last executing test programs: 3.159087161s ago: executing program 1 (id=6526): r0 = socket$inet6(0xa, 0x3, 0x5) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) (async) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r2, &(0x7f0000000140)={0xa, 0x4e22}, 0x1c) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) sendto$inet6(r2, 0x0, 0x0, 0x24040000, &(0x7f00000002c0)={0xa, 0x4e24, 0x2, @remote, 0x71af}, 0x1c) socket$netlink(0x10, 0x3, 0x0) (async) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x5) close(0x4) (async) syz_open_procfs$namespace(0x0, &(0x7f0000000000)='ns/cgroup\x00') (async) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f07ebbeef, 0x8031, 0xffffffffffffffff, 0x215eb000) r4 = socket$inet6_sctp(0xa, 0x1, 0x84) (async) r5 = socket(0x8, 0x4, 0x3) (async) r6 = socket$kcm(0x2, 0x1, 0x84) setsockopt$sock_attach_bpf(r6, 0x84, 0x24, &(0x7f0000000000), 0x4) ioctl$XFS_IOC_PATH_TO_HANDLE(r5, 0x40106183, &(0x7f0000000280)={r4, 0x0, 0x80000, 0x0, 0x0, 0x0, 0x0}) (async) setsockopt$inet6_int(r3, 0x29, 0x4b, &(0x7f0000000100)=0x401, 0x4) bind$inet6(r3, &(0x7f0000000140)={0xa, 0x4e22, 0x3, @local, 0x6}, 0x1c) (async) setsockopt$IP6T_SO_SET_ADD_COUNTERS(r1, 0x29, 0x41, &(0x7f0000000340)={'filter\x00', 0x5, [{}, {}, {}, {}, {}]}, 0x78) (async) ioctl$F2FS_IOC_GET_PIN_FILE(r1, 0x8004f50e, &(0x7f0000000000)) (async) sendmmsg(r0, &(0x7f0000001500)=[{{&(0x7f0000000180)=@l2tp6={0xa, 0x500, 0x7fff, @remote, 0x0, 0x3}, 0x80, 0x0}, 0x5b4}, {{&(0x7f0000000040)=@pppol2tpv3in6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x1, 0x4, 0x1, {0xa, 0x4e24, 0x14a, @remote, 0xffffff48}}}, 0x80, 0x0, 0x0, &(0x7f0000000380)=ANY=[], 0x18}}], 0x2, 0x0) 2.808860578s ago: executing program 4 (id=6532): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$NL80211_CMD_SET_REG(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000280)=ANY=[@ANYBLOB='X\x00\x00\x00', @ANYRES16=r1, @ANYBLOB="010000000000000000001a000000070021006161000005009200000000003400228004000080"], 0x58}}, 0x0) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000a00), 0xffffffffffffffff) r4 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r4, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000200)=ANY=[@ANYBLOB="140000003b000100000019831ab3fa4312"], 0x14}, 0x1, 0x0, 0x0, 0x4008}, 0x40000) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000480)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_GET_WIPHY(r0, &(0x7f00000001c0)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x400}, 0xc, &(0x7f0000000140)={&(0x7f0000000100)={0x24, r1, 0x100, 0x70bd29, 0x25dfdbfd, {{}, {@val={0x8, 0x1, 0x2a}, @val={0x8, 0x3, r5}, @void}}, ["", "", "", ""]}, 0x24}, 0x1, 0x0, 0x0, 0x48004}, 0x0) sendmsg$NL80211_CMD_SET_WIPHY(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000300)={0x24, r3, 0x200, 0x470bd2d, 0x25dfdbfc, {}, [@NL80211_ATTR_WIPHY_RETRY_SHORT={0x5, 0x3d, 0x2}, @NL80211_ATTR_TXQ_LIMIT={0x8}]}, 0x24}, 0x1, 0x0, 0x0, 0x40488d1}, 0x24044080) sendmsg$NL80211_CMD_SET_COALESCE(r2, &(0x7f0000000200)={0x0, 0xffffffffffffff8c, &(0x7f0000000b00)={&(0x7f0000000040)={0x28, r3, 0x1, 0x0, 0x0, {{0x2}, {@val={0x8, 0x3, r5}, @void}}}, 0x28}}, 0x0) 2.594746078s ago: executing program 3 (id=6535): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$NL80211_CMD_SET_MCAST_RATE(r0, &(0x7f0000000140)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x8000}, 0xc, &(0x7f0000000100)={&(0x7f0000000080)={0x50, r1, 0x1, 0x70bd29, 0x25dfdbfc, {{}, {@void, @val={0xc, 0x99, {0x7, 0x1a}}}}, [@NL80211_ATTR_MCAST_RATE={0x8, 0x6b, 0x14}, @NL80211_ATTR_MCAST_RATE={0x8, 0x6b, 0xf0}, @NL80211_ATTR_MCAST_RATE={0x8, 0x6b, 0x21c}, @NL80211_ATTR_MCAST_RATE={0x8, 0x6b, 0x168}, @NL80211_ATTR_MCAST_RATE={0x8, 0x6b, 0xb4}, @NL80211_ATTR_MCAST_RATE={0x8, 0x6b, 0x14}]}, 0x50}, 0x1, 0x0, 0x0, 0x40040d4}, 0x4) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f00000001c0)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_TDLS_CANCEL_CHANNEL_SWITCH(r0, &(0x7f00000002c0)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x40000}, 0xc, &(0x7f0000000280)={&(0x7f0000000200)={0x58, r1, 0x100, 0x70bd25, 0x25dfdbff, {{}, {@val={0x8, 0x3, r2}, @val={0xc, 0x99, {0x2, 0x3d}}}}, [@NL80211_ATTR_MAC={0xa, 0x6, @broadcast}, @NL80211_ATTR_MAC={0xa, 0x6, @device_b}, @NL80211_ATTR_MAC={0xa, 0x6, @device_b}, @NL80211_ATTR_MAC={0xa, 0x6, @broadcast}]}, 0x58}, 0x1, 0x0, 0x0, 0x8011}, 0x24000040) sendmsg$NL80211_CMD_DEL_INTERFACE(r0, &(0x7f00000003c0)={&(0x7f0000000300)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000000380)={&(0x7f0000000340)={0x1c, r1, 0x2, 0x70bd28, 0x25dfdbff, {{}, {@val={0x8, 0x3, r2}, @void}}, [""]}, 0x1c}, 0x1, 0x0, 0x0, 0x40000}, 0x24000851) sendmsg$NL80211_CMD_GET_WIPHY(r0, &(0x7f00000004c0)={&(0x7f0000000400)={0x10, 0x0, 0x0, 0x40000000}, 0xc, &(0x7f0000000480)={&(0x7f0000000440)={0x14, r1, 0x400, 0x70bd28, 0x25dfdbfb, {{}, {@void, @void, @void}}, ["", ""]}, 0x14}, 0x1, 0x0, 0x0, 0x4000}, 0x20008016) r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NFC_CMD_DEV_DOWN(r3, &(0x7f00000005c0)={&(0x7f0000000500)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000580)={&(0x7f0000000540)={0x1c, 0x0, 0x1, 0x70bd26, 0x25dfdbfd, {}, [@NFC_ATTR_DEVICE_INDEX={0x8}]}, 0x1c}, 0x1, 0x0, 0x0, 0x8000}, 0x4004) r4 = accept$nfc_llcp(0xffffffffffffffff, &(0x7f0000000600), &(0x7f0000000680)=0x60) ioctl$IOCTL_GET_NCIDEV_IDX(0xffffffffffffffff, 0x0, &(0x7f00000006c0)=0x0) bind$nfc_llcp(r4, &(0x7f0000000700)={0x27, r5, 0x1, 0x3, 0x9, 0x7, "bdd7067de5bb51da2181f2e9a67c3d9c8a8ddde415606e78ae66edf88e3882f3a09a36d7d6c86c61aaabf95f924211325aed89fb43a8c25210f2eb62253d22", 0x1}, 0x60) ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f0000000780)={'wg1\x00'}) r6 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000800), r0) sendmsg$TIPC_NL_LINK_GET(r0, &(0x7f0000000940)={&(0x7f00000007c0)={0x10, 0x0, 0x0, 0x8000}, 0xc, &(0x7f0000000900)={&(0x7f0000000840)={0x94, r6, 0x2, 0x70bd25, 0x25dfdbfc, {}, [@TIPC_NLA_BEARER={0x10, 0x1, 0x0, 0x1, [@TIPC_NLA_BEARER_PROP={0x4}, @TIPC_NLA_BEARER_DOMAIN={0x8, 0x3, 0x9}]}, @TIPC_NLA_MON={0x4c, 0x9, 0x0, 0x1, [@TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8, 0x1, 0x11e5a141}, @TIPC_NLA_MON_REF={0x8, 0x2, 0x9}, @TIPC_NLA_MON_REF={0x8, 0x2, 0xc}, @TIPC_NLA_MON_REF={0x8, 0x2, 0x401}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8}, @TIPC_NLA_MON_REF={0x8, 0x2, 0x6}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8, 0x1, 0x63}, @TIPC_NLA_MON_REF={0x8, 0x2, 0x4}, @TIPC_NLA_MON_REF={0x8, 0x2, 0x1369}]}, @TIPC_NLA_PUBL={0x24, 0x3, 0x0, 0x1, [@TIPC_NLA_PUBL_LOWER={0x8, 0x2, 0x1}, @TIPC_NLA_PUBL_UPPER={0x8, 0x3, 0x9}, @TIPC_NLA_PUBL_UPPER={0x8, 0x3, 0x100}, @TIPC_NLA_PUBL_TYPE={0x8, 0x1, 0x6}]}]}, 0x94}, 0x1, 0x0, 0x0, 0x40011}, 0x4000000) pselect6(0x40, &(0x7f0000000980)={0x37e, 0x3, 0x3, 0x401, 0x6, 0x62e, 0x2, 0xc}, &(0x7f00000009c0)={0x5, 0x6, 0xfffffffffffffff7, 0x9dd, 0xd, 0x9, 0x200, 0x1ff}, &(0x7f0000000a00)={0x3, 0x4, 0x8000, 0x4, 0x3, 0x4, 0xfffffffffffff27e, 0x400}, &(0x7f0000000a40)={0x0, 0x3938700}, &(0x7f0000000ac0)={&(0x7f0000000a80)={[0x8]}, 0x8}) sendmsg$NL80211_CMD_SET_KEY(r0, &(0x7f0000000c00)={&(0x7f0000000b00), 0xc, &(0x7f0000000bc0)={&(0x7f0000000b40)={0x44, r1, 0x400, 0x70bd2c, 0x25dfdbfe, {{}, {@void, @void}}, [@NL80211_ATTR_KEY_IDX={0x5, 0x8, 0x5}, @NL80211_ATTR_KEY_TYPE={0x8, 0x37, 0x2}, @NL80211_ATTR_KEY_TYPE={0x8, 0x37, 0x1}, @NL80211_ATTR_KEY={0x10, 0x50, 0x0, 0x1, [@NL80211_KEY_DATA_WEP40={0x9, 0x1, "1c2f6556b2"}]}, @NL80211_ATTR_KEY_CIPHER={0x8, 0x9, 0xfac01}]}, 0x44}, 0x1, 0x0, 0x0, 0x60000080}, 0x5) r7 = socket$inet6_sctp(0xa, 0x1, 0x84) getsockopt$IP6T_SO_GET_INFO(r7, 0x29, 0x40, &(0x7f0000000c40)={'security\x00', 0x0, [0x3, 0x5, 0x7, 0xfff]}, &(0x7f0000000cc0)=0x54) r8 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000d40), r0) sendmsg$NL80211_CMD_SET_MULTICAST_TO_UNICAST(r0, &(0x7f0000000e00)={&(0x7f0000000d00)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f0000000dc0)={&(0x7f0000000d80)={0x30, r8, 0x300, 0x70bd25, 0x25dfdbfb, {{}, {@void, @val={0xc, 0x99, {0x7, 0x14}}}}, [@NL80211_ATTR_MULTICAST_TO_UNICAST_ENABLED={0x4}, @NL80211_ATTR_MULTICAST_TO_UNICAST_ENABLED={0x4}, @NL80211_ATTR_MULTICAST_TO_UNICAST_ENABLED={0x4}, @NL80211_ATTR_MULTICAST_TO_UNICAST_ENABLED={0x4}]}, 0x30}, 0x1, 0x0, 0x0, 0xc010}, 0x10000080) syz_genetlink_get_family_id$mptcp(&(0x7f0000000e40), r0) r9 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000ec0), r0) sendmsg$NL80211_CMD_SET_KEY(r0, &(0x7f0000000fc0)={&(0x7f0000000e80)={0x10, 0x0, 0x0, 0x20000000}, 0xc, &(0x7f0000000f80)={&(0x7f0000000f00)={0x78, r9, 0x100, 0x70bd25, 0x25dfdbfe, {{}, {@void, @void}}, [@NL80211_ATTR_KEY_TYPE={0x8}, @NL80211_ATTR_KEY_TYPE={0x8, 0x37, 0x2}, @NL80211_ATTR_KEY_DEFAULT={0x4}, @NL80211_ATTR_MAC={0xa, 0x6, @device_b}, @NL80211_ATTR_MAC={0xa}, @NL80211_ATTR_KEY_DATA_WEP104={0x11, 0x7, "ad1473bac88db807ead21eb3d2"}, @NL80211_ATTR_MAC={0xa}, @NL80211_ATTR_MAC={0xa, 0x6, @device_b}, @NL80211_ATTR_MAC={0xa}]}, 0x78}}, 0x20000011) sendmsg$TIPC_NL_MON_GET(r0, &(0x7f0000001200)={&(0x7f0000001000)={0x10, 0x0, 0x0, 0x204}, 0xc, &(0x7f00000011c0)={&(0x7f0000001040)={0x180, r6, 0x200, 0x70bd29, 0x25dfdbfc, {}, [@TIPC_NLA_BEARER={0x120, 0x1, 0x0, 0x1, [@TIPC_NLA_BEARER_PROP={0x54, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_WIN={0x8, 0x3, 0x40}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0xb8}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x1d}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x4}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x9}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x918}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x8}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x80000001}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x6}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x8}]}, @TIPC_NLA_BEARER_DOMAIN={0x8, 0x3, 0x25}, @TIPC_NLA_BEARER_DOMAIN={0x8, 0x3, 0x3}, @TIPC_NLA_BEARER_NAME={0x13, 0x1, @l2={'eth', 0x3a, 'syzkaller0\x00'}}, @TIPC_NLA_BEARER_PROP={0x44, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x8}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0xf8}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x1000}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x9}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x6}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x9}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x18}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x15}]}, @TIPC_NLA_BEARER_NAME={0x13, 0x1, @l2={'eth', 0x3a, 'veth0_vlan\x00'}}, @TIPC_NLA_BEARER_DOMAIN={0x8, 0x3, 0x22}, @TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_PROP={0x3c, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_TOL={0x8, 0x2, 0x8}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x1}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x5}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x66}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x9}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x13}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x8001}]}]}, @TIPC_NLA_NODE={0x4c, 0x6, 0x0, 0x1, [@TIPC_NLA_NODE_KEY={0x41, 0x4, {'gcm(aes)\x00', 0x19, "cc1c65bf83748d0cd02cd123e1782d7ad27cfe68097b84d012"}}, @TIPC_NLA_NODE_UP={0x4}]}]}, 0x180}, 0x1, 0x0, 0x0, 0x80c0}, 0x8004) ioctl$SIOCGSTAMPNS(r7, 0x8907, &(0x7f0000001240)) sendmsg$NL80211_CMD_REQ_SET_REG(r0, &(0x7f0000001440)={&(0x7f0000001280)={0x10, 0x0, 0x0, 0x8}, 0xc, &(0x7f0000001400)={&(0x7f00000012c0)={0x134, r8, 0x400, 0x70bd28, 0x25dfdbfd, {}, [@NL80211_ATTR_REG_RULES={0xbc, 0x22, 0x0, 0x1, [{0x34, 0x0, 0x0, 0x1, [@NL80211_ATTR_FREQ_RANGE_START={0x8, 0x2, 0x7}, @NL80211_ATTR_DFS_CAC_TIME={0x8, 0x7, 0x1}, @NL80211_ATTR_DFS_CAC_TIME={0x8, 0x7, 0x78}, @NL80211_ATTR_REG_RULE_FLAGS={0x8, 0x1, 0x4}, @NL80211_ATTR_REG_RULE_FLAGS={0x8, 0x1, 0x8}, @NL80211_ATTR_FREQ_RANGE_END={0x8, 0x3, 0x7}]}, {0x1c, 0x0, 0x0, 0x1, [@NL80211_ATTR_REG_RULE_FLAGS={0x8, 0x1, 0x2}, @NL80211_ATTR_REG_RULE_FLAGS={0x8, 0x1, 0x9}, @NL80211_ATTR_POWER_RULE_MAX_EIRP={0x8, 0x6, 0x8001}]}, {0xc, 0x0, 0x0, 0x1, [@NL80211_ATTR_FREQ_RANGE_MAX_BW={0x8, 0x4, 0x400}]}, {0x1c, 0x0, 0x0, 0x1, [@NL80211_ATTR_FREQ_RANGE_MAX_BW={0x8, 0x4, 0x6}, @NL80211_ATTR_FREQ_RANGE_END={0x8, 0x3, 0x1}, @NL80211_ATTR_DFS_CAC_TIME={0x8, 0x7, 0x3}]}, {0x14, 0x0, 0x0, 0x1, [@NL80211_ATTR_REG_RULE_FLAGS={0x8, 0x1, 0x5}, @NL80211_ATTR_FREQ_RANGE_MAX_BW={0x8, 0x4, 0x6}]}, {0x2c, 0x0, 0x0, 0x1, [@NL80211_ATTR_REG_RULE_FLAGS={0x8, 0x1, 0x8000}, @NL80211_ATTR_POWER_RULE_MAX_EIRP={0x8, 0x6, 0xde}, @NL80211_ATTR_POWER_RULE_MAX_ANT_GAIN={0x8, 0x5, 0x33}, @NL80211_ATTR_FREQ_RANGE_START={0x8, 0x2, 0x7018}, @NL80211_ATTR_REG_RULE_FLAGS={0x8}]}]}, @NL80211_ATTR_WIPHY={0x8, 0x1, 0x60}, @NL80211_ATTR_REG_RULES={0x5c, 0x22, 0x0, 0x1, [{0x24, 0x0, 0x0, 0x1, [@NL80211_ATTR_FREQ_RANGE_END={0x8, 0x3, 0x8}, @NL80211_ATTR_POWER_RULE_MAX_EIRP={0x8}, @NL80211_ATTR_FREQ_RANGE_MAX_BW={0x8, 0x4, 0xf}, @NL80211_ATTR_FREQ_RANGE_END={0x8, 0x3, 0x7ff}]}, {0x34, 0x0, 0x0, 0x1, [@NL80211_ATTR_POWER_RULE_MAX_ANT_GAIN={0x8, 0x5, 0x9}, @NL80211_ATTR_FREQ_RANGE_START={0x8, 0x2, 0x400}, @NL80211_ATTR_FREQ_RANGE_END={0x8, 0x3, 0x1}, @NL80211_ATTR_DFS_CAC_TIME={0x8, 0x7, 0x5}, @NL80211_ATTR_DFS_CAC_TIME={0x8, 0x7, 0x4}, @NL80211_ATTR_FREQ_RANGE_END={0x8, 0x3, 0x9}]}]}]}, 0x134}, 0x1, 0x0, 0x0, 0x50}, 0x50815) bind$inet(0xffffffffffffffff, &(0x7f0000001480)={0x2, 0x4e22, @loopback}, 0x10) r10 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL80211_CMD_SET_MPATH(r10, &(0x7f00000015c0)={&(0x7f00000014c0)={0x10, 0x0, 0x0, 0x8000000}, 0xc, &(0x7f0000001580)={&(0x7f0000001500)={0x7c, r8, 0x400, 0x70bd26, 0x25dfdbfd, {{}, {@val={0x8, 0x3, r2}, @val={0xc, 0x99, {0x7, 0x1e}}}}, [@NL80211_ATTR_MPATH_NEXT_HOP={0xa}, @NL80211_ATTR_MPATH_NEXT_HOP={0xa, 0x1a, @device_b}, @NL80211_ATTR_MAC={0xa}, @NL80211_ATTR_MPATH_NEXT_HOP={0xa, 0x1a, @broadcast}, @NL80211_ATTR_MAC={0xa, 0x6, @broadcast}, @NL80211_ATTR_MPATH_NEXT_HOP={0xa}, @NL80211_ATTR_MPATH_NEXT_HOP={0xa, 0x1a, @broadcast}]}, 0x7c}, 0x1, 0x0, 0x0, 0x1}, 0xc0) 2.594324881s ago: executing program 4 (id=6536): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000000)={0x58, 0x2, 0x6, 0x201, 0x0, 0x0, {}, [@IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz0\x00'}, @IPSET_ATTR_FAMILY={0x5, 0x5, 0x2}, @IPSET_ATTR_DATA={0xc, 0x7, 0x0, 0x1, [@IPSET_ATTR_BUCKETSIZE={0x5}]}, @IPSET_ATTR_REVISION={0x5}, @IPSET_ATTR_TYPENAME={0x11, 0x3, 'hash:ip,port\x00'}]}, 0x58}}, 0x0) r1 = socket(0x10, 0x803, 0x0) sendto(r1, &(0x7f0000000740)="120000001200e7ef007b00000000000000a1", 0x12, 0x0, 0x0, 0x0) recvmmsg(r1, &(0x7f00000037c0)=[{{&(0x7f00000004c0)=@ethernet={0x0, @random}, 0xfdf4, &(0x7f0000000380)=[{&(0x7f0000000140)=""/100, 0x365}, {&(0x7f0000000280)=""/85, 0x7c}, {&(0x7f0000000fc0)=""/4096, 0x197}, {&(0x7f0000000400)=""/106, 0x645}, {&(0x7f0000000980)=""/73, 0x1b}, {&(0x7f0000000200)=""/77, 0x14}, {&(0x7f00000007c0)=""/154, 0x21}, {&(0x7f00000001c0)=""/17, 0x1d8}], 0x21, &(0x7f0000000600)=""/191, 0xffffffffffffff2f}}], 0x4000000000003b4, 0x2040000, &(0x7f0000003700)={0x77359400}) r2 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000140), 0xffffffffffffffff) sendmsg$NL80211_CMD_SET_STATION(r1, &(0x7f00000002c0)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x40000000}, 0xc, &(0x7f0000000280)={&(0x7f0000000180)={0xc4, r2, 0x100, 0x70bd25, 0x7, {{}, {@void, @void}}, [@NL80211_ATTR_STA_FLAGS2={0xc, 0x43, {0x7, 0x45c}}, @NL80211_ATTR_STA_SUPPORTED_RATES={0xc, 0x13, [{0xc}, {0xb}, {0x6c, 0x1}, {0x48, 0x1}, {0x12}, {0x30, 0x1}, {0xc, 0x1}, {0x18, 0x1}]}, @NL80211_ATTR_STA_SUPPORTED_RATES={0x22, 0x13, [{0xb}, {0x3}, {0x69, 0x1}, {0x9, 0x1}, {0x9, 0x1}, {0x24}, {0x18, 0x1}, {0xc, 0x1}, {0x4, 0x1}, {0x30}, {0x24}, {0x6c, 0x1}, {0x24, 0x1}, {0x2, 0x1}, {0x18, 0x1}, {0x5}, {0x60, 0x1}, {0xc}, {0xb}, {0x9, 0x1}, {0x18}, {0x4, 0x1}, {0xc}, {0x36, 0x1}, {0x12}, {0x36, 0x1}, {0x1b}, {0x4f, 0x1}, {0x5, 0x1}, {0x9, 0x1}]}, @NL80211_ATTR_STA_AID={0x6, 0x10, 0x721}, @NL80211_ATTR_STA_SUPPORTED_RATES={0x17, 0x13, [{0x18, 0x1}, {0x3}, {0xc}, {0x16, 0x1}, {0x1}, {0x3}, {0x48, 0x1}, {0x16}, {0xb, 0x1}, {0x54, 0x1}, {0x1b, 0x1}, {0x2, 0x1}, {0x5, 0x1}, {0xb}, {0x25}, {0x18, 0x1}, {0x6c, 0x1}, {0xc}, {0x48, 0x1}]}, @NL80211_ATTR_MESH_PEER_AID={0x6, 0xed, 0xa1}, @NL80211_ATTR_STA_TX_POWER={0x6, 0x114, 0x400}, @NL80211_ATTR_STA_WME={0x3c, 0x81, [@NL80211_STA_WME_MAX_SP={0x5, 0x2, 0x1}, @NL80211_STA_WME_UAPSD_QUEUES={0x5, 0x1, 0x2}, @NL80211_STA_WME_UAPSD_QUEUES={0x5, 0x1, 0x8}, @NL80211_STA_WME_UAPSD_QUEUES={0x5, 0x1, 0xb}, @NL80211_STA_WME_UAPSD_QUEUES={0x5, 0x1, 0xf2}, @NL80211_STA_WME_MAX_SP={0x5, 0x2, 0x6}, @NL80211_STA_WME_UAPSD_QUEUES={0x5, 0x1, 0x3}]}, @NL80211_ATTR_STA_PLINK_ACTION={0x5, 0x19, 0x2}]}, 0xc4}, 0x1, 0x0, 0x0, 0x1}, 0x0) 2.401677305s ago: executing program 4 (id=6538): r0 = socket$inet6_sctp(0xa, 0x5, 0x84) shutdown(r0, 0x0) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r0, 0x84, 0x6f, &(0x7f0000000000)={0x0, 0x10, &(0x7f00000002c0)=[@in={0x2, 0x0, @rand_addr=0x64010100}]}, &(0x7f0000000240)=0x10) setsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER_VALUE(r0, 0x84, 0x7c, &(0x7f0000000040)={r1, 0x1, 0x9}, 0x8) r2 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r2, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000000)=@newtaction={0xa0, 0x30, 0x9, 0x0, 0x0, {}, [{0x8c, 0x1, [@m_bpf={0x88, 0x1, 0x0, 0x0, {{0x8}, {0x60, 0x2, 0x0, 0x1, [@TCA_ACT_BPF_OPS_LEN={0x6, 0x3, 0x7}, @TCA_ACT_BPF_OPS={0x3c, 0x4, [{0x25, 0x0, 0x1, 0xfffffffd}, {}, {0x2d}, {0x0, 0x1}, {}, {}, {0x6}]}, @TCA_ACT_BPF_PARMS={0x18, 0x2, {0x0, 0x0, 0x1}}]}, {0x4}, {0xc}, {0xc}}}]}]}, 0xa0}, 0x1, 0x0, 0x0, 0x8090}, 0x8000) 2.252967977s ago: executing program 4 (id=6540): socket$kcm(0x10, 0x2, 0x0) socket$igmp(0x2, 0x3, 0x2) socket$nl_generic(0x10, 0x3, 0x10) socket$kcm(0x10, 0x2, 0x0) bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="04000000040000000400000005"], 0x48) socket$inet6_udp(0xa, 0x2, 0x0) socket(0x10, 0x3, 0x0) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000780)=ANY=[@ANYBLOB="19000000040000000800000008"], 0x50) r1 = epoll_create1(0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r3, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r4 = epoll_create1(0x0) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r3, &(0x7f0000000100)={0x20000014}) epoll_ctl$EPOLL_CTL_ADD(r4, 0x1, r1, &(0x7f0000000000)={0xa0000001}) r5 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r5, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000004c0)=ANY=[@ANYBLOB="18000000260001031dbd7002fadbdf25010000000400ae"], 0x18}, 0x1, 0x0, 0x0, 0x4040854}, 0x0) recvmmsg(r5, &(0x7f0000000800)=[{{0x0, 0x0, &(0x7f0000000180)=[{&(0x7f0000000500)=""/150, 0x96}, {&(0x7f0000003800)=""/4135, 0x1027}, {&(0x7f0000000040)=""/185, 0xb9}, {&(0x7f0000000340)=""/122, 0x7a}, {&(0x7f0000000a40)=""/4081, 0xff1}, {&(0x7f00000005c0)=""/80, 0x50}, {&(0x7f0000000200)=""/30, 0x1e}, {&(0x7f0000000100)=""/3, 0x3}], 0x8}, 0xd}, {{0x0, 0x0, 0x0}, 0x8}, {{0x0, 0x0, 0x0}, 0x38000000}, {{0x0, 0x0, 0x0}}], 0x4, 0x40000102, 0x0) ppoll(&(0x7f0000000400)=[{r5, 0x500}], 0x0, 0x0, 0x0, 0x46) epoll_ctl$EPOLL_CTL_ADD(r4, 0x1, r3, &(0x7f0000000140)={0x4}) r6 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x6, 0xd, &(0x7f0000000200)=ANY=[@ANYBLOB="1800000000000000000000000000000085000000bc00000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bca2000000000000a6020000f8ffffffb703000008000000b704000000000400850000003300000095"], &(0x7f0000000180)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @xdp, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5}, 0x94) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000340)={{r0, 0xffffffffffffffff}, &(0x7f00000001c0), &(0x7f0000000300)=r6}, 0x20) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000000)={r7, &(0x7f0000000380)="0099", &(0x7f0000000480)=@udp6=r6, 0x2}, 0x20) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000280)={r6, 0x5, 0xe, 0x0, &(0x7f00000003c0)="000000000000000000000001e370", 0x0, 0x200000ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x20}, 0x50) 2.204548413s ago: executing program 0 (id=6541): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x200180, 0x0) r1 = socket$inet(0x2, 0x800, 0x75e0) ioctl$sock_SIOCGIFVLAN_GET_VLAN_VID_CMD(r1, 0x8982, &(0x7f00000001c0)) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x2}) r2 = socket(0x10, 0x3, 0x0) write(r2, &(0x7f0000000000)="240000001a005f0400f9f407000904018000200000000000000000000800010000000000", 0x29) r3 = socket$packet(0x11, 0x3, 0x300) r4 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) close(r4) r5 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000100)={'veth0_to_batadv\x00', 0x0}) sendmsg$nl_route_sched(r5, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000600)=@newqdisc={0x4c, 0x24, 0x4ee4e6a52ff56541, 0x1, 0x25dfdbfd, {0x0, 0x0, 0x0, r6, {0x0, 0xb}, {0xffff, 0xffff}, {0xb}}, [@qdisc_kind_options=@q_netem={{0xa}, {0x1c, 0x2, {{0x7, 0x3, 0x6364, 0x5, 0xffffffff, 0x3}}}}]}, 0x4c}, 0x1, 0x0, 0x0, 0x40088c1}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000140)=@newqdisc={0x24, 0x24, 0xd0f, 0xfffffffd, 0xffffffff, {0x60, 0x0, 0x0, 0x0, {0xffe6, 0x2}, {0xffe0, 0x10}, {0xd, 0xd}}}, 0x24}, 0x1, 0x0, 0x0, 0x4000844}, 0x2000c8c1) r7 = openat$nci(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) r8 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r9 = syz_genetlink_get_family_id$nfc(&(0x7f0000000100), r8) ioctl$IOCTL_GET_NCIDEV_IDX(0xffffffffffffffff, 0x0, &(0x7f0000000380)=0x0) unshare(0x8000400) sendmsg$NFC_CMD_DEV_UP(r8, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000d80)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r9, @ANYBLOB="010426bd7000f8dbdf250200000008000100", @ANYRES32=r10], 0x1c}}, 0x4008054) write$nci(r7, &(0x7f0000000240)=ANY=[@ANYBLOB='p\x00\t'], 0xc) sendmsg$OSF_MSG_ADD(0xffffffffffffffff, &(0x7f00000018c0)={0x0, 0x0, &(0x7f0000001880)={&(0x7f0000000100)={0x268, 0x0, 0x5, 0x201, 0x0, 0x0, {0x3, 0x0, 0x6}, [{{0x254, 0x1, {{0x2, 0x200}, 0x80, 0x9, 0x4, 0x1, 0x16, 'syz1\x00', "9f95cf5a03ab4df3f0f3d0941074d2f18faf184d23b6cf52e8c676c218b39b33", "5a19d528faa003da54c821603e499a3e11b3efe2be7aafa9680b20a26883ac0a", [{0x864b, 0x6, {0x2, 0x3ff}}, {0x3, 0x3, {0x2, 0x3}}, {0x2, 0x28, {0x3, 0x3}}, {0x7, 0xfff8, {0x1}}, {0x9d40, 0x2, {0x1, 0x8}}, {0xca, 0xc4f2, {0x3, 0xe02f}}, {0xfffa, 0x17, {0x3, 0x80}}, {0x9, 0x8001, {0x1, 0x3}}, {0x2, 0x9, {0x1, 0xfffffffd}}, {0x200, 0x3, {0x0, 0x4}}, {0x7, 0x80, {0x3, 0x8}}, {0xb1, 0x0, {0x1, 0x5}}, {0x1, 0x2dc, {0x3, 0x3}}, {0xffff, 0x8, {0x3, 0xb}}, {0x2, 0x96}, {0x2, 0x2, {0x1, 0x9}}, {0x6, 0x7, {0x2, 0x3}}, {0x5, 0x5, {0x1, 0x67}}, {0xffd6, 0x1d97, {0x3}}, {0x8, 0xdb4d, {0x2, 0xffffffff}}, {0x3, 0x7fff, {0x0, 0x2}}, {0x401, 0xc, {0x3, 0x10001}}, {0x21, 0x9, {0x2, 0x2}}, {0x3, 0x6, {0x3, 0x5}}, {0x2, 0x200, {0x3, 0x5}}, {0x7, 0x1, {0x2, 0xa6}}, {0x3, 0x101, {0x2, 0x7}}, {0x2, 0x1, {0x3, 0xffffffff}}, {0x6, 0x81, {0x0, 0x6}}, {0xd, 0xc3e, {0x2, 0x1}}, {0x0, 0x84d, {0x1, 0x1}}, {0x5, 0x65, {0x2, 0xfffffffb}}, {0x7, 0x4, {0x2, 0x1}}, {0x1, 0x40, {0x0, 0x1}}, {0xfed9, 0x6, {0x3, 0x1}}, {0x40, 0x6, {0x1, 0xff800000}}, {0x370d, 0x800, {0x1, 0x4}}, {0x101, 0x8, {0x3, 0x10001}}, {0x5, 0x3, {0x2}}, {0x401, 0x5, {0x3, 0x2}}]}}}]}, 0x268}, 0x1, 0x0, 0x0, 0x40}, 0x80) write$nci(r7, &(0x7f0000000280)=ANY=[@ANYBLOB="400109"], 0x87) sendmsg$nl_route_sched(r5, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000440)=@newqdisc={0x48, 0x24, 0x4ee4e6a52ff56541, 0x70b92a, 0x25dfdc01, {0x0, 0x0, 0x0, r6, {}, {0xc, 0xb}, {0xffff, 0xfff1}}, [@qdisc_kind_options=@q_fq_codel={{0xd}, {0x14, 0x2, [@TCA_FQ_CODEL_CE_THRESHOLD={0x8, 0x7, 0x7}, @TCA_FQ_CODEL_CE_THRESHOLD_MASK={0x5, 0xb, 0x64}]}}]}, 0x48}, 0x1, 0x0, 0x0, 0x240048e4}, 0x4890) ioctl$SIOCSIFHWADDR(r4, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) setsockopt$packet_int(r3, 0x107, 0xf, &(0x7f0000000100)=0x207, 0x4) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000040)={'syzkaller0\x00', 0x0}) sendto$packet(r3, &(0x7f00000002c0)="05031600d3fc142000004788031c09102c28", 0xfd1e, 0x4, &(0x7f0000000140)={0x11, 0x0, r11, 0x1, 0x0, 0x6, @multicast}, 0x14) bpf$BPF_GET_BTF_INFO(0xf, &(0x7f0000000280)={0xffffffffffffffff, 0x20, &(0x7f0000000240)={&(0x7f00000000c0)=""/38, 0x26, 0x0, &(0x7f0000000200)=""/40, 0x28}}, 0x10) r12 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r12, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000040)={0x54, 0x2, 0x6, 0x201, 0x0, 0x0, {}, [@IPSET_ATTR_FAMILY={0x5}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz0\x00'}, @IPSET_ATTR_TYPENAME={0x10, 0x3, 'bitmap:port\x00'}, @IPSET_ATTR_DATA={0xc, 0x7, 0x0, 0x1, [@IPSET_ATTR_PORT={0x6}]}, @IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_REVISION={0x5}]}, 0x54}}, 0x0) 2.186654402s ago: executing program 3 (id=6542): r0 = socket(0x10, 0x80002, 0x0) r1 = socket$nl_generic(0x10, 0x3, 0x10) socket$inet(0xa, 0x801, 0x84) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) r3 = syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x3) shutdown(r3, 0x0) recvmmsg(r3, &(0x7f00000055c0), 0x400023c, 0x300, 0x0) r4 = socket$inet6(0xa, 0x802, 0x0) setsockopt$inet6_buf(r4, 0x29, 0x39, &(0x7f0000000040)="ff0204000000000100000000000000000000000000000205", 0x18) close(0x3) mmap(&(0x7f0000001000/0xc00000)=nil, 0xc00000, 0x300000c, 0x3032, 0xffffffffffffffff, 0x0) pselect6(0x40, &(0x7f0000000040)={0x5, 0x800007, 0x2, 0x6, 0x8, 0x8, 0x7, 0x4}, &(0x7f0000000080)={0x97, 0x8, 0x0, 0x1, 0x5, 0x4, 0x3, 0x4}, 0x0, 0x0, 0x0) sendmsg$nl_route(r0, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000009c0)=@newlink={0x20, 0x29, 0x10f}, 0x20}}, 0x0) bpf$BPF_PROG_QUERY(0x10, &(0x7f0000000180)={@ifindex, 0x13, 0x0, 0xffffffff, &(0x7f0000000000)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0], 0x6, 0x0, &(0x7f00000000c0)=[0x0, 0x0, 0x0], &(0x7f0000000100)=[0x0], &(0x7f0000000140)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0], 0x0}, 0x40) bpf$PROG_LOAD_XDP(0x5, &(0x7f00000001c0)={0x10, 0x4, &(0x7f0000001300)=@framed={{}, [@ldst={0x1, 0x2, 0x3, 0x0, 0x1, 0x21}]}, &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0xe}, 0x90) r6 = bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x3, 