last executing test programs: 13m56.376996856s ago: executing program 0 (id=1988): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000600)={0x11, 0x3, &(0x7f0000000200)=@framed, 0x0}, 0x94) (async, rerun: 32) r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000100)=@base={0xb, 0x100, 0x1108, 0x9, 0x1}, 0x50) (rerun: 32) bpf$MAP_UPDATE_BATCH(0x1a, &(0x7f0000000640)={0x0, 0x0, &(0x7f0000000000), &(0x7f00000002c0), 0xb, r1}, 0x38) (async) sendmsg$NFT_BATCH(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000003c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x4805}, 0x20000050) ioctl$XFS_IOC_RTGROUP_GEOMETRY(r1, 0xc0805841, &(0x7f0000000180)={0x5, 0xffffff80, 0x10001, 0x1, 0xb}) sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000100)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a40000000160a03020000000000000000020000000900020073797a30000000000900010073797a3000000000140003800800014000000000080002400000000014000000110001"], 0x68}}, 0x0) (async) sendmsg$NFT_BATCH(r0, &(0x7f0000000840)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000000440)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x5}}, [@NFT_MSG_DELFLOWTABLE={0x2c, 0x18, 0xa, 0x5, 0x0, 0x0, {0x2}, [@NFTA_FLOWTABLE_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_FLOWTABLE_NAME={0x9, 0x2, 'syz0\x00'}]}, @NFT_MSG_NEWFLOWTABLE={0x6c, 0x16, 0xa, 0x401, 0x0, 0x0, {0x2, 0x0, 0x2}, [@NFTA_FLOWTABLE_NAME={0x9, 0x2, 'syz0\x00'}, @NFTA_FLOWTABLE_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_FLOWTABLE_HOOK={0x40, 0x3, 0x0, 0x1, [@NFTA_FLOWTABLE_HOOK_NUM={0x8}, @NFTA_FLOWTABLE_HOOK_DEVS={0x2c, 0x3, 0x0, 0x1, [{0x14, 0x1, 'team_slave_0\x00'}, {0x14, 0x1, 'vlan1\x00'}]}, @NFTA_FLOWTABLE_HOOK_PRIORITY={0x8, 0x2, 0x1, 0x0, 0x200}]}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x1}}}, 0xc0}}, 0x0) sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000004c0)=@updpolicy={0x1bc, 0x19, 0x1, 0xffffffff, 0x0, {{@in=@multicast1, @in=@remote, 0x0, 0x0, 0x0, 0x0, 0xa, 0x0, 0x0, 0x1}, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x5ee76b3ce2b5fd35}, [@tmpl={0x104, 0x5, [{{@in6=@mcast2, 0x0, 0x3c}, 0x0, @in=@broadcast, 0x0, 0x0, 0x2, 0x0, 0x2, 0x0, 0xd1f}, {{@in6=@remote, 0x0, 0x32}, 0x0, @in6=@dev={0xfe, 0x80, '\x00', 0xff}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3ff}, {{@in=@loopback, 0x0, 0x6c}, 0x0, @in6=@loopback, 0x3502, 0x1}, {{@in6=@rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01', 0x0, 0x33}, 0x2, @in6=@private1, 0x0, 0x5}]}]}, 0x1bc}}, 0x40800) 13m56.052052107s ago: executing program 0 (id=1990): r0 = socket$nl_route(0x10, 0x3, 0x0) (async) r1 = socket(0x10, 0x803, 0x2) syz_genetlink_get_family_id$mptcp(&(0x7f00000000c0), r1) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000001c0)=0x14) (async) r3 = socket$nl_route(0x10, 0x3, 0x0) (async) r4 = socket$netlink(0x10, 0x3, 0x0) (async) r5 = socket(0x10, 0x803, 0x0) sendmsg$nl_route_sched(r5, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000380)={0x0, 0x24}}, 0x0) getsockname$packet(r5, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x2ba) (async, rerun: 32) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000480)={0xd, 0x10, &(0x7f0000000080)=@ringbuf={{0x18, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x2}, {}, {}, [@jmp={0x5, 0x1, 0x8, 0xb, 0x0, 0x20, 0xfffffffffffffffc}], {{}, {0x7, 0x0, 0xb, 0x2, 0x0, 0x0, 0x2}, {0x85, 0x0, 0x0, 0x85}}}, &(0x7f0000000140)='GPL\x00', 0x2, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x24, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x10}, 0x94) (async, rerun: 32) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000300)={0x6, 0x3, &(0x7f0000000680)=ANY=[@ANYBLOB="1800000002000000000000000000000095"], 0x0, 0x0, 0x0, 0x0, 0x41100, 0xa}, 0x94) (async) r7 = bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000780)={0x6, 0x3, &(0x7f0000000680)=ANY=[], &(0x7f00000002c0)='syzkaller\x00'}, 0x94) (async) connect$inet6(0xffffffffffffffff, &(0x7f0000000000)={0xa, 0x0, 0x0, @ipv4={'\x00', '\xff\xff', @remote}}, 0x1c) write$cgroup_subtree(0xffffffffffffffff, &(0x7f0000000000)=ANY=[@ANYBLOB="8fedcb7907009875f37538e486dd63"], 0xfdef) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000600)={r7, 0x5, 0xb68, 0x0, &(0x7f0000000000)='%', 0x0, 0xd01, 0x88be, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x48) (async) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000140)=@newtfilter={0x44, 0x2c, 0xf3f, 0x70bd2a, 0x25dfdbfd, {0x0, 0x0, 0x0, 0x0, {0xb, 0xfff3}, {}, {0x7, 0x300}}, [@filter_kind_options=@f_basic={{0xa}, {0x14, 0x2, [@TCA_BASIC_EMATCHES={0x10, 0x2, 0x0, 0x1, [@TCA_EMATCH_TREE_HDR={0x8}, @TCA_EMATCH_TREE_LIST={0x4}]}]}}]}, 0x44}, 0x1, 0x0, 0x0, 0x20041090}, 0x0) (async) r8 = socket$nl_netfilter(0x10, 0x3, 0xc) (async) setsockopt$TIPC_SRC_DROPPABLE(0xffffffffffffffff, 0x10f, 0x80, 0x0, 0x0) sendmsg$NFT_BATCH(r8, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f000000c280)={&(0x7f0000000100)=ANY=[@ANYBLOB="140000001000010000000000001100000000000a20000000000a01010000000000000000050000080900010073797a30000000005c000000030a03000000000000000000050000000900010073797a30000000000900030073797a300000000008000c40000000032800048008000240000000120800014000000000140004"], 0xa4}}, 0x0) (async) sendmsg$nl_route(r4, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000140)=ANY=[@ANYBLOB="3c0000001000850619fbb7c75150926b00000000", @ANYRES32=r6, @ANYBLOB="fe000000000000001c0012000c000100626f6e64000000000c0002000800010004"], 0x3c}}, 0x0) (async, rerun: 32) r9 = socket$nl_route(0x10, 0x3, 0x0) (rerun: 32) r10 = socket(0x1, 0x803, 0x0) getsockname$packet(r10, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000002c0)=0x14) sendmsg$nl_route(r9, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000480)=ANY=[@ANYBLOB="540000001000010400"/20, @ANYRES32=0x0, @ANYBLOB="00000000000000002c0012800e0001006970366772657461700000001800028014000700fc00000000000000000000000000000008000a00", @ANYRES32=r11], 0x54}}, 0x0) (async) r12 = socket(0x1, 0x803, 0x0) getsockname$packet(r12, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000001c0)=0x14) sendmsg$nl_route(r3, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000540)=ANY=[@ANYBLOB="500000001000110f00"/20, @ANYRES32=0x0, @ANYBLOB="040100000000000028001280090001007665746800000000180002801400010000000000", @ANYRES32=0x0, @ANYBLOB=' \x00\x00\x00 \x00\x00\x00\b\x00\n\x00', @ANYRES32=r13, @ANYBLOB="7cf7d7f29684b5667e10f2f46d747dc20cf7e96d418986972a2b9df0bf8eaf9abf19ba20fc687e8bb15edd740a0964490000000000000000"], 0x50}, 0x1, 0x0, 0x0, 0x40000}, 0x0) (async, rerun: 64) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="3c0000001000010400eeffff11ffffffff000000", @ANYRES32=r2], 0x3c}}, 0x0) (rerun: 64) 13m55.824819206s ago: executing program 0 (id=1994): r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$l2tp6(0xa, 0x2, 0x73) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r3 = socket(0x400000000010, 0x3, 0x0) r4 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r3, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000005c0)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0xffffffff, {0x0, 0x0, 0x0, r5, {0x0, 0xfff1}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_multiq={{0xb}, {0x8}}]}, 0x38}}, 0x0) r6 = socket$unix(0x1, 0x1, 0x0) r7 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x20000, 0x0) close(r7) socket$nl_generic(0x10, 0x3, 0x10) ioctl$SIOCSIFHWADDR(r7, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @link_local}) r8 = socket$kcm(0x11, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r6, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) r10 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r10, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) r12 = socket(0x400000000010, 0x3, 0x0) sendmsg$nl_route_sched(r12, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000780)=@newtfilter={0x8c, 0x2c, 0xd27, 0x70bd26, 0x259fdc02, {0x0, 0x0, 0x0, r11, {0xb, 0xfff3}, {}, {0x7}}, [@filter_kind_options=@f_matchall={{0xd}, {0x58, 0x2, [@TCA_MATCHALL_ACT={0x54, 0x2, [@m_skbedit={0x50, 0x1, 0x0, 0x0, {{0xc}, {0x24, 0x2, 0x0, 0x1, [@TCA_SKBEDIT_PARMS={0x18, 0x2, {0x3, 0x1ff, 0x20000000, 0x9, 0x77}}, @TCA_SKBEDIT_QUEUE_MAPPING={0x6, 0x4, 0x2fc}]}, {0x4}, {0xc, 0x7, {0x0, 0x1}}, {0xc, 0x8, {0x2, 0x3}}}}]}]}}]}, 0x8c}, 0x1, 0x0, 0x0, 0x2000c891}, 0x0) sendmsg$kcm(r8, &(0x7f00000000c0)={&(0x7f0000000380)=@xdp={0x2c, 0x7, r9, 0xb}, 0x80, &(0x7f0000000080)=[{&(0x7f0000000140)='\r', 0x1}], 0x1}, 0x4) setsockopt$IP6T_SO_SET_ADD_COUNTERS(r1, 0x29, 0x41, &(0x7f0000000080)={'filter\x00', 0x5, [{}, {}, {}, {}, {}]}, 0x78) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000300)=@newlink={0x48, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x300}, [@IFLA_LINKINFO={0x20, 0x12, 0x0, 0x1, @gtp={{0x8}, {0x14, 0x2, 0x0, 0x1, [@IFLA_GTP_CREATE_SOCKETS={0x5, 0x5, 0x1}, @IFLA_GTP_RESTART_COUNT={0x5, 0x6, 0x38}]}}}, @IFLA_MASTER={0x8}]}, 0x48}}, 0x40) 13m55.546949177s ago: executing program 0 (id=1998): socket$nl_generic(0x10, 0x3, 0x10) r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$ieee802154(&(0x7f0000000000), r0) sendmsg$IEEE802154_LLSEC_ADD_DEVKEY(r0, &(0x7f00000002c0)={0x0, 0x0, 0x0}, 0x8000) socket$nl_route(0x10, 0x3, 0x0) syz_emit_ethernet(0x3a, 0x0, 0x0) bind$inet(0xffffffffffffffff, &(0x7f0000000040)={0x2, 0x4e23, @broadcast}, 0x10) r1 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r1, 0x0, 0x0) sendmsg$nl_xfrm(r1, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000000)=ANY=[@ANYBLOB], 0xb8}}, 0x0) sendmsg$nl_xfrm(r1, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000000)=ANY=[@ANYBLOB="b80000001300e9990000000000000000fc00"/27], 0xb8}, 0x1, 0x0, 0x0, 0x80}, 0x0) r2 = socket$nl_xfrm(0x10, 0x3, 0x6) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, 0x0) r3 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000000)=ANY=[@ANYBLOB="b80000001300000200000000fddbdf257f0000010b9cf2065905b43b000000000000000000000000000000000000000000000004000000000a0060", @ANYRES32=0xee01, @ANYRESOCT], 0xb8}, 0x1, 0x0, 0x0, 0x80}, 0x50) sendmsg$nl_xfrm(r3, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000000)=ANY=[@ANYBLOB="b80000001300e9990000000000000000fc0000000000"], 0xb8}}, 0x20004000) sendmsg$nl_xfrm(r2, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000800)=ANY=[@ANYBLOB="b80000001300e9990500000000000000fc000000000000000000000000000000fc00000080ffffff000000000000000000000000000000000a0030"], 0xb8}}, 0x4000) socket$nl_route(0x10, 0x3, 0x0) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000000c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff000000000200000009000100"], 0x7c}}, 0x0) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000c80)={'lo\x00'}) 13m55.32389103s ago: executing program 0 (id=2000): r0 = socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt(r0, 0x84, 0x81, &(0x7f00000002c0)="1a00000002000000", 0x8) r1 = socket(0x2a, 0x2, 0x0) getsockname$packet(r1, &(0x7f0000000200)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000001480)=0x14) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000440)=@newqdisc={0x44, 0x24, 0xf0b, 0x0, 0x8, {0x0, 0x0, 0x0, r2, {}, {0xffff, 0xffff}, {0x0, 0xfff1}}, [@qdisc_kind_options=@q_hfsc={{0x9}, {0x14, 0x2, @TCA_HFSC_RSC={0x10, 0x1, {0x7, 0x7, 0x19}}}}]}, 0x44}, 0x1, 0x0, 0x0, 0x4000084}, 0x44884) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000001540)={0xe, 0x20000000000000bb, &(0x7f0000000300)=ANY=[@ANYBLOB="1800000000000000000000000000000018010000756c6c2500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb714000008"], 0x0, 0x0, 0x0, 0x0, 0x41000, 0x20, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffc, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0xe, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x41100, 0x39, '\x00', 0x0, @fallback=0x15, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, &(0x7f0000000340)={0x4, 0xb, 0x5, 0x1ffff}, 0x10, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x10, 0x4}, 0x94) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000300)=ANY=[@ANYBLOB="4c0000001800010800000000000000850a600000000000000500000014000500200100000000000000000300000000001c00090008000000", @ANYRES32=r3], 0x4c}}, 0x0) r4 = socket$netlink(0x10, 0x3, 0x0) sendmmsg(r4, &(0x7f00000002c0), 0x40000000000009f, 0x0) r5 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r5, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000001c0)=@newlink={0x28, 0x10, 0x1, 0x70bd25, 0x25dfdbff, {0x0, 0x0, 0x0, 0x0, 0x6293a, 0x3}, [@IFLA_GROUP={0x8}]}, 0x28}, 0x1, 0x0, 0x0, 0x40845}, 0x4000000) sendmsg$IPCTNL_MSG_CT_NEW(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000000c0)={0x0}, 0x1, 0x0, 0x0, 0x4000080}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000340)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000500)=@newtfilter={0x884, 0x2c, 0xd27, 0x70bd25, 0x25dfdffd, {0x0, 0x0, 0x0, r2, {0x6}, {}, {0x8, 0x6}}, [@filter_kind_options=@f_route={{0xa}, {0x854, 0x2, [@TCA_ROUTE4_POLICE={0x850, 0x5, [@TCA_POLICE_RATE={0x404, 0x2, [0xffff, 0x80, 0x800, 0x5, 0xf8a, 0x75, 0x7fffffff, 0x4, 0x7fffffff, 0x1, 0xfffffffb, 0x4, 0x6, 0x4, 0x8, 0x2, 0x0, 0x1, 0x8, 0x7ff, 0xdb, 0x72f4, 0x6, 0x7, 0xd6, 0x0, 0x7, 0x3, 0x2, 0x5a18, 0x2a, 0x5, 0xa, 0x5, 0x6, 0x6, 0x1, 0x0, 0x5, 0xd, 0x6, 0xe60, 0x3a, 0x14, 0x31, 0xc4e2, 0xbf3, 0xfffffff7, 0x2, 0x8, 0x50, 0xfffffff2, 0x8, 0x8, 0x80000001, 0xfffffff7, 0x671b, 0x0, 0x1, 0x9, 0x36, 0xd, 0x79, 0x0, 0x9, 0x8, 0x8, 0x4, 0x10, 0x722b, 0x3f38b6fd, 0x7, 0x4, 0xcb8, 0x713e, 0x8, 0x9, 0x5, 0x33b1026, 0xe9de, 0xf6, 0xd, 0xc, 0x7800000, 0xc1, 0x6f, 0x5, 0x8, 0x2, 0x4, 0xace1, 0x4, 0x6, 0x2, 0x4, 0xff, 0x87, 0x99cf, 0xf, 0x306, 0x6505, 0x4, 0x98, 0x3, 0x6, 0x1, 0x5ba, 0x8, 0x0, 0x7ff, 0x7ff, 0x6, 0x7fffffff, 0x8, 0x3c00000, 0x101, 0xf98, 0x5, 0xc46c, 0x8, 0x7, 0x3b, 0x9, 0xffffffff, 0x81, 0x2, 0x5, 0x1, 0x1000, 0x200, 0xc51, 0x6ee2, 0xe81, 0x8901, 0x2, 0x4, 0x3, 0x7, 0x7b9, 0xfa, 0x40, 0xe, 0x6, 0x9, 0x7fffffff, 0x7fffffff, 0x4ff5a575, 0xc6b7, 0x1, 0xffff8001, 0x40, 0xff, 0x7, 0x5, 0x6e7, 0x3, 0x1, 0xa434, 0xffff, 0x6, 0x6, 0x6, 0x9, 0x4, 0xfffffff7, 0x10001, 0xfffffffa, 0x0, 0x3, 0x3, 0xffffffff, 0x5, 0x357a, 0x1, 0x1, 0x4, 0x4, 0x6, 0x7f, 0x7, 0x8, 0x3, 0x10001, 0xcbf, 0x7, 0x5, 0xf6, 0x8, 0x4, 0x9f8, 0x9, 0x6, 0x1, 0x9, 0x8, 0xff, 0x1ff, 0x2b, 0x5, 0x8, 0x9, 0xff, 0x2, 0x2, 0xfffffff8, 0x5, 0xc3, 0x40, 0x7, 0x80000001, 0x4000000, 0x3, 0xffffffff, 0x800, 0x8, 0x4, 0xb, 0x4, 0x8, 0x1, 0x7f, 0x6, 0x1, 0x10000, 0xacd6, 0xfffffff7, 0x200, 0x10001, 0x8, 0xfffffffa, 0x2, 0x2, 0x4, 0x9, 0x6, 0xffff108b, 0xfffffead, 0x0, 0x0, 0x1ff, 0x4, 0x3, 0x8, 0x0, 0xa6d, 0x5c5, 0x2, 0x6, 0x82, 0x3, 0xffffff7d, 0x8001, 0xffffff2d, 0x2, 0x1000, 0x80000000]}, @TCA_POLICE_AVRATE={0x8, 0x4, 0x2}, @TCA_POLICE_TBF={0x3c, 0x1, {0x5, 0x20000000, 0x200, 0xc8, 0x0, {0xa, 0x2, 0x3, 0x1, 0x4, 0x3}, {0x6, 0x1, 0x1, 0xbbc0, 0x9, 0x1}, 0x96f, 0x7f, 0xa}}, @TCA_POLICE_PEAKRATE={0x404, 0x3, [0x0, 0x6, 0x2, 0x7f, 0x3, 0x8, 0x5, 0x3, 0x3, 0x5, 0x80000001, 0x6, 0x0, 0x8, 0x80000000, 0x6032, 0xc2, 0x9, 0x1000, 0x6, 0x6f, 0x7c45, 0x0, 0x5, 0x9, 0x9, 0xef, 0x291d, 0x0, 0x8, 0x1, 0x8, 0x1, 0x0, 0x2, 0x0, 0xf08, 0xb, 0x6, 0x0, 0xf96a, 0x8, 0x2, 0xc791, 0x6597121a, 0x9, 0x25dc, 0x40, 0x0, 0x0, 0x6, 0x93, 0x7, 0x0, 0x7, 0x4, 0xde1, 0x7fffffff, 0xe32, 0x1, 0xfffffff7, 0x9, 0x10000, 0x6ff0, 0x9, 0x0, 0xfffffff9, 0x1, 0x9, 0xb, 0x58000, 0x2bcd, 0x80000001, 0x1, 0x10001, 0x3, 0x19, 0x1, 0xffffffff, 0x8001, 0x1, 0x1, 0x2, 0x9, 0x9, 0x8000, 0x490000, 0xfffffff2, 0xb3f, 0xffffb6fa, 0x4, 0x0, 0x401, 0x5, 0xd, 0x8, 0x401, 0x4, 0x1ff, 0x3, 0x7f, 0x9, 0x5, 0x97, 0x3, 0x3, 0xc, 0xf, 0x3, 0x3ff, 0x4, 0x80000000, 0x10, 0x8, 0x30, 0x0, 0x4, 0x5, 0xb, 0x40, 0xffffffff, 0x7fffffff, 0x6, 0x101, 0x1, 0xfffffff7, 0x3, 0x0, 0xcc, 0x1, 0x26c0, 0x2, 0x1, 0x5, 0x9, 0x9, 0x2, 0xfffffff8, 0xdc88, 0x8, 0x0, 0x7, 0x7, 0x6, 0x5, 0x3, 0x0, 0x4, 0x2, 0xd, 0x0, 0xbbb, 0x27e, 0x1, 0x75b, 0x8, 0x2, 0x7, 0x2, 0x3, 0x9, 0xfffffffc, 0x5, 0x3, 0x0, 0x9, 0x6, 0x9, 0x1ff, 0x9, 0xa461, 0x8, 0x7, 0x2, 0x800, 0x0, 0x0, 0x6, 0x9, 0x9, 0x49e88dee, 0x3ff, 0x6, 0x6, 0x0, 0x0, 0x9b85, 0x37, 0x800, 0xfffffffe, 0x6, 0x5, 0x6, 0x3, 0x2, 0xd, 0xffffffb4, 0x8000, 0x5, 0xfffffffa, 0x2, 0x3, 0x4a00000, 0x80000001, 0xe71a, 0x6, 0x9, 0x4, 0x2, 0x4, 0x61, 0x1, 0x2, 0xfffffffc, 0x10001, 0x6, 0x2, 0x2, 0x7, 0x7, 0x6, 0x80000000, 0x2, 0x7fff, 0x5, 0xf, 0x401, 0x400, 0xba, 0x8, 0x200, 0x8, 0xb33b, 0x9, 0x7, 0x1, 0x4, 0x8, 0x7, 0x0, 0x2, 0x3, 0x9, 0x0, 0x10, 0xd177, 0x7, 0x6ef, 0x2bd, 0x1, 0x2d, 0xa047, 0xe9e, 0x120000, 0x7, 0x38000]}]}]}}]}, 0x884}}, 0x20004811) r6 = socket$inet_udp(0x2, 0x2, 0x0) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000300)=@bpf_lsm={0xe, 0x3, &(0x7f0000000040)=@framed={{0x15, 0xa, 0x0, 0x0, 0x0, 0x61, 0x10, 0x64}}, &(0x7f0000000000)='GPL\x00'}, 0x90) r7 = socket$nl_generic(0x10, 0x3, 0x10) r8 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000000), 0xffffffffffffffff) sendmsg$ETHTOOL_MSG_LINKMODES_SET(r7, &(0x7f0000000240)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f00000000c0)={0x38, r8, 0x7, 0x0, 0x0, {}, [@ETHTOOL_A_LINKMODES_OURS={0xc, 0x3, 0x0, 0x1, [@ETHTOOL_A_BITSET_NOMASK={0x4}, @ETHTOOL_A_BITSET_MASK={0x4}]}, @ETHTOOL_A_LINKMODES_HEADER={0x18, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'syz_tun\x00'}]}]}, 0x38}}, 0x0) sendmsg$ETHTOOL_MSG_EEE_GET(r1, &(0x7f0000000dc0)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x4000}, 0xc, &(0x7f00000004c0)={&(0x7f00000003c0)={0x70, r8, 0x408, 0x70bd25, 0x25dfdbff, {}, [@HEADER={0x5c, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x3}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x2}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r2}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'veth0_to_batadv\x00'}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x1}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r2}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'sit0\x00'}, @ETHTOOL_A_HEADER_FLAGS={0x8}]}]}, 0x70}, 0x1, 0x0, 0x0, 0x4004000}, 0x4c890) sendmsg$inet(r6, &(0x7f0000000100)={&(0x7f0000000180)={0x2, 0x4e23, @multicast1}, 0x10, 0x0, 0x0, &(0x7f0000000280)=[@ip_retopts={{0x10}}, @ip_pktinfo={{0x1c, 0x0, 0x8, {0x0, @dev={0xac, 0x14, 0x14, 0x1e}, @rand_addr=0x64010102}}}], 0x30}, 0x4000004) r9 = socket$netlink(0x10, 0x3, 0x0) sendmmsg(r9, &(0x7f00000002c0), 0x40000000000009f, 0x0) setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(r0, 0x84, 0x64, &(0x7f0000000000)=[@in6={0xa, 0x4e23, 0x0, @loopback}], 0x1c) sendto$inet6(r0, &(0x7f0000000040)='l', 0x1, 0x0, &(0x7f0000000100)={0xa, 0x4e23, 0x0, @loopback}, 0x1c) 13m54.274238116s ago: executing program 0 (id=2005): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x48241, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x6bf1c2d5adba8c32}) bpf$PROG_LOAD_XDP(0x5, &(0x7f00000001c0)={0x12, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0xe}, 0x94) r1 = socket$kcm(0x2, 0xa, 0x2) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local}) write$tun(r0, &(0x7f00000004c0)={@val, @void, @eth={@link_local, @broadcast, @val={@void, {0x8100, 0x3, 0x1, 0x3}}, {@ipv4={0x800, @udp={{0x5, 0x4, 0x0, 0x0, 0x2c, 0x0, 0x0, 0x0, 0x2f, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @multicast1}, {0x0, 0x6558, 0x18, 0x0, @wg=@data={0x4, 0x0, 0x5865}}}}}}}, 0x42) 13m39.223190799s ago: executing program 32 (id=2005): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x48241, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x6bf1c2d5adba8c32}) bpf$PROG_LOAD_XDP(0x5, &(0x7f00000001c0)={0x12, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0xe}, 0x94) r1 = socket$kcm(0x2, 0xa, 0x2) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local}) write$tun(r0, &(0x7f00000004c0)={@val, @void, @eth={@link_local, @broadcast, @val={@void, {0x8100, 0x3, 0x1, 0x3}}, {@ipv4={0x800, @udp={{0x5, 0x4, 0x0, 0x0, 0x2c, 0x0, 0x0, 0x0, 0x2f, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @multicast1}, {0x0, 0x6558, 0x18, 0x0, @wg=@data={0x4, 0x0, 0x5865}}}}}}}, 0x42) 3.400110306s ago: executing program 2 (id=8532): r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000540)={&(0x7f0000000640)=@delpolicy={0x68, 0x14, 0x1, 0x0, 0x25dfdbfb, {{@in=@multicast1, @in6=@rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02', 0x0, 0x80, 0x7, 0x0, 0x0, 0x80}}, [@sec_ctx={0xc, 0x8, {0x8, 0x8, 0x0, 0x1}}, @mark={0xc, 0x15, {0x0, 0x100}}]}, 0x68}}, 0x4004040) r1 = socket$inet6_udp(0xa, 0x2, 0x0) bind$inet6(r1, &(0x7f0000000040)={0xa, 0x4e23, 0x93, @local, 0xffff}, 0x1c) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000c80)={'lo\x00'}) (async) r2 = socket$netlink(0x10, 0x3, 0x0) (async, rerun: 64) r3 = socket$packet(0x11, 0x2, 0x300) (rerun: 64) setsockopt$packet_int(r3, 0x107, 0xa, &(0x7f0000000080)=0x2, 0x4) (async) setsockopt$packet_rx_ring(r3, 0x107, 0x5, &(0x7f0000000040)=@req3={0x1000, 0x3a, 0x1000, 0x3a, 0x0, 0x200000, 0xffffffff}, 0x1c) (async) sendmsg$nl_route(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f0000000800)=@ipv6_delrule={0x2c, 0x21, 0x11, 0x0, 0x0, {}, [@FIB_RULE_POLICY=@FRA_L3MDEV={0x5, 0x13, 0x1}, @FIB_RULE_POLICY=@FRA_TABLE={0x8}]}, 0x2c}}, 0x0) (async) r4 = socket$nl_generic(0x10, 0x3, 0x10) (async) socketpair(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r7 = bpf$MAP_CREATE(0x0, &(0x7f0000000080)=ANY=[@ANYBLOB="120000a66a7aa563dfa699000600c2ea17b3000002ec85868e1de61a8e6b8206fd98ff6493f36c5889d8f779e20400577d4aba"], 0x50) (async) r8 = socket$inet6_udp(0xa, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r8, 0x8933, &(0x7f0000000c80)={'lo\x00', 0x0}) ioctl$sock_inet6_SIOCSIFADDR(r8, 0x8916, &(0x7f0000000180)={@loopback, 0x58, r9}) (async) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000180)={{r7}, 0x0, &(0x7f0000000140)=r6}, 0x20) (async) r10 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r11 = syz_genetlink_get_family_id$nbd(&(0x7f0000000040), 0xffffffffffffffff) (async) r12 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r12, 0x29, 0x40, &(0x7f00000005c0)=@raw={'raw\x00', 0x3c1, 0x3, 0x2d0, 0x348, 0x18c, 0x203, 0x0, 0x19030000, 0x480, 0x2e0, 0x2e0, 0x480, 0x2e0, 0x8000000, 0x0, {[{{@uncond, 0x300, 0xa8, 0xf0}, @common=@inet=@TEE={0x48, 'TEE\x00', 0x1, {@ipv4=@private, 'veth1_macvtap\x00', {0xffff}}}}, {{@uncond, 0x0, 0xa8, 0x110}, @unspec=@CT2={0x68, 'CT\x00', 0x2, {0x10, 0x1a, 0xfffffff6, 0x81, 'syz1\x00', 'syz1\x00', {0xfffffffffffffffc}}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x330) (async) sendmsg$NBD_CMD_CONNECT(r10, &(0x7f0000001ac0)={0x0, 0x0, &(0x7f0000001a80)={&(0x7f00000000c0)={0x3c, r11, 0x1, 0x70bd2c, 0x0, {}, [@NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x2}, @NBD_ATTR_SOCKETS={0x1c, 0x7, 0x0, 0x1, [{0xc, 0x1, 0x0, 0x1, {0x8, 0x1, r5}}, {0xc, 0x1, 0x0, 0x1, {0x8, 0x1, r5}}]}]}, 0x3c}, 0x1, 0x0, 0x0, 0x55ebfcb85e78e904}, 0x4) (async) recvmsg$unix(r6, &(0x7f00000005c0)={0x0, 0x0, &(0x7f0000000480)=[{&(0x7f00000004c0)=""/8, 0x8}], 0x1}, 0x10022) (async, rerun: 64) sendmsg$nl_crypto(r5, 0x0, 0x800) (async, rerun: 64) syz_genetlink_get_family_id$ethtool(&(0x7f0000000000), r4) r13 = syz_genetlink_get_family_id$netlbl_calipso(&(0x7f0000000300), r10) sendmsg$NLBL_CALIPSO_C_LISTALL(r10, &(0x7f0000000400)={&(0x7f00000002c0)={0x10, 0x0, 0x0, 0x4000}, 0xc, &(0x7f00000003c0)={&(0x7f0000000340)={0x4c, r13, 0x4, 0x70bd2b, 0x25dfdbfe, {}, [@NLBL_CALIPSO_A_MTYPE={0x8}, @NLBL_CALIPSO_A_MTYPE={0x8}, @NLBL_CALIPSO_A_MTYPE={0x8}, @NLBL_CALIPSO_A_MTYPE={0x8}, @NLBL_CALIPSO_A_MTYPE={0x8}, @NLBL_CALIPSO_A_DOI={0x8, 0x1, 0x1}, @NLBL_CALIPSO_A_MTYPE={0x8}]}, 0x4c}, 0x1, 0x0, 0x0, 0x8001}, 0x14000) (async) bpf$PROG_LOAD(0x5, &(0x7f00000054c0)={0x10, 0x16, &(0x7f0000000780)=ANY=[@ANYBLOB="61123000000000006113340000000000bf10000000000000160002000ee600f03d030100000000008701000000000000bc26000000000000bf67000000000000560300000ee60070670200001f000000160300000ee600f0bf050000000000000f610000000000006507f4ff02000400070700004c0040001f75000000000000bf54000000000000070500000300f9ffad430100000000009500000000000000050000000000000095000000000000004d9bd591d568253e9988431ec068e3a82983d58719d72183f2cb7f43dd55788be820b236dcb695dbfd737cbf719506d2d6b05fe7030586e3f640f9f7e9a73b761ad4f0952a70046270d2b6436fdeecd791614ed46de741eb8cf91c046ef9beca574b350021c7ec6ef130f53748068ca432dae4e248b22b9ad8b2811f67916a1764578cba4b069037bfb3362d5691ac397f7e207145d970f0d97867552629b146645c785fb77dbeca38e49a9d5221f1f45f0a25890d04d91a15a05ae7e7ed6252c3d6c1973fb858de1da70d67317e7872b0603ce47ed2c1520e71b527bb42aa2e20e1e85df73736ed0a782ab7e7278dd54358cfdf6313d40f926332623625b49626481054787ab2dff85a9bebd6b317f26c691a65aa97bb3d1506a3a565e9c7ea5ad4611d2d77ee8a5c1b23814a26b6a20061fbb65bdd03770fa849f2a29ba69f90625f42592a70ba890f7a92878ae73574c3a233ee5954119931a1905210715fa77a8795f2fbec3797cb90f59fe8a4abec25f40c87bf25b750bbaa"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sk_msg}, 0x48) (async) syz_genetlink_get_family_id$l2tp(&(0x7f0000000080), 0xffffffffffffffff) (async) socket$nl_generic(0x10, 0x3, 0x10) 3.034339241s ago: executing program 2 (id=8537): syz_80211_join_ibss(0x0, &(0x7f0000000080)=@default_ibss_ssid, 0x6, 0x0) r0 = socket$inet6_sctp(0xa, 0x5, 0x84) getsockopt$bt_hci(r0, 0x84, 0x84, &(0x7f0000000080)=""/4096, &(0x7f0000001200)=0x1000) syz_emit_ethernet(0x4e, &(0x7f0000000600)={@local, @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x2}, @void, {@ipv4={0x800, @tcp={{0x5, 0x4, 0x0, 0x0, 0x40, 0x0, 0x0, 0x0, 0x6, 0x0, @private=0xa010102, @local}, {{0x0, 0x0, 0x41424344, 0x41424344, 0x0, 0x6, 0xb, 0x0, 0x0, 0x0, 0x0, {[@nop, @mss={0x2, 0x4, 0x5e9}, @exp_smc={0xfe, 0x6}, @timestamp={0x8, 0xa, 0x1}]}}}}}}}, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000040)={0x1e, 0xb, &(0x7f0000000880)=ANY=[@ANYRES8], &(0x7f0000000000)='syzkaller\x00', 0x8, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, 0x24}, 0x94) 2.872296408s ago: executing program 2 (id=8539): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_TEST(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000180)=ANY=[@ANYBLOB="280000000b0601020000000000000000030000020500010007003100"/40], 0x28}, 0x1, 0x0, 0x0, 0x4064}, 0x4800) syz_init_net_socket$llc(0x1a, 0x1, 0x0) 2.764558267s ago: executing program 5 (id=8540): r0 = socket$inet(0x2, 0x2, 0x0) setsockopt$inet_opts(r0, 0x0, 0x4, 0x0, 0x0) sendto$inet(r0, 0x0, 0x0, 0x40010, &(0x7f0000000080)={0x2, 0x4e23, @empty}, 0x10) r1 = socket(0x2, 0x3, 0xff) ioctl$sock_ipv4_tunnel_SIOCDELTUNNEL(r1, 0x8910, &(0x7f0000000100)={'tunl0\x00', 0x0}) ioctl$sock_inet6_tcp_SIOCOUTQ(r1, 0x5411, &(0x7f0000000000)) 2.642889118s ago: executing program 2 (id=8543): r0 = socket(0xa, 0x5, 0x0) sendmsg$inet_sctp(r0, &(0x7f00000000c0)={&(0x7f0000000000)=@in={0x2, 0x4e23, @rand_addr=0x64010100}, 0x10, &(0x7f0000000040)=[{&(0x7f0000000100)="e6", 0x1}], 0x1, &(0x7f0000000140)=[@dstaddrv6={0x20, 0x84, 0x8, @rand_addr=' \x01\x00'}, @dstaddrv6={0x20, 0x84, 0x8, @private0}], 0x40, 0x4851}, 0x24000052) bpf$MAP_CREATE(0x0, &(0x7f0000000240)=ANY=[@ANYRES8=r0], 0x48) socket$nl_generic(0x10, 0x3, 0x10) r1 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r1, &(0x7f0000000380)={0x2, 0x4e22, @multicast1}, 0x10) setsockopt$sock_int(r1, 0x1, 0x800000000f, &(0x7f0000000080)=0x7, 0x4) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) r4 = socket$nl_route(0x10, 0x3, 0x0) r5 = socket$kcm(0xa, 0x1, 0x106) sendmsg$kcm(r5, &(0x7f00000002c0)={0x0, 0x0, 0x0}, 0x20040011) r6 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r6, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000000c0)={0x14, 0x3a, 0x301, 0x70bd25, 0xfffffffc, {0x7}}, 0x14}}, 0x0) syz_genetlink_get_family_id$nl80211(&(0x7f0000000040), r6) sendmsg$kcm(r5, &(0x7f0000000780)={&(0x7f0000000000)=@in6={0xa, 0xfffe, 0x0, @ipv4={'\x00', '\xff\xff', @remote}, 0x2}, 0x80, 0x0}, 0xe07e872420dfefca) r7 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_tx_ring(r7, 0x107, 0x5, &(0x7f00000000c0)=@req3={0x808000, 0x4, 0x20300, 0xfc}, 0x1c) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x18, 0xf, &(0x7f0000000100)=@ringbuf={{0x18, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x80}, {{0x18, 0x1, 0x1, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x3010000}, {}, {0x7, 0x0, 0xb, 0x3, 0x0, 0x0, 0xfeff}, {0x85, 0x0, 0x0, 0x86}, {0x7, 0x1, 0xb, 0x9, 0x0, 0x20}}, {{0x5, 0x0, 0x5, 0x9, 0x0, 0x1, 0x80000000}}, [], {{}, {0x7, 0x0, 0xb, 0x2, 0x0, 0x0, 0x3}, {0x85, 0x0, 0x0, 0x84}, {0x7, 0x0, 0xb, 0x0, 0x0, 0x0, 0x500}}}, &(0x7f0000000000)='GPL\x00', 0x3, 0x0, 0x0, 0x41000, 0x64, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x6}, 0x94) poll(&(0x7f0000000300)=[{r7, 0x80}], 0x1, 0x101) r8 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r8, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000001c0)=ANY=[@ANYBLOB="200000002400077760efd800fbdbdf25227c00000c0009000000000010000003f0000000"], 0x20}, 0x1, 0x0, 0x0, 0x4048011}, 0x8010) sendmsg$nl_route_sched(r4, &(0x7f0000000b00)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f00000004c0)=@deltaction={0x278, 0x31, 0x1, 0x70bd2d, 0x25dfdbfd, {}, [@TCA_ACT_TAB={0x4c, 0x1, [{0xc, 0x1a, 0x0, 0x0, @TCA_ACT_INDEX={0x8, 0x3, 0x8}}, {0xc, 0x1c, 0x0, 0x0, @TCA_ACT_INDEX={0x8, 0x3, 0x1}}, {0x14, 0x19, 0x0, 0x0, @TCA_ACT_KIND={0xf, 0x1, 'tunnel_key\x00'}}, {0x10, 0x3, 0x0, 0x0, @TCA_ACT_KIND={0xb, 0x1, 'police\x00'}}, {0xc, 0x9, 0x0, 0x0, @TCA_ACT_INDEX={0x8, 0x3, 0x1}}]}, @TCA_ACT_TAB={0x24, 0x1, [{0x10, 0x8, 0x0, 0x0, @TCA_ACT_KIND={0xb, 0x1, 'police\x00'}}, {0x10, 0xa, 0x0, 0x0, @TCA_ACT_KIND={0xb, 0x1, 'sample\x00'}}]}, @TCA_ACT_TAB={0x10, 0x1, [{0xc, 0x7, 0x0, 0x0, @TCA_ACT_INDEX={0x8}}]}, @TCA_ACT_TAB={0x30, 0x1, [{0x14, 0x18, 0x0, 0x0, @TCA_ACT_KIND={0xd, 0x1, 'connmark\x00'}}, {0xc, 0x18, 0x0, 0x0, @TCA_ACT_KIND={0x8, 0x1, 'nat\x00'}}, {0xc, 0x1e, 0x0, 0x0, @TCA_ACT_INDEX={0x8, 0x3, 0x54}}]}, @TCA_ACT_TAB={0x10, 0x1, [{0xc, 0x12, 0x0, 0x0, @TCA_ACT_KIND={0x8, 0x1, 'nat\x00'}}]}, @TCA_ACT_TAB={0x48, 0x1, [{0x10, 0xb, 0x0, 0x0, @TCA_ACT_KIND={0x9, 0x1, 'csum\x00'}}, {0xc, 0x13, 0x0, 0x0, @TCA_ACT_INDEX={0x8, 0x3, 0x80000001}}, {0xc, 0x19, 0x0, 0x0, @TCA_ACT_INDEX={0x8, 0x3, 0x5}}, {0x10, 0x8, 0x0, 0x0, @TCA_ACT_KIND={0xb, 0x1, 'mirred\x00'}}, {0xc, 0x11, 0x0, 0x0, @TCA_ACT_INDEX={0x8}}]}, @TCA_ACT_TAB={0x28, 0x1, [{0xc, 0x1f, 0x0, 0x0, @TCA_ACT_INDEX={0x8, 0x3, 0x9}}, {0xc, 0x9, 0x0, 0x0, @TCA_ACT_INDEX={0x8, 0x3, 0xfffffffd}}, {0xc, 0x1e, 0x0, 0x0, @TCA_ACT_INDEX={0x8, 0x3, 0x1000}}]}, @TCA_ACT_TAB={0x6c, 0x1, [{0xc, 0x11, 0x0, 0x0, @TCA_ACT_INDEX={0x8, 0x3, 0x6}}, {0xc, 0x8, 0x0, 0x0, @TCA_ACT_INDEX={0x8, 0x3, 0xfffffff0}}, {0x10, 0x1c, 0x0, 0x0, @TCA_ACT_KIND={0xa, 0x1, 'pedit\x00'}}, {0x10, 0xa, 0x0, 0x0, @TCA_ACT_KIND={0xb, 0x1, 'police\x00'}}, {0xc, 0xe, 0x0, 0x0, @TCA_ACT_INDEX={0x8, 0x3, 0x9}}, {0x14, 0x7, 0x0, 0x0, @TCA_ACT_KIND={0xf, 0x1, 'tunnel_key\x00'}}, {0x10, 0x9, 0x0, 0x0, @TCA_ACT_KIND={0xb, 0x1, 'mirred\x00'}}]}, @TCA_ACT_TAB={0x9c, 0x1, [{0x10, 0x10, 0x0, 0x0, @TCA_ACT_KIND={0x9, 0x1, 'vlan\x00'}}, {0xc, 0x6, 0x0, 0x0, @TCA_ACT_INDEX={0x8, 0x3, 0x9}}, {0xc, 0x4, 0x0, 0x0, @TCA_ACT_INDEX={0x8, 0x3, 0x52}}, {0x10, 0x9, 0x0, 0x0, @TCA_ACT_KIND={0xb, 0x1, 'mirred\x00'}}, {0x10, 0x1, 0x0, 0x0, @TCA_ACT_KIND={0x9, 0x1, 'gact\x00'}}, {0x10, 0x6, 0x0, 0x0, @TCA_ACT_KIND={0xb, 0x1, 'skbmod\x00'}}, {0xc, 0x17, 0x0, 0x0, @TCA_ACT_INDEX={0x8, 0x3, 0x4eb}}, {0x10, 0x2, 0x0, 0x0, @TCA_ACT_KIND={0xb, 0x1, 'mirred\x00'}}, {0x10, 0x1d, 0x0, 0x0, @TCA_ACT_KIND={0xc, 0x1, 'skbedit\x00'}}, {0x14, 0x17, 0x0, 0x0, @TCA_ACT_KIND={0xd, 0x1, 'connmark\x00'}}]}, @TCA_ACT_TAB={0x2c, 0x1, [{0xc, 0x3, 0x0, 0x0, @TCA_ACT_INDEX={0x8, 0x3, 0xffff}}, {0x10, 0xb, 0x0, 0x0, @TCA_ACT_KIND={0xb, 0x1, 'skbmod\x00'}}, {0xc, 0x2, 0x0, 0x0, @TCA_ACT_KIND={0x8, 0x1, 'bpf\x00'}}]}]}, 0x278}, 0x1, 0x0, 0x0, 0x40000}, 0x4000814) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000080)={'veth1_macvtap\x00', 0x0}) sendmsg$nl_route(r3, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000000)=@newlink={0x44, 0x10, 0x401, 0xfffffffc, 0x25dfdbff, {0x0, 0x0, 0x0, 0x0, 0x31943}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @macsec={{0xb}, {0x4}}}, @IFLA_LINK={0x8, 0x5, r9}, @IFLA_MASTER={0x8, 0xa, r9}]}, 0x44}, 0x1, 0x0, 0x0, 0x2004d808}, 0x0) bind$inet6(r2, &(0x7f0000000140)={0xa, 0xce22, 0x7f, @ipv4={'\x00', '\xff\xff', @multicast1}, 0xffffffff}, 0x1c) listen(r1, 0x0) listen(r2, 0x2) r10 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$sock_int(r10, 0x1, 0xf, &(0x7f0000000180)=0x800001, 0x4) 2.524045134s ago: executing program 5 (id=8545): r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000500)=ANY=[@ANYBLOB="020000000400000005000000aa"], 0x50) bpf$MAP_LOOKUP_BATCH(0x18, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000000), &(0x7f0000000200), 0xa7c, r0}, 0x38) (async) r1 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000340)=ANY=[@ANYBLOB="02000000040000000800000001"], 0x50) r2 = bpf$PROG_LOAD(0x5, &(0x7f00000004c0)={0x1f, 0x11, &(0x7f0000000180)=ANY=[@ANYBLOB="180000000000000000000000000000008500000050000000b7080000000000007baaf8ff00000000b5080000000000007b8af0ff00000000bfa100000000000007010000f8ffffffbfa400000000000007040000f0ffffffb70200000800000018230000", @ANYRES32=r1, @ANYBLOB="0000000000000000b705000008000000850000001000000095"], &(0x7f0000000100)='syzkaller\x00', 0x0, 0x0, 0x0, 0x41100, 0x1a, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r3 = bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0x6, 0xc, &(0x7f0000000140)=ANY=[@ANYBLOB="18020000040000000000000000000000850000002c000000180100002020732500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000007300000095"], &(0x7f00000001c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @xdp, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) readv(r3, 0x0, 0x0) (async, rerun: 64) bpf$ENABLE_STATS(0x20, 0x0, 0x0) (async, rerun: 64) bpf$PROG_BIND_MAP(0xa, &(0x7f0000000000)={r2}, 0xc) (async) r4 = bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=@base={0x1b, 0x0, 0x0, 0x8000}, 0x48) r5 = bpf$PROG_LOAD(0x5, &(0x7f0000000440)={0x3, 0xd, &(0x7f0000000000)=@framed={{0x18, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6}, [@call={0x85, 0x0, 0x0, 0x11}, @ringbuf_output={{0x18, 0x1, 0x1, 0x0, r4}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0x5}, {}, {}, {}, {}, {0x7, 0x0, 0xb, 0x4, 0x0, 0x0, 0x1}}]}, &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, @fallback=0x35, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000240)={r5, 0x0, 0xe40, 0xe40, &(0x7f00000002c0)='\x00\x00\x00\x00\x00\x00\x00\x00', &(0x7f0000000300)=""/8, 0x320e, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x4c) (async) write$cgroup_subtree(0xffffffffffffffff, &(0x7f0000000080)=ANY=[@ANYRES32=r0, @ANYRESHEX=0x0, @ANYRESOCT=r0, @ANYRESHEX=r5], 0xfdef) (async, rerun: 32) r6 = bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000380)={0x6, 0x3, &(0x7f0000000680)=ANY=[@ANYBLOB="1800000002000000000000000000000095"], 0x0}, 0x94) (async, rerun: 32) socket$nl_route(0x10, 0x3, 0x0) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x5) (async, rerun: 64) close(0x4) (async, rerun: 64) syz_open_procfs$namespace(0x0, &(0x7f0000000200)='ns/uts\x00') (async, rerun: 64) unshare(0x6a040000) (async, rerun: 64) connect$inet(0xffffffffffffffff, &(0x7f0000000000)={0x2, 0x4e21, @multicast1}, 0x10) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000440)={0x6, 0x3, &(0x7f0000000680)=ANY=[], &(0x7f00000002c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x5}, 0x94) (async) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000600)={r6, 0x5, 0x1, 0x0, &(0x7f0000000000)='%', 0x0, 0x23, 0x88be, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0xc7f}, 0x50) 2.418206299s ago: executing program 5 (id=8547): sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x8, &(0x7f0000000280)={&(0x7f0000000240)=@delchain={0x24, 0x65, 0x400, 0x70bd29, 0x25dfdbfc, {0x0, 0x0, 0x0, 0x0, {0x509d884560ba1ba6, 0x3}, {}, {0xfff3, 0x10}}}, 0x24}}, 0x10) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_GET(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000440)=ANY=[@ANYBLOB="60000000010103000000054400028006000340000100000c000280050001003c0000002c0001801400030000000000000000000000ffffac1e000114000400fe8000000000000000000000000000bb0600124000040000a2e0ad687e82fca620c661e3f763c1725d1ef9ab5cfe1bac1ba4153d000000000000000000"], 0x60}, 0x1, 0x0, 0x0, 0x20008014}, 0x4000c090) sendmsg$TEAM_CMD_OPTIONS_SET(0xffffffffffffffff, &(0x7f0000004bc0)={0x0, 