 2147483647 [ 506.631031][T19030] bond1 (unregistering): Released all slaves [ 506.667432][T19028] netlink: 36 bytes leftover after parsing attributes in process `syz.1.3212'. [ 506.685169][T19028] netlink: 36 bytes leftover after parsing attributes in process `syz.1.3212'. [ 506.685207][T19028] netlink: 36 bytes leftover after parsing attributes in process `syz.1.3212'. [ 506.690427][T19028] netlink: 36 bytes leftover after parsing attributes in process `syz.1.3212'. [ 506.690456][T19028] netlink: 36 bytes leftover after parsing attributes in process `syz.1.3212'. [ 506.704899][T19028] netlink: 36 bytes leftover after parsing attributes in process `syz.1.3212'. [ 506.819372][ C0] ip6_tunnel: ip6gre2 xmit: Local address not yet configured! [ 506.862473][T19028] bridge0: port 3(syz_tun) entered disabled state [ 506.887011][T19028] bridge0: port 1(bond0) entered disabled state [ 506.887255][T19028] bridge0: port 2(bridge_slave_1) entered disabled state [ 507.057211][T19028] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 507.076818][T19028] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 507.458110][ T6207] hsr0 speed is unknown, defaulting to 1000 [ 507.465764][ T6207] syz2: Port: 1 Link DOWN [ 507.619659][ T6954] netdevsim netdevsim1 netdevsim0: unset [0, 0] type 1 family 0 port 8472 - 0 [ 507.619695][ T6954] netdevsim netdevsim1 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 507.619732][ T6954] netdevsim netdevsim1 netdevsim1: unset [0, 0] type 1 family 0 port 8472 - 0 [ 507.619756][ T6954] netdevsim netdevsim1 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 507.619787][ T6954] netdevsim netdevsim1 netdevsim2: unset [0, 0] type 1 family 0 port 8472 - 0 [ 507.619811][ T6954] netdevsim netdevsim1 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 507.619841][ T6954] netdevsim netdevsim1 netdevsim3: unset [0, 0] type 1 family 0 port 8472 - 0 [ 507.619865][ T6954] netdevsim netdevsim1 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 508.076762][T18877] bridge0: port 1(bridge_slave_0) entered blocking state [ 508.077285][T18877] bridge0: port 1(bridge_slave_0) entered disabled state [ 508.077573][T18877] bridge_slave_0: entered allmulticast mode [ 508.104500][ T4952] Bluetooth: hci0: command tx timeout [ 508.114179][T18877] bridge_slave_0: entered promiscuous mode [ 508.127623][T18877] bridge0: port 2(bridge_slave_1) entered blocking state [ 508.127750][T18877] bridge0: port 2(bridge_slave_1) entered disabled state [ 508.127893][T18877] bridge_slave_1: entered allmulticast mode [ 508.157145][T18877] bridge_slave_1: entered promiscuous mode [ 508.213913][T18877] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 508.217596][T18877] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 508.287655][T18877] team0: Port device team_slave_0 added [ 508.305849][T18877] team0: Port device team_slave_1 added [ 508.370635][T19098] __nla_validate_parse: 146 callbacks suppressed [ 508.370652][T19098] netlink: 4 bytes leftover after parsing attributes in process `syz.1.3225'. [ 508.371491][T18877] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 508.371507][T18877] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 508.371531][T18877] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 508.374224][T18877] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 508.374240][T18877] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 508.374266][T18877] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 508.610891][T19111] netlink: 4 bytes leftover after parsing attributes in process `syz.4.3228'. [ 508.677264][T19112] netlink: 24 bytes leftover after parsing attributes in process `syz.4.3228'. [ 508.707913][T19117] netlink: 24 bytes leftover after parsing attributes in process `syz.4.3228'. [ 508.710531][T19120] netlink: 4 bytes leftover after parsing attributes in process `syz.4.3228'. [ 508.757252][T19103] bridge0: port 2(bridge_slave_1) entered disabled state [ 508.757702][T19103] bridge0: port 1(bridge_slave_0) entered disabled state [ 508.896097][T18877] hsr_slave_0: entered promiscuous mode [ 508.897256][T18877] hsr_slave_1: entered promiscuous mode [ 508.898123][T18877] debugfs: 'hsr0' already exists in 'hsr' [ 508.898140][T18877] Cannot create hsr debugfs directory [ 509.241582][T19135] netlink: 12 bytes leftover after parsing attributes in process `syz.2.3232'. [ 509.331093][T19141] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 509.409345][T13294] netdevsim netdevsim2 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0 [ 509.409408][T13294] netdevsim netdevsim2 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0 [ 509.474705][T19150] netlink: 12 bytes leftover after parsing attributes in process `syz.4.3235'. [ 509.490819][T13292] netdevsim netdevsim2 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0 [ 509.492739][T19147] syzkaller0: entered promiscuous mode [ 509.492760][T19147] syzkaller0: entered allmulticast mode [ 509.578438][T19145] Bluetooth: MGMT ver 1.23 [ 509.578479][T19145] Bluetooth: hci0: unsupported parameter 5135 [ 509.578494][T19145] Bluetooth: hci0: unsupported parameter 8192 [ 509.578560][T19145] Bluetooth: hci0: unsupported parameter 5135 [ 509.578584][T19145] Bluetooth: hci0: unsupported parameter 8192 [ 509.640734][ T7420] netdevsim netdevsim4 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0 [ 509.640800][ T7420] netdevsim netdevsim4 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0 [ 509.640834][ T7420] netdevsim netdevsim4 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0 [ 509.640867][ T7420] netdevsim netdevsim4 netdevsim0: set [0, 0] type 1 family 0 port 8472 - 0 [ 509.640900][ T7420] netdevsim netdevsim2 netdevsim0: set [0, 0] type 1 family 0 port 8472 - 0 [ 509.834519][T19165] netlink: 'syz.0.3240': attribute type 1 has an invalid length. [ 509.930166][T19169] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 509.964748][T19167] netlink: 'syz.1.3241': attribute type 21 has an invalid length. [ 509.970727][T19167] netlink: 132 bytes leftover after parsing attributes in process `syz.1.3241'. [ 510.268650][T18877] netdevsim netdevsim3 netdevsim0: renamed from eth0 [ 510.334651][T18877] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 510.337578][T18877] netdevsim netdevsim3 netdevsim1: renamed from eth1 [ 510.374127][T18877] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 510.382093][T18877] netdevsim netdevsim3 netdevsim2: renamed from eth2 [ 510.423830][T18877] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 510.433005][T18877] netdevsim netdevsim3 netdevsim3: renamed from eth3 [ 510.457521][T18877] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 510.890889][T18877] 8021q: adding VLAN 0 to HW filter on device bond0 [ 510.931627][ T6954] nci: nci_rx_work: unknown MT 0x5 [ 510.940964][T18877] 8021q: adding VLAN 0 to HW filter on device team0 [ 510.956090][ T7420] bridge0: port 1(bridge_slave_0) entered blocking state [ 510.956281][ T7420] bridge0: port 1(bridge_slave_0) entered forwarding state [ 510.988393][ T7420] bridge0: port 2(bridge_slave_1) entered blocking state [ 510.988519][ T7420] bridge0: port 2(bridge_slave_1) entered forwarding state [ 511.152399][T19223] netlink: 'syz.4.3255': attribute type 1 has an invalid length. [ 511.273035][T19231] netlink: 8 bytes leftover after parsing attributes in process `syz.0.3254'. [ 511.661211][T19243] netlink: 16 bytes leftover after parsing attributes in process `syz.4.3257'. [ 511.896050][T19261] gre1: entered promiscuous mode [ 512.089021][T18877] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 512.205520][T18877] veth0_vlan: entered promiscuous mode [ 512.233091][T18877] veth1_vlan: entered promiscuous mode [ 512.375594][T18877] veth0_macvtap: entered promiscuous mode [ 512.391776][T18877] veth1_macvtap: entered promiscuous mode [ 512.420647][T18877] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 512.444422][T18877] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 512.469769][T13292] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 512.471642][ T7420] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 512.471683][ T7420] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 512.471716][ T7420] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 513.666718][T19205] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 513.808638][T13288] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 513.808663][T13288] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 513.905978][ T6954] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 513.906001][ T6954] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 514.267344][T19328] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 514.276353][T19329] netlink: 28 bytes leftover after parsing attributes in process `syz.1.3265'. [ 514.277008][T19329] netlink: 4 bytes leftover after parsing attributes in process `syz.1.3265'. [ 515.155846][T19347] netlink: 4 bytes leftover after parsing attributes in process `syz.0.3268'. [ 515.170926][T19351] netlink: 'syz.0.3268': attribute type 1 has an invalid length. [ 515.537769][T19361] netlink: 8 bytes leftover after parsing attributes in process `syz.2.3271'. [ 517.100006][T19316] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 517.237463][T19364] netlink: 12 bytes leftover after parsing attributes in process `syz.3.3272'. [ 517.567464][T19385] xt_hashlimit: overflow, try lower: 8/0 [ 518.401340][T19410] netlink: 4 bytes leftover after parsing attributes in process `syz.4.3280'. [ 518.495409][T19399] syzkaller0: entered promiscuous mode [ 518.495436][T19399] syzkaller0: entered allmulticast mode [ 519.398530][T19416] netlink: 28 bytes leftover after parsing attributes in process `syz.3.3281'. [ 519.398567][T19416] netlink: 