last executing test programs: 3.740733014s ago: executing program 0 (id=2376): r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)=@base={0xe, 0x4, 0x8, 0x1, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0}, 0x50) openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) r1 = socket$inet_sctp(0x2, 0x1, 0x84) getsockopt$inet_sctp_SCTP_MAX_BURST(r1, 0x84, 0xd, &(0x7f0000000000)=@assoc_value, &(0x7f0000000100)=0x8) r2 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r3 = openat$cgroup_ro(r2, &(0x7f0000000200)='blkio.throttle.io_serviced_recursive\x00', 0x275a, 0x0) ioctl$FS_IOC_RESVSP(r3, 0x40305828, &(0x7f0000000080)={0x0, 0x0, 0x1, 0x80002}) bpf$PROG_LOAD(0x5, &(0x7f0000000100)={0x2, 0x9, &(0x7f0000000200)=@raw=[@generic={0xbf, 0x2, 0xa}, @generic={0x7, 0x2, 0x0, 0x0, 0xfffffffc}, @generic={0xbf, 0x3, 0xa}, @generic={0x7, 0x3, 0x0, 0x0, 0xfffffff0}, @map_fd={0x18, 0x1, 0x1, 0x0, r0}, @generic={0xb7, 0x4}, @generic={0x85, 0x0, 0x0, 0x0, 0x2}, @generic={0x95}], &(0x7f0000000300)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0x0, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0}, 0x94) 3.493490816s ago: executing program 0 (id=2380): r0 = openat$nci(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) setsockopt$inet6_udp_int(r1, 0x11, 0x67, &(0x7f0000000240)=0x5, 0x4) connect$inet6(r1, &(0x7f0000000000)={0xa, 0xfffe, 0x8, @mcast2, 0x9}, 0x1c) sendmmsg$inet6(r1, &(0x7f0000003cc0)=[{{0x0, 0x171, &(0x7f0000003980), 0x171}}], 0x400000000000172, 0x4001c00) r2 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$nfc(&(0x7f0000000100), r2) syz_emit_ethernet(0xb6, &(0x7f0000000d40)={@multicast, @remote, @void, {@ipv6={0x86dd, @tipc_packet={0x8, 0x6, "98ce9c", 0x80, 0x6, 0x1, @mcast2, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02', {[@hopopts={0x3b}, @hopopts={0x2b, 0x8, '\x00', [@hao={0xc9, 0x10, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}}, @enc_lim={0x4, 0x1, 0x7}, @enc_lim={0x4, 0x1, 0x94}, @enc_lim={0x4, 0x1, 0x9}, @calipso={0x7, 0x20, {0x3, 0x6, 0xb2, 0x0, [0xc5c31af, 0x8001, 0x0]}}, @jumbo={0xc2, 0x4, 0x1}]}], @name_distributor={{0x28, 0x0, 0x0, 0x0, 0x1, 0xa, 0xb, 0x2, 0x400, 0x0, 0x1, 0x6, 0x0, 0x2, 0x4e23, 0x4e22, 0x0, 0x3, 0x0, 0x0, 0x1}}}}}}}, 0x0) r4 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) ioctl$TUNSETIFF(r4, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) write$tun(r4, &(0x7f0000000480)=ANY=[@ANYBLOB="0000080001050700ffff80000600"], 0x96) ioctl$IOCTL_GET_NCIDEV_IDX(r0, 0x0, &(0x7f00000000c0)=0x0) sendmsg$NFC_CMD_DEV_UP(r2, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000d80)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r3, @ANYBLOB="010426bd7000f8dbdf250200000008000100", @ANYRES32=r5], 0x1c}}, 0x4008054) sendmsg$NFC_CMD_LLC_GET_PARAMS(r2, &(0x7f0000000240)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000000180)={&(0x7f0000000140)={0x28, r3, 0x1, 0x70bd29, 0x25dfdbfc, {}, [@NFC_ATTR_FIRMWARE_NAME={0x14, 0x14, ' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02'}]}, 0x28}, 0x1, 0x0, 0x0, 0x4000000}, 0x8) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000400)={0xffffffffffffffff, 0xffffffffffffffff}) sendto$unix(r6, &(0x7f0000000240)='\x00', 0x1, 0x4040081, 0x0, 0x0) recvfrom$unix(r7, 0x0, 0x23, 0x40000011, 0x0, 0x0) r8 = bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x3, 0x8, &(0x7f00000026c0)=ANY=[@ANYBLOB="620af8ff0c200021bfa100000000000007010000f8ffffffb702000003000000bd1200000000000085000000d0000000b70000000000000095000000000000003fba6a7d36d9b18ed812a2e2c49e8020a6f4e0e4a9446ca2b5f1cc1a100a9af698393aa0f3881f9c24aa56f15199fad0093c59d66b5ece9f36c70d0f010c5077da80fb982c1e9400c603146cea484a415b76966118b64f751a0f241b072e90080008002d75593a280000c93e64c227c95aa0b784625704f07a72c2918451ebdcf4cef7f9606056fe5c34665c0af9360a1f7a5e6b607130c89f18c0c1089d8b85880000c29c48b45ef4adf634be763288d01aa27ae8b09e13e79ab20b0b8ed8fb7a68af2ad0000000000000006f803c6468082089b302d7bff8f06f7f918d65eae391cb41336023cdcedb5e0125ebbccbddcf10cb2364149215108355ee570f8078be5cab389cd65e7133719acd97cfa107d40224edc5465a932b77e74e712a0d42bc6099ad23000000803a90bce6dc3a13871765df961c2ed3b1006ef6c1ff0900000000000010c63a949e8b7955394ffa82b8e942c89112f40cab87b1586602d985430cea0162ab3fcf4591c926abfb076719237c8d0e60b0eea24492a660583eecdbf5bcd3de3a83209da17a0faf60fd6ad9b97aa5fa68480366c9c6fd6fa5043aa3926b81e3b59c9f081d6a08000000ea2b1a52496dfcaf99431412fd13f4cec49669e443dcb924cfe5f3185418d60532be9c4d2ec7c32f2095e63c8cdc28f74d043ef8dba2f23b01a9ae44cf945b7632f32030916f89c6dad7603f2ba2a790d62d6faec2fed44da4928b30142bdda5e6c5d50b83bae616b5054d1e7c13b1355d6f4a8245eaa4997da9c77af40000000000000005f58351d599e9b61e8caab9c70764b0a8a7583c90b3433b809bdb9fbd48bc873495cbff8a41326eea31ae4e0f75057df3c9d13330ca006bce1a84521f14518c9b476fccbd6c712016219848624b87cec2dbe98223a0eb4fa39f6b5c02e6d6d90756ff57902a8f57010000009700ce0b4b8bc22941330000000000000000000300000000000000000000000010008bc0d955f2a83366b99711e6e8861c46495ba585a4b2d02edc3e28dd279a896249ed85b9806f0b6c4a000000002b43dcacc413b48dafb7a2c8cb482bac0ac502d9ba96ffffff7f00000000df73be83bb7d5ad883ef07000000000000006da21b40216e14ba2d6af8656bfff17addaedab25b30002abbba7fa725f38400be7c1f001b2cd317902f19e385be9e48dccff72943327d830689da6b53ffffffff631c7771429d1200000033ed846197fcff5e1c7c3d1d6e3a52872baef9753fffffffffffffe09fec2271fe010cd7bb2366fde4a59429738fcc917a57f94f6c453cea623cc5ee0c2a5ff870ce5dfd3467decb05cfd9fcd41df54cdbd9d10a64c108285e71b5565b1768ee58969c41595229df17bcad70fb4021428ce978275d5bc8955778567bc79e13b78249788f11f708008b75d4fe32b561d46ea3abe0fa4d30dc94ef241875f3b4b6ab7929a57affe7d7fa29822aea68a660e717a04becff0f719107000000000000002d7e927123d8ecbbc55bf404571be54c72d978cf2804107f0238abccd32368e57040906df0042e19000000000000002c06f815312e086dd022c074eb8a322fb0bf47c0a8d154b405a07feaf3dd95f6ef44cd1fe582786105c7df8be4877084d4173731efe895efc71f665c4d75cf2458e35d2c9062ece84c99e061887a20639b41c8c12ee86c50804042b3eac1f879b136345cf67ca3fb2b5e518a75f9e7d7101d5e186c489b3a06fb99e0aa7f23a054de2f4d92d6bd72ee2c9fdc75aaaf1e3e483b4ad055e4af403269b4a39ce40293947d9a631bcbf3583784acbda216550d7aec6b79e30cbd128f54c2d3335457ac0eaaa99bf0bdc14ae358c3b377327ac9ecc34f24c9ae153ec60ac0694da85bff9f5f4df9b3fdf242b985bf16b99c9cc0ad1857036f1a985f369191ae954febb3df464bfe0f773ee9afe72f32a2befb89d3777399f5874c553a2ebe9061fe86e669642e09c0e5a3bb6d163118e4cbe024fd452277c3887d6116c6cc9d8046c216c1f8a9778cb26e22a2a998de5eaeadea10d3cfb41b92ecbb422a40da8daccf080842a486721737390cbf3a74cb2003efb9a101b51ab63e9600040000b8a8c9ae3d14f93100c2e0893862eef552fcde2981f48c482bde6e4a4304e50c349f4f9ecee27defd83871c5191e10096e7e60fc3541a2c905a1a95e9571bf38aebd15172f94e3245c582909e2a3bce109b6000000000000000000d6d5210d7560eb92d6a97a27602b81f7636df1535bef1497f90100000000000000abf9010000007740890200d627e87306703be8672dc84eeadba6a41891c170d1ab57075228a9f46ed9bd1f08fb8191bbab2dc51de3a61f0868afc4294859323e7a45319f18101288a0268893373750d10a3fc22dd704e4214de5946912d6c98cd1a9fbe1e7ef8c08acaf30235b920500d2eca55f74a23641f61f2d5b308cf0d031b0c7f0ced69b93e9960ff5f74562adae283d9756237badf4e7965bbe2777e808fcba821aa8e8c5c39609ff85000000000000c1fee30a3f7a85d1b29e58c77685efc0ceb1c8e5729c66018d169fc03aa188546b3ad2a182068e1e3a0e2505bc7f41019645466a31c72ad53bc19faa5401120000793ac48c1b539c75ab40743b00020000a1f68df75cf43f8ecc8d3726602111b40e761fd210a1920382f14d12ca3c3431ee97471c781d0d1280fb00818654a53b6df4b2c97cc1c98d85fda8f80fe908b65550b4412331d73062197655b7f0469250a5989cef0e10773920ed3ccee42d2c3eb80159da5c002511e6eb93842054cfce2ac306cb6e472db3fd67a49b6855a694a8d359add43907003223a47a7fae4f3748d5a432825bc40a03aaef1c8488d86dc211dd2a3ba71e0f45492ef1f8b65ccb3dcd251a61b152d02c29ca0a3328fa7753a5cddea1acaae55ae8263fb284b7a6ab2a8826c1b948207c498cf4824ab1ea3225a53072423b907c6682f8999e0311da5b8378bc841e1787e3a8128dda381a26cb2b365702ff8a27831375b2ddaa2f56e21169f7ca4fd9655ccd4a584acd244e965a0afedaff7c415ff682a4044b3381cc2df28278c9a6824c52048a7cfabda294925cc0956bffa8e950ff5e49f41ae600d830207bf728cd9807933c3c16d80bbea611a18becc2dc38ca0a6f5740f340b76edcd100fcffff007231dcef58c7b88b5aeedaf9626cb51ce1737c10ab37d4f98a934b0f900e0eb639878a1200629f5503cf679154d27681d7a3744cbcd42af59407c9c8e39c5271868917954e604352ba26171d004f1cb2976fab3fa19c7d3ef9678bff79f5155524f061378f94fb453786c3a6f78b10d383b49e31d1568bd43ee34ce6e6be235aa6207285665c2fba773671da41959f51610963b48930658e2d6125a26085001345b0473240b7e5e91811312c43663e76f711c6529ecdec75c7ea1cf0f8f8fff40247d59bbde2ebb8659197e0f37a71be1b12a182ed7de3acba28561a04b807f7a4647e2ea6d8fb92541d07c3d5e4ba077d3cad9f8ba1919592014c00c8eccb2ca5d48ba7b1c3fb185a4bb79700cf51f818b0c701c8de47d12281a67bdaf4b0c50bee9e8f5936250df2e15c1172e7ea6619f7db330700d1e9e42a035e6fd532f61fbfed9c4a7124a1e38eee50a6bbcd1d4e3f68c3f27dd9a70f1a7c6046237ddfb0b26e197322226367d998010458cd4df10af249ce717f6f45e5176e0ddae3054d7289d4e13ab0912703ee39ce264572b89194fdf7acecc35cf8309d4b680a08eed367dad855fce210f1a7c7222dd360eafb4bef7d58bf83362930af6e3f3f851abdc0003bdf9401b533019e90feb069189100007a82df8d9b5f44ebf9355e7b1b01c9470608d4f306d21004730396a4d6c6d46e1ffac97aa93c36123532a36186575266be4981c847160079421d0137801e553069f8d025c40f287378810defc7f2ed4e15f6af17b21153394f8bcfa6a23a77c8d61c9bbc127a57b8d631f36558d9093dee08bc53d97a8003363421738650a22c8fd87b13026799caf58e59951b125e7f161ca34e2c0dd65a23d01a3cb191e743de07247c7f993cf01166fa2ac1ba02f60550e63a7f50422e478c6b5d87f9bd0567a279a9d85a380db25c43bd0529ad783b9d64aaac1b793afb44b7126e17d2b7c0d6be650de7eeef3f3605af344015d03c3e7819145cb9fe1978c98bf9cf10773db59505ae33708c728844c872dfd2cb0b29008000000000000005ca18cb72f0944d0e4fea0a0abd0285bdaf1b000000c089d640c2facb0d1e6243873ac4b1e1068c45c715b68effb7d58d1f9e726dbf6bd910ca4ce0e075658ede42192cf393a50dcc197b03402fed75083628e5dd38213d353b9049e71f037064b05e73ec00c710f1ffc5737d397d555d1cf8859cc030ea8dc3c6a5b3b6fa1c81707479db1833d593a271253aa11efd936b74784f2fc286814848e92d8ee541bc179813297a0a4cc3c8f80c28701185bea091f32475e859479b734727afc110e1abcff460172fd1b42e3c0e2a4bf94a060069000010000087c7572a1e7596f89e5c3d5e70640c90815f77b7b13d0000000085a1e1e84900000000000000000000000000b422fc160a458ee5a91a2471e6e56fdabec6c73ce8983fc68f0b7cdcdde632e6f54a07620e8aa116ce9e84fc3cd5e8288a333dcebb233da9186796995ba69487d8f77d2f8800f02d690fc70a08b231cad1bdcf3740a95d4dd1cfe0f417f275493cf33b19ffff93dfdaf7eb00b8ad87cdf7c21bab5af8e2bac54ee5597e6508c1158124a538c36f9bb11fea7d8b8c7e954b1bc7811654a6636b33f271d0923e9ecd1b724b8feffadfc23c07000000f0785fb722f346d6a5dffe1884d4d0cd8f00000092c85ed44db68ab800001f00000000406e6ed9b219ad07125381087298e75965d1cc5932ddf9e66351b9332a34bee3e3d562c914c629933f0b8724cf680889ade72558d191d9890c69a718f9018586c5131c8dc8e0379bafda1a0fd2997ff115215ce23dca8db7236c1554cdaaadcce2f31834c1bd1908d8e1b361034db56be76acb7654a195bc3e98df3a5dffd5b0783883ef7da3433110e37f7c7cb7f3800de7f99abf910d6949e062747a9c87dcfcc716d6a9c0ec53b9cffe3cfd1df69a76f373d7f997edb9b80bdea1a99c2a6fbb25e035deadaadd7917ebfedd6304a19491769476208684e343f86b4d55a7dbbb07283cb1e35a138d24ebc5b4f8e35a82d3a7f84cb1e02a5a92b53567088be0b1ca023ccd518c0e0715b1c8760801a419ebd2e26440ff7493019bdb655cc88d72d6d7b6bca5a2e19b63ec52fce43d8c53a8031e64026e0d36b6401064c49a729f11ab377f7132c5232bb80195dd5d43d29646a9378eea0761b7ed9d2172e33ed87c7413c843b180cc00000000006bedf2ed716ca43a941119b96d82b26d9061de240d85ec2cfa462bd52104489bb7a7548d7cc53627031e909c69cb824233975a1ea645de63522407c3a240a37e946f30ebf075ea97846a0a8d2286f3f446b1b99ab83a12ddf8a1c06294eadc3eb3e339591afd5c00000000000000000000000000000000000000000000000000579dad8347a3d16976bb7483840b32db0158fb6c809349333325a7866ca5d3133e33ef1a183cefdb65a79fa71800988c8445029e024822dbcfcab49c3a0aec9bd43e6e14078b260700d849a2aa14c9b593f6dcb1de334c065ecfd65031606e55949c185bcda9fde4f9b46a76b8a24bbcd31b22373eb0473248150cd179405ee1af1183b0c0ce3483dc1d9bf732b0751b78fb211d6706b55960c6431afbc02b3c7e08086573939290bb9e590a3875f02a828b07f1dc7df9c8e5da22dfb9dacbf5529e4e994128d835f85465173ea7bbcc519a0c9798ce8b1b07567e3e07169c8c3e4da8bf725c050000000000000000000000000000000000000000004775abdf0c62728eb55a9e2849a1ce05bed60dfe4cc9fa43f9684297c02382c0a35829be7a86305792a9d2e80ca9e8fc50f31f6e0fa810303da03d8b74b42c1ebaf16bb343256405a3a07229a54de09a97b269cd29e8b2f0b0d46c51a6a93eec37f4bc6e29a8e19120ae050ab682662e9b2cc3263a4aba62b63ca9123a53c0f4bf3c4463b8144c89bf058a0af0ae9fc2b7cdfc4817703e267cddc193637d7fd97646090da37093657643daae3840c7f5c10f93524f7ae4791ec6e9d9722e5f670ccb358e051a"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sched_cls, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x5a}, 0x48) r9 = bpf$ITER_CREATE(0xb, &(0x7f0000000100), 0x0) close(r9) bpf$PROG_LOAD(0x5, &(0x7f0000000580)={0x3, 0x4, &(0x7f0000000500)=@framed={{}, [@call={0x85, 0x0, 0x0, 0x29}]}, &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sched_cls, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_DETACH(0x1c, &(0x7f0000000380)=ANY=[@ANYRES32=r9, @ANYRES32=r8, @ANYBLOB='/\x00'/12, @ANYRES32, @ANYBLOB="34a0766ad1f8628223d61a1b1387df009f7a641306c3a00ac447a0063915727a9c570d7b4946be1f91a8f018f52f60088a1fa3e5711b81", @ANYRES64=0x0], 0x20) r10 = bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0xc, 0xe, &(0x7f0000004000)=ANY=[@ANYBLOB="b702000003000000bfa30000000000000703000000feffff7a0af0ff0100000079a4f0ff00000000b7060000ffffffff2d6405000000000065040400010000000404000001007d60b7030000000000006a0a00fe00000000850000000d000000b70000000000000095000000000000005ecefab8f2e85c6c1ca711fcd0cdfa146ec561750379585e5a076d839240d29c034055b67dafe6c8dc3d5d0f65acc0d06d1a1434e4d5b3185fec0e07004e60c08dc8b8dbf11e6e94d75938321a3aa502cd2424a66e6d2ef831ab7ea0c34f17e3946ef3bb622e03b538dfd8e012e79578e51bc53099e90f4580d760551b5b341a29f31e3106d1ddd6152f7cbdb9cd38bdb2209c67deca8eeb9c15ab0300817ac61e4dd11183a13477bf7e860e3670ef0e789f65f1328d6704902cbe7bc04b82d2789cb132b8667c2147661df28d9961b63e1a9cf6c2a660a1fe3c184b751c51160fb20b1c690220b87b20581e7be6ba0dc001c4110555850915148ba532e6ea09c346dfebd38608b3280080005d9a9500000000000000334d83239dd27080851dcac3c12233f9a1fb9c2aec61ce63a38d2fd50117b89a9ab359b4eea0c6e95767d42b4e54861d0227dbfd2e6d7f715a7f3deadd713089856f756436303767d2e24f29e5dad9796edb697a8ad004eea0182babd18cac1bd4f4390af9a9ceafd0002cab154ad029a1090000002780870014751c3c975d5aec84222fd3a0ec4be3e563112f0b39501aafe234870072858dc06e7c337642d3e5a815232f5e16c1b30c3a6a71bc85018e5ff22dc518afc9ffc2cc788bee1b47683db01a2f9398685211dfbbae3e2ed0a50e7313bff5d4c391ddece00fc772dd6b4d4de2a41990f05ca3bdfc92c88c5b8dcd36e7487afa407e2edfae4f390a8337841cef386e22cc22ee17476d738952229682e24b92533ac2a9f5a699593f084419cae0b4532bcc97d3ae526aca54183fb01c73f979ca9857399537f5831808b0dc2a2d0e0000000000000578673f8b6e74ce23877a6b24db0e067345560942fa629fbef2461c96a0c93d47018c12e7ba8188a22e8b15c3e233db00002e30d46a9d24d37cef099ece729aa218f9f44a3210223fdae7ed04935c3c90d3add8eebc8619d73415cda2130f5011e4845535a8b90dfae158b94f50adab188dd8e12baf5cc9398fff00404d5d99f82e20ee6a8c88e18c2977aab37d9ac4cfc1c7b400000000000007ff57c39495c826b956ba859ac8e3c177b91bd7d5e41ff868f7ca1664fe2f3ced846891180604b6dd2499d16d7d9158ffffffff00000000ef069dc42749a89f854797f29d0000002d8c38a967c1bbe09315c29877a308bcc87dc3addb08141bdee5d27874b2f663ddeef0005b4896c7aabf4df517d90bdc01e73835d50200a90800c66ee2b1ad76dff9f9003f07000099d4894ee7f8249dc1e3428d2129369ee1b85af6eb2eea0d0df414b315f651c8412392191fa83ee830548f11e1036a8debd64cbe359454a3f2239cfe35f81b7a490f167e6d5c1109000000000000000042b8ff8c21ad702ccacad5b39eef213d1ca296d2a27798c8ce2a305c0c7d35cf4b22549a4bd92052188bd1f285f653b621491dc6aaee0200e2ff08644fb94c06006eff1be2f633c1d987595ec3db58a7bb3042ec3f771f7a1338a5c3dd35e926049fe86e09c58e273cd905deb28c13c1ed1c0d9cae846bcbfa8cce7b893e578af7dc7d5e87d44ff828de453f34c2b18660b080efc707e676e1fb4d5825c0ca177a4c7fbb4eda0545c00f576b2b5cc7f819abd0f885cc4806f40300966fcf1e54f5a2d38708294cd6f496e547f7ad33850d9feccd0111a2e3700845dee734fe7da3770845cf442d488afd80e17000000000000000000000000000000000000000000000000000005202000000dc1c56d59f35d367632952a93466ae595c6a8cda690d192a070886df42b27098773b45198b4a34ac977ebd4450e121d01342703f5bf030e935878a12489c80aa4252d4ea6b8f6216ff202b5b5a182cb5e838b307632d03a7ca6f6d0339f9953c3093c3690d10ecb65dc5b47481edbf1f000000000000004d16d29c28eb5167e9936ed327fb237a56224e49d9ea955a5f0dec1b3ccd35364600000000000000000000000000000000000000000000000000000000000026ded4dd6fe1518cc7802043ecfe69f743f1213bf8179ecd9e5a225d67521dc728eac7d80a5656ac2cbde21d3ebfbf69ff861f4394836ddf128d6d19079e64336e7c676505c78ad67548f4b192be1827fcd95cf107753cb0a6a979d3db08407081c6281e2d8429a8639034a75f4c7df3ea8fc2018d07af14915f29b719f54926fc32468f65bd06b4092140faed0c329be610c3082d43e121861b5cc03f1a1561f0589e0d12969bc982ff5d8e9b986c0c6c747d9a1cc500bb892c3a16ff10feea20bdac0000000000000000ca06f256c8028e0f9b4c8787361f3289f86ae826c69fa35ba5cbc3f2db1516ffc5c6e3fa618b24a6ce16d6c7010bb37b61fa0a2d8974e69115d33394e86e4b838297ba20f96936b7e4746e92dea6c5d1d33d84d96b50fb000000ae07c65b71088dd7d5d1e1bab9000000000000000000000000b5ace293bec833c13e3229432ad71d646218b5229dd88137fc7c59aa242af3bb4efb82055a3b61227ad40f52c9f2500579aca11033bb9cc16bd83a00840e31d828ec78e116ae46c4897e2795b6ff92e9a1e24b0b855c02f2b7add58ffb25f339297729a7a51810134d3dfbf71f6516737be55c06d9cdcfb1e2bb10b50000eb4acff90756dba1ecf9f58afd3c19b5c4558ba9af6b7333c894a1fb29ade9ad75c9c022e8d03fe28bc358684492aa771dbfe80745fe89ad349ffaad76ff9dd643796caffdf67af5dd476c37e7e9a84e2e5da2696e285a59b53f2fb0e16d8262c080c159ce1d9bc7ef3e3f40c14089c82759106f422582b42e3e8484ea5a6ad9aa520000afe0e0caea1ad4cb23f3c2b8a0f455ba69ea284c268d54b43158a8b1d128d02af263b3dc1cab794c9ac57a2a7332f4d8764c302ccd5aac114482b619fc575aa0dd2777e881e29a854380e2f1e49db5a1517ec40bb3fa44f9959bad67ccaba76408da357f9e93ce055019c9f1534c8bd48bbd61627a2e0a74b5e6aefb7eee403502734137ff47257f164391c672b6079e65d7295eed164ca63e4ea26dce0fb3ce0f6591d80dfb8f386bb74b5589829b6b0679b5d6fccbecfae5553d9950d48c774eaa35b24fce69a20d8bc410d9f48bf7eac90529cd6af061c9e53addddc620ce73c5d177e3d097159f2768636fc10276c6a0adc57483b3f7083f66b87ef296ee85e9bb70a3009a5d30f479e293a3302e11350ea857b37e76ca2f50378e4092ce2c574ad278b9b7b717c571afb2077b019fd9d89efd59b41f051ec5a8ff87ecc8df917a1e386d849fcd10e2f9ca52e02339c2f4666b0c545e25f1cd62421c28d25994be0cff7271a0dee38d7ac4ac736b090e1d29f981fd9086e4000000000000646174b55d251f7f8ca5ccc22a5efb33b237eff5597a3c3a5f3a9bb54abb40e54593e1a7ce4cfa17b3c3fe91c06363496341eae20dcc59b6179b32ddddef5c34000096a54c0c571a91878f61f74912e2299e5501d4d6943bfd74c856511726f0ac8f7d17f1c6b4451c1bcdc6b6e1700e4cd87709d97afc5423c96fa981873d4369b04bbf1fb9f68f17991540868e408201ad1a74179e489aa61f021a437a3fa935588be2068f7ff9b253106326fde795e530b93626cc68e06e602198724249b4445eef08401cd1a3e266db41474e69902e4d8f5da4e94cc36794258fd4032de7ab36bc24c5efd5c8495c1ccd580033c55725f2d60354f8ad5914a0155eaa743350ddb388f486b6de0549ef3b1b3c3b7d4d3a830ff39885776119408029be3788dd8422b1ab7b4c9d5b7d8682fd759c713108e1bdfc64b9121bbf07099def5c0ce3c861ae4b5cad8bba5a0b6059b9ef90c2f96a59320309e25df89484522bb1d6eaa92164f9e4042cb689a45a898354c17b08705205a9189772bcbcb6414e44b33a2470d3bc16f761c33f565b9da5e7991ad8482579cc1b16c1fcec815a5482ae8b1779c5e339971a6ec1217bcfd1ef24284de8a0a9f068f297037d6478c2434a9a18dcc6c7c791e444a79d7ce37f9cf2826b47ad8ca6a2fa254aa02cd098026798a6d336348af0fc11fa2809a5ebbe17ca4d0f889d518f64ee50f562b5fdb1f76d4a7fe14701f8ed0c6a55d66a6efea3e449e6b478abc5b196dd5308cb20c4e2a0bd702651bb39f10523102dcd8ece692159028f314e0d6bfa400475c6699fdc40efe0948e3cef7419a7f113134e5ee20fd87c4521ccfbd32d6f147f743d30866bdd86ca8bf0c7bcc475f4ed53517aaa51f1c151d859a7f0b53abd332c84bdad313e82ac3777a6f7f649ff8a25f6dfe09cb29213896b49a825257bf143e9fa3bbd47009e66fe5705b3ef2b40a182e408c680727d64e00e1ce508f8fd64ac6c84ccc28fc333067de63b9bb5daaa12ce60ee3779ded79651be69d2a413cd948a873dd7ad7017b150828cf100d3df8537f22aff58343c9ee966fceb594bbe10b911427f76a25a219be2f85287b7f83d323a30991067ad1369792166062085ff20c5fb9f6e4f78dd09c7d2d6ca3c8a5d0d26ccbe576f44a1bc94194817"], &(0x7f0000000340)='syzkaller\x00'}, 0x48) r11 = socket$inet6(0xa, 0x2, 0x3a) sendmmsg$inet6(r11, &(0x7f0000000280)=[{{&(0x7f0000000100)={0xa, 0x4e27, 0x10003ff, @mcast1, 0x5}, 0x1c, &(0x7f0000000240)=[{&(0x7f00000000c0)="8000102e7577d401", 0x8}], 0x1, &(0x7f0000000880)=ANY=[@ANYBLOB="140000000000000029000000080000000800000000000000140000000000000029000000430000000900000000000000e80000000000000029000000360000006c19000000000000c910200100000100000000000000000000000502000505020004c91020010000000000000000000000000001079cf3170ddfd629da29d709493ffc93d4cfc0e5ebb19f2505cb1ca085692b0a8b020b1983c88ee106e120276cb081c2aead4922c82c658cc52cd4b3d67780886759da3b57ff49521fbe5c0f097825c987eb83509907b24e77d434e4ae83adb017373f31c51d6092cf7c083222cd49cd40a8c82c8bc9ec97007bec22304fd2cf4db6a7079b7ef0b9a1facd8a6e36b30c36e0c49496a8125e09dff5790400000000000000200000000000000029000000370000002f0100000000000001030000000401051500000000000000290000004300"], 0x250}}], 0x1, 0x4004804) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000080)={r10, 0x18000000000002a0, 0xe80, 0x6000, &(0x7f0000000640)="b9ff03076844268cb89e14f088a847e0ffff20000000003a000aac141440e0", 0x0, 0x11, 0x60000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4000}, 0x48) r12 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r12, &(0x7f00000006c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000000)=@newlink={0x58, 0x10, 0x40d, 0x70bd2a, 0x0, {0x0, 0x0, 0x0, 0x0, 0x0, 0x10}, [@IFLA_LINKINFO={0x24, 0x12, 0x0, 0x1, @macvlan={{0xc}, {0x14, 0x2, 0x0, 0x1, [@IFLA_MACVLAN_MODE={0x8, 0x1, 0x10}, @IFLA_MACVLAN_MACADDR_MODE={0x8, 0x3, 0x1}]}}}, @IFLA_ALT_IFNAME={0x14, 0x35, 'macvlan0\x00'}]}, 0x58}}, 0x8000) close(0x4) write$nci(r0, &(0x7f0000000040)=ANY=[@ANYBLOB='p\x00\t'], 0xc) 3.166401103s ago: executing program 0 (id=2383): r0 = socket$nl_generic(0x10, 0x3, 0x10) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x8080, 0x0) ioctl$TUNSETIFF(r3, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x2}) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r2, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000180)=@newqdisc={0x44, 0x24, 0x605, 0x0, 0x0, {0x0, 0x0, 0x0, r4, {0x0, 0x1}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_gred={{0x9}, {0x14, 0x2, [@TCA_GRED_DPS={0x10, 0x3, {0x4, 0x0, 0x1}}]}}]}, 0x44}, 0x1, 0x0, 0x0, 0x10}, 0x0) sendmsg$nl_route_sched(r2, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000680)=@newqdisc={0x170, 0x24, 0x405, 0x0, 0x0, {0x0, 0x0, 0x0, r4, {0x0, 0x1}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_gred={{0x9}, {0x140, 0x2, [@TCA_GRED_PARMS={0x38, 0x1, {0x1000, 0xa, 0x64, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1}}, @TCA_GRED_STAB={0x104}]}}]}, 0x170}}, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r1, &(0x7f0000000600)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000700)=@newqdisc={0x170, 0x24, 0x41f, 0x0, 0x0, {0x0, 0x0, 0x0, r5, {0x0, 0x1}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_gred={{0x9}, {0x140, 0x2, [@TCA_GRED_PARMS={0x38, 0x1, {0x1000, 0xa, 0x64, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0xbe}}, @TCA_GRED_STAB={0x104}]}}]}, 0x170}}, 0x0) r6 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000100), 0xffffffffffffffff) sendmsg$ETHTOOL_MSG_COALESCE_SET(r0, &(0x7f0000001480)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f00000003c0)=ANY=[@ANYBLOB=',\x00\x00\x00', @ANYRES16=r6, @ANYBLOB="01002bbd7000ffffffff1400000018000180140002006201006467655f736c6176655f310000"], 0x2c}, 0x1, 0x800000000000000, 0x0, 0x4145}, 0x800) syz_genetlink_get_family_id$devlink(&(0x7f0000000140), r0) ioctl$TUNGETDEVNETNS(0xffffffffffffffff, 0x54e3, 0x0) r7 = bpf$PROG_LOAD(0x5, &(0x7f0000000040)={0x2, 0x4, &(0x7f0000000200)=ANY=[@ANYBLOB="180000000300000000000000feffff10850000000700000095"], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x100, 0x70, '\x00', 0x0, @fallback=0x30, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r8 = getpid() bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f0000000180)={r7, 0x0, 0x30, 0x0, @val=@uprobe_multi={&(0x7f0000000340)='./cgroup/cgroup.procs\x00', &(0x7f00000008c0)=[0x45c, 0x9], 0x0, 0x0, 0x2, 0x1, r8}}, 0x40) ioctl$XFS_IOC_PATH_TO_FSHANDLE(r0, 0xc0385868, &(0x7f00000002c0)={r0, &(0x7f0000000180)='(\x00', 0x400000, &(0x7f0000000200)={@_ha_fsid={[0x6eac, 0x2]}, {0xfff, 0x7f, 0x80000001, 0xff}}, 0xc, &(0x7f0000000240)={@_ha_fsid}, &(0x7f0000000280)=0xfffffffb}) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) getsockopt$sock_cred(r9, 0x1, 0x11, &(0x7f0000000280)={0x0}, &(0x7f00000013c0)=0xc) sendmmsg$unix(r9, &(0x7f0000000b80)=[{{0x0, 0x0, &(0x7f0000000340)=[{&(0x7f0000000380)='T', 0x1}], 0x1, &(0x7f00000001c0)=[@cred={{0x1c, 0x1, 0x2, {r10}}}], 0x20, 0x2004c044}}, {{0x0, 0x0, &(0x7f00000005c0)=[{&(0x7f00000000c0)="f48b6b0e", 0x4}], 0x1}}], 0x2, 0x4) r11 = bpf$PROG_LOAD(0x5, &(0x7f0000000040)={0x2, 0x4, &(0x7f0000000200)=ANY=[@ANYBLOB="180000000300000000000000feffff10850000000700000095"], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x100, 0x70, '\x00', 0x0, @fallback=0x30, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r12 = getpid() bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f0000000180)={r11, 0x0, 0x30, 0x0, @val=@uprobe_multi={&(0x7f00000002c0)='./cgroup/cgroup.procs\x00', &(0x7f0000000140)=[0x0], 0x0, 0x0, 0x100000, 0x1, r12}}, 0x40) r13 = socket$nl_netfilter(0x10, 0x3, 0xc) ioctl$sock_SIOCSIFVLAN_GET_VLAN_INGRESS_PRIORITY_CMD(r0, 0x8983, &(0x7f0000001a80)) sendmsg$NFT_BATCH(r13, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000000400)={&(0x7f0000000500)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a84000000160a010300000000000000000a0008045000038008000140000000002c00038014000100626f6e645f736c6176655f3000000000140001007767310000000000000000000000000018000380140001006d6163766c616e3000000000000000000900010073797a310000000008000740000000030900020073797a310000000094160000080a01010000000000000000070000050c0006400000000000000002a0000480240001800a000100726564697200000014000280080003400000000208000140000000082000018008000100667764001400028008000340000000080800014000000015140001800d00010073796e70726f7879000000002c0001800b00010074756e6e656c00001c0002800800024000000004080002400000000f08000240000000111800018011000100666c6f775f6f66666c6f616400000000841504801014018008000100636d7000041402800800014000000008080001400000000e38130380100002800900020073797a3100000000fd00010077dad817c767e5a7c5a34464bf21f697314c3c19b9e61b84a842d1cbb76c42ddb491c88b50df97666b1bed042a1bd80813f1f25f7515394b93235ae07d25b4ce92aa078f048656c912ba1ee1f59fe1f99078678afccf1b059daad3b6016bcd7e16114447ca27fe959818dc8bd3357b41329225bb5c0d4a1978f7dddd89898ec8af85d0b6face5755445709614f232c693c0f3f6cdc7afd628ac8ee0c6137cac5ac3d110ab4791806be8fca58a576f6c09d1bcb932ceaaff9576c7bdf9e3fcae142eb4922fc09332b7ec62c60df24a8f48a95f01deb265678d6a3d5317111e426325ff31f65df29e57efc01fd247ba0b412a359680a2edf26b50000002800028008000180fffffffd08000180fffffffe08000180fffffffd0900020073797a30000000001400028008000180ffffffff0800034000000001f8000100387089490ec6dec3c621ad2cea14d6d2a6aa2e1e9f68093abfddf8a2036317e865aa23b81e4ff945f9d3a3ee1835e18cdb82ef5255a3934201c18b6465e0eaa412f39a6398a245067071f48b6f9709ec04c442ba0868b986eb7d6d797be9f23096c5cbbd674c1661ce4465762692d8671e51217b0ded89e7c6b0557c69bfc1b563c1b81a711d7c3af25bf24ec57c2a88060122b6b9e4b58ba22230dfe7fba425ed79c75db43208d6191967b52850398951f744e8f3f4ab4406d93fa0baf2747cd457025a7561f6462a57280088b2b9a066edc43a6237d340d00a9a2173cb534bd9e7811dd6be778b84bda3e1dd96e3646fa8141a7800010005feb67b3aa4d68469f5e24ba93a5d35cc85138425f7991c71a1fb2fe8e73009c39518ce5a449bd68a106bb262811498f4bf0ae80bdc8baa0ee2da15e62a9236ed5cd534b98acfac4da7bf978047d4c94cdb44fc4655c000f7c47f70aa59f862d06aa1a8e29d105fa5bfdfbd364c31f30d72ffd2041001005d4846a6da35ce624541977612f20823e7db6ba0f80af81fa4685559cd3f4c8c50ec5fafcd17164e5c0f96a27fe4dfab4047ac651173d82aae3f50e87cf6da1681e09b45e55885433026b3c3513f03a620bdb9578217e4f41ad2f8330c9eafa7d06b219462f6ea55ea38ac110ce2cc62792c19162c1a2c972aa6f6d111064761427eb3012074da8f07340fb90745d9852b1976f55250946bdee061b9a1d7828e7083ffbcddb69dd6b4f3abdb480c9fa3daa903199ed9a94ab87c8703e48feb8e4953bc139cf7f0cbf24cef07de6614094b99b5bed06bb0354f12b5dc7214311950a009880431807ff4edf17ec64a49068a5d34717aa58fbb7f777a89483e7e4428e9f7f629299611d516ba17ae0e6dc610568e3f7a7d24e79827ce72f801455dc67a1e6d61846e5d008e0d684c67a2e42e95f3d020c1a386e665fc9b67c29ee713f9ce98e37fec5413a06fe7ae48b4416397416a894bcfacd5088ed21573ba1193aaa57f07d8944eb4db885cf4c4b921c54da613f05444b0d114c0b2132e9886462fb8bb385cf91492cfcce44bd964fb944a54cd1b872a03df40bd60b14c2dcc7ad75e7ccf92f04e5d535c3510a332f8ef67ca291306b726896e9311c80d4701daade9d42339fa1c150bc761ea65adc14cc0de40d13fd9ce61d6b05faff2814a580e8c1232d56a66b18ab78b61dc0a1364f9da66bdd0b6930419e58a9b37eb45357245647a3d3aa789d9bc165fd34ee9f68a6a0c8e1ee9a0f9e1f346c2bcf047dcf681217567daf91b51b29e1f46a805f546c1f237ae60b25a46e4cd68432c2255faeeeb33f12b442ec9030cfa0c817ea44946ff8bf1f1ec26c5a55a9b5609118aaa3d1ba058ad15ee6d7fa0c41d96a2ecff4a9e8a00f738b60934559b4050090e24fc732b07a3a1c068b73f96f2dad8cef395c92f1186a854e3b749db26f0e5db2f903a26a1cb5a2a93040ea0b5f24d89332ee194b3860b21568668d4c04a036310fc2c20fe5ba15e357fa0f3946fc02ef3c415ee50d025c30cddd96732c6ef4000c1feb5accee0027090b8a48978ad63cf04de62c740484612435863e46a7b9764b5b81d5aa76b86aff42e973bdac6ee398ce43d2488f32311dda0a54b61973cb39e06047fe9dcede9e8d1add6c53ce191b5518c269d290cd02e24b2505ff9a5fecec623b72d54a04bc5aa18b14ab67f89496991c2acaabca9534b4a7950a9689c406f292102c703e1dd5368091c196719eab899c43f453dbde077a10a7a5c1c0b6cab22f95df7c7c47181bd3e257f9f01f51d34ce8d8907bc031e0135d9edd29c8b78481c659a49c3ca66918f68547c1d9a1985f54ea162b86519815bc686f72fb336b928013ae6a9b27a2d8de10f500924ed8064af2db61ee892cf8c1bb6f0e6affc72e86563f48ff028b2cb2d5b3a95cddd86dfb0ae21bfd14104d155f284c24cd37153159d9ca34853fb95dc59e2618daf1e38409efeeb73c705520dae581af47046dd4e4bb29e4898c42e211e4b6ea4e826f68d4eb4c35c9000bd64c4f280658b97da4a326d85d661e203f78029c5eec4a6cb6a368479bfb31f99624734d2a8ce8e12c2fba8f6279f105951f810e83a601f73be5a97ef5c00be4a0f70a2defda35a82acb83eac91d9c5e9607b578eed280e6013bb530ac9fe2b83b37e37189c17693a088c60ee1e66bc9ba0f2feba383a71320b3c0ee2582a3718fdb38542cd3e36b161b8431bfe4ebb7e97ef344c7d4ff424066f966e5e7e85a964e9a986b0df0df891b947abd8cb4fa3b1098bcacff37e5239db4226ce71f6f71fdf26b3a3e087f75f36f4220c1c144699406adf8dadc81b76df6659bab451aa9f6aa938eefcffee5d04aadbc4dbfacc414dae1a19a91c15be50bc4356ec213ddb84ee4f4d07af663fd461f71cc0746b38fb28a83983e63e46d1e162b36d9cbdcae6bab5aa2ce82fbf8e48611964fe80319efad2d9ad4e77efafe491c8d476d695338ac539c786bd9dcb2bc5140e501e44b56e71a4215b88d74d030457aa8b0fa0e005a1f77eebba0bd065a65614777c2d1b1a7788c5396b010b6d3e428670d9b5070ce972d2ffb07749faef59fa34b17419bef2edef3794a9297cb59cbc8de1fd36f02a69b11e82ae0d2c998c60b45e96368635fff9fb7393da7c12116a5ab7f72d2625e354e9cdf39c93a73f50ccbd7d170ed9e95c09883145dfa69d3aaaf556e94a8ecd0e1277482dfe4eec89406d608f51593460e5655251939b0477a727287be27bf7a089cdc4e0108d845bbe773060463a23be5ac404db78a94b185651c41b5db672f957676f1feba21fef4bd9733ebfc865c86429cdbd7abb291fb70b2f89b9ef42208b9cc3a24d2d2a8d0397f5e1a12eae60bd140b518e885515ccb5e23636