0x0, &(0x7f0000004b80)={&(0x7f0000004c00)=ANY=[@ANYRESOCT, @ANYRESDEC=0x0, @ANYRES64=0x0, @ANYBLOB="31682fdbe930e2e52b9926d1b63832ca65e17793891e4867e367443af3457c82e2d0e1a08c2ff4085c0b154261912f0d411fdf2715e64120b7275af582c7b0ec958b1f01751c571d460e8069daea25bd680e614ea07a4fe6b1fcf1bf5adedaa38aa40ebfb32afe46875320e92618f826b1682c12c0a4c140373d1d28e3a64165c3b03e7ec0eb2281a4e7c5b44cce9987f6309a890df086148edb7d1e2235fbfca2c0e236836226ada99d878872ddec00dd44528a16a1321410cdc8fae4786fa1f864bf0f059e690464634d5e942ac9de0bb5c02cc542a0ea82ca50613405d073ceb8175ae4ec45cdeae5861d345105df2c7c93bde18699b987a68a8adce03f0c258cedc7e10016aba225a7c11ca01ea4d4ad25ee137419ffa6a6353e8605a8623acb0470cddb46c8cff74ed50a96440a51109f205f172fecdab0b9d0e1904c40d89093cdd11ef3e7a433509164e84291a2170cebd5651a54146dc9965d05f90600111f2a1891da07f04e2c100557ea7c446948a700ed52d8553e2f33f02aad8a0628823caeb719d87c30e6de1f4229dd35b9a5d2f7807f28014d573de38883df84959a3fc3300158a93a62f8cf3c9d0f92fa906d13c9a2646f2b455fa7f5275e22fd03ca32f598790921d35f23ac41cd29f53c5f8ff25d52800c71746f4b9c7e8d74fcf6cdca04ee750e45b62acc00e8be58eb802fa50ed6e38bab43c472ed6cd19c32e8d9f47fbe9afcab31ce9992a53c8f0f1ec940504c69a3027b9e04e186a712adc8d2cecd73a4cae397b5dde5caaff8f9bd00950245cf5d0f0b915f991e38a7ae35abd62f94efb953a068177ddf0bbe79a48789b2d13b723866c25a8774f9d1f2f51cb84a45ee3b3e80ce90d05fe878a5a94861f8be6e35891f5582d9cd4c2609d4d7f4f6aee36a8191c42037eeaae5509823f0d7d0ffd62669a6d02ebf6955ba1bef4f9ec53682b732270845ebeee6e43ab91216b2549bfabcd7a9e027b4a1ba4498111029b78f156c789f1cd8c64e10c46ff335cfb62749b6056511057e6873fd4bb174023a45c0bd4208d392ae27fe09e753df92c9f32d68ec26c9a2a8a18e6fe35552b8746a141e20b072cab0242749890c08908b62f790a93d3b8b09fb9f15bd3245b5b0b70297a567e2ec3c683f720b72b84f3df52c189c8551b382c652deaa4562ec2b567a445d973ec59acb6490bc458fb63b7a442f81a724a36bf8865aa59d3455f7e2345506e1fe5b221fbf066935b7f1ec2379c48577f20a2bece873858e29c8b5bc0b94b6998c2bddec4769ec07e1d05f9d3a62211060107f3db321b617d87b0450688b52e961d0d67540908009a3b33200181537210f46fd0e10fdcb9419070181abff13c1262591fc48ba32eaea6567e7c20596252a2300498bbf7b88cbb1009d0569f92f4247be243a6b7dcada76509182a446c6e857284867c13ae9ac88cc2cebfda589365b9c380fa23986b9c2e3bacabb14480e94c8b3ee593e218512b15ec11a3ceb0b6581465b2e071b85c6c1212c71e242e57061385f0c3d0f612d5e83ac57e59d6e100c6e478184b91c4578d79a3eb74a030f62ccb43e843b0329b2e6ab12c9144d60327a174f9bf6ea9ef9fa5dd259e867a66ecfe792d437a95cbccfba2ea26a41a10225aae80887d4f925c5c89df34fb7c4d38c22f23f1c9bd18ab23ea37a9ef06ccff8e23aaa68e813ee3cb62ae5d95d5ba2c96b5d48cb4f91ee7180e7a50781f8bfa2b8595ec452873d8ba00081ed8f734c9ad1a0af2999ced0e8788726ce14d40851e1aeb05358ca882706ac3927eeab9c79402aba1c9010f807c3aaad8cb1d63d0d8320d4519c0123c7e9c2a785b0eafc577da8b449af7151f927425b3120d5e3d8785d4c74f13c3afb15c67f4ef08acdf543a6e07c1dbf0c82df6f7ab5d49397604247601ca22a208bec987dae3f16b19bdd2bd7d77191b08cf5baee2915b33389153e4a8dcb8f8ba9775550059f565bd18fd582e1ac9a56fc91033a3cd5a40fad42f3058c86e752e8e857b4f41ec4675503552e6a74ff509f0a253432155290381cde37ced2d74bcee2bf4a9e415b64555388d8dfbee0f52391bd0be435807a62cfd59300bd3bb56736055e9712ace5a8153de7888d0844481f569a0d196c609304be2790f9f86b0a4b999887de9412bb7397c588cf5d1bf0b358959bf8c521dd09c1335ecfc210101cfbccbdd2afe54e0a4fb5ed589d82cec7fd84cdab41e64511af939eae175914febe688654211e6e98f3e61826f2d93f650ff6c295afae0760c171baf26d518f262535620dfddcfe227c300da56e570c889121b309dc4fc13e16b19099554b7a480a02fdbedd6722e2545fd0a07ded4dc4b3405c6a219cb7ff97f008a76dbc826e73451fac36dc6eba7f0366bae46afe3fcdf422042a32afd7880e4bafedd6eadec16f3741771e4576a1193bf885bef7e1abd397fe74d67ca4ef7fc27db7da52f5eba6738aa35062f4a40c3c5c790b7096d9709f3814d18f911dc5bc82b2cd0ce513a652d2ecf8828643dac36184aba9aec63888f3ad8cf5f61d00ae9bbe99d21a9832f3f69a8f8d3b518c83f0bd3490f7c1034db592519da768140875962922cf48eb1441f7dcb865c1d92c6d7e00d19c258c7d5a5d72ff1d48473fe3ae19e0eb9f37e46d3228ef321add01caea751539d4b1e7384a0a601ff6cdcd0ec83640cf2f17d29d0533cc69f25f6002eb4e73bca43b23d2a2b6df802fc8510cda790314440131e63716e05de0130ec8b4f09bf1e82919b343971fb61b9ba591db705796bd7c3438b6c60fdaae5f80dc5f79cca5cceb85ea75003483c12fe5ca842f354c32b073ee5a45665127d02b5cd3b36b562f277b1799519256fa309324ae62f4c74acd8e64a06ad4e4bf8839bbd252d8311945bba463241561be12ac9aad538d69f8647ae45803e07dcefdbe8e91e12b8f267d677371fd5e63ce5149bea5246b96565815f99a3a67db8ff1a110b9de48796a560481a18be1768d52d325d8894c6b34ac6b116d19e596e3d0179cfe9ecc39813a2faa8f1032b06578acc4dbfa9111069184961e9814afd5e4266a9197fd3d54fdc214844a457cfc910e785b004d31242a9045f0114ed36648ee43e61ade120a0696e0953f76a1cf9a057b1a4317c1264a36179042b99be7284014e8e7f9e8b8718510887704268b3ef9d528dac2d6a8caaa635298e388e391d063b8d2f4e88d8e1b958b1145fe412f7899195622df9b4fd3b2f4080c115960eb788fada2c2bc6dd2b9964f415cf30a372692bc3099a1518732c3a89bb67af90b3259a435393d9063eebbd4a7cffc917a7568e4d6163599070bc3d3f102700baec3ca15bb4406f59029ca29cb85a04b7353dec6c45c1fbc29f17a2411245050b457d0823712a3bd9f199d620f0397916cd536d0b9656c7431ca391c4b843ce8696af96bf25214534616e8bc3f7dc3dd59bc94b4674628683ebaf13cb0065529fe8c782d9c72bda185edb8f02e971aa62b9c5dc7067d49ef74c9098571917fd065f0f02f7ceb730e838121f061af69b437094b28b728008a0f8b4455e1f785ec41e4239b966612cb9c4c1931181351349eabdcbbe638e9be7552ab6c6f251150f82c89b4470a08b502174913be27adfff2c6e8e6445f3ef0a68880a629efbc73e797a05e61fd84263cfc33f72c5ce660c48f618ef167eab17fbd342126cfa027ee4e29d43a063eb1b1a15d5629ec33032f5d25bedd0512945a30949f0e8a0dda0745a5b6f7dea1da618c158f85d037fdeb61ab5eec30761ea1f71c7edfde005520feb66160dfe2d4e7a2c7987f19d686a70e8f640148ab294ce0505097ce6e65ed139bdd2dd19c2ce9e045d2b33d58284fd716c498d11e29b2f2079d87116731422a3b2a0187b8799a03d93b35d70a2c9540eb8240827df7a5a21936a03693901fc8a148650b26c29f93d689d2dd8893649de570ccbb90a2108d5d68047f5b407884c5bbcef13f809f0b92220e3ec017cb126fa1766e553ecc935902afa54fee14daaee1cefcd0c4012eff84ccb42eb5480f71623509c72e898e9416800feeb6c47c6255767ef605460acf792068ff18c007a54cb3d5551163a6aa6968834c1e7bbe0bc7809a72e44ef080d5fc029545009902d64f992f280d2435b14600ca422f4406e09729c1da0d5cccc44ddc6f7bcb88e28d789679eadfab75b99aef24844a71244aa9073e3c53170a1cd6371ae2b8cbd95f394d8ec61d630557f7038e0c801f5a4ed63c8ebe42505416a11ea3d40678fbf48f6dfbe944d31f24bf72c073968eabddd455d6c30e8d5e59b46414ed4db37d088e8e73647d90d0879028078720dcca82e38a5c1590c87d8cff1f2587dcd64ccb3918e0b449a89003b38d0f2508bc42ec8de97dd9bfee83bbb2195987f85f03650ace87df504583e07c52a06f9a6cab08c847d5637ba3bfad29d2438c61a138488e603c6b58f1763e9f32b8f7454abbec56bc8a5828acba699115823ee563a44f27bf8b186cce96a9c4b8757cdda1f864d3d4bf6b25411c610e2c618ed291d3f74781da4097417ef293ed045dcaf55d1d93b6472a8c3d029fa5cef253e27030024fbb9c986de7b619a6e41121285e82d13dda28ef5333f38a272e01796e2b7e467e4d5a30b65ecf34f5a273c3d2bdd95bd47141e38b0b6b9f3d95f9678225f2ad25807e23a45fdef52823c90101e890abd92bba5d45c26283c4e951565f37a0625402b30f089766059d675067b118004d53f1917ab722e4c5dabeb9a465f33e836f0ae1227bd92524f146a9795099a769703091267326cf56be04e5050c7fdd77c359eae6f1d80bc42c8512bc11265c063acde0db77ea13847c5f4a830ab4ec325bacfa57eb81ae690ee10497199345734bf8838c476c53635ef26ebe8c4e032e6e9a0349f9ba589d70fce2250a34e649763d87204b67bb9e5a9206c5646f4111f3e9c7aad036a76a22f2ed6e12ed38b19dc29feb88edbcb21c3c2912bb2a35d26a6d03351488e4398bf17031be750c15703f27678d82221c11641e3f4cb54a52f24d5c218f01c5068e621a43d9a66f9bb464bcd13aaf7bb42c430582cdda48c9f868f1d8c04a19598752f5d176b985779ee3c0f5605cae0823403c57e0ad0d8fbb4edbd54ed746a4379a31503210d113d845ceefb0d933da880533f62ccda136f7e4950eb744ad607ec58c06e1d602c002206f7aae6f640be3510cef925df2961e1b812a8407edc7128b8452404ca1791bd885ba466f3d60826868fcf61cf94f42d3d7d3d2cb4ccfb5ff62082b3756cc7544fe7eecb967826fb48843c6427d74aab2a9df12c2a55bd1128a4b10205c98cd7d41f0568a9f3880a531d2d2b63c5f7028db0cba1f97816b92b906b3b48f08a629d8297730eaf365ec7f43c2916c53974a80bfa80c75b60a15c2e834a9d3de083978e85f91a16bd481b6fdb30aa9bf5751fc29b9f1c822983e642ee14fac86a42057440cb3d5418889cb64fdf40003c4f81376542f90a3aa97030f15b908e201fd3267e1ba76843a3002b47525bdf6945669724f8ece5cfd520735dfbc787b61b141dad11ac87249cf1beb3d823956c3b53077111574027334b9be0793ab4588b096394c68cdc886cc30ea457fcf1084fcfa00936b942ea62ce1b8959e856a7fd4fa4bfaa2210bd49b046f8808af1a265f2aef57f87e94078271996a2349b7428b8e20c9264722ba1b969400fc52b844c7d52d7205f4ae19853c4b6617298857f3b423780d82f574d9504555b7e2fda3a973d1e3cfce", @ANYRESHEX=r0, @ANYBLOB="aacf5f5d3e3e9ee5151c03c1da580bb5c72150cbd226a24e65a5695085faab1f6f6ed086882a4523d9a8b0344bc0768aaa4bfa62a4b6dd57c8260a72eccb959b2a177e45e34133d163aa5f1417126a0ec1ac751847c047ea4fdb25641d2a82e4a6f2bd61d706e60119349c424ee9a840ae067de4077576861d4e2eb61ec92bd8789ecb582b560570a154dc39c2acf38eefe6dfdf15e6e7642ff403741a8569c3fbf0928de046f280283fa53a2f22c4d98d131df54172941ffcec63b50e046d959d704e42c50d820827124e2f98a4e534", @ANYRES32=r0, @ANYRESDEC=r0, @ANYBLOB="cbdf85a74f8e30765fd60fdc35761fc7501b33ac15733552d19471fbf0d7920f2d0439b4afe4f475667f83452dd70651c6428b511daf65426752041a746535cdab89caa6ae6e9b24767513eb6e658d012ae56d4760650130211464e053700ec8d685a5cf98e9eac42c6d9132bedf0b8c2435f32d3cf463acb64fbb2b8d3cc03042a12bd3cc7a8fe5ed2013c1608f207128560ace4fc7ea32ce3ffa16be0f5e099e653ce6220393321328070371ccd91b2a63c2656ee1f31cd547613eab4ecfe7606c737d730823d50d6c0d6b7577b3ea63235ace00eddac791c7476e7774bccb0aadfa5587b48a00af5b882204f3585c49f6060f614c3c5690d2255b348e828857b874fe1d9608ccfde82edee058e5b8f44dc32c990df0087d45d82911d2b96db0f95ce1b292583dc7471b8f4a1e8db0d958dcb2527b3d1fcc6bf0249a0a11c8fdbad07b38fc8e7b294fb7340e77da4f53154cc59740fc7c6a69f63b2b149fbd24efbffa5b7d5b43a2b63461cdb6261dcc431a423fe72cafd1ae76b9440d0fa3310a698629213c2e3e36ff8c9586f0cc58bb973b3dc6a8af63e705f99f1577dfebe3035cec5d9a13d009c2b4c989182ee87a20670860dfa45bb28444dd6c55c7c7d99de4b75270fc5883b8114a82724259a2d592a56649fc7bddba3e6e86d171bd2688a876690f374ecb1159a5c184a8fa0cf6594236579d8bbc47044d675d4f4f059588a43ee3e5d2b86270684196e3460d0a2c57207ed18b03b83c4146c15df353dedf80d874712c12149cb1911cf0dd5b34160a0e8ad66f21250475ba9dee1bbda2aaa8c5cadc73c3f51f920b4e5f2e3a2bf26abd3a2fbfb854e9b5a942a52ed8bd9c54c7b75b537a462cb24adbf0d9579bd46e91d02cd814b224385fc6532106f7ca27345c932e55f4a3914b5ed6e6bd5b87358f64a381435173f1cb549c55236245aad9eb1e2577d2745e2c17a2c5582b64c2ee8dbc2735e91524d751efb48d49b851f2250b11ede44324e9f97afcba07d9d81aff264b14af464d0ab2b5e48576a10d354c371d8e9f1bcd8ff8f9c8c7f4d86f609bde7648e1d06903cb220e36f3185dd5696ac693bfb8d12782e0b3126a036a975bb82c34f70dbe3729f74fba8a7e357af68c3e996f2db3f43124814e21dfcd5ba0053874818c116e5d279ed8b0bccb940e3a31f7442af7cd17e6e522cc04f7e51b5aae991f2aae1493a518a239498873893817ed9734419a6236f3f20456aa44cf35a12ca357ff6bb88be935394e67c6ce9874f3a3fc43c6109fabfeb84a46645328fe1e798eada2135c91b6389484c40b8df239775febcb1aa7b2a2e8fa86a75656881cb2fe88fee93c91845286e21d3130735c96b6cb4af51e32cfd0899f7da2f6b987a62950338d2b84664131fa14493d5d4ba044cd3ed70b717bc1b468b5e5b01f22873e31446ee4dccb24e1350a736ce838fdab598132b39d2f9dfb793c7ac51d4ad79d2527ee49ba50f62256da94b33ce5454290317a8399254c30e47f77716af9d7deb48466ee4a09f69848dc92efd14acd264d951757339431f3f322329af678fc9291551c66eb7aab7142dbcaee131009876c45f8dab222ce906a0745153ccf2ad87b02f75689d1d2852f1fb5fc47b5c855e91b5c95e71e4c435df29c3dba9af818b7e0b52b5d4ea9610f1140c7ecf43e0c99fb014196bda8a351bef4ca4646232d092d71497f6f3f3cc13e02a9d0ce48644863eec3932d59c117b24a09452580cf16929e17252a99f8bdfc11d04cae2b3874af0a73e8e0ed76c05eb8ca80aebe910f21da2c2fd4c16c8e54d40b27f296e56b49e6333d0830e6cfc3c79ba1d24d2183ab70e641e6e8efed9e488bb2018dfc861fa1eb04c129cf3c5501e0c8eb2c934c43e65f0910c65a6631b794ff0914a56dad7d2eb63fe166f8e3bb0838b31b362a19b8268e26ad8fc85d8df82db631ceb91335d079567e15089e94f7220a1ec7bf953c47953da0040b609383afabfdddcdac2778a5abb09fe0d024ee71c841dac34643fa6e97db17d86b2cce35fec4f0e6cfc79a4d2a52a1462b6bef600b1fec212da11ae3cf063116dbf70bb8dd7b64c76b64643b83c6e9809173a3d5742548d000efd8f8cc7bc087e64abffde822c49626314a15dd74e05c112510efc53cd8da870b9b292174713bccecab04f80ea95d2ac88dcf17ce4713e5aa5d27daf01fe3558578b88f8e120401f33bf73788196c78c9a3b5126f886d90950213592bde2f134b255145f224e385935f2b6830f9d2244f58dacbc52f0f4be2d6b7864845eadb915afada2016716c4fa441355e74b85ccc55552c2226cc4222aa42055457f5a85def206f78d4ef9d52d0dc684caef83a19d66de16d858383d1fd7c8789b262339a72829b43f97c72c0f5393eef8f6fdb9e768ea08bce390a062246329156450236b214f89b957c101a7f006a938b311908543cb26071395bf133dbe3b6f767bfc2ed360e09f508368eba599eca0f632c96d6f7650fd8b224230559f601d9a54b518f98bf3f84f19dd812052ed2d5d4dcc9a159d2c4c62f2f9733f1272517d6ce7447fc0e549085168e7b2b703e3983d21818a51150a6c54e0b386178079fac0a8feece4f0a2c847e61e1b03f919f8d3a8634053fbbb3839c50130ee9fa401bad517e2c9b375484e45709c84e6bb38ed10fce622ac0f0d93808f0768f57e12029430e3c3d1b0fc514ced5abd001da77969461b04a3eb429f17d1abc09fc99f2df9922e6343bd4b73a17d007902cf65fdf6150b163023cdc377bf8a9547519a827012c9d3c2f542bc60333d878004a6a7ad3af09930ea43311083d8a1f3153216d619d91ddb66bd1cddea0dfd9c084a38f386799e7ade9c62d25ff839a788e55a626046ed25ce844def359031ee6e7a86ce59fb9eb6086b05d8d391e241af30376f6ac715f04dba2273b50106d8cec833a33b0cbc2f8d522f9b964f051b80f3972aa11e421d2d88c100e0921833c9dc5de54a5cc432f673daa8e50a7ec176c2799d6b05579b0f77f6f47540c1c93576ae33a2096fae34b392f417ee4b96d4f091349c85ef13cc5f2cd740028fea9c359e9ccf920abc588a05b17e22ed6ae31eec2bbe5a6a36f223abd50a882ec03cebe413774edac634b1f9911cf574fd616d2f13a5b2bd17a73a82cdbbd2e07c92e76757d5659bf63fb964e7046392dcff5f3c76af41e8167fe4186e2e4a5d7cd2a8e3b43ce7eff633aeea2cb5b27688b22b73e01ba03dde0295b86235e3e722ae869f41db5a5faa095f24a01398c95752beade1ffa985580dd97cadc8da3b2b04c0c0bca335fd2d13d36935a1633c764f3ac452869bed4b8000cb0b41303ba601c3bd049a156f4fa84fdb0156800225de1e8176ded640cc7200516bd937f79c2ec49f03a2f831a3fe02616a2397c31336a26df2b362eea8b6961c8aa6dee22f2f021222befdaaf970214fd06d578309e55cde9d89a482bd84a06013cc721c0763b6c75f6c0246257f2be8bd05e927d2c1e7b0fbf630f2500e73077a3da1dc30364e8e2c09c86ebc154acb11c514c85e8e957b983b99374cf281065231c163b07468c87291a3e5d3691efbfa09eeea170c009275d2a02bad31a750673d2eb545feb02198fb21e0519bc61d77fccb2b48cd3106a21baf2d44ecc5cf67edab28de0dfa6bd8e288da6f9b4ef9f0766acd405d1b96da85b10163da20a15343aeff34b0883e4acc2506bbe7e2e31b037ae7b48b6c362d5b873b3dc3f63f00a1986e60a054eceb727d8c592787e924fdbb7996cc5633f9dac8f87f5e2076166b3a6081eb6a4598ff7f827c0ad621b1c9bbea7322c63cc331011ac88231222072759b5cd6333228ea5dd789216f49452e4b4392d9dd442264c3ad559d66205dfdd7a25d49701b52f555ef2703a1771f587938a120c7831aa1e8dc3b1b32121b14550f64842d323b3a46559fc6f83274852f2c46cf609476dd0beae7f704e3f68238bf1702f01419c4bd76606f3b487d5ca22c16b32dc3c75ba839879c2e83d94add37be202488dc07a7a55d0e51acc3cb8078182d3a710b1acaaf4a43b3bd183ad3d7aff940cfd3b275b74512c45d5705ca37b160346849faf9f30951905518feeaad863b2abe0187ab21449cf8a642a96aefc12f5e46dc84f7c59a229435a20f38d67e579d02d73fd7e60c42c756278997b0bfccafccdc34dccb027cd5d162e30561fc36efcac6e8a050b3186d3288a074ab697b67ba10ff3b1a599982db128d15d7626768e0f71a9667ab580ed053f5c0eae8ffb762dec5e40e95bd102c1dfe4aa867b342ea32184ce25c5c5b127f72a75ef4b162cacbefbd03da30370c0ef6a126900d86c0008923215a13efc1f9efaa1b70feb3ec0a5ab70d84e366a5761f28d252653159cd9fba645ed2673058fe132bc6539bccc4654ef497ee04a3ee953f30fc80f5bd02bf009e08694fadc6f724fae3b09bb6a283ee12e8ec633b9a85cb00266191dd636bdb5b8edf6f1841e42a236ac731ccc9b0a4e00e1a5c5093fdc238edbb9b3729656f6760e92c84ac1cdc893399fe678898413bc02ce42aa9c688dc7147fafa88f14b98a2f56fe0d4edcab9fd686d0d165e23ee14b9477dd4111ee55bce58532c8e7b8441d172a7d8de06aca3c89b62cbc01305c5cbde254b9e5642d6534550624e4850196beec2f5d9e8bdcb2de0162b432315648d8e7b84f50df43527f38ba519c7462549898c2a4a3a34007d51b924c43678cec0344dbfc1920754f11a16e16049ee11265a860dff57da0329e84bfbb66be57f90f47254be0d77bff385d6f71abadebb802089390dc186005d156c8a0ea9f8951d5d46200fa63bfdd3c4a57b5ffa4e821424d0883ca1e1b3542559290ba562e7bd6348531f1be8538f401dd4715601ee5fc7202c1465ea66182c9641f404b9bb149634cf8fe48c727469c22a0e4f864e948a4b3063fe3a4ca5b034f582f454fa434a78efcf8b50f518167e94b17f687b1d5f9a174f00d004aa1534d8244415b6d60714b701a4750430cb629293b61f589d21f5aee34f160f861021854f095adcef4d41b5fb3bd4f4aae8b6fedb93d62dd1c0071c09a0776face2047ae03410dfb8149c093021acab695e58d3cb3be1d0dda0983380bc7b071c63e8dcd57edfab315268744897bf9d56142a544898c841caa363e4fc0cf23912be41c6b41e951ef29c3f7fda345183972d15f5bd3ff40c74df4725da1b273ab1cfdef0326d7f21e8b9aaffb11ef446e4adf2e8e36004355eedbc36763ae23bef5c14832365edfff303a5b55b45526b5bd53f5552920d130ab25d3be47ad83d0e3b0c5618213862b1c014c0fb6424abde8313a0c0ee8324595b8c6d19f2f61836e4e02f49a18d82c77de387e977ee8b9fd14e9a379ba4fed36ab331938ae81ef2a8540ad3df764c3cb7cbcc27cfb05dfa80a922d0e7ac403cd0223f70b5293d51b80f1512b9b89f754fa4282aeefc35c7f00e82f66485f2525fed6a0fecc56536cc1a28e6d101adaef2ec2699c382de5c6cc6372525884b89f448425d0662ed7d6c3f6d775e0d45c0363868f2e0422a3cae636b8dfa43de987eb689ba1e34cee54041ea3c260ec440b29f18b7d1601844c8a13f3a208ea57c7eb79a578b221e3f30a9a954d8df9529c1426a43fdfad5c1c6432f3e02217e107c3cb376d155bf80c85f4dff5b372a6040e25ce22068bbf1b3b66c4056a34c9792485162ed1788d137bc2f5633d63087a1be9b88f246856854c951855b8fed49f79a07fdd3ee06b83623429ef"], 0x60}, 0x1, 0x0, 0x0, 0x4000c81}, 0x4000891) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000080)={0x0, 0x48}, 0x1, 0x0, 0x0, 0x10}, 0x0) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000000)={'wlan0\x00', 0x0}) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000180)=@gettfilter={0x5c, 0x2e, 0x200, 0x70bd2b, 0x25dfdbfb, {0x0, 0x0, 0x0, r1, {0x6, 0xffe0}, {0x1, 0xf}, {0x1, 0xd}}, [{0x8, 0xb, 0x1}, {0x8, 0xb, 0x3}, {0x8, 0xb, 0xfbce}, {0x8, 0xb, 0x1}, {0x8, 0xb, 0x800}, {0x8, 0xb, 0x3}, {0x8, 0xb, 0x5}]}, 0x5c}}, 0x8800) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000100)=ANY=[@ANYBLOB="500000001000010425bbe5ad600027842cf52300", @ANYRES32=0x0, @ANYBLOB="0300000000000000280012800a00010076786c616e00"], 0x50}, 0x1, 0x0, 0x0, 0x13d33d22cca65c15}, 0x4008840) r2 = socket$netlink(0x10, 0x3, 0x0) r3 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000240)=ANY=[@ANYBLOB="02000000040000000800000001"], 0x48) r4 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='memory.events\x00', 0x275a, 0x0) mmap(&(0x7f0000002000/0x3000)=nil, 0x3000, 0x0, 0x12, r4, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000400)={0x3, 0xb, &(0x7f0000000140)=ANY=[@ANYBLOB="18000000000000000000000005000000180100002020692500000000002020207b1af8ff00000000bfa100000000000007010000f8000000b802000008000000b70300000500000085000000621600009500000000000000"], &(0x7f0000000000)='syzkaller\x00', 0x5, 0xfe7, &(0x7f0000001e00)=""/4071, 0x40f00}, 0x94) bpf$PROG_LOAD(0x5, &(0x7f0000000380)={0x0, 0x10, &(0x7f0000000580)=ANY=[@ANYBLOB="18050000000000000000000000000000b7080000000000007b8af8ff00000000b7080000000000007b8af0ff00000000bfa100000000000007010000f8ffffffbfa400000000000007040000f0ffffffb70200000800000018230000", @ANYRES32=r3, @ANYBLOB="0000000000000000b704000008000000850000007800000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, '\x00', 0x0, @fallback=0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0}, 0x94) r5 = bpf$PROG_LOAD(0x5, &(0x7f00000007c0)={0x16, 0x10, &(0x7f0000000580)=ANY=[], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @flow_dissector=0x11, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000100)={r5, 0x5, 0xe, 0x0, &(0x7f00000000c0)="469dc2d342e2b7000091000000000bcf48f3ac4e19a56ceb0b42c0", 0x0, 0xfffffffc, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x22) sendmmsg(r2, &(0x7f00000002c0), 0x40000000000009f, 0xe0) socket$nl_netfilter(0x10, 0x3, 0xc) r6 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r6, &(0x7f0000000140)={0xa, 0x4e22, 0x0, @empty}, 0x1c) r7 = socket$nl_generic(0x10, 0x3, 0x10) r8 = syz_genetlink_get_family_id$wireguard(&(0x7f00000003c0), 0xffffffffffffffff) sendmsg$WG_CMD_SET_DEVICE(r7, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000007c0)={0xc0, r8, 0x1, 0x0, 0x0, {}, [@WGDEVICE_A_PEERS={0x74, 0x8, 0x0, 0x1, [{0x28, 0x0, 0x0, 0x1, [@WGPEER_A_PUBLIC_KEY={0x24, 0x1, @neg}]}, {0x48, 0x0, 0x0, 0x1, [@WGPEER_A_PUBLIC_KEY={0x24, 0x1, @c_g}, @WGPEER_A_ALLOWEDIPS={0x20, 0x9, 0x0, 0x1, [{0xffffffffffffff63, 0x0, 0x0, 0x1, [@ipv4={{0x6}, {0xd, 0x2, @empty}, {0x5, 0x3, 0x3}}]}]}]}]}, @WGDEVICE_A_PRIVATE_KEY={0x24, 0x3, @b}, @WGDEVICE_A_IFNAME={0x14, 0x2, 'wg0\x00'}]}, 0xc0}, 0x1, 0x0, 0x0, 0x4004840}, 0x40000) listen(r6, 0x0) setsockopt$inet6_int(r6, 0x29, 0x4, &(0x7f0000000000)=0x8, 0x4) syz_emit_ethernet(0x4a, &(0x7f0000000300)={@local, @remote, @void, {@ipv6={0x86dd, @tcp={0x0, 0x6, '\x00', 0x14, 0x6, 0xff, @private0={0xfc, 0x0, '\x00', 0x1}, @local, {[], {{0x0, 0x4e22, 0x41424344, 0x41424344, 0x0, 0x0, 0x5, 0x2, 0xfffc, 0x0, 0xff6b}}}}}}}, 0x0) r9 = syz_open_procfs$namespace(0xffffffffffffffff, &(0x7f0000000000)='ns/pid_for_children\x00') unshare(0x6020400) socket$nl_route(0x10, 0x3, 0x0) ioctl$BTRFS_IOC_BALANCE(r9, 0x5000940c, 0x0) 2.113337092s ago: executing program 5 (id=8550): socket$nl_route(0x10, 0x3, 0x0) socket$nl_xfrm(0x10, 0x3, 0x6) socket$xdp(0x2c, 0x3, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) bpf$MAP_CREATE(0x0, &(0x7f0000000100)=ANY=[@ANYBLOB="0900000009000000d795e89e7a43353100000000", @ANYRES32=0x1, @ANYBLOB='\x00'/20, @ANYRES32=0x0, @ANYRES32, @ANYBLOB='\x00'/28], 0x50) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, 0x0, 0x0) r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r1, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000980)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x1}}, [@NFT_MSG_NEWTABLE={0x20, 0x0, 0xa, 0x401, 0x0, 0x0, {0x1, 0x0, 0x3}, [@NFTA_TABLE_NAME={0x9, 0x1, 'syz0\x00'}]}, @NFT_MSG_DELSETELEM={0x3c, 0xe, 0xa, 0x201, 0x0, 0x0, {0x0, 0x0, 0x1}, [@NFTA_SET_ELEM_LIST_ELEMENTS={0x28, 0x3, 0x0, 0x1, [{0x10, 0x0, 0x0, 0x1, [@NFTA_SET_ELEM_EXPIRATION={0xc, 0x5, 0x1, 0x0, 0x280000000000000}]}, {0x10, 0x0, 0x0, 0x1, [@NFTA_SET_ELEM_EXPIRATION={0xc, 0x5, 0x1, 0x0, 0x10000}]}, {0x4}]}]}, @NFT_MSG_NEWRULE={0xc0, 0x6, 0xa, 0x401, 0x0, 0x0, {0x1}, [@NFTA_RULE_CHAIN_ID={0x8}, @NFTA_RULE_EXPRESSIONS={0x98, 0x4, 0x0, 0x1, [{0x5c, 0x1, 0x0, 0x1, @exthdr={{0xb}, @val={0x4c, 0x2, 0x0, 0x1, [@NFTA_EXTHDR_DREG={0x8, 0x1, 0x1, 0x0, 0xc}, @NFTA_EXTHDR_OFFSET={0x8}, @NFTA_EXTHDR_LEN={0x8, 0x4, 0x1, 0x0, 0x22}, @NFTA_EXTHDR_SREG={0x8, 0x7, 0x1, 0x0, 0xe}, @NFTA_EXTHDR_TYPE={0x5}, @NFTA_EXTHDR_SREG={0x8, 0x7, 0x1, 0x0, 0x13}, @NFTA_EXTHDR_TYPE={0x5, 0x2, 0x83}, @NFTA_EXTHDR_LEN={0x8, 0x4, 0x1, 0x0, 0xb8}, @NFTA_EXTHDR_OP={0x8, 0x6, 0x1, 0x0, 0x4}]}}}, {0x38, 0x1, 0x0, 0x1, @bitwise={{0xc}, @val={0x28, 0x2, 0x0, 0x1, [@NFTA_BITWISE_LEN={0x8, 0x3, 0x1, 0x0, 0x2}, @NFTA_BITWISE_SREG={0x8, 0x1, 0x1, 0x0, 0x14}, @NFTA_BITWISE_DREG={0x8, 0x2, 0x1, 0x0, 0x12}, @NFTA_BITWISE_OP={0x8}, @NFTA_BITWISE_XOR={0x4}]}}}]}, @NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x3}}}, 0x144}}, 0x0) r2 = syz_genetlink_get_family_id$net_dm(&(0x7f0000000080), r0) r3 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r3, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000100)=@newlink={0x3c, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x3f}, [@IFLA_LINKINFO={0x1c, 0x12, 0x0, 0x1, @bridge={{0xb}, {0xc, 0x2, 0x0, 0x1, [@IFLA_BR_MCAST_SNOOPING={0x5}]}}}]}, 0x3c}}, 0x0) sendmsg$NET_DM_CMD_START(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000100)={&(0x7f00000000c0)={0x14, r2, 0x1, 0x70bd2c, 0x25dfdbff}, 0x14}, 0x1, 0x0, 0x0, 0x40}, 0x40000) bpf$PROG_LOAD(0x5, &(0x7f0000000280)={0x1, 0x4, &(0x7f0000000040)=ANY=[], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, @fallback=0x24, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x8}, 0x94) ioctl$ifreq_SIOCGIFINDEX_vcan(r3, 0x8933, &(0x7f00000003c0)={'vcan0\x00'}) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="18000000000000000000", @ANYRES32, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r4 = bpf$ITER_CREATE(0xb, &(0x7f0000000100), 0x0) ioctl$XFS_IOC_PATH_TO_FSHANDLE(0xffffffffffffffff, 0xc0385868, &(0x7f0000000180)={0xffffffffffffffff, &(0x7f0000000480)='A\xe9\x81\xd3B}\xd8y\x1b\xd4\x88\xb3.1\x87\xde\x99\a\x94C\xe0JJ\xea\x1cEL\x91\xbe\x93\x97\xa8T\xe4\xa3\xca\x7f\x13\xd1\t+?\xc8G\'\x12\x92\xf2\xa03\x066\xa0\x9f\x03\xef\xa6\x1b\xe4\xcb\x8bU\xbc\x8a\xed\xd5\xc1F\xf3)l\xe1S\x9c\xd24\xc6R@\xe2\x88\xb8Q\xd4]\xe2\xcf,b\xf7\x93@\xa8:\x89\xe3w\xf4\x05\xd8\xc9mxj\x15\x9c\xafn\xd3\rsq\x8e&\xf1\xdc#\xfanI\xeb{\x8d\x84\xd1\x91\xb8\x04\xc7\xf4Bg\x98\x02\x14\xe8\xc6\xcb\xd8[\x9aWY\xaf2\x89\xc7V*OF\xd9\xaa\xc9\xf1t\xbf\xa4\x82\xa0\xab\xd0~\x8cC\x85GLf\xdb\xc3x\xaa\xf9\xe9\x1b\x83k\xc6\ty\x14\xe8\x960xffffffffffffffff, 0xffffffffffffffff}) setsockopt$inet_mreqsrc(r5, 0x0, 0x25, &(0x7f0000000240)={@initdev={0xac, 0x1e, 0x9, 0x0}, @multicast1, @multicast2}, 0xc) r7 = socket(0x2, 0x3, 0xff) setsockopt$inet_int(r7, 0x0, 0xd, &(0x7f0000000080)=0x54, 0x4) vmsplice(r6, &(0x7f00000000c0)=[{&(0x7f0000000180)='w', 0x1}], 0x1, 0x0) close(r6) socket$pppoe(0x18, 0x1, 0x0) ioctl$BTRFS_IOC_QGROUP_CREATE(r6, 0x4010942a, &(0x7f0000000200)) r8 = syz_init_net_socket$802154_raw(0x24, 0x3, 0x0) sendmsg$802154_raw(r8, &(0x7f0000000b00)={0x0, 0x0, &(0x7f0000000ac0)={&(0x7f0000000a80)="9938a927b7b31c110cd2143741eacfcf73f97185", 0x14}, 0x1, 0x0, 0x0, 0x20000000}, 0x800) r9 = socket$packet(0x11, 0x3, 0x300) ioctl$sock_SIOCETHTOOL(r9, 0x8946, &(0x7f0000000fc0)={'geneve1\x00', &(0x7f0000000f40)=@ethtool_dump={0x40, 0x4, 0x2}}) r10 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000040), r6) sendmsg$ETHTOOL_MSG_LINKMODES_SET(r6, &(0x7f00000001c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x1000}, 0xfffffe3c, &(0x7f0000000140)={&(0x7f0000000100)={0x2c, r10, 0x400, 0x70bd27, 0x25dfdbfc, {}, [@ETHTOOL_A_LINKMODES_DUPLEX={0x5, 0x6, 0x3}, @ETHTOOL_A_LINKMODES_AUTONEG={0x5, 0x2, 0x8}, @ETHTOOL_A_LINKMODES_SPEED={0x8, 0x5, 0x7}]}, 0x2c}, 0x1, 0x0, 0x0, 0x8001}, 0x1) r11 = socket$nl_route(0x10, 0x3, 0x0) ioctl$ifreq_SIOCGIFINDEX_team(r11, 0x8933, &(0x7f0000000080)={'team0\x00', 0x0}) sendmsg$nl_route(r11, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000100)=@newlink={0x30, 0x10, 0x1, 0x0, 0x0, {}, [@IFLA_MASTER={0x8, 0xa, r12}, @IFLA_GROUP={0x8}]}, 0x30}}, 0x0) splice(r5, 0x0, r6, 0x0, 0xfffd, 0x6) 1.963240592s ago: executing program 4 (id=8552): socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) clock_gettime(0x2, &(0x7f0000000040)) setsockopt$sock_timeval(r0, 0x1, 0x15, &(0x7f0000000240), 0x10) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='memory.events\x00', 0x7a44, 0x1700) r2 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)=[{&(0x7f0000000180)={0x2c, 0x10, 0x1, 0x0, 0x0, "", [@typed={0x8, 0x0, 0x0, 0x0, @fd=r2}, @typed={0x8, 0x0, 0x0, 0x0, @fd=r2}, @nested={0xc, 0x2b, 0x0, 0x1, [@nested={0x8, 0x8, 0x0, 0x1, [@nested={0x4, 0x94}]}]}]}, 0x2c}], 0x1}, 0x24000000) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) write$cgroup_type(r3, &(0x7f00000000c0), 0x9) r4 = syz_init_net_socket$bt_l2cap(0x1f, 0x3, 0x3) sendfile(r4, r1, 0x0, 0x10000) sendmmsg$unix(r0, &(0x7f00000bd000), 0x318, 0x0) r5 = socket(0x10, 0x803, 0x0) r6 = socket$nl_netfilter(0x10, 0x3, 0xc) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000006c0)={&(0x7f0000000340)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0x10, 0x10, 0x7, [@var={0xd, 0x0, 0x0, 0xe, 0x1, 0x1}]}, {0x0, [0x9c811b4e5e9311d0, 0x0, 0x2e, 0x2e, 0x6f]}}, 0x0, 0x2f, 0x0, 0x1, 0x400}, 0x28) r7 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r7, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a84000000060a0b04000000000000000002000000580004802c0001800b000100736f636b657400001c000280080001400000000308007f00000000820800024000000002280001800b0001006f626a72656600001800028008000340000000170900040073797a30000000000900010073797a30000000000900020073797a32"], 0xac}, 0x1, 0x0, 0x0, 0xc0}, 0x20008000) r8 = socket(0x10, 0x803, 0x0) sendmsg$nl_route(r8, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000080)=ANY=[@ANYBLOB="540000001400b59500000000000000000a000000", @ANYRES32=r8, @ANYBLOB="14000100004000000000000000000000000000001400"], 0x54}, 0x1, 0x0, 0x0, 0x800}, 0x80) sendmmsg(0xffffffffffffffff, &(0x7f0000000000), 0x4000000000001f2, 0x0) sendmsg$NFT_BATCH(r6, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000d80)={{0x14}, [@NFT_MSG_NEWTABLE={0x20, 0x0, 0xa, 0x3, 0x0, 0x0, {0x7}, [@NFTA_TABLE_NAME={0x9, 0x1, 'syz0\x00'}]}, @NFT_MSG_NEWSET={0x508, 0x9, 0xa, 0x401, 0x0, 0x0, {0x7}, [@NFTA_SET_ID={0x8}, @NFTA_SET_DESC={0x4d8, 0x9, 0x0, 0x1, [@NFTA_SET_DESC_CONCAT={0xc0, 0x2, 0x0, 0x1, [{0x4c, 0x1, 0x0, 0x1, [@NFTA_SET_FIELD_LEN={0x8, 0x1, 0x1, 0x0, 0xf0}, @NFTA_SET_FIELD_LEN={0x8, 0x1, 0x1, 0x0, 0x80000001}, @NFTA_SET_FIELD_LEN={0x8, 0x1, 0x1, 0x0, 0x7}, @NFTA_SET_FIELD_LEN={0x8, 0x1, 0x1, 0x0, 0x9ca}, @NFTA_SET_FIELD_LEN={0x8, 0x1, 0x1, 0x0, 0x2}, @NFTA_SET_FIELD_LEN={0x8, 0x1, 0x1, 0x0, 0x8}, @NFTA_SET_FIELD_LEN={0x8, 0x1, 0x1, 0x0, 0xffffff00}, @NFTA_SET_FIELD_LEN={0x8, 0x1, 0x1, 0x0, 0x1ff}, @NFTA_SET_FIELD_LEN={0x8, 0x1, 0x1, 0x0, 0x9}]}, {0x14, 0x1, 0x0, 0x1, [@NFTA_SET_FIELD_LEN={0x8, 0x1, 0x1, 0x0, 0x4}, @NFTA_SET_FIELD_LEN={0x8, 0x1, 0x1, 0x0, 0xf}]}, {0x4}, {0x24, 0x1, 0x0, 0x1, [@NFTA_SET_FIELD_LEN={0x8, 0x1, 0x1, 0x0, 0x7}, @NFTA_SET_FIELD_LEN={0x8}, @NFTA_SET_FIELD_LEN={0x8, 0x1, 0x1, 0x0, 0x9}, @NFTA_SET_FIELD_LEN={0x8, 0x1, 0x1, 0x0, 0x8}]}, {0x34, 0x1, 0x0, 0x1, [@NFTA_SET_FIELD_LEN={0x8, 0x1, 0x1, 0x0, 0x101}, @NFTA_SET_FIELD_LEN={0x8, 0x1, 0x1, 0x0, 0x10000}, @NFTA_SET_FIELD_LEN={0x8, 0x1, 0x1, 0x0, 0x60}, @NFTA_SET_FIELD_LEN={0x8, 0x1, 0x1, 0x0, 0xaf0}, @NFTA_SET_FIELD_LEN={0x8, 0x1, 0x1, 0x0, 0x385}, @NFTA_SET_FIELD_LEN={0x8, 0x1, 0x1, 0x0, 0x5}]}]}, @NFTA_SET_DESC_CONCAT={0x108, 0x2, 0x0, 0x1, [{0x2c, 0x1, 0x0, 0x1, [@NFTA_SET_FIELD_LEN={0x8, 0x1, 0x1, 0x0, 0x4a95df46}, @NFTA_SET_FIELD_LEN={0x8, 0x1, 0x1, 0x0, 0x8}, @NFTA_SET_FIELD_LEN={0x8, 0x1, 0x1, 0x0, 0x971}, @NFTA_SET_FIELD_LEN={0x8, 0x1, 0x1, 0x0, 0x26c4}, @NFTA_SET_FIELD_LEN={0x8, 0x1, 0x1, 0x0, 0xf11}]}, {0x54, 0x1, 0x0, 0x1, [@NFTA_SET_FIELD_LEN={0x8, 0x1, 0x1, 0x0, 0x9}, @NFTA_SET_FIELD_LEN={0x8, 0x1, 0x1, 0x0, 0x7}, @NFTA_SET_FIELD_LEN={0x8, 0x1, 0x1, 0x0, 0xffffff00}, @NFTA_SET_FIELD_LEN={0x8, 0x1, 0x1, 0x0, 0x2}, @NFTA_SET_FIELD_LEN={0x8, 0x1, 0x1, 0x0, 0x8}, @NFTA_SET_FIELD_LEN={0x8, 0x1, 0x1, 0x0, 0x9}, @NFTA_SET_FIELD_LEN={0x8, 0x1, 0x1, 0x0, 0x1}, @NFTA_SET_FIELD_LEN={0x8, 0x1, 0x1, 0x0, 0x3d4}, @NFTA_SET_FIELD_LEN={0x8, 0x1, 0x1, 0x0, 0x2}, @NFTA_SET_FIELD_LEN={0x8, 0x1, 0x1, 0x0, 0xfff}]}, {0xc, 0x1, 0x0, 0x1, [@NFTA_SET_FIELD_LEN={0x8, 0x1, 0x1, 0x0, 0x3}]}, {0x34, 0x1, 0x0, 0x1, [@NFTA_SET_FIELD_LEN={0x8, 0x1, 0x1, 0x0, 0x4}, @NFTA_SET_FIELD_LEN={0x8, 0x1, 0x1, 0x0, 0x6}, @NFTA_SET_FIELD_LEN={0x8, 0x1, 0x1, 0x0, 0xfb13}, @NFTA_SET_FIELD_LEN={0x8, 0x1, 0x1, 0x0, 0x86}, @NFTA_SET_FIELD_LEN={0x8, 0x1, 0x1, 0x0, 0x2}, @NFTA_SET_FIELD_LEN={0x8, 0x1, 0x1, 0x0, 0xd909}]}, {0x44, 0x1, 0x0, 0x1, [@NFTA_SET_FIELD_LEN={0x8, 0x1, 0x1, 0x0, 0x9}, @NFTA_SET_FIELD_LEN={0x8, 0x1, 0x1, 0x0, 0x8}, @NFTA_SET_FIELD_LEN={0x8, 0x1, 0x1, 0x0, 0xe}, @NFTA_SET_FIELD_LEN={0x8, 0x1, 0x1, 0x0, 0x452e}, @NFTA_SET_FIELD_LEN={0x8, 0x1, 0x1, 0x0, 0x2a22b218}, @NFTA_SET_FIELD_LEN={0x8, 0x1, 0x1, 0x0, 0x5}, @NFTA_SET_FIELD_LEN={0x8, 0x1, 0x1, 0x0, 0xffffffff}, @NFTA_SET_FIELD_LEN={0x8, 0x1, 0x1, 0x0, 0xbae}]}]}, @NFTA_SET_DESC_CONCAT={0x38, 0x2, 0x0, 0x1, [{0x34, 0x1, 0x0, 0x1, [@NFTA_SET_FIELD_LEN={0x8, 0x1, 0x1, 0x0, 0x5}, @NFTA_SET_FIELD_LEN={0x8, 0x1, 0x1, 0x0, 0x843}, @NFTA_SET_FIELD_LEN={0x8, 0x1, 0x1, 0x0, 0x3}, @NFTA_SET_FIELD_LEN={0x8, 0x1, 0x1, 0x0, 0x1ff}, @NFTA_SET_FIELD_LEN={0x8, 0x1, 0x1, 0x0, 0x9}, @NFTA_SET_FIELD_LEN={0x8, 0x1, 0x1, 0x0, 0x7}]}]}, @NFTA_SET_DESC_CONCAT={0xe4, 0x2, 0x0, 0x1, [{0x24, 0x1, 0x0, 0x1, [@NFTA_SET_FIELD_LEN={0x8, 0x1, 0x1, 0x0, 0x4}, @NFTA_SET_FIELD_LEN={0x8, 0x1, 0x1, 0x0, 0x8}, @NFTA_SET_FIELD_LEN={0x8, 0x1, 0x1, 0x0, 0xffffff80}, @NFTA_SET_FIELD_LEN={0x8, 0x1, 0x1, 0x0, 0x8}]}, {0x14, 0x1, 0x0, 0x1, [@NFTA_SET_FIELD_LEN={0x8, 0x1, 0x1, 0x0, 0x1}, @NFTA_SET_FIELD_LEN={0x8, 0x1, 0x1, 0x0, 0xa50}]}, {0x34, 0x1, 0x0, 0x1, [@NFTA_SET_FIELD_LEN={0x8, 0x1, 0x1, 0x0, 0x1000}, @NFTA_SET_FIELD_LEN={0x8, 0x1, 0x1, 0x0, 0x8}, @NFTA_SET_FIELD_LEN={0x8, 0x1, 0x1, 0x0, 0x9}, @NFTA_SET_FIELD_LEN={0x8, 0x1, 0x1, 0x0, 0x9b84}, @NFTA_SET_FIELD_LEN={0x8, 0x1, 0x1, 0x0, 0x61bcbb9b}, @NFTA_SET_FIELD_LEN={0x8, 0x1, 0x1, 0x0, 0x80000001}]}, {0x1c, 0x1, 0x0, 0x1, [@NFTA_SET_FIELD_LEN={0x8, 0x1, 0x1, 0x0, 0x9}, @NFTA_SET_FIELD_LEN={0x8, 0x1, 0x1, 0x0, 0x33e}, @NFTA_SET_FIELD_LEN={0x8, 0x1, 0x1, 0x0, 0x3ff}]}, {0x44, 0x1, 0x0, 0x1, [@NFTA_SET_FIELD_LEN={0x8, 0x1, 0x1, 0x0, 0xcb}, @NFTA_SET_FIELD_LEN={0x8, 0x1, 0x1, 0x0, 0x1}, @NFTA_SET_FIELD_LEN={0x8, 0x1, 0x1, 0x0, 0x2c95}, @NFTA_SET_FIELD_LEN={0x8, 0x1, 0x1, 0x0, 0x7}, @NFTA_SET_FIELD_LEN={0x8, 0x1, 0x1, 0x0, 0x9}, @NFTA_SET_FIELD_LEN={0x8, 0x1, 0x1, 0x0, 0x1}, @NFTA_SET_FIELD_LEN={0x8, 0x1, 0x1, 0x0, 0x75ce696d}, @NFTA_SET_FIELD_LEN={0x8, 0x1, 0x1, 0x0, 0x93}]}, {0x14, 0x1, 0x0, 0x1, [@NFTA_SET_FIELD_LEN={0x8, 0x1, 0x1, 0x0, 0x4}, @NFTA_SET_FIELD_LEN={0x8, 0x1, 0x1, 0x0, 0x2}]}]}, @NFTA_SET_DESC_SIZE={0x8, 0x1, 0x1, 0x0, 0x7}, @NFTA_SET_DESC_CONCAT={0x150, 0x2, 0x0, 0x1, [{0xc, 0x1, 0x0, 0x1, [@NFTA_SET_FIELD_LEN={0x8, 0x1, 0x1, 0x0, 0x9a5}]}, {0xc, 0x1, 0x0, 0x1, [@NFTA_SET_FIELD_LEN={0x8}]}, {0x2c, 0x1, 0x0, 0x1, [@NFTA_SET_FIELD_LEN={0x8, 0x1, 0x1, 0x0, 0x2}, @NFTA_SET_FIELD_LEN={0x8, 0x1, 0x1, 0x0, 0x8}, @NFTA_SET_FIELD_LEN={0x8}, @NFTA_SET_FIELD_LEN={0x8, 0x1, 0x1, 0x0, 0x7f}, @NFTA_SET_FIELD_LEN={0x8, 0x1, 0x1, 0x0, 0x7}]}, {0x4c, 0x1, 0x0, 0x1, [@NFTA_SET_FIELD_LEN={0x8, 0x1, 0x1, 0x0, 0x6}, @NFTA_SET_FIELD_LEN={0x8, 0x1, 0x1, 0x0, 0x80000000}, @NFTA_SET_FIELD_LEN={0x8, 0x1, 0x1, 0x0, 0x8}, @NFTA_SET_FIELD_LEN={0x8, 0x1, 0x1, 0x0, 0x7}, @NFTA_SET_FIELD_LEN={0x8, 0x1, 0x1, 0x0, 0xad53}, @NFTA_SET_FIELD_LEN={0x8, 0x1, 0x1, 0x0, 0x7}, @NFTA_SET_FIELD_LEN={0x8, 0x1, 0x1, 0x0, 0x1}, @NFTA_SET_FIELD_LEN={0x8, 0x1, 0x1, 0x0, 0x8}, @NFTA_SET_FIELD_LEN={0x8}]}, {0x34, 0x1, 0x0, 0x1, [@NFTA_SET_FIELD_LEN={0x8, 0x1, 0x1, 0x0, 0x3}, @NFTA_SET_FIELD_LEN={0x8, 0x1, 0x1, 0x0, 0x3}, @NFTA_SET_FIELD_LEN={0x8, 0x1, 0x1, 0x0, 0x2}, @NFTA_SET_FIELD_LEN={0x8, 0x1, 0x1, 0x0, 0x1}, @NFTA_SET_FIELD_LEN={0x8}, @NFTA_SET_FIELD_LEN={0x8, 0x1, 0x1, 0x0, 0x3}]}, {0x4c, 0x1, 0x0, 0x1, [@NFTA_SET_FIELD_LEN={0x8, 0x1, 0x1, 0x0, 0x3550000}, @NFTA_SET_FIELD_LEN={0x8, 0x1, 0x1, 0x0, 0x80000000}, @NFTA_SET_FIELD_LEN={0x8, 0x1, 0x1, 0x0, 0x77d0e760}, @NFTA_SET_FIELD_LEN={0x8, 0x1, 0x1, 0x0, 0x6629}, @NFTA_SET_FIELD_LEN={0x8, 0x1, 0x1, 0x0, 0x101}, @NFTA_SET_FIELD_LEN={0x8, 0x1, 0x1, 0x0, 0x1000}, @NFTA_SET_FIELD_LEN={0x8, 0x1, 0x1, 0x0, 0x8}, @NFTA_SET_FIELD_LEN={0x8, 0x1, 0x1, 0x0, 0x9}, @NFTA_SET_FIELD_LEN={0x8, 0x1, 0x1, 0x0, 0x4}]}, {0x24, 0x1, 0x0, 0x1, [@NFTA_SET_FIELD_LEN={0x8, 0x1, 0x1, 0x0, 0xfffffffb}, @NFTA_SET_FIELD_LEN={0x8, 0x1, 0x1, 0x0, 0xab3}, @NFTA_SET_FIELD_LEN={0x8, 0x1, 0x1, 0x0, 0x10000}, @NFTA_SET_FIELD_LEN={0x8, 0x1, 0x1, 0x0, 0x1}]}, {0x14, 0x1, 0x0, 0x1, [@NFTA_SET_FIELD_LEN={0x8, 0x1, 0x1, 0x0, 0x9}, @NFTA_SET_FIELD_LEN={0x8, 0x1, 0x1, 0x0, 0x401}]}, {0x4}]}, @NFTA_SET_DESC_SIZE={0x8, 0x1, 0x1, 0x0, 0x9}, @NFTA_SET_DESC_CONCAT={0x80, 0x2, 0x0, 0x1, [{0x2c, 0x1, 0x0, 0x1, [@NFTA_SET_FIELD_LEN={0x8, 0x1, 0x1, 0x0, 0x1}, @NFTA_SET_FIELD_LEN={0x8, 0x1, 0x1, 0x0, 0x9}, @NFTA_SET_FIELD_LEN={0x3, 0x1, 0x1, 0x0, 0xfffffffb}, @NFTA_SET_FIELD_LEN={0x8, 0x1, 0x1, 0x0, 0x46fdac4b}, @NFTA_SET_FIELD_LEN={0x8, 0x1, 0x1, 0x0, 0x40}]}, {0x3c, 0x1, 0x0, 0x1, [@NFTA_SET_FIELD_LEN={0x8, 0x1, 0x1, 0x0, 0x8}, @NFTA_SET_FIELD_LEN={0x8, 0x1, 0x1, 0x0, 0x5}, @NFTA_SET_FIELD_LEN={0x8, 0x1, 0x1, 0x0, 0xfffffff8}, @NFTA_SET_FIELD_LEN={0x8, 0x1, 0x1, 0x0, 0x3}, @NFTA_SET_FIELD_LEN={0x8, 0x1, 0x1, 0x0, 0xfb3}, @NFTA_SET_FIELD_LEN={0x8, 0x1, 0x1, 0x0, 0x200}, @NFTA_SET_FIELD_LEN={0x8, 0x1, 0x1, 0x0, 0x5}]}, {0x14, 0x1, 0x0, 0x1, [@NFTA_SET_FIELD_LEN={0x8, 0x1, 0x1, 0x0, 0x5e0d2ce9}, @NFTA_SET_FIELD_LEN={0x8, 0x1, 0x1, 0x0, 0x2}]}]}, @NFTA_SET_DESC_SIZE={0x8, 0x1, 0x1, 0x0, 0x1}, @NFTA_SET_DESC_SIZE={0x8, 0x1, 0x1, 0x0, 0x2}]}, @NFTA_SET_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_SET_KEY_LEN={0x8, 0x5, 0x1, 0x0, 0x21}]}, @NFT_MSG_NEWSETELEM={0x50, 0xc, 0xa, 0x101, 0x0, 0x0, {0x7}, [@NFTA_SET_ELEM_LIST_SET={0x9, 0x2, 'syz1\x00'}, @NFTA_SET_ELEM_LIST_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_SET_ELEM_LIST_ELEMENTS={0x24, 0x3, 0x0, 0x1, [{0x20, 0x0, 0x0, 0x1, [@NFTA_SET_ELEM_FLAGS={0x8, 0x3, 0x1, 0x0, 0x1}, @NFTA_SET_ELEM_EXPR={0x14, 0x7, 0x0, 0x1, @counter={{0xc}, @val={0x4}}}]}]}]}], {0x14, 0x10, 0x1, 0x0, 0x0, {0x3, 0x84}}}, 0x5a0}, 0x1, 0x0, 0x0, 0xc800}, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000017c0)={0x1, 