36 bytes leftover after parsing attributes in process `syz.3.3281'. [ 521.330982][T19428] netlink: 8 bytes leftover after parsing attributes in process `syz.2.3284'. [ 521.366784][T19431] netlink: 12 bytes leftover after parsing attributes in process `syz.0.3285'. [ 521.367156][T19431] netlink: 12 bytes leftover after parsing attributes in process `syz.0.3285'. [ 521.442368][T19437] netlink: 12 bytes leftover after parsing attributes in process `syz.3.3283'. [ 521.981059][T19454] netlink: 4 bytes leftover after parsing attributes in process `syz.1.3289'. [ 522.041684][ T7420] netdevsim netdevsim1 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0 [ 522.047850][T13292] netdevsim netdevsim1 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0 [ 522.048665][T13292] netdevsim netdevsim1 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0 [ 522.048700][T13292] netdevsim netdevsim1 netdevsim0: set [0, 0] type 1 family 0 port 8472 - 0 [ 522.289869][T19457] syzkaller0: entered promiscuous mode [ 522.289894][T19457] syzkaller0: entered allmulticast mode [ 522.298975][T19457] 0: reclassify loop, rule prio 0, protocol 700 [ 522.305381][T19457] netlink: 220 bytes leftover after parsing attributes in process `syz.0.3291'. [ 522.305402][T19457] tc_dump_action: action bad kind [ 522.305779][T19457] netlink: 16 bytes leftover after parsing attributes in process `syz.0.3291'. [ 522.423300][T19465] netlink: 'syz.2.3294': attribute type 1 has an invalid length. [ 522.428562][T19466] netlink: 4 bytes leftover after parsing attributes in process `syz.2.3294'. [ 522.558575][T19475] ip_tables: iptables: counters copy to user failed while replacing table [ 522.578478][T19465] bond1: entered promiscuous mode [ 522.579083][T19465] 8021q: adding VLAN 0 to HW filter on device bond1 [ 522.762139][T19481] openvswitch: netlink: Key type 50 is out of range max 32 [ 522.790497][T19483] bond0: Error: Cannot enslave bond to itself. [ 522.947000][T19487] bond1: up delay (10) is not a multiple of miimon (7), value rounded to 7 ms [ 522.959988][T19487] bond1 (unregistering): Released all slaves [ 523.164245][T19499] syz.2.3302: vmalloc error: size 8589938688, exceeds total pages, mode:0x400dc0(GFP_KERNEL_ACCOUNT|__GFP_ZERO), nodemask=(null),cpuset=/,mems_allowed=0-1 [ 523.164320][T19499] CPU: 0 UID: 0 PID: 19499 Comm: syz.2.3302 Not tainted syzkaller #0 PREEMPT(full) [ 523.164344][T19499] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 11/06/2026 [ 523.164357][T19499] Call Trace: [ 523.164365][T19499] [ 523.164375][T19499] dump_stack_lvl+0xe8/0x150 [ 523.164411][T19499] warn_alloc+0x24d/0x270 [ 523.164435][T19499] ? stack_depot_save_flags+0x33/0x810 [ 523.164466][T19499] ? __pfx_warn_alloc+0x10/0x10 [ 523.164487][T19499] ? kasan_save_track+0x4f/0x80 [ 523.164513][T19499] ? __kasan_kmalloc+0x93/0xb0 [ 523.164539][T19499] ? xsk_init_queue+0x8a/0xe0 [ 523.164560][T19499] ? xsk_setsockopt+0x52a/0x960 [ 523.164587][T19499] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 523.164623][T19499] __vmalloc_node_range_noprof+0x12c/0x16f0 [ 523.164679][T19499] ? rcu_is_watching+0x16/0xb0 [ 523.164714][T19499] ? __pfx___vmalloc_node_range_noprof+0x10/0x10 [ 523.164737][T19499] ? __kmalloc_cache_noprof+0x31c/0x600 [ 523.164761][T19499] ? __kmalloc_cache_noprof+0x148/0x600 [ 523.164785][T19499] ? xskq_create+0x56/0x220 [ 523.164814][T19499] xskq_create+0x148/0x220 [ 523.164839][T19499] ? xsk_init_queue+0x8a/0xe0 [ 523.164866][T19499] xsk_init_queue+0x8a/0xe0 [ 523.164892][T19499] xsk_setsockopt+0x52a/0x960 [ 523.164919][T19499] ? __pfx_xsk_setsockopt+0x10/0x10 [ 523.164943][T19499] ? __pfx_aa_sk_perm+0x10/0x10 [ 523.164985][T19499] ? bpf_lsm_socket_setsockopt+0x9/0x20 [ 523.165011][T19499] ? __pfx_xsk_setsockopt+0x10/0x10 [ 523.165035][T19499] do_sock_setsockopt+0x17c/0x1b0 [ 523.165063][T19499] __x64_sys_setsockopt+0x13d/0x1b0 [ 523.165089][T19499] do_syscall_64+0x166/0x520 [ 523.165114][T19499] ? trace_irq_disable+0x3b/0x140 [ 523.165140][T19499] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 523.165159][T19499] ? clear_bhb_loop+0x70/0xc0 [ 523.165194][T19499] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 523.165214][T19499] RIP: 0033:0x7f787bba8f19 [ 523.165235][T19499] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 523.165253][T19499] RSP: 002b:00007f787caf1028 EFLAGS: 00000246 ORIG_RAX: 0000000000000036 [ 523.165274][T19499] RAX: ffffffffffffffda RBX: 00007f787be25fa0 RCX: 00007f787bba8f19 [ 523.165289][T19499] RDX: 0000000000000006 RSI: 000000000000011b RDI: 0000000000000004 [ 523.165302][T19499] RBP: 00007f787bc37f6d R08: 0000000000000004 R09: 0000000000000000 [ 523.165321][T19499] R10: 0000200000000080 R11: 0000000000000246 R12: 0000000000000000 [ 523.165334][T19499] R13: 00007f787be26038 R14: 00007f787be25fa0 R15: 00007ffd7e66f2b8 [ 523.165370][T19499] [ 523.165551][T19499] Mem-Info: [ 523.165561][T19499] active_anon:9154 inactive_anon:0 isolated_anon:0 [ 523.165561][T19499] active_file:2 inactive_file:43777 isolated_file:0 [ 523.165561][T19499] unevictable:0 dirty:247 writeback:0 [ 523.165561][T19499] slab_reclaimable:12716 slab_unreclaimable:130093 [ 523.165561][T19499] mapped:30690 shmem:551 pagetables:1303 [ 523.165561][T19499] sec_pagetables:0 bounce:0 [ 523.165561][T19499] kernel_misc_reclaimable:0 [ 523.165561][T19499] free:1239453 free_pcp:12298 free_cma:0 [ 523.165627][T19499] Node 0 active_anon:36616kB inactive_anon:0kB active_file:8kB inactive_file:174908kB unevictable:0kB isolated(anon):0kB isolated(file):0kB mapped:122760kB dirty:988kB writeback:0kB shmem:2204kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB kernel_stack:16836kB pagetables:5040kB sec_pagetables:0kB all_unreclaimable? no Balloon:0kB gpu_active:0kB gpu_reclaim:0kB [ 523.165678][T19499] Node 1 active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:200kB unevictable:0kB isolated(anon):0kB isolated(file):0kB mapped:0kB dirty:0kB writeback:0kB shmem:0kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB kernel_stack:32kB pagetables:172kB sec_pagetables:0kB all_unreclaimable? no Balloon:0kB gpu_active:0kB gpu_reclaim:0kB [ 523.165725][T19499] Node 0 DMA free:15360kB boost:0kB min:208kB low:260kB high:312kB reserved_highatomic:0kB free_highatomic:0kB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB zspages:0kB present:15992kB managed:15360kB mlocked:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB [ 523.165776][T19499] lowmem_reserve[]: 0 2463 2465 2465 2465 [ 523.165814][T19499] Node 0 DMA32 free:995500kB boost:0kB min:33920kB low:42400kB high:50880kB reserved_highatomic:0kB free_highatomic:0kB active_anon:36616kB inactive_anon:0kB active_file:8kB inactive_file:174908kB unevictable:0kB writepending:988kB zspages:0kB present:3129332kB managed:2522824kB mlocked:0kB bounce:0kB free_pcp:46680kB local_pcp:26956kB free_cma:0kB [ 523.165870][T19499] lowmem_reserve[]: 0 0 1 1 1 [ 523.165931][T19499] Node 0 Normal free:0kB boost:0kB min:16kB low:20kB high:24kB reserved_highatomic:0kB free_highatomic:0kB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB zspages:0kB present:1048580kB managed:1392kB mlocked:0kB bounce:0kB free_pcp:4kB local_pcp:4kB free_cma:0kB [ 523.165984][T19499] lowmem_reserve[]: 0 0 0 0 0 [ 523.166019][T19499] Node 1 Normal free:3946952kB boost:0kB min:55960kB low:69948kB high:83936kB reserved_highatomic:0kB free_highatomic:0kB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:200kB unevictable:0kB writepending:0kB zspages:0kB present:4194300kB managed:4111104kB mlocked:0kB bounce:0kB free_pcp:2508kB local_pcp:2508kB free_cma:0kB [ 523.166075][T19499] lowmem_reserve[]: 0 0 0 0 0 [ 523.166109][T19499] Node 0 DMA: 0*4kB 0*8kB 0*16kB 0*32kB 0*64kB 0*128kB 0*256kB 0*512kB 1*1024kB (U) 1*2048kB (M) 3*4096kB (M) = 15360kB [ 523.166235][T19499] Node 0 DMA32: 2395*4kB (UME) 1734*8kB (UME) 557*16kB (UME) 182*32kB (UME) 96*64kB (UME) 73*128kB (UME) 31*256kB (UME) 10*512kB (UME) 3*1024kB (UM) 4*2048kB (UME) 224*4096kB (UM) = 995500kB [ 523.166386][T19499] Node 0 Normal: 0*4kB 0*8kB 0*16kB 0*32kB 0*64kB 0*128kB 0*256kB 0*512kB 0*1024kB 0*2048kB 0*4096kB = 0kB [ 523.166497][T19499] Node 1 Normal: 4*4kB (UM) 3*8kB (UM) 4*16kB (UM) 3*32kB (UM) 4*64kB (UM) 4*128kB (UM) 4*256kB (UM) 5*512kB (UM) 2*1024kB (UM) 0*2048kB 962*4096kB (UM) = 3946952kB [ 523.166638][T19499] Node 0 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 523.166655][T19499] Node 0 hugepages_total=2 hugepages_free=2 hugepages_surp=0 hugepages_size=2048kB [ 523.166671][T19499] Node 1 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 523.166687][T19499] Node 1 hugepages_total=2 hugepages_free=2 hugepages_surp=0 hugepages_size=2048kB [ 523.166701][T19499] 44326 total pagecache pages [ 523.166709][T19499] 0 pages in swap cache [ 523.166717][T19499] Free swap = 124996kB [ 523.166724][T19499] Total swap = 124996kB [ 523.166733][T19499] 2097051 pages RAM [ 523.166740][T19499] 0 pages HighMem/MovableOnly [ 523.166748][T19499] 434381 pages reserved [ 523.166756][T19499] 0 pages cma reserved [ 524.041794][T19527] Cannot find set identified by id 0 to match [ 524.167619][T19533] bond0: Error: Cannot enslave bond to itself. [ 524.183286][T19533] bond0: Error: Cannot enslave bond to itself. [ 524.209953][T19528] Bluetooth: hci0: unsupported parameter 5134 [ 524.209971][T19528] Bluetooth: hci0: unsupported parameter 8192 [ 524.209979][T19528] Bluetooth: hci0: unsupported parameter 5134 [ 524.209987][T19528] Bluetooth: hci0: unsupported parameter 8192 [ 524.407149][T19552] __nla_validate_parse: 6 callbacks suppressed [ 524.407172][T19552] netlink: 12 bytes leftover after parsing attributes in process `syz.0.3311'. [ 524.415497][T19541] netlink: 'syz.1.3312': attribute type 34 has an invalid length. [ 524.415519][T19541] netlink: 8 