last executing test programs: 1.763038894s ago: executing program 4 (id=7331): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = socket$inet6(0x10, 0x3, 0x0) sendmsg(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)=[{&(0x7f0000001500)="5500000020007fafb72d13b2a4a2719302000000030b43026c26236925000400fe7f0000bd2dca8a9848a3c728f1c46b7b31afdc1338d509000000000100005ae583de0dd7d8319f98af84fda542e718f94b929ade", 0x55}], 0x1}, 0x0) sendmsg$nl_generic(r0, 0x0, 0xc000) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r3, 0x8933, &(0x7f00000000c0)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_START_AP(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000240)={0x80, r4, 0x5, 0x4, 0x25dfdbfe, {{}, {@val={0x8, 0x3, r5}, @void}}, [@beacon=[@NL80211_ATTR_BEACON_HEAD={0x50, 0xe, {{{}, {0x1}, @device_b, @broadcast, @from_mac=@broadcast}, 0x200000000, @random=0x5, 0x0, @void, @void, @val={0x3, 0x1, 0xb9}, @void, @void, @void, @void, @void, @void, @val={0x2d, 0x1a, {0x20, 0x2, 0x1, 0x0, {0x6, 0x4, 0x0, 0x2, 0x0, 0x0, 0x1, 0x1}, 0x6, 0x2, 0xc0}}, @void, @val={0x71, 0x7, {0x0, 0x1, 0x0, 0x1, 0x1, 0xf0}}, @void}}, @NL80211_ATTR_IE_ASSOC_RESP={0x4}], @NL80211_ATTR_BEACON_INTERVAL={0x8}, @NL80211_ATTR_DTIM_PERIOD={0x8, 0xd, 0xfffffffd}]}, 0x80}}, 0x0) syz_genetlink_get_family_id$ipvs(0x0, r2) 1.53959135s ago: executing program 4 (id=7339): socket$kcm(0x2, 0x3, 0x2) socket$rds(0x15, 0x5, 0x0) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) socket$nl_route(0x10, 0x3, 0x0) socket$key(0xf, 0x3, 0x2) r0 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_int(r0, 0x107, 0xf, &(0x7f0000006ffc)=0x8, 0x4) socketpair(0x1, 0x20000000000001, 0x0, &(0x7f0000000100)={0xffffffffffffffff}) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000140)=0x14) bind$packet(r0, &(0x7f0000000000)={0x11, 0x0, r2, 0x1, 0x0, 0x6, @link_local}, 0x14) sendto$inet6(r0, &(0x7f0000000280)="020409fcec074802010e0200c52cf7c20675e005b02f0800eb2b2ff0dac8897c6b112002faffffff3066090cb600c5471d130a66321a54e7df305f80a88161b6fd8f24286a57c3feffff", 0xfc13, 0x800, 0x0, 0x2f) 1.44382814s ago: executing program 4 (id=7341): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0xc1842, 0x0) r1 = socket$inet6_sctp(0xa, 0x5, 0x84) r2 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_fanout(r2, 0x107, 0x12, &(0x7f0000000140)={0x0, 0x6}, 0x4) setsockopt$packet_fanout_data(r2, 0x107, 0x16, &(0x7f0000000100)={0x2, &(0x7f0000000200)=[{0xac}, {0x6}]}, 0x10) ioctl$int_in(r1, 0x5452, &(0x7f0000000000)=0xf) setsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX_OLD(r1, 0x84, 0x6b, &(0x7f0000000380)=[@in6={0xa, 0x0, 0x0, @remote, 0x9}], 0x1c) setsockopt(r1, 0x84, 0x7f, &(0x7f0000000040)="020000000980ffff", 0x8) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r3, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) getpeername$inet6(r1, &(0x7f00000000c0)={0xa, 0x0, 0x0, @mcast1}, &(0x7f0000000180)=0x1c) r4 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x402000, 0x0) getsockopt$inet_sctp6_SCTP_GET_PEER_ADDR_INFO(r1, 0x84, 0xf, &(0x7f0000000280)={0x0, @in={{0x2, 0x4e21, @broadcast}}, 0xb27, 0x4, 0x9, 0xd, 0x7}, &(0x7f00000001c0)=0x98) close(r4) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000140)) ioctl$SIOCSIFHWADDR(r4, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @link_local}) write$cgroup_devices(r0, &(0x7f0000000840)=ANY=[@ANYBLOB="1e0308004d6b71ef288563"], 0xffdd) r5 = socket$nl_route(0x10, 0x3, 0x0) getpeername$packet(r2, &(0x7f00000003c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @local}, &(0x7f0000000400)=0x14) sendmsg$nl_route_sched(r5, &(0x7f0000000500)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x40000}, 0xc, &(0x7f00000004c0)={&(0x7f0000000440)=@newchain={0x4c, 0x64, 0xf20, 0x70bd25, 0x25dfdbfe, {0x0, 0x0, 0x0, r6, {0xb, 0xd}, {0x10, 0x9}, {0xffe0, 0x2}}, [@TCA_CHAIN={0x8, 0xb, 0x1}, @TCA_RATE={0x6, 0x5, {0x6}}, @TCA_RATE={0x6, 0x5, {0x1, 0x8}}, @TCA_RATE={0x6, 0x5, {0x6, 0x9}}, @TCA_RATE={0x6, 0x5, {0x9, 0xff}}]}, 0x4c}, 0x1, 0x0, 0x0, 0x4005}, 0x20000000) close(0x3) close(0x4) 1.426627772s ago: executing program 1 (id=7342): r0 = socket$kcm(0x2, 0x1000000000000002, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0xc, 0xe, &(0x7f0000000b80)=ANY=[@ANYBLOB="b702000003000000bfa30000000000000703000000feffff7a0af0ff0100000079a4f0ff00000000b7060000ffffffff2d6405000000000065040400010000000404000001007d60b7030000000000006a0a00fe00000000850000000d000000b70000000000000095000000000000005ecefab8f2e85c6c1ca711fcd0cdfa146ec561750379585e5a076d839240d29c034055b67dafe6c8dc3d5d78c07fa1f7e655ced4fbd44e24eb0d34e4d5b3185fec0e07004e60c08dc8b8dbf11e6e94d75938321a3aa502cd2424a66e6d2ef831ab7ea0c34f17e3946ef3bb622003b538dfd8e012e79578e51bc53099e90f4580d760551b5b341a29f31e3a06d1ddd6152f7cbdb9cd38bdb2209c67deca8eeb9c15ab3a14817ac61e4dd11183a13477bf7e860e3670ef0e789f65f1328d6704902cbe7bc04b82d2789cb132b8667c2147661df28d9961b63e1a9cf6c2a660a1fe3c184b751c51160fb20b1c581e7be6ba0dc001c4110555850915148ba532e6ea09c346dfebd38608b3280080005d9a9500000000000000334d83239dd27080851dcac3c12233f9a1fb9c2aec61ce63a38d2fd50117b89a9ab359b4eea0c6e95767d42b4e54861d0227dbfd2e6d7f715a7f3deadd7130856f756436303767d2e24f29e5dad9796efea77aeea0182babd18cac1bd4f4390af9a9ceafd0002cab154ad029a1090000002780870014f51c3c975d5aec84222fff0d7216fdb0d3a0ec4be3e563112f0b39501aafe234870072858dc06e7c337642d3e5a815232f5e16c1b30c3a6a71bc85018e5ff2c91018afc9ffc2cc788bee1b47683db01a469398685211dfbbae3e2ed0a50e7313bff5d4c391ddece00fc772dd6b4d4de2a41990f05ca3bdfc92c88c5b8dcd36e7487afa447e2edfae4f390a8337841cef386e22cc22ee17476d738952229682e24b92533ac2a9f5a699593f084419cae0b4532bcc97d3ae486aca54183fb01c73f979ca9857399537f5dc2acb72e7ead0509d380578673f8b6e74ce23877a6b24db0e067345560942fa629fbef2461c96a088a22e8b15c3e233db7ab22e30d46a9d24d37cef099ece72f2090000f44a3210223fdae7ed04935c3c90941576aebc8619d73415cda2130f5011e4845505000001000000004f50adab988dd8e12baf5cc9398fff00404d5d99f82e20ee6a8c88e18c2977aab37d9ac4cfc1c7b400000000000007ff57c39495d5e41ff868f7ca1664fe2f3ced846891180604b6dd2499d16d7d9158ffffffff00000000ef069dc42749a89f854797f29d0000002d8c38a967c1bbe09315c29877a331bcc87dc3addb08141bdee5d27874b2f663ddeef0005b3d96c7aabf4df517d90bdc01e73835d5a3e1a90800c66ee2b1ad76dff9f9000071414c99d4894ee7f8249dc1e3428d2129369ee1b85af6eb2eea0d0df414b315f651c8412392191fa83ee830548f11e1036a8debd64cbe359454a3f2239cfe35f81b7a490f167e6d5c1109000000000000000042b8ff8c21ad702ccacad5b39eef213d1ca296d2a27798c8ce2a305c040035cf4b22549a4bd92052188bd1f285f653b621491dc6aaee0200e2ff08644fb94c06006eff1be2f633c1d987591ec3db58a7bb3042ec3f771f7a1338a5c3dd35e926049fe86e09c58e273cd905deb28c13c1ed1c0d9cae846bf463261135e24d154114df1381b02a0dcbfa8cce7b893e578af7dc7d5e87d44ff828de453f34c2b18660b080efc707e676e1fb4d5825c0ca177a4c7fbb4e62b445c00f576b2b5cc7f819abd0f884cc4806f40300966fcf1e54f5a2d38708194cd6f496e5dee734fe7da3770845cf442d488afdc0e1700000000000000000000000000000000000000000000000000000520500002952a93466ae595c6a8cda690d192a070886df42b27098773b45198b4a34ac977ebd4450e121d01342703f5bf030e935878a6d169c80aa4252d4ea6b8f6216ff202b5b5a182cb5e838b307632d03a7ca6f6d0339f9a33c3093c3690d10ecb65dc5b47481edbf1f000000000000004d16d29c28eb5167e9936ed327fb237a62415f78000000005f0dec1b3ccd35364600000000000000000000000000000000000000000000000000000000000026ded4dd6fe1518cc7802043ecfe69f743f1213bf8179ecd9e5a225d67521dc728eac7d80a5656ac2cbde21d3ebfbf69ff861f4394836ddf128d6d19079e64336e7c676505c78ad67548f4b192be1827fcd95cf107753cb0a6a979d3db0c81c6281e2d8429a863903ca75f4c7df3ea8fc2018d07af1491ef060cd4403a099f32468f65bd06b40824095135861b5cc03f1a1561f0589e0d12969bc982ff5d8e9b986c0c6c747d9a1cc500bb892c3a16ff10feea20bdac00000b0000000000ca06f256c8028e0f9b65f037b21f3289f86a6826c69fa35ba5cbc3f2db1516ffc5c6e3fa618b24a6ce16d6c7010bb37b61fa0a2d8974e69115d33394e86e5dd921a5eadd4b838297ba20f96936b7e4746e92dea6c5d1d33d84d96b50fb000000ae07c65b71088dd7d5d1e1bab9000000000000000000000000b5ace293d5c833c13e3229432ad71d646218b5229dd88137fc7c59aa242af3bb4efb82055a3b61227ad40f52c9f2500579aca11033ec14bb9cc16bd83a00840e602c28ec78e116ae46c4897e2795b6ff92e9a1e24b0b855c02f257aac5af18d8c6b7add58ffb25f339297729a7a51810134d3dfbf71f6516737be55c06d9cdcfb1e29b10b50000eb4acff90756dba1ecf9f58afd3c19b5c4558ba9af6b7333c894a1fb29ade9ad75c9c022e8d03fe28bc358684492aa771dbfe8e4cd14dc5c1eb98b63198f6f830745fe89ad349ffaad76ff9dd643796caffdf67af5dd476c37e7e9a84e2e5da2696e285a59b51c34a5384f2cf51180c159ce40c14089c82759106f422582b42e3e8484ea5a6ad9aa52106eafe0e0caea1ad4cb23f3c2b8a0f455ba69ea284c268d54b43158a8b1d128d02af243b3dc1cab794c9ac57a2a7332f4d8764c302ccd5aac114482b619fc575aa0dd2777e881e29a854380ecf1e49db5a1517ec40bb3fa44f9959bad67ccaba76408da35c9f1534c8bd48bbd61627a2e0a74b5e6aefb7eee403502734137ff47257f164391c673b6079e65d7295eed164ca63e4ea26dce0fb3ce0f6591d80dfb8f386bb79f558982d57c556ca1427b5960b79990565ca2a20996fcba472213744d3a156979651596afde2b0089f023fcfccd072bd6ea8445fc787390d71ec61d5b7b0f05f6931914bf49aa0d66eff294271a93e32f54f281068514a4cd2d0700a43df59e9924e4affdbd22405e675e9d7cdc10546571131831d4dc8c8363077a908d9ae4f27ff095f5b07667f93a3573d3fabfca58ee0a6b6a691102bb3c7be4dc5b816853275e7ae8c13ec341bad15353fad794b46c4fd73e1b4cc78de2156cb158870d5b8446dae9ba5f7f244e6cf8f6791671057347208a313ebbcb72b04706005670f2b0055e440d72c7c3316982c6ebe8675458cf6bb393b007f5cedb7bc411834600000000000000000000000000a20071b07d568a8150ed646b4978d0226d9651647a5999ae7c7c85322a215fcdb1adbad63499518fe0d10145d430422c78367dfa941f74b63f3884565ac89c673da2c2b1172be5f2cd1f3f453ebddd432bd24c73fa773b739e20fcec16a821230654a383ac1868495f67d942c772ca75e09073dbe9307ff5cac7c2c411149a4d989a8a019e068da218d4bc34e4102fd2f97397331e4cd70b4915582b635f07ca87f00dc929f902540f565c20add8675b79e005cf0277d954697317b907b77fa5d6b7feaebaf676a2a37de8aa70748fee4bc198ffd3e2de11eb0eff896fd94de0805ba6b1054a7b3e300d4581e9af62a1ecaee96d2819b3d192e5b9561eb622da25450f586be14017a1cf74f89a1dd18af004decfe266134c3d036ae7996931fe6008a73ed34c35f0da4ffee1fe63bc1af6ef1b4731d50b8ceb582a1e9c6e8d97f8290cc105754f592d16ccdb1df8636d7ca5e372cea97dd0f005cc7092b126dd46758917fb0d94b8483d403bd451429cc1660f0b5a529d8134dc2702f6d8e2f943d98fbe50a3ba653f13f98a00fcbf311f9758ade8e4eb87b4b9fb2d387f5d8c4bdcab2fff9ed8c9de961fd831a070381c8020352fea7c334b2959ddd956701a7ea415e224a81c9fa1ebbabe74f7743e09b6c8b72650b51d5c2000ef3679c039b3604374fc1af7ab354204afbd24f0e701bc08a98452ce2668617e85e0d876f5a8b6d9b777f1c384d8a9883e4262defb6b9aab8d5b76bc91ca50f87966797da2499ca0ac76707c0408a7b6d8708fe7714988babdc11f"], &(0x7f0000000340)='syzkaller\x00'}, 0x48) r1 = syz_init_net_socket$ax25(0x3, 0x3, 0x0) recvmmsg(r1, &(0x7f0000003840)=[{{0x0, 0x0, 0x0}}], 0x1, 0x40, 0x0) r2 = syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10) sendmsg$netlink(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000040)=ANY=[@ANYBLOB="1c00000014001100010080000000000009000000080002"], 0x1c}], 0x1}, 0x0) r3 = socket$can_raw(0x1d, 0x3, 0x1) recvmsg$can_raw(r3, &(0x7f0000000300)={&(0x7f0000000140)=@nfc_llcp, 0x80, &(0x7f0000000840)=[{&(0x7f00000003c0)=""/121, 0x79}, {&(0x7f0000000440)=""/163, 0xa3}, {&(0x7f0000000500)=""/243, 0xf3}, {&(0x7f0000000600)=""/107, 0x6b}, {&(0x7f0000000680)=""/97, 0x61}, {&(0x7f0000000700)=""/71, 0x47}, {&(0x7f0000000780)=""/141, 0x8d}], 0x7, &(0x7f00000000c0)=""/57, 0x39}, 0x40002120) accept4(r3, &(0x7f0000000a00)=@qipcrtr, &(0x7f0000000a80)=0x80, 0x100c00) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f00000008c0)={'vxcan1\x00', 0x0}) r5 = syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0) ioctl$sock_inet_SIOCSIFADDR(r5, 0x8916, &(0x7f0000000000)={'veth0_to_hsr\x00', {0x2, 0x0, @dev={0xac, 0x14, 0x14, 0x2}}}) socket$nl_netfilter(0x10, 0x3, 0xc) openat$cgroup_int(0xffffffffffffffff, &(0x7f0000000080)='cgroup.max.depth\x00', 0x2, 0x0) sendmsg$inet(r0, &(0x7f0000000380)={&(0x7f0000000080)={0x2, 0x4e24, @multicast2}, 0x10, &(0x7f00000009c0)=[{&(0x7f0000000100)="00446916ab", 0x5}, {&(0x7f0000000900)="fa8796617dedaa4609af5a1193042900508b2c77705cafec208566850c9f0a64856a6f449dc7ff73cb0641f33d9e77cb13839b2d6a844c3ce9fb6188228764de31687e000dcf2cfd2b09fbbdfff7ae871352f4de832bf7dcaf6eba93df1a44ed6913574b7a032f4c5b9abd0249c096d635354a247d9cf4313aee36beea26e77a6d2c93ce3afd87e66dffbed891896f8c49ebbd", 0x93}], 0x2, &(0x7f0000001b40)=[@ip_pktinfo={{0x1c, 0x0, 0x8, {r4, @dev={0xac, 0x14, 0x14, 0x29}, @local}}}], 0x20}, 0x0) 1.111159003s ago: executing program 3 (id=7348): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000340)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a01010000000000000000010000000900010073797a30000000002c000000030a01020000000000000000010000000900010073797a30000000000900030073797a310000000038000000030a01040000000000000000010000010900030001007a32000000000c00024000000000000000010900010073797a300000"], 0xac}, 0x1, 0x0, 0xfffffffffffffff5, 0x4040}, 0x0) 1.102496501s ago: executing program 1 (id=7349): r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000000)={0x1f, 0xffffffffffffffff, 0x4}, 0x6) write$bt_hci(r0, &(0x7f00000000c0)=ANY=[@ANYBLOB="000000003201"], 0x138) r1 = socket$kcm(0x10, 0x2, 0x0) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000500), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f0000000100)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_JOIN_MESH(r2, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000180)=ANY=[@ANYBLOB='@\x00\x00\x00', @ANYRES16=r3, @ANYBLOB="010000000000000000000200000008000300", @ANYRES32=r4, @ANYBLOB="0c00990000000000000000000800a100ffff0000080026008d03000008009f"], 0x40}, 0x1, 0x0, 0x0, 0x44}, 0x0) r5 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=@base={0xf, 0x4, 0x8, 0x8}, 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000005c0)={0x0, 0xc, &(0x7f0000000440)=@framed={{}, [@ringbuf_output={{0x18, 0x1, 0x1, 0x0, r5}, {}, {}, {}, {}, {}, {}, {0x85, 0x0, 0x0, 0x3}}]}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0xd, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sock_ops, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) 996.104012ms ago: executing program 3 (id=7350): r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, 0x0, 0xc000) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f00000000c0)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_START_AP(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000700)={0x2ac, r3, 0x5, 0x4, 0x25dfdbfe, {{}, {@val={0x8, 0x3, r4}, @void}}, [@beacon=[@NL80211_ATTR_BEACON_HEAD={0x244, 0xe, {{{}, {0x1}, @device_a, @broadcast, @from_mac=@broadcast}, 0x200000000, @random=0x5, 0x0, @void, @void, @val={0x3, 0x1, 0xb9}, @void, @void, @void, @void, @void, @void, @val={0x2d, 0x1a, {0x20, 0x2, 0x1, 0x0, {0x6, 0x4, 0x0, 0x2, 0x0, 0x0, 0x1, 0x1}, 0x6, 0x2, 0xc0}}, @void, @val={0x71, 0x7, {0x0, 0x1, 0x0, 0x1, 0x1, 0xf0}}, @void, [{0xdd, 0x6d, "3674077d32b81a814023bc30af67d0fd786295e00568b56597186e032124964d3cec15e0ee41bb6fe95006ac171ada257da4111a56e517f681054ff27752fae16c783a6fe4ea576ac8144bc8041e8399323eb2555ecaa2a7426573fd2b7894a81d8aa8a4226cfa5dcdf918aba8"}, {0xdd, 0x91, "a7d68dbf0b11fd0e743b8c65db42f9d36d6725393a6d2b05a2acb11d9d207dec8ee99e565aade32a8db635ba2dc66dd62d86d3f91124d50b32007bd5f34077932d020d8adce901bbf48b1b2544f44dd5bf258d17880604b49b0334b2d169572951b4d64d7ee9579ced9e304ebd87707b0f10e62c44342e3a390a8c84f73bac6a9861e296effdabe5ab7c59958e4ffb0bb9"}, {0xdd, 0xf0, "f4cbd0891eedf19d2637033224f5846d0d23fbcbfa7c4c47e0ec1b8e1efbaffb1b5f474809614d941f962b771842525aa4121dcc389a540a900f37625dd26e43223a1f07a64304d73774d7d539c1056686707f1aad25ba234509f6d5ccb5ec2dd2ee37b20ebbc33c0cb813e6471c15dbbac8d7bc17aa30d117f753fd38b266b030c7ddd8dc6b16a7539b51a6ec31a2848f0c6536124fc430bceda56399d261dd03575e1ffebfa0dc394e060620793c55ddb6b303ab462f1f21371af87a366e3345d61d9bdd3597b64b141dd68a5acf4a5a72800000795dd33e17945c48fac4c9cdeef33473a945ba8c5707fba1543e14"}]}}, @NL80211_ATTR_IE_ASSOC_RESP={0x4}], @NL80211_ATTR_HE_OBSS_PD={0x40, 0x117, 0x0, 0x1, [@NL80211_HE_OBSS_PD_ATTR_MAX_OFFSET={0x5, 0x2, 0xa}, @NL80211_HE_OBSS_PD_ATTR_BSS_COLOR_BITMAP={0xc, 0x4, "294200b5f6ee2ea5"}, @NL80211_HE_OBSS_PD_ATTR_BSS_COLOR_BITMAP={0xc, 0x4, "eecf2ec97d2e1f3d"}, @NL80211_HE_OBSS_PD_ATTR_BSS_COLOR_BITMAP={0xc, 0x4, "8a9916783bd35594"}, @NL80211_HE_OBSS_PD_ATTR_MIN_OFFSET={0x5, 0x1, 0x12}]}, @NL80211_ATTR_DTIM_PERIOD={0x8, 0xd, 0xfffffffd}]}, 0x2ac}}, 0x0) bpf$PROG_LOAD_XDP(0x5, &(0x7f00000003c0)={0x6, 0x2, &(0x7f0000000180)=@raw=[@map_idx_val={0x18, 0xb, 0x6, 0x0, 0xb, 0x0, 0x0, 0x0, 0x5}], &(0x7f00000001c0)='GPL\x00', 0xd, 0x0, 0x0, 0x41100, 0x43, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, &(0x7f00000002c0)={0x3, 0x5, 0x200, 0x9}, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x1}, 0x90) syz_genetlink_get_family_id$ipvs(0x0, r1) 993.071909ms ago: executing program 1 (id=7352): socket$nl_route(0x10, 0x3, 0x0) (async) socket$xdp(0x2c, 0x3, 0x0) (async) socket$xdp(0x2c, 0x3, 0x0) r0 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_SIOCOUTQ(r0, 0x5411, &(0x7f00000002c0)) (async) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000180)=ANY=[], 0x3c}, 0x1, 0x0, 0x0, 0x24000855}, 0x4040050) 931.781686ms ago: executing program 1 (id=7354): r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = syz_genetlink_get_family_id$netlbl_mgmt(&(0x7f0000000140), 0xffffffffffffffff) sendmsg$NLBL_MGMT_C_VERSION(0xffffffffffffffff, &(0x7f0000000480)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f0000000340)={&(0x7f0000000180)={0x74, r1, 0x800, 0x70bd2b, 0x25dfdbfe, {}, [@NLBL_MGMT_A_FAMILY={0x6, 0xb, 0x6}, @NLBL_MGMT_A_IPV4MASK={0x8, 0x8, @initdev={0xac, 0x1e, 0x0, 0x0}}, @NLBL_MGMT_A_IPV4MASK={0x8, 0x8, @rand_addr=0x64010101}, @NLBL_MGMT_A_IPV6MASK={0x14, 0x6, @empty}, @NLBL_MGMT_A_CV4DOI={0x8, 0x4, 0x2}, @NLBL_MGMT_A_IPV6MASK={0x14, 0x6, @mcast1}, @NLBL_MGMT_A_CV4DOI={0x8, 0x4, 0x3}, @NLBL_MGMT_A_FAMILY={0x6, 0xb, 0x9}, @NLBL_MGMT_A_IPV4ADDR={0x8, 0x7, @multicast2}]}, 0x74}, 0x1, 0x0, 0x0, 0x1}, 0x815) r2 = socket$netlink(0x10, 0x3, 0x12) sendmsg$nl_route(r0, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000540)={&(0x7f00000002c0)=ANY=[@ANYBLOB="180000006a0001000000000000009c39c743"], 0x18}}, 0x0) r3 = socket(0x10, 0x803, 0x0) sendmsg$IPVS_CMD_SET_INFO(r3, &(0x7f0000000b00)={0x0, 0x0, &(0x7f0000000ac0)={0x0, 0x14}, 0x1, 0x0, 0x0, 0x400c050}, 0x0) getsockname$packet(r3, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) r5 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r5, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000380)=ANY=[@ANYBLOB="3c0000001000850600"/20, @ANYRES32=r4, @ANYBLOB="01000000020000001c0012000c000100626f6e64000000000c0002000800010005"], 0x3c}}, 0x0) sendmsg$nl_route(r3, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f00000003c0)=@newlink={0x68, 0x10, 0xffffff1f, 0xfffffffc, 0x80, {0x0, 0x0, 0x0, 0x0, 0x0, 0x3f00}, [@IFLA_LINKINFO={0x40, 0x12, 0x0, 0x1, @ip6gretap={{0xe}, {0x2c, 0x2, 0x0, 0x1, [@IFLA_GRE_REMOTE={0x14, 0x7, @private0}, @IFLA_GRE_LOCAL={0x14, 0x6, @mcast1}]}}}, @IFLA_MASTER={0x8, 0xa, r4}]}, 0x68}, 0x1, 0x0, 0x0, 0x2000c0c1}, 0x40000) r6 = bpf$MAP_CREATE(0x0, &(0x7f0000000400)=@base={0xe, 0x4, 0x4, 0x3}, 0x48) r7 = accept$inet6(r3, 0x0, &(0x7f00000004c0)) recvmsg(r7, &(0x7f0000000780)={0x0, 0x0, &(0x7f0000000500)=[{&(0x7f00000005c0)=""/113, 0x71}, {&(0x7f0000000640)=""/135, 0x87}, {&(0x7f0000000700)=""/68, 0x44}], 0x3}, 0x40000000) r8 = socket$rds(0x15, 0x5, 0x0) setsockopt$SO_RDS_TRANSPORT(r8, 0x114, 0x8, &(0x7f0000000600), 0x4) setsockopt$SO_RDS_TRANSPORT(r8, 0x114, 0x8, 0xfffffffffffffffe, 0x0) bpf$TOKEN_CREATE(0x24, &(0x7f00000007c0)={0x0, r2}, 0x8) r9 = bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={&(0x7f0000000000)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0x34, 0x34, 0x2, [@const={0x0, 0x0, 0x0, 0x9, 0x3}, @int={0x0, 0x0, 0x0, 0x1, 0x5, 0x8}, @array={0x0, 0x0, 0x0, 0x3, 0x0, {0x2, 0x2}}]}}, 0x0, 0x4e}, 0x20) bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000680)={0x2, 0x4, 0x8, 0x1, 0x80, 0xffffffffffffffff, 0x0, '\x00', 0x0, r9, 0x0, 0x1}, 0x48) bpf$PROG_LOAD(0x5, &(0x7f0000000840)={0xb, 0x1c, &(0x7f0000000d80)=@ringbuf={{0x18, 0x8, 0x0, 0x0, 0x28}, {{0x18, 0x1, 0x1, 0x0, r6}, {}, {}, {0x85, 0x0, 0x0, 0x5}}, {{0x5, 0x0, 0x3}, {0x95, 0x0, 0x0, 0x700}}, [@snprintf={{0x7, 0x0, 0xb, 0x2}, {0x3, 0x3, 0x3, 0xa, 0x9, 0xfe00}, {0x6, 0x0, 0x6, 0x9}, {0x3, 0x3, 0x6, 0xa, 0xa, 0xfff0, 0x50}, {0x7, 0x1, 0xb, 0x6, 0x8}, {0x7, 0x0, 0x0, 0x8}, {}, {}, {0x5, 0x0, 0x5, 0x0}, {0x18, 0x2, 0x2, 0x0, r6}, {}, {0x46, 0x8, 0xfff0, 0x76}}], {{0x5, 0x1, 0x5, 0x8}, {0x6, 0x0, 0x5, 0x8}, {0x85, 0x0, 0x0, 0x7}}}, &(0x7f0000000980)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0x0, 0xf00, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1}, 0x94) 911.914363ms ago: executing program 2 (id=7355): r0 = socket$inet6(0xa, 0x1, 0x8010000000000084) ioctl$sock_ipv6_tunnel_SIOCADDTUNNEL(r0, 0x89f1, &(0x7f0000000940)={'ip6gre0\x00', &(0x7f00000008c0)={'ip6_vti0\x00', 0x0, 0x2f, 0x3, 0x0, 0x4, 0x40, @mcast1, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01', 0x1, 0x700, 0x6}}) sendmmsg$inet6(r0, &(0x7f0000001300)=[{{0x0, 0x0, &(0x7f0000000480)=[{&(0x7f0000000180)="88e2156733d0b1a7d5498ae3518907fa78b090e97b5ff348882b4ad1b3ea00732f998ec6e79142cc13437ee4c65844825677e5ff4f650b25297423c4e253d0aeeb8c5b8f8e5d0368411075c2c52014fef028434cd37d2c2601cb64aaa64b488f2ca320e38213146eff6f988520896602566c0e9084807d152adb80f67852c2ef9a9e5aff986289322ff7544581463f3e92af941e759bb56228fab6b85b43e3be2d0d6733608cffdf49447869ef6e43d74be1a237fd4349a257c5c91440c2d393d23a93018a695ad0c2556a6b5ed1a9cabc7511f593af5883155198db8e83ca53a36da928befc0311fb725f17", 0xec}, {&(0x7f0000000080)="dd49b1e3da60223001c6c662527e4d4f9a610be86c3aebb767ca73a6536ec6cc4f6fc8f00e5e14227456add8bf649a7b85e757dea093aacef5a6", 0x3a}, {&(0x7f0000000280)="6740646637172ededba3d216ea16e721c753ca6bf8b794ed7389be8af3ea02c1322f4d961c94bb5c308ee37a295bcb0f13901c7d39723d3e657f3913807621ec483f2d00286666a03ce6daea9eff31d88c2f79e554efe9f392a9a541dcbd9dbca0eb554cc255e1fe04b3985ba836b80c44873890a0089a229861ea48d452bcede14e1ea32d3ae662430cf689fc946ecba7c4af3e1e4b6259a39ae9dc62f69c4dc9239d22d62c29cbe7e8f42667be3928ebf3140cc6bcb32e874f", 0xba}, {&(0x7f0000000100)="51df2659b6fd2290d0f21204af74620f1118", 0x12}, {&(0x7f0000000340)="8cbb57c435c78827f5115df3618763a9f524a0489a35d0808092d304f6211aa3c012778ce3562c57bac26f66986ebeefa4fee5228929831fa52710eefb924ed50528380930ee774ae9793b83ee2e8693a5008a4e09517a3a4bc095562bdb0bb41cd57932fbef2ce136b9c4b33f1d981a8b", 0x71}], 0x5, &(0x7f0000000500)}}, {{&(0x7f0000000540)={0xa, 0x4e24, 0x7fffffff, @initdev={0xfe, 0x88, '\x00', 0x1, 0x0}, 0x2}, 0x1c, &(0x7f0000000840)=[{&(0x7f0000000580)="cecfb6ff817f0f709940d81ee5705b071cda6b1ef87d2d588628b8e4556e9fc488ec1339fd633829de4b474e1e6976587bf6f995198e550dc706ab2cdce6da21af14b8e2ed159f8b1237c1312cc12d701b241dbc03ba6f2a32a6bb5adb29ca3db1ec0ec90a3b693c742a30f804529e048fbea7887b08161d48d89df9fc320bd1c94dd62607a24a363dc75e3349259f2b5142e83e7055f2c36d7c888881", 0x9d}], 0x1, &(0x7f0000000980)=[@rthdrdstopts={{0x68, 0x29, 0x37, {0x2e, 0x9, '\x00', [@generic={0x9, 0x47, "268631a19a70066e1c88b24ed91ce39010a74baf409dd66c7bd62d070c73ba443d31a116343caa99a1d7048c9e694159034f558c669c72a3b713a072ec0c69ef636d4e6e428586"}, @enc_lim={0x4, 0x1, 0x6}]}}}, @dontfrag={{0x14, 0x29, 0x3e, 0x101}}, @pktinfo={{0x24, 0x29, 0x32, {@private0, r1}}}, @hopopts_2292={{0x80, 0x29, 0x36, {0x33, 0xc, '\x00', [@pad1, @calipso={0x7, 0x58, {0x2, 0x14, 0xf7, 0x9, [0x7, 0xfffffffffffc0000, 0x2, 0x7, 0x3, 0x2, 0x0, 0x81, 0x6df, 0x200]}}, @pad1, @jumbo={0xc2, 0x4, 0x9}]}}}, @hoplimit={{0x14, 0x29, 0x34, 0x1}}, @hoplimit_2292={{0x14, 0x29, 0x8, 0x10001}}, @flowinfo={{0x14, 0x29, 0xb, 0x5}}], 0x170}}, {{&(0x7f0000000b00)={0xa, 0x4e23, 0x2, @dev={0xfe, 0x80, '\x00', 0x27}, 0x1}, 0x1c, &(0x7f0000000d80)=[{&(0x7f0000000b40)="c4751a2b5dc43c61ea7b1881bf6db1be11c4f2fe0a31935c1286957636ed0e09945f5d3d17d4851b64e9f4a4b70b52db7fd021f343c53ff0fcc6f89143a29c0dd7bd19e593cd69cb3380e8cf83a7f735f846f97454c62798df0389f7aec113b59b16d4aa0afd8f56c2c4bcddfc21d9023e7036d9219f766f9f5055e5cd770c5e4f198c53d5affe9935b1f273138b3892a036e35453f6a0c9cf73b704c41c3813a199bf3c2fee1567d327f08480d1a0da8b86216ba4a93094cb079300e62e", 0xbe}, {&(0x7f0000000c00)="660f3188145cd91f", 0x8}, {&(0x7f0000000c40)="492ca128b86f7505dcd5857bad8b8e1465814678b7a8b72c2f98d7521adbcb1cb0", 0x21}, {&(0x7f0000000c80)="5991c92eba2efd2781e1040f42ef3e815390cfaa456f705339590199cc48b61600acb38b805088aade72049af8c5f28d8e26cc3526fdb9d5a47d15e1bd5c7440aa2fd064ab345d38693e05d834c8b39e8bbf6ef85fbf9b6df70839b2d581d43d230cf9c37e34a46d57d1e92a2987f64dc15ee26c180cdac70bcb10f3e6122e6224de9c5a5920", 0x86}, {&(0x7f0000000d40)="368e51e5ee266ea0438575856b9ab21926427c478f8e342009d24d07840d054f09456d8813cabad8d66d1160604076886a69dabfb2f5111b03cee581d254406d", 0x40}], 0x5, &(0x7f0000001440)=ANY=[@ANYBLOB="480000000000000029000000390000006706010800000000fe80000000000000000000000000003100000000000000000000000000000001200100000000000000000000000000026535dba1dca49a60b4fbf63ca0d19720a32ef678fe"], 0x48}}, {{0x0, 0x0, &(0x7f0000000fc0)=[{&(0x7f0000000e80)="7d404e5ce10b88f036ccfef6736d18b820b8f47ff226640fd4e111aca71e", 0x1e}, {&(0x7f0000000ec0)="598fa5e157af0fe3ecae9704447b0b57ca672ee000cadadc08d002ce1ae7c95758de17aebca3bf8f8c7aaf1bfad003ec64a9bcdbb731b4f85e815de2e8448adda1427c4dea44ecce6c472e6293317530963b47b0e23d9a3f98b23e375687bb968ee87053a997db450812b45ded9eab68ec4da14146e0f51bc3c1821cb42fde3b9e2834db455c37c9a53ec236c93bc45c967911b7861ee39d66f239ee661a714f418638d8c8148048c200d24bc2d887f91f791261189bd2689128efadd9e2112817052a62d200b8d261522b5ad22e88d0187405a7692a7cd4fe3f952c925ebd223ee6a020d1008b5194a3d0679835ede74db40561", 0xf4}], 0x2, &(0x7f00000014c0)=ANY=[@ANYBLOB="2400292d8d45fb0000000000002900000032000501fc01000000000000000000890c86c59dc874b8da87c69a157c3a093aecf1b17e5819d1296601921233d72cf1a2cb44389ff4334475222e3bb57bc01056b942b1ba6298c36ba075084c1bf46f4bfc23a9c2db808eb32d98d152dee7fa6a24a63f308aa694", @ANYRES32=r1, @ANYBLOB='\x00\x00\x00\x00'], 0x28}}, {{&(0x7f0000001040)={0xa, 0x4e21, 0x10001, @local}, 0x1c, &(0x7f0000001280)=[{&(0x7f0000001080)="76e5ad4f2a2d6b0394784607abf06d4404e36d2b143eea37463432dc4a92a855064075d88bf7853a51f04b8c9c1742b25e83478c8fd9826e21fd17d8a702a2c969ef3ce17c2af4b1404566cab7a610667401ed0b4c6e8a68d32edee983ea57810c6a6382ffa35535c6f291e6c7e88c16a5dc2e0c0f0d10d65565acba9688d732549fb3c48d07f221c173ebfd6d9abfdea713706202500acd0a21e23f64ceb24f05eb8905482ac9358c70c44a07f91c50684d937b47c0272673a4d8a0df3ec93bea3eb681eef9b9b1f50812e334166bc371472b0da9e4ca45296b11e1c8f9756370b71ddf", 0xe4}, {&(0x7f0000001180)="d21fdb33a3b475b16f8e78b5c5e2431be8dde019c229ad40a5cb82fcd615", 0x1e}, {&(0x7f00000011c0)="96c5106c8716610d9223a322a2e921d8f0a8bd8454c96dad9261c578b40474b6363ca89ff403b3604a86329c3d9acc674cfd9769dd240b9b4204649e3b9ebd6f1db8015b54b35a6c3097d03dac5707fc82421480b181fe68448bb0a9af0bfd17e38349d9ba87d7bc2bc8451bb4b49bb3b723d47a2b52c62e5922291851fcdb7d1d83c740ec0bb96d6d9b4f950128468bd4ffaa42842931", 0x97}], 0x3, &(0x7f00000012c0)=[@dontfrag={{0x14, 0x29, 0x3e, 0xa}}], 0x18}}], 0x5, 0x40) bpf$PROG_LOAD(0x5, &(0x7f00000054c0)={0x16, 0x16, &(0x7f0000000640)=ANY=[@ANYBLOB="61124c00000000006113500000000000bf2000000000000007000000080000003d0301000000000095000000000000006926000000000000bf67000000000000150700000fff07003506000002000000170600000ee50000bf250000000000002d350000000000006507000002000000070700004c0001fa0f75000000000000bf54000000000000070400000400f9ff3d1401000000000095000000000000000500000000000000950007000000000001722fabb733a0c857c7c4e704000000000000a04d1ffc187fa1a2ba7ba0c0d507b92de00435fd233cc0f0d9b2c312b68856656ca9caa2ee4dc258d72e690098804de235cf020e35245c9f5526d35df627a64ac7efde50fd7f1d8bae66ea38541a7cd29032de94983dfab0e5043daf1b46bef5135c65377bdbe65d525743d88ef4b2ee62652b07f8a4b6e6155cecc13a5ddfab726eca91bd5fecb254ab358488c400330171128be291297947d474c570a385a459db8e7ada8ee987cc0000f6f902b261848d74096636ab6d8c63c8d62861cbc38d1e6bef45e672ac3d3d5243b85b3b15c7499ff39a3dadcbfbea9e050fb6940344dfbeebbf3e7e37d0a9a387518f926fba75479eacd4f51aeb28b6c56a75144ef6df55a275799897ca000000000000000000"], &(0x7f00000000c0)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @flow_dissector, 0xffffffffffffffff, 0x8, &(0x7f0000000040), 0x1f1, 0x10, &(0x7f0000000000), 0x19f}, 0x48) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, 0x0) ioctl$FS_IOC_GETVERSION(0xffffffffffffffff, 0x80087601, 0x0) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, 0x0) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) close(r2) r3 = socket$inet6_mptcp(0xa, 0x1, 0x106) bind$inet6(r2, &(0x7f0000000040)={0xa, 0x4e22, 0x0, @empty}, 0x1c) listen(r3, 0x0) syz_emit_ethernet(0x36, &(0x7f0000000080)={@local, @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x1}, @void, {@ipv4={0x800, @tcp={{0x5, 0x4, 0x0, 0x0, 0x28, 0x65, 0x0, 0xc, 0x6, 0x0, @rand_addr=0x64010101, @broadcast}, {{0x11, 0x4e22, 0x41424344, 0x41424344, 0x0, 0x6, 0x5, 0x2, 0xffff}}}}}}, 0x0) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.net/syz1\x00', 0x1ff) r4 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r5 = openat$cgroup_ro(r4, &(0x7f0000000140)='blkio.throttle.io_service_bytes_recursive\x00', 0x275a, 0x0) read(r5, &(0x7f00000003c0)=""/132, 