d4fd3cfca6ba44d3d9663aad838fc9a6f4669e4a56f18f49245975add9c361eec34616d8fc67aa0295de52dfc1d2c5f046499246be0b0e3956ef1745442117f8bc964872e44ce8d50e8f61a5ee5c55c5de527811313e0117f597b8e467ddce4e224d69330300f3c99a78ce05fbaaf6e85f605586f409027eecd17768c9700259dc18200e6b417561def558b841e48b35c7dec1331802000000cd7132a5560a1601384259761e99fd6c66541a5831b346b16f76f2c2a80606dffe7a52dd575613ea1baab5bafaf8fd84c65f5eef912efaeb643a14ce47d579a5577199ea441c76adc565b7c22d77993e9623ecf959dea3d3985f364aec7fe5a4194bcbde1ce330ee355dc6fce86d49aa48ca8004b10bdf6f57e37a42789ba7864702f77869497f51204fcd09e539f1638958f5de78be33c870948dc8ab4c3cca6a542975f45c8b2a0dd04fe38936d44d65403589f990899ddef1d0493150ec2db81a7045ce62f7bd5d3e331d02a3a86d090f341183f745d6e887d4350f6e310b21e9a7bb02b6df5b316006fe3e04f1d8e60628dde32ff547cc4fb5b795be2bfd9a8239b578d5b59f79fc44e125137828be81d0c9dbdc3f15fb33b6ec519aab0ed6c10b128657d829065843e65e3cae462fcb37d0f46530fd472532e7ffda9f9abe7054b5d8dcbcc7fa77b25cfb4524652e98defa7a9576ab0eaaca0913c1129eb53d4b14753c5a9b73212cfa2afd0c69ffd7c3fb3f631e53ad9022cbd8611794c29e1b441f0ec25168af4be962633ec67692dc6bb62812e41985789ac75ff41b834164256832ad75e8fc30506af97966586dec1e56968b3a8acbe45b3518be2a6231f618c02f6486d9da978a8e04295267669e000f75565d5ba79424ad4cc802e2b6e9f87272bb8cecc1833ce01103105e01aa7981f3fc29ed771e110d775be1f02c4a4af4dbec8b8f3e33019f6bccba5f3f70960a3eb408178a2e82e23d0810e0a2e9ad972aff8d7e2e37b6e01a3524dcdcbcb5086eb7397f8c4d4de8dd287fbd9894a8d34e42491d5591745d61b894f376b239400ea39b892d90993b96a3f1d6613d34049097aeee6821e8a2102d79f2d0957cc7bbeec91166e4d50131dc0be452b51a52524d3afd634a1cc3d6e5ddf3218ead731afa278c7c7d92bfdb0995380f7d20882dd6d74ad147a612609e8a3e6f3abd030c0546d41e461dd04f9d93b2234c09028784c19751c8cdc87ec207f5e336a7249f9fbc6a541c0f25368b70555fde074a8fc677ac29b17a5e9eb0515ad89561b6a53a2c207a892e891cdc6d6487779fd60d1e0af93d5ba848e1c4c02125b543db7e79ca7c5f8864518c9885d5d0853ff902fb11464ba831268bab111f15b36ca5dd00e714536446241225570d8498bf6be8c9e999858b8b51d9b50f86e67577d8c8950e98d20d2732895e52172d2c2b0ff5ae1c97ce0eb6adb4be6172a72a181144a592e2a55573834d1f043afde21bd4a0e5f421554c4311af770cd61b22a980834f9560304b4af76370a44e48d7668930e1f49e3ed978d8e341382d160af8b6fed9e58114da5b6725fe53c88a84b0fa5da779670119711bddb99d6b751e8b6c21db3252b91da02edf1385a6112755b6e6f1076bb53d7f7363fc010331ca95305c73e0fd25c478d952b93392bffdfd94641b222851cbf328038334db51a6cd356147a9d5de9891c0070c27f2173e7673400452a513e916697bdeffec73d094b5505f57b8db6f557dee8d8dc8080d25de6069eda8978f445728228458b8fd19b26811b661b7969802adbaa53bd0306a53c553254cccd4ad92ff43be9288c43769c3fec6a7c650f1f3b5c49f035b54c14210d224c1195b358db972fce1f7b3ea8a8cd964816ea23520392f34a46bc4f6f8c2cc6debf2a5a9abaff8641b008118752dcb6b212fd8150e7bd417996a4b0f884eacc84da3fd7d6c959ef1235d074c6be826b9e04cd61ba2f7e89df0209071deba5cd8959dd6e07614bd06a734be9a6fb00e7d84e847fd5a7cf93411805252c30633beb145cbd6d977ddf8a3cd7d010a9aaaf0416f6f9c43c5973557275aa955ba23dffb9eab6110830e010a28bf621512fc6ea6c1230f4cf4ec345fcb7b1b237bc70c806a55cdf32d40e8665e6ac4ca188c8a6831c619603495870bcf57d326d1730af4bc5fde7ac76ddccbf1140ce8cd8fcf85d43126392b85198e17c7bd3965d444114ff7777c9ec7e4b4b6c8f99e43f7e67725608048b3107f817ab61ed2537572e90cfaf40ed648b51a1ae39cbe8dd06540f819d7320a020f91482c900e2349623930e585c9cddc47bec3835c532ee08f6da21680cb8c9ad9ee0679dcec51dc470e2d8fe7ca1903bfb913ca10f42d4fbc09e0e7cd43e7b90b4e7f9b48cb51a5acbc5e611fe09bb5264b1b7909509cebb5d38ca032fcd8cba683277d775eb11412f15ae08a79fc6302ab76b3c7ca30ec7598183eda412308b412327d7649071a6724e441967349f5ef652961ab77975cc43145e32f20ad60d3a7645cff28e53bb4db3425ee1ce36871d9b19d8c356e7a48e88c4d1fe587ef60f40a67874ced2034e36feb9aa1182b718d5fac7c0d99bc8d2080a47465092c90edc1dba6590831a07e0769b8a86b3769377e936987e40ad62a7fa5fda1c97c84864b84376111b31d3114a5abd776c99497557f96530ce9f1298a21d93b8e6cdfa21385c66c2652a2a8c8d8a43a3d897bd0a1f00368c6b55db6b062b021fa4ea82a7d09c2d3c19b3baeae8a937d3b4bd40cd097117696bcc7dc95736f9bb5b34f91962a0157fd653958d0090dc79bc9ef038a74e95f846bf45ec8768282619953223ce79181270982126ff8b5effe29b0e9d1cded2757859f506be29b136c7e0670b87c24b2ab560d0afc1cbca7fea604a024656699d2d57d234bd068b4b319bf99335bf347594d75e794ee5ea2f489fa88b36c7d9a485cc6f6067e388f8d4c8a3c087ad0f8d5a53df7754e98a2a6f293ee5885a6bfe69299d14520caec3ef243388f52ba3afaeefe938a5e20c40fa647769a586d04f1e138f2633adfd65c8f57ac5f13b9fb2750fb4120019d78027220966b0d2409640cc9c7084920584abc0af586c0c357de389f6ab0a571866ab069c20d1ac750a426db33c886bc9e7f4bdd1c3860a534c0f9f6f7c11a3d3d77fc721314f27e30378cd2db6f51d4996174b7f57d66613b3bcc7922eeaf409c86215266ed4ddcbfd1e41363fa3d3c9ca80a782f841a983ecc0441feb18bc237c993ca22e9c1cdc19e602999aa2f189472a4292c1e9bc418ade5c7d804d5496417b6c5364cfb262333cee68d256f2f81aba99c2c062ab685b5b080ab379df282857cb1b39db4f267547200010046037999f84a57ae8cfb9a6dcdf7343dae54afcbf5d61b8828b443d78be1aa44a7b46f9a51dd22a45b2426c4a7defddcf702cd1cb658db2052b8b5707ce69567a7a5925fe27112662c3b048bd031c0f18b90b4f48889ef48a762b4631f10ae463b02ee36b447447cd903c158f0d90000a00003803800028008000180fffffffc08000180fffffffb0900020073797a3200000000080003400000000408000180ffffffff08000180fffffffb640002800900020073797a31000000000900020073797a310000000008000180fffffffd0900020073797a30000000000900020073797a32000000000900020073797a31000000000900020073797a3100000000080003400000000308000180ffffffff08000140000000020800014055a94be408000240000000013c0001800a00010071756575650000002c000280060001400000000006000240"], 0x1840}, 0x1, 0x0, 0x0, 0x4000850}, 0x40) syz_open_procfs$namespace(0x0, &(0x7f0000000300)='ns/time\x00') ioctl$TUNGETDEVNETNS(0xffffffffffffffff, 0x54e3, 0x0) 2.664266868s ago: executing program 2 (id=2388): r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) sendmsg$IPVS_CMD_SET_INFO(r1, &(0x7f0000000b00)={0x0, 0x0, &(0x7f0000000ac0)={0x0, 0x14}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) r3 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000040), 0x109942, 0x0) ioctl$PPPIOCNEWUNIT(r3, 0xc004743e, &(0x7f0000000580)) ioctl$PPPIOCSPASS(r3, 0x40107447, &(0x7f00000001c0)={0x1, &(0x7f0000000100)=[{0x6, 0x4, 0xe, 0x7}]}) ioctl$PPPIOCSACTIVE(r3, 0x40107446, &(0x7f0000000080)={0x1, &(0x7f0000000000)=[{0x6}]}) r4 = socket(0x2b, 0x80801, 0x1) getsockopt$IPT_SO_GET_REVISION_MATCH(r4, 0x0, 0x42, &(0x7f0000000040)={'ah\x00'}, &(0x7f0000000080)=0x1e) r5 = openat$tun(0xffffffffffffff9c, &(0x7f0000000280), 0x1, 0x0) r6 = socket$inet6_tcp(0xa, 0x1, 0x0) close(r6) r7 = socket$inet6_mptcp(0xa, 0x1, 0x106) bind$inet6(r6, &(0x7f0000000040)={0xa, 0x4e22, 0x0, @empty}, 0x1c) listen(r7, 0xfffffffc) r8 = socket$inet_mptcp(0x2, 0x1, 0x106) socket$nl_netfilter(0x10, 0x3, 0xc) connect$inet(r8, &(0x7f0000000000)={0x2, 0x4e22, @local}, 0x10) r9 = socket$nl_generic(0x10, 0x3, 0x10) r10 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000000), 0xffffffffffffffff) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r9, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000300)={0x38, r10, 0x1, 0x0, 0x0, {}, [@MPTCP_PM_ATTR_ADDR={0x24, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_PORT={0x6, 0x5, 0x4e23}, @MPTCP_PM_ADDR_ATTR_FAMILY={0x6, 0x1, 0x2}, @MPTCP_PM_ADDR_ATTR_ADDR4={0x8, 0x3, @multicast1=0xac1414aa}, @MPTCP_PM_ADDR_ATTR_FLAGS={0x8, 0x6, 0x1}]}]}, 0x38}}, 0x0) ioctl$TUNSETIFF(r5, 0x400454ca, 0x0) ioctl$TUNSETIFF(r5, 0x400454ca, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, 0x0, 0x40) r11 = socket$inet_mptcp(0x2, 0x1, 0x106) ioctl$sock_SIOCETHTOOL(r11, 0x89f1, &(0x7f00000002c0)={'ip6_vti0\x00', 0x0}) write$ppp(r3, 0x0, 0x0) sendmsg$nl_route(r1, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000380)=ANY=[@ANYBLOB="3c0000001000850600"/20, @ANYRES32=r2, @ANYBLOB="01000000000000001c0012000c000100626f6e64000000000c0002000800010006"], 0x3c}}, 0x0) sendmsg$nl_route(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000180)=ANY=[@ANYBLOB="3c00000010001fff000000000100000000000000", @ANYRES32=0x0, @ANYBLOB="0000000000000000140012800900010076657468000000000400028008000a00", @ANYRES32=r2], 0x3c}, 0x1, 0x0, 0x0, 0x40000}, 0x0) 2.377894607s ago: executing program 1 (id=2390): sendmsg$inet(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000700)=[{&(0x7f00000000c0)="6880a642beaf34317f0d", 0xa}], 0x1}, 0x0) (async) r0 = socket$kcm(0x11, 0x200000000000003, 0x300) (async, rerun: 64) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) (rerun: 64) mmap(&(0x7f0000000000/0xc00000)=nil, 0xc00000, 0x0, 0x42073, 0xffffffffffffffff, 0xaba00000) (async) getsockopt$inet6_buf(r1, 0x29, 0x10000000000030, &(0x7f0000034000)=""/144, &(0x7f0000e5f000)=0x90) (async) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r2, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000340)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0) (async) sendmsg$NFT_BATCH(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000007c0)=ANY=[@ANYBLOB="140000001000010000000000000000000a00000a74000000060a0b0400000000000000000200000248000480440001800b00010074617267657400003400028008000240000000020d000100434f4e4e4d41524b000000ea14000300e4624777db9d97adbf2cd16d6fb1131fe40000000900020073797a32000000000900010073797a30"], 0x9c}}, 0x0) setsockopt$sock_attach_bpf(r0, 0x107, 0xf, &(0x7f00000003c0), 0x4) (async) recvmsg$kcm(r0, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000006c0), 0x60}, 0x0) 1.804716541s ago: executing program 1 (id=2393): sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000740)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000340)=@newqdisc={0x148, 0x24, 0xd0f, 0x3, 0x0, {0x60, 0x0, 0x0, 0x0, {0x0, 0x3}, {0xffff, 0xfff3}, {0x5, 0x6}}, [@qdisc_kind_options=@q_mq={0x7}, @TCA_STAB={0x11c, 0x8, 0x0, 0x1, [{{0x1c, 0x1, {0xe, 0x2, 0x0, 0xffff, 0x1, 0x0, 0x2, 0x7}}, {0x12, 0x2, [0x5, 0x5, 0x5, 0x4, 0x4, 0x0, 0x6]}}, {{0x1c, 0x1, {0xb, 0xa6, 0xfff7, 0x6, 0x2, 0x1, 0x5, 0x6}}, {0x10, 0x2, [0x6, 0xfff, 0x10, 0x7ff, 0x7ff, 0x100]}}, {{0x1c, 0x1, {0x1, 0x2, 0x813, 0x10, 0x0, 0x9, 0x3, 0x5}}, {0xe, 0x2, [0x1ff, 0x7, 0x6, 0x1, 0x0]}}, {{0x1c, 0x1, {0x9, 0x10, 0x8, 0x6, 0x2, 0x8, 0x10001, 0x9}}, {0x16, 0x2, [0x6, 0x8d, 0x5, 0x40, 0x8, 0x6, 0xc24, 0xc8e0, 0xfff9]}}, {{0x1c, 0x1, {0x8, 0x4, 0x8, 0x80000001, 0x2, 0x3964, 0x4, 0x5}}, {0xe, 0x2, [0x8, 0x6, 0x9, 0x0, 0x7ff]}}, {{0x1c, 0x1, {0x2, 0x18, 0x48d6, 0x90f, 0x1, 0x8, 0x10, 0x8}}, {0x14, 0x2, [0x7f, 0xcf, 0x3, 0x7d5f, 0x10, 0x9, 0x2, 0x81]}}]}]}, 0x148}, 0x1, 0x0, 0x0, 0x200001d5}, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) splice(r1, 0x0, r3, 0x0, 0x6, 0x0) r4 = socket$nl_generic(0x10, 0x3, 0x10) r5 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000240), 0xffffffffffffffff) r6 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r6, 0x8933, &(0x7f0000000100)={'dummy0\x00', 0x0}) sendmsg$ETHTOOL_MSG_WOL_GET(r4, &(0x7f0000001040)={0x0, 0x0, &(0x7f0000001000)={&(0x7f0000001080)={0x20, r5, 0x1, 0x70bd2a, 0x25dfdbfc, {}, [@HEADER={0xc, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r7}]}]}, 0x20}, 0x1, 0x0, 0x0, 0x400c001}, 0x800) r8 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='memory.events\x00', 0x275a, 0x0) write$cgroup_subtree(r8, &(0x7f0000000280)=ANY=[], 0x10448) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x2000001, 0x12, r8, 0x0) syz_open_procfs$namespace(0x0, &(0x7f0000000100)='ns/uts\x00') ioctl$TUNSETTXFILTER(0xffffffffffffffff, 0x400454ca, &(0x7f0000000100)=ANY=[@ANYBLOB='..']) r9 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='memory.events\x00', 0x275a, 0x0) write$cgroup_subtree(r9, &(0x7f0000000100)=ANY=[], 0x32600) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x2000001, 0x12, r9, 0x0) r10 = syz_open_procfs$namespace(0x0, &(0x7f0000000140)='ns/pid_for_children\x00') mkdirat$cgroup(r10, &(0x7f0000000000)='syz0\x00', 0x1ff) write$cgroup_devices(r3, &(0x7f00000000c0)=ANY=[], 0x6) unshare(0x22020600) r11 = socket(0xa, 0x3, 0xff) sendmsg$inet6(r11, &(0x7f00000001c0)={&(0x7f0000000000)={0xa, 0x8b, 0x10000, @mcast2, 0x5}, 0x1c, &(0x7f00000004c0)=[{&(0x7f0000000040)="671723d7c6013b", 0x7}, {0x0}, {&(0x7f0000000200)="0090000000", 0x5}], 0x3, 0x0, 0xffffffac}, 0x20048b88) close(r2) write(r0, 0x0, 0x0) mmap(&(0x7f00009fd000/0x600000)=nil, 0x600000, 0x100000d, 0x6031, 0xffffffffffffffff, 0x0) r12 = syz_init_net_socket$x25(0x9, 0x5, 0x0) getsockname(r12, 0x0, &(0x7f00000001c0)) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x3000007, 0x31, r3, 0x0) socket$can_j1939(0x1d, 0x2, 0x7) 1.601500312s ago: executing program 2 (id=2395): r0 = socket$inet(0x2, 0x3, 0x8) setsockopt$IPT_SO_SET_REPLACE(r0, 0x0, 0x40, &(0x7f00000003c0)=@raw={'raw\x00', 0x8, 0x3, 0x380, 0x0, 0xe138, 0x198, 0x1d8, 0x198, 0x2e8, 0x358, 0x358, 0x2e8, 0x358, 0x3, 0x0, {[{{@ip={@broadcast, @loopback, 0x0, 0x0, '\x00', 'veth0_to_bond\x00', {0xff}, {}, 0x21}, 0x0, 0x170, 0x1d8, 0x0, {0x0, 0xd000000}, [@common=@unspec=@string={{0xc0}, {0x0, 0x0, 'fsm\x00', "0d0004000000000000000004fff0cf81dfd28c89544e14cd3e01dd24289831867846c88621039b284c3ff45c42995560a99952bed40cf5a8c1df6cdbdb7e2378d5afd35f4c16827f55b3af494e39e8fb330200000000000032b6a99a8d87298e88a94cb519f5c17631af916a0002000000000000000000000000000000000049", 0xc}}, @common=@unspec=@connlimit={{0x40}, {[0xff000000, 0xff000000, 0xff, 0xff000000], 0x6, 0x3, {0xbd6}}}]}, @unspec=@CT2={0x68, 'CT\x00', 0x2, {0x10, 0x0, 0xfffffffd, 0x0, 'snmp_trap\x00', 'syz0\x00', {0xfffffffffffffffc}}}}, {{@uncond, 0x0, 0xc8, 0x110, 0x0, {}, [@inet=@rpfilter={{0x28}}, @common=@inet=@tcp={{0x30}, {[0x4e20, 0x4e23], [0x4e20, 0x4e24], 0x4, 0xc2, 0x1, 0xa}}]}, @unspec=@CT0={0x48, 'CT\x00', 0x0, {0x0, 0x2, 0x0, 0x0, 'syz0\x00', {0x5}}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28, '\x00', 0x4}}}}, 0x3e0) 1.551746222s ago: executing program 0 (id=2397): ioctl$PPPIOCGUNIT(0xffffffffffffffff, 0x80047456, &(0x7f0000000000)) r0 = socket$unix(0x1, 0x2, 0x0) bind$unix(r0, &(0x7f0000000040)=@file={0x0, './file0\x00'}, 0x6e) mmap(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x0, 0x8010, r0, 0x39ebf000) socket$kcm(0x29, 0x7, 0x0) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = openat$ppp(0xffffffffffffff9c, &(0x7f00000000c0), 0x2000, 0x0) ioctl$PPPIOCNEWUNIT(r2, 0xc004743e, &(0x7f0000000100)=0x3) syz_genetlink_get_family_id$team(&(0x7f0000000140), r1) mmap(&(0x7f0000ffb000/0x3000)=nil, 0x3000, 0x3000003, 0x110, 0xffffffffffffffff, 0xd2458000) ioctl$XFS_IOC_GETPARENTS_BY_HANDLE(r1, 0xc040583f, &(0x7f0000000280)={{@align=0x101, {0x9, 0xfe1, 0x2, 0xefa}}, {{[0x1, 0x2, 0x5, 0x6]}, 0x0, 0x0, 0x3, 0x0, &(0x7f0000000180)=[{{@align=0xf8, {0x8, 0x9, 0x4, 0x9}}, 0x0, 0x0, '!})/&(#!!@\x00'}, {{@align=0x6, {0x6277, 0x3, 0xebe7, 0x5}}, 0x6, 0x0, 'team\x00'}, {{@align=0x5, {0x9, 0x6, 0x249, 0xfffffffffffffffa}}, 0x9, 0x0, '\x00'}, {{@align=0x8000000000000001, {0x7b1, 0x5, 0x9e3, 0xffff}}, 0x7, 0x0, '*!#+}\x00'}, {{@align=0x3, {0xb, 0x7, 0x400, 0xffff}}, 0x9, 0x0, 'team\x00'}, {{@align=0xffffffffffffffbb, {0x1000, 0x0, 0x3}}, 0xfa000000, 0x0, '/dev/ppp\x00'}]}}) r3 = syz_genetlink_get_family_id$tipc(&(0x7f0000000300), r1) sendmsg$TIPC_CMD_GET_NODES(r1, &(0x7f00000003c0)={&(0x7f00000002c0)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f0000000380)={&(0x7f0000000340)={0x1c, r3, 0x300, 0x70bd2a, 0x25dfdbfd}, 0x1c}, 0x1, 0x0, 0x0, 0x60080}, 0x4000) r4 = socket$inet6_sctp(0xa, 0x1, 0x84) getsockopt$inet_sctp_SCTP_GET_PEER_ADDRS(0xffffffffffffffff, 0x84, 0x6c, &(0x7f0000000400)={0x0, 0x32, "17ebbd50760f6e93ab3f0f43ba0b6087518d7eba17edc7609b90e211b923a41c3a6e8907cf67c70a0b52d35c5f3f2d271ac3"}, &(0x7f0000000440)=0x3a) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r4, 0x84, 0x6f, &(0x7f00000004c0)={r5, 0x10, &(0x7f0000000480)=[@in={0x2, 0x4e22, @local}]}, &(0x7f0000000500)=0x10) r6 = accept$phonet_pipe(0xffffffffffffffff, &(0x7f0000000540), &(0x7f0000000580)=0x10) ioctl$sock_inet_SIOCGIFBRDADDR(r6, 0x8919, &(0x7f00000005c0)={'veth1_to_bond\x00', {0x2, 0x0, @private}}) r7 = syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10) setsockopt$netlink_NETLINK_ADD_MEMBERSHIP(r7, 0x10e, 0x1, &(0x7f0000000600)=0x14, 0x4) r8 = socket$nl_audit(0x10, 0x3, 0x9) shutdown(r8, 0x0) ioctl$FS_IOC_FIEMAP(r2, 0xc020660b, &(0x7f0000000640)={0x0, 0x7, 0x1, 0x7ff, 0x2, 0x0, [{0x6, 0x2, 0xac94, '\x00', 0x500}, {0xa395, 0x4, 0x39f, '\x00', 0x1000}]}) ioctl$SIOCX25SCALLUSERDATA(0xffffffffffffffff, 0x89e5, &(0x7f0000000700)={0x4b, "b7514d1bd75ac86147dfff5b04cfa4dc2684a174acbe2149c60d4a1f85af561f9a98afe25b9aaca480f3d1c962b067ca8e25d2c452bb967a8a101a68f7b6d5b4aa27caaeeaacf1c92853f3f36d085d62cab8488e68ed29559388c4a3be22effd778cb9ca813d70a15d402ffea123965aade91eda13f40621cce0694fe1f0da31"}) ioctl$FAT_IOCTL_GET_ATTRIBUTES(r1, 0x80047210, &(0x7f00000007c0)) setsockopt$PNPIPE_ENCAP(0xffffffffffffffff, 0x113, 0x1, &(0x7f0000000800)=0x1, 0x4) syz_genetlink_get_family_id$ethtool(&(0x7f0000000840), r1) socket$alg(0x26, 0x5, 0x0) r9 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$L2TP_CMD_NOOP(r9, &(0x7f0000000980)={&(0x7f0000000880)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f0000000940)={&(0x7f0000000900)={0x34, 0x0, 0x100, 0x70bd26, 0x25dfdbfc, {}, [@L2TP_ATTR_LNS_MODE={0x5, 0x14, 0x9a}, @L2TP_ATTR_FD={0x8, 0x17, @l2tp}, @L2TP_ATTR_VLAN_ID={0x6, 0xe, 0x3}, @L2TP_ATTR_DATA_SEQ={0x5, 0x4, 0x9}]}, 0x34}, 0x1, 0x0, 0x0, 0x4008080}, 0x1) 1.551093359s ago: executing program 4 (id=2398): r0 = bpf$PROG_LOAD(0x5, &(0x7f0000000280)={0x7, 0xc, &(0x7f0000000480)=ANY=[@ANYRES64], &(0x7f00000001c0)='GPL\x00', 0x2, 0x0, 0x0, 0x41000, 0x44, '\x00', 0x0, @fallback=0xf, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x10, 0xd}, 0x94) r1 = socket$inet_tcp(0x2, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000180)={'syz_tun\x00', 0x0}) bpf$MAP_CREATE(0x0, 0x0, 0x50) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000003c0)={0x1, 0x4, &(0x7f00000005c0)=ANY=[@ANYBLOB="18000000068a00800000000004000000cb2004000001000095"], &(0x7f0000000200)='syzkaller\x00', 0x5, 0xfe5, &(0x7f0000001840)=""/4069, 0x0, 0x42}, 0x94) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x7c, 0x0, 0x1, 0x0, 0x0, 0x8810}, 0xcc6626eb83b20b3) bpf$MAP_CREATE(0x0, 0x0, 0x48) syz_open_procfs$namespace(0x0, &(0x7f0000000080)='ns/uts\x00') socket$kcm(0xa, 0x5, 0x0) socket$nl_route(0x10, 0x3, 0x0) write(0xffffffffffffffff, 0x0, 0x0) bpf$BPF_PROG_QUERY(0x10, 0x0, 0x0) r3 = socket$alg(0x26, 0x5, 0x0) setsockopt$ALG_SET_KEY(r3, 0x117, 0x1, &(0x7f0000000300), 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r4 = socket$inet_sctp(0x2, 0x1, 0x84) getsockopt$inet_sctp_SCTP_MAX_BURST(r4, 0x84, 0xd, &(0x7f0000000000)=@assoc_value, &(0x7f0000000100)=0x8) r5 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) mkdirat$cgroup(r5, &(0x7f00000004c0)='syz1\x00', 0x1ff) socket$nl_route(0x10, 0x3, 0x0) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, 0x0, 0x0) bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f00000000c0)={r0, r2, 0x25, 0x4, @val=@netkit={@void, @value=r0}}, 0x1c) syz_emit_ethernet(0x181, &(0x7f0000008180)=ANY=[@ANYBLOB="aaaaaaaaaa43aaaaaaaaaaaa08004481017300640000fc2190787f000001ffffffff444489436401010100000008640101000000000600010000000dac1414aa00000080ac1e000100000003ac1e010100007fff0000000000000004ac1414bb00000007830455f200441c4d03ac1414aa00000005ffffffff00000009ac1414190000000044ffffffffffff08000000ac1e0101000000ffac1414aa0000000cac1414bb00000100ac1e010100000002e0000001000000046487c78263b9cb46b71414aa00000000ac1414bb00000027441c80e30a01010200000008ac14144300000003640101000000000889138aac1414bbe00000020a010101ac1414bb89133564010100e000000100000000ac1414bb004e244e20049190788c96a32d07d42200e0a09fb924ff6d00aa874a6b51fb02440f443ec2f124107be25297ea815c0a499a6ed5c5a94f2eeb099ca524327e258465bf5491bb1ffe10f58da68e36035292d56c47c60fe82983a6773a130d51158620e42400"/385], 0x0) ioctl$F2FS_IOC_MOVE_RANGE(0xffffffffffffffff, 0xc020f509, &(0x7f0000000000)={0xffffffffffffffff, 0x3, 0xc7, 0xe7}) r6 = socket$nl_generic(0x10, 0x3, 0x10) listen(r6, 0x2) r7 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r7, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000540)={&(0x7f0000000040)=@newqdisc={0x24, 0x28, 0x4ee4e6a52ff56541, 0x4001, 0xfdfffdfc, {0x0, 0x0, 0x0, 0x0, {0x4}, {0xffff, 0xffff}, {0xfff1, 0xa}}}, 0x24}, 0x1, 0x0, 0x0, 0x400dc}, 0x0) 1.324928947s ago: executing program 4 (id=2399): r0 = bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0x10, 0x4, &(0x7f0000000040)=ANY=[@ANYBLOB="b400000000000000791000000000000063000000000000009500050000000000"], &(0x7f0000003ff6)='GPL\x00', 0x4, 0x26, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @sk_msg, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x8, 0x10, &(0x7f0000000080), 0x10}, 0x23) bpf$BPF_PROG_QUERY(0x10, &(0x7f00000001c0)={@map, 0x13, 0x0, 0x0, &(0x7f00000000c0)=[0x0], 0x1, 0x0, &(0x7f0000000100)=[0x0, 0x0], &(0x7f0000000140)=[0x0, 0x0], &(0x7f0000000180)=[0x0], 0x0}, 0x40) r2 = socket$inet6_udp(0xa, 0x2, 0x0) bpf$MAP_CREATE(0x0, 0x0, 0x0) bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="0a000000010000000c00000009"], 0x50) r3 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[], 0x50) r4 = bpf$PROG_LOAD(0x5, &(0x7f0000000000)={0x11, 0x14, &(0x7f0000000280)=ANY=[@ANYBLOB="180000000000000000000000000000001801000020646c2100000000002020207b1af8ff00000000bfa10000000000000701000008000000b702000008000000b703000000000000850000000500000018110000", @ANYRES32=r3, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$PROG_BIND_MAP(0xa, &(0x7f0000000840)={r4}, 0xc) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(r2, 0x89f2, &(0x7f00000002c0)={'ip6_vti0\x00', &(0x7f00000000c0)={'syztnl0\x00', 0x0, 0x579b0cf1930a90d0, 0x3, 0xc, 0x7, 0x68, @private2={0xfc, 0x2, '\x00', 0x1}, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02', 0x7, 0x80, 0x7}}) r5 = bpf$LINK_GET_FD_BY_ID(0x1e, &(0x7f0000000240)=0xffffffffffffffff, 0x4) r6 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r6, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000080)=ANY=[@ANYBLOB="3800000041000701fefffffffeffffff017c0000040042800c00018006000600800a000014000280100014800c0006"], 0x38}, 0x1, 0x0, 0x0, 0x4048011}, 0xc000) r7 = syz_init_net_socket$bt_rfcomm(0x1f, 0x3, 0x3) getsockopt$bt_BT_RCVMTU(r7, 0x112, 0xd, &(0x7f0000000280)=0x8, &(0x7f0000000300)=0x2) r8 = socket$inet6(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r8, 0x29, 0x40, &(0x7f0000000400)=@raw={'raw\x00', 0x3c1, 0x3, 0x358, 0x1c0, 0x111, 0x4b4, 0x1c0, 0xd4feffff, 0x1c0, 0x20a, 0x278, 0x288, 0x278, 0x3, 0x0, {[{{@ipv6={@empty, @empty, [0x0, 0xffffff00], [], 'ipvlan0\x00', 'caif0\x00', {}, {}, 0x6, 0xfe}, 0x0, 0x198, 0x1c0, 0x0, {}, [@common=@inet=@tcp={{0x30}, {[], [], 0x0, 0x0, 0x2, 0xe}}, @common=@unspec=@string={{0xc0}, {0x0, 0xfffd, 'bm\x00', "6d93eb04697dfa39de04767f46614613a407abbf4ed2e83a63b484dbb3bf6b2a850e79009e2905d2f98ba19f91f3c9faee6d3686e9bee067f4e77d9ad66238750c4100d7ee97ec7646259d90edece6e9787a97bc956c01754c34c5c9518c46178ed5f9194454980e579c80eca35a58dc47d1d5e4ff6e216c724e88c702448587", 0x59, 0x0, {0xfff}}}]}, @common=@inet=@TCPMSS={0x28, 'TCPMSS\x00', 0x0, {0xffff}}}, {{@ipv6={@loopback, @mcast2, [], [], 'veth1_to_hsr\x00', 'pim6reg1\x00'}, 0x0, 0xa8, 0xc8}, @unspec=@TRACE={0x20}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x3b8) bpf$BPF_PROG_ATTACH(0x8, &(0x7f0000000200)={@ifindex, r0, 0x2d, 0x2004, r0, @value=r5, @void, @void, @void, r1}, 0x20) 1.232838966s ago: executing program 3 (id=2400): r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000080)=ANY=[@ANYBLOB="20000000af00090025bd7000000000000400000000000c000200000004001f00"], 0x20}, 0x1, 0x0, 0x0, 0x42014}, 0x4080040) ioctl$sock_SIOCSIFVLAN_GET_VLAN_EGRESS_PRIORITY_CMD(r0, 0x8983, &(0x7f0000000000)) 1.168053273s ago: executing program 4 (id=2401): sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000100)=@newtclass={0x24, 0x28, 0x400, 0x70bd26, 0x25dfdbfd, {0x0, 0x0, 0x0, 0x0, {0x9, 0x2}, {0x7, 0xb}, {0xb, 0xf}}}, 0x24}}, 0x80000) r0 = socket$netlink(0x10, 0x3, 0x8) sendmsg$nl_route(r0, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000400)=ANY=[@ANYBLOB="38000000100001042abd700000000000e36fcd7dfde75bee92a6593fbcf7dd60e268c65c30c577d0", @ANYRES32=0x0, @ANYBLOB="91800300000000001800128008000100677265000c0002800600020021000000487848f278e16a47862d693e1792d36c19729bbd70e8d07dc470c6976017666f2daa3449e1ed6063441a8d85800ace7b724ef97220def803640e2e013c4a3d25496f9d11a8b5688345b705e059bcda48919e97db71bc818f1bd4c2f4c40f4014f969a04b0a820c7c3a37521bf773bfc9cd093d16db0e95183d1736d31a0a2f0588ac7498452d9e6bbd897570995670db1b9bd5534392fb010324eba88e73f3d54bc6f487e51cac5fa38cb46b10a78b700913341a9673690e"], 0x38}}, 0x10) r1 = syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0) setsockopt$WPAN_SECURITY(r1, 0x0, 0x1, 0x0, 0x0) syz_genetlink_get_family_id$tipc(&(0x7f0000003280), r1) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000180)=@newqdisc={0x58, 0x24, 0xf0b, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, {}, {0xffff, 0xffff}, {0x0, 0xfff1}}, [@qdisc_kind_options=@q_sfb={{0x8}, {0x2c, 0x2, @TCA_SFB_PARMS={0x28, 0x1, {0x1a3, 0x645c, 0x4, 0x40, 0x0, 0x7fffffff, 0x80, 0xffffffff, 0x1}}}}]}, 0x58}}, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000180)=ANY=[@ANYBLOB="4c00000010001fff00"/20, @ANYRES32=0x0, @ANYBLOB="00000000000000002c00128009000100626f6e64000000001c00028005000100040000000600180000100000060019"], 0x4c}}, 0x0) r2 = socket$netlink(0x10, 0x3, 0x0) sendmmsg(r2, &(0x7f00000002c0), 0x40000000000009f, 0x0) 1.093812075s ago: executing program 2 (id=2402): r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000004c0)=@newtaction={0x6c, 0x30, 0x1, 0x0, 0x0, {}, [{0x58, 0x1, [@m_mpls={0x54, 0x1, 0x0, 0x0, {{0x9}, {0x28, 0x2, 0x0, 0x1, [@TCA_MPLS_PARMS={0x1c, 0x2, {{}, 0x3}}, @TCA_MPLS_PROTO={0x6, 0x4, 0x8864}]}, {0x4, 0x4}, {0xc}, {0xc, 0x8, {0x0, 0x1}}}}]}]}, 0x6c}}, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x6, 0x13, &(0x7f0000000040)=ANY=[@ANYBLOB="18020000000000000000000000000000180100002020702500000000002020207baaf8ff00000000bda106000000000047010000f8ffffffb702000008000000b70300000040000085000000050000001801000020696c250000000000202021db1af8ff51000000bda102000000000007010000f8ffffffb702000008000000b703000000000000850000007b00000095"], &(0x7f0000000100)='syzkaller\x00', 0xa, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @xdp, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) 968.21317ms ago: executing program 0 (id=2403): unshare(0x600) (async) r0 = socket$inet_tcp(0x2, 0x1, 0x0) (async) r1 = socket$inet6(0xa, 0x2, 0x0) bind$inet6(r1, &(0x7f0000f5dfe4)={0xa, 0x4e20, 0x0, @empty}, 0x1c) r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="12000000050000000800000008"], 0x48) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000300)={r2, &(0x7f0000000240), &(0x7f00000000c0)=@udp6=r1}, 0x20) (async) setsockopt$inet6_MCAST_MSFILTER(r1, 0x29, 0x30, &(0x7f0000000540)={0xcb7f, {{0xa, 0x4e20, 0x6, @dev={0xfe, 0x80, '\x00', 0xf}, 0x7}}, 0x1, 0x9, [{{0xa, 0x4e24, 0x4, @dev={0xfe, 0x80, '\x00', 0x11}, 0x9}}, {{0xa, 0x4e22, 0x1, @private0, 0x6}}, {{0xa, 0x4e20, 0x6, @local, 0x7}}, {{0xa, 0x4e21, 0x5, @private1, 0x9}}, {{0xa, 0x4e22, 0x4, @private0, 0x401}}, {{0xa, 0x4e21, 0x8, @local, 0x7f}}, {{0xa, 0x4e22, 0x7, @remote, 0x1}}, {{0xa, 0x4e22, 0x6f, @mcast1, 0x6}}, {{0xa, 0x4e23, 0x544, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01', 0x7ff}}]}, 0x510) (async) setsockopt$IPT_SO_SET_REPLACE(r0, 0x0, 0x40, &(0x7f0000000000)=@mangle={'mangle\x00', 0x1f, 0x6, 0x390, 0x0, 0x98, 0x130, 0x1c8, 0x2f8, 0x0, 0x98, 0x130, 0x260, 0x2f8, 0x7ffffff, 0x0, {[{{@uncond, 0x0, 0x70, 0x98}, @common=@unspec=@STANDARD={0x28, '\x00', 0x0, 0xfffffffe}}, {{@uncond, 0x0, 0x70, 0x98}, @common=@unspec=@STANDARD={0x28, '\x00', 0x0, 0xfffffffe}}, {{@uncond, 0x0, 0x70, 0x98}, @common=@unspec=@STANDARD={0x28, '\x00', 0x0, 0xfffffffe}}, {{@ip={@empty, @empty, 0x0, 0x0, '\x00', '\x00', {}, {}, 0x6}, 0x0, 0x70, 0x98}, @ECN={0x28, 'ECN\x00', 0x0, {0x30, 0x0, 0x3}}}, {{@uncond, 0x0, 0x70, 0x98}, @common=@unspec=@STANDARD={0x28, '\x00', 0x0, 0xfffffffe}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x3f0) (async) r3 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) setsockopt$bt_hci_HCI_DATA_DIR(r3, 0x0, 0x1, 0x0, 0x0) syz_emit_ethernet(0x3e, &(0x7f0000000a80)=ANY=[@ANYBLOB="ffffffffffffbbbbbbbbbbbb0800450000300000000000019078ac1e0001ac1414aa2b019078e04000e045000000006e0005025e0041e00000026401010256d287a4190e01f82ab62f01c6f0bfc439ae2d05f517ee3a1a0dceab77649ba718d985d579dbf4a61b06efe85ac1d272ffac51d5995ecd9ef2"], 0x0) (async) r4 = socket$inet6_sctp(0xa, 0x5, 0x84) (async, rerun: 64) r5 = socket(0x1, 0x803, 0x0) (rerun: 64) getsockname$packet(r5, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) (async) r6 = socket(0xa, 0x1, 0x0) (async) r7 = socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_TX_RING(r7, 0x11b, 0x3, 0x0, 0x0) (async) setsockopt$inet6_group_source_req(r6, 0x29, 0x2e, &(0x7f00000001c0)={0x3, {{0xa, 0x4e24, 0x2, @mcast1, 0xff7ffffd}}, {{0xa, 0x4e08, 0x4a3, @local, 0x4f1}}}, 0x108) (async, rerun: 64) setsockopt$inet6_MCAST_MSFILTER(r6, 0x29, 0x30, &(0x7f0000001a00)=ANY=[@ANYBLOB="03000000000000000a004e2300000010ff010000000000000000000000000001f8ffffff00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000b0000000a004e2000000008fe8000000000000000000000000000aa05000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000a0000010000000c0000000000000000000000000000000104000300000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ad94e2100000073fe8000000000000000000000000000aa"], 0x610) (async, rerun: 64) r8 = socket$inet6_sctp(0xa, 0x1, 0x84) (async) r9 = socket(0x2, 0x80805, 0x0) r10 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000180), r5) ioctl$sock_SIOCGIFINDEX_80211(r6, 0x8933, &(0x7f00000003c0)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_AUTHENTICATE(r9, &(0x7f0000000500)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x800000}, 0xc, &(0x7f00000004c0)={&(0x7f0000000400)={0x94, r10, 0x20, 0x70bd25, 0x25dfdbff, {{}, {@val={0x8, 0x3, r11}, @void}}, [@NL80211_ATTR_MAC={0xa, 0x6, @random="b2d16191be04"}, @NL80211_ATTR_MAC={0xa, 0x6, @random="2adc5172d2e4"}, @NL80211_ATTR_SSID={0xa, 0x34, @default_ibss_ssid}, @chandef_params=[@NL80211_ATTR_WIPHY_CHANNEL_TYPE={0x8}, @NL80211_ATTR_WIPHY_EDMG_CHANNELS={0x5, 0x118, 0x1f}, @NL80211_ATTR_WIPHY_EDMG_CHANNELS={0x5, 0x118, 0xf}, @NL80211_ATTR_WIPHY_FREQ={0x8, 0x26, @random=0x1608}, @NL80211_ATTR_CENTER_FREQ1={0x8, 0xa0, 0x4}, @NL80211_ATTR_CHANNEL_WIDTH={0x8, 0x9f, 0x847e01c0e0b9fe1c}, @NL80211_ATTR_WIPHY_CHANNEL_TYPE={0x8, 0x27, 0x3}, @NL80211_ATTR_WIPHY_CHANNEL_TYPE={0x8, 0x27, 0x3}, @NL80211_ATTR_CENTER_FREQ2={0x8}], @NL80211_ATTR_MAC={0xa, 0x6, @from_mac=@broadcast}]}, 0x94}, 0x1, 0x0, 0x0, 0x4}, 0x50) getsockopt$inet_sctp_SCTP_MAX_BURST(r9, 0x84, 0xc, &(0x7f0000000100)=@assoc_value={0x0}, &(0x7f0000000000)=0x8) setsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER(r8, 0x84, 0x7b, &(0x7f0000000380)={r12, 0x2}, 0x8) (async, rerun: 32) getsockopt$inet_sctp6_SCTP_PRIMARY_ADDR(r4, 0x84, 0x6, &(0x7f0000000000)={r12, @in6={{0xa, 0x4e21, 0x7, @remote, 0xe0e9}}}, &(0x7f00000000c0)=0x84) (rerun: 32) 