last executing test programs: 3.58316084s ago: executing program 2 (id=4255): r0 = socket$inet6_sctp(0xa, 0x5, 0x84) setsockopt$inet_sctp6_SCTP_DEFAULT_PRINFO(r0, 0x84, 0x72, &(0x7f00000001c0)={0x0, 0x1, 0x20}, 0xc) bind$inet6(r0, &(0x7f0000000300)={0xa, 0x4e23, 0x0, @loopback, 0x3}, 0x7e) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000000)={0x0}, 0x1, 0x0, 0x0, 0x4000811}, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000040)=@newtaction={0x68, 0x30, 0x871a15abc695fb3d, 0x0, 0x0, {}, [{0x54, 0x1, [@m_tunnel_key={0x50, 0x1, 0x0, 0x0, {{0xf}, {0x20, 0x2, 0x0, 0x1, [@TCA_TUNNEL_KEY_PARMS={0x1c, 0x2, {{0x1, 0xfffffffe}, 0x2}}]}, {0x4}, {0xc}, {0xc}}}]}]}, 0x68}, 0x1, 0x0, 0x0, 0x4}, 0x0) mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff002, 0x0, 0x2000000000032, 0xffffffffffffffff, 0x0) r2 = socket$igmp6(0xa, 0x3, 0x2) setsockopt$inet6_int(r2, 0x29, 0x7, &(0x7f00000003c0)=0x80000001, 0x4) sendmmsg(r1, &(0x7f00000002c0), 0x40000000000009f, 0x0) sendto$inet6(r0, &(0x7f0000847fff)='X', 0x34000, 0xe0, &(0x7f000005ffe4)={0xa, 0x4e23, 0x0, @loopback}, 0x1c) 3.382586762s ago: executing program 2 (id=4259): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x48241, 0x0) setsockopt$IP6T_SO_SET_REPLACE(0xffffffffffffffff, 0x29, 0x40, &(0x7f0000000b80)=@mangle={'mangle\x00', 0x2, 0x6, 0x578, 0x0, 0x3d8, 0xd0, 0x3d8, 0x3d8, 0x4a8, 0x4a8, 0x4a8, 0x4a8, 0x4a8, 0x6, 0x0, {[{{@ipv6={@mcast2, @ipv4={'\x00', '\xff\xff', @remote}, [0x0, 0xff, 0xff000000, 0xff000000], [0x0, 0xffffff00, 0xffffff00, 0xffffffff], 'gretap0\x00', 'batadv0\x00', {}, {0xff}, 0x11, 0x5, 0x1, 0x18}, 0x0, 0xa8, 0xd0, 0x0, {0x7a00000010000000}}, @unspec=@CHECKSUM={0x28}}, {{@uncond, 0x0, 0xa8, 0xe0}, @common=@inet=@SET3={0x38, 'SET\x00', 0x3, {{0x0, 0xfc, 0x6}}}}, {{@ipv6={@dev={0xfe, 0x80, '\x00', 0xb4}, @initdev={0xfe, 0x88, '\x00', 0xfd, 0x0}, [0xffffff00], [0xffffff00], 'ip6gre0\x00', 'bond_slave_0\x00', {}, {0xff}}, 0x0, 0xf0, 0x138, 0x48000000, {}, [@common=@dst={{0x48}, {0xff, 0x4, 0x0, [0x1, 0x7a, 0xfffd, 0x3f4, 0x0, 0x3, 0x5, 0x0, 0x8, 0x30, 0xe5, 0x4, 0x1, 0x6, 0x0, 0x7], 0x6}}]}, @common=@inet=@TEE={0x48, 'TEE\x00', 0x1, {@ipv4=@initdev={0xac, 0x1e, 0x1, 0x0}, 'ip6gre0\x00', {0x4}}}}, {{@ipv6={@remote, @dev={0xfe, 0x80, '\x00', 0xd}, [0x0, 0xffff00, 0xffffffff], [0xffffff00, 0xffffff00, 0xffffff00, 0xff000000], 'nr0\x00', 'vxcan1\x00', {}, {}, 0x62, 0x5, 0x3, 0x20}, 0x0, 0xa8, 0xf0}, @SNPT={0x48, 'SNPT\x00', 0x0, {@ipv6=@remote, @ipv6=@mcast1, 0x6, 0x27, 0xd}}}, {{@ipv6={@loopback, @private0, [0xff000000, 0xffffff, 0x0, 0xffffff00], [0xffffff00, 0xffffff00, 0xff, 0xff000000], 'pim6reg1\x00', 'ip6erspan0\x00', {}, {}, 0x6c, 0x80, 0x5, 0x61}, 0x0, 0xa8, 0xd0}, @HL={0x28}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x5d8) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x6bf1c2d5adba8c32}) r1 = socket$kcm(0x2, 0xa, 0x2) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0xe}}) writev(r0, &(0x7f00000008c0)=[{&(0x7f0000000a40)="2e9b3d0007e03dd65193dfb6c575", 0xe}, {&(0x7f0000000100)="00000005", 0x4}, {&(0x7f0000000800)="38c8114fa3", 0x5}], 0x3) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0x3, 0x4, &(0x7f0000000040)=ANY=[@ANYBLOB="b400000000000000731139000000000020000000000000009500200000000000"], &(0x7f0000003ff6)='GPL\x00', 0x2, 0xfd90, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @sched_cls, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x1f2, 0x10, &(0x7f0000000000), 0xfffffe51}, 0x48) sendmsg$IPSET_CMD_RENAME(r2, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000000c0)={0x28, 0x5, 0x6, 0x5, 0x0, 0x0, {}, [@IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz2\x00'}]}, 0x28}}, 0x0) r3 = socket$netlink(0x10, 0x3, 0x0) r4 = socket(0x10, 0x803, 0x0) sendmsg$IPVS_CMD_SET_INFO(r4, &(0x7f0000000b00)={0x0, 0x0, &(0x7f0000000ac0)={0x0, 0x14}}, 0x0) getsockname$packet(r4, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r3, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000380)=ANY=[@ANYBLOB="3c0000001000850600"/20, @ANYRES32=r5, @ANYBLOB="01000000000000001c0012000c000100626f6e64000000000c0002000800010006"], 0x3c}}, 0x0) sendmsg$nl_route(r3, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000580)=@newlink={0x3c, 0x10, 0xffffff1f, 0x0, 0x1, {}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @gre={{0x8}, {0x8, 0x2, 0x0, 0x1, [@IFLA_GRE_COLLECT_METADATA={0x4}]}}}, @IFLA_MASTER={0x8, 0xa, r5}]}, 0x3c}, 0x1, 0x0, 0x0, 0x40000}, 0x0) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket(0x1, 0x803, 0x0) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000001c0)=0x14) sendmsg$nl_route(r6, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000400)=@newlink={0x40, 0x10, 0x403, 0x70bd25, 0x0, {0x0, 0x0, 0x0, 0x0, 0x500}, [@IFLA_LINKINFO={0x18, 0x12, 0x0, 0x1, @gretap={{0xb}, {0x8, 0x2, 0x0, 0x1, [@IFLA_GRE_COLLECT_METADATA={0x4}]}}}, @IFLA_MASTER={0x8, 0xa, r8}]}, 0x40}, 0x1, 0x0, 0x0, 0x24000804}, 0x8000) r9 = socket$nl_route(0x10, 0x3, 0x0) r10 = socket(0x1, 0x803, 0x0) getsockname$packet(r10, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000002c0)=0x14) sendmsg$nl_route(r9, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000380)=@newlink={0x4c, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x300}, [@IFLA_LINKINFO={0x1c, 0x12, 0x0, 0x1, @macvlan={{0xc}, {0xc, 0x2, 0x0, 0x1, [@IFLA_MACVLAN_MODE={0x8, 0x1, 0x8}]}}}, @IFLA_LINK={0x8, 0x5, r11}, @IFLA_MASTER={0x8, 0xa, r11}]}, 0x4c}}, 0x0) setsockopt$TIPC_MCAST_REPLICAST(0xffffffffffffffff, 0x10f, 0x86) r12 = bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="9feb01001800000000000000180000001800000004000000020000000100000c02000000000000000000000d0000000000005f"], 0x0, 0x34}, 0x20) r13 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x3, &(0x7f0000000100)=@framed={{0x18, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1800}}, &(0x7f0000000000)='GPL\x00', 0xc, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, r12, 0x8, &(0x7f00000000c0)={0x0, 0x1}, 0x1}, 0x94) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000500)=@bpf_ext={0x1c, 0x3, &(0x7f0000000080)=@framed={{0x18, 0x0, 0x0, 0x0, 0xc4f, 0x0, 0x0, 0x0, 0xfffffffc}}, &(0x7f0000000180)='GPL\x00', 0x7, 0x0, 0x0, 0x41000, 0x20, '\x00', 0x0, 0x0, r12, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x1, r13, 0x0, 0x0, 0x0, 0x10, 0x4a6}, 0x94) r14 = bpf$PROG_LOAD(0x5, &(0x7f0000000100)={0x20, 0x3, &(0x7f0000000340)=ANY=[@ANYBLOB="1800000000000000000000000000000095"], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, @netfilter=0x2d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f00000002c0)={r14, 0x0, 0x22, 0x0, &(0x7f00000006c0)="f6f4e9a1d78ad62ceef1884386dd78bb3fb7dbfc", 0x0, 0x0, 0x0, 0x2, 0x0, &(0x7f0000000700)="0102", 0x0}, 0x50) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000a40)={0x2, 0x2, &(0x7f0000000080)=@raw=[@call={0x85, 0x0, 0x0, 0xae}, @exit], &(0x7f0000000840)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2a, r12}, 0x94) 2.592056951s ago: executing program 2 (id=4271): r0 = socket(0x848000000015, 0x805, 0x0) (async, rerun: 32) r1 = socket(0x400000000010, 0x3, 0x0) (async, rerun: 32) r2 = socket$inet_sctp(0x2, 0x5, 0x84) (async) r3 = socket(0x2, 0x80805, 0x0) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r3, 0x84, 0x6f, &(0x7f0000000000)={0x0, 0x10, &(0x7f0000000380)=[@in={0x2, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}}]}, &(0x7f0000000180)=0x10) (async) getsockopt$inet_sctp_SCTP_MAX_BURST(r3, 0x84, 0x14, &(0x7f0000000000)=@assoc_value={0x0}, &(0x7f0000001080)=0x8) getsockopt$inet_sctp_SCTP_GET_LOCAL_ADDRS(r2, 0x84, 0x6d, &(0x7f0000000280)={r4}, &(0x7f0000000380)=0x8) getsockopt$inet_sctp_SCTP_ENABLE_STREAM_RESET(r0, 0x84, 0x76, &(0x7f00000001c0)={r4, 0x5}, &(0x7f0000000340)=0x8) (async, rerun: 32) r5 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) (async, rerun: 32) r6 = bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=@base={0x1b, 0x0, 0x0, 0x8000, 0x0, 0xffffffffffffffff, 0xffff}, 0x50) r7 = bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="9feb01001800000000000000180000001800000004000000020000000100000c02000000000000000000000d0000000000005f"], 0x0, 0x34}, 0x20) r8 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x3, &(0x7f0000000100)=ANY=[@ANYBLOB="180000000100000000000000801800009500000000000000"], &(0x7f0000000000)='GPL\x00', 0xc, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, r7, 0x8, &(0x7f00000000c0)={0x0, 0x1}, 0x1}, 0x94) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000500)=@bpf_ext={0x1a, 0xf, &(0x7f00000002c0)=ANY=[@ANYBLOB="1800000092870000000000000000000018110000", @ANYRES32=r6, @ANYBLOB="0000000000000000b702000014000000b7030000000000008500000483000000bf0900000000000055090100000000009500000000000000bf91000000000000b7020000020000008500000084000000b7000000000000009500000000000000"], &(0x7f0000000180)='GPL\x00', 0x7, 0x0, 0x0, 0x40f00, 0x20, '\x00', 0x0, 0x19, r7, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x1, r8, 0x0, 0x0, 0x0, 0x10, 0x4a6}, 0x94) (async) ioctl$TUNSETIFF(r5, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) (async, rerun: 64) r9 = socket(0x400000000010, 0x3, 0x0) (async, rerun: 64) r10 = socket$unix(0x1, 0x1, 0x0) getsockopt$inet_sctp_SCTP_ADAPTATION_LAYER(r0, 0x84, 0x7, &(0x7f00000003c0), &(0x7f0000000400)=0x4) (async) ioctl$sock_SIOCGIFINDEX(r10, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r9, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000280)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0xffffffdf, {0x0, 0x0, 0x0, r11, {0x0, 0x9}, {0xffff, 0xffff}, {0xc, 0xf}}, [@qdisc_kind_options=@q_fq_codel={{0xd}, {0x4}}]}, 0x38}, 0x1, 0x0, 0x0, 0x8001}, 0x20008850) sendmsg$nl_route_sched(r9, &(0x7f0000000900)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000940)=@newtfilter={0x34, 0x2c, 0xd27, 0x70bd28, 0xfffff000, {0x0, 0x0, 0x0, r11, {0xf000, 0xffff}, {0x10}, {0x7, 0xa}}, [@filter_kind_options=@f_route={{0xa}, {0x4}}]}, 0x34}, 0x1, 0x0, 0x0, 0x80}, 0x20000800) r12 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r12, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r1, &(0x7f0000000900)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000001300)=@newtfilter={0x24, 0x2c, 0x1, 0x70bd28, 0xfffff000, {0x0, 0x0, 0x0, r13, {0xf000}, {}, {0x7, 0xa}}}, 0x24}, 0x1, 0x0, 0x0, 0x80}, 0x20000800) (async) connect$inet6(r0, &(0x7f00000000c0)={0xa, 0x0, 0x0, @local, 0x2}, 0x1c) bind$inet6(r0, &(0x7f0000000040)={0xa, 0x0, 0x0, @dev, 0x10}, 0x1c) 2.389568084s ago: executing program 2 (id=4274): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$fou(&(0x7f0000000100), 0xffffffffffffffff) sendmsg$FOU_CMD_ADD(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000040)={0x24, r1, 0xd1bd17c4b9ef5e5b, 0x70bd26, 0x25dfdbfc, {}, [@FOU_ATTR_PEER_V4={0x8, 0x8, @loopback}, @FOU_ATTR_PEER_PORT={0x6, 0xa, 0x4e23}]}, 0x24}}, 0x90) r2 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$TUNSETOFFLOAD(r2, 0xc004743e, 0x110e22fff6) r3 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000080), 0x22180, 0x0) ioctl$TUNSETOFFLOAD(r3, 0x4004743d, 0x110e22fff6) close(r2) readv(r3, &(0x7f00000004c0)=[{&(0x7f00000003c0)=""/207, 0xcf}], 0x1) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r4, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000600)={&(0x7f0000000000)={0x5c, 0x2, 0x6, 0x8f7b80029b167919, 0x0, 0x0, {}, [@IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz0\x00'}, @IPSET_ATTR_DATA={0x14, 0x7, 0x0, 0x1, [@IPSET_ATTR_BUCKETSIZE={0x5, 0x15, 0xfc}, @IPSET_ATTR_HASHSIZE={0x8}]}, @IPSET_ATTR_TYPENAME={0xd, 0x3, 'hash:net\x00'}, @IPSET_ATTR_FAMILY={0x5, 0x5, 0x2}, @IPSET_ATTR_REVISION={0x5}]}, 0x5c}, 0x1, 0x0, 0x0, 0x40000}, 0x0) r5 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000380), 0xffffffffffffffff) r6 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r6, 0x8933, &(0x7f0000000000)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_FRAME(r6, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000fc0)={&(0x7f0000000400)=ANY=[@ANYBLOB='H\x00\x00\x00', @ANYRES16=r5, @ANYBLOB="010000000000fddbdf250200000008000300", @ANYRES32=r7, @ANYBLOB="0c00990009000000740000000800a0009e0900000800a1007c1a0000080026008009000008009f0004000001"], 0x48}}, 0x20000000) 1.977462208s ago: executing program 1 (id=4277): mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.net/syz1\x00', 0x1ff) r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r1 = openat$cgroup_procs(r0, &(0x7f0000000040)='cgroup.procs\x00', 0x2, 0x0) r2 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r2, &(0x7f0000000040)={0x3, 0x0, &(0x7f0000000340)={&(0x7f0000000100)={0x2, 0x2, 0x0, 0x3, 0xc, 0x0, 0x0, 0x0, [@sadb_ident={0x2, 0xa, 0x10, 0x0, 0x6}, @sadb_address={0x3, 0x6, 0x0, 0x0, 0x0, @in={0x2, 0x0, @remote}}, @sadb_sa={0x2}, @sadb_address={0x3, 0x5, 0x0, 0x0, 0x0, @in={0x2, 0x0, @local}}]}, 0x60}, 0x1, 0x7}, 0x0) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000040)='./cgroup.net/syz0\x00', 0x1ff) r3 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000040), 0x200002, 0x0) ioctl$sock_inet_SIOCSIFNETMASK(r2, 0x891c, &(0x7f0000000180)={'gretap0\x00', {0x2, 0x4e22, @multicast2}}) sendmsg$key(r2, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000000200)={0x2, 0xb, 0xff, 0x2, 0x1c, 0x0, 0x70bd26, 0x25dfdbfb, [@sadb_x_sec_ctx={0x3, 0x18, 0x6b, 0xc6, 0xa, "d5d86e7019987246b519"}, @sadb_key={0x13, 0x9, 0x458, 0x0, "8afbe044dda56b644c50f1caf8e19f3b9d3f48142b914e33d7c0bb81f064a827f0d701270a0b8e23c36f463228a39c923299b7fdea032d2e150fb68f245a3dd7378d3a8f70342e9677d316f74dba01c6a2f696fa671f507f26d37234208d5ee76b10d28916920141a880ffcc8ec373cadf604e9dd4bb993fba443555da05cf0be6412c54ee0122903ed30a"}, @sadb_x_nat_t_type={0x1, 0x14, 0x5}, @sadb_address={0x3, 0x5, 0x3c, 0x0, 0x0, @in={0x2, 0x4e23, @private=0xa010101}}]}, 0xe0}}, 0x200088c5) r4 = openat$cgroup_devices(r3, &(0x7f0000000300)='devices.allow\x00', 0x2, 0x0) write$cgroup_devices(r4, &(0x7f0000000100)=ANY=[@ANYBLOB='b *:75'], 0x9) write$cgroup_pid(r1, &(0x7f00000001c0), 0x12) r5 = openat$cgroup_freezer_state(r0, &(0x7f0000000080), 0x2, 0x0) write$cgroup_freezer_state(r5, &(0x7f00000000c0)='THAWED\x00', 0x7) 1.418816097s ago: executing program 2 (id=4283): r0 = socket$inet_tcp(0x2, 0x1, 0x0) ioctl$sock_SIOCSIFVLAN_ADD_VLAN_CMD(r0, 0x8983, &(0x7f0000000000)={0x0, 'veth1_to_batadv\x00', {0x4}, 0xd}) r1 = socket$kcm(0x29, 0x2, 0x0) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$NL80211_CMD_UPDATE_OWE_INFO(r2, &(0x7f0000000140)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x1000}, 0xc, &(0x7f0000000100)={&(0x7f00000000c0)={0x2c, r3, 0x200, 0x70bd29, 0x25dfdbfd, {{}, {@void, @void}}, [@NL80211_ATTR_MAC={0xa, 0x6, @device_b}, @NL80211_ATTR_MAC={0xa}]}, 0x2c}, 0x1, 0x0, 0x0, 0x400c000}, 0x40004) setsockopt$inet_tcp_TCP_ULP(r0, 0x6, 0x1f, &(0x7f0000000180), 0x3) r4 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_802154(0xffffffffffffffff, 0x8933, &(0x7f0000000200)={'wpan1\x00', 0x0}) sendmsg$NL802154_CMD_GET_SEC_DEV(r4, &(0x7f00000002c0)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x60301308}, 0xc, &(0x7f0000000280)={&(0x7f0000000240)={0x40, 0x0, 0x400, 0x70bd27, 0x25dfdbfe, {}, [@NL802154_ATTR_WPAN_DEV={0xc}, @NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x300000003}, @NL802154_ATTR_IFINDEX={0x8, 0x3, r5}, @NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x2}]}, 0x40}, 0x1, 0x0, 0x0, 0x80}, 0x20008880) r6 = socket$kcm(0x29, 0x3, 0x0) r7 = syz_genetlink_get_family_id$SEG6(&(0x7f0000000340), r2) sendmsg$SEG6_CMD_SET_TUNSRC(r6, &(0x7f0000000440)={&(0x7f0000000300)={0x10, 0x0, 0x0, 0x1000000}, 0xc, &(0x7f0000000400)={&(0x7f0000000380)={0x80, r7, 0x100, 0x70bd25, 0x25dfdbff, {}, [@SEG6_ATTR_SECRETLEN={0x5, 0x5, 0x1}, @SEG6_ATTR_DST={0x14, 0x1, @ipv4={'\x00', '\xff\xff', @initdev={0xac, 0x1e, 0x0, 0x0}}}, @SEG6_ATTR_DST={0x14, 0x1, @mcast2}, @SEG6_ATTR_DST={0x14, 0x1, @remote}, @SEG6_ATTR_DST={0x14, 0x1, @dev={0xfe, 0x80, '\x00', 0x3f}}, @SEG6_ATTR_SECRET={0x14, 0x4, [0xa2, 0x5, 0x4, 0x6]}]}, 0x80}, 0x1, 0x0, 0x0, 0x810}, 0x4) ioctl$sock_inet_tcp_SIOCOUTQNSD(r0, 0x894b, &(0x7f0000000480)) pipe(&(0x7f00000004c0)={0xffffffffffffffff}) recvmmsg$unix(r8, &(0x7f00000036c0)=[{{&(0x7f0000000500), 0x6e, &(0x7f0000000740)=[{&(0x7f0000000580)=""/200, 0xc8}, {&(0x7f0000000680)=""/125, 0x7d}, {&(0x7f0000000700)}], 0x3, &(0x7f0000000780)=[@rights={{0x1c, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}, @rights={{0x18, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff]}}], 0x38}}, {{0x0, 0x0, &(0x7f0000000c80)=[{&(0x7f00000007c0)}, {&(0x7f0000000800)=""/45, 0x2d}, {&(0x7f0000000840)=""/217, 0xd9}, {&(0x7f0000000940)=""/233, 0xe9}, {&(0x7f0000000a40)=""/31, 0x1f}, {&(0x7f0000000a80)=""/108, 0x6c}, {&(0x7f0000000b00)=""/120, 0x78}, {&(0x7f0000000b80)=""/250, 0xfa}], 0x8}}, {{&(0x7f0000000d00), 0x6e, &(0x7f0000001200)=[{&(0x7f0000000d80)=""/242, 0xf2}, {&(0x7f0000000e80)=""/133, 0x85}, {&(0x7f0000000f40)=""/109, 0x6d}, {&(0x7f0000000fc0)=""/32, 0x20}, {&(0x7f0000001000)=""/31, 0x1f}, {&(0x7f0000001040)=""/242, 0xf2}, {&(0x7f0000001140)=""/170, 0xaa}], 0x7}}, {{0x0, 0x0, &(0x7f0000003640)=[{&(0x7f0000001280)=""/238, 0xee}, {&(0x7f0000001380)=""/208, 0xd0}, {&(0x7f0000001480)=""/150, 0x96}, {&(0x7f0000001540)=""/25, 0x19}, {&(0x7f0000001580)=""/4096, 0x1000}, {&(0x7f0000002580)}, {&(0x7f00000025c0)=""/119, 0x77}, {&(0x7f0000002640)=""/4096, 0x1000}], 0x8}}], 0x4, 0x100, &(0x7f00000037c0)={0x77359400}) write$tun(r8, &(0x7f0000003800)={@val={0x0, 0x6}, @val={0x0, 0x4, 0x100, 0x6, 0x400, 0x1000}, @mpls={[{0x6beb, 0x0, 0x1}, {0x887, 0x0, 0x1}, {0x4, 0x0, 0x1}, {0x8dfe}, {0xa}], @ipv6=@udp={0x4, 0x6, "8bf7ac", 0x1070, 0x11, 0x1, @empty, @private1, {[@dstopts={0x3b, 0xb, '\x00', [@generic={0x4, 0x32, "33dc78a67cd952697580de40aa0bb1500224b2aa1906dba7b545ea1b4f086526a52829444578b3599fdbdecb436f191836b8"}, @hao={0xc9, 0x10, @private1={0xfc, 0x1, '\x00', 0x1}}, @hao={0xc9, 0x10, @private1}]}], {0x4e21, 0x4e21, 0x1010, 0x0, @gue={{0x2, 0x0, 0x2, 0x3, 0x100, @val=0x80}, "a4189354327d97b05e816f3c50c7ccbb5a9263ceee4ae75f542e77659f6ee800623e9bde988c85ef592b13f3fc5ba3ce730324b64f881e59f772bacd1c93c5d27ff417d4ae806ae9a2196621fb8deea2cfa27af95ab18e4f3e0c024df0d8a73c1fdc8069c96832388a0fe9ab3dacc08da0bfc581476a55f4b5ef220a564ec6704631fb10bd952cbf5bed1d1c7d7e0e62d3a21270d8cb9dbb67ce089d1c28c0b44a52203e9ab544761d79289e50f703ab9a8ed24cf9e3efc4fa598a72933e8209d0f18ca723c3df92732bf281436d6e60b3c4d673c805328461092d2f3e039183165b92d95a483d7a566693e1619de59f92e0b1e1c64851a2e46600a20cac9d7705eb5cd3144dd68afe01e89389a185fa9ba2c70b873f780c35e7abf0f22ba6be359c1859d95c44287fadf99700ee60baec0cbca463dce641dd3a43e332e4f15a978c28bfa3d395f57bd3ea2e50e1400262f388a4e16eacb79c97ba5e387127b5df329d503b00be78de55f52bddc9da77c106cc83d26177bfbfd4b2d1b5609b862a090d6daff655b4320584def7118bf0a09854d37a6d8c2d29da47f6a472059dd13b3e5fc094cd03fc5c2f29e00528b0ae85e9c997e5222a8443449b442ebd50788c6f61887a46c5fd5b70e5c5537f2692b487b6afaeba8b145cf53c9721faa11c9191c1c596fb464b68f68cd4333472a72ed1380b8d25b621d33fe64ad61dc3df3ceb6331c96c034dfd6cdc49c1f2889255f3c2f9ba7500ce447a9bec287c63c5de11e123bdf79fc0f14dff3da82330a4893c16fde5260acec9b30db38e6ac3e9c3da584900a8feee0ac5ac1b640dbd791374cef655a16cf4e95b6cdeef0fe51af647bb21791f0a380bd30b26042d824742008c9b236012a656ba959ac5ca3cb55ce465105850d1ead2c8af2c582e0f894ebf5df5cd504d27edd2a172bce30be4b76c0354e5572e4690fb42849314d4404c3498114ee40c10fea920028842488c2feeb331ca1ead396eef814804bb5e0f3d0eb6ccde6efbb42066c7338bc3c5578dc4454bdc6e1679327872baa584cd432e01698d62526215540512b595e77fc5c76c6cee4f034230497190dd4d82b852b289e447218e675dd870001bcbcbc2791ffc1685d84de92cc1c5bd085b892f289c51dae6564258a8ed208b03cf2b398b3763965f3b607d7062aa15aa992dfca39ba5a1a09aa38c64efadd159b9dc12a8d5e6891bcde0a06edd7de40d63e9ab87e101cffa9a8654f2e4fcc636cdc2621e609cdae8df4bdfbfa0eeba84fa80b64972004842f69a2d0b2db6fb931eb2c59cb20d63318bc3cc21121b2282b2be46fe6d5b4e72009cf3c501ef34b3ab48f306dd9c7099cfc6c361062a86e9dcff034f59b2c114a889dd81ec3fa4e1e48ae5671dabbdad2292a10038ff5dd8be7b635dac613fb3d80998f0c0291ce4bf435508818ec1fe5b654ebf447ee618de469604af900451107a888674e5b5be9b9dfa44c113115e8ee68bc2cdbd35549af25d7601d5abc54063614521fd5ddf03fca5c0ba5e1671e19c8ec09e7af5bf3741d2685d706e2484f18150b048f5ecc85d0d398fffd66a0d9ef08ad1ccf6934b426e679c98df4391ceafe4e8796a0d8ac7af8999c2258df23947453fe3396e59fd67eb5a7699bf0fe91aa973ada248eebe6a7a23cb4a48eaf58838d1d9d25fa0db2bd8108004b8d2f7b8b67c7ef9119297d93c46287dc7910bd5ff990c1639e02d903507693793f9e16d1a1b9bc44bb419b55f33bec319657a73b0499b6cfc10f31434277aa18bfe6fba8ed2d9711abbca601bc9afb6240a074f28ec02adb0f99483a13d1a9f0fe367754d6865806e5a26d2c5f262c2ce6fbdb3f775f62eba79f9ad385378dff0cd8a9bac2894f0c1176049eb3b4721873356dc94be93b80363d040d4c123eb78c444b2e2c6b0308aa6b6079ad4c95ebe28c722cbc24026436e80afbfc27347f8f874fcc9fad1e7c25f0dbc8e63b31eb7907bfa70aaa681c597baef4bdb74a97bcf4ae13566cbe6089a93899f4ef0d5d4208c5a7c5489583b76ea61061fc56ce4eb775a77e5a3328c3bb38401bf999bd29873659533618c5dfb3d1eba3d1523184ee6fdb9fb6043e3fc434bf0d1e15217dfd9a10d08d61fbfcc6a6228607b01bab39385a066452f8aafd68fc6428aac2c4fca90ccaaf55c23d901c8cd771721b6c1fecc511820b659f8ec9b613eaeb36ed6a7c97b77ee4e5d6e5e762c78b3776b584d3f9f3619d812445f60cae3102602836e8ad4ab866daf3d7bbdf64d7bfbf990cb479cbdda787846b9d9c263832246de1204f660adc80ed13dbbb62bd81b6f38b14d97b177ffc1e169c570d3d4d2d6de8437ca86302581b4bd84bd630f795e1bf2c11c6e078584c13d7ba9aaf1e58b185d0b80b05b8a1e4a6dfbe60fbd155ac6a2dc0ac5497621988323f006f6307983db012b43dc367dceaa1a21999edd2da047584e0e9d6f1724aac7b87d63a21551952c3c9c35ce9de0632ea6676ba16101f98215bbaa1f0d7d37e586f3aac3ebaf3ccb577a39a5d066dbaf9f4647427f2407800d4ba407eebab23d0ef6f4dfb3c196fd665d2e5a97878822a3ca7541ac5043c1e5163b3a037624bea9eb3bcddce5cbfd893ba316e90559948745849c24713dfc5dae1da028799e9787a5039f0500e0f4349f6b8a710cc95b17dc029206ae53606c5be11c2334a302ad19eda78b2deca8c38ddf3179ba8ea218e9b3c49f607a315f5f77f23de2fea8c0058496acb5f7877fb0260ae95501123dcd956aa9d0ca40d230e0e631d55207d0b06d7c3d22e96e9f4bec8de5a24743e6644eee28ee7fa4fcfd2b9e968b8a397ed4b8556ea99bb802f4906207d114f6a22c27df726033cb9207833e68306a027d973d40c2ee5b76d79f13e595f8de3d044b5f8faf6209b3b1faadc5e083ebdc6e39e219dbf2899db36fd801022cd96c7b241a0c2e99bf4ff9c7a01156dad379f4841d8d2186f150c9bb36fa066ed94c1e25ecf5816f6b6c64ce6a2ec5bf951fd711f1b1ebee0209a6520a40792a426b0e9fc7ba6003cd310c5556c4835ea82a99c58f7168ad77cfd75aaa3f8a81abd07b619058ffd86d8bdedc66f276d81b5885290fb5470eeb4edde6cc262fb99ff4f63b007d2778fd94445a289e50a32fc375c0f0dc48bcd4c1a180f9eeb76e900832a9cbdcb4ee6f8020164aad6e4e67b816ba3624cdad254a2b2c22ad525310489c8d4d1670606ab72609791524454cbda19412b2f7cf6cb37bed92a289d62c50113bac970765cb663c2115347e181bcf44fa7bd9138b6435f78d312a938b9e0c760c1610ba234ad7ab51dfef25adf392eadfc6305ec3c5fbec2e953df2b90979e05f267e8e1b08070b74da43783d535f3fc9e9d7a5bd3bc2e69d733a94a06e34661e5470d5f26e0f554b59f9fb2b685162037f7a7cf701348f3bafee4c0c804bf50f073cc2ac6e5ce61395adb6ae4055bbb62f6d3ecbd6f6c782f34ff7cf6da39d0ac53326850b48fdfa86f49fcd50279af9db067d076d3134b0e59aab1afe47a07853f68a9c1c401d829c1d235b713e2220505609a196330e0048c368fdf080a1c97ed68547de85a9a21e608f51fbd04d2124facc68e7ea674c14636b2657898b36febc82c2103fe45bd4c377dbddfd007fb7eabaf0d36ab128aefad6c55b013392e8a4c7922f6032222bc7b61dc51ce02f6284b955db4ccc3cb4e7c13aa496bf11be3991928f5703706dfe6e5cbc87101da0e96cea91e0a61f5a6f3b567b57ab9f58983aae71edbc936254bd807ddd6d49382f625f8f227f2d4c5c25d598e4757d10ad143b46fafb304c05c91f8575d0129c28c2b4fd38181c0d9c1b8ffb5e7aa7acb1dda9373bc531b0b80e8cef44b58fbbb022298fb29b073b001fe1395fc761b33c0a4b397a868a7568f85345970c2feabba3016bf49bc8c2279fce2beca0b379502f762d751074f2bf9c845676aab07ec6e57096bc6b75c84e192f45f10b4e9e4b73cafd2c448feb65069beacd497c1247795783b1bfde4a8b3107e310a6cc5b6cd82a70f381fcd61d493e7d72bc6ab7b652eddc5b8d54cf7e1ac66661aa2e46d3e5230c02564651d92c0df7452ad1c4b608fe460a459612f6d59badcec3bdb5a74e3750ce01bb53d8885726bf5226796b239fe3697aedbef6e05b8cf4ea8459f353ad373b745e1d720a196883c33cad6e71d9373329906e3fbfd39866d5f7912b43cbbb09acf26085da6fef3a28647f516e196c1ed8396b45597dc1556309ff91a39139e4fdf501372c87329c6246dc30330b7fc8b53678c175799f3ba7146cac68125e5207307578d5df23e6a3d020b71b056df4f703c4ea8f0a27f48170e4a54bf0b993b6f26a681c6a56e0ebe7541c53e0fc31dd2a29968004e28a469d729de49597a1345cfc6de7a3460630f722650d6f5d7ff4cac03f1b3abf1f3c3b413cfd317286fdacb55fcf1597b482ce28123ccd0e734f6ba9bdff8497837c298e4678193d2b66195989d1b298ae4d7aa76f9822a202f7b0b62a9ee4595a523acb40fe5300168ba6b47514a5786d234d0813482ffa03772845deacaeaf279481753e0100313ba3968fdc9b7c5aa98475e0fe16d5ab622807629cdc55c69ada80fdba00e00629b23b8e28c5d65b2f9f9c3962f033b4b8124952260cc46ba81972f3f06c7a067af8013b41e0faee704e433c2f60654b766e15cd9107d13e9e8e4f81fe6153403325a8bbd3777e4edc833d2106cfdaa3559af2f2894a55c91d429f235f678c5a82bb529322eac59cefba3159169f4f893369f6839b3b128fe6b9a94751db3ae56df3e6895dc371b069cfbb0127ad93eddefbc6face8e1507a30221199bdd39fa52033ad0b058e952e1008e70079efccafd09b0a58b91b5c33f7aa9e78099091623ffcdcdff681c5715c409f11d2edbaf8e6a5b25cf3c7a07229b6920ed3755315149c90272eca4f4d9f959387e3d470b76d1b68d6478484a1d67391d2e3667a3ad1d7cdfebf3031518c153ec215ae449811671326f8451cb45b3f9908c10276e281730bc5c4075482fe4c7e165c9a3ad300b6741fb157960c367df6f80fa1c6ef869cf9ba700f70c66020ea0ef17cd71196d90ed145138d4b2e683cec49708bfa04a9c291e117cf12b641ecf576be65510b93414089b8a01430326dec129fda29164df6f597a5ff932b6da616257492edc70b8d11867eb6532d9b3614d176726a4d0652e1638e4f6f28a573d6d7cd96ad77c2dd151b53a74987e722b549d369eff59051d8c2fd8bbf4369c0ef4f0f7880aedbf0de839283b93510646ee4ea061ad3a20baf4e5d32e8af0c47c5dbb45c980bcf38601f68428700287a0b0977a7271902b405e1710f798980fa9b551d86a9b5dd4a67dcf4d5d67538c94eb755afad427cbe74615fcbeef92bc0cd8bb0a2ae6515d0f680aef9cdcb05906e266fbdf51c79a44dc776f23e53847de8555a67e97ffcb6b77fdc791e6e7ffc8a0d01df62455fbb9b2ebac68734f20e6bef74bc0d1ea9cc236e37d250b9e580e3bd171614d12f476f40289fa4f8740553f26747410a63171772ab9fd888238d9c2b6987c54842c8b4896b5c7e86ffab93028babdc196c2ef796c02023892aeb6a5f9d75b262a0f4fbc17512a2ecad789caa4266907f6dca1599fbebe759d7deeea2fd5647cf1761cd15aea920b4e532df4823c7e5d7335ee490aec7631ab0a605996b598cdbb8da3deeb486528ff738e3ead62777c2236b7d113db4f71417f9043be67fb69692bd30f99266222"}}}}}}, 0x10ba) ioctl$FS_IOC_FIEMAP(r11, 0xc020660b, &(0x7f00000048c0)={0x3, 0xe0c9, 0x2, 0x100, 0x9, 0x0, [{0x0, 0xe, 0x280000, '\x00', 0x1200}, {0x5, 0x9a4, 0xffffffffffffffff, '\x00', 0x80}, {0x0, 0x4, 0x7, '\x00', 0x1188}, {0x8, 0x9, 0x3}, {0x0, 0x2, 0x1, '\x00', 0x1800}, {0x200, 0xffffffffffffffff, 0x101, '\x00', 0x800}, {0x62, 0x8, 0x2}, {0xfffffffffffffffe, 0x4, 0x101, '\x00', 0x1}, {0x7a67, 0x5, 0x7, '\x00', 0x2004}]}) r14 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r15 = syz_genetlink_get_family_id$nl802154(&(0x7f0000004b40), r4) ioctl$sock_SIOCGIFINDEX_802154(r4, 0x8933, &(0x7f0000004b80)={'wpan4\x00', 0x0}) sendmsg$NL802154_CMD_GET_SEC_LEVEL(r14, &(0x7f0000004c40)={&(0x7f0000004b00)={0x10, 0x0, 0x0, 0x40}, 0xc, &(0x7f0000004c00)={&(0x7f0000004bc0)={0x30, r15, 0x400, 0x70bd2b, 0x25dfdbff, {}, [@NL802154_ATTR_IFINDEX={0x8, 0x3, r5}, @NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x2}, @NL802154_ATTR_IFINDEX={0x8, 0x3, r16}]}, 0x30}, 0x1, 0x0, 0x0, 0x4}, 0x4048000) setsockopt$MRT_INIT(r13, 0x0, 0xc8, &(0x7f0000004c80), 0x4) r17 = syz_genetlink_get_family_id$nfc(&(0x7f0000004d00), r4) sendmsg$NFC_CMD_START_POLL(r14, &(0x7f0000004dc0)={&(0x7f0000004cc0)={0x10, 0x0, 0x0, 0x800}, 0xc, &(0x7f0000004d80)={&(0x7f0000004d40)={0x34, r17, 0x200, 0x70bd27, 0x25dfdbff, {}, [@NFC_ATTR_TM_PROTOCOLS={0x8, 0xe, 0x4}, @NFC_ATTR_IM_PROTOCOLS={0x8, 0xd, 0x34}, @NFC_ATTR_PROTOCOLS={0x8, 0x3, 0x90}, @NFC_ATTR_IM_PROTOCOLS={0x8, 0xd, 0x2}]}, 0x34}, 0x1, 0x0, 0x0, 0x80}, 0x80c5) ioctl$OCFS2_IOC_GROUP_ADD64(r1, 0x40186f03, &(0x7f0000004e00)={0x6, 0x9, 0x9, 0x7fff}) ioctl$IOCTL_GET_NCIDEV_IDX(r12, 0x0, &(0x7f0000004e40)) r18 = syz_genetlink_get_family_id$ipvs(&(0x7f0000004ec0), r8) sendmsg$IPVS_CMD_FLUSH(r9, &(0x7f0000005040)={&(0x7f0000004e80)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f0000005000)={&(0x7f0000004f00)={0xdc, r18, 0x1, 0x70bd2b, 0x25dfdbfb, {}, [@IPVS_CMD_ATTR_DAEMON={0x64, 0x3, 0x0, 0x1, [@IPVS_DAEMON_ATTR_MCAST_GROUP={0x8, 0x5, @loopback}, @IPVS_DAEMON_ATTR_MCAST_GROUP6={0x14, 0x6, @mcast2}, @IPVS_DAEMON_ATTR_MCAST_IFN={0x14, 0x2, 'rose0\x00'}, @IPVS_DAEMON_ATTR_MCAST_GROUP6={0x14, 0x6, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02'}, @IPVS_DAEMON_ATTR_SYNC_MAXLEN={0x6, 0x4, 0x9}, @IPVS_DAEMON_ATTR_MCAST_GROUP6={0x14, 0x6, @private2={0xfc, 0x2, '\x00', 0x1}}]}, @IPVS_CMD_ATTR_SERVICE={0x38, 0x1, 0x0, 0x1, [@IPVS_SVC_ATTR_ADDR={0x14, 0x3, @ipv6=@private1}, @IPVS_SVC_ATTR_TIMEOUT={0x8, 0x8, 0x1}, @IPVS_SVC_ATTR_TIMEOUT={0x8, 0x8, 0x7}, @IPVS_SVC_ATTR_PE_NAME={0x8}, @IPVS_SVC_ATTR_PROTOCOL={0x6, 0x2, 0x87}]}, @IPVS_CMD_ATTR_DEST={0x24, 0x2, 0x0, 0x1, [@IPVS_DEST_ATTR_TUN_TYPE={0x5, 0xd, 0x1}, @IPVS_DEST_ATTR_ADDR_FAMILY={0x6, 0xb, 0xa}, @IPVS_DEST_ATTR_ACTIVE_CONNS={0x8, 0x7, 0x4}, @IPVS_DEST_ATTR_TUN_PORT={0x6, 0xe, 0x4e21}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4, 0x3}]}, 0xdc}, 0x1, 0x0, 0x0, 0x20044000}, 0x20040045) ioctl$XFS_IOC_SCRUB_METADATA(r10, 0xc040583c, &(0x7f0000005080)={0x16, 0x4, 0xfffffffffffffff2, 0x5, 0x8}) 1.418120976s ago: executing program 3 (id=4284): r0 = socket$tipc(0x1e, 0x2, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000000)=ANY=[@ANYBLOB="240000002100010000000000000000000a0000200000000000000000050019"], 0x24}, 0x1, 0x0, 0x0, 0x4008000}, 0x20000000) sendto$inet6(0xffffffffffffffff, &(0x7f0000000000)="9000000020", 0x5, 0x0, 0x0, 0x0) r1 = socket$inet6(0x10, 0x3, 0x0) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) ioctl$sock_SIOCETHTOOL(r2, 0x8946, &(0x7f00000001c0)={'pimreg\x00', &(0x7f0000000180)=@ethtool_cmd={0xa, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, [0x10000000]}}) sendto$inet6(r1, &(0x7f0000000000)='.', 0x10a73, 0x800, 0x0, 0x4b6ae4f95a5de35b) bind$tipc(r0, &(0x7f0000000200)=@nameseq={0x1e, 0x1, 0x0, {0x42, 0x0, 0xfffffffd}}, 0x10) r3 = socket$tipc(0x1e, 0x5, 0x0) bind$tipc(r3, &(0x7f0000000100)=@name={0x1e, 0x2, 0x2, {{0x42}, 0x4}}, 0x10) r4 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000280)='blkio.bfq.io_serviced\x00', 0x26e1, 0x0) mmap(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0xd, 0x30, r0, 0x12974000) close(r4) r5 = socket$tipc(0x1e, 0x5, 0x0) sendmsg$tipc(r5, &(0x7f0000000380)={&(0x7f0000000140)=@name={0x1e, 0x2, 0x1, {{0x42, 0x1}}}, 0x10, 0x0, 0x0, 0x0, 0x0, 0x4000884}, 0x845) 1.416324985s ago: executing program 1 (id=4285): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000040), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000400)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_CONTROL_PORT_FRAME(r0, &(0x7f0000003700)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000000c0)=ANY=[@ANYBLOB="000000005b4c5a8f3464debc72a8996243413645bda668962af4b52a303ee9437c1d016feaea434e824df320542e60dde8033ccd98f4de8c1b7a3c1c69ab7464c5a858454e6ad1f5ee21d240055c56418c0af6cf4bb05d981a020a1f0ba19bcf9c32a5e1475039ec9f8e853ddc05b8a579dc1220695f0dd563d1b9", @ANYRES16=r1, @ANYBLOB="010000000000000000008100000008000300", @ANYRES32=r2, @ANYBLOB], 0x1c}}, 0x0) 1.364300963s ago: executing program 0 (id=4286): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = socket$unix(0x1, 0x2, 0x0) r2 = syz_genetlink_get_family_id$nl80211(&(0x7f00000000c0), 0xffffffffffffffff) r3 = socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$MPTCP_PM_CMD_DEL_ADDR(r3, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000180)={0x20, r4, 0x7, 0x0, 0x0, {}, [@MPTCP_PM_ATTR_ADDR={0xc, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_IF_IDX={0x8}]}]}, 0x20}}, 0x8080) sendmsg$NL80211_CMD_JOIN_IBSS(r3, &(0x7f0000000200)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x20000000}, 0xc, &(0x7f00000001c0)={&(0x7f0000000140)={0x6c, r2, 0x800, 0x70bd2c, 0x25dfdbfc, {{}, {@void, @void}}, [@NL80211_ATTR_MESH_CONFIG={0x2c, 0x23, 0x0, 0x1, [@NL80211_MESHCONF_HWMP_ACTIVE_PATH_TIMEOUT={0x8, 0xb, 0x9}, @NL80211_MESHCONF_GATE_ANNOUNCEMENTS={0x5, 0x11, 0x1}, @NL80211_MESHCONF_GATE_ANNOUNCEMENTS={0x5, 0x11, 0x1}, @NL80211_MESHCONF_HWMP_PERR_MIN_INTERVAL={0x6, 0x12, 0x7}, @NL80211_MESHCONF_PLINK_TIMEOUT={0x8, 0x1c, 0x1}]}, @NL80211_ATTR_FREQ_FIXED={0x4}, @NL80211_ATTR_PRIVACY={0x4}, @NL80211_ATTR_PRIVACY={0x4}, @NL80211_ATTR_HT_CAPABILITY_MASK={0x1e, 0x94, {0x40, 0x3, 0x5, 0x0, {0x5, 0x7, 0x0, 0x6d, 0x0, 0x0, 0x1, 0x1}, 0x1, 0x1, 0x2}}]}, 0x6c}, 0x1, 0x0, 0x0, 0x4000091}, 0x20008000) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f0000000100)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_NEW_INTERFACE(r0, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000340)=ANY=[@ANYBLOB='P\x00\x00\x00', @ANYRES16=r2, @ANYBLOB="010038bd7000fddbdf250700000008000300", @ANYRES32=r5, @ANYBLOB="0c009900ff070000700000001400040073797a6b616c6c65723000000000000008000500070000000a0018"], 0x50}, 0x1, 0x0, 0x0, 0x91}, 0x24044884) 1.315854651s ago: executing program 1 (id=4287): r0 = socket$inet_tcp(0x2, 0x1, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000004c0)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000dc0)=ANY=[@ANYBLOB="340100001900000425ad7000fbdbdf251d0100001e0106000e34500402723cb4f29c48edd9c833acc9dc67b3fce1df544612efc03939e94252aade9ca080238342353e205781a372d25c92769143933facb4862f07bfa6e5ae74f762d0d2879574c12718ebea8624826102ddd1daf29a0c1df68b10460b61a34c80de934201838e213ba1c5d395b2bbdc8fe3181160b618b4ec5be0949870fb4ff6923385ecdbe6b09be17c1c1385014760ef8d3f90624c9602cdcac45a382c00650105b944fd5793271655fbd54370f934ec9d10ec71fff1c58aed3b1ea868e0711e33313645e87f989de53fcfc3a8e1fc74a7c975c2d1664238e34551afcda5236fa698168d33dcd8b68c1a0fe59ae52fd7010201fe2a2000"/293], 0x134}}, 0x4004) r1 = socket$inet6(0xa, 0x80001, 0x0) setsockopt$inet6_MCAST_MSFILTER(r1, 0x29, 0x30, &(0x7f00000000c0)=ANY=[@ANYBLOB="12000000000000000a00000000000000ff"], 0x90) r2 = socket$inet6(0xa, 0x80002, 0x0) mmap(&(0x7f0000000000/0x95c000)=nil, 0x95c000, 0x9, 0x8c4b815a5465c2b1, 0xffffffffffffffff, 0x0) connect$inet6(r2, &(0x7f0000000100)={0xa, 0x4e24, 0x405, @loopback, 0x1087}, 0x1c) ioctl$int_in(r0, 0x5452, 0x0) bind$inet(r0, &(0x7f0000000080)={0x2, 0x4e20, @broadcast}, 0x10) r3 = bpf$MAP_CREATE(0x0, &(0x7f0000000a80)=ANY=[@ANYBLOB="1e0000000000000010800000120000050000000098947c2ccb0e113ee209a68aa0f77a37d9bc6a3e6367c8e99bfbf2d2a42b1162d5692ef0112cb0173d43941be7f48f286b7d3ce12641abf0c0fee47d7aceab6b122c11354ef2ec37569b0ee5fbf5c488e70a8308664f62d2b71632ff50e09b5f931608ce6808a094027440821e11bc8eb010180f5d4287a53ea90a494d96eb021b36ba5556188b556867f1", @ANYRES32, @ANYBLOB="0000000000000000000000000000005dbe4c0f00e8428e6142265f9e0f8b81c1a4350c1793a988fe69d14b1bfdfabe8024cdefaddb157a2ecf43edb0f0a9320098f5511cdeaf818566728cc1af34dd5036b9b78e70ef6825c37e39a94b42112adf4b500776824337410377f14ac47be58e7eb92e13fdce26c08f4747add45474d92c472b0f801f59a7497c63b939a2815e0232b5954fb058a059089742d84b674f7476003631ebc3b7db11fe9813cdf0c621f9130d22752eccb52a1af7c7e07816bd361ad62bdf112b670bd705370f22db25ac05c90697b7e4018c70d209d97cc2872e06756d32a14025833a759934b5df058002245b23889cab73589c68599907708d06e60686910afbfd61bb4e92a974fc", @ANYRES32=0x0, @ANYRES32, @ANYBLOB='\x00'/28], 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xf, &(0x7f00000005c0)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r3, @ANYBLOB="0000000000000000b702000014000000b7030000000000008500000083000000bf0900000000000055090100000000009500000000000000bf91000000000000b7020000000000008500000000000000b70000000000000095"], &(0x7f0000000480)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) r4 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r5 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000180), 0xffffffffffffffff) sendmsg$NL802154_CMD_NEW_SEC_LEVEL(r4, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000900)=ANY=[@ANYBLOB=' \x00\x00\x00', @ANYRES16=r5, @ANYBLOB="01002dbd7000ffdbdf25200000000c5c0006000100000001f0ff007f11fd6050143152b42a25fda37b8694b62cb1d7d7f6605008cd5911b6d966b07ae96e0f9de3e12b7d314fe9059284d75d5b9282e564ce07e47ef6369ec727c7110b927410d1723e70c899d126556962531e10bdf7cb46536f52c3e20c94224555deb72b44f030e81d2f1a7f2228a0b4f5a6dc9be3f152ecd30474000000000000000026a726a14cf36c82219c757709ea75d218c66d5a9b51c5ad2b4d853d561c8c8074a99ecd2ee120588a81cd019bd0f2b2"], 0x20}}, 0x20040840) r6 = socket$nl_generic(0x10, 0x3, 0x10) r7 = socket(0xa, 0x3, 0xff) setsockopt$inet6_int(r7, 0x29, 0x7, &(0x7f0000000040)=0xde8, 0x56) r8 = syz_genetlink_get_family_id$devlink(&(0x7f00000000c0), r7) sendmsg$DEVLINK_CMD_PORT_UNSPLIT(r6, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000280)=ANY=[@ANYBLOB="f27d5fb16254101cdc31850ac5379987c296ccfccd7b427301a272138cb97e6a1704dd785f8f639de1b06d42f10bfeefc5a96e8a", @ANYRES16=r8, @ANYBLOB="3107000000002000000038000000080001007063690011000200303030303a30303a31302e300000000008007300020000000e0001006e657464657673696d0000000f0002006e657464657673696d3000000800030004000000"], 0x60}, 0x1, 0x2}, 0x0) r9 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFNL_MSG_ACCT_GET_CTRZERO(r9, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000040)=ANY=[@ANYBLOB="28000300020701020000000000000000070000060000000000000040010000090800024000000000"], 0x28}, 0x1, 0x0, 0x0, 0xd5e52a39dc1e9bf4}, 0x8090) r10 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r10, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000040)=ANY=[@ANYBLOB="3f36dfe9d05b978f0000140100fe00"/24], 0x1c}}, 0x0) ioctl(r0, 0x2, &(0x7f0000000340)="4b77a21fbfdf5aa5093a9bf38b88a1377e57f8b43d23bd7fd88b97b320bb75b84e691e5f7da1fb9c94686299683f4efadb3aae7445e154639d5b2348572114360c653049fda6fa84debeff78de0c52f5fb2cb65cdcaa15ac54132c57955f92332e213b4ed462ce09c6ace092fc7bacb669fb08913065379556bcc545217479dce68e1ffc3b846028b29a635eeb8c9ac91581595c6ba9121eda2207b8da3389ce318bf09b7d51d17e6c7b73dd98c575b646bc176dd90763fb2f2a57caa9de09000ae58602d8ac044640d59b") sendto$inet(r0, 0x0, 0x0, 0x20008005, &(0x7f0000000100)={0x2, 0x4e20, @multicast1}, 0x10) r11 = socket$nl_generic(0x10, 0x3, 0x10) r12 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$TIPC_NL_LINK_RESET_STATS(r11, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000240)={0x14, r12, 0x1}, 0x14}}, 0x0) sendmsg$TIPC_NL_NODE_GET(r6, &(0x7f00000008c0)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x20000}, 0xc, &(0x7f0000000880)={&(0x7f0000000640)={0x214, r12, 0x300, 0x70bd2d, 0x25dfdbfd, {}, [@TIPC_NLA_NET={0x44, 0x7, 0x0, 0x1, [@TIPC_NLA_NET_NODEID_W1={0xc, 0x4, 0x100000000}, @TIPC_NLA_NET_NODEID={0xc, 0x3, 0x8}, @TIPC_NLA_NET_NODEID_W1={0xc, 0x4, 0x6a4}, @TIPC_NLA_NET_NODEID_W1={0xc, 0x4, 0xb}, @TIPC_NLA_NET_ID={0x8, 0x1, 0x8d}, @TIPC_NLA_NET_ID={0x8, 0x1, 0x2}]}, @TIPC_NLA_BEARER={0x54, 0x1, 0x0, 0x1, [@TIPC_NLA_BEARER_UDP_OPTS={0x38, 0x4, {{0x20, 0x1, @in6={0xa, 0x4e24, 0x8d, @loopback, 0x9}}, {0x14, 0x2, @in={0x2, 0x4e21, @remote}}}}, @TIPC_NLA_BEARER_NAME={0x15, 0x1, @l2={'ib', 0x3a, 'veth0_to_bond\x00'}}]}, @TIPC_NLA_BEARER={0x44, 0x1, 0x0, 0x1, [@TIPC_NLA_BEARER_DOMAIN={0x8, 0x3, 0x4}, @TIPC_NLA_BEARER_UDP_OPTS={0x38, 0x4, {{0x20, 0x1, @in6={0xa, 0x4e24, 0x6, @private2={0xfc, 0x2, '\x00', 0x1}}}, {0x14, 0x2, @in={0x2, 0x4e23, @loopback}}}}]}, @TIPC_NLA_NODE={0x4c, 0x6, 0x0, 0x1, [@TIPC_NLA_NODE_KEY={0x45, 0x4, {'gcm(aes)\x00', 0x1d, "3f2e9b487748b5650ac6deb710d43ffa74f9e10455088fba280e11ba60"}}]}, @TIPC_NLA_NODE={0xd8, 0x6, 0x0, 0x1, [@TIPC_NLA_NODE_REKEYING={0x8, 0x6, 0x7}, @TIPC_NLA_NODE_KEY={0x47, 0x4, {'gcm(aes)\x00', 0x1f, "90214224923a2aa789fcd34cb650fc342704bb397a4e22f6bb7d2f82c09d91"}}, @TIPC_NLA_NODE_ADDR={0x8, 0x1, 0x1ff}, @TIPC_NLA_NODE_REKEYING={0x8, 0x6, 0x3}, @TIPC_NLA_NODE_KEY_MASTER={0x4}, @TIPC_NLA_NODE_ID={0x5c, 0x3, "b1ee762e1df39922c6c95de2a153995b47289e3870c2c5b71241c16bf99d7371ad914798d6cf5da18ee967f2e0124f939bfb466347cca3583bb95a2b4173b5b3518776170b7d4f4d7b4540f84d98bbe7c63cff247f5a8da1"}, @TIPC_NLA_NODE_KEY_MASTER={0x4}, @TIPC_NLA_NODE_ADDR={0x8, 0x1, 0xfffffffc}, @TIPC_NLA_NODE_ADDR={0x8, 0x1, 0x2}]}]}, 0x214}, 0x1, 0x0, 0x0, 0x24008400}, 0x0) sendmmsg$inet6(r0, &(0x7f0000001240), 0x1, 0x8001) 1.02907777s ago: executing program 0 (id=4289): r0 = socket(0x10, 0x3, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x2) syz_genetlink_get_family_id$mptcp(&(0x7f00000000c0), r2) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000003c0)=0x14) sendmsg$nl_route(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="3c0000001000010400eeffff11ffffffff000000", @ANYRES32=r3, @ANYBLOB="01000000010000001c0012000c000100627269646765"], 0x3c}}, 0x0) r4 = socket$nl_generic(0x10, 0x3, 0x10) r5 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r4, 0x8933, &(0x7f00000000c0)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_SET_INTERFACE(r4, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000240)={0x9c, r5, 0x5, 0x0, 0x0, {{}, {@void, @void}}, [@mon_options]}, 0x9c}}, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) setsockopt$SO_ATTACH_FILTER(r7, 0x1, 0x1a, 0x0, 0x0) sendmsg$NL80211_CMD_START_AP(r4, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000340)={0x90, r5, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r6}, @void}}, [@beacon=[@NL80211_ATTR_BEACON_HEAD={0x39, 0xe, {{{}, {}, @device_b, @device_b, @from_mac}, 0x0, @default, 0x0, @void, @void, @void, @void, @void, @void, @void, @void, @void, @void, @void, @val={0x71, 0x7, {0x1, 0x0, 0x1, 0x1, 0xffffffffffffffff, 0x7, 0x1}}, @val={0x76, 0x6, {0xb, 0x6, 0x3b, 0x99}}}}, @NL80211_ATTR_IE={0x1d, 0x2a, [@mesh_config={0x71, 0x7, {0x0, 0x1, 0x1, 0x1, 0x2, 0xf, 0x48}}, @challenge={0x10, 0x1, 0xe5}, @gcr_ga={0xbd, 0x6, @device_b}, @measure_req={0x26, 0x3, {0x0, 0x4, 0x9}}]}], @chandef_params=[@NL80211_ATTR_WIPHY_FREQ={0x8}], @NL80211_ATTR_BEACON_INTERVAL={0x8}, @NL80211_ATTR_DTIM_PERIOD={0x8, 0xd, 0xa4a2}]}, 0x90}, 0x1, 0x0, 0x0, 0x4004000}, 0x0) bind$xdp(0xffffffffffffffff, &(0x7f0000000080)={0x2d, 0x0, 0x0, 0xc}, 0x10) ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8933, &(0x7f00000013c0)={'wlan1\x00'}) sendmsg$NL80211_CMD_NEW_KEY(0xffffffffffffffff, 0x0, 0x80) sendmsg$nl_route_sched(r0, &(0x7f0000005840)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000300)=@newqdisc={0x48, 0x24, 0x5820a61ca228651, 0x0, 0x2, {0x0, 0x0, 0x0, r3, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_htb={{0x8}, {0x1c, 0x2, [@TCA_HTB_INIT={0x18, 0x2, {0x3, 0x7fffffff, 0x1}}]}}]}, 0x48}}, 0x8d4) sendmsg$nl_route_sched(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000540)=@newtfilter={0xd8, 0x28, 0xd27, 0x0, 0x0, {0x0, 0x0, 0x0, r3, {0xc}, {0xfff2}, {0xfff1, 0x3d}}, [@filter_kind_options=@f_bpf={{0x8}, {0xac, 0x2, [@TCA_BPF_ACT={0x4c}, @TCA_BPF_NAME={0xc, 0x7, './file0\x00'}]}}]}, 0xd8}}, 0x0) 1.025532901s ago: executing program 3 (id=4290): r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f00000002c0)=ANY=[@ANYBLOB="30000000190001000000000000000000021800000000ff000000000008000100ac1414000c0009"], 0x30}}, 0x0) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(0xffffffffffffffff, 0x89f1, &(0x7f0000000080)={'gre0\x00', &(0x7f0000000040)={'gre0\x00', 0x0, 0x7, 0x0, 0x3, 0x6, {{0x6, 0x4, 0x0, 0x8, 0x18, 0x66, 0x0, 0x1, 0x4, 0x0, @initdev={0xac, 0x1e, 0x1, 0x0}, @dev={0xac, 0x14, 0x14, 0x27}, {[@end]}}}}}) getpeername$packet(0xffffffffffffffff, &(0x7f00000000c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @local}, &(0x7f0000000180)=0x14) ioctl$sock_ipv4_tunnel_SIOCDELTUNNEL(0xffffffffffffffff, 0x89f2, &(0x7f0000000300)={'erspan0\x00', &(0x7f00000001c0)={'syztnl1\x00', 0x0, 0x78b0, 0x1, 0x5, 0x10, {{0x34, 0x4, 0x0, 0xc, 0xd0, 0x68, 0x0, 0x1, 0x29, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @dev={0xac, 0x14, 0x14, 0x3a}, {[@rr={0x7, 0x1f, 0x14, [@multicast1, @broadcast, @loopback, @multicast1, @remote, @multicast2, @private=0xa010102]}, @cipso={0x86, 0x3e, 0x3, [{0x2, 0x7, "a80a2af722"}, {0x7, 0x11, "689c9811e345c18c9a6b481d0bd170"}, {0x0, 0x9, "d368e1a1c70cf9"}, {0x1, 0x4, ',\f'}, {0x5, 0x8, "2015a9ded100"}, {0x5, 0xb, "9e86f71fcb45f4145c"}]}, @ra={0x94, 0x4}, @ra={0x94, 0x4}, @generic={0x86, 0x4, "5e9e"}, @ra={0x94, 0x4}, @timestamp_prespec={0x44, 0xc, 0xd9, 0x3, 0x0, [{@private=0xa010101, 0xb}]}, @timestamp_prespec={0x44, 0x3c, 0x45, 0x3, 0x0, [{@rand_addr=0x64010102, 0x4}, {@private=0xa010100, 0x2}, {@dev={0xac, 0x14, 0x14, 0x21}, 0x800}, {@private=0xa010100, 0xe}, {@rand_addr=0x64010100, 0x6}, {@loopback, 0x9}, {@loopback, 0x5}]}, @ra={0x94, 0x4, 0x1}]}}}}}) ioctl$sock_ipv6_tunnel_SIOCADDTUNNEL(0xffffffffffffffff, 0x89f1, &(0x7f00000003c0)={'ip6_vti0\x00', &(0x7f0000000340)={'syztnl2\x00', 0x0, 0x2f, 0x1, 0x3, 0x7fffffff, 0x0, @empty, @local, 0x20, 0x80, 0x673180ec, 0x4}}) ioctl$sock_ipv4_tunnel_SIOCCHGTUNNEL(0xffffffffffffffff, 0x89f3, &(0x7f0000000480)={'syztnl1\x00', &(0x7f0000000400)={'syztnl0\x00', 0x0, 0x10, 0x8, 0x9, 0x5, {{0xe, 0x4, 0x2, 0x9, 0x38, 0x67, 0x0, 0x4, 0x4, 0x0, @remote, @broadcast, {[@timestamp_prespec={0x44, 0x24, 0x37, 0x3, 0x2, [{@broadcast, 0x4}, {@dev={0xac, 0x14, 0x14, 0x37}, 0x2}, {@initdev={0xac, 0x1e, 0x1, 0x0}, 0x7}, {@initdev={0xac, 0x1e, 0x1, 0x0}, 0x5}]}]}}}}}) r6 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$ETHTOOL_MSG_PAUSE_SET(r6, &(0x7f0000000b00)={&(0x7f0000000980)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f0000000ac0)={&(0x7f00000009c0)={0xe8, 0x0, 0x200, 0x70bd28, 0x25dfdbfb, {}, [@ETHTOOL_A_PAUSE_HEADER={0x60, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x1}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x3}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r3}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'veth0_to_batadv\x00'}, @ETHTOOL_A_HEADER_FLAGS={0x8}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r3}, @ETHTOOL_A_HEADER_FLAGS={0x8}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r2}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x3}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r1}]}, @ETHTOOL_A_PAUSE_TX={0x5, 0x4, 0x1}, @ETHTOOL_A_PAUSE_AUTONEG={0x5, 0x2, 0x1}, @ETHTOOL_A_PAUSE_RX={0x5}, @ETHTOOL_A_PAUSE_RX={0x5, 0x3, 0x1}, @ETHTOOL_A_PAUSE_HEADER={0x54, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'veth0_to_hsr\x00'}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r3}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r5}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x2}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r4}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'vxcan1\x00'}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x2}]}]}, 0xe8}, 0x1, 0x0, 0x0, 0x2000}, 0x4000005) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r0, 0x8933, &(0x7f00000004c0)={'batadv_slave_1\x00', 0x0}) getsockopt$inet6_mreq(0xffffffffffffffff, 0x29, 0x1b, &(0x7f0000000500)={@mcast1, 0x0}, &(0x7f0000000540)=0x14) r9 = socket(0x10, 0x803, 0x0) r10 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r10, 0x8933, &(0x7f0000000100)={'team_slave_1\x00', 0x0}) sendmsg$nl_route_sched(r9, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=@newqdisc={0x2c, 0x24, 0x4ee4e6a52ff56541, 0x70bd27, 0xffffffff, {0x0, 0x0, 0x0, r11, {0x0, 0x4}, {0xffff, 0xffff}, {0xb, 0xfff3}}, [@qdisc_kind_options=@q_qfg={0x8}]}, 0x2c}, 0x1, 0x0, 0x0, 0x4000}, 0x0) sendmsg$nl_route_sched(r9, &(0x7f0000006040)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000840)=@newtfilter={0x54, 0x2c, 0xd2b, 0x70bd2b, 0x25dfdbfb, {0x0, 0x0, 0x0, r11, {0x4}, {}, {0x4, 0xfff3}}, [@filter_kind_options=@f_u32={{0x8}, {0x28, 0x2, [@TCA_U32_SEL={0x24, 0x5, {0xc, 0x6, 0x1, 0x3d3f, 0x0, 0xfff, 0x3, 0x58f, [{0xebd, 0x4, 0x206, 0x4}]}}]}}]}, 0x54}}, 0x24040084) sendmsg$nl_route_sched(r0, &(0x7f0000000940)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x4000}, 0xc, &(0x7f0000000900)={&(0x7f0000000580)=@deltfilter={0x364, 0x2d, 0x1, 0x70bd2b, 0x25dfdbfe, {0x0, 0x0, 0x0, r1, {0x2, 0xffff}, {0x10, 0xfff1}, {0xffe0, 0x1}}, [@filter_kind_options=@f_flower={{0xb}, {0x2e0, 0x2, [@TCA_FLOWER_KEY_ARP_THA_MASK={0xa, 0x42, [0xff, 0x0, 0x0, 0xff, 0x0, 0xff]}, @TCA_FLOWER_ACT={0x2b4, 0x3, [@m_mirred={0x1cc, 0x7, 0x0, 0x0, {{0xb}, {0xe4, 0x2, 0x0, 0x1, [@TCA_MIRRED_PARMS={0x20, 0x2, {{0x4e, 0x100, 0x2, 0x80000000, 0x3ff}, 0x2, r2}}, @TCA_MIRRED_PARMS={0x20, 0x2, {{0x3, 0xc3e4, 0x5, 0xb, 0x92}, 0x4, r3}}, @TCA_MIRRED_PARMS={0x20, 0x2, {{0x5, 0x6, 0xfffffffffffffff8, 0x4, 0xe2}, 0x4, r4}}, @TCA_MIRRED_PARMS={0x20, 0x2, {{0x9, 0x4, 0x4, 0x9, 0x9}, 0x3, r5}}, @TCA_MIRRED_PARMS={0x20, 0x2, {{0x1, 0xb, 0x20000000, 0xfffffffc, 0x8}, 0x2, r7}}, @TCA_MIRRED_PARMS={0x20, 0x2, {{0xa, 0x9, 0x1, 0x3, 0x9386}, 0x2, r8}}, @TCA_MIRRED_PARMS={0x20, 0x2, {{0x5, 0x8, 0xffffffffffffffff, 0x200, 0x7c}, 0x3, r11}}]}, {0xbe, 0x6, "81abceae246c0b5559e9f0dfedce11e6622a0023f6e429cb69753d3b5aa5c4f9d428dae03cb6439b17bc7bed938d164089cbb25e4a65cb953fca5701a68c314594d8b81281345c2e59304e422a1b5064ed01d3f5c9e28b806803c0fc71829d6577c210173478ed147f92a48ab4aa852dfef7f5e96f83848096b24fd736c9a0db539308e16f7e53120ca5d1c2d8b164bf0e0dddb3f3eafeb417914fc804c32bef7d1f1038dab826447540bc27c6f0f61fa96bbc5cba4e5d2dfca9"}, {0xc, 0x7, {0x0, 0x1}}, {0xc, 0x8, {0x0, 0x2}}}}, @m_ife={0xe4, 0x4, 0x0, 0x0, {{0x8}, {0x6c, 0x2, 0x0, 0x1, [@TCA_IFE_DMAC={0xa, 0x3, @broadcast}, @TCA_IFE_SMAC={0xa, 0x4, @broadcast}, @TCA_IFE_DMAC={0xa}, @TCA_IFE_METALST={0x30, 0x6, [@IFE_META_SKBMARK={0x4, 0x1, @void}, @IFE_META_TCINDEX={0x6, 0x5, @val=0x9f00}, @IFE_META_TCINDEX={0x4, 0x5, @void}, @IFE_META_SKBMARK={0x4, 0x1, @void}, @IFE_META_TCINDEX={0x6, 0x5, @val=0xffff}, @IFE_META_PRIO={0x4, 0x3, @void}, @IFE_META_PRIO={0x4, 0x3, @void}, @IFE_META_PRIO={0x8, 0x3, @val=0x9}]}, @TCA_IFE_TYPE={0x6, 0x5, 0x2}, @TCA_IFE_DMAC={0xa, 0x3, @link_local}]}, {0x52, 0x6, "e4fb084cdab445be5fdeb4dc3834f0f73d7de31f0d1be93725c7abb5bda178753117b117aef9bc96af68455a04c840112b7bf6daa7097e64a54932bb1902b42d0151cd64444cea5ce459a2f692a2"}, {0xc, 0x7, {0x1}}, {0xc, 0x8, {0x3, 0x2}}}}]}, @TCA_FLOWER_KEY_IP_TTL={0x5, 0x4b, 0xc}, @TCA_FLOWER_KEY_ICMPV4_TYPE={0x5}, @TCA_FLOWER_KEY_ETH_SRC={0xa, 0x6, @local}]}}, @filter_kind_options=@f_flower={{0xb}, {0x48, 0x2, [@TCA_FLOWER_KEY_UDP_SRC={0x6}, @TCA_FLOWER_KEY_ARP_OP={0x5, 0x3d, 0x8}, @TCA_FLOWER_KEY_ENC_UDP_DST_PORT_MASK={0x6}, @TCA_FLOWER_KEY_ARP_SIP_MASK={0x8, 0x3a, 0xff}, @TCA_FLOWER_KEY_MPLS_LABEL={0x8, 0x46, 0x2}, @TCA_FLOWER_KEY_FLAGS={0x8, 0x2f, 0x1}, @TCA_FLOWER_KEY_ENC_IPV6_DST={0x14, 0x21, @remote}]}}]}, 0x364}, 0x1, 0x0, 0x0, 0x40080d0}, 0x86) 954.336077ms ago: executing program 1 (id=4292): write(0xffffffffffffffff, 0x0, 0x0) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r1 = socket(0x400000000010, 0x3, 0x0) r2 = socket$unix(0x1, 0x5, 0x0) r3 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) r5 = socket$netlink(0x10, 0x3, 0x0) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r7, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) openat$cgroup_ro(r2, &(0x7f00000000c0)='memory.events.local\x00', 0x0, 0x0) bpf$PROG_LOAD_XDP(0x5, &(0x7f00000002c0)={0x10, 0x4, &(0x7f0000001880)=ANY=[@ANYBLOB="1800000000000000000000000000000071101d000000000095"], &(0x7f0000000040)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x54, '\x00', 0x0, 0x9}, 0x94) sendmsg$nl_route_sched(r6, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000280)=@newqdisc={0x2c, 0x24, 0x4ee4e6a52ff56541, 0x70bd26, 0xffffffff, {0x0, 0x0, 0x0, r8, {0x0, 0x6}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_qfg={0x8}]}, 0x2c}}, 0x24040084) r9 = socket$netlink(0x10, 0x3, 0x0) r10 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r10, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r9, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000180)=@newqdisc={0x58, 0x28, 0x4ee4e6a52ff56541, 0x70bd2d, 0x25dfdbfb, {0x0, 0x0, 0x0, r11, {0xfff3}, {0xffff, 0xffff}, {0xffef, 0x1}}, [@qdisc_kind_options=@q_sfb={{0x8}, {0x2c, 0x2, @TCA_SFB_PARMS={0x28, 0x1, {0x82, 0x3, 0x4, 0xffff, 0x7f, 0x7fffffff, 0x1, 0x40, 0x2}}}}]}, 0x58}, 0x1, 0x0, 0x0, 0xdc}, 0x0) sendmsg$nl_route_sched(r5, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000140)=@newqdisc={0x34, 0x28, 0x4ee4e6a52ff56541, 0x4001, 0xfffffdfc, {0x0, 0x0, 0x0, r4, {}, {0xffff, 0xffff}, {0x2, 0x1}}, [@qdisc_kind_options=@q_taprio={{0xb}, {0x4}}]}, 0x34}, 0x1, 0x0, 0x0, 0x400dc}, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r1, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0x25dfdbfd, {0x0, 0x0, 0x0, r12, {0x0, 0xfff1}, {0xffff, 0xffff}, {0x0, 0xf}}, [@qdisc_kind_options=@q_multiq={{0xb}, {0x8, 0x2, {0x42}}}]}, 0x38}}, 0x0) 899.781367ms ago: executing program 2 (id=4293): r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) sendmsg$TIPC_NL_NET_GET(r1, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000140)={0x0}}, 0x1) r2 = socket$inet(0x2, 0x4000000000000001, 0x0) ioctl$sock_inet_udp_SIOCINQ(r2, 0x8905, &(0x7f0000000100)) r3 = syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x3) connect$packet(r3, &(0x7f0000000200)={0x1f, 0xf8, 0x0, 0x1, 0x2}, 0x14) getsockname$packet(r1, &(0x7f0000000600)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000000)=0x14) r5 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_SWAP(r5, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000001c0)={0x4c, 0x6, 0x6, 0x101, 0x0, 0x0, {0x5, 0x0, 0x2}, [@IPSET_ATTR_SETNAME2={0x9, 0x3, 'syz2\x00'}, @IPSET_ATTR_SETNAME2={0x9, 0x3, 'syz0\x00'}, @IPSET_ATTR_SETNAME2={0x9, 0x3, 'syz1\x00'}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}, @IPSET_ATTR_PROTOCOL={0x5}]}, 0x4c}, 0x1, 0x0, 0x0, 0x90}, 0x20000000) r6 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) ioctl$TUNSETIFF(r6, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x2}) r7 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) close(r7) r8 = socket$nl_route(0x10, 0x3, 0x0) r9 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$netlink(r9, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f0000000280)=ANY=[@ANYBLOB="440000001f0001"], 0x44}], 0x1}, 0x0) ioctl$sock_SIOCGIFINDEX(r8, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r8, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000500)=@newqdisc={0x40, 0x24, 0x4ee4e6a52ff56541, 0x3, 0x25dfdbff, {0x0, 0x0, 0x0, r10, {0x0, 0xb}, {0xffff, 0xffff}, {0xfff2}}, [@qdisc_kind_options=@q_fq={{0x7}, {0x14, 0x2, [@TCA_FQ_CE_THRESHOLD={0x8, 0xc, 0x5}, @TCA_FQ_FLOW_MAX_RATE={0x8}]}}]}, 0x40}, 0x1, 0x0, 0x0, 0x40088c1}, 0x0) sendmsg$AUDIT_DEL_RULE(r1, &(0x7f0000000ac0)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f0000000a80)={&(0x7f0000000640)={0x430, 0x3f4, 0x200, 0x70bd25, 0x25dfdbff, {0x1, 0x1, 0x36, [0x0, 0xc776, 0x6, 0x2, 0x0, 0x0, 0x1, 0x800, 0x1, 0x481f, 0x27, 0x1ae9, 0x3, 0x9, 0xdaa6, 0xf, 0x0, 0x81, 0x8, 0x5, 0x8, 0xa, 0xfffffffa, 0x7, 0x53, 0x6, 0x2, 0x1000, 0x4, 0x8001, 0x40, 0x7edb, 0x5, 0x8, 0x1, 0x2, 0x6, 0x3, 0x3, 0x9, 0xfff, 0xe9e, 0x7fff, 0x0, 0x6, 0x2, 0xfffffffa, 0x0, 0x3, 0x5, 0xffff7fff, 0x618d, 0x7, 0xa6e, 0x6, 0x4, 0x9, 0x66a, 0x3f1f, 0x5, 0xffff, 0x3fff, 0x2, 0x7fff], [0x10000, 0x5517, 0xfffffff9, 0x6, 0x8, 0x1, 0x9, 0x8, 0x7, 0x685ba7c4, 0x71, 0x4, 0x80000000, 0x40, 0x0, 0x81, 0xdf, 0x5, 0x5e, 0x10, 0x9, 0x7, 0x2, 0x80000001, 0x401, 0xe, 0x5, 0x80000001, 0x6, 0x9, 0x3, 0x9, 0x80, 0x5, 0x6, 0x7fffffff, 0x7, 0x8, 0x7, 0x1cabe9d2, 0x28, 0xffffffff, 0xb, 0x1, 0x40, 0x8, 0x2, 0x5, 0x8, 0x3, 0x2, 0x5a, 0x5, 0x6, 0x1, 0x7fff, 0x1, 0x9, 0x24000, 0xab9, 0x40, 0x9, 0x8, 0x7fff], [0x0, 0x9, 0xfa, 0x100, 0x9, 0x4, 0x2, 0x8, 0x5, 0xd, 0x1, 0x4, 0x4, 0x65be1f58, 0x800, 0x7fffffff, 0xc8, 0x4, 0xc7, 0x4, 0x8, 0xfe70, 0xc, 0x0, 0x7ff, 0x1, 0x2, 0xa, 0x3, 0x1a23, 0x6, 0xffffffff, 0xfffffff9, 0x6, 0xb595, 0x7, 0xce3e, 0x6, 0x6, 0x4, 0x6, 0x80, 0x3, 0x4, 0xb7d, 0x5, 0x8, 0x8, 0x2, 0x0, 0x0, 0x193d4082, 0x0, 0x7, 0x5, 0x0, 0x7ff, 0x464691d, 0x8, 0x3, 0x7ff, 0x5b, 0x534c, 0x5], [0xd0, 0xb, 0x10, 0x1, 0xfff, 0xd, 0xfffffffb, 0x9, 0x9, 0x5, 0xe46, 0x80, 0x6881, 0xfffffff8, 0x4, 0x4, 0x8, 0xfff, 0x3, 0xa, 0x6, 0x9, 0x7, 0x80, 0x86ea, 0x400, 0x19, 0xc000, 0x7, 0x96b, 0x1ff, 0x86e8, 0x5, 0x7d6, 0x4bf35853, 0x0, 0x2, 0x7ff, 0xfffffff9, 0x6, 0xdd1a, 0x5, 0x1, 0x9, 0x1, 0x4, 0xf, 0xd1c0, 0x2, 0x2, 0xe, 0xd46, 0x9, 0x8, 0x8, 0x737, 0x0, 0x6, 0x1, 0x32, 0x7, 0x1, 0x100, 0x1ed3], 0xd, ['\\)@\\\x00', '\xeb\x00', '&},*@\x00']}, ["", "", "", "", "", "", "", "", ""]}, 0x430}, 0x1, 0x0, 0x0, 0x24000010}, 0x0) ioctl$SIOCSIFHWADDR(r7, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) r11 = socket$unix(0x1, 0x1, 0x0) r12 = socket$kcm(0x11, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r11, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$kcm(r12, &(0x7f00000000c0)={&(0x7f0000000140)=@xdp={0x2c, 0xdd86, r13, 0x15}, 0x80, &(0x7f0000000500)=[{&(0x7f0000000200)="f3a7b9b72c617e5eb41027a91e9d", 0xe}], 0x1}, 0x44) sendmsg$nl_route(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000500)=ANY=[@ANYBLOB="4c00000010001fff00000097cfd0f801ccd07c00", @ANYRES32=0x0, @ANYBLOB="81ffffff000000001c0012800b00010067726574617000000c00028008000100", @ANYRES32=r4, @ANYBLOB="08000d000000000008001f0008000000"], 0x4c}}, 0x0) 802.108361ms ago: executing program 4 (id=4294): r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$sock_inet_SIOCSIFFLAGS(r1, 0x8924, &(0x7f00000000c0)={'dummy0\x00', 0x1}) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$batadv(&(0x7f0000000080), 0xffffffffffffffff) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r3, 0x8933, &(0x7f0000000140)={'batadv0\x00', 0x0}) sendmsg$BATADV_CMD_GET_NEIGHBORS(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000000)=ANY=[@ANYBLOB='$\x00\x00\x00', @ANYRES16=r4, @ANYBLOB="310300000000000000000900000008000300", @ANYRES32=r5, @ANYBLOB="080006"], 0x24}}, 0x4) sendmsg$BATADV_CMD_SET_MESH(r2, &(0x7f0000000240)={&(0x7f0000000000), 0xc, &(0x7f0000000200)={&(0x7f0000000180)={0x4c, r4, 0x200, 0x70bd27, 0x25dfdbff, {}, [@BATADV_ATTR_ELP_INTERVAL={0x8, 0x3a, 0x4}, @BATADV_ATTR_BRIDGE_LOOP_AVOIDANCE_ENABLED={0x5, 0x2e, 0x1}, @BATADV_ATTR_TPMETER_TEST_TIME={0x8, 0xb, 0x7}, @BATADV_ATTR_GW_BANDWIDTH_DOWN={0x8, 0x31, 0x3}, @BATADV_ATTR_ISOLATION_MASK={0x8, 0x2c, 0x4}, @BATADV_ATTR_MULTICAST_FANOUT={0x8, 0x3c, 0x1000}, @BATADV_ATTR_TPMETER_TEST_TIME={0x8, 0xb, 0xe}]}, 0x4c}, 0x1, 0x0, 0x0, 0x81}, 0x24000000) sendmsg$nl_route(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000100)=@setneightbl={0x7c, 0x43, 0x20, 0x70bd29, 0x25dfdbfb, {0x7}, [@NDTA_GC_INTERVAL={0xc, 0x8, 0x3}, @NDTA_PARMS={0x24, 0x6, 0x0, 0x1, [@NDTPA_UCAST_PROBES={0x8, 0xa, 0x2}, @NDTPA_APP_PROBES={0x8, 0x9, 0xff}, @NDTPA_UCAST_PROBES={0x8, 0xa, 0x7}, @NDTPA_APP_PROBES={0x8, 0x9, 0xb}]}, @NDTA_GC_INTERVAL={0xc, 0x8, 0x4}, @NDTA_THRESH2={0x8, 0x3, 0x9}, @NDTA_GC_INTERVAL={0xc, 0x8, 0x7b}, @NDTA_THRESH1={0x8, 0x2, 0xcb}, @NDTA_NAME={0x5, 0x1, '\x00'}, @NDTA_THRESH1={0x8, 0x2, 0x8}]}, 0x7c}}, 0x0) 734.957514ms ago: executing program 3 (id=4295): socket$nl_route(0x10, 0x3, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000200)=ANY=[@ANYBLOB="2800000021000100"], 0x28}}, 0x0) sendmsg$nl_route(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000300)=@ipv6_newaddr={0x18, 0x14, 0x121, 0x0, 0x0, {0x23}}, 0x18}}, 0x0) r1 = socket$unix(0x1, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f0000000040)={'wlan1\x00'}) r2 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFNL_MSG_CTHELPER_GET(r3, &(0x7f0000002f40)={0x0, 0x0, &(0x7f0000002f00)={&(0x7f00000003c0)=ANY=[@ANYBLOB="440000000104000000000000000000000000300002002c00018014000300fc0000000000000000000000000000001400040000005a9560bc5d829de6fe8941d10848300500000000000000000000000000010000"], 0x44}}, 0x0) ioctl(r2, 0x8b2c, &(0x7f0000000040)) r4 = socket$inet_smc(0x2b, 0x1, 0x0) listen(r4, 0x4003) r5 = socket$tipc(0x1e, 0x2, 0x0) bind$tipc(r5, &(0x7f0000000100)=@name={0x1e, 0x2, 0x3, {{0x42}}}, 0x10) bind$tipc(r5, &(0x7f00000000c0)=@name={0x1e, 0x2, 0x9d3354bba4295a8d, {{0x41}}}, 0x10) ioctl$sock_inet_tcp_SIOCATMARK(r4, 0x8905, 0x0) r6 = socket$nl_route(0x10, 0x3, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000140)={0x16, 0x3, &(0x7f0000000000)=ANY=[@ANYBLOB="7a0a00ff00000028711052000000000095"], &(0x7f0000000480)='syzkaller\x00'}, 0x94) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(0xffffffffffffffff, 0x89f1, &(0x7f0000000340)={'syztnl0\x00', &(0x7f0000000280)={'syztnl0\x00', 0x0, 0x1, 0x80, 0x5, 0x10, {{0x10, 0x4, 0x0, 0x32, 0x40, 0x66, 0x0, 0x8, 0x4, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @rand_addr=0x64010102, {[@ssrr={0x89, 0xf, 0xa3, [@broadcast, @private=0xa010102, @private=0xa010102]}, @ssrr={0x89, 0xf, 0x23, [@multicast1, @dev={0xac, 0x14, 0x14, 0x21}, @multicast1]}, @timestamp={0x44, 0x8, 0x9b, 0x0, 0x6, [0x8000]}, @ra={0x94, 0x4, 0x1}]}}}}}) r8 = socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_TX_RING(r8, 0x11b, 0x3, &(0x7f0000000200)=0x301a00, 0x4) sendmsg$nl_route(r6, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000380)=@delneigh={0x30, 0x1d, 0x4, 0x70bd28, 0x25dfdbfd, {0xa, 0x0, 0x0, r7, 0x0, 0x11, 0x8}, [@NDA_MASTER={0x8, 0x9, 0x9}, @NDA_DST_MAC={0xa, 0x1, @remote}]}, 0x30}}, 0x0) sendmsg$NFT_BATCH(r3, &(0x7f0000000700)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x4000000}, 