0x84) sendmmsg$inet(0xffffffffffffffff, &(0x7f0000000880)=[{{&(0x7f0000000040)={0x2, 0x4e21, @multicast1}, 0x10, 0x0, 0x0, &(0x7f0000000000)=[@ip_pktinfo={{0x1e, 0x0, 0x8, {0x0, @empty, @multicast1}}}], 0x20}}], 0x1, 0x4880) r6 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r7 = syz_genetlink_get_family_id$netlbl_unlabel(&(0x7f0000000040), r6) sendmsg$NLBL_UNLABEL_C_STATICREMOVEDEF(r6, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000180)={0x38, r7, 0x1, 0x0, 0x0, {0x4}, [@NLBL_UNLABEL_A_IPV4ADDR={0x5, 0x4, @multicast1}, @NLBL_UNLABEL_A_IFACE={0x14, 0x6, 'veth1_to_team\x00'}, @NLBL_UNLABEL_A_IPV4MASK={0x8, 0x5, @multicast1}]}, 0x38}}, 0x0) setsockopt$inet6_tcp_TCP_ULP(r5, 0x6, 0x1f, &(0x7f0000000500), 0x3) socket(0x28, 0x80000, 0x6) 836.760118ms ago: executing program 3 (id=7356): bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0x10, 0x4, &(0x7f0000000040)=ANY=[@ANYBLOB="b400000000000000791048000000ffea61042c000000000095000000"], &(0x7f0000003ff6)='GPL\x00', 0x2, 0xfd90, &(0x7f000000cf3d)=""/195, 0x0, 0x1, '\x00', 0x0, @sk_msg, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0xfffffffffffffd8b, 0xffffffffffffffff}, 0x48) 819.326269ms ago: executing program 3 (id=7358): r0 = socket$igmp6(0xa, 0x3, 0x2) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000000440)=@raw={'raw\x00', 0x8, 0x3, 0x4c8, 0x0, 0xffffffff, 0xffffffff, 0x0, 0xffffffff, 0x3f8, 0xffffffff, 0xffffffff, 0x3f8, 0xffffffff, 0x3, 0x0, {[{{@ipv6={@private0, @mcast2, [], [], 'veth0_macvtap\x00', 'bridge0\x00'}, 0x0, 0x148, 0x170, 0x0, {}, [@common=@unspec=@helper={{0x48}}, @common=@inet=@hashlimit1={{0x58}, {'bond_slave_1\x00', {0x41, 0x1ff, 0x6, 0xb0e2, 0x10001, 0x84e, 0xfffffffb, 0x18, 0x8}, {0x1}}}]}, @common=@unspec=@NFQUEUE0={0x28}}, {{@ipv6={@remote, @ipv4={'\x00', '\xff\xff', @dev}, [], [], 'erspan0\x00', 'gre0\x00', {0xff}, {}, 0x0, 0x0, 0x0, 0x4b}, 0x0, 0x258, 0x288, 0x0, {}, [@common=@inet=@hashlimit1={{0x58}, {'pim6reg\x00', {0x0, 0x0, 0x5, 0x0, 0x0, 0x7, 0x3ff}}}, @common=@inet=@hashlimit3={{0x158}, {'vcan0\x00', {0x3, 0x0, 0x41, 0xfffffffe, 0x2, 0x1000, 0x6, 0x3}}}]}, @common=@unspec=@CONNMARK={0x30}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28, '\x00', 0x7}}}}, 0x528) write(0xffffffffffffffff, 0x0, 0x0) syz_emit_ethernet(0x4a, &(0x7f0000000080)=ANY=[@ANYBLOB="aaaaaaaaaaaaffffffffffff86dd604dd318001406ff00000000000000000000ffff64010100fe8000000000000000000000000002aa00004001", @ANYRES32=0x41424344, @ANYRES32=0x41424344, @ANYBLOB="da"], 0x0) 806.090053ms ago: executing program 1 (id=7359): r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000000c0)=@newtaction={0x6c, 0x30, 0xffff, 0x0, 0x0, {}, [{0x58, 0x1, [@m_ife={0x54, 0x1, 0x0, 0x0, {{0x8}, {0x2c, 0x2, 0x0, 0x1, [@TCA_IFE_PARMS={0x1c, 0x1, {{0x0, 0x6}}}, @TCA_IFE_METALST={0xc}]}, {0x3}, {0xc, 0x7, {0x40000000}}, {0xc, 0x8, {0x1, 0x2}}}}]}]}, 0x6c}}, 0x0) 732.433235ms ago: executing program 2 (id=7360): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000280), 0xa36fe781ab301968, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f00000002c0)={'pim6reg\x00', 0x100}) r1 = bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000480)={0x6, 0x3, &(0x7f0000000680)=ANY=[@ANYBLOB="1800000002000000000000000000000095"], &(0x7f00000002c0)='syzkaller\x00'}, 0x80) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000180)={r1, 0x5, 0xe, 0x0, &(0x7f0000000000)="251200d800"/14, 0x0, 0x7ff, 0x2a0, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x50) r2 = bpf$PROG_LOAD(0x5, &(0x7f0000000440)={0x3, 0x6, &(0x7f0000000900)=ANY=[@ANYBLOB="b406000000000000711124000000000085100000020000008500000007000000950000000000000095000000000000006d20ea1076d8b9545c7e26bc991d62c58a6dc71a98e5024289dded57ec719e9dad2d175e5265270a81d02e27223bca6eef1cd7288167d8643334b782c8ab98536e9298d4d6f51dfb0633d395d8c4f311c64c001556e989740bfdc33a771912aaf38ea40adee65607944e0a699622811a61496bbea2089aa1dc1aaa105256a8e0a2003781276389af413e6ddc57ff1f829c1d60efebcf860dfd74ae354775"], &(0x7f0000000080)='GPL\x00', 0x4, 0xd0, &(0x7f0000000800)=""/208, 0x0, 0x0, '\x00', 0x0, @sched_cls, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0xe, 0x0, 0x0, 0x0, r1, 0x0, 0x0, 0x0, 0x10, 0x6}, 0x94) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='blkio.throttle.io_service_bytes_recursive\x00', 0x275a, 0x0) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1, 0x12, r3, 0x0) r4 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_int(r4, 0x107, 0x12, &(0x7f0000000000)=0x3, 0x4) r5 = socket$packet(0x11, 0x2, 0x300) r6 = bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x3, 0xe, &(0x7f0000001cc0)=ANY=[@ANYBLOB="b702000000f0ff00bfa300000000000007030000f0ffffff7a0af0ff1100000079a4f0ff00000000b706000000000081ad64020000000000450404000100ff0f1704000001130a00b7050000000000006a0af2fe0000000085000000a3000000b700000000000000950000000000000000e154cd844a954b26c933f7e38e52c997b03b72b3d0ffffffffe4fbffffff55bb2007ee51050512b5b42128aa090a79507df79f298129da00000080f24bf901115e17392ac66ad029d1c00000614600d53daeacea799a22812a1b3cab4d785c908c54f7a2fa798b5adc43eb27d53319d0ad229e5752548300000000dbc2777df150b7cdd77b85b941092314fd085f028f2ed1a4535550614e09d6378198a6097a670838337af2abd55a87ac0394b2f92ffab7d153d62058d0a413b2173619ccf55520f22c9ca8b6712f3024b7041b1df65b3e1b9bf115646d14ce53d13d0ccacda1efc5f9094fa737c28b994a8512c816fdcceaede3faedc51d29a47fc813a2ec00f4c7a53ac271d6d7f4ea6bf97f2f33e2ea2e534300bcb3fdc4b48610e9eefbda7f54f82a804d4a69bf9bc5fa77ee293fbd165a5a68488e40b030166565a097b1b44b451de736bb6d43db8db03d4b7745fef1d04ec633dee254a6d491b849a5a787e814c4fd21a18986252a70f8f92eb6f0e8c7db4bf23242a1f2c2815df09943b1b0452d1b72183aacf4a84f9130b775dd4e9e3070756f97ad791fa9a1681989328c8ddc20ea011bf5742e0e0d4334db8b20ce3f9f16cb7fc20fb4791ec85821d0c48fb657c29b309c73f0977e7cde65a82b94c461d7962b0d2277a84af326f37f3e2c25a62ec45c3af97a8f17da954aff3ec8c108755f75ca13fb7c8bbd8b6e7dac1aba4b20dc7de058a4dfa7e85a8bdf1d41a2d8bda74d66f47cc180f82c5f573c6d294d3665016ac59dda0fde0745db06753a7ac70af2df2c772b0031fe13cab6692402a47e9ffe2d4a2d32f7528751313694bf5700b20ef0c248ddd3da32396a614cac8b4aff2066bb5d4045c9585638c2153a6eee01738b0c10671f4f559b7dcb98a6273b8c651e24d9f679e4fbe948dfb4cc4a389469608241730459f0123fd39206000000000000eb55dad46de56ef907b059b90b8aa49afb9a79ae5498f6589880ed6eea7b9c670012be05e7de0940313c5870786554df26236ebced9390cb6941b8375d936a7d2120eca291963eb2d537d8ee4de5c183c960119451c31539b22809e1d7f0cda06a9fa87d64cb77872a2cd8a104e16bb1a2bacf1301800000ff14a99202d9539f5096412b92012e095b84c20243ff98df3347f0e399d1b9f27e3c33269c0e153b28b2d4410572bc45b9d3fa02208d304d455c36300000000022320178b00cc6ec7966130b547dbd8b0000f0a77fbcf2cd1d0000002000000000000928ee53595a779d243a48cea769470424d28804c026ab7f4a5c81921f0128dfd70b438af60b060000000000000056642b49b745f3bf2cf7908b6d7d748308eea09fc361b4735efbf3411718d6ee7aebf90040662d7836d252c566f5ee934c679dbfae9fb4a79f8a836804ed3a1079b0282a12043408cd60b687dcff91af19010000000000000000456f7d2a42bd13da2022f23daec61854f640f701db0276652f6c74f20675eb781925441578e93046aaddea8ec4ca37f71c2710a7ea8ae0dc214e1cc275b26adfa892e6de92000000000000000000ddff004cff9ec780f535e62f4eeee50e5bafecea4d4134f9d006c8d6883eca5c9c58c9e93311ab5009c68c73de2f04f15d005387577f480000ea65559eb00e76e9d0ada209bcbb5c252b28a60ca770663da451790cc36000906d5a9fad98c308e39bd5ffb6151d79c1cee1cdfba05e3633be3f00000015762e5f5a3a0bc33fdbe28a5ffc83f2f085185cc92fe7f791e8f64293091c989f72dcbbad3fdcd6adab4b7e508e5bf024ed8f8a005f2bbf96c89739f5d81e750d506d7a59a3ad09e8802e8f4f535447cc0fc9d5f89a73145dfcedad69da9cd4375c624600e78f4458542b14f29611f95d4a31838eeb20c20bb82aa31771cd379ec83554cea5e6539db7384e1f58d81f2f2653c4d9818708e27c89b552d3fcd11642d5577fb9030036bce9c764c714c9402c21d181aa0820d89f235a3f1c5fc853e59efb28d4f91652f6750b6ec962802c0320f8059195729d60c534ee8e8ff0755b67fe4c25edb85bcff24c757aa809000008e1d41e1dcf6e6879545b92bd49000000008c420eb4304f66e3a37aaf000000c42a570f0e9dd5fd545470f862f8c3c14fa9ecd1e877b0d8ca84937e859e85e6158f9184bc61a9a284db80e4636c25b96174327d82761c26e329555f9290af40fffe0000000000749efd3763655500344bae34137f5ab0d534b8d43e4ca3b671f2de1cdf519192c6b59a601fd419adc16e2055b850580994484305d7a1759782e4c571ee855a47bc00edf5e9020c09ab004321610b857e8717764b633b00cb32f0e03280e09758bd445ab91d20baca005452b79d7b574a247f1d2fe44dc87c92332af00f191b66b6a6f7323e8faffc0886f4af7fc100dcb39c77a91f0e2e9120be61e58c79d497247d278888901d442ad7f8536605a644e9e3d769db497c3960dfde12182334caee994adc38a437367a54b9e182b78e9a0ceb9a2c4f63902c1ad1a7c5a08d0920a23c2a86abbdf357849a651733e57f31019876026888c8ccb85cff7f000000002c331fca0e541b7ca211c28ed61c5257080f61ae96c18cc7130000000000002100000000000000000000000027c9a46157a3609b6fd9843ee19ec647249a9375de5858818f3c4a4fa6ce4616d42b07199de8b99231ace58c77819ee2b3dc8c17a23692759ccf5a205311b7ab22532697b861dfb54609fd88e604bae6b13df468ad87a6c769f952283a1f4e3842edb3d40c68a2001000006dfff4a979369b0e8ebc62887aa46e820a74f91381dcc198e353047db70686d147357024eb3cb94f1e89cb5ba0a56aa046b4dc521a3d9356b4b8b5917c4c860495b240e80063bde261fd00000000007271e28ef6806bc8e139c49b91c76b0d3958f7f05b47d3e519f1634e8fbd8d31330d89069f9648a2ff93060ff073b3a113e47edf76f7d116d2b0976cf2ec447c030931651dd315003b7a6a5433a2bb560ae99ec4b227eda2e63a1c31a2c2bd48a822cbe92b6524e0cd8020ecaa671e934e94d1eb3de6a5f99f301f89c2ee627e949c68b3a4a426a996d503a26e9a714ee5f72d8805dd1bfbd081f6a5d1f1289dfe14cb9194e26a44fac273461fc5c0e0a33db7f2d43ea8086cf059f40fa2640b6bfb74dd35f5a31059c01517cf4b6641fce9a24b96767b837ca037a1199735c375c705c798e0e208e4a5259d0bfa526b462af45a6e9a84aebe6e6e79900369c17b0ed16acdce1b12b70000000000f4e8cdbadbec962a7edc91c6b80f53e3b19c372e40e2139ff4c1180365eb5b71d834eb0293e252b96e6c90ec4d23cc42e88d262c1fdc317c7c000000acbc1248f2389d7fbcc10a377cc4e28460c0516534bdb3ff372bfd94efa0d32b214b39cea885557d39265a1c5e08c29914db042aa4fe23a92f387ae6d7565d3ca6ceb040f859de2e47f6c04bc55f3b81249faf3a505ac0d29e053b9c1832e8a25a54ae433e43036b032518200e2875736fc139a344bf3bf4d8f6f57e5c4b7f62a23758cb30e43f1974b14d4f3e1a8ce71995ce28564a50f418af2b6f22a7c70c2213ec629288604aa1a9f418487c864af9368a08bd37eecb0a810c5c24d7a82c07a8e68caa7ff2eaf100f6fd4c3af07d7a86b34f2f4d34abf2f92f1a41a330a4e8fbb4876393b38f79573cb53c263090d620a37ea25cde9445ccb74ebc22156465f4871436b44981455eccc221a8251f71c047203ac4d62b0012cab329a5d9003ceff42b007aa61880da20b0ad83ae368a19d2827840b8d00f92745508e63cddaac6d2d3c6cb03d512c5be9e7fd86e461e1e6a228e630029dbeddf37a6990c75ff6dcb6f32f61e59e3bf97f48954fd7908ab05e74815d909548b277bf5c4570eaeb265f4ffeacc3a4ec2edb261d53d09ebb6bdf811e2a4ef0be6392d86a5285a7fd2e4345e14786abafdd4852d3d62c334760c05e1bba37d0f0742c53242596e13bc22682ae15694aaaadef41bbd7185b74feaf59dea096a23a48c9eb3be5c546eda0f4b07916ab14e12839318e953f15fab94c9ba783015ebb6983d514e3b1f246f0a63c5a58cc2be0cb179791ec1b9a3e7e62c165ae39855182266b36ce9d2943c49a7f9a2a89a948b37f2bb830ea790a2b2c2fcd06bc499434dda842cfa91b2df4368f07eb2410aa387d146bccd22698f8f322fbdf4cddf11fd3b85325af8df473c8f156833e5488f31165e6a56d4c1c661bcbefcefd10f47b2e593b836be67bdc15c3b7fb497ecbca1506a577e81947505553dfdfe963c20c12575c4abc45cf9229af181317fde5262a73600f90e7457280ff4229507178c5df9acc273a7be76f6596b2ac36a2d28627e0012f989d7f7a20f2b38eef5efc339b8784ad5fe6fac77926d83a73e3647a6351c23d7e51cf459e5d169d42566b012193338f67612c22eab89fb14a40edd2694696048f9d51d26fa256eede4a9b5dd3508f9308883194ab3b0661d51b18dbdca9b5f70a91db8fc9b19291664eccc8274340eef00c743588b0ae4e7280db3b7bce3041a5bb9fced08059a2518eaf35df7388a518965a9b4c6ee27872be887b37319370a4587e50f28060b963a6e4d73b338f4e8929bc5ada66b6920c633119d17c090e72daa679c6e5bb155710679660004705fd8d4cac660fc32554a20feb5d74cafe562aff12fe126abf5927205867d5fca4a4ff8c7d0933cdfaf5864f4dae435d1ab9e711f48cd03f4cc130b54e18428341e675968ac19509fe7bff5ef0e55d71987e44027e29d02ac36f3c486bcf22f86170cbeeee2a5eb3adadb7d906f25c73df5cd22a8d1ca00b027a1ab966ab4799e631a21042685fc8c05d5e04ab21a66c5f221dabdac52b43a5980b1efb49d9e03d05f4d1a8756085d0305ff3c4cec8500000000000000000000924f7fdfa25a3331d13a50233f70742f16f6e13bd716905299ab21864ec9d3a93b1de03592b73b327348427508a2dcb953dd23e42adfc18fc891a247ba5c7ebd7fa6da7e3ef3d11d4b1bb534b48064aed03c5850c12abf87240b65221a64ec331c31ce394dad6142619893bff5c810f53dbd875837705ad5139a31ff058aacd51eed21216e0bd179cb00bf02af8dc25be8f318bca707c05a0235b86f37606e1cfbc9ee5cd9741c7648713b24107697039cc40aa538c24e8934cd88238237b21f0a901c488c55178984597ef91e7a8d60081cf34081b5df32ef9a89a25203093b8cbb5cd416d189cffcbdb6a336e3adefa39ea04e2c425864c766283829db5c2beb709da87edcee6b682f18abcac4fb9d785beb2f840079b54dfb9a8ab1a6bf4eea20bb51804ec3d3848bfd11ba6a42bc2823559b70eaed4c673e0e834611b6fec4816ee94c62e88b13037d02cffd561f9bb97d6569114d0e6a7170e229ab9e938c18a568184bd6759e5c3526fbcb46da794c5bcb6303f8a4abfe0d37a0d757c686b0b5171892f867020778fcc567a21b04e684e9da29e86c3e392564f93b38d7bec00e82cd32e2a521a715ae603c12ff286ca67757d74553ce8607a1c5c4856e50094904bf08ecde97b7c513bf64252e839439b65ae0125fd8e9c6d142ee7a6af20cd5370396db6f616fb9e5a2824a5cd9c10000000000000000000000000000fd6a689d6779abe81e6aa2c63fce0faf9531a700c8cc02ea5d83f57fbfaee919668e9ba4776f2d5a1d544ea17288de3895fc39713fe150efeb27d43fcc1b53c00a4ade36652ecdb7fab04afa69e2b6611c0233670808a206578c5a7d0266ccf6c80ec69b22c8c71c6d8a057b71d39b18f15311dd7149a75f91ce676516532c0b89e0a2d4323080444686a790eca0390eea32e6fb0bd40b79e2c86d01435be3ba1224970c7e10e4bc54323decb110fb66f25477e309041ce13c8d8b077ead176bc45c5050a88acae7f8aaf962a990e6269de74cb1a915b85c01019066f2858cf322a21ebec7e060da478e31f943e7c31bbdb43c26702a0257e7103b4d532336dc6f0bd5d33a6f7d1134872859afb35a4e0731b38d3a914ed3aa376917b0bc84f5"], &(0x7f0000000b80)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sched_cls, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0xfffffedf, 0x10, &(0x7f0000000040)}, 0x48) r7 = socket$tipc(0x1e, 0x2, 0x0) setsockopt$TIPC_GROUP_JOIN(r7, 0x10f, 0x87, &(0x7f0000000040)={0x42, 0x0, 0x3}, 0x10) r8 = socket$tipc(0x1e, 0x2, 0x0) bind$tipc(r8, &(0x7f0000000100)=@name={0x1e, 0x2, 0x0, {{0x42}}}, 0x10) setsockopt$TIPC_GROUP_JOIN(r8, 0x10f, 0x87, &(0x7f0000000000)={0x42, 0x0, 0x3}, 0x10) sendmsg$tipc(r8, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x40000}, 0x804) socket$tipc(0x1e, 0x5, 0x0) r9 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r9, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000140)=ANY=[@ANYBLOB="3000000040000701feffffff00000000047c0000040042801400018006000600800a000008001c00", @ANYRES16=r9, @ANYRES8], 0x30}, 0x1, 0x0, 0x0, 0x48815}, 0xc000) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000440)=@newlink={0x34, 0x10, 0x439, 0x70bd26, 0x0, {}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @bridge={{0xb}, {0x4}}}]}, 0x34}}, 0x0) sendmmsg$unix(0xffffffffffffffff, 0x0, 0x0, 0x0) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000180)={r6, 0x0, 0xe, 0x0, &(0x7f0000000200)="63eced8e2613c2b346dc3f0a7387", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000080)={'ip6tnl0\x00', 0x0}) r11 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r11, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000380)=@newqdisc={0x44, 0x24, 0x3fe3aa0262d8c583, 0x0, 0x25dfdbff, {0x0, 0x0, 0x0, r10, {0x0, 0x9}, {0xffff, 0xffff}, {0x0, 0xed27c9fa5277b9b7}}, [@qdisc_kind_options=@q_fq_pie={{0xb}, {0x14, 0x8002, [@TCA_FQ_PIE_ALPHA={0x8, 0x5, 0xd}, @TCA_FQ_PIE_TUPDATE={0x8, 0x4, 0xfffffff8}]}}]}, 0x44}, 0x1, 0x0, 0x0, 0x100}, 0x20008000) bpf$BPF_GET_PROG_INFO(0xf, &(0x7f0000000380)={r2, 0xe8, &(0x7f00000004c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, ""/16, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0}}, 0x10) r12 = socket$netlink(0x10, 0x3, 0x400000000000004) sendto(r12, &(0x7f0000000740)="120000001200e7ef007b00000000000000a1", 0x12, 0x0, 0x0, 0x0) bpf$LINK_GET_NEXT_ID(0x1f, &(0x7f0000000040)={0xc3d}, 0x8) 732.1888ms ago: executing program 0 (id=7361): r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000040)={0x3, 0x0, &(0x7f0000000340)={&(0x7f0000000100)=ANY=[@ANYBLOB="020300030c0000002bbd70000000000002000900400000000000000000000e0003000600180000000200000000000000000000000700000002000100000000000000050200000000030005000000000002"], 0x60}, 0x1, 0x7}, 0x20000000) 708.373465ms ago: executing program 1 (id=7362): r0 = socket(0x10, 0x803, 0x0) r1 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_tx_ring(r1, 0x107, 0x5, &(0x7f0000000380)=@req3={0x808000, 0x4, 0x20300, 0xfc, 0x0, 0x2}, 0x1c) sendmsg$NL80211_CMD_CRIT_PROTOCOL_START(r0, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000540)={0x0, 0x1c}}, 0x0) getsockname$packet(r0, &(0x7f0000000600)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000080)=0x14) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x0) sendmsg$nl_route(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=ANY=[@ANYBLOB="4400000010000305000000000307000000000000", @ANYRES32=0x0, @ANYBLOB="20020400061000001c001208004357e843d5a26467650000c8ce400c000280060006000180000008f3ab831210b923fbed69d862120f32bdf35714d6e56e19b8f4913f57a68b0f25f103dcf63238", @ANYRES32=r2, @ANYBLOB], 0x44}, 0x1, 0x0, 0x0, 0x800}, 0x440b0) 611.108814ms ago: executing program 0 (id=7363): mmap(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x0, 0x10, 0xffffffffffffffff, 0x1) r0 = syz_init_net_socket$ax25(0x3, 0x5, 0x6) ioctl$SIOCAX25CTLCON(r0, 0x89e8, 0x0) r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000280)=@base={0x12, 0x9, 0x4, 0x12}, 0x48) bpf$BPF_PROG_QUERY(0x10, &(0x7f0000000780)={@map=r1, 0x4, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x40) bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0xc, 0xe, &(0x7f0000000380)=ANY=[@ANYBLOB="b70200000a000000bfa30000000000000703000000feffff7a0af0ff0100000079a4f0ff00000000b70600007fffffff2d6405000000000065040400010000000404000001007d68b7030000000000006a0a00fe00000000850000000d000000b70000000000000095000000000000005ecefab8f2e85c6c1ca711fcd0cdfa146ec561750379585e6d839240d29c034055b67dafe6c8dc3d5d78c07fa1f7e655ce34e4d5b3185fec0e07004e60c08dc8b8dbf11e6e94d75938321a3aa502cd2424a66e6d2ef831ab7ea0c34f17e3946e0ebc622003b538dfd8e012e79578e51bc5f31e3106d1ddd6152f7cbdb9cd38bdb2209c67deca8eeb9c15ab3a14817ac61e4dd11183a13477bf01860e3670ef0e789f65f1328d6704902cbe7bc04b82d2789cb132b803000000661df28d9961b63e1a9cf6c2a660a1fe3c184b751c51160fb20b1c581e7b148ba532e6ea09c346dfebd38608b32a0080005d9a9500000000000000334d83239dd27080851dcac3c12233f9a1fb9c2aec61ce63a38d2fd50117b89a9ab359b4eea0c6e95767d42b4e14861d0227dbfd2e6d7f715a7f3deadd7130856f756436303767d2e24f29e5dad9796edb697aeea0182babd18cac1bd4f4390af9a9ceafd0002cab154ad029a1090000002780870014f51c3c975d5aec84222fd3a0ec4be3e563112f0b39501aafe234870072858dc06e7c337642d3e5a815232f5e16b089f37b3591a15c0a9be6eb18208404c1b30c3a6a71bc85018e5ff2c91018afc9ffc2cc788bee1b47683db01a469398685211dfbbae3e2ed0a50e7313bff5d4c391ddece00fc772dd6b4d4de2a41990f05ca3bdfc92c88c5b74cd36e748fafa447e2edfae4f390a8337841cef386e22cc22ee17476d738952229682e24b92533ac2a9f5a699593f0844307df70f532bcc97d3ae486aca54183fb01c73f979ca9857399537f5dc2a2d0e0000000000000578673f8b6e74ce23877a6b24db0e067345560942fa629fbef2461c96a088a22e8b15c3e233db7ab22e30d46a9d24d37cef099ece729aa218f9f44a3210223fda0f0a04935c3c90d3add8eebc8619d73415cda2130f50714600fb6241c6e955031795b2c2f56411e48455b5a8b90dfae158b94f50adab988dd8e12baf5cc9398fff00404d5d99f82e20ee6a8c88e18c2977aab37d9ac4cfc1c7b400000000000007ff57c39495c826b956ba859ac8e3c177b91bd7d5e41ff868f7ca1664fe2f3ced846891180604b6dd2499d16d7d9158ffffffff00000000ef069dc42749a89f854797f29d0001002d8c38a967c1bbe09315c298774009d8c6a16c7da308bcc87dc3addb08141bdee5d2780cfef663ddeedd005b3d96c7aabf4df517d90bdc01e73835d5a3e1a90800c66ee2b1ad76dff9f9000071414c99d4894ee7f8249dc1e3428d2129369ee1b85af6eb2eea0d0df414b315f651c8412392191fa83ee830548f11e1036a8debd64cbe359454a3f2239cfe00000000000042b8ff8c21ad702ccacad5b39eef213d1ca296d2a27798c8ce2a305c0c7d35cf4b22549a4bd92052188bd1f285f653b621491dc6aaee0200e2ff08644fb94c06006eff1be2f633c1d987591ec3db58a7bb3042ec3f771f7a1338a5c3dd35e926049fe86e09c58e273cd805deb28c13c1ed1c0d9cae846bcbfa8cce7b893ebc68578af7dc7d5e87d44ff80800000034c2b18660b080efc707e676e1fb4d5825c0ca177a4c7fbb4eda0545c00f576b2b5cc7f819abd0f885cc4806f40300966fcf1e54f5a2d38708294cd6f496e5dee734fe7da3770845cf442d488afdc0e17000000000000000000000000000000000000000000000000000005205000000dc1c568cda690d192a070886df42b27098773b45198b4a34ac977ebd4450e121d01342703f5bf030e935878a6d169c80aa4252d4ea6b8f6216ff202b5b5a182cb5e80339f9953c3093c3690d10ecb65dc5b47481edbf1f000000000000004d16d29c28eb5167e9936ed327fb237a56224e49d9ea955a5f0dec1b3ccd52364600000000000000000000000000000000000000000000000000000000000026ded4dd6fe1518cc7802043ecfe69f743f1213bf8179ecd9e5a225d67521dc728eac7d80a5656ac2cbde21d3ebfbf69ff861f4394836ddf128d6d19079e64336e7c676505c78ad67548f4b192be1827fcd95cf107753cb0a6a979d3db0c407081c6281e2d8429a863903ca75f4c7dcf050000000000001491ef060cd4403a099f32468f65bd06b4082d43e121861b5cc03f1a1561f0589e0d12969bc982ff5d8e9b986c0c6c747d9a1cc500bb892c3a16ff10feea20bdac0000000000000000ca06f256c8028e0f9b65f037b21f3289f86a6826c69fa35ba5cbc3f2db1516ffc5c6e3fa618b24a6ce16d6c78974e69115d33394e86e4b838297ba20f96936b7e4746e92dea6c5d1d33d84d96b50fb000000ae07c65b71088dd7d5d1e1bab9000000000000400000000000a5accf93bec833c13e3229432ad71d646218b5229dd88137fc7c59aa242af3bb4efb82055a3b61227ad40f52c9f2500579aca11033ec14bb9c46136a5755c47287eb00000000000000c4897e2795b6ff92e9a1e24b0b855c02f2b7add58ffb25f3390343c12aa51810134d3dfbf71f6516737be55c06d9cdcfb1e2bb10b50000eb4acff90756dba1ecf9f58afd3c19b5c4558ba9af6b7333d03fe28bc358684492aa771dbfe80745fe89ad349ffaad76ff9dd643796caffdf67af5dd476c37e7e9a84e2e5da2696e285a59b53f2fb0e16d8262c080c159ce40c14089c82759106f422582b42e3e8484ea5a6ad9aa52106eafe0e0caea1ad4cb23f3c2b8a0f455ba69ea284c268d54b43158a8b179509bd9f263b3dc1cab794c9ac57a2a7332f4d8764c302ccd5aac114482b619fca4d97a0ae75ccf11e29a854380e2f1e49db5a1517ec40bb3fa44f9959bad67ccaba76408da35e9f1534c8bd48bbd61627a2e0a74b5e6aefb7eee403502734137ff17320adda5867947257f164391c673b6079e65d7295eed164ca63e4ea26dce0fb3ce0f6591d80dfb8f386bb74b5589829b6b0679b5d65a927de6f4c09f4b742e037381c85d2ec7bb2a8152f0d6a99a0370e0cbd65744eb2efd7b65f04aa7e72588757b9612bb4253a63bb303c0c68a07f115d104f2007237a4f771416741bfd63fdfe3ae6f8bea755d8b7202c2bbae137dc1c3cf40db74a4c1c219d8ddec8f91dae2cdea1353fe062830fa1d233296ec9d8317872257e154665485e7f31cdbfbf435517faf93015b57417d84b8bc8662e097d5ba55d02d48e150695ffae3a676555b10da11751865126d19336116a1e58ab727dda6b343cc97f9479136a66f552abf8fe3d134f6d69df1cffe6740f90735f66ca54fd87800b4bda4db5e68aaccf44d24e09f8a769e3ae7bf246673f15e3d1adae4384bdb7cd30a33e30466b421feb96006c810fd3830a1c75af2580727ffc604d2b04f476acc21419fad9b1baec88974da2db29b80859bde08b85c8086e4b7f1fd568042ad5396d3179c71b1dc43291e450ce9b8d7d80fcb44966d7ad4691a378700000000000000000000000000631ffc86fe0c8124536afbfc6300ee2c00000000000000000000000000000000000000000083a5765d06da91165d24bc316607e2d69344aa1c07ff7cd7bc3d17f122478b6e81077782b9c298edc2546045feff90e7aa7da88d2489fb000a4aa838f911c1a869fa55e979e033b7707df75b93cf5b8d25242741a88f2d54a7107375b25911aa11efa3a4f87fc14f180e353615b3cb9a5cf5ea843014a277c3694a5a83266f73ef039dd739187923715548d58ff43be997e35776e37c2b7772d0873369ba559e4a9ce9a7878a9a46f2a68adae0f3f5c0715b169ff053d8f5ab73d5f738b0edc71a287418ba45a14fd1ab423d9c392d010af2cf1356c6f78d563822afd3e8fb693ef3e1f1c02289e94b15a0a2a58e9c77a6d388004396baf8af32d0bd7fef1597b20e2eec0273012e344628a8ea5bd0a9da43078b95af7186d5bf36a2e31c0ee3e1ec6accd94b7e3b47e52681128c5b6fb2afbffaa52d53080f7ef112fdffffffffffffff0c1f7b4673fc5202bcc1159ba59b9b5c996079b6c2b9cc011470ce48b53c7339135e0a1e7c90b91a84cfaf95af6edc881ca69cb3d869fcd87a294447e3eb627923970281e28528348f9d0157c80ffd70dd45fc9ae550e191e9f88a1f15c2d997c217bb6d5d24e88d07837851b391ffcf3aa2183952ef4d68757c7511179f0984960b907016a4ad6ba19f89794b545f983e94a980f83794c277dd644651d721a0d0546b3e69b8530d9391068d67cfb4fe879c23933ec59d3e728113fdf3a28800512b9cef65523490caa4f5ec30ad6ded9879843ade683b3263197964e752ca77b966ae22e73a0cbbe549306e49d0e11662cf8bcccd8198ef44911ed6b86792086cc6c758d8c4a872041e58685d4134a5ee5063b4bb7e8035442b1cba567cfee96b3b858c9086c907ddddd16414545f1b94b34f081f3e6248699060d62f236b5204993cf42c180f757938a62b5f302cae4a4a7be523be2db61b74bab36d0e63e4469969482ada533c54bdc9c2ad0b7dce02c869e6c853f92d24823036f8b5f4a6f6f89e1a9cd003c714814277f32bd6d535dcc08c992f2938b2e265ff6bfbf38694255c367867d64c50b6f7f2fd131b5b30059ea2ed6bd2b887f808dee79a76d600883085436d79381d7a4a09c4d73f8046c72b206ae3b76429c719f80ab8ff65494f35a75916d81ce89b94ed2e07540d855ebb2e78bfbb354e29d6b905f2573bec68e340472006f3738f004c24edd7c538ad9f25bda4c443bc816a8fb38081adbf5a80f5cd6fde3aadd56a9283dfdcbf7fdd1b44e717c0b405b3261f19b1c38df6331df8e84619ef307875c893a8f0a436ccfb6319000000000000000000000000001f1c8231baae9e6b907826aa7431ee8ee9deb4db6dca3e4fa3df5cd4015a3771c25bff7d305689ff0a71d821fc6ee9d2d0069a6f4cb434e8183796f89825de4d251bbf526adcf572bd39c9817a51b50859c77eebd37709f0d65667a71700006103120886e81241c7186011c6949a9ef5eadb3ca1ba74d055196c80fe796f3550eef858d924ba6a93ea687720ffe78f1e2c98686d85575fbabee88e97d4dea9b7d8416d62f962b9202528fcc38eea7d2b4efca4e14fcbcc15e8"], &(0x7f0000000340)='syzkaller\x00'}, 0x48) 512.043762ms ago: executing program 2 (id=7364): r0 = socket$nl_generic(0x10, 0x3, 0x10) (async) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000040), 0xffffffffffffffff) (async) ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8933, &(0x7f0000000080)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_UPDATE_CONNECT_PARAMS(r0, &(0x7f00000001c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x800}, 0xc, &(0x7f0000000180)={&(0x7f00000000c0)={0x8c, r1, 0x20, 0x70bd29, 0x25dfdbfb, {{}, {@val={0x8, 0x3, r2}, @val={0xc, 0x99, {0x1, 0x63}}}}, [@NL80211_ATTR_IE={0x61, 0x2a, [@mesh_config={0x71, 0x7, {0x0, 0x0, 0x1, 0xffffffffffffffff, 0x2, 0x52, 0x38}}, @challenge={0x10, 0x1, 0xc8}, @tim={0x5, 0x29, {0x5, 0x7e, 0x9, "dc5077d032416d336e2d2b3cf0b61ba5ea9f975ce197bb897d71955415ba03662a78549aa057"}}, @ssid={0x0, 0x6, @default_ibss_ssid}, @link_id={0x65, 0x12, {@random="0579205d6ebc", @broadcast}}, @supported_rates={0x1, 0x8, [{0x16}, {0x18}, {}, {0x4}, {0x9}, {0x60, 0x1}, {0x9, 0x1}, {0x6c}]}]}]}, 0x8c}, 0x1, 0x0, 0x0, 0x800}, 0x20004000) (async) ioctl$XFS_IOC_FREE_EOFBLOCKS(r0, 0x8080583a, &(0x7f0000000200)={0x80000001, 0xffff, 0x3, 0x2, 0x40, 0x0, 0x9}) bpf$BPF_GET_PROG_INFO(0xf, &(0x7f0000000580)={0xffffffffffffffff, 0xe0, &(0x7f0000000480)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, &(0x7f00000002c0)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0], ""/16, 0x0, 0x0, 0x0, 0x0, 0x3, 0x2, &(0x7f0000000300)=[0x0, 0x0, 0x0], &(0x7f0000000340)=[0x0, 0x0], 0x0, 0xbd, &(0x7f0000000380)=[{}, {}, {}, {}, {}, {}, {}, {}], 0x40, 0x10, &(0x7f00000003c0), &(0x7f0000000400), 0x8, 0x88, 0x8, 0x8, &(0x7f0000000440)}}, 0x10) sendmsg$WG_CMD_SET_DEVICE(r0, &(0x7f0000000640)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000600)={&(0x7f00000005c0)={0x34, 0x0, 0x10, 0x70bd2d, 0x25dfdbfc, {}, [@WGDEVICE_A_FWMARK={0x8, 0x7, 0xffffffff}, @WGDEVICE_A_FWMARK={0x8, 0x7, 0x6}, @WGDEVICE_A_LISTEN_PORT={0x6, 0x6, 0x4e21}, @WGDEVICE_A_IFINDEX={0x8, 0x1, r3}]}, 0x34}, 0x1, 0x0, 0x0, 0x4008000}, 0x0) bpf$BPF_MAP_CONST_STR_FREEZE(0x16, &(0x7f0000000680)={0xffffffffffffffff, 0xffffffffffffffff}, 0x4) r6 = bpf$BPF_BTF_GET_FD_BY_ID(0x13, &(0x7f00000006c0)=r4, 0x4) (async, rerun: 32) r7 = bpf$BPF_BTF_GET_FD_BY_ID(0x13, &(0x7f0000000780)=r4, 0x4) (rerun: 32) bpf$MAP_CREATE(0x0, &(0x7f0000000700)=@bloom_filter={0x1e, 0x9, 0xfffffffa, 0xf09f, 0x8001, r5, 0xffffff17, '\x00', r3, r6, 0x5, 0x1, 0x1, 0x9, @value=r7}, 0x50) r8 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL80211_CMD_GET_INTERFACE(r8, &(0x7f0000000880)={&(0x7f00000007c0)={0x10, 0x0, 0x0, 0x8}, 0xc, &(0x7f0000000840)={&(0x7f0000000800)={0x1c, r1, 0x200, 0x70bd2d, 0x25dfdbfc, {{}, {@val={0x8}, @void}}, [""]}, 0x1c}, 0x1, 0x0, 0x0, 0x40800}, 0x84) (async) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f00000008c0)) r9 = syz_genetlink_get_family_id$team(&(0x7f0000000940), r8) sendmsg$TEAM_CMD_OPTIONS_SET(r8, &(0x7f0000000a80)={&(0x7f0000000900)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f0000000a40)={&(0x7f0000000980)={0x8c, r9, 0x10, 0x70bd29, 0x25dfdbfc, {}, [{{0x8, 0x1, r3}, {0x70, 0x2, 0x0, 0x1, [{0x6c, 0x1, @bpf_hash_func={{0x24}, {0x5}, {0x3c, 0x4, [{0x4, 0x40, 0xe9, 0xfffffffe}, {0x2, 0x4, 0x4, 0x100}, {0xfff9, 0x65, 0x8, 0x7}, {0x3, 0x0, 0x2}, {0x96c, 0x3, 0x3, 0x7ff}, {0x3, 0xfc, 0x40, 0x7}, {0x0, 0x7, 0x4, 0x9}]}}}]}}]}, 0x8c}, 0x1, 0x0, 0x0, 0x1}, 0x40) (async) sendmsg$NL80211_CMD_SET_INTERFACE(r5, &(0x7f0000000b80)={&(0x7f0000000ac0)={0x10, 0x0, 0x0, 0x8000}, 0xc, &(0x7f0000000b40)={&(0x7f0000000b00)={0x28, r1, 0x400, 0x70bd28, 0x25dfdbff, {{}, {@void, @void}}, [@NL80211_ATTR_IFTYPE={0x8, 0x5, 0xb}, @NL80211_ATTR_MESH_ID={0xa}]}, 0x28}, 0x1, 0x0, 0x0, 0x40000}, 0x40) setsockopt$CAIFSO_LINK_SELECT(0xffffffffffffffff, 0x116, 0x7f, &(0x7f0000000bc0)=0x9, 0x4) (async, rerun: 64) syz_genetlink_get_family_id$tipc(&(0x7f0000000c00), r8) (rerun: 64) bind$bt_rfcomm(0xffffffffffffffff, &(0x7f0000000c40)={0x1f, @fixed={'\xaa\xaa\xaa\xaa\xaa', 0x11}, 0x8}, 0xa) r10 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000cc0), r0) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(r5, 0x89f2, &(0x7f0000000d80)={'syztnl0\x00', &(0x7f0000000d00)={'syztnl0\x00', r3, 0x29, 0x9, 0x9, 0x2f8, 0x0, @local, @private0, 0x7, 0x700, 0x0, 0x6826d400}}) sendmsg$ETHTOOL_MSG_LINKSTATE_GET(r8, &(0x7f0000000fc0)={&(0x7f0000000c80)={0x10, 0x0, 0x0, 0x20000000}, 0xc, &(0x7f0000000f80)={&(0x7f0000000dc0)={0x1a4, r10, 0x400, 0x70bd27, 0x25dfdbfe, {}, [@HEADER={0xc, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r3}]}, @HEADER={0x3c, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'ipvlan1\x00'}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'vcan0\x00'}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r3}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x1}]}, @HEADER={0x44, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'ip6erspan0\x00'}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x3}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'veth0_to_bridge\x00'}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r3}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r3}]}, @HEADER={0x58, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r3}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x2}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'macvtap0\x00'}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r3}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'macvlan0\x00'}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'macsec0\x00'}]}, @HEADER={0x44, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'ipvlan1\x00'}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'vlan0\x00'}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r11}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x1}]}, @HEADER={0x2c, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'veth1_to_bridge\x00'}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'veth1_virt_wifi\x00'}]}, @HEADER={0x18, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'batadv0\x00'}]}, @HEADER={0x24, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_FLAGS={0x8}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x2}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x2}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x2}]}]}, 0x1a4}, 0x1, 0x0, 0x0, 0x4008011}, 0x4000000) (async) listen(r0, 0x0) (async) r12 = socket(0x10, 0x80000, 0x2) sendmsg$nl_route_sched(r12, &(0x7f00000010c0)={&(0x7f0000001000)={0x10, 0x0, 0x0, 0x1000}, 0xc, &(0x7f0000001080)={&(0x7f0000001040)=@getchain={0x2c, 0x66, 0x200, 0x70bd2d, 0x25dfdbfb, {0x0, 0x0, 0x0, r11, {0xe, 0xfff2}, {0x4, 0x5}, {0xffff, 0x2}}, [{0x8, 0xb, 0x402}]}, 0x2c}, 0x1, 0x0, 0x0, 0x10}, 0x800) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) (async) sendmsg$ETHTOOL_MSG_STRSET_GET(0xffffffffffffffff, &(0x7f0000001280)={&(0x7f0000001100)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f0000001240)={&(0x7f0000001140)={0xc8, r10, 0x8, 0x70bd26, 0x25dfdbff, {}, [@ETHTOOL_A_STRSET_COUNTS_ONLY={0x4}, @ETHTOOL_A_STRSET_COUNTS_ONLY={0x4}, @ETHTOOL_A_STRSET_STRINGSETS={0xac, 0x2, 0x0, 0x1, [{0x4}, {0x1c, 0x1, 0x0, 0x1, [@ETHTOOL_A_STRINGSET_ID={0x8, 0x1, 0x7}, @ETHTOOL_A_STRINGSET_ID={0x8, 0x1, 0x4}, @ETHTOOL_A_STRINGSET_ID={0x8, 0x1, 0x5}]}, {0x2c, 0x1, 0x0, 0x1, [@ETHTOOL_A_STRINGSET_ID={0x8, 0x1, 0x7}, @ETHTOOL_A_STRINGSET_ID={0x8, 0x1, 0x8}, @ETHTOOL_A_STRINGSET_ID={0x8, 0x1, 0x6}, @ETHTOOL_A_STRINGSET_ID={0x8}, @ETHTOOL_A_STRINGSET_ID={0x8, 0x1, 0x4}]}, {0x4}, {0x24, 0x1, 0x0, 0x1, [@ETHTOOL_A_STRINGSET_ID={0x8, 0x1, 0x6}, @ETHTOOL_A_STRINGSET_ID={0x8, 0x1, 0x1}, @ETHTOOL_A_STRINGSET_ID={0x8, 0x1, 0x6}, @ETHTOOL_A_STRINGSET_ID={0x8, 0x1, 0x1}]}, {0x34, 0x1, 0x0, 0x1, [@ETHTOOL_A_STRINGSET_ID={0x8, 0x1, 0x8}, @ETHTOOL_A_STRINGSET_ID={0x8, 0x1, 0x1}, @ETHTOOL_A_STRINGSET_ID={0x8, 0x1, 0x8}, @ETHTOOL_A_STRINGSET_ID={0x8, 0x1, 0x4}, @ETHTOOL_A_STRINGSET_ID={0x8}, @ETHTOOL_A_STRINGSET_ID={0x8, 0x1, 0x6}]}]}]}, 0xc8}, 0x1, 0x0, 0x0, 0x4000000}, 0x20000000) (async) syz_genetlink_get_family_id$l2tp(&(0x7f00000012c0), r0) sendmsg$NL80211_CMD_TRIGGER_SCAN(r8, &(0x7f0000001400)={&(0x7f0000001300)={0x10, 0x0, 0x0, 0x400}, 0xc, &(0x7f00000013c0)={&(0x7f0000001340)={0x48, r1, 0x8, 0x70bd26, 0x25dfdbfb, {{}, {@void, @val={0xc, 0x99, {0x9da0, 0x52}}}}, [@NL80211_ATTR_SCHED_SCAN_RSSI_ADJUST={0x6, 0xf7, {0x0, 0x9}}, @NL80211_ATTR_SCAN_FREQUENCIES={0x4}, @NL80211_ATTR_SCHED_SCAN_RELATIVE_RSSI={0x5, 0xf6, 0x1}, @NL80211_ATTR_SCHED_SCAN_MULTI={0x4}, @NL80211_ATTR_MEASUREMENT_DURATION={0x6, 0xeb, 0xffff}, @NL80211_ATTR_SCHED_SCAN_RSSI_ADJUST={0x6, 0xf7, {0x4, 0x82}}]}, 0x48}, 0x1, 0x0, 0x0, 0x4}, 0x40) 511.476863ms ago: executing program 0 (id=7365): sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="18000000000000001001000001"], 0x18, 0x68000000}, 0x0) r0 = socket$kcm(0x21, 0x2, 0xa) sendmsg$kcm(r0, &(0x7f0000000080)={&(0x7f0000000100)=@rxrpc=@in6={0x21, 0x0, 0x2, 0x1c, {0xa, 0x4e23, 0x0, @private1}}, 0x80, 0x0, 0x0, &(0x7f0000000180)=ANY=[], 0x18, 0x68000000}, 0x0) r1 = socket$kcm(0x21, 0x2, 0xa) sendmsg$kcm(r1, &(0x7f0000000080)={&(0x7f0000000100)=@rxrpc=@in6={0x21, 0x0, 0x2, 0x1c, {0xa, 0x4e22, 0x0, @private2}}, 0x80, 0x0, 0x0, &(0x7f0000000180)=ANY=[], 0x18, 0x68000000}, 0x0) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000180)=ANY=[@ANYBLOB="50000000103d998c92412e050fdbdf2500000000", @ANYRES32=0x0, @ANYBLOB="5d58000000000000140003006970766c616e310000000000000000001c0012800b0001006970766c616e00000c0002800600020000000000"], 0x50}, 0x1, 0x0, 0x0, 0x8c0}, 0x0) 465.983636ms ago: executing program 4 (id=7366): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$NL80211_CMD_SET_TX_BITRATE_MASK(r0, &(0x7f0000000840)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x8}, 0xc, &(0x7f0000000800)={&(0x7f0000000080)={0x76c, r1, 0x300, 0x70bd2b, 0x25dfdbfe, {{}, {@val={0x8}, @val={0xc, 0x99, {0x10000, 0x23}}}}, [@NL80211_ATTR_TX_RATES={0x2c, 0x5a, 0x0, 0x1, [@NL80211_BAND_2GHZ={0x28, 0x0, 0x0, 0x1, [@NL80211_TXRATE_HE_GI={0x5, 0x6, 0x1}, @NL80211_TXRATE_HE_GI={0x5, 0x6, 0x1}, @NL80211_TXRATE_VHT={0x14, 0x3, {[0xfff, 0x400, 0x3, 0x4, 0x0, 0x86f, 0x4, 0x4]}}]}]}, @NL80211_ATTR_TX_RATES={0x22c, 0x5a, 0x0, 0x1, [@NL80211_BAND_5GHZ={0x2c, 0x1, 0x0, 0x1, [@NL80211_TXRATE_HE={0x14, 0x5, {[0x8001, 0x5, 0x6, 0x4, 0x7ff, 0x37, 0xb, 0x10]}}, @NL80211_TXRATE_VHT={0x14, 0x3, {[0x3, 0x80, 0x9, 0x7, 0x1, 0x2cd, 0xd117, 0xa]}}]}, @NL80211_BAND_6GHZ={0xb0, 0x3, 0x0, 0x1, [@NL80211_TXRATE_HE_LTF={0x5, 0x7, 0x1}, @NL80211_TXRATE_HE_GI={0x5, 0x6, 0x2}, @NL80211_TXRATE_HE_GI={0x5, 0x6, 0x2}, @NL80211_TXRATE_HT={0x1d, 0x2, [{0x5, 0x7}, {0x1, 0x8}, {0x6, 0x4}, {0x0, 0x2}, {0x2, 0x9}, {0x0, 0x3}, {0x5}, {0x3, 0x7}, {0x7, 0x9}, {0x6, 0x2}, {0x7, 0x9}, {0x0, 0x7}, {0x5, 0x6}, {0x0, 0x9}, {0x1, 0x7}, {0x1, 0x4}, {0x5, 0x6}, {0x0, 0x3}, {0x5, 0x6}, {0x5, 0xa}, {0x2, 0x5}, {0x4, 0x5}, {0x2, 0x4}, {0x6, 0x5}, {0x6, 0x3}]}, @NL80211_TXRATE_HT={0x1c, 0x2, [{0x5, 0xa}, {0x0, 0x4}, {0x1, 0x3}, {0x2, 0x5}, {0x3, 0x2}, {0x7, 0x9}, {0x7, 0x9}, {0x0, 0x9}, {0x6, 0x6}, {0x0, 0xa}, {0x1}, {0x7, 0x2}, {0x2, 0x7}, {0x4, 0x2}, {0x7, 0x2}, {0x2, 0xa}, {0x0, 0x6}, {0x5, 0x5}, {0x2, 0x2}, {0x2, 0x2}, {0x0, 0x9}, {0x6, 0xa}, {0x7, 0xa}, {0x4, 0xa}]}, @NL80211_TXRATE_HE={0x14, 0x5, {[0xb, 0x3, 0x4, 0x5, 0x401, 0x8, 0x54, 0x3]}}, @NL80211_TXRATE_LEGACY={0x1a, 0x1, [0x3, 0x4, 0x24, 0x3, 0x3, 0x1b, 0x6c, 0x6c, 0xb, 0x9, 0x9, 0x5, 0xc, 0x1b, 0x24, 0x30, 0x2, 0x9, 0x48, 0x4b32b5017a9c9b8e, 0xc, 0x48]}, @NL80211_TXRATE_LEGACY={0xb, 0x1, [0x2, 0x7e, 0x1b, 0x6c, 0x77, 0x30, 0x12]}, @NL80211_TXRATE_HE={0x14, 0x5, {[0x7, 0xe2, 0xe, 0xd, 0x1, 0x2, 0x6, 0x6]}}, @NL80211_TXRATE_HE_GI={0x5, 0x6, 0x2}]}, @NL80211_BAND_60GHZ={0x64, 0x2, 0x0, 0x1, [@NL80211_TXRATE_HE_GI={0x5}, @NL80211_TXRATE_VHT={0x14, 0x3, {[0xc, 0x1, 0x6d3c, 0xfff7, 0x2, 0xff, 0x6, 0x5]}}, @NL80211_TXRATE_HT={0x32, 0x2, [{0x0, 0x4}, {0x7, 0x9}, {0x3, 0x1}, {0x5, 0x3}, {0x3, 0xa}, {0x7}, {0x1, 0x2}, {0x6, 0x4}, {0x0, 0x5}, {0x3}, {0x5}, {0x4, 0x7}, {0x7, 0x8}, {0x4, 0x7}, {0x1, 0x7}, {0x2, 0x8}, {0x3, 0x8}, {0x4, 0x4}, {0x0, 0x8}, {0x4, 0x8}, {0x7, 0x2}, {0x5, 0x2}, {0x1, 0x2}, {0x2, 0x5}, {0x1, 0x2}, {}, {0x6, 0x4}, {0x3, 0x5}, {0x5, 0x6}, {0x1, 0x5}, {0x3}, {0x4, 0x2}, {0x3, 0x6}, {0x6, 0xa}, {0x0, 0xa}, {0x3, 0x4}, {0x0, 0xa}, {0x3, 0x4}, {0x1}, {0x0, 0x5}, {0x2, 0x9}, {0x1, 0x3}, {0x7, 0x1}, {0x1, 0x8}, {0x1, 0x1}, {0x1, 0x3}]}, @NL80211_TXRATE_HT={0x5, 0x2, [{0x6, 0x4}]}, @NL80211_TXRATE_HE_LTF={0x5}]}, @NL80211_BAND_2GHZ={0xbc, 0x0, 0x0, 0x1, [@NL80211_TXRATE_HE={0x14, 0x5, {[0x7f, 0x3, 0x8, 0x9, 0x8000, 0x4, 0x1, 0x4]}}, @NL80211_TXRATE_HE_GI={0x5, 0x6, 0x2}, @NL80211_TXRATE_VHT={0x14, 0x3, {[0x104f, 0x8, 0xc82, 0x4, 0xa4, 0x7, 0x8000, 0x18a8]}}, @NL80211_TXRATE_LEGACY={0x23, 0x1, [0xb, 0x60, 0x2, 0x10, 0x0, 0x36, 0x12, 0x1b, 0x16, 0x2, 0x3, 0x1, 0x30, 0xc, 0x4, 0x6, 0x16, 0x1, 0xb, 0x12, 0x9, 0x9, 0x30, 0x9, 0x4, 0xa, 0x30, 0x48, 0x5, 0x18, 0xe99e824c335ce846]}, @NL80211_TXRATE_HE={0x14, 0x5, {[0x52d, 0xfffe, 0x40, 0xcd24, 0xfe00, 0x6, 0x2, 0x7]}}, @NL80211_TXRATE_HE={0x14, 0x5, {[0x200, 0x0, 0x6, 0x2, 0x1000, 0xce17, 0x6, 0x1000]}}, @NL80211_TXRATE_HE={0x14, 0x5, {[0x400, 0x655, 0x4, 0xe92, 0x49, 0x5, 0x8, 0x109]}}, @NL80211_TXRATE_VHT={0x14, 0x3, {[0x2, 0x6, 0x5, 0x81, 0x40, 0x10, 0x3, 0x1]}}, @NL80211_TXRATE_HT={0x12, 0x2, [{0x7, 0x4}, {0x6, 0x4}, {0x0, 0x9}, {0x5, 0x4}, {0x3, 0x1}, {0x2, 0x7}, {0x4, 0x3}, {0x0, 0x9}, {0x4, 0x4}, {0x3, 0x8}, {0x2, 0x5}, {0x4, 0x5}, {0x1, 0x6}, {0x2, 0x3}]}]}, @NL80211_BAND_5GHZ={0x2c, 0x1, 0x0, 0x1, [@NL80211_TXRATE_LEGACY={0x15, 0x1, [0xc, 0xc, 0x12, 0x30, 0x3, 0x3, 0x18, 0x30, 0x4, 0x6f, 0x60, 0x3, 0x12, 0x1b, 0x36, 0x48, 0x30]}, @NL80211_TXRATE_HE_GI={0x5, 0x6, 0x1}, @NL80211_TXRATE_HE_GI={0x5, 0x6, 0x1}]}]}, @NL80211_ATTR_TX_RATES={0x2a4, 0x5a, 0x0, 0x1, [@NL80211_BAND_5GHZ={0x98, 0x1, 0x0, 0x1, [@NL80211_TXRATE_GI={0x5, 0x4, 0x1}, @NL80211_TXRATE_HT={0x43, 0x2, [{0x0, 0x5}, {0x2, 0x8}, {0x4, 0x8}, {0x3}, {0x0, 0x7}, {0x1, 0xa}, {0x3}, {0x6, 0x9}, {0x7, 0x9}, {0x4, 0x7}, {0x0, 0x5}, {0x1, 0x4}, {0x4, 0x2}, {0x0, 0x3}, {0x2, 0x2}, {0x5, 0x8}, {0x6, 0x3}, {0x1, 0x2}, {0x3, 0x4}, {0x0, 0x8}, {0x4, 0x9}, {0x7, 0x6}, {0x7, 0x1}, {0x0, 0x7}, {0x4, 0x8}, {0x3, 0x8}, {0x1, 0xa}, {0x4, 0x1}, {0x5, 0x3}, {0x7, 0x7}, {0x5, 0x6}, {0x4, 0xa}, {0x0, 0x4}, {0x4, 0x6}, {0x7, 0x2}, {0x2, 0xa}, {0x7, 0x9}, {0x7, 0x5}, {0x6, 0x3}, {0x4}, {0x0, 0x3}, {0x6, 0x7}, {0x1}, {0x1, 0x3}, {0x6, 0x3}, {0x5, 0x6}, {0x2, 0x6}, {0x0, 0x7}, {0x0, 0x7}, {0x4, 0x2}, {0x7, 0x2}, {0x1}, {0x3, 0x2}, {0x4, 0x5}, {0x3, 0x4}, {0x0, 0x1}, {0x1, 0x8}, {0x6, 0x1}, {0x7, 0x5}, {0x3, 0x4}, {0x4}, {0x1, 0x9}, {0x5, 0x9}]}, @NL80211_TXRATE_LEGACY={0x24, 0x1, [0x7a, 0xb, 0x30, 0x30, 0x4, 0x6, 0x2, 0x36, 0x12, 0x16, 0x1b, 0x24, 0x18, 0x1b, 0x48, 0x3, 0x16, 0x9, 0x48, 0x2, 0x16, 0x9, 0x3, 0x6, 0x18, 0x0, 0x36, 0x30, 0x2, 0x1b, 0x48, 0x6c]}, @NL80211_TXRATE_HE={0x14, 0x5, {[0x4, 0x7, 0xfffa, 0x7, 0x101, 0x7, 0xfff9, 0xffff]}}, @NL80211_TXRATE_HE_GI={0x5}, @NL80211_TXRATE_HE_LTF={0x5, 0x7, 0x1}]}, @NL80211_BAND_5GHZ={0x60, 0x1, 0x0, 0x1, [@NL80211_TXRATE_HE={0x14, 0x5, {[0x9051, 0x8, 0x9, 0xed8, 0x6, 0x4, 0x2, 0xdba]}}, @NL80211_TXRATE_LEGACY={0x15, 0x1, [0x6, 0x24, 0x48, 0xc, 0x3, 0x16, 0x2, 0x1b, 0x5, 0x6c, 0x24, 0x24, 0x12, 0x30, 0x6c, 0xb, 0xc]}, @NL80211_TXRATE_VHT={0x14, 0x3, {[0x2, 0x2, 0x4617, 0x5, 0x4, 0x0, 0x7fff, 0x81]}}, @NL80211_TXRATE_GI={0x5}, @NL80211_TXRATE_VHT={0x14, 0x3, {[0x1, 0xda7, 0x2, 0xf, 0x0, 0x7f, 0x9, 0x2]}}]}, @NL80211_BAND_60GHZ={0x2c, 0x2, 0x0, 0x1, [@NL80211_TXRATE_HE={0x14, 0x5, {[0x0, 0x8, 0x7, 0xfffc, 0x4, 0x8, 0x3, 0x2]}}, @NL80211_TXRATE_VHT={0x14, 0x3, {[0xfffa, 0x7, 0x8, 0x7fff, 0x6, 0x7, 0xff]}}]}, @NL80211_BAND_6GHZ={0x1c, 0x3, 0x0, 0x1, [@NL80211_TXRATE_LEGACY={0x16, 0x1, [0x1, 0x24, 0x5, 0x1, 0x1, 0x24, 0x1b, 0x9, 0x12, 0x6, 0x16, 0x2, 0xb, 0x36, 0x2, 0x36, 0x1, 0x52]}]}, @NL80211_BAND_60GHZ={0xc, 0x2, 0x0, 0x1, [@NL80211_TXRATE_HE_LTF={0x5, 0x7, 0x1}]}, @NL80211_BAND_5GHZ={0x64, 0x1, 0x0, 0x1, [@NL80211_TXRATE_HE={0x14, 0x5, {[0x80, 0x4, 0x9df, 0x4ef0, 0x8000, 0xff, 0x4, 0xb]}}, @NL80211_TXRATE_GI={0x5}, @NL80211_TXRATE_HE={0x14, 0x5, {[0x800, 0x6f2, 0x9, 0x6, 0x2, 0x8, 0x9, 0x4]}}, @NL80211_TXRATE_HT={0x1c, 0x2, [{0x2, 0x3}, {0x6, 0x9}, {0x6, 0x3}, {0x5, 0x1}, {0x0, 0x5}, {0x6, 0x4}, {0x0, 0x6}, {0x0, 0x8}, {0x4, 0x7}, {0x0, 0x3}, {0x2, 0x9}, {0x2, 0x6}, {0x6, 0x3}, {0x0, 0x2}, {0x2, 0x2}, {0x3, 0x2}, {0x4, 0x4}, {0x2, 0x4}, {0x0, 0x2}, {0x4, 0x4}, {0x6, 0x9}, {0x6, 0x2}, {0x1, 0x1}, {0x6, 0x2}]}, @NL80211_TXRATE_LEGACY={0x14, 0x1, [0x5, 0x4, 0x5, 0x61, 0x9, 0xb, 0x24, 0x12, 0xc, 0x1a, 0x48, 0x16, 0x12, 0x6, 0x60, 0x24]}]}, @NL80211_BAND_2GHZ={0x20, 0x0, 0x0, 0x1, [@NL80211_TXRATE_VHT={0x14, 0x3, {[0x1, 0x9, 0x80, 0x3, 0x1, 0x189, 0x10, 0x84]}}, @NL80211_TXRATE_HE_GI={0x5, 0x6, 0x2}]}, @NL80211_BAND_5GHZ={0x50, 0x1, 0x0, 0x1, [@NL80211_TXRATE_HT={0x30, 0x2, [{0x4, 0x6}, {0x5, 0x2}, {0x6, 0x4}, {0x0, 0x2}, {0x2, 0x8}, {0x2, 0x9}, {0x1, 0x1}, {}, {0x7, 0x4}, {0x0, 0x3}, {0x0, 0x9}, {0x2, 0xa}, {0x1, 0x5}, {0x7, 0xa}, {0x6, 0x6}, {0x3}, {0x1, 0x1}, {0x4, 0x2}, {0x3, 0x3}, {0x5, 0x2}, {0x5, 0x1}, {0x7, 0x6}, {0x7, 0x3}, {0x7, 0x8}, {0x4, 0x4}, {0x1, 0x5}, {0x4, 0x9}, {0x1, 0x2}, {0x0, 0x3}, {0x0, 0x8}, {0x5, 0x4}, {0x6}, {0x6, 0xa}, {0x0, 0x1}, {0x0, 0x9}, {0x7, 0x9}, {0x1, 0x8}, {0x7, 0x5}, {0x1, 0xa}, {0x5, 0x7}, {0x3, 0x9}, {0x2, 0x6}, {0x4, 0x3}, {0x2}]}, @NL80211_TXRATE_VHT={0x14, 0x3, {[0x7, 0x7, 0x2, 0x6, 0x3, 0xbd9, 0x0, 0x200]}}, @NL80211_TXRATE_GI={0x5}]}, @NL80211_BAND_5GHZ={0x5c, 0x1, 0x0, 0x1, [@NL80211_TXRATE_HT={0x2c, 0x2, [{0x7, 0x1}, {0x6, 0x1}, {0x2, 0x5}, {0x6, 0x1}, {0x1, 0xa}, {0x0, 0x3}, {0x7}, {0x7, 0x2}, {0x7}, {0x4, 0x6}, {0x4, 0x9}, {0x3, 0x8}, {0x3, 0x5}, {0x0, 0x5}, {0x2, 0x6}, {0x0, 0x9}, {0x2}, {0x1, 0x8}, {0x4}, {0x6}, {0x3, 0x2}, {0x7, 0x5}, {0x6}, {0x3, 0x8}, {0x5, 0x9}, {0x0, 0x2}, {0x4, 0x7}, {0x7}, {0x5, 0x8}, {0x5, 0x7}, {0x6, 0x5}, {0x5, 0x5}, {0x5, 0x5}, {0x2, 0x7}, {0x5, 0x7}, {0x1, 0x8}, {0x6, 0x4}, {0x6, 0x9}, {0x1}, {0x2, 0x2}]}, @NL80211_TXRATE_LEGACY={0x21, 0x1, [0x1, 0x36, 0x5, 0x6c, 0x0, 0x24, 0x24, 0x24, 0xc, 0x18, 0x73, 0x60, 0x9, 0x3, 0x48, 0x48, 0x1, 0x5, 0x24, 0x3, 0x36, 0x24, 0x18, 0x6, 0x36, 0x9, 0x36, 0x4, 0x24]}, @NL80211_TXRATE_HE_LTF={0x5}]}, @NL80211_BAND_5GHZ={0x24, 0x1, 0x0, 0x1, [@NL80211_TXRATE_HE={0x14, 0x5, {[0xe, 0x2, 0xfffd, 0x92, 0x9, 0x8b0f, 0x10d, 0xbdf5]}}, @NL80211_TXRATE_LEGACY={0xb, 0x1, [0x24, 0x60, 0x9, 0x9, 0x6c, 0x24, 0x2]}]}]}, @NL80211_ATTR_TX_RATES={0x64, 0x5a, 0x0, 0x1, [@NL80211_BAND_60GHZ={0x48, 0x2, 0x0, 0x1, [@NL80211_TXRATE_HE_GI={0x5, 0x6, 0x1}, @NL80211_TXRATE_VHT={0x14, 0x3, {[0x1, 0xf71, 0x170, 0x6, 0xa, 0xd, 0xfffc, 0x5]}}, @NL80211_TXRATE_HE_LTF={0x5}, @NL80211_TXRATE_GI={0x5}, @NL80211_TXRATE_HE_LTF={0x5}, @NL80211_TXRATE_GI={0x5}, @NL80211_TXRATE_HE_GI={0x5, 0x6, 0x2}]}, @NL80211_BAND_60GHZ={0x18, 0x2, 0x0, 0x1, [@NL80211_TXRATE_HT={0xa, 0x2, [{0x0, 0x3}, {0x0, 0xa}, {0x4, 0xa}, {0x3, 0x2}, {0x0, 0x7}, {0x4, 0x7}]}, @NL80211_TXRATE_LEGACY={0x7, 0x1, [0x4, 0x9, 0x6c]}]}]}, @NL80211_ATTR_TX_RATES={0x2c, 0x5a, 0x0, 0x1, [@NL80211_BAND_5GHZ={0x28, 0x1, 0x0, 0x1, [@NL80211_TXRATE_VHT={0x14, 0x3, {[0x1, 0x80, 0x4, 0xec66, 0x1, 0x4, 0x1, 0x6]}}, @NL80211_TXRATE_HE_GI={0x5}, @NL80211_TXRATE_HE_GI={0x5, 0x6, 0x1}]}]}, @NL80211_ATTR_TX_RATES={0x1b8, 0x5a, 0x0, 0x1, [@NL80211_BAND_6GHZ={0x80, 0x3, 0x0, 0x1, [@NL80211_TXRATE_GI={0x5}, @NL80211_TXRATE_HE_LTF={0x5, 0x7, 0x1}, @NL80211_TXRATE_VHT={0x14, 0x3, {[0xfad, 0x2, 0x6, 0x3, 0x46, 0x400, 0x9, 0x8001]}}, @NL80211_TXRATE_HE_GI={0x5, 0x6, 0x1}, @NL80211_TXRATE_HT={0x27, 0x2, [{0x0, 0x5}, {0x2, 0x4}, {}, {0x7, 0x6}, {0x1, 0x8}, {0x2, 0x4}, {0x0, 0x6}, {0x3, 0x4}, {0x4, 0x6}, {0x4, 0x4}, {0x0, 0x5}, {0x5, 0x8}, {0x3, 0x2}, {0x4, 0x3}, {0x7, 0xa}, {0x4, 0x4}, {0x2, 0x5}, {0x2, 0x5}, {0x1, 0x6}, {0x7, 0x5}, {0x2, 0x5}, {0x1, 0x5}, {0x5, 0x7}, {0x1, 0x3}, {0x1, 0x5}, {0x0, 0x6}, {0x0, 0x7}, {0x6, 0x3}, {0x6, 0x2}, {0x5, 0x5}, {0x2, 0xa}, {0x1, 0x1}, {0x5, 0x4}, {}, {0x5, 0x7}]}, @NL80211_TXRATE_VHT={0x14, 0x3, {[0x101, 0xfff7, 0x7fff, 0x0, 0x7, 0xa3, 0x7ff, 0xd418]}}, @NL80211_TXRATE_VHT={0x14, 0x3, {[0xffff, 0x9, 0xb, 0x6, 0x9, 0x401, 0xfff, 0x8]}}]}, @NL80211_BAND_2GHZ={0xac, 0x0, 0x0, 0x1, [@NL80211_TXRATE_GI={0x5, 0x4, 0x2}, @NL80211_TXRATE_HT={0x40, 0x2, [{0x1, 0x2}, {0x0, 0x2}, {0x1, 0x5}, {0x6, 0x7}, {0x0, 0x2}, {0x4, 0x6}, {0x2, 0x9}, {0x2, 0x2}, {0x2, 0xa}, {0x6, 0x5}, {0x1, 0x5}, {0x5, 0x3}, {0x5, 0x4}, {0x1, 0xa}, {}, {0x1, 0x8}, {0x7, 0x2}, {0x0, 0x8}, {0x1, 0x1}, {0x6, 0x4}, {0x1, 0x7}, {0x5, 0x8}, {0x2}, {0x7, 0x1}, {0x5, 0x9}, {0x1, 0x7}, {0x1, 0x3}, {0x4, 0x4}, {0x1}, {0x0, 0x4}, {0x5, 0x4}, {0x4, 0x6}, {0x0, 0x6}, {0x5, 0x4}, {0x0, 0x6}, {0x0, 0x3}, {0x3, 0x4}, {0x5, 0x9}, {0x5, 0x8}, {0x3, 0x1}, {0x2, 0xa}, {0x4, 0x6}, {0x3, 0x1}, {0x2, 0x7}, {0x4, 0x1}, {0x5, 0x9}, {0x5, 0x7}, {}, {0x5, 0xa}, {0x6, 0x5}, {0x1, 0x4}, {0x1, 0x2}, {0x6, 0x6}, {0x1, 0xa}, {0x5, 0xa}, {0x2, 0x2}, {0x3, 0xa}, {0x6, 0x8}, {0x7, 0x8}, {0x6, 0x9}]}, @NL80211_TXRATE_HT={0x43, 0x2, [{0x0, 0x7}, {0x6, 0x8}, {0x1, 0x7}, {0x3, 0x9}, {0x1, 0x9}, {0x3, 0xa}, {0x0, 0x7}, {0x3, 0x8}, {0x0, 0x5}, {0x5, 0x7}, {0x3, 0x7}, {0x0, 0x4}, {0x6, 0x3}, {0x7, 0x1}, {0x2, 0x1}, {0x7, 0x2}, {0x6, 0xa}, {0x2, 0x2}, {0x5, 0x4}, {0x3, 0x9}, {0x6, 0x9}, {0x4, 0x2}, {0x0, 0x4}, {0x2, 0x4}, {0x5, 0x3}, {0x2, 0x3}, {0x0, 0x1}, {0x5, 0x2}, {0x0, 0xa}, {0x4, 0x1}, {0x3, 0x2}, {0x5, 0x2}, {0x1, 0xa}, {0x6}, {0x0, 0x6}, {0x2, 0x2}, {0x4, 0x4}, {0x2, 0x4}, {0x1, 0x4}, {0x7, 0x7}, {0x7, 0x6}, {0x3, 0x8}, {0x7, 0x5}, {0x3, 0x7}, {0x0, 0xa}, {0x1, 0x9}, {0x2, 0x3}, {0x5, 0x8}, {0x1, 0x3}, {0x2, 0xa}, {0x3, 0x8}, {0x0, 0x2}, {0x6, 0x4}, {0x1, 0x8}, {0x1, 0x2}, {0x1, 0x5}, {0x1, 0x7}, {0x5, 0x7}, {0x6, 0x3}, {0x6, 0x4}, {0x3, 0x4}, {0x2, 0x3}, {0x6, 0x3}]}, @NL80211_TXRATE_HE={0x14, 0x5, {[0x80, 0xffff, 0xffff, 0x9, 0x1, 0xffff, 0x101, 0x4]}}, @NL80211_TXRATE_HE_LTF={0x5}]}, @NL80211_BAND_5GHZ={0x68, 0x1, 0x0, 0x1, [@NL80211_TXRATE_HE={0x14, 0x5, {[0x9, 0x6, 0x62ce, 0x7fff, 0x401, 0x6, 0x10, 0x1]}}, @NL80211_TXRATE_LEGACY={0x19, 0x1, [0x18, 0x36, 0x0, 0x36, 0xb, 0x6c, 0xc, 0x3, 0x9, 0x48, 0xb, 0x3, 0x30, 0x12, 0x5, 0x12, 0x24, 0x6c, 0x1b, 0x7c, 0x1d]}, @NL80211_TXRATE_HE={0x14, 0x5, {[0x0, 0x4, 0x2489, 0x3, 0x8, 0xa, 0x2d, 0x1d]}}, @NL80211_TXRATE_HT={0x18, 0x2, [{0x5, 0x5}, {0x5, 0x8}, {0x7}, {0x2, 0xa}, {0x3, 0x9}, {0x1, 0xa}, {0x2, 0x3}, {0x7, 0x1}, {0x1, 0x9}, {0x5, 0x9}, {0x7, 0x8}, {0x6, 0x2}, {0x2, 0x7}, {0x5, 0x3}, {}, {0x1, 0x6}, {0x3, 0x1}, {0x1, 0x5}, {0x7}, {0x6, 0x1}]}, @NL80211_TXRATE_HE_GI={0x5}]}, @NL80211_BAND_2GHZ={0x20, 0x0, 0x0, 0x1, [@NL80211_TXRATE_HE_LTF={0x5, 0x7, 0x2}, @NL80211_TXRATE_VHT={0x14, 0x3, {[0x6, 0x3, 0x8, 0x2, 0x9, 0x0, 0xe91, 0x2]}}]}]}]}, 0x76c}, 0x1, 0x0, 0x0, 0x2004c054}, 0xc8c0) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000880)={'wlan0\x00'}) sendmsg$TIPC_CMD_GET_NODES(r0, &(0x7f0000000980)={&(0x7f00000008c0)={0x10, 0x0, 0x0, 0x8}, 0xc, &(0x7f0000000940)={&(0x7f0000000900)={0x1c, 0x0, 0x100, 0x70bd26, 0x25dfdbfe, {}, [""]}, 0x1c}, 0x1, 0x0, 0x0, 0x80}, 0x4044000) ioctl$sock_rose_SIOCADDRT(r0, 0x890b, &(0x7f00000009c0)={@dev={0xbb, 0xbb, 0xbb, 0x1, 0x0}, 0x68d9, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @bpq0, 0x7, [@bcast, @bcast, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @bcast, @default, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}]}) r2 = syz_genetlink_get_family_id$gtp(&(0x7f0000000a80), r0) sendmsg$GTP_CMD_ECHOREQ(r0, &(0x7f0000000b40)={&(0x7f0000000a40)={0x10, 0x0, 0x0, 0x8000000}, 0xc, &(0x7f0000000b00)={&(0x7f0000000ac0)={0x34, r2, 0x400, 0x70bd26, 0x25dfdbff, {}, [@GTPA_TID={0xc, 0x3, 0x4}, @GTPA_TID={0xc, 0x3, 0x4}, @GTPA_O_TEI={0x8, 0x9, 0x3}]}, 0x34}, 0x1, 0x0, 0x0, 0x5}, 0x20000000) setsockopt$inet_sctp_SCTP_RECVRCVINFO(0xffffffffffffffff, 0x84, 0x20, &(0x7f0000000b80)=0x8000, 0x4) sendmsg$GTP_CMD_NEWPDP(r0, &(0x7f0000000c80)={&(0x7f0000000bc0)={0x10, 0x0, 0x0, 0x20000000}, 0xc, &(0x7f0000000c40)={&(0x7f0000000c00)={0x2c, r2, 0x400, 0x70bd2c, 0x25dfdbfe, {}, [@GTPA_FAMILY={0x5, 0xd, 0x1e}, @GTPA_VERSION={0x8}, @GTPA_FLOW={0x6}]}, 0x2c}, 0x1, 0x0, 0x0, 0x40004}, 0x20000080) r3 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000d00), r0) sendmsg$ETHTOOL_MSG_EEE_SET(r0, &(0x7f0000000dc0)={&(0x7f0000000cc0)={0x10, 0x0, 0x0, 0x4000}, 0xc, &(0x7f0000000d80)={&(0x7f0000000d40)={0x1c, r3, 0x300, 0x70bd27, 0x25dfdbff, {}, [@ETHTOOL_A_EEE_TX_LPI_TIMER={0x8, 0x7, 0xfffffff9}]}, 0x1c}, 0x1, 0x0, 0x0, 0x880}, 0x20004000) ioctl$sock_kcm_SIOCKCMCLONE(0xffffffffffffffff, 0x89e2, &(0x7f0000000e00)={r0}) r5 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000e80), r0) sendmsg$IPVS_CMD_SET_SERVICE(r4, &(0x7f0000001040)={&(0x7f0000000e40)={0x10, 0x0, 0x0, 0x8000}, 0xc, &(0x7f0000001000)={&(0x7f0000000ec0)={0x110, r5, 0x300, 0x70bd2b, 0x25dfdbff, {}, [@IPVS_CMD_ATTR_SERVICE={0x14, 0x1, 0x0, 0x1, [@IPVS_SVC_ATTR_PE_NAME={0x8}, @IPVS_SVC_ATTR_TIMEOUT={0x8, 0x8, 0x6c25}]}, @IPVS_CMD_ATTR_DAEMON={0x54, 0x3, 0x0, 0x1, [@IPVS_DAEMON_ATTR_SYNC_MAXLEN={0x6, 0x4, 0x4}, @IPVS_DAEMON_ATTR_SYNC_ID={0x8, 0x3, 0x3}, @IPVS_DAEMON_ATTR_MCAST_PORT={0x6, 0x7, 0x4e22}, @IPVS_DAEMON_ATTR_MCAST_PORT={0x6, 0x7, 0x4e24}, @IPVS_DAEMON_ATTR_SYNC_MAXLEN={0x6, 0x4, 0x10}, @IPVS_DAEMON_ATTR_STATE={0x8}, @IPVS_DAEMON_ATTR_MCAST_PORT={0x6, 0x7, 0x4e20}, @IPVS_DAEMON_ATTR_MCAST_GROUP={0x8, 0x5, @local}, @IPVS_DAEMON_ATTR_MCAST_TTL={0x5, 0x8, 0x1}, @IPVS_DAEMON_ATTR_MCAST_GROUP={0x8, 0x5, @dev={0xac, 0x14, 0x14, 0x31}}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5, 0x1}, @IPVS_CMD_ATTR_TIMEOUT_UDP={0x8, 0x6, 0x5033}, @IPVS_CMD_ATTR_SERVICE={0x74, 0x1, 0x0, 0x1, [@IPVS_SVC_ATTR_PE_NAME={0x8}, @IPVS_SVC_ATTR_PE_NAME={0x8}, @IPVS_SVC_ATTR_SCHED_NAME={0x8, 0x6, 'wlc\x00'}, @IPVS_SVC_ATTR_FLAGS={0xc, 0x7, {0x2e, 0x2a}}, @IPVS_SVC_ATTR_ADDR={0x14, 0x3, @ipv4=@dev={0xac, 0x14, 0x14, 0x31}}, @IPVS_SVC_ATTR_AF={0x6, 0x1, 0x2}, @IPVS_SVC_ATTR_TIMEOUT={0x8, 0x8, 0x8}, @IPVS_SVC_ATTR_FLAGS={0xc, 0x7, {0x0, 0x13}}, @IPVS_SVC_ATTR_PORT={0x6, 0x4, 0x4e20}, @IPVS_SVC_ATTR_ADDR={0x14, 0x3, @ipv4=@remote}]}, @IPVS_CMD_ATTR_TIMEOUT_UDP={0x8, 0x6, 0xaae}, @IPVS_CMD_ATTR_TIMEOUT_UDP={0x8, 0x6, 0x8}]}, 0x110}, 0x1, 0x0, 0x0, 0x1}, 0x10) socket$pppl2tp(0x18, 0x1, 0x1) r6 = syz_genetlink_get_family_id$devlink(&(0x7f00000010c0), r0) ioctl$sock_SIOCGPGRP(r4, 0x8904, &(0x7f0000001100)=0x0) r8 = getpid() r9 = ioctl$NS_GET_PARENT(0xffffffffffffffff, 0xb702, 0x0) sendmsg$DEVLINK_CMD_RELOAD(r4, &(0x7f0000001240)={&(0x7f0000001080)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000001200)={&(0x7f0000001140)={0xb0, r6, 0x400, 0x70bd28, 0x25dfdbfc, {}, [{@pci={{0x8}, {0x11}}, @DEVLINK_ATTR_NETNS_PID={0x8, 0x8b, r7}}, {@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, @DEVLINK_ATTR_NETNS_PID={0x8, 0x8b, r8}}, {@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, @DEVLINK_ATTR_NETNS_FD={0x8, 0x8a, r9}}, {@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, @DEVLINK_ATTR_NETNS_FD={0x8}}]}, 0xb0}, 0x1, 0x0, 0x0, 0x4000}, 0x20000801) sendmsg$NL80211_CMD_STOP_AP(r0, &(0x7f0000001340)={&(0x7f0000001280)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f0000001300)={&(0x7f00000012c0)={0x20, r1, 0x300, 0x70bd25, 0x25dfdbfb, {{}, {@void, @val={0xc, 0x99, {0x1, 0x65}}}}, ["", "", "", "", "", "", ""]}, 0x20}, 0x1, 0x0, 0x0, 0x2}, 0x20000804) sendmsg$DEVLINK_CMD_RATE_GET(r0, &(0x7f0000001500)={&(0x7f0000001380)={0x10, 0x0, 0x0, 0x2000}, 0xc, &(0x7f00000014c0)={&(0x7f00000013c0)={0xfc, r6, 0x800, 0x70bd28, 0x25dfdbfe, {}, [@DEVLINK_ATTR_PORT_INDEX={0x8, 0x3, 0x2}, @DEVLINK_ATTR_RATE_NODE_NAME={0xe}, @DEVLINK_ATTR_RATE_NODE_NAME={0xe}, @DEVLINK_ATTR_RATE_NODE_NAME={0xf, 0xa8, @name2}, @DEVLINK_ATTR_PORT_INDEX={0x8}, @DEVLINK_ATTR_RATE_NODE_NAME={0x95, 0xa8, @random="b6f6087b24da4f4ca375cf5c97874fe46309704f45c9ad3dd64218f43fa69af8982fa2e7a42673ef892244bcf68bf2d2d5f1f5e5cc83df9b97aeed41234d6cac68eb6998a36fe50241caff9bf48c891199035d1818ce43db606351f594f33b5ba8ecf3c2967533ab72287b253573e6c6b556e7b0a64fcf4d1409937375c751b7e7d1165a15605ee674ad19aedd59861d29"}, @DEVLINK_ATTR_RATE_NODE_NAME={0xf, 0xa8, @name2}]}, 0xfc}, 0x1, 0x0, 0x0, 0x1}, 0x40000) sendmsg$DEVLINK_CMD_RATE_DEL(r4, &(0x7f0000002640)={&(0x7f0000001540)={0x10, 0x0, 0x0, 0x400}, 0xc, &(0x7f0000002600)={&(0x7f0000001580)={0x1048, r6, 0x300, 0x70bd2a, 0x25dfdbff, {}, [@DEVLINK_ATTR_RATE_NODE_NAME={0xf, 0xa8, @name2}, @DEVLINK_ATTR_RATE_NODE_NAME={0x1004, 0xa8, @random="58e4d74255aa4193b6ea020938d3dd0557fa1ba13de257ab184f0ff89f0b47fa49624a598d2161a63d50a918cf1637e4735ad8046e039bbf6c41061dc174b1875c4e73ae820eca1b1a0657fdc98bc310d76c26a5e2d5747ec3a9868cf7581e23cdc8ee0921fcc17af30fe9b87ecb6f77895ae3ec7d7bd2dc3bcd85d87dab7e09cfffc1381ec439b9b912ebed756965c0bab6a614a97406015f4834c4c4c620a9643b3526ea7814bad573ce12e1279203cbeb2a1b06530771678303d131b40eaa18ff51de589b454365fc5c710bedbe90326c8fdf1a8d20bfdaba64dac7756d7fac965ab5e6455c2941ba237f78590e7274ad53bfda857856c9adb7cd193ce6add8dc3377bb1f82bd00c1a2e2239b0a59043c2067c696fe9abe0f7a724d9761db892f8a7277e7c5dfaffc06f8a9748379ad4fc288688c1d5f1cf40d0010fe4c9a9475123dcc81afd8d741e47d1431ea5cb9b65d4fed75b54a1116541e246a47bbbba2e1d812f7e88942c21a370f413febc57d9e029f35315331e91765dd591bbb1afe2a408405cab740443dd41e4758bce01117b577c55f3152e8b5d2919bdc5549ddfa630a3566d8d7503e1a9047a5bc401329764a38e4c122c0dd66b6500d944496eac50f93dd180b6ae11ceafff8e90b7c5046734cd7a1ec52ef1f0880216a035be8b4148e73e67531a115801645bb94b52acd2bae97141013d17e94d9b8f4e621c6019d330c95809fa50adea712f02840be3b05f6d87c9d8c07a09dae50aa03a4748281fb1d7e92f1feefd59d124140d9dbacd368650a4d6ecebec34727e6eb291f05916033122ce362bc9ba2ca0fe2696f81689b85f1062595561461fa424190f9b2f92e086b35131f8cf101709eb5d6441ebb6aa301d852bbb942563b884d0fd62b2401db6ea4da02e77b143e8e16f30399431fc536f84662ff49cfcfb40a53c099c442e07938aae67f5d55acb4c17082dd387fb32a825ddd3572ae6b72842e1c4a730cb2d8d10c795c3125c896ef27836840e16f18e591425ec76908c7e8ccb46f0aac0690b3d74065896e40dc20aa6f92291b8fd22faaf566dba0bfaaf7c9dc144640686c88de26b2a627dc84e0103dcd55a4a573188471d6beec512aef7a1e17d74a393e79fafe138e5c3f831793848e0fa1bbf839f7cbc664431dbed79b8fc2f13091a7c571ed4618d2b99b933ee8fa8a0ab7fcc0e4b17bf88150a3eb15e02ba0ea5986b3a807b9f21ebafe7f62f7bf48f8c8c67baf866d2452dcf9cd4049bb06804a52fdde4a642dc5cfe9d810983eb84161f763b2da13e6c7afd3042830cf1af2f79c78dcc47730332c886b67a2ad0e7a8cf28f8dc90ae9a4106757a34895d42108f6ec9c95ec77b29a30f02230bc7fa45fe4c1e97156b54ce0e3941968076e0a99af5d236660a62025e8d8ff822c3469de587969aad20165c38ab91b0d7ac790f366236dc485ad815dffbd2040274c2b018b2d6544dc03b3bc211acad64c6032bcb1ddf9a05bd5b6d55da73fc09163afeb269169190794b0c643deff47981c82883029db0c4cdcaafeb1740169ba718944a2ba96ef8220d0c79fbd5a40852d969f379c65ee8f230b7179e3aa51e6217967f613ba49a56843c9bea3f3e479ba66775bb87a9e5b0a36941dd3a9ec1c246b8b97c0cc9d0eac54acba12f7162a9eeb548ddbc56f75b6b0d7913c74a9996ba0e4fdc20e33d8d82a756e18641a9cdb17e6c106ae19bb0b5943c63e9bc203ff7722e149a755d842b23be73fc64e54bd5b1304bec4d0ed6bf4dbf7d697b2ab26334192f6bf22af3075d5303b9999476e15e217035fe80827ad1a85fb3bf845f97bba76c400a3373418f4e12ed96ab333ff03d397a6c17602cb49ab499d33172ecf4ba142205867c4dd7ebe2a5bafca3d69409ffdd1cea275d48ce7ed4e9171b3ac55b8da1f41e8ec9b54f57b5115affadaf5cd80e14995aafc54a7b0fa279529d30ab8bb0e3bad7c743661f301c128305ab7e1f111cdd701a7c7e0512782f31b755eb0528440039e28f56bb8626cde4cb6125008ae13b5e065ef40f9fbf2a03455e814728c4167f70654c2a71d9f4983c42697a6cac726f79329f5d010236294a4de62718c1b3e0ee85310068757c88449c920c0940c829e129c13f8d70407961e5376b699d7b6b51ac7e01f0767cd9e1ed0ba6eba3652e25dfd4097de46a7c2fb0871a4cc69d1ad3814712844d0cc660272a7125aed1ae9ce48e4045e96ea5893e3c5bc08fc77c3e3aedec4b1a5a122c77ea9c5a981fe87eac657bdad88e4341bc2b908a8a3d008385f4502fac85901a71379269ea5ef694a9b1115bb7862dbfc652333c5bd4d49661d6f72874687c8e584e8b25b69116452d2dda1b39325d71b80494a0a196187c8eba6df99c09e75a3a6888b5fd01cad9dda6a6d211ddd679158cde7f8303386a805ad9b39801f37d48d8479611c6472697f376cf903c0c3ebbb3a52ef6f2f6ac152cce8b589dec90bff96dc10e82674a20627b9f3a37b3410e189ed5da2b9d74accaf0b0e01a3f2eaac2e3b250e8e678cac0454c8a0d26e831c92c8a2930f7d58cb16a4b17a22bea8bc0e20be87752bf0fe520dea48d04489e3bb4f68322fcd25b688aa53b354466b97a1898cf6676b9fda8576775dcbd464597569e758b2745c1a01f056f4f6fa1733c518f0b0cb7d23bd5b81fa3fc2d4bc1ed879c9d6d9075d2bc9eb806fac61decffcc9f43cc0199211660da59e75571487c7080bc32eefe210fc39507ed08e18ba7e1a19ad8e3614afd8f4710a744bcb5c80a7cd48bdb8029255bb82d118b75d5ed9ae318ddb30da4fb6a7c3cfaaf2418d4993b50e98d9a9ca73382e21331b7accac4c1fc771d731a1a3f46aa8a55428bc521b1d14874f6a0ebe8a25d1f0314760e9380013831fc78bc6aafdaf36f9dbfe1ebb7c8d0694bb4e5421f4122397941ac25c8fc98ba3a64d9c27c8140fc79d0a2e9b3cfc955e7f0004da64b3cd190daaa34f5bebd0426a38ae60ae5a4a7299e14e3a6143ab823380fa8cdd45fbe9a51ec82fa03a3b0f729cb1e037feb6f20288d79282c15d039295e59f51c7a6c44763313267e3c0a850413028816bc73f44a38b05c56c00a3c871d618b246c03cd6bd4c708a0a4a18b539cea9c135b2ec51d1c226bde9b6c69659b2d2bdcb0c1b5e44821f4cbcb1085313a81133e5ac141d80919f6c7ed6414d4ac13eee4b9790772a3fa4fcc673ebab866b26cc53f94f9cc416b765814f39c2d7813db4091e49fab047b2ec3ac22429d47be0a70338828a1448e16833992b257427ff2b1de60a865f787fd7e0007014f3bb4d25b5d50f52cf6db2cbbf334cf5733651b1a7dd1bc734e73e8363713864a6baf77edfe7ddfa979701f215c21b0f1944bd62524d351fc71d7449efab372f37d4c32cb0b37e0637e66bc3b0b793db8841635a5abd5fae11a9951af8ed4d01e4a2d0e8210b30a802b2996597b1e55fd9ec83dbd5b133d7e62d18fb2dd89f7d4de84d757d1b24964b2734c93c7ea732b62a259eb82fc91f17eab3d78866d984f1daad12809fc83937be4bf526c40f331cfe2980df468be3194986dc2c976952b45766dc63a2ab183e334b682bb555fca7bfbca59ce2110a1bde3064f3b863e99accf3482855e9a57b5815faaaf2c4b77e90feb2bfbb95e064c3796f4464747adb1beaced6102897d0f22d8e70b9a93b872ce96f58d050dbfe1b8d793d9665ee9967a1fa56fb06d7194f04520ab2db462330e0c96e112f3ee4cf971475348aa7d5c4416c984b28333e829902508467868359c9d550474899c89475344f535ee178b009786a215a69ddace591b0576c4e06bf0684b53b19da4c520e8536d91b1d0d399bde26484a1526208e5ca6b00b1f78d9c5937067c0435f7bc76f044cf044e496622454aa3252f7a96d75348cf86e69912c75b944e62b6b6a252fb6cf155164448094481f8a2f6f1f0ff2dcd05fdb28cd09ad9d9f796965aebd55b2446a8fca5080f1578933e3cd419c191aba4ebd9b6d89be5444b42d279aa5d1acb246d75f90c4e35fd4d815720330f74685b2be3c1a0a3566678752d774eff4015b6530a7aef83d69a86d14f2b6800ec876583c6fd61baa189ff5b71fcc3c3f142edbb0c104d8e301f09c4486c638cbaea159feced4f05f53a2d288acbe5a7a02c0995a41d07e7eab5f9917067a6035689b48d117c961b05685e88e511b2f4802e8bb1308fe3de66b9236b1714d44234851e83561cb9bed2b5b6712329a6a7e07dedf43f43b067546ef6df829ca3f77279828798548f1bce1b35943fb8cc36562828ddd113a794e81e9ede9de04cfbce19b2eee3de82056467cf7715c871a3dcb7c4eacc3764287c9c236c4909978fad35a7621baf0ee392121a94acd80192580f43e40974980095e1c7eebeb7390cb95bbe662d68910a429ebb8f15ff9df5c8fb0d76616a2f76dd7127fc58522dc1baa57580cef6353951f7bb288f3221a73c62c60f308621e44ff0244710f34c6e631d8e65a40bfb7989e97d10007ff367c2f221c351ab8a2c76f7b3aa27bda4ccb34acfb21862b40d64ffc3b983293f49dcbcd89e139b8c4b7ac5c5c02de566d3afade2edf43e9c7abf89bd01b810962ba58d2f8bdf9a3373439538fa595cb9cba026f64639cbd1057bd8f89368c9ffe8eca8579a0298fc05cdd3c1d36efe01e73bcced0939c18be2e899ac3393bed8a0595fcb93c27d9c6479e91911d91ebe4c1edd69cc686890ab2ef8a05954058097c46c49e5bb81c1443e45374a0f33af54db17963a8d1c4be394e4548e95510a2469aaa0d4aa7561d59c3b41a27116fecbc2cee8b00332050940d507be47443778f5f15e7225d7055ab1e525e80ca8f3c352e15e9fc6192207388b4306c0cb506739977b046ea04a3166c77ac440437f77d02e1e1584f24ed092ef6ce11176bce4e2799dca2cf7e68a97fbc112d4eb3a2bc142409f9b85563dd57a2137cce1b958269d68ef0e31ccdc89c94df57e2bad4105bb1d1c791ea028bd60bdc3b63f0469f7a9bc9a6331a3cbcb756a790b1edd466291357906a8a4016e1c6cb6f521f29215c78e1d991dafe2ac0c04c35878010d2577d311a07c3c6f2a206a4c3b7fc69eca0cd1a90018dff51a25d822f5f7fcf30156e3d24a3aad8f5f73d966f2db7a057cf3f5774e24a123f233c2e27ee25cd83e2c9994b33c8ac64d5ba2577af2cacb7387b9b4f7776a7195743150c7eec3d4bead636a1134ba977cdc89d2c00e3b5bc2a6c568045e19c7f90069f1bdf9c819b2f80da86cffba9cd0125690c3de494862dda48f7fb4691c51badbc5433f48678a67fa5cc062313882432440450692769e97418125bd69963df9c1323b09502c75b4f31cfb09ab46c5f6d95e6561837043377e7eb7f34b1720711ae5715b0bb7a4c76bc50d173f18bb9f3efda23a58aa034b3f591492e42ec723ec9aac5bf5924ff8b5725c25885f7c591dbcd3ee93a69a4503b2bbe3ff7004631ab398f54b66c5b0430b64e12e5bce02b930fce5e0d9ab68e0f67b46406b632157485504b2b5d26a0d2f48ca1799bdae7756a14782a62809b05c024f90f4bf567d8b76393ee9a8ed44122d8812997a35dd955648769830f8831efbe278f8dca41699167f53166368d142744031bebc4d8f0f52c82e31c463cca82dded556c811c4c7a7b2aa0c175b8da7c184bdb9f1697913097aa84e58e8da1033c5cce32db82b20e948c9f557fd27079a57c4a22170f081fd8b7089b3f0b951cd353b121e30cb2991e4e9539e614cf37106d"}, @DEVLINK_ATTR_PORT_INDEX={0x8, 0x3, 0x3}, @DEVLINK_ATTR_PORT_INDEX={0x8, 0x3, 0x3}, @DEVLINK_ATTR_RATE_NODE_NAME={0xf, 0xa8, @name2}]}, 0x1048}, 0x1, 0x0, 0x0, 0x44804}, 0x100) sendmsg$NL80211_CMD_SET_BSS(r4, &(0x7f0000002740)={&(0x7f0000002680)={0x10, 0x0, 0x0, 0x20000000}, 0xc, &(0x7f0000002700)={&(0x7f00000026c0)={0x30, 0x0, 0x20, 0x70bd2a, 0x25dfdbff, {{}, {@void, @val={0xc, 0x99, {0x7, 0xf}}}}, [@NL80211_ATTR_AP_ISOLATE={0x5, 0x60, 0x7}, @NL80211_ATTR_AP_ISOLATE={0x5, 0x60, 0xf1}]}, 0x30}, 0x1, 0x0, 0x0, 0x20000d05}, 0x40) getsockopt$IP_VS_SO_GET_DESTS(r0, 0x0, 0x484, &(0x7f0000002780)=""/197, &(0x7f0000002880)=0xc5) ioctl$INCFS_IOC_FILL_BLOCKS(r0, 0x80106720, &(0x7f0000002d80)={0x7, &(0x7f0000002c80)=[{0xfffffff9, 0x2c, &(0x7f00000028c0)="a30f1dd5f66ebcc42fb44ee6d39bfa78afb2f24a49c9c1d552b55a42fcda29b62be8bc5952381b199165177c", 0x0, 0x1}, {0xbd44, 0x8c, &(0x7f0000002900)="242a55ba495da461baf520afe2c241a38ccf71a7b4304b12dd500984800feb36a2a96b2dc7229d112c5d2cd6f7fb8190218b3fd6bf172d0d02619601c733d1dfba7a83c0e55141a8c5757cd7c216888f0262dfea8743f9eba39f68a835e1ed2646a74a86fe9e6b132d2e3cbd538391cb37f45be6248eefd11bdd744b7ceb31e4fdd3bae46b39db92975fb454"}, {0xfffffff7, 0x39, &(0x7f00000029c0)="a04d4f9c3fe601e1746474a178818e99ebf21c259d5d1456455c8661eaa0acf75bd54692ff5ff79094c170ad7d33e0d41b560791bc81089787", 0x1}, {0xe78, 0x7f, &(0x7f0000002a00)="56d6fc97b9752dc0b319ac586aa0759974e69c6f526ce9a2d094c6941a1e744b7beeab241659414af01e55c2003f2eeb3203bd317c7e149dc4559a64fe4609af1d8256f685cea226fb3ec28122366362a9a74830808719df8d42bbaa8e6cf8fd42dd3971043fa69ca701813c67bec8656ac15144b6f5325d52b041efa64d25", 0x0, 0x1}, {0x4, 0xc8, &(0x7f0000002a80)="c099f98f6870ccde760f36b4f47c6ee1baa965e9e8f335164af754510dfd90d99c41003dfb2f3f2332a63bb2cd32ff5d197b7d2c7ba756b488ca4d20058b7c4efc3a7c1bdc4f1a65254e43429a4839a0c73d3817f62597e30d27e0bc8f13c51022281913c0e4b7a7e74b2d1ef5563c4f064b52a4c34e83f9643ffe8efa531ef624560d58ce6feffbb455b4b3f7c65270665a79fce4e7f9a397114a64906dbcfcf6b15c83409ee47a8d2476932e7397f6adebb061b80c184f1a0f1573088dae480fcb847038b13882", 0x1, 0x1}, {0x40, 0x3b, &(0x7f0000002b80)="602ba632395d632f0c2c4fa8b713389833c1d2573b85c5632a1f5fe101267836d5e92222e9a3d69838e588a1d50623a005131d4d0c34c866d2c656", 0x1}, {0x7, 0xab, &(0x7f0000002bc0)="c680eaba69e729b2ced5cde3e11a450775b9d3f255abc2a99d92b7b94357041f1c9424dc37a2ae10f46b8b891aba1067ab5799a39df7f185379d816dc7909958158b42a18315f125b377747efeebb5c078c714794a5bded363798d380abe134d0705fcefd049007fe590dcc8826ac5cf8ee6675ae118daf211c74e0caff6c7441aa9dc42cfea2911a95c20027d6da42f906315ba3b821ee1f89bc5fbf0fca4d8644e94ea8cedf7732089b0", 0x0, 0x1}]}) sendmsg$GTP_CMD_NEWPDP(r4, &(0x7f0000002ec0)={&(0x7f0000002dc0)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f0000002e80)={&(0x7f0000002e00)={0x4c, 0x0, 0x20, 0x70bd2b, 0x4, {}, [@GTPA_PEER_ADDRESS={0x8, 0x4, @local}, @GTPA_O_TEI={0x8, 0x9, 0x1}, @GTPA_PEER_ADDRESS={0x8, 0x4, @loopback}, @GTPA_FAMILY={0x5, 0xd, 0x1f}, @GTPA_O_TEI={0x8, 0x9, 0x1}, @GTPA_O_TEI={0x8, 0x9, 0x1}, @GTPA_PEER_ADDRESS={0x8, 0x4, @private=0xa010101}]}, 0x4c}, 0x1, 0x0, 0x0, 0x4000000}, 0x5) r10 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f0000002f00)={0x3, 0x4, 0x4, 0xa, 0x0, 0xffffffffffffffff, 0xc7, '\x00', 0x0, 0xffffffffffffffff, 0x5, 0x1, 0x1}, 0x50) writev(r10, &(0x7f0000003200)=[{&(0x7f0000002f80)="3b3f41bf50f6cae6a1bd213125a686b7ef741bbca186af3cd74ed815013c4f499cb3d28e4fcceb866d73a8a6d4b6d4be70f1f7eddbbaf70fde50d20185aa88e04a00a30264a98e70855ff64a4e840b2e3b7558389d79f81c818a2c4f299f61f7e6e9a8ae9a4b2b6e331135693f780a26f3edb6a94d7527c36a5579e5b117a649866e35de02e1d2937b26cbe66641aea04c9b4cbcc295c661836f9002f0d567e3e959e0e8fefa9d2195d4310e9d1732173d45a9cc79b1bc34ddfa96d9ba1c7a0b5c0e83ebd71fdef09a45f09071ef1cbc022bc42a41152c37180094ea6861", 0xde}, {&(0x7f0000003080)="8e9a5de36e9b3522584fbc4355a558d4ee8c935426ab8b8c10fa27e5d524923846819ec372b694ba0ec7c97f6c45446a7ee0c4d4411c7e5e163b201cda67fe7f04ee65187f5a12b66587e2d3158a574e99a2a3d8504bd1174a3b2b11998563a4d74cd906b5ad09d72c5c82f74cefa289274272ed8eba37cca66174b7f3b39b92502f94babb5bf1b847851d4bcd78c6457bd3359b92be4bf8e3c19430a61a8c2fe4141beca95cb143fb74c9f5", 0xac}, {&(0x7f0000003140)="f4e53bcd220ed6c4cec87d9e94113b86140aaca13f4be8ddf5dbea45b38603447447d91cfef92621a8b604de9453d26e9565e9531615f592d34d3d2e04c997899398d50492c568cb5e1c7d2513c39400f586552530d0415f42568d4031ed68a01b1c57bf11e2e186c25a5d2e08d2f215fb7dc7383c6ab699ed9d6444db9974f4ae5cbe9b4cf1183148c571ef3a75ee874e2cd7cc3f3e854f2f6664576108cd22a6873c9a57af10fba82f50d8680f555406aa4a1a3e6f71d041247400e8f87b", 0xbf}], 0x3) 395.172644ms ago: executing program 2 (id=7367): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000003c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0) sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000680)=ANY=[@ANYBLOB="14000000100001000000000000b890c1a000000a80000000160a01030000000000000000020000000900020073797a30000000000900010073797a30000000005400038008000240000000000800014000000000400003801400010076657468315f746f5f6272696467650014000100776732000000000000000000000000000b00010076657468305f746f5f7465616d00000014000000110001"], 0xa8}}, 0x0) sendmsg$NFT_BATCH(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000740)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a58000000060a0b040000000000000000020000002c0004802800018011000100666c421ee1d55adfbf31616400000000100002800900010073797a30000000000900010000797a30000000000900020073797a3200000000140000001100010000000000000000000000000a3e02d839c711e52bd3a6179203a2eec409b2e5b02ef6e1faaef845dccf8d978497457392263e8e76c0d93da0d2543b6f61d20e7aac9a0def52fca19275266a0181e6291f604eb87f6ed654fed6a6d7e4597b690706269861460ff8b5d55c3f7ebf8295c3f5489aeabfbb9231aff8c17eda0f67a5639978401b74a29bb09bb016752b96a1c0de001d3ab8f07a0595b609a54f15c8466e391ea1a3b6064792d26122850c40e45f0a24d005659b387f7af4d0d79a53d244f29f92d1c5df356e6efdb403c09dc5f694615d0485c07c078201"], 0x80}, 0x1, 0x0, 0x0, 0x2000094}, 0x4000800) close(r0) r1 = socket$inet6(0x10, 0x1, 0x49b) r2 = socket$alg(0x26, 0x5, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000280)={&(0x7f0000000080)=ANY=[@ANYBLOB="9feb01001800000000000000280000002800000002000000000000000000000105000000030000000000000001000085000080000000000001"], 0x0, 0x42}, 0x20) bind$alg(r2, &(0x7f0000000600)={0x26, 'hash\x00', 0x0, 0x0, 'cbcmac(camellia-generic)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r2, 0x117, 0x1, &(0x7f0000000000)="ad56b6c58206007e4af65430442b25b36f", 0x11) sendto$inet6(r1, &(0x7f0000000080)="4c00000012001f15b9409b849ac00a00a5784002000000000000030038c88cc055c5ac27a6c5b068d0bf46d323452536005ad94a461cdbfee9bdb942352359a351d1ec0cffc8792cd8000080", 0x4c, 0x0, 0x0, 0x0) 336.769012ms ago: executing program 0 (id=7368): bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0x10, 0x4, &(0x7f0000000040)=ANY=[@ANYBLOB="b40000000000000079104800000000f161042c000000000095000000"], &(0x7f0000003ff6)='GPL\x00', 0x2, 0xfd90, &(0x7f000000cf3d)=""/195, 0x0, 0x1, '\x00', 0x0, @sk_msg, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0xfffffffffffffd8b, 0xffffffffffffffff}, 0x48) 307.808022ms ago: executing program 4 (id=7369): r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000200)=@base={0xb, 0xc, 0x4, 0xc4f, 0x1, 0x1}, 0x48) bpf$MAP_LOOKUP_BATCH(0x18, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x3, r1}, 0x38) r2 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000180), 0xffffffffffffffff) (async) ioctl$sock_SIOCGIFINDEX_802154(r2, 0x8933, &(0x7f00000001c0)={'wpan1\x00', 0x0}) sendmsg$NL802154_CMD_NEW_SEC_KEY(r2, &(0x7f00000003c0)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000080)=ANY=[@ANYBLOB='|\x00\x00\x00', @ANYRES16=r3, @ANYBLOB="3f9d00000000000000001700000008000300", @ANYRES32=r4, @ANYBLOB="60003080050002000000000014000400403a050c5bae9c544ef2b6d713459a7a1c000180050002000000000008000400050000000800010002", @ANYRESOCT=r2, @ANYRES16=r3, @ANYRESHEX=r0, @ANYRES64=r3, @ANYRESOCT=0x0], 0x7c}, 0x1, 0x0, 0x0, 0x4004}, 0x0) 303.473026ms ago: executing program 3 (id=7370): r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x2, 0x0) r1 = socket$inet_udplite(0x2, 0x2, 0x88) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r2, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000003c0)=ANY=[@ANYBLOB="140000001000010000000000000000001c6a000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0) sendmsg$NFT_BATCH(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000080)={{0x14}, [@NFT_MSG_NEWRULE={0x4c, 0x6, 0xa, 0x409, 0x0, 0x0, {0x2}, [@NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_RULE_CHAIN={0x9, 0x2, 'syz2\x00'}, @NFTA_RULE_EXPRESSIONS={0x20, 0x4, 0x0, 0x1, [{0x1c, 0x1, 0x0, 0x1, @xfrm={{0x9}, @val={0xc, 0x2, 0x0, 0x1, [@NFTA_XFRM_KEY={0x8}]}}}]}]}], {0x14}}, 0x74}}, 0x0) ioctl$FS_IOC_RESVSP(r1, 0x40305828, &(0x7f0000000000)={0x0, 0x3, 0x7, 0x3ff}) setsockopt$inet_group_source_req(r1, 0x0, 0x2e, &(0x7f00000002c0)={0x9, {{0x2, 0x0, @remote}}, {{0x2, 0xffff, @multicast2}}}, 0x108) connect$bt_l2cap(r0, &(0x7f0000000080)={0x1f, 0x0, @fixed={'\xaa\xaa\xaa\xaa\xaa', 0x10}, 0x7ff}, 0xe) r3 = syz_init_net_socket$bt_hidp(0x1f, 0x3, 0x6) ioctl$sock_bt_hidp_HIDPCONNADD(r3, 0x400448c8, &(0x7f0000000600)={r0, r0, 0x8, 0x0, 0x0, 0x6, 0xfe, 0x10cf, 0x5, 0x5, 0x2, 0x1, 'syz0\x00'}) 267.232384ms ago: executing program 2 (id=7371): syz_emit_ethernet(0x72, &(0x7f0000000080)={@local, @empty, @val={@void}, {@ipv6={0x86dd, @icmpv6={0x0, 0x6, "200402", 0x3c, 0x3a, 0x0, @remote, @local, {[], @pkt_toobig={0x8, 0x2, 0x0, 0x0, {0x0, 0x6, "000810", 0x0, 0x88, 0x0, @ipv4={'\x00', '\xff\xff', @empty}, @private2, [@hopopts={0x1, 0x0, '\x00', [@pad1, @ra={0x5, 0x2, 0x8}, @hao={0xc9, 0x0, @empty}, @padn={0x1, 0x0, [0x0, 0x0, 0x0, 0x0]}, @generic={0x6, 0x0, "eaa685a5b387462c1bf1b33e32bea9e312a2f24d4bae420552f3f541ed19934ef8860b258f33ce324c463781daa58defced89d046320f743d358f566ea14e775018020c5a3fa9b8beb27752401d15bbf488ba05b9d4cdcf14a5a68a4eb5ada1d4f7983a5f907917b2599fec450f3c38b30a396d6798bdaa6d091eeabaddb03973bdcc7864cc695c000962247c994935102fd9b693ebdb97105e41e3865a99d4be73637dbdc0f94afcf33d7d7b3036be5ada746c45f6175f36ab3db6d2f2d7b26a1dba12ea926c3026b7283cb07a3b0750fea2b5f180b77e397ff737c8d4a353dd9b7b9a9750e5d857b2e706233c3"}, @enc_lim={0x4, 0x1, 0x8}, @jumbo={0xc2, 0x4, 0x101}, @hao={0xc9, 0x0, @empty}, @calipso={0x7, 0x0, {0x2, 0x0, 0x8, 0x314d, [0x6, 0x8000, 0x8, 0x30000000, 0x9, 0x9, 0x8, 0x5, 0x9, 0x8]}}]}], "fb36eeca"}}}}}}}, 0x0) 265.924201ms ago: executing program 0 (id=7372): syz_emit_ethernet(0x66, &(0x7f0000000440)=ANY=[@ANYBLOB="aaaaaaaaaaaaaaaaaaa8aaaa88a800008100000086dd6076cd8a0028000020010000000000000003000000000000fe8000000000000000000000000000000004000000000000071800000000040000d604"], 0x0) 120.704437ms ago: executing program 0 (id=7373): socket$key(0xf, 0x3, 0x2) ioctl$PPPIOCNEWUNIT(0xffffffffffffffff, 0xc004743e, &(0x7f00000000c0)) bpf$MAP_CREATE(0x0, 0x0, 0x0) ioctl$PPPIOCSFLAGS1(0xffffffffffffffff, 0x40047459, 0x0) pwritev(0xffffffffffffffff, 0x0, 0x0, 0xee, 0x1) r0 = bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000280)={0x6, 0x3, &(0x7f00000000c0)=ANY=[@ANYBLOB="1800000002000000000000000008082295"], &(0x7f0000000240)='syzkaller\x00'}, 0x94) syz_emit_ethernet(0xbe, &(0x7f0000000000)={@multicast, @random="fa1fc6182aca", @void, {@ipv4={0x800, @udp={{0x5, 0x4, 0x0, 0x0, 0xb0, 0x0, 0x0, 0x0, 0x11, 0x0, @empty, @multicast1}, {0x4e21, 0x4e22, 0x9c, 0x0, @wg=@initiation={0x1, 0x3, "7b4b143b7461fd777b1c012bd14efb9f49fcdb8f080c26a04883ad5c8c82b8af", "584cbf2600fcffffbc43efa8698d0a881c51852e4451b57d037ad3c0459428242588eb17b53ae414015acd00", "bcfd56f1375461caaa2f19935e6996c7096ffeeb0300000000000064", {"9a3bfbc1f39cb307b3472eb9cdb042d2", "743fcbb2c5e304000000000000dafe09"}}}}}}}, 0x0) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000600)={r0, 0x5, 0xb68, 0xffffffffffffff6b, &(0x7f0000000000)="ff", 0x0, 0x149c, 0x503, 0x0, 0x0, 0x0, 0x0, 0x2, 0xffff80fe}, 0x48) (fail_nth: 29) 120.423487ms ago: executing program 2 (id=7374): r0 = syz_init_net_socket$netrom(0x6, 0x5, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000000)={'macvlan0\x00', 0x0}) sendmsg$nl_route(r2, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000003580)=@newlink={0x50, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r3, 0x503}, [@IFLA_LINKINFO={0x30, 0x12, 0x0, 0x1, @macvlan={{0xc}, {0x20, 0x2, 0x0, 0x1, [@IFLA_MACVLAN_MACADDR={0xa, 0x4, @local}, @IFLA_MACVLAN_MACADDR_MODE={0x8}, @IFLA_MACVLAN_MODE={0x8, 0x1, 0x10}]}}}]}, 0x50}}, 0x0) sendmmsg(r1, &(0x7f00000002c0), 0x40000000000009f, 0x0) socket(0x10, 0x803, 0x2) ioctl$sock_netrom_SIOCDELRT(r0, 0x890c, &(0x7f0000000140)={0x1, @bcast, @bpq0, 0x8, 'syz0\x00', @bcast, 0x7, 0x8, [@remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x3}, @default, @default, @null, @null, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x0}]}) 9.145902ms ago: executing program 4 (id=7375): r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000040)={0x18, 0x43, 0x9, 0x1, 0x25dfcbfb, {0x1c}, [@typed={0x4, 0x11f}]}, 0x18}, 0x1, 0x0, 0x0, 0x8000}, 0x0) 0s ago: executing program 3 (id=7376): r0 = socket$inet6(0x10, 0x2, 0x4) sendto$inet6(r0, &(0x7f0000000080)="4cfe000012001f15b9409b849ac00a00a5784002000000000000030038c88cc055c5ac27a6c5b068d0bf46d323452536005ad94a461cdbfee9bdb942352359a351d1ec0cffc8792cd8000080", 0x4c, 0x0, 0x0, 0x0) kernel console output (not intermixed with test programs): vl+0xe8/0x150 [ 496.733767][T25997] should_fail_ex+0x412/0x560 [ 496.733791][T25997] should_failslab+0xa8/0x100 [ 496.733811][T25997] ? skb_clone+0x212/0x3a0 [ 496.733835][T25997] kmem_cache_alloc_noprof+0x87/0x650 [ 496.733868][T25997] ? __netlink_lookup+0xc6/0x8b0 [ 496.733908][T25997] skb_clone+0x212/0x3a0 [ 496.733933][T25997] __netlink_deliver_tap+0x404/0x850 [ 496.733964][T25997] ? netlink_deliver_tap+0x2e/0x1b0 [ 496.733984][T25997] netlink_deliver_tap+0x19c/0x1b0 [ 496.734006][T25997] netlink_unicast+0x7e3/0x9b0 [ 496.734032][T25997] ? __pfx_netlink_unicast+0x10/0x10 [ 496.734052][T25997] ? netlink_sendmsg+0x650/0xb40 [ 496.734071][T25997] ? skb_put+0x11b/0x210 [ 496.734095][T25997] netlink_sendmsg+0x813/0xb40 [ 496.734124][T25997] ? __pfx_netlink_sendmsg+0x10/0x10 [ 496.734147][T25997] ? aa_sock_msg_perm+0xf1/0x1b0 [ 496.734170][T25997] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 496.734191][T25997] ? __pfx_netlink_sendmsg+0x10/0x10 [ 496.734210][T25997] ____sys_sendmsg+0xa68/0xad0 [ 496.734246][T25997] ? __pfx_____sys_sendmsg+0x10/0x10 [ 496.734279][T25997] ? import_iovec+0x73/0xa0 [ 496.734305][T25997] ___sys_sendmsg+0x2a5/0x360 [ 496.734335][T25997] ? __pfx____sys_sendmsg+0x10/0x10 [ 496.734391][T25997] ? __fget_files+0x2a/0x420 [ 496.734414][T25997] ? __fget_files+0x3a0/0x420 [ 496.734445][T25997] __x64_sys_sendmsg+0x1bd/0x2a0 [ 496.734472][T25997] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 496.734504][T25997] ? __pfx_ksys_write+0x10/0x10 [ 496.734532][T25997] do_syscall_64+0x14d/0xf80 [ 496.734558][T25997] ? trace_irq_disable+0x3b/0x150 [ 496.734580][T25997] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 496.734597][T25997] ? clear_bhb_loop+0x40/0x90 [ 496.734617][T25997] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 496.734646][T25997] RIP: 0033:0x7f6958d9c629 [ 496.734665][T25997] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 496.734679][T25997] RSP: 002b:00007f6959b7d028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 496.734698][T25997] RAX: ffffffffffffffda RBX: 00007f6959015fa0 RCX: 00007f6958d9c629 [ 496.734711][T25997] RDX: 000000002000c000 RSI: 0000200000000280 RDI: 0000000000000003 [ 496.734722][T25997] RBP: 00007f6959b7d090 R08: 0000000000000000 R09: 0000000000000000 [ 496.734733][T25997] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 496.734743][T25997] R13: 00007f6959016038 R14: 00007f6959015fa0 R15: 00007ffd9afa8a78 [ 496.734769][T25997] [ 497.073079][T25952] chnl_net:caif_netlink_parms(): no params data found [ 497.199825][T25952] bridge0: port 1(bridge_slave_0) entered blocking state [ 497.207077][T25952] bridge0: port 1(bridge_slave_0) entered disabled state [ 497.214673][T25952] bridge_slave_0: entered allmulticast mode [ 497.222330][T25952] bridge_slave_0: entered promiscuous mode [ 497.230651][T25952] bridge0: port 2(bridge_slave_1) entered blocking state [ 497.238045][T25952] bridge0: port 2(bridge_slave_1) entered disabled state [ 497.246335][T25952] bridge_slave_1: entered allmulticast mode [ 497.254187][T25952] bridge_slave_1: entered promiscuous mode [ 497.358642][T26017] bond0: entered promiscuous mode [ 497.384776][T26028] validate_nla: 6 callbacks suppressed [ 497.384796][T26028] netlink: 'syz.2.6005': attribute type 1 has an invalid length. [ 497.397574][T26017] bond_slave_0: entered promiscuous mode [ 497.408557][T26028] x_tables: ip_tables: TCPOPTSTRIP target: only valid in mangle table, not security [ 497.427428][T26026] openvswitch: netlink: Unexpected mask (mask=1040, allowed=10048) [ 497.436927][T26017] bond_slave_1: entered promiscuous mode [ 497.468638][T25952] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 497.502516][T25952] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 497.567724][T25952] team0: Port device team_slave_0 added [ 497.572349][T26035] netlink: 12 bytes leftover after parsing attributes in process `syz.1.6007'. [ 497.582694][T25952] team0: Port device team_slave_1 added [ 497.635738][T25952] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 497.648326][T25952] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 497.684809][T25952] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 497.696110][T26040] netlink: 20 bytes leftover after parsing attributes in process `syz.3.6009'. [ 497.698927][T25952] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 497.713594][T25952] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 497.751681][T25952] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 497.782203][T26048] netlink: 'syz.2.6011': attribute type 16 has an invalid length. [ 497.788669][T26051] netlink: 8 bytes leftover after parsing attributes in process `syz.3.6012'. [ 497.794421][T26048] netlink: 'syz.2.6011': attribute type 17 has an invalid length. [ 497.799268][T26051] netlink: 24 bytes leftover after parsing attributes in process `syz.3.6012'. [ 497.809728][T26048] netlink: 'syz.2.6011': attribute type 5 has an invalid length. [ 497.890758][ T51] Bluetooth: hci0: command tx timeout [ 497.914066][T26051] netlink: 8 bytes leftover after parsing attributes in process `syz.3.6012'. [ 497.922736][T25952] hsr_slave_0: entered promiscuous mode [ 497.923408][T26051] netlink: 24 bytes leftover after parsing attributes in process `syz.3.6012'. [ 497.930457][T25952] hsr_slave_1: entered promiscuous mode [ 497.944314][T25952] debugfs: 'hsr0' already exists in 'hsr' [ 497.950620][T25952] Cannot create hsr debugfs directory [ 497.994543][T26055] netlink: 84 bytes leftover after parsing attributes in process `syz.2.6013'. [ 498.095193][T26051] netlink: 8 bytes leftover after parsing attributes in process `syz.3.6012'. [ 498.101758][T26065] openvswitch: netlink: Unexpected mask (mask=1040, allowed=10048) [ 498.119751][T26051] netlink: 24 bytes leftover after parsing attributes in process `syz.3.6012'. [ 498.272916][T26072] xt_hashlimit: size too large, truncated to 1048576 [ 498.407191][T26081] netlink: 'syz.2.6018': attribute type 1 has an invalid length. [ 498.453809][T25952] netdevsim netdevsim4 netdevsim3 (unregistering): unset [0, 0] type 1 family 0 port 256 - 0 [ 498.464889][T26083] netlink: 'syz.0.6022': attribute type 1 has an invalid length. [ 498.485983][T25952] netdevsim netdevsim4 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 498.643534][T25952] netdevsim netdevsim4 netdevsim2 (unregistering): unset [0, 0] type 1 family 0 port 256 - 0 [ 498.660647][T25952] netdevsim netdevsim4 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 498.685107][T26086] netlink: 'syz.1.6023': attribute type 10 has an invalid length. [ 498.736727][T26089] netlink: 'syz.2.6025': attribute type 64 has an invalid length. [ 498.868923][T25952] netdevsim netdevsim4 netdevsim1 (unregistering): unset [0, 0] type 1 family 0 port 256 - 0 [ 498.882992][T25952] netdevsim netdevsim4 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 498.922023][T26104] openvswitch: netlink: Unexpected mask (mask=1040, allowed=10048) [ 498.940417][ C1] ip6_tunnel: ip6gretap0 xmit: Local address not yet configured! [ 498.972872][T26106] x_tables: unsorted entry at hook 3 [ 499.061991][T25952] batman_adv: batadv0: Removing interface: netdevsim0 [ 499.072841][T25952] netdevsim netdevsim4 netdevsim0 (unregistering): unset [0, 0] type 1 family 0 port 256 - 0 [ 499.084360][T25952] netdevsim netdevsim4 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 499.229625][T26125] batadv_slave_0: entered promiscuous mode [ 499.361400][T26124] batadv_slave_0: left promiscuous mode [ 499.496045][T25952] netdevsim netdevsim4 netdevsim0: renamed from eth0 [ 499.516198][T25952] netdevsim netdevsim4 netdevsim1: renamed from eth1 [ 499.539100][T25952] netdevsim netdevsim4 netdevsim2: renamed from eth2 [ 499.572558][T25952] netdevsim netdevsim4 netdevsim3: renamed from eth3 [ 499.701987][T25952] 8021q: adding VLAN 0 to HW filter on device bond0 [ 499.728629][T25952] 8021q: adding VLAN 0 to HW filter on device team0 [ 499.752199][T17989] bridge0: port 1(bridge_slave_0) entered blocking state [ 499.759502][T17989] bridge0: port 1(bridge_slave_0) entered forwarding state [ 499.792602][T17989] bridge0: port 2(bridge_slave_1) entered blocking state [ 499.799884][T17989] bridge0: port 2(bridge_slave_1) entered forwarding state [ 499.847297][T25952] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 499.971188][ T51] Bluetooth: hci0: command tx timeout [ 500.081151][T26173] bond0: entered promiscuous mode [ 500.086243][T26173] bond_slave_0: entered promiscuous mode [ 500.115554][T26173] bond_slave_1: entered promiscuous mode [ 500.167319][T26182] xt_hashlimit: size too large, truncated to 1048576 [ 500.236613][T26188] netlink: 'syz.0.6054': attribute type 13 has an invalid length. [ 500.408794][T25952] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 500.681473][T25952] veth0_vlan: entered promiscuous mode [ 500.695439][T25952] veth1_vlan: entered promiscuous mode [ 500.795020][T25952] veth0_macvtap: entered promiscuous mode [ 500.815673][T25952] veth1_macvtap: entered promiscuous mode [ 500.843270][T25952] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 500.897697][T25952] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 500.925865][T17988] netdevsim netdevsim4 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 500.954846][T17988] netdevsim netdevsim4 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 500.978960][T17988] netdevsim netdevsim4 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 501.001630][T17988] netdevsim netdevsim4 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 501.023467][T26219] A link change request failed with some changes committed already. Interface xfrm0 may have been left with an inconsistent configuration, please check. [ 501.053275][T26221] IPVS: sync thread started: state = MASTER, mcast_ifn = geneve1, syncid = 0, id = 0 [ 501.213679][T17994] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 501.243322][T17994] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 501.243399][T26228] netlink: 'syz.1.6066': attribute type 10 has an invalid length. [ 501.259783][T26230] FAULT_INJECTION: forcing a failure. [ 501.259783][T26230] name failslab, interval 1, probability 0, space 0, times 0 [ 501.318207][T26230] CPU: 1 UID: 0 PID: 26230 Comm: syz.2.6064 Not tainted syzkaller #0 PREEMPT(full) [ 501.318233][T26230] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 501.318244][T26230] Call Trace: [ 501.318256][T26230] [ 501.318264][T26230] dump_stack_lvl+0xe8/0x150 [ 501.318294][T26230] should_fail_ex+0x412/0x560 [ 501.318320][T26230] should_failslab+0xa8/0x100 [ 501.318343][T26230] __kmalloc_noprof+0xe8/0x760 [ 501.318362][T26230] ? tomoyo_realpath_from_path+0xe3/0x5d0 [ 501.318389][T26230] tomoyo_realpath_from_path+0xe3/0x5d0 [ 501.318421][T26230] ? tomoyo_path_number_perm+0x219/0x630 [ 501.318440][T26230] tomoyo_path_number_perm+0x246/0x630 [ 501.318461][T26230] ? __pfx_tomoyo_path_number_perm+0x10/0x10 [ 501.318482][T26230] ? __lock_acquire+0x6b5/0x2cf0 [ 501.318515][T26230] ? __mutex_unlock_slowpath+0x1bd/0x7d0 [ 501.318561][T26230] ? __fget_files+0x2a/0x420 [ 501.318594][T26230] ? __fget_files+0x2a/0x420 [ 501.318616][T26230] ? __fget_files+0x3a0/0x420 [ 501.318637][T26230] ? __fget_files+0x2a/0x420 [ 501.318663][T26230] security_file_ioctl+0xc3/0x2a0 [ 501.318692][T26230] __se_sys_ioctl+0x47/0x170 [ 501.318713][T26230] do_syscall_64+0x14d/0xf80 [ 501.318737][T26230] ? trace_irq_disable+0x3b/0x150 [ 501.318761][T26230] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 501.318779][T26230] ? clear_bhb_loop+0x40/0x90 [ 501.318800][T26230] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 501.318817][T26230] RIP: 0033:0x7f9482d9c629 [ 501.318834][T26230] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 501.318848][T26230] RSP: 002b:00007f9480fb4028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 501.318867][T26230] RAX: ffffffffffffffda RBX: 00007f9483016180 RCX: 00007f9482d9c629 [ 501.318880][T26230] RDX: 0000200000000180 RSI: 0000000000008953 RDI: 0000000000000007 [ 501.318891][T26230] RBP: 00007f9480fb4090 R08: 0000000000000000 R09: 0000000000000000 [ 501.318902][T26230] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 501.318913][T26230] R13: 00007f9483016218 R14: 00007f9483016180 R15: 00007fff19534048 [ 501.318943][T26230] [ 501.319028][T26230] ERROR: Out of memory at tomoyo_realpath_from_path. [ 501.332468][T17994] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 501.513339][ T1299] lec:lec_start_xmit: lec0:No lecd attached [ 501.535096][T17994] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 501.584200][T26229] syzkaller0: entered promiscuous mode [ 501.591407][T26229] syzkaller0: entered allmulticast mode [ 501.673223][T26239] xt_hashlimit: size too large, truncated to 1048576 [ 501.887648][T26245] openvswitch: netlink: Unexpected mask (mask=1040, allowed=10048) [ 502.053054][ T51] Bluetooth: hci0: command tx timeout [ 502.174223][T26261] FAULT_INJECTION: forcing a failure. [ 502.174223][T26261] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 502.190916][T26261] CPU: 1 UID: 0 PID: 26261 Comm: syz.2.6076 Not tainted syzkaller #0 PREEMPT(full) [ 502.190938][T26261] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 502.190947][T26261] Call Trace: [ 502.190954][T26261] [ 502.190961][T26261] dump_stack_lvl+0xe8/0x150 [ 502.190987][T26261] should_fail_ex+0x412/0x560 [ 502.191008][T26261] _copy_from_user+0x2d/0xb0 [ 502.191028][T26261] sctp_getsockopt_primary_addr+0x107/0x5f0 [ 502.191049][T26261] ? __pfx_sctp_getsockopt_primary_addr+0x10/0x10 [ 502.191082][T26261] ? sctp_getsockopt+0x12f/0xb90 [ 502.191106][T26261] ? __local_bh_enable_ip+0xd0/0x130 [ 502.191131][T26261] sctp_getsockopt+0x910/0xb90 [ 502.191151][T26261] ? __pfx_sock_common_getsockopt+0x10/0x10 [ 502.191172][T26261] do_sock_getsockopt+0x2d3/0x3f0 [ 502.191197][T26261] ? __pfx_do_sock_getsockopt+0x10/0x10 [ 502.191217][T26261] ? __fget_files+0x3a0/0x420 [ 502.191237][T26261] ? __fget_files+0x2a/0x420 [ 502.191262][T26261] __x64_sys_getsockopt+0x1a4/0x240 [ 502.191291][T26261] do_syscall_64+0x14d/0xf80 [ 502.191313][T26261] ? trace_irq_disable+0x3b/0x150 [ 502.191335][T26261] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 502.191353][T26261] ? clear_bhb_loop+0x40/0x90 [ 502.191374][T26261] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 502.191392][T26261] RIP: 0033:0x7f9482d9c629 [ 502.191409][T26261] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 502.191423][T26261] RSP: 002b:00007f9480ff6028 EFLAGS: 00000246 ORIG_RAX: 0000000000000037 [ 502.191442][T26261] RAX: ffffffffffffffda RBX: 00007f9483015fa0 RCX: 00007f9482d9c629 [ 502.191455][T26261] RDX: 0000000000000006 RSI: 0000000000000084 RDI: 0000000000000003 [ 502.191465][T26261] RBP: 00007f9480ff6090 R08: 0000200000000240 R09: 0000000000000000 [ 502.191477][T26261] R10: 0000200000000080 R11: 0000000000000246 R12: 0000000000000001 [ 502.191486][T26261] R13: 00007f9483016038 R14: 00007f9483015fa0 R15: 00007fff19534048 [ 502.191513][T26261] [ 502.441112][T26265] __nla_validate_parse: 17 callbacks suppressed [ 502.441132][T26265] netlink: 12 bytes leftover after parsing attributes in process `syz.3.6078'. [ 502.524182][T26270] netlink: 28 bytes leftover after parsing attributes in process `syz.0.6080'. [ 502.533667][T26270] netlink: 28 bytes leftover after parsing attributes in process `syz.0.6080'. [ 502.711780][T26279] netlink: 12 bytes leftover after parsing attributes in process `syz.3.6085'. [ 502.741615][T26284] syzkaller0: entered promiscuous mode [ 502.747220][T26284] syzkaller0: entered allmulticast mode [ 502.884745][T26291] validate_nla: 3 callbacks suppressed [ 502.884764][T26291] netlink: 'syz.0.6088': attribute type 10 has an invalid length. [ 502.925908][T26291] mac80211_hwsim hwsim51 wlan1: entered promiscuous mode [ 502.934021][T26291] bond0: (slave wlan1): Enslaving as an active interface with an up link [ 503.130586][T26305] netlink: 28 bytes leftover after parsing attributes in process `syz.4.6093'. [ 503.139826][T26305] netlink: 28 bytes leftover after parsing attributes in process `syz.4.6093'. [ 503.226520][T26309] netlink: 4 bytes leftover after parsing attributes in process `syz.4.6095'. [ 503.726973][T26316] netlink: 36 bytes leftover after parsing attributes in process `syz.4.6098'. [ 503.738971][T26316] netlink: 300 bytes leftover after parsing attributes in process `syz.4.6098'. [ 503.751288][T26316] Bluetooth: MGMT ver 1.23 [ 503.757850][T26316] bond0: entered promiscuous mode [ 503.763150][T26316] bond_slave_0: entered promiscuous mode [ 503.768900][T26316] bond_slave_1: entered promiscuous mode [ 503.809690][T26318] netlink: 212328 bytes leftover after parsing attributes in process `syz.4.6099'. [ 503.819177][T26318] netlink: Unknown conntrack attr (type=2304, max=9) [ 504.129808][ T51] Bluetooth: hci0: command tx timeout [ 504.230830][T26326] sctp: [Deprecated]: syz.4.6102 (pid 26326) Use of struct sctp_assoc_value in delayed_ack socket option. [ 504.230830][T26326] Use struct sctp_sack_info instead [ 505.641391][T26279] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 505.711966][T26329] Cannot find set identified by id 1 to match [ 505.864631][T26341] Cannot find del_set index 65531 as target [ 506.090449][T26351] netlink: 'syz.2.6112': attribute type 10 has an invalid length. [ 506.447445][T26352] syzkaller0: entered promiscuous mode [ 506.461544][T26352] syzkaller0: entered allmulticast mode [ 506.593897][T26360] netlink: 'syz.4.6115': attribute type 5 has an invalid length. [ 506.602238][T26365] netlink: 'syz.4.6115': attribute type 5 has an invalid length. [ 506.657438][T17995] netdevsim netdevsim4 netdevsim0: set [0, 0] type 1 family 0 port 8472 - 0 [ 506.695150][T17995] netdevsim netdevsim4 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0 [ 506.734400][T17995] netdevsim netdevsim4 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0 [ 506.746498][T26376] Cannot find set identified by id 1 to match [ 506.765875][T17995] netdevsim netdevsim4 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0 [ 506.939474][ C0] lec0: NETDEV WATCHDOG: CPU: 0: transmit queue 0 timed out 5410 ms [ 506.942697][T26377] bond4: Invalid ad_actor_system MAC address. [ 506.947504][ C0] lec:lec_tx_timeout: lec0 [ 506.958114][T26377] bond4: option ad_actor_system: invalid value (1) [ 506.997365][T26377] bond4 (unregistering): Released all slaves [ 507.085735][T26402] x_tables: unsorted entry at hook 3 [ 507.138520][T26403] netlink: 'syz.2.6125': attribute type 10 has an invalid length. [ 507.205885][T26407] netlink: 'syz.0.6127': attribute type 32 has an invalid length. [ 507.304223][T26415] RDS: rds_bind could not find a transport for fe80::, load rds_tcp or rds_rdma? [ 507.323665][T26413] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 507.342225][T26419] netdevsim netdevsim3: Direct firmware load for .. failed with error -2 [ 507.359631][T26419] netdevsim netdevsim3: Falling back to sysfs fallback for: .. [ 507.467739][T26425] __nla_validate_parse: 6 callbacks suppressed [ 507.467758][T26425] netlink: 4 bytes leftover after parsing attributes in process `syz.2.6134'. [ 507.543940][T26435] x_tables: unsorted entry at hook 3 [ 507.659414][T26442] netlink: 'syz.0.6140': attribute type 10 has an invalid length. [ 507.678951][T26444] netlink: 8 bytes leftover after parsing attributes in process `syz.2.6141'. [ 507.711604][T26442] bond0: (slave wlan1): Releasing backup interface [ 507.720694][T26442] mac80211_hwsim hwsim51 wlan1: left promiscuous mode [ 507.790659][T26451] netlink: 12 bytes leftover after parsing attributes in process `syz.0.6144'. [ 507.867346][T26458] openvswitch: netlink: IP tunnel dst address not specified [ 507.954464][T26462] veth9: entered allmulticast mode [ 507.982287][T26464] Cannot find del_set index 65531 as target [ 508.238900][T26482] xt_hashlimit: size too large, truncated to 1048576 [ 508.241645][T26480] netlink: 'syz.2.6157': attribute type 10 has an invalid length. [ 508.257365][T26480] mac80211_hwsim hwsim49 wlan1: entered promiscuous mode [ 508.270132][T26480] mac80211_hwsim hwsim49 wlan1: entered allmulticast mode [ 508.277941][T26480] bond0: (slave wlan1): Enslaving as an active interface with an up link [ 508.721898][T26514] netlink: 108 bytes leftover after parsing attributes in process `syz.0.6169'. [ 508.732486][T26514] netlink: 8 bytes leftover after parsing attributes in process `syz.0.6169'. [ 509.148195][T26530] openvswitch: netlink: Key 2 has unexpected len 8 expected 4 [ 509.313838][T26535] netlink: 52 bytes leftover after parsing attributes in process `syz.1.6175'. [ 509.337804][T26535] netlink: 12 bytes leftover after parsing attributes in process `syz.1.6175'. [ 509.347661][T26535] netlink: 52 bytes leftover after parsing attributes in process `syz.1.6175'. [ 509.357613][T26535] netlink: 12 bytes leftover after parsing attributes in process `syz.1.6175'. [ 509.366997][T26535] netlink: 52 bytes leftover after parsing attributes in process `syz.1.6175'. [ 509.536471][T26546] netlink: 'syz.4.6174': attribute type 3 has an invalid length. [ 510.864844][T26566] xt_hashlimit: size too large, truncated to 1048576 [ 511.111136][T26582] netlink: 'syz.4.6184': attribute type 10 has an invalid length. [ 511.164832][T26582] mac80211_hwsim hwsim53 wlan1: entered promiscuous mode [ 511.183751][T26582] bond0: (slave wlan1): Enslaving as an active interface with an up link [ 511.257786][T26591] Cannot find add_set index 0 as target [ 511.347807][T26600] FAULT_INJECTION: forcing a failure. [ 511.347807][T26600] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 511.441793][T26600] CPU: 1 UID: 0 PID: 26600 Comm: syz.1.6187 Not tainted syzkaller #0 PREEMPT(full) [ 511.441820][T26600] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 511.441831][T26600] Call Trace: [ 511.441838][T26600] [ 511.441846][T26600] dump_stack_lvl+0xe8/0x150 [ 511.441876][T26600] should_fail_ex+0x412/0x560 [ 511.441906][T26600] _copy_to_user+0x31/0xb0 [ 511.441933][T26600] simple_read_from_buffer+0xe1/0x170 [ 511.441962][T26600] proc_fail_nth_read+0x1bb/0x230 [ 511.441989][T26600] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 511.442015][T26600] ? rw_verify_area+0x2a6/0x4d0 [ 511.442033][T26600] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 511.442057][T26600] vfs_read+0x20c/0xa70 [ 511.442073][T26600] ? fdget_pos+0x246/0x320 [ 511.442102][T26600] ? __pfx___mutex_lock+0x10/0x10 [ 511.442121][T26600] ? __pfx_vfs_read+0x10/0x10 [ 511.442140][T26600] ? __fget_files+0x2a/0x420 [ 511.442167][T26600] ? __fget_files+0x3a0/0x420 [ 511.442189][T26600] ? __fget_files+0x2a/0x420 [ 511.442221][T26600] ksys_read+0x150/0x270 [ 511.442241][T26600] ? __pfx_ksys_read+0x10/0x10 [ 511.442258][T26600] ? __pfx_sock_ioctl+0x10/0x10 [ 511.442286][T26600] do_syscall_64+0x14d/0xf80 [ 511.442311][T26600] ? trace_irq_disable+0x3b/0x150 [ 511.442335][T26600] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 511.442353][T26600] ? clear_bhb_loop+0x40/0x90 [ 511.442376][T26600] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 511.442393][T26600] RIP: 0033:0x7f0cca95cece [ 511.442410][T26600] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 511.442426][T26600] RSP: 002b:00007f0ccb8f9fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 511.442445][T26600] RAX: ffffffffffffffda RBX: 00007f0ccb8fa6c0 RCX: 00007f0cca95cece [ 511.442459][T26600] RDX: 000000000000000f RSI: 00007f0ccb8fa0a0 RDI: 0000000000000008 [ 511.442470][T26600] RBP: 00007f0ccb8fa090 R08: 0000000000000000 R09: 0000000000000000 [ 511.442482][T26600] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 511.442493][T26600] R13: 00007f0ccac16218 R14: 00007f0ccac16180 R15: 00007ffd36757408 [ 511.442524][T26600] [ 511.932424][T26625] xt_hashlimit: size too large, truncated to 1048576 [ 512.197203][T26643] netlink: 'syz.4.6207': attribute type 10 has an invalid length. [ 512.303372][T26648] Cannot find set identified by id 1 to match [ 512.489656][T26660] xt_hashlimit: size too large, truncated to 1048576 [ 512.682267][T26676] __nla_validate_parse: 1 callbacks suppressed [ 512.682287][T26676] netlink: 12 bytes leftover after parsing attributes in process `syz.2.6219'. [ 512.741064][ T5960] netdevsim netdevsim2 netdevsim0: set [1, 1] type 2 family 0 port 20028 - 0 [ 512.750062][ T5960] netdevsim netdevsim2 netdevsim1: set [1, 1] type 2 family 0 port 20028 - 0 [ 512.782714][ T5960] netdevsim netdevsim2 netdevsim2: set [1, 1] type 2 family 0 port 20028 - 0 [ 512.804620][ T5960] netdevsim netdevsim2 netdevsim3: set [1, 1] type 2 family 0 port 20028 - 0 [ 512.836375][T26679] syzkaller0: entered promiscuous mode [ 512.842641][T26679] syzkaller0: entered allmulticast mode [ 512.867912][T26686] xt_hashlimit: size too large, truncated to 1048576 [ 512.956875][T26694] netlink: 12 bytes leftover after parsing attributes in process `syz.2.6225'. [ 513.107370][T26704] netlink: 40 bytes leftover after parsing attributes in process `syz.3.6228'. [ 513.126311][T26704] sctp: [Deprecated]: syz.3.6228 (pid 26704) Use of int in max_burst socket option. [ 513.126311][T26704] Use struct sctp_assoc_value instead [ 513.200902][T26713] openvswitch: netlink: Unexpected mask (mask=1040, allowed=10048) [ 513.269614][T26715] syzkaller0: entered promiscuous mode [ 513.275379][T26715] syzkaller0: entered allmulticast mode [ 513.284477][T26715] "syz.4.6232" (26715) uses obsolete ecb(arc4) skcipher [ 513.519157][T26728] veth0_to_bridge: vlans aren't supported yet for dev_uc|mc_add() [ 513.560896][T26731] Cannot find del_set index 65531 as target [ 513.644898][T26733] xt_SECMARK: only valid in 'mangle' or 'security' table, not 'raw' [ 513.926729][T26702] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 514.362441][T26766] netlink: 'syz.3.6251': attribute type 10 has an invalid length. [ 514.574757][T26780] xt_hashlimit: size too large, truncated to 1048576 [ 514.654510][T26787] netlink: 'syz.4.6260': attribute type 29 has an invalid length. [ 514.689106][T26787] netlink: 'syz.4.6260': attribute type 29 has an invalid length. [ 514.713858][T26790] netlink: 'syz.4.6260': attribute type 29 has an invalid length. [ 514.730205][T26787] netlink: 'syz.4.6260': attribute type 29 has an invalid length. [ 514.738742][T26790] netlink: 'syz.4.6260': attribute type 29 has an invalid length. [ 514.747548][T26790] netlink: 'syz.4.6260': attribute type 29 has an invalid length. [ 514.774515][T26798] Cannot find del_set index 65531 as target [ 514.947600][T26812] x_tables: unsorted entry at hook 3 [ 514.984006][T26808] netlink: 43 bytes leftover after parsing attributes in process `syz.1.6264'. [ 515.180347][T26825] openvswitch: netlink: ufid size 17 bytes exceeds the range (1, 16) [ 515.194200][T26825] openvswitch: netlink: Flow get message rejected, Key attribute missing. [ 515.314865][T26839] netlink: 28 bytes leftover after parsing attributes in process `syz.2.6272'. [ 515.332630][T26830] syzkaller0: entered promiscuous mode [ 515.338715][T26830] syzkaller0: entered allmulticast mode [ 515.346443][T26841] Cannot find del_set index 65531 as target [ 515.542438][T26851] x_tables: unsorted entry at hook 3 [ 515.676972][T26862] netlink: 8 bytes leftover after parsing attributes in process `syz.0.6281'. [ 515.894910][T26876] xt_hashlimit: overflow, try lower: 3/0 [ 515.912928][T26881] x_tables: unsorted entry at hook 3 [ 515.958494][T26885] xt_hashlimit: size too large, truncated to 1048576 [ 516.226212][T26903] netlink: 212368 bytes leftover after parsing attributes in process `syz.2.6303'. [ 516.258426][T26905] netlink: 212368 bytes leftover after parsing attributes in process `syz.2.6303'. [ 516.263943][T26904] macvtap1: entered promiscuous mode [ 516.299742][T26904] macvtap1: entered allmulticast mode [ 516.305987][T26904] veth1_vlan: entered allmulticast mode [ 516.345680][T26902] macvtap2: entered promiscuous mode [ 516.367416][T26902] macvtap2: entered allmulticast mode [ 517.241535][T26958] Cannot find del_set index 65531 as target [ 517.338294][T26963] netlink: 'syz.3.6323': attribute type 5 has an invalid length. [ 517.447496][T26970] xt_hashlimit: size too large, truncated to 1048576 [ 517.448085][T26968] netlink: 'syz.1.6324': attribute type 1 has an invalid length. [ 517.504061][T26968] netlink: 184 bytes leftover after parsing attributes in process `syz.1.6324'. [ 517.526668][T26968] netlink: 'syz.1.6324': attribute type 1 has an invalid length. [ 517.548069][T26968] netlink: 12 bytes leftover after parsing attributes in process `syz.1.6324'. [ 517.720962][T26983] netlink: 8 bytes leftover after parsing attributes in process `syz.2.6329'. [ 517.722282][T26981] netlink: 12 bytes leftover after parsing attributes in process `syz.3.6328'. [ 517.733691][T26983] netlink: 24 bytes leftover after parsing attributes in process `syz.2.6329'. [ 517.829828][T26981] netlink: 12 bytes leftover after parsing attributes in process `syz.3.6328'. [ 518.060097][T26996] x_tables: unsorted entry at hook 3 [ 518.148116][T26998] netlink: 4 bytes leftover after parsing attributes in process `syz.0.6334'. [ 518.255574][T26998] netlink: 28 bytes leftover after parsing attributes in process `syz.0.6334'. [ 518.310044][T27003] netlink: 60 bytes leftover after parsing attributes in process `syz.2.6337'. [ 518.328630][T27003] netlink: 60 bytes leftover after parsing attributes in process `syz.2.6337'. [ 518.380949][T27009] xt_hashlimit: size too large, truncated to 1048576 [ 518.550010][T27029] xt_CT: You must specify a L4 protocol and not use inversions on it [ 518.561957][T27027] xt_CT: You must specify a L4 protocol and not use inversions on it [ 518.637882][T27033] netlink: 28 bytes leftover after parsing attributes in process `syz.0.6345'. [ 518.670404][T27033] netlink: 28 bytes leftover after parsing attributes in process `syz.0.6345'. [ 518.763724][T27034] bond1 (unregistering): Released all slaves [ 518.986969][T27052] xt_hashlimit: size too large, truncated to 1048576 [ 519.254590][T27063] veth0_to_bridge: vlans aren't supported yet for dev_uc|mc_add() [ 519.282677][T27065] xt_hashlimit: size too large, truncated to 1048576 [ 519.491963][T27080] xt_ipcomp: unknown flags 1D [ 519.607872][T27085] validate_nla: 2 callbacks suppressed [ 519.607891][T27085] netlink: 'syz.1.6366': attribute type 24 has an invalid length. [ 519.670707][T11524] lec:lec_start_xmit: lec0:No lecd attached [ 519.835734][T27093] netlink: 'syz.1.6370': attribute type 1 has an invalid length. [ 519.848453][T27093] netlink: 'syz.1.6370': attribute type 4 has an invalid length. [ 519.914138][T27102] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 519.924865][T27102] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 519.935976][T27102] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 519.945880][T27102] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 519.955535][T27102] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 520.005215][T27093] bond4: peer notification delay (1164) is not a multiple of miimon (100), value rounded to 1100 ms [ 520.024855][T27093] bond4: entered promiscuous mode [ 520.041467][T27093] bond4: entered allmulticast mode [ 520.058111][T27093] 8021q: adding VLAN 0 to HW filter on device bond4 [ 520.110313][T27109] syzkaller0: entered promiscuous mode [ 520.116026][T27109] syzkaller0: entered allmulticast mode [ 521.940757][T17989] netdevsim netdevsim3 netdevsim3 (unregistering): unset [0, 0] type 1 family 0 port 2816 - 0 [ 521.965237][T17989] netdevsim netdevsim3 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 522.062648][T27102] Bluetooth: hci1: command tx timeout [ 522.182520][T17989] netdevsim netdevsim3 netdevsim2 (unregistering): unset [0, 0] type 1 family 0 port 2816 - 0 [ 522.208605][T17989] netdevsim netdevsim3 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 522.347386][T17989] netdevsim netdevsim3 netdevsim1 (unregistering): unset [0, 0] type 1 family 0 port 2816 - 0 [ 522.357863][T17989] netdevsim netdevsim3 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 522.440853][T17989] netdevsim netdevsim3 netdevsim0 (unregistering): unset [0, 0] type 1 family 0 port 2816 - 0 [ 522.467730][T17989] netdevsim netdevsim3 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 522.511921][T27150] syzkaller0: entered promiscuous mode [ 522.517445][T27150] syzkaller0: entered allmulticast mode [ 522.713340][T27156] syzkaller0: entered promiscuous mode [ 522.718862][T27156] syzkaller0: entered allmulticast mode [ 522.812841][T27177] Can not set IPV6_FL_F_REFLECT if flowlabel_consistency sysctl is enable [ 522.831138][T27172] IPv6: sit1: Disabled Multicast RS [ 522.837337][T27172] sit1: entered allmulticast mode [ 522.865153][T27174] lo: Caught tx_queue_len zero misconfig [ 522.969894][T17988] nci: nci_rx_work: unknown MT 0x1 [ 524.140571][T27102] Bluetooth: hci1: command tx timeout [ 524.663030][T27101] chnl_net:caif_netlink_parms(): no params data found [ 524.744458][T17989] x9: left allmulticast mode [ 524.750936][T17989] x9: left promiscuous mode [ 524.757643][T17989] bridge0: port 1(1x9) entered disabled state [ 524.929535][ C0] lec0: NETDEV WATCHDOG: CPU: 0: transmit queue 0 timed out 5260 ms [ 524.937789][ C0] lec:lec_tx_timeout: lec0 [ 525.011632][T17989] bond0 (unregistering): (slave bridge0): Releasing backup interface [ 525.020869][T17989] bridge0 (unregistering): left promiscuous mode [ 525.027218][T17989] bridge0 (unregistering): left allmulticast mode [ 525.184774][T17989] bond3 (unregistering): (slave bridge3): Releasing backup interface [ 525.404545][T17989] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 525.414011][T17989] bond_slave_0: left promiscuous mode [ 525.419640][T17989] bond_slave_0: left allmulticast mode [ 525.426856][T17989] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 525.436814][T17989] bond_slave_1: left promiscuous mode [ 525.443688][T17989] bond_slave_1: left allmulticast mode [ 525.450451][T17989] bond0 (unregistering): Released all slaves [ 525.461348][T17989] bond1 (unregistering): (slave lo): Releasing backup interface [ 525.469365][T17989] bond1 (unregistering): (slave lo): last VLAN challenged slave left bond - VLAN blocking is removed [ 525.483452][T17989] bond1 (unregistering): Released all slaves [ 525.498895][T17989] bond2 (unregistering): Released all slaves [ 525.515028][T17989] bond3 (unregistering): Released all slaves [ 525.528347][T17989] bond4 (unregistering): Released all slaves [ 525.555955][T17989] bond5 (unregistering): Released all slaves [ 525.572427][T17989] bond6 (unregistering): Released all slaves [ 525.585278][T17989] bond7 (unregistering): Released all slaves [ 525.598260][T17989] bond8 (unregistering): Released all slaves [ 525.652438][T27101] bridge0: port 1(bridge_slave_0) entered blocking state [ 525.663436][T27101] bridge0: port 1(bridge_slave_0) entered disabled state [ 525.671763][T27101] bridge_slave_0: entered allmulticast mode [ 525.680076][T27101] bridge_slave_0: entered promiscuous mode [ 525.717591][T27101] bridge0: port 2(bridge_slave_1) entered blocking state [ 525.733729][T27101] bridge0: port 2(bridge_slave_1) entered disabled state [ 525.742678][T27101] bridge_slave_1: entered allmulticast mode [ 525.758837][T27101] bridge_slave_1: entered promiscuous mode [ 525.792111][T17989] tipc: Left network mode [ 525.860177][T17989] IPVS: stopping master sync thread 21581 ... [ 525.868766][T27180] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 525.968916][T27101] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 526.027625][T27101] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 526.123868][T27243] netlink: 'syz.2.6408': attribute type 1 has an invalid length. [ 526.155907][T27243] __nla_validate_parse: 10 callbacks suppressed [ 526.155924][T27243] netlink: 476 bytes leftover after parsing attributes in process `syz.2.6408'. [ 526.190473][T27243] netlink: 1041 bytes leftover after parsing attributes in process `syz.2.6408'. [ 526.211431][T27102] Bluetooth: hci1: command tx timeout [ 526.239257][T27101] team0: Port device team_slave_0 added [ 526.267150][T27101] team0: Port device team_slave_1 added [ 526.445333][T27249] veth1_vlan (unregistering): left allmulticast mode [ 526.675309][T27262] netlink: 'syz.4.6415': attribute type 15 has an invalid length. [ 526.688912][T27262] netlink: 4 bytes leftover after parsing attributes in process `syz.4.6415'. [ 526.724190][T27262] netlink: 'syz.4.6415': attribute type 15 has an invalid length. [ 526.734244][T27101] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 526.749926][T27262] netlink: 4 bytes leftover after parsing attributes in process `syz.4.6415'. [ 526.752870][T27101] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 526.789005][T27101] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 526.834743][T27101] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 526.850666][T27101] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 526.926493][T27101] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 527.043386][T27279] netlink: 12 bytes leftover after parsing attributes in process `syz.4.6418'. [ 527.075209][T27287] ip6t_srh: unknown srh invflags 4000 [ 527.191105][T27290] netlink: 124 bytes leftover after parsing attributes in process `syz.2.6420'. [ 527.221672][T27101] hsr_slave_0: entered promiscuous mode [ 527.228752][T27101] hsr_slave_1: entered promiscuous mode [ 527.247180][T27101] debugfs: 'hsr0' already exists in 'hsr' [ 527.261471][T27101] Cannot create hsr debugfs directory [ 527.313011][T27294] Cannot find set identified by id 1 to match [ 527.568453][T27306] tipc: Enabling of bearer rejected, failed to enable media [ 527.690290][T27310] syz_tun: entered allmulticast mode [ 527.829364][T27310] pimreg: entered allmulticast mode [ 527.880285][T17989] hsr_slave_0: left promiscuous mode [ 527.898845][T17989] hsr_slave_1: left promiscuous mode [ 527.909317][T17989] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 527.926285][T17989] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 527.936492][T17989] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 527.954530][T17989] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 527.985603][T17989] veth1_macvtap: left promiscuous mode [ 527.992973][T17989] veth0_macvtap: left promiscuous mode [ 528.001281][T17989] veth1_vlan: left promiscuous mode [ 528.006799][T17989] veth0_vlan: left promiscuous mode [ 528.220901][T17995] smc: removing ib device  [ 528.289778][T27102] Bluetooth: hci1: command tx timeout [ 528.376379][T17989] team0 (unregistering): Port device team_slave_1 removed [ 528.398748][T17989] team0 (unregistering): Port device team_slave_0 removed [ 528.521527][T27307] syz_tun: left allmulticast mode [ 528.690926][T27351] x_tables: ip_tables: TPROXY target: used from hooks FORWARD, but only usable from PREROUTING [ 528.728430][T27356] netlink: 32 bytes leftover after parsing attributes in process `syz.1.6434'. [ 529.547467][T27377] netdevsim netdevsim4 netdevsim3 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 529.562226][T27377] netdevsim netdevsim4 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 529.570579][T27394] Cannot find set identified by id 1 to match [ 529.626621][T27380] kthread_run failed with err -4 [ 529.915716][T27377] netdevsim netdevsim4 netdevsim2 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 529.951920][T27377] netdevsim netdevsim4 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 529.973972][T27404] netlink: 12 bytes leftover after parsing attributes in process `syz.0.6450'. [ 530.214621][T27377] netdevsim netdevsim4 netdevsim1 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 530.246946][T27377] netdevsim netdevsim4 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 530.415913][T27432] netlink: 4 bytes leftover after parsing attributes in process `syz.1.6454'. [ 530.452184][T27430] netlink: 12 bytes leftover after parsing attributes in process `syz.0.6455'. [ 530.530650][T27440] x_tables: unsorted entry at hook 3 [ 530.642835][T27377] netdevsim netdevsim4 netdevsim0 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 530.657655][T27377] netdevsim netdevsim4 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 530.683162][T27442] xt_hashlimit: size too large, truncated to 1048576 [ 530.940436][ C1] ip6_tunnel: ip6gretap0 xmit: Local address not yet configured! [ 530.982939][T27101] netdevsim netdevsim3 netdevsim0: renamed from eth0 [ 531.153928][T17988] netdevsim netdevsim4 eth0: set [0, 0] type 1 family 0 port 8472 - 0 [ 531.174235][T17988] netdevsim netdevsim4 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 531.204795][T27101] netdevsim netdevsim3 netdevsim1: renamed from eth1 [ 531.336526][T27101] netdevsim netdevsim3 netdevsim2: renamed from eth2 [ 531.350948][T17981] netdevsim netdevsim4 eth1: set [0, 0] type 1 family 0 port 8472 - 0 [ 531.363634][T27462] netlink: 60 bytes leftover after parsing attributes in process `syz.1.6465'. [ 531.366099][T27463] netlink: 60 bytes leftover after parsing attributes in process `syz.2.6464'. [ 531.373061][T17981] netdevsim netdevsim4 eth1: set [1, 0] type 2 family 0 port 6081 - 0 [ 531.398636][T17989] IPVS: stop unused estimator thread 0... [ 531.412361][T27101] netdevsim netdevsim3 netdevsim3: renamed from eth3 [ 531.455171][T17983] netdevsim netdevsim4 eth2: set [0, 0] type 1 family 0 port 8472 - 0 [ 531.470732][T17983] netdevsim netdevsim4 eth2: set [1, 0] type 2 family 0 port 6081 - 0 [ 531.515147][T17988] netdevsim netdevsim4 eth3: set [0, 0] type 1 family 0 port 8472 - 0 [ 531.524894][T27469] netlink: 12 bytes leftover after parsing attributes in process `syz.2.6467'. [ 531.540694][T17988] netdevsim netdevsim4 eth3: set [1, 0] type 2 family 0 port 6081 - 0 [ 531.602048][T27474] xt_hashlimit: size too large, truncated to 1048576 [ 531.818826][T27101] 8021q: adding VLAN 0 to HW filter on device bond0 [ 531.919981][T27101] 8021q: adding VLAN 0 to HW filter on device team0 [ 531.957363][T17988] bridge0: port 1(bridge_slave_0) entered blocking state [ 531.964585][T17988] bridge0: port 1(bridge_slave_0) entered forwarding state [ 532.017485][T17988] bridge0: port 2(bridge_slave_1) entered blocking state [ 532.024795][T17988] bridge0: port 2(bridge_slave_1) entered forwarding state [ 532.177416][T27516] netlink: 'syz.0.6478': attribute type 3 has an invalid length. [ 532.213658][T27516] netlink: 666 bytes leftover after parsing attributes in process `syz.0.6478'. [ 532.331883][T27526] Cannot find del_set index 65531 as target [ 532.566089][T27546] gre1: entered promiscuous mode [ 532.589526][T27546] gre1: entered allmulticast mode [ 532.689109][T27101] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 532.754465][T27550] tipc: Started in network mode [ 532.782303][T27550] tipc: Node identity aa87088916ab, cluster identity 4711 [ 532.801808][T27550] tipc: Enabled bearer , priority 0 [ 532.827591][T27561] netlink: 60 bytes leftover after parsing attributes in process `syz.4.6492'. [ 532.861964][T27550] +: renamed from syzkaller0 [ 532.871595][T27550] tipc: Disabling bearer [ 532.992844][T27101] veth0_vlan: entered promiscuous mode [ 533.029120][T27101] veth1_vlan: entered promiscuous mode [ 533.124553][T27101] veth0_macvtap: entered promiscuous mode [ 533.153880][T27101] veth1_macvtap: entered promiscuous mode [ 533.205178][T27101] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 533.236180][T27101] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 533.263298][T17988] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 533.270408][T27584] x_tables: unsorted entry at hook 3 [ 533.294716][T17988] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 533.327254][T27583] netlink: 256 bytes leftover after parsing attributes in process `syz.0.6496'. [ 533.338044][T17988] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 533.374291][T17988] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 533.478253][T27595] netlink: 16 bytes leftover after parsing attributes in process `syz.2.6500'. [ 533.543917][T27591] syzkaller0: entered promiscuous mode [ 533.563402][T27591] syzkaller0: entered allmulticast mode [ 533.870713][T17994] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 533.878574][T17994] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 533.999941][T27618] netlink: 60 bytes leftover after parsing attributes in process `syz.0.6504'. [ 534.007815][T17989] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 534.017765][T17989] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 534.065815][T27620] netdevsim netdevsim2 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 534.080796][T27620] netdevsim netdevsim2 netdevsim3 (unregistering): unset [1, 1] type 2 family 0 port 20028 - 0 [ 534.231493][T27620] netdevsim netdevsim2 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 534.256068][T27620] netdevsim netdevsim2 netdevsim2 (unregistering): unset [1, 1] type 2 family 0 port 20028 - 0 [ 534.296194][T27632] netlink: 16 bytes leftover after parsing attributes in process `syz.0.6507'. [ 534.393428][T27620] netdevsim netdevsim2 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 534.414471][T27620] netdevsim netdevsim2 netdevsim1 (unregistering): unset [1, 1] type 2 family 0 port 20028 - 0 [ 534.491786][T27643] 8021q: adding VLAN 0 to HW filter on device ipvlan0 [ 534.510914][T27643] bond0: (slave ipvlan0): enslaved VLAN challenged slave. Adding VLANs will be blocked as long as it is part of bond. [ 534.516827][T27648] netlink: 'syz.3.6510': attribute type 83 has an invalid length. [ 534.539908][T27646] netlink: 36 bytes leftover after parsing attributes in process `syz.0.6509'. [ 534.571356][T27645] 8021q: adding VLAN 0 to HW filter on device ipvlan0 [ 534.593988][T27645] bond0: (slave ipvlan0): enslaved VLAN challenged slave. Adding VLANs will be blocked as long as it is part of bond. [ 534.659092][T27620] netdevsim netdevsim2 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 534.671574][T27620] netdevsim netdevsim2 netdevsim0 (unregistering): unset [1, 1] type 2 family 0 port 20028 - 0 [ 534.934395][T27665] Cannot find del_set index 65531 as target [ 535.047847][T17988] netdevsim netdevsim2 eth0: set [1, 0] type 2 family 0 port 20028 - 0 [ 535.069074][T17988] netdevsim netdevsim2 eth0: set [1, 1] type 2 family 0 port 6081 - 0 [ 535.120275][T17989] netdevsim netdevsim2 eth1: set [1, 0] type 2 family 0 port 20028 - 0 [ 535.144447][T17989] netdevsim netdevsim2 eth1: set [1, 1] type 2 family 0 port 6081 - 0 [ 535.207897][T27683] netlink: 'syz.4.6518': attribute type 4 has an invalid length. [ 535.222070][T17989] netdevsim netdevsim2 eth2: set [1, 0] type 2 family 0 port 20028 - 0 [ 535.238675][T17989] netdevsim netdevsim2 eth2: set [1, 1] type 2 family 0 port 6081 - 0 [ 535.311235][T17989] netdevsim netdevsim2 eth3: set [1, 0] type 2 family 0 port 20028 - 0 [ 535.337596][T17989] netdevsim netdevsim2 eth3: set [1, 1] type 2 family 0 port 6081 - 0 [ 535.458462][T27699] veth1_macvtap: left promiscuous mode [ 535.470761][T27699] macsec0: entered promiscuous mode [ 535.481817][T27699] macsec0: entered allmulticast mode [ 535.538505][T27699] veth1_macvtap: entered promiscuous mode [ 535.547891][T27699] veth1_macvtap: entered allmulticast mode [ 535.554076][T27699] macsec0: left promiscuous mode [ 535.559358][T27699] macsec0: left allmulticast mode [ 535.564720][T27699] veth1_macvtap: left allmulticast mode [ 535.606843][T27703] syzkaller0: entered promiscuous mode [ 535.621097][T27703] syzkaller0: entered allmulticast mode [ 535.639215][T27706] veth1_macvtap: left promiscuous mode [ 535.650936][T27706] macsec0: entered promiscuous mode [ 535.662800][T27706] macsec0: entered allmulticast mode [ 535.884180][T27724] xt_hashlimit: size too large, truncated to 1048576 [ 536.142807][T27740] netdevsim netdevsim3 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 536.312760][T27740] netdevsim netdevsim3 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 536.369783][T27755] openvswitch: netlink: Multiple metadata blocks provided [ 536.448881][T27740] netdevsim netdevsim3 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 536.512224][T27766] __nla_validate_parse: 4 callbacks suppressed [ 536.512241][T27766] netlink: 4 bytes leftover after parsing attributes in process `syz.1.6542'. [ 536.553207][T27766] team0: entered promiscuous mode [ 536.558559][T27766] team0: entered allmulticast mode [ 536.624784][T27740] netdevsim netdevsim3 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 536.645332][T27776] nbd: must specify a device to reconfigure [ 536.781446][T17989] netdevsim netdevsim3 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 536.834925][T17995] netdevsim netdevsim3 eth1: set [1, 0] type 2 family 0 port 6081 - 0 [ 536.865161][T27790] x_tables: unsorted entry at hook 3 [ 536.882180][T17988] netdevsim netdevsim3 eth2: set [1, 0] type 2 family 0 port 6081 - 0 [ 536.918112][T17995] netdevsim netdevsim3 eth3: set [1, 0] type 2 family 0 port 6081 - 0 [ 537.025350][T27797] syzkaller0: entered promiscuous mode [ 537.037779][T27797] syzkaller0: entered allmulticast mode [ 537.204179][T27810] netlink: 76 bytes leftover after parsing attributes in process `syz.0.6561'. [ 537.458441][T27819] netdevsim netdevsim0 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 537.568987][T27819] netdevsim netdevsim0 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 537.602002][T27828] syzkaller0: entered promiscuous mode [ 537.607702][T27828] syzkaller0: entered allmulticast mode [ 537.703438][T27819] netdevsim netdevsim0 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 537.757879][T27834] Bluetooth: MGMT ver 1.23 [ 537.830750][T27819] netdevsim netdevsim0 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 537.884160][T27840] netlink: 'syz.4.6577': attribute type 1 has an invalid length. [ 537.895740][T27840] netlink: 'syz.4.6577': attribute type 4 has an invalid length. [ 537.911823][T27840] netlink: 9462 bytes leftover after parsing attributes in process `syz.4.6577'. [ 537.992842][T17982] netdevsim netdevsim0 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 538.053785][T17982] netdevsim netdevsim0 eth1: set [1, 0] type 2 family 0 port 6081 - 0 [ 538.082067][T17982] netdevsim netdevsim0 eth2: set [1, 0] type 2 family 0 port 6081 - 0 [ 538.110247][T27852] netlink: 24 bytes leftover after parsing attributes in process `syz.1.6581'. [ 538.110647][T27850] xt_hashlimit: size too large, truncated to 1048576 [ 538.130634][T17982] netdevsim netdevsim0 eth3: set [1, 0] type 2 family 0 port 6081 - 0 [ 538.398107][T27861] syzkaller0: entered promiscuous mode [ 538.415596][T27861] syzkaller0: entered allmulticast mode [ 538.867260][ T51] Bluetooth: hci4: unexpected cc 0x0c03 length: 249 > 1 [ 538.881445][ T51] Bluetooth: hci4: unexpected cc 0x1003 length: 249 > 9 [ 538.889986][ T51] Bluetooth: hci4: unexpected cc 0x1001 length: 249 > 9 [ 538.898848][ T51] Bluetooth: hci4: unexpected cc 0x0c23 length: 249 > 4 [ 538.907436][ T51] Bluetooth: hci4: unexpected cc 0x0c38 length: 249 > 2 [ 539.185280][T27894] FAULT_INJECTION: forcing a failure. [ 539.185280][T27894] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 539.193380][T27879] chnl_net:caif_netlink_parms(): no params data found [ 539.201373][T27894] CPU: 1 UID: 0 PID: 27894 Comm: syz.4.6594 Not tainted syzkaller #0 PREEMPT(full) [ 539.201398][T27894] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 539.201409][T27894] Call Trace: [ 539.201416][T27894] [ 539.201424][T27894] dump_stack_lvl+0xe8/0x150 [ 539.201453][T27894] should_fail_ex+0x412/0x560 [ 539.201478][T27894] _copy_from_user+0x2d/0xb0 [ 539.201502][T27894] ___sys_sendmsg+0x1c6/0x360 [ 539.201532][T27894] ? __pfx____sys_sendmsg+0x10/0x10 [ 539.201585][T27894] ? __fget_files+0x2a/0x420 [ 539.201613][T27894] ? __fget_files+0x3a0/0x420 [ 539.201644][T27894] __x64_sys_sendmsg+0x1bd/0x2a0 [ 539.201669][T27894] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 539.201701][T27894] ? __pfx_ksys_write+0x10/0x10 [ 539.201729][T27894] do_syscall_64+0x14d/0xf80 [ 539.201752][T27894] ? trace_irq_disable+0x3b/0x150 [ 539.201774][T27894] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 539.201791][T27894] ? clear_bhb_loop+0x40/0x90 [ 539.201811][T27894] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 539.201829][T27894] RIP: 0033:0x7fe7a539c629 [ 539.201845][T27894] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 539.201859][T27894] RSP: 002b:00007fe7a62ff028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 539.201879][T27894] RAX: ffffffffffffffda RBX: 00007fe7a5615fa0 RCX: 00007fe7a539c629 [ 539.201891][T27894] RDX: 000000000000c880 RSI: 0000200000000100 RDI: 0000000000000004 [ 539.201902][T27894] RBP: 00007fe7a62ff090 R08: 0000000000000000 R09: 0000000000000000 [ 539.201913][T27894] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 539.201923][T27894] R13: 00007fe7a5616038 R14: 00007fe7a5615fa0 R15: 00007ffd3f46dd78 [ 539.201950][T27894] [ 539.450009][T27899] xt_hashlimit: size too large, truncated to 1048576 [ 539.502721][T27879] bridge0: port 1(bridge_slave_0) entered blocking state [ 539.520144][T27879] bridge0: port 1(bridge_slave_0) entered disabled state [ 539.527426][T27879] bridge_slave_0: entered allmulticast mode [ 539.544735][T27879] bridge_slave_0: entered promiscuous mode [ 539.553484][T27879] bridge0: port 2(bridge_slave_1) entered blocking state [ 539.562077][T27879] bridge0: port 2(bridge_slave_1) entered disabled state [ 539.569355][T27879] bridge_slave_1: entered allmulticast mode [ 539.579050][T27879] bridge_slave_1: entered promiscuous mode [ 539.621808][T27879] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 539.634628][T27879] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 539.676002][T27879] team0: Port device team_slave_0 added [ 539.684919][T27879] team0: Port device team_slave_1 added [ 539.719282][T27879] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 539.732174][T27879] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 539.762147][T27879] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 539.762204][T27907] netlink: 'syz.2.6598': attribute type 3 has an invalid length. [ 539.775064][T27879] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 539.807982][T27879] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 539.835566][T27879] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 539.937510][T27879] hsr_slave_0: entered promiscuous mode [ 539.940217][T27918] netlink: 'syz.4.6601': attribute type 11 has an invalid length. [ 539.954522][T27918] netlink: 'syz.4.6601': attribute type 11 has an invalid length. [ 539.961832][T27879] hsr_slave_1: entered promiscuous mode [ 539.970030][T27879] debugfs: 'hsr0' already exists in 'hsr' [ 539.975785][T27879] Cannot create hsr debugfs directory [ 539.976539][T27918] netlink: 224 bytes leftover after parsing attributes in process `syz.4.6601'. [ 539.995337][T27921] netlink: 4 bytes leftover after parsing attributes in process `syz.4.6601'. [ 540.000842][T27920] netlink: 12 bytes leftover after parsing attributes in process `syz.2.6602'. [ 540.169957][T27927] netlink: 32 bytes leftover after parsing attributes in process `syz.4.6604'. [ 540.199806][T27927] netlink: 24 bytes leftover after parsing attributes in process `syz.4.6604'. [ 540.233230][T27929] FAULT_INJECTION: forcing a failure. [ 540.233230][T27929] name failslab, interval 1, probability 0, space 0, times 0 [ 540.244289][T27927] : entered promiscuous mode [ 540.249153][T27929] CPU: 0 UID: 0 PID: 27929 Comm: syz.2.6606 Not tainted syzkaller #0 PREEMPT(full) [ 540.249178][T27929] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 540.249189][T27929] Call Trace: [ 540.249196][T27929] [ 540.249205][T27929] dump_stack_lvl+0xe8/0x150 [ 540.249242][T27929] should_fail_ex+0x412/0x560 [ 540.249266][T27929] should_failslab+0xa8/0x100 [ 540.249288][T27929] __kmalloc_cache_noprof+0x88/0x660 [ 540.249308][T27929] ? tcp_sendmsg_fastopen+0x1de/0x5e0 [ 540.249338][T27929] tcp_sendmsg_fastopen+0x1de/0x5e0 [ 540.249369][T27929] tcp_sendmsg_locked+0x4bb2/0x5490 [ 540.249396][T27929] ? aa_file_perm+0x12d/0x1630 [ 540.249415][T27929] ? tcp_sendmsg_locked+0x301/0x5490 [ 540.249442][T27929] ? __pfx_aa_label_sk_perm+0x10/0x10 [ 540.249463][T27929] ? __lock_acquire+0x6b5/0x2cf0 [ 540.249492][T27929] ? __lock_acquire+0x6b5/0x2cf0 [ 540.249525][T27929] ? aa_sk_perm+0x15a/0x960 [ 540.249550][T27929] ? __pfx_tcp_sendmsg_locked+0x10/0x10 [ 540.249581][T27929] ? tcp_sendmsg+0x21/0x50 [ 540.249607][T27929] ? __local_bh_enable_ip+0xd0/0x130 [ 540.249633][T27929] tcp_sendmsg+0x2f/0x50 [ 540.249657][T27929] __sys_sendto+0x627/0x7a0 [ 540.249683][T27929] ? __pfx___sys_sendto+0x10/0x10 [ 540.249701][T27929] ? __mutex_unlock_slowpath+0x1bd/0x7d0 [ 540.249738][T27929] ? __fget_files+0x3a0/0x420 [ 540.249770][T27929] ? ksys_write+0x242/0x270 [ 540.249790][T27929] ? __pfx_ksys_write+0x10/0x10 [ 540.249812][T27929] __x64_sys_sendto+0xde/0x100 [ 540.249836][T27929] do_syscall_64+0x14d/0xf80 [ 540.249860][T27929] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 540.249877][T27929] ? clear_bhb_loop+0x40/0x90 [ 540.249899][T27929] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 540.249916][T27929] RIP: 0033:0x7f9482d9c629 [ 540.249933][T27929] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 540.249948][T27929] RSP: 002b:00007f9480ff6028 EFLAGS: 00000246 ORIG_RAX: 000000000000002c [ 540.249967][T27929] RAX: ffffffffffffffda RBX: 00007f9483015fa0 RCX: 00007f9482d9c629 [ 540.249979][T27929] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000004 [ 540.249990][T27929] RBP: 00007f9480ff6090 R08: 0000200000e68000 R09: 0000000000000010 [ 540.250001][T27929] R10: 00000000200007bd R11: 0000000000000246 R12: 0000000000000001 [ 540.250012][T27929] R13: 00007f9483016038 R14: 00007f9483015fa0 R15: 00007fff19534048 [ 540.250040][T27929] [ 540.377190][T27933] xt_hashlimit: size too large, truncated to 1048576 [ 540.544334][T27879] netdevsim netdevsim1 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 256 - 0 [ 540.642698][T27938] netlink: 'syz.4.6609': attribute type 3 has an invalid length. [ 540.653389][T27879] netdevsim netdevsim1 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 256 - 0 [ 540.766632][T27879] netdevsim netdevsim1 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 256 - 0 [ 540.902778][T27879] netdevsim netdevsim1 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 256 - 0 [ 540.932721][ T51] Bluetooth: hci4: command tx timeout [ 541.287947][T27971] netlink: 16 bytes leftover after parsing attributes in process `syz.4.6618'. [ 541.306114][T27879] netdevsim netdevsim1 netdevsim0: renamed from eth0 [ 541.331909][T27879] netdevsim netdevsim1 netdevsim1: renamed from eth1 [ 541.381958][T27879] netdevsim netdevsim1 netdevsim2: renamed from eth2 [ 541.421478][T27879] netdevsim netdevsim1 netdevsim3: renamed from eth3 [ 541.882998][T27996] netlink: 4 bytes leftover after parsing attributes in process `syz.3.6624'. [ 541.893055][T27879] 8021q: adding VLAN 0 to HW filter on device bond0 [ 541.955158][T27879] 8021q: adding VLAN 0 to HW filter on device team0 [ 542.003188][T17988] bridge0: port 1(bridge_slave_0) entered blocking state [ 542.010416][T17988] bridge0: port 1(bridge_slave_0) entered forwarding state [ 542.043408][T17988] bridge0: port 2(bridge_slave_1) entered blocking state [ 542.050715][T17988] bridge0: port 2(bridge_slave_1) entered forwarding state [ 542.462271][T28033] syzkaller0: entered promiscuous mode [ 542.487838][T28033] syzkaller0: entered allmulticast mode [ 542.507176][T28032] netlink: 8 bytes leftover after parsing attributes in process `syz.2.6636'. [ 542.646792][T27879] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 542.803409][T28057] FAULT_INJECTION: forcing a failure. [ 542.803409][T28057] name failslab, interval 1, probability 0, space 0, times 0 [ 542.824741][T27879] veth0_vlan: entered promiscuous mode [ 542.858351][T28057] CPU: 1 UID: 0 PID: 28057 Comm: syz.0.6643 Not tainted syzkaller #0 PREEMPT(full) [ 542.858377][T28057] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 542.858387][T28057] Call Trace: [ 542.858395][T28057] [ 542.858403][T28057] dump_stack_lvl+0xe8/0x150 [ 542.858432][T28057] should_fail_ex+0x412/0x560 [ 542.858457][T28057] should_failslab+0xa8/0x100 [ 542.858475][T28057] ? skb_clone+0x212/0x3a0 [ 542.858500][T28057] kmem_cache_alloc_noprof+0x87/0x650 [ 542.858526][T28057] ? __netlink_lookup+0xc6/0x8b0 [ 542.858554][T28057] skb_clone+0x212/0x3a0 [ 542.858581][T28057] __netlink_deliver_tap+0x404/0x850 [ 542.858614][T28057] ? netlink_deliver_tap+0x2e/0x1b0 [ 542.858636][T28057] netlink_deliver_tap+0x19c/0x1b0 [ 542.858657][T28057] netlink_unicast+0x7e3/0x9b0 [ 542.858682][T28057] ? __pfx_netlink_unicast+0x10/0x10 [ 542.858702][T28057] ? netlink_sendmsg+0x650/0xb40 [ 542.858721][T28057] ? skb_put+0x11b/0x210 [ 542.858746][T28057] netlink_sendmsg+0x813/0xb40 [ 542.858774][T28057] ? __pfx_netlink_sendmsg+0x10/0x10 [ 542.858798][T28057] ? aa_sock_msg_perm+0xf1/0x1b0 [ 542.858819][T28057] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 542.858840][T28057] ? __pfx_netlink_sendmsg+0x10/0x10 [ 542.858860][T28057] ____sys_sendmsg+0xa68/0xad0 [ 542.858892][T28057] ? __pfx_____sys_sendmsg+0x10/0x10 [ 542.858925][T28057] ? import_iovec+0x73/0xa0 [ 542.858952][T28057] ___sys_sendmsg+0x2a5/0x360 [ 542.858981][T28057] ? __pfx____sys_sendmsg+0x10/0x10 [ 542.859037][T28057] ? __fget_files+0x2a/0x420 [ 542.859060][T28057] ? __fget_files+0x3a0/0x420 [ 542.859091][T28057] __x64_sys_sendmsg+0x1bd/0x2a0 [ 542.859118][T28057] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 542.859151][T28057] ? __pfx_ksys_write+0x10/0x10 [ 542.859181][T28057] do_syscall_64+0x14d/0xf80 [ 542.859206][T28057] ? trace_irq_disable+0x3b/0x150 [ 542.859228][T28057] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 542.859244][T28057] ? clear_bhb_loop+0x40/0x90 [ 542.859266][T28057] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 542.859282][T28057] RIP: 0033:0x7fe6dc59c629 [ 542.859307][T28057] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 542.859322][T28057] RSP: 002b:00007fe6dd3cf028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 542.859341][T28057] RAX: ffffffffffffffda RBX: 00007fe6dc815fa0 RCX: 00007fe6dc59c629 [ 542.859354][T28057] RDX: 000000000000c880 RSI: 0000200000000100 RDI: 0000000000000004 [ 542.859364][T28057] RBP: 00007fe6dd3cf090 R08: 0000000000000000 R09: 0000000000000000 [ 542.859374][T28057] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 542.859386][T28057] R13: 00007fe6dc816038 R14: 00007fe6dc815fa0 R15: 00007fff1c2bd048 [ 542.859415][T28057] [ 543.167704][ T51] Bluetooth: hci4: command tx timeout [ 543.188189][T27879] veth1_vlan: entered promiscuous mode [ 543.232669][T28068] Cannot find add_set index 0 as target [ 543.233791][T28066] netlink: 54 bytes leftover after parsing attributes in process `syz.4.6646'. [ 543.303043][T28060] netlink: 12 bytes leftover after parsing attributes in process `syz.2.6645'. [ 543.304278][T28066] netlink: 8 bytes leftover after parsing attributes in process `syz.4.6646'. [ 543.314023][T27879] veth0_macvtap: entered promiscuous mode [ 543.430826][T28076] x_tables: unsorted entry at hook 3 [ 543.445218][T27879] veth1_macvtap: entered promiscuous mode [ 543.597647][T28077] syzkaller0: entered promiscuous mode [ 543.606359][T28077] syzkaller0: entered allmulticast mode [ 543.641447][T27879] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 544.052380][T28097] Cannot find del_set index 65531 as target [ 544.790285][T28106] netlink: 12 bytes leftover after parsing attributes in process `syz.0.6661'. [ 545.250989][ T51] Bluetooth: hci4: command tx timeout [ 545.388605][T27879] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 545.435486][T17982] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 545.445360][T17982] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 545.468353][T28110] netlink: 4 bytes leftover after parsing attributes in process `syz.2.6662'. [ 545.527238][T17982] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 545.601140][T17982] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 545.770070][T17988] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 545.798525][T17988] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 545.847073][T17988] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 545.865202][T17988] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 546.030140][T28136] netlink: 28 bytes leftover after parsing attributes in process `syz.3.6670'. [ 546.039132][T28136] netlink: 28 bytes leftover after parsing attributes in process `syz.3.6670'. [ 546.091361][T28136] netlink: 8 bytes leftover after parsing attributes in process `syz.3.6670'. [ 546.413712][T28146] syzkaller0: entered promiscuous mode [ 546.419244][T28146] syzkaller0: entered allmulticast mode [ 547.338892][ T51] Bluetooth: hci4: command tx timeout [ 548.628888][T28170] bond1: invalid ARP target 0.0.0.0 specified for addition [ 548.636274][T28170] bond1: option arp_ip_target: invalid value (0) [ 548.644008][T28170] bond1 (unregistering): Released all slaves [ 548.672661][T28182] pimreg3: entered allmulticast mode [ 548.803979][T28203] __nla_validate_parse: 1 callbacks suppressed [ 548.804000][T28203] netlink: 28 bytes leftover after parsing attributes in process `syz.4.6687'. [ 548.820476][T28203] netlink: 28 bytes leftover after parsing attributes in process `syz.4.6687'. [ 548.842971][T28203] netlink: 8 bytes leftover after parsing attributes in process `syz.4.6687'. [ 549.014033][T28219] netlink: 'syz.4.6691': attribute type 2 has an invalid length. [ 549.190505][T28237] netlink: 4 bytes leftover after parsing attributes in process `syz.0.6693'. [ 549.208711][T28234] netlink: 16 bytes leftover after parsing attributes in process `syz.4.6695'. [ 549.370012][T28230] netlink: 12 bytes leftover after parsing attributes in process `syz.2.6694'. [ 549.537953][T28253] workqueue: Failed to create a rescuer kthread for wq "bond1": -EINTR [ 549.671358][T28263] policy can only be matched on NF_INET_PRE_ROUTING [ 549.699589][T28263] unable to load match [ 550.269383][T28309] netlink: 60 bytes leftover after parsing attributes in process `syz.3.6714'. [ 550.307674][T28313] netlink: 60 bytes leftover after parsing attributes in process `syz.0.6712'. [ 550.346934][T28298] syzkaller0: entered promiscuous mode [ 550.356154][T28298] syzkaller0: entered allmulticast mode [ 550.666194][T28329] netlink: 404 bytes leftover after parsing attributes in process `syz.2.6720'. [ 550.692183][T28328] delete_channel: no stack [ 551.170018][T28355] netlink: 60 bytes leftover after parsing attributes in process `syz.3.6729'. [ 551.924716][T28389] netlink: 'syz.4.6740': attribute type 1 has an invalid length. [ 551.936128][T28389] Cannot find del_set index 4 as target [ 552.047201][T28394] netlink: 'syz.4.6742': attribute type 3 has an invalid length. [ 552.302765][T28398] ip6tnl0: Caught tx_queue_len zero misconfig [ 552.434467][T28407] Unsupported ieee802154 address type: 0 [ 552.466803][T28403] syzkaller0: entered promiscuous mode [ 552.483483][T28403] syzkaller0: entered allmulticast mode [ 552.658167][T28420] workqueue: Failed to create a rescuer kthread for wq "nfc2_nci_rx_wq": -EINTR [ 552.897706][T28434] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 552.914719][T28434] IPv6: NLM_F_CREATE should be set when creating new route [ 555.375841][T28426] workqueue: Failed to create a rescuer kthread for wq "bond1": -EINTR [ 555.377294][T28429] tipc: Enabling of bearer rejected, failed to enable media [ 555.579134][T28459] netdevsim netdevsim1: Direct firmware load for .. failed with error -2 [ 555.620103][T28459] netdevsim netdevsim1: Falling back to sysfs fallback for: .. [ 555.676266][T28462] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 555.710525][T28462] __nla_validate_parse: 6 callbacks suppressed [ 555.710545][T28462] netlink: 8 bytes leftover after parsing attributes in process `syz.4.6763'. [ 556.014596][T28479] syzkaller0: entered promiscuous mode [ 556.024068][T28479] syzkaller0: entered allmulticast mode [ 556.144516][T28494] netlink: 7060 bytes leftover after parsing attributes in process `syz.0.6771'. [ 556.162443][T28494] netlink: 32 bytes leftover after parsing attributes in process `syz.0.6771'. [ 556.225230][T28489] netlink: 'syz.3.6768': attribute type 29 has an invalid length. [ 556.624790][T28509] xt_hashlimit: size too large, truncated to 1048576 [ 559.026810][T28519] netlink: 28 bytes leftover after parsing attributes in process `syz.2.6777'. [ 559.041076][T28519] netlink: 28 bytes leftover after parsing attributes in process `syz.2.6777'. [ 559.070470][T28519] netlink: 8 bytes leftover after parsing attributes in process `syz.2.6777'. [ 559.156408][T28536] netlink: 12 bytes leftover after parsing attributes in process `syz.0.6782'. [ 559.313520][T28546] xt_CT: You must specify a L4 protocol and not use inversions on it [ 559.328485][T28550] netlink: 'syz.3.6789': attribute type 21 has an invalid length. [ 559.357864][T28556] netlink: 32 bytes leftover after parsing attributes in process `syz.0.6788'. [ 559.388061][T28555] xt_hashlimit: size too large, truncated to 1048576 [ 559.405131][T28548] syzkaller0: entered promiscuous mode [ 559.411136][T28548] syzkaller0: entered allmulticast mode [ 559.418143][T28550] netlink: 156 bytes leftover after parsing attributes in process `syz.3.6789'. [ 559.451519][T28561] netlink: 44 bytes leftover after parsing attributes in process `syz.1.6791'. [ 559.770334][T28580] xt_hashlimit: size too large, truncated to 1048576 [ 559.972360][ T51] block nbd3: Receive control failed (result -107) [ 560.033455][T28592] IPv6: NLM_F_CREATE should be specified when creating new route [ 560.295595][T28604] netlink: 'syz.1.6803': attribute type 1 has an invalid length. [ 560.382734][ C1] bridge0: received packet on bridge_slave_1 with own address as source address (addr:aa:aa:aa:aa:aa:1c, vlan:0) [ 561.772168][T28609] bridge1: trying to set multicast query interval below minimum, setting to 100 (1000ms) [ 561.816051][T28634] __nla_validate_parse: 2 callbacks suppressed [ 561.816065][T28634] netlink: 12 bytes leftover after parsing attributes in process `syz.4.6809'. [ 561.868840][T28636] xt_hashlimit: size too large, truncated to 1048576 [ 561.876095][T28638] netlink: 12 bytes leftover after parsing attributes in process `syz.4.6809'. [ 561.891890][T28638] xfrm1: entered promiscuous mode [ 561.897228][T28638] xfrm1: entered allmulticast mode [ 561.933593][T28637] netlink: 28 bytes leftover after parsing attributes in process `syz.2.6808'. [ 561.970578][T28637] netlink: 28 bytes leftover after parsing attributes in process `syz.2.6808'. [ 