bytes leftover after parsing attributes in process `syz.1.3312'. [ 524.567620][T19559] ip_tables: iptables: counters copy to user failed while replacing table [ 524.657957][T19559] IPv6: addrconf: prefix option has invalid lifetime [ 524.664201][T19562] netlink: 'syz.2.3315': attribute type 1 has an invalid length. [ 524.730286][T19562] 8021q: adding VLAN 0 to HW filter on device bond2 [ 524.803377][T19556] syzkaller1: entered promiscuous mode [ 524.803404][T19556] syzkaller1: entered allmulticast mode [ 524.905140][T19566] bond2: (slave veth3): Enslaving as a backup interface with a down link [ 525.558385][T13292] IPVS: starting estimator thread 0... [ 525.649636][T19596] IPVS: using max 26 ests per chain, 62400 per kthread [ 526.234407][T19600] NFSD: Failed to start, no listeners configured. [ 526.430954][T19605] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 526.433516][T19605] netlink: 60 bytes leftover after parsing attributes in process `syz.1.3322'. [ 527.537060][T19619] netlink: 'syz.2.3325': attribute type 1 has an invalid length. [ 527.537086][T19619] netlink: 244 bytes leftover after parsing attributes in process `syz.2.3325'. [ 527.737207][T19633] netlink: 16 bytes leftover after parsing attributes in process `syz.0.3327'. [ 528.305310][T19669] SET target dimension over the limit! [ 528.824273][T19689] netlink: 48 bytes leftover after parsing attributes in process `syz.4.3343'. [ 528.824300][T19689] netlink: 48 bytes leftover after parsing attributes in process `syz.4.3343'. [ 529.250931][T19690] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 529.250960][T19690] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 529.260510][T19690] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 529.260542][T19690] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 529.482416][T19696] netlink: 92 bytes leftover after parsing attributes in process `syz.3.3346'. [ 529.526715][T19704] netlink: 4 bytes leftover after parsing attributes in process `syz.1.3347'. [ 529.755768][T19716] netlink: 8 bytes leftover after parsing attributes in process `syz.2.3350'. [ 529.755807][T19716] netlink: 'syz.2.3350': attribute type 5 has an invalid length. [ 529.755822][T19716] netlink: 12 bytes leftover after parsing attributes in process `syz.2.3350'. [ 529.780656][T19716] netlink: 8 bytes leftover after parsing attributes in process `syz.2.3350'. [ 529.780689][T19716] netlink: 'syz.2.3350': attribute type 5 has an invalid length. [ 529.780702][T19716] netlink: 12 bytes leftover after parsing attributes in process `syz.2.3350'. [ 530.067090][T19727] netlink: 12 bytes leftover after parsing attributes in process `syz.2.3355'. [ 530.148796][T19736] tipc: Started in network mode [ 530.148830][T19736] tipc: Node identity ac14140f, cluster identity 4711 [ 530.152268][T19736] tipc: New replicast peer: 255.255.255.255 [ 530.153038][T19736] tipc: Enabled bearer , priority 10 [ 530.175946][T19736] netlink: 8 bytes leftover after parsing attributes in process `syz.1.3359'. [ 530.207743][T19738] ebt_limit: overflow, try lower: 4294901760/65535 [ 530.226905][T19738] ebt_limit: overflow, try lower: 4294901760/65535 [ 530.578967][T19757] batman_adv: batadv0: Adding interface: dummy0 [ 530.578988][T19757] batman_adv: batadv0: The MTU of interface dummy0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 530.579020][T19757] batman_adv: batadv0: Interface activated: dummy0 [ 530.733976][T19763] netlink: 8 bytes leftover after parsing attributes in process `syz.1.3369'. [ 530.738892][T19763] netlink: 8 bytes leftover after parsing attributes in process `syz.1.3369'. [ 530.923691][T19775] dvmrp0: entered allmulticast mode [ 530.927872][T19775] dvmrp0: left allmulticast mode [ 531.088805][T19786] tipc: Started in network mode [ 531.088839][T19786] tipc: Node identity ff010000000000000000000000000001, cluster identity 4711 [ 531.088944][T19786] tipc: Enabling of bearer rejected, failed to enable media [ 531.271122][ T6208] tipc: Node number set to 2886997007 [ 532.013754][T19829] IPVS: length: 4096 != 24 [ 532.274625][T19838] bridge1: entered promiscuous mode [ 532.274693][T19838] bridge1: entered allmulticast mode [ 532.445856][T19843] syzkaller0: entered promiscuous mode [ 532.445881][T19843] syzkaller0: entered allmulticast mode [ 532.549119][T19848] netlink: 'syz.1.3390': attribute type 3 has an invalid length. [ 533.556724][T19922] netlink: 'syz.2.3406': attribute type 1 has an invalid length. [ 533.608480][T19922] 8021q: adding VLAN 0 to HW filter on device bond3 [ 533.646182][T19922] mac80211_hwsim hwsim31 wlan1: entered promiscuous mode [ 533.670020][T19922] bond3: (slave wlan1): Enslaving as an active interface with a down link [ 533.857805][ T6954] IPVS: starting estimator thread 0... [ 533.940033][T19936] IPVS: using max 49 ests per chain, 117600 per kthread [ 535.032872][T19963] netlink: 'syz.2.3416': attribute type 17 has an invalid length. [ 535.903201][T19970] bond0: (slave syz_tun): Enslaving as an active interface with an up link [ 535.957251][T19972] __nla_validate_parse: 10 callbacks suppressed [ 535.957270][T19972] netlink: 36 bytes leftover after parsing attributes in process `syz.2.3418'. [ 535.957289][T19972] syzkalle: renamed from bridge_slave_0 (while UP) [ 535.958991][T19972] netlink: 8 bytes leftover after parsing attributes in process `syz.2.3418'. [ 535.970813][T19972] netlink: 36 bytes leftover after parsing attributes in process `syz.2.3418'. [ 535.971053][T19972] netlink: 8 bytes leftover after parsing attributes in process `syz.2.3418'. [ 536.094995][T19979] netlink: 12 bytes leftover after parsing attributes in process `syz.2.3419'. [ 536.222181][T19886] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 537.038418][T20019] batman_adv: batadv0: Adding interface: veth0 [ 537.038440][T20019] batman_adv: batadv0: The MTU of interface veth0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 537.038474][T20019] batman_adv: batadv0: Interface activated: veth0 [ 537.149094][T20025] netlink: 12 bytes leftover after parsing attributes in process `syz.2.3433'. [ 537.220894][T20028] netlink: 'syz.3.3434': attribute type 62 has an invalid length. [ 537.228446][T20028] bridge0: entered promiscuous mode [ 537.228512][T20028] bridge0: entered allmulticast mode [ 537.328796][T20028] ip_tables: iptables: counters copy to user failed while replacing table [ 537.515539][T20040] netlink: 'syz.0.3438': attribute type 1 has an invalid length. [ 537.682536][T20055] sctp: [Deprecated]: syz.2.3441 (pid 20055) Use of int in maxseg socket option. [ 537.682536][T20055] Use struct sctp_assoc_value instead [ 537.710439][T20040] 8021q: adding VLAN 0 to HW filter on device bond1 [ 537.720853][T20041] tipc: Started in network mode [ 537.720883][T20041] tipc: Node identity aaaaaaaaaaaa, cluster identity 4711 [ 537.721043][T20041] tipc: Enabled bearer , priority 0 [ 537.810282][T20053] bond1: (slave ip6gretap1): making interface the new active one [ 537.816112][T20059] netlink: 'syz.3.3442': attribute type 1 has an invalid length. [ 537.816705][T20053] bond1: (slave ip6gretap1): Enslaving as an active interface with an up link [ 537.876764][T20061] netlink: 28 bytes leftover after parsing attributes in process `syz.3.3442'. [ 537.930155][T20067] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 538.016370][T20060] bond1: (slave geneve2): making interface the new active one [ 538.032310][T20060] bond1: (slave geneve2): Enslaving as an active interface with an up link [ 538.054252][T20061] 8021q: adding VLAN 0 to HW filter on device bond1 [ 538.059841][T13292] netdevsim netdevsim3 netdevsim3: set [1, 1] type 2 family 0 port 20000 - 0 [ 538.061320][T13292] netdevsim netdevsim3 netdevsim2: set [1, 1] type 2 family 0 port 20000 - 0 [ 538.061354][T13292] netdevsim netdevsim3 netdevsim1: set [1, 1] type 2 family 0 port 20000 - 0 [ 538.065480][T13292] netdevsim netdevsim3 netdevsim0: set [1, 1] type 2 family 0 port 20000 - 0 [ 538.142845][T20083] netlink: 132 bytes leftover after parsing attributes in process `syz.0.3446'. [ 538.162305][T20083] netlink: 132 bytes leftover after parsing attributes in process `syz.0.3446'. [ 538.286401][T20091] netlink: 40 bytes leftover after parsing attributes in process `syz.4.3449'. [ 538.676449][T20112] syzkaller0: entered promiscuous mode [ 538.676474][T20112] syzkaller0: entered allmulticast mode [ 538.695841][T20111] netlink: 'syz.0.3455': attribute type 5 has an invalid length. [ 538.774462][ T5744] tipc: Node number set to 43690 [ 538.934720][T20121] netlink: 'syz.0.3458': attribute type 4 has an invalid length. [ 538.981344][T20118] batman_adv: Cannot find parent device. Skipping batadv-on-batadv check for gretap1 [ 538.982077][T20118] batman_adv: batadv0: Adding interface: gretap1 [ 538.982092][T20118] batman_adv: batadv0: The MTU of interface gretap1 is too small (1462) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 538.982123][T20118] batman_adv: batadv0: Interface activated: gretap1 [ 539.257964][T20134] netlink: 'syz.2.3463': attribute type 2 has an invalid length. [ 539.907599][T20158] can: request_module (can-proto-0) failed. [ 539.953983][T20163] bridge2: the hash_elasticity option has been deprecated and is always 16 [ 539.954006][T20163] bridge2: trying to set multicast query interval below minimum, setting to 100 (1000ms) [ 540.008464][T20169] bridge3: the hash_elasticity option has been deprecated and is always 16 [ 540.008481][T20169] bridge3: trying to set multicast query interval below minimum, setting to 100 (1000ms) [ 540.076719][T20166] can: request_module (can-proto-0) failed. [ 540.275819][T20179] Bluetooth: MGMT ver 1.23 [ 541.154144][T20230] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 541.154522][T20230] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 