last executing test programs: 3.703522554s ago: executing program 2 (id=6593): socket(0x10, 0x3, 0x0) socket$kcm(0x11, 0x3, 0x0) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r1, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000680)=@newlink={0x44, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x25000}, [@IFLA_AF_SPEC={0x10, 0x1a, 0x0, 0x1, [@AF_INET6={0xc, 0xa, 0x0, 0x1, [@IFLA_INET6_ADDR_GEN_MODE={0x5, 0x8, 0x2}]}]}, @IFLA_IFNAME={0x14, 0x3, 'sit0\x00'}]}, 0x44}}, 0x0) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000500)={&(0x7f0000000200)=@newlink={0x44, 0x10, 0x439, 0x70bd2a, 0xffffffea, {0x0, 0x0, 0xe403, 0x0, 0x3, 0x610c3}, [@IFLA_LINKINFO={0x24, 0x12, 0x0, 0x1, @bond={{0x9}, {0x14, 0x2, 0x0, 0x1, [@IFLA_BOND_AD_ACTOR_SYS_PRIO={0x6, 0x18, 0x4}, @IFLA_BOND_MODE={0x5, 0x1, 0x2}]}}}]}, 0x44}, 0x1, 0x0, 0x0, 0x8000}, 0x4008040) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r3 = socket(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000000)={'lo\x00', 0x0}) sendmsg$nl_route_sched(r3, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000780)={&(0x7f00000000c0)=@newqdisc={0x48, 0x24, 0xd0f, 0x0, 0x0, {0x60, 0x0, 0x0, r5, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_prio={{0x9}, {0x18, 0x2, {0x2, "000000000000000000000500"}}}]}, 0x48}}, 0x0) r6 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) close(r6) r7 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r7, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r7, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000440)=@newqdisc={0x4c, 0x24, 0x4ee4e6a52ff56541, 0x1, 0x25dfdbfd, {0x0, 0x0, 0x0, r8, {0x0, 0xb}, {0xffff, 0xffff}, {0xfff2}}, [@qdisc_kind_options=@q_netem={{0xa}, {0x1c, 0x2, {{0x3, 0x3, 0x6361, 0x5, 0xffffffff, 0x3}}}}]}, 0x4c}, 0x1, 0x0, 0x0, 0x40088c1}, 0x0) sendmsg$nl_route_sched(r7, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000600)=@newqdisc={0x58, 0x24, 0x4ee4e6a52ff56541, 0x70b925, 0x25dfdc04, {0x0, 0x0, 0x0, r8, {0x0, 0xd}, {0xffff, 0xb}, {0xffff, 0xffe0}}, [@qdisc_kind_options=@q_sfb={{0x8}, {0x2c, 0x2, @TCA_SFB_PARMS={0x28, 0x1, {0xfffffffd, 0x7, 0x1000, 0x0, 0x40001c2b, 0x8000, 0x7ff, 0x0, 0x2000000}}}}]}, 0x58}, 0x1, 0x0, 0x0, 0x4040010}, 0x4890) ioctl$SIOCSIFHWADDR(r6, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) r9 = socket$unix(0x1, 0x5, 0x0) ioctl$sock_SIOCGIFINDEX(r9, 0x8933, &(0x7f00000001c0)={'syzkaller0\x00'}) socketpair$unix(0x1, 0x1, 0x0, 0x0) recvmsg$unix(0xffffffffffffffff, 0x0, 0x40000100) recvmsg$unix(0xffffffffffffffff, &(0x7f0000000c40)={0x0, 0x0, 0x0}, 0x10003) close(0xffffffffffffffff) connect$inet6(0xffffffffffffffff, &(0x7f0000000100)={0xa, 0x0, 0x7, @ipv4={'\x00', '\xff\xff', @local}, 0x1}, 0x1c) syz_genetlink_get_family_id$ethtool(&(0x7f0000000200), r3) recvmmsg(0xffffffffffffffff, 0x0, 0x0, 0x10100, 0x0) ioctl$BTRFS_IOC_SUBVOL_GETFLAGS(0xffffffffffffffff, 0x80089419, &(0x7f00000001c0)) socket$inet_icmp_raw(0x2, 0x3, 0x1) 3.178139968s ago: executing program 3 (id=6603): r0 = socket$inet_smc(0x2b, 0x1, 0x0) r1 = epoll_create1(0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r3, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r4 = epoll_create1(0x0) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r3, &(0x7f0000000100)={0x20000014}) epoll_ctl$EPOLL_CTL_ADD(r4, 0x1, r1, &(0x7f0000000380)={0xa0000001}) ppoll(&(0x7f0000000200)=[{r4, 0x1}], 0x1, 0x0, 0x0, 0x3) epoll_pwait(r1, &(0x7f0000000040)=[{}], 0x1, 0xfffffffe, 0x0, 0x0) accept4$inet(r0, &(0x7f00000000c0)={0x2, 0x0, @multicast2}, &(0x7f0000000100)=0x10, 0x80000) r5 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)=@base={0x16, 0x0, 0x4, 0xffff, 0x800, 0x1, 0x0, '\x00', 0x0, 0xffffffffffffffff, 0x5}, 0x96) r6 = bpf$MAP_CREATE(0x0, &(0x7f0000000040)=@base={0xd, 0x4, 0x4, 0x9, 0x0, r5}, 0x48) bpf$MAP_UPDATE_BATCH(0x1b, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x0, r6}, 0x38) 3.02721607s ago: executing program 2 (id=6605): r0 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000000)={'veth1_macvtap\x00'}) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040), 0x1c1341, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f00000000c0)={'syzkaller0\x00', 0x84aebfbd6349b7f2}) r3 = socket(0x10, 0x803, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000100)={'syzkaller0\x00'}) (async) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r3, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000a40)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70bd2d, 0x25dfdbfc, {0x0, 0x0, 0x0, r4, {0x0, 0x6}, {0xffff, 0xffff}, {0x6, 0xb}}, [@qdisc_kind_options=@q_fq_codel={{0xd}, {0x4}}]}, 0x38}}, 0x0) sendmsg$nl_route_sched(r3, &(0x7f00000006c0)={0x0, 0x0, &(0x7f0000000700)={&(0x7f0000000740)=@deltfilter={0x24, 0x2d, 0x1, 0x70bd2a, 0x25dfdbfd, {0x0, 0x0, 0x0, r4, {0x2, 0x5}, {0xf, 0x6}, {0xc, 0x5}}}, 0x24}, 0x1, 0x0, 0x0, 0x4000000}, 0x20048054) (async) sendmsg$nl_route_sched(r3, &(0x7f00000006c0)={0x0, 0x0, &(0x7f0000000700)={&(0x7f0000000740)=@deltfilter={0x24, 0x2d, 0x1, 0x70bd2a, 0x25dfdbfd, {0x0, 0x0, 0x0, r4, {0x2, 0x5}, {0xf, 0x6}, {0xc, 0x5}}}, 0x24}, 0x1, 0x0, 0x0, 0x4000000}, 0x20048054) socket$inet6(0xa, 0x5, 0x7) (async) socket$inet6(0xa, 0x5, 0x7) sendmsg$nl_route(r1, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000300)=@ipv4_delroute={0x24, 0x19, 0x100, 0x70bd2a, 0x25dfdbfb, {0x2, 0x0, 0x20, 0x1, 0xfc, 0x2, 0xc8, 0xa, 0x100}, [@RTA_NH_ID={0x8, 0x1e, 0x6}]}, 0x24}}, 0x800) 2.306138904s ago: executing program 2 (id=6610): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = socket$inet6(0xa, 0x80002, 0x0) setsockopt$inet6_int(r1, 0x29, 0x19, &(0x7f0000000000)=0x84, 0xfde1) sendto$inet6(r1, 0x0, 0x0, 0x200dc009, &(0x7f0000000080)={0xa, 0x4e1f, 0x0, @mcast2}, 0x1c) sendto$inet6(r1, &(0x7f0000001cc0)="2501d77b330b7e73d6b1d1b8a473ff7420b4b43ce0861f000000714fa228ee1f5b48", 0xfffffffffffffe57, 0x8000, 0x0, 0x0) recvmmsg(r1, &(0x7f0000002480)=[{{0x0, 0x0, 0x0}}], 0x1, 0x40002003, 0x0) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x5) close(0x4) syz_open_procfs$namespace(0x0, &(0x7f0000000040)='ns/cgroup\x00') mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f07ebbeef, 0x8031, 0xffffffffffffffff, 0x215eb000) r2 = socket$inet_icmp_raw(0x2, 0x3, 0x1) setsockopt$inet_int(r2, 0x0, 0x14, &(0x7f0000000000)=0x1, 0x4) sendto$inet(r2, &(0x7f0000000100)="1ce0", 0xffeb, 0x0, &(0x7f0000001100)={0x2, 0x0, @private}, 0x10) recvfrom$inet(r2, 0x0, 0x0, 0x0, 0x0, 0x0) setsockopt$IP6T_SO_SET_ADD_COUNTERS(0xffffffffffffffff, 0x29, 0x41, &(0x7f00000000c0)={'raw\x00', 0x3, [{}, {}, {}]}, 0x58) socket$pppl2tp(0x18, 0x1, 0x1) r3 = socket$nl_route(0x10, 0x3, 0x0) ioctl$TUNSETCARRIER(0xffffffffffffffff, 0x400454e2, 0x0) sendmsg$nl_route(r3, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=@newlink={0x30, 0x10, 0x801, 0x0, 0x0, {}, [@IFLA_MTU={0x8, 0x4, 0x500}, @IFLA_GROUP={0x8}]}, 0x30}}, 0x0) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r4, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x0) sendmsg$NFT_BATCH(r4, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f0000002100)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a5c000000090a010400000000000000000a0000040900010073797a310000000008000540000000040900020073797a310000000008000a40fffffffc200011800e000100636f6e6e6c696d69740000000c00028008000140fffff27414000000110001"], 0x84}, 0x1, 0x0, 0x0, 0x4000850}, 0x40) r5 = socket$nl_generic(0x10, 0x3, 0x10) r6 = syz_genetlink_get_family_id$tipc(&(0x7f00000003c0), 0xffffffffffffffff) sendmsg$TIPC_CMD_SHOW_NAME_TABLE(r5, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000280)={0x30, r6, 0x1, 0x0, 0x100000, {{}, {}, {0x14, 0x19, {0x2, 0x1, 0x0, 0x2000000}}}}, 0x30}, 0x1, 0x0, 0x0, 0x4000000}, 0x1004) sendmsg$TIPC_CMD_RESET_LINK_STATS(r0, &(0x7f00000002c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x10000000}, 0xc, &(0x7f0000000200)={&(0x7f00000001c0)={0x28, r6, 0x200, 0x70bd26, 0x25dfdbfb, {{}, {}, {0xc, 0x14, 'syz0\x00'}}, ["", ""]}, 0x28}, 0x1, 0x0, 0x0, 0x8000}, 0x40040) sendmsg$NFT_MSG_GETSETELEM(r4, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000009b80)=ANY=[@ANYBLOB="3c0000000d0a010800000000000000000a0000010900020073797a31000000000900010073797a3100000000100003"], 0x3c}, 0x1, 0x0, 0x0, 0x24000801}, 0x8000) 2.234176311s ago: executing program 0 (id=6613): bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000180)=@bpf_lsm={0xd, 0x5, &(0x7f0000000040)=@framed={{0x76, 0xa, 0x0, 0x0, 0x0, 0x61, 0x11, 0x50}, [@initr0]}, &(0x7f0000000080)='syzkaller\x00', 0x0, 0xffe4}, 0x90) 2.00575276s ago: executing program 0 (id=6614): r0 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_int(r0, 0x107, 0xa, &(0x7f0000000080)=0x1, 0x4) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$netlbl_cipso(&(0x7f0000000200), r1) sendmsg$NLBL_CIPSOV4_C_ADD(r1, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000280)={0x48, r2, 0x1, 0x0, 0x0, {}, [@NLBL_CIPSOV4_A_MLSCATLST={0x1c, 0xc, 0x0, 0x1, [{0x14, 0xb, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSCATLOC={0x8}, @NLBL_CIPSOV4_A_MLSCATREM={0x8, 0xa, 0x424b}]}, {0x4}]}, @NLBL_CIPSOV4_A_MTYPE={0x8, 0x2, 0x1}, @NLBL_CIPSOV4_A_TAGLST={0x4}, @NLBL_CIPSOV4_A_DOI={0x8}, @NLBL_CIPSOV4_A_MLSLVLLST={0x4}]}, 0x48}}, 0x0) setsockopt$packet_rx_ring(r0, 0x107, 0x5, &(0x7f0000000040)=@req3={0x1000, 0x3a, 0x1000, 0x3a, 0x2}, 0x1c) syz_genetlink_get_family_id$mptcp(&(0x7f0000000040), 0xffffffffffffffff) (async) r3 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000240), r1) (async) ioctl$sock_SIOCGIFINDEX_802154(r1, 0x8933, &(0x7f00000004c0)={'wpan4\x00', 0x0}) sendmsg$NL802154_CMD_SET_CCA_MODE(r1, &(0x7f0000001340)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x40000000}, 0xc, &(0x7f0000001300)={&(0x7f0000001280)={0x4c, r3, 0x20, 0x70bd27, 0x25dfdbfe, {}, [@NL802154_ATTR_CCA_MODE={0x8, 0xc, 0x5}, @NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x200000002}, @NL802154_ATTR_IFINDEX={0x8, 0x3, r4}, @NL802154_ATTR_CCA_OPT={0x8}, @NL802154_ATTR_WPAN_PHY={0x8, 0x1, 0x3}, @NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x2}]}, 0x4c}, 0x1, 0x0, 0x0, 0x40004}, 0x4040) (async, rerun: 64) bpf$PROG_LOAD(0x5, &(0x7f00000054c0)={0x3, 0x16, &(0x7f0000000500)=ANY=[@ANYBLOB="61154c000000000061138c0000000000bfa00000000000001503000008004e003d3501000000000095004100000000006916000000000000bf67000000000000350605000fff07206706000005000000160302000ee60060bf590000000000000f650000000000006507f9ff0100000007070000cddfffff1e75000000000000bf54000000000000070400000400f9ff3d4301000000000095000000000000001500000000000000950000000000000032ed3c12dc8c27df8ecf664e0f84f9f17d3c30e32f1754558f2278af6d71d79a5e12814cb1d8a5d4601d295c45a6a0b9bdb7dd3997f9c9c4f6f3be4b369289aa6812b8e007e733a9a4f1b0af3dda82ee45a010fb94fe9de57b9d8a814261bdb94a05000000c6c60bf70d742a81762bab8395fa64810b5b40d893ea8fe01c5473d51b546cad3f1d5ab2af27546e7c955ccefa1f6ab689b555202da2e0ec2871b4a7e65836429a527dc47ebe84a423b6c8d345dc8da3085b0ab71ca1b901627b562ed04ae76002d4519af619e3cca4d69e88158f0200000000c8fb730a5c1bf2b2bb845129361997a75fd552bdc2300000008ac86d8a297dff0445a15f21dce4de9f29eff65aadc841848c9b562a31e56723888fb126a163f16f920ae2fb494059bba8e3b680324a188076ebae3f55c4e9b2ad9bc1172ba7cbebe174aba210d739a018f9bbec63222d20cecac4d03723f1c932c9a6aa57f1ad2e99e0e67ab93716d20000009fbb0f53acbb40b4f8e2739670b31562ed834f2af97787f696649a462e7ee4bcf8b07a10d6735154beb4000000000000000000000000004000bc00f679629709e7e78f4ddc211bc3ebe6bd9d42ca0140a7afaab43176e65ec1118d50d1e827f3472f4445d253880800000000000000690884f800031e03a651bb96589a7e2e509bcc1d161347623cb5e7ac4629c8ab04871bc401000000cc43010000207b40407d000000210000000000000000005f37d83f84e98a523d80bd970d703f37ca364a601ae899a56715a0a62a34c6c94cce6994521629ab028acfc1d926a0f6a5489af8dc2f17923f3c40dfd1970a55c22fe3a5ac000000f4000000000000000000000000c1eb2d91fb79ea00000000000000bb0d00000000000000000000e4007be511fe32fbc90e2364a55e9bb66ac64423d2d00fea2594e190deae46e26c596f84eba9000000000000003cc3aa39ee4b1386ba3b543ccb5f0d7b63924f17c67b13631d22a11dc3c6939628950000000000000001c7205a6b068fff496d2da7d632bd1f61b007e1ff5f1be19637302f3b41eae50509fd05d12f6186f117b062df67d3a63f3265dd1410eea68208a3f26b2989b832d8b34a34a4f08b34b30410856e858d27adee7daf32903d3fc78700d429a2d4c8b6d803eb83eecfe4c7ff9e6ab5a52e83d089dad7a8710e0254f1b11cced7bc3c8da0c44d2ebf9f6f3ff3be4d1458077c2253b0c7c7a0a9fdd63bf910dc20e5cb2a88e59febc47f1212a21f631dbaa74f22bad050e9856b48ae3a03a497c37758537650fe6db88aa3c41fdc3d78e046f6160e1741299e8dc29906870e6431ed1eab5d067a183f064b060a8ec12725d42e3a74863d66bee966b1574f8e01b3f34a267ff0afa1e1c758a0079b747067312e9815a21cb3f1f8150d999d788535a4d3114dbc7e2bf2402a75fd7a55733360040855ed5d1c0d634fb9fb38f84d9d87b27f8a5d91217b728f13e3ee20e69e0ffb2780b1a7af137ff7b4ff010404faf0a4da65396174b4563d54b52f06c870edf0c5d744b5272b44c23488b2bdbff947c4dfa108cbb88202ee1192b81f428a5b3c299848649e1a6bff52f657a67463d7dbf85ae9321fc2b517dc4a29b9b5a8ded5de8206c812439ab129ae818837ee1562078fc524a3baf49a0be9bb7d958d5e87c6c09bf71a894bad62934782cc308e936d7637e07c4a2a3bc87b0da23c00d9ef418cf19e7a8c4c328be0ce95798adc2dca871073f6bd61dc18402cde8b0100010000000000abc86b94f8cbde4d470667bee722a6a2af483ad0d3415ed0f9db059acaba9eaea93f811d434e00000000000000000000d154ba10a8e51489a614e69722bac30000000000000000000000000000c5dfd188ff555285b9743d3aac000583f44fc00b69151d681a2f71373f20d92c9048407c91fabecfe8b3f2d545ffffffff00000000a1cfc4336324c86f3dcb43e9a58208077e90f6ec1c7ac756f61dcc372cdd30b82507489f0bbfbd3c3f21752e81319c0161e154ceb16e00bc7f5a6962dff317f4d014786e432817064874d69a39cb0da31bcc5f81894d8a80756447322207b4007dff12eb95066cc6bc256f0a12282224d718b06ca80b57aa183dd0c3eee45891441f2b89b4c67aa9882281393954972046974f18df232cd7fca610e33f51c2d062020f403d85ff36c26e2f6bd1d82f4d3ceb3472d9a77e0057a3bfe697d9ab7585f4a1b381343d2cf857689232f4fc5135790662dc1419a374be9d7b3e5be2886d23add90d862f1a682ff11c798e338af3e5bb0f9d3952b15bf3e0c618c89d20ca1e18a031397693bf3cfbd8417e5b55e641c898c280356f2da222d5d68919d98158578dcf18efa404e508bcbbb8cfcf70086821ebdf34c9a1dff45af873df904c2bdbef81f246d26f4b40df949e12bdac18533d4e11c608cc31d60cb591c40a7b386fa1c753336d7220a35118d4919b45eff32aab684ee54c0a263c806aabac2f66cbe8d23810052f847c62c6691de14e97aa7e9dc8ecf0cd50540246d2b746e41e5b4e2c095039dfe0f71db6265f7580d098be40ef36faee5d1695830d4242a23e541e6ce9fa1998d8961ef4fe3c8e8fbb566f148c8befc229614a4b7f80d237b8abc6fc0407de31d6e5532f360d379f20f054692b47207922fe6c14eba96c9a7ae906abc1ae1ae8c4fae92883cfa1978a04bb000000000000000000000000000000884efcecca45ea4ab2ec097668456a6ff12854997f5aed737d5205ace5c0b64f87ef10784d0479cb44ca077e0c4ce6ff880e2ce3de63853a9740e9233683bfc8636bee293aeeb680b399a296e6f44c07b5fc5d9d359af007f23004a7acb6df23664ea209620b4fe0f4df81c33bd8ca2335cb4b50881937379b45a301175c3e8eb32970564ec8e25c46ee3bae079faedaad94276cfa251be8256c4c37fc84a299fa176018054e9149a1c9d20a809ce3000000000000000000000000f6fad8476470bf4bb79d2ba2c0f7147577466f4229b364d6900ad22583c0ec630ea0c6177ad88014b074d88fea473d5ef91ed786bbd3371f0dfcc5ccf4aa82927192aa94fe70a261f1899e1f2f62d50b027f7e7cac8fe3691aa323e71d5e479d466512d1df57633a9006016322978a795431c745f0502e37b8884c368a3f9d5c05a7fb5bd25d95442d09f79c5bd656dccb450cb19c6df406ffcfc414334021df3e4654f84f10070846d3b0679544"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0xc, '\x00', 0x0, @sched_cls, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0xffffffffffffffd2, 0x10, 0x0, 0x38}, 0x48) (async, rerun: 64) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000003480)={0x6, 0x2, &(0x7f00000001c0)=ANY=[@ANYBLOB="0701000009090c040500feff"], &(0x7f0000000080)='GPL\x00', 0x5, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x11}, 0x90) (async) r5 = bpf$MAP_CREATE(0x0, &(0x7f0000000140)=@base={0x18, 0x3, 0x7, 0xfffffff8, 0xa015, 0xffffffffffffffff, 0xb08, '\x00', 0x0, 0xffffffffffffffff, 0x0, 0x4, 0x3}, 0x50) (async) ioctl$sock_ipv6_tunnel_SIOCCHGTUNNEL(0xffffffffffffffff, 0x89f3, &(0x7f0000000f40)={'syztnl1\x00', &(0x7f0000000ec0)={'syztnl0\x00', 0x0, 0x2f, 0x2, 0x0, 0x8, 0xc, @mcast2, @private0={0xfc, 0x0, '\x00', 0x1}, 0x7, 0x20, 0x2, 0x4}}) (async) r7 = bpf$BPF_BTF_LOAD(0x12, &(0x7f0000001080)={&(0x7f0000000f80)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0xc, 0xc, 0x4, [@restrict={0x10, 0x0, 0x0, 0xb, 0x2}]}, {0x0, [0x2e, 0x30]}}, &(0x7f0000000fc0)=""/148, 0x28, 0x94, 0x0, 0x9}, 0x28) syz_emit_ethernet(0x86, &(0x7f0000000980)={@local, @multicast, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x78, 0x0, 0x0, 0x0, 0x1, 0x0, @private=0xa010102, @local}, @redirect={0x5, 0x0, 0x0, @multicast2, {0x17, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x11, 0x0, @private=0xa010101, @local, {[@timestamp_addr={0x44, 0x1c, 0xfc, 0x1, 0x0, [{@rand_addr, 0x4e210000}, {@remote, 0x2}, {@local, 0x3ff}]}, @timestamp_addr={0x44, 0x2c, 0x0, 0x1, 0x0, [{@multicast1}, {}, {@dev}, {@private}, {@broadcast}]}]}}}}}}}, 0x0) (async) r8 = socket$pppl2tp(0x18, 0x1, 0x1) (async, rerun: 64) r9 = socket$inet6_udp(0xa, 0x2, 0x0) (rerun: 64) connect$pppl2tp(r8, &(0x7f0000000740)=@pppol2tpv3={0x18, 0x1, {0x3, r9, {0x2, 0x4e23, @broadcast}, 0x2, 0x0, 0x4}}, 0x2e) bind$inet6(r9, &(0x7f0000000000)={0xa, 0xe22, 0x0, @empty}, 0x1c) (async) syz_emit_ethernet(0x50, &(0x7f0000000c00)={@link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x3}, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x34}, @val={@void}, {@ipv6={0x86dd, @udp={0x0, 0x6, "910100", 0x16, 0x11, 0xff, @remote, @local, {[], {0x0, 0xe22, 0x16, 0x0, @opaque="d16087e5eeff4d000f29602c1686"}}}}}}, 0x0) (async) r10 = socket$inet6(0xa, 0x2, 0x0) bind$inet6(r10, &(0x7f0000000480)={0xa, 0x4e20, 0x0, @mcast1, 0x2}, 0x1c) (async) bind$inet6(r10, &(0x7f0000f67fe4)={0xa, 0x4e22, 0x2000000, @private1}, 0x1c) (async) bpf$PROG_LOAD_XDP(0x5, &(0x7f00000011c0)={0x6, 0x12, &(0x7f0000000300)=@ringbuf={{0x18, 0x0, 0x0, 0x0, 0xfffffffd, 0x0, 0x0, 0x0, 0xff}, {{0x18, 0x1, 0x1, 0x0, 0x1}}, {}, [@exit, @map_fd={0x18, 0x4, 0x1, 0x0, r5}], {{}, {}, {0x85, 0x0, 0x0, 0x85}}}, &(0x7f00000003c0)='GPL\x00', 0x10001, 0xb2, &(0x7f0000000400)=""/178, 0x41100, 0x0, '\x00', r6, 0x25, r7, 0x8, &(0x7f00000010c0)={0x3, 0x2}, 0x8, 0x10, &(0x7f0000001100)={0x3, 0x10, 0x44ff, 0x3}, 0x10, 0x0, 0x0, 0x8, 0x0, &(0x7f0000001140)=[{0x1, 0x2, 0x7, 0x6}, {0x4, 0x2, 0xf, 0xc}, {0x3, 0x5, 0x7, 0xb}, {0x1, 0x1, 0x5, 0x5}, {0x1, 0x3, 0xa}, {0x3, 0x2, 0x10, 0x3}, {0x1, 0x1, 0x7, 0x4}, {0x4, 0x4, 0x400, 0xa}], 0x10, 0x3}, 0x94) 1.531050291s ago: executing program 0 (id=6616): r0 = socket(0x2b, 0x1, 0x0) connect$inet6(r0, &(0x7f0000000180)={0xa, 0x4e20, 0x6, @initdev={0xfe, 0x88, '\x00', 0x1, 0x0}, 0x8}, 0x1c) r1 = socket$inet_sctp(0x2, 0x5, 0x84) r2 = socket$inet6_sctp(0xa, 0x5, 0x84) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r2, 0x84, 0x6f, &(0x7f0000000000)={0x0, 0x1c, &(0x7f00000000c0)=[@in6={0xa, 0x4e20, 0x0, @private2}]}, &(0x7f0000000180)=0x10) r3 = socket$inet_sctp(0x2, 0x1, 0x84) getsockopt$inet_sctp_SCTP_MAX_BURST(r3, 0x84, 0xd, &(0x7f0000000000)=@assoc_value={0x0}, &(0x7f0000000040)=0x8) setsockopt$inet_sctp6_SCTP_PEER_ADDR_THLDS(r2, 0x84, 0x85, &(0x7f0000000740)={r4, @in6={{0xa, 0x4e20, 0xffffffff, @private2, 0xffffffff}}, 0x0, 0x1}, 0x90) getsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER(0xffffffffffffffff, 0x84, 0x7b, &(0x7f0000000280)={0x0, 0x6}, &(0x7f00000002c0)=0x8) r6 = socket$inet6_sctp(0xa, 0x5, 0x84) r7 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r7, &(0x7f00000000c0)={0x0, 0xffffffffffffff24, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[], 0x7c}}, 0x0) sendmsg$NFT_BATCH(r7, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f0000000a40)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a3c000000090a010400000000000000000a0000040900010073797a310000000008000540000000020900020073797a310000000008000a40fffffffc3c0000000c0a010100000000000000000a0000070900000900010073797a3100000000100003800c0000800800034000000002140000001100010000000000000000000100000a88f45d0dbf0bd05f5032a7b908482f120f68dd6f0d28a66b5aeb9feb6ceb99ec0468b08d28f0b0623eb8c910650fbf8c45469927fd6d9f552935446ce5a98330bee3001b955932704a22615c74a96d1ff906b54ca7dfba0a83bf6a4067ca778dd55782b61ba2402acad60aea3b51244e9ea0cbcbb8bb31c0117d1b891121c00875c581fff1961c15b4e2bc000000000000000000"], 0xa0}, 0x1, 0x0, 0x0, 0x24000850}, 0x40) r8 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r8, &(0x7f0000000000)={0x500, 0x0, &(0x7f0000000040)={&(0x7f0000000080)=ANY=[@ANYBLOB="020500000c000000000000000000000005000600000000000a00000000000000fc0100010000000000000000000000000000000000000000020001e5b30000000000010000000000030005000000000002000000ac1e00010000100000000000"], 0x60}}, 0x0) r9 = socket$alg(0x26, 0x5, 0x0) bind$alg(r9, &(0x7f0000000140)={0x26, 'hash\x00', 0x0, 0x0, 'hmac(sha224)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r9, 0x117, 0x1, 0x0, 0x0) r10 = accept4$alg(r9, 0x0, 0x0, 0x800) sendmsg$alg(r10, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)=[{&(0x7f00000001c0)="f5a9496032", 0x5}], 0x1}, 0x55) r11 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_MSG_GETSETELEM(r11, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000002f40)=ANY=[@ANYBLOB="40000000210a010900000000000000000a0000010900020073797a31000000000900010073797a31"], 0x40}, 0x1, 0x0, 0x0, 0x24000801}, 0x8000) getsockopt$inet_sctp6_SCTP_PR_ASSOC_STATUS(r6, 0x84, 0x73, &(0x7f0000000600)={0x0, 0x773f, 0x10, 0x1, 0x3}, &(0x7f0000000340)=0x6) getsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(0xffffffffffffffff, 0x84, 0x9, &(0x7f0000000380)={0x0, @in={{0x2, 0x4e24, @dev={0xac, 0x14, 0x14, 0x22}}}, 0xb, 0x8, 0x8, 0xfffffffa, 0x4, 0x3ff, 0x40}, &(0x7f0000000440)=0x9c) sendmmsg$inet_sctp(r1, &(0x7f00000005c0)=[{&(0x7f0000000040)=@in6={0xa, 0x4e20, 0x2ef40bcf, @mcast1, 0x7}, 0x1c, &(0x7f0000000240)=[{&(0x7f0000000080)="279dccb1fadb1422095cbba7aa03fc313dc6dab31304264a1aa4ba651e45bbfa27494991c8ea93ee7508a2b2118791f1b78fd00ac2e77b68404d1ccdbaf3c228063c42ba12618d8507ed68a65ddc5c8aac58d41a0e5cf6aa1586ac99ea986c", 0x5f}, {&(0x7f0000000100)="548fe75deec20855c8", 0x9}, {&(0x7f0000000140)="0dedb985d46407e5fd82abae78dcac44edfa36a4b02f0238e183b04f14c870dd205fc9a1f9b543b27df19d92dc998b22c3a7544fdca4dd0b954a7357994bd3e46d8f306b614b526f42f05f5a5d1b5725bb04d4af075e3c6a6d7c2b736fdfaa4a6cae06682570f318e6071a888e96c657df7a78532065122f04697f685b85480a1896b82fef65474b84ab0847f70ec5287e37c17639fb541f5e3a85f0", 0x9c}], 0x3, &(0x7f0000000b80)=ANY=[@ANYBLOB="300000000000000084000000010000000300000002000000040000000800000004000000030000000b000000", @ANYRES32=r4, @ANYBLOB="18000000000000008400000007000000ac1e010100000000180000000000000084000000060000007f0000000000000020000000000000008400000008000000fc000000000000000000000000000001200000000000000084000000020000000800020001f0ffffddffffff", @ANYRES32=r5, @ANYBLOB="180000000000000084000000060000000800008000000000180000000000000084000000050000000000000003000000840000000500000020000000378c000020000000000000008400000002000000060000008000000009000000a00f8194dc1043f8f083601a6c34fb4b0ba04a4e2af4289cdf1e9eebaa44a5244b49bb6737329640f2ab8a7c5ea258a04d4a31c505d3e09fac63f513b201c4fe9206c9d377d9f3be62408adc589cc5dc5a80b23e00f38334", @ANYRES32=r12, @ANYBLOB="30000000000000008400000001000000ff0f020004000000000800009a070000030000000900000081000000", @ANYRES32=r13], 0x138, 0x44}], 0x1, 0x4000040) r14 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="0600000004000000080000000800000000000000", @ANYRES32, @ANYBLOB='\x00'/20, @ANYRES32=0x0, @ANYRES32, @ANYBLOB="00000200000000000008000000000000000000000000000000000400"], 0x48) r15 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x4, 0xc, &(0x7f0000000880)=ANY=[@ANYBLOB="1800000000000000000000000000000018150000", @ANYRES32=r14, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000012000000850000001500000095"], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000600)={r15, 0x0, 0xe, 0x0, &(0x7f0000001640)="e0857f9f582f0300000000000000", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) setsockopt$inet_sctp_SCTP_PR_SUPPORTED(r1, 0x84, 0x71, &(0x7f0000000200), 0x8) sendto$inet(r1, &(0x7f0000000700)="ab12bb69", 0x4, 0x840, &(0x7f0000000000)={0x2, 0x4e22, @loopback}, 0x10) 1.041971443s ago: executing program 3 (id=6621): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f00000002c0)={'bridge_slave_0\x00', 0x0}) sendmsg$NFT_BATCH(0xffffffffffffffff, 0x0, 0x0) syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff) sendmsg$DEVLINK_CMD_SB_POOL_SET(0xffffffffffffffff, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000280)={0x54, 0x0, 0x20, 0x70bd29, 0x25dfdbff, {}, [{@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, {0x8, 0xb, 0x5}, {0x6, 0x11, 0x6}, {0x8, 0x13, 0xe}, {0x5}}]}, 0x54}, 0x1, 0x0, 0x0, 0x1}, 0x8050) r3 = socket(0x10, 0x80002, 0x0) sendmsg$nl_route(r3, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000280)=ANY=[@ANYBLOB="440000001100a7cc4a372eaf541d002007000000", @ANYRES32=r2, @ANYBLOB="00000000100000001c001a"], 0x44}}, 0x2000800) sendmsg$NFT_BATCH(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000a00)=ANY=[@ANYBLOB="140000001000010000000000000000000100000a20000000000a01040000000000000000010000030900010073797a30000000002c000000030a01010000000000000000010000090900010073797a30000000000900030073797a30000000009c000000060a010400000000000000000100000008000b400000000074000480340001800b000100657874686472000024000280080001400000000c0800034000000000080004400000002d05000200070000003c0001800c00010062697477697365002c000280080002400000000a08000340000000010800064000000000080001400000001204000580040004800900010073797a30"], 0x110}}, 0x0) 983.107133ms ago: executing program 1 (id=6622): r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000140)=ANY=[@ANYBLOB="1c000000120021030000000000bc61682a00968008001d001d"], 0x1c}], 0x1}, 0x0) ioctl$BTRFS_IOC_BALANCE_CTL(r0, 0x40049421, 0xfde82cf4c1a27794) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000000)=@newlink={0x50, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x137b}, [@IFLA_LINKINFO={0x28, 0x12, 0x0, 0x1, @gre={{0x8}, {0x1c, 0x2, 0x0, 0x1, [@IFLA_GRE_IKEY={0x8, 0x4, 0x7}, @IFLA_GRE_PMTUDISC={0x5}, @IFLA_GRE_IGNORE_DF={0x5, 0x13, 0x1}]}}}, @IFLA_NUM_TX_QUEUES={0x8, 0x1f, 0x9}]}, 0x50}}, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r3 = socket(0x400000000010, 0x3, 0x0) r4 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r3, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000005c0)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0x25dfdbfb, {0x0, 0x0, 0x0, r5, {0x0, 0x1}, {0xffff, 0xffff}, {0xffff, 0x9}}, [@qdisc_kind_options=@q_multiq={{0xb}, {0x8}}]}, 0x38}, 0x1, 0x0, 0x0, 0x40004}, 0x4000) sendmsg$nl_route_sched(r3, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000080)=@newtfilter={0x4c, 0x2c, 0xc3f, 0x70bd2d, 0x25dfdbf9, {0x0, 0x0, 0x0, r5, {0x3, 0x2}, {}, {0x7, 0xffe0}}, [@filter_kind_options=@f_flower={{0xb}, {0x1c, 0x2, [@TCA_FLOWER_KEY_ETH_TYPE={0x6, 0x8, 0x8100}, @TCA_FLOWER_KEY_VLAN_ETH_TYPE={0x6, 0x19, 0x88a8}, @TCA_FLOWER_KEY_CVLAN_ETH_TYPE={0x6, 0x4f, 0x8864}]}}]}, 0x4c}, 0x1, 0x0, 0x0, 0x24000810}, 0x20084084) recvmmsg(r0, &(0x7f00000077c0), 0x8000000000001ac, 0x2140, 0x0) 939.785385ms ago: executing program 3 (id=6623): socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$nl_generic(0x10, 0x3, 0x10) socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000580), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000480)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_TRIGGER_SCAN(r2, &(0x7f0000000540)={0x0, 0x0, &(0x7f0000000500)={&(0x7f00000004c0)={0x28, r3, 0x1, 0x70bd2a, 0x25dfdbfb, {{}, {@val={0x8, 0x3, r4}, @void}}, [@NL80211_ATTR_BSSID={0xa}]}, 0x28}, 0x1, 0x0, 0x0, 0x804}, 0x0) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) connect$unix(r1, &(0x7f0000000000)=@abs={0x0, 0x0, 0x5}, 0x6e) connect$unix(r0, &(0x7f0000000800)=@file={0x0, './file0\x00'}, 0x6e) r5 = socket$inet(0xa, 0x801, 0x84) connect$inet(r5, &(0x7f0000004cc0)={0x2, 0x0, @remote={0xac, 0x14, 0xffffffffffffffff}}, 0x10) listen(r5, 0x8) r6 = socket$inet6(0x10, 0x3, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0xffffffffffffff51, &(0x7f0000000340)={&(0x7f00000006c0)=ANY=[@ANYRESDEC=r5, @ANYRES32=r3, @ANYRESHEX=r6], 0x30}, 0x1, 0x0, 0x0, 0x4000}, 0x4000010) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000000)=ANY=[@ANYBLOB="2c000000190001000000000000000000021800000000fd000000ed0008000100ac141400340008"], 0x2c}}, 0x0) setsockopt$inet_sctp6_SCTP_RTOINFO(0xffffffffffffffff, 0x84, 0x0, 0x0, 0x0) sendto$inet6(r6, &(0x7f0000000000)='s', 0x10a73, 0x800, 0x0, 0x4b6ae4f95a5de35b) r7 = accept4(r5, 0x0, 0x0, 0x0) r8 = syz_genetlink_get_family_id$nl80211(&(0x7f00000001c0), r7) ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8933, &(0x7f0000000200)={'wlan0\x00', 0x0}) r10 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r10, &(0x7f0000000100)={0x40000000, 0x0, &(0x7f00000000c0)={&(0x7f0000000440)=ANY=[@ANYBLOB="02180000100000000000000000000000030006000000000002000004000000000000000000000000080012000000000000000000000000003000000000000000000000000000000002000001000000000000000000000000fc020000000000000000000000000000030005000000000002"], 