last executing test programs: 5.517361904s ago: executing program 3 (id=2161): r0 = socket$inet6(0xa, 0x2, 0x0) r1 = socket(0x10, 0x803, 0x0) syz_genetlink_get_family_id$batadv(&(0x7f0000000200), r1) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000380)='memory.events\x00', 0x275a, 0x0) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) pwritev(r3, &(0x7f0000000100)=[{&(0x7f0000000040)="8e", 0x1}], 0x1, 0x4008001, 0x80) close(r3) socket$kcm(0x29, 0x2, 0x0) sendfile(r3, r2, 0x0, 0xf03a0005) connect$inet6(r0, &(0x7f0000000000)={0xa, 0x4e24, 0x8, @loopback, 0xb31}, 0x1c) getsockname$packet(r1, &(0x7f0000000440)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000000c0)=0x14) sendmsg$nl_route(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000180)=ANY=[@ANYBLOB="4000000010003704feffffff0000000000000000", @ANYRES32=r4, @ANYBLOB="c13c06001b14bf262000128008000100736974001400028008000100e00000020500050081"], 0x40}, 0x1, 0x0, 0x0, 0x40000}, 0x0) bind$inet6(r1, &(0x7f0000000100)={0xa, 0x4e20, 0x700, @private0={0xfc, 0x0, '\x00', 0x1}, 0x10001}, 0x1c) r5 = socket$alg(0x26, 0x5, 0x0) bind$alg(r5, &(0x7f0000000080)={0x26, 'skcipher\x00', 0x0, 0x0, 'cts(cbc(aes))\x00'}, 0x58) setsockopt$ALG_SET_KEY(r5, 0x117, 0x1, &(0x7f0000c18000)="ad56b6c5910fae9d6dcd3292ea54c7b6ef915d564c90c200", 0x18) r6 = accept4(r5, 0x0, 0x0, 0x0) sendmsg$alg(r6, &(0x7f00000004c0)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000040)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}, 0x0) sendmsg$TIPC_NL_MEDIA_SET(r6, &(0x7f0000001800)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000140)=ANY=[], 0x12f4}, 0x1, 0x0, 0x0, 0x4044010}, 0x0) recvmsg$unix(r6, &(0x7f0000000840)={0x0, 0x0, &(0x7f00000002c0)=[{&(0x7f0000000100)=""/44, 0x2c}], 0x1}, 0x0) recvmsg$kcm(r6, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)=[{&(0x7f0000000600)=""/4081, 0xff1}], 0x1}, 0x1) sendmmsg$inet(r0, &(0x7f00000018c0)=[{{&(0x7f0000000040)={0x2, 0x4e1c, @multicast1}, 0x10, 0x0, 0x0, &(0x7f0000000080)=[@ip_pktinfo={{0x1c, 0x0, 0x8, {r4, @empty, @multicast1}}}], 0x20}}], 0x1, 0x4880) 5.420385926s ago: executing program 1 (id=2162): socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000800)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = socket$kcm(0x11, 0x200000000000002, 0x300) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000440)={0x6, 0x0, 0x0, 0x0, 0xfffffffe, 0x0, 0x0, 0x0, 0x20, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, &(0x7f00000003c0)=[{0x0, 0x0, 0x3}, {0x10040002, 0x0, 0x7, 0x5}], 0x10, 0x80}, 0x94) close(r3) r4 = syz_init_net_socket$bt_bnep(0x1f, 0x3, 0x4) close(r4) recvmsg$unix(r2, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x0, &(0x7f00000003c0)=[@rights={{0x14, 0x1, 0x1, [0xffffffffffffffff]}}], 0x18}, 0x0) setsockopt$sock_attach_bpf(r1, 0x107, 0x12, &(0x7f00000008c0)=r5, 0x4) r6 = bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000540)={0x6, 0x3, &(0x7f0000000680)=ANY=[@ANYBLOB="1800000002000000000000000000000095"], &(0x7f0000000140)='syzkaller\x00', 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x40}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000600)={r6, 0x5, 0xd50, 0xfffffffffffffee0, &(0x7f0000000000)="259a53f271a76d2608304c6588a8", 0x0, 0xd01, 0x2a0, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x48) r7 = socket$inet6(0xa, 0x1, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r7, 0x29, 0x40, &(0x7f0000000d40)=@raw={'raw\x00', 0x3c1, 0x3, 0xb18, 0x0, 0x12, 0x600, 0x0, 0x202, 0xa48, 0x2e8, 0x2e8, 0xa48, 0x2c0, 0x4, 0x0, {[{{@ipv6={@private0={0xfc, 0x0, '\x00', 0x4}, @mcast2, [], [], 'veth1_to_bond\x00', 'geneve1\x00', {0xff}}, 0x0, 0x948, 0x978, 0x0, {}, [@common=@unspec=@string={{0xc0}, {0x0, 0x0, 'bm\x00', "0000000000000019b5115c2aee68d23a465cd431e150c3234e082555f67222476147864fa0318236000000c348cbd06dc8de1dcbde7d4e252c3394fed47bf78c70f607b0178fa5ea335019ac07a602061c96baeb8989f1f34a214e6726401fe4b124e0f7323a587d2a1fcf07000000eca0a7b66c60c527bac2b50700", 0x2, 0x0, {0x3}}}, @common=@unspec=@u32={{0x7e0}, {[{[{0x5, 0x1}, {0x4, 0x1}, {0x6, 0x2}, {0xffff8001, 0x2}, {0x3}, {0x7, 0x3}, {0x7, 0x2}, {0x65, 0x3}, {0x9, 0x1}, {0x33d8786a, 0x1}, {0x2, 0x2}], [{0x7, 0x8c}, {0x1, 0x5}, {0x3ff, 0xda}, {0x5, 0x80000000}, {0x6, 0x1}, {0x5, 0x3}, {0x9037, 0x8}, {0x1000, 0x1}, {0x7, 0x7ff}, {0x7}, {0x7, 0x4}], 0x7, 0x1}, {[{0x1, 0x3}, {0x80000000, 0x2}, {0x81, 0x3}, {0x8, 0x1}, {0x3}, {0x8, 0x1}, {0x5, 0x3}, {0x6ec7, 0x1}, {0x1, 0x2}, {0x9}, {0xffffffff}], [{0x0, 0x8000}, {0x1, 0x51}, {0x800, 0x1}, {0x40, 0xfffffffe}, {0x1, 0x400}, {0xffffffff, 0x4}, {0x1, 0x2f}, {0x6, 0xe3}, {0x5, 0x2336}, {0x2, 0x7fffffff}, {0x3, 0x100}], 0x2, 0x5}, {[{0x0, 0x1}, {0x1, 0x1}, {0x1, 0x1}, {0x401}, {0xffff, 0x2}, {0x80, 0x3}, {0xc, 0x1}, {0x7, 0x2}, {0x4}, {0x8, 0x1}, {0x84, 0x2}], [{0x2, 0x48ea5d6a}, {0x6, 0x1}, {0x5, 0xf7}, {0xc}, {0xab, 0x5}, {0x2, 0x9}, {0x6, 0x6}, {0x67, 0x5}, {0x40, 0x6}, {0x1800, 0xd}, {0x1ff, 0x8d6}], 0x7}, {[{0x6, 0x2}, {0xfffffff9}, {0xc}, {0x8, 0x1}, {0x8, 0x3}, {0xf, 0x1}, {0xe00}, {0x7fffffff}, {0x7, 0x2}, {0x5, 0x1}], [{0xe, 0x80000000}, {0x1, 0x9}, {0xea, 0x5}, {0x6, 0x5}, {0xa, 0x1}, {0x8, 0x8}, {0x8, 0x1}, {0x401, 0x2}, {0xfff, 0x9}, {0xb, 0x9}, {0x9, 0xffff}], 0xb, 0x4}, {[{0x585b, 0x2}, {0x800, 0x2}, {0x80, 0x1}, {0x6, 0x1}, {0x8001, 0x3}, {0x1, 0x1}, {0x2, 0x3}, {0x100}, {0xfff, 0x3}, {0x1}, {0x8001, 0x1}], [{0x6, 0x8}, {0x7f, 0x5}, {0x6, 0xf}, {0x3}, {0x2}, {0x80000000, 0x4}, {0x400, 0x6de0}, {0x8, 0x9}, {0x7, 0x800}, {0x98f, 0x10000}, {0xa9, 0x7}], 0x6, 0x9}, {[{0x8}, {0x81}, {0x0, 0x3}, {0xb, 0x3}, {0x2, 0x1}, {0xd7, 0x1}, {0x8, 0x3}, {0xf8a9, 0x3}, {0x5}, {0x0, 0x3}, {0x8, 0x2}], [{0x67c4, 0x8b}, {0xeb2, 0x1}, {0x0, 0x7ff}, {0x2, 0x9}, {0x3, 0x3}, {0x81, 0x8cc2}, {0xd, 0x200}, {0x2, 0x7}, {0x4, 0x800}, {0x7, 0x1d}, {0x9, 0x40}], 0x7, 0xb}, {[{0x6, 0x2}, {0x207, 0x2}, {0x0, 0x1b385c99f5cbecae}, {0x10000, 0x1}, {0x65593b7e, 0x2}, {0xdd}, {0x1, 0x2}, {0x4, 0x3}, {0x8, 0x1}, {0x6, 0x2}, {0x4, 0x2}], [{0x2, 0x2}, {0x5, 0x8}, {0x478f, 0x6}, {0x5cc0, 0x3}, {0x967, 0x3}, {0x0, 0x9}, {0x4, 0xfffffffb}, {0x800, 0xffffffff}, {0x81, 0xffff}, {0x6, 0xc}, {0x101, 0x7}], 0x7, 0x5}, {[{0xfffffffd, 0x3}, {0x3, 0x2}, {0xfffffffd, 0x3}, {0x9}, {0x5e84, 0x2}, {0x0, 0x1}, {0x4c2}, {0x8b6a, 0x2}, {0x10, 0x3}, {0x8001, 0x3}, {0x5, 0x3}], [{0x1, 0xc}, {0xf33, 0x8}, {0x6, 0xffffff01}, {0x3, 0x4}, {0x9, 0x66}, {0xb, 0x5}, {0x0, 0xf6c9}, {0x0, 0x4}, {0x2, 0x1000000}, {0x7, 0x4}, {0x40, 0x5d55}], 0xa, 0x5}, {[{}, {0xfff, 0x3}, {0xfffffff7, 0x2}, {0x5, 0x3}, {0x1}, {0x4, 0x1}, {0xae0, 0x3}, {0xffffffc0}, {0x8, 0x1}, {0x4}, {0x7, 0x3}], [{0x1, 0xfffffffc}, {0x1000, 0x7}, {0x2, 0xffffffff}, {0x80, 0x2}, {0x4, 0x6}, {0x3, 0x8}, {0x4, 0x8}, {0x4, 0x7}, {0x4, 0x1}, {0x8, 0x80}, {0xfffff802, 0x34a16896}], 0x6, 0x9}, {[{0x88, 0x3}, {0x9, 0x1}, {0xa610000, 0x1}, {0x0, 0x2}, {0x3, 0x2}, {0x44, 0x2}, {0x9}, {0x3, 0x1}, {0x2}, {0x9, 0x1}, {0x9}], [{0x80000000, 0x6}, {0x7fffffff}, {0x382, 0x3ff}, {0x1, 0x8}, {0xbd, 0x2c8}, {0x7}, {0x10000, 0x5ff}, {0x7, 0x6}, {0x1fd, 0x2}, {0x7, 0xffffffff}, {0x4, 0xe6}], 0x0, 0x3}, {[{0x3, 0x1}, {0x1, 0x2}, {0x4}, {0x36, 0x3}, {0xe1}, {0x9, 0x6}, {0x1}, {0x101, 0x2}, {0x23, 0x3}, {0x6}, {0xffffffff, 0x2}], [{0x7, 0x8}, {0x84b, 0x4}, {0x9, 0x1}, {0x18d, 0x75091ebd}, {0x2, 0xf9}, {0x4, 0xfffffff5}, {0xa, 0x4}, {0x2, 0x3}, {0x0, 0x9}, {0x1ff, 0x3ff}, {0x12505a58, 0x9}], 0x0, 0x4}], 0x2}}]}, @common=@unspec=@CONNMARK={0x30}}, {{@uncond, 0x0, 0xa8, 0xd0}, @common=@unspec=@CONNSECMARK={0x28, 'CONNSECMARK\x00', 0x0, {0x2}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0xb78) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000002c0)={'macvlan0\x00', 0x0}) connect$inet(0xffffffffffffffff, &(0x7f0000000180)={0x2, 0x4e21, @dev={0xac, 0x14, 0x14, 0x1d}}, 0x10) r9 = socket$inet(0x2, 0x3, 0x2) setsockopt$inet_mreqsrc(r9, 0x0, 0x27, 0x0, 0x0) setsockopt$inet_group_source_req(r9, 0x0, 0x2e, &(0x7f00000001c0)={0x5, {{0x2, 0x4e20, @multicast1}}, {{0x2, 0x4e23, @initdev={0xac, 0x1e, 0x0, 0x0}}}}, 0x108) r10 = bpf$MAP_CREATE(0x100000000000000, &(0x7f0000000440)=ANY=[@ANYBLOB="14000000040000000800000006"], 0x48) bpf$MAP_GET_NEXT_KEY(0x4, &(0x7f0000000140)={r10, &(0x7f0000000000)="436e91", 0x0}, 0x20) syz_emit_ethernet(0x36, &(0x7f0000001800)={@link_local, @local, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0xffffffffffffff97, 0x64, 0x0, 0x4, 0x2, 0x0, @empty, @multicast1}, @timestamp_reply={0x11, 0x0, 0x0, 0xe000, 0x2, 0x10001}}}}}, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000400)={0x10, 0x10, &(0x7f0000000040)=ANY=[@ANYRES8=r9], 0x0, 0x40, 0xbe, &(0x7f0000000240)=""/190, 0x41000, 0x54, '\x00', 0x0, @fallback=0xa, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, &(0x7f0000000340)={0x0, 0x8, 0xff, 0x2}, 0x10, 0xffffffffffffffff, 0xffffffffffffffff, 0x4, &(0x7f0000000380), &(0x7f00000003c0)=[{0x2, 0x3, 0x4, 0x1}, {0x1, 0x1, 0xe, 0x7}, {0x0, 0x1, 0x80000001, 0xb}, {0x1, 0x3, 0xa, 0xc8acadbc0b5dcbd4}], 0x10, 0x8}, 0x94) r11 = syz_init_net_socket$bt_l2cap(0x1f, 0x5, 0x0) ioctl$sock_ifreq(r11, 0x8937, 0x0) setsockopt$MRT_DEL_VIF(r9, 0x0, 0xcb, &(0x7f00000004c0)={0x1, 0x4, 0xff, 0xffff, @vifc_lcl_addr=@loopback, @private=0xa010101}, 0x10) r12 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r12, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000000)=@newlink={0x30, 0x10, 0x1, 0x70bd29, 0x25ffdbfd, {0x0, 0x0, 0x0, 0x0, 0x1021, 0x4001}, [@IFLA_GROUP={0x8}, @IFLA_MTU={0x8, 0x4, 0x1500}]}, 0x30}, 0x1, 0x0, 0x0, 0x801}, 0x4000000) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x4c02}) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000080)=ANY=[@ANYBLOB="440000001000010400"/20, @ANYRES32=r8, @ANYBLOB="00001700000000001c0037800b0001006970768a616e08000c0002800600010000000000050027"], 0x44}, 0x1, 0x0, 0x0, 0x240080d8}, 0x0) socket$nl_route(0x10, 0x3, 0x0) 5.34240868s ago: executing program 4 (id=2163): pipe(&(0x7f0000000040)) bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="02000000040000000800000001"], 0x50) (async) r0 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="02000000040000000800000001"], 0x50) bpf$MAP_CREATE(0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="220000000400000010"], 0x48) (async) bpf$MAP_CREATE(0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="220000000400000010"], 0x48) r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000200)=ANY=[], 0x48) bpf$BPF_MAP_CONST_STR_FREEZE(0x16, &(0x7f00000000c0)={r1}, 0x4) bpf$PROG_LOAD(0x5, &(0x7f00000005c0)={0x7, 0x1c, &(0x7f0000000400)=ANY=[@ANYBLOB="18080000cbb60000000000000000000018110000", @ANYRES32=r1, @ANYBLOB="0000000000000000b702000014000000b7030000000000008500000008000000bf0920000000000035090100000000009500000000000000b7080000000000007b8af8ff00000000b7080000020000007b8af0ff00000000bfa100000000000007010000f8ffffffbfa400000000000007040000f0ffffffb70200000800000018230000", @ANYRES32=r0, @ANYBLOB="0000000001000000b7050000080000001c00000000000000bf9800000000000056080000000000008500000005000000b70000000200000095"], &(0x7f0000000000)='GPL\x00', 0x5, 0x0, 0x0, 0x40f00, 0x8, '\x00', 0x0, @fallback=0xc, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000000}, 0x94) r3 = socket(0x10, 0x803, 0x0) syz_genetlink_get_family_id$nl80211(&(0x7f00000003c0), r3) (async) syz_genetlink_get_family_id$nl80211(&(0x7f00000003c0), r3) getsockname$packet(r3, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0xa) sendmsg$nl_route(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000280)=ANY=[@ANYBLOB="4800000010000507000000000000000000000002", @ANYRES32=r4, @ANYBLOB="0000400000000002280012000c00010076657468"], 0x48}}, 0x0) r5 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r5, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000440)=ANY=[@ANYBLOB="2800000014002101000000000000000002200000", @ANYRES32=r4, @ANYBLOB="08000400ffffffff08000200e0"], 0x28}, 0x1, 0x0, 0x0, 0x8001}, 0x0) r7 = socket$netlink(0x10, 0x3, 0x0) r8 = socket$nl_route(0x10, 0x3, 0x0) socket$nl_route(0x10, 0x3, 0x0) (async) r9 = socket$nl_route(0x10, 0x3, 0x0) getsockname$packet(0xffffffffffffffff, &(0x7f0000000500)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000002c0)=0x14) sendmsg$nl_route(r9, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000440)=ANY=[@ANYBLOB="280000001400212100000000000000000200"], 0x28}}, 0x0) sendmsg$nl_route(r8, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000540)=ANY=[@ANYBLOB="200000001400210100000000000000000200b000", @ANYRES32=r10, @ANYBLOB="379e29d911e213ba03210d3d9a4c5c5571a72b4c63fa53b2dc995a4e88861ddfbe6ed41026050b4b71a2239c630b08735aae471d5fe7c0bc"], 0x20}}, 0x0) (async) sendmsg$nl_route(r8, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000540)=ANY=[@ANYBLOB="200000001400210100000000000000000200b000", @ANYRES32=r10, @ANYBLOB="379e29d911e213ba03210d3d9a4c5c5571a72b4c63fa53b2dc995a4e88861ddfbe6ed41026050b4b71a2239c630b08735aae471d5fe7c0bc"], 0x20}}, 0x0) sendmsg$nl_route(r7, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000180)=ANY=[@ANYRES16=r3, @ANYRES32=r6, @ANYRES64, @ANYRESOCT=r2, @ANYRESOCT=r3], 0x18}, 0x1, 0x0, 0x0, 0x45}, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0x20, 0xe, &(0x7f0000001100)=ANY=[@ANYBLOB="b7020000c54a4530bfa30000000000000703000000feffff7a0af0fff8ffff1971a4f0ff00000000b706000008ffffffcf6400000000000045040400010000001704000001000a00b7040000000100006a0af2fe0000004f850000001a000000b7000000000000009500000000000000455781a5feee5e1ce784909b849d5550adf200000000000000b61d69f2ffdaa10350e11cb97c8ad51bcda0c4ee6d9674c77404ceb9971e43405d62de53a1a53608c10556e5734eb84049761451ce2e2d9f8004e26f7fcc059c06220002595f6dba87b81d1106fb026cce67a66afd9ac3d09e29a9d542ca9d85a5c9c88474895c679838def0a83a733dc6a39b63a5ed69d32394c53361d7480884bd6fee53f5b2e7b91c61ced1ebad000000000000e8122a793c080a882add4e1179bd4a44f2fcb6d753a78845d8363e0401861abebe428ba953df4aece69311687f4122073a236c3ad198e3f3a532efa04137d452ff47d2638da3261c8362bb7c7824be6195a66d2e17e122040e11e3bd4a69fc6e8d9f7043e09b9e10dc7777bfae5884e4ba1e9cc4a2bbe99e30810400000000000000d63d716c0975e1ce4a655362e7062ff6ab3934555c01840219829472adefa06d3482c7b2711b98eabdca89b77efd13e6dba4a431ce47911834118093b6cabaa17a57727474e1785ee234835088445aa4a9b677d3d342640e328504aea02a2dff0f000000000000bf8fe1d704765de7482040b2fc3000000000000000008947baeaaf954aff687deaa2f804924600273ee26d8115cbca081a14cba24788779291745083fccdddc90d7af35c048d46362ea0d8d79c79ddca066da478c197d4a550470557bc99cca336bd88cd28a5ee651627e3a6fbf6ea53b95ddb64c69c7d8d2f4baddc239828760459564124bad68209d2a1d16ad085886c017679cfcda8b10700ac1e2bcc5ede5b5687aa418abfa29acd7339e73b2cd185c9eb5fb34fccd20ffa155b16c0c309ed6f6663677df37de0ec0d0f548b273940be5d1fe0bae14d1a76bf741330dacd9cc19c0163bcc93059e8d2d120ea257bba458ecd989cb3581a3f270ad48255ac0dad4923e3e357e4e90583ce8d43ec65ed491d87a51d7c13f665dcf772e3ead71112008b16b0ea821f70aee1ccbd71c5a1c21e87d5b7b73d356337dbcf3456ff6cd0d6b98a258e3509a7d15b9dcae4d0d750ffa07909c955e718585b2456308beda2fa03bb9bcf03cdff31ee4b1665b987829c0f0872c006c6e4ed666fe23b343aae943923eedbdb0e7abee90e3da7b98b7d07d2d4816201ad1737798635b0a3ebd3aed120e4500c16e6c9dc729f2cb4ff5106419291d4222980b49ddb9527ce785822d8f4e2bc30a96767f500b9e26e3b12854da63083320d8bfe49d85e0842803dc59d6375bce2b8a93caf39c0ba767880b9bf9407e6a6c0f9a43d1ab51dabf9423b482e848fbe1653ff0c6161fa43543546ce17a42e6cddadaf0767d84407478ffe2d0b567d81201efc81e800d4c0874235ff5cd7f5f0ee71cc2b0193bfc9290627ceaeb0b02931a817688f3a51fa2861e70cbab50a5d434ed8d8841694dba46f3d5a95ae86e4d471684ccf427b2ba53a157b2a7cf7a4c10051bb77822190a14c2ab1f271a7cf9c240b99"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @netfilter, 0xffffffffffffffff, 0x8, &(0x7f0000000000)={0x0, 0x4}, 0x8, 0x10, &(0x7f0000000340)={0x0, 0x0, 0x0, 0xfffffffe}, 0x10}, 0x94) socket$inet6_icmp_raw(0xa, 0x3, 0x3a) (async) socket$inet6_icmp_raw(0xa, 0x3, 0x3a) epoll_create1(0x0) bpf$ITER_CREATE(0xb, &(0x7f0000000380), 0x8) (async) r11 = bpf$ITER_CREATE(0xb, &(0x7f0000000380), 0x8) unshare(0x2c020400) (async) unshare(0x2c020400) close(r11) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup/syz1\x00', 0x1ff) (async) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup/syz1\x00', 0x1ff) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) (async) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) bpf$BPF_PROG_DETACH(0x8, &(0x7f0000000280)=ANY=[], 0x10) r12 = socket(0x10, 0x3, 0x0) setsockopt$netlink_NETLINK_TX_RING(r12, 0x10e, 0xc, &(0x7f0000000040)={0x802}, 0x10) 4.518179002s ago: executing program 2 (id=2166): r0 = bpf$MAP_CREATE(0x0, &(0x7f00000001c0)=@base={0x1, 0x29, 0x8, 0x1, 0x40, 0xffffffffffffffff, 0x1}, 0x50) bpf$MAP_LOOKUP_ELEM(0x1, &(0x7f0000000180)={r0, &(0x7f00000016c0), 0x0}, 0x20) r1 = socket$inet6_sctp(0xa, 0x5, 0x84) r2 = socket$inet_sctp(0x2, 0x5, 0x84) r3 = socket$inet_sctp(0x2, 0x1, 0x84) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r4, &(0x7f00000002c0)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000400)=ANY=[@ANYBLOB="60000000020603000000000000000000000000060900020073797a3000000000050004000100000014000780080013005607497408001200000000030500010007000000050005000a00000011000300686173683a69702c706f727400"], 0x60}, 0x1, 0x0, 0x0, 0x4000}, 0x4000) getsockopt$inet_sctp_SCTP_MAX_BURST(r3, 0x84, 0xc, &(0x7f00000000c0)=@assoc_value={0x0}, &(0x7f0000000000)=0x8) getsockopt$inet_sctp_SCTP_PR_SUPPORTED(r2, 0x84, 0x71, &(0x7f0000000280)={r5, 0x80000000}, &(0x7f0000000300)=0x8) getsockopt$inet_sctp6_SCTP_MAXSEG(r1, 0x84, 0xd, &(0x7f0000000140)=@assoc_id=r5, &(0x7f00000001c0)=0x4) r6 = socket$inet(0x2, 0x2, 0x1) sendmsg$inet(r6, &(0x7f0000000100)={&(0x7f0000000000)={0x2, 0x4e1e, @loopback}, 0x48, &(0x7f0000000640)=[{&(0x7f0000000040)="08f66b243400000000000500"/21, 0x2}, {&(0x7f0000000180)="96bc1480bb35", 0x6}], 0x2, &(0x7f0000000080)=ANY=[@ANYBLOB="10000000000000000000000007f900004400d863ffffffff00000008ac1414aa000000047f0000010000008000000000000000f90a010100000000007f00000100000006ac1414aa000000f100000000"], 0x10}, 0x80) r7 = socket$kcm(0x21, 0x2, 0xa) sendmsg$kcm(r7, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, &(0x7f00000003c0)=ANY=[@ANYBLOB="1800000000000000100100000b00"], 0x40}, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000240)={0x10, 0x10, &(0x7f0000000080)=ANY=[@ANYBLOB="180000007f000000000000000a00000018010000", @ANYRES32, @ANYBLOB="0000000000000000b702000014000000b70300000000000085000000a0000000b7090000000000005509010000000000950000000000000085000000b1000000bfb1000000000000b7020000000000008500"/104], &(0x7f0000000480)='GPL\x00', 0x3, 0x0, 0x0, 0x0, 0x6f, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0xffffffffffffffe9, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x400}, 0x94) 4.424335431s ago: executing program 0 (id=2167): unshare(0x22020400) r0 = socket$inet_tcp(0x2, 0x1, 0x0) r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1) setsockopt$IPT_SO_SET_REPLACE(r1, 0x4000000000000, 0x40, &(0x7f0000002300)=@raw={'raw\x00', 0xc01, 0x3, 0x248, 0x0, 0x5002004a, 0x0, 0x0, 0x0, 0x1b0, 0x3c8, 0x3c8, 0x1b0, 0x3c8, 0x3, 0x0, {[{{@uncond, 0x60, 0x98, 0xb8, 0x0, {}, [@inet=@rpfilter={{0x28}, {0x2}}]}, @unspec=@NOTRACK={0x20}}, {{@ip={@private=0xa010101, @dev={0xac, 0x14, 0x14, 0x13}, 0xffffffff, 0xffffff00, 'vxcan1\x00', 'veth0_to_team\x00', {}, {}, 0x0, 0x1, 0x1}, 0x0, 0x98, 0xf8, 0x0, {}, [@inet=@rpfilter={{0x28}, {0xc}}]}, @common=@inet=@HMARK={0x60, 'HMARK\x00', 0x0, {@ipv4=@loopback, [0xffffff00, 0xff000000, 0xff, 0xff000000], 0x4e22, 0x4c20, 0x4e20, 0x4e23, 0x7fff, 0x0, 0x3b, 0x83, 0x101}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28, '\x00', 0x4}}}}, 0x2a8) ioctl$BTRFS_IOC_SET_RECEIVED_SUBVOL(r0, 0xc0c89425, &(0x7f0000000000)={"f512b5055ce9f3c08f45fa3b60f8a31b", 0x0, 0x0, {0x8, 0x4}, {0xa, 0x30000}, 0x2, [0x800, 0x7ff, 0xb, 0x6, 0x1, 0x8, 0x6, 0x101, 0x4469, 0x8, 0x8, 0xe, 0x3, 0x7, 0x3]}) ioctl$BTRFS_IOC_WAIT_SYNC(r0, 0x40089416, &(0x7f0000000100)=r2) 4.327704425s ago: executing program 2 (id=2168): r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='memory.events\x00', 0x275a, 0x0) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000200), r2) sendmsg$ETHTOOL_MSG_RINGS_SET(r2, &(0x7f0000000680)={0x0, 0x0, &(0x7f0000000640)={&(0x7f0000000000)={0x34, r3, 0x1, 0x0, 0x25dfdbfc, {}, [@ETHTOOL_A_RINGS_RX={0x8}, @ETHTOOL_A_RINGS_HEADER={0x18, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'wlan1\x00'}]}]}, 0x34}}, 0x0) r4 = syz_genetlink_get_family_id$nl80211(&(0x7f00000000c0), 0xffffffffffffffff) sendmsg$NL80211_CMD_SET_REG(r1, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000100)={0x30, r4, 0x1, 0x0, 0x0, {}, [@NL80211_ATTR_REG_RULES={0x1c, 0x10d, 0x0, 0x1, [{0x4}, {0x14, 0x0, 0x0, 0x1, [@NL80211_ATTR_DFS_CAC_TIME={0x8, 0x7, 0x9}, @NL80211_ATTR_DFS_CAC_TIME={0x8, 0x7, 0xce7}]}]}]}, 0x30}, 0x1, 0x0, 0x0, 0x40000}, 0x10) bpf$PROG_LOAD_XDP(0x5, &(0x7f00000006c0)={0x6, 0x3, &(0x7f0000000680)=ANY=[@ANYBLOB="1800000002000000000000000000000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x55}, 0x94) write$cgroup_subtree(0xffffffffffffffff, &(0x7f0000000000)=ANY=[@ANYBLOB="8fedcb010789005e107538e486dd6317ce22000000fffe80000000000000101000007f0600080000000000000071273fa7b49301641184a907"], 0xfdef) r5 = bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000480)={0x6, 0x3, &(0x7f0000000680)=ANY=[], &(0x7f0000000200)='syzkaller\x00'}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000600)={r5, 0x5, 0xb68, 0x0, &(0x7f0000000000)='%', 0x0, 0xd01, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x1100}, 0x48) r6 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r6, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000200)=@ipv4_newrule={0x24, 0x20, 0x301, 0x70bd27, 0x25dfdbff, {0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1e}, [@FRA_GENERIC_POLICY=@FRA_SPORT_RANGE={0x8, 0x17, {0x4e20, 0x4e20}}]}, 0x24}, 0x1, 0x0, 0x0, 0x240480d4}, 0x0) sendmsg$nl_route(r6, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000200)=ANY=[@ANYBLOB='(\x00\x00\x00'], 0x28}}, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000001140)={&(0x7f0000000040)=ANY=[@ANYBLOB="6800000010000305"], 0x68}}, 0x0) write$cgroup_subtree(r0, &(0x7f0000000000)=ANY=[], 0x32600) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x2000001, 0x12, r0, 0x0) syz_emit_ethernet(0x6e, &(0x7f0000000380)=ANY=[@ANYBLOB="aaaaaaaaaaaabbbbbbbbbbbb86dd6000000000382b00fc220000000000000000000000000000fe8000000000000000000000000000aa6700000000000000210074b941"], 0x0) setsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX_OLD(r0, 0x84, 0x6b, &(0x7f0000000440)=[@in6={0xa, 0x4e24, 0x101, @mcast2}], 0x1c) r7 = socket$inet_smc(0x2b, 0x1, 0x0) setsockopt$ARPT_SO_SET_REPLACE(r7, 0x0, 0x60, &(0x7f0000000000)={'filter\x00', 0x7, 0x4, 0x3e0, 0x110, 0x110, 0x210, 0x2f8, 0x2f8, 0x2f8, 0x4, 0x0, {[{{@uncond, 0xc0, 0x110}, @mangle={0x50, 'mangle\x00', 0x0, {@mac, @mac=@remote, @loopback, @local, 0x1, 0x1}}}, {{@uncond, 0xc0, 0x100}, @unspec=@ERROR={0x40, 'ERROR\x00', 0x0, "716ebd2e1aa0cc683e62f312359594df00da56317f76121697127951fdba"}}, {{@uncond, 0xc0, 0xe8}, @unspec=@NFQUEUE0={0x28}}], {{'\x00', 0xc0, 0xe8}, {0x28}}}}, 0x430) 4.22236505s ago: executing program 4 (id=2169): r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) ioctl$FIONCLEX(r1, 0x5450) setsockopt$netlink_NETLINK_LISTEN_ALL_NSID(r1, 0x10e, 0x8, &(0x7f0000000000)=0x2, 0x4) bind$netlink(r1, &(0x7f0000514ff4)={0x10, 0x0, 0x0, 0x2ffffffff}, 0xc) r2 = socket(0x10, 0x3, 0x0) openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) r3 = socket$netlink(0x10, 0x3, 0x0) r4 = socket$key(0xf, 0x3, 0x2) ioctl$INCFS_IOC_CREATE_FILE(r4, 0xc058671e, &(0x7f0000000640)={{'\x00', 0x3}, {0xc2af}, 0x100, 0x0, 0x0, 0x0, 0x0, &(0x7f00000003c0), 0x0, 0x0, &(0x7f00000004c0)={0x2, 0x48, {0x1, 0xc, 0x32, "fd072a2074d4188a939762ad877a53724beabca94ea078376d7336bbe19d5e1601b3d0661e22e8de7a2bdb18c507c231cb1a", 0x9, "122f4f9c57d083fdd3"}, 0xe9, "bee459a3c2d6f7d8d07dd3dfab48ac202fc23ac068067609687eb3df02e9e6b1591f876c0270a3dc58390da814349c06d4ef1cbb19ff0ed178c89967e3438bb1ba6f6d337acf9f4380f01cdf212dd4241fd27cf9da510017ab6c97397be631be3445947af5d8cb339b47bb3d036664aa20096cbff5fda8040413606942e0855eeaed7433ca7dc3b366422f5194e189bc7d93550edd2c486612e246fcac863c8a80e30f47652e4f5e0b025791790cd0c088de13b01bb7f5dba962aeb739bb4140ca132c8b46c1feec6583712b107d803310f852657072d3513469b0e2884d7d6ac364f078127baf8272"}, 0x13d}) sendmsg$key(r2, &(0x7f0000001600)={0x0, 0x0, &(0x7f00000015c0)={0x0, 0x3d}}, 0x240048c1) r5 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r6 = syz_genetlink_get_family_id$netlbl_unlabel(&(0x7f0000000080), r5) sendmsg$NLBL_UNLABEL_C_STATICADDDEF(r5, &(0x7f00000002c0)={0x0, 0x300, &(0x7f0000000000)={&(0x7f0000000200)=ANY=[@ANYBLOB='D\x00\x00\x00', @ANYRES16=r6, @ANYBLOB="410000000000000001000603000014000300060a0004090300f006e8ffffffffffff070007003a3a0909140002"], 0x44}, 0x1, 0x1000000}, 0x200000000000000) sendmsg$nl_route_sched(r3, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000340)=@newqdisc={0x5c, 0x10, 0x1, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, {0x9, 0x1}, {0x4}, {0xe, 0xd}}, [@TCA_EGRESS_BLOCK={0x8, 0xe, 0x401}, @TCA_STAB={0x28, 0x8, 0x0, 0x1, [{{0x1c, 0x1a, {0x0, 0x0, 0x491, 0x0, 0x0, 0x0, 0x8, 0x2}}, {0x8, 0x1b, [0x0, 0x0]}}]}, @TCA_INGRESS_BLOCK={0x8}]}, 0x5c}, 0x1, 0x0, 0x0, 0x90}, 0x4000c00) socket$nl_netfilter(0x10, 0x3, 0xc) sendto(r3, &(0x7f0000000200)="366a4ef67653b541f0b7af26fbbb77a18c939f7fe98293cbb9ea18d9e0a7a3c12902c174eac3e0d2d84a5186d5f5126227b3bd45d3a244cb25fd5fdc589654e2eab2b46d8d28d6ae08ca90ba20a383707583736267ebaa2cd0c772ab07ea81c055f30adf0e9b0fd346ae5ffe54d568652a169a04bbcf2569cd0d775cdb0a36390437c5ffafe9c41143696ca124c9102903479f7f9d39e64874451dec8a2602aaf24b9e1c54d39efae424047bc6d009af6cba60b9707e6ac2de396f632e314881b227767d8b0ad55e16a3c1bb6c6548f88a15e8f44399b00bc4b01c0491bf", 0xde, 0x4, &(0x7f00000006c0)=@pppol2tpv3={0x18, 0x1, {0x0, r0, {0x2, 0x4e20, @multicast1}, 0x0, 0x1, 0x3}}, 0x80) r7 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r7, &(0x7f0000000740)={0x0, 0x0, &(0x7f0000000080)=[{&(0x7f00000000c0)=ANY=[@ANYBLOB="3c0000001000010000000000000000002c00000020000000ff0f00000000000008001c00c9"], 0x3c}], 0x1, 0x0, 0x0, 0xb305e06d8ab48273}, 0x48800) setsockopt$inet_tcp_int(r2, 0x6, 0x1, &(0x7f0000000040)=0x1, 0x4) ioctl$ifreq_SIOCGIFINDEX_team(r0, 0x8933, &(0x7f00000000c0)={'team0\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000580)={&(0x7f00000001c0)=ANY=[@ANYBLOB="85e79a00", @ANYBLOB="00030000000000002c0012800b00010062726964676500001c00028008000500010000000500250001000000050029000000000008000a00", @ANYRES32=r8], 0x54}, 0x1, 0x0, 0x0, 0x4080}, 0x8044) r9 = socket$nl_generic(0x10, 0x3, 0x10) r10 = syz_genetlink_get_family_id$gtp(&(0x7f00000006c0), r9) bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="06000000040000009c0000000b"], 0x50) r11 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[], 0x48) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000280)={{r11}, &(0x7f00000002c0), &(0x7f0000000240), 0xb00}, 0x20) sendmsg$GTP_CMD_ECHOREQ(r9, &(0x7f0000000780)={0x0, 0x0, &(0x7f0000000740)={&(0x7f00000007c0)=ANY=[@ANYBLOB="1c00000001fe5e24016e9746898f35e75451444ced175e0b5971d8ed4e992920780ca529429ef119c8c706bdb7cd95ee8d677e27b31c1740abf8405edcc402143a11c585baf1598c5cdeed3e6c0f4462292b08a5f46d46146cc04a060039658166a2044200"/113, @ANYRES16=r10, @ANYBLOB="01002abd7000ffdbdf25030000000800020000000000"], 0x1c}, 0x1, 0x0, 0x0, 0x4800}, 0x8010) socket(0x26, 0x80000, 0xfffffff7) 4.187378741s ago: executing program 3 (id=2170): r0 = socket$unix(0x1, 0x1, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000100)={'veth1_to_team\x00', 0x0}) sendmsg$nl_route_sched(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000003c0)=@newqdisc={0x5c, 0x24, 0x4ee4e6a52ff56541, 0x0, 0x0, {0x0, 0x0, 0x0, r2, {0x0, 0xb}, {0xffff, 0xffff}, {0xfff2, 0xa}}, [@TCA_STAB={0x28, 0x8, 0x0, 0x1, [{{0x1c, 0x1, {0x0, 0x7c, 0x40, 0x0, 0x0, 0xc, 0x80000000, 0x1}}, {0x6, 0x2, [0x80]}}]}, @qdisc_kind_options=@q_codel={{0xa}, {0x4}}]}, 0x5c}, 0x1, 0x0, 0x0, 0x20000001}, 0x0) r3 = socket$inet_smc(0x2b, 0x1, 0x0) r4 = accept4$inet6(0xffffffffffffffff, &(0x7f0000000140)={0xa, 0x0, 0x0, @local}, &(0x7f0000000200)=0x1c, 0x80000) getsockopt$inet_sctp6_SCTP_GET_ASSOC_NUMBER(r4, 0x84, 0x1c, &(0x7f0000000280), &(0x7f00000002c0)=0x4) r5 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r5, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010600000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff1b000000020000000900010073797a30000001000900030073797a320000000014000000110001"], 0x7c}}, 0x0) sendmsg$NFT_BATCH(r5, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000680)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a3c000000120a01020000000000000000020000000900020073797a310000000008000440000000000900010073797a3000000000080003400000000a14000000110001"], 0x64}}, 0x0) sendmsg$NFT_BATCH(r5, &(0x7f0000000d80)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000d00)=ANY=[@ANYBLOB="140000001000010000000000000000000220000a3c000000120a09080000000000000000020000000900020073797a310000000008000440000000000900010073797a3000000000080003400000000a"], 0x64}, 0x1, 0x0, 0x0, 0x5}, 0x0) setsockopt$inet_tcp_TCP_REPAIR(r3, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_QUEUE(r3, 0x6, 0x14, &(0x7f0000000540)=0x2, 0x4) connect$inet(r3, &(0x7f0000000040)={0x2, 0x4e23, @remote}, 0x10) r6 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r6, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000540)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a03000000000000000000030000000900010073797a300000000040000000030a03000000020000000000030000000900030073797a30000000000900010073797a300000000014000480080002406375fd82080001400000000028000000000a01040000000000000000030000000900010073797a3000000000080002400000000114000000110001"], 0xb0}}, 0x0) setsockopt$IP_VS_SO_SET_DELDEST(r3, 0x0, 0x488, &(0x7f0000000180)={{0x2b, @remote, 0x4e21, 0x2, 'nq\x00', 0x0, 0x100004d2, 0x30}, {@multicast2, 0x4e22, 0x2, 0x4, 0xd3, 0x6}}, 0x44) socket$nl_route(0x10, 0x3, 0x0) sendmmsg$inet(r3, &(0x7f0000006740)=[{{0x0, 0x0, &(0x7f0000002740)=[{0x0}, {&(0x7f0000000100)}, {0x0}, {&(0x7f0000000080)="09ebb34c6e6b9bcb890e8fc488c52697590da70578e206547182de9cd141c0012e4926791de3eea4aa103ad545198bf93c390bbdb6f1faf1c0924adb7ebc658f62f9f47ed5f8d851dea2d62af8d6aa9af055c1975558eef4", 