562.123632][T28648] FAULT_INJECTION: forcing a failure. [ 562.123632][T28648] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 562.129394][T28646] xt_hashlimit: size too large, truncated to 1048576 [ 562.154930][T28648] CPU: 0 UID: 0 PID: 28648 Comm: syz.2.6813 Not tainted syzkaller #0 PREEMPT(full) [ 562.154956][T28648] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 562.154967][T28648] Call Trace: [ 562.154975][T28648] [ 562.154983][T28648] dump_stack_lvl+0xe8/0x150 [ 562.155012][T28648] should_fail_ex+0x412/0x560 [ 562.155037][T28648] _copy_from_iter+0x1d3/0x1670 [ 562.155063][T28648] ? rcu_is_watching+0x15/0xb0 [ 562.155092][T28648] ? __pfx__copy_from_iter+0x10/0x10 [ 562.155122][T28648] ? netlink_sendmsg+0x650/0xb40 [ 562.155141][T28648] ? skb_put+0x11b/0x210 [ 562.155167][T28648] netlink_sendmsg+0x6c0/0xb40 [ 562.155196][T28648] ? __pfx_netlink_sendmsg+0x10/0x10 [ 562.155220][T28648] ? aa_sock_msg_perm+0xf1/0x1b0 [ 562.155242][T28648] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 562.155263][T28648] ? __pfx_netlink_sendmsg+0x10/0x10 [ 562.155293][T28648] ____sys_sendmsg+0xa68/0xad0 [ 562.155327][T28648] ? __pfx_____sys_sendmsg+0x10/0x10 [ 562.155358][T28648] ? import_iovec+0x73/0xa0 [ 562.155385][T28648] ___sys_sendmsg+0x2a5/0x360 [ 562.155415][T28648] ? __pfx____sys_sendmsg+0x10/0x10 [ 562.155472][T28648] ? __fget_files+0x2a/0x420 [ 562.155495][T28648] ? __fget_files+0x3a0/0x420 [ 562.155529][T28648] __x64_sys_sendmsg+0x1bd/0x2a0 [ 562.155556][T28648] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 562.155588][T28648] ? __pfx_ksys_write+0x10/0x10 [ 562.155623][T28648] do_syscall_64+0x14d/0xf80 [ 562.155647][T28648] ? trace_irq_disable+0x3b/0x150 [ 562.155670][T28648] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 562.155689][T28648] ? clear_bhb_loop+0x40/0x90 [ 562.155711][T28648] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 562.155729][T28648] RIP: 0033:0x7f9482d9c629 [ 562.155747][T28648] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 562.155762][T28648] RSP: 002b:00007f9480ff6028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 562.155783][T28648] RAX: ffffffffffffffda RBX: 00007f9483015fa0 RCX: 00007f9482d9c629 [ 562.155796][T28648] RDX: 0000000000000000 RSI: 00002000000001c0 RDI: 0000000000000005 [ 562.155808][T28648] RBP: 00007f9480ff6090 R08: 0000000000000000 R09: 0000000000000000 [ 562.155820][T28648] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 562.155831][T28648] R13: 00007f9483016038 R14: 00007f9483015fa0 R15: 00007fff19534048 [ 562.155860][T28648] [ 562.434496][T28650] netlink: 24 bytes leftover after parsing attributes in process `syz.3.6814'. [ 562.470200][T28657] Cannot find set identified by id 1 to match [ 562.617650][T28663] xt_hashlimit: size too large, truncated to 1048576 [ 562.884812][T28685] netlink: 'syz.3.6823': attribute type 1 has an invalid length. [ 562.940537][ T1299] lec:lec_start_xmit: lec0:No lecd attached [ 562.981703][T28677] veth1_macvtap: renamed from veth0_vlan [ 563.003805][T28694] xt_hashlimit: size too large, truncated to 1048576 [ 563.061749][T28696] netlink: 'syz.3.6823': attribute type 39 has an invalid length. [ 563.084301][T28693] xt_hashlimit: size too large, truncated to 1048576 [ 563.107646][T28700] IPVS: length: 8 != 1152 [ 563.137908][T28685] bond1: entered promiscuous mode [ 563.152539][T28700] netlink: 108 bytes leftover after parsing attributes in process `syz.2.6827'. [ 563.164075][T28700] IPVS: length: 8 != 1152 [ 563.205956][T28685] 8021q: adding VLAN 0 to HW filter on device bond1 [ 563.324645][T28691] bond1: (slave bridge1): making interface the new active one [ 563.340713][T28691] bridge1: entered promiscuous mode [ 563.370860][T28691] bond1: (slave bridge1): Enslaving as an active interface with an up link [ 563.645337][T28721] netlink: 28 bytes leftover after parsing attributes in process `syz.0.6831'. [ 563.664133][T28721] netlink: 28 bytes leftover after parsing attributes in process `syz.0.6831'. [ 563.675952][T28723] netlink: 'syz.2.6832': attribute type 10 has an invalid length. [ 563.684497][T28721] netlink: 8 bytes leftover after parsing attributes in process `syz.0.6831'. [ 563.938079][T28739] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 563.973127][T28739] xt_l2tp: invalid flags combination: 8 [ 563.976446][T28744] netlink: 8 bytes leftover after parsing attributes in process `syz.2.6840'. [ 564.162303][T28757] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 564.285656][T28763] FAULT_INJECTION: forcing a failure. [ 564.285656][T28763] name failslab, interval 1, probability 0, space 0, times 0 [ 564.403944][T28763] CPU: 0 UID: 0 PID: 28763 Comm: syz.3.6845 Not tainted syzkaller #0 PREEMPT(full) [ 564.403969][T28763] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 564.403980][T28763] Call Trace: [ 564.403987][T28763] [ 564.403994][T28763] dump_stack_lvl+0xe8/0x150 [ 564.404023][T28763] should_fail_ex+0x412/0x560 [ 564.404046][T28763] should_failslab+0xa8/0x100 [ 564.404067][T28763] __kmalloc_noprof+0xe8/0x760 [ 564.404084][T28763] ? genl_family_rcv_msg_attrs_parse+0xa3/0x2a0 [ 564.404113][T28763] genl_family_rcv_msg_attrs_parse+0xa3/0x2a0 [ 564.404140][T28763] genl_family_rcv_msg_doit+0xd9/0x330 [ 564.404168][T28763] ? __pfx_genl_family_rcv_msg_doit+0x10/0x10 [ 564.404198][T28763] ? apparmor_capable+0x137/0x1a0 [ 564.404223][T28763] ? bpf_lsm_capable+0x9/0x20 [ 564.404243][T28763] ? security_capable+0x7e/0x2c0 [ 564.404267][T28763] genl_rcv_msg+0x61c/0x7a0 [ 564.404294][T28763] ? __pfx_genl_rcv_msg+0x10/0x10 [ 564.404313][T28763] ? __pfx_nl80211_pre_doit+0x10/0x10 [ 564.404329][T28763] ? __pfx_nl80211_start_ap+0x10/0x10 [ 564.404345][T28763] ? __pfx_nl80211_post_doit+0x10/0x10 [ 564.404362][T28763] ? __lock_acquire+0x6b5/0x2cf0 [ 564.404394][T28763] netlink_rcv_skb+0x232/0x4b0 [ 564.404422][T28763] ? __pfx_genl_rcv_msg+0x10/0x10 [ 564.404447][T28763] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 564.404484][T28763] ? down_read+0x272/0x2e0 [ 564.404500][T28763] ? genl_rcv+0xd/0x40 [ 564.404522][T28763] genl_rcv+0x28/0x40 [ 564.404543][T28763] netlink_unicast+0x80f/0x9b0 [ 564.404569][T28763] ? __pfx_netlink_unicast+0x10/0x10 [ 564.404588][T28763] ? netlink_sendmsg+0x650/0xb40 [ 564.404606][T28763] ? skb_put+0x11b/0x210 [ 564.404629][T28763] netlink_sendmsg+0x813/0xb40 [ 564.404656][T28763] ? __pfx_netlink_sendmsg+0x10/0x10 [ 564.404679][T28763] ? aa_sock_msg_perm+0xf1/0x1b0 [ 564.404700][T28763] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 564.404719][T28763] ? __pfx_netlink_sendmsg+0x10/0x10 [ 564.404736][T28763] ____sys_sendmsg+0xa68/0xad0 [ 564.404767][T28763] ? __pfx_____sys_sendmsg+0x10/0x10 [ 564.404797][T28763] ? import_iovec+0x73/0xa0 [ 564.404822][T28763] ___sys_sendmsg+0x2a5/0x360 [ 564.404848][T28763] ? __pfx____sys_sendmsg+0x10/0x10 [ 564.404901][T28763] ? __fget_files+0x2a/0x420 [ 564.404923][T28763] ? __fget_files+0x3a0/0x420 [ 564.404953][T28763] __x64_sys_sendmsg+0x1bd/0x2a0 [ 564.404980][T28763] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 564.405014][T28763] ? __pfx_ksys_write+0x10/0x10 [ 564.405042][T28763] do_syscall_64+0x14d/0xf80 [ 564.405064][T28763] ? trace_irq_disable+0x3b/0x150 [ 564.405086][T28763] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 564.405104][T28763] ? clear_bhb_loop+0x40/0x90 [ 564.405125][T28763] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 564.405142][T28763] RIP: 0033:0x7fe19c39c629 [ 564.405159][T28763] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 564.405174][T28763] RSP: 002b:00007fe19d318028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 564.405193][T28763] RAX: ffffffffffffffda RBX: 00007fe19c615fa0 RCX: 00007fe19c39c629 [ 564.405207][T28763] RDX: 0000000000000000 RSI: 00002000000001c0 RDI: 0000000000000005 [ 564.405217][T28763] RBP: 00007fe19d318090 R08: 0000000000000000 R09: 0000000000000000 [ 564.405228][T28763] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 564.405238][T28763] R13: 00007fe19c616038 R14: 00007fe19c615fa0 R15: 00007ffea0953078 [ 564.405264][T28763] [ 564.774708][T28778] netlink: 'syz.0.6850': attribute type 1 has an invalid length. [ 564.861759][T28780] netlink: 'syz.3.6851': attribute type 13 has an invalid length. [ 564.881577][T28778] workqueue: Failed to create a rescuer kthread for wq "bond1": -EINTR [ 564.932947][T28780] veth0_macvtap: left promiscuous mode [ 564.970944][T28780] macvtap0: entered allmulticast mode [ 564.981376][T28780] macvtap0: refused to change device tx_queue_len [ 565.215317][T28811] bond1: Unable to set peer notification delay as MII monitoring is disabled [ 565.230690][T28811] bond1 (unregistering): Released all slaves [ 565.364227][T28821] openvswitch: netlink: IPv4 tun info is not correct [ 565.696255][T28847] FAULT_INJECTION: forcing a failure. [ 565.696255][T28847] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 565.758711][T28847] CPU: 1 UID: 0 PID: 28847 Comm: syz.0.6866 Not tainted syzkaller #0 PREEMPT(full) [ 565.758737][T28847] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 565.758747][T28847] Call Trace: [ 565.758754][T28847] [ 565.758762][T28847] dump_stack_lvl+0xe8/0x150 [ 565.758791][T28847] should_fail_ex+0x412/0x560 [ 565.758816][T28847] _copy_from_iter+0x1d3/0x1670 [ 565.758836][T28847] ? __pfx_ref_tracker_alloc+0x10/0x10 [ 565.758855][T28847] ? __lock_acquire+0x6b5/0x2cf0 [ 565.758882][T28847] ? __pfx__copy_from_iter+0x10/0x10 [ 565.758908][T28847] ? packet_cached_dev_get+0x1c/0x2b0 [ 565.758933][T28847] ? packet_cached_dev_get+0x1c/0x2b0 [ 565.758962][T28847] packet_sendmsg+0x30b2/0x50f0 [ 565.758989][T28847] ? __pfx_aa_label_sk_perm+0x10/0x10 [ 565.759011][T28847] ? __lock_acquire+0x6b5/0x2cf0 [ 565.759038][T28847] ? __lock_acquire+0x6b5/0x2cf0 [ 565.759073][T28847] ? aa_sk_perm+0x15a/0x960 [ 565.759103][T28847] ? aa_sk_perm+0x82d/0x960 [ 565.759119][T28847] ? __pfx_packet_sendmsg+0x10/0x10 [ 565.759149][T28847] ? tomoyo_socket_sendmsg_permission+0x1e0/0x300 [ 565.759173][T28847] ? __fget_files+0x3a0/0x420 [ 565.759195][T28847] ? __fget_files+0x2a/0x420 [ 565.759215][T28847] ? aa_sock_msg_perm+0xf1/0x1b0 [ 565.759236][T28847] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 565.759255][T28847] __sys_sendto+0x709/0x7a0 [ 565.759280][T28847] ? __pfx___sys_sendto+0x10/0x10 [ 565.759298][T28847] ? __mutex_unlock_slowpath+0x1bd/0x7d0 [ 565.759335][T28847] ? __fget_files+0x3a0/0x420 [ 565.759367][T28847] ? ksys_write+0x242/0x270 [ 565.759387][T28847] ? __pfx_ksys_write+0x10/0x10 [ 565.759410][T28847] __x64_sys_sendto+0xde/0x100 [ 565.759437][T28847] do_syscall_64+0x14d/0xf80 [ 565.759458][T28847] ? trace_irq_disable+0x3b/0x150 [ 565.759478][T28847] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 565.759495][T28847] ? clear_bhb_loop+0x40/0x90 [ 565.759516][T28847] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 565.759534][T28847] RIP: 0033:0x7fe6dc59c629 [ 565.759551][T28847] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 565.759566][T28847] RSP: 002b:00007fe6dd3cf028 EFLAGS: 00000246 ORIG_RAX: 000000000000002c [ 565.759585][T28847] RAX: ffffffffffffffda RBX: 00007fe6dc815fa0 RCX: 00007fe6dc59c629 [ 565.759598][T28847] RDX: 000000000000fc13 RSI: 0000200000000280 RDI: 0000000000000007 [ 565.759610][T28847] RBP: 00007fe6dd3cf090 R08: 0000000000000000 R09: 000000000000002f [ 565.759621][T28847] R10: 0000000000000800 R11: 0000000000000246 R12: 0000000000000001 [ 565.759632][T28847] R13: 00007fe6dc816038 R14: 00007fe6dc815fa0 R15: 00007fff1c2bd048 [ 565.759662][T28847] [ 566.397167][T28878] netlink: 'syz.1.6875': attribute type 1 has an invalid length. [ 566.446434][ T5487] veth1_macvtap: left promiscuous mode [ 566.502511][ T5487] veth1_macvtap: entered promiscuous mode [ 566.848426][T28894] __nla_validate_parse: 15 callbacks suppressed [ 566.848446][T28894] netlink: 12 bytes leftover after parsing attributes in process `syz.4.6881'. [ 567.142805][T28924] openvswitch: netlink: Key type 31 is not supported [ 567.145425][T28922] syzkaller0: entered promiscuous mode [ 567.168385][T28922] syzkaller0: entered allmulticast mode [ 567.241167][T28930] netlink: 12 bytes leftover after parsing attributes in process `syz.0.6892'. [ 567.305007][T28936] FAULT_INJECTION: forcing a failure. [ 567.305007][T28936] name failslab, interval 1, probability 0, space 0, times 0 [ 567.343783][T28936] CPU: 0 UID: 0 PID: 28936 Comm: syz.1.6894 Not tainted syzkaller #0 PREEMPT(full) [ 567.343811][T28936] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 567.343823][T28936] Call Trace: [ 567.343830][T28936] [ 567.343838][T28936] dump_stack_lvl+0xe8/0x150 [ 567.343869][T28936] should_fail_ex+0x412/0x560 [ 567.343892][T28936] should_failslab+0xa8/0x100 [ 567.343914][T28936] __kmalloc_noprof+0xe8/0x760 [ 567.343931][T28936] ? bpf_test_init+0x9f/0x150 [ 567.343948][T28936] ? kstrtouint+0x6e/0xe0 [ 567.343969][T28936] bpf_test_init+0x9f/0x150 [ 567.344001][T28936] bpf_prog_test_run_xdp+0x529/0x1160 [ 567.344035][T28936] ? __pfx_bpf_prog_test_run_xdp+0x10/0x10 [ 567.344060][T28936] ? __fget_files+0x2a/0x420 [ 567.344085][T28936] ? __pfx_bpf_prog_test_run_xdp+0x10/0x10 [ 567.344106][T28936] bpf_prog_test_run+0x2c7/0x340 [ 567.344127][T28936] __sys_bpf+0x643/0x950 [ 567.344152][T28936] ? __pfx___sys_bpf+0x10/0x10 [ 567.344187][T28936] ? ksys_write+0x242/0x270 [ 567.344212][T28936] ? __pfx_ksys_write+0x10/0x10 [ 567.344235][T28936] __x64_sys_bpf+0x7c/0x90 [ 567.344259][T28936] do_syscall_64+0x14d/0xf80 [ 567.344282][T28936] ? trace_irq_disable+0x3b/0x150 [ 567.344305][T28936] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 567.344323][T28936] ? clear_bhb_loop+0x40/0x90 [ 567.344343][T28936] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 567.344361][T28936] RIP: 0033:0x7fe65e59c629 [ 567.344378][T28936] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 567.344394][T28936] RSP: 002b:00007fe65f46b028 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 567.344413][T28936] RAX: ffffffffffffffda RBX: 00007fe65e815fa0 RCX: 00007fe65e59c629 [ 567.344426][T28936] RDX: 0000000000000048 RSI: 0000200000000600 RDI: 000000000000000a [ 567.344438][T28936] RBP: 00007fe65f46b090 R08: 0000000000000000 R09: 0000000000000000 [ 567.344449][T28936] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 567.344459][T28936] R13: 00007fe65e816038 R14: 00007fe65e815fa0 R15: 00007ffdc2f60238 [ 567.344489][T28936] [ 567.755418][T28944] netlink: 4 bytes leftover after parsing attributes in process `syz.1.6896'. [ 567.913602][T28954] x_tables: unsorted entry at hook 3 [ 567.947237][T28957] vcan0: tx address claim with dlc 0 [ 567.953124][ C0] lec0: NETDEV WATCHDOG: CPU: 0: transmit queue 0 timed out 5010 ms [ 567.953158][ C0] lec:lec_tx_timeout: lec0 [ 567.971142][T28957] netlink: 240 bytes leftover after parsing attributes in process `syz.2.6901'. [ 568.046252][T28962] netlink: 248 bytes leftover after parsing attributes in process `syz.4.6903'. [ 568.058017][T28962] netlink: 52 bytes leftover after parsing attributes in process `syz.4.6903'. [ 568.073056][T28960] netdevsim netdevsim1 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 568.130610][T28962] syzkaller0: entered promiscuous mode [ 568.136325][T28962] syzkaller0: entered allmulticast mode [ 568.154570][T28962] netlink: 12 bytes leftover after parsing attributes in process `syz.4.6903'. [ 568.183939][T28960] netdevsim netdevsim1 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 568.284492][T28960] netdevsim netdevsim1 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 568.390872][T28960] netdevsim netdevsim1 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 568.478861][T28981] netlink: 8 bytes leftover after parsing attributes in process `syz.4.6910'. [ 568.518975][T28980] netlink: 60 bytes leftover after parsing attributes in process `syz.3.6909'. [ 568.560498][T17988] netdevsim netdevsim1 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 568.568769][T17988] netdevsim netdevsim1 eth1: set [1, 0] type 2 family 0 port 6081 - 0 [ 568.633946][T17988] netdevsim netdevsim1 eth2: set [1, 0] type 2 family 0 port 6081 - 0 [ 568.663262][T28993] netlink: 24 bytes leftover after parsing attributes in process `syz.3.6914'. [ 568.674887][T17988] netdevsim netdevsim1 eth3: set [1, 0] type 2 family 0 port 6081 - 0 [ 569.001130][T29014] block nbd4: Unsupported socket: should be TCP or UNIX. [ 569.080912][T29014] syzkaller0: entered promiscuous mode [ 569.099967][T29014] syzkaller0: entered allmulticast mode [ 569.349319][T29038] tipc: Failed to remove unknown binding: 66,0,0/0:3873252619/3873252621 [ 569.373515][T29038] tipc: Failed to remove unknown binding: 66,0,0/0:3873252619/3873252620 [ 569.413866][T29031] tipc: Failed to remove unknown binding: 66,0,0/0:3873252619/3873252621 [ 569.431710][T29031] tipc: Failed to remove unknown binding: 66,0,0/0:3873252619/3873252620 [ 569.522947][ T51] block nbd4: Receive control failed (result -107) [ 569.608276][T29061] x_tables: ip_tables: TPROXY target: used from hooks FORWARD, but only usable from PREROUTING [ 569.621646][T29057] netlink: Unknown conntrack attr (0) [ 569.852896][T29077] bond0: (slave wlan1): Releasing backup interface [ 569.862240][T29077] mac80211_hwsim hwsim49 wlan1 (unregistering): left promiscuous mode [ 569.871738][T29082] FAULT_INJECTION: forcing a failure. [ 569.871738][T29082] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 569.872295][T29077] mac80211_hwsim hwsim49 wlan1 (unregistering): left allmulticast mode [ 569.909533][T29082] CPU: 1 UID: 0 PID: 29082 Comm: syz.0.6947 Not tainted syzkaller #0 PREEMPT(full) [ 569.909558][T29082] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 569.909568][T29082] Call Trace: [ 569.909576][T29082] [ 569.909584][T29082] dump_stack_lvl+0xe8/0x150 [ 569.909612][T29082] should_fail_ex+0x412/0x560 [ 569.909634][T29082] _copy_from_user+0x2d/0xb0 [ 569.909656][T29082] ___sys_sendmsg+0x1c6/0x360 [ 569.909683][T29082] ? __pfx____sys_sendmsg+0x10/0x10 [ 569.909733][T29082] ? __fget_files+0x2a/0x420 [ 569.909752][T29082] ? __fget_files+0x3a0/0x420 [ 569.909792][T29082] __x64_sys_sendmsg+0x1bd/0x2a0 [ 569.909823][T29082] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 569.909854][T29082] ? __pfx_ksys_write+0x10/0x10 [ 569.909883][T29082] do_syscall_64+0x14d/0xf80 [ 569.909906][T29082] ? trace_irq_disable+0x3b/0x150 [ 569.909929][T29082] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 569.909946][T29082] ? clear_bhb_loop+0x40/0x90 [ 569.909967][T29082] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 569.909984][T29082] RIP: 0033:0x7fe6dc59c629 [ 569.910002][T29082] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 569.910016][T29082] RSP: 002b:00007fe6dd3cf028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 569.910034][T29082] RAX: ffffffffffffffda RBX: 00007fe6dc815fa0 RCX: 00007fe6dc59c629 [ 569.910046][T29082] RDX: 0000000000000000 RSI: 00002000000001c0 RDI: 0000000000000003 [ 569.910056][T29082] RBP: 00007fe6dd3cf090 R08: 0000000000000000 R09: 0000000000000000 [ 569.910068][T29082] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 569.910079][T29082] R13: 00007fe6dc816038 R14: 00007fe6dc815fa0 R15: 00007fff1c2bd048 [ 569.910108][T29082] [ 570.309112][T29097] Cannot find add_set index 0 as target [ 570.370940][T29100] bond1: invalid ARP target 0.0.0.0 specified for addition [ 570.390431][T29100] bond1: option arp_ip_target: invalid value (0) [ 570.408492][T29100] bond1 (unregistering): Released all slaves [ 571.163968][T29165] Cannot find add_set index 0 as target [ 571.730648][T29190] x_tables: ip_tables: TPROXY target: used from hooks FORWARD, but only usable from PREROUTING [ 572.767643][T29197] Cannot find del_set index 65531 as target [ 572.808554][T29199] syzkaller0: entered promiscuous mode [ 572.814122][T29199] syzkaller0: entered allmulticast mode [ 572.967143][T29202] FAULT_INJECTION: forcing a failure. [ 572.967143][T29202] name failslab, interval 1, probability 0, space 0, times 0 [ 572.981209][T29202] CPU: 0 UID: 0 PID: 29202 Comm: syz.1.6990 Not tainted syzkaller #0 PREEMPT(full) [ 572.981234][T29202] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 572.981244][T29202] Call Trace: [ 572.981252][T29202] [ 572.981259][T29202] dump_stack_lvl+0xe8/0x150 [ 572.981287][T29202] should_fail_ex+0x412/0x560 [ 572.981311][T29202] should_failslab+0xa8/0x100 [ 572.981331][T29202] __kvmalloc_node_noprof+0x178/0x8a0 [ 572.981350][T29202] ? bpf_test_run_xdp_live+0x223/0x1cf0 [ 572.981370][T29202] ? __kvmalloc_node_noprof+0x393/0x8a0 [ 572.981392][T29202] bpf_test_run_xdp_live+0x223/0x1cf0 [ 572.981418][T29202] ? bpf_dispatcher_change_prog+0xae0/0xd70 [ 572.981457][T29202] ? __pfx_wait_rcu_exp_gp+0x10/0x10 [ 572.981482][T29202] ? __pfx_autoremove_wake_function+0x10/0x10 [ 572.981501][T29202] ? __pfx_bpf_test_run_xdp_live+0x10/0x10 [ 572.981535][T29202] ? 0xffffffffa0201818 [ 572.981549][T29202] ? 0xffffffffa0201a10 [ 572.981572][T29202] ? __pfx_xdp_test_run_init_page+0x10/0x10 [ 572.981589][T29202] ? _copy_from_user+0x94/0xb0 [ 572.981603][T29202] ? bpf_test_init+0x113/0x150 [ 572.981613][T29202] ? xdp_convert_md_to_buff+0x5b/0x330 [ 572.981625][T29202] bpf_prog_test_run_xdp+0x81c/0x1160 [ 572.981644][T29202] ? __pfx_bpf_prog_test_run_xdp+0x10/0x10 [ 572.981657][T29202] ? __fget_files+0x2a/0x420 [ 572.981673][T29202] ? __pfx_bpf_prog_test_run_xdp+0x10/0x10 [ 572.981685][T29202] bpf_prog_test_run+0x2c7/0x340 [ 572.981696][T29202] __sys_bpf+0x643/0x950 [ 572.981712][T29202] ? __pfx___sys_bpf+0x10/0x10 [ 572.981732][T29202] ? ksys_write+0x242/0x270 [ 572.981744][T29202] ? __pfx_ksys_write+0x10/0x10 [ 572.981757][T29202] __x64_sys_bpf+0x7c/0x90 [ 572.981771][T29202] do_syscall_64+0x14d/0xf80 [ 572.981785][T29202] ? trace_irq_disable+0x3b/0x150 [ 572.981799][T29202] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 572.981809][T29202] ? clear_bhb_loop+0x40/0x90 [ 572.981820][T29202] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 572.981830][T29202] RIP: 0033:0x7fe65e59c629 [ 572.981840][T29202] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 572.981848][T29202] RSP: 002b:00007fe65f46b028 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 572.981860][T29202] RAX: ffffffffffffffda RBX: 00007fe65e815fa0 RCX: 00007fe65e59c629 [ 572.981867][T29202] RDX: 0000000000000048 RSI: 0000200000000600 RDI: 000000000000000a [ 572.981873][T29202] RBP: 00007fe65f46b090 R08: 0000000000000000 R09: 0000000000000000 [ 572.981879][T29202] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 572.981885][T29202] R13: 00007fe65e816038 R14: 00007fe65e815fa0 R15: 00007ffdc2f60238 [ 572.981900][T29202] [ 573.924766][T29147] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 574.072436][T29213] xt_hashlimit: size too large, truncated to 1048576 [ 574.396926][T29237] __nla_validate_parse: 13 callbacks suppressed [ 574.396948][T29237] netlink: 4 bytes leftover after parsing attributes in process `syz.0.7001'. [ 574.543994][T29243] netlink: 4 bytes leftover after parsing attributes in process `syz.3.7003'. [ 574.786351][T29263] netlink: 12 bytes leftover after parsing attributes in process `syz.3.7011'. [ 574.966776][T29279] smc: net device team0 applied user defined pnetid SYZ2 [ 575.024122][T29285] netlink: 16 bytes leftover after parsing attributes in process `syz.2.7020'. [ 575.036823][T29285] netlink: 18 bytes leftover after parsing attributes in process `syz.2.7020'. [ 575.272248][T29302] gre0: entered promiscuous mode [ 575.278088][T29302] gre0: entered allmulticast mode [ 575.301721][T29307] IPVS: set_ctl: invalid protocol: 47 127.0.0.1:20001 [ 575.558889][T29325] netlink: 12 bytes leftover after parsing attributes in process `syz.3.7032'. [ 575.623942][ T51] block nbd5: Receive control failed (result -107) [ 575.773724][T29340] IPVS: Error connecting to the multicast addr [ 575.801403][T29340] geneve2: entered promiscuous mode [ 575.815446][T17994] netdevsim netdevsim4 eth0: set [1, 1] type 2 family 0 port 57666 - 0 [ 575.827185][T29344] netlink: 'syz.1.7039': attribute type 12 has an invalid length. [ 575.831413][T17994] netdevsim netdevsim4 eth1: set [1, 1] type 2 family 0 port 57666 - 0 [ 575.852704][T29340] netdevsim netdevsim4 eth3 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 575.863161][T29340] netdevsim netdevsim4 eth3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 575.917037][T29344] bond1: option primary_reselect: invalid value (255) [ 575.926520][T29344] bond1 (unregistering): Released all slaves [ 575.944392][T17994] netdevsim netdevsim4 eth2: set [1, 1] type 2 family 0 port 57666 - 0 [ 575.944589][T29353] netlink: 60 bytes leftover after parsing attributes in process `syz.3.7040'. [ 575.973397][T29352] netlink: 40 bytes leftover after parsing attributes in process `syz.1.7039'. [ 576.129012][T29358] x_tables: duplicate underflow at hook 3 [ 576.501218][T29380] Cannot find set identified by id 1 to match [ 576.512837][T29381] netlink: 60 bytes leftover after parsing attributes in process `syz.0.7054'. [ 576.608286][T29383] bridge0: port 2(bridge_slave_1) entered disabled state [ 576.616176][T29383] bridge0: port 1(bridge_slave_0) entered disabled state [ 576.671199][T29383] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 576.683878][T29390] netlink: 28 bytes leftover after parsing attributes in process `syz.2.7056'. [ 576.694536][T29383] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 576.718649][T29383] veth1_macvtap: left promiscuous mode [ 576.791099][T17994] netdevsim netdevsim2 eth0: unset [1, 0] type 2 family 0 port 20028 - 0 [ 576.829853][T17994] netdevsim netdevsim2 eth0: unset [1, 1] type 2 family 0 port 6081 - 0 [ 576.838256][T17994] netdevsim netdevsim2 eth1: unset [1, 0] type 2 family 0 port 20028 - 0 [ 576.896085][T17994] netdevsim netdevsim2 eth1: unset [1, 1] type 2 family 0 port 6081 - 0 [ 576.934673][T17994] netdevsim netdevsim2 eth2: unset [1, 0] type 2 family 0 port 20028 - 0 [ 576.965243][T17994] netdevsim netdevsim2 eth2: unset [1, 1] type 2 family 0 port 6081 - 0 [ 576.974203][T17994] netdevsim netdevsim2 eth3: unset [1, 0] type 2 family 0 port 20028 - 0 [ 576.983186][T17994] netdevsim netdevsim2 eth3: unset [1, 1] type 2 family 0 port 6081 - 0 [ 577.181491][T29419] FAULT_INJECTION: forcing a failure. [ 577.181491][T29419] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 577.215673][T29419] CPU: 1 UID: 0 PID: 29419 Comm: syz.0.7062 Not tainted syzkaller #0 PREEMPT(full) [ 577.215700][T29419] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 577.215711][T29419] Call Trace: [ 577.215719][T29419] [ 577.215727][T29419] dump_stack_lvl+0xe8/0x150 [ 577.215756][T29419] should_fail_ex+0x412/0x560 [ 577.215780][T29419] _copy_from_user+0x2d/0xb0 [ 577.215805][T29419] ___sys_sendmsg+0x1c6/0x360 [ 577.215835][T29419] ? __pfx____sys_sendmsg+0x10/0x10 [ 577.215891][T29419] ? __fget_files+0x2a/0x420 [ 577.215914][T29419] ? __fget_files+0x3a0/0x420 [ 577.215946][T29419] __x64_sys_sendmsg+0x1bd/0x2a0 [ 577.215972][T29419] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 577.216005][T29419] ? __pfx_ksys_write+0x10/0x10 [ 577.216034][T29419] do_syscall_64+0x14d/0xf80 [ 577.216056][T29419] ? trace_irq_disable+0x3b/0x150 [ 577.216080][T29419] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 577.216098][T29419] ? clear_bhb_loop+0x40/0x90 [ 577.216117][T29419] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 577.216135][T29419] RIP: 0033:0x7fe6dc59c629 [ 577.216152][T29419] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 577.216167][T29419] RSP: 002b:00007fe6dd38d028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 577.216185][T29419] RAX: ffffffffffffffda RBX: 00007fe6dc816180 RCX: 00007fe6dc59c629 [ 577.216198][T29419] RDX: 0000000000000080 RSI: 00002000000021c0 RDI: 0000000000000003 [ 577.216209][T29419] RBP: 00007fe6dd38d090 R08: 0000000000000000 R09: 0000000000000000 [ 577.216221][T29419] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 577.216231][T29419] R13: 00007fe6dc816218 R14: 00007fe6dc816180 R15: 00007fff1c2bd048 [ 577.216260][T29419] [ 577.734620][T29445] workqueue: name exceeds WQ_NAME_LEN. Truncating to: Ku crK:̥B| [ 577.773661][T29340] netdevsim netdevsim4 eth2 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 577.787275][T29340] netdevsim netdevsim4 eth2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 577.799902][T29340] netdevsim netdevsim4 eth2 (unregistering): unset [1, 1] type 2 family 0 port 57666 - 0 [ 577.874747][T29340] netdevsim netdevsim4 eth1 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 577.885780][T29340] netdevsim netdevsim4 eth1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 577.906288][T29340] netdevsim netdevsim4 eth1 (unregistering): unset [1, 1] type 2 family 0 port 57666 - 0 [ 577.995788][T29340] netdevsim netdevsim4 eth0 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 578.009707][T29340] netdevsim netdevsim4 eth0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 578.023257][T29340] netdevsim netdevsim4 eth0 (unregistering): unset [1, 1] type 2 family 0 port 57666 - 0 [ 578.204699][T17981] netdevsim netdevsim4 eth0: set [0, 0] type 1 family 0 port 8472 - 0 [ 578.234267][T17981] netdevsim netdevsim4 eth0: set [1, 0] type 2 family 0 port 57666 - 0 [ 578.264666][T17981] netdevsim netdevsim4 eth0: set [1, 1] type 2 family 0 port 6081 - 0 [ 578.333125][T17995] netdevsim netdevsim4 eth1: set [0, 0] type 1 family 0 port 8472 - 0 [ 578.348252][T17995] netdevsim netdevsim4 eth1: set [1, 0] type 2 family 0 port 57666 - 0 [ 578.357370][T17995] netdevsim netdevsim4 eth1: set [1, 1] type 2 family 0 port 6081 - 0 [ 578.431760][T17981] netdevsim netdevsim4 eth2: set [0, 0] type 1 family 0 port 8472 - 0 [ 578.456117][T29473] x_tables: unsorted entry at hook 3 [ 578.461587][T17981] netdevsim netdevsim4 eth2: set [1, 0] type 2 family 0 port 57666 - 0 [ 578.482359][T17981] netdevsim netdevsim4 eth2: set [1, 1] type 2 family 0 port 6081 - 0 [ 578.509659][T17981] netdevsim netdevsim4 eth3: set [0, 0] type 1 family 0 port 8472 - 0 [ 578.536739][T17981] netdevsim netdevsim4 eth3: set [1, 0] type 2 family 0 port 57666 - 0 [ 578.559833][T17981] netdevsim netdevsim4 eth3: set [1, 1] type 2 family 0 port 6081 - 0 [ 578.583861][T29478] Cannot find del_set index 65531 as target [ 578.921696][T29508] netlink: 'syz.1.7091': attribute type 1 has an invalid length. [ 578.930293][T29508] netlink: 'syz.1.7091': attribute type 1 has an invalid length. [ 579.029308][T29512] Cannot find set identified by id 1 to match [ 579.166116][T29519] Cannot find del_set index 65531 as target [ 579.464560][T29537] __nla_validate_parse: 7 callbacks suppressed [ 579.464583][T29537] netlink: 11562 bytes leftover after parsing attributes in process `syz.3.7101'. [ 579.621962][T29551] Cannot find set identified by id 1 to match [ 579.668442][T29554] Cannot find del_set index 65531 as target [ 579.730257][T29559] netlink: 4 bytes leftover after parsing attributes in process `syz.2.7111'. [ 579.826841][T29567] netlink: 16 bytes leftover after parsing attributes in process `syz.0.7114'. [ 579.861352][T29567] FAULT_INJECTION: forcing a failure. [ 579.861352][T29567] name failslab, interval 1, probability 0, space 0, times 0 [ 579.881794][T29567] CPU: 1 UID: 0 PID: 29567 Comm: syz.0.7114 Not tainted syzkaller #0 PREEMPT(full) [ 579.881821][T29567] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 579.881832][T29567] Call Trace: [ 579.881839][T29567] [ 579.881848][T29567] dump_stack_lvl+0xe8/0x150 [ 579.881879][T29567] should_fail_ex+0x412/0x560 [ 579.881905][T29567] should_failslab+0xa8/0x100 [ 579.881927][T29567] __kmalloc_noprof+0xe8/0x760 [ 579.881946][T29567] ? unregister_netdevice_many_notify+0xc24/0x2370 [ 579.881972][T29567] unregister_netdevice_many_notify+0xc24/0x2370 [ 579.882005][T29567] ? __pfx_unregister_netdevice_many_notify+0x10/0x10 [ 579.882044][T29567] unregister_netdevice_queue+0x31f/0x360 [ 579.882074][T29567] ? __pfx_unregister_netdevice_queue+0x10/0x10 [ 579.882118][T29567] _cfg80211_unregister_wdev+0x155/0x570 [ 579.882146][T29567] ieee80211_if_remove+0x246/0x300 [ 579.882172][T29567] ieee80211_del_iface+0x19/0x30 [ 579.882191][T29567] cfg80211_remove_virtual_intf+0x221/0x420 [ 579.882217][T29567] genl_family_rcv_msg_doit+0x22a/0x330 [ 579.882249][T29567] ? __pfx_genl_family_rcv_msg_doit+0x10/0x10 [ 579.882287][T29567] ? bpf_lsm_capable+0x9/0x20 [ 579.882308][T29567] ? security_capable+0x7e/0x2c0 [ 579.882334][T29567] genl_rcv_msg+0x61c/0x7a0 [ 579.882365][T29567] ? __pfx_genl_rcv_msg+0x10/0x10 [ 579.882387][T29567] ? __pfx_nl80211_pre_doit+0x10/0x10 [ 579.882403][T29567] ? __pfx_nl80211_del_interface+0x10/0x10 [ 579.882420][T29567] ? __pfx_nl80211_post_doit+0x10/0x10 [ 579.882437][T29567] ? __lock_acquire+0x6b5/0x2cf0 [ 579.882470][T29567] netlink_rcv_skb+0x232/0x4b0 [ 579.882492][T29567] ? __pfx_genl_rcv_msg+0x10/0x10 [ 579.882517][T29567] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 579.882556][T29567] ? down_read+0x272/0x2e0 [ 579.882573][T29567] ? genl_rcv+0xd/0x40 [ 579.882597][T29567] genl_rcv+0x28/0x40 [ 579.882619][T29567] netlink_unicast+0x80f/0x9b0 [ 579.882646][T29567] ? __pfx_netlink_unicast+0x10/0x10 [ 579.882667][T29567] ? netlink_sendmsg+0x650/0xb40 [ 579.882686][T29567] ? skb_put+0x11b/0x210 [ 579.882711][T29567] netlink_sendmsg+0x813/0xb40 [ 579.882749][T29567] ? __pfx_netlink_sendmsg+0x10/0x10 [ 579.882773][T29567] ? aa_sock_msg_perm+0xf1/0x1b0 [ 579.882796][T29567] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 579.882820][T29567] ? __pfx_netlink_sendmsg+0x10/0x10 [ 579.882839][T29567] ____sys_sendmsg+0xa68/0xad0 [ 579.882873][T29567] ? __pfx_____sys_sendmsg+0x10/0x10 [ 579.882905][T29567] ? import_iovec+0x73/0xa0 [ 579.882932][T29567] ___sys_sendmsg+0x2a5/0x360 [ 579.882962][T29567] ? __pfx____sys_sendmsg+0x10/0x10 [ 579.883022][T29567] ? __fget_files+0x2a/0x420 [ 579.883044][T29567] ? __fget_files+0x3a0/0x420 [ 579.883091][T29567] __x64_sys_sendmsg+0x1bd/0x2a0 [ 579.883124][T29567] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 579.883157][T29567] ? __pfx_ksys_write+0x10/0x10 [ 579.883187][T29567] do_syscall_64+0x14d/0xf80 [ 579.883215][T29567] ? trace_irq_disable+0x3b/0x150 [ 579.883238][T29567] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 579.883256][T29567] ? clear_bhb_loop+0x40/0x90 [ 579.883278][T29567] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 579.883295][T29567] RIP: 0033:0x7fe6dc59c629 [ 579.883313][T29567] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 579.883328][T29567] RSP: 002b:00007fe6dd3cf028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 579.883349][T29567] RAX: ffffffffffffffda RBX: 00007fe6dc815fa0 RCX: 00007fe6dc59c629 [ 579.883362][T29567] RDX: 0000000000000000 RSI: 00002000000001c0 RDI: 0000000000000003 [ 579.883373][T29567] RBP: 00007fe6dd3cf090 R08: 0000000000000000 R09: 0000000000000000 [ 579.883385][T29567] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 579.883395][T29567] R13: 00007fe6dc816038 R14: 00007fe6dc815fa0 R15: 00007fff1c2bd048 [ 579.883425][T29567] [ 580.538745][T29589] Cannot find set identified by id 1 to match [ 580.668340][T29595] syzkaller0: entered promiscuous mode [ 580.674023][T29595] syzkaller0: entered allmulticast mode [ 580.794545][T29601] netlink: 28 bytes leftover after parsing attributes in process `syz.2.7126'. [ 580.816172][T29601] netlink: 28 bytes leftover after parsing attributes in process `syz.2.7126'. [ 580.838927][T29601] netlink: 8 bytes leftover after parsing attributes in process `syz.2.7126'. [ 580.901458][T29607] netdevsim netdevsim3 eth3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 580.954981][T29613] pimreg3: entered allmulticast mode [ 581.003153][T29607] netdevsim netdevsim3 eth2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 581.094385][T29607] netdevsim netdevsim3 eth1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 581.170224][T29607] netdevsim netdevsim3 eth0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 581.267804][T29636] netlink: 40 bytes leftover after parsing attributes in process `syz.1.7135'. [ 581.304223][T29641] netlink: 88 bytes leftover after parsing attributes in process `syz.4.7134'. [ 581.319105][T29640] netlink: 176 bytes leftover after parsing attributes in process `syz.2.7136'. [ 581.338635][T29641] openvswitch: netlink: Key type 31 is not supported [ 581.348628][T29640] netlink: 32 bytes leftover after parsing attributes in process `syz.2.7136'. [ 581.348707][T17981] netdevsim netdevsim3 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 581.411730][T17981] netdevsim netdevsim3 eth1: set [1, 0] type 2 family 0 port 6081 - 0 [ 581.466073][T17981] netdevsim netdevsim3 eth2: set [1, 0] type 2 family 0 port 6081 - 0 [ 581.483867][T17981] netdevsim netdevsim3 eth3: set [1, 0] type 2 family 0 port 6081 - 0 [ 581.715514][T29668] xt_hashlimit: size too large, truncated to 1048576 [ 581.872493][T29680] netlink: 'syz.4.7147': attribute type 13 has an invalid length. [ 581.935368][T29682] netlink: 'syz.4.7147': attribute type 5 has an invalid length. [ 581.952210][T29682] netlink: 'syz.4.7147': attribute type 16 has an invalid length. [ 581.961023][T29682] netlink: 'syz.4.7147': attribute type 17 has an invalid length. [ 581.984455][ C1] bridge0: received packet on bridge_slave_1 with own address as source address (addr:aa:aa:aa:aa:aa:1c, vlan:0) [ 582.171156][T29682] bond0: left promiscuous mode [ 582.176061][T29682] bond_slave_0: left promiscuous mode [ 582.184030][T29682] bond_slave_1: left promiscuous mode [ 582.189836][T29682] mac80211_hwsim hwsim53 wlan1: left promiscuous mode [ 582.197991][T29682] 8021q: adding VLAN 0 to HW filter on device bond0 [ 582.207777][T29682] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 582.292743][T29700] netdevsim netdevsim4 eth3 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 582.310765][T29700] netdevsim netdevsim4 eth3 (unregistering): unset [1, 0] type 2 family 0 port 57666 - 0 [ 582.332909][T29700] netdevsim netdevsim4 eth3 (unregistering): unset [1, 1] type 2 family 0 port 6081 - 0 [ 582.401740][ C1] bridge0: received packet on bridge_slave_1 with own address as source address (addr:aa:aa:aa:aa:aa:1c, vlan:0) [ 582.447638][T29700] netdevsim netdevsim4 eth2 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 582.461792][T29700] netdevsim netdevsim4 eth2 (unregistering): unset [1, 0] type 2 family 0 port 57666 - 0 [ 582.493091][T29700] netdevsim netdevsim4 eth2 (unregistering): unset [1, 1] type 2 family 0 port 6081 - 0 [ 582.546219][T29700] netdevsim netdevsim4 eth1 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 582.566824][T29700] netdevsim netdevsim4 eth1 (unregistering): unset [1, 0] type 2 family 0 port 57666 - 0 [ 582.578699][T29700] netdevsim netdevsim4 eth1 (unregistering): unset [1, 1] type 2 family 0 port 6081 - 0 [ 582.668738][T29700] netdevsim netdevsim4 eth0 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 582.697276][T29726] xt_hashlimit: size too large, truncated to 1048576 [ 582.699346][T29700] netdevsim netdevsim4 eth0 (unregistering): unset [1, 0] type 2 family 0 port 57666 - 0 [ 582.730100][T29700] netdevsim netdevsim4 eth0 (unregistering): unset [1, 1] type 2 family 0 port 6081 - 0 [ 583.052274][T17981] netdevsim netdevsim4 eth0: set [0, 0] type 1 family 0 port 8472 - 0 [ 583.062477][T17981] netdevsim netdevsim4 eth0: set [1, 0] type 2 family 0 port 57666 - 0 [ 583.077001][T17981] netdevsim netdevsim4 eth0: set [1, 1] type 2 family 0 port 6081 - 0 [ 583.111887][T29737] geneve2: entered promiscuous mode [ 583.119961][T17981] netdevsim netdevsim4 eth1: set [0, 0] type 1 family 0 port 8472 - 0 [ 583.130243][T17981] netdevsim netdevsim4 eth1: set [1, 0] type 2 family 0 port 57666 - 0 [ 583.140651][T17981] netdevsim netdevsim4 eth1: set [1, 1] type 2 family 0 port 6081 - 0 [ 583.149393][T17981] netdevsim netdevsim3 eth0: set [1, 1] type 2 family 0 port 50962 - 0 [ 583.173855][T17981] netdevsim netdevsim3 eth1: set [1, 1] type 2 family 0 port 50962 - 0 [ 583.196014][T17981] netdevsim netdevsim3 eth2: set [1, 1] type 2 family 0 port 50962 - 0 [ 583.214229][T17981] netdevsim netdevsim3 eth3: set [1, 1] type 2 family 0 port 50962 - 0 [ 583.233624][T17981] netdevsim netdevsim4 eth2: set [0, 0] type 1 family 0 port 8472 - 0 [ 583.276341][T17981] netdevsim netdevsim4 eth2: set [1, 0] type 2 family 0 port 57666 - 0 [ 583.313920][T17981] netdevsim netdevsim4 eth2: set [1, 1] type 2 family 0 port 6081 - 0 [ 583.355411][T17981] netdevsim netdevsim4 eth3: set [0, 0] type 1 family 0 port 8472 - 0 [ 583.383882][T17981] netdevsim netdevsim4 eth3: set [1, 0] type 2 family 0 port 57666 - 0 [ 583.401029][T29764] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 583.421248][T17981] netdevsim netdevsim4 eth3: set [1, 1] type 2 family 0 port 6081 - 0 [ 583.687314][T29785] xt_hashlimit: size too large, truncated to 1048576 [ 583.898152][T29791] pim6reg1: entered promiscuous mode [ 583.916023][T29791] pim6reg1: entered allmulticast mode [ 583.963474][T11524] lec:lec_start_xmit: lec0:No lecd attached [ 584.085495][T29800] xt_hashlimit: size too large, truncated to 1048576 [ 584.204253][T29804] bond2: option arp_validate: mode dependency failed, not supported in mode balance-alb(6) [ 584.416011][T29804] bond2 (unregistering): Released all slaves [ 584.520907][T29819] __nla_validate_parse: 14 callbacks suppressed [ 584.520928][T29819] netlink: 40 bytes leftover after parsing attributes in process `syz.0.7185'. [ 584.568908][T29823] x_tables: ip_tables: TPROXY target: used from hooks FORWARD, but only usable from PREROUTING [ 584.621104][T29819] erspan0: entered promiscuous mode [ 584.642930][T29819] erspan0: entered allmulticast mode [ 584.756775][T29831] netlink: 'syz.4.7192': attribute type 3 has an invalid length. [ 584.823376][T29831] netlink: 'syz.4.7192': attribute type 1 has an invalid length. [ 584.835075][T29831] netlink: 184 bytes leftover after parsing attributes in process `syz.4.7192'. [ 584.844982][T29831] netlink: 'syz.4.7192': attribute type 1 has an invalid length. [ 584.862907][T29831] netlink: 12 bytes leftover after parsing attributes in process `syz.4.7192'. [ 585.003832][T29848] netlink: 20 bytes leftover after parsing attributes in process `syz.1.7194'. [ 585.065135][T29848] x_tables: (null)_tables: SNAT target: only valid in nat table, not syz0 [ 585.088194][T29850] netlink: 36 bytes leftover after parsing attributes in process `syz.4.7198'. [ 585.116919][T29852] xt_hashlimit: size too large, truncated to 1048576 [ 585.509664][T29868] x_tables: ip_tables: TPROXY target: used from hooks FORWARD, but only usable from PREROUTING [ 585.521563][T29866] atomic_op ffff88807ae7c198 conn xmit_atomic 0000000000000000 [ 585.684983][T29860] netlink: 132 bytes leftover after parsing attributes in process `syz.0.7199'. [ 585.857191][T29885] netlink: 28 bytes leftover after parsing attributes in process `syz.4.7209'. [ 585.869592][T29885] netlink: 28 bytes leftover after parsing attributes in process `syz.4.7209'. [ 585.878780][T29885] netlink: 8 bytes leftover after parsing attributes in process `syz.4.7209'. [ 586.000583][T29894] lo speed is unknown, defaulting to 1000 [ 586.006588][T29894] lo speed is unknown, defaulting to 1000 [ 586.012928][T29895] x_tables: ip_tables: TPROXY target: used from hooks FORWARD, but only usable from PREROUTING [ 586.026593][T29894] lo speed is unknown, defaulting to 1000 [ 586.041745][T29894] iwpm_register_pid: Unable to send a nlmsg (client = 2) [ 586.099339][T29894] infiniband syz0: RDMA CMA: cma_listen_on_dev, error -98 [ 586.153267][T29894] lo speed is unknown, defaulting to 1000 [ 586.155788][T29906] RDS: rds_bind could not find a transport for ::ffff:172.30.0.5, load rds_tcp or rds_rdma? [ 586.181200][T29894] lo speed is unknown, defaulting to 1000 [ 586.188937][T29894] lo speed is unknown, defaulting to 1000 [ 586.197811][T29894] lo speed is unknown, defaulting to 1000 [ 586.248181][T29894] lo speed is unknown, defaulting to 1000 [ 586.266846][T29894] lo speed is unknown, defaulting to 1000 [ 586.275543][T29894] lo speed is unknown, defaulting to 1000 [ 586.284003][T29894] lo speed is unknown, defaulting to 1000 [ 586.403327][T29925] netdevsim netdevsim3 eth3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 586.432326][T29925] netdevsim netdevsim3 eth3 (unregistering): unset [1, 1] type 2 family 0 port 50962 - 0 [ 586.506799][T29925] netdevsim netdevsim3 eth2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 586.527057][T29925] netdevsim netdevsim3 eth2 (unregistering): unset [1, 1] type 2 family 0 port 50962 - 0 [ 586.554196][T29933] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 586.572357][T29925] netdevsim netdevsim3 eth1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 586.586156][T29925] netdevsim netdevsim3 eth1 (unregistering): unset [1, 1] type 2 family 0 port 50962 - 0 [ 586.637095][T29939] netlink: 24 bytes leftover after parsing attributes in process `syz.2.7228'. [ 586.658099][T29925] netdevsim netdevsim3 eth0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 586.669325][T29925] netdevsim netdevsim3 eth0 (unregistering): unset [1, 1] type 2 family 0 port 50962 - 0 [ 586.755828][T17994] netdevsim netdevsim3 eth0: set [1, 0] type 2 family 0 port 50962 - 0 [ 586.766444][T17994] netdevsim netdevsim3 eth0: set [1, 1] type 2 family 0 port 6081 - 0 [ 586.786296][T17994] netdevsim netdevsim3 eth1: set [1, 0] type 2 family 0 port 50962 - 0 [ 586.794987][T17994] netdevsim netdevsim3 eth1: set [1, 1] type 2 family 0 port 6081 - 0 [ 586.820944][T17994] netdevsim netdevsim3 eth2: set [1, 0] type 2 family 0 port 50962 - 0 [ 586.831480][T17994] netdevsim netdevsim3 eth2: set [1, 1] type 2 family 0 port 6081 - 0 [ 586.887548][T29949] netlink: 'syz.2.7232': attribute type 5 has an invalid length. [ 586.909397][T17994] netdevsim netdevsim3 eth3: set [1, 0] type 2 family 0 port 50962 - 0 [ 586.941839][T17994] netdevsim netdevsim3 eth3: set [1, 1] type 2 family 0 port 6081 - 0 [ 586.950741][T17994] netdevsim netdevsim2 eth0: set [0, 0] type 1 family 0 port 8472 - 0 [ 586.959096][T17994] netdevsim netdevsim2 eth1: set [0, 0] type 1 family 0 port 8472 - 0 [ 586.967722][T17994] netdevsim netdevsim2 eth2: set [0, 0] type 1 family 0 port 8472 - 0 [ 586.984304][T17994] netdevsim netdevsim2 eth3: set [0, 0] type 1 family 0 port 8472 - 0 [ 587.188877][T29964] gretap0: entered promiscuous mode [ 587.235504][ T5843] lo speed is unknown, defaulting to 1000 [ 587.242282][ T5907] lo speed is unknown, defaulting to 1000 [ 587.248140][ T5843] syz0: Port: 1 Link DOWN [ 587.426538][T29982] netdevsim netdevsim0 eth3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 587.468737][T29977] syzkaller0: entered promiscuous mode [ 587.484212][T29977] syzkaller0: entered allmulticast mode [ 587.530995][T29982] netdevsim netdevsim0 eth2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 587.625766][T29982] netdevsim netdevsim0 eth1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 587.709954][T29982] netdevsim netdevsim0 eth0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 587.714266][T29998] x_tables: ip_tables: TPROXY target: used from hooks FORWARD, but only usable from PREROUTING [ 587.791801][T30002] Cannot find del_set index 65531 as target [ 587.821812][T17981] netdevsim netdevsim0 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 587.862481][ T5960] netdevsim netdevsim0 eth1: set [1, 0] type 2 family 0 port 6081 - 0 [ 587.884923][T17981] netdevsim netdevsim0 eth2: set [1, 0] type 2 family 0 port 6081 - 0 [ 587.925336][ T5960] netdevsim netdevsim0 eth3: set [1, 0] type 2 family 0 port 6081 - 0 [ 588.097915][T30019] netlink: 'syz.2.7260': attribute type 7 has an invalid length. [ 588.119791][T30019] netlink: 'syz.2.7260': attribute type 8 has an invalid length. [ 588.496249][T30056] delete_channel: no stack [ 588.614629][T30067] syzkaller0: entered promiscuous mode [ 588.620980][T30067] syzkaller0: entered allmulticast mode [ 588.678731][T30071] openvswitch: netlink: Missing key (keys=40, expected=100) [ 588.688519][T30072] openvswitch: netlink: Missing key (keys=40, expected=100) [ 588.979764][ C0] lec0: NETDEV WATCHDOG: CPU: 0: transmit queue 0 timed out 5010 ms [ 588.987795][ C0] lec:lec_tx_timeout: lec0 [ 589.993999][T30139] __nla_validate_parse: 13 callbacks suppressed [ 589.994018][T30139] netlink: 36 bytes leftover after parsing attributes in process `syz.0.7300'. [ 590.151666][T30149] netlink: 'syz.2.7305': attribute type 1 has an invalid length. [ 590.202682][T30154] netlink: 36 bytes leftover after parsing attributes in process `syz.2.7305'. [ 590.236531][T30149] bond1: entered promiscuous mode [ 590.242345][T30149] 8021q: adding VLAN 0 to HW filter on device bond1 [ 590.306355][T30146] netlink: 8 bytes leftover after parsing attributes in process `syz.4.7304'. [ 590.322969][T30146] ksmbd: Daemon and kernel module version mismatch. ksmbd: 0, kernel module: 1. User-space ksmbd should terminate. [ 590.381064][T30146] netlink: 'syz.4.7304': attribute type 13 has an invalid length. [ 590.458209][ C0] bridge0: received packet on bridge_slave_1 with own address as source address (addr:aa:aa:aa:aa:aa:1c, vlan:0) [ 590.540489][T30151] macvtap1: entered promiscuous mode [ 590.553513][T30151] macvtap1: entered allmulticast mode [ 590.569768][T30151] veth1_vlan: entered allmulticast mode [ 590.600044][T30170] netlink: 8 bytes leftover after parsing attributes in process `syz.2.7309'. [ 590.601258][T30172] netlink: 9 bytes leftover after parsing attributes in process `syz.1.7311'. [ 590.628787][T30151] macvtap2: entered promiscuous mode [ 590.635350][T30151] macvtap2: entered allmulticast mode [ 590.656855][T30172] gretap0: entered promiscuous mode [ 590.696442][T30172] gretap0: left promiscuous mode [ 590.720010][T30172] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 590.872068][T30187] smc: removing net device team0 with user defined pnetid SYZ2 [ 590.927002][T30187] team0 (unregistering): Port device team_slave_0 removed [ 590.945278][T30194] netlink: 4 bytes leftover after parsing attributes in process `syz.2.7314'. [ 590.990550][ C0] bridge0: received packet on bridge_slave_1 with own address as source address (addr:aa:aa:aa:aa:aa:1c, vlan:0) [ 591.024986][T30187] team0 (unregistering): Port device team_slave_1 removed [ 591.061920][T30196] netlink: 28 bytes leftover after parsing attributes in process `syz.1.7317'. [ 591.072221][T30196] netlink: 28 bytes leftover after parsing attributes in process `syz.1.7317'. [ 591.099769][T30196] netlink: 8 bytes leftover after parsing attributes in process `syz.1.7317'. [ 591.522427][T30239] Cannot find del_set index 65531 as target [ 591.598953][T30243] netlink: 4 bytes leftover after parsing attributes in process `syz.3.7330'. [ 591.640470][T30245] netlink: 'syz.4.7331': attribute type 4 has an invalid length. [ 591.787553][T30257] x_tables: unsorted entry at hook 3 [ 591.814746][T30260] netlink: 'syz.3.7338': attribute type 2 has an invalid length. [ 591.962115][T30272] Cannot find del_set index 65531 as target [ 592.144291][T30285] netlink: 'syz.3.7345': attribute type 83 has an invalid length. [ 592.264976][T30293] tunl0: entered promiscuous mode [ 592.285336][T30293] netlink: 'syz.0.7347': attribute type 3 has an invalid length. [ 592.435356][T30309] netlink: 'syz.1.7354': attribute type 1 has an invalid length. [ 592.604979][T30323] xt_hashlimit: size too large, truncated to 1048576 [ 593.126648][T30349] input: Bluetooth HID Boot Protocol Device as /devices/virtual/bluetooth/hci4/hci4:200/input5 [ 593.305987][T30365] macvlan0: entered promiscuous mode [ 593.352933][T30365] [ 593.355306][T30365] ====================================================== [ 593.362326][T30365] WARNING: possible circular locking dependency detected [ 593.369366][T30365] syzkaller #0 Not tainted [ 593.373787][T30365] ------------------------------------------------------ [ 593.380818][T30365] syz.2.7374/30365 is trying to acquire lock: [ 593.386900][T30365] ffffffff8fd47c58 (nr_neigh_list_lock){+...}-{3:3}, at: nr_del_node+0x57d/0xbb0 [ 593.396069][T30365] [ 593.396069][T30365] but task is already holding lock: [ 593.403422][T30365] ffff88805171da70 (&nr_node->node_lock){+...}-{3:3}, at: nr_del_node+0x2a9/0xbb0 [ 593.412653][T30365] [ 593.412653][T30365] which lock already depends on the new lock. [ 593.412653][T30365] [ 593.423043][T30365] [ 593.423043][T30365] the existing dependency chain (in reverse order) is: [ 593.432038][T30365] [ 593.432038][T30365] -> #2 (&nr_node->node_lock){+...}-{3:3}: [ 593.440016][T30365] _raw_spin_lock_bh+0x36/0x50 [ 593.445298][T30365] nr_rt_device_down+0x153/0x860 [ 593.450752][T30365] nr_device_event+0x137/0x150 [ 593.456034][T30365] notifier_call_chain+0x1be/0x400 [ 593.461660][T30365] __dev_notify_flags+0x16d/0x310 [ 593.467199][T30365] netif_change_flags+0xe8/0x1a0 [ 593.472646][T30365] dev_change_flags+0x130/0x260 [ 593.478009][T30365] dev_ioctl+0x7b4/0x1150 [ 593.482854][T30365] sock_do_ioctl+0x23e/0x320 [ 593.487955][T30365] sock_ioctl+0x5c6/0x7f0 [ 593.492797][T30365] __se_sys_ioctl+0xfc/0x170 [ 593.497905][T30365] do_syscall_64+0x14d/0xf80 [ 593.503007][T30365] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 593.509409][T30365] [ 593.509409][T30365] -> #1 (nr_node_list_lock){+...}-{3:3}: [ 593.517221][T30365] _raw_spin_lock_bh+0x36/0x50 [ 593.522495][T30365] nr_rt_device_down+0xbe/0x860 [ 593.527856][T30365] nr_device_event+0x137/0x150 [ 593.533143][T30365] notifier_call_chain+0x1be/0x400 [ 593.538772][T30365] __dev_notify_flags+0x16d/0x310 [ 593.544306][T30365] netif_change_flags+0xe8/0x1a0 [ 593.549753][T30365] dev_change_flags+0x130/0x260 [ 593.555120][T30365] dev_ioctl+0x7b4/0x1150 [ 593.559961][T30365] sock_do_ioctl+0x23e/0x320 [ 593.565066][T30365] sock_ioctl+0x5c6/0x7f0 [ 593.569900][T30365] __se_sys_ioctl+0xfc/0x170 [ 593.575085][T30365] do_syscall_64+0x14d/0xf80 [ 593.580626][T30365] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 593.587038][T30365] [ 593.587038][T30365] -> #0 (nr_neigh_list_lock){+...}-{3:3}: [ 593.594934][T30365] __lock_acquire+0x15a5/0x2cf0 [ 593.600388][T30365] lock_acquire+0xf0/0x2e0 [ 593.605312][T30365] _raw_spin_lock_bh+0x36/0x50 [ 593.610604][T30365] nr_del_node+0x57d/0xbb0 [ 593.615538][T30365] nr_rt_ioctl+0xb34/0xf90 [ 593.620474][T30365] sock_do_ioctl+0x101/0x320 [ 593.626009][T30365] sock_ioctl+0x5c6/0x7f0 [ 593.630850][T30365] __se_sys_ioctl+0xfc/0x170 [ 593.635952][T30365] do_syscall_64+0x14d/0xf80 [ 593.641056][T30365] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 593.647549][T30365] [ 593.647549][T30365] other info that might help us debug this: [ 593.647549][T30365] [ 593.657764][T30365] Chain exists of: [ 593.657764][T30365] nr_neigh_list_lock --> nr_node_list_lock --> &nr_node->node_lock [ 593.657764][T30365] [ 593.659659][ C1] ip6_tunnel: ip6gretap0 xmit: Local address not yet configured! [ 593.671577][T30365] Possible unsafe locking scenario: [ 593.671577][T30365] [ 593.671586][T30365] CPU0 CPU1 [ 593.671593][T30365] ---- ---- [ 593.671600][T30365] lock(&nr_node->node_lock); [ 593.702248][T30365] lock(nr_node_list_lock); [ 593.709537][T30365] lock(&nr_node->node_lock); [ 593.716832][T30365] lock(nr_neigh_list_lock); [ 593.721498][T30365] [ 593.721498][T30365] *** DEADLOCK *** [ 593.721498][T30365] [ 593.729626][T30365] 2 locks held by syz.2.7374/30365: [ 593.734805][T30365] #0: ffffffff8fd47cb8 (nr_node_list_lock){+...}-{3:3}, at: nr_del_node+0x253/0xbb0 [ 593.744292][T30365] #1: ffff88805171da70 (&nr_node->node_lock){+...}-{3:3}, at: nr_del_node+0x2a9/0xbb0 [ 593.753945][T30365] [ 593.753945][T30365] stack backtrace: [ 593.759826][T30365] CPU: 0 UID: 0 PID: 30365 Comm: syz.2.7374 Not tainted syzkaller #0 PREEMPT(full) [ 593.759847][T30365] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 593.759858][T30365] Call Trace: [ 593.759866][T30365] [ 593.759873][T30365] dump_stack_lvl+0xe8/0x150 [ 593.759897][T30365] print_circular_bug+0x2e1/0x300 [ 593.759923][T30365] check_noncircular+0x12e/0x150 [ 593.759947][T30365] __lock_acquire+0x15a5/0x2cf0 [ 593.759973][T30365] lock_acquire+0xf0/0x2e0 [ 593.759990][T30365] ? nr_del_node+0x57d/0xbb0 [ 593.760013][T30365] ? nr_del_node+0x247/0xbb0 [ 593.760035][T30365] ? nr_del_node+0x57d/0xbb0 [ 593.760056][T30365] _raw_spin_lock_bh+0x36/0x50 [ 593.760076][T30365] ? nr_del_node+0x57d/0xbb0 [ 593.760097][T30365] nr_del_node+0x57d/0xbb0 [ 593.760120][T30365] nr_rt_ioctl+0xb34/0xf90 [ 593.760145][T30365] ? kasan_quarantine_put+0xbb/0x1f0 [ 593.760159][T30365] ? __pfx_nr_rt_ioctl+0x10/0x10 [ 593.760185][T30365] ? apparmor_capable+0x137/0x1a0 [ 593.760208][T30365] ? capable+0x88/0xe0 [ 593.760227][T30365] ? nr_ioctl+0x1b1/0x3b0 [ 593.760246][T30365] sock_do_ioctl+0x101/0x320 [ 593.760263][T30365] ? __pfx_sock_do_ioctl+0x10/0x10 [ 593.760277][T30365] ? do_futex+0x395/0x420 [ 593.760301][T30365] sock_ioctl+0x5c6/0x7f0 [ 593.760316][T30365] ? __pfx_sock_ioctl+0x10/0x10 [ 593.760330][T30365] ? __fget_files+0x2a/0x420 [ 593.760352][T30365] ? __fget_files+0x3a0/0x420 [ 593.760371][T30365] ? __fget_files+0x2a/0x420 [ 593.760392][T30365] ? bpf_lsm_file_ioctl+0x9/0x20 [ 593.760409][T30365] ? __pfx_sock_ioctl+0x10/0x10 [ 593.760423][T30365] __se_sys_ioctl+0xfc/0x170 [ 593.760440][T30365] do_syscall_64+0x14d/0xf80 [ 593.760463][T30365] ? trace_irq_disable+0x3b/0x150 [ 593.760484][T30365] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 593.760499][T30365] ? clear_bhb_loop+0x40/0x90 [ 593.760515][T30365] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 593.760531][T30365] RIP: 0033:0x7f9482d9c629 [ 593.760546][T30365] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 593.760561][T30365] RSP: 002b:00007f9480ff6028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 593.760577][T30365] RAX: ffffffffffffffda RBX: 00007f9483015fa0 RCX: 00007f9482d9c629 [ 593.760589][T30365] RDX: 0000200000000140 RSI: 000000000000890c RDI: 0000000000000004 [ 593.760600][T30365] RBP: 00007f9482e32b39 R08: 0000000000000000 R09: 0000000000000000 [ 593.760610][T30365] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 593.760620][T30365] R13: 00007f9483016038 R14: 00007f9483015fa0 R15: 00007fff19534048 [ 593.760637][T30365] [ 596.049793][T27102] Bluetooth: hci2: command 0x0406 tx timeout