0xe, &(0x7f0000002b00)=ANY=[@ANYBLOB="b702000007000000bfa300000000000007030000f0ffffff7a0af0ff0020000079a4f0ff00000000b706000000000081ad64020000000000450404000100ff0f1704000001130a00b7050000000000006a0af2fe0000000085000000a3000000b700000000000000950000000000000000e154cd8445974b26ffffffe4fbffffff55bb2007ee51050512b5b42128aa090a79507df79f298129daa7a6b2f91af50342115e17392ac627c87867c000006146001e04aeacea799a22a2fa798b5adc43eb27d53319d0ad229e5752548300000000dbc2777df150b7cdd77b85b941092314fd085f028f2ed1a4535550614e09d6378198a6097a670838337af2abd55a87ac0394b2f92ffab7d153d62058d0a413b2173619ccf55520f22c9ca8b6712f3024b7041b1df65b3e1b9bf115646d14ce53d13d0ccacda1ef0900094fa737c28b99938512c816fdcceaede3faedc51d29a47fc813a2ec00f4c7a53ac271d6d7f4ea6bf97f2f33e2ea2e534300bcb3fdc4b4861004eefbda7f54f82a804da4f86bb47a4a69bf9bc5fa96ee293fbd165a5a68488e40b030166565a097b1b44b451de736bb6d43db8db03d4b7745fef1d04ec633dee254a6d491b849a55b000000c4fd21a18986252a70f8f92eb6f0e8c7db4bf23242a1f2d90addedc28159f09943b1b0452d1b72183aacf4a84f9130b775dd4e9e3070756f97ad91935a6ddfa8f90e79321a0574fb30ff0000801989328c8ddc20ea011bf5742e0e0d4334db8b20ce3f9f16cb7fc20fb4791ec85821d0c48fb657c29b309c73f0977e7cde65a82b94c461d7962b0d2277a84af326f37f3e2c25a61ec45c3af97a8f17da954aff3fc8c108755f75ca13fb7c8bbd8b6e7dac1aba4b20dc7de058a4dfa7e85a8bdf1d41a2d8bda74d66f47cc180f82c5f573c1f860d050d694cc7806d294d3665016a7b29da0fde4745db06753a7ac74a2d32f7528751313694bf5700b20ef0c248ddd3da32396a614cacad4aff2066bb5d40887c58559b7dcb98a6273b8c651e57f727041c62cea5b7bd24d9f679e4fbe948dfb4cc4a389469608241630459f0123fd39206000000000000eb55dad46de56ef907b059b90b8aa49afb9a79ae5498f6589880ed6eea7b9c670012be05e7de0940313c5870786554df26236ebced9390cb6941b83720eca291963eb2d537d8ee4de5c183c960119451c31539b22809e1d7f0cda06a9fa87d64cb89872a2cd8a104e16bb1a2bacf13464ca03aff14a9aa4bd9539f5096412b92012e095b84c20243ff98df3347f0e399d1b9f27e3c33269c0e153b28b2d4410572bc45b9d3fa02208d304d455c36300000000022320178b00cc6ed7966130b547dbf8b497af002000000cd1d0000002000000000000000000000000928ee53595a779d243a48cea769470424d28804c04b2c4324ab7f4a5c81921f0128dfd70b438af60b060000000000000056642b49b745f3bf2cf7908b6d7d748308eea09fc361b4735efbf3411718d6ee7aebed161980f2fde4f9ef679dbfae9fb4a79f8a836804ed3a1079b0282a12043408cd60b687dcff91af19010000000000000000456f7d2a42bd13da202274f20675eb781925441578e93046aaddea8ec4ca37f71c2710a7ea8ae0dc214e1cc275b26adfa892e6de92000000000000000000ddff004cff9ec780f535e62f4eeee50e5bafecea4d4134d006c8d6883eca5c9c58c9e9338c73de2f04f15d005387577f480000ea65559eb00e76e9d0ada201bcbb5c252b28a60ca770663da451790cc36000906d5a9fad98c308e39bd5ffb6151d79c1cee1cd102e3c8e63e9fba05e3633be3f00000015762e5f5a3a0bc33fdbe28a5ffc83f2b485185cc92fe7f791e8f6429309d6adab4b7e508e4bf024ed8f8a005f2bbf96c89739f5cf1e750d50517a59a3ad09e8802c8f4f535447cc0fc9d5f99a73145dfcedad69da9cd4375c624600e78f4458542b14f29611f95d4a31838eeb20c20bb82aa31771cd379ec83554cea5e6539db7384e1f58d81f2f2653c4d9818708e27c89b552d7fcd116bce9c764c714c9402c21d181aac59efb28d4f91652f6750b6ec962802c0320f8059195729d60c534ee8e8ff0755b67fe4c25edb85bcff24c757aa8090000000000008c420eb4304f66e3a37aaf000000c42a570f0e9dd5fd545470f862f8c3c14fa9ecd1e877b0d8ca84c044859e85e6158f9184bc61a9a284db80e4636c25b96174327d82761c26e329555f9290af4100000000000000ff0ffd3763655500344bae34137f5ab0d534b8d63e4ca3b671f2de1cdf519192c6b59a601fd419adc16e2055b85058f793484305d7a1759782e4c571ee855a47bc00edf5e9020c09ab004321610b857e8717764b633b21cb32f0e03280e09758bd445ab91d20baca005452b79d7b574a247f1d2fe45b3c4e93da3d51de647c10dd49944dc87c92332af0be61e58c79d497247d278888901d442ad7f8536607a644e9e3d769db497c3960dfde12182334caee994adc38a436367a54b9e182b78e9a0ceb9a2c4f63902c1ad1a7c5a08d0920a23c2a86abbdf357849a651733e57f31019876026888c8ccb85c86b4f8ffffff7f000000002c331fca0e541b7ca211c28ed61c525708a13d115b43f8b1894c8fa8a14dc4810f61ae96c18cc7130000000000002100000000000000000001000027c9a46157a3609b6fd9843ee19ec647249a9375de5858818f3c4a4fa6ce46f4d42b07199de8b99231ace58c77819ee214e49666c464d35ca9b5143ed3b3dc8c17a23692759ccf5a205311b7ab22532697b861dfb54609fd88e6043bd52ae84c1bb0c8a6c769f952283a1f4e3842edb3d42c68a27ef6a1296dfff4a979369b0e8ebc62887aa46e820a74f91381dcc198e353047db70686d147357024eb3cb94f1e89cb5ba0a56aa046b4dc521a3d9356b4b8b5917c4c860495b240e80063bde261fd00000000007271e28ef6806bc8e139c49b91c76bea3858f7f05b47d3e519f1634e8fbd8d31330d89069f9648a2ff93060ff073b3a113e47edf76f7d116d2b0976cf2ec447c030931651dd315003b7a6a5433a2bb560ae99e85b227eda2e63a1c31a2c2bd48a822cbe92b6524e0cd8020ecaa34e19e7141d5e221509342bfe7d294d1eb3de6a50ca0301f89c2ee627e949c68b3a4a426a996d503a26e9a714ee5f72d8805dd1bfbd081f6a5359dbdfbf31a562395020becaf3fd1f1289dfe14cb9194e26a44fac273461fc5c0e0a33db7f2d43ea8086cf059f40fa2640b6bfb74dd35f5a31059c01517cf4b6641fce9a24b96767b837ca037a1199735c375c705c798e0e208e4a5259d0bfa526b462af45a6eab34000000000000000000000000c4426344ec1a3366515dee221e747f55d7dd02534bc503b9b28277c253e410986bef2111a99cc448d652929f8a67a6a1d3f00dcad91aff428aade3f85714a1d3ef29acd4d49b62339c10c2ec0dac4b28288e78980c1184d8223edbc4bf9258b7374e79a8f8bf3fb73c8c6dbb7bbdfc399847a11921f97eba0ea14c4fed9a71eedb97c02461792e3a49dac16c60c3fcaab222025d78963c3ac899fa8b63f58a30212c9b2d7fe751e2046b78f86e22861b6504c667350244dd6d9189a8b9c45f8aaff9db694811ca86ed978f23eed7459c0382074170cf1e25b0e9ba3d1cc309353eea4cd8ab96bafda393276bdd8d32ead8db9e1b54d2d3d50e2815268fc1a6ec566981bc8ca2a4583f3d40e817433d0f4f25cfe6cc1897449ba5f26a9d66ac73e6f5c401376f23a314e0b9ff997d22f3e34b5524642c248aa813edaa626f0000000000000000000000000000000003ba5bac34b611569a451564d3a5400f9097ffe7a37e765bc652be71ee24250d6d9cf19878dd62c53062d6000c40bde6a6135eae8a00000000008d797190a26c933f933aff5c521eeb7a84a62d149d846e74e76b515b6b8be29e8b69310fa130cf6d6b74f33205d3cc218ca554ed8085ae044f5bf2e89ad07963acbd4dd4dc5b4552591edde7a22ad06f7567e6fec2f65011b579bf609d61a3ff4d6f490824bb035995449fc34106ae6889f036d67b6aaee784f855ebc746ac871b5d2031ac0a252ac1f86e93e245f3793cea80b6de773899d49d11d3b1ed79163b111c976cf840a2ef6214a43338fba8c9edb6be26e68fcc5d47ed74a66ce8aba726ab955b9b32ab1890e84a5e2d7476252af25e5c95c5a8b2b1b5c8a2645b01b823c0f169d6ab529cc889bb07889d9e155114cf3e26a50c527ec6d4021cd2cacfea6d7e41e39e26b3967cad65c648b170f12ea9cc69dcee64be0c27b1f4f7f5ce3e62c35602c9d2921326891901661c85b988494f094abb91ed813b42828aa93105896e0aee851a8087e169a1d69e841257d9053d0cdc3a6ac4f12084cc6470abebe8b344b1f56690a2687b428686c854c21831da277e8b8a21b7b91a46d22ba083eca7b1f8268048cde7d6f237dca42035881b29ca9c8c2937971821b613894297ff6f7796053a4de1fd77e180cc22b205d43bb4a1b59962c1f605ea1b74585cf5e8d579f157cb45561c357f9976cec6a43388b3049a0d9c171ff6145266ba119d00000000001ef3794a930eb12f3a6215c510bf0bca70c127e9c70cc7bef921249a7f18a0034ce3264a9e96656b47233e2ed7c76520e649c3fd550bdafd77c5cd72b4446d3e157ddd97e7622a6891fb739acd3b2cdaf65ac78490f0641be6e8c6f55bf3d228786895ff5fd5970faacd8a5025aca0aa1931f477ba06aa60051298c8bf7f3b399194f98dc3f4e8513ad06da09dc393c1284515986b8c70ac69512f6c0c04f42edb3a097a11f2ab480e3e391abffae097752300576337c6dd24c4a98280684aa1fe8c7b43ee8bce05fe979b34da18cdb44dbb030b8009cd3b3b44fd8e7b534acd3f1839cb54817668ab446d3d47848429ea831a57f222c714870582a8832c2a326c5d1e406c8b05dedddceb24483f8f998b05c3ddf85c3799c9000000000000000000000000001e57cf839eb3150d6a076fb7b86fae98dbb46014f483aecb4ec4f0877371bcae8912c78aff857c669760f0e55041563c5c3e8ee4a0eef885fd43fe34a1febc82370d1d07fdfe705ada47288e41e7e6ee82d66b99ae4b0889fe949e7342ca97c1a64dcc7f6a0c0da07de8c808b4caec54820f856889fc5f1af3d675206e3257f974d6e45ff1e905c2f0fc0173ac6714acaaca2397bee23630ecaa2c1c6ddc3085689a033d6d41a1a7ac59baec299158faa52308856805f2130863f4668e27b8bbef4f4cd43a2fd294b5b0bf2b0e4afbe570c54aa214579ca0caf54231d00a94eda2be6f037e2befdd03bf152f696ca1d1ea86eb7ee1f021062ad71246dae1580c4f959a320912032ed468a8ed9f27a2258ddf465de77a51b4713bc6b789a0e8b203f0f592ddb27aa90989a9e0cb624bc34e7d6ebf156ea251e3a2f83ada9f0b70035e8ed200a52b00"/3910], &(0x7f0000000b80)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sched_cls, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0xfffffedf, 0x10, &(0x7f0000000040)}, 0x48) bpf$BPF_GET_PROG_INFO(0xf, &(0x7f0000000700)={r6, 0xe0, &(0x7f0000000a00)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, ""/16, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, 0x10) bpf$BPF_PROG_GET_FD_BY_ID(0xd, &(0x7f0000000140)={r7}, 0x4) bpf$BPF_PROG_ATTACH(0x8, &(0x7f0000000200)={@map=r2, r2, 0x2c, 0x20, r2, @void, @void, @void, @value=r7, r5}, 0x20) r8 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000280), r2) sendmsg$NL80211_CMD_GET_SCAN(r1, &(0x7f0000000380)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x10000000}, 0xc, &(0x7f0000000340)={&(0x7f00000002c0)=ANY=[@ANYBLOB="14000000", @ANYRES16=r8, @ANYBLOB], 0x14}, 0x1, 0x0, 0x0, 0x200000d0}, 0x800) 2.134379513s ago: executing program 1 (id=6543): socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000680)={0xffffffffffffffff, 0xffffffffffffffff}) setsockopt$sock_attach_bpf(r0, 0x1, 0x4c, &(0x7f0000000000), 0x4) recvmsg$unix(r0, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000080)=[@rights={{0x14, 0x1, 0x1, [0xffffffffffffffff]}}], 0x18}, 0x2000) ioctl$TUNSETNOCSUM(r1, 0xff09, 0x110c2300fe) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$team(&(0x7f0000000100), 0xffffffffffffffff) ioctl$ifreq_SIOCGIFINDEX_team(r2, 0x8933, &(0x7f0000000040)={'team0\x00', 0x0}) sendmsg$TEAM_CMD_OPTIONS_SET(r2, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000340)=ANY=[@ANYBLOB='\\\x00\x00\x00', @ANYRES16=r3, @ANYBLOB="01000000000001dcdf250100000008000100", @ANYRES32=r4, @ANYBLOB="400002803c000100240001"], 0x5c}, 0x1, 0x400000000000000, 0x0, 0x80}, 0x40010) sendmsg$MPTCP_PM_CMD_FLUSH_ADDRS(r1, &(0x7f00000001c0)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x1000000}, 0xc, &(0x7f0000000180)={&(0x7f0000000100)={0x50, 0x0, 0x200, 0x70bd2a, 0x25dfdbff, {}, [@MPTCP_PM_ATTR_ADDR_REMOTE={0x34, 0x6, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_ADDR4={0x8, 0x3, @dev={0xac, 0x14, 0x14, 0x25}}, @MPTCP_PM_ADDR_ATTR_PORT={0x6, 0x5, 0x4e20}, @MPTCP_PM_ADDR_ATTR_IF_IDX={0x8, 0x7, r4}, @MPTCP_PM_ADDR_ATTR_ID={0x5, 0x2, 0x3}, @MPTCP_PM_ADDR_ATTR_PORT={0x6, 0x5, 0x4e22}, @MPTCP_PM_ADDR_ATTR_ID={0x5, 0x2, 0x12}]}, @MPTCP_PM_ATTR_TOKEN={0x8, 0x4, 0xd5}]}, 0x50}, 0x1, 0x0, 0x0, 0x20000001}, 0x1) r5 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r5, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000240)={{0x14}, [@NFT_MSG_NEWTABLE={0x20, 0x0, 0xa, 0x401, 0x0, 0x0, {0x1, 0x0, 0x3}, [@NFTA_TABLE_NAME={0x9, 0x1, 'syz0\x00'}]}, @NFT_MSG_NEWCHAIN={0x2c, 0x3, 0xa, 0x101, 0x0, 0x0, {0x1}, [@NFTA_CHAIN_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_CHAIN_NAME={0x9, 0x3, 'syz0\x00'}]}, @NFT_MSG_NEWRULE={0x7c, 0x6, 0xa, 0x401, 0x0, 0x0, {0x1, 0x0, 0x3}, [@NFTA_RULE_CHAIN_ID={0x8}, @NFTA_RULE_EXPRESSIONS={0x58, 0x4, 0x0, 0x1, [{0x24, 0x1, 0x0, 0x1, @exthdr={{0xb}, @val={0x14, 0x2, 0x0, 0x1, [@NFTA_EXTHDR_DREG={0x8, 0x1, 0x1, 0x0, 0xc}, @NFTA_EXTHDR_LEN={0x8, 0x4, 0x1, 0x0, 0x2f}]}}}, {0x30, 0x1, 0x0, 0x1, @cmp={{0x8}, @val={0x24, 0x2, 0x0, 0x1, [@NFTA_CMP_DATA={0x10, 0x3, 0x0, 0x1, [@NFTA_DATA_VALUE={0x9, 0x1, "910d000000"}]}, @NFTA_CMP_SREG={0x8, 0x1, 0x1, 0x0, 0xc}, @NFTA_CMP_OP={0x8}]}}}]}, @NFTA_RULE_ID={0x8, 0x9, 0x1, 0x0, 0x2}]}], {0x14}}, 0xf0}, 0x1, 0x0, 0x0, 0x180}, 0x40800) r6 = socket$netlink(0x10, 0x3, 0x4) setsockopt$netlink_NETLINK_PKTINFO(r6, 0x10e, 0x3, 0x0, 0x0) sendmsg$NFNL_MSG_CTHELPER_NEW(r6, &(0x7f00000004c0)={&(0x7f0000000380), 0xc, &(0x7f0000000480)={&(0x7f00000003c0)={0xa8, 0x0, 0x9, 0x5, 0x0, 0x0, {0x5}, [@NFCTH_NAME={0x9, 0x1, 'syz0\x00'}, @NFCTH_TUPLE={0x60, 0x2, [@CTA_TUPLE_IP={0x14, 0x1, 0x0, 0x1, @ipv4={{0x8, 0x1, @local}, {0x8, 0x2, @empty}}}, @CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @ipv4={'\x00', '\xff\xff', @local}}, {0x14, 0x4, @ipv4={'\x00', '\xff\xff', @remote}}}}, @CTA_TUPLE_ZONE={0x6, 0x3, 0x1, 0x0, 0x3}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5, 0x1, 0x2f}}, @CTA_TUPLE_ZONE={0x6, 0x3, 0x1, 0x0, 0x4}]}, @NFCTH_NAME={0x9, 0x1, 'syz0\x00'}, @NFCTH_PRIV_DATA_LEN={0x8, 0x5, 0x1, 0x0, 0x11}, @NFCTH_POLICY={0xc, 0x4, 0x0, 0x1, {0x8, 0x1, 0x1, 0x0, 0x8}}, @NFCTH_PRIV_DATA_LEN={0x8, 0x5, 0x1, 0x0, 0x7}]}, 0xa8}, 0x1, 0x0, 0x0, 0x804}, 0x24040000) r7 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r8 = syz_genetlink_get_family_id$nfc(&(0x7f0000000540), 0xffffffffffffffff) sendmsg$NFC_CMD_GET_SE(r7, &(0x7f0000000600)={&(0x7f0000000500)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f00000005c0)={&(0x7f0000000580)={0x14, r8, 0x200, 0x70bd2a, 0x25dfdbff, {}, ["", "", "", "", "", "", ""]}, 0x14}, 0x1, 0x0, 0x0, 0x4000000}, 0x800) 1.857692892s ago: executing program 2 (id=6544): r0 = socket$rds(0x15, 0x5, 0x0) bind$rds(r0, &(0x7f0000000040)={0x2, 0x0, @loopback}, 0x10) sendmsg$rds(r0, &(0x7f0000001600)={&(0x7f0000000000)={0x2, 0x0, @remote}, 0x10, 0x0, 0x0, &(0x7f0000000180)=[@rdma_args={0x48, 0x114, 0x1, {{}, {0x0}, &(0x7f0000000680)=[{&(0x7f0000001640)=""/4096, 0x1000}, {&(0x7f0000002640)=""/4096, 0x1000}], 0x2, 0x27}}], 0x48}, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) r2 = socket(0x10, 0x803, 0x0) syz_genetlink_get_family_id$nl80211(&(0x7f0000000240), r2) getsockopt(r1, 0xd69, 0x2, &(0x7f0000000340)=""/183, &(0x7f0000000400)=0xb7) r3 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r3, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000040)=ANY=[@ANYBLOB="2c00000041000100fcff07000400000001000000040048800c00018008000f00e0000001080002"], 0x2c}, 0x1, 0x0, 0x0, 0x400c801}, 0x4008094) getsockname$packet(r2, &(0x7f0000000180)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000000c0)=0x14) sendmsg$nl_route(r2, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000100)=@newlink={0x48, 0x10, 0x437, 0x800000, 0x0, {0x0, 0x0, 0x0, r4, 0x504c3}, [@IFLA_LINKINFO={0x28, 0x12, 0x0, 0x1, @gretap={{0xb}, {0x18, 0x2, 0x0, 0x1, [@IFLA_GRE_COLLECT_METADATA={0x4}, @IFLA_GRE_TOS={0x5, 0x9, 0xb5}, @IFLA_GRE_FWMARK={0x8, 0x14, 0x4}]}}}]}, 0x48}, 0x1, 0x0, 0x0, 0x2000c014}, 0x0) sendmmsg$inet(r1, &(0x7f0000000300)=[{{&(0x7f00000002c0)={0x2, 0x4e23, @multicast1}, 0x10, 0x0, 0x0, &(0x7f0000000000)=[@ip_pktinfo={{0x1c, 0x0, 0x8, {r4, @empty, @remote}}}], 0x20}}], 0x1, 0x40000) 1.803693542s ago: executing program 3 (id=6545): socket$nl_netfilter(0x10, 0x3, 0xc) (async) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_NEW(r0, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000100)=ANY=[@ANYBLOB="640000000001010400000000141a000002000000240001801400018008000100e000000108000200e00000010c00028005000100000000002400028014000180080001000000000008000200ac1e00010c00028005000100000000000800074000000001"], 0x64}, 0x1, 0x0, 0x0, 0x20040000}, 0x0) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_NEW(r1, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000280)=ANY=[@ANYBLOB="50000000000101040000000000000000020000001400188008000140000000000800004000000000240001801400018008000100e000000108000200e00000010c00028005000100"], 0x50}}, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) (async) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg(r2, &(0x7f0000000500)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000200)="68000000010905040000000000000000020000000900010073797a3000000000140002800600010000020000050002000600000008000500000000002c0004800800010000000001200002800c100100706f6c69637930f50800020000000002080003000000001e", 0x68}], 0x1}, 0x20000004) sendmsg$IPSET_CMD_RENAME(r2, &(0x7f0000000140)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f0000000100)={&(0x7f0000000080)={0x7c, 0x5, 0x6, 0x201, 0x0, 0x0, {0x2}, [@IPSET_ATTR_SETNAME={0x9, 0x2, 'syz2\x00'}, @IPSET_ATTR_SETNAME2={0x9, 0x3, 'syz1\x00'}, @IPSET_ATTR_SETNAME2={0x9, 0x3, 'syz1\x00'}, @IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_SETNAME2={0x9, 0x3, 'syz2\x00'}, @IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_SETNAME2={0x9, 0x3, 'syz2\x00'}, @IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_SETNAME2={0x9, 0x3, 'syz0\x00'}]}, 0x7c}, 0x1, 0x0, 0x0, 0x1}, 0x24000040) 1.68227108s ago: executing program 2 (id=6546): r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000002240)={0x0, 0x0, &(0x7f0000001140)={&(0x7f00000001c0)=ANY=[@ANYBLOB="50000000100003058000"/20, @ANYRES32=0x0, @ANYBLOB="00000000000000000a000100aaaaaaaaaa200000240012800b00010067726574617000001400028008000600640101000500130000000000"], 0x50}}, 0x0) socket(0x2000000000000021, 0x2, 0x10000000000002) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = socket$netlink(0x10, 0x3, 0x0) r3 = bpf$MAP_CREATE(0x0, &(0x7f00000002c0)=@base={0x15, 0x10, 0x4, 0xe7, 0x0, 0x1, 0x25f, '\x00', 0x0, 0xffffffffffffffff, 0x0, 0x1}, 0x50) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000000)={'macsec0\x00', 0x0}) ioctl$XFS_IOC_ATTRLIST_BY_HANDLE(r3, 0x4058587a, &(0x7f0000000440)={{r4, &(0x7f00000000c0)='GPL\x00', 0x205a40, &(0x7f0000000100)={@align, {0x4, 0x3, 0x4, 0x6}}, 0x3, &(0x7f0000000200)={@_ha_fsid}, &(0x7f0000000240)=0x8}, {[0x4, 0x1, 0xe49b, 0x9ce2]}, 0x2eb, 0x7c, &(0x7f00000003c0)=""/124}) ioctl$XFS_IOC_FD_TO_HANDLE(r3, 0xc038586a, &(0x7f00000006c0)={r3, &(0x7f0000000280)='}[/\xa4%/*\x00', 0xa001, &(0x7f0000000340)={@align, {0x7ff, 0x6, 0x3, 0x4}}, 0x10001, &(0x7f0000000380)={@_ha_fsid}, &(0x7f0000000680)=0xffffffff}) r8 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000700)={0x2, 0x4, 0x8, 0x1, 0x80, r7, 0x1, '\x00', 0x0, 0xffffffffffffffff, 0x2}, 0x50) bpf$PROG_LOAD(0x5, &(0x7f00000004c0)={0xd, 0x10, &(0x7f0000000580)=ANY=[@ANYBLOB="18050000000000000000000000000000b7080000000000007b8af8ff00000000b7080000000000007b8af0ff00000000bfa100000000000007010000f8ffffffbfa400000000000007040000f0ffffffb70200000800000018230000", @ANYRES32=r8, @ANYBLOB="0000000000000000b70400000800000085d5e8ca000000000000000995000000"], &(0x7f00000001c0)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sock_ops, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000002c0)=ANY=[@ANYBLOB="3c0000001000010010000002ffebdf2530000000", @ANYRES32=r6, @ANYBLOB="20000000000000001c0012800b0001006d616373656300000c00028005000f"], 0x3c}}, 0x0) sendmsg$nl_generic(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000001c0)=ANY=[@ANYBLOB="30000000410007012bbd700000000000037c00000400c2800c000180060006008847"], 0x30}, 0x1, 0x0, 0x0, 0x4048011}, 0xc000) bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0x16, 0x4, &(0x7f0000000040)=ANY=[@ANYBLOB="b400000000000000791090000000000007000000002000009500000000000000"], &(0x7f0000003ff6)='GPL\x00', 0x5, 0xfd90, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @flow_dissector, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x3f}, 0x48) 1.60064695s ago: executing program 3 (id=6547): r0 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r0, &(0x7f0000000040)={0x2, 0x4e22, @empty}, 0x67) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000000)='syz_tun\x00', 0x10) sendto$inet(r0, 0x0, 0x0, 0x20000800, &(0x7f0000000080)={0x2, 0x0, @remote}, 0x10) setsockopt$inet_int(0xffffffffffffffff, 0x0, 0x22, &(0x7f00000000c0)=0x2, 0x4) syz_emit_ethernet(0x186, &(0x7f00000001c0)={@local, @link_local, @void, {@ipv4={0x800, @generic={{0x24, 0x4, 0x1, 0x8, 0x178, 0x68, 0x0, 0x0, 0x67, 0x0, @broadcast, @dev={0xac, 0x14, 0x14, 0x30}, {[@ssrr={0x89, 0xb, 0xb7, [@broadcast, @rand_addr=0x64010102]}, @timestamp_prespec={0x44, 0x4c, 0xb4, 0x3, 0x0, [{@multicast2, 0x6}, {@multicast2, 0xffff}, {@private=0xa010102, 0x88}, {@broadcast, 0x6}, {@empty, 0x7fb1}, {@initdev={0xac, 0x1e, 0x0, 0x0}, 0x9}, {@loopback, 0x10001}, {@private=0xa010100, 0xb}, {@initdev={0xac, 0x1e, 0x0, 0x0}, 0x3961}]}, @rr={0x7, 0x17, 0xa0, [@dev={0xac, 0x14, 0x14, 0x43}, @private=0xa010102, @multicast2, @multicast2, @local]}, @end, @ssrr={0x89, 0xb, 0xaa, [@broadcast, @initdev={0xac, 0x1e, 0x0, 0x0}]}]}}, "c16e68447146cab84dec3282032d9daf82a36fcc5cd6b7286df452c13a70e075a4aad2d1aa7289508bc8728b987df9d02a4d595509fc3162bb2f99556c4948beb1c7352f11d608548b2792d91b111346807f1165186d8030aaebbb8f7e7c630743fbc7240729720176965e0b62f2a81050f6a27b961c3683ffd1118c1aaaa824babb79cc4166d18e80c996b99eb3ed3f666fe2dc010a6e942db984459f61d457a03df74660ce2d8bb02689e9b64425e49c324ee300e73af9cfb499cf16e955ee8ac0de12b4759833f00e58b4bcf8ce83984f170b620a7c05d406a1a6832c9f69f7228ba88326e305"}}}}, 0x0) syz_emit_ethernet(0x76, &(0x7f0000000640)={@local, @local, @void, {@ipv4={0x800, @tcp={{0x5, 0x4, 0x0, 0x0, 0x68, 0x0, 0x0, 0x0, 0x6, 0x0, @remote, @local}, {{0x0, 0x4e22, 0x41424344, 0x41424344, 0x0, 0x2, 0x15, 0x10, 0x0, 0x0, 0x0, {[@mptcp=@capable={0x1e, 0xc}, @mptcp=@syn={0x1e, 0xc}, @sack={0x5, 0x16, [0x0, 0x0, 0x0, 0x0, 0x0]}, @md5sig={0x13, 0x12, "a4bcbcee95c6179191d2675112a6689b"}]}}}}}}}, 0x0) 1.509171712s ago: executing program 2 (id=6548): r0 = socket$kcm(0x11, 0x200000000000002, 0x300) sendmsg$sock(r0, &(0x7f0000000840)={&(0x7f0000000340)=@tipc=@name={0x1e, 0x2, 0x3, {{0x40, 0x3}, 0xffffffff}}, 0x80, 0x0, 0x0, &(0x7f0000000000)=[@mark={{0x14, 0x1, 0x24, 0xff}}], 0x18}, 0x40812) r1 = socket$nl_route(0x10, 0x3, 0x0) getsockopt$inet6_mreq(0xffffffffffffffff, 0x29, 0x1c, &(0x7f0000000080)={@private2}, &(0x7f0000000100)=0x14) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000300)={'bridge0\x00', 0x0}) r3 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r3, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000040)=ANY=[@ANYBLOB="300000001c000100000000000000000007000000", @ANYRES32=r2, @ANYBLOB="c000b2000a0002000000000000000000060005002e5f"], 0x30}, 0x1, 0x0, 0x0, 0x40}, 0x40800) r4 = socket$netlink(0x10, 0x3, 0x0) r5 = socket$nl_netfilter(0x10, 0x3, 0xc) r6 = syz_genetlink_get_family_id$nl80211(&(0x7f00000003c0), 0xffffffffffffffff) r7 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r7, 0x8933, &(0x7f0000000180)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_NEW_KEY(r7, &(0x7f00000006c0)={0x0, 0x0, &(0x7f0000000680)={&(0x7f0000000000)={0x44, r6, 0x801, 0x400, 0x0, {{}, {@val={0x8, 0x3, r8}, @void}}, [@NL80211_ATTR_KEY={0x28, 0x50, 0x0, 0x1, [@NL80211_KEY_DATA_WEP104={0x11, 0x1, "4abee33908f8eef16f162471f4"}, @NL80211_KEY_IDX={0x5, 0x2, 0x2}, @NL80211_KEY_CIPHER={0x8, 0x3, 0xfac08}]}]}, 0x44}}, 0x0) socketpair(0x28, 0x80000, 0x356, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) setsockopt$MRT_ADD_MFC(r9, 0x0, 0xcc, &(0x7f0000000280)={@rand_addr=0x64010101, @initdev={0xac, 0x1e, 0x0, 0x0}, 0x0, "95c104a0fe5fb1694f49a0ef1f2ef9f0c936925c76253dbeedf5a58c1402d4fd", 0x8, 0x5, 0x5, 0x57}, 0x3c) sendmsg$NFT_BATCH(r5, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000003c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0) sendmsg$NFT_BATCH(r5, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000500)={{0x14}, [@NFT_MSG_NEWRULE={0x60, 0x6, 0xa, 0x409, 0x0, 0x0, {0x2, 0x0, 0x2}, [@NFTA_RULE_EXPRESSIONS={0x34, 0x4, 0x0, 0x1, [{0x30, 0x1, 0x0, 0x1, @immediate={{0xe}, @val={0x1c, 0x2, 0x0, 0x1, [@NFTA_IMMEDIATE_DATA={0x10, 0x2, 0x0, 0x1, [@NFTA_DATA_VERDICT={0xc, 0x2, 0x0, 0x1, [@NFTA_VERDICT_CODE={0x8, 0x1, 0x0, 0x1, 0xfffffffffffffffc}]}]}, @NFTA_IMMEDIATE_DREG={0x8}]}}}]}, @NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_RULE_CHAIN={0x9, 0x2, 'syz2\x00'}]}], {0x14}}, 0x88}}, 0x0) sendmsg$nl_route(r4, &(0x7f0000000240)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000340)=ANY=[@ANYBLOB="4c00000010001fff0d00"/20, @ANYRES8=r4, @ANYBLOB="0000000000000000240012800b000100697036746e6c000014000280050009002900000008000100", @ANYRES32, @ANYBLOB="080004"], 0x4c}, 0x1, 0x0, 0x0, 0x8cc}, 0x0) 1.138341058s ago: executing program 0 (id=6549): r0 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000040), 0xffffffffffffffff) r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$TIPC_NL_LINK_GET(r1, &(0x7f00000002c0)={0x0, 0x21, &(0x7f00000000c0)={&(0x7f0000000700)=ANY=[@ANYBLOB='|\x00\x00\x00', @ANYRES16=r0, @ANYBLOB="030700000000000000000800000068000480040007801300010062726f6164636173742d6c696e6b00001900078008000300000000000800020000000000080003000000000008000200000000000800030000000000040004"], 0x7c}}, 0x4) r2 = socket(0xa, 0x5, 0x0) sendmsg$inet_sctp(r2, &(0x7f00000000c0)={&(0x7f0000000000)=@in6={0xa, 0x4e24, 0xff, @loopback, 0x5}, 0x1c, &(0x7f0000000040)=[{&(0x7f0000000100)="e6", 0x1}], 0x1, &(0x7f0000000140)=[@dstaddrv4={0x18, 0x84, 0x7, @local}, @dstaddrv6={0x20, 0x84, 0x8, @rand_addr=' \x01\x00'}], 0x38, 0x4855}, 0x24000052) 1.12556396s ago: executing program 1 (id=6550): r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000001140)={&(0x7f0000000040)=@newlink={0x3c, 0x10, 0x421, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x1c, 0x12, 0x0, 0x1, @macvlan={{0xc}, {0x5, 0x2, 0x0, 0x1, [@IFLA_MACVLAN_BC_QUEUE_LEN={0x8}]}}}]}, 0x3c}}, 0x0) (async, rerun: 32) r1 = socket$netlink(0x10, 0x3, 0xa) (rerun: 32) writev(r1, &(0x7f0000000080)=[{&(0x7f00000000c0)="480000001500257f09004b01fcfc8c860a881300f217e0060000e3323909b8f8896e33719fe3bb036e0bc90900000000000000000000ffff5bf1090000d0bd5e000000006203005b", 0x48}], 0x1) 1.005171834s ago: executing program 2 (id=6551): r0 = socket(0x10, 0x3, 0x0) sendmsg$nl_generic(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000080)=ANY=[@ANYBLOB="180000001600010a"], 0x78}, 0x1, 0x0, 0x0, 0x8000}, 0x0) (async) recvmmsg(r0, &(0x7f0000000b00)=[{{0x0, 0x0, 0x0}, 0x8}, {{&(0x7f0000000480)=@l2tp={0x2, 0x0, @broadcast}, 0x80, &(0x7f0000000680)=[{&(0x7f00000005c0)=""/96, 0x60}, {&(0x7f0000000640)=""/33, 0x21}], 0x2, &(0x7f00000006c0)=""/151, 0x97}, 0x9}, {{&(0x7f0000000780)=@sco, 0x80, &(0x7f0000000800), 0x0, &(0x7f0000000840)=""/13, 0xd}, 0x1}], 0x3, 0x20, 0x0) (async) r1 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000001100)={0x1, 0x4, &(0x7f0000000f40)=ANY=[@ANYBLOB="18000000000000000000000000000000711073000000000095"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x22}, 0x90) syz_emit_ethernet(0x3e, &(0x7f00000002c0)=ANY=[@ANYBLOB="aaaaaaaaaaaaaaaaaaaaaabb88fb450000300000e00003000306907800fa00094570fff600650005010400030a0102ac1414aa00"/62], 0x0) (async) ioctl$XFS_IOC_ATTRMULTI_BY_HANDLE(r1, 0x4048587b, &(0x7f0000000440)={{r1, &(0x7f0000000000)='\x00', 0x200, &(0x7f0000000040)={@align=0x1383b107, {0x8, 0x638a, 0x6, 0x200}}, 0x294, &(0x7f0000000140), &(0x7f0000000180)=0x8}, 0x2, &(0x7f0000000300)=[{0x3, 0x2, &(0x7f00000001c0)='\x00', &(0x7f0000000200), 0x0, 0x18}, {0x1, 0x7, &(0x7f0000000240)='\x00', &(0x7f0000000280)="493a31baa5f9eff5635185f8cd404e498c818ec0553334585f0de04cdba6", 0x1e, 0x8}]}) (async) r3 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000500), 0xffffffffffffffff) sendmsg$MPTCP_PM_CMD_SUBFLOW_DESTROY(r2, &(0x7f00000005c0)={&(0x7f00000004c0)={0x10, 0x0, 0x0, 0x20000}, 0xc, &(0x7f0000000580)={&(0x7f0000000540)={0x1c, r3, 0x300, 0x70bd26, 0x25dfdbfb, {}, [@MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x7}]}, 0x1c}, 0x1, 0x0, 0x0, 0x404008c}, 0x10) (async, rerun: 64) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) (rerun: 64) sendmsg$NFT_BATCH(r4, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000340)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a010400000000000000000200000708000240000000020900010073797a31000000004c000000030a01040000000000000000020000070900010073797a31000000000900030073797a320000000014000480080001000000000308000200000000000b00070066696c746572000084000000060a01040000000000000000020000070900010073797a31000000000900020073797a320000000058000480540001800a0001006d61746368000000440002800b0001006e6661636374000008000200000000002c00030073797a30"], 0x120}}, 0x0) 956.259611ms ago: executing program 4 (id=6552): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000300), 0xffffffffffffffff) r2 = socket$nl_generic(0x10, 0x3, 0x10) recvmmsg(r2, &(0x7f0000001640)=[{{0x0, 0x0, &(0x7f0000000040)=[{&(0x7f00000004c0)=""/4096, 0xd58}, {&(0x7f00000000c0)=""/250, 0x4}], 0x2, 0x0, 0xd64}}], 0x300, 0x34000, 0x0) sendmsg$ETHTOOL_MSG_TSINFO_GET(r2, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000440)={&(0x7f0000000280)=ANY=[@ANYBLOB="18000000", @ANYRES16=r1, @ANYBLOB="a787000000ff000000000b00000404000180"], 0x18}, 0x1, 0x0, 0x0, 0x40000}, 0x0) sendmsg$ETHTOOL_MSG_RINGS_SET(r0, &(0x7f0000000340)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f0000000280)={&(0x7f0000000240)={0x24, r1, 0x200, 0x70bd2a, 0x25dfdbfe, {}, [@ETHTOOL_A_RINGS_TX={0x8, 0x9, 0x70c}, @ETHTOOL_A_RINGS_TX={0x8, 0x9, 0xfffffeff}]}, 0x24}, 0x1, 0x0, 0x0, 0x800}, 0x24040084) r3 = socket(0x11, 0x3, 0x300) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000380)={0x11, 0x3, &(0x7f0000000100)=@framed, &(0x7f0000000000)='syzkaller\x00', 0x4, 0xa9, &(0x7f0000000180)=""/169}, 0x80) r4 = socket$nl_generic(0x10, 0x3, 0x10) r5 = syz_genetlink_get_family_id$nl80211(&(0x7f00000000c0), 0xffffffffffffffff) sendmsg$NL80211_CMD_REQ_SET_REG(r4, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000180)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r5, @ANYBLOB="010000000000deff00001b20000008009a00"], 0x1c}}, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000100)={'hsr0\x00', 0x0}) sendto$packet(r3, &(0x7f0000000140)="01154e0001000011221e4455892fca01000188fb", 0x1c, 0x4044015, &(0x7f0000000040)={0x11, 0x0, r6, 0x0, 0x0, 0x0}, 0x14) 882.906327ms ago: executing program 0 (id=6553): r0 = syz_init_net_socket$802154_raw(0x24, 0x3, 0x0) setsockopt$SO_TIMESTAMPING(r0, 0x1, 0x41, &(0x7f0000000080)=0x49bb, 0x4) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) r2 = socket$inet6_mptcp(0xa, 0x1, 0x106) bind$inet6(r1, &(0x7f0000000040)={0xa, 0x4e22, 0x77c, @empty, 0x1}, 0x1c) listen(r2, 0x0) socket$inet_mptcp(0x2, 0x1, 0x106) r3 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r3, &(0x7f0000000280)={0x2, 0x4e21, @local}, 0x10) setsockopt$inet_tcp_TCP_CONGESTION(r3, 0x6, 0xd, &(0x7f0000000040)='htcp', 0x4) connect$inet(r3, &(0x7f0000000180)={0x2, 0x4e21, @local}, 0x10) r4 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000100)={'lo\x00', 0x0}) sendmsg$nl_route_sched(r4, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000400)=@newqdisc={0x4c, 0x24, 0x4ee4e6a52ff56541, 0x40000, 0x25dfdbfb, {0x0, 0x0, 0x0, r5, {0x0, 0xb}, {0xffff, 0xffff}, {0x3, 0xfff3}}, [@qdisc_kind_options=@q_netem={{0xa}, {0x1c, 0x2, {{0x6, 0x6b7, 