0x58}, {&(0x7f0000001580)="5cf0b67aa16bf1dcc2f1ae5aa14e42cb6db77c270b99b1c640ab27453b4a089d9ad367f0f0dd7ab38ddbaeb047ef74d0a1f9aa080b894ea2f067824e2331f63e32eca6dd1196239a33e3ff58a8c40a9c120cca1666ab88492ec25f2ee144dc6b0d2e21651eea22bd79d45e406676df1e1ae9f937ff483c77a3c16a52c736c022b2829500081c0d6159780f114f713eb8364ba6d5b6c9f64f43326bc2219741e92de26f4342bcc6d691ff5f36c990af86750adc5b945e27ee8d6b65cd12841c9b110bad0f2c9a2d2e73410f0cb58d43c433459b820ed4314723626946aa6697e045c1edce001ffe549ae2a44b4377da7d4f3d2857e45c3f25ea44797577256b587f7420a30745a6e373c058200d42edc02b42d028e4cab8d6fe09d677ccd453784f3deb8724be00842dc857e2efe2a752a32b3dcd252d6ccb6ede45cfab2830c0b5947a4b9c9f68705d9e669d8f1e6d60a32812825252a46beadd87ecc1344c9924cffb26c2effcf25244b1f7b717b0e4b3f30b8c136b2385aeb52364d199e97c455117c390d3d3f0524bb4159b15a1803be4d289ee4524a36d70a47f56b1dcb865c40452f9851860601d929a4237c3ff9522ce238fb12761a11b0eeffa5156d5f8f8e8782dd61e291cd691dfebf673c04622ab3d0f41386eaa02f05a9d4f0b83c796ba1a3115ce0132030cd11f4cc797a20e5388ca45936c27282f7c28ae8312654c9f34b28f1c59894449dcc1c993929cff02280f7688100ac4ccba6e534cd44e6cefa6cf2c64fa66f8e3d59b0b851fbbdbbe81d57c44a5eee6a7d96ca176ad33240a703cff52de4fd70ea2d4330f4efc17c55aa688ed5daa1646e50ffc07c95059a2b3ee442f665c9838293b0400b951a1f706bf73b63d9d7a8aed42c0b54bb81be4fc698e1eb0605d656a5446698b76ef5a224cde75c457d49ad7479153d36ce1c2e32011e058866cc94d44604eefc42fdb6bfd82cf4722bf4c73df1ea2d02eb787ec0eb26ea13532a77465da7070bff12fe8c1694ec2eb87285915ab182543db23b45a1ca291e7b9133fccdc0742ce6e6b71e3286412339dc52d696136f47912519545911c246c875ff80dd734f81c41a73493da7da9c4ee125c60dd65a49d490e2fc33ca5fc511ad18148b1177f19eaeffe7a0174875dd03e8e3b32ebcae0a8aabea0d4d1de879332ea50471fc6eb5b7cefcc7b243c22c84d85c73f8c8fc31cbbcd9f4c6b601e02375428fdbd320c2182877da71a2d70330f05fd8e7c50f73c291bc4bff8e306f55c79cfea125876f6e9092ad5598d8fa62d119385061f1ff13bf7c2b44fd363be7229f6b4f2f6fb7f641535c47cca350e598b8290fa73bfc0559e5bfa74228bd4b7048b8f0356c43a439b5731381d575997780e4f57b5c2d6b5bfbb955aa10e9f9cc46eb62b530a156511fa7e0c001f24396af1a9946d07d3c065f7fb88c430c63807652c60cb174735e1466df3bd407a765a4a63ad2cf004bad50ab2049a7f56cdfd53d39eabc749871e70fbab4ffe42756ed05335df15d40420134902a68b69a15dda03c98ed9333174043441f807b70f5a98d35984128a902e7ee8d5ae806ca40e4f5ad2288ec645ca43275c7625eabda5a774d10c9efcc852b4e2a181255308ab1082ad382bb5bdff980865e7caadcec81b4697457d816625097cb4a9659d480145a3d40237e54be17faf12fae9a9a48226fd7e43509e325359642bd8626e37958f83494b15b6c615121238129c15c1fac440dabc71a836ac2976e1987abdc3ecbe78dacda51cf9019e3159b276a877e355c18a9835cdf98522dad7467dcbd97dca4098599ce33ebee7c742ab847d39172608fd8f829e344393b50f29f0e7efdc35bad46c1e20ed7c3f5874f021a8afe3a96cf9e186eafee13b138d92091282414ad896034d8146e849785b364450970abe11f743a12ac977062059ad7f67b01d32cdcc75c6babe2309fc929a9d92c805ecb4ff70719df50807e824ae90f66b0557bff4ebf78dfa43532869ff5164e144defc4d8ee1d6745ed369e7ed7afc981f0f3a0c82a1f97032a12eb8d672b2231040d132971ff2b2ea2eeb0f30fc21fdcd80e32f8a64d325b0fa74919c0b727335230cd340883ed28bd50af63e07f98f91e5d69851b25ab260828303713fa7ce5671c598fabee013bbb6ed04bc70e8d16d9748b885179ae22e4a9ea40d55d6565b0dc5b35719f28199b95ce9ce7f3c81c5a62a5ec1c9c63a8c74cbd26682875ffd2b8c709643d4dfa81199f9828fbe6c1e99d5c003f7ebfbf860fb238f1e427c74eadf459ed60ee73de4d13c8cfc7c58fc371fdd0e8bd70b10e4f9de9928f5c1fa81dffabc7a818fc8d50d9611f06b901bd88a5fc6b9f8bc6503b23822f105653b598c9f0abffbae0d8c56cff568f2c2bc47a88b26c2124a78921462efa4895730f369bf1f0d3227ef1b76dd394317c1726a13f9c15d65bcf6128b61351abac6a54151efcd872d25d9929cf5b7ef141e84b8d145fff6453d6a943af1c0ebd6c2aad77c1cadd21880bcdc362c690e88a914f946c8cfe00ac1936ac8e7ee66156bf76a158b09244aee3c937677067b8d6ce6de5711c80ee00893acf16e86e44037450581e6d06aff72630356644d2345741e76065a15b23cd57ed96a4b702b07a1c2df236ef5d1f0711ed23742a05bf7c047b48338e28115cdce04277cc10936937f0434ae60adbf1a9fc6f422ce8017d1f7b5554c19dc67fdce214afdb8b9a04e3987d16ce5b0b8d9f779914441357347af13f08fec8b05e4f786e88d1346fffd81cd3feb2c518c8a5199ebc2e15754a789febfde86dacb5530ebad117acc0b1cad2669836b5e536dc3df3739f22b85bf1d64353ce65b81707902fc9b471bd159fc80065f26d56aa310d47c276bbd83f5d2e5e4ffbe0e424b21eb940d9e1b3198eae52cdde8c193f4f07e7af9e40f64e2ebdb9aa0f0dc49fae9b024128379eec28ff2b2989907e16bdd9ea22f767f73d21c1c9ed2992b1c5ff5e606c7a3f5f29ce6e30e0118f5c6f88c6bdd27bc58fc74390a97a98590b31fbcbd76449777b253ce0c68da51d402ae862beef5fbfd8afb3aaa62f57826e74c8f6b985aa456e015fd8325eb8fedbc0f0e681bcd8d7626bee70e48d563d1acb03af39d206384b1e8328e588e66fb7243c8c9c2748a8f9efb34a0ab4e76035d9c6e4a7784ead7194f2868f97c580769942b3e81bf02e55c27f43885303d641ab9717618592bf790c119a9033ffce20a8ffcd0d1f1043add8da1a40b2d223920e33625366ccbf515b4e83ba5030df036316798c8cd50b5dca303fddfed3b4d7e89077be0af139ed509243dca68271d02238c85a6dc019897727b6137b18fdf444cff1790631b4c411daa9939b4a4b1abd93b2b1370d62c9e07962cacdde123b75a625553cc8dd2c4f4df4f96a1cdd07fefb232347dbf24e39831251d30e931dc965b789975d93c35d001bb90335f77984b4fe6cfe67eeacbfe8b03dd3b9eccc33ae979b38bf89417e89e0b7c3da65443cb8371353e7b5a44f99db5c73a0f7bc84147ef45847dc0231e00684f0bfb361efc62636c460501a910047db41258c00538b6763b3a79a23395afc6a46be1f53d123202bb598f9e3f40d50939f0cb01c70215e55de53703375e5be090387eaec3717d22e718c31f9d9eb2a81a2bddd846671d14aa42995cd18aca6c804b4b8eba42693eb4d2db995ef26e5a7ab1c4a98d7c268821edf7d2f193f381c15e87fa8355207c3efb209e4214038e99f7c3e7fdcdc4d038b18b08c488edc20a949f7417a7d8dd4e37dbf1b4afcf79ef867d17ca68a0d744b8f6aee7738be4beb737ca9dba34fda810f44c0f51ec9f8e295e7cd78e3256ae73db7186b1e29a04f63065c44fa6c7a16fe4f50851f336b402ce5a73ff88f9b5cdb52ead12060590180f112a4f6c36e5418207bc5dc8635ec831e383ae67fbbe119de517a6932a69440015d014a1d143c8b09f611aa4f79b083c8ea67806cf221ede408771cf2d979feb3e448fcbd859e875d6ff6cff062e073bdb4b32bcf5", 0xb35}], 0x5}}, {{0x0, 0x0, 0x0}}], 0x3fffffffffffe97, 0x2404c845) r7 = bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={&(0x7f0000000100)=ANY=[@ANYBLOB="9feb01001800000000000000280000002800000004000000020000000000001103000000ffffffff00000000000000020000000002000000000000080200000000005f00"], 0x0, 0x44}, 0x20) bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f00000009c0)={0x14, 0x4, 0x8, 0x1, 0x80, 0x1, 0x0, '\x00', 0x0, r7, 0x0, 0x1}, 0x48) r8 = socket$nl_route(0x10, 0x3, 0x0) r9 = bpf$PROG_LOAD_XDP(0x5, &(0x7f00000003c0)={0x6, 0x3, &(0x7f0000000240)=ANY=[@ANYBLOB="1800000000000000000000000002000095"], &(0x7f00000001c0)='syzkaller\x00', 0x8}, 0x94) ioctl$sock_SIOCGIFINDEX(r8, 0x8933, &(0x7f0000000080)={'veth1_to_hsr\x00', 0x0}) r11 = bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f0000000340)={r9, r10, 0x25, 0x1d, @void}, 0x1a) sendmsg$nl_route_sched(r8, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000004c00)=@newtfilter={0x24, 0x11, 0xd27, 0xffffffff, 0x0, {0x0, 0x0, 0x74, r10, {0x0, 0x7}, {0x0, 0x4}}}, 0x24}, 0x1, 0xf0ffffffffffff}, 0x0) bpf$BPF_GET_BTF_INFO(0xf, &(0x7f0000000880)={r11, 0x0, 0x0}, 0x10) socket$netlink(0x10, 0x3, 0x0) r12 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_int(r12, 0x29, 0x4b, &(0x7f0000000100)=0x5, 0x4) 3.880351932s ago: executing program 0 (id=2171): r0 = socket(0x2, 0x80805, 0x0) socket$inet6(0x10, 0x3, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000080)=ANY=[@ANYBLOB="280000001c00010429bd7000ffdbdf2507000000", @ANYRES32=r1, @ANYBLOB="e0ff8b0a0a0002"], 0x28}, 0x1, 0x0, 0x0, 0x1}, 0x24040040) sendmsg$nl_route(r1, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000080)=ANY=[@ANYBLOB="300000001d"], 0x30}, 0x1, 0x0, 0x0, 0x1}, 0xc31fe084736598c) syz_init_net_socket$bt_rfcomm(0x1f, 0x1, 0x3) r2 = socket$inet(0x2, 0x2, 0x0) setsockopt$IPT_SO_SET_REPLACE(r2, 0x4000000000000, 0x40, &(0x7f0000000000)=@raw={'raw\x00', 0x8, 0x3, 0x208, 0x98, 0x8, 0xfa04, 0x0, 0x6c02, 0x170, 0x194, 0x194, 0x170, 0x194, 0x3, 0x0, {[{{@ip={@multicast1, @rand_addr=0x64010100, 0x0, 0x0, 'team_slave_1\x00', 'veth1\x00', {}, {}, 0x6}, 0x0, 0x70, 0x98, 0x0, {0x0, 0x74020000}}, @common=@inet=@TCPMSS={0x28, 'TCPMSS\x00', 0x0, {0x3}}}, {{@ip={@multicast2, @dev, 0x0, 0x0, '\x00', 'vlan0\x00', {}, {}, 0x0, 0x1, 0x52ffe4dd04836947}, 0x0, 0x70, 0xd8}, @unspec=@CT1={0x68, 'CT\x00', 0x1, {0x1b, 0x5, 0x1, 0x9, 'syz0\x00', 'syz1\x00', {0x1}}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x268) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r0, 0x84, 0x6f, &(0x7f0000000000)={0x0, 0x2c, &(0x7f00000013c0)=[@in={0x2, 0x4e1e, @private=0xa010102}, @in6={0xa, 0x4e21, 0x4, @private2}]}, &(0x7f0000000180)=0x10) getsockopt$bt_hci(r0, 0x84, 0x6d, &(0x7f0000000000)=""/4102, &(0x7f0000001040)=0x1006) 2.892378673s ago: executing program 1 (id=2172): mmap(&(0x7f0000001000/0xc00000)=nil, 0xc00000, 0x2000004, 0x3b071, 0xffffffffffffffff, 0x0) r0 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000000)='net_prio.prioidx\x00', 0x0, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000080)={'bond0\x00', 0x0}) sendmsg$nl_route(r1, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000300)=ANY=[@ANYBLOB="a87195cee4", @ANYRES32=0x0, @ANYBLOB="20ba0100180a04007800128009000100766c616e0000000068000280060001000400000004000480580003802efe010007000000030000000c00010002000000008000000c00010001000000018000000c00010000000000f00500000c00010000020000010400000c0001000100000078998c5d0c000100010000000500000008000500", @ANYRES32=r2, @ANYBLOB="0500110001000000"], 0xa8}, 0x1, 0x0, 0x0, 0x10}, 0x8000002) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r3, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000280)={&(0x7f00000002c0)=ANY=[@ANYBLOB="140000001000010000000000000000000100000a20000000000a01040000000000000000010000000900010073797a30000000006c000000160a01040000000000000000010000000900010073797a30000000000900020073797a300000000040000380080001400000000008000240000000002c000380140001006c6f00000000000000000000000000001400010064756d6d79300000000000000000000054000000030a01040000000000000000010000000900010073797a30000000000900030073797a300000000014000480080001400000000208000240000000000b00070066696c746572000008000a400000000158000000060a01040000000000000000010000000900010073797a30000000000900020073797a30000000002c0004802800018011000100666c6f775f6f66666c6f616400000000100002800900010073", @ANYRES64], 0x1f0}, 0x1, 0x0, 0x0, 0x8040}, 0x0) getsockopt$inet6_mreq(r0, 0x29, 0x15, &(0x7f0000000040)={@remote, 0x0}, &(0x7f0000000080)=0x14) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000640)={0x1f, 0xb, &(0x7f0000000100)=ANY=[@ANYRES64=r4, @ANYRESOCT=r1], &(0x7f0000000180)='GPL\x00', 0x4, 0xde, &(0x7f0000003e40)=""/222, 0x41100, 0x70, '\x00', r4, 0x0, r0, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x208}, 0x94) 2.891306809s ago: executing program 2 (id=2173): r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000740)={0x0, 0x0, &(0x7f0000000600)={&(0x7f0000000240)=ANY=[@ANYBLOB="9400000010000104000000000b9bdd51eb5d4f91", @ANYRES32=0x0, @ANYBLOB="80420000440001005c00128009000100626f6e64000000004c00028005000100050000000800030007000000080004000a000000080009000300000005001d00090000000500150001000000050010008000000005001b00df000000080007000200000008003a00", @ANYRES32=0x0, @ANYBLOB='\b\x00O'], 0x94}}, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x680000, 0x0) write$tun(r1, &(0x7f0000000040)={@void, @val={0x1, 0x3, 0x7ff, 0x2, 0x7, 0x6}, @llc={@snap={0xa8, 0x0, "83", "c36a19", 0xd, "64d526d5e52a10ad91df2ab979a7753bf35f153030ef36847e8a40495d7a73b255fb32308c00cef832f36ec12ea6f7d3712c7e16fec7f7c6772bb0da2e36da299d166a75381bc41c19028efcb9bcb4b872dbb074ef8da12b7c0e250c5495200cca10f77772c030a2b3eaa0b46b90c7402d0182c1b4d6a523761498ece104df4c62a107c8c34395bf5a4520e8c576f3e206a5d16940ccd9c9e04d9939ac08ba42b12a3740ef52a7b58bbdc2e2f0a90f16c4aa48818f035c3e012b727a3ed286202dde0199a3bdaaba37cfad01a408813c37115a90b41ca917a9086b58834e087bc1958aadfb"}}}, 0xf7) socket$nl_route(0x10, 0x3, 0x0) (async) sendmsg$nl_route(r0, &(0x7f0000000740)={0x0, 0x0, &(0x7f0000000600)={&(0x7f0000000240)=ANY=[@ANYBLOB="9400000010000104000000000b9bdd51eb5d4f91", @ANYRES32=0x0, @ANYBLOB="80420000440001005c00128009000100626f6e64000000004c00028005000100050000000800030007000000080004000a000000080009000300000005001d00090000000500150001000000050010008000000005001b00df000000080007000200000008003a00", @ANYRES32=0x0, @ANYBLOB='\b\x00O'], 0x94}}, 0x0) (async) openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x680000, 0x0) (async) write$tun(r1, &(0x7f0000000040)={@void, @val={0x1, 0x3, 0x7ff, 0x2, 0x7, 0x6}, @llc={@snap={0xa8, 0x0, "83", "c36a19", 0xd, "64d526d5e52a10ad91df2ab979a7753bf35f153030ef36847e8a40495d7a73b255fb32308c00cef832f36ec12ea6f7d3712c7e16fec7f7c6772bb0da2e36da299d166a75381bc41c19028efcb9bcb4b872dbb074ef8da12b7c0e250c5495200cca10f77772c030a2b3eaa0b46b90c7402d0182c1b4d6a523761498ece104df4c62a107c8c34395bf5a4520e8c576f3e206a5d16940ccd9c9e04d9939ac08ba42b12a3740ef52a7b58bbdc2e2f0a90f16c4aa48818f035c3e012b727a3ed286202dde0199a3bdaaba37cfad01a408813c37115a90b41ca917a9086b58834e087bc1958aadfb"}}}, 0xf7) (async) 2.884611369s ago: executing program 0 (id=2174): r0 = socket(0x1e, 0x1, 0x0) listen(r0, 0x0) (async) setsockopt$sock_timeval(r0, 0x1, 0x14, &(0x7f0000454ff0)={0x0, 0x2710}, 0x10) r1 = socket(0x2b, 0x80801, 0x1) sendmsg$nl_route_sched(r1, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={0x0}}, 0x20000000) (async) setsockopt$sock_int(r1, 0x1, 0x20, &(0x7f0000000100)=0xffff8000, 0x4) (async) r2 = socket$kcm(0x29, 0x2, 0x0) close(r2) (async) r3 = socket$inet_tcp(0x2, 0x1, 0x0) (async) r4 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x48241, 0x0) ioctl$TUNSETIFF(r4, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x6bf1c2d5adba8c32}) r5 = socket$kcm(0x2, 0xa, 0x2) ioctl$SIOCSIFHWADDR(r5, 0x8914, &(0x7f0000000280)={'syzkaller1\x00', @link_local}) (async) write$tun(r4, &(0x7f0000000080)={@val={0x0, 0x6003}, @void, @eth={@broadcast, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x2}, @void, {@ipv4={0x800, @udp={{0x5, 0x4, 0x0, 0x0, 0x14, 0x4000, 0x0, 0x3, 0x2f, 0x0, @private=0x1fe1, @multicast1}, {0xa000, 0x8864, 0xc, 0x0, @gue={{0x1, 0x0, 0x1, 0x9, 0x0, @void}}}}}}}}, 0x32) (async) setsockopt$inet_MCAST_JOIN_GROUP(r3, 0x0, 0x2a, &(0x7f00000002c0)={0x4, {{0x2, 0x4e20, @multicast2}}}, 0x88) setsockopt$sock_attach_bpf(r2, 0x1, 0xd, &(0x7f00000000c0), 0xfe11) (async) r6 = socket(0x10, 0x3, 0x0) setsockopt$netlink_NETLINK_TX_RING(r6, 0x10e, 0xc, &(0x7f0000000440)={0x2, 0xfffffffc, 0x6}, 0x10) sendmsg$nl_generic(r6, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)={0x20, 0x12, 0xa01, 0x0, 0x0, {0x80}}, 0x26}}, 0x0) (async) close(r2) accept4$x25(r0, 0x0, 0x0, 0x0) (async) r7 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r7, 0x8933, &(0x7f0000000100)={'wlan0\x00', 0x0}) (async) r9 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$NL80211_CMD_SET_TX_BITRATE_MASK(r7, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000580)={0x30, r9, 0x21, 0x72bd25, 0x0, {{}, {@val={0x8, 0x3, r8}, @void}}, [@NL80211_ATTR_TX_RATES={0x14, 0x5a, 0x0, 0x1, [@NL80211_BAND_2GHZ={0x10, 0x0, 0x0, 0x1, [@NL80211_TXRATE_HT={0x5, 0x2, [{0x6, 0x1}]}, @NL80211_TXRATE_LEGACY={0x4}]}]}]}, 0x30}, 0x1, 0x0, 0x0, 0x24000000}, 0x0) (async) setsockopt$MRT6_TABLE(r0, 0x29, 0xcf, &(0x7f0000000000)=0xfc, 0x4) 2.579778842s ago: executing program 1 (id=2175): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_SWAP(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000001c0)=ANY=[@ANYBLOB="34000000060601080000000000000000010000050900020073797a3000000000050001"], 0x34}, 0x1, 0x0, 0x0, 0x140}, 0x0) ioctl$EXT4_IOC_CLEAR_ES_CACHE(r0, 0x6628) 2.19355486s ago: executing program 2 (id=2176): r0 = socket$l2tp(0x2, 0x2, 0x73) bind$inet(r0, &(0x7f0000000140)={0x2, 0x4e20, @empty}, 0x10) r1 = socket$inet(0x2, 0xa, 0xfffff7fd) setsockopt$sock_int(r1, 0x1, 0x2e, &(0x7f0000000180)=0x7b, 0x4) recvmmsg(r1, &(0x7f00000066c0), 0xa0d, 0x0, 0x0) r2 = socket$kcm(0x2, 0x922000000001, 0x106) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x0, 0x6c033, 0xffffffffffffffff, 0x0) setsockopt$sock_attach_bpf(r2, 0x1, 0x25, &(0x7f00000002c0), 0x8) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, &(0x7f00000003c0)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32, @ANYBLOB="0000000000000000b70800000d0000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095", @ANYRESOCT=r0], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r3 = bpf$MAP_CREATE(0x0, &(0x7f0000000740)=ANY=[@ANYBLOB="0b00000005000000000400000900000001"], 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0xa, 0x4, &(0x7f0000000480)=ANY=[@ANYBLOB="18000000000000000000000000000000850000006d"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r4 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000d80)={0x18, 0x5, &(0x7f0000000480)=ANY=[@ANYBLOB="1801000021"], 0x0, 0x40, 0x0, 0x0, 0x0, 0xb4a02fe0ce239f93, '\x00', 0x0, 0x2}, 0x94) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0xe, 0x0, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000800000000000000000000018110000", @ANYRES32=r3], 0x0, 0x0, 0x0, 0x0, 0x41100, 0x59, '\x00', 0x0, @fallback=0x2a, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, r4, 0x0, 0x0, 0x0, 0x0}, 0x94) r5 = bpf$PROG_LOAD(0x5, &(0x7f0000000300)={0x6, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback=0x4, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000180)={r5, 0x2000000, 0xe, 0x0, &(0x7f0000000040)="630b008646dc3f0adf33c9f7b986", 0x0, 0xcf25, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x80}, 0x50) connect$inet(r0, &(0x7f0000000200)={0x2, 0x0, @local}, 0x10) sendmmsg$inet(r0, &(0x7f0000000900)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0) r6 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r6, 0x8933, &(0x7f00000001c0)={'ip6gretap0\x00'}) openat$tun(0xffffffffffffff9c, &(0x7f00000001c0), 0x101801, 0x0) r7 = socket(0x1e, 0x1, 0x0) setsockopt$inet6_tcp_int(r7, 0x6, 0x9, 0x0, 0x0) r8 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000600)=[{&(0x7f0000000080)='H', 0x1}], 0x1}, 0x0) bind$bt_hci(r8, &(0x7f0000000000)={0x1f, 0xffffffffffffffff, 0x3}, 0x6) write$bt_hci(r8, &(0x7f0000000080)=ANY=[], 0x6) 2.191337664s ago: executing program 4 (id=2177): r0 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f0000000000)={0x1b, 0x0, 0x0, 0x4, 0x0, 0xffffffffffffffff, 0x7ff, '\x00', 0x0, 0xffffffffffffffff, 0x2, 0x4, 0x3}, 0x50) ioctl$XFS_IOC_FD_TO_HANDLE(0xffffffffffffffff, 0xc038586a, &(0x7f0000000240)={0xffffffffffffffff, &(0x7f0000000140)='&:-!\x00', 0x2f4240, &(0x7f0000000180)={@align=0x7, {0x5, 0x81, 0x0, 0x101}}, 0x31a, &(0x7f00000001c0)={@_ha_fsid}, &(0x7f0000000200)=0xbabe}) r2 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000480)={0x9, 0x17, &(0x7f0000000300)=@raw=[@snprintf={{}, {}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0x400}}, @generic={0x2, 0x0, 0x7, 0x100, 0x3ff}, @map_idx_val={0x18, 0x3, 0x6, 0x0, 0x5, 0x0, 0x0, 0x0, 0x81}, @tail_call, @map_idx_val={0x18, 0xa, 0x6, 0x0, 0x5, 0x0, 0x0, 0x0, 0x2b}], &(0x7f00000003c0)='syzkaller\x00', 0x7f, 0x0, 0x0, 0x1e00, 0x8, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x2, &(0x7f0000000400)=[0x1, 0xffffffffffffffff, 0x1, 0x1], &(0x7f0000000440)=[{0x0, 0x5, 0xb, 0xe}, {0x5, 0x5, 0x3}], 0x10, 0x8}, 0x94) r3 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f0000000540)={0x3, 0x4, 0x4, 0xa, 0x0, 0x1, 0x6, '\x00', 0x0, 0xffffffffffffffff, 0x3, 0x0, 0x5}, 0x50) bpf$PROG_LOAD(0x5, &(0x7f0000000680)={0x5, 0x10, &(0x7f0000000080)=@ringbuf={{0x18, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x9}, {{0x18, 0x1, 0x1, 0x0, r0}}, {}, [@generic={0x8, 0x8, 0xd, 0x5, 0xf}], {{}, {0x7, 0x0, 0xb, 0x2, 0x0, 0x0, 0x1}, {0x85, 0x0, 0x0, 0x85}}}, &(0x7f0000000100)='GPL\x00', 0x3, 0x0, 0x0, 0x0, 0x40, '\x00', 0x0, @fallback=0x5, r1, 0x8, &(0x7f0000000280)={0x9, 0x4}, 0x8, 0x10, &(0x7f00000002c0)={0x2, 0x0, 0x0, 0x80000000}, 0x10, 0xffffffffffffffff, r2, 0x5, &(0x7f00000005c0)=[r3], &(0x7f0000000600)=[{0x2, 0x1, 0x4, 0x2}, {0x4, 0x1, 0xc, 0x1}, {0x3, 0x2, 0xb, 0x6}, {0x2, 0x2, 0x0, 0x9}, {0x5, 0x3, 0x9, 0x7}], 0x10, 0x2}, 0x94) sendfile(r3, r1, &(0x7f0000000740)=0x8, 0x7) r4 = syz_init_net_socket$bt_l2cap(0x1f, 0x5, 0x0) ioctl$F2FS_IOC_MOVE_RANGE(r4, 0xc020f509, &(0x7f0000000880)={r3, 0x8, 0x6, 0x81}) r6 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f00000008c0)={0x3, 0x4, 0x4, 0xa, 0x0, r0, 0xd2, '\x00', 0x0, 0xffffffffffffffff, 0x3, 0x3, 0x2}, 0x50) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f00000009c0)=@bpf_ext={0x1c, 0x5, &(0x7f0000000780)=@raw=[@ringbuf_query={{0x18, 0x1, 0x1, 0x0, r3}}, @ldst={0x3, 0x3, 0x3, 0xa, 0xa, 0xffffffffffffffff, 0x10}], &(0x7f00000007c0)='GPL\x00', 0xd982, 0x0, 0x0, 0x41000, 0x64, '\x00', 0x0, 0x0, r1, 0x8, &(0x7f0000000800)={0x6, 0x2}, 0x8, 0x10, &(0x7f0000000840)={0x0, 0x4, 0x819, 0x3ee}, 0x10, 0x2ab88, r1, 0x4, &(0x7f0000000940)=[r3, r1, r3, r5, r3, r6], &(0x7f0000000980)=[{0x0, 0x2, 0x10, 0xa}, {0x1, 0x1, 0xe}, {0x5, 0x5, 0x2, 0x9}, {0x4, 0x5, 0x3, 0xb}], 0x10, 0x100}, 0x94) r7 = accept4$tipc(0xffffffffffffffff, &(0x7f0000000a80), &(0x7f0000000ac0)=0x10, 0x800) ioctl$sock_bt_hidp_HIDPCONNADD(r1, 0x400448c8, &(0x7f0000000b40)={r7, r5, 0x40, 0x24, &(0x7f0000000b00)="431e8dc7a04da0d811a716f4528c16520db8a430ad59623107be0efa92b25341e2568a61", 0xf7, 0x8, 0xe0, 0xfffa, 0x3, 0x0, 0x5, 'syz1\x00'}) getpeername$packet(r1, &(0x7f0000000c00)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @local}, &(0x7f0000000c40)=0x14) ioctl$sock_ipv6_tunnel_SIOCGETTUNNEL(r1, 0x89f0, &(0x7f0000000d00)={'syztnl0\x00', &(0x7f0000000c80)={'ip6_vti0\x00', r8, 0x29, 0x0, 0x6, 0x7, 0xc, @mcast1, @empty, 0x10, 0x7800, 0x2, 0xd}}) socket$key(0xf, 0x3, 0x2) ioctl$INCFS_IOC_READ_FILE_SIGNATURE(0xffffffffffffffff, 0x8010671f, &(0x7f0000000e40)={&(0x7f0000000d40)=""/198, 0xc6}) r10 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000ec0), r5) sendmsg$ETHTOOL_MSG_RINGS_SET(r1, &(0x7f0000001040)={&(0x7f0000000e80)={0x10, 0x0, 0x0, 0x800000}, 0xc, &(0x7f0000001000)={&(0x7f0000000f00)={0xe4, r10, 0x100, 0x70bd2b, 0x25dfdbff, {}, [@ETHTOOL_A_RINGS_RX={0x8}, @ETHTOOL_A_RINGS_RX_JUMBO={0x8}, @ETHTOOL_A_RINGS_HEADER={0x64, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'lo\x00'}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'syzkaller1\x00'}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'vcan0\x00'}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r9}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'macvlan0\x00'}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x3}]}, @ETHTOOL_A_RINGS_RX_MINI={0x8, 0x7, 0x3467}, @ETHTOOL_A_RINGS_HEADER={0x4c, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_INDEX={0x8}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r8}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r9}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x3}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'netpci0\x00'}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'ip6erspan0\x00'}]}, @ETHTOOL_A_RINGS_RX_JUMBO={0x8, 0x8, 0x8}]}, 0xe4}, 0x1, 0x0, 0x0, 0x20000000}, 0x85780e1f5953b64e) r11 = syz_genetlink_get_family_id$nl80211(&(0x7f00000010c0), r1) sendmsg$NL80211_CMD_CONNECT(r1, &(0x7f0000001480)={&(0x7f0000001080)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f0000001440)={&(0x7f0000001100)={0x320, r11, 0x10, 0x70bd26, 0x25dfdbfe, {{}, {@void, @val={0xc, 0x99, {0xfffffff1, 0x75}}}}, [@NL80211_ATTR_PBSS={0x4}, @NL80211_ATTR_PREV_BSSID={0xa, 0x4f, @random="7a4a945b3550"}, @NL80211_ATTR_HT_CAPABILITY={0x1e, 0x1f, {0x1, 0x1, 0x1, 0x0, {0xffff, 0x400, 0x0, 0xa3, 0x0, 0x0, 0x1, 0x1, 0x1}, 0x1, 0x10001, 0x3}}, @fils_params=[@NL80211_ATTR_FILS_ERP_USERNAME={0xc, 0xf9, "894cdae862024e4d"}, @NL80211_ATTR_FILS_ERP_RRK={0x96, 0xfc, "5cba2907102e904a0cce4eb5f05ab7274b14ee0c3b7aa223f86628db7517f284a9d59a7f2f0539db46beb01e555f3f6c14af6bf8f3b924728d6b4d564ab39a973dc9759cd911942cfe692f038ce7302f99559c056de0c7196cf2515c29829dc1a4a33fa353b3b32e10e954ece3df2bea6745d9088338d6f781f0755f4bb59b28240adde288ffe1b2b833fa0dcf17c52c095c"}, @NL80211_ATTR_FILS_ERP_REALM={0x2a, 0xfa, "7dcd15321119a0aee3282d9a7fa49be0f74223bced2adc5dad4eae9089ace39884628499425c"}, @NL80211_ATTR_FILS_ERP_NEXT_SEQ_NUM={0x6, 0xfb, 0x4}, @NL80211_ATTR_FILS_ERP_RRK={0x9c, 0xfc, "2d60012f2baf749af01d2e96f35da0dc98dabef2fedfd7926cc4b56d1d759941622537e14e8734fcbb974e6c06757bb4af7fd7d14dd2c240ef92950ea736dde5d632a1aaee66051931ce98dbd3d6bc8056e9fcf39ad401a2f19588c783c0811681e20ffa5e94293b20d77cdf5cecb98a50adb66a130bfef2fb3dcabd39e78a0071dc6e96f29c8266e934be1dddfca689c84a2f07ba41a619"}, @NL80211_ATTR_FILS_ERP_REALM={0x11, 0xfa, "093200efc790328f652222c32c"}, @NL80211_ATTR_FILS_ERP_USERNAME={0xe, 0xf9, "c215553cf077b9f6b0fd"}, @NL80211_ATTR_FILS_ERP_RRK={0x100, 0xfc, "5e5b9090296efb4d0ebf349ca1881940bd1289bda6abc29ea53bcb0fd6b3f12ca2edf3acf5a3d35224a2cbb159d711c99692327f629a6f29f7524a3608dfad8eb84138caec626abba64960f1876a0c4576f8eca3a92b5b2c0cf5132570c32b9db20095cb42620db65811a26e5a993a987038cf7eec17d8a59519be1a56c971ad806d95d294f218b58296f8056cdfa8b5f63338f37f287b0a290566ecb5a1c36192a5534f7b7b1f763c35c5f32fb3f87bdc1e554639200d6fd856b7e350c35d15b760d89c58d8da5e3f190ad82a25b0286fcb511ca39294797fcaec2bb196e37f717a1ba84de194fd74321461e87f49f2737166cd0f95285b9f7332c7"}, @NL80211_ATTR_FILS_ERP_NEXT_SEQ_NUM={0x6, 0xfb, 0x2}], @NL80211_ATTR_BSS_SELECT={0x20, 0xe3, 0x0, 0x1, {0x1c, 0x0, [@NL80211_BSS_SELECT_ATTR_RSSI={0x4}, @NL80211_BSS_SELECT_ATTR_BAND_PREF={0x8, 0x2, 0x3}, @NL80211_BSS_SELECT_ATTR_RSSI={0x4}, @NL80211_BSS_SELECT_ATTR_BAND_PREF={0x8, 0x2, 0x3ff}]}}, @NL80211_ATTR_VHT_CAPABILITY_MASK={0x10, 0xb0, {0x200, {0x1, 0x3ed9, 0x5, 0x1}}}]}, 0x320}, 0x1, 0x0, 0x0, 0x40}, 0x40001) ioctl$sock_ipv6_tunnel_SIOCGETTUNNEL(r1, 0x89f0, &(0x7f0000001540)={'syztnl0\x00', &(0x7f00000014c0)={'ip6tnl0\x00', r9, 0x29, 0x9, 0x3, 0x40, 0x40, @mcast2, @private1, 0x7800, 0x1, 0xaa8, 0x7ff}}) getsockopt$inet6_IPV6_XFRM_POLICY(r1, 0x29, 0x23, &(0x7f0000001580)={{{@in, @in6=@mcast2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@local}, 0x0, @in6=@private1}}, &(0x7f0000001680)=0xe8) setsockopt$inet6_IPV6_XFRM_POLICY(r5, 0x29, 0x23, &(0x7f00000016c0)={{{@in6=@private1, @in6=@local, 0x4e21, 0x4, 0x4e22, 0x1, 0xa, 0x80, 0x80, 0x73, r12, r13}, {0x7fff, 0x8c78, 0x6, 0x4, 0x95, 0x1, 0x8000, 0x80}, {0x4, 0x4, 0x1, 0x5}, 0x5, 0x0, 0x0, 0x0, 0x2}, {{@in=@dev={0xac, 0x14, 0x14, 0x17}, 0x4d4, 0x6c}, 0x2, @in6=@ipv4={'\x00', '\xff\xff', @multicast1}, 0x3504, 0x5, 0x3, 0x9, 0x2, 0x2, 0x7}}, 0xe8) ioctl$FS_IOC_FSSETXATTR(r0, 0x401c5820, &(0x7f00000017c0)={0x9, 0xa, 0xb, 0x3, 0xd42}) syz_init_net_socket$bt_l2cap(0x1f, 0x3, 0x0) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000001b00)={r5, 0x0, 0xeb, 0x64, &(0x7f0000001800)="224970e53e7741183fb0169e45fcf3dfafafaef4f73989823b9c8f8e6115a57a5019d4d29e8deca2dc390190b7089983ba66d0e8ea1a6dd3e6efd41ad9f84c5307b6985d636f85eee58c7dccacf62c5f335905eb745117cb6eadb31e44c1ad1a929eb202e490c94d9b7704383c7d33059b4d536308974b21ff0edc840e7cfd3b049a12d89cc649719166bcc1955fd6839fea5479c458823326ceecc6c0345248e7d8b6aaddbcd9bf580c389136febbb467e41d7c5236f677fd439e7cefdc61dc9a55a7c038c4aaadc38a949836e8394bf34cbc872068eea9b90865d6d768f1dcacba23561ca44eefb2d487", &(0x7f0000001900)=""/100, 0x1, 0x0, 0x9b, 0x8a, &(0x7f0000001980)="7068b9de22c55b80a795c108a4c6f2bda40cf13eb2d73f980dfde921b422a0426a1ccb5b3368727a25c72677aff2e3dbfc6b255f8307fffb47648c38507226a4fbbe42d8b19a2ee40aa9422fc3e6b05bf6698a1e2566f1dfd1ebe2cc7119f14a367514f715f92308a75518b01298dd9c5934da7f9fcfafb9e7e7a03e3ccd749c6ac870bab2af42e5948602f204c6f3b5332f59601c73a2bc009b35", &(0x7f0000001a40)="0ff7bd9c40c603733fbc2d049e66448ccecccd924bb667aa700ab78e9ea8e628a94e242a4d4301cea89cd8f9da97807c5d604d73f0c7f899084b0d75fbb9e40426797706c813fd9ebfe399eae7e8305d17314806d7c239a721e55fb975fd0de101e4c64fe6c6f89d262750cc98313637bdb16e35f492c7be18fa34ea698bfd90f474a601d47e2e517025", 0x1, 0x0, 0x26}, 0x50) bind$xdp(r1, &(0x7f0000001b80)={0x2c, 0x9, r8, 0xc}, 0x10) getsockname$packet(r1, &(0x7f0000001bc0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @link_local}, &(0x7f0000001c00)=0x14) socketpair(0xf, 0x6, 0x3, &(0x7f0000001c40)) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000001c80)) 2.191018164s ago: executing program 1 (id=2178): bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000400)={0x6, 0x4, &(0x7f0000000000)=ANY=[@ANYBLOB="18000000000000000000000001000080bf001000ffffffff9500b8ec667189000000000000"], &(0x7f0000001480)='syzkaller\x00', 0x9}, 0x94) 2.100913513s ago: executing program 3 (id=2179): bpf$MAP_CREATE(0x0, &(0x7f0000000780)=@base={0xe, 0x4, 0x8, 0x7}, 0x50) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='memory.events\x00', 0x275a, 0x0) write$tun(r0, &(0x7f0000000340)=ANY=[], 0x141) r1 = socket$inet_mptcp(0x2, 0x1, 0x106) setsockopt$sock_int(r1, 0x1, 0x1, &(0x7f0000000200), 0x4) mmap(&(0x7f0000000000/0x4000)=nil, 0x4000, 0x1, 0x10012, r0, 0x0) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='memory.events\x00', 0x275a, 0x0) r3 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r3, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000004c0)=ANY=[@ANYBLOB="18000000260001031dbd7002fadbdf25010000000400ae"], 0x18}, 0x1, 0x0, 0x0, 0x20044001}, 0x0) recvmmsg(r3, &(0x7f000000b400)=[{{0x0, 0x0, &(0x7f0000001b80)=[{&(0x7f0000000a80)=""/4089, 0xff9}], 0x1}, 0x5dd7}, {{0x0, 0x0, &(0x7f00000040c0)=[{&(0x7f0000002c80)=""/188, 0xbc}, {&(0x7f0000000680)=""/175, 0xaf}, {&(0x7f0000002ec0)=""/212, 0xd4}, {&(0x7f0000002fc0)=""/189, 0xbd}, {&(0x7f0000003080)=""/4076, 0xfec}, {&(0x7f00000005c0)=""/46, 0x2e}], 0x6}, 0x3}, {{0x0, 0x0, 0x0}, 0x4}], 0x3, 0x40, 0x0) write$cgroup_subtree(r2, &(0x7f0000000000)=ANY=[], 0x3261e) mmap(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x9, 0x2010, r2, 0xf1bd8000) bpf$PROG_LOAD(0x5, &(0x7f00000004c0)={0x3, 0xc, &(0x7f0000000700)=ANY=[], &(0x7f0000000080)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0xc, '\x00', 0x0, @sched_cls=0x36, r2, 0xcc03, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, r0, 0x0, 0x0, 0x0, 0x0, 0x8001}, 0x94) 1.880284381s ago: executing program 0 (id=2180): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$team(&(0x7f00000044c0), 0xffffffffffffffff) sendmsg$TEAM_CMD_OPTIONS_SET(r1, &(0x7f00000004c0)={0x0, 0x0, &(0x7f0000000480)={&(0x7f0000000180)=ANY=[@ANYBLOB='`\x00\x00\x00', @ANYRES16=r2, @ANYBLOB="010028bd7000fedbdf250100000008000100", @ANYRES64=r2], 0x60}}, 0x110) getsockname$packet(0xffffffffffffffff, 0x0, 0x0) bpf$MAP_CREATE(0x0, 0x0, 0x48) bpf$PROG_LOAD(0x5, 0x0, 0x0) r3 = socket$inet_udp(0x2, 0x2, 0x0) r4 = socket$pppl2tp(0x18, 0x1, 0x1) connect$pppl2tp(r4, &(0x7f0000000140)=@pppol2tpin6={0x18, 0x1, {0x0, r3, 0x1, 0x0, 0x0, 0x0, {0xa, 