967.874018ms ago: executing program 3 (id=2404): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)=[{&(0x7f0000000200)}], 0x1}, 0x800) 775.359641ms ago: executing program 3 (id=2405): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x42082, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x2}) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) close(r1) r2 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000580)={&(0x7f00000007c0)=@newqdisc={0x58, 0x24, 0x4ee4e6a52ff56541, 0x1, 0x25dfdbfd, {0x0, 0x0, 0x0, r3, {0x0, 0xb}, {0xffff, 0xffff}, {0xfff2}}, [@qdisc_kind_options=@q_tbf={{0x8}, {0x2c, 0x2, [@TCA_TBF_PARMS={0x28, 0x1, {{0x5, 0x1, 0x5, 0xd, 0xd9, 0x10}, {0x0, 0x2, 0x5, 0x3, 0x1}, 0x2, 0x5, 0x8d0}}]}}]}, 0x58}, 0x1, 0x0, 0x0, 0x40088c1}, 0x0) socket$netlink(0x10, 0x3, 0xc) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) r4 = socket$kcm(0x11, 0x3, 0x0) r5 = socket$unix(0x1, 0x5, 0x0) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) setsockopt$sock_attach_bpf(r4, 0x107, 0xf, &(0x7f0000000600), 0x56) r7 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r7, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r7, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f00000001c0)=@newqdisc={0x34, 0x24, 0x4ee4e6a52ff56541, 0x70b926, 0x25dfdbfe, {0x0, 0x0, 0x0, r8, {0x0, 0x8}, {0xffff, 0xb}, {0xffff, 0xfff2}}, [@qdisc_kind_options=@q_blackhole={0xe}]}, 0x34}, 0x1, 0x0, 0x0, 0x40000b0}, 0x4890) sendmsg$kcm(r4, &(0x7f00000000c0)={&(0x7f0000000580)=@xdp={0x2c, 0x0, r6, 0x3e}, 0x80, &(0x7f0000000080)=[{&(0x7f0000000180)="27030200590214120600002fb96dbcf706e10500000086ddffff1144ee1611d4b8bf4a31accb", 0xfdef}], 0x1}, 0x0) 753.711961ms ago: executing program 2 (id=2406): r0 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f00000006c0)=ANY=[@ANYBLOB="0200000004000000080000000100000080"], 0x50) bpf$BPF_MAP_CONST_STR_FREEZE(0x16, &(0x7f0000000480)={r0, 0xffffffffffffffff}, 0x4) bpf$PROG_LOAD(0x5, &(0x7f0000000100)={0x1f, 0x10, &(0x7f00000009c0)=ANY=[@ANYBLOB="18000000000000000000000000000000b7080000000000007b8af8ff00000000b7080000000000007b8af0ff00000000bfa100000001000007010000f8ffffffbfa400000000000007040000f0ffffffb70200000800000018230000", @ANYRES32=r1, @ANYBLOB="0000000000000000b70500000800000085000000b600000095"], &(0x7f0000000b00)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x1a, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) 668.932317ms ago: executing program 1 (id=2407): r0 = syz_genetlink_get_family_id$nl80211(&(0x7f00000003c0), 0xffffffffffffffff) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = socket$can_bcm(0x1d, 0x2, 0x2) sendmsg$NL80211_CMD_GET_COALESCE(r1, &(0x7f0000000100)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x137e7d60ee9237bf}, 0xc, &(0x7f00000000c0)={&(0x7f0000000080)={0x1c, r0, 0x4, 0x70bd2b, 0x25dfdbfb, {{}, {@val={0x8, 0x1, 0x2a}, @void, @void}}, ["", "", "", "", "", "", "", "", "", ""]}, 0x1c}, 0x1, 0x0, 0x0, 0x4}, 0x20000030) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_TYPE(r3, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000280)={0x2c, 0xd, 0x6, 0x3, 0x0, 0x0, {0x2, 0x0, 0x5}, [@IPSET_ATTR_TYPENAME={0x10, 0x3, 'bitmap:port\x00'}, @IPSET_ATTR_PROTOCOL={0x5}]}, 0x2c}, 0x1, 0x0, 0x0, 0x44841}, 0x0) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFNL_MSG_ACCT_NEW(r4, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000200)={0x14, 0x0, 0x7, 0x101, 0x0, 0x0, {0x7, 0x0, 0x2}}, 0x14}, 0x1, 0x0, 0x0, 0xc012}, 0x4000040) getsockopt$sock_int(r2, 0x1, 0x2c, 0x0, &(0x7f0000000040)) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f0000000540)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_NEW_KEY(r1, &(0x7f00000006c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=ANY=[@ANYBLOB='@\x00\x00\x00', @ANYRES16=r0, @ANYBLOB="010802000000fedbdf250b00000008000300", @ANYRES32=r5, @ANYBLOB="1800508009000100073ed52fed000000080007000108"], 0x40}}, 0x0) 618.767952ms ago: executing program 4 (id=2408): r0 = socket$nl_generic(0x10, 0x3, 0x10) (async) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$NL80211_CMD_SET_NOACK_MAP(r0, &(0x7f0000000140)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x200000}, 0xc, &(0x7f0000000100)={&(0x7f0000000080)={0x48, r1, 0x4, 0x70bd2d, 0x25dfdbfe, {{}, {@void, @val={0xc, 0x99, {0x0, 0x1e}}}}, [@NL80211_ATTR_NOACK_MAP={0x6, 0x95, 0xb}, @NL80211_ATTR_NOACK_MAP={0x6, 0x95, 0x1156}, @NL80211_ATTR_NOACK_MAP={0x6}, @NL80211_ATTR_NOACK_MAP={0x6}, @NL80211_ATTR_NOACK_MAP={0x6, 0x95, 0x81}]}, 0x48}, 0x1, 0x0, 0x0, 0x20000000}, 0x40) sendmsg$NL80211_CMD_UPDATE_FT_IES(r0, &(0x7f0000000240)={&(0x7f0000000180), 0xc, &(0x7f0000000200)={&(0x7f00000001c0)={0x28, r1, 0x1, 0x70bd25, 0x25dfdbff, {{}, {@void, @val={0xc, 0x99, {0xa, 0x76}}}}, [@NL80211_ATTR_MDID={0x6, 0xb1, 0xfffb}]}, 0x28}, 0x1, 0x0, 0x0, 0x40}, 0x20008000) (async) bind(r0, &(0x7f0000000280)=@l2={0x1f, 0x4, @none, 0xff}, 0x80) sendmsg$NL80211_CMD_JOIN_OCB(r0, &(0x7f0000000400)={&(0x7f0000000300)={0x10, 0x0, 0x0, 0x4002}, 0xc, &(0x7f00000003c0)={&(0x7f0000000340)={0x48, r1, 0x10, 0x70bd25, 0x25dfdbfc, {{}, {@void, @val={0xc, 0x99, {0x1, 0x15}}}}, [@NL80211_ATTR_CENTER_FREQ1={0x8, 0xa0, 0x5}, @NL80211_ATTR_WIPHY_CHANNEL_TYPE={0x8, 0x27, 0x1}, @NL80211_ATTR_CENTER_FREQ2={0x8, 0xa1, 0x2}, @NL80211_ATTR_WIPHY_FREQ_OFFSET={0x8, 0x122, 0x267}, @NL80211_ATTR_WIPHY_FREQ={0x8, 0x26, @random=0x14a0}]}, 0x48}, 0x1, 0x0, 0x0, 0x4000000}, 0x24000010) r2 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) getsockopt$sock_timeval(r2, 0x1, 0x15, &(0x7f0000000440), &(0x7f0000000480)=0x10) (async) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000500), r0) sendmsg$NL80211_CMD_SET_MPATH(r0, &(0x7f0000000600)={&(0x7f00000004c0)={0x10, 0x0, 0x0, 0x10000000}, 0xc, &(0x7f00000005c0)={&(0x7f0000000540)={0x68, r3, 0x400, 0x70bd2d, 0x25dfdbfb, {{}, {@void, @val={0xc, 0x99, {0x5, 0x66}}}}, [@NL80211_ATTR_MPATH_NEXT_HOP={0xa}, @NL80211_ATTR_MAC={0xa, 0x6, @broadcast}, @NL80211_ATTR_MPATH_NEXT_HOP={0xa}, @NL80211_ATTR_MPATH_NEXT_HOP={0xa, 0x1a, @broadcast}, @NL80211_ATTR_MPATH_NEXT_HOP={0xa}, @NL80211_ATTR_MAC={0xa, 0x6, @device_b}]}, 0x68}, 0x1, 0x0, 0x0, 0x10}, 0x4881) bpf$BPF_GET_MAP_INFO(0xf, &(0x7f0000000700)={0xffffffffffffffff, 0x58, &(0x7f0000000680)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, ""/16, 0x0}}, 0x10) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000007c0)={&(0x7f0000000640)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f0000000780)={&(0x7f0000000740)=@getqdisc={0x38, 0x26, 0x200, 0x70bd26, 0x25dfdbfe, {0x0, 0x0, 0x0, r4, {0x4, 0x9}, {0xffff, 0x7}, {0x8, 0xfff3}}, [{0x4}, {0x4}, {0x4}, {0x4}, {0x4}]}, 0x38}, 0x1, 0x0, 0x0, 0x24000014}, 0x0) (async) r5 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r6 = syz_genetlink_get_family_id$nbd(&(0x7f0000000840), 0xffffffffffffffff) sendmsg$NBD_CMD_STATUS(r5, &(0x7f0000000940)={&(0x7f0000000800)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000000900)={&(0x7f0000000880)={0x70, r6, 0x200, 0x70bd28, 0x25dfdbff, {}, [@NBD_ATTR_TIMEOUT={0xc, 0x4, 0x2}, @NBD_ATTR_BLOCK_SIZE_BYTES={0xc, 0x3, 0xd2a5}, @NBD_ATTR_BACKEND_IDENTIFIER={0xc, 0xa, 'nl80211\x00'}, @NBD_ATTR_BACKEND_IDENTIFIER={0xc, 0xa, 'nl80211\x00'}, @NBD_ATTR_TIMEOUT={0xc, 0x4, 0x2}, @NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x5}, @NBD_ATTR_BLOCK_SIZE_BYTES={0xc, 0x3, 0xa80}, @NBD_ATTR_INDEX={0x8, 0x1, 0x0}]}, 0x70}, 0x1, 0x0, 0x0, 0x4000000}, 0x4040040) (async) syz_genetlink_get_family_id$nbd(&(0x7f0000000980), 0xffffffffffffffff) (async) r7 = socket$inet_sctp(0x2, 0x1, 0x84) (async) getsockopt$inet_sctp6_SCTP_GET_ASSOC_STATS(0xffffffffffffffff, 0x84, 0x70, &(0x7f00000009c0)={0x0, @in={{0x2, 0x4e21, @initdev={0xac, 0x1e, 0x0, 0x0}}}, [0x980, 0xe0, 0x80000000, 0x4, 0x0, 0x9, 0x9, 0x9, 0x3, 0x1, 0x8f, 0x7, 0x6, 0x6, 0xb9]}, &(0x7f0000000ac0)=0x100) setsockopt$inet_sctp_SCTP_DELAYED_SACK(r7, 0x84, 0x10, &(0x7f0000000b00)=@sack_info={r8, 0x8}, 0xc) (async) r9 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000b80), r5) (async) ioctl$sock_SIOCGIFINDEX_802154(r5, 0x8933, &(0x7f0000000bc0)={'wpan0\x00', 0x0}) sendmsg$NL802154_CMD_NEW_SEC_DEV(r5, &(0x7f0000000c80)={&(0x7f0000000b40)={0x10, 0x0, 0x0, 0x40000}, 0xc, &(0x7f0000000c40)={&(0x7f0000000c00)={0x34, r9, 0xd9f8bf90aa33b54c, 0x70bd27, 0x25dfdbfd, {}, [@NL802154_ATTR_IFINDEX={0x8, 0x3, r10}, @NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x200000002}, @NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x300000003}]}, 0x34}, 0x1, 0x0, 0x0, 0x40000}, 0x4000010) r11 = syz_genetlink_get_family_id$gtp(&(0x7f0000000d00), r0) sendmsg$GTP_CMD_ECHOREQ(r0, &(0x7f0000000dc0)={&(0x7f0000000cc0)={0x10, 0x0, 0x0, 0x200000}, 0xc, &(0x7f0000000d80)={&(0x7f0000000d40)={0x28, r11, 0x300, 0x70bd29, 0x25dfdbfc, {}, [@GTPA_PEER_ADDR6={0x14, 0xb, @loopback}]}, 0x28}, 0x1, 0x0, 0x0, 0x4}, 0x4004000) r12 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000e40), r5) sendmsg$IEEE802154_LLSEC_DEL_SECLEVEL(r5, &(0x7f0000000f00)={&(0x7f0000000e00)={0x10, 0x0, 0x0, 0x20000}, 0xc, &(0x7f0000000ec0)={&(0x7f0000000e80)={0x2c, r12, 0x800, 0x70bd29, 0x25dfdbff, {}, [@IEEE802154_ATTR_LLSEC_DEV_OVERRIDE={0x5, 0x36, 0x1}, @IEEE802154_ATTR_LLSEC_DEV_OVERRIDE={0x5}, @IEEE802154_ATTR_LLSEC_FRAME_TYPE={0x5, 0x33, 0xa}]}, 0x2c}}, 0x800) (async) r13 = socket(0x2, 0xa, 0xffff7fff) sendmsg$nl_route_sched(r13, &(0x7f0000001140)={&(0x7f0000000f40)={0x10, 0x0, 0x0, 0x40000}, 0xc, &(0x7f0000001100)={&(0x7f0000000f80)=@deltaction={0x148, 0x31, 0x300, 0x70bd28, 0x25dfdbfb, {}, [@TCA_ACT_TAB={0x38, 0x1, [{0x10, 0x1b, 0x0, 0x0, @TCA_ACT_KIND={0x9, 0x1, 'vlan\x00'}}, {0xc, 0x1b, 0x0, 0x0, @TCA_ACT_INDEX={0x8}}, {0xc, 0x11, 0x0, 0x0, @TCA_ACT_KIND={0x8, 0x1, 'ipt\x00'}}, {0xc, 0x7, 0x0, 0x0, @TCA_ACT_INDEX={0x8, 0x3, 0x642}}]}, @TCA_ACT_TAB={0x74, 0x1, [{0x10, 0xe, 0x0, 0x0, @TCA_ACT_KIND={0xa, 0x1, 'pedit\x00'}}, {0x14, 0x4, 0x0, 0x0, @TCA_ACT_KIND={0xf, 0x1, 'tunnel_key\x00'}}, {0x10, 0x11, 0x0, 0x0, @TCA_ACT_KIND={0xc, 0x1, 'skbedit\x00'}}, {0xc, 0x6, 0x0, 0x0, @TCA_ACT_INDEX={0x8, 0x3, 0xe24}}, {0xc, 0x5, 0x0, 0x0, @TCA_ACT_INDEX={0x8, 0x3, 0x6}}, {0xc, 0xd, 0x0, 0x0, @TCA_ACT_INDEX={0x8, 0x3, 0xffff9d78}}, {0xc, 0x11, 0x0, 0x0, @TCA_ACT_KIND={0x8, 0x1, 'bpf\x00'}}, {0xc, 0x1e, 0x0, 0x0, @TCA_ACT_INDEX={0x8, 0x3, 0x5}}]}, @TCA_ACT_TAB={0x88, 0x1, [{0xc, 0x1a, 0x0, 0x0, @TCA_ACT_INDEX={0x8, 0x3, 0x5}}, {0x10, 0xd, 0x0, 0x0, @TCA_ACT_KIND={0xb, 0x1, 'police\x00'}}, {0x10, 0x6, 0x0, 0x0, @TCA_ACT_KIND={0x9, 0x1, 'gact\x00'}}, {0xc, 0x5, 0x0, 0x0, @TCA_ACT_INDEX={0x8, 0x3, 0x1000}}, {0xc, 0x8, 0x0, 0x0, @TCA_ACT_INDEX={0x8, 0x3, 0x6}}, {0xc, 0x18, 0x0, 0x0, @TCA_ACT_INDEX={0x8, 0x3, 0x2}}, {0x10, 0xd, 0x0, 0x0, @TCA_ACT_KIND={0xa, 0x1, 'pedit\x00'}}, {0xc, 0x1b, 0x0, 0x0, @TCA_ACT_INDEX={0x8, 0x3, 0x468}}, {0xc, 0x6, 0x0, 0x0, @TCA_ACT_INDEX={0x8, 0x3, 0x6}}, {0xc, 0x9, 0x0, 0x0, @TCA_ACT_INDEX={0x8, 0x3, 0x3}}]}]}, 0x148}, 0x1, 0x0, 0x0, 0x1}, 0x10841) r14 = syz_genetlink_get_family_id$netlbl_calipso(&(0x7f00000011c0), r5) sendmsg$NLBL_CALIPSO_C_LIST(r5, &(0x7f00000012c0)={&(0x7f0000001180)={0x10, 0x0, 0x0, 0x4000}, 0xc, &(0x7f0000001280)={&(0x7f0000001200)={0x4c, r14, 0x200, 0x70bd2a, 0x25dfdbfc, {}, [@NLBL_CALIPSO_A_MTYPE={0x8}, @NLBL_CALIPSO_A_DOI={0x8, 0x1, 0x2}, @NLBL_CALIPSO_A_MTYPE={0x8}, @NLBL_CALIPSO_A_DOI={0x8, 0x1, 0x1}, @NLBL_CALIPSO_A_DOI={0x8, 0x1, 0x1}, @NLBL_CALIPSO_A_MTYPE={0x8}, @NLBL_CALIPSO_A_MTYPE={0x8}]}, 0x4c}, 0x1, 0x0, 0x0, 0x20000000}, 0x4000001) 602.573126ms ago: executing program 1 (id=2409): bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000200)={0x2, 0xc, &(0x7f00000013c0)=ANY=[@ANYBLOB="180200001000000000000000000000001801000020696c2500000000002020207b2af8ff000d0000bfa100000000000007010000f8ffffffb702000008000000b70300000000000085000000ad000000870000000000000095"], &(0x7f0000000000)='syzkaller\x00', 0x2, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x38, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x1}, 0x94) 532.291473ms ago: executing program 0 (id=2410): socket$nl_route(0x10, 0x3, 0x0) socket$kcm(0x21, 0x2, 0x2) socket$inet6_udp(0xa, 0x2, 0x0) socket(0x2b, 0x1, 0x0) r0 = socket$inet6_sctp(0xa, 0x1, 0x84) bpf$BPF_PROG_GET_FD_BY_ID(0xd, &(0x7f0000001880)={0xffffffffffffffff}, 0x3) bpf$MAP_CREATE(0x0, &(0x7f0000001580)=ANY=[@ANYBLOB="1200000003000000040000008000000012320500", @ANYRES32=0x1, @ANYBLOB='\x00'/20, @ANYRES32=0x0, @ANYRES32, @ANYBLOB="01000000000000000300"/24, @ANYRES32, @ANYBLOB="ca7640ffe123a611d26ffa83e27ab5ccc1ee8a367707c15b06b2a9c0d19aa9e11a019fe68c7ce841873f230c299b0b6af9a82a402efdb398bf6b9531d54d320eb4f12d244cd28eee0d860ceb83ace5b58fd14ff8b878b6fdca785b0c6ed7a07e314afc9e8d168d10b3f27b0292c509e0430342aba3129ba2fa56d677455d341b2027ea57b10a06db24bb3df56518321499a31799366095302f8561cf753d793dd1aae2b6198426c79b8b"], 0x50) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000001880)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={0x0}, 0x1, 0x0, 0x0, 0x8040}, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000300)=ANY=[@ANYBLOB="2c00000078000104020000000000000007000000640000001400018008"], 0x2c}}, 0x0) r2 = socket$netlink(0x10, 0x3, 0x0) sendmmsg(r2, &(0x7f00000002c0), 0x40000000000009f, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0xc, 0xe, &(0x7f0000000b40)=ANY=[@ANYBLOB="b702000009000000bfa30000000000000703000000feffff7a0bf0fff8ffffff79a4f0ff00000000b7060000ffffffff2e6405000000000065060400010000000404000001007d60b7030000000000006a0a00fe00000000850000000d000000b70000000000000095000000000000002c3f2cc2b7956244cef7baf48e6d2885a09a87507ebfc75b5b0f4e4309ebcdac5f7a860c008cbdd3b4c3b7f28754860c9c781f6410457253e89ad528d985636a86ec0f68f59cd1159a2c2e85d726859a919cc9548a349980d1ccdce27f94bc074c27f81078545c146a0857153b7b8f00034debae58a4ab415b0d7ff0575cc272cd3d7e8d974927676468ff2d86e0ffac94792ed9cf6b40b3cf252a47c05ae8a70d57cc3e067d1867b54d24e20000000000000020009ebf84d3b042d6e432cd080e3b57239f0127473e6ba922aff649609d40b47ec331ccba3cf96f9483ff19a6471bf5abc742d9cbcfb964b11b31034694a6aad86cf08a6c7b2235dc99de9aa3e6b77c7a2877261ed32da90864987f30926c9013eec3b86836ae50447aa5a79f40c235000000453302712c3d8fc4e2b61adb0695e800000000d4f4e91f0000002c33df424d1bafe5725c8a404724f8a4f1cda7997b65954f74097560b91da309b887af2485c2d9ab09b523000000000000000bf7b2ff4602aec1eea200000064881c5630521a08e051374cf05c921a06fb7818000000009dc8d95e0e5b365d10e1004dae58b3b5b89709b0ff47b200000000004000cbef88811dc8c1b27ac7d9a6bb70f60eb9c01dd2fc79b85e4d961498f3a80131d21d856177a2189f45d011ef1da5c6d57bb8fd387ccea9c3899a914e47e82f040000009d81003f927355408f87264797d3fa970949793b94329d580500d1f91c0d22587e05a61e3d8576ca168e88d7a9af95b04a37c27bfffab9abbb31fa8c0080258cfa6d3f166e695f3c56490aeef464d9965d70a50f1282619344f223548e750339643adac1322c87ca253ff2fb1882760d6feab16bacdf83c11816dbe959ebc5ec479c8319f73e2249eab0486b110702a481d3b51976a52303056e800b4ae5acc2dfae60ab958e9f3ef9b4aaa4e8d6166f636a65eb1d672bf2000000cda8462cc9b16624998be65683321e970000000009b8e20762c1bf4a3eb6769f2b23e842bacd9c685edea0ffa3e975424f8ede49e61a4de808a38ba3512d64dc71867df4eee3f1ff791cf7c9862f98b45852e4b2f78721b978a2df2f2a29a387c6f0576b36038f819286eca99a6a434811cf2a117d775fe986a49fb82cf5f15972d5ab18f1045384501adabb20f7b0e15ff47f1744e2341b59034959a1289ba6e243668e6735305707e3de7652bfc5b60c76deff43a1d6fd6a4180ab723735abbeffe7f2ec3a0bb86f9eddfc0f3d1d503d7a54b49e1ae6c5aa620d27e91aa0aa0ed6fcacfc91fbb4c256409e54daefbb107c381fa729ff5f3907d93430da178d685d7730f5e129438a5214f722096d2986334c2576bef69145d3fbd78a9059e454474f92e65828b018174a9f4738b8c71fbdeac26ab95e02f9a847182766964976b1fccdb9f35721e43e33883cf16ed1343fb7429eb395123b0a4262b7023c22039b9002589a378ed4c6267965af78b861bd025312538cec97966b8973d4e299d9802264d06e40ae118e1d242d1128dcedeb44030df12ef68f78215d65f96eb55db8cbcb060008000d988374f85451a694ffe38a1d03916ff10dc82b31c98d42e1a1bda1290de1a499a5a385b31112a48ba3e6d6849914c1788a7aca37177cc341fff44fec5c5e0abae01c439a1b0311e074e81ae9993b5b3459553e4ece78d4c1501c70f5d81e0725d5b273755c0000000000000000aa4234ff82182952a76233d18e7d49638aeb04e7a9e9e7eafb7c255372795d2d192a0a33cab0f5bf2e93e0544fcdf2df2bc6ce96e5a11993d54f97a23754ac828674dbb93c0ad345715be4a13678b01edf76d8a923655800a2c88cce004505ab45d8f5f88aa887bbce5c18970428516f6099bdbb2cd7a2356397f1a0a23e662e2a6c4834400cbaa41c3c574e6e6aefb7a68da5ec1ae49f968bbe0e0bf9878516f553639f5b4828e92019b61f5874be1c7cdd9482df50bc24a8a1fa10d291390eb84e26a2e8dbeaa45604b05a116c1210a7540bf81005044273f5a8ffc538db289350eb248e483bd8920efcf30a798c2b636243e0a37262ca47dfeefa753ba528f7ba77e825051ce69b4475d7d714ba0c636e6ae9f710411d30ef424aeaabe057c7df6ff8f767bcd9012e1047c686f5ccb76ab3a5df53cbc22ba7ea8f6a8e220bb4d83de1e4dc19d6c1be841503850803bc2c2d5e0e34270a7f1cca0c6c53a8e5f891f7a793a70da62d6d88fbb90d220acc687931b42d6be83ab870da3c0a567f5e65ec0457f4ad2a4ec0b671b36388afd5520a8483a4b11f7d02a409315f0f9e59f47668d68a74838d6976e12fd45200014041dffacbf60892ec8bd7560686f137a806d3dfaba900b47cac62f828342fff009adb5b2251461a1b9d6ba625b8fe04e69a1a4be2696f0000000086e172932e03000000000000005942e1b9d6dc28ab8e19e1111dd893e801015642faf21eef40d6e7de3ef62c4bc5ff17e7aeb2841098f845d1cc9ec4eee79c298fb0ba939b13707044e2e9cc0d350438c1c8c6bb9a38c6ac5ca0d9cf1f3d6915f25cb26edfc28b3079b97df32601240e454db103fb0c4a143673a3f160d3a7b83ecd0509ce9eba0c7bf7843799b1b56a234f9eaab8a3f14f1472bb6aaeb8ac9ee4054605558ab31f339f6a4caf2ee2fd01f34dca3300000000000000000000000000000000f59f8e6e00000000c44130098d833a24000000000095e6f945ba9a941cef5e70b8c152321e24b5b29bcf374dcf5a29a35d76e6e2bf8df95462690a4fc9ec8129e92b6ebb4b40a992a75d3c595426ae40d0bfc87db24d856359079b29b3c374d081c300b2cfaa596d24e800ef8e2201f2fb7a9946f89f9f31f7cbd603fd7f8898c70b5c65f2e28f22e1a79a6af3a54861b07f124642e98389557affbdede09b5566a4a1ee73b20846810030a754acddcdafe3ceeeebc0b5f2fedfe7d198e3067f3dbac9441a9ab8409cbbb7e15b9ae3944097de34de2001c8533a3766e6e4c4c4702ccb932a27a3962814cd6aa8fc684beeaa3932efae3a9052be8eec1e95f6ad8d41dd34829503ba4b66e27154cb6e34aa13450522df1723130b6fe347c93f00e40e293c98d849a33f773c743728992f40faccd5c23130a1c6bfd6fc661bca1598137ddd1090ded672f5a48a40cab3f640c8241a364cbdd3f188eec7da7bccafbd5bf28a46f0eecc6b550471b0b0770c6a5a411c0e0b19e15a461e7c6833ba936e214b013f2819ec6572a43b5cd32b11d7e4f8dcf8f7820a17b7b2ee6178a03351dd25091e46bfd82a3979b9cad109fd6217cd52aa81bdabd50826a674bd16b8f7e6aed12a305366599f5f029a7b24558c027518c669760500002f1c19d16a6f391906000000cc0bbbfb8c698ecc137d96711100e0108d3bd2afed0b279ebf0527552a9331e646c424b14ffbb815622bfd2f635855bed1b164d0a56bd104be069854111c5b26ec3c652b5f0a6b9676dae987ec23456ba05a4dfb15321ef6b76e7e547a688c67ab531cfc784c9f940d9fb0464a6cce635e14b80dc5c1c64e75e6bd5355d84f8df272f18f58c570e7afd83ee77f157c146aa747b728969aeb4aba1d8f9de1b3fb8ab6ea50e884c2ea98e6400bf0c5ae2887cd1da0e57ccfdf5eca2b455247efcc13102846c0a85f20c80007c0ce6efce627b95b8ad3003385de97101678fb2163ecea6e70a77a6fbc089e31a5ccece932229b8f79faa6863d6857c3d9a9710f9f8ad16eeb8342278f311cbc226498028234d21466892983378fe64acbb44f694cd78e43c74aa75505cb1c91b189f8f89f233a05f5cd4e173a373178557843dd705268f74a9e5429945503195aefd6706b584d8408c9652b3fe68500747f7ee8375fa559c3ad195d3795df1a8364cd13acc3256ee4634c73eeb6954d0fcf09ab84df0b8900e0c6fea2ccb600ae7a4b128cae19df160e7c207b89132d1d5bdc9ffc79f0549b82df521817651d5fead5128205b92ccdccc69407ab556217af277af911dbd456dfc43dd061b6c91485dcc208cf0b3d0bf851de413f5de5ec015e296914afab6411109355e027ce04990d9aae251b9deb11b7db45b9f15b7b55d8fdbedd9e6cf891205694f02be8b9ea8ecd41308a0e1b93ae3435bfa88b440b1f701b4d0fc49c82193f27f8023b630ea97edbf3bf421a0a1a2b4ac7bb30bcd1cdd172c0df37408fd6827bb03e8742fc1c7a2befd1299928c5f79e846a8dc7ca648d960a759e6711b69776896a9656d59af6d44bc5348229fa84ae78af8421a22c4b4c17a3d24a4a0104000000000000d77cc4eef51c2b417c8c7458ddd7dd9d1a863bf0a9e1a30a19020490038017a5c7e474c83302a2c2b5c976dacf3dda7191c757f208000000000000005f7ed983f65723fbb36b9b51abb0dbcd335700000000000000000000000000000086666201251aa4f139d0485ffcf89f01639fd1579a3802f720a0215c720a97071f5065a23642a58275dbca444b00e2e5835185d5d5b2796eb0fe32cf3b0633f58ecc7648c3c6efe82f93a3008052416512eea30ea9472e0b456a652883c0907323cf03be193a05008cdef7a98a1671a1918df310dc4bfd61c3db4819ab1c57b348a8ff1ed36364a20fe846f1cd086058d139ce528425b31c5d08b433562ffb318c1285011f9b78b2401989384311101e452f54661ecdb2514a6ae50dbdd422de0f0f8c670000000000390be79688f80c47314cb1b14afcaa5d23f9032e0ec51f45f447d6a7c798fcf7e60e2180e289410801e4f03a0e140f388f25b92da1025d8409e171a2336ed71cca86eb4658fe06df286e0e20276b0618eeffd05774f15686cd9d3182ca2fec863875f305fed6baf48a594db12582a38cfdffffffffffffff0cf8d920517835fe7d09cfcb624f6931f1cc6f6b71f58de9ddc38e0c43992f6bc57a718d0cfd197b5324b4e05ef1caa96db3ae1f2f2e5791faba2ebbe1a6faf21f2748fb1fb6743c3ca8af4e6b02518c9b7fdc1b5721eb1c3ed98db25536f74ac7861afc94544e52dcb5c60460a05802e3b437ac977bfa26b887a2443e8d559c58187f004eb82b07937df6e96f77ed551926bec4e0188fae10a35d1c5f1768ac6be829bea46f1babc3d74adc31ca71bdab9079e4288881b434484eadde9da6b81802842abd462d546c59d87acc014f81d3414759bda12d2a2c6bc1bfa807bd3101eb227184a61107b6d0618e2a3b842671e084ac3f0ff94dc48b51601247318ab4d1c5106458000000000008000000000000cfee0107e6c2fe8639d926829fdbbd86bf591a8c3c235d8939af9d923f648165881a6c29997234406400b3b1c321cc158dbe17123eace30000000000009ea77cb4d3ca892600000000796de6ae4ae40bdf9a6e8c5dc29562262af9cd54e8e3ecc7e3c8cba0ecc791683496c4e5c1a5729714d9f9031f49b400cd2667b4ea6df54809615a4f973f93e6ccec72f16ff998e29ed99df733680a9d5cea57f99cc139b6ea9014f3000000000000000000000000000000000000feeab45a4046a622b0dceb413e4e39b7317e92cbed46b41ab5115bfb542c933783d750852dfdc6656aaf15e10615a88821f2f1bc53969b52d6852755e7681ad5beda80b38ccd34116b99f50b4fdd967b3f20f260455412b67563e40e323bde9d673fceda0ad6981565c8a183d928903b4f4472dde41b6dcd75314c31e704dfcb222c8359fe88944f852242270c932abfaeece0843d708f5cd25b2a63ae1e79723c1c3c013836b47da0a35d0f34c070000000000000422ae2c148d444dd437a7d2f5e575009bc2d17a199802409329dae8baa58d3de63ad45328a9d4dc1ace543dfe11913c6c6413f8f7a15657d012fea460bb4656a20df1ba26932b0ef49f8ea88d7b4c1289314ba789661640f1b5d7cbae103fa95b0035f1e8e866307d4796eab0992704f9e00be4b1af8dfa9e94ad74e607ea9d7d7a95ed5a15429426abbed8d2c657018305c6f9e5159a5453f958991a908ff4cb2e8cbccb1d3c8daf754e4b01b2edd023e5bfdf293bd28fc1f8885f6edd5a715df4d180247feb08e9e2e5126c48be6098e711f0d86de5d76fdccae34eef9197c32ab4e6fcb52eb9ce18fdb621a75913a97254d783778203ec0bd1a8859683e1d01da4e81fb73bb3b358340a0310bf5ae17b917208da607fd7b125cf99fd3e9056f5184df7570ede94b736ae354b5b8ae2cc473b455f2f86d47c69027676bf1141f316b0f278f1692406572ee82766f8e5ff1cfec2a7a6cab7d0f2582a877c9bd4ca81089373f738d02e6bb4d3df30ac0f041e51ad36e1ff140812baf54b80635cc80963c8f69fa4506f7a30c99d3e538cc0aeafcad86ead38ed949aa3c204aea50e5e0039f01b82595b7dc921a8acc1f76340f060cc9a3acad3451c17dc9b5ca5d10a0cb1708592d1900a046f33761d50895febd9fd58cb132989766cf7c252daac259576ec218e3857e6fa97fe445d1fab51d87302a4bb28a4cfe462ee4849cc6832650188ca187d85509d8beccf9d9cf752368985804195b9fd2faf1aff8248f3981bd55cbbf514cd8365fee72cc7af053e5388ceadadb967ef735181df6a90cab13f58f6d563c9ab4ad37297aecffd8446cb2b14ec36a99af8393e3760d5970ba1debdcbccd54012c559ee2797ff962328aa6a252c0756e396ce4d52937546675203bdf1d6b120acac576523f8b1daa922188bf61536312f90dba92fb380c3c6fb5f9883a2c4dd99a1bac9b7cb25ff2ef9bd58ff97ddfdd2d4bcc371ee82245b57cd91a7fa3479cd339f54a5c422b753cd42d441ea881d46e419312db1f0cccce"], &(0x7f0000000340)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, 0x0, 0xff9d}, 0x48) getsockopt$sock_cred(r1, 0x1, 0x11, &(0x7f0000000280), 0x0) sendmmsg$unix(r1, &(0x7f00000001c0), 0x0, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) getsockopt$sock_cred(r3, 0x1, 0x11, &(0x7f0000001340), &(0x7f0000001380)=0xc) sendmmsg$unix(r3, &(0x7f0000002f40)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f0000001580), 0x0, 0x40800}}], 0x1, 0x0) r4 = socket$inet_sctp(0x2, 0x5, 0x84) r5 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000002c0)={0x1f, 0x3, &(0x7f00000001c0)=ANY=[@ANYBLOB="1800000000490000000000000000000095"], &(0x7f0000000180)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x11}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000900)={r5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffe04, 0x0, &(0x7f00000008c0)="89", 0x0}, 0x32) ioctl$sock_SIOCETHTOOL(r4, 0x8946, &(0x7f0000000100)={'netdevsim0\x00', &(0x7f0000000000)=@ethtool_ringparam={0x33, 0xffff5257, 0xae2e, 0x100, 0x7, 0x0, 0x400, 0x3, 0xffff7fff}}) gettid() r6 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_int(r6, 0x107, 0xa, 0x0, 0x0) setsockopt$packet_rx_ring(r6, 0x107, 0x5, &(0x7f0000000240)=@req3={0x1000, 0x1, 0x1000, 0x1, 0x10007ff, 0xf84, 0xfff}, 0x1c) getsockopt$inet_IP_XFRM_POLICY(r4, 0x0, 0x11, &(0x7f0000000380)={{{@in6=@remote, @in=@loopback}}, {{}, 0x0, @in=@dev}}, &(0x7f0000000140)=0xe8) sendmsg$nl_generic(0xffffffffffffffff, &(0x7f00000047c0)={&(0x7f0000000040), 0xc, &(0x7f0000004780)={&(0x7f0000004800)=ANY=[], 0x179c}, 0x1, 0x0, 0x0, 0x40}, 0x20004040) setsockopt$inet_sctp6_SCTP_EVENTS(r0, 0x84, 0xb, &(0x7f0000000180)={0x29, 0xff, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x3, 0x2, 0x40, 0x93}, 0xe) ioctl$int_in(r0, 0x5452, &(0x7f0000000280)=0xffffffffffffffff) 513.51047ms ago: executing program 2 (id=2411): setsockopt$inet6_tcp_TCP_MD5SIG(0xffffffffffffffff, 0x6, 0xe, &(0x7f0000000300)={@in6={{0xa, 0x4e23, 0x101, @private2, 0x8e4}}, 0x0, 0x0, 0x2b, 0x0, "bb02a3c364ca41d6357e54452401400400941292f4925a1e1ea6324d6193fcf19b49f3eefb1f56c54dc46d8b6d2ccd118aa0cc1dc2767bbe000100060000010100"}, 0xd8) r0 = socket$kcm(0x23, 0x5, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) r2 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$netlbl_cipso(&(0x7f00000002c0), r2) sendmsg$NLBL_CIPSOV4_C_ADD(r2, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB='X\x00\x00\x00', @ANYRES16=r3, @ANYBLOB="010004000000fcdbdf25010000000800010003000000080002000300000034000480050003000200000005000300000000000500030007000000050001"], 0x58}, 0x1, 0x0, 0x0, 0x80}, 0x3000c000) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) setsockopt$sock_int(r0, 0x1, 0x6, &(0x7f0000000240)=0x9, 0x4) listen(r0, 0x800) r4 = accept4(r0, 0x0, 0x0, 0x80000) r5 = socket$kcm(0x2, 0xa, 0x2) ioctl$SIOCSIFHWADDR(r5, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local}) write$tun(r1, &(0x7f0000000380)=ANY=[@ANYBLOB="1c0000f500000000000000862dfdff000000"], 0x78) getsockopt$inet_sctp6_SCTP_GET_PEER_ADDR_INFO(r4, 0x84, 0xf, &(0x7f0000000040)={0x0, @in6={{0xa, 0x4e24, 0x4, @mcast2, 0x1f99}}, 0xb926, 0x5, 0x4e, 0x9, 0x9}, &(0x7f0000000100)=0x98) setsockopt$inet_sctp_SCTP_AUTH_ACTIVE_KEY(0xffffffffffffffff, 0x84, 0x18, &(0x7f0000000140)={r6, 0x6}, 0x8) 481.700116ms ago: executing program 1 (id=2412): r0 = socket$inet(0x2, 0x3, 0x8) setsockopt$IPT_SO_SET_REPLACE(r0, 0x0, 0x40, &(0x7f00000003c0)=@raw={'raw\x00', 0x8, 0x3, 0x380, 0x0, 0xe138, 0x198, 0x1d8, 0x198, 0x2e8, 0x358, 0x358, 0x2e8, 0x358, 0x3, 0x0, {[{{@ip={@broadcast, @loopback, 0x0, 0x0, '\x00', 'veth0_to_bond\x00', {0xff}, {}, 0x21}, 0x0, 0x170, 0x1d8, 0x0, {0x0, 0xe000000}, [@common=@unspec=@string={{0xc0}, {0x0, 0x0, 'fsm\x00', "0d0004000000000000000004fff0cf81dfd28c89544e14cd3e01dd24289831867846c88621039b284c3ff45c42995560a99952bed40cf5a8c1df6cdbdb7e2378d5afd35f4c16827f55b3af494e39e8fb330200000000000032b6a99a8d87298e88a94cb519f5c17631af916a0002000000000000000000000000000000000049", 0xc}}, @common=@unspec=@connlimit={{0x40}, {[0xff000000, 0xff000000, 0xff, 0xff000000], 0x6, 0x3, {0xbd6}}}]}, @unspec=@CT2={0x68, 'CT\x00', 0x2, {0x10, 0x0, 0xfffffffd, 0x0, 'snmp_trap\x00', 'syz0\x00', {0xfffffffffffffffc}}}}, {{@uncond, 0x0, 0xc8, 0x110, 0x0, {}, [@inet=@rpfilter={{0x28}}, @common=@inet=@tcp={{0x30}, {[0x4e20, 0x4e23], [0x4e20, 0x4e24], 0x4, 0xc2, 0x1, 0xa}}]}, @unspec=@CT0={0x48, 'CT\x00', 0x0, {0x0, 0x2, 0x0, 0x0, 'syz0\x00', {0x5}}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28, '\x00', 0x4}}}}, 0x3e0) 296.663209ms ago: executing program 3 (id=2413): syz_emit_ethernet(0x56, &(0x7f00000006c0)={@multicast, @random="0e10840dc342", @void, {@ipv6={0x86dd, @icmpv6={0x0, 0x6, "081f20", 0x20, 0x3a, 0xff, @dev={0xfe, 0x80, '\x00', 0x20}, @mcast2, {[], @ndisc_ra={0x86, 0x0, 0x0, 0x0, 0xf0, 0x6, 0x5, 0x0, [{0x1, 0x2, "8fe385338db8892faa3b66b04dc3"}]}}}}}}, 0x0) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) close(r0) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) close(r1) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r2, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x0) sendmsg$NFT_BATCH(r2, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000000380)={&(0x7f00000003c0)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a50000000090a010400000000000000000a0000040900010073797a310000000008000540000000020900020073797a310000000008000a40fffffffc0c0009800800014000000002080008400000000114000000110001"], 0x78}, 0x1, 0x0, 0x0, 0x4000850}, 0x40) sendmsg$NFT_BATCH(r1, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f00000002c0)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x5}}, [@NFT_MSG_NEWSETELEM={0x40, 0xc, 0xa, 0x101, 0x0, 0x0, {0xa, 0x0, 0x6}, [@NFTA_SET_ELEM_LIST_SET={0x9, 0x2, 'syz1\x00'}, @NFTA_SET_ELEM_LIST_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_SET_ELEM_LIST_ELEMENTS={0x14, 0x3, 0x0, 0x1, [{0x10, 0x0, 0x0, 0x1, [@NFTA_SET_ELEM_KEY={0xc, 0x1, 0x0, 0x1, [@NFTA_DATA_VALUE={0x6, 0x1, '\x00\x00'}]}]}]}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x1}}}, 0x68}, 0x1, 0x0, 0x0, 0x4000850}, 0x40) sendmsg$NFT_BATCH(r0, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f00000002c0)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a400000000c0a01010000000000f9ff000a0000090900020073797a31000000200900010073797a310000000014000380100000800c0001800600010058"], 0x68}, 0x1, 0x0, 0x0, 0x4004850}, 0x40) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_MSG_GETSETELEM(r3, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000200)={0x2c, 0xd, 0xa, 0x301, 0x0, 0x0, {0xa, 0x0, 0x1}, [@NFTA_SET_ELEM_LIST_SET={0x9, 0x2, 'syz1\x00'}, @NFTA_SET_ELEM_LIST_TABLE={0x9, 0x1, 'syz1\x00'}]}, 0x2c}, 0x1, 0x0, 0x0, 0x24000801}, 0x8000) syz_genetlink_get_family_id$nl80211(&(0x7f0000000440), r3) 188.095626ms ago: executing program 1 (id=2414): r0 = socket$kcm(0xa, 0x1, 0x106) sendmsg$kcm(r0, &(0x7f0000000140)={0x0, 0x0, 0x0}, 0x20000011) (async) sendmsg$kcm(r0, &(0x7f0000000780)={&(0x7f0000000000)=@in6={0xa, 0xfffe, 0x0, @ipv4={'\x00', '\xff\xff', @dev={0xac, 0x14, 0x14, 0x16}}, 0x2}, 0x80, 0x0}, 0xe07e872420dfefca) (async) socket$nl_generic(0x10, 0x3, 0x10) (async) bpf$ENABLE_STATS(0x20, 0x0, 0x0) (async) r1 = bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="1b00000000000000000000000080"], 0x50) (async) r2 = socket$pppl2tp(0x18, 0x1, 0x1) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) ioctl$TUNSETIFF(r3, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x2}) (async) r4 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) close(r4) r5 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r5, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000600)=@newqdisc={0x4c, 0x24, 0x4ee4e6a52ff56541, 0x1, 0x25dfdbfd, {0x0, 0x0, 0x0, r6, {0x0, 0xb}, {0xffff, 