last executing test programs: 3.715480239s ago: executing program 4 (id=2514): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f0000002d00)={0x0, 0x0, &(0x7f0000002cc0)={&(0x7f0000005500)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x2}}, [@NFT_MSG_DELTABLE={0x1c, 0x2, 0xa, 0x5, 0x0, 0x0, {0x0, 0x0, 0xa}, [@NFTA_TABLE_FLAGS={0x8, 0x2, 0x1, 0x0, 0x3}]}, @NFT_MSG_DELSETELEM={0x20, 0xe, 0xa, 0x101, 0x0, 0x0, {0x1, 0x0, 0x3}, [@NFTA_SET_ELEM_LIST_TABLE={0x9, 0x1, 'syz0\x00'}]}, @NFT_MSG_DELRULE={0x20, 0x8, 0xa, 0x801, 0x0, 0x0, {0x3, 0x0, 0x1}, [@NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x7}}}, 0x84}, 0x1, 0x0, 0x0, 0x20046851}, 0x4000082) 3.536028135s ago: executing program 4 (id=2515): sendmsg$IPCTNL_MSG_CT_GET(0xffffffffffffffff, 0x0, 0x0) sendmsg$TIPC_NL_LINK_GET(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000280)={0x0, 0x24}}, 0x0) ioctl$sock_ipv6_tunnel_SIOCGET6RD(0xffffffffffffffff, 0x89f8, &(0x7f00000001c0)={'ip_vti0\x00', &(0x7f00000000c0)={'gretap0\x00', 0x0, 0x7800, 0x20, 0xfffffff7, 0x401, {{0x10, 0x4, 0x2, 0x7, 0x40, 0x64, 0x0, 0x6, 0x29, 0x0, @private=0xa010102, @loopback, {[@lsrr={0x83, 0xb, 0x4c, [@initdev={0xac, 0x1e, 0x1, 0x0}, @private=0xa010101]}, @timestamp={0x44, 0x20, 0x6c, 0x0, 0x6, [0x7fff, 0x4, 0x80000000, 0x4, 0x5, 0x8, 0xd40b]}, @noop]}}}}}) (async) ioctl$sock_ipv6_tunnel_SIOCGET6RD(0xffffffffffffffff, 0x89f8, &(0x7f00000001c0)={'ip_vti0\x00', &(0x7f00000000c0)={'gretap0\x00', 0x0, 0x7800, 0x20, 0xfffffff7, 0x401, {{0x10, 0x4, 0x2, 0x7, 0x40, 0x64, 0x0, 0x6, 0x29, 0x0, @private=0xa010102, @loopback, {[@lsrr={0x83, 0xb, 0x4c, [@initdev={0xac, 0x1e, 0x1, 0x0}, @private=0xa010101]}, @timestamp={0x44, 0x20, 0x6c, 0x0, 0x6, [0x7fff, 0x4, 0x80000000, 0x4, 0x5, 0x8, 0xd40b]}, @noop]}}}}}) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000400)=@newqdisc={0x2c, 0x24, 0x10, 0x0, 0x25dfdbfe, {0x0, 0x0, 0x0, r0, {}, {0xd, 0xc}}, [@qdisc_kind_options=@q_cbs={{}, {0x0, 0x2, @TCA_CBS_PARMS={0x0, 0x1, {0x9, '\x00', 0x2, 0x3, 0x38}}}}, @TCA_INGRESS_BLOCK={0x0, 0xd, 0x178}, @TCA_EGRESS_BLOCK={0x0, 0xe, 0x8000}, @TCA_INGRESS_BLOCK={0x0, 0xd, 0x9}, @qdisc_kind_options=@q_skbprio={{}, {0x0, 0x2, 0x7}}, @TCA_INGRESS_BLOCK={0x0, 0xd, 0x7fff}, @TCA_INGRESS_BLOCK={0x0, 0xd, 0x6}]}, 0x5c}}, 0x0) (async) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000400)=@newqdisc={0x2c, 0x24, 0x10, 0x0, 0x25dfdbfe, {0x0, 0x0, 0x0, r0, {}, {0xd, 0xc}}, [@qdisc_kind_options=@q_cbs={{}, {0x0, 0x2, @TCA_CBS_PARMS={0x0, 0x1, {0x9, '\x00', 0x2, 0x3, 0x38}}}}, @TCA_INGRESS_BLOCK={0x0, 0xd, 0x178}, @TCA_EGRESS_BLOCK={0x0, 0xe, 0x8000}, @TCA_INGRESS_BLOCK={0x0, 0xd, 0x9}, @qdisc_kind_options=@q_skbprio={{}, {0x0, 0x2, 0x7}}, @TCA_INGRESS_BLOCK={0x0, 0xd, 0x7fff}, @TCA_INGRESS_BLOCK={0x0, 0xd, 0x6}]}, 0x5c}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000500)={&(0x7f0000000040)=@newtfilter={0x2c, 0x2c, 0xd27, 0xffffffff, 0x0, {0x0, 0x0, 0x0, 0x0, {0xfffa, 0xffe0}, {}, {0xfff1, 0xfff9}}, [@TCA_RATE={0x6, 0x5, {0xfc, 0x9}}]}, 0x2c}, 0x1, 0x0, 0x0, 0x81}, 0x24004000) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r3, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) (async) r4 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r4, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r5 = socket$unix(0x1, 0x1, 0x0) socket$nl_route(0x10, 0x3, 0x0) (async) r6 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, 0x0) sendmsg$nl_route_sched(r6, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x20008001}, 0x0) socket$unix(0x1, 0x1, 0x0) (async) r7 = socket$unix(0x1, 0x1, 0x0) socket$kcm(0x11, 0x3, 0x0) (async) r8 = socket$kcm(0x11, 0x3, 0x0) r9 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) close(r9) (async) close(r9) socket$unix(0x1, 0x2, 0x0) ioctl$SIOCSIFHWADDR(r9, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) ioctl$sock_SIOCGIFINDEX(r7, 0x8933, &(0x7f0000000100)={'syzkaller0\x00'}) (async) ioctl$sock_SIOCGIFINDEX(r7, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$kcm(r8, &(0x7f0000000280)={&(0x7f0000000380)=@xdp={0x2c, 0x0, r10, 0x3e}, 0x80, &(0x7f00000001c0)=[{&(0x7f0000000180)='\'', 0x1}], 0x1}, 0x5) unshare(0x40040000) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000180)={'veth0\x00', 0x0}) sendmsg$nl_route_sched(r2, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=@newqdisc={0x34, 0x24, 0x4ee4e6a52ff56541, 0x70b926, 0x80100, {0x0, 0x0, 0x0, r11, {0x0, 0x2}, {0x1, 0xb}, {0x10, 0x5}}, [@qdisc_kind_options=@q_codel={{0xa}, {0x4}}]}, 0x34}, 0x1, 0x0, 0x0, 0xc020}, 0x0) sendmmsg(r1, &(0x7f00000002c0), 0x40000000000009f, 0x0) (async) sendmmsg(r1, &(0x7f00000002c0), 0x40000000000009f, 0x0) 3.071451837s ago: executing program 4 (id=2519): ioctl$XFS_IOC_PATH_TO_FSHANDLE(0xffffffffffffffff, 0xc0385868, &(0x7f0000000200)={0xffffffffffffffff, &(0x7f0000000100)='\x00', 0x80000, &(0x7f0000000140)={@_ha_fsid={[0x10001, 0xc]}, {0x8, 0x94b0, 0x10001, 0x85}}, 0x3, &(0x7f0000000180)={@_ha_fsid}, &(0x7f00000001c0)}) r1 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000280), 0xffffffffffffffff) sendmsg$MPTCP_PM_CMD_GET_LIMITS(r0, &(0x7f0000000380)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x400}, 0xc, &(0x7f0000000340)={&(0x7f00000002c0)={0x44, r1, 0x20, 0x70bd2c, 0x25dfdbff, {}, [@MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x4}, @MPTCP_PM_ATTR_TOKEN={0x8, 0x4, 0x1}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8}, @MPTCP_PM_ATTR_TOKEN={0x8, 0x4, 0x7ff}, @MPTCP_PM_ATTR_LOC_ID={0x5, 0x5, 0x16}, @MPTCP_PM_ATTR_SUBFLOWS={0x8}]}, 0x44}, 0x1, 0x0, 0x0, 0x4}, 0x8000) bpf$PROG_LOAD(0x5, &(0x7f0000000040)={0x15, 0x4, &(0x7f0000000000)=ANY=[@ANYRES8=0x0, @ANYRES64, @ANYRES32, @ANYRESHEX=0x0], &(0x7f0000003ff6)='GPL\x00', 0x2, 0xa4, &(0x7f000000cf3d)=""/164, 0x0, 0x25, '\x00', 0x0, @sk_reuseport}, 0x94) 3.038786669s ago: executing program 0 (id=2520): r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000440)=ANY=[@ANYBLOB="1b00000000000000000000000080"], 0x50) r2 = bpf$PROG_LOAD(0x5, &(0x7f0000000140)={0x6, 0x17, &(0x7f0000000280)=ANY=[@ANYBLOB="1800000000000000000000000000000218110000", @ANYRES32, @ANYBLOB="0000000000000000b702000014000000b7030000000000008500000083000000bf090000000000005509010000000000950000000000000018110000", @ANYRES32=r0, @ANYBLOB="000000b7020000000000288500000086000000181100000000000000", @ANYRES32=r1, @ANYBLOB="0000000000000000b7020000000000008500000017000000bf91000000000000b7020000000000008500000084000000b70000000000000095"], &(0x7f0000000080)='GPL\x00', 0x0, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, @fallback=0x33, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000600)={r2, 0xfca804a0, 0xe, 0x0, &(0x7f0000000580)="b80022ab98d1db1b883e04000000", 0x0, 0xbfffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0xf8}, 0x50) r3 = socket(0x2, 0x80805, 0x0) sendmmsg$inet(r3, &(0x7f0000000540)=[{{&(0x7f0000000000)={0x2, 0x0, @rand_addr=0x64010100}, 0x10, 0x0}}], 0x1, 0xc000) r4 = socket$inet(0x2, 0x80001, 0x84) r5 = socket$inet6_sctp(0xa, 0x5, 0x84) setsockopt(r5, 0x84, 0x11, &(0x7f0000000040)="020c0000098011e8", 0x8) getsockopt$inet_sctp_SCTP_MAX_BURST(r4, 0x84, 0x14, &(0x7f0000000000)=@assoc_value={0x0}, &(0x7f0000000040)=0x8) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.net/syz1\x00', 0x1ff) r7 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r8 = openat$cgroup_procs(r7, &(0x7f0000000040)='cgroup.procs\x00', 0x2, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$inet(r10, &(0x7f0000001b00)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001d80)=ANY=[@ANYBLOB="28010000000000000100000001"], 0x128}, 0x0) recvmsg$unix(r9, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000080), 0x100}, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$inet(r12, &(0x7f0000001b00)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001d80)=ANY=[], 0x128}, 0x0) recvmsg$unix(r11, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000080), 0x100}, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$inet(r14, &(0x7f0000001b00)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001d80)=ANY=[], 0x128}, 0x0) recvmsg$unix(r13, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000900), 0x100}, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$inet(r16, &(0x7f0000001b00)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001d80)=ANY=[], 0x128}, 0x0) recvmsg(r15, &(0x7f00000005c0)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001dc0)=""/4096, 0x1000}, 0x0) write$cgroup_pid(r8, &(0x7f00000001c0), 0x12) setsockopt$inet_sctp6_SCTP_DEFAULT_PRINFO(r3, 0x84, 0x72, &(0x7f00000003c0)={r6, 0x0, 0x20}, 0xc) sendmsg$nl_route(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000100)=@newlink={0x4c, 0x10, 0x20, 0x0, 0x0, {0x7a, 0x0, 0x0, 0x0, 0x41100}, [@IFLA_LINKINFO={0x2c, 0x12, 0x0, 0x1, @bridge={{0xb}, {0x1c, 0x2, 0x0, 0x1, [@IFLA_BR_MCAST_MEMBERSHIP_INTVL={0xc, 0x1f, 0xb767}, @IFLA_BR_MCAST_QUERIER_INTVL={0xc, 0x20, 0x10}]}}}]}, 0x4c}}, 0x0) r17 = syz_genetlink_get_family_id$SEG6(&(0x7f0000000180), r3) sendmsg$SEG6_CMD_SETHMAC(r3, &(0x7f0000000240)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x8}, 0xc, &(0x7f0000000200)={&(0x7f00000001c0)={0x40, r17, 0x100, 0x70bd28, 0x25dfdbfc, {}, [@SEG6_ATTR_DSTLEN={0x8, 0x2, 0x55f}, @SEG6_ATTR_ALGID={0x5, 0x6, 0x9}, @SEG6_ATTR_SECRETLEN={0x5, 0x5, 0x4}, @SEG6_ATTR_HMACKEYID={0x8, 0x3, 0x912}, @SEG6_ATTR_DSTLEN={0x8, 0x2, 0x1b1eda4f}, @SEG6_ATTR_SECRET={0x4}]}, 0x40}, 0x1, 0x0, 0x0, 0x20000050}, 0x24004000) 2.860428503s ago: executing program 4 (id=2523): r0 = socket$nl_generic(0x10, 0x3, 0x10) socket$netlink(0x10, 0x3, 0x6720f15ce8555866) (async) r1 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$ETHTOOL_MSG_COALESCE_SET(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000300)={0x34, r1, 0x1, 0x0, 0x0, {0x10}, [@ETHTOOL_A_COALESCE_HEADER={0x18, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'netdevsim0\x00'}]}, @ETHTOOL_A_COALESCE_USE_ADAPTIVE_RX={0x5}]}, 0x34}}, 0x0) 2.816409959s ago: executing program 3 (id=2524): r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='memory.events\x00', 0x275a, 0x0) setsockopt$packet_fanout(0xffffffffffffffff, 0x107, 0x12, &(0x7f0000000000)={0x0, 0x8000}, 0x4) setsockopt$SO_ATTACH_FILTER(0xffffffffffffffff, 0x1, 0x1a, &(0x7f0000000400)={0x0, &(0x7f0000000340)}, 0x10) ioctl$sock_ipv4_tunnel_SIOCDELTUNNEL(r0, 0x89f2, &(0x7f0000000a00)={'sit0\x00', &(0x7f0000000980)={'syztnl0\x00', 0x0, 0x20, 0x0, 0x80000001, 0xe, {{0x10, 0x4, 0x2, 0x7, 0x40, 0x64, 0x0, 0x5b, 0x2f, 0x0, @private=0x3ff, @multicast1, {[@noop, @rr={0x7, 0x13, 0x75, [@empty, @rand_addr=0x64010102, @empty, @broadcast]}, @lsrr={0x83, 0x17, 0x50, [@loopback, @remote, @loopback, @multicast1, @dev={0xac, 0x14, 0x14, 0x2e}]}]}}}}}) getsockopt$inet_mreqn(r0, 0x0, 0x24, &(0x7f0000000a40)={@private, @empty, 0x0}, &(0x7f0000000a80)=0xc) sendmsg$TEAM_CMD_OPTIONS_SET(r0, &(0x7f0000001540)={&(0x7f0000000300)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f0000001500)={&(0x7f0000000f00)={0x5f8, 0x0, 0x200, 0x70bd2c, 0x25dfdbff, {}, [{{0x8}, {0x1a8, 0x2, 0x0, 0x1, [{0x40, 0x1, @queue_id={{{0x24}, {0x5}, {0x8, 0x4, 0xa}}, {0x8}}}, {0x38, 0x1, @mcast_rejoin_count={{0x24}, {0x5}, {0x8, 0x4, 0x2}}}, {0x38, 0x1, @activeport={{0x24}, {0x5}, {0x8}}}, {0x40, 0x1, @queue_id={{{0x24}, {0x5}, {0x8, 0x4, 0xffffffff}}, {0x8}}}, {0x40, 0x1, @queue_id={{{0x24}, {0x5}, {0x8, 0x4, 0xbe}}, {0x8}}}, {0x38, 0x1, @notify_peers_count={{0x24}, {0x5}, {0x8, 0x4, 0x800}}}, {0x3c, 0x1, @user_linkup={{{0x24}, {0x5}, {0x4}}, {0x8}}}]}}, {{0x8}, {0x74, 0x2, 0x0, 0x1, [{0x38, 0x1, @mcast_rejoin_count={{0x24}, {0x5}, {0x8, 0x4, 0x2}}}, {0x38, 0x1, @notify_peers_interval={{0x24}, {0x5}, {0x8, 0x4, 0x35fe}}}]}}, {{0x8}, {0x1e0, 0x2, 0x0, 0x1, [{0x3c, 0x1, @user_linkup_enabled={{{0x24}, {0x5}, {0x4}}, {0x8}}}, {0x38, 0x1, @mcast_rejoin_count={{0x24}, {0x5}, {0x8, 0x4, 0x5}}}, {0x38, 0x1, @mcast_rejoin_count={{0x24}, {0x5}, {0x8, 0x4, 0x1}}}, {0x40, 0x1, @queue_id={{{0x24}, {0x5}, {0x8, 0x4, 0x9}}, {0x8}}}, {0x38, 0x1, @lb_stats_refresh_interval={{0x24}, {0x5}, {0x8, 0x4, 0x200}}}, {0x3c, 0x1, @enabled={{{0x24}, {0x5}, {0x4}}, {0x8}}}, {0x3c, 0x1, @user_linkup_enabled={{{0x24}, {0x5}, {0x4}}, {0x8}}}, {0x40, 0x1, @name={{0x24}, {0x5}, {0xe, 0x4, 'broadcast\x00'}}}]}}, {{0x8}, {0xbc, 0x2, 0x0, 0x1, [{0x3c, 0x1, @user_linkup={{{0x24}, {0x5}, {0x4}}, {0x8}}}, {0x44, 0x1, @name={{0x24}, {0x5}, {0x11, 0x4, 'activebackup\x00'}}}, {0x38, 0x1, @mcast_rejoin_count={{0x24}, {0x5}, {0x8, 0x4, 0x3}}}]}}, {{0x8}, {0x104, 0x2, 0x0, 0x1, [{0x40, 0x1, @lb_tx_hash_to_port_mapping={{{0x24}, {0x5}, {0x8}}, {0x8}}}, {0x40, 0x1, @priority={{{0x24}, {0x5}, {0x8, 0x4, 0x4}}, {0x8, 0x6, r1}}}, {0x40, 0x1, @lb_hash_stats={{{0x24}, {0x5}, {0x8, 0x4, 0x1}}, {0x8}}}, {0x40, 0x1, @queue_id={{{0x24}, {0x5}, {0x8, 0x4, 0x9}}, {0x8, 0x6, r2}}}]}}]}, 0x5f8}, 0x1, 0x0, 0x0, 0x20048801}, 0x9caffcda7c92726c) bind$inet(0xffffffffffffffff, &(0x7f0000000240)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0xf}}, 0x10) socket$packet(0x11, 0xa, 0x300) r3 = socket$alg(0x26, 0x5, 0x0) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r4, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000e40)={{0x14}, [@NFT_MSG_NEWTABLE={0x20, 0x0, 0xa, 0x5, 0x0, 0x0, {0x5}, [@NFTA_TABLE_NAME={0x9, 0x1, 'syz0\x00'}]}, @NFT_MSG_NEWCHAIN={0x2c, 0x3, 0xa, 0x101, 0x0, 0x0, {0x5}, [@NFTA_CHAIN_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_CHAIN_NAME={0x9, 0x3, 'syz0\x00'}]}, @NFT_MSG_NEWRULE={0x44, 0x6, 0xa, 0x401, 0x0, 0x0, {0x5}, [@NFTA_RULE_CHAIN_ID={0x8}, @NFTA_RULE_EXPRESSIONS={0x14, 0x4, 0x0, 0x1, [{0x10, 0x1, 0x0, 0x1, @dup={{0x8}, @val={0x4}}}]}, @NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_RULE_USERDATA={0x5, 0x7, 0x1, 0x0, "ae"}]}], {0x14}}, 0xb8}}, 0x0) syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) r5 = accept4(r3, 0x0, 0x0, 0x0) r6 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r6, &(0x7f0000000080)={0x2, 0x4e21, @multicast1}, 0x10) openat$6lowpan_control(0xffffffffffffff9c, &(0x7f00000017c0), 0x2, 0x0) close(0x3) ioctl$AUTOFS_IOC_PROTOVER(r6, 0x80049363, &(0x7f0000000040)) r7 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000280), r0) sendmsg$IPVS_CMD_GET_SERVICE(r5, &(0x7f00000003c0)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x24000}, 0xc, &(0x7f0000000380)={&(0x7f00000002c0)={0x14, r7, 0x100, 0x70bd25, 0x25dfdbfb}, 0x14}, 0x1, 0x0, 0x0, 0x4000011}, 0x8044) setsockopt$sock_int(r3, 0x1, 0x2e, &(0x7f0000000100)=0x3, 0x4) openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) socket(0x400000000010, 0x3, 0x4) connect$inet(r6, &(0x7f0000000180)={0x2, 0x4e21, @dev={0xac, 0x14, 0x14, 0x1d}}, 0x10) setsockopt$inet_tcp_TCP_REPAIR_OPTIONS(r6, 0x6, 0x16, &(0x7f0000000000)=[@mss, @sack_perm, @window={0x3, 0x7}, @mss={0x2, 0xfff}, @window={0x3, 0x0, 0x401}, @window], 0x20000000000000e4) r8 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r8, &(0x7f0000000200)={0x0, 0x29, &(0x7f0000000180)={&(0x7f0000000000)=@newlink={0x30, 0x10, 0x1, 0x70bd29, 0x25dfdbfd, {0x0, 0x0, 0x0, 0x0, 0x1021, 0x3}, [@IFLA_GROUP={0x8}, @IFLA_MTU={0x8, 0x4, 0x500}]}, 0x30}, 0x1, 0x0, 0x0, 0x801}, 0x4000000) setsockopt$inet_tcp_TCP_REPAIR(r6, 0x6, 0x13, &(0x7f00000001c0), 0x4) sendto$inet(r6, &(0x7f0000000000), 0xffffffffffffff94, 0xb, 0x0, 0x0) recvfrom$inet(r6, &(0x7f0000000080)=""/8, 0xfffffffffffffd0b, 0xc9100120, 0x0, 0xfffffffffffffd25) 2.715135704s ago: executing program 4 (id=2526): r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000780)={0x15, 0x3, &(0x7f0000000540)=ANY=[@ANYBLOB="1800000000000000000000000000000095"], &(0x7f00000005c0)='GPL\x00'}, 0x94) r1 = socket$inet6_icmp(0xa, 0x2, 0x3a) setsockopt$sock_attach_bpf(r1, 0x1, 0x34, &(0x7f0000000040)=r0, 0x4) r2 = socket$kcm(0x29, 0x5, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) socketpair$tipc(0x1e, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) recvmsg(r4, &(0x7f0000000500)={&(0x7f0000000040)=@hci, 0x80, &(0x7f0000000100)=[{&(0x7f0000000400)=""/248, 0x200105d0}], 0x1}, 0x1f00) sendmsg$tipc(r5, &(0x7f0000000240)={0x0, 0xfffffff5, &(0x7f0000000200)=[{&(0x7f0000000140)="a2", 0xfffffdef}], 0x1}, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f07ebbeef, 0x8031, 0xffffffffffffffff, 0x215eb000) r6 = socket$nl_generic(0x10, 0x3, 0x10) r7 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000040), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r3, 0x8933, &(0x7f00000002c0)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_JOIN_MESH(r6, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f00000000c0)={0x30, r7, 0x1, 0x70bd25, 0x25dfdbfd, {{}, {@val={0x8, 0x3, r8}, @void}}, [@NL80211_ATTR_MESH_ID={0xa}, @NL80211_ATTR_MCAST_RATE={0x8, 0x6b, 0xb4}]}, 0x30}}, 0x0) syz_genetlink_get_family_id$devlink(&(0x7f0000000000), r6) sendmsg$kcm(r2, &(0x7f0000000280)={0x0, 0xffe4, &(0x7f0000000ac0)=[{&(0x7f0000000b00)="b6bd7e4983a45b31f79d80060400000000000000a33734d88229acf96457ad59d0b87f8659b614043e3d21a7cacecab8bbd26251b93b28b4d83e618673f9c74d0a28a5146c5511549fa617e908352c87d8ddff2ce042a1e58eb7b63759cab3526dd8ae1566ddcfb5fa83e8b2940b3ed1b8", 0x71}, {&(0x7f0000000880)="3aa854", 0x3}, {&(0x7f0000000a40)="746b9120a32aaf78043a9b07000000000000003c44", 0xfffffe16}], 0x3}, 0xc854) r9 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r9, &(0x7f0000000100)={0x2, 0x4e23, @loopback}, 0x10) setsockopt$SO_TIMESTAMPING(r9, 0x1, 0x25, &(0x7f00000001c0)=0x327, 0x4) connect$inet(r9, &(0x7f0000001bc0)={0x2, 0x4e23, @loopback}, 0x10) sendto$inet(r9, &(0x7f00000002c0)="01a4acc7cf28ab9f6c7fc745c30bfc165466072a660bbf56352083db9d40454a67f8010000004bd29585885c89773ca3ba28a1e85ffe2a9220e0ecd440e345b745bf2146835ad015c801f95be5b890e44fb3dfbe8e88a1e5176e584c9702", 0x7fc8, 0x0, 0x0, 0x0) setsockopt$sock_int(r2, 0x1, 0x2d, &(0x7f0000000100)=0x4c, 0x4) 2.714073231s ago: executing program 0 (id=2527): r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) sendmsg$IPVS_CMD_SET_INFO(r1, &(0x7f0000000b00)={0x0, 0x0, &(0x7f0000000ac0)={0x0, 0x14}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) unshare(0x26020480) r3 = socket$inet_udp(0x2, 0x2, 0x0) r4 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r4, &(0x7f0000000000)={0x40000000, 0x0, &(0x7f0000000040)={&(0x7f0000000240)=ANY=[@ANYBLOB="0207000902"], 0x10}}, 0x0) r5 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r5, &(0x7f00000001c0)={0x2, 0x0, @local}, 0x16) connect$inet(r5, &(0x7f0000000480)={0x2, 0x0, @multicast2}, 0x10) setsockopt$packet_int(0xffffffffffffffff, 0x107, 0xa, &(0x7f0000000080)=0x2, 0x4) setsockopt$packet_rx_ring(0xffffffffffffffff, 0x107, 0x5, &(0x7f0000000040)=@req3={0x1000, 0x3a, 0x1000, 0x3a, 0x0, 0x0, 0xffffffff}, 0x1c) setsockopt$inet_IP_XFRM_POLICY(r5, 0x0, 0x11, &(0x7f00000002c0)={{{@in6=@dev, @in6=@mcast2, 0x0, 0x0, 0xffff, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0xee01}, {0x0, 0x28c, 0x1}, {0x7}, 0x0, 0x0, 0x1}, {{@in=@rand_addr=0x64010102, 0x2000000, 0x33}, 0x0, @in6=@loopback, 0x0, 0x3, 0x0, 0xb7, 0x0, 0x8000000}}, 0xe8) getsockopt$inet_sctp_SCTP_INITMSG(0xffffffffffffffff, 0x84, 0x2, &(0x7f0000000100), &(0x7f0000000140)=0x8) ioctl$NS_GET_OWNER_UID(0xffffffffffffffff, 0xb704, &(0x7f00000000c0)=0x0) setsockopt$inet_IP_XFRM_POLICY(r5, 0x0, 0x11, &(0x7f00000004c0)={{{@in6=@empty, @in=@multicast2, 0x4e24, 0xdfe1, 0x4e22, 0x4, 0xa, 0x80, 0x80, 0x6, 0x0, r6}, {0x0, 0x5e, 0x1ff, 0x8, 0x296, 0x5, 0x2, 0x242}, {0x9, 0x100, 0xffffffffffffffc0, 0xfd6c}, 0x3, 0x6e6bb5, 0x1, 0x0, 0x3, 0x1}, {{@in=@local, 0x4d6, 0x2b}, 0x2, @in6=@mcast2, 0x3503, 0x4, 0x0, 0x2e, 0x1, 0x0, 0x5}}, 0xe8) sendmmsg(r5, &(0x7f0000007fc0), 0x800001d, 0x0) setsockopt$inet_IP_XFRM_POLICY(r3, 0x0, 0x11, &(0x7f00000002c0)={{{@in6=@private0={0xfc, 0x0, '\x00', 0x1}, @in6=@mcast1, 0x0, 0x0, 0x4e21, 0x0, 0x2, 0x0, 0x0, 0x2f}, {0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, 0xffffffffffffffff}, {0x0, 0x400000000}, 0x3, 0x0, 0x1, 0x0, 0x0, 0x2}, {{@in6=@local, 0x1, 0x6c}, 0x0, @in=@dev={0xac, 0x14, 0x14, 0x3d}, 0x0, 0x0, 0x0, 0xb7}}, 0xe8) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000380)=ANY=[@ANYBLOB="3c0000001000850600"/20, @ANYRES32=r2, @ANYBLOB="01000000000000001c0012000c000100626f6e64000000000c0002000800010006"], 0x3c}}, 0x0) r7 = socket$nl_route(0x10, 0x3, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000180)=0x14) sendmsg$nl_route(r7, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000003c0)=@newlink={0x44, 0x10, 0x403, 0x78bd28, 0x0, {0x0, 0x0, 0x0, 0x0, 0x90646}, [@IFLA_LINKINFO={0x1c, 0x12, 0x0, 0x1, @vlan={{0x9}, {0xc, 0x2, 0x0, 0x1, [@IFLA_VLAN_ID={0x6, 0x1, 0x2}]}}}, @IFLA_LINK={0x8, 0x5, r8}]}, 0x44}, 0x1, 0x0, 0x0, 0x20000600}, 0x0) sendmsg$nl_route(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000280)=@newlink={0x50, 0x10, 0xffffff1f, 0x0, 0x1, {0x0, 0x0, 0x0, 0x0, 0x0, 0x4408}, [@IFLA_LINKINFO={0x28, 0x12, 0x0, 0x1, @geneve={{0xb}, {0x18, 0x2, 0x0, 0x1, [@IFLA_GENEVE_REMOTE6={0x14, 0x7, @loopback}]}}}, @IFLA_MASTER={0x8, 0xa, r2}]}, 0x50}, 0x1, 0x0, 0x0, 0x40000}, 0x0) 1.821187543s ago: executing program 2 (id=2533): r0 = socket$inet6(0xa, 0xa, 0xf93) (async) r1 = syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0) getsockopt$WPAN_SECURITY(r1, 0x0, 0x1, &(0x7f0000000000), &(0x7f0000000040)=0x4) (async) ioctl$sock_SIOCSIFVLAN_GET_VLAN_INGRESS_PRIORITY_CMD(0xffffffffffffffff, 0x8983, &(0x7f0000000080)) r2 = gettid() ioctl$sock_SIOCSPGRP(0xffffffffffffffff, 0x8902, &(0x7f00000000c0)=r2) (async) r3 = socket$vsock_stream(0x28, 0x1, 0x0) ioctl$sock_SIOCADDRT(r3, 0x890b, &(0x7f0000000140)={0x0, @l2tp={0x2, 0x0, @multicast2, 0x4}, @tipc=@id={0x1e, 0x3, 0x1, {0x4e20, 0x2}}, @in={0x2, 0x4e24, @broadcast}, 0x1ff, 0x0, 0x0, 0x0, 0x31e6, &(0x7f0000000100)='vlan0\x00', 0x4, 0x1, 0xc370}) (async) sendmsg$AUDIT_SIGNAL_INFO(0xffffffffffffffff, &(0x7f0000000200)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x1}, 0xc, 0xffffffffffffffff, 0x1, 0x0, 0x0, 0x48010}, 0x0) (async) ioctl$sock_FIOGETOWN(r3, 0x8903, &(0x7f0000000240)) (async) r4 = openat$tun(0xffffffffffffff9c, &(0x7f0000000280), 0x82000, 0x0) write$tun(r4, &(0x7f00000002c0)={@val={0x0, 0x600a}, @val={0x1, 0x1, 0x2, 0x7, 0x10, 0xf2b3}, @ipv6=@dccp_packet={0x7, 0x6, "06f8de", 0x18e, 0x21, 0x1, @remote, @empty, {[@srh={0x5e, 0x4, 0x4, 0x2, 0x9, 0x20, 0x7, [@mcast2, @ipv4={'\x00', '\xff\xff', @multicast1}]}, @routing={0x32, 0x2, 0x1, 0xc, 0x0, [@ipv4={'\x00', '\xff\xff', @empty}]}, @fragment={0x29, 0x0, 0x6, 0x1, 0x0, 0x1, 0x67}, @routing={0x2e, 0x10, 0x1, 0xc, 0x0, [@private0={0xfc, 0x0, '\x00', 0x1}, @empty, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01', @remote, @local, @dev={0xfe, 0x80, '\x00', 0x17}, @ipv4={'\x00', '\xff\xff', @multicast1}, @empty]}, @routing={0x73, 0x2, 0x1, 0x40, 0x0, [@private2={0xfc, 0x2, '\x00', 0x1}]}, @routing={0x88, 0x2, 0x1, 0x73, 0x0, [@remote]}, @hopopts={0x0, 0x0, '\x00', [@generic={0x7}]}, @routing={0x32, 0xa, 0x0, 0x7, 0x0, [@mcast2, @loopback, @loopback, @local, @ipv4={'\x00', '\xff\xff', @remote}]}], {{0x4e20, 0x4e20, 0x4, 0x1, 0x1, 0x0, 0x0, 0x8, 0x6, "3b3ded", 0xfa, "d5daaf"}, "4765ccbc9b1da0c061f525cb75ca4bdb6217527c1eaa"}}}}, 0x1c4) (async) r5 = accept4(r0, &(0x7f00000004c0)=@tipc=@name, &(0x7f0000000540)=0x80, 0x800) r6 = syz_genetlink_get_family_id$nl80211(&(0x7f00000005c0), 0xffffffffffffffff) sendmsg$NL80211_CMD_NEW_MPATH(r5, &(0x7f00000006c0)={&(0x7f0000000580)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f0000000680)={&(0x7f0000000600)={0x68, r6, 0x200, 0x70bd29, 0x25dfdbfc, {{}, {@void, @void}}, [@NL80211_ATTR_MPATH_NEXT_HOP={0xa}, @NL80211_ATTR_MPATH_NEXT_HOP={0xa, 0x1a, @broadcast}, @NL80211_ATTR_MAC={0xa}, @NL80211_ATTR_MAC={0xa, 0x6, @broadcast}, @NL80211_ATTR_MAC={0xa, 0x6, @device_b}, @NL80211_ATTR_MPATH_NEXT_HOP={0xa}, @NL80211_ATTR_MAC={0xa}]}, 0x68}, 0x1, 0x0, 0x0, 0x80}, 0xc0c5) ioctl$EXT4_IOC_GROUP_EXTEND(r1, 0x40086607, &(0x7f0000000700)=0x86e4) (async) r7 = openat$tun(0xffffffffffffff9c, &(0x7f0000000740), 0x400000, 0x0) ioctl$TUNSETSTEERINGEBPF(r7, 0x800454e0, &(0x7f0000000780)) (async) r8 = epoll_create1(0x80000) ioctl$sock_kcm_SIOCKCMCLONE(r5, 0x89e2, &(0x7f00000007c0)={r8}) sendmsg$NL80211_CMD_LEAVE_MESH(r9, &(0x7f00000008c0)={&(0x7f0000000800)={0x10, 0x0, 0x0, 0x40000000}, 0xc, &(0x7f0000000880)={&(0x7f0000000840)={0x20, r6, 0x8, 0x70bd2a, 0x25dfdbfc, {{}, {@void, @val={0xc, 0x99, {0x8, 0x4a}}}}, ["", "", "", "", "", "", "", "", ""]}, 0x20}, 0x1, 0x0, 0x0, 0x82000}, 0x8004) r10 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL80211_CMD_SET_MAC_ACL(r10, &(0x7f00000009c0)={&(0x7f0000000900)={0x10, 0x0, 0x0, 0x800}, 0xc, &(0x7f0000000980)={&(0x7f0000000940)={0x14, r6, 0x800, 0x70bd29, 0x25dfdbfb, {{}, {@void, @void}}}, 0x14}, 0x1, 0x0, 0x0, 0x800}, 0x44001) (async) sendmsg$NL80211_CMD_GET_PROTOCOL_FEATURES(r5, &(0x7f0000000ac0)={&(0x7f0000000a00)={0x10, 0x0, 0x0, 0x10}, 0xc, &(0x7f0000000a80)={&(0x7f0000000a40)={0x14, r6, 0x100, 0x70bd2b, 0x25dfdbfd, {}, ["", "", "", "", "", "", "", ""]}, 0x14}}, 0x0) r11 = socket$inet_udp(0x2, 0x2, 0x0) (async) getsockname$packet(r9, &(0x7f0000000b00)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @multicast}, &(0x7f0000000b40)=0x14) ioctl$sock_ipv4_tunnel_SIOCCHGTUNNEL(r11, 0x89f3, &(0x7f0000000c40)={'syztnl1\x00', &(0x7f0000000b80)={'gre0\x00', r12, 0x8, 0x80b0, 0x81, 0x4, {{0x1b, 0x4, 0x3, 0x5, 0x6c, 0x65, 0x0, 0x6, 0x29, 0x0, @private=0xa010100, @initdev={0xac, 0x1e, 0x1, 0x0}, {[@timestamp_prespec={0x44, 0x14, 0x42, 0x3, 0x8, [{@initdev={0xac, 0x1e, 0x0, 0x0}, 0x4}, {@loopback, 0x7}]}, @noop, @ra={0x94, 0x4, 0x1}, @timestamp_prespec={0x44, 0x1c, 0xf, 0x3, 0x1, [{@dev={0xac, 0x14, 0x14, 0x15}, 0x9}, {@local, 0x9}, {@empty, 0x40}]}, @lsrr={0x83, 0x23, 0xe9, [@private=0xa010101, @multicast2, @dev={0xac, 0x14, 0x14, 0x2d}, @loopback, @dev={0xac, 0x14, 0x14, 0x31}, @broadcast, @remote, @private=0xa010101]}]}}}}}) (async) getsockopt$inet_sctp_SCTP_DEFAULT_PRINFO(r9, 0x84, 0x72, &(0x7f0000000c80)={0x0, 0x6, 0x30}, &(0x7f0000000cc0)=0xc) getsockopt$inet_sctp_SCTP_STREAM_SCHEDULER_VALUE(r5, 0x84, 0x7c, &(0x7f0000000d00)={r13, 0x9, 0x401}, &(0x7f0000000d40)=0x8) (async) sendto(r3, &(0x7f0000000d80)="a8461874c81e90508aec3d52fc2e45b84951de82a48369bf5802f735a1959bf54e52fe58ccc49fa0a3ffc0a424c4cf10f7d319c2eb2e557311bb10fb4284bbbf5414f93a3d2cc0a28b94afb2fbd82eb877035507749b2997dbba4aa2ffa7bb320350db6317cf32077bd27069a911202b453f8c3445f8cb742f2b47ad176a1f55b309bd941bf263520eabe262fcb8c76556943e41f82ab50ecf0687d1354a5afe029f9ed2ed343398669dbb29ee75027e5e26270ecb7684e793bb9fb9281b5d0faef99ffbc93b4950396547b1f0d8687a84c000e989a05dadac0a52099242dd9e4931fcad99e788df33e4", 0xea, 0x5, 0x0, 0x0) 1.817976451s ago: executing program 3 (id=2534): r0 = socket$l2tp6(0xa, 0x2, 0x73) sendmmsg$inet6(r0, &(0x7f0000007000)=[{{&(0x7f0000000140)={0xa, 0x4e21, 0x101, @private1, 0x9}, 0x1c, 0x0, 0x0, &(0x7f00000003c0)=[@hoplimit={{0x14, 0x29, 0x34, 0x3586}}], 0x18}}], 0x1, 0x40) r1 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$SO_TIMESTAMPING(r1, 0x1, 0x25, &(0x7f00000001c0)=0x2931, 0x4) (async) connect$inet(r1, &(0x7f00000002c0)={0x2, 0x4e22, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10) (async) sendmmsg(r1, &(0x7f0000007fc0), 0x800001d, 0x0) setsockopt$sock_int(r1, 0x1, 0x29, &(0x7f0000000000)=0x7b, 0x4) recvmmsg(r1, &(0x7f0000004680)=[{{0x0, 0x0, 0x0}, 0xfffffe01}], 0x1, 0x2000, 0x0) syz_emit_ethernet(0x46, &(0x7f00000001c0)=ANY=[@ANYRES8=r0], 0x0) 1.624402533s ago: executing program 0 (id=2535): r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000680)=@newsa={0x16c, 0x10, 0x713, 0x0, 0x25dfdbfc, {{@in6=@rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01', @in6=@rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01', 0x0, 0x0, 0x4e21, 0x2, 0x2, 0x0, 0x0, 0x6c, 0x0, 0xee00}, {@in6=@private1, 0xfe, 0x32}, @in6=@ipv4={'\x00', '\xff\xff', @remote}, {0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x5, 0x543}, {0x7, 0x7fffffffffffffff}, {0x0, 0x0, 0x2000000}, 0x70bd2d, 0x3500, 0xa, 0x4, 0x0, 0x50}, [@algo_aead={0x60, 0x12, {{'rfc4106(gcm(aes))\x00'}, 0xa0, 0x60, "210466d38547aa140db90100000000c54222cb7a"}}, @encap={0x1c, 0x4, {0x2, 0x4e24, 0x4e24, @in=@remote}}]}, 0x16c}, 0x1, 0x0, 0x0, 0x880}, 0x0) mmap(&(0x7f0000107000/0x4000)=nil, 0x4000, 0xd, 0x10010, 0xffffffffffffffff, 0x0) socket$inet_icmp_raw(0x2, 0x3, 0x1) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x5) close(0x4) syz_open_procfs$namespace(0x0, &(0x7f0000000200)='ns/pid_for_children\x00') unshare(0x6a040000) bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="1b00000000000000000000000080"], 0x48) bpf$PROG_LOAD(0x5, &(0x7f0000000980)={0x1, 0xf, 0x0, &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x24, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r1 = socket$nl_xfrm(0x10, 0x3, 0x6) setsockopt$netlink_NETLINK_ADD_MEMBERSHIP(r1, 0x10e, 0x1, &(0x7f0000000a80)=0x1, 0x4) r2 = socket$inet6(0xa, 0x3, 0x1) setsockopt$inet6_IPV6_XFRM_POLICY(r2, 0x29, 0x23, &(0x7f0000000980)={{{@in=@multicast1, @in=@broadcast, 