541.154859][T20230] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 541.155199][T20230] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 541.208339][T20230] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 541.208771][T20230] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 541.213996][T20230] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 541.214396][T20230] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 541.706561][T20184] block nbd5: Receive control failed (result -32) [ 541.788931][T20255] __nla_validate_parse: 10 callbacks suppressed [ 541.788958][T20255] netlink: 24 bytes leftover after parsing attributes in process `syz.4.3490'. [ 542.201863][T20276] x_tables: duplicate underflow at hook 3 [ 542.201954][T20276] x_tables: duplicate underflow at hook 3 [ 542.202035][T20276] x_tables: duplicate underflow at hook 3 [ 542.202113][T20276] x_tables: duplicate underflow at hook 3 [ 542.202189][T20276] x_tables: duplicate underflow at hook 3 [ 542.202268][T20276] x_tables: duplicate underflow at hook 3 [ 542.202365][T20276] x_tables: duplicate underflow at hook 3 [ 542.202455][T20276] x_tables: duplicate underflow at hook 3 [ 542.202533][T20276] x_tables: duplicate underflow at hook 3 [ 542.202608][T20276] x_tables: duplicate underflow at hook 3 [ 542.341629][T20184] Bluetooth: hci1: command 0x0c24 tx timeout [ 542.345241][ T4952] Bluetooth: hci1: Opcode 0x0c24 failed: -110 [ 543.688221][T20328] netlink: 44 bytes leftover after parsing attributes in process `syz.3.3511'. [ 543.688250][T20328] netlink: 43 bytes leftover after parsing attributes in process `syz.3.3511'. [ 543.688266][T20328] netlink: 'syz.3.3511': attribute type 5 has an invalid length. [ 543.688280][T20328] netlink: 43 bytes leftover after parsing attributes in process `syz.3.3511'. [ 544.105461][T20349] sctp: [Deprecated]: syz.3.3517 (pid 20349) Use of int in maxseg socket option. [ 544.105461][T20349] Use struct sctp_assoc_value instead [ 544.217548][T20356] netlink: 40 bytes leftover after parsing attributes in process `syz.0.3516'. [ 544.233964][T20355] sctp: [Deprecated]: syz.1.3519 (pid 20355) Use of int in maxseg socket option. [ 544.233964][T20355] Use struct sctp_assoc_value instead [ 544.298072][T20355] netlink: 'syz.1.3519': attribute type 1 has an invalid length. [ 544.347481][T20355] 8021q: adding VLAN 0 to HW filter on device bond2 [ 544.361150][T20184] Bluetooth: hci4: Malformed Event: 0x02 [ 544.367761][T20347] netlink: 'syz.0.3516': attribute type 21 has an invalid length. [ 544.367887][T20347] netlink: 'syz.0.3516': attribute type 1 has an invalid length. [ 544.367930][T20347] netlink: 144 bytes leftover after parsing attributes in process `syz.0.3516'. [ 544.426092][T20355] bond2: (slave veth0_to_bond): Enslaving as an active interface with a down link [ 544.718167][T20385] netlink: 16 bytes leftover after parsing attributes in process `syz.1.3526'. [ 544.721340][T20385] netlink: 12 bytes leftover after parsing attributes in process `syz.1.3526'. [ 544.882392][T20396] netlink: 'syz.2.3529': attribute type 1 has an invalid length. [ 544.882416][T20396] netlink: 4320 bytes leftover after parsing attributes in process `syz.2.3529'. [ 545.018962][T20400] netlink: 'syz.1.3530': attribute type 1 has an invalid length. [ 545.059055][T20400] netlink: 4 bytes leftover after parsing attributes in process `syz.1.3530'. [ 545.084098][T20400] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 545.121250][T20407] netdevsim netdevsim3 netdevsim0: entered allmulticast mode [ 545.163349][T20405] macsec1: entered promiscuous mode [ 545.163376][T20405] team0: entered promiscuous mode [ 545.163389][T20405] team_slave_0: entered promiscuous mode [ 545.163632][T20405] team_slave_1: entered promiscuous mode [ 545.164213][T20405] macsec1: entered allmulticast mode [ 545.164229][T20405] team0: entered allmulticast mode [ 545.199412][T20405] team_slave_0: entered allmulticast mode [ 545.199446][T20405] team_slave_1: entered allmulticast mode [ 545.216648][T20405] 8021q: adding VLAN 0 to HW filter on device macsec1 [ 545.217217][T20405] team0: Device macsec1 is already an upper device of the team interface [ 545.233487][T20405] team0: left allmulticast mode [ 545.233509][T20405] team_slave_0: left allmulticast mode [ 545.233525][T20405] team_slave_1: left allmulticast mode [ 545.233572][T20405] team0: left promiscuous mode [ 545.324881][ T6208] team_slave_0: left promiscuous mode [ 545.324938][ T6208] team_slave_1: left promiscuous mode [ 545.333654][T20413] llcp: llcp_sock_recvmsg: Recv datagram failed state 4 -107 0 [ 545.381988][T20419] netlink: 'syz.1.3536': attribute type 6 has an invalid length. [ 545.383721][T20419] tipc: Enabled bearer , priority 10 [ 545.465319][T20421] net_ratelimit: 25 callbacks suppressed [ 545.465343][T20421] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 545.726681][T20438] sctp: [Deprecated]: syz.1.3541 (pid 20438) Use of int in maxseg socket option. [ 545.726681][T20438] Use struct sctp_assoc_value instead [ 545.726741][T20438] sctp: [Deprecated]: syz.1.3541 (pid 20438) Use of int in maxseg socket option. [ 545.726741][T20438] Use struct sctp_assoc_value instead [ 545.726785][T20438] sctp: [Deprecated]: syz.1.3541 (pid 20438) Use of int in maxseg socket option. [ 545.726785][T20438] Use struct sctp_assoc_value instead [ 545.726829][T20438] sctp: [Deprecated]: syz.1.3541 (pid 20438) Use of int in maxseg socket option. [ 545.726829][T20438] Use struct sctp_assoc_value instead [ 545.726872][T20438] sctp: [Deprecated]: syz.1.3541 (pid 20438) Use of int in maxseg socket option. [ 545.726872][T20438] Use struct sctp_assoc_value instead [ 545.727003][T20438] sctp: [Deprecated]: syz.1.3541 (pid 20438) Use of int in maxseg socket option. [ 545.727003][T20438] Use struct sctp_assoc_value instead [ 545.727048][T20438] sctp: [Deprecated]: syz.1.3541 (pid 20438) Use of int in maxseg socket option. [ 545.727048][T20438] Use struct sctp_assoc_value instead [ 545.727097][T20438] sctp: [Deprecated]: syz.1.3541 (pid 20438) Use of int in maxseg socket option. [ 545.727097][T20438] Use struct sctp_assoc_value instead [ 546.474076][T20463] batman_adv: Cannot find parent device. Skipping batadv-on-batadv check for gretap1 [ 546.474969][T20463] batman_adv: batadv0: Adding interface: gretap1 [ 546.474986][T20463] batman_adv: batadv0: The MTU of interface gretap1 is too small (1462) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 546.475092][T20463] batman_adv: batadv0: Interface activated: gretap1 [ 546.775755][T20472] openvswitch: netlink: Tunnel attr 20 out of range max 16 [ 546.997116][T20482] netlink: 'syz.4.3552': attribute type 4 has an invalid length. [ 547.144398][T20481] netdevsim netdevsim4 netdevsim0: entered allmulticast mode [ 547.584480][T20505] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 547.593341][T20490] __nla_validate_parse: 103 callbacks suppressed [ 547.593361][T20490] netlink: 24 bytes leftover after parsing attributes in process `syz.2.3553'. [ 547.621708][T20505] netlink: 24 bytes leftover after parsing attributes in process `syz.1.3556'. [ 547.626371][T20506] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 547.653042][T20512] netlink: 24 bytes leftover after parsing attributes in process `syz.1.3556'. [ 547.857800][T20517] netlink: 92 bytes leftover after parsing attributes in process `syz.0.3558'. [ 547.872495][T20518] netlink: 92 bytes leftover after parsing attributes in process `syz.0.3558'. [ 548.094360][T20530] netlink: 308 bytes leftover after parsing attributes in process `syz.2.3561'. [ 548.245514][T20544] netdevsim netdevsim2 netdevsim0: entered allmulticast mode [ 548.260642][T20543] netlink: 'syz.2.3565': attribute type 1 has an invalid length. [ 548.261903][T20543] xt_time: unknown flags 0x4 [ 548.301376][T20543] netlink: 44 bytes leftover after parsing attributes in process `syz.2.3565'. [ 548.326688][T20538] sctp: [Deprecated]: syz.0.3563 (pid 20538) Use of struct sctp_assoc_value in delayed_ack socket option. [ 548.326688][T20538] Use struct sctp_sack_info instead [ 548.557266][T20557] ipip0: entered allmulticast mode [ 548.762861][T20566] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 548.917136][T20546] netlink: 20 bytes leftover after parsing attributes in process `syz.0.3563'. [ 548.964510][T20569] netlink: 132 bytes leftover after parsing attributes in process `syz.0.3563'. [ 549.010933][T20578] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 549.100762][T20566] bridge0: port 2(bridge_slave_1) entered blocking state [ 549.100964][T20566] bridge0: port 2(bridge_slave_1) entered forwarding state [ 549.101329][T20566] bridge0: port 1(syzkalle) entered blocking state [ 549.101485][T20566] bridge0: port 1(syzkalle) entered forwarding state [ 549.187054][T20581] netlink: 32 bytes leftover after parsing attributes in process `syz.3.3574'. [ 549.262492][T13289] bond2: (slave veth3): link status definitely up, 10000 Mbps full duplex [ 549.262567][T13289] bond2: Warning: No 802.3ad response from the link partner for any adapters in the bond [ 549.311547][T13289] bond2: active interface up! [ 549.367192][ T30] audit: type=1800 audit(1794375708.335:41): pid=20581 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.3.3574" name="blkio.bfq.time_recursive" dev="tmpfs" ino=343 res=0 errno=-22 [ 549.481353][T20591] ip6t_frag: unknown flags 4 [ 549.831568][T20606] xt_check_table_hooks: 23 callbacks suppressed [ 549.831593][T20606] x_tables: duplicate underflow at hook 3 [ 549.949602][T20611] batman_adv: batadv0: Interface deactivated: dummy0 [ 549.968274][T20611] batman_adv: batadv0: Removing interface: dummy0 [ 550.133505][T20615] ip_tables: iptables: counters copy to user failed while replacing table [ 550.198009][T20615] bridge0: port 3(batadv1) entered blocking state [ 550.198210][T20615] bridge0: port 3(batadv1) entered disabled state [ 550.198443][T20615] batadv1: entered allmulticast mode [ 550.220982][T20615] batadv1: entered promiscuous mode [ 550.497204][T20624] hsr_slave_0: left promiscuous mode [ 550.512972][T20624] hsr_slave_1: left promiscuous mode [ 550.553271][T13294] smbdirect: ib_dev[syz2] removed [ 550.649855][T20642] syzkaller0: left promiscuous mode [ 550.649882][T20642] syzkaller0: left allmulticast mode [ 550.701362][T13288] batman_adv: batadv1: No IGMP Querier present - multicast optimizations disabled [ 550.701384][T13288] batman_adv: batadv1: No MLD Querier present - multicast optimizations disabled [ 550.942734][T20650] ip_tables: iptables: counters copy to user failed while replacing table [ 551.128444][T13293] IPVS: starting estimator thread 0... [ 551.220087][T20668] IPVS: using max 27 ests per chain, 64800 per kthread [ 552.082130][T20689] sctp: [Deprecated]: syz.1.3604 (pid 20689) Use of int in maxseg socket option. [ 552.082130][T20689] Use struct sctp_assoc_value instead [ 552.102514][T20695] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 552.145174][T20695] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 552.345314][T20709] netlink: 'syz.1.3609': attribute type 1 has an invalid length. [ 552.644576][T20720] __nla_validate_parse: 6 callbacks suppressed [ 552.644599][T20720] netlink: 8 bytes leftover after parsing attributes in process `syz.1.3610'. [ 552.705589][T20720] netlink: 8 bytes leftover after parsing attributes in process `syz.1.3610'. [ 552.706981][T20719] netlink: 8 bytes leftover after parsing attributes in process `syz.1.3610'. [ 552.745571][T20720] netlink: 8 bytes leftover after parsing attributes in process `syz.1.3610'. [ 552.765345][T20720] netlink: 8 bytes leftover after parsing attributes in process `syz.1.3610'. [ 552.828464][T20720] netlink: 8 bytes leftover after parsing attributes in process `syz.1.3610'. [ 552.859847][T20720] netlink: 8 bytes leftover after parsing attributes in process `syz.1.3610'. [ 552.926767][T20720] netlink: 8 bytes leftover after parsing attributes in process `syz.1.3610'. [ 552.945395][T20720] netlink: 8 bytes leftover after parsing attributes in process `syz.1.3610'. [ 552.964755][T20720] netlink: 8 bytes leftover after parsing attributes in process `syz.1.3610'. [ 553.397637][T20733] bond0: option lacp_strict: mode dependency failed, not supported in mode balance-rr(0) [ 553.632984][T20742] netlink: 'syz.4.3616': attribute type 1 has an invalid length. [ 553.931162][T20765] Bluetooth: MGMT ver 1.23 [ 554.047563][T20774] openvswitch: netlink: Actions may not be safe on all matching packets [ 554.052648][T20776] openvswitch: netlink: Actions may not be safe on all matching packets [ 554.993775][T20821] netlink: 'syz.4.3636': attribute type 4 has an invalid length. [ 555.255665][T20839] bridge0: port 3(veth0) entered blocking state [ 555.255794][T20839] bridge0: port 3(veth0) entered disabled state [ 555.255981][T20839] veth0: entered allmulticast mode [ 555.263427][T20839] veth0: entered promiscuous mode [ 555.266711][T20839] bridge0: port 3(veth0) entered blocking state [ 555.266830][T20839] bridge0: port 3(veth0) entered forwarding state [ 555.505825][T20848] atm:do_vcc_ioctl: ATM_SETSC is obsolete; used by syz.4.3645:20848 [ 555.737830][T20865] syz.2.3648: vmalloc error: size 34359742464, exceeds total pages, mode:0x400dc0(GFP_KERNEL_ACCOUNT|__GFP_ZERO), nodemask=(null),cpuset=/,mems_allowed=0-1 [ 555.737939][T20865] CPU: 0 UID: 0 PID: 20865 Comm: syz.2.3648 Not tainted syzkaller #0 PREEMPT(full) [ 555.737962][T20865] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 11/06/2026 [ 555.737975][T20865] Call Trace: [ 555.737985][T20865] [ 555.737995][T20865] dump_stack_lvl+0xe8/0x150 [ 555.738033][T20865] warn_alloc+0x24d/0x270 [ 555.738057][T20865] ? stack_depot_save_flags+0x33/0x810 [ 555.738090][T20865] ? __pfx_warn_alloc+0x10/0x10 [ 555.738113][T20865] ? kasan_save_track+0x4f/0x80 [ 555.738141][T20865] ? __kasan_kmalloc+0x93/0xb0 [ 555.738169][T20865] ? xsk_init_queue+0x8a/0xe0 [ 555.738192][T20865] ? xsk_setsockopt+0x5e0/0x960 [ 555.738216][T20865] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 555.738252][T20865] __vmalloc_node_range_noprof+0x12c/0x16f0 [ 555.738310][T20865] ? rcu_is_watching+0x16/0xb0 [ 555.738345][T20865] ? __pfx___vmalloc_node_range_noprof+0x10/0x10 [ 555.738368][T20865] ? __kmalloc_cache_noprof+0x31c/0x600 [ 555.738395][T20865] ? __kmalloc_cache_noprof+0x148/0x600 [ 555.738419][T20865] ? xskq_create+0x56/0x220 [ 555.738448][T20865] xskq_create+0x148/0x220 [ 555.738473][T20865] ? xsk_init_queue+0x8a/0xe0 [ 555.738500][T20865] xsk_init_queue+0x8a/0xe0 [ 555.738528][T20865] xsk_setsockopt+0x5e0/0x960 [ 555.738553][T20865] ? __pfx_xsk_setsockopt+0x10/0x10 [ 555.738577][T20865] ? __pfx_aa_sk_perm+0x10/0x10 [ 555.738611][T20865] ? aa_sock_opt_perm+0x142/0x1e0 [ 555.738637][T20865] ? bpf_lsm_socket_setsockopt+0x9/0x20 [ 555.738662][T20865] ? __pfx_xsk_setsockopt+0x10/0x10 [ 555.738688][T20865] do_sock_setsockopt+0x17c/0x1b0 [ 555.738717][T20865] __x64_sys_setsockopt+0x13d/0x1b0 [ 555.738747][T20865] do_syscall_64+0x166/0x520 [ 555.738772][T20865] ? trace_irq_disable+0x3b/0x140 [ 555.738800][T20865] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 555.738821][T20865] ? clear_bhb_loop+0x70/0xc0 [ 555.738846][T20865] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 555.738867][T20865] RIP: 0033:0x7f787bba8f19 [ 555.738892][T20865] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 555.738909][T20865] RSP: 002b:00007f787caaf028 EFLAGS: 00000246 ORIG_RAX: 0000000000000036 [ 555.738937][T20865] RAX: ffffffffffffffda RBX: 00007f787be26180 RCX: 00007f787bba8f19 [ 555.738952][T20865] RDX: 0000000000000003 RSI: 000000000000011b RDI: 0000000000000004 [ 555.738965][T20865] RBP: 00007f787bc37f6d R08: 0000000000000004 R09: 0000000000000000 [ 555.738977][T20865] R10: 0000200000000000 R11: 0000000000000246 R12: 0000000000000000 [ 555.738990][T20865] R13: 00007f787be26218 R14: 00007f787be26180 R15: 00007ffd7e66f2b8 [ 555.739027][T20865] [ 555.739058][T20865] Mem-Info: [ 555.739068][T20865] active_anon:9331 inactive_anon:0 isolated_anon:0 [ 555.739068][T20865] active_file:2 inactive_file:43789 isolated_file:0 [ 555.739068][T20865] unevictable:0 dirty:228 writeback:0 [ 555.739068][T20865] slab_reclaimable:13002 slab_unreclaimable:130077 [ 555.739068][T20865] mapped:29680 shmem:536 pagetables:1381 [ 555.739068][T20865] sec_pagetables:0 bounce:0 [ 555.739068][T20865] kernel_misc_reclaimable:0 [ 555.739068][T20865] free:1238850 free_pcp:11236 free_cma:0 [ 555.771581][T20865] Node 0 active_anon:37324kB inactive_anon:0kB active_file:8kB inactive_file:174956kB unevictable:0kB isolated(anon):0kB isolated(file):0kB mapped:118720kB dirty:912kB writeback:0kB shmem:2144kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB kernel_stack:17380kB pagetables:5352kB sec_pagetables:0kB all_unreclaimable? no Balloon:0kB gpu_active:0kB gpu_reclaim:0kB [ 555.771641][T20865] Node 1 active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:200kB unevictable:0kB isolated(anon):0kB isolated(file):0kB mapped:0kB dirty:0kB writeback:0kB shmem:0kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB kernel_stack:32kB pagetables:172kB sec_pagetables:0kB all_unreclaimable? no Balloon:0kB gpu_active:0kB gpu_reclaim:0kB [ 555.771686][T20865] Node 0 DMA free:15360kB boost:0kB min:208kB low:260kB high:312kB reserved_highatomic:0kB free_highatomic:0kB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB zspages:0kB present:15992kB managed:15360kB mlocked:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB [ 555.771762][T20865] lowmem_reserve[]: 0 2463 2465 2465 2465 [ 555.771797][T20865] Node 0 DMA32 free:990580kB boost:0kB min:33920kB low:42400kB high:50880kB reserved_highatomic:0kB free_highatomic:0kB active_anon:37324kB inactive_anon:0kB active_file:8kB inactive_file:174956kB unevictable:0kB writepending:912kB zspages:0kB present:3129332kB managed:2522824kB mlocked:0kB bounce:0kB free_pcp:44944kB local_pcp:24072kB free_cma:0kB [ 555.771849][T20865] lowmem_reserve[]: 0 0 1 1 1 [ 555.771880][T20865] Node 0 Normal free:0kB boost:0kB min:16kB low:20kB high:24kB reserved_highatomic:0kB free_highatomic:0kB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB zspages:0kB present:1048580kB managed:1392kB mlocked:0kB bounce:0kB free_pcp:4kB local_pcp:0kB free_cma:0kB [ 555.771927][T20865] lowmem_reserve[]: 0 0 0 0 0 [ 555.771959][T20865] Node 1 Normal free:3949460kB boost:0kB min:55960kB low:69948kB high:83936kB reserved_highatomic:0kB free_highatomic:0kB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:200kB unevictable:0kB writepending:0kB zspages:0kB present:4194300kB managed:4111104kB mlocked:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB [ 555.772007][T20865] lowmem_reserve[]: 0 0 0 0 0 [ 555.772038][T20865] Node 0 DMA: 0*4kB 0*8kB 0*16kB 0*32kB 0*64kB 0*128kB 0*256kB 0*512kB 1*1024kB (U) 1*2048kB (M) 3*4096kB (M) = 15360kB [ 555.772142][T20865] Node 0 DMA32: 1153*4kB (UME) 824*8kB (UME) 161*16kB (UME) 733*32kB (UME) 180*64kB (UME) 68*128kB (UME) 33*256kB (UME) 10*512kB (UME) 2*1024kB (M) 4*2048kB (UME) 222*4096kB (UM) = 990580kB [ 555.772285][T20865] Node 0 Normal: 0*4kB 0*8kB 0*16kB 0*32kB 0*64kB 0*128kB 0*256kB 0*512kB 0*1024kB 0*2048kB 0*4096kB = 0kB [ 555.772373][T20865] Node 1 Normal: 5*4kB (UM) 6*8kB (UM) 17*16kB (UM) 10*32kB (UM) 10*64kB (UM) 9*128kB (UM) 8*256kB (UM) 5*512kB (UM) 2*1024kB (UM) 0*2048kB 962*4096kB (UM) = 3949460kB [ 555.772516][T20865] Node 0 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 555.772530][T20865] Node 0 hugepages_total=2 hugepages_free=2 