0x80}}, 0x0) r11 = socket$l2tp(0x2, 0x2, 0x73) setsockopt$IPT_SO_SET_REPLACE(r11, 0x0, 0x40, &(0x7f0000000440)=@mangle={'mangle\x00', 0x44, 0x6, 0x3c8, 0x1c8, 0x1c8, 0x260, 0x0, 0x0, 0x330, 0x330, 0x330, 0x330, 0x330, 0x6, 0x0, {[{{@ip={@multicast1, @dev={0xac, 0x14, 0x14, 0x13}, 0xff, 0xff000000, 'pim6reg1\x00', 'bridge_slave_0\x00', {}, {0xff}, 0x88, 0x3}, 0x0, 0x70, 0x98}, @TTL={0x28, 'TTL\x00', 0x0, {0x1, 0x9}}}, {{@ip={@private=0xa010100, @local, 0x7fffff80, 0x0, 'vcan0\x00', 'veth0_virt_wifi\x00', {}, {0xff}, 0x6}, 0x0, 0x70, 0x98}, @ECN={0x28, 'ECN\x00', 0x0, {0x10, 0x0, 0x2}}}, {{@uncond, 0x0, 0x70, 0x98}, @TTL={0x28, 'TTL\x00', 0x0, {0x2}}}, {{@ip={@private=0xa010101, @multicast1, 0x0, 0xffffff00, 'syzkaller0\x00', 'bond0\x00', {}, {}, 0x0, 0x2}, 0x0, 0x70, 0x98}, @unspec=@CHECKSUM={0x28}}, {{@uncond, 0x0, 0x70, 0xd0}, @common=@CLUSTERIP={0x60, 'CLUSTERIP\x00', 0x0, {0x0, @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x3}, 0xff, 0x2, [0x4, 0x36, 0x1d, 0x1c, 0x23, 0x21, 0x2c, 0x7, 0x1e, 0x7, 0x2e, 0x37, 0x30, 0x9, 0x3b, 0x16], 0x0, 0x6, 0x2}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x451) sendmsg$NL80211_CMD_GET_MPP(r7, &(0x7f00000002c0)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0xdc945a15aecd3fb2}, 0xc, &(0x7f0000000280)={&(0x7f0000000240)={0x40, r8, 0x800, 0x70bd28, 0x25dfdbfd, {{}, {@val={0x8, 0x3, r9}, @val={0xc, 0x99, {0x7, 0x54}}}}, [@NL80211_ATTR_MPATH_NEXT_HOP={0xa}, @NL80211_ATTR_MAC={0xa}]}, 0x40}, 0x1, 0x0, 0x0, 0x44810}, 0x20008880) setsockopt$inet_sctp6_SCTP_PEER_ADDR_THLDS(r7, 0x84, 0x1f, &(0x7f0000000600)={0x0, @in={{0x2, 0x4e21, @empty}}, 0x1000, 0x2}, 0x90) 806.108525ms ago: executing program 4 (id=6624): bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000180)=@bpf_lsm={0xd, 0x5, &(0x7f0000000040)=@framed={{0x76, 0xa, 0x0, 0x0, 0x0, 0x61, 0x11, 0x50}, [@initr0]}, &(0x7f0000000080)='syzkaller\x00', 0x0, 0xffe5}, 0x90) 543.885534ms ago: executing program 1 (id=6625): r0 = socket$inet6_sctp(0xa, 0x1, 0x84) listen(r0, 0x100) r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1) setsockopt$inet_mreq(r1, 0x0, 0x23, &(0x7f0000000000)={@multicast1=0xe0000300, @local}, 0x8) (async) r2 = socket$igmp(0x2, 0x3, 0x2) setsockopt$MRT_INIT(r2, 0x0, 0xc8, &(0x7f0000003d40), 0x4) setsockopt$MRT_ADD_VIF(r2, 0x0, 0xca, &(0x7f0000003d80)={0x1, 0x0, 0x0, 0x0, @vifc_lcl_addr=@local, @dev}, 0x10) syz_emit_ethernet(0x36, &(0x7f0000000180)={@multicast, @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x2}, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x28, 0x0, 0x0, 0x0, 0x2, 0x0, @empty, @multicast1=0xe0000300}, @timestamp_reply={0xe, 0x0, 0x0, 0x2, 0xf, 0x5, 0x2, 0x9}}}}}, 0x0) r3 = socket(0x10, 0x3, 0x0) setsockopt$netlink_NETLINK_TX_RING(r3, 0x10e, 0xc, &(0x7f0000000100)={0x80000000, 0x0, 0xfffffffc}, 0x10) write(r3, &(0x7f0000000000)="240000001a005f0214f9f407000982001f000000fe0000000000000008000f00fd000000", 0x24) r4 = accept4(r0, 0x0, 0x0, 0x0) bpf$ENABLE_STATS(0x20, 0x0, 0x0) r5 = bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f00000003c0)=@bpf_lsm={0x1e, 0x3, &(0x7f0000000080)=ANY=[@ANYBLOB="1800000001000000000000000000000095"], &(0x7f0000000280)='GPL\x00', 0x0, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, 0x24}, 0x94) (async) bpf$MAP_CREATE(0x0, &(0x7f0000000000)=@base={0x0, 0x0, 0x2, 0x0, 0x4102, 0x1, 0x10000}, 0x50) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000440)={r5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x600, 0x0, 0x48, 0x0, &(0x7f0000000000)='\x00', 0x0}, 0x48) (async) setsockopt$sock_timeval(r4, 0x1, 0x56, &(0x7f00000001c0)={0x0, 0x2710}, 0x10) (async) r6 = accept4$vsock_stream(r4, &(0x7f00000000c0)={0x28, 0x0, 0xffffffff, @local}, 0x10, 0x80000) splice(r6, &(0x7f0000000100)=0x6, r5, &(0x7f0000000180)=0x8, 0x3, 0xd) (async) sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f00000035c0)={0x0, 0x0, &(0x7f0000003580)={&(0x7f0000000900)=@newsa={0x184, 0x10, 0x1, 0x0, 0x0, {{@in=@initdev={0xac, 0x1e, 0x1, 0x0}, @in6=@local, 0x0, 0x0, 0x2000, 0x0, 0xa, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff}, {@in=@multicast1, 0x0, 0x6c}, @in=@empty, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1000000000000000}, {0x0, 0x4}, {}, 0x0, 0x0, 0x2, 0x1, 0x6}, [@algo_comp={0x48, 0x3, {{'deflate\x00'}}}, @algo_aead={0x4c, 0x12, {{'gcm_base(ctr(aes-aesni),ghash-generic)\x00'}, 0x0, 0x80}}]}, 0x184}}, 0x0) (async) shutdown(r0, 0x1) (async) r7 = socket$nl_route(0x10, 0x3, 0x0) (async) setsockopt$inet_sctp_SCTP_I_WANT_MAPPED_V4_ADDR(0xffffffffffffffff, 0x84, 0xc, &(0x7f0000000040)=0xb, 0x4) sendmsg$nl_route(r7, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000000)=ANY=[@ANYBLOB="3c00000010000304000000000400000000000000", @ANYRES32=0x0, @ANYRESHEX], 0x3c}, 0x1, 0x2000000000000000}, 0x0) 539.534335ms ago: executing program 2 (id=6626): ioctl$XFS_IOC_ATTRLIST_BY_HANDLE(0xffffffffffffffff, 0x4058587a, &(0x7f0000000180)={{0xffffffffffffffff, &(0x7f0000000000)='\x00', 0x400000, &(0x7f0000000040)={@align=0x4, {0x10, 0x4, 0x10000, 0x2c}}, 0x0, &(0x7f0000000080), &(0x7f00000000c0)=0x3}, {[0x4, 0x200, 0x0, 0x3d2]}, 0x3, 0x44, &(0x7f0000000100)=""/68}) ioctl$sock_kcm_SIOCKCMUNATTACH(0xffffffffffffffff, 0x89e1, &(0x7f0000000200)={r0}) bpf$MAP_LOOKUP_BATCH(0x18, &(0x7f0000000480)={&(0x7f0000000240)="f699bceb622fef95b802c33345537755fab3c690530dfad51f56984a07b386faa653c5460eaf87630ba1fddb78a9e361c8562e9bf43d382c682ae0a59e0793c8341704c0664336f0b4aef85b7c69575fa2d78ae0b7dd25f4f14150e26f27aef85eff5788d9781ed70a0e975462a49371a950c93aa1e6f8b13018572a7894c667e7b162264970d2570ec91c80ddaafe9df71b8022b58f0f42b8ad4077525d3db007063991989e25f3a390c672a86771d61b9a87c260a7b31cec563d84c17cbe29cfac7c2641168c948bccf85b25ea68d06b6f", &(0x7f0000000340)=""/53, &(0x7f0000000380)="fc917e8c9df818d1173980b315bd37f4b9e83fe35c12fdf1faf884da232aa71886734027cfaa74eb08713636e7526a9549868c5b29860b9b8e3b5f1940af9c8bd4f3659097893476ecd08e8fab02b69b38ca6fbf2e7c25d100e9c0491e0d0842b8974fcd7e02b515524ccb7dc3c39e77248b3ee8867b25e863f44bc7934a96b529fad36af3b711", &(0x7f0000000440)="10b4b670b78973a83322d447a3c2ec0f1d4f0ae681158d1659c21df3aaa08579dac05418", 0x401, r0, 0x4}, 0x38) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000004c0)={'tunl0\x00'}) bpf$MAP_UPDATE_BATCH(0x1a, &(0x7f0000000840)={&(0x7f0000000500)="501f10ff26136459163572a1bb81c256f803e35da5dfedc477fa74e60ed1ae7bd7372c77da6e3559005b86e82894e7cd5fe506797b4f41f89181d75d99725410a71eacf1ebabb9342c2bde6db46bea03b70537c88363ddd23b9c6bf980680cae90968fdc21769e8b6b60f24e0ed0c9e372ade884928d44f587b0c5cb92b172437a831bfa2ec07efb819f351c9e2d09095efefcc1fefd7a8735fb674153421a3cf041786a2a3351b57521aa98b2f23b3e2c34bbf54b3861081613354db97f094d1c8120e0adf683e04fb8ec2d19bd6b0d0c5bf4b563c2b145d6e00cf23ad55a424a16b1552bff914a8cb78af2d26b005473f7b414cefe8d44d82fd59dfa8a", &(0x7f0000000600)=""/100, &(0x7f0000000680)="97c43272a7de5a1d6ada2e09a028aaf1b60339584b58865411e330bbb4f75a6c371dfdc4cf8591c949b365202528006619c167e78918b3b060bc5a4eb410472dc3ec2298065b9d573a4470f207c39fcfa67bbafcecd96b55bf12a99b0bbd3ec8612189d076cb62dda1e8dae3c92b1d513cc829bb77c29d760f8b8ff2b21f290ec6a919d88153a820f07c1a43afe9151c302ffa06f7121dc1b99645da21977fb0d6bb346e401d3b4a9d663f0b36e9c6528e54da693be862d2685c6626469d6af2dc9da2", &(0x7f0000000780)="9f91763f8ba5dc57e039215c930eb4421e7dc5a2f1e1f9dde9846065784c7ea04fcb20b6fa2c4333d6fa743907d40223075870d42015a7bfc231d8929c0569646dbe2476af7e64589b5357e25ae89ba2b1c41121ecd637c4385fa826bac2cbf38ba8295987f2a7c414aa761e9e1352e5df54e63c5d05a69e02c0bb31306bdc827536b499eb92d6b742c82945e052fac8490e2ee542c01118c2c6e20ad5", 0x0, r0}, 0x38) sendmsg$IPCTNL_MSG_EXP_GET(r0, &(0x7f0000000980)={&(0x7f0000000880)={0x10, 0x0, 0x0, 0x20001000}, 0xc, &(0x7f0000000940)={&(0x7f00000008c0)={0x58, 0x1, 0x2, 0x301, 0x0, 0x0, {0x7}, [@CTA_EXPECT_TUPLE={0x44, 0x2, 0x0, 0x1, [@CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @mcast1}, {0x14, 0x4, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}}}}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5, 0x1, 0x1}}, @CTA_TUPLE_ZONE={0x6}]}]}, 0x58}, 0x1, 0x0, 0x0, 0x80c4}, 0x40) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$OSF_MSG_REMOVE(r1, &(0x7f0000001180)={&(0x7f00000009c0)={0x10, 0x0, 0x0, 0x40000}, 0xc, &(0x7f0000001140)={&(0x7f0000000a00)={0x710, 0x1, 0x5, 0x801, 0x0, 0x0, {0x3, 0x0, 0x1}, [{{0x254, 0x1, {{0x2, 0x8}, 0x1e, 0x4, 0x80, 0x7, 0x8, 'syz0\x00', "d0cb827c2ef8312c799c21596c91a2d7e6c67d849bd10859193fa908682bcadc", "e691d1fc5ab3d0bf4875089bb1206fc04a9a4fe3627bd98d5bb7883054e5b3e8", [{0x78, 0x1, {0x0, 0x5}}, {0x4, 0xf800, {0x0, 0x5}}, {0x9, 0x4, {0x2, 0x2feb}}, {0x7ff, 0x463d, {0x3}}, {0x5, 0x6d7e}, {0xa, 0x7, {0x0, 0xf6f}}, {0x7, 0x4, {0x1, 0x7ff}}, {0x7ff, 0x5, {0x1, 0x2}}, {0x153, 0x1, {0x1, 0x1}}, {0x2, 0x10, {0x0, 0x6}}, {0x1000, 0x9, {0x3, 0x7ff}}, {0x101, 0x4, {0x2, 0x2}}, {0x9, 0xe5, {0x3, 0x8000}}, {0x3, 0xc, {0x1, 0x3}}, {0x80, 0x2, {0x0, 0x27fa847a}}, {0x800, 0x2, {0x2, 0x43}}, {0xd94, 0x2, {0x1, 0xdaca}}, {0xe, 0x1ff, {0x3}}, {0x5, 0x7, {0x3, 0x1}}, {0x6, 0x8, {0x9bb387a262668595, 0x4}}, {0x8, 0x9, {0x3, 0x5}}, {0x1, 0x6, {0x3}}, {0x7, 0x7f, {0x2}}, {0x7, 0x4, {0x2, 0x3}}, {0x8001, 0xb5, {0x2, 0x4}}, {0x16, 0x8, {0x2, 0x3}}, {0x8, 0x95b, {0x0, 0x7}}, {0x8, 0x7, {0x3, 0x5}}, {0x20, 0x7f, {0x1}}, {0x83, 0xb, {0x2, 0xcb3d}}, {0x7ff, 0xb7, {0x3, 0x4}}, {0x2, 0x3}, {0xff80, 0x8000, {0x3, 0xfffffff9}}, {0x8001, 0x8001, {0x2, 0x9}}, {0x51, 0x9, {0x0, 0x7f}}, {0x9, 0x7ff, {0x1, 0x5}}, {0x3804, 0x7, {0x1, 0x2}}, {0x5cc, 0x7, {0x0, 0x7}}, {0xf1fc, 0x39, {0x3, 0x46c}}, {0x9, 0x800, {0x2, 0x3}}]}}}, {{0x254, 0x1, {{0x3, 0x8001}, 0x16, 0x2, 0xfffc, 0x404, 0x10, 'syz0\x00', "56920e31763d665a3512d75eb0ab25e6064fd9c26de654cf20686016091b8632", "6106e44dc079c398a4298b5a875e3e21846793b8f6a145485b9403ac17ca6663", [{0xd, 0x3, {0x0, 0x1}}, {0x3, 0x6, {0x1, 0x6}}, {0x6, 0x101, {0x3, 0x6}}, {0x3, 0x0, {0x1, 0x7}}, {0xfff, 0x7}, {0x6, 0x401, {0x0, 0x8}}, {0x5, 0x9, {0x3, 0xffff8000}}, {0x1, 0x2, {0x3, 0x4}}, {0x5, 0x4, {0x3, 0x5}}, {0x1, 0x4, {0x0, 0xfffffff4}}, {0x200, 0xe16, {0x2, 0x7d4}}, {0x0, 0x1, {0x0, 0x7}}, {0x8, 0xc000, {0x3, 0x62a}}, {0x2, 0x8, {0x2, 0x80}}, {0x8, 0x7f, {0x2, 0x5}}, {0x92a, 0x8, {0x0, 0x3}}, {0x6, 0x6, {0x1, 0x9}}, {0x4d, 0x1, {0x2, 0xfffffffb}}, {0x7fff, 0xd58, {0x0, 0xfffffe00}}, {0x7, 0x7, {0x1}}, {0x2, 0xe, {0x3, 0x7}}, {0x6, 0x4, {0x0, 0xffffa4bf}}, {0x100, 0x3, {0x1, 0x1}}, {0x80, 0x5, {0x1, 0x7}}, {0x6396, 0x524a, {0x0, 0x3}}, {0x1ff, 0xe, {0x1, 0x8}}, {0x6, 0x3}, {0x2, 0x4, {0x2, 0xa}}, {0xc, 0x9, {0x0, 0x5}}, {0x80, 0x0, {0x2, 0x80000001}}, {0x3, 0x2f39, {0x3, 0x8}}, {0x0, 0x1, {0x0, 0xae}}, {0x3ff, 0x400, {0x0, 0x400}}, {0x1, 0xee, {0x3, 0x7}}, {0x2, 0x1, {0x0, 0x7}}, {0x2, 0x8, {0x3}}, {0x101, 0x6, {0x2, 0x8}}, {0x7, 0x7fff, {0x3, 0x4}}, {0x8, 0x3, {0x3, 0x7}}, {0xfc, 0x3, {0x1, 0x10001}}]}}}, {{0x254, 0x1, {{0x0, 0x8}, 0xc2, 0x40, 0xb, 0xd, 0x1f, 'syz1\x00', "5618e96bc0cf568f77ce56a0a210782d8afe8a1179df032e71b0d2adef79b2c1", "3cdac645fecdbbc76206e6067a35ccc59c645fce36b4610a74173b79ce5db7ba", [{0x1, 0x2, {0x2, 0x432}}, {0x2, 0x7, {0x2, 0xf65}}, {0x3ff, 0x1, {0x0, 0x8000}}, {0x0, 0x3, {0x3, 0xf}}, {0x9, 0x4000, {0x2, 0x81}}, {0xfffc, 0x1, {0x2, 0x7ff}}, {0x418f, 0x1, {0x3, 0x6}}, {0xfff9, 0x5}, {0x7f, 0x9, {0x2, 0x7}}, {0x9, 0x40, {0x1, 0x6cb}}, {0x6, 0x9, {0x3, 0x5}}, {0x4, 0xfff, {0x2, 0x80}}, {0x81, 0x40, {0x3, 0x33f663ac}}, {0x8, 0x6, {0x1, 0x7}}, {0x4, 0xd67, {0x2, 0x4}}, {0x7ff, 0x8, {0x0, 0x1}}, {0x77, 0x2, {0x2, 0x8000}}, {0xfff9, 0x5, {0x1, 0x101}}, {0xfffb, 0x1, {0x0, 0xfd5}}, {0x9ef, 0x4, {0x1, 0xfffff801}}, {0x1, 0xd62c, {0x1, 0xc}}, {0x9f24, 0x7f, {0x1, 0x400}}, {0x1, 0xfffd, {0x0, 0x1}}, {0xc5, 0xfff7, {0x0, 0x4}}, {0x1, 0x8000, {0x3, 0x6}}, {0x0, 0x4, {0x2, 0x4}}, {0x4675, 0xf800, {0x0, 0x7f}}, {0x29b, 0x3b9d, {0x2, 0xd983}}, {0x81, 0x5, {0x0, 0x92a6}}, {0x92, 0x4, {0x1, 0x23}}, {0x9bd9, 0xa4}, {0x4, 0x7, {0x0, 0x5}}, {0x0, 0x1, {0x1, 0x8}}, {0x1, 0x35, {0x0, 0x1}}, {0x7, 0x2, {0x3, 0xdd}}, {0x1, 0x929, {0x3}}, {0xe5, 0x0, {0x2, 0x3ff}}, {0x7, 0xe, {0x1, 0x8}}, {0xff, 0x4, {0x1, 0x8}}, {0x3, 0x7ff, {0x0, 0x2}}]}}}]}, 0x710}, 0x1, 0x0, 0x0, 0x48844}, 0x50010) ioctl$FIONCLEX(r1, 0x5450) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f00000011c0)={'wlan1\x00'}) sendmsg$FOU_CMD_DEL(r0, &(0x7f00000012c0)={&(0x7f0000001200)={0x10, 0x0, 0x0, 0x20}, 0xc, &(0x7f0000001280)={&(0x7f0000001240)={0x3c, 0x0, 0x10, 0x70bd2d, 0x25dfdbfb, {}, [@FOU_ATTR_PEER_V6={0x14, 0x9, @private1}, @FOU_ATTR_LOCAL_V6={0x14, 0x7, @remote}]}, 0x3c}, 0x1, 0x0, 0x0, 0x4000}, 0x4) ioctl$BTRFS_IOC_INO_PATHS(r1, 0xc0389423, &(0x7f0000001340)={0x4, 0x18, [0x1000000000000, 0x557, 0x8, 0x7], &(0x7f0000001300)=[0x0, 0x0, 0x0]}) bpf$OBJ_GET_MAP(0x7, &(0x7f00000013c0)=@o_path={&(0x7f0000001380)='./file0\x00', 0x0, 0x8, r1}, 0x18) ioctl$F2FS_IOC_GET_COMPRESS_BLOCKS(r0, 0x8008f511, &(0x7f0000001400)) r2 = socket$inet_icmp_raw(0x2, 0x3, 0x1) getsockopt$inet_buf(r2, 0x0, 0x27, &(0x7f0000001440)=""/16, &(0x7f0000001480)=0x10) r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$nl802154(&(0x7f0000001500), 0xffffffffffffffff) sendmsg$NL802154_CMD_GET_SEC_DEVKEY(r3, &(0x7f00000015c0)={&(0x7f00000014c0)={0x10, 0x0, 0x0, 0x8000000}, 0xc, &(0x7f0000001580)={&(0x7f0000001540)={0x20, r4, 0x10, 0x70bd2c, 0x25dfdbfd, {}, [@NL802154_ATTR_WPAN_DEV={0xc}]}, 0x20}, 0x1, 0x0, 0x0, 0xc050}, 0x200080d0) r5 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r6 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000001640), r3) sendmsg$IEEE802154_LLSEC_ADD_SECLEVEL(r5, &(0x7f0000001740)={&(0x7f0000001600)={0x10, 0x0, 0x0, 0x2000}, 0xc, &(0x7f0000001700)={&(0x7f0000001680)={0x50, r6, 0x2, 0x70bd29, 0x25dfdbfb, {}, [@IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan0\x00'}, @IEEE802154_ATTR_LLSEC_FRAME_TYPE={0x5, 0x33, 0xd}, @IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan3\x00'}, @IEEE802154_ATTR_LLSEC_SECLEVELS={0x5, 0x35, 0x1}, @IEEE802154_ATTR_LLSEC_FRAME_TYPE={0x5, 0x33, 0x4}, @IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan4\x00'}]}, 0x50}, 0x1, 0x0, 0x0, 0x40c0}, 0x8801) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r1, 0x8933, &(0x7f0000001780)) setsockopt$RDS_FREE_MR(r0, 0x114, 0x3, &(0x7f00000017c0)={{0x1ff, 0x5}, 0x6}, 0x10) ioctl$sock_inet_tcp_SIOCATMARK(r0, 0x8905, &(0x7f0000001800)) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$IEEE802154_ASSOCIATE_REQ(0xffffffffffffffff, &(0x7f0000001900)={&(0x7f0000001840)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f00000018c0)={&(0x7f0000001880)={0x30, r6, 0x400, 0x70bd2c, 0x25dfdbfd, {}, [@IEEE802154_ATTR_COORD_HW_ADDR={0xc, 0x9, {0xaaaaaaaaaaaa0102}}, @IEEE802154_ATTR_CHANNEL={0x5, 0x7, 0x19}, @IEEE802154_ATTR_COORD_PAN_ID={0x6, 0xa, 0x2}]}, 0x30}, 0x1, 0x0, 0x0, 0x1}, 0x810) ioctl$sock_SIOCGIFINDEX_802154(r5, 0x8933, &(0x7f0000001980)={'wpan1\x00', 0x0}) sendmsg$NL802154_CMD_DEL_SEC_LEVEL(r5, &(0x7f0000001a80)={&(0x7f0000001940)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f0000001a40)={&(0x7f00000019c0)={0x4c, r4, 0x100, 0x70bd26, 0x25dfdbfd, {}, [@NL802154_ATTR_IFINDEX={0x8, 0x3, r7}, @NL802154_ATTR_SEC_LEVEL={0x24, 0x2d, 0x0, 0x1, [@NL802154_SECLEVEL_ATTR_DEV_OVERRIDE={0x5, 0x4, 0x1}, @NL802154_SECLEVEL_ATTR_DEV_OVERRIDE={0x5, 0x4, 0x1}, @NL802154_SECLEVEL_ATTR_DEV_OVERRIDE={0x5}, @NL802154_SECLEVEL_ATTR_DEV_OVERRIDE={0x5, 0x4, 0x1}]}, @NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x200000002}]}, 0x4c}, 0x1, 0x0, 0x0, 0x200080c1}, 0x4000000) sendmsg$NFQNL_MSG_VERDICT(0xffffffffffffffff, &(0x7f0000001bc0)={&(0x7f0000001ac0)={0x10, 0x0, 0x0, 0x4}, 0xc, &(0x7f0000001b80)={&(0x7f0000001b00)={0x5c, 0x1, 0x3, 0x3, 0x0, 0x0, {0x1, 0x0, 0x5}, [@NFQA_VLAN={0x1c, 0x13, 0x0, 0x1, [@NFQA_VLAN_PROTO={0x6, 0x1, 0x1, 0x0, 0x88a8}, @NFQA_VLAN_PROTO={0x6, 0x1, 0x1, 0x0, 0x8100}, @NFQA_VLAN_PROTO={0x6, 0x1, 0x1, 0x0, 0x8100}]}, @NFQA_CT={0x2c, 0xb, 0x0, 0x1, [@CTA_ID={0x8, 0xc, 0x1, 0x0, 0x2}, @CTA_ID={0x8, 0xc, 0x1, 0x0, 0x3}, @CTA_LABELS_MASK={0x18, 0x17, [0x0, 0x2, 0x7, 0x9, 0x1d]}]}]}, 0x5c}, 0x1, 0x0, 0x0, 0x4004854}, 0x800) 538.900772ms ago: executing program 4 (id=6627): r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r0, &(0x7f0000019580)={0x0, 0x0, &(0x7f0000003780)={&(0x7f0000000c40)=@newtaction={0x88c, 0x30, 0x12f, 0x0, 0x0, {}, [{0x878, 0x1, [@m_police={0x874, 0x1, 0x0, 0x0, {{0xb}, {0x848, 0x2, 0x0, 0x1, [[@TCA_POLICE_PEAKRATE={0x404, 0x3, [0x0, 0x0, 0xfffffffc, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x12000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffd]}], [@TCA_POLICE_RATE={0x404, 0x2, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x689e5dd0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x40, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10]}], [@TCA_POLICE_TBF={0x3c, 0x1, {0x8000, 0x10000000, 0x400, 0x4, 0x5, {0x9, 0x0, 0x1, 0x2, 0x8, 0x3}, {0x7, 0x2, 0x10, 0x0, 0x1, 0xfffffffe}, 0x80, 0x0, 0x9}}]]}, {0x4}, {0xc, 0xb}, {0xc, 0xa}}}]}]}, 0x88c}}, 0x0) (async) r1 = socket$inet_mptcp(0x2, 0x1, 0x106) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000580)={0x11, 0x6, &(0x7f00000004c0)=ANY=[@ANYBLOB="18000000000000000000000000000000e5000200f0ffffff18400000fcffffff000000000000000095"], &(0x7f0000000040)='GPL\x00', 0x7}, 0x90) (async) setsockopt$inet_int(r1, 0x0, 0x19, 0x0, 0x0) 538.217019ms ago: executing program 3 (id=6628): r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000280)=ANY=[@ANYRESHEX], 0x48) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x2}) r2 = socket$kcm(0x11, 0x3, 0x0) r3 = socket$tipc(0x1e, 0x5, 0x0) bind$tipc(r3, &(0x7f0000000000)=@nameseq={0x1e, 0x1, 0x0, {0x41}}, 0x10) (async) listen(r3, 0x0) r4 = socket$tipc(0x1e, 0x5, 0x0) sendmsg$tipc(r4, &(0x7f0000000240)={&(0x7f0000000080)=@name={0x1e, 0x2, 0x0, {{0x41}}}, 0x10, &(0x7f0000000340)=[{&(0x7f00000002c0)='/', 0x1}], 0x1, 0x0, 0x0, 0x40}, 0x0) (async) accept4(r3, 0x0, 0x0, 0x0) (async) r5 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) close(r5) (async) r6 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r6, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r6, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000500)=@newqdisc={0x40, 0x24, 0x4ee4e6a52ff56541, 0x1, 0x25dfdbfd, {0x0, 0x0, 0x0, r7, {0x0, 0xb}, {0xffff, 0xffff}, {0xfff2}}, [@qdisc_kind_options=@q_fq={{0x7}, {0x14, 0x2, [@TCA_FQ_CE_THRESHOLD={0x8, 0xc, 0x5}, @TCA_FQ_FLOW_MAX_RATE={0x8}]}}]}, 0x40}, 0x1, 0x0, 0x0, 0x40088c1}, 0x0) (async) ioctl$SIOCSIFHWADDR(r5, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) sendmsg$kcm(r2, &(0x7f00000000c0)={&(0x7f0000000380)=@xdp={0x2c, 0x8, r7, 0x2e}, 0x80, &(0x7f0000000200)=[{&(0x7f0000000280)="55ee4addb0838779ff7a51df6a14", 0xe}], 0x1}, 0x4) r8 = socket$kcm(0x2, 0x5, 0x84) sendmsg$inet(r8, &(0x7f0000000600)={&(0x7f00000001c0)={0x2, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}}, 0x10, &(0x7f0000000380)=[{&(0x7f0000000640)="80", 0x26892}], 0x1}, 0xfc) (async) sendmsg$inet(r8, &(0x7f0000000680)={&(0x7f0000000000)={0x2, 0x4e24, @rand_addr=0x64010102}, 0x10, &(0x7f0000000540)=[{&(0x7f0000000240)="f9", 0x1}], 0x1}, 0x24000004) sendmsg$inet(r8, &(0x7f0000000500)={&(0x7f0000000080)={0x2, 0x4e24, @rand_addr=0x64010102}, 0x10, &(0x7f00000000c0)=[{&(0x7f0000000200)="cd", 0x1}], 0x1}, 0x240448c4) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000180)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000010007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) 537.922011ms ago: executing program 1 (id=6629): socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000300)={0xffffffffffffffff}) r1 = socket(0x10, 0x3, 0x0) sendmsg$nl_route(r1, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000480)=@mpls_getroute={0x1c, 0x1a, 0x1, 0x0, 0x0, {0x1c, 0x14, 0x0, 0xfe}}, 0x1c}}, 0x0) r2 = socket$nl_route(0x10, 0x3, 0x0) getsockname$packet(r1, &(0x7f0000000280)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @link_local}, &(0x7f0000000340)=0x14) getsockopt$PNPIPE_IFINDEX(r1, 0x113, 0x2, &(0x7f0000000400)=0x0, &(0x7f0000000440)=0x4) sendmsg$nl_route(r2, &(0x7f0000000580)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f0000000540)={&(0x7f00000004c0)=@newneigh={0x50, 0x1c, 0x1, 0x70bd25, 0x25dfdbfe, {0x7, 0x0, 0x0, r3, 0x4, 0x4, 0xa}, [@NDA_FLAGS_EXT={0x8, 0xf, 0x1}, @NDA_SRC_VNI={0x8, 0xb, 0x4}, @NDA_MASTER={0x8, 0x9, 0x8000}, @NDA_PORT={0x6, 0x6, 0x4e21}, @NDA_LLADDR={0xa}, @NDA_IFINDEX={0x8, 0x8, r4}]}, 0x50}, 0x1, 0x0, 0x0, 0x44}, 0x8840) ioctl$SIOCSIFHWADDR(r0, 0x8993, &(0x7f0000000040)={'bond0\x00', @random='\x00\x00\x00\x00\x00 '}) r5 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r5, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=ANY=[@ANYRESHEX=r1], 0xc4}, 0x1, 0x0, 0x0, 0x4}, 0x40004) r6 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r7 = syz_genetlink_get_family_id$nl802154(&(0x7f00000002c0), 0xffffffffffffffff) sendmsg$NL802154_CMD_GET_SEC_LEVEL(r6, &(0x7f00000003c0)={0x0, 0xfffffffffffffd90, &(0x7f0000000380)={&(0x7f0000000240)={0x14, r7, 0x701, 0x74bd2b, 0x0, {0x5}}, 0x14}, 0x1, 0x0, 0x0, 0x20004074}, 0x2000000) r8 = syz_genetlink_get_family_id$netlbl_unlabel(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$NLBL_UNLABEL_C_STATICLISTDEF(r6, &(0x7f0000000180)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000000140)={&(0x7f00000000c0)={0x28, r8, 0x100, 0x70bd27, 0x25dfdbfb, {}, [@NLBL_UNLABEL_A_IPV6ADDR={0x14, 0x2, @empty}]}, 0x28}, 0x1, 0x0, 0x0, 0x40}, 0x4) 537.343706ms ago: executing program 4 (id=6630): r0 = socket$pppl2tp(0x18, 0x1, 0x1) r1 = socket$inet6_udp(0xa, 0x2, 0x0) connect$pppl2tp(r0, &(0x7f0000000740)=@pppol2tpv3={0x18, 0x1, {0x3, r1, {0x2, 0x4e23, @broadcast}, 0x2, 0x0, 0x4}}, 0x2e) bind$inet6(r1, &(0x7f0000000000)={0xa, 0xe22, 0x0, @empty}, 0x1c) syz_emit_ethernet(0x22, &(0x7f0000000040)={@link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x3}, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x34}, @val={@void}, {@can={0xc, {{0x3, 0x1, 0x1, 0x1}, 0x7, 0x1, 0x0, 0x0, "1482802c77e93ef3"}}}}, 0x0) 495.220974ms ago: executing program 0 (id=6631): r0 = socket$kcm(0x11, 0x3, 0x0) setsockopt$sock_attach_bpf(r0, 0x107, 0xf, &(0x7f0000000000), 0x4) sendmsg$kcm(r0, &(0x7f0000000040)={&(0x7f0000001340)=@hci={0x1f, 0x0, 0x12}, 0x80, &(0x7f0000000140)=[{&(0x7f00000006c0)="62042700590200000000002f1eafbcf706e12b30087f5c582d26116642c47a5f8786ee601e65ab3c06d4b8bf4a81cb3e247345af215542f41ddf82f618438a34f90186cee844", 0x46}], 0x1}, 0x4014) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000300)=@bpf_lsm={0xb, 0x4, &(0x7f0000000040)=@framed={{0x66, 0xa, 0x0, 0x0, 0x0, 0x61, 0x11, 0x4c}, [@call={0x85, 0x0, 0x0, 0x1c}]}, &(0x7f0000000000)='GPL\x00'}, 0x80) 406.657867ms ago: executing program 1 (id=6632): r0 = socket$pppl2tp(0x18, 0x1, 0x1) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$netlbl_mgmt(&(0x7f0000000180), r1) sendmsg$NLBL_MGMT_C_ADD(r1, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000440)={&(0x7f0000000ec0)={0xf4, r2, 0xe701ac47a3d23ecd, 0x0, 0x0, {}, [@NLBL_MGMT_A_PROTOCOL={0x8}, @NLBL_MGMT_A_DOMAIN={0xce, 0x1, 'C\xec\xf8\xa0w\x15|\xd8\xbcs\xe1\xb93\x14\xcd\xcb\xb6\xb9\xbb\x84\xe5\xbc\xdb\x7f\x9a\xf2\xea\xcc\x91:v@\xe83-\x1d\xaagQl\x7f\tKt\fc\x1f\x17]\xd5\xd0\xf0\xa8\xeb\xd2g\x92\x04\x02\v\x00od\xe6,\xd3@I\x17\xf3\xbees0\xad\xc6\xbf/*\xb6(o\x91t\x12\x93U6\xf4@n\xdc\xdc\x8a7y\x81FY\xbe\xbbc\xd2\xc3\x01\xa5\xe2V\x8c\xb3im~\xd2V\xdaG\xbdbF\xc8n\x86\xac\x9c\xfb\xda\xe2&\"\xb4:\x13\xe9\tc\x85\xb4\xcb\x17\xbfm\x846\xe7\x7fp\x9eCdb\xad;\xa2\x8fs\xbf6\xe8\xe3Xg3&\xe2 \xd6\n\x9d=~<\x93/\xaf\x89\x06+\x96]\xb5+\xee\xff8^D*\xdb\xb8\xd8t\x80\xd4\x8fK=E0\xe8R\x83'}, @NLBL_MGMT_A_IPV4MASK={0x8, 0x8, @initdev={0xac, 0x1e, 0x0, 0x0}}]}, 0xf4}}, 0x0) ioctl$SIOCSIFMTU(r0, 0x8922, &(0x7f0000005f40)={'veth0_to_bond\x00', 0xe}) r3 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000000)='blkio.bfq.io_queued\x00', 0x0, 0x0) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r3, 0x8933, &(0x7f0000000040)) setsockopt$sock_linger(r3, 0x1, 0xd, &(0x7f0000000080)={0x0, 0x2}, 0x8) 362.488805ms ago: executing program 4 (id=6633): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) connect$netlink(r0, &(0x7f0000000180)=@kern={0x10, 0x0, 0x0, 0x100000}, 0xc) sendmsg$NFT_MSG_GETCHAIN(r0, &(0x7f0000000580)={&(0x7f0000000380)={0x10, 0x0, 0x0, 0x20}, 0xc, &(0x7f0000000540)={&(0x7f00000003c0)={0x158, 0x4, 0xa, 0x101, 0x0, 0x0, {0x0, 0x0, 0x4}, [@NFTA_CHAIN_TYPE={0xb, 0x7, 'filter\x00'}, @NFTA_CHAIN_HANDLE={0xc, 0x2, 0x1, 0x0, 0x2}, @NFTA_CHAIN_FLAGS={0x8}, @NFTA_CHAIN_TYPE={0x8, 0x7, 'nat\x00'}, @NFTA_CHAIN_HOOK={0x18, 0x4, 0x0, 0x1, [@NFTA_HOOK_DEV={0x14, 0x3, 'pimreg0\x00'}]}, @NFTA_CHAIN_POLICY={0x8}, @NFTA_CHAIN_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_CHAIN_USERDATA={0x9a, 0xc, "ee7fa24c9df0f55f98f84a305efd2630e03223e9effca375525716785e0602736dd1e403c90afe0e8bba872926c1f781603acb6d702fca66b66047be1c12b7a27faf892fff4302afcf5941e5e085d9df23f7213a088a3e78505eb7da0b76f73e7c671adf3518f264c403fb62a6ce04ab13c5315460cceefd51573db11b4b1daf772d75436947f4b40a2c47778f8abdc6d60f09262366"}, @NFTA_CHAIN_HOOK={0x4c, 0x4, 0x0, 0x1, [@NFTA_HOOK_PRIORITY={0x8, 0x2, 0x1, 0x0, 0x3c87a466}, @NFTA_HOOK_DEV={0x14, 0x3, 'lo\x00'}, @NFTA_HOOK_HOOKNUM={0x8, 0x1, 0x1, 0x0, 0x3}, @NFTA_HOOK_DEV={0x14, 0x3, 'veth1_macvtap\x00'}, @NFTA_HOOK_PRIORITY={0x8, 0x2, 0x1, 0x0, 0x19260b94}, @NFTA_HOOK_HOOKNUM={0x8, 0x1, 0x1, 0x0, 0x4}]}, @NFTA_CHAIN_FLAGS={0x8}]}, 0x158}, 0x1, 0x0, 0x0, 0x24000000}, 0x80) r1 = socket$pppl2tp(0x18, 0x1, 0x1) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$wireguard(&(0x7f0000000040), 0xffffffffffffffff) ioctl$ifreq_SIOCGIFINDEX_wireguard(r2, 0x8933, &(0x7f00000003c0)={'wg2\x00', 0x0}) sendmsg$WG_CMD_SET_DEVICE(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000880)={0x68, r3, 0x1, 0x0, 0x0, {}, [@WGDEVICE_A_IFINDEX={0x8, 0x1, r4}, @WGDEVICE_A_PEERS={0x4c, 0x8, 0x0, 0x1, [{0x48, 0x0, 0x0, 0x1, [@WGPEER_A_ENDPOINT6={0x20, 0x4, {0xa, 0x4e21, 0x0, @loopback, 0x300}}, @WGPEER_A_PUBLIC_KEY={0x24, 0x1, @a_g}]}]}]}, 0x68}}, 0x0) r5 = socket$inet6_udp(0xa, 0x2, 0x0) connect$pppl2tp(r1, &(0x7f0000000000)=@pppol2tpv3={0x18, 0x1, {0x3, r5, {0x2, 0x0, @multicast1}, 0x2}}, 0x2e) r6 = socket$inet6_sctp(0xa, 0x801, 0x84) sendmmsg$inet6(r6, &(0x7f0000006bc0)=[{{&(0x7f0000000000)={0xa, 0x4e23, 0x8080, @dev={0xfe, 0x80, '\x00', 0x29}, 0x4}, 0x1c, &(0x7f0000000040)=[{&(0x7f0000000180)="4cf7", 0x2}], 0x1}}], 0x1, 0x4040001) shutdown(r6, 0x1) getsockopt$bt_hci(r6, 0x84, 0x81, &(0x7f0000001280)=""/4107, &(0x7f00000000c0)=0x100b) r7 = socket$nl_generic(0x10, 0x3, 0x10) r8 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), 0xffffffffffffffff) r9 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$L2TP_CMD_SESSION_DELETE(r9, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000200)=ANY=[@ANYBLOB="341b0000", @ANYRES16=r8, @ANYBLOB="01002cbd70100400000005000000080009000200000006001c0000d0000008000b00000000000600010007000000"], 0x34}}, 0x24) r10 = syz_genetlink_get_family_id$tipc(&(0x7f0000000600), r7) sendmsg$TIPC_CMD_SHOW_LINK_STATS(r7, &(0x7f00000006c0)={&(0x7f00000005c0)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f0000000680)={&(0x7f0000000640)=ANY=[@ANYBLOB='0\x00\x00\x00', @ANYRES16=r10, @ANYBLOB="201626bd7000fddbdf2501000000000000000bb100000010001462726f6164636173742d6c696e6b0000"], 0x30}, 0x1, 0x0, 0x0, 0x810}, 0x40) getsockopt$inet6_buf(r5, 0x29, 0xcd, &(0x7f0000000240)=""/240, &(0x7f0000000340)=0xf0) r11 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000140), r9) sendmsg$L2TP_CMD_TUNNEL_GET(r9, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000080)={0x14, r11, 0x325, 0x70bd28, 0x0, {0x8}}, 0x14}, 0x1, 0x0, 0x0, 0x811}, 0x8000) 353.383962ms ago: executing program 2 (id=6634): r0 = socket$nl_route(0x10, 0x3, 0x0) (async) r1 = socket$inet6_udp(0xa, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000c80)={'lo\x00', 0x0}) sendmsg$nl_route_sched(r0, &(0x7f0000001200)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=@newqdisc={0x30, 0x24, 0x4ee4e6a52ff56541, 0x70bd28, 0x0, {0x0, 0x0, 0x0, r2, {}, {0xffff, 0xffff}, {0xd, 0x10}}, [@qdisc_kind_options=@q_fq={{0x7}, {0x4}}]}, 0x30}}, 0x0) (async) r3 = socket$nl_route(0x10, 0x3, 0x0) r4 = socket$inet6_udp(0xa, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000c80)={'lo\x00', 0x0}) sendmsg$nl_route_sched(r3, &(0x7f0000001200)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000000c0)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70bd28, 0x8, {0x0, 0x0, 0x0, r5, {}, {0xffff, 0xffff}, {0xd, 0xfff2}}, [@qdisc_kind_options=@q_fq={{0x7}, {0xc, 0x2, [@TCA_FQ_BUCKETS_LOG={0x8, 0x8, 0x1}]}}]}, 0x38}}, 0x0) (async) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket(0x10, 0x3, 0x0) getsockopt$sock_cred(r7, 0x1, 0x11, &(0x7f0000000180)={0x0, 0x0}, &(0x7f0000000bc0)=0xc) sendmsg$nl_route(r6, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000200)=@ipv4_newrule={0x28, 0x20, 0x301, 0x0, 0x0, {0x2, 0x0, 0x0, 0xf}, [@FRA_GENERIC_POLICY=@FRA_UID_RANGE={0xc, 