0x0, 0x4000000, @mcast1}}}, 0x32) r5 = socket$nl_generic(0x10, 0x3, 0x10) r6 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$L2TP_CMD_TUNNEL_GET(r5, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000080)={0x14, r6, 0x325, 0x0, 0x0, {0x8}}, 0x14}}, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) r7 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r7, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000044c0)={&(0x7f0000001300)=ANY=[@ANYBLOB="5800000002060108000000000000000005000003050005000a000000050001000700000005000400000000000900020073797a310000000014000300686173683a69702c706f72742c6970000c00078008000640000000002c925c9c9e83066f48a7d3861f2cb94c2fb818b093e2b3c12db9"], 0x58}, 0x1, 0x0, 0x0, 0x90}, 0x40c0) r8 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_ADD(r8, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000780)=ANY=[@ANYBLOB="74000000090601020000000000000000030000000900020073797a310000000005000100070000004c0007801800018014000240fe8000000000000000000300000000aa1800148014000240fc000000000000000000000000000000060004404e1f0000050007008400000006000540"], 0x74}, 0x1, 0x0, 0x0, 0x10040003}, 0x0) setsockopt(0xffffffffffffffff, 0x84, 0x11, &(0x7f0000000040), 0x0) sendmsg$nl_generic(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000000)=ANY=[@ANYRESOCT], 0x44}, 0x1, 0x0, 0x0, 0x4084085}, 0x4008094) socket$nl_route(0x10, 0x3, 0x0) getpeername$packet(0xffffffffffffffff, 0x0, &(0x7f00000003c0)) setsockopt$SO_RDS_TRANSPORT(0xffffffffffffffff, 0x114, 0x8, 0x0, 0x0) connect$inet(0xffffffffffffffff, &(0x7f0000004cc0)={0x2, 0x0, @remote={0xac, 0x14, 0xffffffffffffffff}}, 0x10) listen(0xffffffffffffffff, 0xfffffffd) 1.826328149s ago: executing program 1 (id=2181): r0 = socket$netlink(0x10, 0x3, 0x0) r1 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000003c0)={0x11, 0x3, &(0x7f0000000380)=ANY=[@ANYBLOB="1800000000020000000000000000000095"], &(0x7f0000000580)='syzkaller\x00', 0x7, 0x0, 0x0, 0x0, 0xc}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000600)={r1, 0x406, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x61, 0x0, &(0x7f00000008c0)="5c4d445d8ae29bc1d5b8ad6d8a98459487277ef223bd736900000000baf60280d3d967f1484ac995a4ef9a1a109ea94c36a001ee049132902cfbdaec64e27bda184c5e4c46685d9bb62996e1691b61c4094a66eb6ec09611261b34c2432c0618cc", 0x0}, 0x50) r2 = socket(0x10, 0x803, 0x0) r3 = socket$inet6_icmp(0xa, 0x2, 0x3a) setsockopt$IP6T_SO_SET_REPLACE(r3, 0x29, 0x40, &(0x7f00000002c0)=@security={'security\x00', 0xe, 0x4, 0x378, 0xffffffff, 0x0, 0x210, 0x210, 0xffffffff, 0xffffffff, 0x370, 0x370, 0x370, 0xffffffff, 0x4, 0x0, {[{{@ipv6={@empty, @remote, [0xffffffff, 0xff000000, 0xff, 0xffffffff], [0xffffff00, 0xff, 0xff000000], 'bridge_slave_0\x00', 'caif0\x00', {0xff}, {0xff}, 0x4, 0x5, 0x1, 0x60}, 0x0, 0xd0, 0xf8, 0x0, {}, [@common=@ipv6header={{0x28}, {0x5, 0x40, 0x1}}]}, @common=@unspec=@STANDARD={0x28, '\x00', 0x0, 0xfffffffffffffffc}}, {{@ipv6={@private1={0xfc, 0x1, '\x00', 0x1}, @mcast1, [0xff000000, 0xff, 0xffffffff, 0xff], [0xffffffff, 0xffffffff, 0xffffffff, 0xffffff00], 'bridge_slave_0\x00', 'veth0_to_bridge\x00', {}, {}, 0x0, 0x1, 0x6, 0xa}, 0x0, 0xa8, 0xd0}, @common=@unspec=@CONNSECMARK={0x28, 'CONNSECMARK\x00', 0x0, {0x2}}}, {{@uncond, 0x0, 0xa8, 0xe0}, @common=@inet=@SET3={0x38, 'SET\x00', 0x3, {{0x3, 0x2, 0x2}, {0x4, 0x3, 0x1}, {0x3, 0x1}, 0x4, 0xfb}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x3d8) (async) sendmsg$IPVS_CMD_SET_INFO(r2, &(0x7f0000000b00)={0x0, 0x0, &(0x7f0000000ac0)={0x0, 0x14}}, 0x0) (async, rerun: 32) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) (rerun: 32) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000380)=ANY=[@ANYBLOB="3c0000001000850600"/20, @ANYRES32=r4, @ANYBLOB="01000000000000001c0012000c000100626f6e64000000000c0002000800010006"], 0x3c}}, 0x0) sendmsg$nl_route(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000580)=ANY=[@ANYBLOB="5800000010001fff000000000100000000000000", @ANYRES32=0x0, @ANYBLOB="0000000008440000300012800b00010067656e657665000020000280140007000000000000000000000000007fff0001050004000100000008000a00", @ANYRES32=r4], 0x58}, 0x1, 0x0, 0x0, 0x40000}, 0x0) (async) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000280)={0xffffffffffffffff}) pipe(&(0x7f0000000000)={0xffffffffffffffff}) splice(r6, 0x0, r5, 0x0, 0xffffffff, 0x4) (async) r7 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x60202, 0x0) (async) syz_extract_tcp_res(&(0x7f00000001c0)={0x41424344}, 0xb, 0x1ff) write$tun(r7, &(0x7f0000000200)={@void, @val={0x1, 0x80, 0x5, 0x3, 0xf, 0x5}, @ipv4=@esp={{0x5, 0x4, 0x1, 0x9, 0x214, 0x67, 0xca8a, 0x6f, 0x32, 0x0, @loopback, @local}, {0x4d6, 0x4, @basic={0x0, 0x0, 0xfffa, [@ipv6=@tcp={0x5, 0x6, "a71285", 0x1b1, 0x6, 0x1, @mcast1, @mcast1, {[@srh={0x16, 0x6, 0x4, 0x3, 0x40, 0x28, 0x9, [@empty, @mcast1, @ipv4={'\x00', '\xff\xff', @local}]}, @dstopts={0x2c, 0x8, '\x00', [@hao={0xc9, 0x10, @initdev={0xfe, 0x88, '\x00', 0x1, 0x0}}, @calipso={0x7, 0x30, {0x0, 0xa, 0x3, 0x6, [0x118, 0xa, 0x400, 0x6, 0x3]}}]}, @fragment={0x2b, 0x0, 0x3, 0x1, 0x0, 0x7, 0x68}, @fragment={0x2b, 0x0, 0x3e, 0x1, 0x0, 0x2, 0x68}, @fragment={0x6, 0x0, 0xf, 0x0, 0x0, 0x6, 0x65}], {{0x4e24, 0x4e21, 0x41424344, r8, 0x0, 0x0, 0x10, 0x8, 0x1, 0x0, 0x0, {[@sack_perm={0x4, 0x2}, @sack_perm={0x4, 0x2}, @exp_fastopen={0xfe, 0x5, 0xf989, "c0"}, @generic={0x1, 0xd, "3a348de45c0a880af113b9"}, @mptcp=@mp_fclose={0x1e, 0xc, 0x0, 0x0, 0x7}, @exp_smc={0xfe, 0x6}, @generic={0x4, 0x2}]}}, {"a972c0e7ad44abd3c87e9ed78249483267452778005c332fe59501d7fe89730b26c8305a9b84c05a2d0216422395dbf218af8ff6c2d591c59afeccad1da93d28a1c28a39e8bdcb150ba5cfc77018c36a4407dfee495dbaf9e9eec8f366e34aa2077d0ab8184d967ed9dd5dd216876c937f25d57fc5f47ac01b4a6f7b14da5292977c21dadbe4f527e4eb86749903a25bc9570cbe18837742d9c690979de202182c4014b2643c4f24db77d13864aee9ee591dd12e00a02cb1691c5a5c2177e13872b9a23367695d4eefe7e8d2909c8b99d0"}}}}, @runt="7060e65c7690a0b7fe935ed4c142ce84486f1bd1"]}, "8edc31016c", 0x5}}}, 0x21e) (async) syz_extract_tcp_res$synack(&(0x7f00000000c0)={0x41424344, 0x41424344}, 0x1, 0x0) write$tun(r6, &(0x7f00000006c0)={@val={0x0, 0xf8}, @void, @ipv6=@tcp={0x9, 0x6, "9e68a5", 0x11f, 0x6, 0x0, @private0, @dev={0xfe, 0x80, '\x00', 0x28}, {[@dstopts={0x6, 0x0, '\x00', [@ra={0x5, 0x2, 0x7c31}, @pad1]}, @hopopts={0x2f, 0x4, '\x00', [@ra={0x5, 0x2, 0x6}, @pad1, @enc_lim={0x4, 0x1, 0x2}, @ra={0x5, 0x2, 0x4}, @hao={0xc9, 0x10, @empty}]}], {{0x4e24, 0x4e21, r8, r9, 0x0, 0x0, 0xd, 0x8, 0xe, 0x0, 0xc45, {[@exp_fastopen={0xfe, 0x7, 0xf989, "01c2ac"}, @sack={0x5, 0xe, [0x800, 0x7, 0x7]}, @fastopen={0x22, 0x4, "cef0"}, @window={0x3, 0x3, 0xf9}, @sack_perm={0x4, 0x2}]}}, {"e90e1a724ed317e8bf7aa303a362d3d360e6c505ebe7afa905096dce6478791fea5582dcc6ddf36dd62fdc2fccbafb8cbd5e681a66f910e8f64e9c203437b817451488f6bd3eabff746fe438ec21b59033b3636cfe6ba034e6af7294194800f2010a759331805519ca09f3f48616df0ebbbe066382bd19cc5d6ea3efe0272b2c1af57178330e6bb503400b853b0045cb9074ee4eb6f067454bc1d7a437b00906ccb23210ff4b29798af6b62949de80e36ddf23"}}}}}, 0x14b) 1.761558449s ago: executing program 4 (id=2182): r0 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="1b0000000000000000000000000004"], 0x48) r1 = bpf$MAP_CREATE(0x0, &(0x7f00000006c0)=ANY=[@ANYBLOB="0500000003000000040000000800000000000000", @ANYRES32, @ANYBLOB='\x00'/20, @ANYRES32=0x0, @ANYRES32, @ANYBLOB='\x00'/17], 0x50) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x1, 0xd, &(0x7f0000000300)=ANY=[@ANYBLOB="18000000000000000000000000000000850000002f00000018110000", @ANYRES32=r1, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000300000095"], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) (async) openat$tun(0xffffffffffffff9c, &(0x7f0000000140), 0x40e41, 0x0) (async) socket$netlink(0x10, 0x3, 0x4) socket$inet6(0xa, 0x2, 0x0) (async) r2 = socket$packet(0x11, 0x3, 0x300) (async, rerun: 64) r3 = bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x1, 0xe, &(0x7f00000004c0)=ANY=[@ANYBLOB="b702000000000000bfa30000000000000703000000feffff7a0af0fff8ffff1971a4f0ff00000000b7060000080000001e6400000000000045040400010000001704000001000a00b7040000000100006a0af2fe00000000850000001a000000b7000000000000009500000000000000455781a5feee5e1ce784909b849d5550adf200000000000000b61d69f2ffdaa10350e11cb97c8ad51bcda0c4ee6d9674c77404ceb9971e43405d621ffbc9a4fd39b0631f6dde53a9a53608c10556e5734eb84049761471ce540c772e2d9f8004e26f7fcc059c062234d5595f6dba87b81d0806fb0289ce67a66afd9ac3d09e29a9d542ca9d85a5c9c88474895d679838def0a83a733dc6a39b63a5ed69d32394c53361d7480884bd8048a967d9b912ef9f1dcc4ff8546fee53f5b2e7b91c61ced1ebad000000000000e8122a793c080a882add4e1179bd4a44f231b6d753a7be428ba953df4aece69311687f4122073a236c3ad198e3f3a532efa04137d452ff47d2638da3261c8362bb7c7824be6195a66d2e17e122040e11e3bd4a69fc6e8d9f7043e09b9e10dc7777bfae5884e4ba1e9cc4a2bbe99e30816127f46a1aae33d4d63d716c0975e1ce4a655362e7062ff6ab3934555c0184021b829472adefa06d3482c7b2711b98eabdca89b77efd13e6dba4a431ce47910000118093b6cabaa17a57727474e1785ee234835088445aa4a9b677d3d342640e328504aea02a2d727e62b7f097a02dbf8fe1d704765de7482040b2fc3000000000000000008947baeaaf954aff687deaa2f80492461d273ee26d8115cbca081a14cba24788779291745083fccdddc90d7af35c528df8000000d8d79c79ddca066da478c197d4a550470557bc99cca336bd88cd28a5ee651627e3a6fbf6ea53b95ddb64c69c7d8d2f4baddc239828760459564124bad68209d2a1d16ad085886c017679cfcda8b1e152ac1e2bcc5ede5b5687aa418abfa29acd7339e73b2cd185c9eb5fb34fccd20ffa155b16c0c309ed6f6663677df37de0ec0d0f548b273940be5d1fe0bae14d1a76bf741330dacd9cc19c0163bcc93059e8d2d1bfa928e2ba458ecd989cb3581a3f270ad48255ac0dad4923e3e36629589ff6b0ceb3438e4b432dd454c04be2d538aaf60c9f7a7281d32142f2fdbc3d37e5a072b5d7f0a349f1a75f01b5c203d4bdde6ff12de9a37f7fb9a16059ad97e2edefb5e0b0326bd25f6fd1d108efa9d30a9883815654486fe42cf2f676cdbb91f7582ab314be"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x0, 0x10, &(0x7f0000000340), 0xfffffffffffffe19}, 0x42) (rerun: 64) setsockopt$sock_attach_bpf(r2, 0x1, 0x32, &(0x7f00000008c0)=r3, 0x4) r4 = socket$packet(0x11, 0x3, 0x300) (async, rerun: 64) r5 = socket(0x10, 0x2, 0x0) (rerun: 64) sendmsg$nl_route(r5, &(0x7f0000000380)={0x0, 0x4076cbba9945d516, &(0x7f0000000340)={0x0, 0x14}}, 0x0) (async, rerun: 64) getsockname$packet(r5, &(0x7f0000000140)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000040)=0x14) (rerun: 64) sendmsg$nl_route(r5, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000500)={&(0x7f0000000100)=ANY=[@ANYBLOB="4000000010003904000000000000000080040000", @ANYRES32=r6, @ANYBLOB="01980000000000002000128008000100736974001400028006000e000600000008000100", @ANYRES32=r4], 0x40}, 0x1, 0x0, 0x0, 0x80}, 0x0) r7 = socket$inet_tcp(0x2, 0x1, 0x0) getsockopt$inet_tcp_int(r7, 0x6, 0x10, 0x0, &(0x7f0000000280)=0xfded) (async) sendto$packet(r4, &(0x7f0000000600)="05d936277c6f54222002097844ffcf8bd1846f7f83477ca1b278e3e4018a34844b9d62cbd7cd2a62", 0x28, 0x8c1, &(0x7f00000000c0)={0x11, 0x86dd, r6, 0x1, 0x0, 0x6, @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x3}}, 0x14) (async) bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0x10, 0x17, &(0x7f0000000000)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b702000014000000b7030000000000008500000083000000bf09000000000000550901000074f6967d00000000000000180100002020702500000000002020207baaf8ff00000000bda100000000000027010000f8ffffffb702000008000000b7030000000000002500000006000000be91000000000000b502ecffffff00008500000005000000b70000000000000095"], &(0x7f00000002c0)='GPL\x00', 0xf, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, @fallback=0x1a, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) 1.741702613s ago: executing program 3 (id=2183): r0 = syz_genetlink_get_family_id$nbd(&(0x7f0000000240), 0xffffffffffffffff) getsockopt$bt_BT_POWER(0xffffffffffffffff, 0x112, 0x9, &(0x7f0000000080)=0x2b, &(0x7f00000000c0)=0x1) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000015c0)={&(0x7f0000000380)=ANY=[@ANYBLOB="9feb010018000000000001000a0000000c00000005000000020000000000000500000000005f615f00b3756e74d3a86c2783c801e5b34202f6c23220bf49e0fd927ccb3255361d78aadabd9fece6a7049ef667c9828d5fa4a2d275005528c3f76b1d46dc59ee17b7b1c3972dda3626eb40c2bbad4b01cd94f14a42477c2589d70917e399789acfdd04ff06d1b937e2ff07e463e1684e76488c2c9d925375aec021e1b8372a524d08119d5dad7682df2f258aae5e807f195f4047d188f96ca0a4765fa8f8cb3d238334f3"], 0x0, 0x29, 0x0, 0x1}, 0x28) r1 = socket$inet_sctp(0x2, 0x1, 0x84) setsockopt$inet_int(r1, 0x0, 0xc, &(0x7f00000002c0)=0x4, 0x4) getsockopt$inet_opts(r1, 0x0, 0x9, 0x0, &(0x7f0000000500)) socket$inet6_tcp(0xa, 0x1, 0x0) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.net/syz0\x00', 0x1ff) r2 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000680), r2) r4 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000004c0)='cpuset.effective_cpus\x00', 0x275a, 0x0) r5 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000100)='memory.events\x00', 0x7a05, 0x1700) r6 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) write$cgroup_int(r6, &(0x7f0000000200), 0x806000) readv(r4, &(0x7f0000000740)=[{0x0}], 0x1) sendfile(r5, r4, 0x0, 0xf03a0005) r7 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r8 = openat$cgroup_freezer_state(r7, &(0x7f0000000140), 0x2, 0x0) write$cgroup_freezer_state(r8, &(0x7f0000000040)='FROZEN\x00', 0x7) mkdirat$cgroup(r7, &(0x7f0000000100)='syz0\x00', 0x1ff) sendfile(r8, r8, 0x0, 0x9) r9 = socket(0x400000000010, 0x3, 0x0) getsockopt$sock_int(r9, 0x1, 0x22, 0x0, &(0x7f0000000180)) r10 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000300)=ANY=[@ANYRESHEX=r3, @ANYRES8=r10, @ANYRES64=r2, @ANYRESOCT=r9], 0x34}, 0x1, 0x0, 0x0, 0x20000000}, 0x8804) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000280)={0xffffffffffffffff}) r12 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NBD_CMD_RECONFIGURE(r12, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000580)=ANY=[@ANYBLOB=',\x00\x00\x00', @ANYRES16=r0, @ANYBLOB="010029bd7000ffdbdf25030000000800010000000000100007800c00018008000100", @ANYRES32=r11, @ANYBLOB="8aeb3976c9e33ace943ca27326b1bb235bcdf0837410016ceed2adc1db1013aeb51c81aa21f5fa6302e3772302793ee51615ea1d2849e34ce4a50113f85f1daa7e225f"], 0x2c}, 0x1, 0x0, 0x0, 0xe256610c62001369}, 0x600000c0) setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(r1, 0x84, 0x64, &(0x7f0000000480)=[@in6={0xa, 0x4e22, 0x6, @empty, 0x6}, @in6={0xa, 0x4e22, 0x9, @remote, 0xffffffe6}], 0x38) 1.225861144s ago: executing program 0 (id=2184): r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='memory.events\x00', 0x275a, 0x0) write$cgroup_subtree(r0, &(0x7f0000000000)=ANY=[], 0x32600) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x2000001, 0x12, r0, 0x0) r1 = socket$inet6_sctp(0xa, 0x1, 0x84) getsockopt$inet_sctp6_SCTP_DELAYED_SACK(r1, 0x84, 0x10, &(0x7f0000000040)=@assoc_value={0x0, 0x211d9572}, &(0x7f00000001c0)=0x8) r2 = socket(0x10, 0x3, 0x0) r3 = openat$ppp(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) sendmsg$nl_route(r2, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000001c0)=ANY=[@ANYBLOB="400000001000030400"/20, @ANYRES32=0x0, @ANYBLOB="00000000000000001800128008000100707070000c00028008000100", @ANYRES32=r3, @ANYBLOB='\b\x00\n\x00', @ANYRES64=r2], 0x40}}, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)) pselect6(0x40, &(0x7f0000000000)={0x7f, 0x8, 0x3, 0x7, 0x7, 0x3, 0x800, 0x6}, 0x0, 0x0, 0x0, 0x0) bpf$MAP_CREATE(0x0, &(0x7f0000000340)=@bloom_filter={0x1e, 0x80, 0x7ad3, 0x0, 0x64000, r0, 0x3, '\x00', 0x0, r0, 0x4, 0x0, 0x0, 0x2}, 0x50) r4 = bpf$MAP_CREATE(0x0, &(0x7f0000000100)=@base={0xf, 0x4, 0x4, 0x4, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0}, 0x48) bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0x10, 0x6, &(0x7f0000000300)=@raw=[@map_fd={0x18, 0x2, 0x1, 0x0, r4}, @generic={0xbf, 0x3, 0x1}, @generic={0xb7, 0x4}, @generic={0x85, 0x0, 0x0, 0x0, 0x3c}, @generic={0x95}], &(0x7f0000000400)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sk_msg=0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) 1.141364488s ago: executing program 1 (id=2185): r0 = socket$unix(0x1, 0x2, 0x0) bind$unix(r0, &(0x7f0000000080)=@file={0x1, '\xe9\x1fq\x89Y\x1e\x923aK\x00'}, 0x6e) r1 = socket$unix(0x1, 0x2, 0x0) r2 = socket$unix(0x1, 0x2, 0x0) connect$unix(r2, &(0x7f0000000180)=@file={0x1, '\xe9\x1fq\x89Y\x1e\x923aK\x00'}, 0x6e) sendmmsg(r2, &(0x7f0000002dc0), 0x307017fdb7a66cb, 0x0) socket$can_bcm(0x1d, 0x2, 0x2) socket(0x2, 0x80805, 0x0) syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x3) socket$inet6_sctp(0xa, 0x5, 0x84) pselect6(0x40, &(0x7f00000001c0)={0x0, 0x0, 0x3, 0x3, 0x0, 0x80, 0x1, 0xffffffffffffffff}, 0x0, &(0x7f00000002c0)={0x3ff, 0x0, 0x8, 0x9, 0x0, 0x1ff, 0x7fffffff}, 0x0, 0x0) connect$unix(r1, &(0x7f0000000180)=@file={0x1, '\xe9\x1fq\x89Y\x1e\x923aK\x00'}, 0x6e) ppoll(&(0x7f0000000100)=[{r2, 0x3328}, {r1, 0x4236}], 0x2, 0x0, 0x0, 0x0) unshare(0x22020400) close(r0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000000)={0xffffffffffffffff}) recvmsg(r2, &(0x7f0000001480)={0x0, 0x0, 0x0}, 0x100) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000140)={0x1e, 0x4, &(0x7f0000000200)=@framed={{0x18, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, [@ldst={0x1, 0x2, 0x3, 0x2, 0x1, 0x30}]}, &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x24, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x40000000}, 0x94) 1.092464894s ago: executing program 4 (id=2186): socket$inet6_tcp(0xa, 0x1, 0x0) (async) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) mmap(0x0, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x13, &(0x7f0000000100)=0x100000001, 0x4) connect$inet6(r0, &(0x7f00000003c0)={0xa, 0x0, 0x9, @loopback, 0x40}, 0x1c) setsockopt$inet6_tcp_TCP_ULP(r0, 0x6, 0x1f, &(0x7f0000000040), 0x3) setsockopt$inet6_tcp_TLS_TX(r0, 0x11a, 0x2, &(0x7f00000001c0)=@ccm_128={{0x304}, "100900", "a3966a9c2c799501471a53222718e691", "b77df3fe", "0d461df8b401a3a2"}, 0x28) getsockopt$inet6_tcp_TCP_ZEROCOPY_RECEIVE(r0, 0x11a, 0x4, 0x0, 0x0) r1 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) socket$inet6_tcp(0xa, 0x1, 0x0) (async) socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_int(r1, 0x29, 0x19, 0x0, 0x4638ee184721e40f) (async) setsockopt$inet6_int(r1, 0x29, 0x19, 0x0, 0x4638ee184721e40f) bpf$PROG_LOAD(0x5, &(0x7f00000002c0)={0x10, 0xc, &(0x7f0000000080)=ANY=[@ANYBLOB="1800000004000000000000008001000018270000", @ANYRES32, @ANYBLOB="00000000040000008510000003000000185a00000200000000000076400000001846000004000000000000000000000018260000", @ANYRES32=0x1, @ANYBLOB="00000000010000009500000000000000"], &(0x7f0000000140)='GPL\x00', 0xaa0, 0x0, 0x0, 0x41100, 0x27, '\x00', 0x0, @sk_msg=0x7, 0xffffffffffffffff, 0x8, &(0x7f0000000180)={0x3, 0x4}, 0x8, 0x10, &(0x7f0000000200)={0x4, 0x0, 0xb15, 0x2}, 0x10, 0xffffffffffffffff, 0xffffffffffffffff, 0x1, &(0x7f0000000240)=[0x1, 0xffffffffffffffff], &(0x7f0000000280)=[{0x5, 0x5, 0xa, 0x1}], 0x10, 0x6}, 0x94) (async) r2 = bpf$PROG_LOAD(0x5, &(0x7f00000002c0)={0x10, 0xc, &(0x7f0000000080)=ANY=[@ANYBLOB="1800000004000000000000008001000018270000", @ANYRES32, @ANYBLOB="00000000040000008510000003000000185a00000200000000000076400000001846000004000000000000000000000018260000", @ANYRES32=0x1, @ANYBLOB="00000000010000009500000000000000"], &(0x7f0000000140)='GPL\x00', 0xaa0, 0x0, 0x0, 0x41100, 0x27, '\x00', 0x0, @sk_msg=0x7, 0xffffffffffffffff, 0x8, &(0x7f0000000180)={0x3, 0x4}, 0x8, 0x10, &(0x7f0000000200)={0x4, 0x0, 0xb15, 0x2}, 0x10, 0xffffffffffffffff, 0xffffffffffffffff, 0x1, &(0x7f0000000240)=[0x1, 0xffffffffffffffff], &(0x7f0000000280)=[{0x5, 0x5, 0xa, 0x1}], 0x10, 0x6}, 0x94) sendmmsg$inet6(0xffffffffffffffff, &(0x7f00000058c0)=[{{0x0, 0x0, &(0x7f0000001300)=[{&(0x7f00000002c0)="a8d81e6d947d922587e5abd7a547dd11ec10b1c149e49cdd3a3acce0e471282c8b594920aca050647626d317dc6c38dc493cb80ae55dbb9e00d8376a96cab883ecd9c634e8f1965a11ae4e9ba062368bf6b8c3424d469dbb24c7919f332e637a015802cb8739f82185ed1bf0c2f1a2a0c59942596f4fd386adeab9b2683beaca798e3ee69e0a6d239098c745305d21b9293483dfdbcd94277f7a08f414e77a78001546e1449a889cbef622f3874183060c884ea7e3abca8d3fed20b5013cdeb7f7dc474909ecfd57a1d4c7fe05129fb45468e681e3bc744e43ef5ffa40e4ac7ee8332cafa8b254079bc94711f6090b3c65d0d79208f463dd3b16242cc1c15249b3e42c624749049179fd397ee1daf5e5b907b6fec63b1aa2be29320af21a37e729c0445b4bfa5d338495804dfab92a2e973104c7bed5a24e0bdfb4846036d623e173269b722c9ccd93b8c9682c3cdf0e1b806b5b00ede878c698663d851dfba23d9abfca0140f167ef1b9cd0e1e49fc0eb6bdc46f4fdf381d55b3d6185361afc9cfebc3f98af4524fec4d5277bf6134a2a473932947f2051b7ca196b8b9931c14b04c34f309efecb1bbdc563497e7e66847057967363411c2f720df3a0ed530abbaa72d4b8d2aeecab950759c47057d7cc26c7d939191908d0426fa7d9abd51fabc26324575bee2848486f3736bbd3714f07ac559a918c06f31c391cba5b6cbd4e7316f68e45e421001b5b002520c769be330de8e7d86bc218d4562f6a86167eb0bf35ed70478200b58d420db3d4f6408ed160c36d6e92a085212394d5507243aff5ba8fc1be49eff3fe050cf4dbf033385b751d3fe87001cf608583d3394e87e73aedffd99312705e726f0b85622fe7b3ef5b08ae9e1e2ca1bcfc804209102a1a358c88e6456169a7a9731acebe1264385509a19d534e45fc352e6cf1347aff24f17c21242ada32ff0565bacec22528790f461195cd5a2293ac5df991acf980be873cded06b84c6094a62cfe5438d19a4fe04e1238c595bd764477094ae3ad1660a0d65e3a63ca9a197879f05fb64fe542ea13ef2ec836ea2513c841fb133d38696e9f1f0222e4afc160fc05d3e6279469c1af9a158d3240e20d15d3d03d8be46067c17d4e42f0d97e0d25b410a3a6be7964119aae495c6ef148882f15f52df74bb810876c2762d69cc331a9de08dd8138787c283249c8406172bc6cd4625a31865bdbc674379e9ff08de675dc91f088f9d38b33bf335d199907d6225bc4958a7f74aa6030cd1a3c1220af6396d37a85c1efc4b5d88936d485c2dd350a4e1f4d75ff07bce3920e1fec69d5ba8d142957f8f4d7c0e0da2a0ca6643ebd8c96562", 0x3c0}], 0x1}}], 0x1, 0x40080) bpf$PROG_LOAD(0x5, &(0x7f0000000880)={0x1, 0x10, &(0x7f0000000180)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r3 = socket$alg(0x26, 0x5, 0x0) bind$alg(r3, &(0x7f0000000380)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc-cast5-avx\x00'}, 0x58) (async) bind$alg(r3, &(0x7f0000000380)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc-cast5-avx\x00'}, 0x58) setsockopt$ALG_SET_KEY(r3, 0x117, 0x1, &(0x7f00000004c0)="2c385a7af3", 0x5) r4 = accept4(r3, 0x0, 0x0, 0x800) sendmmsg$alg(r4, &(0x7f0000000040)=[{0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)="f78d9ca38fff48f3be52163448412ba8", 0xfffffe3f}, {&(0x7f0000000140)="ebe3a0e9796cfd1647e299f4e376fdba128280b372219d205e81f4a7f71c1926aae1efd7e0054a863f3d5cfe6cb55b5bb9fa6935849e6098ed884e7cb51726b360fbb37b4fe035bbb095873048", 0xff31}, {&(0x7f00000003c0)="e8700e444d50a969ff67347cff6127e6ef12ee3819271482a4975a52c1ab9b8b4db3945d1032005eabe97b4dc33a47d3a158da988456d30026b433186f53cdcdb93a4722bf306a10470d50f5cb1ece9ead3459bab1cf1538cd0b157653c5e892962c80f158c443e9c6ad7d2a8103ef2f4b93766b9a21501f94c1568b13756b66f74f46cf801704d2da8b96c34070b233af0afcc436712e58ed25e721193af05a045ad3fdc928f02f3dbad19d3e66eebda2e63f3f46ef4511cee26d7b48241847bf9e343ef4674c45e2a085060f11"}], 0x1, &(0x7f0000000380)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x40800) (async) sendmmsg$alg(r4, &(0x7f0000000040)=[{0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)="f78d9ca38fff48f3be52163448412ba8", 0xfffffe3f}, {&(0x7f0000000140)="ebe3a0e9796cfd1647e299f4e376fdba128280b372219d205e81f4a7f71c1926aae1efd7e0054a863f3d5cfe6cb55b5bb9fa6935849e6098ed884e7cb51726b360fbb37b4fe035bbb095873048", 0xff31}, {&(0x7f00000003c0)="e8700e444d50a969ff67347cff6127e6ef12ee3819271482a4975a52c1ab9b8b4db3945d1032005eabe97b4dc33a47d3a158da988456d30026b433186f53cdcdb93a4722bf306a10470d50f5cb1ece9ead3459bab1cf1538cd0b157653c5e892962c80f158c443e9c6ad7d2a8103ef2f4b93766b9a21501f94c1568b13756b66f74f46cf801704d2da8b96c34070b233af0afcc436712e58ed25e721193af05a045ad3fdc928f02f3dbad19d3e66eebda2e63f3f46ef4511cee26d7b48241847bf9e343ef4674c45e2a085060f11"}], 0x1, &(0x7f0000000380)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x40800) recvmsg(r4, &(0x7f00000005c0)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f00000000c0)=""/81, 0x7ffff000}, {&(0x7f0000000200)=""/83, 0x20000253}], 0x2}, 0x0) (async) recvmsg(r4, &(0x7f00000005c0)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f00000000c0)=""/81, 0x7ffff000}, {&(0x7f0000000200)=""/83, 0x20000253}], 0x2}, 0x0) r5 = socket$nl_generic(0x10, 0x3, 0x10) r6 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000580), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r5, 0x8933, &(0x7f00000013c0)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_FRAME(r5, &(0x7f0000001380)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000dc0)=ANY=[@ANYBLOB="f4060000", @ANYRES16=r6, @ANYBLOB="01000000000000e14f003b00000008000300", @ANYRES32=r7, @ANYBLOB="d50633008000009effffffffffff080211000001"], 0x6f4}}, 0x0) r8 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000540)={0x18, 0x4, &(0x7f0000000380)=@framed={{0x18, 0x0, 0x0, 0x0, 0x40, 0x0, 0x0, 0x0, 0x6}, [@alu={0x4, 0x1, 0x0, 0x3, 0x2, 0x100, 0xfffffffffffffffa}]}, &(0x7f0000000400)='syzkaller\x00', 0xfce6, 0x26, &(0x7f0000000440)=""/38, 0x40f00, 0x17, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, &(0x7f0000000480)={0xa, 0x2}, 0x8, 0x10, 0x0, 0x0, 0x0, 0x0, 0x1, &(0x7f00000004c0)=[0xffffffffffffffff, 0xffffffffffffffff, 0x1, 0xffffffffffffffff, 0x1, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0x1, 0xffffffffffffffff], &(0x7f0000000500)=[{0x2, 0x2, 0x6, 0x1}], 0x10, 0xfffffffc}, 0x94) ioctl$BTRFS_IOC_GET_SUPPORTED_FEATURES(r0, 0x80489439, &(0x7f0000000640)) bpf$BPF_LINK_UPDATE(0x1d, &(0x7f0000000600)={0xffffffffffffffff, r2, 0x4, r8}, 0x10) (async) bpf$BPF_LINK_UPDATE(0x1d, &(0x7f0000000600)={0xffffffffffffffff, r2, 0x4, r8}, 0x10) 1.078560753s ago: executing program 2 (id=2187): r0 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000340)=ANY=[@ANYBLOB="0200000004000000080000000100000080"], 0x50) bpf$MAP_UPDATE_CONST_STR(0x2, &(0x7f00000002c0)={{r0, 0xffffffffffffffff}, &(0x7f0000000200), &(0x7f00000005c0)='%pi6 \x00'}, 0x20) bpf$BPF_MAP_CONST_STR_FREEZE(0x16, &(0x7f0000000800)={r1, 0xffffffffffffffff}, 0x4) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r3, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000600)=ANY=[@ANYBLOB="140000001000010000000000000000000200000a20000000000a050000000000000000000100fffc0900010073797a300000000040000000030a01010000000000000000010000000900030073797a300000000014000480080002400000000008000140000000000900010073797a30000000004c000000060a010400000000000000000100000024000480200001800700010072740000140002800800014000000014080002400000000208000b40000000000900010073797a300000000014000000020a010100000700000000000100000914000000110001"], 0xe8}, 0x1, 0x0, 0x0, 0x8000}, 0x0) r4 = bpf$PROG_LOAD(0x5, &(0x7f00000004c0)={0x16, 0x10, &(0x7f0000000100)=ANY=[@ANYBLOB="18000000000000000000000000000000b7080000000000007b8af8ff00000000b7080000ffff0b867b8af0ff00000000bfa100000000000007010000f8ffffffbfa400000000000007040000f0ffffffb70200000000000018230000", @ANYRES32=r2, @ANYBLOB="0000000000000000b70500000800000085000000a500000095"], &(0x7f0000000600)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @flow_dissector, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000640)={r4, 0x0, 0x22, 0x48000000, &(0x7f0000000300)="40f0538ef047b21fb60068305500", 0x0, 0xf00, 0x0, 0x0, 0x0, 0x0, 0x0}, 0xaf) 686.541696ms ago: executing program 3 (id=2188): r0 = socket$inet_tcp(0x2, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000180)={'syz_tun\x00', 0x0}) r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000400)=ANY=[@ANYBLOB="19000000040000000400000005"], 0x50) r3 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x6, 0xc, &(0x7f00000001c0)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r2, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bc82000000000000a6020000f8ffffffb703000008900000b703000000000000850000003300000095"], &(0x7f0000000180)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x4, '\x00', 0x0, @xdp, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4f, 0x0, 0x0, 0x0}, 0x94) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000480)={{r2}, &(0x7f0000000240), &(0x7f0000000340)=r3}, 0x20) bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f00000008c0)={r3, r1, 0x25, 0x0, @void}, 0x10) syz_emit_ethernet(0x0, 0x0, 0x0) syz_emit_ethernet(0xfe4f, &(0x7f0000000000)=ANY=[], 0x0) r4 = socket$inet6_sctp(0xa, 0x801, 0x84) setsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER(r4, 0x84, 0x7b, &(0x7f00000000c0)={0x0, 0x1}, 0x8) connect$inet6(r4, &(0x7f0000000080)={0xa, 0x0, 0x0, @rand_addr=' \x01\x00'}, 0x1c) setsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER_VALUE(r4, 0x84, 0x7c, &(0x7f00000002c0)={0x0, 0x0, 0x4}, 0x8) 685.138951ms ago: executing program 2 (id=2189): r0 = bpf$BPF_BTF_LOAD(0x12, &(0x7f00000005c0)={&(0x7f0000000180)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0x107, 0x107, 0x5, [@func={0x8, 0x0, 0x0, 0xc, 0x2}, @datasec={0x9, 0x5, 0x0, 0xf, 0x3, [{0x1, 0x8, 0x5}, {0x1, 0x4, 0x9f}, {0x5, 0xb5d6, 0x700}, {0x2, 0x924, 0x7ff}, {0x4, 0x4, 0x6}], "ad405e"}, @decl_tag={0x10, 0x0, 0x0, 0x11, 0x5, 0x6}, @func_proto={0x0, 0x9, 0x0, 0xd, 0x0, [{0x4, 0x3}, {0x5, 0x3}, {0x3, 0x3}, {0x8, 0x3}, {0x5, 0x5}, {0x10, 0x1}, {0x9, 0x2}, {0x2}, {0x9, 0x5}]}, @ptr={0x9, 0x0, 0x0, 0x2, 0x3}, @typedef={0xf, 0x0, 0x0, 0x8, 0x3}, @var={0xb, 0x0, 0x0, 0xe, 0x5}, @fwd={0x7}, @const={0x1, 0x0, 0x0, 0xa, 0x3}, @volatile={0xd, 0x0, 0x0, 0x9, 0x5}]}, {0x0, [0x5f, 0x30, 0x61]}}, &(0x7f0000000500)=""/173, 0x125, 0xad, 0x1, 0xb}, 0x28) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000002c80)={0x3, 0xc, &(0x7f0000000140)=ANY=[], &(0x7f0000000080)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, r0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, 0x0, 0x0) socket(0x1a, 0x3, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCETHTOOL(r1, 0x8946, &(0x7f0000000340)={'netdevsim0\x00', &(0x7f0000000400)=@ethtool_flash={0x33, 0xb619, '.