0x80, 0x0, 0x1, 0x91b1}}}}]}, 0x4c}, 0x1, 0x0, 0x0, 0x4000400}, 0x24000000) sendto$inet(r3, 0x0, 0x0, 0x12, 0x0, 0x0) recvfrom$inet(r3, &(0x7f0000000080), 0xffffffffffffffa9, 0xc9100120, 0x0, 0x1500) 823.351103ms ago: executing program 1 (id=6554): r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$phonet(0x23, 0x2, 0x1) ioctl$sock_proto_private(r1, 0x89ee, &(0x7f0000007880)="0ecd") sendmsg$nl_route(r0, &(0x7f0000000000)={&(0x7f0000000040), 0xc, &(0x7f0000000100)={&(0x7f00000000c0)=ANY=[@ANYRES8=r0], 0x5c}}, 0x0) socket$nl_route(0x10, 0x3, 0x0) (async) socket$phonet(0x23, 0x2, 0x1) (async) ioctl$sock_proto_private(r1, 0x89ee, &(0x7f0000007880)="0ecd") (async) sendmsg$nl_route(r0, &(0x7f0000000000)={&(0x7f0000000040), 0xc, &(0x7f0000000100)={&(0x7f00000000c0)=ANY=[@ANYRES8=r0], 0x5c}}, 0x0) (async) 750.608535ms ago: executing program 0 (id=6555): r0 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl80211(&(0x7f0000000000), r0) (async) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000040)='veth1_to_team\x00', 0x10) (async) r1 = accept$packet(0xffffffffffffffff, &(0x7f0000000080)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @link_local}, &(0x7f00000000c0)=0x14) (async) bpf$BPF_GET_PROG_INFO(0xf, &(0x7f00000003c0)={0xffffffffffffffff, 0xe0, &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xa, &(0x7f0000000100)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], ""/16, 0x0, 0x0, 0x0, 0x0, 0x4, 0x1, &(0x7f0000000140)=[0x0, 0x0, 0x0, 0x0], &(0x7f0000000180)=[0x0], 0x0, 0x4f, &(0x7f00000001c0)=[{}, {}], 0x10, 0x10, &(0x7f0000000200), &(0x7f0000000240), 0x8, 0x9f, 0x8, 0x8, &(0x7f0000000280)}}, 0x10) bind$packet(r1, &(0x7f0000000400)={0x11, 0x4, r2, 0x1, 0x78, 0x6, @remote}, 0x14) (async) ioctl$XFS_IOC_PATH_TO_HANDLE(r0, 0xc0385869, &(0x7f0000000540)={r0, &(0x7f0000000440)='veth1_to_team\x00', 0x100, &(0x7f0000000480)={@align=0x99, {0x6, 0x5, 0xd0, 0x10001}}, 0x1, &(0x7f00000004c0), &(0x7f0000000500)=0x8001}) r4 = syz_genetlink_get_family_id$fou(&(0x7f00000005c0), r0) sendmsg$FOU_CMD_ADD(r3, &(0x7f0000000680)={&(0x7f0000000580)={0x10, 0x0, 0x0, 0x10000000}, 0xc, &(0x7f0000000640)={&(0x7f0000000600)={0x1c, r4, 0x10, 0x70bd29, 0x25dfdbfc, {}, [@FOU_ATTR_LOCAL_V4={0x8, 0x6, @private=0xa010102}]}, 0x1c}, 0x1, 0x0, 0x0, 0x8084}, 0x48000) (async) getsockopt$inet_sctp6_SCTP_AUTH_ACTIVE_KEY(r3, 0x84, 0x18, &(0x7f00000006c0)={0x0, 0x6}, &(0x7f0000000700)=0x8) setsockopt$inet_sctp6_SCTP_DELAYED_SACK(r3, 0x84, 0x10, &(0x7f0000000740)=@sack_info={r5, 0xbb, 0x40}, 0xc) (async) r6 = socket$inet_tcp(0x2, 0x1, 0x0) getsockopt$inet_mreqsrc(r6, 0x0, 0x27, &(0x7f0000000780)={@empty, @initdev, @empty}, &(0x7f00000007c0)=0xc) (async) sendmsg$unix(r3, &(0x7f0000000d00)={0x0, 0x0, &(0x7f0000000c40)=[{&(0x7f0000000800)="a157264adce1754dc014de662e56e62d580f7251a7482c0e38b016ff7d29d3d69690e98f9ad43dca2fd66a204ba6e57f408e6bfb8e70fd8aebd9b76a321c47b325de0eeeaf7b7c15feffc3d815ec3a84577a43b9dfb4", 0x56}, {&(0x7f0000000880)="76a70848d46190b9376b800f92c8b8cae36f2c0f50cdfea74ab4820e0bea909c8987f2279ba5f2f9418c863d5d8f682b53836ea0972868b25f00b1fdaf41df803fbe5e6600385af8b3e195", 0x4b}, {&(0x7f0000000900)="5bce81ebca03b07109a77cc1698f01539b22774b69bf05ee746543fc3b5155a004dee81bb632621a08227172a4a929c3362b84ff20ca475aba22c75cecb5afc4755f15b9e72ab54def7ebf3487d663dc1e9f03da3c425420d4dd7160c520614e36b4c7521a9d431620cecd90d5d531341466bbb39bd486dc984c2167fc1d010e974639713af3164042526af5", 0x8c}, {&(0x7f00000009c0)="165d308fd6e594282ab82a7568647b9505ee42b2d7486b1066d2286369f113f09a1c91ef757db7e7551c6e47e93955a0d673c8012290953e614e15e776d429b2dd5d7202bdd3c5843543d9bacf16392d39ef6c5c50708f6af1820db9a93dbdfaeb68f750d20bc048db5601e94ad42a71459c8673735e58a1cbe20ed96f56f09e4fe5444bb0454dce83f55b83ef91eeeb87623bf623ba26bf7fbfd197", 0x9c}, {&(0x7f0000000a80)="068199cf7b4358585e440e1ccfda264b93620c027b2056335b8cdb5f21fefd97647cfc3918ab8925d048e49c6318ed7d0ca4cdd9cfe29c35578abb2f87f5a4750205d0185b4eab504494f410abd29407f98d5e840de8957d304b6e641bc2707d77766687b77106402a4c30555cc470c13d664fcf19a0a3e5399d36e43443617f9fb05525afce32a85c66082a4fad45d3883d5a317056a3d39d15ad2be199918282af0f24de019fb96914f7defe7710a8667d0d34dc23087aaa0376d145b65e8736b724c823c7828cd71e16611ba758b9390fe968bb29e7f7facc33d044a22989a23a90122e7cbc32b931851a7a597ee8b9571ac8b4", 0xf5}, {&(0x7f0000000b80)="1acd2b400f06fd9dd97c23ebc2e94a55cbb178005e1e8d99846eacec53e9e3ef81c7f76d1d81d7d68c72e34cc0d986576cb6848e40b72fa524c04a7e24e2af3a96daef605ecda7eed1a7c6452538a2a224cbeffe2bc246fa1606e3b83412810d6a4cb666834f7bbdca2fb8e2842eb2dcd8ea6d35c107772042ecd67b419e9cbb8d1acaf08ae39bd39d5c0652aa56e2f8060e7aa744", 0x95}], 0x6, &(0x7f0000000cc0), 0x0, 0x28004091}, 0x4044) r7 = openat$6lowpan_enable(0xffffffffffffff9c, &(0x7f0000000d40), 0x2, 0x0) (async) r8 = syz_genetlink_get_family_id$devlink(&(0x7f0000000dc0), r0) sendmsg$DEVLINK_CMD_SB_OCC_SNAPSHOT(r3, &(0x7f0000000f00)={&(0x7f0000000d80)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f0000000ec0)={&(0x7f0000000e00)={0x88, r8, 0x120, 0x70bd27, 0x25dfdbfe, {}, [{@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, {0x8, 0xb, 0x3}}, {@pci={{0x8}, {0x11}}, {0x8, 0xb, 0x9}}, {@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, {0x8}}]}, 0x88}, 0x1, 0x0, 0x0, 0x2400c080}, 0x20000005) (async) sendmsg$IPSET_CMD_ADD(r3, &(0x7f0000001000)={&(0x7f0000000f40), 0xc, &(0x7f0000000fc0)={&(0x7f0000000f80)={0x1c, 0x9, 0x6, 0x0, 0x0, 0x0, {0xa, 0x0, 0x6}, [@IPSET_ATTR_PROTOCOL={0x5}]}, 0x1c}}, 0x0) (async) getsockopt$sock_cred(r1, 0x1, 0x11, &(0x7f0000001040)={0x0}, &(0x7f0000001080)=0xc) write$cgroup_pid(r3, &(0x7f00000010c0)=r9, 0x12) r10 = getpid() write$cgroup_pid(r3, &(0x7f0000001100)=r10, 0x12) (async) r11 = syz_genetlink_get_family_id$ipvs(&(0x7f0000001180), r3) sendmsg$IPVS_CMD_ZERO(r0, &(0x7f0000001280)={&(0x7f0000001140)={0x10, 0x0, 0x0, 0x2000}, 0xc, &(0x7f0000001240)={&(0x7f00000011c0)={0x74, r11, 0x800, 0x70bd2c, 0x25dfdbff, {}, [@IPVS_CMD_ATTR_SERVICE={0x28, 0x1, 0x0, 0x1, [@IPVS_SVC_ATTR_PE_NAME={0x8}, @IPVS_SVC_ATTR_SCHED_NAME={0x7, 0x6, 'sh\x00'}, @IPVS_SVC_ATTR_NETMASK={0x8, 0x9, 0x2c}, @IPVS_SVC_ATTR_FLAGS={0xc, 0x7, {0x11, 0x2}}]}, @IPVS_CMD_ATTR_DEST={0x30, 0x2, 0x0, 0x1, [@IPVS_DEST_ATTR_ADDR={0x14, 0x1, @ipv4=@private=0xa010100}, @IPVS_DEST_ATTR_FWD_METHOD={0x8, 0x3, 0x4}, @IPVS_DEST_ATTR_TUN_FLAGS={0x6, 0xf, 0x81}, @IPVS_DEST_ATTR_TUN_PORT={0x6, 0xe, 0x4e20}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5, 0x67e}]}, 0x74}, 0x1, 0x0, 0x0, 0x20000010}, 0x4) sendmsg$OSF_MSG_REMOVE(r3, &(0x7f00000015c0)={&(0x7f00000012c0)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f0000001580)={&(0x7f0000001300)={0x268, 0x1, 0x5, 0x3, 0x0, 0x0, {0xa}, [{{0x254, 0x1, {{0x2, 0x2}, 0x7, 0x6, 0x6, 0x4, 0xd, 'syz1\x00', "f9cbde919570b8d0fa878c712677eeb818c64eb6ae5d705669f7bfa84c762d69", "3a9bdcd231777951b3fa1ad87be8944ba96c3946335b0675a2ba3279628b7cac", [{0x1c, 0x100, {0x1, 0x400}}, {0x800, 0x0, {0x3}}, {0x1, 0x5, {0x2, 0x87}}, {0x3, 0xd33b, {0x3, 0x7}}, {0x0, 0xd0, {0x0, 0x101}}, {0xc, 0x6, {0x2, 0x7}}, {0x2, 0x7, {0x0, 0x2}}, {0x0, 0x38, {0x2, 0x8001}}, {0x5, 0x81, {0x1, 0x1}}, {0x10, 0x8, {0x5, 0x2}}, {0x8764, 0x2, {0x0, 0x8}}, {0xa, 0x8, {0x1, 0x1}}, {0x0, 0x5, {0x0, 0x1}}, {0x1, 0x0, {0x1, 0x7ff}}, {0xe40, 0x1, {0x2, 0x50}}, {0x0, 0x7ef0, {0x1, 0x60}}, {0x5, 0x0, {0x2, 0x7}}, {0x3, 0x9875, {0x0, 0x5}}, {0x0, 0x5, {0x1, 0x100}}, {0x0, 0x1, {0x1, 0x3}}, {0xd, 0x7f, {0x1, 0x667}}, {0x5, 0x7, {0x1, 0x1000}}, {0x8, 0x6, {0x2, 0x1ff}}, {0x9, 0x8001, {0x2, 0x2}}, {0x6, 0xfffd, {0x3, 0x1}}, {0xf0e2, 0x1, {0x1, 0x140}}, {0x7, 0x5, {0x3, 0x5}}, {0x5969, 0x3, {0x2, 0x93c}}, {0xbe, 0x9, {0x1, 0x822}}, {0x2, 0xff17, {0x1, 0x3c0}}, {0x9, 0x9, {0x1, 0x1}}, {0xfd, 0x8000, {0x0, 0x9}}, {0x1, 0x4, {0x2, 0xe6d}}, {0x7, 0x4, {0x0, 0x4}}, {0xe9, 0x4, {0x3, 0x4}}, {0x275b, 0x4c0, {0x3, 0x8}}, {0x7ff, 0xffff, {0x3, 0xd}}, {0x1, 0x400, {0x2, 0x10000}}, {0xefc0, 0x400, {0x2, 0xdeae6542}}, {0x9, 0x7, {0x1, 0x3}}]}}}]}, 0x268}, 0x1, 0x0, 0x0, 0x4000}, 0x40c0) (async) ioctl$sock_inet_SIOCSARP(r3, 0x8955, &(0x7f0000001600)={{0x2, 0x4e20, @local}, {0x6, @remote}, 0x4, {0x2, 0x4e22, @dev={0xac, 0x14, 0x14, 0x8}}, 'wlan1\x00'}) (async) ioctl$sock_TIOCINQ(r6, 0x541b, &(0x7f0000001680)) (async) write$tun(r3, &(0x7f00000016c0)={@void, @val={0x0, 0x0, 0x2, 0x4, 0x6, 0x20}, @ipv6=@icmpv6={0x5, 0x6, "0ab7ae", 0x15a, 0x3a, 0x0, @private2, @private2={0xfc, 0x2, '\x00', 0x1}, {[@routing={0x3a, 0x6, 0x0, 0x11, 0x0, [@loopback, @local, @local]}, @srh={0x5c, 0x12, 0x4, 0x9, 0x3, 0x50, 0x3, [@private1, @mcast1, @ipv4={'\x00', '\xff\xff', @local}, @private2={0xfc, 0x2, '\x00', 0xee}, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, @mcast1, @empty, @private2={0xfc, 0x2, '\x00', 0x1}, @loopback]}, @fragment={0x2b, 0x0, 0x83, 0x1, 0x0, 0x1d, 0x64}], @echo_reply={0x81, 0x0, 0x0, 0x9027, 0x5, "89bdccc9658fa0cb7add5f4b70bcbe817f16f946a3542b7a75276ed1332b6d21a4d35ac70f9788401a2f2741bac2c1b9d64a258c7270e0f4a4917932a499a9b74d066e2f6da5100d8c66d8597a9b2a37e9870c77af09f481617e79ab447a4ab6d1766c7747e835c4aa05e1d5c61707f58df71fd8cbf73121270b"}}}}, 0x18c) (async) ioctl$F2FS_IOC_DECOMPRESS_FILE(r7, 0xf517, 0x0) (async) ioctl$XFS_IOC_ERROR_INJECTION(r3, 0x40085874, &(0x7f0000001880)={r3}) 671.052767ms ago: executing program 1 (id=6556): r0 = bpf$PROG_LOAD_XDP(0x5, &(0x7f0000003ac0)={0x6, 0x3, &(0x7f0000000680)=ANY=[@ANYBLOB="1800000002000000000000000000000095"], &(0x7f0000000140)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x40}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000600)={r0, 0x5, 0xd50, 0xfffffffffffffee0, &(0x7f0000000000)="259a53f271a76d2608004c6588a8", 0x0, 0xd01, 0x2a0, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x48) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000140)=@newtfilter={0x34, 0x2c, 0xf3f, 0x70bd2a, 0x25dfdbfd, {0x0, 0x0, 0x0, 0x0, {0xb, 0xfff3}, {0x7, 0xfff3}, {0xb, 0x306}}, [@filter_kind_options=@f_basic={{0xa}, {0x4}}]}, 0x34}, 0x1, 0x0, 0x0, 0x20041090}, 0x0) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r1, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f000000c280)={&(0x7f0000000100)=ANY=[@ANYBLOB="140000001000010000000000001100000000000a20000000000a01010000000000000000050000080900010073797a30000000005c000000030a03000000000000000000050000000900010073797a30000000000900030073797a300000000008000c40000000032800048008000240000000120800014000000000140004"], 0xa4}}, 0x0) 670.047146ms ago: executing program 4 (id=6557): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) (async) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000140)=@newqdisc={0x24, 0x24, 0xd0f, 0xfffffffd, 0xffffffff, {0x60, 0x0, 0x0, 0x0, {0xffe6, 0x2}, {0xfff2, 0x10}, {0xd, 0x1a}}}, 0x24}, 0x1, 0x0, 0x0, 0x4000844}, 0x2000c8c1) (async) r1 = openat$nci(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) socket$nl_generic(0x10, 0x3, 0x10) (async) syz_genetlink_get_family_id$devlink(0x0, 0xffffffffffffffff) (async) sendmsg$IPSET_CMD_CREATE(0xffffffffffffffff, 0x0, 0x0) r2 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$nfc(&(0x7f0000000100), r2) (async, rerun: 64) ioctl$IOCTL_GET_NCIDEV_IDX(r1, 0x0, &(0x7f00000000c0)=0x0) (rerun: 64) sendmsg$NFC_CMD_DEV_UP(r2, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000d80)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r3, @ANYBLOB="010426bd7000f8dbdf250200000008000100", @ANYRES32=r4], 0x1c}}, 0x4008054) (async) write$nci(r1, &(0x7f0000000240)=ANY=[@ANYBLOB='p\x00\t'], 0xc) (async) write$nci(r1, 0x0, 0x6a) (async) r5 = socket$nl_generic(0x10, 0x3, 0x10) r6 = syz_genetlink_get_family_id$mptcp(&(0x7f00000001c0), r5) sendmsg$MPTCP_PM_CMD_FLUSH_ADDRS(r5, &(0x7f0000000500)={0x0, 0x0, &(0x7f00000004c0)={&(0x7f00000003c0)={0x14, r6, 0x1, 0x70bd27, 0x25dfdbfb}, 0x14}, 0x1, 0x0, 0x0, 0x20000850}, 0x28044042) (async) r7 = socket(0x10, 0x803, 0x0) (async, rerun: 64) setsockopt$inet6_MCAST_MSFILTER(0xffffffffffffffff, 0x29, 0x30, 0x0, 0x110) (rerun: 64) sendmsg$nl_route_sched(r7, 0x0, 0x24040084) (async, rerun: 64) write$nci(r1, &(0x7f0000000540)=ANY=[@ANYBLOB="60060409"], 0x16) (async, rerun: 64) unshare(0x20000400) r8 = accept4(0xffffffffffffffff, 0x0, 0x0, 0x0) sendmmsg$alg(r8, 0x0, 0x0, 0x20000814) (async) r9 = bpf$PROG_LOAD_XDP(0x5, 0x0, 0x0) sendfile(r8, r9, 0x0, 0x1) r10 = socket$nl_netfilter(0x10, 0x3, 0xc) r11 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r11, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[@ANYRES32=r11], 0x7c}, 0x1, 0x0, 0x0, 0x4810}, 0x0) sendmsg$NFT_BATCH(r10, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f0000000100)={{0x14}, [@NFT_MSG_NEWRULE={0x58, 0x6, 0xa, 0x401, 0x0, 0x0, {0xa, 0x0, 0x1}, [@NFTA_RULE_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_RULE_EXPRESSIONS={0x2c, 0x4, 0x0, 0x1, [{0x28, 0x1, 0x0, 0x1, @ct={{0x7}, @val={0x1c, 0x2, 0x0, 0x1, [@NFTA_CT_DIRECTION={0x5, 0x3, 0x1}, @NFTA_CT_KEY={0x8, 0x2, 0x1, 0x0, 0x9}, @NFTA_CT_DREG={0x8, 0x1, 0x1, 0x0, 0x9}]}}}]}, @NFTA_RULE_CHAIN={0x9, 0x2, 'syz2\x00'}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x2}}}, 0x80}, 0x1, 0x0, 0x0, 0x4008091}, 0x24000000) (async, rerun: 32) syz_emit_ethernet(0x66, &(0x7f0000000280)={@random="e33110495bfd", @dev={'\xaa\xaa\xaa\xaa\xaa', 0xc}, @val={@val={0x88a8, 0x6, 0x1, 0x4}, {0x8100, 0x6, 0x1, 0x3}}, {@ipv6={0x86dd, @icmpv6={0x0, 0x6, "04003e", 0x28, 0x3a, 0x0, @private1={0xfc, 0x1, '\x00', 0x1}, @mcast2, {[], @ndisc_redir={0x89, 0x0, 0x0, '\x00', @rand_addr=' \x01\x00', @private1}}}}}}, 0x0) (async, rerun: 32) sendmsg$IPSET_CMD_CREATE(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000044c0)={&(0x7f0000000700)=ANY=[@ANYBLOB="6000000002060500000000000000000007000000140007800800114000000040080012400000ffff0500010006000800050005000a00000005000400000000000900020073797a310000000011000300686173683a6970"], 0x60}, 0x1, 0x0, 0x0, 0x810}, 0x20004000) 669.758032ms ago: executing program 2 (id=6558): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) sendmsg$can_j1939(0xffffffffffffffff, 0x0, 0x40) setsockopt$inet6_tcp_int(r0, 0x6, 0x13, &(0x7f0000000040)=0x100000001, 0x4) connect$inet6(r0, &(0x7f0000000080)={0xa, 0x0, 0x0, @loopback}, 0x1c) (async) setsockopt$inet6_tcp_TCP_ULP(r0, 0x6, 0x1f, &(0x7f00000002c0), 0xffb2) setsockopt$inet6_tcp_TLS_TX(r0, 0x11a, 0x2, &(0x7f0000000280)=@gcm_256={{0x304}, "00e1ffffff00", "5985e81ad0d9585bc175cbecd3f55eb699e3ee0bc206f3ba527c85bde06fbf19", '\x00', '\x00\x00\x00\f\x00'}, 0x38) (async) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000580)='cpuacct.usage_all\x00', 0x275a, 0x0) write$cgroup_subtree(r1, &(0x7f0000000000)=ANY=[], 0x3261e) (async, rerun: 64) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x2000001, 0x12, r1, 0x0) (async, rerun: 64) setsockopt$inet6_tcp_TLS_TX(r0, 0x11a, 0x4, &(0x7f00000000c0)=@gcm_128={{0x304}, "cdbef90c18b633a0", "fa07b3a2d40586d364f360be6df53598", "7eb00b44", "e598980949a58c71"}, 0x28) (async, rerun: 64) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) (rerun: 64) sendmsg$NFT_BATCH(r2, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000100)={{0x14}, [@NFT_MSG_NEWTABLE={0x20, 0x0, 0xa, 0x401, 0x0, 0x0, {0x1, 0x0, 0x3}, [@NFTA_TABLE_NAME={0x9, 0x1, 'syz0\x00'}]}, @NFT_MSG_NEWCHAIN={0x2c, 0x3, 0xa, 0x101, 0x0, 0x0, {0x1}, [@NFTA_CHAIN_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_CHAIN_NAME={0x9, 0x3, 'syz2\x00'}]}, @NFT_MSG_NEWRULE={0xa0, 0x6, 0xa, 0x401, 0x0, 0x0, {0x1, 0x0, 0x2}, [@NFTA_RULE_CHAIN_ID={0x8}, @NFTA_RULE_EXPRESSIONS={0x78, 0x4, 0x0, 0x1, [{0x34, 0x1, 0x0, 0x1, @exthdr={{0xb}, @val={0x24, 0x2, 0x0, 0x1, [@NFTA_EXTHDR_DREG={0x8, 0x1, 0x1, 0x0, 0xc}, @NFTA_EXTHDR_OFFSET={0x8, 0x3, 0x1, 0x0, 0x2}, @NFTA_EXTHDR_LEN={0x8, 0x4, 0x1, 0x0, 0x22}, @NFTA_EXTHDR_TYPE={0x5, 0x2, 0x7}]}}}, {0x40, 0x1, 0x0, 0x1, @bitwise={{0xc}, @val={0x30, 0x2, 0x0, 0x1, [@NFTA_BITWISE_LEN={0x8, 0x3, 0x1, 0x0, 0x2}, @NFTA_BITWISE_SREG={0x8, 0x1, 0x1, 0x0, 0x14}, @NFTA_BITWISE_DREG={0x8, 0x2, 0x1, 0x0, 0x12}, @NFTA_BITWISE_DATA={0xc, 0x7, 0x0, 0x1, [@NFTA_DATA_VALUE={0x8, 0x1, "60ec6972"}]}, @NFTA_BITWISE_OP={0x8, 0x6, 0x1, 0x0, 0x2}]}}}]}, @NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x7}}}, 0x114}}, 0x0) (async, rerun: 64) r3 = socket$nl_route(0x10, 0x3, 0x0) (rerun: 64) sendmsg$nl_route(r3, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000240)=@newlink={0x3c, 0x10, 0x403, 0x3, 0x0, {0x0, 0x0, 0x0, 0x0, 0x90646, 0x1080}, [@IFLA_LINKINFO={0x1c, 0x12, 0x0, 0x1, @bond={{0x9}, {0xc, 0x2, 0x0, 0x1, [@IFLA_BOND_ACTIVE_SLAVE={0x8}]}}}]}, 0x3c}, 0x1, 0x0, 0x0, 0x44680}, 0x20048040) 624.567007ms ago: executing program 0 (id=6559): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000004c0)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x2}}, [@NFT_MSG_NEWTABLE={0x20, 0x0, 0xa, 0x801, 0x0, 0x0, {0x1, 0x0, 0xfffc}, [@NFTA_TABLE_NAME={0x9, 0x1, 'syz0\x00'}]}, @NFT_MSG_NEWCHAIN={0x2c, 0x3, 0xa, 0x101, 0x0, 0x0, {0x1}, [@NFTA_CHAIN_NAME={0x9, 0x3, 'syz0\x00'}, @NFTA_CHAIN_TABLE={0x9, 0x1, 'syz0\x00'}]}, @NFT_MSG_NEWRULE={0x4c, 0x6, 0xa, 0x401, 0x0, 0x0, {0x1}, [@NFTA_RULE_EXPRESSIONS={0x28, 0x4, 0x0, 0x1, [{0x24, 0x1, 0x0, 0x1, @socket={{0xb}, @val={0x14, 0x2, 0x0, 0x1, [@NFTA_SOCKET_DREG={0x8, 0x2, 0x1, 0x0, 0x1}, @NFTA_SOCKET_KEY={0x8, 0x1, 0x1, 0x0, 0x3}]}}}]}, @NFTA_RULE_CHAIN_ID={0x8}, @NFTA_RULE_ID={0x8, 0x9, 0x1, 0x0, 0x3}]}], {0x14}}, 0xc0}, 0x1, 0x0, 0x0, 0x4008000}, 0x0) (async) sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000004c0)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x2}}, [@NFT_MSG_NEWTABLE={0x20, 0x0, 0xa, 0x801, 0x0, 0x0, {0x1, 0x0, 0xfffc}, [@NFTA_TABLE_NAME={0x9, 0x1, 'syz0\x00'}]}, @NFT_MSG_NEWCHAIN={0x2c, 0x3, 0xa, 0x101, 0x0, 0x0, {0x1}, [@NFTA_CHAIN_NAME={0x9, 0x3, 'syz0\x00'}, @NFTA_CHAIN_TABLE={0x9, 0x1, 'syz0\x00'}]}, @NFT_MSG_NEWRULE={0x4c, 0x6, 0xa, 0x401, 0x0, 0x0, {0x1}, [@NFTA_RULE_EXPRESSIONS={0x28, 0x4, 0x0, 0x1, [{0x24, 0x1, 0x0, 0x1, @socket={{0xb}, @val={0x14, 0x2, 0x0, 0x1, [@NFTA_SOCKET_DREG={0x8, 0x2, 0x1, 0x0, 0x1}, @NFTA_SOCKET_KEY={0x8, 0x1, 0x1, 0x0, 0x3}]}}}]}, @NFTA_RULE_CHAIN_ID={0x8}, @NFTA_RULE_ID={0x8, 0x9, 0x1, 0x0, 0x3}]}], {0x14}}, 0xc0}, 0x1, 0x0, 0x0, 0x4008000}, 0x0) r1 = bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=@base={0xb, 0x8, 0xc, 0x3, 0x1}, 0x50) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='memory.events\x00', 0x275a, 0x0) (async) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='memory.events\x00', 0x275a, 0x0) writev(r2, &(0x7f0000000000)=[{&(0x7f0000000200)="4647b4f3", 0x4}], 0x1) (async) writev(r2, &(0x7f0000000000)=[{&(0x7f0000000200)="4647b4f3", 0x4}], 0x1) mmap(&(0x7f0000000000/0x4000)=nil, 0x4000, 0x1, 0x10012, r2, 0x0) r3 = syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x0) r4 = socket$nl_crypto(0x10, 0x3, 0x15) sendmsg$nl_crypto(r4, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000200)=ANY=[@ANYBLOB="f0000000120003"], 0xf0}, 0x1, 0x0, 0x0, 0x8000}, 0x44040) bind$bt_l2cap(r3, &(0x7f0000000000)={0x1f, 0x0, @any, 0x0, 0x1}, 0xe) r5 = socket(0x10, 0x3, 0x0) setsockopt$netlink_NETLINK_TX_RING(r5, 0x10e, 0xc, &(0x7f0000000040)={0xffffff, 0x0, 0x0, 0x4}, 0x10) write(r5, &(0x7f0000000000)="240000001a00590214f9f407000904101f00000000000000000200000800040001000000", 0x24) ioctl$FICLONE(r5, 0x40049409, r5) (async) ioctl$FICLONE(r5, 0x40049409, r5) socket$kcm(0x11, 0x3, 0x0) (async) r6 = socket$kcm(0x11, 0x3, 0x0) setsockopt$sock_attach_bpf(r6, 0x107, 0xf, &(0x7f0000000000), 0x4) syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0) (async) r7 = syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0) sendmsg$802154_dgram(r7, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={0x0}, 0x7}, 0x4040815) sendmsg$kcm(r6, &(0x7f00000000c0)={&(0x7f0000000100)=@hci={0x1f, 0x0, 0x5}, 0x80, &(0x7f0000000500)=[{&(0x7f0000000040)="2703022b590200330000002f1eafbcf706e1050000008848000f1102ee16005782973d2bd4b82b4a8291a14b8a34f90186cee844000000080000000019b0fb0bba", 0x41}, {&(0x7f0000000440)="63f805d76494961172959832930469edc7b7d050139bf7ada32bc9e37eed1153ecb716cdb8981cd819af0b33254465cc904b7b31789d65c0e0d3333ce2ef36205dd154e363bcadf8f2ea93f45503c6d9fd8dfe5a638cfeb9f79c930a4d18260e5a08ffd35ed8371cff78119319b2b62c7cd9378c73ae90c801681f55ef26cb0000000000000000", 0x87}, {&(0x7f0000000280)="fe112162c63e6da8bc8432294ef18af53cc330a62a2c7035246635093ba4d30fcf19a90804f04a10939db8f4e13069cda6d167bf1b68c94d8d694d6ad1a4d51a715975560ad48770706eb1b88d021e1119f2eb75275cfe77f862368649be0f7aff5e7826729816e3d3e7986d9434f891c71ca6e4210c6757083cfd8e732048c504f28b6d309fc129ed8eb5a82e224eb648f90134d1d315977c6ea360a7fece4baa3dd7dcc970759f29df0e86469e954e2b050e87b203ca27a2a519b7555c3b73f2681d49442d9647ff5ea64110cc5020fdeafe53a7d8be70f3260816bc376bcdc5352771fa55d9733e27730ec7103520e8359c78edd21ee6c68feb3685a55722f5da09ffe8ba9f05081a8d214156376f99906245f2f390ad717979d98f0574f8c5b52dcc2fa494f461be6c2560ddbaafb80c5b4583cbe56d24f14ab78fd718947077ea736251c7b8eee267267534c84daa6f095e94bfb85986a03ddea362cc7e6682884e710727c1163cd4f336c13b844605b7a815fe39e43bd0d2e414410a82958455b8a6bd9194c631d66295675fed64c04107a595c421111a3af6e9fadab5c9", 0x1a1}, {&(0x7f0000000180)="6fe4dd9eeba3271dc700b581440284", 0xfe69}], 0x4}, 0x0) (async) sendmsg$kcm(r6, &(0x7f00000000c0)={&(0x7f0000000100)=@hci={0x1f, 0x0, 0x5}, 0x80, &(0x7f0000000500)=[{&(0x7f0000000040)="2703022b590200330000002f1eafbcf706e1050000008848000f1102ee16005782973d2bd4b82b4a8291a14b8a34f90186cee844000000080000000019b0fb0bba", 0x41}, {&(0x7f0000000440)="63f805d76494961172959832930469edc7b7d050139bf7ada32bc9e37eed1153ecb716cdb8981cd819af0b33254465cc904b7b31789d65c0e0d3333ce2ef36205dd154e363bcadf8f2ea93f45503c6d9fd8dfe5a638cfeb9f79c930a4d18260e5a08ffd35ed8371cff78119319b2b62c7cd9378c73ae90c801681f55ef26cb0000000000000000", 0x87}, {&(0x7f0000000280)="fe112162c63e6da8bc8432294ef18af53cc330a62a2c7035246635093ba4d30fcf19a90804f04a10939db8f4e13069cda6d167bf1b68c94d8d694d6ad1a4d51a715975560ad48770706eb1b88d021e1119f2eb75275cfe77f862368649be0f7aff5e7826729816e3d3e7986d9434f891c71ca6e4210c6757083cfd8e732048c504f28b6d309fc129ed8eb5a82e224eb648f90134d1d315977c6ea360a7fece4baa3dd7dcc970759f29df0e86469e954e2b050e87b203ca27a2a519b7555c3b73f2681d49442d9647ff5ea64110cc5020fdeafe53a7d8be70f3260816bc376bcdc5352771fa55d9733e27730ec7103520e8359c78edd21ee6c68feb3685a55722f5da09ffe8ba9f05081a8d214156376f99906245f2f390ad717979d98f0574f8c5b52dcc2fa494f461be6c2560ddbaafb80c5b4583cbe56d24f14ab78fd718947077ea736251c7b8eee267267534c84daa6f095e94bfb85986a03ddea362cc7e6682884e710727c1163cd4f336c13b844605b7a815fe39e43bd0d2e414410a82958455b8a6bd9194c631d66295675fed64c04107a595c421111a3af6e9fadab5c9", 0x1a1}, {&(0x7f0000000180)="6fe4dd9eeba3271dc700b581440284", 0xfe69}], 0x4}, 0x0) r8 = socket$nl_netfilter(0x10, 0x3, 0xc) setsockopt$SO_ATTACH_FILTER(r8, 0x1, 0x1a, &(0x7f0000000240)={0x2, &(0x7f0000000400)=[{0x28, 0x0, 0x0, 0xffffefff}, {0x6, 0x0, 0x0, 0x6}]}, 0x10) sendmsg$IPCTNL_MSG_CT_GET_DYING(r8, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000040)={0x14, 0x6, 0x1, 0x101, 0x0, 0x0, {0x2, 0x0, 0x2}}, 0x14}, 0x1, 0x0, 0x0, 0x4000000}, 0x10) (async) sendmsg$IPCTNL_MSG_CT_GET_DYING(r8, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000040)={0x14, 0x6, 0x1, 0x101, 0x0, 0x0, {0x2, 0x0, 0x2}}, 0x14}, 0x1, 0x0, 0x0, 0x4000000}, 0x10) bpf$MAP_UPDATE_BATCH(0x1a, &(0x7f0000000240)={0x0, 0x0, &(0x7f00000000c0), &(0x7f0000000140), 0x5, r1}, 0x38) bpf$MAP_GET_NEXT_KEY(0x4, &(0x7f0000000040)={r1, &(0x7f0000000140), &(0x7f0000000000)=""/48}, 0x20) 621.602475ms ago: executing program 3 (id=6560): r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000003c0)={'bond0\x00', 0x0}) r2 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000000), 0xc0802, 0x0) ioctl$PPPIOCNEWUNIT(r2, 0xc004743e, &(0x7f00000000c0)) ioctl$PPPIOCSMAXCID(r2, 0x40047451, &(0x7f0000000200)=0x8) ioctl$PPPIOCSFLAGS1(r2, 0x40047459, &(0x7f0000000100)=0x4) pwritev(r2, &(0x7f0000000080)=[{&(0x7f0000000240)="00214500002c00000000400600000a0000010a000002005000060000000100000001601003e80000000001010101", 0x2e}], 0x1, 0x0, 0x0) pwritev(r2, &(0x7f0000000080)=[{&(0x7f00000003c0)="00214500002c00000000400600000a0000010a0000020050005000000001000b0018601003e80000000001010103", 0x2e}], 0x1, 0x0, 0x2) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r0, 0x8933, &(0x7f0000000200)={'batadv0\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000140)=@newlink={0x50, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x21}, [@IFLA_MASTER={0x8, 0xa, r3}, @IFLA_LINKINFO={0x28, 0x12, 0x0, 0x1, @hsr={{0x8}, {0x1c, 0x2, 0x0, 0x1, [@IFLA_HSR_SLAVE1={0x8, 0x1, r1}, @IFLA_HSR_SLAVE2={0x8, 0x2, r3}, @IFLA_HSR_PROTOCOL={0x5, 0x7, 0x1}]}}}]}, 0x50}, 0x1, 0x0, 0x0, 0x20040000}, 0x0) 186.858596ms ago: executing program 0 (id=6561): r0 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f0000000740)=ANY=[@ANYBLOB="03000000054eb84e040000000a00000000000000", @ANYRES32=0x0, @ANYBLOB='\x00'/20, @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB='\x00'/28], 0x48) bpf$PROG_LOAD(0x5, &(0x7f0000000880)={0x3, 0x10, &(0x7f0000000000)=ANY=[@ANYBLOB="1806000000000000000000000000000018120000", @ANYRES32=r0, @ANYBLOB="0000000000000000b703000013000000850000000c000000b707000000000000180100002020702500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000000600000095"], &(0x7f0000000980)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sched_cls, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) r2 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) socket$pppoe(0x18, 0x1, 0x0) bind$bt_hci(r2, &(0x7f0000000040)={0x1f, 0x0, 0x1}, 0x6) r3 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$HCIINQUIRY(r3, 0x400448ca, 0x0) sendmsg$NFT_BATCH(r1, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000440)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000017c0)={0xe, 