0xffff}, {0xfff2}}, [@qdisc_kind_options=@q_netem={{0xa}, {0x1c, 0x2, {{0x3, 0x3, 0x6361, 0x5, 0xffffffff, 0x3}}}}]}, 0x4c}, 0x1, 0x0, 0x0, 0x40088c1}, 0x0) (async) sendmsg$nl_route_sched(r5, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000140)=@newqdisc={0x34, 0x24, 0x4ee4e6a52ff56541, 0x70b926, 0x25dfdc04, {0x0, 0x0, 0x0, r6, {0x0, 0xd}, {0xfff3, 0xb}, {0x4}}, [@qdisc_kind_options=@q_cake={{0x9}, {0x4}}]}, 0x34}, 0x1, 0x0, 0x0, 0x240000a1}, 0x4890) ioctl$SIOCSIFHWADDR(r4, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) (async) r7 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r7, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) (async) r9 = socket$packet(0x11, 0x3, 0x300) sendto$packet(r9, &(0x7f00000005c0)="ba45efcc74567f08fa0000ea0756", 0xe, 0x4041, &(0x7f00000001c0)={0x11, 0x88a8, r8, 0x1, 0xd8, 0x6, @broadcast}, 0x14) getsockopt$sock_buf(r2, 0x1, 0x14, &(0x7f00000004c0)=""/41, &(0x7f0000000500)=0x29) (async) r10 = bpf$PROG_LOAD(0x5, &(0x7f0000000800)={0xc, 0x10, &(0x7f00000004c0)=ANY=[@ANYBLOB="180000001400000000000000ffff020018150000", @ANYRES32=r1, @ANYBLOB="0000000000000000b7080000070000007b5af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b70400003e000000850000002600000018110000", @ANYRES32=r1, @ANYBLOB="0000000000000000b702000000000000850000008600000095"], &(0x7f0000000180)='GPL\x00', 0x0, 0x0, 0x0, 0x40f00, 0x3, '\x00', 0x0, @fallback=0x1f, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000d80)={r10, 0x18000000000002a0, 0xe, 0x0, &(0x7f0000000040)="76ea090000000000009ba56a88ca", 0x0, 0x6400, 0x60000000, 0x0, 0x0, 0x0, 0x0}, 0x7f) r11 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r11, &(0x7f0000000040)={0x2, 0x4e20, @empty}, 0x10) (async) syz_emit_ethernet(0xbe, &(0x7f00000008c0)=ANY=[@ANYBLOB="aaaaaaaaaa23aaaaaaaaaabb0800450000b00000000000119078000000000000000000004e20009c907801000000000000007b4b143b7461fd777b1c012bd14efb9f49fcdb8f080c26a04883ad5c8c82b8af584cbf2649a50f2dbc43efa8698d0a881c51852e4451b57d037ad3c045942824251d7d17b5191584bcd4fbe40a23424dbcfd56f1375461caaa2f19935e6996c7096ffeeb03000000000000649a3bfbc1d19cb307b3472ab9cdb042d2643fcbb2c5a57df67d074af6e8dafe09497a348697d6c4ffb0c11dbd4d1d4663dfd507ecf3083140419998cb53d7fb83f953a57e6b3ae8f56e38929978c1153de237cf3ff04936886326a89e73e037f04f11"], 0x0) (async) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000140)={0x6, 0x3, &(0x7f0000000680)=ANY=[@ANYBLOB="1800000002000000000000000000000095"], 0x0, 0x5, 0x0, 0x0, 0x60ff78ce1cb3c070}, 0x94) (async, rerun: 64) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000480)={0x6, 0x221e, &(0x7f0000000680)=ANY=[], &(0x7f0000000080)='GPL\x00', 0x7, 0x0, 0x0, 0x0, 0x50}, 0x94) (rerun: 64) recvmmsg(r11, &(0x7f0000000880)=[{{0x0, 0x0, &(0x7f00000007c0)}}], 0x1, 0x40000020, 0x0) (async) ioctl$SIOCGSTAMPNS(r0, 0x8907, 0x0) 173.103964ms ago: executing program 3 (id=2415): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)=[{&(0x7f0000000200)="68000000000905040000000100000000020000000900010073797a30000000001400028006000100000200000500020006000000", 0x34}], 0x1}, 0x800) 165.367637ms ago: executing program 4 (id=2416): r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000180)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb(aes)\x00'}, 0x58) bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000180)={&(0x7f0000000100)=ANY=[@ANYBLOB="9feb01001800000000000000240000002400000008000000000000000000000b03000000000000000000000d00000000040000000000000c020000000000000061612e00e93af02335324f37184e45e59c7d757a7052bee1f17622a9fda51f2cd8798b7b51c6deb4facdf6d9afd904582b1e89ac6d4ed11e5c5107d3"], 0x0, 0x44, 0x0, 0x1}, 0x28) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000000380)="71e67a15cdf00900c7d8b900003a52a7a39d8024a9760f9c56fc4eea7840b3c75f4e7a4a201b3cc889bce1ad99dccb4766aa0ed94db9633dae75ed6d723c8f095b2b4396d5d133a200e831b8739d849494f2a5b9b45f0c000000000000085b6d5d84e4f63a14bacc8d612a18ca572b924fa03f6cb71f7c3eb650f424891ad1dea9d872301fd24b9f2b5a5ad4928463c3f76f914d24b043a423dc688fc3b6e242cced13ec1b95e82cd5b5466c1bc342962831497dcc9d94856628d9a12604670bda3047f272e9994b2a0b8e5bb4817c1a9cf9dbbd3158bca6fddad02c6042d6f1980cfcf74a4efee51a317a2c3508771faa6030faef22cb4a0a3db39306febe24196219475d00d438dab0d07f48113a072dd208c038de01707435a7627efd7d87f35ae50496f271", 0x127) r1 = accept4$alg(r0, 0x0, 0x0, 0x80000) sendmsg$alg(r1, &(0x7f0000000280)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x880}, 0x404c804) epoll_create1(0x0) socket$alg(0x26, 0x5, 0x0) (async) bind$alg(r0, &(0x7f0000000180)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb(aes)\x00'}, 0x58) (async) bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000180)={&(0x7f0000000100)=ANY=[@ANYBLOB="9feb01001800000000000000240000002400000008000000000000000000000b03000000000000000000000d00000000040000000000000c020000000000000061612e00e93af02335324f37184e45e59c7d757a7052bee1f17622a9fda51f2cd8798b7b51c6deb4facdf6d9afd904582b1e89ac6d4ed11e5c5107d3"], 0x0, 0x44, 0x0, 0x1}, 0x28) (async) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000000380)="71e67a15cdf00900c7d8b900003a52a7a39d8024a9760f9c56fc4eea7840b3c75f4e7a4a201b3cc889bce1ad99dccb4766aa0ed94db9633dae75ed6d723c8f095b2b4396d5d133a200e831b8739d849494f2a5b9b45f0c000000000000085b6d5d84e4f63a14bacc8d612a18ca572b924fa03f6cb71f7c3eb650f424891ad1dea9d872301fd24b9f2b5a5ad4928463c3f76f914d24b043a423dc688fc3b6e242cced13ec1b95e82cd5b5466c1bc342962831497dcc9d94856628d9a12604670bda3047f272e9994b2a0b8e5bb4817c1a9cf9dbbd3158bca6fddad02c6042d6f1980cfcf74a4efee51a317a2c3508771faa6030faef22cb4a0a3db39306febe24196219475d00d438dab0d07f48113a072dd208c038de01707435a7627efd7d87f35ae50496f271", 0x127) (async) accept4$alg(r0, 0x0, 0x0, 0x80000) (async) sendmsg$alg(r1, &(0x7f0000000280)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x880}, 0x404c804) (async) epoll_create1(0x0) (async) 93.988881ms ago: executing program 3 (id=2417): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) r1 = socket$kcm(0x2, 0xa, 0x2) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0xe}}) ioctl$TUNSETOFFLOAD(r0, 0x400454d0, 0x1) r2 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_int(r2, 0x107, 0xf, &(0x7f0000000240)=0x2, 0x4) setsockopt$packet_rx_ring(r2, 0x107, 0x5, &(0x7f0000000040)=@req3={0x1000, 0x3a, 0x1000, 0x3a}, 0x1c) write$tun(r0, &(0x7f00000004c0)={@val={0x0, 0x86dd}, @val={0x0, 0x4, 0x9, 0x4, 0x0, 0xca6}, @mpls={[], @ipv6=@gre_packet={0xe, 0x6, "ec00be", 0x44, 0x2f, 0xff, @local, @mcast2, {[], {{0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x88be, 0x0, 0x6}, {0x0, 0x0, 0x1, 0x1}, {0x1, 0x0, 0x1}, {0xa888, 0x88be, 0x2, {{0x6, 0x1, 0x9, 0x2, 0x1, 0x0, 0x3, 0x5}, 0x1, {0x88a8}}}, {0x8, 0x22eb, 0x20000, {{0x0, 0x2, 0xc, 0x0, 0x0, 0x2, 0x7, 0x8}, 0x2, {0x2, 0x4, 0x0, 0x5, 0x1, 0x1, 0x1}}}, {0x8, 0x6558, 0x2}}}}}}, 0x7a) 674.084µs ago: executing program 4 (id=2418): r0 = socket$inet_tcp(0x2, 0x1, 0x0) r1 = socket$igmp(0x2, 0x3, 0x2) r2 = socket$netlink(0x10, 0x3, 0x0) r3 = socket$netlink(0x10, 0x3, 0x0) r4 = socket(0x10, 0x803, 0x0) sendmsg$IPVS_CMD_SET_INFO(r4, &(0x7f0000000b00)={0x0, 0x0, &(0x7f0000000ac0)={0x0, 0x14}}, 0x0) getsockname$packet(r4, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r3, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000003c0)=ANY=[@ANYBLOB="3c0000001000850600"/20, @ANYRES32=r5, @ANYBLOB="01030003000000001c0012000c000100626f6e64000000000c0002000800010005"], 0x3c}}, 0x0) sendmsg$nl_generic(r3, &(0x7f00000005c0)={&(0x7f0000000480)={0x10, 0x0, 0x0, 0x8}, 0xc, &(0x7f0000000580)={&(0x7f00000004c0)={0xb0, 0x16, 0x1, 0x70bd28, 0x25dfdbff, {0xb}, [@nested={0x99, 0x11f, 0x0, 0x1, [@generic="931ed2839348a7578d5faeaf54e28e9fd241c21c7601cdfea4b3f30901d7dda48ffab2d692291e0f648828ffa49dbce06ea1fb2a2b41b01cb790d6ef92835b558553fd344287fcfac9c6e94e4ea08d62cf24f474c81548f53a7b7dccee8d9ea6d4026be635a151b93c595c3b6bf2e9c4f69fa79b9cc05b9cfd35c4b48a7a162a4d9907153ad34b03465c23c5f2a1fc67ec5b24519e"]}]}, 0xb0}, 0x1, 0x0, 0x0, 0x4}, 0x40000) sendmsg$nl_route(r2, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000680)=ANY=[@ANYBLOB="4c00000010001ffffcfdfffffdffffff00000000", @ANYRES32=0x0, @ANYBLOB="0002010000000000240012800b00010065727370616e000014000280050016000000000008000700ac1414bb08000a00", @ANYRES32=r5], 0x4c}, 0x1, 0x0, 0x0, 0x8044}, 0x0) r6 = socket$kcm(0x10, 0x2, 0x4) connect$inet(r1, &(0x7f0000000240)={0x2, 0x8, @loopback}, 0x10) sendmsg$kcm(r6, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000040)=[{&(0x7f0000000100)="4c000000150097f87059ae08060c040002ff0f020000000000000187ac1414aaa69d35a2cca84708f7abca1bac141410bd7c493872f750375ed08a560400000003c48f93b82a03000000461e", 0x4c}], 0x1}, 0x800c) bind$inet(r0, &(0x7f0000000080)={0x2, 0x4e21, @broadcast}, 0x10) r7 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$PPPIOCNEWUNIT(r7, 0xc004743e, &(0x7f00000000c0)) ioctl$PPPIOCSMRRU(r7, 0x4004743c, 0x0) connect$inet(r0, &(0x7f0000000180)={0x2, 0x4e21, @local}, 0x10) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000940)={&(0x7f0000000100)=@newtclass={0x24, 0x28, 0x2, 0x70bd26, 0x25dfdbff, {0x0, 0x0, 0x0, 0x0, {0x9, 0x5}, {0x7, 0xb}, {0xb, 0xf}}}, 0x24}}, 0x0) r8 = socket$netlink(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000000)={0xffffffffffffffff}) r10 = bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="12000000770000000800000002"], 0x50) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000140)={{r10, 0xffffffffffffffff}, &(0x7f0000000180), &(0x7f0000000280)=r9}, 0x20) bpf$BPF_LINK_CREATE(0x1c, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff, 0x5, 0x0, @void}, 0x10) bpf$MAP_LOOKUP_ELEM(0x1, &(0x7f0000000440)={r11, &(0x7f00000001c0), 0x0}, 0x20) sendmsg$nl_route(r8, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000000)=ANY=[@ANYBLOB="840000001000010428bd70000000000000000000", @ANYRES32=0x0, @ANYBLOB="9180030000200000500012800b000100697036746e6c000040000280040013000800080001000000080014000300000008000100", @ANYRES32, @ANYBLOB="0600100003000000080014000000000008000700060000000800140000800000140003006e"], 0x84}, 0x1, 0x0, 0x0, 0x4}, 0x0) bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0x10, 0x4, &(0x7f0000000040)=ANY=[@ANYBLOB="b40000"], 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sk_msg}, 0x94) sendmmsg(r8, &(0x7f00000002c0), 0x40000000000009f, 0x0) setsockopt$inet_tcp_TCP_MD5SIG(r0, 0x6, 0xe, &(0x7f0000000340)={@in={{0x2, 0x4e24, @local}}, 0x0, 0x0, 0x30, 0x0, "cebd7ceedb7b0ad952e966bbe242b92b746b023df2cb59e32e10366456deac64e782206bd4aee372005a52a40b7161161a8b2749fe184fb0d08bc63f90010a1ed2bf603d2c3fcc250c30136f9ef2ef8b"}, 0xd8) sendto$inet(r0, &(0x7f0000000000), 0xffffffffffffff94, 0x0, 0x0, 0x11) 0s ago: executing program 2 (id=2419): r0 = openat$tcp_congestion(0xffffffffffffff9c, &(0x7f0000000000), 0x1, 0x0) ioctl(r0, 0x1ff, &(0x7f0000000040)="d03c0e72b8da89e6c5dd96131cd03961fca5f45bdf69a24f2f91d4857fab1bdeb7579a") r1 = socket$can_bcm(0x1d, 0x2, 0x2) getsockopt$IP_VS_SO_GET_DAEMON(r1, 0x0, 0x487, &(0x7f0000000080), &(0x7f00000000c0)=0x30) clock_gettime(0x0, &(0x7f0000006d00)={0x0, 0x0}) recvmmsg(r1, &(0x7f0000006a80)=[{{&(0x7f0000000100)=@pppol2tpin6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @loopback}}}, 0x80, &(0x7f00000035c0)=[{&(0x7f0000000180)=""/193, 0xc1}, {&(0x7f0000000280)=""/4096, 0x1000}, {&(0x7f0000001280)=""/4096, 0x1000}, {&(0x7f0000002280)=""/158, 0x9e}, {&(0x7f0000002340)=""/112, 0x70}, {&(0x7f00000023c0)=""/109, 0x6d}, {&(0x7f0000002440)=""/215, 0xd7}, {&(0x7f0000002540)=""/19, 0x13}, {&(0x7f0000002580)=""/12, 0xc}, {&(0x7f00000025c0)=""/4096, 0x1000}], 0xa, &(0x7f0000003680)=""/204, 0xcc}, 0x7}, {{&(0x7f0000003780)=@ieee802154, 0x80, &(0x7f0000003ac0)=[{&(0x7f0000003800)=""/113, 0x71}, {&(0x7f0000003880)=""/235, 0xeb}, {&(0x7f0000003980)=""/188, 0xbc}, {&(0x7f0000003a40)=""/118, 0x76}], 0x4, &(0x7f0000003b00)=""/118, 0x76}, 0x7}, {{&(0x7f0000003b80)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @broadcast}}}, 0x80, &(0x7f0000004000)=[{&(0x7f0000003c00)=""/21, 0x15}, {&(0x7f0000003c40)=""/223, 0xdf}, {&(0x7f0000003d40)=""/204, 0xcc}, {&(0x7f0000003e40)=""/232, 0xe8}, {&(0x7f0000003f40)=""/126, 0x7e}, {&(0x7f0000003fc0)=""/38, 0x26}], 0x6, &(0x7f0000004080)=""/232, 0xe8}, 0x6b2}, {{&(0x7f0000004180)=@in={0x2, 0x0, @multicast2}, 0x80, &(0x7f0000004440)=[{&(0x7f0000004200)=""/139, 0x8b}, {&(0x7f00000042c0)=""/100, 0x64}, {&(0x7f0000004340)=""/194, 0xc2}], 0x3, &(0x7f0000004480)=""/210, 0xd2}}, {{&(0x7f0000004580)=@nfc, 0x80, &(0x7f0000004900)=[{&(0x7f0000004600)=""/252, 0xfc}, {&(0x7f0000004700)=""/46, 0x2e}, {&(0x7f0000004740)}, {&(0x7f0000004780)}, {&(0x7f00000047c0)=""/13, 0xd}, {&(0x7f0000004800)=""/211, 0xd3}], 0x6}, 0x800}, {{&(0x7f0000004980)=@l2tp={0x2, 0x0, @dev}, 0x80, &(0x7f0000005b80)=[{&(0x7f0000004a00)=""/203, 0xcb}, {&(0x7f0000004b00)=""/4096, 0x1000}, {&(0x7f0000005b00)=""/73, 0x49}], 0x3, &(0x7f0000005bc0)=""/178, 0xb2}, 0x3}, {{&(0x7f0000005c80)=@l2={0x1f, 0x0, @none}, 0x80, &(0x7f0000006040)=[{&(0x7f0000005d00)=""/149, 0x95}, {&(0x7f0000005dc0)=""/161, 0xa1}, {&(0x7f0000005e80)=""/239, 0xef}, {&(0x7f0000005f80)=""/40, 0x28}, {&(0x7f0000005fc0)=""/71, 0x47}], 0x5}, 0x3}, {{0x0, 0x0, &(0x7f0000006180)=[{&(0x7f00000060c0)=""/8, 0x8}, {&(0x7f0000006100)=""/115, 0x73}], 0x2, &(0x7f00000061c0)=""/229, 0xe5}, 0x6}, {{&(0x7f00000062c0)=@llc={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @remote}, 0x80, &(0x7f0000006780)=[{&(0x7f0000006340)=""/233, 0xe9}, {&(0x7f0000006440)=""/7, 0x7}, {&(0x7f0000006480)=""/228, 0xe4}, {&(0x7f0000006580)=""/19, 0x13}, {&(0x7f00000065c0)=""/168, 0xa8}, {&(0x7f0000006680)=""/186, 0xba}, {&(0x7f0000006740)=""/14, 0xe}], 0x7}, 0xee}, {{&(0x7f0000006800)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @broadcast}}}, 0x80, &(0x7f0000006940)=[{&(0x7f0000006880)=""/172, 0xac}], 0x1, &(0x7f0000006980)=""/194, 0xc2}, 0x2}], 0xa, 0x10042, &(0x7f0000006d40)={r2, r3+10000000}) r6 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f0000006d80)={0x3, 0x4, 0x4, 0xa, 0x0, 0xffffffffffffffff, 0x2, '\x00', 0x0, 0xffffffffffffffff, 0x3, 0x4, 0x5}, 0x50) r7 = bpf$PROG_LOAD_XDP(0x5, &(0x7f0000007040)={0x6, 0x4, &(0x7f0000006e40)=@framed={{0x18, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0xfffffffc}, [@call={0x85, 0x0, 0x0, 0x4}]}, &(0x7f0000006e80)='GPL\x00', 0x8, 0xd9, &(0x7f0000006ec0)=""/217, 0x40f00, 0x10, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, &(0x7f0000006fc0)={0x5, 0x2}, 0x8, 0x10, &(0x7f0000007000)={0x2, 0x6, 0xfff, 0xdbb}, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x3}, 0x94) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000007140)={{r6}, &(0x7f0000006e00), &(0x7f0000007100)=r7}, 0x20) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f00000071c0)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_ADD_TX_TS(r4, &(0x7f00000072c0)={&(0x7f0000007180)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000007280)={&(0x7f0000007200)={0x48, 0x0, 0x300, 0x70bd25, 0x25dfdbff, {{}, {@val={0x8, 0x3, r8}, @val={0xc, 0x99, {0x3, 0x68}}}}, [@NL80211_ATTR_MAC={0xa, 0x6, @broadcast}, @NL80211_ATTR_MAC={0xa}, @NL80211_ATTR_TSID={0x5, 0xd2, 0x5}]}, 0x48}, 0x1, 0x0, 0x0, 0x4044000}, 0x0) setsockopt$RDS_GET_MR_FOR_DEST(r4, 0x114, 0x7, &(0x7f0000007400)={@l2tp6={0xa, 0x0, 0x1, @remote, 0xfffffffe}, {&(0x7f0000007300)=""/176, 0xb0}, &(0x7f00000073c0), 0x48}, 0xa0) setsockopt$ALG_SET_KEY(r5, 0x117, 0x1, &(0x7f00000074c0)="3e5c531454c397e27ae4cf3a2fe792d1b861b8a772aa3de5eb61bbf7f0d42beff292ae72a6c5ccec24350ce3c50c9b91d5f0e0912ec76124d537086f9aaef91bd3b169eaf7e076e2264796f5ac53cc7309e7585719dedd50383a49673bfa0bc6c184d8e5e3730bc7b9b3e6f8301dd76907bd2f61034f342db82e80d690b64293889149deae1855ebf7e08cae907363", 0x8f) r9 = syz_genetlink_get_family_id$devlink(&(0x7f00000075c0), r5) sendmsg$DEVLINK_CMD_PORT_SPLIT(0xffffffffffffffff, &(0x7f0000007700)={&(0x7f0000007580)={0x10, 0x0, 0x0, 0x1000000}, 0xc, &(0x7f00000076c0)={&(0x7f0000007600)={0x98, r9, 0x100, 0x70bd28, 0x25dfdbff, {}, [{{@pci={{0x8}, {0x11}}, {0x8, 0x3, 0x1}}, {0x8, 0x9, 0x5}}, {{@pci={{0x8}, {0x11}}, {0x8, 0x3, 0x2}}, {0x8, 0x9, 0x6}}, {{@pci={{0x8}, {0x11}}, {0x8}}, {0x8, 0x9, 0x7}}]}, 0x98}, 0x1, 0x0, 0x0, 0x40090}, 0x804) pipe(&(0x7f0000007740)={0xffffffffffffffff, 0xffffffffffffffff}) bpf$MAP_DELETE_ELEM(0x3, &(0x7f00000077c0)={r10, &(0x7f0000007780)="8d24"}, 0x20) clock_gettime(0x0, &(0x7f00000078c0)={0x0, 0x0}) pselect6(0x40, &(0x7f0000007800)={0xdc, 0x3, 0xff, 0x3, 0x1d, 0x0, 0xff, 0x1000}, &(0x7f0000007840)={0x2, 0xd53, 0x6, 0x2, 0x0, 0x8, 0x1c, 0xffffffffffffffff}, &(0x7f0000007880)={0x1, 0x1, 0xffffffff00000001, 0x400, 0xd10e, 0x0, 0x5ff655a4, 0xb}, &(0x7f0000007900)={r11, r12+10000000}, &(0x7f0000007980)={&(0x7f0000007940), 0x8}) r13 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCBRDELBR(r13, 0x89a1, &(0x7f00000079c0)='bridge_slave_0\x00') r14 = socket$inet6_sctp(0xa, 0x1, 0x84) getsockopt$inet_sctp6_SCTP_MAX_BURST(r14, 0x84, 0x14, &(0x7f0000007a00)=@assoc_value, &(0x7f0000007a40)=0x8) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r14, 0x8933, &(0x7f0000007a80)={'batadv_slave_0\x00', 0x0}) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r4, 0x8933, &(0x7f0000007b00)={'batadv_slave_1\x00', 0x0}) getsockopt$inet6_IPV6_IPSEC_POLICY(r14, 0x29, 0x22, &(0x7f0000007b40)={{{@in=@broadcast, @in6=@private2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@initdev}, 0x0, @in=@private}}, &(0x7f0000007c40)=0xe8) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000007c80)={0x0, 0x0}, &(0x7f0000007cc0)=0xc) sendmsg$nl_xfrm(r5, &(0x7f0000008040)={&(0x7f0000007ac0)={0x10, 0x0, 0x0, 0x1000000}, 0xc, &(0x7f0000008000)={&(0x7f0000007d00)=@getsa={0x2f0, 0x12, 0x20, 0x70bd2d, 0x25dfdbfb, {@in6=@private0, 0x4d6, 0xa, 0x6c}, [@user_kmaddress={0x2c, 0x13, {@in=@dev={0xac, 0x14, 0x14, 0xf}, @in=@loopback, 0x0, 0x2}}, @policy={0xac, 0x7, {{@in6=@initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, @in=@multicast1, 0x4e23, 0x0, 0x4e24, 0x6, 0x2, 0x20, 0x80, 0x0, r16, r17}, {0x9, 0xc, 0x1400000000, 0x4, 0x10001, 0xfffffffffffffff9, 0xffffffffffffffff, 0x9}, {0x10000, 0x7fffffff, 0xb7, 0x30c}, 0x1, 0x6e6bb8, 0x1}}, @XFRMA_IF_ID={0x8, 0x1f, 0x3}, @XFRMA_SET_MARK_MASK={0x8, 0x1e, 0x8}, @srcaddr={0x14, 0xd, @in6=@dev={0xfe, 0x80, '\x00', 0x19}}, @algo_crypt={0xac, 0x2, {{'cbc-aes-ce\x00'}, 0x320, "261b0ad559acd09983696e22bafa1944d48c4093fb988b34b7402a399c242b2642ac9f1b6b12078c17de216de94a6511ce4d76f7a1cd64eb12bd18c188dd71bb81d92d368c260ff4aac199e97e91effef73b73685c0165111edb9553344889b52afc27dd"}}, @iptfs_dont_frag={0x4}, @sa={0xe4, 0x6, {{@in6=@mcast2, @in6=@empty, 0x4e23, 0x1, 0x4e20, 0x1, 0x2, 0x80, 0x20, 0x4, r15, r18}, {@in6=@initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, 0x4d5, 0x3c}, @in=@dev={0xac, 0x14, 0x14, 0x1b}, {0xc, 0x9, 0x93, 0xd60d, 0x1, 0xe, 0xaf4, 0x7}, {0xffffffffffffffff, 0x7, 0x400, 0xffffffffffffffff}, {0x9, 0x6, 0x3}, 0x70bd28, 0x34ff, 0x2, 0x2, 0x6, 0xc4}}, @mark={0xc, 0x15, {0x35075d}}, @replay_esn_val={0x2c, 0x17, {0x4, 0x70bd27, 0x70bd2b, 0x70bd2d, 0x70bd28, 0x5, [0x10000, 0x9df, 0x8, 0x2]}}]}, 0x2f0}, 0x1, 0x0, 0x0, 0x1}, 0x20040060) r19 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$IPVS_CMD_DEL_SERVICE(r19, &(0x7f0000008240)={&(0x7f0000008080)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f0000008200)={&(0x7f0000008100)={0xf8, 0x0, 0x4, 0x70bd2b, 0x25dfdbfe, {}, [@IPVS_CMD_ATTR_SERVICE={0x2c, 0x1, 0x0, 0x1, [@IPVS_SVC_ATTR_PROTOCOL={0x6, 0x2, 0x87}, @IPVS_SVC_ATTR_SCHED_NAME={0x7, 0x6, 'rr\x00'}, @IPVS_SVC_ATTR_TIMEOUT={0x8, 0x8, 0x8}, @IPVS_SVC_ATTR_AF={0x6, 0x1, 0xe3a94cfb221adab1}, @IPVS_SVC_ATTR_NETMASK={0x8, 0x9, 0x75}]}, @IPVS_CMD_ATTR_SERVICE={0x18, 0x1, 0x0, 0x1, [@IPVS_SVC_ATTR_FLAGS={0xc, 0x7, {0x8, 0x32}}, @IPVS_SVC_ATTR_PROTOCOL={0x6, 0x2, 0x87}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5, 0x43e}, @IPVS_CMD_ATTR_DAEMON={0x40, 0x3, 0x0, 0x1, [@IPVS_DAEMON_ATTR_MCAST_GROUP6={0x14, 0x6, @dev={0xfe, 0x80, '\x00', 0x37}}, @IPVS_DAEMON_ATTR_SYNC_ID={0x8, 0x3, 0x1}, @IPVS_DAEMON_ATTR_SYNC_MAXLEN={0x6, 0x4, 0x7e}, @IPVS_DAEMON_ATTR_MCAST_GROUP={0x8, 0x5, @dev={0xac, 0x14, 0x14, 0x3d}}, @IPVS_DAEMON_ATTR_MCAST_TTL={0x5, 0x8, 0x7f}, @IPVS_DAEMON_ATTR_STATE={0x8}]}, @IPVS_CMD_ATTR_DAEMON={0x2c, 0x3, 0x0, 0x1, [@IPVS_DAEMON_ATTR_MCAST_IFN={0x14, 0x2, 'bridge_slave_1\x00'}, @IPVS_DAEMON_ATTR_MCAST_GROUP6={0x14, 0x6, @mcast1}]}, @IPVS_CMD_ATTR_DEST={0x2c, 0x2, 0x0, 0x1, [@IPVS_DEST_ATTR_TUN_FLAGS={0x6, 0xf, 0xb}, @IPVS_DEST_ATTR_TUN_FLAGS={0x6, 0xf, 0xdd48}, @IPVS_DEST_ATTR_L_THRESH={0x8, 0x6, 0x2}, @IPVS_DEST_ATTR_TUN_FLAGS={0x6, 0xf, 0x7f}, @IPVS_DEST_ATTR_U_THRESH={0x8, 0x5, 0x8}]}]}, 0xf8}, 0x1, 0x0, 0x0, 0x8000}, 0x4000) kernel console output (not intermixed with test programs): ing backup interface [ 261.483027][ T8978] gre1: left promiscuous mode [ 261.536941][ T8978] bond2 (unregistering): Released all slaves [ 261.582544][ T9006] tipc: Resetting bearer [ 261.805928][ T8979] bond1: option primary: mode dependency failed, not supported in mode balance-rr(0) [ 261.868407][ T8979] bond1 (unregistering): Released all slaves [ 262.172876][ T9034] xt_TPROXY: Can be used only with -p tcp or -p udp [ 262.179307][ T9034] __nla_validate_parse: 3 callbacks suppressed [ 262.179324][ T9034] netlink: 11 bytes leftover after parsing attributes in process `syz.2.668'. [ 263.443667][ T9095] FAULT_INJECTION: forcing a failure. [ 263.443667][ T9095] name fail_usercopy, interval 1, probability 0, space 0, times 1 [ 263.458828][ T9095] CPU: 1 UID: 0 PID: 9095 Comm: syz.2.682 Not tainted syzkaller #0 PREEMPT(full) [ 263.458852][ T9095] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 263.458870][ T9095] Call Trace: [ 263.458881][ T9095] [ 263.458888][ T9095] dump_stack_lvl+0xe8/0x150 [ 263.458925][ T9095] should_fail_ex+0x410/0x560 [ 263.458953][ T9095] _copy_from_iter+0x1d3/0x1660 [ 263.458978][ T9095] ? __alloc_skb+0x27a/0x7a0 [ 263.459003][ T9095] ? __alloc_skb+0x27a/0x7a0 [ 263.459028][ T9095] ? __alloc_skb+0x27a/0x7a0 [ 263.459051][ T9095] ? __pfx__copy_from_iter+0x10/0x10 [ 263.459073][ T9095] ? kmem_cache_alloc_node_noprof+0x1f9/0x610 [ 263.459098][ T9095] ? __alloc_skb+0x27a/0x7a0 [ 263.459119][ T9095] ? __alloc_skb+0x27a/0x7a0 [ 263.459146][ T9095] ? netlink_sendmsg+0x650/0xb40 [ 263.459164][ T9095] ? skb_put+0x112/0x210 [ 263.459189][ T9095] netlink_sendmsg+0x6c0/0xb40 [ 263.459216][ T9095] ? __pfx_netlink_sendmsg+0x10/0x10 [ 263.459245][ T9095] ? apparmor_socket_sendmsg+0x98/0x360 [ 263.459272][ T9095] ? __pfx_netlink_sendmsg+0x10/0x10 [ 263.459289][ T9095] sock_sendmsg_nosec+0x13a/0x180 [ 263.459313][ T9095] ____sys_sendmsg+0x54e/0x850 [ 263.459335][ T9095] ? __pfx_____sys_sendmsg+0x10/0x10 [ 263.459361][ T9095] ? import_iovec+0x73/0xa0 [ 263.459389][ T9095] ___sys_sendmsg+0x2a5/0x360 [ 263.459405][ T9095] ? __lock_acquire+0x6df/0x2e50 [ 263.459424][ T9095] ? __pfx____sys_sendmsg+0x10/0x10 [ 263.459475][ T9095] ? __fget_files+0x2a/0x420 [ 263.459498][ T9095] ? __fget_files+0x3a2/0x420 [ 263.459529][ T9095] __x64_sys_sendmsg+0x1b1/0x290 [ 263.459549][ T9095] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 263.459593][ T9095] do_syscall_64+0x166/0x520 [ 263.459616][ T9095] ? trace_irq_disable+0x3b/0x140 [ 263.459632][ T9095] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 263.459650][ T9095] ? clear_bhb_loop+0x70/0xc0 [ 263.459673][ T9095] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 263.459694][ T9095] RIP: 0033:0x7f7104d9e159 [ 263.459717][ T9095] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 263.459731][ T9095] RSP: 002b:00007f7105d52028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 263.459754][ T9095] RAX: ffffffffffffffda RBX: 00007f7105025fa0 RCX: 00007f7104d9e159 [ 263.459767][ T9095] RDX: 0000000000040004 RSI: 0000200000000280 RDI: 0000000000000004 [ 263.459778][ T9095] RBP: 00007f7105d52090 R08: 0000000000000000 R09: 0000000000000000 [ 263.459788][ T9095] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 263.459798][ T9095] R13: 00007f7105026038 R14: 00007f7105025fa0 R15: 00007ffdc7b19928 [ 263.459827][ T9095] [ 263.505485][ T9099] netlink: 'syz.3.684': attribute type 4 has an invalid length. [ 263.974464][ T9118] bridge0: left allmulticast mode [ 264.202108][ T9130] ip6tnl1: entered allmulticast mode [ 264.237494][ T9128] ipvlan0: Caught tx_queue_len zero misconfig [ 264.915163][ T9159] bridge2: entered promiscuous mode [ 265.004809][ T9164] bridge3: entered promiscuous mode [ 265.123870][ T9175] FAULT_INJECTION: forcing a failure. [ 265.123870][ T9175] name failslab, interval 1, probability 0, space 0, times 1 [ 265.123923][ T9175] CPU: 0 UID: 0 PID: 9175 Comm: syz.3.699 Not tainted syzkaller #0 PREEMPT(full) [ 265.123943][ T9175] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 265.123953][ T9175] Call Trace: [ 265.123960][ T9175] [ 265.123967][ T9175] dump_stack_lvl+0xe8/0x150 [ 265.123994][ T9175] should_fail_ex+0x410/0x560 [ 265.124021][ T9175] should_failslab+0xa8/0x100 [ 265.124039][ T9175] ? skb_clone+0x212/0x3a0 [ 265.124058][ T9175] kmem_cache_alloc_noprof+0xa1/0x600 [ 265.124086][ T9175] ? skb_clone+0x212/0x3a0 [ 265.124109][ T9175] skb_clone+0x212/0x3a0 [ 265.124129][ T9175] __netlink_deliver_tap+0x413/0x860 [ 265.124160][ T9175] ? netlink_deliver_tap+0x2e/0x1b0 [ 265.124181][ T9175] netlink_deliver_tap+0x19c/0x1b0 [ 265.124202][ T9175] netlink_unicast+0x781/0x940 [ 265.124229][ T9175] netlink_sendmsg+0x813/0xb40 [ 265.124258][ T9175] ? __pfx_netlink_sendmsg+0x10/0x10 [ 265.124286][ T9175] ? apparmor_socket_sendmsg+0x98/0x360 [ 265.124323][ T9175] ? __pfx_netlink_sendmsg+0x10/0x10 [ 265.124341][ T9175] sock_sendmsg_nosec+0x13a/0x180 [ 265.124366][ T9175] ____sys_sendmsg+0x54e/0x850 [ 265.124388][ T9175] ? __pfx_____sys_sendmsg+0x10/0x10 [ 265.124415][ T9175] ? import_iovec+0x73/0xa0 [ 265.124444][ T9175] ___sys_sendmsg+0x2a5/0x360 [ 265.124460][ T9175] ? __lock_acquire+0x6df/0x2e50 [ 265.124482][ T9175] ? __pfx____sys_sendmsg+0x10/0x10 [ 265.124534][ T9175] ? __fget_files+0x2a/0x420 [ 265.124555][ T9175] ? __fget_files+0x3a2/0x420 [ 265.124586][ T9175] __x64_sys_sendmsg+0x1b1/0x290 [ 265.124607][ T9175] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 265.124644][ T9175] do_syscall_64+0x166/0x520 [ 265.124666][ T9175] ? trace_irq_disable+0x3b/0x140 [ 265.124683][ T9175] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 265.124701][ T9175] ? clear_bhb_loop+0x70/0xc0 [ 265.124723][ T9175] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 265.124740][ T9175] RIP: 0033:0x7f23f0d9e159 [ 265.124756][ T9175] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 265.124771][ T9175] RSP: 002b:00007f23f1c09028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 265.124789][ T9175] RAX: ffffffffffffffda RBX: 00007f23f1025fa0 RCX: 00007f23f0d9e159 [ 265.124801][ T9175] RDX: 0000000000040004 RSI: 0000200000000280 RDI: 0000000000000004 [ 265.124813][ T9175] RBP: 00007f23f1c09090 R08: 0000000000000000 R09: 0000000000000000 [ 265.124823][ T9175] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 265.124834][ T9175] R13: 00007f23f1026038 R14: 00007f23f1025fa0 R15: 00007ffe093aa968 [ 265.124863][ T9175] [ 265.441327][ T9181] xt_hashlimit: size too large, truncated to 1048576 [ 266.069916][ T9207] netlink: 8 bytes leftover after parsing attributes in process `syz.2.710'. [ 266.069960][ T9207] netlink: 4 bytes leftover after parsing attributes in process `syz.2.710'. [ 266.070001][ T9207] netlink: 'syz.2.710': attribute type 11 has an invalid length. [ 266.363281][ T9215] x_tables: unsorted entry at hook 2 [ 266.434027][ T9218] pim6reg99999999: entered allmulticast mode [ 266.868374][ T9232] netlink: 72 bytes leftover after parsing attributes in process `syz.0.718'. [ 267.321379][ T9244] netlink: 20 bytes leftover after parsing attributes in process `syz.1.721'. [ 267.335146][ T9244] netlink: 12 bytes leftover after parsing attributes in process `syz.1.721'. [ 267.474757][ T9258] RDS: rds_bind could not find a transport for ::ffff:172.30.1.2, load rds_tcp or rds_rdma? [ 268.313894][ T9293] netlink: 76 bytes leftover after parsing attributes in process `syz.4.734'. [ 268.319152][ T9291] The dccp option matching is deprecated and scheduled to be removed in 2027. [ 268.319152][ T9291] Please contact the netfilter-devel mailing list or update your nftables rules. [ 268.345711][ T9293] netlink: 76 bytes leftover after parsing attributes in process `syz.4.734'. [ 268.691231][ T9294] netlink: 4 bytes leftover after parsing attributes in process `syz.3.735'. [ 269.200402][ T9330] netlink: 16 bytes leftover after parsing attributes in process `syz.4.744'. [ 269.229241][ T9330] tipc: Enabled bearer , priority 10 [ 269.864794][ T9372] netlink: 12 bytes leftover after parsing attributes in process `syz.4.753'. [ 269.874332][ T9372] netlink: 12 bytes leftover after parsing attributes in process `syz.4.753'. [ 269.887685][ T9370] IPVS: set_ctl: invalid protocol: 8 127.0.0.1:20004 [ 270.985634][ T9398] netlink: 'syz.1.760': attribute type 1 has an invalid length. [ 271.077496][ T9398] 8021q: adding VLAN 0 to HW filter on device bond2 [ 271.103725][ T9406] bond2: (slave veth0_to_bond): making interface the new active one [ 271.111946][ T9406] bond2: (slave veth0_to_bond): Enslaving as an active interface with an up link [ 271.156425][ T9398] bond2: entered promiscuous mode [ 271.157654][ T9398] veth0_to_bond: entered promiscuous mode [ 271.158586][ T9398] bond2: entered allmulticast mode [ 271.158601][ T9398] veth0_to_bond: entered allmulticast mode [ 271.238054][ T9398] macvlan3: entered promiscuous mode [ 271.238097][ T9398] macvlan3: entered allmulticast mode [ 271.241263][ T9398] 8021q: adding VLAN 0 to HW filter on device macvlan3 [ 271.261390][ T9398] bond2: (slave macvlan3): the slave hw address is in use by the bond; giving it the hw address of veth0_to_bond [ 271.437685][ T99] batadv1: left promiscuous mode [ 271.984895][ T9445] netlink: 28 bytes leftover after parsing attributes in process `syz.2.770'. [ 272.028285][ T9442] syzkaller0: entered promiscuous mode [ 272.028326][ T9442] syzkaller0: entered allmulticast mode [ 272.529254][ T9474] netlink: 4 bytes leftover after parsing attributes in process `syz.3.780'. [ 272.552177][ T9474] netlink: 4 bytes leftover after parsing attributes in process `syz.3.780'. [ 273.167590][ T9499] netlink: 'syz.2.787': attribute type 4 has an invalid length. [ 273.167624][ T9499] netlink: 17 bytes leftover after parsing attributes in process `syz.2.787'. [ 273.189890][ T9495] netlink: 16 bytes leftover after parsing attributes in process `syz.4.785'. [ 273.281145][ T9503] syzkaller0: entered promiscuous mode [ 273.281187][ T9503] syzkaller0: entered allmulticast mode [ 273.536684][ T9519] bond0: option active_slave: mode dependency failed, not supported in mode balance-rr(0) [ 274.554604][ T9549] syzkaller0: left promiscuous mode [ 274.560644][ T9549] syzkaller0: left allmulticast mode [ 274.687274][ T9550] 8021q: adding VLAN 0 to HW filter on device macsec1 [ 275.023457][ T9563] xt_CT: No such helper "snmp_trap" [ 275.484991][ T9566] ip_tables: iptables: counters copy to user failed while replacing table [ 275.588500][ T9573] syzkaller0: entered promiscuous mode [ 275.594080][ T9573] bond_slave_0: entered promiscuous mode [ 275.594243][ T9573] bond_slave_1: entered promiscuous mode [ 275.608795][ T9573] syzkaller0: entered allmulticast mode [ 275.615208][ T9573] bond_slave_0: entered allmulticast mode [ 275.622708][ T9573] bond_slave_1: entered allmulticast mode [ 275.629806][ T9573] tipc: Resetting bearer [ 276.105130][ T9598] netlink: 'syz.4.810': attribute type 1 has an invalid length. [ 276.172029][ T9605] netlink: 48 bytes leftover after parsing attributes in process `syz.4.810'. [ 276.215861][ T9598] netlink: 28 bytes leftover after parsing attributes in process `syz.4.810'. [ 276.226148][ T9598] netlink: 36 bytes leftover after parsing attributes in process `syz.4.810'. [ 276.237245][ T9602] netlink: 4 bytes leftover after parsing attributes in process `syz.1.812'. [ 276.285822][ T9602] netlink: 8 bytes leftover after parsing attributes in process `syz.1.812'. [ 276.285872][ T9602] netlink: 20 bytes leftover after parsing attributes in process `syz.1.812'. [ 276.314794][ T9602] geneve2: entered promiscuous mode [ 276.314839][ T9602] geneve2: entered allmulticast mode [ 276.901314][ T9629] ipvlan2: entered allmulticast mode [ 276.907072][ T9629] syz_tun: entered allmulticast mode [ 277.205236][ T9646] syzkaller0: entered promiscuous mode [ 277.205283][ T9646] syzkaller0: entered allmulticast mode [ 277.293072][ T9651] dummy0: mtu less than device minimum [ 277.438341][ T9656] netlink: 'syz.3.825': attribute type 1 has an invalid length. [ 277.477898][ T9656] bond3: entered promiscuous mode [ 277.478320][ T9656] 8021q: adding VLAN 0 to HW filter on device bond3 [ 277.482998][ T9656] netlink: 'syz.3.825': attribute type 1 has an invalid length. [ 277.524742][ T9656] bond4: entered promiscuous mode [ 277.525377][ T9656] 8021q: adding VLAN 0 to HW filter on device bond4 [ 277.571558][ T9667] syzkaller0: entered promiscuous mode [ 277.577373][ T9667] syzkaller0: entered allmulticast mode [ 279.433642][ T9745] syzkaller0: entered promiscuous mode [ 279.433685][ T9745] syzkaller0: entered allmulticast mode [ 279.569898][ T9750] __nla_validate_parse: 1 callbacks suppressed [ 279.569947][ T9750] netlink: 28 bytes leftover after parsing attributes in process `syz.2.843'. [ 279.831736][ T9778] netlink: 24 bytes leftover after parsing attributes in process `syz.1.850'. [ 279.847339][ T6466] ip6_tunnel: ip6gretap1 xmit: Local address not yet configured! [ 279.931522][ T9780] netlink: 16 bytes leftover after parsing attributes in process `syz.4.852'. [ 280.028755][ T9790] netlink: 48 bytes leftover after parsing attributes in process `syz.2.853'. [ 280.136054][ T9794] netlink: 12 bytes leftover after parsing attributes in process `syz.0.856'. [ 280.165061][ T9794] netlink: 12 bytes leftover after parsing attributes in process `syz.0.856'. [ 280.165224][ T9794] netlink: 12 bytes leftover after parsing attributes in process `syz.0.856'. [ 280.165337][ T9794] netlink: 12 bytes leftover after parsing attributes in process `syz.0.856'. [ 280.165459][ T9794] netlink: 12 bytes leftover after parsing attributes in process `syz.0.856'. [ 280.165902][ T9794] netlink: 12 bytes leftover after parsing attributes in process `syz.0.856'. [ 280.232095][ T9798] netlink: 'syz.4.857': attribute type 1 has an invalid length. [ 280.232138][ T9798] netlink: 'syz.4.857': attribute type 1 has an invalid length. [ 280.233259][ T9799] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 280.282620][ T9794] bond6: (slave bridge4): Enslaving as an active interface with an up link [ 280.300497][ T9795] macvlan4: entered promiscuous mode [ 280.300535][ T9795] macvlan4: entered allmulticast mode [ 280.300835][ T9795] bond6: (slave macvlan4): Error -98 calling set_mac_address [ 280.342519][ T9802] netlink: 'syz.4.857': attribute type 3 has an invalid length. [ 280.370911][ T12] ip6_tunnel: ip6gretap1 xmit: Local address not yet configured! [ 280.706570][ T6466] ip6_tunnel: ip6gretap1 xmit: Local address not yet configured! [ 281.061102][ T5724] ip6_tunnel: ip6gretap1 xmit: Local address not yet configured! [ 281.389755][ T52] ip6_tunnel: ip6gretap1 xmit: Local address not yet configured! [ 281.389973][ T52] ip6_tunnel: ip6gretap1 xmit: Local address not yet configured! [ 281.440113][ T9869] syzkaller0: entered promiscuous mode [ 281.440158][ T9869] syzkaller0: entered allmulticast mode [ 281.625773][ T6466] ip6_tunnel: ip6gretap1 xmit: Local address not yet configured! [ 282.138408][ T9906] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 282.162061][ T9906] A link change request failed with some changes committed already. Interface netdevsim0 may have been left with an inconsistent configuration, please check. [ 282.692463][ T9930] bond7 (unregistering): Released all slaves [ 282.692534][ T9940] IPv6: addrconf: prefix option has invalid lifetime [ 283.241496][ T9967] sch_tbf: burst 65537 is lower than device syzkaller0 mtu (65589) ! [ 283.292532][ T9972] syzkaller0: entered promiscuous mode [ 283.292579][ T9972] syzkaller0: entered allmulticast mode [ 283.469909][ T9980] pimreg: entered allmulticast mode [ 283.542057][ T6465] bridge0: entered promiscuous mode [ 283.659830][ T9991] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 284.013204][T10008] netlink: 'syz.0.910': attribute type 1 has an invalid length. [ 284.248810][T10022] netlink: 'syz.2.916': attribute type 13 has an invalid length. [ 284.422888][T10022] netlink: 'syz.2.916': attribute type 6 has an invalid length. [ 284.545175][T10022] team0: Port device team_slave_0 removed [ 284.732171][ T6466] ip6_tunnel: ip6gretap1 xmit: Local address not yet configured! [ 284.900111][ T6465] ip6_tunnel: ip6gretap1 xmit: Local address not yet configured! [ 285.065735][ C0] ip6_tunnel: ip6gretap1 xmit: Local address not yet configured! [ 285.086050][T10070] __nla_validate_parse: 42 callbacks suppressed [ 285.086096][T10070] netlink: 16402 bytes leftover after parsing attributes in process `syz.1.929'. [ 285.103936][T10072] netlink: 16402 bytes leftover after parsing attributes in process `syz.1.929'. [ 285.269579][T10080] syzkaller0: left promiscuous mode [ 285.269617][T10080] syzkaller0: left allmulticast mode [ 286.020543][ T9002] ip6_tunnel: ip6gretap1 xmit: Local address not yet configured! [ 286.250687][T10114] netlink: 36 bytes leftover after parsing attributes in process `syz.3.934'. [ 286.339710][T10122] netlink: 666 bytes leftover after parsing attributes in process `syz.1.938'. [ 289.263859][T10159] netlink: 24 bytes leftover after parsing attributes in process `syz.4.942'. [ 289.284727][ T12] ip6_tunnel: ip6gretap1 xmit: Local address not yet configured! [ 289.293312][ T12] ip6_tunnel: ip6gretap1 xmit: Local address not yet configured! [ 289.382146][T10166] Bluetooth: hci0: invalid length 0, exp 2 for type 13 [ 289.460721][T10172] netlink: 4 bytes leftover after parsing attributes in process `syz.4.942'. [ 289.925136][T10192] netlink: 44 bytes leftover after parsing attributes in process `syz.2.948'. [ 289.934870][T10193] erspan1: entered allmulticast mode [ 290.021083][ T6466] ip6_tunnel: ip6gretap1 xmit: Local address not yet configured! [ 290.087414][T10193] syz.4.949 (10193) used obsolete PPPIOCDETACH ioctl [ 290.134532][T10186] bond0: Device is already in use. [ 290.356180][T10218] netlink: 36 bytes leftover after parsing attributes in process `syz.1.952'. [ 290.473458][T10228] netlink: 'syz.2.954': attribute type 1 has an invalid length. [ 290.490337][T10234] trusted_key: syz.3.955 sent an empty control message without MSG_MORE. [ 290.525071][T10231] netlink: 328 bytes leftover after parsing attributes in process `syz.2.954'. [ 290.525227][T10231] netlink: 'syz.2.954': attribute type 9 has an invalid length. [ 290.525240][T10231] netlink: 108 bytes leftover after parsing attributes in process `syz.2.954'. [ 290.525249][T10231] netlink: 32 bytes leftover after parsing attributes in process `syz.2.954'. [ 290.587865][T10214] A link change request failed with some changes committed already. Interface wlan0 may have been left with an inconsistent configuration, please check. [ 290.606297][T10224] sch_tbf: burst 65537 is lower than device syzkaller0 mtu (65589) ! [ 290.626821][T10230] syzkaller0: entered promiscuous mode [ 290.626854][T10230] syzkaller0: entered allmulticast mode [ 290.652552][T10228] 8021q: adding VLAN 0 to HW filter on device bond2 [ 290.678270][T10229] bond2: (slave veth3): Enslaving as an active interface with a down link [ 290.875273][T10247] netlink: 24 bytes leftover after parsing attributes in process `syz.0.958'. [ 290.910364][T10252] netlink: 'syz.4.957': attribute type 1 has an invalid length. [ 291.061006][T10252] bond2: entered promiscuous mode [ 291.068586][T10252] 8021q: adding VLAN 0 to HW filter on device bond2 [ 291.177154][T10258] 8021q: adding VLAN 0 to HW filter on device bond2 [ 291.177824][T10258] bond2: (slave xfrm1): The slave device specified does not support setting the MAC address [ 291.177842][T10258] bond2: (slave xfrm1): Setting fail_over_mac to active for active-backup mode [ 291.210457][T10258] bond2: (slave xfrm1): making interface the new active one [ 291.219487][T10258] xfrm1: entered promiscuous mode [ 291.228209][T10258] bond2: (slave xfrm1): Enslaving as an active interface with an up link [ 291.483644][T10277] netlink: 44 bytes leftover after parsing attributes in process `syz.0.961'. [ 291.648589][T10292] netlink: 4 bytes leftover after parsing attributes in process `syz.1.965'. [ 292.123068][T10318] syzkaller0: entered promiscuous mode [ 292.123110][T10318] syzkaller0: entered allmulticast mode [ 292.612010][T10348] netlink: 8 bytes leftover after parsing attributes in process `syz.4.981'. [ 292.735719][ C0] ip6_tunnel: ip6gretap1 xmit: Local address not yet configured! [ 292.752965][T10359] netlink: 'syz.2.984': attribute type 1 has an invalid length. [ 292.753010][T10359] netlink: 'syz.2.984': attribute type 2 has an invalid length. [ 293.455830][ C0] ip6_tunnel: ip6gretap1 xmit: Local address not yet configured! [ 293.913068][T10391] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 293.972242][T10393] erspan0: entered promiscuous mode [ 294.013754][T10390] erspan0: left promiscuous mode [ 294.490650][T10412] tipc: Enabling of bearer rejected, already enabled [ 294.624122][T10418] sctp: [Deprecated]: syz.2.998 (pid 10418) Use of struct sctp_assoc_value in delayed_ack socket option. [ 294.624122][T10418] Use struct sctp_sack_info instead [ 294.792805][T10425] netlink: 12 bytes leftover after parsing attributes in process `syz.3.999'. [ 295.290185][T10448] netlink: 'syz.2.1007': attribute type 1 has an invalid length. [ 295.351245][T10448] 8021q: adding VLAN 0 to HW filter on device bond3 [ 295.446411][T10448] netlink: 28 bytes leftover after parsing attributes in process `syz.2.1007'. [ 295.458198][T10448] bond3: entered allmulticast mode [ 295.468094][T10452] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 295.546655][T10454] A link change request failed with some changes committed already. Interface netdevsim0 may have been left with an inconsistent configuration, please check. [ 296.154580][T10481] netdevsim netdevsim4 netdevsim0: entered allmulticast mode [ 296.154783][T10481] A link change request failed with some changes committed already. Interface netdevsim0 may have been left with an inconsistent configuration, please check. [ 296.306998][T10478] netlink: 24 bytes leftover after parsing attributes in process `syz.3.1011'. [ 296.330113][T10478] veth0_to_hsr: entered promiscuous mode [ 296.338560][T10478] veth0_to_hsr: left promiscuous mode [ 297.192187][T10515] geneve1: entered promiscuous mode [ 297.213188][T10515] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 297.471759][T10525] netlink: 4 bytes leftover after parsing attributes in process `syz.0.1023'. [ 297.601606][T10354] Set syz1 is full, maxelem 65536 reached [ 297.780344][T10536] syzkaller1: entered promiscuous mode [ 297.786055][T10536] syzkaller1: entered allmulticast mode [ 297.954528][T10541] netlink: 10556 bytes leftover after parsing attributes in process `syz.1.1028'. [ 298.008424][T10541] netlink: 56 bytes leftover after parsing attributes in process `syz.1.1028'. [ 298.401643][T10574] x9: renamed from bridge_slave_0 (while UP) [ 298.615154][T10591] netlink: 8 bytes leftover after parsing attributes in process `syz.0.1041'. [ 298.633009][T10593] netlink: 4 bytes leftover after parsing attributes in process `syz.3.1042'. [ 298.783688][T10600] tipc: Started in network mode [ 298.783735][T10600] tipc: Node identity 7f000001, cluster identity 4711 [ 298.800096][T10600] tipc: New replicast peer: 127.0.0.1 [ 298.809265][T10600] tipc: Enabled bearer , priority 10 [ 298.830207][T10591] syzkaller0: left promiscuous mode [ 298.830250][T10591] syzkaller0: left allmulticast mode [ 298.972592][T10614] netlink: 8 bytes leftover after parsing attributes in process `syz.2.1047'. [ 299.418294][T10631] netlink: 8 bytes leftover after parsing attributes in process `syz.3.1050'. [ 299.862624][T10653] netlink: 'syz.0.1055': attribute type 1 has an invalid length. [ 299.921467][T10653] 8021q: adding VLAN 0 to HW filter on device bond7 [ 299.935002][T10657] netlink: 4 bytes leftover after parsing attributes in process `syz.4.1054'. [ 300.012160][ T9415] tipc: Node number set to 2130706433 [ 300.077936][T10653] bond7: (slave geneve2): making interface the new active one [ 300.092691][T10653] bond7: (slave geneve2): Enslaving as an active interface with an up link [ 300.218855][T10431] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 300.248616][T10431] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 300.251436][T10429] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 300.251472][T10429] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 300.373034][T10677] netlink: 'syz.4.1059': attribute type 4 has an invalid length. [ 300.373079][T10677] netlink: 'syz.4.1059': attribute type 8 has an invalid length. [ 300.570672][T10690] bridge_slave_0: left allmulticast mode [ 300.580551][T10690] bridge_slave_0: left promiscuous mode [ 300.586541][T10690] bridge0: port 1(bridge_slave_0) entered disabled state [ 300.606950][T10690] bridge_slave_1: left allmulticast mode [ 300.612802][T10690] bridge_slave_1: left promiscuous mode [ 300.620999][T10690] bridge0: port 2(bridge_slave_1) entered disabled state [ 300.648399][T10690] bond0: (slave bond_slave_0): Releasing backup interface [ 300.659173][T10690] bond0: (slave bond_slave_1): Releasing backup interface [ 300.675085][T10690] team0: Port device team_slave_0 removed [ 300.686457][T10690] team0: Port device team_slave_1 removed [ 300.690797][T10690] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 300.692943][T10690] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 300.700799][T10690] A link change request failed with some changes committed already. Interface hsr_slave_0 may have been left with an inconsistent configuration, please check. [ 301.091469][T10711] netlink: zone id is out of range [ 301.091786][T10711] netlink: zone id is out of range [ 301.092151][T10711] netlink: zone id is out of range [ 301.092542][T10711] netlink: zone id is out of range [ 301.104397][T10711] syzkaller0: left promiscuous mode [ 301.104416][T10711] bond_slave_0: left promiscuous mode [ 301.104604][T10711] bond_slave_1: left promiscuous mode [ 301.104743][T10711] syzkaller0: left allmulticast mode [ 301.104755][T10711] bond_slave_0: left allmulticast mode [ 301.104767][T10711] bond_slave_1: left allmulticast mode [ 301.105153][T10711] tipc: Resetting bearer [ 301.112526][T10711] IPVS: wlc: FWM 3 0x00000003 - no destination available [ 301.302615][T10723] netlink: 'syz.2.1070': attribute type 30 has an invalid length. [ 301.375437][T10727] __nla_validate_parse: 2 callbacks suppressed [ 301.375494][T10727] netlink: 28 bytes leftover after parsing attributes in process `syz.4.1072'. [ 301.480493][T10716] netlink: 8 bytes leftover after parsing attributes in process `syz.0.1067'. [ 301.480544][T10716] netlink: 8 bytes leftover after parsing attributes in process `syz.0.1067'. [ 301.518625][T10428] netdevsim netdevsim0 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 301.518922][T10428] netdevsim netdevsim0 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 301.518972][T10428] netdevsim netdevsim0 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 301.519009][T10428] netdevsim netdevsim0 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 301.548259][T10734] netlink: 4 bytes leftover after parsing attributes in process `syz.3.1071'. [ 301.646752][T10742] netlink: 'syz.1.1075': attribute type 1 has an invalid length. [ 301.678057][T10742] lo: entered promiscuous mode [ 301.694052][T10742] tunl0: entered promiscuous mode [ 301.705954][ C0] ip6_tunnel: ip6gretap1 xmit: Local address not yet configured! [ 301.721344][T10742] gre0: entered promiscuous mode [ 301.757526][T10742] gretap0: entered promiscuous mode [ 301.797567][T10744] sctp: [Deprecated]: syz.4.1076 (pid 10744) Use of struct sctp_assoc_value in delayed_ack socket option. [ 301.797567][T10744] Use struct sctp_sack_info instead [ 301.846205][T10742] erspan0: entered promiscuous mode [ 301.850388][T10742] ip_vti0: entered promiscuous mode [ 301.861846][T10747] netlink: 'syz.4.1076': attribute type 11 has an invalid length. [ 301.874892][T10742] ip6_vti0: entered promiscuous mode [ 301.908673][T10742] sit0: entered promiscuous mode [ 301.986354][T10742] ip6tnl0: entered promiscuous mode [ 302.001850][T10753] netlink: 12 bytes leftover after parsing attributes in process `syz.0.1078'. [ 302.029933][T10742] ip6gre0: entered promiscuous mode [ 302.081145][T10742] ip6gretap0: entered promiscuous mode [ 302.096653][T10742] bridge0: port 2(bridge_slave_1) entered disabled state [ 302.097292][T10742] bridge0: port 1(bridge_slave_0) entered disabled state [ 302.270045][T10750] 8021q: adding VLAN 0 to HW filter on device team0 [ 302.281033][T10750] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 302.282040][T10768] netlink: 4 bytes leftover after parsing attributes in process `syz.0.1078'. [ 302.316386][T10750] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 302.322401][T10750] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 302.322422][T10750] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 302.325240][T10750] A link change request failed with some changes committed already. Interface virt_wifi0 may have been left with an inconsistent configuration, please check. [ 302.430829][T10748] syzkaller0: entered promiscuous mode [ 302.430881][T10748] syzkaller0: entered allmulticast mode [ 302.511786][T10766] bond8 (unregistering): Released all slaves [ 302.529695][T10774] netlink: 176 bytes leftover after parsing attributes in process `syz.4.1080'. [ 302.558846][T10429] bridge0: port 1(bridge_slave_0) entered blocking state [ 302.558956][T10429] bridge0: port 1(bridge_slave_0) entered forwarding state [ 302.633480][T10779] netlink: 72 bytes leftover after parsing attributes in process `syz.4.1080'. [ 304.524654][T10793] netlink: 'syz.1.1085': attribute type 1 has an invalid length. [ 304.524689][T10793] netlink: 4 bytes leftover after parsing attributes in process `syz.1.1085'. [ 304.642107][T10802] netlink: 8 bytes leftover after parsing attributes in process `syz.3.1087'. [ 304.999091][T10810] hsr_slave_1 (unregistering): left promiscuous mode [ 305.050754][T10825] lo: entered allmulticast mode [ 305.142126][T10833] C: renamed from veth1_to_team (while UP) [ 305.202875][T10831] ip6t_REJECT: ECHOREPLY is not supported [ 306.060184][T10808] lo: left allmulticast mode [ 306.259109][T10868] ip6gre2: entered allmulticast mode [ 306.427198][T10879] __nla_validate_parse: 8 callbacks suppressed [ 306.433894][T10879] netlink: 12 bytes leftover after parsing attributes in process `syz.2.1105'. [ 306.443076][T10879] tc_dump_action: action bad kind [ 306.449752][T10875] pim6reg0: tun_chr_ioctl cmd 1074025675 [ 306.449784][T10875] pim6reg0: persist disabled [ 306.466790][T10875] netlink: 8 bytes leftover after parsing attributes in process `syz.4.1104'. [ 306.561107][T10875] bond3: option ad_actor_sys_prio: invalid value (0) [ 306.561136][T10875] bond3: option ad_actor_sys_prio: allowed values 1 - 65535 [ 306.574229][T10875] bond3 (unregistering): Released all slaves [ 306.791068][T10893] mac80211_hwsim hwsim2 wlan0: entered promiscuous mode [ 306.799961][T10893] mac80211_hwsim hwsim2 wlan0: entered allmulticast mode [ 306.838149][T10896] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 307.329440][T10913] A link change request failed with some changes committed already. Interface veth0_vlan may have been left with an inconsistent configuration, please check. [ 307.346118][T10913] netlink: 8 bytes leftover after parsing attributes in process `syz.0.1115'. [ 307.540106][T10922] FAULT_INJECTION: forcing a failure. [ 307.540106][T10922] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 307.540169][T10922] CPU: 0 UID: 0 PID: 10922 Comm: syz.3.1118 Not tainted syzkaller #0 PREEMPT(full) [ 307.540185][T10922] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 307.540193][T10922] Call Trace: [ 307.540199][T10922] [ 307.540206][T10922] dump_stack_lvl+0xe8/0x150 [ 307.540230][T10922] should_fail_ex+0x410/0x560 [ 307.540255][T10922] _copy_to_user+0x31/0xb0 [ 307.540273][T10922] bpf_test_finish+0x1cf/0x690 [ 307.540295][T10922] ? __pfx_bpf_test_finish+0x10/0x10 [ 307.540316][T10922] ? _copy_from_user+0x94/0xb0 [ 307.540331][T10922] ? bpf_test_init+0x113/0x150 [ 307.540356][T10922] bpf_prog_test_run_xdp+0x8bc/0x11d0 [ 307.540389][T10922] ? __pfx_bpf_prog_test_run_xdp+0x10/0x10 [ 307.540413][T10922] ? __fget_files+0x2a/0x420 [ 307.540436][T10922] ? __pfx_bpf_prog_test_run_xdp+0x10/0x10 [ 307.540454][T10922] bpf_prog_test_run+0x2c5/0x340 [ 307.540477][T10922] __sys_bpf+0xa22/0xd90 [ 307.540501][T10922] ? __pfx___sys_bpf+0x10/0x10 [ 307.540525][T10922] ? __fget_files+0x2a/0x420 [ 307.540559][T10922] ? ksys_write+0x242/0x270 [ 307.540586][T10922] ? __pfx_ksys_write+0x10/0x10 [ 307.540615][T10922] __x64_sys_bpf+0xba/0xd0 [ 307.540636][T10922] do_syscall_64+0x166/0x520 [ 307.540657][T10922] ? trace_irq_disable+0x3b/0x140 [ 307.540672][T10922] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 307.540688][T10922] ? clear_bhb_loop+0x70/0xc0 [ 307.540706][T10922] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 307.540723][T10922] RIP: 0033:0x7f23f0d9e159 [ 307.540740][T10922] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 307.540754][T10922] RSP: 002b:00007f23f1c09028 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 307.540773][T10922] RAX: ffffffffffffffda RBX: 00007f23f1025fa0 RCX: 00007f23f0d9e159 [ 307.540786][T10922] RDX: 000000000000001c RSI: 0000200000000000 RDI: 000000000000000a [ 307.540797][T10922] RBP: 00007f23f1c09090 R08: 0000000000000000 R09: 0000000000000000 [ 307.540807][T10922] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 307.540818][T10922] R13: 00007f23f1026038 R14: 00007f23f1025fa0 R15: 00007ffe093aa968 [ 307.540847][T10922] [ 308.004349][T10941] netlink: 'syz.4.1123': attribute type 3 has an invalid length. [ 308.012346][T10941] netlink: 28 bytes leftover after parsing attributes in process `syz.4.1123'. [ 308.141440][T10946] netlink: 12 bytes leftover after parsing attributes in process `syz.4.1124'. [ 308.269873][T10946] 8021q: adding VLAN 0 to HW filter on device bond3 [ 308.314158][T10943] macvlan2: entered promiscuous mode [ 308.314189][T10943] macvlan2: entered allmulticast mode [ 308.322264][T10943] bond3: entered promiscuous mode [ 308.323243][T10943] 8021q: adding VLAN 0 to HW filter on device macvlan2 [ 308.334656][T10943] bond3: left promiscuous mode [ 308.548576][T10974] netlink: 32 bytes leftover after parsing attributes in process `syz.3.1131'. [ 308.573856][T10965] A link change request failed with some changes committed already. Interface virt_wifi0 may have been left with an inconsistent configuration, please check. [ 308.862973][T10982] PF_CAN: dropped non conform CAN skbuff: dev type 65534, len 64993 [ 309.571344][T11007] syzkaller1: entered promiscuous mode [ 309.578721][T11007] syzkaller1: entered allmulticast mode [ 310.025330][T11032] x_tables: duplicate underflow at hook 3 [ 310.612237][T11061] syzkaller0: entered promiscuous mode [ 310.618579][T11061] syzkaller0: entered allmulticast mode [ 311.234229][T11088] netlink: 'syz.4.1155': attribute type 2 has an invalid length. [ 311.234268][T11088] netlink: 'syz.4.1155': attribute type 2 has an invalid length. [ 311.571709][T11100] vcan0: tx drop: invalid sa for name 0x0000004000000000 [ 311.579147][T11103] syzkaller0: entered promiscuous mode [ 311.579166][T11103] bond_slave_0: entered promiscuous mode [ 311.579299][T11103] bond_slave_1: entered promiscuous mode [ 311.579741][T11103] syzkaller0: entered allmulticast mode [ 311.579756][T11103] bond_slave_0: entered allmulticast mode [ 311.579770][T11103] bond_slave_1: entered allmulticast mode [ 311.581013][T11103] tipc: Resetting bearer [ 311.591905][T11100] netlink: 4 bytes leftover after parsing attributes in process `syz.1.1159'. [ 311.599778][T11105] macvtap0: entered promiscuous mode [ 311.600029][T11105] macvtap0: entered allmulticast mode [ 311.600041][T11105] batadv0: entered allmulticast mode [ 311.601769][T11105] 8021q: adding VLAN 0 to HW filter on device macvtap0 [ 311.629240][T11105] batadv0: left allmulticast mode [ 311.695416][T11116] netlink: 'syz.3.1164': attribute type 30 has an invalid length. [ 311.704086][T11116] netlink: 56 bytes leftover after parsing attributes in process `syz.3.1164'. [ 311.894619][T11111] macvtap0: entered promiscuous mode [ 311.894805][T11111] macvtap0: entered allmulticast mode [ 311.894819][T11111] batadv0: entered allmulticast mode [ 311.898755][T11111] 8021q: adding VLAN 0 to HW filter on device macvtap0 [ 311.915037][T11111] batadv0: left allmulticast mode [ 312.018448][T11122] mac80211_hwsim hwsim10 : renamed from wlan0 [ 312.110253][T11130] netlink: 12 bytes leftover after parsing attributes in process `syz.3.1166'. [ 312.140115][T11132] netlink: 'syz.2.1169': attribute type 1 has an invalid length. [ 312.148795][T11132] netlink: 244 bytes leftover after parsing attributes in process `syz.2.1169'. [ 312.325752][T11137] netlink: 'syz.0.1168': attribute type 11 has an invalid length. [ 312.382598][T11137] openvswitch: netlink: Key type 29 is not supported [ 312.852890][T11177] netlink: 24 bytes leftover after parsing attributes in process `syz.1.1178'. [ 313.045057][T11187] netlink: 20 bytes leftover after parsing attributes in process `syz.1.1178'. [ 313.267902][T11184] netlink: 4 bytes leftover after parsing attributes in process `syz.1.1178'. [ 313.382898][T11199] netlink: 32 bytes leftover after parsing attributes in process `syz.0.1180'. [ 313.401674][T11198] lo speed is unknown, defaulting to 1000 [ 313.401793][T11198] lo speed is unknown, defaulting to 1000 [ 313.432119][T11198] lo speed is unknown, defaulting to 1000 [ 313.477850][T11198] smbdirect: ib_dev[syz_device_name_32_chars_1234567]: added: RNIC max_fast_reg_page_list_len=256 device_cap_flags=0x200000 kernel_cap_flags=0x10 page_size_cap=0x1000 [ 313.509195][T11198] smbdirect: ib_dev[syz_device_name_32_chars_1234567]: num_ports=1 max_qp_rd_atom=128 max_qp_init_rd_atom=128 max_sgl_rd=0 max_sge_rd=1 max_cqe=3276800 max_qp_wr=32768 max_send_sge=6 max_recv_sge=6 [ 313.509275][T11198] smbdirect: ib_dev[syz_device_name_32_chars_1234567]PORT[1]: iwarp=1 ib=0 roce=0 v1=0 v2=0 core_cap_flags=0x400008 [ 313.577191][T11207] netlink: 32 bytes leftover after parsing attributes in process `syz.3.1183'. [ 313.592524][T11198] infiniband syz_device_name_32_chars_1234567: RDMA CMA: cma_listen_on_dev, error -22 [ 313.610069][T11207] netlink: 32 bytes leftover after parsing attributes in process `syz.3.1183'. [ 313.828101][T11198] lo speed is unknown, defaulting to 1000 [ 313.841291][T11198] lo speed is unknown, defaulting to 1000 [ 313.866133][T11198] lo speed is unknown, defaulting to 1000 [ 313.872320][T11198] lo speed is unknown, defaulting to 1000 [ 313.878138][T11198] lo speed is unknown, defaulting to 1000 [ 314.053404][T11224] netlink: 'syz.3.1186': attribute type 21 has an invalid length. [ 315.637706][T11312] netlink: 'syz.0.1196': attribute type 1 has an invalid length. [ 316.013763][T11327] syzkaller0: entered promiscuous mode [ 316.020182][T11327] syzkaller0: entered allmulticast mode [ 316.036905][T11328] tipc: Started in network mode [ 316.036960][T11328] tipc: Node identity 1a5c686ad748, cluster identity 4711 [ 316.040693][T11328] tipc: Enabled bearer , priority 0 [ 316.169835][T11329] tipc: Resetting bearer [ 316.202798][T11324] tipc: Resetting bearer [ 316.223168][T11324] tipc: Disabling bearer [ 317.069642][ T1314] ieee802154 phy1 wpan1: encryption failed: -22 [ 317.207357][T11394] __nla_validate_parse: 8 callbacks suppressed [ 317.207404][T11394] netlink: 48 bytes leftover after parsing attributes in process `syz.3.1215'. [ 317.235054][T11385] netdevsim netdevsim1 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 317.263165][T11393] netlink: 48 bytes leftover after parsing attributes in process `syz.3.1215'. [ 317.324274][T11393] netlink: 48 bytes leftover after parsing attributes in process `syz.3.1215'. [ 317.402762][T11385] netdevsim netdevsim1 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 317.464316][T11399] tipc: Enabling of bearer rejected, already enabled [ 317.573519][T11385] netdevsim netdevsim1 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 317.643615][T11416] netlink: 8 bytes leftover after parsing attributes in process `syz.2.1220'. [ 317.676654][T11416] netlink: 1200 bytes leftover after parsing attributes in process `syz.2.1220'. [ 317.676775][T11416] netlink: 1200 bytes leftover after parsing attributes in process `syz.2.1220'. [ 317.698691][ C0] ip6_tunnel: ip6gretap1 xmit: Local address not yet configured! [ 317.708018][T11416] netlink: 52 bytes leftover after parsing attributes in process `syz.2.1220'. [ 317.781954][T11425] netlink: 24 bytes leftover after parsing attributes in process `syz.0.1222'. [ 317.821295][T11385] netdevsim netdevsim1 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 318.266824][T10430] netdevsim netdevsim1 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 318.312513][T11455] netlink: 16 bytes leftover after parsing attributes in process `syz.0.1227'. [ 318.407914][T10430] netdevsim netdevsim1 eth3: set [1, 0] type 2 family 0 port 6081 - 0 [ 318.418160][T10431] netdevsim netdevsim1 eth2: set [1, 0] type 2 family 0 port 6081 - 0 [ 318.418220][T10431] netdevsim netdevsim1 eth1: set [1, 0] type 2 family 0 port 6081 - 0 [ 318.535180][T11460] netlink: 12 bytes leftover after parsing attributes in process `syz.3.1229'. [ 318.630249][T11473] FAULT_INJECTION: forcing a failure. [ 318.630249][T11473] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 318.645380][T11473] CPU: 0 UID: 0 PID: 11473 Comm: syz.0.1232 Not tainted syzkaller #0 PREEMPT(full) [ 318.645403][T11473] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 318.645413][T11473] Call Trace: [ 318.645420][T11473] [ 318.645427][T11473] dump_stack_lvl+0xe8/0x150 [ 318.645458][T11473] should_fail_ex+0x410/0x560 [ 318.645488][T11473] _copy_from_user+0x2d/0xb0 [ 318.645509][T11473] do_ipt_set_ctl+0x743/0xe20 [ 318.645540][T11473] ? rcu_is_watching+0x16/0xb0 [ 318.645562][T11473] ? __pfx_do_ipt_set_ctl+0x10/0x10 [ 318.645603][T11473] ? __mutex_unlock_slowpath+0x731/0x900 [ 318.645634][T11473] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 318.645672][T11473] nf_setsockopt+0x26f/0x290 [ 318.645699][T11473] ? __pfx_sock_common_setsockopt+0x10/0x10 [ 318.645725][T11473] do_sock_setsockopt+0x17c/0x1b0 [ 318.645756][T11473] __x64_sys_setsockopt+0x13d/0x1b0 [ 318.645788][T11473] do_syscall_64+0x166/0x520 [ 318.645818][T11473] ? trace_irq_disable+0x3b/0x140 [ 318.645835][T11473] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 318.645854][T11473] ? clear_bhb_loop+0x70/0xc0 [ 318.645876][T11473] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 318.645895][T11473] RIP: 0033:0x7f816419e159 [ 318.645912][T11473] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 318.645926][T11473] RSP: 002b:00007f8165125028 EFLAGS: 00000246 ORIG_RAX: 0000000000000036 [ 318.645947][T11473] RAX: ffffffffffffffda RBX: 00007f8164425fa0 RCX: 00007f816419e159 [ 318.645960][T11473] RDX: 0000000000000040 RSI: 0000000000000000 RDI: 0000000000000003 [ 318.645971][T11473] RBP: 00007f8165125090 R08: 00000000000003e0 R09: 0000000000000000 [ 318.645982][T11473] R10: 00002000000003c0 R11: 0000000000000246 R12: 0000000000000001 [ 318.645994][T11473] R13: 00007f8164426038 R14: 00007f8164425fa0 R15: 00007ffd18491bf8 [ 318.646025][T11473] [ 318.851399][T11479] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 318.854852][T11469] xt_CT: No such helper "snmp_trap" [ 319.368646][T11510] RDS: rds_bind could not find a transport for ::80:0:8000:0:20:0, load rds_tcp or rds_rdma? [ 319.815248][T11531] FAULT_INJECTION: forcing a failure. [ 319.815248][T11531] name failslab, interval 1, probability 0, space 0, times 0 [ 319.815293][T11531] CPU: 1 UID: 0 PID: 11531 Comm: syz.2.1245 Not tainted syzkaller #0 PREEMPT(full) [ 319.815312][T11531] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 319.815322][T11531] Call Trace: [ 319.815330][T11531] [ 319.815337][T11531] dump_stack_lvl+0xe8/0x150 [ 319.815367][T11531] should_fail_ex+0x410/0x560 [ 319.815397][T11531] should_failslab+0xa8/0x100 [ 319.815422][T11531] __kvmalloc_node_noprof+0x176/0x820 [ 319.815444][T11531] ? xt_alloc_table_info+0x40/0xb0 [ 319.815470][T11531] ? xt_alloc_table_info+0x40/0xb0 [ 319.815501][T11531] xt_alloc_table_info+0x40/0xb0 [ 319.815525][T11531] do_ipt_set_ctl+0x962/0xe20 [ 319.815556][T11531] ? rcu_is_watching+0x16/0xb0 [ 319.815577][T11531] ? __pfx_do_ipt_set_ctl+0x10/0x10 [ 319.815618][T11531] ? __mutex_unlock_slowpath+0x731/0x900 [ 319.815647][T11531] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 319.815685][T11531] nf_setsockopt+0x26f/0x290 [ 319.815712][T11531] ? __pfx_sock_common_setsockopt+0x10/0x10 [ 319.815737][T11531] do_sock_setsockopt+0x17c/0x1b0 [ 319.815769][T11531] __x64_sys_setsockopt+0x13d/0x1b0 [ 319.815800][T11531] do_syscall_64+0x166/0x520 [ 319.815823][T11531] ? trace_irq_disable+0x3b/0x140 [ 319.815841][T11531] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 319.815860][T11531] ? clear_bhb_loop+0x70/0xc0 [ 319.815882][T11531] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 319.815900][T11531] RIP: 0033:0x7f7104d9e159 [ 319.815917][T11531] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 319.815931][T11531] RSP: 002b:00007f7105d52028 EFLAGS: 00000246 ORIG_RAX: 0000000000000036 [ 319.815950][T11531] RAX: ffffffffffffffda RBX: 00007f7105025fa0 RCX: 00007f7104d9e159 [ 319.815963][T11531] RDX: 0000000000000040 RSI: 0000000000000000 RDI: 0000000000000003 [ 319.815973][T11531] RBP: 00007f7105d52090 R08: 00000000000003e0 R09: 0000000000000000 [ 319.815984][T11531] R10: 00002000000003c0 R11: 0000000000000246 R12: 0000000000000001 [ 319.815995][T11531] R13: 00007f7105026038 R14: 00007f7105025fa0 R15: 00007ffdc7b19928 [ 319.816024][T11531] [ 320.394532][T11548] ip6gretap1: default qdisc (pfifo_fast) fail, fallback to noqueue [ 320.985599][T11572] 8021q: VLANs not supported on syzkaller0 [ 321.011466][T11572] Bluetooth: hci0: invalid length 0, exp 4 for type 32 [ 321.468716][T11583] syzkaller0: entered promiscuous mode [ 321.468756][T11583] syzkaller0: entered allmulticast mode [ 321.539318][ T3368] syzkaller0: (slave bond_slave_0): link status definitely up, 10000 Mbps full duplex [ 321.539541][ T3368] syzkaller0: (slave bond_slave_1): link status definitely up, 10000 Mbps full duplex [ 321.558889][ T3368] syzkaller0: active interface up! [ 321.878718][T11602] veth0_to_hsr: entered promiscuous mode [ 321.891269][T11602] veth0_to_hsr: left promiscuous mode [ 322.084935][T11610] xt_CT: No such helper "snmp_trap" [ 322.306175][T11624] netlink: 'syz.3.1267': attribute type 1 has an invalid length. [ 322.423178][T11624] 8021q: adding VLAN 0 to HW filter on device bond5 [ 322.450948][T11624] netlink: 'syz.3.1267': attribute type 1 has an invalid length. [ 322.482025][T11628] vlan0: entered allmulticast mode [ 322.482070][T11628] veth0_to_bond: entered allmulticast mode [ 322.493860][T11628] bond5: (slave vlan0): Enslaving as an active interface with a down link [ 322.726031][T11639] __nla_validate_parse: 7 callbacks suppressed [ 322.726074][T11639] netlink: 12 bytes leftover after parsing attributes in process `syz.0.1269'. [ 322.849164][T11648] netlink: 12 bytes leftover after parsing attributes in process `syz.3.1272'. [ 323.355342][T11655] netlink: 24 bytes leftover after parsing attributes in process `syz.3.1274'. [ 323.638822][T11663] Bluetooth: MGMT ver 1.23 [ 323.731547][T11672] netlink: 60 bytes leftover after parsing attributes in process `syz.4.1277'. [ 323.738007][T11657] syzkaller0: entered promiscuous mode [ 323.738027][T11657] syzkaller0: entered allmulticast mode [ 323.758754][T11678] netlink: 60 bytes leftover after parsing attributes in process `syz.4.1277'. [ 323.925347][T11684] netlink: NAT attribute has 1 unknown bytes [ 323.933010][T11684] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 324.086068][T11691] netlink: 12 bytes leftover after parsing attributes in process `syz.0.1281'. [ 324.299992][T11708] netlink: 8 bytes leftover after parsing attributes in process `syz.3.1283'. [ 324.300047][T11708] netlink: 'syz.3.1283': attribute type 30 has an invalid length. [ 324.300062][T11708] netlink: 4 bytes leftover after parsing attributes in process `syz.3.1283'. [ 324.600556][T11713] netlink: 24 bytes leftover after parsing attributes in process `syz.3.1283'. [ 325.965282][T11709] faux_driver regulatory: loading /lib/firmware/regulatory.db failed with error -4 [ 325.965344][T11709] faux_driver regulatory: Direct firmware load for regulatory.db failed with error -4 [ 325.965361][T11709] faux_driver regulatory: Falling back to sysfs fallback for: regulatory.db [ 325.976133][T11711] netlink: 7 bytes leftover after parsing attributes in process `syz.3.1283'. [ 326.147961][T11717] FAULT_INJECTION: forcing a failure. [ 326.147961][T11717] name failslab, interval 1, probability 0, space 0, times 0 [ 326.164264][T11717] CPU: 0 UID: 0 PID: 11717 Comm: syz.0.1284 Not tainted syzkaller #0 PREEMPT(full) [ 326.164287][T11717] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 326.164296][T11717] Call Trace: [ 326.164304][T11717] [ 326.164311][T11717] dump_stack_lvl+0xe8/0x150 [ 326.164340][T11717] should_fail_ex+0x410/0x560 [ 326.164369][T11717] should_failslab+0xa8/0x100 [ 326.164392][T11717] __kvmalloc_node_noprof+0x176/0x820 [ 326.164409][T11717] ? do_ipt_set_ctl+0x962/0xe20 [ 326.164432][T11717] ? do_sock_setsockopt+0x17c/0x1b0 [ 326.164455][T11717] ? __x64_sys_setsockopt+0x13d/0x1b0 [ 326.164478][T11717] ? do_syscall_64+0x166/0x520 [ 326.164501][T11717] ? translate_table+0x193/0x1f80 [ 326.164522][T11717] ? translate_table+0x193/0x1f80 [ 326.164552][T11717] translate_table+0x193/0x1f80 [ 326.164596][T11717] ? __pfx_translate_table+0x10/0x10 [ 326.164619][T11717] ? lock_acquire+0x115/0x350 [ 326.164658][T11717] ? _copy_from_user+0x94/0xb0 [ 326.164679][T11717] do_ipt_set_ctl+0xa53/0xe20 [ 326.164711][T11717] ? rcu_is_watching+0x16/0xb0 [ 326.164733][T11717] ? __pfx_do_ipt_set_ctl+0x10/0x10 [ 326.164772][T11717] ? __mutex_unlock_slowpath+0x731/0x900 [ 326.164801][T11717] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 326.164837][T11717] nf_setsockopt+0x26f/0x290 [ 326.164864][T11717] ? __pfx_sock_common_setsockopt+0x10/0x10 [ 326.164890][T11717] do_sock_setsockopt+0x17c/0x1b0 [ 326.164920][T11717] __x64_sys_setsockopt+0x13d/0x1b0 [ 326.164959][T11717] do_syscall_64+0x166/0x520 [ 326.164981][T11717] ? trace_irq_disable+0x3b/0x140 [ 326.164996][T11717] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 326.165015][T11717] ? clear_bhb_loop+0x70/0xc0 [ 326.165036][T11717] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 326.165054][T11717] RIP: 0033:0x7f816419e159 [ 326.165071][T11717] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 326.165085][T11717] RSP: 002b:00007f8165125028 EFLAGS: 00000246 ORIG_RAX: 0000000000000036 [ 326.165105][T11717] RAX: ffffffffffffffda RBX: 00007f8164425fa0 RCX: 00007f816419e159 [ 326.165118][T11717] RDX: 0000000000000040 RSI: 0000000000000000 RDI: 0000000000000003 [ 326.165128][T11717] RBP: 00007f8165125090 R08: 00000000000003e0 R09: 0000000000000000 [ 326.165139][T11717] R10: 00002000000003c0 R11: 0000000000000246 R12: 0000000000000001 [ 326.165150][T11717] R13: 00007f8164426038 R14: 00007f8164425fa0 R15: 00007ffd18491bf8 [ 326.165178][T11717] [ 326.363373][T11723] netlink: 'syz.2.1287': attribute type 2 has an invalid length. [ 326.389452][T11723] netlink: 'syz.2.1287': attribute type 2 has an invalid length. [ 326.594512][T11734] xt_limit: Overflow, try lower: 0/0 [ 326.616487][T11741] xt_limit: Overflow, try lower: 0/0 [ 326.953952][T11762] FAULT_INJECTION: forcing a failure. [ 326.953952][T11762] name failslab, interval 1, probability 0, space 0, times 0 [ 326.967181][T11762] CPU: 0 UID: 0 PID: 11762 Comm: syz.0.1300 Not tainted syzkaller #0 PREEMPT(full) [ 326.967206][T11762] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 326.967216][T11762] Call Trace: [ 326.967223][T11762] [ 326.967231][T11762] dump_stack_lvl+0xe8/0x150 [ 326.967261][T11762] should_fail_ex+0x410/0x560 [ 326.967290][T11762] should_failslab+0xa8/0x100 [ 326.967310][T11762] __kmalloc_noprof+0xfe/0x720 [ 326.967336][T11762] ? fsm_init+0x235/0x4e0 [ 326.967352][T11762] ? fsm_init+0x235/0x4e0 [ 326.967373][T11762] fsm_init+0x235/0x4e0 [ 326.967397][T11762] textsearch_prepare+0x84/0x170 [ 326.967423][T11762] string_mt_check+0x183/0x260 [ 326.967450][T11762] xt_check_match+0x602/0xce0 [ 326.967480][T11762] ? __pfx_xt_check_match+0x10/0x10 [ 326.967506][T11762] ? pcpu_alloc_noprof+0x1036/0x1900 [ 326.967538][T11762] ? xt_find_match+0x213/0x260 [ 326.967568][T11762] translate_table+0x1498/0x1f80 [ 326.967612][T11762] ? __pfx_translate_table+0x10/0x10 [ 326.967636][T11762] ? lock_acquire+0x115/0x350 [ 326.967674][T11762] ? _copy_from_user+0x94/0xb0 [ 326.967697][T11762] do_ipt_set_ctl+0xa53/0xe20 [ 326.967726][T11762] ? rcu_is_watching+0x16/0xb0 [ 326.967745][T11762] ? __pfx_do_ipt_set_ctl+0x10/0x10 [ 326.967782][T11762] ? __mutex_unlock_slowpath+0x731/0x900 [ 326.967813][T11762] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 326.967858][T11762] nf_setsockopt+0x26f/0x290 [ 326.967883][T11762] ? __pfx_sock_common_setsockopt+0x10/0x10 [ 326.967908][T11762] do_sock_setsockopt+0x17c/0x1b0 [ 326.967938][T11762] __x64_sys_setsockopt+0x13d/0x1b0 [ 326.967968][T11762] do_syscall_64+0x166/0x520 [ 326.967989][T11762] ? trace_irq_disable+0x3b/0x140 [ 326.968006][T11762] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 326.968023][T11762] ? clear_bhb_loop+0x70/0xc0 [ 326.968045][T11762] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 326.968062][T11762] RIP: 0033:0x7f816419e159 [ 326.968078][T11762] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 326.968092][T11762] RSP: 002b:00007f8165125028 EFLAGS: 00000246 ORIG_RAX: 0000000000000036 [ 326.968111][T11762] RAX: ffffffffffffffda RBX: 00007f8164425fa0 RCX: 00007f816419e159 [ 326.968124][T11762] RDX: 0000000000000040 RSI: 0000000000000000 RDI: 0000000000000003 [ 326.968133][T11762] RBP: 00007f8165125090 R08: 00000000000003e0 R09: 0000000000000000 [ 326.968143][T11762] R10: 00002000000003c0 R11: 0000000000000246 R12: 0000000000000001 [ 326.968154][T11762] R13: 00007f8164426038 R14: 00007f8164425fa0 R15: 00007ffd18491bf8 [ 326.968185][T11762] [ 327.765387][T11796] netlink: 'syz.3.1308': attribute type 2 has an invalid length. [ 327.814138][T11787] lo speed is unknown, defaulting to 1000 [ 328.173974][T11786] __nla_validate_parse: 8 callbacks suppressed [ 328.177353][T11786] netlink: 32 bytes leftover after parsing attributes in process `syz.2.1306'. [ 328.177447][T11786] netlink: 32 bytes leftover after parsing attributes in process `syz.2.1306'. [ 328.345430][T11812] netlink: 'syz.4.1313': attribute type 1 has an invalid length. [ 328.429626][T11815] netlink: 'syz.3.1314': attribute type 1 has an invalid length. [ 328.753512][T11830] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 329.038225][T11846] FAULT_INJECTION: forcing a failure. [ 329.038225][T11846] name failslab, interval 1, probability 0, space 0, times 0 [ 329.068960][T11852] netlink: 8 bytes leftover after parsing attributes in process `syz.3.1323'. [ 329.079532][T11846] CPU: 0 UID: 0 PID: 11846 Comm: syz.4.1322 Not tainted syzkaller #0 PREEMPT(full) [ 329.079559][T11846] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 329.079570][T11846] Call Trace: [ 329.079577][T11846] [ 329.079585][T11846] dump_stack_lvl+0xe8/0x150 [ 329.079617][T11846] should_fail_ex+0x410/0x560 [ 329.079661][T11846] should_failslab+0xa8/0x100 [ 329.079684][T11846] __kvmalloc_node_noprof+0x176/0x820 [ 329.079706][T11846] ? __nf_register_net_hook+0x232/0x930 [ 329.079728][T11846] ? nf_hook_entries_grow+0x287/0x740 [ 329.079747][T11846] ? nf_hook_entries_grow+0x287/0x740 [ 329.079775][T11846] nf_hook_entries_grow+0x287/0x740 [ 329.079810][T11846] __nf_register_net_hook+0x2c9/0x930 [ 329.079844][T11846] nf_register_net_hook+0xb2/0x190 [ 329.079869][T11846] nf_register_net_hooks+0x44/0x1b0 [ 329.079896][T11846] nf_defrag_ipv4_enable+0x87/0x120 [ 329.079921][T11846] nf_ct_netns_do_get+0x18c/0x5c0 [ 329.079953][T11846] ? __pfx_nf_ct_netns_do_get+0x10/0x10 [ 329.079977][T11846] ? trace_contention_end+0x3d/0x140 [ 329.080006][T11846] ? nf_ct_netns_get+0xe9/0x320 [ 329.080033][T11846] connlimit_mt_check+0x7f/0x250 [ 329.080063][T11846] xt_check_match+0x602/0xce0 [ 329.080096][T11846] ? __pfx_xt_check_match+0x10/0x10 [ 329.080123][T11846] ? pcpu_alloc_noprof+0x1036/0x1900 [ 329.080158][T11846] ? xt_find_match+0x213/0x260 [ 329.080191][T11846] translate_table+0x1498/0x1f80 [ 329.080240][T11846] ? __pfx_translate_table+0x10/0x10 [ 329.080261][T11846] ? lock_acquire+0x115/0x350 [ 329.080296][T11846] ? _copy_from_user+0x94/0xb0 [ 329.080320][T11846] do_ipt_set_ctl+0xa53/0xe20 [ 329.080353][T11846] ? rcu_is_watching+0x16/0xb0 [ 329.080376][T11846] ? __pfx_do_ipt_set_ctl+0x10/0x10 [ 329.080417][T11846] ? __mutex_unlock_slowpath+0x731/0x900 [ 329.080450][T11846] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 329.080486][T11846] nf_setsockopt+0x26f/0x290 [ 329.080512][T11846] ? __pfx_sock_common_setsockopt+0x10/0x10 [ 329.080539][T11846] do_sock_setsockopt+0x17c/0x1b0 [ 329.080569][T11846] __x64_sys_setsockopt+0x13d/0x1b0 [ 329.080599][T11846] do_syscall_64+0x166/0x520 [ 329.080628][T11846] ? trace_irq_disable+0x3b/0x140 [ 329.080646][T11846] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 329.080665][T11846] ? clear_bhb_loop+0x70/0xc0 [ 329.080687][T11846] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 329.080705][T11846] RIP: 0033:0x7fdf4d59e159 [ 329.080723][T11846] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 329.080739][T11846] RSP: 002b:00007fdf4b7f6028 EFLAGS: 00000246 ORIG_RAX: 0000000000000036 [ 329.080760][T11846] RAX: ffffffffffffffda RBX: 00007fdf4d825fa0 RCX: 00007fdf4d59e159 [ 329.080773][T11846] RDX: 0000000000000040 RSI: 0000000000000000 RDI: 0000000000000003 [ 329.080783][T11846] RBP: 00007fdf4b7f6090 R08: 00000000000003e0 R09: 0000000000000000 [ 329.080795][T11846] R10: 00002000000003c0 R11: 0000000000000246 R12: 0000000000000001 [ 329.080806][T11846] R13: 00007fdf4d826038 R14: 00007fdf4d825fa0 R15: 00007ffcce7c5f18 [ 329.080839][T11846] [ 329.146292][T11846] xt_connlimit: cannot load conntrack support for proto=2 [ 329.437792][T11865] netlink: 28 bytes leftover after parsing attributes in process `syz.3.1326'. [ 329.437842][T11865] netlink: 32 bytes leftover after parsing attributes in process `syz.3.1326'. [ 329.437872][T11865] netlink: 28 bytes leftover after parsing attributes in process `syz.3.1326'. [ 329.438045][T11865] netlink: 32 bytes leftover after parsing attributes in process `syz.3.1326'. [ 329.633548][T11876] tipc: Enabling of bearer rejected, failed to enable media [ 329.710264][T11878] netlink: 'syz.2.1330': attribute type 2 has an invalid length. [ 330.304606][T11903] FAULT_INJECTION: forcing a failure. [ 330.304606][T11903] name failslab, interval 1, probability 0, space 0, times 0 [ 330.304655][T11903] CPU: 0 UID: 0 PID: 11903 Comm: syz.1.1336 Not tainted syzkaller #0 PREEMPT(full) [ 330.304676][T11903] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 330.304686][T11903] Call Trace: [ 330.304694][T11903] [ 330.304702][T11903] dump_stack_lvl+0xe8/0x150 [ 330.304733][T11903] should_fail_ex+0x410/0x560 [ 330.304765][T11903] should_failslab+0xa8/0x100 [ 330.304785][T11903] __kvmalloc_node_noprof+0x176/0x820 [ 330.304806][T11903] ? nf_hook_entries_grow+0x287/0x740 [ 330.304827][T11903] ? nf_hook_entries_grow+0x287/0x740 [ 330.304849][T11903] ? __pfx___mutex_lock+0x10/0x10 [ 330.304878][T11903] nf_hook_entries_grow+0x287/0x740 [ 330.304913][T11903] __nf_register_net_hook+0x2c9/0x930 [ 330.304947][T11903] nf_register_net_hook+0xb2/0x190 [ 330.304971][T11903] nf_register_net_hooks+0x44/0x1b0 [ 330.304994][T11903] nf_ct_netns_do_get+0x3bf/0x5c0 [ 330.305021][T11903] ? __pfx_nf_ct_netns_do_get+0x10/0x10 [ 330.305045][T11903] ? trace_contention_end+0x3d/0x140 [ 330.305071][T11903] ? nf_ct_netns_get+0xe9/0x320 [ 330.305096][T11903] connlimit_mt_check+0x7f/0x250 [ 330.305125][T11903] xt_check_match+0x602/0xce0 [ 330.305155][T11903] ? __pfx_xt_check_match+0x10/0x10 [ 330.305183][T11903] ? pcpu_alloc_noprof+0x1036/0x1900 [ 330.305217][T11903] ? xt_find_match+0x213/0x260 [ 330.305248][T11903] translate_table+0x1498/0x1f80 [ 330.305293][T11903] ? __pfx_translate_table+0x10/0x10 [ 330.305314][T11903] ? lock_acquire+0x115/0x350 [ 330.305355][T11903] ? _copy_from_user+0x94/0xb0 [ 330.305376][T11903] do_ipt_set_ctl+0xa53/0xe20 [ 330.305407][T11903] ? rcu_is_watching+0x16/0xb0 [ 330.305428][T11903] ? __pfx_do_ipt_set_ctl+0x10/0x10 [ 330.305467][T11903] ? __mutex_unlock_slowpath+0x731/0x900 [ 330.305505][T11903] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 330.305539][T11903] nf_setsockopt+0x26f/0x290 [ 330.305565][T11903] ? __pfx_sock_common_setsockopt+0x10/0x10 [ 330.305592][T11903] do_sock_setsockopt+0x17c/0x1b0 [ 330.305624][T11903] __x64_sys_setsockopt+0x13d/0x1b0 [ 330.305657][T11903] do_syscall_64+0x166/0x520 [ 330.305680][T11903] ? trace_irq_disable+0x3b/0x140 [ 330.305697][T11903] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 330.305716][T11903] ? clear_bhb_loop+0x70/0xc0 [ 330.305739][T11903] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 330.305758][T11903] RIP: 0033:0x7f2a0a59e159 [ 330.305776][T11903] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 330.305791][T11903] RSP: 002b:00007f2a0b3ec028 EFLAGS: 00000246 ORIG_RAX: 0000000000000036 [ 330.305811][T11903] RAX: ffffffffffffffda RBX: 00007f2a0a825fa0 RCX: 00007f2a0a59e159 [ 330.305826][T11903] RDX: 0000000000000040 RSI: 0000000000000000 RDI: 0000000000000003 [ 330.305837][T11903] RBP: 00007f2a0b3ec090 R08: 00000000000003e0 R09: 0000000000000000 [ 330.305849][T11903] R10: 00002000000003c0 R11: 0000000000000246 R12: 0000000000000001 [ 330.305861][T11903] R13: 00007f2a0a826038 R14: 00007f2a0a825fa0 R15: 00007ffd8ed15b28 [ 330.305894][T11903] [ 330.347505][T11903] xt_connlimit: cannot load conntrack support for proto=2 [ 330.635072][T11910] netlink: 112 bytes leftover after parsing attributes in process `syz.3.1339'. [ 330.811290][T11919] netlink: 20 bytes leftover after parsing attributes in process `syz.2.1343'. [ 330.842974][T11919] netlink: 20 bytes leftover after parsing attributes in process `syz.2.1343'. [ 330.946395][T11931] netlink: 'syz.1.1345': attribute type 15 has an invalid length. [ 331.019983][T11933] veth0_to_hsr: Caught tx_queue_len zero misconfig [ 331.173786][T11939] gretap1: entered promiscuous mode [ 331.324880][T11953] netlink: 'syz.0.1352': attribute type 1 has an invalid length. [ 331.347015][T11953] netlink: 'syz.0.1352': attribute type 1 has an invalid length. [ 331.476473][T11957] ip6t_srh: unknown srh invflags 4000 [ 331.740676][T11969] ip6t_ah: unknown flags 4 [ 331.912982][T11978] xt_cluster: node mask cannot exceed total number of nodes [ 332.261438][T11993] sit2: entered allmulticast mode [ 332.324640][T11995] 8021q: adding VLAN 0 to HW filter on device bond3 [ 332.482731][T12001] x_tables: duplicate underflow at hook 1 [ 333.045361][T12011] lo speed is unknown, defaulting to 1000 [ 333.223010][T12020] netlink: 'syz.0.1372': attribute type 21 has an invalid length. [ 333.223051][T12020] __nla_validate_parse: 3 callbacks suppressed [ 333.223083][T12020] netlink: 128 bytes leftover after parsing attributes in process `syz.0.1372'. [ 333.275446][T12022] netlink: 8 bytes leftover after parsing attributes in process `syz.0.1372'. [ 333.278859][T12020] netlink: 'syz.0.1372': attribute type 4 has an invalid length. [ 333.278878][T12020] netlink: 'syz.0.1372': attribute type 3 has an invalid length. [ 333.278889][T12020] netlink: 3 bytes leftover after parsing attributes in process `syz.0.1372'. [ 333.471081][T12029] netlink: 24 bytes leftover after parsing attributes in process `syz.0.1374'. [ 333.482788][T12029] netlink: 24 bytes leftover after parsing attributes in process `syz.0.1374'. [ 333.763680][T12046] bridge0: entered allmulticast mode [ 334.011776][T12037] netlink: 830 bytes leftover after parsing attributes in process `syz.2.1378'. [ 334.394028][T12080] netlink: 76 bytes leftover after parsing attributes in process `syz.4.1386'. [ 334.418038][T12080] netlink: 4 bytes leftover after parsing attributes in process `syz.4.1386'. [ 334.722196][T12095] netlink: 'syz.2.1389': attribute type 11 has an invalid length. [ 334.814376][T12106] netlink: 'syz.4.1393': attribute type 23 has an invalid length. [ 334.875438][T12108] netlink: 'syz.4.1393': attribute type 1 has an invalid length. [ 335.050483][T12108] 8021q: adding VLAN 0 to HW filter on device bond4 [ 335.138029][T12121] netlink: 12 bytes leftover after parsing attributes in process `syz.0.1395'. [ 335.153495][T12113] bond4: (slave veth3): Enslaving as an active interface with a down link [ 335.181353][T12117] 8021q: adding VLAN 0 to HW filter on device batadv1 [ 335.181621][T12117] bond4: (slave batadv1): dev_set_mac_address on slave failed! ALB mode requires that the base driver support setting the hw address also when the network device's interface is open [ 335.198095][T12124] netlink: 60 bytes leftover after parsing attributes in process `syz.2.1397'. [ 335.559272][T12143] syzkaller0: left promiscuous mode [ 335.559309][T12143] bond_slave_0: left promiscuous mode [ 335.559465][T12143] bond_slave_1: left promiscuous mode [ 335.570729][T12143] syzkaller0: left allmulticast mode [ 335.570749][T12143] bond_slave_0: left allmulticast mode [ 335.570763][T12143] bond_slave_1: left allmulticast mode [ 336.002913][T12165] netlink: 'syz.4.1406': attribute type 21 has an invalid length. [ 336.430430][T12189] nbd: must specify at least one socket [ 336.438977][T12188] nbd: must specify at least one socket [ 337.158379][T12226] netlink: 'syz.1.1417': attribute type 1 has an invalid length. [ 337.158419][T12226] netlink: 'syz.1.1417': attribute type 2 has an invalid length. [ 337.166562][T12222] lo speed is unknown, defaulting to 1000 [ 337.319275][T12231] syzkaller0: entered promiscuous mode [ 337.319429][T12231] bond_slave_0: entered promiscuous mode [ 337.319858][T12231] bond_slave_1: entered promiscuous mode [ 337.320036][T12231] syzkaller0: entered allmulticast mode [ 337.320049][T12231] bond_slave_0: entered allmulticast mode [ 337.320062][T12231] bond_slave_1: entered allmulticast mode [ 337.938264][T12251] bond0: (slave dummy0): Releasing backup interface [ 338.697187][T12251] bridge_slave_0: left allmulticast mode [ 338.703654][T12251] bridge_slave_0: left promiscuous mode [ 338.705102][T12251] bridge0: port 1(bridge_slave_0) entered disabled state [ 338.708455][T12277] __nla_validate_parse: 8 callbacks suppressed [ 338.708470][T12277] netlink: 276 bytes leftover after parsing attributes in process `syz.0.1429'. [ 338.738120][T12251] syzkaller0: (slave bond_slave_0): Releasing backup interface [ 338.747526][T12251] bond_slave_0: left promiscuous mode [ 338.753276][T12251] bond_slave_0: left allmulticast mode [ 338.772314][T12251] syzkaller0: (slave bond_slave_1): Releasing backup interface [ 338.781643][T12251] tipc: Resetting bearer [ 338.782354][T12251] bond_slave_1: left promiscuous mode [ 338.795004][T12251] bond_slave_1: left allmulticast mode [ 338.813696][T12251] team0: Port device team_slave_0 removed [ 338.836467][T12251] team0: Port device team_slave_1 removed [ 338.843241][T12251] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 338.843294][T12251] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 338.864615][T12251] A link change request failed with some changes committed already. Interface hsr_slave_0 may have been left with an inconsistent configuration, please check. [ 338.910094][T10430] tipc: Resetting bearer [ 339.058323][T12287] netlink: 8 bytes leftover after parsing attributes in process `syz.4.1434'. [ 339.067870][T12288] netlink: 8 bytes leftover after parsing attributes in process `syz.4.1434'. [ 339.251066][T12298] netlink: 60 bytes leftover after parsing attributes in process `syz.1.1433'. [ 339.268999][T12301] $2v5.: renamed from lo (while UP) [ 339.401431][T12310] netlink: 'syz.3.1438': attribute type 1 has an invalid length. [ 339.567912][T12310] 8021q: adding VLAN 0 to HW filter on device bond6 [ 339.675181][T12318] batman_adv: batadv0: Adding interface: veth0 [ 339.684878][T12318] batman_adv: batadv0: The MTU of interface veth0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 339.711960][T12318] batman_adv: batadv0: Interface activated: veth0 [ 339.826123][T12332] netlink: 12 bytes leftover after parsing attributes in process `syz.4.1442'. [ 339.834633][T12331] batman_adv: batadv0: Interface deactivated: veth0 [ 339.834655][T12331] batman_adv: batadv0: Removing interface: veth0 [ 340.324548][T12355] netlink: 60 bytes leftover after parsing attributes in process `syz.3.1450'. [ 340.771111][T12373] bridge5: entered promiscuous mode [ 340.784885][T12375] netlink: 'syz.3.1457': attribute type 11 has an invalid length. [ 340.784935][T12375] netlink: 8 bytes leftover after parsing attributes in process `syz.3.1457'. [ 340.791249][T12370] pimreg: entered allmulticast mode [ 341.101414][T12385] netlink: 8 bytes leftover after parsing attributes in process `syz.2.1458'. [ 341.201033][T12375] netdevsim netdevsim3 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 341.240152][T12378] syzkaller1: entered promiscuous mode [ 341.246404][T12378] syzkaller1: entered allmulticast mode [ 341.248400][T12388] pimreg: left allmulticast mode [ 341.396652][T12375] netdevsim netdevsim3 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 341.503451][T12394] netlink: 12 bytes leftover after parsing attributes in process `syz.2.1460'. [ 341.533800][T12375] netdevsim netdevsim3 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 341.563465][T12394] netlink: 12 bytes leftover after parsing attributes in process `syz.2.1460'. [ 341.699939][T12375] netdevsim netdevsim3 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 342.032710][T12405] netlink: 'syz.0.1463': attribute type 2 has an invalid length. [ 342.034842][T12411] netlink: 'syz.0.1463': attribute type 4 has an invalid length. [ 342.083629][T12405] netlink: 'syz.0.1463': attribute type 4 has an invalid length. [ 342.101130][T10431] netdevsim netdevsim3 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 342.350494][ T9000] netdevsim netdevsim3 eth2: set [1, 0] type 2 family 0 port 6081 - 0 [ 342.388050][ T9000] netdevsim netdevsim3 eth1: set [1, 0] type 2 family 0 port 6081 - 0 [ 342.406202][T10431] netdevsim netdevsim3 eth3: set [1, 0] type 2 family 0 port 6081 - 0 [ 343.127405][T12460] xt_policy: too many policy elements [ 343.140356][T12460] netlink: 'syz.4.1473': attribute type 1 has an invalid length. [ 343.140420][T12460] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 343.443117][T12470] netlink: 'syz.1.1476': attribute type 4 has an invalid length. [ 343.475282][T12470] netlink: 'syz.1.1476': attribute type 4 has an invalid length. [ 343.829345][T12475] __nla_validate_parse: 2 callbacks suppressed [ 343.829396][T12475] netlink: 60 bytes leftover after parsing attributes in process `syz.2.1478'. [ 344.081507][T12488] netlink: 68 bytes leftover after parsing attributes in process `syz.0.1483'. [ 344.180724][T12492] netlink: 308 bytes leftover after parsing attributes in process `syz.2.1485'. [ 344.510196][T12498] netlink: 72 bytes leftover after parsing attributes in process `syz.1.1488'. [ 344.569616][T12498] netlink: 14 bytes leftover after parsing attributes in process `syz.1.1488'. [ 344.705220][T12512] netlink: 60 bytes leftover after parsing attributes in process `syz.4.1491'. [ 344.752696][T12500] pim6reg: entered allmulticast mode [ 344.753726][T12502] pim6reg: left allmulticast mode [ 344.793771][T12517] openvswitch: netlink: Unexpected mask (mask=1010, allowed=10058) [ 345.001262][T12522] xt_HMARK: proto mask must be zero with L3 mode [ 345.068955][T12522] netlink: 8 bytes leftover after parsing attributes in process `syz.3.1493'. [ 345.330031][T12524] netlink: 16 bytes leftover after parsing attributes in process `syz.0.1494'. [ 345.420407][T12526] lo speed is unknown, defaulting to 1000 [ 345.571750][T12537] veth5: entered allmulticast mode [ 345.660152][T12547] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 346.677904][T12572] netlink: 68 bytes leftover after parsing attributes in process `syz.4.1504'. [ 347.179660][T12590] netlink: 60 bytes leftover after parsing attributes in process `syz.4.1507'. [ 347.739138][ T9856] lo speed is unknown, defaulting to 1000 [ 348.010827][T12629] netlink: 'syz.4.1515': attribute type 13 has an invalid length. [ 348.219887][T12642] bridge0: left allmulticast mode [ 348.317998][T12649] netlink: 'syz.4.1521': attribute type 12 has an invalid length. [ 348.416093][ C0] ip6_tunnel: ip6gretap1 xmit: Local address not yet configured! [ 348.530372][T12636] openvswitch: netlink: Unexpected mask (mask=440, allowed=10048) [ 348.751629][T12663] netdevsim netdevsim2 netdevsim0: entered promiscuous mode [ 348.820534][T12663] erspan0: entered promiscuous mode [ 348.824936][T12663] debugfs: 'hsr1' already exists in 'hsr' [ 348.824957][T12663] Cannot create hsr debugfs directory [ 348.950045][T12675] __nla_validate_parse: 9 callbacks suppressed [ 348.958255][T12675] netlink: 112 bytes leftover after parsing attributes in process `syz.3.1531'. [ 349.104825][T12681] netlink: 564 bytes leftover after parsing attributes in process `syz.1.1530'. [ 349.341887][T12690] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 349.354268][T12690] netlink: 28 bytes leftover after parsing attributes in process `syz.4.1534'. [ 349.613601][T12705] netlink: 'syz.0.1539': attribute type 1 has an invalid length. [ 349.616784][T12702] netlink: 16 bytes leftover after parsing attributes in process `syz.3.1538'. [ 349.674540][T12705] 8021q: adding VLAN 0 to HW filter on device bond8 [ 349.780088][T12706] bond8: (slave geneve3): making interface the new active one [ 349.790634][T12706] bond8: (slave geneve3): Enslaving as an active interface with an up link [ 349.806343][T10430] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 349.806406][T10430] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 349.806435][T10430] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 349.816869][ T9000] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 350.058752][T12719] pimreg: entered allmulticast mode [ 350.060392][T12721] pimreg: left allmulticast mode [ 350.173186][T12727] Cannot find set identified by id 65534 to match [ 350.354807][T12729] netlink: 60 bytes leftover after parsing attributes in process `syz.0.1549'. [ 350.958137][T12779] syzkaller1: entered promiscuous mode [ 350.964894][T12779] syzkaller1: entered allmulticast mode [ 350.990200][T12779] syzkaller1: left promiscuous mode [ 350.995735][T12779] syzkaller1: left allmulticast mode [ 351.113964][T12785] syzkaller0: left promiscuous mode [ 351.114029][T12785] syzkaller0: left allmulticast mode [ 351.114486][T12785] tipc: Resetting bearer [ 351.210824][T12787] netlink: 12 bytes leftover after parsing attributes in process `syz.4.1563'. [ 351.309078][T12793] No such timeout policy "syz1" [ 351.457852][T12805] netlink: 36 bytes leftover after parsing attributes in process `syz.1.1566'. [ 351.463527][T12801] netlink: 199784 bytes leftover after parsing attributes in process `syz.0.1567'. [ 351.463558][T12801] netlink: 'syz.0.1567': attribute type 1 has an invalid length. [ 351.465475][T12801] pim6reg1: entered promiscuous mode [ 351.465493][T12801] pim6reg1: entered allmulticast mode [ 351.605452][T12810] xt_CT: No such helper "snmp_trap" [ 351.947926][T12823] netlink: 'syz.3.1569': attribute type 13 has an invalid length. [ 351.947956][T12823] netlink: 'syz.3.1569': attribute type 17 has an invalid length. [ 352.323301][T12827] netlink: 60 bytes leftover after parsing attributes in process `syz.0.1571'. [ 352.516416][T12822] batman_adv: batadv0: Interface deactivated: veth0 [ 353.038966][T12823] 8021q: adding VLAN 0 to HW filter on device bond0 [ 353.047566][T12823] 8021q: adding VLAN 0 to HW filter on device team0 [ 353.059995][T12823] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 353.061772][T12823] batman_adv: batadv0: Interface activated: veth0 [ 353.147749][T12823] A link change request failed with some changes committed already. Interface virt_wifi0 may have been left with an inconsistent configuration, please check. [ 353.156457][ T9000] netdevsim netdevsim3 eth3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 353.157515][ T9000] netdevsim netdevsim3 eth1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 353.157555][ T9000] netdevsim netdevsim3 eth2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 353.163859][ T3368] netdevsim netdevsim3 eth0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 353.264036][T12848] netlink: 'syz.2.1572': attribute type 1 has an invalid length. [ 353.264078][T12848] netlink: 224 bytes leftover after parsing attributes in process `syz.2.1572'. [ 353.411512][T12851] lo speed is unknown, defaulting to 1000 [ 353.611329][T12861] 8021q: VLANs not supported on wg0 [ 353.767251][T12869] netlink: 'syz.0.1579': attribute type 4 has an invalid length. [ 353.833410][T12869] netlink: 'syz.0.1579': attribute type 4 has an invalid length. [ 353.884852][T12876] netlink: 'syz.4.1581': attribute type 30 has an invalid length. [ 354.073571][T12887] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 354.097164][T12887] __nla_validate_parse: 1 callbacks suppressed [ 354.104246][T12887] netlink: 8 bytes leftover after parsing attributes in process `syz.4.1584'. [ 354.114041][T12887] netlink: 8 bytes leftover after parsing attributes in process `syz.4.1584'. [ 354.341698][T12899] netlink: 8 bytes leftover after parsing attributes in process `syz.4.1588'. [ 355.176093][T12905] tc_dump_action: action bad kind [ 355.288769][T12925] netlink: 24 bytes leftover after parsing attributes in process `syz.1.1594'. [ 355.444024][T12932] ipt_REJECT: TCP_RESET invalid for non-tcp [ 356.143561][T12960] netlink: 'syz.0.1605': attribute type 7 has an invalid length. [ 356.169477][T12962] netlink: 28 bytes leftover after parsing attributes in process `syz.4.1606'. [ 356.182535][T12962] netlink: 'syz.4.1606': attribute type 7 has an invalid length. [ 356.182583][T12962] netlink: 'syz.4.1606': attribute type 8 has an invalid length. [ 356.182598][T12962] netlink: 4 bytes leftover after parsing attributes in process `syz.4.1606'. [ 356.184460][T12964] netlink: 'syz.3.1607': attribute type 1 has an invalid length. [ 356.288647][T12972] netlink: 'syz.3.1607': attribute type 10 has an invalid length. [ 356.300965][T12972] netlink: 40 bytes leftover after parsing attributes in process `syz.3.1607'. [ 356.361948][T12964] 8021q: adding VLAN 0 to HW filter on device bond7 [ 356.424045][T12966] bond7: (slave dummy0): making interface the new active one [ 356.433622][T12966] bond7: (slave dummy0): Enslaving as an active interface with an up link [ 356.443666][T12972] dummy0: entered promiscuous mode [ 356.471330][T12972] bond7: (slave dummy0): Releasing active interface [ 357.073351][T13023] netlink: 36 bytes leftover after parsing attributes in process `syz.0.1618'. [ 357.131155][T13015] 8021q: adding VLAN 0 to HW filter on device bond0 [ 357.139717][T13023] netlink: 28 bytes leftover after parsing attributes in process `syz.0.1618'. [ 357.153023][T13015] 8021q: adding VLAN 0 to HW filter on device team0 [ 357.201646][T13015] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 357.218479][T13015] A link change request failed with some changes committed already. Interface virt_wifi0 may have been left with an inconsistent configuration, please check. [ 357.598754][T13051] netlink: 4 bytes leftover after parsing attributes in process `syz.4.1622'. [ 357.613158][T13039] syzkaller0: entered promiscuous mode [ 357.613218][T13039] syzkaller0: entered allmulticast mode [ 357.633357][T13041] veth1_to_bond: entered allmulticast mode [ 357.640805][T13045] veth1_to_bond: entered promiscuous mode [ 357.672573][T13051] veth1_to_bond (unregistering): left allmulticast mode [ 357.682094][T13051] veth1_to_bond (unregistering): left promiscuous mode [ 358.370169][T13067] block nbd3: Unsupported socket: should be TCP or UNIX. [ 358.807094][T13076] SET target dimension over the limit! [ 359.122726][T13083] block nbd3: Unsupported socket: should be TCP or UNIX. [ 359.494751][T13101] netlink: 'syz.0.1633': attribute type 7 has an invalid length. [ 360.520939][T13099] syzkaller0: left promiscuous mode [ 360.520979][T13099] syzkaller0: left allmulticast mode [ 360.529103][T13100] tipc: Enabled bearer , priority 10 [ 360.930902][T13121] syzkaller0: entered promiscuous mode [ 360.936744][T13121] syzkaller0: entered allmulticast mode [ 360.942903][T13121] tipc: Resetting bearer [ 360.967662][T13117] x_tables: ip_tables: osf match: only valid for protocol 6 [ 360.979214][T10428] IPVS: starting estimator thread 0... [ 361.007463][T13124] __nla_validate_parse: 1 callbacks suppressed [ 361.007520][T13124] netlink: 36 bytes leftover after parsing attributes in process `syz.3.1640'. [ 361.096262][T13127] IPVS: using max 33 ests per chain, 79200 per kthread [ 361.129888][T13128] netlink: 'syz.2.1641': attribute type 1 has an invalid length. [ 361.129925][T13128] netlink: 244 bytes leftover after parsing attributes in process `syz.2.1641'. [ 361.300469][T13137] netlink: 12 bytes leftover after parsing attributes in process `syz.4.1644'. [ 361.323163][T13131] lo speed is unknown, defaulting to 1000 [ 361.557977][T12844] tipc: Node number set to 952949736 [ 361.616975][T13146] bond4: option arp_interval: invalid value (18446744073709551615) [ 361.633328][T13146] bond4: option arp_interval: allowed values 0 - 2147483647 [ 361.643530][T13146] bond4 (unregistering): Released all slaves [ 361.937054][T13170] IPVS: set_ctl: invalid protocol: 60 127.0.0.1:20000 [ 362.291185][T13190] syzkaller0: entered promiscuous mode [ 362.291225][T13190] syzkaller0: entered allmulticast mode [ 362.470849][T13196] netlink: 12 bytes leftover after parsing attributes in process `syz.2.1658'. [ 363.062595][T13212] netlink: 156 bytes leftover after parsing attributes in process `syz.0.1661'. [ 363.208532][T13233] openvswitch: netlink: VXLAN extension 248 out of range max 1 [ 363.213843][T13217] lo speed is unknown, defaulting to 1000 [ 363.405412][T13229] ip6gretap3: entered allmulticast mode [ 364.411667][T13271] netlink: 'syz.2.1674': attribute type 49 has an invalid length. [ 364.547681][ C1] vcan0: j1939_tp_rxtimer: 0xffff888079c51400: rx timeout, send abort [ 364.605434][T13271] ip6gretap0: entered promiscuous mode [ 364.605476][T13271] ip6gretap0: entered allmulticast mode [ 364.845993][T13297] xt_CT: No such helper "snmp_trap" [ 365.033727][T13313] netlink: 20 bytes leftover after parsing attributes in process `syz.4.1684'. [ 365.047987][ C1] vcan0: j1939_tp_rxtimer: 0xffff888079c50800: rx timeout, send abort [ 365.058561][ C1] vcan0: j1939_tp_rxtimer: 0xffff888079c51400: abort rx timeout. Force session deactivation [ 365.439536][T13325] syzkaller1: entered promiscuous mode [ 365.439579][T13325] syzkaller1: entered allmulticast mode [ 365.555708][ C1] vcan0: j1939_tp_rxtimer: 0xffff888079c50800: abort rx timeout. Force session deactivation [ 366.379229][T13358] netlink: 244 bytes leftover after parsing attributes in process `syz.4.1690'. [ 366.494046][T13358] netlink: 'syz.4.1690': attribute type 13 has an invalid length. [ 366.503503][T13358] netlink: 4 bytes leftover after parsing attributes in process `syz.4.1690'. [ 366.672196][T13375] netlink: 'syz.1.1695': attribute type 1 has an invalid length. [ 366.718358][T13382] netlink: 'syz.4.1696': attribute type 13 has an invalid length. [ 366.743111][T13375] 8021q: adding VLAN 0 to HW filter on device bond4 [ 366.785494][T13375] netlink: 28 bytes leftover after parsing attributes in process `syz.1.1695'. [ 366.847941][T13395] xt_CONNSECMARK: invalid mode: 254 [ 366.899064][T13397] netlink: 'syz.3.1698': attribute type 2 has an invalid length. [ 366.949709][T13384] bond4: (slave veth13): Enslaving as an active interface with a down link [ 367.208772][T13412] xt_hashlimit: size too large, truncated to 1048576 [ 367.219327][T13412] xt_hashlimit: max too large, truncated to 1048576 [ 367.690937][T13438] netlink: 8 bytes leftover after parsing attributes in process `syz.4.1707'. [ 367.774277][T13448] netlink: 8 bytes leftover after parsing attributes in process `syz.4.1707'. [ 367.954361][T13456] ip6tnl0: Caught tx_queue_len zero misconfig [ 368.095300][T13456] netlink: 'syz.4.1712': attribute type 5 has an invalid length. [ 368.610550][T13488] mac80211_hwsim hwsim8 wlan0: entered promiscuous mode [ 368.610597][T13488] mac80211_hwsim hwsim8 wlan0: entered allmulticast mode [ 368.993519][T13507] bridge0: port 1(veth0_virt_wifi) entered blocking state [ 369.001999][T13507] bridge0: port 1(veth0_virt_wifi) entered disabled state [ 369.009690][T13507] veth0_virt_wifi: entered allmulticast mode [ 369.034291][T13507] veth0_virt_wifi: entered promiscuous mode [ 369.671156][T13536] netlink: 'syz.4.1730': attribute type 11 has an invalid length. [ 369.723234][T13541] netlink: 'syz.1.1732': attribute type 2 has an invalid length. [ 369.768257][T13536] A link change request failed with some changes committed already. Interface virt_wifi0 may have been left with an inconsistent configuration, please check. [ 369.773502][T13536] netlink: 8 bytes leftover after parsing attributes in process `syz.4.1730'. [ 369.887195][T13539] bond_slave_0: entered promiscuous mode [ 369.900254][T13539] A link change request failed with some changes committed already. Interface virt_wifi0 may have been left with an inconsistent configuration, please check. [ 369.912540][T12844] lo speed is unknown, defaulting to 1000 [ 369.912573][T12844] syz_device_name_32_chars_1234567: Port: 1 Link ACTIVE [ 369.912898][T13539] netlink: 12 bytes leftover after parsing attributes in process `syz.2.1731'. [ 370.010712][T13552] xt_MASQUERADE: bad rangesize 20224 [ 370.201721][T13566] netlink: 21 bytes leftover after parsing attributes in process `syz.2.1738'. [ 370.202928][ T6462] lo speed is unknown, defaulting to 1000 [ 370.202946][ T6462] syz_device_name_32_chars_1234567: Port: 1 Link DOWN [ 370.218736][T13568] netlink: 21 bytes leftover after parsing attributes in process `syz.2.1738'. [ 370.220034][T13568] netlink: 'syz.2.1738': attribute type 4 has an invalid length. [ 370.221875][T13566] netlink: 'syz.2.1738': attribute type 4 has an invalid length. [ 370.233429][ T6462] lo speed is unknown, defaulting to 1000 [ 370.233450][ T6462] syz_device_name_32_chars_1234567: Port: 1 Link ACTIVE [ 370.377232][T13578] ip_tables: iptables: counters copy to user failed while replacing table [ 370.805075][T13594] geneve0: Caught tx_queue_len zero misconfig [ 370.811364][T13594] netlink: 8 bytes leftover after parsing attributes in process `syz.3.1745'. [ 371.123320][T13615] bridge0: port 3(veth0) entered blocking state [ 371.123512][T13615] bridge0: port 3(veth0) entered disabled state [ 371.123682][T13615] veth0: entered allmulticast mode [ 371.130417][T13615] veth0: entered promiscuous mode [ 371.496615][T13630] __nla_validate_parse: 3 callbacks suppressed [ 371.496664][T13630] netlink: 8 bytes leftover after parsing attributes in process `syz.1.1756'. [ 371.520809][T13628] dvmrp0: entered allmulticast mode [ 371.548680][T13628] netlink: 152 bytes leftover after parsing attributes in process `syz.2.1755'. [ 371.633444][T13637] netlink: 4 bytes leftover after parsing attributes in process `syz.3.1759'. [ 371.817902][T13646] ip6gretap0: entered promiscuous mode [ 371.848442][T13642] netlink: 4 bytes leftover after parsing attributes in process `syz.2.1760'. [ 371.848538][T13642] bridge_slave_1: left allmulticast mode [ 371.848558][T13642] bridge_slave_1: left promiscuous mode [ 371.848788][T13642] bridge0: port 2(bridge_slave_1) entered disabled state [ 371.922402][T13642] x9: left allmulticast mode [ 371.922448][T13642] x9: left promiscuous mode [ 371.928399][T13648] netlink: 'syz.2.1760': attribute type 83 has an invalid length. [ 371.942897][T13642] bridge0: port 1(1x9) entered disabled state [ 372.300026][T13657] netlink: 277 bytes leftover after parsing attributes in process `syz.2.1765'. [ 372.306109][T13657] netlink: 16 bytes leftover after parsing attributes in process `syz.2.1765'. [ 372.497456][ T1208] IPVS: starting estimator thread 0... [ 372.586255][T13664] IPVS: using max 35 ests per chain, 84000 per kthread [ 372.621667][T13666] netlink: 12 bytes leftover after parsing attributes in process `syz.1.1768'. [ 372.623083][T13666] netlink: 12 bytes leftover after parsing attributes in process `syz.1.1768'. [ 372.624237][T13666] netlink: 12 bytes leftover after parsing attributes in process `syz.1.1768'. [ 372.624738][T13666] netlink: 12 bytes leftover after parsing attributes in process `syz.1.1768'. [ 373.048664][T13688] Bluetooth: hci0: invalid length 0, exp 2 for type 3 [ 373.419408][T13717] syzkaller0: left promiscuous mode [ 373.419447][T13717] syzkaller0: left allmulticast mode [ 373.419882][T13717] tipc: Resetting bearer [ 373.515435][T13707] lo speed is unknown, defaulting to 1000 [ 373.734966][T13725] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 374.225358][ T31] audit: type=1804 audit(1788313302.840:7): pid=13737 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=open_writers comm="syz.2.1780" name="/newroot/336/memory.events" dev="tmpfs" ino=1731 res=1 errno=0 [ 374.249706][ T31] audit: type=1800 audit(1788313302.840:8): pid=13737 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.2.1780" name="memory.events" dev="tmpfs" ino=1731 res=0 errno=0 [ 375.074822][T13767] netlink: 'syz.1.1789': attribute type 1 has an invalid length. [ 375.501809][T13781] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 375.701444][T13798] syzkaller0: entered promiscuous mode [ 375.701482][T13798] syzkaller0: entered allmulticast mode [ 375.746394][T13790] batman_adv: Cannot find parent device. Skipping batadv-on-batadv check for gretap1 [ 375.757832][T13790] batman_adv: batadv0: Adding interface: gretap1 [ 375.757887][T13790] batman_adv: batadv0: The MTU of interface gretap1 is too small (1462) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 375.757921][T13790] batman_adv: batadv0: Interface activated: gretap1 [ 376.605882][T13834] netlink: 'syz.0.1810': attribute type 4 has an invalid length. [ 376.605923][T13834] __nla_validate_parse: 30 callbacks suppressed [ 376.605950][T13834] netlink: 224 bytes leftover after parsing attributes in process `syz.0.1810'. [ 376.661141][T13818] netlink: 4 bytes leftover after parsing attributes in process `syz.2.1807'. [ 376.668000][T13816] syzkaller0: entered promiscuous mode [ 376.668021][T13816] syzkaller0: entered allmulticast mode [ 377.172974][T13864] netlink: 8 bytes leftover after parsing attributes in process `syz.2.1814'. [ 377.182970][T13864] netlink: 8 bytes leftover after parsing attributes in process `syz.2.1814'. [ 377.554450][T13855] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 377.563594][T13855] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 377.803749][T12844] lo speed is unknown, defaulting to 1000 [ 377.803812][T12844] syz_device_name_32_chars_1234567: Port: 1 Link DOWN [ 377.816065][T10431] netdevsim netdevsim2 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 377.816122][T10431] netdevsim netdevsim2 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 377.816153][T10431] netdevsim netdevsim2 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 377.816182][T10431] netdevsim netdevsim2 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 378.100849][T13895] netlink: 24 bytes leftover after parsing attributes in process `syz.0.1824'. [ 378.517581][ T1314] ieee802154 phy1 wpan1: encryption failed: -22 [ 379.130860][T13939] lo speed is unknown, defaulting to 1000 [ 379.814700][T13973] netlink: 76 bytes leftover after parsing attributes in process `syz.4.1838'. [ 379.867345][T13975] netlink: 5 bytes leftover after parsing attributes in process `syz.3.1839'. [ 379.926262][T13981] netlink: 8 bytes leftover after parsing attributes in process `syz.3.1839'. [ 380.018568][T13975] netlink: 'syz.3.1839': attribute type 32 has an invalid length. [ 380.018611][T13975] netlink: 12 bytes leftover after parsing attributes in process `syz.3.1839'. [ 380.079205][T13985] netlink: 24 bytes leftover after parsing attributes in process `syz.0.1841'. [ 380.253670][T13991] netlink: 'syz.2.1844': attribute type 21 has an invalid length. [ 380.353849][T13995] netlink: 'syz.3.1845': attribute type 1 has an invalid length. [ 380.701277][ T8213] udevd[8213]: inotify_add_watch(7, /dev/nbd64, 10) failed: No such file or directory [ 380.959811][T14015] veth0: entered promiscuous mode [ 380.959942][T14015] veth0: left promiscuous mode [ 381.452235][T14059] syzkaller0: entered promiscuous mode [ 381.452270][T14059] syzkaller0: entered allmulticast mode [ 381.453183][T14059] tipc: Resetting bearer [ 382.082392][T14082] netlink: 'syz.1.1862': attribute type 1 has an invalid length. [ 382.871102][T14051] netdevsim netdevsim4 netdevsim0: left promiscuous mode [ 382.871147][T14051] netdevsim netdevsim4 netdevsim0: left allmulticast mode [ 382.886556][T14094] netlink: NAT attributes may be specified only when CT COMMIT flag is also specified. [ 382.886585][T14094] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 382.910238][T14051] bond2: left promiscuous mode [ 382.910275][T14051] xfrm1: left promiscuous mode [ 382.955951][T14051] ip6gre2: left allmulticast mode [ 383.022509][T14051] veth5: left allmulticast mode [ 383.340374][T14112] netlink: 'syz.2.1870': attribute type 14 has an invalid length. [ 383.577430][T14122] __nla_validate_parse: 4 callbacks suppressed [ 383.577474][T14122] netlink: 16 bytes leftover after parsing attributes in process `syz.3.1871'. [ 383.727558][T14131] netlink: 68 bytes leftover after parsing attributes in process `syz.3.1871'. [ 383.727687][T14131] netlink: 12 bytes leftover after parsing attributes in process `syz.3.1871'. [ 383.727703][T14131] netlink: 8 bytes leftover after parsing attributes in process `syz.3.1871'. [ 383.732242][T14131] netlink: 16 bytes leftover after parsing attributes in process `syz.3.1871'. [ 383.732272][T14131] netlink: 164 bytes leftover after parsing attributes in process `syz.3.1871'. [ 383.862415][T14133] netlink: 8 bytes leftover after parsing attributes in process `syz.4.1873'. [ 383.963730][T14138] tc_dump_action: action bad kind [ 384.473439][T14152] netlink: 'syz.0.1877': attribute type 1 has an invalid length. [ 384.483498][T14152] netlink: 24 bytes leftover after parsing attributes in process `syz.0.1877'. [ 384.503546][T14149] netlink: 36 bytes leftover after parsing attributes in process `syz.3.1880'. [ 384.640875][T14162] --map-set only usable from mangle table [ 384.665813][T14165] netlink: 24 bytes leftover after parsing attributes in process `syz.4.1881'. [ 384.666639][T14163] netlink: 'syz.2.1884': attribute type 1 has an invalid length. [ 384.836844][T14171] bridge7: entered allmulticast mode [ 384.997496][T14185] netdevsim netdevsim4 netdevsim0: entered allmulticast mode [ 385.010912][T14185] A link change request failed with some changes committed already. Interface netdevsim0 may have been left with an inconsistent configuration, please check. [ 385.063605][T14185] netdevsim netdevsim4: Direct firmware load for failed with error -2 [ 385.076981][T14185] netdevsim netdevsim4: Falling back to sysfs fallback for: [ 385.307793][T14203] ip_tables: iptables: counters copy to user failed while replacing table [ 385.624719][T14217] netlink: 'syz.0.1895': attribute type 5 has an invalid length. [ 386.915440][T14266] netlink: 'syz.2.1907': attribute type 4 has an invalid length. [ 386.939227][T14266] netlink: 'syz.2.1907': attribute type 4 has an invalid length. [ 386.951241][ T25] lo speed is unknown, defaulting to 1000 [ 386.951290][ T25] syz_device_name_32_chars_1234567: Port: 1 Link ACTIVE [ 387.142070][T14273] netlink: 'syz.4.1908': attribute type 1 has an invalid length. [ 387.451724][T14290] IPVS: ip_vs_add_dest(): server weight less than zero [ 387.457756][T14292] IPVS: rr: UDP 127.0.0.1:10000 - no destination available [ 387.612563][T14297] tipc: Enabling of bearer rejected, failed to enable media [ 387.790299][T14302] A link change request failed with some changes committed already. Interface wlan0 may have been left with an inconsistent configuration, please check. [ 388.297920][T14333] Cannot find del_set index 17 as target [ 388.481933][ C0] vcan0: j1939_tp_rxtimer: 0xffff88802a8b0000: rx timeout, send abort [ 388.827495][T14353] tipc: Enabling of bearer rejected, already enabled [ 388.944652][T14363] __nla_validate_parse: 12 callbacks suppressed [ 388.944703][T14363] netlink: 28 bytes leftover after parsing attributes in process `syz.2.1932'. [ 388.982003][ C0] vcan0: j1939_tp_rxtimer: 0xffff88802a8b0000: abort rx timeout. Force session deactivation [ 388.984236][ C0] vcan0: j1939_tp_rxtimer: 0xffff88802a8b1c00: rx timeout, send abort [ 389.484283][ C0] vcan0: j1939_tp_rxtimer: 0xffff88802a8b1c00: abort rx timeout. Force session deactivation [ 389.924570][T14407] netlink: 4 bytes leftover after parsing attributes in process `syz.4.1939'. [ 390.326695][T14417] netlink: 4 bytes leftover after parsing attributes in process `syz.0.1942'. [ 390.470467][T14428] netlink: 28 bytes leftover after parsing attributes in process `syz.1.1946'. [ 390.480432][T14427] netlink: 28 bytes leftover after parsing attributes in process `syz.1.1946'. [ 390.521770][T14424] netlink: 4 bytes leftover after parsing attributes in process `syz.4.1944'. [ 390.533311][T14427] netlink: 'syz.1.1946': attribute type 1 has an invalid length. [ 390.547091][T14428] netlink: 'syz.1.1946': attribute type 1 has an invalid length. [ 390.774216][T14444] netlink: 16 bytes leftover after parsing attributes in process `syz.4.1948'. [ 390.793266][T14445] syzkaller0: entered promiscuous mode [ 390.793305][T14445] syzkaller0: entered allmulticast mode [ 390.848801][T14445] netlink: 36 bytes leftover after parsing attributes in process `syz.3.1949'. [ 390.870630][T14445] tipc: Enabled bearer , priority 0 [ 390.899854][T14442] tipc: Resetting bearer [ 390.968264][T14442] tipc: Disabling bearer [ 391.012295][T14461] netlink: 'syz.4.1953': attribute type 1 has an invalid length. [ 391.113979][T14461] 8021q: adding VLAN 0 to HW filter on device bond7 [ 391.239375][T14468] bond7: (slave veth9): Enslaving as an active interface with a down link [ 391.284874][T14461] 8021q: adding VLAN 0 to HW filter on device batadv1 [ 391.302776][T14461] bond7: (slave batadv1): making interface the new active one [ 391.317640][T14461] batadv1: entered promiscuous mode [ 391.323350][T14461] bond7: (slave batadv1): Enslaving as an active interface with an up link [ 391.443450][T14483] netlink: 'syz.3.1957': attribute type 7 has an invalid length. [ 391.453941][T14490] netlink: 'syz.3.1957': attribute type 7 has an invalid length. [ 392.492796][T14526] netlink: 24 bytes leftover after parsing attributes in process `syz.2.1962'. [ 392.507760][ T31] audit: type=1107 audit(1788313321.120:9): pid=14524 uid=0 auid=4294967295 ses=4294967295 subj=unconfined msg='zY0E?Cͧ'o(q$'b !T' ~fbH7i(f.