last executing test programs: 3.669747251s ago: executing program 2 (id=1689): r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) close(0x3) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x275a, 0x0) bpf$ENABLE_STATS(0x20, 0x0, 0x0) pipe(0x0) r1 = bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0x10, 0x4, &(0x7f0000000040)=ANY=[@ANYBLOB="b4000000000000007910480000000000610400000000000095000080"], &(0x7f0000003ff6)='GPL\x00', 0x2, 0xfd90, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @sk_msg}, 0x48) close(r1) r2 = socket$inet6(0xa, 0x2, 0x0) bind$inet6(r2, &(0x7f0000f5dfe4)={0xa, 0x4e20}, 0x1c) r3 = bpf$MAP_CREATE(0x0, &(0x7f0000000540)=ANY=[@ANYBLOB="0f0000000400000004000000120000"], 0x50) r4 = bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000340)={0xe, 0x4, &(0x7f0000000400)=ANY=[@ANYBLOB="18020000801000000000000004000000850000002700000095"], &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x2000}, 0x94) r5 = socket$inet6_udp(0xa, 0x2, 0x0) sendmmsg$inet6(r5, &(0x7f0000000500)=[{{&(0x7f0000000040)={0xa, 0x4e20, 0x1, @mcast2}, 0x1c, 0x0}}], 0x1, 0x0) syz_emit_ethernet(0x4e, &(0x7f0000000340)={@local, @multicast, @void, {@ipv6={0x86dd, @udp={0xa, 0x6, "1b8100", 0x18, 0x11, 0x0, @empty, @mcast2, {[], {0x4e25, 0x4e20, 0x18, 0x0, @wg=@data={0x4, 0x5, 0x9}}}}}}}, 0x0) bpf$BPF_PROG_DETACH(0x8, &(0x7f0000000100)=ANY=[@ANYRES64=r1, @ANYRES32=r4, @ANYBLOB="05"], 0x10) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f00000001c0)={{r3}, &(0x7f0000000140), &(0x7f0000000180)=r1}, 0x20) syz_emit_ethernet(0xbe, &(0x7f0000000000)={@dev={'\xaa\xaa\xaa\xaa\xaa', 0x23}, @dev={'\xaa\xaa\xaa\xaa\xaa', 0xc}, @void, {@ipv4={0x800, @udp={{0x5, 0x4, 0x0, 0x0, 0xb0, 0x0, 0x0, 0x0, 0x11, 0x0, @empty, @empty}, {0x0, 0x4e20, 0x9c, 0x0, @wg=@initiation={0x1, 0x0, "7b4b142b7461fd777b1c012bd14efb9f49fcdb8f080c26a04883ad5c8c82b8af", "584cbf2649a50f2dbc43efa8698d0a881c51852e4451b57d037ad3c04594282423424d00", "bcfd56f1375461caaa2f19935e6996c7096ffeeb0300000000000064", {"9a3bfbc1f39cb307b3472eb9cdb042d2", "643fcbb2c5a57df67d544af6e8dafe09"}}}}}}}, 0x0) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000140)={0x6, 0x3, &(0x7f0000000680)=ANY=[@ANYBLOB="1800000002000000000000000000000095"], 0x0, 0x2003}, 0x94) syz_genetlink_get_family_id$batadv(&(0x7f0000000080), 0xffffffffffffffff) r6 = bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000480)={0x6, 0x3, &(0x7f0000000680)=ANY=[], &(0x7f0000000200)='syzkaller\x00', 0x9}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000600)={r6, 0x5, 0xb68, 0x0, &(0x7f0000000000)='%', 0x0, 0xd01, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x48) r7 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) r8 = bpf$MAP_CREATE(0x0, &(0x7f00000004c0)=@base={0x2, 0x4, 0x4, 0x6}, 0x50) bpf$MAP_CREATE(0x0, &(0x7f0000000040)=@base={0xc, 0x4, 0x4, 0x10000, 0x0, r8, 0x0, '\x00', 0x0, 0xffffffffffffffff, 0x3, 0x3}, 0x50) write$cgroup_int(r7, &(0x7f0000000200), 0x806000) ioctl$FS_IOC_RESVSP(r7, 0x40305829, &(0x7f0000000380)={0x0, 0x0, 0x4000, 0x9ffffc}) sendfile(r7, r0, 0x0, 0x7d1d7457) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x22052, r0, 0x0) 3.669350201s ago: executing program 1 (id=1690): sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000500)={&(0x7f0000000040)=ANY=[@ANYBLOB="2f349933d88f0eeeb920000000020039040000000002000000000003e4", @ANYRES32=0x0, @ANYBLOB="a162000000000000"], 0x20}, 0x1, 0x0, 0x0, 0x4014}, 0x0) r0 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f00000001c0)={0x2, 0x4, 0x8, 0x1, 0x80, 0xffffffffffffffff, 0x0, '\x00', 0x0, 0x0}, 0x50) r1 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r1, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000740)=ANY=[@ANYBLOB="b8000000190001000000000000000300e00000020000000000000000000000000000000000000000000000000000003bbcd68600000000000a00200000000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="0800000000000000100000000000000002000000010000000000000000000000ff0f00000000000073b4ffffffffffffffffffffffffffff0000000000000000000000001000000000000000000000200200000000000000fffffffffffffffffe"], 0xb8}}, 0x4004) r2 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r2, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f00000004c0)=ANY=[@ANYBLOB="b8000000190001000000000000000000e00000020000000000000000000000000000000000000000000000000000000000000000000000000a00000087"], 0xb8}}, 0x2c000010) r3 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$inet_MCAST_JOIN_GROUP(r3, 0x0, 0x2a, &(0x7f0000000600)={0xa, {{0x2, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}}}}, 0x88) setsockopt$inet_MCAST_MSFILTER(r3, 0x0, 0x30, &(0x7f00000007c0)=ANY=[@ANYBLOB="020000000000000002000000e0000002000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000200000002004e206b0c95997aa15ba5000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002004e21e0000002"], 0x190) r4 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$inet_MCAST_JOIN_GROUP(r4, 0x0, 0x2a, &(0x7f0000000180)={0x2, {{0x2, 0x0, @multicast2}}}, 0x88) setsockopt$inet_group_source_req(r3, 0x0, 0x2c, &(0x7f00000004c0)={0x2, {{0x2, 0x0, @multicast2}}, {{0x2, 0x0, @multicast2}}}, 0x108) r5 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r5, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f00000004c0)=@updpolicy={0xb8, 0x19, 0x1, 0x0, 0x0, {{@in=@multicast1=0xe0000002, @in, 0x0, 0x0, 0x0, 0x0, 0xa, 0x0, 0x0, 0x87}, {0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x5, 0xfffffffffffffffb}, {0x0, 0x40000000000000, 0x200000000000000}, 0x2}}, 0xb8}, 0x1, 0x0, 0x0, 0x4000015}, 0x2c000010) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000180)={{r0}, &(0x7f00000000c0), &(0x7f0000000100)}, 0x20) bpf$BPF_MAP_CONST_STR_FREEZE(0x16, &(0x7f0000000300)={r0, 0xffffffffffffffff}, 0x4) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000880)={0x11, 0x10, &(0x7f00000003c0)=@framed={{}, [@snprintf={{}, {}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0x2}, {}, {}, {}, {}, {}, {}, {0x18, 0x3, 0x2, 0x0, r6}}]}, &(0x7f0000000240)='GPL\x00', 0x4, 0x4, &(0x7f0000002500)=""/4105, 0x0, 0x68}, 0x94) 3.385898785s ago: executing program 1 (id=1693): r0 = socket$inet6_sctp(0xa, 0x5, 0x84) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r0, 0x84, 0x6f, &(0x7f0000000040)={0x0, 0x2c, &(0x7f00000002c0)=[@in6={0xa, 0x4e24, 0x78, @empty, 0x2}, @in={0x2, 0x4e24, @loopback}]}, &(0x7f0000000080)=0x10) (async, rerun: 64) getsockopt$inet_sctp6_SCTP_GET_ASSOC_ID_LIST(r0, 0x84, 0x1d, &(0x7f0000000140)={0x1, [0x0]}, &(0x7f0000000240)=0x8) (rerun: 64) setsockopt$inet_sctp6_SCTP_PEER_ADDR_THLDS(r0, 0x84, 0x1f, &(0x7f0000000680)={r1, @in={{0x2, 0x4e21, @empty}}, 0xfffe, 0xb92}, 0x90) (async) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000500)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f00000001c0)=ANY=[@ANYBLOB="14000d001000010000000000000000000700000a14000000060a030400000000000000000a0000011400d4b17c27dcc11c00001100010000007f18cab286c0e619a5000000"], 0x3c}, 0x1, 0x0, 0x0, 0x4000850}, 0x20040040) (async) sendmsg$IPSET_CMD_CREATE(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000044c0)={&(0x7f0000000100)=ANY=[@ANYBLOB="1800000002060c000000007f0396674d85220a0004000780"], 0x18}}, 0x0) (async) sendmsg$inet(r0, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB="1c000000000000000000000007000000890b040a01"], 0x40}, 0xffbe) (async) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000380), 0x7432c1, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x6bf1c2d5adba8c32}) (async) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000001140)={&(0x7f0000000100)=ANY=[@ANYRES8, @ANYRES32, @ANYBLOB="0000000000000000400012800c0001"], 0x68}}, 0x0) (async) r3 = socket$igmp6(0xa, 0x3, 0x2) socket$kcm(0x2, 0xa, 0x2) ioctl$sock_SIOCSIFVLAN_ADD_VLAN_CMD(r3, 0x8983, &(0x7f0000000300)={0x0, 'syzkaller1\x00', {0x2}}) (async) write$tun(r2, &(0x7f0000000100)=ANY=[@ANYBLOB="06000000bbbbbbbbbbbbaaaaaaaaaabb88f5"], 0x72) sendmsg$IPSET_CMD_CREATE(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, 0x0}, 0x0) (async) r4 = socket(0x2, 0x80805, 0x0) setsockopt$inet_sctp6_SCTP_PEER_ADDR_THLDS(r4, 0x84, 0x1f, &(0x7f0000000080)={0x0, @in6={{0xa, 0x4e20, 0x4, @private0, 0x6}}, 0x7, 0x5}, 0x90) (async, rerun: 64) r5 = socket$nl_netfilter(0x10, 0x3, 0xc) (rerun: 64) recvmsg(r5, &(0x7f0000001700)={0x0, 0x0, &(0x7f00000015c0)=[{&(0x7f0000000000)=""/27, 0x1b}, {&(0x7f0000000500)=""/4087, 0xff7}], 0x2}, 0x10000) (async) openat$tun(0xffffffffffffff9c, &(0x7f0000000180), 0x2800, 0x0) r6 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r6, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000001f40)={&(0x7f0000000040)=ANY=[@ANYBLOB="fc00000019000100000000000000000000000000000000000000000000000000ff02000000000000000000000000000100000008000000000a00000000000000", @ANYRES32=0x0, @ANYRES32, @ANYBLOB="0000000000000000a900000000000000000000000000000001000000000000000000000000000000ffffffffffffffff000000000000000000000000000000000300000000000000000a000000000000000000000080400002000000000000080000000000000000000000000000000044000500fc000000000000000000000000000001000000003c000000000000007f0000010000000000000000000000000200000004"], 0xfc}}, 0x0) (async, rerun: 32) socket$nl_xfrm(0x10, 0x3, 0x6) (async, rerun: 32) r7 = socket$netlink(0x10, 0x3, 0x6) setsockopt$inet_sctp6_SCTP_PR_SUPPORTED(0xffffffffffffffff, 0x84, 0x71, &(0x7f0000000340)={r1, 0x8}, 0x8) (async, rerun: 32) bind$netlink(r7, &(0x7f0000514ff4)={0x10, 0x0, 0x0, 0x2ffffffff}, 0xc) (rerun: 32) setsockopt$sock_int(r7, 0x1, 0x8, &(0x7f0000000000), 0x4) (async) setsockopt$netlink_NETLINK_BROADCAST_ERROR(r7, 0x10e, 0x4, &(0x7f0000000100)=0x1800, 0x4) (async) r8 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r8, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000001f80)=ANY=[@ANYBLOB="ac0100001700010000000000000000007f0000010000000000000000000000000000fefffffffffffd8000000000000000000000000000bbac1414bb000000000000000000000000ffffff2b6b57a470b83fce00000000004e210000000000000000006400000000", @ANYBLOB="a55dcbbb3ea43e1d146ad735d011e9b4352640a646f430c08c727883ce33f24a2911fd3ac45942912b14ef11ceaa6131bfecf496f847a4ee5a45a0f22e3984df4f7a6d835cbbe7ea43574fc6655c8e20c3e54ef930a27b91fdf317e419d8e133c8781bee307bef6710338150940290985af682737d7aed5e8467d1990a9e90257015655c318f49df016a88aa41fb6b584d1c0d082aeee252c154b71780af9a556755680e901e8764d06630df7934eb551f7f8e4c6b6115789f1bcd2d226ab31cc98e863af2066fc28b07a5e1863786f5cda8213e2c680b414592ba6aad0e1c616c198a869fc9af308656927c2d8e5b5ebdc1256b733445d0b168607ec2c1aec13a9b85b1326ae2062c02cc0b88a09ed4bcf48c58eea5d2c2e4802c05cca77dc74f9ffbf09ccea9b32af004232ac036ae373c5910e3e1026227744f4633ff9c07cf5840d465f19f61342521db964c4b684715fc676c6bf72df9c84f361dd325c8c3d08d3f3a14e622903cc4578a3cc453706fb379c8605150528a9097d0618c3a73124aae2c90e3427662e16fd05ef0be74b0843a8ce3e7f0ec82491b4f3414d62c4b599f24b2ace24d994fdf13547ef0ed1b03b3d63ffcd35adc76920ef67d3719a0346870111c925ae853d470511f4d7132278e1ac69c353e1019e714bcb922bca39ff3cd136d31bf93638d5272e1b860cd0703029da4301d3a1efc3444c2d0af086b0e7b22718608392156feda8b6048fa829f566b8c9a92d83921cc6ef7a3a86e70b435afc24844e9bbf0551054aa97c143001d05957c9fed93ceb8efb47bfa598dc98eb898c349542be19d0000613861532b68a812445ecb21c1e79665f1c613d13a0bab890b97d0fd1f4706885aef0376d3336ad5729409c0938b7d86ed646da977d30af17d64419c5e4131924c2668a842f5d07e3d8816550fa9553e3f38e133e0f673ce2b473c48ae77dd55d7bc7b448941a044aad6647e68b8f48746680909332ec5a70d07dc2c0b949f8fd72e9b13b1e25e70a1f92c825e7300769062d68f591e64a69e9fc6ba5be27f14063ec9abcae2b0662e8577abe33dedc7480dc9db9821890275974e1a97312099e2503d55d770919b10a2d56643c0b1f655eece3474a5c52e18a138b9bf595364c44cc9ac9c1c41f007dbff5468ff7272c0c42147e2cacc351bd2316ac15c134d713d20c501fdd488492ca9d3eda34bc13bfdbd1286964bae3f472ad6aa62856a22e6536bc0dfde6d6d8cc4d5cac7c4ced7faebf413a1dd1eff63982dea53c22bbe29be7e8d59d66d19f1b487cf5ede3962a5663c0e349432b363a9f2eb5cf5be855535499f4ceda1c7f3977266829da618a749ba7f9d28c2d4e79bbc08a57d47f7b61b83d2937f15f9989773fc6c21d903e978494041c6a1e604da9c53bd63bfeb40e6111b3d06549320e8e10a8ff65640529768d07d8f93b3c7d557be38bbddb563117cb1d71d5d5d510ee0298eae57b28284a6c6e98c23f5f8f5aad794e0fe6888165d4f3b41fb6c28bb1fce7b12752068ebbd79b08972b09b3e8da7dae02ad28dcc244a806ffc5256f02e9e051fe4fd7aa82e40236f5b90834d00d1c72fac0a367f5d69f223e54117814ca319592913905607a16fa127b25747b42bdb1b6f65983deb11183759beecf767e5da073e2517b7880c45f199b66d1d9625cf5f4071c4f992a5b647d9907f846bd981c1e684982770544ad5f93998f0b7b96d0af8961c1e1ceee9729b56dea72e47852b6aac655f9256dc85fc7a3a34f5b52efe6dff6b92ba3f10c00329fd59ea45a8fba3f8cd74c7078f0b319ccf689759e7e4ce12bb9721aa70c1396918453e0fb2c00245be6d45aa767e2b64397e1974c81d85854e96368925592e1c227a541ed80b71613e176f7cb3e1df9b32e316024e8f18b4ea14b6a02a16b7f8274722ca94a229389c686445d483e594a1708860be9f01353ad0809ed1be7ffd66ea90c182be849bd96af4032f203b877ad141a5f67d1e75dd3cf324e260a902b2abafb49d4ddb3386e01fb6dd4e532cef56b9c3f827797b45dcb986e1ce3bc560400a3971919a3e2fd67f28f1658621bb562fcd5fece3ccd804e74f33b84385fd6dbb7e7e3be1f2811031becb0872feef0b91820ab1ea946be3edec2d4a9eee2ec203549467601365a8a0efd4437467d3f045463a6780f82d161313f531d3243341cf19f78dfd755b7616bfd233962004d44ee38dfab8b861423fd82a8b77c3fbad7b8595a1216ffd98d6784fc64033f7becd118197f6b2474f33ad820774008414eda5f8a5d06b4c52e4332fbdca7fcd7e055b8672588d49181a3b6331e037a28199160f165284bae196692bf5b477f310c124a181260db136ba2f452a8c64429aa0bdb76c9d86619bb6a4ad5410454140528a95c72069ffab2aa026daa1a91d1ef5bfe3dd25f324741dddf53d5fbe136011d2681d9bd0be8c40714cd7a79ea207f9482789ff7423dfa556f15a6b9acdb2989699eda07a2f6d214af625c75ef656f06c8a48d6014bf3f032ddc6010c0bc5e7d3b3d4d9240cf74e5736aed3f4ec3fc9c60821ec191f9d6b5ee9ee6b6b15ebfb3c23ef241994786500326e8a74c7331cd40ff7a71d18f4981c5e2705b2f7f162a98403a08c01b8d7e73953f03e8ce103760c258fc3260e57c3b8b4a444681b6dd58ac6b78c026dfd55f56926e2c40c8eb81b88b816fa8ec390b98e951ab5bbf66134959ca01bf06abbc25a12d6f2482e9a2f13e2652421b36d1124c6bf48589cee4cd020879a183be0bb654d378d630ae62dbeffbcd263f0ff240b6e4219a57eb45ee5125fc3a413ef9c743bc5a8a3219490edb9743bb2906f92885e2170e4adf0c545ffddb1170388b79b5d1e457c6636e37520275b4f23fe984952b6b5af1ae99303c31cde0579d201188c614c16fe58644d1308fb8c203fbdbdcf8e4a1b0c29b2eceec41d06ed9e162c7468d9d1697a7805e2a52ac5373009a46c797f59b52685f98c120105e0c666fd163474fb45f711e5170634a2a8ac2aadbac32ed2283edd8d1dbdd93a224cf48bd8d78638346563883c1303182dd0888c8a2bb612f01bb3d34119583a67ee1c315190c730418c0255049a38f268b982038d0a95c059b03226c62ab558ce357586254ad336fe95931d3c6cda7f4b6b9e85e41bb692be9058854b49d5ec9e5430044210c4b3bb8dcab169cd415a0e3fe450eb2ed66ac8c316b7fa6babf5e1d59a1eeca0bb10a1655c63cc607967bbb1dcc7e19e5e9707fbfd03df1fd286f04ad83af36fd4ab6efdc6b9f6e891fbe26e0f60d6a0c15ee86776001ed1953cfd6c16645b7296446434b3b26011a4c35ddff982c6411b72670367198012134b102d56d00363d070c63f6e5bfbd706f238bd8d670921f95bcef8ccea0a23fd82fade5afea1a602f898305fcaa63d5b45980b3b5ff7eec28174585487a2d08c68195f3e1200525ed2e6ff135bf1590df156c61622e348812ad9c590a2e1055210daa20c72411aeb993666d5c2e9ed390c1b87ea19ca8d66410b895b4baa3edad8d441d5c467a927444bda19109b46d7997d58e3c51ef7ccba14f022665185bdab16d099f627de760505f8d7f91c1f8d5e63f2fa60dd35f958ffee367ceb6678b54876172aff6e01687d34bafdc0b183c3851455467c0d14525fcde3d918ba8da4ea7ee34a257f44e3f278542f74598325ab90f47485cb5643342979b2901128a74b147a56a00bbe82a84b798840db62374aa877a886b912eb595a423278d9dd7fc439d619c95537f8b43346dff305af1ec2b79c2a8cecc20f224b1d4d8ec44348e3af37b0c8d0bf2cfced5d372dcc96c3992204ab8c80ac13f96cf99f6df35eedb7bdc32c575744c621ebaaa7a816a8fabc054fc73670ec14d714f3f37fc3275b591013c2f150c69ba66f11985fad5707a85dcd5ff01ebc1760ffad5a2af4803f879a893455e6280d46164526008a77266598d42700bd9ed0b6371e9d24d1775b94d8781fabb16bf8ed930b72e9c6e6c420e6fbfc45b501c0f9d6b90546959e2118b519985741c0d0e02a7e4da65a149be4cecfcf79fce90ca6092f4e9a204f64fa45afe11541dcf8a9918d45120979e35928dc5bf4fea3c67ea64f58a81362538123e36a185b6481e92013391a09d4bfeed499acba8bb4205f2a3364b08841ad8ad81bf79d23302643d5fd7d5f3287a127dd31fef1e442272f6306dd494018a6f1f0f2070e5df0725367c7f57773e597ab4525cc4d51b312bfedd5b4caa698a2d91703f16e3968854536de9a30db08c06795700ab1b3d23bf3fbf6b468eb157066e76fceb14ef1a317735a9fb337e6d7059dbd6d7dd71002d2d6b9262c539b52c8710a1642ec56d5368cfa088a5dde92e37ef143ad11f2778149deb5b1c39ebb06f6ab63a56cfa4c9a13e7554c1e2f1b79fb7a388f23fbd4c00290d0d264052a6c7ec5f7adf001ee057d024c6d277fb257f4a68d160f99dbe6df0e78ac8bbec15a7152dbcaf66620fa38a30f0a2bd6e767d66960772daec34eccfa2cf3a7aebf3ed11fbf2bfe6ea798b35aa8be34aeed3d7f4da1c3f3676550bd878d8e88dad3b5a233d10ab066ea72a9ec47b9ac77624f699879c021484acc969940ce54f3aad0815eef228549674505cdc9ba7ac55b59754290de30498ad062846d5f7423ec709f4539da70e0ce2851322480ffafaf936b93fb4e5e62ea0f1112c89212259e95c8ca14c4c29e32ed7d7d623cd44e5757183940862f012de92a7f7acbb2b937a3f641e29373ac99e793e13e6308ca4718d3559b8262845a4c486d114acd5db6b60330d01eb83042eb0628915b4a8a6ac240a5c6b44bc0b726241b271de583148bd014513e8208866ff251f73e9350dfa8556d9891cbb760f7b43ee9a5a84cee9d816ec1a138fe8eedcc19a1860743928d0da098bb150b15b0c802f4c90e99a933ec6063e29fec10f6dd029a97076c34fc91fe27cfad76e490c101945a1cfff98532d3b1d424a2326bdfcfb44aa314e17e6a2e197ad6a6a892796a7e51fc274f33746ddfb30e578d60cee0e3a0e7154bc9a29d361d1c9710322f2f7c6598a5a19f8572a2583fd0b552d706893c78aad0e3bb95186578d45d20c3324809d576286f5b0aa77aefb44764c8c5b055d47320cc1300f29666ae9f94dd484a297979312f88a207e973059ccda6e8214931a563547370aea82fba0318a52c55e5f69d53dccd56e7b30a20f744202ca584fb7766937c13c16231fa8ad04ea702badd4e56d553b913058b185273df098a08d4c4c6e918b9fee49c0cbe907e9dec058b31af1053044d89bd031093b314701c48c0f09dd97977737c7bd2ef0556af2555c9c6a54e6dc81e36ce701c34d10cc0310467cfef924bde83e8f0fe650bc35cf86252b39d2a5a17e87d3e5cec2228b200ea65cf811531d21a74a74ae75c6e6b7abacbeefc73a7e683070ab91f76e829dcfaf40a38fe33c3a18a9c4beb17d4de2f227b5242aab89eafe01a62ee8cedc2ce30d09eb1ebe8d8c37985a9e936242478c0e4bf114cda637734d7f1c702c849d9280c9cc284f0654c5e14ade06f7b346fcf3a2c1f8835704662a88196086929334df46b150edd16b5380a22c39af8583e331a5dd45fa7340fcae11db18c0b0b8525672a2bef3b7589e6649be1f15457658b7bca1ae9d8b615def8c5b90ff83790f6f4efb61ab8994a752934aeda3255a05c4cc0b22ab8fa7b02eac441fc95427634711c12e6fe93d597c5245a1d76b40d1fa1e83eb03383dc11d5bd180791ca9f", @ANYRES32=0x0, @ANYBLOB="fc0200000000000000000000000000000000000000000000000000000000000100000000000000000a00802000000000", @ANYRES32=0x0, @ANYRES32=0xee00, @ANYBLOB="00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000200000200000000f9ffffff00000000000000000000000084000500ffffffff000000000000000000000000000004d33c0000000a00000000000000000000000000000000000001053500000200ac0003000000010000000900000000000000000000000000000000000001000004d56c"], 0x1ac}}, 0x20048881) 3.252000692s ago: executing program 0 (id=1694): bind$bt_l2cap(0xffffffffffffffff, 0x0, 0x0) bind$bt_l2cap(0xffffffffffffffff, 0x0, 0x0) r0 = socket$packet(0x11, 0x2, 0x300) bpf$MAP_CREATE(0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="0a0000000200000006500000ff00000042000000", @ANYRES32=0xffffffffffffffff, @ANYRES8=r0, @ANYRES32=0x0, @ANYRES32=0xffffffffffffffff, @ANYBLOB="0000000004"], 0x50) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000001c0)=ANY=[@ANYRESOCT=r1], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x40) r3 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r3, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000280)=ANY=[@ANYBLOB="600000001800010400000000000000000a400000fe0200010000000014000500fe80000000000000000000000000000208000400", @ANYRESDEC=r2, @ANYBLOB="0600150008000000200016801c00010000020101"], 0x60}, 0x1, 0x0, 0x0, 0x10000001}, 0x0) setsockopt$inet_mreqn(0xffffffffffffffff, 0x0, 0x27, 0x0, 0x0) bind$inet6(0xffffffffffffffff, &(0x7f0000000000)={0xa, 0x4e20, 0xfbfffffd, @mcast2={0xff, 0x5}, 0x1ff}, 0x1c) setsockopt$inet_mreqn(0xffffffffffffffff, 0x0, 0x24, &(0x7f00000000c0)={@local, @broadcast}, 0xc) r4 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000100)={'virt_wifi0\x00', 0x0}) r6 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r6, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000080)={0x24, 0x2f, 0x9, 0x70bd2c, 0x25dfdbfb, {0x4}, [@typed={0xc, 0x17, 0x0, 0x0, @u64=0x2}, @typed={0x4, 0x1d}]}, 0x24}, 0x1, 0x0, 0x0, 0x42914}, 0x20044014) sendmsg$nl_route(r4, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000300)=ANY=[@ANYBLOB="5000000010000304000000000000000000000400", @ANYRES32=0x0, @ANYBLOB="00a3000000000000280012800b0001006d616373656300001800028005000900000000000c000100000100000000000008000500", @ANYRES32=r5, @ANYBLOB="1d85681b11c331bd81a116e1b433fe4f0ad479acd0b1329a2c6f578a382927843c1d6260d4f12b11d04625b8094f6cad26e3fb972edb7307370db2cd21d640b9f965ea78f6d322fe9840f67481506f4a68df3d"], 0x50}, 0x1, 0x0, 0x0, 0x24008000}, 0x800) r7 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='cgroup.kill\x00', 0x275a, 0x0) write$cgroup_subtree(r7, &(0x7f0000000000)=ANY=[], 0x32600) getsockopt$inet_buf(0xffffffffffffffff, 0x0, 0x29, &(0x7f0000000000)=""/129, &(0x7f0000695ffc)=0x81) r8 = socket$unix(0x1, 0x1, 0x0) getsockopt$sock_int(r8, 0x1, 0x10, 0x0, &(0x7f0000000040)) ioctl$sock_SIOCGIFINDEX(r7, 0x8933, &(0x7f0000000100)={'batadv0\x00'}) bpf$MAP_CREATE(0x0, &(0x7f0000000180)=ANY=[], 0x50) 2.900859614s ago: executing program 4 (id=1696): r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000800)={0x11, 0x13, &(0x7f00000006c0)=ANY=[@ANYBLOB="180000000000000000000000000000001801000020756c2500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b7030000eb000000850000002d000000180100002020642500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b70300000000000085000000b000000095"], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x11}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000500)={r0, 0x0, 0x0, 0xfffffffffffffe58, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x5}, 0x5) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x48241, 0x0) r2 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) getsockname(r2, 0x0, &(0x7f0000001440)) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x6bf1c2d5adba8c32}) r3 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$inet_udp_int(r3, 0x11, 0x1, &(0x7f00000006c0), 0x4) r4 = socket$kcm(0x2, 0xa, 0x2) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(0xffffffffffffffff, 0x89f2, &(0x7f0000000b00)={'ip6tnl0\x00', &(0x7f0000000a80)={'ip6tnl0\x00', 0x0, 0x0, 0x52, 0x8, 0x0, 0x7d, @empty, @rand_addr=' \x01\x00', 0x7800, 0x8000, 0x9a, 0x8}}) r6 = bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000c40)={&(0x7f0000000f80)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0x54, 0x54, 0x9, [@type_tag={0x1, 0x0, 0x0, 0x12, 0x1}, @int={0xf, 0x0, 0x0, 0x1, 0x0, 0x3, 0x0, 0x10, 0x3}, @func_proto={0x0, 0x2, 0x0, 0xd, 0x0, [{0xa, 0x5}, {0x0, 0x5}]}, @decl_tag={0x1, 0x0, 0x0, 0x11, 0x3, 0x3}, @typedef={0x0, 0x0, 0x0, 0x8, 0x2}]}, {0x0, [0x30, 0x4f, 0x2e, 0x61, 0x0, 0x61, 0x2e]}}, &(0x7f0000000bc0)=""/99, 0x75, 0x63, 0x0, 0x6, 0x10000}, 0x28) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000e00)={0x6, 0x1c, &(0x7f00000008c0)=@ringbuf={{0x18, 0x0, 0x0, 0x0, 0x80, 0x0, 0x0, 0x0, 0x2}, {}, {}, [@exit, @printk={@llx, {}, {}, {}, {}, {0x7, 0x0, 0xb, 0x3, 0x0, 0x0, 0x4b}}, @map_idx={0x18, 0x2, 0x5, 0x0, 0x10}, @map_idx={0x18, 0x4, 0x5, 0x0, 0x10}], {{}, {0x7, 0x0, 0xb, 0x2, 0x0, 0x0, 0x2}, {0x85, 0x0, 0x0, 0x1}}}, &(0x7f00000009c0)='GPL\x00', 0x8, 0x7d, &(0x7f0000000a00)=""/125, 0x40f00, 0xc8, '\x00', r5, 0x25, r6, 0x8, &(0x7f0000000c80)={0x2, 0x3}, 0x8, 0x10, &(0x7f0000000cc0)={0x2, 0xa, 0x3, 0x4}, 0x10, 0x0, 0x0, 0x9, &(0x7f0000000d00), &(0x7f0000000d40)=[{0x2, 0x5, 0x2, 0x6}, {0x4, 0x4, 0x9}, {0x4, 0x1, 0x1}, {0x4, 0x2, 0xe, 0x3}, {0x4, 0x1, 0x0, 0x8}, {0x0, 0x2, 0xd, 0xe}, {0x4, 0x5, 0xe, 0x1}, {0x3, 0x4, 0x3, 0xb}, {0x3, 0x1, 0xa, 0xa}], 0x10, 0x7}, 0x94) r7 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r7, &(0x7f0000000780)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000000000)=ANY=[@ANYBLOB="2000000036005d082bfd700403dcdf25040000000800040002000000040005"], 0x20}, 0x1, 0x0, 0x0, 0x20000000}, 0x24000080) pipe(&(0x7f00000001c0)={0xffffffffffffffff}) ioctl$SIOCSIFHWADDR(r8, 0x8914, &(0x7f0000000040)={'syzkaller1\x00', @dev={'\xaa\xaa\xaa\xaa\xaa', 0x2d}}) writev(r4, &(0x7f0000000640)=[{&(0x7f0000000200)="25e98beb9ac9610dfdbd821af188b066a839483d40e2cce66ebad6b3eaaebba42a97b78b8767", 0x26}, {&(0x7f0000000240)="da04cf66e3181153cf474123a65d69df1b4cdfa2fd009c7f459e8aae93fa899baa8975275f539d696067b6f2ccb2fa74845708a4557d27df75aa36c59b06aaf4dfa0dae39454289aed21f77178e418881a7012f6aedd57b4aeb0005f7df778c77eb56d2e06903cb6ea051a749f45b6d403da731ff33fbeb166021b2ef08f267191c4382b822b4e81ba2ee0cc25bc4f2f6ae6534d6047457187209f874623c506d4f2ce379b1c758b9834b6050ffac04756baec179301db295ed125580bb11abb84ce31791a1a6fa63bce75ed0c9d23ea3c15210ebf1ee4b034cecbef928ca526b90c2260443073399cf371e0c1d8c4d2dfd691b3ee5db997a5", 0xf9}, {&(0x7f0000000340)="3e54ff200b5e887a372f76077c8ec1867df564e7627c1c9740f00e0e82b3a2c5d96eb73fd3fb0756a15f0f542d45fa8e5b68db8c553ebf1570fc9475939b5458c40f35988384e26049697eb3b854abebf7f679874f7fcfb3c9f392c162b30308b6ca588b662b4df3ed91c269b8efd14f79f6e3ff279abd2fb402a2da6ae8bdd896b5808d3c80ab2a0005e39b7c6bce41b35414e0da4ced412643b18cf96ac8853fa8f877adbd6671a307f37ed649416b5e09193a14ce0a49474f4583171411f4aa2e1cfd1bde558321465583182f96d646161e3b7ed015d41872aa0383a6", 0xde}, {&(0x7f0000000440)="91f8df491162c20e51f6b88313e1f71e567e51cd10df36ebb4121dc7915db9345cccf6e25981a5bd8c77950dcfa155d90007d0e958e88817cba15d2560fc616a2871b6965fcc69aad953e085757758249e1e6174f5d61039c884f9e019dfc3ef6965980e702f47c6d7a4cdbed1db3725ab7def6e4c6e911cee94156b44db13baa4ef548c1fe5b3ccda476109a4d7a9651faa73d8", 0x94}], 0x4) bind$rds(0xffffffffffffffff, &(0x7f0000000040)={0x2, 0x4e21, @local}, 0x10) r9 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='memory.events\x00', 0x275a, 0x0) write$cgroup_subtree(r9, &(0x7f0000000000)=ANY=[], 0x32600) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x2000001, 0x12, r9, 0x0) r10 = socket$inet_sctp(0x2, 0x5, 0x84) getsockopt$inet_sctp_SCTP_DELAYED_SACK(r10, 0x84, 0x10, &(0x7f0000000100)=@assoc_value={0x0, 0xfa8d}, &(0x7f0000000040)=0x8) r11 = socket$nl_generic(0x10, 0x3, 0x10) r12 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000d00), r7) sendmsg$NL80211_CMD_REQ_SET_REG(r11, &(0x7f0000000f40)={&(0x7f00000007c0)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000000f00)={&(0x7f0000000ec0)={0x1c, r12, 0x4, 0x70bd29, 0x25dfdbfb, {}, [@NL80211_ATTR_REG_ALPHA2={0x6, 0x21, 'a\x00'}]}, 0x1c}, 0x1, 0x0, 0x0, 0x40080}, 0x44040) r13 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f0000000680)=ANY=[@ANYBLOB="1b00000000000000000000000000040000000000", @ANYRES32=0x0, @ANYBLOB="0000000000000000000000000300000000000000", @ANYRES32=0x0, @ANYRES32, @ANYBLOB='\x00'/28], 0x50) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000100)={0x11, 0x11, &(0x7f0000000580)=ANY=[@ANYBLOB="18000000cf1b0000ddff00000500000018110000", @ANYRES32=r13, @ANYBLOB="0000000000000000b702000014000000b7030000000700008500000086000000bf0900000000000055090100000000009500000000000000c500fefffcffffff6d90f8ff00000000bf91000000000000b702000003000000850000002a000000b7000000000000009500000000000000"], &(0x7f0000000080)='GPL\x00', 0x1, 0x0, 0x0, 0x41100, 0x2c}, 0x94) 2.725747402s ago: executing program 3 (id=1697): r0 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000240)={0x2, 0x4, 0x8, 0x1, 0x80, 0xffffffffffffffff, 0x0, '\x00', 0x0, 0x0}, 0x48) r1 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f00000007c0)=ANY=[@ANYBLOB="1b0000000000000000000000000004"], 0x48) bpf$PROG_LOAD(0x5, &(0x7f0000000840)={0x7, 0x1c, &(0x7f0000000d80)=ANY=[@ANYBLOB="1808000040000000000000000000000018110000", @ANYRES32=r1, @ANYBLOB="0000000000000000b702000014000000b7030000530000008500000005000000bca90000000000033509000000d44a6be5000d0000000000b702000000000000739af0ff00000000c50904000410ffd8c3aaf0fff1000000bf8600000000000007080000f8ffffffbfa400000000000007060000f0ffffffb70200000800000018220000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7050000080000004608f0ff76000000bf9800000000000056080000000000008500000007000000b70000000000000095"], &(0x7f0000000440)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0xb, '\x00', 0x0, @fallback=0x22, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) 2.528280602s ago: executing program 2 (id=1698): socket$igmp(0x2, 0x3, 0x2) (async) socket$igmp(0x2, 0x3, 0x2) r0 = socket$igmp(0x2, 0x3, 0x2) r1 = accept4$inet6(0xffffffffffffffff, &(0x7f0000000040)={0xa, 0x0, 0x0, @initdev}, &(0x7f00000002c0)=0x1c, 0x0) getsockopt$IP6T_SO_GET_INFO(r1, 0x29, 0x40, &(0x7f0000000300)={'mangle\x00', 0x0, [0x40, 0x3, 0x8001, 0x100, 0x8]}, &(0x7f0000000380)=0x54) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f00000000c0)='veth1_to_team\x00', 0x10) (async) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f00000000c0)='veth1_to_team\x00', 0x10) r2 = socket$inet_icmp_raw(0x2, 0x3, 0x1) setsockopt$inet_mreq(r2, 0x0, 0x23, &(0x7f0000000000)={@multicast1=0xe0000300, @local}, 0x8) syz_emit_ethernet(0x3e, &(0x7f0000000240)={@local, @broadcast, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x30, 0x0, 0x0, 0x80, 0x2, 0x0, @empty, @multicast1=0xe0000300}, @dest_unreach={0x3, 0x7, 0x0, 0x0, 0x3, 0xc58, {0x5, 0x4, 0x0, 0x7, 0x0, 0x65, 0xe, 0x4e, 0x24, 0xc, @empty, @dev={0xac, 0x14, 0x14, 0x44}}}}}}}, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000440)={0x3, 0x6, &(0x7f00000000c0)=ANY=[@ANYBLOB="050000000000000073113d00000000008510000002000000850000000700000095000000000000009500a5050000000081f005a7882872458d411581baa7d0d402a88c77270acb09300888fcee9a2b0ec3737390fb12edd26bb7dbff1ad86c44597cdd036ac2b0e47022b39854215b876ebe5569d12e4de38972f9a6b144b0ee679d93beae72274e2570b75fa0c16c0a041537216e11fc511bd2b1ea614c55fcd1ac17ec71d3751de380b76a1f30a47e31a68e23f6681cd944228899dcdfc322d928707b600fcf8e10ab435297d736da45454296e797d5caa3f979381127aeb6c77376d94f2afd33ed5ef6b2f78a95be49adf076f20372f1ce43d82aea5ac3db5e9363ffcab66f716cf35e05e6673b0f180c3dd377b894f59784e3c5f19da9abe13eac243ccd2de2a4a4060bf8c6385f5543e8114238707cce031d28b7a2e558ef6131ad2e9ef72abd83fd213bf51b4cbf36bdf4a5105588ddc750a8dc0828aee77d50d5163eebe3f4b0bf43ea23046744786746a20d6b86a99198462a81a7e0b393831dca2a90f5ce37be18009f34f99b66c82598cbedcca69b639fb7bc9ace6bfd58667e737f7b42fe8a03b58c653dd463fc7cfb50fd6c14b34696452d88fe4d1c0c81ff0f909c2ad5d9acee9874eccfc8c4d10b74"], &(0x7f0000000080)='GPL\x00', 0x5, 0x29e, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @sched_cls, 0xffffffffffffffff, 0x6}, 0x70) socket$igmp(0x2, 0x3, 0x2) (async) socket$igmp(0x2, 0x3, 0x2) 2.47019481s ago: executing program 0 (id=1699): bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f0000000340)=ANY=[@ANYBLOB="1b0000000000000000000000000004"], 0x50) bpf$MAP_CREATE(0x0, &(0x7f0000000340)=ANY=[@ANYBLOB="0e0000000400000004"], 