0xe, &(0x7f0000001880)=ANY=[@ANYBLOB="b700000081000000bfa300000000000007030000f1feffff720af0fff8ffffff71a4f0ff0000000071109700000000007d400500000000002604000001ed00000f030000000000007c440000000000006b0a00fe000000007203000000000006b5000000000000009500000000000000023bc065b58111c6dfa041b63af4a3912435f18564a710aad58db6a693002e7f3be361917adef6ee1c8a2a4f8ef1e50becb19bc461e91a7168c50000000190f32050e436fe275daf51efd601b6bf01c8e8b1b526375ec4dd6fcd82e4fe51bef7af9aa0d7d600c095199fe3ff3128e599b0eaebbdbd732c9cc00eec363e4a8f6456e2cc21557c26fc646cb7798b3e6440c2fbdb00a3e35208b0bb0d2cd829e654400e2438ec649dc74a28610643a98d9ec21ead2ed51b104d4d91af25b845d8a7925c3109b151b8b9f75dd08d123deda88c658d42ecbf28bf7076c15b463bebc72f526d8e8afcb913466aaa7f6df70252e79166d858fcd0e06dd31af9612f2460d0b11008e59a5923906f88b53987ad1714e72ba7a54f0c33d39000d06a59ff616236fd9aa58f2477184b6a89adaf17b0a6041bdef728d236619074d6ebdfd1f5089048ddff6da40f9411fe722631cb467600ade70063e5291569b33d21dae356e1c51f03a801be8189679a16da18ec0ae564162a27afea62d84f3a10746443d6438e959532e0617d419c6bc6ea9f2bca4464f56e24e6d2105bd901204a1deeed4155617572652d950ad31928b0b0c3dc2869f478341d02d0f5ad94b081fcd507acb4b9c65fee9d5a17f48a7382f13d000000225d85ae49cee383dc5049076b989b40000000000000da60d2ae20cfb91d6a49964757cdf538f9ce2bdb1ab062cd54e67011d355d84ce97bb0c6b4a595e487efbb2d71cde2c140952f9a0f0bc6980fe78683ac5c0c31032599ddd71063be9261b2e1aab1675b34a22048ef8c126aeef5f510a8f1aded94a129e4aec6f8d9ab06faffc3a15d96c2ea3e2e04cfe031b2875353193f82ade69d0540059fe6c7fe7cd8697502c7596566d674e425da5e87e59602a9f6590521d31d3804b3e0a1053abdc31282dfb15eb6841bb64a1b304502dda787343ce3c953992e4a982f3c48153baae244e7bf37548c7f1a4cad2422ee965a38f7defbd2160242b104e20dc2d9b0c35608d402ccc99069bd50b994fda7a9de44028d6112a0c2d21b2dc98816106dec28eaeb883418f562ae00003ea96d10f172c0374d6eed826416050000000bfe9b4a9c5a90ff59d54d1f92ecc4e95dd2d18383117c039862198899b212c55318294270a1ad10c80fef7c24d47afce829ba0f85da6d888f18ea40ab959f6074ab2a40d85d15017ab513cdc6c0e57fb1c1ca571380d7b4ead35a385e0b4a26b702396df7e0c1e02b6e4114f244a9bf93f04bf072f0861f7580e69db384ac7eeedcf2ba1a9508f9d6aba582a896a9f1ffa968eacea75caf822a7a63ba34015ea5aacb1188883ad24b89b6a3b1832371fe5bc621426d1ed0a4a99702cc1b6912a1e717d29135753208165b9cdbae2ed9dc7358f0ebadde0b727f27feeb744ddcc536cbae315c7d1fe1399562ba6824840bd2951680f6f2f9a6a8346962a350845ffa0d829e4f79adc287906943408e6df3c391e97ba48db0a5adbfd03aac93df8866fb010aec0e92bed1fe39af169d2a466f0db6f3d9436a7d55fc30511d00e10000c95265b2bd83d64a532869d701723fedcbada1ee7baa5b6a686b50f0937f778af083e055f6138a757ebd0ed91124a6b244f9acf41ac5d73a008364e0606a594817031fc2f52c87852730a3bd7ac923fe0721719b3d654026c6ea08b83b123145ab5703dad844ceb201ddeb6dc5f6a903792283c42efc54fa84323afc4c10eff462c8843187f1dd48ef3fa293774d582956ff0f40b10ca94f6feeb2893c17888e1cdba94a6ea80c33ead5722c3293a493f1479531dd88261458f40d31fe8df15efaaeea831555877f9538d6ee6ba65893ff1f908ba7554ba583fef3ec7932f5954f31a878e2fae6691d1aee1da02ba516467df3e7d1daac43738012e4fee18a22da19fcdb4c2890cda1f96b952511e3a69d694d625e0b2f808890205f3a6da2819d2f9e77c7c64affa54fec0136cbafa5f6f096753b639a924599c1f69219927ea5301fff0a6063d427f0688430754c02180d61542c2571f983e9673560000000000000000005a7b57f03ca91a01ba2e30ca99e8ebc15ecb4d91675767999d146aef7799738b292fd640dfef6b04d086f737a159d7e0c6e4d81ad64a8bbca4856ff03b2969e2b15f36b788bce5ccdbaf75c94cb93499f6947a967a7bce14c6de4e7c0660d80010f5c653d22d490cba8c2a4ab595bf4238f18ca428dafc7ac96d404607a0000000051a2104f22e6db5a62b5089c1b45282d38864daa3ae81d6b0968d1d2867b91b7d120617d12d91db2633d6864da40b54783a17aaeb6737c323f9f98e354cc98dcfe23ad01bd1c61563e69ffe1c2c73e16e1461173f359e93d2c5e424c17998809ec8f0232b3955e052a4cecd89008f70314a0bdd491ec860cde7c79f7b4d4e24c62e8e3ed8bcb45202c3d4bbec8d722824c0ebca8db1ea4a003d2fbdc1f9be78537756ab5bbe4fe9af5d785d0128171c90d9900ce2532b0f9d01c4b450100000001000000393cb4e62e754598e47df6bd06431c94bc5d047899fd219f448bf9189c65c9d91eda6b52a373803a9efe44f86909bc90addb7b9aee813df534aac4b3093c91b8068cd84990453f006694d461b76a58d88cf0f520310a1e80dc18cde98d662eee077515d0a8811922929e085392ab3d1311b8243266d87047f601fa88a0da36b9f302e8262395174328f2482d14008de83070744f143fdec90ba5a82668d5fac114c13955ad6dca5db2231d8ba14c54c47ed04a4b4ace17e357e1d6432399f87a7a14245bbd796a09313b247b95d37ff40a404bdad74bd20000000000000000000099fef7cd7af3ce64a92f95d89d125b1e641240d7e5e27a3d1f7684448c3e3822d617e205061298b939a191be4b48e169bde2cae3accc5bd40a2968b59c93d35f8e42366fdef9a2abae1cf01ce68abff28861aac8302d268569dd42e194e330c7aaa54ebbcefd23f21ce8153b9926e12e925cb56119df72c7533a48d028ad0c74e2a9478fa3be18a1a2b65079cc1c00400000000000f59dd19e8d525206c0a728cfd42193abe8130bc01a2d69841f3d7799ac04bdc590bb1c89b9c695f163e57343c9bfb59909433c9001c5f8b23e38534a538fc933cac6c2a92d038df638a0f226df9fb857bd414c2cd69985e8053e3dfa41614d7c74d04d8c2471041d17c730fad28395f8d4688898cd58b9d600c851626529bb58aa364b55e73f053450665e7b94ed1012fd7a8139166fd599c028db4cb9680c8035f967db18de738844da7e260a830c1ffa49f5af3c15423a0e315acb82a3e89218cb314e68fda4d94aa1d815babc13b9fd336d205c5913ef67cf0216e2d81e6127bd9d7fab28800eaab2355992f8ce4cd38add4b272c0bee4076ca4847ffa691cf78fb7ec212bad3bef29f577ea7159b7f3025b3d977ff7c91024cf71126233cb80610eb37bd2d40ebdfed687f0b093e68f10b72146a0b749ee2105e2da94a288146abbbaf7c0b24fe0000000000000000f1a4f4de6a8d12dc9e71a20cbd412898586843b534d36e21379a8a06133c1babde9e5bd5b6afc5f684aada43ee560e800f58cb33b8483f6518abde7c86bd5d389c1b3c40fdd4bebe4adf87b1025ff57eb50984cc5bad9ea1c15484ea627c3c1501d612ed65939266e7332966f03e0376076e7c5dfe25f367dda7f69db89829b360dd2f59cbaad10f13e269eca792725bbacb96aa0a5c426ca76f84322661"], &(0x7f00000001c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sk_skb, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x0, 0x10, &(0x7f0000000000), 0xffa3}, 0x48) bind$bt_hci(r3, &(0x7f0000000080)={0x1f, 0xffffffffffffffff, 0x2}, 0x6) sendmsg$NFT_BATCH(r1, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000b00)={&(0x7f0000003980)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a64000000060a010400000000000000000200000038000480340001800c0001007061796c6f6164002400028008000440000000010800014000000001080003401900000008000240000000000900010073797a30000000000900020073797a32"], 0x8c}, 0x1, 0x0, 0x0, 0x20044000}, 0x0) r4 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) poll(&(0x7f0000000040)=[{r4, 0x16842e9bd142d0d5}], 0x1, 0x94) syz_emit_ethernet(0x36, &(0x7f0000000100)=ANY=[@ANYRES16=0x0], 0x0) 163.720295ms ago: executing program 1 (id=6562): r0 = openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, 0x0) r1 = socket(0x400000000010, 0x3, 0x0) r2 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r1, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000005c0)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0xffffffff, {0x0, 0x0, 0x0, r3, {0x0, 0xfff1}, {0xffff, 0xffff}, {0x0, 0x2}}, [@qdisc_kind_options=@q_multiq={{0xb}, {0x8, 0x2, {0x0, 0x3}}}]}, 0x38}, 0x1, 0x0, 0x0, 0x1}, 0x8000) sendmsg$nl_route_sched(r1, &(0x7f0000000580)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000840)=@newtfilter={0x24, 0x2c, 0xd27, 0x70bd2d, 0x25dfdc00, {0x0, 0x0, 0x0, r3, {0x0, 0x3}, {}, {0xfff3, 0xffe0}}}, 0x24}, 0x1, 0x0, 0x0, 0x50}, 0x0) r4 = socket(0x400000000010, 0x3, 0x0) r5 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r4, &(0x7f0000006040)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000006080)=@delchain={0x24, 0x66, 0x221, 0x70bd2c, 0x25dfdbff, {0x0, 0x0, 0x0, r6, {0x0, 0xfff3}, {}, {0xb, 0xffff}}}, 0x24}, 0x1, 0x0, 0x0, 0x8048}, 0x20004800) syz_genetlink_get_family_id$ethtool(&(0x7f0000000340), r4) (fail_nth: 11) 1.577588ms ago: executing program 3 (id=6563): r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='memory.events\x00', 0x275a, 0x0) sendmmsg$inet6(0xffffffffffffffff, &(0x7f0000000640)=[{{&(0x7f0000000180)={0xa, 0x0, 0x0, @mcast1}, 0x1c, 0x0}}], 0x1, 0x0) write$cgroup_subtree(r0, &(0x7f0000000100)=ANY=[], 0x32600) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x2000001, 0x12, r0, 0x0) r1 = socket$phonet_pipe(0x23, 0x5, 0x2) bpf$MAP_UPDATE_BATCH(0x1a, &(0x7f0000000500)={&(0x7f0000000200)="45106ddb8bce53a8683a248d6052d7bde6d281b2d261dae884f3a9c11a09d53b8fcb4be5e44067983272d7681537423671eee25d1d45fa06f1d9dab9de3c9c77d43f9eb239a1da9f5896d5f775fd916a8f9c7f63bd07ecbaec10e454300e73f224500fa708d722f3357fa506a7eb97baf5f7650a4878d2d7b54585e0fb4c3d7181592d51d9eee6936afba4efe21a7de25cbde2057702192ac97e6933dda55a72945af4ba0218fcfd586fd7bdcd964493d7d60b61e3be6724ca1b5e82139f79fb2609116fb8a64682c290917f544319e682b2f9bf592b53463ac19af78687bf53a3a8597105ea5f707efb915d239895d58dafd4eec4504f", &(0x7f0000000300)=""/184, &(0x7f00000003c0)="5a717ba9f98e844bfb1a2f7879529650aa1fc98cbc672ff1d29b61c09a541018bd1375593b6ca89cd0967c1f0740d8945688996712771a48fd9bf94c8d2eaee0c74e535617252e3e40288fc7cf8ecfe739cf8ce3e743ac53c632f0a1b5adf3ea6dadff14a5622c745749d25627115933506279ba5f986e1c9987f583a27864e0cf931bb85db3821dc3d2e272f99b2e99f31ccb390b048513f62e13e6fd2b47bc4137924462896994ea84692a1bc02d74c12da613d33fcd7ea3e6d4097c40c6b709c143855bbd9f45fffb92", &(0x7f00000004c0)="5098e70aec616537e64094931185c730480b91008e1859ae86", 0xfffffff2, r0}, 0x38) getsockopt$PNPIPE_ENCAP(r1, 0x113, 0x1, 0x0, &(0x7f0000000080)) getsockopt$inet_sctp_SCTP_NODELAY(r0, 0x84, 0x3, &(0x7f0000000000), &(0x7f0000000040)=0x4) ioctl$OCFS2_IOC_RESVSP(r0, 0x40305828, &(0x7f00000000c0)={0x1, 0x2, 0xa1d, 0x7, 0x0, 0x34}) 0s ago: executing program 2 (id=6564): r0 = bpf$PROG_LOAD(0x5, &(0x7f0000000440)={0x7, 0x6, &(0x7f0000000000)=@framed={{0x5, 0x0, 0x0, 0x0, 0x0, 0x71, 0x11, 0xaa}, [@func={0x85, 0x0, 0x1, 0x0, 0x2}, @call={0x85, 0x0, 0x0, 0x2a}, @exit], {0x95, 0x0, 0x5a5}}, &(0x7f0000000080)='GPL\x00', 0x5, 0x29e, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x6}, 0x70) r1 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f00000000c0)={0x1b, 0x0, 0x0, 0x4, 0x0, 0xffffffffffffffff, 0x4a3c, '\x00', 0x0, 0xffffffffffffffff, 0x5, 0x5, 0x2}, 0x50) r2 = bpf$ITER_CREATE(0x21, &(0x7f0000000140), 0x8) ioctl$sock_ipv6_tunnel_SIOCADDTUNNEL(0xffffffffffffffff, 0x89f1, &(0x7f0000000340)={'ip6tnl0\x00', &(0x7f00000002c0)={'syztnl0\x00', 0x0, 0x4, 0x2, 0x7, 0x3, 0x20, @private1={0xfc, 0x1, '\x00', 0x1}, @dev={0xfe, 0x80, '\x00', 0x1c}, 0x8000, 0x10, 0x4, 0x6}}) ioctl$XFS_IOC_FD_TO_HANDLE(r0, 0xc038586a, &(0x7f0000000540)={r0, &(0x7f0000000380)='\'\\\xc0s^\'&m^.\x00', 0x28080, &(0x7f00000003c0)={@align=0x4, {0x4, 0x0, 0xe0, 0xe0}}, 0x1, &(0x7f0000000400)={@_ha_fsid}, &(0x7f0000000500)=0x9}) r5 = bpf$MAP_CREATE(0x0, &(0x7f0000000640)=ANY=[@ANYBLOB="17000000000000000400000003"], 0x48) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000a40)={0x3, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r5], 0x0, 0x0, 0x0, 0x0, 0x41100}, 0x94) r6 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r6, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x0) sendmsg$NFT_BATCH(r6, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f0000000680)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x5}}, [@NFT_MSG_NEWSET={0x44, 0x9, 0xa, 0x401, 0x0, 0x0, {0xa, 0x0, 0x4}, [@NFTA_SET_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_SET_KEY_LEN={0x8, 0x5, 0x1, 0x0, 0x2}, @NFTA_SET_NAME={0x9, 0x2, 'syz1\x00'}, @NFTA_SET_ID={0x8, 0xa, 0x1, 0x0, 0xfffffffc}, @NFTA_SET_FLAGS={0x8, 0x3, 0x1, 0x0, 0x4}]}, @NFT_MSG_NEWSETELEM={0x40, 0xc, 0xa, 0x101, 0x0, 0x0, {0xa, 0x0, 0x6}, [@NFTA_SET_ELEM_LIST_SET={0x9, 0x2, 'syz1\x00'}, @NFTA_SET_ELEM_LIST_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_SET_ELEM_LIST_ELEMENTS={0x14, 0x3, 0x0, 0x1, [{0x10, 0x0, 0x0, 0x1, [@NFTA_SET_ELEM_KEY={0xc, 0x1, 0x0, 0x1, [@NFTA_DATA_VALUE={0x6, 0x1, "d103"}]}]}]}]}, @NFT_MSG_DELTABLE={0x14, 0x2, 0xa, 0x201, 0x0, 0x0, {0x0, 0x0, 0x2}}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x1}}}, 0xc0}, 0x1, 0x0, 0x0, 0x4000850}, 0x40) bpf$ITER_CREATE(0x21, &(0x7f0000000040)={r4}, 0x8) sendmsg$RDMA_NLDEV_CMD_DELLINK(r2, &(0x7f0000000940)={&(0x7f0000000880)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f0000000900)={&(0x7f0000000980)=ANY=[@ANYBLOB="28000000041400012abd7000fddbdf25080001000000000008000100010000000800010000000000da32e799f9b823d50aae221b8c1dc8142a2a087af65a9cd537b5a5528c1de8ecc4d6fe785ecf483c38673d6836b46146ed2efeb148f744f8f4d059da78e7503969ae08fde857461d0f6ec0cfe9b6bc0f1ebe39d052d69ef5675c0a"], 0x28}, 0x1, 0x0, 0x0, 0x880}, 0x4000040) r7 = bpf$MAP_CREATE(0x0, &(0x7f00000005c0)=ANY=[@ANYBLOB="1200000000000000e10000000700000010e40400", @ANYRES32=0x1, @ANYBLOB="e4000000d17d020045edae820000000000000000", @ANYRES32=0x0, @ANYRES32, @ANYBLOB="04000000030000000500"/20, @ANYRES32, @ANYBLOB='\x00\x00\x00\x00'], 0x50) r8 = bpf$MAP_CREATE(0x0, &(0x7f0000000740)=ANY=[@ANYBLOB="0b00000005000000000400000900000001"], 0x48) r9 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000d80)={0x18, 0x5, &(0x7f0000000480)=ANY=[@ANYBLOB="1801000021"], 0x0, 0x40, 0x0, 0x0, 0x0, 0xb4a02fe0ce239f93, '\x00', 0x0, 0x2}, 0x94) recvfrom(r4, &(0x7f0000000b00)=""/250, 0xfa, 0x40010022, &(0x7f0000000c00)=@can={0x1d, r3}, 0x80) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0xe, 0x0, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000800000000000000000000018110000", @ANYRES32=r8], 0x0, 0x0, 0x0, 0x0, 0x41100, 0x59, '\x00', 0x0, @fallback=0x2a, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, r9, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$MAP_UPDATE_CONST_STR(0x2, &(0x7f00000006c0)={{0xffffffffffffffff, 0xffffffffffffffff}, &(0x7f0000000640), &(0x7f0000000680)='%-010d \x00'}, 0x20) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000640)={0x1e, 0x4, &(0x7f0000000040)=@framed={{}, [@ldst={0x1, 0x2, 0x3, 0x2, 0x1, 0x31}]}, &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x24}, 0x80) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000007c0)={0x18, 0x1c, &(0x7f0000000180)=@ringbuf={{0x18, 0x0, 0x0, 0x0, 0xfffffffa, 0x0, 0x0, 0x0, 0x7}, {{0x18, 0x1, 0x1, 0x0, r1}}, {}, [@ldst={0x1, 0x2, 0x0, 0x0, 0xa, 0x40}, @map_fd={0x18, 0x2, 0x1, 0x0, r2}, @printk={@s, {}, {}, {}, {}, {0x7, 0x0, 0xb, 0x3, 0x0, 0x0, 0xffff}}, @map_idx={0x18, 0x2, 0x5, 0x0, 0xa}], {{}, {0x7, 0x0, 0xb, 0x2, 0x0, 0x0, 0x1}, {0x85, 0x0, 0x0, 0x85}}}, &(0x7f0000000280)='GPL\x00', 0x94f, 0x0, 0x0, 0x41100, 0x35, '\x00', r3, 0x0, r4, 0x8, &(0x7f0000000580)={0x5, 0x3}, 0x8, 0x10, 0x0, 0x0, 0x0, 0x0, 0x7, &(0x7f0000000700)=[r5, r7, r8, r10], &(0x7f0000000740)=[{0x5, 0x4, 0x2, 0x3}, {0x5, 0x2, 0x0, 0x7}, {0x2, 0x5, 0x5, 0x9}, {0x4, 0x4, 0x1, 0x2}, {0x5, 0x1, 0x3, 0xa}, {0x5, 0x1, 0x1, 0x7}, {0x1, 0x5, 0xc, 0xa}], 0x10, 0xd9}, 0x94) close(0x3) kernel console output (not intermixed with test programs): et option. [ 721.336955][T26810] Use struct sctp_sack_info instead [ 721.553956][T26831] netlink: 112 bytes leftover after parsing attributes in process `syz.4.5379'. [ 722.264127][T26867] netlink: 'syz.3.5386': attribute type 2 has an invalid length. [ 723.396100][ T6886] net_ratelimit: 48 callbacks suppressed [ 723.399196][ T6886] bond3: (slave ip6gretap0): link status up, enabling it in 0 ms [ 723.399226][ T6886] bond3: (slave ip6gretap0): failed to get link speed/duplex [ 723.515896][ T6890] bond3: (slave ip6gretap0): link status up, enabling it in 0 ms [ 723.515940][ T6890] bond3: (slave ip6gretap0): failed to get link speed/duplex [ 723.626949][ T6886] bond3: (slave ip6gretap0): link status up, enabling it in 0 ms [ 723.627004][ T6886] bond3: (slave ip6gretap0): failed to get link speed/duplex [ 723.736059][ T6890] bond3: (slave ip6gretap0): link status up, enabling it in 0 ms [ 723.736102][ T6890] bond3: (slave ip6gretap0): failed to get link speed/duplex [ 723.846411][ T1104] bond3: (slave ip6gretap0): link status up, enabling it in 0 ms [ 723.850224][ T1104] bond3: (slave ip6gretap0): failed to get link speed/duplex [ 724.572741][T26833] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 724.572928][T26837] netlink: 256 bytes leftover after parsing attributes in process `syz.2.5378'. [ 724.779077][T26885] IPVS: ip_vs_edit_dest(): lower threshold is higher than upper threshold [ 724.815047][T26889] IPVS: ip_vs_edit_dest(): lower threshold is higher than upper threshold [ 724.976645][T26897] netlink: 76 bytes leftover after parsing attributes in process `syz.1.5395'. [ 725.001224][T26905] netlink: 256 bytes leftover after parsing attributes in process `syz.0.5396'. [ 725.001269][T26905] netlink: 'syz.0.5396': attribute type 9 has an invalid length. [ 725.093147][T26912] netlink: 68 bytes leftover after parsing attributes in process `syz.4.5399'. [ 725.096169][T26912] netlink: 'syz.4.5399': attribute type 13 has an invalid length. [ 725.096186][T26912] netlink: 4 bytes leftover after parsing attributes in process `syz.4.5399'. [ 725.096619][T26912] netlink: 'syz.4.5399': attribute type 13 has an invalid length. [ 725.096632][T26912] netlink: 4 bytes leftover after parsing attributes in process `syz.4.5399'. [ 725.291690][T26919] netlink: 'syz.1.5404': attribute type 39 has an invalid length. [ 725.386110][T26924] netlink: 40 bytes leftover after parsing attributes in process `syz.0.5401'. [ 725.398345][T26928] netlink: 666 bytes leftover after parsing attributes in process `syz.4.5403'. [ 725.471460][T26930] netlink: 52 bytes leftover after parsing attributes in process `syz.3.5405'. [ 725.471505][T26930] netlink: 52 bytes leftover after parsing attributes in process `syz.3.5405'. [ 725.969779][T26949] netlink: 'syz.1.5412': attribute type 3 has an invalid length. [ 726.435138][T26949] netlink: 'syz.1.5412': attribute type 2 has an invalid length. [ 726.468537][T26972] netlink: 'syz.3.5416': attribute type 39 has an invalid length. [ 726.563388][T26974] netlink: 'syz.4.5417': attribute type 3 has an invalid length. [ 726.585304][T26977] IPVS: sync thread started: state = MASTER, mcast_ifn = veth1_to_team, syncid = 4, id = 0 [ 726.888142][T26988] netlink: 'syz.2.5421': attribute type 1 has an invalid length. [ 726.934454][T26988] 8021q: adding VLAN 0 to HW filter on device bond8 [ 726.961859][T26988] bond8: up delay (136) is not a multiple of miimon (100), value rounded to 100 ms [ 726.968283][T26990] netlink: 'syz.0.5423': attribute type 1 has an invalid length. [ 726.998107][T26988] bond8: entered allmulticast mode [ 727.093223][T26988] bond8: (slave ip6gretap1): Enslaving as an active interface with an up link [ 727.167157][T26996] veth15: entered allmulticast mode [ 727.189105][T26996] bond9: (slave veth15): Enslaving as an active interface with a down link [ 727.200237][T26990] hsr_slave_0: left promiscuous mode [ 727.207704][T26990] hsr_slave_1: left promiscuous mode [ 727.353620][ T6890] smc: removing ib device syz1 [ 727.409775][T26996] bond1: (slave veth0_to_bond): Releasing active interface [ 727.418195][T26996] veth3: entered promiscuous mode [ 727.439840][T26996] bond9: (slave veth0_to_bond): making interface the new active one [ 727.451790][T26996] bond9: (slave veth0_to_bond): Enslaving as an active interface with an up link [ 727.464314][T21100] wg1 speed is unknown, defaulting to 1000 [ 727.464443][T21100] syz1: Port: 1 Link DOWN [ 727.477696][ T6890] smbdirect: ib_dev[syz1] removed [ 727.504368][T26990] macvlan3: entered promiscuous mode [ 727.510321][T26990] macvlan3: entered allmulticast mode [ 727.516548][T26990] bond9: entered promiscuous mode [ 727.521828][T26990] veth0_to_bond: entered promiscuous mode [ 727.532360][T26990] 8021q: adding VLAN 0 to HW filter on device macvlan3 [ 727.538776][T26990] bond9: (slave macvlan3): the slave hw address is in use by the bond; couldn't find a slave with a free hw address to give it (this should not have happened) [ 727.538931][T26990] bond9: left promiscuous mode [ 727.538945][T26990] veth0_to_bond: left promiscuous mode [ 728.003068][T27030] bridge_slave_0: left allmulticast mode [ 728.003112][T27030] bridge_slave_0: left promiscuous mode [ 728.003368][T27030] bridge0: port 1(bridge_slave_0) entered disabled state [ 728.065510][T27030] bridge_slave_1: left promiscuous mode [ 728.065785][T27030] bridge0: port 2(bridge_slave_1) entered disabled state [ 728.118346][T27030] bond0: (slave bond_slave_0): Releasing backup interface [ 728.231773][T27030] bond0: (slave bond_slave_1): Releasing backup interface [ 728.384972][T27030] team0: Port device team_slave_0 removed [ 728.407097][ T6886] net_ratelimit: 147 callbacks suppressed [ 728.407147][ T6886] bond3: (slave ip6gretap0): link status up, enabling it in 0 ms [ 728.427379][ T50] bond3: (slave ip6gretap0): link status up, enabling it in 0 ms [ 728.448608][ T50] bond3: (slave ip6gretap0): link status up, enabling it in 0 ms [ 728.465672][T27030] team0: Port device team_slave_1 removed [ 728.467397][ T6886] bond3: (slave ip6gretap0): link status up, enabling it in 0 ms [ 728.474746][T27030] A link change request failed with some changes committed already. Interface hsr_slave_0 may have been left with an inconsistent configuration, please check. [ 728.475478][T27034] team0: Mode changed to "roundrobin" [ 728.487283][ T50] bond3: (slave ip6gretap0): link status up, enabling it in 0 ms [ 728.515262][ T203] bond3: (slave ip6gretap0): link status up, enabling it in 0 ms [ 728.525864][ T1104] bond3: (slave ip6gretap0): link status up, enabling it in 0 ms [ 728.548486][ T6874] bond3: (slave ip6gretap0): link status up, enabling it in 0 ms [ 728.565820][ T203] bond3: (slave ip6gretap0): link status up, enabling it in 0 ms [ 728.708405][T27046] bond9: option lacp_rate: mode dependency failed, not supported in mode broadcast(3) [ 728.731213][T27046] bond9 (unregistering): Released all slaves [ 728.919904][T27047] ÿ: renamed from veth1_vlan (while UP) [ 729.598170][T27075] bond10: option xmit_hash_policy: invalid value (64) [ 729.611658][T27075] bond10 (unregistering): Released all slaves [ 729.898264][T27080] bond10: option xmit_hash_policy: invalid value (64) [ 729.922377][T27080] bond10 (unregistering): Released all slaves [ 730.331735][T27101] veth1_to_bond: entered allmulticast mode [ 730.372939][T27101] __nla_validate_parse: 11 callbacks suppressed [ 730.372994][T27101] netlink: 4 bytes leftover after parsing attributes in process `syz.3.5453'. [ 730.428711][T27101] veth1_to_bond (unregistering): left allmulticast mode [ 730.582880][T27107] netlink: 12 bytes leftover after parsing attributes in process `syz.2.5455'. [ 730.709124][T27114] netlink: 60 bytes leftover after parsing attributes in process `syz.3.5456'. [ 730.711391][T27114] netlink: 60 bytes leftover after parsing attributes in process `syz.3.5456'. [ 730.716605][T27114] validate_nla: 2 callbacks suppressed [ 730.716622][T27114] netlink: 'syz.3.5456': attribute type 32 has an invalid length. [ 730.716635][T27114] netlink: 500 bytes leftover after parsing attributes in process `syz.3.5456'. [ 730.721071][T27114] netlink: 12 bytes leftover after parsing attributes in process `syz.3.5456'. [ 731.096975][T27137] netlink: 28 bytes leftover after parsing attributes in process `syz.3.5462'. [ 731.216086][T27121] 8021q: adding VLAN 0 to HW filter on device bond5 [ 731.231537][T27143] netlink: 'syz.3.5462': attribute type 10 has an invalid length. [ 731.240869][T27143] netlink: 40 bytes leftover after parsing attributes in process `syz.3.5462'. [ 731.687615][T27162] geneve3: entered allmulticast mode [ 731.725481][T27164] netlink: 4 bytes leftover after parsing attributes in process `syz.2.5468'. [ 731.775022][T27174] syzkaller0: entered promiscuous mode [ 731.781146][T27164] netlink: 4 bytes leftover after parsing attributes in process `syz.2.5468'. [ 731.791229][T27174] syzkaller0: entered allmulticast mode [ 731.832128][ C0] ip6_tunnel: ip6gre1 xmit: Local address not yet configured! [ 732.108097][T27194] ieee802154 phy1 wpan1: encryption failed: -22 [ 732.169887][T27198] FAULT_INJECTION: forcing a failure. [ 732.169887][T27198] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 732.169947][T27198] CPU: 1 UID: 0 PID: 27198 Comm: syz.3.5477 Not tainted syzkaller #0 PREEMPT(full) [ 732.169966][T27198] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 732.169977][T27198] Call Trace: [ 732.169983][T27198] [ 732.169990][T27198] dump_stack_lvl+0xe8/0x150 [ 732.170015][T27198] should_fail_ex+0x410/0x560 [ 732.170046][T27198] _copy_from_user+0x2d/0xb0 [ 732.170067][T27198] ___sys_sendmsg+0x1c6/0x360 [ 732.170086][T27198] ? __lock_acquire+0x6df/0x2e50 [ 732.170108][T27198] ? __pfx____sys_sendmsg+0x10/0x10 [ 732.170160][T27198] ? __fget_files+0x2a/0x420 [ 732.170181][T27198] ? __fget_files+0x3a2/0x420 [ 732.170212][T27198] __x64_sys_sendmsg+0x1b1/0x290 [ 732.170234][T27198] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 732.170273][T27198] do_syscall_64+0x166/0x520 [ 732.170299][T27198] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 732.170317][T27198] ? clear_bhb_loop+0x70/0xc0 [ 732.170339][T27198] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 732.170356][T27198] RIP: 0033:0x7ff52e59e159 [ 732.170373][T27198] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 732.170388][T27198] RSP: 002b:00007ff52f515028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 732.170406][T27198] RAX: ffffffffffffffda RBX: 00007ff52e825fa0 RCX: 00007ff52e59e159 [ 732.170420][T27198] RDX: 0000000000000000 RSI: 00002000000000c0 RDI: 0000000000000003 [ 732.170431][T27198] RBP: 00007ff52f515090 R08: 0000000000000000 R09: 0000000000000000 [ 732.170443][T27198] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 732.170451][T27198] R13: 00007ff52e826038 R14: 00007ff52e825fa0 R15: 00007ffcc4e5e568 [ 732.170477][T27198] [ 732.332963][T27199] dvmrp8: entered allmulticast mode [ 732.702917][T27220] ±ÿ: left allmulticast mode [ 732.728855][T27230] tipc: Enabling of bearer rejected, already enabled [ 732.815156][T27234] FAULT_INJECTION: forcing a failure. [ 732.815156][T27234] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 732.815209][T27234] CPU: 1 UID: 0 PID: 27234 Comm: syz.0.5492 Not tainted syzkaller #0 PREEMPT(full) [ 732.815229][T27234] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 732.815239][T27234] Call Trace: [ 732.815246][T27234] [ 732.815252][T27234] dump_stack_lvl+0xe8/0x150 [ 732.815277][T27234] should_fail_ex+0x410/0x560 [ 732.815307][T27234] _copy_from_user+0x2d/0xb0 [ 732.815327][T27234] __copy_msghdr+0x390/0x590 [ 732.815351][T27234] ___sys_sendmsg+0x213/0x360 [ 732.815369][T27234] ? __lock_acquire+0x6df/0x2e50 [ 732.815390][T27234] ? __pfx____sys_sendmsg+0x10/0x10 [ 732.815442][T27234] ? __fget_files+0x2a/0x420 [ 732.815464][T27234] ? __fget_files+0x3a2/0x420 [ 732.815495][T27234] __x64_sys_sendmsg+0x1b1/0x290 [ 732.815517][T27234] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 732.815556][T27234] do_syscall_64+0x166/0x520 [ 732.815580][T27234] ? trace_irq_disable+0x3b/0x140 [ 732.815597][T27234] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 732.815615][T27234] ? clear_bhb_loop+0x70/0xc0 [ 732.815637][T27234] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 732.815655][T27234] RIP: 0033:0x7f64ee39e159 [ 732.815670][T27234] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 732.815689][T27234] RSP: 002b:00007f64ef1a6028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 732.815708][T27234] RAX: ffffffffffffffda RBX: 00007f64ee625fa0 RCX: 00007f64ee39e159 [ 732.815722][T27234] RDX: 0000000000000000 RSI: 00002000000000c0 RDI: 0000000000000003 [ 732.815733][T27234] RBP: 00007f64ef1a6090 R08: 0000000000000000 R09: 0000000000000000 [ 732.815745][T27234] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 732.815755][T27234] R13: 00007f64ee626038 R14: 00007f64ee625fa0 R15: 00007ffc5c3c4548 [ 732.815783][T27234] [ 733.299451][T27260] bridge0: adding interface bridge0 with same address as a received packet (addr:aa:aa:aa:aa:aa:1b, vlan:0) [ 733.456225][ T1104] net_ratelimit: 149 callbacks suppressed [ 733.456275][ T1104] bond3: (slave ip6gretap0): link status up, enabling it in 0 ms [ 733.456295][ T1104] bond3: (slave ip6gretap0): failed to get link speed/duplex [ 733.578524][ T6896] bond3: (slave ip6gretap0): link status up, enabling it in 0 ms [ 733.578574][ T6896] bond3: (slave ip6gretap0): failed to get link speed/duplex [ 733.675102][T27281] FAULT_INJECTION: forcing a failure. [ 733.675102][T27281] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 733.684083][T27275] syzkaller0: entered promiscuous mode [ 733.684104][T27275] syzkaller0: entered allmulticast mode [ 733.698617][ T6874] bond3: (slave ip6gretap0): link status up, enabling it in 0 ms [ 733.698646][ T6874] bond3: (slave ip6gretap0): failed to get link speed/duplex [ 733.718143][T27281] CPU: 0 UID: 0 PID: 27281 Comm: syz.2.5506 Not tainted syzkaller #0 PREEMPT(full) [ 733.718167][T27281] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 733.718179][T27281] Call Trace: [ 733.718186][T27281] [ 733.718197][T27281] dump_stack_lvl+0xe8/0x150 [ 733.718226][T27281] should_fail_ex+0x410/0x560 [ 733.718257][T27281] _copy_from_user+0x2d/0xb0 [ 733.718277][T27281] ____sys_sendmsg+0x303/0x850 [ 733.718303][T27281] ? __pfx_____sys_sendmsg+0x10/0x10 [ 733.718331][T27281] ? import_iovec+0x73/0xa0 [ 733.718354][T27281] ___sys_sendmsg+0x2a5/0x360 [ 733.718373][T27281] ? __lock_acquire+0x6df/0x2e50 [ 733.718396][T27281] ? __pfx____sys_sendmsg+0x10/0x10 [ 733.718443][T27281] ? __fget_files+0x2a/0x420 [ 733.718464][T27281] ? __fget_files+0x3a2/0x420 [ 733.718493][T27281] __x64_sys_sendmsg+0x1b1/0x290 [ 733.718516][T27281] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 733.718557][T27281] do_syscall_64+0x166/0x520 [ 733.718581][T27281] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 733.718598][T27281] ? clear_bhb_loop+0x70/0xc0 [ 733.718619][T27281] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 733.718637][T27281] RIP: 0033:0x7f7e9ff9e159 [ 733.718653][T27281] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 733.718667][T27281] RSP: 002b:00007f7ea0e00028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 733.718695][T27281] RAX: ffffffffffffffda RBX: 00007f7ea0225fa0 RCX: 00007f7e9ff9e159 [ 733.718709][T27281] RDX: 0000000000000000 RSI: 00002000000000c0 RDI: 0000000000000003 [ 733.718720][T27281] RBP: 00007f7ea0e00090 R08: 0000000000000000 R09: 0000000000000000 [ 733.718731][T27281] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 733.718740][T27281] R13: 00007f7ea0226038 R14: 00007f7ea0225fa0 R15: 00007ffcb2693d68 [ 733.718769][T27281] [ 733.806954][ T6896] bond3: (slave ip6gretap0): link status up, enabling it in 0 ms [ 733.806980][ T6896] bond3: (slave ip6gretap0): failed to get link speed/duplex [ 733.925984][ T6874] bond3: (slave ip6gretap0): link status