0x14, {r8, 0xee01}}]}, 0x28}}, 0x0) r9 = bpf$PROG_LOAD(0x5, &(0x7f00000002c0)={0x10, 0xc, &(0x7f0000000100)=@raw=[@generic={0xc, 0x8, 0x1, 0x32, 0xde9}, @map_val={0x18, 0x5, 0x2, 0x0, 0x1, 0x0, 0x0, 0x0, 0x4}, @tail_call={{0x18, 0x2, 0x1, 0x0, 0x1}}, @exit, @exit, @cb_func={0x18, 0xb, 0x4, 0x0, 0xfffffffffffffffc}], &(0x7f0000000180)='GPL\x00', 0x5, 0x67, &(0x7f00000001c0)=""/103, 0x41000, 0x20, '\x00', r2, @sk_msg=0x7, 0xffffffffffffffff, 0x8, &(0x7f0000000240)={0x0, 0x5}, 0x8, 0x10, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, &(0x7f0000000280)=[0xffffffffffffffff, r1, 0xffffffffffffffff, 0xffffffffffffffff, 0x1], 0x0, 0x10, 0x730fdd08}, 0x94) sendmsg$nl_route(r3, &(0x7f0000000480)={&(0x7f0000000040), 0xc, &(0x7f0000000440)={&(0x7f0000000380)=@ipv4_delroute={0x84, 0x19, 0x800, 0x70bd2b, 0x25dfdbfe, {0x2, 0x20, 0x14, 0x3, 0xfc, 0x3, 0xfd, 0x1, 0x2500}, [@RTA_IIF={0x8, 0x3, r2}, @RTA_ENCAP={0x18, 0x16, 0x0, 0x1, @SEG6_LOCAL_NH6={0x14, 0x5, @private1}}, @RTA_DST={0x8, 0x1, @dev={0xac, 0x14, 0x14, 0x3c}}, @RTA_IP_PROTO={0x5, 0x1b, 0x11}, @RTA_GATEWAY={0x8, 0x5, @empty}, @RTA_PRIORITY={0x8, 0x6, 0x2}, @RTA_UID={0x8, 0x19, r8}, @RTA_DPORT={0x6, 0x1d, 0x4e23}, @RTA_ENCAP={0x10, 0x16, 0x0, 0x1, @LWT_BPF_OUT={0xc, 0x2, 0x0, 0x1, @LWT_BPF_PROG_FD={0x8, 0x1, r9}}}, @RTA_IIF={0x8}]}, 0x84}, 0x1, 0x0, 0x0, 0x4000000}, 0x24000080) 311.274734ms ago: executing program 3 (id=6635): r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r1, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000280)=ANY=[@ANYBLOB="14000000cef35ff600000000000000000000000000000070000000090a0104a1c7a61cba9c336ca80000000000010000070000e48909eacb0008000a40000000000900020073797a30000000000900010073797a3000000000080005400000000d2ce51138cdb991f947c7e7006c61737400000000180002800c00024000000000000000080800034000000110140000001000010000000000000000000000001f656bab2b55780b4a7908c83aadc583a1180ae23434c54daca575480da5c9ea8c0c8528be39548ce972851a5388e7c1f79c0d609da9d5eb7090fad4275fed2b440cafe374705b6f6e9f99c636bcfd1a57bcf7014eca159203251aef8a029dd0121c868db8c45dcaa0f4fcf9870511db1faa0ddfa6e3a48aed1dc55b0cc6d79f491ce9f6a65c03b901c61c4e748955381b29d234a4986f08e49fac45c795de627149290b72a2b4fc5fe938230f049cc5a62b8c0de69fdc4da0ef01f978b059118bc8996c821da53726bc7e53afc2"], 0xb8}}, 0x20050800) r2 = socket$nl_route(0x10, 0x3, 0x0) ioctl$F2FS_IOC_MOVE_RANGE(r0, 0xc020f509, &(0x7f0000001640)={r0, 0xfffffffffffffffc, 0x6, 0xd65}) r4 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r4, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000340)=@newlink={0x40, 0x10, 0x44b, 0x70bd26, 0x25dfdbfe, {0x7a}, [@IFLA_LINKINFO={0x20, 0x12, 0x0, 0x1, @bridge={{0xb}, {0x10, 0x2, 0x0, 0x1, [@IFLA_BR_MCAST_QUERY_INTVL={0xc, 0x21, 0x7fff}]}}}]}, 0x40}}, 0x0) ioctl$sock_ipv6_tunnel_SIOCGET6RD(r3, 0x89f8, &(0x7f0000001500)={'syztnl1\x00', &(0x7f0000001440)={'ip_vti0\x00', 0x0, 0xff37, 0x40, 0x4, 0xff6, {{0x26, 0x4, 0x3, 0x4, 0x98, 0x65, 0x0, 0x9, 0x2f, 0x0, @loopback, @broadcast, {[@lsrr={0x83, 0x1b, 0x60, [@rand_addr=0x64010101, @private=0xa010101, @private=0xa010102, @initdev={0xac, 0x1e, 0x1, 0x0}, @private=0xa010101, @initdev={0xac, 0x1e, 0x1, 0x0}]}, @timestamp_addr={0x44, 0x14, 0x48, 0x1, 0x8, [{@multicast1, 0x2}, {@initdev={0xac, 0x1e, 0x1, 0x0}, 0x200}]}, @timestamp_addr={0x44, 0x54, 0x37, 0x1, 0x3, [{@loopback, 0x80000001}, {@broadcast}, {@multicast2, 0x5}, {@local, 0x4362}, {@initdev={0xac, 0x1e, 0x0, 0x0}, 0xff}, {@local, 0x4}, {@initdev={0xac, 0x1e, 0x0, 0x0}, 0x2a}, {@dev={0xac, 0x14, 0x14, 0x44}}, {@multicast1, 0x3}, {@remote, 0xc}]}]}}}}}) sendmsg$nl_route(r0, &(0x7f00000015c0)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x40000000}, 0xc, &(0x7f0000001580)={&(0x7f0000001540)=@getstats={0x1c, 0x5e, 0x200, 0x70bd2d, 0x25dfdbfe, {0x0, 0x0, 0x0, r5, 0x5}, ["", ""]}, 0x1c}, 0x1, 0x0, 0x0, 0x40}, 0x0) setsockopt$inet_opts(r3, 0x0, 0x4, &(0x7f0000000440)="2c882d74e0c2bce349353a578258ae4e2baca74597240ef1b0b0970e9e4db01562e8a5a1f1781a9957102a24f27481c81b5c8014e22775be4d5d59fda61d6a02e7a1406db9bedb47f69499fd4f7cabdde1ba3033af135343d43b1a8ff1875f180d62285dfef4a78367c6aad580ebdd95f374001a8f6bad05cf784378611703dc30a45d4126551eb8b0a72c9191ca1bee05116304961ce664e8ba6f0053fef63850e221a08666b443fdb4debee6790ad23532198a2cf955ab01fbcfe243e2bc3acb8b4e972b0c7cf7ec3edfd712d568ef2d70b9fa5fbb820d8bf0e6e55265259f36910b87fd3911e4e8d3056c6f84cbbd90410ebab8fcf9d9cfb001170f231f8bc43ecf15aaffc40cec302efffbd5dc63a480101436d85fc943e7df0f42f2e9a822520b9570db31bed52421f27d0ded49dc99a4a3bb4834129ba5da3fb7f69a9bb8a65f1de4f544fc4b0522b7c8471167fc6fa75249d969e8269c773e873d9a7138ed8108d2f82f3d3a7b981d48f34d7c6781eb7e961a1e79b80c5e1ade648b8adabb09df7d01b4d710411af775c1003b0040a9fa07cd80aac5964609de32b91ce87ec1bd1522e47fd06bd7143779bb758b00a577d265828ceafdf4f7813a99898d68bcbbde6ab9df7206a6d40e60db3f7f8f10be0eb3d417c30184fd7828071018194c51b7bdb1022e29b7f41d4a3df5f9e61c50819e42cd1e05f2d95a881dc9697200debe84ca671a33875e2ccc55652b77e0d2a7d67f5e187045f2e5d54455ac7dbc43dffc6ab5818a387c5fb71bba097a392540ea18d96ec9895b4432d5f5aad1ceff848a35b0deec6851bacc72cac50466d2d66bb9b6f0f6750e20a6d13def29e3871505bcb21e60f3fa96358bc51edf32182ce1eae0eed189366bf909b0640c22dcf7b1b3758ae330518e5f2da6e75bcfec06f3bf01346a3fc115e0c3e8dd41ae63b9e214773e5e9496858a0f9bd719b271d16966b9bbeafac99b9792c8d8b45da46b7ae9ea5395d274e35fcf8dfd8e834b278b708957b57f07eb123d0be3ddd137142c6b84bfef9216c793160d217c1ee36d9d219abd9d290af314838ed71b86a2b635e24081fdc3d952655a53fb83fc2dd8132fcb63e916cb41e90620f0790e0bdf23cd6b9cf84758c84dc572c565781cff620af5a5676f8ae18556524b1501375e51cf01ac7435f9e00ff06636b88c86fb7e640461df047775d9573609941911d19a77a6e71ff570e3fd0a76be003e1a5f74cfff9afd6f36ed80deae172975a3f45e9fc0040fc406445842e64909b0de252cc34f1b6523e74729fbe54c4678b3e14bf00a07562207082647bf578593f73c22ca3a13b69c1bd31ffc48885821846a00a7a034530843bde913f94ac433f3be89f4a1f6b1afb0d96ee9aa49076d014cdb6381ca72adf5c8eb4e3e4b8dd7d80495d7311b05f8714881afff8be33a3305521df20594b16184ae890f8e7d92590839c2cc3d76f54513ebeee8bcb73edb9892f3a1d209bd252c1c2886b001381dbfb33b916c21f5c080cf5edd8b12b72fd9b064381e5d5c8dd51f7a5038676682d6a11eee069f4d9081fed95ad937964a0ac5e67e38e93d3044ca3f82ade967c1e751f890162d11db462852b6f37a431e16ca2a5089d279cfee083ae728514fb58e0d370e898e6b08391a4eecb8170835695bdca13c83b7ddb4b9f4c1e9b3184f1f9b02e1017c6543aed96436e93b0da8fdf9d4e99b07b033515fe41b28bb714e6654e09571bd8a733cc69978066da12aa472fe7f8527023d100615d10518f374f40cdd97eb0a33c2d58cd32b7ff9f190bb180c168faf9c7dfc581c87183d540b9d6b0bd8dc005e4df9167762c4ec21fdd3f12415610febd8a5e378ec763f036567081b4b565211a83769280c6481394d4a2a37fa80ff37bd5397dc805aa9f525ccfb4a21d548674fa158ae526bbf0a1cb8b8e1a0ecca78a0f5db51d4ddd6646f5e399149684eb47e194beb30fcbcf446e5b5bd95885e86d9290b9b181c6b96428021bfcfb8f95d5b55455a86fd2989ad065d0ee483bf874b18298084a5449d03b3ce603e8140fb2cb70ceffd5603c4eae99641e900f7ed4840b850223628556d1dcdf86fe60b3d9db42f0dfc449d5f66ac0514e5a536c4cecc7fade381b74bc75668c119e4a80f4a670ceb62177eccd4bfe517e5ee0d123ce81c4c2bb113f12eb2865320cc2cca6f9cf9a0a5df3ac2be0c440b402ce4431b360d10c126f7dfe086c8931bc710c0c5468f8ec1f3e3415041ca89e6bd0447da9485a774993b5a3ee2225c52007970803f0397686395ddfa77eaed50b687aaebfe2b673cd0fd1812567a851f17e1108c8be4c40d8c1cb1fc0151db64522674e09b41d29b3235d9b4fa20462ab77e1e07a988e9262ad39a6ff3e559de2c1487327acf9593ee63ac5f4e254c1583d14f0849f1835abc3b8ea8c9994d9828bf703ff7f78f9ce6bec4ac3be227571711d23371926f449c7a476c37471d824160db2ba6ee17364e9352ee73e4149e74103efde81a6b65fa89ecb522330afd9d9b86c4035bcdd51530cdec6fc1c618615350c0154d523666bebcee27876fee277c601ccf8114c86151882813edda7dfeb65880e1d085162ec721845285471942ca4ed0cb5c6094dae657365c1f6275f0f1c61c6668b1276d8bcc1557ee38ec029cf66cd95c8bafa6b8a17b6683c3c95014d4a302758d2b28f2faec047b90e62f03b9b56f04d13b4d8f8119051c9c32b664ceab4ac34d361c6b8224df321bc729ee3b729e860843d01ff8676b3e072f269463288a29220052f880641730c638dffb7145e49bc5603020abece15be2b5e7dd3e8a8be2278b58db04a962f878afb69debfc3f0caa8baf32bdc78df617d67c9fbb30700174155fd741594b82c8975dfc5c5726699f10a9988d9f8382718b3d98c83dd0f25824d8da1ab782b1aac60f4f9c9079666f895ebb2bdabc20f755fa6519144cdc7e5865c0b7352e28d380b3c28424ff8eb306cd7a8e77ec149f2bc15214b5ddb7be7813a7bb171b73045083022daf38b293623a5fb97f9baa0e0418cc0c93657a016ae96876adbf71c4efae942f0bb01237b42208d281b4989657f7efc80045fec6c41e8edfc3e48e025a36fe3e6331f237e77177aa64463b851c40996f7b7636ee6cd8ae1a7052588fbeb6d1806154f265f2fd6a0bd7df9c4fde19ef87fd29a9a9517ce21dad3ebdbf35db5bbddacc5d7d59c1328fffcaa9222f2dd4a494842833d45f4aa2b0ade7d444ea03d13600059462780c36907f98974b69ac04a648aac35b4c38405739d01a994baed8bf345f8f3fe29c87559aaa08c2d8e2830e23e8aa0c03a5286221d9a338b6d591bf026312ccecb8ae2a1942c64891f2c06d3e6af4ad90ba2fb0aaf6113cc747161711aa8cd4a8e0932bd8e18c65a4d3c243fc8be8f920f64ee1070a99368179e9db15794263bc72918a9b9aefc2a5061411db3529657b438d2406fcb1d82245c0935ca592a1ab76c43be24603f34bfc1aa4cbe219a5733e8c01537e2787b8370648d701e59524792980f41522e0d28b7482d7e11d8ee4f8570f5270837ee1d3a5f701fae4f6e1fefb22c9dbef7699aa06089d1a939ac544566e31e5704c1e6947431b8c6b04f457b20defb516fbd84e2c5b5f2206e65bf8714ec045d07646daf2e9410e0af47cf82422b31b8602768a3863a25bebe81ae746e94e1259be5fc3dec21bcd745a3fc06db65939af1fd8710502c0777972a32d11faace1da2444ed49e7d6dd7b9d461d59b3331c824fd58f84e60a69cf65afc29816dc83a89bb540643ca96c1447b54cd00a01fe60949b9b8d35b893d2a82473a7bfb26f1aa2852a2a13a08e3cf7e009bb7938a627732b36fb9d4b1b1ea548678ee0afe69786f679ac53575f4553052cbd28ac61834054c5cb6cc2d96ccffd9b27e9f2b804d074029625940e954097b77a0ba8e8c77a6ea9d3eaf5c8bf0385c0c1dfb1cc352674d80e37fad50105116fa99daab601b1e68de5be7909f944b30ec804667e73cccc58b0804ec515035166d051eb1023ea66ced71b93eb6087d699a563df7351625d346405c120b5ac1aaae6109270418793045862ea4ea2d3a4e2711a9d2e7d9a23a9a8060855daf17fdabd9093432d43d1489491919a39c8d5867593844eb5cefeae4eb9459aa8b102361833c0e545807d384f8825547818ecdeaef2e4a43716692c5b9099cb5fbf60d29ec00278b7ab944697697e943cccb10fba65704ae3efba414e0c48d8efc686dc9266c13b4c3b5ab8bca9df4058654a530dc432459705b93da1e0e6053c28418f25c384e17baad68914725bbe74118424dc81075ac1eac02e3d309088696a7a4afca426b4c081238f7cd91a137b75439e71fc1cd13ebae9ecd6bdbf5f9e1ebedc8ebc1a885e465841db87626b54fafca87622c16e8f04bd0bc6d91677e14185d2bc6f3ecfe9eb0d643d021f54ba7bf1711918f603bc5ff1db4773ef5553962b57f060cfb32956e8500508290e3c36eaf0287ed663ba731ec332d5a09c8eb6c0faa828ae0b502c583712f1153182c399481f66451aa4a5445bfa6a5699aeb8d95a94082b94c40f886f2e1c08123e03ec72cd4ba1dd9dfb99de2d6e47fa3282ea0bc3ed81f39ab87e3f275976173d9e891ff26fea6ad7017cbff56615f4880eb21a5d0fc293d933a047725973b8ae609ce84fd7329e8300d5019db50097b5541b3f9e15272fcdec20bccb884bae2eb2d2082aac8bbd3bb6facfe3d4395f6780a200c61d5e9f11927fb45999962c2e9cb9e5c680741f58d348ee667096f8acebb176b41e0a88e8fdae91f5bba1d67a670247b26d3b73f55ec31b9c37d72059cceb9a0ec3cff8b5a3edd699c17de89a06a5f45c56df4380f6ae98d053cd3e128d9cba41138ff94e2042f5dfc5c00023654f665d889b006dad61bc3cd311cbde9d6e7f59b2d787a138a99cbee4b8f86d529a4a753136a92ee7b831753771e304bdddaa02618ece206e442d70bf0880c208095f9e473b37c19867cdf96df31fc940d4a152b2542feb553acb471aba8e0c75ec610d42b3f9a94360fbd70c25d3770f333aa95150ea4a18466d6a1b4a3d636664d5a50e5f0a1e882d6fc813603b74b48e646eece8d8f8966fb778c21591c5b2d4b0c5f962f6a5cbcf20943f9fd355702cdfa94a61efc92f5d5d61c12e0b09300f8df7bc78cb73a92bebc286440b41f4b1ffecd922fbf518ee40f5b64b53969c6b5c972b950db29e8fc49359201c0658e333b076de3e89d837892033bf22380e3613dd02821efe0c2b08cff63da241a8380cd59c5785eb7b129fbe5b27cc46cf0f87974fb594e79313f110ad3a0c8f99aa8aab45e45fff1637bd399e45ad19eeae0629d9c548423f317703105b97368303b1884c528c6419cf79be0e9f75e36288f40798cdf9d52fb134359db46846e5cf806939d6770832b38e17e01f63d7648101854b2eeee5e4f774dbb2167dbf4e7127c32601f9c39dc755c83f2b9edafed480d35856bfda7555641d8eb69da077cc31bf878c3c294512427a08f84d34f1597bb7dce9e5f09f31fa136159e35f2470ada21fec46b79465f7740e3472bd13fcdbab77965db1f0e7d1142e16b3d3389d3279f5caa69f3252e85d2a864fb8c03ea9b425953712d2c79ef9b62b6b0de985ea32e78b6b1bac9d21c470ccb70944f0eb7910104de3ae97aed6967c8199316a1e4b67486a37d46aadb28d95d413348d06e18b886555aeaf081107dd573ab6a9f01ab8d213698534113cc4107efd86", 0x1000) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000300)={'bridge0\x00', 0x0}) sendmsg$nl_route(r2, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000080)=@RTM_NEWMDB={0x38, 0x54, 0x1, 0x70bd2b, 0x2, {0x7, r6}, [@MDBA_SET_ENTRY={0x20, 0x1, {r6, 0x1, 0x2, 0x0, {@ip4=@loopback}}}]}, 0x38}, 0x1, 0x0, 0x0, 0x22004804}, 0x40080c0) bpf$MAP_LOOKUP_ELEM(0x1, &(0x7f0000000100)={0x1, &(0x7f0000000000)="7ca1e5a630e80c607c4bad7ad8d4683b18ba832a06f239", &(0x7f0000000040)=""/139}, 0x20) sendmsg$nl_route(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000400)=ANY=[@ANYBLOB="340000001100010027bd700000dcdf2500000000", @ANYRES16=r0, @ANYRES8=0x0], 0x34}}, 0x24008004) setsockopt$inet_mreqn(r3, 0x0, 0x20, &(0x7f0000001600)={@broadcast, @empty}, 0xc) socket$nl_route(0x10, 0x3, 0x0) (async) socket$nl_netfilter(0x10, 0x3, 0xc) (async) sendmsg$NFT_BATCH(r1, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000280)=ANY=[@ANYBLOB="14000000cef35ff600000000000000000000000000000070000000090a0104a1c7a61cba9c336ca80000000000010000070000e48909eacb0008000a40000000000900020073797a30000000000900010073797a3000000000080005400000000d2ce51138cdb991f947c7e7006c61737400000000180002800c00024000000000000000080800034000000110140000001000010000000000000000000000001f656bab2b55780b4a7908c83aadc583a1180ae23434c54daca575480da5c9ea8c0c8528be39548ce972851a5388e7c1f79c0d609da9d5eb7090fad4275fed2b440cafe374705b6f6e9f99c636bcfd1a57bcf7014eca159203251aef8a029dd0121c868db8c45dcaa0f4fcf9870511db1faa0ddfa6e3a48aed1dc55b0cc6d79f491ce9f6a65c03b901c61c4e748955381b29d234a4986f08e49fac45c795de627149290b72a2b4fc5fe938230f049cc5a62b8c0de69fdc4da0ef01f978b059118bc8996c821da53726bc7e53afc2"], 0xb8}}, 0x20050800) (async) socket$nl_route(0x10, 0x3, 0x0) (async) ioctl$F2FS_IOC_MOVE_RANGE(r0, 0xc020f509, &(0x7f0000001640)={r0, 0xfffffffffffffffc, 0x6, 0xd65}) (async) socket$nl_route(0x10, 0x3, 0x0) (async) sendmsg$nl_route(r4, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000340)=@newlink={0x40, 0x10, 0x44b, 0x70bd26, 0x25dfdbfe, {0x7a}, [@IFLA_LINKINFO={0x20, 0x12, 0x0, 0x1, @bridge={{0xb}, {0x10, 0x2, 0x0, 0x1, [@IFLA_BR_MCAST_QUERY_INTVL={0xc, 0x21, 0x7fff}]}}}]}, 0x40}}, 0x0) (async) ioctl$sock_ipv6_tunnel_SIOCGET6RD(r3, 0x89f8, &(0x7f0000001500)={'syztnl1\x00', &(0x7f0000001440)={'ip_vti0\x00', 0x0, 0xff37, 0x40, 0x4, 0xff6, {{0x26, 0x4, 0x3, 0x4, 0x98, 0x65, 0x0, 0x9, 0x2f, 0x0, @loopback, @broadcast, {[@lsrr={0x83, 0x1b, 0x60, [@rand_addr=0x64010101, @private=0xa010101, @private=0xa010102, @initdev={0xac, 0x1e, 0x1, 0x0}, @private=0xa010101, @initdev={0xac, 0x1e, 0x1, 0x0}]}, @timestamp_addr={0x44, 0x14, 0x48, 0x1, 0x8, [{@multicast1, 0x2}, {@initdev={0xac, 0x1e, 0x1, 0x0}, 0x200}]}, @timestamp_addr={0x44, 0x54, 0x37, 0x1, 0x3, [{@loopback, 0x80000001}, {@broadcast}, {@multicast2, 0x5}, {@local, 0x4362}, {@initdev={0xac, 0x1e, 0x0, 0x0}, 0xff}, {@local, 0x4}, {@initdev={0xac, 0x1e, 0x0, 0x0}, 0x2a}, {@dev={0xac, 0x14, 0x14, 0x44}}, {@multicast1, 0x3}, {@remote, 0xc}]}]}}}}}) (async) sendmsg$nl_route(r0, &(0x7f00000015c0)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x40000000}, 0xc, &(0x7f0000001580)={&(0x7f0000001540)=@getstats={0x1c, 0x5e, 0x200, 0x70bd2d, 0x25dfdbfe, {0x0, 0x0, 0x0, r5, 0x5}, ["", ""]}, 0x1c}, 0x1, 0x0, 0x0, 0x40}, 0x0) (async) setsockopt$inet_opts(r3, 0x0, 0x4, &(0x7f0000000440)="2c882d74e0c2bce349353a578258ae4e2baca74597240ef1b0b0970e9e4db01562e8a5a1f1781a9957102a24f27481c81b5c8014e22775be4d5d59fda61d6a02e7a1406db9bedb47f69499fd4f7cabdde1ba3033af135343d43b1a8ff1875f180d62285dfef4a78367c6aad580ebdd95f374001a8f6bad05cf784378611703dc30a45d4126551eb8b0a72c9191ca1bee05116304961ce664e8ba6f0053fef63850e221a08666b443fdb4debee6790ad23532198a2cf955ab01fbcfe243e2bc3acb8b4e972b0c7cf7ec3edfd712d568ef2d70b9fa5fbb820d8bf0e6e55265259f36910b87fd3911e4e8d3056c6f84cbbd90410ebab8fcf9d9cfb001170f231f8bc43ecf15aaffc40cec302efffbd5dc63a480101436d85fc943e7df0f42f2e9a822520b9570db31bed52421f27d0ded49dc99a4a3bb4834129ba5da3fb7f69a9bb8a65f1de4f544fc4b0522b7c8471167fc6fa75249d969e8269c773e873d9a7138ed8108d2f82f3d3a7b981d48f34d7c6781eb7e961a1e79b80c5e1ade648b8adabb09df7d01b4d710411af775c1003b0040a9fa07cd80aac5964609de32b91ce87ec1bd1522e47fd06bd7143779bb758b00a577d265828ceafdf4f7813a99898d68bcbbde6ab9df7206a6d40e60db3f7f8f10be0eb3d417c30184fd7828071018194c51b7bdb1022e29b7f41d4a3df5f9e61c50819e42cd1e05f2d95a881dc9697200debe84ca671a33875e2ccc55652b77e0d2a7d67f5e187045f2e5d54455ac7dbc43dffc6ab5818a387c5fb71bba097a392540ea18d96ec9895b4432d5f5aad1ceff848a35b0deec6851bacc72cac50466d2d66bb9b6f0f6750e20a6d13def29e3871505bcb21e60f3fa96358bc51edf32182ce1eae0eed189366bf909b0640c22dcf7b1b3758ae330518e5f2da6e75bcfec06f3bf01346a3fc115e0c3e8dd41ae63b9e214773e5e9496858a0f9bd719b271d16966b9bbeafac99b9792c8d8b45da46b7ae9ea5395d274e35fcf8dfd8e834b278b708957b57f07eb123d0be3ddd137142c6b84bfef9216c793160d217c1ee36d9d219abd9d290af314838ed71b86a2b635e24081fdc3d952655a53fb83fc2dd8132fcb63e916cb41e90620f0790e0bdf23cd6b9cf84758c84dc572c565781cff620af5a5676f8ae18556524b1501375e51cf01ac7435f9e00ff06636b88c86fb7e640461df047775d9573609941911d19a77a6e71ff570e3fd0a76be003e1a5f74cfff9afd6f36ed80deae172975a3f45e9fc0040fc406445842e64909b0de252cc34f1b6523e74729fbe54c4678b3e14bf00a07562207082647bf578593f73c22ca3a13b69c1bd31ffc48885821846a00a7a034530843bde913f94ac433f3be89f4a1f6b1afb0d96ee9aa49076d014cdb6381ca72adf5c8eb4e3e4b8dd7d80495d7311b05f8714881afff8be33a3305521df20594b16184ae890f8e7d92590839c2cc3d76f54513ebeee8bcb73edb9892f3a1d209bd252c1c2886b001381dbfb33b916c21f5c080cf5edd8b12b72fd9b064381e5d5c8dd51f7a5038676682d6a11eee069f4d9081fed95ad937964a0ac5e67e38e93d3044ca3f82ade967c1e751f890162d11db462852b6f37a431e16ca2a5089d279cfee083ae728514fb58e0d370e898e6b08391a4eecb8170835695bdca13c83b7ddb4b9f4c1e9b3184f1f9b02e1017c6543aed96436e93b0da8fdf9d4e99b07b033515fe41b28bb714e6654e09571bd8a733cc69978066da12aa472fe7f8527023d100615d10518f374f40cdd97eb0a33c2d58cd32b7ff9f190bb180c168faf9c7dfc581c87183d540b9d6b0bd8dc005e4df9167762c4ec21fdd3f12415610febd8a5e378ec763f036567081b4b565211a83769280c6481394d4a2a37fa80ff37bd5397dc805aa9f525ccfb4a21d548674fa158ae526bbf0a1cb8b8e1a0ecca78a0f5db51d4ddd6646f5e399149684eb47e194beb30fcbcf446e5b5bd95885e86d9290b9b181c6b96428021bfcfb8f95d5b55455a86fd2989ad065d0ee483bf874b18298084a5449d03b3ce603e8140fb2cb70ceffd5603c4eae99641e900f7ed4840b850223628556d1dcdf86fe60b3d9db42f0dfc449d5f66ac0514e5a536c4cecc7fade381b74bc75668c119e4a80f4a670ceb62177eccd4bfe517e5ee0d123ce81c4c2bb113f12eb2865320cc2cca6f9cf9a0a5df3ac2be0c440b402ce4431b360d10c126f7dfe086c8931bc710c0c5468f8ec1f3e3415041ca89e6bd0447da9485a774993b5a3ee2225c52007970803f0397686395ddfa77eaed50b687aaebfe2b673cd0fd1812567a851f17e1108c8be4c40d8c1cb1fc0151db64522674e09b41d29b3235d9b4fa20462ab77e1e07a988e9262ad39a6ff3e559de2c1487327acf9593ee63ac5f4e254c1583d14f0849f1835abc3b8ea8c9994d9828bf703ff7f78f9ce6bec4ac3be227571711d23371926f449c7a476c37471d824160db2ba6ee17364e9352ee73e4149e74103efde81a6b65fa89ecb522330afd9d9b86c4035bcdd51530cdec6fc1c618615350c0154d523666bebcee27876fee277c601ccf8114c86151882813edda7dfeb65880e1d085162ec721845285471942ca4ed0cb5c6094dae657365c1f6275f0f1c61c6668b1276d8bcc1557ee38ec029cf66cd95c8bafa6b8a17b6683c3c95014d4a302758d2b28f2faec047b90e62f03b9b56f04d13b4d8f8119051c9c32b664ceab4ac34d361c6b8224df321bc729ee3b729e860843d01ff8676b3e072f269463288a29220052f880641730c638dffb7145e49bc5603020abece15be2b5e7dd3e8a8be2278b58db04a962f878afb69debfc3f0caa8baf32bdc78df617d67c9fbb30700174155fd741594b82c8975dfc5c5726699f10a9988d9f8382718b3d98c83dd0f25824d8da1ab782b1aac60f4f9c9079666f895ebb2bdabc20f755fa6519144cdc7e5865c0b7352e28d380b3c28424ff8eb306cd7a8e77ec149f2bc15214b5ddb7be7813a7bb171b73045083022daf38b293623a5fb97f9baa0e0418cc0c93657a016ae96876adbf71c4efae942f0bb01237b42208d281b4989657f7efc80045fec6c41e8edfc3e48e025a36fe3e6331f237e77177aa64463b851c40996f7b7636ee6cd8ae1a7052588fbeb6d1806154f265f2fd6a0bd7df9c4fde19ef87fd29a9a9517ce21dad3ebdbf35db5bbddacc5d7d59c1328fffcaa9222f2dd4a494842833d45f4aa2b0ade7d444ea03d13600059462780c36907f98974b69ac04a648aac35b4c38405739d01a994baed8bf345f8f3fe29c87559aaa08c2d8e2830e23e8aa0c03a5286221d9a338b6d591bf026312ccecb8ae2a1942c64891f2c06d3e6af4ad90ba2fb0aaf6113cc747161711aa8cd4a8e0932bd8e18c65a4d3c243fc8be8f920f64ee1070a99368179e9db15794263bc72918a9b9aefc2a5061411db3529657b438d2406fcb1d82245c0935ca592a1ab76c43be24603f34bfc1aa4cbe219a5733e8c01537e2787b8370648d701e59524792980f41522e0d28b7482d7e11d8ee4f8570f5270837ee1d3a5f701fae4f6e1fefb22c9dbef7699aa06089d1a939ac544566e31e5704c1e6947431b8c6b04f457b20defb516fbd84e2c5b5f2206e65bf8714ec045d07646daf2e9410e0af47cf82422b31b8602768a3863a25bebe81ae746e94e1259be5fc3dec21bcd745a3fc06db65939af1fd8710502c0777972a32d11faace1da2444ed49e7d6dd7b9d461d59b3331c824fd58f84e60a69cf65afc29816dc83a89bb540643ca96c1447b54cd00a01fe60949b9b8d35b893d2a82473a7bfb26f1aa2852a2a13a08e3cf7e009bb7938a627732b36fb9d4b1b1ea548678ee0afe69786f679ac53575f4553052cbd28ac61834054c5cb6cc2d96ccffd9b27e9f2b804d074029625940e954097b77a0ba8e8c77a6ea9d3eaf5c8bf0385c0c1dfb1cc352674d80e37fad50105116fa99daab601b1e68de5be7909f944b30ec804667e73cccc58b0804ec515035166d051eb1023ea66ced71b93eb6087d699a563df7351625d346405c120b5ac1aaae6109270418793045862ea4ea2d3a4e2711a9d2e7d9a23a9a8060855daf17fdabd9093432d43d1489491919a39c8d5867593844eb5cefeae4eb9459aa8b102361833c0e545807d384f8825547818ecdeaef2e4a43716692c5b9099cb5fbf60d29ec00278b7ab944697697e943cccb10fba65704ae3efba414e0c48d8efc686dc9266c13b4c3b5ab8bca9df4058654a530dc432459705b93da1e0e6053c28418f25c384e17baad68914725bbe74118424dc81075ac1eac02e3d309088696a7a4afca426b4c081238f7cd91a137b75439e71fc1cd13ebae9ecd6bdbf5f9e1ebedc8ebc1a885e465841db87626b54fafca87622c16e8f04bd0bc6d91677e14185d2bc6f3ecfe9eb0d643d021f54ba7bf1711918f603bc5ff1db4773ef5553962b57f060cfb32956e8500508290e3c36eaf0287ed663ba731ec332d5a09c8eb6c0faa828ae0b502c583712f1153182c399481f66451aa4a5445bfa6a5699aeb8d95a94082b94c40f886f2e1c08123e03ec72cd4ba1dd9dfb99de2d6e47fa3282ea0bc3ed81f39ab87e3f275976173d9e891ff26fea6ad7017cbff56615f4880eb21a5d0fc293d933a047725973b8ae609ce84fd7329e8300d5019db50097b5541b3f9e15272fcdec20bccb884bae2eb2d2082aac8bbd3bb6facfe3d4395f6780a200c61d5e9f11927fb45999962c2e9cb9e5c680741f58d348ee667096f8acebb176b41e0a88e8fdae91f5bba1d67a670247b26d3b73f55ec31b9c37d72059cceb9a0ec3cff8b5a3edd699c17de89a06a5f45c56df4380f6ae98d053cd3e128d9cba41138ff94e2042f5dfc5c00023654f665d889b006dad61bc3cd311cbde9d6e7f59b2d787a138a99cbee4b8f86d529a4a753136a92ee7b831753771e304bdddaa02618ece206e442d70bf0880c208095f9e473b37c19867cdf96df31fc940d4a152b2542feb553acb471aba8e0c75ec610d42b3f9a94360fbd70c25d3770f333aa95150ea4a18466d6a1b4a3d636664d5a50e5f0a1e882d6fc813603b74b48e646eece8d8f8966fb778c21591c5b2d4b0c5f962f6a5cbcf20943f9fd355702cdfa94a61efc92f5d5d61c12e0b09300f8df7bc78cb73a92bebc286440b41f4b1ffecd922fbf518ee40f5b64b53969c6b5c972b950db29e8fc49359201c0658e333b076de3e89d837892033bf22380e3613dd02821efe0c2b08cff63da241a8380cd59c5785eb7b129fbe5b27cc46cf0f87974fb594e79313f110ad3a0c8f99aa8aab45e45fff1637bd399e45ad19eeae0629d9c548423f317703105b97368303b1884c528c6419cf79be0e9f75e36288f40798cdf9d52fb134359db46846e5cf806939d6770832b38e17e01f63d7648101854b2eeee5e4f774dbb2167dbf4e7127c32601f9c39dc755c83f2b9edafed480d35856bfda7555641d8eb69da077cc31bf878c3c294512427a08f84d34f1597bb7dce9e5f09f31fa136159e35f2470ada21fec46b79465f7740e3472bd13fcdbab77965db1f0e7d1142e16b3d3389d3279f5caa69f3252e85d2a864fb8c03ea9b425953712d2c79ef9b62b6b0de985ea32e78b6b1bac9d21c470ccb70944f0eb7910104de3ae97aed6967c8199316a1e4b67486a37d46aadb28d95d413348d06e18b886555aeaf081107dd573ab6a9f01ab8d213698534113cc4107efd86", 0x1000) (async) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000300)={'bridge0\x00'}) (async) sendmsg$nl_route(r2, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000080)=@RTM_NEWMDB={0x38, 0x54, 0x1, 0x70bd2b, 0x2, {0x7, r6}, [@MDBA_SET_ENTRY={0x20, 0x1, {r6, 0x1, 0x2, 0x0, {@ip4=@loopback}}}]}, 0x38}, 0x1, 0x0, 0x0, 0x22004804}, 0x40080c0) (async) bpf$MAP_LOOKUP_ELEM(0x1, &(0x7f0000000100)={0x1, &(0x7f0000000000)="7ca1e5a630e80c607c4bad7ad8d4683b18ba832a06f239", &(0x7f0000000040)=""/139}, 0x20) (async) sendmsg$nl_route(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000400)=ANY=[@ANYBLOB="340000001100010027bd700000dcdf2500000000", @ANYRES16=r0, @ANYRES8=0x0], 0x34}}, 0x24008004) (async) setsockopt$inet_mreqn(r3, 0x0, 0x20, &(0x7f0000001600)={@broadcast, @empty}, 0xc) (async) 250.143471ms ago: executing program 0 (id=6636): r0 = socket$key(0xf, 0x3, 0x2) r1 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r1, &(0x7f00000014c0)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000000c0)={0x2, 0x1, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, [@sadb_address={0x5, 0x6, 0x0, 0x0, 0x0, @in6={0xa, 0x0, 0x0, @private2}}]}, 0x38}}, 0x0) r2 = socket(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000080)={'ip6tnl0\x00', 0x0}) sendmsg$nl_route_sched(r2, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000000)=@newqdisc={0x3c, 0x24, 0x3fe3aa0262d8c583, 0x70bd2c, 0x0, {0x0, 0x0, 0x0, r3, {0x0, 0xfff3}, {0xffff, 0xffff}, {0x6}}, [@qdisc_kind_options=@q_fq_pie={{0xb}, {0xc, 0x8002, [@TCA_FQ_PIE_ECN_PROB={0x8, 0x9, 0x2a}]}}]}, 0x3c}, 0x1, 0x0, 0x0, 0x2}, 0x2000400c) sendmsg$key(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000100)={0x2, 0xa, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, [@sadb_x_filter={0x5, 0x1a, @in6=@mcast2, @in6=@private0={0xfc, 0x0, '\x00', 0x1}, 0x0, 0x0, 0x12}]}, 0x38}}, 0x0) r4 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r4, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000140)=ANY=[@ANYBLOB="1c000000120021030000000000bc61682a00968008001d001d"], 0x1c}], 0x1}, 0x0) bpf$PROG_LOAD_XDP(0x5, &(0x7f00000001c0)={0x12, 0x4, &(0x7f0000000000)=@framed={{}, [@call={0x85, 0x0, 0x0, 0x39}]}, &(0x7f0000000480)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x34}, 0x90) recvmmsg(r4, &(0x7f00000077c0), 0x8000000000001ac, 0x2140, 0x0) 249.397598ms ago: executing program 1 (id=6637): sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000480)=ANY=[], 0x18}}, 0x20004000) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000100)=@gettaction={0x50, 0x32, 0x20, 0x70bd25, 0x25dfdbf6, {}, [@action_gd=@TCA_ACT_TAB={0x1c, 0x1, [{0xc, 0x1a, 0x0, 0x0, @TCA_ACT_KIND={0x8, 0x1, 'bpf\x00'}}, {0xc, 0x1d, 0x0, 0x0, @TCA_ACT_KIND={0x8, 0x1, 'ife\x00'}}]}, @action_gd=@TCA_ACT_TAB={0x20, 0x1, [{0x10, 0xc, 0x0, 0x0, @TCA_ACT_KIND={0xb, 0x1, 'mirred\x00'}}, {0xc, 0x16, 0x0, 0x0, @TCA_ACT_INDEX={0x8, 0x3, 0x40}}]}]}, 0x50}, 0x1, 0x0, 0x0, 0x40000}, 0x4048840) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000100)=ANY=[@ANYBLOB="4800000010000d0428bd7000fcdbff2500008000", @ANYRES32=0x0, @ANYBLOB="1000000000000000280012800b0001006272696467650000180002"], 0x48}, 0x1, 0x0, 0x0, 0x10}, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000100)=ANY=[@ANYBLOB="500000001000010425bbe5ad600027842cf52300", @ANYRES32=0x0, @ANYBLOB="0300000000000000280012800a00010076786c616e00"], 0x50}, 0x1, 0x0, 0x0, 0x13d33d22cca65c15}, 0x4008840) r0 = socket$netlink(0x10, 0x3, 0x0) socket$netlink(0x10, 0x3, 0x4) sendmmsg(r0, &(0x7f00000002c0), 0x40000000000009f, 0x0) 203.264282ms ago: executing program 4 (id=6638): bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000180)=@bpf_lsm={0xd, 0x5, &(0x7f0000000040)=@framed={{0x76, 0xa, 0x0, 0x0, 0x0, 0x61, 0x11, 0x50}, [@initr0]}, &(0x7f0000000080)='syzkaller\x00', 0x0, 0xffea}, 0x90) 107.105305ms ago: executing program 2 (id=6639): r0 = socket(0x1e, 0x4, 0x0) setsockopt$packet_tx_ring(r0, 0x10f, 0x87, &(0x7f0000000140)=@req3={0x7813, 0x3, 0x2, 0x81, 0x1fd, 0x1, 0x1}, 0x1c) r1 = socket(0x1e, 0x4, 0x0) setsockopt$packet_tx_ring(r1, 0x10f, 0x87, &(0x7f0000000140)=@req3={0x7813, 0x3, 0x2, 0x81, 0x1fd, 0x1, 0x1}, 0x1c) recvmsg$unix(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000080)=[{&(0x7f0000000180)=""/254, 0xfe}], 0x1}, 0x20) sendmmsg(r1, &(0x7f00000030c0)=[{{0x0, 0xa9cc7003, &(0x7f0000000400)=[{&(0x7f00000000c0)="ee", 0x101d0}], 0x1}}], 0x400000000000181, 0x9200000000000000) recvmsg$unix(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000080)=[{&(0x7f0000000180)=""/254, 0xfe}], 0x1}, 0x20) sendmmsg(r0, &(0x7f00000030c0)=[{{0x0, 0xa, 0x0}}], 0x4000000000001ef, 0x8004) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x3, 0x4, &(0x7f0000000280)=ANY=[@ANYBLOB="180000000000000000000000c93152ab6cd4655f65a1d3ebe41859000000008500000055000000950000000000000050772f602de793eb22441200b70b9ea60e73fab2ec945df56583f98dfa72c311f666814b839f9ac963dd44753a92b0bed5b4699d8a53deabcf4ae333c0c8d285a8418340fc2b3debf0116fa1a4972c3add1eaa0418ef"], &(0x7f0000000040)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sched_cls, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) syz_emit_ethernet(0x6a, &(0x7f0000000080)={@local, @dev, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x1b, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @address_request}}}}, 