hugepages_surp=0 hugepages_size=2048kB [ 555.772544][T20865] Node 1 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 555.772558][T20865] Node 1 hugepages_total=2 hugepages_free=2 hugepages_surp=0 hugepages_size=2048kB [ 555.772572][T20865] 44323 total pagecache pages [ 555.772580][T20865] 0 pages in swap cache [ 555.772586][T20865] Free swap = 124996kB [ 555.772594][T20865] Total swap = 124996kB [ 555.772601][T20865] 2097051 pages RAM [ 555.772608][T20865] 0 pages HighMem/MovableOnly [ 555.772615][T20865] 434381 pages reserved [ 555.772622][T20865] 0 pages cma reserved [ 555.807671][T20870] syzkaller0: entered promiscuous mode [ 555.807693][T20870] syzkaller0: entered allmulticast mode [ 556.774501][T20902] netlink: 'syz.3.3655': attribute type 10 has an invalid length. [ 556.903168][T20916] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 557.113866][T20920] ip_tables: iptables: counters copy to user failed while replacing table [ 557.155981][T20922] netlink: 'syz.1.3660': attribute type 10 has an invalid length. [ 557.158412][T20922] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 557.163805][T20922] team0: Port device netdevsim0 added [ 557.230240][T20924] netlink: 'syz.2.3662': attribute type 1 has an invalid length. [ 557.413590][T20931] ip6tnl1: entered promiscuous mode [ 557.561465][T20941] bond3: (slave wlan1): Releasing active interface [ 557.644952][T20945] netlink: 'syz.0.3668': attribute type 1 has an invalid length. [ 557.729722][T20951] netlink: 'syz.2.3669': attribute type 1 has an invalid length. [ 557.877304][T20951] 8021q: adding VLAN 0 to HW filter on device bond4 [ 558.105557][T20967] __nla_validate_parse: 40 callbacks suppressed [ 558.105584][T20967] netlink: 20 bytes leftover after parsing attributes in process `syz.4.3672'. [ 558.164358][T20970] netlink: 'syz.4.3672': attribute type 30 has an invalid length. [ 558.856149][T20952] bond4: (slave veth7): Enslaving as an active interface with a down link [ 559.100358][T20983] netlink: 'syz.2.3674': attribute type 12 has an invalid length. [ 559.145635][T20988] nbd: nbd3 already in use [ 559.145920][T20988] block nbd3: NBD_DISCONNECT [ 559.146419][T20988] block nbd3: Send disconnect failed -32 [ 559.146444][T20988] block nbd3: shutting down sockets [ 559.691486][T21007] ip_tables: iptables: counters copy to user failed while replacing table [ 559.791819][T21007] syzkaller1: entered promiscuous mode [ 559.791838][T21007] syzkaller1: entered allmulticast mode [ 559.872556][T21009] netlink: 45349 bytes leftover after parsing attributes in process `syz.3.3681'. [ 559.918597][T21015] netlink: 200 bytes leftover after parsing attributes in process `syz.1.3682'. [ 559.918627][T21015] openvswitch: netlink: Flow set message rejected, Key attribute missing. [ 560.000217][T21009] 0ªX¹¦Dö»: renamed from gretap0 (while UP) [ 560.003824][T21009] 0ªX¹¦Dö»: entered allmulticast mode [ 560.126429][T21022] tipc: Started in network mode [ 560.126508][T21022] tipc: Node identity ceb8b72822d8, cluster identity 4711 [ 560.127020][T21022] tipc: Enabled bearer , priority 0 [ 560.127810][T21024] netlink: 'syz.0.3686': attribute type 1 has an invalid length. [ 560.128943][T21024] netlink: 4 bytes leftover after parsing attributes in process `syz.0.3686'. [ 560.382680][T21039] bond5: up delay (7) is not a multiple of miimon (100), value rounded to 0 ms [ 560.382714][T21039] bond5: down delay (1) is not a multiple of miimon (100), value rounded to 0 ms [ 560.382962][T21039] bond5: entered allmulticast mode [ 560.436853][T21042] openvswitch: netlink: Flow key attr not present in new flow. [ 560.448212][T21042] netlink: 4 bytes leftover after parsing attributes in process `syz.3.3688'. [ 560.455845][T21042] netlink: 4 bytes leftover after parsing attributes in process `syz.3.3688'. [ 560.570860][T21045] block nbd3: shutting down sockets [ 560.608353][ C0] vxcan1: j1939_tp_rxtimer: 0xffff88804e4a0400: rx timeout, send abort [ 560.618845][T21045] netlink: 16 bytes leftover after parsing attributes in process `syz.2.3690'. [ 560.817212][T21049] netlink: 16 bytes leftover after parsing attributes in process `syz.0.3692'. [ 560.817280][T21049] netlink: 64 bytes leftover after parsing attributes in process `syz.0.3692'. [ 560.817294][T21049] tipc: Invalid UDP bearer configuration [ 560.817341][T21049] tipc: Enabling of bearer rejected, failed to enable media [ 560.837403][T21051] netlink: 4 bytes leftover after parsing attributes in process `syz.1.3693'. [ 561.108433][ C0] vxcan1: j1939_tp_rxtimer: 0xffff88804e4a0400: abort rx timeout. Force session deactivation [ 561.110933][ C0] vxcan1: j1939_tp_rxtimer: 0xffff88804e4a0000: rx timeout, send abort [ 561.133202][ C0] vxcan1: j1939_xtp_rx_rts_session_active: 0xffff88804e4a0000: connection exists (fe ff). last cmd: 20 [ 561.239355][ T6212] tipc: Node number set to 3965761320 [ 561.382975][ C0] vxcan1: j1939_tp_rxtimer: 0xffff88802b604400: rx timeout, send abort [ 561.458875][T21078] netlink: 'syz.0.3700': attribute type 6 has an invalid length. [ 561.883026][ C0] vxcan1: j1939_tp_rxtimer: 0xffff88802b604400: abort rx timeout. Force session deactivation [ 562.288651][T20184] Bluetooth: hci1: link tx timeout [ 562.288691][T20184] Bluetooth: hci1: killing stalled connection 10:aa:aa:aa:aa:aa [ 562.293700][T20184] Bluetooth: hci1: link tx timeout [ 562.293719][T20184] Bluetooth: hci1: killing stalled connection 11:aa:aa:aa:aa:aa [ 563.935445][T21177] syzkaller1: entered promiscuous mode [ 563.935471][T21177] syzkaller1: entered allmulticast mode [ 563.937621][T21177] TC_ACT_REPEAT abuse ? [ 564.340546][T21145] Bluetooth: hci1: command 0x0c24 tx timeout [ 564.500163][ T4952] Bluetooth: hci3: Opcode 0x0c1a failed: -110 [ 564.501362][ T4952] Bluetooth: hci3: command 0x0c1a tx timeout [ 564.505545][T21203] __nla_validate_parse: 4 callbacks suppressed [ 564.505563][T21203] netlink: 156 bytes leftover after parsing attributes in process `syz.1.3728'. [ 564.505577][T21203] netlink: 68 bytes leftover after parsing attributes in process `syz.1.3728'. [ 565.078612][T21233] sctp: [Deprecated]: syz.4.3736 (pid 21233) Use of int in max_burst socket option. [ 565.078612][T21233] Use struct sctp_assoc_value instead [ 565.126842][T21233] netlink: 8 bytes leftover after parsing attributes in process `syz.4.3736'. [ 565.126888][T21233] x_tables: ip6_tables: policy.0 match: invalid size 312 (kernel) != (user) 0 [ 565.222354][T21145] Bluetooth: hci5: command 0x0406 tx timeout [ 566.117869][T21255] sit3: entered promiscuous mode [ 566.419947][T21113] Bluetooth: hci1: command 0x0c24 tx timeout [ 566.632654][T21285] openvswitch: netlink: Unexpected mask (mask=200040, allowed=10048) [ 566.791460][T21290] xt_hashlimit: max too large, truncated to 1048576 [ 567.160187][T21307] netlink: 8 bytes leftover after parsing attributes in process `syz.1.3750'. [ 567.177846][T21308] netlink: 16 bytes leftover after parsing attributes in process `syz.1.3750'. [ 567.744698][T21324] syz_tun: left allmulticast mode [ 567.744730][T21324] syz_tun: left promiscuous mode [ 567.745004][T21324] bridge0: port 3(syz_tun) entered disabled state [ 567.778268][T21324] bond0: left allmulticast mode [ 567.778294][T21324] bond_slave_0: left allmulticast mode [ 567.778311][T21324] bond_slave_1: left allmulticast mode [ 567.778329][T21324] bond0: left promiscuous mode [ 567.778340][T21324] bond_slave_0: left promiscuous mode [ 567.778575][T21324] bond_slave_1: left promiscuous mode [ 567.780212][T21324] bridge0: port 1(bond0) entered disabled state [ 567.835194][T21324] batman_adv: batadv0: Interface deactivated: veth0 [ 567.835222][T21324] batman_adv: batadv0: Removing interface: veth0 [ 567.853707][T21324] bridge_slave_1: left allmulticast mode [ 567.853734][T21324] bridge_slave_1: left promiscuous mode [ 567.855374][T21324] bridge0: port 2(bridge_slave_1) entered disabled state [ 567.903716][T21324] bond2: (slave veth0_to_bond): Releasing active interface [ 567.956286][T21324] bond0: (slave bond_slave_0): Releasing backup interface [ 567.983821][T21324] bond0: (slave bond_slave_1): Releasing backup interface [ 568.014346][T21324] team0: Port device team_slave_0 removed [ 568.027700][T21324] team0: Port device team_slave_1 removed [ 568.028978][T21324] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 568.082590][T21324] team0: Port device netdevsim0 removed [ 568.212999][T21336] team0: Mode changed to "broadcast" [ 568.315219][T21345] netlink: 8 bytes leftover after parsing attributes in process `syz.3.3758'. [ 569.255844][T21392] netlink: 8 bytes leftover after parsing attributes in process `syz.1.3765'. [ 569.647561][T21421] netlink: 12 bytes leftover after parsing attributes in process `syz.2.3769'. [ 570.007764][T21441] netlink: 132 bytes leftover after parsing attributes in process `syz.0.3772'. [ 570.985307][T21449] bridge0: port 2(bridge_slave_1) entered disabled state [ 570.986068][T21449] bridge0: port 1(bridge_slave_0) entered disabled state [ 571.630152][T21449] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 571.686995][T21449] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 572.138735][T21449] batman_adv: batadv0: Interface deactivated: gretap1 [ 572.179428][ T43] netdevsim netdevsim3 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 572.179466][ T43] netdevsim netdevsim3 netdevsim1: unset [1, 1] type 2 family 0 port 20000 - 0 [ 572.179501][ T43] netdevsim netdevsim3 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 572.179524][ T43] netdevsim netdevsim3 netdevsim0: unset [1, 1] type 2 family 0 port 20000 - 0 [ 572.179555][ T43] netdevsim netdevsim3 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 572.179578][ T43] netdevsim netdevsim3 netdevsim3: unset [1, 1] type 2 family 0 port 20000 - 0 [ 572.179609][ T43] netdevsim netdevsim3 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 572.179632][ T43] netdevsim netdevsim3 netdevsim2: unset [1, 1] type 2 family 0 port 20000 - 0 [ 572.268706][T21398] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 572.570903][T21498] syzkaller1: entered promiscuous mode [ 572.570930][T21498] syzkaller1: entered allmulticast mode [ 572.921583][T21518] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 572.962035][T21518] ip_tables: iptables: counters copy to user failed while replacing table [ 573.323749][T21528] netlink: 20 bytes leftover after parsing attributes in process `syz.2.3783'. [ 573.389007][T21532] netlink: 'syz.4.3786': attribute type 1 has an invalid length. [ 573.433528][T21537] netlink: 8 bytes leftover after parsing attributes in process `syz.1.3784'. [ 573.435187][T21537] netlink: 24 bytes leftover after parsing attributes in process `syz.1.3784'. [ 573.435207][T21537] netlink: 8 bytes leftover after parsing attributes in process `syz.1.3784'. [ 573.496187][T21532] 8021q: adding VLAN 0 to HW filter on device bond2 [ 573.542880][T21532] netlink: 'syz.4.3786': attribute type 4 has an invalid length. [ 573.546785][T21532] netlink: 'syz.4.3786': attribute type 4 has an invalid length. [ 573.761133][T21546] netlink: 12 bytes leftover after parsing attributes in process `syz.3.3788'. [ 573.761161][T21546] netlink: 24 bytes leftover after parsing attributes in process `syz.3.3788'. [ 573.907607][T21546] netlink: 8 bytes leftover after parsing attributes in process `syz.3.3788'. [ 573.907676][T21546] netlink: 4 bytes leftover after parsing attributes in process `syz.3.3788'. [ 574.546679][T21572] ip6erspan0: entered allmulticast mode [ 574.806018][T21582] vti0: entered promiscuous mode [ 575.043434][T21594] netlink: 28 bytes leftover after parsing attributes in process `syz.3.3798'. [ 575.133627][T21605] siw: device registration error -23 [ 575.683927][T21627] macsec1: entered promiscuous mode [ 575.707856][T21629] bond0: (slave ip6tnl0): refused to change device type [ 575.708807][T21629] ip_tables: iptables: counters copy to user failed while replacing table [ 575.792018][T21632] netlink: 20 bytes leftover after parsing attributes in process `syz.1.3808'. [ 575.952743][T21645] netlink: 'syz.3.3811': attribute type 15 has an invalid length. [ 576.054034][T21649] netlink: 12 bytes leftover after parsing attributes in process `syz.4.3813'. [ 576.188390][T21657] netlink: 32 bytes leftover after parsing attributes in process `syz.1.3815'. [ 576.350625][T21658] tipc: Resetting bearer [ 576.379503][T21673] netlink: 28 bytes leftover after parsing attributes in process `syz.0.3814'. [ 576.404179][T21658] bridge0: port 2(bridge_slave_1) entered disabled state [ 576.405074][T21658] bridge0: port 1(bridge_slave_0) entered disabled state [ 576.697408][T21658] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 576.738271][T21686] netlink: 24 bytes leftover after parsing attributes in process `syz.2.3822'. [ 576.748745][T21658] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 577.103101][T21712] netlink: 40 bytes leftover after parsing attributes in process `syz.1.3826'. [ 577.410265][T21658] batman_adv: batadv0: Interface deactivated: gretap1 [ 577.710453][ T7419] netdevsim netdevsim0 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 577.710504][ T7419] netdevsim netdevsim0 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 577.710539][ T7419] netdevsim netdevsim0 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 577.710571][ T7419] netdevsim netdevsim0 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 577.856082][T21733] block nbd0: reconnected socket [ 577.869834][T21728] netlink: 8 bytes leftover after parsing attributes in process `syz.1.3832'. [ 578.008937][T21741] netlink: 'syz.0.3835': attribute type 1 has an invalid length. [ 578.092383][T20184] block nbd0: Receive control failed (result -32) [ 578.378683][T21754] IPVS: ip_vs_add_dest(): server weight less than zero [ 578.451194][T21758] netlink: 24 bytes leftover after parsing attributes in process `syz.1.3841'. [ 578.464172][T21760] ip_tables: iptables: counters copy to user failed while replacing table [ 578.464551][T21761] ip_tables: iptables: counters copy to user failed while replacing table [ 578.602320][T21767] netlink: 24 bytes leftover after parsing attributes in process `syz.3.3843'. [ 579.037934][T21786] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 579.038024][T21787] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 579.073193][T21792] hsr0: entered allmulticast mode [ 579.073217][T21792] hsr_slave_0: entered allmulticast mode [ 579.073234][T21792] hsr_slave_1: entered allmulticast mode [ 579.857289][T21785] hsr0: left allmulticast mode [ 579.857316][T21785] hsr_slave_0: left allmulticast mode [ 579.857334][T21785] hsr_slave_1: left allmulticast mode [ 580.204918][T21826] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 580.361070][T21832] __nla_validate_parse: 1 callbacks suppressed [ 580.361091][T21832] netlink: 596 bytes leftover after parsing attributes in process `syz.0.3859'. [ 580.366217][T21832] netlink: 24 bytes leftover after parsing attributes in process `syz.0.3859'. [ 580.388749][T21832] ip_tables: iptables: counters copy to user failed while replacing table [ 580.394555][T21832] Bluetooth: hci0: add_remote_oob_data: invalid len of 70 bytes [ 580.431525][T21834] sch_tbf: burst 19872 is lower than device lo mtu (65550) ! [ 580.497315][T21836] [ 580.499730][T21836] ====================================================== [ 580.507059][T21836] WARNING: possible circular locking dependency detected [ 580.515108][T21836] syzkaller #0 Not tainted [ 580.519701][T21836] ------------------------------------------------------ [ 580.526724][T21836] syz.2.3860/21836 is trying to acquire lock: [ 580.532789][T21836] ffff88801d28d210 (&root->kernfs_iattr_rwsem){++++}-{4:4}, at: kernfs_unlink_sibling+0x6d/0x240 [ 580.543408][T21836] [ 580.543408][T21836] but task is already holding lock: [ 580.550778][T21836] ffff88801d28d180 (&root->kernfs_rwsem){++++}-{4:4}, at: kernfs_rename_ns+0xb4/0x9e0 [ 580.560360][T21836] [ 580.560360][T21836] which lock already depends on the new lock. [ 580.560360][T21836] [ 580.570762][T21836] [ 580.570762][T21836] the existing dependency chain (in reverse order) is: [ 580.579770][T21836] [ 580.579770][T21836] -> #9 (&root->kernfs_rwsem){++++}-{4:4}: [ 580.587826][T21836] down_write+0x91/0x200 [ 580.592627][T21836] kernfs_add_one+0x41/0x510 [ 580.597739][T21836] kernfs_create_dir_ns+0x18c/0x220 [ 580.603473][T21836] internal_create_group+0x440/0x1180 [ 580.609480][T21836] cpuhp_invoke_callback+0x434/0x810 [ 580.615300][T21836] cpuhp_issue_call+0x3f0/0x750 [ 580.620692][T21836] __cpuhp_setup_state_cpuslocked+0x3f4/0x6f0 [ 580.627301][T21836] __cpuhp_setup_state+0x3f/0x60 [ 580.632779][T21836] do_one_initcall+0x250/0x870 [ 580.638071][T21836] do_initcall_level+0x10a/0x1a0 [ 580.643636][T21836] do_initcalls+0x59/0xa0 [ 580.648500][T21836] kernel_init_freeable+0x29d/0x3e0 [ 580.654231][T21836] kernel_init+0x22/0x1d0 [ 580.659084][T21836] ret_from_fork+0x514/0xb70 [ 580.664375][T21836] ret_from_fork_asm+0x1a/0x30 [ 580.669763][T21836] [ 580.669763][T21836] -> #8 (cpuhp_state_mutex){+.+.}-{4:4}: [ 580.677592][T21836] [ 580.677592][T21836] -> #7 (cpu_hotplug_lock){++++}-{0:0}: [ 580.685425][T21836] cpus_read_lock+0x3d/0x160 [ 580.690557][T21836] static_key_slow_inc+0x12/0x30 [ 580.696109][T21836] nbd_genl_reconnect_sock_cb+0x69a/0xbb0 [ 580.702492][T21836] nbd_genl_foreach_sock+0x265/0x450 [ 580.708391][T21836] nbd_genl_reconfigure+0xbbb/0x1040 [ 580.714197][T21836] genl_family_rcv_msg_doit+0x233/0x340 [ 580.720274][T21836] genl_rcv_msg+0x614/0x7a0 [ 580.725323][T21836] netlink_rcv_skb+0x226/0x4a0 [ 580.730635][T21836] genl_rcv+0x28/0x40 [ 580.735160][T21836] netlink_unicast+0x8ef/0xa80 [ 580.740479][T21836] netlink_sendmsg+0x7f0/0xb20 [ 580.745783][T21836] sock_sendmsg_nosec+0x14e/0x190 [ 580.751339][T21836] ____sys_sendmsg+0x54e/0x850 [ 580.756658][T21836] ___sys_sendmsg+0x2a5/0x360 [ 580.761867][T21836] __x64_sys_sendmsg+0x1b1/0x290 [ 580.767438][T21836] do_syscall_64+0x166/0x520 [ 580.772651][T21836] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 580.779106][T21836] [ 580.779106][T21836] -> #6 (&nsock->tx_lock){+.+.}-{4:4}: [ 580.786774][T21836] __mutex_lock+0x197/0x15a0 [ 580.791894][T21836] nbd_queue_rq+0x373/0xff0 [ 580.796920][T21836] blk_mq_dispatch_rq_list+0x499/0x1990 [ 580.803082][T21836] __blk_mq_sched_dispatch_requests+0xd36/0x1580 [ 580.809958][T21836] blk_mq_sched_dispatch_requests+0xd7/0x190 [ 580.816459][T21836] blk_mq_run_work_fn+0x167/0x2f0 [ 580.822003][T21836] process_scheduled_works+0xc3d/0x1630 [ 580.828080][T21836] worker_thread+0xa47/0xfb0 [ 580.833208][T21836] kthread+0x38b/0x480 [ 580.837796][T21836] ret_from_fork+0x514/0xb70 [ 580.842997][T21836] ret_from_fork_asm+0x1a/0x30 [ 580.848284][T21836] [ 580.848284][T21836] -> #5 (&cmd->lock){+.+.}-{4:4}: [ 580.855511][T21836] __mutex_lock+0x197/0x15a0 [ 580.860644][T21836] nbd_queue_rq+0xc1/0xff0 [ 580.865587][T21836] blk_mq_dispatch_rq_list+0x499/0x1990 [ 580.871836][T21836] __blk_mq_sched_dispatch_requests+0xd36/0x1580 [ 580.878683][T21836] blk_mq_sched_dispatch_requests+0xd7/0x190 [ 580.885187][T21836] blk_mq_run_work_fn+0x167/0x2f0 [ 580.890738][T21836] process_scheduled_works+0xc3d/0x1630 [ 580.896826][T21836] worker_thread+0xa47/0xfb0 [ 580.901943][T21836] kthread+0x38b/0x480 [ 580.906543][T21836] ret_from_fork+0x514/0xb70 [ 580.911653][T21836] ret_from_fork_asm+0x1a/0x30 [ 580.916938][T21836] [ 580.916938][T21836] -> #4 (set->srcu){.+.