0x421f, 0x0, 0x0, 0x5, 0x2}, {0x10000, 0x200000004, 0x8, 0x6811221d, 0x100000000, 0x4, 0x200000003, 0x9}, {0x0, 0xfffffffffffffffd, 0x7}, 0x9, 0x0, 0x1, 0x0, 0x6}, {{@in=@empty, 0x0, 0x2b}, 0xa, @in6=@local, 0x3502, 0x1, 0x0, 0x0, 0x9, 0x6c}}, 0xe8) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, 0x0) connect$inet6(r2, &(0x7f0000000000)={0xa, 0x0, 0x0, @ipv4={'\x00', '\xff\xff', @local}}, 0x1c) socket$kcm(0x11, 0x200000000000002, 0x300) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) close(r3) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r3, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x0) sendmsg$NFT_BATCH(r4, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f0000000340)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a4c000000090a010400000000000000000a0000040900010073797a310000000008000540000000020900020073797a310000000008000a40ffffff07000000400000001408000c4000000e45400000000c0a010100000000000000000a0000060900020073797a31000000000900010073797a310000000014000380100000800c00018006000100d103000014000000110001"], 0xb4}, 0x1, 0x0, 0x0, 0x40090}, 0x20008040) sendmsg$NFT_BATCH(r3, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f00000002c0)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a400000000c0a01010000000000f9ff000a0000090900020073797a31000000200900010073797a310000000014000380100000800c00018006000100582e000014000000110001"], 0x68}, 0x1, 0x0, 0x0, 0x4004850}, 0x40) r5 = socket$nl_netfilter(0x10, 0x3, 0xc) r6 = socket$l2tp(0x2, 0x2, 0x73) bind$inet(r6, &(0x7f00000002c0)={0x2, 0x4e20, @empty}, 0x10) connect$inet(r6, &(0x7f0000000200)={0x2, 0x0, @local}, 0x10) sendmmsg$inet(r6, &(0x7f0000000900)=[{{0x0, 0x0, 0x0}}], 0x40000cf, 0x0) getsockopt$IP_VS_SO_GET_DAEMON(r6, 0x0, 0x34, 0x0, &(0x7f0000000500)) sendmsg$NFT_MSG_GETSETELEM(r5, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000400)=ANY=[@ANYBLOB="40000000210a018800000000000000000a0000010900020073797a31000000000900010073797a310000000014000380100000800c000180060001"], 0x40}, 0x1, 0x0, 0x0, 0x4000805}, 0x8000) 1.528253645s ago: executing program 2 (id=2536): setsockopt$IP6T_SO_SET_REPLACE(0xffffffffffffffff, 0x29, 0x40, &(0x7f0000000000)=@raw={'raw\x00', 0x8, 0x3, 0x298, 0x128, 0xffffffff, 0xffffffff, 0x0, 0xffffffff, 0x248, 0xffffffff, 0xffffffff, 0x248, 0xffffffff, 0x3, 0x0, {[{{@ipv6={@remote, @ipv4={'\x00', '\xff\xff', @dev={0xac, 0x14, 0x14, 0x25}}, [0xff, 0xff000000, 0x0, 0xffffff00], [0xff000000, 0xff, 0xbfa6c1dfb8cc9f2d], 'wg2\x00', 'veth0_virt_wifi\x00', {}, {}, 0x29, 0x10, 0x0, 0x60}, 0x0, 0xa8, 0xf0, 0x60030000, {0x0, 0xff000000}}, @common=@unspec=@IDLETIMER={0x48, 'IDLETIMER\x00', 0x0, {0x0, 'syz1\x00', {0x8}}}}, {{@ipv6={@initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, @empty, [0xff000000, 0xffffff00, 0xffffff00, 0xff], [0xff, 0xff, 0xffffffff, 0xff], 'ip6gre0\x00', '\x00', {0xff}, {}, 0x0, 0x2, 0x4}, 0x0, 0xa8, 0xd8}, @common=@unspec=@CONNMARK={0x30, 'CONNMARK\x00', 0x1, {0x8000002, 0x6, 0x9}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x2f8) r0 = socket(0x2, 0xa, 0x8) (async) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000040)={'bridge_slave_0\x00', 0x0}) sendmsg$nl_route(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000340)=ANY=[@ANYBLOB="280000001c0001060e305900ffdbdf2507000000", @ANYRES32=r2, @ANYRESDEC=0x0], 0x28}, 0x1, 0x0, 0x0, 0x5}, 0x4040004) (async, rerun: 32) sendmsg$NL80211_CMD_VENDOR(r0, &(0x7f00000005c0)={&(0x7f0000000300)={0x10, 0x0, 0x0, 0x800000}, 0xc, &(0x7f0000000580)={&(0x7f0000000480)={0xe4, 0x0, 0x100, 0x70bd28, 0x25dfdbfd, {{}, {@void, @val={0x8}, @val={0xc, 0x99, {0x0, 0x60}}}}, [@NL80211_ATTR_VENDOR_DATA={0x91, 0xc5, "1e5ce2e3aace1a4a5452ccfd5ee1d8617bc07ced787acc9323eae415938afdf46bcb416fceb5e908d3f34887ef47dcf2e23db89d1e68cecb231982ee35dd3193b3b60dca3844ca67574f2d3e54346d95711724df7f1dda36d116177ad827b9984a5a190d689715adb7057cdd652e6c7e0c304706232ce1339504841c5b14ba3a6f902a543afd783beb94b01494"}, @NL80211_ATTR_VENDOR_SUBCMD={0x8, 0xc4, 0x2}, @NL80211_ATTR_VENDOR_SUBCMD={0x8, 0xc4, 0xa9f7}, @NL80211_ATTR_VENDOR_SUBCMD={0x8, 0xc4, 0x2}, @NL80211_ATTR_VENDOR_ID={0x8, 0xc3, 0x9}, @NL80211_ATTR_VENDOR_ID={0x8, 0xc3, 0x9}]}, 0xe4}, 0x1, 0x0, 0x0, 0x40000}, 0x20044805) (rerun: 32) sendmmsg(r0, &(0x7f0000000000), 0x400000000000235, 0x0) 1.176866216s ago: executing program 3 (id=2538): socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000380)={0xffffffffffffffff}) r1 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f0000001d40)=ANY=[@ANYBLOB="0300000004000000040000000a"], 0x48) r2 = bpf$PROG_LOAD(0x5, &(0x7f0000000500)={0x1, 0x10, &(0x7f0000000bc0)=ANY=[@ANYBLOB="1808000000000000000000000000000018120000", @ANYRES32=r1, @ANYBLOB="0000000000000000b703000000000000850000000c000000b7000000000000001801000000082c2500000000002120207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000000700000095"], &(0x7f0000000980)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) setsockopt$sock_attach_bpf(r0, 0x1, 0x32, &(0x7f00000000c0)=r2, 0x4) r3 = accept4$packet(0xffffffffffffffff, 0x0, &(0x7f0000000680), 0x81000) getsockopt$packet_buf(r3, 0x107, 0xd, &(0x7f0000000340)=""/28, &(0x7f00000003c0)=0x1c) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000040)=@newqdisc={0x24, 0x24, 0x100, 0x70bd2a, 0x1, {0x0, 0x0, 0x0, 0x0, {0x2, 0xe}, {0xffff, 0xffff}, {0xe}}}, 0x24}, 0x1, 0x0, 0x0, 0x8000}, 0x0) r4 = socket$netlink(0x10, 0x3, 0x0) setsockopt$sock_linger(r3, 0x1, 0xd, &(0x7f0000000480)={0x0, 0x8}, 0x8) getsockopt$IP_VS_SO_GET_DAEMON(r0, 0x0, 0x487, &(0x7f00000001c0), &(0x7f0000000200)=0x30) ioctl$EXT4_IOC_GET_ES_CACHE(r4, 0xc020662a, &(0x7f0000000080)={0x0, 0x4, 0x0, 0x32, 0x1, 0x0, [{0x8001, 0x3d7, 0x6, '\x00', 0x200}]}) socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000500)=@newqdisc={0x2c, 0x24, 0xd0f, 0xfffffffd, 0xffffffff, {0x60, 0x0, 0x0, 0x0, {0xffe0, 0x2}, {0xfff2, 0x10}, {0xfff3, 0xfff2}}, [@TCA_INGRESS_BLOCK={0x8, 0xd, 0x4c}]}, 0x2c}, 0x1, 0x0, 0x0, 0x4000844}, 0x2000c8d1) bpf$MAP_UPDATE_BATCH(0x1a, &(0x7f0000000000)={0x0, 0x0, 0x0, &(0x7f0000010040), 0xfffffffe, 0xffffffffffffffff, 0x4}, 0x38) r5 = socket$alg(0x26, 0x5, 0x0) ioctl$sock_ipv6_tunnel_SIOCGET6RD(0xffffffffffffffff, 0x89f8, &(0x7f0000000800)={'syztnl0\x00', &(0x7f0000000700)={'gretap0\x00', 0x0, 0x8, 0x700, 0x6, 0x3, {{0x7, 0x4, 0x3, 0x31, 0x1c, 0x67, 0x0, 0x40, 0x29, 0x0, @rand_addr=0x64010101, @remote, {[@timestamp={0x44, 0x8, 0x1d, 0x0, 0x1, [0x8]}]}}}}}) sendmsg$DCCPDIAG_GETSOCK(r4, &(0x7f0000002100)={&(0x7f00000006c0)={0x10, 0x0, 0x0, 0x200000}, 0xc, &(0x7f00000020c0)={&(0x7f0000001d80)={0x304, 0x13, 0xd25, 0x70bd25, 0x25dfdbff, {0xb, 0x0, 0xf7, 0x0, {0x4e24, 0x4e22, [0xf, 0x10, 0x6, 0xff], [0x1, 0xd, 0x4b8045bc], r6, [0x8, 0x10000]}, 0xffffffff, 0x385}, [@INET_DIAG_REQ_BYTECODE={0xaa, 0x1, "11aefba4b4001c6296ba719e66afddb11e13da0d98f8ebb5ba5a2d3f7ea601a2cc1e1a00c3f261a2df9576585e7afed4108a4d8ff67a23e26f78429eea39a03bed6712ccdce827ed746ffecaca87b657f914fcdb3870f2943c719f3fdf9a41a4835251dc9bfa36a07312af854d29b3a955c5790a700ac59434db91c7de02fa3b5d5608db726c3ac0827f6705ab697a234daa876e6f4c6fba07296154723d97699c4d546bcecf"}, @INET_DIAG_REQ_BYTECODE={0x9c, 0x1, "bd12a0029e83479e1cd7250908a8bcc2da451813fcb0f5e4f2cd55c78be6c737316bd28c60e3e8fe953e1adb34ef90697f5672e52a1e47bd7068c10e9a494a6fc3f5e24ecb71081b79775b3ec43f4f50b370b492c625b39f71662b61d9a38010d75265f98b913b4a3c969359170a5cb620cb83c31c17a53e8267dbd49da9cca8a28d5f17dca766c616e65f21722a0b7080efdb3c0daceafe"}, @INET_DIAG_REQ_BYTECODE={0x61, 0x1, "9347bc4db825a3bd40931793bc4f004d8ad4276c4452682e5536171f9e5dacd7048d7d7be1f8c601eec77fbe5c70c2c4be130aada076b01af44ae083f6d69c5becb8fdbdc1ed1f53c37f39fd3a29c5b6ebe5809a25a721b11496099087"}, @INET_DIAG_REQ_BYTECODE={0x8e, 0x1, "387f572dfe99ed23cd5c16c597d9bc93a12f8e54875d7ea69d40b6c9d020805dbe56f84b64d0016965fc6973ac350a5e16de2678160bd989729d5c118dc419d175fef9b12abe6f3db0cca72805690761e31eb114cd5ceedc5f5021b9b4e1c729eee88a3828841246b52de1b32b6fe67cfa108cc264aabaf25a55c5de63655870890e66becb11f19fa9d3"}, @INET_DIAG_REQ_BYTECODE={0x79, 0x1, "58e8fb41b013793fd1d109703d4decb48ef8f2fa27fc52857b3ddd6a7447f5671df3c9d49f61f49333f6530971ebf184041d6365433cee2f02d459b8da1683337e1dad16e001b2bae0603c05391c1c8e0882b101feaaeac50365654edff9d7f19df9ae553220a06761ebaf98c380b56d36f11ebc1e"}]}, 0x304}, 0x1, 0x0, 0x0, 0x20000000}, 0x4008801) bind$alg(r5, &(0x7f00000004c0)={0x26, 'skcipher\x00', 0x0, 0x0, 'xts(serpent)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r5, 0x117, 0x1, 0x0, 0x0) r7 = accept4(r5, 0x0, 0x0, 0x800) sendmmsg$alg(r7, &(0x7f0000000040)=[{0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)="f78d9ca38fff48f3be52163448412ba8", 0x10}, {&(0x7f0000000140)="ebe3a0e9796cfd1647e299f4e376fdba128280b372219d205e81f4a7f71c1926aae1efd7e0054a863f3d5cfe6cb55b5bb9fa6935849e6098ed884e7cb51726b360fbb37b4fe035bbb095873048", 0x4d}, {&(0x7f00000003c0)="e8700e44", 0x4}], 0x3, &(0x7f0000000380)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x40800) bpf$PROG_LOAD(0x5, &(0x7f0000000040)={0x6, 0x10, &(0x7f0000000500)=ANY=[@ANYBLOB="18020000ff070000000000000300000018110000", @ANYRES32, @ANYBLOB="0000000000000000b702000001"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x80000000}, 0x94) r8 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000940)='hugetlb.2MB.usage_in_bytes\x00', 0x26e1, 0x0) close(r8) socket(0x10, 0x3, 0x0) ioctl$SIOCSIFHWADDR(r8, 0x8b34, &(0x7f0000000000)={'wlan1\x00', @random="000500000020"}) 1.043778472s ago: executing program 2 (id=2540): r0 = socket(0x11, 0x80a, 0x0) ioctl$sock_ipv6_tunnel_SIOCGETTUNNEL(r0, 0x89f0, &(0x7f0000000600)={'ip6tnl0\x00', &(0x7f0000000580)={'syztnl2\x00', 0x0, 0x0, 0x8, 0x0, 0x7ff, 0x5, @ipv4={'\x00', '\xff\xff', @private=0xa010101}, @private2={0xfc, 0x2, '\x00', 0x1}, 0x700, 0x700, 0x5, 0x31b}}) bpf$PROG_LOAD(0x5, &(0x7f0000000040)={0x3, 0x4, &(0x7f0000000340)=ANY=[@ANYBLOB="1800000004000000000000000a00000091116500000000009500"], &(0x7f0000000000)='syzkaller\x00', 0x6, 0x0, 0x0, 0x0, 0x8, '\x00', 0x0, @fallback=0x12, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffff8}, 0x94) (async) tee(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x0) (async) socket$inet(0x2, 0x0, 0x9) 1.043134133s ago: executing program 4 (id=2541): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) r2 = bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x3, 0x3, &(0x7f0000000880)=ANY=[@ANYBLOB="85000000130000005d0000000000000095000000000000000a621cf434b9eaafdc2a00e9bfde908990817b364e51afe9c8dab05b16a6437211f9f0570759f1cae63487ff68fffffffffffe8e3932e2b75a25a4cf8a9456aa8a701c318c67edb6e9330b53c0eeba8644311ba7541189070000f50c000000d8e5b1dc91c5499be2097784a94b6cc2d272ac751d8bce5db4862c1b2eab7007ceea158dbc329bab5f8450147b2b9629fdd6cdb5507d3a76dbaf6f93d161caa513f8aa41f795507856ea0015166c56ea0103220ed5a66834be086ef206a8606b04fc8462cbbe8233f381b4eefbdbdac708c1f4959cb6c008397006da8e243ec9fb19f3fab2b0f46d73a9f2d7c674cdbe4d7f76f5fbd05043e81f435fccf5063a93aa9b4c7f68670594"], &(0x7f0000000000)='GPL\x00', 0x5, 0x487, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @sched_cls}, 0x48) r3 = bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0xc, 0xe, &(0x7f0000002480)=ANY=[@ANYBLOB="b702000003000000bfa30000000000000703000000feffff7a0af0fff8ffffff79a4f0ff00000000b7060000ffffffff2d6405000000000065040400010000000404000001007d60b7030000000000006a0a00fe00000000850000000d000000b70000000000000095000010000000005ecefab8f2e85c6c1ca711fcd0cdfa146ec561750379585e5a076d83923dd29c034055b67dafe6c8dc3d5d78c07fa1f7e655ce34e4d5b3185fec0e07004e1a3aa502cd2424a66e6d2ef831ab7ea0c34f17e3946ef3bb622003b538dfd8e012e79578e51bc53099e90f4580d760551b5b341a29f31e3106d1ddd6152f7cbdb9cd38bdb2ca8eeb9c15ab3a14817ac61e4dd11183a13477bf7e860e3670ef0e789f65f1328d6704902cbe7bc04b82d2789cb132b8667c2147661df28d9961b63e1a9cf6c2a660a1fe3c184b751c51160fb20b1c581e7be6ba0dc001c4110555850915148ba532e6ea09c346dfebd38608b3280080005d9a9500000000000000334d83239dd27080e71113610e10d858e8327edb1fb6c86adac12233f9a1fb9c2aec61ce63a38d2fd50117b89a9ab359b4eea0c6e95767d42b4e54861d0227dbfd2e6d7f715a7f3deadd7130856f756436303767d2e24f29e5dad9796edb697aeea0182babd18c65ae1bd4f4390af9a9ceafd07ed00b0000002cab154ad029a1090000002780870014f51c3c975d5aec84222fff0d7216fdb0d3a0ec4be3e563112f0b39501aafe234870072858dc06e7c337642d3e5a815232f5e16c1b30c3a2a71bc85018e5ff2c910496f18afc9ffc2cc788bee1b47683db01a469398685211bbae3e2ed0a50e7313bff5d4c391ddece00fc772dd6b4d4de2a41990f05ca3bdfc92c88c5b8dcd36e7487afa447e2edfae4f390a8337841cef386e22cc22ee17476d738952229682e24b92533ac2a9f5a699593f084419cae0b4532bcc97d3ae486aca54183fb01c73f979ca9857399537f5dc2acb72c7ead0509d380578673f8b6e74ce23877a6b24db0e067345560942fa629fbef2461c96a088a22e8b15c3e233db7ab22e30d46a9624d37c10223fdae7ed04935c3c9068000000bc8619d73415cda2130f5011e48455b5a8b90dfae158b94f50adab988dd8e12baf5cc9398fff00404d5d99f82e20ee6a8c88e18c2977aab37d9ac4cfc1c7b40000000000000007ff57c39495c826b956ba859ac8e3c177b91bd7d5e41ff868f3ca1664fe2f3ced8416dc180604b60c2499d16d7d9158ffffffff00000000ef069dc42749289f854797f2f900c2a12d8c38a967c1bbe09315c29877a331bcc87dc3addb08141bdee5d27874b2f663ddeef0005b3d96c7aabf4df517d90bdc01e73835d5a3e1a9e90d7676074a0bde4471414c99d4894ee7f8139dc1e3428d2129369ee1b85af6eb2eea0d0df414b315f651c8070000001fa83ee830548f11e1038debd64cbe359454a3f2239cfe35f81b7aded448859968ff0e90500d0b07c0dd00490f167e6d5c1109681739dc33f75b2042b8ff8c21ad702cca54728acad5b39eef213d1ca296d2a27798c8ce2a305c0c7d35cf4b22549a4bd92052188bd20785f653b621491d04aaee0d409731091f4fb94c06006e3c1be2f633c1d987591ec3db58a7bb3042ec3f771f7a1338a5c3dd35e926049fe86e09c58e273cd905deb28c13c1ed1c0d9cae846bcbfa8cce7b893e1590bab105b0cb578af7dc7d5e87d48d376444e2de02f47c61e8e84ff828de453f34c2b08660b080efc707e676e1fb4d5865c0ca177a4c7fbb4e829ab0894a1062b445c00f576b2b5cc7f819abd0f885cc4806f47ffb966fcf1e54f5a2d38708194cd6f496e5dee734fe7da3770845cf442d488afdc0e17000000000000000000000000000000000000000000000000000005205000000dc1c56d59f35d3676329bb8cda690d192a070886df42b2708398773b45198b4a34ac977ebd4450e121d01342703f5bf030e935878a6d169cdfaa4252d4ea6b8f6216ff202b5b5a182cb5e8380100632d03a7ca6f6d0339f9953c30930804fdc3690d10ecb65dc5b47481edbf1eee2e8893e903054d16d29c28eb5167e9936ed327fb237a56224e49d9ea955a5f0dec1b3ccd35364600000000000000000000000000000000000000000000000000000000000026def743f1213bf817becd9e5a225d67521d1128eac7d80a5656ac2cbde21d3ebfbf69ff861f4394836ddf128d6d19079e64336e7c676505c78ad67548f4b192be1827fcd95cf107753cb0a6a979030000007081c6281e2d8429a863903ca75f4c7df3ea8fc2018d07af1491ef060cd4403a099f324661351df747aa6a65872dfdcfa68f65bd06b4082d43e121861b5cc09b986bf56c747d9a1cc5b506892c3a16ff10feea20bdac89bfb758cf3500000000000000000000000000000098e6db5a96055e764a3bfd4ccb20d2e800994f4b602d25b2c076f21c7102687e054bb93b2d013be6227fd99902b074c0de00733128c81c48c5e140b17d71ac48f137d10798c4272826d2ba55bbda0059636528c132ed06759d880d1bc291a76456ed7ee8bcb392fdf886dbc74879ec4b831904d7c101ebbaef3c0ae6d0cf0000000000000000000000000000000011cb735f66a559ef0cdb5163a15c0bb986474bf5d9542e3e48805ce53127e4c076d69d868df543717aaaa07d7aca056f7f036c2bcba0795d1a64868a29ac5321b3cd6ef5b1a741afc7124ee3df3a35e8014d6cb5fd6c054a10bb2146174c1d68b45fcfd7e531090ceae2f05536a4d5d6a4081e743827fb9c031d1fc9f195c2da189c49eaed6c30c71da0452e502ef393efeb02ebe82b1851cae5fa7c958ba23110b5e0e5b890803f28a356b2920e74564e0f8377b0ba5187fed2882b4780a1bcb583f1cb1470003ef9b592b9461328cfc01ebfce0ecdcea714a517dc40000000000000000000000000006bd0561e1cc72880cc3ec1bdf35eb670a9040e3b53cd826b94ad8aeb014e74787fe89fb3247a87d8bfb6d400142369f88964708d1d4db5a5df9d62ea6d805dfce568b885a50ed8e2eaf8a932287a1d3bfac17774e58875a63b77e07298e4b4f515189c6fcac3cd35dac9240e633219bb6a5a25865e6ed8e16caa5406b56702afe0befcabbc9a2a772a1a087f0d633d457bceb695b2cba3a1a2daa2dda796373cc0fe0a53236d028fc1076bb746b2717c8b6052f58c91bb8cc19474ab9d4d2160773829f078727f6c684ca749136a7f46ca28b00bb4237695b409859a3cb7dbf298c7802264387811e20a0d78489eab0b0e", @ANYBLOB="b1e89de5f90c58874c60583a1f815b2abec3d966ed5e58647d465af5b3601e4d55c268c667c6b0f3e18586362cb39dab10369515b187615978046e04a45f9192cb36845a6e9ec021d7c78439ae777cd0"], &(0x7f0000000340)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x10, 0x2}, 0x94) socket$kcm(0x11, 0x200000000000002, 0x300) r4 = bpf$PROG_LOAD(0x5, &(0x7f0000000600)={0x1, 0x5, &(0x7f0000001540)=ANY=[@ANYBLOB="bf16000000000000b7070000000100004870000000000000500000000000000095000000000000002ba728041598fbd30cb599e83d24a3aa81d36bb3019c13bd23212fb56fa54f2641d8b02c3815e79c1414eb07eae6f0711e6bd917487960717142fa9ea4318123f602000000000080de89e661168c1886d0d4d94f204e34ff65c26e278ef5b915395b19284a1a4bc72fbc1626e3a2a2ad358061d0ae0209e62f51ee988e6ea604ce974a22a550d6f97080980400003e05df3ceb9f1feae5737ecaa80a666963c474c2a100c788b277beee1cbf9b0a4d3881dcc7b1b85f3c3d44aeaccd3641110bec4e90a6341965c39e4b3431abe802f5ab3e89cf6c662ed4048d3b3e22278d00ce00000000d3a02762c2951257b85802189d74005d2a1bcf9436e192e23fd275985bf31b714f000bcab6fcd610f25f5888000000003f11afc9bd08c6ebfbb89432fb465bc52f49129b9b6150e320c9901de2ebb9000000018e3095c4c5c7a156cec33a667dccaff950ca1e5efdd4c968dacf81baa3a509b1041d06f6b0097c430481824a3f4fddd3c643f630ba175d876defd3541772f26e27c44cfdb2d85d6d29983e830a9cdd79837b3468e8c67a571d0a017c100344c52a570dd39877dfb2ff1ae66e1ce917474b2e650ae630afd086004c4a56c6cce6e51723257c872c5255f20100000000000000f041b665ab21372c8d8b7bac5b5c784d20a4a24d8dbd75062e1daef9dead619cc6e7baa72707157791c3d2a286ffb8d35452bb5d36c2a8682bf7ecbd53f950ef4709ec01e230d2f53594ef4839c6130c4c13a0cca84b9935f771fd49e480cd9d48aeb12b1d6acabd38a817bcd222614d1f62734d679039a97d2b74f9e8e997ccd314000f7477137f4e8e7025123e783df8b8a17e3aa9fe1f662aef87a065b03cfb65b4dfe4f1b56e1f23128d743753a1de172d683d5892ce9414a1d98ea93e3d35dbb6c23b90cf36e83b8a434a97d09343d7f83079ccb02e69d384146056d125cfa788237874dd42dae334bda042819a2aa24dba1c25be2794448b4f63483026b5e34d44705b76ef29241adab0dd7d68bf975e02069f6f2425e1bc97a3d588085f16bef63a06578d4f5de7bfb6aaa75f16996d536256c02284cb1d3a6fb8cae87691fae365a70c3fc69e1565bba8dd8a8ca049f798abe646f738bebd69413afc9d8a5edd7aaa000000000000001e6c2f2a287c5278a218dbfaffffff00a14db5cfa6819eb1d39c48cfdc80d215c9e16e0c4736c819363154cca4e2f89800d18c89d7f46f679df6c9e2952ae1ebfd0ca88368ee6ce139e8b5822c22cf2e9dde943d34c432e1001171792c65986146666a5490928441f47e0fe5eac41824ca1fd0eb71aa243c88d5480efd8329d9a733d8f9ffffff5f912ac4e34bf6ea8a86da707b03bddb491ba0cc98f6be92c50008a2b50025419d1476c73132ca7ca26ce8a7e3ffb700f09e157f9b844051f1a642aca9ff98c9036471ccff0522903e7bcf62e18f7696bbc280b95e8e0d6fd5644b0ebde3a95b06548862de809d3dae3cccf109f7c78e8479a345e800000000000000000000009455bf417627ce723a5d9103706aba69279500bb82f6b5a3ddc0bd9856712945b70c75ce5b722578820820d010d7a3cffc99fc647d0b82ef26ab708c0b19ed144be51c3b398f0e6bb7a30006000000cba12953d58cff0f0378740fe6662f377b97d8e7cdb047acd083d3cd3856476a60a49ad127ba6570bafc2bbcf9ee721fd9cb467ff071e5604fbf0491245c0000007d932d7a64de4c4aa433fc0840aff7c47da3a4c6966d0000000000000000f6bfbae29e8a6e2a889f6ef6869d82d6bd73eb76b65c7a35a54a4a6b8ad4600e3a972a0bb5971a5f16590b0a03dafa3fd1118765cc8ab9fccf3b51c41a339f200f2fa33006910a679a9ae0187b4d750c4bd244cb0cbfd23b265f4d4da448a7a0d19c5e430a31609dfa2dde267551467eb6475293dd7012cc449009981f22820e57a0eff234ccfe21d7a2302e000669753d3c3432cc14ee1abe724adb6b5431befedd3e22971118f0e21aed1823cb7dde8212a8531bd9691dd4cc6a370e9eb56b3d790b98f2bd0db1e5de6a146597b2cbb7103040d2a39d7965d34df524b760ab92efcce7dd1574052c735935bf6a752c015c7f5ffee9ff66e5dd2866b15b6e0d17618cb1f5c1ee4b051f47db7aa110f499f840a5c965443d725556351ee25fe09f69494b053678dcadcf02e063dff2fa4bef1ac3bbbebe6c74d71ec3b23e29895eff1d1017024fe3e8cc759b05785adc346b7ffd05963f92c1d0d7d90ba878ad89e490f3e29ac51d30632869a534418f916bf6fe8167827a8e6c8f8b391c822805cb0adf1b8bd6947ff208753eb0d208ce14f7b206b2e02c21e963abc5ceb735c1b3c46b0a843de52a903375dfb663a8d8ee9c2b2705c1a81d9d3b9656b219c8cd99c9cafcd0d0540884d97aecb19983fc6af29ab44a82aff9cba921192c665b877af6539bdb1b567f481ba07982e7ad758f4e1eac69e7e88a63960975f490e161e371ec8534791e3b61c685d900a9c0839208356b53750e76fcc3c2d1bddcbd83897921414d0c02e8188f3df79ea2a5c5444004830e6cb227ca1bdafb977c00000000003a417193b8c5d793687335a930867094fd6a78218218e04b705ec62f1608cb569b81914e68f175b392af6bc4fd2121d7fd276af2c97a441b56e7a0687d98b8e76d8d0d231e4fe00be1de76bd19cc12e2bd938eb681ed6bc951c1b4f7c51af59eea4d40c6000000000200778a677b72786311153271a3313da02645e11761699e4d04ac86dd14ff7b9a10d3fa74696fe3953a5b7706bf5d1faba4b18808d9cb0e9db696dec4e0820ee4028d7225a2c9c427cf64cbde6fba056b2006b7a37c1181d530fb865e235cd302f3b4071ee5237ada986b9e5e3144bf479f277f10656ad3744037ccc9c63685a6f1109d2ea73773d3635f61497f1fa1ea4a16f601800bf3e59141fbf05a96113320c445f9ba8596970d5254727e804fbd99ccefb7c09269dd2c5c25e56e169ac15980f3f85f7ca36dd5950ef5b64fd46f123311829534a82940994199b3cf7a8fabea9930952f5da9b909c1946e55289f668c423fcbb31ae91864c882313151741a67538c9689dc8ecc9903c7041e5c0704e2fa55a756487517a7445cbd9e3f5175e41c0000000000000000000a000000bf98efd587fffe326f474b0b089c017b16c0062cbce96f5adebec52a79f9363909842f79c50a1520be46d87003137e4c5031f00123e812a5e37cd52c9eb7336281cb8c6ce9934b157d7875a70eaf103cb3938e2361c51cd1eab8a26b232acf6bf0ab829c26dab637538b2eb1420d812d2b80c777710ba0f18e4661681aa218d9ba54023ab4305d77eb15611ae2545835e9d30e9f6d4fb43a291c69545a1eea0f8720431132d8549f99bf6c5cb060da70cbb59d0a000000000034d083fc37d2449f72de0cbea4bc1dc89c136cdbc504f849d5502d77a95c7bfff4cd9c03058d0d4d07ea64824f1acf2b39389f675f39d01719cdbab3f1ce10609c8d7b3e37cb99b41da5e485a441b6a103549f55ab09dc98767763d1f2fafd45bb7d2b40050d1f8292f4d9ec6d0000000000003932062290f4996fdd55b06023437e9e2072daf7f5d82f6f1b5b89a41134f4dc2e65bb11272fdf8c8141f41d6160b3d8b6ecd16d14267f61b4881adee7f07f3d6af5ae79e16fe2c3f55ac7a6392d2e1d9b4286b6c3e1f5a76b85ed6e1f0000c67e6c5fcdc8c39381be4799b8cb2d08b8262c807dd755e22b801162381aa9d1af2bbc9cfd497585337eac408b8475b47a392a10cae349160f128e5f873a58064eb400c36a90624f6aed398a215e9ce64522ab249f67c38a656d32ecff5cdb2b039c4abf349d2c0f88a42e9189bbfa7f5cf35b6e7ef8f9d33163b7ea875583e3aec4714c9c4ca3ecb04f2720237615a28bf310b58ffa2a103216fdcc8c2d8f5d55e5e7ebf147105272aaae56e86d856b3cf79a3f7306436762dd1a08ce873e07cebc7892ec6f9f696da38feed3dc0001500e34adae1ba89a32bad2af9030f840f1ba46cdadd5cbacc59352c290f55d971b65953533668c25f21d8d62d849e9058eaa97c63491568887548f668cdbca2abf01a361a0b64d8b523e669da350e3ec7445dfbf366b0b3bc5e76824a1e43eaaeca70db90f2fa39596443447671933079a24fe3681ad9ac361f71ac279a688f10a1cc4df1112105edebc5e3bbc394c8305ab129ca2dfb9b7c5e9d097bd01b495cccefddce569117f7f5d6a6270ff0f0f4c371029ca8489571b55841bf3dd003bc81460eee57ceb3c33f4e9300b0144fe040cf5fcfcbb616c2070237881afdb314cecd1623f3e55ab8b7627fa1be349145a8d6313cbc790eefe2020138e82fb9d351be4ddcbcc9bc048dd3db5828d16baec6e07a007f0030f34ea3cfd524d6fa1d45da5641d6c94e1d3ae7fba1c85035d2a60ef1696e0d96aa1c60019f73ae0aa6113cd66ef26b5777337c26e1461405d86fdf091edd526f25cada439bb3609ed5c35ab60a539ade786bd6004d0ea3edbd6c4da0d8e8be8c771c8c8a0b07d9859e04adb18964dcce9bce546074c26dffbc2df372a016e8c845d4257000000000000000000000000000000000000f29657697d9c2b132b2dc2f5ea5122836582a7e85fe2bc166f17aefd9d861de0191f5277d4a3b5afb6f23d9eea2459f7844606e1202768d83c24cc791bde44a448022bbfa571fe029a7b2d5152639ee283894ab6168992ff0acc01b39a078f285ce615351f262019586eb9447bb3eaffd7b53d8f37ca6c5f1027dd5b7592996c8a7789ba108979cc9ad07ed86682843e2eaa855dd01443ee6ffde1811f10039d5d14458177096e15cc4d8f2582a1bea5ccb9f10f615c87c441dc50a244bc138a1cae9868c3079bafe69769000000000000000000e99b63029d219cd3545a8426b56554a9f265d3557eefb3602894507c256cb8ee9ebadfecb6afeb84ba757bfa8d00a5af0dd6aa1e8144ef8ef04410d52204c335408941b8eccc5c734cc6a05247142ed647f89bcb5c043acfb382b9cc918bc3cdc368983157851cdf678800aa7eb2a6cbc12c7ae23bc88b8f10223ab2a093429f3f6965bc5af0114cf6f246e891e20ecaad7059866506c3000000000c3230e901e885b7a4a36bdfdb5ce7a2e5807a0f4c1d461d1243fccf51b875b49490cd7d044e7a1e1a4c013fae1f070a8a37ab90da2efc6c875b3aab34b75a252072691fc97bef0fed8ee597ab83bb53f89c36bc2ee3ad54904542f66dc94132df75fc9944882d6f2e13b7057e0000000000000000000000000000000000001b726c0ccd24000000000000cfd2f4d005578b9ed06e1c41ef3b411066739de953d39b968caaca1507928d68"], &(0x7f0000000300)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x17, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, r2, 0x0, 0x0, 0x0, 0x10, 0x10000}, 0x94) sendmsg$nl_generic(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000200)=ANY=[@ANYBLOB="14800000110007010040007c0000"], 0x14}, 0x1, 0x0, 0x0, 0xc000}, 0xc010) r5 = socket$nl_generic(0x10, 0x3, 0x10) r6 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r6, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000440)=ANY=[@ANYRES8=r4, @ANYRES32=0x0, @ANYRESHEX=r5, @ANYBLOB="00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001d00000000000000000000000000000000000000000000000000000000000000dd020000000000000000000000000000000000000000000084010500ac14143b000000000000000000000000000000002b00000000000000ac14140d000000000000000000000000000000000000ff00000000000000000000000000fc020000000000000000000000000000000004d63200000000000000e00000020000000000000008000000000000000000000000000000000000000000008000e0000002000000000000000000000000000000003c00000002000000ac1414bb000000000000000000000000006a6c0001030000000000000000000000000000ff020000000000000000000000000001000000003c000000020000002001000000000000000000000000000000000000010000000000000003000000000000007f000001000000000000000000"], 0x23c}}, 0x0) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000080)={r3, 0x2e0, 0x12c, 0x60000004, &(0x7f0000000100)="b9ff03076044238cb89e0cf086dd0de0ffff00184000630677fbac141414e000000162079f4b4d2f87e5feca6aab845013f2325f1a3901050b038da1880b25181aa59d943be3f4aed50ea5a6b8686731cb89ef77123c899b699eeaa8eaa0073461119663906400f30c0600000000000059b6d3296e8ca31bce1d8392078b72f24996ae17dffc2e43c8174b54b620636894aaacf28ff62616363c70a440aec4014caf28c0adc043084617d7ecf41e9d134589d46e5dfc4ca5780d38cae870b9a1df48b238190da450296b0ac01496ace23eefc9d4246dd14afbf79a2283a0bb7e1d235f3df126c3acc240d75a058f6efa6d1f5f7ff4000000000000000000", 0x0, 0xfe, 0x60000000, 0x0, 0x25, &(0x7f0000000040)="ded6e0966ec1cf6ba4b897a54e4e062b311453dcbb62932a01105d0a8066ca8e5e1f2f575d0d6e996b57fd408d420abb7337934e59815d75b4eb3e7206afce", &(0x7f0000000380)="af5fa441b438b5156d8a9fcc090f586e979858f64170cde36889dcc8539ffcca62621a4c3ea3f7acee366e6fb0b94314f90931dec60fed6c9fee64af416c29f65e47110b81f6b4da06db5e1aad1f627acb", 0x0, 0x3}, 0x2c) sendmsg$NFT_BATCH(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000003c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0) r7 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_tx_ring(r7, 0x107, 0x5, &(0x7f00000000c0)=@req3={0x808000, 0x4, 0x20300, 0xfc}, 0x1c) setsockopt$sock_int(r7, 0x1, 0x2, &(0x7f0000000040)=0xffffffff, 0x4) sendmsg$NFT_BATCH(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000640)=ANY=[], 0x54}}, 0x20000080) close(r1) syz_genetlink_get_family_id$nl80211(&(0x7f00000006c0), 0xffffffffffffffff) bpf$PROG_LOAD(0x5, &(0x7f0000000740)={0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1005c, '\x00', 0x0, @fallback=0xa, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x10, 0x6}, 0x94) r8 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r8, 0x8933, &(0x7f00000013c0)={'wlan1\x00', 0x0}) r10 = openat$ppp(0xffffffffffffff9c, 0x0, 0xc0802, 0x0) r11 = socket$inet6_mptcp(0xa, 0x1, 0x106) connect$inet6(r11, &(0x7f0000000040)={0xa, 0x4001, 0x0, @empty}, 0x1c) r12 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r12, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000006540)=ANY=[@ANYBLOB="200000003200bd700000000000067c00000c00018006000600843b0000"], 0x20}, 0x1, 0x0, 0x0, 0x4048011}, 0xc000) connect$unix(r11, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$inet6(r11, &(0x7f0000008c80)=[{{&(0x7f0000000000)={0xa, 0x4e22, 0xfd4e, @empty, 0xc}, 0x1c, 0x0}}], 0x1, 0x20000800) ioctl$BTRFS_IOC_QUOTA_CTL(r10, 0xc0109428, 0x0) sendmsg$NL80211_CMD_SET_TX_BITRATE_MASK(r0, &(0x7f0000000dc0)={0x0, 0x0, &(0x7f0000000d80)={&(0x7f0000000700)=ANY=[@ANYRESHEX=r6, @ANYRES8=r9, @ANYBLOB="010000000000000000003900000008000300", @ANYRES32=r9, @ANYRES16=r9], 0x34}, 0x1, 0x0, 0x0, 0x4044080}, 0x0) 1.003780006s ago: executing program 3 (id=2542): r0 = socket$inet6(0x10, 0x3, 0x0) bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0xd, 0x4, &(0x7f0000000040)=@framed={{0xffffffb4, 0x0, 0x0, 0x0, 0x0, 0x61, 0x14, 0x70}, [@ldst={0x6, 0x0, 0x5}]}, &(0x7f0000003ff6)='GPL\x00', 0x5, 0xfd90, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @sock_ops}, 0x48) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_FLUSH(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000080)={0x28, 0x4, 0x6, 0x201, 0x0, 0x0, {0x3, 0x0, 0x1}, [@IPSET_ATTR_SETNAME={0x9, 0x2, 'syz0\x00'}, @IPSET_ATTR_PROTOCOL={0x5}]}, 0x28}, 0x1, 0x0, 0x0, 0x8000}, 0x44010) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000000)=ANY=[@ANYBLOB="2c000000190001000000000000000000021800000000fd000000ed0008000100ac1414000800080004"], 0x2c}}, 0x0) r2 = socket$alg(0x26, 