up, enabling it in 0 ms [ 733.950476][ T6874] bond3: (slave ip6gretap0): link status up, enabling it in 0 ms [ 734.419186][T27312] netlink: 'syz.1.5516': attribute type 6 has an invalid length. [ 734.623076][T27327] FAULT_INJECTION: forcing a failure. [ 734.623076][T27327] name failslab, interval 1, probability 0, space 0, times 0 [ 734.623127][T27327] CPU: 1 UID: 0 PID: 27327 Comm: syz.4.5521 Not tainted syzkaller #0 PREEMPT(full) [ 734.623149][T27327] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 734.623159][T27327] Call Trace: [ 734.623166][T27327] [ 734.623174][T27327] dump_stack_lvl+0xe8/0x150 [ 734.623204][T27327] should_fail_ex+0x410/0x560 [ 734.623233][T27327] should_failslab+0xa8/0x100 [ 734.623251][T27327] ? dst_alloc+0x105/0x170 [ 734.623270][T27327] kmem_cache_alloc_noprof+0xa1/0x600 [ 734.623298][T27327] ? dst_alloc+0x105/0x170 [ 734.623325][T27327] dst_alloc+0x105/0x170 [ 734.623352][T27327] ip_route_output_key_hash_rcu+0x14ac/0x2720 [ 734.623384][T27327] ? ip_route_output_key_hash+0xd8/0x2a0 [ 734.623409][T27327] ip_route_output_key_hash+0x18d/0x2a0 [ 734.623434][T27327] ? ns_capable+0x89/0xe0 [ 734.623458][T27327] ? __pfx_ip_route_output_key_hash+0x10/0x10 [ 734.623484][T27327] ? lock_acquire+0x115/0x350 [ 734.623513][T27327] ip_route_output_flow+0x2a/0x150 [ 734.623533][T27327] ? security_sk_classify_flow+0x6d/0x150 [ 734.623560][T27327] udp_sendmsg+0x144a/0x2140 [ 734.623602][T27327] ? __pfx_udp_sendmsg+0x10/0x10 [ 734.623644][T27327] ? tomoyo_supervisor+0x4d2/0x1560 [ 734.623688][T27327] ? get_random_u32+0x497/0x8b0 [ 734.623707][T27327] ? lockdep_hardirqs_on+0x7b/0x110 [ 734.623731][T27327] ? get_random_u32+0x13a/0x8b0 [ 734.623749][T27327] ? get_random_u32+0x4ce/0x8b0 [ 734.623774][T27327] udpv6_sendmsg+0x915/0x2610 [ 734.623813][T27327] ? __pfx_udpv6_sendmsg+0x10/0x10 [ 734.623836][T27327] ? udp_lib_get_port+0x177b/0x1c60 [ 734.623860][T27327] ? udp_lib_get_port+0x177b/0x1c60 [ 734.623907][T27327] ? inet_send_prepare+0x1b4/0x260 [ 734.623934][T27327] ? lockdep_hardirqs_on+0x7b/0x110 [ 734.623958][T27327] ? inet_send_prepare+0x1b4/0x260 [ 734.623978][T27327] ? __local_bh_enable_ip+0xd6/0x140 [ 734.624000][T27327] ? inet_send_prepare+0x1b4/0x260 [ 734.624025][T27327] ? inet6_sendmsg+0xe4/0x120 [ 734.624047][T27327] ? __pfx_inet6_sendmsg+0x10/0x10 [ 734.624067][T27327] sock_sendmsg_nosec+0x90/0x180 [ 734.624093][T27327] ____sys_sendmsg+0x54e/0x850 [ 734.624117][T27327] ? __pfx_____sys_sendmsg+0x10/0x10 [ 734.624146][T27327] ? import_iovec+0x73/0xa0 [ 734.624168][T27327] ___sys_sendmsg+0x2a5/0x360 [ 734.624186][T27327] ? __lock_acquire+0x6df/0x2e50 [ 734.624207][T27327] ? __pfx____sys_sendmsg+0x10/0x10 [ 734.624261][T27327] ? __fget_files+0x2a/0x420 [ 734.624282][T27327] ? __fget_files+0x3a2/0x420 [ 734.624314][T27327] __x64_sys_sendmsg+0x1b1/0x290 [ 734.624336][T27327] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 734.624376][T27327] do_syscall_64+0x166/0x520 [ 734.624401][T27327] ? trace_irq_disable+0x3b/0x140 [ 734.624417][T27327] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 734.624435][T27327] ? clear_bhb_loop+0x70/0xc0 [ 734.624458][T27327] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 734.624475][T27327] RIP: 0033:0x7f4e8f39e159 [ 734.624492][T27327] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 734.624506][T27327] RSP: 002b:00007f4e902d1028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 734.624525][T27327] RAX: ffffffffffffffda RBX: 00007f4e8f625fa0 RCX: 00007f4e8f39e159 [ 734.624537][T27327] RDX: 0000000000000000 RSI: 00002000000000c0 RDI: 0000000000000003 [ 734.624549][T27327] RBP: 00007f4e902d1090 R08: 0000000000000000 R09: 0000000000000000 [ 734.624560][T27327] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 734.624571][T27327] R13: 00007f4e8f626038 R14: 00007f4e8f625fa0 R15: 00007fff454dd388 [ 734.624600][T27327] [ 735.427208][T27364] ref_tracker: memory allocation failure, unreliable refcount tracker. [ 735.437866][T27366] __nla_validate_parse: 7 callbacks suppressed [ 735.438848][T27366] netlink: 4 bytes leftover after parsing attributes in process `syz.3.5535'. [ 735.562514][T27377] xt_physdev: --physdev-out and --physdev-is-out only supported in the FORWARD and POSTROUTING chains with bridged traffic [ 735.565343][T27376] netlink: 32 bytes leftover after parsing attributes in process `syz.0.5536'. [ 735.598113][T27378] netlink: 8 bytes leftover after parsing attributes in process `syz.3.5537'. [ 736.034110][T27408] netlink: 76 bytes leftover after parsing attributes in process `syz.2.5542'. [ 736.093811][T27415] netlink: 20 bytes leftover after parsing attributes in process `syz.0.5543'. [ 736.158934][T27413] netlink: 20 bytes leftover after parsing attributes in process `syz.0.5543'. [ 736.162750][T27420] netlink: 12 bytes leftover after parsing attributes in process `syz.1.5545'. [ 736.270307][T27420] 8021q: adding VLAN 0 to HW filter on device bond6 [ 736.282853][T27422] bond6: entered promiscuous mode [ 736.282888][T27422] bond6: entered allmulticast mode [ 736.502648][T27440] netlink: 'syz.1.5551': attribute type 1 has an invalid length. [ 736.553125][T27442] netlink: 'syz.3.5550': attribute type 10 has an invalid length. [ 736.748760][T27450] netlink: 'syz.3.5555': attribute type 8 has an invalid length. [ 736.757863][T27450] netlink: 8 bytes leftover after parsing attributes in process `syz.3.5555'. [ 736.798735][T27453] netlink: 76 bytes leftover after parsing attributes in process `syz.0.5556'. [ 736.865434][T27457] netlink: 4 bytes leftover after parsing attributes in process `syz.1.5558'. [ 737.289946][T27469] netlink: 'syz.0.5560': attribute type 4 has an invalid length. [ 737.474257][T27476] netlink: 'syz.2.5563': attribute type 1 has an invalid length. [ 737.487826][T27477] netlink: 'syz.2.5563': attribute type 1 has an invalid length. [ 737.861637][T27508] netlink: 'syz.1.5571': attribute type 39 has an invalid length. [ 738.191612][T27528] Bluetooth: hci0: unsupported parameter 5135 [ 738.191661][T27528] Bluetooth: hci0: unsupported parameter 8192 [ 738.191674][T27528] Bluetooth: hci0: unsupported parameter 5135 [ 738.191685][T27528] Bluetooth: hci0: unsupported parameter 8192 [ 738.266346][T27534] netlink: 'syz.4.5580': attribute type 1 has an invalid length. [ 738.319884][T27534] bond4: entered promiscuous mode [ 738.320389][T27534] 8021q: adding VLAN 0 to HW filter on device bond4 [ 738.405280][T27540] 8021q: adding VLAN 0 to HW filter on device bond4 [ 738.405673][T27540] bond4: (slave ip6gre2): The slave device specified does not support setting the MAC address [ 738.412097][T27540] bond4: (slave ip6gre2): Setting fail_over_mac to active for active-backup mode [ 738.475864][ T50] net_ratelimit: 104 callbacks suppressed [ 738.475910][ T50] bond3: (slave ip6gretap0): link status up, enabling it in 0 ms [ 738.497099][ T50] bond3: (slave ip6gretap0): link status up, enabling it in 0 ms [ 738.526155][ T50] bond3: (slave ip6gretap0): link status up, enabling it in 0 ms [ 738.529163][T27550] xt_NFQUEUE: number of total queues is 0 [ 738.531148][T27540] bond4: (slave ip6gre2): making interface the new active one [ 738.531168][T27540] ip6gre2: entered promiscuous mode [ 738.540714][T27540] bond4: (slave ip6gre2): Enslaving as an active interface with an up link [ 738.558700][ T50] bond3: (slave ip6gretap0): link status up, enabling it in 0 ms [ 738.568141][ T50] bond3: (slave ip6gretap0): link status up, enabling it in 0 ms [ 738.589081][ T1104] bond3: (slave ip6gretap0): link status up, enabling it in 0 ms [ 738.595673][T27537] bond0: option ad_user_port_key: mode dependency failed, not supported in mode balance-rr(0) [ 738.616603][ T50] bond3: (slave ip6gretap0): link status up, enabling it in 0 ms [ 738.636003][ T203] bond3: (slave ip6gretap0): link status up, enabling it in 0 ms [ 738.658057][ T203] bond3: (slave ip6gretap0): link status up, enabling it in 0 ms [ 738.678025][ T6890] bond3: (slave ip6gretap0): link status up, enabling it in 0 ms [ 738.704362][T27560] netlink: 'syz.2.5585': attribute type 39 has an invalid length. [ 738.733264][T27545] pim6reg1: entered promiscuous mode [ 738.733336][T27545] pim6reg1: entered allmulticast mode [ 738.863285][T27565] IPVS: length: 122 != 8 [ 738.870261][T27565] IPVS: length: 122 != 8 [ 739.006289][ T6890] veth3: left promiscuous mode [ 739.044464][T27578] netlink: 'syz.3.5588': attribute type 1 has an invalid length. [ 740.052322][T27645] NCSI netlink: No device for ifindex 0 [ 740.240986][T27650] hsr0: entered allmulticast mode [ 740.241025][T27650] hsr_slave_0: entered allmulticast mode [ 740.241056][T27650] hsr_slave_1: entered allmulticast mode [ 740.538262][T27672] __nla_validate_parse: 16 callbacks suppressed [ 740.538308][T27672] netlink: 8 bytes leftover after parsing attributes in process `syz.3.5616'. [ 740.792484][T27688] netlink: 64985 bytes leftover after parsing attributes in process `syz.3.5620'. [ 741.163677][T27707] netlink: 8 bytes leftover after parsing attributes in process `syz.3.5625'. [ 741.339056][T27715] 8021q: adding VLAN 0 to HW filter on device bond9 [ 741.363552][T27719] x_tables: duplicate underflow at hook 3 [ 741.386984][T27715] bond9: (slave veth9): Enslaving as an active interface with a down link [ 741.410792][T27715] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 741.421976][T27715] bond9: (slave batadv0): making interface the new active one [ 741.431552][T27715] batadv0: entered promiscuous mode [ 741.439319][T27715] bond9: (slave batadv0): Enslaving as an active interface with an up link [ 741.930997][T27748] ip6t_rt: `--rt-type 0' required before `--rt-0-*' [ 742.101882][T27756] validate_nla: 6 callbacks suppressed [ 742.121961][T27756] netlink: 'syz.4.5642': attribute type 97 has an invalid length. [ 742.122006][T27756] netlink: 8 bytes leftover after parsing attributes in process `syz.4.5642'. [ 742.122023][T27756] netlink: 'syz.4.5642': attribute type 97 has an invalid length. [ 742.122034][T27756] netlink: 8 bytes leftover after parsing attributes in process `syz.4.5642'. [ 742.448693][T27775] netlink: 12 bytes leftover after parsing attributes in process `syz.3.5648'. [ 742.448729][T27775] netlink: 24 bytes leftover after parsing attributes in process `syz.3.5648'. [ 742.688770][T27793] netlink: 8 bytes leftover after parsing attributes in process `syz.2.5654'. [ 742.714984][T27793] sit2: entered promiscuous mode [ 742.721332][T27793] sit2: entered allmulticast mode [ 742.921413][T27806] netlink: 'syz.4.5657': attribute type 39 has an invalid length. [ 743.024653][T27812] xt_hashlimit: size too large, truncated to 1048576 [ 743.197413][T27828] netlink: 'syz.1.5663': attribute type 17 has an invalid length. [ 743.205818][T27828] netlink: 4 bytes leftover after parsing attributes in process `syz.1.5663'. [ 743.214810][T27828] netlink: 28 bytes leftover after parsing attributes in process `syz.1.5663'. [ 743.259527][T27831] netlink: 'syz.1.5663': attribute type 17 has an invalid length. [ 743.336473][T27828] erspan0: entered promiscuous mode [ 743.345135][T27828] gretap0: entered promiscuous mode [ 743.537503][ T203] net_ratelimit: 107 callbacks suppressed [ 743.537555][ T203] bond3: (slave ip6gretap0): link status up, enabling it in 0 ms [ 743.557566][ T6896] bond3: (slave ip6gretap0): link status up, enabling it in 0 ms [ 743.576267][ T203] bond3: (slave ip6gretap0): link status up, enabling it in 0 ms [ 743.606331][ T6896] bond3: (slave ip6gretap0): link status up, enabling it in 0 ms [ 743.606385][ T6896] bond3: (slave ip6gretap0): failed to get link speed/duplex [ 743.673317][T27848] netlink: 'syz.0.5672': attribute type 39 has an invalid length. [ 743.716640][ T203] bond3: (slave ip6gretap0): link status up, enabling it in 0 ms [ 743.724537][ T203] bond3: (slave ip6gretap0): failed to get link speed/duplex [ 743.836703][ T6874] bond3: (slave ip6gretap0): link status up, enabling it in 0 ms [ 743.836752][ T6874] bond3: (slave ip6gretap0): failed to get link speed/duplex [ 743.945830][ T6896] bond3: (slave ip6gretap0): link status up, enabling it in 0 ms [ 744.353048][T27887] netlink: 'syz.2.5684': attribute type 39 has an invalid length. [ 744.504706][T27893] syzkaller0: entered promiscuous mode [ 744.512689][T27893] syzkaller0: entered allmulticast mode [ 744.655337][T27900] sctp: [Deprecated]: syz.3.5689 (pid 27900) Use of int in maxseg socket option. [ 744.655337][T27900] Use struct sctp_assoc_value instead [ 744.658218][T27901] sctp: [Deprecated]: syz.3.5689 (pid 27901) Use of int in maxseg socket option. [ 744.658218][T27901] Use struct sctp_assoc_value instead [ 744.890011][ T30] audit: type=1804 audit(1788642270.410:24): pid=27911 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=open_writers comm="syz.3.5694" name="/newroot/557/cgroup.controllers" dev="tmpfs" ino=2857 res=1 errno=0 [ 744.913885][ T30] audit: type=1800 audit(1788642270.430:25): pid=27911 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.3.5694" name="cgroup.controllers" dev="tmpfs" ino=2857 res=0 errno=0 [ 745.065341][T27917] netlink: 'syz.0.5696': attribute type 39 has an invalid length. [ 745.258226][T27921] vlan5: entered allmulticast mode [ 745.258270][T27921] bond0: entered allmulticast mode [ 745.425540][T27949] netlink: 'syz.4.5707': attribute type 39 has an invalid length. [ 745.549477][T27957] __nla_validate_parse: 14 callbacks suppressed [ 745.549529][T27957] netlink: 8 bytes leftover after parsing attributes in process `syz.2.5708'. [ 745.549553][T27957] netlink: 20 bytes leftover after parsing attributes in process `syz.2.5708'. [ 745.661749][T27962] netlink: 'syz.4.5712': attribute type 39 has an invalid length. [ 745.717555][T27964] netlink: 8 bytes leftover after parsing attributes in process `syz.4.5713'. [ 745.729844][T27964] netlink: 224 bytes leftover after parsing attributes in process `syz.4.5713'. [ 745.740300][T27965] netlink: 224 bytes leftover after parsing attributes in process `syz.4.5713'. [ 745.964423][ T1104] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 745.972810][ T1104] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 746.101463][T27979] netlink: 12 bytes leftover after parsing attributes in process `syz.4.5719'. [ 746.441879][T28003] tipc: Started in network mode [ 746.441928][T28003] tipc: Node identity aaaaaaaaaa3, cluster identity 4711 [ 746.442062][T28003] tipc: Enabled bearer , priority 10 [ 746.443223][T28000] syzkaller0: entered promiscuous mode [ 746.443241][T28000] syzkaller0: entered allmulticast mode [ 747.003025][T28050] netlink: 32 bytes leftover after parsing attributes in process `syz.2.5737'. [ 747.021391][T28050] IPVS: set_ctl: invalid protocol: 51 224.0.0.2:20002 [ 747.028353][T28050] xt_hashlimit: size too large, truncated to 1048576 [ 747.076544][T28054] xt_hashlimit: size too large, truncated to 1048576 [ 747.180375][T28059] netlink: 24 bytes leftover after parsing attributes in process `syz.1.5739'. [ 747.193119][ T1313] ieee802154 phy1 wpan1: encryption failed: -22 [ 747.203894][T28060] netlink: 24 bytes leftover after parsing attributes in process `syz.1.5739'. [ 747.383938][T28071] syzkaller0: entered promiscuous mode [ 747.383983][T28071] syzkaller0: entered allmulticast mode [ 747.557093][ T10] tipc: Node number set to 10136234 [ 747.806756][T28084] validate_nla: 4 callbacks suppressed [ 747.806808][T28084] netlink: 'syz.2.5747': attribute type 39 has an invalid length. [ 748.084750][T28100] netlink: 12 bytes leftover after parsing attributes in process `syz.2.5752'. [ 748.180262][T28106] x_tables: duplicate underflow at hook 1 [ 748.627852][ T6896] net_ratelimit: 105 callbacks suppressed [ 748.627905][ T6896] bond3: (slave ip6gretap0): link status up, enabling it in 0 ms [ 748.627929][ T6896] bond3: (slave ip6gretap0): failed to get link speed/duplex [ 748.736202][ T6890] bond3: (slave ip6gretap0): link status up, enabling it in 0 ms [ 748.754859][T28132] netlink: 'syz.3.5761': attribute type 39 has an invalid length. [ 748.762942][ T6874] bond3: (slave ip6gretap0): link status up, enabling it in 0 ms [ 748.763968][ T6874] bond3: (slave ip6gretap0): failed to get link speed/duplex [ 748.794360][T28130] sctp: [Deprecated]: syz.4.5762 (pid 28130) Use of struct sctp_assoc_value in delayed_ack socket option. [ 748.794360][T28130] Use struct sctp_sack_info instead [ 748.795229][T28135] netlink: 'syz.0.5763': attribute type 10 has an invalid length. [ 748.821649][T28134] macvlan3: entered promiscuous mode [ 748.821682][T28134] macvlan3: entered allmulticast mode [ 748.822657][T28134] bond0: (slave macvlan3): Opening slave failed [ 748.866885][ T6890] bond3: (slave ip6gretap0): link status up, enabling it in 0 ms [ 748.885848][ T1104] bond3: (slave ip6gretap0): link status up, enabling it in 0 ms [ 748.904138][T28135] netlink: 'syz.0.5763': attribute type 10 has an invalid length. [ 748.904381][T28135] netlink: 'syz.0.5763': attribute type 10 has an invalid length. [ 748.904575][T28135] netlink: 'syz.0.5763': attribute type 10 has an invalid length. [ 748.904762][T28135] netlink: 'syz.0.5763': attribute type 10 has an invalid length. [ 748.904949][T28135] netlink: 'syz.0.5763': attribute type 10 has an invalid length. [ 748.905143][T28135] netlink: 'syz.0.5763': attribute type 10 has an invalid length. [ 748.905352][T28135] netlink: 'syz.0.5763': attribute type 10 has an invalid length. [ 748.907978][ T6874] bond3: (slave ip6gretap0): link status up, enabling it in 0 ms [ 748.908005][ T6874] bond3: (slave ip6gretap0): failed to get link speed/duplex [ 749.017079][ T50] bond3: (slave ip6gretap0): link status up, enabling it in 0 ms [ 749.022251][T28149] sctp: [Deprecated]: syz.2.5766 (pid 28149) Use of int in maxseg socket option. [ 749.022251][T28149] Use struct sctp_assoc_value instead [ 749.124518][T28140] syzkaller0: entered promiscuous mode [ 749.124564][T28140] syzkaller0: entered allmulticast mode [ 752.605217][T28173] __nla_validate_parse: 9 callbacks suppressed [ 752.605261][T28173] netlink: 76 bytes leftover after parsing attributes in process `syz.0.5768'. [ 752.838147][ T6874] batadv0: left promiscuous mode [ 753.496932][T28230] bridge5: entered allmulticast mode [ 753.642980][T28237] netlink: 4 bytes leftover after parsing attributes in process `syz.1.5786'. [ 753.728989][T28241] validate_nla: 59 callbacks suppressed [ 753.729038][T28241] netlink: 'syz.0.5787': attribute type 39 has an invalid length. [ 753.735924][ T6886] net_ratelimit: 195 callbacks suppressed [ 753.735943][ T6886] bond3: (slave ip6gretap0): link status up, enabling it in 0 ms [ 753.735964][ T6886] bond3: (slave ip6gretap0): failed to get link speed/duplex [ 753.845909][ T6896] bond3: (slave ip6gretap0): link status up, enabling it in 0 ms [ 753.845967][ T6896] bond3: (slave ip6gretap0): failed to get link speed/duplex [ 753.956774][ T6890] bond3: (slave ip6gretap0): link status up, enabling it in 0 ms [ 753.956825][ T6890] bond3: (slave ip6gretap0): failed to get link speed/duplex [ 754.066339][ T6886] bond3: (slave ip6gretap0): link status up, enabling it in 0 ms [ 754.074503][ T6886] bond3: (slave ip6gretap0): failed to get link speed/duplex [ 754.182855][T28273] netlink: 76 bytes leftover after parsing attributes in process `syz.3.5795'. [ 754.192457][ T6890] bond3: (slave ip6gretap0): link status up, enabling it in 0 ms [ 754.192497][ T6890] bond3: (slave ip6gretap0): failed to get link speed/duplex [ 754.299875][T28275] netlink: 56 bytes leftover after parsing attributes in process `syz.3.5796'. [ 754.344906][T28275] bond9 (unregistering): Released all slaves [ 754.431617][T28280] syzkaller0: entered promiscuous mode [ 754.431672][T28280] syzkaller0: entered allmulticast mode [ 754.645265][T28288] netlink: 'syz.1.5800': attribute type 39 has an invalid length. [ 754.764624][T28292] netlink: 'syz.4.5803': attribute type 1 has an invalid length. [ 755.049476][T28308] netlink: 'syz.4.5806': attribute type 1 has an invalid length. [ 755.133667][T28320] RDS: rds_bind could not find a transport for fe80::, load rds_tcp or rds_rdma? [ 755.189360][T28308] bond5: entered promiscuous mode [ 755.198396][T28308] 8021q: adding VLAN 0 to HW filter on device bond5 [ 755.228726][T28326] erspan0: entered promiscuous mode [ 755.228841][T28326] vlan6: entered promiscuous mode [ 755.291727][T28331] netlink: 'syz.0.5812': attribute type 39 has an invalid length. [ 755.300450][T28328] 8021q: adding VLAN 0 to HW filter on device bond5 [ 755.300864][T28328] bond5: (slave ip6gre3): The slave device specified does not support setting the MAC address [ 755.300882][T28328] bond5: (slave ip6gre3): Setting fail_over_mac to active for active-backup mode [ 755.328372][T28328] bond5: (slave ip6gre3): making interface the new active one [ 755.328405][T28328] ip6gre3: entered promiscuous mode [ 755.348024][T28328] bond5: (slave ip6gre3): Enslaving as an active interface with an up link [ 755.452522][T28333] syzkaller0: entered promiscuous mode [ 755.458581][T28333] syzkaller0: entered allmulticast mode [ 755.666754][ T4933] block nbd2: Receive control failed (result -32) [ 755.780783][T28353] xt_ecn: cannot match TCP bits for non-tcp packets [ 755.871009][T28360] bond5: entered allmulticast mode [ 755.877297][T28360] ip6gre3: entered allmulticast mode [ 755.889146][T28359] bond5: left allmulticast mode [ 755.894333][T28359] ip6gre3: left allmulticast mode [ 756.278307][T28369] C: renamed from 04±ÿ (while UP) [ 756.308235][T28369] netlink: 'syz.4.5823': attribute type 1 has an invalid length. [ 756.335231][T28373] netlink: 'syz.1.5825': attribute type 39 has an invalid length. [ 756.766010][T28386] x_tables: unsorted entry at hook 2 [ 756.793832][T28390] netlink: 44 bytes leftover after parsing attributes in process `syz.4.5831'. [ 757.080766][T28405] RDS: rds_bind could not find a transport for fe80::, load rds_tcp or rds_rdma? [ 757.132783][T28408] netlink: 'syz.3.5836': attribute type 39 has an invalid length. [ 757.300250][T28424] netlink: 'syz.1.5842': attribute type 9 has an invalid length. [ 757.402025][T28431] mac80211_hwsim hwsim27 syzkaller0: left promiscuous mode [ 757.409871][T28431] mac80211_hwsim hwsim27 syzkaller0: left allmulticast mode [ 757.419387][T28431] tipc: Resetting bearer [ 758.034590][T28459] netlink: 4 bytes leftover after parsing attributes in process `syz.2.5854'. [ 758.178450][T28464] mac80211_hwsim hwsim27 syzkaller0: entered promiscuous mode [ 758.178495][T28464] mac80211_hwsim hwsim27 syzkaller0: entered allmulticast mode [ 758.178963][T28464] tipc: Resetting bearer [ 758.293587][T28471] netlink: 28 bytes leftover after parsing attributes in process `syz.0.5860'. [ 758.395426][T28473] netlink: 'syz.1.5858': attribute type 11 has an invalid length. [ 758.500391][T28479] xt_CT: You must specify a L4 protocol and not use inversions on it [ 758.669394][T28494] Cannot find add_set index 0 as target [ 758.765959][T12147] net_ratelimit: 126 callbacks suppressed [ 758.766010][T12147] bond3: (slave ip6gretap0): link status up, enabling it in 0 ms [ 758.766034][T12147] bond3: (slave ip6gretap0): failed to get link speed/duplex [ 758.871869][T28503] netlink: 12 bytes leftover after parsing attributes in process `syz.0.5867'. [ 758.884266][T28503] netlink: 4 bytes leftover after parsing attributes in process `syz.0.5867'. [ 758.885907][T12147] bond3: (slave ip6gretap0): link status up, enabling it in 0 ms [ 758.885932][T12147] bond3: (slave ip6gretap0): failed to get link speed/duplex [ 758.995958][ T6886] bond3: (slave ip6gretap0): link status up, enabling it in 0 ms [ 758.996009][ T6886] bond3: (slave ip6gretap0): failed to get link speed/duplex [ 759.100573][T28509] Cannot find add_set index 0 as target [ 759.116633][T12147] bond3: (slave ip6gretap0): link status up, enabling it in 0 ms [ 759.117523][T12147] bond3: (slave ip6gretap0): failed to get link speed/duplex [ 759.149381][T28509] netlink: 16 bytes leftover after parsing attributes in process `syz.3.5869'. [ 759.225871][ T6874] bond3: (slave ip6gretap0): link status up, enabling it in 0 ms [ 759.225926][ T6874] bond3: (slave ip6gretap0): failed to get link speed/duplex [ 759.228937][T28509] netlink: 16 bytes leftover after parsing attributes in process `syz.3.5869'. [ 759.260435][T28509] netlink: 16 bytes leftover after parsing attributes in process `syz.3.5869'. [ 759.302379][T28509] netlink: 16 bytes leftover after parsing attributes in process `syz.3.5869'. [ 759.323388][T28509] netlink: 16 bytes leftover after parsing attributes in process `syz.3.5869'. [ 759.347917][T28509] netlink: 16 bytes leftover after parsing attributes in process `syz.3.5869'. [ 759.353073][T28516] netlink: 'syz.0.5871': attribute type 2 has an invalid length. [ 759.353376][T28519] netlink: 'syz.0.5871': attribute type 2 has an invalid length. [ 759.557890][T28528] Cannot find set identified by id 0 to match [ 759.565048][T28528] netlink: 'syz.1.5874': attribute type 11 has an invalid length. [ 759.709419][T28532] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 760.060985][T28542] netlink: 'syz.4.5880': attribute type 10 has an invalid length. [ 760.159583][T18500] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 760.178324][T18500] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 760.187091][T18500] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 760.198305][T18500] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 760.206219][T18500] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 760.420345][T28554] syzkaller1: entered promiscuous mode [ 760.420385][T28554] syzkaller1: entered allmulticast mode [ 760.912532][T28578] netlink: 'syz.3.5887': attribute type 2 has an invalid length. [ 761.328677][T28546] lo speed is unknown, defaulting to 1000 [ 761.682336][T28599] x_tables: duplicate underflow at hook 1 [ 761.897451][T28546] bridge0: port 1(bridge_slave_0) entered blocking state [ 761.905616][T28546] bridge0: port 1(bridge_slave_0) entered disabled state [ 761.914184][T28546] bridge_slave_0: entered allmulticast mode [ 761.923001][T28546] bridge_slave_0: entered promiscuous mode [ 761.932318][T28628] sctp: [Deprecated]: syz.1.5899 (pid 28628) Use of int in maxseg socket option. [ 761.932318][T28628] Use struct sctp_assoc_value instead [ 761.947488][T28546] bridge0: port 2(bridge_slave_1) entered blocking state [ 761.947713][T28546] bridge0: port 2(bridge_slave_1) entered disabled state [ 761.947851][T28546] bridge_slave_1: entered allmulticast mode [ 761.949652][T28546] bridge_slave_1: entered promiscuous mode [ 762.027629][T28546] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 762.031865][T28546] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 762.074103][T28546] team0: Port device team_slave_0 added [ 762.081365][T28546] team0: Port device team_slave_1 added [ 762.118004][T28546] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 762.118040][T28546] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 762.118062][T28546] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 762.120111][T28546] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 762.120124][T28546] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 762.120147][T28546] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 762.170243][T28546] hsr_slave_0: entered promiscuous mode [ 762.171288][T28546] hsr_slave_1: entered promiscuous mode [ 762.172054][T28546] debugfs: 'hsr0' already exists in 'hsr' [ 762.172073][T28546] Cannot create hsr debugfs directory [ 762.306171][ T4933] Bluetooth: hci1: command tx timeout [ 762.377518][T28635] xt_CT: You must specify a L4 protocol and not use inversions on it [ 762.476665][T28546] netdevsim netdevsim2 eth3 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 762.476753][T28546] netdevsim netdevsim2 eth3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 762.644694][T28645] tls_set_device_offload_rx: netdev not found [ 762.674035][T28647] xt_REDIRECT: bad MAP_IPS. [ 762.702226][T28645] SET target dimension over the limit! [ 762.738860][T28546] netdevsim netdevsim2 eth2 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 762.738923][T28546] netdevsim