0x0) sendmsg$key(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000000)={0x0, 0x10}}, 0x40010) sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000005c0)=ANY=[@ANYBLOB="c40000001900674c0000000004000000fc000000000000000000000000000002e000000200000000000000000000000000000000000000000200200000000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="0100000000000000000000000000000000000000000000000000000000000000000000400000000000008000000000000000000000000000fcffffffffffffff"], 0xc4}, 0x1, 0x0, 0x0, 0x40000}, 0x4c050) sendmsg$key(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000640)=ANY=[@ANYBLOB="020e00"], 0x80}}, 0x4814) r2 = socket$key(0xf, 0x3, 0x2) sendmmsg(r2, &(0x7f0000000180), 0x229ffa1c4ce5369, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000140)={0x1e, 0x4, &(0x7f0000000900)=ANY=[@ANYBLOB="1800000000000000000000000000000079122800000000009500"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x24, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0xfffffffffffffff7}, 0x94) 2.075536ms ago: executing program 3 (id=6640): r0 = socket$pppl2tp(0x18, 0x1, 0x1) r1 = socket$inet6_udp(0xa, 0x2, 0x0) connect$pppl2tp(r0, &(0x7f0000000000)=@pppol2tpv3={0x18, 0x1, {0x3, r1, {0x2, 0x4e21, @initdev={0xac, 0x1e, 0x0, 0x0}}, 0x2}}, 0x2e) (async) connect$pppl2tp(r0, &(0x7f0000000000)=@pppol2tpv3={0x18, 0x1, {0x3, r1, {0x2, 0x4e21, @initdev={0xac, 0x1e, 0x0, 0x0}}, 0x2}}, 0x2e) r2 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000340), 0xffffffffffffffff) syz_emit_ethernet(0x2a, &(0x7f0000000040)={@local, @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x2}, @void, {@arp={0x806, @ether_ipv4={0x1, 0x800, 0x6, 0x4, 0xa, @broadcast, @loopback, @multicast, @initdev={0xac, 0x1e, 0x1, 0x0}}}}}, &(0x7f00000000c0)={0x1, 0x4, [0x896, 0x427, 0x5e6, 0x2ef]}) (async) syz_emit_ethernet(0x2a, &(0x7f0000000040)={@local, @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x2}, @void, {@arp={0x806, @ether_ipv4={0x1, 0x800, 0x6, 0x4, 0xa, @broadcast, @loopback, @multicast, @initdev={0xac, 0x1e, 0x1, 0x0}}}}}, &(0x7f00000000c0)={0x1, 0x4, [0x896, 0x427, 0x5e6, 0x2ef]}) r3 = socket$nl_generic(0x10, 0x3, 0x10) setsockopt$inet6_IPV6_DSTOPTS(r1, 0x29, 0x3b, &(0x7f00000001c0)={0xf0}, 0x8) sendmsg$L2TP_CMD_SESSION_DELETE(r3, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000140)={0x34, r2, 0x1, 0x70bd26, 0x25dfdbfe, {0x5}, [@L2TP_ATTR_CONN_ID={0x8, 0x9, 0x2}, @L2TP_ATTR_PW_TYPE={0x6, 0x1, 0x5}, @L2TP_ATTR_PEER_SESSION_ID={0x8, 0xc, 0xaaa}, @L2TP_ATTR_SESSION_ID={0x8, 0xb, 0x4}]}, 0x34}, 0x1, 0x0, 0x0, 0x20006911}, 0x0) 1.638378ms ago: executing program 0 (id=6641): r0 = socket$nl_route(0x10, 0x3, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0xe, 0xe, &(0x7f0000001740)=ANY=[@ANYBLOB="b702000000000000bfa300000000000007030000f0ffffff7a0af0ff0200000079a4f0ff00000000b706000000000081ad64020000000000450404000100ff0f1704000001130a00b7050000010000006a0af2fe000000008500000009000000b700000000000000950000000000000000e154cd8445974b26c933f7ffffffffe4fbffffff55bb2007ee51050512b5b42128aa090a79507df79f298129daa7a6b2f91af50342115e17392ac627c87881c000006146001e04aeacea799a22a2fa798b5adc43eb27d53319d0ad229e5752548300000000dbc2777df150b7cdd77b85b941092314fd085f028f2ed1a4535550614e09d6378198a6097a670838337af2abd55a87ac0394b2f92ffab7d153d62058d0a413b2173619ccf55520f22c9ca8b6712f3024b7041b1df65b3e1b9bf115646d14ce53d13d0ccacda1ef0900094fa737c28b99938512c816fdcceaede3faedc51d29a47fc813a2ec00f4c7a53ac271d6d7f4ea6bf97f2f33e2ea2e534300bcb3fdc4b4861004eefbda7f54f82a804da4f85db47a4a69bf9bc5fa96ee293fbd165a5a68488e40b030166565a097b1b44b451de736bb6d43db8db03d4b7745fef1d04ec633dee254a6d491b849a5a787e814c4fd21a18986252a70f8f92eb6f0e8c7db4bf23242a1f2c28159f09943b1b0452d1b72183aacf4a84f9130b775dd4e9e3070756f97ad791fa99dac06b57479321a0574fb30ff0000001989425f5d0b79f6584d0416d7c4bb9f547b328c8ddc20ea011bf5742e0e0d4334db8b20ce3f9f16cb7fc20fb4791ec85821d0c48fb657c29b309c73f0977e7cde65a82b94c461d7962b0d2277a84af326f37f3e2c25a61ec45c3af97a8f17da954aff3fc8c108755f75ca13fb7c8bbd8b6e7dac1aba4b20dc7de058a4dfa7e85a8bdf1d41a2d8bda74d66f47cc180f82c5f573c6d294d3665016ac59dda0fde4745db06753a7ac74a2d32f7528751313694bf5700b20ef0c248ddd3da32396a614cacad4aff2066bb5d4045c958559b7dcb98a6273b8c651e24d9f679e4fbe948dfb4cc4a389469608241730459f0123fd39206000000000000eb55dad46de56ef907b059b90b8aa49afb9a79ae5498f6589880ed6eea7f9c670012be05e7de0940313c5870786554df26236ebced9390cb6941b8375d936a7d2120eca291963eb2d537d8ee4de5c183c960119451c31539b22809e1d7f0cda06a9fa87d64cb77872a2cd8a104e16bb1a2bacf13464ca03aff14a9aa4bd9539f5096412b92012e095b84c20243ff98df3347f0e399d1b9f27e3c33269c0e153b28b2d4410572bc45b9d3fa02208d304d455c36300000000022320178b00cc6ed7966130b547dbf8b497af002000000cd1d00000020000000ef19349ee7f31abc11c800000000000000000000000928ee53595a779d243a48cea769470424d28804c04b2c4324ab7f4a5c81921f0128dfd70b438af60b060000000000000056642b49b745f3bf2c4af38ffb7d748308eea09fc361b4735efbf3411718d6ee7aebf9ef679dbfae9fb4a79f8a836804ed3a1079b0282a12043408cd60b687dcff91af19010000000000000000456f7d2a42bd13da202274f20675eb781925441578e93046aaddea8ec4ca37f71c2710a7ea8ae0dc214e1cc275b26adfa892e6de92000000000000000000ddff004cff9ec7ffff35e62f4eeee50e5bafecea4d4134f9d006c8d6883eca5c9c58c9e93311ab5009c68c73de2f04f15d005387577f480000ea65559eb00e76e9d0ada201bcbb5c252b28a60ca770663da451790cc36000906d5a9fad98c308e39bd5ffb6151d79c1cee1cd102e3c8e63e9fba05e3633be3f00000015762e5f5a3a0bc33fdbe28a5ffc83f2b485185cc92fe7f791e8f6429309d6adab4b7e508e5bf024ed8f8a005f2bbf96c89739f5cf1e750d50517a59a3ad09e8802e8f4f535447cc0fc9d5f99a73145dfcedad69da9cd4375c624600e78f4458542b14f29611f95d4a31838eeb20c20bb82aa31771cd379ec83554cea5e6539db7384e1f58d81f2f2653c4d9818708e27c89b552d7fcd116bce9c764c714c9402c21d181aac59efb28d4f91652f6750b6ec962802c0320f8059195729d60c534ee8e8ff0755b67fe4c25edb85bcff24c757aa8090000000000008c420eb4304f66e3a37aaf000000c42a570f0e9dd5fd545470f862f8c3c14fa9ecd1e877b0d8ca84c044859e85e6158f9184bc61a9a284db80e4636c25b96174327d82761c26e329555f9290af4100000000000000749efd3763655500344bae34137f5ab0d534b8d63e4ca3b671f2de1cdf519192c6b59a601fd419adc16e2055b85058f793484305d7a1759782e4c571ee855a47bc00edf5e9020c09ab004321610b857e8717764b633b21cb32f0eb3280e09758bd445ab91d20baca005472b79d7b574a247f1d2fe45b3c4e93da3d51de647c10dd49944dc87c92fe8bad99ca332af00f191b66b6a6f732a91f0e2e9190e4b448da7de018c58e950767f9b320be61e58c79d497247d278888901d442ad7f8536605a644e9e3d769db497c3960dfde12182334caee994adc38a436367a54b9e182b78e9a0ceb9a2c4f63902c1ad1a7c5a08d0920a23c2a86abbdf357849a651733e57f31019876026888c8ccb85c86b4f8ffffff7f000000002c331fca0e541b7ca211c28ed61c52573d9308a13d115b43f8b1894c8fa8a14dc4810f61ae96bf704526a8919bc700002100000000000000000001000027c9a46157a3609b6fd9843ee19ec647249a9375de5858818f3c4a4fa6ce46f4d42b07199de8b99231ace58c77819ee214e49666c464d35ca9b5143ed3b3dc8c17a23692759ccf5a205311b7ab22532697b861dfb54609fd88e6043bd52ae84c1bb0c8a6c769f952283a1f4e3842edb3d42c68a27ef6a1296dfff4a979369b0e8ebc62887aa46e820a74f91381ccc198e353047db70686d147357024eb3cb94f1e89cb5ba0a56aa046b4dc521a3d9356b4b8b5917c4c860495b240e80063bde261fd00000000007271e28ef6806bc8e139c49b91c76bea3858f78fbd8d31330d89069f9648a2ff93060ff073b3a113e47edf76f7d116d2b0976cf2ec447c030931651dd315003b7a6a5433a2bb3c035fc6846abe389b25c988f0bbb889560ae99ec4b227eda2e63a1c31a2c2bd48a822cbe92b6524e0cd8020ecaa34e19e7141d5e221509342bfe7d294d1eb3de6a50ca0301f89c2ee627e949c68b3a4a426a9b7d503a26e9a714ee5f72d8805dd1bfbd081f6a5d1f1289dfe14cb9194e26a44fac273461fc5c0e0a33db7f2d43ea8086cf059f40fa2640b6bfb74dd35f5a31059c01517cf4b6641fce9a24b96767b837ca037a1199735c375c705c798e0e208e4a5259d0bfa526b462af45a6eab34000000000000000000000000c4426344ec1a3366515dee221e747f55d7dd02534bc503b9b28277c253e410986bef2111a99cc448d652929f8a67a6a1d3f00dcad91aff428aade3f85714a1d3ef29acd4d49b62339c10c2ec0dac4728288e78980c1184d8223edbccbf9258b7374e79a1f8bf3fb73cfd1e76982f3d899f71e4a9f0ba8c6dbb7bbdfc399847a11921f97eba0ea14c4fed9a71eedb97c02461792e3a49dac16c60c3fcaab222025d78963c3ac899fa8b63f58a30212c9b2d7fe751e2046b78f86e22861b6504c667350244dd6d9189a8b9c45f8aaff9db694811ca86ed978f23eed7459c0382074170cf1e25b0e9ba3d1cc309353eea4cd8ab96bafda393276bdd8d32ead8db9e1b54d2d3d50e2815268fc1a6ec566981bc8ca2a4583f3d40e817433d0f4f25cfe6cc1897449ba5f26a9d66ac73e6f5c401376f23a314e0b9ff997d22f3e34b7524642c248aa813edaa626f00000021f8547d393dabe616fbbde21c90be00b5a22671395c7a69c6dd4d022ffc97ddb6aa025131652d409da1d8cfc3d219d4b1c1b7b8170d7c33d91db2b73f7ae02485a209a2474b5d0790d05c01bec623056e4d3f4d3149373a28b26a15a1fcce73d57e6eaf7e6f315fe275ebc9ef7aeca277dde01dde724f419803a2172a7833ceab38d21ca4f1dea5e1f4d8824167b21dd289dd4e6ecfba9e163bdbc48e1e758ecde0"], &(0x7f00000001c0)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sk_skb, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0xfffffedf, 0x10, &(0x7f0000000040), 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xfffffffffffffece}, 0x48) r1 = socket(0x10, 0x3, 0x0) sendmsg$nl_generic(r1, &(0x7f0000000540)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000000)={0x28, 0x2e, 0xa01, 0x0, 0x0, {0x1f}, [@typed={0xc, 0x0, 0x0, 0x0, @u64=0x1}, @typed={0x8, 0xb, 0x0, 0x0, @ipv4}]}, 0x28}}, 0x8000) getsockopt$inet_mptcp_buf(r1, 0x11c, 0x1, &(0x7f0000000280)=""/150, &(0x7f0000000340)=0x96) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000200)=ANY=[@ANYBLOB="800000001000ffff27bd7000fbdbdf2500000000", @ANYRES32=0x0, @ANYBLOB="1720000021200000600012800b000100697036746e6c00005000028014000200fc0100000000000000000000000000000400130014000300fe8000000000000000000000000000aa0500060002000000080008003b000000080008002400000008000100026f24"], 0x80}, 0x1, 0x0, 0x0, 0x1}, 0x8000002) 255.566µs ago: executing program 4 (id=6642): r0 = socket$nl_generic(0x10, 0x3, 0x10) (async) r1 = syz_genetlink_get_family_id$wireguard(&(0x7f00000003c0), 0xffffffffffffffff) socket$can_bcm(0x1d, 0x2, 0x2) (async) sendmsg$WG_CMD_SET_DEVICE(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000100)=ANY=[@ANYBLOB="b4000000", @ANYRES16=r1, @ANYBLOB="0100000000000000000001000000680008806400008024000100f44da367a88ee6564f020211456727082f5cebee8b1bf5eb7337341b459b39223c0009801c0000800600010002000000080002007f00000105000300030000001c00008006000100020000000800020000000000050003000200000024000300b08073e8d44e91e3da922c22438244bb885c69e269c8e9d835b114293a4ddc6e140002007767300000000000000000000000000018a3fcb1d5ea7062d4f22af540f01daeb00c6605bca3c1c77bae93a0a3b698da0d6a0fc6bff8f47ccadae494cfccf0650c397bd4cdb26b364ca710739fd70054eb831927c140fa8c45cbed6317f4a869c992d7aa80c6451db726eb8cbd903032fdd1bc5275567817757b4124bcd889c09aab68f0fd2e41385af8eb82c6feddb30753"], 0xb4}, 0x1, 0x0, 0x0, 0x4004840}, 0x40000) 0s ago: executing program 1 (id=6643): socket$packet(0x11, 0x2, 0x300) unshare(0x20000400) r0 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) setsockopt$inet6_IPV6_ADDRFORM(r0, 0x3a, 0x1, 0x0, 0x300) bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x16, 0x4, &(0x7f0000000000)=ANY=[@ANYBLOB="18000000000000000000000000000000711294000000000095"], &(0x7f0000000100)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x2a, '\x00', 0x0, @flow_dissector=0x11, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x0) getsockname$packet(0xffffffffffffffff, 0x0, 0x0) setsockopt$MRT_ADD_VIF(0xffffffffffffffff, 0x0, 0xca, 0x0, 0x0) sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000480)={0x0, 0x0, 0x0}, 0x0) r1 = socket$inet_tcp(0x2, 0x1, 0x0) getsockopt$inet_tcp_TCP_REPAIR_WINDOW(r1, 0x6, 0x1d, 0x0, &(0x7f00000001c0)) socket$nl_xfrm(0x10, 0x3, 0x6) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) r3 = socket$kcm(0x2, 0xa, 0x2) ioctl$SIOCSIFHWADDR(r3, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local}) write$tun(r2, &(0x7f0000000300)=ANY=[@ANYBLOB="034886dd010000000000140000006000000003082f00fe88a43de1a400000046000000007d01ff0200000088beffffffffffff000001"], 0xfdef) kernel console output (not intermixed with test programs): 211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 697.334510][T24608] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 697.359586][T24639] batman_adv: Cannot find parent device. Skipping batadv-on-batadv check for gretap3 [ 697.363254][T24608] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 697.385950][T24608] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 697.397865][T24608] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 697.402542][T24639] batman_adv: batadv0: Adding interface: gretap3 [ 697.421656][T24608] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 697.433641][T24608] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 697.466709][T24639] batman_adv: batadv0: The MTU of interface gretap3 is too small (1462) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 697.496264][T24608] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 697.513931][T24639] batman_adv: batadv0: Interface activated: gretap3 [ 697.544860][T24608] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 697.595891][T24608] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 697.643786][T24608] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 697.663510][T24608] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 697.683133][T24608] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 697.706353][T24608] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 697.747387][T24608] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 697.785585][T24649] tap0: tun_chr_ioctl cmd 1074025672 [ 697.804001][T24649] tap0: ignored: set checksum disabled [ 697.819004][T24649] netlink: 'syz.0.5594': attribute type 1 has an invalid length. [ 697.986382][ T3367] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 698.567903][T24671] __nla_validate_parse: 4 callbacks suppressed [ 698.567924][T24671] netlink: 4 bytes leftover after parsing attributes in process `syz.1.5600'. [ 698.850853][T24688] IPVS: rr: UDP 224.0.0.2:0 - no destination available [ 699.068206][T24701] netlink: 12 bytes leftover after parsing attributes in process `syz.1.5610'. [ 699.102375][T24698] tipc: Started in network mode [ 699.123916][T24698] tipc: Node identity 3693ecd26015, cluster identity 4711 [ 699.146480][ T3367] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 699.166964][T24698] tipc: Enabled bearer , priority 0 [ 699.205186][T24700] syzkaller0: entered promiscuous mode [ 699.234952][T24700] syzkaller0: entered allmulticast mode [ 699.260674][T24702] sch_tbf: burst 255 is lower than device syzkaller0 mtu (1514) ! [ 699.295275][T24714] netlink: 48 bytes leftover after parsing attributes in process `syz.0.5613'. [ 699.343236][T24707] bridge_slave_1: left allmulticast mode [ 699.351246][T24707] bridge_slave_1: left promiscuous mode [ 699.358095][T24707] bridge0: port 2(bridge_slave_1) entered disabled state [ 699.371867][T24707] bridge_slave_0: left allmulticast mode [ 699.387499][T24707] bridge_slave_0: left promiscuous mode [ 699.399799][T24707] bridge0: port 1(bridge_slave_0) entered disabled state [ 699.477789][T24702] tipc: Resetting bearer [ 699.598199][T24702] tipc: Resetting bearer [ 699.662481][T24702] tipc: Disabling bearer [ 699.752944][T24734] netlink: 20 bytes leftover after parsing attributes in process `syz.1.5617'. [ 699.803134][T24734] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 699.810487][T24734] IPv6: NLM_F_CREATE should be set when creating new route [ 699.933151][T24744] netlink: 40 bytes leftover after parsing attributes in process `syz.2.5618'. [ 700.022304][T24744] syzkaller1: entered promiscuous mode [ 700.032958][T24744] syzkaller1: entered allmulticast mode [ 700.287097][ T1170] net_ratelimit: 1 callbacks suppressed [ 700.287116][ T1170] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 700.369700][T24759] netlink: 12 bytes leftover after parsing attributes in process `syz.4.5627'. [ 700.893383][T24786] netlink: 'syz.3.5630': attribute type 21 has an invalid length. [ 701.040205][ C0] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 701.048666][ C0] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 701.056988][ C0] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 701.064760][T24786] bond6: option lacp_rate: mode dependency failed, not supported in mode broadcast(3) [ 701.155731][T24786] bond6 (unregistering): Released all slaves [ 701.301326][T24792] kthread_run failed with err -4 [ 701.393787][T24801] netlink: 84 bytes leftover after parsing attributes in process `syz.4.5632'. [ 701.414210][T24801] netlink: 84 bytes leftover after parsing attributes in process `syz.4.5632'. [ 701.452349][ T152] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 701.628992][T24807] veth0_to_bridge: vlans aren't supported yet for dev_uc|mc_add() [ 701.892770][T24820] netlink: 104 bytes leftover after parsing attributes in process `syz.3.5638'. [ 702.244546][T24829] netlink: 'syz.1.5642': attribute type 49 has an invalid length. [ 702.264620][T24833] netlink: 8 bytes leftover after parsing attributes in process `syz.4.5643'. [ 702.372896][ T48] netdevsim netdevsim4 netdevsim0: set [0, 0] type 1 family 0 port 8472 - 0 [ 702.413688][ T48] netdevsim netdevsim4 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0 [ 702.450685][ T48] netdevsim netdevsim4 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0 [ 702.493586][ T48] netdevsim netdevsim4 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0 [ 702.576679][T11517] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 702.821970][T24856] nbd: must specify at least one socket [ 703.690014][T24886] __nla_validate_parse: 9 callbacks suppressed [ 703.690038][T24886] netlink: 8 bytes leftover after parsing attributes in process `syz.1.5662'. [ 703.718584][ T59] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 703.759365][T24886] netlink: 8 bytes leftover after parsing attributes in process `syz.1.5662'. [ 704.008913][T24904] netlink: 16 bytes leftover after parsing attributes in process `syz.3.5666'. [ 704.585100][T24926] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 704.592479][T24926] IPv6: NLM_F_CREATE should be set when creating new route [ 704.599777][T24926] IPv6: NLM_F_CREATE should be set when creating new route [ 704.795151][T24930] netlink: 68 bytes leftover after parsing attributes in process `syz.3.5672'. [ 704.828997][T24930] netlink: 12 bytes leftover after parsing attributes in process `syz.3.5672'. [ 704.896956][ T152] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 704.932058][T24937] x_tables: unsorted underflow at hook 4 [ 704.938394][T24935] netlink: 12 bytes leftover after parsing attributes in process `syz.0.5674'. [ 704.957834][T11517] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 704.971766][T24935] openvswitch: netlink: EtherType 0 is less than min 600 [ 705.314976][T24952] netlink: 84 bytes leftover after parsing attributes in process `syz.0.5678'. [ 705.325625][T24952] netlink: 84 bytes leftover after parsing attributes in process `syz.0.5678'. [ 705.352418][T24945] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 705.560940][T24962] x_tables: ip_tables: TPROXY target: used from hooks FORWARD, but only usable from PREROUTING [ 705.742462][T24972] netlink: 512 bytes leftover after parsing attributes in process `syz.0.5681'. [ 706.165612][ T48] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 706.545349][T24992] netlink: 28 bytes leftover after parsing attributes in process `syz.3.5685'. [ 706.796310][ C0] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 706.804890][ C0] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 706.813248][ C0] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 707.029310][T25010] Bluetooth: MGMT ver 1.23 [ 707.262879][T25016] Unsupported ieee802154 address type: 0 [ 707.295429][ T3367] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 707.324752][T25019] openvswitch: netlink: ct_state flags ffffffff unsupported [ 708.456361][ T3367] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 708.529513][T25059] netlink: 'syz.4.5709': attribute type 4 has an invalid length. [ 708.824900][T25066] netlink: 'syz.2.5711': attribute type 12 has an invalid length. [ 708.843065][T25066] __nla_validate_parse: 2 callbacks suppressed [ 708.843084][T25066] netlink: 132 bytes leftover after parsing attributes in process `syz.2.5711'. [ 708.891400][T25066] syzkaller0: entered promiscuous mode [ 708.900892][T25066] syzkaller0: entered allmulticast mode [ 709.002326][T25073] netlink: 12 bytes leftover after parsing attributes in process `syz.4.5714'. [ 709.013184][T25073] netlink: 12 bytes leftover after parsing attributes in process `syz.4.5714'. [ 709.145403][T25078] netlink: 4 bytes leftover after parsing attributes in process `syz.2.5715'. [ 709.576547][ T59] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 709.975181][T25008] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 710.289908][T25093] syzkaller0: entered promiscuous mode [ 710.301547][T25093] syzkaller0: entered allmulticast mode [ 710.310820][T25102] netlink: 16 bytes leftover after parsing attributes in process `syz.3.5721'. [ 710.346471][T25102] netlink: 16 bytes leftover after parsing attributes in process `syz.3.5721'. [ 710.697344][ T3367] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 710.720016][ T36] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 710.744347][T25125] netlink: 12 bytes leftover after parsing attributes in process `syz.4.5726'. [ 710.821032][T25125] netlink: 12 bytes leftover after parsing attributes in process `syz.4.5726'. [ 710.868708][T25127] netlink: 12 bytes leftover after parsing attributes in process `syz.2.5728'. [ 710.937279][T25130] netlink: 12 bytes leftover after parsing attributes in process `syz.2.5728'. [ 710.949244][T25129] syzkaller1: entered promiscuous mode [ 710.965139][T25129] syzkaller1: entered allmulticast mode [ 711.568157][T25165] netlink: 'syz.2.5740': attribute type 11 has an invalid length. [ 711.739200][T25171] netlink: 'syz.0.5743': attribute type 12 has an invalid length. [ 711.773408][T25171] netlink: 'syz.0.5743': attribute type 11 has an invalid length. [ 711.836368][ C0] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 711.844803][ C0] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 711.853203][ C0] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 711.870286][ T140] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 711.880910][T25181] xt_connbytes: Forcing CT accounting to be enabled [ 711.926585][T25181] Cannot find set identified by id 65534 to match [ 712.017639][T25188] syzkaller1: tun_chr_ioctl cmd 1074025677 [ 712.041380][T25188] syzkaller1: linktype set to 823 [ 712.070654][T25188] netlink: 'syz.3.5748': attribute type 21 has an invalid length. [ 712.161210][T25188] netlink: 'syz.3.5748': attribute type 21 has an invalid length. [ 712.257515][T25208] netlink: 'syz.4.5755': attribute type 10 has an invalid length. [ 712.268513][T25209] netlink: 'syz.0.5752': attribute type 9 has an invalid length. [ 712.277049][T25197] netlink: 'syz.1.5753': attribute type 12 has an invalid length. [ 712.818016][T25208] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 712.892962][T25208] bond0: (slave batadv0): Enslaving as an active interface with an up link [ 712.947532][T25242] netlink: 'syz.2.5757': attribute type 1 has an invalid length. [ 712.974176][T25236] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 713.020139][ T1174] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 713.088132][T25236] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 713.130924][T25236] bond0 (unregistering): (slave batadv0): Releasing backup interface [ 713.149756][T25236] bond0 (unregistering): Released all slaves [ 713.302665][T25252] sctp: [Deprecated]: syz.4.5762 (pid 25252) Use of int in max_burst socket option deprecated. [ 713.302665][T25252] Use struct sctp_assoc_value instead [ 713.429776][T25250] xt_hashlimit: size too large, truncated to 1048576 [ 713.439435][T25261] sctp: [Deprecated]: syz.4.5762 (pid 25261) Use of struct sctp_assoc_value in delayed_ack socket option. [ 713.439435][T25261] Use struct sctp_sack_info instead [ 714.168961][ T14] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 715.297636][ T3310] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 716.404840][ T7422] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 716.486470][ T7422] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 716.929355][T25316] lo: entered allmulticast mode [ 716.950538][T25318] workqueue: Failed to create a rescuer kthread for wq "bond7": -EINTR [ 716.952523][T25312] syzkaller0: entered promiscuous mode [ 716.999411][T25312] syzkaller0: entered allmulticast mode [ 717.036328][ C0] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 717.044738][ C0] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 717.053130][ C0] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 717.068817][T25334] sctp: [Deprecated]: syz.1.5776 (pid 25334) Use of struct sctp_assoc_value in delayed_ack socket option. [ 717.068817][T25334] Use struct sctp_sack_info instead [ 717.287096][T25340] __nla_validate_parse: 14 callbacks suppressed [ 717.287116][T25340] netlink: 28 bytes leftover after parsing attributes in process `syz.3.5779'. [ 717.537407][ T7422] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 717.864080][T25356] input: Bluetooth HID Boot Protocol Device as /devices/virtual/bluetooth/hci4/hci4:200/input8 [ 717.891921][T25358] netlink: 'syz.2.5780': attribute type 2 has an invalid length. [ 718.148582][T25370] netlink: 44 bytes leftover after parsing attributes in process `syz.1.5786'. [ 718.189911][T25374] netlink: 4 bytes leftover after parsing attributes in process `syz.2.5788'. [ 718.555681][T25392] netlink: 16215 bytes leftover after parsing attributes in process `syz.4.5794'. [ 718.567098][ T4947] Bluetooth: hci4: command 0x0405 tx timeout [ 718.688681][ T152] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 718.753513][T25403] sctp: [Deprecated]: syz.0.5798 (pid 25403) Use of int in maxseg socket option. [ 718.753513][T25403] Use struct sctp_assoc_value instead [ 719.052535][ T4947] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 719.072413][ T4947] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 719.082255][ T4947] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 719.094138][ T4947] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 719.103832][ T4947] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 719.289354][T25416] netlink: 16 bytes leftover after parsing attributes in process `syz.0.5802'. [ 719.338074][T25416] netlink: 4 bytes leftover after parsing attributes in process `syz.0.5802'. [ 719.494507][T25424] netlink: 4 bytes leftover after parsing attributes in process `syz.2.5804'. [ 719.838669][ T12] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 719.942063][T25405] erspan0: entered promiscuous mode [ 719.972530][T25405] erspan0: entered allmulticast mode [ 720.245159][T25451] IPv6: NLM_F_CREATE should be specified when creating new route [ 720.273649][T25451] netlink: 'syz.0.5809': attribute type 1 has an invalid length. [ 720.886720][T25467] netlink: 52 bytes leftover after parsing attributes in process `syz.4.5813'. [ 720.976345][T23413] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 721.054952][T25470] netlink: 24 bytes leftover after parsing attributes in process `syz.0.5815'. [ 721.078195][T25475] netlink: 'syz.2.5816': attribute type 3 has an invalid length. [ 721.101045][T25471] netlink: 24 bytes leftover after parsing attributes in process `syz.0.5815'. [ 721.196257][ T5650] Bluetooth: hci0: command tx timeout [ 721.359877][T25489] netlink: 'syz.4.5819': attribute type 1 has an invalid length. [ 721.485810][ T1017] bridge_slave_1: left allmulticast mode [ 721.533028][ T1017] bridge_slave_1: left promiscuous mode [ 721.563171][ T1017] bridge0: port 2(bridge_slave_1) entered disabled state [ 721.615787][ T1017] bridge_slave_0: left allmulticast mode [ 721.627154][ T1017] bridge_slave_0: left promiscuous mode [ 721.635871][ T1017] bridge0: port 1(bridge_slave_0) entered disabled state [ 721.687487][T25499] TCP: request_sock_subflow_v6: Possible SYN flooding on port [fe80::aa]:20002. Sending cookies. [ 721.722502][ T1017] batman_adv: batadv0: Interface deactivated: gretap3 [ 721.893928][T25509] x_tables: duplicate underflow at hook 3 [ 722.106572][ T12] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 722.131374][ T1017] bond8 (unregistering): (slave vti0): Releasing backup interface [ 722.139504][ T1017] vti0 (unregistering): left promiscuous mode [ 722.156401][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 722.164811][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 722.248151][ T7421] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 722.321083][ T1017] batman_adv: batadv0: Removing interface: gretap3 [ 722.533565][ T1017] bond9 (unregistering): (slave bridge6): Releasing