+}-{0:0}: [ 580.924073][T21836] __synchronize_srcu+0xca/0x2f0 [ 580.929572][T21836] elevator_switch+0x1e8/0x7b0 [ 580.934886][T21836] elevator_change+0x2fa/0x480 [ 580.940182][T21836] elevator_set_default+0x375/0x440 [ 580.945928][T21836] blk_register_queue+0x404/0x4f0 [ 580.951480][T21836] __add_disk+0x6b8/0xdb0 [ 580.956341][T21836] add_disk_fwnode+0x100/0x3a0 [ 580.961713][T21836] nbd_dev_add+0x733/0xb60 [ 580.966647][T21836] nbd_init+0x168/0x1f0 [ 580.971357][T21836] do_one_initcall+0x250/0x870 [ 580.976640][T21836] do_initcall_level+0x10a/0x1a0 [ 580.982101][T21836] do_initcalls+0x59/0xa0 [ 580.986954][T21836] kernel_init_freeable+0x29d/0x3e0 [ 580.992689][T21836] kernel_init+0x22/0x1d0 [ 580.997551][T21836] ret_from_fork+0x514/0xb70 [ 581.002663][T21836] ret_from_fork_asm+0x1a/0x30 [ 581.008035][T21836] [ 581.008035][T21836] -> #3 (&q->elevator_lock){+.+.}-{4:4}: [ 581.015852][T21836] __mutex_lock+0x197/0x15a0 [ 581.020967][T21836] elevator_change+0x1af/0x480 [ 581.026259][T21836] elevator_set_none+0xb5/0x140 [ 581.031633][T21836] blk_mq_update_nr_hw_queues+0x60b/0x1b70 [ 581.037961][T21836] nbd_start_device+0x189/0xb30 [ 581.043337][T21836] nbd_genl_connect+0x167d/0x1cd0 [ 581.048886][T21836] genl_family_rcv_msg_doit+0x233/0x340 [ 581.054969][T21836] genl_rcv_msg+0x614/0x7a0 [ 581.060010][T21836] netlink_rcv_skb+0x226/0x4a0 [ 581.065308][T21836] genl_rcv+0x28/0x40 [ 581.069813][T21836] netlink_unicast+0x8ef/0xa80 [ 581.075100][T21836] netlink_sendmsg+0x7f0/0xb20 [ 581.080392][T21836] sock_sendmsg_nosec+0x14e/0x190 [ 581.085975][T21836] ____sys_sendmsg+0x54e/0x850 [ 581.091280][T21836] ___sys_sendmsg+0x2a5/0x360 [ 581.096491][T21836] __x64_sys_sendmsg+0x1b1/0x290 [ 581.101969][T21836] do_syscall_64+0x166/0x520 [ 581.107091][T21836] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 581.113505][T21836] [ 581.113505][T21836] -> #2 (&q->q_usage_counter(io)#49){++++}-{0:0}: [ 581.122162][T21836] blk_alloc_queue+0x544/0x690 [ 581.127461][T21836] __blk_mq_alloc_disk+0x194/0x390 [ 581.133097][T21836] nbd_dev_add+0x494/0xb60 [ 581.138048][T21836] nbd_init+0x168/0x1f0 [ 581.142734][T21836] do_one_initcall+0x250/0x870 [ 581.148019][T21836] do_initcall_level+0x10a/0x1a0 [ 581.153482][T21836] do_initcalls+0x59/0xa0 [ 581.158341][T21836] kernel_init_freeable+0x29d/0x3e0 [ 581.164057][T21836] kernel_init+0x22/0x1d0 [ 581.168906][T21836] ret_from_fork+0x514/0xb70 [ 581.174019][T21836] ret_from_fork_asm+0x1a/0x30 [ 581.179306][T21836] [ 581.179306][T21836] -> #1 (fs_reclaim){+.+.}-{0:0}: [ 581.186515][T21836] fs_reclaim_acquire+0x71/0x100 [ 581.191976][T21836] kmem_cache_alloc_noprof+0x5f/0x600 [ 581.197867][T21836] __kernfs_iattrs+0xdd/0x380 [ 581.203062][T21836] kernfs_iop_setattr+0xe6/0x3f0 [ 581.208528][T21836] notify_change+0xbba/0xea0 [ 581.213642][T21836] do_truncate+0x1c2/0x250 [ 581.218700][T21836] path_openat+0x18a6/0x20f0 [ 581.223861][T21836] do_file_open+0x23e/0x4a0 [ 581.228918][T21836] do_sys_openat2+0x115/0x200 [ 581.234120][T21836] __x64_sys_openat+0x138/0x170 [ 581.239492][T21836] do_syscall_64+0x166/0x520 [ 581.244606][T21836] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 581.251022][T21836] [ 581.251022][T21836] -> #0 (&root->kernfs_iattr_rwsem){++++}-{4:4}: [ 581.259660][T21836] __lock_acquire+0x164c/0x2de0 [ 581.265062][T21836] lock_acquire+0x115/0x350 [ 581.270088][T21836] down_write+0x91/0x200 [ 581.274856][T21836] kernfs_unlink_sibling+0x6d/0x240 [ 581.280664][T21836] kernfs_rename_ns+0x575/0x9e0 [ 581.286039][T21836] sysfs_rename_link_ns+0x16e/0x1b0 [ 581.291757][T21836] device_rename+0x110/0x210 [ 581.296917][T21836] cfg80211_dev_rename+0x16f/0x250 [ 581.302556][T21836] nl80211_set_wiphy+0x63f/0x3430 [ 581.308195][T21836] genl_family_rcv_msg_doit+0x233/0x340 [ 581.314266][T21836] genl_rcv_msg+0x614/0x7a0 [ 581.319377][T21836] netlink_rcv_skb+0x226/0x4a0 [ 581.324668][T21836] genl_rcv+0x28/0x40 [ 581.329174][T21836] netlink_unicast+0x8ef/0xa80 [ 581.334479][T21836] netlink_sendmsg+0x7f0/0xb20 [ 581.339873][T21836] sock_sendmsg_nosec+0x14e/0x190 [ 581.345429][T21836] ____sys_sendmsg+0x54e/0x850 [ 581.350737][T21836] ___sys_sendmsg+0x2a5/0x360 [ 581.356034][T21836] __x64_sys_sendmsg+0x1b1/0x290 [ 581.361507][T21836] do_syscall_64+0x166/0x520 [ 581.366630][T21836] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 581.373043][T21836] [ 581.373043][T21836] other info that might help us debug this: [ 581.373043][T21836] [ 581.383359][T21836] Chain exists of: [ 581.383359][T21836] &root->kernfs_iattr_rwsem --> cpuhp_state_mutex --> &root->kernfs_rwsem [ 581.383359][T21836] [ 581.397928][T21836] Possible unsafe locking scenario: [ 581.397928][T21836] [ 581.405394][T21836] CPU0 CPU1 [ 581.410764][T21836] ---- ---- [ 581.416125][T21836] lock(&root->kernfs_rwsem); [ 581.420903][T21836] lock(cpuhp_state_mutex); [ 581.428033][T21836] lock(&root->kernfs_rwsem); [ 581.435505][T21836] lock(&root->kernfs_iattr_rwsem); [ 581.440797][T21836] [ 581.440797][T21836] *** DEADLOCK *** [ 581.440797][T21836] [ 581.449022][T21836] locks held by syz.2.3860/21836: 4, last CPU#0: [ 581.455418][T21836] #0: ffffffff916f7c28 (cb_lock){++++}-{4:4}, at: genl_rcv+0x19/0x40 [ 581.463694][T21836] #1: ffffffff918dbf20 (cfg80211_mutex){+.+.}-{4:4}, at: nl80211_set_wiphy+0xaa/0x3430 [ 581.473537][T21836] #2: ffff88804ff70800 (&rdev->wiphy.mtx){+.+.}-{4:4}, at: nl80211_set_wiphy+0x4e8/0x3430 [ 581.483543][T21836] #3: ffff88801d28d180 (&root->kernfs_rwsem){++++}-{4:4}, at: kernfs_rename_ns+0xb4/0x9e0 [ 581.493561][T21836] [ 581.493561][T21836] stack backtrace: [ 581.499542][T21836] CPU: 0 UID: 0 PID: 21836 Comm: syz.2.3860 Not tainted syzkaller #0 PREEMPT(full) [ 581.508909][T21836] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 11/06/2026 [ 581.518973][T21836] Call Trace: [ 581.522253][T21836] [ 581.525188][T21836] dump_stack_lvl+0xe8/0x150 [ 581.529787][T21836] print_circular_bug+0x2e2/0x300 [ 581.534827][T21836] check_noncircular+0x12f/0x150 [ 581.539773][T21836] __lock_acquire+0x164c/0x2de0 [ 581.544635][T21836] ? __lock_acquire+0x747/0x2de0 [ 581.549574][T21836] ? __lock_acquire+0x747/0x2de0 [ 581.554517][T21836] lock_acquire+0x115/0x350 [ 581.559026][T21836] ? kernfs_unlink_sibling+0x6d/0x240 [ 581.564504][T21836] down_write+0x91/0x200 [ 581.568759][T21836] ? kernfs_unlink_sibling+0x6d/0x240 [ 581.574228][T21836] ? __pfx_down_write+0x10/0x10 [ 581.579086][T21836] ? kernfs_root+0x1c/0x230 [ 581.583599][T21836] ? kernfs_root+0x1c/0x230 [ 581.588106][T21836] ? kernfs_root+0x1c/0x230 [ 581.592606][T21836] ? kernfs_root+0x1ea/0x230 [ 581.597199][T21836] kernfs_unlink_sibling+0x6d/0x240 [ 581.602401][T21836] kernfs_rename_ns+0x575/0x9e0 [ 581.607350][T21836] sysfs_rename_link_ns+0x16e/0x1b0 [ 581.612554][T21836] device_rename+0x110/0x210 [ 581.617148][T21836] cfg80211_dev_rename+0x16f/0x250 [ 581.622268][T21836] nl80211_set_wiphy+0x63f/0x3430 [ 581.627302][T21836] ? lock_acquire+0x115/0x350 [ 581.632014][T21836] ? __pfx_nl80211_set_wiphy+0x10/0x10 [ 581.637477][T21836] ? nl80211_pre_doit+0x543/0xfa0 [ 581.642505][T21836] ? nl80211_pre_doit+0x86e/0xfa0 [ 581.647529][T21836] ? genl_family_rcv_msg_attrs_parse+0x20b/0x2f0 [ 581.653874][T21836] genl_family_rcv_msg_doit+0x233/0x340 [ 581.659455][T21836] ? __pfx_genl_family_rcv_msg_doit+0x10/0x10 [ 581.665538][T21836] ? bpf_lsm_capable+0x9/0x20 [ 581.670222][T21836] ? security_capable+0x7e/0x2c0 [ 581.675229][T21836] genl_rcv_msg+0x614/0x7a0 [ 581.679781][T21836] ? __pfx_genl_rcv_msg+0x10/0x10 [ 581.684903][T21836] ? __pfx_nl80211_pre_doit+0x10/0x10 [ 581.690467][T21836] ? __pfx_nl80211_set_wiphy+0x10/0x10 [ 581.695970][T21836] ? __pfx_nl80211_post_doit+0x10/0x10 [ 581.701473][T21836] netlink_rcv_skb+0x226/0x4a0 [ 581.706276][T21836] ? __pfx_genl_rcv_msg+0x10/0x10 [ 581.711307][T21836] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 581.716613][T21836] ? down_read+0x2b9/0x320 [ 581.721040][T21836] genl_rcv+0x28/0x40 [ 581.725026][T21836] netlink_unicast+0x8ef/0xa80 [ 581.729804][T21836] netlink_sendmsg+0x7f0/0xb20 [ 581.734569][T21836] ? __pfx_netlink_sendmsg+0x10/0x10 [ 581.739851][T21836] ? aa_sock_msg_perm+0x144/0x210 [ 581.744880][T21836] ? apparmor_socket_sendmsg+0x98/0x360 [ 581.750487][T21836] ? __pfx_netlink_sendmsg+0x10/0x10 [ 581.755781][T21836] sock_sendmsg_nosec+0x14e/0x190 [ 581.760812][T21836] ____sys_sendmsg+0x54e/0x850 [ 581.765583][T21836] ? __pfx_____sys_sendmsg+0x10/0x10 [ 581.770878][T21836] ? import_iovec+0x73/0xa0 [ 581.775390][T21836] ___sys_sendmsg+0x2a5/0x360 [ 581.780067][T21836] ? __lock_acquire+0x747/0x2de0 [ 581.785021][T21836] ? __pfx____sys_sendmsg+0x10/0x10 [ 581.790220][T21836] ? futex_wait+0x2a2/0x390 [ 581.794741][T21836] ? __fget_files+0x3a2/0x420 [ 581.799426][T21836] ? __fget_files+0x2a/0x420 [ 581.804025][T21836] __x64_sys_sendmsg+0x1b1/0x290 [ 581.808963][T21836] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 581.814431][T21836] do_syscall_64+0x166/0x520 [ 581.819025][T21836] ? trace_irq_disable+0x3b/0x140 [ 581.824056][T21836] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 581.830121][T21836] ? clear_bhb_loop+0x70/0xc0 [ 581.834797][T21836] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 581.840700][T21836] RIP: 0033:0x7f787bba8f19 [ 581.845119][T21836] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 581.864727][T21836] RSP: 002b:00007f787caf1028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 581.873149][T21836] RAX: ffffffffffffffda RBX: 00007f787be25fa0 RCX: 00007f787bba8f19 [ 581.881124][T21836] RDX: 0000000000000000 RSI: 0000200000000200 RDI: 0000000000000009 [ 581.889097][T21836] RBP: 00007f787bc37f6d R08: 0000000000000000 R09: 0000000000000000 [ 581.897079][T21836] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 581.905051][T21836] R13: 00007f787be26038 R14: 00007f787be25fa0 R15: 00007ffd7e66f2b8 [ 581.913036][T21836] [ 581.924244][T20184] Bluetooth: hci4: command 0x041b tx timeout