\x00'}}) unshare(0x2a020400) openat$pidfd(0xffffffffffffff9c, &(0x7f0000001100), 0x200200, 0x0) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r2, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000480)={0x5c, 0x2, 0x6, 0x5, 0x0, 0x0, {}, [@IPSET_ATTR_REVISION={0x5}, @IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz2\x00'}, @IPSET_ATTR_FAMILY={0x5}, @IPSET_ATTR_DATA={0x14, 0x7, 0x0, 0x1, [@IPSET_ATTR_BUCKETSIZE={0x5, 0x15, 0x3}, @IPSET_ATTR_HASHSIZE={0x8, 0x12, 0x1, 0x0, 0x9}]}, @IPSET_ATTR_TYPENAME={0xd, 0x3, 'hash:mac\x00'}]}, 0x5c}, 0x1, 0x0, 0x0, 0x80}, 0x0) sendmsg$NFQNL_MSG_CONFIG(r2, &(0x7f0000000140)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x4000000}, 0xc, &(0x7f0000000100)={&(0x7f00000000c0)={0x38, 0x2, 0x3, 0x201, 0x0, 0x0, {0x1, 0x0, 0x8}, [@NFQA_CFG_PARAMS={0x9, 0x2, {0x9}}, @NFQA_CFG_QUEUE_MAXLEN={0x8, 0x3, 0x1, 0x0, 0x431}, @NFQA_CFG_MASK={0x8, 0x4, 0x1, 0x0, 0x20}, @NFQA_CFG_CMD={0x8, 0x1, {0x1, 0x0, 0x1a}}]}, 0x38}, 0x1, 0x0, 0x0, 0x4000004}, 0x804) 594.109389ms ago: executing program 4 (id=2190): r0 = socket$nl_xfrm(0x10, 0x3, 0x6) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x48241, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x6bf1c2d5adba8c32}) r2 = socket$netlink(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$team(&(0x7f00000044c0), 0xffffffffffffffff) r4 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route(r4, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000080)=@newlink={0x54, 0x10, 0xffffff1f, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x2c, 0x12, 0x0, 0x1, @ip6gretap={{0xe}, {0x18, 0x2, 0x0, 0x1, [@IFLA_GRE_LOCAL={0x14, 0x6, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01'}]}}}, @IFLA_NUM_TX_QUEUES={0x8, 0x1f, 0x4}]}, 0x54}, 0x1, 0x0, 0x0, 0x20}, 0x0) ioctl$ifreq_SIOCGIFINDEX_team(r2, 0x8933, &(0x7f00000000c0)={'team0\x00', 0x0}) r6 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$TEAM_CMD_OPTIONS_SET(r6, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000004b80)={&(0x7f0000000240)={0x58, r3, 0x405, 0x70b927, 0x25dfdbfe, {}, [{{0x8, 0x1, r5}, {0x3c, 0x2, 0x0, 0x1, [{0x38, 0x1, @mcast_rejoin_count={{0x24}, {0x5}, {0x8, 0x4, 0x2}}}]}}]}, 0x58}, 0x1, 0x0, 0x0, 0x4040df5}, 0x4040084) r7 = socket$inet6_sctp(0xa, 0x5, 0x84) r8 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000140), r4) sendmsg$IPVS_CMD_DEL_DAEMON(r4, &(0x7f0000000500)={&(0x7f0000000100), 0xc, &(0x7f00000004c0)={&(0x7f00000003c0)={0xf0, r8, 0x501, 0x70bd29, 0x25dfdbfe, {}, [@IPVS_CMD_ATTR_TIMEOUT_UDP={0x8, 0x6, 0x80000001}, @IPVS_CMD_ATTR_DEST={0x2c, 0x2, 0x0, 0x1, [@IPVS_DEST_ATTR_PERSIST_CONNS={0x8, 0x9, 0x1}, @IPVS_DEST_ATTR_ADDR_FAMILY={0x6, 0xb, 0x2}, @IPVS_DEST_ATTR_INACT_CONNS={0x8, 0x8, 0x5db}, @IPVS_DEST_ATTR_INACT_CONNS={0x8, 0x8, 0x7}, @IPVS_DEST_ATTR_TUN_PORT={0x6, 0xe, 0x4e24}]}, @IPVS_CMD_ATTR_DEST={0x5c, 0x2, 0x0, 0x1, [@IPVS_DEST_ATTR_PERSIST_CONNS={0x8, 0x9, 0x77be}, @IPVS_DEST_ATTR_ADDR={0x14, 0x1, @ipv6=@mcast1}, @IPVS_DEST_ATTR_U_THRESH={0x8, 0x5, 0x7}, @IPVS_DEST_ATTR_TUN_TYPE={0x5}, @IPVS_DEST_ATTR_FWD_METHOD={0x8, 0x3, 0x2}, @IPVS_DEST_ATTR_PORT={0x6, 0x2, 0x4e22}, @IPVS_DEST_ATTR_ADDR={0x14, 0x1, @ipv6=@local}, @IPVS_DEST_ATTR_ADDR_FAMILY={0x6, 0xb, 0xa}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5, 0x2}, @IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4, 0x6}, @IPVS_CMD_ATTR_DEST={0x3c, 0x2, 0x0, 0x1, [@IPVS_DEST_ATTR_ADDR_FAMILY={0x6, 0xb, 0x2}, @IPVS_DEST_ATTR_WEIGHT={0x8, 0x4, 0x5a294b84}, @IPVS_DEST_ATTR_TUN_TYPE={0x5}, @IPVS_DEST_ATTR_FWD_METHOD={0x8, 0x3, 0x1}, @IPVS_DEST_ATTR_U_THRESH={0x8, 0x5, 0x80000000}, @IPVS_DEST_ATTR_ADDR_FAMILY={0x6, 0xb, 0x2}, @IPVS_DEST_ATTR_PORT={0x6, 0x2, 0x4e24}]}]}, 0xf0}}, 0x4000) r9 = socket$inet_sctp(0x2, 0x1, 0x84) sendmsg$IPSET_CMD_CREATE(0xffffffffffffffff, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000000)=ANY=[@ANYBLOB="142089e9"], 0x14}, 0x1, 0x0, 0x0, 0x2804d}, 0x80) getsockopt$inet_sctp_SCTP_MAX_BURST(r9, 0x84, 0xd, &(0x7f0000000000)=@assoc_value={0x0}, &(0x7f0000000040)=0x8) setsockopt$inet_sctp6_SCTP_PEER_ADDR_THLDS(r7, 0x84, 0x85, &(0x7f0000000000)={r10, @in={{0x2, 0x4e24, @empty}}, 0x27c0}, 0x90) r11 = socket$kcm(0x2, 0xa, 0x2) ioctl$SIOCSIFHWADDR(r11, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0xe}}) r12 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r12, &(0x7f0000000c40)={0x0, 0x0, &(0x7f0000000c00)={&(0x7f0000000600)=ANY=[@ANYBLOB="140000001000010000000000000000000300000a28000000000a010200000000000000000200000908000240000000030900010073797a300000000098000000160a030000000000000000000200000a6c000380180003801400010064756d6d7930000000000000000000000800014000000000400003801400010073797a6b616c6c65723100000000000014000100697036677265746170edffadf3000000140001006970366772657461703000000000000008000240000000020900020073797a31000000000900010073797a300000000014000000110001"], 0xe8}, 0x1, 0x0, 0x0, 0x4000000}, 0x80) r13 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f00000009c0)={0x1b, 0x0, 0x0, 0x40000, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0}, 0x48) bpf$PROG_LOAD(0x5, &(0x7f0000002c40)={0x7, 0x17, &(0x7f00000007c0)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r13, @ANYBLOB="0000000000000000b702000014000000b7030000000000008500000005000000bf09000000000000b609010000ffffff640000000000000018010000646c6c2500000000002020207b9af8ff000000004c9100000000000037010000f8ffffffb702000008000000b7030000ffffffff15000000060000005f93000000000000b5030000000000008500000076000000b70000000000000095"], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) writev(r1, &(0x7f0000000300)=[{&(0x7f00000001c0)="2e9b3d0007e03dd65193dfb6c575963f8864", 0x12}], 0x1) connect$inet6(0xffffffffffffffff, &(0x7f0000000180)={0xa, 0x4e24, 0xb, @mcast2, 0x9}, 0x1c) sendto$inet6(0xffffffffffffffff, &(0x7f0000000040)="800037bbfa9ba1ce", 0xffe9, 0x0, 0x0, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f0000003780)=[{{0x0, 0x0, 0x0}, 0x5}], 0x1, 0x8140, 0x0) sendmsg$nl_xfrm(r0, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000000)=ANY=[@ANYBLOB="f4000000290001000000000000000000fc020000000000000000000000000001fe8000000000000000000000000000200000000000020000", @ANYRES32=0x0, @ANYRES32, @ANYBLOB="be6b6e000000000050001100ac1414aa000000000000000000000000ffffffff0000000000000000fc020000000000000000000000000001ff0200000000000000000000000000013c040000080000000a000a00280015"], 0xf4}, 0x1, 0x0, 0x0, 0x4000090}, 0x0) 74.946651ms ago: executing program 0 (id=2191): openat$rfkill(0xffffffffffffff9c, &(0x7f0000006040), 0x0, 0x0) r0 = openat$rfkill(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) bind$alg(0xffffffffffffffff, &(0x7f0000000000)={0x26, 'aead\x00', 0x0, 0x0, 'seqiv(rfc4106(gcm(aes)))\x00'}, 0x58) setsockopt$ALG_SET_KEY(0xffffffffffffffff, 0x117, 0x1, &(0x7f00000009c0)="ad56b6c5820fae9d6dcd3292ea54c7be8bbdadbb1632ea5704cae881ef915d374c90c200", 0x24) r1 = accept4(0xffffffffffffffff, 0x0, 0x0, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000340)={0x7, 0x1c, &(0x7f0000000400)=ANY=[@ANYBLOB="18080000cbb60000000000000000000018110000", @ANYRES32, @ANYBLOB="0000000000000000b702000014000000b7030000000000008500000008000000bf092000000000003509"], 0x0, 0x5, 0x0, 0x0, 0x40f00, 0x8, '\x00', 0x0, @fallback=0xc, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000000}, 0x94) r2 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f00000003c0)={'wlan0\x00', 0x0}) r4 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000280), 0xffffffffffffffff) r5 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL80211_CMD_FRAME(r5, &(0x7f0000000c00)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000400)={0x84, r4, 0x1, 0x0, 0x0, {{}, {@val={0x8, 0x3, r3}, @void}}, [@NL80211_ATTR_FRAME={0x64, 0x33, @probe_response={{{0x0, 0x0, 0x5, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1}, {0x8}, @device_b, @device_a, @initial, {0xa, 0x3}}, 0x8, @default, 0x2, @val={0x0, 0x6, @default_ap_ssid}, @void, @void, @void, @val={0x6, 0x1, 0x7f}, @val={0x2d, 0x1a, {0xc, 0x0, 0x3, 0x0, {0x2, 0xc5, 0x0, 0x21a, 0x0, 0x1, 0x1, 0x3, 0x1}, 0x800, 0x1b6b, 0x7}}, @val={0x72, 0x6}, @val={0x71, 0x7, {0x1, 0xffffffffffffffff, 0x1, 0xffffffffffffffff, 0xffffffffffffffff, 0x9, 0x8}}}}, @NL80211_ATTR_DONT_WAIT_FOR_ACK={0x4}]}, 0x84}, 0x1, 0x0, 0x0, 0xc0}, 0x0) ioctl$TUNSETTXFILTER(0xffffffffffffffff, 0x400454ca, &(0x7f0000000100)=ANY=[@ANYBLOB='..']) r6 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='memory.events\x00', 0x275a, 0x0) write$cgroup_subtree(r6, &(0x7f0000000100)=ANY=[], 0x32600) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x2000001, 0x12, r6, 0x0) r7 = syz_open_procfs$namespace(0x0, &(0x7f0000000000)='ns/pid\x00') openat$cgroup(r7, &(0x7f0000000340)='syz1\x00', 0x200002, 0x0) sendmmsg$alg(r1, &(0x7f0000000c00), 0x0, 0x40) recvmsg(r1, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000180), 0x38}, 0x40000061) setsockopt$inet_tcp_TCP_CONGESTION(r1, 0x6, 0xd, &(0x7f0000000080)='cdg', 0x3) ioctl$RFKILL_IOCTL_NOINPUT(r0, 0x5201) ioctl$RFKILL_IOC_MAX_SIZE(r0, 0x2, &(0x7f0000000040)=0x9) bind$inet(r1, &(0x7f00000000c0)={0x2, 0x4e22, @multicast1}, 0x10) close(0x4) getsockopt$IP_VS_SO_GET_DESTS(0xffffffffffffffff, 0x0, 0x484, &(0x7f0000000100)=""/105, &(0x7f0000000180)=0x69) 0s ago: executing program 3 (id=2192): bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x44, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000140)={0xd, 0x4, &(0x7f0000000000)=@framed={{}, [@ldst={0x1, 0x3, 0x3, 0x2, 0x1, 0xb0}]}, &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x24}, 0x90) r0 = socket(0x40000000015, 0x805, 0x0) getsockopt(r0, 0x114, 0x5, &(0x7f0000019100)=""/102399, &(0x7f00000000c0)=0x18fff) getsockopt$inet_pktinfo(0xffffffffffffffff, 0x0, 0x8, &(0x7f0000000080)={0x0, @private, @remote}, &(0x7f00000002c0)=0xc) setsockopt$MRT6_DEL_MIF(r0, 0x29, 0xcb, &(0x7f0000000300)={0x0, 0x1, 0x7, r1, 0xb}, 0xc) r2 = bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="01000000120000007f00000001"], 0x48) bpf$BPF_GET_MAP_INFO(0xf, &(0x7f0000000280)={r2, 0x58, &(0x7f0000000200)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, ""/16, 0x0}}, 0x10) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000500)={0x6, 0xf, &(0x7f0000000380)=ANY=[@ANYBLOB="1800000018000000000000000300000018110000", @ANYRES32=r2, @ANYBLOB="0000000000000000b702000014000000b7030000000000008500000083000000bf0900000000000055090100000000009500000000000000bf91000000000000b7020000010000008500ecff83000000b70000000000000095000000000000007f244a2c20f1ad4da64693eea2de219d85ad197b2ccb4241dcae8b7ee1a026ae87012794e8aa08ac9c31fdc887d387ed941fbea2db15337b2eb73b6f49c02fe7dbe61fec83c703118db46a790f7bf813eabd33625cd002a5592fc7c79af88555fcbc4f81d18730f073de403fde23eb6e8a"], &(0x7f00000007c0)='syzkaller\x00', 0x1, 0x0, 0x0, 0x41100, 0x40, '\x00', r3}, 0x94) r4 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000000), 0xffffffffffffffff) r5 = socket$alg(0x26, 0x5, 0x0) bind$alg(r5, &(0x7f0000000540)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb-serpent-avx\x00'}, 0x58) setsockopt$ALG_SET_KEY(r5, 0x117, 0x1, &(0x7f0000000000)="0800d907", 0x4) r6 = socket$inet6_mptcp(0xa, 0x1, 0x106) setsockopt$inet6_tcp_int(r6, 0x6, 0xa, 0x0, 0x0) sendmsg$NL80211_CMD_TRIGGER_SCAN(0xffffffffffffffff, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000340)={0x1c, r4, 0x1, 0x0, 0x0, {{0x8}, {@val={0x8}, @void}}}, 0x1c}, 0x1, 0x0, 0x0, 0x4000}, 0x4000000) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x44, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) (async) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000140)={0xd, 0x4, &(0x7f0000000000)=@framed={{}, [@ldst={0x1, 0x3, 0x3, 0x2, 0x1, 0xb0}]}, &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x24}, 0x90) (async) socket(0x40000000015, 0x805, 0x0) (async) getsockopt(r0, 0x114, 0x5, &(0x7f0000019100)=""/102399, &(0x7f00000000c0)=0x18fff) (async) getsockopt$inet_pktinfo(0xffffffffffffffff, 0x0, 0x8, &(0x7f0000000080)={0x0, @private, @remote}, &(0x7f00000002c0)=0xc) (async) setsockopt$MRT6_DEL_MIF(r0, 0x29, 0xcb, &(0x7f0000000300)={0x0, 0x1, 0x7, r1, 0xb}, 0xc) (async) bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="01000000120000007f00000001"], 0x48) (async) bpf$BPF_GET_MAP_INFO(0xf, &(0x7f0000000280)={r2, 0x58, &(0x7f0000000200)}, 0x10) (async) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000500)={0x6, 0xf, &(0x7f0000000380)=ANY=[@ANYBLOB="1800000018000000000000000300000018110000", @ANYRES32=r2, @ANYBLOB="0000000000000000b702000014000000b7030000000000008500000083000000bf0900000000000055090100000000009500000000000000bf91000000000000b7020000010000008500ecff83000000b70000000000000095000000000000007f244a2c20f1ad4da64693eea2de219d85ad197b2ccb4241dcae8b7ee1a026ae87012794e8aa08ac9c31fdc887d387ed941fbea2db15337b2eb73b6f49c02fe7dbe61fec83c703118db46a790f7bf813eabd33625cd002a5592fc7c79af88555fcbc4f81d18730f073de403fde23eb6e8a"], &(0x7f00000007c0)='syzkaller\x00', 0x1, 0x0, 0x0, 0x41100, 0x40, '\x00', r3}, 0x94) (async) syz_genetlink_get_family_id$nl80211(&(0x7f0000000000), 0xffffffffffffffff) (async) socket$alg(0x26, 0x5, 0x0) (async) bind$alg(r5, &(0x7f0000000540)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb-serpent-avx\x00'}, 0x58) (async) setsockopt$ALG_SET_KEY(r5, 0x117, 0x1, &(0x7f0000000000)="0800d907", 0x4) (async) socket$inet6_mptcp(0xa, 0x1, 0x106) (async) setsockopt$inet6_tcp_int(r6, 0x6, 0xa, 0x0, 0x0) (async) sendmsg$NL80211_CMD_TRIGGER_SCAN(0xffffffffffffffff, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000340)={0x1c, r4, 0x1, 0x0, 0x0, {{0x8}, {@val={0x8}, @void}}}, 0x1c}, 0x1, 0x0, 0x0, 0x4000}, 0x4000000) (async) kernel console output (not intermixed with test programs): ][ T7511] netlink: 108 bytes leftover after parsing attributes in process `syz.3.398'. [ 137.076591][ T7511] netlink: 32 bytes leftover after parsing attributes in process `syz.3.398'. [ 137.391207][ T7527] netlink: 232 bytes leftover after parsing attributes in process `syz.4.401'. [ 137.546099][ T7518] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 137.596967][ T7547] netlink: 208 bytes leftover after parsing attributes in process `syz.2.404'. [ 137.610336][ T7519] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 137.643906][ T7548] xt_CHECKSUM: CHECKSUM should be avoided. If really needed, restrict with "-p udp" and only use in OUTPUT [ 137.736079][ T7546] syzkaller0: entered promiscuous mode [ 137.744314][ T7546] syzkaller0: entered allmulticast mode [ 137.899213][ T7546] tipc: Started in network mode [ 137.917854][ T7546] tipc: Node identity aafecfdd590c, cluster identity 4711 [ 137.949046][ T7546] tipc: Enabled bearer , priority 0 [ 138.017064][ T7546] tipc: Resetting bearer [ 138.064544][ T7545] tipc: Resetting bearer [ 138.168695][ T7545] tipc: Disabling bearer [ 138.453724][ T7582] netlink: 'syz.2.413': attribute type 13 has an invalid length. [ 138.470475][ T7583] netlink: 'syz.4.411': attribute type 32 has an invalid length. [ 138.470940][ T5719] hid-generic 0005:07C0:5505.0001: item fetching failed at offset 0/1 [ 138.499492][ T5719] hid-generic 0005:07C0:5505.0001: probe with driver hid-generic failed with error -22 [ 139.405299][ T7635] syzkaller0: entered promiscuous mode [ 139.433858][ T7635] syzkaller0: entered allmulticast mode [ 139.904601][ T7662] __nla_validate_parse: 7 callbacks suppressed [ 139.904620][ T7662] netlink: 28 bytes leftover after parsing attributes in process `syz.2.429'. [ 140.103556][ T7669] netlink: 20 bytes leftover after parsing attributes in process `syz.4.431'. [ 140.718474][ T7691] netlink: 4 bytes leftover after parsing attributes in process `syz.4.435'. [ 140.985759][ T7697] tunl0: Caught tx_queue_len zero misconfig [ 141.079474][ T7700] IPVS: set_ctl: invalid protocol: 46 172.20.20.187:20003 [ 141.551605][ T7720] netlink: 'syz.4.444': attribute type 2 has an invalid length. [ 141.646390][ T7720] : entered promiscuous mode [ 141.694074][ T7731] netlink: 12 bytes leftover after parsing attributes in process `syz.1.446'. [ 143.800065][ T7764] openvswitch: netlink: IP tunnel attribute has 4 unknown bytes. [ 144.114905][ T7771] netlink: 24 bytes leftover after parsing attributes in process `syz.1.458'. [ 144.598650][ T7725] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 144.911814][ T7782] bridge0: entered allmulticast mode [ 144.930933][ T7791] netlink: 'syz.2.463': attribute type 1 has an invalid length. [ 144.963240][ T7782] netlink: 'syz.1.461': attribute type 34 has an invalid length. [ 145.317881][ T7807] netlink: 60 bytes leftover after parsing attributes in process `syz.2.467'. [ 145.362174][ T7807] netlink: 'syz.2.467': attribute type 3 has an invalid length. [ 145.389787][ T7807] netlink: 646 bytes leftover after parsing attributes in process `syz.2.467'. [ 145.435047][ T7807] netlink: 4 bytes leftover after parsing attributes in process `syz.2.467'. [ 145.499373][ T7807] bridge_slave_1: left allmulticast mode [ 145.509434][ T7807] bridge_slave_1: left promiscuous mode [ 145.523674][ T7807] bridge0: port 2(bridge_slave_1) entered disabled state [ 145.562452][ T7807] bridge_slave_0: left allmulticast mode [ 145.595979][ T7807] bridge_slave_0: left promiscuous mode [ 145.624725][ T7807] bridge0: port 1(bridge_slave_0) entered disabled state [ 145.707343][ T7807] team0: Port device bridge0 removed [ 147.010934][ T7865] netlink: 8 bytes leftover after parsing attributes in process `syz.3.480'. [ 147.033821][ T7869] lo: Caught tx_queue_len zero misconfig [ 147.075647][ T7869] netlink: 76 bytes leftover after parsing attributes in process `syz.2.482'. [ 147.117460][ T7877] netlink: 28 bytes leftover after parsing attributes in process `syz.1.481'. [ 147.144514][ T7865] Bluetooth: hci0: invalid length 0, exp 2 for type 22 [ 147.486853][ T7889] lo: entered allmulticast mode [ 147.541432][ T7888] sctp: [Deprecated]: syz.2.484 (pid 7888) Use of int in maxseg socket option. [ 147.541432][ T7888] Use struct sctp_assoc_value instead [ 148.264879][ T7911] gre1: entered promiscuous mode [ 148.311844][ T7911] gre1: entered allmulticast mode [ 148.343510][ T7886] lo: left allmulticast mode [ 148.411839][ T7915] vxcan0: tx drop: invalid da for name 0x00000000000000c8 [ 149.136062][ T7943] block nbd1: server does not support multiple connections per device. [ 149.154275][ T7948] xt_cgroup: invalid path, errno=-2 [ 149.170823][ T7943] block nbd1: shutting down sockets [ 149.240738][ T7941] netlink: 12 bytes leftover after parsing attributes in process `syz.2.500'. [ 149.374512][ T7956] netlink: 12 bytes leftover after parsing attributes in process `syz.4.504'. [ 149.653419][ T7974] netlink: 'syz.3.508': attribute type 1 has an invalid length. [ 149.662128][ T7974] netlink: 224 bytes leftover after parsing attributes in process `syz.3.508'. [ 149.674247][ T7974] netlink: 8 bytes leftover after parsing attributes in process `syz.3.508'. [ 149.686825][ T7974] nbd: must specify a device to reconfigure [ 149.814436][ T7976] bridge1: port 1(veth3) entered blocking state [ 149.821208][ T7976] bridge1: port 1(veth3) entered disabled state [ 149.827789][ T7976] veth3: entered allmulticast mode [ 149.853586][ T7976] veth3: entered promiscuous mode [ 149.890221][ T7979] bridge1: port 2(veth0_to_bond) entered blocking state [ 149.909066][ T7979] bridge1: port 2(veth0_to_bond) entered disabled state [ 149.920421][ T7979] veth0_to_bond: entered allmulticast mode [ 149.947413][ T7979] veth0_to_bond: entered promiscuous mode [ 150.001484][ T7976] bridge1: port 3(veth5) entered blocking state [ 150.016094][ T7976] bridge1: port 3(veth5) entered disabled state [ 150.024714][ T7976] veth5: entered allmulticast mode [ 150.039277][ T7976] veth5: entered promiscuous mode [ 150.064435][ T7986] syzkaller0: entered promiscuous mode [ 150.091607][ T7986] syzkaller0: entered allmulticast mode [ 150.259355][ T7996] x_tables: duplicate underflow at hook 3 [ 150.414385][ T8003] veth1_macvtap: left promiscuous mode [ 150.430045][ T8003] macsec0: entered promiscuous mode [ 150.465740][ T8003] veth1_macvtap: entered promiscuous mode [ 150.490777][ T8003] macsec0: left promiscuous mode [ 150.549782][ T8009] syzkaller0: entered promiscuous mode [ 150.579128][ T8009] syzkaller0: entered allmulticast mode [ 150.601541][ T8002] netlink: 'syz.0.517': attribute type 30 has an invalid length. [ 150.613945][ T8018] __nla_validate_parse: 3 callbacks suppressed [ 150.613965][ T8018] netlink: 8 bytes leftover after parsing attributes in process `syz.4.521'. [ 150.666309][ T8018] netlink: 'syz.4.521': attribute type 1 has an invalid length. [ 150.684917][ T8018] netlink: 84 bytes leftover after parsing attributes in process `syz.4.521'. [ 150.705866][ T8018] netlink: 4 bytes leftover after parsing attributes in process `syz.4.521'. [ 151.193992][ T8041] netlink: 'syz.0.525': attribute type 11 has an invalid length. [ 151.400539][ T8051] netlink: 20 bytes leftover after parsing attributes in process `syz.3.528'. [ 151.507320][ T8061] Bluetooth: hci0: unsupported parameter 5135 [ 151.523254][ T8061] Bluetooth: hci0: unsupported parameter 8192 [ 151.540079][ T8061] Bluetooth: hci0: unsupported parameter 5135 [ 151.546385][ T8051] ip6gre1: entered promiscuous mode [ 151.563387][ T8061] Bluetooth: hci0: unsupported parameter 8192 [ 151.568260][ T8051] ip6gre1: entered allmulticast mode [ 151.678452][ T8059] netdevsim netdevsim0: loading /lib/firmware/. failed with error -22 [ 151.745012][ T8059] netdevsim netdevsim0: Direct firmware load for . failed with error -22 [ 151.753585][ T8066] netlink: 52 bytes leftover after parsing attributes in process `syz.2.532'. [ 151.753638][ T8066] netlink: 68 bytes leftover after parsing attributes in process `syz.2.532'. [ 151.779952][ T8059] netdevsim netdevsim0: Falling back to sysfs fallback for: . [ 151.977258][ T8074] netlink: 14 bytes leftover after parsing attributes in process `syz.2.534'. [ 152.218443][ T8083] netlink: 4 bytes leftover after parsing attributes in process `syz.4.536'. [ 152.338623][ T8086] dummy0: entered allmulticast mode [ 152.368603][ T8063] netlink: 180 bytes leftover after parsing attributes in process `syz.0.530'. [ 152.564782][ T8096] syzkaller0: entered promiscuous mode [ 152.571002][ T8096] syzkaller0: entered allmulticast mode [ 152.695638][ T8102] netlink: 4 bytes leftover after parsing attributes in process `syz.3.540'. [ 153.196338][ T8109] netdevsim netdevsim1 netdevsim0: entered allmulticast mode [ 153.725882][ T8144] netlink: 'syz.0.553': attribute type 16 has an invalid length. [ 153.734808][ T8144] netlink: 'syz.0.553': attribute type 17 has an invalid length. [ 154.526066][ T8169] tipc: New replicast peer: 172.20.20.170 [ 154.538615][ T8169] tipc: Enabled bearer , priority 10 [ 154.548131][ T8171] tipc: New replicast peer: 0.0.0.0 [ 154.768307][ T8182] sctp: [Deprecated]: syz.0.563 (pid 8182) Use of struct sctp_assoc_value in delayed_ack socket option. [ 154.768307][ T8182] Use struct sctp_sack_info instead [ 154.921904][ T8184] macsec2: entered allmulticast mode [ 154.959309][ T8184] dummy0: entered allmulticast mode [ 155.003406][ T8184] dummy0: entered promiscuous mode [ 155.032920][ T8184] dummy0: left allmulticast mode [ 155.104025][ T8199] IPVS: sync thread started: state = BACKUP, mcast_ifn = vcan0, syncid = 32, id = 0 [ 155.104885][ T8178] bond2: entered promiscuous mode [ 155.176270][ T8178] bond2: entered allmulticast mode [ 155.194354][ T29] dummy0: left promiscuous mode [ 155.505456][ T8220] xt_TCPMSS: Only works on TCP SYN packets [ 155.582887][ T48] IPVS: starting estimator thread 0... [ 155.602563][ T8216] syzkaller0: entered promiscuous mode [ 155.608172][ T8216] syzkaller0: entered allmulticast mode [ 155.680217][ T8229] IPVS: using max 26 ests per chain, 62400 per kthread [ 156.082175][ T5619] Bluetooth: hci4: link tx timeout [ 156.108009][ T5619] Bluetooth: hci4: killing stalled connection 11:aa:aa:aa:aa:aa [ 156.442768][ T8261] netlink: 'syz.2.579': attribute type 1 has an invalid length. [ 157.334123][ T8242] faux_driver regulatory: loading /lib/firmware/regulatory.db failed with error -4 [ 157.348816][ T8242] faux_driver regulatory: Direct firmware load for regulatory.db failed with error -4 [ 157.358536][ T8242] faux_driver regulatory: Falling back to sysfs fallback for: regulatory.db [ 157.416857][ T8261] 8021q: adding VLAN 0 to HW filter on device bond3 [ 157.855284][ T8279] __nla_validate_parse: 6 callbacks suppressed [ 157.855304][ T8279] netlink: 16 bytes leftover after parsing attributes in process `syz.4.582'. [ 157.929786][ T8279] netlink: 16 bytes leftover after parsing attributes in process `syz.4.582'. [ 158.159879][ T5619] Bluetooth: hci4: command 0x0406 tx timeout [ 158.825781][ T8312] netlink: 48 bytes leftover after parsing attributes in process `syz.1.589'. [ 158.941158][ T8315] netlink: 48 bytes leftover after parsing attributes in process `syz.1.589'. [ 159.344730][ T8309] syzkaller0: entered promiscuous mode [ 159.384942][ T8309] syzkaller0: entered allmulticast mode [ 159.848883][ T1014] syzkaller0: tun_net_xmit 70 [ 160.233326][ T8346] IPVS: length: 35 != 24 [ 160.313230][ T8346] tipc: Started in network mode [ 160.380629][ T8346] tipc: Node identity f6bbcf8a2, cluster identity 4711 [ 160.489981][ T8346] tipc: Enabled bearer , priority 0 [ 160.992908][ T8353] syzkaller0: entered promiscuous mode [ 161.034124][ T8353] syzkaller0: entered allmulticast mode [ 161.101918][ T8372] netlink: 4768 bytes leftover after parsing attributes in process `syz.0.597'. [ 161.480145][ T8343] tipc: Resetting bearer [ 161.532231][ T8343] tipc: Disabling bearer [ 161.754322][ T8387] vxcan3: entered promiscuous mode [ 161.770755][ T8393] netlink: 20 bytes leftover after parsing attributes in process `syz.0.601'. [ 161.873941][ T8390] netdevsim netdevsim2 netdevsim0: entered promiscuous mode [ 161.890162][ T8399] netlink: 'syz.1.603': attribute type 11 has an invalid length. [ 162.029789][ T8393] 8021q: VLANs not supported on wg1 [ 162.462152][ T8418] netlink: 4 bytes leftover after parsing attributes in process `syz.1.609'. [ 162.492323][ T8418] netlink: 4 bytes leftover after parsing attributes in process `syz.1.609'. [ 162.514790][ T8421] vlan0: entered promiscuous mode [ 162.533855][ T8421] team0: Port device vlan0 added [ 162.608294][ T8430] netlink: 'syz.4.612': attribute type 1 has an invalid length. [ 162.692889][ T8435] TCP: request_sock_TCPv6: Possible SYN flooding on port [::]:20002. Sending cookies. [ 162.703424][ T8435] TCP: tcp_parse_options: Illegal window scaling value 215 > 14 received [ 162.772556][ T8437] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 163.469799][ T8455] netlink: 28 bytes leftover after parsing attributes in process `syz.1.619'. [ 163.485297][ T8457] netlink: 16 bytes leftover after parsing attributes in process `syz.4.620'. [ 163.935294][ T8464] 8021q: adding VLAN 0 to HW filter on device bond2 [ 163.987899][ T8464] 8021q: adding VLAN 0 to HW filter on device bond3 [ 164.073898][ T6871] bond1: (slave veth5): link status definitely up, 10000 Mbps full duplex [ 164.099163][ T6871] bond1: (slave veth5): making interface the new active one [ 164.123308][ T6871] bond1: active interface up! [ 164.146638][ T8464] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 164.379066][ T8492] netlink: 24 bytes leftover after parsing attributes in process `syz.4.626'. [ 164.446559][ T8488] RDS: rds_bind could not find a transport for ::a:2800:0, load rds_tcp or rds_rdma? [ 164.506482][ T8488] netlink: 24 bytes leftover after parsing attributes in process `syz.4.626'. [ 164.707788][ T8502] netlink: 12 bytes leftover after parsing attributes in process `syz.2.630'. [ 165.412730][ T8537] netlink: 12 bytes leftover after parsing attributes in process `syz.0.636'. [ 165.460194][ T8537] netlink: 12 bytes leftover after parsing attributes in process `syz.0.636'. [ 165.634374][ T8540] netdevsim netdevsim0 : renamed from netdevsim0 (while UP) [ 166.048771][ T8562] netlink: 80 bytes leftover after parsing attributes in process `syz.2.642'. [ 166.187252][ T8565] netlink: 12 bytes leftover after parsing attributes in process `syz.1.643'. [ 166.935495][ T8598] netlink: 8 bytes leftover after parsing attributes in process `syz.2.649'. [ 166.997826][ T8598] netlink: 'syz.2.649': attribute type 1 has an invalid length. [ 167.503427][ T8610] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 167.683958][ T8610] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 168.186110][ T8643] netlink: 'syz.0.660': attribute type 16 has an invalid length. [ 168.526815][ T8657] xt_hashlimit: size too large, truncated to 1048576 [ 168.682187][ T8667] Bluetooth: hci0: invalid length 0, exp 2 for type 25 [ 168.713004][ T8668] Bluetooth: hci0: invalid length 0, exp 2 for type 25 [ 168.742121][ T8667] trusted_key: syz.4.666 sent an empty control message without MSG_MORE. [ 168.922893][ T8673] __nla_validate_parse: 5 callbacks suppressed [ 168.922912][ T8673] netlink: 12 bytes leftover after parsing attributes in process `syz.0.667'. [ 169.017836][ T8673] netlink: 24 bytes leftover after parsing attributes in process `syz.0.667'. [ 169.678745][ T8706] batadv_slave_1: entered promiscuous mode [ 169.770289][ T8702] veth0: entered promiscuous mode [ 169.801668][ T8702] vlan2: entered promiscuous mode [ 170.185513][ T8705] batadv_slave_1: left promiscuous mode [ 170.398047][ T8735] netlink: 'syz.2.678': attribute type 6 has an invalid length. [ 170.406718][ T8728] netlink: 'syz.1.676': attribute type 2 has an invalid length. [ 170.426692][ T8728] netlink: 8 bytes leftover after parsing attributes in process `syz.1.676'. [ 170.435846][ T8735] IPv6: NLM_F_CREATE should be specified when creating new route [ 170.870640][ T8748] netlink: 20 bytes leftover after parsing attributes in process `syz.3.680'. [ 171.064200][ T8728] : entered promiscuous mode [ 171.427985][ T8757] netlink: 8 bytes leftover after parsing attributes in process `syz.3.683'. [ 171.977493][ T8782] bond4 (unregistering): Released all slaves [ 172.148318][ T8785] netlink: 12 bytes leftover after parsing attributes in process `syz.2.687'. [ 172.592279][ T8811] input: Bluetooth HID Boot Protocol Device as /devices/virtual/bluetooth/hci4/hci4:200/input5 [ 172.671896][ T8817] C: renamed from veth1_to_team (while UP) [ 172.745342][ T8817] netlink: 152 bytes leftover after parsing attributes in process `syz.1.693'. [ 172.936589][ T8833] netlink: 2108 bytes leftover after parsing attributes in process `syz.2.696'. [ 173.120927][ T8841] netlink: 136 bytes leftover after parsing attributes in process `syz.0.698'. [ 173.175426][ T8841] netlink: 4 bytes leftover after parsing attributes in process `syz.0.698'. [ 174.215591][ T8870] __nla_validate_parse: 3 callbacks suppressed [ 174.215611][ T8870] netlink: 4 bytes leftover after parsing attributes in process `syz.0.705'. [ 174.271821][ T8872] netlink: 20 bytes leftover after parsing attributes in process `syz.1.707'. [ 174.281275][ T8872] netlink: 36 bytes leftover after parsing attributes in process `syz.1.707'. [ 174.795593][ T8892] pim6reg1: entered