0xe, &(0x7f0000001880)=ANY=[@ANYBLOB="b7000000ff000000bfa30000000000000703000018feffff720aa9fff8ffffff71a400fe0000000072030200000000131d400500000000004704000001ed00006b03feff000000001d440000000000007a0a00fe00ffffffc303000040000000b5000000000000009500000000000000023bc065b58111c6dfa041b63af4a3912435f1a864a710e4d58db6a693002e7f3be361917adef6ee1c8a2a4f8ef1e50becb19bc461e91a7109000000000190f32050e436fe275daf51efd601b6bf01c8e8b1b526375ec4dd6fcd82e4fee5bef7af9aa0d7d600c095199fe3ff3128e599b0eaebbdbd732c9cc00eec363e4a8f6456e2cc21557c0afc646cb7798b3e6440c2fbdb00c37dfca3e35208b0bb0d2cd829e654400e2438ec649dc74a28610643a98d9ec21ead2ed51b104d4d91af25b845d8a7925c3109b151b8b9f75dd08d123deda88c658d42ecbf28bf7076c15b463bebba2c598b4fc72f526d8e8afcb913466aaa7f6df70252e79166d858fcd0e06dd31af9612f2460d0b11008e59a5923906f88b53987ad1714e72ba7a54f0c33d39000d06a59ff616236fd9aa58f2477184b6a89adaf17b0a6041bdef728d236619074d6ebdfd1f5089048ddff6da40f9411fe722631cb467600ade70063e5291569b33d21dae356e1c51f03a801be8189679a16da18ec0ae564162a27afea62d84f3a1074649c6bc6ea9f2bca4464f56e24e6d2105bd901204a1deeed4155617572652d950ad31928b0b0c0dc2869f478341d02d0f5ad94b081fcd507acb4b9c65fee9d5a17f48a7382f13d000000225d85ae49cee383dc5049076b989b40000000000000da60d2ae20cfb91d6acdf538f9ce2bdb1ab062cd54e67011d355d84ce97bb0c6b4a595e487efbb2d71cde2c140952f9a0f0bc6980fe78683ac5c0c31032599ddd71063be9261b2e1aab1675b34a22048ef8c126aeef5f510a8f1aded94a129e4aec6f8d9ab06faffc3a15d96c2ea3e2e04cfe031b2875353193f82ade69d0540059fe6c7fe7cd8697502c7596566d674e425da5e87e50002a9f6590521d31d3804b3e0a1053abdc31282dfb15eb6841bb64a1b304502dda787343ce3c953992e4a982f3c48153baae244e7bf37548c7f1a4cad2422ee965a38f7defbd2160242b104e20dc2d9b0c35608d402ccdd9069bd50b994fda7a9de5c028d6112a0c2d21b2dc98814106dec28eaeb883418f562ae00003ea96d10f172c0374d6eed826416050000000bfe9b4a9c5a90ff59d54d1f92ecc4e95dd2d18383117c039862198899b212c53218294270a1ad10c80fef7c24d47afce829ba0f85da6d888f18ea40ab959f6074ab2a40d85d15017ab513cdc6c0e57fb1c1ca571380d7b4ead35a385e0b4a26b702396df7e0c1e02b6e4114f244a9bf93f04bf072f0861f7580e69db384ac7eeedcf2ba1a9508f9d6aba582a896a9f1ffa968eacea75caf822a7a63ba34015ea5aacb118888876b617398d00a7526103ad2a3b1832371fe5bc621426d1ed0a4a99702cc1b6912a1e717d29135753208165b9cdbae2ed9dc7358f0ebadde0b727f27feeb744ddcc536cbae315c7d1fe1399562ba6824840bd2951680f6f2f9a6a8346962a350845ffa0d829e4f79adc287906943408e6df3c3bfd03aac93df8866fb010aec0e92bed1fe39af169d2a466f0db6f3d9436a7d55fc30511d00000000c95265b2bd83d64a532869d701723fed000000007baa5b6a686b50f0937f778af083e08b7ab6cd9c65ba55f6138a757ebd0ed93517a6b244f9acf41ac5d73a008364e0606a594817031fc2f52c8785fe0721719b3d654026c6ea08b83b123145ab5703dad844ceb201ddc42efc54fa84323afc4c10eff462c8843187f1dd48ef3fa293d364b9effa9a9406ac2683e231d4774d582956ff0f40b10ca94f6feeb2893c17888e1cdba94a6ea80c33ead5722c3293a493f1479517dd88261458f40d31fe8df15efaaeea831555877f9538d6ee6ba65893ff1f908ba7554ba583fef3ec7932f5954f31a878e2fae6691d1aee1da02ba516467df3e7d1daac43738012e4fee18a79e59e1712c8c546768e5722da19fcdb4c2890cda1f96b952511e3a49d694d625e0b2f808890205f3a6da2819d2f9e77c7c64affa54fec0136cbafa5f62e96753b639a924599c1f69219927ea5301fff0a6063d427f0688430754c02180d61542c25000000000000000005a7b57f03ca91a01ba2e30ca99e8ebc15ecb4d91675767987d146aef7799738b292fd640dfef6b04d086f737a159d7e0c6e4d81ad64a8bbca485683252b15f36b788bce5ccdbaf75c94cb93499f6947a967a7bce14c6de4e7c0660d80010f5c653d22d49030a8c2a4ab595bf4238f18ca428dafc7ac96d404607a0000000051a2104f22e6db5a62b5089c1b45282d38864daa3ae81d6b0968d1d2867b91b7d120617d12d91db2633d6864da40b54783a17aaeb6737c32040098e354cc98dcfe23ad01bd1c61563e69ffe1c2c73e1661261173f359e93d2c5e424c17998809ec8f0232b3955e052a4cecd89008f70314a0bdd491ec86a4555d89fe0120f64c62e8e3ed8bcb45202c3d4bbec8d722824c0ebca8db1ea4a0032f37ff559be78537756ab5bbe4fe9af5d785d0128171c90d9900ce2532b0f9d01c4b45294fbba468df3e1be62e754598e47df6bd06431c94bc5d047899fd219f448bf9189c65c9d91eda6b52a373803a9efe44f86909bc90addb7b9aee813df534aac4b3093c91b8068cd849904568916694d461b76a58d88cf0f520310a1e9fdc18cde98d662eee07751532d5e7d0a8811922929e085392ab3d1311b8243266d87047f601fa88a0da36b9f302e8262395174328f2482d14008de83070f66b2b388f0f744f143fdec90ba5a82668d5fac114c13955ad6dca5db2231d8ba14c54c47ed04a4b4ace17e357e1d6432399f87a7a14245bbd796a09313b247b95d37ff40a404bdad74bd20000000000000000000099fef7cd7af3ce64a92f95d89d125b1e641240d7e5e2fa3d1f7684448c3e3822d617e205061298b939a191be4b48e169bde2cae3accc5bd40a2968b59c93d35f8e42366fdef907000000f01ce68abff28861aac8302d268569dd42e194e330c7aaa54ebbcefd23f21ce8153b9926e12e015cb56119df72c7533a48d028a3a981463f25c068d4410dad0c74e2a9478fa3be18a1a27bc46dd12305a1ae9dd19e8d525206c0a728cfd42193abe8130b51d6c9b94c5513df2d85e8c01a2d69841f3d7799ac04bdc590bb1c89b9c695f163e57343c9bfb59909433c9001c5f8b23e38534a538fc933cac6c2a92d038df638a0f226df9fb857bd414c2cd69985e8053e3dfa41614d7c74d04d8c2471041d17c730fad28395f8d4688898cd58b9d600c851626529bb581012fd7a8139166fd5e59c84f4ab07001b99c028db4cb9680c8035f967db18de738844da7e260a830c1ffa49f5af3c15423a0e315acb82a3e89218cb314e68fda4d94aa1d815babc13b9fd336d205c5913ef670000000000000000ba470bfe62fe293308b2a146f12a4c205235924cee765d94b1cc06641247c773ab8d1abbeb03ea68"], &(0x7f0000000080)='GPL\x00', 0x7, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x0, 0x10, &(0x7f0000000000), 0xffffffffffffff11, 0x0, 0xffffffffffffffff, 0xfffffffffffffea5}, 0x48) r9 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0xc0a41, 0x0) ioctl$TUNSETIFF(r9, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0x4002}) bpf$MAP_UPDATE_CONST_STR(0x2, &(0x7f00000005c0)={{r3, 0xffffffffffffffff}, &(0x7f0000000540), &(0x7f0000000580)='%pI4 \x00'}, 0x20) bpf$MAP_UPDATE_BATCH(0x1a, &(0x7f0000000640)={&(0x7f0000000100)="93f27aff4d3d9464db85e34b662b5fcf8bea10eb6fd1796c3f6c9eab14143917eb3ee7cbbcc0a4a65dd35d0252adbebfd5480bbe9cac47df", &(0x7f00000003c0)=""/181, &(0x7f0000000480)="323d65bc489533cd4ad9d5d8d6424eaca271844dd45fa1eeb109619838652320bbdfd4c95ef53991785fba1ca760a24cdebf4319a1dae4e6d07b0bd59c36ad1bfad979", &(0x7f0000000500)="5784f8f859c1463d6fb8a3374e75e30f17a60f4d5e1f", 0xbb48, r10, 0x4}, 0x38) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000180)='./cgroup/syz0\x00', 0x200002, 0x0) r11 = epoll_create1(0x80000) epoll_ctl$EPOLL_CTL_ADD(r11, 0x1, r9, &(0x7f0000000600)) write$tun(r9, &(0x7f0000000240)={@val={0x0, 0x18}, @val={0x3, 0x1, 0x3, 0xffff, 0xc4, 0x10}, @ipv4=@tcp={{0x5, 0x4, 0x3, 0x4, 0xd6, 0x65, 0x0, 0x9, 0x6, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @broadcast}, {{0x4e20, 0x4e22, 0x41424344, 0x41424344, 0x1, 0x0, 0x1d, 0x80, 0x7, 0x0, 0x9, {[@mptcp=@remove_addr={0x1e, 0x59, 0x6, 0x0, "3bcc55e2fb4b662a463b24b28a4fafb428a89d60f9547d33690c48bf9581455479f14cea31faf5212327c508ed14d3cc9f1b20adaecc3b4c664e61295f92adc7b03928e6f24a8ee8e299effe97537d57096d808d21b4"}, @exp_fastopen={0xfe, 0x4}]}}, {"13d3b3875dfd9a3f6328f33f09ceec09986b30406704e2560f04592cb4869c77658fcb3eca004c77b183c5840dbb0fd30bcd067737d3f07dff1755aac0e628d921d141b089c15306c066b177aab8"}}}}, 0xe4) sendmsg$nl_route(r5, &(0x7f0000000380)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000040)=@newlink={0x44, 0x10, 0x437, 0x0, 0xffffffff, {0x0, 0x0, 0x0, 0x0, 0x5120b, 0x1020}, [@IFLA_LINKINFO={0x24, 0x12, 0x0, 0x1, @bridge={{0xb}, {0x14, 0x2, 0x0, 0x1, [@IFLA_BR_PRIORITY={0x6, 0x6, 0x4}, @IFLA_BR_STP_STATE={0x8}]}}}]}, 0x44}, 0x1, 0x0, 0x0, 0x48800}, 0x0) 1.962670054s ago: executing program 3 (id=8553): r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff) getsockname$packet(0xffffffffffffffff, 0x0, 0x0) sendmsg$GTP_CMD_DELPDP(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000140)={0x1c, 0x0, 0x3, 0x2070bd29, 0xe, {}, [@GTPA_LINK={0x8}]}, 0x1c}, 0x1, 0x0, 0x0, 0x2000041}, 0x20000000) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f00000001c0), 0xffffffffffffffff) sendmsg$NL80211_CMD_START_AP(0xffffffffffffffff, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000140)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r1, @ANYBLOB="a183000000000000000005"], 0x1c}}, 0x0) sendmsg$NLBL_MGMT_C_ADDDEF(r0, &(0x7f0000000100)={0x0, 0xd, &(0x7f00000000c0)={&(0x7f0000000000)=ANY=[@ANYRES64=r1], 0x4c}}, 0x4040000) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000240)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x800000}, 0xc, &(0x7f0000000200)={&(0x7f0000000180)=@ipv4_getroute={0x1c, 0x1a, 0x400, 0x70bd2d, 0x25dfdbff, {0x2, 0x0, 0x10, 0xd, 0xff, 0x0, 0xfd, 0x0, 0xf00}, ["", "", "", ""]}, 0x1c}, 0x1, 0x0, 0x0, 0x24000080}, 0x4040884) unshare(0x68070a80) r2 = socket$phonet_pipe(0x23, 0x5, 0x2) bind$phonet(r2, 0x0, 0x0) 1.791428866s ago: executing program 3 (id=8554): r0 = socket$kcm(0x29, 0x2, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) sendmsg$sock(r1, &(0x7f00000004c0)={&(0x7f0000000000)=@pptp={0x18, 0x2, {0x2, @broadcast}}, 0x80, &(0x7f0000000440)=[{&(0x7f0000000080)="5354c7a3253453259d51022f3f209f2dd0a8e1a62acc8d548df3502d8c0d0ceec103de857256bc54a584c4f4b54adc493020c22368878989877023cec2141a48826e896586dfdaa48b5af5fe07f45b68dba01d29f51f1d2ff0da6f849c431f004ea9872df294aceb5bbc7b47b09a98f69d54dcd2d1ef316456", 0x79}, {&(0x7f0000000100)="473f553a5e06ace19d49650b51c349a4187aeb7232af3ae9b9b2b8dbf10010c6bf815685ba493c36bd5a9c80fb6566b3ca1d1b35", 0x34}, {&(0x7f0000000140)="7aefb66f1a23245aa37222127fac94a76656fd5b8b4d48bea88a", 0x1a}, {&(0x7f0000000180)="94d1b1f18c44de126658b7c490e0594176bf8672dd70de5a4a763776fed29a3f1abf826a9c2012ae8cb020b8d5f542407a95ac50f5d45d70dc3961a0d854a9139c6bdc328d2164839aa592302b3e8e2856b667ff5b9629ded32b3b7a91928d2d31e1690b8267bdd7474105b19fb37d10d825cb63ebf4e2ac9ad7e47030b4265956c76da7ecf46632eadc0765df07066631069ea028dcce05e2f399850d7ef5d47d6c3f425fdc876aac66ef4e6c91bda5d31000a9765256171c1a2b9642cdc8f9f52936eed12bb37c15b3c10986a2caeb1511c0590199436902447dadfce178", 0xdf}, {&(0x7f0000000280)="e1a6b357086fd7af3a4e774f02e9e0f991d5f549842c5ffce3e8a398223d20e3c8d09055be4393bbb292", 0x2a}, {&(0x7f00000002c0)="1e66ed84d34108d9b8329520d8e3f489f9b9fe4ffd3ad81134caddb9089f7b3a95347fb15a4ba53ca7640a662081c9a5ed27d1e520522a6d7e95fd40fb60d0f03f64db6ac4543a034781a608aad2b6623c3e641423c24658d1b5ea19d659f4ead5ce1850dc51df6ddf4fb1f2ac3e75820fe380669da9ed63d899a8c3f77c282d79ad1d6b93db3f190384ec0b46857e34d60e13acc86cb5315cf9322125931a6db7d75cf1b2991c312cee705ba59848dbedc695336930ffdbdd883fe9eeab5c15", 0xc0}, {&(0x7f0000000380)="8fbdcdabcf3fd60ab1c9fee10ba68b333bb6791fc9334372c91af11be1c67ce458d43b5f43632c52f6ebe810459f3dbccb62c527addac674302b28f8d38043ccc56519f5601007dc60ca0d9765f2cda0d63e85f9e3cbb8425ce05a397a4343f6340d58d6590d9930908325bbb059204ef9a111babf60cbbeaed942944852", 0x7e}, {&(0x7f0000000400)="3c1eadb6bac754a5ca01e7b0851115ccf609334d699f396a988a2cf8d9fbc5d6f294a0a1a348ed6017a8f33405945182edfc638efa906f", 0x37}], 0x8}, 0x4000080) openat$tun(0xffffffffffffff9c, &(0x7f0000000500), 0x2080c2, 0x0) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000580), 0xffffffffffffffff) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r0, 0x8933, &(0x7f00000005c0)={'batadv_slave_1\x00', 0x0}) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(0xffffffffffffffff, 0x89f0, &(0x7f00000006c0)={'gretap0\x00', &(0x7f0000000600)={'syztnl1\x00', 0x0, 0x1, 0x20, 0x8, 0x9, {{0x1a, 0x4, 0x2, 0x2, 0x68, 0x65, 0x0, 0x62, 0x2f, 0x0, @empty, @remote, {[@generic={0x83, 0xe, "0af204f78feb90486eddcf89"}, @lsrr={0x83, 0x1f, 0x40, [@empty, @initdev={0xac, 0x1e, 0x0, 0x0}, @private=0xa010100, @private=0xa010102, @multicast2, @multicast2, @private=0xa010102]}, @timestamp={0x44, 0x8, 0x54, 0x0, 0x5, [0x1]}, @rr={0x7, 0x1b, 0xaa, [@dev={0xac, 0x14, 0x14, 0x3a}, @local, @remote, @remote, @multicast1, @rand_addr=0x6]}, @end, @end]}}}}}) sendmsg$ETHTOOL_MSG_STRSET_GET(r2, &(0x7f0000000800)={&(0x7f0000000540)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f00000007c0)={&(0x7f0000000700)={0xb4, r3, 0x920, 0x70bd2d, 0x25dfdbfd, {}, [@ETHTOOL_A_STRSET_HEADER={0x84, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'bridge_slave_1\x00'}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x3}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'vlan0\x00'}, @ETHTOOL_A_HEADER_FLAGS={0x8}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x3}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r4}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'tunl0\x00'}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r5}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x1}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'wlan1\x00'}]}, @ETHTOOL_A_STRSET_HEADER={0x18, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'batadv_slave_0\x00'}]}, @ETHTOOL_A_STRSET_COUNTS_ONLY={0x4}]}, 0xb4}, 0x1, 0x0, 0x0, 0x40}, 0x8040) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000840)='./cgroup.cpu/syz1\x00', 0x200002, 0x0) r6 = syz_genetlink_get_family_id$tipc2(&(0x7f00000008c0), r2) sendmsg$TIPC_NL_MEDIA_GET(r2, &(0x7f0000000b00)={&(0x7f0000000880)={0x10, 0x0, 0x0, 0x40000000}, 0xc, &(0x7f0000000ac0)={&(0x7f0000000900)={0x1b8, r6, 0x200, 0x70bd29, 0x25dfdbfd, {}, [@TIPC_NLA_NET={0x34, 0x7, 0x0, 0x1, [@TIPC_NLA_NET_NODEID_W1={0xc, 0x4, 0x5}, @TIPC_NLA_NET_NODEID={0xc, 0x3, 0x7a5}, @TIPC_NLA_NET_NODEID_W1={0xc, 0x4, 0xa}, @TIPC_NLA_NET_NODEID={0xc, 0x3, 0xb74}]}, @TIPC_NLA_BEARER={0xc, 0x1, 0x0, 0x1, [@TIPC_NLA_BEARER_DOMAIN={0x8, 0x3, 0x4}]}, @TIPC_NLA_BEARER={0x88, 0x1, 0x0, 0x1, [@TIPC_NLA_BEARER_PROP={0x14, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_WIN={0x8, 0x3, 0x8}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x1}]}, @TIPC_NLA_BEARER_DOMAIN={0x8, 0x3, 0x3}, @TIPC_NLA_BEARER_UDP_OPTS={0x38, 0x4, {{0x14, 0x1, @in={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0x1e}}}, {0x20, 0x2, @in6={0xa, 0x4e21, 0x65, @remote, 0xa}}}}, @TIPC_NLA_BEARER_NAME={0x13, 0x1, @l2={'eth', 0x3a, 'netdevsim0\x00'}}, @TIPC_NLA_BEARER_PROP={0xc, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_WIN={0x8, 0x3, 0x3}]}, @TIPC_NLA_BEARER_NAME={0xd, 0x1, @udp='udp:syz0\x00'}]}, @TIPC_NLA_PUBL={0x3c, 0x3, 0x0, 0x1, [@TIPC_NLA_PUBL_LOWER={0x8, 0x2, 0x6}, @TIPC_NLA_PUBL_TYPE={0x8, 0x1, 0x5}, @TIPC_NLA_PUBL_LOWER={0x8, 0x2, 0xc6}, @TIPC_NLA_PUBL_LOWER={0x8, 0x2, 0x4}, @TIPC_NLA_PUBL_UPPER={0x8, 0x3, 0x6}, @TIPC_NLA_PUBL_LOWER={0x8, 0x2, 0x5}, @TIPC_NLA_PUBL_LOWER={0x8}]}, @TIPC_NLA_LINK={0xa0, 0x4, 0x0, 0x1, [@TIPC_NLA_LINK_PROP={0xc, 0x7, 0x0, 0x1, [@TIPC_NLA_PROP_TOL={0x8, 0x2, 0x4}]}, @TIPC_NLA_LINK_NAME={0x9, 0x1, 'syz1\x00'}, @TIPC_NLA_LINK_PROP={0x24, 0x7, 0x0, 0x1, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0x6}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x51c}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0xd}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x4}]}, @TIPC_NLA_LINK_NAME={0x9, 0x1, 'syz0\x00'}, @TIPC_NLA_LINK_PROP={0xc, 0x7, 0x0, 0x1, [@TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x7}]}, @TIPC_NLA_LINK_NAME={0x13, 0x1, 'broadcast-link\x00'}, @TIPC_NLA_LINK_NAME={0x9, 0x1, 'syz0\x00'}, @TIPC_NLA_LINK_PROP={0x1c, 0x7, 0x0, 0x1, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0xfc4}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x2}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x4}]}, @TIPC_NLA_LINK_NAME={0x9, 0x1, 'syz0\x00'}]}]}, 0x1b8}, 0x1, 0x0, 0x0, 0x800}, 0x200c0b8) pipe(&(0x7f0000000b40)={0xffffffffffffffff, 0xffffffffffffffff}) setsockopt$TIPC_CONN_TIMEOUT(r7, 0x10f, 0x82, &(0x7f0000000b80)=0x1, 0x4) r9 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000bc0)='./cgroup.net/syz0\x00', 0x200002, 0x0) openat$cgroup_freezer_state(r9, &(0x7f0000000c00), 0x2, 0x0) setsockopt$RDS_GET_MR_FOR_DEST(r7, 0x114, 0x7, &(0x7f0000000d00)={@llc={0x1a, 0x102, 0x9, 0x80, 0x17, 0x6, @remote}, {&(0x7f0000000c40)=""/75, 0x4b}, &(0x7f0000000cc0), 0xd}, 0xa0) getsockopt$IPT_SO_GET_ENTRIES(r7, 0x0, 0x41, &(0x7f0000000dc0)={'filter\x00', 0x4e, "5fc194a24be05dc64ba15afe1d6a438254cfe1fd9756c8c879d3a29479e72453f2862a497a4cf8a425174f351120972b922706d71a9a8c871d3d65409ed922038332710c4122ad6fc6856ac21e05"}, &(0x7f0000000e40)=0x72) ioctl$BTRFS_IOC_DEFRAG_RANGE(r9, 0x40309410, 0x0) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r10 = socket$netlink(0x10, 0x3, 0x5) getsockopt$sock_linger(r10, 0x1, 0xd, &(0x7f0000000e80), &(0x7f0000000ec0)=0x8) getsockopt$IP6T_SO_GET_REVISION_TARGET(r7, 0x29, 0x45, &(0x7f0000000f00)={'TPROXY\x00'}, &(0x7f0000000f40)=0x1e) openat$cgroup_subtree(r8, &(0x7f0000000f80), 0x2, 0x0) connect$inet(r8, &(0x7f0000000fc0)={0x2, 0x4e22, @private=0xa010100}, 0x10) r11 = socket$l2tp6(0xa, 0x2, 0x73) ioctl$sock_inet6_SIOCSIFDSTADDR(r11, 0x8918, &(0x7f0000001000)={@empty, 0x48, r5}) getsockopt$inet_sctp_SCTP_DELAYED_SACK(r8, 0x84, 0x10, &(0x7f0000001040)=@assoc_value={0x0, 0x3}, &(0x7f0000001080)=0x8) ioctl$TUNSETIFINDEX(r8, 0x400454da, &(0x7f00000010c0)=r4) setsockopt$inet_sctp_SCTP_SET_PEER_PRIMARY_ADDR(r7, 0x84, 0x5, &(0x7f0000001100)={r12, @in={{0x2, 0x4e21, @multicast2}}}, 0x84) 1.508181307s ago: executing program 1 (id=8555): r0 = socket$inet6_sctp(0xa, 0x5, 0x84) syz_init_net_socket$bt_hidp(0x1f, 0x3, 0x6) (async) r1 = syz_init_net_socket$bt_hidp(0x1f, 0x3, 0x6) r2 = socket$rxrpc(0x21, 0x2, 0x2) ioctl$sock_bt_hidp_HIDPCONNADD(r1, 0x400448c8, &(0x7f0000000000)={r0, r2, 0x1ff, 0x0, 0x0, 0xa, 0x81, 0x1000, 0x0, 0x4102, 0x1, 0x8, 'syz1\x00'}) 1.391598265s ago: executing program 3 (id=8556): r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r1, &(0x7f0000000080)={0x1f, 0xffff, 0x3}, 0x6) write(r1, &(0x7f0000000000)="0a000000010001", 0x7) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r2, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000006c0)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x7}}, [@NFT_MSG_NEWTABLE={0x20, 0x0, 0xa, 0x401, 0x0, 0x0, {0x1, 0x0, 0x8000}, [@NFTA_TABLE_NAME={0x9, 0x1, 'syz0\x00'}]}, @NFT_MSG_NEWCHAIN={0x2c, 0x3, 0xa, 0x101, 0x0, 0x0, {0x1, 0x0, 0x3}, [@NFTA_CHAIN_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_CHAIN_NAME={0x9, 0x3, 'syz2\x00'}]}, @NFT_MSG_NEWRULE={0x9c, 0x6, 0xa, 0x401, 0x0, 0x0, {0x1}, [@NFTA_RULE_CHAIN_ID={0x8}, @NFTA_RULE_EXPRESSIONS={0x74, 0x4, 0x0, 0x1, [{0x34, 0x1, 0x0, 0x1, @exthdr={{0xb}, @val={0x24, 0x2, 0x0, 0x1, [@NFTA_EXTHDR_DREG={0x8, 0x1, 0x1, 0x0, 0xc}, @NFTA_EXTHDR_OFFSET={0x8, 0x3, 0x1, 0x0, 0x3b}, @NFTA_EXTHDR_LEN={0x8, 0x4, 0x1, 0x0, 0x22}, @NFTA_EXTHDR_TYPE={0x5, 0x2, 0x7}]}}}, {0x3c, 0x1, 0x0, 0x1, @bitwise={{0xc}, @val={0x2c, 0x2, 0x0, 0x1, [@NFTA_BITWISE_LEN={0x8, 0x3, 0x1, 0x0, 0x4}, @NFTA_BITWISE_SREG={0x8, 0x1, 0x1, 0x0, 0x14}, @NFTA_BITWISE_DREG={0x8, 0x2, 0x1, 0x0, 0x12}, @NFTA_BITWISE_OP={0x8, 0x6, 0x1, 0x0, 0x1}, @NFTA_BITWISE_DATA={0x8, 0x7, 0x0, 0x1, [@NFTA_DATA_VALUE={0x4}]}]}}}]}, @NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x7}}}, 0x110}}, 0x0) syz_genetlink_get_family_id$netlbl_cipso(&(0x7f00000002c0), r0) r3 = socket$inet6(0xa, 0x800000000000002, 0x0) setsockopt$inet6_udp_int(r3, 0x11, 0x67, &(0x7f0000000000)=0x28, 0x4) r4 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r4, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r5 = socket(0x400000000010, 0x3, 0x0) syz_genetlink_get_family_id$ieee802154(&(0x7f00000001c0), r0) sendmsg$IEEE802154_LLSEC_SETPARAMS(0xffffffffffffffff, 0x0, 0x800) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000000)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r5, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000005c0)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70bd2c, 0x25dddbfd, {0x0, 0x0, 0x0, r6, {0x0, 0xffff}, {0xffff, 0xffff}, {0x1, 0xd}}, [@qdisc_kind_options=@q_multiq={{0xb}, {0x8, 0x2, {0x28}}}]}, 0x38}}, 0x0) r7 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r7, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000044c0)={&(0x7f0000000140)={0x60, 0x2, 0x6, 0x401, 0x0, 0x0, {}, [@IPSET_ATTR_DATA={0x14, 0x7, 0x0, 0x1, [@IPSET_ATTR_TIMEOUT={0x8, 0x6, 0x1, 0x0, 0x9}, @IPSET_ATTR_CADT_FLAGS={0x8, 0x8, 0x1, 0x0, 0x9e}]}, @IPSET_ATTR_PROTOCOL={0x5, 0x1, 0x6}, @IPSET_ATTR_FAMILY={0x5, 0x5, 0xa}, @IPSET_ATTR_REVISION={0x5}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}, @IPSET_ATTR_TYPENAME={0x11, 0x3, 'hash:ip,mark\x00'}]}, 0x60}, 0x1, 0x0, 0x0, 0x24000000}, 0x0) sendmsg$nl_route_sched(r5, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000280)=@newtfilter={0x3c, 0x2c, 0xd27, 0x70bd28, 0x8000, {0x0, 0x0, 0x0, r6, {0x0, 0x8}, {}, {0xc}}, [@filter_kind_options=@f_flower={{0xb}, {0xc, 0x2, [@TCA_FLOWER_KEY_ENC_OPTS={0x8, 0x54, 0x0, 0x1, [@TCA_FLOWER_KEY_ENC_OPTS_ERSPAN={0x4, 0x27}]}]}}]}, 0x3c}, 0x1, 0x0, 0x0, 0x260580e9}, 0x810) r8 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r8, 0x8933, &(0x7f00000002c0)={'bridge_slave_1\x00', 0x0}) sendmsg$nl_route_sched(r8, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000140)=@newqdisc={0x44, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0xffffffff, {0x0, 0x0, 0x0, r9, {0x0, 0xfff1}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_hfsc={{0x9}, {0x14, 0x2, @TCA_HFSC_FSC={0x10, 0x2, {0xd, 0xfffffffb, 0x7fffffff}}}}]}, 0x44}, 0x1, 0x0, 0x0, 0x4000000}, 0x20040084) sendmsg$nl_route_sched(r8, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000001980)=@newqdisc={0x43c, 0x28, 0x4ee4e6a52ff56541, 0x5001, 0xfffffdfc, {0x0, 0x0, 0x0, r9, {0xfff3}, {0x0, 0xfff1}, {0x2, 0x8}}, [@qdisc_kind_options=@q_tbf={{0x8}, {0x408, 0x2, [@TCA_TBF_RTAB={0x404, 0x2, [0x80000001, 0x8001, 0x3, 0x0, 0x6, 0x4, 0x8, 0x9, 0x401, 0xfffffffc, 0x6, 0xfffffff7, 0x3, 0x3, 0x4, 0x3, 0x100, 0x8, 0xff, 0x80, 0x9, 0x8001, 0x80, 0x7, 0x101, 0xa46, 0xeb, 0x7ff, 0x7, 0x10001, 0x9, 0x6, 0x9c01, 0x7, 0x4, 0x0, 0xfaa, 0xc88, 0x6, 0x8d1, 0x1ff, 0x2, 0x1, 0x80000000, 0x6a, 0xffffffff, 0x7, 0x4, 0x3, 0x6, 0x0, 0x100, 0x4, 0x9, 0x8, 0x144, 0xd, 0x14574, 0x0, 0x7f, 0x7, 0x1, 0x314, 0x7, 0xe, 0xfccf, 0x2, 0x45, 0x7, 0x4, 0x2, 0x8, 0x5, 0x3, 0x1, 0x4, 0x1, 0x40, 0xb, 0x3ff, 0xfffffff9, 0x6, 0x9, 0x8, 0x80, 0x59b, 0x1, 0x2, 0x6, 0xc, 0x0, 0xfffffffa, 0x4, 0xba65, 0x4, 0x0, 0x70e, 0x9, 0xd, 0x1, 0x0, 0x7fffffff, 0x7fff, 0xfff, 0x4, 0x4, 0xac1, 0x5, 0x4, 0x9, 0x5, 0x9, 0x7, 0x5371, 0x709d7f5b, 0xa09a, 0xfffffffe, 0x4b8a, 0x9, 0x7, 0x4, 0x3, 0x8a9, 0x6, 0x4, 0x10001, 0xc0000000, 0x4, 0x7, 0xf, 0x86, 0x7, 0x3, 0x9, 0x9, 0x663, 0xfffffffd, 0xe2, 0x0, 0x4, 0x4, 0x6, 0xfc, 0x1, 0x9, 0x8, 0x7, 0x8001, 0x0, 0x4, 0x5, 0xfd, 0x90, 0xffff, 0x5, 0xfffeffff, 0x7, 0x9, 0x8e0e, 0x1, 0xe, 0x8, 0xd, 0x2, 0x5, 0x0, 0xb, 0x6, 0x4, 0x9, 0x9, 0x0, 0xc, 0xaa8, 0xcb1a, 0x7, 0xffffffff, 0x9, 0x2, 0x81, 0x9, 0x280, 0x0, 0x8, 0x9, 0x8, 0xfffffff9, 0x800, 0x18e, 0x5, 0x5, 0x1, 0x32, 0x6, 0x4f, 0x8, 0xfffffff9, 0x1, 0x0, 0x6, 0x1, 0x7, 0x8001, 0x7, 0x53f, 0x4, 0xd13b, 0xb, 0x6, 0xb, 0x100, 0x7, 0x5, 0x6, 0x1, 0x10001, 0x6, 0x4, 0x7, 0x82, 0xf0, 0x4, 0x3, 0x6, 0x4, 0x5, 0x400, 0x0, 0x0, 0x1000, 0x6, 0xc, 0x2, 0x1, 0x3, 0xc, 0x8, 0x80000001, 0x8, 0xa4eb, 0x7, 0x4, 0xffffffff, 0x1ff, 0x3ff, 0x3, 0x80, 0x3, 0x8001, 0x1, 0x8, 0xe1, 0xc, 0x5, 0x3, 0x95]}]}}, @TCA_RATE={0x6, 0x5, {0x0, 0x11}}]}, 0x43c}, 0x1, 0x0, 0x0, 0x40098}, 0x4004004) r10 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r10, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000003c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0) 1.308083653s ago: executing program 1 (id=8557): socket$nl_xfrm(0x10, 0x3, 0x6) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x0) sendmsg$NFT_BATCH(r0, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f0000000100)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x5}}, [@NFT_MSG_NEWSET={0x3c, 0x9, 0xa, 0x401, 0x0, 0x0, {0xa, 0x0, 0x4}, [@NFTA_SET_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_SET_KEY_LEN={0x8, 0x5, 0x1, 0x0, 0x2}, @NFTA_SET_NAME={0x9, 0x2, 'syz1\x00'}, @NFTA_SET_ID={0x8, 0xa, 0x1, 0x0, 0xfffffffc}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x1}}}, 0x64}, 0x1, 0x0, 0x0, 0x94}, 0x24000000) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000680)={0xffffffffffffffff, 0xffffffffffffffff}) setsockopt$sock_attach_bpf(r3, 0x1, 0x4c, &(0x7f0000000000), 0x4) sendmsg$inet(r2, &(0x7f0000000140)={0x0, 0x0, 0x0}, 0x0) recvmsg$unix(r3, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000300)=[@rights={{0x14, 0x1, 0x1, [0xffffffffffffffff]}}], 0x18}, 0x0) ioctl$sock_inet6_tcp_SIOCINQ(r4, 0x541b, 0x0) r5 = socket(0x10, 0x3, 0x0) r6 = socket$nl_generic(0x10, 0x3, 0x10) r7 = syz_genetlink_get_family_id$nl80211(&(0x7f00000000c0), 0xffffffffffffffff) syz_emit_ethernet(0x6e, &(0x7f0000000880)={@broadcast, @empty, @void, {@ipv6={0x86dd, @icmpv6={0x0, 0x6, "f4a300", 0x38, 0x3a, 0x1, @remote, @mcast2, {[], @param_prob={0x4, 0x0, 0x0, 0x6, {0xc, 0x6, "f6cd53", 0x200, 0x2c, 0xff, @dev={0xfe, 0x80, '\x00', 0x35}, @local, [], "13d86558da0a7f6b"}}}}}}}, 0x0) sendmsg$NL80211_CMD_GET_WIPHY(r6, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000080)={0x28, r7, 0x65aebf9dafbebb59, 0x70bd28, 0x1, {{}, {@void, @val={0x8}, @val={0xc, 0x99, {0x6, 0x112}}}}}, 0x28}, 0x1, 0x0, 0x0, 0x400c080}, 0x24048840) r8 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r8, 0x8933, &(0x7f0000000380)={'bridge0\x00', 0x0}) sendmsg$nl_route(r5, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000140)=@newlink={0x44, 0x10, 0xffffffffffffffff, 0x70bd26, 0x25dfdbee, {0x0, 0x0, 0x0, 0x0, 0x40c35}, [@IFLA_LINKINFO={0x1c, 0x12, 0x0, 0x1, @macsec={{0xb}, {0xc, 0x2, 0x0, 0x1, [@IFLA_MACSEC_PORT={0x6, 0x2, 0x1, 0x0, 0x4e23}]}}}, @IFLA_LINK={0x8, 0x5, r9}]}, 0x44}, 0x1, 0x0, 0x0, 0x20028001}, 0x8000) sendmsg$NFT_MSG_GETSETELEM(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000001040)={0x4c, 0xd, 0xa, 0x801, 0x0, 0x0, {0xa, 0x0, 0x1}, [@NFTA_SET_ELEM_LIST_SET={0x9, 0x2, 'syz1\x00'}, @NFTA_SET_ELEM_LIST_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_SET_ELEM_LIST_ELEMENTS={0x20, 0x3, 0x0, 0x1, [{0x1c, 0x0, 0x0, 0x1, [@NFTA_SET_ELEM_KEY={0xc, 0x1, 0x0, 0x1, [@NFTA_DATA_VALUE={0x6, 0x1, "1e1c"}]}, @NFTA_SET_ELEM_KEY_END={0xc, 0xa, 0x0, 0x1, [@NFTA_DATA_VALUE={0x5, 0x1, 'W'}]}]}]}]}, 0x4c}, 0x1, 0x0, 0x0, 0x4000805}, 0x8000) 1.158562558s ago: executing program 2 (id=8558): bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f0000000380)=ANY=[@ANYBLOB="0300000004000000040000000a"], 0x50) openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000040)='cpuacct.usage_percpu_sys\x00', 0x0, 0x0) r0 = socket(0x10, 0x3, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket$inet_udp(0x2, 0x2, 0x0) sendmsg$nl_route(r1, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000180)=ANY=[@ANYBLOB="4000000010003b1500000000ffdbdf2500000000", @ANYRES32=0x0, @ANYBLOB="41040000015001001800128008000100677470000c00028008000100", @ANYRES32=r2, @ANYBLOB='\b\x00\n\x00', @ANYRES32], 0x40}}, 0x10) close(0x4) sendmsg$nl_generic(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000000c0)=ANY=[@ANYBLOB="1400000052f823c280000000000000001c000000"], 0x14}, 0x1, 0x0, 0x0, 0x800}, 0x0) syz_genetlink_get_family_id$gtp(&(0x7f00000000c0), 0xffffffffffffffff) ioctl$TUNGETDEVNETNS(0xffffffffffffffff, 0x54e3, 0x0) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) r4 = socket$rds(0x15, 0x5, 0x0) bind$rds(r4, &(0x7f0000000040)={0x2, 0x0, @loopback}, 0x10) sendmsg$rds(r4, &(0x7f0000001600)={&(0x7f0000000000)={0x2, 0x0, @local}, 0x10, 0x0, 0x0, &(0x7f0000000a40)=[@rdma_args={0x48, 0x114, 0x1, {{}, {0x0}, &(0x7f00000006c0)=[{&(0x7f0000000100)=""/17, 0x11}], 0x1, 0x1000000000000}}, @rdma_args={0x48, 0x114, 0x1, {{0x3, 0x9}, {&(0x7f0000000600)=""/139, 0x8b}, &(0x7f0000000a00)=[{&(0x7f0000000b00)=""/249, 0xf9}, {&(0x7f0000000900)=""/146, 0x92}, {&(0x7f00000009c0)}], 0x3, 0x1, 0x9}}], 0x90}, 0x40800) ioctl$TUNSETIFF(r3, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x2}) r5 = socket$unix(0x1, 0x5, 0x0) r6 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r6, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000440)=@newqdisc={0x58, 0x24, 0x4ee4e6a52ff56541, 0x0, 0xffffffff, {0x0, 0x0, 0x0, r7, {0x0, 0xb}, {0xffff, 0x1}, {0xb}}, [@qdisc_kind_options=@q_cbs={{}, {0x0, 0x2, @TCA_CBS_PARMS={0x0, 0x1, {0x0, '\x00', 0x8, 0x8, 0xb80, 0x1}}}}]}, 0x7d}, 0x1, 0x0, 0x0, 0x20008001}, 0x0) sendmsg$nl_route_sched(r6, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000240)=@newqdisc={0x3c, 0x24, 0x4ee4e6a52ff56541, 0x70bd2d, 0x80000, {0x0, 0x0, 0x0, r7, {0x7, 0xffff}, {0xffe6, 0xb}, {0xfff2, 0x3}}, [@qdisc_kind_options=@q_plug={{0x9}, {0xc, 0x2, {0x2, 0xa}}}]}, 0x3c}, 0x1, 0x0, 0x0, 0x840}, 0x4048080) r8 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x8400, 0x0) close(r8) socket$nl_generic(0x10, 0x3, 0x10) ioctl$SIOCSIFHWADDR(r8, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) r9 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r9, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) r11 = socket$packet(0x11, 0x2, 0x300) sendto$packet(r11, &(0x7f0000000280)="800000800000210ee7decd7a0003", 0xe, 0x40, &(0x7f00000001c0)={0x11, 0x8100, r10, 0x1, 0xd8}, 0x14) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(0xffffffffffffffff, 0x8933, &(0x7f00000002c0)) 1.089090556s ago: executing program 1 (id=8559): r0 = bpf$PROG_LOAD(0x5, &(0x7f0000000140)={0x10, 0x4, &(0x7f0000000040)=ANY=[@ANYBLOB="18000000000000000000000000000000611824000000000095"], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x9, '\x00', 0x0, @fallback=0x22, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) (async) r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000280)=@base={0xe, 0xff, 0x2, 0xfffffffa, 0x200, 0x1, 0x0, '\x00', 0x0, 0xffffffffffffffff, 0x4, 0x2, 0x3}, 0x50) ioctl$sock_ipv4_tunnel_SIOCCHGTUNNEL(0xffffffffffffffff, 0x89f3, &(0x7f00000006c0)={'tunl0\x00', &(0x7f0000000600)={'syztnl0\x00', 0x0, 0x20, 0x80, 0x7fffffff, 0xef, {{0x1e, 0x4, 0x3, 0x4, 0x78, 0x67, 0x0, 0x2, 0x29, 0x0, @broadcast, @multicast1, {[@noop, @rr={0x7, 0x7, 0x84, [@rand_addr=0x64010101]}, @noop, @ra={0x94, 0x4}, @timestamp_addr={0x44, 0x54, 0xe6, 0x1, 0x4, [{@empty, 0x7}, {@loopback, 0xd}, {@private=0xa010101, 0x26e000}, {@empty, 0x40}, {@dev={0xac, 0x14, 0x14, 0x2e}, 0x5}, {@local, 0x1}, {@dev={0xac, 0x14, 0x14, 0xf}, 0x2}, {@initdev={0xac, 0x1e, 0x1, 0x0}, 0x70000000}, {@dev={0xac, 0x14, 0x14, 0x21}}, {@broadcast, 0xfffffff2}]}, @end]}}}}}) (async) bpf$BPF_GET_PROG_INFO(0xf, &(0x7f0000001b40)={0xffffffffffffffff, 0xe0, &(0x7f0000001a40)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7, &(0x7f0000001880)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], ""/16, 0x0, 0x0, 0x0, 0x0, 0x5, 0x8, &(0x7f00000018c0)=[0x0, 0x0, 0x0, 0x0, 0x0], &(0x7f0000001900)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], 0x0, 0x9f, &(0x7f0000001940)=[{}, {}, {}, {}, {}], 0x28, 0x10, &(0x7f0000001980), &(0x7f00000019c0), 0x8, 0xcb, 0x8, 0x8, &(0x7f0000001a00)}}, 0x10) (async) r4 = bpf$BPF_MAP_GET_FD_BY_ID(0xe, &(0x7f0000001b80)={0x0, 0x56d, 0x10}, 0xc) r5 = bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=@base={0x12, 0x4, 0x4, 0x2}, 0x48) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000400)={0x1a, 0xf, &(0x7f0000000680)=@ringbuf={{0x18, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x2}, {{0x18, 0x1, 0x1, 0x0, r5}}, {}, [], {{}, {0x7, 0x0, 0xb, 0x2, 0x0, 0x0, 0x2}, {0x85, 0x0, 0x0, 0x84}}}, &(0x7f0000000180)='GPL\x00', 0x8, 0xff8, &(0x7f0000001e00)=""/4088, 0x0, 0x5a}, 0x94) (async) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000001c40)={{0x1, 0xffffffffffffffff}, &(0x7f0000001bc0), &(0x7f0000001c00)=r0}, 0x20) bpf$BPF_MAP_CONST_STR_FREEZE(0x16, &(0x7f0000001c80)={0x1, 0xffffffffffffffff}, 0x4) (async) r8 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000001cc0)=ANY=[@ANYBLOB="02000059e2fabd00080000000100000080000000", @ANYRES32=r0, @ANYBLOB="0100"/20, @ANYRES32=0x0, @ANYRES32, @ANYBLOB="00000000010000000300"/28], 0x50) (async) r9 = bpf$MAP_CREATE(0x0, &(0x7f0000001d40)=@bloom_filter={0x1e, 0x5cc2, 0x9, 0x5, 0x30300, 0x1, 0x9, '\x00', 0x0, 0xffffffffffffffff, 0x1, 0x2, 0x0, 0x3}, 0x50) bpf$PROG_LOAD(0x5, &(0x7f0000001e40)={0x1f, 0x10, &(0x7f0000000300)=@framed={{0x18, 0x0, 0x0, 0x0, 0x7ad, 0x0, 0x0, 0x0, 0x3}, [@generic={0x7, 0x9, 0x1, 0x2, 0x7fffffff}, @ringbuf_query={{0x18, 0x1, 0x1, 0x0, r1}}, @printk={@p, {}, {}, {}, {}, {0x7, 0x0, 0xb, 0x3, 0x0, 0x0, 0x9}}]}, &(0x7f0000000380)='syzkaller\x00', 0x2, 0xcf, &(0x7f00000003c0)=""/207, 0x41000, 0x2, '\x00', r2, @fallback=0x1a, 0xffffffffffffffff, 0x8, &(0x7f0000001800)={0x8, 0x4}, 0x8, 0x10, &(0x7f0000001840)={0x5, 0x6, 0x8, 0xfff}, 0x10, r3, r0, 0x2, &(0x7f0000001dc0)=[r4, r5, r6, r7, r8, r9], &(0x7f0000001e00)=[{0x0, 0x3, 0x7, 0x6}, {0x1, 0x4, 0xa, 0x2}]}, 0x94) (async) mmap(&(0x7f0000001000/0xc00000)=nil, 0xc00000, 0x2000004, 0x3b071, 0xffffffffffffffff, 0x0) (async) r10 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f00000007c0)=ANY=[@ANYBLOB="1b0000000000000000000000000004"], 0x50) bpf$PROG_LOAD(0x5, &(0x7f00000054c0)={0x2, 0x16, &(0x7f0000000180)=ANY=[@ANYBLOB="611230000000000061134c0000000000bf2000000000000016001000071b48013d030100000000000702000000b0ffb0bc26100000000000bf672000000000001602000000b0ffb06702000007000000360600000ee600f0bf050000000000000f650000000000006507f4ff02000000070700004c0040001f75000000000000bf54000000000000070500000300f9ffad430100000000009500000000000000050000000000000095000000000000004d9bd591d568253e9988431ec068e3a83683d58719d72183f2cb7f43dd55788be820b236dcb695dbfd737cbf5fe7030586"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0xfe}, 0x48) socket$igmp(0x2, 0x3, 0x2) (async) r11 = socket$igmp(0x2, 0x3, 0x2) (async) r12 = socket$inet_smc(0x2b, 0x1, 0x0) getsockopt$inet_tcp_int(r12, 0x6, 0x2e, 0x0, &(0x7f0000000040)) setsockopt$MRT_FLUSH(r11, 0x0, 0xd1, &(0x7f0000000000)=0x8, 0x4) setsockopt$MRT_INIT(r11, 0x0, 0xc8, &(0x7f00000000c0), 0x4) (async) setsockopt$MRT_DONE(r11, 0x0, 0xc9, 0x0, 0x0) (async) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000700)={0x11, 0x18, &(0x7f0000000540)=ANY=[@ANYBLOB="180000008f080000000000000010000018110000", @ANYRES32=r10, @ANYBLOB="0000000000000000b702000014000000b7030000fcff00008500000086000000bf0900000000000055090100000000809500000000000000180100002020752500000000002020207b1af8ff00000000bfa100000000000007010000f8feffffb702000008000000b70300007b0d0000850000007f0000004500f4fffcffffffbf91000000000000b702000001000000850000008500008d480000000000000095"], &(0x7f0000000080)='GPL\x00', 0xf, 0xffe, &(0x7f0000000800)=""/4094, 0x41000, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x7ff}, 0x94) 1.088080196s ago: executing program 3 (id=8560): r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmmsg$inet(0xffffffffffffffff, &(0x7f0000000a00)=[{{0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000000)="a905a6f2", 0x4}], 0x1}}], 0x1, 0xc044) r1 = socket(0x2, 0x2, 0x1) bind$unix(r1, &(0x7f0000000000)=@abs, 0x6e) connect$unix(r1, &(0x7f0000000100)=@abs={0x0, 0x0, 0x4e24}, 0x6e) r2 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000040), r0) sendmsg$ETHTOOL_MSG_LINKINFO_SET(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000000)=ANY=[@ANYBLOB='D\x00\x00\x00', @ANYRES16=r2, @ANYBLOB="010025bd7000fcdbdf2503000000180001801400020073797a5f74756e00000000000000000005000200000000000500050000000000050003"], 0x44}, 0x1, 0x0, 0x0, 0x20009085}, 0x40040c0) r3 = socket$alg(0x26, 0x5, 0x0) bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0xe, 0x4, 0x0, 0x0, 0x4, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @sk_skb}, 0x94) r4 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r4, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000740)=@updpolicy={0xb8, 0x19, 0x1, 0x0, 0x10000, {{@in=@multicast2, @in=@empty, 0x0, 0x0, 0x0, 0x0, 0xa, 0x20}, {0x20008, 0x10, 0x100000002, 0x0, 0xfff, 0xffffffffffffb473, 0xffffffffffffffff, 0x4}, {0x1000000003, 0x2000000000000000, 0x2, 0xffffffffffffffff}, 0xfffffffe, 0x0, 0x0, 0x0, 0x0, 0x3}}, 0xb8}}, 0x4004) r5 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r5, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f00000004c0)=@updpolicy={0xb8, 0x19, 0x1, 0x0, 0x0, {{@in=@multicast1=0xe0000002, @in, 0x0, 0x0, 0x0, 0x0, 0xa, 0x0, 0x0, 0x87}, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffb}, {0x0, 0x0, 0x200000000000000}}}, 0xb8}}, 0x2c000010) r6 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r6, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f00000004c0)=@updpolicy={0xb8, 0x19, 0x1, 0x0, 0x0, {{@in=@multicast1=0xe0000002, @in, 0x0, 0x0, 0x0, 0x0, 0xa, 0x0, 0x0, 0x87}, {0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x5, 0xfffffffffffffffb}, {0x0, 0x40000000000000, 0x200000000000000}, 0x2}}, 0xb8}, 0x1, 0x0, 0x0, 0x4000015}, 0x2c000010) bind$alg(r3, &(0x7f00000004c0)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc(twofish)\x00'}, 0x5b) setsockopt$ALG_SET_KEY(r3, 0x117, 0x1, &(0x7f0000000280)="ad56b6c5820fae9d6dcd3292ea54c7beef915d564c90c200", 0x18) r7 = accept4(r3, 0x0, 0x0, 0x800) sendmmsg$alg(r7, &(0x7f00000007c0)=[{0x0, 0x0, 0x0}], 0x1, 