0x48) r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000100)=ANY=[@ANYBLOB="3800000041000701fefffffffeffffff017c0000040042800c00018006000600800a00001400028006000a"], 0x38}, 0x1, 0x0, 0x0, 0x4048011}, 0xc000) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_TYPE(r1, &(0x7f0000000180)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x800}, 0xc, &(0x7f0000000140)={&(0x7f00000000c0)={0x64, 0xd, 0x6, 0x101, 0x0, 0x0, {0x3, 0x0, 0x1}, [@IPSET_ATTR_FAMILY={0x5, 0x5, 0x7}, @IPSET_ATTR_FAMILY={0x5, 0x5, 0x2}, @IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_TYPENAME={0x10, 0x3, 'bitmap:port\x00'}, @IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_TYPENAME={0xe, 0x3, 'bitmap:ip\x00'}, @IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_PROTOCOL={0x5}]}, 0x64}, 0x1, 0x0, 0x0, 0x80}, 0x44000) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000001c0)=@newlink={0x3c, 0x10, 0xffffffffffffffff, 0x70bd23, 0x25dfdbf8, {0x0, 0x0, 0x0, 0x0, 0x35a38, 0x4522f}, [@IFLA_LINKINFO={0x1c, 0x12, 0x0, 0x1, @bond={{0x9}, {0xc, 0x2, 0x0, 0x1, [@IFLA_BOND_PRIMARY={0x8}]}}}]}, 0x3c}, 0x1, 0x0, 0x0, 0x1}, 0x20040044) 2.467170013s ago: executing program 1 (id=1700): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x48241, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x6bf1c2d5adba8c32}) socket$kcm(0x2, 0xa, 0x2) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket$netlink(0x10, 0x3, 0x0) socket$nl_route(0x10, 0x3, 0x0) r3 = socket(0x27, 0x3, 0x0) r4 = socket$kcm(0xa, 0x2, 0x73) sendmsg$inet(r4, &(0x7f0000001180)={&(0x7f0000000000)={0xa, 0x4e21, @empty}, 0x10, &(0x7f0000001080)=[{&(0x7f0000000040)="a72d11a15c048c0a7d63aebc5cea1f81510ff6091475aeec600831aa9d3944e60bc2ad06a619c560aa0118b28f68f1eb14549d633b4b23f179fb680716faa43414787559be90843c35ab30acad8a6740140e00721abc2eb362f7bde53b3c992d3e28ccc20ec84fdc569947047f6c09a647ee8c0a747b951e66c068ccf1af93ee9e6f9528ff79e2f989383b05a690a6bec4634b867c9446c1c644b3010e8a3514c6328323b4bbdd602b8f0dace6aea70902c4ddd2a2f2810f1348b0d0df3c1e6a5938fcfdc87e7580c6be0c6a06eca62d6f787dd16add086a21391c4c707d8b61929d1252681b84c245e0efafe2e6e73ad86a3cf59235ab0eacbb414af92ec3cdac420a064a98e8cc18bdf63f8997f96436e0fe6f06fdbf47fff353b01a861babd4a38d126bfe3e29049e6cc883e6efae6e70ef9ed124b1b09887a58c991e223b6420dca5ae238027e91b17b1707dc5c0d5f59f0ca95614f1ea1d263c1ee54dfe31ae35eb3c8e3b931dff7920c57fbba89adf2e392c1ad719b90c7ade0d38ff9792934ef1fb12f51d8e2fad12486d5883d5b1a46696fad128c6805cfb25bc6487e1e407d6b266971b09d0d864a7a550284e24b6cdc9f4ae1081a638175dffef002c76ac5558d23e41edbe68f4b4950a13aa000326dae5a857603dc5a40d6c6618a98c7b6e1eebd325ea2c14601a25658965f40864fd015d9b2fff83ee5ed3212ebd9fa429f0140f633556ac07c0c08e67a1848c9942ecc47dd4ffede9a429e9e0472be7cdbcd117e621ddf745c00a814ffff0224634472577dc0b35a9c153409f1a2bddc193b20b4d244d9cbbd59816c46000c596865f58b4e640ed4a9ab6086cede697fb113560925498da83273e679e0e28b84961eb7b9c9b4fa916590965c76b48e5d453f27a821bd2bf0946ff2413ec30f7893d1f046e18f736c40ceda26dfc4a0a62f71a3606d3f72c0a858dfd7895e2572292e11af913c6b513a141d28e501ae7c49618d104aac9abb78466a636efb88120d0eef0a501558a5aa34784a9823f2802a0bcdf318f9b436b34b42a2a7cf513f80364ad9a699d2e23eb4f3a2bbce818bd20da61882b3dac699d05dc24f29b72471b712423ace6278c43df2be7a09e815517b86d8b3ce16af3d64a575958c5fd52aac53b391f3d2a67c24c6c13ec11428b61b80a6a58cbba1790a98d190a572070f63fc0b809669895ea9865c3066b06102f6f2c7171dc7f76e1931b3e4deb569ef9d07d5f86a848f50942e93c419c3a23489f14803b08182dfd48b8d4375be6b7f805a21209c05e5927693a8834c8d5a5acbd47ed8a30a8a741d1ad77639b56b3b90c0b2023fa334befd28b2e27cbcd94b0ce7437f88ce67a925cea6d6d7e5313de6d328b1124a8b9ef83fe39ca3da97d33c60b7fd4af67d3c8fccb595a27a5bffc71e5a5b2ec966828993b0c0f83cbc55f9a7fb66a4101d5c83b77885072b6e2b2ceebe32f635509698c05089b9ff1cb1959b211e114dadb224ef2d5e7a3c55b3ac00fcdc9018577603c6301e5d4341b3d7eeb2665349d448d28d5d108f576408cbe533a6adbba18ebb2d84bb9af81108506a2f50fb56d595579000747930449fdf4ed01715ec624a0cb73636a35b9136f10b79e3d7ded09008b92e92c64e26e6b6d17f18b70b1d9813de8d2ff151c7a6a0452c660a57c33f13e2d9b88fa5f5c0505722d2e787a425e4a3e9b5efa9668e9199f5fb9fe7d5b8a57719a57df152e7f2c6a1087a2a24084f82455b65353a70559f04d5ed12defb81497ea69c1c7e69c373524770b7473c16a69c7a3648a9dd93377b89cdff61cf62512d1ee67a55ea67993937c1f55a2179bc9c8a337364cfb84d295adda1ad9700fc2f5c11cbfc1b90affb4666c6e7e23a6f7751410a5651819f29f690c6dba2b8a67e0f7f8cc377feb1854c393578994c85391ba21b3961aed477f771645571dc7d6cae72bf79c82a92a4edc3742b1398060a0a5c9e81c016b7f2ae3db529c6ff824cc28678764d8ab49d7dc68e5b0556c9e7ffb6fef442776d86fbd458741830e57f22a1f8513b92abd5b2df93a67cc560134078f0b8ecc3276e40aadef5cd579888b86b4988f396679250701f3869e7493b33692035ecd94aca5189fd0a0893ccc5bb19c0b4caca86cf90ebc2a5558f39cccb33f6773a4e425bf551fb3b6456ee1cc62fa1843a9e5539bb2d02ae6ef82533a9dbcfb562c1ab18c1f639ae7ff02083746f74a15ba2d10e4b955940a5d6f488d326a99f287c48ad463ce40367aeeff519cbad0a2d7fdbfa48bff75955467977764c2be2bd2ffa18396c46920c40c50a4037003666406d177e2cd20aee423d07169d8f611f635ba0b62b61265ff2c5548446a2423dd1038482b6852b2d9d2f90aa05d82c5e2c3d1af0c7aad72d82b3da67471af7b037bb0424a785e73f35b5a10a2ab300a195c20cd119a5390e0cd5d49c70bd80883b933e843d0d2902749dcf3c140c708a0f004b7a2f50bf311305dc01719016fcce5863815ca7951de710fcb71cd177551ff6fcd9f8bf01b93868f24c6129b6d7917125338cf62110083093fc7f862015d48450d992f2bb43e601cab19b2ea7b83962a382fc2a31fdf2358bf8a9a9e506eaa7b6eb5e7444d1ef459b24ffa51362abce902dfd84201a0e4b5a3b62757aad54fb65b83821c6bba663886de092065a565921ea3eb6781bb8ed4f4db3abcfeeb379b7e52fca790bea719918e299ab01bf5e92177d134360bf7a16a59e9d03d3dcfb0a25599237e3d41b3f0026c9402b1fb1894426303413a2cbcf7c72807ca694afa285990d07c3bca26413c9947b3b344aafc04544b8c11416e0312b028da7302e316c3966d41884b15055a49a4a0b3eac8e11f88a5615fb0af582f065d28e5a454447e9d0cfc60356439ebf7e1d0a00f5b9cc6daf2bd7195ba96b4d1a0679ff0fb1c01282c378a880f90f460889b67d76d4d0e8db6c928d113533d1d10b810303c43d8ff622c5bab7f095b96e64bf9daa48a2bdf3d9d40bac00cf1b66df61a4f7c3e21938e876f81b1179dce6a008f28eb682cae690ced0ea0d542da604d8056f2b1813ed36683c4c51aeb2650772cfb1c55d4e60604ff06344cfc271b2175a6c94defb807af240b483e24298ca73bfc743ca2ca2e77e6d5b817b3c1986601537faf59ac84c74d8bd0c068cb8e6bd03ac2dcf5793fb4a00b3c901a33aa3ee86e4f0db317b94bb8678ab26e36d305ebac4b0f7f164947148255b562dd0f87648499d45bccfb7d8c9d5624cadf8160a396e79fbcdc100058ba4606e41c02fb2cc0dc6c36196bd28acfde82a18cda2321d2d83fecd3b85380667cd1d0bc68298c6c8f10421a80c8fa86912b6c3e8ddd9d9668520d5151409e6b77f0d7730b374a68a744151bfbd123cfdf871e8c24e70d2ca3b50e84a48e0b78c1781000cfc848d43584985763a76c0ab9ba882c55e3e4aa8f2174255db38adb8350b48a77be22a869d13d183325f859b883464e5e46de5ea8a92532b9a794daaeff657cd361f7f158f8bebe36e9de1f5b9721d4263dcc9472229bc02d3f552180abfb25ca7aa36cb914d99c09fd5bb99dcab9b4e3c634d18fc7dfe84dc4425ad1e39c3e7410d49b4ea0a8a2958688c7725822f6dfc0827d19dc385e0e35a949941e4dd1aaeaab9ebe402f8c584bca7efc829f2ccfb63fd7bde1c182a67c14f9d3f033ca674e2604e89cd55a15419f956cd61a755c1b13554dae98e77be078aadfc131c9677381f1dbe6ef194eb17603a463e8b844ab46a6046e1f07d96d66de669359bff4c3d80948a4de3abb2f171a09b5d8999c379fb62244114e218c79805df7d899e5661320ee6721d652b95f09e4dfe69bd67099c73294b17ab574e0b966aa3ab44478965b9dca3cb3b9282945f24ccdd07c638ae25a84a728ca24f87ff49d718121a694be46f3616e27b1041b3c6cd24b9cf775bfc28dfbe0a009048f0599f2d5d6586cfd1e7f7fe69872d08b98f60d28e6af0d49d7f06ad71a7b5c41df261aba5de114022c7288bc265cc17909fdeadc3d7b256d7ab3b96e40f857060f16b54a6bb7248ee571f87ace5ee39eab412706cf52fa711468b21ea129c3f44bceb429fcc1a0ac2aa87b9365077dcfcfa9a1b32a0a09699197c20019a66cbd0a897feab3706c23123b888ada643d4560082033e31596b0483578968e3c9593ebd97141c228a42fc7645f92171c120aabca36657683fd7c72fcb87217f124d6fabc52f1d221d8410b47b0ad4bd944bf4085365e9b52a53911ab4ee142c5a1ebbe034c9d98c538c066f2dc0acf372eb2397dcac765055123e0ba19be22b18c886bf0f7490abe9fde91ffa62e059962bd134be8501cb5b715a744b1398e2c4c7e8afe72e189dda0654296afa1c1f99ab7d800fa40f72a758625c833b6fc7b7d42250522b456e1e7de815350c36c9cb2f4d1c9cb99109f89b456c559463f11b8b58247809b17a4ed4912bd0a47a529f1364d6dc593ea7f3eb98962078ac90e5012ee1c7b4b9ed5a8c7a9c0231b4ce425693faab64fa0f3482a04d4be2e06ee5d103694d288810a1a7f4d1e908dd82dd2016a064ece5cd67ef1dd5f4cda728fc6f1ccdd949dd8f775d862621507248ef4c83ae274969d19c7ddb02a4e8a1ab2b7aa539a442b22735ceedeefe60a1059dfaaa0979ce8d5387b5a047841fd9749b88ca91216b02d7926408a01916b7781bb7167528ccdb9a486d173437a5ba3e552c8674dff2cc9b21054e0e4f86b61b8723fca58ceef4413bffae9e9be79c5b9788f5449811ce78be9bc7a86375a670197baaef751beabcba0aa6c7c33f1cd702cb78ec39fa1f17d9da733d6abf2b80f9c51ac8f6f664b24edc53a7c9525c3016bd05c67272375fe816b2b121f2de68b885a0fd8f8b8c6c342237b632f6414a3eb3480f5f42106c5812e9bfd4e8c8dea8d08525d9aa1da7c7c2ee7ff3d31b79b211dd01e304a8ffc83a89a59f3b1e2ef5e969b6d90bea7e161066f25622fad914bff52bacd2807093dda1838b529ee57f718b374ce2841b924a42457867547a6edcb8412d85f11796742bf640b5819a9546357df778c332af5983c4373a95d9c58b52dba445eee92e6911824f0c534e7a5934d9eac9b7f6fec22002fc53a3003a3304217f567b47cd326edc5f48eb1f46bb20d1e10e72239afc9769344590cf48902aba5405b7d4baa31a912ab398a2f2d3f037614bb56a89244ece50f3a1e058d274f1e70f944eb8a305be91e561e5eb843d057a81f4deb84a6335ec81ca964cdae5f318d4e9aaea2c477cc279c00c698bcfe4b8e04c09079d8f3f5438d9d45a00f50d2f9b245c8c68eebf247e25ba8d26f8b95b21ac9ceb50c0aa2e4bdc032024db216b92f9350a90ac79341af14d3fa8ba908096e1b503341aed667bb184c672dac85fc4f335b3871c3b4e55ea219a857d2d2e135358f6b45a20b3e7de8e09b2041eb7c5084a80258fb524a983752659298a251e178b56f96bc67ae0a78ec92f92d92c9cf0edb5dcb11e739d69410ad44c8df00caa030d7d89f2ec38bd7698115c423cf3e6048793aca08ffbcdac766f1553773fa00031c1d75246e4e1eddf8948d02a3de6d67fd7329e45070f29044587f1e0db50d04e673191a63e30f96ee0d8d52738fab36a7fe2c6ab9301d401e7ca5b1f039193a580e40abbdf40c2d7e27809dec80815d37adae9fe7fb9d3a974c9fc03944d7338d000b81170be4c6792ed6b3b827194b3ae11e2acfca48498d1126aacf80f3d574256ef7f75552ff087a819e", 0x1000}, {&(0x7f0000001040)="9d7fcf3efc63f4a6a555ba8b4726d7ccaf8a207100e69cfac4377876021d7131b838059f96bd206d4776368ed2a92432e5af71", 0x33}], 0x2, 0x0, 0x6b}, 0x4000000) setsockopt$netlink_NETLINK_TX_RING(r3, 0x10e, 0xc, &(0x7f0000000040)={0x5}, 0x10) r5 = socket$nl_route(0x10, 0x3, 0x0) setsockopt$netlink_NETLINK_NO_ENOBUFS(r5, 0x10e, 0xc, &(0x7f0000000040)=0x7f, 0x4) sendmsg$nl_route(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000001100)={&(0x7f0000001340)=ANY=[], 0x30}, 0x1, 0x0, 0x0, 0x48003}, 0x0) sendmsg$nl_route(r3, &(0x7f0000001140)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000011c0)=ANY=[], 0x2c}, 0x1, 0x0, 0x0, 0x260180d1}, 0x24048090) r6 = socket$netlink(0x10, 0x3, 0x6) bind$netlink(r6, &(0x7f0000514ff4)={0x10, 0x0, 0x0, 0x2ffffffff}, 0xc) r7 = socket$inet6_mptcp(0xa, 0x1, 0x106) bind$inet6(r7, &(0x7f0000000040)={0xa, 0x4e24, 0x0, @empty, 0x800007}, 0x1c) r8 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r8, &(0x7f0000000080)={0x1f, 0xffff, 0x3}, 0x6) write(r8, &(0x7f0000000140)="24000000010006", 0x7) syz_genetlink_get_family_id$mptcp(&(0x7f00000010c0), r2) r9 = socket$inet_mptcp(0x2, 0x1, 0x106) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f00000001c0)={'wlan0\x00'}) socket$nl_generic(0x10, 0x3, 0x10) connect$inet(r9, &(0x7f0000000000)={0x2, 0x6e22, @local}, 0x10) r10 = bpf$BPF_BTF_LOAD(0x12, &(0x7f0000008b80)={&(0x7f00000003c0)=ANY=[], 0x0, 0x46, 0x0, 0x1, 0x3}, 0x28) r11 = socket$inet6(0xa, 0xc0f4c4bcf63bab3e, 0xc04) setsockopt$inet6_IPV6_DSTOPTS(r11, 0x29, 0x3b, &(0x7f0000000380)=ANY=[@ANYRES64=r9, @ANYRESDEC, @ANYRES8=r10, @ANYRES64=r11], 0x8) setsockopt$inet6_int(r7, 0x29, 0x12, &(0x7f0000000040)=0x5, 0x4) 2.278650495s ago: executing program 3 (id=1701): sendmsg$ETHTOOL_MSG_FEATURES_SET(0xffffffffffffffff, 0x0, 0x0) r0 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_int(r0, 0x107, 0xf, &(0x7f0000000100)=0x207, 0x4) r1 = socket$packet(0x11, 0x3, 0x300) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000300)={'ip6gre0\x00', 0x0}) sendto$packet(r0, 0x0, 0x0, 0x4, &(0x7f0000000140)={0x11, 0x86dd, r2, 0x1, 0x0, 0x6, @multicast}, 0x14) recvmmsg(r1, &(0x7f0000000780)=[{{0x0, 0x0, &(0x7f0000000680)=[{&(0x7f00000005c0)=""/174, 0xae}], 0x1}, 0xffffffff}], 0x1, 0x22, 0x0) 2.056311154s ago: executing program 4 (id=1702): r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$IPT_SO_SET_REPLACE(r0, 0x4000000000000, 0x40, &(0x7f0000002300)=@raw={'raw\x00', 0xc01, 0x3, 0x2298, 0x1100, 0x5002004a, 0x0, 0x0, 0x0, 0x2200, 0x3c8, 0x3c8, 0x2200, 0x3c8, 0x3, 0x0, {[{{@uncond, 0x60, 0x10a0, 0x1100, 0x0, {}, [@common=@unspec=@cgroup1={{0x1030}, {0x1, 0x0, 0x0, 0x0, './cgroup.cpu/syz1\x00'}}]}, @common=@SET={0x60, 'SET\x00', 0x0, {{0x1, [0x2, 0x1, 0x7], 0x6, 0x2}, {0x2, [0x0, 0x6, 0x4, 0x9, 0x0, 0x89ce99baffcf6900], 0x1, 0x1}}}}, {{@uncond, 0x0, 0x10a0, 0x1100, 0x0, {}, [@common=@unspec=@cgroup1={{0x1030}, {0x0, 0x0, 0x1, 0x1, './cgroup.net/syz1\x00', 0x2, {0x5}}}]}, @common=@inet=@HMARK={0x60, 'HMARK\x00', 0x0, {@ipv4=@loopback, [0xffffff00, 0xff000000, 0xff, 0xff0000ff], 0x4e22, 0x4c20, 0x4e24, 0x4e23, 0xc9, 0x0, 0x3b, 0x83, 0x25}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28, '\x00', 0x4}}}}, 0x22f8) r1 = bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000480)={&(0x7f0000000280)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0xc, 0xc, 0x2, [@restrict]}}, 0x0, 0x26}, 0x20) bpf$BPF_GET_MAP_INFO(0xf, &(0x7f0000000200)={r1, 0x58, &(0x7f0000000180)}, 0x10) r2 = socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt$inet_sctp6_SCTP_HMAC_IDENT(r2, 0x84, 0x16, &(0x7f00000000c0)={0x8, [0x5, 0x10, 0x6, 0xdb1b, 0x3, 0x1, 0x9, 0x27]}, 0x14) r3 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r3, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)=[{&(0x7f0000000780)={0x2c, 0x10, 0x1, 0x0, 0x25dfdbfe, "", [@typed={0x8, 0x0, 0x0, 0x0, @fd=r3}, @typed={0x8, 0x0, 0x0, 0x0, @fd}, @nested={0x4, 0x1a}, @typed={0x8, 0x27, 0x0, 0x0, @ipv4=@empty}]}, 0x2c}], 0x1}, 0x4040010) bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000140)={&(0x7f0000000000)=ANY=[@ANYBLOB="9feb01001800000000000000340000003400000006000000040000000000000e0400000000000000000000000000000d03000000000000000000000400000000000000000000000b030000000000000063"], 0x0, 0x52}, 0x28) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000180)={0x11, 0xb, &(0x7f0000000240)=ANY=[@ANYBLOB="183000000100000000000000030000001801000020786c2500000000002020207b0000ff00000000bfa100000000000007010000f8ffffffb702000008000000b7030000652b0000850000000600000095"], &(0x7f0000000080)='GPL\x00', 0xa}, 0x94) getsockopt$inet_sctp6_SCTP_HMAC_IDENT(0xffffffffffffffff, 0x84, 0x16, &(0x7f0000000100)={0x3, [0xfffc, 0x7fff, 0xfffb]}, &(0x7f00000002c0)=0xa) 1.849470692s ago: executing program 2 (id=1703): r0 = socket$nl_xfrm(0x10, 0x3, 0x6) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$NL80211_CMD_PEER_MEASUREMENT_START(0xffffffffffffffff, &(0x7f0000000100)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x20000}, 0xc, &(0x7f00000000c0)={&(0x7f0000000080)={0x30, r1, 0x200, 0x70bd2c, 0x25dfdbfd, {{}, {@void, @void}}, [@NL80211_ATTR_TIMEOUT={0x8, 0x110, 0x2}, @NL80211_ATTR_TIMEOUT={0x8, 0x110, 0x1}, @NL80211_ATTR_MAC={0xa, 0x6, @broadcast}]}, 0x30}, 0x1, 0x0, 0x0, 0x4040882}, 0x20000000) (async) sendmsg$NL80211_CMD_PEER_MEASUREMENT_START(0xffffffffffffffff, &(0x7f0000000100)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x20000}, 0xc, &(0x7f00000000c0)={&(0x7f0000000080)={0x30, r1, 0x200, 0x70bd2c, 0x25dfdbfd, {{}, {@void, @void}}, [@NL80211_ATTR_TIMEOUT={0x8, 0x110, 0x2}, @NL80211_ATTR_TIMEOUT={0x8, 0x110, 0x1}, @NL80211_ATTR_MAC={0xa, 0x6, @broadcast}]}, 0x30}, 0x1, 0x0, 0x0, 0x4040882}, 0x20000000) sendmsg$nl_xfrm(r0, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000380)=@newsa={0xf0, 0x12, 0x401, 0x0, 0x0, {{@in6=@local, @in6=@remote, 0x0, 0x0, 0x0, 0x0, 0xa}, {@in6=@local, 0x1234, 0x33}, @in6=@remote, {0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff}, {}, {}, 0x0, 0x0, 0xa}}, 0xf0}}, 0x0) 1.849037733s ago: executing program 0 (id=1704): r0 = socket$inet_sctp(0x2, 0x1, 0x84) setsockopt$IPT_SO_SET_REPLACE(r0, 0x0, 0x40, &(0x7f0000000d00)=@raw={'raw\x00', 0x8, 0x3, 0x578, 0x290, 0xa, 0x148, 0x290, 0x10, 0x4e0, 0x2a8, 0x2a8, 0x4e0, 0x2a8, 0x3, 0x0, {[{{@ip={@private=0xa010102, @multicast1, 0x0, 0x0, 'veth0\x00', 'veth0_virt_wifi\x00', {}, {0xff}}, 0x0, 0x220, 0x290, 0x0, {0x200003ae, 0x7f00}, [@common=@inet=@hashlimit1={{0x58}, {'geneve0\x00', {0x0, 0xe2, 0x9, 0x0, 0x0, 0xfffffffb, 0x7}}}, @common=@inet=@hashlimit3={{0x158}, {'veth0_virt_wifi\x00', {0x400, 0x0, 0x44, 0x7e, 0x7, 0x101, 0xfffffaf9, 0xe, 0x20, 0x8}, {0x9}}}]}, @common=@unspec=@NFLOG={0x70, 'NFLOG\x00', 0x0, {0x2, 0x0, 0x7f, 0x0, 0x0, "f2f7b90ad2b60c45cb4ea6e7bf902bdc2ff8a9304d9f655c746adc0bdc773506378bc0d27efd6abb05175089830cc46186074d7de46d5af300"}}}, {{@uncond, 0x0, 0x208, 0x250, 0x0, {}, [@common=@inet=@hashlimit3={{0x158}, {'geneve0\x00', {0x0, 0xff, 0x0, 0x4000, 0x0, 0x7fff, 0x240, 0x0, 0x8}, {0xfffffffffffffffc}}}, @common=@set={{0x40}, {{0xffff, [0x1, 0x4, 0x0, 0x7, 0x5, 0x3], 0x0, 0x4}}}]}, @unspec=@CT0={0x48, 'CT\x00', 0x0, {0x0, 0x2, 0xa, 0x7, 'syz1\x00', {0xfffffffffffffffd}}}}], {{'\x00', 0xc8, 0x70, 0x98}, {0x28}}}}, 0x5d8) 1.654982161s ago: executing program 4 (id=1705): socket$nl_generic(0x10, 0x3, 0x10) socket$inet6_tcp(0xa, 0x1, 0x0) socket$nl_route(0x10, 0x3, 0x0) socket$nl_generic(0x10, 0x3, 0x10) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_DESTROY(r0, &(0x7f0000000240)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f0000000200)={&(0x7f00000001c0)={0x38, 0x3, 0x6, 0x401, 0x0, 0x0, {0x3, 0x0, 0x2}, [@IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz2\x00'}, @IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_PROTOCOL={0x5}]}, 0x38}, 0x1, 0x0, 0x0, 0x8000}, 0x24040045) r1 = socket$inet6_mptcp(0xa, 0x1, 0x106) getsockopt$inet6_tcp_buf(r1, 0x6, 0x19, &(0x7f0000002fc0)=""/4096, &(0x7f0000000680)=0xffffffffffffff81) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000001c0)=ANY=[@ANYBLOB="a400000010000104080000000300000000000000", @ANYRES32=0x0, @ANYBLOB="fab0817dbcb5f31a70001280110001006272696467655f736c6176650000000058000580050019a103000000050005000000000005000c000700000005000700a100000005000a00ffa1000005000800ffa10000040018000500060001000000060002000100000005001e00000000000500010003000000140003006272696467655f736c6176655f30"], 0xa4}, 0x1, 0x0, 0x0, 0x20044010}, 0x4040) openat$tun(0xffffffffffffff9c, &(0x7f0000000140), 0x42000, 0x0) socketpair(0x1, 0x1, 0x0, &(0x7f0000000000)) close(0x3) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000029c0)={0xffffffffffffffff, 0xffffffffffffffff}) close(r3) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000740)={0x0, 0x4, &(0x7f0000000000)=ANY=[@ANYBLOB="1800000000000000000000000000000071127f000000000095"], 0x0, 0x0, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, 0x24, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x9}, 0x94) r4 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f00000000c0), 0x34) bpf$MAP_LOOKUP_ELEM(0x5, &(0x7f00000000c0)={r4, &(0x7f0000000000), &(0x7f0000000040)=""/73}, 0x70) 1.626430072s ago: executing program 1 (id=1706): sendmsg$ETHTOOL_MSG_LINKMODES_SET(0xffffffffffffffff, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000100)=ANY=[], 0x3c}, 0x1, 0x0, 0x0, 0x20004000}, 0x4044094) (async, rerun: 64) r0 = socket$inet(0x2, 0x3, 0x33) (rerun: 64) getsockopt$inet_mreqsrc(r0, 0x0, 0x53, &(0x7f0000000000)={@dev, @local, @broadcast}, &(0x7f0000000040)=0x8) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r1, &(0x7f0000000000)={0x1f, 0xffffffffffffffff, 0x3}, 0x6) (async) ioctl$SIOCX25SFACILITIES(0xffffffffffffffff, 0x89e3, &(0x7f0000000080)={0x37, 0x800000, 0x8, 0x9, 0x8000}) (async) r2 = socket(0x2, 0x805, 0x0) getsockopt$inet_sctp_SCTP_SOCKOPT_CONNECTX3(r2, 0x84, 0x6f, &(0x7f0000000000)={0x0, 0x20, &(0x7f0000000100)=[@in={0x2, 0x4e20, @rand_addr=0x64010102}, @in={0x2, 0x4e20, @remote}]}, &(0x7f00000007c0)=0x10) (async) getsockopt$inet_sctp6_SCTP_GET_ASSOC_ID_LIST(r2, 0x84, 0x1d, &(0x7f0000000000)={0x1, [0x0]}, &(0x7f0000000040)=0x8) getsockopt$inet_sctp_SCTP_ASSOCINFO(r2, 0x84, 0x1, &(0x7f0000000180)={r3, 0x2, 0x6, 0x80000000, 0xa18c, 0x8}, &(0x7f00000001c0)=0x14) syz_emit_ethernet(0x4a, &(0x7f0000004180)={@local, @broadcast, @void, {@ipv6={0x86dd, @tcp={0x0, 0x6, '\x00', 0x14, 0x6, 0x0, @local, @local, {[], {{0x8000, 0x4001, 0x41424344, 0x41424344, 0x0, 0x0, 0x5, 0x42, 0x100}}}}}}}, 0x0) r4 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$inet_int(r4, 0x0, 0x1, &(0x7f0000000180)=0x1f5, 0x1) (async) write$bt_hci(r1, &(0x7f0000000080)=ANY=[], 0x6) 1.562240548s ago: executing program 2 (id=1707): r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_inet_SIOCSIFPFLAGS(0xffffffffffffffff, 0x8934, &(0x7f0000000040)={'wlan0\x00', 0x1}) ioctl(r0, 0x8b22, &(0x7f0000000040)) r1 = socket$inet6(0xa, 0x2, 0x0) setsockopt$inet6_int(r1, 0x29, 0x33, &(0x7f0000000040)=0x7, 0x4) bind$inet6(r1, &(0x7f0000f5dfe4)={0xa, 0x4e20, 0x0, @empty}, 0x1c) recvmmsg(r1, &(0x7f0000000600)=[{{&(0x7f0000000140)=@nfc_llcp, 0x80, &(0x7f0000000800)=[{&(0x7f0000000340)=""/180, 0xb4}, {&(0x7f0000000280)=""/122, 0x7a}, {&(0x7f0000000400)=""/165, 0xa5}, {&(0x7f00000004c0)=""/142, 0x8e}, {&(0x7f0000000640)=""/70, 0x46}, {&(0x7f00000006c0)=""/179, 0xb3}], 0x6, &(0x7f0000000580)=""/70, 0x46}}], 0x1, 0x2, 0x0) r2 = socket$inet6(0xa, 0x2, 0x0) sendto$inet6(r2, 0x0, 0x0, 0x0, &(0x7f0000000300)={0xa, 0x4e20, 0x0, @mcast1}, 0x1c) socket$inet6(0xa, 0x2, 0x0) 1.56061058s ago: executing program 0 (id=1708): socket(0x10, 0x803, 0x0) r0 = socket$inet6(0xa, 0x2, 0x0) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000300)=@bpf_lsm={0xd, 0x5, &(0x7f0000000040)=ANY=[@ANYBLOB="a60a0000000000006111800000000000180000000000000000000000000000009500000000000000"], &(0x7f0000000100)='syzkaller\x00'}, 0x94) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r0, 0x29, 0x20, &(0x7f0000000080)={@mcast2, 0x300, 0x0, 0x2, 0x3, 0x0, 0x4}, 0x20) socket$inet6(0xa, 0x2, 0x0) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000004c0)={&(0x7f0000000700)=ANY=[@ANYBLOB="50000000021601080000000000000000000000000900e30000007a000000000005000900030000000c000300686173683a6970001400078005001500ff000000080031400000004c0500010006000000"], 0x50}, 0x1, 0x0, 0x0, 0x40010}, 0x0) r2 = socket$xdp(0x2c, 0x3, 0x0) getsockopt$IP_VS_SO_GET_SERVICES(r2, 0x0, 0x482, &(0x7f00000005c0)=""/227, &(0x7f00000006c0)=0xe3) socket$inet6_sctp(0xa, 0x5, 0x84) close(0x3) syz_genetlink_get_family_id$devlink(&(0x7f0000000580), 0xffffffffffffffff) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0) ioctl$TUNSETIFF(r3, 0x400454ca, &(0x7f0000000080)={'pimreg0\x00', 0x7c2}) ioctl$TUNSETQUEUE(r3, 0x400454d9, &(0x7f00000000c0)={'veth0_to_batadv\x00', 0x400}) ioctl$TUNSETQUEUE(r3, 0x400454d9, &(0x7f0000000140)={'veth0_macvtap\x00', 0x400}) r4 = socket$netlink(0x10, 0x3, 0x4) write(r4, &(0x7f00000000c0)="29000000140005b7ff000000040860eb0101b6ff02159f02c26ed638eeb738256e06a40e07fff0797e", 0x140) r5 = socket$can_bcm(0x1d, 0x2, 0x2) r6 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) ioctl$TUNSETIFF(r6, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x1001}) r7 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r7, 0x8933, &(0x7f0000000080)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r7, &(0x7f0000001000)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000100)=@newqdisc={0x30, 0x24, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r8, {0x0, 0xffff}, {0xfff1, 0xffff}}, [@qdisc_kind_options=@q_ingress={0xc}]}, 0x30}}, 0x0) sendmsg$nl_route_sched(r7, &(0x7f0000001200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f00000012c0)=@newtfilter={0x84, 0x2c, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r8, {0x1}, {0xfff1, 0xffff}, {0xfff3, 0x1}}, [@filter_kind_options=@f_basic={{0xa}, {0x4c, 0x2, [@TCA_BASIC_ACT={0x48, 0x3, [@m_ct={0x44, 0x1, 0x0, 0x0, {{0x7}, {0x1c, 0x2, 0x0, 0x1, [@TCA_CT_PARMS={0x18, 0x1, {0x0, 0x0, 0x20000000}}]}, {0x4}, {0xc}, {0xc}}}]}]}}, @TCA_RATE={0x6, 0x5, {0xaa, 0x3}}]}, 0x84}}, 0x8084) ioctl$ifreq_SIOCGIFINDEX_vcan(r5, 0x8933, &(0x7f0000000100)={'vcan0\x00'}) r9 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r9, 0x8933, &(0x7f0000000140)) socket$nl_route(0x10, 0x3, 0x0) sendmsg$NFT_BATCH(0xffffffffffffffff, 0x0, 0x0) 1.325599463s ago: executing program 3 (id=1709): mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup/syz1\x00', 0x1ff) (async) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) (async) r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000004c0)={0x3, 0xc, &(0x7f0000000140)=ANY=[@ANYBLOB="180200000100004000000000000000008500000087000000180100002020702500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000006d00000095"], &(0x7f0000000080)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x4}, 0x94) (async) r1 = bpf$MAP_CREATE(0x0, 0x0, 0x0) r2 = socket$kcm(0x10, 0x2, 0x0) (async) r3 = socket$kcm(0x11, 0x3, 0x0) (async) r4 = socket$unix(0x1, 0x5, 0x0) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) setsockopt$sock_attach_bpf(r3, 0x107, 0xf, &(0x7f0000000600), 0x56) (async) sendmsg$kcm(r3, &(0x7f00000000c0)={&(0x7f0000000580)=@xdp={0x2c, 0x0, r5, 0x3e}, 0x80, &(0x7f0000000080)=[{&(0x7f0000000180)="27030200590214120600002fb96dbcf706e10500000086ddffff1144ee1611d4b8bf4a31accb", 0xfdef}], 0x1}, 0x0) (async) r6 = bpf$BPF_BTF_GET_FD_BY_ID(0x13, &(0x7f0000000400)=0xffffffffffffffff, 0x4) (async) r7 = bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000680)={&(0x7f0000000580)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0x50, 0x50, 0x7, [@func_proto={0x0, 0x7, 0x0, 0xd, 0x0, [{0x2, 0x2}, {0x8, 0x2}, {0x7, 0x3}, {0x5, 0x1}, {0x2, 0x5}, {0x7}, {0x0, 0x1}]}, @type_tag={0xd, 0x0, 0x0, 0x12, 0x1}]}, {0x0, [0x2e, 0x0, 0x5f, 0x61, 0x2e]}}, &(0x7f0000000600)=""/99, 0x6f, 0x63, 0x1, 0x7, 0x10000}, 0x28) (async) r8 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000040)='blkio.bfq.io_serviced_recursive\x00', 0x0, 0x0) setsockopt$IP_VS_SO_SET_FLUSH(r8, 0x0, 0x485, 0x0, 0x0) (async) bpf$MAP_CREATE(0x0, &(0x7f0000000440)=@bloom_filter={0x1e, 0x1, 0xffff, 0x1297, 0x18808, r1, 0x5, '\x00', r5, r6, 0x5, 0x5, 0x2, 0x5, @value=r7, @void, @value=r8}, 0x50) bpf$MAP_CREATE(0x0, &(0x7f0000000140)=@base={0x1, 0x4, 0x4, 0x100, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0}, 0x48) r9 = bpf$PROG_LOAD(0x5, &(0x7f00000001c0)={0x1, 0x3, &(0x7f0000000280)=@framed, &(0x7f0000000300)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) setsockopt$sock_attach_bpf(r2, 0x1, 0x32, &(0x7f0000000040)=r9, 0x4) sendmsg$kcm(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)=[{&(0x7f0000000300)="d800000018002f25e6924c1b00e6b904021d080006007c09e8fe55a10a0015400200142602600e1208000f0000000401a8001600140003400400027c035c0461c1d67f6f94007134cf6efb8000a007a290457f0189b316277ce06bbace8017cbec4c2ee5a7cef4090000001f180000000000000014d6d930dfe1d9d322303983a475730d16a4683f5aeb4edbb57a5025ccca1e10360000000000000080d95667e006dcdf63951f215ce3bb9ad809d5e1cace81ed0bffece0b42a9ecbee5de6ccd40dd6e4edef3d93452a92954b9f65137743370e97039207", 0xd8}], 0x1}, 0x0) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f00000002c0)={r0, 0x0, 0xe, 0x0, &(0x7f00000003c0)="e097566f5bec64466cf0925782dd", 0x0, 0x8c9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, 0x50) (async) unshare(0x24060400) (async) bpf$PROG_LOAD_XDP(0x5, &(0x7f00000000c0)={0x3, 0x0, 0x0, 0x0, 0x8, 0xfffffffffffffdc4, 0x0, 0x0, 0x0, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x8001}, 0x94) (async) r10 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='memory.events\x00', 0x275a, 0x0) write$cgroup_subtree(r10, &(0x7f0000000080)=ANY=[], 0x10448) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x2000001, 0x12, r10, 0x0) (async) bpf$MAP_LOOKUP_ELEM(0x1, &(0x7f0000000040)={0xffffffffffffffff, 0x0, 0x0}, 0x20) 1.284448014s ago: executing program 4 (id=1710): r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_GET_CTRZERO(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000b40)={0x1c, 0x3, 0x1, 0x801, 0x0, 0x0, {0x2, 0x0, 0x6}, [@CTA_ZONE={0x6, 0x12, 0x1, 0x0, 0x1}]}, 0x1c}, 0x1, 0x0, 0x0, 0x8004}, 0x8084) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000800)={&(0x7f0000000500)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f00000006c0)={&(0x7f0000000640)=@getchain={0x5c, 0x66, 0x200, 0x70bd2b, 0x25dfdbfc, {0x0, 0x0, 0x0, 0x0, {0xc}, {0x10, 0xb}, {0x0, 0xd}}, [{0x8, 0xb, 0xffffffff}, {0x8, 0xb, 0x2}, {0x8, 0xb, 0x7fffffff}, {0x8, 0xb, 0x4}, {0x8, 0xb, 0x3}, {0x8, 0xb, 0x81}, {0x8, 0xb, 0x8}]}, 0x5c}, 0x1, 0x0, 0x0, 0x4040080}, 0x800) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000780)=@newlink={0x5c, 0x10, 0x401, 0x4, 0x0, {0x0, 0x0, 0x0, 0x0, 0x103, 0x10}, [@IFLA_LINKINFO={0x3c, 0x12, 0x0, 0x1, @bond={{0x9}, {0x2c, 0x2, 0x0, 0x1, [@IFLA_BOND_MIN_LINKS={0x8, 0x12, 0x9}, @IFLA_BOND_PRIMARY_RESELECT={0x5, 0xc, 0x1}, @IFLA_BOND_PEER_NOTIF_DELAY={0x8, 0x1c, 0x10000}, @IFLA_BOND_AD_ACTOR_SYS_PRIO={0x6, 0x18, 0x5}, @IFLA_BOND_AD_ACTOR_SYSTEM={0x8, 0x1a, @multicast2}]}}}]}, 0x5c}, 0x1, 0x0, 0x0, 0x850}, 0x0) r3 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000040), r0) r4 = socket$inet6(0xa, 0x1, 0x8010000000000084) r5 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000400)='memory.stat\x00', 0x0, 0x0) sendmsg$IPCTNL_MSG_EXP_NEW(r5, &(0x7f0000000740)={&(0x7f00000004c0)={0x10, 0x0, 0x0, 0x2000004}, 0xc, &(0x7f0000000700)={&(0x7f0000000a00)={0xac, 0x0, 0x2, 0x101, 0x0, 0x0, {0x3, 0x0, 0x4}, [@CTA_EXPECT_NAT={0x7c, 0xa, 0x0, 0x1, [@CTA_EXPECT_NAT_TUPLE={0x24, 0x2, 0x0, 0x1, [@CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5, 0x1, 0x6}}, @CTA_TUPLE_IP={0x14, 0x1, 0x0, 0x1, @ipv4={{0x8, 0x1, @private=0xa010102}, {0x8, 0x2, @rand_addr=0x64010102}}}]}, @CTA_EXPECT_NAT_DIR={0x8, 0x1, 0x1, 0x0, 0x1}, @CTA_EXPECT_NAT_DIR={0x8}, @CTA_EXPECT_NAT_DIR={0x8, 0x1, 0x1, 0x0, 0x1}, @CTA_EXPECT_NAT_DIR={0x8}, @CTA_EXPECT_NAT_DIR={0x8}, @CTA_EXPECT_NAT_TUPLE={0xc, 0x2, 0x0, 0x1, [@CTA_TUPLE_ZONE={0x6, 0x3, 0x1, 0x0, 0x1}]}, @CTA_EXPECT_NAT_DIR={0x8, 0x1, 0x1, 0x0, 0x1}, @CTA_EXPECT_NAT_TUPLE={0x18, 0x2, 0x0, 0x1, [@CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5, 0x1, 0x88}}, @CTA_TUPLE_ZONE={0x6, 0x3, 0x1, 0x0, 0x3}]}]}, @CTA_EXPECT_NAT={0x1c, 0xa, 0x0, 0x1, [@CTA_EXPECT_NAT_DIR={0x8}, @CTA_EXPECT_NAT_DIR={0x8}, @CTA_EXPECT_NAT_DIR={0x8, 0x1, 0x1, 0x0, 0x1}]}]}, 0xac}, 0x1, 0x0, 0x0, 0x4000040}, 0x2004c010) sendmmsg$inet6(r4, &(0x7f0000004cc0)=[{{&(0x7f0000000040)={0xa, 0x4e1e, 0x1ff, @private0, 0x401}, 0x1c, &(0x7f00000001c0)=[{&(0x7f00000003c0)="f5", 0x1}], 0x1}}, {{&(0x7f0000000480)={0xa, 0x4e23, 0x4, @private2={0xfc, 0x2, '\x00', 0x1}, 0x8e}, 0x1c, &(0x7f0000000d80)=[{&(0x7f0000000c40)="ea", 0x26}], 0x1}}], 0x2, 0x40) bpf$PROG_LOAD(0x5, &(0x7f00000002c0)={0x3, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="18000000ff0700000000000000000000850000002a00000018010000646c6c2500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000000000000b703000000000000850000007200000095"], 