promiscuous mode [ 174.801635][ T8892] pim6reg1: entered allmulticast mode [ 174.840731][ T8891] syzkaller0: entered promiscuous mode [ 174.846254][ T8891] syzkaller0: entered allmulticast mode [ 174.924975][ T8891] bond4: entered promiscuous mode [ 174.937115][ T8891] bond4: entered allmulticast mode [ 174.956978][ T8891] 8021q: adding VLAN 0 to HW filter on device bond4 [ 175.026978][ T8904] x_tables: ip_tables: icmp match: only valid for protocol 1 [ 175.391486][ T8924] netlink: 76 bytes leftover after parsing attributes in process `syz.2.716'. [ 175.547601][ T8934] netlink: 36 bytes leftover after parsing attributes in process `syz.0.720'. [ 177.717541][ T8885] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 178.025550][ T8955] netlink: 32 bytes leftover after parsing attributes in process `syz.0.723'. [ 178.360420][ T8971] openvswitch: netlink: Multiple metadata blocks provided [ 178.377502][ T8963] netlink: 8 bytes leftover after parsing attributes in process `syz.1.728'. [ 178.433968][ T8967] netlink: 8 bytes leftover after parsing attributes in process `syz.1.728'. [ 178.651288][ T8982] netlink: 212324 bytes leftover after parsing attributes in process `syz.4.732'. [ 178.670887][ T8982] openvswitch: netlink: Message has 5 unknown bytes. [ 178.707830][ T8982] netlink: 212324 bytes leftover after parsing attributes in process `syz.4.732'. [ 178.773584][ T8982] openvswitch: netlink: Message has 5 unknown bytes. [ 178.804932][ T8982] openvswitch: netlink: Message has 5 unknown bytes. [ 178.827012][ T8986] bridge0: port 2(bridge_slave_1) entered disabled state [ 178.835577][ T8986] bridge0: port 1(bridge_slave_0) entered disabled state [ 178.853749][ T8982] openvswitch: netlink: Message has 5 unknown bytes. [ 178.875611][ T8982] openvswitch: netlink: Message has 5 unknown bytes. [ 178.925496][ T8982] openvswitch: netlink: Message has 5 unknown bytes. [ 178.969269][ T8982] openvswitch: netlink: Message has 5 unknown bytes. [ 179.018578][ T8982] openvswitch: netlink: Message has 5 unknown bytes. [ 179.055298][ T8982] openvswitch: netlink: Message has 5 unknown bytes. [ 179.226720][ T8982] __nla_validate_parse: 63 callbacks suppressed [ 179.226739][ T8982] netlink: 212324 bytes leftover after parsing attributes in process `syz.4.732'. [ 179.283277][ T8982] netlink: 212324 bytes leftover after parsing attributes in process `syz.4.732'. [ 179.309063][ T8982] netlink: 212324 bytes leftover after parsing attributes in process `syz.4.732'. [ 179.663129][ T9018] sctp: [Deprecated]: syz.4.740 (pid 9018) Use of struct sctp_assoc_value in delayed_ack socket option. [ 179.663129][ T9018] Use struct sctp_sack_info instead [ 179.948457][ T9026] netlink: 32 bytes leftover after parsing attributes in process `syz.2.743'. [ 179.983220][ T9031] netlink: 'syz.0.746': attribute type 8 has an invalid length. [ 179.997801][ T9031] netlink: 4 bytes leftover after parsing attributes in process `syz.0.746'. [ 179.998248][ T9030] netlink: 24 bytes leftover after parsing attributes in process `syz.4.745'. [ 180.045561][ T9031] veth1_to_team: entered promiscuous mode [ 180.074879][ T9031] gretap0: entered promiscuous mode [ 180.182881][ T9031] veth1_to_team: left promiscuous mode [ 180.207263][ T9031] gretap0: left promiscuous mode [ 180.356007][ T9044] veth1_macvtap: left promiscuous mode [ 180.377222][ T9044] macsec0: entered promiscuous mode [ 180.422000][ T9044] veth1_macvtap: entered promiscuous mode [ 180.442409][ T9044] macsec0: left promiscuous mode [ 180.452079][ T9046] veth0_to_hsr: entered promiscuous mode [ 180.794191][ T9064] netlink: 24 bytes leftover after parsing attributes in process `syz.2.754'. [ 180.851268][ T9056] 8021q: adding VLAN 0 to HW filter on device bond0 [ 180.944800][ T9056] 8021q: adding VLAN 0 to HW filter on device team0 [ 180.986733][ T9056] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 181.517598][ T9056] bond_slave_0: entered promiscuous mode [ 181.588489][ T9056] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 181.622301][ T9056] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 181.654347][ T9056] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 181.686469][ T9056] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 181.721001][ T9056] virt_wifi0: default qdisc (pfifo_fast) fail, fallback to noqueue [ 181.754392][ T9056] veth1_macvtap: left promiscuous mode [ 181.784646][ T9056] veth0_macvtap: left promiscuous mode [ 181.801774][ T9056] veth0_macvtap: entered promiscuous mode [ 181.824206][ T9056] veth1_macvtap: entered promiscuous mode [ 181.851109][ T9056] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 181.863813][ T9056] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 181.876977][ T9056] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 181.885687][ T9056] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 181.923840][ T9056] 8021q: adding VLAN 0 to HW filter on device bond1 [ 181.944115][ T9056] 8021q: adding VLAN 0 to HW filter on device bond2 [ 182.007524][ T9077] 8021q: VLANs not supported on syzkaller1 [ 182.250118][ T6871] netdevsim netdevsim2 netdevsim0: set [0, 0] type 1 family 0 port 8472 - 0 [ 182.272808][ T6871] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 182.317045][ T6871] netdevsim netdevsim2 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0 [ 182.373723][ T6871] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 182.408559][ T6871] netdevsim netdevsim2 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0 [ 182.453018][ T6871] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 182.475722][ T6871] netdevsim netdevsim2 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0 [ 182.538478][ T6871] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 182.576791][ T9129] netlink: 20 bytes leftover after parsing attributes in process `syz.0.767'. [ 182.615366][ T9120] netlink: 'syz.2.769': attribute type 1 has an invalid length. [ 182.746646][ T9112] xt_CT: No such helper "snmp_trap" [ 183.451911][ T9169] netlink: 28 bytes leftover after parsing attributes in process `syz.3.781'. [ 183.475802][ T9162] netlink: 16 bytes leftover after parsing attributes in process `syz.4.779'. [ 183.782465][ T9182] xt_hashlimit: size too large, truncated to 1048576 [ 184.756626][ T9230] __nla_validate_parse: 3 callbacks suppressed [ 184.756645][ T9230] netlink: 68 bytes leftover after parsing attributes in process `syz.1.796'. [ 184.822564][ T9230] netlink: 16 bytes leftover after parsing attributes in process `syz.1.796'. [ 184.848587][ T9233] netlink: 24 bytes leftover after parsing attributes in process `syz.4.797'. [ 184.878824][ T9230] netlink: 8 bytes leftover after parsing attributes in process `syz.1.796'. [ 185.022445][ T9241] netlink: 4 bytes leftover after parsing attributes in process `syz.2.799'. [ 186.537926][ T9288] netlink: 8 bytes leftover after parsing attributes in process `syz.2.806'. [ 186.624991][ T9291] netlink: 4 bytes leftover after parsing attributes in process `syz.4.805'. [ 186.698927][ T9291] dummy0: left allmulticast mode [ 186.712757][ T9291] bridge0: port 3(dummy0) entered disabled state [ 186.763502][ T9291] bridge_slave_1: left allmulticast mode [ 186.784847][ T9291] bridge0: port 2(bridge_slave_1) entered disabled state [ 186.867174][ T9291] bridge_slave_0: left allmulticast mode [ 186.899941][ T9291] bridge_slave_0: left promiscuous mode [ 186.970487][ T9291] bridge0: port 1(bridge_slave_0) entered disabled state [ 187.213776][ T9313] bond5: entered allmulticast mode [ 187.262871][ T9320] wireguard0: entered promiscuous mode [ 187.272932][ T9320] wireguard0: entered allmulticast mode [ 187.283772][ T9320] bond5: (slave wireguard0): The slave device specified does not support setting the MAC address [ 187.301221][ T9320] bond5: (slave wireguard0): Error -95 calling set_mac_address [ 187.399101][ T9326] netlink: 12 bytes leftover after parsing attributes in process `syz.3.810'. [ 187.706097][ T9328] syzkaller0: entered promiscuous mode [ 187.723651][ T9328] syzkaller0: entered allmulticast mode [ 187.788736][ T9339] dummy0: left promiscuous mode [ 191.126607][ T9394] netlink: 12 bytes leftover after parsing attributes in process `syz.0.827'. [ 191.360750][ T9394] netlink: 12 bytes leftover after parsing attributes in process `syz.0.827'. [ 191.598363][ T9417] tipc: Enabled bearer , priority 0 [ 191.776825][ T9430] netlink: 8 bytes leftover after parsing attributes in process `syz.0.836'. [ 191.898794][ T9426] ip6tnl0: Caught tx_queue_len zero misconfig [ 192.206648][ T9451] syzkaller0: entered promiscuous mode [ 192.213326][ T9438] xt_SECMARK: only valid in 'mangle' or 'security' table, not 'filter' [ 192.239250][ T9451] syzkaller0: entered allmulticast mode [ 192.306168][ T9442] net_ratelimit: 114 callbacks suppressed [ 192.306187][ T9442] Dead loop on virtual device ip6_vti0 (net 38), fix it urgently! [ 192.891097][ T9463] netlink: 12 bytes leftover after parsing attributes in process `syz.4.840'. [ 192.956058][ T9468] Unknown options in mask 6 [ 192.998210][ T9468] openvswitch: netlink: IP tunnel attribute has 5377 unknown bytes. [ 193.055515][ T9472] netlink: 56 bytes leftover after parsing attributes in process `syz.4.840'. [ 194.244720][ T1308] ieee802154 phy0 wpan0: encryption failed: -22 [ 194.253504][ T1308] ieee802154 phy1 wpan1: encryption failed: -22 [ 194.431711][ T9506] netlink: 32 bytes leftover after parsing attributes in process `syz.3.851'. [ 194.510354][ T9511] block nbd1: not configured, cannot reconfigure [ 194.929518][ T9523] tipc: Enabling of bearer rejected, already enabled [ 195.184898][ T9529] tipc: Resetting bearer [ 195.508617][ T9548] netlink: 'syz.2.862': attribute type 10 has an invalid length. [ 195.556161][ T9550] netlink: 4 bytes leftover after parsing attributes in process `syz.1.859'. [ 195.642772][ T9551] netlink: 'syz.4.863': attribute type 1 has an invalid length. [ 195.875184][ T9548] syz_tun: entered promiscuous mode [ 195.949242][ T9548] bond0: (slave syz_tun): Enslaving as an active interface with an up link [ 196.006550][ T9565] netlink: 8 bytes leftover after parsing attributes in process `syz.4.863'. [ 196.923468][ T9598] netlink: 9 bytes leftover after parsing attributes in process `syz.1.872'. [ 196.966855][ T9603] x_tables: duplicate entry at hook 1 [ 197.027761][ T9598] gretap0: entered promiscuous mode [ 197.179024][ T9603] netlink: 12 bytes leftover after parsing attributes in process `syz.0.873'. [ 197.212112][ T9599] smbdirect: ib_dev[syz1]: added: RNIC max_fast_reg_page_list_len=256 device_cap_flags=0x200000 kernel_cap_flags=0x10 page_size_cap=0x1000 [ 197.310898][ T9599] smbdirect: ib_dev[syz1]: num_ports=1 max_qp_rd_atom=128 max_qp_init_rd_atom=128 max_sgl_rd=0 max_sge_rd=1 max_cqe=3276800 max_qp_wr=32768 max_send_sge=6 max_recv_sge=6 [ 197.338617][ T9617] netlink: 11575 bytes leftover after parsing attributes in process `syz.3.876'. [ 197.345071][ T9603] netlink: 'syz.0.873': attribute type 1 has an invalid length. [ 197.415291][ T9599] smbdirect: ib_dev[syz1]PORT[1]: iwarp=1 ib=0 roce=0 v1=0 v2=0 core_cap_flags=0x400008 [ 197.494029][ T9599] iwpm_register_pid: Unable to send a nlmsg (client = 2) [ 197.586700][ T9599] infiniband syz1: RDMA CMA: cma_listen_on_dev, error -98 [ 197.850638][ T9635] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 198.084758][ T9641] netlink: 16 bytes leftover after parsing attributes in process `syz.1.881'. [ 198.186792][ T9641] bond6: option broadcast_neighbor: mode dependency failed, not supported in mode balance-rr(0) [ 198.295135][ T9641] bond6 (unregistering): Released all slaves [ 198.342989][ T9652] tipc: Enabling of bearer rejected, failed to enable media [ 198.353061][ T9655] netlink: 12 bytes leftover after parsing attributes in process `syz.4.887'. [ 198.365894][ T9655] netlink: 20 bytes leftover after parsing attributes in process `syz.4.887'. [ 198.415595][ T9655] netlink: 12 bytes leftover after parsing attributes in process `syz.4.887'. [ 198.459247][ T9660] netlink: 24 bytes leftover after parsing attributes in process `syz.2.886'. [ 198.645130][ T9671] netlink: 'syz.1.889': attribute type 23 has an invalid length. [ 198.715591][ T9673] veth1_macvtap: left promiscuous mode [ 198.722590][ T9675] netlink: 4 bytes leftover after parsing attributes in process `syz.2.891'. [ 199.333140][ T9706] bridge0: port 1(vlan2) entered blocking state [ 199.369502][ T9706] bridge0: port 1(vlan2) entered disabled state [ 199.406310][ T9706] vlan2: entered allmulticast mode [ 199.440703][ T9706] geneve0: entered allmulticast mode [ 199.948228][ T9731] netlink: 20 bytes leftover after parsing attributes in process `syz.0.903'. [ 200.768305][ T9764] netlink: 'syz.3.912': attribute type 4 has an invalid length. [ 200.885513][ T9760] xfrm0: entered allmulticast mode [ 200.963058][ T9760] A link change request failed with some changes committed already. Interface xfrm0 may have been left with an inconsistent configuration, please check. [ 201.044990][ T5269] veth1_macvtap: entered promiscuous mode [ 201.957753][ T9811] netlink: 'syz.3.923': attribute type 4 has an invalid length. [ 201.973986][ T9811] __nla_validate_parse: 4 callbacks suppressed [ 201.974005][ T9811] netlink: 17 bytes leftover after parsing attributes in process `syz.3.923'. [ 202.013503][ T9807] netlink: 24 bytes leftover after parsing attributes in process `syz.1.925'. [ 202.301702][ T9821] netlink: 'syz.2.927': attribute type 15 has an invalid length. [ 202.468246][ T9759] infiniband syz0: set down [ 202.490208][ T9759] infiniband syz0: added ipvlan1 [ 202.499602][ T9829] netlink: 68 bytes leftover after parsing attributes in process `syz.3.929'. [ 202.534307][ T9759] workqueue: Failed to create a rescuer kthread for wq "ib_mad1": -EINTR [ 202.538601][ T9759] infiniband syz0: Couldn't open port 1 [ 202.556724][ T9759] smbdirect: ib_dev[syz0]: added: IB_CA max_fast_reg_page_list_len=512 device_cap_flags=0x1c001223c76 kernel_cap_flags=0x14 page_size_cap=0xfffff000 [ 202.573254][ T9759] smbdirect: ib_dev[syz0]: num_ports=1 max_qp_rd_atom=128 max_qp_init_rd_atom=128 max_sgl_rd=0 max_sge_rd=32 max_cqe=32767 max_qp_wr=1048576 max_send_sge=32 max_recv_sge=32 [ 202.592157][ T9759] smbdirect: ib_dev[syz0]PORT[1]: iwarp=0 ib=0 roce=1 v1=0 v2=1 core_cap_flags=0x803005 [ 202.647032][ T9759] RDS/IB: syz0: added [ 202.669490][ T9759] smc: adding ib device syz0 with port count 1 [ 202.697654][ T9759] smc: ib device syz0 port 1 has no pnetid [ 202.746501][ T9837] netlink: 'syz.1.932': attribute type 4 has an invalid length. [ 202.792505][ T9841] netlink: 28 bytes leftover after parsing attributes in process `syz.0.931'. [ 202.827807][ T9839] netlink: 12 bytes leftover after parsing attributes in process `syz.2.930'. [ 202.927755][ T9839] xfrm1: entered promiscuous mode [ 202.941964][ T9839] xfrm1: entered allmulticast mode [ 203.108341][ T9849] bridge0: port 2(bridge_slave_1) entered blocking state [ 203.115693][ T9849] bridge0: port 2(bridge_slave_1) entered forwarding state [ 203.123353][ T9849] bridge0: port 1(bridge_slave_0) entered blocking state [ 203.130588][ T9849] bridge0: port 1(bridge_slave_0) entered forwarding state [ 203.277233][ T9849] 8021q: adding VLAN 0 to HW filter on device bond5 [ 203.332330][ T9855] netlink: 12 bytes leftover after parsing attributes in process `syz.2.935'. [ 204.142870][ T9885] netlink: 'syz.0.942': attribute type 2 has an invalid length. [ 204.252448][ T9888] netlink: 'syz.0.942': attribute type 1 has an invalid length. [ 204.296768][ T9888] netlink: 228 bytes leftover after parsing attributes in process `syz.0.942'. [ 204.402340][ T9885] : entered promiscuous mode [ 205.833153][ T9933] netlink: 'syz.1.944': attribute type 12 has an invalid length. [ 205.864229][ T9933] netlink: 'syz.1.944': attribute type 29 has an invalid length. [ 205.888331][ T9933] netlink: 148 bytes leftover after parsing attributes in process `syz.1.944'. [ 206.038424][ T9941] erspan0: entered promiscuous mode [ 206.563649][ T50] Bluetooth: hci2: command 0x0401 tx timeout [ 206.569833][ T5612] Bluetooth: hci1: command 0x0406 tx timeout [ 206.570356][ T5617] Bluetooth: hci3: command 0x0406 tx timeout [ 207.163207][ T9969] sctp: [Deprecated]: syz.1.954 (pid 9969) Use of int in maxseg socket option. [ 207.163207][ T9969] Use struct sctp_assoc_value instead [ 207.215539][ T9966] netlink: 'syz.0.953': attribute type 13 has an invalid length. [ 207.869431][ T9985] netlink: 4768 bytes leftover after parsing attributes in process `syz.2.959'. [ 207.889256][ T9985] netlink: 4768 bytes leftover after parsing attributes in process `syz.2.959'. [ 208.077928][ T9989] ip_tables: iptables: counters copy to user failed while replacing table [ 208.128752][ T9991] ip_tables: iptables: counters copy to user failed while replacing table [ 208.630841][T10009] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 208.675070][T10013] xt_TPROXY: Can be used only with -p tcp or -p udp [ 208.715272][ T9983] netlink: 'syz.3.958': attribute type 10 has an invalid length. [ 208.717679][T10014] IPVS: set_ctl: invalid protocol: 29 172.20.20.187:20002 [ 208.731345][ T9983] netlink: 2 bytes leftover after parsing attributes in process `syz.3.958'. [ 208.770095][ T9983] team0: Device wg2 is of different type [ 208.836308][T10014] netlink: 12 bytes leftover after parsing attributes in process `syz.4.963'. [ 208.874003][T10018] netlink: 24 bytes leftover after parsing attributes in process `syz.2.967'. [ 209.076331][T10034] ksmbd: Daemon and kernel module version mismatch. ksmbd: 0, kernel module: 1. User-space ksmbd should terminate. [ 209.143831][T10038] netlink: 24 bytes leftover after parsing attributes in process `syz.3.970'. [ 209.550812][T10052] netlink: 'syz.1.974': attribute type 1 has an invalid length. [ 209.558673][T10053] netlink: 'syz.1.974': attribute type 1 has an invalid length. [ 209.612908][T10053] workqueue: Failed to create a rescuer kthread for wq "bond6": -EINTR [ 209.622874][T10052] workqueue: Failed to create a rescuer kthread for wq "bond6": -EINTR [ 209.813583][T10070] netlink: 12 bytes leftover after parsing attributes in process `syz.4.975'. [ 209.893115][T10060] virt_wifi0: default qdisc (pfifo_fast) fail, fallback to noqueue [ 210.019342][ T6871] bridge1: port 2(veth0_to_bond) entered blocking state [ 210.026561][ T6871] bridge1: port 2(veth0_to_bond) entered forwarding state [ 210.036483][T10074] netlink: 8 bytes leftover after parsing attributes in process `syz.3.977'. [ 210.086801][ T6871] bridge1: port 1(veth3) entered blocking state [ 210.093297][ T6871] bridge1: port 1(veth3) entered forwarding state [ 210.126307][ T6871] bridge1: port 3(veth5) entered blocking state [ 210.132849][ T6871] bridge1: port 3(veth5) entered forwarding state [ 210.204051][T10076] netlink: 20 bytes leftover after parsing attributes in process `syz.0.978'. [ 210.249041][T10076] openvswitch: netlink: Missing key (keys=c0, expected=100) [ 210.430048][ T1014] ip6_tunnel: ip6tnl2 xmit: Local address not yet configured! [ 210.651962][ T30] audit: type=1804 audit(1787240807.252:2): pid=10084 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=open_writers comm="syz.4.981" name="/newroot/185/cgroup.controllers" dev="tmpfs" ino=968 res=1 errno=0 [ 210.683214][T10085] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 210.765485][ T30] audit: type=1800 audit(1787240807.262:3): pid=10084 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.4.981" name="cgroup.controllers" dev="tmpfs" ino=968 res=0 errno=0 [ 211.112176][T10091] ip6tnl1: entered allmulticast mode [ 211.326995][T10109] netlink: 'syz.2.989': attribute type 1 has an invalid length. [ 211.346182][T10109] netlink: 36 bytes leftover after parsing attributes in process `syz.2.989'. [ 212.035029][ T6866] ip6_tunnel: ip6tnl1 xmit: Local address not yet configured! [ 212.057502][ T6866] ip6_tunnel: ip6tnl1 xmit: Local address not yet configured! [ 212.114557][ T29] ip6_tunnel: ip6tnl1 xmit: Local address not yet configured! [ 212.254050][T10123] syz_tun: entered allmulticast mode [ 212.284661][T10116] syz_tun: left allmulticast mode [ 212.440132][ T29] ip6_tunnel: ip6tnl1 xmit: Local address not yet configured! [ 212.500954][ T5711] ip6_tunnel: ip6tnl1 xmit: Local address not yet configured! [ 212.844360][T10160] bridge0: port 2(bridge_slave_1) entered disabled state [ 212.853066][T10160] bridge0: port 1(bridge_slave_0) entered disabled state [ 213.194870][T10177] __nla_validate_parse: 7 callbacks suppressed [ 213.194890][T10177] netlink: 36 bytes leftover after parsing attributes in process `syz.2.1007'. [ 213.400237][T10164] netlink: 'syz.1.1003': attribute type 40 has an invalid length. [ 213.720703][T10193] netlink: 277 bytes leftover after parsing attributes in process `syz.0.1011'. [ 213.931462][T10197] mac80211_hwsim hwsim6 wlan0: entered allmulticast mode [ 213.960704][T10197] mac80211_hwsim hwsim6 wlan0: entered promiscuous mode [ 214.009215][T10197] netlink: 4 bytes leftover after parsing attributes in process `syz.0.1012'. [ 214.042877][T10196] mac80211_hwsim hwsim6 wlan0: left promiscuous mode [ 214.071908][T10196] mac80211_hwsim hwsim6 wlan0: left allmulticast mode [ 214.400207][ C1] ip6_tunnel: ip6tnl2 xmit: Local address not yet configured! [ 215.152484][T10247] netlink: 'syz.4.1023': attribute type 1 has an invalid length. [ 215.387055][T10252] netlink: 8 bytes leftover after parsing attributes in process `syz.2.1024'. [ 215.398594][T10247] 8021q: adding VLAN 0 to HW filter on device bond4 [ 215.406697][T10252] netlink: 12 bytes leftover after parsing attributes in process `syz.2.1024'. [ 215.512407][T10245] bond4: (slave erspan0): making interface the new active one [ 215.544793][T10245] bond4: (slave erspan0): Enslaving as an active interface with an up link [ 215.754927][T10263] netdevsim netdevsim3 netdevsim0: entered allmulticast mode [ 215.924167][T10274] netlink: 16 bytes leftover after parsing attributes in process `syz.0.1031'. [ 216.000313][ C1] ip6_tunnel: ip6tnl1 xmit: Local address not yet configured! [ 216.235391][T10282] syz_tun: left promiscuous mode [ 216.456144][T10294] input: Bluetooth HID Boot Protocol Device as /devices/virtual/bluetooth/hci4/hci4:200/input6 [ 216.518632][T10282] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 216.532746][T10290] netlink: 92 bytes leftover after parsing attributes in process `syz.0.1034'. [ 216.586360][T10282] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 216.757706][T10300] smc: removing ib device syz0 [ 216.937519][T10282] netdevsim netdevsim2 netdevsim0: left promiscuous mode [ 217.075937][T10300] smbdirect: ib_dev[syz0] removed [ 217.207743][T10282] bond2: left promiscuous mode [ 217.225650][T10282] bond2: left allmulticast mode [ 217.339475][T10282] xfrm1: left promiscuous mode [ 217.364039][T10282] xfrm1: left allmulticast mode [ 217.431478][ T8367] netdevsim netdevsim2 netdevsim3: unset [0, 0] type 1 family 0 port 8472 - 0 [ 217.465891][ T8367] netdevsim netdevsim2 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 217.551706][ T8367] netdevsim netdevsim2 netdevsim2: unset [0, 0] type 1 family 0 port 8472 - 0 [ 217.553580][T10333] af_packet: packet size is too long (100663297 > 1484) [ 217.607994][ T8367] netdevsim netdevsim2 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 217.648705][ T8367] netdevsim netdevsim2 netdevsim1: unset [0, 0] type 1 family 0 port 8472 - 0 [ 217.735613][ T8367] netdevsim netdevsim2 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 217.792510][ T8367] netdevsim netdevsim2 netdevsim0: unset [0, 0] type 1 family 0 port 8472 - 0 [ 217.850833][ T8367] netdevsim netdevsim2 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 218.177672][T10353] netlink: 12 bytes leftover after parsing attributes in process `syz.3.1046'. [ 218.475972][T10367] ip_tables: iptables: counters copy to user failed while replacing table [ 218.512979][T10364] ip_tables: iptables: counters copy to user failed while replacing table [ 218.802831][T10373] block nbd3: not configured, cannot reconfigure [ 222.077659][T10467] netlink: 16 bytes leftover after parsing attributes in process `syz.2.1065'. [ 222.174562][T10474] batadv_slave_0: Caught tx_queue_len zero misconfig [ 222.296085][T10475] team0: Port device syz_tun added [ 222.410102][ C1] ip6_tunnel: ip6tnl2 xmit: Local address not yet configured! [ 222.666818][T10413] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 222.749299][T10502] netlink: 76 bytes leftover after parsing attributes in process `syz.1.1073'. [ 222.799502][T10507] netlink: 8 bytes leftover after parsing attributes in process `syz.4.1074'. [ 222.916273][T10509] netlink: 4 bytes leftover after parsing attributes in process `syz.4.1074'. [ 222.998389][T10512] netlink: 'syz.4.1074': attribute type 10 has an invalid length. [ 223.023973][T10515] ip_tunnel: non-ECT from 0.0.0.0 with TOS=0x3 [ 223.028637][T10512] netlink: 2 bytes leftover after parsing attributes in process `syz.4.1074'. [ 223.095376][T10520] netlink: 40 bytes leftover after parsing attributes in process `syz.1.1078'. [ 223.198216][T10509] A link change request failed with some changes committed already. Interface gre2 may have been left with an inconsistent configuration, please check. [ 223.315255][T10512] team0: Device wg2 is of different type [ 223.365848][T10532] netlink: 32 bytes leftover after parsing attributes in process `syz.0.1079'. [ 223.395537][T10532] netlink: 16 bytes leftover after parsing attributes in process `syz.0.1079'. [ 223.497034][T10536] netlink: 32 bytes leftover after parsing attributes in process `syz.4.1082'. [ 223.691118][ C1] ip6_tunnel: ip6tnl1 xmit: Local address not yet configured! [ 224.337113][T10557] netlink: 28 bytes leftover after parsing attributes in process `syz.0.1089'. [ 224.587985][T10562] openvswitch: netlink: VXLAN extension message has 4 unknown bytes. [ 225.400035][T10575] syzkaller1: tun_chr_ioctl cmd 1074025677 [ 225.416346][T10575] syzkaller1: linktype set to 823 [ 225.754719][T10592] netlink: 'syz.0.1098': attribute type 21 has an invalid length. [ 225.804341][T10592] netlink: 'syz.0.1098': attribute type 6 has an invalid length. [ 226.554047][T10626] IPv6: NLM_F_CREATE should be specified when creating new route [ 226.621769][T10629] netlink: 'syz.4.1110': attribute type 1 has an invalid length. [ 226.731946][T10629] bond5: (slave veth3): Enslaving as an active interface with a down link [ 226.762006][T10629] bond5: (slave vlan3): the slave hw address is in use by the bond; couldn't find a slave with a free hw address to give it (this should not have happened) [ 226.915290][T10629] syzkaller0: left promiscuous mode [ 226.940595][T10629] syzkaller0: left allmulticast mode [ 227.198707][T10646] __nla_validate_parse: 4 callbacks suppressed [ 227.198726][T10646] netlink: 52 bytes leftover after parsing attributes in process `syz.4.1116'. [ 227.280515][T10651] netlink: 52 bytes leftover after parsing attributes in process `syz.4.1116'. [ 227.693637][T10663] netlink: 8 bytes leftover after parsing attributes in process `syz.0.1118'. [ 227.728442][T10663] netlink: 'syz.0.1118': attribute type 10 has an invalid length. [ 227.739841][T10663] netlink: 32 bytes leftover after parsing attributes in process `syz.0.1118'. [ 229.928721][T10677] Bluetooth: hci2: Opcode 0x0c1a failed: -4 [ 229.938766][T10677] Bluetooth: hci2: Error when powering off device on rfkill (-4) [ 229.971483][T10677] Bluetooth: hci1: Opcode 0x0c1a failed: -4 [ 229.981645][T10677] Bluetooth: hci1: Error when powering off device on rfkill (-4) [ 230.018310][T10677] Bluetooth: hci3: Opcode 0x0c1a failed: -4 [ 230.051517][T10677] Bluetooth: hci3: Error when powering off device on rfkill (-4) [ 230.082893][T10677] Bluetooth: hci4: Opcode 0x0c1a failed: -4 [ 230.093499][T10677] Bluetooth: hci4: Error when powering off device on rfkill (-4) [ 230.161353][T10650] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 230.178092][T10675] netlink: 12 bytes leftover after parsing attributes in process `syz.0.1120'. [ 230.507156][T10718] netlink: 120 bytes leftover after parsing attributes in process `syz.4.1123'. [ 230.564042][T10718] A link change request failed with some changes committed already. Interface bridge0 may have been left with an inconsistent configuration, please check. [ 231.053902][T10735] netlink: 8 bytes leftover after parsing attributes in process `syz.2.1127'. [ 231.071202][T10735] 8021q: adding VLAN 0 to HW filter on device bond0 [ 231.205408][T10743] sctp: [Deprecated]: syz.3.1128 (pid 10743) Use of struct sctp_assoc_value in delayed_ack socket option. [ 231.205408][T10743] Use struct sctp_sack_info instead [ 231.756324][T10766] netlink: 'syz.1.1136': attribute type 1 has an invalid length. [ 231.819017][T10764] team0 (unregistering): Port device team_slave_0 removed [ 231.821666][T10768] netlink: 'syz.1.1136': attribute type 1 has an invalid length. [ 231.876126][T10764] team0 (unregistering): Port device team_slave_1 removed [ 231.913470][T10773] xt_CONNSECMARK: invalid mode: 254 [ 231.958338][T10764] team0 (unregistering): Port device vlan0 removed [ 232.055449][T10778] IPVS: set_ctl: invalid protocol: 64 224.0.0.2:20004 [ 232.164713][T10781] netlink: 44 bytes leftover after parsing attributes in process `syz.2.1140'. [ 232.236001][T10785] netlink: 12 bytes leftover after parsing attributes in process `syz.4.1143'. [ 232.273057][T10785] netlink: 12 bytes leftover after parsing attributes in process `syz.4.1143'. [ 232.295011][T10785] netlink: 12 bytes leftover after parsing attributes in process `syz.4.1143'. [ 232.334879][T10791] netlink: 32 bytes leftover after parsing attributes in process `syz.3.1144'. [ 232.510485][T10798] netlink: 112 bytes leftover after parsing attributes in process `syz.0.1145'. [ 232.557974][T10803] netlink: 4 bytes leftover after parsing attributes in process `syz.3.1146'. [ 232.570945][T10802] netlink: 4 bytes leftover after parsing attributes in process `syz.4.1148'. [ 232.738912][T10811] netlink: 4 bytes leftover after parsing attributes in process `syz.0.1149'. [ 233.123039][T10811] hsr_slave_0: left promiscuous mode [ 233.173053][T10811] hsr_slave_1: left promiscuous mode [ 233.333707][T10815] netlink: 156 bytes leftover after parsing attributes in process `syz.4.1151'. [ 233.912676][T10839] netlink: 8 bytes leftover after parsing attributes in process `syz.4.1158'. [ 234.088155][T10839] bond6: option ad_actor_sys_prio: invalid value (0) [ 234.126261][T10839] bond6: option ad_actor_sys_prio: allowed values 1 - 65535 [ 234.162876][T10839] bond6 (unregistering): Released all slaves [ 234.203941][T10841] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 234.298948][T10841] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 234.390002][T10854] bridge0: port 2(bridge_slave_1) entered blocking state [ 234.397283][T10854] bridge0: port 2(bridge_slave_1) entered listening state [ 234.404751][T10854] bridge0: port 1(bridge_slave_0) entered blocking state [ 234.411961][T10854] bridge0: port 1(bridge_slave_0) entered listening state [ 234.520992][T10854] A link change request failed with some changes committed already. Interface virt_wifi0 may have been left with an inconsistent configuration, please check. [ 234.577760][T10864] netlink: 'syz.4.1165': attribute type 11 has an invalid length. [ 234.593634][T10864] netlink: 'syz.4.1165': attribute type 4 has an invalid length. [ 234.854272][T10873] netlink: 'syz.2.1168': attribute type 1 has an invalid length. [ 234.988496][T10878] netlink: 'syz.3.1170': attribute type 4 has an invalid length. [ 235.009567][T10878] A link change request failed with some changes committed already. Interface gre1 may have been left with an inconsistent configuration, please check. [ 235.245485][T10887] sit0: entered promiscuous mode [ 235.313435][T10887] netlink: 'syz.0.1172': attribute type 1 has an invalid length. [ 235.344890][T10894] atomic_op ffff88802b8de1e0 conn xmit_atomic 0000000000000000 [ 235.395724][T10894] netlink: 'syz.2.1174': attribute type 1 has an invalid length. [ 235.645147][T10894] bond4: entered promiscuous mode [ 235.680610][T10894] 8021q: adding VLAN 0 to HW filter on device bond4 [ 235.815644][T10904] bond4: (slave bridge1): making interface the new active one [ 235.824825][T10904] bridge1: entered promiscuous mode [ 235.833985][T10904] bond4: (slave bridge1): Enslaving as an active interface with an up link [ 237.119977][ C1] ip6_tunnel: ip6tnl2 xmit: Local address not yet configured! [ 237.449126][T10958] netlink: 'syz.0.1188': attribute type 9 has an invalid length. [ 237.479587][T10958] __nla_validate_parse: 9 callbacks suppressed [ 237.479607][T10958] netlink: 4 bytes leftover after parsing attributes in process `syz.0.1188'. [ 237.562927][T10970] netlink: 28 bytes leftover after parsing attributes in process `syz.2.1189'. [ 237.866429][T10978] netlink: 28 bytes leftover after parsing attributes in process `syz.0.1191'. [ 237.908759][T10978] netlink: 4 bytes leftover after parsing attributes in process `syz.0.1191'. [ 237.961788][T10979] openvswitch: netlink: Missing key (keys=c0, expected=100) [ 238.316295][T10952] IPVS: lblc: SCTP 172.20.20.187:0 - no destination available [ 238.435232][T11002] openvswitch: netlink: Key type 29 is not supported [ 238.545853][T11010] netlink: 12 bytes leftover after parsing attributes in process `syz.1.1200'. [ 238.594223][ T5619] block nbd1: Receive control failed (result -1) [ 238.658932][T11011] netlink: 7 bytes leftover after parsing attributes in process `syz.0.1199'. [ 238.806539][T11014] bridge0: port 1(bridge_slave_0) entered disabled state [ 238.855670][T11014] bridge0: port 2(bridge_slave_1) entered disabled state [ 238.888385][T11014] bridge1: port 2(veth0_to_bond) entered disabled state [ 239.071819][T11014] bridge1: port 1(veth3) entered disabled state [ 239.107396][T11014] bridge1: port 3(veth5) entered disabled state [ 239.240821][T11029] netlink: 51 bytes leftover after parsing attributes in process `syz.3.1204'. [ 239.680216][ C1] ip6_tunnel: ip6tnl1 xmit: Local address not yet configured! [ 240.850788][T11067] netlink: 'syz.0.1210': attribute type 2 has an invalid length. [ 241.491859][T11104] netlink: 'syz.0.1220': attribute type 1 has an invalid length. [ 241.830848][T11094] netlink: 'syz.2.1217': attribute type 30 has an invalid length. [ 241.899471][T11116] syzkaller0: entered promiscuous mode [ 241.922349][T11116] syzkaller0: entered allmulticast mode [ 241.927368][T11119] netlink: 'syz.4.1224': attribute type 3 has an invalid length. [ 241.953279][T11119] netlink: 'syz.4.1224': attribute type 1 has an invalid length. [ 241.981270][T11119] netlink: 232 bytes leftover after parsing attributes in process `syz.4.1224'. [ 242.366848][T11134] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 242.400301][T11135] netlink: 20 bytes leftover after parsing attributes in process `syz.2.1228'. [ 242.553418][T11139] veth1_macvtap: entered allmulticast mode [ 243.007715][T11158] netlink: 'syz.3.1236': attribute type 1 has an invalid length. [ 243.023420][T11156] netlink: 4 bytes leftover after parsing attributes in process `syz.0.1235'. [ 243.222778][T11170] netlink: 28 bytes leftover after parsing attributes in process `syz.3.1236'. [ 243.300959][T11163] bond1: (slave veth3): Enslaving as an active interface with a down link [ 243.454617][T11158] bond1: (slave veth5): Enslaving as an active interface with a down link [ 243.488653][T11181] tipc: Enabling of bearer rejected, failed to enable media [ 243.566048][T11180] sch_tbf: burst 255 is lower than device syzkaller0 mtu (1514) ! [ 243.634470][T11180] netlink: 28 bytes leftover after parsing attributes in process `syz.0.1240'. [ 243.691294][T11180] ip: renamed from virt_wifi0 [ 243.725797][T11186] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 243.766034][T11180] A link change request failed with some changes committed already. Interface ip may have been left with an inconsistent configuration, please check. [ 243.847574][T11181] syzkaller0: entered promiscuous mode [ 243.875544][T11181] syzkaller0: entered allmulticast mode [ 243.913903][T11192] tipc: Enabling of bearer rejected, failed to enable media [ 244.077578][T11203] netlink: 16 bytes leftover after parsing attributes in process `syz.3.1241'. [ 244.096351][T11202] netlink: 'syz.1.1245': attribute type 1 has an invalid length. [ 244.151746][T11208] netlink: 28 bytes leftover after parsing attributes in process `syz.1.1245'. [ 244.252242][T11211] xt_time: invalid argument - start or stop time greater than 23:59:59 [ 244.729449][T11230] netlink: 8 bytes leftover after parsing attributes in process `syz.2.1250'. [ 244.763342][T11230] netlink: 4 bytes leftover after parsing attributes in process `syz.2.1250'. [ 244.777211][T11230] netlink: 'syz.2.1250': attribute type 11 has an invalid length. [ 244.788396][T11230] netlink: 'syz.2.1250': attribute type 14 has an invalid length. [ 244.909494][T11239] netlink: 4 bytes leftover after parsing attributes in process `syz.1.1252'. [ 245.276758][ T30] audit: type=1804 audit(1787240841.872:4): pid=11256 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=open_writers comm="syz.3.1257" name="/newroot/225/cgroup.controllers" dev="tmpfs" ino=1176 res=1 errno=0 [ 245.378632][ T30] audit: type=1800 audit(1787240841.912:5): pid=11256 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.3.1257" name="cgroup.controllers" dev="tmpfs" ino=1176 res=0 errno=0 [ 245.635816][T11266] x_tables: arp_tables: NFQUEUE target: not valid for this family [ 245.661392][T11267] x_tables: arp_tables: NFQUEUE target: not valid for this family [ 245.680255][T11265] Unknown options in mask 6 [ 245.692349][T11265] netlink: 28 bytes leftover after parsing attributes in process `syz.4.1261'. [ 245.708331][T11266] netlink: 40 bytes leftover after parsing attributes in process `syz.1.1260'. [ 245.747280][T11271] netlink: 'syz.4.1261': attribute type 1 has an invalid length. [ 245.757663][T11270] netlink: 'syz.0.1262': attribute type 13 has an invalid length. [ 246.733280][T11313] netlink: 'syz.2.1269': attribute type 2 has an invalid length. [ 246.754339][T11314] netlink: 'syz.2.1269': attribute type 2 has an invalid length. [ 246.790368][T11313] debugfs: '.P'G!DES' already exists in 'ieee80211' [ 247.169135][T11337] netlink: 'syz.0.1274': attribute type 32 has an invalid length. [ 248.133651][T11385] __nla_validate_parse: 9 callbacks suppressed [ 248.133670][T11385] netlink: 44 bytes leftover after parsing attributes in process `syz.0.1284'. [ 248.534291][T11398] netlink: 'syz.0.1289': attribute type 12 has an invalid length. [ 248.543445][T11398] bond0: Caught tx_queue_len zero misconfig [ 248.585031][T11399] IPVS: set_ctl: invalid protocol: 255 0.0.0.0:20004 [ 248.757297][T11403] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 248.821244][T11403] netlink: 12 bytes leftover after parsing attributes in process `syz.0.1290'. [ 248.846421][T11410] netlink: 'syz.4.1292': attribute type 4 has an invalid length. [ 249.012815][T11410] netlink: 22 bytes leftover after parsing attributes in process `syz.4.1292'. [ 249.045149][T11415] netlink: 24 bytes leftover after parsing attributes in process `syz.3.1293'. [ 249.066693][T11411] netlink: 'syz.4.1292': attribute type 4 has an invalid length. [ 249.473030][T11429] netlink: 40 bytes leftover after parsing attributes in process `syz.4.1296'. [ 250.561222][T11489] syzkaller0: entered promiscuous mode [ 250.577179][T11489] syzkaller0: entered allmulticast mode [ 250.592144][T11489] tipc: Enabling of bearer rejected, already enabled [ 251.148511][T11528] openvswitch: netlink: Key type 16360 is out of range max 32 [ 251.217230][T11528] tipc: Enabled bearer , priority 0 [ 251.248985][T11534] netlink: 12 bytes leftover after parsing attributes in process `syz.4.1318'. [ 251.302250][T11532] xt_addrtype: ipv6 PROHIBIT (THROW, NAT ..) matching not supported [ 251.335512][T11528] syzkaller0: entered promiscuous mode [ 251.341664][T11528] syzkaller0: entered allmulticast mode [ 251.347839][T11528] tipc: Resetting bearer [ 251.425483][T11528] tipc: Resetting bearer [ 251.880466][T11552] netlink: 68 bytes leftover after parsing attributes in process `syz.1.1323'. [ 252.241595][T11562] netlink: 40 bytes leftover after parsing attributes in process `syz.3.1325'. [ 253.423212][T11528] tipc: Disabling bearer [ 253.453201][ T5750] tipc: Node number set to 2130706433 [ 253.678993][T11577] netlink: 12 bytes leftover after parsing attributes in process `syz.2.1328'. [ 253.764176][T11577] Bluetooth: MGMT ver 1.23 [ 254.035699][T11598] netlink: 156 bytes leftover after parsing attributes in process `syz.1.1332'. [ 254.221260][T11601] netlink: 4 bytes leftover after parsing attributes in process `syz.4.1333'. [ 254.657200][T11617] netlink: 'syz.0.1336': attribute type 1 has an invalid length. [ 254.796391][T11617] 8021q: adding VLAN 0 to HW filter on device bond2 [ 254.812477][T11622] x_tables: duplicate underflow at hook 1 [ 254.819778][T11622] x_tables: duplicate underflow at hook 1 [ 255.329345][T11646] netlink: 'syz.1.1343': attribute type 11 has an invalid length. [ 255.681142][ T1308] ieee802154 phy0 wpan0: encryption failed: -22 [ 256.626010][T11692] bond3: option ad_actor_sys_prio: mode dependency failed, not supported in mode broadcast(3) [ 256.706857][T11707] netlink: 12 bytes leftover after parsing attributes in process `syz.3.1359'. [ 256.718114][T11692] bond3 (unregistering): Released all slaves [ 256.986707][T11709] bridge1: port 1(veth0_to_bond) entered blocking state [ 257.020057][T11709] bridge1: port 1(veth0_to_bond) entered disabled state [ 257.041796][T11709] veth0_to_bond: entered allmulticast mode [ 257.077485][T11709] veth0_to_bond: entered promiscuous mode [ 257.215830][T11731] netlink: 8 bytes leftover after parsing attributes in process `syz.0.1362'. [ 258.188193][T11764] netlink: 16 bytes leftover after parsing attributes in process `syz.1.1368'. [ 258.204150][T11757] block nbd2: server does not support multiple connections per device. [ 258.240861][T11757] block nbd2: shutting down sockets [ 258.705671][T11786] netlink: 28 bytes leftover after parsing attributes in process `syz.1.1370'. [ 259.698326][T11819] netlink: 8 bytes leftover after parsing attributes in process `syz.2.1380'. [ 259.735784][T11819] netlink: 'syz.2.1380': attribute type 30 has an invalid length. [ 259.793140][T11822] netlink: 8 bytes leftover after parsing attributes in process `syz.2.1380'. [ 259.907591][T11822] netlink: 'syz.2.1380': attribute type 30 has an invalid length. [ 259.921147][T11819] vxlan2: entered promiscuous mode [ 259.949873][T11819] vxlan2: entered allmulticast mode [ 259.962640][ T13] netdevsim netdevsim2 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0 [ 260.035777][T11822] vxlan3: entered promiscuous mode [ 260.059427][T11822] vxlan3: entered allmulticast mode [ 260.093073][ T1000] netdevsim netdevsim2 netdevsim0: set [0, 0] type 1 family 0 port 8472 - 0 [ 260.162539][ T8367] netdevsim netdevsim2 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0 [ 260.203595][ T8367] netdevsim netdevsim2 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0 [ 260.294034][T11842] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 260.364324][T11848] netlink: 4 bytes leftover after parsing attributes in process `syz.4.1383'. [ 260.520183][T11858] netlink: 4 bytes leftover after parsing attributes in process `syz.0.1387'. [ 260.967003][T11878] netlink: 'syz.2.1390': attribute type 1 has an invalid length. [ 261.139930][T11884] netlink: 'syz.2.1390': attribute type 10 has an invalid length. [ 261.168403][T11884] netlink: 40 bytes leftover after parsing attributes in process `syz.2.1390'. [ 261.200680][T11878] 8021q: adding VLAN 0 to HW filter on device bond5 [ 261.284248][T11872] bridge0: port 1(bridge_slave_0) entered disabled state [ 262.022447][T11907] sctp: [Deprecated]: syz.1.1396 (pid 11907) Use of int in max_burst socket option deprecated. [ 262.022447][T11907] Use struct sctp_assoc_value instead [ 262.438307][T11937] netlink: 8 bytes leftover after parsing attributes in process `syz.0.1404'. [ 262.548600][T11942] netlink: 8 bytes leftover after parsing attributes in process `syz.0.1404'. [ 262.590669][T11941] nbd: must specify a device to reconfigure [ 262.604910][T11939] ipvlan2: entered promiscuous mode [ 262.634482][T11939] bridge0: port 3(ipvlan2) entered blocking state [ 262.664627][T11939] bridge0: port 3(ipvlan2) entered disabled state [ 262.702607][T11939] ipvlan2: entered allmulticast mode [ 262.721216][T11939] bridge0: entered allmulticast mode [ 262.743389][T11939] ipvlan2: left allmulticast mode [ 262.755870][T11939] bridge0: left allmulticast mode [ 263.174002][T11965] syzkaller0: entered promiscuous mode [ 263.195872][T11965] syzkaller0: entered allmulticast mode [ 263.276938][T11968] netlink: 28 bytes leftover after parsing attributes in process `syz.0.1412'. [ 264.653407][ C1] bridge0: port 1(bridge_slave_0) entered learning state [ 264.661816][ C1] bridge0: port 2(bridge_slave_1) entered learning state [ 265.973769][T12045] xt_hashlimit: size too large, truncated to 1048576 [ 266.078585][T12047] netlink: 8 bytes leftover after parsing attributes in process `syz.4.1425'. [ 266.560282][ C1] ip6_tunnel: ip6tnl2 xmit: Local address not yet configured! [ 267.072723][T12086] netlink: 55631 bytes leftover after parsing attributes in process `syz.0.1435'. [ 267.193884][T12086] netlink: 20 bytes leftover after parsing attributes in process `syz.0.1435'. [ 267.711248][T12116] netlink: 24 bytes leftover after parsing attributes in process `syz.2.1441'. [ 267.768831][T12116] netlink: 24 bytes leftover after parsing attributes in process `syz.2.1441'. [ 268.252034][T12137] netlink: 72 bytes leftover after parsing attributes in process `syz.1.1444'. [ 268.620911][T12109] bridge1: port 2(veth0_to_bond) entered disabled state [ 268.651239][T12109] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 268.877211][T12136] A link change request failed with some changes committed already. Interface team0 may have been left with an inconsistent configuration, please check. [ 268.921368][ T6868] netdevsim netdevsim0 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 268.951032][ T6868] netdevsim netdevsim0 : unset [1, 0] type 2 family 0 port 6081 - 0 [ 269.004195][ T6868] netdevsim netdevsim0 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 269.036219][ T6868] netdevsim netdevsim0 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 269.304514][ T6876] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 269.347491][ T6876] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 269.838177][T12193] pimreg: entered allmulticast mode [ 270.191005][T12179] pimreg: left allmulticast mode [ 270.416003][T12214] sit3: entered promiscuous mode [ 270.596220][T12220] x_tables: ip6_tables: set.2 match: invalid size 8 (kernel) != (user) 16 [ 270.735755][T12225] netlink: 8 bytes leftover after parsing attributes in process `syz.4.1464'. [ 270.802087][T12229] netlink: 4 bytes leftover after parsing attributes in process `syz.3.1465'. [ 270.815396][T12228] bond0: (slave syz_tun): Releasing backup interface [ 270.846375][T12228] bond0: (slave bond_slave_0): Releasing backup interface [ 270.871346][T12228] bond0: (slave bond_slave_1): Releasing backup interface [ 270.893376][T12228] team0: Port device team_slave_0 removed [ 270.903687][T12228] team0: Port device team_slave_1 removed [ 270.910606][T12228] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 270.922740][T12228] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 270.938257][T12228] A link change request failed with some changes committed already. Interface hsr_slave_0 may have been left with an inconsistent configuration, please check. [ 271.292658][T12236] netlink: 68 bytes leftover after parsing attributes in process `syz.0.1467'. [ 271.679860][ C1] ip6_tunnel: ip6tnl1 xmit: Local address not yet configured! [ 272.037892][T12264] sctp: [Deprecated]: syz.4.1476 (pid 12264) Use of struct sctp_assoc_value in delayed_ack socket option. [ 272.037892][T12264] Use struct sctp_sack_info instead [ 272.152886][T12269] netlink: 40 bytes leftover after parsing attributes in process `syz.0.1478'. [ 272.311200][T12274] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 272.594865][T12282] netlink: 814 bytes leftover after parsing attributes in process `syz.0.1482'. [ 272.673717][T12282] netlink: 814 bytes leftover after parsing attributes in process `syz.0.1482'. [ 273.000646][T12301] ip_tables: iptables: counters copy to user failed while replacing table [ 273.086284][T12300] vlan0: entered promiscuous mode [ 273.113094][T12300] bridge0: entered promiscuous mode [ 273.327728][T12315] netlink: 'syz.2.1490': attribute type 1 has an invalid length. [ 273.422469][T12322] ip_tables: iptables: counters copy to user failed while replacing table [ 273.523254][T12315] 8021q: adding VLAN 0 to HW filter on device bond6 [ 273.674234][T12324] x_tables: duplicate underflow at hook 1 [ 273.691773][T12321] bond6: (slave geneve2): making interface the new active one [ 273.713256][T12321] bond6: (slave geneve2): Enslaving as an active interface with an up link [ 273.943263][T12326] netlink: 20 bytes leftover after parsing attributes in process `syz.0.1494'. [ 274.048172][T12335] netlink: 564 bytes leftover after parsing attributes in process `syz.1.1496'. [ 274.140304][ T8367] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 274.175187][ T8367] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 274.289907][ T1000] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 274.552909][T12317] netlink: 'syz.4.1489': attribute type 3 has an invalid length. [ 274.597614][T12317] netlink: 8 bytes leftover after parsing attributes in process `syz.4.1489'. [ 274.679942][ T1000] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 274.895899][T12348] openvswitch: netlink: Mixed IPv4 and IPv6 tunnel attributes [ 274.984989][T12350] netlink: 20 bytes leftover after parsing attributes in process `syz.0.1501'. [ 275.003521][T12351] netlink: zone id is out of range [ 275.028379][T12351] netlink: zone id is out of range [ 275.047088][T12351] netlink: zone id is out of range [ 275.066763][T12351] netlink: zone id is out of range [ 275.086468][T12351] netlink: zone id is out of range [ 275.103618][T12351] netlink: zone id is out of range [ 275.122225][T12351] netlink: zone id is out of range [ 275.150152][T12351] netlink: zone id is out of range [ 275.173910][T12351] netlink: zone id is out of range [ 275.187183][T12350] macvlan2: entered promiscuous mode [ 275.229788][T12350] erspan0: entered promiscuous mode [ 275.272895][T12350] erspan0: left promiscuous mode [ 275.565519][T12358] netlink: 8 bytes leftover after parsing attributes in process `syz.4.1503'. [ 275.680725][T12362] netdevsim netdevsim2 netdevsim3: unset [0, 0] type 1 family 0 port 8472 - 0 [ 275.701364][T12362] netdevsim netdevsim2 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 275.815451][T12367] lo: Caught tx_queue_len zero misconfig [ 275.835075][T12367] netlink: 8 bytes leftover after parsing attributes in process `syz.0.1506'. [ 275.873063][T12370] netlink: 'syz.4.1507': attribute type 7 has an invalid length. [ 276.040873][ T12] netdevsim netdevsim4 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0 [ 276.064577][T12377] Bluetooth: ISO socket layer initialized [ 276.070127][ T12] netdevsim netdevsim4 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0 [ 276.130097][ T12] netdevsim netdevsim4 netdevsim0: set [0, 0] type 1 family 0 port 8472 - 0 [ 276.212813][ T480] netdevsim netdevsim4 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0 [ 276.549473][T12398] netlink: 44 bytes leftover after parsing attributes in process `syz.1.1512'. [ 277.128135][T12425] netlink: 28 bytes leftover after parsing attributes in process `syz.1.1517'. [ 277.170751][T12425] netlink: 28 bytes leftover after parsing attributes in process `syz.1.1517'. [ 277.264818][T12429] ip6gretap0: entered promiscuous mode [ 277.289911][T12429] macvtap1: entered promiscuous mode [ 277.295839][T12432] netlink: 16 bytes leftover after parsing attributes in process `syz.0.1520'. [ 277.314288][T12429] macvtap1: entered allmulticast mode [ 277.340425][T12429] ip6gretap0: entered allmulticast mode [ 277.852434][T12429] ip6gretap0: left allmulticast mode [ 277.875300][T12429] ip6gretap0: left promiscuous mode [ 278.188067][T12434] bond7 (unregistering): Released all slaves [ 278.259054][ T5269] netdevsim netdevsim2 netdevsim3: default qdisc (pfifo_fast) fail, fallback to noqueue [ 278.351060][ T5269] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 278.660508][T12461] netlink: 8 bytes leftover after parsing attributes in process `syz.2.1525'. [ 278.767402][T12469] netlink: 212396 bytes leftover after parsing attributes in process `syz.3.1527'. [ 279.288907][T12502] netlink: 'syz.2.1538': attribute type 21 has an invalid length. [ 279.310281][T12502] netlink: 132 bytes leftover after parsing attributes in process `syz.2.1538'. [ 279.332619][T12502] netlink: 'syz.2.1538': attribute type 1 has an invalid length. [ 279.746703][T12516] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 279.814931][T12516] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 279.852731][T12516] ip6gre1: left promiscuous mode [ 279.898518][T12516] 8021q: adding VLAN 0 to HW filter on device bond1 [ 279.915939][ T6084] bridge1: port 1(veth0_to_bond) entered blocking state [ 279.923090][ T6084] bridge1: port 1(veth0_to_bond) entered forwarding state [ 280.079749][ T6868] netdevsim netdevsim3 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0 [ 280.092089][ T13] bond1: (slave veth3): link status definitely up, 10000 Mbps full duplex [ 280.102338][ T13] bond1: (slave veth5): link status definitely up, 10000 Mbps full duplex [ 280.117797][ T13] bond1: (slave veth3): making interface the new active one [ 280.128787][ T13] bond1: active interface up! [ 280.329932][ T13] netdevsim netdevsim3 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0 [ 280.356021][T12537] netlink: 16 bytes leftover after parsing attributes in process `syz.2.1545'. [ 280.365684][T12533] netlink: 'syz.3.1543': attribute type 11 has an invalid length. [ 280.410841][ T1000] netdevsim netdevsim3 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0 [ 280.428740][T12526] netlink: 36 bytes leftover after parsing attributes in process `syz.0.1542'. [ 280.458963][ T1000] netdevsim netdevsim3 netdevsim0: set [0, 0] type 1 family 0 port 8472 - 0 [ 280.604777][T12546] netlink: 32 bytes leftover after parsing attributes in process `syz.4.1547'. [ 281.237605][T12566] netlink: 'syz.3.1553': attribute type 6 has an invalid length. [ 281.680557][T12578] net_ratelimit: 1716 callbacks suppressed [ 281.680577][T12578] ip_tables: iptables: counters copy to user failed while replacing table [ 281.848221][T12578] __nla_validate_parse: 1 callbacks suppressed [ 281.848240][T12578] netlink: 8 bytes leftover after parsing attributes in process `syz.2.1556'. [ 281.913916][T12586] netlink: 44 bytes leftover after parsing attributes in process `syz.3.1559'. [ 281.956354][T12578] 8021q: adding VLAN 0 to HW filter on device macvlan0 [ 282.235872][T12595] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 282.464715][T12601] macvtap0: entered promiscuous mode [ 282.532885][T12604] netlink: 60 bytes leftover after parsing attributes in process `syz.3.1563'. [ 282.716444][T12609] syzkaller1: entered promiscuous mode [ 282.736133][T12609] syzkaller1: entered allmulticast mode [ 282.762919][T12609] netlink: 12 bytes leftover after parsing attributes in process `syz.3.1565'. [ 282.780820][T12609] netlink: 12 bytes leftover after parsing attributes in process `syz.3.1565'. [ 282.790694][T12615] netlink: 4 bytes leftover after parsing attributes in process `syz.1.1567'. [ 282.802725][T12614] netlink: 12 bytes leftover after parsing attributes in process `syz.1.1567'. [ 282.828538][T12614] netlink: 12 bytes leftover after parsing attributes in process `syz.1.1567'. [ 283.040993][T12621] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 283.094655][T12622] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 283.244087][T12631] openvswitch: netlink: Port 856954028 exceeds max allowable 65535 [ 283.261701][T12632] netlink: 'syz.3.1572': attribute type 11 has an invalid length. [ 283.325037][T12634] netlink: 20 bytes leftover after parsing attributes in process `syz.4.1575'. [ 283.350550][T12637] netlink: 8 bytes leftover after parsing attributes in process `syz.1.1576'. [ 283.351228][T12634] openvswitch: netlink: Missing key (keys=c0, expected=20080) [ 283.437337][T12637] netlink: 'syz.1.1576': attribute type 10 has an invalid length. [ 286.196489][T12668] bond6: (slave bridge7): Enslaving as an active interface with an up link [ 286.226299][T12682] IPVS: Error connecting to the multicast addr [ 286.455439][T12696] veth1_to_bond: entered allmulticast mode [ 286.482088][T12696] veth1_to_bond: entered promiscuous mode [ 286.553911][T12694] veth1_to_bond: left promiscuous mode [ 286.577950][T12694] veth1_to_bond: left allmulticast mode [ 287.099158][T12722] tap0: tun_chr_ioctl cmd 1074025677 [ 287.140439][T12722] tap0: linktype set to 778 [ 287.213267][T12722] __nla_validate_parse: 5 callbacks suppressed [ 287.213286][T12722] netlink: 8 bytes leftover after parsing attributes in process `syz.0.1594'. [ 287.282023][T12730] netlink: 28 bytes leftover after parsing attributes in process `syz.0.1594'. [ 287.334807][T12722] netlink: 16 bytes leftover after parsing attributes in process `syz.0.1594'. [ 287.585500][T12735] syzkaller1: left promiscuous mode [ 287.601353][T12735] syzkaller1: left allmulticast mode [ 287.613373][T12730] nbd2: detected capacity change from 0 to 127 [ 287.844043][T12747] netlink: 'syz.2.1599': attribute type 16 has an invalid length. [ 287.860412][ T5619] block nbd2: Receive control failed (result -104) [ 287.874858][T12747] netlink: 'syz.2.1599': attribute type 17 has an invalid length. [ 287.977240][T12750] syzkaller0: left promiscuous mode [ 288.014918][T12750] syzkaller0: left allmulticast mode [ 288.102171][T12753] nbd1: detected capacity change from 0 to 2 [ 288.162704][ T1571] block nbd1: Dead connection, failed to find a fallback [ 288.238548][T12762] netlink: 12 bytes leftover after parsing attributes in process `syz.2.1605'. [ 288.450977][T12772] syzkaller1: entered promiscuous mode [ 288.463330][T12772] syzkaller1: entered allmulticast mode [ 288.496806][T12772] netlink: 'syz.4.1609': attribute type 1 has an invalid length. [ 288.513758][T12772] netlink: 4 bytes leftover after parsing attributes in process `syz.4.1609'. [ 288.538681][T12774] netlink: 4 bytes leftover after parsing attributes in process `syz.3.1610'. [ 288.593491][T12778] netlink: 4 bytes leftover after parsing attributes in process `syz.3.1610'. [ 288.717069][T12783] lo: entered allmulticast mode [ 288.736120][T12783] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 289.192980][T12801] ip_tables: iptables: counters copy to user failed while replacing table [ 289.360537][T12811] siw: device registration error -23 [ 289.520932][T12816] netlink: 8 bytes leftover after parsing attributes in process `syz.2.1621'. [ 289.570587][T12818] netlink: 8 bytes leftover after parsing attributes in process `syz.1.1622'. [ 289.721251][T12816] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 289.893163][T12826] bond3: option xmit_hash_policy: invalid value (10) [ 289.907250][T12826] bond3 (unregistering): Released all slaves [ 289.907902][T12829] netlink: 'syz.0.1626': attribute type 1 has an invalid length. [ 290.059002][T12832] Cannot find del_set index 4 as target [ 290.326663][T12838] netlink: 40 bytes leftover after parsing attributes in process `syz.4.1630'. [ 290.519557][T12854] netlink: 'syz.1.1635': attribute type 10 has an invalid length. [ 290.526859][T12852] Bluetooth: hci0: unsupported parameter 5135 [ 290.544535][T12852] Bluetooth: hci0: invalid len left 4, exp >= 20 [ 290.571964][T12854] team0: Device wg2 is of different type [ 290.632694][T12857] netlink: 'syz.4.1637': attribute type 1 has an invalid length. [ 290.825247][T12872] netlink: 'syz.1.1641': attribute type 11 has an invalid length. [ 290.861102][T12858] gretap1: entered allmulticast mode [ 290.873361][T12858] bond6: (slave gretap1): making interface the new active one [ 290.883701][T12858] bond6: (slave gretap1): Enslaving as an active interface with an up link [ 290.968647][T12880] block nbd2: Connection timed out, retrying (0/1 alive) [ 290.983034][T12880] block nbd2: Connection timed out, retrying (0/1 alive) [ 290.990792][ T25] block nbd2: Dead connection, failed to find