backup interface [ 722.542873][ T1017] bridge6 (unregistering): left promiscuous mode [ 722.567716][ T1017] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 722.599894][ T1017] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 722.613088][ T1017] bond0 (unregistering): Released all slaves [ 722.628532][ T1017] bond1 (unregistering): Released all slaves [ 722.668394][ T1017] bond2 (unregistering): Released all slaves [ 722.699061][ T1017] bond3 (unregistering): Released all slaves [ 722.740504][ T1017] bond4 (unregistering): Released all slaves [ 722.765219][ T1017] bond5 (unregistering): Released all slaves [ 722.782710][ T1017] bond6 (unregistering): Released all slaves [ 722.803925][ T1017] bond7 (unregistering): Released all slaves [ 722.827681][ T1017] bond8 (unregistering): Released all slaves [ 722.848138][ T1017] bond9 (unregistering): Released all slaves [ 722.888025][T25520] netlink: 'syz.4.5826': attribute type 22 has an invalid length. [ 722.915688][T25522] netlink: 'syz.4.5826': attribute type 22 has an invalid length. [ 722.928494][T25520] __nla_validate_parse: 1 callbacks suppressed [ 722.928512][T25520] netlink: 4 bytes leftover after parsing attributes in process `syz.4.5826'. [ 722.943681][T25522] netlink: 4 bytes leftover after parsing attributes in process `syz.4.5826'. [ 722.968673][ T5292] 8021q: adding VLAN 0 to HW filter on device eth1 [ 723.101979][T25531] netlink: 24 bytes leftover after parsing attributes in process `syz.2.5827'. [ 723.226869][T25531] netlink: 24 bytes leftover after parsing attributes in process `syz.2.5827'. [ 723.269686][ T14] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 723.288416][ T5650] Bluetooth: hci0: command tx timeout [ 723.476906][ T1017] IPVS: stopping backup sync thread 23059 ... [ 723.619997][T25538] syzkaller0: entered promiscuous mode [ 723.637911][T25538] syzkaller0: entered allmulticast mode [ 723.692645][T25560] netlink: 96 bytes leftover after parsing attributes in process `syz.0.5830'. [ 723.815592][T25557] netlink: 8 bytes leftover after parsing attributes in process `syz.0.5830'. [ 724.041067][T25410] bridge0: port 1(bridge_slave_0) entered blocking state [ 724.056301][T25410] bridge0: port 1(bridge_slave_0) entered disabled state [ 724.070647][T25410] bridge_slave_0: entered allmulticast mode [ 724.083218][T25410] bridge_slave_0: entered promiscuous mode [ 724.132422][T25410] bridge0: port 2(bridge_slave_1) entered blocking state [ 724.141885][T25410] bridge0: port 2(bridge_slave_1) entered disabled state [ 724.149690][T25410] bridge_slave_1: entered allmulticast mode [ 724.180605][T25410] bridge_slave_1: entered promiscuous mode [ 724.270033][T25410] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 724.304141][T25410] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 724.412645][T25410] team0: Port device team_slave_0 added [ 724.466851][ T7421] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 724.495573][T25410] team0: Port device team_slave_1 added [ 724.530464][T25410] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 724.539717][T25410] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 724.598690][T25410] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 724.611452][T25410] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 724.618656][T25410] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 724.645946][T25410] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 724.753103][T25410] hsr_slave_0: entered promiscuous mode [ 724.760113][T25410] hsr_slave_1: entered promiscuous mode [ 724.770280][T25410] debugfs: 'hsr0' already exists in 'hsr' [ 724.777413][T25410] Cannot create hsr debugfs directory [ 724.908528][ T1017] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 724.916235][ T1017] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 724.930606][ T1017] veth1_vlan: left allmulticast mode [ 725.207330][ T1017] team0 (unregistering): Port device team_slave_1 removed [ 725.229397][ T1017] team0 (unregistering): Port device team_slave_0 removed [ 725.337943][ T1017] team0 (unregistering): Port device dummy0 removed [ 725.356281][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 725.364780][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 725.373169][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 725.382506][ T5650] Bluetooth: hci0: command tx timeout [ 725.428955][ T5292] 8021q: adding VLAN 0 to HW filter on device eth2 [ 725.619238][ T14] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 725.795233][ T1017] IPVS: stop unused estimator thread 0... [ 726.253389][T25410] netdevsim netdevsim1 netdevsim0: renamed from eth0 [ 726.264769][T25410] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 726.273354][T25410] netdevsim netdevsim1 netdevsim1: renamed from eth1 [ 726.284558][T25410] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 726.292830][T25410] netdevsim netdevsim1 netdevsim2: renamed from eth2 [ 726.314947][T25410] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 726.323953][T25410] netdevsim netdevsim1 netdevsim3: renamed from eth3 [ 726.335117][T25410] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 726.491212][T25410] 8021q: adding VLAN 0 to HW filter on device bond0 [ 726.520803][T25410] 8021q: adding VLAN 0 to HW filter on device team0 [ 726.535987][ T3310] bridge0: port 1(bridge_slave_0) entered blocking state [ 726.543212][ T3310] bridge0: port 1(bridge_slave_0) entered forwarding state [ 726.571006][ T3310] bridge0: port 2(bridge_slave_1) entered blocking state [ 726.578217][ T3310] bridge0: port 2(bridge_slave_1) entered forwarding state [ 727.262760][T25410] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 727.341141][T25410] veth0_vlan: entered promiscuous mode [ 727.402821][T25410] veth1_vlan: entered promiscuous mode [ 727.448487][ T5650] Bluetooth: hci0: command tx timeout [ 727.472030][T25410] veth0_macvtap: entered promiscuous mode [ 727.502282][T25410] veth1_macvtap: entered promiscuous mode [ 727.538597][T25410] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 727.553819][T25410] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 727.569680][ T7422] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 727.585086][ T7422] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 727.619991][ T1174] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 727.649618][ T7422] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 727.855532][ T1174] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 727.866567][ T7422] net_ratelimit: 1 callbacks suppressed [ 727.866583][ T7422] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 727.881661][ T1174] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 727.927971][ T152] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 727.935850][ T152] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 728.013705][ T1017] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 728.102324][T25642] netlink: 8 bytes leftover after parsing attributes in process `syz.1.5799'. [ 728.117719][T25642] netlink: 'syz.1.5799': attribute type 1 has an invalid length. [ 728.125593][T25642] netlink: 'syz.1.5799': attribute type 2 has an invalid length. [ 729.027873][ T7422] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 730.158331][ T1174] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 731.116420][ C0] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 731.124885][ C0] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 731.266330][ T1174] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 732.376820][ T1170] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 733.486415][ T14] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 733.767077][ T1170] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 734.316387][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 734.324693][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 734.587491][ T14] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 735.687918][ T1174] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 736.797432][ T14] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 737.896334][ T7422] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 738.996406][ T1017] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 739.436334][ C0] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 739.444611][ C0] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 739.518194][ T1017] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 740.117570][ T1017] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 741.216845][ T7422] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 742.316893][ T7422] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 742.636377][ C0] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 742.644706][ C0] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 743.417257][ T1174] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 744.516860][ T152] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 744.644369][ T7421] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 745.617854][ T1170] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 745.836387][ C0] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 745.844771][ C0] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 746.736641][ T1174] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 747.838860][ T1170] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 748.956429][ T14] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 750.077436][ T1017] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 750.236446][ C0] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 750.244827][ C0] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 750.396780][ T152] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 751.176450][ T152] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 752.276489][ T1017] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 753.386385][ T1017] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 753.516372][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 753.524744][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 754.486821][ T1174] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 755.607070][ T7422] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 756.726415][ T7422] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 757.356371][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 757.364901][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 757.836644][ T7421] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 758.946353][ T7422] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 759.996650][ T7421] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 760.046431][ T7421] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 761.146915][ T1174] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 761.836313][ C0] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 761.844723][ C0] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 761.853074][ C0] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 762.276362][ T152] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 763.386776][ T1017] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 764.497115][ T1174] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 765.596694][ T7421] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 765.757390][ T1174] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 766.707057][ T7421] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 767.806623][ T152] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 768.876413][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 768.884728][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 768.893016][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 768.916574][ T1017] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 770.017186][ T7422] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 770.878337][ T14] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 771.119696][ T1017] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 771.882561][T25672] openvswitch: netlink: Port 856954028 exceeds max allowable 65535 [ 771.981110][ T30] audit: type=1800 audit(1782975115.371:10): pid=25681 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.1.5835" name="memory.events" dev="tmpfs" ino=23 res=0 errno=0 [ 772.065391][T25679] syzkaller1: entered promiscuous mode [ 772.086845][T25679] syzkaller1: entered allmulticast mode [ 772.211041][T25688] netlink: 84 bytes leftover after parsing attributes in process `syz.1.5840'. [ 772.235643][T25688] netlink: 84 bytes leftover after parsing attributes in process `syz.1.5840'. [ 772.256638][ T152] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 772.268917][T25688] A link change request failed with some changes committed already. Interface ip6_vti0 may have been left with an inconsistent configuration, please check. [ 772.448997][T25697] netlink: 12 bytes leftover after parsing attributes in process `syz.1.5845'. [ 772.490953][T25697] netlink: 12 bytes leftover after parsing attributes in process `syz.1.5845'. [ 772.729522][T25706] block nbd0: Unsupported socket: should be TCP or UNIX. [ 772.749792][T25708] netlink: 'syz.2.5850': attribute type 24 has an invalid length. [ 772.962234][ T30] audit: type=1804 audit(1782975116.341:11): pid=25716 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=open_writers comm="syz.1.5851" name="/newroot/5/cgroup.controllers" dev="tmpfs" ino=44 res=1 errno=0 [ 773.029907][ T30] audit: type=1800 audit(1782975116.341:12): pid=25716 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.1.5851" name="cgroup.controllers" dev="tmpfs" ino=44 res=0 errno=0 [ 773.326283][T25734] tipc: Enabling of bearer rejected, failed to enable media [ 773.386946][ T152] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 773.613874][T25744] netlink: 'syz.1.5856': attribute type 1 has an invalid length. [ 773.644669][T25746] netlink: 12 bytes leftover after parsing attributes in process `syz.4.5857'. [ 773.728432][T25746] netlink: 12 bytes leftover after parsing attributes in process `syz.4.5857'. [ 773.996334][ C0] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 774.004816][ C0] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 774.013238][ C0] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 774.038299][T25769] netlink: 60 bytes leftover after parsing attributes in process `syz.4.5863'. [ 774.180053][T25774] netlink: 'syz.2.5864': attribute type 83 has an invalid length. [ 774.291961][T25779] netlink: 64 bytes leftover after parsing attributes in process `syz.1.5866'. [ 774.537770][ T7421] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 775.043442][T25813] netlink: 12 bytes leftover after parsing attributes in process `syz.3.5879'. [ 775.492806][T25813] xfrm2: entered promiscuous mode [ 775.513159][T25813] xfrm2: entered allmulticast mode [ 775.744134][ T7421] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 775.926594][ T7421] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 776.031120][T25844] hsr0: entered allmulticast mode [ 776.036569][T25844] hsr_slave_0: entered allmulticast mode [ 776.042401][T25844] hsr_slave_1: entered allmulticast mode [ 776.101309][T25842] netlink: 88 bytes leftover after parsing attributes in process `syz.2.5885'. [ 776.371314][T25851] syzkaller0: entered promiscuous mode [ 776.383545][T25851] syzkaller0: entered allmulticast mode [ 776.653044][T25870] netlink: 'syz.1.5895': attribute type 1 has an invalid length. [ 776.887443][ T7421] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 777.170263][T25894] netlink: 'syz.0.5904': attribute type 3 has an invalid length. [ 777.598435][T25909] syz_tun: entered allmulticast mode [ 777.817332][T25923] netlink: 'syz.2.5909': attribute type 3 has an invalid length. [ 777.825982][T25923] netlink: 'syz.2.5909': attribute type 3 has an invalid length. [ 777.846695][T25923] netlink: 'syz.2.5909': attribute type 3 has an invalid length. [ 777.872702][T25923] netlink: 'syz.2.5909': attribute type 3 has an invalid length. [ 777.887595][T25922] __nla_validate_parse: 40 callbacks suppressed [ 777.887612][T25922] netlink: 8 bytes leftover after parsing attributes in process `syz.2.5909'. [ 777.889452][T25906] syz_tun: left allmulticast mode [ 777.914902][T25923] netlink: 'syz.2.5909': attribute type 3 has an invalid length. [ 777.936806][T25923] netlink: 'syz.2.5909': attribute type 3 has an invalid length. [ 777.990599][T25923] netlink: 'syz.2.5909': attribute type 3 has an invalid length. [ 778.049780][T25923] netlink: 'syz.2.5909': attribute type 3 has an invalid length. [ 778.069186][T10112] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 778.122187][T25923] netlink: 'syz.2.5909': attribute type 3 has an invalid length. [ 778.143853][T25923] netlink: 'syz.2.5909': attribute type 3 has an invalid length. [ 778.230743][T25933] netlink: 12 bytes leftover after parsing attributes in process `syz.3.5912'. [ 778.249087][T25931] netlink: 244 bytes leftover after parsing attributes in process `syz.1.5914'. [ 778.277705][T25934] netlink: 12 bytes leftover after parsing attributes in process `syz.0.5913'. [ 778.282842][T25933] FAULT_INJECTION: forcing a failure. [ 778.282842][T25933] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 778.340741][T25933] CPU: 0 UID: 0 PID: 25933 Comm: syz.3.5912 Not tainted syzkaller #0 PREEMPT(full) [ 778.340779][T25933] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 778.340794][T25933] Call Trace: [ 778.340803][T25933] [ 778.340814][T25933] dump_stack_lvl+0xe8/0x150 [ 778.340850][T25933] should_fail_ex+0x40c/0x560 [ 778.340889][T25933] _copy_from_user+0x2d/0xb0 [ 778.340914][T25933] ___sys_sendmsg+0x1c6/0x360 [ 778.340942][T25933] ? __lock_acquire+0x683/0x2cf0 [ 778.340989][T25933] ? __pfx____sys_sendmsg+0x10/0x10 [ 778.341019][T25933] ? kstrtouint+0x6e/0xe0 [ 778.341076][T25933] ? __fget_files+0x2a/0x420 [ 778.341100][T25933] ? __fget_files+0x3a2/0x420 [ 778.341133][T25933] __sys_sendmmsg+0x273/0x4d0 [ 778.341164][T25933] ? __pfx___sys_sendmmsg+0x10/0x10 [ 778.341217][T25933] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 778.341258][T25933] ? ksys_write+0x242/0x270 [ 778.341288][T25933] ? __pfx_ksys_write+0x10/0x10 [ 778.341323][T25933] __x64_sys_sendmmsg+0xa0/0xc0 [ 778.341348][T25933] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 778.341374][T25933] do_syscall_64+0x174/0x580 [ 778.341395][T25933] ? trace_irq_disable+0x3b/0x140 [ 778.341417][T25933] ? clear_bhb_loop+0x40/0x90 [ 778.341457][T25933] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 778.341479][T25933] RIP: 0033:0x7f0ea779de59 [ 778.341500][T25933] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 778.341519][T25933] RSP: 002b:00007f0ea860d028 EFLAGS: 00000246 ORIG_RAX: 0000000000000133 [ 778.341543][T25933] RAX: ffffffffffffffda RBX: 00007f0ea7a26090 RCX: 00007f0ea779de59 [ 778.341559][T25933] RDX: 04000000000001f2 RSI: 0000200000000000 RDI: 0000000000000004 [ 778.341574][T25933] RBP: 00007f0ea860d090 R08: 0000000000000000 R09: 0000000000000000 [ 778.341587][T25933] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 778.341599][T25933] R13: 00007f0ea7a26128 R14: 00007f0ea7a26090 R15: 00007fff3fd6c878 [ 778.341633][T25933] [ 778.744328][T25937] xfrm1: entered allmulticast mode [ 778.768757][T25941] netlink: 8 bytes leftover after parsing attributes in process `syz.0.5919'. [ 778.844223][T25941] bond6: option xmit_hash_policy: invalid value (64) [ 778.879862][T25941] bond6 (unregistering): Released all slaves [ 778.952004][T25953] netlink: 108 bytes leftover after parsing attributes in process `syz.1.5920'. [ 779.036413][ C0] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 779.044850][ C0] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 779.053225][ C0] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 779.251173][T25966] netlink: 12 bytes leftover after parsing attributes in process `syz.3.5924'. [ 779.261634][T25966] block nbd0: reconnected socket [ 779.267146][T25966] nbd: error processing sock list [ 779.276901][ T5650] block nbd0: Receive control failed (result -32) [ 779.336320][ T14] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 779.372518][T25970] netlink: 4 bytes leftover after parsing attributes in process `syz.3.5925'. [ 779.381681][T25970] netlink: 4 bytes leftover after parsing attributes in process `syz.3.5925'. [ 779.392154][T25970] netlink: 4 bytes leftover after parsing attributes in process `syz.3.5925'. [ 779.512449][T25974] sctp: [Deprecated]: syz.3.5928 (pid 25974) Use of int in maxseg socket option. [ 779.512449][T25974] Use struct sctp_assoc_value instead [ 780.033200][T26000] syzkaller0: entered promiscuous mode [ 780.049238][T26000] syzkaller0: entered allmulticast mode [ 780.082237][T26003] syzkaller0: entered promiscuous mode [ 780.102250][T26003] syzkaller0: entered allmulticast mode [ 780.498433][ T152] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 780.910544][T26003] Bluetooth: hci2: Opcode 0x0401 failed: -4 [ 781.037135][ T152] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 781.073406][ T3310] nci: nci_add_new_protocol: the target found does not have the desired protocol [ 781.107502][T26046] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 781.362679][T26061] SET target dimension over the limit! [ 781.417824][T26061] sch_fq: defrate 0 ignored. [ 781.616831][ T7422] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 782.236902][ T5650] Bluetooth: hci2: command 0x0406 tx timeout [ 782.746906][ T7421] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 783.857480][ T1174] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 784.400765][T10112] bridge_slave_1: left allmulticast mode [ 784.439156][T10112] bridge_slave_1: left promiscuous mode [ 784.457581][T10112] bridge0: port 2(bridge_slave_1) entered disabled state [ 784.563224][T26132] atomic_op ffff88802b234998 conn xmit_atomic 0000000000000000 [ 784.575436][T10112] bridge_slave_0: left allmulticast mode [ 784.599750][T10112] bridge_slave_0: left promiscuous mode [ 784.622771][T10112] bridge0: port 1(bridge_slave_0) entered disabled state [ 784.876234][ C0] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 784.884716][ C0] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 784.893070][ C0] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 785.153830][T26157] __nla_validate_parse: 6 callbacks suppressed [ 785.153851][T26157] netlink: 20 bytes leftover after parsing attributes in process `syz.2.5967'. [ 785.222301][T10112] bond10 (unregistering): (slave ip6gre2): Releasing backup interface [ 785.247605][T10112] ip6gre2 (unregistering): left promiscuous mode [ 785.524702][T10112] erspan0 (unregistering): left promiscuous mode [ 785.594926][T10112] gretap0 (unregistering): left promiscuous mode [ 785.742195][T10112] bond2 (unregistering): (slave geneve2): Releasing active interface [ 785.930893][T10112] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 785.939948][T10112] bond_slave_0: left allmulticast mode [ 785.949992][T10112] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 785.959124][T10112] bond_slave_1: left allmulticast mode [ 785.969739][T10112] bond0 (unregistering): Released all slaves [ 785.983137][T10112] bond1 (unregistering): Released all slaves [ 786.007712][T10112] bond2 (unregistering): Released all slaves [ 786.030771][T10112] bond3 (unregistering): Released all slaves [ 786.054140][T10112] bond4 (unregistering): Released all slaves [ 786.079982][T10112] bond5 (unregistering): Released all slaves [ 786.105462][T10112] bond6 (unregistering): Released all slaves [ 786.133573][T10112] bond7 (unregistering): (slave veth3): Releasing active interface [ 786.141944][T10112] batadv1: entered promiscuous mode [ 786.152955][T10112] bond7 (unregistering): (slave batadv1): Releasing active interface [ 786.164395][T10112] bond7 (unregistering): (slave veth5): Releasing active interface [ 786.183546][T10112] bond7 (unregistering): Released all slaves [ 786.220626][T10112] bond8 (unregistering): Released all slaves [ 786.250745][T10112] bond9 (unregistering): Released all slaves [ 786.270597][T10112] bond10 (unregistering): Released all slaves [ 786.295660][T10112] bond11 (unregistering): (slave lo): Releasing backup interface [ 786.309812][T10112] bond11 (unregistering): (slave lo): last VLAN challenged slave left bond - VLAN blocking is removed [ 786.329404][T10112] bond11 (unregistering): Released all slaves [ 786.363594][T10112] bond12 (unregistering): Released all slaves [ 786.385764][T26140] syz_tun: entered allmulticast mode [ 786.397121][T26140] syz_tun: left allmulticast mode [ 786.442012][T26163] netlink: 12 bytes leftover after parsing attributes in process `syz.4.5969'. [ 786.469930][T26164] netlink: 12 bytes leftover after parsing attributes in process `syz.4.5969'. [ 786.609120][T10112] tipc: Left network mode [ 787.002746][T26182] validate_nla: 26 callbacks suppressed [ 787.002766][T26182] netlink: 'syz.2.5975': attribute type 1 has an invalid length. [ 787.244577][T26192] bond7: (slave bridge5): making interface the new active one [ 787.279807][T26192] bond7: (slave bridge5): Enslaving as an active interface with an up link [ 787.394849][T26201] syz_tun: entered allmulticast mode [ 787.431978][T26199] syz_tun: left allmulticast mode [ 787.484318][T26206] netlink: 32 bytes leftover after parsing attributes in process `syz.2.5983'. [ 787.788551][T26222] netlink: 'syz.4.5988': attribute type 2 has an invalid length. [ 787.800825][T26214] 8021q: adding VLAN 0 to HW filter on device bond1 [ 787.900091][T10112] hsr_slave_0: left promiscuous mode [ 787.921072][T10112] hsr_slave_1: left promiscuous mode [ 787.943528][T10112] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 787.960798][T10112] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 787.975957][T10112] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 787.995804][T10112] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 788.086298][T10112] veth1_vlan: left allmulticast mode [ 788.109130][T10112] veth1_vlan: left promiscuous mode [ 788.122448][T10112] veth0_vlan: left promiscuous mode [ 788.129355][T26235] netlink: 'syz.0.5991': attribute type 10 has an invalid length. [ 788.148127][T26235] netlink: 40 bytes leftover after parsing attributes in process `syz.0.5991'. [ 788.932666][T26222] : entered promiscuous mode [ 788.959090][T26228] bridge6: trying to set multicast query interval above maximum, setting to 8640000 (86400000ms) [ 789.033133][T26235] team0: Port device geneve1 added [ 789.069995][T26236] syzkaller0: entered promiscuous mode [ 789.078849][T26236] syzkaller0: entered allmulticast mode [ 789.125693][T26258] netlink: 'syz.1.5993': attribute type 12 has an invalid length. [ 789.162657][T26258] netlink: 4 bytes leftover after parsing attributes in process `syz.1.5993'. [ 789.189624][T26258] netlink: 'syz.1.5993': attribute type 12 has an invalid length. [ 789.199929][T26258] netlink: 4 bytes leftover after parsing attributes in process `syz.1.5993'. [ 789.214371][T26263] netlink: 'syz.4.5994': attribute type 21 has an invalid length. [ 789.241194][T26263] netlink: 128 bytes leftover after parsing attributes in process `syz.4.5994'. [ 789.432860][T26268] openvswitch: netlink: Flow set message rejected, Key attribute missing. [ 791.309014][ T3310] netdevsim netdevsim1 netdevsim0: set [0, 0] type 1 family 0 port 8472 - 0 [ 791.318756][ T3310] netdevsim netdevsim1 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0 [ 791.385193][T26263] netlink: 'syz.4.5994': attribute type 4 has an invalid length. [ 791.413614][T26263] netlink: 'syz.4.5994': attribute type 5 has an invalid length. [ 791.432876][T26263] netlink: 3 bytes leftover after parsing attributes in process `syz.4.5994'. [ 791.462071][T26267] syz_tun: entered allmulticast mode [ 791.470035][T26267] syz_tun: left allmulticast mode [ 791.489596][ T3310] netdevsim netdevsim1 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0 [ 791.524761][ T3310] netdevsim netdevsim1 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0 [ 791.687345][T26282] IPv6: addrconf: prefix option has invalid lifetime [ 791.722636][T26279] vcan3: entered promiscuous mode [ 791.732736][T26279] vcan3: entered allmulticast mode [ 791.810332][T26293] netlink: 'syz.2.6002': attribute type 10 has an invalid length. [ 791.919728][T26302] netlink: 28 bytes leftover after parsing attributes in process `syz.2.6002'. [ 792.054367][T26306] xt_cgroup: path and classid specified [ 792.625917][T26293] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 792.701768][T26293] bond0: (slave netdevsim1): Enslaving as an active interface with an up link [ 792.734971][T26301] lo: left allmulticast mode [ 793.382664][T10112] IPVS: stop unused estimator thread 0... [ 793.990920][T26338] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 