0xc, &(0x7f00000006c0)={&(0x7f00000004c0)=ANY=[@ANYBLOB="140000001000010000000000000000000700000ac00000000b0a010200000000000000000a0000016a000d406530480c042d4c7f0a89f837a2f98a1273879801f06375186e5c6596c585ca0fc25c1f6c525424daf6393bd92f191a17da180678fd0d2faaaf5975d97070dcd2666dd6587919022622f6a0802288c10c08af0a234d2d7c8aa620fc671e476f002d2baa07a114000008000640000000000c000b4000000000000000100800044000000000080008400000000110001180090001006c617374000000000c00104000000000000000041c000000030a010300000000000000000300000308000540fffffffb48000000080a010800000000000000000000000208000a4000000001170007406b30ddb42a4973d6836b0fecfb8132d08627bd0008000940000000030900010073797a300000000020000000120a03000000000000000000020000020c000640000000000000000478000000020a01030000000000000000030000070c000440000000000000000458000600fdf9aa73133f5a33d21565e76feb5f3695edba9ac2b938a9171aa6ac9d726e5099dcb87cc0352792c91c969ee42c62df426b0d7b74126ca50301197eadd094dbf49993ccd6a59ba4f9587fb646a894d580cf2361140000001100010000000000000000000300000a"], 0x1e4}, 0x1, 0x0, 0x0, 0x10}, 0x4) 663.939064ms ago: executing program 4 (id=4296): r0 = bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x4, 0xe, &(0x7f0000000880)=ANY=[@ANYBLOB="b702000000000020bfa300000000000007030000f0ffffff7a0af0ff0200000079a4f0ff00000000b706000000000081ad64020000000000450404000100ff0f1704000001130a00b7050000010000006a0af2fe00000000850000002b000000b700000000000000950000000000000000e154cd8445974b26c933f7ffffffffe4fbffffff55bb2007ee51050512b5b42128aa090a79507df79f298129daa7a6b2f91af50342115e17392ac627c87881c000006146001e04aeacea799a22a2fa798b5adc43eb27d53319d0ad229e5752548300000000dbc2777df150b7cdd77b85b941092314fd085f028f2ed1a4535550614e09d6378198a6097a670838337af2abd55a87ac0394b2f92ffab7d153d62058d0a413b2173619ccf55520f22c9ca8b6712f3024b7041b1df65b3e1b9bf115646d14ce53d13d0ccacda1ef0900094fa737c28b99938512c816fdcceaede3faedc51d29a47fc813a2ec00f4c7a53ac271d6d7f4ea6bf97f2f33e2ea2e534300bcb3fdc4b4861004eefbda7f54f82a804da4f85db47a4a69bf9bc5fa96ee293fbd165a5a68488e40b030166565a097b1b44b451de736bb6d43db8db03d4b7745fef1d04ec633dee254a6d491b849a5a787e814c4fd21a18986252a70f8f92eb6f0e8c7db4bf23242a1f2c28159f09943b1b0452d1b72183aacf4a84f9130b775dd4e9e3070756f97ad791fa99dac06b57479321a0574fb30ff0000001989328c8ddc20ea011bf5742e0e024334db8b20ce3f9f16cb7fc20fb4791ec85823d0c48fb657c29b309c73f0977e7cde65a82b94c461d7962b0d2277a84af326f37f3e2c25a61ec45c3af97a8f17da954aff3fc8c108755f75ca13fb7c8bbd8b6e7dac1aba4b20dc7de058a4dfa7e85a8bdf1d41a2d8bda74d66f47cc180f82c5f573c6d294d3665016ac59dda0fde4745db06753a7ac74a2d32f7528751313694bf5700b20ef0c248ddd3da32396a614cacad4aff2066bb5d4045c958559b7dcb98a6273b8c651e24d9f679e4fbe948dfb4cc4a389469608241730459f0123fd39206000000000000eb55dad46de56ef907b059b90b8aa49afb9a79ae5498f6589880ed6eea7f9c670012be05e7de0940313c5870786554df26236ebced9390cb6941b8375d936a7d2120eca291963eb2d537d8ee4de5c183c960119451c31539b22809e1d7f0cda06a9fa87d64cb77872a2cd8a104e16bb1a2ba9c29faa38c409d32b6b7d6cf13464ca03aff14a9aa4bd9539f5096412b92012e095b84c20243ff98df3347f0e399d1b9f27e3c33269c0e153b28b2d4410572bc45b9d3fa02208d304d455c36300000000022320178b00cc6ed7966130b547dbf8b497af002000000cd1d00000020000000ef19349ee7f31abc11c800000000000000000000000928ee53595a779d243a48cea769470424d28804c04b2c4324ab7f4a5c81921f0128dfd70b438af60b060000000000000056642b49b745f3bf2cf7908b6d7d748308eea09fc361b4735efbf3411718d6ee7aebf9ef679dbfae9fb4a79f8a836804ed3a1079b0282a12043408cd60b687dcff91af19010000000000000000456f7d2a42bd13da202274f20675eb781925441578e93046aaddea8ec4ca37f71c2710a7ea8ae0dc214e1cc275b26adfa892e6de92000000000000000000ddff004cff9ec7ffff35e62f4eeee50e5bafecea4d4134f9d006c8d6883eca5c9c58c9e933119c5009c68c73de2f04f15d005387577f480000ea65559eb00e76e9d0ada201bcbb5c252b28a60ca770663da451790cc36000906d5a9fad98c308e39bd5ffb6151d79c1cee1cd102e3c8e63e9fba05e3633be3f00000015762e5f5a3a0bc33fdbe28a5ffc83f2b485185cc92fe7f791e8f6429309d6adab4b7e508e5bf024ed8f8a005f2bbf96c89739f5cf1e750d50517a59a3ad09e8802e8f4f535447cc0fc9d5f99a73145dfcedad69da9cd4375c624600e78f4458542b14f29611f95d4a31838eeb20c20bb82aa31771cd379ec83554cea5e6539db7384e1f58d81f2f2653c4d9818708e27c89b552d7fcd116bce9c764c714c9402c21d181aac59efb28d4f91652f6750b6ec962802c0320f8059195729d60c534ee8e8ff0755b67fe4c25edb85bcff24c757aa8090000000000008c420eb4304f66e3a37aaf000000c42a570f0e9dd617545470f862f8c3c14fa9ecd1e877b0d8ca84c044859e85e6158f9184bc61a9a284db80e4636c25b96174327d82761c26e329555f9290af4100000000000000749efd3763655500344bae34137f5ab0d534b8d63e4ca3b671f2de1cdf519192c6b59a601fd419adc16e2055b85058f793484305d7a1759782e4c571ee855a47bc00edf5e9020c09ab004321610b857e8717764b633b21cb32f0e03280e09758bd445ab91d20baca005452b79d7b574a247fa62fe45b3c4e93da3d51de647c10dd49944dc87c92332af00f191b66b6a6f732a91f0e2e9120bed64069dcf82d3e5e0361e58c79d497247d278888901d442ad7f8536605a644e9e3d769db497c3960dfde12182334caee994adc38a436367a54b9e182b78e9a0ceb9a2c4f63902c1ad1a7c5a08d0920a23c2a86abbdf357849a651733e57f31019876026888c8ccb85c86b4f8ffffff7f000000002c331fca0e541b7ca211c28ed61c525708a13d115b43f8b1894c8fa8a1000000002100000000000000000001000027c9a46157a3609b6fd9843ee19ec647249a9375de5858818f3c4a4fa6ce46f4d42b07199de8b99231ace58c77819ee214e49666c464d35ca9b5143ed3b3dc8c17a23692759ccf5a205311b7ab22532697b861dfb54609fd88e6043bd52ae84c1bb0c8a6c769f952283a1f4e3842edb3d42c68a27ef6a1296dfff4a979369b0e8ebc62887aa46e824d86869ec4ab392b0a74f91381dcc198e353047db70686d147357024eb3cb94f1e89cb5ba0a56aa046b4dc521a3d9356b4b8b5917c4c860495b240e80063bde261fd00000000007271e28ef6806bc8e139c49b91c76bea3858f78fbd8d31330d89069f9648a2ff93060ff073b3a113e47edf76f7d116d2b0976cf2ec447c030931651dd315003b7a6a5433a2bb3c035fc6846abe389b25c988f0bbb889560ae99ec4b227eda2e63a1c31a2c2bd48a822cbe92b6524e0cd8020ecaa34e19e7141d5e221509342bfe7d294d1eb3de6a50ca0301f89c2ee627e949c68b3a4a412a9b7d503a26e9a714ee5f72d8805dd1bfbd081f6a5d1f1289dfe14cb9194e26a44fac273461fc5c0e0a33db7f2d43ea8086cf059f40fa2640b6bfb74dd35f5a31059c01517cf4b6641fce9a24b96767b837ca037a1199735c375c705c798e0e208e4a5259d0bfa526b462af45a6eab34000000000000000000000000c4426344ec1a3366515dee221e747f55d7dd02534bc503b9b28277c253e410986bef2111a99cc448d652929f8a67a6a1d3f00dcad91aff428aade3f85714a1d3ef29acd4d49b62339c10c2ec0daca8d4c1090000000000000084d8223edbccbf9258b7374e79a1f8bf3fb73c8c6dbb7bbdfc399847a11921f97eba0ea14c4fed9a71eedb97c02461792e3a49dac16c60c3fcaab222025d78963c3ac899fa8b63f58a30212c9b2d7fe751e2046b78f86e22861b6504c667350244dd6d9189a8b9c45f8aaff9db694811ca86ed978f23eed7459c0382074170cf1e25b0e9ba3d36c309353eea4cd8ab96bafda393276bdd8d32ead8db9e1b54d2d3d50e2815268fc1a6ec566981bc8ca2a4583f3d40e817433d0f4f25cfe6cc1897449ba5f26a9d66ac73e6f5c401376f23a314e0b9ff997d22f3e34b7524642c248aa813edaa626f0000000000000000004f9e02a3b51a97c4b1c1b411cc6bee2a56f29c55a6aac46a0cfc318fae02922a403431d4e5a4396cad2c8dd34037bc041a2ba1505ba2c4889122ca04e85881aad5f8bfc12e6741872aad21bf5301cd4c607ef50a991c410f7c60e45b5c193f813a36d841165b91b5e170f6ba24558df57145eb8142a6ed87c6d5cbae3e52d569996604669a6e9ca1a3689c795970b4bcd00881faff52a6766fafa07ed7d4a49f47d34fd76a394adcb33a270b6a14e74bca7c2ea92dd845d3f774fde1bbea911c1ea76d52f7912e2597e6a33380647ed44956730b5b84662b8e659124379c0d86b1d28fdfa3cd2013103e3048c4ad4f5a4dcd133b2fc8fae3b51e4433cee7c08e67c7d7ed4432045e10f8718e5c163b1704fa2c707b61a1a9f63edfceff1a0cd7baf4a15b2fd607a09d398d73243bdcc664fbd5f582e48af2a18b02f0184a7bdd95ac78241e6749e74b152702333c56588375f806f10578eaae329c4f8dfb83e5524e2c9aa59ce7828bd1f146b2a4150fb2a8ced08e2ffac81e921e8a6f0071361a0acdbd125fb5f5e9ffe98e38508582a496afd30ca460dbfca77915a18b7b9ef6c1d6e13bc12fe43063cfecfafb05bf2339ad61533fbf3e410b403182742fa2d40c402cb83c2fef46a36f17c1abf97b0e2d114bd1472ab4207aa060f9e5d91c4a4911b1a1df47b858be141ab3386f26f561df35678489dc1b9f10eee1b2ab3dfdaedd7e06ff8a127f1743fcb32d7f80d40aebc1ea72edc348f5f9ba4bace97db948c24c679c74cd4336a7233d836082bb0e8b013bd1ee3612cd43cd2a3cb83754bb3408"], &(0x7f0000000140)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, &(0x7f00000001c0), 0xfffffedf, 0x10, &(0x7f0000000040), 0xffffff95, 0x0, 0xffffffffffffffff, 0xd}, 0x48) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f00000001c0)={'bond0\x00', 0x0}) sendmsg$nl_route(r1, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000000)=ANY=[@ANYBLOB="440000001000010400001d000080000000000000", @ANYRES32=0x0, @ANYBLOB="0380000000000000140012800b0001006970766c616e00000400028008000500", @ANYRES32=r2, @ANYBLOB="0800040036ee0000"], 0x44}, 0x1, 0x0, 0x0, 0x240008c4}, 0x4054) r3 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_int(r3, 0x107, 0xa, &(0x7f0000000080)=0x2, 0x4) (async) setsockopt$packet_tx_ring(r3, 0x107, 0xd, &(0x7f0000000200)=@req3={0x10000, 0x100000001, 0x10000, 0x1, 0x0, 0x0, 0xfffffffc}, 0x1c) (async) bpf$BPF_BTF_GET_FD_BY_ID(0x13, &(0x7f00000002c0)=0xffffffffffffffff, 0x4) (async) bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000380)={0x2, 0x4, 0x8, 0x1, 0x80, 0x1, 0x3, '\x00', 0x0, 0xffffffffffffffff, 0x1}, 0x50) ioctl$XFS_IOC_START_COMMIT(r0, 0x80585882, &(0x7f0000000400)) (async) r4 = socket(0x10, 0x3, 0x0) sendmsg$nl_generic(r4, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000001240)={&(0x7f0000000340)=ANY=[@ANYRESHEX=r3], 0x184}}, 0x4040000) r5 = bpf$MAP_CREATE(0x0, &(0x7f0000000640)=@base={0x10, 0x4, 0x4, 0x8}, 0x50) bpf$MAP_GET_NEXT_KEY(0x2, &(0x7f00000000c0)={r5, &(0x7f00000001c0), &(0x7f0000000080)=""/52}, 0x20) bpf$BPF_MAP_CONST_STR_FREEZE(0x16, &(0x7f0000000480), 0x4) (async) bpf$OBJ_GET_MAP(0x7, &(0x7f0000000500)=@generic={&(0x7f00000004c0)='./file0\x00'}, 0x18) (async) r6 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r6, 0x400454ca, &(0x7f0000000080)={'syzkaller0\x00', 0x7101}) r7 = socket$unix(0x1, 0x1, 0x0) r8 = socket$netlink(0x10, 0x3, 0x0) (async, rerun: 32) r9 = socket$nl_route(0x10, 0x3, 0x0) (async, rerun: 32) ioctl$sock_SIOCGIFINDEX(r7, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r9, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000280)=@newqdisc={0x2c, 0x24, 0x4ee4e6a52ff56541, 0x70bd26, 0xffffffff, {0x0, 0x0, 0x0, r10, {0x0, 0x6}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_qfg={0x8}]}, 0x2c}}, 0x24040084) (async) sendmsg$nl_route_sched(r8, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000540)={&(0x7f0000000400)=@newqdisc={0x34, 0x28, 0x4ee4e6a52ff56541, 0x4001, 0xfffffdfc, {0x0, 0x0, 0x0, r10, {0x4}, {0xffff, 0xffff}, {0x2, 0xa}}, [@qdisc_kind_options=@q_taprio={{0xb}, {0x4}}]}, 0x34}, 0x1, 0x0, 0x0, 0x400dc}, 0x0) (async) r11 = socket$netlink(0x10, 0x3, 0x0) (async) r12 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r12, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r11, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000580)=@newqdisc={0x88, 0x28, 0x4ee4e6a52ff56541, 0x4001, 0xfffffdfc, {0x0, 0x0, 0x0, r13, {}, {0xffff, 0xffff}, {0x2, 0x1}}, [@qdisc_kind_options=@q_mqprio={{0xb}, {0x58, 0x2, {{0xa, [0x6, 0x0, 0x7, 0x9, 0x5, 0x5, 0x6, 0x1, 0x7, 0xb, 0x6, 0x5, 0x6, 0xa, 0x2, 0xd], 0x0, [0xd, 0x7, 0x4, 0x9, 0x31f5, 0x155, 0x1, 0x0, 0x4, 0x4, 0x1, 0x400, 0xfff, 0xe403, 0x5e4d, 0xfff], [0x8, 0x2, 0x5, 0x2, 0xd, 0x5, 0x0, 0xff48, 0x6, 0x2, 0x401, 0x400, 0x4, 0x6, 0x2, 0x1]}}}}]}, 0x88}, 0x1, 0x0, 0x0, 0x85c}, 0x0) r14 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r14, 0x8933, &(0x7f0000000100)={'syzkaller0\x00'}) 616.574822ms ago: executing program 0 (id=4297): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x0) r1 = socket$igmp(0x2, 0x3, 0x2) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000040), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f0000000000)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_FRAME(r2, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=ANY=[@ANYBLOB='<\x00\x00\x00', @ANYRES16=r3, @ANYBLOB="010000000000000000003b00000008000300", @ANYRES32=r4, @ANYBLOB="1f003300d0000000080211000001080211000000505050505050"], 0x3c}, 0x1, 0x0, 0x0, 0x8800}, 0x10) sendmsg$NL80211_CMD_RELOAD_REGDB(0xffffffffffffffff, &(0x7f0000000140)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x4000}, 0xc, &(0x7f0000000100)={&(0x7f0000000040)={0x14, r3, 0x4, 0x70bd2c, 0x25dfdbfb, {}, [""]}, 0x14}, 0x1, 0x0, 0x0, 0xc4}, 0x20000001) sendmsg$NFT_BATCH(r0, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f0000000480)={{0x14, 0x10, 0x7c, 0x0, 0x6000, {0x5}}, [@NFT_MSG_NEWSET={0x3c, 0x9, 0xa, 0x401, 0x0, 0x0, {0xa, 0x0, 0x4}, [@NFTA_SET_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_SET_KEY_LEN={0x8, 0x5, 0x1, 0x0, 0x1}, @NFTA_SET_NAME={0x9, 0x2, 'syz1\x00'}, @NFTA_SET_ID={0x8, 0xa, 0x1, 0x0, 0xfffffffc}]}, @NFT_MSG_NEWSETELEM={0x40, 0xc, 0xa, 0x101, 0x0, 0x0, {0xa, 0x0, 0x6}, [@NFTA_SET_ELEM_LIST_SET={0x9, 0x2, 'syz1\x00'}, @NFTA_SET_ELEM_LIST_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_SET_ELEM_LIST_ELEMENTS={0x14, 0x3, 0x0, 0x1, [{0x10, 0x0, 0x0, 0x1, [@NFTA_SET_ELEM_KEY={0xc, 0x1, 0x0, 0x1, [@NFTA_DATA_VALUE={0x5, 0x1, "d1"}]}]}]}]}, @NFT_MSG_DELRULE={0x14, 0x8, 0xa, 0x101, 0x0, 0x0, {0x1, 0x0, 0x1}}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x1}}}, 0xb8}}, 0x40) 555.527702ms ago: executing program 1 (id=4298): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x2}) bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000300)={0x2, 0x4, 0x8, 0x1, 0x80, 0x1, 0x6483, '\x00', 0x0, 0xffffffffffffffff, 0x4, 0x1, 0x3}, 0x50) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket$packet(0x11, 0x3, 0x300) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000040)={'bridge0\x00', 0x0}) sendmsg$nl_route(r1, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000140)=@newlink={0x3c, 0x10, 0x1, 0x70bd25, 0x25dfdbfd, {0x0, 0x0, 0x0, r3, 0x52a10}, [@IFLA_LINKINFO={0x1c, 0x12, 0x0, 0x1, @bridge={{0xb}, {0xc, 0x2, 0x0, 0x1, [@IFLA_BR_MCAST_MLD_VERSION={0x5, 0x2c, 0x2}]}}}]}, 0x3c}, 0x1, 0x0, 0x0, 0x20004001}, 0x4000000) r4 = bpf$MAP_CREATE(0x0, &(0x7f0000000440)=@base={0x1e, 0x2, 0xb, 0x8, 0x4010, 0x1, 0x9, '\x00', r3, 0xffffffffffffffff, 0x4002, 0x4, 0x5}, 0x50) r5 = bpf$PROG_LOAD(0x5, &(0x7f0000000680)={0x11, 0x8, &(0x7f0000000240)=ANY=[@ANYBLOB="1800000000000000000000000000000018120000", @ANYRES32=r4, @ANYBLOB="0000000000000000b703000000000000850700001b000000b70000000000000095000000000000009c61d2af71e47537360994266b19f7dfa8ac890874debef52a65069b129947494a92593dcd7a794af1eda5f98f3688c0575e0070fd83337252bc9765ebebf5e9"], &(0x7f0000000780)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$PROG_BIND_MAP(0xa, &(0x7f0000000500)={r5}, 0xc) (async) bpf$BPF_MAP_LOOKUP_AND_DELETE_ELEM(0x15, &(0x7f0000000400)={r4, &(0x7f0000000100), &(0x7f00000001c0)=""/5}, 0x20) (async) r6 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) r7 = socket(0x400000000010, 0x3, 0x0) (async) r8 = openat$tun(0xffffffffffffff9c, &(0x7f00000001c0), 0xa2f01, 0x0) ioctl$TUNSETIFF(r8, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x6bf1c2d5adba8c32}) r9 = socket$inet6(0xa, 0x2, 0x0) bind$inet6(r9, &(0x7f0000000100)={0xa, 0x4e20, 0x8001, @ipv4={'\x00', '\xff\xff', @empty}}, 0x1c) (async) r10 = socket$kcm(0x2, 0xa, 0x2) ioctl$SIOCSIFHWADDR(r10, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local}) (async) write$tun(r8, &(0x7f00000006c0)=ANY=[@ANYBLOB="0a00001bbbbbbbbbbbbbaaaaaaaaaa2986dd6d002008001811ff20010000000000000000000000000001ff0200000000000000000000000000014f194e20"], 0x52) ioctl$sock_SIOCGIFINDEX(r7, 0x8933, &(0x7f0000000380)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r7, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000001c0)=@newqdisc={0x44, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0xffffffff, {0x0, 0x0, 0x0, r11, {0x0, 0x7ffe}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_hfsc={{0x9}, {0x14, 0x2, @TCA_HFSC_FSC={0x10, 0x2, {0x8, 0xd0, 0x200009}}}}]}, 0x44}}, 0x8000) (async) sendmsg$nl_route_sched(r7, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000800)=@deltclass={0x2c, 0x29, 0x200, 0x70bd2b, 0x25dfdbff, {0x0, 0x0, 0x0, r3, {0x5, 0xa}, {0xa, 0xc}, {0xfff1, 0x5466206fad657201}}, [@TCA_RATE={0x6, 0x5, {0xf8, 0xf5}}]}, 0x2c}, 0x1, 0x0, 0x0, 0x884}, 0x2) close(r6) socket(0x10, 0x3, 0x0) ioctl$SIOCSIFHWADDR(r6, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) (async) r12 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_int(r12, 0x107, 0xf, &(0x7f0000000100)=0x207, 0x4) ioctl$sock_SIOCGIFINDEX(r12, 0x8933, &(0x7f0000000040)={'syzkaller0\x00', 0x0}) sendto$packet(r12, &(0x7f00000002c0)="05031c00d3fc140000004788031c09102c28", 0xfdef, 0x4, &(0x7f0000000140)={0x11, 0x0, r13, 0x1, 0x0, 0x6, @multicast}, 0x14) 445.1206ms ago: executing program 3 (id=4299): r0 = socket$inet_sctp(0x2, 0x5, 0x84) setsockopt$inet_sctp_SCTP_EVENTS(r0, 0x84, 0xb, &(0x7f0000000100)={0x5, 0x8, 0x4, 0x0, 0x5, 0x25, 0x1, 0x0, 0x0, 0x3, 0x8, 0xba, 0x31}, 0xe) r1 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000240)={0x2, 0x4, 0x8, 0x1, 0x80, 0x0, 0x0, '\x00', 0x0, 0x0}, 0x48) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000340)={0x1e, 0x4, &(0x7f00000000c0)=@framed={{}, [@ldst={0x1, 0x0, 0x4, 0x0, 0x1, 0x50}]}, &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x24}, 0x90) r2 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f00000007c0)={0x1b, 0x0, 0x0, 0x40000, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0}, 0x50) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r3, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000003900)={{0x14}, [@NFT_MSG_NEWTABLE={0x20, 0x0, 0xa, 0x3, 0x0, 0x0, {0x7}, [@NFTA_TABLE_NAME={0x9, 0x1, 'syz0\x00'}]}, @NFT_MSG_NEWSET={0x3c, 0x9, 0xa, 0x401, 0x0, 0x0, {0x7}, [@NFTA_SET_ID={0x8}, @NFTA_SET_NAME={0x9, 0x2, 'syz1\x00'}, @NFTA_SET_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_SET_KEY_LEN={0x8, 0x5, 0x1, 0x0, 0x21}]}, @NFT_MSG_NEWSETELEM={0x44, 0x1e, 0xa, 0x201, 0x0, 0x0, {0x7}, [@NFTA_SET_ELEM_LIST_SET={0x9, 0x2, 'syz1\x00'}, @NFTA_SET_ELEM_LIST_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_SET_ELEM_LIST_ELEMENTS={0x18, 0x3, 0x0, 0x1, [{0x14, 0x0, 0x0, 0x1, [@NFTA_SET_ELEM_FLAGS={0x8}, @NFTA_SET_ELEM_KEY_END={0x4}, @NFTA_SET_ELEM_KEY={0xfffffff3}]}]}]}], {0x14, 0x10, 0x1, 0x0, 0x0, {0x0, 0x84}}}, 0xc8}}, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000840)={0xb, 0x1c, &(0x7f0000000000)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r2, @ANYBLOB="0000000000000000b702000014000000b70300001b0000008500000083000000bf0900000000000055090100000000009500000000000000bf080000000000007b9af8ff00000000b5090500000000007baaf0ff00000000bda804000000000007080000f8ffffffbfa400000000000007000000f0ffffffb70200000800000018220000", @ANYRES32=r1, @ANYBLOB="0000000000000000b7050000080000004600000076000000bf9100000000000007080000000000008500000085000000b70000000000000095"], &(0x7f0000000980)='GPL\x00', 0xb, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) 436.887022ms ago: executing program 0 (id=4300): bpf$PROG_LOAD_XDP(0x5, &(0x7f00000003c0)={0x3, 0x4, &(0x7f0000000080)=ANY=[@ANYBLOB="18000000000000000000000000000003000134000000000095000000000000c4"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, 0xf}, 0x94) 383.295723ms ago: executing program 4 (id=4301): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r0, &(0x7f0000001240)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=ANY=[@ANYBLOB="5c000000020601030a0000000000000000000000100003006269746d61703a706f72740005000400000000000900020073797a300000000005000500000000000500010006000000140007", @ANYRES16=r0, @ANYRESOCT=0x0, @ANYRESHEX=r0], 0x5c}}, 0x0) r1 = socket$can_bcm(0x1d, 0x2, 0x2) r2 = getpid() ioctl$sock_FIOSETOWN(r1, 0x8901, &(0x7f00000000c0)=r2) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x9c401, 0x0) ioctl$TUNSETTXFILTER(r3, 0x400454d1, &(0x7f0000000040)=ANY=[@ANYBLOB="0000021abbbbbbbbbbbbaaaaaaaaaa2f"]) 339.105435ms ago: executing program 0 (id=4302): syz_80211_join_ibss(&(0x7f00000001c0)='wlan0\x00', &(0x7f0000000200)=@random="7da22dc7acc5843fce6f3f5817fc89831eed", 0x12, 0x2) r0 = socket$nl_generic(0x10, 0x3, 0x10) bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="1900000004000000040000000c"], 0x48) r1 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[], 0x48) socketpair$unix(0x1, 0x0, 0x0, 0x0) r2 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x6, 0xc, &(0x7f00000001c0)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r1, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bc82000000000000a6020000f8ffffffb703000008000000b703000000000000850000003300000095"], &(0x7f0000000180)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @xdp, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000280)={{r1}, &(0x7f0000000080), &(0x7f0000000240)=r2}, 0x20) r3 = socket(0x400000000010, 0x3, 0x0) r4 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000640)=@newtfilter={0x3c, 0x2c, 0xd3f, 0x30bd2d, 0x25dfdbfd, {0x0, 0x0, 0x0, r5, {0xb, 0x3}, {}, {0x8, 0xffe0}}, [@filter_kind_options=@f_basic={{0xa}, {0xc, 0x2, [@TCA_BASIC_CLASSID={0x8, 0x1, {0x0, 0xfff1}}]}}]}, 0x3c}, 0x1, 0x0, 0x0, 0x10}, 0x0) r6 = bpf$OBJ_GET_PROG(0x7, &(0x7f00000003c0)=@o_path={&(0x7f0000000380)='./file0\x00', 0x0, 0x10, r2}, 0x18) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000000)={r6, 0x18000000000002a0, 0xe, 0x0, &(0x7f0000000580)="b9ff03076804268c989e14f088a8", 0x0, 0x500, 0x60000000, 0x0, 0x0, 0x0, 0x0, 0x2c25543289d358cd}, 0x50) r7 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000000), 0xffffffffffffffff) sendmsg$IPVS_CMD_SET_CONFIG(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000080)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r7, @ANYRESOCT=0x0, @ANYRESOCT=r7, @ANYRESDEC=r7, @ANYRES32=r0], 0x1c}}, 0x0) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) syz_emit_ethernet(0x3e, &(0x7f00000005c0)={@local, @random="2c09000000f8", @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x3, 0x7, 0x30, 0x67, 0x0, 0x9, 0x1, 0x0, @dev={0xac, 0x14, 0x14, 0x21}, @remote}, @redirect={0x5, 0x1, 0x0, @private=0xa010101, {0x5, 0x4, 0x3, 0x2a, 0xc7e, 0x64, 0xdd, 0x2, 0x21, 0x5, @initdev={0xac, 0x1e, 0x1, 0x0}, @initdev={0xac, 0x1e, 0x1, 0x0}}}}}}}, 0x0) r8 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r9 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFQNL_MSG_CONFIG(r9, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000180)={0x1c, 0x2, 0x3, 0x3, 0x0, 0x0, {}, [@NFQA_CFG_CMD={0x8, 0x1, {0x1}}]}, 0x1c}}, 0x0) sendmsg$NFQNL_MSG_VERDICT(r9, &(0x7f0000000bc0)={0x0, 0x0, &(0x7f0000000b80)={&(0x7f0000000580)={0x20, 0x1, 0x3, 0x801, 0x0, 0x0, {0x2}, [@NFQA_VERDICT_HDR={0xc, 0x2, {0xfffffffffffffffd}}]}, 0x20}}, 0x44) r10 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000400), r8) sendmsg$IEEE802154_LLSEC_ADD_SECLEVEL(r8, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000001680)=ANY=[@ANYBLOB="769692ac", @ANYRES16=r10, @ANYBLOB="0b062dbd700000000000300000000a0001007770616e31000000"], 0x20}, 0x1, 0x0, 0x0, 0x4004840}, 0x0) 317.657747ms ago: executing program 4 (id=4303): r0 = socket$inet_tcp(0x2, 0x1, 0x0) getsockopt$EBT_SO_GET_INFO(r0, 0x0, 0x80, &(0x7f0000000140)={'filter\x00', 0x0, 0x0, 0x0, [0x8, 0x8000000000000000, 0xa, 0x1, 0x8001, 0xfffffffffffffffe]}, &(0x7f00000001c0)=0x78) socket$inet_icmp_raw(0x2, 0x3, 0x1) (async) r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='memory.events\x00', 0x275a, 0x0) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x0, 0x12, r2, 0x0) setsockopt$inet_mreq(r1, 0x0, 0x23, &(0x7f00000000c0)={@multicast1=0xe0000300, @dev={0xac, 0x14, 0x14, 0x17}}, 0x8) (async) setsockopt$inet_mreq(r1, 0x0, 0x23, &(0x7f00000000c0)={@multicast1=0xe0000300, @dev={0xac, 0x14, 0x14, 0x17}}, 0x8) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000080)={0x1e, 0x4, &(0x7f0000000040)=ANY=[@ANYBLOB="18000000000000000000000000000000711214000000000095"], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x24}, 0x94) 215.825735ms ago: executing program 4 (id=4304): r0 = socket$inet6_udp(0xa, 0x2, 0x0) sendmmsg$inet(r0, &(0x7f00000003c0)=[{{&(0x7f0000000000)={0x2, 0x4e20, @local}, 0x10, &(0x7f0000000340)=[{&(0x7f0000000040)="820430b12d225304975ca4d24a8e54656687923abb9b51b1cb11ebefd5c639d55d8fee2a0ea8d4826c612beee75ef3de324a339ad7907825fb348e0e83600a", 0x3f}, {&(0x7f0000000080)="816529eea46aae3b1dc95efe9fee22ebdecfb613a9885b9b7050f5c7a2e6c7c85fcca5121a686fd06f010da8ab20bab7c1c2ad7f587dcb66c6f24b84477adb949508654cf1bc7e7168adaecb1353f29c1b244265959184414dde4e39fc21fd9a811d6b9eb13a5dbe7d09d380b821553bec5b0242cc9520ac1815ce4d6a4ac466e1aeedec7d979cefed6427c2e493871dc17724b8a5f0ae023093b7f2f1a9e7aaf53193e84c707d561502b2919cab355e55", 0xb1}, {&(0x7f0000000140)="402a05bd5691fb087ca9ee3078ec3af71302ec34515ef12b33bad7573993eec1b98ebfb255350f5918ea94fe599353db0be0f75729a76d0886e62ec32c0b450f629ced79905a1edce1861eabf06fc1d856f03197713096f534f781029c9f32ccf2661aae65343ee4a8448ad962ba7d8f7bca15c5228deed933b7bd5e2dfc4d00dea9344e89afa4e26c0ccf041912c46d4fcb95e4be83e4f6372d34e469b3e42e3c2cfa999747b18b6a1ef2f4806b334f05828cb1a862686ddbcbd20619f3897c7225752259bac048f70004682bed840f9b73768355666d6bd79c24cf4488b8430a1c73", 0xe3}, {&(0x7f0000000240)="da9e4c32a15098b3f552d2fbac33654f518eea0755002ac0fec4ef2fbd85c02f209710cf21f034b62b94d6ecd165af9feffe8cb64e4f3e7fc081ed7c5e3809d88e499990eb14612502dcd023a4990107b853446b41a3dfcf50fd19758e32e3e32be66f3e7d8562e862fe1de1d5a301fac7f5c0d283ff3c30bdb9165cda8526da32f135b7fcb2b3cac286d189c2bf80b0c2934a0ecc1d141e56ce4046db00b4f85328ae9046ab883ca521824b0b603c710d98c19e56039ef1a33d934a0023f342e3eebfbbdfb64a93a28999ea681863f64651798d0ad0c3367fdcd8611efc029e2a0b54a29332d2", 0xe7}], 0x4, &(0x7f0000000380)=[@ip_ttl={{0x14, 0x0, 0x2, 0x4}}], 0x18}}], 0x1, 0x4008800) r1 = bpf$BPF_BTF_GET_FD_BY_ID(0x13, &(0x7f0000000400), 0x4) sendfile(r1, r0, &(0x7f0000000440)=0x8, 0x0) ioctl$sock_ipv6_tunnel_SIOCADDTUNNEL(r0, 0x89f1, &(0x7f0000000500)={'ip6tnl0\x00', &(0x7f0000000480)={'syztnl2\x00', 0x0, 0x4, 0x9, 0x6, 0x800, 0x4e, @empty, @dev={0xfe, 0x80, '\x00', 0xf}, 0x40, 0x8, 0xa0, 0x8}}) r3 = accept(r0, &(0x7f0000000540)=@nl=@unspec, &(0x7f00000005c0)=0x80) r4 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000640), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000680)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_GET_MPP(r3, &(0x7f0000000740)={&(0x7f0000000600)={0x10, 0x0, 0x0, 0x4000}, 0xc, &(0x7f0000000700)={&(0x7f00000006c0)={0x34, r4, 0x800, 0x70bd2a, 0x25dfdbff, {{}, {@val={0x8, 0x3, r5}, @void}}, [@NL80211_ATTR_MPATH_NEXT_HOP={0xa, 0x1a, @device_b}, @NL80211_ATTR_MAC={0xa, 0x6, @broadcast}]}, 0x34}, 0x1, 0x0, 0x0, 0x20000084}, 0x40) sendmsg$NL80211_CMD_SET_MCAST_RATE(r1, &(0x7f0000000840)={&(0x7f0000000780)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f0000000800)={&(0x7f00000007c0)={0x24, r4, 0x200, 0x70bd2c, 0x25dfdbfb, {{}, {@void, @void}}, [@NL80211_ATTR_MCAST_RATE={0x8, 0x6b, 0x2ec}, @NL80211_ATTR_MCAST_RATE={0x8, 0x6b, 0x5a}]}, 0x24}, 0x1, 0x0, 0x0, 0x4}, 0x4080) r6 = syz_genetlink_get_family_id$nl80211(&(0x7f00000008c0), r3) sendmsg$NL80211_CMD_DEL_PMK(r3, &(0x7f0000000980)={&(0x7f0000000880)={0x10, 0x0, 0x0, 0x4000000}, 0xc, &(0x7f0000000940)={&(0x7f0000000900)={0x2c, r6, 0x200, 0x70bd2c, 0x25dfdbfd, {{}, {@void, @void}}, [@NL80211_ATTR_MAC={0xa, 0x6, @device_b}, @NL80211_ATTR_MAC={0xa, 0x6, @broadcast}]}, 0x2c}, 0x1, 0x0, 0x0, 0x20000000}, 0x0) setsockopt$netlink_NETLINK_ADD_MEMBERSHIP(r3, 0x10e, 0x1, &(0x7f00000009c0)=0x4, 0x4) syz_genetlink_get_family_id$devlink(&(0x7f0000000a00), r3) sendmsg$ETHTOOL_MSG_LINKINFO_SET(r3, &(0x7f0000000b00)={&(0x7f0000000a40)={0x10, 0x0, 0x0, 0x40000000}, 0xc, &(0x7f0000000ac0)={&(0x7f0000000a80)={0x1c, 0x0, 0x400, 0x70bd27, 0x25dfdbff, {}, [@ETHTOOL_A_LINKINFO_PORT={0x5, 0x2, 0xd}]}, 0x1c}, 0x1, 0x0, 0x0, 0x1}, 0x40005) r7 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000b40)={0x2, 0x4, 0x8, 0x1, 0x80, 0xffffffffffffffff, 0xcab, '\x00', r2, r1, 0x4, 0x1, 0x2}, 0x50) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000c40)={{0x1, 0xffffffffffffffff}, &(0x7f0000000bc0), &(0x7f0000000c00)}, 0x20) ioctl$sock_ipv6_tunnel_SIOCADDTUNNEL(r0, 0x89f1, &(0x7f0000000f00)={'ip6_vti0\x00', &(0x7f0000000e80)={'syztnl0\x00', r2, 0x2f, 0x75, 0x9, 0xfd2, 0x15, @rand_addr=' \x01\x00', @mcast2, 0x7800, 0x700, 0x40}}) r10 = bpf$PROG_LOAD(0x5, &(0x7f0000001280)={0x1d, 0x26, &(0x7f0000000fc0)=@ringbuf={{0x18, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x7f}, {{0x18, 0x1, 0x1, 0x0, 0x1}}, {}, [@map_idx={0x18, 0x6, 0x5, 0x0, 0x4}, @map_fd={0x18, 0x3, 0x1, 0x0, 0x1}, @snprintf={{}, {}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0xa}, {}, {}, {}, {}, {}, {}, {0x18, 0x3, 0x2, 0x0, 0x1}}, @map_idx_val={0x18, 0x4, 0x6, 0x0, 0xf, 0x0, 0x0, 0x0, 0x6}, @map_fd={0x18, 0x2, 0x1, 0x0, 0x1}, @initr0={0x18, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x400}], {{}, {0x7, 0x0, 0xb, 0x2, 0x0, 0x0, 0x1}}}, &(0x7f0000001100)='syzkaller\x00', 0x6, 0x23, &(0x7f0000001140)=""/35, 0x40f00, 0x0, '\x00', r2, @lsm=0x30, r1, 0x8, &(0x7f0000001180)={0x0, 0x2}, 0x8, 0x10, &(0x7f00000011c0)={0x1, 0x6, 0x8, 0x4}, 0x10, 0x0, 0xffffffffffffffff, 0x4, &(0x7f0000001200)=[0xffffffffffffffff], &(0x7f0000001240)=[{0x4, 0x4, 0xe, 0xb}, {0x3, 0x3, 0x1, 0xb}, {0x5, 0x1, 0xa, 0xc}, {0x0, 0x5, 0x8}], 0x10, 0x4}, 0x94) bpf$MAP_UPDATE_CONST_STR(0x2, &(0x7f00000013c0)={{0xffffffffffffffff, 0xffffffffffffffff}, &(0x7f0000001340), &(0x7f0000001380)='%pi6 \x00'}, 0x20) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000001480)={{0x1, 0xffffffffffffffff}, &(0x7f0000001400), &(0x7f0000001440)}, 0x20) r13 = bpf$BPF_MAP_GET_FD_BY_ID(0xe, &(0x7f00000014c0)={0x0, 0x4, 0x8}, 0xc) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000001580)=@bpf_ext={0x1c, 0x16, &(0x7f0000000c80)=@ringbuf={{0x18, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, {}, {}, [@ldst={0x0, 0x3, 0x6, 0x1, 0x3, 0x1, 0xffffffffffffffff}, @generic={0x1, 0x3, 0xa, 0x101, 0xf63}, @call={0x85, 0x0, 0x0, 0x3b}, @map_val={0x18, 0x1, 0x2, 0x0, r7, 0x0, 0x0, 0x0, 0xffff}, @map_fd={0x18, 0x2, 0x1, 0x0, r8}], {{}, {0x7, 0x0, 0xb, 0x2, 0x0, 0x0, 0x1}, {0x85, 0x0, 0x0, 0x84}}}, &(0x7f0000000d40)='syzkaller\x00', 0x1, 0xe9, &(0x7f0000000d80)=""/233, 0x41100, 0x9, '\x00', r9, 0x0, r1, 0x8, &(0x7f0000000f40)={0x0, 0x5}, 0x8, 0x10, &(0x7f0000000f80)={0x3, 0x3, 0x5, 0xb}, 0x10, 0x2ef65, r10, 0x0, &(0x7f0000001500)=[r11, r12, r13, 0x1], &(0x7f0000001540), 0x10, 0x2d05}, 0x94) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000001640)={'pim6reg1\x00'}) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r0, 0x8933, &(0x7f0000001880)={'batadv_slave_1\x00', 0x0}) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000001980)={0x11, 0x13, &(0x7f0000001680)=@ringbuf={{0x18, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x8}, {{0x18, 0x1, 0x1, 0x0, r13}}, {}, [@initr0={0x18, 0x0, 0x0, 0x0, 0x9}, @exit, @jmp={0x5, 0x0, 0x3, 0x3, 0x0, 0x1b, 0x4}], {{}, {0x7, 0x0, 0xb, 0x2, 0x0, 0x0, 0x2}, {0x85, 0x0, 0x0, 0x84}}}, &(0x7f0000001740)='GPL\x00', 0x2, 0xcc, &(0x7f0000001780)=""/204, 0x40f00, 0x20, '\x00', r14, 