a fallback [ 291.007283][T12880] block nbd2: Connection timed out, retrying (0/1 alive) [ 291.015415][ T25] block nbd2: shutting down sockets [ 291.021802][T12880] block nbd2: Connection timed out, retrying (0/1 alive) [ 291.031257][ T25] I/O error, dev nbd2, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 291.048025][ T25] Buffer I/O error on dev nbd2, logical block 0, async page read [ 291.057672][ T25] I/O error, dev nbd2, sector 6 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 291.068093][ T25] Buffer I/O error on dev nbd2, logical block 3, async page read [ 291.076253][ T25] I/O error, dev nbd2, sector 4 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 291.085935][ T25] Buffer I/O error on dev nbd2, logical block 2, async page read [ 291.095592][ T25] I/O error, dev nbd2, sector 2 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 291.105311][ T25] Buffer I/O error on dev nbd2, logical block 1, async page read [ 291.115990][ T25] I/O error, dev nbd2, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 4 prio class 2 [ 291.128361][ T25] Buffer I/O error on dev nbd2, logical block 0, async page read [ 291.136380][ T25] Buffer I/O error on dev nbd2, logical block 1, async page read [ 291.144353][ T25] Buffer I/O error on dev nbd2, logical block 2, async page read [ 291.152455][ T25] Buffer I/O error on dev nbd2, logical block 3, async page read [ 291.164915][ T25] I/O error, dev nbd2, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 4 prio class 2 [ 291.175451][ T25] Buffer I/O error on dev nbd2, logical block 0, async page read [ 291.183456][ T25] Buffer I/O error on dev nbd2, logical block 1, async page read [ 291.193281][ T25] I/O error, dev nbd2, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 291.204086][ T25] I/O error, dev nbd2, sector 2 op 0x0:(READ) flags 0x800000 phys_seg 3 prio class 2 [ 291.214394][ T25] I/O error, dev nbd2, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 291.232681][ T1626] I/O error, dev nbd2, sector 2 op 0x0:(READ) flags 0x800000 phys_seg 3 prio class 2 [ 291.248651][ T6906] ldm_validate_partition_table(): Disk read failed. [ 291.290613][ T6906] Dev nbd2: unable to read RDB block 0 [ 291.302030][ T6906] nbd2: unable to read partition table [ 291.334741][ T6906] ldm_validate_partition_table(): Disk read failed. [ 291.343115][ T6906] Dev nbd2: unable to read RDB block 0 [ 291.350553][ T6906] nbd2: unable to read partition table [ 291.795393][T12908] openvswitch: netlink: EtherType 2 is less than min 600 [ 291.877399][T12908] netlink: 'syz.3.1650': attribute type 13 has an invalid length. [ 292.246103][T12925] vlan2: entered allmulticast mode [ 292.465323][T12931] bond7 (unregistering): Released all slaves [ 292.522321][T12934] veth0: Caught tx_queue_len zero misconfig [ 292.566041][T12940] __nla_validate_parse: 5 callbacks suppressed [ 292.566061][T12940] netlink: 8 bytes leftover after parsing attributes in process `syz.1.1654'. [ 292.592356][T12940] netlink: 8 bytes leftover after parsing attributes in process `syz.1.1654'. [ 292.601490][T12940] A link change request failed with some changes committed already. Interface batadv0 may have been left with an inconsistent configuration, please check. [ 292.667664][T12942] bond4 (unregistering): Released all slaves [ 293.022001][T12964] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 293.042125][ C1] vxcan1: j1939_tp_rxtimer: 0xffff88807eb56400: rx timeout, send abort [ 293.083922][T12966] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 293.117811][T12964] syzkaller1: entered promiscuous mode [ 293.204126][ T1571] block nbd1: shutting down sockets [ 293.212760][ T5616] ldm_validate_partition_table(): Disk read failed. [ 293.222271][ T5616] Dev nbd1: unable to read RDB block 0 [ 293.228758][ T5616] nbd1: unable to read partition table [ 293.234333][T12964] syzkaller1: entered allmulticast mode [ 293.241025][ T5616] nbd1: partition table beyond EOD, truncated [ 293.264578][T12966] xt_cluster: you have exceeded the maximum number of cluster nodes (524288 > 32) [ 293.299933][ T5616] ldm_validate_partition_table(): Disk read failed. [ 293.334348][ T5616] Dev nbd1: unable to read RDB block 0 [ 293.363430][ T5616] nbd1: unable to read partition table [ 293.388758][ T5616] nbd1: partition table beyond EOD, truncated [ 293.501092][T12986] gtp0: entered promiscuous mode [ 293.506226][T12986] gtp0: entered allmulticast mode [ 293.514273][T12986] team0: Device gtp0 is of different type [ 293.553074][ C1] vxcan1: j1939_tp_rxtimer: 0xffff88807eb56400: abort rx timeout. Force session deactivation [ 293.801309][T12994] netlink: 8 bytes leftover after parsing attributes in process `syz.1.1668'. [ 293.823991][T12994] netlink: 'syz.1.1668': attribute type 10 has an invalid length. [ 293.843607][T12994] netlink: 12 bytes leftover after parsing attributes in process `syz.1.1668'. [ 294.167682][T13009] xt_ecn: cannot match TCP bits for non-tcp packets [ 294.298366][T13014] netlink: 12 bytes leftover after parsing attributes in process `syz.1.1674'. [ 294.322439][T13015] netlink: 'syz.4.1673': attribute type 1 has an invalid length. [ 294.396416][T13010] netlink: 8 bytes leftover after parsing attributes in process `syz.4.1673'. [ 294.417337][T13010] netlink: 8 bytes leftover after parsing attributes in process `syz.4.1673'. [ 294.616928][T13017] bond7: option primary: mode dependency failed, not supported in mode balance-rr(0) [ 294.719756][ C1] bridge0: port 2(bridge_slave_1) entered forwarding state [ 294.727047][ C1] bridge0: topology change detected, propagating [ 294.733921][ C1] bridge0: port 1(bridge_slave_0) entered forwarding state [ 294.741198][ C1] bridge0: topology change detected, propagating [ 294.900750][T13034] xt_hashlimit: max too large, truncated to 1048576 [ 294.913819][T13017] bond7 (unregistering): Released all slaves [ 294.962285][T13044] netlink: 36 bytes leftover after parsing attributes in process `syz.0.1682'. [ 295.308671][T13057] netlink: 428 bytes leftover after parsing attributes in process `syz.3.1685'. [ 295.484977][T13061] netlink: 8 bytes leftover after parsing attributes in process `syz.2.1687'. [ 296.456282][T13105] netlink: 'syz.1.1701': attribute type 1 has an invalid length. [ 296.611566][T13113] nbd: must specify a size in bytes for the device [ 296.628951][T13113] xt_policy: output policy not valid in PREROUTING and INPUT [ 296.642558][T13105] netlink: 'syz.1.1701': attribute type 11 has an invalid length. [ 296.841657][T13110] bond7: (slave geneve3): making interface the new active one [ 296.856737][T13110] bond7: (slave geneve3): Enslaving as an active interface with an up link [ 296.870852][ T6084] netdevsim netdevsim1 netdevsim0: set [1, 1] type 2 family 0 port 20000 - 0 [ 296.906968][ T6084] netdevsim netdevsim1 netdevsim3: set [1, 1] type 2 family 0 port 20000 - 0 [ 296.922151][T13128] syz.0.1706: vmalloc error: size 8589938688, exceeds total pages, mode:0x400dc0(GFP_KERNEL_ACCOUNT|__GFP_ZERO), nodemask=(null),cpuset=/,mems_allowed=0-1 [ 296.941095][T13111] 8021q: adding VLAN 0 to HW filter on device bond7 [ 296.962088][ T1000] netdevsim netdevsim1 netdevsim1: set [1, 1] type 2 family 0 port 20000 - 0 [ 296.986818][T13128] CPU: 0 UID: 0 PID: 13128 Comm: syz.0.1706 Not tainted syzkaller #0 PREEMPT(full) [ 296.986849][T13128] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 296.986871][T13128] Call Trace: [ 296.986879][T13128] [ 296.986888][T13128] dump_stack_lvl+0xe8/0x150 [ 296.986927][T13128] warn_alloc+0x24c/0x270 [ 296.986961][T13128] ? __pfx_warn_alloc+0x10/0x10 [ 296.986993][T13128] ? xskq_create+0x56/0x220 [ 296.987022][T13128] ? xsk_setsockopt+0x52a/0x960 [ 296.987048][T13128] ? do_syscall_64+0x174/0x580 [ 296.987078][T13128] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 296.987117][T13128] __vmalloc_node_range_noprof+0x12c/0x1730 [ 296.987176][T13128] ? __pfx___vmalloc_node_range_noprof+0x10/0x10 [ 296.987203][T13128] ? __kmalloc_cache_noprof+0x32d/0x660 [ 296.987230][T13128] ? __kmalloc_cache_noprof+0x150/0x660 [ 296.987256][T13128] ? xskq_create+0x56/0x220 [ 296.987289][T13128] xskq_create+0x148/0x220 [ 296.987318][T13128] ? xsk_init_queue+0x8a/0xe0 [ 296.987348][T13128] xsk_init_queue+0x8a/0xe0 [ 296.987379][T13128] xsk_setsockopt+0x52a/0x960 [ 296.987406][T13128] ? __fget_files+0x2a/0x420 [ 296.987434][T13128] ? __pfx_xsk_setsockopt+0x10/0x10 [ 296.987462][T13128] ? __pfx_aa_sk_perm+0x10/0x10 [ 296.987499][T13128] ? aa_sock_opt_perm+0xff/0x1a0 [ 296.987524][T13128] ? bpf_lsm_socket_setsockopt+0x9/0x20 [ 296.987545][T13128] ? __pfx_xsk_setsockopt+0x10/0x10 [ 296.987574][T13128] do_sock_setsockopt+0x17c/0x1b0 [ 296.987608][T13128] __x64_sys_setsockopt+0x13d/0x1b0 [ 296.987636][T13128] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 296.987660][T13128] do_syscall_64+0x174/0x580 [ 296.987702][T13128] ? trace_irq_disable+0x3b/0x140 [ 296.987727][T13128] ? clear_bhb_loop+0x70/0xc0 [ 296.987753][T13128] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 296.987772][T13128] RIP: 0033:0x7f433479e0d9 [ 296.987791][T13128] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 296.987809][T13128] RSP: 002b:00007f433558b028 EFLAGS: 00000246 ORIG_RAX: 0000000000000036 [ 296.987831][T13128] RAX: ffffffffffffffda RBX: 00007f4334a26090 RCX: 00007f433479e0d9 [ 296.987845][T13128] RDX: 0000000000000006 RSI: 000000000000011b RDI: 0000000000000005 [ 296.987857][T13128] RBP: 00007f4334835024 R08: 0000000000000004 R09: 0000000000000000 [ 296.987869][T13128] R10: 0000200000000000 R11: 0000000000000246 R12: 0000000000000000 [ 296.987880][T13128] R13: 00007f4334a26128 R14: 00007f4334a26090 R15: 00007fffec5b1738 [ 296.987913][T13128] [ 296.987930][T13128] Mem-Info: [ 297.219188][ T1000] netdevsim netdevsim1 netdevsim2: set [1, 1] type 2 family 0 port 20000 - 0 [ 297.350868][T13128] active_anon:7878 inactive_anon:1093 isolated_anon:0 [ 297.350868][T13128] active_file:2 inactive_file:43249 isolated_file:0 [ 297.350868][T13128] unevictable:0 dirty:121 writeback:0 [ 297.350868][T13128] slab_reclaimable:10877 slab_unreclaimable:102377 [ 297.350868][T13128] mapped:29562 shmem:2336 pagetables:1516 [ 297.350868][T13128] sec_pagetables:0 bounce:0 [ 297.350868][T13128] kernel_misc_reclaimable:0 [ 297.350868][T13128] free:1319733 free_pcp:8996 free_cma:0 [ 297.477453][T13128] Node 0 active_anon:29512kB inactive_anon:4372kB active_file:8kB inactive_file:172796kB unevictable:0kB isolated(anon):0kB isolated(file):0kB mapped:122248kB dirty:484kB writeback:0kB shmem:7144kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB kernel_stack:13996kB pagetables:5720kB sec_pagetables:0kB all_unreclaimable? no Balloon:0kB gpu_active:0kB gpu_reclaim:0kB [ 297.571173][T13141] __nla_validate_parse: 6 callbacks suppressed [ 297.571194][T13141] netlink: 16 bytes leftover after parsing attributes in process `syz.1.1711'. [ 297.595278][T13128] Node 1 active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:200kB unevictable:0kB isolated(anon):0kB isolated(file):0kB mapped:0kB dirty:0kB writeback:0kB shmem:0kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB kernel_stack:32kB pagetables:144kB sec_pagetables:0kB all_unreclaimable? no Balloon:0kB gpu_active:0kB gpu_reclaim:0kB [ 297.766618][T13128] Node 0 DMA free:15360kB boost:0kB min:208kB low:260kB high:312kB reserved_highatomic:0KB free_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB zspages:0kB present:15992kB managed:15360kB mlocked:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB [ 297.784493][T13129] llcp: llcp_sock_recvmsg: Recv datagram failed state 4 -512 0 [ 297.838642][T13128] lowmem_reserve[]: 0 2488 2488 2488 2488 [ 297.854911][T13128] Node 0 DMA32 free:1321256kB boost:0kB min:34160kB low:42700kB high:51240kB reserved_highatomic:0KB free_highatomic:0KB active_anon:24468kB inactive_anon:4372kB active_file:8kB inactive_file:172796kB unevictable:0kB writepending:528kB zspages:0kB present:3129332kB managed:2548376kB mlocked:0kB bounce:0kB free_pcp:35104kB local_pcp:22360kB free_cma:0kB [ 297.904432][T13144] netlink: 4 bytes leftover after parsing attributes in process `syz.3.1710'. [ 297.912944][T13128] lowmem_reserve[]: 0 0 0 0 0 [ 297.929261][T13128] Node 0 Normal free:0kB boost:0kB min:0kB low:0kB high:0kB reserved_highatomic:0KB free_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB zspages:0kB present:1048580kB managed:256kB mlocked:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB [ 297.966092][T13144] netlink: 52 bytes leftover after parsing attributes in process `syz.3.1710'. [ 297.991924][T13128] lowmem_reserve[]: 0 0 0 0 0 [ 298.006140][T13128] Node 1 Normal free:3950484kB boost:0kB min:55736kB low:69668kB high:83600kB reserved_highatomic:0KB free_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:200kB unevictable:0kB writepending:0kB zspages:0kB present:4194300kB managed:4111100kB mlocked:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB [ 298.088214][T13128] lowmem_reserve[]: 0 0 0 0 0 [ 298.096892][T13128] Node 0 DMA: 0*4kB 0*8kB 0*16kB 0*32kB 0*64kB 0*128kB 0*256kB 0*512kB 1*1024kB (U) 1*2048kB (M) 3*4096kB (M) = 15360kB [ 298.114283][T13128] Node 0 DMA32: 1857*4kB (UM) 1537*8kB (UME) 768*16kB (UM) 1252*32kB (UME) 581*64kB (UM) 210*128kB (UM) 165*256kB (UME) 107*512kB (UM) 51*1024kB (UM) 2*2048kB (UM) 252*4096kB (UM) = 1321676kB [ 298.149731][T13128] Node 0 Normal: 0*4kB 0*8kB 0*16kB 0*32kB 0*64kB 0*128kB 0*256kB 0*512kB 0*1024kB 0*2048kB 0*4096kB = 0kB [ 298.167152][T13128] Node 1 Normal: 1*4kB (M) 2*8kB (UM) 8*16kB (UM) 10*32kB (UM) 11*64kB (UM) 4*128kB (UM) 3*256kB (UM) 3*512kB (UM) 2*1024kB (UM) 0*2048kB 963*4096kB (M) = 3950484kB [ 298.239075][T13128] Node 0 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 298.271738][T13128] Node 0 hugepages_total=2 hugepages_free=2 hugepages_surp=0 hugepages_size=2048kB [ 298.281994][T13128] Node 1 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 298.292503][T13128] Node 1 hugepages_total=2 hugepages_free=2 hugepages_surp=0 hugepages_size=2048kB [ 298.315382][T13128] 43774 total pagecache pages [ 298.328037][T13128] 0 pages in swap cache [ 298.346198][T13128] Free swap = 124996kB [ 298.359184][T13128] Total swap = 124996kB [ 298.370385][T13128] 2097051 pages RAM [ 298.375476][T13128] 0 pages HighMem/MovableOnly [ 298.382470][T13128] 428278 pages reserved [ 298.386796][T13128] 0 pages cma reserved [ 298.394369][T13165] netlink: 10 bytes leftover after parsing attributes in process `syz.1.1717'. [ 299.619414][T13191] netlink: 16 bytes leftover after parsing attributes in process `syz.3.1728'. [ 299.722738][T13199] netlink: 28 bytes leftover after parsing attributes in process `syz.4.1729'. [ 299.835935][T13205] netlink: 65047 bytes leftover after parsing attributes in process `syz.0.1731'. [ 300.064395][T13214] netlink: 56 bytes leftover after parsing attributes in process `syz.4.1733'. [ 300.098134][T13215] tipc: Started in network mode [ 300.114279][T13215] tipc: Node identity 22defddfa163, cluster identity 4711 [ 300.123500][T13215] tipc: Enabled bearer , priority 0 [ 300.154975][T13218] netlink: 276 bytes leftover after parsing attributes in process `syz.2.1735'. [ 300.178358][T13218] netlink: 276 bytes leftover after parsing attributes in process `syz.2.1735'. [ 300.233479][T13215] syzkaller0: entered promiscuous mode [ 300.247252][T13215] syzkaller0: entered allmulticast mode [ 300.257323][T13215] tipc: Resetting bearer [ 300.273244][T13213] tipc: Resetting bearer [ 300.962776][T13243] IPVS: set_ctl: invalid protocol: 0 255.255.255.255:20000 [ 302.533666][T13213] tipc: Disabling bearer [ 302.554168][ T5801] tipc: Node number set to 2210266591 [ 302.758707][T13246] netlink: 4 bytes leftover after parsing attributes in process `syz.3.1743'. [ 303.675627][T13292] netlink: 20 bytes leftover after parsing attributes in process `syz.2.1758'. [ 303.973345][T13311] bridge0: left allmulticast mode [ 303.998731][T13311] netlink: 8 bytes leftover after parsing attributes in process `syz.1.1761'. [ 304.216027][T13320] netlink: 12 bytes leftover after parsing attributes in process `syz.1.1763'. [ 304.255184][T13320] netlink: 'syz.1.1763': attribute type 1 has an invalid length. [ 304.278242][T13320] netlink: 224 bytes leftover after parsing attributes in process `syz.1.1763'. [ 304.293557][T13324] netlink: 8 bytes leftover after parsing attributes in process `syz.4.1764'. [ 304.318404][T13320] netlink: 8 bytes leftover after parsing attributes in process `syz.1.1763'. [ 304.524979][T13337] netlink: 20 bytes leftover after parsing attributes in process `syz.0.1767'. [ 304.558312][T13337] netlink: 12 bytes leftover after parsing attributes in process `syz.0.1767'. [ 304.673371][T13347] netlink: 8 bytes leftover after parsing attributes in process `syz.0.1767'. [ 304.754171][T13350] netlink: 'syz.2.1771': attribute type 7 has an invalid length. [ 304.766069][T13350] netlink: 'syz.2.1771': attribute type 8 has an invalid length. [ 304.913903][T13347] veth9: entered allmulticast mode [ 304.943099][T13347] bond4: (slave veth9): Enslaving as an active interface with an up link [ 305.279198][T13372] bridge3: entered allmulticast mode [ 306.207285][T13414] openvswitch: netlink: Missing key (keys=c0, expected=100) [ 306.395247][T13423] syzkaller1: entered promiscuous mode [ 306.439810][T13423] syzkaller1: entered allmulticast mode [ 307.242422][T13423] sctp: [Deprecated]: syz.3.1786 (pid 13423) Use of int in max_burst socket option. [ 307.242422][T13423] Use struct sctp_assoc_value instead [ 307.478292][T13459] veth1: Caught tx_queue_len zero misconfig [ 308.148553][T13473] __nla_validate_parse: 36 callbacks suppressed [ 308.148574][T13473] netlink: 84 bytes leftover after parsing attributes in process `syz.1.1795'. [ 308.215233][T13482] netlink: 380 bytes leftover after parsing attributes in process `syz.4.1799'. [ 308.234887][T13482] netlink: 4 bytes leftover after parsing attributes in process `syz.4.1799'. [ 308.250111][T13482] netlink: 7 bytes leftover after parsing attributes in process `syz.4.1799'. [ 308.415448][T13495] netlink: 'syz.4.1802': attribute type 1 has an invalid length. [ 308.423430][T13495] netlink: 1368 bytes leftover after parsing attributes in process `syz.4.1802'. [ 308.453556][T13493] netlink: 40 bytes leftover after parsing attributes in process `syz.2.1801'. [ 308.473898][T13492] geneve1: Caught tx_queue_len zero misconfig [ 308.713468][T13499] batman_adv: Cannot find parent device. Skipping batadv-on-batadv check for gretap2 [ 308.753877][T13499] batman_adv: batadv0: Adding interface: gretap2 [ 308.769280][T13499] batman_adv: batadv0: The MTU of interface gretap2 is too small (1462) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 308.851246][T13499] batman_adv: batadv0: Interface activated: gretap2 [ 308.910399][T13515] veth1_macvtap: left promiscuous mode [ 308.996189][T13519] xt_policy: too many policy elements [ 309.345060][T13540] netlink: 4 bytes leftover after parsing attributes in process `syz.3.1814'. [ 309.582640][T13548] netlink: 24 bytes leftover after parsing attributes in process `syz.3.1817'. [ 309.605462][T13548] netlink: 'syz.3.1817': attribute type 1 has an invalid length. [ 309.614695][T13548] netlink: 'syz.3.1817': attribute type 2 has an invalid length. [ 309.632877][T13548] netlink: 12 bytes leftover after parsing attributes in process `syz.3.1817'. [ 309.800147][T13558] netlink: 20 bytes leftover after parsing attributes in process `syz.0.1821'. [ 310.034235][T13564] 8021q: VLANs not supported on syzkaller1 [ 310.634401][T13587] ip6tnl0: Caught tx_queue_len zero misconfig [ 311.325337][T13601] netlink: 'syz.4.1830': attribute type 8 has an invalid length. [ 311.478028][T13612] IPVS: set_ctl: invalid protocol: 243 255.255.255.255:20014 [ 311.603373][T13589] syzkaller0: entered promiscuous mode [ 311.634002][T13589] syzkaller0: entered allmulticast mode [ 316.123428][T13643] pim6reg: entered allmulticast mode [ 316.186217][T13643] pim6reg: left allmulticast mode [ 316.303129][T13655] openvswitch: netlink: IP tunnel attribute has 8 unknown bytes. [ 316.351493][T13655] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 316.417943][T13655] __nla_validate_parse: 2 callbacks suppressed [ 316.417963][T13655] netlink: 8 bytes leftover after parsing attributes in process `syz.2.1840'. [ 316.454335][T13659] IPv6: NLM_F_CREATE should be specified when creating new route [ 316.496816][T13659] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 316.505936][T13659] IPv6: NLM_F_CREATE should be set when creating new route [ 316.516605][T13655] netlink: 'syz.2.1840': attribute type 1 has an invalid length. [ 316.672724][T13663] netlink: 104 bytes leftover after parsing attributes in process `syz.4.1842'. [ 316.948587][T13675] syzkaller1: left promiscuous mode [ 317.015303][T13675] syzkaller1: left allmulticast mode [ 317.128471][ T1308] ieee802154 phy0 wpan0: encryption failed: -22 [ 318.208838][T13710] xt_HMARK: proto mask must be zero with L3 mode [ 318.278675][ T12] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 318.300606][ T12] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 318.832329][T13731] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 318.879322][T13731] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 318.968635][T13731] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 319.016463][T13738] netlink: 16 bytes leftover after parsing attributes in process `syz.2.1861'. [ 319.785386][T13756] netlink: 8 bytes leftover after parsing attributes in process `syz.2.1868'. [ 319.876558][T13756] netlink: 'syz.2.1868': attribute type 26 has an invalid length. [ 319.955069][T13756] netlink: 4 bytes leftover after parsing attributes in process `syz.2.1868'. [ 320.027822][T13756] netlink: 8 bytes leftover after parsing attributes in process `syz.2.1868'. [ 320.115679][T13756] netlink: 'syz.2.1868': attribute type 26 has an invalid length. [ 320.192181][T13756] netlink: 4 bytes leftover after parsing attributes in process `syz.2.1868'. [ 320.385225][T13771] netlink: 12 bytes leftover after parsing attributes in process `syz.4.1872'. [ 320.914829][T13771] bond7: entered promiscuous mode [ 321.004395][T13771] 8021q: adding VLAN 0 to HW filter on device bond7 [ 321.112002][T13791] netlink: 'syz.1.1876': attribute type 17 has an invalid length. [ 321.226707][T13775] vlan3: entered allmulticast mode [ 321.252505][T13775] bond7: entered allmulticast mode [ 321.261521][T13797] netlink: 'syz.1.1876': attribute type 23 has an invalid length. [ 321.354967][T13791] gretap0: left promiscuous mode [ 322.098637][T13814] netlink: 12 bytes leftover after parsing attributes in process `syz.0.1880'. [ 322.733901][T13831] netlink: 12 bytes leftover after parsing attributes in process `syz.0.1885'. [ 322.787604][T13834] netlink: 'syz.1.1886': attribute type 1 has an invalid length. [ 322.795734][T13834] netlink: 'syz.1.1886': attribute type 6 has an invalid length. [ 322.814875][T13834] netlink: 'syz.1.1886': attribute type 3 has an invalid length. [ 322.870636][T13828] bond4 (unregistering): Released all slaves [ 322.903871][T13831] workqueue: Failed to create a rescuer kthread for wq "bond5": -EINTR [ 323.103538][T13828] syz.3.1884 (13828) used obsolete PPPIOCDETACH ioctl [ 323.753076][T13857] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 324.077698][T13862] vlan3: entered promiscuous mode [ 324.091663][T13862] bridge0: entered promiscuous mode [ 324.282994][T13862] x_tables: unsorted underflow at hook 4 [ 324.604339][T13805] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 325.263445][T13889] netlink: 128 bytes leftover after parsing attributes in process `syz.3.1899'. [ 325.504424][T13900] SET target dimension over the limit! [ 326.102184][T13906] netlink: 256 bytes leftover after parsing attributes in process `syz.2.1903'. [ 326.579398][T13922] netlink: 24 bytes leftover after parsing attributes in process `syz.0.1908'. [ 326.823404][T13932] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 326.853770][T13922] netlink: 28 bytes leftover after parsing attributes in process `syz.0.1908'. [ 326.998404][T13939] netlink: 4912 bytes leftover after parsing attributes in process `syz.3.1909'. [ 327.038634][T13940] netlink: 28 bytes leftover after parsing attributes in process `syz.4.1912'. [ 327.621909][T13947] netlink: 4 bytes leftover after parsing attributes in process `syz.0.1914'. [ 328.656520][T13970] IPVS: set_ctl: invalid protocol: 46 100.1.1.0:20000 [ 328.664816][T13972] netlink: 48 bytes leftover after parsing attributes in process `syz.1.1919'. [ 328.902363][T13977] netlink: 56 bytes leftover after parsing attributes in process `syz.0.1920'. [ 329.406046][T13991] netlink: 272 bytes leftover after parsing attributes in process `syz.1.1924'. [ 329.432168][T13992] netlink: 272 bytes leftover after parsing attributes in process `syz.1.1924'. [ 329.548959][T13954] infiniband syz0: set down [ 329.567306][T13954] infiniband syz0: added veth1_to_hsr [ 329.600811][T13954] workqueue: Failed to create a rescuer kthread for wq "ib_mad1": -EINTR [ 329.603684][T13954] infiniband syz0: Couldn't open port 1 [ 329.630041][T13954] smbdirect: ib_dev[syz0]: added: IB_CA max_fast_reg_page_list_len=512 device_cap_flags=0x1c001223c76 kernel_cap_flags=0x14 page_size_cap=0xfffff000 [ 329.693673][T13954] smbdirect: ib_dev[syz0]: num_ports=1 max_qp_rd_atom=128 max_qp_init_rd_atom=128 max_sgl_rd=0 max_sge_rd=32 max_cqe=32767 max_qp_wr=1048576 max_send_sge=32 max_recv_sge=32 [ 329.748329][T13954] smbdirect: ib_dev[syz0]PORT[1]: iwarp=0 ib=0 roce=1 v1=0 v2=1 core_cap_flags=0x803005 [ 329.930886][T14001] netlink: 28 bytes leftover after parsing attributes in process `syz.4.1926'. [ 330.026497][T13954] RDS/IB: syz0: added [ 330.044877][T13954] smc: adding ib device syz0 with port count 1 [ 330.083811][T13954] smc: ib device syz0 port 1 has no pnetid [ 330.511734][T14016] netlink: 4 bytes leftover after parsing attributes in process `syz.0.1929'. [ 331.136290][T14030] netlink: 36 bytes leftover after parsing attributes in process `syz.3.1931'. [ 333.283033][T14068] netlink: 56 bytes leftover after parsing attributes in process `syz.1.1940'. [ 333.857845][T14080] netlink: 76 bytes leftover after parsing attributes in process `syz.1.1943'. [ 333.933731][T14081] netlink: 64 bytes leftover after parsing attributes in process `syz.3.1942'. [ 333.964314][T14080] netlink: 8 bytes leftover after parsing attributes in process `syz.1.1943'. [ 334.041260][T14087] netlink: 4 bytes leftover after parsing attributes in process `syz.4.1945'. [ 334.138931][T14080] netlink: 8 bytes leftover after parsing attributes in process `syz.1.1943'. [ 334.195565][T14091] netlink: 4 bytes leftover after parsing attributes in process `syz.3.1942'. [ 334.838968][T14102] netlink: 28 bytes leftover after parsing attributes in process `syz.0.1948'. [ 334.902457][T14102] netlink: 28 bytes leftover after parsing attributes in process `syz.0.1948'. [ 335.618179][T14112] netlink: 'syz.3.1949': attribute type 21 has an invalid length. [ 335.695196][T14112] netlink: 132 bytes leftover after parsing attributes in process `syz.3.1949'. [ 336.403965][T14126] xt_hashlimit: max too large, truncated to 1048576 [ 336.445325][T14126] xt_hashlimit: overflow, try lower: 0/0 [ 336.839990][T14133] tunl0: Caught tx_queue_len zero misconfig [ 338.819051][T14197] openvswitch: netlink: nsh attr 1 has unexpected len 335 expected 8 [ 339.934496][T14233] __nla_validate_parse: 1 callbacks suppressed [ 339.934516][T14233] netlink: 24 bytes leftover after parsing attributes in process `syz.0.1979'. [ 339.991101][T14234] netlink: 4 bytes leftover after parsing attributes in process `syz.0.1979'. [ 340.001006][T14233] netlink: 24 bytes leftover after parsing attributes in process `syz.0.1979'. [ 340.081673][T14234] netlink: 'syz.0.1979': attribute type 39 has an invalid length. [ 340.308249][T14242] ip_tables: iptables: counters copy to user failed while replacing table [ 340.414623][T14243] ip_tables: iptables: counters copy to user failed while replacing table [ 340.457397][T14242] ip_tables: iptables: counters copy to user failed while replacing table [ 340.486899][T14245] netlink: 'syz.4.1982': attribute type 23 has an invalid length. [ 341.085056][T14259] netlink: 316 bytes leftover after parsing attributes in process `syz.4.1987'. [ 341.399623][T14268] netlink: 'syz.3.1990': attribute type 2 has an invalid length. [ 341.459163][T14268] v: renamed from dummy0 (while UP) [ 341.586689][T14276] netlink: 12 bytes leftover after parsing attributes in process `syz.4.1991'. [ 342.706025][T14296] netlink: 1 bytes leftover after parsing attributes in process `syz.4.1998'. [ 342.729821][ C1] ip6_tunnel: ip6tnl1 xmit: Local address not yet configured! [ 342.888198][T14299] netlink: 'syz.0.2000': attribute type 1 has an invalid length. [ 342.950183][T14302] netlink: 'syz.2.2001': attribute type 11 has an invalid length. [ 343.320324][T14299] 8021q: adding VLAN 0 to HW filter on device bond6 [ 343.357236][T14304] ip6tnl0: Caught tx_queue_len zero misconfig [ 343.439954][T14305] erspan0: left promiscuous mode [ 343.544047][T14305] 8021q: adding VLAN 0 to HW filter on device team0 [ 343.555998][T14305] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 343.624921][T14305] bridge_slave_0: entered promiscuous mode [ 343.694501][T14305] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 343.705533][T14305] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 343.777321][T14305] veth1_macvtap: left promiscuous mode [ 343.818815][T14305] veth0_macvtap: left promiscuous mode [ 343.834308][T14305] veth0_macvtap: entered promiscuous mode [ 343.844851][T14305] veth1_macvtap: entered promiscuous mode [ 343.877321][T14305] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 343.894922][T14305] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 343.944747][T14305] A link change request failed with some changes committed already. Interface vxlan0 may have been left with an inconsistent configuration, please check. [ 344.009663][T14311] tipc: Enabling of bearer rejected, failed to enable media [ 344.058506][T14321] tap0: tun_chr_ioctl cmd 1074025677 [ 344.070062][T14321] tap0: linktype set to 0 [ 344.250623][T12153] syz0: Port: 1 Link ACTIVE [ 344.948952][T14343] netlink: 8 bytes leftover after parsing attributes in process `syz.0.2011'. [ 345.037699][T14343] netlink: 8 bytes