794.027100][T26338] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 794.109537][T26338] macvlan0: left promiscuous mode [ 794.154590][T26338] netdevsim netdevsim0 netdevsim0: left promiscuous mode [ 794.194484][T26338] bond2: left promiscuous mode [ 794.273266][T26338] xfrm1: left promiscuous mode [ 794.278715][T26338] h: left promiscuous mode [ 794.285127][T26338] bond3: left promiscuous mode [ 794.305699][T26338] bridge4: left promiscuous mode [ 794.336830][T26338] gtp0: left promiscuous mode [ 794.343970][T26339] syz_tun: entered allmulticast mode [ 794.400678][T26357] syzkaller1: entered promiscuous mode [ 794.421811][T26357] syzkaller1: entered allmulticast mode [ 794.469719][T15124] netdevsim netdevsim0 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 794.501914][T15124] netdevsim netdevsim0 netdevsim0: unset [1, 1] type 2 family 0 port 20004 - 0 [ 794.535655][T15124] netdevsim netdevsim0 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 794.561903][T15124] netdevsim netdevsim0 netdevsim1: unset [1, 1] type 2 family 0 port 20004 - 0 [ 794.582663][T26329] syz_tun: left allmulticast mode [ 794.703143][T15124] netdevsim netdevsim0 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 794.722599][T15124] netdevsim netdevsim0 netdevsim2: unset [1, 1] type 2 family 0 port 20004 - 0 [ 794.732496][T15124] netdevsim netdevsim0 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 794.758954][T15124] netdevsim netdevsim0 netdevsim3: unset [1, 1] type 2 family 0 port 20004 - 0 [ 794.955660][T26385] syz_tun: entered allmulticast mode [ 794.970604][T26384] syz_tun: left allmulticast mode [ 795.053147][T26390] netlink: 36 bytes leftover after parsing attributes in process `syz.2.6022'. [ 795.138467][T26394] xt_hashlimit: size too large, truncated to 1048576 [ 795.207815][T26389] netlink: 8 bytes leftover after parsing attributes in process `syz.0.6020'. [ 795.240086][T26400] netlink: 36 bytes leftover after parsing attributes in process `syz.4.6025'. [ 795.295339][T26400] netlink: 108 bytes leftover after parsing attributes in process `syz.4.6025'. [ 795.334974][T26400] netlink: 8 bytes leftover after parsing attributes in process `syz.4.6025'. [ 795.720295][T26416] lo: entered promiscuous mode [ 795.745193][T26416] tunl0: entered promiscuous mode [ 795.767087][T26416] gre0: entered promiscuous mode [ 795.801928][T26416] gretap0: entered promiscuous mode [ 795.830186][T26416] erspan0: entered promiscuous mode [ 795.852716][T26416] ip_vti0: entered promiscuous mode [ 795.973656][T26428] netlink: 64 bytes leftover after parsing attributes in process `syz.1.6034'. [ 796.019786][T26428] netlink: 64 bytes leftover after parsing attributes in process `syz.1.6034'. [ 796.100551][T26432] netlink: 64 bytes leftover after parsing attributes in process `syz.1.6034'. [ 796.497763][T26464] __nla_validate_parse: 1 callbacks suppressed [ 796.497782][T26464] netlink: 12 bytes leftover after parsing attributes in process `syz.1.6041'. [ 796.745275][T22061] IPVS: starting estimator thread 0... [ 796.848989][T26478] IPVS: using max 29 ests per chain, 69600 per kthread [ 796.936375][T26491] netlink: 8 bytes leftover after parsing attributes in process `syz.2.6050'. [ 796.957059][T26491] syzkaller0: entered promiscuous mode [ 796.962617][T26491] syzkaller0: entered allmulticast mode [ 797.333618][T26510] netlink: 12 bytes leftover after parsing attributes in process `syz.1.6055'. [ 797.343870][T26510] netlink: 12 bytes leftover after parsing attributes in process `syz.1.6055'. [ 797.464031][T26520] netlink: 16 bytes leftover after parsing attributes in process `syz.1.6059'. [ 797.572427][T26524] x_tables: duplicate underflow at hook 1 [ 799.745789][T26481] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 799.754977][T26503] netlink: 256 bytes leftover after parsing attributes in process `syz.2.6053'. [ 800.007589][T26535] xt_hashlimit: size too large, truncated to 1048576 [ 800.205727][T26543] xt_hashlimit: size too large, truncated to 1048576 [ 800.966257][T26571] netlink: 12 bytes leftover after parsing attributes in process `syz.0.6071'. [ 801.008479][T26571] netlink: 420 bytes leftover after parsing attributes in process `syz.0.6071'. [ 801.038050][T26577] netlink: 'syz.2.6073': attribute type 24 has an invalid length. [ 801.075757][T26580] netlink: 'syz.1.6074': attribute type 1 has an invalid length. [ 801.143739][T26580] 8021q: adding VLAN 0 to HW filter on device bond2 [ 801.169255][T26580] bond2: (slave gretap1): making interface the new active one [ 801.178970][T26580] bond2: (slave gretap1): Enslaving as an active interface with an up link [ 801.316842][T26588] netlink: 'syz.2.6077': attribute type 1 has an invalid length. [ 801.340865][T26588] netlink: 224 bytes leftover after parsing attributes in process `syz.2.6077'. [ 801.435094][T26599] netlink: 12 bytes leftover after parsing attributes in process `syz.4.6075'. [ 801.701540][T26604] bond6: entered promiscuous mode [ 801.707075][T26604] bond6: entered allmulticast mode [ 801.712701][T26604] 8021q: adding VLAN 0 to HW filter on device bond6 [ 802.481669][T26638] tipc: can't start tipc receive workqueue [ 802.951831][T26667] syz_tun: entered allmulticast mode [ 802.983710][T26665] syz_tun: left allmulticast mode [ 803.102205][T26679] netlink: 32 bytes leftover after parsing attributes in process `syz.0.6095'. [ 803.149147][T26679] netlink: 40 bytes leftover after parsing attributes in process `syz.0.6095'. [ 803.219448][T26687] netlink: 'syz.1.6097': attribute type 9 has an invalid length. [ 803.734490][T26712] syz.2.6106: vmalloc error: size 8589938688, exceeds total pages, mode:0xdc0(GFP_KERNEL|__GFP_ZERO), nodemask=(null),cpuset=/,mems_allowed=0-1 [ 803.775570][T26714] netlink: 12 bytes leftover after parsing attributes in process `syz.1.6107'. [ 803.792409][T26712] CPU: 0 UID: 0 PID: 26712 Comm: syz.2.6106 Not tainted syzkaller #0 PREEMPT(full) [ 803.792441][T26712] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 803.792456][T26712] Call Trace: [ 803.792466][T26712] [ 803.792477][T26712] dump_stack_lvl+0xe8/0x150 [ 803.792513][T26712] warn_alloc+0x24c/0x270 [ 803.792553][T26712] ? stack_depot_save_flags+0x33/0x800 [ 803.792591][T26712] ? __pfx_warn_alloc+0x10/0x10 [ 803.792630][T26712] ? kasan_save_track+0x3e/0x80 [ 803.792652][T26712] ? __kasan_kmalloc+0x93/0xb0 [ 803.792693][T26712] ? xsk_setsockopt+0x52a/0x960 [ 803.792725][T26712] ? do_sock_setsockopt+0x17c/0x1b0 [ 803.792749][T26712] ? __x64_sys_setsockopt+0x13d/0x1b0 [ 803.792771][T26712] ? do_syscall_64+0x174/0x580 [ 803.792792][T26712] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 803.792829][T26712] __vmalloc_node_range_noprof+0x12c/0x1730 [ 803.792902][T26712] ? __pfx___vmalloc_node_range_noprof+0x10/0x10 [ 803.792943][T26712] ? __kasan_kmalloc+0x93/0xb0 [ 803.792970][T26712] ? __kmalloc_cache_noprof+0x32d/0x660 [ 803.793006][T26712] ? __kmalloc_cache_noprof+0x150/0x660 [ 803.793047][T26712] vmalloc_user_noprof+0xad/0xe0 [ 803.793084][T26712] ? xskq_create+0xbf/0x170 [ 803.793119][T26712] xskq_create+0xbf/0x170 [ 803.793157][T26712] xsk_init_queue+0x8a/0xe0 [ 803.793194][T26712] xsk_setsockopt+0x52a/0x960 [ 803.793225][T26712] ? __fget_files+0x2a/0x420 [ 803.793251][T26712] ? __pfx_xsk_setsockopt+0x10/0x10 [ 803.793284][T26712] ? __pfx_aa_sk_perm+0x10/0x10 [ 803.793317][T26712] ? aa_sock_opt_perm+0xff/0x1a0 [ 803.793351][T26712] ? bpf_lsm_socket_setsockopt+0x9/0x20 [ 803.793381][T26712] ? __pfx_xsk_setsockopt+0x10/0x10 [ 803.793415][T26712] do_sock_setsockopt+0x17c/0x1b0 [ 803.793447][T26712] __x64_sys_setsockopt+0x13d/0x1b0 [ 803.793475][T26712] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 803.793505][T26712] do_syscall_64+0x174/0x580 [ 803.793539][T26712] ? trace_irq_disable+0x3b/0x140 [ 803.793561][T26712] ? clear_bhb_loop+0x40/0x90 [ 803.793590][T26712] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 803.793613][T26712] RIP: 0033:0x7fd5fd39de59 [ 803.793634][T26712] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 803.793653][T26712] RSP: 002b:00007fd5fe33f028 EFLAGS: 00000246 ORIG_RAX: 0000000000000036 [ 803.793686][T26712] RAX: ffffffffffffffda RBX: 00007fd5fd625fa0 RCX: 00007fd5fd39de59 [ 803.793703][T26712] RDX: 0000000000000006 RSI: 000000000000011b RDI: 0000000000000003 [ 803.793717][T26712] RBP: 00007fd5fd433e6f R08: 0000000000000004 R09: 0000000000000000 [ 803.793731][T26712] R10: 0000200000000000 R11: 0000000000000246 R12: 0000000000000000 [ 803.793746][T26712] R13: 00007fd5fd626038 R14: 00007fd5fd625fa0 R15: 00007ffe03a747a8 [ 803.793786][T26712] [ 803.793820][T26712] Mem-Info: [ 804.236298][T26712] active_anon:7197 inactive_anon:0 isolated_anon:0 [ 804.236298][T26712] active_file:272 inactive_file:43490 isolated_file:0 [ 804.236298][T26712] unevictable:768 dirty:217 writeback:0 [ 804.236298][T26712] slab_reclaimable:11730 slab_unreclaimable:103896 [ 804.236298][T26712] mapped:29514 shmem:3151 pagetables:1122 [ 804.236298][T26712] sec_pagetables:0 bounce:0 [ 804.236298][T26712] kernel_misc_reclaimable:0 [ 804.236298][T26712] free:1314699 free_pcp:8646 free_cma:0 [ 804.321104][T26712] Node 0 active_anon:29788kB inactive_anon:0kB active_file:1088kB inactive_file:173760kB unevictable:1536kB isolated(anon):0kB isolated(file):0kB mapped:123256kB dirty:868kB writeback:0kB shmem:12068kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB kernel_stack:13836kB pagetables:4156kB sec_pagetables:0kB all_unreclaimable? no Balloon:0kB gpu_active:0kB gpu_reclaim:0kB [ 804.420817][T26712] Node 1 active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:200kB unevictable:1536kB isolated(anon):0kB isolated(file):0kB mapped:0kB dirty:0kB writeback:0kB shmem:1536kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB kernel_stack:64kB pagetables:132kB sec_pagetables:0kB all_unreclaimable? no Balloon:0kB gpu_active:0kB gpu_reclaim:0kB [ 804.469029][T26712] Node 0 DMA free:15360kB boost:0kB min:208kB low:260kB high:312kB reserved_highatomic:0KB free_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB zspages:0kB present:15992kB managed:15360kB mlocked:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB [ 804.511143][T26712] lowmem_reserve[]: 0 2491 2492 2492 2492 [ 804.520926][T26723] netlink: 20 bytes leftover after parsing attributes in process `syz.1.6109'. [ 804.547284][T26712] Node 0 DMA32 free:1276068kB boost:0kB min:34184kB low:42728kB high:51272kB reserved_highatomic:0KB free_highatomic:0KB active_anon:32988kB inactive_anon:0kB active_file:1088kB inactive_file:173760kB unevictable:1536kB writepending:868kB zspages:0kB present:3129332kB managed:2551424kB mlocked:0kB bounce:0kB free_pcp:34020kB local_pcp:16052kB free_cma:0kB [ 804.548719][T26723] netlink: 'syz.1.6109': attribute type 1 has an invalid length. [ 804.624059][T26712] lowmem_reserve[]: 0 0 0 0 0 [ 804.629428][T26712] Node 0 Normal free:0kB boost:0kB min:8kB low:8kB high:8kB reserved_highatomic:0KB free_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB zspages:0kB present:1048580kB managed:620kB mlocked:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB [ 804.638226][ T4947] Bluetooth: hci5: unexpected cc 0x0c03 length: 249 > 1 [ 804.681247][ T4947] Bluetooth: hci5: unexpected cc 0x1003 length: 249 > 9 [ 804.692741][ T4947] Bluetooth: hci5: unexpected cc 0x1001 length: 249 > 9 [ 804.704449][ T4947] Bluetooth: hci5: unexpected cc 0x0c23 length: 249 > 4 [ 804.712501][ T4947] Bluetooth: hci5: unexpected cc 0x0c38 length: 249 > 2 [ 804.760043][T26712] lowmem_reserve[]: 0 0 0 0 0 [ 804.799726][T26712] Node 1 Normal free:3939760kB boost:0kB min:55708kB low:69632kB high:83556kB reserved_highatomic:0KB free_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:200kB unevictable:1536kB writepending:0kB zspages:0kB present:4194300kB managed:4111100kB mlocked:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB [ 804.883792][T26712] lowmem_reserve[]: 0 0 0 0 0 [ 804.922652][T26712] Node 0 DMA: 0*4kB 0*8kB 0*16kB 0*32kB 0*64kB 0*128kB 0*256kB 0*512kB 1*1024kB (U) 1*2048kB (M) 3*4096kB (M) = 15360kB [ 804.976986][T26712] Node 0 DMA32: 1759*4kB (UM) 1987*8kB (UME) 755*16kB (UME) 1247*32kB (UME) 390*64kB (UME) 147*128kB (UME) 59*256kB (UME) 71*512kB (UME) 42*1024kB (UM) 29*2048kB (UME) 250*4096kB (UM) = 1296548kB [ 805.047865][T26712] Node 0 Normal: 0*4kB 0*8kB 0*16kB 0*32kB 0*64kB 0*128kB 0*256kB 0*512kB 0*1024kB 0*2048kB 0*4096kB = 0kB [ 805.084760][T26712] Node 1 Normal: 2*4kB (UM) 5*8kB (UM) 10*16kB (UM) 7*32kB (UM) 6*64kB (UM) 3*128kB (UM) 5*256kB (UM) 4*512kB (UM) 1*1024kB (M) 1*2048kB (U) 960*4096kB (UM) = 3939760kB [ 805.141033][T26712] Node 0 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 805.194036][T26712] Node 0 hugepages_total=2 hugepages_free=2 hugepages_surp=0 hugepages_size=2048kB [ 805.206799][T26712] Node 1 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 805.229247][T26712] Node 1 hugepages_total=2 hugepages_free=2 hugepages_surp=0 hugepages_size=2048kB [ 805.268614][T26712] 45070 total pagecache pages [ 805.296558][T26712] 0 pages in swap cache [ 805.308851][T26712] Free swap = 124996kB [ 805.318989][T26712] Total swap = 124996kB [ 805.342833][T26712] 2097051 pages RAM [ 805.366128][T26712] 0 pages HighMem/MovableOnly [ 805.386111][T26712] 427425 pages reserved [ 805.390370][T26712] 0 pages cma reserved [ 805.752691][T26762] netlink: 24 bytes leftover after parsing attributes in process `syz.2.6116'. [ 805.990115][T26769] bridge7: entered promiscuous mode [ 806.037213][T26769] bridge7: entered allmulticast mode [ 806.534902][T26800] geneve3: entered promiscuous mode [ 806.722365][T26727] bridge0: port 1(bridge_slave_0) entered blocking state [ 806.738031][T26727] bridge0: port 1(bridge_slave_0) entered disabled state [ 806.745735][T26727] bridge_slave_0: entered allmulticast mode [ 806.757397][T26727] bridge_slave_0: entered promiscuous mode [ 806.767355][T26727] bridge0: port 2(bridge_slave_1) entered blocking state [ 806.775028][T26727] bridge0: port 2(bridge_slave_1) entered disabled state [ 806.783978][T26727] bridge_slave_1: entered allmulticast mode [ 806.792538][T26727] bridge_slave_1: entered promiscuous mode [ 806.806606][ T5650] Bluetooth: hci5: command tx timeout [ 806.937287][T26727] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 806.971564][T26727] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 806.988834][T26812] netlink: 12 bytes leftover after parsing attributes in process `syz.3.6128'. [ 807.121110][T26727] team0: Port device team_slave_0 added [ 807.182269][T26727] team0: Port device team_slave_1 added [ 807.359587][T26820] syzkaller0: entered promiscuous mode [ 807.381405][T26820] syzkaller0: entered allmulticast mode [ 807.436544][T26820] simple: basic_1 [ 807.463757][T26727] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 807.489351][T26727] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 807.587771][T26727] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 807.633981][T26727] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 807.652829][T26727] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 807.694409][T26727] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 807.891188][T26862] netlink: 8 bytes leftover after parsing attributes in process `syz.3.6139'. [ 807.928594][T26839] netlink: 830 bytes leftover after parsing attributes in process `syz.1.6132'. [ 807.950253][T26862] netlink: 8 bytes leftover after parsing attributes in process `syz.3.6139'. [ 807.977697][T26862] netlink: 8 bytes leftover after parsing attributes in process `syz.3.6139'. [ 808.011570][T26727] hsr_slave_0: entered promiscuous mode [ 808.018385][T26727] hsr_slave_1: entered promiscuous mode [ 808.587992][T26889] netlink: 'syz.3.6148': attribute type 27 has an invalid length. [ 808.597193][T26884] syzkaller0: entered promiscuous mode [ 808.615506][T26884] syzkaller0: entered allmulticast mode [ 808.622443][T26889] netlink: 'syz.3.6148': attribute type 4 has an invalid length. [ 808.635272][T26889] __nla_validate_parse: 47 callbacks suppressed [ 808.635326][T26889] netlink: 152 bytes leftover after parsing attributes in process `syz.3.6148'. [ 808.843826][T26902] netlink: 8 bytes leftover after parsing attributes in process `syz.3.6151'. [ 808.876171][ T5650] Bluetooth: hci5: command tx timeout [ 808.925822][T26904] netlink: 8 bytes leftover after parsing attributes in process `syz.2.6152'. [ 808.940996][T26904] netlink: 24 bytes leftover after parsing attributes in process `syz.2.6152'. [ 808.988994][T26904] netlink: 8 bytes leftover after parsing attributes in process `syz.2.6152'. [ 809.017848][T26904] netlink: 24 bytes leftover after parsing attributes in process `syz.2.6152'. [ 809.056369][T26904] netlink: 8 bytes leftover after parsing attributes in process `syz.2.6152'. [ 809.067596][T26904] netlink: 24 bytes leftover after parsing attributes in process `syz.2.6152'. [ 809.404644][T26918] netlink: 12 bytes leftover after parsing attributes in process `syz.4.6155'. [ 809.421592][T26918] netlink: 60 bytes leftover after parsing attributes in process `syz.4.6155'. [ 809.463045][T26922] pimreg: entered allmulticast mode [ 810.310927][T26953] bond0: (slave bridge0): Enslaving as an active interface with an up link [ 810.467444][T26943] syzkaller0: entered promiscuous mode [ 810.473263][T26943] syzkaller0: entered allmulticast mode [ 810.491057][T26956] macvlan0: entered promiscuous mode [ 810.506247][T26956] macvlan0: entered allmulticast mode [ 810.512040][T26956] bond0: (slave macvlan0): Error -98 calling set_mac_address [ 810.541425][T26968] openvswitch: netlink: IP tunnel attribute has 236 unknown bytes. [ 810.962510][ T5650] Bluetooth: hci5: command tx timeout [ 812.978122][T26727] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 813.001264][T26727] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 813.027253][T26727] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 813.046900][ T5650] Bluetooth: hci5: command tx timeout [ 813.089923][T26727] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 813.120869][T26727] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 813.138830][T26727] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 813.151498][T26727] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 813.169625][T26727] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 813.318600][T26727] 8021q: adding VLAN 0 to HW filter on device bond0 [ 813.364065][T26727] 8021q: adding VLAN 0 to HW filter on device team0 [ 813.399649][ T12] bridge0: port 1(bridge_slave_0) entered blocking state [ 813.406866][ T12] bridge0: port 1(bridge_slave_0) entered forwarding state [ 813.431812][ T12] bridge0: port 2(bridge_slave_1) entered blocking state [ 813.439011][ T12] bridge0: port 2(bridge_slave_1) entered forwarding state [ 813.765180][ T1174] netdevsim netdevsim3 netdevsim0: unset [0, 0] type 1 family 0 port 8472 - 0 [ 813.786396][ T1174] netdevsim netdevsim3 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 814.025451][T27043] netlink: 'syz.1.6188': attribute type 1 has an invalid length. [ 814.037243][T27047] __nla_validate_parse: 52 callbacks suppressed [ 814.037262][T27047] netlink: 12 bytes leftover after parsing attributes in process `syz.4.6190'. [ 814.089772][T27043] 8021q: adding VLAN 0 to HW filter on device bond3 [ 814.103378][T27043] hsr0: A HSR master's MTU cannot be greater than the smallest MTU of its slaves minus the HSR Tag length (6 octets). [ 814.124840][T27043] geneve2: entered promiscuous mode [ 814.130948][T27043] geneve2: entered allmulticast mode [ 814.550762][T27069] netlink: 'syz.2.6196': attribute type 1 has an invalid length. [ 814.799033][T26727] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 814.915668][T27087] netlink: 8 bytes leftover after parsing attributes in process `syz.1.6200'. [ 814.934409][T26727] veth0_vlan: entered promiscuous mode [ 814.945861][T27087] netlink: 'syz.1.6200': attribute type 1 has an invalid length. [ 814.961078][T26727] veth1_vlan: entered promiscuous mode [ 814.970546][T27087] netlink: 232 bytes leftover after parsing attributes in process `syz.1.6200'. [ 815.008597][T27087] netlink: 'syz.1.6200': attribute type 1 has an invalid length. [ 815.047041][T26727] veth0_macvtap: entered promiscuous mode [ 815.061375][T26727] veth1_macvtap: entered promiscuous mode [ 815.091078][T26727] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 815.119332][T26727] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 815.167647][ T3310] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 815.179329][ T3310] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 815.476588][ T3310] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 815.516134][ T3310] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 815.797007][T23413] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 815.829232][T23413] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 815.934887][T23413] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 815.972942][T27100] netlink: 52 bytes leftover after parsing attributes in process `syz.1.6205'. [ 815.982246][T23413] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 816.078950][T27127] netlink: 'syz.1.6205': attribute type 2 has an invalid length. [ 816.598222][T27213] netlink: 'syz.0.6210': attribute type 2 has an invalid length. [ 817.650287][T27246] netlink: 'syz.4.6211': attribute type 1 has an invalid length. [ 817.729811][T27246] 8021q: adding VLAN 0 to HW filter on device bond8 [ 817.903668][T27249] bond8: (slave bridge3): making interface the new active one [ 817.921076][T27249] bond8: (slave bridge3): Enslaving as an active interface with an up link [ 818.907568][T27099] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 818.960022][T27201] netlink: 256 bytes leftover after parsing attributes in process `syz.0.6210'. [ 819.356572][T27272] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 819.374402][T27272] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 819.388165][T27272] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 819.400529][T27272] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 819.410628][T27272] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 819.759739][T27280] openvswitch: netlink: ERSPAN option length err (len 256, max 255). [ 819.950838][T27289] netlink: 12 bytes leftover after parsing attributes in process `syz.1.6221'. [ 820.351113][T27310] netlink: 16 bytes leftover after parsing attributes in process `syz.2.6227'. [ 820.389696][T27310] netlink: 'syz.2.6227': attribute type 1 has an invalid length. [ 820.413622][T27310] netlink: 'syz.2.6227': attribute type 2 has an invalid length. [ 820.450111][T27312] netlink: 'syz.2.6227': attribute type 1 has an invalid length. [ 820.481823][T27312] netlink: 'syz.2.6227': attribute type 2 has an invalid length. [ 820.514604][T15697] bond2: (slave syz_tun): Releasing backup interface [ 820.595889][T27315] syzkaller0: entered promiscuous mode [ 820.610913][T27315] syzkaller0: entered allmulticast mode [ 820.668545][T27315] netlink: 'syz.1.6229': attribute type 33 has an invalid length. [ 820.686508][T27325] netlink: 12 bytes leftover after parsing attributes in process `syz.2.6231'. [ 820.821733][T27315] bond4: option broadcast_neighbor: mode dependency failed, not supported in mode balance-rr(0) [ 820.950182][ T30] audit: type=1800 audit(1782975164.331:13): pid=27331 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.2.6232" name="memory.events" dev="tmpfs" ino=2930 res=0 errno=0 [ 821.270140][T27315] bond4 (unregistering): Released all slaves [ 821.445477][ T5650] Bluetooth: hci2: command tx timeout [ 821.474966][T27339] xt_CT: You must specify a L4 protocol and not use inversions on it [ 821.486028][T27339] xt_hl: Unknown Hop Limit match mode: 206 [ 821.565691][T27342] Can not set IPV6_FL_F_REFLECT if flowlabel_consistency sysctl is enable [ 821.943479][T27269] bridge0: port 1(bridge_slave_0) entered blocking state [ 821.957870][T27269] bridge0: port 1(bridge_slave_0) entered disabled state [ 821.970326][T27269] bridge_slave_0: entered allmulticast mode [ 821.983542][T27269] bridge_slave_0: entered promiscuous mode [ 821.983983][T27358] netlink: 28 bytes leftover after parsing attributes in process `syz.4.6239'. [ 822.030411][T27269] bridge0: port 2(bridge_slave_1) entered blocking state [ 822.062630][T27269] bridge0: port 2(bridge_slave_1) entered disabled state [ 822.100890][T27269] bridge_slave_1: entered allmulticast mode [ 822.125083][T27269] bridge_slave_1: entered promiscuous mode [ 822.333106][T27269] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 822.416634][T27383] netlink: 8 bytes leftover after parsing attributes in process `syz.1.6245'. [ 822.428160][T27379] bond9: Unable to set peer notification delay as MII monitoring is disabled [ 822.438939][T27379] bond9 (unregistering): Released all slaves [ 822.482547][T27269] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 822.602090][T27269] team0: Port device team_slave_0 added [ 822.620903][T27269] team0: Port device team_slave_1 added [ 822.670735][T27397] netlink: 'syz.1.6247': attribute type 1 has an invalid length. [ 822.698607][T27397] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 822.705874][T27397] IPv6: NLM_F_CREATE should be set when creating new route [ 822.713233][T27397] IPv6: NLM_F_CREATE should be set when creating new route [ 822.725660][T27401] sctp: [Deprecated]: syz.4.6248 (pid 27401) Use of struct sctp_assoc_value in delayed_ack socket option. [ 822.725660][T27401] Use struct sctp_sack_info instead [ 822.807769][T27404] netlink: 4 bytes leftover after parsing attributes in process `syz.4.6248'. [ 822.819918][T27269] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 822.830823][T27406] netlink: 8 bytes leftover after parsing attributes in process `syz.1.6250'. [ 822.846891][T27269] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 822.877724][T27269] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 822.955647][T27269] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 822.992517][T27269] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 823.093985][T27415] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 823.105274][T27269] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 823.130751][T27419] netlink: 180 bytes leftover after parsing attributes in process `syz.0.6254'. [ 823.153285][T27415] mac80211_hwsim hwsim27 ÿ: renamed from wlan1 [ 823.312439][T27269] hsr_slave_0: entered promiscuous mode [ 823.331077][T27269] hsr_slave_1: entered promiscuous mode [ 823.351728][T27269] debugfs: 'hsr0' already exists in 'hsr' [ 823.374817][T27269] Cannot create hsr debugfs directory [ 823.389926][T27427] netlink: 'syz.2.6255': attribute type 4 has an invalid length. [ 823.516275][ T5650] Bluetooth: hci2: command tx timeout [ 823.574595][T27437] netlink: 'syz.2.6259': attribute type 6 has an invalid length. [ 823.592777][T27438] netlink: 36 bytes leftover after parsing attributes in process `syz.4.6260'. [ 824.028421][T27269] netdevsim netdevsim3 netdevsim3 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 824.056741][T27269] netdevsim netdevsim3 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 824.311172][T27269] netdevsim netdevsim3 netdevsim2 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 824.344148][T27269] netdevsim netdevsim3 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 824.352086][T27464] netlink: 28 bytes leftover after parsing attributes in process `syz.2.6269'. [ 824.544583][T27269] netdevsim netdevsim3 netdevsim1 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 824.565670][T27269] netdevsim netdevsim3 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 825.225997][T27507] __nla_validate_parse: 3 callbacks suppressed [ 825.245308][T27507] netlink: 8 bytes leftover after parsing attributes in process `syz.2.6280'. [ 825.254559][T27506] netlink: 'syz.4.6281': attribute type 16 has an invalid length. [ 825.263554][T27506] netlink: 'syz.4.6281': attribute type 17 has an invalid length. [ 825.300207][T27509] netlink: 28 bytes leftover after parsing attributes in process `syz.4.6281'. [ 825.315836][T27509] netlink: 32 bytes leftover after parsing attributes in process `syz.4.6281'. [ 825.329140][T27506] erspan0: left allmulticast mode [ 825.346756][T27506] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 825.412406][T27506] macvtap0: left allmulticast mode [ 825.419344][T27506] veth0_macvtap: left allmulticast mode [ 825.470218][T27506] A link change request failed with some changes committed already. Interface ÿ may have been left with an inconsistent configuration, please check. [ 825.569424][T27513] netlink: 24 bytes leftover after parsing attributes in process `syz.2.6284'. [ 825.596686][ T5650] Bluetooth: hci2: command tx timeout [ 825.981741][T27529] netlink: 12 bytes leftover after parsing attributes in process `syz.4.6289'. [ 827.676608][ T5650] Bluetooth: hci2: command tx timeout [ 827.754106][T27482] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 827.785351][T27269] netdevsim netdevsim3 netdevsim0: renamed from eth0 [ 827.809395][T27269] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 827.825923][T27269] netdevsim netdevsim3 netdevsim1: renamed from eth1 [ 827.887966][T27269] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 827.914035][T27269] netdevsim netdevsim3 netdevsim2: renamed from eth2 [ 827.938779][T27269] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 827.953320][T27269] netdevsim netdevsim3 netdevsim3: renamed from eth3 [ 827.974565][T27269] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 828.002115][T27540] netlink: 8 bytes leftover after parsing attributes in process `syz.0.6292'. [ 828.041383][T27540] netdevsim netdevsim0 netdevsim0: entered promiscuous mode [ 828.053473][T27540] netlink: 184 bytes leftover after parsing attributes in process `syz.0.6292'. [ 828.117366][T27551] netlink: 'syz.2.6293': attribute type 4 has an invalid length. [ 828.141599][T27551] netlink: 17 bytes leftover after parsing attributes in process `syz.2.6293'. [ 828.317897][T27269] 8021q: adding VLAN 0 to HW filter on device bond0 [ 828.333029][T27560] netlink: 44 bytes leftover after parsing attributes in process `syz.0.6297'. [ 828.415477][T27269] 8021q: adding VLAN 0 to HW filter on device team0 [ 828.450284][ T14] bridge0: port 1(bridge_slave_0) entered blocking state [ 828.457502][ T14] bridge0: port 1(bridge_slave_0) entered forwarding state [ 828.499693][T10112] bridge0: port 2(bridge_slave_1) entered blocking state [ 828.507006][T10112] bridge0: port 2(bridge_slave_1) entered forwarding state [ 828.867791][T27571] sch_tbf: burst 19872 is lower than device lo mtu (65550) ! [ 830.042234][T27595] netlink: 'syz.4.6309': attribute type 21 has an invalid length. [ 830.080810][T27595] netlink: 128 bytes leftover after parsing attributes in process `syz.4.6309'. [ 830.108460][T27601] netlink: 'syz.4.6309': attribute type 21 has an invalid length. [ 830.129261][T27602] Cannot find set identified by id 0 to match [ 830.136462][T27595] netlink: 'syz.4.6309': attribute type 4 has an invalid length. [ 830.154520][T27595] netlink: 'syz.4.6309': attribute type 5 has an invalid length. [ 830.175233][T27601] netlink: 'syz.4.6309': attribute type 4 has an invalid length. [ 830.197081][T27601] netlink: 'syz.4.6309': attribute type 5 has an invalid length. [ 830.229648][T27595] netlink: 'syz.4.6309': attribute type 21 has an invalid length. [ 831.143351][T27269] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 831.469487][T27269] veth0_vlan: entered promiscuous mode [ 831.510209][T27269] veth1_vlan: entered promiscuous mode [ 831.633013][T27269] veth0_macvtap: entered promiscuous mode [ 831.681948][T27269] veth1_macvtap: entered promiscuous mode [ 831.744299][T27269] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 831.781469][T27269] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 831.814634][ T14] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 831.842377][ T14] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 831.890727][ T14] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 832.001277][T27651] bridge0: port 2(bridge_slave_1) entered disabled state [ 832.009023][T27651] bridge0: port 1(bridge_slave_0) entered disabled state [ 832.077321][T27651] A link change request failed with some changes committed already. Interface bridge_slave_0 may have been left with an inconsistent configuration, please check. [ 832.097497][ T14] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 832.395601][ T3310] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 832.418399][ T3310] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 832.426472][T27667] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 832.444792][T27671] __nla_validate_parse: 6 callbacks suppressed [ 832.444811][T27671] netlink: 576 bytes leftover after parsing attributes in process `syz.4.6331'. [ 832.530590][ T3310] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 832.539917][T27675] netlink: 24 bytes leftover after parsing attributes in process `syz.0.6333'. [ 832.551683][ T3310] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 832.565775][T27674] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 832.765613][T27684] veth1_to_bond: entered allmulticast mode [ 832.807988][ T3310] netdevsim netdevsim3 netdevsim0: set [0, 0] type 1 family 0 port 8472 - 0 [ 832.830620][ T3310] netdevsim netdevsim3 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0 [ 832.858365][T27684] veth1_to_bond: entered promiscuous mode [ 832.866343][ T3310] netdevsim netdevsim3 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0 [ 832.895955][ T3310] netdevsim netdevsim3 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0 [ 832.931814][T27683] veth1_to_bond: left promiscuous mode [ 832.942867][T27683] veth1_to_bond: left allmulticast mode [ 833.148623][T27696] netlink: 8 bytes leftover after parsing attributes in process `syz.3.6341'. [ 833.254988][T27272] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 833.265903][T27272] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 833.283046][T27272] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 833.296856][T27272] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 833.311795][T27272] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 833.550263][T27708] xt_time: unknown flags 0xf4 [ 833.614770][T27711] netlink: 12 bytes leftover after parsing attributes in process `syz.4.6342'. [ 834.382646][T27745] netlink: 8 bytes leftover after parsing attributes in process `syz.4.6352'. [ 834.404806][T27745] netlink: 44 bytes leftover after parsing attributes in process `syz.4.6352'. [ 834.429038][T27748] netlink: 8 bytes leftover after parsing attributes in process `syz.4.6352'. [ 834.442127][T27748] netlink: 44 bytes leftover after parsing attributes in process `syz.4.6352'. [ 834.617133][T27755] tipc: Started in network mode [ 834.635051][T27755] tipc: Node identity e0000001, cluster identity 4711 [ 834.664783][T27755] tipc: Enabling of bearer rejected, failed to enable media [ 834.682067][T27759] netlink: 12 bytes leftover after parsing attributes in process `syz.1.6356'. [ 834.691605][T27759] bridge: RTM_NEWNEIGH with invalid ether address [ 834.986613][T27771] netlink: 8 bytes leftover after parsing attributes in process `syz.1.6359'. [ 835.219233][T27272] block nbd3: Receive control failed (result -32) [ 835.327630][T27702] bridge0: port 1(bridge_slave_0) entered blocking state [ 835.351624][T27702] bridge0: port 1(bridge_slave_0) entered disabled state [ 835.358966][T27272] Bluetooth: hci1: command tx timeout [ 835.376818][T27702] bridge_slave_0: entered allmulticast mode [ 835.385046][T27702] bridge_slave_0: entered promiscuous mode [ 835.394741][T27702] bridge0: port 2(bridge_slave_1) entered blocking state [ 835.402312][T27702] bridge0: port 2(bridge_slave_1) entered disabled state [ 835.409638][T27702] bridge_slave_1: entered allmulticast mode [ 835.420273][T27702] bridge_slave_1: entered promiscuous mode [ 835.510432][T27702] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 835.530470][T27702] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 835.663971][T27796] bond1: entered promiscuous mode [ 835.684325][T27796] bond1: entered allmulticast mode [ 835.703065][T27796] 8021q: adding VLAN 0 to HW filter on device bond1 [ 835.719783][T27702] team0: Port device team_slave_0 added [ 835.725674][T27809] bridge: RTM_NEWNEIGH with invalid ether address [ 835.736344][T27702] team0: Port device team_slave_1 added [ 835.741990][T27809] bridge: RTM_NEWNEIGH with invalid ether address [ 835.752065][T27809] FAULT_INJECTION: forcing a failure. [ 835.752065][T27809] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 835.768940][T27809] CPU: 1 UID: 0 PID: 27809 Comm: syz.0.6365 Not tainted syzkaller #0 PREEMPT(full) [ 835.768969][T27809] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 835.768983][T27809] Call Trace: [ 835.768992][T27809] [ 835.769001][T27809] dump_stack_lvl+0xe8/0x150 [ 835.769035][T27809] should_fail_ex+0x40c/0x560 [ 835.769071][T27809] _copy_from_user+0x2d/0xb0 [ 835.769105][T27809] __copy_msghdr+0x390/0x590 [ 835.769136][T27809] ___sys_sendmsg+0x213/0x360 [ 835.769159][T27809] ? __lock_acquire+0x683/0x2cf0 [ 835.769189][T27809] ? __pfx____sys_sendmsg+0x10/0x10 [ 835.769212][T27809] ? __lock_acquire+0x683/0x2cf0 [ 835.769240][T27809] ? kstrtouint+0x6e/0xe0 [ 835.769316][T27809] __sys_sendmmsg+0x273/0x4d0 [ 835.769348][T27809] ? __pfx___sys_sendmmsg+0x10/0x10 [ 835.769384][T27809] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 835.769423][T27809] ? ksys_write+0x242/0x270 [ 835.769454][T27809] ? __pfx_ksys_write+0x10/0x10 [ 835.769488][T27809] __x64_sys_sendmmsg+0xa0/0xc0 [ 835.769514][T27809] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 835.769538][T27809] do_syscall_64+0x174/0x580 [ 835.769559][T27809] ? trace_irq_disable+0x3b/0x140 [ 835.769581][T27809] ? clear_bhb_loop+0x40/0x90 [ 835.769610][T27809] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 835.769633][T27809] RIP: 0033:0x7f530719de59 [ 835.769654][T27809] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 835.769674][T27809] RSP: 002b:00007f5308102028 EFLAGS: 00000246 ORIG_RAX: 0000000000000133 [ 835.769698][T27809] RAX: ffffffffffffffda RBX: 00007f5307425fa0 RCX: 00007f530719de59 [ 835.769715][T27809] RDX: 04000000000001f2 RSI: 0000200000000000 RDI: 0000000000000004 [ 835.769730][T27809] RBP: 00007f5308102090 R08: 0000000000000000 R09: 0000000000000000 [ 835.769745][T27809] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 835.769759][T27809] R13: 00007f5307426038 R14: 00007f5307425fa0 R15: 00007ffc5fa91f48 [ 835.769800][T27809] [ 835.904548][T27702] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 836.014026][T27702] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 836.040294][T27702] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 836.053070][T27702] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 836.061596][T27702] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 836.093618][T27702] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 836.224646][T27702] hsr_slave_0: entered promiscuous mode [ 836.231117][T27702] hsr_slave_1: entered promiscuous mode [ 836.237713][T27702] debugfs: 'hsr0' already exists in 'hsr' [ 836.243709][T27702] Cannot create hsr debugfs directory [ 836.481419][T27702] netdevsim netdevsim2 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 836.492604][T27702] netdevsim netdevsim2 netdevsim3 (unregistering): unset [1, 1] type 2 family 0 port 20000 - 0 [ 836.567290][T27820] lo: entered promiscuous mode [ 836.573402][T27820] tunl0: entered promiscuous mode [ 836.579535][T27820] gre0: entered promiscuous mode [ 836.584918][T27820] gretap0: entered promiscuous mode [ 836.592583][T27820] erspan0: entered promiscuous mode [ 836.598972][T27820] ip_vti0: entered promiscuous mode [ 836.640883][T27702] netdevsim netdevsim2 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 836.651448][T27702] netdevsim netdevsim2 netdevsim2 (unregistering): unset [1, 1] type 2 family 0 port 20000 - 0 [ 836.714700][T27702] bond0: (slave netdevsim1): Releasing backup interface [ 836.730321][T27702] netdevsim netdevsim2 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 836.741506][T27702] netdevsim netdevsim2 netdevsim1 (unregistering): unset [1, 1] type 2 family 0 port 20000 - 0 [ 836.823928][T27702] netdevsim netdevsim2 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 836.834383][T27702] netdevsim netdevsim2 netdevsim0 (unregistering): unset [1, 1] type 2 family 0 port 20000 - 0 [ 837.437121][T27272] Bluetooth: hci1: command tx timeout [ 837.997573][T27775] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 838.052556][T27702] netdevsim netdevsim2 netdevsim0: renamed from eth0 [ 838.084295][T27830] __nla_validate_parse: 4 callbacks suppressed [ 838.084315][T27830] netlink: 4 bytes leftover after parsing attributes in process `syz.3.6371'. [ 838.173385][T27702] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 838.207694][T27702] netdevsim netdevsim2 netdevsim1: renamed from eth1 [ 838.248839][T27702] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 838.274559][T27702] netdevsim netdevsim2 netdevsim2: renamed from eth2 [ 838.282921][T27839] netlink: 8 bytes leftover after parsing attributes in process `syz.4.6374'. [ 838.296810][T27702] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 838.324493][T27839] netdevsim netdevsim4 netdevsim0: entered promiscuous mode [ 838.337932][T27839] netlink: 184 bytes leftover after parsing attributes in process `syz.4.6374'. [ 838.348468][T27702] netdevsim netdevsim2 netdevsim3: renamed from eth3 [ 838.364047][T27702] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 838.429351][T27844] netlink: 4 bytes leftover after parsing attributes in process `syz.0.6376'. [ 838.561492][T27853] ip6_vti0: Master is either lo or non-ether device [ 838.584715][T27853] syz_tun: entered allmulticast mode [ 838.624978][T27853] dvmrp8: entered allmulticast mode [ 838.683854][T27852] syz_tun: left allmulticast mode [ 838.792930][T27702] 8021q: adding VLAN 0 to HW filter on device bond0 [ 838.830899][T27702] 8021q: adding VLAN 0 to HW filter on device team0 [ 838.854993][ T1017] bridge0: port 1(bridge_slave_0) entered blocking state [ 838.862241][ T1017] bridge0: port 1(bridge_slave_0) entered forwarding state [ 838.893583][T27873] netlink: 12 bytes leftover after parsing attributes in process `syz.4.6383'. [ 838.920105][ T7421] bridge0: port 2(bridge_slave_1) entered blocking state [ 838.927472][ T7421] bridge0: port 2(bridge_slave_1) entered forwarding state [ 838.940715][T27873] netlink: 'syz.4.6383': attribute type 1 has an invalid length. [ 838.993245][T27873] netlink: 'syz.4.6383': attribute type 1 has an invalid length. [ 839.016311][T27873] netlink: 'syz.4.6383': attribute type 2 has an invalid length. [ 839.027960][T27873] netlink: 68 bytes leftover after parsing attributes in process `syz.4.6383'. [ 839.518495][ T5650] Bluetooth: hci1: command tx timeout [ 841.436975][ T5650] Bluetooth: hci0: command 0x0406 tx timeout [ 841.593485][T27898] netlink: 8 bytes leftover after parsing attributes in process `syz.1.6392'. [ 841.602665][T27272] Bluetooth: hci1: command tx timeout [ 841.892051][T27917] FAULT_INJECTION: forcing a failure. [ 841.892051][T27917] name failslab, interval 1, probability 0, space 0, times 0 [ 841.906985][T27917] CPU: 0 UID: 0 PID: 27917 Comm: syz.1.6397 Not tainted syzkaller #0 PREEMPT(full) [ 841.907017][T27917] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 841.907031][T27917] Call Trace: [ 841.907039][T27917] [ 841.907049][T27917] dump_stack_lvl+0xe8/0x150 [ 841.907081][T27917] should_fail_ex+0x40c/0x560 [ 841.907134][T27917] should_failslab+0xa8/0x100 [ 841.907163][T27917] kmem_cache_alloc_node_noprof+0xb3/0x610 [ 841.907195][T27917] ? local_lock_release+0x9c/0x160 [ 841.907232][T27917] ? __alloc_skb+0x1d7/0x7a0 [ 841.907250][T27917] ? __alloc_skb+0x1d7/0x7a0 [ 841.907279][T27917] __alloc_skb+0x1d7/0x7a0 [ 841.907305][T27917] netlink_dump+0x1e7/0xee0 [ 841.907344][T27917] ? __pfx_netlink_dump+0x10/0x10 [ 841.907383][T27917] ? netlink_recvmsg+0x5bf/0xa50 [ 841.907407][T27917] ? kmem_cache_free+0x182/0x650 [ 841.907437][T27917] netlink_recvmsg+0x683/0xa50 [ 841.907474][T27917] ? __pfx_netlink_recvmsg+0x10/0x10 [ 841.907505][T27917] ? __pfx___up_read+0x10/0x10 [ 841.907535][T27917] ? aa_sock_msg_perm+0xf1/0x1b0 [ 841.907565][T27917] ? bpf_lsm_socket_recvmsg+0x9/0x20 [ 841.907594][T27917] ? security_socket_recvmsg+0x7e/0x2c0 [ 841.907719][T27917] ? __pfx_netlink_recvmsg+0x10/0x10 [ 841.907746][T27917] sock_recvmsg+0x196/0x1e0 [ 841.907781][T27917] ____sys_recvmsg+0x1e6/0x4a0 [ 841.907817][T27917] ? __pfx_____sys_recvmsg+0x10/0x10 [ 841.907861][T27917] ? import_iovec+0x73/0xa0 [ 841.907890][T27917] ___sys_recvmsg+0x213/0x5a0 [ 841.907922][T27917] ? __pfx____sys_recvmsg+0x10/0x10 [ 841.907954][T27917] ? __fget_files+0x2a/0x420 [ 841.907997][T27917] ? __fget_files+0x3a2/0x420 [ 841.908032][T27917] do_recvmmsg+0x31a/0x7f0 [ 841.908081][T27917] ? __pfx_do_recvmmsg+0x10/0x10 [ 841.908137][T27917] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 841.908162][T27917] ? __fget_files+0x3a2/0x420 [ 841.908197][T27917] __x64_sys_recvmmsg+0x198/0x250 [ 841.908228][T27917] ? __pfx___x64_sys_recvmmsg+0x10/0x10 [ 841.908265][T27917] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 841.908291][T27917] do_syscall_64+0x174/0x580 [ 841.908311][T27917] ? trace_irq_disable+0x3b/0x140 [ 841.908333][T27917] ? clear_bhb_loop+0x40/0x90 [ 841.908362][T27917] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 841.908385][T27917] RIP: 0033:0x7f92f3d9de59 [ 841.908405][T27917] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 841.908425][T27917] RSP: 002b:00007f92f4be2028 EFLAGS: 00000246 ORIG_RAX: 000000000000012b [ 841.908449][T27917] RAX: ffffffffffffffda RBX: 00007f92f4025fa0 RCX: 00007f92f3d9de59 [ 841.908465][T27917] RDX: 08000000000001ac RSI: 00002000000077c0 RDI: 0000000000000003 [ 841.908481][T27917] RBP: 00007f92f4be2090 R08: 0000000000000000 R09: 0000000000000000 [ 841.908494][T27917] R10: 0000000000002140 R11: 0000000000000246 R12: 0000000000000001 [ 841.908508][T27917] R13: 00007f92f4026038 R14: 00007f92f4025fa0 R15: 00007fff0c7d9108 [ 841.908545][T27917] [ 842.549943][T27932] netlink: 16 bytes leftover after parsing attributes in process `syz.1.6400'. [ 842.700673][T27942] netlink: 16 bytes leftover after parsing attributes in process `syz.0.6404'. [ 842.859768][T27947] netlink: 'syz.3.6405': attribute type 4 has an invalid length. [ 842.980430][T27702] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 843.522517][T27963] FAULT_INJECTION: forcing a failure. [ 843.522517][T27963] name fail_page_alloc, interval 1, probability 0, space 0, times 1 [ 843.537115][T27702] veth0_vlan: entered promiscuous mode [ 843.569967][T27963] CPU: 0 UID: 0 PID: 27963 Comm: syz.0.6409 Not tainted syzkaller #0 PREEMPT(full) [ 843.569995][T27963] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 843.570009][T27963] Call Trace: [ 843.570017][T27963] [ 843.570026][T27963] dump_stack_lvl+0xe8/0x150 [ 843.570059][T27963] should_fail_ex+0x40c/0x560 [ 843.570096][T27963] prepare_alloc_pages+0x230/0x650 [ 843.570130][T27963] __alloc_frozen_pages_noprof+0x12f/0x380 [ 843.570159][T27963] ? __pfx___alloc_frozen_pages_noprof+0x10/0x10 [ 843.570189][T27963] ? __pfx_policy_nodemask+0x10/0x10 [ 843.570215][T27963] ? __pfx_rtnl_dump_ifinfo+0x10/0x10 [ 843.570317][T27963] ? stack_trace_save+0xa9/0x100 [ 843.570362][T27963] alloc_pages_mpol+0x212/0x380 [ 843.570395][T27963] folio_alloc_mpol_noprof+0x39/0x160 [ 843.570437][T27963] vma_alloc_folio_noprof+0xe1/0x1e0 [ 843.570478][T27963] ? __pfx_vma_alloc_folio_noprof+0x10/0x10 [ 843.570522][T27963] do_wp_page+0x1163/0x4c70 [ 843.570576][T27963] ? __pfx_do_wp_page+0x10/0x10 [ 843.570600][T27963] ? do_raw_spin_lock+0x12b/0x2f0 [ 843.570632][T27963] ? __pfx_do_raw_spin_lock+0x10/0x10 [ 843.570671][T27963] handle_mm_fault+0x1490/0x3080 [ 843.570711][T27963] ? handle_mm_fault+0xec/0x3080 [ 843.570767][T27963] ? __pfx_handle_mm_fault+0x10/0x10 [ 843.570811][T27963] ? _raw_spin_unlock_irqrestore+0x30/0x80 [ 843.570873][T27963] ? lockdep_hardirqs_on+0x7a/0x110 [ 843.570910][T27963] ? lock_mm_and_find_vma+0xa7/0x340 [ 843.570946][T27963] do_user_addr_fault+0x744/0x1340 [ 843.571000][T27963] exc_page_fault+0x6a/0xc0 [ 843.571034][T27963] asm_exc_page_fault+0x26/0x30 [ 843.571055][T27963] RIP: 0010:__put_user_nocheck_4+0x3/0x20 [ 843.571089][T27963] Code: d9 0f 01 cb 89 01 31 c9 0f 01 ca e9 57 91 03 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 0f 01 cb <89> 01 31 c9 0f 01 ca c3 cc cc cc cc 90 90 90 90 90 90 90 90 90 90 [ 843.571108][T27963] RSP: 0018:ffffc9000369f8d8 EFLAGS: 00050202 [ 843.571128][T27963] RAX: 0000000000000020 RBX: 0000000000000020 RCX: 00002000000077f0 [ 843.571142][T27963] RDX: ffff888076dcdd00 RSI: 0000000000002140 RDI: 00000000ffffffff [ 843.571157][T27963] RBP: ffffc9000369fa50 R08: ffffffff9032d6f7 R09: 1ffffffff2065ade [ 843.571173][T27963] R10: dffffc0000000000 R11: fffffbfff2065adf R12: 1ffff920006d3f28 [ 843.571189][T27963] R13: 0000000000002140 R14: 00002000000077c0 R15: dffffc0000000000 [ 843.571224][T27963] ____sys_recvmsg+0x2be/0x4a0 [ 843.571279][T27963] ? __pfx_____sys_recvmsg+0x10/0x10 [ 843.571323][T27963] ? import_iovec+0x73/0xa0 [ 843.571351][T27963] ___sys_recvmsg+0x213/0x5a0 [ 843.571384][T27963] ? __pfx____sys_recvmsg+0x10/0x10 [ 843.571415][T27963] ? __fget_files+0x2a/0x420 [ 843.571458][T27963] ? __fget_files+0x3a2/0x420 [ 843.571512][T27963] do_recvmmsg+0x31a/0x7f0 [ 843.571547][T27963] ? __pfx_do_recvmmsg+0x10/0x10 [ 843.571585][T27963] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 843.571608][T27963] ? __fget_files+0x3a2/0x420 [ 843.571641][T27963] __x64_sys_recvmmsg+0x198/0x250 [ 843.571670][T27963] ? __pfx___x64_sys_recvmmsg+0x10/0x10 [ 843.571705][T27963] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 843.571730][T27963] do_syscall_64+0x174/0x580 [ 843.571749][T27963] ? trace_irq_disable+0x3b/0x140 [ 843.571771][T27963] ? clear_bhb_loop+0x40/0x90 [ 843.571798][T27963] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 843.571819][T27963] RIP: 0033:0x7f530719de59 [ 843.571838][T27963] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 843.571855][T27963] RSP: 002b:00007f5308102028 EFLAGS: 00000246 ORIG_RAX: 000000000000012b [ 843.571876][T27963] RAX: ffffffffffffffda RBX: 00007f5307425fa0 RCX: 00007f530719de59 [ 843.571891][T27963] RDX: 08000000000001ac RSI: 00002000000077c0 RDI: 0000000000000003 [ 843.571905][T27963] RBP: 00007f5308102090 R08: 0000000000000000 R09: 0000000000000000 [ 843.571918][T27963] R10: 0000000000002140 R11: 0000000000000246 R12: 0000000000000001 [ 843.571930][T27963] R13: 00007f5307426038 R14: 00007f5307425fa0 R15: 00007ffc5fa91f48 [ 843.571964][T27963] [ 843.573572][T27702] veth1_vlan: entered promiscuous mode [ 844.119381][T27702] veth0_macvtap: entered promiscuous mode [ 844.156492][T27702] veth1_macvtap: entered promiscuous mode [ 844.278447][T27702] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 844.332726][T27702] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 844.369983][T27985] netlink: 12 bytes leftover after parsing attributes in process `syz.0.6415'. [ 844.389220][ T3310] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 844.421709][ T3310] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 844.505009][T27991] gtp0: entered allmulticast mode [ 844.522509][T27991] team0: Device gtp0 is of different type [ 844.553039][ T3310] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 844.591636][ T3310] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 844.917649][T28007] syzkaller0: entered promiscuous mode [ 844.923374][T28007] syzkaller0: entered allmulticast mode [ 844.931889][ T14] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 844.961779][ T14] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 845.004407][T28006] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 845.032140][ T1017] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 845.068694][ T1017] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 845.520867][T28025] netlink: 32 bytes leftover after parsing attributes in process `syz.3.6428'. [ 847.330777][T28019] bridge0: port 2(bridge_slave_1) entered disabled state [ 847.365769][T28024] netlink: 12 bytes leftover after parsing attributes in process `syz.3.6428'. [ 847.388747][T28024] bridge: RTM_NEWNEIGH with invalid ether address [ 847.569686][T28034] netlink: 8 bytes leftover after parsing attributes in process `syz.3.6431'. [ 847.580034][T28034] netlink: 8 bytes leftover after parsing attributes in process `syz.3.6431'. [ 847.590689][T28034] netlink: 8 bytes leftover after parsing attributes in process `syz.3.6431'. [ 847.606823][T28034] netlink: 8 bytes leftover after parsing attributes in process `syz.3.6431'. [ 848.075279][T28055] netlink: 52 bytes leftover after parsing attributes in process `syz.0.6439'. [ 848.080185][T28057] netlink: 20 bytes leftover after parsing attributes in process `syz.1.6441'. [ 848.101098][T28058] netlink: 12 bytes leftover after parsing attributes in process `syz.2.6440'. [ 848.126542][T28058] bridge: RTM_NEWNEIGH with invalid ether address [ 848.153861][T28058] bridge: RTM_NEWNEIGH with invalid ether address [ 848.286904][ T5650] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 848.302186][ T5650] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 848.317414][ T5650] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 848.345054][ T5650] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 848.359567][ T5650] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 848.508289][T28068] tipc: Enabling of bearer rejected, media not registered [ 848.799406][T28085] netlink: 'syz.3.6447': attribute type 10 has an invalid length. [ 848.828574][T28089] sch_tbf: burst 19872 is lower than device lo mtu (65550) ! [ 848.839230][T28091] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 848.850483][T28085] team0: entered allmulticast mode [ 848.856526][T28085] team_slave_0: entered allmulticast mode [ 848.871657][T28085] team_slave_1: entered allmulticast mode [ 848.899390][T28085] bridge0: port 3(team0) entered blocking state [ 848.925618][T28085] bridge0: port 3(team0) entered disabled state [ 848.951025][T28085] team0: entered promiscuous mode [ 848.975476][T28085] team_slave_0: entered promiscuous mode [ 849.007115][T28085] team_slave_1: entered promiscuous mode [ 849.032723][T28085] bridge0: port 3(team0) entered blocking state [ 849.039299][T28085] bridge0: port 3(team0) entered forwarding state [ 849.077919][T28099] bond0: (slave ip6gre0): Error: Device can not be enslaved while up [ 849.343530][ T5765] IPVS: starting estimator thread 0... [ 849.456849][T28113] IPVS: using max 29 ests per chain, 69600 per kthread [ 849.498825][T28121] FAULT_INJECTION: forcing a failure. [ 849.498825][T28121] name failslab, interval 1, probability 0, space 0, times 0 [ 849.514887][T28121] CPU: 0 UID: 0 PID: 28121 Comm: syz.3.6455 Not tainted syzkaller #0 PREEMPT(full) [ 849.514916][T28121] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 849.514931][T28121] Call Trace: [ 849.514940][T28121] [ 849.514950][T28121] dump_stack_lvl+0xe8/0x150 [ 849.514983][T28121] should_fail_ex+0x40c/0x560 [ 849.515031][T28121] should_failslab+0xa8/0x100 [ 849.515060][T28121] kmem_cache_alloc_node_noprof+0xb3/0x610 [ 849.515093][T28121] ? local_lock_release+0x9c/0x160 [ 849.515130][T28121] ? __alloc_skb+0x1d7/0x7a0 [ 849.515149][T28121] ? __alloc_skb+0x1d7/0x7a0 [ 849.515177][T28121] __alloc_skb+0x1d7/0x7a0 [ 849.515203][T28121] netlink_dump+0x1e7/0xee0 [ 849.515227][T28121] ? __netlink_lookup+0xc6/0x8b0 [ 849.515265][T28121] ? __pfx_netlink_dump+0x10/0x10 [ 849.515305][T28121] ? netlink_lookup+0x30/0x200 [ 849.515340][T28121] ? netlink_lookup+0x30/0x200 [ 849.515370][T28121] __netlink_dump_start+0x589/0x7b0 [ 849.515399][T28121] rtnetlink_rcv_msg+0xa48/0xc00 [ 849.515527][T28121] ? __pfx_rtnl_dump_all+0x10/0x10 [ 849.515550][T28121] ? rtnetlink_rcv_msg+0x1c9/0xc00 [ 849.515583][T28121] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 849.515616][T28121] ? ref_tracker_free+0x689/0x830 [ 849.515647][T28121] ? __pfx_rtnl_dumpit+0x10/0x10 [ 849.515669][T28121] ? __pfx_rtnl_dump_all+0x10/0x10 [ 849.515705][T28121] netlink_rcv_skb+0x226/0x4a0 [ 849.515731][T28121] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 849.515767][T28121] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 849.515806][T28121] ? netlink_deliver_tap+0x2e/0x1b0 [ 849.515832][T28121] ? netlink_deliver_tap+0x2e/0x1b0 [ 849.515863][T28121] netlink_unicast+0x7bb/0x940 [ 849.515899][T28121] netlink_sendmsg+0x813/0xb40 [ 849.515935][T28121] ? __pfx_netlink_sendmsg+0x10/0x10 [ 849.515966][T28121] ? aa_sock_msg_perm+0xf1/0x1b0 [ 849.516001][T28121] ? __pfx_netlink_sendmsg+0x10/0x10 [ 849.516035][T28121] sock_sendmsg_nosec+0x13a/0x180 [ 849.516069][T28121] sock_write_iter+0x2de/0x3e0 [ 849.516100][T28121] ? __pfx_sock_write_iter+0x10/0x10 [ 849.516138][T28121] ? bpf_lsm_file_permission+0x9/0x20 [ 849.516169][T28121] ? security_file_permission+0x75/0x260 [ 849.516214][T28121] vfs_write+0x612/0xba0 [ 849.516251][T28121] ? __pfx_vfs_write+0x10/0x10 [ 849.516290][T28121] ? __fget_files+0x2a/0x420 [ 849.516323][T28121] ksys_write+0x150/0x270 [ 849.516353][T28121] ? __pfx_ksys_write+0x10/0x10 [ 849.516390][T28121] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 849.516415][T28121] do_syscall_64+0x174/0x580 [ 849.516437][T28121] ? trace_irq_disable+0x3b/0x140 [ 849.516459][T28121] ? clear_bhb_loop+0x40/0x90 [ 849.516487][T28121] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 