netdevsim2 eth2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 762.894168][T28546] netdevsim netdevsim2 eth1 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 762.894204][T28546] netdevsim netdevsim2 eth1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 762.994522][T28546] netdevsim netdevsim2 eth0 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 762.994558][T28546] netdevsim netdevsim2 eth0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 763.149268][T28665] __nla_validate_parse: 30 callbacks suppressed [ 763.149318][T28665] netlink: 28 bytes leftover after parsing attributes in process `syz.0.5911'. [ 763.778899][ T6874] net_ratelimit: 127 callbacks suppressed [ 763.778949][ T6874] bond3: (slave ip6gretap0): link status up, enabling it in 0 ms [ 763.796973][ T6890] bond3: (slave ip6gretap0): link status up, enabling it in 0 ms [ 763.805023][ T6890] bond3: (slave ip6gretap0): failed to get link speed/duplex [ 763.907170][ T6890] bond3: (slave ip6gretap0): link status up, enabling it in 0 ms [ 763.907216][ T6890] bond3: (slave ip6gretap0): failed to get link speed/duplex [ 763.910363][T28546] netdevsim netdevsim2 netdevsim0: renamed from eth0 [ 763.942747][T28546] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 763.944426][T28546] netdevsim netdevsim2 netdevsim1: renamed from eth1 [ 763.970701][T28546] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 763.974087][T28546] netdevsim netdevsim2 netdevsim2: renamed from eth2 [ 764.001646][T28546] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 764.004122][T28546] netdevsim netdevsim2 netdevsim3: renamed from eth3 [ 764.019438][ T50] bond3: (slave ip6gretap0): link status up, enabling it in 0 ms [ 764.035308][T28546] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 764.051433][ T6890] bond3: (slave ip6gretap0): link status up, enabling it in 0 ms [ 764.069095][ T6890] bond3: (slave ip6gretap0): link status up, enabling it in 0 ms [ 764.086346][ T50] bond3: (slave ip6gretap0): link status up, enabling it in 0 ms [ 764.108238][ T50] bond3: (slave ip6gretap0): link status up, enabling it in 0 ms [ 764.144427][T28704] dvmrp0: entered allmulticast mode [ 764.159207][T28710] RDS: rds_bind could not find a transport for ::ffff:172.20.20.170, load rds_tcp or rds_rdma? [ 764.383961][T28716] netlink: 76 bytes leftover after parsing attributes in process `syz.3.5928'. [ 764.396834][ T4933] Bluetooth: hci1: command tx timeout [ 764.402506][T28716] netlink: 'syz.3.5928': attribute type 11 has an invalid length. [ 764.402527][T28716] netlink: 3808 bytes leftover after parsing attributes in process `syz.3.5928'. [ 764.447503][T28723] netlink: 27 bytes leftover after parsing attributes in process `syz.4.5930'. [ 764.447897][T28721] netlink: 27 bytes leftover after parsing attributes in process `syz.4.5930'. [ 764.475487][T28546] 8021q: adding VLAN 0 to HW filter on device bond0 [ 764.514170][T28546] 8021q: adding VLAN 0 to HW filter on device team0 [ 764.532760][ T6890] bridge0: port 1(bridge_slave_0) entered blocking state [ 764.532851][ T6890] bridge0: port 1(bridge_slave_0) entered forwarding state [ 764.562564][ T6874] bridge0: port 2(bridge_slave_1) entered blocking state [ 764.562691][ T6874] bridge0: port 2(bridge_slave_1) entered forwarding state [ 764.831066][T28739] syzkaller1: entered promiscuous mode [ 764.831104][T28739] syzkaller1: entered allmulticast mode [ 765.069466][T28762] netlink: 'syz.3.5939': attribute type 49 has an invalid length. [ 765.410021][T28782] netlink: 'syz.3.5944': attribute type 10 has an invalid length. [ 765.442808][T28782] bond0: (slave veth0_to_bond): Enslaving as an active interface with an up link [ 765.459668][T28546] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 765.543573][T28546] veth0_vlan: entered promiscuous mode [ 765.571104][T28546] veth1_vlan: entered promiscuous mode [ 765.654748][T28546] veth0_macvtap: entered promiscuous mode [ 765.659917][T28546] veth1_macvtap: entered promiscuous mode [ 765.672008][T28788] netlink: 4 bytes leftover after parsing attributes in process `syz.0.5946'. [ 765.690103][T28546] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 765.730881][T28546] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 765.753064][ T6890] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 765.753161][ T6890] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 765.754771][T12147] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 765.754913][T12147] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 766.004856][ T50] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 766.004893][ T50] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 766.037159][T28796] xt_bpf: check failed: parse error [ 766.128820][ T6886] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 766.128859][ T6886] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 766.230457][T28806] netlink: 24 bytes leftover after parsing attributes in process `syz.0.5951'. [ 766.253665][T28809] xt_addrtype: ipv6 BLACKHOLE matching not supported [ 766.262028][T28809] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 766.262073][T28809] IPv6: NLM_F_CREATE should be set when creating new route [ 766.440525][T28818] netlink: 'syz.2.5879': attribute type 39 has an invalid length. [ 766.470967][ T4933] Bluetooth: hci1: command tx timeout [ 767.345582][T28809] veth1_vlan: left allmulticast mode [ 767.379297][T28809] tipc: Resetting bearer [ 767.567279][ T7101] netdevsim netdevsim4 netdevsim3: unset [0, 0] type 1 family 0 port 8472 - 0 [ 767.567328][ T7101] netdevsim netdevsim4 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 767.567367][ T7101] netdevsim netdevsim4 netdevsim3: unset [1, 1] type 2 family 0 port 256 - 0 [ 767.567407][ T7101] netdevsim netdevsim4 netdevsim2: unset [0, 0] type 1 family 0 port 8472 - 0 [ 767.567433][ T7101] netdevsim netdevsim4 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 767.567483][ T7101] netdevsim netdevsim4 netdevsim2: unset [1, 1] type 2 family 0 port 256 - 0 [ 767.567520][ T7101] netdevsim netdevsim4 netdevsim1: unset [0, 0] type 1 family 0 port 8472 - 0 [ 767.567545][ T7101] netdevsim netdevsim4 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 767.567570][ T7101] netdevsim netdevsim4 netdevsim1: unset [1, 1] type 2 family 0 port 256 - 0 [ 767.567605][ T7101] netdevsim netdevsim4 netdevsim0: unset [0, 0] type 1 family 0 port 8472 - 0 [ 767.567630][ T7101] netdevsim netdevsim4 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 767.567655][ T7101] netdevsim netdevsim4 netdevsim0: unset [1, 1] type 2 family 0 port 256 - 0 [ 767.956997][T28841] syzkaller0: entered promiscuous mode [ 767.962610][T28841] syzkaller0: entered allmulticast mode [ 768.044739][T18500] Bluetooth: hci4: unexpected cc 0x0c03 length: 249 > 1 [ 768.061112][T18500] Bluetooth: hci4: unexpected cc 0x1003 length: 249 > 9 [ 768.069744][T18500] Bluetooth: hci4: unexpected cc 0x1001 length: 249 > 9 [ 768.085239][T18500] Bluetooth: hci4: unexpected cc 0x0c23 length: 249 > 4 [ 768.094563][T18500] Bluetooth: hci4: unexpected cc 0x0c38 length: 249 > 2 [ 768.265267][T28854] x_tables: unsorted underflow at hook 3 [ 768.549630][ T4933] Bluetooth: hci1: command tx timeout [ 768.730703][T28870] Cannot find map_set index 135 as target [ 768.773881][ T6874] netdevsim netdevsim3 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 768.789457][T12147] net_ratelimit: 154 callbacks suppressed [ 768.789506][T12147] bond3: (slave ip6gretap0): link status up, enabling it in 0 ms [ 768.806048][ T6890] bond3: (slave ip6gretap0): link status up, enabling it in 0 ms [ 768.826004][T12147] bond3: (slave ip6gretap0): link status up, enabling it in 0 ms [ 768.848561][ T6886] bond3: (slave ip6gretap0): link status up, enabling it in 0 ms [ 768.867756][ T203] bond3: (slave ip6gretap0): link status up, enabling it in 0 ms [ 768.882727][ T203] bond3: (slave ip6gretap0): failed to get link speed/duplex [ 768.986396][ T203] bond3: (slave ip6gretap0): link status up, enabling it in 0 ms [ 769.022612][ T203] bond3: (slave ip6gretap0): link status up, enabling it in 0 ms [ 769.029345][T28896] netlink: 24 bytes leftover after parsing attributes in process `syz.1.5970'. [ 769.044074][ T6874] netdevsim netdevsim3 netdevsim2 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 769.044130][ T6874] netdevsim netdevsim3 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 769.047921][ T203] bond3: (slave ip6gretap0): link status up, enabling it in 0 ms [ 769.066156][ T203] bond3: (slave ip6gretap0): link status up, enabling it in 0 ms [ 769.167512][T28893] netlink: 28 bytes leftover after parsing attributes in process `syz.2.5969'. [ 769.167558][T28893] netlink: 28 bytes leftover after parsing attributes in process `syz.2.5969'. [ 769.167574][T28893] netlink: 'syz.2.5969': attribute type 6 has an invalid length. [ 769.175122][T28893] netlink: 28 bytes leftover after parsing attributes in process `syz.2.5969'. [ 769.175148][T28893] netlink: 28 bytes leftover after parsing attributes in process `syz.2.5969'. [ 769.175162][T28893] netlink: 'syz.2.5969': attribute type 6 has an invalid length. [ 769.460882][ T6874] netdevsim netdevsim3 netdevsim1 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 769.460933][ T6874] netdevsim netdevsim3 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 769.493154][T28844] lo speed is unknown, defaulting to 1000 [ 769.659136][ T6874] netdevsim netdevsim3 netdevsim0 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 769.659191][ T6874] netdevsim netdevsim3 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 769.932656][T28932] sch_tbf: burst 255 is lower than device syzkaller0 mtu (1514) ! [ 769.980029][T12147] netdevsim netdevsim3 eth2: set [1, 0] type 2 family 0 port 6081 - 0 [ 769.982827][ T203] netdevsim netdevsim3 eth1: set [1, 0] type 2 family 0 port 6081 - 0 [ 769.982903][ T203] netdevsim netdevsim3 eth3: set [1, 0] type 2 family 0 port 6081 - 0 [ 770.011323][T28932] tipc: Resetting bearer [ 770.058832][ T6874] pimreg: left allmulticast mode [ 770.162434][ T4933] Bluetooth: hci4: command tx timeout [ 770.262984][ T6874] bond8 (unregistering): (slave erspan1): Releasing active interface [ 770.263021][ T6874] erspan1 (unregistering): left promiscuous mode [ 770.391604][ T6874] bond0 (unregistering): (slave veth0_to_bond): Releasing backup interface [ 770.404273][ T6874] bond0 (unregistering): Released all slaves [ 770.413643][ T6874] bond1 (unregistering): Released all slaves [ 770.425564][ T6874] bond2 (unregistering): Released all slaves [ 770.437359][ T6874] bond3 (unregistering): Released all slaves [ 770.451364][ T6874] bond4 (unregistering): (slave veth3): Releasing active interface [ 770.463895][ T6874] bond4 (unregistering): Released all slaves [ 770.478888][ T6874] bond5 (unregistering): Released all slaves [ 770.489917][ T6874] bond6 (unregistering): Released all slaves [ 770.501381][ T6874] bond7 (unregistering): Released all slaves [ 770.514558][ T6874] bond8 (unregistering): Released all slaves [ 770.603093][T28844] bridge0: port 1(bridge_slave_0) entered blocking state [ 770.615246][T28844] bridge0: port 1(bridge_slave_0) entered disabled state [ 770.615501][T28844] bridge_slave_0: entered allmulticast mode [ 770.634109][T28844] bridge_slave_0: entered promiscuous mode [ 770.644413][T28844] bridge0: port 2(bridge_slave_1) entered blocking state [ 770.651908][T28844] bridge0: port 2(bridge_slave_1) entered disabled state [ 770.652070][T28844] bridge_slave_1: entered allmulticast mode [ 770.665291][T28844] bridge_slave_1: entered promiscuous mode [ 770.691499][ T6874] tipc: Disabling bearer [ 770.691625][ T6874] tipc: Disabling bearer [ 770.716392][ T6874] tipc: Left network mode [ 770.728984][ T6890] netdevsim netdevsim3 eth4: set [1, 0] type 2 family 0 port 6081 - 0 [ 770.745354][T28844] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 770.765320][T28844] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 770.829699][T28844] team0: Port device team_slave_0 added [ 770.834359][T28844] team0: Port device team_slave_1 added [ 770.879316][T28844] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 770.885953][T28844] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 770.885985][T28844] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 770.902169][T28844] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 770.902185][T28844] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 770.902208][T28844] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 770.999057][T28844] hsr_slave_0: entered promiscuous mode [ 771.006362][T28844] hsr_slave_1: entered promiscuous mode [ 771.012780][T28844] debugfs: 'hsr0' already exists in 'hsr' [ 771.014018][T28844] Cannot create hsr debugfs directory [ 771.336894][T28844] netdevsim netdevsim3 eth4 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 771.419692][T28844] netdevsim netdevsim3 eth3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 771.507512][T28844] netdevsim netdevsim3 eth2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 771.554973][T28844] netdevsim netdevsim3 eth1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 771.620412][T28870] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 771.973016][T28947] netlink: 736 bytes leftover after parsing attributes in process `syz.0.5976'. [ 771.973056][T28947] netlink: 1982 bytes leftover after parsing attributes in process `syz.0.5976'. [ 771.973086][T28947] netlink: 24 bytes leftover after parsing attributes in process `syz.0.5976'. [ 772.079250][T28947] netlink: 20 bytes leftover after parsing attributes in process `syz.0.5976'. [ 772.226915][ T4933] Bluetooth: hci4: command tx timeout [ 772.461723][ T6874] hsr_slave_0: left promiscuous mode [ 772.470340][ T6874] hsr_slave_1: left promiscuous mode [ 772.493002][ T6874] veth0_macvtap: left promiscuous mode [ 772.500911][ T6874] ÿ: left promiscuous mode [ 773.194891][ T7101] smc: removing ib device syz0 [ 773.376635][T28959] netlink: 76 bytes leftover after parsing attributes in process `syz.1.5980'. [ 773.446555][T28844] netdevsim netdevsim3 netdevsim0: renamed from eth0 [ 773.477300][T28844] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 773.489319][T28844] netdevsim netdevsim3 netdevsim1: renamed from eth1 [ 773.526980][T28844] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 773.535226][T28844] netdevsim netdevsim3 netdevsim2: renamed from eth2 [ 773.587028][T28844] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 773.587956][T28844] netdevsim netdevsim3 netdevsim3: renamed from eth3 [ 773.627075][T28844] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 773.643024][ T7101] smbdirect: ib_dev[syz0] removed [ 773.674207][T28994] netlink: 'syz.1.5987': attribute type 1 has an invalid length. [ 773.796633][ T6886] net_ratelimit: 172 callbacks suppressed [ 773.796681][ T6886] bond3: (slave ip6gretap0): link status up, enabling it in 0 ms [ 773.816201][ T6890] bond3: (slave ip6gretap0): link status up, enabling it in 0 ms [ 773.838518][ T50] bond3: (slave ip6gretap0): link status up, enabling it in 0 ms [ 773.857629][ T203] bond3: (slave ip6gretap0): link status up, enabling it in 0 ms [ 773.875875][ T6886] bond3: (slave ip6gretap0): link status up, enabling it in 0 ms [ 773.900520][ T203] bond3: (slave ip6gretap0): link status up, enabling it in 0 ms [ 773.919294][ T50] bond3: (slave ip6gretap0): link status up, enabling it in 0 ms [ 773.938482][ T203] bond3: (slave ip6gretap0): link status up, enabling it in 0 ms [ 773.957848][ T6886] bond3: (slave ip6gretap0): link status up, enabling it in 0 ms [ 773.975893][ T6886] bond3: (slave ip6gretap0): link status up, enabling it in 0 ms [ 774.245454][T28995] bond7: (slave veth0_to_bond): making interface the new active one [ 774.254728][T28995] bond7: (slave veth0_to_bond): Enslaving as an active interface with an up link [ 774.306466][ T4933] Bluetooth: hci4: command tx timeout [ 774.561006][T28844] 8021q: adding VLAN 0 to HW filter on device bond0 [ 774.663422][T28844] 8021q: adding VLAN 0 to HW filter on device team0 [ 774.694043][ T50] bridge0: port 1(bridge_slave_0) entered blocking state [ 774.694162][ T50] bridge0: port 1(bridge_slave_0) entered forwarding state [ 774.789810][T29046] __nla_validate_parse: 1 callbacks suppressed [ 774.789868][T29046] netlink: 64 bytes leftover after parsing attributes in process `syz.2.5995'. [ 774.945913][T29053] netlink: 4 bytes leftover after parsing attributes in process `syz.0.5997'. [ 774.960643][T29043] syzkaller1: entered promiscuous mode [ 774.960691][T29043] syzkaller1: entered allmulticast mode [ 775.049551][ T50] bridge0: port 2(bridge_slave_1) entered blocking state [ 775.049666][ T50] bridge0: port 2(bridge_slave_1) entered forwarding state [ 775.820665][T29077] netlink: 'syz.1.6003': attribute type 1 has an invalid length. [ 776.052680][T29096] netlink: 48 bytes leftover after parsing attributes in process `syz.0.6005'. [ 776.083339][T29091] netlink: 'syz.4.6006': attribute type 12 has an invalid length. [ 776.083389][T29091] netlink: 'syz.4.6006': attribute type 29 has an invalid length. [ 776.083417][T29091] netlink: 148 bytes leftover after parsing attributes in process `syz.4.6006'. [ 776.083437][T29091] netlink: 'syz.4.6006': attribute type 2 has an invalid length. [ 776.386176][ T4933] Bluetooth: hci4: command tx timeout [ 776.481985][T29105] netlink: 284 bytes leftover after parsing attributes in process `syz.2.6008'. [ 776.603889][T29121] netlink: 20 bytes leftover after parsing attributes in process `syz.0.6012'. [ 776.669558][T29128] netlink: 20 bytes leftover after parsing attributes in process `syz.0.6012'. [ 776.702129][T28844] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 776.704847][T29122] netlink: 'syz.4.6011': attribute type 83 has an invalid length. [ 776.775410][T29122] netlink: 16 bytes leftover after parsing attributes in process `syz.4.6011'. [ 776.969657][T28844] veth0_vlan: entered promiscuous mode [ 777.035504][T28844] veth1_vlan: entered promiscuous mode [ 777.227800][T28844] veth0_macvtap: entered promiscuous mode [ 777.255561][T28844] veth1_macvtap: entered promiscuous mode [ 777.400918][T28844] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 777.457217][T28844] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 777.589814][T29180] ieee802154 phy1 wpan1: encryption failed: -22 [ 777.793424][ T50] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 777.801507][ T50] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 777.801549][ T50] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 777.801591][ T50] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 777.815232][T29184] netlink: 36 bytes leftover after parsing attributes in process `syz.4.6020'. [ 778.038595][T29195] xt_TCPMSS: Only works on TCP SYN packets [ 778.190103][T29201] netlink: 52 bytes leftover after parsing attributes in process `syz.0.6023'. [ 778.339773][ T6900] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 778.339816][ T6900] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 778.682569][ T6896] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 778.682612][ T6896] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 778.754408][T29213] syzkaller0: entered promiscuous mode [ 778.754453][T29213] syzkaller0: entered allmulticast mode [ 778.898704][ T6896] net_ratelimit: 141 callbacks suppressed [ 778.898776][ T6896] bond3: (slave ip6gretap0): link status up, enabling it in 0 ms [ 778.916691][ T6896] bond3: (slave ip6gretap0): link status up, enabling it in 0 ms [ 778.940153][T23477] bond3: (slave ip6gretap0): link status up, enabling it in 0 ms [ 778.956482][T23477] bond3: (slave ip6gretap0): link status up, enabling it in 0 ms [ 778.977880][ T6896] bond3: (slave ip6gretap0): link status up, enabling it in 0 ms [ 778.997733][ T6896] bond3: (slave ip6gretap0): link status up, enabling it in 0 ms [ 779.016082][ T6900] bond3: (slave ip6gretap0): link status up, enabling it in 0 ms [ 779.036519][ T6896] bond3: (slave ip6gretap0): link status up, enabling it in 0 ms [ 779.058690][ T6896] bond3: (slave ip6gretap0): link status up, enabling it in 0 ms [ 779.099654][ T50] bond3: (slave ip6gretap0): link status up, enabling it in 0 ms [ 779.261105][T29246] netlink: 'syz.3.5956': attribute type 39 has an invalid length. [ 779.727184][T29256] xt_addrtype: both incoming and outgoing interface limitation cannot be selected [ 779.751162][T29259] xt_addrtype: both incoming and outgoing interface limitation cannot be selected [ 779.914450][T18500] Bluetooth: hci5: unexpected cc 0x0c03 length: 249 > 1 [ 779.931030][T18500] Bluetooth: hci5: unexpected cc 0x1003 length: 249 > 9 [ 779.937375][T18500] Bluetooth: hci5: unexpected cc 0x1001 length: 249 > 9 [ 779.973765][T18500] Bluetooth: hci5: unexpected cc 0x0c23 length: 249 > 4 [ 779.983424][T18500] Bluetooth: hci5: unexpected cc 0x0c38 length: 249 > 2 [ 780.540198][T29295] xt_addrtype: input interface limitation not valid in POSTROUTING and OUTPUT [ 780.597220][ T6874] IPVS: stop unused estimator thread 0... [ 780.880083][T29303] tipc: New replicast peer: 255.255.255.255 [ 780.881019][T29303] tipc: Enabled bearer , priority 10 [ 781.348255][T29331] __nla_validate_parse: 4 callbacks suppressed [ 781.348303][T29331] netlink: 16 bytes leftover after parsing attributes in process `syz.0.6045'. [ 781.412916][T29321] xt_CT: No such helper "pptp" [ 781.479720][T29264] lo speed is unknown, defaulting to 1000 [ 782.147944][T18500] Bluetooth: hci5: command tx timeout [ 782.227066][T29357] netlink: 20 bytes leftover after parsing attributes in process `syz.0.6049'. [ 782.227115][T29357] nbd: socks must be embedded in a SOCK_ITEM attr [ 782.418656][T29371] netlink: 12 bytes leftover after parsing attributes in process `syz.1.6052'. [ 782.520381][T29371] veth0_macvtap: entered allmulticast mode [ 782.590729][T29264] bridge0: port 1(bridge_slave_0) entered blocking state [ 782.602461][T29264] bridge0: port 1(bridge_slave_0) entered disabled state [ 782.602735][T29264] bridge_slave_0: entered allmulticast mode [ 782.622606][T29264] bridge_slave_0: entered promiscuous mode [ 782.652538][T29376] bridge0: entered promiscuous mode [ 782.652588][T29376] bridge0: entered allmulticast mode [ 782.665360][T29264] bridge0: port 2(bridge_slave_1) entered blocking state [ 782.665472][T29264] bridge0: port 2(bridge_slave_1) entered disabled state [ 782.665655][T29264] bridge_slave_1: entered allmulticast mode [ 782.668967][T29264] bridge_slave_1: entered promiscuous mode [ 782.701469][T29384] FAULT_INJECTION: forcing a failure. [ 782.701469][T29384] name failslab, interval 1, probability 0, space 0, times 0 [ 782.701523][T29384] CPU: 0 UID: 0 PID: 29384 Comm: syz.2.6055 Not tainted syzkaller #0 PREEMPT(full) [ 782.701542][T29384] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 782.701551][T29384] Call Trace: [ 782.701558][T29384] [ 782.701565][T29384] dump_stack_lvl+0xe8/0x150 [ 782.701595][T29384] should_fail_ex+0x410/0x560 [ 782.701628][T29384] should_failslab+0xa8/0x100 [ 782.701649][T29384] ? skb_clone+0x212/0x3a0 [ 782.701669][T29384] kmem_cache_alloc_noprof+0xa1/0x600 [ 782.701697][T29384] ? skb_clone+0x212/0x3a0 [ 782.701722][T29384] skb_clone+0x212/0x3a0 [ 782.701745][T29384] __netlink_deliver_tap+0x413/0x860 [ 782.701778][T29384] ? netlink_deliver_tap+0x2e/0x1b0 [ 782.701810][T29384] netlink_deliver_tap+0x19c/0x1b0 [ 782.701833][T29384] netlink_unicast+0x781/0x940 [ 782.701862][T29384] netlink_sendmsg+0x813/0xb40 [ 782.701893][T29384] ? __pfx_netlink_sendmsg+0x10/0x10 [ 782.701923][T29384] ? apparmor_socket_sendmsg+0x98/0x360 [ 782.701951][T29384] ? __pfx_netlink_sendmsg+0x10/0x10 [ 782.701971][T29384] sock_sendmsg_nosec+0x13a/0x180 [ 782.701997][T29384] ____sys_sendmsg+0x54e/0x850 [ 782.702021][T29384] ? __pfx_____sys_sendmsg+0x10/0x10 [ 782.702050][T29384] ? import_iovec+0x73/0xa0 [ 782.702072][T29384] ___sys_sendmsg+0x2a5/0x360 [ 782.702090][T29384] ? __lock_acquire+0x6df/0x2e50 [ 782.702112][T29384] ? __pfx____sys_sendmsg+0x10/0x10 [ 782.702165][T29384] ? __fget_files+0x2a/0x420 [ 782.702186][T29384] ? __fget_files+0x3a2/0x420 [ 782.702222][T29384] __x64_sys_sendmsg+0x1b1/0x290 [ 782.702244][T29384] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 782.702283][T29384] do_syscall_64+0x166/0x520 [ 782.702307][T29384] ? trace_irq_disable+0x3b/0x140 [ 782.702324][T29384] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 782.702343][T29384] ? clear_bhb_loop+0x70/0xc0 [ 782.702364][T29384] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 782.702381][T29384] RIP: 0033:0x7f45cbf9e159 [ 782.702398][T29384] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 782.702414][T29384] RSP: 002b:00007f45cce62028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 782.702433][T29384] RAX: ffffffffffffffda RBX: 00007f45cc226090 RCX: 00007f45cbf9e159 [ 782.702446][T29384] RDX: 0000000000000000 RSI: 00002000000001c0 RDI: 0000000000000003 [ 782.702457][T29384] RBP: 00007f45cce62090 R08: 0000000000000000 R09: 0000000000000000 [ 782.702467][T29384] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 782.702478][T29384] R13: 00007f45cc226128 R14: 00007f45cc226090 R15: 00007ffff29afa18 [ 782.702508][T29384] [ 782.742921][T29385] netlink: 'syz.1.6056': attribute type 2 has an invalid length. [ 782.742942][T29385] netlink: 'syz.1.6056': attribute type 8 has an invalid length. [ 782.742952][T29385] netlink: 132 bytes leftover after parsing attributes in process `syz.1.6056'. [ 782.753551][T29379] dvmrp8: entered allmulticast mode [ 782.754650][T29383] syzkaller1: entered promiscuous mode [ 782.754668][T29383] syzkaller1: entered allmulticast mode [ 782.837691][T29264] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 782.994930][T29264] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 783.122964][T29399] IPVS: set_ctl: invalid protocol: 1 172.20.20.187:20002 [ 783.182099][T29264] team0: Port device team_slave_0 added [ 783.198657][T29264] team0: Port device team_slave_1 added [ 783.254057][T29264] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 783.254095][T29264] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 783.254187][T29264] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 783.258975][T29264] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 783.258989][T29264] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 783.259012][T29264] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 783.413265][T29433] Cannot find map_set index 135 as target [ 783.424109][T29264] hsr_slave_0: entered promiscuous mode [ 783.426476][T29264] hsr_slave_1: entered promiscuous mode [ 783.429515][T29264] debugfs: 'hsr0' already exists in 'hsr' [ 783.429534][T29264] Cannot create hsr debugfs directory [ 783.583662][T29436] netlink: 4 bytes leftover after parsing attributes in process `syz.1.6063'. [ 783.916195][ T50] net_ratelimit: 155 callbacks suppressed [ 783.917288][ T50] bond3: (slave ip6gretap0): link status up, enabling it in 0 ms [ 783.917318][ T50] bond3: (slave ip6gretap0): failed to get link speed/duplex [ 784.030075][ T6900] bond3: (slave ip6gretap0): link status up, enabling it in 0 ms [ 784.046501][ T6896] bond3: (slave ip6gretap0): link status up, enabling it in 0 ms [ 784.050153][T29459] netlink: 'syz.1.6069': attribute type 39 has an invalid length. [ 784.072372][ T6874] bond3: (slave ip6gretap0): link status up, enabling it in 0 ms [ 784.081418][T29461] netlink: 4 bytes leftover after parsing attributes in process `syz.3.6068'. [ 784.085915][ T50] bond3: (slave ip6gretap0): link status up, enabling it in 0 ms [ 784.108272][ T6900] bond3: (slave ip6gretap0): link status up, enabling it in 0 ms [ 784.126961][ T50] bond3: (slave ip6gretap0): link status up, enabling it in 0 ms [ 784.147356][ T50] bond3: (slave ip6gretap0): link status up, enabling it in 0 ms [ 784.167380][ T50] bond3: (slave ip6gretap0): link status up, enabling it in 0 ms [ 784.178776][T29468] netlink: 4 bytes leftover after parsing attributes in process `syz.3.6068'. [ 784.226644][T18500] Bluetooth: hci5: command tx timeout [ 784.301765][T29452] bond1: option arp_all_targets: invalid value (18446744073709551613) [ 784.320955][T29452] bond1 (unregistering): Released all slaves [ 784.700427][T29491] netlink: 24 bytes leftover after parsing attributes in process `syz.3.6078'. [ 784.785114][T29496] netlink: 28 bytes leftover after parsing attributes in process `syz.3.6078'. [ 784.785161][T29496] nbd: must specify at least one socket [ 784.844970][T29502] netlink: 28 bytes leftover after parsing attributes in process `syz.1.6079'. [ 784.959719][T29510] netlink: 'syz.1.6083': attribute type 39 has an invalid length. [ 785.217243][T29527] netlink: 'syz.1.6086': attribute type 1 has an invalid length. [ 785.352089][T29531] netlink: 'syz.1.6089': attribute type 4 has an invalid length. [ 785.640311][T29538] veth1_macvtap: left promiscuous mode [ 785.671545][T29264] netdevsim netdevsim4 netdevsim0: renamed from eth0 [ 785.691883][T29264] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 785.694226][T29264] netdevsim netdevsim4 netdevsim1: renamed from eth1 [ 785.749595][T29264] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 785.763231][T29264] netdevsim netdevsim4 netdevsim2: renamed from eth2 [ 785.797003][T29264] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 785.798173][T29264] netdevsim netdevsim4 netdevsim3: renamed from eth3 [ 785.815015][T29264] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 785.957960][T29561] netlink: 'syz.3.6094': attribute type 39 has an invalid length. [ 786.169093][T29264] 8021q: adding VLAN 0 to HW filter on device bond0 [ 786.213185][T29264] 8021q: adding VLAN 0 to HW filter on device team0 [ 786.243027][T23476] bridge0: port 1(bridge_slave_0) entered blocking state [ 786.243172][T23476] bridge0: port 1(bridge_slave_0) entered forwarding state [ 786.275291][T23476] bridge0: port 2(bridge_slave_1) entered blocking state [ 786.275414][T23476] bridge0: port 2(bridge_slave_1) entered forwarding state [ 786.307948][T18500] Bluetooth: hci5: command tx timeout [ 786.389809][T18500] Bluetooth: hci4: Controller not accepting commands anymore: ncmd = 0 [ 786.390030][T18500] Bluetooth: hci4: Injecting HCI hardware error event [ 786.396531][ T4933] Bluetooth: hci4: hardware error 0x00 [ 786.499116][T29574] lo speed is unknown, defaulting to 1000 [ 786.550270][ T6874] tipc: Subscription rejected, illegal request [ 786.584803][T29579] __nla_validate_parse: 6 callbacks suppressed [ 786.585586][T29579] netlink: 32 bytes leftover after parsing attributes in process `syz.2.6099'. [ 786.590313][T29579] netlink: 36 bytes leftover after parsing attributes in process `syz.2.6099'. [ 786.708772][T29579] syzkaller1: entered promiscuous mode [ 786.708819][T29579] syzkaller1: entered allmulticast mode [ 787.287089][T29608] netlink: 'syz.2.6104': attribute type 39 has an invalid length. [ 787.359459][T29264] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 787.550906][T29620] sctp: [Deprecated]: syz.3.6107 (pid 29620) Use of struct sctp_assoc_value in delayed_ack socket option. [ 787.550906][T29620] Use struct sctp_sack_info instead [ 788.062129][T29264] veth0_vlan: entered promiscuous mode [ 788.094016][T29264] veth1_vlan: entered promiscuous mode [ 788.166231][T29650] netlink: 'syz.2.6117': attribute type 39 has an invalid length. [ 788.186601][T29652] netlink: 'syz.1.6115': attribute type 2 has an invalid length. [ 788.204785][T29654] macsec0: entered promiscuous mode [ 788.255434][T29264] veth0_macvtap: entered promiscuous mode [ 788.314713][T29264] veth1_macvtap: entered promiscuous mode [ 788.335794][T29264] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 788.346540][T29659] netlink: 'syz.2.6118': attribute type 2 has an invalid length. [ 788.362761][T29264] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 788.387095][T18500] Bluetooth: hci5: command tx timeout [ 788.418938][ T6896] netdevsim netdevsim4 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 788.419003][ T6896] netdevsim netdevsim4 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 788.419032][ T6896] netdevsim netdevsim4 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 788.419056][ T6896] netdevsim netdevsim4 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 788.450720][T23476] nci: nci_extract_activation_params_iso_dep: unsupported activation_rf_tech_and_mode 0x2 [ 788.483145][T29665] netlink: 'syz.2.6118': attribute type 7 has an invalid length. [ 788.559077][ T4933] Bluetooth: hci4: Opcode 0x0c03 failed: -110 [ 788.784949][ T6896] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 788.785005][ T6896] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 788.926428][T29683] netlink: 28 bytes leftover after parsing attributes in process `syz.1.6126'. [ 788.927322][ T6896] net_ratelimit: 158 callbacks suppressed [ 788.927356][ T6896] bond3: (slave ip6gretap0): link status up, enabling it in 0 ms [ 788.942064][ T6896] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 788.942083][ T6896] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 788.948650][T23476] bond3: (slave ip6gretap0): link status up, enabling it in 0 ms [ 788.948675][T23476] bond3: (slave ip6gretap0): failed to get link speed/duplex [ 789.056403][ T6896] bond3: (slave ip6gretap0): link status up, enabling it in 0 ms [ 789.056454][ T6896] bond3: (slave ip6gretap0): failed to get link speed/duplex [ 789.085276][T29689] netlink: 'syz.3.6127': attribute type 39 has an invalid length. [ 789.174841][ T7101] bond3: (slave ip6gretap0): link status up, enabling it in 0 ms [ 789.174894][ T7101] bond3: (slave ip6gretap0): failed to get link speed/duplex [ 789.277938][ T6896] bond3: (slave ip6gretap0): link status up, enabling it in 0 ms [ 789.297942][ T7101] bond3: (slave ip6gretap0): link status up, enabling it in 0 ms [ 789.313860][T29697] netlink: 132 bytes leftover after parsing attributes in process `syz.3.6129'. [ 789.317409][ T6896] bond3: (slave ip6gretap0): link status up, enabling it in 0 ms [ 789.342809][T29697] netlink: 132 bytes leftover after parsing attributes in process `syz.3.6129'. [ 789.641833][T18500] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 789.653482][T18500] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 789.660888][T18500] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 789.664802][T18500] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 789.665401][T18500] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 789.972953][T29722] bond1: Removing last arp target with arp_interval on [ 789.989078][T29730] validate_nla: 2 callbacks suppressed [ 789.989123][T29730] netlink: 'syz.4.6139': attribute type 39 has an invalid length. [ 789.993449][T29722] bond1 (unregistering): Released all slaves [ 790.606941][T29753] netlink: 16 bytes leftover after parsing attributes in process `syz.4.6144'. [ 790.763519][T29712] lo speed is unknown, defaulting to 1000 [ 790.993698][T29765] netlink: 'syz.1.6146': attribute type 2 has an invalid length. [ 791.374773][T29784] netlink: 28 bytes leftover after parsing attributes in process `syz.1.6150'. [ 791.650172][T29797] netlink: 'syz.3.6153': attribute type 39 has an invalid length. [ 791.747560][T18500] Bluetooth: hci0: command tx timeout [ 791.802317][T29802] No such timeout policy "s" [ 792.021975][T29712] bridge0: port 1(bridge_slave_0) entered blocking state [ 792.022082][T29712] bridge0: port 1(bridge_slave_0) entered disabled state [ 792.022277][T29712] bridge_slave_0: entered allmulticast mode [ 792.028113][T29712] bridge_slave_0: entered promiscuous mode [ 792.037286][T29712] bridge0: port 2(bridge_slave_1) entered blocking state [ 792.037525][T29712] bridge0: port 2(bridge_slave_1) entered disabled state [ 792.037925][T29712] bridge_slave_1: entered allmulticast mode [ 792.044657][T29712] bridge_slave_1: entered promiscuous mode [ 792.217477][T29712] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 792.232051][T29712] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 792.275486][T29828] ip6t_REJECT: ECHOREPLY is not supported [ 792.429989][T29830] bridge0: port 2(bridge_slave_1) entered disabled state [ 792.450774][T29712] team0: Port device team_slave_0 added [ 792.467468][T29712] team0: Port device team_slave_1 added [ 792.557476][T29839] netlink: 40 bytes leftover after parsing attributes in process `syz.1.6163'. [ 792.609520][T29712] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 792.609566][T29712] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 792.611701][T29712] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 792.628770][T29712] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 792.628787][T29712] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 792.628812][T29712] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 792.733180][T29845] netlink: 'syz.2.6165': attribute type 39 has an invalid length. [ 792.769936][T29712] hsr_slave_0: entered promiscuous mode [ 792.772481][T29843] netlink: 'syz.4.6164': attribute type 1 has an invalid length. [ 792.772502][T29843] netlink: 16150 bytes leftover after parsing attributes in process `syz.4.6164'. [ 792.776787][T29712] hsr_slave_1: entered promiscuous mode [ 792.777370][T29843] netlink: 164 bytes leftover after parsing attributes in process `syz.4.6164'. [ 792.813093][T29712] debugfs: 'hsr0' already exists in 'hsr' [ 792.819105][T29712] Cannot create hsr debugfs directory [ 793.554874][T29712] netdevsim netdevsim0 netdevsim3 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 793.554932][T29712] netdevsim netdevsim0 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 793.794562][T29712] netdevsim netdevsim0 netdevsim2 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 793.794621][T29712] netdevsim netdevsim0 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 793.826291][T18500] Bluetooth: hci0: command tx timeout [ 793.881980][T29887] netlink: 28 bytes leftover after parsing attributes in process `syz.3.6175'. [ 793.887358][T29887] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 793.964297][T29887] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 793.976868][ T50] net_ratelimit: 160 callbacks suppressed [ 793.976931][ T50] bond3: (slave ip6gretap0): link status up, enabling it in 0 ms [ 793.996918][ T50] bond3: (slave ip6gretap0): link status up, enabling it in 0 ms [ 794.016186][T23476] bond3: (slave ip6gretap0): link status up, enabling it in 0 ms [ 794.035989][T23477] bond3: (slave ip6gretap0): link status up, enabling it in 0 ms [ 794.057180][ T50] bond3: (slave ip6gretap0): link status up, enabling it in 0 ms [ 794.080977][ T50] bond3: (slave ip6gretap0): link status up, enabling it in 0 ms [ 794.096473][T23477] bond3: (slave ip6gretap0): link status up, enabling it in 0 ms [ 794.108480][T29888] sit0: entered promiscuous mode [ 794.116465][T29899] netlink: 'syz.4.6177': attribute type 39 has an invalid length. [ 794.116882][ T50] bond3: (slave ip6gretap0): link status up, enabling it in 0 ms [ 794.120962][T29888] netlink: 8 bytes leftover after parsing attributes in process `syz.3.6175'. [ 794.140559][T23477] bond3: (slave ip6gretap0): link status up, enabling it in 0 ms [ 794.158505][ T7101] bond3: (slave ip6gretap0): link status up, enabling it in 0 ms [ 794.213021][T29712] netdevsim netdevsim0 netdevsim1 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 794.224207][T29712] netdevsim netdevsim0 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 794.362292][T29905] x_tables: duplicate underflow at hook 1 [ 794.470751][T29917] netlink: 32 bytes leftover after parsing attributes in process `syz.3.6179'. [ 794.500683][T29712] netdevsim netdevsim0 netdevsim0 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 794.514854][T29712] netdevsim netdevsim0 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 794.612917][T29914] netlink: 76 bytes leftover after parsing attributes in process `syz.4.6181'. [ 794.667771][T29916] xt_TCPMSS: path-MTU clamping only supported in FORWARD, OUTPUT and POSTROUTING hooks [ 794.672073][T29916] xt_hashlimit: size too large, truncated to 1048576 [ 794.970717][T29940] netlink: 4 bytes leftover after parsing attributes in process `syz.1.6185'. [ 795.063644][T29948] netlink: 60 bytes leftover after parsing attributes in process `syz.1.6185'. [ 795.255113][T29956] netlink: 'syz.3.6186': attribute type 61 has an invalid length. [ 795.323576][T29958] xt_hl: Unknown TTL match mode: 255 [ 795.332683][T29951] batadv0: entered promiscuous mode [ 795.332862][T29951] macsec1: entered promiscuous mode [ 795.334326][T29951] 8021q: adding VLAN 0 to HW filter on device macsec1 [ 795.338562][T29951] batadv0: left promiscuous mode [ 795.473894][T29712] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 795.484699][T29964] netlink: 'syz.4.6190': attribute type 39 has an invalid length. [ 795.493171][T29712] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 795.501354][T29712] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 795.513347][T29712] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 795.554074][T29712] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 795.567989][T29712] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 795.576913][T29712] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 795.606848][T29712] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 795.702235][T29979] netlink: 'syz.4.6194': attribute type 1 has an invalid length. [ 795.778269][T29981] netlink: 28 bytes leftover after parsing attributes in process `syz.4.6194'. [ 795.842105][T18500] block nbd3: Receive control failed (result -32) [ 795.893259][T29987] netlink: 'syz.3.6195': attribute type 1 has an invalid length. [ 795.906848][T18500] Bluetooth: hci0: command tx timeout [ 796.003730][T29987] 8021q: adding VLAN 0 to HW filter on device bond1 [ 796.023743][T29993] set match dimension is over the limit! [ 796.045416][T29712] 8021q: adding VLAN 0 to HW filter on device bond0 [ 796.093119][T29959] tipc: Started in network mode [ 796.093170][T29959] tipc: Node identity 361388efc66, cluster identity 4711 [ 796.093408][T29959] tipc: Enabled bearer , priority 10 [ 796.140609][T29712] 8021q: adding VLAN 0 to HW filter on device team0 [ 796.159456][T23477] bridge0: port 1(bridge_slave_0) entered blocking state [ 796.159595][T23477] bridge0: port 1(bridge_slave_0) entered forwarding state [ 796.167083][T29957] tipc: Resetting bearer [ 796.222977][T29957] tipc: Disabling bearer [ 796.250905][T30008] netlink: 'syz.4.6201': attribute type 39 has an invalid length. [ 796.280063][T23476] bridge0: port 2(bridge_slave_1) entered blocking state [ 796.280172][T23476] bridge0: port 2(bridge_slave_1) entered forwarding state [ 796.864561][T30032] sctp: [Deprecated]: syz.2.6206 (pid 30032) Use of int in max_burst socket option deprecated. [ 796.864561][T30032] Use struct sctp_assoc_value instead [ 796.931553][T30043] bond1: option primary: mode dependency failed, not supported in mode balance-rr(0) [ 796.946696][T30043] bond1 (unregistering): Released all slaves [ 797.042874][T30047] bond1: option primary: mode dependency failed, not supported in mode balance-rr(0) [ 797.048745][T30047] bond1 (unregistering): Released all slaves [ 797.259692][T30064] netlink: 'syz.4.6212': attribute type 39 has an invalid length. [ 797.370479][T30070] netlink: 'syz.4.6215': attribute type 3 has an invalid length. [ 797.388815][T30070] netlink: 'syz.4.6215': attribute type 3 has an invalid length. [ 797.398089][T30070] netlink: 'syz.4.6215': attribute type 3 has an invalid length. [ 797.406959][T30070] netlink: 'syz.4.6215': attribute type 3 has an invalid length. [ 797.417997][T30072] x_tables: ip_tables: osf match: only valid for protocol 6 [ 797.474887][T29712] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 797.519929][T30076] syzkaller0: entered promiscuous mode [ 797.528060][T30076] syzkaller0: entered allmulticast mode [ 797.534676][ T6896] nci: nci_extract_activation_params_iso_dep: unsupported activation_rf_tech_and_mode 0x2 [ 797.572289][T30076] __nla_validate_parse: 7 callbacks suppressed [ 797.572335][T30076] netlink: 4 bytes leftover after parsing attributes in process `syz.3.6214'. [ 797.707184][T29712] veth0_vlan: entered promiscuous mode [ 797.731744][T29712] veth1_vlan: entered promiscuous mode [ 797.842313][T30104] netlink: 20 bytes leftover after parsing attributes in process `syz.1.6220'. [ 797.924061][T29712] veth0_macvtap: entered promiscuous mode [ 797.938995][T29712] veth1_macvtap: entered promiscuous mode [ 797.975649][T29712] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 797.983888][T29712] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 797.986468][T18500] Bluetooth: hci0: command tx timeout [ 798.059312][ T6890] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 798.059790][ T6890] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 798.059841][ T6890] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 798.059871][ T6890] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 798.189570][T23475] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 798.189604][T23475] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 798.320987][ T6887] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 798.321031][ T6887] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 798.421814][T30123] netlink: 104 bytes leftover after parsing attributes in process `syz.3.6227'. [ 798.543878][T30129] xt_CT: You must specify a L4 protocol and not use inversions on it [ 798.603160][T30127] FAULT_INJECTION: forcing a failure. [ 798.603160][T30127] name failslab, interval 1, probability 0, space 0, times 0 [ 798.603233][T30127] CPU: 0 UID: 0 PID: 30127 Comm: syz.0.6132 Not tainted syzkaller #0 PREEMPT(full) [ 798.603255][T30127] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 798.603265][T30127] Call Trace: [ 798.603273][T30127] [ 798.603281][T30127] dump_stack_lvl+0xe8/0x150 [ 798.603312][T30127] should_fail_ex+0x410/0x560 [ 798.603343][T30127] should_failslab+0xa8/0x100 [ 798.603363][T30127] ? skb_clone+0x212/0x3a0 [ 798.603382][T30127] kmem_cache_alloc_noprof+0xa1/0x600 [ 798.603405][T30127] ? skb_clone+0x212/0x3a0 [ 798.603428][T30127] skb_clone+0x212/0x3a0 [ 798.603450][T30127] __netlink_deliver_tap+0x413/0x860 [ 798.603487][T30127] ? netlink_deliver_tap+0x2e/0x1b0 [ 798.603511][T30127] netlink_deliver_tap+0x19c/0x1b0 [ 798.603544][T30127] netlink_sendskb+0x68/0x140 [ 798.603568][T30127] netlink_rcv_skb+0x2a4/0x4a0 [ 798.603591][T30127] ? __pfx_genl_rcv_msg+0x10/0x10 [ 798.603619][T30127] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 798.603656][T30127] ? down_read+0x2be/0x330 [ 798.603680][T30127] genl_rcv+0x28/0x40 [ 798.603705][T30127] netlink_unicast+0x7bd/0x940 [ 798.603735][T30127] netlink_sendmsg+0x813/0xb40 [ 798.603768][T30127] ? __pfx_netlink_sendmsg+0x10/0x10 [ 798.603798][T30127] ? apparmor_socket_sendmsg+0x98/0x360 [ 798.603828][T30127] ? __pfx_netlink_sendmsg+0x10/0x10 [ 798.603850][T30127] sock_sendmsg_nosec+0x13a/0x180 [ 798.603877][T30127] ____sys_sendmsg+0x54e/0x850 [ 798.603903][T30127] ? __pfx_____sys_sendmsg+0x10/0x10 [ 798.603932][T30127] ? import_iovec+0x73/0xa0 [ 798.603956][T30127] ___sys_sendmsg+0x2a5/0x360 [ 798.603975][T30127] ? __lock_acquire+0x6df/0x2e50 [ 798.603999][T30127] ? __pfx____sys_sendmsg+0x10/0x10 [ 798.604053][T30127] ? __fget_files+0x2a/0x420 [ 798.604076][T30127] ? __fget_files+0x3a2/0x420 [ 798.604110][T30127] __x64_sys_sendmsg+0x1b1/0x290 [ 798.604133][T30127] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 798.604179][T30127] do_syscall_64+0x166/0x520 [ 798.604208][T30127] ? trace_irq_disable+0x3b/0x140 [ 798.604225][T30127] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 798.604244][T30127] ? clear_bhb_loop+0x70/0xc0 [ 798.604266][T30127] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 798.604285][T30127] RIP: 0033:0x7efeb759e159 [ 798.604303][T30127] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 798.604319][T30127] RSP: 002b:00007efeb83dd028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 798.604339][T30127] RAX: ffffffffffffffda RBX: 00007efeb7825fa0 RCX: 00007efeb759e159 [ 798.604353][T30127] RDX: 0000000000000000 RSI: 00002000000001c0 RDI: 0000000000000003 [ 798.604365][T30127] RBP: 00007efeb83dd090 R08: 0000000000000000 R09: 0000000000000000 [ 798.604377][T30127] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 798.604388][T30127] R13: 00007efeb7826038 R14: 00007efeb7825fa0 R15: 00007ffd9a6decd8 [ 798.604420][T30127] [ 799.037190][ T6889] net_ratelimit: 145 callbacks suppressed [ 799.037265][ T6889] bond3: (slave ip6gretap0): link status up, enabling it in 0 ms [ 799.037284][ T6889] bond3: (slave ip6gretap0): failed to get link speed/duplex [ 799.124867][ T4933] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 799.134376][ T4933] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 799.141744][ T4933] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 799.146888][ T6889] bond3: (slave ip6gretap0): link status up, enabling it in 0 ms [ 799.146915][ T6889] bond3: (slave ip6gretap0): failed to get link speed/duplex [ 799.166924][ T4933] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 799.167540][ T4933] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 799.255955][T23472] bond3: (slave ip6gretap0): link status up, enabling it in 0 ms [ 799.277387][ T6887] bond3: (slave ip6gretap0): link status up, enabling it in 0 ms [ 799.298937][ T6887] bond3: (slave ip6gretap0): link status up, enabling it in 0 ms [ 799.318121][T23472] bond3: (slave ip6gretap0): link status up, enabling it in 0 ms [ 799.337042][ T6890] bond3: (slave ip6gretap0): link status up, enabling it in 0 ms [ 799.358527][ T6900] bond3: (slave ip6gretap0): link status up, enabling it in 0 ms [ 799.778858][T30171] netlink: 8 bytes leftover after parsing attributes in process `syz.4.6240'. [ 799.778917][T30171] netlink: 8 bytes leftover after parsing attributes in process `syz.4.6240'. [ 799.779632][T30171] netlink: 8 bytes leftover after parsing attributes in process `syz.4.6240'. [ 799.779658][T30171] netlink: 8 bytes leftover after parsing attributes in process `syz.4.6240'. [ 800.010847][T30184] FAULT_INJECTION: forcing a failure. [ 800.010847][T30184] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 800.010896][T30184] CPU: 0 UID: 0 PID: 30184 Comm: syz.0.6242 Not tainted syzkaller #0 PREEMPT(full) [ 800.010917][T30184] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 800.010929][T30184] Call Trace: [ 800.010936][T30184] [ 800.010945][T30184] dump_stack_lvl+0xe8/0x150 [ 800.010984][T30184] should_fail_ex+0x410/0x560 [ 800.011018][T30184] _copy_to_user+0x31/0xb0 [ 800.011039][T30184] simple_read_from_buffer+0xe1/0x170 [ 800.011068][T30184] proc_fail_nth_read+0x1bb/0x230 [ 800.011095][T30184] ? common_file_perm+0x20e/0x2b0 [ 800.011117][T30184] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 800.011147][T30184] ? rw_verify_area+0x24a/0x4c0 [ 800.011173][T30184] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 800.011202][T30184] vfs_read+0x213/0xa80 [ 800.011231][T30184] ? __pfx___mutex_lock+0x10/0x10 [ 800.011258][T30184] ? __pfx_vfs_read+0x10/0x10 [ 800.011284][T30184] ? __fget_files+0x2a/0x420 [ 800.011312][T30184] ? __fget_files+0x3a2/0x420 [ 800.011333][T30184] ? __fget_files+0x2a/0x420 [ 800.011365][T30184] ksys_read+0x150/0x270 [ 800.011392][T30184] ? __pfx_ksys_read+0x10/0x10 [ 800.011428][T30184] do_syscall_64+0x166/0x520 [ 800.011452][T30184] ? trace_irq_disable+0x3b/0x140 [ 800.011469][T30184] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 800.011487][T30184] ? clear_bhb_loop+0x70/0xc0 [ 800.011508][T30184] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 800.011521][T30184] RIP: 0033:0x7efeb755e98e [ 800.011535][T30184] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 800.011548][T30184] RSP: 002b:00007efeb83dcfe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 800.011574][T30184] RAX: ffffffffffffffda RBX: 00007efeb83dd6c0 RCX: 00007efeb755e98e [ 800.011588][T30184] RDX: 000000000000000f RSI: 00007efeb83dd0a0 RDI: 0000000000000004 [ 800.011599][T30184] RBP: 00007efeb83dd090 R08: 0000000000000000 R09: 0000000000000000 [ 800.011611][T30184] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 800.011621][T30184] R13: 00007efeb7826038 R14: 00007efeb7825fa0 R15: 00007ffd9a6decd8 [ 800.011656][T30184] [ 800.368996][T30145] lo speed is unknown, defaulting to 1000 [ 800.551919][T30201] x_tables: duplicate underflow at hook 1 [ 800.678839][T30209] validate_nla: 7 callbacks suppressed [ 800.685603][T30209] netlink: 'syz.0.6249': attribute type 39 has an invalid length. [ 800.999796][T30145] bridge0: port 1(bridge_slave_0) entered blocking state [ 801.000310][T30145] bridge0: port 1(bridge_slave_0) entered disabled state [ 801.000460][T30145] bridge_slave_0: entered allmulticast mode [ 801.002402][T30145] bridge_slave_0: entered promiscuous mode [ 801.005609][T30145] bridge0: port 2(bridge_slave_1) entered blocking state [ 801.006853][T30145] bridge0: port 2(bridge_slave_1) entered disabled state [ 801.006992][T30145] bridge_slave_1: entered allmulticast mode [ 801.008911][T30145] bridge_slave_1: entered promiscuous mode [ 801.043447][T30145] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 801.048441][T30145] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 801.125467][T30145] team0: Port device team_slave_0 added [ 801.135188][T30145] team0: Port device team_slave_1 added [ 801.222895][T30145] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 801.222931][T30145] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 801.222952][T30145] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 801.230040][T30145] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 801.230055][T30145] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 801.230077][T30145] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 801.271403][T18500] Bluetooth: hci2: command tx timeout [ 801.494477][T30145] hsr_slave_0: entered promiscuous mode [ 801.509524][T30145] hsr_slave_1: entered promiscuous mode [ 801.510267][T30145] debugfs: 'hsr0' already exists in 'hsr' [ 801.510304][T30145] Cannot create hsr debugfs directory [ 801.567581][T30240] netlink: 4 bytes leftover after parsing attributes in process `syz.3.6257'. [ 801.908930][T18500] Bluetooth: hci5: Controller not accepting commands anymore: ncmd = 0 [ 801.909017][T18500] Bluetooth: hci5: Injecting HCI hardware error event [ 801.910877][T18500] Bluetooth: hci5: hardware error 0x00 [ 802.110341][T30269] netlink: 'syz.3.6263': attribute type 39 has an invalid length. [ 802.167545][T30270] erspan0: entered promiscuous mode [ 802.379945][T30277] netlink: 24 bytes leftover after parsing attributes in process `syz.3.6266'. [ 802.507707][T30145] netdevsim netdevsim1 netdevsim3 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 802.518802][T30145] netdevsim netdevsim1 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 802.555582][T30277] netlink: 48 bytes leftover after parsing attributes in process `syz.3.6266'. [ 802.688773][T30145] netdevsim netdevsim1 netdevsim2 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 802.688824][T30145] netdevsim netdevsim1 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 802.728669][T30297] netlink: 'syz.3.6273': attribute type 4 has an invalid length. [ 802.729827][T30297] netlink: 'syz.3.6273': attribute type 7 has an invalid length. [ 802.807704][T30303] netlink: 'syz.0.6275': attribute type 39 has an invalid length. [ 802.969991][T30145] netdevsim netdevsim1 netdevsim1 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 802.980954][T30145] netdevsim netdevsim1 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 803.000770][T30307] bond0: (slave ip6gre0): Error: Device can not be enslaved while up [ 803.179621][T30145] netdevsim netdevsim1 netdevsim0 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 803.193696][T30145] netdevsim netdevsim1 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 803.347175][ T4933] Bluetooth: hci2: command tx timeout [ 803.545520][T30333] netlink: 'syz.4.6284': attribute type 7 has an invalid length. [ 803.573617][T30335] netlink: 'syz.2.6285': attribute type 39 has an invalid length. [ 803.599394][T30333] netlink: 'syz.4.6284': attribute type 7 has an invalid length. [ 803.675624][T30145] netdevsim netdevsim1 netdevsim0: renamed from eth0 [ 803.688648][T30145] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 803.696857][T30145] netdevsim netdevsim1 netdevsim1: renamed from eth1 [ 803.709900][T30145] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 803.718620][T30145] netdevsim netdevsim1 netdevsim2: renamed from eth2 [ 803.736317][T30145] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 803.744303][ T7101] netdevsim netdevsim4 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0 [ 803.744432][ T7101] netdevsim netdevsim4 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0 [ 803.744550][ T7101] netdevsim netdevsim4 netdevsim0: set [0, 0] type 1 family 0 port 8472 - 0 [ 803.775401][T30145] netdevsim netdevsim1 netdevsim3: renamed from eth3 [ 803.793186][T30145] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 803.897026][ T6887] netdevsim netdevsim4 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0 [ 803.939241][T30355] netlink: 28 bytes leftover after parsing attributes in process `syz.4.6290'. [ 803.998409][T18500] Bluetooth: hci5: Opcode 0x0c03 failed: -110 [ 804.139518][ T6890] net_ratelimit: 162 callbacks suppressed [ 804.139568][ T6890] bond3: (slave ip6gretap0): link status up, enabling it in 0 ms [ 804.149715][T30145] 8021q: adding VLAN 0 to HW filter on device bond0 [ 804.156415][T23472] bond3: (slave ip6gretap0): link status up, enabling it in 0 ms [ 804.156441][T23472] bond3: (slave ip6gretap0): failed to get link speed/duplex [ 804.185373][T30145] 8021q: adding VLAN 0 to HW filter on device team0 [ 804.202555][T23472] bridge0: port 1(bridge_slave_0) entered blocking state [ 804.202667][T23472] bridge0: port 1(bridge_slave_0) entered forwarding state [ 804.230064][ T6890] bridge0: port 2(bridge_slave_1) entered blocking state [ 804.230187][ T6890] bridge0: port 2(bridge_slave_1) entered forwarding state [ 804.268242][T23475] bond3: (slave ip6gretap0): link status up, enabling it in 0 ms [ 804.287166][ T6890] bond3: (slave ip6gretap0): link status up, enabling it in 0 ms [ 804.287235][ T6890] bond3: (slave ip6gretap0): failed to get link speed/duplex [ 804.347964][T30365] netlink: 'syz.0.6294': attribute type 30 has an invalid length. [ 804.396610][ T6890] bond3: (slave ip6gretap0): link status up, enabling it in 0 ms [ 804.403093][T30368] netlink: 'syz.3.6296': attribute type 39 has an invalid length. [ 804.415863][ T6890] bond3: (slave ip6gretap0): link status up, enabling it in 0 ms [ 804.441713][ T6890] bond3: (slave ip6gretap0): link status up, enabling it in 0 ms [ 804.441755][ T6890] bond3: (slave ip6gretap0): failed to get link speed/duplex [ 804.737275][T30390] netlink: 4 bytes leftover after parsing attributes in process `syz.0.6299'. [ 804.913741][T30398] netlink: 20 bytes leftover after parsing attributes in process `syz.2.6301'. [ 804.941056][T30401] xt_hashlimit: overflow, try lower: 3/0 [ 805.428786][T18500] Bluetooth: hci2: command tx timeout [ 805.800288][T30145] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 805.955340][T30145] veth0_vlan: entered promiscuous mode [ 805.990620][T30145] veth1_vlan: entered promiscuous mode [ 806.178416][T30145] veth0_macvtap: entered promiscuous mode [ 806.216604][T30145] veth1_macvtap: entered promiscuous mode [ 806.273811][T30459] netlink: 24 bytes leftover after parsing attributes in process `syz.2.6312'. [ 806.285133][T30459] netlink: 24 bytes leftover after parsing attributes in process `syz.2.6312'. [ 806.349648][T30145] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 806.381044][T30145] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 806.484688][ T6890] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 806.493502][ T7101] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 806.496674][ T6899] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 806.496715][ T6899] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 806.507873][T30462] netlink: 'syz.2.6313': attribute type 1 has an invalid length. [ 806.648767][T30462] bond1: entered promiscuous mode [ 806.648855][T30462] bond1: entered allmulticast mode [ 806.649378][T30462] 8021q: adding VLAN 0 to HW filter on device bond1 [ 806.696263][T30467] erspan1: entered allmulticast mode [ 806.707696][T30467] bond1: (slave erspan1): making interface the new active one [ 806.713603][T30464] netlink: 'syz.0.6314': attribute type 1 has an invalid length. [ 806.715392][T30467] erspan1: entered promiscuous mode [ 806.733897][T30467] bond1: (slave erspan1): Enslaving as an active interface with an up link [ 806.743766][T30470] syzkaller0: entered promiscuous mode [ 806.743808][T30470] syzkaller0: entered allmulticast mode [ 806.853520][T30468] erspan1: entered allmulticast mode [ 806.906843][ T6900] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 806.906887][ T6900] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 806.942480][T30464] tipc: Enabling of bearer rejected, failed to enable media [ 807.043669][T30484] x_tables: duplicate underflow at hook 1 [ 807.119655][ T6887] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 807.128258][ T6887] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 807.506707][T18500] Bluetooth: hci2: command tx timeout [ 807.615560][T30503] x_tables: duplicate underflow at hook 1 [ 807.780945][T30520] netlink: 12 bytes leftover after parsing attributes in process `syz.0.6324'. [ 807.845599][T30525] netlink: 'syz.3.6327': attribute type 15 has an invalid length. [ 807.912500][T30536] netlink: 'syz.3.6327': attribute type 15 has an invalid length. [ 808.069051][T30547] netlink: 8 bytes leftover after parsing attributes in process `syz.2.6333'. [ 808.090010][ T6890] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 808.090056][ T6890] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 808.129489][T30554] netlink: 8 bytes leftover after parsing attributes in process `syz.2.6333'. [ 808.130466][T30555] netlink: 8 bytes leftover after parsing attributes in process `syz.2.6333'. [ 808.627301][ T1313] ieee802154 phy1 wpan1: encryption failed: -22 [ 808.717691][T30592] netlink: 'syz.4.6344': attribute type 10 has an invalid length. [ 808.726726][ T6889] IPVS: starting estimator thread 0... [ 808.728016][T30587] netlink: 28 bytes leftover after parsing attributes in process `syz.0.6341'. [ 808.754255][T30592] IPVS: set_ctl: invalid protocol: 50 172.20.20.170:20003 [ 808.836468][T30594] IPVS: using max 33 ests per chain, 79200 per kthread [ 809.077338][T30608] __nla_validate_parse: 1 callbacks suppressed [ 809.077389][T30608] netlink: 12 bytes leftover after parsing attributes in process `syz.3.6350'. [ 809.248430][ T6887] net_ratelimit: 133 callbacks suppressed [ 809.248483][ T6887] bond3: (slave ip6gretap0): link status up, enabling it in 0 ms [ 809.248504][ T6887] bond3: (slave ip6gretap0): failed to get link speed/duplex [ 809.357521][ T6887] bond3: (slave ip6gretap0): link status up, enabling it in 0 ms [ 809.357572][ T6887] bond3: (slave ip6gretap0): failed to get link speed/duplex [ 809.468274][ T6887] bond3: (slave ip6gretap0): link status up, enabling it in 0 ms [ 809.468332][ T6887] bond3: (slave ip6gretap0): failed to get link speed/duplex [ 809.511807][T30629] netlink: 4 bytes leftover after parsing attributes in process `syz.2.6358'. [ 809.522363][T30629] netlink: 52 bytes leftover after parsing attributes in process `syz.2.6358'. [ 809.544156][T30629] bridge0: port 1(bridge_slave_0) entered disabled state [ 809.576724][ T6887] bond3: (slave ip6gretap0): link status up, enabling it in 0 ms [ 809.576780][ T6887] bond3: (slave ip6gretap0): failed to get link speed/duplex [ 809.654260][T30633] netlink: 8 bytes leftover after parsing attributes in process `syz.2.6361'. [ 809.687551][T23475] bond3: (slave ip6gretap0): link status up, enabling it in 0 ms [ 809.707452][ T6890] bond3: (slave ip6gretap0): link status up, enabling it in 0 ms [ 810.208971][T30663] x_tables: unsorted entry at hook 4 [ 810.209065][T30663] x_tables: unsorted entry at hook 4 [ 810.209131][T30663] x_tables: unsorted entry at hook 4 [ 810.209220][T30663] x_tables: unsorted entry at hook 4 [ 810.209285][T30663] x_tables: unsorted entry at hook 4 [ 810.209364][T30663] x_tables: unsorted entry at hook 4 [ 810.209430][T30663] x_tables: unsorted entry at hook 4 [ 810.209499][T30663] x_tables: unsorted entry at hook 4 [ 810.249310][T30666] netlink: 36 bytes leftover after parsing attributes in process `syz.0.6371'. [ 810.271022][T30649] bond1: entered allmulticast mode [ 810.275105][T30649] 8021q: adding VLAN 0 to HW filter on device bond1 [ 810.299550][T30670] IPv6: Can't replace route, no match found [ 810.306067][T30670] IPv6: Can't replace route, no match found [ 810.487170][T30678] netlink: 36 bytes leftover after parsing attributes in process `syz.2.6375'. [ 810.854728][T30707] netlink: 8 bytes leftover after parsing attributes in process `syz.2.6378'. [ 811.283947][T30720] netlink: 'syz.4.6381': attribute type 3 has an invalid length. [ 811.399041][T30730] netlink: 28 bytes leftover after parsing attributes in process `syz.2.6384'. [ 811.889136][T30756] netlink: 'syz.3.6392': attribute type 9 has an invalid length. [ 812.172711][T30772] netlink: 68 bytes leftover after parsing attributes in process `syz.3.6396'. [ 812.429553][T30787] netlink: 'syz.3.6400': attribute type 1 has an invalid length. [ 812.452921][T30787] 8021q: adding VLAN 0 to HW filter on device bond2 [ 812.507191][T30787] bond2: (slave geneve2): making interface the new active one [ 812.514886][T30787] bond2: (slave geneve2): Enslaving as an active interface with an up link [ 813.105060][T30821] netlink: 'syz.4.6407': attribute type 9 has an invalid length. [ 813.386748][ T6889] IPVS: starting estimator thread 0... [ 813.478571][T30840] IPVS: using max 35 ests per chain, 84000 per kthread [ 813.486969][T30848] xfrm0 speed is unknown, defaulting to 1000 [ 813.496603][T30848] xfrm0 speed is unknown, defaulting to 1000 [ 813.503390][T30848] xfrm0 speed is unknown, defaulting to 1000 [ 813.512244][T30848] smbdirect: ib_dev[syz1]: added: RNIC max_fast_reg_page_list_len=256 device_cap_flags=0x200000 kernel_cap_flags=0x10 page_size_cap=0x1000 [ 813.526824][T30848] smbdirect: ib_dev[syz1]: num_ports=1 max_qp_rd_atom=128 max_qp_init_rd_atom=128 max_sgl_rd=0 max_sge_rd=1 max_cqe=3276800 max_qp_wr=32768 max_send_sge=6 max_recv_sge=6 [ 813.544524][T30848] smbdirect: ib_dev[syz1]PORT[1]: iwarp=1 ib=0 roce=0 v1=0 v2=0 core_cap_flags=0x400008 [ 813.567030][T30848] infiniband syz1: RDMA CMA: cma_listen_on_dev, error -98 [ 813.601802][T30848] xfrm0 speed is unknown, defaulting to 1000 [ 813.618534][T30848] xfrm0 speed is unknown, defaulting to 1000 [ 813.631424][T30848] xfrm0 speed is unknown, defaulting to 1000 [ 813.639557][T30848] xfrm0 speed is unknown, defaulting to 1000 [ 813.649777][T30848] xfrm0 speed is unknown, defaulting to 1000 [ 813.659377][T30848] xfrm0 speed is unknown, defaulting to 1000 [ 813.671630][T30848] xfrm0 speed is unknown, defaulting to 1000 [ 813.679707][T30848] xfrm0 speed is unknown, defaulting to 1000 [ 813.691784][T30848] xfrm0 speed is unknown, defaulting to 1000 [ 813.702890][T30848] xfrm0 speed is unknown, defaulting to 1000 [ 813.714212][T30848] xfrm0 speed is unknown, defaulting to 1000 [ 813.726403][T30848] xfrm0 speed is unknown, defaulting to 1000 [ 813.734389][T30848] xfrm0 speed is unknown, defaulting to 1000 [ 814.122907][T30873] netlink: 8 bytes leftover after parsing attributes in process `syz.0.6418'. [ 814.146342][T30874] sctp: [Deprecated]: syz.4.6419 (pid 30874) Use of struct sctp_assoc_value in delayed_ack socket option. [ 814.146342][T30874] Use struct sctp_sack_info instead [ 814.172424][T30873] vlan2: entered promiscuous mode [ 814.172470][T30873] bond0: entered promiscuous mode [ 814.174601][T30873] bond_slave_0: entered promiscuous mode [ 814.174811][T30873] bond_slave_1: entered promiscuous mode [ 814.317063][ T6900] net_ratelimit: 165 callbacks suppressed [ 814.317107][ T6900] bond3: (slave ip6gretap0): link status up, enabling it in 0 ms [ 814.317133][ T6900] bond3: (slave ip6gretap0): failed to get link speed/duplex [ 814.379242][T30883] vcan0: tx address claim with broadcast sa [ 814.394774][T30883] netlink: 'syz.0.6422': attribute type 1 has an invalid length. [ 814.404125][T30883] netlink: 7 bytes leftover after parsing attributes in process `syz.0.6422'. [ 814.428145][ T6872] bond3: (slave ip6gretap0): link status up, enabling it in 0 ms [ 814.456400][ T6900] bond3: (slave ip6gretap0): link status up, enabling it in 0 ms [ 814.456447][ T6900] bond3: (slave ip6gretap0): failed to get link speed/duplex [ 814.566698][ T6900] bond3: (slave ip6gretap0): link status up, enabling it in 0 ms [ 814.566740][ T6900] bond3: (slave ip6gretap0): failed to get link speed/duplex [ 814.678586][ T6872] bond3: (slave ip6gretap0): link status up, enabling it in 0 ms [ 814.678637][ T6872] bond3: (slave ip6gretap0): failed to get link speed/duplex [ 814.724854][T30895] netlink: 768 bytes leftover after parsing attributes in process `syz.0.6427'. [ 814.734690][T30895] netlink: 'syz.0.6427': attribute type 4 has an invalid length. [ 814.794895][ T6889] bond3: (slave ip6gretap0): link status up, enabling it in 0 ms [ 815.127485][T30929] netlink: 20 bytes leftover after parsing attributes in process `syz.0.6435'. [ 815.249795][T30938] netlink: 24 bytes leftover after parsing attributes in process `syz.0.6435'. [ 815.360872][T30946] netlink: 16 bytes leftover after parsing attributes in process `syz.1.6437'. [ 815.365369][T30950] netlink: 20 bytes leftover after parsing attributes in process `syz.4.6439'. [ 815.820951][T30974] netlink: 40 bytes leftover after parsing attributes in process `syz.4.6447'. [ 815.822919][T30973] netlink: 232 bytes leftover after parsing attributes in process `syz.0.6446'. [ 816.401988][T31009] netlink: 'syz.0.6456': attribute type 2 has an invalid length. [ 816.589048][T31020] netlink: 'syz.2.6458': attribute type 8 has an invalid length. [ 816.783122][T31006] bridge0: port 2(bridge_slave_1) entered disabled state [ 816.783552][T31006] bridge0: port 1(bridge_slave_0) entered disabled state [ 818.955092][T30978] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 819.114594][T31050] netlink: 12 bytes leftover after parsing attributes in process `syz.3.6463'. [ 819.181164][T31054] netlink: 12 bytes leftover after parsing attributes in process `syz.3.6463'. [ 819.397814][ T6887] net_ratelimit: 84 callbacks suppressed [ 819.397861][ T6887] bond3: (slave ip6gretap0): link status up, enabling it in 0 ms [ 819.397885][ T6887] bond3: (slave ip6gretap0): failed to get link speed/duplex [ 819.465067][T31068] nbd4: detected capacity change from 0 to 63 [ 819.480376][T18500] block nbd4: Receive control failed (result -32) [ 819.510645][ T6887] bond3: (slave ip6gretap0): link status up, enabling it in 0 ms [ 819.510690][ T6887] bond3: (slave ip6gretap0): failed to get link speed/duplex [ 819.529469][ T1984] block nbd4: Dead connection, failed to find a fallback [ 819.532376][ T1984] block nbd4: shutting down sockets [ 819.532529][ T1984] I/O error, dev nbd4, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 819.532655][ T1984] Buffer I/O error on dev nbd4, logical block 0, async page read [ 819.541731][ T1984] I/O error, dev nbd4, sector 2 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 819.541761][ T1984] Buffer I/O error on dev nbd4, logical block 1, async page read [ 819.542493][ T1984] I/O error, dev nbd4, sector 4 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 819.542518][ T1984] Buffer I/O error on dev nbd4, logical block 2, async page read [ 819.542631][ T1984] I/O error, dev nbd4, sector 6 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 819.542654][ T1984] Buffer I/O error on dev nbd4, logical block 3, async page read [ 819.544373][ T1984] I/O error, dev nbd4, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 819.544399][ T1984] Buffer I/O error on dev nbd4, logical block 0, async page read [ 819.547483][ T1984] I/O error, dev nbd4, sector 2 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 819.547511][ T1984] Buffer I/O error on dev nbd4, logical block 1, async page read [ 819.559319][ T1984] I/O error, dev nbd4, sector 4 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 819.559349][ T1984] Buffer I/O error on dev nbd4, logical block 2, async page read [ 819.559458][ T1984] I/O error, dev nbd4, sector 6 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 819.559481][ T1984] Buffer I/O error on dev nbd4, logical block 3, async page read [ 819.559585][ T1984] I/O error, dev nbd4, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 819.559607][ T1984] Buffer I/O error on dev nbd4, logical block 0, async page read [ 819.559689][ T1984] I/O error, dev nbd4, sector 2 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 819.559710][ T1984] Buffer I/O error on dev nbd4, logical block 1, async page read [ 819.604828][T28553] ldm_validate_partition_table(): Disk read failed. [ 819.612930][T28553] Dev nbd4: unable to read RDB block 0 [ 819.626377][ T6900] bond3: (slave ip6gretap0): link status up, enabling it in 0 ms [ 819.626414][ T6900] bond3: (slave ip6gretap0): failed to get link speed/duplex [ 819.630417][T28553] nbd4: unable to read partition table [ 819.739336][T28553] ldm_validate_partition_table(): Disk read failed. [ 819.740205][T28553] Dev nbd4: unable to read RDB block 0 [ 819.750152][T23475] bond3: (slave ip6gretap0): link status up, enabling it in 0 ms [ 819.750178][T23475] bond3: (slave ip6gretap0): failed to get link speed/duplex [ 819.751410][T28553] nbd4: unable to read partition table [ 819.849234][ T6900] bond3: (slave ip6gretap0): link status up, enabling it in 0 ms [ 819.849287][ T6900] bond3: (slave ip6gretap0): failed to get link speed/duplex [ 819.863120][T31080] sctp: [Deprecated]: syz.1.6472 (pid 31080) Use of struct sctp_assoc_value in delayed_ack socket option. [ 819.863120][T31080] Use struct sctp_sack_info instead [ 820.104177][T31096] netlink: 4 bytes leftover after parsing attributes in process `syz.4.6477'. [ 820.140702][T31098] netlink: 12 bytes leftover after parsing attributes in process `syz.2.6479'. [ 820.168645][T31095] netlink: 24 bytes leftover after parsing attributes in process `syz.1.6478'. [ 820.346702][T31106] gre1: entered promiscuous mode [ 820.361188][T31112] netlink: 8 bytes leftover after parsing attributes in process `syz.2.6481'. [ 820.361240][T31112] netlink: 16 bytes leftover after parsing attributes in process `syz.2.6481'. [ 820.423456][T18500] Bluetooth: hci2: Malformed HCI Event [ 820.724910][T31137] netlink: 4 bytes leftover after parsing attributes in process `syz.1.6490'. [ 820.918069][T31154] netlink: 24 bytes leftover after parsing attributes in process `syz.3.6494'. [ 820.957790][T31145] bridge0: port 1(bridge_slave_0) entered forwarding state [ 821.058625][T31158] netlink: 12 bytes leftover after parsing attributes in process `syz.3.6495'. [ 821.250338][T31167] netlink: 9 bytes leftover after parsing attributes in process `syz.3.6497'. [ 821.309975][T31167] netlink: 'syz.3.6497': attribute type 5 has an invalid length. [ 821.310015][T31167] netlink: 'syz.3.6497': attribute type 6 has an invalid length. [ 821.392258][T31172] PF_CAN: dropped non conform CAN XL skbuff: dev type 65534, len 40 [ 821.551854][T31189] netlink: 'syz.0.6502': attribute type 2 has an invalid length. [ 821.551898][T31189] netlink: 'syz.0.6502': attribute type 2 has an invalid length. [ 821.955387][T31207] netlink: 'syz.3.6509': attribute type 2 has an invalid length. [ 822.174997][T31218] xt_IDLETIMER: label is empty or not nul-terminated [ 822.289425][T31229] xt_check_table_hooks: 57 callbacks suppressed [ 822.289479][T31229] x_tables: duplicate underflow at hook 1 [ 822.714997][T31238] bond2: option mode: invalid value (70) [ 822.727996][T31238] bond2 (unregistering): Released all slaves [ 823.278178][T31279] netlink: 'syz.4.6529': attribute type 1 has an invalid length. [ 823.321243][T31276] tc_dump_action: action bad kind [ 823.860607][T31305] netlink: 'syz.0.6537': attribute type 25 has an invalid length. [ 824.192402][T31309] __nla_validate_parse: 14 callbacks suppressed [ 824.201889][T31309] netlink: 20 bytes leftover after parsing attributes in process `syz.2.6539'. [ 824.201934][T31309] nbd: device at index 64 is going down [ 824.216029][T31329] netlink: 20 bytes leftover after parsing attributes in process `syz.1.6543'. [ 824.216054][T31329] netlink: 20 bytes leftover after parsing attributes in process `syz.1.6543'. [ 824.473112][T28553] udevd[28553]: inotify_add_watch(7, /dev/nbd64, 10) failed: No such file or directory [ 824.500551][T28553] udevd[28553]: inotify_add_watch(7, /dev/nbd64, 10) failed: No such file or directory [ 824.511478][ T12] net_ratelimit: 92 callbacks suppressed [ 824.511498][ T12] bond3: (slave ip6gretap0): link status up, enabling it in 0 ms [ 824.511520][ T12] bond3: (slave ip6gretap0): failed to get link speed/duplex [ 824.520600][T31342] netlink: 4 bytes leftover after parsing attributes in process `syz.3.6545'. [ 824.600846][T31345] netlink: 12 bytes leftover after parsing attributes in process `syz.2.6546'. [ 824.610261][T31345] openvswitch: netlink: Missing key (keys=40, expected=200000) [ 824.619030][T23472] bond3: (slave ip6gretap0): link status up, enabling it in 0 ms [ 824.619081][T23472] bond3: (slave ip6gretap0): failed to get link speed/duplex [ 824.725969][ T6872] bond3: (slave ip6gretap0): link status up, enabling it in 0 ms [ 824.726017][ T6872] bond3: (slave ip6gretap0): failed to get link speed/duplex [ 824.756064][T31351] netlink: 44 bytes leftover after parsing attributes in process `syz.2.6548'. [ 824.835929][ T6872] bond3: (slave ip6gretap0): link status up, enabling it in 0 ms [ 824.835984][ T6872] bond3: (slave ip6gretap0): failed to get link speed/duplex [ 824.973489][T23472] bond3: (slave ip6gretap0): link status up, enabling it in 0 ms [ 825.151532][T31353] netlink: 28 bytes leftover after parsing attributes in process `syz.0.6549'. [ 825.389727][T31362] xt_nfacct: accounting object `syz0' does not exist [ 825.742847][T31397] bond0: entered promiscuous mode [ 825.748733][T31397] bond_slave_0: entered promiscuous mode [ 825.754937][T31397] bond_slave_1: entered promiscuous mode [ 825.770557][T31397] batadv0: entered promiscuous mode [ 825.777989][T31397] debugfs: 'hsr1' already exists in 'hsr' [ 825.787096][T31397] Cannot create hsr debugfs directory [ 825.795239][T31397] 8021q: adding VLAN 0 to HW filter on device hsr1 [ 825.860807][T31397] bond0: left promiscuous mode [ 825.866080][T31397] bond_slave_0: left promiscuous mode [ 825.866410][T31397] bond_slave_1: left promiscuous mode [ 825.880031][T31397] batadv0: left promiscuous mode [ 826.365621][T31412] Oops: general protection fault, probably for non-canonical address 0xdffffc000000000b: 0000 [#1] SMP KASAN PTI [ 826.377552][T31412] KASAN: null-ptr-deref in range [0x0000000000000058-0x000000000000005f] [ 826.385979][T31412] CPU: 1 UID: 0 PID: 31412 Comm: syz.0.6561 Not tainted syzkaller #0 PREEMPT(full) [ 826.395361][T31412] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 826.405427][T31412] RIP: 0010:klist_remove+0x156/0x340 [ 826.410731][T31412] Code: 4d 89 f5 49 c1 ed 03 43 80 7c 3d 00 00 74 08 4c 89 f7 e8 dd db 5c f6 4d 8b 26 49 83 e4 fe 49 8d 7c 24 58 48 89 f8 48 c1 e8 03 <42> 80 3c 38 00 74 05 e8 be db 5c f6 49 8b 44 24 58 48 89 44 24 08 [ 826.430346][T31412] RSP: 0018:ffffc9000fe87960 EFLAGS: 00010202 [ 826.436416][T31412] RAX: 000000000000000b RBX: ffff888020bb0000 RCX: ffffffff9a9db501 [ 826.444376][T31412] RDX: 0000000000000001 RSI: 0000000000000004 RDI: 0000000000000058 [ 826.452425][T31412] RBP: ffffc9000fe87a60 R08: ffffffff905f94e3 R09: 1ffffffff20bf29c [ 826.460390][T31412] R10: dffffc0000000000 R11: fffffbfff20bf29d R12: 0000000000000000 [ 826.468357][T31412] R13: 1ffff1100ef4a60c R14: ffff888077a53060 R15: dffffc0000000000 [ 826.476323][T31412] FS: 00007efeb83dd6c0(0000) GS:ffff888124dd9000(0000) knlGS:0000000000000000 [ 826.485240][T31412] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 826.491821][T31412] CR2: 00007fb43e59ae9c CR3: 0000000061440000 CR4: 00000000003526f0 [ 826.499807][T31412] Call Trace: [ 826.503083][T31412] [ 826.506006][T31412] ? __pfx_klist_remove+0x10/0x10 [ 826.511025][T31412] ? kobject_move+0x5e2/0x720 [ 826.515700][T31412] ? __pfx_kobject_move+0x10/0x10 [ 826.520729][T31412] ? do_raw_spin_unlock+0xf5/0x200 [ 826.525849][T31412] ? get_device_parent+0x366/0x3a0 [ 826.530958][T31412] device_move+0x18e/0x720 [ 826.535363][T31412] hci_conn_del_sysfs+0xb8/0x1a0 [ 826.540293][T31412] hci_conn_del+0xc3d/0x1200 [ 826.544874][T31412] hci_conn_hash_flush+0x189/0x260 [ 826.549982][T31412] hci_dev_close_sync+0x7fc/0x10c0 [ 826.555094][T31412] ? __pfx___mutex_lock+0x10/0x10 [ 826.560120][T31412] ? __pfx_hci_dev_close_sync+0x10/0x10 [ 826.565655][T31412] ? lockdep_hardirqs_on+0x7b/0x110 [ 826.570861][T31412] ? enable_work+0x1fd/0x230 [ 826.575451][T31412] hci_dev_close+0x108/0x260 [ 826.580033][T31412] sock_do_ioctl+0x101/0x320 [ 826.584621][T31412] ? __pfx_sock_do_ioctl+0x10/0x10 [ 826.589720][T31412] ? hook_file_ioctl+0x1f2/0x600 [ 826.594651][T31412] sock_ioctl+0x57a/0x7e0 [ 826.598976][T31412] ? __pfx_sock_ioctl+0x10/0x10 [ 826.603820][T31412] ? __fget_files+0x2a/0x420 [ 826.608413][T31412] ? __fget_files+0x3a2/0x420 [ 826.613083][T31412] ? __fget_files+0x2a/0x420 [ 826.617671][T31412] ? bpf_lsm_file_ioctl+0x9/0x20 [ 826.622601][T31412] ? __pfx_sock_ioctl+0x10/0x10 [ 826.627455][T31412] __se_sys_ioctl+0xfc/0x170 [ 826.632052][T31412] do_syscall_64+0x166/0x520 [ 826.636652][T31412] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 826.642715][T31412] ? clear_bhb_loop+0x70/0xc0 [ 826.647390][T31412] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 826.653274][T31412] RIP: 0033:0x7efeb759e159 [ 826.657682][T31412] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 826.678426][T31412] RSP: 002b:00007efeb83dd028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 826.686850][T31412] RAX: ffffffffffffffda RBX: 00007efeb7825fa0 RCX: 00007efeb759e159 [ 826.694819][T31412] RDX: 0000000000000000 RSI: 00000000400448ca RDI: 0000000000000007 [ 826.702782][T31412] RBP: 00007efeb7635024 R08: 0000000000000000 R09: 0000000000000000 [ 826.710757][T31412] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 826.718723][T31412] R13: 00007efeb7826038 R14: 00007efeb7825fa0 R15: 00007ffd9a6decd8 [ 826.726696][T31412] [ 826.729715][T31412] Modules linked in: [ 826.737062][T31412] ---[ end trace 0000000000000000 ]--- [ 826.779841][T31412] RIP: 0010:klist_remove+0x156/0x340 [ 826.785368][T31412] Code: 4d 89 f5 49 c1 ed 03 43 80 7c 3d 00 00 74 08 4c 89 f7 e8 dd db 5c f6 4d 8b 26 49 83 e4 fe 49 8d 7c 24 58 48 89 f8 48 c1 e8 03 <42> 80 3c 38 00 74 05 e8 be db 5c f6 49 8b 44 24 58 48 89 44 24 08 [ 826.806786][T31412] RSP: 0018:ffffc9000fe87960 EFLAGS: 00010202 [ 826.806809][T31412] RAX: 000000000000000b RBX: ffff888020bb0000 RCX: ffffffff9a9db501 [ 826.806824][T31412] RDX: 0000000000000001 RSI: 0000000000000004 RDI: 0000000000000058 [ 826.806835][T31412] RBP: ffffc9000fe87a60 R08: ffffffff905f94e3 R09: 1ffffffff20bf29c [ 826.806850][T31412] R10: dffffc0000000000 R11: fffffbfff20bf29d R12: 0000000000000000 [ 826.806863][T31412] R13: 1ffff1100ef4a60c R14: ffff888077a53060 R15: dffffc0000000000 [ 826.806877][T31412] FS: 00007efeb83dd6c0(0000) GS:ffff888124cd9000(0000) knlGS:0000000000000000 [ 826.806893][T31412] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 826.806907][T31412] CR2: 00007fe4889ed158 CR3: 0000000061440000 CR4: 00000000003526f0 [ 826.806944][T31412] Kernel panic - not syncing: Fatal exception [ 826.882583][T31412] Kernel Offset: disabled [ 826.886906][T31412] Rebooting in 86400 seconds..