0x0, 0x3054, 0x0, 0x0, 0x41100, 0x20, '\x00', 0x0, @sched_cls=0x2e, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0}, 0x94) r6 = socket$packet(0x11, 0x2, 0x300) r7 = bpf$PROG_LOAD(0x5, &(0x7f0000000880)={0x1, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000380)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x10, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000}, 0x94) setsockopt$sock_attach_bpf(r6, 0x1, 0x32, &(0x7f0000000180)=r7, 0x4) r8 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r8, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000440)=@newqdisc={0x24, 0x24, 0x4ee4e6a52ff56541, 0x1, 0x25dfdbfd, {0x0, 0x0, 0x0, 0x0, {0x0, 0xb}, {0xffff, 0xffff}, {0xfff2, 0x6}}}, 0x24}, 0x1, 0x0, 0x0, 0x40088c1}, 0x0) shutdown(r4, 0x1) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x8080}, 0x20004450) r9 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r9, 0x6, 0x13, &(0x7f0000000040)=0x100000001, 0x76dc) r10 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r10, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000180)=@newlink={0x44, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x1c155}, [@IFLA_LINKINFO={0x24, 0x12, 0x0, 0x1, @macvlan={{0xc}, {0x14, 0x2, 0x0, 0x1, [@IFLA_MACVLAN_FLAGS={0x6, 0x2, 0xfffc}, @IFLA_MACVLAN_BC_QUEUE_LEN={0x8, 0x7, 0x767c78b0}]}}}]}, 0x44}}, 0x800) connect$inet6(r9, &(0x7f0000000100)={0xa, 0x0, 0x7, @ipv4={'\x00', '\xff\xff', @local}, 0x1}, 0x1c) setsockopt$inet6_tcp_TCP_ULP(r9, 0x6, 0x1f, &(0x7f00000002c0), 0x4) setsockopt$inet6_tcp_TLS_TX(r9, 0x11a, 0x2, &(0x7f0000000000)=@gcm_128={{0x303}, "399421fe8a4c9563", "00b147fbbfc100", "d6dc09ff", '\x00\x00\b\x00'}, 0x0) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f00000005c0)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a54000000060a010400000000000000000a0000010900010073797a310000000028000480240001800b0001007470726f78790000140002800800024000002a0c080001400000000a0900020073797a32"], 0x7c}, 0x1, 0x0, 0x0, 0x40}, 0x24000840) getsockopt$inet_sctp6_SCTP_ENABLE_STREAM_RESET(r4, 0x84, 0x76, &(0x7f0000000000)={0x0, 0x3}, &(0x7f00000000c0)=0x8) ioctl$sock_SIOCGIFINDEX_802154(r0, 0x8933, &(0x7f0000000100)={'wpan0\x00', 0x0}) sendmsg$NL802154_CMD_NEW_SEC_LEVEL(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000140)={0x20, r3, 0x1, 0x70bd2b, 0x25dfdbfe, {}, [@NL802154_ATTR_SEC_LEVEL={0x4}, @NL802154_ATTR_IFINDEX={0x8, 0x3, r11}]}, 0x20}, 0x1, 0x0, 0x0, 0x40081}, 0x0) 1.237154249s ago: executing program 1 (id=1711): socket$inet_tcp(0x2, 0x1, 0x0) (async) r0 = socket$inet_tcp(0x2, 0x1, 0x0) r1 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r1, &(0x7f00000014c0)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000180)={0x2, 0xd, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, [@sadb_x_policy={0x8, 0x12, 0x2, 0x2, 0x0, 0x0, 0x2, {0x6, 0x32, 0x3, 0x0, 0x0, 0x0, 0x0, @in=@rand_addr=0x10006c00, @in6=@private2}}, @sadb_address={0x3, 0x5, 0x0, 0x0, 0x0, @in={0x2, 0x0, @local}}, @sadb_address={0x3, 0x6, 0x0, 0x0, 0x0, @in={0x2, 0x0, @private}}]}, 0x80}}, 0x0) (async) sendmsg$key(r1, &(0x7f00000014c0)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000180)={0x2, 0xd, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, [@sadb_x_policy={0x8, 0x12, 0x2, 0x2, 0x0, 0x0, 0x2, {0x6, 0x32, 0x3, 0x0, 0x0, 0x0, 0x0, @in=@rand_addr=0x10006c00, @in6=@private2}}, @sadb_address={0x3, 0x5, 0x0, 0x0, 0x0, @in={0x2, 0x0, @local}}, @sadb_address={0x3, 0x6, 0x0, 0x0, 0x0, @in={0x2, 0x0, @private}}]}, 0x80}}, 0x0) syz_emit_ethernet(0x3e, &(0x7f0000000180)={@local, @dev, @void, {@ipv4={0x800, @tcp={{0x7, 0x4, 0x0, 0x0, 0x30, 0x0, 0x0, 0x0, 0x6, 0x0, @private=0xa010102, @local, {[@generic={0x7, 0x7, "0476bc4b4c"}]}}, {{0x0, 0x4e22, 0x41424344, 0x41424344, 0x0, 0x6, 0x5}}}}}}, 0x0) openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) (async) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, 0x0) (async) ioctl$TUNSETIFF(r2, 0x400454ca, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000007c0)={0x10, 0x2, &(0x7f0000000100)=ANY=[@ANYBLOB="91104d0000000000"], &(0x7f0000000000)='GPL\x00', 0x2, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x1}, 0x94) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) ioctl$TUNSETIFF(r3, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) (async) ioctl$TUNSETIFF(r3, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) ioctl$TUNSETOFFLOAD(r3, 0x400454ce, 0x1) r4 = socket(0x10, 0x3, 0x0) sendmsg$nl_route(r4, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000140)=@mpls_getroute={0x1c, 0x1a, 0x9e8a232eead7a86d, 0x0, 0x0, {0x1c, 0x20, 0xa8f1e416535134e9, 0x1, 0xfd, 0x0, 0xff, 0x0, 0x2d00}}, 0x1c}}, 0x0) r5 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x2000, 0x0) ioctl$TUNSETIFF(r5, 0x400454ca, &(0x7f0000000080)={'syzkaller0\x00', 0xca58c30f81b6079f}) (async) ioctl$TUNSETIFF(r5, 0x400454ca, &(0x7f0000000080)={'syzkaller0\x00', 0xca58c30f81b6079f}) socket$kcm(0x2, 0xa, 0x2) (async) r6 = socket$kcm(0x2, 0xa, 0x2) ioctl$SIOCSIFHWADDR(r6, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local}) bpf$BPF_BTF_LOAD(0x12, 0x0, 0x0) bpf$BPF_BTF_GET_NEXT_ID(0x17, 0x0, 0x0) bpf$MAP_CREATE_CONST_STR(0x0, 0x0, 0x0) r7 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r7, &(0x7f0000000280)={0x2, 0x4e21, @local}, 0x10) (async) bind$inet(r7, &(0x7f0000000280)={0x2, 0x4e21, @local}, 0x10) setsockopt$inet_tcp_TCP_CONGESTION(r7, 0x6, 0xd, 0x0, 0x0) connect$inet(r7, &(0x7f0000000180)={0x2, 0x4e21, @local}, 0x10) r8 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r8, 0x8933, &(0x7f0000000400)={'macvlan1\x00'}) (async) ioctl$sock_SIOCGIFINDEX(r8, 0x8933, &(0x7f0000000400)={'macvlan1\x00', 0x0}) openat$tun(0xffffffffffffff9c, 0x0, 0x40241, 0x0) sendmsg$nl_route_sched(r8, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000740)=@newqdisc={0x4c, 0x24, 0x4ee4e6a52ff56541, 0x40000, 0x25dfdbfb, {0x0, 0x0, 0x0, r9, {0x0, 0xb}, {0xffff, 0xffff}, {0x3, 0xfff3}}, [@qdisc_kind_options=@q_netem={{0xa}, {0x1c, 0x2, {{0x6, 0x6b7, 0x80, 0x0, 0x1, 0x91b1}}}}]}, 0x4c}, 0x1, 0x0, 0x0, 0x4000400}, 0x24000000) sendto$inet(r7, &(0x7f0000000900)="2e552f5d9fd8b0d9627c4980f0d1ea2bf8f617a682acd2841acd878bd68344d4f50f83b0c51fa9135a01c95d4a128ec8b12d01010000a44c4505ba9a36f2cf4cc5e8308126d0a2c3b9d24e57c5011376b6263e2a1258eec1eb72bedea3eb5ccf73eb081b4c6d5faa998d7b795c057dd757d14200a8a6dbb3e59df96b77d16753ac4b32b94ffe6b5ee304d0428eb18056657c8c5c71c632be66cb26fe5c9abec7591ef3cb9b2a1133e9fa9bf0de6c378bed7b51cb8a07c343aabfda193349b91a5dc81a658cb61fbbfa51ef95abe03381ee2cb8d41da19ea8b96ec68ce17cf57da60f1d04acaf34a643db8d2d5ad2991f306b42744347a0c9e1fe2136b2b3da49032d3a57df1e236222cf6d6fe396aff8e5fe7fff5baa88789b783c12045e2c904a5d118369fdddc3e6e2f24bdbb26df92ac9bf4751c897a87c0223888e36ad14ba6e4d879ff464cac6f13a3a543e067d922e99c50f2fc6391e9c1c82b7195005eafdbb3374200c134cbd0f11739e8c19dd07140686242fea48caf3a1a93b86f35d77f258a2c9ce24cf321068551a584262d7a74a344e428c77c8af755e72904b0ca8a0bb359fb0", 0x6fc50de5, 0x92, 0x0, 0x0) (async) sendto$inet(r7, &(0x7f0000000900)="2e552f5d9fd8b0d9627c4980f0d1ea2bf8f617a682acd2841acd878bd68344d4f50f83b0c51fa9135a01c95d4a128ec8b12d01010000a44c4505ba9a36f2cf4cc5e8308126d0a2c3b9d24e57c5011376b6263e2a1258eec1eb72bedea3eb5ccf73eb081b4c6d5faa998d7b795c057dd757d14200a8a6dbb3e59df96b77d16753ac4b32b94ffe6b5ee304d0428eb18056657c8c5c71c632be66cb26fe5c9abec7591ef3cb9b2a1133e9fa9bf0de6c378bed7b51cb8a07c343aabfda193349b91a5dc81a658cb61fbbfa51ef95abe03381ee2cb8d41da19ea8b96ec68ce17cf57da60f1d04acaf34a643db8d2d5ad2991f306b42744347a0c9e1fe2136b2b3da49032d3a57df1e236222cf6d6fe396aff8e5fe7fff5baa88789b783c12045e2c904a5d118369fdddc3e6e2f24bdbb26df92ac9bf4751c897a87c0223888e36ad14ba6e4d879ff464cac6f13a3a543e067d922e99c50f2fc6391e9c1c82b7195005eafdbb3374200c134cbd0f11739e8c19dd07140686242fea48caf3a1a93b86f35d77f258a2c9ce24cf321068551a584262d7a74a344e428c77c8af755e72904b0ca8a0bb359fb0", 0x6fc50de5, 0x92, 0x0, 0x0) recvfrom$inet(r7, &(0x7f0000000080), 0xffffffffffffffa9, 0xc9100120, 0x0, 0x1500) setsockopt$IPT_SO_SET_REPLACE(r0, 0x0, 0x40, &(0x7f0000000000)=@mangle={'mangle\x00', 0x1f, 0x6, 0x390, 0x0, 0x98, 0x130, 0x1c8, 0x2f8, 0x0, 0x98, 0x130, 0x260, 0x2f8, 0x6, 0x0, {[{{@uncond, 0x0, 0x70, 0x98}, @common=@unspec=@STANDARD={0x28, '\x00', 0x0, 0xfffffffe}}, {{@uncond, 0x0, 0x70, 0x98}, @common=@unspec=@STANDARD={0x28, '\x00', 0x0, 0xfffffffe}}, {{@uncond, 0x0, 0x70, 0x98}, @common=@unspec=@STANDARD={0x28, '\x00', 0x0, 0xfffffffe}}, {{@ip={@empty, @empty, 0x0, 0x0, '\x00', '\x00', {}, {}, 0x6}, 0x0, 0x70, 0x98}, @ECN={0x28, 'ECN\x00', 0x0, {0x30, 0x0, 0x3}}}, {{@uncond, 0x0, 0x70, 0x98}, @common=@unspec=@STANDARD={0x28, '\x00', 0x0, 0xfffffffe}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x3f0) 807.326367ms ago: executing program 0 (id=1712): r0 = socket(0x10, 0x3, 0x0) close(0x3) r1 = socket$inet_tcp(0x2, 0x1, 0x6) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) close(r2) sendmsg$NFT_BATCH(r2, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f00000002c0)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x5}}, [@NFT_MSG_NEWSETELEM={0x48, 0xc, 0xa, 0x101, 0x0, 0x0, {0xa, 0x0, 0x6}, [@NFTA_SET_ELEM_LIST_SET={0x9, 0x2, 'syz1\x00'}, @NFTA_SET_ELEM_LIST_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_SET_ELEM_LIST_ELEMENTS={0x1c, 0x3, 0x0, 0x1, [{0x18, 0x0, 0x0, 0x1, [@NFTA_SET_ELEM_KEY={0xc, 0x1, 0x0, 0x1, [@NFTA_DATA_VALUE={0x6, 0x1, "d103"}]}, @NFTA_SET_ELEM_FLAGS={0x8, 0x3, 0x1, 0x0, 0x1}]}]}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x3}}}, 0x70}, 0x1, 0x0, 0x0, 0x4000851}, 0x40) sendmsg$NFT_MSG_GETRULE(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000540)=ANY=[@ANYRES16=r2], 0x78}, 0x1, 0x0, 0x0, 0x40090}, 0x240c90c4) setsockopt$PNPIPE_ENCAP(r0, 0x113, 0x1, &(0x7f0000000180)=0x1, 0x4) close(0x3) r3 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(r3, 0x6, 0x13, &(0x7f0000000080)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_QUEUE(r3, 0x6, 0x14, &(0x7f0000000100)=0x2, 0x4) connect$inet(r3, &(0x7f0000000040)={0x2, 0x4e20, @dev={0xac, 0x14, 0x14, 0x58}}, 0x10) sendto(r3, &(0x7f0000000140)='A', 0xfffff, 0x40008c1, 0x0, 0x0) recvmmsg(r3, &(0x7f0000000d00)=[{{0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000001d40)=""/4096, 0x1000}], 0x1}, 0x1}], 0x256, 0x10022, 0x0) setsockopt$inet_tcp_buf(r1, 0x6, 0x1f, &(0x7f0000000400)='espintcp', 0x8) write(0xffffffffffffffff, &(0x7f0000000580)="d941ca74f0423650d5f0623f7d121145af560000000087ae1648394012cc869885719bf67dfc2bfba4802b12cf6b3a15724d8000daed67780608957404c6d33b488647b971ff20965fac58f1ef41fc01ff2f324665c522a747d98b88c46319b658bbfa357aefac06fbfca3520f13e2336d76c3c0381ad917407b008f5cf1f29cb79680556ffd1a162841b4c1b8c46d99b5594f796265c4b2ef039190a41867f0645738f5000000004e46e8475c1a810fcccd76cf7ea3c311942b4e67cb09f8247748b47d460af465f78f4a25d33213c4ef3d779a1e0eb65772739a91c23e99d38049d0bdf44f293528a524444fad8cdd5882d901fc7a6ea942494704e8095c2baaf51df36d6d8ed80609798301bde535c4511ddc4fd46663fe3157a9b8616a0a47d4ae3537fdf6799a6ba150d878f9cf4c5ee5c7f0fc063aa9e1129261d946cadc3862ff00181e1f4557763d22c7e16d448dad5022cc2ab75ad4ad504213ad4321dcc78ef32e57b54518c47fe32b08e05e4e33207e90885ef4a1686ef46c7c75b886f1f9189665191c", 0x189) socket$nl_route(0x10, 0x3, 0x0) socket(0x2a, 0x6, 0xffff) r4 = socket$inet_tcp(0x2, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000180)={'syz_tun\x00'}) socket(0x2b, 0x80801, 0x1) pipe(&(0x7f0000000240)) r5 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$sock_int(r5, 0x1, 0x3c, &(0x7f0000000040)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR(r5, 0x6, 0x13, &(0x7f00000000c0)=0x1, 0x4) connect$inet(r5, &(0x7f00000006c0)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0x2}}, 0x10) setsockopt$inet_tcp_TCP_REPAIR_QUEUE(r5, 0x6, 0x14, &(0x7f00000002c0)=0x1, 0x4) sendmmsg$inet(r5, &(0x7f0000000580)=[{{0x0, 0x0, &(0x7f0000000680)=[{&(0x7f0000000740)="b3", 0x1}], 0x1, &(0x7f0000000080)=ANY=[], 0xf0}}], 0x1, 0x24004c41) pselect6(0x40, &(0x7f0000000000)={0x7f, 0x7, 0x3, 0x7, 0x7, 0x9b, 0x800, 0x8000000000000000}, 0x0, 0x0, 0x0, 0x0) 778.178116ms ago: executing program 3 (id=1713): socket$nl_generic(0x10, 0x3, 0x10) (async) r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000080)={0x44, 0x42, 0x1, 0x0, 0x0, {0x3, 0x1}, [@generic="0ff2ecd06a8001dfc7000000", @typed={0x12, 0x1, 0x0, 0x0, @binary="00112233445566778899aabb86dd"}, @nested={0x4, 0x8002}, @nested={0xc, 0x8003, 0x0, 0x1, [@nested={0x8, 0x11, 0x0, 0x1, [@nested={0x4, 0x1c}]}]}]}, 0x44}}, 0x4000000) 649.226143ms ago: executing program 4 (id=1714): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r1 = socket(0x400000000010, 0x3, 0x0) r2 = socket$unix(0x1, 0x5, 0x0) r3 = socket$inet6_sctp(0xa, 0x1, 0x84) r4 = socket$inet6_sctp(0xa, 0x5, 0x84) r5 = socket(0x2, 0x80805, 0x0) getsockopt$inet_sctp_SCTP_MAX_BURST(r5, 0x84, 0xc, &(0x7f0000000100)=@assoc_value={0x0}, &(0x7f0000000000)=0x8) getsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER(r4, 0x84, 0x7b, &(0x7f0000000000)={r6, 0x4}, &(0x7f0000000040)=0x8) r7 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r7, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000004c0)=ANY=[@ANYBLOB="140000001000010000000000000000000a00000a20000000000a01030000000000000000010000000900010073797a310000000054000000030a01020000000000000000010000000900030073797a310000000028000480080002400000000008000140000000051400030076657468315f6d6163767461700000000900010073797a31000000007c000000050a01020000000000000000010020000c0002400000000000000001200004801400030076657468315f6d61637674617000000008000140000000050900010073797a31000000000a000700726f7574650000000c00024000000000000000051800048014000300726f73653000000000000000000000001c000000050a010400000000000000000200000608000b400000000230000000020a0002000000000000000007000007080002400000000508000240000000010c00044000000000000000021c000000020a0104000000000000000001000008080002400000000178000000030a0103000000000000000001000001400008800c00024000000000000000050c00024000000000000000070c00024000000000000000000c00024000000000000000030c000140000000000000000608000b40000000030900010073797a3100"], 0x308}}, 0x0) setsockopt$inet_sctp6_SCTP_DEFAULT_PRINFO(r3, 0x84, 0x72, &(0x7f00000003c0)={r6, 0x0, 0x208a27a000009eab}, 0xc) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) r9 = socket$nl_rdma(0x10, 0x3, 0x14) sendmsg$RDMA_NLDEV_CMD_STAT_SET(r9, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000280)=ANY=[@ANYBLOB="38000000101401002cbd7000fedbdf25080001000100000008001580"], 0x38}, 0x1, 0x0, 0x0, 0x4000}, 0x4000c014) sendmsg$nl_route_sched(r1, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0x25dfdbfd, {0x0, 0x0, 0x0, r8, {0x0, 0xfff1}, {0xffff, 0xffff}, {0x0, 0xf}}, [@qdisc_kind_options=@q_multiq={{0xb}, {0x8, 0x2, {0x42}}}]}, 0x38}}, 0x0) socket$nl_route(0x10, 0x3, 0x0) r10 = socket$nl_xfrm(0x10, 0x3, 0x6) r11 = socket$nl_generic(0x10, 0x3, 0x10) r12 = syz_genetlink_get_family_id$tipc(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$TIPC_CMD_ENABLE_BEARER(r11, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000480)={&(0x7f00000006c0)=ANY=[@ANYBLOB='8\x00\x00\x00', @ANYRES16=r12, @ANYBLOB="010027fcdbdf25010000000000000001410000000300170000000e0000000669623a7465616d5f736c6176655f30010000005300db096113fc1fa0bdb0fd14100cd988cd9b9f8f96722c1e7b23703f7a1ea80cfff6"], 0x38}, 0x1, 0x0, 0x0, 0x4000}, 0x800) sendmsg$nl_xfrm(r10, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000540)=ANY=[@ANYBLOB="38010000100001000200f8fffedbdf25e000000100000000000000000000000020010000000000000000000000000000000107144e230005000010003a000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="e0000002000000000000000000000000000004d46c00000000000000000000000000ffffac1e0001000000000000000092010000000000003affffffffffffff00000000000000001c250800000000000200000000000000f8ffffffffffffff7c232e0e00000000090000000000000000000000000000001f00000002000000feffffffffffffff02000000fcffffffff0f00002abd700004350000020001000000000000000000480003006465666c61746500000000000100"/240], 0x138}, 0x1, 0x0, 0x0, 0x8801}, 0x0) r13 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r13, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000280)=ANY=[@ANYRESOCT=r13, @ANYRES32=r0, @ANYBLOB="1179432887268529638ea2432430e34bd9f2515f956502f97b7d71c18b4dfd3f9c5f11e0867c47caafd31b0a746cf03c25ce67b8cdfb74a5de183a212dfe90a0bbbf59b83186602676c5020d28b6788fe09b30e9b395d4567b035ab18a5e41a0f5cadca007cbbfcb648727081a00cc05481e2bc2d0d48ebe8d412bfa832a6f732c2b2e8f0b3067d260272c293734c2c871fa42c42b8f156a64da48fa1a2142327d65afd9337a47f4bbaf2df43fd568f5d6a2edc8c87154e19594e8d3580636f7be15f1cd261e94d0cd0977c74178e6e433e2cbb366882a04bdceca75b995c441c1add1708a3fbddd067a670b96e885a7caa28c4b00c77c0690587004921294", @ANYRES64=0x0], 0x3c}}, 0x0) r14 = socket$kcm(0x1e, 0x1, 0x0) recvmmsg(r14, &(0x7f0000000140)=[{{0x0, 0x0, &(0x7f0000000ac0)=[{&(0x7f0000000180)=""/123, 0x7b}], 0x1}, 0x101}], 0x1, 0x10020, 0x0) r15 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$inet(r15, &(0x7f0000000940)={&(0x7f0000000000)={0x2, 0x4e24, @rand_addr=0x64010101}, 0x10, &(0x7f0000000800)=[{&(0x7f0000000040)="c187f7deba90c0357b31d03793f366f7810d9b78be3edf1fc7837ced663b24264c809ef41deef96321e8e2ab6fa315374c2ed305bce128ecc6c64f976a252db5d6b401571c2fbf941ce0c3bef9f62e3ff168d8feb53f5b21b8d1f7e4", 0x5c}, {&(0x7f0000000e00)="c38e6c39ddc836cc17efd1e5c3fe07eae40dff65ae175b7705dd8be6419f1be9a269485d7ec83d017bafe87af0ba827c8d1d2e2c609e3aef5d4ebe08046f0aa2630348e545d3b7c2362cc83096cbf8df8218bf508bd662de381ed5a3d516c0d1369cfdcb5e6dd1bdca607a2c581719cdea1b8d402a0d10603be1d2d1fa384b70fdf6e37dfb1da75f6a357465c98c12413197244ba3af489634474a85", 0x9c}, {&(0x7f0000000200)="8d5062dab388d3b0cb092f168126808ca1f0971aedb775180b1bb5330514b371f9079925d9fc4e1156b57049b52aec2a6016ffb7f2120d745899204650febe52d62e114facfd524978ad37e1e6b363da9bc6935954f6ee3d96ce5116bfc2152bf6feeeff543cb7d8e350eab005d092b5f7c72cb725c537536d4cd5c977d96e51d089686fabab9bc33514300c128a13a3cb34d042435f31a24c7faa", 0x9b}, {&(0x7f00000002c0)="66370068b2b5a910f4817f2fbce838c2c1424792f1162020", 0x18}, {&(0x7f0000000300)="378f8e8d3cde0c626f33352acee36b60cc7adac229383ca0b0b038ba41f712452c6e361cf7fe7bd3c1984c636bd2a5c61fcd8224f069cb85c6834fd7d63fa25d3775d0111a575f15b59e416f48dae9a0937f3522f0249464f053faefbe5b77f2b8a8b4efb8312784ff84c3bb288170b9dbfb27d6d2d3933611f0b1f80b6659efd4782d", 0x83}, {&(0x7f0000000440)="6230bce4112b9844a87aed6a4ec2d73f92c5e57fa24d766a8f51563ab5fe21f075365c4d8a380e87ae731100214e52b67b22770b8977137b97f7aad4669e6b0bb7dc44484bab43b330b78f35b875e77c83881cb83b75678dc3affcdb7fa37daf4059a1e8d29a5f8ff036685f6d923a0f9576f1d08bb45f504fa23800b4ccb8ce5e05d5fe2af3e957d0b5730974518c44c9f16f6f98e4422a5b703d57601b614422de09f80eb6837ff98df515e927d779", 0xb0}, {&(0x7f0000000580)="efc5ac01a6c10314ded58793fb0c2e880f6995ab8d01d989ffa567dc1337e12e75efcd45abb921bf69230a38b1f6cb00ed1e595c8f18415333d50c06d2ff119f8dc5eec839e2ab9aaecc210f1e44912df46eac16b3c5c32448ddf77303f294c8e030b4dbe0daddc137f041aa72cde228bf332b20273598806cbbdb7fae9166ce763a42ad2693ca2845063602c4b082bc9ce486c624d14d68f489908b966ccddcfb3b5db9b80bcad7d585b6343952b19a6c6539c7b10571e7dec13307574a07ecfb3dc8889d26bf887f1e30a765059364f125c76c38339f8de805845f6e0008000024f02b3dc51d8a3d16ebd6d7862719b4", 0xf1}, {&(0x7f0000000740)="066070a1496aea2f051056af4c3b6ee725cb7837c956028d0e7ae3bca798d6a08325f1bffd179748d5429e209f2f8a9949113968178de246e975a71564a0bdb0b00b859b992b4c437551a67c39a860516ed545b08950cd0b82a5c0aaebf030c06dff01791dd2bd8bdaa30b157ccc45ecb810fd38f55af84fd318a8330a5078", 0x7f}, {&(0x7f00000007c0)}], 0x9, &(0x7f00000008c0)=[@ip_ttl={{0x14, 0x0, 0x2, 0xf}}, @ip_tos_u8={{0x11, 0x0, 0x1, 0xfb}}, @ip_tos_u8={{0x11, 0x0, 0x1, 0x5}}, @ip_ttl={{0xe, 0x0, 0x2, 0x5}}], 0x60}, 0x4040000) sendmsg$nl_route_sched(r1, &(0x7f0000000000)={0x0, 0xffffffaa, &(0x7f0000000140)={&(0x7f00000001c0)=@newtfilter={0x38, 0x2c, 0xd27, 0x70bd26, 0x25dfdbfc, {0x0, 0x0, 0x0, r8, {0x4}, {}, {0xc, 0x2}}, [@filter_kind_options=@f_matchall={{0xd}, {0x4}}]}, 0x38}, 0x1, 0x0, 0x0, 0x8848}, 0x80) socket$nl_netfilter(0x10, 0x3, 0xc) 534.316784ms ago: executing program 2 (id=1715): r0 = socket(0xa, 0x3, 0x3a) setsockopt$MRT6_DEL_MIF(r0, 0x29, 0xc8, 0x0, 0xc000000) r1 = bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000880)={&(0x7f0000000080)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0x24, 0x24, 0x2, [@func_proto={0x0, 0x0, 0x0, 0x2, 0x3}, @const={0x0, 0x0, 0x0, 0xb}, @volatile={0x0, 0x0, 0x0, 0x9, 0x2}]}}, 0x0, 0x3e}, 0x20) ioctl$XFS_IOC_ATTRLIST_BY_HANDLE(r1, 0x4058587a, &(0x7f0000000280)={{r1, &(0x7f0000000140)='snmp_trap\x00', 0x20000, &(0x7f0000000180)={@align=0xc3, {0x8, 0x6, 0xffffffc0, 0x27e6}}, 0x3, &(0x7f00000001c0), &(0x7f0000000200)=0x6}, {[0x2, 0x7fffffff, 0x8, 0x3]}, 0x59d, 0x39, &(0x7f0000000240)=""/57}) accept$alg(r2, 0x0, 0x0) bpf$MAP_LOOKUP_BATCH(0x18, &(0x7f0000000380)={&(0x7f0000000040)="b64b6779e728a585fc6d831c9c111ee3bf867c7fa20663508d961b5b0bc1d4eded804b84c8ee0b5e7b55af44aa8bf4a16c4d4aaf896a13f650a3b4f737945a9a179a6ceb93adadb8dd841258d0f04b02868cd415ab9bc48b055a8b3f92b143cb16138c216513a045af2101e7e3c507bedee404330f1171", 0x0, 0x0, 0x0}, 0x38) r3 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f00000000c0)={0x2, 0x4, 0x8, 0x1, 0x80, 0xffffffffffffffff, 0x0, '\x00', 0x0, 0xffffffffffffffff, 0xffffffff, 0xffffffff, 0xfffffffe}, 0x1b) r4 = epoll_create1(0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r6 = epoll_create1(0x0) pselect6(0x40, &(0x7f00000001c0)={0x7f, 0x0, 0x0, 0xbf1, 0x0, 0xffff7ffffffffffa, 0x8}, 0x0, 0x0, 0x0, 0x0) epoll_ctl$EPOLL_CTL_ADD(r6, 0x1, r4, 0x0) epoll_ctl$EPOLL_CTL_ADD(r4, 0x1, r5, &(0x7f0000000040)={0x2004}) bpf$MAP_LOOKUP_ELEM(0x5, &(0x7f00000000c0)={r3, &(0x7f0000000000), &(0x7f0000000040)=""/73}, 0x70) setsockopt$MRT6_ADD_MFC(r0, 0x29, 0xcc, &(0x7f0000000080)={{0xa, 0x4e21, 0x8, @private1, 0x4}, {0xa, 0x4e22, 0xdb2a, @empty, 0x20000000}, 0x1, {[0x4, 0x3, 0x8, 0x845b, 0x0, 0x6, 0x6, 0x4]}}, 0x5c) setsockopt$MRT6_ADD_MFC(r0, 0x29, 0xcc, &(0x7f0000000000)={{0xa, 0x0, 0x0, @local}, {0xa, 0x0, 0x0, @empty}}, 0x5c) write(0xca, &(0x7f0000000040)="0404e7", 0x3) setsockopt$MRT6_FLUSH(r0, 0x29, 0xd4, &(0x7f0000000100)=0x2, 0x4) r7 = socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt$IP6T_SO_SET_REPLACE(r7, 0x29, 0x40, &(0x7f00000028c0)=@raw={'raw\x00', 0x3c1, 0x3, 0x1340, 0x0, 0xc8, 0x8, 0x1270, 0x5803, 0x1270, 0x2e8, 0x2e8, 0x1270, 0x2e8, 0x3, 0x0, {[{{@uncond, 0x0, 0x1108, 0x1138, 0x0, {0x0, 0x2000000000000}, [@common=@ah={{0x30}, {[0x4d6, 0x3ff], 0x8, 0x5}}, @common=@unspec=@cgroup1={{0x1030}, {0x0, 0x0, 0x1, 0x0, './cgroup.cpu/syz1\x00', 0x0, {0xfffffffffffffffc}}}]}, @common=@inet=@SET2={0x30, 'SET\x00', 0x2, {{0x1, 0x3, 0x2}, {0x1, 0x2, 0x6}, 0xffc6, 0x5}}}, {{@uncond, 0x0, 0xd0, 0x138, 0x0, {}, [@inet=@rpfilter={{0x28}, {0xd72904966aae0e9f}}]}, @unspec=@CT2={0x68, 'CT\x00', 0x2, {0x0, 0x0, 0x0, 0x0, 'snmp_trap\x00', 'syz1\x00'}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x13a0) 518.976041ms ago: executing program 3 (id=1716): bpf$PROG_LOAD(0x5, &(0x7f0000000240)={0x3, 0x4, &(0x7f00000008c0)=ANY=[@ANYBLOB="b7050000000000006110480000000000dc0500002000000095000000000000009abb1723bf24203831c9545b21c751ee4024f479cbe4b89f9808837203000000000000c2d182c7a3221481f5009edaf5f5ac058299e10e790a198f42a715b99fb3d2a73dd025848710155ad1efd7d991408000000000000085a0db0401fa29e075b7ab0408a0d8cfceeb23465bb027ee1151c02af21d8f9aa57e673a6724441d08087aff070eda8abef22b3a806c8226f5a2886c93bd29b37252ba4a6e9cc5f69e75680c431aa855e487ae513abd6c4ee973fce29a26018ed5e0780f8778a602a3533a3dac7da4fe491edf3abfa7bf871c58848ac46ada6776bd9b85df01e626026a59ddfa7a9c879acbfb0bf426785dec7d8611dc850df49ed8633bdb83dd505fb20649f53841a0e200c91f5bf1bb186ed87efc7b6f8859d029c8376ca19265e281fea0a6fd2222f8850c8445758503ede0ce1b3f73ecd8989e8c53c5e679b13802bddf80f3b1d07d6d68bfa12ab34697d40ac1150a842f8bb381344b994c19642a10eb30845a993daaa8bd4aebc595475feb3475d8e802498382e73edb98fcf2df96ab3c870490c4"], &(0x7f00000002c0)='syzkaller\x00', 0x5, 0xc3, &(0x7f0000000300)=""/195, 0x0, 0x0, '\x00', 0x0, @sched_cls, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x8, 0x10, &(0x7f0000000080), 0x10}, 0x94) r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f00000001c0)=@ipv4_newroute={0x30, 0x18, 0x35f32a6dfa748ddd, 0x0, 0x0, {0x2, 0x10, 0x0, 0x0, 0xfe, 0x0, 0xac, 0x5}, [@RTA_ENCAP_TYPE={0x6, 0x15, 0xa}, @RTA_ENCAP={0xc, 0x16, 0x0, 0x1, @LWTUNNEL_IP_DST={0x8, 0x2, @rand_addr=0x64010100}}]}, 0x30}}, 0x0) sendmsg$nl_generic(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000040)=ANY=[@ANYBLOB="4433000041000701fefffffffeffffff017c0000040042800c00018006000600800a0000203302801c3317800400150004008b80080086800400b2800633", @ANYRES8=r1], 0x3344}, 0x1, 0x0, 0x0, 0x4040044}, 0xc000) r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$netlbl_calipso(&(0x7f0000000140), r3) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f00000001c0)={'netdevsim0\x00', &(0x7f0000000000)=@ethtool_pauseparam={0x13, 0x0, 0xfffffffc}}) r5 = socket$nl_route(0x10, 0x3, 0x0) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r5, 0x8933, &(0x7f0000000040)={'batadv_slave_0\x00', 0x0}) sendmsg$nl_route(r5, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=@ipv4_newaddr={0x48, 0x14, 0x509, 0x8070bd28, 0xfffffffa, {0x2, 0x38, 0x1ef, 0x0, r6}, [@IFA_ADDRESS={0x8, 0x1, @broadcast}, @IFA_BROADCAST={0x8, 0x4, @rand_addr=0x64000100}, @IFA_LOCAL={0x8, 0x2, @loopback}, @IFA_BROADCAST={0x8, 0x4, @broadcast}, @IFA_TARGET_NETNSID={0x8, 0xa, 0x4}, @IFA_LOCAL={0x8, 0x2, @broadcast}]}, 0x48}, 0x1, 0x0, 0x0, 0x871ac4b32833d133}, 0x4890) r7 = socket$nl_route(0x10, 0x3, 0x0) r8 = socket$nl_generic(0x10, 0x3, 0x10) r9 = socket$nl_generic(0x10, 0x3, 0x10) r10 = syz_genetlink_get_family_id$fou(&(0x7f0000000200), 0xffffffffffffffff) sendmsg$FOU_CMD_ADD(r9, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000040)={0x24, r10, 0x209, 0x0, 0x0, {}, [@FOU_ATTR_TYPE={0x5, 0x4, 0x2}, @FOU_ATTR_PORT={0x6, 0x1, 0x4e20}]}, 0x24}, 0x1, 0x0, 0x0, 0x200000d1}, 0x0) sendmsg$FOU_CMD_GET(r8, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000600)={&(0x7f00000001c0)=ANY=[@ANYBLOB="01010000", @ANYRES16=r10, @ANYBLOB="010029bd7000fddbdf2503000000060001004e200000"], 0x1c}, 0x1, 0x0, 0x0, 0x20000801}, 0x840) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(0xffffffffffffffff, 0x8933, &(0x7f0000000040)={'batadv_slave_1\x00'}) sendmsg$nl_route(r7, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000000)=ANY=[], 0x70}}, 0x20008084) sendmsg$NLBL_CALIPSO_C_ADD(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000140)={0x24, r4, 0x125, 0x0, 0x0, {}, [@NLBL_CALIPSO_A_MTYPE={0x8}, @NLBL_CALIPSO_A_DOI={0x8, 0x1, 0x3}]}, 0x24}}, 0x0) r11 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r12 = syz_genetlink_get_family_id$netlbl_calipso(&(0x7f00000000c0), r11) sendmsg$NLBL_CALIPSO_C_LISTALL(r11, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000100)=ANY=[@ANYBLOB="1400bdae0000", @ANYRES16=r12, @ANYBLOB="65572abd7000f9dbdf2504000000"], 0x14}, 0x1, 0x0, 0x0, 0x80}, 0x24004052) sendmsg$NLBL_CALIPSO_C_ADD(r3, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000280)=ANY=[@ANYBLOB='$\x00\x00\x00', @ANYRES16=r4, @ANYBLOB="01002bbd7000fedbdf2501000000080002000200002d0800010001000000"], 0x24}, 0x1, 0x0, 0x0, 0x24000000}, 0x20000010) syz_genetlink_get_family_id$nl802154(&(0x7f0000000200), r11) r13 = epoll_create1(0x80000) writev(r13, &(0x7f00000006c0)=[{&(0x7f00000003c0)="bd6c95680415804c12f404644642", 0xe}, {&(0x7f0000000540)="eac2c1a7ba26ae3b9fbb297eaa478e40c5142794c995aee00b896b7ac1ebe21af192e38afc5a6f839a394fab18192f0534aa936642fe04eb1537da789405922260d5f56d22c048e692323a4a9fb03058b5f1ff1467d316b1f6fbe8bc50e9a4135b359e6f6af56091f4473698101bde0924a51a1d6e95e009c4cbd2b5709677f45614ba91bd286012bf7d63505e4bc027d9469f103b", 0x95}, {&(0x7f0000000600)="d34b44e380", 0x5}, {&(0x7f0000000640)="8a356ea1cf6083c9eac50e12c770005af66175ddebbd095731c49c6d3986d51e5074af9dbcd77d70edc4e14a0c255357e5a8ec3d7819987178f0b631a53f3a7afd2e73b63e8a6a79fa42bbb77bcb2856af6098bf793589e6ef9cfde85ce21bf1e69bdd105e", 0x65}], 0x4) accept4(0xffffffffffffffff, 0x0, &(0x7f0000000000), 0x80000) socket$nl_generic(0x10, 0x3, 0x10) 236.898008ms ago: executing program 4 (id=1717): r0 = syz_init_net_socket$802154_raw(0x24, 0x3, 0x0) recvmmsg(r0, &(0x7f00000005c0)=[{{0x0, 0x0, 0x0}, 0x3}, {{0x0, 0x0, 0x0}, 0x5}], 0x2, 0x122, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000140)=ANY=[@ANYBLOB="38000000120005ff00000000000080000000004a", @ANYRES32=0x0, @ANYBLOB="2482000000000000180012800e00010077697265677561726400000004000280"], 0x38}}, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000140)={0x6, 0x3, &(0x7f0000000680)=ANY=[@ANYBLOB="1800000002000000000000000000000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x1}, 0x94) bpf$PROG_LOAD(0x5, &(0x7f0000000780)={0x6, 0xc, &(0x7f0000000080)=@framed={{0x18, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, [@ringbuf_output={{}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0x4}, {}, {}, {}, {}, {0x7, 0x0, 0xb, 0x4, 0x0, 0x0, 0x2}}]}, &(0x7f00000001c0)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x94) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) listen(r2, 0x0) r3 = bpf$MAP_CREATE(0x0, &(0x7f00000023c0)=ANY=[@ANYBLOB="1200000004000000080000000b"], 0x48) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000500)={r3, &(0x7f0000000240), &(0x7f00000004c0)=@tcp6=r2}, 0x20) r4 = socket$nl_route(0x10, 0x3, 0x0) r5 = socket$inet6(0xa, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f00000000c0)={'veth0_macvtap\x00', 0x0}) sendmsg$nl_route_sched(r4, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000280)=@newtfilter={0x2c, 0x11, 0x2, 0x70bd2d, 0x25dfdbfd, {0x0, 0x0, 0x74, r6, {0x4, 0xfff2}, {0x3, 0xd}, {0x8, 0x2}}, [@TCA_RATE={0x6, 0x5, {0x6, 0x6}}]}, 0x2c}, 0x1, 0xf0ffffffffffff, 0x0, 0x1c005}, 0x24048004) r7 = bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000a40)={&(0x7f0000000d00)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0xac, 0xac, 0x5, [@func_proto={0x0, 0x6, 0x0, 0xd, 0x0, [{0x5, 0x2}, {0x2, 0x3}, {0x6, 0x2}, {0x4, 0x5}, {0x1}, {0xd, 0x4}]}, @decl_tag={0xe, 0x0, 0x0, 0x11, 0x3, 0x1}, @fwd={0x8}, @typedef={0xc, 0x0, 0x0, 0x8, 0x4}, @struct={0x8, 0x5, 0x0, 0x4, 0x0, 0x10, [{0xa, 0x1, 0x81}, {0x3, 0x5}, {0x8, 0x1, 0xe34b}, {0x4, 0x5, 0x5}, {0x5, 0x5, 0x5}]}]}, {0x0, [0x0, 0x2e, 0x2e]}}, &(0x7f0000000a00)=""/59, 0xc9, 0x3b, 0x0, 0x4}, 0x28) r8 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f0000000b00)=ANY=[@ANYBLOB="1b00000000000000000000000700000000000000", @ANYRES32, @ANYBLOB="0600"/20, @ANYRES32=0x0, @ANYRES32, @ANYBLOB="00000000010000000500ff1500000000000000000000001400000000"], 0x50) r9 = bpf$OBJ_GET_MAP(0x7, &(0x7f0000000bc0)=@generic={&(0x7f0000000b80)='./file0\x00', 