849.516509][T28121] RIP: 0033:0x7f7c4bd9de59 [ 849.516531][T28121] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 849.516550][T28121] RSP: 002b:00007f7c4cc25028 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 849.516573][T28121] RAX: ffffffffffffffda RBX: 00007f7c4c025fa0 RCX: 00007f7c4bd9de59 [ 849.516590][T28121] RDX: 0000000000000024 RSI: 0000200000000000 RDI: 0000000000000003 [ 849.516604][T28121] RBP: 00007f7c4cc25090 R08: 0000000000000000 R09: 0000000000000000 [ 849.516618][T28121] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 849.516632][T28121] R13: 00007f7c4c026038 R14: 00007f7c4c025fa0 R15: 00007fffb68f9728 [ 849.516668][T28121] [ 850.033453][T28130] __nla_validate_parse: 2 callbacks suppressed [ 850.033474][T28130] netlink: 256 bytes leftover after parsing attributes in process `syz.3.6458'. [ 850.067051][T28130] netlink: 'syz.3.6458': attribute type 9 has an invalid length. [ 850.280341][T28139] netlink: 'syz.1.6460': attribute type 1 has an invalid length. [ 850.396834][T27272] Bluetooth: hci3: command tx timeout [ 850.515116][T28147] netlink: 8 bytes leftover after parsing attributes in process `syz.2.6462'. [ 850.930724][T28064] bridge0: port 1(bridge_slave_0) entered blocking state [ 850.948804][T28064] bridge0: port 1(bridge_slave_0) entered disabled state [ 850.987100][T28064] bridge_slave_0: entered allmulticast mode [ 850.997477][T28064] bridge_slave_0: entered promiscuous mode [ 851.008119][T28064] bridge0: port 2(bridge_slave_1) entered blocking state [ 851.046947][T28064] bridge0: port 2(bridge_slave_1) entered disabled state [ 851.058396][T28064] bridge_slave_1: entered allmulticast mode [ 851.076737][T28064] bridge_slave_1: entered promiscuous mode [ 851.113563][T28168] netlink: 32 bytes leftover after parsing attributes in process `syz.1.6468'. [ 851.166855][T28064] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 851.189183][T28064] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 851.263830][T28064] team0: Port device team_slave_0 added [ 851.273724][T28171] netlink: 8 bytes leftover after parsing attributes in process `syz.2.6470'. [ 851.288239][T28064] team0: Port device team_slave_1 added [ 851.348975][T28064] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 851.386396][T28064] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 851.458024][T28064] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 851.472085][T28064] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 851.484442][T28064] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 851.541897][T28064] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 851.667624][T28064] hsr_slave_0: entered promiscuous mode [ 851.694867][T28064] hsr_slave_1: entered promiscuous mode [ 851.716748][T28193] xt_CT: You must specify a L4 protocol and not use inversions on it [ 851.719189][T28194] netlink: 'syz.1.6475': attribute type 1 has an invalid length. [ 851.736404][T28064] debugfs: 'hsr0' already exists in 'hsr' [ 851.753668][T28194] netlink: 'syz.1.6475': attribute type 2 has an invalid length. [ 851.765758][T28064] Cannot create hsr debugfs directory [ 852.479135][T27272] Bluetooth: hci3: command tx timeout [ 852.910121][T28221] xt_hashlimit: size too large, truncated to 1048576 [ 853.000383][T28225] xt_hashlimit: size too large, truncated to 1048576 [ 853.352217][T28064] netdevsim netdevsim4 netdevsim3 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 853.380220][T28064] netdevsim netdevsim4 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 853.468894][T28237] FAULT_INJECTION: forcing a failure. [ 853.468894][T28237] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 853.510068][T28237] CPU: 1 UID: 0 PID: 28237 Comm: syz.0.6481 Not tainted syzkaller #0 PREEMPT(full) [ 853.510091][T28237] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 853.510102][T28237] Call Trace: [ 853.510109][T28237] [ 853.510117][T28237] dump_stack_lvl+0xe8/0x150 [ 853.510144][T28237] should_fail_ex+0x40c/0x560 [ 853.510171][T28237] _copy_to_user+0x31/0xb0 [ 853.510191][T28237] simple_read_from_buffer+0xe1/0x170 [ 853.510226][T28237] proc_fail_nth_read+0x1bb/0x230 [ 853.510248][T28237] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 853.510268][T28237] ? rw_verify_area+0x24a/0x4c0 [ 853.510289][T28237] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 853.510306][T28237] vfs_read+0x213/0xa80 [ 853.510329][T28237] ? __pfx___mutex_lock+0x10/0x10 [ 853.510347][T28237] ? __pfx_vfs_read+0x10/0x10 [ 853.510369][T28237] ? __fget_files+0x2a/0x420 [ 853.510389][T28237] ? __fget_files+0x3a2/0x420 [ 853.510403][T28237] ? __fget_files+0x2a/0x420 [ 853.510425][T28237] ksys_read+0x150/0x270 [ 853.510447][T28237] ? __pfx_ksys_read+0x10/0x10 [ 853.510473][T28237] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 853.510491][T28237] do_syscall_64+0x174/0x580 [ 853.510507][T28237] ? trace_irq_disable+0x3b/0x140 [ 853.510524][T28237] ? clear_bhb_loop+0x40/0x90 [ 853.510544][T28237] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 853.510561][T28237] RIP: 0033:0x7f530715e68e [ 853.510578][T28237] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 853.510592][T28237] RSP: 002b:00007f5308101fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 853.510610][T28237] RAX: ffffffffffffffda RBX: 00007f53081026c0 RCX: 00007f530715e68e [ 853.510622][T28237] RDX: 000000000000000f RSI: 00007f53081020a0 RDI: 0000000000000004 [ 853.510632][T28237] RBP: 00007f5308102090 R08: 0000000000000000 R09: 0000000000000000 [ 853.510643][T28237] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 853.510653][T28237] R13: 00007f5307426038 R14: 00007f5307425fa0 R15: 00007ffc5fa91f48 [ 853.510681][T28237] [ 853.894549][T28064] netdevsim netdevsim4 netdevsim2 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 853.937389][T28064] netdevsim netdevsim4 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 854.128031][T28064] netdevsim netdevsim4 netdevsim1 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 854.174352][T28064] netdevsim netdevsim4 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 854.211696][T28259] netlink: 8 bytes leftover after parsing attributes in process `syz.0.6485'. [ 854.273630][T28261] sctp: [Deprecated]: syz.3.6487 (pid 28261) Use of struct sctp_assoc_value in delayed_ack socket option. [ 854.273630][T28261] Use struct sctp_sack_info instead [ 854.320933][T28064] netdevsim netdevsim4 netdevsim0 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 854.331530][T28064] netdevsim netdevsim4 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 854.530100][T28064] netdevsim netdevsim4 netdevsim0: renamed from eth0 [ 854.556087][T27272] Bluetooth: hci3: command tx timeout [ 854.611714][T28064] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 854.631970][T28064] netdevsim netdevsim4 netdevsim1: renamed from eth1 [ 854.643455][T28064] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 854.663673][T28064] netdevsim netdevsim4 netdevsim2: renamed from eth2 [ 854.674983][T28064] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 854.684841][T28064] netdevsim netdevsim4 netdevsim3: renamed from eth3 [ 854.695116][T28064] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 854.843381][T28064] 8021q: adding VLAN 0 to HW filter on device bond0 [ 854.879688][T28064] 8021q: adding VLAN 0 to HW filter on device team0 [ 854.905636][ T12] bridge0: port 1(bridge_slave_0) entered blocking state [ 854.912853][ T12] bridge0: port 1(bridge_slave_0) entered forwarding state [ 854.945852][ T12] bridge0: port 2(bridge_slave_1) entered blocking state [ 854.953113][ T12] bridge0: port 2(bridge_slave_1) entered forwarding state [ 854.972483][T28281] netlink: 'syz.3.6491': attribute type 24 has an invalid length. [ 855.582263][T28306] netlink: 12 bytes leftover after parsing attributes in process `syz.1.6498'. [ 855.622587][T28306] bridge: RTM_NEWNEIGH with invalid ether address [ 855.910072][T28326] netlink: 'syz.1.6501': attribute type 16 has an invalid length. [ 855.961476][T28326] netlink: 'syz.1.6501': attribute type 17 has an invalid length. [ 856.059692][T28064] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 856.220273][T28326] hsr0: left allmulticast mode [ 856.234312][T28326] hsr_slave_0: left allmulticast mode [ 856.264443][T28326] hsr_slave_1: left allmulticast mode [ 856.343374][T28326] geneve2: left promiscuous mode [ 856.359774][T28326] geneve2: left allmulticast mode [ 856.382834][ T3310] bridge0: port 2(bridge_slave_1) entered blocking state [ 856.390074][ T3310] bridge0: port 2(bridge_slave_1) entered forwarding state [ 856.637918][T27272] Bluetooth: hci3: command tx timeout [ 859.380426][T28064] veth0_vlan: entered promiscuous mode [ 859.389105][T28383] xt_socket: unknown flags 0x50 [ 859.393756][T28381] netlink: 8 bytes leftover after parsing attributes in process `syz.2.6513'. [ 859.438818][T28064] veth1_vlan: entered promiscuous mode [ 859.570779][T28064] veth0_macvtap: entered promiscuous mode [ 859.624122][T28064] veth1_macvtap: entered promiscuous mode [ 859.703986][T28064] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 859.765993][T28064] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 859.819029][ T12] netdevsim netdevsim4 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 859.852306][ T12] netdevsim netdevsim4 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 859.878044][ T12] netdevsim netdevsim4 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 859.895109][T28392] netlink: 4768 bytes leftover after parsing attributes in process `syz.0.6518'. [ 859.913746][ T12] netdevsim netdevsim4 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 859.933224][T28392] netlink: 4768 bytes leftover after parsing attributes in process `syz.0.6518'. [ 859.950250][T28394] IPVS: Schedule: port zero only supported in persistent services, check your ipvs configuration [ 859.980039][T28396] netlink: 28 bytes leftover after parsing attributes in process `syz.2.6520'. [ 860.421287][ T1170] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 860.448951][ T1170] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 860.538981][ T1170] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 860.549198][ T1170] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 860.554088][T28415] netlink: 20 bytes leftover after parsing attributes in process `syz.3.6524'. [ 860.766905][T28420] netlink: 12 bytes leftover after parsing attributes in process `syz.4.6437'. [ 861.004974][T28426] netlink: 8 bytes leftover after parsing attributes in process `syz.1.6528'. [ 861.273840][T28443] netlink: 52 bytes leftover after parsing attributes in process `syz.0.6534'. [ 861.666448][T22077] IPVS: starting estimator thread 0... [ 861.776536][T28458] IPVS: using max 26 ests per chain, 62400 per kthread [ 862.563189][T28481] bond0: (slave bond_slave_1): Error: Device is in use and cannot be enslaved [ 862.698178][T28489] netlink: 168 bytes leftover after parsing attributes in process `syz.2.6543'. [ 863.090701][T28496] bridge0: port 3(team0) entered disabled state [ 863.097484][T28496] bridge0: port 2(bridge_slave_1) entered disabled state [ 863.105183][T28496] bridge0: port 1(bridge_slave_0) entered disabled state [ 863.319679][T28521] netlink: 4 bytes leftover after parsing attributes in process `syz.1.6549'. [ 863.427126][T28496] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 863.444725][T28496] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 863.617118][T28524] gre1: entered promiscuous mode [ 863.631472][T28524] gre1: entered allmulticast mode [ 863.729140][T28527] netlink: 72 bytes leftover after parsing attributes in process `syz.0.6550'. [ 863.742271][T10112] netdevsim netdevsim3 netdevsim0: unset [0, 0] type 1 family 0 port 8472 - 0 [ 863.755000][T10112] netdevsim netdevsim3 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 863.775658][T10112] netdevsim netdevsim3 netdevsim1: unset [0, 0] type 1 family 0 port 8472 - 0 [ 863.796106][T10112] netdevsim netdevsim3 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 863.882230][T10112] netdevsim netdevsim3 netdevsim2: unset [0, 0] type 1 family 0 port 8472 - 0 [ 863.905242][T10112] netdevsim netdevsim3 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 863.916587][T28535] netlink: 104 bytes leftover after parsing attributes in process `syz.1.6552'. [ 863.949050][T10112] netdevsim netdevsim3 netdevsim3: unset [0, 0] type 1 family 0 port 8472 - 0 [ 863.974074][T10112] netdevsim netdevsim3 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 864.090693][T28542] netlink: 48 bytes leftover after parsing attributes in process `syz.4.6554'. [ 864.170684][T28547] netlink: 'syz.0.6555': attribute type 1 has an invalid length. [ 864.215966][T28547] netlink: 228 bytes leftover after parsing attributes in process `syz.0.6555'. [ 864.279275][T28553] netlink: 8 bytes leftover after parsing attributes in process `syz.3.6558'. [ 864.363846][T28553] geneve2: entered promiscuous mode [ 864.384011][T28553] geneve2: entered allmulticast mode [ 864.467583][T10112] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 864.495653][T10112] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 864.543029][T10112] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 864.574655][T10112] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 865.140882][T28604] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 865.554190][T28633] netlink: 'syz.1.6582': attribute type 25 has an invalid length. [ 865.801334][T28644] __nla_validate_parse: 1 callbacks suppressed [ 865.801364][T28644] netlink: 48 bytes leftover after parsing attributes in process `syz.1.6584'. [ 865.826257][T28644] netlink: 48 bytes leftover after parsing attributes in process `syz.1.6584'. [ 866.368860][T28663] bond1: option ad_actor_sys_prio: mode dependency failed, not supported in mode balance-xor(2) [ 866.411312][T28663] bond1 (unregistering): Released all slaves [ 866.539622][T28663] syzkaller0: entered promiscuous mode [ 866.561483][T28663] syzkaller0: entered allmulticast mode [ 866.804917][T28703] netlink: 'syz.1.6601': attribute type 4 has an invalid length. [ 866.901599][T28705] netlink: 'syz.1.6601': attribute type 4 has an invalid length. [ 866.918637][T28697] netlink: 56 bytes leftover after parsing attributes in process `syz.1.6601'. [ 867.415213][T28730] netlink: 'syz.0.6609': attribute type 2 has an invalid length. [ 867.460752][T28730] netlink: 212408 bytes leftover after parsing attributes in process `syz.0.6609'. [ 867.494820][T28730] openvswitch: netlink: Flow get message rejected, Key attribute missing. [ 867.745329][T28741] netlink: 20 bytes leftover after parsing attributes in process `syz.1.6612'. [ 867.785319][T28741] xt_ecn: cannot match TCP bits for non-tcp packets [ 867.789276][T28742] xt_ecn: cannot match TCP bits for non-tcp packets [ 868.178079][ T5650] block nbd4: Receive control failed (result -107) [ 868.209406][T28741] nbd4: detected capacity change from 0 to 63 [ 868.267839][T27272] block nbd4: Receive control failed (result -104) [ 868.501751][T28761] netlink: 28 bytes leftover after parsing attributes in process `syz.0.6616'. [ 868.511517][T28759] netlink: 256 bytes leftover after parsing attributes in process `syz.4.6618'. [ 868.534715][T28761] netlink: 20 bytes leftover after parsing attributes in process `syz.0.6616'. [ 868.802557][T28767] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 869.107098][T28774] netlink: 27 bytes leftover after parsing attributes in process `syz.3.6623'. [ 869.510134][T28804] veth0_to_bond: mtu less than device minimum [ 869.683667][T28817] netlink: 'syz.1.6637': attribute type 12 has an invalid length. [ 869.693026][T28811] netlink: 20 bytes leftover after parsing attributes in process `syz.3.6635'. [ 869.709902][T28817] netlink: 'syz.1.6637': attribute type 12 has an invalid length. [ 869.868297][T28827] [ 869.870713][T28827] ====================================================== [ 869.877749][T28827] WARNING: possible circular locking dependency detected [ 869.884799][T28827] syzkaller #0 Not tainted [ 869.889240][T28827] ------------------------------------------------------ [ 869.896276][T28827] syz.3.6640/28827 is trying to acquire lock: [ 869.902356][T28827] ffffffff8ea84680 (fs_reclaim){+.+.}-{0:0}, at: __kmalloc_cache_noprof+0x61/0x660 [ 869.911688][T28827] [ 869.911688][T28827] but task is already holding lock: [ 869.919093][T28827] ffff88806825b530 (&idev->mc_lock){+.+.}-{4:4}, at: __ipv6_dev_mc_inc+0x4e/0xa40 [ 869.928522][T28827] [ 869.928522][T28827] which lock already depends on the new lock. [ 869.928522][T28827] [ 869.939022][T28827] [ 869.939022][T28827] the existing dependency chain (in reverse order) is: [ 869.948054][T28827] [ 869.948054][T28827] -> #7 (&idev->mc_lock){+.+.}-{4:4}: [ 869.955634][T28827] __mutex_lock+0x19d/0x1550 [ 869.960761][T28827] __ipv6_dev_mc_inc+0x4e/0xa40 [ 869.966148][T28827] __ipv6_sock_mc_join+0x4f7/0x740 [ 869.971796][T28827] ipv6_mcast_join_leave+0x1a2/0x240 [ 869.977715][T28827] do_ipv6_setsockopt+0x1990/0x3180 [ 869.983476][T28827] ipv6_setsockopt+0x59/0x170 [ 869.988706][T28827] do_sock_setsockopt+0x17c/0x1b0 [ 869.994268][T28827] __x64_sys_setsockopt+0x13d/0x1b0 [ 870.000009][T28827] do_syscall_64+0x174/0x580 [ 870.005139][T28827] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 870.011565][T28827] [ 870.011565][T28827] -> #6 (sk_lock-AF_INET6){+.+.}-{0:0}: [ 870.019307][T28827] lock_sock_nested+0x41/0x100 [ 870.024612][T28827] inet_shutdown+0x6a/0x390 [ 870.029756][T28827] nbd_mark_nsock_dead+0x2cb/0x550 [ 870.035464][T28827] recv_work+0x1cee/0x1e10 [ 870.040460][T28827] process_scheduled_works+0xa8e/0x14e0 [ 870.046559][T28827] worker_thread+0xa47/0xfb0 [ 870.051691][T28827] kthread+0x388/0x470 [ 870.056289][T28827] ret_from_fork+0x514/0xb70 [ 870.061424][T28827] ret_from_fork_asm+0x1a/0x30 [ 870.066734][T28827] [ 870.066734][T28827] -> #5 (&nsock->tx_lock){+.+.}-{4:4}: [ 870.074403][T28827] __mutex_lock+0x19d/0x1550 [ 870.079543][T28827] nbd_queue_rq+0x373/0x1150 [ 870.084674][T28827] blk_mq_dispatch_rq_list+0x499/0x1990 [ 870.090851][T28827] __blk_mq_sched_dispatch_requests+0xd36/0x1580 [ 870.097754][T28827] blk_mq_sched_dispatch_requests+0xd7/0x190 [ 870.104278][T28827] blk_mq_run_work_fn+0x16c/0x300 [ 870.109842][T28827] process_scheduled_works+0xa8e/0x14e0 [ 870.115944][T28827] worker_thread+0xa47/0xfb0 [ 870.121090][T28827] kthread+0x388/0x470 [ 870.125698][T28827] ret_from_fork+0x514/0xb70 [ 870.130833][T28827] ret_from_fork_asm+0x1a/0x30 [ 870.136164][T28827] [ 870.136164][T28827] -> #4 (&cmd->lock){+.+.}-{4:4}: [ 870.143401][T28827] __mutex_lock+0x19d/0x1550 [ 870.148520][T28827] nbd_queue_rq+0xc1/0x1150 [ 870.153550][T28827] blk_mq_dispatch_rq_list+0x499/0x1990 [ 870.159657][T28827] __blk_mq_sched_dispatch_requests+0xd36/0x1580 [ 870.166554][T28827] blk_mq_sched_dispatch_requests+0xd7/0x190 [ 870.173082][T28827] blk_mq_run_work_fn+0x16c/0x300 [ 870.178651][T28827] process_scheduled_works+0xa8e/0x14e0 [ 870.184735][T28827] worker_thread+0xa47/0xfb0 [ 870.189878][T28827] kthread+0x388/0x470 [ 870.194483][T28827] ret_from_fork+0x514/0xb70 [ 870.199607][T28827] ret_from_fork_asm+0x1a/0x30 [ 870.204904][T28827] [ 870.204904][T28827] -> #3 (set->srcu){.+.+}-{0:0}: [ 870.212047][T28827] __synchronize_srcu+0xc9/0x2f0 [ 870.217524][T28827] elevator_switch+0x1e8/0x7b0 [ 870.222909][T28827] elevator_change+0x2fa/0x480 [ 870.228221][T28827] elevator_set_default+0x375/0x440 [ 870.233978][T28827] blk_register_queue+0x3f3/0x4e0 [ 870.239576][T28827] __add_disk+0x6cb/0xe30 [ 870.244448][T28827] add_disk_fwnode+0xfb/0x4b0 [ 870.249659][T28827] nbd_dev_add+0x733/0xb60 [ 870.254712][T28827] nbd_init+0x15f/0x1e0 [ 870.259473][T28827] do_one_initcall+0x250/0x870 [ 870.264768][T28827] do_initcall_level+0x10a/0x1a0 [ 870.270303][T28827] do_initcalls+0x59/0xa0 [ 870.275172][T28827] kernel_init_freeable+0x29d/0x3e0 [ 870.280913][T28827] kernel_init+0x1d/0x1d0 [ 870.285793][T28827] ret_from_fork+0x514/0xb70 [ 870.290919][T28827] ret_from_fork_asm+0x1a/0x30 [ 870.296239][T28827] [ 870.296239][T28827] -> #2 (&q->elevator_lock){+.+.}-{4:4}: [ 870.304070][T28827] __mutex_lock+0x19d/0x1550 [ 870.309204][T28827] elevator_change+0x1af/0x480 [ 870.314508][T28827] elevator_set_none+0xb5/0x140 [ 870.319895][T28827] blk_mq_update_nr_hw_queues+0x5ef/0x19f0 [ 870.326228][T28827] nbd_start_device+0x189/0xb30 [ 870.331602][T28827] nbd_genl_connect+0x1597/0x1c10 [ 870.337148][T28827] genl_family_rcv_msg_doit+0x233/0x340 [ 870.343248][T28827] genl_rcv_msg+0x614/0x7a0 [ 870.348284][T28827] netlink_rcv_skb+0x226/0x4a0 [ 870.353596][T28827] genl_rcv+0x28/0x40 [ 870.358112][T28827] netlink_unicast+0x7bb/0x940 [ 870.363428][T28827] netlink_sendmsg+0x813/0xb40 [ 870.368728][T28827] sock_sendmsg_nosec+0x13a/0x180 [ 870.374292][T28827] ____sys_sendmsg+0x54e/0x850 [ 870.379590][T28827] ___sys_sendmsg+0x2a5/0x360 [ 870.384795][T28827] __x64_sys_sendmsg+0x1b1/0x290 [ 870.390265][T28827] do_syscall_64+0x174/0x580 [ 870.395383][T28827] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 870.401804][T28827] [ 870.401804][T28827] -> #1 (&q->q_usage_counter(io)#53){++++}-{0:0}: [ 870.410441][T28827] blk_alloc_queue+0x544/0x690 [ 870.415740][T28827] __blk_mq_alloc_disk+0x194/0x390 [ 870.421375][T28827] nbd_dev_add+0x494/0xb60 [ 870.426318][T28827] nbd_init+0x15f/0x1e0 [ 870.431006][T28827] do_one_initcall+0x250/0x870 [ 870.436303][T28827] do_initcall_level+0x10a/0x1a0 [ 870.441781][T28827] do_initcalls+0x59/0xa0 [ 870.446642][T28827] kernel_init_freeable+0x29d/0x3e0 [ 870.452403][T28827] kernel_init+0x1d/0x1d0 [ 870.457270][T28827] ret_from_fork+0x514/0xb70 [ 870.462390][T28827] ret_from_fork_asm+0x1a/0x30 [ 870.467685][T28827] [ 870.467685][T28827] -> #0 (fs_reclaim){+.+.}-{0:0}: [ 870.474931][T28827] __lock_acquire+0x1520/0x2cf0 [ 870.480319][T28827] lock_acquire+0x106/0x350 [ 870.485354][T28827] fs_reclaim_acquire+0x71/0x100 [ 870.490832][T28827] __kmalloc_cache_noprof+0x61/0x660 [ 870.496668][T28827] __ipv6_dev_mc_inc+0x447/0xa40 [ 870.502151][T28827] ipv6_add_dev+0xe36/0x13a0 [ 870.507334][T28827] addrconf_notify+0x771/0x1050 [ 870.512727][T28827] notifier_call_chain+0x1a5/0x3d0 [ 870.518361][T28827] register_netdevice+0x18a4/0x1eb0 [ 870.524128][T28827] l2tp_eth_create+0x7f1/0xbd0 [ 870.529502][T28827] l2tp_nl_cmd_session_create+0x714/0xbe0 [ 870.535747][T28827] genl_family_rcv_msg_doit+0x233/0x340 [ 870.541834][T28827] genl_rcv_msg+0x614/0x7a0 [ 870.546874][T28827] netlink_rcv_skb+0x226/0x4a0 [ 870.552172][T28827] genl_rcv+0x28/0x40 [ 870.556692][T28827] netlink_unicast+0x7bb/0x940 [ 870.561989][T28827] netlink_sendmsg+0x813/0xb40 [ 870.567302][T28827] sock_sendmsg_nosec+0x13a/0x180 [ 870.572873][T28827] ____sys_sendmsg+0x54e/0x850 [ 870.578174][T28827] ___sys_sendmsg+0x2a5/0x360 [ 870.583382][T28827] __x64_sys_sendmsg+0x1b1/0x290 [ 870.588848][T28827] do_syscall_64+0x174/0x580 [ 870.593980][T28827] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 870.600407][T28827] [ 870.600407][T28827] other info that might help us debug this: [ 870.600407][T28827] [ 870.610647][T28827] Chain exists of: [ 870.610647][T28827] fs_reclaim --> sk_lock-AF_INET6 --> &idev->mc_lock [ 870.610647][T28827] [ 870.623266][T28827] Possible unsafe locking scenario: [ 870.623266][T28827] [ 870.630733][T28827] CPU0 CPU1 [ 870.636110][T28827] ---- ---- [ 870.641483][T28827] lock(&idev->mc_lock); [ 870.645829][T28827] lock(sk_lock-AF_INET6); [ 870.652864][T28827] lock(&idev->mc_lock); [ 870.659729][T28827] lock(fs_reclaim); [ 870.663726][T28827] [ 870.663726][T28827] *** DEADLOCK *** [ 870.663726][T28827] [ 870.671877][T28827] 4 locks held by syz.3.6640/28827: [ 870.677076][T28827] #0: ffffffff8fe5b3e8 (cb_lock){++++}-{4:4}, at: genl_rcv+0x19/0x40 [ 870.685298][T28827] #1: ffffffff8fe5b220 (genl_mutex){+.+.}-{4:4}, at: genl_rcv_msg+0x10b/0x7a0 [ 870.694310][T28827] #2: ffffffff8fdeac00 (rtnl_mutex){+.+.}-{4:4}, at: l2tp_eth_create+0x7c9/0xbd0 [ 870.703568][T28827] #3: ffff88806825b530 (&idev->mc_lock){+.+.}-{4:4}, at: __ipv6_dev_mc_inc+0x4e/0xa40 [ 870.713245][T28827] [ 870.713245][T28827] stack backtrace: [ 870.719150][T28827] CPU: 1 UID: 0 PID: 28827 Comm: syz.3.6640 Not tainted syzkaller #0 PREEMPT(full) [ 870.719177][T28827] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 870.719190][T28827] Call Trace: [ 870.719199][T28827] [ 870.719209][T28827] dump_stack_lvl+0xe8/0x150 [ 870.719237][T28827] print_circular_bug+0x2e1/0x300 [ 870.719267][T28827] check_noncircular+0x12e/0x150 [ 870.719299][T28827] __lock_acquire+0x1520/0x2cf0 [ 870.719334][T28827] ? __pfx___mutex_trylock_common+0x10/0x10 [ 870.719364][T28827] ? rcu_is_watching+0x15/0xb0 [ 870.719389][T28827] ? trace_contention_end+0x3d/0x140 [ 870.719419][T28827] ? __kmalloc_cache_noprof+0x61/0x660 [ 870.719453][T28827] lock_acquire+0x106/0x350 [ 870.719473][T28827] ? __kmalloc_cache_noprof+0x61/0x660 [ 870.719509][T28827] ? __ipv6_dev_mc_inc+0x4e/0xa40 [ 870.719538][T28827] fs_reclaim_acquire+0x71/0x100 [ 870.719558][T28827] ? __kmalloc_cache_noprof+0x61/0x660 [ 870.719590][T28827] __kmalloc_cache_noprof+0x61/0x660 [ 870.719618][T28827] ? __ipv6_dev_mc_inc+0x447/0xa40 [ 870.719636][T28827] ? __ipv6_dev_mc_inc+0x447/0xa40 [ 870.719659][T28827] __ipv6_dev_mc_inc+0x447/0xa40 [ 870.719681][T28827] ? addrconf_sysctl_register+0x1a9/0x1c0 [ 870.719709][T28827] ipv6_add_dev+0xe36/0x13a0 [ 870.719734][T28827] addrconf_notify+0x771/0x1050 [ 870.719761][T28827] notifier_call_chain+0x1a5/0x3d0 [ 870.719782][T28827] register_netdevice+0x18a4/0x1eb0 [ 870.719810][T28827] ? __pfx_register_netdevice+0x10/0x10 [ 870.719832][T28827] ? __pfx_l2tp_session_register+0x10/0x10 [ 870.719935][T28827] ? l2tp_eth_create+0x37e/0xbd0 [ 870.719960][T28827] l2tp_eth_create+0x7f1/0xbd0 [ 870.719986][T28827] ? l2tp_eth_create+0x37e/0xbd0 [ 870.720010][T28827] ? __pfx_l2tp_eth_create+0x10/0x10 [ 870.720038][T28827] l2tp_nl_cmd_session_create+0x714/0xbe0 [ 870.720062][T28827] ? trace_kmalloc+0x2a/0xf0 [ 870.720090][T28827] ? __pfx_l2tp_nl_cmd_session_create+0x10/0x10 [ 870.720116][T28827] ? genl_family_rcv_msg_attrs_parse+0x20b/0x2f0 [ 870.720144][T28827] ? genl_family_rcv_msg_attrs_parse+0x265/0x2f0 [ 870.720173][T28827] genl_family_rcv_msg_doit+0x233/0x340 [ 870.720202][T28827] ? __pfx_genl_family_rcv_msg_doit+0x10/0x10 [ 870.720233][T28827] ? bpf_lsm_capable+0x9/0x20 [ 870.720250][T28827] ? security_capable+0x7e/0x2c0 [ 870.720274][T28827] genl_rcv_msg+0x614/0x7a0 [ 870.720313][T28827] ? __pfx_genl_rcv_msg+0x10/0x10 [ 870.720342][T28827] ? __pfx_l2tp_nl_cmd_session_create+0x10/0x10 [ 870.720371][T28827] netlink_rcv_skb+0x226/0x4a0 [ 870.720389][T28827] ? __pfx_genl_rcv_msg+0x10/0x10 [ 870.720414][T28827] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 870.720438][T28827] ? down_read+0x2be/0x330 [ 870.720458][T28827] genl_rcv+0x28/0x40 [ 870.720479][T28827] netlink_unicast+0x7bb/0x940 [ 870.720500][T28827] netlink_sendmsg+0x813/0xb40 [ 870.720524][T28827] ? __pfx_netlink_sendmsg+0x10/0x10 [ 870.720544][T28827] ? aa_sock_msg_perm+0xf1/0x1b0 [ 870.720568][T28827] ? __pfx_netlink_sendmsg+0x10/0x10 [ 870.720586][T28827] sock_sendmsg_nosec+0x13a/0x180 [ 870.720610][T28827] ____sys_sendmsg+0x54e/0x850 [ 870.720631][T28827] ? __pfx_____sys_sendmsg+0x10/0x10 [ 870.720653][T28827] ? import_iovec+0x73/0xa0 [ 870.720671][T28827] ___sys_sendmsg+0x2a5/0x360 [ 870.720689][T28827] ? __lock_acquire+0x683/0x2cf0 [ 870.720707][T28827] ? __pfx____sys_sendmsg+0x10/0x10 [ 870.720727][T28827] ? futex_wait+0x2a2/0x390 [ 870.720772][T28827] ? __fget_files+0x2a/0x420 [ 870.720788][T28827] ? __fget_files+0x3a2/0x420 [ 870.720808][T28827] __x64_sys_sendmsg+0x1b1/0x290 [ 870.720829][T28827] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 870.720855][T28827] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 870.720873][T28827] do_syscall_64+0x174/0x580 [ 870.720889][T28827] ? trace_irq_disable+0x3b/0x140 [ 870.720904][T28827] ? clear_bhb_loop+0x40/0x90 [ 870.720924][T28827] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 870.720941][T28827] RIP: 0033:0x7f7c4bd9de59 [ 870.720976][T28827] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 870.720991][T28827] RSP: 002b:00007f7c4cc04028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 870.721009][T28827] RAX: ffffffffffffffda RBX: 00007f7c4c026090 RCX: 00007f7c4bd9de59 [ 870.721022][T28827] RDX: 0000000000000000 RSI: 0000200000000080 RDI: 0000000000000005 [ 870.721034][T28827] RBP: 00007f7c4be33e6f R08: 0000000000000000 R09: 0000000000000000 [ 870.721045][T28827] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 870.721056][T28827] R13: 00007f7c4c026128 R14: 00007f7c4c026090 R15: 00007fffb68f9728 [ 870.721076][T28827] [ 871.232676][T28830] __nla_validate_parse: 2 callbacks suppressed [ 871.232694][T28830] netlink: 4 bytes leftover after parsing attributes in process `syz.0.6641'.