0x0, 0xffffffffffffffff, 0x8, &(0x7f00000018c0)={0x4, 0x3}, 0x8, 0x10, 0x0, 0x0, 0x0, 0x0, 0x2, &(0x7f0000001900)=[r12], &(0x7f0000001940)=[{0x2, 0x4, 0x5, 0x2}, {0x0, 0x3, 0xf, 0x8}], 0x10, 0x8}, 0x94) bpf$BPF_MAP_LOOKUP_AND_DELETE_ELEM(0x15, &(0x7f0000002ac0)={r7, &(0x7f0000001a40)="88d4a6ed051fb13c0c1a15e2104b2c3c9d5de0501dbfcee592ec214058652c601061a2b76ccb82375fce7f0fae8112ab6cee75002753b16c77b557e15173de50104a29f75118b1bda0c133236183dd", &(0x7f0000001ac0)=""/4096, 0x4}, 0x20) sendmsg$NL80211_CMD_NEW_KEY(r3, &(0x7f0000002c00)={&(0x7f0000002b00)={0x10, 0x0, 0x0, 0x200000}, 0xc, &(0x7f0000002bc0)={&(0x7f0000002b40)={0x80, r4, 0x4, 0x70bd27, 0x25dfdbfc, {{}, {@val={0x8, 0x3, r5}, @void}}, [@NL80211_ATTR_KEY_DEFAULT_MGMT={0x4}, @NL80211_ATTR_KEY_DEFAULT_MGMT={0x4}, @NL80211_ATTR_KEY_IDX={0x5, 0x8, 0x5}, @NL80211_ATTR_KEY_DATA_WEP40={0x9, 0x7, "43393dec65"}, @NL80211_ATTR_KEY_DEFAULT_MGMT={0x4}, @NL80211_ATTR_KEY_DEFAULT_TYPES={0x1c, 0x6e, 0x0, 0x1, [@NL80211_KEY_DEFAULT_TYPE_MULTICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_MULTICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_MULTICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_MULTICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}]}, @NL80211_ATTR_KEY_DEFAULT_TYPES={0x20, 0x6e, 0x0, 0x1, [@NL80211_KEY_DEFAULT_TYPE_MULTICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_MULTICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_MULTICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}]}, @NL80211_ATTR_KEY_TYPE={0x8}]}, 0x80}}, 0x95) r15 = bpf$BPF_MAP_GET_FD_BY_ID(0xe, &(0x7f0000002c40)={0xffffffffffffffff, 0x4, 0x10}, 0xc) bpf$BPF_MAP_CONST_STR_FREEZE(0x16, &(0x7f0000002c80)={r15}, 0x4) 169.733983ms ago: executing program 3 (id=4305): r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000840)='memory.events.local\x00', 0x275a, 0x0) r1 = socket$packet(0x11, 0x2, 0x300) r2 = bpf$MAP_CREATE(0x0, &(0x7f00000004c0)=ANY=[@ANYBLOB="1b00000000000000000000000080"], 0x50) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1801000011000000000000000000000018120000", @ANYRES32=r2, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa20000000000000702"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000023c0)={0x0, 0x4, &(0x7f0000000480)=@framed={{0x18, 0x2, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x8000}, [@call={0x85, 0x0, 0x0, 0x75}]}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x94) r3 = bpf$PROG_LOAD(0x5, &(0x7f0000000880)={0x1, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x10, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) setsockopt$sock_attach_bpf(r1, 0x1, 0x32, &(0x7f0000000180)=r3, 0x4) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r4, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000480)=ANY=[@ANYBLOB="140000001000050000000000000000000000000a20000000000a05000000000000000000010000000900010073797a300000000040000000030a01020000000000000000010000000900010073797a30000000000900030073797a3000000000140004800800024000000000080001400000000571000000060a010400000008000000000100000008000b4000000000400004803c0001800a0001006d617463680000002c0002800800010065636e000c000300e4edf2b75cc7c0a308000240000000000c000100706b7474797065000900010073797a30"], 0xf0}}, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x0, 0x11, r0, 0x0) bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=@base={0x1b, 0x0, 0x0, 0x8000, 0x4, r0}, 0x50) 147.206046ms ago: executing program 1 (id=4306): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x13, &(0x7f0000000040)=0x100000001, 0x76dc) connect$inet6(r0, &(0x7f0000000100)={0xa, 0x0, 0x7, @ipv4={'\x00', '\xff\xff', @local}, 0x1}, 0x1c) setsockopt$inet6_tcp_TCP_ULP(r0, 0x6, 0x1f, &(0x7f00000002c0), 0x4) setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r0, 0x6, 0x14, &(0x7f0000000400)=0x1, 0x4) r1 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r1, &(0x7f00000014c0)={0x0, 0x0, &(0x7f0000001480)={&(0x7f0000001400)={0x2, 0x9, 0x0, 0x2, 0x2}, 0x10}}, 0x0) setsockopt$inet6_tcp_TLS_TX(r0, 0x11a, 0x2, &(0x7f0000000000)=@gcm_128={{0x304}, "2d9421fe8a4c9563", "cf6ff9ff337ed301000100c747fbbfc1", "db0127ff", "16dea6d67a8426bd"}, 0x28) setsockopt$sock_int(r0, 0x1, 0xa, &(0x7f0000000140)=0x10001, 0x4) setsockopt$inet6_tcp_TLS_TX(r0, 0x11a, 0x1, &(0x7f0000000340)=@gcm_128={{0x304}, "b7a41f2305009201", "d21b0e8a0e000000000000000600", '\x00', "ec9300"}, 0x28) recvfrom(r0, &(0x7f0000002800)=""/4071, 0xfffffffffffffdab, 0x17, 0x0, 0x0) syz_genetlink_get_family_id$ethtool(&(0x7f0000000200), r0) recvmmsg(r0, &(0x7f00000019c0)=[{{0x0, 0x0, 0x0}, 0x7fffffff}, {{0x0, 0x0, &(0x7f0000001b40)=[{&(0x7f0000000180)=""/15, 0xf}], 0x1}, 0x9}], 0x2, 0x10100, 0x0) setsockopt$sock_int(r0, 0x1, 0x12, &(0x7f00000000c0)=0x8, 0x4) socket$inet6_tcp(0xa, 0x1, 0x0) (async) setsockopt$inet6_tcp_int(r0, 0x6, 0x13, &(0x7f0000000040)=0x100000001, 0x76dc) (async) connect$inet6(r0, &(0x7f0000000100)={0xa, 0x0, 0x7, @ipv4={'\x00', '\xff\xff', @local}, 0x1}, 0x1c) (async) setsockopt$inet6_tcp_TCP_ULP(r0, 0x6, 0x1f, &(0x7f00000002c0), 0x4) (async) setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r0, 0x6, 0x14, &(0x7f0000000400)=0x1, 0x4) (async) socket$key(0xf, 0x3, 0x2) (async) sendmsg$key(r1, &(0x7f00000014c0)={0x0, 0x0, &(0x7f0000001480)={&(0x7f0000001400)={0x2, 0x9, 0x0, 0x2, 0x2}, 0x10}}, 0x0) (async) setsockopt$inet6_tcp_TLS_TX(r0, 0x11a, 0x2, &(0x7f0000000000)=@gcm_128={{0x304}, "2d9421fe8a4c9563", "cf6ff9ff337ed301000100c747fbbfc1", "db0127ff", "16dea6d67a8426bd"}, 0x28) (async) setsockopt$sock_int(r0, 0x1, 0xa, &(0x7f0000000140)=0x10001, 0x4) (async) setsockopt$inet6_tcp_TLS_TX(r0, 0x11a, 0x1, &(0x7f0000000340)=@gcm_128={{0x304}, "b7a41f2305009201", "d21b0e8a0e000000000000000600", '\x00', "ec9300"}, 0x28) (async) recvfrom(r0, &(0x7f0000002800)=""/4071, 0xfffffffffffffdab, 0x17, 0x0, 0x0) (async) syz_genetlink_get_family_id$ethtool(&(0x7f0000000200), r0) (async) recvmmsg(r0, &(0x7f00000019c0)=[{{0x0, 0x0, 0x0}, 0x7fffffff}, {{0x0, 0x0, &(0x7f0000001b40)=[{&(0x7f0000000180)=""/15, 0xf}], 0x1}, 0x9}], 0x2, 0x10100, 0x0) (async) setsockopt$sock_int(r0, 0x1, 0x12, &(0x7f00000000c0)=0x8, 0x4) (async) 72.946822ms ago: executing program 0 (id=4307): socket$alg(0x26, 0x5, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32, @ANYBLOB="0000000000000000b70800000d0000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) (async) r0 = bpf$ITER_CREATE(0x21, &(0x7f0000000000), 0x8) bpf$BPF_GET_BTF_INFO(0xf, &(0x7f0000002a80)={0xffffffffffffffff, 0x20, &(0x7f0000002a40)={&(0x7f0000000780)=""/150, 0x96, 0x0, &(0x7f0000000600)=""/202, 0xca}}, 0x10) (async, rerun: 64) socket(0x10, 0x3, 0x0) (async, rerun: 64) openat$tun(0xffffffffffffff9c, &(0x7f0000000280), 0x1, 0x0) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) (async) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x1c1842, 0x0) r4 = bpf$PROG_LOAD(0x5, &(0x7f0000000340)={0x1, 0xb, &(0x7f0000000540)=ANY=[@ANYBLOB="180000000000000000000000feffffff18010000696c6c00000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b70300000800000085000000060000009500000000000000"], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x1, '\x00', 0x0, @fallback=0x24, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) ioctl$TUNSETIFF(r3, 0x400454ca, &(0x7f00000002c0)={'syzkaller0\x00', 0x7101}) (async) ioctl$TUNSETSTEERINGEBPF(r3, 0x800454e0, &(0x7f00000001c0)=r4) write$cgroup_devices(r3, &(0x7f0000000280)=ANY=[@ANYRESDEC], 0xffdd) (async) r5 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) close(r5) (async) r6 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r6, 0x8933, &(0x7f0000000100)={'syzkaller0\x00'}) (async) ioctl$SIOCSIFHWADDR(r5, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) (async) r7 = socket$packet(0x11, 0x3, 0x300) ioctl$sock_SIOCGIFINDEX(r7, 0x8933, &(0x7f0000000040)={'syzkaller0\x00', 0x0}) sendto$packet(r7, &(0x7f00000005c0)="05031c00d3fc140000004788ed1c", 0xe, 0x24000091, &(0x7f0000000140)={0x11, 0xf5, r8, 0x1, 0xfe, 0x6, @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x3}}, 0x14) (async) r9 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='memory.events\x00', 0x275a, 0x0) write$cgroup_subtree(r9, &(0x7f0000000000)=ANY=[], 0x10448) (async) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x2000001, 0x12, r9, 0x0) (async) bpf$PROG_LOAD(0x5, &(0x7f0000002b00)={0x6, 0x9, &(0x7f0000000280)=@raw=[@ringbuf_output={{0x18, 0x1, 0x1, 0x0, r0}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0x2}, {}, {}, {}, {}, {0x7, 0x0, 0xb, 0x4, 0x0, 0x0, 0x2}}], &(0x7f00000003c0)='GPL\x00', 0x81, 0x1000, &(0x7f0000001840)=""/4096, 0x41100, 0x38, '\x00', 0x0, @xdp=0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, &(0x7f0000002840)={0x1, 0xe, 0x10000, 0x4a1}, 0x10, r1, r9, 0x4, 0x0, &(0x7f0000002ac0)=[{0x2, 0x3, 0x3, 0xa}, {0x1, 0x3, 0xd, 0x1}, {0x4, 0x1, 0x4, 0xa}, {0x0, 0x5, 0xb, 0x9}], 0x10, 0x8}, 0x94) r10 = bpf$MAP_CREATE(0x0, &(0x7f0000000740)=ANY=[@ANYBLOB="0b00000005000000000400000900000001"], 0x48) (async) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0xa, 0x4, &(0x7f0000000480)=ANY=[@ANYBLOB="18000000000000000000000000000000850000006d"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r11 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000d80)={0x18, 0x5, &(0x7f0000000480)=ANY=[@ANYBLOB="1801000021"], 0x0, 0x40, 0x0, 0x0, 0x0, 0xb4a02fe0ce239f93, '\x00', 0x0, 0x2}, 0x94) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0xe, 0x0, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000800000000000000000000018110000", @ANYRES32=r10], 0x0, 0x0, 0x0, 0x0, 0x41100, 0x59, '\x00', 0x0, @fallback=0x2a, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, r11, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$PROG_LOAD(0x5, &(0x7f0000000300)={0x6, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback=0x4, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) 64.969692ms ago: executing program 4 (id=4308): write(0xffffffffffffffff, 0x0, 0x0) r0 = openat$tun(0xffffffffffffff9c, &(0x7f00000002c0), 0x321680, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r1 = socket(0x400000000010, 0x3, 0x0) r2 = socket$unix(0x1, 0x5, 0x0) r3 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) r5 = socket$netlink(0x10, 0x3, 0x0) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r7, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) write$6lowpan_enable(r5, &(0x7f00000000c0)='0', 0x1) sendmsg$nl_route_sched(r6, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000280)=@newqdisc={0x2c, 0x24, 0x4ee4e6a52ff56541, 0x70bd26, 0xffffffff, {0x0, 0x0, 0x0, r8, {0x0, 0x6}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_qfg={0x8}]}, 0x2c}}, 0x24040084) r9 = socket$netlink(0x10, 0x3, 0x0) r10 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r10, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r9, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000180)=@newqdisc={0x58, 0x28, 0x4ee4e6a52ff56541, 0x70bd2d, 0x25dfdbfb, {0x0, 0x0, 0x0, r11, {0xfff3}, {0xffff, 0xffff}, {0xffef, 0x1}}, [@qdisc_kind_options=@q_sfb={{0x8}, {0x2c, 0x2, @TCA_SFB_PARMS={0x28, 0x1, {0x82, 0x3, 0x4, 0xffff, 0x7f, 0x7fffffff, 0x1, 0x40, 0x2}}}}]}, 0x58}, 0x1, 0x0, 0x0, 0xdc}, 0x0) sendmsg$nl_route_sched(r5, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000140)=@newqdisc={0x34, 0x28, 0x4ee4e6a52ff56541, 0x4001, 0xfffffdfc, {0x0, 0x0, 0x0, r4, {}, {0xffff, 0xffff}, {0x2, 0x1}}, [@qdisc_kind_options=@q_taprio={{0xb}, {0x4}}]}, 0x34}, 0x1, 0x0, 0x0, 0x400dc}, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r1, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0x25dfdbfd, {0x0, 0x0, 0x0, r12, {0x0, 0xfff1}, {0xffff, 0xffff}, {0x0, 0xf}}, [@qdisc_kind_options=@q_multiq={{0xb}, {0x8, 0x2, {0x42}}}]}, 0x38}}, 0x0) 0s ago: executing program 3 (id=4309): bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000000), 0x31) (async) r0 = socket$packet(0x11, 0x2, 0x300) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000180)={'bridge0\x00'}) (async) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000004c0)={0x1f, 0x18, &(0x7f0000000280)=ANY=[@ANYRES16=r0, @ANYBLOB="8897c4fffc492b3691b94e93f9abee2f7a0f2a959b2511eab661b44026f931332501a34b86db9cf01e2a1f469b330e30d4c8251fbdcea64c4df39c4adc481597e39fe1e799c5bc38dc341d3fb6bae98aa1dcec53b5a1906688d595744500fc4fcc253e7dc98a07a94392dac54f2bdd30dcbbce1656ef00547501222070553d2214cabd5b065adb1a10f73881be39e290940e12b02aeb3e23254542c0760d00e2cefc9862910f27ae309f63ec5936c71ac6e4fedce04b22ae2aa224ff0a482e879dab6879ba771863f5eb4b9f19563e54bdb686a987a1ce6cab9b8a887ee4210c0a7bd22205b6feffff", @ANYBLOB="0000000000000000b7050000080000a8c5000000a50000001801000020216405000000000004000f7b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b70400000000000085000000a700000095"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x18, '\x00', 0x0, @fallback=0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000640)={r1, 0x0, 0x0, 0xfffffffffffffdf3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) (async, rerun: 64) r2 = socket$nl_route(0x10, 0x3, 0x0) (async, rerun: 64) r3 = socket$netlink(0x10, 0x3, 0x0) (async) r4 = socket(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r4, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={0x0, 0x14}}, 0x0) getsockname$packet(r4, &(0x7f00000002c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000100)=0x14) sendmsg$nl_route(r3, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000008c0)=ANY=[@ANYBLOB="480000001000050700000086d7c0d6c878f064eb", @ANYRES32=r5, @ANYBLOB="0000000000000000280012000c00010076657468"], 0x48}}, 0x0) (async) sendmsg$nl_route_sched(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f00000004c0)={&(0x7f0000000900)=@newqdisc={0x30, 0x24, 0xf1d, 0x0, 0x0, {0x0, 0x0, 0x0, r5, {}, {0xfff1, 0xffff}}, [@qdisc_kind_options=@q_clsact={0xb}]}, 0x30}, 0x1, 0xfffc}, 0x4000800) (async) sendmsg$nl_route_sched(r2, &(0x7f00000016c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000003080)=@delchain={0x24, 0x66, 0xf31, 0xfffffffd, 0x0, {0x0, 0x0, 0x0, r5, {0x0, 0x1}, {0xfff1, 0xffff}, {0x0, 0x1b}}}, 0x24}, 0x1, 0x0, 0x0, 0x10}, 0x0) (async, rerun: 64) r6 = socket$nl_netfilter(0x10, 0x3, 0xc) (rerun: 64) sendmsg$NFT_BATCH(r6, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000440)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x10}, 0x0) (async) r7 = openat$tun(0xffffffffffffff9c, &(0x7f0000000140), 0x10002, 0x0) ioctl$TUNSETIFF(r7, 0x400454ca, &(0x7f0000000080)={'pimreg0\x00', 0x7c2}) r8 = openat$tun(0xffffffffffffff9c, &(0x7f0000000140), 0x0, 0x0) ioctl$TUNSETIFF(r8, 0x400454ca, &(0x7f0000000080)={'pimreg0\x00', 0x7c2}) (async) ioctl$TUNATTACHFILTER(r8, 0x401054d5, &(0x7f0000000000)={0x3, &(0x7f00000001c0)=[{0x0, 0x0, 0x0, 0x37cb7880}, {0x0, 0xfe, 0x10}, {0x6, 0x0, 0x0, 0x8007}]}) sendmsg$NFT_BATCH(r6, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000680)=ANY=[@ANYBLOB="14000000100001000000000000b890c1a000000a80000000160a01030000000000000000020000000900020073797a30000000000900010073797a30000000005400038008000240000000000800014000000000400003801400010076657468315f746f5f6272696467650014000100776732000000000000000000000000001400010076657468305f746f5f7465616d00000014000000110001"], 0xa8}}, 0x0) (async) r9 = socket$inet6_sctp(0xa, 0x1, 0x84) getsockopt$inet_sctp6_SCTP_RECONFIG_SUPPORTED(r9, 0x84, 0xb, 0x0, &(0x7f0000000640)) recvfrom(r6, 0x0, 0x0, 0x10000, 0x0, 0x0) sendmsg$NFT_MSG_GETFLOWTABLE(r6, &(0x7f0000000240)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f00000004c0)=ANY=[@ANYBLOB="14000000170a0102"], 0x14}, 0x1, 0x0, 0x0, 0x1}, 0x90) r10 = socket$nl_generic(0x10, 0x3, 0x10) (async) r11 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000580), r7) sendmsg$NL80211_CMD_GET_REG(r10, &(0x7f0000000740)={&(0x7f0000000400)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f0000000600)={&(0x7f00000005c0)=ANY=[@ANYBLOB="07de0000", @ANYRES16=r11, @ANYBLOB="00082bbd7000ffdbdf251f000000070021006161000006002100610000000400cc00050092000300000008000100570000000400cc00"], 0x3c}, 0x1, 0x0, 0x0, 0x10}, 0x4054) r12 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r12, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000180)=@newtaction={0x4c, 0x30, 0x1, 0x70bd28, 0x0, {}, [{0x38, 0x1, [@m_ife={0x34, 0x1, 0x0, 0x0, {{0x8}, {0xc, 0x2, 0x0, 0x1, [@TCA_IFE_TYPE={0x6, 0x5, 0xefff}]}, {0x4}, {0xc}, {0xc, 0x8, {0x0, 0x1}}}}]}]}, 0x4c}, 0x1, 0x0, 0x0, 0x480c4}, 0x0) kernel console output (not intermixed with test programs): iled. [ 486.595769][ T4956] I/O error, dev nbd2, sector 0 op 0x0:(READ) flags 0x0 phys_seg 4 prio class 2 [ 486.610766][T16388] Dev nbd2: unable to read RDB block 0 [ 486.620676][T16579] netlink: 8 bytes leftover after parsing attributes in process `syz.0.3173'. [ 486.629084][T16388] nbd2: unable to read partition table [ 486.652764][T16388] ldm_validate_partition_table(): Disk read failed. [ 486.669478][T16388] Dev nbd2: unable to read RDB block 0 [ 486.679269][T16388] nbd2: unable to read partition table [ 486.862024][T16583] netlink: 12 bytes leftover after parsing attributes in process `syz.0.3173'. [ 486.912000][T16583] netlink: 28 bytes leftover after parsing attributes in process `syz.0.3173'. [ 486.967257][T16589] sock: sock_timestamping_bind_phc: sock not bind to device [ 487.027299][T16581] netlink: 8 bytes leftover after parsing attributes in process `syz.4.3174'. [ 487.457308][ T5639] Bluetooth: hci0: command tx timeout [ 487.779134][T16606] netlink: 'syz.0.3181': attribute type 12 has an invalid length. [ 487.781290][T16609] netlink: 8 bytes leftover after parsing attributes in process `syz.1.3182'. [ 487.797303][T16610] netlink: 56 bytes leftover after parsing attributes in process `syz.4.3183'. [ 487.815004][T16609] netlink: 'syz.1.3182': attribute type 6 has an invalid length. [ 487.824692][T16609] netlink: 4 bytes leftover after parsing attributes in process `syz.1.3182'. [ 487.992646][ T3331] netdevsim netdevsim1 netdevsim0: set [0, 0] type 1 family 0 port 8472 - 0 [ 488.032211][ T3331] netdevsim netdevsim1 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0 [ 488.061087][ T3331] netdevsim netdevsim1 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0 [ 488.082725][ T3331] netdevsim netdevsim1 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0 [ 488.327519][T16634] ksmbd: Unknown IPC event: 1, ignore. [ 488.844478][T16530] bridge0: port 1(bridge_slave_0) entered blocking state [ 488.852570][T16530] bridge0: port 1(bridge_slave_0) entered disabled state [ 488.860433][T16530] bridge_slave_0: entered allmulticast mode [ 488.869932][T16530] bridge_slave_0: entered promiscuous mode [ 488.880223][T16530] bridge0: port 2(bridge_slave_1) entered blocking state [ 488.888557][T16530] bridge0: port 2(bridge_slave_1) entered disabled state [ 488.896766][T16530] bridge_slave_1: entered allmulticast mode [ 488.905281][T16530] bridge_slave_1: entered promiscuous mode [ 488.960579][T16530] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 489.001672][T16530] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 489.139289][T16530] team0: Port device team_slave_0 added [ 489.161497][T16530] team0: Port device team_slave_1 added [ 489.329608][T16530] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 489.352242][T16530] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 489.443748][T16530] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 489.474487][T16530] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 489.489648][T16530] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 489.530707][T16530] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 489.549455][ T5639] Bluetooth: hci0: command tx timeout [ 489.641838][T16705] openvswitch: netlink: Missing key (keys=40, expected=100) [ 489.751771][T16530] hsr_slave_0: entered promiscuous mode [ 489.783879][T16713] x_tables: duplicate underflow at hook 2 [ 489.785044][T16530] hsr_slave_1: entered promiscuous mode [ 489.812108][T16530] debugfs: 'hsr0' already exists in 'hsr' [ 489.819181][T16530] Cannot create hsr debugfs directory [ 489.897965][T16722] sctp: [Deprecated]: syz.1.3213 (pid 16722) Use of int in max_burst socket option. [ 489.897965][T16722] Use struct sctp_assoc_value instead [ 490.060174][T16728] bond0: (slave syz_tun): speed changed to 0 on port 1 [ 490.109938][T16733] netlink: 'syz.4.3214': attribute type 1 has an invalid length. [ 490.119920][ T95] bond0: (slave syz_tun): link status up again after 0 ms [ 490.134611][T16733] netlink: 'syz.4.3214': attribute type 3 has an invalid length. [ 490.147398][T16733] __nla_validate_parse: 4 callbacks suppressed [ 490.147419][T16733] netlink: 172 bytes leftover after parsing attributes in process `syz.4.3214'. [ 490.164589][ T95] bond0: (slave syz_tun): link status up again after 0 ms [ 490.172451][T16733] NCSI netlink: No device for ifindex 813332851 [ 490.196018][ T95] bond0: (slave syz_tun): link status up again after 0 ms [ 490.242536][ T95] bond0: (slave syz_tun): link status up again after 0 ms [ 490.287756][ T140] bond0: (slave syz_tun): link status up again after 0 ms [ 490.326597][ T95] bond0: (slave syz_tun): link status up again after 0 ms [ 490.358746][ T95] bond0: (slave syz_tun): failed to get link speed/duplex [ 490.838087][T16530] netdevsim netdevsim3 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 20004 - 0 [ 491.046389][ T36] net_ratelimit: 2 callbacks suppressed [ 491.046413][ T36] bond0: (slave syz_tun): failed to get link speed/duplex [ 491.199656][T16530] netdevsim netdevsim3 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 20004 - 0 [ 491.346769][T16772] FAULT_INJECTION: forcing a failure. [ 491.346769][T16772] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 491.360555][T16791] netlink: 36 bytes leftover after parsing attributes in process `syz.0.3227'. [ 491.377417][T16790] netlink: 8 bytes leftover after parsing attributes in process `syz.4.3228'. [ 491.388088][T16530] netdevsim netdevsim3 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 20004 - 0 [ 491.391411][T16790] netlink: 12 bytes leftover after parsing attributes in process `syz.4.3228'. [ 491.403061][T16772] CPU: 0 UID: 0 PID: 16772 Comm: syz.2.3223 Not tainted syzkaller #0 PREEMPT(full) [ 491.403086][T16772] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 491.403097][T16772] Call Trace: [ 491.403105][T16772] [ 491.403112][T16772] dump_stack_lvl+0xe8/0x150 [ 491.403146][T16772] should_fail_ex+0x40c/0x560 [ 491.403178][T16772] _copy_from_user+0x2d/0xb0 [ 491.403202][T16772] ___sys_sendmsg+0x1c6/0x360 [ 491.403224][T16772] ? __lock_acquire+0x683/0x2cf0 [ 491.403252][T16772] ? __pfx____sys_sendmsg+0x10/0x10 [ 491.403309][T16772] ? __fget_files+0x2a/0x420 [ 491.403330][T16772] ? __fget_files+0x3a2/0x420 [ 491.403362][T16772] __x64_sys_sendmsg+0x1b1/0x290 [ 491.403387][T16772] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 491.403427][T16772] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 491.403448][T16772] do_syscall_64+0x174/0x580 [ 491.403467][T16772] ? trace_irq_disable+0x3b/0x140 [ 491.403489][T16772] ? clear_bhb_loop+0x40/0x90 [ 491.403511][T16772] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 491.403529][T16772] RIP: 0033:0x7f3415d9de59 [ 491.403547][T16772] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 491.403562][T16772] RSP: 002b:00007f3416ba9028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 491.403582][T16772] RAX: ffffffffffffffda RBX: 00007f3416025fa0 RCX: 00007f3415d9de59 [ 491.403595][T16772] RDX: 0000000004000880 RSI: 0000200000002900 RDI: 0000000000000009 [ 491.403607][T16772] RBP: 00007f3416ba9090 R08: 0000000000000000 R09: 0000000000000000 [ 491.403619][T16772] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 491.403630][T16772] R13: 00007f3416026038 R14: 00007f3416025fa0 R15: 00007ffd0cc56288 [ 491.403660][T16772] [ 491.517928][ T7453] IPVS: starting estimator thread 0... [ 491.533358][T16794] netlink: 224 bytes leftover after parsing attributes in process `syz.0.3229'. [ 491.618391][ T5639] Bluetooth: hci0: command tx timeout [ 491.628741][T16773] netlink: 'syz.1.3225': attribute type 1 has an invalid length. [ 491.664589][T16795] IPVS: using max 26 ests per chain, 62400 per kthread [ 491.742329][T16530] netdevsim netdevsim3 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 20004 - 0 [ 491.777208][ T140] bond0: (slave syz_tun): failed to get link speed/duplex [ 491.906426][ T140] bond0: (slave syz_tun): failed to get link speed/duplex [ 492.027216][ T95] bond0: (slave syz_tun): failed to get link speed/duplex [ 492.220795][T16819] mac80211_hwsim hwsim26 wlan0: entered promiscuous mode [ 492.357147][ T3331] bond0: (slave syz_tun): failed to get link speed/duplex [ 492.379456][T16827] macvtap1: entered promiscuous mode [ 492.385258][T16827] macvtap1: entered allmulticast mode [ 492.391550][T16827] veth1_vlan: entered allmulticast mode [ 492.481308][T16827] macvtap2: entered promiscuous mode [ 492.494789][T16827] macvtap2: entered allmulticast mode [ 493.209697][T16848] lo: entered allmulticast mode [ 493.234675][T16848] lo: left allmulticast mode [ 493.250966][T16530] netdevsim netdevsim3 netdevsim0: renamed from eth0 [ 493.296946][T16530] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 493.313050][T16530] netdevsim netdevsim3 netdevsim1: renamed from eth1 [ 493.342562][T16530] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 493.362403][T16853] netlink: 'syz.2.3242': attribute type 1 has an invalid length. [ 493.379123][T16530] netdevsim netdevsim3 netdevsim2: renamed from eth2 [ 493.408191][T16530] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 493.422373][T16530] netdevsim netdevsim3 netdevsim3: renamed from eth3 [ 493.454783][T16860] netlink: 20 bytes leftover after parsing attributes in process `syz.1.3247'. [ 493.457511][T16530] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 493.484775][T16860] netlink: 11 bytes leftover after parsing attributes in process `syz.1.3247'. [ 493.678444][T16887] netlink: 12 bytes leftover after parsing attributes in process `syz.0.3249'. [ 493.697353][ T5639] Bluetooth: hci0: command tx timeout [ 493.811960][ T14] bond0: (slave syz_tun): failed to get link speed/duplex [ 493.873052][T16530] 8021q: adding VLAN 0 to HW filter on device bond0 [ 493.958853][ T156] bond0: (slave syz_tun): failed to get link speed/duplex [ 494.002285][T16530] 8021q: adding VLAN 0 to HW filter on device team0 [ 494.062900][ T140] bridge0: port 1(bridge_slave_0) entered blocking state [ 494.070176][ T140] bridge0: port 1(bridge_slave_0) entered forwarding state [ 494.114944][ T95] bridge0: port 2(bridge_slave_1) entered blocking state [ 494.122256][ T95] bridge0: port 2(bridge_slave_1) entered forwarding state [ 494.298698][ T14] bond0: (slave syz_tun): failed to get link speed/duplex [ 494.415975][ T95] bond0: (slave syz_tun): failed to get link speed/duplex [ 494.765981][T16919] bridge0: port 4(syz_tun) entered disabled state [ 494.796508][T16919] bridge0: port 3(bond0) entered disabled state [ 494.803422][T16919] bridge0: port 2(bridge_slave_1) entered disabled state [ 494.811199][T16919] bridge0: port 1(bridge_slave_0) entered disabled state [ 494.856701][T16919] A link change request failed with some changes committed already. Interface bond0 may have been left with an inconsistent configuration, please check. [ 495.114106][T16530] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 495.145263][T16940] netlink: 12 bytes leftover after parsing attributes in process `syz.0.3259'. [ 495.181179][T16530] veth0_vlan: entered promiscuous mode [ 495.194396][T16530] veth1_vlan: entered promiscuous mode [ 495.230401][T16530] veth0_macvtap: entered promiscuous mode [ 495.240830][T16530] veth1_macvtap: entered promiscuous mode [ 495.261177][T16530] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 495.275527][T16530] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 495.292130][ T140] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 495.302457][ T140] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 495.326111][ T140] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 495.337590][ T140] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 496.116079][ T14] net_ratelimit: 10 callbacks suppressed [ 496.116103][ T14] bond0: (slave syz_tun): failed to get link speed/duplex [ 496.236025][ T14] bond0: (slave syz_tun): failed to get link speed/duplex [ 496.346925][ T3331] bond0: (slave syz_tun): failed to get link speed/duplex [ 496.456350][ T36] bond0: (slave syz_tun): failed to get link speed/duplex [ 496.566359][ T95] bond0: (slave syz_tun): failed to get link speed/duplex [ 496.617455][T16881] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 496.628358][T16909] netlink: 244 bytes leftover after parsing attributes in process `syz.1.3255'. [ 496.677083][ T3331] bond0: (slave syz_tun): failed to get link speed/duplex [ 496.857229][ T95] bond0: (slave syz_tun): failed to get link speed/duplex [ 496.881074][ T95] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 496.901095][ T95] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 496.941018][T16949] netlink: 'syz.2.3261': attribute type 1 has an invalid length. [ 497.080098][T16958] bond0: (slave syz_tun): failed to get link speed/duplex [ 497.162658][T16958] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 497.208010][T16958] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 497.229881][ T95] bond0: (slave syz_tun): failed to get link speed/duplex [ 497.282681][T16964] syzkaller0: entered promiscuous mode [ 497.320029][T16964] syzkaller0: entered allmulticast mode [ 497.384421][T16964] simple: basic_1 [ 497.389486][T16964] simple: basic_2 [ 497.393171][T16964] simple: basic_3 [ 497.396906][T16964] simple: basic_4 [ 497.400611][T16964] simple: basic_5 [ 497.404284][T16964] simple: basic_6 [ 497.408001][T16964] simple: basic_7 [ 497.411668][T16964] simple: basic_8 [ 497.415357][T16964] simple: basic_9 [ 497.419093][T16964] simple: basic_10 [ 497.422844][T16964] simple: basic_11 [ 497.426639][T16964] simple: basic_12 [ 497.430416][T16964] simple: basic_13 [ 497.434168][T16964] simple: basic_14 [ 497.437973][T16964] simple: basic_15 [ 497.441739][T16964] simple: basic_16 [ 497.445758][T16964] simple: basic_17 [ 497.450000][T16964] 0: reclassify loop, rule prio 0, protocol 800 [ 497.469116][T16974] netlink: 8 bytes leftover after parsing attributes in process `syz.1.3266'. [ 497.817252][T16990] netlink: 68 bytes leftover after parsing attributes in process `syz.2.3271'. [ 498.076174][T16998] netlink: 4 bytes leftover after parsing attributes in process `syz.2.3274'. [ 498.108761][T16998] netlink: 4 bytes leftover after parsing attributes in process `syz.2.3274'. [ 498.422120][ T5633] Bluetooth: hci4: unexpected cc 0x0c03 length: 249 > 1 [ 498.435529][ T5633] Bluetooth: hci4: unexpected cc 0x1003 length: 249 > 9 [ 498.445507][ T5633] Bluetooth: hci4: unexpected cc 0x1001 length: 249 > 9 [ 498.463767][ T5633] Bluetooth: hci4: unexpected cc 0x0c23 length: 249 > 4 [ 498.475271][ T5633] Bluetooth: hci4: unexpected cc 0x0c38 length: 249 > 2 [ 498.598731][T17017] netlink: 'syz.2.3277': attribute type 1 has an invalid length. [ 498.950783][T17035] xt_cgroup: invalid path, errno=-2 [ 499.091543][ T5644] bond0: (slave syz_tun): Removing an active aggregator [ 499.101006][ T5644] bond0: (slave syz_tun): Releasing backup interface [ 499.687882][ T140] netdevsim netdevsim4 netdevsim3 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 499.720770][ T140] netdevsim netdevsim4 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 499.830922][T17070] syzkaller0: entered promiscuous mode [ 499.847657][T17070] syzkaller0: entered allmulticast mode [ 499.968587][ T140] netdevsim netdevsim4 netdevsim2 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 499.980017][ T140] netdevsim netdevsim4 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 500.039171][T17079] netlink: 28 bytes leftover after parsing attributes in process `syz.3.3291'. [ 500.064307][T17079] netlink: 28 bytes leftover after parsing attributes in process `syz.3.3291'. [ 500.180455][ T140] netdevsim netdevsim4 netdevsim1 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 500.204510][ T140] netdevsim netdevsim4 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 500.268783][T17087] netlink: 'syz.2.3292': attribute type 1 has an invalid length. [ 500.529157][ T140] netdevsim netdevsim4 netdevsim0 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 500.567114][ T140] netdevsim netdevsim4 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 500.578147][ T5633] Bluetooth: hci4: command tx timeout [ 501.379073][ T140] bridge_slave_1: left allmulticast mode [ 501.408046][ T140] bridge_slave_1: left promiscuous mode [ 501.427565][ T140] bridge0: port 2(bridge_slave_1) entered disabled state [ 501.482090][ T140] bridge_slave_0: left allmulticast mode [ 501.507491][ T140] bridge_slave_0: left promiscuous mode [ 501.527692][ T140] bridge0: port 1(bridge_slave_0) entered disabled state [ 502.313950][ T140] pimreg: left allmulticast mode [ 502.369845][ T140] tipc: Resetting bearer [ 502.532353][ T140] bond3 (unregistering): (slave ip6gre1): Releasing backup interface [ 502.541178][ T140] ip6gre1 (unregistering): left promiscuous mode [ 502.600480][ T140] tipc: Disabling bearer [ 502.661189][ T5633] Bluetooth: hci4: command tx timeout [ 502.691934][ T140] bond4 (unregistering): (slave gretap2): Releasing active interface [ 502.884562][ T140] bond1 (unregistering): (slave bridge4): Releasing active interface [ 502.911645][ T140] .