0x5, 0x0) bind$alg(r2, &(0x7f0000000200)={0x26, 'hash\x00', 0x0, 0x0, 'wp256\x00'}, 0x58) r3 = accept4(r2, 0x0, 0x0, 0x800) r4 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x2000, 0x0) ioctl$TUNATTACHFILTER(r4, 0x401054d5, &(0x7f0000000140)={0x1, &(0x7f00000000c0)=[{0x4, 0x40, 0x4, 0x5}]}) recvmmsg$unix(r3, &(0x7f0000003700)=[{{0x0, 0x700, 0x0, 0x0, 0x0, 0x500}}], 0x600, 0x0, 0x0) sendmmsg$unix(r3, &(0x7f0000003180)=[{{0x0, 0x0, &(0x7f0000000a00)=[{&(0x7f0000000500)='}', 0x1}], 0x1, 0x0, 0x0, 0x4004000}}], 0x1, 0x0) sendto$inet6(r0, &(0x7f0000000000)='s', 0x10a73, 0x800, 0x0, 0x4b6ae4f95a5de35b) setsockopt$IP6T_SO_SET_REPLACE(0xffffffffffffffff, 0x29, 0x40, 0x0, 0x0) 988.10545ms ago: executing program 0 (id=2543): r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$nl_rdma(0x10, 0x3, 0x14) sendmsg$RDMA_NLDEV_CMD_RES_MR_GET(r1, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000100)={0x20, 0x140d, 0x1, 0x70bd29, 0x25dfdbfb, "", [@RDMA_NLDEV_ATTR_DEV_INDEX={0x8}, @RDMA_NLDEV_ATTR_RES_MRN={0x8, 0x3e, 0x4}]}, 0x20}, 0x1, 0x0, 0x0, 0x36b3c6ffafb53114}, 0x20040000) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000740)=ANY=[@ANYRES32=r0, @ANYRES32=0x0, @ANYBLOB="00000000000000001c0012800b00010062726964676500000c00028008000800810000000a000100aa"], 0x48}}, 0x4) socket$nl_route(0x10, 0x3, 0x0) (async) socket$nl_rdma(0x10, 0x3, 0x14) (async) sendmsg$RDMA_NLDEV_CMD_RES_MR_GET(r1, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000100)={0x20, 0x140d, 0x1, 0x70bd29, 0x25dfdbfb, "", [@RDMA_NLDEV_ATTR_DEV_INDEX={0x8}, @RDMA_NLDEV_ATTR_RES_MRN={0x8, 0x3e, 0x4}]}, 0x20}, 0x1, 0x0, 0x0, 0x36b3c6ffafb53114}, 0x20040000) (async) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000740)=ANY=[@ANYRES32=r0, @ANYRES32=0x0, @ANYBLOB="00000000000000001c0012800b00010062726964676500000c00028008000800810000000a000100aa"], 0x48}}, 0x4) (async) 836.446934ms ago: executing program 1 (id=2544): r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000780)=ANY=[], 0x50}, 0x1, 0x0, 0x0, 0x24000804}, 0x48040) r1 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x3, 0xc, &(0x7f00000005c0)=ANY=[@ANYBLOB="180200000900000000000000010000008500000028000000180100002020702500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000003000000850000009b00000095000000000000005e9052136b5274d60a3c84f3eb59104ad497411a747d8f40e5216c0486ee1c9b680cd55b96f495be377e064e0b"], &(0x7f0000000040)='GPL\x00'}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f00000002c0)={r1, 0x0, 0xe, 0x0, &(0x7f0000000100)="e0b9547ed387dbe9abc89b6f5bec", 0x0, 0x2000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, 0x50) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(0xffffffffffffffff, 0x84, 0x6f, &(0x7f0000000000)={0x0, 0x1c, &(0x7f0000000080)=[@in6={0xa, 0x4e24, 0xd, @ipv4={'\x00', '\xff\xff', @private=0xa010102}, 0x4}]}, 0x0) sendmsg$NL80211_CMD_NEW_INTERFACE(0xffffffffffffffff, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000540)={&(0x7f00000008c0)={0x114, 0x0, 0x2, 0x70bd26, 0x25dfdbfd, {{}, {@val={0x8, 0x1, 0x9}, @val={0x8}, @val={0xc, 0x99, {0x80000001, 0x45}}}}, [@mon_options=[@NL80211_ATTR_MU_MIMO_GROUP_DATA={0x1c, 0xe7, "4e1bb08a28818c5ec2a72638c3ab1b39778d12e4fb36d648"}, @NL80211_ATTR_MU_MIMO_FOLLOW_MAC_ADDR={0xa, 0xe8, @broadcast}], @NL80211_ATTR_IFNAME={0x14, 0x4, 'lo\x00'}, @mon_options=[@NL80211_ATTR_MU_MIMO_FOLLOW_MAC_ADDR={0xa, 0xe8, @device_b}, @NL80211_ATTR_MNTR_FLAGS={0x24, 0x17, 0x0, 0x1, [@NL80211_MNTR_FLAG_PLCPFAIL={0x4}, @NL80211_MNTR_FLAG_OTHER_BSS={0x4}, @NL80211_MNTR_FLAG_ACTIVE={0x4}, @NL80211_MNTR_FLAG_CONTROL={0x4}, @NL80211_MNTR_FLAG_ACTIVE={0x4}, @NL80211_MNTR_FLAG_OTHER_BSS={0x4}, @NL80211_MNTR_FLAG_PLCPFAIL={0x4}, @NL80211_MNTR_FLAG_PLCPFAIL={0x4}]}, @NL80211_ATTR_MU_MIMO_GROUP_DATA={0x1c, 0xe7, "6293a2d26bb946a382a4a7b8cc034513621f2e726198c9f7"}, @NL80211_ATTR_MNTR_FLAGS={0x8, 0x17, 0x0, 0x1, [@NL80211_MNTR_FLAG_ACTIVE={0x4}]}, @NL80211_ATTR_MNTR_FLAGS={0x1c, 0x17, 0x0, 0x1, [@NL80211_MNTR_FLAG_COOK_FRAMES={0x4}, @NL80211_MNTR_FLAG_FCSFAIL={0x4}, @NL80211_MNTR_FLAG_FCSFAIL={0x4}, @NL80211_MNTR_FLAG_CONTROL={0x4}, @NL80211_MNTR_FLAG_COOK_FRAMES={0x4}, @NL80211_MNTR_FLAG_FCSFAIL={0x4}]}, @NL80211_ATTR_MNTR_FLAGS={0x10, 0x17, 0x0, 0x1, [@NL80211_MNTR_FLAG_PLCPFAIL={0x4}, @NL80211_MNTR_FLAG_CONTROL={0x4}, @NL80211_MNTR_FLAG_PLCPFAIL={0x4}]}, @NL80211_ATTR_MNTR_FLAGS={0x14, 0x17, 0x0, 0x1, [@NL80211_MNTR_FLAG_COOK_FRAMES={0x4}, @NL80211_MNTR_FLAG_PLCPFAIL={0x4}, @NL80211_MNTR_FLAG_OTHER_BSS={0x4}, @NL80211_MNTR_FLAG_FCSFAIL={0x4}]}, @NL80211_ATTR_MNTR_FLAGS={0x4}], @NL80211_ATTR_IFTYPE={0x8, 0x5, 0x6}, @NL80211_ATTR_4ADDR={0x5}]}, 0x114}, 0x1, 0x0, 0x0, 0x41}, 0x0) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000040)) r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000100)=@base={0x12, 0xc, 0x4, 0x2}, 0x50) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f00000003c0)={{r2, 0xffffffffffffffff}, &(0x7f0000000340), &(0x7f0000000380)}, 0x20) bpf$MAP_GET_NEXT_KEY(0x4, &(0x7f0000000300)={r3, &(0x7f0000000500), 0x0}, 0x20) socket$inet6(0xa, 0x3, 0x4) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='memory.events\x00', 0x275a, 0x0) socket$nl_route(0x10, 0x3, 0x0) socket$kcm(0x10, 0x2, 0x10) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000002c0)) socket$can_bcm(0x1d, 0x2, 0x2) socket$inet6_sctp(0xa, 0x5, 0x84) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000200)) syz_init_net_socket$llc(0x1a, 0x2, 0x0) r4 = socket$alg(0x26, 0x5, 0x0) socket(0x2, 0x80805, 0x0) bind$alg(r4, &(0x7f00000004c0)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb-serpent-sse2\x00'}, 0x58) accept4(r4, 0x0, 0x0, 0x800) socket$l2tp6(0xa, 0x2, 0x73) socket$inet_icmp(0x2, 0x2, 0x1) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000029c0)) bpf$ENABLE_STATS(0x20, 0x0, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000001c0)={0x10, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="b4000000000000007910480000000000610400000000000095"], 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sk_msg}, 0x94) r5 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="02000000040000000800000001"], 0x48) bpf$MAP_LOOKUP_ELEM(0x5, &(0x7f00000000c0)={r5, &(0x7f0000000000), &(0x7f0000000280)=""/73}, 0x20) 814.879711ms ago: executing program 0 (id=2545): unshare(0x2c020400) (async) r0 = socket$pppl2tp(0x18, 0x1, 0x1) (async) r1 = socket$inet6_udp(0xa, 0x2, 0x0) connect$pppl2tp(r0, &(0x7f0000000000)=@pppol2tpv3={0x18, 0x1, {0x3, r1, {0x2, 0x0, @dev}, 0x2}}, 0x2e) r2 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), 0xffffffffffffffff) r3 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$L2TP_CMD_SESSION_DELETE(r3, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f00000002c0)=ANY=[@ANYBLOB="4400f800", @ANYRES16=r2, @ANYBLOB="01002cbd70004400000005000000080009000200000008000c00a80a0000060001000400000008000b00020000000500130009000000050012000e000000"], 0x44}}, 0xc010) (async) r4 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) (async) r5 = syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x3) writev(r5, &(0x7f0000000200)=[{&(0x7f0000000400)="fb", 0xffffff5c}, {&(0x7f00000197c0)="1902eb02d5e5f29e59e1a7caec33eb76d2430da474d87e367f6598d026438b65eda8341073b6752abdcee080c8e1e876b25227c37d7dd79886ce33f13e857c8eda1cecf6ac36c03dbf54e3cb5136da5a33fee76fb3113f8b6700e9e5fc006b8eed665fed48738d59395ad07438c3610ae3976aac75caf2facafa21c25be3c2", 0x7f}, {&(0x7f0000000280)="c6e5bf4e5ba26d3e5c9bb5360f92e67a44ba6b62e2274d6487af77d783d4c6693cee943690f5864e779d1beb21efed6e6d476f87"}, {&(0x7f0000000040)="dcbe422f5d028b81e662578f53c6471fd1c854f19dfa4247ae100a162723a5a403ccb3dd5913918efd77b8c43fbc4981d9bafc3b48e16322a5389908ee89a3c08fa633f1ae892c748b831b5b007a53f960f174194ce4812b382d45c202230aa6be00be2fbb427a3a"}, {&(0x7f00000000c0)="d1bc1a7600e5a60a93d380d591a3ee81db3154323e5c991f724a3fb2ef7fce391b98a4c3dee9b879f3c7f9c8ea68e307bd072d45d3b6d21ac4b6a820d8b9d3f6ab9c2a99257afdff89172e4c0118cd53e3620717e20c3f3a2f7d36a39493b166bcb349e584a2d14678b014398a181abcd2e3aef487a0667aabc0f4927dc0f23f897606e702a0ee605e8a0c3336b2936f03dbef8244cd3f87de18e4374edf5610cd7e53baa579063b65fdcc608037b6459e05632743841ec2ba0f81aaa631d64e2a33955d814e"}, {&(0x7f00000001c0)="93890dce91f8091f06ba66f5ad81571882d65b82d7ab4616336da4ecaf1965633209d1f7a7d363f8dadd4d6a3926d74bfec60d9d08bf196fe146"}], 0x1) (async) ioctl$TUNSETIFF(r4, 0x400454ca, &(0x7f0000000140)={'pim6reg1\x00', 0x2}) r6 = bpf$BPF_PROG_GET_FD_BY_ID(0xd, &(0x7f00000001c0)={0xffffffffffffffff}, 0x4) ioctl$TUNSETFILTEREBPF(r4, 0x800454e1, &(0x7f0000000200)=r6) (async) sendmsg$TIPC_NL_MON_GET(0xffffffffffffffff, &(0x7f0000000240)={&(0x7f0000000040), 0xc, 0x0}, 0x0) (async) r7 = socket$inet_mptcp(0x2, 0x1, 0x106) bind$inet(r7, &(0x7f0000000380)={0x2, 0x5e21, @local}, 0x10) (async) getsockopt$inet_mptcp_buf(r7, 0x11c, 0x3, &(0x7f0000000040)=""/185, &(0x7f0000000140)=0xb9) (async) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) (async) ioctl$TUNSETSNDBUF(r4, 0x400454d4, &(0x7f0000000380)=0x2) ioctl$SIOCSIFHWADDR(r8, 0x8914, &(0x7f0000000100)={'pim6reg1\x00', @broadcast}) (async) r9 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0200000004000000080000004848eec224892d8a79a1d156b2b42200000080000900b961edadbd161b2095f18b0229", @ANYRES32, @ANYBLOB='\x00'/20, @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB='\x00'/28], 0x50) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x6, 0xb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @xdp=0x25, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) (async) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000180)={{r9}, &(0x7f00000000c0), &(0x7f0000000100)}, 0x20) bpf$BPF_MAP_CONST_STR_FREEZE(0x16, &(0x7f0000000300)={r9, 0xffffffffffffffff}, 0x4) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000880)={0x11, 0x10, &(0x7f00000003c0)=ANY=[@ANYRES16=r10, @ANYRES32=r10, @ANYBLOB="00000000001f0000b7050085000000a50000009500"/32], &(0x7f0000000240)='GPL\x00', 0x8, 0x0, 0x0, 0x0, 0x68}, 0x94) (async) bpf$PROG_LOAD(0x5, &(0x7f0000000000)={0x3, 0x4, &(0x7f00000000c0)=ANY=[@ANYBLOB="180000000000000000000000080000009111bf000000000095"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x32, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8}, 0x94) (async) r11 = socket$inet_sctp(0x2, 0x1, 0x84) setsockopt$inet_IP_XFRM_POLICY(r11, 0x0, 0x11, &(0x7f0000000400)={{{@in6=@loopback, @in6=@local, 0x4e21, 0x5, 0x4e23, 0x1, 0x0, 0x0, 0x80, 0x18}, {0x0, 0x3, 0x5, 0xa400000000000000, 0x8, 0x7d, 0x1, 0x3}, {0x49c, 0x8, 0x80000001, 0x7fff}, 0x7, 0x0, 0x2, 0x0, 0x3, 0x2}, {{@in=@remote, 0x4d2, 0x6c}, 0xa, @in6=@initdev={0xfe, 0x88, '\x00', 0x1, 0x0}, 0x3506, 0x7, 0x2, 0x3, 0x1, 0x1, 0x22c}}, 0xe8) r12 = socket$inet_icmp_raw(0x2, 0x3, 0x1) setsockopt$IP_VS_SO_SET_ADD(r12, 0x0, 0x482, &(0x7f00000008c0)={0x84, @rand_addr=0x64010102, 0x4e22, 0x1, 'none\x00', 0x0, 0x10002, 0x6f}, 0x2c) 730.947165ms ago: executing program 1 (id=2546): r0 = bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="1b00000000000000000000000080"], 0x48) bpf$PROG_LOAD(0x5, &(0x7f0000000140)={0x1f, 0xf, &(0x7f0000000040)=@ringbuf={{0x18, 0x0, 0x0, 0x0, 0x80000000, 0x0, 0x0, 0x0, 0xc8ae}, {{0x18, 0x1, 0x1, 0x0, r0}}, {}, [], {{}, {0x7, 0x0, 0xb, 0x2, 0x0, 0x0, 0x1}, {0x85, 0x0, 0x0, 0x85}}}, &(0x7f0000000840)='syzkaller\x00', 0x0, 0x0, 0x0, 0x41000, 0x12, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9}, 0x94) 676.630982ms ago: executing program 2 (id=2547): r0 = socket(0x10, 0x3, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) ioctl$sock_SIOCETHTOOL(r1, 0x89f1, &(0x7f0000000340)={'ip6_vti0\x00', &(0x7f0000000200)=@ethtool_rxnfc={0x29, 0xd, 0xb48c, {0x2, @usr_ip6_spec={@ipv4={'\x00', '\xff\xff', @remote}, @ipv4={'\x00', '\xff\xff', @loopback}, 0x1000, 0x82, 0xfd}, {0x0, @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x2}, 0xde0, 0x2db, [0x800, 0x386a]}, @tcp_ip4_spec={@initdev={0xac, 0x1e, 0x1, 0x0}, @private=0xa010102, 0x4e23, 0x4e22, 0x5}, {0x0, @link_local, 0xa0d, 0x3, [0x6, 0x800]}, 0x3, 0xffff}}}) (async) setsockopt$netlink_NETLINK_TX_RING(r0, 0x10e, 0xc, &(0x7f0000000040)={0x800}, 0x10) (async) sendmsg$nl_route(r0, &(0x7f00000003c0)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000100)=ANY=[@ANYBLOB="1c0000005e00010027bd7000000000000000", @ANYRESDEC], 0x1c}, 0x1, 0x0, 0x0, 0x4040084}, 0x0) 676.354285ms ago: executing program 3 (id=2548): r0 = syz_init_net_socket$llc(0x1a, 0x1, 0x0) sendmmsg$inet(r0, &(0x7f0000000c40), 0x0, 0x4044) (async) connect$llc(r0, &(0x7f00000000c0)={0x1a, 0x321, 0x40, 0x6, 0x81, 0x3, @random="3050e9ae9a3c"}, 0x10) 615.198295ms ago: executing program 3 (id=2549): socket$inet_icmp_raw(0x2, 0x3, 0x1) (async) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x5) (async) close(0x4) (async) syz_open_procfs$namespace(0x0, &(0x7f0000000180)='ns/pid_for_children\x00') unshare(0x6a040000) (async) r0 = socket(0x0, 0x80000, 0x0) getsockname$packet(r0, 0x0, 0x0) 612.306253ms ago: executing program 1 (id=2550): r0 = socket(0x1a, 0x6, 0x20000000) setsockopt$netlink_NETLINK_TX_RING(r0, 0x10e, 0xc, &(0x7f0000000040)={0x8604}, 0x10) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000180)=ANY=[@ANYBLOB="240000001a006da7ffffe000000000001c14000000000000e120b34b87b50000000008000100200000000adade2443d11f5d50486a526224ab0a75f6249bb8995e2408e83d244f662c5657935b4eb4e6e20f13526af920022d9f5c323778a5626731549c0e7e1a175c732c472a48bec3b0b9552327e7191bd110fa8e0bdad9c800"/138], 0x24}}, 0x0) (async) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r1, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000003c0)=ANY=[@ANYBLOB="140000001000010000000000000000001c6a000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0) (async) sendmsg$NFT_BATCH(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f000000a100)={{0x14}, [@NFT_MSG_NEWRULE={0x50, 0x6, 0xa, 0x409, 0x0, 0x0, {0x2, 0x0, 0x7}, [@NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_RULE_CHAIN={0x9, 0x2, 'syz2\x00'}, @NFTA_RULE_EXPRESSIONS={0x24, 0x4, 0x0, 0x1, [{0x20, 0x1, 0x0, 0x1, @rt={{0x7}, @val={0x14, 0x2, 0x0, 0x1, [@NFTA_RT_DREG={0x8, 0x1, 0x1, 0x0, 0xc}, @NFTA_RT_KEY={0x8, 0x2, 0x1, 0x0, 0x20}]}}}]}]}], {0x14}}, 0x78}, 0x1, 0x0, 0x0, 0x8080}, 0x0) (async) ioctl$XFS_IOC_ATTRLIST_BY_HANDLE(r0, 0x4058587a, &(0x7f0000000300)={{r0, &(0x7f00000000c0)='!}\x00', 0x40400, &(0x7f0000000100)={@align=0x7fff, {0x6, 0xff01, 0x8e, 0xa000000000}}, 0x1, &(0x7f0000000140), &(0x7f0000000240)=0xee2c}, {[0x9, 0x98, 0x7f, 0x9]}, 0x4, 0x5c, &(0x7f0000000280)=""/92}) 556.38568ms ago: executing program 0 (id=2551): setsockopt$WPAN_SECURITY(0xffffffffffffffff, 0x0, 0x1, &(0x7f00000001c0)=0x2, 0x4) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) splice(r1, 0x0, r3, 0x0, 0x6, 0x0) r4 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='memory.events\x00', 0x275a, 0x0) write$cgroup_subtree(r4, &(0x7f0000000280)=ANY=[], 0x10448) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x2000001, 0x12, r4, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000240)={0x0, 0x0, 0x0, 0x0, 0x1, 0x2, 0x11fe726f7e78fcf0}, 0x28) close(r2) write(r0, 0x0, 0x0) mmap(&(0x7f00009fd000/0x600000)=nil, 0x600000, 0x100000d, 0x6031, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x3000007, 0x31, r3, 0x0) r5 = syz_init_net_socket$bt_bnep(0x1f, 0x3, 0x4) getsockopt$sock_cred(r5, 0x1, 0x11, 0x0, &(0x7f0000000480)) mmap(&(0x7f0000107000/0x4000)=nil, 0x4000, 0xd, 0x10010, 0xffffffffffffffff, 0x0) socket$inet_icmp_raw(0x2, 0x3, 0x1) r6 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x5) close(0x4) syz_open_procfs$namespace(0x0, &(0x7f0000000200)='ns/pid_for_children\x00') unshare(0x6a040000) bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="1b00000000000000000000000080"], 0x48) r7 = syz_init_net_socket$bt_l2cap(0x1f, 0x5, 0x0) bind$bt_l2cap(r7, &(0x7f0000002080), 0xe) listen(r7, 0x30) bpf$PROG_LOAD(0x5, &(0x7f0000000980)={0x1, 0xf, 0x0, &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x24, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) socket$kcm(0x11, 0x200000000000002, 0x300) bpf$TOKEN_CREATE(0x24, &(0x7f0000000080)={0x0, r6}, 0x8) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000280)={0x6, 0x3, &(0x7f0000000b40)=ANY=[], &(0x7f0000000040)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x69}, 0x94) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f05ebbee1, 0x8031, 0xffffffffffffffff, 0x0) socket$inet_mptcp(0x2, 0x1, 0x106) 451.729782ms ago: executing program 1 (id=2552): socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000380)={0xffffffffffffffff}) r1 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f0000001d40)=ANY=[@ANYBLOB="0300000004000000040000000a"], 0x48) r2 = bpf$PROG_LOAD(0x5, &(0x7f0000000500)={0x1, 0x10, &(0x7f0000000bc0)=ANY=[@ANYBLOB="1808000000000000000000000000000018120000", @ANYRES32=r1, @ANYBLOB="0000000000000000b703000000000000850000000c000000b7000000000000001801000000082c2500000000002120207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000000700000095"], &(0x7f0000000980)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) setsockopt$sock_attach_bpf(r0, 0x1, 0x32, &(0x7f00000000c0)=r2, 0x4) r3 = accept4$packet(0xffffffffffffffff, 0x0, &(0x7f0000000680), 0x81000) getsockopt$packet_buf(r3, 0x107, 0xd, &(0x7f0000000340)=""/28, &(0x7f00000003c0)=0x1c) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000040)=@newqdisc={0x24, 0x24, 0x100, 0x70bd2a, 0x1, {0x0, 0x0, 0x0, 0x0, {0x2, 0xe}, {0xffff, 0xffff}, {0xe}}}, 0x24}, 0x1, 0x0, 0x0, 0x8000}, 0x0) r4 = socket$netlink(0x10, 0x3, 0x0) setsockopt$sock_linger(r3, 0x1, 0xd, &(0x7f0000000480)={0x0, 0x8}, 0x8) getsockopt$IP_VS_SO_GET_DAEMON(r0, 0x0, 0x487, &(0x7f00000001c0), &(0x7f0000000200)=0x30) ioctl$EXT4_IOC_GET_ES_CACHE(r4, 0xc020662a, &(0x7f0000000080)={0x0, 0x4, 0x0, 0x32, 0x1, 0x0, [{0x8001, 0x3d7, 0x6, '\x00', 0x200}]}) socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000500)=@newqdisc={0x2c, 0x24, 0xd0f, 0xfffffffd, 0xffffffff, {0x60, 0x0, 0x0, 0x0, {0xffe0, 0x2}, {0xfff2, 0x10}, {0xfff3, 0xfff2}}, [@TCA_INGRESS_BLOCK={0x8, 0xd, 0x4c}]}, 0x2c}, 0x1, 0x0, 0x0, 0x4000844}, 0x2000c8d1) bpf$MAP_UPDATE_BATCH(0x1a, &(0x7f0000000000)={0x0, 0x0, 0x0, &(0x7f0000010040), 0xfffffffe, 0xffffffffffffffff, 0x4}, 0x38) r5 = socket$alg(0x26, 0x5, 0x0) ioctl$sock_ipv6_tunnel_SIOCGET6RD(0xffffffffffffffff, 0x89f8, &(0x7f0000000800)={'syztnl0\x00', &(0x7f0000000700)={'gretap0\x00', 0x0, 0x8, 0x700, 0x6, 0x3, {{0x7, 0x4, 0x3, 0x31, 0x1c, 0x67, 0x0, 0x40, 0x29, 0x0, @rand_addr=0x64010101, @remote, {[@timestamp={0x44, 0x8, 0x1d, 0x0, 0x1, [0x8]}]}}}}}) sendmsg$DCCPDIAG_GETSOCK(r4, &(0x7f0000002100)={&(0x7f00000006c0)={0x10, 0x0, 0x0, 0x200000}, 0xc, &(0x7f00000020c0)={&(0x7f0000001d80)={0x304, 0x13, 0xd25, 0x70bd25, 0x25dfdbff, {0xb, 0x0, 0xf7, 0x0, {0x4e24, 0x4e22, [0xf, 0x10, 0x6, 0xff], [0x1, 0xd, 0x4b8045bc], r6, [0x8, 0x10000]}, 0xffffffff, 0x385}, [@INET_DIAG_REQ_BYTECODE={0xaa, 0x1, "11aefba4b4001c6296ba719e66afddb11e13da0d98f8ebb5ba5a2d3f7ea601a2cc1e1a00c3f261a2df9576585e7afed4108a4d8ff67a23e26f78429eea39a03bed6712ccdce827ed746ffecaca87b657f914fcdb3870f2943c719f3fdf9a41a4835251dc9bfa36a07312af854d29b3a955c5790a700ac59434db91c7de02fa3b5d5608db726c3ac0827f6705ab697a234daa876e6f4c6fba07296154723d97699c4d546bcecf"}, @INET_DIAG_REQ_BYTECODE={0x9c, 0x1, "bd12a0029e83479e1cd7250908a8bcc2da451813fcb0f5e4f2cd55c78be6c737316bd28c60e3e8fe953e1adb34ef90697f5672e52a1e47bd7068c10e9a494a6fc3f5e24ecb71081b79775b3ec43f4f50b370b492c625b39f71662b61d9a38010d75265f98b913b4a3c969359170a5cb620cb83c31c17a53e8267dbd49da9cca8a28d5f17dca766c616e65f21722a0b7080efdb3c0daceafe"}, @INET_DIAG_REQ_BYTECODE={0x61, 0x1, "9347bc4db825a3bd40931793bc4f004d8ad4276c4452682e5536171f9e5dacd7048d7d7be1f8c601eec77fbe5c70c2c4be130aada076b01af44ae083f6d69c5becb8fdbdc1ed1f53c37f39fd3a29c5b6ebe5809a25a721b11496099087"}, @INET_DIAG_REQ_BYTECODE={0x8e, 0x1, "387f572dfe99ed23cd5c16c597d9bc93a12f8e54875d7ea69d40b6c9d020805dbe56f84b64d0016965fc6973ac350a5e16de2678160bd989729d5c118dc419d175fef9b12abe6f3db0cca72805690761e31eb114cd5ceedc5f5021b9b4e1c729eee88a3828841246b52de1b32b6fe67cfa108cc264aabaf25a55c5de63655870890e66becb11f19fa9d3"}, @INET_DIAG_REQ_BYTECODE={0x79, 0x1, "58e8fb41b013793fd1d109703d4decb48ef8f2fa27fc52857b3ddd6a7447f5671df3c9d49f61f49333f6530971ebf184041d6365433cee2f02d459b8da1683337e1dad16e001b2bae0603c05391c1c8e0882b101feaaeac50365654edff9d7f19df9ae553220a06761ebaf98c380b56d36f11ebc1e"}]}, 0x304}, 0x1, 0x0, 0x0, 0x20000000}, 0x4008801) bind$alg(r5, &(0x7f00000004c0)={0x26, 'skcipher\x00', 0x0, 0x0, 'xts(serpent)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r5, 0x117, 0x1, 0x0, 0x0) accept4(r5, 0x0, 0x0, 0x800) bpf$PROG_LOAD(0x5, &(0x7f0000000040)={0x6, 0x10, &(0x7f0000000500)=ANY=[@ANYBLOB="18020000ff070000000000000300000018110000", @ANYRES32, @ANYBLOB="0000000000000000b702000001"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x80000000}, 0x94) r7 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000940)='hugetlb.2MB.usage_in_bytes\x00', 0x26e1, 0x0) close(r7) socket(0x10, 0x3, 0x0) ioctl$SIOCSIFHWADDR(r7, 0x8b34, &(0x7f0000000000)={'wlan1\x00', @random="000500000020"}) 451.210962ms ago: executing program 2 (id=2553): r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)=@base={0x10, 0x4, 0x4, 0x2, 0x0, 0x1}, 0x48) r1 = socket(0x2b, 0x80801, 0x1) sendto$inet6(r1, 0x0, 0x0, 0x2200c055, &(0x7f0000000500)={0xa, 0x4e1e, 0x0, @loopback={0x0, 0xa0211fffe000001}, 0x3}, 0x1c) bpf$MAP_GET_NEXT_KEY(0x4, &(0x7f0000000140)={r0, &(0x7f0000000080), 0x0}, 0x20) sendmsg$IPCTNL_MSG_EXP_NEW(0xffffffffffffffff, &(0x7f0000000500)={0x0, 0x0, &(0x7f00000004c0)={&(0x7f00000001c0)=ANY=[@ANYBLOB="840000000002010400000000000000000a00000004000180300003802c00018014000300fc00000000000000000000100000000014004400fe800000001f610000000000000000bb3c0002800c00028005000100000000002c00018014000300fc020000000000000000000000000000140004"], 0x84}, 0x1, 0x0, 0x0, 0x4000000}, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000240)=ANY=[@ANYBLOB="1400000010cfec346c622152110000000200000af8feffff1100010000000000000000000000000a"], 0x28}}, 0x4000040) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x9) sendmsg$nl_route(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000200)=ANY=[@ANYBLOB="a000000010003b0e2a1a86eb2636037f00000000", @ANYRES32=r3, @ANYBLOB="0200000000008000800012000800010076746936740002"], 0xa0}}, 0x0) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f00000003c0)=@bpf_lsm={0x1e, 0x3, &(0x7f00000000c0)=ANY=[@ANYBLOB="1800000000000000000000000000000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x24}, 0x94) r4 = bpf$ITER_CREATE(0xb, &(0x7f0000000100), 0x0) close(r4) syz_open_procfs$namespace(0xffffffffffffffff, &(0x7f00000001c0)='ns/net\x00') r5 = bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f00000003c0)=@bpf_lsm={0x1e, 0x3, &(0x7f00000000c0)=ANY=[], &(0x7f0000000140)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x24, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0xfffffffa}, 0x94) bpf$BPF_PROG_TEST_RUN(0x1c, &(0x7f00000005c0)={r5, 0x0, 0x24, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, 0xa) syz_emit_ethernet(0x42, &(0x7f0000002a80)={@local, @link_local, @void, {@ipv4={0x800, @tcp={{0x5, 0x4, 0x0, 0x0, 0x34, 0x0, 0x0, 0x0, 0x6, 0x0, @rand_addr=0x64010101, @local}, {{0x0, 0x4e22, 0x41424344, 0x41424344, 0x0, 0x6, 0x8, 0xc2, 0x0, 0x0, 0x0, {[@timestamp={0x8, 0xa, 0x5, 0x2}]}}}}}}}, 0x0) r6 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$inet_udp_int(r6, 0x11, 0x64, &(0x7f0000000000)=0x2, 0x4) ioctl$NILFS_IOCTL_SYNC(r4, 0x80086e8a, &(0x7f0000000300)) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x5) setsockopt$MRT6_ADD_MFC(r2, 0x29, 0xcc, &(0x7f0000000000)={{0xa, 0x0, 0x0, @local}, {0xa, 0x0, 0x0, @empty}, 0x0, {[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffc]}}, 0x5c) r7 = bpf$MAP_CREATE(0x0, &(0x7f00000006c0)=ANY=[@ANYBLOB="0b000000080000000c0000000300000001000000", @ANYRES32, @ANYBLOB='\x00'/20, @ANYRES32=0x0, @ANYRES32, @ANYBLOB="000000180000000000000900293556c86a489c8d0bd2b5fc75f7ac3f470f171c7b7ee53ef52ab2d7befd1bed26f2c4eaffe2226a0b5d92cb54dd6263a486c1a7a32d96ca0c8509b865dd90c1873880c5dd6353a4dd64246f96e19d6ff28a11eb91f03e629f8a860f782e28"], 0x48) bpf$MAP_UPDATE_BATCH(0x1a, &(0x7f0000000380)={0x0, 0x0, &(0x7f00000000c0), &(0x7f0000000140), 0x5, r7}, 0x38) bpf$MAP_GET_NEXT_KEY(0x4, &(0x7f0000000080)={r7, &(0x7f0000000000), &(0x7f0000000140)=""/75}, 0x20) close(0x4) r8 = syz_open_procfs$namespace(0x0, &(0x7f0000000080)='ns/ipc\x00') r9 = bpf$TOKEN_CREATE(0x24, &(0x7f0000000340)={0x0, r8}, 0x8) ioctl$XFS_IOC_FSBULKSTAT(r9, 0xc0205865, &(0x7f0000000b80)={&(0x7f0000000280)=0x2, 0x7, &(0x7f00000006c0), &(0x7f0000000b40)}) r10 = bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000480)={0x6, 0x3, &(0x7f0000000680)=ANY=[@ANYBLOB="1800000002000000000000000000000095"], &(0x7f00000002c0)='syzkaller\x00'}, 0x80) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000600)={r10, 0x5, 0x14, 0x0, &(0x7f00000000c0)="259a53f271a76d2788a24c6588a81e0ee27b4483", 0x0, 0xd01, 0x2a0, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x50) 361.85048ms ago: executing program 1 (id=2554): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a05000000000000000000020000000900010073797a300000000048000000030a01010000000000000000020000000900010073797a30000000000900030073797a3200000000080007006e617400140004800800014000000000080002400000000014000000020a010800000000060000000000000014000000110001"], 0xa4}}, 0x0) r1 = accept(r0, 0x0, &(0x7f0000000000)) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) bpf$PROG_LOAD(0x5, &(0x7f0000000140)={0xb, 0x1c, &(0x7f0000000d80)=ANY=[@ANYBLOB="18080000cbb60000002000000000000018110000", @ANYRES32, @ANYBLOB="0000000000000000b702000014000000b7030000000000008500000005000000bf0900000000000035090100000000009500000000000000b7020000000080007b9af8ff00000000d6090000002000007baaf0ff00000000bf2720000000000007080000fffdffffbf9400000000000007040000f0ffffff640200000800000018220000", @ANYRES32, @ANYBLOB="0000000000000000b7050000080000004608f0ff76000000bf980000000000005608ffff010000008500000005010000b70000000000000095"], &(0x7f0000000980)='GPL\x00', 0x0, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000000}, 0x94) r4 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) ioctl$TUNSETIFF(r4, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x6bf1c2d5adba8c32}) r5 = socket$packet(0x11, 0x2, 0x300) pipe(&(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) splice(r5, 0x0, r6, 0x0, 0xf3a, 0x0) r7 = socket$kcm(0x2, 0xa, 0x2) ioctl$SIOCSIFHWADDR(r7, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local}) writev(r4, &(0x7f0000000300)=[{&(0x7f0000000080)="2e9b5b0007e03dd65193dfb6", 0xc}, {&(0x7f00000001c0)="b700001811005a", 0x7}], 0x2) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f00000000c0)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_ASSOCIATE(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000380)={0x28, r3, 0x1, 0x70bd2a, 0x25dfdbff, {{}, {@val={0x8, 0x3, r8}, @void}}, [@NL80211_ATTR_SSID={0x4}, @NL80211_ATTR_USE_MFP={0x8}]}, 0x28}, 0x1, 0x0, 0x0, 0x20000000}, 0xc00) r9 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r9, 0x8933, &(0x7f0000000080)={'wlan1\x00', 0x0}) r11 = syz_genetlink_get_family_id$nl80211(&(0x7f00000001c0), 0xffffffffffffffff) sendmsg$NL80211_CMD_SET_CQM(r9, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000380)={0x30, r11, 0x1, 0x0, 0x0, {{}, {@val={0x8, 0x3, r10}, @void}}, [@NL80211_ATTR_CQM={0x14, 0x5e, 0x0, 0x1, [@NL80211_ATTR_CQM_RSSI_THOLD={0x8, 0x1, [0x701]}, @NL80211_ATTR_CQM_RSSI_HYST={0x8, 0x2, 0xfff}]}]}, 0x30}}, 0x0) sendmsg$NL80211_CMD_GET_COALESCE(r1, &(0x7f0000000100)={&(0x7f0000000040), 0xc, &(0x7f00000000c0)={&(0x7f0000000080)={0x30, r3, 0x1, 0x70bd29, 0x25dfdbfb, {{}, {@val={0x8, 0x1, 0x51}, @val={0x8, 0x3, r10}, @val={0xc, 0x99, {0x8, 0xe}}}}, [""]}, 0x30}, 0x1, 0x0, 0x0, 0x40}, 0x80) 142.579534ms ago: executing program 2 (id=2555): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x20881, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000040)={'tunl0\x00', 0x0}) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r3, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000280)={{0x14}, [@NFT_MSG_NEWTABLE={0x20, 0x0, 0xa, 0x3, 0x0, 0x0, {0x1}, [@NFTA_TABLE_NAME={0x9, 0x1, 'syz0\x00'}]}, @NFT_MSG_NEWSET={0x44, 0x9, 0xa, 0x401, 0x0, 0x0, {0x1}, [@NFTA_SET_ID={0x8}, @NFTA_SET_NAME={0x9, 0x2, 'syz2\x00'}, @NFTA_SET_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_SET_KEY_LEN={0x8, 0x5, 0x1, 0x0, 0x1d}, @NFTA_SET_FLAGS={0x8, 0x3, 0x1, 0x0, 0x7}]}, @NFT_MSG_NEWSETELEM={0x54, 0xc, 0xa, 0x201, 0x0, 0x0, {0x1, 0x0, 0x2}, [@NFTA_SET_ELEM_LIST_SET={0x9, 0x2, 'syz2\x00'}, @NFTA_SET_ELEM_LIST_ELEMENTS={0x28, 0x3, 0x0, 0x1, [{0x24, 0x0, 0x0, 0x1, [@NFTA_SET_ELEM_KEY={0x4}, @NFTA_SET_ELEM_FLAGS={0x8, 0x3, 0x1, 0x0, 0x1}, @NFTA_SET_ELEM_EXPR={0x14, 0x7, 0x0, 0x1, @inner={{0xa}, @val={0x4}}}]}]}, @NFTA_SET_ELEM_LIST_TABLE={0x9, 