leftover after parsing attributes in process `syz.0.2011'. [ 345.770311][T14362] openvswitch: netlink: VXLAN extension 1 has unexpected len 0 expected 4 [ 346.156943][T14371] netlink: 12 bytes leftover after parsing attributes in process `syz.0.2016'. [ 346.272074][T14371] netlink: 28 bytes leftover after parsing attributes in process `syz.0.2016'. [ 346.333118][T14371] netlink: 32 bytes leftover after parsing attributes in process `syz.0.2016'. [ 346.360036][T14371] netlink: 28 bytes leftover after parsing attributes in process `syz.0.2016'. [ 346.785109][T14384] xt_policy: input policy not valid in POSTROUTING and OUTPUT [ 347.657082][T14401] netlink: 12 bytes leftover after parsing attributes in process `syz.1.2026'. [ 349.108528][T14438] netlink: 8 bytes leftover after parsing attributes in process `syz.1.2036'. [ 349.137220][T14438] netlink: 4 bytes leftover after parsing attributes in process `syz.1.2036'. [ 349.189383][T14438] netlink: 'syz.1.2036': attribute type 18 has an invalid length. [ 349.222653][T14437] netlink: 8 bytes leftover after parsing attributes in process `syz.1.2036'. [ 349.259058][T14437] netlink: 'syz.1.2036': attribute type 18 has an invalid length. [ 349.359818][ T1000] netdevsim netdevsim1 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0 [ 349.397237][ T1000] netdevsim netdevsim1 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0 [ 349.452700][T14450] netdevsim netdevsim2 netdevsim0: entered allmulticast mode [ 349.486971][T14450] A link change request failed with some changes committed already. Interface netdevsim0 may have been left with an inconsistent configuration, please check. [ 349.571088][ T13] netdevsim netdevsim1 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0 [ 349.594753][ T13] netdevsim netdevsim1 netdevsim0: set [0, 0] type 1 family 0 port 8472 - 0 [ 350.043383][T14457] __nla_validate_parse: 3 callbacks suppressed [ 350.043502][T14457] netlink: 8 bytes leftover after parsing attributes in process `syz.4.2040'. [ 350.150846][T14466] netlink: 'syz.3.2044': attribute type 1 has an invalid length. [ 350.307003][T14466] lo: entered promiscuous mode [ 350.472166][T14466] tunl0: entered promiscuous mode [ 350.595068][T14466] gre0: entered promiscuous mode [ 350.781077][T14466] gretap0: entered promiscuous mode [ 350.891433][T14476] netlink: 8 bytes leftover after parsing attributes in process `syz.2.2046'. [ 350.916119][T14466] erspan0: entered promiscuous mode [ 350.944076][T14466] ip_vti0: entered promiscuous mode [ 350.983355][T14466] ip6_vti0: entered promiscuous mode [ 351.059204][T14466] sit0: entered promiscuous mode [ 351.143037][T14466] ip6tnl0: entered promiscuous mode [ 351.223967][T14466] ip6gre0: entered promiscuous mode [ 351.285683][T14466] syz_tun: entered promiscuous mode [ 351.327706][T14466] ip6gretap0: entered promiscuous mode [ 351.403622][T14466] bridge0: port 2(bridge_slave_1) entered disabled state [ 351.411393][T14466] bridge0: port 1(bridge_slave_0) entered disabled state [ 351.430430][T14466] bridge0: entered promiscuous mode [ 351.449547][T14466] bond0: entered promiscuous mode [ 351.462187][T14466] bond_slave_0: entered promiscuous mode [ 351.482430][T14466] bond_slave_1: entered promiscuous mode [ 351.543457][T14466] team0: entered promiscuous mode [ 351.569976][T14466] team_slave_0: entered promiscuous mode [ 351.596460][T14466] team_slave_1: entered promiscuous mode [ 351.648689][T14466] v: entered promiscuous mode [ 351.674207][T14466] nlmon0: entered promiscuous mode [ 351.696754][T14466] batadv0: entered promiscuous mode [ 351.710998][T14466] veth0: entered promiscuous mode [ 351.725344][T14466] veth1: entered promiscuous mode [ 351.737807][T14466] wg0: entered promiscuous mode [ 351.756193][T14466] wg1: entered promiscuous mode [ 351.765296][T14466] wg2: entered promiscuous mode [ 351.774451][T14466] veth0_to_bridge: entered promiscuous mode [ 351.787264][T14466] veth1_to_bridge: entered promiscuous mode [ 351.805568][T14466] bridge1: port 1(veth0_to_bond) entered disabled state [ 351.819045][T14466] veth1_to_bond: entered promiscuous mode [ 351.836666][T14466] veth0_to_team: entered promiscuous mode [ 351.849419][T14466] veth1_to_team: entered promiscuous mode [ 351.866286][T14466] veth1_to_batadv: entered promiscuous mode [ 351.877580][T14466] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 351.885714][T14466] batadv_slave_1: entered promiscuous mode [ 351.898154][T14466] veth0_to_hsr: entered promiscuous mode [ 351.912588][T14466] veth1_to_hsr: entered promiscuous mode [ 352.362808][T14504] netlink: 8 bytes leftover after parsing attributes in process `syz.0.2054'. [ 352.917971][T14520] netlink: 16 bytes leftover after parsing attributes in process `syz.4.2056'. [ 353.211014][T14520] netlink: 28 bytes leftover after parsing attributes in process `syz.4.2056'. [ 353.487924][T14525] netlink: 28 bytes leftover after parsing attributes in process `syz.4.2056'. [ 353.601430][T14529] netlink: 4 bytes leftover after parsing attributes in process `syz.1.2060'. [ 353.746692][T14533] netlink: 8 bytes leftover after parsing attributes in process `syz.2.2061'. [ 354.683337][T14550] netlink: 12 bytes leftover after parsing attributes in process `syz.4.2066'. [ 354.863716][T14550] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 355.736132][T14573] xt_hashlimit: size too large, truncated to 1048576 [ 356.103350][T14587] netlink: 'syz.1.2075': attribute type 4 has an invalid length. [ 356.291184][T14590] netlink: 'syz.1.2075': attribute type 4 has an invalid length. [ 356.365439][T14589] netlink: 8 bytes leftover after parsing attributes in process `syz.0.2076'. [ 356.837166][T14596] ip_tables: iptables: counters copy to user failed while replacing table [ 357.181733][ T6866] IPVS: starting estimator thread 0... [ 357.199413][T14607] IPVS: set_ctl: invalid protocol: 137 0.0.0.0:65534 [ 357.330530][T14610] IPVS: using max 25 ests per chain, 60000 per kthread [ 357.554335][T14618] IPVS: set_ctl: invalid protocol: 51 224.0.0.1:20004 [ 357.645133][T14623] netlink: 4 bytes leftover after parsing attributes in process `syz.3.2083'. [ 357.770901][T14630] gtp0: entered promiscuous mode [ 357.800527][T14630] gtp0: entered allmulticast mode [ 358.046293][T14634] netlink: 4 bytes leftover after parsing attributes in process `syz.2.2086'. [ 360.412979][T14643] syzkaller0: entered promiscuous mode [ 360.429938][T14643] syzkaller0: entered allmulticast mode [ 360.925575][T14675] netlink: 24 bytes leftover after parsing attributes in process `syz.4.2091'. [ 361.013279][T14675] netlink: 24 bytes leftover after parsing attributes in process `syz.4.2091'. [ 361.668024][T14694] tunl0: Caught tx_queue_len zero misconfig [ 361.773052][T14698] netlink: 20 bytes leftover after parsing attributes in process `syz.0.2097'. [ 361.812934][T14700] netlink: 28 bytes leftover after parsing attributes in process `syz.2.2098'. [ 361.852478][T14700] netlink: 124 bytes leftover after parsing attributes in process `syz.2.2098'. [ 362.484432][T14725] xt_HMARK: spi-set and port-set can't be combined [ 362.664610][T14731] netlink: 'syz.1.2104': attribute type 7 has an invalid length. [ 362.704249][T14731] netlink: 'syz.1.2104': attribute type 8 has an invalid length. [ 362.771746][T14736] SET target dimension over the limit! [ 362.772368][T14725] netlink: 'syz.1.2104': attribute type 7 has an invalid length. [ 362.859781][T14725] netlink: 'syz.1.2104': attribute type 8 has an invalid length. [ 362.890264][T14731] netlink: 12 bytes leftover after parsing attributes in process `syz.1.2104'. [ 362.965691][T14731] syz_tun: Device is already in use. [ 363.142324][T14725] netlink: 8 bytes leftover after parsing attributes in process `syz.1.2104'. [ 363.166451][T14742] netlink: 48 bytes leftover after parsing attributes in process `syz.0.2107'. [ 363.528256][T14725] bond0: option primary: mode dependency failed, not supported in mode balance-rr(0) [ 363.780484][T14751] geneve0: entered promiscuous mode [ 363.835569][T14751] geneve0: left promiscuous mode [ 364.078090][T14761] netlink: 'syz.1.2112': attribute type 1 has an invalid length. [ 364.117353][T14764] netlink: 28 bytes leftover after parsing attributes in process `syz.3.2113'. [ 364.139861][T14764] netlink: 'syz.3.2113': attribute type 7 has an invalid length. [ 364.167976][T14764] netlink: 'syz.3.2113': attribute type 8 has an invalid length. [ 364.184563][T14764] netlink: 4 bytes leftover after parsing attributes in process `syz.3.2113'. [ 364.279212][T14761] : renamed from dummy0 [ 365.906149][T14805] netlink: 52 bytes leftover after parsing attributes in process `syz.0.2124'. [ 366.148350][T14816] netlink: 8 bytes leftover after parsing attributes in process `syz.4.2126'. [ 367.126953][T14842] netlink: 'syz.0.2132': attribute type 1 has an invalid length. [ 367.535642][T14842] bond7: entered promiscuous mode [ 367.573289][T14842] bond7: entered allmulticast mode [ 367.607613][T14842] 8021q: adding VLAN 0 to HW filter on device bond7 [ 367.734997][T14843] erspan1: entered allmulticast mode [ 367.803652][T14843] bond7: (slave erspan1): making interface the new active one [ 367.868228][T14843] erspan1: entered promiscuous mode [ 367.922168][T14843] bond7: (slave erspan1): Enslaving as an active interface with an up link [ 368.305620][T14875] netlink: 27 bytes leftover after parsing attributes in process `syz.0.2137'. [ 368.404548][ T6084] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 368.475739][ T6084] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 368.986397][T14888] netlink: 'syz.2.2140': attribute type 2 has an invalid length. [ 369.086193][T14892] sysfs: cannot create duplicate filename '/class/ieee80211/.P'G!DES' [ 369.123579][T14892] CPU: 1 UID: 0 PID: 14892 Comm: syz.2.2140 Not tainted syzkaller #0 PREEMPT(full) [ 369.123626][T14892] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 369.123642][T14892] Call Trace: [ 369.123722][T14892] [ 369.123789][T14892] dump_stack_lvl+0xe8/0x150 [ 369.123971][T14892] sysfs_warn_dup+0x8e/0xa0 [ 369.124031][T14892] sysfs_do_create_link_sd+0xc0/0x110 [ 369.124064][T14892] device_add_class_symlinks+0x1cf/0x240 [ 369.124169][T14892] device_add+0x467/0xb80 [ 369.124195][T14892] wiphy_register+0x1fc8/0x2ff0 [ 369.124331][T14892] ? __pfx_wiphy_register+0x10/0x10 [ 369.124407][T14892] ? __pfx_netdev_run_todo+0x10/0x10 [ 369.124500][T14892] ? minstrel_ht_alloc+0x6e0/0x7e0 [ 369.124577][T14892] ? ieee80211_init_rate_ctrl_alg+0x55d/0x5d0 [ 369.124668][T14892] ieee80211_register_hw+0x3d3d/0x4a50 [ 369.124762][T14892] ? ieee80211_register_hw+0x19d1/0x4a50 [ 369.124827][T14892] ? __pfx_ieee80211_register_hw+0x10/0x10 [ 369.124865][T14892] ? __asan_memset+0x22/0x50 [ 369.124910][T14892] ? __hrtimer_setup+0x1b7/0x260 [ 369.124952][T14892] ? __pfx_mac80211_hwsim_beacon+0x10/0x10 [ 369.125034][T14892] mac80211_hwsim_new_radio+0x3258/0x56b0 [ 369.125093][T14892] ? __pfx_mac80211_hwsim_new_radio+0x10/0x10 [ 369.125115][T14892] ? kstrndup+0xbd/0x160 [ 369.125170][T14892] ? kstrndup+0xbd/0x160 [ 369.125200][T14892] hwsim_new_radio_nl+0xd8b/0xf90 [ 369.125253][T14892] genl_family_rcv_msg_doit+0x233/0x340 [ 369.125327][T14892] ? __pfx_genl_family_rcv_msg_doit+0x10/0x10 [ 369.125365][T14892] ? bpf_lsm_capable+0x9/0x20 [ 369.125400][T14892] ? security_capable+0x7e/0x2c0 [ 369.125523][T14892] genl_rcv_msg+0x614/0x7a0 [ 369.125552][T14892] ? __pfx_genl_rcv_msg+0x10/0x10 [ 369.125573][T14892] ? __pfx_hwsim_new_radio_nl+0x10/0x10 [ 369.125596][T14892] ? __pfx_ref_tracker_free+0x10/0x10 [ 369.125680][T14892] netlink_rcv_skb+0x226/0x4a0 [ 369.125733][T14892] ? __pfx_genl_rcv_msg+0x10/0x10 [ 369.125756][T14892] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 369.125802][T14892] ? down_read+0x2be/0x330 [ 369.125916][T14892] genl_rcv+0x28/0x40 [ 369.125935][T14892] netlink_unicast+0x7bb/0x940 [ 369.125973][T14892] netlink_sendmsg+0x813/0xb40 [ 369.126014][T14892] ? __pfx_netlink_sendmsg+0x10/0x10 [ 369.126047][T14892] ? aa_sock_msg_perm+0xf1/0x1b0 [ 369.126106][T14892] ? __pfx_netlink_sendmsg+0x10/0x10 [ 369.126133][T14892] sock_sendmsg_nosec+0x13a/0x180 [ 369.126197][T14892] ____sys_sendmsg+0x54e/0x850 [ 369.126231][T14892] ? __pfx_____sys_sendmsg+0x10/0x10 [ 369.126270][T14892] ? import_iovec+0x73/0xa0 [ 369.126337][T14892] ___sys_sendmsg+0x2a5/0x360 [ 369.126364][T14892] ? __lock_acquire+0x683/0x2cf0 [ 369.126403][T14892] ? __pfx____sys_sendmsg+0x10/0x10 [ 369.126441][T14892] ? futex_wake+0x51b/0x5f0 [ 369.126514][T14892] ? __fget_files+0x2a/0x420 [ 369.126554][T14892] ? __fget_files+0x3a2/0x420 [ 369.126593][T14892] __x64_sys_sendmsg+0x1b1/0x290 [ 369.126624][T14892] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 369.126672][T14892] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 369.126711][T14892] do_syscall_64+0x174/0x580 [ 369.126788][T14892] ? trace_irq_disable+0x3b/0x140 [ 369.126823][T14892] ? clear_bhb_loop+0x70/0xc0 [ 369.126850][T14892] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 369.126871][T14892] RIP: 0033:0x7fbde999e0d9 [ 369.126920][T14892] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 369.126939][T14892] RSP: 002b:00007fbdea836028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 369.126968][T14892] RAX: ffffffffffffffda RBX: 00007fbde9c26090 RCX: 00007fbde999e0d9 [ 369.126983][T14892] RDX: 0000000000000000 RSI: 0000200000000100 RDI: 0000000000000004 [ 369.126997][T14892] RBP: 00007fbde9a35024 R08: 0000000000000000 R09: 0000000000000000 [ 369.127010][T14892] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 369.127022][T14892] R13: 00007fbde9c26128 R14: 00007fbde9c26090 R15: 00007ffea78e19d8 [ 369.127059][T14892] [ 370.185955][T14906] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 370.287568][T14906] netlink: 'syz.1.2143': attribute type 1 has an invalid length. [ 370.684242][T14923] netlink: 20 bytes leftover after parsing attributes in process `syz.0.2146'. [ 370.969038][T14923] netlink: 8 bytes leftover after parsing attributes in process `syz.0.2146'. [ 371.579379][T14951] netlink: 'syz.1.2151': attribute type 4 has an invalid length. [ 372.208694][T14970] netlink: 8 bytes leftover after parsing attributes in process `syz.3.2153'. [ 372.731076][T14977] netlink: 12 bytes leftover after parsing attributes in process `syz.1.2157'. [ 372.856526][T14976] tipc: Bearer : already 2 bearers with priority 10 [ 372.907041][T14977] netlink: 'syz.1.2157': attribute type 1 has an invalid length. [ 372.930635][T14976] tipc: Bearer : trying with adjusted priority [ 372.958291][T14976] tipc: Enabling of bearer rejected, max 3 bearers permitted [ 373.083133][T14984] netlink: 48 bytes leftover after parsing attributes in process `syz.0.2159'. [ 373.134065][T14984] netlink: 20 bytes leftover after parsing attributes in process `syz.0.2159'. [ 373.194381][T14984] netlink: 20 bytes leftover after parsing attributes in process `syz.0.2159'. [ 373.255163][T14984] netlink: 7 bytes leftover after parsing attributes in process `syz.0.2159'. [ 373.640040][T15001] netlink: 24 bytes leftover after parsing attributes in process `syz.4.2163'. [ 373.686114][T15005] netlink: 12 bytes leftover after parsing attributes in process `syz.0.2165'. [ 373.792280][T15009] IPVS: set_ctl: invalid protocol: 59 224.0.0.1:19999 [ 374.186801][T15019] sctp: [Deprecated]: syz.2.2166 (pid 15019) Use of int in maxseg socket option. [ 374.186801][T15019] Use struct sctp_assoc_value instead [ 374.795515][T15025] netlink: 4 bytes leftover after parsing attributes in process `syz.2.2168'. [ 374.852398][T15028] netlink: 'syz.4.2169': attribute type 13 has an invalid length. [ 374.866530][T15030] veth1_to_team: Caught tx_queue_len zero misconfig [ 374.936896][T15030] netlink: 4 bytes leftover after parsing attributes in process `syz.3.2170'. [ 374.993882][T15032] netlink: 20 bytes leftover after parsing attributes in process `syz.4.2169'. [ 375.016864][T15030] netlink: 4 bytes leftover after parsing attributes in process `syz.3.2170'. [ 375.098672][T15039] xt_TCPMSS: Only works on TCP SYN packets [ 375.106351][T15031] IPVS: set_ctl: invalid protocol: 43 172.20.20.187:20001 [ 375.199011][T15042] netlink: 8 bytes leftover after parsing attributes in process `syz.2.2173'. [ 375.229818][T15043] netlink: 4 bytes leftover after parsing attributes in process `syz.3.2170'. [ 375.252454][T15046] netlink: 8 bytes leftover after parsing attributes in process `syz.2.2173'. [ 375.421473][T10288] ip6_tunnel: ip6tnl1 xmit: Local address not yet configured! [ 375.487873][T15038] netlink: 8 bytes leftover after parsing attributes in process `syz.0.2171'. [ 375.603796][T15032] bond0: (slave bond_slave_0): Releasing backup interface [ 375.766576][T15032] bond_slave_0: entered promiscuous mode [ 375.780043][T15032] bond_slave_0: entered allmulticast mode [ 375.813237][T10288] ip6_tunnel: ip6tnl1 xmit: Local address not yet configured! [ 375.956827][T15042] bond8: up delay (10) is not a multiple of miimon (7), value rounded to 7 ms [ 376.041476][T15042] bond8 (unregistering): Released all slaves [ 376.314029][T15046] workqueue: Failed to create a rescuer kthread for wq "bond8": -EINTR [ 377.156928][T15075] netlink: 'syz.1.2181': attribute type 1 has an invalid length. [ 377.384017][T15080] Freezing with imperfect legacy cgroup freezer. See cgroup.freeze of cgroup v2 [ 377.419086][T15075] workqueue: Failed to create a rescuer kthread for wq "bond8": -EINTR [ 377.696291][T15080] block nbd0: reconnected socket [ 377.742574][ T5619] block nbd0: Receive control failed (result -32) [ 378.333722][T15112] netdevsim netdevsim2: loading /lib/firmware/. failed with error -22 [ 378.436767][T15112] netdevsim netdevsim2: Direct firmware load for . failed with error -22 [ 378.511465][T15112] netdevsim netdevsim2: Falling back to sysfs fallback for: . [ 378.636867][T15112] [ 378.639262][T15112] ====================================================== [ 378.646372][T15112] WARNING: possible circular locking dependency detected [ 378.653454][T15112] syzkaller #0 Not tainted [ 378.657893][T15112] ------------------------------------------------------ [ 378.664945][T15112] syz.2.2189/15112 is trying to acquire lock: [ 378.671022][T15112] ffffffff8ec848e0 (fs_reclaim){+.+.}-{0:0}, at: __kmalloc_cache_noprof+0x61/0x660 [ 378.680470][T15112] [ 378.680470][T15112] but task is already holding lock: [ 378.687845][T15112] ffffffff8f5dea40 (gdp_mutex){+.+.}-{4:4}, at: get_device_parent+0x16f/0x3a0 [ 378.696773][T15112] [ 378.696773][T15112] which lock already depends on the new lock. [ 378.696773][T15112] [ 378.707193][T15112] [ 378.707193][T15112] the existing dependency chain (in reverse order) is: [ 378.716233][T15112] [ 378.716233][T15112] -> #8 (gdp_mutex){+.+.}-{4:4}: [ 378.723493][T15112] __mutex_lock+0x19d/0x1550 [ 378.728686][T15112] get_device_parent+0x16f/0x3a0 [ 378.734170][T15112] device_add+0x2d4/0xb80 [ 378.739046][T15112] device_create+0x269/0x300 [ 378.744182][T15112] msr_device_create+0x33/0x50 [ 378.749508][T15112] cpuhp_invoke_callback+0x434/0x810 [ 378.755355][T15112] cpuhp_thread_fun+0x362/0x780 [ 378.760751][T15112] smpboot_thread_fn+0x57c/0xa80 [ 378.766236][T15112] kthread+0x388/0x470 [ 378.770853][T15112] ret_from_fork+0x514/0xb70 [ 378.776030][T15112] ret_from_fork_asm+0x1a/0x30 [ 378.781341][T15112] [ 378.781341][T15112] -> #7 (cpuhp_state-up){+.+.}-{0:0}: [ 378.788924][T15112] cpuhp_thread_fun+0x127/0x780 [ 378.794326][T15112] smpboot_thread_fn+0x57c/0xa80 [ 378.799826][T15112] kthread+0x388/0x470 [ 378.804461][T15112] ret_from_fork+0x514/0xb70 [ 378.809701][T15112] ret_from_fork_asm+0x1a/0x30 [ 378.815027][T15112] [ 378.815027][T15112] -> #6 (cpu_hotplug_lock){++++}-{0:0}: [ 378.822804][T15112] cpus_read_lock+0x42/0x160 [ 378.827950][T15112] static_key_slow_inc+0x12/0x30 [ 378.833483][T15112] nbd_genl_reconfigure+0x1301/0x1e80 [ 378.839486][T15112] genl_family_rcv_msg_doit+0x233/0x340 [ 378.845583][T15112] genl_rcv_msg+0x614/0x7a0 [ 378.850633][T15112] netlink_rcv_skb+0x226/0x4a0 [ 378.855955][T15112] genl_rcv+0x28/0x40 [ 378.860479][T15112] netlink_unicast+0x7bb/0x940 [ 378.865815][T15112] netlink_sendmsg+0x813/0xb40 [ 378.871166][T15112] sock_sendmsg_nosec+0x13a/0x180 [ 378.876771][T15112] ____sys_sendmsg+0x54e/0x850 [ 378.882081][T15112] ___sys_sendmsg+0x2a5/0x360 [ 378.887318][T15112] __x64_sys_sendmsg+0x1b1/0x290 [ 378.892900][T15112] do_syscall_64+0x174/0x580 [ 378.898055][T15112] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 378.904511][T15112] [ 378.904511][T15112] -> #5 (&nsock->tx_lock){+.+.}-{4:4}: [ 378.912282][T15112] __mutex_lock+0x19d/0x1550 [ 378.917438][T15112] nbd_queue_rq+0x373/0x1150 [ 378.922614][T15112] blk_mq_dispatch_rq_list+0x499/0x1990 [ 378.928847][T15112] __blk_mq_sched_dispatch_requests+0xd36/0x1580 [ 378.935812][T15112] blk_mq_sched_dispatch_requests+0xd7/0x190 [ 378.942364][T15112] blk_mq_run_work_fn+0x16c/0x300 [ 378.947950][T15112] process_scheduled_works+0xa8e/0x14e0 [ 378.954057][T15112] worker_thread+0xa47/0xfb0 [ 378.959213][T15112] kthread+0x388/0x470 [ 378.963905][T15112] ret_from_fork+0x514/0xb70 [ 378.969060][T15112] ret_from_fork_asm+0x1a/0x30 [ 378.974423][T15112] [ 378.974423][T15112] -> #4 (&cmd->lock){+.+.}-{4:4}: [ 378.981682][T15112] __mutex_lock+0x19d/0x1550 [ 378.986949][T15112] nbd_queue_rq+0xc1/0x1150 [ 378.992009][T15112] blk_mq_dispatch_rq_list+0x499/0x1990 [ 378.998213][T15112] __blk_mq_sched_dispatch_requests+0xd36/0x1580 [ 379.005111][T15112] blk_mq_sched_dispatch_requests+0xd7/0x190 [ 379.011655][T15112] blk_mq_run_work_fn+0x16c/0x300 [ 379.017239][T15112] process_scheduled_works+0xa8e/0x14e0 [ 379.023432][T15112] worker_thread+0xa47/0xfb0 [ 379.028672][T15112] kthread+0x388/0x470 [ 379.033340][T15112] ret_from_fork+0x514/0xb70 [ 379.038501][T15112] ret_from_fork_asm+0x1a/0x30 [ 379.043824][T15112] [ 379.043824][T15112] -> #3 (set->srcu){.+.+}-{0:0}: [ 379.050992][T15112] __synchronize_srcu+0xc9/0x2f0 [ 379.056523][T15112] elevator_switch+0x1e8/0x7b0 [ 379.061916][T15112] elevator_change+0x2fa/0x480 [ 379.067238][T15112] elevator_set_default+0x375/0x440 [ 379.072992][T15112] blk_register_queue+0x3f3/0x4e0 [ 379.078670][T15112] __add_disk+0x6cb/0xe30 [ 379.083581][T15112] add_disk_fwnode+0x100/0x3a0 [ 379.088904][T15112] nbd_dev_add+0x733/0xb60 [ 379.093874][T15112] nbd_init+0x15f/0x1e0 [ 379.098725][T15112] do_one_initcall+0x250/0x870 [ 379.104056][T15112] do_initcall_level+0x10a/0x1a0 [ 379.109605][T15112] do_initcalls+0x59/0xa0 [ 379.114529][T15112] kernel_init_freeable+0x29d/0x3e0 [ 379.120276][T15112] kernel_init+0x1d/0x1d0 [ 379.125154][T15112] ret_from_fork+0x514/0xb70 [ 379.130299][T15112] ret_from_fork_asm+0x1a/0x30 [ 379.135621][T15112] [ 379.135621][T15112] -> #2 (&q->elevator_lock){+.+.}-{4:4}: [ 379.143479][T15112] __mutex_lock+0x19d/0x1550 [ 379.148642][T15112] elevator_change+0x1af/0x480 [ 379.153978][T15112] elevator_set_none+0xb5/0x140 [ 379.159392][T15112] blk_mq_update_nr_hw_queues+0x5ef/0x19f0 [ 379.165756][T15112] nbd_start_device+0x189/0xb30 [ 379.171178][T15112] nbd_genl_connect+0x1597/0x1c10 [ 379.176782][T15112] genl_family_rcv_msg_doit+0x233/0x340 [ 379.182883][T15112] genl_rcv_msg+0x614/0x7a0 [ 379.187941][T15112] netlink_rcv_skb+0x226/0x4a0 [ 379.193291][T15112] genl_rcv+0x28/0x40 [ 379.197831][T15112] netlink_unicast+0x7bb/0x940 [ 379.203145][T15112] netlink_sendmsg+0x813/0xb40 [ 379.208549][T15112] sock_sendmsg_nosec+0x13a/0x180 [ 379.214132][T15112] ____sys_sendmsg+0x54e/0x850 [ 379.219624][T15112] ___sys_sendmsg+0x2a5/0x360 [ 379.224856][T15112] __x64_sys_sendmsg+0x1b1/0x290 [ 379.230371][T15112] do_syscall_64+0x174/0x580 [ 379.235518][T15112] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 379.241982][T15112] [ 379.241982][T15112] -> #1 (&q->q_usage_counter(io)#49){++++}-{0:0}: [ 379.250624][T15112] blk_alloc_queue+0x544/0x690 [ 379.255936][T15112] __blk_mq_alloc_disk+0x194/0x390 [ 379.261709][T15112] nbd_dev_add+0x494/0xb60 [ 379.266677][T15112] nbd_init+0x15f/0x1e0 [ 379.271388][T15112] do_one_initcall+0x250/0x870 [ 379.276708][T15112] do_initcall_level+0x10a/0x1a0 [ 379.282190][T15112] do_initcalls+0x59/0xa0 [ 379.287067][T15112] kernel_init_freeable+0x29d/0x3e0 [ 379.292826][T15112] kernel_init+0x1d/0x1d0 [ 379.297706][T15112] ret_from_fork+0x514/0xb70 [ 379.302916][T15112] ret_from_fork_asm+0x1a/0x30 [ 379.308245][T15112] [ 379.308245][T15112] -> #0 (fs_reclaim){+.+.}-{0:0}: [ 379.315515][T15112] __lock_acquire+0x1520/0x2cf0 [ 379.320914][T15112] lock_acquire+0x106/0x350 [ 379.325970][T15112] fs_reclaim_acquire+0x71/0x100 [ 379.331478][T15112] __kmalloc_cache_noprof+0x61/0x660 [ 379.337309][T15112] get_device_parent+0x255/0x3a0 [ 379.342794][T15112] device_add+0x2d4/0xb80 [ 379.347677][T15112] firmware_fallback_sysfs+0x2dd/0xa40 [ 379.353784][T15112] _request_firmware+0x1049/0x1780 [ 379.359524][T15112] request_firmware+0x36/0x50 [ 379.364763][T15112] devlink_compat_flash_update+0x157/0x2c0 [ 379.371241][T15112] dev_ethtool+0x23b7/0x29c0 [ 379.376516][T15112] dev_ioctl+0x392/0x1150 [ 379.381458][T15112] sock_do_ioctl+0x23e/0x320 [ 379.386606][T15112] sock_ioctl+0x57a/0x7e0 [ 379.391494][T15112] __se_sys_ioctl+0xfc/0x170 [ 379.396630][T15112] do_syscall_64+0x174/0x580 [ 379.401783][T15112] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 379.408228][T15112] [ 379.408228][T15112] other info that might help us debug this: [ 379.408228][T15112] [ 379.418537][T15112] Chain exists of: [ 379.418537][T15112] fs_reclaim --> cpuhp_state-up --> gdp_mutex [ 379.418537][T15112] [ 379.430839][T15112] Possible unsafe locking scenario: [ 379.430839][T15112] [ 379.438363][T15112] CPU0 CPU1 [ 379.443789][T15112] ---- ---- [ 379.449191][T15112] lock(gdp_mutex); [ 379.453119][T15112] lock(cpuhp_state-up); [ 379.459996][T15112] lock(gdp_mutex); [ 379.466438][T15112] lock(fs_reclaim); [ 379.470533][T15112] [ 379.470533][T15112] *** DEADLOCK *** [ 379.470533][T15112] [ 379.478692][T15112] 3 locks held by syz.2.2189/15112: [ 379.483907][T15112] #0: ffff8880777af258 (&devlink->lock_key#5){+.+.}-{4:4}, at: devlink_compat_flash_update+0xa6/0x2c0 [ 379.495088][T15112] #1: ffffffff8e9f5988 (umhelper_sem){++++}-{4:4}, at: usermodehelper_read_trylock+0xfc/0x2c0 [ 379.505480][T15112] #2: ffffffff8f5dea40 (gdp_mutex){+.+.}-{4:4}, at: get_device_parent+0x16f/0x3a0 [ 379.514840][T15112] [ 379.514840][T15112] stack backtrace: [ 379.520805][T15112] CPU: 0 UID: 0 PID: 15112 Comm: syz.2.2189 Not tainted syzkaller #0 PREEMPT(full) [ 379.520832][T15112] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 379.520845][T15112] Call Trace: [ 379.520854][T15112] [ 379.520866][T15112] dump_stack_lvl+0xe8/0x150 [ 379.520898][T15112] print_circular_bug+0x2e1/0x300 [ 379.520935][T15112] check_noncircular+0x12e/0x150 [ 379.520973][T15112] __lock_acquire+0x1520/0x2cf0 [ 379.521009][T15112] ? lockdep_unlock+0x5d/0xd0 [ 379.521033][T15112] ? __lock_acquire+0x13e8/0x2cf0 [ 379.521066][T15112] ? __kmalloc_cache_noprof+0x61/0x660 [ 379.521093][T15112] lock_acquire+0x106/0x350 [ 379.521120][T15112] ? __kmalloc_cache_noprof+0x61/0x660 [ 379.521155][T15112] fs_reclaim_acquire+0x71/0x100 [ 379.521181][T15112] ? __kmalloc_cache_noprof+0x61/0x660 [ 379.521207][T15112] __kmalloc_cache_noprof+0x61/0x660 [ 379.521234][T15112] ? get_device_parent+0x255/0x3a0 [ 379.521256][T15112] ? get_device_parent+0x255/0x3a0 [ 379.521281][T15112] get_device_parent+0x255/0x3a0 [ 379.521305][T15112] device_add+0x2d4/0xb80 [ 379.521328][T15112] firmware_fallback_sysfs+0x2dd/0xa40 [ 379.521351][T15112] ? kfree+0x1c5/0x640 [ 379.521376][T15112] _request_firmware+0x1049/0x1780 [ 379.521418][T15112] ? __pfx__request_firmware+0x10/0x10 [ 379.521450][T15112] ? xa_get_mark+0x67/0x7a0 [ 379.521479][T15112] request_firmware+0x36/0x50 [ 379.521510][T15112] devlink_compat_flash_update+0x157/0x2c0 [ 379.521538][T15112] ? dev_ethtool+0x224a/0x29c0 [ 379.521558][T15112] ? dev_ioctl+0x392/0x1150 [ 379.521582][T15112] ? sock_ioctl+0x57a/0x7e0 [ 379.521612][T15112] ? __se_sys_ioctl+0xfc/0x170 [ 379.521631][T15112] ? do_syscall_64+0x174/0x580 [ 379.521661][T15112] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 379.521684][T15112] ? __pfx_devlink_compat_flash_update+0x10/0x10 [ 379.521714][T15112] ? _raw_spin_unlock_irqrestore+0x30/0x80 [ 379.521744][T15112] ? _raw_spin_unlock_irqrestore+0x4c/0x80 [ 379.521781][T15112] dev_ethtool+0x23b7/0x29c0 [ 379.521801][T15112] ? __lock_acquire+0x683/0x2cf0 [ 379.521836][T15112] ? __pfx_dev_ethtool+0x10/0x10 [ 379.521857][T15112] ? kasan_quarantine_put+0xbb/0x1f0 [ 379.521885][T15112] ? dev_load+0x21/0x1f0 [ 379.521913][T15112] ? dev_load+0x21/0x1f0 [ 379.521937][T15112] ? dev_load+0x21/0x1f0 [ 379.521960][T15112] dev_ioctl+0x392/0x1150 [ 379.521986][T15112] sock_do_ioctl+0x23e/0x320 [ 379.522020][T15112] ? __pfx_sock_do_ioctl+0x10/0x10 [ 379.522051][T15112] ? hook_file_ioctl+0x1f0/0x5f0 [ 379.522131][T15112] sock_ioctl+0x57a/0x7e0 [ 379.522163][T15112] ? __pfx_sock_ioctl+0x10/0x10 [ 379.522194][T15112] ? __fget_files+0x2a/0x420 [ 379.522222][T15112] ? __fget_files+0x3a2/0x420 [ 379.522247][T15112] ? __fget_files+0x2a/0x420 [ 379.522276][T15112] ? bpf_lsm_file_ioctl+0x9/0x20 [ 379.522300][T15112] ? __pfx_sock_ioctl+0x10/0x10 [ 379.522331][T15112] __se_sys_ioctl+0xfc/0x170 [ 379.522350][T15112] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 379.522373][T15112] do_syscall_64+0x174/0x580 [ 379.522406][T15112] ? clear_bhb_loop+0x70/0xc0 [ 379.522431][T15112] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 379.522453][T15112] RIP: 0033:0x7fbde999e0d9 [ 379.522473][T15112] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 379.522492][T15112] RSP: 002b:00007fbdea857028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 379.522515][T15112] RAX: ffffffffffffffda RBX: 00007fbde9c25fa0 RCX: 00007fbde999e0d9 [ 379.522531][T15112] RDX: 0000200000000340 RSI: 0000000000008946 RDI: 0000000000000003 [ 379.522546][T15112] RBP: 00007fbde9a35024 R08: 0000000000000000 R09: 0000000000000000 [ 379.522560][T15112] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 379.522573][T15112] R13: 00007fbde9c26038 R14: 00007fbde9c25fa0 R15: 00007ffea78e19d8 [ 379.522599][T15112] [ 380.013011][T15127] rfkill: input handler disabled [ 380.018715][T15127] rfkill: input handler enabled [ 380.061699][T15118] __nla_validate_parse: 2 callbacks suppressed [ 380.061719][T15118] netlink: 56 bytes leftover after parsing attributes in process `syz.4.2190'.