` (unregistering): (slave bond_slave_0): Releasing backup interface [ 502.921598][ T140] .` (unregistering): Released all slaves [ 502.932147][ T140] bond1 (unregistering): Released all slaves [ 502.953836][ T140] bond2 (unregistering): Released all slaves [ 502.972852][ T140] bond0 (unregistering): Released all slaves [ 502.988207][ T140] bond3 (unregistering): Released all slaves [ 503.003902][ T140] bond4 (unregistering): Released all slaves [ 503.018626][ T140] bond5 (unregistering): Released all slaves [ 503.034528][ T140] bond6 (unregistering): (slave veth5): Releasing active interface [ 503.044115][ T140] bond6 (unregistering): Released all slaves [ 503.084381][T17147] tipc: Started in network mode [ 503.089358][T17147] tipc: Node identity 960203708d9d, cluster identity 4711 [ 503.096936][T17147] tipc: Enabled bearer , priority 0 [ 503.153694][ T5290] 8021q: adding VLAN 0 to HW filter on device eth1 [ 503.274676][T17147] tipc: Disabling bearer [ 503.412597][ T140] tipc: Disabling bearer [ 503.418332][ T140] tipc: Left network mode [ 503.502707][T17169] netlink: 'syz.3.3310': attribute type 1 has an invalid length. [ 503.663001][T17176] netlink: 8 bytes leftover after parsing attributes in process `syz.1.3313'. [ 503.822501][T17191] netlink: 12 bytes leftover after parsing attributes in process `syz.1.3315'. [ 503.943663][T17197] netlink: 24 bytes leftover after parsing attributes in process `syz.2.3317'. [ 504.335229][T17211] netlink: 4 bytes leftover after parsing attributes in process `syz.3.3319'. [ 504.736001][ T5633] Bluetooth: hci4: command tx timeout [ 505.604365][T17232] syzkaller0: entered promiscuous mode [ 505.625255][T17232] syzkaller0: entered allmulticast mode [ 505.736589][ T5290] 8021q: adding VLAN 0 to HW filter on device eth2 [ 505.899651][T17277] netlink: 28 bytes leftover after parsing attributes in process `syz.3.3327'. [ 505.930366][T17271] netlink: 12 bytes leftover after parsing attributes in process `syz.3.3327'. [ 506.233913][T17290] TCP: TCP_TX_DELAY enabled [ 506.810228][T17327] net_ratelimit: 12 callbacks suppressed [ 506.810247][T17327] IPVS: wlc: FWM 3 0x00000003 - no destination available [ 506.828119][ T5633] Bluetooth: hci4: command tx timeout [ 506.900613][T17336] netlink: 'syz.1.3337': attribute type 1 has an invalid length. [ 506.968275][T17341] netlink: 'syz.0.3339': attribute type 9 has an invalid length. [ 507.005748][T17340] mac80211_hwsim hwsim33 wlan0: entered promiscuous mode [ 507.146105][T17015] bridge0: port 1(bridge_slave_0) entered blocking state [ 507.177869][T17015] bridge0: port 1(bridge_slave_0) entered disabled state [ 507.214921][T17015] bridge_slave_0: entered allmulticast mode [ 507.268315][T17015] bridge_slave_0: entered promiscuous mode [ 507.391539][T17361] netlink: 8 bytes leftover after parsing attributes in process `syz.3.3341'. [ 507.429144][T17361] netlink: 8 bytes leftover after parsing attributes in process `syz.3.3341'. [ 507.651528][T17358] bridge0: port 5(ipvlan2) entered blocking state [ 507.675584][T17358] bridge0: port 5(ipvlan2) entered disabled state [ 507.699456][T17358] ipvlan2: entered allmulticast mode [ 507.719833][T17358] bridge0: entered allmulticast mode [ 507.737644][T17373] netlink: 24 bytes leftover after parsing attributes in process `syz.2.3343'. [ 507.774157][T17373] netlink: 8 bytes leftover after parsing attributes in process `syz.2.3343'. [ 507.790163][T17358] ipvlan2: left allmulticast mode [ 507.808405][T17358] bridge0: left allmulticast mode [ 507.860825][T17015] bridge0: port 2(bridge_slave_1) entered blocking state [ 507.892863][T17015] bridge0: port 2(bridge_slave_1) entered disabled state [ 507.920372][T17015] bridge_slave_1: entered allmulticast mode [ 507.961984][T17015] bridge_slave_1: entered promiscuous mode [ 508.093811][ T140] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 508.112123][ T140] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 508.130220][ T140] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 508.147099][ T140] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 508.171664][ T140] veth1_macvtap: left promiscuous mode [ 508.179719][ T140] veth0_macvtap: left promiscuous mode [ 508.501166][ T48] smc: removing ib device syz1 [ 508.564948][ T5290] 8021q: adding VLAN 0 to HW filter on device eth3 [ 508.674561][T17015] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 508.687754][T17187] syz1: Port: 1 Link DOWN [ 508.738135][T17015] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 508.912830][T17015] team0: Port device team_slave_0 added [ 508.987913][T17015] team0: Port device team_slave_1 added [ 509.064106][ T48] smbdirect: ib_dev[syz1] removed [ 509.115079][T17403] pim6reg: entered allmulticast mode [ 509.132729][T17399] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 509.206003][T17015] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 509.222660][T17015] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 509.249263][T17015] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 509.289969][T17015] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 509.337635][T17015] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 509.399102][T17015] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 509.457027][T17417] openvswitch: netlink: Flow actions attr not present in new flow. [ 509.479481][T17414] syzkaller0: entered promiscuous mode [ 509.485007][T17414] syzkaller0: entered allmulticast mode [ 509.954080][T17443] netlink: 'syz.3.3354': attribute type 13 has an invalid length. [ 510.107273][T17452] netlink: 'syz.3.3354': attribute type 1 has an invalid length. [ 513.506527][T17015] hsr_slave_0: entered promiscuous mode [ 513.513475][T17015] hsr_slave_1: entered promiscuous mode [ 513.523053][T17015] debugfs: 'hsr0' already exists in 'hsr' [ 513.529633][T17015] Cannot create hsr debugfs directory [ 513.640905][ T5290] 8021q: adding VLAN 0 to HW filter on device eth4 [ 513.774497][T17471] Cannot find add_set index 0 as target [ 513.828190][T17471] syzkaller0: entered promiscuous mode [ 513.861951][T17471] syzkaller0: entered allmulticast mode [ 513.921948][T17480] netlink: 12 bytes leftover after parsing attributes in process `syz.1.3358'. [ 514.091536][T17485] netlink: 'syz.3.3357': attribute type 1 has an invalid length. [ 514.158470][ T140] IPVS: stop unused estimator thread 0... [ 514.370601][T17493] netlink: 16 bytes leftover after parsing attributes in process `syz.0.3362'. [ 514.430320][T17495] xt_cluster: node mask cannot exceed total number of nodes [ 514.698235][T17505] netlink: 28 bytes leftover after parsing attributes in process `syz.0.3366'. [ 514.720970][T17505] netlink: 28 bytes leftover after parsing attributes in process `syz.0.3366'. [ 514.805433][T17511] xt_TCPMSS: Only works on TCP SYN packets [ 515.059896][T17522] netlink: 8 bytes leftover after parsing attributes in process `syz.3.3370'. [ 515.179690][T17526] syzkaller0: entered promiscuous mode [ 515.199842][T17526] syzkaller0: entered allmulticast mode [ 515.867788][T17015] netdevsim netdevsim4 netdevsim0: renamed from eth0 [ 515.913918][T17015] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 515.963275][T17015] netdevsim netdevsim4 netdevsim1: renamed from eth1 [ 515.991251][T17015] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 516.013120][T17015] netdevsim netdevsim4 netdevsim2: renamed from eth2 [ 516.027687][T17015] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 516.039588][T17562] syzkaller0: entered promiscuous mode [ 516.066178][T17562] syzkaller0: entered allmulticast mode [ 516.075333][T17015] netdevsim netdevsim4 netdevsim3: renamed from eth3 [ 516.092974][T17015] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 516.388436][T17587] netlink: 'syz.0.3387': attribute type 2 has an invalid length. [ 516.493776][T17587] : entered promiscuous mode [ 516.594403][T17603] netlink: 12 bytes leftover after parsing attributes in process `syz.3.3388'. [ 516.762374][T17015] 8021q: adding VLAN 0 to HW filter on device bond0 [ 516.826706][T17015] 8021q: adding VLAN 0 to HW filter on device team0 [ 516.872134][T16958] bridge0: port 1(bridge_slave_0) entered blocking state [ 516.879409][T16958] bridge0: port 1(bridge_slave_0) entered forwarding state [ 516.944750][T16958] bridge0: port 2(bridge_slave_1) entered blocking state [ 516.952275][T16958] bridge0: port 2(bridge_slave_1) entered forwarding state [ 517.031491][T17616] netlink: 'syz.2.3391': attribute type 3 has an invalid length. [ 517.062851][T17616] netlink: 'syz.2.3391': attribute type 1 has an invalid length. [ 517.092925][T17616] netlink: 212 bytes leftover after parsing attributes in process `syz.2.3391'. [ 517.146498][T17616] NCSI netlink: No device for ifindex 813332851 [ 517.638216][T17635] netlink: 12 bytes leftover after parsing attributes in process `syz.2.3394'. [ 518.254205][T17670] netlink: 'syz.1.3400': attribute type 4 has an invalid length. [ 518.277225][T17670] netlink: 17 bytes leftover after parsing attributes in process `syz.1.3400'. [ 518.472919][T17015] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 519.050797][ T5633] block nbd3: Receive control failed (result -32) [ 519.070103][ T5633] block nbd3: Receive control failed (result -107) [ 519.109661][T17650] nbd3: detected capacity change from 0 to 63 [ 519.120054][T17015] veth0_vlan: entered promiscuous mode [ 519.150123][ T25] block nbd3: Dead connection, failed to find a fallback [ 519.157479][ T25] block nbd3: shutting down sockets [ 519.162746][ T25] blk_print_req_error: 91 callbacks suppressed [ 519.162763][ T25] I/O error, dev nbd3, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 519.178990][ T25] buffer_io_error: 138 callbacks suppressed [ 519.179008][ T25] Buffer I/O error on dev nbd3, logical block 0, async page read [ 519.198444][ T25] I/O error, dev nbd3, sector 2 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 519.207951][ T25] Buffer I/O error on dev nbd3, logical block 1, async page read [ 519.217916][ T25] I/O error, dev nbd3, sector 4 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 519.229170][ T25] Buffer I/O error on dev nbd3, logical block 2, async page read [ 519.239472][ T25] I/O error, dev nbd3, sector 6 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 519.248865][ T25] Buffer I/O error on dev nbd3, logical block 3, async page read [ 519.258904][ T25] I/O error, dev nbd3, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 519.268682][ T25] Buffer I/O error on dev nbd3, logical block 0, async page read [ 519.278865][ T25] I/O error, dev nbd3, sector 2 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 519.288217][ T25] Buffer I/O error on dev nbd3, logical block 1, async page read [ 519.301465][ T25] I/O error, dev nbd3, sector 4 op 0x0:(READ) flags 0x0 phys_seg 2 prio class 2 [ 519.311145][ T25] Buffer I/O error on dev nbd3, logical block 2, async page read [ 519.321127][ T25] Buffer I/O error on dev nbd3, logical block 3, async page read [ 519.331740][ T25] I/O error, dev nbd3, sector 0 op 0x0:(READ) flags 0x0 phys_seg 4 prio class 2 [ 519.341398][ T25] Buffer I/O error on dev nbd3, logical block 0, async page read [ 519.350936][ T25] Buffer I/O error on dev nbd3, logical block 1, async page read [ 519.360754][ T25] I/O error, dev nbd3, sector 0 op 0x0:(READ) flags 0x0 phys_seg 4 prio class 2 [ 519.370519][ T25] I/O error, dev nbd3, sector 0 op 0x0:(READ) flags 0x0 phys_seg 4 prio class 2 [ 519.384529][T16388] ldm_validate_partition_table(): Disk read failed. [ 519.403593][T17015] veth1_vlan: entered promiscuous mode [ 519.412621][T16388] Dev nbd3: unable to read RDB block 0 [ 519.435456][T16388] nbd3: unable to read partition table [ 519.497348][T16388] ldm_validate_partition_table(): Disk read failed. [ 519.518582][T16388] Dev nbd3: unable to read RDB block 0 [ 519.530821][T16388] nbd3: unable to read partition table [ 519.661370][T17015] veth0_macvtap: entered promiscuous mode [ 519.703809][T17015] veth1_macvtap: entered promiscuous mode [ 519.727976][T17710] syzkaller0: entered promiscuous mode [ 519.750874][T17710] syzkaller0: entered allmulticast mode [ 519.792215][T17720] lo: Caught tx_queue_len zero misconfig [ 519.858762][T17015] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 519.899494][T17722] syzkaller0: entered promiscuous mode [ 519.907710][T17722] syzkaller0: entered allmulticast mode [ 520.041254][T17015] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 520.179503][ T48] netdevsim netdevsim4 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 520.206228][ T14] netdevsim netdevsim4 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 520.245012][ T14] netdevsim netdevsim4 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 520.284286][ T14] netdevsim netdevsim4 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 520.562679][T17754] netlink: 24 bytes leftover after parsing attributes in process `syz.0.3416'. [ 520.721739][ T140] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 520.762821][ T140] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 520.883027][T17763] bond1: option ad_actor_sys_prio: mode dependency failed, not supported in mode balance-rr(0) [ 520.907023][T17763] bond1 (unregistering): Released all slaves [ 520.931316][T17775] netlink: 8 bytes leftover after parsing attributes in process `syz.2.3422'. [ 521.128642][T17780] syzkaller0: entered promiscuous mode [ 521.148128][T17780] syzkaller0: entered allmulticast mode [ 521.174512][ T140] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 521.198889][ T140] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 521.453851][T17789] netlink: 'syz.3.3424': attribute type 4 has an invalid length. [ 521.478004][T17798] netlink: 36 bytes leftover after parsing attributes in process `syz.2.3425'. [ 521.529774][T17798] syzkaller0: entered promiscuous mode [ 521.558031][T17798] syzkaller0: entered allmulticast mode [ 521.894753][T17817] netlink: 44 bytes leftover after parsing attributes in process `syz.1.3430'. [ 521.956846][T17817] Bluetooth: MGMT ver 1.23 [ 521.997261][T17817] syzkaller1: tun_chr_ioctl cmd 1074025678 [ 522.019461][T17817] syzkaller1: group set to 0 [ 522.051336][T17823] netlink: 40 bytes leftover after parsing attributes in process `syz.2.3431'. [ 522.118426][T17819] netlink: 132 bytes leftover after parsing attributes in process `syz.2.3431'. [ 522.140947][T17819] netlink: 132 bytes leftover after parsing attributes in process `syz.2.3431'. [ 522.321579][T17841] xt_socket: unknown flags 0xe4 [ 522.380765][T17852] netlink: 64 bytes leftover after parsing attributes in process `syz.1.3437'. [ 522.462133][T17832] netlink: 8 bytes leftover after parsing attributes in process `syz.4.3434'. [ 522.537144][T17830] IPVS: wlc: FWM 3 0x00000003 - no destination available [ 522.546336][T17185] IPVS: starting estimator thread 0... [ 522.679168][T17862] IPVS: using max 29 ests per chain, 69600 per kthread [ 522.976470][T17839] syzkaller0: entered promiscuous mode [ 522.990293][T17839] syzkaller0: entered allmulticast mode [ 523.040107][T17873] syzkaller0: entered promiscuous mode [ 523.062018][T17873] syzkaller0: entered allmulticast mode [ 523.095381][T17869] netlink: 8 bytes leftover after parsing attributes in process `syz.1.3439'. [ 525.714355][T17869] bond1: option xmit_hash_policy: invalid value (64) [ 525.727206][T17869] bond1 (unregistering): Released all slaves [ 525.758986][T17896] vxcan1 speed is unknown, defaulting to 1000 [ 525.873930][T17896] vxcan1 speed is unknown, defaulting to 1000 [ 525.901290][T17907] syzkaller0: entered promiscuous mode [ 525.916921][T17907] syzkaller0: entered allmulticast mode [ 525.929532][T17896] vxcan1 speed is unknown, defaulting to 1000 [ 526.084240][T17914] netlink: 136 bytes leftover after parsing attributes in process `syz.2.3446'. [ 526.238389][T17920] xt_hl: Unknown TTL match mode: 255 [ 526.263477][T17922] xt_hl: Unknown TTL match mode: 255 [ 526.298117][T17923] netlink: 24 bytes leftover after parsing attributes in process `syz.2.3450'. [ 526.634610][T17896] infiniband syz2: set active [ 526.640052][ T7474] vxcan1 speed is unknown, defaulting to 1000 [ 526.650284][T17896] infiniband syz2: added vxcan1 [ 526.660909][T17896] workqueue: Failed to create a rescuer kthread for wq "ib_mad1": -EINTR [ 526.671544][T17896] infiniband syz2: Couldn't open port 1 [ 526.693120][T17896] smbdirect: ib_dev[syz2]: added: IB_CA max_fast_reg_page_list_len=512 device_cap_flags=0x1c001223c76 kernel_cap_flags=0x14 page_size_cap=0xfffff000 [ 526.707098][T17943] netlink: 8 bytes leftover after parsing attributes in process `syz.1.3458'. [ 526.710246][T17896] smbdirect: ib_dev[syz2]: num_ports=1 max_qp_rd_atom=128 max_qp_init_rd_atom=128 max_sgl_rd=0 max_sge_rd=32 max_cqe=32767 max_qp_wr=1048576 max_send_sge=32 max_recv_sge=32 [ 526.744778][T17896] smbdirect: ib_dev[syz2]PORT[1]: iwarp=0 ib=0 roce=1 v1=0 v2=1 core_cap_flags=0x803005 [ 526.764182][T17936] netlink: 'syz.2.3456': attribute type 1 has an invalid length. [ 526.840859][T17896] RDS/IB: syz2: added [ 526.848264][T17896] smc: adding ib device syz2 with port count 1 [ 526.860972][T17896] smc: ib device syz2 port 1 has no pnetid [ 526.867605][T16069] vxcan1 speed is unknown, defaulting to 1000 [ 526.890091][T17896] vxcan1 speed is unknown, defaulting to 1000 [ 527.245264][T17961] netlink: 80 bytes leftover after parsing attributes in process `syz.0.3463'. [ 527.260746][T17959] netlink: 'syz.3.3462': attribute type 1 has an invalid length. [ 527.288699][T17959] netlink: 16179 bytes leftover after parsing attributes in process `syz.3.3462'. [ 527.323164][T17959] netlink: 'syz.3.3462': attribute type 13 has an invalid length. [ 527.387903][T17965] netlink: 28 bytes leftover after parsing attributes in process `syz.1.3464'. [ 527.600270][T17896] vxcan1 speed is unknown, defaulting to 1000 [ 527.811137][T17981] netlink: 'syz.0.3468': attribute type 39 has an invalid length. [ 527.842011][T17981] hsr_slave_0: left promiscuous mode [ 527.877456][T17981] hsr_slave_1: left promiscuous mode [ 528.232558][T17996] netlink: 240 bytes leftover after parsing attributes in process `syz.3.3474'. [ 528.328274][T17896] vxcan1 speed is unknown, defaulting to 1000 [ 528.398277][T17998] netlink: 'syz.1.3475': attribute type 1 has an invalid length. [ 528.569010][T17998] 8021q: adding VLAN 0 to HW filter on device bond1 [ 528.758919][T18012] netlink: 8 bytes leftover after parsing attributes in process `syz.3.3480'. [ 528.779874][T18015] netlink: 8 bytes leftover after parsing attributes in process `syz.1.3481'. [ 528.790924][T18015] netlink: 8 bytes leftover after parsing attributes in process `syz.1.3481'. [ 528.801959][T18015] netlink: 'syz.1.3481': attribute type 1 has an invalid length. [ 528.856626][T18015] bond2: entered promiscuous mode [ 528.862409][T18015] 8021q: adding VLAN 0 to HW filter on device bond2 [ 528.946171][T18020] Cannot find set identified by id 65534 to match [ 529.002675][T18015] bond2: (slave bridge2): making interface the new active one [ 529.011292][T18015] bridge2: entered promiscuous mode [ 529.019654][T18015] bond2: (slave bridge2): Enslaving as an active interface with an up link [ 529.072428][T17896] vxcan1 speed is unknown, defaulting to 1000 [ 529.208155][T18029] veth0_to_hsr: Caught tx_queue_len zero misconfig [ 529.356811][T18035] syzkaller0: entered promiscuous mode [ 529.365225][T18035] syzkaller0: entered allmulticast mode [ 529.693714][T17896] vxcan1 speed is unknown, defaulting to 1000 [ 531.090090][T18056] vlan0: mtu greater than device maximum [ 531.118674][T18063] netlink: 'syz.3.3497': attribute type 12 has an invalid length. [ 531.127126][T18063] netlink: 'syz.3.3497': attribute type 29 has an invalid length. [ 531.135313][T18063] netlink: 'syz.3.3497': attribute type 7 has an invalid length. [ 531.143485][T18063] netlink: 'syz.3.3497': attribute type 39 has an invalid length. [ 531.153094][T18068] __nla_validate_parse: 3 callbacks suppressed [ 531.153116][T18068] netlink: 16 bytes leftover after parsing attributes in process `syz.2.3500'. [ 531.189347][T17896] vxcan1 speed is unknown, defaulting to 1000 [ 531.326904][T18089] netlink: 252 bytes leftover after parsing attributes in process `syz.2.3503'. [ 531.371703][T18095] netlink: 252 bytes leftover after parsing attributes in process `syz.2.3503'. [ 531.661033][T18099] syzkaller0: entered promiscuous mode [ 531.667120][T18099] syzkaller0: entered allmulticast mode [ 531.676454][T17896] vxcan1 speed is unknown, defaulting to 1000 [ 532.066718][T17896] vxcan1 speed is unknown, defaulting to 1000 [ 532.566664][T18145] netlink: 4 bytes leftover after parsing attributes in process `syz.3.3517'. [ 533.115924][T18155] netlink: 40 bytes leftover after parsing attributes in process `syz.2.3521'. [ 533.135117][T18157] netlink: 'syz.2.3521': attribute type 11 has an invalid length. [ 533.162896][T18157] netlink: 132 bytes leftover after parsing attributes in process `syz.2.3521'. [ 534.416076][T18139] Bluetooth: hci5: command 0x0406 tx timeout [ 534.830445][T17896] vxcan1 speed is unknown, defaulting to 1000 [ 534.836824][T18143] veth1_to_bond: entered allmulticast mode [ 534.842913][T18143] veth1_to_bond: left allmulticast mode [ 534.873570][T18145] bond0: (slave bond_slave_1): Releasing backup interface [ 535.396147][T18184] netlink: 'syz.3.3530': attribute type 12 has an invalid length. [ 535.436142][T18184] netlink: 'syz.3.3530': attribute type 29 has an invalid length. [ 535.455733][T18190] netlink: 16 bytes leftover after parsing attributes in process `syz.2.3532'. [ 535.476565][T18190] nbd: must specify at least one socket [ 535.496022][T18184] netlink: 148 bytes leftover after parsing attributes in process `syz.3.3530'. [ 535.553307][T18184] netlink: 59 bytes leftover after parsing attributes in process `syz.3.3530'. [ 535.573911][T18197] IPVS: length: 24 != 12587352 [ 535.648211][T18201] netlink: 8 bytes leftover after parsing attributes in process `syz.4.3534'. [ 535.807505][T18210] netlink: 'syz.2.3535': attribute type 1 has an invalid length. [ 535.842408][T18210] netlink: 'syz.2.3535': attribute type 4 has an invalid length. [ 536.225377][T18236] macvlan0: entered promiscuous mode [ 536.264770][T18236] syzkaller1: entered promiscuous mode [ 536.283577][T18236] syzkaller1: entered allmulticast mode [ 536.360178][T18239] netlink: 'syz.3.3547': attribute type 1 has an invalid length. [ 536.369066][T18239] __nla_validate_parse: 3 callbacks suppressed [ 536.369093][T18239] netlink: 224 bytes leftover after parsing attributes in process `syz.3.3547'. [ 536.385706][T18239] netlink: 8 bytes leftover after parsing attributes in process `syz.3.3547'. [ 536.525495][T18249] netlink: 72 bytes leftover after parsing attributes in process `syz.2.3550'. [ 536.752920][T18260] netlink: 666 bytes leftover after parsing attributes in process `syz.0.3552'. [ 536.796213][T18264] netlink: 32 bytes leftover after parsing attributes in process `syz.4.3554'. [ 536.900156][T18260] netlink: 666 bytes leftover after parsing attributes in process `syz.0.3552'. [ 537.732167][T18317] netlink: 'syz.3.3566': attribute type 10 has an invalid length. [ 537.783879][T18317] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 537.817952][T18317] bond0: (slave batadv0): Enslaving as an active interface with an up link [ 537.991085][T18340] sctp: [Deprecated]: syz.0.3574 (pid 18340) Use of int in max_burst socket option deprecated. [ 537.991085][T18340] Use struct sctp_assoc_value instead [ 538.031717][T18342] netlink: 'syz.1.3573': attribute type 2 has an invalid length. [ 538.049562][T18342] netlink: 'syz.1.3573': attribute type 1 has an invalid length. [ 538.069682][T18342] netlink: 'syz.1.3573': attribute type 1 has an invalid length. [ 538.098276][T18334] x_tables: duplicate underflow at hook 3 [ 538.329676][T18356] netlink: 16 bytes leftover after parsing attributes in process `syz.1.3579'. [ 538.663862][T18371] netlink: 1288 bytes leftover after parsing attributes in process `syz.2.3584'. [ 538.862383][T16923] IPVS: starting estimator thread 0... [ 538.904172][T18381] IPVS: sh: FWM 3 0x00000003 - no destination available [ 538.981996][T18382] IPVS: using max 26 ests per chain, 62400 per kthread [ 539.007237][T18387] netlink: 24 bytes leftover after parsing attributes in process `syz.0.3589'. [ 539.116944][T18399] netlink: 16 bytes leftover after parsing attributes in process `syz.2.3593'. [ 539.135423][T18401] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 539.490579][T18421] nbd: nbd0 already in use [ 539.709886][T18436] gtp0: entered promiscuous mode [ 539.726832][T18436] gtp0: entered allmulticast mode [ 539.942816][T18447] validate_nla: 1 callbacks suppressed [ 539.942868][T18447] netlink: 'syz.2.3606': attribute type 1 has an invalid length. [ 539.958610][T18449] netlink: 'syz.1.3607': attribute type 1 has an invalid length. [ 539.959018][T18447] netlink: 'syz.2.3606': attribute type 3 has an invalid length. [ 539.975503][T18447] netlink: 'syz.2.3606': attribute type 7 has an invalid length. [ 539.984434][T18447] netlink: 'syz.2.3606': attribute type 8 has an invalid length. [ 540.024220][T18449] 8021q: adding VLAN 0 to HW filter on device bond3 [ 540.053131][T18447] NCSI netlink: No device for ifindex 131092 [ 540.071423][T18447] IPv6: NLM_F_CREATE should be specified when creating new route [ 540.381664][T18471] netlink: 'syz.3.3612': attribute type 1 has an invalid length. [ 540.720651][T18490] netlink: 'syz.0.3619': attribute type 1 has an invalid length. [ 540.750479][T18463] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 540.800890][T18490] 8021q: adding VLAN 0 to HW filter on device bond2 [ 541.014925][T18502] netlink: 'syz.1.3622': attribute type 1 has an invalid length. [ 541.049537][T18499] bond3: entered promiscuous mode [ 541.066591][T18499] 8021q: adding VLAN 0 to HW filter on device bond3 [ 541.113828][T18502] 8021q: adding VLAN 0 to HW filter on device bond4 [ 541.158880][T18504] bond4: (slave gretap2): making interface the new active one [ 541.170539][T18504] bond4: (slave gretap2): Enslaving as an active interface with an up link [ 541.213219][T18503] 8021q: adding VLAN 0 to HW filter on device bond3 [ 541.235550][T18503] bond3: (slave sit1): The slave device specified does not support setting the MAC address [ 541.252129][T18503] bond3: (slave sit1): Error -95 calling set_mac_address [ 541.714922][T18525] __nla_validate_parse: 7 callbacks suppressed [ 541.714944][T18525] netlink: 28 bytes leftover after parsing attributes in process `syz.0.3629'. [ 541.749874][T18525] veth0: entered promiscuous mode [ 541.761694][T18527] veth0: left promiscuous mode [ 542.664838][T18579] netlink: 'syz.1.3644': attribute type 1 has an invalid length. [ 542.857595][T18585] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 542.942947][T18597] netlink: 60 bytes leftover after parsing attributes in process `syz.0.3649'. [ 542.969956][T18597] netlink: 420 bytes leftover after parsing attributes in process `syz.0.3649'. [ 543.871959][T18635] netlink: 'syz.2.3659': attribute type 1 has an invalid length. [ 543.910678][T18640] geneve2: entered promiscuous mode [ 543.917518][T18640] geneve2: entered allmulticast mode [ 543.978581][T18647] netlink: 4 bytes leftover after parsing attributes in process `syz.0.3665'. [ 544.059384][T18651] netlink: 4 bytes leftover after parsing attributes in process `syz.0.3665'. [ 544.346432][T18654] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 545.047081][T18707] A link change request failed with some changes committed already. Interface