<8$uXy1|Sl*wm$pI0bZBH*.wIGRqP{^Mn2&*p&T#N>_oJY8a1a{le?c)y&wUoV\Ƿ [ 392.507760][ T31] Ѷ-Dkŷ% [ 398.938525][T14784] tipc: Resetting bearer [ 399.367428][T14799] netlink: 12 bytes leftover after parsing attributes in process `syz.1.2027'. [ 399.461158][T14802] netlink: 12 bytes leftover after parsing attributes in process `syz.2.2028'. [ 399.889414][T14815] xt_CT: No such helper "snmp_trap" [ 399.918191][T14821] lo speed is unknown, defaulting to 1000 [ 399.952774][T14816] smbdirect: ib_dev[syz1]: added: RNIC max_fast_reg_page_list_len=256 device_cap_flags=0x200000 kernel_cap_flags=0x10 page_size_cap=0x1000 [ 399.952838][T14816] smbdirect: ib_dev[syz1]: num_ports=1 max_qp_rd_atom=128 max_qp_init_rd_atom=128 max_sgl_rd=0 max_sge_rd=1 max_cqe=3276800 max_qp_wr=32768 max_send_sge=6 max_recv_sge=6 [ 399.952871][T14816] smbdirect: ib_dev[syz1]PORT[1]: iwarp=1 ib=0 roce=0 v1=0 v2=0 core_cap_flags=0x400008 [ 400.026566][T14816] iwpm_register_pid: Unable to send a nlmsg (client = 2) [ 400.096168][T14836] netlink: 12 bytes leftover after parsing attributes in process `syz.3.2037'. [ 400.165008][T14816] infiniband syz1: RDMA CMA: cma_listen_on_dev, error -98 [ 400.273252][T14842] gretap0: entered promiscuous mode [ 400.280318][T14842] macsec1: entered allmulticast mode [ 400.280356][T14842] gretap0: entered allmulticast mode [ 400.304466][T14842] gretap0: left allmulticast mode [ 400.304513][T14842] gretap0: left promiscuous mode [ 401.164224][T14880] xt_CT: No such helper "snmp_trap" [ 401.196575][T14878] syz_tun: entered allmulticast mode [ 401.235739][T14877] syz_tun: left allmulticast mode [ 401.364503][T14891] af_packet: tpacket_rcv: packet too big, clamped from 52 to 4294967272. macoff=96 [ 401.390791][T14893] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 401.410007][T14896] netlink: 8 bytes leftover after parsing attributes in process `syz.0.2054'. [ 401.426384][T14896] xt_hashlimit: invalid rate [ 401.509237][T14890] netlink: 8 bytes leftover after parsing attributes in process `syz.2.2051'. [ 401.601500][T14903] netlink: 24 bytes leftover after parsing attributes in process `syz.2.2058'. [ 401.630205][T14903] vlan0: entered promiscuous mode [ 401.706901][T14906] netlink: 'syz.1.2057': attribute type 1 has an invalid length. [ 401.706936][T14906] netlink: 'syz.1.2057': attribute type 4 has an invalid length. [ 401.706961][T14906] netlink: 9462 bytes leftover after parsing attributes in process `syz.1.2057'. [ 401.721240][T14906] netlink: 'syz.1.2057': attribute type 1 has an invalid length. [ 401.721260][T14906] netlink: 'syz.1.2057': attribute type 4 has an invalid length. [ 401.721272][T14906] netlink: 9462 bytes leftover after parsing attributes in process `syz.1.2057'. [ 401.752028][T14914] netlink: 20 bytes leftover after parsing attributes in process `syz.2.2058'. [ 401.752059][T14914] netlink: 40 bytes leftover after parsing attributes in process `syz.2.2058'. [ 401.906785][T14917] ip6tnl2: entered allmulticast mode [ 401.911395][ T52] ip6_tunnel: ip6tnl2 xmit: Local address not yet configured! [ 401.911601][ T52] ip6_tunnel: ip6tnl2 xmit: Local address not yet configured! [ 401.937383][ T5744] ip6_tunnel: ip6tnl2 xmit: Local address not yet configured! [ 401.975778][T12842] ip6_tunnel: ip6tnl2 xmit: Local address not yet configured! [ 402.083162][T14930] tipc: Resetting bearer [ 402.122392][T14930] tipc: Disabling bearer [ 402.164366][T14934] netdevsim netdevsim4 netdevsim0: left allmulticast mode [ 402.203659][T14934] ip6tnl2: left allmulticast mode [ 402.248269][T14934] pim6reg1: entered promiscuous mode [ 402.254268][T14934] pim6reg1: entered allmulticast mode [ 402.409074][T14941] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 402.427756][T14928] sch_tbf: burst 88 is lower than device veth11 mtu (1514) ! [ 402.433161][T14941] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 403.014249][T14978] tipc: Failed to remove unknown binding: 66,0,0/952949736:4200927639/4200927640 [ 403.014707][T14979] tipc: Failed to remove unknown binding: 66,0,0/952949736:4200927639/4200927640 [ 403.468478][T15006] ip6t_srh: unknown srh match flags 4000 [ 403.566727][T15012] netlink: 'syz.2.2082': attribute type 1 has an invalid length. [ 404.297538][T15025] netdevsim netdevsim2 netdevsim0: entered allmulticast mode [ 404.371455][T15025] netlink: 'syz.2.2084': attribute type 29 has an invalid length. [ 404.479993][T15031] netlink: 'syz.1.2087': attribute type 4 has an invalid length. [ 404.714230][T15039] netlink: 'syz.2.2089': attribute type 6 has an invalid length. [ 404.983972][T15045] xt_time: unknown flags 0x4 [ 405.114970][T15052] 8021q: VLANs not supported on syzkaller0 [ 405.941904][T15081] bridge0: entered allmulticast mode [ 406.764332][T15106] netlink: 'syz.2.2104': attribute type 13 has an invalid length. [ 406.913861][T15111] __nla_validate_parse: 35 callbacks suppressed [ 406.920720][T15111] netlink: 12 bytes leftover after parsing attributes in process `syz.2.2106'. [ 406.923998][T15108] netlink: 8 bytes leftover after parsing attributes in process `syz.3.2105'. [ 407.018358][T15114] netlink: 'syz.4.2107': attribute type 2 has an invalid length. [ 407.026567][T15114] netlink: 40 bytes leftover after parsing attributes in process `syz.4.2107'. [ 407.042685][T15114] : entered promiscuous mode [ 407.132160][T15118] netlink: 28 bytes leftover after parsing attributes in process `syz.2.2108'. [ 407.225294][T15121] netlink: 'syz.2.2111': attribute type 4 has an invalid length. [ 407.234272][T15121] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 407.393716][T15132] netlink: 28 bytes leftover after parsing attributes in process `syz.0.2110'. [ 407.453021][T15126] ipvlan2: entered promiscuous mode [ 407.473916][T15126] team0: Device ipvlan2 failed to register rx_handler [ 407.505400][T15137] netlink: 'syz.3.2113': attribute type 1 has an invalid length. [ 407.613223][T15137] 8021q: adding VLAN 0 to HW filter on device bond10 [ 407.731261][T15141] bond10: (slave veth13): Enslaving as an active interface with a down link [ 407.836378][T15145] netlink: 36 bytes leftover after parsing attributes in process `syz.0.2114'. [ 408.099322][T15152] netlink: 12 bytes leftover after parsing attributes in process `syz.0.2117'. [ 408.423140][T15169] 8021q: adding VLAN 0 to HW filter on device bond0 [ 408.424944][T15169] 8021q: adding VLAN 0 to HW filter on device team0 [ 408.445034][T15169] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 408.453672][T15181] netlink: 28 bytes leftover after parsing attributes in process `syz.1.2121'. [ 408.491951][T15169] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 408.502056][T15169] batadv_slave_1: left promiscuous mode [ 408.502665][T15169] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 408.520267][T15183] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 408.538586][T15169] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 408.538614][T15169] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 408.562504][T15169] A link change request failed with some changes committed already. Interface virt_wifi0 may have been left with an inconsistent configuration, please check. [ 408.861655][T15194] tipc: Enabling of bearer rejected, failed to enable media [ 408.862357][T15194] netlink: 8 bytes leftover after parsing attributes in process `syz.2.2127'. [ 409.059076][T15211] netlink: 20 bytes leftover after parsing attributes in process `syz.4.2130'. [ 409.068916][T15211] openvswitch: netlink: Flow actions attr not present in new flow. [ 409.083394][T15209] bond_slave_0: Caught tx_queue_len zero misconfig [ 409.215753][ C0] ip6_tunnel: ip6gretap1 xmit: Local address not yet configured! [ 410.202978][T15266] netlink: 'syz.0.2143': attribute type 11 has an invalid length. [ 411.953998][T15330] 8021q: VLANs not supported on xfrm0 [ 412.092655][T15334] __nla_validate_parse: 3 callbacks suppressed [ 412.109919][T15334] netlink: 48 bytes leftover after parsing attributes in process `syz.0.2158'. [ 412.236637][T15337] netlink: 4 bytes leftover after parsing attributes in process `syz.1.2159'. [ 412.237337][T15337] netlink: 4 bytes leftover after parsing attributes in process `syz.1.2159'. [ 412.285102][T15337] IPVS: set_ctl: invalid protocol: 43 172.20.20.187:20001 [ 412.417888][T15340] netlink: 4 bytes leftover after parsing attributes in process `syz.1.2159'. [ 412.615245][T15346] ovs-s!!: entered promiscuous mode [ 412.630589][T15346] netlink: 393 bytes leftover after parsing attributes in process `syz.0.2162'. [ 413.235359][T15374] netlink: 'syz.4.2171': attribute type 11 has an invalid length. [ 413.244128][T15374] netlink: 68 bytes leftover after parsing attributes in process `syz.4.2171'. [ 413.256941][T15371] netlink: 20 bytes leftover after parsing attributes in process `syz.1.2169'. [ 413.270121][T15377] netlink: 68 bytes leftover after parsing attributes in process `syz.4.2171'. [ 413.280201][T15379] netlink: 'syz.4.2171': attribute type 11 has an invalid length. [ 413.323483][T15369] syzkaller0: entered promiscuous mode [ 413.323524][T15369] syzkaller0: entered allmulticast mode [ 413.350995][T15369] tipc: Enabled bearer , priority 0 [ 413.506727][T15390] netlink: 36 bytes leftover after parsing attributes in process `syz.1.2172'. [ 413.602180][T15384] tipc: Resetting bearer [ 413.713880][T15384] tipc: Disabling bearer [ 413.720086][T15400] netlink: 12 bytes leftover after parsing attributes in process `syz.1.2174'. [ 413.994783][T15417] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 414.239249][T15428] netlink: 'syz.2.2182': attribute type 2 has an invalid length. [ 415.118966][T15461] netlink: 'syz.4.2194': attribute type 19 has an invalid length. [ 415.119007][T15461] netlink: 'syz.4.2194': attribute type 20 has an invalid length. [ 415.172558][T15463] netlink: 'syz.4.2194': attribute type 19 has an invalid length. [ 415.172600][T15463] netlink: 'syz.4.2194': attribute type 20 has an invalid length. [ 415.242519][T15471] netlink: 'syz.0.2197': attribute type 1 has an invalid length. [ 415.281187][ T61] netdevsim netdevsim4 netdevsim0: set [0, 0] type 1 family 0 port 8472 - 0 [ 415.437358][ T61] netdevsim netdevsim1 eth2: set [0, 0] type 1 family 0 port 8472 - 0 [ 415.437436][ T61] netdevsim netdevsim1 eth1: set [0, 0] type 1 family 0 port 8472 - 0 [ 415.437464][ T61] netdevsim netdevsim1 eth0: set [0, 0] type 1 family 0 port 8472 - 0 [ 415.437492][ T61] netdevsim netdevsim4 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0 [ 415.437521][ T61] netdevsim netdevsim4 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0 [ 415.437551][ T61] netdevsim netdevsim4 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0 [ 415.437579][ T61] netdevsim netdevsim1 eth3: set [0, 0] type 1 family 0 port 8472 - 0 [ 415.642394][T15488] syzkaller0: entered promiscuous mode [ 415.642433][T15488] syzkaller0: entered allmulticast mode [ 415.962278][T15503] Freezing with imperfect legacy cgroup freezer. See cgroup.freeze of cgroup v2 [ 416.233605][T15519] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 416.262290][T15519] netlink: 'syz.4.2211': attribute type 4 has an invalid length. [ 416.302138][T15519] netlink: 'syz.4.2211': attribute type 4 has an invalid length. [ 416.451366][T15524] netlink: 'syz.2.2213': attribute type 1 has an invalid length. [ 417.432632][T15560] __nla_validate_parse: 25 callbacks suppressed [ 417.432699][T15560] netlink: 8 bytes leftover after parsing attributes in process `syz.2.2224'. [ 417.454815][T15560] netlink: 48 bytes leftover after parsing attributes in process `syz.2.2224'. [ 417.640835][T15565] netlink: 4 bytes leftover after parsing attributes in process `syz.1.2226'. [ 418.067936][T15592] netlink: 12 bytes leftover after parsing attributes in process `syz.2.2233'. [ 418.127152][T15592] netlink: 'syz.2.2233': attribute type 1 has an invalid length. [ 418.229557][T15592] netlink: 64 bytes leftover after parsing attributes in process `syz.2.2233'. [ 419.314704][T15646] netlink: 8 bytes leftover after parsing attributes in process `syz.1.2248'. [ 419.361692][T15653] netlink: 8 bytes leftover after parsing attributes in process `syz.3.2247'. [ 419.361746][T15653] netlink: 4 bytes leftover after parsing attributes in process `syz.3.2247'. [ 419.369399][T15648] netlink: 8 bytes leftover after parsing attributes in process `syz.3.2247'. [ 419.369428][T15648] netlink: 4 bytes leftover after parsing attributes in process `syz.3.2247'. [ 419.495809][ T1212] netdevsim netdevsim3 eth0: set [0, 0] type 1 family 0 port 4352 - 0 [ 419.495873][ T1212] netdevsim netdevsim3 eth1: set [0, 0] type 1 family 0 port 4352 - 0 [ 419.495920][ T1212] netdevsim netdevsim3 eth2: set [0, 0] type 1 family 0 port 4352 - 0 [ 419.495953][ T1212] netdevsim netdevsim3 eth3: set [0, 0] type 1 family 0 port 4352 - 0 [ 420.579634][T15708] sit2: entered promiscuous mode [ 421.069806][T15723] validate_nla: 1 callbacks suppressed [ 421.070179][T15723] netlink: 'syz.1.2266': attribute type 3 has an invalid length. [ 421.194856][T15718] mac80211_hwsim hwsim2 wlan0: left promiscuous mode [ 421.194902][T15718] mac80211_hwsim hwsim2 wlan0: left allmulticast mode [ 421.460316][T15726] lo speed is unknown, defaulting to 1000 [ 422.673551][ T8213] udevd[8213]: inotify_add_watch(7, /dev/nbd64, 10) failed: No such file or directory [ 422.886698][ T31] audit: type=1804 audit(1788313351.500:13): pid=15810 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=open_writers comm="syz.0.2282" name="/newroot/476/cgroup.controllers" dev="tmpfs" ino=2451 res=1 errno=0 [ 422.886763][ T31] audit: type=1800 audit(1788313351.500:14): pid=15810 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.0.2282" name="cgroup.controllers" dev="tmpfs" ino=2451 res=0 errno=0 [ 422.942424][ T31] audit: type=1804 audit(1788313351.560:15): pid=15815 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=ToMToU comm="syz.0.2282" name="/newroot/476/cgroup.controllers" dev="tmpfs" ino=2451 res=1 errno=0 [ 423.078739][T15794] A link change request failed with some changes committed already. Interface hsr_slave_0 may have been left with an inconsistent configuration, please check. [ 423.258708][T15827] __nla_validate_parse: 10 callbacks suppressed [ 423.268231][T15827] netlink: 8 bytes leftover after parsing attributes in process `syz.0.2285'. [ 423.279563][T15827] tipc: Invalid UDP bearer configuration [ 423.279626][T15827] tipc: Enabling of bearer rejected, failed to enable media [ 423.594254][T15830] bond9: Removing last arp target with arp_interval on [ 423.754787][T15851] netlink: 64 bytes leftover after parsing attributes in process `syz.0.2289'. [ 423.775865][T15858] netlink: 'syz.1.2291': attribute type 3 has an invalid length. [ 423.775909][T15858] netlink: 'syz.1.2291': attribute type 3 has an invalid length. [ 423.776635][T15858] netlink: 16 bytes leftover after parsing attributes in process `syz.1.2291'. [ 423.843892][T15848] syzkaller1: entered promiscuous mode [ 423.843941][T15848] syzkaller1: entered allmulticast mode [ 423.942592][T15861] netlink: 4 bytes leftover after parsing attributes in process `syz.2.2292'. [ 424.021801][T15866] netlink: 8 bytes leftover after parsing attributes in process `syz.2.2292'. [ 424.050344][T15861] hsr_slave_1 (unregistering): left promiscuous mode [ 424.127029][T15870] RDS: rds_bind could not find a transport for ::ffff:100.1.1.0, load rds_tcp or rds_rdma? [ 424.537695][T15898] netlink: 8 bytes leftover after parsing attributes in process `syz.4.2298'. [ 424.553482][T15893] netlink: 'syz.2.2299': attribute type 1 has an invalid length. [ 424.620644][T15905] netlink: 32 bytes leftover after parsing attributes in process `syz.2.2299'. [ 424.625582][T15896] netlink: 160 bytes leftover after parsing attributes in process `syz.1.2300'. [ 424.625675][T15896] netlink: 16 bytes leftover after parsing attributes in process `syz.1.2300'. [ 424.669539][T15904] tap0: tun_chr_ioctl cmd 1074025677 [ 424.669641][T15904] tap0: linktype set to 768 [ 425.750168][T15969] syzkaller0: entered promiscuous mode [ 425.750211][T15969] syzkaller0: entered allmulticast mode [ 425.808340][T15977] tipc: Enabled bearer , priority 0 [ 425.824681][T15924] tipc: Resetting bearer [ 425.957683][T15924] tipc: Disabling bearer [ 426.582151][ C1] vxcan1: j1939_tp_rxtimer: 0xffff88804cbc9800: rx timeout, send abort [ 427.082215][ C1] vxcan1: j1939_tp_rxtimer: 0xffff88804cbc9800: abort rx timeout. Force session deactivation [ 430.531220][T16070] netlink: 8 bytes leftover after parsing attributes in process `syz.0.2312'. [ 430.557878][T16138] netlink: 12 bytes leftover after parsing attributes in process `syz.4.2318'. [ 430.593180][T16136] netlink: 12 bytes leftover after parsing attributes in process `syz.4.2318'. [ 430.727239][T16162] netlink: 32 bytes leftover after parsing attributes in process `syz.3.2319'. [ 430.729624][T16162] netlink: 52 bytes leftover after parsing attributes in process `syz.3.2319'. [ 430.768866][T16169] netlink: 4 bytes leftover after parsing attributes in process `syz.2.2320'. [ 430.769060][T16169] netlink: 4 bytes leftover after parsing attributes in process `syz.2.2320'. [ 430.769225][T16169] netlink: 4 bytes leftover after parsing attributes in process `syz.2.2320'. [ 430.769375][T16169] netlink: 4 bytes leftover after parsing attributes in process `syz.2.2320'. [ 430.780426][T16169] netlink: 4 bytes leftover after parsing attributes in process `syz.2.2320'. [ 431.198750][T16191] netlink: 'syz.3.2325': attribute type 10 has an invalid length. [ 431.532032][T16202] bond0 (unregistering): Released all slaves [ 432.114504][T16207] erspan0: entered promiscuous mode [ 432.114688][T16207] vlan4: entered promiscuous mode [ 432.622229][T16261] netlink: 'syz.3.2335': attribute type 30 has an invalid length. [ 433.341238][T16296] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 434.157423][T16332] netlink: 'syz.4.2350': attribute type 1 has an invalid length. [ 434.157458][T16332] netlink: 'syz.4.2350': attribute type 2 has an invalid length. [ 434.385399][T16344] xt_TCPMSS: Only works on TCP SYN packets [ 434.478489][T16347] A link change request failed with some changes committed already. Interface hsr_slave_0 may have been left with an inconsistent configuration, please check. [ 434.629566][T16354] tipc: New replicast peer: 255.255.255.255 [ 434.655967][T16354] tipc: Enabled bearer , priority 10 [ 435.048624][T16382] ipip2: entered allmulticast mode [ 435.243836][T16393] batadv_slave_0: entered allmulticast mode [ 435.251704][T16393] A link change request failed with some changes committed already. Interface batadv_slave_0 may have been left with an inconsistent configuration, please check. [ 435.408535][T16397] xt_CT: No such helper "snmp_trap" [ 435.692346][T16407] workqueue: name exceeds WQ_NAME_LEN. Truncating to: 疽m%AAZI % [ 435.831420][T16404] sctp: [Deprecated]: syz.1.2369 (pid 16404) Use of int in maxseg socket option. [ 435.831420][T16404] Use struct sctp_assoc_value instead [ 436.272787][T16437] ip6gretap0: left promiscuous mode [ 436.301037][T16437] 8021q: adding VLAN 0 to HW filter on device team0 [ 436.313748][T16437] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 436.380279][T16437] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 436.394006][T16437] A link change request failed with some changes committed already. Interface virt_wifi0 may have been left with an inconsistent configuration, please check. [ 436.415430][T16445] __nla_validate_parse: 223 callbacks suppressed [ 436.415478][T16445] netlink: 4 bytes leftover after parsing attributes in process `syz.4.2374'. [ 436.472754][T16437] Bluetooth: MGMT ver 1.23 [ 436.796364][T16464] netlink: 4 bytes leftover after parsing attributes in process `syz.2.2377'. [ 436.964123][T16470] xt_CT: No such helper "snmp_trap" [ 437.264127][T16489] netlink: 16 bytes leftover after parsing attributes in process `syz.3.2386'. [ 437.323031][ T5280] veth1_vlan: left promiscuous mode [ 437.492471][T16491] xt_CT: No such helper "snmp_trap" [ 437.686149][T16500] netlink: 24 bytes leftover after parsing attributes in process `syz.3.2389'. [ 437.782305][T16502] netlink: 'syz.2.2388': attribute type 1 has an invalid length. [ 437.864131][T16502] 8021q: adding VLAN 0 to HW filter on device bond6 [ 437.935087][T16511] bond6: (slave veth7): Enslaving as an active interface with a down link [ 438.304497][T16520] netlink: 8 bytes leftover after parsing attributes in process `syz.4.2391'. [ 438.675266][T16535] netlink: 8 bytes leftover after parsing attributes in process `syz.3.2396'. [ 438.869993][T16548] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 438.873596][T16537] xt_CT: No such helper "snmp_trap" [ 439.127159][T16555] bond9: option ad_user_port_key: invalid value (65535) [ 439.134357][T16555] bond9: option ad_user_port_key: allowed values 0 - 1023 [ 439.149499][T16555] bond9 (unregistering): Released all slaves [ 439.284268][T16555] netlink: 24 bytes leftover after parsing attributes in process `syz.4.2401'. [ 439.406648][T16570] netlink: 12 bytes leftover after parsing attributes in process `syz.1.2407'. [ 439.524243][T16572] sch_tbf: burst 0 is lower than device syzkaller0 mtu (1514) ! [ 439.541178][T16572] syzkaller0: entered promiscuous mode [ 439.541223][T16572] syzkaller0: entered allmulticast mode [ 439.732643][T16583] netdevsim netdevsim0: Direct firmware load for . failed with error -2 [ 439.732701][T16583] netdevsim netdevsim0: Falling back to sysfs fallback for: . [ 439.743533][T16591] netlink: 'syz.2.2411': attribute type 1 has an invalid length. [ 439.766580][T16586] xt_CT: No such helper "snmp_trap" [ 440.103735][T16613] netlink: 'syz.4.2418': attribute type 1 has an invalid length. [ 440.123085][T16600] syzkaller0: entered promiscuous mode [ 440.123128][T16600] syzkaller0: entered allmulticast mode [ ** replaying previous printk message ** [ 440.205202][ C1] ================================================================== [ 440.205225][ C1] BUG: KASAN: use-after-free in qdisc_pkt_len_segs_init+0x7f7/0xa30 [ 440.205257][ C1] Read of size 2 at addr ffff88817e65d0b4 by task syz.3.2417/16614 [ 440.205276][ C1] [ 440.205291][ C1] CPU: 1 UID: 0 PID: 16614 Comm: syz.3.2417 Not tainted syzkaller #0 PREEMPT(full) [ 440.205315][ C1] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 440.205332][ C1] Call Trace: [ 440.205343][ C1] [ 440.205351][ C1] dump_stack_lvl+0xe8/0x150 [ 440.205386][ C1] print_address_description+0x55/0x1e0 [ 440.205414][ C1] ? qdisc_pkt_len_segs_init+0x7f7/0xa30 [ 440.205434][ C1] print_report+0x58/0x70 [ 440.205458][ C1] kasan_report+0x117/0x150 [ 440.205480][ C1] ? skb_clone+0x212/0x3a0 [ 440.205500][ C1] ? qdisc_pkt_len_segs_init+0x7f7/0xa30 [ 440.205530][ C1] qdisc_pkt_len_segs_init+0x7f7/0xa30 [ 440.205558][ C1] __dev_queue_xmit+0x27f/0x3820 [ 440.205578][ C1] ? do_softirq+0x77/0xd0 [ 440.205604][ C1] ? __local_bh_enable_ip+0x100/0x140 [ 440.205629][ C1] ? vfs_write+0x612/0xba0 [ 440.205659][ C1] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 440.205692][ C1] ? __pfx___dev_queue_xmit+0x10/0x10 [ 440.205720][ C1] ? __copy_skb_header+0xa3/0x4a0 [ 440.205742][ C1] ? __asan_memcpy+0x40/0x70 [ 440.205774][ C1] ? __skb_clone+0x5c/0x6c0 [ 440.205796][ C1] ? __skb_clone+0x449/0x6c0 [ 440.205820][ C1] ? skb_clone+0x246/0x3a0 [ 440.205839][ C1] ? prp_get_untagged_frame+0x45/0x1d0 [ 440.205867][ C1] hsr_forward_skb+0x1701/0x2b70 [ 440.205897][ C1] ? hsr_forward_skb+0xb9/0x2b70 [ 440.205922][ C1] ? lock_acquire+0x115/0x350 [ 440.205943][ C1] ? hsr_addr_is_self+0x26/0x3e0 [ 440.205974][ C1] ? __pfx_hsr_forward_skb+0x10/0x10 [ 440.206002][ C1] ? hsr_addr_is_self+0x26/0x3e0 [ 440.206033][ C1] ? hsr_addr_is_self+0x26/0x3e0 [ 440.206064][ C1] ? hsr_addr_is_self+0x26/0x3e0 [ 440.206096][ C1] ? hsr_addr_is_self+0x2e2/0x3e0 [ 440.206127][ C1] ? hsr_addr_is_self+0x26/0x3e0 [ 440.206160][ C1] hsr_handle_frame+0x6ba/0xa50 [ 440.206195][ C1] ? __pfx_hsr_handle_frame+0x10/0x10 [ 440.206218][ C1] __netif_receive_skb_core+0x989/0x30c0 [ 440.206252][ C1] ? lock_acquire+0x115/0x350 [ 440.206275][ C1] ? __pfx___netif_receive_skb_core+0x10/0x10 [ 440.206302][ C1] ? lock_acquire+0x115/0x350 [ 440.206339][ C1] __netif_receive_skb_list_core+0x24d/0x830 [ 440.206374][ C1] ? __pfx___netif_receive_skb_list_core+0x10/0x10 [ 440.206409][ C1] netif_receive_skb_list_internal+0x995/0xcf0 [ 440.206440][ C1] ? netif_receive_skb_list_internal+0x501/0xcf0 [ 440.206468][ C1] ? __pfx_netif_receive_skb_list_internal+0x10/0x10 [ 440.206497][ C1] ? dev_gro_receive+0x1097/0x2380 [ 440.206535][ C1] napi_complete_done+0x299/0x730 [ 440.206566][ C1] ? __pfx_napi_complete_done+0x10/0x10 [ 440.206594][ C1] ? gro_cell_poll+0x18a/0x630 [ 440.206628][ C1] gro_cell_poll+0x5ff/0x630 [ 440.206663][ C1] ? gro_cell_poll+0x18a/0x630 [ 440.206694][ C1] __napi_poll+0xaa/0x330 [ 440.206722][ C1] net_rx_action+0x61d/0xf50 [ 440.206758][ C1] ? __pfx_net_rx_action+0x10/0x10 [ 440.206786][ C1] ? kvm_sched_clock_read+0x11/0x20 [ 440.206818][ C1] ? __pfx_sched_clock_cpu+0x10/0x10 [ 440.206838][ C1] ? kvm_sched_clock_read+0x11/0x20 [ 440.206864][ C1] ? sched_clock+0x41/0x60 [ 440.206900][ C1] handle_softirqs+0x226/0x860 [ 440.206930][ C1] ? do_softirq+0x77/0xd0 [ 440.206958][ C1] ? tun_rx_batched+0x185/0x790 [ 440.206988][ C1] do_softirq+0x77/0xd0 [ 440.207015][ C1] [ 440.207022][ C1] [ 440.207030][ C1] __local_bh_enable_ip+0x100/0x140 [ 440.207058][ C1] ? tun_rx_batched+0x185/0x790 [ 440.207087][ C1] tun_rx_batched+0x616/0x790 [ 440.207119][ C1] ? __pfx_tun_rx_batched+0x10/0x10 [ 440.207150][ C1] ? lock_acquire+0x115/0x350 [ 440.207179][ C1] ? tun_get_user+0x23ba/0x44d0 [ 440.207207][ C1] ? __local_bh_enable_ip+0xd6/0x140 [ 440.207238][ C1] ? tun_get_user+0x27b0/0x44d0 [ 440.207267][ C1] tun_get_user+0x2be0/0x44d0 [ 440.207303][ C1] ? tun_get_user+0x27b0/0x44d0 [ 440.207331][ C1] ? aa_file_perm+0x18b/0x15f0 [ 440.207356][ C1] ? aa_file_perm+0x4ed/0x15f0 [ 440.207377][ C1] ? __pfx_tun_get_user+0x10/0x10 [ 440.207408][ C1] ? __lock_acquire+0x6df/0x2e50 [ 440.207430][ C1] ? __pfx___futex_wait+0x10/0x10 [ 440.207472][ C1] ? ref_tracker_alloc+0x341/0x4b0 [ 440.207509][ C1] ? __pfx_ref_tracker_alloc+0x10/0x10 [ 440.207542][ C1] ? lock_acquire+0x115/0x350 [ 440.207562][ C1] ? tun_get+0x1c/0x2f0 [ 440.207595][ C1] ? tun_get+0x1c/0x2f0 [ 440.207621][ C1] ? tun_get+0x1c/0x2f0 [ 440.207646][ C1] tun_chr_write_iter+0x113/0x200 [ 440.207676][ C1] vfs_write+0x612/0xba0 [ 440.207710][ C1] ? __pfx_vfs_write+0x10/0x10 [ 440.207745][ C1] ? __fget_files+0x2a/0x420 [ 440.207778][ C1] ksys_write+0x150/0x270 [ 440.207809][ C1] ? __pfx_ksys_write+0x10/0x10 [ 440.207845][ C1] do_syscall_64+0x166/0x520 [ 440.207873][ C1] ? trace_irq_disable+0x3b/0x140 [ 440.207894][ C1] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 440.207916][ C1] ? clear_bhb_loop+0x70/0xc0 [ 440.207941][ C1] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 440.207962][ C1] RIP: 0033:0x7f23f0d9e159 [ 440.207983][ C1] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 440.208003][ C1] RSP: 002b:00007f23f1be8028 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 440.208028][ C1] RAX: ffffffffffffffda RBX: 00007f23f1026090 RCX: 00007f23f0d9e159 [ 440.208045][ C1] RDX: 000000000000007a RSI: 00002000000004c0 RDI: 0000000000000003 [ 440.208060][ C1] RBP: 00007f23f0e35024 R08: 0000000000000000 R09: 0000000000000000 [ 440.208074][ C1] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 440.208087][ C1] R13: 00007f23f1026128 R14: 00007f23f1026090 R15: 00007ffe093aa968 [ 440.208113][ C1] [ 440.208121][ C1] [ 440.208126][ C1] The buggy address belongs to the physical page: [ 440.208148][ C1] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x17e65d [ 440.208174][ C1] flags: 0x57ff00000000000(node=1|zone=2|lastcpupid=0x7ff) [ 440.208209][ C1] raw: 057ff00000000000 ffffea0005f99748 ffffea0005f99748 0000000000000000 [ 440.208228][ C1] raw: 0000000000000000 0000000000000000 00000000ffffffff 0000000000000000 [ 440.208239][ C1] page dumped because: kasan: bad access detected [ 440.208263][ C1] page_owner info is not present (never set?) [ 440.208271][ C1] [ 440.208276][ C1] Memory state around the buggy address: [ 440.208287][ C1] ffff88817e65cf80: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 440.208302][ C1] ffff88817e65d000: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 440.208316][ C1] >ffff88817e65d080: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 440.208327][ C1] ^ [ 440.208340][ C1] ffff88817e65d100: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 440.208354][ C1] ffff88817e65d180: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 440.208365][ C1] ================================================================== [ 440.208463][ C1] Kernel panic - not syncing: KASAN: panic_on_warn set ... [ 440.915893][ C1] CPU: 1 UID: 0 PID: 16614 Comm: syz.3.2417 Not tainted syzkaller #0 PREEMPT(full) [ 440.925254][ C1] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 440.935346][ C1] Call Trace: [ 440.938627][ C1] [ 440.941470][ C1] vpanic+0x56d/0xa60 [ 440.945454][ C1] ? rcu_is_watching+0x16/0xb0 [ 440.950415][ C1] ? __pfx_vpanic+0x10/0x10 [ 440.954927][ C1] panic+0xc5/0xd0 [ 440.958652][ C1] ? __pfx_panic+0x10/0x10 [ 440.963071][ C1] ? qdisc_pkt_len_segs_init+0x7f7/0xa30 [ 440.968707][ C1] ? qdisc_pkt_len_segs_init+0x7f7/0xa30 [ 440.974337][ C1] check_panic_on_warn+0x89/0xb0 [ 440.979264][ C1] ? qdisc_pkt_len_segs_init+0x7f7/0xa30 [ 440.984889][ C1] end_report+0x73/0x170 [ 440.989123][ C1] ? qdisc_pkt_len_segs_init+0x7f7/0xa30 [ 440.994747][ C1] kasan_report+0x128/0x150 [ 440.999239][ C1] ? skb_clone+0x212/0x3a0 [ 441.003644][ C1] ? qdisc_pkt_len_segs_init+0x7f7/0xa30 [ 441.009269][ C1] qdisc_pkt_len_segs_init+0x7f7/0xa30 [ 441.014721][ C1] __dev_queue_xmit+0x27f/0x3820 [ 441.019645][ C1] ? do_softirq+0x77/0xd0 [ 441.023973][ C1] ? __local_bh_enable_ip+0x100/0x140 [ 441.029347][ C1] ? vfs_write+0x612/0xba0 [ 441.033775][ C1] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 441.039839][ C1] ? __pfx___dev_queue_xmit+0x10/0x10 [ 441.045208][ C1] ? __copy_skb_header+0xa3/0x4a0 [ 441.050217][ C1] ? __asan_memcpy+0x40/0x70 [ 441.054801][ C1] ? __skb_clone+0x5c/0x6c0 [ 441.059287][ C1] ? __skb_clone+0x449/0x6c0 [ 441.063875][ C1] ? skb_clone+0x246/0x3a0 [ 441.068295][ C1] ? prp_get_untagged_frame+0x45/0x1d0 [ 441.073757][ C1] hsr_forward_skb+0x1701/0x2b70 [ 441.078721][ C1] ? hsr_forward_skb+0xb9/0x2b70 [ 441.083655][ C1] ? lock_acquire+0x115/0x350 [ 441.088329][ C1] ? hsr_addr_is_self+0x26/0x3e0 [ 441.093269][ C1] ? __pfx_hsr_forward_skb+0x10/0x10 [ 441.098551][ C1] ? hsr_addr_is_self+0x26/0x3e0 [ 441.103487][ C1] ? hsr_addr_is_self+0x26/0x3e0 [ 441.108426][ C1] ? hsr_addr_is_self+0x26/0x3e0 [ 441.113359][ C1] ? hsr_addr_is_self+0x2e2/0x3e0 [ 441.118379][ C1] ? hsr_addr_is_self+0x26/0x3e0 [ 441.123315][ C1] hsr_handle_frame+0x6ba/0xa50 [ 441.128162][ C1] ? __pfx_hsr_handle_frame+0x10/0x10 [ 441.133522][ C1] __netif_receive_skb_core+0x989/0x30c0 [ 441.139159][ C1] ? lock_acquire+0x115/0x350 [ 441.143827][ C1] ? __pfx___netif_receive_skb_core+0x10/0x10 [ 441.149889][ C1] ? lock_acquire+0x115/0x350 [ 441.154577][ C1] __netif_receive_skb_list_core+0x24d/0x830 [ 441.160553][ C1] ? __pfx___netif_receive_skb_list_core+0x10/0x10 [ 441.167052][ C1] netif_receive_skb_list_internal+0x995/0xcf0 [ 441.173198][ C1] ? netif_receive_skb_list_internal+0x501/0xcf0 [ 441.179518][ C1] ? __pfx_netif_receive_skb_list_internal+0x10/0x10 [ 441.186194][ C1] ? dev_gro_receive+0x1097/0x2380 [ 441.191306][ C1] napi_complete_done+0x299/0x730 [ 441.196326][ C1] ? __pfx_napi_complete_done+0x10/0x10 [ 441.201862][ C1] ? gro_cell_poll+0x18a/0x630 [ 441.206619][ C1] gro_cell_poll+0x5ff/0x630 [ 441.211205][ C1] ? gro_cell_poll+0x18a/0x630 [ 441.215962][ C1] __napi_poll+0xaa/0x330 [ 441.220287][ C1] net_rx_action+0x61d/0xf50 [ 441.224875][ C1] ? __pfx_net_rx_action+0x10/0x10 [ 441.229978][ C1] ? kvm_sched_clock_read+0x11/0x20 [ 441.235169][ C1] ? __pfx_sched_clock_cpu+0x10/0x10 [ 441.240439][ C1] ? kvm_sched_clock_read+0x11/0x20 [ 441.245635][ C1] ? sched_clock+0x41/0x60 [ 441.250055][ C1] handle_softirqs+0x226/0x860 [ 441.254815][ C1] ? do_softirq+0x77/0xd0 [ 441.259135][ C1] ? tun_rx_batched+0x185/0x790 [ 441.263981][ C1] do_softirq+0x77/0xd0 [ 441.268131][ C1] [ 441.271048][ C1] [ 441.273963][ C1] __local_bh_enable_ip+0x100/0x140 [ 441.279155][ C1] ? tun_rx_batched+0x185/0x790 [ 441.284011][ C1] tun_rx_batched+0x616/0x790 [ 441.288693][ C1] ? __pfx_tun_rx_batched+0x10/0x10 [ 441.293887][ C1] ? lock_acquire+0x115/0x350 [ 441.298551][ C1] ? tun_get_user+0x23ba/0x44d0 [ 441.303393][ C1] ? __local_bh_enable_ip+0xd6/0x140 [ 441.308677][ C1] ? tun_get_user+0x27b0/0x44d0 [ 441.313526][ C1] tun_get_user+0x2be0/0x44d0 [ 441.318210][ C1] ? tun_get_user+0x27b0/0x44d0 [ 441.323053][ C1] ? aa_file_perm+0x18b/0x15f0 [ 441.327805][ C1] ? aa_file_perm+0x4ed/0x15f0 [ 441.332556][ C1] ? __pfx_tun_get_user+0x10/0x10 [ 441.337746][ C1] ? __lock_acquire+0x6df/0x2e50 [ 441.342673][ C1] ? __pfx___futex_wait+0x10/0x10 [ 441.347693][ C1] ? ref_tracker_alloc+0x341/0x4b0 [ 441.352806][ C1] ? __pfx_ref_tracker_alloc+0x10/0x10 [ 441.358345][ C1] ? lock_acquire+0x115/0x350 [ 441.363022][ C1] ? tun_get+0x1c/0x2f0 [ 441.367174][ C1] ? tun_get+0x1c/0x2f0 [ 441.371319][ C1] ? tun_get+0x1c/0x2f0 [ 441.375464][ C1] tun_chr_write_iter+0x113/0x200 [ 441.380485][ C1] vfs_write+0x612/0xba0 [ 441.384731][ C1] ? __pfx_vfs_write+0x10/0x10 [ 441.389575][ C1] ? __fget_files+0x2a/0x420 [ 441.394164][ C1] ksys_write+0x150/0x270 [ 441.398486][ C1] ? __pfx_ksys_write+0x10/0x10 [ 441.403336][ C1] do_syscall_64+0x166/0x520 [ 441.407918][ C1] ? trace_irq_disable+0x3b/0x140 [ 441.412925][ C1] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 441.418979][ C1] ? clear_bhb_loop+0x70/0xc0 [ 441.423651][ C1] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 441.429530][ C1] RIP: 0033:0x7f23f0d9e159 [ 441.433940][ C1] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 441.453532][ C1] RSP: 002b:00007f23f1be8028 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 441.461942][ C1] RAX: ffffffffffffffda RBX: 00007f23f1026090 RCX: 00007f23f0d9e159 [ 441.469905][ C1] RDX: 000000000000007a RSI: 00002000000004c0 RDI: 0000000000000003 [ 441.477865][ C1] RBP: 00007f23f0e35024 R08: 0000000000000000 R09: 0000000000000000 [ 441.485825][ C1] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 441.493795][ C1] R13: 00007f23f1026128 R14: 00007f23f1026090 R15: 00007ffe093aa968 [ 441.501760][ C1] [ 441.505037][ C1] Kernel Offset: disabled [ 441.509351][ C1] Rebooting in 86400 seconds..