0x1, 'syz0\x00'}]}], {0x14, 0x10}}, 0xe0}}, 0x0) sendmsg$nl_route_sched(r1, &(0x7f0000001200)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000480)=@newqdisc={0x3c, 0x24, 0x4ee4e6a52ff56541, 0x70bd29, 0xfffffffe, {0x0, 0x0, 0x0, r2, {0x0, 0xb}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_red={{0x8}, {0x10, 0x2, [@TCA_RED_FLAGS={0xc, 0x4, {0x8, 0xba20f6fb1b67f90b}}]}}]}, 0x3c}}, 0x4000010) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) r4 = syz_open_procfs$namespace(0xffffffffffffffff, &(0x7f0000000000)='ns/time_for_children\x00') ioctl$FS_IOC_RESVSP(r4, 0x40305828, &(0x7f0000000040)={0x0, 0x1, 0x5, 0x1}) r5 = socket$kcm(0x2, 0x3, 0x2) r6 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r6, 0x6, 0x13, &(0x7f0000000040)=0x100000001, 0x76dc) connect$inet6(r6, &(0x7f0000000080)={0xa, 0x0, 0xfffffffe, @ipv4={'\x00', '\xff\xff', @local}, 0x4}, 0x1c) setsockopt$inet6_tcp_TCP_ULP(r6, 0x6, 0x1f, &(0x7f00000002c0), 0x4) setsockopt$inet6_tcp_TLS_TX(r6, 0x11a, 0x2, &(0x7f0000000140)=@ccm_128={{0x303, 0x39}, '\x00', "0bf70000000000000000061000000001", "00000004", "27ddbd038d0600"}, 0x28) ioctl$SIOCSIFHWADDR(r5, 0x8914, &(0x7f0000000040)={'syzkaller1\x00', @broadcast}) write$tun(r0, &(0x7f0000000100)={@val={0x8, 0x800}, @val={0x7, 0x3, 0x3, 0x2, 0x14}, @ipv4=@tcp={{0x5, 0x4, 0x0, 0x5, 0x38, 0x0, 0x0, 0x8, 0x2f, 0x0, @empty, @broadcast}, {{0x8100, 0x22eb, 0x41424344, 0x41424344, 0x0, 0x0, 0x9, 0x20, 0x5, 0x0, 0x0, {[@generic={0x3, 0x2}, @fastopen={0x22, 0x2}, @timestamp={0x8, 0xa, 0x7, 0xde}]}}}}}, 0x46) r7 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000004c0)={0x18, 0x15, &(0x7f0000000240)=@ringbuf={{0x18, 0x0, 0x0, 0x0, 0x5b62168c, 0x0, 0x0, 0x0, 0x4}, {{0x18, 0x1, 0x1, 0x0, 0x1}}, {}, [@initr0={0x18, 0x0, 0x0, 0x0, 0x232b, 0x0, 0x0, 0x0, 0x5}, @map_fd={0x18, 0x7, 0x1, 0x0, r5}, @map_val={0x18, 0x4, 0x2, 0x0, 0x1, 0x0, 0x0, 0x0, 0xfffffff1}], {{}, {0x7, 0x0, 0xb, 0x2, 0x0, 0x0, 0x1}, {0x85, 0x0, 0x0, 0x84}}}, &(0x7f0000000300)='GPL\x00', 0x5, 0x57, &(0x7f0000000340)=""/87, 0x40f00, 0x41, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x9, &(0x7f00000003c0)=[0xffffffffffffffff, 0x1, r5, 0xffffffffffffffff, 0x1], &(0x7f0000000400)=[{0x5, 0x1, 0xe, 0xc}, {0x1, 0x1, 0x7, 0xb}, {0x0, 0x5, 0xb, 0xc}, {0x0, 0x2, 0x0, 0xc}, {0x1, 0x1, 0x4, 0x2}, {0x4, 0x2, 0x4, 0xb}, {0x0, 0x4, 0x4, 0x4}, {0x5, 0x4, 0x6}, {0x2, 0x5, 0x10, 0x4}], 0x10, 0x3}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000780)={r7, 0x0, 0x2a, 0x5c, &(0x7f0000000580)="e548c8ff6c43338c9e0d93e4cd21f3ccb265c58389a9c5fea6dda488bda6efc568f7f552ffcc36530d47", &(0x7f00000005c0)=""/92, 0x0, 0x0, 0xf3, 0x3, &(0x7f0000000640)="c9098ff7274d975aa78d2c5987a13f289b5db7e00f46780e3eeec14917e11191a69cb8dd602bb37610cb6c8d2e8c567b5369a8ed4ce2e22e0a88cd6e1b48396784e2f67c9f098582a8b50fec3c495453f519753044d584dfd128e6992e745eec88f5868b1be2d251583ec989c84857a10b634cd3a390371a72d4aa6318477064f7883b5003a1b522f137b79b72dddefa5d8434a9539f2d79405d97c49a9ed852688556ece78486833dc5f4cab070ba5c9fd7be59c2ca0edb2b27878aca45439c042fbc220206178390693e4bbccd71e39ed89e38dd2dfb237670059ba942acc9ea559c36b3db87b45baef8931c1608d9fb43b8", &(0x7f0000000740)="081327", 0x4, 0x0, 0x8}, 0x50) 0s ago: executing program 1 (id=2556): bpf$BPF_BTF_GET_NEXT_ID(0x17, &(0x7f0000000140)={0x0, 0x0}, 0x8) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x12, 0x8, &(0x7f00000001c0)=ANY=[@ANYRES16=r0, @ANYRES8=r0, @ANYBLOB="5382e9e37cad6729a832ad689a57f5f2a22794f8b1a421393d7cee7d8a628c7c6dfecbdd43aff489105ad173415f775bf77499429cc097c9a18d6c"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x9, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, r0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x10, 0x20000}, 0x94) bpf$BPF_PROG_DETACH(0x1c, &(0x7f0000000200)={@cgroup=r1, r1, 0x2f, 0x2c, 0x4}, 0x20) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = syz_genetlink_get_family_id$ipvs(&(0x7f00000001c0), 0xffffffffffffffff) r4 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$IPVS_CMD_NEW_DAEMON(r4, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f00000000c0)=ANY=[@ANYBLOB='X\x00\x00\x00', @ANYRES16=r3, @ANYBLOB="0100000000000000000009000000440003800800010002000000140002007663616e3000000000000000000000000800030000000000140006"], 0x58}}, 0x20008000) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000000)={'netdevsim0\x00', 0x0}) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040), 0x4080, 0x0) ioctl$TUNSETQUEUE(r7, 0x400454d9, &(0x7f0000000080)={'netpci0\x00', 0x600}) ioctl$ifreq_SIOCGIFINDEX_team(r6, 0x8933, &(0x7f0000000000)={'team0\x00', 0x0}) sendmsg$nl_route(r6, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000001280)=@newlink={0x4c, 0x10, 0xffffffffffffffff, 0x70bd25, 0x25dfdbfb, {0x0, 0x0, 0x0, 0x0, 0x2017, 0x2021}, [@IFLA_LINKINFO={0x24, 0x12, 0x0, 0x1, @macvlan={{0xc}, {0x14, 0x2, 0x0, 0x1, [@IFLA_MACVLAN_MACADDR_MODE={0x8}, @IFLA_MACVLAN_MODE={0x8, 0x1, 0x10}]}}}, @IFLA_LINK={0x8, 0x5, r8}]}, 0x4c}, 0x1, 0x0, 0x0, 0x1}, 0x8000002) sendmsg$nl_route(r2, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000001140)={&(0x7f0000000300)=@newlink={0x44, 0x10, 0x503, 0x0, 0x25dfdbfb, {0x0, 0x0, 0x0, 0x0, 0x50307, 0x2a2e3}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @macvtap={{0xc}, {0x4}}}, @IFLA_LINK={0x8, 0x5, r5}, @IFLA_MASTER={0x8, 0xa, r5}]}, 0x44}, 0x1, 0x0, 0x0, 0x1}, 0x0) kernel console output (not intermixed with test programs): eth3: set [0, 0] type 1 family 0 port 8472 - 0 [ 167.412992][ T8993] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 168.342898][ T9039] veth0_virt_wifi: Caught tx_queue_len zero misconfig [ 168.513411][ T9048] macvlan2: entered promiscuous mode [ 168.937594][ T9075] netlink: 'syz.0.866': attribute type 11 has an invalid length. [ 168.985437][ T9084] netlink: 'syz.0.866': attribute type 11 has an invalid length. [ 169.102895][ T9091] __nla_validate_parse: 9 callbacks suppressed [ 169.102915][ T9091] netlink: 16 bytes leftover after parsing attributes in process `syz.3.868'. [ 169.198234][ T9091] xt_CT: No such helper "snmp" [ 170.019733][ T9138] netlink: 12 bytes leftover after parsing attributes in process `syz.3.879'. [ 170.034134][ T9138] netlink: 32 bytes leftover after parsing attributes in process `syz.3.879'. [ 170.064044][ T9138] netlink: 4 bytes leftover after parsing attributes in process `syz.3.879'. [ 170.241522][ T9149] openvswitch: netlink: VXLAN extension 1 has unexpected len 8 expected 4 [ 170.378333][ T9159] geneve3: entered promiscuous mode [ 170.564330][ T9174] ªªªªªª: renamed from wg2 (while UP) [ 170.686900][ T9181] xt_CT: You must specify a L4 protocol and not use inversions on it [ 170.698737][ T9182] netlink: 28 bytes leftover after parsing attributes in process `syz.4.893'. [ 171.074293][ T9201] syzkaller0: entered promiscuous mode [ 171.088781][ T9201] syzkaller0: entered allmulticast mode [ 171.236426][ T9214] IPVS: sh: FWM 3 0x00000003 - no destination available [ 171.270715][ T9201] IPVS: sh: FWM 3 0x00000003 - no destination available [ 171.272956][ T9216] netlink: 24 bytes leftover after parsing attributes in process `syz.1.901'. [ 171.425190][ T9211] lo speed is unknown, defaulting to 1000 [ 172.073810][ T9254] syzkaller1: tun_chr_ioctl cmd 2147767520 [ 172.087458][ T9254] syzkaller1: tun_chr_ioctl cmd 3222820985 [ 172.328638][ T9264] netlink: 16 bytes leftover after parsing attributes in process `syz.4.915'. [ 172.352623][ T9264] netlink: 8 bytes leftover after parsing attributes in process `syz.4.915'. [ 172.374629][ T9266] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 172.384548][ T5638] Bluetooth: hci4: command 0x0405 tx timeout [ 172.490637][ T9277] sctp: [Deprecated]: syz.0.918 (pid 9277) Use of int in maxseg socket option. [ 172.490637][ T9277] Use struct sctp_assoc_value instead [ 172.531048][ T9277] netlink: 'syz.0.918': attribute type 2 has an invalid length. [ 172.562840][ T9277] netlink: 830 bytes leftover after parsing attributes in process `syz.0.918'. [ 172.690052][ T9283] netlink: 16 bytes leftover after parsing attributes in process `syz.4.919'. [ 173.607965][ T9322] netlink: 'syz.2.931': attribute type 1 has an invalid length. [ 173.975192][ T9340] syzkaller0: entered promiscuous mode [ 173.994839][ T9340] syzkaller0: entered allmulticast mode [ 174.005160][ T9349] netlink: 'syz.4.941': attribute type 1 has an invalid length. [ 174.019973][ T9349] netlink: 'syz.4.941': attribute type 1 has an invalid length. [ 174.118401][ T9349] xfrm1: entered allmulticast mode [ 174.130668][ T9355] syzkaller1: entered promiscuous mode [ 174.140145][ T9355] syzkaller1: entered allmulticast mode [ 174.223514][ T9363] __nla_validate_parse: 8 callbacks suppressed [ 174.223541][ T9363] netlink: 24 bytes leftover after parsing attributes in process `syz.3.945'. [ 174.223763][ T9349] netlink: 8 bytes leftover after parsing attributes in process `syz.4.941'. [ 174.241284][ T9363] netlink: 24 bytes leftover after parsing attributes in process `syz.3.945'. [ 174.286148][ T9365] syzkaller0: entered promiscuous mode [ 174.305992][ T9365] syzkaller0: entered allmulticast mode [ 174.673950][ T9378] x_tables: ip_tables: socket match: used from hooks OUTPUT, but only valid from PREROUTING/INPUT [ 174.942069][ T9395] netlink: 'syz.4.954': attribute type 5 has an invalid length. [ 175.208641][ T9402] lo speed is unknown, defaulting to 1000 [ 175.448808][ T9415] netlink: 16 bytes leftover after parsing attributes in process `syz.1.959'. [ 175.882368][ T9426] netlink: 4 bytes leftover after parsing attributes in process `syz.1.963'. [ 176.049579][ T9439] netlink: 'syz.2.965': attribute type 11 has an invalid length. [ 176.312149][ T9445] tipc: Enabled bearer , priority 0 [ 176.331979][ T9445] syzkaller0: entered promiscuous mode [ 176.348591][ T9445] syzkaller0: entered allmulticast mode [ 176.387495][ T9445] tipc: Resetting bearer [ 176.416225][ T9443] tipc: Resetting bearer [ 176.460985][ T9443] tipc: Disabling bearer [ 176.586662][ T9449] pimreg: entered allmulticast mode [ 176.608385][ T9451] pimreg: left allmulticast mode [ 177.310908][ T9475] IPVS: sed: FWM 3 0x00000003 - no destination available [ 177.568841][ T9484] netlink: 24 bytes leftover after parsing attributes in process `syz.4.977'. [ 178.229146][ T9512] netlink: 'syz.2.984': attribute type 41 has an invalid length. [ 178.231517][ T9514] netlink: 'syz.2.984': attribute type 41 has an invalid length. [ 178.538968][ T9526] debugfs: 'netdev:syzkaller0' already exists in 'phy5' [ 178.956445][ T9537] af_packet: tpacket_rcv: packet too big, clamped from 1 to 4294967272. macoff=96 [ 179.280235][ T9549] netlink: 12 bytes leftover after parsing attributes in process `syz.1.995'. [ 179.298890][ T9549] block nbd1: Unsupported socket: should be TCP or UNIX. [ 180.232195][ T9560] 8021q: adding VLAN 0 to HW filter on device bond3 [ 180.276774][ T9560] bond2: (slave bond3): Enslaving as an active interface with an up link [ 180.371211][ T9567] bond2: (slave gretap1): Enslaving as an active interface with an up link [ 180.408683][ T9583] netlink: 12 bytes leftover after parsing attributes in process `syz.1.1000'. [ 180.605115][ T9571] sysfs: cannot create duplicate filename '/class/ieee80211/!' [ 180.623007][ T9571] CPU: 0 UID: 0 PID: 9571 Comm: syz.0.1001 Not tainted syzkaller #0 PREEMPT(full) [ 180.623036][ T9571] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 180.623050][ T9571] Call Trace: [ 180.623058][ T9571] [ 180.623067][ T9571] dump_stack_lvl+0xe8/0x150 [ 180.623098][ T9571] sysfs_warn_dup+0x8e/0xa0 [ 180.623126][ T9571] sysfs_do_create_link_sd+0xc0/0x110 [ 180.623156][ T9571] device_add_class_symlinks+0x1cf/0x240 [ 180.623186][ T9571] device_add+0x475/0xbb0 [ 180.623214][ T9571] wiphy_register+0x1fb1/0x2fe0 [ 180.623254][ T9571] ? __pfx_wiphy_register+0x10/0x10 [ 180.623274][ T9571] ? __pfx_netdev_run_todo+0x10/0x10 [ 180.623297][ T9571] ? minstrel_ht_alloc+0x6e0/0x7e0 [ 180.623333][ T9571] ? ieee80211_init_rate_ctrl_alg+0x55d/0x5d0 [ 180.623369][ T9571] ieee80211_register_hw+0x3c53/0x4910 [ 180.623404][ T9571] ? ieee80211_register_hw+0x1971/0x4910 [ 180.623456][ T9571] ? __pfx_ieee80211_register_hw+0x10/0x10 [ 180.623483][ T9571] ? __asan_memset+0x22/0x50 [ 180.623508][ T9571] ? __hrtimer_setup+0x1b7/0x260 [ 180.623533][ T9571] ? __pfx_mac80211_hwsim_beacon+0x10/0x10 [ 180.623564][ T9571] mac80211_hwsim_new_radio+0x3327/0x57e0 [ 180.623625][ T9571] ? __pfx_mac80211_hwsim_new_radio+0x10/0x10 [ 180.623651][ T9571] ? kstrndup+0xbf/0x160 [ 180.623682][ T9571] hwsim_new_radio_nl+0xe20/0x26e0 [ 180.623704][ T9571] ? unwind_next_frame+0xa6/0x2550 [ 180.623745][ T9571] ? is_bpf_text_address+0x26/0x2b0 [ 180.623781][ T9571] ? __pfx_hwsim_new_radio_nl+0x10/0x10 [ 180.623808][ T9571] ? __kernel_text_address+0xd/0x30 [ 180.623836][ T9571] ? unwind_get_return_address+0x4d/0x90 [ 180.623861][ T9571] ? __pfx_stack_trace_consume_entry+0x10/0x10 [ 180.623892][ T9571] ? arch_stack_walk+0xfb/0x150 [ 180.623932][ T9571] ? stack_trace_save+0xa9/0x100 [ 180.623962][ T9571] ? __pfx_stack_trace_save+0x10/0x10 [ 180.624010][ T9571] ? stack_depot_save_flags+0x33/0x810 [ 180.624055][ T9571] ? __nla_validate_parse+0x2480/0x2dc0 [ 180.624088][ T9571] ? ____sys_sendmsg+0x972/0x9f0 [ 180.624117][ T9571] ? ___sys_sendmsg+0x2a5/0x360 [ 180.624166][ T9571] ? __pfx___nla_validate_parse+0x10/0x10 [ 180.624215][ T9571] ? rcu_is_watching+0x15/0xb0 [ 180.624240][ T9571] ? trace_kmalloc+0x2a/0xf0 [ 180.624274][ T9571] ? __nla_parse+0x40/0x60 [ 180.624317][ T9571] ? genl_family_rcv_msg_attrs_parse+0x20b/0x2f0 [ 180.624340][ T9571] ? genl_family_rcv_msg_attrs_parse+0x265/0x2f0 [ 180.624368][ T9571] genl_family_rcv_msg_doit+0x22a/0x330 [ 180.624397][ T9571] ? __pfx_genl_family_rcv_msg_doit+0x10/0x10 [ 180.624432][ T9571] ? bpf_lsm_capable+0x9/0x20 [ 180.624450][ T9571] ? security_capable+0x7e/0x2c0 [ 180.624481][ T9571] genl_rcv_msg+0x61c/0x7a0 [ 180.624511][ T9571] ? __pfx_genl_rcv_msg+0x10/0x10 [ 180.624533][ T9571] ? __pfx_hwsim_new_radio_nl+0x10/0x10 [ 180.624574][ T9571] netlink_rcv_skb+0x232/0x4b0 [ 180.624605][ T9571] ? __pfx_genl_rcv_msg+0x10/0x10 [ 180.624630][ T9571] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 180.624676][ T9571] ? down_read+0x270/0x2e0 [ 180.624696][ T9571] ? genl_rcv+0xd/0x40 [ 180.624719][ T9571] genl_rcv+0x28/0x40 [ 180.624740][ T9571] netlink_unicast+0x75c/0x8e0 [ 180.624779][ T9571] netlink_sendmsg+0x813/0xb40 [ 180.624817][ T9571] ? __pfx_netlink_sendmsg+0x10/0x10 [ 180.624846][ T9571] ? aa_sock_msg_perm+0xf1/0x1b0 [ 180.624873][ T9571] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 180.624903][ T9571] ____sys_sendmsg+0x972/0x9f0 [ 180.624934][ T9571] ? __might_fault+0xaf/0x130 [ 180.624968][ T9571] ? __pfx_____sys_sendmsg+0x10/0x10 [ 180.625019][ T9571] ? import_iovec+0x73/0xa0 [ 180.625054][ T9571] ___sys_sendmsg+0x2a5/0x360 [ 180.625083][ T9571] ? __lock_acquire+0x6b5/0x2cf0 [ 180.625111][ T9571] ? __pfx____sys_sendmsg+0x10/0x10 [ 180.625150][ T9571] ? futex_wake+0x4ac/0x580 [ 180.625208][ T9571] ? __fget_files+0x2a/0x420 [ 180.625232][ T9571] ? __fget_files+0x3a0/0x420 [ 180.625268][ T9571] __x64_sys_sendmsg+0x1bd/0x2a0 [ 180.625303][ T9571] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 180.625344][ T9571] ? rcu_is_watching+0x15/0xb0 [ 180.625380][ T9571] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 180.625403][ T9571] do_syscall_64+0x15f/0xf80 [ 180.625421][ T9571] ? trace_irq_disable+0x3b/0x140 [ 180.625451][ T9571] ? clear_bhb_loop+0x40/0x90 [ 180.625477][ T9571] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 180.625497][ T9571] RIP: 0033:0x7fc4c879cdd9 [ 180.625517][ T9571] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 180.625533][ T9571] RSP: 002b:00007fc4c9686028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 180.625555][ T9571] RAX: ffffffffffffffda RBX: 00007fc4c8a16090 RCX: 00007fc4c879cdd9 [ 180.625569][ T9571] RDX: 0000000000000300 RSI: 0000200000000040 RDI: 0000000000000009 [ 180.625581][ T9571] RBP: 00007fc4c8832d69 R08: 0000000000000000 R09: 0000000000000000 [ 180.625592][ T9571] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 180.625604][ T9571] R13: 00007fc4c8a16128 R14: 00007fc4c8a16090 R15: 00007fff0977f8c8 [ 180.625639][ T9571] [ 181.822273][ T9602] batadv0: entered promiscuous mode [ 181.833715][ T9602] erspan0: entered promiscuous mode [ 181.855751][ T9602] hsr1: entered allmulticast mode [ 181.861058][ T9602] batadv0: entered allmulticast mode [ 181.866552][ T9602] erspan0: entered allmulticast mode [ 181.923797][ T9610] bond4: option ad_actor_sys_prio: mode dependency failed, not supported in mode balance-rr(0) [ 181.936375][ T9610] bond4 (unregistering): Released all slaves [ 181.957197][ T9608] sit0: Caught tx_queue_len zero misconfig [ 181.963790][ T8349] netdevsim netdevsim1 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 181.987447][ T8349] netdevsim netdevsim1 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 182.061466][ T8349] netdevsim netdevsim1 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 182.124136][ T8349] netdevsim netdevsim1 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 182.178258][ T9626] IPVS: set_ctl: invalid protocol: 136 172.30.0.2:20005 [ 182.240665][ T9643] bridge_slave_1: left allmulticast mode [ 182.246379][ T9643] bridge_slave_1: left promiscuous mode [ 182.263462][ T9643] bridge0: port 2(bridge_slave_1) entered disabled state [ 182.278393][ T9647] netlink: 14 bytes leftover after parsing attributes in process `syz.0.1016'. [ 182.291143][ T9643] bridge_slave_0: left allmulticast mode [ 182.314084][ T9643] bridge_slave_0: left promiscuous mode [ 182.324789][ T9643] bridge0: port 1(bridge_slave_0) entered disabled state [ 182.457600][ T9647] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 182.472065][ T9647] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 182.488266][ T9647] bond0 (unregistering): Released all slaves [ 182.780263][ T9665] syzkaller0: entered promiscuous mode [ 182.786126][ T9665] syzkaller0: entered allmulticast mode [ 182.952365][ T9667] netlink: 12 bytes leftover after parsing attributes in process `syz.4.1022'. [ 183.054471][ T9671] bridge: RTM_NEWNEIGH with invalid state 0x8 [ 183.061610][ T9671] netlink: 12 bytes leftover after parsing attributes in process `syz.3.1023'. [ 183.083614][ T9667] bond4: (slave vcan1): refused to change device type [ 183.152499][ T9671] bond1: (slave bridge2): Enslaving as an active interface with an up link [ 183.679038][ T9684] lo speed is unknown, defaulting to 1000 [ 183.838408][ T9704] tipc: Enabled bearer , priority 10 [ 184.674082][ T9731] netlink: 52 bytes leftover after parsing attributes in process `syz.0.1039'. [ 184.950718][ T6358] tipc: Node number set to 2311419042 [ 185.224164][ T9755] netlink: 12 bytes leftover after parsing attributes in process `syz.3.1045'. [ 185.457186][ T9769] netlink: 4 bytes leftover after parsing attributes in process `syz.3.1049'. [ 185.479014][ T9768] netlink: 4 bytes leftover after parsing attributes in process `syz.3.1049'. [ 185.496636][ T9769] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 185.539362][ T9768] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 185.567053][ T9775] netlink: 4 bytes leftover after parsing attributes in process `syz.3.1049'. [ 185.807555][ T9783] syzkaller0: entered promiscuous mode [ 185.828753][ T9783] syzkaller0: entered allmulticast mode [ 185.847293][ T9785] netlink: 44 bytes leftover after parsing attributes in process `syz.3.1055'. [ 185.932560][ T9791] 5Ò: entered promiscuous mode [ 187.126697][ T9844] syzkaller0: entered promiscuous mode [ 187.138563][ T9844] syzkaller0: entered allmulticast mode [ 188.347377][ T9865] netlink: 'syz.1.1072': attribute type 13 has an invalid length. [ 188.355273][ T9865] netlink: 4 bytes leftover after parsing attributes in process `syz.1.1072'. [ 188.365068][ T9865] netlink: 8 bytes leftover after parsing attributes in process `syz.1.1072'. [ 189.512209][ T9814] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 189.749281][ T9877] lo: entered allmulticast mode [ 189.763557][ T9878] netlink: 12 bytes leftover after parsing attributes in process `syz.0.1075'. [ 190.103666][ T9902] netlink: 4 bytes leftover after parsing attributes in process `syz.1.1083'. [ 190.156524][ T9906] netlink: 4 bytes leftover after parsing attributes in process `syz.2.1082'. [ 190.493407][ T9914] macvlan3: entered promiscuous mode [ 190.502976][ T9914] gretap0: entered promiscuous mode [ 190.510234][ T9914] gretap0: left promiscuous mode [ 190.526946][ T9876] lo: left allmulticast mode [ 190.746787][ T9918] netlink: 7060 bytes leftover after parsing attributes in process `syz.1.1087'. [ 190.864842][ T9930] netlink: 20 bytes leftover after parsing attributes in process `syz.4.1090'. [ 191.052126][ T9941] netlink: 80 bytes leftover after parsing attributes in process `syz.0.1094'. [ 191.086706][ T9941] netlink: 12 bytes leftover after parsing attributes in process `syz.0.1094'. [ 191.117661][ T9941] netlink: 12 bytes leftover after parsing attributes in process `syz.0.1094'. [ 191.466694][ T9962] ip6tnl3: entered allmulticast mode [ 191.528036][ T9964] openvswitch: netlink: IPv4 tun info is not correct [ 191.544484][ T9966] netlink: 72 bytes leftover after parsing attributes in process `syz.0.1102'. [ 191.665738][ T9977] netlink: 212344 bytes leftover after parsing attributes in process `syz.0.1105'. [ 191.814107][ T9986] netlink: 'syz.0.1108': attribute type 32 has an invalid length. [ 191.865070][ T9986] bond0: option coupled_control: invalid value (12) [ 191.873696][ T9986] bond0 (unregistering): Released all slaves [ 192.205346][T10010] tipc: Started in network mode [ 192.214090][T10010] tipc: Node identity 3236547f25b1, cluster identity 4711 [ 192.222008][T10010] tipc: Enabled bearer , priority 0 [ 192.251274][T10010] tipc: Resetting bearer [ 192.285757][T10007] tipc: Disabling bearer [ 192.295051][T10016] The dccp option matching is deprecated and scheduled to be removed in 2027. [ 192.295051][T10016] Please contact the netfilter-devel mailing list or update your nftables rules. [ 192.299389][ T6156] wlan1: No active IBSS STAs - trying to scan for other IBSS networks with same SSID (merge) [ 192.693963][T10032] Unsupported ieee802154 address type: 0 [ 193.210553][T10058] netlink: 'syz.4.1130': attribute type 1 has an invalid length. [ 193.322163][T10058] bond5: entered promiscuous mode [ 193.336491][T10058] 8021q: adding VLAN 0 to HW filter on device bond5 [ 193.347693][T10066] openvswitch: netlink: nsh attribute has 2 unknown bytes. [ 193.355366][T10067] netlink: 'syz.1.1131': attribute type 27 has an invalid length. [ 193.424130][T10060] 8021q: adding VLAN 0 to HW filter on device bond6 [ 193.434178][T10060] bond5: (slave bond6): making interface the new active one [ 193.441941][T10060] bond6: entered promiscuous mode [ 193.449543][T10060] bond5: (slave bond6): Enslaving as an active interface with an up link [ 193.526544][T10062] Cannot find del_set index 8192 as target [ 194.125005][T10101] xt_CT: You must specify a L4 protocol and not use inversions on it [ 194.294862][T10114] netlink: 'syz.1.1145': attribute type 1 has an invalid length. [ 194.329146][T10114] workqueue: Failed to create a rescuer kthread for wq "bond5": -EINTR [ 194.376961][T10124] FAULT_INJECTION: forcing a failure. [ 194.376961][T10124] name fail_usercopy, interval 1, probability 0, space 0, times 1 [ 194.444996][T10124] CPU: 0 UID: 0 PID: 10124 Comm: syz.4.1147 Not tainted syzkaller #0 PREEMPT(full) [ 194.445020][T10124] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 194.445030][T10124] Call Trace: [ 194.445036][T10124] [ 194.445044][T10124] dump_stack_lvl+0xe8/0x150 [ 194.445070][T10124] should_fail_ex+0x412/0x560 [ 194.445096][T10124] _copy_from_user+0x2d/0xb0 [ 194.445121][T10124] __sys_bpf+0x229/0x950 [ 194.445148][T10124] ? __pfx___sys_bpf+0x10/0x10 [ 194.445188][T10124] ? ksys_write+0x242/0x270 [ 194.445215][T10124] ? __pfx_ksys_write+0x10/0x10 [ 194.445243][T10124] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 194.445263][T10124] __x64_sys_bpf+0x7c/0x90 [ 194.445288][T10124] do_syscall_64+0x15f/0xf80 [ 194.445304][T10124] ? trace_irq_disable+0x3b/0x140 [ 194.445330][T10124] ? clear_bhb_loop+0x40/0x90 [ 194.445352][T10124] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 194.445369][T10124] RIP: 0033:0x7f8978b9cdd9 [ 194.445386][T10124] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 194.445400][T10124] RSP: 002b:00007f8979a04028 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 194.445419][T10124] RAX: ffffffffffffffda RBX: 00007f8978e15fa0 RCX: 00007f8978b9cdd9 [ 194.445431][T10124] RDX: 0000000000000050 RSI: 0000200000000600 RDI: 000000000000000a [ 194.445443][T10124] RBP: 00007f8979a04090 R08: 0000000000000000 R09: 0000000000000000 [ 194.445454][T10124] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 194.445464][T10124] R13: 00007f8978e16038 R14: 00007f8978e15fa0 R15: 00007ffe130bab68 [ 194.445493][T10124] [ 194.933619][T10140] __nla_validate_parse: 7 callbacks suppressed [ 194.933637][T10140] netlink: 12 bytes leftover after parsing attributes in process `syz.4.1151'. [ 195.039347][T10140] netlink: 'syz.4.1151': attribute type 1 has an invalid length. [ 195.132910][T10143] IPVS: length: 149 != 8 [ 195.264042][T10147] netlink: 'syz.0.1154': attribute type 2 has an invalid length. [ 195.462933][T10155] netlink: 68 bytes leftover after parsing attributes in process `syz.0.1156'. [ 195.806164][T10160] tunl0: Caught tx_queue_len zero misconfig [ 195.916134][T10160] syzkaller0: entered promiscuous mode [ 195.948954][T10160] syzkaller0: entered allmulticast mode [ 196.284208][T10172] FAULT_INJECTION: forcing a failure. [ 196.284208][T10172] name failslab, interval 1, probability 0, space 0, times 1 [ 196.299167][T10172] CPU: 0 UID: 0 PID: 10172 Comm: syz.4.1161 Not tainted syzkaller #0 PREEMPT(full) [ 196.299193][T10172] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 196.299203][T10172] Call Trace: [ 196.299210][T10172] [ 196.299217][T10172] dump_stack_lvl+0xe8/0x150 [ 196.299244][T10172] should_fail_ex+0x412/0x560 [ 196.299272][T10172] should_failslab+0xa8/0x100 [ 196.299300][T10172] __kmalloc_noprof+0xe8/0x760 [ 196.299329][T10172] ? bpf_test_init+0x9f/0x150 [ 196.299358][T10172] bpf_test_init+0x9f/0x150 [ 196.299385][T10172] bpf_prog_test_run_xdp+0x529/0x1160 [ 196.299425][T10172] ? __pfx_bpf_prog_test_run_xdp+0x10/0x10 [ 196.299453][T10172] ? __fget_files+0x2a/0x420 [ 196.299478][T10172] ? __pfx_bpf_prog_test_run_xdp+0x10/0x10 [ 196.299501][T10172] bpf_prog_test_run+0x2c7/0x340 [ 196.299517][T10172] __sys_bpf+0x643/0x950 [ 196.299540][T10172] ? __pfx___sys_bpf+0x10/0x10 [ 196.299576][T10172] ? ksys_write+0x242/0x270 [ 196.299601][T10172] ? __pfx_ksys_write+0x10/0x10 [ 196.299637][T10172] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 196.299656][T10172] __x64_sys_bpf+0x7c/0x90 [ 196.299678][T10172] do_syscall_64+0x15f/0xf80 [ 196.299694][T10172] ? trace_irq_disable+0x3b/0x140 [ 196.299718][T10172] ? clear_bhb_loop+0x40/0x90 [ 196.299739][T10172] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 196.299755][T10172] RIP: 0033:0x7f8978b9cdd9 [ 196.299770][T10172] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 196.299784][T10172] RSP: 002b:00007f8979a04028 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 196.299801][T10172] RAX: ffffffffffffffda RBX: 00007f8978e15fa0 RCX: 00007f8978b9cdd9 [ 196.299812][T10172] RDX: 0000000000000050 RSI: 0000200000000600 RDI: 000000000000000a [ 196.299822][T10172] RBP: 00007f8979a04090 R08: 0000000000000000 R09: 0000000000000000 [ 196.299832][T10172] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 196.299842][T10172] R13: 00007f8978e16038 R14: 00007f8978e15fa0 R15: 00007ffe130bab68 [ 196.299872][T10172] [ 197.685437][T10208] netlink: 'syz.2.1170': attribute type 1 has an invalid length. [ 198.987436][T10208] workqueue: Failed to create a rescuer kthread for wq "bond4": -EINTR [ 198.998551][T10209] workqueue: Failed to create a rescuer kthread for wq "wg-crypt-wireguard%d": -EINTR [ 199.020151][T10210] workqueue: Failed to create a rescuer kthread for wq "wg-crypt-wireguard%d": -EINTR [ 199.229455][T10222] FAULT_INJECTION: forcing a failure. [ 199.229455][T10222] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 199.268580][T10222] CPU: 1 UID: 0 PID: 10222 Comm: syz.3.1174 Not tainted syzkaller #0 PREEMPT(full) [ 199.268604][T10222] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 199.268615][T10222] Call Trace: [ 199.268622][T10222] [ 199.268629][T10222] dump_stack_lvl+0xe8/0x150 [ 199.268654][T10222] should_fail_ex+0x412/0x560 [ 199.268679][T10222] _copy_from_user+0x2d/0xb0 [ 199.268702][T10222] bpf_test_init+0xd8/0x150 [ 199.268724][T10222] bpf_prog_test_run_xdp+0x529/0x1160 [ 199.268760][T10222] ? __pfx_bpf_prog_test_run_xdp+0x10/0x10 [ 199.268782][T10222] ? __fget_files+0x2a/0x420 [ 199.268801][T10222] ? __pfx_bpf_prog_test_run_xdp+0x10/0x10 [ 199.268820][T10222] bpf_prog_test_run+0x2c7/0x340 [ 199.268836][T10222] __sys_bpf+0x643/0x950 [ 199.268856][T10222] ? __pfx___sys_bpf+0x10/0x10 [ 199.268886][T10222] ? ksys_write+0x242/0x270 [ 199.268905][T10222] ? __pfx_ksys_write+0x10/0x10 [ 199.268926][T10222] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 199.268940][T10222] __x64_sys_bpf+0x7c/0x90 [ 199.268958][T10222] do_syscall_64+0x15f/0xf80 [ 199.268970][T10222] ? trace_irq_disable+0x3b/0x140 [ 199.268989][T10222] ? clear_bhb_loop+0x40/0x90 [ 199.269004][T10222] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 199.269017][T10222] RIP: 0033:0x7fb2b539cdd9 [ 199.269030][T10222] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 199.269040][T10222] RSP: 002b:00007fb2b618c028 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 199.269055][T10222] RAX: ffffffffffffffda RBX: 00007fb2b5615fa0 RCX: 00007fb2b539cdd9 [ 199.269064][T10222] RDX: 0000000000000050 RSI: 0000200000000600 RDI: 000000000000000a [ 199.269072][T10222] RBP: 00007fb2b618c090 R08: 0000000000000000 R09: 0000000000000000 [ 199.269079][T10222] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 199.269087][T10222] R13: 00007fb2b5616038 R14: 00007fb2b5615fa0 R15: 00007ffd5c5dd0c8 [ 199.269109][T10222] [ 199.504878][T10228] netlink: 8 bytes leftover after parsing attributes in process `syz.4.1176'. [ 199.923580][T10247] syzkaller0: entered promiscuous mode [ 199.934160][T10247] syzkaller0: entered allmulticast mode [ 200.070325][T10255] x_tables: duplicate underflow at hook 1 [ 200.385769][T10268] FAULT_INJECTION: forcing a failure. [ 200.385769][T10268] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 200.400015][T10268] CPU: 0 UID: 0 PID: 10268 Comm: syz.1.1188 Not tainted syzkaller #0 PREEMPT(full) [ 200.400039][T10268] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 200.400050][T10268] Call Trace: [ 200.400056][T10268] [ 200.400064][T10268] dump_stack_lvl+0xe8/0x150 [ 200.400089][T10268] should_fail_ex+0x412/0x560 [ 200.400117][T10268] _copy_to_user+0x31/0xb0 [ 200.400145][T10268] bpf_test_finish+0x1db/0x6b0 [ 200.400179][T10268] ? __pfx_bpf_test_finish+0x10/0x10 [ 200.400209][T10268] ? _copy_from_user+0x94/0xb0 [ 200.400233][T10268] ? bpf_test_init+0x113/0x150 [ 200.400258][T10268] bpf_prog_test_run_xdp+0x8fa/0x1160 [ 200.400300][T10268] ? __pfx_bpf_prog_test_run_xdp+0x10/0x10 [ 200.400329][T10268] ? __fget_files+0x2a/0x420 [ 200.400355][T10268] ? __pfx_bpf_prog_test_run_xdp+0x10/0x10 [ 200.400381][T10268] bpf_prog_test_run+0x2c7/0x340 [ 200.400403][T10268] __sys_bpf+0x643/0x950 [ 200.400434][T10268] ? __pfx___sys_bpf+0x10/0x10 [ 200.400472][T10268] ? ksys_write+0x242/0x270 [ 200.400497][T10268] ? __pfx_ksys_write+0x10/0x10 [ 200.400523][T10268] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 200.400543][T10268] __x64_sys_bpf+0x7c/0x90 [ 200.400568][T10268] do_syscall_64+0x15f/0xf80 [ 200.400584][T10268] ? trace_irq_disable+0x3b/0x140 [ 200.400608][T10268] ? clear_bhb_loop+0x40/0x90 [ 200.400629][T10268] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 200.400645][T10268] RIP: 0033:0x7f3b4299cdd9 [ 200.400661][T10268] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 200.400674][T10268] RSP: 002b:00007f3b43821028 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 200.400692][T10268] RAX: ffffffffffffffda RBX: 00007f3b42c15fa0 RCX: 00007f3b4299cdd9 [ 200.400704][T10268] RDX: 0000000000000050 RSI: 0000200000000600 RDI: 000000000000000a [ 200.400715][T10268] RBP: 00007f3b43821090 R08: 0000000000000000 R09: 0000000000000000 [ 200.400726][T10268] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 200.400736][T10268] R13: 00007f3b42c16038 R14: 00007f3b42c15fa0 R15: 00007ffd82c108e8 [ 200.400765][T10268] [ 200.676004][T10272] macvtap1: entered promiscuous mode [ 200.685131][T10272] macvtap1: entered allmulticast mode [ 200.690723][T10272] veth1_vlan: entered allmulticast mode [ 200.767835][T10272] macvtap2: entered promiscuous mode [ 200.774253][T10272] macvtap2: entered allmulticast mode [ 201.040431][T10296] netlink: 212368 bytes leftover after parsing attributes in process `syz.3.1195'. [ 201.058066][T10297] netlink: 'syz.2.1196': attribute type 1 has an invalid length. [ 201.078939][T10298] netlink: 28 bytes leftover after parsing attributes in process `syz.2.1196'. [ 201.101278][T10296] syzkaller1: tun_chr_ioctl cmd 35108 [ 201.164059][T10297] bond4: entered promiscuous mode [ 201.169805][T10297] 8021q: adding VLAN 0 to HW filter on device bond4 [ 201.420691][T10316] netlink: 'syz.0.1199': attribute type 1 has an invalid length. [ 201.438233][T10316] netlink: 'syz.0.1199': attribute type 1 has an invalid length. [ 201.580578][ T5638] Bluetooth: hci3: command 0x0401 tx timeout [ 201.581993][ T5634] Bluetooth: hci2: command 0x0406 tx timeout [ 201.586644][ T5638] Bluetooth: hci0: command 0x0406 tx timeout [ 201.586704][ T5638] Bluetooth: hci1: command 0x0406 tx timeout [ 201.836568][T10330] netlink: 20 bytes leftover after parsing attributes in process `syz.1.1201'. [ 201.970368][T10340] netlink: 24 bytes leftover after parsing attributes in process `syz.1.1201'. [ 202.001179][T10340] gre0: entered allmulticast mode [ 202.324849][T10355] netlink: 4 bytes leftover after parsing attributes in process `syz.0.1208'. [ 202.357386][T10355] netlink: 12 bytes leftover after parsing attributes in process `syz.0.1208'. [ 202.446675][T10357] netlink: 8 bytes leftover after parsing attributes in process `syz.2.1207'. [ 202.607266][T10372] netlink: 12 bytes leftover after parsing attributes in process `syz.0.1211'. [ 202.681248][T10378] netlink: 'syz.4.1212': attribute type 5 has an invalid length. [ 202.713088][T10381] netlink: 'syz.4.1212': attribute type 5 has an invalid length. [ 202.718112][T10367] netlink: 44 bytes leftover after parsing attributes in process `syz.0.1211'. [ 202.748390][T10372] 8021q: adding VLAN 0 to HW filter on device bond0 [ 202.765951][T10367] 8021q: adding VLAN 0 to HW filter on device batadv1 [ 202.775244][T10367] bond0: (slave batadv1): Enslaving as an active interface with an up link [ 202.842961][T10376] vlan2: entered promiscuous mode [ 202.857078][T10376] bond0: entered promiscuous mode [ 202.862625][T10376] batadv1: entered promiscuous mode [ 202.879534][T10376] vlan2: entered allmulticast mode [ 202.887748][T10376] bond0: entered allmulticast mode [ 202.904814][T10376] batadv1: entered allmulticast mode [ 202.917096][T10387] netlink: 16 bytes leftover after parsing attributes in process `syz.4.1214'. [ 203.358345][T10400] netlink: 'syz.0.1220': attribute type 4 has an invalid length. [ 206.345720][T10400] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 206.369461][T10412] netlink: 'syz.2.1222': attribute type 1 has an invalid length. [ 206.388271][T10412] __nla_validate_parse: 3 callbacks suppressed [ 206.388293][T10412] netlink: 224 bytes leftover after parsing attributes in process `syz.2.1222'. [ 206.587554][T10473] FAULT_INJECTION: forcing a failure. [ 206.587554][T10473] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 206.633465][T10473] CPU: 1 UID: 0 PID: 10473 Comm: syz.4.1234 Not tainted syzkaller #0 PREEMPT(full) [ 206.633491][T10473] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 206.633501][T10473] Call Trace: [ 206.633508][T10473] [ 206.633516][T10473] dump_stack_lvl+0xe8/0x150 [ 206.633541][T10473] should_fail_ex+0x412/0x560 [ 206.633570][T10473] _copy_to_user+0x31/0xb0 [ 206.633598][T10473] simple_read_from_buffer+0xe1/0x170 [ 206.633625][T10473] proc_fail_nth_read+0x1bb/0x230 [ 206.633652][T10473] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 206.633677][T10473] ? rw_verify_area+0x2a6/0x4d0 [ 206.633699][T10473] ? __fget_files+0x2a/0x420 [ 206.633718][T10473] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 206.633740][T10473] vfs_read+0x20c/0xa70 [ 206.633768][T10473] ? __pfx___mutex_lock+0x10/0x10 [ 206.633786][T10473] ? __pfx_vfs_read+0x10/0x10 [ 206.633807][T10473] ? __fget_files+0x2a/0x420 [ 206.633830][T10473] ? __fget_files+0x3a0/0x420 [ 206.633848][T10473] ? __fget_files+0x2a/0x420 [ 206.633875][T10473] ksys_read+0x150/0x270 [ 206.633900][T10473] ? __pfx_ksys_read+0x10/0x10 [ 206.633930][T10473] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 206.633949][T10473] do_syscall_64+0x15f/0xf80 [ 206.633964][T10473] ? trace_irq_disable+0x3b/0x140 [ 206.633987][T10473] ? clear_bhb_loop+0x40/0x90 [ 206.634009][T10473] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 206.634026][T10473] RIP: 0033:0x7f8978b5d60e [ 206.634042][T10473] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 206.634056][T10473] RSP: 002b:00007f8979a03fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 206.634074][T10473] RAX: ffffffffffffffda RBX: 00007f8979a046c0 RCX: 00007f8978b5d60e [ 206.634086][T10473] RDX: 000000000000000f RSI: 00007f8979a040a0 RDI: 0000000000000004 [ 206.634096][T10473] RBP: 00007f8979a04090 R08: 0000000000000000 R09: 0000000000000000 [ 206.634105][T10473] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 206.634115][T10473] R13: 00007f8978e16038 R14: 00007f8978e15fa0 R15: 00007ffe130bab68 [ 206.634142][T10473] [ 206.892757][T10485] netlink: 24 bytes leftover after parsing attributes in process `syz.3.1236'. [ 206.921596][T10487] netlink: 'syz.4.1240': attribute type 8 has an invalid length. [ 207.024672][T10495] netlink: 16 bytes leftover after parsing attributes in process `syz.3.1241'. [ 207.069965][T10497] macsec1: entered promiscuous mode [ 207.075393][T10497] batadv0: entered promiscuous mode [ 207.083348][T10497] 8021q: adding VLAN 0 to HW filter on device macsec1 [ 207.104522][T10497] batadv0: left promiscuous mode [ 207.269767][T10503] netdevsim netdevsim3 netdevsim3 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 207.314547][T10508] netlink: 'syz.4.1246': attribute type 1 has an invalid length. [ 207.390152][T10508] 8021q: adding VLAN 0 to HW filter on device bond7 [ 207.477090][T10503] netdevsim netdevsim3 netdevsim2 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 207.554264][T10514] bond7: (slave veth5): Enslaving as an active interface with a down link [ 207.579152][T10508] 8021q: adding VLAN 0 to HW filter on device batadv1 [ 207.589900][T10508] bond7: (slave batadv1): making interface the new active one [ 207.600195][T10508] batadv1: entered promiscuous mode [ 207.606229][T10508] bond7: (slave batadv1): Enslaving as an active interface with an up link [ 207.761352][T10522] bond7 (unregistering): (slave veth5): Releasing active interface [ 209.875941][T10522] bond7 (unregistering): (slave batadv1): Releasing active interface [ 209.911130][T10522] bond7 (unregistering): Released all slaves [ 209.925970][T10530] netlink: 12 bytes leftover after parsing attributes in process `syz.0.1252'. [ 209.978672][T10503] netdevsim netdevsim3 netdevsim1 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 210.150449][T10503] netdevsim netdevsim3 netdevsim0 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 210.174596][T10540] netlink: 28 bytes leftover after parsing attributes in process `syz.1.1254'. [ 210.216229][T10540] netlink: 28 bytes leftover after parsing attributes in process `syz.1.1254'. [ 210.345059][T10549] netlink: 'syz.2.1256': attribute type 4 has an invalid length. [ 210.423140][T10549] netlink: 'syz.2.1256': attribute type 1 has an invalid length. [ 210.466738][ T8349] netdevsim netdevsim3 eth0: set [0, 0] type 1 family 0 port 8472 - 0 [ 210.602335][T10549] bond5: entered promiscuous mode [ 210.631327][T10549] 8021q: adding VLAN 0 to HW filter on device bond5 [ 210.754148][ T127] netdevsim netdevsim3 eth1: set [0, 0] type 1 family 0 port 8472 - 0 [ 210.819975][ T180] netdevsim netdevsim3 eth2: set [0, 0] type 1 family 0 port 8472 - 0 [ 210.853245][ T180] netdevsim netdevsim3 eth3: set [0, 0] type 1 family 0 port 8472 - 0 [ 211.268409][T10582] xt_hashlimit: size too large, truncated to 1048576 [ 211.393867][T10594] netlink: 'syz.2.1270': attribute type 2 has an invalid length. [ 211.485100][T10600] netlink: 'syz.4.1273': attribute type 1 has an invalid length. [ 211.608639][T10608] netlink: 12 bytes leftover after parsing attributes in process `syz.0.1274'. [ 211.684399][T10605] bond7: (slave bridge5): making interface the new active one [ 211.697378][T10605] bond7: (slave bridge5): Enslaving as an active interface with an up link [ 211.763409][T10606] A link change request failed with some changes committed already. Interface bridge_slave_0 may have been left with an inconsistent configuration, please check. [ 211.821394][T10594] A link change request failed with some changes committed already. Interface bridge_slave_0 may have been left with an inconsistent configuration, please check. [ 211.854362][T10612] tipc: New replicast peer: 255.255.255.255 [ 211.861677][T10612] tipc: Enabled bearer , priority 10 [ 211.881368][T10623] macvlan2: entered promiscuous mode [ 211.886712][T10623] macvlan2: entered allmulticast mode [ 211.895128][T10623] bond7: entered promiscuous mode [ 211.900716][T10623] bridge5: entered promiscuous mode [ 211.907664][T10623] 8021q: adding VLAN 0 to HW filter on device macvlan2 [ 211.915754][T10623] bond7: (slave macvlan2): the slave hw address is in use by the bond; couldn't find a slave with a free hw address to give it (this should not have happened) [ 211.923254][T10600] netlink: 8 bytes leftover after parsing attributes in process `syz.4.1273'. [ 211.934126][T10623] bond7: left promiscuous mode [ 211.945558][T10623] bridge5: left promiscuous mode [ 211.995066][T10617] netlink: 8 bytes leftover after parsing attributes in process `syz.1.1271'. [ 212.388211][T10648] syzkaller1: entered promiscuous mode [ 212.413175][T10648] syzkaller1: entered allmulticast mode [ 212.421502][T10649] IPVS: wlc: UDP 224.0.0.2:0 - no destination available [ 212.430112][ T6356] IPVS: starting estimator thread 0... [ 212.504050][T10649] netlink: 12 bytes leftover after parsing attributes in process `syz.1.1281'. [ 212.529579][T10655] IPVS: using max 32 ests per chain, 76800 per kthread [ 212.606102][T10664] IPVS: set_ctl: invalid protocol: 255 172.20.20.60:20004 [ 212.627114][T10649] xfrm1: entered promiscuous mode [ 212.642234][T10649] xfrm1: entered allmulticast mode [ 212.654319][T10649] netlink: 12 bytes leftover after parsing attributes in process `syz.1.1281'. [ 212.665982][T10667] sctp: [Deprecated]: syz.2.1287 (pid 10667) Use of int in maxseg socket option. [ 212.665982][T10667] Use struct sctp_assoc_value instead [ 212.723563][T10667] netlink: 'syz.2.1287': attribute type 2 has an invalid length. [ 212.939503][T10672] 8021q: adding VLAN 0 to HW filter on device bond1 [ 213.255797][T10672] geneve3: left promiscuous mode [ 213.271884][T10672] 8021q: adding VLAN 0 to HW filter on device bond2 [ 213.285375][T10672] 8021q: adding VLAN 0 to HW filter on device bond4 [ 213.294662][T10672] 8021q: adding VLAN 0 to HW filter on device ipvlan2 [ 213.305659][T10672] bond5: left promiscuous mode [ 213.311029][T10672] bond6: left promiscuous mode [ 213.317954][T10672] A link change request failed with some changes committed already. Interface geneve4 may have been left with an inconsistent configuration, please check. [ 213.355991][ T5723] tipc: Node number set to 394744959 [ 213.375095][T10677] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 213.655258][T10702] netlink: 4 bytes leftover after parsing attributes in process `syz.2.1296'. [ 213.679631][T10702] netlink: 48 bytes leftover after parsing attributes in process `syz.2.1296'. [ 213.729160][T10702] lo speed is unknown, defaulting to 1000 [ 213.759553][T10704] netlink: 8 bytes leftover after parsing attributes in process `syz.2.1296'. [ 213.793002][T10708] SET target dimension over the limit! [ 213.799626][T10706] netlink: 'syz.0.1297': attribute type 1 has an invalid length. [ 213.857106][T10710] netlink: 28 bytes leftover after parsing attributes in process `syz.0.1297'. [ 213.910506][T10706] bond5: entered promiscuous mode [ 213.916534][T10706] 8021q: adding VLAN 0 to HW filter on device bond5 [ 213.925488][T10710] bond5: entered allmulticast mode [ 213.975837][T10706] bond5: (slave bridge4): making interface the new active one [ 213.994472][T10706] bridge4: entered promiscuous mode [ 214.001027][T10706] bridge4: entered allmulticast mode [ 214.028308][T10706] bond5: (slave bridge4): Enslaving as an active interface with an up link [ 214.246514][T10728] dummy0: entered allmulticast mode [ 214.400672][T10732] No such timeout policy "syz1" [ 214.471783][T10740] netlink: 32 bytes leftover after parsing attributes in process `syz.0.1305'. [ 214.579415][T10751] : renamed from veth0_to_bond [ 215.703347][T10782] netlink: 'syz.0.1315': attribute type 14 has an invalid length. [ 216.012391][T10795] syzkaller0: entered promiscuous mode [ 216.045523][T10795] syzkaller0: entered allmulticast mode [ 216.346609][T10805] netlink: 'syz.4.1319': attribute type 3 has an invalid length. [ 216.358985][T10805] netlink: 'syz.4.1319': attribute type 3 has an invalid length. [ 216.936142][T10823] lo speed is unknown, defaulting to 1000 [ 216.964837][T10833] __nla_validate_parse: 13 callbacks suppressed [ 216.964856][T10833] netlink: 830 bytes leftover after parsing attributes in process `syz.2.1327'. [ 217.115768][T10839] netlink: 40 bytes leftover after parsing attributes in process `syz.0.1329'. [ 217.231149][T10842] netlink: 68 bytes leftover after parsing attributes in process `syz.3.1330'. [ 217.269679][T10842] netlink: 28 bytes leftover after parsing attributes in process `syz.3.1330'. [ 217.655984][T10855] netlink: 'syz.3.1335': attribute type 3 has an invalid length. [ 217.671259][T10855] netlink: 'syz.3.1335': attribute type 3 has an invalid length. [ 217.682519][T10862] netlink: 'syz.2.1337': attribute type 13 has an invalid length. [ 217.687495][T10869] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 217.702305][T10871] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 217.714433][T10862] netlink: 'syz.2.1337': attribute type 17 has an invalid length. [ 217.733131][T10862] netlink: 8 bytes leftover after parsing attributes in process `syz.2.1337'. [ 217.781758][T10872] lo: entered allmulticast mode [ 217.848404][T10877] netlink: 4 bytes leftover after parsing attributes in process `syz.4.1338'. [ 217.990724][ T127] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 218.016694][ T127] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 218.046351][T10886] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 218.049190][T10885] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 218.383919][T10895] netlink: 4 bytes leftover after parsing attributes in process `syz.2.1345'. [ 218.419353][T10895] batman_adv: batadv0: Adding interface: veth5 [ 218.431152][T10895] batman_adv: batadv0: The MTU of interface veth5 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 218.457661][T10895] batman_adv: batadv0: Interface activated: veth5 [ 218.879159][T10914] tipc: Enabled bearer , priority 0 [ 218.919573][T10915] syzkaller0: entered promiscuous mode [ 218.937302][T10915] syzkaller0: entered allmulticast mode [ 218.984973][T10927] netlink: 212368 bytes leftover after parsing attributes in process `syz.0.1355'. [ 218.986283][T10925] netlink: 4 bytes leftover after parsing attributes in process `syz.2.1354'. [ 219.000621][T10914] tipc: Resetting bearer [ 219.085087][ T6370] hid-generic 0005:10CF:0A11.0001: item fetching failed at offset 0/1 [ 219.110677][T10931] netlink: 296 bytes leftover after parsing attributes in process `syz.3.1356'. [ 219.131787][ T6370] hid-generic 0005:10CF:0A11.0001: probe with driver hid-generic failed with error -22 [ 219.317206][T10943] Bluetooth: MGMT ver 1.23 [ 219.829394][T10981] lo speed is unknown, defaulting to 1000 [ 220.276460][T11011] syzkaller0: left promiscuous mode [ 220.293765][T11011] syzkaller0: left allmulticast mode [ 220.339486][T11013] netlink: 'syz.4.1376': attribute type 10 has an invalid length. [ 220.356085][T11016] x_tables: duplicate underflow at hook 2 [ 220.365311][T11016] openvswitch: netlink: Message has 28 unknown bytes. [ 220.774860][T11035] netlink: 'syz.1.1385': attribute type 1 has an invalid length. [ 220.841640][T11035] 8021q: adding VLAN 0 to HW filter on device bond6 [ 220.856867][T11040] bond6: (slave gretap2): making interface the new active one [ 220.866881][T11040] bond6: (slave gretap2): Enslaving as an active interface with an up link [ 220.888885][T11042] openvswitch: netlink: Message has 16 unknown bytes. [ 221.327417][T11051] lo speed is unknown, defaulting to 1000 [ 221.717907][T11063] xt_CT: No such helper "syz0" [ 223.617387][T11030] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 223.648907][T11060] netlink: 'syz.3.1389': attribute type 1 has an invalid length. [ 223.926080][T11069] __nla_validate_parse: 6 callbacks suppressed [ 223.926098][T11069] netlink: 8 bytes leftover after parsing attributes in process `syz.4.1392'. [ 223.936941][T11078] netlink: 12 bytes leftover after parsing attributes in process `syz.0.1395'. [ 223.998764][T11078] block nbd1: Unsupported socket: should be TCP or UNIX. [ 224.032244][T11084] netlink: 'syz.1.1397': attribute type 4 has an invalid length. [ 224.055965][T11084] netlink: 12 bytes leftover after parsing attributes in process `syz.1.1397'. [ 224.135723][T11088] netlink: 12 bytes leftover after parsing attributes in process `syz.3.1398'. [ 224.214292][T11098] x_tables: duplicate underflow at hook 1 [ 224.234559][T11084] xt_CT: No such helper "netbios-ns" [ 224.283063][T11088] veth7: entered allmulticast mode [ 224.301318][ T180] wlan1: No active IBSS STAs - trying to scan for other IBSS networks with same SSID (merge) [ 224.310066][T11088] bond2: (slave veth7): Enslaving as an active interface with an up link [ 224.910263][T11127] netlink: 16 bytes leftover after parsing attributes in process `syz.0.1408'. [ 224.931327][T11127] netlink: 16 bytes leftover after parsing attributes in process `syz.0.1408'. [ 224.957964][T11127] netlink: 16 bytes leftover after parsing attributes in process `syz.0.1408'. [ 224.976909][T11130] netlink: 60 bytes leftover after parsing attributes in process `syz.0.1408'. [ 224.980920][T11127] netlink: 16 bytes leftover after parsing attributes in process `syz.0.1408'. [ 225.038223][T11127] netlink: 16 bytes leftover after parsing attributes in process `syz.0.1408'. [ 225.117201][T11127] 8021q: adding VLAN 0 to HW filter on device team0 [ 225.134761][T11127] dummy0: left allmulticast mode [ 225.156346][T11127] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 225.241411][T11127] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 225.257761][T11127] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 225.271512][T11127] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 225.288659][T11147] netlink: 'syz.1.1416': attribute type 1 has an invalid length. [ 225.301173][T11127] veth1_vlan: left promiscuous mode [ 225.306940][T11147] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 225.318063][T11127] veth0_vlan: left promiscuous mode [ 225.324812][T11127] veth0_vlan: entered promiscuous mode [ 225.337640][T11127] veth1_vlan: entered promiscuous mode [ 225.350230][T11127] veth1_macvtap: left promiscuous mode [ 225.357303][T11127] veth0_macvtap: left promiscuous mode [ 225.364689][T11127] veth0_macvtap: entered promiscuous mode [ 225.372280][T11127] veth1_macvtap: entered promiscuous mode [ 225.391288][T11127] geneve2: left promiscuous mode [ 225.399600][T11127] geneve2: left allmulticast mode [ 225.424062][T11127] 8021q: adding VLAN 0 to HW filter on device bond1 [ 225.518015][T11127] netdevsim netdevsim0 eth0: default qdisc (pfifo_fast) fail, fallback to noqueue [ 225.531638][T11127] 8021q: adding VLAN 0 to HW filter on device eth0 [ 225.540074][T11127] netdevsim netdevsim0 eth1: default qdisc (pfifo_fast) fail, fallback to noqueue [ 225.550988][T11127] 8021q: adding VLAN 0 to HW filter on device eth1 [ 225.559564][T11127] netdevsim netdevsim0 eth2: default qdisc (pfifo_fast) fail, fallback to noqueue [ 225.571058][T11127] 8021q: adding VLAN 0 to HW filter on device eth2 [ 225.580638][T11127] netdevsim netdevsim0 eth3: default qdisc (pfifo_fast) fail, fallback to noqueue [ 225.591280][T11127] 8021q: adding VLAN 0 to HW filter on device eth3 [ 225.611898][T11127] veth3: left promiscuous mode [ 225.628602][T11127] 8021q: adding VLAN 0 to HW filter on device bond3 [ 225.637216][T11127] ip6tnl1: left allmulticast mode [ 225.657057][T11127] ip6tnl3: left allmulticast mode [ 225.666735][T11127] vlan2: left promiscuous mode [ 225.671955][T11127] bond0: left promiscuous mode [ 225.677094][T11127] batadv1: left promiscuous mode [ 225.683482][T11127] vlan2: left allmulticast mode [ 225.690462][T11127] bond0: left allmulticast mode [ 225.695414][T11127] batadv1: left allmulticast mode [ 225.702175][T11127] bond5: left promiscuous mode [ 225.707054][T11127] bridge4: left promiscuous mode [ 225.712685][T11127] bond5: left allmulticast mode [ 225.717630][T11127] bridge4: left allmulticast mode [ 225.890046][ T6156] netdevsim netdevsim0 eth0: set [1, 1] type 2 family 0 port 256 - 0 [ 225.909934][ T6156] netdevsim netdevsim0 eth1: set [1, 1] type 2 family 0 port 256 - 0 [ 225.926591][ T6156] netdevsim netdevsim0 eth2: set [1, 1] type 2 family 0 port 256 - 0 [ 225.974408][ T6156] netdevsim netdevsim0 eth3: set [1, 1] type 2 family 0 port 256 - 0 [ 226.005380][T11160] block nbd1: Unsupported socket: should be TCP or UNIX. [ 226.246624][ T6156] ip6_tunnel: ip6tnl1 xmit: Local address not yet configured! [ 226.280384][ T6358] ip6_tunnel: ip6tnl1 xmit: Local address not yet configured! [ 226.292932][ T6156] ip6_tunnel: ip6tnl1 xmit: Local address not yet configured! [ 226.347528][T11174] netlink: 'syz.0.1423': attribute type 1 has an invalid length. [ 226.360284][T11174] netlink: 'syz.0.1423': attribute type 1 has an invalid length. [ 226.532978][T11179] netlink: 'syz.0.1424': attribute type 10 has an invalid length. [ 226.543277][ T6156] ip6_tunnel: ip6tnl2 xmit: Local address not yet configured! [ 226.558321][ T6156] ip6_tunnel: ip6tnl2 xmit: Local address not yet configured! [ 226.561523][T11183] netlink: 'syz.1.1425': attribute type 11 has an invalid length. [ 226.568842][ T6353] ip6_tunnel: ip6tnl2 xmit: Local address not yet configured! [ 226.838859][ T6370] ip6_tunnel: ip6tnl1 xmit: Local address not yet configured! [ 227.018137][T11195] xt_limit: Overflow, try lower: 28676/2147483648 [ 227.100260][ T6370] ip6_tunnel: ip6tnl1 xmit: Local address not yet configured! [ 227.148753][ T5724] ip6_tunnel: ip6tnl2 xmit: Local address not yet configured! [ 227.418831][ T6353] ip6_tunnel: ip6tnl2 xmit: Local address not yet configured! [ 227.557687][T11210] sctp: [Deprecated]: syz.0.1434 (pid 11210) Use of struct sctp_assoc_value in delayed_ack socket option. [ 227.557687][T11210] Use struct sctp_sack_info instead [ 228.518365][T11251] bond7: entered promiscuous mode [ 228.544160][T11251] 8021q: adding VLAN 0 to HW filter on device bond7 [ 228.572394][T11251] bridge0: port 3(bond7) entered blocking state [ 228.615384][T11251] bridge0: port 3(bond7) entered disabled state [ 228.630775][T11251] bond7: entered allmulticast mode [ 228.648720][T11251] bridge0: port 3(bond7) entered blocking state [ 228.656805][T11251] bridge0: port 3(bond7) entered forwarding state [ 228.993539][ T8350] bridge0: port 3(bond7) entered disabled state [ 229.203753][T11288] veth1_vlan: left allmulticast mode [ 229.218221][ T8350] netdevsim netdevsim3 eth0: unset [0, 0] type 1 family 0 port 8472 - 0 [ 229.227183][ T8350] netdevsim netdevsim3 eth1: unset [0, 0] type 1 family 0 port 8472 - 0 [ 229.236226][ T8350] netdevsim netdevsim3 eth2: unset [0, 0] type 1 family 0 port 8472 - 0 [ 229.254077][ T8350] netdevsim netdevsim3 eth3: unset [0, 0] type 1 family 0 port 8472 - 0 [ 229.714069][T11315] syzkaller1: tun_chr_ioctl cmd 2147767520 [ 229.753502][T11318] __nla_validate_parse: 108 callbacks suppressed [ 229.753520][T11318] netlink: 4 bytes leftover after parsing attributes in process `syz.1.1460'. [ 230.346286][T11341] bridge_slave_0: entered promiscuous mode [ 230.394194][T11341] geneve6: entered promiscuous mode [ 230.416635][T11341] geneve6: entered allmulticast mode [ 230.451170][ T180] netdevsim netdevsim0 eth0: set [1, 2] type 2 family 0 port 20000 - 0 [ 230.474554][ T127] netdevsim netdevsim0 eth1: set [1, 2] type 2 family 0 port 20000 - 0 [ 230.488347][ T8349] netdevsim netdevsim0 eth2: set [1, 2] type 2 family 0 port 20000 - 0 [ 230.496851][ T8349] netdevsim netdevsim0 eth3: set [1, 2] type 2 family 0 port 20000 - 0 [ 230.562909][T11338] netlink: 16 bytes leftover after parsing attributes in process `syz.4.1464'. [ 230.736939][T11338] netlink: 4 bytes leftover after