0x40800) recvmsg(r7, &(0x7f00000005c0)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f00000000c0)=""/81, 0x51}], 0x1}, 0x0) socket$netlink(0x10, 0x3, 0xb) setsockopt$EBT_SO_SET_ENTRIES(r7, 0x0, 0x80, &(0x7f0000000a00)=@nat={'nat\x00', 0x19, 0x4, 0x720, [0x2000000002c0, 0x0, 0x0, 0x200000000744, 0x200000000774], 0x0, &(0x7f0000000080), &(0x7f00000002c0)=[{0x0, '\x00', 0x0, 0x0, 0x2, [{0x3, 0x62, 0x200, 'syz_tun\x00', 'batadv0\x00', 'ip6tnl0\x00', 'macvtap0\x00', @remote, [0x0, 0x0, 0x0, 0xff, 0xff], @empty, [0x0, 0xff, 0xff, 0xff], 0xe6, 0xe6, 0x116, [@vlan={{'vlan\x00', 0x0, 0x8}, {{0x0, 0x6, 0x18, 0x7, 0x4}}}, @ip={{'ip\x00', 0x0, 0x20}, {{@local, @multicast1, 0xffffffff, 0x0, 0x10, 0x33, 0x4, 0x8, 0x4e24, 0x4e24, 0x4e20, 0x4e24}}}], [], @common=@CLASSIFY={'CLASSIFY\x00', 0x8, {{0x6}}}}, {0x9, 0x1, 0x8035, 'netpci0\x00', 'bridge_slave_0\x00', 'pim6reg\x00', 'bridge_slave_1\x00', @random="0752d00a1a63", [0x0, 0xff, 0xff, 0xff, 0xff], @remote, [0xff, 0xff, 0xff, 0xff, 0xff, 0xff], 0x2a6, 0x30e, 0x33e, [@bpf0={{'bpf\x00', 0x0, 0x210}, {{0x19, [{0x5, 0x6, 0x8, 0x9bf}, {0x1, 0x35, 0xc, 0xa151}, {0x16, 0x0, 0x45, 0xffffff00}, {0xea89, 0x1, 0x5, 0x5}, {0x5, 0x3, 0x6, 0xc}, {0xe, 0x1, 0x1, 0x78}, {0x5, 0x1, 0x80, 0x2}, {0x9, 0x81, 0x5, 0x7}, {0x5, 0x4, 0x98, 0xd}, {0xfbff, 0x4, 0x7, 0x7}, {0x3ff, 0x6d, 0xd5, 0x4}, {0x7, 0x3, 0x8, 0x5e3b9b96}, {0x9, 0xfd, 0x6, 0x4}, {0x200, 0x6, 0x3, 0x1}, {0xfffc, 0x81, 0x7, 0x7f}, {0xf, 0x1, 0xb2, 0x9}, {0x3ff, 0x4, 0x8, 0x180}, {0x4, 0x1, 0x26, 0xf7}, {0x6, 0x5, 0x5, 0x81}, {0xff, 0x6, 0x4, 0x6}, {0xaf, 0x9, 0x80, 0x1}, {0x7ff, 0x5, 0x4f, 0xc63}, {0x5, 0x24, 0xe, 0x79fb}, {0x987, 0x3, 0xc6, 0x4f10}, {0x4, 0x3, 0x4, 0x7fffffff}, {0x8, 0xab, 0x1}, {0x2, 0x7, 0x6, 0x5}, {0x4, 0x6, 0x5, 0x8}, {0x9, 0x6, 0x80, 0x7}, {0x26c8, 0x80, 0x2, 0x1}, {0xb, 0xf1, 0xff, 0x4}, {0x1, 0xf5, 0x4, 0xfffffff4}, {0x1, 0x0, 0xa, 0x9}, {0x8, 0x2, 0x5, 0xa}, {0xd4, 0x29, 0xf8, 0x5}, {0x92, 0x8, 0x5, 0x4df}, {0x1, 0x80, 0x7, 0x3ff}, {0xfeff, 0x0, 0x1}, {0xb89, 0xcf, 0x4, 0x6f0}, {0x9, 0x93, 0x7, 0x2}, {0x20, 0x2}, {0x7, 0x9, 0x0, 0xfffffffb}, {0xb08, 0x1, 0x28, 0xb}, {0x8000, 0xfd, 0x4, 0x7}, {0xb, 0x4, 0xf8, 0xca}, {0x8, 0x1, 0x17, 0x3}, {0xb, 0x1, 0x9, 0x4c}, {0xfff7, 0x1, 0x0, 0xdc}, {0x4, 0x5, 0x8, 0x4}, {0x3ff, 0x7, 0xfe, 0x2}, {0x2, 0x1, 0x2, 0xb}, {0x1, 0x80, 0x10, 0x79}, {0x81, 0x5, 0x10, 0x2}, {0x63e, 0x40, 0x8, 0x8}, {0x1ff, 0x20, 0xf, 0x3}, {0xff7b, 0xa, 0x4, 0x1b}, {0x8, 0x63, 0x6, 0x3}, {0x1, 0x6, 0x6, 0x5}, {0xffff, 0x8a, 0x10, 0x81}, {0x9, 0x4, 0x4, 0x79}, {0x101, 0x0, 0x4, 0x10001}, {0x1, 0x6, 0x3, 0x1}, {0xff9c, 0x6, 0x9, 0x5a6}, {0xa, 0x80, 0x6, 0x3b}], {0xff}}}}], [@common=@AUDIT={'AUDIT\x00', 0x8}, @snat={'snat\x00', 0x10, {{@multicast, 0xfffffffffffffffe}}}], @common=@NFQUEUE0={'NFQUEUE\x00', 0x8, {{0x6}}}}]}, {0x0, '\x00', 0x2, 0xfffffffffffffffe}, {0x0, '\x00', 0x2, 0xffffffffffffffff, 0x2, [{0x3, 0x1b, 0x7ebb, 'syz_tun\x00', 'bond_slave_0\x00', 'bridge_slave_1\x00', 'pim6reg1\x00', @dev={'\xaa\xaa\xaa\xaa\xaa', 0x13}, [0x0, 0x0, 0xff, 0xff, 0xff, 0xff], @remote, [0x0, 0xff, 0xff, 0x0, 0xff], 0xee, 0x11e, 0x156, [@ip={{'ip\x00', 0x0, 0x20}, {{@private=0xa010102, @multicast2, 0xff000000, 0xff, 0x2, 0x29, 0x6, 0x28, 0x4e23, 0x4e20, 0x4e20, 0x4e22}}}, @mac={{'mac\x00', 0x0, 0x10}, {{@broadcast}}}], [@common=@NFQUEUE0={'NFQUEUE\x00', 0x8, {{0x2}}}], @arpreply={'arpreply\x00', 0x10, {{@empty, 0xfffffffffffffffd}}}}, {0x11, 0x20, 0x1c, 'gretap0\x00', 'ipvlan0\x00', 'veth1_to_batadv\x00', 'veth1_to_bridge\x00', @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0xe}, [0x0, 0xff, 0x0, 0x0, 0xff], @broadcast, [0x0, 0x0, 0xff, 0x0, 0xff], 0x6e, 0x9e, 0xe6, [], [@common=@CONNSECMARK={'CONNSECMARK\x00', 0x8, {{0x1}}}], @common=@ERROR={'ERROR\x00', 0x20, {"3d1c98baa1bae1ca15f7d7bb6271965dd0b44cd858a5246b4d327ed31fa6"}}}]}]}, 0x798) 955.110998ms ago: executing program 5 (id=8561): socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) sendmsg$IPCTNL_MSG_CT_GET(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000280)=ANY=[@ANYRESOCT=r0, @ANYRES32=r1], 0x154}, 0x1, 0x0, 0x0, 0x8005}, 0x4008044) r2 = socket$l2tp(0x2, 0x2, 0x73) r3 = socket$nl_route(0x10, 0x3, 0x0) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r2, 0x8933, &(0x7f00000001c0)={'batadv_slave_1\x00', 0x0}) sendmsg$nl_route(r3, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000100)=ANY=[@ANYBLOB="3c000000180001002cbd7000000000000a100000fc02ff000000000008000400", @ANYRES32=r4, @ANYBLOB="0600150008000000100016800c"], 0x3c}}, 0x0) ioctl$int_in(r1, 0x5452, &(0x7f0000000000)=0x7) connect$unix(r0, &(0x7f0000000140)=@abs={0x0, 0x0, 0x4e20}, 0x6e) ppoll(&(0x7f0000000300)=[{r1, 0x3e4ffc878e6089fd}], 0x1, 0x0, 0x0, 0x0) sendmsg$nl_xfrm(0xffffffffffffffff, 0x0, 0x20000800) r5 = socket$inet6(0x10, 0x3, 0x0) r6 = socket(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r6, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000001680)={&(0x7f0000000000)=@newtaction={0x6c, 0x30, 0x53b, 0x0, 0x0, {}, [{0x58, 0x1, [@m_simple={0x54, 0x1, 0x0, 0x0, {{0xb}, {0x28, 0x2, 0x0, 0x1, [@TCA_DEF_DATA={0xb, 0x3, 'simple\x00'}, @TCA_DEF_PARMS={0x18, 0x2, {0x9f}}]}, {0x4}, {0xc, 0x7, {0x0, 0x1}}, {0xc, 0x8, {0x0, 0x1}}}}]}]}, 0x6c}, 0x1, 0x0, 0x0, 0x4060040}, 0x0) sendto$inet6(r5, &(0x7f0000000380)="f261a7136f89cc12f2fc6fc6a759522dfb6649bcd4ded01d5147840ac522dca61d6bd4c5f670fda237bdad451239ba88130b19c4038061abdfef075f335bf61e0bd0f7f0527d22995cd0726f23c70b98e2b385bc817c571ff9187203e47bf92dd09d406624bf3072df423d17ed3e4a147906f1c5af33ac7e6fefde1a4923d26acfa92df62911f17515705f38b68bab4cb593f6ba5c9036ab5925b7b9f22c6622f590b24d595f9626492e1228f55857d05cf9ffffff", 0xd7, 0x40e5, 0x0, 0x0) r7 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x303000, 0x0) ioctl$TUNSETIFF(r7, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) socket(0x29, 0x3, 0x0) socket$unix(0x1, 0x5, 0x0) r8 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r8, &(0x7f00000001c0)={0x1f, 0x3, 0x6}, 0x6) r9 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl80211(0x0, r9) r10 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r10, &(0x7f00000001c0)={0x2, 0x1, @local}, 0x10) connect$inet(r10, &(0x7f0000000480)={0x2, 0x4e22, @multicast1}, 0x10) sendmmsg(r10, &(0x7f0000007fc0), 0x800001d, 0x0) socket$nl_route(0x10, 0x3, 0x0) socket$nl_crypto(0x10, 0x3, 0x15) 874.421203ms ago: executing program 4 (id=8562): socket$netlink(0x10, 0x3, 0x10) sendmsg$inet(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001d80)=ANY=[@ANYBLOB="28010000000000000100000001"], 0x128}, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000001480)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$inet(r1, &(0x7f0000001b00)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001d80)=ANY=[], 0x128}, 0x0) recvmsg$unix(r0, &(0x7f0000000040)={0x0, 0x0, 0x0, 0x0, &(0x7f00000014c0)=[@rights={{0x10}}, @cred={{0x1c}}, @rights={{0x10}}, @rights={{0x10}}], 0x50}, 0x40000002) r2 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="02000000040000000800000001"], 0x50) bpf$MAP_CREATE(0x0, &(0x7f0000000200)=@base={0x12, 0x4, 0x4, 0x11}, 0x50) bpf$MAP_CREATE(0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="220000000400000010"], 0x48) pipe(&(0x7f0000000080)={0xffffffffffffffff}) r4 = bpf$MAP_CREATE(0x0, &(0x7f0000000200)=ANY=[], 0x48) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f00000002c0)={{r4}, &(0x7f0000000140), &(0x7f0000000280)=r3}, 0x20) socket$tipc(0x1e, 0x2, 0x0) bpf$BPF_MAP_CONST_STR_FREEZE(0x16, &(0x7f00000000c0)={r4}, 0x4) bpf$PROG_LOAD(0x5, &(0x7f0000000340)={0x7, 0x1c, &(0x7f0000000400)=ANY=[@ANYBLOB="18080000cbb60000000000000000000018110000", @ANYRES32=r4, @ANYBLOB="0000000000000001b702000014000000b7030000000000008500000008000000bf092000000000003509010000000a009500000000000000b7080000000000007b8af8ff00000000b7080000020000007b8af0ff00000000bfa100000000000007010000f8ffffffbfa400000000000007040000f0ffffffb70200000800000018230000", @ANYRES32=r2, @ANYBLOB="0000000001000000b7050000080000001c00000000000000bf980000000000000d08000000000000850000001b000000b70000000200000095"], &(0x7f0000000000)='GPL\x00', 0x5, 0x0, 0x0, 0x40f00, 0x8, '\x00', 0x0, @fallback=0xc, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000000}, 0x94) 861.710258ms ago: executing program 3 (id=8563): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) r2 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000040), 0xffffffffffffffff) r3 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r3, 0x8933, &(0x7f00000003c0)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_CHANNEL_SWITCH(r3, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000400)={0x30, r2, 0x1, 0x0, 0x0, {{}, {@val={0x8, 0x3, r4}, @void}}, [@chandef_params=[@NL80211_ATTR_WIPHY_FREQ={0x8, 0x26, @random=0x994}], @NL80211_ATTR_CH_SWITCH_BLOCK_TX={0x4}, @NL80211_ATTR_CH_SWITCH_COUNT={0x8, 0xb7, 0xc5}]}, 0x30}}, 0x0) r5 = socket$nl_generic(0x10, 0x3, 0x10) r6 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000500), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r5, 0x8933, &(0x7f00000002c0)={'wlan0\x00', 0x0}) r8 = socket$nl_generic(0x10, 0x3, 0x10) r9 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000280), 0xffffffffffffffff) sendmsg$NL80211_CMD_FRAME(r8, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000640)={&(0x7f0000000340)={0x5c, r9, 0x1, 0x70bd2a, 0x25dfdbfe, {{}, {@val={0x8}, @void}}, [@NL80211_ATTR_FRAME={0x3f, 0x33, @beacon={{{}, {0xde1}, @broadcast}, 0x0, @default, 0x4001, @void, @void, @void, @void, @void, @val={0x5, 0x4, {0x9, 0x7e, 0x7, "90"}}, @void, @val={0x2a, 0x1, {0x1, 0x1, 0x1}}, @val={0x3c, 0x4, {0x1, 0x2, 0xb0, 0x5}}, @void, @val={0x72, 0x6}, @void, @void}}]}, 0x5c}, 0x1, 0x0, 0x0, 0x880}, 0x0) sendmsg$NL80211_CMD_FRAME(r5, &(0x7f0000000c00)={0x0, 0x0, &(0x7f0000000640)={&(0x7f0000000340)={0x4c, r6, 0x1, 0x0, 0x0, {{}, {@val={0x8, 0x3, r7}, @void}}, [@NL80211_ATTR_FRAME={0x30, 0x33, @action={{{}, {}, @device_b}, @sp_mp_confirm={0xf, 0x2, {0x202, @default, {0x1, 0x4, [{0x4, 0x1}, {0x1, 0x1}, {0x16, 0x1}, {0x18}]}, @val={0x72, 0x6}, @void}}}}]}, 0x4c}}, 0x0) r10 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$inet_int(r10, 0x0, 0x17, &(0x7f0000000440)=0xcd, 0x4) setsockopt$inet_int(r10, 0x0, 0x17, &(0x7f0000000040)=0xc8, 0x4) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f00000000c0)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_SET_INTERFACE(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000180)={0x24, r1, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r11}, @void}}, [@NL80211_ATTR_IFTYPE={0x8, 0x5, 0x9}]}, 0x24}, 0x1, 0x0, 0x0, 0x20004000}, 0x0) 660.959758ms ago: executing program 4 (id=8564): r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000400)=ANY=[@ANYBLOB="180000002500010324bd5f02ffdbdf25010000000400ae"], 0x18}, 0x1, 0x0, 0x0, 0x4008}, 0x0) ioctl$NILFS_IOCTL_GET_CPINFO(r0, 0x80186e82, &(0x7f0000000580)={&(0x7f0000000440)=[{0x2, 0x0, 0xa1f, 0x56, 0x7, 0x7, 0x800, 0x2}, {0x0, 0x0, 0x77, 0x1e, 0xe4b, 0x404, 0x0, 0x8000000000000001}, {0x3, 0x0, 0x8, 0x542, 0x0, 0x8000000000000000, 0x5f2, 0x5}, {0x2, 0x0, 0x0, 0x9550, 0x155c, 0xfffffffffffffff3, 0x9}, {0x3, 0x0, 0x6, 0x3, 0x760e, 0x4, 0x7, 0x8}], 0x5, 0x38, 0x1, 0x6}) recvmsg(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000200)=[{&(0x7f0000001640)=""/4101, 0x1005}, {&(0x7f0000000300)=""/91, 0x5b}], 0x2}, 0x2000) syz_genetlink_get_family_id$ethtool(&(0x7f0000000000), r0) syz_genetlink_get_family_id$nl80211(&(0x7f0000000380), r0) socket$nl_generic(0x10, 0x3, 0x10) (async) sendmsg$nl_generic(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000400)=ANY=[@ANYBLOB="180000002500010324bd5f02ffdbdf25010000000400ae"], 0x18}, 0x1, 0x0, 0x0, 0x4008}, 0x0) (async) ioctl$NILFS_IOCTL_GET_CPINFO(r0, 0x80186e82, &(0x7f0000000580)={&(0x7f0000000440)=[{0x2, 0x0, 0xa1f, 0x56, 0x7, 0x7, 0x800, 0x2}, {0x0, 0x0, 0x77, 0x1e, 0xe4b, 0x404, 0x0, 0x8000000000000001}, {0x3, 0x0, 0x8, 0x542, 0x0, 0x8000000000000000, 0x5f2, 0x5}, {0x2, 0x0, 0x0, 0x9550, 0x155c, 0xfffffffffffffff3, 0x9}, {0x3, 0x0, 0x6, 0x3, 0x760e, 0x4, 0x7, 0x8}], 0x5, 0x38, 0x1, 0x6}) (async) recvmsg(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000200)=[{&(0x7f0000001640)=""/4101, 0x1005}, {&(0x7f0000000300)=""/91, 0x5b}], 0x2}, 0x2000) (async) syz_genetlink_get_family_id$ethtool(&(0x7f0000000000), r0) (async) syz_genetlink_get_family_id$nl80211(&(0x7f0000000380), r0) (async) 528.19925ms ago: executing program 2 (id=8565): socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="0f000000040000000400000012"], 0x48) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000740)={{r1}, &(0x7f00000006c0), &(0x7f0000000700)=r0}, 0x20) recvmsg$unix(r0, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000002380)=[{&(0x7f0000002480)=""/195, 0xc3}], 0x1}, 0x2000) 527.092803ms ago: executing program 3 (id=8566): r0 = epoll_create1(0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@file={0x1, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) r3 = syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0) connect$802154_dgram(r3, &(0x7f0000000200)={0x2, @long}, 0x8) epoll_pwait(r0, &(0x7f0000000140)=[{}], 0x1, 0x2d516fb6, 0x0, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) epoll_ctl$EPOLL_CTL_ADD(r0, 0x1, r0, &(0x7f0000000100)={0x20000014}) r4 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000280)={0x3, 0x5, &(0x7f00000006c0)=ANY=[], &(0x7f0000000680)='GPL\x00'}, 0x94) bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000d00)=ANY=[@ANYBLOB="02000000040000000800000001"], 0x50) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000800)=@bpf_ext={0x1c, 0x14, &(0x7f0000000580)=@ringbuf={{0x18, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x1}, {}, {}, [@jmp={0x5, 0x1, 0x0, 0x0, 0x0, 0xffffffffffffffe0, 0xfffffffffffffff0}, @exit, @map_idx_val={0x18, 0x8, 0x6, 0x0, 0x1, 0x0, 0x0, 0x0, 0xf}, @func={0x85, 0x0, 0x1, 0x0, 0xfffffffffffffffb}], {{}, {0x7, 0x0, 0xb, 0x2, 0x0, 0x0, 0x1}, {0x85, 0x0, 0x0, 0x84}}}, &(0x7f0000000640)='syzkaller\x00', 0x6, 0xe4, &(0x7f00000006c0)=""/228, 0x41100, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x2103f, 0xffffffffffffffff, 0x2, 0x0, &(0x7f00000007c0)=[{0x2, 0x4, 0x8, 0xa}, {0x4, 0x5, 0xe, 0xa}], 0x10, 0xfc4}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f00000003c0)={r4, 0x0, 0xb, 0x0, &(0x7f0000000180)="5becbc0e0d7cca6073a4f1", 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) epoll_wait(r0, &(0x7f0000000040)=[{}], 0x1, 0x400) socket$nl_sock_diag(0x10, 0x3, 0x4) r5 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) setsockopt$SO_ATTACH_FILTER(r5, 0x1, 0x1a, &(0x7f0000000080)={0x1, &(0x7f0000000040)=[{0x6, 0x0, 0x1}]}, 0x10) bind$bt_hci(r5, &(0x7f0000000140)={0x1f, 0xffff, 0x2}, 0x6) r6 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$HCIINQUIRY(r6, 0x400448ca, 0x0) r7 = socket$inet6_tcp(0xa, 0x1, 0x0) listen(r7, 0x0) socket$kcm(0x29, 0x0, 0x0) r8 = bpf$MAP_CREATE(0x0, &(0x7f0000000240)=ANY=[@ANYRES8=r5], 0x48) bpf$BPF_PROG_DETACH(0x8, &(0x7f0000000ac0)=ANY=[@ANYRES32=r8, @ANYRES32=r6, @ANYBLOB='&'], 0x10) bpf$MAP_UPDATE_ELEM(0x2, 0x0, 0x0) r9 = socket$inet_icmp(0x2, 0x2, 0x1) setsockopt$inet_mreqsrc(r9, 0x0, 0x27, 0x0, 0x0) unshare(0x2c020400) pselect6(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) 468.841179ms ago: executing program 4 (id=8567): mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x6, 0x31, 0xffffffffffffffff, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000340)=@newnexthop={0x30, 0x68, 0x1, 0x3, 0x80000000, {}, [@NHA_GROUP={0x4}, @NHA_GATEWAY={0x14, 0x6, @in6_addr=@dev={0xfe, 0x80, '\x00', 0x17}}]}, 0x30}}, 0x40000) r0 = socket(0x11, 0x3, 0x0) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000480)={0x6, 0x3, 0x0, &(0x7f00000002c0)='syzkaller\x00', 0x7}, 0x94) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000005c0)={'ip6gretap0\x00', 0x0}) bind$packet(r0, &(0x7f0000000180)={0x11, 0x0, r1, 0x1, 0x0, 0x6, @remote}, 0x14) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x48241, 0x0) r3 = epoll_create(0x8) epoll_ctl$EPOLL_CTL_ADD(r3, 0x1, r2, &(0x7f0000000100)={0x30000010}) close(r3) bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0xc, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x17, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x10, 0x2}, 0x94) setsockopt$packet_int(r0, 0x107, 0xf, &(0x7f0000000000)=0xe9, 0x4) sendmsg$netlink(r0, &(0x7f0000002ac0)={0x0, 0x0, &(0x7f0000000440)=[{&(0x7f0000000280)=ANY=[@ANYBLOB="3b844100d5432f"], 0xdd12}], 0x1}, 0x20040890) r4 = socket$igmp6(0xa, 0x3, 0x2) getsockopt$CAN_RAW_RECV_OWN_MSGS(r0, 0x65, 0x4, &(0x7f0000000080), &(0x7f00000000c0)=0x4) setsockopt$MRT6_DEL_MIF(r4, 0x29, 0xcb, &(0x7f0000000040)={0x1, 0x1, 0x53, 0x0, 0x80000000}, 0xc) bpf$PROG_LOAD(0x5, &(0x7f0000000740)={0x1, 0x4, &(0x7f0000000580)=ANY=[@ANYBLOB="1805000000e330000000f353ec9b351b2d72f3e97cdd755f7f"], &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x15, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8000}, 0x94) r5 = bpf$MAP_CREATE(0x0, &(0x7f0000000380)=@base={0x5, 0x3, 0x877, 0x3, 0x1000, 0xffffffffffffffff, 0x3, '\x00', r1, 0xffffffffffffffff, 0x0, 0x1, 0x2}, 0x50) r6 = socket$inet6_udp(0xa, 0x2, 0x0) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000700)={r5, &(0x7f0000000600)="c9938abf142dad7770e21ac8e43c3630e232c72c8a3238983d57764bf7199f1c5da35d4ae9299c4f050385b182bf78445aedaba76075f547e08ce887c9c0601c1f307e0dfe820f86a5c87015bcf1e8767ee84abde5714d06b3bd456aa489aef8ba96e8f10ac28e5952d74e414f6c1be494a839480101101b85f24020cb9e203bb97fce36b85205674115db3a8c8dd6eab0f881b8625a", &(0x7f00000006c0)=@udp6=r6, 0x4}, 0x20) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x6, 0x31, 0xffffffffffffffff, 0x0) (async) sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000340)=@newnexthop={0x30, 0x68, 0x1, 0x3, 0x80000000, {}, [@NHA_GROUP={0x4}, @NHA_GATEWAY={0x14, 0x6, @in6_addr=@dev={0xfe, 0x80, '\x00', 0x17}}]}, 0x30}}, 0x40000) (async) socket(0x11, 0x3, 0x0) (async) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000480)={0x6, 0x3, 0x0, &(0x7f00000002c0)='syzkaller\x00', 0x7}, 0x94) (async) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000005c0)={'ip6gretap0\x00'}) (async) bind$packet(r0, &(0x7f0000000180)={0x11, 0x0, r1, 0x1, 0x0, 0x6, @remote}, 0x14) (async) openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x48241, 0x0) (async) epoll_create(0x8) (async) epoll_ctl$EPOLL_CTL_ADD(r3, 0x1, r2, &(0x7f0000000100)={0x30000010}) (async) close(r3) (async) bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0xc, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x17, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x10, 0x2}, 0x94) (async) setsockopt$packet_int(r0, 0x107, 0xf, &(0x7f0000000000)=0xe9, 0x4) (async) sendmsg$netlink(r0, &(0x7f0000002ac0)={0x0, 0x0, &(0x7f0000000440)=[{&(0x7f0000000280)=ANY=[@ANYBLOB="3b844100d5432f"], 0xdd12}], 0x1}, 0x20040890) (async) socket$igmp6(0xa, 0x3, 0x2) (async) getsockopt$CAN_RAW_RECV_OWN_MSGS(r0, 0x65, 0x4, &(0x7f0000000080), &(0x7f00000000c0)=0x4) (async) setsockopt$MRT6_DEL_MIF(r4, 0x29, 0xcb, &(0x7f0000000040)={0x1, 0x1, 0x53, 0x0, 0x80000000}, 0xc) (async) bpf$PROG_LOAD(0x5, &(0x7f0000000740)={0x1, 0x4, &(0x7f0000000580)=ANY=[@ANYBLOB="1805000000e330000000f353ec9b351b2d72f3e97cdd755f7f"], &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x15, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8000}, 0x94) (async) bpf$MAP_CREATE(0x0, &(0x7f0000000380)=@base={0x5, 0x3, 0x877, 0x3, 0x1000, 0xffffffffffffffff, 0x3, '\x00', r1, 0xffffffffffffffff, 0x0, 0x1, 0x2}, 0x50) (async) socket$inet6_udp(0xa, 0x2, 0x0) (async) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000700)={r5, &(0x7f0000000600)="c9938abf142dad7770e21ac8e43c3630e232c72c8a3238983d57764bf7199f1c5da35d4ae9299c4f050385b182bf78445aedaba76075f547e08ce887c9c0601c1f307e0dfe820f86a5c87015bcf1e8767ee84abde5714d06b3bd456aa489aef8ba96e8f10ac28e5952d74e414f6c1be494a839480101101b85f24020cb9e203bb97fce36b85205674115db3a8c8dd6eab0f881b8625a", &(0x7f00000006c0)=@udp6=r6, 0x4}, 0x20) (async) 352.126213ms ago: executing program 4 (id=8568): r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000240), 0xffffffffffffffff) sendmsg$ETHTOOL_MSG_LINKMODES_SET(r1, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000640)={0x34, r2, 0x1, 0x0, 0x0, {}, [@ETHTOOL_A_LINKMODES_HEADER={0x18, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'syz_tun\x00'}]}, @ETHTOOL_A_LINKMODES_AUTONEG={0x5, 0x2, 0xfc}]}, 0x34}, 0x1, 0x0, 0x0, 0x44851}, 0x0) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000500)={&(0x7f00000000c0)=@newlink={0xe4, 0x10, 0x439, 0x70bd40, 0x25dfdbfe, {0x0, 0x0, 0x0, 0x0, 0x9801}, [@IFLA_LINKINFO={0x18, 0x12, 0x0, 0x1, @wireguard={{0xe}, {0x4}}}, @IFLA_PROP_LIST={0xa4, 0x34, 0x0, 0x1, [{0x14, 0x35, 'netpci0\x00'}, {0x14, 0x35, 'macvtap0\x00'}, {0x14, 0x35, 'macsec0\x00'}, {0x14, 0x35, 'bridge_slave_1\x00'}, {0x14, 0x35, 'syzkaller0\x00'}, {0x14, 0x35, 'veth0_virt_wifi\x00'}, {0x14, 0x35, 'geneve1\x00'}, {0x14, 0x35, 'wg1\x00'}]}, @IFLA_GROUP={0x8, 0x1b, 0xc}]}, 0xe4}, 0x1, 0x0, 0x0, 0x24000007}, 0x0) 264.79815ms ago: executing program 1 (id=8569): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000180), 0x100, 0x0) ioctl$SIOCSIFHWADDR(r0, 0x8924, &(0x7f00000001c0)={'bond0\x00', @random="36bc46f7d299"}) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r1, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000100)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x0) sendmsg$NFT_BATCH(r1, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000380)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a44000000090a010400000000000000000a0000040900010073797a310000000008000540000000020900020073797a310000000008000a40fffffffc0800034000000014480000000c0a010100004365000000000a0000060900020073797a31000000000900010073797a31000000001c0003801800008008000340000000020c000440000000000000000b14000000110001"], 0xb4}, 0x1, 0x0, 0x0, 0x4000850}, 0x40) sendmsg$NFT_MSG_GETSETELEM(r1, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000200)=ANY=[@ANYBLOB="2c0000000d0a01e6ffffffffffffff000a0000010900020073797a31000000000800010073797a31"], 0x2c}, 0x1, 0x0, 0x0, 0x24040885}, 0x8000) 208.972429ms ago: executing program 4 (id=8570): r0 = socket$alg(0x26, 0x5, 0x0) r1 = socket$kcm(0xa, 0x2, 0x0) r2 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000440)={0x18, 0x12, &(0x7f0000000340)=ANY=[@ANYRESOCT=r0, @ANYRES32=r1, @ANYRES8=r0, @ANYRESOCT=0x0, @ANYBLOB="3d4b7f8c18a87b12b7a741251ea7e77050cad5f9f9a9a2fcb19aa27c7e3cc40ebb502346d1a3fc26dff9b7084f08e7e2564bbd24648ec9e609192605d017abdc47c17b05512b56989d4f010a458cc339a64fb1137cac85d88f441790b8", @ANYRESOCT=r0, @ANYRES8=r1], &(0x7f0000000000)='GPL\x00', 0x2, 0xe3, &(0x7f0000001980)=""/227, 0x0, 0xc, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0xffffffff}, 0x94) r3 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r3, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000500)=ANY=[@ANYBLOB="340000003e0007010300000000000000027c00000400428011000100686d"], 0x34}, 0x1, 0x0, 0x0, 0x4048011}, 0xc000) r4 = socket(0x2, 0x80805, 0x0) r5 = socket$inet_sctp(0x2, 0x5, 0x84) setsockopt$IP_VS_SO_SET_ADD(r5, 0x0, 0x482, &(0x7f0000000140)={0x84, @rand_addr=0x64010105, 0x4e22, 0x3, 'lblc\x00', 0x1, 0x80005, 0x6f}, 0x2c) setsockopt$IP_VS_SO_SET_ADDDEST(r4, 0x0, 0x487, &(0x7f0000000000)={{0x84, @rand_addr=0x64010100, 0x4e21, 0x2, 'ovf\x00', 0x0, 0x8, 0x77}, {@multicast2, 0x4e24, 0x2, 0xcd, 0x4, 0x6}}, 0x44) sendmsg$nl_generic(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000440)=ANY=[@ANYBLOB="1c0000001600010000000000000000000a0000000800ce8004000173"], 0x1c}}, 0x0) sendmsg$sock(r1, &(0x7f00000000c0)={&(0x7f0000000580)=@in={0x2, 0x4e23, @multicast2}, 0x80, 0x0, 0x0, &(0x7f0000000000)=[@timestamping={{0x14, 0x1, 0x25, 0xe3}}], 0x18}, 0x10044045) setsockopt$IP_VS_SO_SET_FLUSH(r5, 0x0, 0x485, 0x0, 0x0) r6 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x109001, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$inet(r8, &(0x7f0000001b00)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001d80)=ANY=[@ANYBLOB="28010000000000000100000001"], 0x128}, 0x0) recvmsg$unix(r7, 0x0, 0x0) socketpair$unix(0x1, 0x2, 0x0, 0x0) writev(0xffffffffffffffff, 0x0, 0x0) r9 = bpf$PROG_LOAD_XDP(0x5, 0x0, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f0000001b00)={0x0, 0x0, 0x0, 0x49, &(0x7f0000001880)=ANY=[@ANYBLOB="426192dfb310460b2eba1545cbd1319392619b7fa5b45816ce1c966ecff549232362a866ea4dbd7cd30206e847836c34145de23d5b218a53a4b848459ea119290baaa2", @ANYRES64=r2, @ANYRESOCT, @ANYRESHEX=r4, @ANYBLOB="ea79ee3fedc5fcef91e284a6f0f043efa753a799ffb80f3588c125f48a023267834fb220b545f6e6523100b4cadd5355564b45e2c30fb60c38a9a891c83006284e87b553cfa441d5dd6ef9709429f0d9b233e187d11bfa2b6966", @ANYRESOCT=r8, @ANYRES32=r4, @ANYRESHEX=r6], 0x128}, 0x4) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000680)={0x10, 0xd, &(0x7f0000000600)=ANY=[@ANYRESDEC], &(0x7f0000000640)='syzkaller\x00', 0x1, 0x0, 0x0, 0x0, 0x9, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0xfce}, 0x94) recvmsg$unix(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000080), 0x100}, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000040)={0xffffffffffffffff}) sendmsg$inet(r8, &(0x7f0000001b00)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001dc0)=ANY=[@ANYRES8=r3, @ANYBLOB="7a06d1b0cfafed23860273cde1619e8e2712eb984aed83daad41aaae4661499bfba4e8caf3daf79394ade239fc9fde25a36b9e0f78bec57cc9658edfff19d193b9ac2b68151a06e0cc9e0a008bcbe3ea1d25cb7efde5b54f9578e4f193bc54baeb1cc54d3964de0ab67a266803a30603d6bfd682e3c474d2d81ed8053fab60a445a265f0a7dc5fdb55753fe2360ddf41264a54924f30d8f9014480122a28f09dd34f38435197f7d3f264a19d261e63527ba3724ab97163c0454240098009598f23c2b81005a8076a609e9dc139dc2c4445083f5a83ac3c28f7f1a3e004434b520e604293bf7573088b9199bb4e11f6703a23653e4cb26fdf8b7f1456a6d2230ffaa85e01074faceeb267f9bb00"/293, @ANYRESOCT=r9, @ANYRES8=r10], 0x128}, 0x2000c004) recvmsg$unix(r11, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000200)}, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)) recvmsg(r1, &(0x7f00000005c0)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000740)=""/4120, 0x1018}, 0x2122) ioctl$TUNGETDEVNETNS(r6, 0x54e3, 0x0) r12 = bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0xe, 0x5, &(0x7f0000000040)=ANY=[], &(0x7f0000000080)='syzkaller\x00', 0x2, 0x0, 0x0, 0x0, 0x20, '\x00', 0x0, @fallback=0x17, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000240)={r12, 0x0, 0xe40, 0xe40, &(0x7f00000002c0)='\x00\x00\x00\x00\x00\x00\x00\x00', &(0x7f0000000300)=""/8, 0x4000, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x4c) 165.374988ms ago: executing program 1 (id=8571): r0 = bpf$PROG_LOAD(0x5, &(0x7f0000000380)={0x6, 0x3, &(0x7f0000000480)=ANY=[@ANYBLOB="1800000002020000000000000000100095"], &(0x7f0000000500)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x8, '\x00', 0x0, @fallback=0x2e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000240)={r0, 0xfca804a0, 0xfffffffffffffe30, 0xf, &(0x7f00000002c0)="b800000500000000", &(0x7f0000000040)=""/6, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) socket$inet_tcp(0x2, 0x1, 0x0) (async) r1 = socket$inet_tcp(0x2, 0x1, 0x0) socket$igmp(0x2, 0x3, 0x2) (async) r2 = socket$igmp(0x2, 0x3, 0x2) socket$netlink(0x10, 0x3, 0x0) (async) r3 = socket$netlink(0x10, 0x3, 0x0) socket$netlink(0x10, 0x3, 0x0) (async) r4 = socket$netlink(0x10, 0x3, 0x0) r5 = socket(0x10, 0x803, 0x0) sendmsg$IPVS_CMD_SET_INFO(r5, &(0x7f0000000b00)={0x0, 0x0, &(0x7f0000000ac0)={0x0, 0x14}}, 0x0) getsockname$packet(r5, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r4, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000003c0)=ANY=[@ANYBLOB="3c0000001000850600"/20, @ANYRES32=r6, @ANYBLOB="01030003000000001c0012000c000100626f6e64000000000c0002000800010005"], 0x3c}}, 0x0) sendmsg$nl_route(r3, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000680)=ANY=[@ANYBLOB="4c00000010001ffffcfffffffdffffff00000000", @ANYRES32=0x0, @ANYBLOB="0002010000000000240012800b00010065727370616e000014000280050016000000000008000700ac1414bb08000a00", @ANYRES32=r6], 0x4c}, 0x1, 0x0, 0x0, 0x40}, 0x0) socket$kcm(0x10, 0x2, 0x4) (async) r7 = socket$kcm(0x10, 0x2, 0x4) connect$inet(r2, &(0x7f0000000240)={0x2, 0x8, @loopback}, 0x10) sendmsg$kcm(r7, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000040)=[{&(0x7f0000000100)="4c000000150097f87059ae08060c040002ff0f020000000000000187ac1414aaa69d35a2cca84708f7abca1bac141410bd7c493872f750375ed08a560400000003c48f93b82a03000000461e", 0x4c}], 0x1}, 0x800c) (async) sendmsg$kcm(r7, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000040)=[{&(0x7f0000000100)="4c000000150097f87059ae08060c040002ff0f020000000000000187ac1414aaa69d35a2cca84708f7abca1bac141410bd7c493872f750375ed08a560400000003c48f93b82a03000000461e", 0x4c}], 0x1}, 0x800c) bind$inet(r1, &(0x7f0000000080)={0x2, 0x4e21, @broadcast}, 0x10) r8 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$PPPIOCNEWUNIT(r8, 0xc004743e, &(0x7f00000000c0)) ioctl$PPPIOCSMRRU(r8, 0x4004743c, 0x0) connect$inet(r1, &(0x7f0000000180)={0x2, 0x4e21, @local}, 0x10) r9 = socket$netlink(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000000)={0xffffffffffffffff}) bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="12000000770000000800000002"], 0x50) (async) r11 = bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="12000000770000000800000002"], 0x50) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000140)={{r11, 0xffffffffffffffff}, &(0x7f0000000180), &(0x7f0000000280)=r10}, 0x20) bpf$BPF_LINK_CREATE(0x1c, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff, 0x5, 0x0, @void}, 0x10) (async) bpf$BPF_LINK_CREATE(0x1c, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff, 0x5, 0x0, @void}, 0x10) bpf$MAP_LOOKUP_ELEM(0x1, &(0x7f0000000440)={r12, &(0x7f00000001c0), 0x0}, 0x20) sendmsg$nl_route(r9, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000540)=ANY=[@ANYBLOB="84000098100010000009f8e751c9000000000000", @ANYRES32=0x0, @ANYBLOB="9180030000200000500012800b000100697036746e6c000040000280040013000800080001000000080014000300000008000100", @ANYRES32, @ANYBLOB="060010000300000008001400000000000800070006000000080e140000800000140003006eaa10cc82350a4966f4869ba3a8fb5b8254df7062c037996ee8c389511f55b05ead192ad63a011e0515cd72f8b32596655091359750bb573a3a909a46b3a48838bafacc1473be3a34d03ce1de29160b358be838d2c82453ffbe5d391bfaab3aa32cd89a61907f1694a40b935e0e28cb243199ca97f3de2059778fdb4d12f35cce7c674d43cda6a39301b3408856b1dbf263a5852fdf7ce52a71a35ac95139499fd2c4d8674c417e98f29ee8488bbccaa4f821e3ef516bb6c8d5c4796c8c273f4429"], 0x84}, 0x1, 0x0, 0x0, 0x4}, 0x40001) bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0x10, 0x4, &(0x7f0000000040)=ANY=[@ANYBLOB="b40000"], 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sk_msg}, 0x94) (async) bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0x10, 0x4, &(0x7f0000000040)=ANY=[@ANYBLOB="b40000"], 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sk_msg}, 0x94) sendmmsg(r9, &(0x7f00000002c0), 0x40000000000009f, 0x0) setsockopt$inet_tcp_TCP_MD5SIG(r1, 0x6, 0xe, &(0x7f0000000340)={@in={{0x2, 0x4e24, @local}}, 0x0, 0x0, 0x30, 0x0, "cebd7ceedb7b0ad952e966bbe242b92b746b023df2cb59e32e10366456deac64e782206bd4aee372005a52a40b7161161a8b2749fe184fb0d08bc63f90010a1ed2bf603d2c3fcc250c30136f9ef2ef8b"}, 0xd8) 0s ago: executing program 5 (id=8572): bpf$TOKEN_CREATE(0x24, &(0x7f0000000000), 0x8) bpf$BPF_MAP_CONST_STR_FREEZE(0x16, &(0x7f0000000080), 0x4) r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000140)={0xc, 0x3, &(0x7f0000000040)=ANY=[@ANYBLOB="18400000000000000000ff7db2c6"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x38, '\x00', 0x0, 0xc, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x4}, 0x94) r1 = socket$inet_icmp(0x2, 0x2, 0x1) bind$inet(r1, &(0x7f0000000140)={0x2, 0x4e24, @private=0xa010100}, 0x10) bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0x18, 0x4, &(0x7f0000000040)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x2, 0xc3, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @fallback=0x27, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, r0}, 0x94) r2 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="0300000004000000040000000a"], 0x50) bpf$PROG_LOAD(0x5, &(0x7f0000000880)={0x3, 0x10, &(0x7f0000000000)=@framed={{0x18, 0x6, 0x0, 0x0, 0x40000}, [@tail_call={{0x18, 0x2, 0x1, 0x0, r2}, {}, {}, {0x7, 0x0, 0xb, 0x7}}, @printk]}, &(0x7f0000000980)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @sched_cls, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='memory.events\x00', 0x275a, 0x0) r4 = syz_genetlink_get_family_id$gtp(&(0x7f0000000540), r3) sendmsg$GTP_CMD_DELPDP(r3, &(0x7f0000000600)={&(0x7f0000000500)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f00000005c0)={&(0x7f0000000580)={0x34, r4, 0x8, 0x70bd26, 0x25dfdbff, {}, [@GTPA_I_TEI={0x8, 0x8, 0x2}, @GTPA_VERSION={0x8}, @GTPA_VERSION={0x8, 0x2, 0x1}, @GTPA_VERSION={0x8, 0x2, 0x1}]}, 0x34}, 0x1, 0x0, 0x0, 0x4048841}, 0x20000000) r5 = socket$nl_generic(0x10, 0x3, 0x10) r6 = syz_genetlink_get_family_id$ethtool(&(0x7f00000002c0), r3) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r3, 0x8933, &(0x7f0000000300)={'batadv_slave_0\x00', 0x0}) getsockopt$inet_pktinfo(r1, 0x0, 0x8, &(0x7f0000000340)={0x0, @multicast1, @multicast1}, &(0x7f0000000380)=0xc) ioctl$ifreq_SIOCGIFINDEX_team(r3, 0x8933, &(0x7f00000003c0)={'team0\x00', 0x0}) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000000)={0x3, 0x4, &(0x7f00000008c0)=ANY=[@ANYBLOB="24020c0000000000000500000000000000000000cd00000095"], &(0x7f0000000180)='GPL\x00'}, 0x94) sendmsg$ETHTOOL_MSG_COALESCE_GET(r5, &(0x7f00000004c0)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x800}, 0xc, &(0x7f0000000480)={&(0x7f0000000400)={0x74, r6, 0x200, 0x70bd25, 0x25dfdbfd, {}, [@HEADER={0x60, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'pim6reg1\x00'}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r7}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'ip6erspan0\x00'}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'hsr0\x00'}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r8}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r9}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x3}]}]}, 0x74}, 0x1, 0x0, 0x0, 0x8000}, 0x24000821) write$cgroup_subtree(r3, &(0x7f0000000000)=ANY=[], 0x3261e) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x9, 0x13, r3, 0x0) r10 = socket$inet6_sctp(0xa, 0x5, 0x84) setsockopt$inet_sctp6_SCTP_INITMSG(r10, 0x84, 0x2, &(0x7f00000000c0)={0xfffc, 0xc}, 0x8) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r10, 0x84, 0x6f, &(0x7f0000000200)={0x0, 0x1e, &(0x7f00000001c0)=[@in6={0xa, 0x0, 0x0, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02', 0x8}]}, &(0x7f0000000640)=0x10) getsockopt$inet_sctp6_SCTP_GET_ASSOC_NUMBER(r10, 0x84, 0x1c, &(0x7f0000000000), &(0x7f0000000040)=0x4) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x2, 0x31, 0xffffffffffffffff, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000880)={0x3, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sched_cls, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) syz_init_net_socket$llc(0x1a, 0x0, 0x0) kernel console output (not intermixed with test programs): nd15 [ 1080.180383][ T3204] 8021q: adding VLAN 0 to HW filter on device bond16 [ 1080.194200][ T3204] 8021q: adding VLAN 0 to HW filter on device bond17 [ 1080.231368][T10324] bridge0: port 2(bridge_slave_1) entered blocking state [ 1080.238668][T10324] bridge0: port 2(bridge_slave_1) entered forwarding state [ 1080.281742][T10324] bridge5: port 2(veth0_to_bond) entered blocking state [ 1080.288927][T10324] bridge5: port 2(veth0_to_bond) entered forwarding state [ 1080.361692][T10324] bridge5: port 1(veth19) entered blocking state [ 1080.368233][T10324] bridge5: port 1(veth19) entered forwarding state [ 1080.378292][T10324] bridge5: port 3(veth21) entered blocking state [ 1080.384802][T10324] bridge5: port 3(veth21) entered forwarding state [ 1080.407658][T10319] netdevsim netdevsim5 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 1080.418566][T10319] netdevsim netdevsim5 eth0: set [1, 1] type 2 family 0 port 20004 - 0 [ 1080.427958][T10319] netdevsim netdevsim5 eth1: set [1, 0] type 2 family 0 port 6081 - 0 [ 1080.436999][T10319] netdevsim netdevsim5 eth1: set [1, 1] type 2 family 0 port 20004 - 0 [ 1080.494768][ T3248] syzkaller0: entered promiscuous mode [ 1080.503639][ T3248] syzkaller0: entered allmulticast mode [ 1080.526602][ T3254] netlink: 'syz.4.7567': attribute type 32 has an invalid length. [ 1080.553913][T10319] netdevsim netdevsim5 eth2: set [1, 0] type 2 family 0 port 6081 - 0 [ 1080.570501][T10319] netdevsim netdevsim5 eth2: set [1, 1] type 2 family 0 port 20004 - 0 [ 1080.608811][T10319] netdevsim netdevsim5 eth3: set [1, 0] type 2 family 0 port 6081 - 0 [ 1080.634678][T10319] netdevsim netdevsim5 eth3: set [1, 1] type 2 family 0 port 20004 - 0 [ 1083.411085][T10308] bond12: (slave veth13): link status definitely up, 10000 Mbps full duplex [ 1083.454012][T10308] bond12: (slave veth13): making interface the new active one [ 1083.474944][T10308] bond12: active interface up! [ 1083.576945][T10324] bond16: (slave veth15): link status definitely up, 10000 Mbps full duplex [ 1083.590639][T10324] bond16: (slave veth17): link status definitely up, 10000 Mbps full duplex [ 1083.613529][T10324] bond16: (slave veth15): making interface the new active one [ 1083.635153][T10324] veth15: entered allmulticast mode [ 1083.668231][T10324] bond16: active interface up! [ 1083.688879][ T3289] batadv_slave_0: entered promiscuous mode [ 1083.706527][T17883] ip6_tunnel: ip6erspan1 xmit: Local address not yet configured! [ 1083.762195][ T3283] batadv_slave_0: left promiscuous mode [ 1083.795156][T10290] ip6_tunnel: ip6erspan1 xmit: Local address not yet configured! [ 1083.907209][T17883] ip6_tunnel: ip6erspan1 xmit: Local address not yet configured! [ 1084.021674][ T3305] __nla_validate_parse: 4 callbacks suppressed [ 1084.021707][ T3305] netlink: 12 bytes leftover after parsing attributes in process `syz.4.7578'. [ 1084.332581][ T3316] openvswitch: netlink: Missing valid actions attribute. [ 1084.343484][ T3317] netlink: 212408 bytes leftover after parsing attributes in process `syz.3.7583'. [ 1084.353743][ T3318] openvswitch: netlink: Missing valid actions attribute. [ 1084.380669][ T3316] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 1084.403691][ T3318] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 1084.469043][ T3320] netlink: 72 bytes leftover after parsing attributes in process `syz.2.7585'. [ 1084.601333][ T3320] syz_tun: left promiscuous mode [ 1084.621556][ T3320] syz_tun: entered allmulticast mode [ 1084.827747][ T2736] ip6_tunnel: ip6erspan1 xmit: Local address not yet configured! [ 1084.852496][ T2736] ip6_tunnel: ip6erspan1 xmit: Local address not yet configured! [ 1084.986311][T22808] ip6_tunnel: ip6erspan1 xmit: Local address not yet configured! [ 1085.049452][ T3347] bridge0: trying to set multicast startup query interval below minimum, setting to 100 (1000ms) [ 1085.738892][ T3385] netlink: 8 bytes leftover after parsing attributes in process `syz.4.7608'. [ 1085.755518][ T3385] gtp0: entered promiscuous mode [ 1085.761872][ T3385] gtp0: entered allmulticast mode [ 1086.048534][ T3403] nft_compat: unsupported protocol 0 [ 1086.078207][ T3397] syzkaller1: entered promiscuous mode [ 1086.094162][ T3397] syzkaller1: entered allmulticast mode [ 1086.286810][ T3415] netlink: 4 bytes leftover after parsing attributes in process `syz.5.7615'. [ 1086.649423][ T3429] FAULT_INJECTION: forcing a failure. [ 1086.649423][ T3429] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1086.681802][ T3429] CPU: 1 UID: 0 PID: 3429 Comm: syz.2.7620 Not tainted syzkaller #0 PREEMPT(full) [ 1086.681833][ T3429] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 1086.681848][ T3429] Call Trace: [ 1086.681858][ T3429] [ 1086.681868][ T3429] dump_stack_lvl+0xe8/0x150 [ 1086.681908][ T3429] should_fail_ex+0x412/0x560 [ 1086.681941][ T3429] _copy_from_user+0x2d/0xb0 [ 1086.681971][ T3429] ___sys_sendmsg+0x1c6/0x360 [ 1086.682000][ T3429] ? __lock_acquire+0x6b5/0x2cf0 [ 1086.682031][ T3429] ? __pfx____sys_sendmsg+0x10/0x10 [ 1086.682098][ T3429] ? __fget_files+0x2a/0x420 [ 1086.682128][ T3429] ? __fget_files+0x3a0/0x420 [ 1086.682168][ T3429] __x64_sys_sendmsg+0x1bd/0x2a0 [ 1086.682199][ T3429] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 1086.682237][ T3429] ? __pfx_ksys_write+0x10/0x10 [ 1086.682281][ T3429] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1086.682307][ T3429] do_syscall_64+0x174/0x580 [ 1086.682334][ T3429] ? trace_irq_disable+0x3b/0x140 [ 1086.682369][ T3429] ? clear_bhb_loop+0x40/0x90 [ 1086.682406][ T3429] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1086.682429][ T3429] RIP: 0033:0x7fda4359ce59 [ 1086.682450][ T3429] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1086.682470][ T3429] RSP: 002b:00007fda44471028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 1086.682494][ T3429] RAX: ffffffffffffffda RBX: 00007fda43815fa0 RCX: 00007fda4359ce59 [ 1086.682511][ T3429] RDX: 0000000000000000 RSI: 0000200000000000 RDI: 0000000000000003 [ 1086.682526][ T3429] RBP: 00007fda44471090 R08: 0000000000000000 R09: 0000000000000000 [ 1086.682540][ T3429] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1086.682554][ T3429] R13: 00007fda43816038 R14: 00007fda43815fa0 R15: 00007ffc146bf3a8 [ 1086.682591][ T3429] [ 1087.223260][ T3446] syzkaller1: entered promiscuous mode [ 1087.246340][ T3446] syzkaller1: entered allmulticast mode [ 1087.340478][ T3447] netlink: 168 bytes leftover after parsing attributes in process `syz.3.7624'. [ 1088.252529][ T3474] FAULT_INJECTION: forcing a failure. [ 1088.252529][ T3474] name failslab, interval 1, probability 0, space 0, times 0 [ 1088.308425][ T3474] CPU: 1 UID: 0 PID: 3474 Comm: syz.1.7633 Not tainted syzkaller #0 PREEMPT(full) [ 1088.308458][ T3474] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 1088.308472][ T3474] Call Trace: [ 1088.308481][ T3474] [ 1088.308491][ T3474] dump_stack_lvl+0xe8/0x150 [ 1088.308524][ T3474] should_fail_ex+0x412/0x560 [ 1088.308554][ T3474] should_failslab+0xa8/0x100 [ 1088.308580][ T3474] kmem_cache_alloc_node_noprof+0x8f/0x690 [ 1088.308614][ T3474] ? __alloc_skb+0x186/0x7d0 [ 1088.308637][ T3474] ? __alloc_skb+0x1d0/0x7d0 [ 1088.308657][ T3474] ? __local_bh_enable_ip+0xd0/0x130 [ 1088.308687][ T3474] __alloc_skb+0x1d0/0x7d0 [ 1088.308715][ T3474] pfkey_sendmsg+0x212/0x1120 [ 1088.308875][ T3474] ? unwind_next_frame+0xa6/0x2550 [ 1088.308920][ T3474] ? __pfx_pfkey_sendmsg+0x10/0x10 [ 1088.308964][ T3474] ? aa_sk_perm+0x6d5/0x900 [ 1088.309007][ T3474] ? __pfx_aa_sk_perm+0x10/0x10 [ 1088.309037][ T3474] ? tomoyo_socket_sendmsg_permission+0x1e0/0x300 [ 1088.309086][ T3474] ? aa_sock_msg_perm+0xf1/0x1b0 [ 1088.309122][ T3474] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 1088.309158][ T3474] ____sys_sendmsg+0x972/0x9f0 [ 1088.309185][ T3474] ? __might_fault+0xaf/0x130 [ 1088.309221][ T3474] ? __pfx_____sys_sendmsg+0x10/0x10 [ 1088.309259][ T3474] ? import_iovec+0x73/0xa0 [ 1088.309291][ T3474] ___sys_sendmsg+0x2a5/0x360 [ 1088.309316][ T3474] ? __lock_acquire+0x6b5/0x2cf0 [ 1088.309346][ T3474] ? __pfx____sys_sendmsg+0x10/0x10 [ 1088.309413][ T3474] ? __fget_files+0x2a/0x420 [ 1088.309442][ T3474] ? __fget_files+0x3a0/0x420 [ 1088.309481][ T3474] __x64_sys_sendmsg+0x1bd/0x2a0 [ 1088.309511][ T3474] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 1088.309550][ T3474] ? __pfx_ksys_write+0x10/0x10 [ 1088.309593][ T3474] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1088.309618][ T3474] do_syscall_64+0x174/0x580 [ 1088.309643][ T3474] ? trace_irq_disable+0x3b/0x140 [ 1088.309681][ T3474] ? clear_bhb_loop+0x40/0x90 [ 1088.309710][ T3474] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1088.309739][ T3474] RIP: 0033:0x7f0d4ad9ce59 [ 1088.309761][ T3474] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1088.309780][ T3474] RSP: 002b:00007f0d4bbcd028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 1088.309804][ T3474] RAX: ffffffffffffffda RBX: 00007f0d4b015fa0 RCX: 00007f0d4ad9ce59 [ 1088.309821][ T3474] RDX: 0000000000000000 RSI: 0000200000000000 RDI: 0000000000000003 [ 1088.309836][ T3474] RBP: 00007f0d4bbcd090 R08: 0000000000000000 R09: 0000000000000000 [ 1088.309850][ T3474] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1088.309863][ T3474] R13: 00007f0d4b016038 R14: 00007f0d4b015fa0 R15: 00007ffc2e9a89d8 [ 1088.309899][ T3474] [ 1088.348788][ T1635] block nbd6: Possible stuck request ffff888027c77000: control (read@0,2048B). Runtime 150 seconds [ 1088.906251][ C0] ip6_tunnel: ip6erspan1 xmit: Local address not yet configured! [ 1089.079910][ T3492] A link change request failed with some changes committed already. Interface gretap0 may have been left with an inconsistent configuration, please check. [ 1089.121390][ T3490] netlink: 16 bytes leftover after parsing attributes in process `syz.3.7639'. [ 1089.201418][ T3486] syzkaller1: entered promiscuous mode [ 1089.228072][ T3486] syzkaller1: entered allmulticast mode [ 1089.248707][ T3496] netlink: 72 bytes leftover after parsing attributes in process `syz.5.7638'. [ 1089.618354][ T3518] FAULT_INJECTION: forcing a failure. [ 1089.618354][ T3518] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1089.631676][ C0] bridge0: port 1(bridge_slave_0) entered forwarding state [ 1089.631705][ C0] bridge0: topology change detected, propagating [ 1089.631999][ C0] bridge0: port 2(bridge_slave_1) entered forwarding state [ 1089.632018][ C0] bridge0: topology change detected, propagating [ 1089.678359][ T3518] CPU: 0 UID: 0 PID: 3518 Comm: syz.5.7644 Not tainted syzkaller #0 PREEMPT(full) [ 1089.678390][ T3518] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 1089.678403][ T3518] Call Trace: [ 1089.678412][ T3518] [ 1089.678421][ T3518] dump_stack_lvl+0xe8/0x150 [ 1089.678452][ T3518] should_fail_ex+0x412/0x560 [ 1089.678498][ T3518] _copy_from_user+0x2d/0xb0 [ 1089.678528][ T3518] ___sys_sendmsg+0x1c6/0x360 [ 1089.678554][ T3518] ? __lock_acquire+0x6b5/0x2cf0 [ 1089.678584][ T3518] ? __pfx____sys_sendmsg+0x10/0x10 [ 1089.678650][ T3518] ? __fget_files+0x2a/0x420 [ 1089.678686][ T3518] ? __fget_files+0x3a0/0x420 [ 1089.678725][ T3518] __x64_sys_sendmsg+0x1bd/0x2a0 [ 1089.678755][ T3518] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 1089.678793][ T3518] ? __pfx_ksys_write+0x10/0x10 [ 1089.678835][ T3518] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1089.678860][ T3518] do_syscall_64+0x174/0x580 [ 1089.678885][ T3518] ? trace_irq_disable+0x3b/0x140 [ 1089.678918][ T3518] ? clear_bhb_loop+0x40/0x90 [ 1089.678946][ T3518] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1089.678969][ T3518] RIP: 0033:0x7fab8c59ce59 [ 1089.678990][ T3518] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1089.679009][ T3518] RSP: 002b:00007fab8d506028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 1089.679032][ T3518] RAX: ffffffffffffffda RBX: 00007fab8c815fa0 RCX: 00007fab8c59ce59 [ 1089.679049][ T3518] RDX: 0000000000000000 RSI: 00002000000000c0 RDI: 0000000000000003 [ 1089.679063][ T3518] RBP: 00007fab8d506090 R08: 0000000000000000 R09: 0000000000000000 [ 1089.679077][ T3518] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1089.679090][ T3518] R13: 00007fab8c816038 R14: 00007fab8c815fa0 R15: 00007ffd66460768 [ 1089.679127][ T3518] [ 1090.118019][ T3482] netlink: 8 bytes leftover after parsing attributes in process `syz.1.7637'. [ 1090.142208][ T3482] netlink: 'syz.1.7637': attribute type 21 has an invalid length. [ 1090.242636][ T3482] Bluetooth: MGMT ver 1.23 [ 1090.267444][ T1635] block nbd7: Possible stuck request ffff888027cb5080: control (read@0,2048B). Runtime 150 seconds [ 1090.353064][ T3535] netlink: 8 bytes leftover after parsing attributes in process `syz.4.7646'. [ 1090.404351][ T3540] netlink: 12 bytes leftover after parsing attributes in process `syz.2.7651'. [ 1090.434825][ T3544] netlink: 24 bytes leftover after parsing attributes in process `syz.5.7650'. [ 1090.670840][ T3538] netlink: 8 bytes leftover after parsing attributes in process `syz.5.7650'. [ 1091.150486][ T3570] FAULT_INJECTION: forcing a failure. [ 1091.150486][ T3570] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1091.197030][ T3570] CPU: 1 UID: 0 PID: 3570 Comm: syz.2.7659 Not tainted syzkaller #0 PREEMPT(full) [ 1091.197061][ T3570] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 1091.197075][ T3570] Call Trace: [ 1091.197085][ T3570] [ 1091.197094][ T3570] dump_stack_lvl+0xe8/0x150 [ 1091.197136][ T3570] should_fail_ex+0x412/0x560 [ 1091.197166][ T3570] _copy_from_iter+0x1d3/0x1670 [ 1091.197194][ T3570] ? rcu_is_watching+0x15/0xb0 [ 1091.197229][ T3570] ? __pfx__copy_from_iter+0x10/0x10 [ 1091.197263][ T3570] ? __alloc_skb+0x4e5/0x7d0 [ 1091.197284][ T3570] ? skb_put+0x11b/0x210 [ 1091.197312][ T3570] pfkey_sendmsg+0x265/0x1120 [ 1091.197345][ T3570] ? unwind_next_frame+0xa6/0x2550 [ 1091.197389][ T3570] ? __pfx_pfkey_sendmsg+0x10/0x10 [ 1091.197427][ T3570] ? aa_sk_perm+0x6d5/0x900 [ 1091.197469][ T3570] ? __pfx_aa_sk_perm+0x10/0x10 [ 1091.197499][ T3570] ? tomoyo_socket_sendmsg_permission+0x1e0/0x300 [ 1091.197541][ T3570] ? aa_sock_msg_perm+0xf1/0x1b0 [ 1091.197577][ T3570] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 1091.197613][ T3570] ____sys_sendmsg+0x972/0x9f0 [ 1091.197640][ T3570] ? __might_fault+0xaf/0x130 [ 1091.197674][ T3570] ? __pfx_____sys_sendmsg+0x10/0x10 [ 1091.197709][ T3570] ? import_iovec+0x73/0xa0 [ 1091.197739][ T3570] ___sys_sendmsg+0x2a5/0x360 [ 1091.197765][ T3570] ? __lock_acquire+0x6b5/0x2cf0 [ 1091.197793][ T3570] ? __pfx____sys_sendmsg+0x10/0x10 [ 1091.197858][ T3570] ? __fget_files+0x2a/0x420 [ 1091.197885][ T3570] ? __fget_files+0x3a0/0x420 [ 1091.197925][ T3570] __x64_sys_sendmsg+0x1bd/0x2a0 [ 1091.197955][ T3570] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 1091.197993][ T3570] ? __pfx_ksys_write+0x10/0x10 [ 1091.198036][ T3570] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1091.198061][ T3570] do_syscall_64+0x174/0x580 [ 1091.198085][ T3570] ? trace_irq_disable+0x3b/0x140 [ 1091.198124][ T3570] ? clear_bhb_loop+0x40/0x90 [ 1091.198152][ T3570] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1091.198175][ T3570] RIP: 0033:0x7fda4359ce59 [ 1091.198197][ T3570] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1091.198216][ T3570] RSP: 002b:00007fda44471028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 1091.198239][ T3570] RAX: ffffffffffffffda RBX: 00007fda43815fa0 RCX: 00007fda4359ce59 [ 1091.198256][ T3570] RDX: 0000000000000000 RSI: 0000200000000000 RDI: 0000000000000003 [ 1091.198270][ T3570] RBP: 00007fda44471090 R08: 0000000000000000 R09: 0000000000000000 [ 1091.198283][ T3570] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1091.198296][ T3570] R13: 00007fda43816038 R14: 00007fda43815fa0 R15: 00007ffc146bf3a8 [ 1091.198333][ T3570] [ 1091.525332][ T3565] syzkaller1: entered promiscuous mode [ 1091.543238][ T3565] syzkaller1: entered allmulticast mode [ 1091.670450][ T3532] infiniband uyz0: set active [ 1091.707874][ T3532] infiniband uyz0: added bridge_slave_1 [ 1091.730289][ T3532] workqueue: Failed to create a rescuer kthread for wq "ib_mad1": -EINTR [ 1091.739350][ T3532] infiniband uyz0: Couldn't open port 1 [ 1091.758108][ T3532] smbdirect: ib_dev[uyz0]: added: IB_CA max_fast_reg_page_list_len=512 device_cap_flags=0x1c001223c76 kernel_cap_flags=0x14 page_size_cap=0xfffff000 [ 1091.775766][ T3532] smbdirect: ib_dev[uyz0]: num_ports=1 max_qp_rd_atom=128 max_qp_init_rd_atom=128 max_sgl_rd=0 max_sge_rd=32 max_cqe=32767 max_qp_wr=1048576 max_send_sge=32 max_recv_sge=32 [ 1091.794509][ T3532] smbdirect: ib_dev[uyz0]PORT[1]: iwarp=0 ib=0 roce=1 v1=0 v2=1 core_cap_flags=0x803005 [ 1091.811099][ T3576] netlink: 'syz.2.7662': attribute type 11 has an invalid length. [ 1091.935039][ T3532] RDS/IB: uyz0: added [ 1091.948692][ T3532] smc: adding ib device uyz0 with port count 1 [ 1091.961529][ T3587] netlink: 8 bytes leftover after parsing attributes in process `syz.5.7665'. [ 1091.970647][ T3532] smc: ib device uyz0 port 1 has no pnetid [ 1091.994286][ T3587] netlink: 8 bytes leftover after parsing attributes in process `syz.5.7665'. [ 1092.104968][ T3592] netlink: 60 bytes leftover after parsing attributes in process `syz.2.7666'. [ 1092.310092][ T3598] netlink: 'syz.3.7668': attribute type 10 has an invalid length. [ 1092.481106][ T3598] team0: Port device veth1_to_hsr added [ 1092.880569][ T1667] block nbd8: Possible stuck request ffff888027ce5080: control (read@0,2048B). Runtime 150 seconds [ 1093.301161][ T3618] x_tables: duplicate underflow at hook 2 [ 1093.364436][ T3622] IPv6: NLM_F_CREATE should be specified when creating new route [ 1094.042009][ T3635] syzkaller0: entered promiscuous mode [ 1094.055285][ T3635] syzkaller0: entered allmulticast mode [ 1094.171460][ T3639] team0: entered promiscuous mode [ 1094.183619][ T3639] team_slave_0: entered promiscuous mode [ 1094.193347][ T3639] team_slave_1: entered promiscuous mode [ 1094.201177][ T3639] team0: entered allmulticast mode [ 1094.208131][ T3639] team_slave_0: entered allmulticast mode [ 1094.214012][ T3639] team_slave_1: entered allmulticast mode [ 1094.222743][ T3638] netlink: 8 bytes leftover after parsing attributes in process `syz.1.7679'. [ 1094.245615][ T3639] team0: Cannot enslave team device to itself [ 1094.801504][T10324] bond1: (slave bridge1): link status up again after 0 ms [ 1094.825234][ T3647] sctp: [Deprecated]: syz.5.7682 (pid 3647) Use of struct sctp_assoc_value in delayed_ack socket option. [ 1094.825234][ T3647] Use struct sctp_sack_info instead [ 1094.840457][T10324] bond1: (slave bridge1): failed to get link speed/duplex [ 1095.016703][T10324] bond1: (slave bridge1): failed to get link speed/duplex [ 1095.155993][T10324] bond1: (slave bridge1): failed to get link speed/duplex [ 1095.296732][T10324] bond1: (slave bridge1): failed to get link speed/duplex [ 1095.425990][T10324] bond1: (slave bridge1): failed to get link speed/duplex [ 1095.494441][ T3673] netlink: 'syz.1.7691': attribute type 4 has an invalid length. [ 1095.544723][ T3674] netlink: 'syz.1.7691': attribute type 4 has an invalid length. [ 1095.576400][T10319] bond1: (slave bridge1): failed to get link speed/duplex [ 1095.696191][T10319] bond1: (slave bridge1): failed to get link speed/duplex [ 1095.816460][T10324] bond1: (slave bridge1): failed to get link speed/duplex [ 1095.926015][ T3647] netlink: 8 bytes leftover after parsing attributes in process `syz.5.7682'. [ 1095.936085][T10312] bond1: (slave bridge1): failed to get link speed/duplex [ 1096.263261][ T3693] netlink: 8 bytes leftover after parsing attributes in process `syz.3.7697'. [ 1096.293659][ T3693] netlink: 8 bytes leftover after parsing attributes in process `syz.3.7697'. [ 1096.557424][ T3704] netlink: 8 bytes leftover after parsing attributes in process `syz.2.7701'. [ 1096.759160][ T3706] syzkaller1: entered promiscuous mode [ 1096.768284][ T3706] syzkaller1: entered allmulticast mode [ 1096.818863][ T3711] gre2: entered allmulticast mode [ 1096.973032][ T3715] netlink: 'syz.2.7705': attribute type 1 has an invalid length. [ 1096.991187][ T3715] netlink: 96 bytes leftover after parsing attributes in process `syz.2.7705'. [ 1097.013487][ T3715] netlink: 1 bytes leftover after parsing attributes in process `syz.2.7705'. [ 1097.182218][ T3721] netlink: 144 bytes leftover after parsing attributes in process `syz.2.7707'. [ 1097.307014][ C0] ip6_tunnel: ip6erspan1 xmit: Local address not yet configured! [ 1098.004427][ T3743] netlink: 24 bytes leftover after parsing attributes in process `syz.2.7715'. [ 1098.370679][ T3760] geneve0: entered promiscuous mode [ 1098.389389][ T3760] geneve0: entered allmulticast mode [ 1098.875012][ T3787] netlink: 212368 bytes leftover after parsing attributes in process `syz.1.7727'. [ 1099.138646][ T3797] siw: device registration error -23 [ 1099.330640][ T3805] __nla_validate_parse: 3 callbacks suppressed [ 1099.330660][ T3805] netlink: 12 bytes leftover after parsing attributes in process `syz.1.7733'. [ 1099.384092][ T3805] ipvlan2: entered allmulticast mode [ 1099.411265][ T3805] gretap0: entered allmulticast mode [ 1099.659447][ T3818] m1Ie5nè‹Ò: entered promiscuous mode [ 1099.704475][ T3828] xt_addrtype: output interface limitation not valid in PREROUTING and INPUT [ 1099.801052][ T3834] IPVS: set_ctl: invalid protocol: 137 100.1.1.1:20003 [ 1099.811839][ T3836] ip_vti0: entered promiscuous mode [ 1099.841462][ T3836] netlink: 8 bytes leftover after parsing attributes in process `syz.2.7743'. [ 1099.876173][T10319] net_ratelimit: 31 callbacks suppressed [ 1099.876208][T10319] bond1: (slave bridge1): failed to get link speed/duplex [ 1099.890623][ T3838] netlink: 16 bytes leftover after parsing attributes in process `syz.3.7744'. [ 1100.028657][T10308] bond1: (slave bridge1): failed to get link speed/duplex [ 1100.120433][ T3845] netlink: 76 bytes leftover after parsing attributes in process `syz.2.7746'. [ 1100.138714][ T3845] netlink: 'syz.2.7746': attribute type 1 has an invalid length. [ 1100.156977][T10324] bond1: (slave bridge1): failed to get link speed/duplex [ 1100.255158][ T3845] 8021q: adding VLAN 0 to HW filter on device bond6 [ 1100.279583][ T3845] bond5: (slave bond6): making interface the new active one [ 1100.289340][ T3845] bond5: (slave bond6): Enslaving as an active interface with an up link [ 1100.305677][T10324] bond1: (slave bridge1): failed to get link speed/duplex [ 1100.322143][ T3845] netlink: 104 bytes leftover after parsing attributes in process `syz.2.7746'. [ 1100.457669][T10324] bond1: (slave bridge1): failed to get link speed/duplex [ 1100.509214][T10319] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1100.527189][T10324] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1100.536538][T10324] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1100.589687][T10324] bond1: (slave bridge1): failed to get link speed/duplex [ 1100.626129][ T3865] netlink: 'syz.2.7752': attribute type 1 has an invalid length. [ 1100.664183][ T3865] netlink: 'syz.2.7752': attribute type 3 has an invalid length. [ 1100.690730][ T3873] netlink: 12 bytes leftover after parsing attributes in process `syz.1.7754'. [ 1100.709706][ T3865] netlink: 132 bytes leftover after parsing attributes in process `syz.2.7752'. [ 1100.797089][T10312] bond1: (slave bridge1): failed to get link speed/duplex [ 1100.811996][ T3869] Bluetooth: hci0: Opcode 0x0c03 failed: -4 [ 1100.824016][ T3870] Bluetooth: hci0: Opcode 0x0c03 failed: -4 [ 1100.932693][ T3881] netlink: 12 bytes leftover after parsing attributes in process `syz.1.7758'. [ 1100.967604][ T3884] netlink: 8 bytes leftover after parsing attributes in process `syz.3.7756'. [ 1100.978926][ T3881] netlink: 12 bytes leftover after parsing attributes in process `syz.1.7758'. [ 1101.890749][ T3940] bridge5: entered promiscuous mode [ 1101.928077][ T3940] bridge5: entered allmulticast mode [ 1101.984922][ T3939] syzkaller0: entered promiscuous mode [ 1102.008413][ T3939] syzkaller0: entered allmulticast mode [ 1102.100822][ T3952] FAULT_INJECTION: forcing a failure. [ 1102.100822][ T3952] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1102.114994][ T3952] CPU: 0 UID: 0 PID: 3952 Comm: syz.1.7777 Not tainted syzkaller #0 PREEMPT(full) [ 1102.115025][ T3952] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 1102.115039][ T3952] Call Trace: [ 1102.115048][ T3952] [ 1102.115058][ T3952] dump_stack_lvl+0xe8/0x150 [ 1102.115090][ T3952] should_fail_ex+0x412/0x560 [ 1102.115120][ T3952] _copy_from_iter+0x3b0/0x1670 [ 1102.115155][ T3952] ? trace_kmalloc+0x2a/0xf0 [ 1102.115187][ T3952] ? __pfx__copy_from_iter+0x10/0x10 [ 1102.115217][ T3952] ? alloc_pages_mpol+0x3c0/0x490 [ 1102.115252][ T3952] af_alg_sendmsg+0x1552/0x2650 [ 1102.115335][ T3952] ? __pfx_af_alg_sendmsg+0x10/0x10 [ 1102.115359][ T3952] ? __pfx_aa_sk_perm+0x10/0x10 [ 1102.115388][ T3952] ? tomoyo_socket_sendmsg_permission+0x1e0/0x300 [ 1102.115434][ T3952] ? aa_sock_msg_perm+0xf1/0x1b0 [ 1102.115470][ T3952] ? skcipher_sendmsg+0x26/0xf0 [ 1102.115500][ T3952] ____sys_sendmsg+0x972/0x9f0 [ 1102.115528][ T3952] ? __might_fault+0xaf/0x130 [ 1102.115565][ T3952] ? __pfx_____sys_sendmsg+0x10/0x10 [ 1102.115603][ T3952] ? import_iovec+0x73/0xa0 [ 1102.115634][ T3952] ___sys_sendmsg+0x2a5/0x360 [ 1102.115667][ T3952] ? __lock_acquire+0x6b5/0x2cf0 [ 1102.115697][ T3952] ? __pfx____sys_sendmsg+0x10/0x10 [ 1102.115730][ T3952] ? kstrtouint+0x6e/0xe0 [ 1102.115795][ T3952] ? __fget_files+0x2a/0x420 [ 1102.115822][ T3952] ? __fget_files+0x3a0/0x420 [ 1102.115862][ T3952] __sys_sendmmsg+0x27c/0x4e0 [ 1102.115895][ T3952] ? __pfx___sys_sendmmsg+0x10/0x10 [ 1102.115920][ T3952] ? __mutex_unlock_slowpath+0x1be/0x6f0 [ 1102.115976][ T3952] ? ksys_write+0x242/0x270 [ 1102.116011][ T3952] ? __pfx_ksys_write+0x10/0x10 [ 1102.116051][ T3952] __x64_sys_sendmmsg+0xa0/0xc0 [ 1102.116079][ T3952] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1102.116102][ T3952] do_syscall_64+0x174/0x580 [ 1102.116125][ T3952] ? trace_irq_disable+0x3b/0x140 [ 1102.116158][ T3952] ? clear_bhb_loop+0x40/0x90 [ 1102.116187][ T3952] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1102.116209][ T3952] RIP: 0033:0x7f0d4ad9ce59 [ 1102.116230][ T3952] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1102.116247][ T3952] RSP: 002b:00007f0d4bbcd028 EFLAGS: 00000246 ORIG_RAX: 0000000000000133 [ 1102.116270][ T3952] RAX: ffffffffffffffda RBX: 00007f0d4b015fa0 RCX: 00007f0d4ad9ce59 [ 1102.116287][ T3952] RDX: 0000000000000002 RSI: 00002000000007c0 RDI: 0000000000000005 [ 1102.116301][ T3952] RBP: 00007f0d4bbcd090 R08: 0000000000000000 R09: 0000000000000000 [ 1102.116314][ T3952] R10: 0000000000040800 R11: 0000000000000246 R12: 0000000000000001 [ 1102.116329][ T3952] R13: 00007f0d4b016038 R14: 00007f0d4b015fa0 R15: 00007ffc2e9a89d8 [ 1102.116366][ T3952] [ 1102.861595][ T3978] netlink: 'syz.2.7786': attribute type 1 has an invalid length. [ 1102.887986][ T3979] netlink: 'syz.2.7786': attribute type 1 has an invalid length. [ 1104.976173][T10312] net_ratelimit: 30 callbacks suppressed [ 1104.976198][T10312] bond1: (slave bridge1): failed to get link speed/duplex [ 1104.992957][T10290] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1105.096554][T10308] bond1: (slave bridge1): failed to get link speed/duplex [ 1105.216688][T10308] bond1: (slave bridge1): failed to get link speed/duplex [ 1105.326040][T10324] bond1: (slave bridge1): failed to get link speed/duplex [ 1105.436455][T10290] bond1: (slave bridge1): failed to get link speed/duplex [ 1105.546671][T10324] bond1: (slave bridge1): failed to get link speed/duplex [ 1105.656465][T10319] bond1: (slave bridge1): failed to get link speed/duplex [ 1105.766612][T10324] bond1: (slave bridge1): failed to get link speed/duplex [ 1105.876602][T10290] bond1: (slave bridge1): failed to get link speed/duplex [ 1106.093034][ T3994] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 1107.027888][ T4090] __nla_validate_parse: 7 callbacks suppressed [ 1107.027927][ T4090] netlink: 80 bytes leftover after parsing attributes in process `syz.3.7816'. [ 1107.081921][ T4090] netlink: 64 bytes leftover after parsing attributes in process `syz.3.7816'. [ 1107.316912][ T4104] nbd: illegal input index -1 [ 1107.353831][ T4103] netlink: 4 bytes leftover after parsing attributes in process `syz.3.7819'. [ 1107.463464][ T4103] netlink: 'syz.3.7819': attribute type 1 has an invalid length. [ 1108.503005][ T4148] netlink: 88 bytes leftover after parsing attributes in process `syz.1.7834'. [ 1109.284681][ T4176] netlink: 2 bytes leftover after parsing attributes in process `syz.5.7841'. [ 1109.285155][ T4174] netlink: 68 bytes leftover after parsing attributes in process `syz.4.7839'. [ 1109.305263][ T4176] IPv6: NLM_F_CREATE should be specified when creating new route [ 1109.505482][ T4187] netlink: 8 bytes leftover after parsing attributes in process `syz.4.7844'. [ 1109.547471][ T4187] netdevsim netdevsim4 netdevsim0: entered promiscuous mode [ 1109.611849][ T4187] netdevsim netdevsim4 netdevsim0: left promiscuous mode [ 1109.999520][T10308] net_ratelimit: 37 callbacks suppressed [ 1109.999542][T10308] bond1: (slave bridge1): failed to get link speed/duplex [ 1110.108411][T10319] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1110.196040][T10308] bond1: (slave bridge1): failed to get link speed/duplex [ 1110.203749][ T4214] netlink: 40 bytes leftover after parsing attributes in process `syz.2.7853'. [ 1110.306541][T10337] bond1: (slave bridge1): failed to get link speed/duplex [ 1110.426225][T10308] bond1: (slave bridge1): failed to get link speed/duplex [ 1110.450711][ T4228] netlink: 12 bytes leftover after parsing attributes in process `syz.4.7857'. [ 1110.512223][ T4228] bridge6: port 1(vlan4) entered blocking state [ 1110.519011][ T4228] bridge6: port 1(vlan4) entered disabled state [ 1110.525623][ T4228] vlan4: entered allmulticast mode [ 1110.536642][ T4228] bridge6: entered allmulticast mode [ 1110.545559][ T4228] vlan4: left allmulticast mode [ 1110.549574][ T4234] netlink: 64 bytes leftover after parsing attributes in process `syz.1.7858'. [ 1110.556925][ T4228] bridge6: left allmulticast mode [ 1110.749886][T10319] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1110.779467][ T4233] syzkaller0: entered promiscuous mode [ 1110.785094][ T4233] syzkaller0: entered allmulticast mode [ 1110.829485][T10312] bond1: (slave bridge1): failed to get link speed/duplex [ 1110.960131][T10319] bond1: (slave bridge1): failed to get link speed/duplex [ 1111.011229][ T4246] bridge0: entered allmulticast mode [ 1111.052492][ T4246] xt_physdev: --physdev-out and --physdev-is-out only supported in the FORWARD and POSTROUTING chains with bridged traffic [ 1111.086899][T10300] bond1: (slave bridge1): failed to get link speed/duplex [ 1111.198927][T10308] bond1: (slave bridge1): failed to get link speed/duplex [ 1111.831432][ T4282] tipc: Enabling of bearer rejected, failed to enable media [ 1112.479027][ T4320] __nla_validate_parse: 3 callbacks suppressed [ 1112.479051][ T4320] netlink: 16 bytes leftover after parsing attributes in process `syz.3.7881'. [ 1112.639313][ T4320] tap0: tun_chr_ioctl cmd 2148553947 [ 1112.665082][ T4328] tipc: Enabling of bearer rejected, failed to enable media [ 1112.858286][ T4341] netlink: 16 bytes leftover after parsing attributes in process `syz.1.7889'. [ 1113.099754][ T4349] x_tables: ip6_tables: eui64 match: used from hooks OUTPUT, but only valid from PREROUTING/INPUT/FORWARD [ 1114.586469][ C0] ip6_tunnel: ip6erspan1 xmit: Local address not yet configured! [ 1115.228967][T10337] net_ratelimit: 16 callbacks suppressed [ 1115.228990][T10337] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1115.496026][T10308] bond1: (slave bridge1): failed to get link speed/duplex [ 1115.560276][ T4357] netlink: 32 bytes leftover after parsing attributes in process `syz.4.7895'. [ 1115.590533][ T4353] xt_addrtype: both incoming and outgoing interface limitation cannot be selected [ 1115.605929][T10337] bond1: (slave bridge1): failed to get link speed/duplex [ 1115.727164][ T4364] netlink: 'syz.3.7897': attribute type 1 has an invalid length. [ 1115.789890][T10337] bond1: (slave bridge1): failed to get link speed/duplex [ 1115.869573][ C0] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1115.884556][T10312] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1115.899830][T10308] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1115.934344][ T4364] bond6: entered promiscuous mode [ 1115.940710][ T4364] 8021q: adding VLAN 0 to HW filter on device bond6 [ 1115.956722][T10290] bond1: (slave bridge1): failed to get link speed/duplex [ 1116.070496][ T4377] bond6: (slave bridge5): making interface the new active one [ 1116.102195][ T4377] bridge5: entered promiscuous mode [ 1116.125074][ T4377] bond6: (slave bridge5): Enslaving as an active interface with an up link [ 1116.244423][ T4367] syzkaller0: entered promiscuous mode [ 1116.250453][ T4367] syzkaller0: entered allmulticast mode [ 1116.839473][ T4389] netlink: 'syz.3.7904': attribute type 5 has an invalid length. [ 1116.847572][ T4389] netlink: 8 bytes leftover after parsing attributes in process `syz.3.7904'. [ 1116.938068][ T4396] netlink: 'syz.4.7906': attribute type 1 has an invalid length. [ 1117.072867][T10319] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1117.147121][ T2736] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1119.066534][ T1635] block nbd6: Possible stuck request ffff888027c77000: control (read@0,2048B). Runtime 180 seconds [ 1119.206359][ T4396] workqueue: Failed to create a rescuer kthread for wq "bond5": -EINTR [ 1119.314322][ T4401] xt_NFQUEUE: number of total queues is 0 [ 1119.759299][ T4424] syzkaller0: renamed from batadv_slave_1 (while UP) [ 1119.838519][ T4424] netlink: 8 bytes leftover after parsing attributes in process `syz.5.7916'. [ 1119.877616][ T4427] netlink: 8 bytes leftover after parsing attributes in process `syz.3.7917'. [ 1119.910091][ T4427] netlink: 8 bytes leftover after parsing attributes in process `syz.3.7917'. [ 1119.957565][ T4427] syzkaller0: entered promiscuous mode [ 1119.969896][ T4427] syzkaller0: entered allmulticast mode [ 1120.372326][ T1635] block nbd7: Possible stuck request ffff888027cb5080: control (read@0,2048B). Runtime 180 seconds [ 1120.447553][ T4443] FAULT_INJECTION: forcing a failure. [ 1120.447553][ T4443] name fail_page_alloc, interval 1, probability 0, space 0, times 0 [ 1120.523328][ T4443] CPU: 1 UID: 0 PID: 4443 Comm: syz.1.7920 Not tainted syzkaller #0 PREEMPT(full) [ 1120.523360][ T4443] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 1120.523374][ T4443] Call Trace: [ 1120.523383][ T4443] [ 1120.523393][ T4443] dump_stack_lvl+0xe8/0x150 [ 1120.523425][ T4443] should_fail_ex+0x412/0x560 [ 1120.523457][ T4443] prepare_alloc_pages+0x22a/0x650 [ 1120.523502][ T4443] __alloc_frozen_pages_noprof+0x12f/0x380 [ 1120.523527][ T4443] ? __pfx___alloc_frozen_pages_noprof+0x10/0x10 [ 1120.523565][ T4443] ? __pfx_policy_nodemask+0x10/0x10 [ 1120.523585][ T4443] ? trace_kmalloc+0x2a/0xf0 [ 1120.523613][ T4443] ? __pfx__copy_from_iter+0x10/0x10 [ 1120.523640][ T4443] alloc_pages_mpol+0x235/0x490 [ 1120.523665][ T4443] alloc_pages_noprof+0xac/0x2a0 [ 1120.523688][ T4443] af_alg_sendmsg+0x1446/0x2650 [ 1120.523731][ T4443] ? __pfx_af_alg_sendmsg+0x10/0x10 [ 1120.523751][ T4443] ? __pfx_aa_sk_perm+0x10/0x10 [ 1120.523777][ T4443] ? tomoyo_socket_sendmsg_permission+0x1e0/0x300 [ 1120.523816][ T4443] ? aa_sock_msg_perm+0xf1/0x1b0 [ 1120.523850][ T4443] ? skcipher_sendmsg+0x26/0xf0 [ 1120.523875][ T4443] ____sys_sendmsg+0x972/0x9f0 [ 1120.523900][ T4443] ? __might_fault+0xaf/0x130 [ 1120.523933][ T4443] ? __pfx_____sys_sendmsg+0x10/0x10 [ 1120.523967][ T4443] ? import_iovec+0x73/0xa0 [ 1120.523996][ T4443] ___sys_sendmsg+0x2a5/0x360 [ 1120.524018][ T4443] ? __lock_acquire+0x6b5/0x2cf0 [ 1120.524045][ T4443] ? __pfx____sys_sendmsg+0x10/0x10 [ 1120.524075][ T4443] ? kstrtouint+0x6e/0xe0 [ 1120.524131][ T4443] ? __fget_files+0x2a/0x420 [ 1120.524156][ T4443] ? __fget_files+0x3a0/0x420 [ 1120.524195][ T4443] __sys_sendmmsg+0x27c/0x4e0 [ 1120.524225][ T4443] ? __pfx___sys_sendmmsg+0x10/0x10 [ 1120.524246][ T4443] ? __mutex_unlock_slowpath+0x1be/0x6f0 [ 1120.524317][ T4443] ? ksys_write+0x242/0x270 [ 1120.524350][ T4443] ? __pfx_ksys_write+0x10/0x10 [ 1120.524386][ T4443] __x64_sys_sendmmsg+0xa0/0xc0 [ 1120.524410][ T4443] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1120.524432][ T4443] do_syscall_64+0x174/0x580 [ 1120.524452][ T4443] ? trace_irq_disable+0x3b/0x140 [ 1120.524483][ T4443] ? clear_bhb_loop+0x40/0x90 [ 1120.524508][ T4443] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1120.524528][ T4443] RIP: 0033:0x7f0d4ad9ce59 [ 1120.524548][ T4443] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1120.524566][ T4443] RSP: 002b:00007f0d4bbcd028 EFLAGS: 00000246 ORIG_RAX: 0000000000000133 [ 1120.524588][ T4443] RAX: ffffffffffffffda RBX: 00007f0d4b015fa0 RCX: 00007f0d4ad9ce59 [ 1120.524604][ T4443] RDX: 0000000000000002 RSI: 00002000000007c0 RDI: 0000000000000005 [ 1120.524617][ T4443] RBP: 00007f0d4bbcd090 R08: 0000000000000000 R09: 0000000000000000 [ 1120.524630][ T4443] R10: 0000000000040800 R11: 0000000000000246 R12: 0000000000000002 [ 1120.524642][ T4443] R13: 00007f0d4b016038 R14: 00007f0d4b015fa0 R15: 00007ffc2e9a89d8 [ 1120.524675][ T4443] [ 1120.839056][ T4434] workqueue: Failed to create a rescuer kthread for wq "bond5": -EINTR [ 1120.946264][T10290] net_ratelimit: 10 callbacks suppressed [ 1120.946291][T10290] bond1: (slave bridge1): failed to get link