geneve0 may have been left with an inconsistent configuration, please check. [ 545.316842][T18730] IPVS: set_ctl: invalid protocol: 58 0.0.0.0:20000 [ 545.485123][T18741] netlink: 8 bytes leftover after parsing attributes in process `syz.4.3686'. [ 545.530252][T18743] netlink: 12 bytes leftover after parsing attributes in process `syz.4.3686'. [ 545.560432][T18741] validate_nla: 1 callbacks suppressed [ 545.560482][T18741] netlink: 'syz.4.3686': attribute type 5 has an invalid length. [ 545.582503][T18743] block nbd4: Unsupported socket: should be TCP or UNIX. [ 545.584429][T18750] netlink: 28 bytes leftover after parsing attributes in process `syz.1.3688'. [ 545.624842][T18750] netlink: 'syz.1.3688': attribute type 7 has an invalid length. [ 545.640232][T18741] netlink: 20 bytes leftover after parsing attributes in process `syz.4.3686'. [ 545.658281][T18753] syzkaller1: tun_chr_ioctl cmd 1074025677 [ 545.658350][T18750] netlink: 20 bytes leftover after parsing attributes in process `syz.1.3688'. [ 545.665028][T18749] block nbd4: Unsupported socket: should be TCP or UNIX. [ 545.686367][T17187] syzkaller1: tun_net_xmit 90 [ 545.703736][T18753] syzkaller1: Linktype set failed because interface is up [ 546.730338][T18794] __nla_validate_parse: 1 callbacks suppressed [ 546.730359][T18794] netlink: 4 bytes leftover after parsing attributes in process `syz.3.3700'. [ 546.826991][T18798] syzkaller0: entered promiscuous mode [ 546.838206][T18798] syzkaller0: entered allmulticast mode [ 547.021053][T18804] netlink: 'syz.3.3705': attribute type 1 has an invalid length. [ 547.051438][T18804] FAULT_INJECTION: forcing a failure. [ 547.051438][T18804] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 547.089391][T18804] CPU: 1 UID: 0 PID: 18804 Comm: syz.3.3705 Not tainted syzkaller #0 PREEMPT(full) [ 547.089422][T18804] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 547.089434][T18804] Call Trace: [ 547.089443][T18804] [ 547.089452][T18804] dump_stack_lvl+0xe8/0x150 [ 547.089496][T18804] should_fail_ex+0x40c/0x560 [ 547.089537][T18804] _copy_from_iter+0x1d3/0x1660 [ 547.089558][T18804] ? kmem_cache_alloc_node_noprof+0x1b1/0x610 [ 547.089587][T18804] ? rcu_is_watching+0x15/0xb0 [ 547.089623][T18804] ? trace_kmem_cache_alloc+0x29/0xe0 [ 547.089651][T18804] ? kmem_cache_alloc_node_noprof+0x3b8/0x610 [ 547.089677][T18804] ? __pfx__copy_from_iter+0x10/0x10 [ 547.089698][T18804] ? __alloc_skb+0x276/0x7a0 [ 547.089724][T18804] ? __alloc_skb+0x276/0x7a0 [ 547.089753][T18804] ? netlink_sendmsg+0x650/0xb40 [ 547.089783][T18804] ? skb_put+0x112/0x210 [ 547.089814][T18804] netlink_sendmsg+0x6c0/0xb40 [ 547.089854][T18804] ? __pfx_netlink_sendmsg+0x10/0x10 [ 547.089895][T18804] ? aa_sock_msg_perm+0xf1/0x1b0 [ 547.089934][T18804] ? __pfx_netlink_sendmsg+0x10/0x10 [ 547.089960][T18804] sock_sendmsg_nosec+0x13a/0x180 [ 547.089996][T18804] ____sys_sendmsg+0x54e/0x850 [ 547.090029][T18804] ? __pfx_____sys_sendmsg+0x10/0x10 [ 547.090067][T18804] ? import_iovec+0x73/0xa0 [ 547.090096][T18804] ___sys_sendmsg+0x2a5/0x360 [ 547.090121][T18804] ? __lock_acquire+0x683/0x2cf0 [ 547.090156][T18804] ? __pfx____sys_sendmsg+0x10/0x10 [ 547.090225][T18804] ? __fget_files+0x2a/0x420 [ 547.090253][T18804] ? __fget_files+0x3a2/0x420 [ 547.090292][T18804] __x64_sys_sendmsg+0x1b1/0x290 [ 547.090322][T18804] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 547.090370][T18804] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 547.090396][T18804] do_syscall_64+0x174/0x580 [ 547.090420][T18804] ? trace_irq_disable+0x3b/0x140 [ 547.090449][T18804] ? clear_bhb_loop+0x40/0x90 [ 547.090475][T18804] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 547.090497][T18804] RIP: 0033:0x7f56c119de59 [ 547.090518][T18804] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 547.090537][T18804] RSP: 002b:00007f56c1f9a028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 547.090561][T18804] RAX: ffffffffffffffda RBX: 00007f56c1425fa0 RCX: 00007f56c119de59 [ 547.090576][T18804] RDX: 0000000000000000 RSI: 00002000000012c0 RDI: 0000000000000004 [ 547.090590][T18804] RBP: 00007f56c1f9a090 R08: 0000000000000000 R09: 0000000000000000 [ 547.090604][T18804] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 547.090617][T18804] R13: 00007f56c1426038 R14: 00007f56c1425fa0 R15: 00007fff9e383558 [ 547.090653][T18804] [ 547.396566][T18814] netlink: 24 bytes leftover after parsing attributes in process `syz.0.3707'. [ 547.405745][T18814] netlink: 24 bytes leftover after parsing attributes in process `syz.0.3707'. [ 547.425126][T18821] netlink: 'syz.1.3711': attribute type 58 has an invalid length. [ 547.460380][T18821] netlink: 20 bytes leftover after parsing attributes in process `syz.1.3711'. [ 547.828905][T18844] netlink: 'syz.0.3716': attribute type 1 has an invalid length. [ 547.880000][T18838] syzkaller0: entered promiscuous mode [ 547.888354][T18838] syzkaller0: entered allmulticast mode [ 548.008772][T18851] bond1 (unregistering): Released all slaves [ 548.180138][T18861] netlink: 24 bytes leftover after parsing attributes in process `syz.0.3720'. [ 548.230793][T18863] syzkaller0: entered promiscuous mode [ 548.236467][T18863] syzkaller0: entered allmulticast mode [ 548.298249][T18865] netlink: 24 bytes leftover after parsing attributes in process `syz.3.3722'. [ 548.492729][T18875] netlink: 'syz.2.3724': attribute type 1 has an invalid length. [ 548.511058][T18878] netlink: 'syz.4.3726': attribute type 2 has an invalid length. [ 548.522469][T18875] FAULT_INJECTION: forcing a failure. [ 548.522469][T18875] name failslab, interval 1, probability 0, space 0, times 0 [ 548.533247][T18878] netlink: 'syz.4.3726': attribute type 8 has an invalid length. [ 548.552552][T18875] CPU: 0 UID: 0 PID: 18875 Comm: syz.2.3724 Not tainted syzkaller #0 PREEMPT(full) [ 548.552581][T18875] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 548.552593][T18875] Call Trace: [ 548.552602][T18875] [ 548.552610][T18875] dump_stack_lvl+0xe8/0x150 [ 548.552647][T18875] should_fail_ex+0x40c/0x560 [ 548.552683][T18875] should_failslab+0xa8/0x100 [ 548.552716][T18875] __kmalloc_node_noprof+0x105/0x740 [ 548.552743][T18875] ? qdisc_create+0x64/0xf00 [ 548.552852][T18875] ? lock_acquire+0x106/0x350 [ 548.552877][T18875] ? qdisc_alloc+0x92/0x9d0 [ 548.552921][T18875] ? qdisc_alloc+0x92/0x9d0 [ 548.552953][T18875] qdisc_alloc+0x92/0x9d0 [ 548.552987][T18875] qdisc_create+0x12c/0xf00 [ 548.553009][T18875] ? lockdep_rtnl_is_held+0x26/0x40 [ 548.553066][T18875] ? qdisc_lookup+0x364/0x6c0 [ 548.553096][T18875] tc_modify_qdisc+0x17af/0x2390 [ 548.553133][T18875] ? __pfx_tc_modify_qdisc+0x10/0x10 [ 548.553196][T18875] ? __pfx_tc_modify_qdisc+0x10/0x10 [ 548.553217][T18875] rtnetlink_rcv_msg+0x7b9/0xc00 [ 548.553262][T18875] ? netlink_sendmsg+0x5d4/0xb40 [ 548.553290][T18878] netlink: 132 bytes leftover after parsing attributes in process `syz.4.3726'. [ 548.553290][T18875] ? rtnetlink_rcv_msg+0x1c9/0xc00 [ 548.553311][T18875] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 548.553333][T18875] ? __lock_acquire+0x683/0x2cf0 [ 548.553369][T18875] netlink_rcv_skb+0x226/0x4a0 [ 548.553393][T18875] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 548.553414][T18875] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 548.553450][T18875] ? netlink_deliver_tap+0x2e/0x1b0 [ 548.553472][T18875] ? netlink_deliver_tap+0x2e/0x1b0 [ 548.553500][T18875] netlink_unicast+0x7bb/0x940 [ 548.553532][T18875] netlink_sendmsg+0x813/0xb40 [ 548.553566][T18875] ? __pfx_netlink_sendmsg+0x10/0x10 [ 548.553593][T18875] ? aa_sock_msg_perm+0xf1/0x1b0 [ 548.553624][T18875] ? __pfx_netlink_sendmsg+0x10/0x10 [ 548.553645][T18875] sock_sendmsg_nosec+0x13a/0x180 [ 548.553675][T18875] ____sys_sendmsg+0x54e/0x850 [ 548.553704][T18875] ? __pfx_____sys_sendmsg+0x10/0x10 [ 548.553737][T18875] ? import_iovec+0x73/0xa0 [ 548.553763][T18875] ___sys_sendmsg+0x2a5/0x360 [ 548.553783][T18875] ? __lock_acquire+0x683/0x2cf0 [ 548.553811][T18875] ? __pfx____sys_sendmsg+0x10/0x10 [ 548.553869][T18875] ? __fget_files+0x2a/0x420 [ 548.553892][T18875] ? __fget_files+0x3a2/0x420 [ 548.553925][T18875] __x64_sys_sendmsg+0x1b1/0x290 [ 548.553951][T18875] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 548.553992][T18875] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 548.554012][T18875] do_syscall_64+0x174/0x580 [ 548.554032][T18875] ? trace_irq_disable+0x3b/0x140 [ 548.554056][T18875] ? clear_bhb_loop+0x40/0x90 [ 548.554078][T18875] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 548.554097][T18875] RIP: 0033:0x7f3415d9de59 [ 548.554115][T18875] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 548.554130][T18875] RSP: 002b:00007f3416ba9028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 548.554150][T18875] RAX: ffffffffffffffda RBX: 00007f3416025fa0 RCX: 00007f3415d9de59 [ 548.554163][T18875] RDX: 0000000000000000 RSI: 00002000000012c0 RDI: 0000000000000004 [ 548.554174][T18875] RBP: 00007f3416ba9090 R08: 0000000000000000 R09: 0000000000000000 [ 548.554194][T18875] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 548.554205][T18875] R13: 00007f3416026038 R14: 00007f3416025fa0 R15: 00007ffd0cc56288 [ 548.554236][T18875] [ 549.204652][T18902] netlink: 'syz.2.3731': attribute type 1 has an invalid length. [ 549.267684][T18902] 8021q: adding VLAN 0 to HW filter on device bond2 [ 549.381219][T18906] bond2: (slave ip6gretap1): making interface the new active one [ 549.395312][T18906] bond2: (slave ip6gretap1): Enslaving as an active interface with an up link [ 549.417673][T18915] IPVS: set_ctl: invalid protocol: 58 127.0.0.1:20003 [ 549.451835][T18902] veth5: entered promiscuous mode [ 549.490497][T18902] bond2: (slave veth5): Enslaving as an active interface with a down link [ 549.585119][T18912] bond2: (slave vlan3): the slave hw address is in use by the bond; couldn't find a slave with a free hw address to give it (this should not have happened) [ 549.674333][T18924] syzkaller0: entered promiscuous mode [ 549.712476][T18923] netlink: 252 bytes leftover after parsing attributes in process `syz.1.3737'. [ 549.722539][T18924] syzkaller0: entered allmulticast mode [ 549.901762][T18941] netlink: 'syz.2.3740': attribute type 1 has an invalid length. [ 549.979791][T18943] netlink: 4 bytes leftover after parsing attributes in process `syz.2.3740'. [ 550.006463][T18945] FAULT_INJECTION: forcing a failure. [ 550.006463][T18945] name failslab, interval 1, probability 0, space 0, times 0 [ 550.020044][T18945] CPU: 0 UID: 0 PID: 18945 Comm: syz.4.3741 Not tainted syzkaller #0 PREEMPT(full) [ 550.020071][T18945] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 550.020082][T18945] Call Trace: [ 550.020090][T18945] [ 550.020098][T18945] dump_stack_lvl+0xe8/0x150 [ 550.020135][T18945] should_fail_ex+0x40c/0x560 [ 550.020168][T18945] should_failslab+0xa8/0x100 [ 550.020198][T18945] __kmalloc_node_noprof+0x105/0x740 [ 550.020223][T18945] ? qdisc_create+0x64/0xf00 [ 550.020241][T18945] ? lock_acquire+0x106/0x350 [ 550.020264][T18945] ? qdisc_alloc+0x92/0x9d0 [ 550.020283][T18945] ? qdisc_alloc+0x92/0x9d0 [ 550.020310][T18945] qdisc_alloc+0x92/0x9d0 [ 550.020341][T18945] qdisc_create+0x12c/0xf00 [ 550.020362][T18945] ? lockdep_rtnl_is_held+0x26/0x40 [ 550.020389][T18945] ? qdisc_lookup+0x364/0x6c0 [ 550.020420][T18945] tc_modify_qdisc+0x17af/0x2390 [ 550.020456][T18945] ? __pfx_tc_modify_qdisc+0x10/0x10 [ 550.020475][T18945] ? __dev_queue_xmit+0x29b/0x37f0 [ 550.020533][T18945] ? __pfx_tc_modify_qdisc+0x10/0x10 [ 550.020552][T18945] rtnetlink_rcv_msg+0x7b9/0xc00 [ 550.020581][T18945] ? rtnetlink_rcv_msg+0x1c9/0xc00 [ 550.020607][T18945] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 550.020627][T18945] ? ref_tracker_free+0x689/0x830 [ 550.020652][T18945] ? __pfx_ref_tracker_free+0x10/0x10 [ 550.020684][T18945] netlink_rcv_skb+0x226/0x4a0 [ 550.020710][T18945] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 550.020734][T18945] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 550.020780][T18945] ? netlink_deliver_tap+0x2e/0x1b0 [ 550.020804][T18945] ? netlink_deliver_tap+0x2e/0x1b0 [ 550.020836][T18945] netlink_unicast+0x7bb/0x940 [ 550.020872][T18945] netlink_sendmsg+0x813/0xb40 [ 550.020911][T18945] ? __pfx_netlink_sendmsg+0x10/0x10 [ 550.020941][T18945] ? aa_sock_msg_perm+0xf1/0x1b0 [ 550.020972][T18945] ? __pfx_netlink_sendmsg+0x10/0x10 [ 550.020994][T18945] sock_sendmsg_nosec+0x13a/0x180 [ 550.021024][T18945] ____sys_sendmsg+0x54e/0x850 [ 550.021055][T18945] ? __pfx_____sys_sendmsg+0x10/0x10 [ 550.021089][T18945] ? import_iovec+0x73/0xa0 [ 550.021119][T18945] ___sys_sendmsg+0x2a5/0x360 [ 550.021142][T18945] ? __lock_acquire+0x683/0x2cf0 [ 550.021173][T18945] ? __pfx____sys_sendmsg+0x10/0x10 [ 550.021234][T18945] ? __fget_files+0x2a/0x420 [ 550.021259][T18945] ? __fget_files+0x3a2/0x420 [ 550.021295][T18945] __x64_sys_sendmsg+0x1b1/0x290 [ 550.021323][T18945] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 550.021370][T18945] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 550.021394][T18945] do_syscall_64+0x174/0x580 [ 550.021415][T18945] ? trace_irq_disable+0x3b/0x140 [ 550.021440][T18945] ? clear_bhb_loop+0x40/0x90 [ 550.021465][T18945] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 550.021486][T18945] RIP: 0033:0x7fcdcbb9de59 [ 550.021505][T18945] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 550.021522][T18945] RSP: 002b:00007fcdcca38028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 550.021543][T18945] RAX: ffffffffffffffda RBX: 00007fcdcbe25fa0 RCX: 00007fcdcbb9de59 [ 550.021558][T18945] RDX: 0000000000000000 RSI: 00002000000012c0 RDI: 0000000000000004 [ 550.021570][T18945] RBP: 00007fcdcca38090 R08: 0000000000000000 R09: 0000000000000000 [ 550.021581][T18945] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 550.021593][T18945] R13: 00007fcdcbe26038 R14: 00007fcdcbe25fa0 R15: 00007ffcd20d2138 [ 550.021627][T18945] [ 550.386617][T18943] bond3 (unregistering): Released all slaves [ 550.597054][T18959] validate_nla: 1 callbacks suppressed [ 550.597075][T18959] netlink: 'syz.3.3745': attribute type 4 has an invalid length. [ 550.628650][T18959] netlink: 240 bytes leftover after parsing attributes in process `syz.3.3745'. [ 551.350870][T19002] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 551.567532][T19006] syzkaller0: entered promiscuous mode [ 551.573122][T19006] syzkaller0: entered allmulticast mode [ 551.869104][T19022] netlink: 24 bytes leftover after parsing attributes in process `syz.1.3756'. [ 551.882870][T19020] xt_l2tp: v2 tid > 0xffff: 1114244 [ 551.917477][T19024] netlink: 'syz.4.3757': attribute type 1 has an invalid length. [ 551.948025][T19024] FAULT_INJECTION: forcing a failure. [ 551.948025][T19024] name failslab, interval 1, probability 0, space 0, times 0 [ 551.969136][T19024] CPU: 0 UID: 0 PID: 19024 Comm: syz.4.3757 Not tainted syzkaller #0 PREEMPT(full) [ 551.969165][T19024] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 551.969180][T19024] Call Trace: [ 551.969189][T19024] [ 551.969197][T19024] dump_stack_lvl+0xe8/0x150 [ 551.969230][T19024] should_fail_ex+0x40c/0x560 [ 551.969265][T19024] should_failslab+0xa8/0x100 [ 551.969294][T19024] __kmalloc_cache_noprof+0xa8/0x660 [ 551.969318][T19024] ? ref_tracker_alloc+0x2d7/0x4b0 [ 551.969335][T19024] ? tcf_block_get_ext+0x2b4/0x17d0 [ 551.969357][T19024] ? tcf_block_get_ext+0x2b4/0x17d0 [ 551.969379][T19024] ? __pfx_ref_tracker_alloc+0x10/0x10 [ 551.969402][T19024] tcf_block_get_ext+0x2b4/0x17d0 [ 551.969421][T19024] ? sock_sendmsg_nosec+0x13a/0x180 [ 551.969450][T19024] ? do_syscall_64+0x174/0x580 [ 551.969469][T19024] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 551.969499][T19024] tcf_block_get+0x67/0xa0 [ 551.969521][T19024] ? __pfx_tcf_chain_head_change_dflt+0x10/0x10 [ 551.969550][T19024] multiq_init+0x72/0x2b0 [ 551.969675][T19024] ? __pfx_multiq_init+0x10/0x10 [ 551.969698][T19024] qdisc_create+0x7b5/0xf00 [ 551.969719][T19024] ? lockdep_rtnl_is_held+0x26/0x40 [ 551.969751][T19024] tc_modify_qdisc+0x17af/0x2390 [ 551.969786][T19024] ? __pfx_tc_modify_qdisc+0x10/0x10 [ 551.969815][T19024] ? __dev_queue_xmit+0x29b/0x37f0 [ 551.969874][T19024] ? __pfx_tc_modify_qdisc+0x10/0x10 [ 551.969892][T19024] rtnetlink_rcv_msg+0x7b9/0xc00 [ 551.969919][T19024] ? rtnetlink_rcv_msg+0x1c9/0xc00 [ 551.969940][T19024] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 551.969960][T19024] ? ref_tracker_free+0x689/0x830 [ 551.969982][T19024] ? __pfx_ref_tracker_free+0x10/0x10 [ 551.970014][T19024] netlink_rcv_skb+0x226/0x4a0 [ 551.970041][T19024] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 551.970067][T19024] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 551.970107][T19024] ? netlink_deliver_tap+0x2e/0x1b0 [ 551.970132][T19024] ? netlink_deliver_tap+0x2e/0x1b0 [ 551.970165][T19024] netlink_unicast+0x7bb/0x940 [ 551.970201][T19024] netlink_sendmsg+0x813/0xb40 [ 551.970239][T19024] ? __pfx_netlink_sendmsg+0x10/0x10 [ 551.970268][T19024] ? aa_sock_msg_perm+0xf1/0x1b0 [ 551.970301][T19024] ? __pfx_netlink_sendmsg+0x10/0x10 [ 551.970321][T19024] sock_sendmsg_nosec+0x13a/0x180 [ 551.970353][T19024] ____sys_sendmsg+0x54e/0x850 [ 551.970383][T19024] ? __pfx_____sys_sendmsg+0x10/0x10 [ 551.970420][T19024] ? import_iovec+0x73/0xa0 [ 551.970445][T19024] ___sys_sendmsg+0x2a5/0x360 [ 551.970467][T19024] ? __lock_acquire+0x683/0x2cf0 [ 551.970498][T19024] ? __pfx____sys_sendmsg+0x10/0x10 [ 551.970564][T19024] ? __fget_files+0x2a/0x420 [ 551.970590][T19024] ? __fget_files+0x3a2/0x420 [ 551.970626][T19024] __x64_sys_sendmsg+0x1b1/0x290 [ 551.970654][T19024] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 551.970698][T19024] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 551.970720][T19024] do_syscall_64+0x174/0x580 [ 551.970740][T19024] ? trace_irq_disable+0x3b/0x140 [ 551.970765][T19024] ? clear_bhb_loop+0x40/0x90 [ 551.970791][T19024] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 551.970819][T19024] RIP: 0033:0x7fcdcbb9de59 [ 551.970838][T19024] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 551.970854][T19024] RSP: 002b:00007fcdcca38028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 551.970874][T19024] RAX: ffffffffffffffda RBX: 00007fcdcbe25fa0 RCX: 00007fcdcbb9de59 [ 551.970888][T19024] RDX: 0000000000000000 RSI: 00002000000012c0 RDI: 0000000000000004 [ 551.970898][T19024] RBP: 00007fcdcca38090 R08: 0000000000000000 R09: 0000000000000000 [ 551.970910][T19024] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 551.970921][T19024] R13: 00007fcdcbe26038 R14: 00007fcdcbe25fa0 R15: 00007ffcd20d2138 [ 551.970956][T19024] [ 552.468384][T19031] netlink: 'syz.2.3759': attribute type 1 has an invalid length. [ 552.510463][T19031] netlink: 228 bytes leftover after parsing attributes in process `syz.2.3759'. [ 552.933422][T19053] netlink: 'syz.4.3764': attribute type 1 has an invalid length. [ 553.033795][T19062] syzkaller0: entered promiscuous mode [ 553.039586][T19062] syzkaller0: entered allmulticast mode [ 553.062668][T19056] netlink: 'syz.2.3765': attribute type 1 has an invalid length. [ 553.246919][T19074] netlink: 104 bytes leftover after parsing attributes in process `syz.4.3770'. [ 553.534800][T19086] netlink: 24 bytes leftover after parsing attributes in process `syz.0.3774'. [ 553.579661][ T140] tipc: Subscription rejected, illegal request [ 553.691192][T19096] IPv6: NLM_F_CREATE should be specified when creating new route [ 553.727533][T19096] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 553.734952][T19096] IPv6: NLM_F_CREATE should be set when creating new route [ 553.792971][T19103] bond0: Device is already in use. [ 554.111163][T19121] netlink: 4 bytes leftover after parsing attributes in process `syz.0.3781'. [ 554.161755][T19120] netlink: 'syz.4.3780': attribute type 1 has an invalid length. [ 554.552692][T19137] netlink: 16215 bytes leftover after parsing attributes in process `syz.1.3787'. [ 554.574639][T19131] netlink: 'syz.0.3784': attribute type 1 has an invalid length. [ 554.801702][T19150] netlink: zone id is out of range [ 554.833646][T19150] netlink: zone id is out of range [ 554.857496][T19150] netlink: zone id is out of range [ 554.877179][T19150] netlink: zone id is out of range [ 554.903216][T19150] netlink: zone id is out of range [ 554.936470][T19150] netlink: zone id is out of range [ 554.942008][T19150] netlink: zone id is out of range [ 554.948670][T19150] netlink: zone id is out of range [ 554.953885][T19150] netlink: zone id is out of range [ 554.966409][T19150] netlink: zone id is out of range [ 555.203023][T19174] xt_hashlimit: invalid interval [ 555.422314][T19184] netlink: 4 bytes leftover after parsing attributes in process `syz.2.3800'. [ 555.478910][T19191] netlink: 12 bytes leftover after parsing attributes in process `syz.2.3800'. [ 555.650747][T19184] netlink: 'syz.2.3800': attribute type 61 has an invalid length. [ 555.681711][T19196] syz_tun: left allmulticast mode [ 555.695040][T19196] syz_tun: left promiscuous mode [ 555.713770][T19196] bridge0: port 4(syz_tun) entered disabled state [ 555.762966][T19196] team0: Port device syz_tun added [ 555.961348][T19199] syzkaller0: entered promiscuous mode [ 555.972890][T19199] syzkaller0: entered allmulticast mode [ 556.323768][T19229] netlink: 20 bytes leftover after parsing attributes in process `syz.3.3810'. [ 558.908138][T19226] IPv6: sit1: Disabled Multicast RS [ 558.914272][T19226] sit1: entered allmulticast mode [ 558.939375][T19214] vlan3: entered allmulticast mode [ 558.944532][T19214] bond0: entered allmulticast mode [ 558.954510][T19214] bond_slave_0: entered allmulticast mode [ 558.960985][T19214] bond_slave_1: entered allmulticast mode [ 559.090991][T19255] netlink: 'syz.4.3813': attribute type 4 has an invalid length. [ 559.136952][T19255] netlink: 17 bytes leftover after parsing attributes in process `syz.4.3813'. [ 559.165987][T19257] netlink: 14601 bytes leftover after parsing attributes in process `syz.4.3813'. [ 559.428937][T19273] netlink: 'syz.1.3819': attribute type 1 has an invalid length. [ 559.464125][T19273] FAULT_INJECTION: forcing a failure. [ 559.464125][T19273] name failslab, interval 1, probability 0, space 0, times 0 [ 559.487775][T19273] CPU: 0 UID: 0 PID: 19273 Comm: syz.1.3819 Not tainted syzkaller #0 PREEMPT(full) [ 559.487806][T19273] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 559.487818][T19273] Call Trace: [ 559.487826][T19273] [ 559.487836][T19273] dump_stack_lvl+0xe8/0x150 [ 559.487872][T19273] should_fail_ex+0x40c/0x560 [ 559.487907][T19273] should_failslab+0xa8/0x100 [ 559.487938][T19273] __kmalloc_cache_noprof+0xa8/0x660 [ 559.487963][T19273] ? __pfx___mutex_trylock_common+0x10/0x10 [ 559.487985][T19273] ? flow_indr_dev_setup_offload+0x252/0x670 [ 559.488070][T19273] ? flow_indr_dev_setup_offload+0x252/0x670 [ 559.488102][T19273] flow_indr_dev_setup_offload+0x252/0x670 [ 559.488129][T19273] ? __pfx_tc_block_indr_cleanup+0x10/0x10 [ 559.488160][T19273] tcf_block_offload_cmd+0x288/0x3b0 [ 559.488195][T19273] ? __pfx_tcf_block_offload_cmd+0x10/0x10 [ 559.488239][T19273] ? __pfx_down_write+0x10/0x10 [ 559.488294][T19273] ? __kmalloc_cache_noprof+0x150/0x660 [ 559.488317][T19273] ? tcf_block_get_ext+0x6e7/0x17d0 [ 559.488338][T19273] ? tcf_block_get_ext+0x6e7/0x17d0 [ 559.488368][T19273] tcf_block_get_ext+0xfe0/0x17d0 [ 559.488441][T19273] tcf_block_get+0x67/0xa0 [ 559.488465][T19273] ? __pfx_tcf_chain_head_change_dflt+0x10/0x10 [ 559.488496][T19273] multiq_init+0x72/0x2b0 [ 559.488524][T19273] ? __pfx_multiq_init+0x10/0x10 [ 559.488546][T19273] qdisc_create+0x7b5/0xf00 [ 559.488568][T19273] ? lockdep_rtnl_is_held+0x26/0x40 [ 559.488603][T19273] tc_modify_qdisc+0x17af/0x2390 [ 559.488647][T19273] ? __pfx_tc_modify_qdisc+0x10/0x10 [ 559.488668][T19273] ? __dev_queue_xmit+0x29b/0x37f0 [ 559.488729][T19273] ? __pfx_tc_modify_qdisc+0x10/0x10 [ 559.488749][T19273] rtnetlink_rcv_msg+0x7b9/0xc00 [ 559.488777][T19273] ? rtnetlink_rcv_msg+0x1c9/0xc00 [ 559.488800][T19273] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 559.488820][T19273] ? ref_tracker_free+0x689/0x830 [ 559.488845][T19273] ? __pfx_ref_tracker_free+0x10/0x10 [ 559.488879][T19273] netlink_rcv_skb+0x226/0x4a0 [ 559.488908][T19273] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 559.488933][T19273] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 559.488981][T19273] ? netlink_deliver_tap+0x2e/0x1b0 [ 559.489007][T19273] ? netlink_deliver_tap+0x2e/0x1b0 [ 559.489040][T19273] netlink_unicast+0x7bb/0x940 [ 559.489078][T19273] netlink_sendmsg+0x813/0xb40 [ 559.489118][T19273] ? __pfx_netlink_sendmsg+0x10/0x10 [ 559.489150][T19273] ? aa_sock_msg_perm+0xf1/0x1b0 [ 559.489187][T19273] ? __pfx_netlink_sendmsg+0x10/0x10 [ 559.489220][T19273] sock_sendmsg_nosec+0x13a/0x180 [ 559.489257][T19273] ____sys_sendmsg+0x54e/0x850 [ 559.489290][T19273] ? __pfx_____sys_sendmsg+0x10/0x10 [ 559.489325][T19273] ? import_iovec+0x73/0xa0 [ 559.489355][T19273] ___sys_sendmsg+0x2a5/0x360 [ 559.489380][T19273] ? __lock_acquire+0x683/0x2cf0 [ 559.489413][T19273] ? __pfx____sys_sendmsg+0x10/0x10 [ 559.489485][T19273] ? __fget_files+0x2a/0x420 [ 559.489510][T19273] ? __fget_files+0x3a2/0x420 [ 559.489549][T19273] __x64_sys_sendmsg+0x1b1/0x290 [ 559.489579][T19273] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 559.489629][T19273] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 559.489652][T19273] do_syscall_64+0x174/0x580 [ 559.489676][T19273] ? clear_bhb_loop+0x40/0x90 [ 559.489702][T19273] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 559.489722][T19273] RIP: 0033:0x7f2b3af9de59 [ 559.489742][T19273] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 559.489760][T19273] RSP: 002b:00007f2b3be76028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 559.489784][T19273] RAX: ffffffffffffffda RBX: 00007f2b3b225fa0 RCX: 00007f2b3af9de59 [ 559.489799][T19273] RDX: 0000000000000000 RSI: 00002000000012c0 RDI: 0000000000000004 [ 559.489812][T19273] RBP: 00007f2b3be76090 R08: 0000000000000000 R09: 0000000000000000 [ 559.489825][T19273] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 559.489837][T19273] R13: 00007f2b3b226038 R14: 00007f2b3b225fa0 R15: 00007ffea2bdb2a8 [ 559.489873][T19273] [ 560.029753][T19276] netlink: 27 bytes leftover after parsing attributes in process `syz.4.3818'. [ 560.103856][T19285] netlink: 108 bytes leftover after parsing attributes in process `syz.0.3822'. [ 560.203895][T19289] syzkaller0: entered promiscuous mode [ 560.209952][T19289] syzkaller0: entered allmulticast mode [ 560.528220][T19308] net_ratelimit: 69 callbacks suppressed [ 560.528241][T19308] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 560.587569][T19314] netlink: 768 bytes leftover after parsing attributes in process `syz.3.3829'. [ 560.939301][T19328] netdevsim netdevsim2: Direct firmware load for .. failed with error -2 [ 560.957648][T19328] netdevsim netdevsim2: Falling back to sysfs fallback for: .. [ 561.031176][T19331] netlink: 'syz.4.3834': attribute type 1 has an invalid length. [ 561.055168][T19331] FAULT_INJECTION: forcing a failure. [ 561.055168][T19331] name failslab, interval 1, probability 0, space 0, times 0 [ 561.082695][T19331] CPU: 1 UID: 0 PID: 19331 Comm: syz.4.3834 Not tainted syzkaller #0 PREEMPT(full) [ 561.082725][T19331] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 561.082737][T19331] Call Trace: [ 561.082745][T19331] [ 561.082754][T19331] dump_stack_lvl+0xe8/0x150 [ 561.082793][T19331] should_fail_ex+0x40c/0x560 [ 561.082830][T19331] should_failslab+0xa8/0x100 [ 561.082863][T19331] __kmalloc_noprof+0xfe/0x720 [ 561.082890][T19331] ? multiq_init+0x149/0x2b0 [ 561.082910][T19331] ? multiq_init+0x149/0x2b0 [ 561.082933][T19331] ? __pfx_tcf_chain_head_change_dflt+0x10/0x10 [ 561.082963][T19331] multiq_init+0x149/0x2b0 [ 561.082990][T19331] ? __pfx_multiq_init+0x10/0x10 [ 561.083012][T19331] qdisc_create+0x7b5/0xf00 [ 561.083034][T19331] ? lockdep_rtnl_is_held+0x26/0x40 [ 561.083067][T19331] tc_modify_qdisc+0x17af/0x2390 [ 561.083104][T19331] ? __pfx_tc_modify_qdisc+0x10/0x10 [ 561.083126][T19331] ? __dev_queue_xmit+0x29b/0x37f0 [ 561.083185][T19331] ? __pfx_tc_modify_qdisc+0x10/0x10 [ 561.083203][T19331] rtnetlink_rcv_msg+0x7b9/0xc00 [ 561.083230][T19331] ? rtnetlink_rcv_msg+0x1c9/0xc00 [ 561.083252][T19331] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 561.083272][T19331] ? ref_tracker_free+0x689/0x830 [ 561.083296][T19331] ? __pfx_ref_tracker_free+0x10/0x10 [ 561.083329][T19331] netlink_rcv_skb+0x226/0x4a0 [ 561.083358][T19331] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 561.083383][T19331] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 561.083425][T19331] ? netlink_deliver_tap+0x2e/0x1b0 [ 561.083450][T19331] ? netlink_deliver_tap+0x2e/0x1b0 [ 561.083483][T19331] netlink_unicast+0x7bb/0x940 [ 561.083520][T19331] netlink_sendmsg+0x813/0xb40 [ 561.083559][T19331] ? __pfx_netlink_sendmsg+0x10/0x10 [ 561.083591][T19331] ? aa_sock_msg_perm+0xf1/0x1b0 [ 561.083625][T19331] ? __pfx_netlink_sendmsg+0x10/0x10 [ 561.083649][T19331] sock_sendmsg_nosec+0x13a/0x180 [ 561.083694][T19331] ____sys_sendmsg+0x54e/0x850 [ 561.083727][T19331] ? __pfx_____sys_sendmsg+0x10/0x10 [ 561.083764][T19331] ? import_iovec+0x73/0xa0 [ 561.083794][T19331] ___sys_sendmsg+0x2a5/0x360 [ 561.083817][T19331] ? __lock_acquire+0x683/0x2cf0 [ 561.083849][T19331] ? __pfx____sys_sendmsg+0x10/0x10 [ 561.083917][T19331] ? __fget_files+0x2a/0x420 [ 561.083942][T19331] ? __fget_files+0x3a2/0x420 [ 561.083981][T19331] __x64_sys_sendmsg+0x1b1/0x290 [ 561.084011][T19331] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 561.084059][T19331] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 561.084082][T19331] do_syscall_64+0x174/0x580 [ 561.084104][T19331] ? trace_irq_disable+0x3b/0x140 [ 561.084131][T19331] ? clear_bhb_loop+0x40/0x90 [ 561.084157][T19331] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 561.084178][T19331] RIP: 0033:0x7fcdcbb9de59 [ 561.084198][T19331] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 561.084215][T19331] RSP: 002b:00007fcdcca38028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 561.084238][T19331] RAX: ffffffffffffffda RBX: 00007fcdcbe25fa0 RCX: 00007fcdcbb9de59 [ 561.084252][T19331] RDX: 0000000000000000 RSI: 00002000000012c0 RDI: 0000000000000004 [ 561.084265][T19331] RBP: 00007fcdcca38090 R08: 0000000000000000 R09: 0000000000000000 [ 561.084277][T19331] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 561.084289][T19331] R13: 00007fcdcbe26038 R14: 00007fcdcbe25fa0 