parsing attributes in process `syz.4.1464'. [ 231.156531][T11368] netlink: 8 bytes leftover after parsing attributes in process `syz.2.1469'. [ 231.303855][T11378] ip6_vti0: entered promiscuous mode [ 231.401963][T11378] netlink: 8 bytes leftover after parsing attributes in process `syz.0.1473'. [ 231.465948][T11390] netlink: 20 bytes leftover after parsing attributes in process `syz.2.1474'. [ 231.534605][T11388] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 231.905543][T11401] netlink: 60 bytes leftover after parsing attributes in process `syz.1.1478'. [ 232.014626][T11404] netlink: 12 bytes leftover after parsing attributes in process `syz.4.1479'. [ 232.402877][T11415] netlink: 8 bytes leftover after parsing attributes in process `syz.4.1482'. [ 232.435116][T11415] netlink: 8 bytes leftover after parsing attributes in process `syz.4.1482'. [ 232.749716][T11427] veth9: entered allmulticast mode [ 233.378239][T11444] 8021q: adding VLAN 0 to HW filter on device bond8 [ 233.390295][T11461] netdevsim netdevsim1: Direct firmware load for  failed with error -2 [ 233.398962][T11461] netdevsim netdevsim1: Falling back to sysfs fallback for:  [ 233.465637][T11327] Set syz1 is full, maxelem 65536 reached [ 234.021306][T11486] PF_CAN: dropped non conform CAN XL skbuff: dev type 65534, len 64993 [ 234.316586][T11507] x_tables: ip_tables: rpfilter match: used from hooks OUTPUT, but only valid from PREROUTING [ 235.020135][T11539] netlink: 'syz.2.1521': attribute type 1 has an invalid length. [ 235.038006][T11542] netlink: 'syz.0.1523': attribute type 1 has an invalid length. [ 235.046070][T11542] __nla_validate_parse: 9 callbacks suppressed [ 235.046087][T11542] netlink: 96 bytes leftover after parsing attributes in process `syz.0.1523'. [ 235.173361][T11540] netlink: 'syz.4.1522': attribute type 33 has an invalid length. [ 235.202570][T11539] 8021q: adding VLAN 0 to HW filter on device bond9 [ 235.221540][T11540] netlink: 152 bytes leftover after parsing attributes in process `syz.4.1522'. [ 235.295287][T11540] `: renamed from team0 (while UP) [ 235.546346][T11570] netlink: 'syz.1.1526': attribute type 1 has an invalid length. [ 235.775483][T11566] lo speed is unknown, defaulting to 1000 [ 235.866302][T11582] netlink: 8 bytes leftover after parsing attributes in process `syz.1.1529'. [ 236.747397][T11600] netlink: 'syz.1.1534': attribute type 1 has an invalid length. [ 236.763016][T11609] netlink: 'syz.4.1536': attribute type 8 has an invalid length. [ 236.842139][T11600] 8021q: adding VLAN 0 to HW filter on device bond7 [ 236.930985][T11612] vlan4: entered allmulticast mode [ 236.956587][T11612] bond7: entered allmulticast mode [ 237.203600][T11632] netlink: 8 bytes leftover after parsing attributes in process `syz.1.1538'. [ 237.309128][T11635] netlink: 24 bytes leftover after parsing attributes in process `syz.2.1540'. [ 237.473201][T11635] netlink: 'syz.2.1540': attribute type 1 has an invalid length. [ 237.491628][T11635] netlink: 240 bytes leftover after parsing attributes in process `syz.2.1540'. [ 237.561729][T11640] netlink: 'syz.2.1540': attribute type 1 has an invalid length. [ 237.614466][T11635] lo speed is unknown, defaulting to 1000 [ 237.639859][T11651] netlink: 4 bytes leftover after parsing attributes in process `syz.4.1542'. [ 238.108154][T11673] netlink: 28 bytes leftover after parsing attributes in process `syz.4.1546'. [ 238.142125][T11673] netlink: 28 bytes leftover after parsing attributes in process `syz.4.1546'. [ 238.293513][T11679] netlink: 4 bytes leftover after parsing attributes in process `syz.0.1549'. [ 238.405211][T11683] syzkaller0: entered promiscuous mode [ 238.420446][T11683] syzkaller0: entered allmulticast mode [ 238.847918][T11705] syzkaller0: entered promiscuous mode [ 238.870474][T11705] syzkaller0: entered allmulticast mode [ 239.256490][T11723] syzkaller0: entered promiscuous mode [ 239.268849][T11723] syzkaller0: entered allmulticast mode [ 239.306822][T11733] A link change request failed with some changes committed already. Interface netdevsim0 may have been left with an inconsistent configuration, please check. [ 239.547231][T11742] netlink: 'syz.1.1565': attribute type 1 has an invalid length. [ 239.572044][T11742] netlink: 'syz.1.1565': attribute type 1 has an invalid length. [ 239.660216][ C1] ip6_tnl_xmit_ctl: 2 callbacks suppressed [ 239.660234][ C1] ip6_tunnel: ip6tnl1 xmit: Local address not yet configured! [ 239.915608][T11764] Can not set IPV6_FL_F_REFLECT if flowlabel_consistency sysctl is enable [ 240.173550][T11772] xt_CT: No such helper "snmp" [ 240.192505][T11779] tipc: Resetting bearer [ 240.310967][ C1] ip6_tunnel: ip6tnl2 xmit: Local address not yet configured! [ 240.482355][T11790] __nla_validate_parse: 4 callbacks suppressed [ 240.482374][T11790] netlink: 108 bytes leftover after parsing attributes in process `syz.1.1577'. [ 240.539113][T11790] ip6tnl5: entered allmulticast mode [ 241.035032][T11821] bond8: option coupled_control: mode dependency failed, not supported in mode balance-rr(0) [ 241.047479][T11821] bond8 (unregistering): Released all slaves [ 241.240881][ T6370] hsr0: entered promiscuous mode [ 241.257258][T11836] netlink: 4 bytes leftover after parsing attributes in process `syz.4.1588'. [ 241.336380][T11845] netlink: 12 bytes leftover after parsing attributes in process `syz.4.1588'. [ 241.543117][T11843] netlink: 28 bytes leftover after parsing attributes in process `syz.3.1587'. [ 241.758095][T11848] macsec2: entered promiscuous mode [ 241.788080][T11848] dummy0: entered promiscuous mode [ 241.840928][T11848] macsec2: entered allmulticast mode [ 241.870897][T11848] dummy0: entered allmulticast mode [ 241.907207][T11848] dummy0: left allmulticast mode [ 241.937418][T11848] dummy0: left promiscuous mode [ 242.176643][T11896] syzkaller0: entered promiscuous mode [ 242.199435][T11896] syzkaller0: entered allmulticast mode [ 242.384128][T11909] x_tables: duplicate underflow at hook 1 [ 242.522988][T11913] vxcan0: entered allmulticast mode [ 242.533155][T11916] validate_nla: 1 callbacks suppressed [ 242.533170][T11916] netlink: 'syz.2.1602': attribute type 32 has an invalid length. [ 242.568491][T11916] netlink: 8 bytes leftover after parsing attributes in process `syz.2.1602'. [ 242.593002][T11919] sctp: [Deprecated]: syz.3.1603 (pid 11919) Use of struct sctp_assoc_value in delayed_ack socket option. [ 242.593002][T11919] Use struct sctp_sack_info instead [ 242.630740][T11900] nbd1: detected capacity change from 0 to 63 [ 242.651308][T11916] bond10: option coupled_control: invalid value (12) [ 242.661051][ T5636] block nbd1: Receive control failed (result -104) [ 242.661079][ T50] block nbd1: Receive control failed (result -32) [ 242.677044][T11913] netlink: 44 bytes leftover after parsing attributes in process `syz.1.1601'. [ 242.714751][T11916] bond10 (unregistering): Released all slaves [ 243.244413][T11949] netlink: 128 bytes leftover after parsing attributes in process `syz.2.1611'. [ 243.576964][T11967] syzkaller0: Caught tx_queue_len zero misconfig [ 243.747339][T11976] netlink: 8 bytes leftover after parsing attributes in process `syz.3.1619'. [ 243.809494][T11979] netlink: 8 bytes leftover after parsing attributes in process `syz.3.1619'. [ 244.199821][T12001] netlink: 56 bytes leftover after parsing attributes in process `syz.1.1626'. [ 244.248308][T12006] netlink: 'syz.2.1628': attribute type 1 has an invalid length. [ 244.272873][T12001] netlink: 'syz.1.1626': attribute type 3 has an invalid length. [ 246.208421][T12074] macsec2: entered promiscuous mode [ 246.234386][T12074] bridge0: entered promiscuous mode [ 246.605531][T12094] __nla_validate_parse: 2 callbacks suppressed [ 246.605548][T12094] netlink: 4 bytes leftover after parsing attributes in process `syz.4.1644'. [ 247.503335][T12119] netlink: 28 bytes leftover after parsing attributes in process `syz.4.1649'. [ 247.557066][T12119] netlink: 'syz.4.1649': attribute type 7 has an invalid length. [ 247.599377][T12119] netlink: 'syz.4.1649': attribute type 8 has an invalid length. [ 247.629711][T12119] netlink: 4 bytes leftover after parsing attributes in process `syz.4.1649'. [ 247.873663][T12135] netlink: 'syz.4.1654': attribute type 1 has an invalid length. [ 247.894209][T12137] netlink: 40 bytes leftover after parsing attributes in process `syz.3.1655'. [ 247.918354][T12135] netlink: 8 bytes leftover after parsing attributes in process `syz.4.1654'. [ 247.938153][T12135] bond0: Unable to set up delay as MII monitoring is disabled [ 247.965339][T12135] x_tables: duplicate underflow at hook 1 [ 248.142256][T12145] netlink: 12 bytes leftover after parsing attributes in process `syz.2.1656'. [ 248.180925][T12149] netlink: 20 bytes leftover after parsing attributes in process `syz.4.1658'. [ 248.381646][T12159] netlink: 8 bytes leftover after parsing attributes in process `syz.3.1657'. [ 248.740153][T12169] netlink: 'syz.4.1662': attribute type 8 has an invalid length. [ 248.820337][T12169] netlink: 8 bytes leftover after parsing attributes in process `syz.4.1662'. [ 248.870504][T12179] netlink: 24 bytes leftover after parsing attributes in process `syz.1.1663'. [ 249.612932][T12172] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 250.190688][T12226] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 250.334825][T12230] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 251.463381][T12264] lo speed is unknown, defaulting to 1000 [ 251.618302][T12280] __nla_validate_parse: 7 callbacks suppressed [ 251.618321][T12280] netlink: 4 bytes leftover after parsing attributes in process `syz.3.1682'. [ 251.924343][T12292] mac80211_hwsim hwsim6 wlan0: entered promiscuous mode [ 251.940217][T12292] mac80211_hwsim hwsim6 wlan0: entered allmulticast mode [ 252.025699][T12295] gre0: left allmulticast mode [ 252.102515][T12295] mac80211_hwsim hwsim8 wlan0: left promiscuous mode [ 252.127030][T12295] mac80211_hwsim hwsim8 wlan0: left allmulticast mode [ 252.149135][T12295] vlan2: left promiscuous mode [ 252.165421][T12307] raw_sendmsg: syz.4.1689 forgot to set AF_INET. Fix it! [ 252.166028][T12295] vlan3: left promiscuous mode [ 252.199229][T12295] veth3: left allmulticast mode [ 252.205972][T12295] bond2: left promiscuous mode [ 252.215041][T12295] xfrm1: left promiscuous mode [ 252.225997][T12295] xfrm1: left allmulticast mode [ 252.239045][T12295] tipc: Resetting bearer [ 252.249178][T12295] syzkaller0: left promiscuous mode [ 252.286572][T12295] syzkaller0: left allmulticast mode [ 252.303273][T12295] vlan4: left allmulticast mode [ 252.311779][T12295] bond7: left allmulticast mode [ 252.316927][T12295] ip6tnl5: left allmulticast mode [ 252.593820][T12296] lo speed is unknown, defaulting to 1000 [ 252.718842][T12300] hsr0: entered promiscuous mode [ 252.738970][T12300] netlink: 'syz.2.1688': attribute type 4 has an invalid length. [ 252.762627][T12307] netlink: 12 bytes leftover after parsing attributes in process `syz.4.1689'. [ 252.787416][T12300] netlink: 17 bytes leftover after parsing attributes in process `syz.2.1688'. [ 252.989062][T12337] netlink: 48 bytes leftover after parsing attributes in process `syz.3.1697'. [ 253.034143][T12299] lo speed is unknown, defaulting to 1000 [ 253.540121][T12318] lo speed is unknown, defaulting to 1000 [ 254.159349][T12359] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 254.392111][T12359] batman_adv: batadv0: Interface deactivated: ip6gretap1 [ 254.622147][ T8350] netdevsim netdevsim0 eth0: unset [0, 0] type 1 family 0 port 8472 - 0 [ 254.648696][ T8350] netdevsim netdevsim0 eth0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 254.673095][T12379] netlink: 'syz.3.1710': attribute type 1 has an invalid length. [ 254.678642][ T8350] netdevsim netdevsim0 eth0: unset [1, 1] type 2 family 0 port 256 - 0 [ 254.690570][ T8350] netdevsim netdevsim0 eth0: unset [1, 2] type 2 family 0 port 20000 - 0 [ 254.699646][ T8350] netdevsim netdevsim0 eth1: unset [0, 0] type 1 family 0 port 8472 - 0 [ 254.711314][ T8350] netdevsim netdevsim0 eth1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 254.720198][ T8350] netdevsim netdevsim0 eth1: unset [1, 1] type 2 family 0 port 256 - 0 [ 254.729684][ T8350] netdevsim netdevsim0 eth1: unset [1, 2] type 2 family 0 port 20000 - 0 [ 254.769817][T12384] netlink: 40 bytes leftover after parsing attributes in process `syz.4.1709'. [ 254.841545][T12379] 8021q: adding VLAN 0 to HW filter on device bond3 [ 254.867800][ T8350] netdevsim netdevsim0 eth2: unset [0, 0] type 1 family 0 port 8472 - 0 [ 254.893408][ T8350] netdevsim netdevsim0 eth2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 254.904887][ T8350] netdevsim netdevsim0 eth2: unset [1, 1] type 2 family 0 port 256 - 0 [ 254.913592][ T8350] netdevsim netdevsim0 eth2: unset [1, 2] type 2 family 0 port 20000 - 0 [ 254.928715][ T8350] netdevsim netdevsim0 eth3: unset [0, 0] type 1 family 0 port 8472 - 0 [ 254.938185][ T8350] netdevsim netdevsim0 eth3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 254.951169][ T8350] netdevsim netdevsim0 eth3: unset [1, 1] type 2 family 0 port 256 - 0 [ 254.976636][ T8350] netdevsim netdevsim0 eth3: unset [1, 2] type 2 family 0 port 20000 - 0 [ 255.025685][T12382] vlan2: entered allmulticast mode [ 255.030987][T12382] bond3: entered allmulticast mode [ 255.055520][T12386] bond3: (slave geneve2): making interface the new active one [ 255.063704][T12386] geneve2: entered allmulticast mode [ 255.071950][T12386] bond3: (slave geneve2): Enslaving as an active interface with an up link [ 255.106544][ T8350] netdevsim netdevsim3 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 255.139939][ T8350] netdevsim netdevsim3 eth1: set [1, 0] type 2 family 0 port 6081 - 0 [ 255.172246][ T8350] netdevsim netdevsim3 eth2: set [1, 0] type 2 family 0 port 6081 - 0 [ 255.185319][ T8350] netdevsim netdevsim3 eth3: set [1, 0] type 2 family 0 port 6081 - 0 [ 255.605932][T12414] netlink: 12 bytes leftover after parsing attributes in process `syz.4.1716'. [ 255.654635][T12418] netlink: 28 bytes leftover after parsing attributes in process `syz.3.1717'. [ 256.030711][T12431] netem: change failed [ 256.222360][T12437] mac80211_hwsim hwsim2 wlan0: Caught tx_queue_len zero misconfig [ 256.603948][T12465] xt_CT: You must specify a L4 protocol and not use inversions on it [ 256.633714][T12465] netlink: 28 bytes leftover after parsing attributes in process `syz.1.1727'. [ 256.661334][T12469] netlink: 4 bytes leftover after parsing attributes in process `syz.4.1730'. [ 256.712850][T12471] netlink: 20 bytes leftover after parsing attributes in process `syz.3.1731'. [ 256.791682][T12473] netlink: 20 bytes leftover after parsing attributes in process `syz.3.1731'. [ 256.801872][T12473] nbd: device at index 64 is going down [ 256.922363][ T5645] udevd[5645]: inotify_add_watch(7, /dev/nbd64, 10) failed: No such file or directory [ 256.945344][ T5632] udevd[5632]: inotify_add_watch(7, /dev/nbd64, 10) failed: No such file or directory [ 257.432160][T12492] netlink: 'syz.3.1738': attribute type 11 has an invalid length. [ 257.433575][T12493] netlink: 16 bytes leftover after parsing attributes in process `syz.0.1740'. [ 257.454665][T12492] netlink: 199828 bytes leftover after parsing attributes in process `syz.3.1738'. [ 257.495610][T12493] netlink: 48 bytes leftover after parsing attributes in process `syz.0.1740'. [ 257.520552][T12496] SET target dimension over the limit! [ 257.577169][T12501] netlink: 28 bytes leftover after parsing attributes in process `syz.2.1742'. [ 257.613810][T12503] netlink: 540 bytes leftover after parsing attributes in process `syz.4.1741'. [ 257.674308][T12499] lo speed is unknown, defaulting to 1000 [ 257.754285][T12501] x_tables: arp_tables: NFQUEUE target: not valid for this family [ 258.005480][T12515] tc_dump_action: action bad kind [ 258.563488][T12538] tipc: Can't bind to reserved service type 1 [ 258.861215][T12549] netlink: 36 bytes leftover after parsing attributes in process `syz.2.1754'. [ 259.585078][T12579] IPVS: set_ctl: invalid protocol: 46 127.0.0.1:20001 [ 260.828383][T12672] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 260.880333][T12673] netlink: 'syz.0.1787': attribute type 30 has an invalid length. [ 260.968102][T12673] netlink: 'syz.0.1787': attribute type 30 has an invalid length. [ 260.976240][ T8349] netdevsim netdevsim0 eth0: set [0, 0] type 1 family 0 port 8472 - 0 [ 260.995986][ T8349] netdevsim netdevsim0 eth1: set [0, 0] type 1 family 0 port 8472 - 0 [ 260.997294][T12678] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 261.023109][ T8349] netdevsim netdevsim0 eth2: set [0, 0] type 1 family 0 port 8472 - 0 [ 261.044533][ T8349] netdevsim netdevsim0 eth3: set [0, 0] type 1 family 0 port 8472 - 0 [ 261.071898][T12686] RDS: rds_bind could not find a transport for ::ffff:172.20.20.170, load rds_tcp or rds_rdma? [ 261.257125][T12698] netlink: 'syz.3.1795': attribute type 11 has an invalid length. [ 261.506953][T12709] netdevsim netdevsim4 netdevsim3 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 261.519909][T12709] netdevsim netdevsim4 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 261.571872][T12711] lo speed is unknown, defaulting to 1000 [ 261.681309][T12709] netdevsim netdevsim4 netdevsim2 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 261.708604][T12709] netdevsim netdevsim4 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 261.792133][T12727] __nla_validate_parse: 9 callbacks suppressed [ 261.792150][T12727] netlink: 24 bytes leftover after parsing attributes in process `syz.3.1803'. [ 261.822240][T12709] netdevsim netdevsim4 netdevsim1 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 261.840060][T12709] netdevsim netdevsim4 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 261.864655][T12729] netlink: 24 bytes leftover after parsing attributes in process `syz.3.1803'. [ 261.970688][T12732] netlink: 'syz.2.1804': attribute type 14 has an invalid length. [ 261.979516][T12732] netlink: 8 bytes leftover after parsing attributes in process `syz.2.1804'. [ 261.980113][T12735] netlink: 16 bytes leftover after parsing attributes in process `syz.3.1805'. [ 262.001064][T12735] netlink: 16 bytes leftover after parsing attributes in process `syz.3.1805'. [ 262.014395][T12709] netdevsim netdevsim4 netdevsim0 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 262.027220][T12709] netdevsim netdevsim4 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 262.496141][T12757] netlink: 40 bytes leftover after parsing attributes in process `syz.2.1810'. [ 262.523947][T12761] netlink: 64138 bytes leftover after parsing attributes in process `syz.0.1809'. [ 262.532421][T12760] netlink: 180 bytes leftover after parsing attributes in process `syz.1.1811'. [ 262.544483][T12760] netlink: 8 bytes leftover after parsing attributes in process `syz.1.1811'. [ 262.637851][T12765] netlink: 8 bytes leftover after parsing attributes in process `syz.0.1812'. [ 262.670404][ T70] netdevsim netdevsim4 eth0: set [0, 0] type 1 family 0 port 8472 - 0 [ 262.687322][ T70] netdevsim netdevsim4 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 262.710899][T12770] nbd: must specify at least one socket [ 262.777166][ T48] netdevsim netdevsim4 eth1: set [0, 0] type 1 family 0 port 8472 - 0 [ 262.805073][ T48] netdevsim netdevsim4 eth1: set [1, 0] type 2 family 0 port 6081 - 0 [ 262.918976][ T48] netdevsim netdevsim4 eth2: set [0, 0] type 1 family 0 port 8472 - 0 [ 262.938584][ T48] netdevsim netdevsim4 eth2: set [1, 0] type 2 family 0 port 6081 - 0 [ 263.015145][ T48] netdevsim netdevsim4 eth3: set [0, 0] type 1 family 0 port 8472 - 0 [ 263.047697][ T48] netdevsim netdevsim4 eth3: set [1, 0] type 2 family 0 port 6081 - 0 [ 263.301120][T12792] smc: removing ib device sqz0 [ 263.665753][T12792] smbdirect: ib_dev[sqz0] removed [ 263.693437][T12818] netlink: 'syz.2.1828': attribute type 1 has an invalid length. [ 263.743780][T12820] netlink: 'syz.3.1829': attribute type 1 has an invalid length. [ 264.033276][T12820] 8021q: adding VLAN 0 to HW filter on device bond4 [ 264.222470][T12825] bond4: (slave geneve3): making interface the new active one [ 264.276897][T12825] bond4: (slave geneve3): Enslaving as an active interface with an up link [ 264.872890][T12860] pim6reg: entered allmulticast mode [ 265.136218][T12860] pim6reg: left allmulticast mode [ 265.713765][T12891] bond10 (unregistering): Released all slaves [ 265.973395][T12897] netlink: 'syz.2.1837': attribute type 11 has an invalid length. [ 266.121827][T12903] netlink: 'syz.2.1839': attribute type 1 has an invalid length. [ 266.393189][T12903] 8021q: adding VLAN 0 to HW filter on device bond10 [ 266.619160][T12911] bond10: (slave veth9): Enslaving as an active interface with a down link [ 266.697806][T12915] 8021q: adding VLAN 0 to HW filter on device batadv1 [ 266.744682][T12915] bond10: (slave batadv1): making interface the new active one [ 266.746598][T12922] IPVS: set_ctl: invalid protocol: 136 172.30.0.4:20005 [ 266.770043][T12915] batadv1: entered promiscuous mode [ 266.785951][T12915] bond10: (slave batadv1): Enslaving as an active interface with an up link [ 267.316765][T12946] netlink: 'syz.0.1847': attribute type 1 has an invalid length. [ 267.966659][T12985] __nla_validate_parse: 4 callbacks suppressed [ 267.966677][T12985] netlink: 12 bytes leftover after parsing attributes in process `syz.1.1858'. [ 267.987150][T12985] netlink: 8 bytes leftover after parsing attributes in process `syz.1.1858'. [ 268.114800][T12981] IPVS: persistence engine module ip_vs_pe_• not found [ 268.521354][T13017] netlink: 28 bytes leftover after parsing attributes in process `syz.0.1866'. [ 269.518202][T12985] ip6tnl6: entered allmulticast mode [ 269.554213][T13003] vti0: entered promiscuous mode [ 269.568835][T13003] vti0: entered allmulticast mode [ 269.618954][ T8352] netdevsim netdevsim4 eth0: unset [0, 0] type 1 family 0 port 8472 - 0 [ 269.647353][ T8352] netdevsim netdevsim4 eth0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 269.670935][ T8352] netdevsim netdevsim4 eth1: unset [0, 0] type 1 family 0 port 8472 - 0 [ 269.699447][ T8352] netdevsim netdevsim4 eth1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 269.767876][ T8352] netdevsim netdevsim4 eth2: unset [0, 0] type 1 family 0 port 8472 - 0 [ 269.798612][ T8352] netdevsim netdevsim4 eth2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 269.865135][ T8352] netdevsim netdevsim4 eth3: unset [0, 0] type 1 family 0 port 8472 - 0 [ 269.889610][ T8352] netdevsim netdevsim4 eth3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 270.224248][T13061] netlink: 'syz.2.1874': attribute type 1 has an invalid length. [ 270.259125][T13061] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 272.888873][T13071] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 272.943418][ T4958] block nbd1: Connection timed out, retrying (0/2 alive) [ 272.951791][ T4958] block nbd1: Connection timed out, retrying (0/2 alive) [ 272.961220][ T4958] block nbd1: Connection timed out, retrying (0/2 alive) [ 272.968328][ T4958] block nbd1: Connection timed out, retrying (0/2 alive) [ 272.979203][ T4958] block nbd1: Dead connection, failed to find a fallback [ 272.990573][ T4958] block nbd1: shutting down sockets [ 272.996456][ T4958] I/O error, dev nbd1, sector 6 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 273.006394][ T4958] Buffer I/O error on dev nbd1, logical block 3, async page read [ 273.014768][ T4958] I/O error, dev nbd1, sector 4 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 273.027123][ T4958] Buffer I/O error on dev nbd1, logical block 2, async page read [ 273.035794][ T4958] I/O error, dev nbd1, sector 2 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 273.044922][ T4958] Buffer I/O error on dev nbd1, logical block 1, async page read [ 273.052946][ T4958] I/O error, dev nbd1, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 273.063478][ T4958] Buffer I/O error on dev nbd1, logical block 0, async page read [ 273.074952][T11584] I/O error, dev nbd1, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 273.086432][T11584] Buffer I/O error on dev nbd1, logical block 0, async page read [ 273.101457][T11584] I/O error, dev nbd1, sector 2 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 273.110679][T11584] Buffer I/O error on dev nbd1, logical block 1, async page read [ 273.120061][T11584] I/O error, dev nbd1, sector 4 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 273.129250][T11584] Buffer I/O error on dev nbd1, logical block 2, async page read [ 273.138578][T11584] I/O error, dev nbd1, sector 6 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 273.147721][T11584] Buffer I/O error on dev nbd1, logical block 3, async page read [ 273.156058][T11584] I/O error, dev nbd1, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 273.165216][T11584] Buffer I/O error on dev nbd1, logical block 0, async page read [ 273.173181][T11584] I/O error, dev nbd1, sector 2 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 273.182696][T11584] Buffer I/O error on dev nbd1, logical block 1, async page read [ 273.193823][T11584] ldm_validate_partition_table(): Disk read failed. [ 273.205366][T11584] Dev nbd1: unable to read RDB block 0 [ 273.214827][T11584] nbd1: unable to read partition table [ 273.236040][T11584] ldm_validate_partition_table(): Disk read failed. [ 273.253933][T11584] Dev nbd1: unable to read RDB block 0 [ 273.271189][T13119] netlink: 8 bytes leftover after parsing attributes in process `syz.2.1886'. [ 273.292246][T11584] nbd1: unable to read partition table [ 273.299776][T13115] syzkaller0: entered promiscuous mode [ 273.307065][T13119] netlink: 8 bytes leftover after parsing attributes in process `syz.2.1886'. [ 273.310686][T13115] syzkaller0: entered allmulticast mode [ 273.351953][T13125] netlink: 8 bytes leftover after parsing attributes in process `syz.2.1886'. [ 273.368132][T13125] netlink: 8 bytes leftover after parsing attributes in process `syz.2.1886'. [ 273.421498][T13128] netlink: 144 bytes leftover after parsing attributes in process `syz.4.1888'. [ 273.432140][T13115] sch_tbf: burst 185 is lower than device syzkaller0 mtu (1500) ! [ 273.460273][T13130] tipc: Enabling of bearer rejected, failed to enable media [ 273.559391][T13133] netlink: 12 bytes leftover after parsing attributes in process `syz.0.1889'. [ 273.597561][T13133] netlink: 'syz.0.1889': attribute type 2 has an invalid length. [ 273.629119][T13133] netlink: 16 bytes leftover after parsing attributes in process `syz.0.1889'. [ 273.655704][T13143] netlink: 40 bytes leftover after parsing attributes in process `syz.2.1893'. [ 273.841603][T13147] netlink: 'syz.0.1894': attribute type 21 has an invalid length. [ 273.867003][T13147] netlink: 164 bytes leftover after parsing attributes in process `syz.0.1894'. [ 273.934773][T13155] netlink: 4 bytes leftover after parsing attributes in process `syz.2.1897'. [ 274.260467][T13180] netlink: 'syz.2.1902': attribute type 7 has an invalid length. [ 274.307701][T13163] bridge7: port 1(veth7) entered blocking state [ 274.314266][T13163] bridge7: port 1(veth7) entered disabled state [ 274.322314][T13163] veth7: entered allmulticast mode [ 274.329300][T13163] veth7: entered promiscuous mode [ 274.355258][T13169] Freezing with imperfect legacy cgroup freezer. See cgroup.freeze of cgroup v2 [ 274.367544][T13160] bridge7: port 2(veth0_to_bond) entered blocking state [ 274.378816][T13160] bridge7: port 2(veth0_to_bond) entered disabled state [ 274.394897][T13160] veth0_to_bond: entered allmulticast mode [ 274.406384][T13160] veth0_to_bond: entered promiscuous mode [ 274.465173][T13188] x_tables: duplicate underflow at hook 3 [ 274.552414][T13192] ip6t_srh: unknown srh match flags 4000 [ 274.645750][T13196] pim6reg: entered allmulticast mode [ 274.714073][T13196] pim6reg: left allmulticast mode [ 274.988337][T13214] 8021q: adding VLAN 0 to HW filter on device bond11 [ 275.228623][T13214] bond11: (slave veth11): Enslaving as an active interface with an up link [ 276.071948][T13277] netlink: 'syz.4.1935': attribute type 1 has an invalid length. [ 276.170927][T13277] 8021q: adding VLAN 0 to HW filter on device bond8 [ 276.362932][T13284] syzkaller1: entered promiscuous mode [ 276.380762][T13284] syzkaller1: entered allmulticast mode [ 276.525538][T13303] TCP: TCP_TX_DELAY enabled [ 277.019276][T13317] netlink: 'syz.1.1949': attribute type 29 has an invalid length. [ 277.748934][ T70] batadv1: left promiscuous mode [ 277.777429][T13360] netlink: 'syz.1.1959': attribute type 4 has an invalid length. [ 277.789660][T13360] netlink: 'syz.1.1959': attribute type 4 has an invalid length. [ 277.996175][T13369] netlink: 'syz.4.1963': attribute type 1 has an invalid length. [ 278.009333][T13367] mac80211_hwsim hwsim4 syzkaller0: left promiscuous