speed/duplex [ 1120.987520][ T2738] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1121.001800][T10324] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1121.111757][ T4459] netlink: 48 bytes leftover after parsing attributes in process `syz.2.7923'. [ 1121.167399][T10290] bond1: (slave bridge1): failed to get link speed/duplex [ 1121.317827][T10319] bond1: (slave bridge1): failed to get link speed/duplex [ 1121.437981][T10324] bond1: (slave bridge1): failed to get link speed/duplex [ 1121.556095][T10319] bond1: (slave bridge1): failed to get link speed/duplex [ 1121.628348][T10324] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1121.980012][T10290] bond1: (slave bridge1): failed to get link speed/duplex [ 1122.110536][T10290] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1122.165276][ T4486] syzkaller0: entered promiscuous mode [ 1122.183111][ T4486] syzkaller0: entered allmulticast mode [ 1122.418997][ T4495] FAULT_INJECTION: forcing a failure. [ 1122.418997][ T4495] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1122.439225][ T4495] CPU: 0 UID: 0 PID: 4495 Comm: syz.4.7936 Not tainted syzkaller #0 PREEMPT(full) [ 1122.439253][ T4495] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 1122.439265][ T4495] Call Trace: [ 1122.439274][ T4495] [ 1122.439283][ T4495] dump_stack_lvl+0xe8/0x150 [ 1122.439312][ T4495] should_fail_ex+0x412/0x560 [ 1122.439338][ T4495] _copy_from_iter+0x3b0/0x1670 [ 1122.439370][ T4495] ? trace_kmalloc+0x2a/0xf0 [ 1122.439398][ T4495] ? __pfx__copy_from_iter+0x10/0x10 [ 1122.439424][ T4495] ? alloc_pages_mpol+0x3c0/0x490 [ 1122.439465][ T4495] af_alg_sendmsg+0x1552/0x2650 [ 1122.439513][ T4495] ? __pfx_af_alg_sendmsg+0x10/0x10 [ 1122.439534][ T4495] ? __pfx_aa_sk_perm+0x10/0x10 [ 1122.439560][ T4495] ? tomoyo_socket_sendmsg_permission+0x1e0/0x300 [ 1122.439598][ T4495] ? aa_sock_msg_perm+0xf1/0x1b0 [ 1122.439629][ T4495] ? skcipher_sendmsg+0x26/0xf0 [ 1122.439654][ T4495] ____sys_sendmsg+0x972/0x9f0 [ 1122.439679][ T4495] ? __might_fault+0xaf/0x130 [ 1122.439711][ T4495] ? __pfx_____sys_sendmsg+0x10/0x10 [ 1122.439744][ T4495] ? import_iovec+0x73/0xa0 [ 1122.439772][ T4495] ___sys_sendmsg+0x2a5/0x360 [ 1122.439793][ T4495] ? __lock_acquire+0x6b5/0x2cf0 [ 1122.439820][ T4495] ? __pfx____sys_sendmsg+0x10/0x10 [ 1122.439849][ T4495] ? kstrtouint+0x6e/0xe0 [ 1122.439906][ T4495] ? __fget_files+0x2a/0x420 [ 1122.439929][ T4495] ? __fget_files+0x3a0/0x420 [ 1122.439966][ T4495] __sys_sendmmsg+0x27c/0x4e0 [ 1122.439996][ T4495] ? __pfx___sys_sendmmsg+0x10/0x10 [ 1122.440017][ T4495] ? __mutex_unlock_slowpath+0x1be/0x6f0 [ 1122.440068][ T4495] ? ksys_write+0x242/0x270 [ 1122.440100][ T4495] ? __pfx_ksys_write+0x10/0x10 [ 1122.440135][ T4495] __x64_sys_sendmmsg+0xa0/0xc0 [ 1122.440159][ T4495] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1122.440181][ T4495] do_syscall_64+0x174/0x580 [ 1122.440201][ T4495] ? trace_irq_disable+0x3b/0x140 [ 1122.440232][ T4495] ? clear_bhb_loop+0x40/0x90 [ 1122.440256][ T4495] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1122.440276][ T4495] RIP: 0033:0x7fc4fcd9ce59 [ 1122.440295][ T4495] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1122.440311][ T4495] RSP: 002b:00007fc4fdbe5028 EFLAGS: 00000246 ORIG_RAX: 0000000000000133 [ 1122.440332][ T4495] RAX: ffffffffffffffda RBX: 00007fc4fd015fa0 RCX: 00007fc4fcd9ce59 [ 1122.440347][ T4495] RDX: 0000000000000002 RSI: 00002000000007c0 RDI: 0000000000000005 [ 1122.440359][ T4495] RBP: 00007fc4fdbe5090 R08: 0000000000000000 R09: 0000000000000000 [ 1122.440371][ T4495] R10: 0000000000040800 R11: 0000000000000246 R12: 0000000000000002 [ 1122.440383][ T4495] R13: 00007fc4fd016038 R14: 00007fc4fd015fa0 R15: 00007fff3cdf4648 [ 1122.440416][ T4495] [ 1122.911627][ T1667] block nbd8: Possible stuck request ffff888027ce5080: control (read@0,2048B). Runtime 180 seconds [ 1123.681219][ T4548] netlink: 8 bytes leftover after parsing attributes in process `syz.4.7957'. [ 1123.694334][ T4548] netlink: 12 bytes leftover after parsing attributes in process `syz.4.7957'. [ 1123.738401][ T4548] netlink: 8 bytes leftover after parsing attributes in process `syz.4.7957'. [ 1123.754708][ T4548] netlink: 4 bytes leftover after parsing attributes in process `syz.4.7957'. [ 1123.777960][ T4548] netlink: 8 bytes leftover after parsing attributes in process `syz.4.7957'. [ 1123.801372][ T4548] netlink: 4 bytes leftover after parsing attributes in process `syz.4.7957'. [ 1123.915634][ T4555] gretap0: entered promiscuous mode [ 1123.921281][ T4555] vlan3: entered promiscuous mode [ 1124.022282][ T4564] ip6t_srh: unknown srh match flags 4000 [ 1124.540584][ T4587] syzkaller0: entered promiscuous mode [ 1124.546357][ T4587] syzkaller0: entered allmulticast mode [ 1124.849847][ T4599] __nla_validate_parse: 3 callbacks suppressed [ 1124.849920][ T4599] netlink: 260 bytes leftover after parsing attributes in process `syz.1.7976'. [ 1124.892528][ T4602] netlink: 16 bytes leftover after parsing attributes in process `syz.5.7977'. [ 1124.903297][ T4602] netlink: 16 bytes leftover after parsing attributes in process `syz.5.7977'. [ 1125.300671][ T4618] netlink: 212368 bytes leftover after parsing attributes in process `syz.1.7984'. [ 1125.394163][ T4622] nbd: must specify a size in bytes for the device [ 1125.451363][ T4621] block nbd3: NBD_DISCONNECT [ 1125.470866][ T4621] block nbd3: Send disconnect failed -32 [ 1125.506205][ T4621] block nbd3: Send disconnect failed -32 [ 1125.541407][ T4621] block nbd3: shutting down sockets [ 1125.618680][ T4953] Bluetooth: hci4: unexpected cc 0x0c03 length: 249 > 1 [ 1125.633792][ T4953] Bluetooth: hci4: unexpected cc 0x1003 length: 249 > 9 [ 1125.643103][ T4953] Bluetooth: hci4: unexpected cc 0x1001 length: 249 > 9 [ 1125.651302][ T4953] Bluetooth: hci4: unexpected cc 0x0c23 length: 249 > 4 [ 1125.677836][ T4953] Bluetooth: hci4: unexpected cc 0x0c38 length: 249 > 2 [ 1125.863303][ T4638] netlink: 'syz.3.7989': attribute type 1 has an invalid length. [ 1126.039757][ T4638] 8021q: adding VLAN 0 to HW filter on device bond7 [ 1126.101285][ T4641] netlink: 8 bytes leftover after parsing attributes in process `syz.4.7988'. [ 1126.291515][T25276] syz_tun (unregistering): left allmulticast mode [ 1126.307775][T25276] bond0: (slave syz_tun): Releasing backup interface [ 1126.456386][T10324] net_ratelimit: 29 callbacks suppressed [ 1126.456407][T10324] bond1: (slave bridge1): failed to get link speed/duplex [ 1126.612450][ T4664] netlink: 'syz.2.7994': attribute type 1 has an invalid length. [ 1126.626005][ T4664] netlink: 9188 bytes leftover after parsing attributes in process `syz.2.7994'. [ 1126.632560][ T2738] bond1: (slave bridge1): failed to get link speed/duplex [ 1126.748557][T10319] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1126.756750][T10319] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1126.766653][T10324] bond1: (slave bridge1): failed to get link speed/duplex [ 1126.907471][ T2736] bond1: (slave bridge1): failed to get link speed/duplex [ 1127.027576][ T2738] bond1: (slave bridge1): failed to get link speed/duplex [ 1127.147375][ T2738] bond1: (slave bridge1): failed to get link speed/duplex [ 1127.223616][ T4688] netlink: 'syz.3.8001': attribute type 1 has an invalid length. [ 1127.225212][ T4687] netlink: 'syz.3.8001': attribute type 1 has an invalid length. [ 1127.270468][ T4687] bond8: entered promiscuous mode [ 1127.275649][ T4687] bond8: entered allmulticast mode [ 1127.281941][ T4687] 8021q: adding VLAN 0 to HW filter on device bond8 [ 1127.306333][ T2736] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1127.308035][T10319] bond1: (slave bridge1): failed to get link speed/duplex [ 1127.392026][ T4687] netlink: 4 bytes leftover after parsing attributes in process `syz.3.8001'. [ 1127.787535][ T4953] Bluetooth: hci4: command tx timeout [ 1128.344116][ T4729] netlink: 20 bytes leftover after parsing attributes in process `syz.3.8011'. [ 1128.384602][ T4726] bridge0: port 2(bridge_slave_1) entered disabled state [ 1128.392410][ T4726] bridge0: port 1(bridge_slave_0) entered disabled state [ 1128.470681][ T4726] bond0: left promiscuous mode [ 1128.475767][ T4726] bond_slave_0: left promiscuous mode [ 1128.482842][ T4726] bond_slave_1: left promiscuous mode [ 1128.490087][ T4726] syz_tun: left promiscuous mode [ 1128.580983][ T4726] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 1128.604134][ T4726] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 1128.700497][ T4726] vlan2: left promiscuous mode [ 1128.705353][ T4726] bridge0: left promiscuous mode [ 1128.724539][ T4726] veth11: left allmulticast mode [ 1128.730779][ T4726] ip6erspan1: left allmulticast mode [ 1128.737313][ T4726] gtp0: left promiscuous mode [ 1128.742055][ T4726] gtp0: left allmulticast mode [ 1128.750228][ T4726] bridge5: left promiscuous mode [ 1128.755223][ T4726] bridge5: left allmulticast mode [ 1128.780725][ T4729] ip6gre1: entered promiscuous mode [ 1128.790118][ T4729] ip6gre1: entered allmulticast mode [ 1128.813273][ T6027] uyz0: Port: 1 Link DOWN [ 1128.835140][T10337] netdevsim netdevsim4 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 1128.854550][T10337] netdevsim netdevsim4 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 1128.882888][T10337] netdevsim netdevsim4 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 1128.995767][T10337] netdevsim netdevsim4 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 1129.009229][ T4740] netlink: 'syz.1.8014': attribute type 3 has an invalid length. [ 1129.018828][ T4740] netlink: 'syz.1.8014': attribute type 3 has an invalid length. [ 1129.021857][ T4741] FAULT_INJECTION: forcing a failure. [ 1129.021857][ T4741] name fail_page_alloc, interval 1, probability 0, space 0, times 0 [ 1129.043891][ T4741] CPU: 1 UID: 0 PID: 4741 Comm: syz.3.8013 Not tainted syzkaller #0 PREEMPT(full) [ 1129.043919][ T4741] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 1129.043933][ T4741] Call Trace: [ 1129.043943][ T4741] [ 1129.043952][ T4741] dump_stack_lvl+0xe8/0x150 [ 1129.043984][ T4741] should_fail_ex+0x412/0x560 [ 1129.044024][ T4741] prepare_alloc_pages+0x22a/0x650 [ 1129.044070][ T4741] __alloc_frozen_pages_noprof+0x12f/0x380 [ 1129.044097][ T4741] ? __pfx___alloc_frozen_pages_noprof+0x10/0x10 [ 1129.044138][ T4741] ? __pfx_policy_nodemask+0x10/0x10 [ 1129.044160][ T4741] ? trace_kmalloc+0x2a/0xf0 [ 1129.044190][ T4741] ? __pfx__copy_from_iter+0x10/0x10 [ 1129.044218][ T4741] alloc_pages_mpol+0x235/0x490 [ 1129.044248][ T4741] alloc_pages_noprof+0xac/0x2a0 [ 1129.044273][ T4741] af_alg_sendmsg+0x1446/0x2650 [ 1129.044321][ T4741] ? __pfx_af_alg_sendmsg+0x10/0x10 [ 1129.044345][ T4741] ? __pfx_aa_sk_perm+0x10/0x10 [ 1129.044376][ T4741] ? tomoyo_socket_sendmsg_permission+0x1e0/0x300 [ 1129.044420][ T4741] ? aa_sock_msg_perm+0xf1/0x1b0 [ 1129.044455][ T4741] ? skcipher_sendmsg+0x26/0xf0 [ 1129.044484][ T4741] ____sys_sendmsg+0x972/0x9f0 [ 1129.044521][ T4741] ? __might_fault+0xaf/0x130 [ 1129.044559][ T4741] ? __pfx_____sys_sendmsg+0x10/0x10 [ 1129.044601][ T4741] ? import_iovec+0x73/0xa0 [ 1129.044633][ T4741] ___sys_sendmsg+0x2a5/0x360 [ 1129.044657][ T4741] ? __lock_acquire+0x6b5/0x2cf0 [ 1129.044688][ T4741] ? __pfx____sys_sendmsg+0x10/0x10 [ 1129.044720][ T4741] ? kstrtouint+0x6e/0xe0 [ 1129.044784][ T4741] ? __fget_files+0x2a/0x420 [ 1129.044811][ T4741] ? __fget_files+0x3a0/0x420 [ 1129.044851][ T4741] __sys_sendmmsg+0x27c/0x4e0 [ 1129.044885][ T4741] ? __pfx___sys_sendmmsg+0x10/0x10 [ 1129.044909][ T4741] ? __mutex_unlock_slowpath+0x1be/0x6f0 [ 1129.044965][ T4741] ? ksys_write+0x242/0x270 [ 1129.045001][ T4741] ? __pfx_ksys_write+0x10/0x10 [ 1129.045043][ T4741] __x64_sys_sendmmsg+0xa0/0xc0 [ 1129.045071][ T4741] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1129.045094][ T4741] do_syscall_64+0x174/0x580 [ 1129.045117][ T4741] ? trace_irq_disable+0x3b/0x140 [ 1129.045152][ T4741] ? clear_bhb_loop+0x40/0x90 [ 1129.045180][ T4741] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1129.045202][ T4741] RIP: 0033:0x7f39a759ce59 [ 1129.045224][ T4741] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1129.045243][ T4741] RSP: 002b:00007f39a83b2028 EFLAGS: 00000246 ORIG_RAX: 0000000000000133 [ 1129.045264][ T4741] RAX: ffffffffffffffda RBX: 00007f39a7815fa0 RCX: 00007f39a759ce59 [ 1129.045281][ T4741] RDX: 0000000000000002 RSI: 00002000000007c0 RDI: 0000000000000005 [ 1129.045295][ T4741] RBP: 00007f39a83b2090 R08: 0000000000000000 R09: 0000000000000000 [ 1129.045309][ T4741] R10: 0000000000040800 R11: 0000000000000246 R12: 0000000000000002 [ 1129.045322][ T4741] R13: 00007f39a7816038 R14: 00007f39a7815fa0 R15: 00007ffd52c91588 [ 1129.045358][ T4741] [ 1129.377921][ T4743] bond3: Removing last ns target with arp_interval on [ 1129.493604][ T4631] bridge0: port 1(bridge_slave_0) entered blocking state [ 1129.510965][ T4631] bridge0: port 1(bridge_slave_0) entered disabled state [ 1129.525086][ T4631] bridge_slave_0: entered allmulticast mode [ 1129.533814][ T4631] bridge_slave_0: entered promiscuous mode [ 1129.544056][ T4631] bridge0: port 2(bridge_slave_1) entered blocking state [ 1129.565600][ T4631] bridge0: port 2(bridge_slave_1) entered disabled state [ 1129.575306][ T4631] bridge_slave_1: entered allmulticast mode [ 1129.584680][ T4631] bridge_slave_1: entered promiscuous mode [ 1129.608292][ T4750] tipc: Enabling of bearer rejected, failed to enable media [ 1129.681035][ T4631] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 1129.694909][ T4631] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 1129.740356][ T4631] team0: Port device team_slave_0 added [ 1129.749941][ T4631] team0: Port device team_slave_1 added [ 1129.788976][ T4631] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 1129.796686][ T4631] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 1129.823695][ T4631] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 1129.838027][ T4631] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 1129.845041][ T4631] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 1129.872565][ T4953] Bluetooth: hci4: command 0x041b tx timeout [ 1129.894755][ T4631] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 1130.083097][ T4631] hsr_slave_0: entered promiscuous mode [ 1130.112963][ T4631] hsr_slave_1: entered promiscuous mode [ 1130.121893][ T4631] debugfs: 'hsr0' already exists in 'hsr' [ 1130.131985][ T4631] Cannot create hsr debugfs directory [ 1130.259088][ T4777] netlink: 'syz.3.8022': attribute type 2 has an invalid length. [ 1130.276888][ T4777] netlink: 224 bytes leftover after parsing attributes in process `syz.3.8022'. [ 1130.307861][ T4777] netlink: 'syz.3.8022': attribute type 2 has an invalid length. [ 1130.336539][ T4777] netlink: 224 bytes leftover after parsing attributes in process `syz.3.8022'. [ 1130.604739][ T4786] syzkaller1: entered promiscuous mode [ 1130.623071][ T4786] syzkaller1: entered allmulticast mode [ 1130.924785][ T4803] netlink: 8 bytes leftover after parsing attributes in process `syz.3.8030'. [ 1131.191496][ T4631] netdevsim netdevsim5 eth3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1131.204351][ T4631] netdevsim netdevsim5 eth3 (unregistering): unset [1, 1] type 2 family 0 port 20004 - 0 [ 1131.635361][ T4631] netdevsim netdevsim5 eth2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1131.674920][ T4631] netdevsim netdevsim5 eth2 (unregistering): unset [1, 1] type 2 family 0 port 20004 - 0 [ 1131.721560][ T4839] netlink: 32 bytes leftover after parsing attributes in process `syz.1.8037'. [ 1131.788018][ T4838] syzkaller1: entered promiscuous mode [ 1131.805088][ T4838] syzkaller1: entered allmulticast mode [ 1131.836125][T10290] net_ratelimit: 18 callbacks suppressed [ 1131.836170][T10290] bond1: (slave bridge1): failed to get link speed/duplex [ 1131.867570][T10319] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1131.945993][T31476] Bluetooth: hci4: command 0x041b tx timeout [ 1131.969626][ T4631] netdevsim netdevsim5 eth1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1131.987671][ T4631] netdevsim netdevsim5 eth1 (unregistering): unset [1, 1] type 2 family 0 port 20004 - 0 [ 1132.147068][T10290] bond1: (slave bridge1): failed to get link speed/duplex [ 1132.278953][ T4631] netdevsim netdevsim5 eth0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1132.306820][ T4631] netdevsim netdevsim5 eth0 (unregistering): unset [1, 1] type 2 family 0 port 20004 - 0 [ 1132.349721][T10337] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1132.461683][T10337] bond1: (slave bridge1): failed to get link speed/duplex [ 1132.506877][T10337] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1132.515487][ T4831] netlink: 20 bytes leftover after parsing attributes in process `syz.1.8037'. [ 1132.706149][T10319] bond1: (slave bridge1): failed to get link speed/duplex [ 1133.036125][ T4874] netlink: 16 bytes leftover after parsing attributes in process `syz.2.8046'. [ 1133.147039][T10290] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1133.157815][T10337] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1133.488319][ T4894] IPv6: sit1: Disabled Multicast RS [ 1133.499022][ T4631] netdevsim netdevsim5 netdevsim0: renamed from eth0 [ 1133.522020][ T4631] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 1133.534896][ T4631] netdevsim netdevsim5 netdevsim1: renamed from eth1 [ 1133.558789][ T4631] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 1133.570183][T10319] bond1: (slave bridge1): failed to get link speed/duplex [ 1133.589692][ T4631] netdevsim netdevsim5 netdevsim2: renamed from eth2 [ 1133.618373][ T4631] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 1133.627575][ T4631] netdevsim netdevsim5 netdevsim3: renamed from eth3 [ 1133.640504][ T4896] netlink: 24 bytes leftover after parsing attributes in process `syz.2.8052'. [ 1133.651718][ T4631] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 1133.782906][ T4631] 8021q: adding VLAN 0 to HW filter on device bond0 [ 1133.838878][ T4631] 8021q: adding VLAN 0 to HW filter on device team0 [ 1133.857091][T10319] bridge0: port 1(bridge_slave_0) entered blocking state [ 1133.864287][T10319] bridge0: port 1(bridge_slave_0) entered forwarding state [ 1133.891916][T10319] bridge0: port 2(bridge_slave_1) entered blocking state [ 1133.899171][T10319] bridge0: port 2(bridge_slave_1) entered forwarding state [ 1134.026548][T31476] Bluetooth: hci4: command 0x041b tx timeout [ 1134.068087][ T4914] bond8: (slave lo): enslaved VLAN challenged slave. Adding VLANs will be blocked as long as it is part of bond. [ 1134.097405][ T4914] bond8: (slave lo): Enslaving as an active interface with an up link [ 1134.274951][ T4921] mac80211_hwsim hwsim137 wlan0: entered promiscuous mode [ 1134.814737][ T4954] netlink: 'syz.3.8062': attribute type 4 has an invalid length. [ 1134.834390][ T4954] netlink: 224 bytes leftover after parsing attributes in process `syz.3.8062'. [ 1134.864305][ T4631] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 1135.020575][ T4961] netlink: 8 bytes leftover after parsing attributes in process `syz.1.8065'. [ 1135.189839][ T4968] netlink: 'syz.4.8066': attribute type 4 has an invalid length. [ 1135.251159][ T4968] syzkaller0: entered promiscuous mode [ 1135.255594][ T4971] netlink: 7 bytes leftover after parsing attributes in process `syz.1.8067'. [ 1135.276955][ T4968] syzkaller0: entered allmulticast mode [ 1135.463420][ T4631] veth0_vlan: entered promiscuous mode [ 1135.483055][ T4975] netlink: 4 bytes leftover after parsing attributes in process `syz.1.8069'. [ 1135.507389][ T4631] veth1_vlan: entered promiscuous mode [ 1135.530509][ T4975] macvtap1: entered promiscuous mode [ 1135.538495][ T4975] bridge0: entered promiscuous mode [ 1135.544111][ T4975] macvtap1: entered allmulticast mode [ 1135.553800][ T4975] bridge0: entered allmulticast mode [ 1135.589905][ T4978] bridge0: left allmulticast mode [ 1135.599852][ T4978] macvtap1: left promiscuous mode [ 1135.615160][ T4978] macvtap1: left allmulticast mode [ 1135.652941][ T6027] bridge0: left promiscuous mode [ 1135.800487][ T4631] veth0_macvtap: entered promiscuous mode [ 1135.855758][ T4631] veth1_macvtap: entered promiscuous mode [ 1135.943497][ T4631] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 1136.002717][ T4631] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 1136.035439][T10319] netdevsim netdevsim5 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 1136.052069][T10319] netdevsim netdevsim5 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 1136.073782][T10319] netdevsim netdevsim5 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 1136.105962][T31476] Bluetooth: hci4: command 0x041b tx timeout [ 1136.109886][ T4999] netlink: 300 bytes leftover after parsing attributes in process `syz.3.8075'. [ 1136.353575][T10319] netdevsim netdevsim5 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 1136.808985][T10337] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1136.838462][T10337] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1137.024486][T10290] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1137.027688][ T2738] net_ratelimit: 19 callbacks suppressed [ 1137.027741][ T2738] bond1: (slave bridge1): failed to get link speed/duplex [ 1137.067200][T10290] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1137.206066][T10337] bond1: (slave bridge1): failed to get link speed/duplex [ 1137.328368][T10312] bond1: (slave bridge1): failed to get link speed/duplex [ 1137.444309][ T5030] netlink: 8 bytes leftover after parsing attributes in process `syz.5.8084'. [ 1137.449754][ T2738] bond1: (slave bridge1): failed to get link speed/duplex [ 1137.461873][ T5029] nbd: socks must be embedded in a SOCK_ITEM attr [ 1137.518805][ T5030] macsec1: entered promiscuous mode [ 1137.534923][ T5030] macsec1: entered allmulticast mode [ 1137.608858][ T5035] netlink: 8 bytes leftover after parsing attributes in process `syz.4.8085'. [ 1137.627975][T10337] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1137.679350][ T5036] netlink: 'syz.3.8087': attribute type 15 has an invalid length. [ 1137.794747][ T5046] netlink: 49 bytes leftover after parsing attributes in process `syz.2.8086'. [ 1137.825636][ T5046] netlink: 140 bytes leftover after parsing attributes in process `syz.2.8086'. [ 1138.091115][T10312] bond1: (slave bridge1): failed to get link speed/duplex [ 1138.101516][ T5048] netlink: 28 bytes leftover after parsing attributes in process `syz.2.8086'. [ 1138.110992][ T5048] netlink: 32 bytes leftover after parsing attributes in process `syz.2.8086'. [ 1138.122568][ T5048] netlink: 28 bytes leftover after parsing attributes in process `syz.2.8086'. [ 1138.138309][ T5048] netlink: 32 bytes leftover after parsing attributes in process `syz.2.8086'. [ 1138.259890][ T5056] syzkaller1: entered promiscuous mode [ 1138.265533][ T5056] syzkaller1: entered allmulticast mode [ 1138.272753][ T2736] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1138.286213][T10312] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1138.316572][T10312] bond1: (slave bridge1): failed to get link speed/duplex [ 1138.506400][ T2738] bond1: (slave bridge1): failed to get link speed/duplex [ 1138.602140][ T5065] can: request_module (can-proto-0) failed. [ 1138.718366][ T5074] 8021q: adding VLAN 0 to HW filter on device team0 [ 1138.953004][ T5082] netlink: 'syz.4.8095': attribute type 1 has an invalid length. [ 1139.020387][ T5082] netlink: 'syz.4.8095': attribute type 1 has an invalid length. [ 1139.430135][ T5087] bond5: (slave veth13): Enslaving as an active interface with a down link [ 1139.507292][ T5091] bond5: (slave veth15): Enslaving as an active interface with a down link [ 1139.718198][ T5116] netlink: 'syz.4.8102': attribute type 4 has an invalid length. [ 1139.772002][ T5118] netlink: 'syz.4.8102': attribute type 4 has an invalid length. [ 1140.039263][ T5113] bridge0: port 2(bridge_slave_1) entered disabled state [ 1140.047052][ T5113] bridge0: port 1(bridge_slave_0) entered disabled state [ 1140.245420][ T5113] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 1140.264376][ T5113] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 1140.526295][ T5129] syzkaller1: entered promiscuous mode [ 1140.532940][ T5129] syzkaller1: entered allmulticast mode [ 1140.552304][ T2736] netdevsim netdevsim5 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 1140.590176][ T2736] netdevsim netdevsim5 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 1140.680322][ T5158] netlink: 'syz.3.8112': attribute type 1 has an invalid length. [ 1140.700163][ T2736] netdevsim netdevsim5 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 1140.710827][ T2736] netdevsim netdevsim5 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 1140.811963][ T5158] bond9: entered promiscuous mode [ 1140.820004][ T5158] 8021q: adding VLAN 0 to HW filter on device bond9 [ 1140.852908][ T5158] __nla_validate_parse: 5 callbacks suppressed [ 1140.852931][ T5158] netlink: 4 bytes leftover after parsing attributes in process `syz.3.8112'. [ 1140.942209][ T5158] 8021q: adding VLAN 0 to HW filter on device bond9 [ 1140.961590][ T5158] bond9: (slave ip6gre2): The slave device specified does not support setting the MAC address [ 1140.994017][ T5158] bond9: (slave ip6gre2): Setting fail_over_mac to active for active-backup mode [ 1141.029011][ T5158] bond9: (slave ip6gre2): making interface the new active one [ 1141.036958][ T5158] ip6gre2: entered promiscuous mode [ 1141.044609][ T5158] bond9: (slave ip6gre2): Enslaving as an active interface with an up link [ 1141.074337][ T5181] tipc: Started in network mode [ 1141.079850][ T5181] tipc: Node identity ac1414aa, cluster identity 4711 [ 1141.090615][ T5181] tipc: Enabled bearer , priority 5 [ 1141.098152][ T5181] netlink: 4 bytes leftover after parsing attributes in process `syz.2.8119'. [ 1141.350311][ T5181] bond0: (slave syz_tun): Releasing backup interface [ 1141.421811][ T5187] veth1_to_hsr: entered allmulticast mode [ 1141.431517][ T5190] netlink: 'syz.5.8122': attribute type 4 has an invalid length. [ 1141.501840][ T5192] policy can only be matched on NF_INET_PRE_ROUTING [ 1141.501865][ T5192] unable to load match [ 1141.670424][ T5196] syzkaller1: entered promiscuous mode [ 1141.693518][ T5196] syzkaller1: entered allmulticast mode [ 1141.763731][ T5205] netlink: 68 bytes leftover after parsing attributes in process `syz.4.8126'. [ 1141.885599][ T5211] tipc: Started in network mode [ 1141.893928][ T5211] tipc: Node identity ac1414aa, cluster identity 4711 [ 1141.911137][ T5211] tipc: Enabled bearer , priority 5 [ 1141.928746][ T5211] netlink: 4 bytes leftover after parsing attributes in process `syz.4.8126'. [ 1142.008478][ T5211] syz_tun (unregistering): left allmulticast mode [ 1142.042462][ T5211] bond0: (slave syz_tun): Releasing backup interface [ 1142.053994][ T5218] ip6t_REJECT: ECHOREPLY is not supported [ 1142.087737][ T5216] netlink: 8 bytes leftover after parsing attributes in process `syz.5.8131'. [ 1142.098489][T10324] net_ratelimit: 16 callbacks suppressed [ 1142.098510][T10324] bond1: (slave bridge1): failed to get link speed/duplex [ 1142.127699][ T5216] netlink: 224 bytes leftover after parsing attributes in process `syz.5.8131'. [ 1142.145754][ T5216] netlink: 8 bytes leftover after parsing attributes in process `syz.5.8131'. [ 1142.205906][ T10] tipc: Node number set to 2886997162 [ 1142.247505][ T2736] bond1: (slave bridge1): failed to get link speed/duplex [ 1142.384683][T10319] bond1: (slave bridge1): failed to get link speed/duplex [ 1142.510550][T10324] bond1: (slave bridge1): failed to get link speed/duplex [ 1142.629154][T10290] bond1: (slave bridge1): failed to get link speed/duplex [ 1142.743304][ T5246] netlink: 12 bytes leftover after parsing attributes in process `syz.3.8138'. [ 1142.763721][ T2736] bond1: (slave bridge1): failed to get link speed/duplex [ 1142.892533][T10324] bond1: (slave bridge1): failed to get link speed/duplex [ 1142.907142][T17887] tipc: Node number set to 2886997162 [ 1143.056549][T10319] bond1: (slave bridge1): failed to get link speed/duplex [ 1143.166878][T10319] bond1: (slave bridge1): failed to get link speed/duplex [ 1143.178570][ T5257] netlink: 144 bytes leftover after parsing attributes in process `syz.3.8142'. [ 1143.299113][T10337] bond1: (slave bridge1): failed to get link speed/duplex [ 1143.562459][ T5279] netlink: 20 bytes leftover after parsing attributes in process `syz.3.8146'. [ 1145.311359][ T5231] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 1145.656677][ T5318] rdma_op ffff88807debb9f0 conn xmit_rdma 0000000000000000 [ 1145.894127][ T5325] __nla_validate_parse: 2 callbacks suppressed [ 1145.894150][ T5325] netlink: 4 bytes leftover after parsing attributes in process `syz.3.8158'. [ 1146.214330][ T5314] v: renamed from ip6gretap0 (while UP) [ 1146.288004][ T5350] netlink: 20 bytes leftover after parsing attributes in process `syz.4.8165'. [ 1146.413933][ T5354] x_tables: duplicate underflow at hook 3 [ 1146.887588][ T5369] netlink: 16 bytes leftover after parsing attributes in process `syz.1.8174'. [ 1146.903195][ T5370] IPVS: set_ctl: invalid protocol: 46 224.0.0.2:20001 [ 1147.075380][ T5369] syzkaller0: entered promiscuous mode [ 1147.093025][ T5369] syzkaller0: entered allmulticast mode [ 1147.106666][T10290] net_ratelimit: 32 callbacks suppressed [ 1147.106685][T10290] bond1: (slave bridge1): failed to get link speed/duplex [ 1147.658883][ T5376] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 1149.149027][ T1635] block nbd6: Possible stuck request ffff888027c77000: control (read@0,2048B). Runtime 210 seconds [ 1150.017388][T10324] bond1: (slave bridge1): failed to get link speed/duplex [ 1150.164572][T10312] bond1: (slave bridge1): failed to get link speed/duplex [ 1150.189379][ T5422] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 1150.337311][T10324] bond1: (slave bridge1): failed to get link speed/duplex [ 1150.428838][ C0] ip6_tunnel: ip6erspan1 xmit: Local address not yet configured! [ 1150.439221][ T1635] block nbd7: Possible stuck request ffff888027cb5080: control (read@0,2048B). Runtime 210 seconds [ 1150.467728][T10337] bond1: (slave bridge1): failed to get link speed/duplex [ 1150.606740][T10290] bond1: (slave bridge1): failed to get link speed/duplex [ 1150.727496][T10324] bond1: (slave bridge1): failed to get link speed/duplex [ 1150.856632][T10324] bond1: (slave bridge1): failed to get link speed/duplex [ 1150.976564][T10337] bond1: (slave bridge1): failed to get link speed/duplex [ 1151.087165][T10324] bond1: (slave bridge1): failed to get link speed/duplex [ 1151.129414][ T5457] netlink: 28 bytes leftover after parsing attributes in process `syz.5.8196'. [ 1152.153995][ T5497] net_ratelimit: 8 callbacks suppressed [ 1152.154015][ T5497] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 1152.189551][ T5501] netlink: 40 bytes leftover after parsing attributes in process `syz.4.8208'. [ 1152.227784][ T5505] gre1: entered promiscuous mode [ 1152.252135][ T5502] netlink: 40 bytes leftover after parsing attributes in process `syz.3.8209'. [ 1152.262083][ T5502] netlink: 260 bytes leftover after parsing attributes in process `syz.3.8209'. [ 1152.356701][T10324] bond1: (slave bridge1): failed to get link speed/duplex [ 1152.487307][T10324] bond1: (slave bridge1): failed to get link speed/duplex [ 1152.644305][T10337] bond1: (slave bridge1): failed to get link speed/duplex [ 1152.768015][T10324] bond1: (slave bridge1): failed to get link speed/duplex [ 1152.897165][T10324] bond1: (slave bridge1): failed to get link speed/duplex [ 1152.999008][ T1667] block nbd8: Possible stuck request ffff888027ce5080: control (read@0,2048B). Runtime 210 seconds [ 1153.167676][ T2736] bond1: (slave bridge1): failed to get link speed/duplex [ 1153.230035][ T5552] netlink: 332 bytes leftover after parsing attributes in process `syz.2.8225'. [ 1153.237335][ T5551] netlink: 8 bytes leftover after parsing attributes in process `syz.3.8223'. [ 1153.254877][ T5552] netlink: 'syz.2.8225': attribute type 9 has an invalid length. [ 1153.272460][ T5552] netlink: 108 bytes leftover after parsing attributes in process `syz.2.8225'. [ 1153.284855][ T5552] netlink: 32 bytes leftover after parsing attributes in process `syz.2.8225'. [ 1153.308238][T10337] bond1: (slave bridge1): failed to get link speed/duplex [ 1153.447584][T10290] bond1: (slave bridge1): failed to get link speed/duplex [ 1153.616627][T10324] bond1: (slave bridge1): failed to get link speed/duplex [ 1153.643744][ T5576] netlink: 84 bytes leftover after parsing attributes in process `syz.1.8228'. [ 1153.878565][ T5580] netlink: 8 bytes leftover after parsing attributes in process `syz.3.8231'. [ 1154.489217][ T5605] dummy0: entered allmulticast mode [ 1154.512379][ T5604] dummy0: left allmulticast mode [ 1155.354066][ T5647] netlink: 'syz.4.8252': attribute type 1 has an invalid length. [ 1155.774720][ T5652] netlink: 'syz.1.8255': attribute type 6 has an invalid length. [ 1155.805683][ T5654] netlink: 'syz.5.8254': attribute type 11 has an invalid length. [ 1155.874889][ T5659] netlink: 'syz.4.8257': attribute type 1 has an invalid length. [ 1155.875437][ T5658] netlink: 'syz.4.8257': attribute type 1 has an invalid length. [ 1156.495384][ T5681] : entered promiscuous mode [ 1156.756832][ T5699] FAULT_INJECTION: forcing a failure. [ 1156.756832][ T5699] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1156.783019][ T5699] CPU: 0 UID: 0 PID: 5699 Comm: syz.2.8267 Not tainted syzkaller #0 PREEMPT(full) [ 1156.783053][ T5699] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 1156.783066][ T5699] Call Trace: [ 1156.783075][ T5699] [ 1156.783085][ T5699] dump_stack_lvl+0xe8/0x150 [ 1156.783117][ T5699] should_fail_ex+0x412/0x560 [ 1156.783147][ T5699] _copy_from_user+0x2d/0xb0 [ 1156.783185][ T5699] ___sys_recvmsg+0x175/0x590 [ 1156.783220][ T5699] ? __pfx____sys_recvmsg+0x10/0x10 [ 1156.783254][ T5699] ? __fget_files+0x2a/0x420 [ 1156.783302][ T5699] ? __fget_files+0x3a0/0x420 [ 1156.783342][ T5699] do_recvmmsg+0x334/0x800 [ 1156.783460][ T5699] ? __pfx_do_recvmmsg+0x10/0x10 [ 1156.783500][ T5699] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 1156.783545][ T5699] __x64_sys_recvmmsg+0x198/0x250 [ 1156.783577][ T5699] ? __pfx___x64_sys_recvmmsg+0x10/0x10 [ 1156.783613][ T5699] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1156.783638][ T5699] do_syscall_64+0x174/0x580 [ 1156.783662][ T5699] ? trace_irq_disable+0x3b/0x140 [ 1156.783696][ T5699] ? clear_bhb_loop+0x40/0x90 [ 1156.783724][ T5699] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1156.783747][ T5699] RIP: 0033:0x7fda4359ce59 [ 1156.783770][ T5699] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1156.783790][ T5699] RSP: 002b:00007fda44450028 EFLAGS: 00000246 ORIG_RAX: 000000000000012b [ 1156.783814][ T5699] RAX: ffffffffffffffda RBX: 00007fda43816090 RCX: 00007fda4359ce59 [ 1156.783830][ T5699] RDX: 0000000000000001 RSI: 00002000000000c0 RDI: 0000000000000003 [ 1156.783844][ T5699] RBP: 00007fda44450090 R08: 0000000000000000 R09: 0000000000000000 [ 1156.783858][ T5699] R10: 0000000000010043 R11: 0000000000000246 R12: 0000000000000001 [ 1156.783872][ T5699] R13: 00007fda43816128 R14: 00007fda43816090 R15: 00007ffc146bf3a8 [ 1156.783908][ T5699] [ 1157.080697][ T5705] geneve0: entered promiscuous mode [ 1157.091103][ T5705] geneve0: left promiscuous mode [ 1157.167231][ T5707] netlink: 'syz.1.8270': attribute type 1 has an invalid length. [ 1157.185514][ T5707] __nla_validate_parse: 5 callbacks suppressed [ 1157.185538][ T5707] netlink: 96 bytes leftover after parsing attributes in process `syz.1.8270'. [ 1157.213507][ T5707] netlink: 'syz.1.8270': attribute type 1 has an invalid length. [ 1157.225991][ T5708] netlink: 'syz.1.8270': attribute type 8 has an invalid length. [ 1157.234235][ T5708] netlink: 4 bytes leftover after parsing attributes in process `syz.1.8270'. [ 1157.247736][ T5707] netlink: 'syz.1.8270': attribute type 8 has an invalid length. [ 1157.264556][ T5707] netlink: 606 bytes leftover after parsing attributes in process `syz.1.8270'. [ 1157.286134][ T5710] netlink: 4 bytes leftover after parsing attributes in process `syz.1.8270'. [ 1157.628562][ T2736] net_ratelimit: 22 callbacks suppressed [ 1157.628585][ T2736] bond1: (slave bridge1): failed to get link speed/duplex [ 1157.689221][ T5708] veth1_to_team: entered promiscuous mode [ 1157.749384][ T5708] veth1_to_team: left promiscuous mode [ 1157.798192][T10319] bond1: (slave bridge1): failed to get link speed/duplex [ 1157.878610][ T5714] syzkaller1: entered promiscuous mode [ 1157.914376][ T5714] syzkaller1: entered allmulticast mode [ 1157.995286][ T5719] bridge0 (unregistering): left allmulticast mode [ 1158.098296][T10290] bond1: (slave bridge1): failed to get link speed/duplex [ 1158.150403][ T5733] syzkaller0: entered promiscuous mode [ 1158.171682][ T5733] syzkaller0: entered allmulticast mode [ 1158.287615][ T5741] netlink: 60 bytes leftover after parsing attributes in process `syz.5.8279'. [ 1158.298193][ T5741] unsupported nlmsg_type 40 [ 1158.299825][ T5727] syzkaller1: entered promiscuous mode [ 1158.322238][ T5727] syzkaller1: entered allmulticast mode [ 1158.416141][T10319] bond1: (slave bridge1): failed to get link speed/duplex [ 1158.566618][ T5754] netlink: 12 bytes leftover after parsing attributes in process `syz.5.8282'. [ 1158.618012][ T5757] netlink: 12 bytes leftover after parsing attributes in process `syz.5.8282'. [ 1158.661685][ T5758] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 1158.728676][ T5754] vlan2: entered promiscuous mode [ 1158.758566][ T5754] batadv0: entered promiscuous mode [ 1158.805749][ T5771] input: Bluetooth HID Boot Protocol Device as /devices/virtual/bluetooth/hci4/hci4:200/input7 [ 1158.900046][ T5757] vlan2: entered promiscuous mode [ 1158.934002][ T5785] netlink: 16 bytes leftover after parsing attributes in process `syz.4.8290'. [ 1159.219738][ T5779] netlink: 20 bytes leftover after parsing attributes in process `syz.1.8286'. [ 1159.333463][ T5797] netlink: 28 bytes leftover after parsing attributes in process `syz.5.8291'. [ 1159.366639][T10337] bond1: (slave bridge1): failed to get link speed/duplex [ 1159.417482][ T5801] syzkaller1: tun_chr_ioctl cmd 1074025677 [ 1159.431175][ T5801] syzkaller1: linktype set to 778 [ 1159.527011][ T2738] bond1: (slave bridge1): failed to get link speed/duplex [ 1159.580722][ T5809] erspan0: entered promiscuous mode [ 1159.686897][ T2736] bond1: (slave bridge1): failed to get link speed/duplex [ 1159.817616][ T2736] bond1: (slave bridge1): failed to get link speed/duplex [ 1159.870492][ T5829] FAULT_INJECTION: forcing a failure. [ 1159.870492][ T5829] name failslab, interval 1, probability 0, space 0, times 0 [ 1159.910945][ T5829] CPU: 1 UID: 0 PID: 5829 Comm: syz.2.8301 Not tainted syzkaller #0 PREEMPT(full) [ 1159.910976][ T5829] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 1159.910990][ T5829] Call Trace: [ 1159.910999][ T5829] [ 1159.911009][ T5829] dump_stack_lvl+0xe8/0x150 [ 1159.911041][ T5829] should_fail_ex+0x412/0x560 [ 1159.911071][ T5829] should_failslab+0xa8/0x100 [ 1159.911097][ T5829] kmem_cache_alloc_node_noprof+0x8f/0x690 [ 1159.911140][ T5829] ? __alloc_skb+0x186/0x7d0 [ 1159.911162][ T5829] ? __alloc_skb+0x1d0/0x7d0 [ 1159.911182][ T5829] ? __local_bh_enable_ip+0xd0/0x130 [ 1159.911211][ T5829] __alloc_skb+0x1d0/0x7d0 [ 1159.911240][ T5829] netlink_sendmsg+0x5d4/0xb40 [ 1159.911279][ T5829] ? __pfx_netlink_sendmsg+0x10/0x10 [ 1159.911317][ T5829] ? aa_sock_msg_perm+0xf1/0x1b0 [ 1159.911353][ T5829] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 1159.911388][ T5829] ____sys_sendmsg+0x972/0x9f0 [ 1159.911415][ T5829] ? __might_fault+0xaf/0x130 [ 1159.911451][ T5829] ? __pfx_____sys_sendmsg+0x10/0x10 [ 1159.911488][ T5829] ? import_iovec+0x73/0xa0 [ 1159.911521][ T5829] ___sys_sendmsg+0x2a5/0x360 [ 1159.911545][ T5829] ? __lock_acquire+0x6b5/0x2cf0 [ 1159.911575][ T5829] ? __pfx____sys_sendmsg+0x10/0x10 [ 1159.911641][ T5829] ? __fget_files+0x2a/0x420 [ 1159.911669][ T5829] ? __fget_files+0x3a0/0x420 [ 1159.911707][ T5829] __x64_sys_sendmsg+0x1bd/0x2a0 [ 1159.911738][ T5829] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 1159.911773][ T5829] ? __pfx_ksys_write+0x10/0x10 [ 1159.911815][ T5829] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1159.911844][ T5829] do_syscall_64+0x174/0x580 [ 1159.911874][ T5829] ? trace_irq_disable+0x3b/0x140 [ 1159.911907][ T5829] ? clear_bhb_loop+0x40/0x90 [ 1159.911935][ T5829] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1159.911957][ T5829] RIP: 0033:0x7fda4359ce59 [ 1159.911977][ T5829] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1159.911996][ T5829] RSP: 002b:00007fda44471028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 1159.912019][ T5829] RAX: ffffffffffffffda RBX: 00007fda43815fa0 RCX: 00007fda4359ce59 [ 1159.912036][ T5829] RDX: 0000000000000000 RSI: 0000200000000280 RDI: 0000000000000003 [ 1159.912050][ T5829] RBP: 00007fda44471090 R08: 0000000000000000 R09: 0000000000000000 [ 1159.912063][ T5829] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1159.912075][ T5829] R13: 00007fda43816038 R14: 00007fda43815fa0 R15: 00007ffc146bf3a8 [ 1159.912108][ T5829] [ 1160.168617][ T2736] bond1: (slave bridge1): failed to get link speed/duplex [ 1160.543060][ T5856] geneve4: entered promiscuous mode [ 1160.612476][ T5861] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 1161.570491][ T5900] netlink: 'syz.3.8326': attribute type 1 has an invalid length. [ 1161.647368][ T5900] 8021q: adding VLAN 0 to HW filter on device bond10 [ 1162.144869][ T5914] ipip0: entered promiscuous mode [ 1162.203081][ T5916] __nla_validate_parse: 16 callbacks suppressed [ 1162.203104][ T5916] netlink: 4 bytes leftover after parsing attributes in process `syz.4.8331'. [ 1162.232741][ T5916] hsr_slave_0: left promiscuous mode [ 1162.258694][ T5916] hsr_slave_1: left promiscuous mode [ 1162.459981][ T5931] netlink: 36 bytes leftover after parsing attributes in process `syz.2.8334'. [ 1162.481253][ T5931] netlink: 24 bytes leftover after parsing attributes in process `syz.2.8334'. [ 1162.675969][T10337] net_ratelimit: 20 callbacks suppressed [ 1162.675992][T10337] bond1: (slave bridge1): failed to get link speed/duplex [ 1162.772747][ T5944] syzkaller1: entered promiscuous mode [ 1162.785337][ T5944] syzkaller1: entered allmulticast mode [ 1162.817751][T10337] bond1: (slave bridge1): failed to get link speed/duplex [ 1162.937343][T10319] bond1: (slave bridge1): failed to get link speed/duplex [ 1163.071671][T10324] bond1: (slave bridge1): failed to get link speed/duplex [ 1163.217089][T10290] bond1: (slave bridge1): failed to get link speed/duplex [ 1163.251214][ T5966] netlink: 68 bytes leftover after parsing attributes in process `syz.2.8346'. [ 1163.346176][ T2736] bond1: (slave bridge1): failed to get link speed/duplex [ 1163.469315][T10319] bond1: (slave bridge1): failed to get link speed/duplex [ 1163.586388][ T2736] bond1: (slave bridge1): failed to get link speed/duplex [ 1163.702290][ T5987] netlink: 480 bytes leftover after parsing attributes in process `syz.5.8353'. [ 1163.717788][T10319] bond1: (slave bridge1): failed to get link speed/duplex [ 1163.744070][ T5983] syzkaller1: entered promiscuous mode [ 1163.756651][ T5987] netlink: 480 bytes leftover after parsing attributes in process `syz.5.8353'. [ 1163.778986][ T5983] syzkaller1: entered allmulticast mode [ 1163.849150][T10324] bond1: (slave bridge1): failed to get link speed/duplex [ 1164.033061][ T6002] FAULT_INJECTION: forcing a failure. [ 1164.033061][ T6002] name failslab, interval 1, probability 0, space 0, times 0 [ 1164.077119][ T6002] CPU: 1 UID: 0 PID: 6002 Comm: syz.2.8363 Not tainted syzkaller #0 PREEMPT(full) [ 1164.077154][ T6002] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 1164.077167][ T6002] Call Trace: [ 1164.077176][ T6002] [ 1164.077185][ T6002] dump_stack_lvl+0xe8/0x150 [ 1164.077216][ T6002] should_fail_ex+0x412/0x560 [ 1164.077246][ T6002] should_failslab+0xa8/0x100 [ 1164.077272][ T6002] kmem_cache_alloc_node_noprof+0x8f/0x690 [ 1164.077307][ T6002] ? __alloc_skb+0x1d0/0x7d0 [ 1164.077329][ T6002] ? __local_bh_enable_ip+0xd0/0x130 [ 1164.077358][ T6002] __alloc_skb+0x1d0/0x7d0 [ 1164.077387][ T6002] netlink_dump+0x1d8/0xe10 [ 1164.077416][ T6002] ? __netlink_lookup+0xc6/0x8b0 [ 1164.077448][ T6002] ? __netlink_lookup+0x7e4/0x8b0 [ 1164.077476][ T6002] ? __pfx_netlink_dump+0x10/0x10 [ 1164.077515][ T6002] ? netlink_lookup+0x30/0x200 [ 1164.077548][ T6002] ? netlink_lookup+0x30/0x200 [ 1164.077571][ T6002] ? netlink_lookup+0x30/0x200 [ 1164.077602][ T6002] __netlink_dump_start+0x5cb/0x7e0 [ 1164.077637][ T6002] rtnetlink_rcv_msg+0xa3a/0xbe0 [ 1164.077662][ T6002] ? __pfx_rtm_dump_nexthop_bucket+0x10/0x10 [ 1164.077792][ T6002] ? rtnetlink_rcv_msg+0x1b9/0xbe0 [ 1164.077814][ T6002] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 1164.077835][ T6002] ? ref_tracker_free+0x693/0x840 [ 1164.077860][ T6002] ? __pfx_rtnl_dumpit+0x10/0x10 [ 1164.077882][ T6002] ? __pfx_rtm_dump_nexthop_bucket+0x10/0x10 [ 1164.077927][ T6002] netlink_rcv_skb+0x232/0x4b0 [ 1164.077954][ T6002] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 1164.077980][ T6002] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 1164.078021][ T6002] ? netlink_deliver_tap+0x2e/0x1b0 [ 1164.078047][ T6002] ? netlink_deliver_tap+0x2e/0x1b0 [ 1164.078080][ T6002] netlink_unicast+0x75c/0x8e0 [ 1164.078118][ T6002] netlink_sendmsg+0x813/0xb40 [ 1164.078156][ T6002] ? __pfx_netlink_sendmsg+0x10/0x10 [ 1164.078189][ T6002] ? aa_sock_msg_perm+0xf1/0x1b0 [ 1164.078226][ T6002] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 1164.078260][ T6002] ____sys_sendmsg+0x972/0x9f0 [ 1164.078287][ T6002] ? __might_fault+0xaf/0x130 [ 1164.078325][ T6002] ? __pfx_____sys_sendmsg+0x10/0x10 [ 1164.078362][ T6002] ? import_iovec+0x73/0xa0 [ 1164.078395][ T6002] ___sys_sendmsg+0x2a5/0x360 [ 1164.078421][ T6002] ? __lock_acquire+0x6b5/0x2cf0 [ 1164.078451][ T6002] ? __pfx____sys_sendmsg+0x10/0x10 [ 1164.078519][ T6002] ? __fget_files+0x2a/0x420 [ 1164.078554][ T6002] ? __fget_files+0x3a0/0x420 [ 1164.078595][ T6002] __x64_sys_sendmsg+0x1bd/0x2a0 [ 1164.078625][ T6002] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 1164.078664][ T6002] ? __pfx_ksys_write+0x10/0x10 [ 1164.078708][ T6002] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1164.078733][ T6002] do_syscall_64+0x174/0x580 [ 1164.078757][ T6002] ? trace_irq_disable+0x3b/0x140 [ 1164.078791][ T6002] ? clear_bhb_loop+0x40/0x90 [ 1164.078819][ T6002] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1164.078841][ T6002] RIP: 0033:0x7fda4359ce59 [ 1164.078860][ T6002] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1164.078878][ T6002] RSP: 002b:00007fda44471028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 1164.078900][ T6002] RAX: ffffffffffffffda RBX: 00007fda43815fa0 RCX: 00007fda4359ce59 [ 1164.078916][ T6002] RDX: 0000000000000000 RSI: 0000200000000280 RDI: 0000000000000003 [ 1164.078928][ T6002] RBP: 00007fda44471090 R08: 0000000000000000 R09: 0000000000000000 [ 1164.078941][ T6002] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1164.078953][ T6002] R13: 00007fda43816038 R14: 00007fda43815fa0 R15: 00007ffc146bf3a8 [ 1164.078987][ T6002] [ 1164.145338][ T6003] ipip1: entered promiscuous mode [ 1164.390612][ T6007] netlink: 12 bytes leftover after parsing attributes in process `syz.1.8364'. [ 1164.938675][ T6030] tipc: Enabling of bearer rejected, failed to enable media [ 1164.974369][ T6026] netlink: 4 bytes leftover after parsing attributes in process `syz.4.8368'. [ 1164.998960][ T6026] netlink: 4 bytes leftover after parsing attributes in process `syz.4.8368'. [ 1165.024950][ T6026] netlink: 8 bytes leftover after parsing attributes in process `syz.4.8368'. [ 1165.258100][ T6040] veth1_to_hsr: left allmulticast mode [ 1165.423302][ T6040] mac80211_hwsim hwsim137 wlan0: left promiscuous mode [ 1165.459823][ T6040] gtp0: left promiscuous mode [ 1165.473461][ T6040] gtp0: left allmulticast mode [ 1165.531998][ T6040] veth9: left promiscuous mode [ 1165.549414][ T6040] veth11: left promiscuous mode [ 1165.572434][ T6040] gre2: left allmulticast mode [ 1165.597986][ T6040] bond6: left promiscuous mode [ 1165.607665][ T6040] bridge5: left promiscuous mode [ 1165.629948][ T6040] bond8: left promiscuous mode [ 1165.639934][ T6040] bond8: left allmulticast mode [ 1165.653161][ T6040] ip6gre1: left promiscuous mode [ 1165.679030][ T6040] ip6gre1: left allmulticast mode [ 1165.693429][ T6040] bond9: left promiscuous mode [ 1165.702747][ T6040] ip6gre2: left promiscuous mode [ 1165.724471][ T6040] ipip0: left promiscuous mode [ 1165.755102][ T6040] ipip1: left promiscuous mode [ 1165.949901][ T6060] FAULT_INJECTION: forcing a failure. [ 1165.949901][ T6060] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1165.998144][ T6060] CPU: 0 UID: 0 PID: 6060 Comm: syz.1.8376 Not tainted syzkaller #0 PREEMPT(full) [ 1165.998175][ T6060] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 1165.998189][ T6060] Call Trace: [ 1165.998198][ T6060] [ 1165.998208][ T6060] dump_stack_lvl+0xe8/0x150 [ 1165.998241][ T6060] should_fail_ex+0x412/0x560 [ 1165.998273][ T6060] _copy_to_user+0x31/0xb0 [ 1165.998305][ T6060] simple_read_from_buffer+0xe1/0x170 [ 1165.998339][ T6060] proc_fail_nth_read+0x1bb/0x230 [ 1165.998375][ T6060] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 1165.998409][ T6060] ? rw_verify_area+0x2a6/0x4d0 [ 1165.998449][ T6060] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 1165.998481][ T6060] vfs_read+0x20c/0xa70 [ 1165.998520][ T6060] ? __pfx___mutex_lock+0x10/0x10 [ 1165.998548][ T6060] ? __pfx_vfs_read+0x10/0x10 [ 1165.998583][ T6060] ? __fget_files+0x2a/0x420 [ 1165.998617][ T6060] ? __fget_files+0x3a0/0x420 [ 1165.998644][ T6060] ? __fget_files+0x2a/0x420 [ 1165.998683][ T6060] ksys_read+0x150/0x270 [ 1165.998718][ T6060] ? __pfx_ksys_read+0x10/0x10 [ 1165.998760][ T6060] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1165.998786][ T6060] do_syscall_64+0x174/0x580 [ 1165.998809][ T6060] ? trace_irq_disable+0x3b/0x140 [ 1165.998843][ T6060] ? clear_bhb_loop+0x40/0x90 [ 1165.998871][ T6060] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1165.998894][ T6060] RIP: 0033:0x7f0d4ad5d68e [ 1165.998916][ T6060] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 1165.998936][ T6060] RSP: 002b:00007f0d4bbccfe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 1165.998961][ T6060] RAX: ffffffffffffffda RBX: 00007f0d4bbcd6c0 RCX: 00007f0d4ad5d68e [ 1165.998978][ T6060] RDX: 000000000000000f RSI: 00007f0d4bbcd0a0 RDI: 0000000000000004 [ 1165.998993][ T6060] RBP: 00007f0d4bbcd090 R08: 0000000000000000 R09: 0000000000000000 [ 1165.999007][ T6060] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1165.999020][ T6060] R13: 00007f0d4b016038 R14: 00007f0d4b015fa0 R15: 00007ffc2e9a89d8 [ 1165.999057][ T6060] [ 1166.235237][ T6064] FAULT_INJECTION: forcing a failure. [ 1166.235237][ T6064] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1166.256802][ T6064] CPU: 1 UID: 0 PID: 6064 Comm: syz.2.8378 Not tainted syzkaller #0 PREEMPT(full) [ 1166.256832][ T6064] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 1166.256847][ T6064] Call Trace: [ 1166.256856][ T6064] [ 1166.256866][ T6064] dump_stack_lvl+0xe8/0x150 [ 1166.256898][ T6064] should_fail_ex+0x412/0x560 [ 1166.256936][ T6064] _copy_to_user+0x31/0xb0 [ 1166.256966][ T6064] simple_read_from_buffer+0xe1/0x170 [ 1166.257001][ T6064] proc_fail_nth_read+0x1bb/0x230 [ 1166.257036][ T6064] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 1166.257070][ T6064] ? rw_verify_area+0x2a6/0x4d0 [ 1166.257102][ T6064] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 1166.257134][ T6064] vfs_read+0x20c/0xa70 [ 1166.257173][ T6064] ? __pfx___mutex_lock+0x10/0x10 [ 1166.257200][ T6064] ? __pfx_vfs_read+0x10/0x10 [ 1166.257235][ T6064] ? __fget_files+0x2a/0x420 [ 1166.257268][ T6064] ? __fget_files+0x3a0/0x420 [ 1166.257294][ T6064] ? __fget_files+0x2a/0x420 [ 1166.257333][ T6064] ksys_read+0x150/0x270 [ 1166.257368][ T6064] ? __pfx_ksys_read+0x10/0x10 [ 1166.257411][ T6064] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1166.257440][ T6064] do_syscall_64+0x174/0x580 [ 1166.257463][ T6064] ? trace_irq_disable+0x3b/0x140 [ 1166.257497][ T6064] ? clear_bhb_loop+0x40/0x90 [ 1166.257526][ T6064] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1166.257549][ T6064] RIP: 0033:0x7fda4355d68e [ 1166.257569][ T6064] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 1166.257588][ T6064] RSP: 002b:00007fda44470fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 1166.257611][ T6064] RAX: ffffffffffffffda RBX: 00007fda444716c0 RCX: 00007fda4355d68e [ 1166.257628][ T6064] RDX: 000000000000000f RSI: 00007fda444710a0 RDI: 0000000000000004 [ 1166.257643][ T6064] RBP: 00007fda44471090 R08: 0000000000000000 R09: 0000000000000000 [ 1166.257657][ T6064] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1166.257670][ T6064] R13: 00007fda43816038 R14: 00007fda43815fa0 R15: 00007ffc146bf3a8 [ 1166.257707][ T6064] [ 1166.545264][ T6070] FAULT_INJECTION: forcing a failure. [ 1166.545264][ T6070] name failslab, interval 1, probability 0, space 0, times 0 [ 1166.599818][ T6070] CPU: 1 UID: 0 PID: 6070 Comm: syz.1.8380 Not tainted syzkaller #0 PREEMPT(full) [ 1166.599849][ T6070] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 1166.599864][ T6070] Call Trace: [ 1166.599873][ T6070] [ 1166.599883][ T6070] dump_stack_lvl+0xe8/0x150 [ 1166.599914][ T6070] should_fail_ex+0x412/0x560 [ 1166.599944][ T6070] should_failslab+0xa8/0x100 [ 1166.599967][ T6070] ? skb_clone+0x212/0x3a0 [ 1166.599994][ T6070] kmem_cache_alloc_noprof+0x87/0x650 [ 1166.600036][ T6070] skb_clone+0x212/0x3a0 [ 1166.600067][ T6070] __netlink_deliver_tap+0x404/0x850 [ 1166.600109][ T6070] ? netlink_deliver_tap+0x2e/0x1b0 [ 1166.600138][ T6070] netlink_deliver_tap+0x19c/0x1b0 [ 1166.600167][ T6070] __netlink_sendskb+0x47/0x90 [ 1166.600192][ T6070] netlink_dump+0xa0f/0xe10 [ 1166.600232][ T6070] ? __pfx_netlink_dump+0x10/0x10 [ 1166.600273][ T6070] ? netlink_lookup+0x30/0x200 [ 1166.600297][ T6070] ? netlink_lookup+0x30/0x200 [ 1166.600320][ T6070] ? netlink_lookup+0x30/0x200 [ 1166.600359][ T6070] __netlink_dump_start+0x5cb/0x7e0 [ 1166.600396][ T6070] rtnetlink_rcv_msg+0xa3a/0xbe0 [ 1166.600421][ T6070] ? __pfx_neigh_dump_info+0x10/0x10 [ 1166.600449][ T6070] ? rtnetlink_rcv_msg+0x1b9/0xbe0 [ 1166.600472][ T6070] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 1166.600493][ T6070] ? ref_tracker_free+0x693/0x840 [ 1166.600517][ T6070] ? __pfx_neigh_dump_info+0x10/0x10 [ 1166.600562][ T6070] netlink_rcv_skb+0x232/0x4b0 [ 1166.600590][ T6070] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 1166.600615][ T6070] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 1166.600657][ T6070] ? netlink_deliver_tap+0x2e/0x1b0 [ 1166.600684][ T6070] ? netlink_deliver_tap+0x2e/0x1b0 [ 1166.600718][ T6070] netlink_unicast+0x75c/0x8e0 [ 1166.600755][ T6070] netlink_sendmsg+0x813/0xb40 [ 1166.600793][ T6070] ? __pfx_netlink_sendmsg+0x10/0x10 [ 1166.600825][ T6070] ? aa_sock_msg_perm+0xf1/0x1b0 [ 1166.600862][ T6070] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 1166.600897][ T6070] ____sys_sendmsg+0x972/0x9f0 [ 1166.600924][ T6070] ? __might_fault+0xaf/0x130 [ 1166.600962][ T6070] ? __pfx_____sys_sendmsg+0x10/0x10 [ 1166.601000][ T6070] ? import_iovec+0x73/0xa0 [ 1166.601032][ T6070] ___sys_sendmsg+0x2a5/0x360 [ 1166.601057][ T6070] ? __lock_acquire+0x6b5/0x2cf0 [ 1166.601087][ T6070] ? __pfx____sys_sendmsg+0x10/0x10 [ 1166.601156][ T6070] ? __fget_files+0x2a/0x420 [ 1166.601183][ T6070] ? __fget_files+0x3a0/0x420 [ 1166.601222][ T6070] __x64_sys_sendmsg+0x1bd/0x2a0 [ 1166.601253][ T6070] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 1166.601291][ T6070] ? __pfx_ksys_write+0x10/0x10 [ 1166.601335][ T6070] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1166.601367][ T6070] do_syscall_64+0x174/0x580 [ 1166.601395][ T6070] ? clear_bhb_loop+0x40/0x90 [ 1166.601423][ T6070] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1166.601445][ T6070] RIP: 0033:0x7f0d4ad9ce59 [ 1166.601466][ T6070] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1166.601485][ T6070] RSP: 002b:00007f0d4bbcd028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 1166.601509][ T6070] RAX: ffffffffffffffda RBX: 00007f0d4b015fa0 RCX: 00007f0d4ad9ce59 [ 1166.601526][ T6070] RDX: 0000000000000000 RSI: 0000200000000040 RDI: 0000000000000003 [ 1166.601541][ T6070] RBP: 00007f0d4bbcd090 R08: 0000000000000000 R09: 0000000000000000 [ 1166.601555][ T6070] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1166.601568][ T6070] R13: 00007f0d4b016038 R14: 00007f0d4b015fa0 R15: 00007ffc2e9a89d8 [ 1166.601605][ T6070] [ 1167.011599][ T6068] netlink: 'syz.5.8379': attribute type 4 has an invalid length. [ 1167.136896][ T6078] netlink: 'syz.1.8383': attribute type 1 has an invalid length. [ 1167.257806][ T6083] pim6reg1: entered promiscuous mode [ 1167.263200][ T6083] pim6reg1: entered allmulticast mode [ 1167.385081][ T6085] __nla_validate_parse: 4 callbacks suppressed [ 1167.385104][ T6085] netlink: 8 bytes leftover after parsing attributes in process `syz.5.8386'. [ 1167.524763][ T6088] tipc: Started in network mode [ 1167.530437][ T6088] tipc: Node identity a6b9dca5d5ef, cluster identity 4711 [ 1167.538731][ T6088] tipc: Enabled bearer , priority 0 [ 1167.550772][ T6088] syzkaller0: entered promiscuous mode [ 1167.557155][ T6088] syzkaller0: entered allmulticast mode [ 1167.712630][T10312] net_ratelimit: 17 callbacks suppressed [ 1167.712654][T10312] bond1: (slave bridge1): failed to get link speed/duplex [ 1167.867567][ T2736] bond1: (slave bridge1): failed to get link speed/duplex [ 1167.976975][ T2736] bond1: (slave bridge1): failed to get link speed/duplex [ 1168.087086][T10312] bond1: (slave bridge1): failed to get link speed/duplex [ 1168.129031][ T6112] netlink: 68 bytes leftover after parsing attributes in process `syz.4.8396'. [ 1168.162449][ T6112] Cannot find add_set index 2 as target [ 1168.196080][ T6114] FAULT_INJECTION: forcing a failure. [ 1168.196080][ T6114] name fail_page_alloc, interval 1, probability 0, space 0, times 0 [ 1168.210096][ T6114] CPU: 0 UID: 0 PID: 6114 Comm: syz.2.8397 Not tainted syzkaller #0 PREEMPT(full) [ 1168.210126][ T6114] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 1168.210140][ T6114] Call Trace: [ 1168.210149][ T6114] [ 1168.210159][ T6114] dump_stack_lvl+0xe8/0x150 [ 1168.210191][ T6114] should_fail_ex+0x412/0x560 [ 1168.210221][ T6114] prepare_alloc_pages+0x22a/0x650 [ 1168.210265][ T6114] __alloc_frozen_pages_noprof+0x12f/0x380 [ 1168.210294][ T6114] ? __pfx___alloc_frozen_pages_noprof+0x10/0x10 [ 1168.210334][ T6114] ? __pfx_policy_nodemask+0x10/0x10 [ 1168.210357][ T6114] ? trace_kmalloc+0x2a/0xf0 [ 1168.210387][ T6114] ? __pfx__copy_from_iter+0x10/0x10 [ 1168.210416][ T6114] alloc_pages_mpol+0x235/0x490 [ 1168.210445][ T6114] alloc_pages_noprof+0xac/0x2a0 [ 1168.210471][ T6114] af_alg_sendmsg+0x1446/0x2650 [ 1168.210519][ T6114] ? __pfx_af_alg_sendmsg+0x10/0x10 [ 1168.210541][ T6114] ? __pfx_aa_sk_perm+0x10/0x10 [ 1168.210570][ T6114] ? tomoyo_socket_sendmsg_permission+0x1e0/0x300 [ 1168.210613][ T6114] ? aa_sock_msg_perm+0xf1/0x1b0 [ 1168.210648][ T6114] ? skcipher_sendmsg+0x26/0xf0 [ 1168.210677][ T6114] ____sys_sendmsg+0x972/0x9f0 [ 1168.210705][ T6114] ? __might_fault+0xaf/0x130 [ 1168.210742][ T6114] ? __pfx_____sys_sendmsg+0x10/0x10 [ 1168.210789][ T6114] ? import_iovec+0x73/0xa0 [ 1168.210821][ T6114] ___sys_sendmsg+0x2a5/0x360 [ 1168.210846][ T6114] ? __lock_acquire+0x6b5/0x2cf0 [ 1168.210876][ T6114] ? __pfx____sys_sendmsg+0x10/0x10 [ 1168.210912][ T6114] ? kstrtouint+0x6e/0xe0 [ 1168.210977][ T6114] ? __fget_files+0x2a/0x420 [ 1168.211005][ T6114] ? __fget_files+0x3a0/0x420 [ 1168.211046][ T6114] __sys_sendmmsg+0x27c/0x4e0 [ 1168.211080][ T6114] ? __pfx___sys_sendmmsg+0x10/0x10 [ 1168.211104][ T6114] ? __mutex_unlock_slowpath+0x1be/0x6f0 [ 1168.211168][ T6114] ? rcu_is_watching+0x15/0xb0 [ 1168.211204][ T6114] __x64_sys_sendmmsg+0xa0/0xc0 [ 1168.211231][ T6114] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1168.211256][ T6114] do_syscall_64+0x174/0x580 [ 1168.211279][ T6114] ? trace_irq_disable+0x3b/0x140 [ 1168.211312][ T6114] ? clear_bhb_loop+0x40/0x90 [ 1168.211339][ T6114] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1168.211362][ T6114] RIP: 0033:0x7fda4359ce59 [ 1168.211383][ T6114] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1168.211401][ T6114] RSP: 002b:00007fda44471028 EFLAGS: 00000246 ORIG_RAX: 0000000000000133 [ 1168.211423][ T6114] RAX: ffffffffffffffda RBX: 00007fda43815fa0 RCX: 00007fda4359ce59 [ 1168.211439][ T6114] RDX: 0000000000000002 RSI: 00002000000007c0 RDI: 0000000000000005 [ 1168.211453][ T6114] RBP: 00007fda44471090 R08: 0000000000000000 R09: 0000000000000000 [ 1168.211467][ T6114] R10: 0000000000040800 R11: 0000000000000246 R12: 0000000000000002 [ 1168.211480][ T6114] R13: 00007fda43816038 R14: 00007fda43815fa0 R15: 00007ffc146bf3a8 [ 1168.211517][ T6114] [ 1168.252393][ T6112] bond6: invalid ARP target 0.0.0.0 specified for addition [ 1168.527132][ T6112] bond6: option arp_ip_target: invalid value (0) [ 1168.535251][ T6112] bond6 (unregistering): Released all slaves [ 1168.563241][ T6084] tipc: Resetting bearer [ 1168.593476][ T6084] tipc: Disabling bearer [ 1168.630500][ T6027] tipc: Node number set to 1935072421 [ 1168.647134][T10319] bond1: (slave bridge1): failed to get link speed/duplex [ 1168.796334][T10312] bond1: (slave bridge1): failed to get link speed/duplex [ 1168.811048][ T6127] netlink: 20 bytes leftover after parsing attributes in process `syz.1.8400'. [ 1168.915978][T10312] bond1: (slave bridge1): failed to get link speed/duplex [ 1169.058069][ T2736] bond1: (slave bridge1): failed to get link speed/duplex [ 1169.084297][ T6143] netlink: 8 bytes leftover after parsing attributes in process `syz.4.8405'. [ 1169.187043][T10319] bond1: (slave bridge1): failed to get link speed/duplex [ 1169.297713][T10312] bond1: (slave bridge1): failed to get link speed/duplex [ 1169.487431][ T6166] netlink: 'syz.4.8411': attribute type 1 has an invalid length. [ 1169.513544][ T6166] 8021q: adding VLAN 0 to HW filter on device bond6 [ 1169.549625][ T6166] bond6: (slave veth17): Enslaving as an active interface with a down link [ 1169.569027][ T6166] 8021q: adding VLAN 0 to HW filter on device batadv2 [ 1169.581010][ T6166] bond6: (slave batadv2): making interface the new active one [ 1169.590491][ T6166] batadv2: entered promiscuous mode [ 1169.596249][ T6166] bond6: (slave batadv2): Enslaving as an active interface with an up link [ 1169.896483][ T6174] =v: renamed from veth0_to_bond (while UP) [ 1171.003205][ T6186] x_tables: ip_tables: DNAT target: used from hooks POSTROUTING, but only usable from PREROUTING/OUTPUT [ 1171.939965][ T6135] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 1172.073699][ T6188] FAULT_INJECTION: forcing a failure. [ 1172.073699][ T6188] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1172.107034][ T6188] CPU: 1 UID: 0 PID: 6188 Comm: syz.2.8418 Not tainted syzkaller #0 PREEMPT(full) [ 1172.107066][ T6188] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 1172.107081][ T6188] Call Trace: [ 1172.107090][ T6188] [ 1172.107100][ T6188] dump_stack_lvl+0xe8/0x150 [ 1172.107132][ T6188] should_fail_ex+0x412/0x560 [ 1172.107169][ T6188] _copy_from_iter+0x3b0/0x1670 [ 1172.107217][ T6188] ? trace_kmalloc+0x2a/0xf0 [ 1172.107250][ T6188] ? __pfx__copy_from_iter+0x10/0x10 [ 1172.107297][ T6188] ? alloc_pages_mpol+0x3c0/0x490 [ 1172.107333][ T6188] af_alg_sendmsg+0x1552/0x2650 [ 1172.107382][ T6188] ? __pfx_af_alg_sendmsg+0x10/0x10 [ 1172.107406][ T6188] ? __pfx_aa_sk_perm+0x10/0x10 [ 1172.107435][ T6188] ? tomoyo_socket_sendmsg_permission+0x1e0/0x300 [ 1172.107480][ T6188] ? aa_sock_msg_perm+0xf1/0x1b0 [ 1172.107515][ T6188] ? skcipher_sendmsg+0x26/0xf0 [ 1172.107545][ T6188] ____sys_sendmsg+0x972/0x9f0 [ 1172.107572][ T6188] ? __might_fault+0xaf/0x130 [ 1172.107608][ T6188] ? __pfx_____sys_sendmsg+0x10/0x10 [ 1172.107645][ T6188] ? import_iovec+0x73/0xa0 [ 1172.107676][ T6188] ___sys_sendmsg+0x2a5/0x360 [ 1172.107701][ T6188] ? __lock_acquire+0x6b5/0x2cf0 [ 1172.107731][ T6188] ? __pfx____sys_sendmsg+0x10/0x10 [ 1172.107764][ T6188] ? kstrtouint+0x6e/0xe0 [ 1172.107828][ T6188] ? __fget_files+0x2a/0x420 [ 1172.107855][ T6188] ? __fget_files+0x3a0/0x420 [ 1172.107895][ T6188] __sys_sendmmsg+0x27c/0x4e0 [ 1172.107938][ T6188] ? __pfx___sys_sendmmsg+0x10/0x10 [ 1172.107962][ T6188] ? __mutex_unlock_slowpath+0x1be/0x6f0 [ 1172.108019][ T6188] ? ksys_write+0x242/0x270 [ 1172.108055][ T6188] ? __pfx_ksys_write+0x10/0x10 [ 1172.108096][ T6188] __x64_sys_sendmmsg+0xa0/0xc0 [ 1172.108124][ T6188] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1172.108149][ T6188] do_syscall_64+0x174/0x580 [ 1172.108173][ T6188] ? trace_irq_disable+0x3b/0x140 [ 1172.108206][ T6188] ? clear_bhb_loop+0x40/0x90 [ 1172.108234][ T6188] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1172.108257][ T6188] RIP: 0033:0x7fda4359ce59 [ 1172.108277][ T6188] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1172.108296][ T6188] RSP: 002b:00007fda44471028 EFLAGS: 00000246 ORIG_RAX: 0000000000000133 [ 1172.108319][ T6188] RAX: ffffffffffffffda RBX: 00007fda43815fa0 RCX: 00007fda4359ce59 [ 1172.108336][ T6188] RDX: 0000000000000002 RSI: 00002000000007c0 RDI: 0000000000000005 [ 1172.108350][ T6188] RBP: 00007fda44471090 R08: 0000000000000000 R09: 0000000000000000 [ 1172.108364][ T6188] R10: 0000000000040800 R11: 0000000000000246 R12: 0000000000000002 [ 1172.108378][ T6188] R13: 00007fda43816038 R14: 00007fda43815fa0 R15: 00007ffc146bf3a8 [ 1172.108414][ T6188] [ 1172.452648][ T6198] netlink: 24 bytes leftover after parsing attributes in process `syz.3.8419'. [ 1172.569563][ T6205] netlink: 12 bytes leftover after parsing attributes in process `syz.5.8423'. [ 1172.579494][ T6205] netlink: 16 bytes leftover after parsing attributes in process `syz.5.8423'. [ 1172.589855][ T6205] tc_dump_action: action bad kind [ 1172.732714][ T6210] netlink: 175008 bytes leftover after parsing attributes in process `syz.4.8425'. [ 1172.776588][T10337] net_ratelimit: 28 callbacks suppressed [ 1172.776610][T10337] bond1: (slave bridge1): failed to get link speed/duplex [ 1172.906804][T10290] bond1: (slave bridge1): failed to get link speed/duplex [ 1172.933105][ T6219] netlink: 'syz.5.8430': attribute type 27 has an invalid length. [ 1172.961383][ T6221] netlink: 8 bytes leftover after parsing attributes in process `syz.3.8429'. [ 1172.963650][ T6224] netlink: 8 bytes leftover after parsing attributes in process `syz.3.8429'. [ 1173.016471][ T2736] bond1: (slave bridge1): failed to get link speed/duplex [ 1173.022397][ T6221] netlink: 32 bytes leftover after parsing attributes in process `syz.3.8429'. [ 1173.150186][ T6238] openvswitch: netlink: IPv4 tun info is not correct [ 1173.306471][T10337] bond1: (slave bridge1): failed to get link speed/duplex [ 1173.432050][ T6246] netlink: 207952 bytes leftover after parsing attributes in process `syz.3.8436'. [ 1173.446674][T10337] bond1: (slave bridge1): failed to get link speed/duplex [ 1173.557888][T10319] bond1: (slave bridge1): failed to get link speed/duplex [ 1173.651614][ T6260] netlink: 244 bytes leftover after parsing attributes in process `syz.2.8439'. [ 1173.696110][T10319] bond1: (slave bridge1): failed to get link speed/duplex [ 1173.817466][T10290] bond1: (slave bridge1): failed to get link speed/duplex [ 1173.903197][ T6266] FAULT_INJECTION: forcing a failure. [ 1173.903197][ T6266] name fail_page_alloc, interval 1, probability 0, space 0, times 0 [ 1173.905651][ T4953] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 1173.918955][ T6266] CPU: 0 UID: 0 PID: 6266 Comm: syz.4.8443 Not tainted syzkaller #0 PREEMPT(full) [ 1173.919028][ T6266] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 1173.919068][ T6266] Call Trace: [ 1173.919091][ T6266] [ 1173.919121][ T6266] dump_stack_lvl+0xe8/0x150 [ 1173.919205][ T6266] should_fail_ex+0x412/0x560 [ 1173.919285][ T6266] prepare_alloc_pages+0x22a/0x650 [ 1173.919400][ T6266] __alloc_frozen_pages_noprof+0x12f/0x380 [ 1173.919475][ T6266] ? __pfx___alloc_frozen_pages_noprof+0x10/0x10 [ 1173.919587][ T6266] ? __pfx_policy_nodemask+0x10/0x10 [ 1173.919662][ T6266] ? trace_kmalloc+0x2a/0xf0 [ 1173.919766][ T6266] ? __pfx__copy_from_iter+0x10/0x10 [ 1173.919849][ T6266] alloc_pages_mpol+0x235/0x490 [ 1173.919929][ T6266] alloc_pages_noprof+0xac/0x2a0 [ 1173.919979][ T6266] af_alg_sendmsg+0x1446/0x2650 [ 1173.920106][ T6266] ? __pfx_af_alg_sendmsg+0x10/0x10 [ 1173.920162][ T6266] ? __pfx_aa_sk_perm+0x10/0x10 [ 1173.920243][ T6266] ? tomoyo_socket_sendmsg_permission+0x1e0/0x300 [ 1173.920334][ T6266] ? aa_sock_msg_perm+0xf1/0x1b0 [ 1173.920435][ T6266] ? skcipher_sendmsg+0x26/0xf0 [ 1173.920509][ T6266] ____sys_sendmsg+0x972/0x9f0 [ 1173.920582][ T6266] ? __might_fault+0xaf/0x130 [ 1173.920677][ T6266] ? __pfx_____sys_sendmsg+0x10/0x10 [ 1173.920780][ T6266] ? import_iovec+0x73/0xa0 [ 1173.920862][ T6266] ___sys_sendmsg+0x2a5/0x360 [ 1173.920933][ T6266] ? __lock_acquire+0x6b5/0x2cf0 [ 1173.921014][ T6266] ? __pfx____sys_sendmsg+0x10/0x10 [ 1173.921145][ T6266] ? kstrtouint+0x6e/0xe0 [ 1173.921352][ T6266] ? __fget_files+0x2a/0x420 [ 1173.921426][ T6266] ? __fget_files+0x3a0/0x420 [ 1173.921537][ T6266] __sys_sendmmsg+0x27c/0x4e0 [ 1173.921623][ T6266] ? __pfx___sys_sendmmsg+0x10/0x10 [ 1173.921686][ T6266] ? __mutex_unlock_slowpath+0x1be/0x6f0 [ 1173.921841][ T6266] ? ksys_write+0x242/0x270 [ 1173.921935][ T6266] ? __pfx_ksys_write+0x10/0x10 [ 1173.922045][ T6266] __x64_sys_sendmmsg+0xa0/0xc0 [ 1173.922111][ T6266] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1173.922174][ T6266] do_syscall_64+0x174/0x580 [ 1173.922260][ T6266] ? clear_bhb_loop+0x40/0x90 [ 1173.922335][ T6266] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1173.922403][ T6266] RIP: 0033:0x7fc4fcd9ce59 [ 1173.922477][ T6266] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1173.922534][ T6266] RSP: 002b:00007fc4fdbe5028 EFLAGS: 00000246 ORIG_RAX: 0000000000000133 [ 1173.922598][ T6266] RAX: ffffffffffffffda RBX: 00007fc4fd015fa0 RCX: 00007fc4fcd9ce59 [ 1173.922640][ T6266] RDX: 0000000000000002 RSI: 00002000000007c0 RDI: 0000000000000005 [ 1173.922680][ T6266] RBP: 00007fc4fdbe5090 R08: 0000000000000000 R09: 0000000000000000 [ 1173.922720][ T6266] R10: 0000000000040800 R11: 0000000000000246 R12: 0000000000000002 [ 1173.922761][ T6266] R13: 00007fc4fd016038 R14: 00007fc4fd015fa0 R15: 00007fff3cdf4648 [ 1173.922855][ T6266] [ 1174.007319][T10308] bond1: (slave bridge1): failed to get link speed/duplex [ 1174.222041][ T6271] xt_policy: too many policy elements [ 1174.242701][ T4953] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 1174.252487][ T4953] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 1174.262285][ T4953] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 1174.277379][ T4953] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 1174.284343][ T6272] netlink: 16 bytes leftover after parsing attributes in process `syz.5.8444'. [ 1174.872115][ T6297] netlink: 'syz.4.8451': attribute type 4 has an invalid length. [ 1174.890774][ T6296] syzkaller1: tun_chr_ioctl cmd 1074025677 [ 1174.908993][ T6296] syzkaller1: linktype set to 825 [ 1174.929353][ T6299] netlink: 'syz.4.8451': attribute type 4 has an invalid length. [ 1175.015223][T10308] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1175.043712][T10308] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1175.195510][ T6311] Cannot find del_set index 1536 as target [ 1175.349929][ T6310] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 1175.491264][ T6319] xt_CHECKSUM: CHECKSUM should be avoided. If really needed, restrict with "-p udp" and only use in OUTPUT [ 1175.524231][ T6319] ipt_ECN: cannot use operation on non-tcp rule [ 1176.267129][ T6350] Cannot find del_set index 1792 as target [ 1176.346117][T31476] Bluetooth: hci3: command tx timeout [ 1176.449842][ T6355] batadv_slave_1: entered promiscuous mode [ 1176.724673][ T6268] bridge0: port 1(bridge_slave_0) entered blocking state [ 1176.734335][ T6268] bridge0: port 1(bridge_slave_0) entered disabled state [ 1176.744112][ T6268] bridge_slave_0: entered allmulticast mode [ 1176.758539][ T6268] bridge_slave_0: entered promiscuous mode [ 1176.768972][ T6268] bridge0: port 2(bridge_slave_1) entered blocking state [ 1176.787422][ T6268] bridge0: port 2(bridge_slave_1) entered disabled state [ 1176.794865][ T6268] bridge_slave_1: entered allmulticast mode [ 1176.804079][ T6268] bridge_slave_1: entered promiscuous mode [ 1176.892587][ T6268] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 1176.911374][ T6268] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 1176.987466][ T6268] team0: Port device team_slave_0 added [ 1177.007319][ T6268] team0: Port device team_slave_1 added [ 1177.018462][ T6373] tipc: New replicast peer: 255.255.255.255 [ 1177.025473][ T6373] tipc: Enabled bearer , priority 5 [ 1177.087242][ T6373] netlink: 'syz.1.8470': attribute type 1 has an invalid length. [ 1177.088728][ T6268] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 1177.109754][ T6268] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 1177.137833][ T6268] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 1177.188325][ T6376] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 1177.240827][ T6389] sctp: [Deprecated]: syz.2.8474 (pid 6389) Use of struct sctp_assoc_value in delayed_ack socket option. [ 1177.240827][ T6389] Use struct sctp_sack_info instead [ 1177.280726][ T6373] bond4: entered promiscuous mode [ 1177.297808][ T6373] 8021q: adding VLAN 0 to HW filter on device bond4 [ 1177.350292][ T6268] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 1177.358593][ T6268] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 1177.386736][ T6268] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 1177.399258][ T6378] bond4: entered allmulticast mode [ 1177.484274][ T6391] Cannot find del_set index 15104 as target [ 1177.539474][ T6268] hsr_slave_0: entered promiscuous mode [ 1177.559150][ T6268] hsr_slave_1: entered promiscuous mode [ 1177.575600][ T6268] debugfs: 'hsr0' already exists in 'hsr' [ 1177.582077][ T6268] Cannot create hsr debugfs directory [ 1177.867283][ T2736] wlan1: Trigger new scan to find an IBSS to join [ 1177.910964][ T6411] __nla_validate_parse: 10 callbacks suppressed [ 1177.910984][ T6411] netlink: 7 bytes leftover after parsing attributes in process `syz.4.8481'. [ 1178.006578][T10337] net_ratelimit: 20 callbacks suppressed [ 1178.006601][T10337] bond1: (slave bridge1): failed to get link speed/duplex [ 1178.161231][ T6268] netdevsim netdevsim3 netdevsim3 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 1178.184457][ T5003] udevd[5003]: worker [28837] /devices/virtual/block/nbd6 timeout; kill it [ 1178.209143][ T5003] udevd[5003]: seq 48663 '/devices/virtual/block/nbd6' killed [ 1178.217734][ T6268] netdevsim netdevsim3 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1178.228882][ T5003] udevd[5003]: worker [29823] /devices/virtual/block/nbd7 timeout; kill it [ 1178.244780][ T5003] udevd[5003]: seq 48689 '/devices/virtual/block/nbd7' killed [ 1178.255693][ T6433] netlink: 8 bytes leftover after parsing attributes in process `syz.2.8484'. [ 1178.277437][ T5003] udevd[5003]: worker [30414] /devices/virtual/block/nbd8 timeout; kill it [ 1178.292352][ T6418] batadv0: entered promiscuous mode [ 1178.293438][ T5003] udevd[5003]: seq 48711 '/devices/virtual/block/nbd8' killed [ 1178.323314][ T6027] tipc: Node number set to 1 [ 1178.427043][T31476] Bluetooth: hci3: command tx timeout [ 1178.475233][ T6268] netdevsim netdevsim3 netdevsim2 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 1178.500518][ T6268] netdevsim netdevsim3 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1178.577459][T10337] bond1: (slave bridge1): failed to get link speed/duplex [ 1178.757212][ T6268] netdevsim netdevsim3 netdevsim1 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 1178.780962][ T6268] netdevsim netdevsim3 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1178.888345][ T2736] bond1: (slave bridge1): failed to get link speed/duplex [ 1179.016278][ T6268] netdevsim netdevsim3 netdevsim0 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 1179.037203][ T6268] netdevsim netdevsim3 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1179.219221][ T6462] sit2: entered promiscuous mode [ 1179.228594][ T1635] block nbd6: Possible stuck request ffff888027c77000: control (read@0,2048B). Runtime 240 seconds [ 1179.239918][ T2736] bond1: (slave bridge1): failed to get link speed/duplex [ 1179.437336][ T2736] bond1: (slave bridge1): failed to get link speed/duplex [ 1179.797227][ T6477] bond5 (unregistering): Released all slaves [ 1180.126570][T10312] bond1: (slave bridge1): failed to get link speed/duplex [ 1180.155716][ T6268] netdevsim netdevsim3 netdevsim0: renamed from eth0 [ 1180.188149][ T6268] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 1180.206825][ T6268] netdevsim netdevsim3 netdevsim1: renamed from eth1 [ 1180.231268][ T6268] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 1180.251263][ T6268] netdevsim netdevsim3 netdevsim2: renamed from eth2 [ 1180.280506][ T6268] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 1180.297380][ T6268] netdevsim netdevsim3 netdevsim3: renamed from eth3 [ 1180.349859][ T6268] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 1180.377418][T10312] bond1: (slave bridge1): failed to get link speed/duplex [ 1180.506438][T31476] Bluetooth: hci3: command tx timeout [ 1180.512093][ T1635] block nbd7: Possible stuck request ffff888027cb5080: control (read@0,2048B). Runtime 240 seconds [ 1180.569257][ T2736] bond1: (slave bridge1): failed to get link speed/duplex [ 1180.631567][ T6268] 8021q: adding VLAN 0 to HW filter on device bond0 [ 1180.653362][ T6479] dvmrp0: entered allmulticast mode [ 1180.697063][ T6268] 8021q: adding VLAN 0 to HW filter on device team0 [ 1180.740590][T10312] bridge0: port 1(bridge_slave_0) entered blocking state [ 1180.747840][T10312] bridge0: port 1(bridge_slave_0) entered forwarding state [ 1180.782161][ T6505] FAULT_INJECTION: forcing a failure. [ 1180.782161][ T6505] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1180.796125][ T2736] bond1: (slave bridge1): failed to get link speed/duplex [ 1180.809991][T10312] bridge0: port 2(bridge_slave_1) entered blocking state [ 1180.817185][T10312] bridge0: port 2(bridge_slave_1) entered forwarding state [ 1180.829268][ T6505] CPU: 1 UID: 0 PID: 6505 Comm: syz.5.8505 Not tainted syzkaller #0 PREEMPT(full) [ 1180.829297][ T6505] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 1180.829311][ T6505] Call Trace: [ 1180.829320][ T6505] [ 1180.829330][ T6505] dump_stack_lvl+0xe8/0x150 [ 1180.829362][ T6505] should_fail_ex+0x412/0x560 [ 1180.829393][ T6505] _copy_to_user+0x31/0xb0 [ 1180.829424][ T6505] simple_read_from_buffer+0xe1/0x170 [ 1180.829468][ T6505] proc_fail_nth_read+0x1bb/0x230 [ 1180.829503][ T6505] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 1180.829537][ T6505] ? rw_verify_area+0x2a6/0x4d0 [ 1180.829569][ T6505] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 1180.829601][ T6505] vfs_read+0x20c/0xa70 [ 1180.829639][ T6505] ? __pfx___mutex_lock+0x10/0x10 [ 1180.829667][ T6505] ? __pfx_vfs_read+0x10/0x10 [ 1180.829702][ T6505] ? __fget_files+0x2a/0x420 [ 1180.829735][ T6505] ? __fget_files+0x3a0/0x420 [ 1180.829771][ T6505] ? __fget_files+0x2a/0x420 [ 1180.829809][ T6505] ksys_read+0x150/0x270 [ 1180.829845][ T6505] ? __pfx_ksys_read+0x10/0x10 [ 1180.829887][ T6505] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1180.829913][ T6505] do_syscall_64+0x174/0x580 [ 1180.829936][ T6505] ? trace_irq_disable+0x3b/0x140 [ 1180.829978][ T6505] ? clear_bhb_loop+0x40/0x90 [ 1180.830007][ T6505] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1180.830029][ T6505] RIP: 0033:0x7f9ff055d68e [ 1180.830050][ T6505] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 1180.830069][ T6505] RSP: 002b:00007f9ff13dcfe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 1180.830093][ T6505] RAX: ffffffffffffffda RBX: 00007f9ff13dd6c0 RCX: 00007f9ff055d68e [ 1180.830110][ T6505] RDX: 000000000000000f RSI: 00007f9ff13dd0a0 RDI: 0000000000000006 [ 1180.830124][ T6505] RBP: 00007f9ff13dd090 R08: 0000000000000000 R09: 0000000000000000 [ 1180.830139][ T6505] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1180.830153][ T6505] R13: 00007f9ff0816038 R14: 00007f9ff0815fa0 R15: 00007ffe2f4131c8 [ 1180.830191][ T6505] [ 1181.052212][T10290] wlan1: Trigger new scan to find an IBSS to join [ 1181.059783][T10290] batadv2: left promiscuous mode [ 1181.067255][T10290] bond1: (slave bridge1): failed to get link speed/duplex [ 1181.224399][ T6515] Cannot find map_set index 132 as target [ 1181.462630][ T6522] pim6reg1: entered allmulticast mode [ 1181.745740][ T6534] netlink: 'syz.2.8512': attribute type 1 has an invalid length. [ 1181.745738][ T6530] netlink: 'syz.2.8512': attribute type 1 has an invalid length. [ 1181.793508][ T6534] netlink: 'syz.2.8512': attribute type 1 has an invalid length. [ 1181.826360][ T6530] netlink: 'syz.2.8512': attribute type 1 has an invalid length. [ 1182.251847][ T6550] netlink: 16 bytes leftover after parsing attributes in process `syz.2.8517'. [ 1182.354045][ T6268] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 1182.567454][ T6268] veth0_vlan: entered promiscuous mode [ 1182.597453][T31476] Bluetooth: hci3: command tx timeout [ 1182.619004][ T6268] veth1_vlan: entered promiscuous mode [ 1182.811511][ T6268] veth0_macvtap: entered promiscuous mode [ 1182.851665][ T6268] veth1_macvtap: entered promiscuous mode [ 1182.941899][ T6268] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 1183.031623][ T6268] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 1183.069083][T10308] net_ratelimit: 13 callbacks suppressed [ 1183.069104][T10308] bond1: (slave bridge1): failed to get link speed/duplex [ 1183.087552][ T1667] block nbd8: Possible stuck request ffff888027ce5080: control (read@0,2048B). Runtime 240 seconds [ 1183.133723][T10319] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 1183.172832][T10308] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 1183.191036][T10308] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 1183.229887][T10308] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 1183.241099][T10308] bond1: (slave bridge1): failed to get link speed/duplex [ 1183.361900][T10308] bond1: (slave bridge1): failed to get link speed/duplex [ 1183.506914][ T6592] dvmrp0: entered allmulticast mode [ 1183.580897][ T6592] dvmrp8: entered allmulticast mode [ 1183.612853][ T6594] dvmrp0: left allmulticast mode [ 1183.700485][T10337] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1183.711562][T10319] bond1: (slave bridge1): failed to get link speed/duplex [ 1183.732032][T10337] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1183.870589][T10337] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1183.927050][T10337] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1183.936545][T10319] bond1: (slave bridge1): failed to get link speed/duplex [ 1183.967376][T10337] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1184.076535][ T2736] bond1: (slave bridge1): failed to get link speed/duplex [ 1184.102990][ T6612] netlink: 16186 bytes leftover after parsing attributes in process `syz.4.8533'. [ 1184.152229][ T6615] bridge0: entered allmulticast mode [ 1184.209823][T10337] bond1: (slave bridge1): failed to get link speed/duplex [ 1184.238281][ T6619] bridge_slave_1: left allmulticast mode [ 1184.254324][ T6619] bridge_slave_1: left promiscuous mode [ 1184.263119][ T6619] bridge0: port 2(bridge_slave_1) entered disabled state [ 1184.312128][ T6619] bridge_slave_0: left allmulticast mode [ 1184.335381][ T6619] bridge_slave_0: left promiscuous mode [ 1184.351058][ T6619] bridge0: port 1(bridge_slave_0) entered disabled state [ 1184.392350][ T6618] vlan0: entered allmulticast mode [ 1184.399714][ T6618] veth0_vlan: entered allmulticast mode [ 1184.418452][T10319] bond1: (slave bridge1): failed to get link speed/duplex [ 1184.501312][ T6636] netlink: 12 bytes leftover after parsing attributes in process `syz.2.8539'. [ 1184.546623][T10312] bond1: (slave bridge1): failed to get link speed/duplex [ 1184.663148][ T6641] netlink: 'syz.4.8541': attribute type 4 has an invalid length. [ 1184.689239][ T6641] netlink: 156 bytes leftover after parsing attributes in process `syz.4.8541'. [ 1184.699621][T10312] bond1: (slave bridge1): failed to get link speed/duplex [ 1184.719501][ T6642] syzkaller0: entered promiscuous mode [ 1184.737411][ T6642] syzkaller0: entered allmulticast mode [ 1184.990327][ T6661] macsec1: entered promiscuous mode [ 1185.003516][ T6666] netlink: 76 bytes leftover after parsing attributes in process `syz.5.8547'. [ 1185.083386][ T6667] netlink: 'syz.1.8548': attribute type 4 has an invalid length. [ 1185.140238][ T6667] netlink: 'syz.1.8548': attribute type 4 has an invalid length. [ 1185.508026][ T6690] netlink: 20 bytes leftover after parsing attributes in process `syz.4.8552'. [ 1186.423160][ T6718] netlink: 52 bytes leftover after parsing attributes in process `syz.2.8558'. [ 1186.479805][ T6707] syzkaller0: entered promiscuous mode [ 1186.513521][ T6707] syzkaller0: entered allmulticast mode [ 1186.526636][ T6721] IPv6: NLM_F_CREATE should be specified when creating new route [ 1187.090750][ T6748] netlink: 4 bytes leftover after parsing attributes in process `syz.1.8569'. [ 1187.178385][ T6752] netlink: 8 bytes leftover after parsing attributes in process `syz.4.8570'. [ 1187.190720][ T6027] IPVS: starting estimator thread 0... [ 1187.236603][ T6755] netlink: 'syz.1.8571': attribute type 1 has an invalid length. [ 1187.286180][ T6753] IPVS: using max 29 ests per chain, 69600 per kthread [ 1187.336173][ T6755] bond5: entered promiscuous mode [ 1187.341478][ T6755] bond5: entered allmulticast mode [ 1187.349047][ T6755] 8021q: adding VLAN 0 to HW filter on device bond5 [ 1187.372466][ T6756] erspan2: entered allmulticast mode [ 1187.395334][ T6756] bond5: (slave erspan2): making interface the new active one [ 1187.405168][ T6756] erspan2: entered promiscuous mode [ 1187.415714][ T6756] [ 1187.418089][ T6756] ====================================================== [ 1187.425128][ T6756] WARNING: possible circular locking dependency detected [ 1187.432184][ T6756] syzkaller #0 Not tainted [ 1187.436629][ T6756] ------------------------------------------------------ [ 1187.443678][ T6756] syz.1.8571/6756 is trying to acquire lock: [ 1187.449682][ T6756] ffff88806a49cff0 (&hsr->seqnr_lock){+.-.}-{3:3}, at: hsr_dev_xmit+0x237/0x360 [ 1187.458946][ T6756] [ 1187.458946][ T6756] but task is already holding lock: [ 1187.466463][ T6756] ffff888093660d58 (&qdisc_xmit_lock_key#4){+.-.}-{3:3}, at: sch_direct_xmit+0x15f/0x4c0 [ 1187.476434][ T6756] [ 1187.476434][ T6756] which lock already depends on the new lock. [ 1187.476434][ T6756] [ 1187.486857][ T6756] [ 1187.486857][ T6756] the existing dependency chain (in reverse order) is: [ 1187.495890][ T6756] [ 1187.495890][ T6756] -> #1 (&qdisc_xmit_lock_key#4){+.-.}-{3:3}: [ 1187.504177][ T6756] _raw_spin_lock+0x2e/0x40 [ 1187.509233][ T6756] sch_direct_xmit+0x15f/0x4c0 [ 1187.514532][ T6756] __dev_queue_xmit+0x180f/0x3950 [ 1187.520103][ T6756] hsr_forward_skb+0x166e/0x2a70 [ 1187.525592][ T6756] hsr_dev_xmit+0x242/0x360 [ 1187.530650][ T6756] dev_hard_start_xmit+0x2cd/0x830 [ 1187.536317][ T6756] __dev_queue_xmit+0x14d9/0x3950 [ 1187.541888][ T6756] ip6_output+0x340/0x550 [ 1187.546766][ T6756] NF_HOOK+0x177/0x4f0 [ 1187.551384][ T6756] mld_sendpack+0x8b4/0xe40 [ 1187.556430][ T6756] mld_ifc_work+0x835/0xe70 [ 1187.561478][ T6756] process_scheduled_works+0xb5d/0x1860 [ 1187.567565][ T6756] worker_thread+0xa53/0xfc0 [ 1187.572705][ T6756] kthread+0x389/0x470 [ 1187.577325][ T6756] ret_from_fork+0x514/0xb70 [ 1187.582458][ T6756] ret_from_fork_asm+0x1a/0x30 [ 1187.587763][ T6756] [ 1187.587763][ T6756] -> #0 (&hsr->seqnr_lock){+.-.}-{3:3}: [ 1187.595520][ T6756] __lock_acquire+0x15a5/0x2cf0 [ 1187.600908][ T6756] lock_acquire+0x106/0x350 [ 1187.605954][ T6756] _raw_spin_lock_bh+0x36/0x50 [ 1187.611267][ T6756] hsr_dev_xmit+0x237/0x360 [ 1187.616313][ T6756] dev_hard_start_xmit+0x2cd/0x830 [ 1187.621984][ T6756] __dev_queue_xmit+0x14d9/0x3950 [ 1187.627552][ T6756] NF_HOOK+0x33a/0x3c0 [ 1187.632171][ T6756] arp_xmit+0x16c/0x270 [ 1187.636879][ T6756] arp_solicit+0xbe0/0xe40 [ 1187.641839][ T6756] __neigh_event_send+0xf05/0x14d0 [ 1187.647498][ T6756] neigh_resolve_output+0x198/0x750 [ 1187.653245][ T6756] ip_finish_output2+0xca9/0x1070 [ 1187.658813][ T6756] ip_output+0x29f/0x450 [ 1187.663622][ T6756] iptunnel_xmit+0x621/0xd10 [ 1187.668764][ T6756] ip_tunnel_xmit+0x193a/0x1f20 [ 1187.674171][ T6756] __gre_xmit+0x19e/0x240 [ 1187.679116][ T6756] erspan_xmit+0xa41/0x14d0 [ 1187.684205][ T6756] dev_hard_start_xmit+0x2cd/0x830 [ 1187.689878][ T6756] sch_direct_xmit+0x251/0x4c0 [ 1187.695183][ T6756] __dev_queue_xmit+0x180f/0x3950 [ 1187.700751][ T6756] alb_send_lp_vid+0x348/0x550 [ 1187.706167][ T6756] alb_send_learning_packets+0x12c/0x300 [ 1187.712335][ T6756] alb_fasten_mac_swap+0x639/0xf60 [ 1187.717985][ T6756] bond_alb_handle_active_change+0xc6d/0xf30 [ 1187.724512][ T6756] bond_change_active_slave+0x106e/0x35f0 [ 1187.730791][ T6756] bond_select_active_slave+0x909/0xd40 [ 1187.736889][ T6756] bond_enslave+0x212f/0x3a90 [ 1187.742105][ T6756] do_set_master+0x533/0x6d0 [ 1187.747241][ T6756] rtnl_newlink_create+0x6af/0xb70 [ 1187.752902][ T6756] rtnl_newlink+0x166a/0x1bb0 [ 1187.758125][ T6756] rtnetlink_rcv_msg+0x7d5/0xbe0 [ 1187.763603][ T6756] netlink_rcv_skb+0x232/0x4b0 [ 1187.768907][ T6756] netlink_unicast+0x75c/0x8e0 [ 1187.774210][ T6756] netlink_sendmsg+0x813/0xb40 [ 1187.779552][ T6756] ____sys_sendmsg+0x972/0x9f0 [ 1187.784889][ T6756] ___sys_sendmsg+0x2a5/0x360 [ 1187.790113][ T6756] __x64_sys_sendmsg+0x1bd/0x2a0 [ 1187.795598][ T6756] do_syscall_64+0x174/0x580 [ 1187.800735][ T6756] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1187.807167][ T6756] [ 1187.807167][ T6756] other info that might help us debug this: [ 1187.807167][ T6756] [ 1187.817420][ T6756] Possible unsafe locking scenario: [ 1187.817420][ T6756] [ 1187.824884][ T6756] CPU0 CPU1 [ 1187.830265][ T6756] ---- ---- [ 1187.835642][ T6756] lock(&qdisc_xmit_lock_key#4); [ 1187.840696][ T6756] lock(&hsr->seqnr_lock); [ 1187.847742][ T6756] lock(&qdisc_xmit_lock_key#4); [ 1187.855324][ T6756] lock(&hsr->seqnr_lock); [ 1187.859944][ T6756] [ 1187.859944][ T6756] *** DEADLOCK *** [ 1187.859944][ T6756] [ 1187.868112][ T6756] 10 locks held by syz.1.8571/6756: [ 1187.873361][ T6756] #0: ffffffff90328498 (&ops->srcu#2){.+.+}-{0:0}, at: rtnl_link_ops_get+0x23/0x250 [ 1187.882886][ T6756] #1: ffffffff8fdc9dc0 (rtnl_mutex){+.+.}-{4:4}, at: rtnl_newlink+0x883/0x1bb0 [ 1187.891968][ T6756] #2: ffffffff8e95cc80 (rcu_read_lock_bh){....}-{1:3}, at: __dev_queue_xmit+0x2b6/0x3950 [ 1187.901918][ T6756] #3: ffff8880799ef228 (dev->qdisc_tx_busylock ?: &qdisc_tx_busylock#4){+...}-{3:3}, at: __dev_queue_xmit+0x11a6/0x3950 [ 1187.914570][ T6756] #4: ffff888093660d58 (&qdisc_xmit_lock_key#4){+.-.}-{3:3}, at: sch_direct_xmit+0x15f/0x4c0 [ 1187.924872][ T6756] #5: ffffffff8e95cc20 (rcu_read_lock){....}-{1:3}, at: ip_output+0x5b/0x450 [ 1187.933790][ T6756] #6: ffffffff8e95cc20 (rcu_read_lock){....}-{1:3}, at: ip_finish_output2+0x3c2/0x1070 [ 1187.943558][ T6756] #7: ffffffff8e95cc20 (rcu_read_lock){....}-{1:3}, at: arp_xmit+0x23/0x270 [ 1187.952392][ T6756] #8: ffffffff8e95cc80 (rcu_read_lock_bh){....}-{1:3}, at: __dev_queue_xmit+0x2b6/0x3950 [ 1187.962342][ T6756] #9: ffffffff8e95cc20 (rcu_read_lock){....}-{1:3}, at: hsr_dev_xmit+0x2d/0x360 [ 1187.971509][ T6756] [ 1187.971509][ T6756] stack backtrace: [ 1187.977418][ T6756] CPU: 0 UID: 0 PID: 6756 Comm: syz.1.8571 Not tainted syzkaller #0 PREEMPT(full) [ 1187.977440][ T6756] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 1187.977452][ T6756] Call Trace: [ 1187.977460][ T6756] [ 1187.977469][ T6756] dump_stack_lvl+0xe8/0x150 [ 1187.977492][ T6756] print_circular_bug+0x2e1/0x300 [ 1187.977518][ T6756] check_noncircular+0x12e/0x150 [ 1187.977544][ T6756] __lock_acquire+0x15a5/0x2cf0 [ 1187.977571][ T6756] ? __siphash_unaligned+0x25f/0x3b0 [ 1187.977596][ T6756] ? skb_network_protocol+0x23d/0x400 [ 1187.977620][ T6756] ? hsr_dev_xmit+0x237/0x360 [ 1187.977642][ T6756] lock_acquire+0x106/0x350 [ 1187.977659][ T6756] ? hsr_dev_xmit+0x237/0x360 [ 1187.977685][ T6756] ? __pfx_netif_skb_features+0x10/0x10 [ 1187.977707][ T6756] ? hsr_dev_xmit+0x237/0x360 [ 1187.977729][ T6756] _raw_spin_lock_bh+0x36/0x50 [ 1187.977756][ T6756] ? hsr_dev_xmit+0x237/0x360 [ 1187.977778][ T6756] hsr_dev_xmit+0x237/0x360 [ 1187.977799][ T6756] ? hsr_dev_xmit+0x2d/0x360 [ 1187.977822][ T6756] dev_hard_start_xmit+0x2cd/0x830 [ 1187.977851][ T6756] __dev_queue_xmit+0x14d9/0x3950 [ 1187.977875][ T6756] ? __local_bh_enable_ip+0xd0/0x130 [ 1187.977895][ T6756] ? __dev_queue_xmit+0x2b6/0x3950 [ 1187.977916][ T6756] ? arpt_do_table+0x256/0x1e30 [ 1187.978008][ T6756] ? arpt_do_table+0x256/0x1e30 [ 1187.978032][ T6756] ? __pfx___dev_queue_xmit+0x10/0x10 [ 1187.978059][ T6756] ? __pfx_arpt_do_table+0x10/0x10 [ 1187.978081][ T6756] ? trace_kmem_cache_alloc+0x29/0xe0 [ 1187.978114][ T6756] ? NF_HOOK+0xa2/0x3c0 [ 1187.978142][ T6756] NF_HOOK+0x33a/0x3c0 [ 1187.978167][ T6756] ? __pfx_arp_xmit_finish+0x10/0x10 [ 1187.978193][ T6756] ? NF_HOOK+0xa2/0x3c0 [ 1187.978217][ T6756] ? __pfx_NF_HOOK+0x10/0x10 [ 1187.978241][ T6756] ? lock_acquire+0x106/0x350 [ 1187.978260][ T6756] ? __pfx_arp_xmit_finish+0x10/0x10 [ 1187.978286][ T6756] ? inet_addr_type_dev_table+0x25/0x190 [ 1187.978316][ T6756] arp_xmit+0x16c/0x270 [ 1187.978340][ T6756] ? arp_xmit+0x23/0x270 [ 1187.978365][ T6756] arp_solicit+0xbe0/0xe40 [ 1187.978394][ T6756] ? arp_solicit+0x119/0xe40 [ 1187.978420][ T6756] ? __pfx_arp_solicit+0x10/0x10 [ 1187.978452][ T6756] ? __pfx_arp_solicit+0x10/0x10 [ 1187.978477][ T6756] __neigh_event_send+0xf05/0x14d0 [ 1187.978511][ T6756] neigh_resolve_output+0x198/0x750 [ 1187.978540][ T6756] ? __pfx_ip_neigh_gw4+0x10/0x10 [ 1187.978567][ T6756] ? ip_finish_output2+0x3c2/0x1070 [ 1187.978583][ T6756] ip_finish_output2+0xca9/0x1070 [ 1187.978600][ T6756] ? ip_skb_dst_mtu+0x80b/0xa50 [ 1187.978627][ T6756] ? ip_finish_output+0x40e/0x530 [ 1187.978654][ T6756] ip_output+0x29f/0x450 [ 1187.978680][ T6756] ? ip_output+0x5b/0x450 [ 1187.978706][ T6756] iptunnel_xmit+0x621/0xd10 [ 1187.978731][ T6756] ip_tunnel_xmit+0x193a/0x1f20 [ 1187.978757][ T6756] ? seqcount_lockdep_reader_access+0xd4/0x100 [ 1187.978794][ T6756] ? __pfx_ip_tunnel_xmit+0x10/0x10 [ 1187.978823][ T6756] ? __pfx_gre_build_header+0x10/0x10 [ 1187.978845][ T6756] ? irqentry_exit+0x218/0x8b0 [ 1187.978864][ T6756] ? lockdep_hardirqs_on+0x7a/0x110 [ 1187.978882][ T6756] ? irqentry_exit+0x218/0x8b0 [ 1187.978899][ T6756] ? trace_irq_disable+0x3b/0x140 [ 1187.978928][ T6756] __gre_xmit+0x19e/0x240 [ 1187.978952][ T6756] ? __pfx___gre_xmit+0x10/0x10 [ 1187.978973][ T6756] ? __pfx_erspan_xmit+0x10/0x10 [ 1187.978997][ T6756] ? iptunnel_handle_offloads+0x2fd/0x630 [ 1187.979019][ T6756] erspan_xmit+0xa41/0x14d0 [ 1187.979049][ T6756] ? __pfx_erspan_xmit+0x10/0x10 [ 1187.979080][ T6756] dev_hard_start_xmit+0x2cd/0x830 [ 1187.979109][ T6756] sch_direct_xmit+0x251/0x4c0 [ 1187.979129][ T6756] ? __pfx_sch_direct_xmit+0x10/0x10 [ 1187.979145][ T6756] ? bond_select_active_slave+0x870/0xd40 [ 1187.979178][ T6756] __dev_queue_xmit+0x180f/0x3950 [ 1187.979204][ T6756] ? __dev_queue_xmit+0x2b6/0x3950 [ 1187.979232][ T6756] ? __pfx___dev_queue_xmit+0x10/0x10 [ 1187.979255][ T6756] ? rcu_is_watching+0x15/0xb0 [ 1187.979277][ T6756] ? trace_kmem_cache_alloc+0x29/0xe0 [ 1187.979301][ T6756] ? kmem_cache_alloc_node_noprof+0x3ce/0x690 [ 1187.979334][ T6756] ? alb_send_lp_vid+0x14e/0x550 [ 1187.979355][ T6756] alb_send_lp_vid+0x348/0x550 [ 1187.979376][ T6756] ? __pfx_alb_send_lp_vid+0x10/0x10 [ 1187.979398][ T6756] ? __pfx_alb_set_slave_mac_addr+0x10/0x10 [ 1187.979419][ T6756] alb_send_learning_packets+0x12c/0x300 [ 1187.979439][ T6756] ? __pfx_alb_send_learning_packets+0x10/0x10 [ 1187.979461][ T6756] ? alb_swap_mac_addr+0x230/0x340 [ 1187.979482][ T6756] alb_fasten_mac_swap+0x639/0xf60 [ 1187.979501][ T6756] ? dev_addr_mod+0x1ba/0x350 [ 1187.979523][ T6756] bond_alb_handle_active_change+0xc6d/0xf30 [ 1187.979545][ T6756] ? __pfx_bond_alb_handle_active_change+0x10/0x10 [ 1187.979572][ T6756] ? __hw_addr_add_ex+0x43d/0x520 [ 1187.979602][ T6756] ? __local_bh_enable_ip+0xd0/0x130 [ 1187.979622][ T6756] bond_change_active_slave+0x106e/0x35f0 [ 1187.979651][ T6756] ? __pfx_do_sync_core+0x10/0x10 [ 1187.979678][ T6756] ? lockdep_hardirqs_on+0x7a/0x110 [ 1187.979696][ T6756] ? smp_call_function_many_cond+0x1051/0x13d0 [ 1187.979716][ T6756] ? __pfx_bond_change_active_slave+0x10/0x10 [ 1187.979744][ T6756] ? __pfx_do_sync_core+0x10/0x10 [ 1187.979772][ T6756] ? __pfx_smp_call_function_many_cond+0x10/0x10 [ 1187.979790][ T6756] ? bond_start_xmit+0x92/0x1900 [ 1187.979816][ T6756] ? __pfx___text_poke+0x10/0x10 [ 1187.979844][ T6756] ? static_key_slow_inc_cpuslocked+0xba/0xf0 [ 1187.979879][ T6756] bond_select_active_slave+0x909/0xd40 [ 1187.979911][ T6756] ? __pfx_bond_select_active_slave+0x10/0x10 [ 1187.979946][ T6756] bond_enslave+0x212f/0x3a90 [ 1187.979973][ T6756] ? __pfx_bond_enslave+0x10/0x10 [ 1187.979996][ T6756] ? __pfx___dev_notify_flags+0x10/0x10 [ 1187.980014][ T6756] ? __dev_change_flags+0x5fe/0x7e0 [ 1187.980034][ T6756] ? mutex_is_locked+0x17/0x50 [ 1187.980058][ T6756] do_set_master+0x533/0x6d0 [ 1187.980084][ T6756] rtnl_newlink_create+0x6af/0xb70 [ 1187.980104][ T6756] ? __pfx___nla_validate_parse+0x10/0x10 [ 1187.980132][ T6756] ? __pfx_rtnl_newlink_create+0x10/0x10 [ 1187.980153][ T6756] ? __pfx___mutex_lock+0x10/0x10 [ 1187.980178][ T6756] ? ns_capable+0x89/0xe0 [ 1187.980197][ T6756] rtnl_newlink+0x166a/0x1bb0 [ 1187.980221][ T6756] ? __pfx_rtnl_newlink+0x10/0x10 [ 1187.980237][ T6756] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1187.980272][ T6756] ? kasan_quarantine_put+0xbb/0x1f0 [ 1187.980298][ T6756] ? lockdep_hardirqs_on+0x7a/0x110 [ 1187.980317][ T6756] ? nlmon_xmit+0xb0/0x100 [ 1187.980335][ T6756] ? kmem_cache_free+0x182/0x650 [ 1187.980366][ T6756] ? __lock_acquire+0x6b5/0x2cf0 [ 1187.980387][ T6756] ? __dev_queue_xmit+0x2b6/0x3950 [ 1187.980410][ T6756] ? __local_bh_enable_ip+0xd0/0x130 [ 1187.980427][ T6756] ? lockdep_hardirqs_on+0x7a/0x110 [ 1187.980445][ T6756] ? __dev_queue_xmit+0x2b6/0x3950 [ 1187.980466][ T6756] ? __local_bh_enable_ip+0xd0/0x130 [ 1187.980482][ T6756] ? __dev_queue_xmit+0x2b6/0x3950 [ 1187.980508][ T6756] ? rtnetlink_rcv_msg+0x1b9/0xbe0 [ 1187.980532][ T6756] ? __pfx_rtnl_newlink+0x10/0x10 [ 1187.980548][ T6756] rtnetlink_rcv_msg+0x7d5/0xbe0 [ 1187.980574][ T6756] ? rtnetlink_rcv_msg+0x1b9/0xbe0 [ 1187.980591][ T6756] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 1187.980607][ T6756] ? ref_tracker_free+0x693/0x840 [ 1187.980628][ T6756] ? __pfx_ref_tracker_free+0x10/0x10 [ 1187.980652][ T6756] netlink_rcv_skb+0x232/0x4b0 [ 1187.980673][ T6756] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 1187.980691][ T6756] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 1187.980717][ T6756] ? netlink_deliver_tap+0x2e/0x1b0 [ 1187.980737][ T6756] ? netlink_deliver_tap+0x2e/0x1b0 [ 1187.980759][ T6756] netlink_unicast+0x75c/0x8e0 [ 1187.980782][ T6756] netlink_sendmsg+0x813/0xb40 [ 1187.980807][ T6756] ? __pfx_netlink_sendmsg+0x10/0x10 [ 1187.980830][ T6756] ? aa_sock_msg_perm+0xf1/0x1b0 [ 1187.980857][ T6756] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 1187.980883][ T6756] ____sys_sendmsg+0x972/0x9f0 [ 1187.980904][ T6756] ? __might_fault+0xaf/0x130 [ 1187.980930][ T6756] ? __pfx_____sys_sendmsg+0x10/0x10 [ 1187.980955][ T6756] ? import_iovec+0x73/0xa0 [ 1187.980977][ T6756] ___sys_sendmsg+0x2a5/0x360 [ 1187.980996][ T6756] ? __lock_acquire+0x6b5/0x2cf0 [ 1187.981016][ T6756] ? __pfx____sys_sendmsg+0x10/0x10 [ 1187.981039][ T6756] ? futex_wait+0x2a2/0x390 [ 1187.981076][ T6756] ? __fget_files+0x2a/0x420 [ 1187.981098][ T6756] ? __fget_files+0x3a0/0x420 [ 1187.981124][ T6756] __x64_sys_sendmsg+0x1bd/0x2a0 [ 1187.981146][ T6756] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 1187.981170][ T6756] ? rcu_is_watching+0x15/0xb0 [ 1187.981195][ T6756] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1187.981214][ T6756] do_syscall_64+0x174/0x580 [ 1187.981232][ T6756] ? trace_irq_disable+0x3b/0x140 [ 1187.981258][ T6756] ? clear_bhb_loop+0x40/0x90 [ 1187.981278][ T6756] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1187.981295][ T6756] RIP: 0033:0x7f0d4ad9ce59 [ 1187.981312][ T6756] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1187.981328][ T6756] RSP: 002b:00007f0d4bbac028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 1187.981347][ T6756] RAX: ffffffffffffffda RBX: 00007f0d4b016090 RCX: 00007f0d4ad9ce59 [ 1187.981361][ T6756] RDX: 0000000000000000 RSI: 00002000000000c0 RDI: 0000000000000008 [ 1187.981372][ T6756] RBP: 00007f0d4ae32d6f R08: 0000000000000000 R09: 0000000000000000 [ 1187.981384][ T6756] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 1187.981395][ T6756] R13: 00007f0d4b016128 R14: 00007f0d4b016090 R15: 00007ffc2e9a89d8 [ 1187.981416][ T6756] SYZFAIL: failed to recv rpc fd=3 want=4 recv=0 n=0 (errno 9: Bad file descriptor) [ 1189.016796][ T6756] bond5: (slave erspan2): Enslaving as an active interface with an up link [ 1189.061620][T10319] net_ratelimit: 19 callbacks suppressed [ 1189.061644][T10319] bond1: (slave bridge1): failed to get link speed/duplex [ 1189.148832][ T6756] syz.1.8571 (6756) used greatest stack depth: 16552 bytes left [ 1189.220478][T10308] bond1: (slave bridge1): failed to get link speed/duplex [ 1189.364882][T10308] netdevsim netdevsim2 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1189.506574][ T2736] bond1: (slave bridge1): failed to get link speed/duplex [ 1189.623773][T10308] netdevsim netdevsim2 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1189.738283][T29699] bond0: (slave syz_tun): Releasing backup interface [ 1189.761388][T29699] syz_tun (unregistering): left allmulticast mode [ 1189.802570][T10308] netdevsim netdevsim2 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1189.818396][ T2736] bond1: (slave bridge1): failed to get link speed/duplex [ 1189.897616][T10308] netdevsim netdevsim2 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1189.937532][ T2736] bond1: (slave bridge1): failed to get link speed/duplex [ 1190.223624][T10308] bond1 (unregistering): (slave bridge1): Removing an active aggregator [ 1190.233222][T10308] bond1 (unregistering): (slave bridge1): Releasing backup interface [ 1190.241758][T10308] bond1 (unregistering): (slave bridge1): the permanent HWaddr of slave - 66:5d:cd:0d:80:06 - is still in use by bond - set the HWaddr of slave to a different address to avoid conflicts [ 1190.260633][T10308] bridge1 (unregistering): left promiscuous mode [ 1190.269049][T10308] bridge1 (unregistering): left allmulticast mode [ 1190.282716][T10308] bond1 (unregistering): (slave bridge2): Releasing backup interface [ 1190.292670][T10308] bridge2 (unregistering): left promiscuous mode [ 1190.300106][T10308] bridge2 (unregistering): left allmulticast mode [ 1190.335170][T10308] bond3 (unregistering): (slave bridge8): Releasing active interface [ 1190.383885][T10308] bond0 (unregistering): Released all slaves [ 1190.394093][T10308] bond1 (unregistering): Released all slaves [ 1190.406224][T10308] bond2 (unregistering): Released all slaves [ 1190.417852][T10308] bond3 (unregistering): (slave veth3): Releasing active interface [ 1190.428965][T10308] bond3 (unregistering): (slave veth5): Releasing active interface [ 1190.440334][T10308] bond3 (unregistering): Released all slaves [ 1190.452362][T10308] bond4 (unregistering): (slave veth9): Releasing active interface [ 1190.462053][T10308] bond4 (unregistering): (slave veth11): Releasing active interface [ 1190.471906][T10308] bond4 (unregistering): Released all slaves [ 1190.482558][T10308] bond5 (unregistering): (slave bond6): Releasing backup interface [ 1190.491425][T10308] bond5 (unregistering): Released all slaves [ 1190.503667][T10308] bond6 (unregistering): Released all slaves [ 1190.515053][T10308] bond7 (unregistering): Released all slaves [ 1190.526567][T10308] bond8 (unregistering): (slave lo): Releasing backup interface [ 1190.534621][T10308] bond8 (unregistering): (slave lo): last VLAN challenged slave left bond - VLAN blocking is removed [ 1190.550432][T10308] bond8 (unregistering): Released all slaves [ 1190.690684][T10308] tipc: Disabling bearer [ 1190.708893][T10308] tipc: Left network mode [ 1190.942612][ T5298] 8021q: adding VLAN 0 to HW filter on device eth5 [ 1191.277297][ T5298] 8021q: adding VLAN 0 to HW filter on device eth6 [ 1191.493796][T10308] hsr_slave_0: left promiscuous mode [ 1191.525111][T10308] hsr_slave_1: left promiscuous mode [ 1191.535728][T10308] veth1_macvtap: left promiscuous mode [ 1191.542287][T10308] veth0_macvtap: left promiscuous mode [ 1191.548852][T10308] veth1_vlan: left promiscuous mode [ 1191.554134][T10308] veth0_vlan: left promiscuous mode [ 1191.903612][ T5298] 8021q: adding VLAN 0 to HW filter on device eth7 [ 1192.224319][T10308] netdevsim netdevsim3 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1192.280234][T10308] netdevsim netdevsim3 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1192.298260][ T5298] 8021q: adding VLAN 0 to HW filter on device eth8 [ 1192.358279][T10308] netdevsim netdevsim3 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1192.402735][T10308] netdevsim netdevsim3 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1192.806150][T10308] bridge_slave_1: left allmulticast mode [ 1192.815279][T10308] bridge_slave_1: left promiscuous mode [ 1192.827509][T10308] bridge0: port 2(bridge_slave_1) entered disabled state [ 1192.868650][T10308] bridge_slave_0: left allmulticast mode [ 1192.874829][T10308] bridge_slave_0: left promiscuous mode [ 1192.880866][T10308] bridge0: port 1(bridge_slave_0) entered disabled state [ 1192.893102][T10308] vlan0: left allmulticast mode [ 1192.899056][T10308] veth0_vlan: left allmulticast mode [ 1192.911843][T10308] dvmrp8: left allmulticast mode [ 1192.975408][T10308] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 1192.992382][T10308] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 1193.003049][T10308] bond0 (unregistering): Released all slaves [ 1193.093113][T10308] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 1193.103903][T10308] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 1193.113911][T10308] bond0 (unregistering): Released all slaves [ 1193.122309][T10308] bond1 (unregistering): Released all slaves [ 1193.135586][ T5298] 8021q: adding VLAN 0 to HW filter on device eth9 [ 1193.205181][T10308] tipc: Left network mode [ 1193.577937][ T5298] 8021q: adding VLAN 0 to HW filter on device eth10 [ 1193.919398][T10308] hsr_slave_0: left promiscuous mode [ 1193.927115][T10308] hsr_slave_1: left promiscuous mode [ 1193.933022][T10308] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 1193.943116][T10308] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 1193.953488][T10308] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 1193.961671][T10308] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 1193.975497][T10308] hsr_slave_0: left promiscuous mode [ 1193.982406][T10308] hsr_slave_1: left promiscuous mode [ 1193.993259][T10308] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 1194.009580][T10308] veth1_macvtap: left promiscuous mode [ 1194.015135][T10308] veth0_macvtap: left promiscuous mode [ 1194.022449][T10308] veth1_vlan: left promiscuous mode [ 1194.028526][T10308] veth0_vlan: left promiscuous mode [ 1194.162301][T10308] team0 (unregistering): Port device team_slave_1 removed [ 1194.181870][T10308] team0 (unregistering): Port device team_slave_0 removed [ 1194.330416][T10308] team0 (unregistering): Port device team_slave_1 removed [ 1194.343338][T10308] team0 (unregistering): Port device team_slave_0 removed [ 1194.409422][ T5298] 8021q: adding VLAN 0 to HW filter on device eth11 [ 1194.833579][ T5298] 8021q: adding VLAN 0 to HW filter on device eth12 [ 1195.118534][ T5298] 8021q: adding VLAN 0 to HW filter on device eth13 [ 1195.401058][ T5298] 8021q: adding VLAN 0 to HW filter on device eth14 [ 1195.679117][ T5298] 8021q: adding VLAN 0 to HW filter on device eth15 [ 1195.963791][ T5298] 8021q: adding VLAN 0 to HW filter on device eth16