0x0, 0x10}, 0x18) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000c40)={0x11, 0x1c, &(0x7f00000006c0)=ANY=[@ANYBLOB="180000008c090000000000000d00000018110000", @ANYRES32, @ANYBLOB="0000000000000000b702000014000000b7030000000000008500000083000000bf090000000000005509010000000000950000000000000018110000", @ANYRES32=r3, @ANYBLOB="0000000000000000b7080000070000007b8af8ff00000000bfa201000000000007020000f8ffffffb703000008000000b70400000200000085000000820000001800000005000000000000008e050000185b0000100000000000000000000000bf91000000000000b70200000100e8008500000085000000b7000000000000009500000000000000"], &(0x7f0000000880)='GPL\x00', 0x5, 0x3c, &(0x7f00000008c0)=""/60, 0x41000, 0x20, '\x00', r6, 0x0, r7, 0x8, &(0x7f0000000a80)={0x2, 0x5}, 0x8, 0x10, &(0x7f0000000ac0)={0x4, 0x7, 0x6, 0x1}, 0x10, 0x0, 0x0, 0x0, &(0x7f0000000c00)=[r8, r9], 0x0, 0x10, 0x5a}, 0x94) bpf$PROG_LOAD_XDP(0x5, &(0x7f00000007c0)={0x6, 0x3, &(0x7f0000000680)=ANY=[], &(0x7f00000002c0)='GPL\x00'}, 0x94) r10 = socket$inet_icmp_raw(0x2, 0x3, 0x1) connect$inet(r10, &(0x7f0000000080)={0x2, 0x0, @empty}, 0x10) r11 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r11, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000100)=@newlink={0x28, 0x10, 0x1, 0x70bd25, 0x25dfdbf9, {0x0, 0x0, 0x0, 0x0, 0x48815, 0x50103}, [@IFLA_GROUP={0x8}]}, 0x28}, 0x1, 0x0, 0x0, 0x40801}, 0x4000000) r12 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000001c0)=ANY=[@ANYBLOB="14000000100004f2ff000000000000000000000a14000000000a010200906c7ff522ff4e000000000000001700000014000000042001000000000000"], 0x3c}, 0x1, 0x0, 0x0, 0x24048044}, 0x0) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000440)=[{0x0}], 0x1}, 0x4005) sendmsg$nl_generic(r12, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000001c0)=ANY=[@ANYBLOB="30000000410007012bbd700000000000047c00000400c2800c0001800600060086dd00000c0007"], 0x30}, 0x1, 0x0, 0x0, 0x4048011}, 0xc000) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000080)={0x1, 0x3, &(0x7f0000000000)=@framed={{0x18, 0x0, 0x0, 0x0, 0x30}}, &(0x7f00000002c0)='GPL\x00', 0xf}, 0x94) syz_genetlink_get_family_id$gtp(&(0x7f00000003c0), 0xffffffffffffffff) 135.954534ms ago: executing program 2 (id=1718): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x0) (async) socket$nl_generic(0x10, 0x3, 0x10) (async) socket$inet6_tcp(0xa, 0x1, 0x0) (async) r1 = socket$nl_generic(0x10, 0x3, 0x10) (async) r2 = bpf$ITER_CREATE(0xb, &(0x7f0000000100), 0x0) (async) close(0xffffffffffffffff) (async) r3 = socket$kcm(0x29, 0x5, 0x0) (async) r4 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='blkio.bfq.io_service_time_recursive\x00', 0x275a, 0x0) write$cgroup_int(r4, &(0x7f0000000000), 0xffffff6a) r5 = socket$kcm(0x29, 0x5, 0x0) sendmsg$kcm(r5, &(0x7f0000000280)={0x0, 0xffe4, &(0x7f0000000ac0)=[{&(0x7f0000000b00)="b6bd7e4983a45b31f79d80060400000000000000a33734d88229acf96457ad59d0b87f8659b614043e3d21a7cacecab8bbd26251b93b28b4d83e618673f9c74d0a28a5146c5511549fa617e908352c87d8ddff2ce042a1e58eb7b63759cab3526dd8ae1566ddcfb5fa83e8b2940b3ed1b8", 0x71}, {&(0x7f0000000880)="3aa854", 0x3}, {&(0x7f0000000a40)="746b9120a32aaf78043a9b07000000000000003c44", 0xfffffe16}], 0x3}, 0xc854) (async) setsockopt$sock_int(r5, 0x1, 0x12, &(0x7f0000000180)=0x4c, 0x4) r6 = syz_genetlink_get_family_id$nl80211(&(0x7f00000000c0), r2) (async) sendfile(r3, r4, 0x0, 0xffffffff000) (async) r7 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$NL80211_CMD_GET_PROTOCOL_FEATURES(r4, &(0x7f0000000240)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x400}, 0xc, &(0x7f0000000200)={&(0x7f00000001c0)={0x14, r6, 0x0, 0x70bd2c, 0x25dfdbfd}, 0x14}, 0x1, 0x0, 0x0, 0x44010}, 0x40000) sendmsg$NL80211_CMD_RELOAD_REGDB(r1, &(0x7f00000006c0)={0x0, 0x0, &(0x7f0000000440)={&(0x7f0000000380)={0x14, r7, 0x1, 0x70bd2d, 0x25dfdbfe}, 0x14}, 0x1, 0x0, 0x0, 0x20000000}, 0x20008004) r8 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r8, &(0x7f0000000400)={0x2, 0x4e21, @private=0xa0100ff}, 0x10) (async) connect$inet(r8, &(0x7f0000000180)={0x2, 0x4e21, @dev={0xac, 0x14, 0x14, 0x1b}}, 0x10) sendto$inet(r8, &(0x7f0000000000), 0xffffffffffffff94, 0x0, 0x0, 0x0) (async) setsockopt$inet_tcp_TCP_CONGESTION(r8, 0x6, 0xd, &(0x7f00000000c0)='bbr', 0x3) (async) recvfrom$inet(r8, &(0x7f0000000080)=""/8, 0xfffffffffffffd0b, 0x720, 0x0, 0xfffffffffffffd25) (async) ioctl$AUTOFS_IOC_CATATONIC(r1, 0x9362, 0x0) socket$inet_sctp(0x2, 0x1, 0x84) sendmsg$nl_route(r2, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000080)={0x0}, 0x1, 0x0, 0x0, 0x10}, 0x4000000) (async) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000001980)={&(0x7f0000000040)=@newchain={0x24, 0x64, 0x300, 0x70bd2c, 0x25dfdbfe, {0x0, 0x0, 0x0, 0x0, {0x2, 0xfff2}, {0xfff3, 0xfff3}, {0xa, 0x1ffe4}}}, 0x44}, 0x1, 0x0, 0x0, 0x404c040}, 0x0) (async) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000003c0)=ANY=[@ANYBLOB="440000001000010800"/20, @ANYRESDEC=r1, @ANYRESHEX=r8], 0x44}}, 0x0) socket$netlink(0x10, 0x3, 0x0) 55.329966ms ago: executing program 0 (id=1719): sendmsg$ETHTOOL_MSG_FEATURES_SET(0xffffffffffffffff, 0x0, 0x0) r0 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_int(r0, 0x107, 0xf, &(0x7f0000000100)=0x207, 0x4) r1 = socket$packet(0x11, 0x3, 0x300) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000300)={'ip6gre0\x00', 0x0}) sendto$packet(r0, &(0x7f00000002c0), 0x0, 0x4, &(0x7f0000000140)={0x11, 0x86dd, r2, 0x1, 0x0, 0x6, @multicast}, 0x14) recvmmsg(r1, &(0x7f0000000780)=[{{0x0, 0x0, &(0x7f0000000680)=[{&(0x7f00000005c0)=""/174, 0xae}], 0x1}, 0xffffffff}], 0x1, 0x22, 0x0) 5.709687ms ago: executing program 1 (id=1720): r0 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000580), 0xffffffffffffffff) r1 = socket$inet6(0xa, 0x2, 0x0) bind$inet6(r1, &(0x7f0000000040)={0xa, 0xe22}, 0x1c) r2 = socket$netlink(0x10, 0x3, 0x8000000004) writev(r2, &(0x7f0000001200)=[{&(0x7f0000000080)="580000001400add427323b472545b45602117fffffff810000400e227f000001925aa80020007b00090080007f000006e809000000ff0000e03ac71002000000ffffffff0000000200"/88, 0x58}], 0x1) r3 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL80211_CMD_SET_TID_CONFIG(r3, &(0x7f0000000680)={0x0, 0x0, &(0x7f0000000540)={&(0x7f0000000340)=ANY=[@ANYBLOB=' \x00\x00\x00', @ANYRES16=r0, @ANYBLOB="495300000000000000006700000008000300", @ANYRES32=0x0, @ANYBLOB="04003c0119"], 0x20}}, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) r4 = bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0xe, 0x4, &(0x7f0000000940)=ANY=[@ANYBLOB="b4050000200080066110000000000000c6000000000000009500d800000000009f33ef60916e55893f1eeb0b2ae13d922e6235592ce847e2566c43d72918a897323fd0723043c47c896ce0bce66a245ad9d6817fd98cd824498949714ffaac8a6f77ef0000ca5d82054d54d53cd2b6db714e75d9bdae214fa68a0557eb2c5ca683a4b6fcfcff0bffffffffffd47042eaebfa6fa26fa7a347c7faa8e700458c60897d4a6148a1c11428427c40de60beacf871ab5c2ff88a02084e5b5271e45f00003826fb8579c1fb01d2c5553d2ccb5fc5b51fe6b174ebd9907dcff414ed55b0c20cdbe7009a6fe7cc78762f1d4dcdbca64920db9a50f86c21632f7a4bd344e0bd74ff05d37ef68e3b9db863c758ffffffffabe90ac5d08dd9d4e0359c41cf3626e1230bc1cd4c02c460ceb44276e9bd94d1c2e6d17dc5c2edf332a62f5fe68fbbbbfcfd00000000000fbf940e6652d357474ed5f816f66ac3027460ae66317f83cdd7a7eb2a7003d1a6cf5478533584961c329fcf5a43e05c92bfef0dcd28000000003f2915a3039c9a78f63b8ec7e60a0000fed7d67c440e23d130e51eea1e085bebabe7059de9cbfc5117c024185a062acb6b8eec31c21b3af8b9eedb4660ed2deb7acf2a33a376a5cb7d4266d5b0be14488d14b473502486ad8dd600000000000000000000c7766ea7c581782c0d90f42a85303835fc291c25d29e6bead5d7360f2e1929d7736ebc8558c4506407d3046022bdf25485bd5442169e9b4c1278343581b7a06f65e8ea6b042c4fd08381e5000000000000006398d6480000001a723b91030000006480304c66b217aea0156ce9eef911fe5b7370f79987303ecb3aabc53c60014a0101ab766754f596b41da9534d12b8306a1b36cf3b03f0d790879f523eabfbee83d8bd472ef69660cf6ec897106c51e54a17497f384c4956b41f3843e7c878b1e11316d8ddae1c6c3b85aaf7a9fcaf8f5d6186c42542d68ba72682c938d3c0a2e6e10eed71b1d31c9f300b41745329bf34495c63e43fb896e4903fb0fae54a8f0fe3b48a5b29d279070647e65097c8ecf32a15080000000000000001007ba4a70a084bd994ac5e00000000000000000000000000351a30cd97f83d72631d0fe92efa974a53f4dc1eb9a86df632a6d463688123f64d42a919bcfc44a90ffd680200000091f842a91c977f6075d07e39e669b0713af0498a99bf5261cb3269d499a5202d7a08b33ade7b38829b9bd39619688d5e9af22170ef83e5b92cbb32b655c45de1c154aad81bf64351668a3f76d5afa958aff76249e0ffdf8e45155536a1a44bfcbfbfd232af000052f9002a"], &(0x7f0000003ff6)='GPL\x00', 0x4, 0xfd90, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @sk_skb, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x366, 0x10, &(0x7f0000000000), 0x1dd}, 0x48) r5 = bpf$MAP_CREATE(0x0, &(0x7f00000005c0)=@base={0x12, 0x4, 0x4, 0x12}, 0x50) bpf$BPF_PROG_DETACH(0x8, &(0x7f0000000080)=ANY=[@ANYRES32=r5, @ANYRES32=r4, @ANYBLOB="05"], 0x10) close(r4) r6 = socket(0x28, 0x5, 0x0) r7 = socket(0x28, 0x5, 0x0) bind$vsock_stream(r7, &(0x7f0000000040)={0x28, 0x0, 0x0, @local}, 0x10) listen(r7, 0x1) connect$vsock_stream(r6, &(0x7f0000000080)={0x28, 0x0, 0x0, @local}, 0x10) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000580)={{r5}, &(0x7f0000000500), &(0x7f0000000540)=r4}, 0x20) r8 = accept4$x25(r7, &(0x7f0000000180)={0x9, @remote}, &(0x7f0000000280)=0x12, 0x800) sendmsg$inet(r8, &(0x7f0000000700)={0x0, 0x0, &(0x7f0000000440)=[{&(0x7f00000002c0)="4b86f13f4ab288cf9ef62b32ba303f34e6da2e1bd05718757f018b06e1784ea43265bc050a21ea992f277ef9c97be7a4dc4e6f283a30a934d793d234ad26e3872fd7568ab4c19ae7339b7911c9915f31add3e048cbf0cdfd", 0x58}, {&(0x7f0000000340)="b81ceb61760c9d6460ef34403bdd6b4b0d88d35a91b73258a924d10524dfac691aa6d920e88f2c3f913cc69ad1299b9c4bea78951bb54517b682f6da4703bce8d8fb47b12d5584a29b4315e8b923f81a9fcdd0049c6e3c3166eed607f03476cb557160d33084d22d0a5ad12971114cae6e4a25c57a", 0x75}, {&(0x7f00000003c0)="2693e2d35973846b4f76b225568661f5ff066d1236625dafe6b629ee2aedde103df40dca70f2c5b3", 0x28}], 0x3, &(0x7f0000000640)=[@ip_retopts={{0x38, 0x0, 0x7, {[@timestamp_addr={0x44, 0x24, 0xe6, 0x1, 0x9, [{@private=0xa010102, 0x8000}, {@empty}, {@multicast2, 0x8}, {@local, 0x3}]}, @ssrr={0x89, 0x3, 0xfe}, @end]}}}, @ip_tos_u8={{0x11, 0x0, 0x1, 0x5}}, @ip_pktinfo={{0x1c, 0x0, 0x8, {0x0, @private=0xa010100, @loopback}}}, @ip_pktinfo={{0x1c, 0x0, 0x8, {0x0, @private=0xa010101, @remote}}}], 0x90}, 0x6040) close(0x3) bpf$MAP_CREATE(0x0, &(0x7f0000000840)=ANY=[@ANYBLOB="230000000300000002000000ffff000005"], 0x48) r9 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r9, 0x0, 0x0) r10 = socket$tipc(0x1e, 0x2, 0x0) bind$tipc(r10, &(0x7f0000000140)=@name={0x1e, 0x2, 0x0, {{0x42}}}, 0x10) bind$tipc(r10, &(0x7f00000001c0)=@nameseq={0x1e, 0x1, 0x3, {0x42, 0x2, 0xffffffff}}, 0x10) setsockopt$TIPC_GROUP_JOIN(r10, 0x10f, 0x87, &(0x7f0000000100)={0x42, 0x2, 0x2}, 0x10) r11 = socket$tipc(0x1e, 0x2, 0x0) bind$tipc(r11, &(0x7f0000000100)=@name={0x1e, 0x2, 0x0, {{0x42, 0x20000003}}}, 0x10) 0s ago: executing program 3 (id=1721): r0 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$ARPT_SO_SET_REPLACE(r0, 0x0, 0x60, &(0x7f0000000140)={'filter\x00', 0x7, 0x4, 0x3c0, 0x1f0, 0x1f0, 0x0, 0x108, 0x2d8, 0x2d8, 0x4, 0x0, {[{{@uncond, 0xc0, 0x108}, @unspec=@LED={0x48, 'LED\x00', 0x0, {'syz1\x00'}}}, {{@uncond, 0xc0, 0xe8, 0x0, {0xa00}}, @unspec=@STANDARD={0x28, '\x00', 0x0, 0xffffffffffffffff}}, {{@uncond, 0xc0, 0xe8}, @unspec=@NFQUEUE2={0x28}}], {{'\x00', 0xc0, 0xe8}, {0x28}}}}, 0x447) (async) r1 = socket$nl_route(0x10, 0x3, 0x0) (async) r2 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r2, 0x8933, &(0x7f0000000000)={'batadv0\x00', 0x0}) (async) r4 = syz_genetlink_get_family_id$batadv(&(0x7f0000000080), r2) sendmsg$BATADV_CMD_GET_MCAST_FLAGS(r2, &(0x7f0000000240)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000640)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r4, @ANYBLOB="f5af24bd7000000000000e00000008000300", @ANYRES32=r3], 0x1c}, 0x1, 0x0, 0x0, 0x200000d0}, 0x0) (async) r5 = syz_genetlink_get_family_id$devlink(&(0x7f00000000c0), 0xffffffffffffffff) (async, rerun: 64) socket$netlink(0x10, 0x3, 0xc) (async, rerun: 64) r6 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000100)='memory.events\x00', 0x275a, 0x0) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0xc, 0x80010, r6, 0x1000) r7 = syz_init_net_socket$bt_rfcomm(0x1f, 0x1, 0x3) setsockopt$bt_BT_SECURITY(r7, 0x112, 0x4, &(0x7f0000000040)={0x80, 0xde}, 0x2) (async) r8 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) ioctl$TUNSETIFF(r8, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x6bf1c2d5adba8c32}) r9 = socket$kcm(0x2, 0xa, 0x2) ioctl$SIOCSIFHWADDR(r9, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x1}}) (async) writev(r8, &(0x7f00000002c0)=[{&(0x7f0000000080)="2e9b3d0007e03dd65193dfb6c575963f86ddf06712e960272f8db0049d90491ceaebfd26d4eef23248000000f858dbb8a1905234", 0x34}, {&(0x7f0000000100)="051a0000", 0x4}, {&(0x7f0000000200)="73ec500447db", 0x6}], 0x3) (async) sendmsg$DEVLINK_CMD_PORT_GET(r2, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000440)={&(0x7f00000004c0)=ANY=[@ANYBLOB="01000000", @ANYRES16=r5, @ANYBLOB="01002bbd700000000000350000000e0001006e657464657673696d0000000f0002006e657464657673696d3000000800730002000000"], 0x3c}}, 0x0) (async) r10 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r6, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000b40)=ANY=[@ANYBLOB="fc0000590097034f0100bc3a0010000100feffffdf2500000000000000000000000000000000fe88ba1af11391e2efbe000000000101000103944e2300050000", @ANYRESOCT=r9, @ANYRES16, @ANYBLOB="ff02000000000e0000000000000000030000000000000000ac1414bb47e90000200000000000000000000000000000000900000000132d0be6b2d6b2029fd0bae2b460c4000000ffff0000000000001c250800000000000200000000000000f8ffffffffffffff020000000000007cf80000000000000000000000e8d2fff88d0e0385b46bca000000001f00000000000000ff0100000000000002000000fcffffff400002002abd7000043500000a0001fd2000", @ANYRES8=r0], 0xfc}, 0x1, 0x0, 0x0, 0x81}, 0x4014) (async, rerun: 32) r11 = socket$nl_xfrm(0x10, 0x3, 0x6) (rerun: 32) sendmsg$nl_xfrm(r11, &(0x7f0000000680)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000940)=ANY=[@ANYRESHEX=r11, @ANYRES32=0x0, @ANYRES32=r10, @ANYBLOB="ff020000000000000000000000000001000004d46c000000ac1414bb000000000000000000000000000000000000000092010000000000000600000000000000ffff0000000000001c250800000000000200000000000000f8ffffffffffffff000000000b000000ffffffffffffffff00000000000000000900000000000000feffffffffffffff02000000fcffffff000000002abd7000043500000a0001002000000000000000480003006465666c61746500"/240, @ANYBLOB="571f41ecc8d193948022f556e40674a631875ee41096ea087bedbee45cbc8639ab40e77be07dcf2da00357e68059ea442ca8f2bd62fef3b55521f8f9df4e61c91a5d8ac6c4276a57e0fd460f9a360fe1253031b5c2d835", @ANYRES16=r4], 0x138}, 0x1, 0x0, 0x0, 0x8801}, 0x0) (async) sendmsg$nl_route(r1, &(0x7f0000000900)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000540)=ANY=[@ANYBLOB="4c0000002000010000000000000000000a801400000000080c000000140001002001000000000000000000000000000114000200fc0200000000000000000000000000ff080018004e244e246ffec4d916392a7a6e2891e8abf79233117381b5776c9578aa91f225f6996e62f558043a171ee8f0f4c57f99f5f83a0728302f222775a798ce1096801ac34e0b952f68d7f2c20f1492c656e7e7fdedf2459d9aa9e8d7767e9044c5e532ef3d52116b50f6c4accc54b3668cdbd7ce6be904e9ec9f29410927b12ea68b032474301f3a7883922de65b0c3d24c946f4a690efb3b8b08cede82ed228091b2e18f07054f8aa2a3b7f21a6a8cd3c70e808"], 0x4c}}, 0x40000) (async) sendmsg$nl_route(r1, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000500)={&(0x7f00000002c0)=ANY=[@ANYBLOB="5c0000001000390400"/20, @ANYRES32=0x0, @ANYBLOB="00000000600000003c0012800b000100697036746e6c00002c010280140003002001000000000000000000000000000114000200fc0200"/68], 0x5c}}, 0x0) (async) r12 = socket$nl_generic(0x10, 0x3, 0x10) r13 = syz_genetlink_get_family_id$ethtool(&(0x7f00000000c0), r12) sendmsg$ETHTOOL_MSG_STRSET_GET(r12, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000100)={&(0x7f00000002c0)=ANY=[@ANYBLOB='D\x00\x00\x00', @ANYRES16=r13, @ANYBLOB="21032cbd7000fedbdf25010000000400030004000180280002800c00018008000100060000000c00018008000100040000000c000180080001"], 0x44}, 0x1, 0x0, 0x0, 0x24044094}, 0x4) r14 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r14, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000000)=ANY=[@ANYBLOB="240000001800010200000000000000001c8e003d43177dc69c0000fc070001"], 0x24}}, 0x0) kernel console output (not intermixed with test programs): mily 0 port 8472 - 0 [ 173.727770][ T6291] openvswitch: cpu_id mismatch with handler threads [ 173.867633][ T8567] netlink: 'syz.1.627': attribute type 1 has an invalid length. [ 173.867661][ T8567] netlink: 'syz.1.627': attribute type 4 has an invalid length. [ 173.867674][ T8567] netlink: 9462 bytes leftover after parsing attributes in process `syz.1.627'. [ 173.870451][ T8567] netlink: 'syz.1.627': attribute type 1 has an invalid length. [ 173.870474][ T8567] netlink: 'syz.1.627': attribute type 4 has an invalid length. [ 173.870485][ T8567] netlink: 9462 bytes leftover after parsing attributes in process `syz.1.627'. [ 173.947583][ T8561] netlink: 8 bytes leftover after parsing attributes in process `syz.2.628'. [ 174.469355][ T8582] xfrm1: entered allmulticast mode [ 174.759941][ T8587] 8021q: adding VLAN 0 to HW filter on device bond2 [ 174.796584][ T12] openvswitch: cpu_id mismatch with handler threads [ 174.799010][ T12] openvswitch: cpu_id mismatch with handler threads [ 175.274978][ T5725] openvswitch: cpu_id mismatch with handler threads [ 176.106196][ T8652] netlink: 'syz.3.654': attribute type 1 has an invalid length. [ 177.292925][ T8692] batadv_slave_0: entered promiscuous mode [ 177.303442][ T8692] batadv_slave_0: left promiscuous mode [ 177.834847][ C0] ip6_tunnel: ip6tnl1 xmit: Local address not yet configured! [ 177.997050][ T8723] __nla_validate_parse: 14 callbacks suppressed [ 177.997073][ T8723] netlink: 4384 bytes leftover after parsing attributes in process `syz.2.667'. [ 178.090999][ T8734] syzkaller0: entered promiscuous mode [ 178.091023][ T8734] syzkaller0: entered allmulticast mode [ 178.106069][ T8734] netlink: 12 bytes leftover after parsing attributes in process `syz.0.670'. [ 178.128477][ T8734] bond1: (slave .`): Releasing backup interface [ 178.176099][ T8734] veth0: left allmulticast mode [ 178.176127][ T8734] veth0: left promiscuous mode [ 178.176378][ T8734] bridge0: port 3(veth0) entered disabled state [ 178.210732][ T8734] bridge_slave_0: left allmulticast mode [ 178.210759][ T8734] bridge_slave_0: left promiscuous mode [ 178.214114][ T8734] bridge0: port 1(bridge_slave_0) entered disabled state [ 178.268319][ T8734] bridge_slave_1: left allmulticast mode [ 178.268349][ T8734] bridge_slave_1: left promiscuous mode [ 178.268555][ T8734] bridge0: port 2(bridge_slave_1) entered disabled state [ 178.326219][ T8742] netlink: 20 bytes leftover after parsing attributes in process `syz.1.671'. [ 178.328115][ T8734] .`: (slave bond_slave_0): Releasing backup interface [ 178.372203][ T8734] team0: Port device team_slave_0 removed [ 178.398082][ T8734] team0: Port device team_slave_1 removed [ 178.398995][ T8734] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 178.399015][ T8734] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 178.431411][ T8734] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 178.431438][ T8734] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 178.455310][ T8734] A link change request failed with some changes committed already. Interface hsr_slave_0 may have been left with an inconsistent configuration, please check. [ 178.751155][ T8751] netlink: 20 bytes leftover after parsing attributes in process `syz.3.674'. [ 178.838113][ T8751] netlink: 8 bytes leftover after parsing attributes in process `syz.3.674'. [ 179.129600][ T8751] bond3: up delay (10) is not a multiple of miimon (7), value rounded to 7 ms [ 179.173000][ T8751] bond3 (unregistering): Released all slaves [ 179.195011][ C1] openvswitch: cpu_id mismatch with handler threads [ 179.329862][ T8783] netlink: 8 bytes leftover after parsing attributes in process `syz.4.679'. [ 179.958210][ T8800] TC_ACT_REPEAT abuse ? [ 180.018676][ T8809] netlink: 16 bytes leftover after parsing attributes in process `syz.1.688'. [ 180.214276][ T8816] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 180.359609][ T8811] Set syz0 is full, maxelem 0 reached [ 180.710700][ T8835] netlink: 4384 bytes leftover after parsing attributes in process `syz.4.691'. [ 181.111873][ T8851] netlink: 8 bytes leftover after parsing attributes in process `syz.2.695'. [ 181.624143][ T8874] netlink: 16 bytes leftover after parsing attributes in process `syz.2.700'. [ 182.175019][ T8892] netlink: 'syz.0.705': attribute type 1 has an invalid length. [ 183.278032][ T5632] block nbd64: NBD_DISCONNECT [ 183.616455][ T8947] __nla_validate_parse: 7 callbacks suppressed [ 183.616478][ T8947] netlink: 20 bytes leftover after parsing attributes in process `syz.4.719'. [ 183.749840][ T8933] syzkaller0: entered promiscuous mode [ 183.749865][ T8933] syzkaller0: entered allmulticast mode [ 183.770104][ T5636] udevd[5636]: inotify_add_watch(7, /dev/nbd64, 10) failed: No such file or directory [ 184.311385][ T8977] netlink: 52 bytes leftover after parsing attributes in process `syz.1.725'. [ 184.800023][ T8966] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 184.831671][ T8988] netlink: 8 bytes leftover after parsing attributes in process `syz.3.726'. [ 186.245637][ C0] ip6_tunnel: ip6tnl1 xmit: Local address not yet configured! [ 186.471188][ T9022] FAULT_INJECTION: forcing a failure. [ 186.471188][ T9022] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 186.471223][ T9022] CPU: 1 UID: 0 PID: 9022 Comm: syz.2.733 Not tainted syzkaller #0 PREEMPT(full) [ 186.471244][ T9022] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 186.471255][ T9022] Call Trace: [ 186.471263][ T9022] [ 186.471272][ T9022] dump_stack_lvl+0xe8/0x150 [ 186.471305][ T9022] should_fail_ex+0x410/0x560 [ 186.471331][ T9022] _copy_from_user+0x2d/0xb0 [ 186.471356][ T9022] __copy_msghdr+0x390/0x590 [ 186.471390][ T9022] ___sys_sendmsg+0x213/0x360 [ 186.471427][ T9022] ? __lock_acquire+0x747/0x2de0 [ 186.471453][ T9022] ? __pfx____sys_sendmsg+0x10/0x10 [ 186.471477][ T9022] ? __lock_acquire+0x747/0x2de0 [ 186.471504][ T9022] ? kstrtouint+0x6e/0xe0 [ 186.471570][ T9022] __sys_sendmmsg+0x273/0x4d0 [ 186.471605][ T9022] ? __pfx___sys_sendmmsg+0x10/0x10 [ 186.471643][ T9022] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 186.471688][ T9022] ? ksys_write+0x242/0x270 [ 186.471721][ T9022] ? __pfx_ksys_write+0x10/0x10 [ 186.471758][ T9022] __x64_sys_sendmmsg+0xa0/0xc0 [ 186.471788][ T9022] do_syscall_64+0x166/0x520 [ 186.471814][ T9022] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 186.471835][ T9022] ? clear_bhb_loop+0x70/0xc0 [ 186.471859][ T9022] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 186.471878][ T9022] RIP: 0033:0x7f469899e159 [ 186.471898][ T9022] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 186.471913][ T9022] RSP: 002b:00007f4699866028 EFLAGS: 00000246 ORIG_RAX: 0000000000000133 [ 186.471935][ T9022] RAX: ffffffffffffffda RBX: 00007f4698c25fa0 RCX: 00007f469899e159 [ 186.471950][ T9022] RDX: 0000000000000002 RSI: 000020000000c940 RDI: 0000000000000006 [ 186.471962][ T9022] RBP: 00007f4699866090 R08: 0000000000000000 R09: 0000000000000000 [ 186.471979][ T9022] R10: 0000000004000000 R11: 0000000000000246 R12: 0000000000000001 [ 186.471991][ T9022] R13: 00007f4698c26038 R14: 00007f4698c25fa0 R15: 00007ffd370dfd38 [ 186.472026][ T9022] [ 187.103779][ T9032] netlink: 'syz.0.737': attribute type 10 has an invalid length. [ 187.111285][ T9032] team0: Port device bond_slave_0 added [ 187.207305][ T9037] ip_tables: iptables: counters copy to user failed while replacing table [ 187.228675][ T9036] netlink: 24 bytes leftover after parsing attributes in process `syz.4.734'. [ 187.407277][ T9042] netlink: 32 bytes leftover after parsing attributes in process `syz.0.739'. [ 187.948334][ T9054] netlink: 4384 bytes leftover after parsing attributes in process `syz.0.742'. [ 188.155199][ C1] openvswitch: cpu_id mismatch with handler threads [ 188.357505][ T9066] netlink: 24 bytes leftover after parsing attributes in process `syz.4.746'. [ 191.107107][ T5622] Bluetooth: hci3: unexpected event 0x04 length: 0 < 10 [ 191.163179][ T9085] x_tables: ip6_tables: cgroup match: used from hooks PREROUTING, but only valid from INPUT/OUTPUT/POSTROUTING [ 191.777898][ T5622] Bluetooth: hci4: unexpected event 0x04 length: 0 < 10 [ 191.796923][ T9092] x_tables: ip6_tables: cgroup match: used from hooks PREROUTING, but only valid from INPUT/OUTPUT/POSTROUTING [ 191.910191][ T9106] netlink: 4 bytes leftover after parsing attributes in process `syz.4.758'. [ 191.953973][ T9103] netlink: 16178 bytes leftover after parsing attributes in process `syz.1.757'. [ 191.966598][ T9103] netlink: 88 bytes leftover after parsing attributes in process `syz.1.757'. [ 192.266065][ T9122] netlink: 4384 bytes leftover after parsing attributes in process `syz.4.760'. [ 192.718732][ T9125] bridge0: left allmulticast mode [ 192.839537][ T9139] netlink: 48 bytes leftover after parsing attributes in process `syz.3.767'. [ 192.935739][ T9144] netlink: 8 bytes leftover after parsing attributes in process `syz.2.766'. [ 193.161575][ T9156] ip_tables: iptables: counters copy to user failed while replacing table [ 193.251837][ T9125] bridge1: left allmulticast mode [ 193.332171][ T9139] netlink: 48 bytes leftover after parsing attributes in process `syz.3.767'. [ 193.365984][ T201] netdevsim netdevsim0 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 193.366036][ T201] netdevsim netdevsim0 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 193.366070][ T201] netdevsim netdevsim0 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 193.366104][ T201] netdevsim netdevsim0 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 193.551801][ T9162] netlink: 'syz.3.769': attribute type 54 has an invalid length. [ 193.551826][ T9162] netlink: 8 bytes leftover after parsing attributes in process `syz.3.769'. [ 193.962482][ T9174] tipc: Started in network mode [ 193.962512][ T9174] tipc: Node identity 92ef61704068, cluster identity 4711 [ 193.962658][ T9174] tipc: Enabled bearer , priority 0 [ 193.962847][ T9176] syzkaller0: entered promiscuous mode [ 193.962865][ T9176] syzkaller0: entered allmulticast mode [ 194.022047][ T9174] tipc: Resetting bearer [ 194.039396][ T9173] tipc: Resetting bearer [ 194.125907][ T9173] tipc: Disabling bearer [ 194.405463][ T5622] Bluetooth: hci0: Opcode 0x0c03 failed: -110 [ 194.559896][ T1310] ieee802154 phy1 wpan1: encryption failed: -22 [ 195.132397][ T9221] netlink: 4 bytes leftover after parsing attributes in process `syz.2.778'. [ 195.134107][ T9221] xt_CONNSECMARK: only valid in 'mangle' or 'security' table, not 'raw' [ 195.412918][ T9221] xt_CT: No such helper "netbios-ns" [ 195.941641][ T9240] syzkaller1: entered promiscuous mode [ 195.941667][ T9240] syzkaller1: entered allmulticast mode [ 196.360819][ T9254] netlink: 24 bytes leftover after parsing attributes in process `syz.2.786'. [ 196.646075][ T9264] bond3: entered promiscuous mode [ 196.769838][ T9239] sch_tbf: burst 88 is lower than device veth1 mtu (1514) ! [ 196.831333][ T9234] atm:do_vcc_ioctl: ATM_SETSC is obsolete; used by syz.1.782:9234 [ 197.084812][ T9277] __nla_validate_parse: 2 callbacks suppressed [ 197.084841][ T9277] netlink: 4384 bytes leftover after parsing attributes in process `syz.2.791'. [ 197.310778][ T9282] netlink: 8 bytes leftover after parsing attributes in process `syz.4.794'. [ 197.310818][ T9282] netlink: 8 bytes leftover after parsing attributes in process `syz.4.794'. [ 198.077102][ T5622] Bluetooth: hci2: unexpected event 0x04 length: 0 < 10 [ 198.079704][ T9316] x_tables: ip6_tables: cgroup match: used from hooks PREROUTING, but only valid from INPUT/OUTPUT/POSTROUTING [ 198.193798][ T9310] netlink: 32 bytes leftover after parsing attributes in process `syz.0.799'. [ 198.402196][ T9326] netlink: 32 bytes leftover after parsing attributes in process `syz.1.802'. [ 198.588778][ T9332] netlink: 8 bytes leftover after parsing attributes in process `syz.1.802'. [ 198.681810][ T9331] ipvlan3: entered promiscuous mode [ 198.694921][ T9331] team0: Device ipvlan3 failed to register rx_handler [ 198.722286][ T9333] netlink: 9 bytes leftover after parsing attributes in process `syz.2.804'. [ 198.798134][ T9333] gretap0: entered promiscuous mode [ 199.229054][ T9353] netlink: 868 bytes leftover after parsing attributes in process `syz.0.810'. [ 199.468947][ T9368] netlink: 'syz.4.811': attribute type 10 has an invalid length. [ 199.630558][ T9374] netlink: 4384 bytes leftover after parsing attributes in process `syz.0.813'. [ 199.765827][ T9376] netlink: 8 bytes leftover after parsing attributes in process `syz.3.812'. [ 200.076195][ T9361] syzkaller0: entered promiscuous mode [ 200.076222][ T9361] syzkaller0: entered allmulticast mode [ 200.171581][ T9384] tipc: Started in network mode [ 200.171613][ T9384] tipc: Node identity 2ed7ac45a259, cluster identity 4711 [ 200.171795][ T9384] tipc: Enabled bearer , priority 0 [ 201.762813][ T5622] Bluetooth: hci1: command 0x0406 tx timeout [ 201.762861][ T5622] Bluetooth: hci3: command 0x0406 tx timeout [ 201.763100][ T5622] Bluetooth: hci2: command 0x0406 tx timeout [ 202.884991][ C0] ip6_tunnel: ip6tnl1 xmit: Local address not yet configured! [ 203.063890][ T9381] tipc: Disabling bearer [ 203.150263][ T9150] tipc: Node number set to 2358160453 [ 203.192649][ T9417] Cannot find set identified by id 65535 to match [ 203.726939][ T9424] ipvlan2: entered promiscuous mode [ 203.727245][ T9424] team0: Device ipvlan2 is VLAN challenged and team device has VLAN set up [ 203.771659][ T9433] netlink: 9 bytes leftover after parsing attributes in process `syz.3.820'. [ 204.439074][ T9461] SET target dimension over the limit! [ 204.593149][ T52] Bluetooth: hci4: connection err: -111 [ 204.997100][ T9478] netlink: 100 bytes leftover after parsing attributes in process `syz.3.832'. [ 204.997131][ T9478] netlink: 40 bytes leftover after parsing attributes in process `syz.3.832'. [ 205.434891][ C1] openvswitch: cpu_id mismatch with handler threads [ 205.456759][ T9495] netlink: 32 bytes leftover after parsing attributes in process `syz.3.838'. [ 205.710943][ T9511] ip_tables: iptables: counters copy to user failed while replacing table [ 205.727032][ T9511] ip_tables: iptables: counters copy to user failed while replacing table [ 205.737289][ T9511] netlink: 4 bytes leftover after parsing attributes in process `syz.4.840'. [ 205.737313][ T9511] netlink: 4 bytes leftover after parsing attributes in process `syz.4.840'. [ 205.846351][ T9502] raw_sendmsg: syz.3.841 forgot to set AF_INET. Fix it! [ 206.968063][ T9561] netlink: 44 bytes leftover after parsing attributes in process `syz.4.850'. [ 206.968093][ T9561] netlink: 43 bytes leftover after parsing attributes in process `syz.4.850'. [ 206.968108][ T9561] netlink: 'syz.4.850': attribute type 6 has an invalid length. [ 206.968122][ T9561] netlink: 'syz.4.850': attribute type 5 has an invalid length. [ 206.968134][ T9561] netlink: 43 bytes leftover after parsing attributes in process `syz.4.850'. [ 207.591742][ T9579] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 208.543667][ T9622] Cannot find set identified by id 65535 to match [ 209.053694][ T9638] netlink: 'syz.0.863': attribute type 1 has an invalid length. [ 209.832370][ T9638] 8021q: adding VLAN 0 to HW filter on device bond4 [ 209.839483][ T9641] bond4: (slave veth0_to_bond): Enslaving as an active interface with an up link [ 210.145706][ T9663] netlink: 52 bytes leftover after parsing attributes in process `syz.4.866'. [ 210.292829][ T9667] netlink: 'syz.0.869': attribute type 1 has an invalid length. [ 210.336046][ T9672] Cannot find set identified by id 65535 to match [ 210.429774][ T9675] sctp: [Deprecated]: syz.2.870 (pid 9675) Use of int in max_burst socket option. [ 210.429774][ T9675] Use struct sctp_assoc_value instead [ 210.521416][ T9667] bond5: entered promiscuous mode [ 210.521915][ T9667] 8021q: adding VLAN 0 to HW filter on device bond5 [ 210.597465][ T9681] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 210.750203][ T9667] bond5: (slave bridge3): making interface the new active one [ 210.750232][ T9667] bridge3: entered promiscuous mode [ 210.800855][ T9667] bond5: (slave bridge3): Enslaving as an active interface with an up link [ 211.211918][ T9705] x_tables: ip_tables: REDIRECT target: used from hooks POSTROUTING, but only usable from PREROUTING/OUTPUT [ 211.352214][ T9709] netlink: 32 bytes leftover after parsing attributes in process `syz.0.877'. [ 211.782136][ T9716] netlink: 'syz.0.880': attribute type 1 has an invalid length. [ 212.440002][ T9744] Cannot find set identified by id 65535 to match [ 213.193684][ T9766] netlink: 4 bytes leftover after parsing attributes in process `syz.0.889'. [ 213.202777][ T9762] netlink: 4 bytes leftover after parsing attributes in process `syz.3.888'. [ 213.202806][ T9762] netlink: 'syz.3.888': attribute type 5 has an invalid length. [ 213.203061][ T9769] netlink: 4 bytes leftover after parsing attributes in process `syz.3.888'. [ 213.203077][ T9769] netlink: 'syz.3.888': attribute type 5 has an invalid length. [ 213.354924][ T52] Bluetooth: hci4: command 0x0406 tx timeout [ 213.584971][ T9762] netlink: 4 bytes leftover after parsing attributes in process `syz.3.888'. [ 213.585005][ T9762] netlink: 'syz.3.888': attribute type 5 has an invalid length. [ 213.587097][ T9769] netlink: 4 bytes leftover after parsing attributes in process `syz.3.888'. [ 213.587125][ T9769] netlink: 'syz.3.888': attribute type 5 has an invalid length. [ 213.589420][ T9748] v: renamed from ip_vti0 [ 213.643926][ T9748] v: entered allmulticast mode [ 213.644128][ T9748] A link change request failed with some changes committed already. Interface v may have been left with an inconsistent configuration, please check. [ 213.645092][ T1152] netdevsim netdevsim3 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0 [ 213.645555][ T1152] netdevsim netdevsim3 netdevsim0: set [0, 0] type 1 family 0 port 8472 - 0 [ 213.676378][ T1152] netdevsim netdevsim3 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0 [ 213.680492][ T201] netdevsim netdevsim3 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0 [ 213.864737][ T9789] netlink: 8 bytes leftover after parsing attributes in process `syz.2.893'. [ 213.864773][ T9789] netlink: 20 bytes leftover after parsing attributes in process `syz.2.893'. [ 214.083829][ T9789] bridge0: port 1(batadv1) entered blocking state [ 214.083986][ T9789] bridge0: port 1(batadv1) entered disabled state [ 214.084164][ T9789] batadv1: entered allmulticast mode [ 214.119011][ T9789] batadv1: entered promiscuous mode [ 214.119438][ T9799] RDS: rds_bind could not find a transport for fe88::101, load rds_tcp or rds_rdma? [ 214.308942][ T9809] x_tables: ip6_tables: cgroup match: used from hooks PREROUTING, but only valid from INPUT/OUTPUT/POSTROUTING [ 214.311736][ T9809] ±ÿ: renamed from lo (while UP) [ 214.435636][ T201] batman_adv: batadv1: No IGMP Querier present - multicast optimizations disabled [ 214.435657][ T201] batman_adv: batadv1: No MLD Querier present - multicast optimizations disabled [ 214.541264][ T9825] netlink: 12 bytes leftover after parsing attributes in process `syz.4.898'. [ 215.309362][ T9841] netlink: 8 bytes leftover after parsing attributes in process `syz.0.903'. [ 215.331433][ T9841] bond3: left promiscuous mode [ 215.342641][ T9841] bond5: left promiscuous mode [ 215.342666][ T9841] bridge3: left promiscuous mode [ 215.461933][ T9846] dummy0: entered allmulticast mode [ 215.836018][ T9868] netlink: 8 bytes leftover after parsing attributes in process `syz.4.911'. [ 216.270986][ T9883] netlink: 8 bytes leftover after parsing attributes in process `syz.0.915'. [ 217.357542][ T9905] netlink: 'syz.4.919': attribute type 1 has an invalid length. [ 217.593406][ T9911] pim6reg: entered allmulticast mode [ 217.593577][ T9906] syzkaller1: entered allmulticast mode [ 217.720130][ T9927] netlink: 56 bytes leftover after parsing attributes in process `syz.4.925'. [ 217.720641][ T9925] netlink: 56 bytes leftover after parsing attributes in process `syz.4.925'. [ 217.747993][ T9928] sch_tbf: burst 6 is lower than device syzkaller0 mtu (1514) ! [ 217.767638][ T9925] nbd4: detected capacity change from 0 to 63 [ 217.770996][ T9925] block nbd4: NBD_DISCONNECT [ 217.771105][ T9925] block nbd4: Disconnected due to user request. [ 217.771118][ T9925] block nbd4: shutting down sockets [ 217.777734][ T2223] blk_print_req_error: 82 callbacks suppressed [ 217.777752][ T2223] I/O error, dev nbd4, sector 2 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 217.777776][ T2223] buffer_io_error: 138 callbacks suppressed [ 217.777786][ T2223] Buffer I/O error on dev nbd4, logical block 1, async page read [ 217.777908][ T2223] I/O error, dev nbd4, sector 4 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 217.777930][ T2223] Buffer I/O error on dev nbd4, logical block 2, async page read [ 217.778035][ T2223] I/O error, dev nbd4, sector 6 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 217.778056][ T2223] Buffer I/O error on dev nbd4, logical block 3, async page read [ 217.817680][ C1] I/O error, dev nbd4, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 217.817765][ C1] Buffer I/O error on dev nbd4, logical block 0, async page read [ 217.817942][ T2223] I/O error, dev nbd4, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 217.817976][ T2223] Buffer I/O error on dev nbd4, logical block 0, async page read [ 217.818076][ T2223] I/O error, dev nbd4, sector 2 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 217.818098][ T2223] Buffer I/O error on dev nbd4, logical block 1, async page read [ 217.818188][ T2223] I/O error, dev nbd4, sector 4 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 217.818209][ T2223] Buffer I/O error on dev nbd4, logical block 2, async page read [ 217.818300][ T2223] I/O error, dev nbd4, sector 6 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 217.818321][ T2223] Buffer I/O error on dev nbd4, logical block 3, async page read [ 217.818422][ T2223] I/O error, dev nbd4, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 217.818443][ T2223] Buffer I/O error on dev nbd4, logical block 0, async page read [ 217.818724][ T2223] I/O error, dev nbd4, sector 2 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 217.818745][ T2223] Buffer I/O error on dev nbd4, logical block 1, async page read [ 217.829582][ T5636] ldm_validate_partition_table(): Disk read failed. [ 217.835155][ T5636] Dev nbd4: unable to read RDB block 0 [ 217.848983][ T5636] nbd4: unable to read partition table [ 217.903545][ T5636] ldm_validate_partition_table(): Disk read failed. [ 217.909140][ T5636] Dev nbd4: unable to read RDB block 0 [ 217.913945][ T5636] nbd4: unable to read partition table [ 218.108530][ T9935] Can not set IPV6_FL_F_REFLECT if flowlabel_consistency sysctl is enable [ 218.136721][ T9935] netlink: 36 bytes leftover after parsing attributes in process `syz.4.928'. [ 218.238046][ T9937] netlink: 8 bytes leftover after parsing attributes in process `syz.4.929'. [ 218.290851][ T9939] netlink: 8 bytes leftover after parsing attributes in process `syz.2.930'. [ 218.292982][ T9939] x_tables: duplicate entry at hook 1 [ 218.413482][ T9945] netlink: 4384 bytes leftover after parsing attributes in process `syz.4.931'. [ 218.460707][ T9947] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 218.858937][ T30] audit: type=1800 audit(1790484536.026:4): pid=9964 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.2.937" name="memory.events" dev="tmpfs" ino=970 res=0 errno=0 [ 219.057928][ T9963] netlink: 9 bytes leftover after parsing attributes in process `syz.3.938'. [ 219.058128][ T9963] 0·: renamed from hsr0 (while UP) [ 219.068161][ T9963] 0·: entered allmulticast mode [ 219.068186][ T9963] hsr_slave_0: entered allmulticast mode [ 219.068605][ T9963] A link change request failed with some changes committed already. Interface c0· may have been left with an inconsistent configuration, please check. [ 219.109905][ T9970] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 219.804877][ T9993] bridge0: port 3(bond0) entered disabled state [ 219.805785][ T9993] bridge0: port 2(bridge_slave_1) entered disabled state [ 219.806462][ T9993] bridge0: port 1(bridge_slave_0) entered disabled state [ 219.920628][ T9993] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 219.933851][ T9993] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 219.952468][ T9993] 0·: left allmulticast mode [ 219.952495][ T9993] hsr_slave_0: left allmulticast mode [ 220.205182][ T9993] bond1: left allmulticast mode [ 220.205210][ T9993] bridge1: left allmulticast mode [ 220.241026][ T9993] bridge2: left promiscuous mode [ 220.241054][ T9993] bridge2: left allmulticast mode [ 220.243456][ T9993] xfrm1: left allmulticast mode [ 220.264791][ T1149] netdevsim netdevsim3 netdevsim1: unset [0, 0] type 1 family 0 port 8472 - 0 [ 220.264828][ T1149] netdevsim netdevsim3 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 220.264851][ T1149] netdevsim netdevsim3 netdevsim1: unset [1, 1] type 2 family 0 port 20000 - 0 [ 220.275573][ T1149] netdevsim netdevsim3 netdevsim2: unset [0, 0] type 1 family 0 port 8472 - 0 [ 220.275611][ T1149] netdevsim netdevsim3 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 220.275632][ T1149] netdevsim netdevsim3 netdevsim2: unset [1, 1] type 2 family 0 port 20000 - 0 [ 220.275663][ T1149] netdevsim netdevsim3 netdevsim3: unset [0, 0] type 1 family 0 port 8472 - 0 [ 220.275684][ T1149] netdevsim netdevsim3 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 220.275703][ T1149] netdevsim netdevsim3 netdevsim3: unset [1, 1] type 2 family 0 port 20000 - 0 [ 220.275731][ T1149] netdevsim netdevsim3 netdevsim0: unset [0, 0] type 1 family 0 port 8472 - 0 [ 220.275751][ T1149] netdevsim netdevsim3 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 220.275771][ T1149] netdevsim netdevsim3 netdevsim0: unset [1, 1] type 2 family 0 port 20000 - 0 [ 220.401077][ T9908] pim6reg: left allmulticast mode [ 220.538788][T10016] __nla_validate_parse: 4 callbacks suppressed [ 220.538810][T10016] netlink: 12 bytes leftover after parsing attributes in process `syz.2.954'. [ 220.701864][T10031] Cannot find set identified by id 65535 to match [ 221.022089][T10036] tipc: Enabled bearer , priority 0 [ 221.051718][T10050] netlink: 56 bytes leftover after parsing attributes in process `syz.3.961'. [ 221.105206][T10047] syzkaller1: entered promiscuous mode [ 221.105232][T10047] syzkaller1: entered allmulticast mode [ 221.163014][T10048] tipc: Disabling bearer [ 221.450406][T10063] netlink: 8 bytes leftover after parsing attributes in process `syz.2.966'. [ 221.450433][T10063] netlink: 4 bytes leftover after parsing attributes in process `syz.2.966'. [ 221.450458][T10063] netlink: 'syz.2.966': attribute type 18 has an invalid length. [ 221.482281][T10064] netlink: 24 bytes leftover after parsing attributes in process `syz.1.965'. [ 221.738479][T10070] tipc: Enabling of bearer rejected, failed to enable media [ 221.806186][T10072] Cannot find set identified by id 65535 to match [ 221.944428][T10079] netlink: 8 bytes leftover after parsing attributes in process `syz.4.971'. [ 222.035183][T10079] bond2: up delay (10) is not a multiple of miimon (7), value rounded to 7 ms [ 222.289895][T10079] bond2 (unregistering): Released all slaves [ 222.370933][T10084] netlink: 108 bytes leftover after parsing attributes in process `syz.1.973'. [ 222.383055][T10084] netlink: 108 bytes leftover after parsing attributes in process `syz.1.973'. [ 222.396759][T10090] netlink: 32 bytes leftover after parsing attributes in process `syz.0.974'. [ 222.716385][T10105] netlink: 'syz.1.976': attribute type 54 has an invalid length. [ 222.716410][T10105] netlink: 8 bytes leftover after parsing attributes in process `syz.1.976'. [ 222.719890][T10112] netlink: 'syz.1.976': attribute type 54 has an invalid length. [ 223.062760][T10122] syzkaller1: tun_chr_ioctl cmd 1074025677 [ 223.062911][T10122] syzkaller1: linktype set to 825 [ 223.118434][T10129] netlink: 'syz.3.985': attribute type 1 has an invalid length. [ 223.813894][T10161] netlink: 'syz.4.991': attribute type 1 has an invalid length. [ 224.003277][T10161] 8021q: adding VLAN 0 to HW filter on device bond2 [ 226.382519][T10247] syzkaller0: entered promiscuous mode [ 226.382548][T10247] syzkaller0: entered allmulticast mode [ 226.418908][ T30] audit: type=1800 audit(1790484543.586:5): pid=10257 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.0.1006" name=FFFFFFFF dev="tmpfs" ino=1026 res=0 errno=0 [ 226.433144][ T30] audit: type=1804 audit(1790484543.596:6): pid=10257 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=ToMToU comm="syz.0.1006" name=2F6E6577726F6F742F3139352FFFFFFFFF dev="tmpfs" ino=1026 res=1 errno=0 [ 226.582504][T10265] netlink: 'syz.1.1007': attribute type 1 has an invalid length. [ 226.625879][T10265] __nla_validate_parse: 10 callbacks suppressed [ 226.625917][T10265] netlink: 12 bytes leftover after parsing attributes in process `syz.1.1007'. [ 227.488150][T10287] Cannot find set identified by id 65535 to match [ 227.542178][T10196] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 228.991633][T10268] bond2: (slave veth0_to_bond): making interface the new active one [ 228.992514][T10268] bond2: (slave veth0_to_bond): Enslaving as an active interface with an up link [ 229.328317][T10300] netlink: 'syz.3.1015': attribute type 32 has an invalid length. [ 229.328344][T10300] netlink: 8 bytes leftover after parsing attributes in process `syz.3.1015'. [ 229.353702][T10300] bond3: Setting coupled_control to off (0) [ 229.726399][T10323] netlink: 4384 bytes leftover after parsing attributes in process `syz.1.1020'. [ 230.283034][T10351] netlink: 36 bytes leftover after parsing attributes in process `syz.0.1023'. [ 230.289447][T10351] netlink: Conntrack attr has 8 unknown bytes [ 230.289482][T10351] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 230.903836][T10373] netlink: 24 bytes leftover after parsing attributes in process `syz.1.1028'. [ 231.657893][T10375] netlink: 32 bytes leftover after parsing attributes in process `syz.2.1029'. [ 231.661760][T10375] netlink: 4 bytes leftover after parsing attributes in process `syz.2.1029'. [ 231.690271][T10376] netlink: 32 bytes leftover after parsing attributes in process `syz.2.1029'. [ 231.693660][T10376] netlink: 4 bytes leftover after parsing attributes in process `syz.2.1029'. [ 232.713087][T10328] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 232.728880][T10371] netlink: 'syz.1.1028': attribute type 2 has an invalid length. [ 232.728907][T10371] netlink: 'syz.1.1028': attribute type 1 has an invalid length. [ 232.728920][T10371] netlink: 224 bytes leftover after parsing attributes in process `syz.1.1028'. [ 232.994409][T10400] batman_adv: batadv0: Adding interface: syzkaller0 [ 232.994430][T10400] batman_adv: batadv0: The MTU of interface syzkaller0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 233.032586][T10400] batman_adv: batadv0: Interface activated: syzkaller0 [ 233.098439][T10400] netlink: 48 bytes leftover after parsing attributes in process `syz.1.1031'. [ 233.111069][T10400] Bluetooth: hci0: unsupported parameter 5135 [ 233.111092][T10400] Bluetooth: hci0: invalid length 1, exp 2 for type 24 [ 233.146038][T10399] batman_adv: batadv0: Interface deactivated: syzkaller0 [ 233.216379][T10406] netlink: 'syz.4.1034': attribute type 1 has an invalid length. [ 233.250459][T10399] batman_adv: batadv0: Removing interface: syzkaller0 [ 233.419563][T10406] 8021q: adding VLAN 0 to HW filter on device bond3 [ 233.614027][T10432] netlink: 64 bytes leftover after parsing attributes in process `syz.1.1040'. [ 233.667649][T10420] bond3: (slave geneve2): making interface the new active one [ 233.672497][T10420] bond3: (slave geneve2): Enslaving as an active interface with an up link [ 233.780829][T10438] netlink: 4 bytes leftover after parsing attributes in process `syz.0.1041'. [ 233.793066][T10427] netlink: 8 bytes leftover after parsing attributes in process `syz.1.1040'. [ 233.793089][T10427] netlink: 8 bytes leftover after parsing attributes in process `syz.1.1040'. [ 233.909229][T10438] macvtap2: entered allmulticast mode [ 233.909257][T10438] dummy0: entered allmulticast mode [ 233.945671][T10438] dummy0: left allmulticast mode [ 234.050009][T10441] macvtap2: entered allmulticast mode [ 234.050036][T10441] dummy0: entered allmulticast mode [ 234.067206][T10441] dummy0: left allmulticast mode [ 234.116088][T10435] syzkaller1: entered promiscuous mode [ 234.116259][T10435] syzkaller1: entered allmulticast mode [ 234.118122][T10436] syzkaller1: entered promiscuous mode [ 234.118142][T10436] syzkaller1: entered allmulticast mode [ 234.126123][ T6291] netdevsim netdevsim4 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 234.126170][ T6291] netdevsim netdevsim4 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 234.126203][ T6291] netdevsim netdevsim4 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 234.126233][ T6291] netdevsim netdevsim4 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 234.638465][T10458] bond4: option lacp_rate: invalid value (3) [ 234.640227][T10458] bond4 (unregistering): Released all slaves [ 234.755761][T10462] 8021q: adding VLAN 0 to HW filter on device team0 [ 234.760134][T10462] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 234.871209][T10462] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 234.882209][T10462] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 234.904611][T10462] hsr0: A HSR master's MTU cannot be greater than the smallest MTU of its slaves minus the HSR Tag length (6 octets). [ 234.980378][ T6294] bridge0: port 1(bridge_slave_0) entered blocking state [ 234.980444][ T6294] bridge0: port 1(bridge_slave_0) entered forwarding state [ 235.021206][ T6294] bridge0: port 2(bridge_slave_1) entered blocking state [ 235.021366][ T6294] bridge0: port 2(bridge_slave_1) entered forwarding state [ 236.148954][ T30] audit: type=1800 audit(1790484553.316:7): pid=10526 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.0.1060" name="memory.events" dev="tmpfs" ino=1084 res=0 errno=0 [ 236.150274][ T30] audit: type=1804 audit(1790484553.316:8): pid=10526 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=ToMToU comm="syz.0.1060" name="/newroot/206/memory.events" dev="tmpfs" ino=1084 res=1 errno=0 [ 236.512680][T10537] Cannot find set identified by id 65535 to match [ 236.768188][T10546] veth0: entered promiscuous mode [ 236.788950][T10546] __nla_validate_parse: 12 callbacks suppressed [ 236.788974][T10546] netlink: 228 bytes leftover after parsing attributes in process `syz.0.1065'. [ 236.794813][ C0] ip6_tunnel: ip6tnl1 xmit: Local address not yet configured! [ 237.125218][T10546] veth0: left promiscuous mode [ 237.977432][T10584] netlink: 'syz.3.1072': attribute type 2 has an invalid length. [ 238.219303][T10593] netlink: 4 bytes leftover after parsing attributes in process `syz.2.1075'. [ 238.241392][T10598] netlink: 52 bytes leftover after parsing attributes in process `syz.1.1076'. [ 238.603187][T10609] tipc: New replicast peer: 255.255.255.255 [ 238.603958][T10609] tipc: Enabled bearer , priority 10 [ 238.626740][T10609] netlink: 12 bytes leftover after parsing attributes in process `syz.0.1080'. [ 238.742981][T10617] netlink: 'syz.1.1082': attribute type 1 has an invalid length. [ 238.850416][T10617] 8021q: adding VLAN 0 to HW filter on device bond3 [ 238.897535][T10625] netlink: 4 bytes leftover after parsing attributes in process `syz.3.1083'. [ 238.945769][T10628] netlink: 'syz.0.1084': attribute type 1 has an invalid length. [ 238.950366][T10624] netlink: 'syz.1.1082': attribute type 10 has an invalid length. [ 238.950391][T10624] netlink: 40 bytes leftover after parsing attributes in process `syz.1.1082'. [ 238.999889][T10622] bond3: (slave veth5): Enslaving as an active interface with a down link [ 239.078496][T10617] bond3: (slave dummy0): making interface the new active one [ 239.103497][T10617] bond3: (slave dummy0): Enslaving as an active interface with an up link [ 239.131432][T10625] macvtap0: entered promiscuous mode [ 239.131456][T10625] erspan0: entered promiscuous mode [ 239.131683][T10625] macvtap0: entered allmulticast mode [ 239.131697][T10625] erspan0: entered allmulticast mode [ 239.185181][T10626] erspan0: left allmulticast mode [ 239.185199][T10626] erspan0: left promiscuous mode [ 239.185421][T10626] macvtap0: left promiscuous mode [ 239.185433][T10626] macvtap0: left allmulticast mode [ 239.228869][T10624] dummy0: entered promiscuous mode [ 239.232752][T10624] bond3: (slave dummy0): Releasing active interface [ 239.321338][T10629] gretap2: entered allmulticast mode [ 239.343183][T10629] bond7: (slave gretap2): making interface the new active one [ 239.372559][T10629] bond7: (slave gretap2): Enslaving as an active interface with an up link [ 239.487657][T10644] netlink: 8 bytes leftover after parsing attributes in process `syz.2.1088'. [ 239.720063][T10649] block nbd0: NBD_DISCONNECT [ 239.720094][T10649] block nbd0: Send disconnect failed -32 [ 239.720112][T10649] block nbd0: Send disconnect failed -32 [ 239.720156][T10649] block nbd0: shutting down sockets [ 239.776514][T10659] ip_tables: iptables: counters copy to user failed while replacing table [ 239.934978][T10667] netlink: 232 bytes leftover after parsing attributes in process `syz.2.1095'. [ 239.994863][ C1] openvswitch: cpu_id mismatch with handler threads [ 240.541254][T10686] netlink: 8 bytes leftover after parsing attributes in process `syz.3.1102'. [ 240.575657][T10689] netlink: 24 bytes leftover after parsing attributes in process `syz.0.1100'. [ 240.649823][T10693] openvswitch: netlink: Missing key (keys=c0, expected=880) [ 240.898914][T10706] ±ÿ: renamed from lo (while UP) [ 241.150466][T10712] openvswitch: netlink: Missing key (keys=40, expected=2000) [ 241.163200][T10712] netlink: 'syz.4.1109': attribute type 16 has an invalid length. [ 241.163200][T10714] netlink: 'syz.4.1109': attribute type 16 has an invalid length. [ 241.163224][T10712] netlink: 'syz.4.1109': attribute type 3 has an invalid length. [ 241.163225][T10714] netlink: 'syz.4.1109': attribute type 3 has an invalid length. [ 241.877768][T10739] __nla_validate_parse: 8 callbacks suppressed [ 241.877789][T10739] netlink: 232 bytes leftover after parsing attributes in process `syz.2.1120'. [ 242.160052][T10748] netlink: 32 bytes leftover after parsing attributes in process `syz.2.1122'. [ 242.595904][T10775] netlink: 52 bytes leftover after parsing attributes in process `syz.2.1125'. [ 242.750059][T10798] netlink: zone id is out of range [ 242.750077][T10798] netlink: zone id is out of range [ 242.750087][T10798] netlink: zone id is out of range [ 242.750094][T10798] netlink: zone id is out of range [ 242.750102][T10798] netlink: zone id is out of range [ 242.750110][T10798] netlink: zone id is out of range [ 242.750117][T10798] netlink: zone id is out of range [ 242.927624][T10804] netlink: 8 bytes leftover after parsing attributes in process `syz.2.1128'. [ 243.333584][T10815] netlink: 224 bytes leftover after parsing attributes in process `syz.2.1132'. [ 243.352720][T10812] netlink: 16 bytes leftover after parsing attributes in process `syz.4.1130'. [ 243.352747][T10812] tipc: Started in network mode [ 243.352762][T10812] tipc: Node identity 4, cluster identity 4711 [ 243.352773][T10812] tipc: Node number set to 4 [ 243.622899][T10822] netlink: 'syz.3.1135': attribute type 2 has an invalid length. [ 243.624429][T10822] netlink: 16 bytes leftover after parsing attributes in process `syz.3.1135'. [ 243.627860][T10810] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 243.690298][T10825] netlink: 8 bytes leftover after parsing attributes in process `syz.0.1133'. [ 243.690325][T10825] netlink: 4 bytes leftover after parsing attributes in process `syz.0.1133'. [ 243.939386][T10810] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 243.960919][T10810] bond0 (unregistering): (slave netdevsim1): Releasing backup interface [ 243.962251][T10810] bond0 (unregistering): Released all slaves [ 244.043143][T10839] netlink: 'syz.0.1133': attribute type 2 has an invalid length. [ 244.043167][T10839] netlink: 40 bytes leftover after parsing attributes in process `syz.0.1133'. [ 244.091686][T10825] 8021q: adding VLAN 0 to HW filter on device bond0 [ 244.120073][T10825] bond1: (slave bond0): making interface the new active one [ 244.123872][T10825] bond1: (slave bond0): Enslaving as an active interface with an up link [ 244.169840][T10836] bond1 (unregistering): (slave bond0): Releasing backup interface [ 247.026590][T10836] bond1 (unregistering): Released all slaves [ 247.371096][T10839] : entered promiscuous mode [ 247.747602][T10857] __nla_validate_parse: 1 callbacks suppressed [ 247.747623][T10857] netlink: 12 bytes leftover after parsing attributes in process `syz.2.1139'. [ 247.754165][T10867] IPVS: set_ctl: invalid protocol: 58 172.20.20.187:20002 [ 247.778616][T10857] ipvlan3: entered allmulticast mode [ 247.778639][T10857] syz_tun: entered allmulticast mode [ 248.180198][T10890] netlink: 224 bytes leftover after parsing attributes in process `syz.0.1146'. [ 248.232621][T10888] bond1: option xmit_hash_policy: invalid value (10) [ 248.534322][T10888] bond1 (unregistering): Released all slaves [ 254.925720][ T52] Bluetooth: hci4: link tx timeout [ 254.925742][ T52] Bluetooth: hci4: killing stalled connection 10:aa:aa:aa:aa:aa [ 255.997327][ T1310] ieee802154 phy1 wpan1: encryption failed: -22 [ 256.962577][ T52] Bluetooth: hci4: command 0x0406 tx timeout [ 264.926784][T11011] netlink: 52 bytes leftover after parsing attributes in process `syz.4.1152'. [ 264.926820][T11011] netlink: 60 bytes leftover after parsing attributes in process `syz.4.1152'. [ 265.134375][T11013] netlink: 36 bytes leftover after parsing attributes in process `syz.3.1151'. [ 265.191053][T11011] sctp: [Deprecated]: syz.4.1152 (pid 11011) Use of struct sctp_assoc_value in delayed_ack socket option. [ 265.191053][T11011] Use struct sctp_sack_info instead [ 265.300836][T11030] netlink: 12 bytes leftover after parsing attributes in process `syz.0.1153'. [ 265.734758][T11046] netlink: 256 bytes leftover after parsing attributes in process `syz.1.1157'. [ 265.776530][T11049] netlink: 224 bytes leftover after parsing attributes in process `syz.3.1158'. [ 266.193986][T11069] IPVS: sync thread started: state = MASTER, mcast_ifn = veth0, syncid = 1, id = 0 [ 266.205124][T11068] netlink: 'syz.0.1164': attribute type 15 has an invalid length. [ 266.208911][T11071] netlink: 'syz.0.1164': attribute type 15 has an invalid length. [ 266.404163][T11074] netlink: 28 bytes leftover after parsing attributes in process `syz.2.1165'. [ 266.505421][T11078] netlink: 'syz.1.1167': attribute type 16 has an invalid length. [ 266.505451][T11078] netlink: 156 bytes leftover after parsing attributes in process `syz.1.1167'. [ 267.560103][T11106] netlink: 8 bytes leftover after parsing attributes in process `syz.3.1174'. [ 267.624971][T11106] net_ratelimit: 4 callbacks suppressed [ 267.624995][T11106] openvswitch: netlink: Flow actions attr not present in new flow. [ 267.661810][T11106] netlink: 'syz.3.1174': attribute type 10 has an invalid length. [ 267.671785][T11106] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 267.693607][T11106] team0: Port device netdevsim1 added [ 267.963086][T11110] netlink: 68 bytes leftover after parsing attributes in process `syz.2.1175'. [ 268.226281][T11120] netlink: 'syz.3.1178': attribute type 1 has an invalid length. [ 268.226486][T11120] netlink: 'syz.3.1178': attribute type 1 has an invalid length. [ 268.226641][T11120] netlink: 'syz.3.1178': attribute type 1 has an invalid length. [ 268.226800][T11120] netlink: 'syz.3.1178': attribute type 1 has an invalid length. [ 268.226954][T11120] netlink: 'syz.3.1178': attribute type 1 has an invalid length. [ 268.227118][T11120] netlink: 'syz.3.1178': attribute type 1 has an invalid length. [ 268.677297][T11124] bond1: entered promiscuous mode [ 268.688978][T11124] 8021q: adding VLAN 0 to HW filter on device bond1 [ 268.823497][T11126] ip_tables: iptables: counters copy to user failed while replacing table [ 268.865340][T11124] bond1: (slave bridge4): making interface the new active one [ 268.865365][T11124] bridge4: entered promiscuous mode [ 268.869848][T11124] bond1: (slave bridge4): Enslaving as an active interface with an up link [ 269.147925][T11131] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 269.965767][T11168] gre1: entered promiscuous mode [ 270.934705][T11172] Bluetooth: hci1: Opcode 0x0c1a failed: -4 [ 270.934732][T11172] Bluetooth: hci1: Error when powering off device on rfkill (-4) [ 271.160651][T11172] Bluetooth: hci3: Opcode 0x0c1a failed: -4 [ 271.160679][T11172] Bluetooth: hci3: Error when powering off device on rfkill (-4) [ 271.282392][T11172] Bluetooth: hci2: Opcode 0x0c1a failed: -4 [ 271.282417][T11172] Bluetooth: hci2: Error when powering off device on rfkill (-4) [ 271.371434][T11172] Bluetooth: hci4: Opcode 0x0c1a failed: -4 [ 271.371459][T11172] Bluetooth: hci4: Error when powering off device on rfkill (-4) [ 271.722706][T11196] netlink: 12 bytes leftover after parsing attributes in process `syz.3.1197'. [ 271.722732][T11196] netlink: 20 bytes leftover after parsing attributes in process `syz.3.1197'. [ 272.023077][T11202] netlink: 4 bytes leftover after parsing attributes in process `syz.1.1201'. [ 272.023103][T11202] openvswitch: netlink: Flow key attribute not present in set flow. [ 272.283060][T11208] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 272.375154][T11209] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 272.756708][T11194] atm:do_vcc_ioctl: ATM_SETSC is obsolete; used by syz.4.1199:11194 [ 272.845796][T11219] netlink: 24 bytes leftover after parsing attributes in process `syz.3.1206'. [ 273.357237][T11230] FAULT_INJECTION: forcing a failure. [ 273.357237][T11230] name failslab, interval 1, probability 0, space 0, times 0 [ 273.357274][T11230] CPU: 0 UID: 0 PID: 11230 Comm: syz.1.1210 Not tainted syzkaller #0 PREEMPT(full) [ 273.357296][T11230] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 273.357308][T11230] Call Trace: [ 273.357316][T11230] [ 273.357325][T11230] dump_stack_lvl+0xe8/0x150 [ 273.357385][T11230] should_fail_ex+0x410/0x560 [ 273.357414][T11230] ? __alloc_skb+0x1db/0x7a0 [ 273.357439][T11230] should_failslab+0xa8/0x100 [ 273.357466][T11230] ? __alloc_skb+0x1db/0x7a0 [ 273.357489][T11230] kmem_cache_alloc_node_noprof+0xa1/0x610 [ 273.357520][T11230] ? __alloc_skb+0x18d/0x7a0 [ 273.357544][T11230] ? __alloc_skb+0x1db/0x7a0 [ 273.357575][T11230] __alloc_skb+0x1db/0x7a0 [ 273.357603][T11230] alloc_skb_with_frags+0xc6/0x760 [ 273.357641][T11230] sock_alloc_send_pskb+0x878/0x990 [ 273.357691][T11230] ? __pfx_sock_alloc_send_pskb+0x10/0x10 [ 273.357717][T11230] ? kasan_quarantine_put+0xbb/0x1f0 [ 273.357739][T11230] ? lockdep_hardirqs_on+0x7b/0x110 [ 273.357768][T11230] ? unix_dgram_sendmsg+0x5d7/0x17b0 [ 273.357788][T11230] ? kmem_cache_free+0x182/0x650 [ 273.357815][T11230] ? bpf_lsm_socket_getpeersec_dgram+0x9/0x20 [ 273.357845][T11230] unix_dgram_sendmsg+0x4da/0x17b0 [ 273.357868][T11230] ? __lock_acquire+0x747/0x2de0 [ 273.357907][T11230] ? __lock_acquire+0x747/0x2de0 [ 273.357928][T11230] ? __pfx_unix_dgram_sendmsg+0x10/0x10 [ 273.357954][T11230] ? aa_sock_msg_perm+0x129/0x210 [ 273.357983][T11230] ? unix_seqpacket_sendmsg+0x111/0x1e0 [ 273.358007][T11230] ? __pfx_unix_seqpacket_sendmsg+0x10/0x10 [ 273.358029][T11230] sock_sendmsg_nosec+0x13a/0x180 [ 273.358055][T11230] ____sys_sendmsg+0x54e/0x850 [ 273.358087][T11230] ? __pfx_____sys_sendmsg+0x10/0x10 [ 273.358125][T11230] ? import_iovec+0x73/0xa0 [ 273.358152][T11230] ___sys_sendmsg+0x2a5/0x360 [ 273.358178][T11230] ? __lock_acquire+0x747/0x2de0 [ 273.358201][T11230] ? __pfx____sys_sendmsg+0x10/0x10 [ 273.358224][T11230] ? __lock_acquire+0x747/0x2de0 [ 273.358249][T11230] ? kstrtouint+0x6e/0xe0 [ 273.358310][T11230] __sys_sendmmsg+0x273/0x4d0 [ 273.358339][T11230] ? __pfx___sys_sendmmsg+0x10/0x10 [ 273.358384][T11230] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 273.358427][T11230] ? ksys_write+0x242/0x270 [ 273.358457][T11230] ? __pfx_ksys_write+0x10/0x10 [ 273.358492][T11230] __x64_sys_sendmmsg+0xa0/0xc0 [ 273.358521][T11230] do_syscall_64+0x166/0x520 [ 273.358545][T11230] ? trace_irq_disable+0x3b/0x140 [ 273.358564][T11230] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 273.358584][T11230] ? clear_bhb_loop+0x70/0xc0 [ 273.358607][T11230] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 273.358626][T11230] RIP: 0033:0x7f165759e159 [ 273.358645][T11230] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 273.358661][T11230] RSP: 002b:00007f165845f028 EFLAGS: 00000246 ORIG_RAX: 0000000000000133 [ 273.358684][T11230] RAX: ffffffffffffffda RBX: 00007f1657825fa0 RCX: 00007f165759e159 [ 273.358698][T11230] RDX: 0000000004000190 RSI: 0000200000000180 RDI: 0000000000000003 [ 273.358711][T11230] RBP: 00007f165845f090 R08: 0000000000000000 R09: 0000000000000000 [ 273.358723][T11230] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 273.358735][T11230] R13: 00007f1657826038 R14: 00007f1657825fa0 R15: 00007ffc53e62a68 [ 273.358768][T11230] [ 273.387587][T11228] x_tables: ip6_tables: cgroup match: used from hooks PREROUTING, but only valid from INPUT/OUTPUT/POSTROUTING [ 273.574702][T11236] netlink: 8 bytes leftover after parsing attributes in process `syz.4.1212'. [ 273.986583][T11247] netlink: 48 bytes leftover after parsing attributes in process `syz.3.1215'. [ 274.162316][T11251] netlink: 224 bytes leftover after parsing attributes in process `syz.3.1215'. [ 274.372741][T11253] netlink: 40 bytes leftover after parsing attributes in process `syz.1.1217'. [ 274.414120][T11246] syzkaller0: entered promiscuous mode [ 274.414147][T11246] syzkaller0: entered allmulticast mode [ 274.712120][T11260] netlink: 8 bytes leftover after parsing attributes in process `syz.0.1216'. [ 274.712151][T11260] netlink: 8 bytes leftover after parsing attributes in process `syz.0.1216'. [ 275.280100][T11282] FAULT_INJECTION: forcing a failure. [ 275.280100][T11282] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 275.280136][T11282] CPU: 1 UID: 0 PID: 11282 Comm: syz.1.1223 Not tainted syzkaller #0 PREEMPT(full) [ 275.280159][T11282] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 275.280172][T11282] Call Trace: [ 275.280180][T11282] [ 275.280189][T11282] dump_stack_lvl+0xe8/0x150 [ 275.280224][T11282] should_fail_ex+0x410/0x560 [ 275.280254][T11282] _copy_from_user+0x2d/0xb0 [ 275.280281][T11282] ___sys_sendmsg+0x1c6/0x360 [ 275.280309][T11282] ? __lock_acquire+0x747/0x2de0 [ 275.280346][T11282] ? __pfx____sys_sendmsg+0x10/0x10 [ 275.280372][T11282] ? __lock_acquire+0x747/0x2de0 [ 275.280398][T11282] ? kstrtouint+0x6e/0xe0 [ 275.280463][T11282] __sys_sendmmsg+0x273/0x4d0 [ 275.280498][T11282] ? __pfx___sys_sendmmsg+0x10/0x10 [ 275.280542][T11282] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 275.280585][T11282] ? ksys_write+0x242/0x270 [ 275.280619][T11282] ? __pfx_ksys_write+0x10/0x10 [ 275.280656][T11282] __x64_sys_sendmmsg+0xa0/0xc0 [ 275.280686][T11282] do_syscall_64+0x166/0x520 [ 275.280712][T11282] ? trace_irq_disable+0x3b/0x140 [ 275.280732][T11282] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 275.280753][T11282] ? clear_bhb_loop+0x70/0xc0 [ 275.280778][T11282] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 275.280798][T11282] RIP: 0033:0x7f165759e159 [ 275.280819][T11282] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 275.280836][T11282] RSP: 002b:00007f165845f028 EFLAGS: 00000246 ORIG_RAX: 0000000000000133 [ 275.280858][T11282] RAX: ffffffffffffffda RBX: 00007f1657825fa0 RCX: 00007f165759e159 [ 275.280873][T11282] RDX: 0000000004000190 RSI: 0000200000000180 RDI: 0000000000000003 [ 275.280887][T11282] RBP: 00007f165845f090 R08: 0000000000000000 R09: 0000000000000000 [ 275.280899][T11282] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 275.280920][T11282] R13: 00007f1657826038 R14: 00007f1657825fa0 R15: 00007ffc53e62a68 [ 275.280954][T11282] [ 275.456474][T11283] validate_nla: 28 callbacks suppressed [ 275.456497][T11283] netlink: 'syz.4.1222': attribute type 6 has an invalid length. [ 275.456510][T11283] netlink: 'syz.4.1222': attribute type 5 has an invalid length. [ 276.663343][T11313] Cannot find set identified by id 65535 to match [ 277.002129][T11319] __nla_validate_parse: 5 callbacks suppressed [ 277.002156][T11319] netlink: 8 bytes leftover after parsing attributes in process `syz.0.1233'. [ 277.045706][T11318] netlink: 'syz.2.1234': attribute type 4 has an invalid length. [ 277.267687][T11322] A link change request failed with some changes committed already. Interface virt_wifi0 may have been left with an inconsistent configuration, please check. [ 277.459399][T11330] syzkaller0: entered promiscuous mode [ 277.459425][T11330] syzkaller0: entered allmulticast mode [ 277.470556][T11330] netlink: 32 bytes leftover after parsing attributes in process `syz.4.1236'. [ 277.470712][T11330] macsec0: left promiscuous mode [ 277.616499][T11334] x_tables: ip6_tables: cgroup match: used from hooks PREROUTING, but only valid from INPUT/OUTPUT/POSTROUTING [ 277.984768][T11339] netlink: 12 bytes leftover after parsing attributes in process `syz.0.1241'. [ 278.277250][T11352] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 278.356526][T11352] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 278.447856][T11354] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 278.525988][T11352] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 278.538445][T11357] Cannot find set identified by id 65535 to match [ 278.579286][T11352] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 278.805412][T11333] xt_policy: output policy not valid in PREROUTING and INPUT [ 278.858331][T11365] netlink: 24 bytes leftover after parsing attributes in process `syz.2.1246'. [ 279.293319][T11370] A link change request failed with some changes committed already. Interface virt_wifi0 may have been left with an inconsistent configuration, please check. [ 279.326085][T11373] veth0: entered promiscuous mode [ 279.326152][T11373] veth0: left promiscuous mode [ 279.752652][ T30] audit: type=1804 audit(1790484596.916:9): pid=11389 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=open_writers comm="syz.1.1250" name="/newroot/237/cgroup.controllers" dev="tmpfs" ino=1242 res=1 errno=0 [ 279.761462][ T30] audit: type=1800 audit(1790484596.926:10): pid=11389 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.1.1250" name="cgroup.controllers" dev="tmpfs" ino=1242 res=0 errno=0 [ 279.847917][T11389] No such timeout policy "syz0" [ 279.993686][T11375] smc: net device lo applied user defined pnetid SYZ0 [ 280.079223][T11396] netdevsim netdevsim3 netdevsim0: entered promiscuous mode [ 280.079445][T11396] A link change request failed with some changes committed already. Interface netdevsim0 may have been left with an inconsistent configuration, please check. [ 280.276826][T11398] tipc: Enabled bearer , priority 10 [ 280.327452][T11398] tipc: Enabling of bearer rejected, already enabled [ 280.816203][T11416] netlink: 4 bytes leftover after parsing attributes in process `syz.2.1257'. [ 280.834845][T11421] netlink: 8 bytes leftover after parsing attributes in process `syz.0.1259'. [ 280.869967][T11428] FAULT_INJECTION: forcing a failure. [ 280.869967][T11428] name failslab, interval 1, probability 0, space 0, times 0 [ 280.870003][T11428] CPU: 1 UID: 0 PID: 11428 Comm: syz.4.1260 Not tainted syzkaller #0 PREEMPT(full) [ 280.870026][T11428] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 280.870039][T11428] Call Trace: [ 280.870047][T11428] [ 280.870056][T11428] dump_stack_lvl+0xe8/0x150 [ 280.870093][T11428] should_fail_ex+0x410/0x560 [ 280.870121][T11428] ? __alloc_skb+0x1db/0x7a0 [ 280.870145][T11428] should_failslab+0xa8/0x100 [ 280.870173][T11428] ? __alloc_skb+0x1db/0x7a0 [ 280.870195][T11428] kmem_cache_alloc_node_noprof+0xa1/0x610 [ 280.870227][T11428] ? __alloc_skb+0x18d/0x7a0 [ 280.870252][T11428] ? __alloc_skb+0x1db/0x7a0 [ 280.870285][T11428] __alloc_skb+0x1db/0x7a0 [ 280.870315][T11428] alloc_skb_with_frags+0xc6/0x760 [ 280.870354][T11428] sock_alloc_send_pskb+0x878/0x990 [ 280.870406][T11428] ? __pfx_sock_alloc_send_pskb+0x10/0x10 [ 280.870434][T11428] ? kasan_quarantine_put+0xbb/0x1f0 [ 280.870455][T11428] ? lockdep_hardirqs_on+0x7b/0x110 [ 280.870487][T11428] ? unix_dgram_sendmsg+0x5d7/0x17b0 [ 280.870513][T11428] ? kmem_cache_free+0x182/0x650 [ 280.870535][T11428] ? bpf_lsm_socket_getpeersec_dgram+0x9/0x20 [ 280.870568][T11428] unix_dgram_sendmsg+0x4da/0x17b0 [ 280.870592][T11428] ? __lock_acquire+0x747/0x2de0 [ 280.870630][T11428] ? __lock_acquire+0x747/0x2de0 [ 280.870651][T11428] ? __pfx_unix_dgram_sendmsg+0x10/0x10 [ 280.870678][T11428] ? aa_sock_msg_perm+0x129/0x210 [ 280.870710][T11428] ? unix_seqpacket_sendmsg+0x111/0x1e0 [ 280.870736][T11428] ? __pfx_unix_seqpacket_sendmsg+0x10/0x10 [ 280.870758][T11428] sock_sendmsg_nosec+0x13a/0x180 [ 280.870784][T11428] ____sys_sendmsg+0x54e/0x850 [ 280.870819][T11428] ? __pfx_____sys_sendmsg+0x10/0x10 [ 280.870866][T11428] ? import_iovec+0x73/0xa0 [ 280.870897][T11428] ___sys_sendmsg+0x2a5/0x360 [ 280.870924][T11428] ? __lock_acquire+0x747/0x2de0 [ 280.870950][T11428] ? __pfx____sys_sendmsg+0x10/0x10 [ 280.870975][T11428] ? __lock_acquire+0x747/0x2de0 [ 280.871001][T11428] ? kstrtouint+0x6e/0xe0 [ 280.871068][T11428] __sys_sendmmsg+0x273/0x4d0 [ 280.871103][T11428] ? __pfx___sys_sendmmsg+0x10/0x10 [ 280.871142][T11428] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 280.871187][T11428] ? ksys_write+0x242/0x270 [ 280.871220][T11428] ? __pfx_ksys_write+0x10/0x10 [ 280.871258][T11428] __x64_sys_sendmmsg+0xa0/0xc0 [ 280.871289][T11428] do_syscall_64+0x166/0x520 [ 280.871315][T11428] ? trace_irq_disable+0x3b/0x140 [ 280.871335][T11428] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 280.871357][T11428] ? clear_bhb_loop+0x70/0xc0 [ 280.871382][T11428] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 280.871403][T11428] RIP: 0033:0x7f0b9a19e159 [ 280.871423][T11428] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 280.871439][T11428] RSP: 002b:00007f0b9b0a5028 EFLAGS: 00000246 ORIG_RAX: 0000000000000133 [ 280.871464][T11428] RAX: ffffffffffffffda RBX: 00007f0b9a425fa0 RCX: 00007f0b9a19e159 [ 280.871479][T11428] RDX: 0000000004000190 RSI: 0000200000000180 RDI: 0000000000000003 [ 280.871492][T11428] RBP: 00007f0b9b0a5090 R08: 0000000000000000 R09: 0000000000000000 [ 280.871505][T11428] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 280.871517][T11428] R13: 00007f0b9a426038 R14: 00007f0b9a425fa0 R15: 00007ffdd1327cf8 [ 280.871552][T11428] [ 281.201434][T11436] netlink: 'syz.2.1262': attribute type 5 has an invalid length. [ 281.372438][T11441] xt_ipcomp: unknown flags 1D [ 281.375001][ T9150] tipc: Node number set to 3532087664 [ 281.680583][T11448] netlink: 12 bytes leftover after parsing attributes in process `syz.3.1265'. [ 281.698475][T11449] netlink: 56 bytes leftover after parsing attributes in process `syz.2.1264'. [ 281.983412][T11461] netlink: 'syz.4.1268': attribute type 8 has an invalid length. [ 281.983440][T11461] netlink: 4 bytes leftover after parsing attributes in process `syz.4.1268'. [ 281.983474][T11461] netlink: 8 bytes leftover after parsing attributes in process `syz.4.1268'. [ 282.137121][T11449] netlink: 'syz.2.1264': attribute type 1 has an invalid length. [ 282.137207][T11449] netlink: 'syz.2.1264': attribute type 1 has an invalid length. [ 283.121988][T11507] netlink: 8 bytes leftover after parsing attributes in process `syz.2.1279'. [ 283.122015][T11507] netlink: 4 bytes leftover after parsing attributes in process `syz.2.1279'. [ 283.122040][T11507] netlink: 'syz.2.1279': attribute type 15 has an invalid length. [ 283.283154][T11515] netlink: 24 bytes leftover after parsing attributes in process `syz.1.1281'. [ 283.653315][T11530] ieee802154 phy1 wpan1: encryption failed: -22 [ 283.730534][T11532] netlink: 8 bytes leftover after parsing attributes in process `syz.4.1282'. [ 283.730566][T11532] netlink: 8 bytes leftover after parsing attributes in process `syz.4.1282'. [ 283.908167][T11538] netlink: 224 bytes leftover after parsing attributes in process `syz.3.1285'. [ 284.323279][T11526] bridge0: port 2(bridge_slave_1) entered disabled state [ 284.323623][T11526] bridge0: port 1(bridge_slave_0) entered disabled state [ 284.934070][T11526] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 284.991101][T11526] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 285.560833][ T6292] netdevsim netdevsim4 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 285.560885][ T6292] netdevsim netdevsim4 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 285.560920][ T6292] netdevsim netdevsim4 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 285.574599][ T1149] netdevsim netdevsim4 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 285.990697][T11573] x_tables: ip6_tables: cgroup match: used from hooks PREROUTING, but only valid from INPUT/OUTPUT/POSTROUTING [ 286.387678][T11587] Cannot find set identified by id 65535 to match [ 287.504400][T11623] netlink: 'syz.3.1302': attribute type 10 has an invalid length. [ 287.567660][T11623] team0: Port device dummy0 added [ 287.570843][T11636] netlink: 'syz.3.1302': attribute type 10 has an invalid length. [ 287.648635][T11636] team0: Port device dummy0 removed [ 287.836922][T11638] x_tables: ip6_tables: cgroup match: used from hooks PREROUTING, but only valid from INPUT/OUTPUT/POSTROUTING [ 288.993753][T11693] Cannot find set identified by id 65535 to match [ 290.092520][T11743] x_tables: ip6_tables: cgroup match: used from hooks PREROUTING, but only valid from INPUT/OUTPUT/POSTROUTING [ 290.304331][T11746] netlink: 36 bytes leftover after parsing attributes in process `syz.4.1317'. [ 290.683695][T11762] syzkaller0: entered promiscuous mode [ 290.683721][T11762] syzkaller0: entered allmulticast mode [ 291.160987][T11778] netlink: 'syz.0.1324': attribute type 21 has an invalid length. [ 291.429241][T11783] bond4 (unregistering): Released all slaves [ 291.925535][T11790] bond4 (unregistering): Released all slaves [ 292.065111][T11800] syzkaller1: tun_chr_ioctl cmd 1074025673 [ 292.065181][T11801] syzkaller1: tun_chr_ioctl cmd 1074025677 [ 292.065283][T11801] syzkaller1: linktype set to 776 [ 292.065534][T11802] syzkaller1: tun_chr_ioctl cmd 1074025677 [ 292.065610][T11802] syzkaller1: linktype set to 776 [ 292.070372][T11805] netlink: 7 bytes leftover after parsing attributes in process `syz.4.1327'. [ 292.070400][T11805] netlink: 1 bytes leftover after parsing attributes in process `syz.4.1327'. [ 292.070417][T11805] netlink: 1 bytes leftover after parsing attributes in process `syz.4.1327'. [ 292.083240][T11812] Unsupported ieee802154 address type: 0 [ 292.263774][T11806] netlink: 'syz.0.1328': attribute type 1 has an invalid length. [ 292.279298][T11808] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 292.597177][T11821] netlink: 'syz.1.1333': attribute type 39 has an invalid length. [ 292.627792][T11825] FAULT_INJECTION: forcing a failure. [ 292.627792][T11825] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 292.627830][T11825] CPU: 0 UID: 0 PID: 11825 Comm: syz.0.1332 Not tainted syzkaller #0 PREEMPT(full) [ 292.627854][T11825] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 292.627866][T11825] Call Trace: [ 292.627874][T11825] [ 292.627884][T11825] dump_stack_lvl+0xe8/0x150 [ 292.627919][T11825] should_fail_ex+0x410/0x560 [ 292.627950][T11825] _copy_from_user+0x2d/0xb0 [ 292.627978][T11825] ___sys_sendmsg+0x1c6/0x360 [ 292.628005][T11825] ? __lock_acquire+0x747/0x2de0 [ 292.628036][T11825] ? __pfx____sys_sendmsg+0x10/0x10 [ 292.628062][T11825] ? __lock_acquire+0x747/0x2de0 [ 292.628097][T11825] ? kstrtouint+0x6e/0xe0 [ 292.628164][T11825] __sys_sendmmsg+0x273/0x4d0 [ 292.628198][T11825] ? __pfx___sys_sendmmsg+0x10/0x10 [ 292.628238][T11825] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 292.628283][T11825] ? ksys_write+0x242/0x270 [ 292.628316][T11825] ? __pfx_ksys_write+0x10/0x10 [ 292.628354][T11825] __x64_sys_sendmmsg+0xa0/0xc0 [ 292.628385][T11825] do_syscall_64+0x166/0x520 [ 292.628411][T11825] ? trace_irq_disable+0x3b/0x140 [ 292.628431][T11825] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 292.628453][T11825] ? clear_bhb_loop+0x70/0xc0 [ 292.628478][T11825] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 292.628498][T11825] RIP: 0033:0x7f5fd4f9e159 [ 292.628518][T11825] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 292.628535][T11825] RSP: 002b:00007f5fd5da7028 EFLAGS: 00000246 ORIG_RAX: 0000000000000133 [ 292.628559][T11825] RAX: ffffffffffffffda RBX: 00007f5fd5225fa0 RCX: 00007f5fd4f9e159 [ 292.628573][T11825] RDX: 0000000004000190 RSI: 0000200000000180 RDI: 0000000000000003 [ 292.628586][T11825] RBP: 00007f5fd5da7090 R08: 0000000000000000 R09: 0000000000000000 [ 292.628599][T11825] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 292.628611][T11825] R13: 00007f5fd5226038 R14: 00007f5fd5225fa0 R15: 00007ffd00457b98 [ 292.628646][T11825] [ 292.930056][T11834] netlink: 'syz.0.1335': attribute type 1 has an invalid length. [ 292.930084][T11834] netlink: 'syz.0.1335': attribute type 2 has an invalid length. [ 293.305018][T11840] Cannot find set identified by id 65535 to match [ 293.491596][T11846] netlink: 40 bytes leftover after parsing attributes in process `syz.4.1340'. [ 293.898936][T11857] batman_adv: batadv0: Adding interface: dummy0 [ 293.898957][T11857] batman_adv: batadv0: The MTU of interface dummy0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 293.898985][T11857] batman_adv: batadv0: Not using interface dummy0 (retrying later): interface not active [ 293.971080][T11857] netlink: 16 bytes leftover after parsing attributes in process `syz.0.1344'. [ 294.703629][T11881] netlink: 8 bytes leftover after parsing attributes in process `syz.3.1350'. [ 294.826165][T11884] Cannot find set identified by id 65535 to match [ 294.905503][T11881] vlan3: entered allmulticast mode [ 294.905534][T11881] netdevsim netdevsim3 netdevsim0: entered allmulticast mode [ 295.374852][T11900] bond8: entered promiscuous mode [ 295.470599][T11902] bond9: entered promiscuous mode [ 295.525383][T11892] netlink: 36 bytes leftover after parsing attributes in process `syz.4.1354'. [ 295.558637][T11892] netlink: Conntrack attr has 8 unknown bytes [ 295.558679][T11892] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 295.592213][T11921] Set syz0 is full, maxelem 0 reached [ 295.633318][T11921] netlink: 36 bytes leftover after parsing attributes in process `syz.2.1358'. [ 295.956242][T11931] netlink: 4 bytes leftover after parsing attributes in process `syz.2.1361'. [ 295.968456][ T5725] dummy0: entered promiscuous mode [ 295.968793][T11931] macvtap1: entered allmulticast mode [ 295.968808][T11931] dummy0: entered allmulticast mode [ 295.984161][T11931] dummy0: left allmulticast mode [ 296.025212][T11932] netlink: 47 bytes leftover after parsing attributes in process `syz.2.1361'. [ 296.025241][T11932] netlink: 4 bytes leftover after parsing attributes in process `syz.2.1361'. [ 296.142427][T11934] netlink: 47 bytes leftover after parsing attributes in process `syz.2.1361'. [ 296.142455][T11934] netlink: 4 bytes leftover after parsing attributes in process `syz.2.1361'. [ 296.297291][ T5725] dummy0: left promiscuous mode [ 296.298275][T11926] netlink: 12 bytes leftover after parsing attributes in process `syz.4.1360'. [ 296.378714][ T5725] dummy0: entered promiscuous mode [ 296.382431][T11932] macvtap1: entered allmulticast mode [ 296.382452][T11932] dummy0: entered allmulticast mode [ 296.438508][T11932] dummy0: left allmulticast mode [ 296.611775][T11934] macvtap1: entered allmulticast mode [ 296.611804][T11934] dummy0: entered allmulticast mode [ 296.622427][T11934] dummy0: left allmulticast mode [ 296.791273][ T5725] dummy0: left promiscuous mode [ 296.991129][T11948] Cannot find set identified by id 65535 to match [ 297.129161][T11950] lo: entered allmulticast mode [ 297.129374][T11950] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 297.617177][T11976] sock: sock_timestamping_bind_phc: sock not bind to device [ 297.699596][T11965] x_tables: ip6_tables: cgroup match: used from hooks PREROUTING, but only valid from INPUT/OUTPUT/POSTROUTING [ 298.260972][T11988] netlink: 'syz.0.1372': attribute type 1 has an invalid length. [ 298.261029][T11988] netlink: 'syz.0.1372': attribute type 1 has an invalid length. [ 298.743228][T11999] netlink: 52 bytes leftover after parsing attributes in process `syz.1.1374'. [ 298.747794][T11999] netlink: 52 bytes leftover after parsing attributes in process `syz.1.1374'. [ 298.991460][T12001] bond2: (slave veth0_to_bond): Releasing active interface [ 299.021513][T12001] bond0: (slave bond_slave_0): Releasing backup interface [ 299.049514][T12001] bond0: (slave bond_slave_1): Releasing backup interface [ 299.050191][T12009] Cannot find set identified by id 65535 to match [ 299.170117][T12001] team0: Port device team_slave_0 removed [ 299.256044][T12001] team0: Port device team_slave_1 removed [ 299.277940][T12001] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 299.277968][T12001] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 299.286307][T12001] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 299.286329][T12001] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 299.328075][T12001] A link change request failed with some changes committed already. Interface hsr_slave_0 may have been left with an inconsistent configuration, please check. [ 299.473038][T12010] netlink: 'syz.0.1375': attribute type 1 has an invalid length. [ 299.484955][T12014] netlink: 'syz.0.1375': attribute type 1 has an invalid length. [ 299.882854][T12038] FAULT_INJECTION: forcing a failure. [ 299.882854][T12038] name failslab, interval 1, probability 0, space 0, times 0 [ 299.882890][T12038] CPU: 0 UID: 0 PID: 12038 Comm: syz.0.1381 Not tainted syzkaller #0 PREEMPT(full) [ 299.882913][T12038] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 299.882934][T12038] Call Trace: [ 299.882942][T12038] [ 299.882952][T12038] dump_stack_lvl+0xe8/0x150 [ 299.882987][T12038] should_fail_ex+0x410/0x560 [ 299.883016][T12038] ? __alloc_skb+0x1db/0x7a0 [ 299.883041][T12038] should_failslab+0xa8/0x100 [ 299.883068][T12038] ? __alloc_skb+0x1db/0x7a0 [ 299.883090][T12038] kmem_cache_alloc_node_noprof+0xa1/0x610 [ 299.883121][T12038] ? __alloc_skb+0x18d/0x7a0 [ 299.883151][T12038] ? __alloc_skb+0x1db/0x7a0 [ 299.883183][T12038] __alloc_skb+0x1db/0x7a0 [ 299.883213][T12038] alloc_skb_with_frags+0xc6/0x760 [ 299.883254][T12038] sock_alloc_send_pskb+0x878/0x990 [ 299.883305][T12038] ? __pfx_sock_alloc_send_pskb+0x10/0x10 [ 299.883333][T12038] ? kasan_quarantine_put+0xbb/0x1f0 [ 299.883354][T12038] ? lockdep_hardirqs_on+0x7b/0x110 [ 299.883385][T12038] ? unix_dgram_sendmsg+0x5d7/0x17b0 [ 299.883406][T12038] ? kmem_cache_free+0x182/0x650 [ 299.883427][T12038] ? bpf_lsm_socket_getpeersec_dgram+0x9/0x20 [ 299.883459][T12038] unix_dgram_sendmsg+0x4da/0x17b0 [ 299.883482][T12038] ? __lock_acquire+0x747/0x2de0 [ 299.883511][T12038] ? __lock_acquire+0x747/0x2de0 [ 299.883535][T12038] ? __lock_acquire+0x747/0x2de0 [ 299.883553][T12038] ? __pfx_unix_dgram_sendmsg+0x10/0x10 [ 299.883577][T12038] ? aa_sock_msg_perm+0x129/0x210 [ 299.883607][T12038] ? unix_seqpacket_sendmsg+0x111/0x1e0 [ 299.883630][T12038] ? __pfx_unix_seqpacket_sendmsg+0x10/0x10 [ 299.883650][T12038] sock_sendmsg_nosec+0x13a/0x180 [ 299.883674][T12038] ____sys_sendmsg+0x54e/0x850 [ 299.883706][T12038] ? __pfx_____sys_sendmsg+0x10/0x10 [ 299.883742][T12038] ? import_iovec+0x73/0xa0 [ 299.883770][T12038] ___sys_sendmsg+0x2a5/0x360 [ 299.883795][T12038] ? __lock_acquire+0x747/0x2de0 [ 299.883818][T12038] ? __pfx____sys_sendmsg+0x10/0x10 [ 299.883841][T12038] ? __lock_acquire+0x747/0x2de0 [ 299.883866][T12038] ? kstrtouint+0x6e/0xe0 [ 299.883937][T12038] __sys_sendmmsg+0x273/0x4d0 [ 299.883971][T12038] ? __pfx___sys_sendmmsg+0x10/0x10 [ 299.884007][T12038] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 299.884051][T12038] ? ksys_write+0x242/0x270 [ 299.884083][T12038] ? __pfx_ksys_write+0x10/0x10 [ 299.884119][T12038] __x64_sys_sendmmsg+0xa0/0xc0 [ 299.884150][T12038] do_syscall_64+0x166/0x520 [ 299.884175][T12038] ? trace_irq_disable+0x3b/0x140 [ 299.884196][T12038] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 299.884216][T12038] ? clear_bhb_loop+0x70/0xc0 [ 299.884241][T12038] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 299.884261][T12038] RIP: 0033:0x7f5fd4f9e159 [ 299.884280][T12038] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 299.884297][T12038] RSP: 002b:00007f5fd5da7028 EFLAGS: 00000246 ORIG_RAX: 0000000000000133 [ 299.884319][T12038] RAX: ffffffffffffffda RBX: 00007f5fd5225fa0 RCX: 00007f5fd4f9e159 [ 299.884334][T12038] RDX: 0000000004000190 RSI: 0000200000000180 RDI: 0000000000000003 [ 299.884347][T12038] RBP: 00007f5fd5da7090 R08: 0000000000000000 R09: 0000000000000000 [ 299.884359][T12038] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 299.884372][T12038] R13: 00007f5fd5226038 R14: 00007f5fd5225fa0 R15: 00007ffd00457b98 [ 299.884405][T12038] [ 300.851351][T12059] syzkaller0: entered promiscuous mode [ 300.851377][T12059] syzkaller0: entered allmulticast mode [ 300.857610][T12075] Cannot find set identified by id 65535 to match [ 300.946676][T12079] __nla_validate_parse: 5 callbacks suppressed [ 300.946698][T12079] netlink: 76 bytes leftover after parsing attributes in process `syz.3.1387'. [ 301.114057][T12082] x_tables: ip6_tables: cgroup match: used from hooks PREROUTING, but only valid from INPUT/OUTPUT/POSTROUTING [ 302.679469][T12107] netlink: 24 bytes leftover after parsing attributes in process `syz.1.1393'. [ 303.256792][T12117] netlink: 'syz.4.1395': attribute type 4 has an invalid length. [ 305.458523][T12128] FAULT_INJECTION: forcing a failure. [ 305.458523][T12128] name failslab, interval 1, probability 0, space 0, times 0 [ 305.458560][T12128] CPU: 1 UID: 0 PID: 12128 Comm: syz.2.1396 Not tainted syzkaller #0 PREEMPT(full) [ 305.458583][T12128] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 305.458595][T12128] Call Trace: [ 305.458603][T12128] [ 305.458612][T12128] dump_stack_lvl+0xe8/0x150 [ 305.458651][T12128] should_fail_ex+0x410/0x560 [ 305.458680][T12128] ? __alloc_skb+0x1db/0x7a0 [ 305.458704][T12128] should_failslab+0xa8/0x100 [ 305.458730][T12128] ? __alloc_skb+0x1db/0x7a0 [ 305.458752][T12128] kmem_cache_alloc_node_noprof+0xa1/0x610 [ 305.458783][T12128] ? __alloc_skb+0x18d/0x7a0 [ 305.458808][T12128] ? __alloc_skb+0x1db/0x7a0 [ 305.458839][T12128] __alloc_skb+0x1db/0x7a0 [ 305.458869][T12128] alloc_skb_with_frags+0xc6/0x760 [ 305.458908][T12128] sock_alloc_send_pskb+0x878/0x990 [ 305.458959][T12128] ? __pfx_sock_alloc_send_pskb+0x10/0x10 [ 305.458996][T12128] ? kasan_quarantine_put+0xbb/0x1f0 [ 305.459017][T12128] ? lockdep_hardirqs_on+0x7b/0x110 [ 305.459048][T12128] ? unix_dgram_sendmsg+0x5d7/0x17b0 [ 305.459069][T12128] ? kmem_cache_free+0x182/0x650 [ 305.459091][T12128] ? bpf_lsm_socket_getpeersec_dgram+0x9/0x20 [ 305.459122][T12128] unix_dgram_sendmsg+0x4da/0x17b0 [ 305.459147][T12128] ? __lock_acquire+0x747/0x2de0 [ 305.459176][T12128] ? __lock_acquire+0x747/0x2de0 [ 305.459202][T12128] ? __lock_acquire+0x747/0x2de0 [ 305.459222][T12128] ? __pfx_unix_dgram_sendmsg+0x10/0x10 [ 305.459248][T12128] ? aa_sock_msg_perm+0x129/0x210 [ 305.459281][T12128] ? unix_seqpacket_sendmsg+0x111/0x1e0 [ 305.459305][T12128] ? __pfx_unix_seqpacket_sendmsg+0x10/0x10 [ 305.459327][T12128] sock_sendmsg_nosec+0x13a/0x180 [ 305.459352][T12128] ____sys_sendmsg+0x54e/0x850 [ 305.459386][T12128] ? __pfx_____sys_sendmsg+0x10/0x10 [ 305.459425][T12128] ? import_iovec+0x73/0xa0 [ 305.459454][T12128] ___sys_sendmsg+0x2a5/0x360 [ 305.459480][T12128] ? __lock_acquire+0x747/0x2de0 [ 305.459505][T12128] ? __pfx____sys_sendmsg+0x10/0x10 [ 305.459530][T12128] ? __lock_acquire+0x747/0x2de0 [ 305.459557][T12128] ? kstrtouint+0x6e/0xe0 [ 305.459623][T12128] __sys_sendmmsg+0x273/0x4d0 [ 305.459658][T12128] ? __pfx___sys_sendmmsg+0x10/0x10 [ 305.459697][T12128] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 305.459741][T12128] ? ksys_write+0x242/0x270 [ 305.459775][T12128] ? __pfx_ksys_write+0x10/0x10 [ 305.459812][T12128] __x64_sys_sendmmsg+0xa0/0xc0 [ 305.459842][T12128] do_syscall_64+0x166/0x520 [ 305.459866][T12128] ? trace_irq_disable+0x3b/0x140 [ 305.459885][T12128] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 305.459904][T12128] ? clear_bhb_loop+0x70/0xc0 [ 305.460020][T12128] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 305.460056][T12128] RIP: 0033:0x7f469899e159 [ 305.460078][T12128] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 305.460095][T12128] RSP: 002b:00007f4699866028 EFLAGS: 00000246 ORIG_RAX: 0000000000000133 [ 305.460118][T12128] RAX: ffffffffffffffda RBX: 00007f4698c25fa0 RCX: 00007f469899e159 [ 305.460132][T12128] RDX: 0000000004000190 RSI: 0000200000000180 RDI: 0000000000000003 [ 305.460146][T12128] RBP: 00007f4699866090 R08: 0000000000000000 R09: 0000000000000000 [ 305.460158][T12128] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 305.460170][T12128] R13: 00007f4698c26038 R14: 00007f4698c25fa0 R15: 00007ffd370dfd38 [ 305.460204][T12128] [ 305.883168][T12139] Cannot find set identified by id 65535 to match [ 305.921710][T12146] IPVS: set_ctl: invalid protocol: 43 100.1.1.2:20000 [ 305.927569][T12144] tipc: Enabled bearer , priority 0 [ 305.937936][T12143] netlink: 12 bytes leftover after parsing attributes in process `syz.1.1402'. [ 305.970726][T12144] netlink: 'syz.3.1401': attribute type 1 has an invalid length. [ 306.220353][T12144] netlink: 'syz.3.1401': attribute type 1 has an invalid length. [ 306.242384][T12161] netlink: 28 bytes leftover after parsing attributes in process `syz.0.1405'. [ 306.242419][T12161] netlink: 28 bytes leftover after parsing attributes in process `syz.0.1405'. [ 306.274873][T12172] netlink: 'syz.1.1407': attribute type 2 has an invalid length. [ 306.275474][T12174] netlink: 'syz.1.1407': attribute type 2 has an invalid length. [ 306.328382][T12176] netlink: 28 bytes leftover after parsing attributes in process `syz.0.1405'. [ 306.328421][T12176] netlink: 28 bytes leftover after parsing attributes in process `syz.0.1405'. [ 306.372261][T12180] netlink: 8 bytes leftover after parsing attributes in process `syz.2.1404'. [ 306.483089][T12183] x_tables: ip6_tables: cgroup match: used from hooks PREROUTING, but only valid from INPUT/OUTPUT/POSTROUTING [ 306.804840][T12185] batman_adv: Cannot find parent device. Skipping batadv-on-batadv check for gretap1 [ 306.807260][T12185] batman_adv: batadv0: Adding interface: gretap1 [ 306.807276][T12185] batman_adv: batadv0: The MTU of interface gretap1 is too small (1462) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 306.807720][T12185] batman_adv: batadv0: Interface activated: gretap1 [ 306.876363][T12158] tipc: Enabling of bearer rejected, already enabled [ 307.124192][T12189] netlink: 12 bytes leftover after parsing attributes in process `syz.1.1409'. [ 307.152286][T12194] netlink: 8 bytes leftover after parsing attributes in process `syz.3.1410'. [ 307.194685][ C0] ip6_tunnel: ip6tnl1 xmit: Local address not yet configured! [ 307.373798][T12189] macvlan2: entered promiscuous mode [ 307.373824][T12189] macvlan2: entered allmulticast mode [ 307.390317][T12189] bond5: entered promiscuous mode [ 307.391103][T12189] 8021q: adding VLAN 0 to HW filter on device macvlan2 [ 307.454043][T12189] bond5: left promiscuous mode [ 307.819938][T12202] syzkaller0: entered promiscuous mode [ 307.819965][T12202] syzkaller0: entered allmulticast mode [ 307.891694][T12219] Cannot find set identified by id 65535 to match [ 307.986933][T12221] netlink: 4384 bytes leftover after parsing attributes in process `syz.0.1415'. [ 308.568713][T12244] syz.3.1418: vmalloc error: size 8589938688, exceeds total pages, mode:0x400dc0(GFP_KERNEL_ACCOUNT|__GFP_ZERO), nodemask=(null),cpuset=/,mems_allowed=0-1 [ 308.568825][T12244] CPU: 1 UID: 0 PID: 12244 Comm: syz.3.1418 Not tainted syzkaller #0 PREEMPT(full) [ 308.568859][T12244] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 308.568872][T12244] Call Trace: [ 308.568881][T12244] [ 308.568892][T12244] dump_stack_lvl+0xe8/0x150 [ 308.568930][T12244] warn_alloc+0x24d/0x270 [ 308.568954][T12244] ? kasan_save_track+0x4f/0x80 [ 308.568973][T12244] ? kasan_save_track+0x3e/0x80 [ 308.568997][T12244] ? __pfx_warn_alloc+0x10/0x10 [ 308.569016][T12244] ? __x64_sys_setsockopt+0x13d/0x1b0 [ 308.569044][T12244] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 308.569088][T12244] __vmalloc_node_range_noprof+0x127/0x1540 [ 308.569152][T12244] ? rcu_is_watching+0x16/0xb0 [ 308.569185][T12244] ? __pfx___vmalloc_node_range_noprof+0x10/0x10 [ 308.569220][T12244] ? __kmalloc_cache_noprof+0x321/0x600 [ 308.569243][T12244] ? __kmalloc_cache_noprof+0x14d/0x600 [ 308.569264][T12244] ? xskq_create+0x56/0x220 [ 308.569295][T12244] xskq_create+0x148/0x220 [ 308.569321][T12244] ? xsk_init_queue+0x8a/0xe0 [ 308.569348][T12244] xsk_init_queue+0x8a/0xe0 [ 308.569376][T12244] xsk_setsockopt+0x52a/0x960 [ 308.569404][T12244] ? __pfx_xsk_setsockopt+0x10/0x10 [ 308.569429][T12244] ? __pfx_aa_sk_perm+0x10/0x10 [ 308.569467][T12244] ? bpf_lsm_socket_setsockopt+0x9/0x20 [ 308.569493][T12244] ? __pfx_xsk_setsockopt+0x10/0x10 [ 308.569520][T12244] do_sock_setsockopt+0x17c/0x1b0 [ 308.569554][T12244] __x64_sys_setsockopt+0x13d/0x1b0 [ 308.569589][T12244] do_syscall_64+0x166/0x520 [ 308.569617][T12244] ? trace_irq_disable+0x3b/0x140 [ 308.569638][T12244] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 308.569659][T12244] ? clear_bhb_loop+0x70/0xc0 [ 308.569685][T12244] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 308.569706][T12244] RIP: 0033:0x7fa4b0f9e159 [ 308.569727][T12244] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 308.569745][T12244] RSP: 002b:00007fa4b1e79028 EFLAGS: 00000246 ORIG_RAX: 0000000000000036 [ 308.569767][T12244] RAX: ffffffffffffffda RBX: 00007fa4b1226540 RCX: 00007fa4b0f9e159 [ 308.569782][T12244] RDX: 0000000000000006 RSI: 000000000000011b RDI: 000000000000000b [ 308.569795][T12244] RBP: 00007fa4b103506b R08: 0000000000000004 R09: 0000000000000000 [ 308.569808][T12244] R10: 0000200000000000 R11: 0000000000000246 R12: 0000000000000000 [ 308.569822][T12244] R13: 00007fa4b12265d8 R14: 00007fa4b1226540 R15: 00007ffef2afa8c8 [ 308.569867][T12244] [ 308.573169][T12244] Mem-Info: [ 308.573182][T12244] active_anon:6273 inactive_anon:0 isolated_anon:0 [ 308.573182][T12244] active_file:0 inactive_file:43515 isolated_file:0 [ 308.573182][T12244] unevictable:0 dirty:130 writeback:0 [ 308.573182][T12244] slab_reclaimable:11166 slab_unreclaimable:106367 [ 308.573182][T12244] mapped:37778 shmem:529 pagetables:1614 [ 308.573182][T12244] sec_pagetables:0 bounce:0 [ 308.573182][T12244] kernel_misc_reclaimable:0 [ 308.573182][T12244] free:1282241 free_pcp:8851 free_cma:0 [ 308.573235][T12244] Node 0 active_anon:25092kB inactive_anon:0kB active_file:0kB inactive_file:173852kB unevictable:0kB isolated(anon):0kB isolated(file):0kB mapped:151112kB dirty:520kB writeback:0kB shmem:2116kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB kernel_stack:14584kB pagetables:6328kB sec_pagetables:0kB all_unreclaimable? no Balloon:0kB gpu_active:0kB gpu_reclaim:0kB [ 308.573291][T12244] Node 1 active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:208kB unevictable:0kB isolated(anon):0kB isolated(file):0kB mapped:0kB dirty:0kB writeback:0kB shmem:0kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB kernel_stack:96kB pagetables:128kB sec_pagetables:0kB all_unreclaimable? no Balloon:0kB gpu_active:0kB gpu_reclaim:0kB [ 308.573341][T12244] Node 0 DMA free:15360kB boost:0kB min:208kB low:260kB high:312kB reserved_highatomic:0kB free_highatomic:0kB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB zspages:0kB present:15992kB managed:15360kB mlocked:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB [ 308.573403][T12244] lowmem_reserve[]: 0 2487 2487 2487 2487 [ 308.573446][T12244] Node 0 DMA32 free:1170980kB boost:0kB min:34140kB low:42672kB high:51204kB reserved_highatomic:0kB free_highatomic:0kB active_anon:25092kB inactive_anon:0kB active_file:0kB inactive_file:173852kB unevictable:0kB writepending:520kB zspages:0kB present:3129332kB managed:2546840kB mlocked:0kB bounce:0kB free_pcp:35404kB local_pcp:17252kB free_cma:0kB [ 308.573508][T12244] lowmem_reserve[]: 0 0 0 0 0 [ 308.573558][T12244] Node 0 Normal free:0kB boost:0kB min:0kB low:0kB high:0kB reserved_highatomic:0kB free_highatomic:0kB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB zspages:0kB present:1048580kB managed:0kB mlocked:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB [ 308.573612][T12244] lowmem_reserve[]: 0 0 0 0 0 [ 308.573651][T12244] Node 1 Normal free:3942624kB boost:0kB min:55760kB low:69700kB high:83640kB reserved_highatomic:0kB free_highatomic:0kB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:208kB unevictable:0kB writepending:0kB zspages:0kB present:4194300kB managed:4111104kB mlocked:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB [ 308.573709][T12244] lowmem_reserve[]: 0 0 0 0 0 [ 308.573745][T12244] Node 0 DMA: 0*4kB 0*8kB 0*16kB 0*32kB 0*64kB 0*128kB 0*256kB 0*512kB 1*1024kB (U) 1*2048kB (M) 3*4096kB (M) = 15360kB [ 308.573880][T12244] Node 0 DMA32: 1121*4kB (UME) 718*8kB (UM) 337*16kB (UM) 91*32kB (UME) 90*64kB (UM) 23*128kB (UM) 17*256kB (UM) 5*512kB (UM) 6*1024kB (UME) 6*2048kB (UME) 273*4096kB (UM) = 1170788kB [ 308.574072][T12244] Node 0 Normal: 0*4kB 0*8kB 0*16kB 0*32kB 0*64kB 0*128kB 0*256kB 0*512kB 0*1024kB 0*2048kB 0*4096kB = 0kB [ 308.577168][T12244] Node 1 Normal: 2*4kB (UM) 1*8kB (M) 7*16kB (UM) 9*32kB (UM) 7*64kB (UM) 1*128kB (M) 5*256kB (UM) 4*512kB (UM) 2*1024kB (UM) 0*2048kB 961*4096kB (M) = 3942624kB [ 308.577315][T12244] Node 0 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 308.577330][T12244] Node 0 hugepages_total=2 hugepages_free=2 hugepages_surp=0 hugepages_size=2048kB [ 308.577345][T12244] Node 1 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 308.577359][T12244] Node 1 hugepages_total=2 hugepages_free=2 hugepages_surp=0 hugepages_size=2048kB [ 308.577374][T12244] 44040 total pagecache pages [ 308.577382][T12244] 0 pages in swap cache [ 308.577389][T12244] Free swap = 124996kB [ 308.577396][T12244] Total swap = 124996kB [ 308.577403][T12244] 2097051 pages RAM [ 308.577410][T12244] 0 pages HighMem/MovableOnly [ 308.577431][T12244] 428725 pages reserved [ 308.577439][T12244] 0 pages cma reserved [ 309.581336][T12254] x_tables: ip6_tables: cgroup match: used from hooks PREROUTING, but only valid from INPUT/OUTPUT/POSTROUTING [ 312.314692][ C1] openvswitch: cpu_id mismatch with handler threads [ 312.454215][T12261] netlink: 4 bytes leftover after parsing attributes in process `syz.4.1422'. [ 312.825163][T12268] netlink: 64 bytes leftover after parsing attributes in process `syz.4.1427'. [ 312.871295][T12268] syzkaller1: entered promiscuous mode [ 312.871321][T12268] syzkaller1: entered allmulticast mode [ 312.938806][T12268] netlink: zone id is out of range [ 312.938825][T12268] netlink: zone id is out of range [ 312.938834][T12268] netlink: zone id is out of range [ 312.938843][T12268] netlink: zone id is out of range [ 312.938851][T12268] netlink: zone id is out of range [ 312.938859][T12268] netlink: zone id is out of range [ 312.938872][T12268] netlink: zone id is out of range [ 312.938881][T12268] netlink: zone id is out of range [ 312.938888][T12268] netlink: zone id is out of range [ 312.938897][T12268] netlink: zone id is out of range [ 313.571574][T12296] netlink: 296 bytes leftover after parsing attributes in process `syz.3.1432'. [ 313.930206][T12302] x_tables: ip6_tables: cgroup match: used from hooks PREROUTING, but only valid from INPUT/OUTPUT/POSTROUTING [ 314.362411][T12314] Cannot find del_set index 3 as target [ 314.381675][T12315] Cannot find del_set index 3 as target [ 314.830303][T12332] netlink: 5 bytes leftover after parsing attributes in process `syz.0.1438'. [ 314.830389][T12332] netlink: 24 bytes leftover after parsing attributes in process `syz.0.1438'. [ 314.858016][T12336] netlink: 12 bytes leftover after parsing attributes in process `syz.4.1443'. [ 314.896574][T12336] tipc: Enabling of bearer rejected, failed to enable media [ 315.150042][T12343] bond6: option primary: mode dependency failed, not supported in mode balance-rr(0) [ 315.173130][T12343] bond6 (unregistering): Released all slaves [ 315.579527][T12355] netlink: 36 bytes leftover after parsing attributes in process `syz.4.1446'. [ 315.811945][T12362] netlink: 36 bytes leftover after parsing attributes in process `syz.3.1447'. [ 316.349752][T12389] netlink: 8 bytes leftover after parsing attributes in process `syz.0.1453'. [ 316.696275][T12391] lo: left allmulticast mode [ 317.439488][ T1310] ieee802154 phy1 wpan1: encryption failed: -22 [ 317.652939][T12415] netlink: 'syz.4.1458': attribute type 1 has an invalid length. [ 318.765899][T12402] IPv6: sit1: Disabled Multicast RS [ 318.770599][T12415] workqueue: Failed to create a rescuer kthread for wq "bond0": -EINTR [ 318.992083][T12427] netlink: 36 bytes leftover after parsing attributes in process `syz.0.1461'. [ 319.012891][ T13] netdevsim netdevsim2 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 319.014266][ T13] netdevsim netdevsim2 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 319.014635][ T6291] netdevsim netdevsim2 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 319.014673][ T6291] netdevsim netdevsim2 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 319.071674][T12432] net_ratelimit: 1709 callbacks suppressed [ 319.071697][T12432] netlink: Conntrack attr has 8 unknown bytes [ 319.071728][T12432] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 319.213410][T12434] netlink: 'syz.2.1460': attribute type 21 has an invalid length. [ 319.213438][T12434] netlink: 8 bytes leftover after parsing attributes in process `syz.2.1460'. [ 319.213465][T12434] bond0: option lacp_rate: mode dependency failed, not supported in mode balance-rr(0) [ 319.228578][T12434] netlink: 132 bytes leftover after parsing attributes in process `syz.2.1460'. [ 319.380176][T12442] netlink: 68 bytes leftover after parsing attributes in process `syz.4.1463'. [ 319.515930][T12444] batman_adv: batadv0: Adding interface: syzkaller0 [ 319.515951][T12444] batman_adv: batadv0: The MTU of interface syzkaller0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 319.515982][T12444] batman_adv: batadv0: Interface activated: syzkaller0 [ 319.678709][T12443] batman_adv: batadv0: Interface deactivated: syzkaller0 [ 320.237833][T12443] batman_adv: batadv0: Removing interface: syzkaller0 [ 320.340766][ T5279] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 320.767553][T12475] netlink: 260 bytes leftover after parsing attributes in process `syz.0.1471'. [ 320.941367][T12496] ip_tables: iptables: counters copy to user failed while replacing table [ 321.505023][T12504] netlink: 36 bytes leftover after parsing attributes in process `syz.0.1476'. [ 321.507800][T12504] netlink: Conntrack attr has 8 unknown bytes [ 321.507838][T12504] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 321.730907][T12511] nbd: must specify at least one socket [ 321.793627][T12514] netlink: 'syz.2.1480': attribute type 15 has an invalid length. [ 321.793653][T12514] netlink: 'syz.2.1480': attribute type 7 has an invalid length. [ 321.793666][T12514] netlink: 52 bytes leftover after parsing attributes in process `syz.2.1480'. [ 321.830706][T12514] netlink: 'syz.2.1480': attribute type 6 has an invalid length. [ 321.830734][T12514] netlink: 8 bytes leftover after parsing attributes in process `syz.2.1480'. [ 322.045573][T12518] Cannot find set identified by id 65535 to match [ 322.250390][T12523] Timeout policy `syz1' can only be used by L3 protocol number 35061 [ 322.833885][T12539] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 323.138732][T12543] syzkaller0: entered promiscuous mode [ 323.138762][T12543] syzkaller0: entered allmulticast mode [ 323.174687][ T6291] IPVS: starting estimator thread 0... [ 323.264918][T12551] IPVS: using max 24 ests per chain, 57600 per kthread [ 323.380704][T12558] netlink: 12 bytes leftover after parsing attributes in process `syz.4.1491'. [ 323.548303][T12546] netlink: 4 bytes leftover after parsing attributes in process `syz.0.1490'. [ 323.552342][T12554] gre0: entered promiscuous mode [ 323.552369][T12554] gre0: entered allmulticast mode [ 323.891927][T12569] netlink: 'syz.0.1494': attribute type 4 has an invalid length. [ 324.744922][T12588] netlink: 'syz.4.1499': attribute type 1 has an invalid length. [ 327.584906][T12598] netlink: Unknown nat attribute (0) [ 327.584957][T12598] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 327.717297][T12607] __nla_validate_parse: 1 callbacks suppressed [ 327.717321][T12607] netlink: 40 bytes leftover after parsing attributes in process `syz.0.1503'. [ 327.718577][T12604] netlink: 12 bytes leftover after parsing attributes in process `syz.2.1501'. [ 327.842276][T12615] netlink: 184 bytes leftover after parsing attributes in process `syz.4.1505'. [ 328.099453][T12622] FAULT_INJECTION: forcing a failure. [ 328.099453][T12622] name failslab, interval 1, probability 0, space 0, times 0 [ 328.099489][T12622] CPU: 0 UID: 0 PID: 12622 Comm: syz.0.1506 Not tainted syzkaller #0 PREEMPT(full) [ 328.099511][T12622] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 328.099524][T12622] Call Trace: [ 328.099532][T12622] [ 328.099541][T12622] dump_stack_lvl+0xe8/0x150 [ 328.099575][T12622] should_fail_ex+0x410/0x560 [ 328.099605][T12622] should_failslab+0xa8/0x100 [ 328.099632][T12622] __kmalloc_noprof+0xfe/0x720 [ 328.099651][T12622] ? __kasan_kmalloc+0x93/0xb0 [ 328.099674][T12622] ? nla_strdup+0x9d/0x140 [ 328.099697][T12622] ? nla_strdup+0x9d/0x140 [ 328.099723][T12622] ? __kmalloc_cache_noprof+0x14d/0x600 [ 328.099749][T12622] nla_strdup+0x9d/0x140 [ 328.099777][T12622] nf_tables_newtable+0x49a/0x1990 [ 328.099829][T12622] nfnetlink_rcv+0x1288/0x28c0 [ 328.099898][T12622] ? __pfx_nfnetlink_rcv+0x10/0x10 [ 328.099990][T12622] ? lock_acquire+0x115/0x350 [ 328.100022][T12622] ? netlink_deliver_tap+0x2e/0x1b0 [ 328.100043][T12622] ? netlink_deliver_tap+0x2e/0x1b0 [ 328.100068][T12622] netlink_unicast+0x7bd/0x940 [ 328.100111][T12622] netlink_sendmsg+0x813/0xb40 [ 328.100142][T12622] ? __pfx_netlink_sendmsg+0x10/0x10 [ 328.100172][T12622] ? apparmor_socket_sendmsg+0x98/0x360 [ 328.100201][T12622] ? __pfx_netlink_sendmsg+0x10/0x10 [ 328.100220][T12622] sock_sendmsg_nosec+0x13a/0x180 [ 328.100246][T12622] ____sys_sendmsg+0x54e/0x850 [ 328.100278][T12622] ? __pfx_____sys_sendmsg+0x10/0x10 [ 328.100313][T12622] ? import_iovec+0x73/0xa0 [ 328.100343][T12622] ___sys_sendmsg+0x2a5/0x360 [ 328.100367][T12622] ? __lock_acquire+0x747/0x2de0 [ 328.100394][T12622] ? __pfx____sys_sendmsg+0x10/0x10 [ 328.100463][T12622] ? __fget_files+0x2a/0x420 [ 328.100488][T12622] ? __fget_files+0x3a2/0x420 [ 328.100528][T12622] __x64_sys_sendmsg+0x1b1/0x290 [ 328.100560][T12622] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 328.100615][T12622] do_syscall_64+0x166/0x520 [ 328.100641][T12622] ? trace_irq_disable+0x3b/0x140 [ 328.100661][T12622] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 328.100682][T12622] ? clear_bhb_loop+0x70/0xc0 [ 328.100708][T12622] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 328.100729][T12622] RIP: 0033:0x7f5fd4f9e159 [ 328.100749][T12622] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 328.100766][T12622] RSP: 002b:00007f5fd5da7028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 328.100790][T12622] RAX: ffffffffffffffda RBX: 00007f5fd5225fa0 RCX: 00007f5fd4f9e159 [ 328.100805][T12622] RDX: 0000000000000000 RSI: 00002000000000c0 RDI: 0000000000000003 [ 328.100818][T12622] RBP: 00007f5fd5da7090 R08: 0000000000000000 R09: 0000000000000000 [ 328.100830][T12622] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 328.100842][T12622] R13: 00007f5fd5226038 R14: 00007f5fd5225fa0 R15: 00007ffd00457b98 [ 328.100877][T12622] [ 328.913766][T12639] netlink: 24 bytes leftover after parsing attributes in process `syz.4.1510'. [ 329.353568][T12652] netlink: 12 bytes leftover after parsing attributes in process `syz.1.1514'. [ 329.484850][T12649] syzkaller0: entered promiscuous mode [ 329.484875][T12649] syzkaller0: entered allmulticast mode [ 329.618104][T12657] netlink: 8 bytes leftover after parsing attributes in process `syz.2.1516'. [ 330.252888][T12668] FAULT_INJECTION: forcing a failure. [ 330.252888][T12668] name failslab, interval 1, probability 0, space 0, times 0 [ 330.252925][T12668] CPU: 1 UID: 0 PID: 12668 Comm: syz.2.1519 Not tainted syzkaller #0 PREEMPT(full) [ 330.252948][T12668] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 330.252960][T12668] Call Trace: [ 330.252969][T12668] [ 330.252978][T12668] dump_stack_lvl+0xe8/0x150 [ 330.253013][T12668] should_fail_ex+0x410/0x560 [ 330.253044][T12668] should_failslab+0xa8/0x100 [ 330.253073][T12668] __kvmalloc_node_noprof+0x176/0x820 [ 330.253101][T12668] ? __rhashtable_init_noprof+0x545/0xaf0 [ 330.253123][T12668] ? __rhashtable_init_noprof+0x545/0xaf0 [ 330.253154][T12668] __rhashtable_init_noprof+0x545/0xaf0 [ 330.253183][T12668] __rhltable_init_noprof+0x26/0x70 [ 330.253209][T12668] nf_tables_newtable+0x6a7/0x1990 [ 330.253260][T12668] nfnetlink_rcv+0x1288/0x28c0 [ 330.253327][T12668] ? __pfx_nfnetlink_rcv+0x10/0x10 [ 330.253411][T12668] ? lock_acquire+0x115/0x350 [ 330.253443][T12668] ? netlink_deliver_tap+0x2e/0x1b0 [ 330.253464][T12668] ? netlink_deliver_tap+0x2e/0x1b0 [ 330.253491][T12668] netlink_unicast+0x7bd/0x940 [ 330.253532][T12668] netlink_sendmsg+0x813/0xb40 [ 330.253564][T12668] ? __pfx_netlink_sendmsg+0x10/0x10 [ 330.253594][T12668] ? apparmor_socket_sendmsg+0x98/0x360 [ 330.253620][T12668] ? __pfx_netlink_sendmsg+0x10/0x10 [ 330.253639][T12668] sock_sendmsg_nosec+0x13a/0x180 [ 330.253665][T12668] ____sys_sendmsg+0x54e/0x850 [ 330.253700][T12668] ? __pfx_____sys_sendmsg+0x10/0x10 [ 330.253743][T12668] ? import_iovec+0x73/0xa0 [ 330.253773][T12668] ___sys_sendmsg+0x2a5/0x360 [ 330.253807][T12668] ? __lock_acquire+0x747/0x2de0 [ 330.253834][T12668] ? __pfx____sys_sendmsg+0x10/0x10 [ 330.253902][T12668] ? __fget_files+0x2a/0x420 [ 330.253928][T12668] ? __fget_files+0x3a2/0x420 [ 330.253967][T12668] __x64_sys_sendmsg+0x1b1/0x290 [ 330.253998][T12668] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 330.254048][T12668] do_syscall_64+0x166/0x520 [ 330.254072][T12668] ? trace_irq_disable+0x3b/0x140 [ 330.254092][T12668] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 330.254113][T12668] ? clear_bhb_loop+0x70/0xc0 [ 330.254137][T12668] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 330.254155][T12668] RIP: 0033:0x7f469899e159 [ 330.254175][T12668] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 330.254190][T12668] RSP: 002b:00007f4699866028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 330.254214][T12668] RAX: ffffffffffffffda RBX: 00007f4698c25fa0 RCX: 00007f469899e159 [ 330.254229][T12668] RDX: 0000000000000000 RSI: 00002000000000c0 RDI: 0000000000000003 [ 330.254241][T12668] RBP: 00007f4699866090 R08: 0000000000000000 R09: 0000000000000000 [ 330.254254][T12668] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 330.254266][T12668] R13: 00007f4698c26038 R14: 00007f4698c25fa0 R15: 00007ffd370dfd38 [ 330.254298][T12668] [ 330.462291][T12676] netlink: 8 bytes leftover after parsing attributes in process `syz.3.1521'. [ 330.868727][T12682] netlink: 'syz.0.1524': attribute type 49 has an invalid length. [ 331.035022][T12663] xt_policy: output policy not valid in PREROUTING and INPUT [ 331.071937][T12687] FAULT_INJECTION: forcing a failure. [ 331.071937][T12687] name failslab, interval 1, probability 0, space 0, times 0 [ 331.071975][T12687] CPU: 1 UID: 0 PID: 12687 Comm: syz.2.1526 Not tainted syzkaller #0 PREEMPT(full) [ 331.071999][T12687] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 331.072012][T12687] Call Trace: [ 331.072020][T12687] [ 331.072030][T12687] dump_stack_lvl+0xe8/0x150 [ 331.072067][T12687] should_fail_ex+0x410/0x560 [ 331.072096][T12687] ? __alloc_skb+0x1db/0x7a0 [ 331.072121][T12687] should_failslab+0xa8/0x100 [ 331.072148][T12687] ? __alloc_skb+0x1db/0x7a0 [ 331.072170][T12687] kmem_cache_alloc_node_noprof+0xa1/0x610 [ 331.072202][T12687] ? __alloc_skb+0x18d/0x7a0 [ 331.072227][T12687] ? __alloc_skb+0x1db/0x7a0 [ 331.072259][T12687] __alloc_skb+0x1db/0x7a0 [ 331.072289][T12687] alloc_skb_with_frags+0xc6/0x760 [ 331.072329][T12687] sock_alloc_send_pskb+0x878/0x990 [ 331.072381][T12687] ? __pfx_sock_alloc_send_pskb+0x10/0x10 [ 331.072409][T12687] ? kasan_quarantine_put+0xbb/0x1f0 [ 331.072441][T12687] ? lockdep_hardirqs_on+0x7b/0x110 [ 331.072474][T12687] ? unix_dgram_sendmsg+0x5d7/0x17b0 [ 331.072499][T12687] ? kmem_cache_free+0x182/0x650 [ 331.072523][T12687] ? bpf_lsm_socket_getpeersec_dgram+0x9/0x20 [ 331.072555][T12687] unix_dgram_sendmsg+0x4da/0x17b0 [ 331.072578][T12687] ? __lock_acquire+0x747/0x2de0 [ 331.072608][T12687] ? __lock_acquire+0x747/0x2de0 [ 331.072636][T12687] ? __lock_acquire+0x747/0x2de0 [ 331.072656][T12687] ? __pfx_unix_dgram_sendmsg+0x10/0x10 [ 331.072683][T12687] ? aa_sock_msg_perm+0x129/0x210 [ 331.072715][T12687] ? unix_seqpacket_sendmsg+0x111/0x1e0 [ 331.072740][T12687] ? __pfx_unix_seqpacket_sendmsg+0x10/0x10 [ 331.072762][T12687] sock_sendmsg_nosec+0x13a/0x180 [ 331.072788][T12687] ____sys_sendmsg+0x54e/0x850 [ 331.072824][T12687] ? __pfx_____sys_sendmsg+0x10/0x10 [ 331.072864][T12687] ? import_iovec+0x73/0xa0 [ 331.072895][T12687] ___sys_sendmsg+0x2a5/0x360 [ 331.072921][T12687] ? __lock_acquire+0x747/0x2de0 [ 331.072947][T12687] ? __pfx____sys_sendmsg+0x10/0x10 [ 331.072972][T12687] ? __lock_acquire+0x747/0x2de0 [ 331.072999][T12687] ? kstrtouint+0x6e/0xe0 [ 331.073066][T12687] __sys_sendmmsg+0x273/0x4d0 [ 331.073102][T12687] ? __pfx___sys_sendmmsg+0x10/0x10 [ 331.073142][T12687] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 331.073186][T12687] ? ksys_write+0x242/0x270 [ 331.073220][T12687] ? __pfx_ksys_write+0x10/0x10 [ 331.073257][T12687] __x64_sys_sendmmsg+0xa0/0xc0 [ 331.073288][T12687] do_syscall_64+0x166/0x520 [ 331.073314][T12687] ? trace_irq_disable+0x3b/0x140 [ 331.073335][T12687] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 331.073356][T12687] ? clear_bhb_loop+0x70/0xc0 [ 331.073381][T12687] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 331.073402][T12687] RIP: 0033:0x7f469899e159 [ 331.073429][T12687] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 331.073446][T12687] RSP: 002b:00007f4699866028 EFLAGS: 00000246 ORIG_RAX: 0000000000000133 [ 331.073469][T12687] RAX: ffffffffffffffda RBX: 00007f4698c25fa0 RCX: 00007f469899e159 [ 331.073484][T12687] RDX: 0000000004000190 RSI: 0000200000000180 RDI: 0000000000000003 [ 331.073498][T12687] RBP: 00007f4699866090 R08: 0000000000000000 R09: 0000000000000000 [ 331.073511][T12687] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 331.073523][T12687] R13: 00007f4698c26038 R14: 00007f4698c25fa0 R15: 00007ffd370dfd38 [ 331.073557][T12687] [ 331.654024][T12688] gretap1: entered promiscuous mode [ 331.799771][T12709] sctp: [Deprecated]: syz.2.1530 (pid 12709) Use of int in max_burst socket option deprecated. [ 331.799771][T12709] Use struct sctp_assoc_value instead [ 332.054896][T12712] netlink: 4 bytes leftover after parsing attributes in process `syz.3.1531'. [ 332.054942][T12712] netlink: 4 bytes leftover after parsing attributes in process `syz.3.1531'. [ 332.156391][T12720] FAULT_INJECTION: forcing a failure. [ 332.156391][T12720] name failslab, interval 1, probability 0, space 0, times 0 [ 332.156438][T12720] CPU: 1 UID: 0 PID: 12720 Comm: syz.4.1533 Not tainted syzkaller #0 PREEMPT(full) [ 332.156462][T12720] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 332.156474][T12720] Call Trace: [ 332.156482][T12720] [ 332.156492][T12720] dump_stack_lvl+0xe8/0x150 [ 332.156528][T12720] should_fail_ex+0x410/0x560 [ 332.156559][T12720] should_failslab+0xa8/0x100 [ 332.156588][T12720] __kvmalloc_node_noprof+0x176/0x820 [ 332.156616][T12720] ? __rhashtable_init_noprof+0x545/0xaf0 [ 332.156639][T12720] ? __rhashtable_init_noprof+0x545/0xaf0 [ 332.156672][T12720] __rhashtable_init_noprof+0x545/0xaf0 [ 332.156701][T12720] __rhltable_init_noprof+0x26/0x70 [ 332.156728][T12720] nf_tables_newtable+0x6e0/0x1990 [ 332.156781][T12720] nfnetlink_rcv+0x1288/0x28c0 [ 332.156851][T12720] ? __pfx_nfnetlink_rcv+0x10/0x10 [ 332.156938][T12720] ? lock_acquire+0x115/0x350 [ 332.156972][T12720] ? netlink_deliver_tap+0x2e/0x1b0 [ 332.156993][T12720] ? netlink_deliver_tap+0x2e/0x1b0 [ 332.157026][T12720] netlink_unicast+0x7bd/0x940 [ 332.157069][T12720] netlink_sendmsg+0x813/0xb40 [ 332.157102][T12720] ? __pfx_netlink_sendmsg+0x10/0x10 [ 332.157134][T12720] ? apparmor_socket_sendmsg+0x98/0x360 [ 332.157161][T12720] ? __pfx_netlink_sendmsg+0x10/0x10 [ 332.157181][T12720] sock_sendmsg_nosec+0x13a/0x180 [ 332.157207][T12720] ____sys_sendmsg+0x54e/0x850 [ 332.157243][T12720] ? __pfx_____sys_sendmsg+0x10/0x10 [ 332.157283][T12720] ? import_iovec+0x73/0xa0 [ 332.157314][T12720] ___sys_sendmsg+0x2a5/0x360 [ 332.157342][T12720] ? __lock_acquire+0x747/0x2de0 [ 332.157369][T12720] ? __pfx____sys_sendmsg+0x10/0x10 [ 332.157450][T12720] ? __fget_files+0x2a/0x420 [ 332.157477][T12720] ? __fget_files+0x3a2/0x420 [ 332.157517][T12720] __x64_sys_sendmsg+0x1b1/0x290 [ 332.157549][T12720] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 332.157601][T12720] do_syscall_64+0x166/0x520 [ 332.157629][T12720] ? trace_irq_disable+0x3b/0x140 [ 332.157650][T12720] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 332.157671][T12720] ? clear_bhb_loop+0x70/0xc0 [ 332.157698][T12720] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 332.157718][T12720] RIP: 0033:0x7f0b9a19e159 [ 332.157739][T12720] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 332.157756][T12720] RSP: 002b:00007f0b9b0a5028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 332.157780][T12720] RAX: ffffffffffffffda RBX: 00007f0b9a425fa0 RCX: 00007f0b9a19e159 [ 332.157795][T12720] RDX: 0000000000000000 RSI: 00002000000000c0 RDI: 0000000000000003 [ 332.157809][T12720] RBP: 00007f0b9b0a5090 R08: 0000000000000000 R09: 0000000000000000 [ 332.157822][T12720] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 332.157833][T12720] R13: 00007f0b9a426038 R14: 00007f0b9a425fa0 R15: 00007ffdd1327cf8 [ 332.157869][T12720] [ 332.633473][T12726] tipc: Enabled bearer , priority 0 [ 332.633941][T12727] syzkaller0: entered promiscuous mode [ 332.633961][T12727] syzkaller0: entered allmulticast mode [ 332.666016][T12725] tipc: Resetting bearer [ 332.714349][T12723] tipc: Resetting bearer [ 332.745958][T12730] netlink: 'syz.2.1536': attribute type 11 has an invalid length. [ 332.745986][T12730] netlink: 'syz.2.1536': attribute type 4 has an invalid length. [ 332.746001][T12730] netlink: 224 bytes leftover after parsing attributes in process `syz.2.1536'. [ 332.824225][T12730] netlink: 8 bytes leftover after parsing attributes in process `syz.2.1536'. [ 332.835891][T12732] FAULT_INJECTION: forcing a failure. [ 332.835891][T12732] name failslab, interval 1, probability 0, space 0, times 0 [ 332.835924][T12732] CPU: 1 UID: 0 PID: 12732 Comm: syz.0.1537 Not tainted syzkaller #0 PREEMPT(full) [ 332.835947][T12732] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 332.835959][T12732] Call Trace: [ 332.835968][T12732] [ 332.835976][T12732] dump_stack_lvl+0xe8/0x150 [ 332.836011][T12732] should_fail_ex+0x410/0x560 [ 332.836040][T12732] ? __alloc_skb+0x1db/0x7a0 [ 332.836064][T12732] should_failslab+0xa8/0x100 [ 332.836091][T12732] ? __alloc_skb+0x1db/0x7a0 [ 332.836112][T12732] kmem_cache_alloc_node_noprof+0xa1/0x610 [ 332.836141][T12732] ? __alloc_skb+0x18d/0x7a0 [ 332.836164][T12732] ? __alloc_skb+0x1db/0x7a0 [ 332.836194][T12732] __alloc_skb+0x1db/0x7a0 [ 332.836223][T12732] alloc_skb_with_frags+0xc6/0x760 [ 332.836262][T12732] sock_alloc_send_pskb+0x878/0x990 [ 332.836310][T12732] ? __pfx_sock_alloc_send_pskb+0x10/0x10 [ 332.836336][T12732] ? kasan_quarantine_put+0xbb/0x1f0 [ 332.836357][T12732] ? lockdep_hardirqs_on+0x7b/0x110 [ 332.836385][T12732] ? unix_dgram_sendmsg+0x5d7/0x17b0 [ 332.836405][T12732] ? kmem_cache_free+0x182/0x650 [ 332.836439][T12732] ? bpf_lsm_socket_getpeersec_dgram+0x9/0x20 [ 332.836471][T12732] unix_dgram_sendmsg+0x4da/0x17b0 [ 332.836494][T12732] ? __lock_acquire+0x747/0x2de0 [ 332.836522][T12732] ? __lock_acquire+0x747/0x2de0 [ 332.836549][T12732] ? __lock_acquire+0x747/0x2de0 [ 332.836568][T12732] ? __pfx_unix_dgram_sendmsg+0x10/0x10 [ 332.836594][T12732] ? aa_sock_msg_perm+0x129/0x210 [ 332.836626][T12732] ? unix_seqpacket_sendmsg+0x111/0x1e0 [ 332.836651][T12732] ? __pfx_unix_seqpacket_sendmsg+0x10/0x10 [ 332.836672][T12732] sock_sendmsg_nosec+0x13a/0x180 [ 332.836697][T12732] ____sys_sendmsg+0x54e/0x850 [ 332.836731][T12732] ? __pfx_____sys_sendmsg+0x10/0x10 [ 332.836768][T12732] ? import_iovec+0x73/0xa0 [ 332.836797][T12732] ___sys_sendmsg+0x2a5/0x360 [ 332.836823][T12732] ? __lock_acquire+0x747/0x2de0 [ 332.836848][T12732] ? __pfx____sys_sendmsg+0x10/0x10 [ 332.836873][T12732] ? __lock_acquire+0x747/0x2de0 [ 332.836899][T12732] ? kstrtouint+0x6e/0xe0 [ 332.836962][T12732] __sys_sendmmsg+0x273/0x4d0 [ 332.836995][T12732] ? __pfx___sys_sendmmsg+0x10/0x10 [ 332.837031][T12732] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 332.837071][T12732] ? ksys_write+0x242/0x270 [ 332.837107][T12732] ? __pfx_ksys_write+0x10/0x10 [ 332.837145][T12732] __x64_sys_sendmmsg+0xa0/0xc0 [ 332.837175][T12732] do_syscall_64+0x166/0x520 [ 332.837202][T12732] ? trace_irq_disable+0x3b/0x140 [ 332.837222][T12732] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 332.837243][T12732] ? clear_bhb_loop+0x70/0xc0 [ 332.837268][T12732] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 332.837288][T12732] RIP: 0033:0x7f5fd4f9e159 [ 332.837309][T12732] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 332.837326][T12732] RSP: 002b:00007f5fd5da7028 EFLAGS: 00000246 ORIG_RAX: 0000000000000133 [ 332.837349][T12732] RAX: ffffffffffffffda RBX: 00007f5fd5225fa0 RCX: 00007f5fd4f9e159 [ 332.837364][T12732] RDX: 0000000004000190 RSI: 0000200000000180 RDI: 0000000000000003 [ 332.837378][T12732] RBP: 00007f5fd5da7090 R08: 0000000000000000 R09: 0000000000000000 [ 332.837391][T12732] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 332.837403][T12732] R13: 00007f5fd5226038 R14: 00007f5fd5225fa0 R15: 00007ffd00457b98 [ 332.837447][T12732] [ 332.838111][T12723] tipc: Disabling bearer [ 332.937778][T12730] netlink: 'syz.2.1536': attribute type 2 has an invalid length. [ 332.937803][T12730] netlink: 8 bytes leftover after parsing attributes in process `syz.2.1536'. [ 334.136947][T12772] FAULT_INJECTION: forcing a failure. [ 334.136947][T12772] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 334.136988][T12772] CPU: 0 UID: 0 PID: 12772 Comm: syz.2.1549 Not tainted syzkaller #0 PREEMPT(full) [ 334.137011][T12772] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 334.137023][T12772] Call Trace: [ 334.137032][T12772] [ 334.137041][T12772] dump_stack_lvl+0xe8/0x150 [ 334.137076][T12772] should_fail_ex+0x410/0x560 [ 334.137106][T12772] _copy_from_user+0x2d/0xb0 [ 334.137134][T12772] ___sys_sendmsg+0x1c6/0x360 [ 334.137171][T12772] ? __pfx____sys_sendmsg+0x10/0x10 [ 334.137196][T12772] ? __lock_acquire+0x747/0x2de0 [ 334.137273][T12772] __sys_sendmmsg+0x273/0x4d0 [ 334.137307][T12772] ? __pfx___sys_sendmmsg+0x10/0x10 [ 334.137346][T12772] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 334.137399][T12772] ? ksys_write+0x242/0x270 [ 334.137432][T12772] ? __pfx_ksys_write+0x10/0x10 [ 334.137469][T12772] __x64_sys_sendmmsg+0xa0/0xc0 [ 334.137499][T12772] do_syscall_64+0x166/0x520 [ 334.137525][T12772] ? trace_irq_disable+0x3b/0x140 [ 334.137545][T12772] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 334.137565][T12772] ? clear_bhb_loop+0x70/0xc0 [ 334.137590][T12772] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 334.137610][T12772] RIP: 0033:0x7f469899e159 [ 334.137630][T12772] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 334.137648][T12772] RSP: 002b:00007f4699866028 EFLAGS: 00000246 ORIG_RAX: 0000000000000133 [ 334.137671][T12772] RAX: ffffffffffffffda RBX: 00007f4698c25fa0 RCX: 00007f469899e159 [ 334.137686][T12772] RDX: 0000000004000190 RSI: 0000200000000180 RDI: 0000000000000003 [ 334.137699][T12772] RBP: 00007f4699866090 R08: 0000000000000000 R09: 0000000000000000 [ 334.137712][T12772] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 334.137724][T12772] R13: 00007f4698c26038 R14: 00007f4698c25fa0 R15: 00007ffd370dfd38 [ 334.137763][T12772] [ 334.186636][T12766] bond0: Removing last ns target with arp_interval on [ 334.693669][T12778] netlink: 'syz.2.1551': attribute type 1 has an invalid length. [ 334.693806][T12779] netlink: 'syz.2.1551': attribute type 1 has an invalid length. [ 334.717695][T12778] netlink: 'syz.2.1551': attribute type 1 has an invalid length. [ 334.806946][T12787] veth1_virt_wifi: entered promiscuous mode [ 334.997723][T12786] veth1_virt_wifi: left promiscuous mode [ 335.040390][T12790] netlink: 8 bytes leftover after parsing attributes in process `syz.2.1555'. [ 335.046010][T12790] syzkaller0: entered promiscuous mode [ 335.046032][T12790] syzkaller0: entered allmulticast mode [ 335.718455][T12813] ip6t_frag: unknown flags 4 [ 335.887081][T12817] netlink: 4 bytes leftover after parsing attributes in process `syz.4.1562'. [ 336.396175][T12825] syzkaller0: entered promiscuous mode [ 336.396204][T12825] syzkaller0: entered allmulticast mode [ 340.588678][T12865] netlink: 4384 bytes leftover after parsing attributes in process `syz.0.1574'. [ 340.821954][T12875] netlink: 12 bytes leftover after parsing attributes in process `syz.2.1576'. [ 340.959214][ T5635] block nbd0: Receive control failed (result -107) [ 341.143139][T12885] netlink: 32 bytes leftover after parsing attributes in process `syz.3.1579'. [ 341.244836][T12888] netlink: 52 bytes leftover after parsing attributes in process `syz.2.1580'. [ 341.613856][T12903] Bluetooth: hci0: unsupported parameter 5135 [ 341.613884][T12903] Bluetooth: hci0: unsupported parameter 8192 [ 341.613897][T12903] Bluetooth: hci0: unsupported parameter 5135 [ 341.613909][T12903] Bluetooth: hci0: unsupported parameter 8192 [ 342.894609][T12944] netlink: 12 bytes leftover after parsing attributes in process `syz.3.1593'. [ 342.894762][T12943] netlink: 68 bytes leftover after parsing attributes in process `syz.0.1590'. [ 343.019381][T12938] syzkaller0: entered promiscuous mode [ 343.019410][T12938] syzkaller0: entered allmulticast mode [ 343.298599][T12962] xt_hashlimit: overflow, try lower: 17592186044416/255 [ 343.900889][T12979] netlink: 220 bytes leftover after parsing attributes in process `syz.3.1603'. [ 347.391408][T12955] tipc: Enabling of bearer rejected, already enabled [ 347.691016][T12992] netlink: 132 bytes leftover after parsing attributes in process `syz.3.1605'. [ 347.750419][T12992] netlink: 20 bytes leftover after parsing attributes in process `syz.3.1605'. [ 347.766695][T12995] netlink: 4912 bytes leftover after parsing attributes in process `syz.4.1604'. [ 348.967897][T13038] netlink: 4 bytes leftover after parsing attributes in process `syz.1.1614'. [ 349.033167][T13040] netlink: 4 bytes leftover after parsing attributes in process `syz.1.1614'. [ 349.208087][T13038] netlink: 'syz.1.1614': attribute type 4 has an invalid length. [ 349.302458][T13052] netlink: 'syz.1.1614': attribute type 4 has an invalid length. [ 349.399552][T13043] tipc: Enabled bearer , priority 0 [ 349.630395][T13043] syzkaller0: entered promiscuous mode [ 349.630424][T13043] syzkaller0: entered allmulticast mode [ 349.630946][T13043] tipc: Resetting bearer [ 350.178324][ T6291] tipc: Resetting bearer [ 350.183312][T13041] tipc: Resetting bearer [ 355.280307][T13041] tipc: Disabling bearer [ 355.290872][T13066] netlink: 8 bytes leftover after parsing attributes in process `syz.0.1619'. [ 355.585728][T13098] xt_l2tp: invalid flags combination: 8 [ 355.594274][T13102] IPVS: set_ctl: invalid protocol: 12 10.1.1.0:20000 [ 355.740137][T13110] netlink: 4912 bytes leftover after parsing attributes in process `syz.4.1625'. [ 356.343034][T13127] netlink: 24 bytes leftover after parsing attributes in process `syz.1.1626'. [ 356.362746][T13125] netlink: 8 bytes leftover after parsing attributes in process `syz.2.1629'. [ 357.452368][T13179] syzkaller0: Caught tx_queue_len zero misconfig [ 358.742716][T13225] netlink: 8 bytes leftover after parsing attributes in process `syz.2.1644'. [ 358.742753][T13225] netlink: 'syz.2.1644': attribute type 30 has an invalid length. [ 358.840150][T13225] vxlan1: entered promiscuous mode [ 358.840177][T13225] vxlan1: entered allmulticast mode [ 358.845980][ T1168] netdevsim netdevsim2 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0 [ 358.846199][ T1168] netdevsim netdevsim2 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0 [ 358.846250][ T1168] netdevsim netdevsim2 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0 [ 358.875015][ T1168] netdevsim netdevsim2 netdevsim0: set [0, 0] type 1 family 0 port 8472 - 0 [ 358.955579][T13234] netlink: 48 bytes leftover after parsing attributes in process `syz.4.1647'. [ 359.051916][T13235] netlink: 8 bytes leftover after parsing attributes in process `syz.3.1646'. [ 359.051944][T13235] netlink: 4 bytes leftover after parsing attributes in process `syz.3.1646'. [ 359.138442][T13238] netlink: 4912 bytes leftover after parsing attributes in process `syz.1.1645'. [ 359.249687][T13235] netlink: 8 bytes leftover after parsing attributes in process `syz.3.1646'. [ 359.324780][ T6294] netdevsim netdevsim3 netdevsim0: set [0, 0] type 1 family 0 port 8472 - 0 [ 359.325230][T11673] netdevsim netdevsim3 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0 [ 359.343168][T11673] netdevsim netdevsim3 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0 [ 359.343210][T11673] netdevsim netdevsim3 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0 [ 359.430134][T13245] netlink: 'syz.4.1649': attribute type 6 has an invalid length. [ 359.674720][T13256] netlink: 'syz.4.1651': attribute type 1 has an invalid length. [ 359.674745][T13256] netlink: 'syz.4.1651': attribute type 2 has an invalid length. [ 360.761505][T13285] A link change request failed with some changes committed already. Interface 26±ÿ may have been left with an inconsistent configuration, please check. [ 361.177507][T13302] pimreg9: entered allmulticast mode [ 361.231054][T13290] ICMPv6: RA: ndisc_router_discovery failed to add default route [ 361.231264][T13290] ICMPv6: RA: ndisc_router_discovery failed to add default route [ 361.231454][T13290] ICMPv6: RA: ndisc_router_discovery failed to add default route [ 361.231640][T13290] ICMPv6: RA: ndisc_router_discovery failed to add default route [ 361.231843][T13290] ICMPv6: RA: ndisc_router_discovery failed to add default route [ 361.232032][T13290] ICMPv6: RA: ndisc_router_discovery failed to add default route [ 361.232222][T13290] ICMPv6: RA: ndisc_router_discovery failed to add default route [ 361.232410][T13290] ICMPv6: RA: ndisc_router_discovery failed to add default route [ 361.232662][T13290] ICMPv6: RA: ndisc_router_discovery failed to add default route [ 361.674038][T13315] __nla_validate_parse: 1 callbacks suppressed [ 361.674061][T13315] netlink: 36 bytes leftover after parsing attributes in process `syz.2.1667'. [ 361.981469][T13320] bond0: option lacp_rate: mode dependency failed, not supported in mode balance-rr(0) [ 362.026503][T13320] vlan2: entered allmulticast mode [ 362.026528][T13320] bond0: entered allmulticast mode [ 362.219882][T13325] netlink: 'syz.0.1671': attribute type 4 has an invalid length. [ 362.293006][T13327] bridge5: entered allmulticast mode [ 362.653237][T13336] Bluetooth: hci0: invalid length 0, exp 2 for type 23 [ 362.668707][T13336] netlink: 'syz.1.1674': attribute type 1 has an invalid length. [ 362.756460][T13337] netlink: 'syz.0.1673': attribute type 2 has an invalid length. [ 362.756488][T13337] netlink: 228 bytes leftover after parsing attributes in process `syz.0.1673'. [ 363.828196][T13369] batman_adv: batadv0: Adding interface: netdevsim0 [ 363.828218][T13369] batman_adv: batadv0: The MTU of interface netdevsim0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 363.828250][T13369] batman_adv: batadv0: Interface activated: netdevsim0 [ 364.613303][T13397] Cannot find set identified by id 65535 to match [ 364.939383][T13410] netlink: 40 bytes leftover after parsing attributes in process `syz.0.1694'. [ 364.970403][T13410] netlink: 'syz.0.1694': attribute type 23 has an invalid length. [ 365.771015][T13425] net_ratelimit: 46 callbacks suppressed [ 365.771041][T13425] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 365.800431][T13425] bond10: option primary: mode dependency failed, not supported in mode balance-rr(0) [ 365.856574][T13430] netlink: 4 bytes leftover after parsing attributes in process `syz.1.1700'. [ 365.861627][T13425] bond10 (unregistering): Released all slaves [ 366.072974][T13433] xt_cgroup: invalid path, errno=-2 [ 366.077925][T13433] netlink: 'syz.4.1702': attribute type 39 has an invalid length. [ 366.116401][T13433] v: left allmulticast mode [ 366.192899][T13435] netlink: 200 bytes leftover after parsing attributes in process `syz.2.1703'. [ 366.232915][T13438] Cannot find set identified by id 65535 to match [ 366.830685][T13459] netlink: 'syz.3.1709': attribute type 21 has an invalid length. [ 366.942040][T13458] bond4: Unable to set peer notification delay as MII monitoring is disabled [ 366.961921][T13458] bond4 (unregistering): Released all slaves [ 367.080268][T13459] netlink: 'syz.3.1709': attribute type 3 has an invalid length. [ 367.080295][T13459] netlink: 144 bytes leftover after parsing attributes in process `syz.3.1709'. [ 367.235061][T13471] ip_tables: iptables: counters copy to user failed while replacing table [ 367.304337][T13482] netlink: 44 bytes leftover after parsing attributes in process `syz.3.1713'. [ 367.366506][T13485] netlink: 16 bytes leftover after parsing attributes in process `syz.4.1714'. [ 367.710637][T13489] x_tables: ip6_tables: cgroup match: used from hooks PREROUTING, but only valid from INPUT/OUTPUT/POSTROUTING [ 367.711040][T13491] openvswitch: netlink: Missing valid actions attribute. [ 367.711084][T13491] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 368.036646][T13501] gre0: left promiscuous mo ** replaying previous printk message ** [ 368.036646][T13501] gre0: left promiscuous mode [ 368.048293][T13497] [ 368.059798][T13497] ====================================================== [ 368.066839][T13497] WARNING: possible circular locking dependency detected [ 368.073970][T13497] syzkaller #0 Not tainted [ 368.078413][T13497] ------------------------------------------------------ [ 368.085453][T13497] syz.2.1718/13497 is trying to acquire lock: [ 368.091536][T13497] ffffffff8ee904e0 (fs_reclaim){+.+.}-{0:0}, at: prepare_alloc_pages+0x149/0x600 [ 368.100723][T13497] [ 368.100723][T13497] but task is already holding lock: [ 368.108117][T13497] ffff88807f1af678 (&mm->mmap_lock){++++}-{4:4}, at: lock_mm_and_find_vma+0x36/0x340 [ 368.117669][T13497] [ 368.117669][T13497] which lock already depends on the new lock. [ 368.117669][T13497] [ 368.128102][T13497] [ 368.128102][T13497] the existing dependency chain (in reverse order) is: [ 368.137145][T13497] [ 368.137145][T13497] -> #7 (&mm->mmap_lock){++++}-{4:4}: [ 368.144839][T13497] __might_fault+0xcb/0x130 [ 368.149907][T13497] _copy_from_user+0x28/0xb0 [ 368.155057][T13497] csum_and_copy_from_iter_full+0x210/0x1fb0 [ 368.161604][T13497] ip_generic_getfrag+0x149/0x2d0 [ 368.167284][T13497] __ip6_append_data+0x3b26/0x40c0 [ 368.172958][T13497] ip6_append_data+0x108/0x270 [ 368.178280][T13497] rawv6_sendmsg+0x1298/0x18c0 [ 368.183618][T13497] sock_sendmsg_nosec+0x10e/0x180 [ 368.185106][T13501] 8021q: adding VLAN 0 to HW filter on device team0 [ 368.188590][T13501] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 368.202653][T13497] ____sys_sendmsg+0x54e/0x850 [ 368.207978][T13497] ___sys_sendmsg+0x2a5/0x360 [ 368.213224][T13497] __x64_sys_sendmsg+0x1b1/0x290 [ 368.218735][T13497] do_syscall_64+0x166/0x520 [ 368.223904][T13497] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 368.230401][T13497] [ 368.230401][T13497] -> #6 (sk_lock-AF_INET6){+.+.}-{0:0}: [ 368.238233][T13497] lock_sock_nested+0x41/0x100 [ 368.243555][T13497] inet_shutdown+0x6a/0x390 [ 368.248751][T13497] nbd_mark_nsock_dead+0x2cb/0x550 [ 368.254381][T13497] recv_work+0x1cee/0x1e10 [ 368.259333][T13497] process_scheduled_works+0xc3d/0x1630 [ 368.265403][T13497] worker_thread+0xa47/0xfb0 [ 368.270515][T13497] kthread+0x38b/0x480 [ 368.275110][T13497] ret_from_fork+0x514/0xb70 [ 368.280241][T13497] ret_from_fork_asm+0x1a/0x30 [ 368.285548][T13497] [ 368.285548][T13497] -> #5 (&nsock->tx_lock){+.+.}-{4:4}: [ 368.293216][T13497] __mutex_lock+0x19d/0x1550 [ 368.298355][T13497] nbd_queue_rq+0x373/0xff0 [ 368.303490][T13497] blk_mq_dispatch_rq_list+0x499/0x1990 [ 368.309599][T13497] __blk_mq_sched_dispatch_requests+0xd36/0x1580 [ 368.316473][T13497] blk_mq_sched_dispatch_requests+0xd7/0x190 [ 368.323007][T13497] blk_mq_run_work_fn+0x16c/0x300 [ 368.328596][T13497] process_scheduled_works+0xc3d/0x1630 [ 368.334702][T13497] worker_thread+0xa47/0xfb0 [ 368.339853][T13497] kthread+0x38b/0x480 [ 368.344648][T13497] ret_from_fork+0x514/0xb70 [ 368.349784][T13497] ret_from_fork_asm+0x1a/0x30 [ 368.355124][T13497] [ 368.355124][T13497] -> #4 (&cmd->lock){+.+.}-{4:4}: [ 368.362359][T13497] __mutex_lock+0x19d/0x1550 [ 368.367508][T13497] nbd_queue_rq+0xc1/0xff0 [ 368.372477][T13497] blk_mq_dispatch_rq_list+0x499/0x1990 [ 368.378575][T13497] __blk_mq_sched_dispatch_requests+0xd36/0x1580 [ 368.385630][T13497] blk_mq_sched_dispatch_requests+0xd7/0x190 [ 368.392247][T13497] blk_mq_run_work_fn+0x16c/0x300 [ 368.397839][T13497] process_scheduled_works+0xc3d/0x1630 [ 368.403943][T13497] worker_thread+0xa47/0xfb0 [ 368.409089][T13497] kthread+0x38b/0x480 [ 368.413693][T13497] ret_from_fork+0x514/0xb70 [ 368.418813][T13497] ret_from_fork_asm+0x1a/0x30 [ 368.424206][T13497] [ 368.424206][T13497] -> #3 (set->srcu){.+.+}-{0:0}: [ 368.431513][T13497] __synchronize_srcu+0xc9/0x2f0 [ 368.436993][T13497] elevator_switch+0x1e8/0x7b0 [ 368.442290][T13497] elevator_change+0x2fa/0x480 [ 368.447588][T13497] elevator_set_default+0x375/0x440 [ 368.453354][T13497] blk_register_queue+0x3f3/0x4e0 [ 368.458928][T13497] __add_disk+0x6b8/0xdb0 [ 368.463803][T13497] add_disk_fwnode+0x100/0x3a0 [ 368.469107][T13497] nbd_dev_add+0x733/0xb60 [ 368.474058][T13497] nbd_init+0x168/0x1f0 [ 368.478837][T13497] do_one_initcall+0x250/0x870 [ 368.484133][T13497] do_initcall_level+0x10a/0x1a0 [ 368.489597][T13497] do_initcalls+0x59/0xa0 [ 368.494457][T13497] kernel_init_freeable+0x29d/0x3e0 [ 368.500186][T13497] kernel_init+0x22/0x1d0 [ 368.505128][T13497] ret_from_fork+0x514/0xb70 [ 368.510269][T13497] ret_from_fork_asm+0x1a/0x30 [ 368.515679][T13497] [ 368.515679][T13497] -> #2 (&q->elevator_lock){+.+.}-{4:4}: [ 368.523594][T13497] __mutex_lock+0x19d/0x1550 [ 368.528802][T13497] elevator_change+0x1af/0x480 [ 368.534092][T13497] elevator_set_none+0xb5/0x140 [ 368.539817][T13497] blk_mq_update_nr_hw_queues+0x5ef/0x19f0 [ 368.546325][T13497] nbd_start_device+0x189/0xb30 [ 368.551709][T13497] nbd_genl_connect+0x167d/0x1cd0 [ 368.557284][T13497] genl_family_rcv_msg_doit+0x233/0x340 [ 368.563475][T13497] genl_rcv_msg+0x614/0x7a0 [ 368.568517][T13497] netlink_rcv_skb+0x226/0x4a0 [ 368.573804][T13497] genl_rcv+0x28/0x40 [ 368.578311][T13497] netlink_unicast+0x7bd/0x940 [ 368.583604][T13497] netlink_sendmsg+0x813/0xb40 [ 368.588981][T13497] sock_sendmsg_nosec+0x13a/0x180 [ 368.594994][T13497] ____sys_sendmsg+0x54e/0x850 [ 368.600289][T13497] ___sys_sendmsg+0x2a5/0x360 [ 368.605494][T13497] __x64_sys_sendmsg+0x1b1/0x290 [ 368.611143][T13497] do_syscall_64+0x166/0x520 [ 368.616281][T13497] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 368.622703][T13497] [ 368.622703][T13497] -> #1 (&q->q_usage_counter(io)#49){++++}-{0:0}: [ 368.631401][T13497] blk_alloc_queue+0x544/0x690 [ 368.636696][T13497] __blk_mq_alloc_disk+0x194/0x390 [ 368.642337][T13497] nbd_dev_add+0x494/0xb60 [ 368.647277][T13497] nbd_init+0x168/0x1f0 [ 368.652049][T13497] do_one_initcall+0x250/0x870 [ 368.657341][T13497] do_initcall_level+0x10a/0x1a0 [ 368.662804][T13497] do_initcalls+0x59/0xa0 [ 368.667656][T13497] kernel_init_freeable+0x29d/0x3e0 [ 368.673398][T13497] kernel_init+0x22/0x1d0 [ 368.678257][T13497] ret_from_fork+0x514/0xb70 [ 368.683382][T13497] ret_from_fork_asm+0x1a/0x30 [ 368.688714][T13497] [ 368.688714][T13497] -> #0 (fs_reclaim){+.+.}-{0:0}: [ 368.696108][T13497] __lock_acquire+0x164c/0x2de0 [ 368.701523][T13497] lock_acquire+0x115/0x350 [ 368.706552][T13497] fs_reclaim_acquire+0x71/0x100 [ 368.712021][T13497] prepare_alloc_pages+0x149/0x600 [ 368.717657][T13497] __alloc_frozen_pages_noprof+0x185/0x5a0 [ 368.723993][T13497] alloc_pages_mpol+0x21e/0x390 [ 368.729458][T13497] alloc_pages_noprof+0xb1/0x2b0 [ 368.734930][T13497] pte_alloc_one+0x22/0x370 [ 368.740081][T13497] __pte_alloc+0x25/0x1a0 [ 368.744930][T13497] do_pte_missing+0x2db7/0x34b0 [ 368.750305][T13497] handle_mm_fault+0x1a53/0x3750 [ 368.755768][T13497] do_user_addr_fault+0x746/0x1340 [ 368.761494][T13497] exc_page_fault+0x6a/0xc0 [ 368.766541][T13497] asm_exc_page_fault+0x26/0x30 [ 368.772057][T13497] rep_movs_alternative+0x4a/0xa0 [ 368.777636][T13497] _copy_from_iter+0x408/0x1660 [ 368.783024][T13497] kcm_sendmsg+0xe32/0x2ad0 [ 368.788056][T13497] sock_sendmsg_nosec+0x13a/0x180 [ 368.793606][T13497] ____sys_sendmsg+0x54e/0x850 [ 368.798903][T13497] ___sys_sendmsg+0x2a5/0x360 [ 368.804125][T13497] __x64_sys_sendmsg+0x1b1/0x290 [ 368.809592][T13497] do_syscall_64+0x166/0x520 [ 368.814806][T13497] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 368.821223][T13497] [ 368.821223][T13497] other info that might help us debug this: [ 368.821223][T13497] [ 368.831458][T13497] Chain exists of: [ 368.831458][T13497] fs_reclaim --> sk_lock-AF_INET6 --> &mm->mmap_lock [ 368.831458][T13497] [ 368.844076][T13497] Possible unsafe locking scenario: [ 368.844076][T13497] [ 368.851623][T13497] CPU0 CPU1 [ 368.856988][T13497] ---- ---- [ 368.862352][T13497] rlock(&mm->mmap_lock); [ 368.866770][T13497] lock(sk_lock-AF_INET6); [ 368.873797][T13497] lock(&mm->mmap_lock); [ 368.880645][T13497] lock(fs_reclaim); [ 368.884632][T13497] [ 368.884632][T13497] *** DEADLOCK *** [ 368.884632][T13497] [ 368.892769][T13497] locks held by syz.2.1718/13497: 3, last CPU#0: [ 368.899091][T13497] #0: ffff88807be463c8 (&kcm->tx_mutex){+.+.}-{4:4}, at: kcm_sendmsg+0x1b4/0x2ad0 [ 368.908412][T13497] #1: ffff88807be45f60 (sk_lock-AF_KCM){+.+.}-{0:0}, at: kcm_sendmsg+0x1be/0x2ad0 [ 368.917927][T13497] #2: ffff88807f1af678 (&mm->mmap_lock){++++}-{4:4}, at: lock_mm_and_find_vma+0x36/0x340 [ 368.927855][T13497] [ 368.927855][T13497] stack backtrace: [ 368.933748][T13497] CPU: 0 UID: 0 PID: 13497 Comm: syz.2.1718 Not tainted syzkaller #0 PREEMPT(full) [ 368.943121][T13497] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 368.953180][T13497] Call Trace: [ 368.956476][T13497] [ 368.959514][T13497] dump_stack_lvl+0xe8/0x150 [ 368.964125][T13497] print_circular_bug+0x2e2/0x300 [ 368.969339][T13497] check_noncircular+0x12f/0x150 [ 368.974291][T13497] __lock_acquire+0x164c/0x2de0 [ 368.979156][T13497] ? rcu_is_watching+0x16/0xb0 [ 368.983929][T13497] ? trace_hrtimer_start+0x82/0x200 [ 368.989139][T13497] ? hrtimer_start_range_ns_common+0x7f6/0xb60 [ 368.995302][T13497] lock_acquire+0x115/0x350 [ 368.999831][T13497] ? prepare_alloc_pages+0x149/0x600 [ 369.005129][T13497] fs_reclaim_acquire+0x71/0x100 [ 369.010066][T13497] ? prepare_alloc_pages+0x149/0x600 [ 369.015350][T13497] prepare_alloc_pages+0x149/0x600 [ 369.020468][T13497] __alloc_frozen_pages_noprof+0x185/0x5a0 [ 369.026293][T13497] ? __pfx___alloc_frozen_pages_noprof+0x10/0x10 [ 369.032627][T13497] ? __pfx_policy_nodemask+0x10/0x10 [ 369.037923][T13497] alloc_pages_mpol+0x21e/0x390 [ 369.042797][T13497] alloc_pages_noprof+0xb1/0x2b0 [ 369.047743][T13497] pte_alloc_one+0x22/0x370 [ 369.052344][T13497] __pte_alloc+0x25/0x1a0 [ 369.056682][T13497] do_pte_missing+0x2db7/0x34b0 [ 369.061539][T13497] ? mtree_range_walk+0x707/0x8b0 [ 369.066586][T13497] handle_mm_fault+0x1a53/0x3750 [ 369.071560][T13497] ? handle_mm_fault+0xf1/0x3750 [ 369.076525][T13497] ? __pfx_handle_mm_fault+0x10/0x10 [ 369.081830][T13497] ? __pfx___up_read+0x10/0x10 [ 369.086709][T13497] ? lock_mm_and_find_vma+0xa7/0x340 [ 369.092028][T13497] do_user_addr_fault+0x746/0x1340 [ 369.097180][T13497] exc_page_fault+0x6a/0xc0 [ 369.101733][T13497] asm_exc_page_fault+0x26/0x30 [ 369.106611][T13497] RIP: 0010:rep_movs_alternative+0x4a/0xa0 [ 369.112537][T13497] Code: 67 04 00 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 00 48 8b 06 48 89 07 48 83 c6 08 48 83 c7 08 83 e9 08 74 db 83 f9 08 73 e8 eb c5 a4 e9 0f 67 04 00 48 8b 06 48 89 07 48 8d 47 08 48 83 e0 f8 48 [ 369.132169][T13497] RSP: 0018:ffffc90005367618 EFLAGS: 00050206 [ 369.138432][T13497] RAX: 00007ffffffff001 RBX: dffffc0000000000 RCX: 00000000000009cc [ 369.146410][T13497] RDX: 0000000000000001 RSI: 0000200000400000 RDI: ffff88805452f634 [ 369.154397][T13497] RBP: ffffc90005367770 R08: ffff88805452ffff R09: 1ffff1100a8a5fff [ 369.162393][T13497] R10: dffffc0000000000 R11: ffffed100a8a6000 R12: ffffc90005367e10 [ 369.170368][T13497] R13: 00000000003f7f8c R14: 0000000000008000 R15: 0000000000008000 [ 369.178442][T13497] _copy_from_iter+0x408/0x1660 [ 369.183312][T13497] ? __pfx__copy_from_iter+0x10/0x10 [ 369.188603][T13497] ? alloc_pages_noprof+0x140/0x2b0 [ 369.193816][T13497] ? skb_page_frag_refill+0x119/0x460 [ 369.199200][T13497] kcm_sendmsg+0xe32/0x2ad0 [ 369.203716][T13497] ? lockdep_hardirqs_on+0x7b/0x110 [ 369.208961][T13497] ? __pfx_kcm_sendmsg+0x10/0x10 [ 369.213941][T13497] ? apparmor_socket_sendmsg+0x98/0x360 [ 369.219665][T13497] ? __pfx_kcm_sendmsg+0x10/0x10 [ 369.224617][T13497] sock_sendmsg_nosec+0x13a/0x180 [ 369.229661][T13497] ____sys_sendmsg+0x54e/0x850 [ 369.234443][T13497] ? __pfx_____sys_sendmsg+0x10/0x10 [ 369.239758][T13497] ? import_iovec+0x73/0xa0 [ 369.244287][T13497] ___sys_sendmsg+0x2a5/0x360 [ 369.248973][T13497] ? __lock_acquire+0x747/0x2de0 [ 369.253916][T13497] ? __pfx____sys_sendmsg+0x10/0x10 [ 369.259127][T13497] ? futex_wait+0x2a2/0x390 [ 369.263648][T13497] ? __fget_files+0x2a/0x420 [ 369.268252][T13497] ? __fget_files+0x3a2/0x420 [ 369.272936][T13497] __x64_sys_sendmsg+0x1b1/0x290 [ 369.277883][T13497] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 369.283361][T13497] do_syscall_64+0x166/0x520 [ 369.287960][T13497] ? trace_irq_disable+0x3b/0x140 [ 369.292988][T13497] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 369.299143][T13497] ? clear_bhb_loop+0x70/0xc0 [ 369.303858][T13497] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 369.309750][T13497] RIP: 0033:0x7f469899e159 [ 369.314170][T13497] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 369.333804][T13497] RSP: 002b:00007f4699845028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 369.342233][T13497] RAX: ffffffffffffffda RBX: 00007f4698c26090 RCX: 00007f469899e159 [ 369.350211][T13497] RDX: 000000000000c854 RSI: 0000200000000280 RDI: 0000000000000009 [ 369.358186][T13497] RBP: 00007f4698a3506b R08: 0000000000000000 R09: 0000000000000000 [ 369.366164][T13497] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 369.374150][T13497] R13: 00007f4698c26128 R14: 00007f4698c26090 R15: 00007ffd370dfd38 [ 369.382199][T13497] [ 369.451318][T13511] x_tables: duplicate entry at hook 1 [ 369.471239][T13501] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 369.488603][T13501] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 369.528819][T13501] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 369.528849][T13501] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 369.557291][T13501] A link change request failed with some changes committed already. Interface virt_wifi0 may have been left with an inconsistent configuration, please check. [ 369.562190][T11673] bridge0: port 1(bridge_slave_0) entered blocking state [ 369.562270][T11673] bridge0: port 1(bridge_slave_0) entered forwarding state [ 369.563818][T11673] bridge0: port 2(bridge_slave_1) entered blocking state [ 369.563892][T11673] bridge0: port 2(bridge_slave_1) entered forwarding state [ 369.647626][T13501] openvswitch: netlink: Message has 8 unknown bytes. [ 369.654240][T13519] netlink: 44 bytes leftover after parsing attributes in process `syz.3.1721'. [ 369.751981][T13514] netlink: 'syz.3.1721': attribute type 1 has an invalid length.