mode [ 278.050212][T13367] mac80211_hwsim hwsim4 syzkaller0: left allmulticast mode [ 278.066153][ T5360] hid-generic 0005:046D:0A0E.0002: item fetching failed at offset 0/1 [ 278.092076][ T5360] hid-generic 0005:046D:0A0E.0002: probe with driver hid-generic failed with error -22 [ 278.101366][T13374] tipc: Started in network mode [ 278.109565][T13374] tipc: Node identity , cluster identity 4711 [ 278.115731][T13374] tipc: Failed to obtain node identity [ 278.121880][T13374] tipc: Enabling of bearer rejected, failed to enable media [ 278.170590][T13374] syzkaller0: entered promiscuous mode [ 278.176200][T13374] syzkaller0: entered allmulticast mode [ 278.439549][T13400] __nla_validate_parse: 15 callbacks suppressed [ 278.439568][T13400] netlink: 24 bytes leftover after parsing attributes in process `syz.0.1970'. [ 280.462795][T13422] netlink: 24 bytes leftover after parsing attributes in process `syz.1.1974'. [ 280.505722][T13427] netlink: 24 bytes leftover after parsing attributes in process `syz.1.1974'. [ 280.614498][T13439] netlink: 'syz.0.1979': attribute type 11 has an invalid length. [ 280.643748][T13437] netlink: 8 bytes leftover after parsing attributes in process `syz.4.1977'. [ 280.777020][T13439] netlink: 204 bytes leftover after parsing attributes in process `syz.0.1979'. [ 280.845230][T13448] bond10: option updelay: invalid value (18446744073709518847) [ 280.855418][T13448] bond10: option updelay: allowed values 0 - 2147483647 [ 280.865397][T13448] bond10 (unregistering): Released all slaves [ 280.896814][T13461] netlink: 'syz.0.1985': attribute type 32 has an invalid length. [ 280.932418][T13461] netlink: 20 bytes leftover after parsing attributes in process `syz.0.1985'. [ 281.341593][T13490] bond13: Unable to set down delay as MII monitoring is disabled [ 281.363243][T13490] bond13 (unregistering): Released all slaves [ 281.680723][T13502] openvswitch: netlink: Missing key (keys=40, expected=80) [ 281.853886][T13509] netlink: 'syz.1.1998': attribute type 9 has an invalid length. [ 281.937447][T13519] Cannot find set identified by id 0 to match [ 281.965532][T13520] netlink: 20 bytes leftover after parsing attributes in process `syz.4.1999'. [ 282.051652][T13522] netlink: 4 bytes leftover after parsing attributes in process `syz.0.2004'. [ 282.202912][T13538] netlink: 156 bytes leftover after parsing attributes in process `syz.1.2006'. [ 282.236274][T13538] openvswitch: netlink: Missing key (keys=40, expected=10000000) [ 282.260362][T13538] syzkaller0: entered promiscuous mode [ 282.276220][T13538] syzkaller0: entered allmulticast mode [ 282.359017][T13538] tipc: Enabling of bearer rejected, already enabled [ 282.436230][T13548] syzkaller0: left promiscuous mode [ 282.452183][T13548] syzkaller0: left allmulticast mode [ 282.493158][T13550] netlink: 36 bytes leftover after parsing attributes in process `syz.0.2010'. [ 282.828384][ T29] audit: type=1800 audit(1778347153.501:2): pid=13563 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.4.2013" name="memory.events" dev="tmpfs" ino=2086 res=0 errno=0 [ 282.885259][T13565] IPVS: wlc: UDP 224.0.0.2:0 - no destination available [ 283.226474][T13592] netlink: 'syz.0.2018': attribute type 1 has an invalid length. [ 283.555208][T13595] bond6: (slave vxcan3): The slave device specified does not support setting the MAC address [ 283.621489][T13595] bond6: (slave vxcan3): Error -95 calling set_mac_address [ 283.622891][T13609] __nla_validate_parse: 1 callbacks suppressed [ 283.622906][T13609] netlink: 12 bytes leftover after parsing attributes in process `syz.1.2020'. [ 283.649901][T13612] netlink: 12 bytes leftover after parsing attributes in process `syz.1.2020'. [ 283.717089][T13604] macvlan3: entered promiscuous mode [ 283.738778][T13604] macvlan3: entered allmulticast mode [ 283.756452][T13604] bond6: entered promiscuous mode [ 283.769435][T13604] 8021q: adding VLAN 0 to HW filter on device macvlan3 [ 283.787240][T13620] netlink: 'syz.3.2021': attribute type 13 has an invalid length. [ 283.804437][T13620] netlink: 'syz.3.2021': attribute type 17 has an invalid length. [ 283.816830][T13604] bond6: left promiscuous mode [ 283.856014][T13609] workqueue: Failed to create a rescuer kthread for wq "bond10": -EINTR [ 283.857184][T13612] workqueue: Failed to create a rescuer kthread for wq "bond10": -EINTR [ 284.032506][T13634] netlink: 'syz.1.2025': attribute type 3 has an invalid length. [ 284.053054][T13620] 8021q: adding VLAN 0 to HW filter on device team0 [ 284.077914][T13620] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 284.107378][T13638] netlink: 8 bytes leftover after parsing attributes in process `syz.1.2026'. [ 284.147069][T13620] team_slave_1: left promiscuous mode [ 284.154982][T13620] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 284.163200][T13620] xfrm0: left allmulticast mode [ 284.178346][T13620] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 284.189760][T13620] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 284.205308][T13620] veth1_vlan: left promiscuous mode [ 284.211861][T13620] veth0_vlan: left promiscuous mode [ 284.217645][T13620] veth0_vlan: entered promiscuous mode [ 284.226457][T13620] veth1_vlan: entered promiscuous mode [ 284.233830][T13620] tipc: Resetting bearer [ 284.240094][T13620] tipc: Resetting bearer [ 284.248220][T13620] veth1_macvtap: left promiscuous mode [ 284.255145][T13620] veth0_macvtap: left promiscuous mode [ 284.261778][T13620] veth0_macvtap: entered promiscuous mode [ 284.278740][T13620] veth1_macvtap: entered promiscuous mode [ 284.287685][T13620] mac80211_hwsim hwsim6 wlan0: left promiscuous mode [ 284.294510][T13620] mac80211_hwsim hwsim6 wlan0: left allmulticast mode [ 284.321360][T13620] bond0: left promiscuous mode [ 284.326158][T13620] bond0: left allmulticast mode [ 284.331958][T13620] 8021q: adding VLAN 0 to HW filter on device bond0 [ 284.341219][T13620] 8021q: adding VLAN 0 to HW filter on device bond1 [ 284.351253][T13620] veth1_vlan: entered allmulticast mode [ 284.357029][T13620] macvtap1: left promiscuous mode [ 284.362371][T13620] macvtap1: left allmulticast mode [ 284.367497][T13620] veth1_vlan: left allmulticast mode [ 284.381665][T13620] 8021q: adding VLAN 0 to HW filter on device eth0 [ 284.394955][T13620] 8021q: adding VLAN 0 to HW filter on device eth1 [ 284.407791][T13620] 8021q: adding VLAN 0 to HW filter on device eth2 [ 284.421393][T13620] 8021q: adding VLAN 0 to HW filter on device eth3 [ 284.434652][T13620] 8021q: adding VLAN 0 to HW filter on device bond2 [ 284.443183][T13620] veth7: left allmulticast mode [ 284.449599][T13620] mac80211_hwsim hwsim6 wlan0: entered promiscuous mode [ 284.460807][T13620] macsec2: left promiscuous mode [ 284.467558][T13620] vlan2: left allmulticast mode [ 284.472562][T13620] bond3: left allmulticast mode [ 284.477437][T13620] geneve2: left allmulticast mode [ 284.487905][T13620] vti0: left promiscuous mode [ 284.493120][T13620] vti0: left allmulticast mode [ 284.510493][ T13] bridge0: port 1(bridge_slave_0) entered blocking state [ 284.517612][ T13] bridge0: port 1(bridge_slave_0) entered forwarding state [ 284.535724][ T13] bridge0: port 2(bridge_slave_1) entered blocking state [ 284.542933][ T13] bridge0: port 2(bridge_slave_1) entered forwarding state [ 284.587284][ T8349] netdevsim netdevsim3 eth0: set [0, 0] type 1 family 0 port 8472 - 0 [ 284.596002][ T8349] netdevsim netdevsim3 eth1: set [0, 0] type 1 family 0 port 8472 - 0 [ 284.740500][ T8349] netdevsim netdevsim3 eth2: set [0, 0] type 1 family 0 port 8472 - 0 [ 284.759677][ T8349] netdevsim netdevsim3 eth3: set [0, 0] type 1 family 0 port 8472 - 0 [ 285.334074][T13670] netlink: 28 bytes leftover after parsing attributes in process `syz.2.2032'. [ 285.560440][T13678] netlink: 4 bytes leftover after parsing attributes in process `syz.0.2038'. [ 285.592466][T13681] netlink: 272 bytes leftover after parsing attributes in process `syz.4.2035'. [ 285.836020][T13701] netlink: 20 bytes leftover after parsing attributes in process `syz.1.2040'. [ 285.856595][T13700] netlink: 36 bytes leftover after parsing attributes in process `syz.3.2041'. [ 285.861325][T13703] netlink: 'syz.4.2039': attribute type 13 has an invalid length. [ 285.878047][T13703] netlink: 'syz.4.2039': attribute type 17 has an invalid length. [ 285.891512][T13701] netlink: 4 bytes leftover after parsing attributes in process `syz.1.2040'. [ 285.903773][T13702] netlink: 'syz.0.2042': attribute type 1 has an invalid length. [ 286.071168][T13703] 8021q: adding VLAN 0 to HW filter on device bond0 [ 286.087812][T13703] 8021q: adding VLAN 0 to HW filter on device ` [ 286.121743][T13703] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 286.276358][T13703] veth1_vlan: left promiscuous mode [ 286.293997][T13703] veth0_vlan: left promiscuous mode [ 286.302376][T13703] veth0_vlan: entered promiscuous mode [ 286.328223][T13703] veth1_vlan: entered promiscuous mode [ 286.352473][T13703] veth1_macvtap: left promiscuous mode [ 286.374835][T13703] veth0_macvtap: left promiscuous mode [ 286.399707][T13703] veth0_macvtap: entered promiscuous mode [ 286.464140][T13703] veth1_macvtap: entered promiscuous mode [ 286.651613][T13703] 8021q: adding VLAN 0 to HW filter on device bond1 [ 286.675451][T13753] netlink: 24 bytes leftover after parsing attributes in process `syz.3.2048'. [ 286.736845][T13703] xfrm1: left allmulticast mode [ 286.744655][T13703] 8021q: adding VLAN 0 to HW filter on device bond2 [ 286.752596][T13703] 8021q: adding VLAN 0 to HW filter on device bond3 [ 286.766268][T13703] 8021q: adding VLAN 0 to HW filter on device bond4 [ 286.774510][T13703] 8021q: adding VLAN 0 to HW filter on device ipvlan2 [ 286.784664][T13703] 8021q: adding VLAN 0 to HW filter on device bond5 [ 286.792610][T13703] 8021q: adding VLAN 0 to HW filter on device bond6 [ 286.801920][T13703] A link change request failed with some changes committed already. Interface geneve4 may have been left with an inconsistent configuration, please check. [ 286.818795][T13702] workqueue: Failed to create a rescuer kthread for wq "bond7": -EINTR [ 286.917664][ T180] netdevsim netdevsim4 eth0: set [0, 0] type 1 family 0 port 8472 - 0 [ 286.960743][ T180] netdevsim netdevsim4 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 286.980660][ T180] netdevsim netdevsim4 eth1: set [0, 0] type 1 family 0 port 8472 - 0 [ 286.992111][ T180] netdevsim netdevsim4 eth1: set [1, 0] type 2 family 0 port 6081 - 0 [ 287.003005][ T180] netdevsim netdevsim4 eth2: set [0, 0] type 1 family 0 port 8472 - 0 [ 287.013997][ T180] netdevsim netdevsim4 eth2: set [1, 0] type 2 family 0 port 6081 - 0 [ 287.054975][ T180] netdevsim netdevsim4 eth3: set [0, 0] type 1 family 0 port 8472 - 0 [ 287.063741][ T180] netdevsim netdevsim4 eth3: set [1, 0] type 2 family 0 port 6081 - 0 [ 287.133196][T13773] xt_l2tp: v2 doesn't support IP mode [ 287.151036][T13764] openvswitch: netlink: Geneve opt len 1 is not a multiple of 4. [ 287.644026][T13797] netlink: 'syz.2.2060': attribute type 21 has an invalid length. [ 287.673389][T13797] netlink: 'syz.2.2060': attribute type 4 has an invalid length. [ 287.690433][T13797] netlink: 'syz.2.2060': attribute type 3 has an invalid length. [ 287.711314][T13797] IPVS: set_ctl: invalid protocol: 1 172.30.0.3:20003 [ 287.731904][T13799] dvmrp6: entered allmulticast mode [ 287.760233][T13805] netlink: 'syz.0.2063': attribute type 8 has an invalid length. [ 287.764116][T13799] xt_connbytes: Forcing CT accounting to be enabled [ 287.976303][T13805] veth1_to_team: entered promiscuous mode [ 288.018026][T13805] gretap0: entered promiscuous mode [ 288.036022][T13805] debugfs: 'hsr1' already exists in 'hsr' [ 288.066442][T13805] Cannot create hsr debugfs directory [ 288.085414][T13805] hsr1: entered promiscuous mode [ 288.158020][T13819] 8021q: adding VLAN 0 to HW filter on device macvlan3 [ 288.169426][ T5817] team_slave_0: entered promiscuous mode [ 288.268606][T13826] x_tables: duplicate underflow at hook 4 [ 288.281263][T13819] 8021q: adding VLAN 0 to HW filter on device macvlan4 [ 288.457983][T13840] gre1: entered allmulticast mode [ 288.827792][T13867] __nla_validate_parse: 12 callbacks suppressed [ 288.827810][T13867] netlink: 20 bytes leftover after parsing attributes in process `syz.2.2083'. [ 288.861288][ T48] wlan1: Trigger new scan to find an IBSS to join [ 289.001243][T13878] Cannot find add_set index 1 as target [ 289.161726][T13887] bond5 (unregistering): Released all slaves [ 289.183940][T13889] workqueue: Failed to create a rescuer kthread for wq "bond10": -EINTR [ 289.281251][T13899] netlink: 4 bytes leftover after parsing attributes in process `syz.3.2091'. [ 289.282588][T13897] netlink: 8 bytes leftover after parsing attributes in process `syz.4.2090'. [ 290.400978][T13946] netlink: 212368 bytes leftover after parsing attributes in process `syz.1.2104'. [ 290.506657][T13954] sctp: [Deprecated]: syz.2.2106 (pid 13954) Use of int in max_burst socket option. [ 290.506657][T13954] Use struct sctp_assoc_value instead [ 290.923521][T13979] netlink: 36 bytes leftover after parsing attributes in process `syz.0.2111'. [ 291.040358][T13984] syzkaller0: entered promiscuous mode [ 291.062409][T13984] syzkaller0: entered allmulticast mode [ 291.142210][T13979] netlink: 8 bytes leftover after parsing attributes in process `syz.0.2111'. [ 291.570283][ T5636] block nbd2: Receive control failed (result -32) [ 291.675477][T13971] nbd2: detected capacity change from 0 to 8388735 [ 291.752248][T14009] netlink: 27 bytes leftover after parsing attributes in process `syz.1.2115'. [ 291.781137][T11584] block nbd2: Dead connection, failed to find a fallback [ 291.821467][ T70] wlan1: Trigger new scan to find an IBSS to join [ 291.841830][T11584] block nbd2: shutting down sockets [ 291.874712][T14009] netlink: 8 bytes leftover after parsing attributes in process `syz.1.2115'. [ 291.912393][T11584] blk_print_req_error: 138 callbacks suppressed [ 291.912410][T11584] I/O error, dev nbd2, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 291.984222][T11584] buffer_io_error: 138 callbacks suppressed [ 291.984238][T11584] Buffer I/O error on dev nbd2, logical block 0, async page read [ 292.035179][T11584] I/O error, dev nbd2, sector 2 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 292.053825][T14009] netlink: 8 bytes leftover after parsing attributes in process `syz.1.2115'. [ 292.070237][T11584] Buffer I/O error on dev nbd2, logical block 1, async page read [ 292.083636][T11584] I/O error, dev nbd2, sector 4 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 292.101331][T14020] netlink: 32 bytes leftover after parsing attributes in process `syz.0.2116'. [ 292.108573][T11584] Buffer I/O error on dev nbd2, logical block 2, async page read [ 292.120598][T14020] tipc: Invalid UDP bearer configuration [ 292.120654][T14020] tipc: Enabling of bearer rejected, failed to enable media [ 292.153491][T11584] I/O error, dev nbd2, sector 6 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 292.169545][T11584] Buffer I/O error on dev nbd2, logical block 3, async page read [ 292.198282][T11584] I/O error, dev nbd2, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 292.241044][T11584] Buffer I/O error on dev nbd2, logical block 0, async page read [ 292.284273][T11584] I/O error, dev nbd2, sector 2 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 292.330625][T11584] Buffer I/O error on dev nbd2, logical block 1, async page read [ 292.359848][T11584] I/O error, dev nbd2, sector 4 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 292.377051][T11584] Buffer I/O error on dev nbd2, logical block 2, async page read [ 292.396619][T11584] I/O error, dev nbd2, sector 6 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 292.414660][T11584] Buffer I/O error on dev nbd2, logical block 3, async page read [ 292.432266][T11584] I/O error, dev nbd2, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 292.453426][T11584] Buffer I/O error on dev nbd2, logical block 0, async page read [ 292.472924][T11584] I/O error, dev nbd2, sector 2 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 292.508825][T11584] Buffer I/O error on dev nbd2, logical block 1, async page read [ 292.553969][T11584] ldm_validate_partition_table(): Disk read failed. [ 292.582874][T11584] Dev nbd2: unable to read RDB block 0 [ 292.605563][T11584] nbd2: unable to read partition table [ 292.673384][T11584] ldm_validate_partition_table(): Disk read failed. [ 292.696949][T11584] Dev nbd2: unable to read RDB block 0 [ 292.720012][T11584] nbd2: unable to read partition table [ 292.905622][T14065] IPVS: wlc: UDP 224.0.0.2:0 - no destination available [ 292.972196][ T29] audit: type=1800 audit(1778347163.651:3): pid=14064 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.3.2125" name=3A202E31323334352E2E2E2E2028313829207238203D2030783363333130303030300A202020202020323A202E31323334352E2E382E20283835292063616C6C2070632B360A202020202020333A202E2E2E2E2E2E2E2E382E2028313829207230203D203078313130303030303066666666666666660A202020202020353A202E2E2E2E2E2E2E2E382E202836362920696620773820733E2030783020676F746F2070632B300A202020202020363A202E2E2E2E2E2E2E2E2E2E20283138292072 dev="tmpfs" ino=2143 res=0 errno=0 [ 293.181463][T14074] bond11: option ad_user_port_key: invalid value (65535) [ 293.188947][T14074] bond11: option ad_user_port_key: allowed values 0 - 1023 [ 293.201770][T14074] bond11 (unregistering): Released all slaves [ 293.208364][T14077] netlink: 'syz.3.2129': attribute type 1 has an invalid length. [ 293.369860][T14077] 8021q: adding VLAN 0 to HW filter on device bond5 [ 293.431064][T14086] bond5: (slave gretap1): making interface the new active one [ 293.441026][T14086] bond5: (slave gretap1): Enslaving as an active interface with an up link [ 293.461253][T14077] bond5 (unregistering): (slave gretap1): Releasing active interface [ 293.472557][T14087] netlink: 'syz.4.2132': attribute type 2 has an invalid length. [ 293.508368][T14087] netlink: 'syz.4.2132': attribute type 1 has an invalid length. [ 293.526291][T14087] netlink: 'syz.4.2132': attribute type 1 has an invalid length. [ 293.533193][T14077] bond5 (unregistering): Released all slaves [ 293.622460][T14101] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 293.639943][T14104] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 294.262524][T14110] mac80211_hwsim hwsim4 syzkaller0: entered promiscuous mode [ 294.281577][T14110] mac80211_hwsim hwsim4 syzkaller0: entered allmulticast mode [ 294.611125][T14131] netlink: 'syz.2.2143': attribute type 11 has an invalid length. [ 294.632597][T14129] __nla_validate_parse: 5 callbacks suppressed [ 294.632616][T14129] netlink: 4 bytes leftover after parsing attributes in process `syz.3.2142'. [ 294.654951][T14131] netlink: 7 bytes leftover after parsing attributes in process `syz.2.2143'. [ 294.677344][T14136] netlink: 8 bytes leftover after parsing attributes in process `syz.4.2144'. [ 294.755928][T14136] vlan0: entered allmulticast mode [ 294.774970][T14136] macvtap0: entered allmulticast mode [ 294.793964][T14136] veth0_macvtap: entered allmulticast mode [ 294.861512][ T13] wlan1: Trigger new scan to find an IBSS to join [ 294.987291][T14150] netlink: 60 bytes leftover after parsing attributes in process `syz.4.2149'. [ 295.002165][T14150] netlink: 12 bytes leftover after parsing attributes in process `syz.4.2149'. [ 295.019866][T14150] netlink: 'syz.4.2149': attribute type 1 has an invalid length. [ 295.211492][T14163] netlink: 8 bytes leftover after parsing attributes in process `syz.3.2153'. [ 295.238394][T14159] netlink: 'syz.0.2151': attribute type 5 has an invalid length. [ 295.494339][T14165] macsec3: entered promiscuous mode [ 295.805737][ T127] wlan1: Creating new IBSS network, BSSID 32:ee:11:2d:3e:8c [ 295.849826][T14182] netlink: 'syz.3.2160': attribute type 1 has an invalid length. [ 295.943924][T14182] netlink: 28 bytes leftover after parsing attributes in process `syz.3.2160'. [ 296.043356][T14182] 8021q: adding VLAN 0 to HW filter on device bond5 [ 296.075163][T14193] netlink: 8 bytes leftover after parsing attributes in process `syz.2.2158'. [ 296.083186][T14192] macvlan5: entered promiscuous mode [ 296.090980][T14193] netlink: 8 bytes leftover after parsing attributes in process `syz.2.2158'. [ 296.102467][T14192] macvlan5: entered allmulticast mode [ 296.114344][T14192] bond5: entered promiscuous mode [ 296.134249][T14192] 8021q: adding VLAN 0 to HW filter on device macvlan5 [ 296.200167][T14192] bond5: left promiscuous mode [ 296.383402][T14208] netlink: 8 bytes leftover after parsing attributes in process `syz.1.2166'. [ 297.120573][T14257] netlink: 'syz.0.2179': attribute type 1 has an invalid length. [ 297.149073][T14256] netlink: 'syz.0.2179': attribute type 1 has an invalid length. [ 297.177940][T14259] xt_CT: You must specify a L4 protocol and not use inversions on it [ 297.180727][T14257] workqueue: Failed to create a rescuer kthread for wq "bond7": -EINTR [ 297.619371][ T29] audit: type=1804 audit(1778347168.291:4): pid=14285 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=open_writers comm="syz.3.2187" name="/newroot/425/memory.events" dev="tmpfs" ino=2205 res=1 errno=0 [ 297.656199][ T29] audit: type=1800 audit(1778347168.301:5): pid=14285 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.3.2187" name="memory.events" dev="tmpfs" ino=2205 res=0 errno=0 [ 297.693053][T14285] bond6: option lacp_active: mode dependency failed, not supported in mode balance-rr(0) [ 297.705767][T14285] bond6 (unregistering): Released all slaves [ 297.833513][T14290] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 298.213964][T14315] hsr0: left promiscuous mode [ 298.474180][ T29] audit: type=1804 audit(1778347169.151:6): pid=14331 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=open_writers comm="syz.2.2202" name="/newroot/452/cgroup.controllers" dev="tmpfs" ino=2332 res=1 errno=0 [ 298.555580][ T29] audit: type=1800 audit(1778347169.151:7): pid=14331 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.2.2202" name="cgroup.controllers" dev="tmpfs" ino=2332 res=0 errno=0 [ 299.352707][T14368] siw: device registration error -23 [ 299.548352][T14380] macsec1: entered promiscuous mode [ 299.886888][T14399] netlink: 'syz.4.2217': attribute type 1 has an invalid length. [ 299.909639][T14399] __nla_validate_parse: 40 callbacks suppressed [ 299.909658][T14399] netlink: 228 bytes leftover after parsing attributes in process `syz.4.2217'. [ 299.927266][T14399] netlink: 8 bytes leftover after parsing attributes in process `syz.4.2217'. [ 300.003231][T14406] bond6: option lacp_active: invalid value (8) [ 300.063531][T14406] bond6 (unregistering): Released all slaves [ 300.606219][T14430] netlink: 4 bytes leftover after parsing attributes in process `syz.1.2224'. [ 300.646823][T14435] netlink: 8 bytes leftover after parsing attributes in process `syz.4.2226'. [ 300.711222][T14432] xt_CT: No such helper "snmp" [ 300.816795][ T5636] Bluetooth: hci4: link tx timeout [ 300.836448][ T5636] Bluetooth: hci4: killing stalled connection 11:aa:aa:aa:aa:aa [ 300.852981][T14443] netlink: 12 bytes leftover after parsing attributes in process `syz.0.2228'. [ 300.920903][T14446] x_tables: ip_tables: RATEEST.0 target: invalid size 32 (kernel) != (user) 0 [ 301.352778][T14472] netlink: 76 bytes leftover after parsing attributes in process `syz.1.2239'. [ 301.393323][T14475] x_tables: ip_tables: osf match: only valid for protocol 6 [ 301.446179][T14475] bond8: option arp_interval: mode dependency failed, not supported in mode balance-tlb(5) [ 301.460514][T14475] bond8 (unregistering): Released all slaves [ 301.488167][T14476] syzkaller0: entered promiscuous mode [ 301.494396][T14476] syzkaller0: entered allmulticast mode [ 301.521063][T14479] sch_tbf: burst 32855 is lower than device lo mtu (11337746) ! [ 301.666285][T14486] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 301.676007][T14486] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 302.344203][T14521] tc_dump_action: action bad kind [ 302.586199][T14531] bond10: option tlb_dynamic_lb: mode dependency failed, not supported in mode balance-rr(0) [ 302.639363][T14531] bond10 (unregistering): Released all slaves [ 302.810164][T14529] netlink: 72 bytes leftover after parsing attributes in process `syz.0.2254'. [ 302.858946][ T5636] Bluetooth: hci4: command 0x0405 tx timeout [ 302.866720][T14529] netlink: 12 bytes leftover after parsing attributes in process `syz.0.2254'. [ 302.873711][T14498] netdevsim netdevsim2 eth3 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 302.914843][T14529] netlink: 4 bytes leftover after parsing attributes in process `syz.0.2254'. [ 302.963227][T14498] netdevsim netdevsim2 eth3 (unregistering): unset [1, 0] type 2 family 0 port 20000 - 0 [ 302.995198][T14498] netdevsim netdevsim2 eth3 (unregistering): unset [1, 1] type 2 family 0 port 6081 - 0 [ 303.162750][T14547] netlink: 8 bytes leftover after parsing attributes in process `syz.4.2257'. [ 303.173527][T14551] netlink: 'syz.1.2258': attribute type 1 has an invalid length. [ 303.288253][T14498] netdevsim netdevsim2 eth2 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 303.315910][T14498] netdevsim netdevsim2 eth2 (unregistering): unset [1, 0] type 2 family 0 port 20000 - 0 [ 303.341898][T14498] netdevsim netdevsim2 eth2 (unregistering): unset [1, 1] type 2 family 0 port 6081 - 0 [ 303.382433][T14553] bond11: (slave bridge8): Enslaving as a backup interface with an up link [ 303.490817][T14498] netdevsim netdevsim2 eth1 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 303.531051][T14498] netdevsim netdevsim2 eth1 (unregistering): unset [1, 0] type 2 family 0 port 20000 - 0 [ 303.553038][T14498] netdevsim netdevsim2 eth1 (unregistering): unset [1, 1] type 2 family 0 port 6081 - 0 [ 303.654124][T14498] netdevsim netdevsim2 eth0 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 303.678857][T14498] netdevsim netdevsim2 eth0 (unregistering): unset [1, 0] type 2 family 0 port 20000 - 0 [ 303.714518][T14498] netdevsim netdevsim2 eth0 (unregistering): unset [1, 1] type 2 family 0 port 6081 - 0 [ 303.797040][T14571] openvswitch: netlink: Missing key (keys=40, expected=200000) [ 304.020577][ T8348] netdevsim netdevsim2 eth0: set [0, 0] type 1 family 0 port 8472 - 0 [ 304.042860][ T8348] netdevsim netdevsim2 eth0: set [1, 0] type 2 family 0 port 20000 - 0 [ 304.065530][ T8348] netdevsim netdevsim2 eth0: set [1, 1] type 2 family 0 port 6081 - 0 [ 304.154419][ T12] netdevsim netdevsim2 eth1: set [0, 0] type 1 family 0 port 8472 - 0 [ 304.178811][ T12] netdevsim netdevsim2 eth1: set [1, 0] type 2 family 0 port 20000 - 0 [ 304.206654][ T12] netdevsim netdevsim2 eth1: set [1, 1] type 2 family 0 port 6081 - 0 [ 304.398950][T14360] netdevsim netdevsim2 eth2: set [0, 0] type 1 family 0 port 8472 - 0 [ 304.451984][T14360] netdevsim netdevsim2 eth2: set [1, 0] type 2 family 0 port 20000 - 0 [ 304.500777][T14360] netdevsim netdevsim2 eth2: set [1, 1] type 2 family 0 port 6081 - 0 [ 304.561421][T14355] netdevsim netdevsim2 eth3: set [0, 0] type 1 family 0 port 8472 - 0 [ 304.594982][T14355] netdevsim netdevsim2 eth3: set [1, 0] type 2 family 0 port 20000 - 0 [ 304.631751][T14355] netdevsim netdevsim2 eth3: set [1, 1] type 2 family 0 port 6081 - 0 [ 304.687784][T14610] A link change request failed with some changes committed already. Interface team0 may have been left with an inconsistent configuration, please check. [ 304.754205][T14610] A link change request failed with some changes committed already. Interface team0 may have been left with an inconsistent configuration, please check. [ 304.925934][T14622] __nla_validate_parse: 3 callbacks suppressed [ 304.925953][T14622] netlink: 4 bytes leftover after parsing attributes in process `syz.2.2273'. [ 304.976716][T14622] xt_TCPMSS: Only works on TCP SYN packets [ 305.000640][T14624] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 305.139205][T14622] bond7: left allmulticast mode [ 305.150665][T14622] bridge0: port 3(bond7) entered disabled state [ 305.183235][T14622] bridge_slave_1: left allmulticast mode [ 305.213283][T14622] bridge_slave_1: left promiscuous mode [ 305.235204][T14622] bridge0: port 2(bridge_slave_1) entered disabled state [ 305.259722][T14622] bridge_slave_0: left allmulticast mode [ 305.266650][T14622] bridge_slave_0: left promiscuous mode [ 305.273284][T14622] bridge0: port 1(bridge_slave_0) entered disabled state [ 305.359509][T14636] netlink: 4 bytes leftover after parsing attributes in process `syz.1.2278'. [ 305.595332][T14643] bond8: option arp_all_targets: invalid value (129) [ 305.621868][T14643] bond8 (unregistering): Released all slaves [ 306.022954][T14658] geneve5: entered promiscuous mode [ 306.034173][T14658] geneve5: entered allmulticast mode [ 306.082084][T14665] xt_hashlimit: size too large, truncated to 1048576 [ 306.737850][T14696] netlink: 12 bytes leftover after parsing attributes in process `syz.0.2292'. [ 307.363597][T14713] x_tables: duplicate underflow at hook 3 [ 307.421422][T14717] netlink: 8 bytes leftover after parsing attributes in process `syz.1.2299'. [ 307.430635][T14717] netlink: 8 bytes leftover after parsing attributes in process `syz.1.2299'. [ 307.440156][T14717] netlink: 124 bytes leftover after parsing attributes in process `syz.1.2299'. [ 307.992075][T14728] netlink: 4 bytes leftover after parsing attributes in process `syz.3.2303'. [ 308.147776][T14740] netlink: 12 bytes leftover after parsing attributes in process `syz.3.2306'. [ 308.173605][T14734] netlink: 'syz.3.2306': attribute type 1 has an invalid length. [ 308.351335][T14750] netlink: 20 bytes leftover after parsing attributes in process `syz.3.2311'. [ 308.474157][T14756] A link change request failed with some changes committed already. Interface batadv_slave_0 may have been left with an inconsistent configuration, please check. [ 308.502641][T14758] xt_nfacct: accounting object `syz0' does not exist [ 308.566836][T14762] netlink: 'syz.3.2316': attribute type 1 has an invalid length. [ 308.587554][T14762] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 308.651622][T14764] netlink: 8 bytes leftover after parsing attributes in process `syz.1.2317'. [ 308.674267][T14764] xt_CT: You must specify a L4 protocol and not use inversions on it [ 309.586185][T14802] syzkaller0: entered promiscuous mode [ 309.601786][T14802] syzkaller0: entered allmulticast mode [ 309.970161][T14816] veth13: entered allmulticast mode [ 310.011533][T14816] bond12: (slave veth13): Enslaving as an active interface with an up link [ 310.096250][T14825] bond12 (unregistering): (slave veth13): Releasing backup interface [ 310.133886][T14825] bond12 (unregistering): Released all slaves [ 310.237789][T14832] xt_recent: hitcount (262144) is larger than allowed maximum (65535) [ 310.419632][T14838] __nla_validate_parse: 4 callbacks suppressed [ 310.419648][T14838] netlink: 88 bytes leftover after parsing attributes in process `syz.4.2334'. [ 310.547232][T14847] netlink: 104 bytes leftover after parsing attributes in process `syz.2.2335'. [ 310.585992][T14847] netlink: 8 bytes leftover after parsing attributes in process `syz.2.2335'. [ 310.693361][T14849] netlink: 24 bytes leftover after parsing attributes in process `syz.2.2335'. [ 310.988321][T14866] bridge0: port 1(erspan0) entered blocking state [ 311.001524][T14866] bridge0: port 1(erspan0) entered disabled state [ 311.010185][T14866] erspan0: entered allmulticast mode [ 311.020443][T14866] erspan0: entered promiscuous mode [ 311.030059][T14867] erspan0: left allmulticast mode [ 311.044201][T14867] erspan0: left promiscuous mode [ 311.057455][T14867] bridge0: port 1(erspan0) entered disabled state [ 311.625989][T14898] netlink: 4 bytes leftover after parsing attributes in process `syz.2.2347'. [ 311.815876][T14904] netlink: 32 bytes leftover after parsing attributes in process `syz.1.2350'. [ 311.829931][T14909] netlink: 'syz.3.2348': attribute type 2 has an invalid length. [ 311.844474][T14910] IPVS: sed: FWM 3 0x00000003 - no destination available [ 311.857481][T14909] netlink: 'syz.3.2348': attribute type 2 has an invalid length. [ 311.872246][T14910] IPVS: sed: FWM 3 0x00000003 - no destination available [ 312.116114][T14915] netlink: 8 bytes leftover after parsing attributes in process `syz.1.2352'. [ 312.241605][T14918] netlink: 4 bytes leftover after parsing attributes in process `syz.2.2353'. [ 312.961530][T14948] netlink: 324 bytes leftover after parsing attributes in process `syz.4.2361'. [ 312.976061][T14946] xt_l2tp: invalid flags combination: 0 [ 313.250331][T14965] netlink: 'syz.2.2366': attribute type 1 has an invalid length. [ 313.278294][T14965] bond13: entered promiscuous mode [ 313.284113][T14965] 8021q: adding VLAN 0 to HW filter on device bond13 [ 313.294558][T14965] netlink: 4 bytes leftover after parsing attributes in process `syz.2.2366'. [ 313.322318][T14965] bond13: (slave bridge0): making interface the new active one [ 313.330193][T14965] bridge0: entered promiscuous mode [ 313.336576][T14965] bond13: (slave bridge0): Enslaving as an active interface with an up link [ 313.545214][T14975] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 313.557151][T14975] netlink: 'syz.1.2369': attribute type 1 has an invalid length. [ 313.874009][T14987] netlink: 'syz.2.2374': attribute type 1 has an invalid length. [ 314.206559][T15001] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 314.305306][ T3360] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 314.344983][ T3360] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 314.362177][T14996] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 314.380302][T15010] xt_hashlimit: overflow, rate too high: 0 [ 314.580698][T15017] netlink: 'syz.1.2382': attribute type 2 has an invalid length. [ 314.810943][T15024] xt_CT: No such helper "snmp" [ 315.174267][T15041] vlan0: entered promiscuous mode [ 315.735018][T15033] __nla_validate_parse: 13 callbacks suppressed [ 315.735039][T15033] netlink: 44 bytes leftover after parsing attributes in process `syz.1.2387'. [ 316.330599][ T29] audit: type=1800 audit(1778347187.011:8): pid=15071 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.2.2399" name=3A202E31323334352E2E2E2E2028313829207238203D2030783363333130303030300A202020202020323A202E31323334352E2E382E20283835292063616C6C2070632B360A202020202020333A202E2E2E2E2E2E2E2E382E2028313829207230203D203078313130303030303066666666666666660A202020202020353A202E2E2E2E2E2E2E2E382E202836362920696620773820733E2030783020676F746F2070632B300A202020202020363A202E2E2E2E2E2E2E2E2E2E20283138292072 dev="tmpfs" ino=2573 res=0 errno=0 [ 316.402759][T15073] netlink: 4 bytes leftover after parsing attributes in process `syz.3.2398'. [ 316.450527][T15075] netlink: 8 bytes leftover after parsing attributes in process `syz.2.2400'. [ 316.461890][T15075] netlink: 12 bytes leftover after parsing attributes in process `syz.2.2400'. [ 316.471383][T15075] netlink: 'syz.2.2400': attribute type 20 has an invalid length. [ 316.495177][T15072] syzkaller0: entered promiscuous mode [ 316.502573][T15072] syzkaller0: entered allmulticast mode [ 316.573041][T15080] tipc: New replicast peer: 255.255.255.255 [ 316.582098][T15080] tipc: Enabled bearer , priority 10 [ 327.980223][T14360] wlan1: No active IBSS STAs - trying to scan for other IBSS networks with same SSID (merge) [ 354.391029][T15092] netlink: 'syz.1.2404': attribute type 1 has an invalid length. [ 354.502728][T15092] bond13: (slave bridge9): Enslaving as a backup interface with an up link [ 354.532700][T15092] macvlan0: entered promiscuous mode [ 354.538081][T15092] macvlan0: entered allmulticast mode [ 354.545113][T15092] bond13: entered promiscuous mode [ 354.551857][T15092] bridge9: entered promiscuous mode [ 354.558183][T15092] 8021q: adding VLAN 0 to HW filter on device macvlan0 [ 354.568734][T15102] netlink: 36 bytes leftover after parsing attributes in process `syz.3.2406'. [ 354.623738][T15092] bond13: left promiscuous mode [ 354.634121][T15092] bridge9: left promiscuous mode [ 355.285226][T15143] netlink: 16 bytes leftover after parsing attributes in process `syz.3.2413'. [ 355.360198][T15147] netlink: 8 bytes leftover after parsing attributes in process `syz.0.2418'. [ 355.382846][T15151] sch_tbf: burst 32855 is lower than device lo mtu (65550) ! [ 355.425969][T15147] wlan0: renamed from gre0 [ 355.448061][T15147] wlan0: entered promiscuous mode [ 355.474910][T15147] wlan0: entered allmulticast mode [ 355.480622][T15147] A link change request failed with some changes committed already. Interface wlan0 may have been left with an inconsistent configuration, please check. [ 355.686436][T15181] vlan0: entered promiscuous mode [ 355.781136][T15186] netlink: 8 bytes leftover after parsing attributes in process `syz.2.2427'. [ 355.836917][T15189] openvswitch: netlink: Flow key attr not present in new flow. [ 355.951111][T15198] netlink: 8 bytes leftover after parsing attributes in process `syz.2.2430'. [ 356.029332][T15202] IPv6: Can't replace route, no match found [ 356.036621][T15202] netlink: 'syz.2.2431': attribute type 1 has an invalid length. [ 356.950674][T15220] netlink: 'syz.4.2434': attribute type 12 has an invalid length. [ 357.276258][T15236] netlink: 8 bytes leftover after parsing attributes in process `syz.0.2438'. [ 357.311329][T15236] netlink: 24 bytes leftover after parsing attributes in process `syz.0.2438'. [ 357.369247][T15230] block nbd3: server does not support multiple connections per device. [ 357.396696][T15230] block nbd3: shutting down sockets [ 357.451981][T15247] netlink: 'syz.3.2441': attribute type 1 has an invalid length. [ 357.673166][T15250] trusted_key: syz.3.2442 sent an empty control message without MSG_MORE. [ 358.523978][T15260] syzkaller0: default qdisc (pfifo_fast) fail, fallback to noqueue [ 358.581147][T15275] netlink: 20 bytes leftover after parsing attributes in process `syz.0.2446'. [ 358.667592][T15292] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 358.715751][T15289] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 359.101608][T15315] netlink: 264 bytes leftover after parsing attributes in process `syz.0.2454'. [ 359.439886][T15328] xt_hashlimit: max too large, truncated to 1048576 [ 359.472520][T15328] xt_ecn: cannot match TCP bits for non-tcp packets [ 359.963431][T15346] netlink: 4 bytes leftover after parsing attributes in process `syz.4.2460'. [ 360.314939][T15357] geneve2: entered promiscuous mode [ 360.344224][ T3360] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 360.378172][ T3360] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 360.395606][ T3360] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 360.412080][ T3360] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 361.363146][T15398] syzkaller1: entered allmulticast mode [ 361.795580][T15419] netlink: 12 bytes leftover after parsing attributes in process `syz.4.2476'. [ 361.811523][T15421] veth0_macvtap: Caught tx_queue_len zero misconfig [ 362.034032][T15437] netlink: 8 bytes leftover after parsing attributes in process `syz.4.2476'. [ 362.077053][T15439] netlink: 24 bytes leftover after parsing attributes in process `syz.3.2481'. [ 362.091450][T15442] netlink: 88 bytes leftover after parsing attributes in process `syz.2.2478'. [ 362.108612][T15442] netlink: 12 bytes leftover after parsing attributes in process `syz.2.2478'. [ 362.126473][T15443] netlink: 'syz.0.2479': attribute type 6 has an invalid length. [ 362.139075][T15442] netlink: 8 bytes leftover after parsing attributes in process `syz.2.2478'. [ 362.298844][T15439] bridge0: port 2(bridge_slave_1) entered disabled state [ 362.306320][T15439] bridge0: port 1(bridge_slave_0) entered disabled state [ 362.316518][T15439] team_slave_0: left promiscuous mode [ 362.382623][T15439] tipc: Resetting bearer [ 362.479278][T15428] bond10: (slave vcan1): refused to change device type [ 362.538652][T15457] bond8: option downdelay: invalid value (18446744073709547521) [ 362.546885][T15457] bond8: option downdelay: allowed values 0 - 2147483647 [ 362.565155][T15457] bond8 (unregistering): Released all slaves [ 362.656801][T15467] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 362.730104][T15456] bond8: option downdelay: invalid value (18446744073709547521) [ 362.748802][T15456] bond8: option downdelay: allowed values 0 - 2147483647 [ 362.766003][T15456] bond8 (unregistering): Released all slaves [ 362.849756][T14360] netdevsim netdevsim3 eth0: unset [0, 0] type 1 family 0 port 8472 - 0 [ 362.862880][T14360] netdevsim netdevsim3 eth0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 363.003564][T15482] 8021q: adding VLAN 0 to HW filter on device bond15 [ 363.014700][T14360] netdevsim netdevsim3 eth1: unset [0, 0] type 1 family 0 port 8472 - 0 [ 363.025528][T15489] netlink: 12 bytes leftover after parsing attributes in process `syz.4.2491'. [ 363.034817][T14360] netdevsim netdevsim3 eth1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 363.043365][T14360] netdevsim netdevsim3 eth2: unset [0, 0] type 1 family 0 port 8472 - 0 [ 363.052197][T14360] netdevsim netdevsim3 eth2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 363.069678][T14360] netdevsim netdevsim3 eth3: unset [0, 0] type 1 family 0 port 8472 - 0 [ 363.078652][T14360] netdevsim netdevsim3 eth3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 363.474318][T15509] xt_ecn: cannot match TCP bits for non-tcp packets [ 363.607522][T15522] bridge_slave_1: left allmulticast mode [ 363.646110][T15522] bridge_slave_1: left promiscuous mode [ 363.674218][T15522] bridge0: port 2(bridge_slave_1) entered disabled state [ 363.720031][T15522] bridge_slave_0: left allmulticast mode [ 363.746138][T15522] bridge_slave_0: left promiscuous mode [ 363.788487][T15522] bridge0: port 1(bridge_slave_0) entered disabled state [ 363.805440][T15528] sctp: [Deprecated]: syz.1.2503 (pid 15528) Use of int in max_burst socket option deprecated. [ 363.805440][T15528] Use struct sctp_assoc_value instead [ 364.784309][T15550] A link change request failed with some changes committed already. Interface gretap0 may have been left with an inconsistent configuration, please check. [ 364.863721][T15573] netlink: 4 bytes leftover after parsing attributes in process `syz.1.2516'. [ 365.205214][T15578] block nbd3: Unsupported socket: should be TCP or UNIX. [ 365.598644][T15605] 8021q: adding VLAN 0 to HW filter on device team0 [ 365.615035][T15609] netlink: 8 bytes leftover after parsing attributes in process `syz.2.2528'. [ 365.643023][T15608] netlink: 'syz.0.2527': attribute type 1 has an invalid length. [ 365.805559][T15605] hsr0: A HSR master's MTU cannot be greater than the smallest MTU of its slaves minus the HSR Tag length (6 octets). [ 365.821057][T15621] Cannot find set identified by id 65534 to match [ 366.001029][T15608] 8021q: adding VLAN 0 to HW filter on device bond8 [ 366.028380][T15634] netlink: 132 bytes leftover after parsing attributes in process `syz.1.2530'. [ 366.079843][T15615] vlan0: entered allmulticast mode [ 366.095119][T15615] bond8: entered allmulticast mode [ 366.470789][T15655] netlink: 12 bytes leftover after parsing attributes in process `syz.1.2532'. [ 366.630781][T15655] bond14: entered promiscuous mode [ 366.648029][T15655] 8021q: adding VLAN 0 to HW filter on device bond14 [ 366.721591][T15676] netlink: 16 bytes leftover after parsing attributes in process `syz.0.2535'. [ 366.768863][T15665] 8021q: adding VLAN 0 to HW filter on device bond15 [ 366.792482][T15665] bond15: entered promiscuous mode [ 366.808841][T15665] bond14: (slave bond15): Enslaving as an active interface with an up link [ 366.838214][T15674] netlink: 12 bytes leftover after parsing attributes in process `syz.2.2536'. [ 366.884386][T15674] netlink: 12 bytes leftover after parsing attributes in process `syz.2.2536'. [ 366.919252][T15674] netlink: 12 bytes leftover after parsing attributes in process `syz.2.2536'. [ 366.954895][T15674] netlink: 12 bytes leftover after parsing attributes in process `syz.2.2536'. [ 366.986738][T15674] netlink: 12 bytes leftover after parsing attributes in process `syz.2.2536'. [ 367.014265][T15674] netlink: 12 bytes leftover after parsing attributes in process `syz.2.2536'. [ 368.194695][T15745] syzkaller1: entered promiscuous mode [ 368.208855][T15745] syzkaller1: entered allmulticast mode [ 368.330087][T15743] [ 368.332458][T15743] ====================================================== [ 368.339484][T15743] WARNING: possible circular locking dependency detected [ 368.346505][T15743] syzkaller #0 Not tainted [ 368.350908][T15743] ------------------------------------------------------ [ 368.358000][T15743] syz.2.2555/15743 is trying to acquire lock: [ 368.364049][T15743] ffffffff8f0acb08 (crypto_alg_sem){++++}-{4:4}, at: crypto_alg_mod_lookup+0x211/0x5f0 [ 368.373711][T15743] [ 368.373711][T15743] but task is already holding lock: [ 368.381064][T15743] ffff8880a6450fe0 (sk_lock-AF_INET6){+.+.}-{0:0}, at: tls_setsockopt+0x39a/0x15c0 [ 368.390382][T15743] [ 368.390382][T15743] which lock already depends on the new lock. [ 368.390382][T15743] [ 368.400772][T15743] [ 368.400772][T15743] the existing dependency chain (in reverse order) is: [ 368.409771][T15743] [ 368.409771][T15743] -> #8 (sk_lock-AF_INET6){+.+.}-{0:0}: [ 368.417506][T15743] lock_sock_nested+0x41/0x100 [ 368.422792][T15743] inet_shutdown+0x6a/0x390 [ 368.427805][T15743] nbd_mark_nsock_dead+0x2e9/0x560 [ 368.433428][T15743] sock_shutdown+0x15e/0x260 [ 368.438530][T15743] nbd_clear_sock+0x24/0x170 [ 368.443634][T15743] nbd_config_put+0x2dd/0x580 [ 368.448826][T15743] nbd_genl_connect+0x19d5/0x1cf0 [ 368.454377][T15743] genl_family_rcv_msg_doit+0x22a/0x330 [ 368.460446][T15743] genl_rcv_msg+0x61c/0x7a0 [ 368.465472][T15743] netlink_rcv_skb+0x232/0x4b0 [ 368.470766][T15743] genl_rcv+0x28/0x40 [ 368.475261][T15743] netlink_unicast+0x75c/0x8e0 [ 368.480539][T15743] netlink_sendmsg+0x813/0xb40 [ 368.485911][T15743] ____sys_sendmsg+0x972/0x9f0 [ 368.491190][T15743] ___sys_sendmsg+0x2a5/0x360 [ 368.496437][T15743] __x64_sys_sendmsg+0x1bd/0x2a0 [ 368.501891][T15743] do_syscall_64+0x15f/0xf80 [ 368.507021][T15743] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 368.513424][T15743] [ 368.513424][T15743] -> #7 (&nsock->tx_lock){+.+.}-{4:4}: [ 368.521151][T15743] __mutex_lock+0x1a3/0x1550 [ 368.526249][T15743] nbd_queue_rq+0x37b/0x1100 [ 368.531349][T15743] blk_mq_dispatch_rq_list+0xa70/0x1910 [ 368.537409][T15743] __blk_mq_sched_dispatch_requests+0xdcc/0x1600 [ 368.544253][T15743] blk_mq_sched_dispatch_requests+0xd7/0x190 [ 368.550755][T15743] blk_mq_run_hw_queue+0x348/0x4f0 [ 368.556384][T15743] blk_mq_dispatch_list+0xd16/0xe10 [ 368.562097][T15743] blk_mq_flush_plug_list+0x48d/0x570 [ 368.567988][T15743] __blk_flush_plug+0x3ed/0x4d0 [ 368.573464][T15743] __submit_bio+0x28d/0x580 [ 368.578477][T15743] submit_bio_noacct_nocheck+0x2f4/0xa40 [ 368.584630][T15743] block_read_full_folio+0x599/0x830 [ 368.590432][T15743] filemap_read_folio+0x137/0x3b0 [ 368.595974][T15743] do_read_cache_folio+0x358/0x590 [ 368.601599][T15743] read_part_sector+0xb6/0x2b0 [ 368.606876][T15743] adfspart_check_ICS+0xb1/0x960 [ 368.612330][T15743] bdev_disk_changed+0x817/0x1770 [ 368.617868][T15743] blkdev_get_whole+0x380/0x510 [ 368.623231][T15743] bdev_open+0x31e/0xd30 [ 368.627988][T15743] blkdev_open+0x470/0x610 [ 368.632916][T15743] do_dentry_open+0x785/0x14e0 [ 368.638200][T15743] vfs_open+0x3b/0x340 [ 368.642806][T15743] path_openat+0x2e08/0x3860 [ 368.647929][T15743] do_file_open+0x23e/0x4a0 [ 368.652968][T15743] do_sys_openat2+0x113/0x200 [ 368.658190][T15743] __x64_sys_openat+0x138/0x170 [ 368.663573][T15743] do_syscall_64+0x15f/0xf80 [ 368.668684][T15743] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 368.675107][T15743] [ 368.675107][T15743] -> #6 (&cmd->lock){+.+.}-{4:4}: [ 368.682405][T15743] __mutex_lock+0x1a3/0x1550 [ 368.687516][T15743] nbd_queue_rq+0xc6/0x1100 [ 368.692540][T15743] blk_mq_dispatch_rq_list+0xa70/0x1910 [ 368.698603][T15743] __blk_mq_sched_dispatch_requests+0xdcc/0x1600 [ 368.705449][T15743] blk_mq_sched_dispatch_requests+0xd7/0x190 [ 368.711945][T15743] blk_mq_run_hw_queue+0x348/0x4f0 [ 368.717570][T15743] blk_mq_dispatch_list+0xd16/0xe10 [ 368.723287][T15743] blk_mq_flush_plug_list+0x48d/0x570 [ 368.729176][T15743] __blk_flush_plug+0x3ed/0x4d0 [ 368.734555][T15743] __submit_bio+0x28d/0x580 [ 368.739562][T15743] submit_bio_noacct_nocheck+0x2f4/0xa40 [ 368.745808][T15743] block_read_full_folio+0x599/0x830 [ 368.751600][T15743] filemap_read_folio+0x137/0x3b0 [ 368.757137][T15743] do_read_cache_folio+0x358/0x590 [ 368.762765][T15743] read_part_sector+0xb6/0x2b0 [ 368.768049][T15743] adfspart_check_ICS+0xb1/0x960 [ 368.773518][T15743] bdev_disk_changed+0x817/0x1770 [ 368.779065][T15743] blkdev_get_whole+0x380/0x510 [ 368.784523][T15743] bdev_open+0x31e/0xd30 [ 368.789286][T15743] blkdev_open+0x470/0x610 [ 368.794209][T15743] do_dentry_open+0x785/0x14e0 [ 368.799482][T15743] vfs_open+0x3b/0x340 [ 368.804061][T15743] path_openat+0x2e08/0x3860 [ 368.809162][T15743] do_file_open+0x23e/0x4a0 [ 368.814180][T15743] do_sys_openat2+0x113/0x200 [ 368.819373][T15743] __x64_sys_openat+0x138/0x170 [ 368.824734][T15743] do_syscall_64+0x15f/0xf80 [ 368.829828][T15743] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 368.836229][T15743] [ 368.836229][T15743] -> #5 (set->srcu){.+.+}-{0:0}: [ 368.843354][T15743] __synchronize_srcu+0xca/0x300 [ 368.848810][T15743] elevator_switch+0x1e8/0x7a0 [ 368.854092][T15743] elevator_change+0x2cc/0x450 [ 368.859370][T15743] elevator_set_default+0x36c/0x430 [ 368.865266][T15743] blk_register_queue+0x3e9/0x4e0 [ 368.870815][T15743] __add_disk+0x677/0xd50 [ 368.875654][T15743] add_disk_fwnode+0xfb/0x480 [ 368.880941][T15743] nbd_dev_add+0x72c/0xb50 [ 368.885959][T15743] nbd_init+0x168/0x1f0 [ 368.890629][T15743] do_one_initcall+0x250/0x870 [ 368.895920][T15743] do_initcall_level+0x104/0x190 [ 368.901401][T15743] do_initcalls+0x59/0xa0 [ 368.906343][T15743] kernel_init_freeable+0x2a6/0x3e0 [ 368.912405][T15743] kernel_init+0x1d/0x1d0 [ 368.917246][T15743] ret_from_fork+0x514/0xb70 [ 368.922345][T15743] ret_from_fork_asm+0x1a/0x30 [ 368.927710][T15743] [ 368.927710][T15743] -> #4 (&q->elevator_lock){+.+.}-{4:4}: [ 368.935526][T15743] __mutex_lock+0x1a3/0x1550 [ 368.940638][T15743] elevator_change+0x1b3/0x450 [ 368.945920][T15743] elevator_set_none+0xb5/0x140 [ 368.951293][T15743] blk_mq_update_nr_hw_queues+0x5e7/0x1a60 [ 368.957635][T15743] nbd_start_device+0x17f/0xb10 [ 368.963005][T15743] nbd_genl_connect+0x165b/0x1cf0 [ 368.968540][T15743] genl_family_rcv_msg_doit+0x22a/0x330 [ 368.974601][T15743] genl_rcv_msg+0x61c/0x7a0 [ 368.979613][T15743] netlink_rcv_skb+0x232/0x4b0 [ 368.984892][T15743] genl_rcv+0x28/0x40 [ 368.989380][T15743] netlink_unicast+0x75c/0x8e0 [ 368.994654][T15743] netlink_sendmsg+0x813/0xb40 [ 368.999929][T15743] ____sys_sendmsg+0x972/0x9f0 [ 369.005206][T15743] ___sys_sendmsg+0x2a5/0x360 [ 369.010398][T15743] __x64_sys_sendmsg+0x1bd/0x2a0 [ 369.015853][T15743] do_syscall_64+0x15f/0xf80 [ 369.020953][T15743] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 369.027363][T15743] [ 369.027363][T15743] -> #3 (&q->q_usage_counter(io)#50){++++}-{0:0}: [ 369.035960][T15743] blk_alloc_queue+0x546/0x680 [ 369.041240][T15743] __blk_mq_alloc_disk+0x197/0x390 [ 369.046859][T15743] nbd_dev_add+0x499/0xb50 [ 369.051797][T15743] nbd_init+0x168/0x1f0 [ 369.056464][T15743] do_one_initcall+0x250/0x870 [ 369.061738][T15743] do_initcall_level+0x104/0x190 [ 369.067197][T15743] do_initcalls+0x59/0xa0 [ 369.072042][T15743] kernel_init_freeable+0x2a6/0x3e0 [ 369.077755][T15743] kernel_init+0x1d/0x1d0 [ 369.082595][T15743] ret_from_fork+0x514/0xb70 [ 369.087694][T15743] ret_from_fork_asm+0x1a/0x30 [ 369.092967][T15743] [ 369.092967][T15743] -> #2 (fs_reclaim){+.+.}-{0:0}: [ 369.100177][T15743] fs_reclaim_acquire+0x71/0x100 [ 369.105632][T15743] __kmalloc_cache_noprof+0x40/0x660 [ 369.111442][T15743] cryptomgr_notify+0x85/0x930 [ 369.116727][T15743] notifier_call_chain+0x1ad/0x3d0 [ 369.122348][T15743] blocking_notifier_call_chain+0x6a/0x90 [ 369.128583][T15743] crypto_alg_mod_lookup+0x3b1/0x5f0 [ 369.134388][T15743] crypto_alloc_tfm_node+0x13e/0x3f0 [ 369.140185][T15743] crypto_alloc_sync_skcipher+0x39/0xd0 [ 369.146244][T15743] rxkad_init+0x20/0xe0 [ 369.150906][T15743] rxrpc_init_security+0x72/0x120 [ 369.156441][T15743] af_rxrpc_init+0x13d/0x2e0 [ 369.161543][T15743] do_one_initcall+0x250/0x870 [ 369.166815][T15743] do_initcall_level+0x104/0x190 [ 369.172265][T15743] do_initcalls+0x59/0xa0 [ 369.177111][T15743] kernel_init_freeable+0x2a6/0x3e0 [ 369.182824][T15743] kernel_init+0x1d/0x1d0 [ 369.187674][T15743] ret_from_fork+0x514/0xb70 [ 369.192771][T15743] ret_from_fork_asm+0x1a/0x30 [ 369.198132][T15743] [ 369.198132][T15743] -> #1 ((crypto_chain).rwsem){++++}-{4:4}: [ 369.206291][T15743] down_read+0x47/0x2e0 [ 369.210958][T15743] blocking_notifier_call_chain+0x54/0x90 [ 369.217188][T15743] __crypto_register_alg+0x32b/0x3c0 [ 369.222988][T15743] crypto_register_alg+0x447/0x810 [ 369.228697][T15743] do_one_initcall+0x250/0x870 [ 369.233967][T15743] do_initcall_level+0x104/0x190 [ 369.239417][T15743] do_initcalls+0x59/0xa0 [ 369.244369][T15743] kernel_init_freeable+0x2a6/0x3e0 [ 369.250082][T15743] kernel_init+0x1d/0x1d0 [ 369.254923][T15743] ret_from_fork+0x514/0xb70 [ 369.260025][T15743] ret_from_fork_asm+0x1a/0x30 [ 369.265304][T15743] [ 369.265304][T15743] -> #0 (crypto_alg_sem){++++}-{4:4}: [ 369.272853][T15743] __lock_acquire+0x15a5/0x2cf0 [ 369.278213][T15743] lock_acquire+0x106/0x350 [ 369.283225][T15743] down_write+0x96/0x200 [ 369.287978][T15743] crypto_alg_mod_lookup+0x211/0x5f0 [ 369.293782][T15743] crypto_alloc_tfm_node+0x13e/0x3f0 [ 369.299577][T15743] tls_set_sw_offload+0xa33/0x1780 [ 369.305197][T15743] tls_setsockopt+0xf3e/0x15c0 [ 369.310476][T15743] do_sock_setsockopt+0x17c/0x1b0 [ 369.316016][T15743] __x64_sys_setsockopt+0x13d/0x1b0 [ 369.321733][T15743] do_syscall_64+0x15f/0xf80 [ 369.326831][T15743] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 369.333232][T15743] [ 369.333232][T15743] other info that might help us debug this: [ 369.333232][T15743] [ 369.343444][T15743] Chain exists of: [ 369.343444][T15743] crypto_alg_sem --> &nsock->tx_lock --> sk_lock-AF_INET6 [ 369.343444][T15743] [ 369.356477][T15743] Possible unsafe locking scenario: [ 369.356477][T15743] [ 369.363908][T15743] CPU0 CPU1 [ 369.369258][T15743] ---- ---- [ 369.374635][T15743] lock(sk_lock-AF_INET6); [ 369.379125][T15743] lock(&nsock->tx_lock); [ 369.386048][T15743] lock(sk_lock-AF_INET6); [ 369.393061][T15743] lock(crypto_alg_sem); [ 369.397378][T15743] [ 369.397378][T15743] *** DEADLOCK *** [ 369.397378][T15743] [ 369.405504][T15743] 1 lock held by syz.2.2555/15743: [ 369.410596][T15743] #0: ffff8880a6450fe0 (sk_lock-AF_INET6){+.+.}-{0:0}, at: tls_setsockopt+0x39a/0x15c0 [ 369.420372][T15743] [ 369.420372][T15743] stack backtrace: [ 369.426252][T15743] CPU: 0 UID: 0 PID: 15743 Comm: syz.2.2555 Not tainted syzkaller #0 PREEMPT(full) [ 369.426271][T15743] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 369.426292][T15743] Call Trace: [ 369.426300][T15743] [ 369.426307][T15743] dump_stack_lvl+0xe8/0x150 [ 369.426327][T15743] print_circular_bug+0x2e1/0x300 [ 369.426350][T15743] check_noncircular+0x12e/0x150 [ 369.426372][T15743] __lock_acquire+0x15a5/0x2cf0 [ 369.426398][T15743] ? crypto_alg_mod_lookup+0x211/0x5f0 [ 369.426416][T15743] lock_acquire+0x106/0x350 [ 369.426432][T15743] ? crypto_alg_mod_lookup+0x211/0x5f0 [ 369.426454][T15743] down_write+0x96/0x200 [ 369.426476][T15743] ? crypto_alg_mod_lookup+0x211/0x5f0 [ 369.426493][T15743] ? __pfx_down_write+0x10/0x10 [ 369.426511][T15743] ? crypto_larval_alloc+0x1bf/0x290 [ 369.426529][T15743] crypto_alg_mod_lookup+0x211/0x5f0 [ 369.426548][T15743] crypto_alloc_tfm_node+0x13e/0x3f0 [ 369.426570][T15743] tls_set_sw_offload+0xa33/0x1780 [ 369.426594][T15743] tls_setsockopt+0xf3e/0x15c0 [ 369.426620][T15743] ? __pfx_tls_setsockopt+0x10/0x10 [ 369.426645][T15743] ? __fget_files+0x2a/0x420 [ 369.426664][T15743] ? aa_sock_opt_perm+0xff/0x1a0 [ 369.426686][T15743] ? sock_common_setsockopt+0x36/0xc0 [ 369.426706][T15743] ? __pfx_sock_common_setsockopt+0x10/0x10 [ 369.426726][T15743] do_sock_setsockopt+0x17c/0x1b0 [ 369.426751][T15743] __x64_sys_setsockopt+0x13d/0x1b0 [ 369.426774][T15743] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 369.426791][T15743] do_syscall_64+0x15f/0xf80 [ 369.426805][T15743] ? trace_irq_disable+0x3b/0x140 [ 369.426829][T15743] ? clear_bhb_loop+0x40/0x90 [ 369.426846][T15743] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 369.426863][T15743] RIP: 0033:0x7f53cdb9cdd9 [ 369.426878][T15743] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 369.426893][T15743] RSP: 002b:00007f53ceae5028 EFLAGS: 00000246 ORIG_RAX: 0000000000000036 [ 369.426909][T15743] RAX: ffffffffffffffda RBX: 00007f53cde15fa0 RCX: 00007f53cdb9cdd9 [ 369.426922][T15743] RDX: 0000000000000002 RSI: 000000000000011a RDI: 0000000000000008 [ 369.426932][T15743] RBP: 00007f53cdc32d69 R08: 0000000000000028 R09: 0000000000000000 [ 369.426943][T15743] R10: 0000200000000140 R11: 0000000000000246 R12: 0000000000000000 [ 369.426953][T15743] R13: 00007f53cde16038 R14: 00007f53cde15fa0 R15: 00007fffd5217228 [ 369.426971][T15743] [ 369.678551][T15749] macvtap0: entered allmulticast mode [ 369.684011][T15749] netdevsim netdevsim1 netdevsim0: entered allmulticast mode [ 369.691795][T15749] 8021q: adding VLAN 0 to HW filter on device macvtap0 [ 369.772218][T15749] netdevsim netdevsim1 netdevsim0: left allmulticast mode