R15: 00007ffcd20d2138 [ 561.084325][T19331] [ 561.548013][T19314] vxcan1 speed is unknown, defaulting to 1000 [ 561.648432][T19347] netlink: 'syz.0.3836': attribute type 1 has an invalid length. [ 561.724963][T19351] netlink: 56 bytes leftover after parsing attributes in process `syz.1.3838'. [ 561.737565][T19351] netlink: 12 bytes leftover after parsing attributes in process `syz.1.3838'. [ 561.752803][T19351] netlink: 31 bytes leftover after parsing attributes in process `syz.1.3838'. [ 561.764194][T19351] netlink: 'syz.1.3838': attribute type 2 has an invalid length. [ 561.785744][T19351] netlink: 31 bytes leftover after parsing attributes in process `syz.1.3838'. [ 561.887471][T19357] syzkaller0: entered promiscuous mode [ 561.903734][T19357] syzkaller0: entered allmulticast mode [ 562.592945][T19386] netlink: 'syz.2.3847': attribute type 1 has an invalid length. [ 562.602269][T19392] FAULT_INJECTION: forcing a failure. [ 562.602269][T19392] name failslab, interval 1, probability 0, space 0, times 0 [ 562.602485][T19391] netlink: 40 bytes leftover after parsing attributes in process `syz.1.3850'. [ 562.622106][T19392] CPU: 1 UID: 0 PID: 19392 Comm: syz.2.3847 Not tainted syzkaller #0 PREEMPT(full) [ 562.622132][T19392] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 562.622144][T19392] Call Trace: [ 562.622151][T19392] [ 562.622159][T19392] dump_stack_lvl+0xe8/0x150 [ 562.622201][T19392] should_fail_ex+0x40c/0x560 [ 562.622233][T19392] should_failslab+0xa8/0x100 [ 562.622260][T19392] __kmalloc_node_noprof+0x105/0x740 [ 562.622284][T19392] ? qdisc_alloc+0x92/0x9d0 [ 562.622304][T19392] ? qdisc_alloc+0x92/0x9d0 [ 562.622331][T19392] qdisc_alloc+0x92/0x9d0 [ 562.622359][T19392] qdisc_create_dflt+0x8e/0x4e0 [ 562.622384][T19392] multiq_tune+0x81c/0x1030 [ 562.622417][T19392] ? __pfx_multiq_tune+0x10/0x10 [ 562.622434][T19392] ? __kmalloc_noprof+0x396/0x720 [ 562.622456][T19392] ? __kmalloc_noprof+0x1ad/0x720 [ 562.622476][T19392] ? multiq_init+0x149/0x2b0 [ 562.622493][T19392] ? multiq_init+0x149/0x2b0 [ 562.622519][T19392] ? multiq_init+0x212/0x2b0 [ 562.622542][T19392] ? __pfx_multiq_init+0x10/0x10 [ 562.622567][T19392] qdisc_create+0x7b5/0xf00 [ 562.622587][T19392] ? lockdep_rtnl_is_held+0x26/0x40 [ 562.622616][T19392] tc_modify_qdisc+0x17af/0x2390 [ 562.622648][T19392] ? __pfx_tc_modify_qdisc+0x10/0x10 [ 562.622696][T19392] ? __pfx_tc_modify_qdisc+0x10/0x10 [ 562.622713][T19392] rtnetlink_rcv_msg+0x7b9/0xc00 [ 562.622733][T19392] ? netlink_sendmsg+0x5d4/0xb40 [ 562.622760][T19392] ? rtnetlink_rcv_msg+0x1c9/0xc00 [ 562.622780][T19392] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 562.622801][T19392] ? __lock_acquire+0x683/0x2cf0 [ 562.622838][T19392] netlink_rcv_skb+0x226/0x4a0 [ 562.622862][T19392] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 562.622889][T19392] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 562.622925][T19392] ? netlink_deliver_tap+0x2e/0x1b0 [ 562.622947][T19392] ? netlink_deliver_tap+0x2e/0x1b0 [ 562.622975][T19392] netlink_unicast+0x7bb/0x940 [ 562.623007][T19392] netlink_sendmsg+0x813/0xb40 [ 562.623041][T19392] ? __pfx_netlink_sendmsg+0x10/0x10 [ 562.623069][T19392] ? aa_sock_msg_perm+0xf1/0x1b0 [ 562.623099][T19392] ? __pfx_netlink_sendmsg+0x10/0x10 [ 562.623121][T19392] sock_sendmsg_nosec+0x13a/0x180 [ 562.623151][T19392] ____sys_sendmsg+0x54e/0x850 [ 562.623187][T19392] ? __pfx_____sys_sendmsg+0x10/0x10 [ 562.623219][T19392] ? import_iovec+0x73/0xa0 [ 562.623245][T19392] ___sys_sendmsg+0x2a5/0x360 [ 562.623266][T19392] ? __lock_acquire+0x683/0x2cf0 [ 562.623294][T19392] ? __pfx____sys_sendmsg+0x10/0x10 [ 562.623353][T19392] ? __fget_files+0x2a/0x420 [ 562.623376][T19392] ? __fget_files+0x3a2/0x420 [ 562.623409][T19392] __x64_sys_sendmsg+0x1b1/0x290 [ 562.623435][T19392] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 562.623476][T19392] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 562.623497][T19392] do_syscall_64+0x174/0x580 [ 562.623516][T19392] ? trace_irq_disable+0x3b/0x140 [ 562.623540][T19392] ? clear_bhb_loop+0x40/0x90 [ 562.623562][T19392] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 562.623580][T19392] RIP: 0033:0x7f3415d9de59 [ 562.623599][T19392] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 562.623613][T19392] RSP: 002b:00007f3413ff6028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 562.623634][T19392] RAX: ffffffffffffffda RBX: 00007f3416026180 RCX: 00007f3415d9de59 [ 562.623647][T19392] RDX: 0000000000000000 RSI: 00002000000012c0 RDI: 0000000000000004 [ 562.623658][T19392] RBP: 00007f3413ff6090 R08: 0000000000000000 R09: 0000000000000000 [ 562.623669][T19392] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 562.623680][T19392] R13: 00007f3416026218 R14: 00007f3416026180 R15: 00007ffd0cc56288 [ 562.623710][T19392] [ 563.860296][T19428] syzkaller0: entered promiscuous mode [ 563.893915][T19428] syzkaller0: entered allmulticast mode [ 564.000162][T19435] netlink: 'syz.4.3859': attribute type 13 has an invalid length. [ 564.013234][T19435] netlink: 'syz.4.3859': attribute type 58 has an invalid length. [ 564.404683][T19450] __nla_validate_parse: 3 callbacks suppressed [ 564.404706][T19450] netlink: 8 bytes leftover after parsing attributes in process `syz.2.3864'. [ 564.449308][T19450] netlink: 12 bytes leftover after parsing attributes in process `syz.2.3864'. [ 564.503332][T19450] netlink: 8 bytes leftover after parsing attributes in process `syz.2.3864'. [ 564.517454][ T65] netdevsim netdevsim2 netdevsim0: set [0, 0] type 1 family 0 port 8472 - 0 [ 564.533006][T19450] netlink: 12 bytes leftover after parsing attributes in process `syz.2.3864'. [ 564.551872][ T65] netdevsim netdevsim2 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0 [ 564.582391][T19460] netlink: 'syz.4.3866': attribute type 1 has an invalid length. [ 564.616272][ T3331] netdevsim netdevsim2 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0 [ 564.644123][T19460] FAULT_INJECTION: forcing a failure. [ 564.644123][T19460] name failslab, interval 1, probability 0, space 0, times 0 [ 564.684556][T19460] CPU: 0 UID: 0 PID: 19460 Comm: syz.4.3866 Not tainted syzkaller #0 PREEMPT(full) [ 564.684585][T19460] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 564.684597][T19460] Call Trace: [ 564.684606][T19460] [ 564.684615][T19460] dump_stack_lvl+0xe8/0x150 [ 564.684653][T19460] should_fail_ex+0x40c/0x560 [ 564.684689][T19460] should_failslab+0xa8/0x100 [ 564.684720][T19460] __kmalloc_node_noprof+0x105/0x740 [ 564.684748][T19460] ? qdisc_alloc+0x92/0x9d0 [ 564.684769][T19460] ? qdisc_alloc+0x92/0x9d0 [ 564.684799][T19460] qdisc_alloc+0x92/0x9d0 [ 564.684831][T19460] qdisc_create_dflt+0x8e/0x4e0 [ 564.684861][T19460] multiq_tune+0x81c/0x1030 [ 564.684896][T19460] ? __pfx_multiq_tune+0x10/0x10 [ 564.684914][T19460] ? __kmalloc_noprof+0x396/0x720 [ 564.684937][T19460] ? __kmalloc_noprof+0x1ad/0x720 [ 564.684958][T19460] ? multiq_init+0x149/0x2b0 [ 564.684977][T19460] ? multiq_init+0x149/0x2b0 [ 564.685006][T19460] ? multiq_init+0x212/0x2b0 [ 564.685032][T19460] ? __pfx_multiq_init+0x10/0x10 [ 564.685054][T19460] qdisc_create+0x7b5/0xf00 [ 564.685076][T19460] ? lockdep_rtnl_is_held+0x26/0x40 [ 564.685110][T19460] tc_modify_qdisc+0x17af/0x2390 [ 564.685146][T19460] ? __pfx_tc_modify_qdisc+0x10/0x10 [ 564.685168][T19460] ? __dev_queue_xmit+0x29b/0x37f0 [ 564.685240][T19460] ? __pfx_tc_modify_qdisc+0x10/0x10 [ 564.685259][T19460] rtnetlink_rcv_msg+0x7b9/0xc00 [ 564.685288][T19460] ? rtnetlink_rcv_msg+0x1c9/0xc00 [ 564.685309][T19460] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 564.685329][T19460] ? ref_tracker_free+0x689/0x830 [ 564.685352][T19460] ? __pfx_ref_tracker_free+0x10/0x10 [ 564.685386][T19460] netlink_rcv_skb+0x226/0x4a0 [ 564.685413][T19460] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 564.685438][T19460] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 564.685479][T19460] ? netlink_deliver_tap+0x2e/0x1b0 [ 564.685504][T19460] ? netlink_deliver_tap+0x2e/0x1b0 [ 564.685536][T19460] netlink_unicast+0x7bb/0x940 [ 564.685573][T19460] netlink_sendmsg+0x813/0xb40 [ 564.685611][T19460] ? __pfx_netlink_sendmsg+0x10/0x10 [ 564.685641][T19460] ? aa_sock_msg_perm+0xf1/0x1b0 [ 564.685674][T19460] ? __pfx_netlink_sendmsg+0x10/0x10 [ 564.685699][T19460] sock_sendmsg_nosec+0x13a/0x180 [ 564.685732][T19460] ____sys_sendmsg+0x54e/0x850 [ 564.685765][T19460] ? __pfx_____sys_sendmsg+0x10/0x10 [ 564.685799][T19460] ? import_iovec+0x73/0xa0 [ 564.685827][T19460] ___sys_sendmsg+0x2a5/0x360 [ 564.685849][T19460] ? __lock_acquire+0x683/0x2cf0 [ 564.685880][T19460] ? __pfx____sys_sendmsg+0x10/0x10 [ 564.685943][T19460] ? __fget_files+0x2a/0x420 [ 564.685968][T19460] ? __fget_files+0x3a2/0x420 [ 564.686002][T19460] __x64_sys_sendmsg+0x1b1/0x290 [ 564.686032][T19460] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 564.686080][T19460] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 564.686103][T19460] do_syscall_64+0x174/0x580 [ 564.686125][T19460] ? trace_irq_disable+0x3b/0x140 [ 564.686150][T19460] ? clear_bhb_loop+0x40/0x90 [ 564.686176][T19460] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 564.686196][T19460] RIP: 0033:0x7fcdcbb9de59 [ 564.686225][T19460] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 564.686243][T19460] RSP: 002b:00007fcdcca38028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 564.686265][T19460] RAX: ffffffffffffffda RBX: 00007fcdcbe25fa0 RCX: 00007fcdcbb9de59 [ 564.686280][T19460] RDX: 0000000000000000 RSI: 00002000000012c0 RDI: 0000000000000004 [ 564.686293][T19460] RBP: 00007fcdcca38090 R08: 0000000000000000 R09: 0000000000000000 [ 564.686306][T19460] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 564.686318][T19460] R13: 00007fcdcbe26038 R14: 00007fcdcbe25fa0 R15: 00007ffcd20d2138 [ 564.686353][T19460] [ 565.248013][ T48] netdevsim netdevsim2 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0 [ 565.328890][T19474] IPVS: length: 46 != 8 [ 565.378174][T19474] netlink: 'syz.2.3869': attribute type 10 has an invalid length. [ 565.393414][T19474] 8021q: adding VLAN 0 to HW filter on device team0 [ 565.404360][T19474] bond0: (slave team0): Enslaving as an active interface with an up link [ 565.943238][T19514] netlink: 'syz.2.3883': attribute type 1 has an invalid length. [ 565.991934][T19514] FAULT_INJECTION: forcing a failure. [ 565.991934][T19514] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 566.021825][T19514] CPU: 0 UID: 0 PID: 19514 Comm: syz.2.3883 Not tainted syzkaller #0 PREEMPT(full) [ 566.021857][T19514] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 566.021868][T19514] Call Trace: [ 566.021877][T19514] [ 566.021886][T19514] dump_stack_lvl+0xe8/0x150 [ 566.021924][T19514] should_fail_ex+0x40c/0x560 [ 566.021963][T19514] _copy_from_user+0x2d/0xb0 [ 566.021989][T19514] kstrtouint_from_user+0xd6/0x180 [ 566.022024][T19514] ? __pfx_kstrtouint_from_user+0x10/0x10 [ 566.022070][T19514] proc_fail_nth_write+0x8e/0x210 [ 566.022130][T19514] ? __pfx_proc_fail_nth_write+0x10/0x10 [ 566.022165][T19514] ? __pfx_proc_fail_nth_write+0x10/0x10 [ 566.022192][T19514] vfs_write+0x296/0xba0 [ 566.022236][T19514] ? __pfx_vfs_write+0x10/0x10 [ 566.022267][T19514] ? __fget_files+0x2a/0x420 [ 566.022298][T19514] ? __fget_files+0x3a2/0x420 [ 566.022321][T19514] ? __fget_files+0x2a/0x420 [ 566.022355][T19514] ksys_write+0x150/0x270 [ 566.022394][T19514] ? __pfx_ksys_write+0x10/0x10 [ 566.022433][T19514] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 566.022457][T19514] do_syscall_64+0x174/0x580 [ 566.022478][T19514] ? trace_irq_disable+0x3b/0x140 [ 566.022504][T19514] ? clear_bhb_loop+0x40/0x90 [ 566.022530][T19514] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 566.022558][T19514] RIP: 0033:0x7f3415d5e68e [ 566.022578][T19514] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 566.022596][T19514] RSP: 002b:00007f3416ba8fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 566.022620][T19514] RAX: ffffffffffffffda RBX: 00007f3416ba96c0 RCX: 00007f3415d5e68e [ 566.022635][T19514] RDX: 0000000000000001 RSI: 00007f3416ba90a0 RDI: 000000000000000c [ 566.022657][T19514] RBP: 00007f3416ba9090 R08: 0000000000000000 R09: 0000000000000000 [ 566.022669][T19514] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 566.022679][T19514] R13: 00007f3416026038 R14: 00007f3416025fa0 R15: 00007ffd0cc56288 [ 566.022714][T19514] [ 566.363117][T19520] netlink: 'syz.0.3886': attribute type 4 has an invalid length. [ 566.602031][T19536] netlink: 72 bytes leftover after parsing attributes in process `syz.1.3891'. [ 566.814077][T19547] netlink: 'syz.3.3893': attribute type 9 has an invalid length. [ 567.092383][T19558] netlink: 12 bytes leftover after parsing attributes in process `syz.0.3897'. [ 567.132630][T19563] smc: ib device syz2 ibport 2 applied user defined pnetid SYZ2 [ 567.615136][T19579] netlink: 'syz.0.3904': attribute type 49 has an invalid length. [ 567.644935][T19583] netlink: 'syz.3.3906': attribute type 1 has an invalid length. [ 567.664633][T19584] netlink: 'syz.2.3905': attribute type 1 has an invalid length. [ 567.783803][T19590] netlink: 16 bytes leftover after parsing attributes in process `syz.0.3908'. [ 567.807228][T19594] netlink: 48 bytes leftover after parsing attributes in process `syz.1.3907'. [ 567.819081][T19583] bond2: entered promiscuous mode [ 567.824990][T19583] 8021q: adding VLAN 0 to HW filter on device bond2 [ 567.844313][T19587] macvtap1: entered allmulticast mode [ 567.868312][T19591] macvtap2: entered allmulticast mode [ 567.874639][T19541] vxcan1 speed is unknown, defaulting to 1000 [ 567.916562][T19587] netlink: 'syz.3.3906': attribute type 9 has an invalid length. [ 568.008044][T19583] bond2: (slave bridge2): making interface the new active one [ 568.016602][T19583] bridge2: entered promiscuous mode [ 568.038980][T19583] bond2: (slave bridge2): Enslaving as an active interface with an up link [ 568.054840][T19606] netlink: 8 bytes leftover after parsing attributes in process `syz.2.3909'. [ 568.198491][T19606] batman_adv: Cannot find parent device. Skipping batadv-on-batadv check for gretap1 [ 568.229363][T19606] gretap1: default qdisc (pfifo_fast) fail, fallback to noqueue [ 568.244585][T19606] gretap1: entered promiscuous mode [ 568.269230][T19606] gretap1: entered allmulticast mode [ 568.433040][T19610] bridge_slave_0: Caught tx_queue_len zero misconfig [ 568.447876][T19613] ipvlan1: Caught tx_queue_len zero misconfig [ 569.060908][T19644] netlink: 4 bytes leftover after parsing attributes in process `syz.0.3917'. [ 569.290464][T19649] netlink: 'syz.3.3918': attribute type 15 has an invalid length. [ 569.574351][T19664] __nla_validate_parse: 2 callbacks suppressed [ 569.574372][T19664] netlink: 12 bytes leftover after parsing attributes in process `syz.1.3922'. [ 569.646502][T19666] netlink: 12 bytes leftover after parsing attributes in process `syz.1.3922'. [ 569.661470][T19667] syzkaller1: entered promiscuous mode [ 569.698700][T19667] syzkaller1: entered allmulticast mode [ 570.080389][T19679] syzkaller0: entered promiscuous mode [ 570.107332][T19679] syzkaller0: entered allmulticast mode [ 570.365203][T19693] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 570.560561][T19704] netlink: 'syz.3.3930': attribute type 1 has an invalid length. [ 570.592822][T19704] netlink: 'syz.3.3930': attribute type 2 has an invalid length. [ 570.692316][T19708] syzkaller0: entered promiscuous mode [ 570.698284][T19708] syzkaller0: entered allmulticast mode [ 570.797663][T19711] netlink: 76 bytes leftover after parsing attributes in process `syz.3.3934'. [ 571.011469][T19718] netlink: 3 bytes leftover after parsing attributes in process `syz.3.3936'. [ 571.024595][T19718] netlink: 'syz.3.3936': attribute type 1 has an invalid length. [ 571.432382][T19749] netlink: 'syz.4.3943': attribute type 32 has an invalid length. [ 571.659454][T19758] netlink: 4 bytes leftover after parsing attributes in process `syz.2.3945'. [ 571.711648][T19766] batman_adv: Cannot find parent device. Skipping batadv-on-batadv check for gretap1 [ 571.723133][T19766] gretap1: default qdisc (pfifo_fast) fail, fallback to noqueue [ 571.733233][T19766] gretap1: entered promiscuous mode [ 571.738683][T19766] gretap1: entered allmulticast mode [ 571.859897][T19780] virt_wifi0: entered allmulticast mode [ 571.959638][T19787] sock: sock_timestamping_bind_phc: sock not bind to device [ 572.299942][T19801] hsr0: A HSR master's MTU cannot be greater than the smallest MTU of its slaves minus the HSR Tag length (6 octets). [ 572.408459][T19806] netlink: 24 bytes leftover after parsing attributes in process `syz.0.3957'. [ 572.573321][T19814] syzkaller1: entered promiscuous mode [ 572.580668][T19814] syzkaller1: entered allmulticast mode [ 572.906688][T19828] netlink: 24 bytes leftover after parsing attributes in process `syz.3.3965'. [ 572.930999][T19823] netlink: 4 bytes leftover after parsing attributes in process `syz.3.3965'. [ 573.236903][T19848] netlink: 'syz.1.3975': attribute type 23 has an invalid length. [ 573.564710][T19867] netlink: 48 bytes leftover after parsing attributes in process `syz.1.3981'. [ 573.654789][T19868] syzkaller0: entered promiscuous mode [ 573.666672][T19868] syzkaller0: entered allmulticast mode [ 573.679722][T19868] netlink: 'syz.3.3980': attribute type 1 has an invalid length. [ 573.688131][T19868] netlink: 'syz.3.3980': attribute type 11 has an invalid length. [ 573.709674][T19874] netlink: 'syz.2.3983': attribute type 1 has an invalid length. [ 573.718730][T19868] netlink: 224 bytes leftover after parsing attributes in process `syz.3.3980'. [ 573.768628][T19874] 8021q: adding VLAN 0 to HW filter on device bond3 [ 574.172668][T19893] geneve2: entered promiscuous mode [ 574.196066][T19893] netlink: 'syz.4.3989': attribute type 1 has an invalid length. [ 574.242230][T19895] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 574.293445][T19897] netlink: 'syz.2.3990': attribute type 1 has an invalid length. [ 574.439834][T19902] vlan4: entered allmulticast mode [ 574.672064][T19915] smc: net device vlan1 applied user defined pnetid SYZ2 [ 574.699629][T19916] openvswitch: netlink: Unexpected mask (mask=8000, allowed=10048) [ 574.712303][T19913] netlink: 'syz.3.3996': attribute type 1 has an invalid length. [ 574.776693][T19913] ip6tnl0: Caught tx_queue_len zero misconfig [ 574.877912][T19919] Bluetooth: hci0: Opcode 0x0c03 failed: -4 [ 575.021327][T19940] __nla_validate_parse: 5 callbacks suppressed [ 575.021349][T19940] netlink: 27 bytes leftover after parsing attributes in process `syz.1.4002'. [ 575.222492][T19952] netlink: 'syz.3.4008': attribute type 2 has an invalid length. [ 575.380992][T19950] hsr0: entered allmulticast mode [ 575.387162][T19950] hsr_slave_0: entered allmulticast mode [ 575.393376][T19950] hsr_slave_1: entered allmulticast mode [ 575.416730][T19952] : entered promiscuous mode [ 575.451478][T19957] netlink: 'syz.1.4010': attribute type 1 has an invalid length. [ 575.543059][T19960] netlink: 8 bytes leftover after parsing attributes in process `syz.3.4011'. [ 575.784625][T19974] batman_adv: Cannot find parent device. Skipping batadv-on-batadv check for gretap3 [ 575.809896][T19974] batman_adv: batadv0: Adding interface: gretap3 [ 575.846751][T19974] batman_adv: batadv0: The MTU of interface gretap3 is too small (1462) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 575.927908][T19974] batman_adv: batadv0: Interface activated: gretap3 [ 576.623844][T20024] validate_nla: 4 callbacks suppressed [ 576.623864][T20024] netlink: 'syz.4.4031': attribute type 1 has an invalid length. [ 576.743970][T20024] workqueue: Failed to create a rescuer kthread for wq "bond1": -EINTR [ 576.805005][T20032] netlink: 12 bytes leftover after parsing attributes in process `syz.0.4034'. [ 576.866496][T20034] netlink: 132 bytes leftover after parsing attributes in process `syz.3.4035'. [ 577.080701][T20046] netlink: 404 bytes leftover after parsing attributes in process `syz.2.4039'. [ 577.101611][T20046] netlink: 28 bytes leftover after parsing attributes in process `syz.2.4039'. [ 577.112756][T20046] netlink: 28 bytes leftover after parsing attributes in process `syz.2.4039'. [ 577.126191][T20046] netlink: 20 bytes leftover after parsing attributes in process `syz.2.4039'. [ 577.327765][T20072] netlink: 40 bytes leftover after parsing attributes in process `syz.3.4044'. [ 577.544124][T20077] netlink: 12 bytes leftover after parsing attributes in process `syz.2.4046'. [ 577.677677][T20099] netlink: 'syz.4.4051': attribute type 1 has an invalid length. [ 577.883294][T20103] 8021q: adding VLAN 0 to HW filter on device bond2 [ 577.894648][T20103] bond1: (slave bond2): making interface the new active one [ 577.904099][T20103] bond1: (slave bond2): Enslaving as an active interface with an up link [ 577.933872][T20110] openvswitch: netlink: IPv6 tunnel dst address is zero [ 577.941177][T20106] bond1: (slave gretap2): Enslaving as a backup interface with an up link [ 577.970451][T20099] 8021q: adding VLAN 0 to HW filter on device bond1 [ 578.317050][T20128] netlink: 'syz.0.4062': attribute type 2 has an invalid length. [ 578.375313][T20126] netlink: 'syz.4.4060': attribute type 66 has an invalid length. [ 578.631628][T20150] bond0: (slave ip6gre0): Error: Device can not be enslaved while up [ 578.791738][T20156] netlink: 'syz.4.4070': attribute type 10 has an invalid length. [ 578.949371][T20139] nbd4: detected capacity change from 0 to 63 [ 578.979675][ T5633] block nbd4: Receive control failed (result -104) [ 578.981420][T18139] block nbd4: Receive control failed (result -32) [ 579.213829][T20176] IPVS: set_ctl: invalid protocol: 108 224.0.0.1:20002 [ 579.370020][T20180] netdevsim netdevsim4: Firmware load for '..' refused, path contains '..' component [ 579.594882][T20194] netlink: 'syz.4.4081': attribute type 83 has an invalid length. [ 579.801710][T20203] x_tables: arp_tables: NFQUEUE target: not valid for this family [ 579.885530][T20211] hsr_slave_0: hsr_addr_subst_dest: Unknown node [ 579.895240][T20211] hsr_slave_1: hsr_addr_subst_dest: Unknown node [ 579.942392][T20211] hsr_slave_0: left promiscuous mode [ 579.960169][T20211] hsr_slave_1: left promiscuous mode [ 580.021887][T20218] syzkaller0: entered promiscuous mode [ 580.034107][T20218] syzkaller0: entered allmulticast mode [ 580.160971][T20232] __nla_validate_parse: 10 callbacks suppressed [ 580.160993][T20232] netlink: 80 bytes leftover after parsing attributes in process `syz.4.4094'. [ 580.183815][T20230] veth0_to_team: Caught tx_queue_len zero misconfig [ 580.195097][T20230] netlink: 'syz.3.4095': attribute type 1 has an invalid length. [ 580.650304][T20251] bridge1: the hash_elasticity option has been deprecated and is always 16 [ 580.669319][T20256] netlink: 'syz.1.4104': attribute type 4 has an invalid length. [ 580.684004][T20260] netlink: 8 bytes leftover after parsing attributes in process `syz.0.4103'. [ 580.696009][T20256] netlink: 17 bytes leftover after parsing attributes in process `syz.1.4104'. [ 580.716871][T20256] netlink: 14601 bytes leftover after parsing attributes in process `syz.1.4104'. [ 581.545488][T20314] netlink: 'syz.4.4114': attribute type 1 has an invalid length. [ 581.849412][T20336] netlink: 8 bytes leftover after parsing attributes in process `syz.2.4118'. [ 581.866243][T20336] netlink: 'syz.2.4118': attribute type 10 has an invalid length. [ 581.874222][T20336] netlink: 12 bytes leftover after parsing attributes in process `syz.2.4118'. [ 581.912879][T20314] 8021q: adding VLAN 0 to HW filter on device bond3 [ 581.953733][T20064] netdevsim netdevsim2 netdevsim0: unset [0, 0] type 1 family 0 port 8472 - 0 [ 581.990705][T20064] netdevsim netdevsim2 netdevsim0: unset [1, 1] type 2 family 0 port 19977 - 0 [ 582.059532][T20319] bond3: (slave gretap3): making interface the new active one [ 582.101888][T20319] bond3: (slave gretap3): Enslaving as an active interface with an up link [ 582.162668][T20350] netlink: 28 bytes leftover after parsing attributes in process `syz.3.4120'. [ 582.166498][T20336] geneve3: entered promiscuous mode [ 582.228292][T20336] geneve3: entered allmulticast mode [ 582.238086][T20064] netdevsim netdevsim2 netdevsim1: unset [0, 0] type 1 family 0 port 8472 - 0 [ 582.266592][T20064] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 582.276246][T20352] netlink: 68 bytes leftover after parsing attributes in process `syz.4.4121'. [ 582.283458][T20064] netdevsim netdevsim2 netdevsim1: unset [1, 1] type 2 family 0 port 19977 - 0 [ 582.311210][T20064] netdevsim netdevsim2 netdevsim2: unset [0, 0] type 1 family 0 port 8472 - 0 [ 582.330095][T20064] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 582.365983][T20064] netdevsim netdevsim2 netdevsim2: unset [1, 1] type 2 family 0 port 19977 - 0 [ 582.393457][T20064] netdevsim netdevsim2 netdevsim3: unset [0, 0] type 1 family 0 port 8472 - 0 [ 582.411461][T20064] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 582.422944][T20064] netdevsim netdevsim2 netdevsim3: unset [1, 1] type 2 family 0 port 19977 - 0 [ 582.440714][T20064] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 582.554129][T20367] netlink: 32 bytes leftover after parsing attributes in process `syz.1.4124'. [ 582.564581][T20367] netlink: 12 bytes leftover after parsing attributes in process `syz.1.4124'. [ 582.613027][T20359] 8021q: adding VLAN 0 to HW filter on device bond4 [ 582.647732][T20365] gre0: Master is either lo or non-ether device [ 583.528881][T20392] syzkaller0: entered promiscuous mode [ 583.543624][T20392] syzkaller0: entered allmulticast mode [ 586.408708][T20442] lo: Caught tx_queue_len zero misconfig [ 586.688800][T20455] netlink: 'syz.3.4142': attribute type 3 has an invalid length. [ 586.724206][T20455] netlink: 'syz.3.4142': attribute type 1 has an invalid length. [ 586.749764][T20455] netlink: 204 bytes leftover after parsing attributes in process `syz.3.4142'. [ 586.773176][T20455] Cannot find set identified by id 1 to match [ 586.863087][T20473] sctp: [Deprecated]: syz.0.4145 (pid 20473) Use of struct sctp_assoc_value in delayed_ack socket option. [ 586.863087][T20473] Use struct sctp_sack_info instead [ 587.321761][T20493] netdevsim netdevsim0: Direct firmware load for .. failed with error -2 [ 587.392785][T20493] netdevsim netdevsim0: Falling back to sysfs fallback for: .. [ 587.741147][T20506] syzkaller0: entered promiscuous mode [ 587.749611][T20506] syzkaller0: entered allmulticast mode [ 587.951290][T20511] bond6: Unable to set peer notification delay as MII monitoring is disabled [ 587.973573][T20511] bond6 (unregistering): Released all slaves [ 588.095182][T20520] netlink: 20 bytes leftover after parsing attributes in process `syz.4.4156'. [ 588.344881][T20530] : renamed from bond0 [ 588.560109][T20539] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 588.588107][T20539] netlink: 12 bytes leftover after parsing attributes in process `syz.2.4164'. [ 588.632052][T20545] FAULT_INJECTION: forcing a failure. [ 588.632052][T20545] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 588.675193][T20545] CPU: 0 UID: 0 PID: 20545 Comm: syz.0.4167 Not tainted syzkaller #0 PREEMPT(full) [ 588.675223][T20545] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 588.675236][T20545] Call Trace: [ 588.675244][T20545] [ 588.675254][T20545] dump_stack_lvl+0xe8/0x150 [ 588.675292][T20545] should_fail_ex+0x40c/0x560 [ 588.675338][T20545] _copy_from_iter+0x1d3/0x1660 [ 588.675360][T20545] ? kmem_cache_alloc_node_noprof+0x1b1/0x610 [ 588.675387][T20545] ? rcu_is_watching+0x15/0xb0 [ 588.675418][T20545] ? trace_kmem_cache_alloc+0x29/0xe0 [ 588.675446][T20545] ? kmem_cache_alloc_node_noprof+0x3b8/0x610 [ 588.675469][T20545] ? __pfx__copy_from_iter+0x10/0x10 [ 588.675490][T20545] ? __alloc_skb+0x276/0x7a0 [ 588.675511][T20545] ? __alloc_skb+0x276/0x7a0 [ 588.675540][T20545] ? netlink_sendmsg+0x650/0xb40 [ 588.675567][T20545] ? skb_put+0x112/0x210 [ 588.675594][T20545] netlink_sendmsg+0x6c0/0xb40 [ 588.675631][T20545] ? __pfx_netlink_sendmsg+0x10/0x10 [ 588.675662][T20545] ? aa_sock_msg_perm+0xf1/0x1b0 [ 588.675696][T20545] ? __pfx_netlink_sendmsg+0x10/0x10 [ 588.675719][T20545] sock_sendmsg_nosec+0x13a/0x180 [ 588.675752][T20545] __sys_sendto+0x408/0x5a0 [ 588.675786][T20545] ? __pfx___sys_sendto+0x10/0x10 [ 588.675836][T20545] ? do_user_addr_fault+0xc4a/0x1340 [ 588.675872][T20545] __x64_sys_sendto+0xde/0x100 [ 588.675896][T20545] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 588.675919][T20545] do_syscall_64+0x174/0x580 [ 588.675940][T20545] ? trace_irq_disable+0x3b/0x140 [ 588.675966][T20545] ? clear_bhb_loop+0x40/0x90 [ 588.675991][T20545] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 588.676010][T20545] RIP: 0033:0x7fcf64b5e68e [ 588.676031][T20545] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 588.676048][T20545] RSP: 002b:00007fcf65b33e88 EFLAGS: 00000246 ORIG_RAX: 000000000000002c [ 588.676071][T20545] RAX: ffffffffffffffda RBX: 00007fcf65b356c0 RCX: 00007fcf64b5e68e [ 588.676086][T20545] RDX: 0000000000000020 RSI: 00007fcf65b34000 RDI: 0000000000000003 [ 588.676099][T20545] RBP: 0000000000000000 R08: 00007fcf65b33f04 R09: 000000000000000c [ 588.676112][T20545] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000003 [ 588.676124][T20545] R13: 00007fcf65b33f58 R14: 00007fcf65b34000 R15: 0000000000000000 [ 588.676159][T20545] [ 588.960936][T20551] wg2: Caught tx_queue_len zero misconfig [ 589.243726][T20563] xt_CT: No such helper "snmp_trap" [ 589.378638][T20569] bond4: option primary: mode dependency failed, not supported in mode balance-rr(0) [ 589.398309][T20569] bond4 (unregistering): Released all slaves [ 589.487795][T20576] netlink: 28 bytes leftover after parsing attributes in process `syz.1.4175'. [ 589.585656][T20584] syzkaller0: entered promiscuous mode [ 589.591868][T20584] syzkaller0: entered allmulticast mode [ 589.711446][T20596] FAULT_INJECTION: forcing a failure. [ 589.711446][T20596] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 589.727263][T20596] CPU: 1 UID: 0 PID: 20596 Comm: syz.0.4183 Not tainted syzkaller #0 PREEMPT(full) [ 589.727292][T20596] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 589.727304][T20596] Call Trace: [ 589.727313][T20596] [ 589.727331][T20596] dump_stack_lvl+0xe8/0x150 [ 589.727368][T20596] should_fail_ex+0x40c/0x560 [ 589.727402][T20596] _copy_from_iter+0x1d3/0x1660 [ 589.727421][T20596] ? kmem_cache_alloc_node_noprof+0x1b1/0x610 [ 589.727443][T20596] ? rcu_is_watching+0x15/0xb0 [ 589.727470][T20596] ? trace_kmem_cache_alloc+0x29/0xe0 [ 589.727493][T20596] ? kmem_cache_alloc_node_noprof+0x3b8/0x610 [ 589.727516][T20596] ? __pfx__copy_from_iter+0x10/0x10 [ 589.727537][T20596] ? __alloc_skb+0x276/0x7a0 [ 589.727558][T20596] ? __alloc_skb+0x276/0x7a0 [ 589.727587][T20596] ? netlink_sendmsg+0x650/0xb40 [ 589.727614][T20596] ? skb_put+0x112/0x210 [ 589.727641][T20596] netlink_sendmsg+0x6c0/0xb40 [ 589.727679][T20596] ? __pfx_netlink_sendmsg+0x10/0x10 [ 589.727711][T20596] ? aa_sock_msg_perm+0xf1/0x1b0 [ 589.727746][T20596] ? __pfx_netlink_sendmsg+0x10/0x10 [ 589.727772][T20596] sock_sendmsg_nosec+0x13a/0x180 [ 589.727808][T20596] __sys_sendto+0x408/0x5a0 [ 589.727836][T20596] ? __pfx___sys_sendto+0x10/0x10 [ 589.727893][T20596] ? do_user_addr_fault+0xc4a/0x1340 [ 589.727929][T20596] __x64_sys_sendto+0xde/0x100 [ 589.727953][T20596] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 589.727977][T20596] do_syscall_64+0x174/0x580 [ 589.728000][T20596] ? trace_irq_disable+0x3b/0x140 [ 589.728027][T20596] ? clear_bhb_loop+0x40/0x90 [ 589.728058][T20596] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 589.728079][T20596] RIP: 0033:0x7fcf64b5e68e [ 589.728100][T20596] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 589.728118][T20596] RSP: 002b:00007fcf65b33e88 EFLAGS: 00000246 ORIG_RAX: 000000000000002c [ 589.728142][T20596] RAX: ffffffffffffffda RBX: 00007fcf65b356c0 RCX: 00007fcf64b5e68e [ 589.728157][T20596] RDX: 0000000000000020 RSI: 00007fcf65b34000 RDI: 0000000000000003 [ 589.728171][T20596] RBP: 0000000000000000 R08: 00007fcf65b33f04 R09: 000000000000000c [ 589.728184][T20596] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000003 [ 589.728197][T20596] R13: 00007fcf65b33f58 R14: 00007fcf65b34000 R15: 0000000000000000 [ 589.728231][T20596] [ 589.758108][T20598] netlink: 768 bytes leftover after parsing attributes in process `syz.1.4184'. [ 589.993413][T20595] syzkaller1: entered promiscuous mode [ 589.999321][T20595] syzkaller1: entered allmulticast mode [ 590.010201][T20600] netlink: 8 bytes leftover after parsing attributes in process `syz.0.4185'. [ 590.024841][T20602] netlink: 8 bytes leftover after parsing attributes in process `syz.0.4185'. [ 590.174250][T20604] netlink: 16402 bytes leftover after parsing attributes in process `syz.1.4184'. [ 590.331836][T20619] sctp: [Deprecated]: syz.2.4188 (pid 20619) Use of int in maxseg socket option. [ 590.331836][T20619] Use struct sctp_assoc_value instead [ 590.383966][T20620] netlink: 16 bytes leftover after parsing attributes in process `syz.0.4189'. [ 590.448151][T20626] netlink: 232 bytes leftover after parsing attributes in process `syz.3.4191'. [ 590.498712][T20626] block nbd0: Unsupported socket: should be TCP or UNIX. [ 590.736703][ T5633] Bluetooth: hci2: command 0x0406 tx timeout [ 590.753118][T20639] FAULT_INJECTION: forcing a failure. [ 590.753118][T20639] name failslab, interval 1, probability 0, space 0, times 0 [ 590.784590][T20639] CPU: 1 UID: 0 PID: 20639 Comm: syz.3.4195 Not tainted syzkaller #0 PREEMPT(full) [ 590.784620][T20639] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 590.784632][T20639] Call Trace: [ 590.784640][T20639] [ 590.784650][T20639] dump_stack_lvl+0xe8/0x150 [ 590.784690][T20639] should_fail_ex+0x40c/0x560 [ 590.784728][T20639] should_failslab+0xa8/0x100 [ 590.784760][T20639] kmem_cache_alloc_noprof+0xa6/0x5f0 [ 590.784787][T20639] ? skb_clone+0x212/0x3a0 [ 590.784812][T20639] ? skb_clone+0x212/0x3a0 [ 590.784854][T20639] skb_clone+0x212/0x3a0 [ 590.784885][T20639] __netlink_deliver_tap+0x413/0x860 [ 590.784926][T20639] ? netlink_deliver_tap+0x2e/0x1b0 [ 590.784955][T20639] netlink_deliver_tap+0x19c/0x1b0 [ 590.784984][T20639] netlink_unicast+0x77f/0x940 [ 590.785021][T20639] netlink_sendmsg+0x813/0xb40 [ 590.785059][T20639] ? __pfx_netlink_sendmsg+0x10/0x10 [ 590.785091][T20639] ? aa_sock_msg_perm+0xf1/0x1b0 [ 590.785128][T20639] ? __pfx_netlink_sendmsg+0x10/0x10 [ 590.785153][T20639] sock_sendmsg_nosec+0x13a/0x180 [ 590.785189][T20639] __sys_sendto+0x408/0x5a0 [ 590.785220][T20639] ? __pfx___sys_sendto+0x10/0x10 [ 590.785274][T20639] ? rcu_is_watching+0x15/0xb0 [ 590.785312][T20639] __x64_sys_sendto+0xde/0x100 [ 590.785333][T20639] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 590.785355][T20639] do_syscall_64+0x174/0x580 [ 590.785376][T20639] ? trace_irq_disable+0x3b/0x140 [ 590.785401][T20639] ? clear_bhb_loop+0x40/0x90 [ 590.785427][T20639] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 590.785444][T20639] RIP: 0033:0x7f56c115e68e [ 590.785464][T20639] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 590.785480][T20639] RSP: 002b:00007f56c1f98e88 EFLAGS: 00000246 ORIG_RAX: 000000000000002c [ 590.785503][T20639] RAX: ffffffffffffffda RBX: 00007f56c1f9a6c0 RCX: 00007f56c115e68e [ 590.785518][T20639] RDX: 0000000000000020 RSI: 00007f56c1f99000 RDI: 0000000000000003 [ 590.785530][T20639] RBP: 0000000000000000 R08: 00007f56c1f98f04 R09: 000000000000000c [ 590.785543][T20639] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000003 [ 590.785555][T20639] R13: 00007f56c1f98f58 R14: 00007f56c1f99000 R15: 0000000000000000 [ 590.785590][T20639] [ 591.043748][T20643] gre0: entered promiscuous mode [ 591.053125][T20643] gre0: entered allmulticast mode [ 591.065303][T20640] syzkaller0: entered promiscuous mode [ 591.071424][T20640] syzkaller0: entered allmulticast mode [ 591.289613][T20663] netlink: 'syz.2.4204': attribute type 1 has an invalid length. [ 591.310296][T20655] sit3: entered promiscuous mode [ 591.315479][T20655] sit3: entered allmulticast mode [ 591.344959][T20665] openvswitch: netlink: IP tunnel attribute has 4 unknown bytes. [ 591.858639][T20686] IPVS: set_ctl: invalid protocol: 136 224.0.0.1:20001 [ 592.044199][T20697] syzkaller0: entered promiscuous mode [ 592.058749][T20697] syzkaller0: entered allmulticast mode [ 592.093136][T20699] __nla_validate_parse: 3 callbacks suppressed [ 592.093160][T20699] netlink: 4 bytes leftover after parsing attributes in process `syz.4.4217'. [ 592.121932][T20701] netlink: 212408 bytes leftover after parsing attributes in process `syz.1.4218'. [ 592.151088][T20701] openvswitch: netlink: Message has 512 unknown bytes. [ 592.324960][T20712] netlink: 'syz.1.4220': attribute type 1 has an invalid length. [ 592.360757][T20715] netlink: 12 bytes leftover after parsing attributes in process `syz.2.4221'. [ 592.605084][T20726] FAULT_INJECTION: forcing a failure. [ 592.605084][T20726] name failslab, interval 1, probability 0, space 0, times 0 [ 592.642423][T20726] CPU: 1 UID: 0 PID: 20726 Comm: syz.0.4226 Not tainted syzkaller #0 PREEMPT(full) [ 592.642454][T20726] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 592.642467][T20726] Call Trace: [ 592.642476][T20726] [ 592.642486][T20726] dump_stack_lvl+0xe8/0x150 [ 592.642524][T20726] should_fail_ex+0x40c/0x560 [ 592.642562][T20726] should_failslab+0xa8/0x100 [ 592.642594][T20726] kmem_cache_alloc_node_noprof+0xb3/0x610 [ 592.642619][T20726] ? local_lock_release+0x9c/0x160 [ 592.642644][T20726] ? __alloc_skb+0x1d7/0x7a0 [ 592.642664][T20726] ? __alloc_skb+0x1d7/0x7a0 [ 592.642695][T20726] __alloc_skb+0x1d7/0x7a0 [ 592.642722][T20726] ctrl_getfamily+0x3d0/0x5c0 [ 592.642759][T20726] ? __pfx_ctrl_getfamily+0x10/0x10 [ 592.642791][T20726] ? genl_family_rcv_msg_attrs_parse+0x265/0x2f0 [ 592.642823][T20726] genl_family_rcv_msg_doit+0x233/0x340 [ 592.642853][T20726] ? __pfx_genl_family_rcv_msg_doit+0x10/0x10 [ 592.642886][T20726] ? __dev_queue_xmit+0x29b/0x37f0 [ 592.642927][T20726] genl_rcv_msg+0x614/0x7a0 [ 592.642967][T20726] ? __pfx_genl_rcv_msg+0x10/0x10 [ 592.642999][T20726] ? __pfx_ctrl_getfamily+0x10/0x10 [ 592.643031][T20726] ? __pfx_ref_tracker_free+0x10/0x10 [ 592.643066][T20726] netlink_rcv_skb+0x226/0x4a0 [ 592.643095][T20726] ? __pfx_genl_rcv_msg+0x10/0x10 [ 592.643129][T20726] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 592.643175][T20726] ? down_read+0x2be/0x330 [ 592.643214][T20726] genl_rcv+0x28/0x40 [ 592.643243][T20726] netlink_unicast+0x7bb/0x940 [ 592.643281][T20726] netlink_sendmsg+0x813/0xb40 [ 592.643320][T20726] ? __pfx_netlink_sendmsg+0x10/0x10 [ 592.643352][T20726] ? aa_sock_msg_perm+0xf1/0x1b0 [ 592.643389][T20726] ? __pfx_netlink_sendmsg+0x10/0x10 [ 592.643415][T20726] sock_sendmsg_nosec+0x13a/0x180 [ 592.643451][T20726] __sys_sendto+0x408/0x5a0 [ 592.643483][T20726] ? __pfx___sys_sendto+0x10/0x10 [ 592.643547][T20726] ? do_user_addr_fault+0xc4a/0x1340 [ 592.643584][T20726] __x64_sys_sendto+0xde/0x100 [ 592.643609][T20726] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 592.643632][T20726] do_syscall_64+0x174/0x580 [ 592.643654][T20726] ? trace_irq_disable+0x3b/0x140 [ 592.643681][T20726] ? clear_bhb_loop+0x40/0x90 [ 592.643706][T20726] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 592.643728][T20726] RIP: 0033:0x7fcf64b5e68e [ 592.643749][T20726] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 592.643767][T20726] RSP: 002b:00007fcf65b33e88 EFLAGS: 00000246 ORIG_RAX: 000000000000002c [ 592.643790][T20726] RAX: ffffffffffffffda RBX: 00007fcf65b356c0 RCX: 00007fcf64b5e68e [ 592.643805][T20726] RDX: 0000000000000020 RSI: 00007fcf65b34000 RDI: 0000000000000003 [ 592.643819][T20726] RBP: 0000000000000000 R08: 00007fcf65b33f04 R09: 000000000000000c [ 592.643832][T20726] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000003 [ 592.643844][T20726] R13: 00007fcf65b33f58 R14: 00007fcf65b34000 R15: 0000000000000000 [ 592.643880][T20726] [ 593.059904][T20738] netlink: 'syz.2.4232': attribute type 4 has an invalid length. [ 593.213803][T20748] netlink: 16 bytes leftover after parsing attributes in process `syz.0.4235'. [ 593.593857][T20769] netlink: 28 bytes leftover after parsing attributes in process `syz.2.4241'. [ 593.730071][T20773] netlink: 'syz.3.4242': attribute type 2 has an invalid length. [ 593.749667][T20773] netlink: 'syz.3.4242': attribute type 11 has an invalid length. [ 593.764175][T20773] netlink: 132 bytes leftover after parsing attributes in process `syz.3.4242'. [ 593.812527][T18139] block nbd0: Receive control failed (result -107) [ 593.813725][T20777] block nbd0: reconnected socket [ 593.873250][T20777] netlink: 596 bytes leftover after parsing attributes in process `syz.2.4244'. [ 594.117306][T20784] netlink: 4 bytes leftover after parsing attributes in process `syz.3.4246'. [ 594.630246][T20813] netlink: 28 bytes leftover after parsing attributes in process `syz.2.4253'. [ 594.641213][T20813] netlink: 28 bytes leftover after parsing attributes in process `syz.2.4253'. [ 594.696246][T20815] syzkaller0: entered promiscuous mode [ 594.712421][T20815] syzkaller0: entered allmulticast mode [ 594.755071][T20815] 0: reclassify loop, rule prio 0, protocol 800 [ 595.020581][T20834] netlink: 'syz.2.4259': attribute type 1 has an invalid length. [ 595.059436][T20834] 8021q: adding VLAN 0 to HW filter on device bond5 [ 595.095567][T20834] 8021q: adding VLAN 0 to HW filter on device bond5 [ 595.103373][T20834] bond5: (slave gre1): The slave device specified does not support setting the MAC address [ 595.114986][T20834] bond5: (slave gre1): Error -95 calling set_mac_address [ 595.184483][T20841] gretap2: entered promiscuous mode [ 595.238268][T20841] bond5: (slave gretap2): making interface the new active one [ 595.247994][T20841] bond5: (slave gretap2): Enslaving as an active interface with an up link [ 595.264932][T20834] macvlan2: entered promiscuous mode [ 595.270587][T20834] macvlan2: entered allmulticast mode [ 595.278878][T20834] bond5: entered promiscuous mode [ 595.300064][T20834] 8021q: adding VLAN 0 to HW filter on device macvlan2 [ 595.321242][T20834] bond5: (slave macvlan2): the slave hw address is in use by the bond; giving it the hw address of gretap2 [ 595.346804][T20853] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 595.356673][T20834] bond5: left promiscuous mode [ 595.770479][T20871] netlink: 'syz.0.4269': attribute type 11 has an invalid length. [ 595.839388][T20871] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 595.866434][T20871] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 595.906152][T20875] xt_CT: No such helper "snmp_trap" [ 596.090581][T20871] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 596.117686][T20871] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 596.161407][ T3331] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 596.172065][ C0] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 596.183081][ T7474] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 596.193708][T17183] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 596.277529][T20895] FAULT_INJECTION: forcing a failure. [ 596.277529][T20895] name failslab, interval 1, probability 0, space 0, times 0 [ 596.309981][T20895] CPU: 1 UID: 0 PID: 20895 Comm: syz.3.4275 Not tainted syzkaller #0 PREEMPT(full) [ 596.310013][T20895] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 596.310025][T20895] Call Trace: [ 596.310033][T20895] [ 596.310042][T20895] dump_stack_lvl+0xe8/0x150 [ 596.310077][T20895] should_fail_ex+0x40c/0x560 [ 596.310111][T20895] should_failslab+0xa8/0x100 [ 596.310141][T20895] kmem_cache_alloc_noprof+0xa6/0x5f0 [ 596.310165][T20895] ? skb_clone+0x212/0x3a0 [ 596.310187][T20895] ? skb_clone+0x212/0x3a0 [ 596.310218][T20895] skb_clone+0x212/0x3a0 [ 596.310246][T20895] __netlink_deliver_tap+0x413/0x860 [ 596.310286][T20895] ? netlink_deliver_tap+0x2e/0x1b0 [ 596.310314][T20895] netlink_deliver_tap+0x19c/0x1b0 [ 596.310339][T20895] netlink_sendskb+0x68/0x140 [ 596.310363][T20895] ctrl_getfamily+0x4c8/0x5c0 [ 596.310394][T20895] ? __pfx_ctrl_getfamily+0x10/0x10 [ 596.310426][T20895] ? genl_family_rcv_msg_attrs_parse+0x265/0x2f0 [ 596.310454][T20895] genl_family_rcv_msg_doit+0x233/0x340 [ 596.310483][T20895] ? __pfx_genl_family_rcv_msg_doit+0x10/0x10 [ 596.310522][T20895] ? __dev_queue_xmit+0x29b/0x37f0 [ 596.310564][T20895] genl_rcv_msg+0x614/0x7a0 [ 596.310608][T20895] ? __pfx_genl_rcv_msg+0x10/0x10 [ 596.310637][T20895] ? __pfx_ctrl_getfamily+0x10/0x10 [ 596.310667][T20895] ? __pfx_ref_tracker_free+0x10/0x10 [ 596.310702][T20895] netlink_rcv_skb+0x226/0x4a0 [ 596.310730][T20895] ? __pfx_genl_rcv_msg+0x10/0x10 [ 596.310764][T20895] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 596.310810][T20895] ? down_read+0x2be/0x330 [ 596.310846][T20895] genl_rcv+0x28/0x40 [ 596.310876][T20895] netlink_unicast+0x7bb/0x940 [ 596.310915][T20895] netlink_sendmsg+0x813/0xb40 [ 596.310953][T20895] ? __pfx_netlink_sendmsg+0x10/0x10 [ 596.310984][T20895] ? aa_sock_msg_perm+0xf1/0x1b0 [ 596.311018][T20895] ? __pfx_netlink_sendmsg+0x10/0x10 [ 596.311042][T20895] sock_sendmsg_nosec+0x13a/0x180 [ 596.311076][T20895] __sys_sendto+0x408/0x5a0 [ 596.311106][T20895] ? __pfx___sys_sendto+0x10/0x10 [ 596.311166][T20895] ? do_user_addr_fault+0xc4a/0x1340 [ 596.311203][T20895] __x64_sys_sendto+0xde/0x100 [ 596.311228][T20895] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 596.311252][T20895] do_syscall_64+0x174/0x580 [ 596.311274][T20895] ? trace_irq_disable+0x3b/0x140 [ 596.311301][T20895] ? clear_bhb_loop+0x40/0x90 [ 596.311327][T20895] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 596.311347][T20895] RIP: 0033:0x7f56c115e68e [ 596.311368][T20895] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 596.311383][T20895] RSP: 002b:00007f56c1f98e88 EFLAGS: 00000246 ORIG_RAX: 000000000000002c [ 596.311405][T20895] RAX: ffffffffffffffda RBX: 00007f56c1f9a6c0 RCX: 00007f56c115e68e [ 596.311420][T20895] RDX: 0000000000000020 RSI: 00007f56c1f99000 RDI: 0000000000000003 [ 596.311433][T20895] RBP: 0000000000000000 R08: 00007f56c1f98f04 R09: 000000000000000c [ 596.311446][T20895] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000003 [ 596.311458][T20895] R13: 00007f56c1f98f58 R14: 00007f56c1f99000 R15: 0000000000000000 [ 596.311493][T20895] [ 597.216459][ T7474] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 597.423474][T20944] team_slave_1: Caught tx_queue_len zero misconfig [ 597.434173][T20943] __nla_validate_parse: 10 callbacks suppressed [ 597.434196][T20943] netlink: 12 bytes leftover after parsing attributes in process `syz.0.4289'. [ 597.459647][T20947] netlink: 'syz.1.4292': attribute type 1 has an invalid length. [ 597.508452][T20943] netlink: 136 bytes leftover after parsing attributes in process `syz.0.4289'. [ 597.568923][T20943] netlink: 92 bytes leftover after parsing attributes in process `syz.0.4289'. [ 597.580858][T20952] netlink: 4 bytes leftover after parsing attributes in process `syz.2.4293'. [ 597.611598][T20952] syzkaller0: entered promiscuous mode [ 597.624275][T20952] syzkaller0: entered allmulticast mode [ 597.638835][ T95] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 597.647479][ C0] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 597.784439][T20960] 8021q: adding VLAN 0 to HW filter on device ipvlan0 [ 597.820221][T20967] bridge0: port 2(bridge_slave_1) entered disabled state [ 597.832026][T20967] bridge0: port 1(bridge_slave_0) entered disabled state [ 597.882464][T20967] bridge0: entered allmulticast mode [ 597.951830][T20975] netlink: 4 bytes leftover after parsing attributes in process `syz.3.4299'. [ 597.998242][T20975] netlink: 4 bytes leftover after parsing attributes in process `syz.3.4299'. [ 598.052405][ T3331] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 598.063480][ T3331] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 598.204550][T20988] netlink: 9 bytes leftover after parsing attributes in process `syz.3.4305'. [ 598.249094][T20995] mac80211_hwsim hwsim27 syzkaller0: entered promiscuous mode [ 598.257343][T16069] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 598.266321][T20997] [ 598.268712][T20997] ====================================================== [ 598.268956][T20995] mac80211_hwsim hwsim27 syzkaller0: entered allmulticast mode [ 598.275811][T20997] WARNING: possible circular locking dependency detected [ 598.275841][T20997] syzkaller #0 Not tainted [ 598.275853][T20997] ------------------------------------------------------ [ 598.302214][T20997] syz.1.4306/20997 is trying to acquire lock: [ 598.308317][T20997] ffff88807873f678 (&mm->mmap_lock){++++}-{4:4}, at: gup_fast_fallback+0x20d/0x20e0 [ 598.317857][T20997] [ 598.317857][T20997] but task is already holding lock: [ 598.325232][T20997] ffff888036de3860 (sk_lock-AF_INET6){+.+.}-{0:0}, at: tls_sw_sendmsg+0x161/0x2860 [ 598.334678][T20997] [ 598.334678][T20997] which lock already depends on the new lock. [ 598.334678][T20997] [ 598.345170][T20997] [ 598.345170][T20997] the existing dependency chain (in reverse order) is: [ 598.354181][T20997] [ 598.354181][T20997] -> #7 (sk_lock-AF_INET6){+.+.}-{0:0}: [ 598.361987][T20997] lock_sock_nested+0x41/0x100 [ 598.367285][T20997] inet_shutdown+0x6a/0x390 [ 598.372343][T20997] nbd_mark_nsock_dead+0x2cb/0x550 [ 598.378046][T20997] recv_work+0x1cee/0x1e10 [ 598.383018][T20997] process_scheduled_works+0xa8e/0x14e0 [ 598.389108][T20997] worker_thread+0xa47/0xfb0 [ 598.394218][T20997] kthread+0x388/0x470 [ 598.398837][T20997] ret_from_fork+0x514/0xb70 [ 598.404008][T20997] ret_from_fork_asm+0x1a/0x30 [ 598.409310][T20997] [ 598.409310][T20997] -> #6 (&nsock->tx_lock){+.+.}-{4:4}: [ 598.416966][T20997] __mutex_lock+0x19d/0x1550 [ 598.422084][T20997] nbd_queue_rq+0x373/0x1150 [ 598.427200][T20997] blk_mq_dispatch_rq_list+0x499/0x1990 [ 598.433328][T20997] __blk_mq_sched_dispatch_requests+0xd36/0x1580 [ 598.440219][T20997] blk_mq_sched_dispatch_requests+0xd7/0x190 [ 598.446818][T20997] blk_mq_run_work_fn+0x16c/0x300 [ 598.452458][T20997] process_scheduled_works+0xa8e/0x14e0 [ 598.458529][T20997] worker_thread+0xa47/0xfb0 [ 598.463643][T20997] kthread+0x388/0x470 [ 598.468258][T20997] ret_from_fork+0x514/0xb70 [ 598.473376][T20997] ret_from_fork_asm+0x1a/0x30 [ 598.478675][T20997] [ 598.478675][T20997] -> #5 (&cmd->lock){+.+.}-{4:4}: [ 598.485898][T20997] __mutex_lock+0x19d/0x1550 [ 598.491038][T20997] nbd_queue_rq+0xc1/0x1150 [ 598.496066][T20997] blk_mq_dispatch_rq_list+0x499/0x1990 [ 598.502226][T20997] __blk_mq_sched_dispatch_requests+0xd36/0x1580 [ 598.509081][T20997] blk_mq_sched_dispatch_requests+0xd7/0x190 [ 598.515588][T20997] blk_mq_run_work_fn+0x16c/0x300 [ 598.521148][T20997] process_scheduled_works+0xa8e/0x14e0 [ 598.527232][T20997] worker_thread+0xa47/0xfb0 [ 598.532350][T20997] kthread+0x388/0x470 [ 598.536945][T20997] ret_from_fork+0x514/0xb70 [ 598.542062][T20997] ret_from_fork_asm+0x1a/0x30 [ 598.547362][T20997] [ 598.547362][T20997] -> #4 (set->srcu){.+.+}-{0:0}: [ 598.554490][T20997] __synchronize_srcu+0xc9/0x2f0 [ 598.559952][T20997] elevator_switch+0x1e8/0x7b0 [ 598.565281][T20997] elevator_change+0x2fa/0x480 [ 598.570562][T20997] elevator_set_default+0x375/0x440 [ 598.576280][T20997] blk_register_queue+0x3f3/0x4e0 [ 598.581875][T20997] __add_disk+0x6cb/0xe30 [ 598.586740][T20997] add_disk_fwnode+0xfb/0x4b0 [ 598.591942][T20997] nbd_dev_add+0x733/0xb60 [ 598.596887][T20997] nbd_init+0x15f/0x1e0 [ 598.601658][T20997] do_one_initcall+0x250/0x870 [ 598.606967][T20997] do_initcall_level+0x10a/0x1a0 [ 598.612508][T20997] do_initcalls+0x59/0xa0 [ 598.617387][T20997] kernel_init_freeable+0x29d/0x3e0 [ 598.623125][T20997] kernel_init+0x1d/0x1d0 [ 598.627987][T20997] ret_from_fork+0x514/0xb70 [ 598.633109][T20997] ret_from_fork_asm+0x1a/0x30 [ 598.638398][T20997] [ 598.638398][T20997] -> #3 (&q->elevator_lock){+.+.}-{4:4}: [ 598.646222][T20997] __mutex_lock+0x19d/0x1550 [ 598.651341][T20997] elevator_change+0x1af/0x480 [ 598.656643][T20997] elevator_set_none+0xb5/0x140 [ 598.662060][T20997] blk_mq_update_nr_hw_queues+0x5ef/0x19f0 [ 598.668399][T20997] nbd_start_device+0x189/0xb30 [ 598.673782][T20997] nbd_genl_connect+0x1597/0x1c10 [ 598.679335][T20997] genl_family_rcv_msg_doit+0x233/0x340 [ 598.685411][T20997] genl_rcv_msg+0x614/0x7a0 [ 598.690448][T20997] netlink_rcv_skb+0x226/0x4a0 [ 598.695756][T20997] genl_rcv+0x28/0x40 [ 598.700357][T20997] netlink_unicast+0x7bb/0x940 [ 598.705669][T20997] netlink_sendmsg+0x813/0xb40 [ 598.710956][T20997] sock_sendmsg_nosec+0x13a/0x180 [ 598.716564][T20997] ____sys_sendmsg+0x54e/0x850 [ 598.721884][T20997] ___sys_sendmsg+0x2a5/0x360 [ 598.727089][T20997] __x64_sys_sendmsg+0x1b1/0x290 [ 598.732556][T20997] do_syscall_64+0x174/0x580 [ 598.737763][T20997] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 598.744183][T20997] [ 598.744183][T20997] -> #2 (&q->q_usage_counter(io)#51){++++}-{0:0}: [ 598.752809][T20997] blk_alloc_queue+0x544/0x690 [ 598.758133][T20997] __blk_mq_alloc_disk+0x194/0x390 [ 598.763785][T20997] nbd_dev_add+0x494/0xb60 [ 598.768747][T20997] nbd_init+0x15f/0x1e0 [ 598.773477][T20997] do_one_initcall+0x250/0x870 [ 598.778814][T20997] do_initcall_level+0x10a/0x1a0 [ 598.784284][T20997] do_initcalls+0x59/0xa0 [ 598.789135][T20997] kernel_init_freeable+0x29d/0x3e0 [ 598.794866][T20997] kernel_init+0x1d/0x1d0 [ 598.799717][T20997] ret_from_fork+0x514/0xb70 [ 598.804835][T20997] ret_from_fork_asm+0x1a/0x30 [ 598.810140][T20997] [ 598.810140][T20997] -> #1 (fs_reclaim){+.+.}-{0:0}: [ 598.817359][T20997] fs_reclaim_acquire+0x71/0x100 [ 598.822855][T20997] kmem_cache_alloc_noprof+0x64/0x5f0 [ 598.828749][T20997] mas_alloc_nodes+0x291/0x350 [ 598.834142][T20997] mas_preallocate+0x2cf/0x630 [ 598.839450][T20997] vma_link+0x123/0x470 [ 598.844144][T20997] insert_vm_struct+0x1bf/0x290 [ 598.849516][T20997] create_init_stack_vma+0x5c1/0x9b0 [ 598.855322][T20997] alloc_bprm+0x506/0x640 [ 598.860178][T20997] kernel_execve+0x85/0x9c0 [ 598.865208][T20997] try_to_run_init_process+0x13/0x60 [ 598.871054][T20997] kernel_init+0xad/0x1d0 [ 598.875910][T20997] ret_from_fork+0x514/0xb70 [ 598.881034][T20997] ret_from_fork_asm+0x1a/0x30 [ 598.886337][T20997] [ 598.886337][T20997] -> #0 (&mm->mmap_lock){++++}-{4:4}: [ 598.893903][T20997] __lock_acquire+0x1520/0x2cf0 [ 598.899358][T20997] lock_acquire+0x106/0x350 [ 598.904416][T20997] gup_fast_fallback+0x226/0x20e0 [ 598.910016][T20997] __iov_iter_get_pages_alloc+0x378/0xa40 [ 598.916269][T20997] iov_iter_get_pages2+0x5e/0xa0 [ 598.921750][T20997] sk_msg_zerocopy_from_iter+0x21b/0x8c0 [ 598.928071][T20997] tls_sw_sendmsg+0x10d5/0x2860 [ 598.933456][T20997] sock_sendmsg_nosec+0x90/0x180 [ 598.939102][T20997] __sys_sendto+0x408/0x5a0 [ 598.944131][T20997] __x64_sys_sendto+0xde/0x100 [ 598.949420][T20997] do_syscall_64+0x174/0x580 [ 598.954629][T20997] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 598.961090][T20997] [ 598.961090][T20997] other info that might help us debug this: [ 598.961090][T20997] [ 598.971328][T20997] Chain exists of: [ 598.971328][T20997] &mm->mmap_lock --> &nsock->tx_lock --> sk_lock-AF_INET6 [ 598.971328][T20997] [ 598.984442][T20997] Possible unsafe locking scenario: [ 598.984442][T20997] [ 598.991912][T20997] CPU0 CPU1 [ 598.997754][T20997] ---- ---- [ 599.003134][T20997] lock(sk_lock-AF_INET6); [ 599.007640][T20997] lock(&nsock->tx_lock); [ 599.014576][T20997] lock(sk_lock-AF_INET6); [ 599.021608][T20997] rlock(&mm->mmap_lock); [ 599.026074][T20997] [ 599.026074][T20997] *** DEADLOCK *** [ 599.026074][T20997] [ 599.034248][T20997] 2 locks held by syz.1.4306/20997: [ 599.039438][T20997] #0: ffff8880570a74e8 (&ctx->tx_lock){+.+.}-{4:4}, at: tls_sw_sendmsg+0x13c/0x2860 [ 599.048975][T20997] #1: ffff888036de3860 (sk_lock-AF_INET6){+.+.}-{0:0}, at: tls_sw_sendmsg+0x161/0x2860 [ 599.058733][T20997] [ 599.058733][T20997] stack backtrace: [ 599.064625][T20997] CPU: 1 UID: 0 PID: 20997 Comm: syz.1.4306 Not tainted syzkaller #0 PREEMPT(full) [ 599.064644][T20997] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 599.064655][T20997] Call Trace: [ 599.064663][T20997] [ 599.064671][T20997] dump_stack_lvl+0xe8/0x150 [ 599.064696][T20997] print_circular_bug+0x2e1/0x300 [ 599.064714][T20997] check_noncircular+0x12e/0x150 [ 599.064741][T20997] __lock_acquire+0x1520/0x2cf0 [ 599.064767][T20997] ? __page_table_check_zero+0x6a/0x3e0 [ 599.064789][T20997] ? gup_fast_fallback+0x20d/0x20e0 [ 599.064803][T20997] lock_acquire+0x106/0x350 [ 599.064822][T20997] ? gup_fast_fallback+0x20d/0x20e0 [ 599.064838][T20997] ? __page_table_check_zero+0x6a/0x3e0 [ 599.064857][T20997] ? __page_table_check_zero+0x397/0x3e0 [ 599.064875][T20997] ? __page_table_check_zero+0x6a/0x3e0 [ 599.064894][T20997] ? gup_fast_fallback+0x20d/0x20e0 [ 599.064908][T20997] gup_fast_fallback+0x226/0x20e0 [ 599.064922][T20997] ? gup_fast_fallback+0x20d/0x20e0 [ 599.064938][T20997] ? get_page_from_freelist+0x2212/0x2270 [ 599.064960][T20997] ? kernel_text_address+0xa5/0xe0 [ 599.064985][T20997] ? do_raw_spin_lock+0x12b/0x2f0 [ 599.065005][T20997] ? __pfx_gup_fast_fallback+0x10/0x10 [ 599.065021][T20997] ? is_valid_gup_args+0x11f/0x200 [ 599.065036][T20997] ? get_user_pages_fast+0x4d/0xb0 [ 599.065052][T20997] __iov_iter_get_pages_alloc+0x378/0xa40 [ 599.065073][T20997] ? __alloc_frozen_pages_noprof+0x1db/0x380 [ 599.065094][T20997] ? __pfx___alloc_frozen_pages_noprof+0x10/0x10 [ 599.065117][T20997] iov_iter_get_pages2+0x5e/0xa0 [ 599.065135][T20997] sk_msg_zerocopy_from_iter+0x21b/0x8c0 [ 599.065154][T20997] ? __lock_acquire+0x683/0x2cf0 [ 599.065177][T20997] ? alloc_pages_noprof+0x13b/0x2a0 [ 599.065199][T20997] ? __pfx_sk_msg_zerocopy_from_iter+0x10/0x10 [ 599.065235][T20997] tls_sw_sendmsg+0x10d5/0x2860 [ 599.065272][T20997] ? __pfx_tls_sw_sendmsg+0x10/0x10 [ 599.065296][T20997] ? __might_fault+0xaf/0x130 [ 599.065312][T20997] ? __pfx_aa_sk_perm+0x10/0x10 [ 599.065331][T20997] ? sock_rps_record_flow+0x19/0x350 [ 599.065348][T20997] ? inet_send_prepare+0x5b/0x260 [ 599.065364][T20997] ? inet6_sendmsg+0x101/0x120 [ 599.065454][T20997] ? __pfx_inet6_sendmsg+0x10/0x10 [ 599.065471][T20997] sock_sendmsg_nosec+0x90/0x180 [ 599.065494][T20997] __sys_sendto+0x408/0x5a0 [ 599.065513][T20997] ? __pfx___sys_sendto+0x10/0x10 [ 599.065539][T20997] ? do_user_addr_fault+0xc4a/0x1340 [ 599.065563][T20997] __x64_sys_sendto+0xde/0x100 [ 599.065579][T20997] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 599.065596][T20997] do_syscall_64+0x174/0x580 [ 599.065613][T20997] ? trace_irq_disable+0x3b/0x140 [ 599.065632][T20997] ? clear_bhb_loop+0x40/0x90 [ 599.065671][T20997] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 599.065687][T20997] RIP: 0033:0x7f2b3af5e68e [ 599.065702][T20997] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 599.065716][T20997] RSP: 002b:00007f2b3be53e88 EFLAGS: 00000246 ORIG_RAX: 000000000000002c [ 599.065734][T20997] RAX: ffffffffffffffda RBX: 00007f2b3be556c0 RCX: 00007f2b3af5e68e [ 599.065746][T20997] RDX: 0000000000000020 RSI: 00007f2b3be54000 RDI: 0000000000000003 [ 599.065756][T20997] RBP: 0000000000000000 R08: 00007f2b3be53f04 R09: 000000000000000c [ 599.065767][T20997] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000003 [ 599.065777][T20997] R13: 00007f2b3be53f58 R14: 00007f2b3be54000 R15: 0000000000000000 [ 599.065800][T20997] [ 599.537098][ T5633] Bluetooth: hci4: command 0x0405 tx timeout [ 599.847004][ T95] net_ratelimit: 5 callbacks suppressed [ 599.847020][ T95] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 599.861080][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 600.497451][T16069] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 600.996177][ T3331] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 601.004487][ C0] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 601.537863][ T7474] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 602.097479][ T7474] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 602.116169][ T95] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 602.124448][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 602.416214][T17187] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 605.216346][T16922] net_ratelimit: 9 callbacks suppressed [ 605.216368][T16922] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 605.486116][ T95] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 605.494392][ C0] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 606.096119][ T5633] Bluetooth: hci1: command 0x0406 tx timeout [ 606.256251][T16922] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 606.576099][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 606.584539][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 606.616306][ T3331] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 606.624640][ C0] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 607.296103][T16069] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 607.698341][T17187] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog