last executing test programs: 5.739508933s ago: executing program 1 (id=2250): socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000940)={0xffffffffffffffff, 0xffffffffffffffff}) pipe(&(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) splice(r1, 0x0, r2, 0x0, 0xf3a, 0x0) mmap(&(0x7f0000001000/0xc00000)=nil, 0xc00000, 0x0, 0x10010, 0xffffffffffffffff, 0xffffb000) splice(r1, 0x0, r2, 0x0, 0x9, 0x4) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r3, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000080)=ANY=[@ANYRESHEX=r3], 0xb0}, 0x1, 0x0, 0x0, 0x81}, 0x40800) write(r0, 0x0, 0x0) 2.453608443s ago: executing program 3 (id=2287): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = socket$nl_generic(0x10, 0x3, 0x10) socket$nl_netfilter(0x10, 0x3, 0xc) (async) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r2, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x0) sendmsg$NFT_BATCH(r2, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f0000000100)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a4c000000090a010400000000000000000a0000040900010073797a310000000008000540000000020900020073797a310000000008000a40fffffffc080003400000001408000c4000000e45400000000c0a010100000000000000000a0000060900020073797a31000000000900010073797a310000000014000380100000800c00018006000100d103000014000000110001"], 0xb4}, 0x1, 0x0, 0x0, 0x4000850}, 0x40) sendmsg$NFT_BATCH(r2, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000340)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x3}}, [@NFT_MSG_NEWSETELEM={0x5c, 0xc, 0xa, 0x101, 0x0, 0x0, {0xa, 0x0, 0x6}, [@NFTA_SET_ELEM_LIST_SET={0x9, 0x2, 'syz1\x00'}, @NFTA_SET_ELEM_LIST_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_SET_ELEM_LIST_ELEMENTS={0x30, 0x3, 0x0, 0x1, [{0x1c, 0x0, 0x0, 0x1, [@NFTA_SET_ELEM_KEY={0xc, 0x1, 0x0, 0x1, [@NFTA_DATA_VALUE={0x6, 0x1, "d103"}]}, @NFTA_SET_ELEM_TIMEOUT={0xc, 0x4, 0x1, 0x0, 0x2df31ab3}]}, {0xc, 0x0, 0x0, 0x1, [@NFTA_SET_ELEM_FLAGS={0x8, 0x3, 0x1, 0x0, 0x2}]}, {0x20}]}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x1}}}, 0x84}, 0x1, 0x0, 0x0, 0x4000850}, 0x40) (async) sendmsg$NFT_BATCH(r2, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000340)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x3}}, [@NFT_MSG_NEWSETELEM={0x5c, 0xc, 0xa, 0x101, 0x0, 0x0, {0xa, 0x0, 0x6}, [@NFTA_SET_ELEM_LIST_SET={0x9, 0x2, 'syz1\x00'}, @NFTA_SET_ELEM_LIST_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_SET_ELEM_LIST_ELEMENTS={0x30, 0x3, 0x0, 0x1, [{0x1c, 0x0, 0x0, 0x1, [@NFTA_SET_ELEM_KEY={0xc, 0x1, 0x0, 0x1, [@NFTA_DATA_VALUE={0x6, 0x1, "d103"}]}, @NFTA_SET_ELEM_TIMEOUT={0xc, 0x4, 0x1, 0x0, 0x2df31ab3}]}, {0xc, 0x0, 0x0, 0x1, [@NFTA_SET_ELEM_FLAGS={0x8, 0x3, 0x1, 0x0, 0x2}]}, {0x20}]}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x1}}}, 0x84}, 0x1, 0x0, 0x0, 0x4000850}, 0x40) r3 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_fanout(r3, 0x107, 0x12, &(0x7f0000000100)={0x0, 0x7}, 0x4) (async) setsockopt$packet_fanout(r3, 0x107, 0x12, &(0x7f0000000100)={0x0, 0x7}, 0x4) bind$packet(r3, &(0x7f00000003c0)={0x11, 0xf7, 0x0, 0x1, 0x3, 0x6, @random="38bb015489e4"}, 0x14) syz_genetlink_get_family_id$tipc2(&(0x7f0000000040), r1) (async) syz_genetlink_get_family_id$tipc2(&(0x7f0000000040), r1) r4 = socket$rxrpc(0x21, 0x2, 0x2) sendmsg(r4, &(0x7f0000000200)={&(0x7f0000000100)=@rxrpc=@in4={0x21, 0x1, 0x2, 0x10, {0x2, 0x1234, @loopback}}, 0x80, 0x0, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="1800000000000000100100000100"], 0x18}, 0x0) sendmsg(r4, &(0x7f0000000a00)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000b00)=[{0x18, 0x110, 0x1, 'd\x00\x00\x00\x00\x00\x00\x00'}, {0x14, 0x110, 0x2, "01000000"}], 0x2c}, 0x0) sendmsg$TIPC_NL_BEARER_ENABLE(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000002c0)=ANY=[@ANYBLOB='l\x00\x00\x00', @ANYRES32=r2, @ANYBLOB="01000000000000000000030000005800018044000400200001000a7aadf991fd2e9ba10000c0a9000000000000000000000100000000120002000a00000000000000fe8000000000000000000000000000bb000000000d0001007564703a73"], 0x6c}}, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000440)={0x1, 0x4, &(0x7f0000000140)=ANY=[@ANYBLOB="180000000000000000bcd27dd9a156559ac53f6cf5000000000000007301f8ff"], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x17, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0xfffffffe}, 0x94) (async) bpf$PROG_LOAD(0x5, &(0x7f0000000440)={0x1, 0x4, &(0x7f0000000140)=ANY=[@ANYBLOB="180000000000000000bcd27dd9a156559ac53f6cf5000000000000007301f8ff"], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x17, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0xfffffffe}, 0x94) 2.451229097s ago: executing program 1 (id=2288): r0 = socket(0x11, 0x3, 0x0) setsockopt(r0, 0x107, 0xf, &(0x7f0000000100)="00008634", 0x4) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r1, 0x0, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000180)={'veth0\x00', 0x0}) sendmsg(r0, &(0x7f0000000100)={&(0x7f0000000040)=@ll={0x11, 0x3, r2, 0x1, 0xe5, 0x6, @broadcast}, 0x80, &(0x7f0000000240)=[{&(0x7f00000003c0)="020195ff002d3922ff65b4355e953d23d254f00000000000", 0x18}, {&(0x7f00000001c0)="2cf2565b0e508224b706a643e98dc932f5fc6d8e51626cdbf9ff02dbb8b2d2ca2be0dfa8f2a777f680c590257a0641579678f72a6ff270a8989633cbe781bf372d4a0e61", 0xff87}], 0x2}, 0x44000) recvfrom$l2tp(r0, &(0x7f0000000300)=""/158, 0x9e, 0x100, &(0x7f00000003c0)={0x2, 0x0, @remote}, 0x10) ioctl$FS_IOC_GETFSLABEL(0xffffffffffffffff, 0x400452c9, 0x0) r3 = socket(0x1e, 0x4, 0x0) sendmmsg(r3, &(0x7f00000030c0)=[{{0x0, 0xa9cc7003, &(0x7f0000000400)=[{&(0x7f00000000c0)="ee", 0x101d0}], 0x1}}], 0x400000000000181, 0x9200000000000000) syz_genetlink_get_family_id$batadv(&(0x7f00000002c0), r3) bpf$PROG_LOAD(0x5, 0x0, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r4 = socket(0x10, 0x803, 0x0) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000a40)=@newqdisc={0x2c, 0x24, 0x4ee4e6a52ff5653f, 0x70bd2d, 0x25dfdbfc, {0x0, 0x0, 0x0, 0x0, {0x0, 0x9}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_drr={0x8}]}, 0x2c}, 0x1, 0x0, 0x0, 0x81}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000006040)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000040)=@newtfilter={0x34, 0x2c, 0xd3f, 0x70bd25, 0x25dfdbfb, {0x0, 0x0, 0x0, 0x0, {0xc, 0xc}, {0x0, 0x9}, {0xf, 0x9}}, [@filter_kind_options=@f_flower={{0xb}, {0x4}}]}, 0x34}, 0x1, 0x0, 0x0, 0x1}, 0x20040014) sendmsg$nl_route_sched(r4, &(0x7f0000006040)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000040)=@newtfilter={0x24, 0x2c, 0xd3f, 0x70bd25, 0x25dfdbfb, {0x0, 0x0, 0x0, r5, {0xfff1, 0xc}, {0x0, 0x9}, {0xf, 0xfff3}}}, 0x24}}, 0x20040014) r6 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) ioctl$TUNSETIFF(r6, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r7 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x202000, 0x0) close(r7) r8 = socket$nl_route(0x10, 0x3, 0x0) r9 = socket$unix(0x1, 0x1, 0x0) ioctl$NILFS_IOCTL_GET_SUINFO(r8, 0x80186e84, 0x0) ioctl$sock_SIOCGIFINDEX(r9, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r8, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000140)=@newqdisc={0x44, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0xffffffff, {0x0, 0x0, 0x0, r10, {0x0, 0xfff1}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_hfsc={{0x9}, {0x14, 0x2, @TCA_HFSC_FSC={0x10, 0x2, {0x4d, 0xfffffffb, 0x7fffffff}}}}]}, 0x44}, 0x1, 0x0, 0x0, 0x4000000}, 0x20040084) ioctl$SIOCSIFHWADDR(r7, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) socket(0x400000000010, 0x3, 0x0) 2.3741709s ago: executing program 4 (id=2289): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000080)={'syzkaller0\x00', 0x7101}) r1 = socket(0x400000000010, 0x3, 0x0) bind$tipc(0xffffffffffffffff, 0x0, 0x0) bind$tipc(0xffffffffffffffff, &(0x7f00000000c0)=@name={0x1e, 0x2, 0x0, {{0x42, 0x3}, 0x2}}, 0x10) r2 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$DEVLINK_CMD_RATE_GET(r2, 0x0, 0x0) r3 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f00000003c0)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r1, &(0x7f00000012c0)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000480)=@newqdisc={0x44, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0xffffffff, {0x0, 0x0, 0x0, r4, {0x0, 0xfff1}, {0xffff, 0xffff}, {0xffe0}}, [@qdisc_kind_options=@q_hfsc={{0x9}, {0x14, 0x2, @TCA_HFSC_FSC={0x10, 0x2, {0x7, 0x2, 0x1}}}}]}, 0x44}, 0x1, 0x0, 0x0, 0x4040001}, 0x0) r5 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) r7 = socket(0x400000000010, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r7, 0x8933, &(0x7f0000000380)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r7, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000580)=@newtfilter={0x3c, 0x2c, 0xd27, 0x70bd2b, 0x2, {0x0, 0x0, 0x0, r8, {0x0, 0x10}, {}, {0x8, 0xffe0}}, [@filter_kind_options=@f_flower={{0xb}, {0xc, 0x2, [@TCA_FLOWER_KEY_PORT_DST_MAX={0x6, 0x5a, 0x4e20}]}}]}, 0x3c}, 0x1, 0x0, 0x0, 0x20048800}, 0x0) sendmsg$nl_route_sched(r7, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000540)={&(0x7f0000000b00)=@newqdisc={0x24, 0x29, 0x4ee4e6a52ff56541, 0x4001, 0xfffdfdfc, {0x0, 0x0, 0x0, r6, {}, {0xffff, 0xffff}, {0xffff, 0xfff2}}}, 0x24}, 0x1, 0x0, 0x0, 0x400c0}, 0x44840) ioctl$sock_SIOCGIFVLAN_ADD_VLAN_CMD(0xffffffffffffffff, 0x8982, 0x0) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000380)={0x18, 0x7, &(0x7f0000000040)=ANY=[@ANYBLOB="18000000000000000000000000000000e5000300000000000600000000000000250000001000000006000000faffffff95"], &(0x7f0000000140)='GPL\x00', 0x0, 0x0, 0x0, 0x40f00, 0x8, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x7}, 0x94) 2.17179378s ago: executing program 3 (id=2291): socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) splice(r1, 0x0, r2, 0x0, 0x6, 0x0) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='memory.events\x00', 0x275a, 0x0) write$cgroup_subtree(r3, &(0x7f0000000280)=ANY=[], 0x10448) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x2000001, 0x12, r3, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000340)={&(0x7f0000000280)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0xc, 0xc, 0x5, [@enum64={0x2, 0x0, 0x0, 0x13, 0x0, 0x8}]}, {0x0, [0x61, 0x61, 0x2e]}}, 0x0, 0x29, 0x0, 0x1, 0x9b2987a6}, 0x28) write$cgroup_devices(r2, &(0x7f00000000c0)=ANY=[], 0x6) write(r0, 0x0, 0x0) mmap(&(0x7f00009fd000/0x600000)=nil, 0x600000, 0x100000d, 0x6031, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x3000007, 0x31, r2, 0x0) r4 = socket$inet_udp(0x2, 0x2, 0x0) getsockopt$inet_buf(r4, 0x0, 0x20, 0x0, &(0x7f0000002680)) 2.095000179s ago: executing program 2 (id=2292): bpf$PROG_LOAD(0x5, &(0x7f0000000480)={0xc, 0xc, &(0x7f0000000000)=ANY=[@ANYBLOB="180000000000000000000000000000008500000018000000180100002020702500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b70300000000000085000000b000000095"], &(0x7f0000000200)='GPL\x00', 0x1, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, @fallback=0x2b, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value=0x3f000000}, 0x94) 2.00838959s ago: executing program 1 (id=2293): r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='memory.events\x00', 0x275a, 0x0) mmap(&(0x7f0000002000/0x4000)=nil, 0x4000, 0xedc623580215bdcd, 0x12, r0, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000440)={0x13, 0x13, &(0x7f0000000080)=ANY=[@ANYBLOB="18080000fa0000000000000000ff003e851000000600000018000000", @ANYRES32, @ANYBLOB="0000000000000000660800000000000018000000fffe000000000000000000009500000000000000360a020000000000180100002020782500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b50afdffffff000085000000060000009500000000000000"], &(0x7f0000000000)='GPL\x00', 0x2, 0xff5c, &(0x7f00000001c0)=""/222, 0x41100, 0x8, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0xffffffe8, 0x0, 0xffffffffffffff97}, 0x78) 1.983056982s ago: executing program 2 (id=2294): r0 = bpf$MAP_CREATE(0x0, &(0x7f0000001000)=@base={0xa, 0x4, 0x8, 0xa, 0x0, 0xffffffffffffffff, 0xfffffffd}, 0x50) r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000740)=ANY=[@ANYBLOB="0600000004000000040000000001"], 0x50) r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000140)=ANY=[@ANYBLOB="0100000004000000040000000001"], 0x48) bpf$MAP_CREATE(0x0, 0x0, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000001c0)={0x1, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="18000000000000000000000000000000611800000000000018110000", @ANYRES32=r1, @ANYBLOB="0000000000000000150802000000000018110000", @ANYRES32=r2, @ANYBLOB="0000000000000000bfa200000000000007020000f8ffffff850000000300000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0xa, 0x4, &(0x7f0000000480)=ANY=[@ANYBLOB="18000000000000000000000000000000850000006d"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x20, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0x14, &(0x7f0000000400)=ANY=[@ANYBLOB="18000000000000000000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b7040000000000008500000001"], 0x0, 0x0, 0x0, 0x0, 0x0, 0xb, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r3 = bpf$PROG_LOAD(0x5, &(0x7f0000000680)={0x11, 0x14, &(0x7f0000000400)=ANY=[], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x40f03, 0xe, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$PROG_BIND_MAP(0xa, &(0x7f00000004c0)={r3}, 0xc) 1.871725278s ago: executing program 2 (id=2295): r0 = socket$inet6_sctp(0xa, 0x1, 0x84) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r0, 0x84, 0x6f, 0x0, &(0x7f00000002c0)) r1 = socket$inet6_sctp(0xa, 0x5, 0x84) close(0x3) r2 = socket(0x2, 0x80805, 0x0) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r3, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r4 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) close(r4) r5 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r5, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000680)=@newqdisc={0x68, 0x24, 0x4ee4e6a52ff56541, 0x1, 0x25dfdbfd, {0x0, 0x0, 0x0, r6, {0x0, 0xb}, {0xffff, 0xffff}, {0xfff2}}, [@qdisc_kind_options=@q_netem={{0xa}, {0x38, 0x2, {{0x3, 0x8000003, 0x1, 0x1, 0x8, 0x3}, [@TCA_NETEM_REORDER={0xc, 0x3, {0x9e, 0x7}}, @TCA_NETEM_CORR={0x10, 0x1, {0xa, 0xa, 0xeb04}}]}}}]}, 0x68}, 0x1, 0x0, 0x0, 0x40088c1}, 0x0) ioctl$SIOCSIFHWADDR(r4, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) r7 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r7, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) r9 = socket$packet(0x11, 0x3, 0x300) sendto$packet(r9, &(0x7f0000000440)="80", 0x1, 0x40, &(0x7f00000001c0)={0x11, 0x8100, r8, 0x1, 0xd8, 0x6, @broadcast}, 0x14) r10 = socket$inet6_sctp(0xa, 0x5, 0x84) shutdown(r10, 0x0) close(0x3) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r10, 0x84, 0x6f, &(0x7f0000000200)={0x0, 0x10, &(0x7f00000001c0)=[@in={0x2, 0x4e23, @rand_addr=0x64010100}]}, &(0x7f0000000140)=0x10) r12 = socket$nl_generic(0x10, 0x3, 0x10) r13 = syz_genetlink_get_family_id$devlink(&(0x7f00000000c0), 0xffffffffffffffff) sendmsg$DEVLINK_CMD_PORT_SET(r12, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000140)=ANY=[@ANYBLOB='@\x00\x00\x00', @ANYRES16=r13, @ANYBLOB="010029bd7000fcdbdf250600000008000100"], 0x40}, 0x1, 0x0, 0x0, 0x880}, 0x50) getsockopt$inet_sctp6_SCTP_PRIMARY_ADDR(r10, 0x84, 0x7a, &(0x7f0000000340)={r11, @in6={{0xa, 0x3, 0x4, @mcast1}}}, &(0x7f0000000040)=0x84) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r12, 0x8933, &(0x7f0000000280)) sendmmsg$inet_sctp(r2, &(0x7f00000032c0)=[{0x0, 0x0, 0x0, 0x0, &(0x7f0000000700)=ANY=[@ANYBLOB="30000000000000008400000001000000000000017c"], 0x30}], 0x1, 0x0) getsockopt$inet_sctp6_SCTP_DEFAULT_SNDINFO(r1, 0x84, 0x22, &(0x7f0000000080)={0x0, 0x0, 0x3, 0xe0d9, r14}, &(0x7f0000000100)=0x10) 1.828676758s ago: executing program 1 (id=2296): bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000440)={0x11, 0x13, &(0x7f0000000080)=ANY=[@ANYBLOB="18080000000010c30000000003000000851000000600000018000000", @ANYRES32, @ANYBLOB="00000000000000116608000000000100180000000000000000000000000010009500000000000000360a020000000001180100002020782500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b50a00000000000085000000060000009500000000000000"], &(0x7f0000000000)='GPL\x00', 0xa, 0xff5c, &(0x7f0000000340)=""/222, 0x0, 0x8}, 0x78) r0 = socket$kcm(0x10, 0x2, 0x4) r1 = socket$inet_mptcp(0x2, 0x1, 0x106) listen(r1, 0x2) syz_80211_inject_frame(0x0, &(0x7f0000000340)=ANY=[@ANYBLOB="5809040050505050505008021100000008021100000178005a0e3269ef10d89883c73a68"], 0x80) sendmsg$ETHTOOL_MSG_STRSET_GET(0xffffffffffffffff, &(0x7f00000004c0)={0x0, 0x0, &(0x7f0000000480)={&(0x7f0000000300)=ANY=[@ANYRES16, @ANYBLOB="00012cbd7000ffdbdf25010000004c0002803c00018008000100040000000800010002000000080001000600000008000100070000000800010012034e05080001000800000008000100080000000c0001800800010005000000080002800400"], 0x68}, 0x1, 0x0, 0x0, 0x40005}, 0x8044) syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10) (async) r2 = syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10) sendmsg$netlink(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f00000000c0)=[{&(0x7f0000000340)=ANY=[@ANYBLOB="180100003000010003000000fbdbdf2506"], 0x118}], 0x1, 0x0, 0x0, 0x1}, 0x0) r3 = socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200), r3) ioctl$sock_SIOCGIFINDEX_80211(r3, 0x8933, &(0x7f0000000080)={'wlan0\x00'}) (async) ioctl$sock_SIOCGIFINDEX_80211(r3, 0x8933, &(0x7f0000000080)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_NEW_INTERFACE(r3, &(0x7f00000000c0)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000140)=ANY=[@ANYBLOB='X\x00\x00\x00', @ANYRES16=r4, @ANYBLOB="090d2000000000f0ff000700000008000300", @ANYRES32=r5, @ANYBLOB="0800051d000000001400060076657468115f746f5f7465616d0000000400cc0008000500090000001400040073"], 0x58}}, 0x0) r6 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl80211(&(0x7f00000000c0), 0xffffffffffffffff) (async) r7 = syz_genetlink_get_family_id$nl80211(&(0x7f00000000c0), 0xffffffffffffffff) r8 = socket$netlink(0x10, 0x3, 0x0) socket$inet(0x2, 0x4000000000000001, 0x0) (async) r9 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r9, 0x6, 0x80000000000002, &(0x7f00000004c0)=0x79, 0x4) (async) setsockopt$inet_tcp_int(r9, 0x6, 0x80000000000002, &(0x7f00000004c0)=0x79, 0x4) bind$inet(r9, &(0x7f0000000080)={0x2, 0x4e23, @multicast1}, 0x10) setsockopt$SO_ATTACH_FILTER(r9, 0x1, 0x1a, &(0x7f0000000000)={0x1, &(0x7f0000000280)=[{0x6, 0xfa, 0x0, 0xe4}]}, 0x10) sendto$inet(r9, 0x0, 0x0, 0x200007fd, 0x0, 0x0) sendmmsg$inet(r9, &(0x7f0000001240)=[{{0x0, 0x0, &(0x7f0000001dc0)=[{&(0x7f0000001440)="91f8a9849519def2f8eb48d9173c3d6f357d0272b7319130feaab952ac4703cad04be68907e50e997fc26e4c91ea4feb931647fc5393de25000000000000000000f38a6a4cb6b275ee91bd0196db0af38f2665cbbb4e66534143d02eac997657cf0a3df3cc8df5281ca813b255039632532f021a46b78fb7892513e49b3af0f59c39d0edaaf273933db78b8653e664f28ca6a3f8803662958348e8bef4a1370e5fc0c803eeb368fa89f78a1b167d80b9e42486e2965156a4a2383c8682df617947d6b3b50f", 0xc5}], 0x1}}], 0x1, 0x0) sendto$inet(r9, &(0x7f0000000580)="17", 0x59a, 0x10008095, 0x0, 0x0) (async) sendto$inet(r9, &(0x7f0000000580)="17", 0x59a, 0x10008095, 0x0, 0x0) sendmsg$nl_route_sched(r8, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000005c00)={&(0x7f0000000000)=@newtaction={0xa0, 0x30, 0x9, 0x0, 0x0, {}, [{0x8c, 0x1, [@m_bpf={0x88, 0x1, 0x0, 0x0, {{0x8}, {0x60, 0x2, 0x0, 0x1, [@TCA_ACT_BPF_OPS_LEN={0x6, 0x3, 0x7}, @TCA_ACT_BPF_OPS={0x3c, 0x4, [{0x35, 0x0, 0x1, 0xfffffffd}, {}, {0x3d}, {}, {}, {}, {0x6}]}, @TCA_ACT_BPF_PARMS={0x18}]}, {0x4}, {0xc}, {0xc}}}]}]}, 0xa0}}, 0x8000) r10 = socket$alg(0x26, 0x5, 0x0) bind$alg(r10, &(0x7f0000000100)={0x26, 'hash\x00', 0x0, 0x0, 'sha512\x00'}, 0x58) (async) bind$alg(r10, &(0x7f0000000100)={0x26, 'hash\x00', 0x0, 0x0, 'sha512\x00'}, 0x58) setsockopt$ALG_SET_KEY(r10, 0x117, 0x7, &(0x7f00000000c0)="0300ff04", 0x4) ioctl$sock_SIOCGIFINDEX_80211(r6, 0x8933, &(0x7f0000000680)={'wlan0\x00'}) (async) ioctl$sock_SIOCGIFINDEX_80211(r6, 0x8933, &(0x7f0000000680)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_NEW_INTERFACE(r6, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000000)=ANY=[@ANYBLOB='D\x00\x00\x00', @ANYRES16=r7, @ANYBLOB="010028bd7000fddbdf250700000008000300", @ANYRES32=r11, @ANYBLOB="0c00990008000000300000001400040073797a6b616c6c657242000000000000080005000400"], 0x44}, 0x1, 0x0, 0x0, 0x81}, 0x24044884) (async) sendmsg$NL80211_CMD_NEW_INTERFACE(r6, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000000)=ANY=[@ANYBLOB='D\x00\x00\x00', @ANYRES16=r7, @ANYBLOB="010028bd7000fddbdf250700000008000300", @ANYRES32=r11, @ANYBLOB="0c00990008000000300000001400040073797a6b616c6c657242000000000000080005000400"], 0x44}, 0x1, 0x0, 0x0, 0x81}, 0x24044884) sendmsg$kcm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)=[{&(0x7f0000000340)="89000000120081ae08061cdc030ec080000000080000000000e2ffca1b1f0000000004c00e72f750375ed08a56331dbf9ed7815e381ad6e747033a0093b837dc6cc01e32efaec8c7a6ec08120800030006010000bdad446b9bbc7a46e3988285dcdf12f2130809d78f0a947ee2b49e33538afa8af92347514f0b", 0x7a}], 0x1}, 0x0) syz_genetlink_get_family_id$team(&(0x7f0000000240), r0) (async) syz_genetlink_get_family_id$team(&(0x7f0000000240), r0) 1.712737934s ago: executing program 4 (id=2298): r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) sendmsg$NL80211_CMD_CRIT_PROTOCOL_START(r1, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000540)={0x0, 0x1c}}, 0x0) getsockname$packet(r1, &(0x7f0000000600)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000080)=0x14) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000640)=ANY=[@ANYBLOB="3c0000001000850600000000ff6122314a000800", @ANYRES32=r2, @ANYBLOB="f5ff0f00252155b21c0012000c000100626f6e64000000000c0002000800010001"], 0x3c}}, 0x40000) r3 = bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000780)={0x6, 0x4, &(0x7f0000000580)=ANY=[@ANYBLOB="18020000000000020000000000000000850000001700000095"], &(0x7f00000005c0)='GPL\x00'}, 0x94) r4 = socket(0x10, 0x803, 0x8) sendmsg$IPVS_CMD_SET_INFO(r4, &(0x7f0000000b00)={0x0, 0x0, &(0x7f0000000ac0)={0x0, 0x2d}, 0x1, 0x0, 0x0, 0x8801}, 0x8000) getsockname$packet(r4, &(0x7f0000000600)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000180)=0x14) bpf$LINK_GET_NEXT_ID(0x1f, &(0x7f0000000100)={0x2}, 0x8) bpf$BPF_PROG_QUERY(0x10, &(0x7f0000000440)={@fallback=r0, 0xe, 0x0, 0x40, &(0x7f00000001c0)=[0x0], 0x1, 0x0, &(0x7f0000000380)=[0x0, 0x0, 0x0, 0x0], &(0x7f00000003c0)=[0x0, 0x0, 0x0, 0x0], &(0x7f0000000400)=[0x0]}, 0x40) bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f0000000280)={r3, r2, 0x25, 0xf, @val=@kprobe_multi=@addrs={0x0, 0x0, 0x0, &(0x7f0000000240)=[0x81, 0xd5], 0xcf8}}, 0x1c) r5 = socket$netlink(0x10, 0x3, 0x0) r6 = socket(0x10, 0x803, 0x4) sendmsg$IPVS_CMD_SET_INFO(r6, &(0x7f0000000b00)={0x0, 0x0, &(0x7f0000000ac0)={0x0, 0x14}}, 0x0) getsockname$packet(r6, &(0x7f0000000340)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x66) sendmsg$nl_route(r5, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000001440)=@newlink={0x50, 0x10, 0xffffff1f, 0x0, 0x80, {0x0, 0x0, 0x0, 0x0, 0x300, 0x17e05}, [@IFLA_MASTER={0x8, 0xa, r7}, @IFLA_LINKINFO={0x28, 0x12, 0x0, 0x1, @veth={{0x9}, {0x18, 0x2, 0x0, 0x1, @val=@VETH_INFO_PEER={0x14, 0x1, {{0x0, 0x0, 0x0, 0x0, 0x800, 0x640}}}}}}]}, 0x50}, 0x1, 0x0, 0x0, 0x2000c0c1}, 0x0) 1.411687502s ago: executing program 2 (id=2299): r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$IPVS_CMD_NEW_SERVICE(r0, &(0x7f0000000500)={0x0, 0x0, &(0x7f0000000600)={&(0x7f0000000700)={0x68, 0x0, 0x5, 0x0, 0x0, {0x1, 0x1}, [@IPVS_CMD_ATTR_SERVICE={0x54, 0x1, 0x0, 0x1, [@IPVS_SVC_ATTR_AF={0x6, 0x1, 0xa}, @IPVS_SVC_ATTR_PROTOCOL={0x6, 0x2, 0x6}, @IPVS_SVC_ATTR_ADDR={0x14, 0x3, @ipv6=@local}, @IPVS_SVC_ATTR_PORT={0x6, 0x4, 0x50}, @IPVS_SVC_ATTR_SCHED_NAME={0x7, 0x6, 'rr\x00'}, @IPVS_SVC_ATTR_FLAGS={0xc, 0x7, {0x1, 0x1}}, @IPVS_SVC_ATTR_TIMEOUT={0x8}, @IPVS_SVC_ATTR_NETMASK={0x8, 0x9, 0x80}]}]}, 0x68}}, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) close(r1) r2 = socket$inet6_mptcp(0xa, 0x1, 0x106) bind$inet6(r1, &(0x7f0000000040)={0xa, 0x4e22, 0x0, @empty, 0x200}, 0x1c) listen(r2, 0x0) r3 = socket$inet_mptcp(0x2, 0x1, 0x106) connect$inet(r3, &(0x7f0000000000)={0x2, 0x4e22, @empty}, 0x10) mmap(&(0x7f0000001000/0xc00000)=nil, 0xc00000, 0x0, 0x3032, 0xffffffffffffffff, 0x0) r4 = socket$kcm(0x11, 0x3, 0x0) setsockopt$sock_attach_bpf(r4, 0x107, 0xf, &(0x7f0000000000), 0x4) sendmsg$kcm(r4, &(0x7f0000000100)={&(0x7f0000000180)=@hci={0x1f, 0x0, 0x5}, 0x80, &(0x7f0000000140)=[{&(0x7f0000001280)="27050200340f3c0006000b2fb96dbcf706060000170000", 0x17}, {0x0}], 0x2}, 0x9cdc2384056f4939) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={0x0}, 0x1, 0x0, 0x0, 0x24040080}, 0x20040004) r5 = accept(r2, 0x0, 0x0) sendmsg$TEAM_CMD_OPTIONS_SET(r5, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000440)={&(0x7f00000004c0)=ANY=[], 0xfffffdef}, 0x1, 0x0, 0x0, 0x2400c840}, 0x0) r6 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000280), r5) sendmsg$MPTCP_PM_CMD_ANNOUNCE(r5, &(0x7f00000004c0)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x20000}, 0xc, &(0x7f0000000480)={&(0x7f0000000140)={0x98, r6, 0x8, 0x70bd29, 0x25dfdbfe, {}, [@MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x4}, @MPTCP_PM_ATTR_ADDR_REMOTE={0x3c, 0x6, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_PORT={0x6, 0x5, 0x4e21}, @MPTCP_PM_ADDR_ATTR_ID={0x5, 0x2, 0x7f}, @MPTCP_PM_ADDR_ATTR_ID={0x5, 0x2, 0x5}, @MPTCP_PM_ADDR_ATTR_ADDR4={0x8, 0x3, @multicast1}, @MPTCP_PM_ADDR_ATTR_FAMILY={0x6, 0x1, 0xa}, @MPTCP_PM_ADDR_ATTR_ADDR4={0x8, 0x3, @dev={0xac, 0x14, 0x14, 0x3c}}, @MPTCP_PM_ADDR_ATTR_FLAGS={0x8, 0x6, 0x1}]}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x7}, @MPTCP_PM_ATTR_LOC_ID={0x5, 0x5, 0x44}, @MPTCP_PM_ATTR_ADDR_REMOTE={0x28, 0x6, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_FAMILY={0x6, 0x1, 0x2}, @MPTCP_PM_ADDR_ATTR_ID={0x5, 0x2, 0x80}, @MPTCP_PM_ADDR_ATTR_ADDR6={0x14, 0x4, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}}]}, @MPTCP_PM_ATTR_TOKEN={0x8, 0x4, 0x1}]}, 0x98}, 0x1, 0x0, 0x0, 0x2004c000}, 0xf0) syz_emit_ethernet(0x0, 0x0, 0x0) r7 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x4a241, 0x0) r8 = socket$inet6(0xa, 0x5, 0x0) setsockopt$sock_int(r8, 0x1, 0xf, &(0x7f0000fee000)=0x3fa, 0x4) bind$inet6(r8, &(0x7f0000000100)={0xa, 0x4e23, 0x8001, @empty, 0xffffff5d}, 0x1c) listen(r8, 0x50) r9 = socket$inet6(0xa, 0x5, 0x0) setsockopt$sock_int(r9, 0x1, 0xf, &(0x7f0000fee000)=0x3fa, 0x4) bind$inet6(r9, &(0x7f0000000140)={0xa, 0xe23, 0x5, @empty, 0x4}, 0x1c) listen(r9, 0x50) ioctl$TUNSETIFF(r7, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x8, 0x32, 0xffffffffffffffff, 0x0) 1.376688674s ago: executing program 0 (id=2300): sendmmsg(0xffffffffffffffff, &(0x7f000000a540)=[{{0x0, 0x0, &(0x7f0000000700)=[{0x0}], 0x1}}], 0x1, 0x41) r0 = socket$can_j1939(0x1d, 0x2, 0x7) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f00000000c0)={'vcan0\x00', 0x0}) bind$can_j1939(r0, &(0x7f0000000340)={0x1d, r1, 0x0, {0x2, 0x0, 0x6}, 0xfe}, 0x18) setsockopt$sock_int(r0, 0x1, 0x6, &(0x7f0000000040)=0x1, 0x4) mmap(0x0, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r2 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL80211_CMD_SET_INTERFACE(r2, 0x0, 0x0) r3 = socket$pppoe(0x18, 0x1, 0x0) connect$pppoe(r3, &(0x7f0000000040)={0x18, 0x0, {0x4, @empty, 'veth0_to_team\x00'}}, 0x1e) ioctl$PPPIOCSMRU(r3, 0x40047452, 0x0) sendmmsg$sock(r0, &(0x7f0000007480), 0x29e15b2, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000680)={0x11, 0x3, &(0x7f0000000180)=ANY=[], &(0x7f0000000080)='GPL\x00', 0x7, 0x0, 0x0, 0x40f00, 0x5, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0xfffffffb}, 0x94) mmap(0x0, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) 1.311749273s ago: executing program 3 (id=2301): r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000080)={&(0x7f00000000c0)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0x18, 0x18, 0x2, [@array={0x0, 0x0, 0x0, 0x3, 0x0, {0x3, 0x10000003}}]}}, &(0x7f0000000140)=""/240, 0x32, 0xf0, 0x1}, 0x20) bind$bt_hci(r0, &(0x7f00000000c0)={0x1f, 0x0, 0x1}, 0x6) r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r1, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000780)=@newlink={0x278, 0x10, 0x403, 0x70bd2d, 0x25dfdbfb, {0x0, 0x0, 0x4, 0x0, 0x262cd, 0x80}, [@IFLA_VF_PORTS={0x244, 0x18, 0x0, 0x1, [{0x74, 0x1, 0x0, 0x1, [@IFLA_PORT_INSTANCE_UUID={0x14, 0x4, "476230d549f9b9e29afe0b195f5a0caa"}, @IFLA_PORT_INSTANCE_UUID={0x14, 0x4, "e6015224192244f69197f8b77f905cfa"}, @IFLA_PORT_INSTANCE_UUID={0x14, 0x4, "cecb9b8e4b5e9b01f7abc4046253360a"}, @IFLA_PORT_PROFILE={0xf, 0x2, 'tunnel_key\x00'}, @IFLA_PORT_HOST_UUID={0x14, 0x5, "a87ea11f7ec25f7b01666d7c357aaafb"}, @IFLA_PORT_REQUEST={0x5, 0x6, 0x3}, @IFLA_PORT_VF={0x8, 0x1, 0x140}]}, {0x50, 0x1, 0x0, 0x1, [@IFLA_PORT_VF={0x8, 0x1, 0x7}, @IFLA_PORT_INSTANCE_UUID={0x14, 0x4, "3e2d208af47832092b5512ac6af2ce88"}, @IFLA_PORT_INSTANCE_UUID={0x14, 0x4, "3f732e92828b0838ba127a3ff9a87a28"}, @IFLA_PORT_VF={0x8, 0x1, 0x400}, @IFLA_PORT_HOST_UUID={0x14, 0x5, "e0cd87fb7957dcd1f45b1cdc12f077ae"}]}, {0x10, 0x1, 0x0, 0x1, [@IFLA_PORT_PROFILE={0xa, 0x2, '\'[#\'\xce\x00'}]}, {0x44, 0x1, 0x0, 0x1, [@IFLA_PORT_PROFILE={0xf, 0x2, 'tunnel_key\x00'}, @IFLA_PORT_REQUEST={0x5, 0x6, 0x81}, @IFLA_PORT_HOST_UUID={0x14, 0x5, "b990074c96a301d0aca9a0317f804c9d"}, @IFLA_PORT_INSTANCE_UUID={0x14, 0x4, "81d57e1a7b7ea4525037a6cbfd48b709"}]}, {0x40, 0x1, 0x0, 0x1, [@IFLA_PORT_REQUEST={0x5, 0x6, 0x5}, @IFLA_PORT_PROFILE={0x8, 0x2, 'GPL\x00'}, @IFLA_PORT_VF={0x8, 0x1, 0x9}, @IFLA_PORT_VF={0x8, 0x1, 0x7}, @IFLA_PORT_INSTANCE_UUID={0x14, 0x4, "0617d0ab271376b8f27bc7ae24a7ab6f"}, @IFLA_PORT_REQUEST={0x5, 0x6, 0x87}]}, {0x10, 0x1, 0x0, 0x1, [@IFLA_PORT_PROFILE={0x9, 0x2, '[*/@\x00'}]}, {0x80, 0x1, 0x0, 0x1, [@IFLA_PORT_INSTANCE_UUID={0x14, 0x4, "fdbc9b3bc6c355cbf9f6bbe0e21ef110"}, @IFLA_PORT_HOST_UUID={0x14, 0x5, "4a310d4b14bfea113d3cbed8f109410d"}, @IFLA_PORT_INSTANCE_UUID={0x14, 0x4, "55288de618b586b3891af71494c17ccf"}, @IFLA_PORT_HOST_UUID={0x14, 0x5, "3d81b16d63565c1012a01e9b9528ba62"}, @IFLA_PORT_REQUEST={0x5, 0x6, 0x4}, @IFLA_PORT_REQUEST={0x5, 0x6, 0xf0}, @IFLA_PORT_INSTANCE_UUID={0x14, 0x4, "a7af9cfb6e6ba11e266a28672e8bc2bd"}, @IFLA_PORT_VF={0x8, 0x1, 0x2}]}, {0x4}, {0x54, 0x1, 0x0, 0x1, [@IFLA_PORT_VF={0x8, 0x1, 0x6}, @IFLA_PORT_INSTANCE_UUID={0x14, 0x4, "e4fb8065be19122cdea064511b445b4b"}, @IFLA_PORT_PROFILE={0x6, 0x2, ',\x00'}, @IFLA_PORT_VF={0x8, 0x1, 0x1}, @IFLA_PORT_PROFILE={0x5, 0x2, '\x00'}, @IFLA_PORT_PROFILE={0x7, 0x2, '\r^\x00'}, @IFLA_PORT_INSTANCE_UUID={0x14, 0x4, "2f9b8d7ad2c78301b71964dbbe251f06"}]}]}, @IFLA_IFNAME={0x14, 0x3, 'veth0_to_hsr\x00'}]}, 0x278}, 0x1, 0x0, 0x0, 0x4004095}, 0x0) write(0xffffffffffffffff, &(0x7f00000002c0)="fc0000001c000704ab5b2509b868030002ab087a0100000001481093210001c0f0030584050060100000000000039815fa2c53c28648000000b9d95662537a00bc000c00f0ff7f0000b400600033d44000040560916a0033f436313012dafd5a32e273fc83ab82d710f74cec184406f90d435ef8b29d3ef3d92c94170e5bba2e177312e081bea05d3a021e8ca062914a46ccfc510bb73c9455cdc8363ae4f5df77bc4cfd6239ec2a0f0d1bcae5fa0f5f9dcdd51af51af8502943283f4bb102b2b8f5566791cf190201ded815b2ccd243f395ed94e0ad91bd6433802e0784f2013cd1890058a10000c880ac801fe4af000049f0d4796f0000090548de", 0xfc) r2 = socket$inet_tcp(0x2, 0x1, 0x0) r3 = socket$inet_icmp(0x2, 0x2, 0x1) ioctl$INCFS_IOC_GET_FILLED_BLOCKS(r3, 0x80286722, &(0x7f0000000600)={&(0x7f0000000480)=""/224, 0xe0, 0x5}) syz_init_net_socket$llc(0x1a, 0x801, 0x0) syz_genetlink_get_family_id$mptcp(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$MPTCP_PM_CMD_DEL_ADDR(0xffffffffffffffff, &(0x7f0000000240)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x800}, 0xc, 0x0, 0x1, 0x0, 0x0, 0x40011}, 0x1) r4 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r4, &(0x7f0000000c00)={0x0, 0x0, &(0x7f0000000100)={&(0x7f00000000c0)=ANY=[@ANYBLOB="240000002000010900000000ffdbd32502180000ff0000080000000208000100ac141400"], 0x24}}, 0x0) r5 = socket(0x840000000002, 0x3, 0x100) connect$inet(r2, &(0x7f0000000280)={0x2, 0x4e24, @multicast2}, 0x10) sendmmsg$inet(r5, &(0x7f0000005240), 0x4000095, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000140)={0x3, 0x4, &(0x7f0000000700)=ANY=[@ANYBLOB="1800000000000000000000000000000091118300"/32], &(0x7f0000000c40)='GPL\x00', 0x4, 0x0, 0x0, 0x41000, 0x4, '\x00', 0x0, @fallback=0x1d, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffff8}, 0x94) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000000)={0x0}, 0x1, 0x0, 0x0, 0x4000811}, 0x0) r6 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000003c0)=@newtaction={0x80, 0x30, 0x871a15abc695fb3d, 0x100, 0x0, {}, [{0x6c, 0x1, [@m_tunnel_key={0xffffffffffffff3b, 0x1, 0x0, 0x0, {{0xf}, {0x38, 0x2, 0x0, 0x1, [@TCA_TUNNEL_KEY_NO_CSUM={0x0, 0xa, 0x1}]}, {0x4}, {0xc, 0x7, {0x1}}, {0xc}}}]}]}, 0x80}, 0x1, 0x0, 0x0, 0x4}, 0x0) sendmmsg(r6, &(0x7f00000002c0), 0x40000000000009f, 0x0) setsockopt$inet_buf(r5, 0x0, 0x29, 0x0, 0x0) ioctl$sock_inet_SIOCSARP(r2, 0x8953, &(0x7f0000000180)={{0x2, 0x0, @empty}, {}, 0x0, {0x440, 0x0, @multicast1=0xe000cc02}}) r7 = syz_init_net_socket$x25(0x9, 0x5, 0x0) ioctl$sock_SIOCETHTOOL(r7, 0x8946, &(0x7f0000000080)={'dummy0\x00', &(0x7f0000000100)=@ethtool_rxfh={0x29, 0x2, 0x100100, 0xcb98, 0xc, "33e4a8", 0x6}}) r8 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) ioctl$TUNSETIFF(r8, 0x400454ca, &(0x7f0000000640)={'syzkaller0\x00', 0x1}) socket$inet6(0xa, 0x2, 0x0) socket$packet(0x11, 0x3, 0x300) 1.136252466s ago: executing program 4 (id=2302): r0 = socket$nl_route(0x10, 0x3, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000780)={0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @xdp, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r1 = socket$inet6_sctp(0xa, 0x1, 0x84) sendto$inet6(r1, &(0x7f0000847fff)='X', 0x1, 0x0, &(0x7f000005ffe4)={0xa, 0x0, 0x0, @loopback={0xe0ffffff00000000}}, 0x1c) setsockopt$inet_sctp6_SCTP_EVENTS(r1, 0x84, 0xb, 0x0, 0x0) recvmmsg(r1, &(0x7f0000000000)=[{{0x0, 0x0, 0x0}, 0xa}], 0x40000f6, 0x102, 0x0) shutdown(r1, 0x1) r2 = bpf$MAP_CREATE(0x0, &(0x7f00000001c0)=ANY=[@ANYBLOB="06000000040000000b0000000500"], 0x50) bpf$MAP_UPDATE_BATCH(0x1a, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000007c0), &(0x7f0000000380), 0x1000fff, r2, 0x0, 0xa0028000}, 0x86) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000080)={'bond0\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000580)={&(0x7f00000000c0)=@newlink={0x3c, 0x10, 0x403, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x215, 0x100000}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @ipoib={{0xa}, {0x4}}}, @IFLA_LINK={0x8, 0x5, r3}]}, 0x3c}, 0x1, 0xba01}, 0x0) 1.133618026s ago: executing program 0 (id=2303): r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000000)=ANY=[@ANYBLOB=' \x00\x00\x00f\x00\r\v'], 0x20}}, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000180)={'wlan0\x00', 0x0}) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r1, 0x8933, &(0x7f00000000c0)={'batadv0\x00', 0x0}) r4 = bpf$PROG_LOAD(0x5, &(0x7f00000004c0)={0x5, 0x5, &(0x7f0000000180)=ANY=[@ANYBLOB="180800000000000000000000000000001800000000000000000000000000000095"], &(0x7f0000000280)='syzkaller\x00', 0x0, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, @fallback=0x2f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x94) sendmsg$nl_route(r1, &(0x7f0000000340)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x4}, 0xc, &(0x7f00000002c0)={&(0x7f0000000240)=@getneigh={0x14, 0x1e, 0x20, 0x70bd2a, 0x9, {}, ["", "", ""]}, 0x14}, 0x1, 0x0, 0x0, 0x4004}, 0x811) r5 = bpf$ITER_CREATE(0xb, &(0x7f0000000100), 0x0) r6 = socket$inet6_sctp(0xa, 0x5, 0x84) sendmsg$nl_route(r6, &(0x7f0000000840)={0xfffffffffffffffd, 0x0, &(0x7f0000000800)={&(0x7f00000006c0)=@ipmr_delroute={0x114, 0x19, 0x504, 0x70bd28, 0x25dfdbff, {0x80, 0x14, 0x0, 0x9, 0xfe, 0x2, 0xff, 0x3, 0x2100}, [@RTA_METRICS={0xf0, 0x8, 0x0, 0x1, "46e8a1f448b194a2b361991c2c70acea0ad7569a535d7faa9e137e1ddb6edcffa83ab5efbb7024bbcd4ba32b0388ffadccbb58058f39fc262d4eaa0ee64c826db827dbb51b503b4c0322e2a1c575e777bf3a10b5c8a2184833de2280c5082fc2aa0b4a1127a73cef1599abf95aeb91b421169d1f780601efe1753d7138e20e66c4cb7d50cd724772dd161c37ed26aebb09b59a149777fca911e01ae39978c8427c7cebb91cbb9581c1d347c521f08d720acf8668641384079a52f5b15fe7cf1a47a00c93ee78c9ddc6666dfe42f75606358bb81458e0361d02333e2598d24b98ecb999f034f16d3cb85bcdd3"}, @RTA_PREFSRC={0x8, 0x7, @multicast2}]}, 0x114}}, 0x20000004) getsockopt$inet_sctp6_SCTP_PR_ASSOC_STATUS(r6, 0x84, 0x74, 0x0, &(0x7f0000000040)) close(r5) syz_open_procfs$namespace(0xffffffffffffffff, &(0x7f0000000300)='ns/net\x00') r7 = bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f00000003c0)=@bpf_lsm={0x1e, 0x3, &(0x7f00000000c0)=ANY=[@ANYBLOB="1800000000000000000000000000000095"], &(0x7f0000000280)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x24}, 0x80) bpf$BPF_PROG_TEST_RUN(0x1c, &(0x7f00000005c0)={r7, 0x0, 0x24, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, 0xa) bpf$LINK_GET_NEXT_ID(0x1f, &(0x7f0000000d00)={0x5, 0x0}, 0x8) r9 = bpf$LINK_GET_FD_BY_ID(0x1e, &(0x7f0000000380)=r8, 0x4) bpf$BPF_LINK_UPDATE(0x1d, &(0x7f0000000680)={r9, r4, 0x4, r7}, 0x10) sendmsg$nl_route(r1, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000100)={&(0x7f00000001c0)=ANY=[@ANYBLOB="4c0000001000010426bd7000fddbdf2500000000", @ANYRES32=0x0, @ANYBLOB="03000000000000001c0012800c0001006d6163766c616e000c000280080001000400000008000500", @ANYRES32=r2, @ANYBLOB='\b\x00\n\x00', @ANYRES32=r3], 0x4c}, 0x1, 0x0, 0x0, 0x8800}, 0x200040cc) 974.921137ms ago: executing program 3 (id=2304): bpf$PROG_LOAD(0x5, &(0x7f0000000480)={0xc, 0xc, &(0x7f0000000000)=ANY=[@ANYBLOB="180000000000000000000000000000008500000018000000180100002020702500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b70300000000000085000000b000000095"], &(0x7f0000000200)='GPL\x00', 0x1, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, @fallback=0x2b, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value=0x40000000}, 0x94) 886.545879ms ago: executing program 0 (id=2305): r0 = bpf$MAP_CREATE(0x0, &(0x7f0000001000)=@base={0xa, 0x4, 0x8, 0xa, 0x0, 0xffffffffffffffff, 0xfffffffd}, 0x50) r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000740)=ANY=[@ANYBLOB="0600000004000000040000000001"], 0x50) r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000140)=ANY=[@ANYBLOB="0100000004000000040000000001"], 0x48) bpf$MAP_CREATE(0x0, 0x0, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000001c0)={0x1, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="18000000000000000000000000000000611800000000000018110000", @ANYRES32=r1, @ANYBLOB="0000000000000000150802000000000018110000", @ANYRES32=r2, @ANYBLOB="0000000000000000bfa200000000000007020000f8ffffff850000000300000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0xa, 0x4, &(0x7f0000000480)=ANY=[@ANYBLOB="18000000000000000000000000000000850000006d"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x20, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0x14, &(0x7f0000000400)=ANY=[@ANYBLOB="1800"/15, @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b7040000000000008500000001"], 0x0, 0x0, 0x0, 0x0, 0x0, 0xb, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r3 = bpf$PROG_LOAD(0x5, &(0x7f0000000680)={0x11, 0x14, &(0x7f0000000400)=ANY=[], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x40f03, 0xe, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$PROG_BIND_MAP(0xa, &(0x7f00000004c0)={r3}, 0xc) 881.652278ms ago: executing program 4 (id=2306): socket$nl_generic(0x10, 0x3, 0x10) (async) r0 = socket$unix(0x1, 0x2, 0x0) bind$unix(r0, 0x0, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) setsockopt$netlink_NETLINK_NO_ENOBUFS(r1, 0x10e, 0xc, 0x0, 0x0) socket$netlink(0x10, 0x3, 0x9) (async) r2 = socket$netlink(0x10, 0x3, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000002c80)={0x3, 0xc, &(0x7f00000005c0)=ANY=[@ANYBLOB="180200000000000000000000000000008500000027000000180100002020702500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000000600000095"], &(0x7f0000000080)='GPL\x00'}, 0x90) socket$packet(0x11, 0x2, 0x300) (async) getsockopt$sock_cred(r1, 0x1, 0x11, 0x0, 0x0) (async) r3 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="0e000000040000000800000005"], 0x48) r4 = bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x4, 0x5, &(0x7f0000000340)=ANY=[@ANYBLOB="180200000000000000000000000000008500000061000000850000007d00000095"], &(0x7f00000000c0)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f00000002c0)={r4, 0x0, 0xe, 0x0, &(0x7f00000006c0)="19aba2fb2f6b9ad47dd9d9162656", 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) r5 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x6, 0xc, &(0x7f00000001c0)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r3, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bc82000000000000a6020000f8ffffffb703000008000000cd03000000000000850000003300000095"], &(0x7f0000000180)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @xdp=0xedf0e51957efc755, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) (async, rerun: 32) r6 = socket$inet6_sctp(0xa, 0x801, 0x84) (rerun: 32) sendmmsg$inet6(r6, &(0x7f0000000840)=[{{&(0x7f00000001c0)={0xa, 0x4e22, 0x4, @dev={0xfe, 0x80, '\x00', 0x30}, 0xa}, 0x1c, &(0x7f0000000240)=[{&(0x7f0000000200)="a2", 0x1}], 0x1}}], 0x1, 0xc010) (async) shutdown(r6, 0x1) getsockopt$bt_hci(r6, 0x84, 0x81, &(0x7f0000001280)=""/4107, &(0x7f00000000c0)=0x100b) (async, rerun: 32) r7 = socket$inet6(0xa, 0x80003, 0xff) (rerun: 32) setsockopt$inet6_int(r7, 0x29, 0x18, 0x0, 0x0) (async) r8 = socket(0x10, 0x803, 0x0) sendmsg$nl_route(r8, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000001c0)=ANY=[@ANYBLOB="440000001000030500"/20, @ANYRES32=0x0, @ANYBLOB="0000000000000000240001000000000000006e640000000094b7028005000100040000000800090000000000"], 0x44}, 0x1, 0x0, 0x0, 0x800}, 0x400c89c) setsockopt$SO_VM_SOCKETS_CONNECT_TIMEOUT_OLD(r8, 0x28, 0x6, &(0x7f0000000240), 0x10) (async) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000440)={{r3}, &(0x7f0000000380), &(0x7f0000000480)=r5}, 0x20) (async) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000000)={r5, 0x18000000000002a0, 0x5ee, 0x0, &(0x7f0000000580)="b9ff03076804268c989e14f088a8", 0x0, 0x500, 0x60000000, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x50) (async) shutdown(r2, 0x1) sendmsg$netlink(r2, &(0x7f0000000740)={0x0, 0x0, &(0x7f00000002c0)=[{&(0x7f0000000300)=ANY=[@ANYBLOB="20000000110001000000000000000000100000e60b"], 0x20}], 0x1}, 0x0) 832.773339ms ago: executing program 1 (id=2307): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x42082, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x2}) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) close(r1) r2 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) r4 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r4, &(0x7f0000000640)={0x0, 0x0, &(0x7f0000000600)={&(0x7f0000000280)=@newtaction={0x70, 0x30, 0xb, 0x0, 0x0, {}, [{0x5c, 0x1, [@m_skbedit={0x58, 0x1, 0x0, 0x0, {{0xc}, {0x48, 0x2, 0x0, 0x1, [@TCA_SKBEDIT_MARK={0x8, 0x3}, @TCA_SKBEDIT_PARMS={0x18, 0x2, {0x0, 0x80000}}, @TCA_SKBEDIT_PTYPE={0x2, 0x4}, @TCA_SKBEDIT_PRIORITY={0x0, 0x3, {0xfff1}}, @TCA_SKBEDIT_PRIORITY={0x0, 0x3, {0x9, 0x8}}, @TCA_SKBEDIT_QUEUE_MAPPING={0x0, 0x4, 0xea37}]}, {0x10}, {0xc, 0xa}, {0xc, 0x9, {0xf5}}}}]}]}, 0x70}}, 0x0) sendmsg$nl_route_sched(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000580)={&(0x7f00000007c0)=@newqdisc={0x60, 0x24, 0x4ee4e6a52ff56541, 0x1, 0x25dfdbfd, {0x0, 0x0, 0x0, r3, {0x0, 0xb}, {0xffff, 0xffff}, {0xfff2}}, [@qdisc_kind_options=@q_tbf={{0x8}, {0x34, 0x2, [@TCA_TBF_PARMS={0x28, 0x1, {{0x5, 0x1, 0x5, 0xd, 0xd9, 0x10}, {0x0, 0x2, 0x5, 0x3, 0x1}, 0x2, 0x5, 0x8d0}}, @TCA_TBF_BURST={0x8, 0x6, 0x10001}]}}]}, 0x60}, 0x1, 0x0, 0x0, 0x40088c1}, 0x0) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) r5 = socket$kcm(0x11, 0x3, 0x0) r6 = socket$unix(0x1, 0x5, 0x0) ioctl$sock_SIOCGIFINDEX(r6, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) setsockopt$sock_attach_bpf(r5, 0x107, 0xf, &(0x7f0000000600), 0x56) r8 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r8, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r8, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000140)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70b926, 0x25dfdbfe, {0x0, 0x0, 0x0, r9, {0x0, 0x8}, {0xffff, 0xb}, {0xffff, 0xffe0}}, [@qdisc_kind_options=@q_skbprio={{0xc}, {0x8}}]}, 0x38}, 0x1, 0x0, 0x0, 0x40000b0}, 0x4890) sendmsg$kcm(r5, &(0x7f00000000c0)={&(0x7f0000000580)=@xdp={0x2c, 0x0, r7, 0x3e}, 0x80, &(0x7f0000000080)=[{&(0x7f0000000180)="27030200590214120600002fb96dbcf706e10500000086ddffff1144ee1611d4b8bf4a31accb", 0xfdef}], 0x1}, 0x0) openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x42082, 0x0) (async) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x2}) (async) openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) (async) close(r1) (async) socket$nl_route(0x10, 0x3, 0x0) (async) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'syzkaller0\x00'}) (async) socket$nl_route(0x10, 0x3, 0x0) (async) sendmsg$nl_route_sched(r4, &(0x7f0000000640)={0x0, 0x0, &(0x7f0000000600)={&(0x7f0000000280)=@newtaction={0x70, 0x30, 0xb, 0x0, 0x0, {}, [{0x5c, 0x1, [@m_skbedit={0x58, 0x1, 0x0, 0x0, {{0xc}, {0x48, 0x2, 0x0, 0x1, [@TCA_SKBEDIT_MARK={0x8, 0x3}, @TCA_SKBEDIT_PARMS={0x18, 0x2, {0x0, 0x80000}}, @TCA_SKBEDIT_PTYPE={0x2, 0x4}, @TCA_SKBEDIT_PRIORITY={0x0, 0x3, {0xfff1}}, @TCA_SKBEDIT_PRIORITY={0x0, 0x3, {0x9, 0x8}}, @TCA_SKBEDIT_QUEUE_MAPPING={0x0, 0x4, 0xea37}]}, {0x10}, {0xc, 0xa}, {0xc, 0x9, {0xf5}}}}]}]}, 0x70}}, 0x0) (async) sendmsg$nl_route_sched(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000580)={&(0x7f00000007c0)=@newqdisc={0x60, 0x24, 0x4ee4e6a52ff56541, 0x1, 0x25dfdbfd, {0x0, 0x0, 0x0, r3, {0x0, 0xb}, {0xffff, 0xffff}, {0xfff2}}, [@qdisc_kind_options=@q_tbf={{0x8}, {0x34, 0x2, [@TCA_TBF_PARMS={0x28, 0x1, {{0x5, 0x1, 0x5, 0xd, 0xd9, 0x10}, {0x0, 0x2, 0x5, 0x3, 0x1}, 0x2, 0x5, 0x8d0}}, @TCA_TBF_BURST={0x8, 0x6, 0x10001}]}}]}, 0x60}, 0x1, 0x0, 0x0, 0x40088c1}, 0x0) (async) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) (async) socket$kcm(0x11, 0x3, 0x0) (async) socket$unix(0x1, 0x5, 0x0) (async) ioctl$sock_SIOCGIFINDEX(r6, 0x8933, &(0x7f0000000100)={'syzkaller0\x00'}) (async) setsockopt$sock_attach_bpf(r5, 0x107, 0xf, &(0x7f0000000600), 0x56) (async) socket$nl_route(0x10, 0x3, 0x0) (async) ioctl$sock_SIOCGIFINDEX(r8, 0x8933, &(0x7f0000000100)={'syzkaller0\x00'}) (async) sendmsg$nl_route_sched(r8, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000140)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70b926, 0x25dfdbfe, {0x0, 0x0, 0x0, r9, {0x0, 0x8}, {0xffff, 0xb}, {0xffff, 0xffe0}}, [@qdisc_kind_options=@q_skbprio={{0xc}, {0x8}}]}, 0x38}, 0x1, 0x0, 0x0, 0x40000b0}, 0x4890) (async) sendmsg$kcm(r5, &(0x7f00000000c0)={&(0x7f0000000580)=@xdp={0x2c, 0x0, r7, 0x3e}, 0x80, &(0x7f0000000080)=[{&(0x7f0000000180)="27030200590214120600002fb96dbcf706e10500000086ddffff1144ee1611d4b8bf4a31accb", 0xfdef}], 0x1}, 0x0) (async) 773.959748ms ago: executing program 3 (id=2308): bpf$PROG_LOAD(0x5, &(0x7f0000000340)={0x10, 0x4, &(0x7f0000000040)=@framed={{0xffffffb4, 0x0, 0x0, 0x0, 0x0, 0x79, 0x10}, [@ldst={0x3, 0x3, 0x3, 0xa, 0x0, 0xfffffffffffffff8}], {0x95, 0x0, 0x74}}, &(0x7f0000003ff6)='GPL\x00', 0x8, 0xc3, &(0x7f0000000400)=""/198, 0x0, 0x0, '\x00', 0x0, @sk_msg, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0xffffff52}, 0x37) bpf$BPF_MAP_CONST_STR_FREEZE(0x16, &(0x7f0000000100)={0x1, 0xffffffffffffffff}, 0x4) getsockopt$inet_mreqn(0xffffffffffffffff, 0x0, 0x23, &(0x7f0000000140)={@private, @loopback, 0x0}, &(0x7f00000001c0)=0xc) bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000240)={0x2, 0x4, 0x8, 0x1, 0x80, r0, 0x8, '\x00', r1, 0xffffffffffffffff, 0x2, 0x2, 0x5}, 0x50) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f00000003c0)={'netdevsim0\x00', 0x0}) bpf$PROG_LOAD_XDP(0x5, &(0x7f00000000c0)={0x3, 0x3, &(0x7f0000000480)=@framed={{0x18, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6}}, &(0x7f0000000200)='GPL\x00', 0xe, 0x0, 0x0, 0x0, 0x0, '\x00', r2}, 0x94) sendmsg$ETHTOOL_MSG_STRSET_GET(r0, &(0x7f0000000a00)={&(0x7f0000000740)={0x10, 0x0, 0x0, 0x800}, 0xc, &(0x7f00000009c0)={&(0x7f0000000780)={0x20c, 0x0, 0x2, 0x70bd2c, 0x25dfdbff, {}, [@ETHTOOL_A_STRSET_STRINGSETS={0x104, 0x2, 0x0, 0x1, [{0x4c, 0x1, 0x0, 0x1, [@ETHTOOL_A_STRINGSET_ID={0x8, 0x1, 0x6}, @ETHTOOL_A_STRINGSET_ID={0x8, 0x1, 0x8}, @ETHTOOL_A_STRINGSET_ID={0x8, 0x1, 0x6}, @ETHTOOL_A_STRINGSET_ID={0x8, 0x1, 0x5}, @ETHTOOL_A_STRINGSET_ID={0x8, 0x1, 0x3}, @ETHTOOL_A_STRINGSET_ID={0x8, 0x1, 0x4}, @ETHTOOL_A_STRINGSET_ID={0x8, 0x1, 0x6}, @ETHTOOL_A_STRINGSET_ID={0x8, 0x1, 0x6}, @ETHTOOL_A_STRINGSET_ID={0x8, 0x1, 0x2}]}, {0x24, 0x1, 0x0, 0x1, [@ETHTOOL_A_STRINGSET_ID={0x8}, @ETHTOOL_A_STRINGSET_ID={0x8, 0x1, 0x1}, @ETHTOOL_A_STRINGSET_ID={0x8, 0x1, 0x7}, @ETHTOOL_A_STRINGSET_ID={0x8, 0x1, 0x3}]}, {0x54, 0x1, 0x0, 0x1, [@ETHTOOL_A_STRINGSET_ID={0x8}, @ETHTOOL_A_STRINGSET_ID={0x8, 0x1, 0x8}, @ETHTOOL_A_STRINGSET_ID={0x8, 0x1, 0x8}, @ETHTOOL_A_STRINGSET_ID={0x8, 0x1, 0x5}, @ETHTOOL_A_STRINGSET_ID={0x8, 0x1, 0x1}, @ETHTOOL_A_STRINGSET_ID={0x8, 0x1, 0x4}, @ETHTOOL_A_STRINGSET_ID={0x8, 0x1, 0x8}, @ETHTOOL_A_STRINGSET_ID={0x8, 0x1, 0x6}, @ETHTOOL_A_STRINGSET_ID={0x8, 0x1, 0x5}, @ETHTOOL_A_STRINGSET_ID={0x8, 0x1, 0x6}]}, {0x14, 0x1, 0x0, 0x1, [@ETHTOOL_A_STRINGSET_ID={0x8, 0x1, 0x8}, @ETHTOOL_A_STRINGSET_ID={0x8, 0x1, 0x7}]}, {0x14, 0x1, 0x0, 0x1, [@ETHTOOL_A_STRINGSET_ID={0x8}, @ETHTOOL_A_STRINGSET_ID={0x8, 0x1, 0x8}]}, {0x14, 0x1, 0x0, 0x1, [@ETHTOOL_A_STRINGSET_ID={0x8, 0x1, 0x7}, @ETHTOOL_A_STRINGSET_ID={0x8}]}]}, @ETHTOOL_A_STRSET_HEADER={0x78, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x1}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r1}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r2}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'gretap0\x00'}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'dvmrp0\x00'}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x2}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x1}, @ETHTOOL_A_HEADER_FLAGS={0x8}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x1}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'macvlan0\x00'}]}, @ETHTOOL_A_STRSET_STRINGSETS={0x2c, 0x2, 0x0, 0x1, [{0x14, 0x1, 0x0, 0x1, [@ETHTOOL_A_STRINGSET_ID={0x8, 0x1, 0x5}, @ETHTOOL_A_STRINGSET_ID={0x8, 0x1, 0x1}]}, {0x14, 0x1, 0x0, 0x1, [@ETHTOOL_A_STRINGSET_ID={0x8, 0x1, 0x5}, @ETHTOOL_A_STRINGSET_ID={0x8, 0x1, 0x7}]}]}, @ETHTOOL_A_STRSET_STRINGSETS={0x50, 0x2, 0x0, 0x1, [{0x4c, 0x1, 0x0, 0x1, [@ETHTOOL_A_STRINGSET_ID={0x8, 0x1, 0x1}, @ETHTOOL_A_STRINGSET_ID={0x8, 0x1, 0x1}, @ETHTOOL_A_STRINGSET_ID={0x8, 0x1, 0x5}, @ETHTOOL_A_STRINGSET_ID={0x8, 0x1, 0x8}, @ETHTOOL_A_STRINGSET_ID={0x8, 0x1, 0x4}, @ETHTOOL_A_STRINGSET_ID={0x8, 0x1, 0x4}, @ETHTOOL_A_STRINGSET_ID={0x8, 0x1, 0x8}, @ETHTOOL_A_STRINGSET_ID={0x8}, @ETHTOOL_A_STRINGSET_ID={0x8, 0x1, 0x6}]}]}]}, 0x20c}, 0x1, 0x0, 0x0, 0x12}, 0x4008000) r3 = socket$nl_generic(0x10, 0x3, 0x10) r4 = socket$inet_udp(0x2, 0x2, 0x0) getsockopt$inet_udp_int(r4, 0x11, 0x64, 0x0, &(0x7f0000000000)=0x255374afca783ed0) r5 = syz_genetlink_get_family_id$gtp(&(0x7f0000000000), r3) r6 = socket$nl_netfilter(0x10, 0x3, 0xc) close(r6) r7 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r7, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x0) sendmsg$NFT_BATCH(r7, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f0000000100)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a4c000000090a010400000000000000000a0000040900010073797a310000000008000540000000020900020073797a310000000008000a40fffffffc080003400000001408000c4000000e45400000000c0a010100000000000000000a0000060900020073797a31000000000900010073797a310000000014000380100000800c00018006000100d103000014000000110001"], 0xb4}, 0x1, 0x0, 0x0, 0x4000850}, 0x40) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000500)={'veth1\x00', &(0x7f0000000200)=@ethtool_per_queue_op={0x4b, 0xf, [0xa, 0x1, 0x7fff, 0x1, 0x4, 0x9, 0xa4, 0xffb, 0x2, 0xb69, 0xc1, 0x4, 0x1, 0x3, 0x5, 0x101, 0x8, 0x9, 0x3, 0x3, 0x1, 0xfffffffc, 0x0, 0x6, 0x9, 0x4, 0x7, 0x5, 0x100000, 0x762, 0x3, 0xd, 0xe, 0x2b12, 0x102, 0x6, 0x1c00, 0xb, 0x7, 0xbed4, 0x8, 0x8000100, 0x3, 0x0, 0x11000, 0x80000000, 0x5, 0x79b, 0x2, 0x1, 0x7f, 0x4, 0x2, 0x7, 0xf, 0x101, 0xd7, 0x1fa0860a, 0x7, 0xae, 0x81, 0x8, 0x180000, 0x4007, 0x8b, 0x5, 0x2b3, 0xf7, 0x5, 0x2, 0x6, 0x9, 0x4, 0x7, 0x4009, 0x0, 0x4, 0x100002, 0x8, 0x753, 0x0, 0x1005, 0x80005, 0x10001, 0x2, 0xffffffff, 0x6, 0x6, 0x9, 0x80000000, 0xfdffffff, 0x2, 0x488b, 0x84, 0x100, 0x10, 0x252, 0x81, 0xb, 0x5, 0x20006, 0x5, 0x2, 0xb, 0x2, 0xdda, 0xd, 0x2a2, 0xfffffffd, 0x2, 0x2, 0x5, 0x8, 0x0, 0x7fff, 0x2, 0x3f, 0x8, 0xcb, 0x3, 0x400, 0x66cd, 0x8, 0x8, 0x1, 0x1fc, 0xc5c, 0xffffffff]}}) sendmsg$NFT_BATCH(r7, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000480)=ANY=[@ANYBLOB="1400000010000100000000821bd468000300000a580000000c0a010100000000000000000a00000a0900020073797a31000000000900010073797a31000000002c000380280000800c00018006000100d103"], 0x80}, 0x1, 0x0, 0x0, 0x4000850}, 0x40) r8 = socket$nl_rdma(0x10, 0x3, 0x14) sendmsg$RDMA_NLDEV_CMD_DELLINK(r8, &(0x7f0000000700)={&(0x7f0000000640)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f00000006c0)={&(0x7f0000000680)={0x10, 0x1404, 0x1, 0x70bd28, 0x25dfdbff}, 0x10}, 0x1, 0x0, 0x0, 0x4800}, 0x0) sendmsg$NFT_BATCH(r6, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f00000001c0)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a480000001e0a010100000000000000000a0000060900020073797a31000000000900010073797a31000000001c000380180000800c000180060001"], 0x70}, 0x1, 0x0, 0x0, 0x4451099e661a63b1}, 0x0) r9 = socket(0x22, 0x80000, 0x0) syz_genetlink_get_family_id$ethtool(&(0x7f0000000380), r9) getsockname$packet(r9, &(0x7f0000000180)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000000c0)=0x14) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r4, 0x8933, &(0x7f00000005c0)={'batadv_slave_0\x00', 0x0}) setsockopt$inet6_mreq(r9, 0x29, 0x15, &(0x7f0000000600)={@mcast2, r11}, 0x14) ioctl$sock_kcm_SIOCKCMCLONE(r9, 0x89e2, &(0x7f0000000300)={r9}) sendmsg$nl_route(r12, &(0x7f0000000580)={&(0x7f00000003c0)={0x10, 0x0, 0x0, 0x200000}, 0xc, &(0x7f0000000440)={&(0x7f0000000400)=@ipv6_getmulticast={0x14, 0x3a, 0x400, 0x70bd28, 0x25dfdbfe, {}, ["", "", "", "", "", "", ""]}, 0x14}, 0x1, 0x0, 0x0, 0x20000491}, 0x20000000) sendmsg$nl_route(r9, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000500)=ANY=[@ANYBLOB="3800000010003704000080000000000000000000", @ANYRES32=r10, @ANYBLOB="c3040500000000001800128008000100677470000c00028008000100454d98ec86fb304c6179c175e0f094515e6411776644457cdc86ce70a72ca61d808ad4d2dcc08aeabf3125c2c8d6", @ANYRES32, @ANYBLOB], 0x38}, 0x1, 0x0, 0x0, 0x2000c014}, 0x0) sendmsg$GTP_CMD_DELPDP(r3, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f00000004c0)={0x24, r5, 0x3, 0x70bd29, 0xe, {}, [@GTPA_LINK={0x8, 0x1, r10}, @GTPA_VERSION={0x8, 0x2, 0x1}]}, 0x24}, 0x1, 0x0, 0x0, 0x44800}, 0x20000000) 580.65273ms ago: executing program 0 (id=2309): bpf$PROG_LOAD(0x5, &(0x7f0000000880)={0x6, 0x23, &(0x7f0000000140)=ANY=[@ANYBLOB="bf1600"], 0x0, 0x0, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, @xdp, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r0 = socket$inet6(0xa, 0x2, 0x0) setsockopt$inet6_int(r0, 0x29, 0x35, &(0x7f0000000000)=0x8000, 0x4) setsockopt$inet6_IPV6_HOPOPTS(r0, 0x29, 0x36, &(0x7f0000000140)=ANY=[], 0x8) bind$inet6(r0, &(0x7f0000f5dfe4)={0xa, 0x4e20, 0x0, @empty}, 0x1c) setsockopt$inet6_int(r0, 0x29, 0xb, &(0x7f0000000040)=0x100008, 0x4) recvmmsg(r0, &(0x7f0000000500)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f0000000340)=""/19, 0x13}, 0x68000}], 0x1, 0x10002, 0x0) sendto$inet6(r0, 0x0, 0x0, 0x0, &(0x7f0000000200)={0xa, 0x4e20, 0x0, @mcast1}, 0x1c) 364.675069ms ago: executing program 4 (id=2310): r0 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) connect$inet6(r0, &(0x7f0000000100)={0xa, 0xfffe, 0x4, @mcast2={0xff, 0x3}}, 0x1c) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000080)='bridge0\x00', 0x10) sendto$inet6(r0, &(0x7f0000000000)="8f6bb66f", 0x4, 0x800, 0x0, 0x0) 343.544802ms ago: executing program 2 (id=2311): bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000280)={0x1e, 0x4, &(0x7f0000000400)=ANY=[@ANYBLOB="18000000000000000000000000000000711209000000000095"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x24}, 0x94) r0 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$TIPC_NL_KEY_SET(0xffffffffffffffff, &(0x7f0000000800)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x200000}, 0xc, &(0x7f00000007c0)={&(0x7f0000000840)=ANY=[@ANYBLOB="70030000", @ANYRES16=r0, @ANYBLOB="040028bd7000fedbdf251700000044000380080003000b00000008000300000001000800020006000000080001000200000008000300090000000800010006000000080002000400000008000100ae7c00000c00018008000300f7ffffff6401068008000600030000008d0003006991f417c5f8276123e67528a60b55a6d85f3aeeb4591fa0a327cabf0d50635bdb6d2aaaf772e192a6ad7e68b750402bd0ebee955f639ab93a06b7d7d7474732ec92bd3c7be4dd8346179377ee809d92381a584ad4313b97ad6e6984b716527e600b808c271b9cbe63953afd8f6b2da33769dda31429c79f795cc6cee700153d87b57fb23999ba05bf000000040005006900030073cfc5b95734c7c600042e418c39eee52080149f6065fb51513f91968ace83735e56558c3b0beff88c9137ca18d6a66650c35d9ecf6e78a18a5bf49204ca42ede6856c681c80a69eedf9b5d02d694374db1249e6dd016361880ab611c8eea39ea1bdb4262b00000004000200080001007f00000008000100ff7f00004100040067636d2861657329000000000000000000000000000000000000000000000000190000004bcf9036dc64c059b66845d553c5f7eecba9b95617396f8e79000000d00005804c0002800800030004000000080003000f000000080002004005000008000400b1120000080001000500000008000400c80000000800020004000000080002000800000008000300000001000700010069620000080001007564700008000100756470001400028008000400feffffff0800040008000000070001006962000044000280080003000000000008000400ff010000080001001f000000080001000c000000080002000000000008000400000001000800030003000000080001000400000008000100756470001c000780080002004c00000008000100f8ffffff08000100c20e0000bc0004801300010062726f6164636173742d6c696e6b00001c00078008000400781a000008000300ff03000008000100000000002400078008000300000000000800040001000000080002008000000008000400030000000900010073797a31000000000900010073797a30000000000900010073797a31000000000c000780080001001a00000034000780080001000800000008080000000000000000030004000000080001001700000008000100100000000800030000000100"], 0x370}, 0x1, 0x0, 0x0, 0x4040040}, 0x4080) 332.299158ms ago: executing program 1 (id=2312): openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0) socket$nl_route(0x10, 0x3, 0x0) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x5) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000140)=ANY=[@ANYBLOB="280000001800090000000000000000001c140000fe000001000000000c"], 0x28}}, 0x0) close(0x4) syz_open_procfs$namespace(0x0, &(0x7f0000000040)='ns/cgroup\x00') (async) syz_open_procfs$namespace(0x0, &(0x7f0000000040)='ns/cgroup\x00') mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f07ebbeef, 0x8031, 0xffffffffffffffff, 0x215eb000) bpf$PROG_LOAD(0x5, &(0x7f0000000540)={0xe, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x59, '\x00', 0x0, @fallback=0xd, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) setsockopt$IPT_SO_SET_ADD_COUNTERS(0xffffffffffffffff, 0x0, 0x61, &(0x7f0000000640)=ANY=[@ANYBLOB="66696c74657200000000000000ee2b000000643b02000000000000000000000002000000"], 0x48) socket$netlink(0x10, 0x3, 0x12) (async) socket$netlink(0x10, 0x3, 0x12) r0 = socket$inet(0xa, 0x6, 0x200085) listen(r0, 0x8) (async) listen(r0, 0x8) r1 = accept4(r0, 0x0, 0x0, 0x0) mmap(&(0x7f0000001000/0xc00000)=nil, 0xc00000, 0x5, 0x3030, 0xffffffffffffffff, 0x0) bpf$BPF_BTF_LOAD(0x12, 0x0, 0x0) setsockopt$inet6_mreq(r1, 0x29, 0x1c, &(0x7f00000001c0)={@remote}, 0x14) r2 = socket$inet_smc(0x2b, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r2, 0x0, 0x80, &(0x7f0000000100)=@broute={'broute\x00', 0x20, 0x0, 0x90, [0x0, 0x0, 0x0, 0x0, 0x0, 0x200000000040], 0x0, 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB="0000000000000000000000000000000000000000000000000000000000000000000000000000acad86e684c73695000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff00000000000000000000000400000000000000000000ed0000000000000000000000000000000000000000ffffffff00000000064d9a7d2a132bdad9eda87beb3460d8c6bd1c5eba2d61185e19e36c0da778f14ec90d3b497100000000"]}, 0x12e) (async) setsockopt$EBT_SO_SET_ENTRIES(r2, 0x0, 0x80, &(0x7f0000000100)=@broute={'broute\x00', 0x20, 0x0, 0x90, [0x0, 0x0, 0x0, 0x0, 0x0, 0x200000000040], 0x0, 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB="0000000000000000000000000000000000000000000000000000000000000000000000000000acad86e684c73695000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff00000000000000000000000400000000000000000000ed0000000000000000000000000000000000000000ffffffff00000000064d9a7d2a132bdad9eda87beb3460d8c6bd1c5eba2d61185e19e36c0da778f14ec90d3b497100000000"]}, 0x12e) syz_genetlink_get_family_id$devlink(&(0x7f0000000080), 0xffffffffffffffff) (async) syz_genetlink_get_family_id$devlink(&(0x7f0000000080), 0xffffffffffffffff) socket$nl_netfilter(0x10, 0x3, 0xc) (async) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) writev(r3, &(0x7f0000000440)=[{&(0x7f0000000200)="2f099c7af34d8ea80723648e0574b245289c39d8b9d36fc54de9dfbc31ffe44334f4f158abf38e6952d29d975a471ce46aaf734e25d17de19a724feb16fe896f211dd078745855f4b44862feedf3bc2aa3cd7e293de872a7282580694caf5b2e3efa6b0406ef2e206f", 0x69}, {&(0x7f0000000380)="cf0d1b50ae1b1ab03028ee5e35a39b9666ab98e0c7e0a2258b6387af549b5fc2ff6bf787e3f169d9cc9cd1301eeec04df00ca67f511aec94c3a7fd1f46d2df6c85253d1f1e57a3026eda06ed155f2f17fba08bc1eac51e434e5736c4a06450036dbec16af7f468a5f10ba907bbfcc9a7addc93203328b8c83dea0d007373d45a86f5", 0x82}], 0x2) sendmsg$NFULNL_MSG_CONFIG(r3, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f00000009c0)=ANY=[@ANYBLOB="2400000001040102000000c9fd0000000000000008000340000100000500010001"], 0x24}, 0x1, 0x0, 0x0, 0x4000000}, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) (async) r4 = socket$inet6_tcp(0xa, 0x1, 0x0) r5 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r5, &(0x7f0000000140)={0xa, 0x4e22, 0x0, @ipv4={'\x00', '\xff\xff', @empty}}, 0x1c) (async) bind$inet6(r5, &(0x7f0000000140)={0xa, 0x4e22, 0x0, @ipv4={'\x00', '\xff\xff', @empty}}, 0x1c) bind$inet6(r4, &(0x7f0000000140)={0xa, 0x4e22, 0x0, @ipv4={'\x00', '\xff\xff', @multicast1}}, 0x1c) sendmsg$NFULNL_MSG_CONFIG(r3, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000000)=ANY=[@ANYBLOB="300000000a0000050a000200000000020000002006005c40000000000600064000"/48], 0x30}, 0x1, 0x0, 0x0, 0xc010}, 0x22000004) socket(0x2b, 0x1, 0x1) (async) socket(0x2b, 0x1, 0x1) socket(0xa, 0x1, 0x0) (async) socket(0xa, 0x1, 0x0) socket(0x28, 0x5, 0x0) 320.721653ms ago: executing program 0 (id=2313): epoll_create(0x3) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000840)=ANY=[@ANYBLOB="0a000000050000000300000004"], 0x48) r1 = bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="1b00000000000000000000000080"], 0x48) close(0x3) bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="01000000030000000800000005"], 0x50) r2 = bpf$PROG_LOAD(0x5, &(0x7f00000004c0)={0x11, 0x10, &(0x7f0000000180)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r1, @ANYBLOB="0000000000000000b702000003000000850000008600000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000300000095"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$PROG_BIND_MAP(0xa, &(0x7f0000000cc0)={r2}, 0xc) r3 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r3, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000980)=ANY=[@ANYBLOB="1400000042000b06"], 0x14}}, 0x0) r4 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r4, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000700)=@newlink={0x44, 0x10, 0xffffffffffffffff, 0x70bd25, 0x25dfdbfb, {0x0, 0x0, 0x0, 0x0, 0x42, 0x2021}, [@IFLA_LINKINFO={0x24, 0x12, 0x0, 0x1, @geneve={{0xb}, {0x14, 0x2, 0x0, 0x1, [@IFLA_GENEVE_UDP_ZERO_CSUM6_TX={0x5, 0x9, 0x1}, @IFLA_GENEVE_UDP_CSUM={0x5}]}}}]}, 0x44}, 0x1, 0x0, 0x0, 0x1}, 0x8000002) r5 = socket(0x840000000002, 0x3, 0xfa) connect$inet(r5, &(0x7f0000000080)={0x2, 0x4e20, @remote}, 0x10) sendmmsg$inet(r5, &(0x7f0000005240), 0x4000095, 0x0) setsockopt$inet_MCAST_LEAVE_GROUP(r5, 0x0, 0x2d, 0x0, 0x0) setsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX_OLD(r5, 0x84, 0x6b, &(0x7f0000000000)=[@in={0x2, 0x4e21, @private=0xa010100}, @in6={0xa, 0x4e24, 0x1, @mcast2, 0x2}, @in={0x2, 0x4e21, @broadcast}, @in={0x2, 0x4e20, @rand_addr=0x64010102}, @in6={0xa, 0x4e24, 0x2000, @private0={0xfc, 0x0, '\x00', 0x1}, 0x8}], 0x68) recvmmsg(r3, &(0x7f0000003c00)=[{{0x0, 0x0, &(0x7f0000000180)=[{&(0x7f00000009c0)=""/4129, 0x1021}, {&(0x7f0000000880)=""/142, 0x8e}, {&(0x7f0000000280)=""/152, 0x98}, {&(0x7f0000000500)=""/134, 0x86}, {&(0x7f0000000780)=""/158, 0x9e}, {&(0x7f0000000340)=""/142, 0x8e}], 0x6}, 0x1}, {{&(0x7f0000000100)=@nfc_llcp, 0x80, &(0x7f0000003b00)=[{&(0x7f0000000200)=""/33, 0x21}, {&(0x7f0000000400)=""/150, 0x96}, {&(0x7f00000004c0)=""/37, 0x25}, {&(0x7f0000001a00)=""/4096, 0x1000}, {&(0x7f0000002a00)=""/4096, 0x1000}, {&(0x7f0000003a00)=""/240, 0xf0}], 0x6, &(0x7f0000003b80)=""/85, 0x55}, 0x8}], 0x2, 0x40000002, 0x0) 252.87983ms ago: executing program 3 (id=2314): socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x804) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, 0x0}, 0x0) bpf$OBJ_GET_PROG(0x9, &(0x7f00000000c0)=@generic={0x0, 0x11}, 0x18) sendmsg(0xffffffffffffffff, 0x0, 0x4040044) socket(0x10, 0x803, 0x0) pipe(0x0) r0 = bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000400)=@bpf_lsm={0x6, 0x3, &(0x7f00000003c0)=ANY=[@ANYBLOB="18000000003f000000000000000000f195"], &(0x7f0000000140)='GPL\x00'}, 0x94) r1 = socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt$inet_sctp6_SCTP_INITMSG(r1, 0x84, 0x2, &(0x7f00000000c0)={0xfffc, 0xc}, 0x8) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r1, 0x84, 0x6f, &(0x7f0000000200)={0x0, 0x1e, &(0x7f00000001c0)=[@in6={0xa, 0x0, 0x0, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02', 0x8}]}, &(0x7f0000000640)=0x10) setsockopt$sock_int(r1, 0x1, 0x28, &(0x7f0000000000)=0x803ff, 0x4) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$int_in(r2, 0x5452, &(0x7f00000000c0)=0x100) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x3ec0) close(0x3) r3 = bpf$ITER_CREATE(0xb, &(0x7f00000004c0)={r0}, 0x8) close(r3) close(0x3) r4 = bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0x10, 0x4, &(0x7f0000000040)=ANY=[@ANYBLOB="b4000000000000007910480000000000610400000000000095000000"], &(0x7f0000003ff6)='GPL\x00', 0x2, 0xfd90, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @sk_msg}, 0x48) close(r4) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000140)={0xffffffffffffffff}) close(0x3) r6 = bpf$MAP_CREATE(0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="0f00000004000000040000001200000000000000", @ANYRES32=0x0], 0x48) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f00000000c0)={{r6}, &(0x7f0000000000), &(0x7f0000000080)=r4}, 0x20) recvmsg$unix(r5, &(0x7f00000004c0)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f00000006c0)=""/179, 0x33fe0}], 0x1}, 0x0) write$cgroup_int(r3, 0x0, 0x0) 172.293436ms ago: executing program 4 (id=2315): r0 = socket(0x10, 0x803, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000100)={'bridge_slave_0\x00', 0x0}) sendmsg$nl_route_sched(r0, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000a40)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70bd28, 0xffffffff, {0x0, 0x0, 0x0, r1, {0x0, 0x9}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_fq_codel={{0xd}, {0x4}}]}, 0x38}}, 0x0) (async) sendmsg$nl_route_sched(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000001740)=@newtfilter={0xd10, 0x2c, 0xd27, 0x70bd27, 0x25dfdbfb, {0x0, 0x0, 0x0, r1, {0x0, 0xc}, {}, {0xa, 0xf}}, [@filter_kind_options=@f_basic={{0xa}, {0xce0, 0x2, [@TCA_BASIC_POLICE={0x468, 0x4, [@TCA_POLICE_RATE64={0xc, 0x8, 0x80}, @TCA_POLICE_RESULT={0x8}, @TCA_POLICE_RESULT={0x8, 0x5, 0xe}, @TCA_POLICE_RESULT={0x8, 0x5, 0x7}, @TCA_POLICE_PEAKRATE={0x404, 0x3, [0x9, 0x6b9a, 0x9, 0x5, 0x4, 0x4, 0x289, 0xd1, 0x9, 0x0, 0x8, 0x3, 0x7, 0x5, 0x19e, 0x3ff, 0x10001, 0x4, 0x2, 0x4, 0x0, 0x1000, 0x2, 0x5, 0x6, 0x0, 0x6, 0x2, 0x50e, 0x7f, 0x3, 0xf, 0x7fff, 0x3, 0x6, 0x9, 0xfffff8b3, 0xfffffffe, 0xffff, 0xccc0, 0x7f, 0x8, 0x65a, 0x3, 0x3, 0xd9, 0xffff, 0xa3a, 0x5, 0x5, 0x5, 0x400, 0x3, 0xff, 0x5, 0x6, 0x1, 0x8802, 0x80000000, 0x5, 0xb911, 0xa000000, 0x69e4, 0x7, 0x3, 0x8, 0x8, 0x80000001, 0x4, 0x4, 0x3, 0x1, 0x2, 0xd, 0x2, 0x2, 0x2, 0x2, 0x917, 0x2, 0xa7, 0x7, 0x8, 0x1, 0x7, 0xc3, 0x5, 0x1, 0x1, 0x9, 0x5, 0x4, 0xb, 0x7, 0x9, 0x63, 0xfffffe00, 0x2040, 0x2, 0x90c7, 0x3, 0x1000, 0x8, 0x8, 0x698c, 0x7ff, 0x1, 0x9, 0x8001, 0x7e9, 0x2, 0x6, 0x2c, 0x10, 0x2, 0x0, 0x1, 0xb, 0x8, 0x200, 0x8000, 0x7, 0x9, 0x9, 0x2, 0x3, 0xfffffdc8, 0xfff, 0x6, 0x9, 0x100, 0x80, 0x1, 0xa9, 0x4, 0x3, 0x2de, 0x3, 0x1, 0x4, 0x101, 0x6, 0x1000, 0x0, 0x5, 0x0, 0x3, 0x9, 0x16c, 0x1, 0x8000, 0x1, 0x8, 0x9, 0x7, 0x99, 0x3, 0x8, 0x8, 0x4b81, 0x7fffffff, 0x10000, 0x7, 0x5, 0x3, 0x8, 0xffff, 0x401, 0x2a53, 0x9, 0x40, 0x7, 0xd80, 0xfff, 0x8, 0x8, 0x4, 0x29, 0x9, 0x8, 0x7ff, 0x2, 0x8, 0x7f, 0x0, 0x401, 0x7, 0x8, 0x7ff, 0x800, 0x1, 0x6, 0x3, 0x3, 0xff, 0x0, 0x8, 0x7, 0x6, 0x9, 0x5, 0xffffffff, 0xdba, 0xdf5, 0x6, 0x1, 0x5, 0xf8, 0x800, 0x9, 0x5, 0x1, 0x9, 0x2, 0x7, 0x7, 0x5, 0x432, 0x9, 0x5, 0x2, 0x2, 0x6, 0x4, 0x8, 0xa, 0x5, 0x6e06, 0x44, 0x4, 0x8, 0x2, 0x0, 0x2, 0x9, 0x7, 0xfffff001, 0x4, 0x6, 0x7f, 0x4, 0x800, 0x10, 0x10001, 0x1ff, 0x6, 0x9, 0xfffff1f7, 0x1, 0xb94, 0x80000001, 0x4, 0x6, 0x3, 0x6, 0x8001]}, @TCA_POLICE_TBF={0x3c, 0x1, {0x401, 0x7, 0xc, 0x40, 0x2, {0x2, 0x2, 0x1c00, 0x4, 0x8, 0x4}, {0x5, 0x0, 0x4, 0x7, 0x6, 0x2}, 0x10, 0x1000, 0x99}}]}, @TCA_BASIC_EMATCHES={0x4}, @TCA_BASIC_POLICE={0x870, 0x4, [@TCA_POLICE_PEAKRATE64={0xc, 0x9, 0x5}, @TCA_POLICE_AVRATE={0x8, 0x4, 0x8}, @TCA_POLICE_RATE={0x404, 0x2, [0x98, 0xa, 0x3, 0x4, 0x5299, 0x4, 0x3, 0xffff949e, 0x100, 0x3, 0xe05, 0x0, 0x4, 0x24, 0x8001, 0x1ff, 0x6, 0x2, 0x7, 0x80000000, 0x10001, 0x81, 0x1, 0x2, 0x40, 0x1, 0x0, 0x93, 0x2, 0x0, 0x7, 0x80000001, 0x1, 0x9, 0xe2a, 0x10, 0x9, 0x4, 0x2, 0xfff, 0x1ff, 0x5, 0x1, 0x7, 0x80000000, 0x4, 0x6, 0xfffffff7, 0x8001, 0x0, 0x800, 0x8, 0x83, 0x7f, 0x0, 0x10, 0x3, 0x0, 0x8, 0x6, 0xfffffffc, 0xfffffe00, 0x3, 0x9, 0x5a93, 0x1000, 0x300000, 0x20009, 0x73, 0x2, 0xf, 0x2, 0x0, 0x2, 0x60, 0x1ff, 0x3ff, 0x4, 0x7, 0x1, 0x9df, 0x1ff, 0x0, 0x7, 0x8, 0x4ab, 0x76, 0x3, 0x3e, 0x1, 0x7, 0x3, 0x80000000, 0x0, 0x9, 0x7, 0x64de, 0xffff, 0x800, 0x10001, 0xfffffffe, 0x5, 0x66, 0x1, 0x148dc91a, 0xf2, 0x6, 0x400, 0x5, 0x8, 0x100, 0x10000, 0x7, 0xb, 0x8, 0x4, 0x7, 0x59, 0x9, 0x5, 0x6, 0x101, 0x3, 0x7, 0x200, 0x8, 0xfffffffe, 0x8, 0x5, 0xfffffffc, 0x1, 0xb, 0x6, 0x9, 0x0, 0x7, 0x6, 0xf78, 0x5, 0x4, 0x1, 0x9, 0x8000, 0x1, 0x46b, 0x9, 0x2, 0x9, 0xde48, 0xa00, 0x6, 0x2, 0x200, 0x9, 0xc5, 0xcfb, 0xa, 0x8, 0x1, 0x2cb, 0x7, 0x3e4, 0x7, 0x5, 0x7ff, 0xfb49, 0x8, 0x1, 0xfd, 0xfffffff8, 0x7, 0x8f71, 0x400, 0x9, 0x2, 0x1e1, 0x20000000, 0x4, 0x7, 0x7, 0x0, 0x7fffffff, 0x2357, 0x200, 0x9, 0x5, 0x2, 0x7c, 0x6, 0xfffffc00, 0x6, 0x8, 0x3, 0x3ff, 0x6, 0x0, 0x9, 0x0, 0x2, 0x12000000, 0x85, 0xf, 0x101, 0x10001, 0x8, 0x2, 0x4, 0xa8, 0x2, 0x8, 0x0, 0xffffffff, 0x8, 0x5, 0x2, 0x10000, 0x3, 0x9, 0x18, 0x4, 0x2, 0x1ff, 0x80000003, 0x7ff, 0x5, 0x8, 0x10, 0x40, 0xfff, 0x6, 0x7, 0x80000001, 0x3, 0x9, 0x1, 0x8, 0x0, 0x2ee257b4, 0xc, 0x0, 0x10000, 0x40, 0x8, 0x9, 0x0, 0xa03, 0xb7, 0x73, 0x3, 0x7, 0x0, 0x3, 0x2d, 0x8, 0xffffa942, 0x3]}, @TCA_POLICE_TBF={0x3c, 0x1, {0x4, 0x20000000, 0x5, 0x7, 0x8, {0x9, 0x1, 0xffff, 0x1, 0x7, 0x401}, {0x7, 0x2, 0x7, 0x6, 0x1, 0x3ff}, 0x2, 0x401, 0x8}}, @TCA_POLICE_PEAKRATE={0x404, 0x3, [0x800, 0x3, 0x0, 0x9, 0xf8, 0x81, 0x0, 0xfffffffd, 0x100, 0x10001, 0xff, 0x7fffffff, 0xffff, 0x14, 0x81b6, 0x40, 0x9, 0x6, 0x91, 0x1, 0x9, 0xfff, 0x86, 0xb, 0x5, 0x0, 0x90, 0xe9, 0xa, 0x18, 0x77, 0x1, 0x5, 0x5, 0x2, 0x7, 0x116, 0x5, 0x965e, 0xe4a, 0x7fffffff, 0x3, 0x3236, 0x9, 0xff, 0x1, 0x7, 0x7, 0x7fff, 0x0, 0x7, 0x1, 0x5, 0x0, 0x7, 0x5, 0x3, 0xb6, 0x4a2f, 0x6, 0x0, 0x8, 0x40, 0xfff, 0x9, 0x3, 0x0, 0x6, 0xffffffff, 0x7360, 0x6, 0x9b0, 0x8, 0x7fffffff, 0x9, 0x2, 0x81, 0x2, 0x80000001, 0x200, 0x626096f6, 0x10000, 0x1, 0x5, 0x3, 0x81, 0x23, 0x7, 0x5, 0x6, 0xf8e7, 0x1, 0x4, 0x6, 0x2, 0x5, 0x8001, 0x400, 0x3, 0x1000, 0x7, 0xffff, 0x4, 0x0, 0x8, 0xff, 0xffffffff, 0x0, 0x3, 0x8000, 0x2, 0x10, 0x3, 0x6, 0x0, 0x4, 0x7, 0x100, 0x0, 0x1f9a80, 0x8, 0xa, 0x4, 0xfffffd91, 0x68f2f7d1, 0xfffff801, 0x7fffffff, 0x69, 0x80000000, 0xff, 0x4, 0x4, 0x7, 0xe, 0x5, 0x6a, 0x7, 0x300, 0x4, 0x2, 0x7, 0x0, 0x7f, 0xb, 0x1, 0x5, 0xff, 0xfffffff9, 0x0, 0x42, 0xfffffffe, 0x2, 0xb212, 0x7c, 0x3, 0x3b, 0x659, 0x1, 0x6, 0x9, 0x2, 0x7fffffff, 0xfff, 0x8, 0x1, 0x5, 0x800, 0x10000, 0x1, 0x401, 0x8, 0x6, 0x7, 0x2, 0x9, 0x2, 0x9, 0xd, 0x80000000, 0x538, 0x9, 0x2, 0x259, 0xe2d5, 0x99, 0x8, 0x668fe4b3, 0x5, 0x5f, 0x3, 0x4, 0xfffffffe, 0x9, 0x19, 0x4, 0x4, 0xfffffff7, 0x0, 0xffffffff, 0x2, 0x8, 0xcb, 0x8, 0x800, 0x7ff, 0x400, 0x4, 0x6, 0xff, 0x0, 0xc, 0x4c0, 0x1, 0xc32f, 0x8001, 0x3, 0x1, 0x7, 0x6, 0xf2d, 0x0, 0x1, 0x1, 0x2, 0x10, 0x1ff, 0x7fff, 0x4, 0x2, 0x8, 0x3, 0x1, 0x7, 0x8, 0x6, 0x2, 0x8, 0x2, 0xfd, 0x6, 0x0, 0x8, 0xffffff00, 0x0, 0x4, 0x8, 0x1, 0x3, 0xffffffff, 0x800, 0x7, 0x0, 0xfffffff4, 0x200, 0xf, 0x3899]}, @TCA_POLICE_AVRATE={0x8, 0x4, 0x6}, @TCA_POLICE_PEAKRATE64={0xc, 0x9, 0x6}]}]}}]}, 0xd10}, 0x1, 0x0, 0x0, 0x8044}, 0x4040050) (async) r2 = socket$netlink(0x10, 0x3, 0xc) bind$netlink(r2, &(0x7f0000514ff4)={0x10, 0x0, 0x0, 0x2ffffffff}, 0xc) setsockopt$netlink_NETLINK_BROADCAST_ERROR(r2, 0x10e, 0x4, &(0x7f0000000140)=0x6, 0x4) setsockopt$sock_int(r2, 0x1, 0x8, &(0x7f0000000200), 0x4) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) (async) r4 = socket$unix(0x1, 0x5, 0x0) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000040)={'batadv_slave_1\x00', 0x0}) (async) r6 = socket(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r6, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000300)=@newqdisc={0x88, 0x24, 0xf0b, 0x70bd26, 0x0, {0x0, 0x0, 0x0, r5, {0x0, 0xffff}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_mqprio={{0xb}, {0x58, 0x2, {{0x1, [], 0x0, [0x1, 0x2, 0xfffe, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x5c4, 0x8000, 0x0, 0x0, 0x3dc], [0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1000]}}}}]}, 0x88}}, 0x20000000) sendmsg$nl_route_sched(r6, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000100)=@newqdisc={0x4c, 0x24, 0x4ee4e6a52ff56541, 0x70bd2d, 0xfffbffff, {0x0, 0x0, 0x0, r5, {0x0, 0x8}, {0xffff, 0xffff}, {0xc, 0xfff3}}, [@qdisc_kind_options=@q_taprio={{0xb}, {0x1c, 0x2, [@TCA_TAPRIO_ATTR_SCHED_ENTRY_LIST={0x10, 0x2, 0x0, 0x1, [{0xc, 0x1, 0x0, 0x1, [@TCA_TAPRIO_SCHED_ENTRY_INTERVAL={0x8, 0x4, 0x8001}]}]}, @TCA_TAPRIO_ATTR_FLAGS={0x8, 0xa, 0x2}]}}]}, 0x4c}, 0x1, 0x0, 0x0, 0x40001}, 0x4040010) (async) sendmsg$IPCTNL_MSG_CT_NEW(r3, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f00000029c0)={0x94, 0x0, 0x1, 0x401, 0x0, 0x0, {0xa}, [@CTA_TUPLE_ORIG={0x3c, 0x1, 0x0, 0x1, [@CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @local}, {0x14, 0x4, @mcast1}}}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5}}]}, @CTA_TUPLE_REPLY={0x3c, 0x2, 0x0, 0x1, [@CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @local}, {0x14, 0x4, @local}}}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5}}]}, @CTA_TIMEOUT={0x8}]}, 0x94}}, 0x0) (async) r7 = syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10) sendmsg$netlink(r7, &(0x7f00000001c0)={0x0, 0x0, &(0x7f00000008c0)=[{&(0x7f0000002740)=ANY=[@ANYBLOB="140000001300016e994fde440113e90005"], 0x14}], 0x1}, 0x0) (async) r8 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_DELETE(r3, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000640)={0x14, 0x2, 0x1, 0x5, 0x0, 0x0, {0x2, 0x0, 0x8}}, 0x14}, 0x1, 0x0, 0x0, 0x20044804}, 0x40040) (async) readv(r8, &(0x7f0000001700)=[{&(0x7f0000000680)=""/4096, 0x1000}], 0x1) (async) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000000c0)=[{&(0x7f0000000580)="d8000000140081054e81f782db44b904021d080225000000040000a118000200fcffffff00", 0x25}], 0x1, 0x0, 0x0, 0x7400}, 0x34044001) (async) r9 = socket$kcm(0x10, 0x2, 0x0) write$cgroup_subtree(r9, &(0x7f0000000580)=ANY=[], 0xfe33) (async) sendmsg$IPCTNL_MSG_CT_GET_DYING(r8, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000100)={&(0x7f00000005c0)={0x14, 0x6, 0x1, 0x301, 0x0, 0x0, {0xa, 0x0, 0x4}}, 0x14}, 0x1, 0x0, 0x0, 0x2404c031}, 0x20000000) (async) socket$inet6_sctp(0xa, 0x5, 0x84) (async) openat$tun(0xffffffffffffff9c, &(0x7f0000000040), 0x200, 0x0) r10 = socket$packet(0x11, 0x2, 0x300) (async) socketpair(0x1, 0x100000005, 0x0, &(0x7f0000000000)={0xffffffffffffffff}) getpeername$packet(r11, &(0x7f0000000000)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000040)=0x14) sendmmsg(r10, &(0x7f00000005c0)=[{{&(0x7f0000000700)=@xdp={0x2c, 0x8, r12, 0x14}, 0x80, 0x0}}], 0x1, 0x20000081) 132.68153ms ago: executing program 2 (id=2316): r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000580)=@base={0x6, 0x4, 0x8, 0x8}, 0x50) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r1, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000008e80)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a01080000000000000000070000000900010073797a30000000004c000000090a010400000000000000000700000008000a40000000000900020073797a31000000000900010073797a3000000000080005400000000c080003400000001c08000640ffffff00f43b00000c0a01010000000000000000070000000900020073797a31000000000900010073797a30000000001400038010000080080003400000000204000280b43b0380ec03008054000a804e00010019d1d87b73b1f888777e7694b6407e83e23c116497d7e15d28dbd916dd83f5a795e46458e6160d6b66628b6946c2657c7fb851508899bbbbd97d89ae13f401a84847ab2cd4952bdef8b600000800034000000001400001"], 0x3c88}}, 0x4000840) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x4, 0xc, &(0x7f0000000880)=ANY=[@ANYBLOB="1800000000000000000000000000000018150000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000012000000850000001500000095"], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r2 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$nbd(&(0x7f0000000000), 0xffffffffffffffff) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff}) sendmsg$NBD_CMD_CONNECT(r3, &(0x7f0000001ac0)={0x0, 0x0, &(0x7f0000001a80)={&(0x7f0000000140)={0x38, r4, 0x1, 0xfffffffd, 0x0, {}, [@NBD_ATTR_SOCKETS={0x10, 0x7, 0x0, 0x1, [{0xc, 0x1, 0x0, 0x1, {0x8, 0x1, r5}}]}, @NBD_ATTR_INDEX={0x8, 0x1, 0x0}, @NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x7fff}]}, 0x38}}, 0x20000000) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000200)={0x1c, r4, 0x1, 0x70bd27, 0x25dfdbff, {}, [@NBD_ATTR_INDEX={0x8, 0x1, 0x0}]}, 0x1c}, 0x1, 0x0, 0x0, 0x51}, 0x4000810) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32, @ANYBLOB="0000000000000000b70800000d0000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) r6 = bpf$MAP_CREATE(0x0, &(0x7f0000000740)=ANY=[@ANYBLOB="0b00000005000000000400000900000001"], 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000004c0)={0xa, 0x4, &(0x7f0000000480)=ANY=[@ANYBLOB="18000000000000000000000000000000850000006d"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0xe, 0x0, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000800000000000000000000018110000", @ANYRES32=r6], 0x0, 0x0, 0x0, 0x0, 0x41100, 0x59, '\x00', 0x0, @fallback=0x2a, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0}, 0x94) r7 = bpf$PROG_LOAD(0x5, &(0x7f0000000300)={0x6, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback=0x4, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r8 = socket$kcm(0x1e, 0x4, 0x0) setsockopt$sock_attach_bpf(r8, 0x10f, 0x87, &(0x7f00000008c0), 0x43) r9 = socket$kcm(0x1e, 0x4, 0x0) setsockopt$sock_attach_bpf(r9, 0x10f, 0x87, &(0x7f00000008c0), 0x43) write$cgroup_subtree(r9, &(0x7f0000000040)=ANY=[], 0x101d0) sendmsg$kcm(r9, &(0x7f00000001c0)={&(0x7f0000000040)=@tipc=@nameseq={0x1e, 0x1, 0x1, {0x42}}, 0x80, 0x0, 0x0, &(0x7f0000000140)=ANY=[], 0x1458}, 0x20048811) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000180)={r7, 0x2000000, 0xe, 0x0, &(0x7f0000000040)="630b008666dc3f0adf33c9f7b986", 0x0, 0xcf25, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x80}, 0x50) r10 = socket$netlink(0x10, 0x3, 0x0) r11 = socket(0x10, 0x803, 0x0) sendmsg$IPVS_CMD_SET_INFO(r11, &(0x7f0000000b00)={0x0, 0x0, &(0x7f0000000ac0)={0x0, 0x14}}, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000100)={0xd, 0x4, &(0x7f0000000040)=@framed={{0x18, 0x0, 0x0, 0x0, 0xffffff41, 0x0, 0x0, 0x0, 0x8}, [@generic={0x91, 0x1, 0x1, 0xd9}]}, &(0x7f0000000c40)='GPL\x00', 0x3, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, @fallback=0x1d, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffff9}, 0x94) getsockname$packet(r11, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r11, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000380)=ANY=[@ANYBLOB="3c0000001000850600"/20, @ANYRES32=r12, @ANYBLOB="01000000000000001c0012000c000100626f6e64000000000c0002000800010006"], 0x3c}}, 0x0) sendmsg$nl_route(r10, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000180)=ANY=[@ANYBLOB="3c00000010001fff000000000100000000000000", @ANYRES32=0x0, @ANYBLOB="0000000000000000140012800900010076657468000000000400028008000a00", @ANYRES32=r12], 0x3c}, 0x1, 0x0, 0x0, 0x40000}, 0x0) socket$nl_route(0x10, 0x3, 0x0) 0s ago: executing program 0 (id=2317): openat$tun(0xffffffffffffff9c, 0x0, 0x48641, 0x0) r0 = openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, 0x0) readv(r0, 0x0, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r1, 0x0, 0x0) ioctl$SIOCSIFHWADDR(0xffffffffffffffff, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0xe}}) sendmsg$tipc(0xffffffffffffffff, &(0x7f00000000c0)={&(0x7f0000000200)=@nameseq={0x1e, 0x1, 0x1, {0x2, 0x0, 0x2}}, 0x10, 0x0, 0x0, 0x0, 0x0, 0x40080}, 0x40) ioctl$TUNSETIFF(r0, 0x400454ca, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000240)={0x11, 0x13, &(0x7f0000000300)=ANY=[@ANYRES32=r0], &(0x7f00000001c0)='GPL\x00', 0xa, 0xce, &(0x7f0000000340)=""/206, 0x40f00, 0x8}, 0x94) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r4 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040), 0x20702, 0x0) ioctl$TUNSETIFF(r4, 0x400454ca, &(0x7f0000000080)={'syzkaller0\x00', 0xca58c30f81b6079f}) ioctl$TUNSETQUEUE(r4, 0x400454d9, &(0x7f0000000780)={'pim6reg0\x00', 0x400}) close(0x3) ioctl$sock_bt_hci(r3, 0x800448d2, 0x0) bind$bt_hci(r3, &(0x7f0000000080)={0x1f, 0xffff, 0x3}, 0x6) sendmsg$nl_route(r2, &(0x7f0000000340)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000640)=ANY=[@ANYBLOB="6c000000100001002bbd7000fbdbdf2500000000", @ANYRES32=0x0, @ANYBLOB="8a43010000000000300016802c00018028000100f6ffffff000000000000000000000000000000000000000000000000000000000000000014000300776c616e30000000000000000000000008000a00", @ANYRES32=0x0, @ANYBLOB="0800ffedebfcd27f3a3c57e17405bb77fc5a64d84e6b"], 0x6c}, 0x1, 0x0, 0x0, 0x4000880}, 0x0) r5 = socket$nl_rdma(0x10, 0x3, 0x14) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r5, &(0x7f00000005c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000440)=ANY=[], 0x38}, 0x1, 0x0, 0x0, 0x2000010}, 0x8000) r6 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='blkio.bfq.io_service_bytes\x00', 0x275a, 0x0) write$cgroup_subtree(r6, &(0x7f0000000880)=ANY=[], 0x32600) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x2000001, 0x12, r6, 0x0) r7 = syz_init_net_socket$bt_l2cap(0x1f, 0x5, 0x0) ioctl$sock_ifreq(r7, 0x8970, &(0x7f0000000080)={'dummy0\x00', @ifru_flags=0x100}) socket$inet6(0xa, 0x1, 0x84) r8 = socket$inet(0x2, 0x2, 0x1) sendmsg$inet(r8, &(0x7f0000000600)={&(0x7f0000000000)={0x2, 0x0, @initdev={0xac, 0x1e, 0x1, 0x0}}, 0x10, &(0x7f00000000c0)=[{&(0x7f0000000400)='\b\x00', 0x2}, {&(0x7f0000000180)="2d0000008058", 0x6}], 0x2, &(0x7f0000000100)=ANY=[@ANYBLOB="1c000000000000000000000007000000830b040a0101027f00000100000000001c000000000000000000000008000000", @ANYRESOCT=r8], 0x40}, 0x20000000) syz_init_net_socket$802154_raw(0x24, 0x3, 0x0) kernel console output (not intermixed with test programs): . [ 194.268304][ T8790] netlink: 'syz.3.740': attribute type 3 has an invalid length. [ 194.485008][ C0] ip6_tunnel: ip6gre2 xmit: Local address not yet configured! [ 194.678069][ T8807] netlink: 8 bytes leftover after parsing attributes in process `syz.0.743'. [ 194.938130][ T8819] netlink: 24 bytes leftover after parsing attributes in process `syz.4.745'. [ 194.982555][ T8819] netlink: 'syz.4.745': attribute type 4 has an invalid length. [ 194.982583][ T8819] netlink: 152 bytes leftover after parsing attributes in process `syz.4.745'. [ 195.705580][ T8838] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 195.799057][ T8840] netlink: 20 bytes leftover after parsing attributes in process `syz.3.749'. [ 195.881356][ T8838] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 196.176333][ T8846] netlink: 8 bytes leftover after parsing attributes in process `syz.4.750'. [ 196.176362][ T8846] netlink: 4 bytes leftover after parsing attributes in process `syz.4.750'. [ 196.176390][ T8846] netlink: 'syz.4.750': attribute type 14 has an invalid length. [ 196.176406][ T8846] netlink: 'syz.4.750': attribute type 13 has an invalid length. [ 196.890501][ T5833] udevd[5833]: inotify_add_watch(7, /dev/nbd64, 10) failed: No such file or directory [ 196.919489][ T8855] netlink: 8 bytes leftover after parsing attributes in process `syz.1.752'. [ 197.026233][ T8858] syzkaller1: entered promiscuous mode [ 197.026261][ T8858] syzkaller1: entered allmulticast mode [ 197.317575][ T8875] syzkaller0: entered promiscuous mode [ 197.317602][ T8875] syzkaller0: entered allmulticast mode [ 197.325514][ T8875] tipc: Started in network mode [ 197.325589][ T8875] tipc: Node identity 0ad0b42dc4f5, cluster identity 4711 [ 197.328832][ T8875] tipc: Enabled bearer , priority 0 [ 197.462612][ T8873] tipc: Resetting bearer [ 197.528986][ T8873] tipc: Disabling bearer [ 197.546208][ T8885] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 197.681366][ T8885] netlink: 12 bytes leftover after parsing attributes in process `syz.2.758'. [ 197.681416][ T8885] block nbd0: not configured, cannot reconfigure [ 197.686582][ T8892] netlink: 4 bytes leftover after parsing attributes in process `syz.3.759'. [ 197.844677][ T8897] netlink: 24 bytes leftover after parsing attributes in process `syz.1.760'. [ 197.877871][ T8897] netlink: 'syz.1.760': attribute type 4 has an invalid length. [ 197.879595][ T8897] 8021q: adding VLAN 0 to HW filter on device bond0 [ 198.281266][ T8914] netlink: 'syz.3.763': attribute type 1 has an invalid length. [ 198.393368][ T8914] 8021q: adding VLAN 0 to HW filter on device bond6 [ 198.901897][ T8940] sctp: [Deprecated]: syz.2.767 (pid 8940) Use of int in max_burst socket option. [ 198.901897][ T8940] Use struct sctp_assoc_value instead [ 199.014330][ T8941] sctp: [Deprecated]: syz.2.767 (pid 8941) Use of int in max_burst socket option. [ 199.014330][ T8941] Use struct sctp_assoc_value instead [ 199.287793][ T8956] bond0: (slave ip6tnl0): refused to change device type [ 200.411333][ T8990] block nbd0: server does not support multiple connections per device. [ 200.411942][ T8990] block nbd0: shutting down sockets [ 200.651557][ T8999] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 200.693618][ T9004] FAULT_INJECTION: forcing a failure. [ 200.693618][ T9004] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 200.693654][ T9004] CPU: 1 UID: 0 PID: 9004 Comm: syz.3.782 Not tainted syzkaller #0 PREEMPT(full) [ 200.693679][ T9004] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 200.693694][ T9004] Call Trace: [ 200.693703][ T9004] [ 200.693712][ T9004] dump_stack_lvl+0xe8/0x150 [ 200.693754][ T9004] should_fail_ex+0x410/0x560 [ 200.693793][ T9004] _copy_to_user+0x31/0xb0 [ 200.693825][ T9004] bpf_verifier_vlog+0x496/0x900 [ 200.693862][ T9004] bpf_verifier_log_write+0x11d/0x1a0 [ 200.693892][ T9004] ? __pfx_bpf_verifier_log_write+0x10/0x10 [ 200.693924][ T9004] ? __pfx_bpf_verifier_log_write+0x10/0x10 [ 200.693945][ T9004] ? __kvmalloc_node_noprof+0x52f/0x820 [ 200.693979][ T9004] verbose_arg_track+0x161/0x610 [ 200.694012][ T9004] analyze_subprog+0x2cec/0x9e00 [ 200.694038][ T9004] ? print_uprobe_event+0x7f/0x3f0 [ 200.694119][ T9004] ? __pfx_analyze_subprog+0x10/0x10 [ 200.694144][ T9004] ? __x64_sys_bpf+0xba/0xd0 [ 200.694164][ T9004] ? do_syscall_64+0x166/0x520 [ 200.694191][ T9004] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 200.694256][ T9004] ? call_instance+0x263/0x560 [ 200.694281][ T9004] ? rcu_is_watching+0x16/0xb0 [ 200.694308][ T9004] ? call_instance+0x263/0x560 [ 200.694331][ T9004] ? trace_kmalloc+0x2a/0xf0 [ 200.694355][ T9004] ? call_instance+0x263/0x560 [ 200.694379][ T9004] ? __kvmalloc_node_noprof+0x52f/0x820 [ 200.694406][ T9004] ? __kvmalloc_node_noprof+0x345/0x820 [ 200.694430][ T9004] ? call_instance+0x263/0x560 [ 200.694454][ T9004] ? call_instance+0x263/0x560 [ 200.694497][ T9004] bpf_compute_subprog_arg_access+0x2c9/0x14d0 [ 200.694526][ T9004] ? __pfx_lwt_seg6local_func_proto+0x10/0x10 [ 200.694556][ T9004] ? bpf_get_trace_printk_proto+0x48/0x60 [ 200.694613][ T9004] ? __pfx_bpf_compute_subprog_arg_access+0x10/0x10 [ 200.694647][ T9004] ? __kvmalloc_node_noprof+0x345/0x820 [ 200.694672][ T9004] ? bpf_compute_live_registers+0x14f/0x1ff0 [ 200.694697][ T9004] ? bpf_compute_live_registers+0x14f/0x1ff0 [ 200.694732][ T9004] bpf_compute_live_registers+0x8d3/0x1ff0 [ 200.694783][ T9004] ? __pfx_bpf_compute_live_registers+0x10/0x10 [ 200.694821][ T9004] bpf_check+0x25ed/0x2e10 [ 200.694857][ T9004] ? ktime_get_with_offset+0x93/0x2d0 [ 200.694885][ T9004] ? __pfx_bpf_check+0x10/0x10 [ 200.694913][ T9004] ? bpf_obj_name_cpy+0x194/0x1e0 [ 200.694948][ T9004] bpf_prog_load+0x14d6/0x1c20 [ 200.694987][ T9004] ? __pfx_bpf_prog_load+0x10/0x10 [ 200.695039][ T9004] __sys_bpf+0xd0d/0xd90 [ 200.695073][ T9004] ? __pfx___sys_bpf+0x10/0x10 [ 200.695110][ T9004] ? __fget_files+0x2a/0x420 [ 200.695159][ T9004] ? ksys_write+0x242/0x270 [ 200.695196][ T9004] ? __pfx_ksys_write+0x10/0x10 [ 200.695233][ T9004] __x64_sys_bpf+0xba/0xd0 [ 200.695259][ T9004] do_syscall_64+0x166/0x520 [ 200.695285][ T9004] ? trace_irq_disable+0x3b/0x140 [ 200.695307][ T9004] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 200.695331][ T9004] ? clear_bhb_loop+0x70/0xc0 [ 200.695357][ T9004] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 200.695379][ T9004] RIP: 0033:0x7f924059e159 [ 200.695399][ T9004] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 200.695418][ T9004] RSP: 002b:00007f9241467028 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 200.695441][ T9004] RAX: ffffffffffffffda RBX: 00007f9240825fa0 RCX: 00007f924059e159 [ 200.695458][ T9004] RDX: 0000000000000078 RSI: 0000200000000440 RDI: 0000000000000005 [ 200.695473][ T9004] RBP: 00007f9241467090 R08: 0000000000000000 R09: 0000000000000000 [ 200.695486][ T9004] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 200.695498][ T9004] R13: 00007f9240826038 R14: 00007f9240825fa0 R15: 00007ffccca256c8 [ 200.695533][ T9004] [ 200.910046][ T9008] __nla_validate_parse: 2 callbacks suppressed [ 200.910121][ T9008] netlink: 24 bytes leftover after parsing attributes in process `syz.4.783'. [ 201.136207][ T9008] netlink: 'syz.4.783': attribute type 4 has an invalid length. [ 201.136341][ T9008] netlink: 152 bytes leftover after parsing attributes in process `syz.4.783'. [ 201.436103][ T9018] RDS: rds_bind could not find a transport for ::ffff:172.30.0.4, load rds_tcp or rds_rdma? [ 201.571526][ T9018] x_tables: ip6_tables: rpfilter match: used from hooks OUTPUT, but only valid from PREROUTING [ 201.632363][ T9018] netlink: 188 bytes leftover after parsing attributes in process `syz.3.787'. [ 202.364933][ T9055] netlink: 'syz.3.796': attribute type 1 has an invalid length. [ 202.458825][ T9064] FAULT_INJECTION: forcing a failure. [ 202.458825][ T9064] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 202.458865][ T9064] CPU: 0 UID: 0 PID: 9064 Comm: syz.2.797 Not tainted syzkaller #0 PREEMPT(full) [ 202.458893][ T9064] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 202.458909][ T9064] Call Trace: [ 202.458918][ T9064] [ 202.458929][ T9064] dump_stack_lvl+0xe8/0x150 [ 202.458971][ T9064] should_fail_ex+0x410/0x560 [ 202.459006][ T9064] _copy_to_user+0x31/0xb0 [ 202.459052][ T9064] bpf_verifier_vlog+0x496/0x900 [ 202.459090][ T9064] verbose+0x11d/0x1a0 [ 202.459126][ T9064] ? __pfx_verbose+0x10/0x10 [ 202.459151][ T9064] ? lock_acquire+0x115/0x350 [ 202.459188][ T9064] print_bpf_insn+0x14f7/0x2930 [ 202.459222][ T9064] ? __pfx_verbose+0x10/0x10 [ 202.459249][ T9064] ? __pfx_print_bpf_insn+0x10/0x10 [ 202.459281][ T9064] ? _copy_to_user+0x8a/0xb0 [ 202.459314][ T9064] ? bpf_verifier_vlog+0x58d/0x900 [ 202.459352][ T9064] ? bpf_verifier_log_write+0x11d/0x1a0 [ 202.459382][ T9064] bpf_verbose_insn+0xcb/0x130 [ 202.459408][ T9064] ? __pfx_bpf_verbose_insn+0x10/0x10 [ 202.459431][ T9064] ? __kvmalloc_node_noprof+0x52f/0x820 [ 202.459458][ T9064] ? __pfx_verbose+0x10/0x10 [ 202.459479][ T9064] ? __pfx_bpf_disasm_kfunc_name+0x10/0x10 [ 202.459510][ T9064] ? arg_track_eq+0x503/0x7a0 [ 202.459547][ T9064] analyze_subprog+0x2cb5/0x9e00 [ 202.459577][ T9064] ? print_uprobe_event+0x7f/0x3f0 [ 202.459664][ T9064] ? __pfx_analyze_subprog+0x10/0x10 [ 202.459692][ T9064] ? __x64_sys_bpf+0xba/0xd0 [ 202.459714][ T9064] ? do_syscall_64+0x166/0x520 [ 202.459743][ T9064] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 202.459812][ T9064] ? call_instance+0x263/0x560 [ 202.459839][ T9064] ? rcu_is_watching+0x16/0xb0 [ 202.459869][ T9064] ? call_instance+0x263/0x560 [ 202.459894][ T9064] ? trace_kmalloc+0x2a/0xf0 [ 202.459920][ T9064] ? call_instance+0x263/0x560 [ 202.459946][ T9064] ? __kvmalloc_node_noprof+0x52f/0x820 [ 202.459977][ T9064] ? __kvmalloc_node_noprof+0x345/0x820 [ 202.460003][ T9064] ? call_instance+0x263/0x560 [ 202.460038][ T9064] ? call_instance+0x263/0x560 [ 202.460084][ T9064] bpf_compute_subprog_arg_access+0x2c9/0x14d0 [ 202.460117][ T9064] ? __pfx_lwt_seg6local_func_proto+0x10/0x10 [ 202.460151][ T9064] ? bpf_get_trace_printk_proto+0x48/0x60 [ 202.460213][ T9064] ? __pfx_bpf_compute_subprog_arg_access+0x10/0x10 [ 202.460251][ T9064] ? __kvmalloc_node_noprof+0x345/0x820 [ 202.460279][ T9064] ? bpf_compute_live_registers+0x14f/0x1ff0 [ 202.460308][ T9064] ? bpf_compute_live_registers+0x14f/0x1ff0 [ 202.460347][ T9064] bpf_compute_live_registers+0x8d3/0x1ff0 [ 202.460400][ T9064] ? __pfx_bpf_compute_live_registers+0x10/0x10 [ 202.460444][ T9064] bpf_check+0x25ed/0x2e10 [ 202.460486][ T9064] ? ktime_get_with_offset+0x93/0x2d0 [ 202.460525][ T9064] ? __pfx_bpf_check+0x10/0x10 [ 202.460558][ T9064] ? bpf_obj_name_cpy+0x194/0x1e0 [ 202.460599][ T9064] bpf_prog_load+0x14d6/0x1c20 [ 202.460643][ T9064] ? __pfx_bpf_prog_load+0x10/0x10 [ 202.460702][ T9064] __sys_bpf+0xd0d/0xd90 [ 202.460739][ T9064] ? __pfx___sys_bpf+0x10/0x10 [ 202.460781][ T9064] ? __fget_files+0x2a/0x420 [ 202.460842][ T9064] ? ksys_write+0x242/0x270 [ 202.460883][ T9064] ? __pfx_ksys_write+0x10/0x10 [ 202.460926][ T9064] __x64_sys_bpf+0xba/0xd0 [ 202.460955][ T9064] do_syscall_64+0x166/0x520 [ 202.460984][ T9064] ? trace_irq_disable+0x3b/0x140 [ 202.461009][ T9064] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 202.461042][ T9064] ? clear_bhb_loop+0x70/0xc0 [ 202.461074][ T9064] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 202.461100][ T9064] RIP: 0033:0x7f9e9399e159 [ 202.461124][ T9064] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 202.461146][ T9064] RSP: 002b:00007f9e9477e028 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 202.461175][ T9064] RAX: ffffffffffffffda RBX: 00007f9e93c25fa0 RCX: 00007f9e9399e159 [ 202.461195][ T9064] RDX: 0000000000000078 RSI: 0000200000000440 RDI: 0000000000000005 [ 202.461212][ T9064] RBP: 00007f9e9477e090 R08: 0000000000000000 R09: 0000000000000000 [ 202.461228][ T9064] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 202.461242][ T9064] R13: 00007f9e93c26038 R14: 00007f9e93c25fa0 R15: 00007ffc0c9c1058 [ 202.461282][ T9064] [ 202.920568][ T9055] 8021q: adding VLAN 0 to HW filter on device bond7 [ 202.942130][ T9061] bond2: (slave veth0_to_bond): Releasing active interface [ 202.969551][ T9061] bond7: (slave veth0_to_bond): making interface the new active one [ 202.971306][ T9061] bond7: (slave veth0_to_bond): Enslaving as an active interface with an up link [ 203.044762][ T9065] macvlan2: entered promiscuous mode [ 203.044789][ T9065] macvlan2: entered allmulticast mode [ 203.045548][ T9065] bond7: entered promiscuous mode [ 203.045566][ T9065] veth0_to_bond: entered promiscuous mode [ 203.046578][ T9065] 8021q: adding VLAN 0 to HW filter on device macvlan2 [ 203.047362][ T9065] bond7: (slave macvlan2): the slave hw address is in use by the bond; couldn't find a slave with a free hw address to give it (this should not have happened) [ 203.047564][ T9065] bond7: left promiscuous mode [ 203.047580][ T9065] veth0_to_bond: left promiscuous mode [ 203.441468][ T9074] netlink: 164 bytes leftover after parsing attributes in process `syz.2.799'. [ 203.681709][ T9071] 8021q: adding VLAN 0 to HW filter on device bond6 [ 203.712066][ T9071] team0: Port device bond6 added [ 203.819091][ T9097] netlink: 'syz.3.804': attribute type 1 has an invalid length. [ 204.138767][ T9099] bond8: entered promiscuous mode [ 204.138795][ T9099] bond8: entered allmulticast mode [ 204.139181][ T9099] 8021q: adding VLAN 0 to HW filter on device bond8 [ 204.533449][ T9112] tipc: Started in network mode [ 204.533490][ T9112] tipc: Node identity 7ea9a6d56d61, cluster identity 4711 [ 204.533758][ T9112] tipc: Enabled bearer , priority 0 [ 204.629390][ T9106] sch_tbf: burst 255 is lower than device syzkaller0 mtu (1514) ! [ 204.692306][ T9112] tipc: Resetting bearer [ 204.866401][ T9120] syzkaller0: entered promiscuous mode [ 204.866427][ T9120] syzkaller0: entered allmulticast mode [ 204.871070][ T9105] tipc: Resetting bearer [ 204.978615][ T9105] tipc: Disabling bearer [ 205.240336][ T9151] sctp: [Deprecated]: syz.2.817 (pid 9151) Use of struct sctp_assoc_value in delayed_ack socket option. [ 205.240336][ T9151] Use struct sctp_sack_info instead [ 205.538244][ T5623] Bluetooth: hci3: SCO packet too small [ 205.639873][ T9162] netlink: 52 bytes leftover after parsing attributes in process `syz.3.819'. [ 205.742683][ T9159] syzkaller0: entered promiscuous mode [ 205.742712][ T9159] syzkaller0: entered allmulticast mode [ 206.279651][ T5623] Bluetooth: hci4: link tx timeout [ 206.279674][ T5623] Bluetooth: hci4: killing stalled connection 10:aa:aa:aa:aa:aa [ 208.323455][ T52] Bluetooth: hci4: command 0x0406 tx timeout [ 208.836831][ T9204] netlink: 32 bytes leftover after parsing attributes in process `syz.2.829'. [ 209.089894][ T9213] netlink: 8 bytes leftover after parsing attributes in process `syz.2.832'. [ 209.140836][ T9216] netlink: 4 bytes leftover after parsing attributes in process `syz.2.832'. [ 209.203325][ C0] ip6_tunnel: ip6gre2 xmit: Local address not yet configured! [ 209.239706][ T9216] A link change request failed with some changes committed already. Interface gre1 may have been left with an inconsistent configuration, please check. [ 209.240079][ T9216] netlink: 4 bytes leftover after parsing attributes in process `syz.2.832'. [ 209.241125][ T9216] A link change request failed with some changes committed already. Interface gre1 may have been left with an inconsistent configuration, please check. [ 209.241413][ T9216] netlink: 4 bytes leftover after parsing attributes in process `syz.2.832'. [ 209.242568][ T9216] A link change request failed with some changes committed already. Interface gre1 may have been left with an inconsistent configuration, please check. [ 209.242854][ T9216] netlink: 4 bytes leftover after parsing attributes in process `syz.2.832'. [ 209.324117][ T9216] A link change request failed with some changes committed already. Interface gre1 may have been left with an inconsistent configuration, please check. [ 209.324432][ T9216] netlink: 4 bytes leftover after parsing attributes in process `syz.2.832'. [ 209.325344][ T9216] A link change request failed with some changes committed already. Interface gre1 may have been left with an inconsistent configuration, please check. [ 209.325585][ T9216] netlink: 4 bytes leftover after parsing attributes in process `syz.2.832'. [ 209.326483][ T9216] A link change request failed with some changes committed already. Interface gre1 may have been left with an inconsistent configuration, please check. [ 209.326716][ T9216] netlink: 4 bytes leftover after parsing attributes in process `syz.2.832'. [ 209.327705][ T9216] A link change request failed with some changes committed already. Interface gre1 may have been left with an inconsistent configuration, please check. [ 209.327946][ T9216] netlink: 4 bytes leftover after parsing attributes in process `syz.2.832'. [ 209.328982][ T9216] A link change request failed with some changes committed already. Interface gre1 may have been left with an inconsistent configuration, please check. [ 209.330285][ T9216] A link change request failed with some changes committed already. Interface gre1 may have been left with an inconsistent configuration, please check. [ 209.331467][ T9216] A link change request failed with some changes committed already. Interface gre1 may have been left with an inconsistent configuration, please check. [ 210.055267][ T9238] syzkaller1: tun_chr_ioctl cmd 1074025673 [ 210.055414][ T9238] syzkaller1: tun_chr_ioctl cmd 1074025673 [ 210.055516][ T9238] syzkaller1: tun_chr_ioctl cmd 1074025673 [ 210.055636][ T9238] syzkaller1: tun_chr_ioctl cmd 1074025673 [ 210.055739][ T9238] syzkaller1: tun_chr_ioctl cmd 1074025673 [ 210.055870][ T9238] syzkaller1: tun_chr_ioctl cmd 1074025673 [ 210.055971][ T9238] syzkaller1: tun_chr_ioctl cmd 1074025673 [ 210.056071][ T9238] syzkaller1: tun_chr_ioctl cmd 1074025673 [ 210.056177][ T9238] syzkaller1: tun_chr_ioctl cmd 1074025673 [ 210.056307][ T9238] syzkaller1: tun_chr_ioctl cmd 1074025673 [ 210.056408][ T9238] syzkaller1: tun_chr_ioctl cmd 1074025673 [ 210.056510][ T9238] syzkaller1: tun_chr_ioctl cmd 1074025673 [ 210.056612][ T9238] syzkaller1: tun_chr_ioctl cmd 1074025673 [ 210.059899][ T9239] syzkaller1: tun_chr_ioctl cmd 1074025677 [ 210.060025][ T9239] syzkaller1: linktype set to 769 [ 210.061970][ T9238] syzkaller1: tun_chr_ioctl cmd 1074025673 [ 210.062110][ T9238] syzkaller1: tun_chr_ioctl cmd 1074025673 [ 210.062217][ T9238] syzkaller1: tun_chr_ioctl cmd 1074025673 [ 210.062318][ T9238] syzkaller1: tun_chr_ioctl cmd 1074025673 [ 210.062416][ T9238] syzkaller1: tun_chr_ioctl cmd 1074025673 [ 210.062544][ T9238] syzkaller1: tun_chr_ioctl cmd 1074025673 [ 210.062643][ T9238] syzkaller1: tun_chr_ioctl cmd 1074025673 [ 210.062741][ T9238] syzkaller1: tun_chr_ioctl cmd 1074025673 [ 210.062842][ T9238] syzkaller1: tun_chr_ioctl cmd 1074025673 [ 210.062976][ T9238] syzkaller1: tun_chr_ioctl cmd 1074025673 [ 210.237639][ T9238] syzkaller1: tun_chr_ioctl cmd 1074025673 [ 210.237790][ T9238] syzkaller1: tun_chr_ioctl cmd 1074025673 [ 210.237883][ T9238] syzkaller1: tun_chr_ioctl cmd 1074025673 [ 210.238002][ T9238] syzkaller1: tun_chr_ioctl cmd 1074025673 [ 210.238092][ T9238] syzkaller1: tun_chr_ioctl cmd 1074025673 [ 210.238190][ T9238] syzkaller1: tun_chr_ioctl cmd 1074025673 [ 210.238279][ T9238] syzkaller1: tun_chr_ioctl cmd 1074025673 [ 210.238396][ T9238] syzkaller1: tun_chr_ioctl cmd 1074025673 [ 210.238486][ T9238] syzkaller1: tun_chr_ioctl cmd 1074025673 [ 210.842917][ T9263] netlink: 'syz.3.841': attribute type 4 has an invalid length. [ 211.930867][ T9233] Bluetooth: hci2: command 0x0406 tx timeout [ 211.930914][ T9233] Bluetooth: hci3: command 0x0406 tx timeout [ 211.930942][ T9233] Bluetooth: hci1: command 0x0406 tx timeout [ 212.037809][ T9299] tun0: tun_chr_ioctl cmd 1074025677 [ 212.037934][ T9299] tun0: linktype set to 779 [ 212.700719][ T9317] syzkaller0: entered promiscuous mode [ 212.700749][ T9317] syzkaller0: entered allmulticast mode [ 213.281906][ T9353] netlink: 'syz.4.857': attribute type 4 has an invalid length. [ 213.407555][ T9359] netlink: 'syz.2.860': attribute type 7 has an invalid length. [ 213.407809][ T9359] netlink: 'syz.2.860': attribute type 7 has an invalid length. [ 213.898180][ T9371] netlink: 'syz.2.865': attribute type 1 has an invalid length. [ 213.994546][ T9376] netlink: 'syz.2.865': attribute type 46 has an invalid length. [ 214.285537][ T9389] netlink: 'syz.4.871': attribute type 1 has an invalid length. [ 214.330285][ T9389] 8021q: adding VLAN 0 to HW filter on device bond4 [ 214.347081][ T9389] bond3: (slave veth0_to_bond): Releasing active interface [ 214.367326][ T9389] bond4: (slave veth0_to_bond): making interface the new active one [ 214.370759][ T9389] bond4: (slave veth0_to_bond): Enslaving as an active interface with an up link [ 214.420237][ T9389] macvlan2: entered promiscuous mode [ 214.420263][ T9389] macvlan2: entered allmulticast mode [ 214.422154][ T9389] bond4: entered promiscuous mode [ 214.422178][ T9389] veth0_to_bond: entered promiscuous mode [ 214.434773][ T9389] 8021q: adding VLAN 0 to HW filter on device macvlan2 [ 214.444589][ T9389] bond4: (slave macvlan2): the slave hw address is in use by the bond; couldn't find a slave with a free hw address to give it (this should not have happened) [ 214.454095][ T9389] bond4: left promiscuous mode [ 214.454119][ T9389] veth0_to_bond: left promiscuous mode [ 214.800464][ T9408] x_tables: duplicate underflow at hook 1 [ 214.873032][ T9412] __nla_validate_parse: 17 callbacks suppressed [ 214.874161][ T9412] netlink: 12 bytes leftover after parsing attributes in process `syz.2.876'. [ 215.112832][ T9412] 8021q: adding VLAN 0 to HW filter on device bond8 [ 215.246401][ T9413] mac80211_hwsim hwsim10 wlan1: entered promiscuous mode [ 215.291999][ T9413] bond8: (slave wlan1): Enslaving as an active interface with an up link [ 215.355900][ T9438] netlink: 12 bytes leftover after parsing attributes in process `syz.1.881'. [ 215.361835][ T9422] net_ratelimit: 13 callbacks suppressed [ 215.361862][ T9422] ip6_tunnel: non-ECT from 0000:0000:0000:0000:0000:ffff:7f00:0001 with DS=0xb [ 215.429792][ T8010] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 215.429819][ T8010] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 215.529068][ T9431] openvswitch: netlink: Flow actions attr not present in new flow. [ 215.716641][ T59] IPVS: starting estimator thread 0... [ 215.794458][ T9456] IPVS: set_ctl: invalid protocol: 1088 0.32.0.0:34816 [ 215.813215][ T9452] IPVS: using max 25 ests per chain, 60000 per kthread [ 215.959085][ T9450] netlink: 'syz.1.883': attribute type 4 has an invalid length. [ 215.980570][ T9457] netlink: 'syz.1.883': attribute type 4 has an invalid length. [ 216.179317][ T9468] bond0: up delay (5) is not a multiple of miimon (4), value rounded to 4 ms [ 216.275981][ T9473] netlink: 228 bytes leftover after parsing attributes in process `syz.1.887'. [ 216.476557][ T9476] netlink: 'syz.0.888': attribute type 2 has an invalid length. [ 216.476584][ T9476] netlink: 'syz.0.888': attribute type 2 has an invalid length. [ 216.479909][ T9484] netlink: 48 bytes leftover after parsing attributes in process `syz.1.890'. [ 216.482837][ T9483] netlink: 48 bytes leftover after parsing attributes in process `syz.1.890'. [ 216.710676][ T9491] netlink: 'syz.3.895': attribute type 1 has an invalid length. [ 216.866550][ T9491] 8021q: adding VLAN 0 to HW filter on device bond9 [ 216.894645][ T9496] tipc: New replicast peer: 255.255.255.255 [ 216.902428][ T9496] tipc: Enabled bearer , priority 10 [ 216.997386][ T9494] bond9: (slave ip6gretap1): making interface the new active one [ 217.021145][ T9494] bond9: (slave ip6gretap1): Enslaving as an active interface with an up link [ 217.137935][ T9515] trusted_key: syz.1.897 sent an empty control message without MSG_MORE. [ 217.244156][ T9512] netlink: 44 bytes leftover after parsing attributes in process `syz.1.897'. [ 217.244314][ T9512] netlink: 44 bytes leftover after parsing attributes in process `syz.1.897'. [ 217.244423][ T9512] netlink: 44 bytes leftover after parsing attributes in process `syz.1.897'. [ 217.244539][ T9512] netlink: 44 bytes leftover after parsing attributes in process `syz.1.897'. [ 217.244641][ T9512] netlink: 44 bytes leftover after parsing attributes in process `syz.1.897'. [ 217.584869][ T9537] ip_tables: iptables: counters copy to user failed while replacing table [ 217.668159][ T9537] batman_adv: Cannot find parent device. Skipping batadv-on-batadv check for gretap1 [ 217.669052][ T9537] batman_adv: batadv0: Adding interface: gretap1 [ 217.669067][ T9537] batman_adv: batadv0: The MTU of interface gretap1 is too small (1462) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 217.669120][ T9537] batman_adv: batadv0: Interface activated: gretap1 [ 218.014584][ T1776] tipc: Node number set to 3758096386 [ 218.536468][ T9573] 8021q: adding VLAN 0 to HW filter on device ipvlan2 [ 218.567524][ T9573] tap0: tun_chr_ioctl cmd 2147767520 [ 218.569254][ T9573] tap0: tun_chr_ioctl cmd 2148553947 [ 218.667275][ T9575] ipip0: entered promiscuous mode [ 219.346221][ T9605] pim6reg1: entered promiscuous mode [ 219.346248][ T9605] pim6reg1: entered allmulticast mode [ 219.394988][ T9601] 0: reclassify loop, rule prio 0, protocol 03 [ 220.019092][ T9620] syzkaller0: entered promiscuous mode [ 220.019118][ T9620] syzkaller0: entered allmulticast mode [ 220.091363][ T9626] Bluetooth: hci0: invalid length 0, exp 2 for type 12 [ 220.346225][ T9631] __nla_validate_parse: 61 callbacks suppressed [ 220.346249][ T9631] netlink: 24 bytes leftover after parsing attributes in process `syz.3.924'. [ 220.450173][ T8011] IPVS: starting estimator thread 0... [ 220.467634][ T9638] IPVS: set_ctl: invalid protocol: 68 22.0.1.0:0 [ 220.518519][ T9631] netlink: 4 bytes leftover after parsing attributes in process `syz.3.924'. [ 220.533245][ T9642] IPVS: using max 26 ests per chain, 62400 per kthread [ 220.651617][ T9647] Bluetooth: hci0: invalid length 0, exp 2 for type 22 [ 220.660929][ T9647] netlink: 8 bytes leftover after parsing attributes in process `syz.1.928'. [ 220.660957][ T9647] netlink: 8 bytes leftover after parsing attributes in process `syz.1.928'. [ 220.852027][ T9655] netlink: 20 bytes leftover after parsing attributes in process `syz.2.931'. [ 220.979171][ T9649] netlink: Failed to add %pK helper -22 [ 220.979241][ T9649] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 221.087754][ T9664] xt_TCPMSS: Only works on TCP SYN packets [ 221.360870][ T9674] netlink: 'syz.1.936': attribute type 3 has an invalid length. [ 221.360950][ T9674] netlink: 'syz.1.936': attribute type 3 has an invalid length. [ 221.361021][ T9674] netlink: 'syz.1.936': attribute type 3 has an invalid length. [ 221.630842][ T9681] syzkaller0: entered promiscuous mode [ 221.630873][ T9681] syzkaller0: entered allmulticast mode [ 221.646244][ T9680] netlink: 28 bytes leftover after parsing attributes in process `syz.4.940'. [ 221.646268][ T9680] netlink: 4 bytes leftover after parsing attributes in process `syz.4.940'. [ 221.648005][ T9686] IPVS: set_ctl: invalid protocol: 149 224.0.0.2:20002 [ 222.002579][ T9704] netlink: 284 bytes leftover after parsing attributes in process `syz.3.950'. [ 222.114880][ T9707] netlink: 7 bytes leftover after parsing attributes in process `syz.0.949'. [ 224.650802][ T9690] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 224.932783][ T9742] macsec1: entered promiscuous mode [ 224.932809][ T9742] hsr0: entered promiscuous mode [ 225.502057][ T9766] FAULT_INJECTION: forcing a failure. [ 225.502057][ T9766] name failslab, interval 1, probability 0, space 0, times 0 [ 225.502089][ T9766] CPU: 0 UID: 0 PID: 9766 Comm: syz.3.965 Not tainted syzkaller #0 PREEMPT(full) [ 225.502111][ T9766] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 225.502122][ T9766] Call Trace: [ 225.502129][ T9766] [ 225.502138][ T9766] dump_stack_lvl+0xe8/0x150 [ 225.502172][ T9766] should_fail_ex+0x410/0x560 [ 225.502199][ T9766] should_failslab+0xa8/0x100 [ 225.502226][ T9766] __kmalloc_noprof+0xfe/0x720 [ 225.502246][ T9766] ? kernfs_fop_write_iter+0x157/0x540 [ 225.502271][ T9766] ? kernfs_fop_write_iter+0x157/0x540 [ 225.502304][ T9766] kernfs_fop_write_iter+0x157/0x540 [ 225.502334][ T9766] vfs_write+0x612/0xba0 [ 225.502369][ T9766] ? __pfx_vfs_write+0x10/0x10 [ 225.502410][ T9766] ? __fget_files+0x2a/0x420 [ 225.502445][ T9766] ksys_write+0x150/0x270 [ 225.502474][ T9766] ? __pfx_ksys_write+0x10/0x10 [ 225.502511][ T9766] do_syscall_64+0x166/0x520 [ 225.502535][ T9766] ? trace_irq_disable+0x3b/0x140 [ 225.502554][ T9766] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 225.502575][ T9766] ? clear_bhb_loop+0x70/0xc0 [ 225.502600][ T9766] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 225.502619][ T9766] RIP: 0033:0x7f924059e159 [ 225.502639][ T9766] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 225.502657][ T9766] RSP: 002b:00007f9241467028 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 225.502678][ T9766] RAX: ffffffffffffffda RBX: 00007f9240825fa0 RCX: 00007f924059e159 [ 225.502693][ T9766] RDX: 000000000000000a RSI: 0000200000000280 RDI: 0000000000000005 [ 225.502705][ T9766] RBP: 00007f9241467090 R08: 0000000000000000 R09: 0000000000000000 [ 225.502717][ T9766] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 225.502729][ T9766] R13: 00007f9240826038 R14: 00007f9240825fa0 R15: 00007ffccca256c8 [ 225.502763][ T9766] [ 225.647911][ T9766] netlink: 'syz.3.965': attribute type 21 has an invalid length. [ 225.958923][ T9776] netlink: 'syz.0.967': attribute type 1 has an invalid length. [ 226.050913][ T9776] syzkaller1: tun_chr_ioctl cmd 2147767506 [ 226.192130][ T9786] netlink: 16 bytes leftover after parsing attributes in process `syz.1.970'. [ 226.241974][ T9787] netlink: 'syz.4.972': attribute type 1 has an invalid length. [ 226.295467][ T9787] 8021q: adding VLAN 0 to HW filter on device bond5 [ 226.364395][ T9797] netlink: 12 bytes leftover after parsing attributes in process `syz.3.973'. [ 226.396306][ T9787] bond4: (slave veth0_to_bond): Releasing active interface [ 226.421939][ T9787] bond5: (slave veth0_to_bond): making interface the new active one [ 226.444222][ T9787] bond5: (slave veth0_to_bond): Enslaving as an active interface with an up link [ 226.478474][ T9799] netlink: 'syz.3.973': attribute type 10 has an invalid length. [ 226.502513][ T9793] macvlan2: entered promiscuous mode [ 226.502542][ T9793] macvlan2: entered allmulticast mode [ 226.515376][ T9793] bond5: entered promiscuous mode [ 226.515402][ T9793] veth0_to_bond: entered promiscuous mode [ 226.516493][ T9793] 8021q: adding VLAN 0 to HW filter on device macvlan2 [ 226.517413][ T9793] bond5: (slave macvlan2): the slave hw address is in use by the bond; couldn't find a slave with a free hw address to give it (this should not have happened) [ 226.517567][ T9793] bond5: left promiscuous mode [ 226.517587][ T9793] veth0_to_bond: left promiscuous mode [ 226.538506][ T9797] netlink: 'syz.3.973': attribute type 10 has an invalid length. [ 226.637475][ T9799] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 226.640247][ T9799] team0: Port device netdevsim1 added [ 226.662511][ T9797] team0: Port device netdevsim1 removed [ 226.675986][ T9797] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 226.695251][ T9797] bond0: (slave netdevsim1): Enslaving as an active interface with a down link [ 226.923004][ T9811] 8021q: VLANs not supported on wg1 [ 227.216925][ T9822] netlink: 'syz.0.978': attribute type 4 has an invalid length. [ 227.290949][ T9825] netlink: 20 bytes leftover after parsing attributes in process `syz.1.980'. [ 227.290982][ T9825] nbd: couldn't find a device at index 64 [ 227.631560][ T9833] Bluetooth: MGMT ver 1.23 [ 227.791415][ T9839] netlink: 'syz.1.985': attribute type 1 has an invalid length. [ 227.851079][ T9839] 8021q: adding VLAN 0 to HW filter on device bond7 [ 227.940084][ T9839] bond5: (slave veth0_to_bond): Releasing active interface [ 228.006238][ T9839] bond7: (slave veth0_to_bond): Enslaving as an active interface with a down link [ 228.080369][ T9843] macvlan3: entered promiscuous mode [ 228.080396][ T9843] macvlan3: entered allmulticast mode [ 228.082781][ T9843] bond7: entered promiscuous mode [ 228.095408][ T9852] netlink: 'syz.3.988': attribute type 1 has an invalid length. [ 228.111169][ T9843] 8021q: adding VLAN 0 to HW filter on device macvlan3 [ 228.111960][ T9843] bond7: (slave macvlan3): the slave hw address is in use by the bond; couldn't find a slave with a free hw address to give it (this should not have happened) [ 228.133934][ T9843] bond7: left promiscuous mode [ 228.379023][ T9852] bond10: entered promiscuous mode [ 228.379476][ T9852] 8021q: adding VLAN 0 to HW filter on device bond10 [ 228.439698][ T9850] syzkaller0: entered promiscuous mode [ 228.439726][ T9850] syzkaller0: entered allmulticast mode [ 228.602850][ T9852] veth5: entered allmulticast mode [ 228.620769][ T9852] bond10: (slave veth5): making interface the new active one [ 228.620798][ T9852] veth5: entered promiscuous mode [ 228.643822][ T9852] bond10: (slave veth5): Enslaving as an active interface with an up link [ 228.645435][ T9875] IPVS: set_ctl: invalid protocol: 44 224.0.0.2:20000 [ 228.696209][ T9882] FAULT_INJECTION: forcing a failure. [ 228.696209][ T9882] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 228.696245][ T9882] CPU: 0 UID: 0 PID: 9882 Comm: syz.2.995 Not tainted syzkaller #0 PREEMPT(full) [ 228.696271][ T9882] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 228.696285][ T9882] Call Trace: [ 228.696294][ T9882] [ 228.696303][ T9882] dump_stack_lvl+0xe8/0x150 [ 228.696340][ T9882] should_fail_ex+0x410/0x560 [ 228.696372][ T9882] _copy_to_user+0x31/0xb0 [ 228.696404][ T9882] simple_read_from_buffer+0xe1/0x170 [ 228.696444][ T9882] proc_fail_nth_read+0x1bb/0x230 [ 228.696487][ T9882] ? common_file_perm+0x20e/0x2b0 [ 228.696519][ T9882] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 228.696560][ T9882] ? rw_verify_area+0x24a/0x4c0 [ 228.696595][ T9882] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 228.696632][ T9882] vfs_read+0x213/0xa80 [ 228.696671][ T9882] ? __pfx___mutex_lock+0x10/0x10 [ 228.696702][ T9882] ? __pfx_vfs_read+0x10/0x10 [ 228.696737][ T9882] ? __fget_files+0x2a/0x420 [ 228.696773][ T9882] ? __fget_files+0x3a2/0x420 [ 228.696803][ T9882] ? __fget_files+0x2a/0x420 [ 228.696844][ T9882] ksys_read+0x150/0x270 [ 228.696879][ T9882] ? __pfx_ksys_read+0x10/0x10 [ 228.696926][ T9882] do_syscall_64+0x166/0x520 [ 228.696953][ T9882] ? trace_irq_disable+0x3b/0x140 [ 228.696977][ T9882] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 228.697000][ T9882] ? clear_bhb_loop+0x70/0xc0 [ 228.697028][ T9882] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 228.697051][ T9882] RIP: 0033:0x7f9e9395e98e [ 228.697073][ T9882] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 228.697092][ T9882] RSP: 002b:00007f9e9477dfe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 228.697117][ T9882] RAX: ffffffffffffffda RBX: 00007f9e9477e6c0 RCX: 00007f9e9395e98e [ 228.697134][ T9882] RDX: 000000000000000f RSI: 00007f9e9477e0a0 RDI: 0000000000000006 [ 228.697148][ T9882] RBP: 00007f9e9477e090 R08: 0000000000000000 R09: 0000000000000000 [ 228.697162][ T9882] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 228.697180][ T9882] R13: 00007f9e93c26038 R14: 00007f9e93c25fa0 R15: 00007ffc0c9c1058 [ 228.697217][ T9882] [ 229.187554][ T9886] netlink: 'syz.2.996': attribute type 4 has an invalid length. [ 229.626055][ T9906] netlink: 'syz.0.1004': attribute type 1 has an invalid length. [ 229.807658][ T9918] netlink: 24 bytes leftover after parsing attributes in process `syz.2.1007'. [ 229.834892][ T9906] 8021q: adding VLAN 0 to HW filter on device bond5 [ 229.870616][ T9912] bond3: (slave veth0_to_bond): Releasing active interface [ 229.921309][ T9923] netlink: 'syz.4.1006': attribute type 4 has an invalid length. [ 229.960383][ T9912] bond5: (slave veth0_to_bond): making interface the new active one [ 229.981493][ T9912] bond5: (slave veth0_to_bond): Enslaving as an active interface with an up link [ 230.057347][ T9916] macvlan0: entered promiscuous mode [ 230.057374][ T9916] macvlan0: entered allmulticast mode [ 230.059244][ T9916] bond5: entered promiscuous mode [ 230.059266][ T9916] veth0_to_bond: entered promiscuous mode [ 230.061787][ T9916] 8021q: adding VLAN 0 to HW filter on device macvlan0 [ 230.101922][ T9916] bond5: (slave macvlan0): the slave hw address is in use by the bond; couldn't find a slave with a free hw address to give it (this should not have happened) [ 230.102113][ T9916] bond5: left promiscuous mode [ 230.102131][ T9916] veth0_to_bond: left promiscuous mode [ 230.471250][ T9933] bond9: option all_slaves_active: invalid value (255) [ 230.483343][ T9933] bond9 (unregistering): Released all slaves [ 232.077934][ T9999] netlink: 'syz.1.1031': attribute type 12 has an invalid length. [ 232.299449][T10001] openvswitch: netlink: VXLAN extension message has 4 unknown bytes. [ 232.458978][T10003] netlink: 4 bytes leftover after parsing attributes in process `syz.1.1032'. [ 232.461694][T10003] netlink: 12 bytes leftover after parsing attributes in process `syz.1.1032'. [ 232.471001][T10007] netlink: 'syz.3.1034': attribute type 1 has an invalid length. [ 232.471070][T10007] netlink: 248 bytes leftover after parsing attributes in process `syz.3.1034'. [ 232.740187][T10016] netlink: 'syz.4.1037': attribute type 3 has an invalid length. [ 232.740215][T10016] netlink: 8 bytes leftover after parsing attributes in process `syz.4.1037'. [ 232.776887][T10016] netlink: NAT attribute has 1 unknown bytes [ 232.776926][T10016] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 232.895274][T10025] netlink: 8 bytes leftover after parsing attributes in process `syz.1.1038'. [ 232.895309][T10025] netlink: 48 bytes leftover after parsing attributes in process `syz.1.1038'. [ 232.952500][T10027] netlink: 76 bytes leftover after parsing attributes in process `syz.3.1039'. [ 232.980347][T10025] macvlan3: entered allmulticast mode [ 232.980372][T10025] gretap0: entered allmulticast mode [ 233.607274][T10054] netlink: 'syz.4.1047': attribute type 7 has an invalid length. [ 233.612494][T10054] netlink: 64 bytes leftover after parsing attributes in process `syz.4.1047'. [ 233.896366][T10062] netlink: 8 bytes leftover after parsing attributes in process `syz.4.1053'. [ 234.117723][T10070] x_tables: ip6_tables: TCPMSS target: only valid for protocol 6 [ 234.172154][T10073] netlink: 'syz.1.1057': attribute type 2 has an invalid length. [ 234.298924][T10073] : entered promiscuous mode [ 234.429736][T10083] netlink: 112 bytes leftover after parsing attributes in process `syz.3.1060'. [ 235.082143][T10109] netlink: 'syz.0.1068': attribute type 1 has an invalid length. [ 235.247325][T10109] 8021q: adding VLAN 0 to HW filter on device bond6 [ 235.278877][T10115] bond5: (slave veth0_to_bond): Releasing active interface [ 235.303471][T10115] bond6: (slave veth0_to_bond): making interface the new active one [ 235.305990][T10115] bond6: (slave veth0_to_bond): Enslaving as an active interface with an up link [ 235.341681][T10123] macvlan0: entered promiscuous mode [ 235.341716][T10123] macvlan0: entered allmulticast mode [ 235.343354][T10123] bond6: entered promiscuous mode [ 235.343377][T10123] veth0_to_bond: entered promiscuous mode [ 235.346226][T10123] 8021q: adding VLAN 0 to HW filter on device macvlan0 [ 235.348591][T10123] bond6: (slave macvlan0): the slave hw address is in use by the bond; couldn't find a slave with a free hw address to give it (this should not have happened) [ 235.349035][T10123] bond6: left promiscuous mode [ 235.349052][T10123] veth0_to_bond: left promiscuous mode [ 235.422352][T10122] A link change request failed with some changes committed already. Interface ip6gre0 may have been left with an inconsistent configuration, please check. [ 235.604279][T10134] x_tables: duplicate entry at hook 3 [ 235.631953][T10134] netlink: Invalid conntrack timeout [ 235.631987][T10134] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 235.651309][T10134] netlink: 'syz.3.1075': attribute type 1 has an invalid length. [ 235.781699][T10134] veth7: entered allmulticast mode [ 236.246169][T10161] ip_tables: iptables: counters copy to user failed while replacing table [ 236.367328][T10157] batman_adv: batadv0: Adding interface: macvtap0 [ 236.367348][T10157] batman_adv: batadv0: The MTU of interface macvtap0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 236.367379][T10157] batman_adv: batadv0: Not using interface macvtap0 (retrying later): interface not active [ 236.648835][T10180] netlink: 'syz.4.1089': attribute type 1 has an invalid length. [ 236.745883][T10180] 8021q: adding VLAN 0 to HW filter on device bond7 [ 236.799282][T10185] bond5: (slave veth0_to_bond): Releasing active interface [ 236.816149][T10185] bond7: (slave veth0_to_bond): making interface the new active one [ 236.817879][T10185] bond7: (slave veth0_to_bond): Enslaving as an active interface with an up link [ 236.847944][T10180] macvlan2: entered promiscuous mode [ 236.847971][T10180] macvlan2: entered allmulticast mode [ 236.848816][T10180] bond7: entered promiscuous mode [ 236.848836][T10180] veth0_to_bond: entered promiscuous mode [ 236.850059][T10180] 8021q: adding VLAN 0 to HW filter on device macvlan2 [ 236.850826][T10180] bond7: (slave macvlan2): the slave hw address is in use by the bond; couldn't find a slave with a free hw address to give it (this should not have happened) [ 236.850952][T10180] bond7: left promiscuous mode [ 236.850973][T10180] veth0_to_bond: left promiscuous mode [ 236.918768][T10193] netlink: 'syz.0.1093': attribute type 21 has an invalid length. [ 237.551082][T10218] __nla_validate_parse: 8 callbacks suppressed [ 237.551105][T10218] netlink: 92 bytes leftover after parsing attributes in process `syz.0.1099'. [ 237.704311][T10224] netlink: 12 bytes leftover after parsing attributes in process `syz.0.1102'. [ 237.835784][T10226] netlink: 36 bytes leftover after parsing attributes in process `syz.3.1103'. [ 238.277327][T10202] netlink: 'syz.4.1095': attribute type 4 has an invalid length. [ 238.448247][T10249] macsec1: entered allmulticast mode [ 238.451003][T10249] veth1_macvtap: entered allmulticast mode [ 238.580561][T10266] nbd: must specify a size in bytes for the device [ 238.993868][T10275] netlink: 12 bytes leftover after parsing attributes in process `syz.3.1110'. [ 239.283358][ C0] ip6_tunnel: ip6gre2 xmit: Local address not yet configured! [ 239.532233][T10292] netlink: 'syz.3.1117': attribute type 26 has an invalid length. [ 240.346595][T10313] Bluetooth: MGMT ver 1.23 [ 240.371074][T10313] netlink: 4 bytes leftover after parsing attributes in process `syz.0.1120'. [ 240.522207][T10313] netlink: 4 bytes leftover after parsing attributes in process `syz.0.1120'. [ 240.548362][T10319] netlink: 20 bytes leftover after parsing attributes in process `syz.4.1121'. [ 241.411239][T10342] bond7: invalid ARP target 0.0.0.0 specified for addition [ 241.411269][T10342] bond7: option arp_ip_target: invalid value (0) [ 241.446724][T10342] bond7 (unregistering): Released all slaves [ 241.824716][T10356] netlink: 'syz.2.1131': attribute type 1 has an invalid length. [ 241.996625][T10356] 8021q: adding VLAN 0 to HW filter on device bond9 [ 242.029277][T10359] bond2: (slave veth0_to_bond): Releasing active interface [ 242.079147][T10359] bond9: (slave veth0_to_bond): Enslaving as an active interface with a down link [ 242.104876][T10370] macvlan2: entered promiscuous mode [ 242.104904][T10370] macvlan2: entered allmulticast mode [ 242.110334][T10370] bond9: entered promiscuous mode [ 242.111316][T10370] 8021q: adding VLAN 0 to HW filter on device macvlan2 [ 242.112307][T10370] bond9: (slave macvlan2): the slave hw address is in use by the bond; couldn't find a slave with a free hw address to give it (this should not have happened) [ 242.114135][T10370] bond9: left promiscuous mode [ 242.129543][T10369] netlink: 8 bytes leftover after parsing attributes in process `syz.1.1135'. [ 242.209915][T10375] A link change request failed with some changes committed already. Interface wg1 may have been left with an inconsistent configuration, please check. [ 242.243848][T10369] netdevsim netdevsim1 netdevsim0: entered promiscuous mode [ 242.246845][T10369] gretap0: entered promiscuous mode [ 242.249411][T10369] gretap0: left promiscuous mode [ 242.249778][T10369] netdevsim netdevsim1 netdevsim0: left promiscuous mode [ 242.480033][T10385] netlink: 24 bytes leftover after parsing attributes in process `syz.0.1139'. [ 242.630426][T10391] netlink: 32 bytes leftover after parsing attributes in process `syz.1.1141'. [ 243.113607][T10414] netlink: 24 bytes leftover after parsing attributes in process `syz.4.1148'. [ 243.203815][T10414] netlink: 'syz.4.1148': attribute type 4 has an invalid length. [ 243.203844][T10414] netlink: 152 bytes leftover after parsing attributes in process `syz.4.1148'. [ 243.299446][T10417] netlink: 'syz.2.1150': attribute type 21 has an invalid length. [ 243.587342][T10420] netlink: 8 bytes leftover after parsing attributes in process `syz.0.1151'. [ 243.587369][T10420] netlink: 4 bytes leftover after parsing attributes in process `syz.0.1151'. [ 243.617100][T10405] netlink: 60 bytes leftover after parsing attributes in process `syz.3.1146'. [ 243.689842][T10405] netlink: 'syz.3.1146': attribute type 4 has an invalid length. [ 244.744089][T10447] netlink: 'syz.4.1159': attribute type 7 has an invalid length. [ 245.179686][T10463] xt_ecn: cannot match TCP bits for non-tcp packets [ 246.692559][T10494] netlink: 'syz.0.1170': attribute type 1 has an invalid length. [ 249.970317][T10522] ip6tnl2: entered allmulticast mode [ 250.024116][ T7403] ip6_tunnel: ip6tnl2 xmit: Local address not yet configured! [ 250.024365][ T7403] ip6_tunnel: ip6tnl2 xmit: Local address not yet configured! [ 250.024632][T10522] netlink: 'syz.2.1180': attribute type 1 has an invalid length. [ 250.067161][ T6557] ip6_tunnel: ip6tnl2 xmit: Local address not yet configured! [ 250.583376][ T6557] ip6_tunnel: ip6tnl2 xmit: Local address not yet configured! [ 250.654356][T10527] netlink: 'syz.3.1181': attribute type 8 has an invalid length. [ 250.803916][ C1] ip6_tunnel: ip6gre1 xmit: Local address not yet configured! [ 250.841632][T10547] mac80211_hwsim hwsim6 syzkaller0: entered promiscuous mode [ 250.841732][T10547] mac80211_hwsim hwsim6 syzkaller0: entered allmulticast mode [ 250.884810][ T6557] ip6_tunnel: ip6tnl2 xmit: Local address not yet configured! [ 251.756280][T10594] netlink: 'syz.4.1197': attribute type 21 has an invalid length. [ 252.094955][T10602] openvswitch: netlink: Encap mask attribute is set for non-VLAN frame. [ 252.100577][T10604] openvswitch: netlink: Encap mask attribute is set for non-VLAN frame. [ 252.340672][T10611] netlink: 16 bytes leftover after parsing attributes in process `syz.4.1203'. [ 252.521481][T10617] netlink: 4 bytes leftover after parsing attributes in process `syz.2.1205'. [ 252.526394][T10617] FAULT_INJECTION: forcing a failure. [ 252.526394][T10617] name failslab, interval 1, probability 0, space 0, times 0 [ 252.526427][T10617] CPU: 0 UID: 0 PID: 10617 Comm: syz.2.1205 Not tainted syzkaller #0 PREEMPT(full) [ 252.526452][T10617] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 252.526478][T10617] Call Trace: [ 252.526487][T10617] [ 252.526497][T10617] dump_stack_lvl+0xe8/0x150 [ 252.526540][T10617] should_fail_ex+0x410/0x560 [ 252.526570][T10617] ? __alloc_skb+0x1db/0x7a0 [ 252.526596][T10617] should_failslab+0xa8/0x100 [ 252.526624][T10617] ? __alloc_skb+0x1db/0x7a0 [ 252.526646][T10617] kmem_cache_alloc_node_noprof+0xa1/0x610 [ 252.526679][T10617] ? __alloc_skb+0x18d/0x7a0 [ 252.526705][T10617] ? __alloc_skb+0x1db/0x7a0 [ 252.526736][T10617] __alloc_skb+0x1db/0x7a0 [ 252.526766][T10617] netlink_ack+0x136/0xb30 [ 252.526804][T10617] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 252.526830][T10617] ? ref_tracker_free+0x689/0x830 [ 252.526859][T10617] ? __pfx_ref_tracker_free+0x10/0x10 [ 252.526895][T10617] netlink_rcv_skb+0x2a4/0x4a0 [ 252.526930][T10617] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 252.526959][T10617] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 252.527005][T10617] ? netlink_deliver_tap+0x2e/0x1b0 [ 252.527038][T10617] ? netlink_deliver_tap+0x2e/0x1b0 [ 252.527077][T10617] netlink_unicast+0x7bd/0x940 [ 252.527118][T10617] netlink_sendmsg+0x813/0xb40 [ 252.527160][T10617] ? __pfx_netlink_sendmsg+0x10/0x10 [ 252.527213][T10617] ? apparmor_socket_sendmsg+0x18b/0x360 [ 252.527240][T10617] ? __pfx_netlink_sendmsg+0x10/0x10 [ 252.527271][T10617] sock_sendmsg_nosec+0x13a/0x180 [ 252.527296][T10617] ____sys_sendmsg+0x54e/0x850 [ 252.527333][T10617] ? __pfx_____sys_sendmsg+0x10/0x10 [ 252.527374][T10617] ? import_iovec+0x73/0xa0 [ 252.527405][T10617] ___sys_sendmsg+0x2a5/0x360 [ 252.527434][T10617] ? __lock_acquire+0x747/0x2de0 [ 252.527460][T10617] ? __pfx____sys_sendmsg+0x10/0x10 [ 252.527525][T10617] ? __fget_files+0x2a/0x420 [ 252.527556][T10617] ? __fget_files+0x3a2/0x420 [ 252.527614][T10617] __x64_sys_sendmsg+0x1b1/0x290 [ 252.527647][T10617] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 252.527699][T10617] do_syscall_64+0x166/0x520 [ 252.527727][T10617] ? trace_irq_disable+0x3b/0x140 [ 252.527748][T10617] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 252.527770][T10617] ? clear_bhb_loop+0x70/0xc0 [ 252.527797][T10617] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 252.527821][T10617] RIP: 0033:0x7f9e9399e159 [ 252.527842][T10617] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 252.527862][T10617] RSP: 002b:00007f9e91bd5028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 252.527887][T10617] RAX: ffffffffffffffda RBX: 00007f9e93c26180 RCX: 00007f9e9399e159 [ 252.527903][T10617] RDX: 0000000020004844 RSI: 0000200000000180 RDI: 0000000000000006 [ 252.527919][T10617] RBP: 00007f9e91bd5090 R08: 0000000000000000 R09: 0000000000000000 [ 252.527933][T10617] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 252.527947][T10617] R13: 00007f9e93c26218 R14: 00007f9e93c26180 R15: 00007ffc0c9c1058 [ 252.527982][T10617] [ 253.276828][T10632] netlink: 'syz.0.1211': attribute type 21 has an invalid length. [ 253.693308][ C0] ip6_tunnel: ip6tnl2 xmit: Local address not yet configured! [ 253.877892][T10652] mac80211_hwsim hwsim6 syzkaller0: left promiscuous mode [ 253.877925][T10652] mac80211_hwsim hwsim6 syzkaller0: left allmulticast mode [ 253.981808][T10654] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 254.438688][T10667] netlink: 64 bytes leftover after parsing attributes in process `syz.2.1221'. [ 254.438723][T10667] netlink: 20 bytes leftover after parsing attributes in process `syz.2.1221'. [ 254.867277][T10683] netlink: 4 bytes leftover after parsing attributes in process `syz.4.1226'. [ 254.985521][T10685] netlink: 'syz.1.1227': attribute type 1 has an invalid length. [ 255.122868][T10685] 8021q: adding VLAN 0 to HW filter on device bond8 [ 255.272515][T10690] bond7: (slave veth0_to_bond): Releasing active interface [ 255.301389][T10690] bond8: (slave veth0_to_bond): Enslaving as an active interface with a down link [ 255.302318][T10695] netlink: 24 bytes leftover after parsing attributes in process `syz.3.1231'. [ 255.365137][T10695] netlink: 'syz.3.1231': attribute type 4 has an invalid length. [ 255.365164][T10695] netlink: 152 bytes leftover after parsing attributes in process `syz.3.1231'. [ 255.612143][T10709] netlink: 'syz.4.1232': attribute type 61 has an invalid length. [ 255.612169][T10709] netlink: 'syz.4.1232': attribute type 62 has an invalid length. [ 255.774838][T10697] netlink: 16 bytes leftover after parsing attributes in process `syz.0.1230'. [ 255.980221][T10722] netlink: 8 bytes leftover after parsing attributes in process `syz.2.1241'. [ 255.980483][T10722] netlink: 8 bytes leftover after parsing attributes in process `syz.2.1241'. [ 256.171293][T10735] netlink: 'syz.0.1244': attribute type 1 has an invalid length. [ 256.284618][T10735] 8021q: adding VLAN 0 to HW filter on device bond8 [ 256.300155][T10739] bond6: (slave veth0_to_bond): Releasing active interface [ 256.322314][T10739] bond8: (slave veth0_to_bond): making interface the new active one [ 256.336896][T10739] bond8: (slave veth0_to_bond): Enslaving as an active interface with an up link [ 256.465989][T10750] sch_fq: defrate 2 ignored. [ 256.498059][T10750] tipc: Enabled bearer , priority 0 [ 256.523950][T10750] syzkaller0: left promiscuous mode [ 256.523975][T10750] syzkaller0: left allmulticast mode [ 256.524498][T10750] tipc: Resetting bearer [ 256.852780][T10728] Bluetooth: hci0: Opcode 0x0c03 failed: -4 [ 257.140713][T10754] netdevsim netdevsim4 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 257.199064][T10776] tipc: Enabling of bearer rejected, already enabled [ 257.199781][T10779] syzkaller0: entered promiscuous mode [ 257.199805][T10779] syzkaller0: entered allmulticast mode [ 257.200378][T10779] tipc: Resetting bearer [ 257.217704][T10785] sch_tbf: burst 255 is lower than device syzkaller0 mtu (65589) ! [ 257.344633][T10771] syzkaller0: mtu less than device minimum [ 257.370663][T10790] __nla_validate_parse: 7 callbacks suppressed [ 257.370685][T10790] netlink: 16 bytes leftover after parsing attributes in process `syz.2.1261'. [ 257.370711][T10790] netlink: 164 bytes leftover after parsing attributes in process `syz.2.1261'. [ 257.517387][T10754] netdevsim netdevsim4 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 257.541904][T10771] netlink: 12 bytes leftover after parsing attributes in process `syz.3.1255'. [ 257.608166][T10754] team0: Port device netdevsim1 removed [ 257.610216][T10754] netdevsim netdevsim4 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 257.759862][T10803] sctp: [Deprecated]: syz.1.1264 (pid 10803) Use of struct sctp_assoc_value in delayed_ack socket option. [ 257.759862][T10803] Use struct sctp_sack_info instead [ 257.931911][T10754] netdevsim netdevsim4 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 258.040036][T10816] netlink: 12 bytes leftover after parsing attributes in process `syz.2.1267'. [ 258.040597][T10816] netlink: 12 bytes leftover after parsing attributes in process `syz.2.1267'. [ 258.040989][T10816] netlink: 12 bytes leftover after parsing attributes in process `syz.2.1267'. [ 258.041330][T10816] netlink: 12 bytes leftover after parsing attributes in process `syz.2.1267'. [ 258.069221][T10816] netlink: 12 bytes leftover after parsing attributes in process `syz.2.1267'. [ 258.076081][T10816] netlink: 12 bytes leftover after parsing attributes in process `syz.2.1267'. [ 258.077037][T10816] netlink: 12 bytes leftover after parsing attributes in process `syz.2.1267'. [ 258.496166][ T7996] netdevsim netdevsim4 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 258.496325][ T7996] netdevsim netdevsim4 eth1: set [1, 0] type 2 family 0 port 6081 - 0 [ 258.624476][ T7996] netdevsim netdevsim4 eth3: set [1, 0] type 2 family 0 port 6081 - 0 [ 258.624529][ T7996] netdevsim netdevsim4 eth2: set [1, 0] type 2 family 0 port 6081 - 0 [ 258.791381][T10848] nbd: socks must be embedded in a SOCK_ITEM attr [ 259.677537][T10881] syzkaller0: entered promiscuous mode [ 259.677563][T10881] syzkaller0: entered allmulticast mode [ 259.712482][T10881] tipc: Enabled bearer , priority 0 [ 259.771311][T10881] tipc: Resetting bearer [ 260.131171][T10881] tipc: Resetting bearer [ 260.188563][T10881] tipc: Disabling bearer [ 261.647173][T10969] netlink: 'syz.1.1313': attribute type 1 has an invalid length. [ 261.683281][ C0] ip6_tunnel: ip6tnl2 xmit: Local address not yet configured! [ 262.288426][T11003] netlink: 'syz.2.1328': attribute type 1 has an invalid length. [ 262.368118][T11003] 8021q: adding VLAN 0 to HW filter on device bond11 [ 262.382929][T11006] bond9: (slave veth0_to_bond): Releasing active interface [ 262.414951][T11006] bond11: (slave veth0_to_bond): Enslaving as an active interface with a down link [ 262.865549][T11030] __nla_validate_parse: 75 callbacks suppressed [ 262.865575][T11030] netlink: 8 bytes leftover after parsing attributes in process `syz.0.1333'. [ 262.896958][T11030] netlink: 4 bytes leftover after parsing attributes in process `syz.0.1333'. [ 262.899207][T11029] netlink: 4 bytes leftover after parsing attributes in process `syz.2.1335'. [ 263.321974][T11049] netlink: 32 bytes leftover after parsing attributes in process `syz.2.1340'. [ 263.358057][T11044] mac80211_hwsim hwsim4 wlan0: entered promiscuous mode [ 263.358090][T11044] mac80211_hwsim hwsim4 wlan0: entered allmulticast mode [ 263.382977][T11044] A link change request failed with some changes committed already. Interface wlan0 may have been left with an inconsistent configuration, please check. [ 263.406305][T11057] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 263.694900][T11052] syzkaller1: entered promiscuous mode [ 263.694928][T11052] syzkaller1: entered allmulticast mode [ 264.562211][T11089] IPVS: set_ctl: invalid protocol: 58 255.255.255.255:20001 [ 264.614612][T11110] ip6gretap1: entered allmulticast mode [ 264.739416][T11104] netlink: 'syz.1.1352': attribute type 1 has an invalid length. [ 264.815610][T11118] netlink: 'syz.0.1355': attribute type 2 has an invalid length. [ 264.921925][T11119] netlink: 'syz.4.1354': attribute type 1 has an invalid length. [ 265.042780][T11125] syzkaller1: entered promiscuous mode [ 265.042805][T11125] syzkaller1: entered allmulticast mode [ 265.080479][T11125] PF_CAN: dropped non conform CAN skbuff: dev type 280, len 324 [ 265.464535][T11143] netlink: 'syz.4.1362': attribute type 4 has an invalid length. [ 266.458739][T11176] netlink: 67 bytes leftover after parsing attributes in process `syz.3.1369'. [ 266.671001][T11186] netlink: 'syz.3.1373': attribute type 21 has an invalid length. [ 266.692014][T11186] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 266.720097][T11186] netlink: 'syz.3.1373': attribute type 1 has an invalid length. [ 266.828268][T11188] netlink: 24 bytes leftover after parsing attributes in process `syz.0.1372'. [ 266.868449][T11188] netlink: 'syz.0.1372': attribute type 4 has an invalid length. [ 266.868474][T11188] netlink: 152 bytes leftover after parsing attributes in process `syz.0.1372'. [ 266.957040][T11192] netlink: 'syz.3.1376': attribute type 4 has an invalid length. [ 267.166834][T11202] netlink: 'syz.0.1378': attribute type 1 has an invalid length. [ 267.166858][T11202] netlink: 84 bytes leftover after parsing attributes in process `syz.0.1378'. [ 267.166875][T11202] netlink: 4 bytes leftover after parsing attributes in process `syz.0.1378'. [ 267.173993][T11202] netlink: 7 bytes leftover after parsing attributes in process `syz.0.1378'. [ 267.324984][T11204] IPVS: sync thread started: state = MASTER, mcast_ifn = macsec0, syncid = 3, id = 0 [ 267.359290][T11206] gtp0: entered promiscuous mode [ 267.359317][T11206] gtp0: entered allmulticast mode [ 267.380664][T11206] team0: Port device gtp0 added [ 267.470291][T11206] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 267.991243][T11226] __nla_validate_parse: 2 callbacks suppressed [ 267.991266][T11226] netlink: 3560 bytes leftover after parsing attributes in process `syz.0.1386'. [ 268.111510][T11230] bridge0: entered allmulticast mode [ 268.130089][T11226] netlink: del zone limit has 4 unknown bytes [ 268.163565][T11230] bridge_slave_1: left allmulticast mode [ 268.163613][T11230] bridge_slave_1: left promiscuous mode [ 268.163859][T11230] bridge0: port 2(bridge_slave_1) entered disabled state [ 268.197291][T11230] bridge_slave_0: left allmulticast mode [ 268.197323][T11230] bridge_slave_0: left promiscuous mode [ 268.197545][T11230] bridge0: port 1(bridge_slave_0) entered disabled state [ 268.221756][T11238] netlink: del zone limit has 4 unknown bytes [ 268.548147][T11215] netlink: 'syz.2.1381': attribute type 4 has an invalid length. [ 269.175979][T11234] netlink: 3560 bytes leftover after parsing attributes in process `syz.0.1386'. [ 269.321079][T11258] netlink: 4 bytes leftover after parsing attributes in process `syz.3.1394'. [ 269.526577][T11263] syzkaller0: entered promiscuous mode [ 269.526606][T11263] syzkaller0: entered allmulticast mode [ 269.641033][T11273] netlink: 'syz.1.1398': attribute type 1 has an invalid length. [ 269.731597][T11273] 8021q: adding VLAN 0 to HW filter on device bond9 [ 269.797523][T11277] bond8: (slave veth0_to_bond): Releasing active interface [ 269.872889][T11277] bond9: (slave veth0_to_bond): Enslaving as an active interface with a down link [ 270.004891][ T5621] Bluetooth: hci4: command 0x0406 tx timeout [ 270.092097][T11291] syz_tun: entered allmulticast mode [ 270.115464][T11290] syz_tun: left allmulticast mode [ 270.950651][T11315] netlink: 24 bytes leftover after parsing attributes in process `syz.0.1412'. [ 271.016919][T11315] netlink: 'syz.0.1412': attribute type 4 has an invalid length. [ 271.016943][T11315] netlink: 152 bytes leftover after parsing attributes in process `syz.0.1412'. [ 271.067698][T11322] netlink: 80 bytes leftover after parsing attributes in process `syz.2.1414'. [ 271.088941][T11326] netlink: 224 bytes leftover after parsing attributes in process `syz.4.1415'. [ 272.044377][T11351] IPVS: set_ctl: invalid protocol: 137 224.0.0.1:20000 [ 272.059652][T11351] raw_sendmsg: syz.3.1423 forgot to set AF_INET. Fix it! [ 272.219289][T11353] netlink: 4 bytes leftover after parsing attributes in process `syz.2.1424'. [ 272.934348][T11381] netlink: 'syz.4.1431': attribute type 34 has an invalid length. [ 272.934374][T11381] netlink: 8 bytes leftover after parsing attributes in process `syz.4.1431'. [ 273.105860][T11381] bond8: option lacp_strict: invalid value (99) [ 273.122881][T11381] bond8 (unregistering): Released all slaves [ 273.132635][T11386] netlink: 'syz.1.1433': attribute type 4 has an invalid length. [ 273.295041][T11391] tc_dump_action: action bad kind [ 273.892273][T11411] netlink: 8 bytes leftover after parsing attributes in process `syz.2.1442'. [ 273.965988][T11415] netlink: 'syz.4.1445': attribute type 2 has an invalid length. [ 273.970230][T11416] netlink: 'syz.4.1445': attribute type 2 has an invalid length. [ 274.313999][T11425] Bluetooth: ISO socket layer initialized [ 274.499025][T11433] netlink: 40 bytes leftover after parsing attributes in process `syz.3.1449'. [ 275.165991][T11454] netlink: 116 bytes leftover after parsing attributes in process `syz.3.1458'. [ 275.738386][T11477] netlink: 24 bytes leftover after parsing attributes in process `syz.0.1468'. [ 275.832704][T11477] netlink: 'syz.0.1468': attribute type 4 has an invalid length. [ 275.832731][T11477] netlink: 152 bytes leftover after parsing attributes in process `syz.0.1468'. [ 275.954376][T11482] netlink: 'syz.1.1470': attribute type 1 has an invalid length. [ 276.020404][T11482] 8021q: adding VLAN 0 to HW filter on device bond10 [ 276.077368][ T5621] Bluetooth: hci4: unexpected cc 0x2003 length: 0 < 9 [ 276.077409][ T5621] Bluetooth: hci4: unexpected event for opcode 0x2003 [ 276.157159][T11482] bond9: (slave veth0_to_bond): Releasing active interface [ 276.182322][T11482] bond10: (slave veth0_to_bond): Enslaving as an active interface with a down link [ 276.210626][T11487] macvlan4: entered promiscuous mode [ 276.210654][T11487] macvlan4: entered allmulticast mode [ 276.211318][T11487] bond10: entered promiscuous mode [ 276.242040][T11487] 8021q: adding VLAN 0 to HW filter on device macvlan4 [ 276.242917][T11487] bond10: (slave macvlan4): the slave hw address is in use by the bond; couldn't find a slave with a free hw address to give it (this should not have happened) [ 276.267966][T11487] bond10: left promiscuous mode [ 276.321229][T11497] netlink: 'syz.2.1474': attribute type 4 has an invalid length. [ 277.025076][T11522] netlink: 24 bytes leftover after parsing attributes in process `syz.1.1483'. [ 277.043528][ C0] ip6_tunnel: ip6tnl2 xmit: Local address not yet configured! [ 277.063287][T11522] netlink: 'syz.1.1483': attribute type 4 has an invalid length. [ 277.063311][T11522] netlink: 152 bytes leftover after parsing attributes in process `syz.1.1483'. [ 277.327413][T11527] netlink: 80 bytes leftover after parsing attributes in process `syz.1.1485'. [ 277.329618][T11529] veth1_to_bond: entered allmulticast mode [ 277.330273][T11529] veth1_to_bond: entered promiscuous mode [ 277.331223][T11529] netlink: 4 bytes leftover after parsing attributes in process `syz.3.1486'. [ 277.368210][T11527] netlink: 8 bytes leftover after parsing attributes in process `syz.1.1485'. [ 277.396503][T11529] veth1_to_bond (unregistering): left allmulticast mode [ 277.396555][T11529] veth1_to_bond (unregistering): left promiscuous mode [ 277.435329][T11529] bond0: (slave bond_slave_1): Releasing backup interface [ 278.029531][T11551] openvswitch: netlink: Flow set message rejected, Key attribute missing. [ 278.199295][T11557] syzkaller0: entered promiscuous mode [ 278.199333][T11557] syzkaller0: entered allmulticast mode [ 278.208252][T11556] netlink: 'syz.3.1495': attribute type 4 has an invalid length. [ 278.494688][T11567] syzkaller1: entered promiscuous mode [ 278.494717][T11567] syzkaller1: entered allmulticast mode [ 279.023909][T11593] __nla_validate_parse: 3 callbacks suppressed [ 279.023930][T11593] netlink: 8 bytes leftover after parsing attributes in process `syz.4.1508'. [ 279.023957][T11593] netlink: 20 bytes leftover after parsing attributes in process `syz.4.1508'. [ 279.069682][T11593] netlink: 8 bytes leftover after parsing attributes in process `syz.4.1508'. [ 279.069721][T11593] netlink: 20 bytes leftover after parsing attributes in process `syz.4.1508'. [ 279.268101][T11603] netlink: 'syz.1.1511': attribute type 1 has an invalid length. [ 279.340139][T11603] 8021q: adding VLAN 0 to HW filter on device bond11 [ 279.356842][T11609] bond10: (slave veth0_to_bond): Releasing active interface [ 279.394981][T11609] bond11: (slave veth0_to_bond): Enslaving as an active interface with a down link [ 279.486645][T11603] macvlan4: entered promiscuous mode [ 279.486673][T11603] macvlan4: entered allmulticast mode [ 279.492937][T11603] bond11: entered promiscuous mode [ 279.507499][T11603] 8021q: adding VLAN 0 to HW filter on device macvlan4 [ 279.513440][T11603] bond11: (slave macvlan4): the slave hw address is in use by the bond; couldn't find a slave with a free hw address to give it (this should not have happened) [ 279.518487][T11603] bond11: left promiscuous mode [ 279.731075][T11618] netlink: 'syz.1.1518': attribute type 1 has an invalid length. [ 279.731102][T11618] netlink: 232 bytes leftover after parsing attributes in process `syz.1.1518'. [ 279.731120][T11618] netlink: 'syz.1.1518': attribute type 1 has an invalid length. [ 279.762960][T11618] netlink: 180 bytes leftover after parsing attributes in process `syz.1.1518'. [ 279.776416][T11618] Bluetooth: hci0: unsupported parameter 5135 [ 279.776441][T11618] Bluetooth: hci0: invalid length 1, exp 2 for type 24 [ 280.032104][T11625] netlink: 56 bytes leftover after parsing attributes in process `syz.2.1521'. [ 280.589127][T11650] netlink: 20 bytes leftover after parsing attributes in process `syz.0.1528'. [ 280.589153][T11650] openvswitch: netlink: Flow actions attr not present in new flow. [ 280.913692][T11659] netlink: 24 bytes leftover after parsing attributes in process `syz.1.1530'. [ 280.957125][T11659] netlink: 'syz.1.1530': attribute type 4 has an invalid length. [ 280.957146][T11659] netlink: 152 bytes leftover after parsing attributes in process `syz.1.1530'. [ 281.619976][T11687] netlink: 'syz.3.1543': attribute type 1 has an invalid length. [ 281.699194][T11695] netlink: 'syz.0.1545': attribute type 10 has an invalid length. [ 281.752976][T11699] netlink: 'syz.0.1545': attribute type 10 has an invalid length. [ 281.831637][T11701] netlink: 'syz.0.1545': attribute type 1 has an invalid length. [ 281.831680][T11701] netlink: 'syz.0.1545': attribute type 1 has an invalid length. [ 281.855693][T11687] 8021q: adding VLAN 0 to HW filter on device bond11 [ 281.882986][T11695] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 281.896367][T11695] team0: Port device netdevsim1 added [ 281.900779][T11692] bond7: (slave veth0_to_bond): Releasing active interface [ 281.927504][T11692] bond11: (slave veth0_to_bond): making interface the new active one [ 281.929168][T11692] bond11: (slave veth0_to_bond): Enslaving as an active interface with an up link [ 282.011623][T11699] team0: Port device netdevsim1 removed [ 282.029508][T11699] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 282.044866][T11699] bond0: (slave netdevsim1): Enslaving as an active interface with an up link [ 282.075056][T11700] macvlan2: entered promiscuous mode [ 282.077893][T11700] macvlan2: entered allmulticast mode [ 282.080727][T11700] bond11: entered promiscuous mode [ 282.080753][T11700] veth0_to_bond: entered promiscuous mode [ 282.089672][T11700] 8021q: adding VLAN 0 to HW filter on device macvlan2 [ 282.096310][T11700] bond11: (slave macvlan2): the slave hw address is in use by the bond; couldn't find a slave with a free hw address to give it (this should not have happened) [ 282.120913][T11700] bond11: left promiscuous mode [ 282.120981][T11700] veth0_to_bond: left promiscuous mode [ 282.543625][T11713] ip6tnl0: entered promiscuous mode [ 282.642526][T11713] can: request_module (can-proto-3) failed. [ 282.968002][T11731] 8021q: adding VLAN 0 to HW filter on device bond12 [ 283.007449][T11731] bond11: (slave veth0_to_bond): Releasing active interface [ 283.070287][T11731] bond12: (slave veth0_to_bond): making interface the new active one [ 283.081780][T11731] bond12: (slave veth0_to_bond): Enslaving as an active interface with an up link [ 283.223725][T11738] macvlan2: entered promiscuous mode [ 283.223751][T11738] macvlan2: entered allmulticast mode [ 283.249505][T11738] bond12: entered promiscuous mode [ 283.249533][T11738] veth0_to_bond: entered promiscuous mode [ 283.258365][T11738] 8021q: adding VLAN 0 to HW filter on device macvlan2 [ 283.295189][T11738] bond12: (slave macvlan2): the slave hw address is in use by the bond; couldn't find a slave with a free hw address to give it (this should not have happened) [ 283.295696][T11738] bond12: left promiscuous mode [ 283.295718][T11738] veth0_to_bond: left promiscuous mode [ 283.866717][T11756] validate_nla: 2 callbacks suppressed [ 283.866741][T11756] netlink: 'syz.4.1558': attribute type 1 has an invalid length. [ 284.004857][T11756] 8021q: adding VLAN 0 to HW filter on device bond8 [ 284.066145][T11760] bond7: (slave veth0_to_bond): Releasing active interface [ 284.121763][T11760] bond8: (slave veth0_to_bond): making interface the new active one [ 284.134542][T11760] bond8: (slave veth0_to_bond): Enslaving as an active interface with an up link [ 284.232001][T11756] macvlan2: entered promiscuous mode [ 284.232026][T11756] macvlan2: entered allmulticast mode [ 284.232830][T11756] bond8: entered promiscuous mode [ 284.232848][T11756] veth0_to_bond: entered promiscuous mode [ 284.248753][T11756] 8021q: adding VLAN 0 to HW filter on device macvlan2 [ 284.257139][T11756] bond8: (slave macvlan2): the slave hw address is in use by the bond; couldn't find a slave with a free hw address to give it (this should not have happened) [ 284.257296][T11756] bond8: left promiscuous mode [ 284.257313][T11756] veth0_to_bond: left promiscuous mode [ 285.572206][T11816] __nla_validate_parse: 8 callbacks suppressed [ 285.572229][T11816] netlink: 24 bytes leftover after parsing attributes in process `syz.1.1576'. [ 285.627904][T11816] netlink: 'syz.1.1576': attribute type 4 has an invalid length. [ 285.627927][T11816] netlink: 152 bytes leftover after parsing attributes in process `syz.1.1576'. [ 286.524122][T11844] netlink: 48 bytes leftover after parsing attributes in process `syz.1.1587'. [ 286.567781][T11845] netlink: 48 bytes leftover after parsing attributes in process `syz.1.1587'. [ 286.755249][T11852] netlink: 24 bytes leftover after parsing attributes in process `syz.0.1589'. [ 286.788980][T11852] netlink: 'syz.0.1589': attribute type 4 has an invalid length. [ 286.789004][T11852] netlink: 152 bytes leftover after parsing attributes in process `syz.0.1589'. [ 287.881595][T11888] IPv6: NLM_F_CREATE should be specified when creating new route [ 287.901876][T11886] netlink: 12 bytes leftover after parsing attributes in process `syz.0.1601'. [ 288.065665][T11894] netlink: 24 bytes leftover after parsing attributes in process `syz.3.1604'. [ 288.096905][T11894] netlink: 'syz.3.1604': attribute type 4 has an invalid length. [ 288.096930][T11894] netlink: 152 bytes leftover after parsing attributes in process `syz.3.1604'. [ 288.451723][T11911] IPv6: Can't replace route, no match found [ 288.452030][T11911] IPv6: Can't replace route, no match found [ 288.506220][T11916] netlink: 12 bytes leftover after parsing attributes in process `syz.0.1610'. [ 288.767854][T11925] x_tables: arp_tables: NFQUEUE target: not valid for this family [ 289.452489][T11941] netlink: 'syz.1.1619': attribute type 4 has an invalid length. [ 289.778451][T11955] netlink: 'syz.0.1625': attribute type 21 has an invalid length. [ 290.420086][T11983] mac80211_hwsim hwsim2 wlan0: entered promiscuous mode [ 290.420117][T11983] mac80211_hwsim hwsim2 wlan0: entered allmulticast mode [ 290.431000][T11983] A link change request failed with some changes committed already. Interface wlan0 may have been left with an inconsistent configuration, please check. [ 290.680312][T11992] netlink: 'syz.0.1636': attribute type 26 has an invalid length. [ 291.679856][T12002] __nla_validate_parse: 3 callbacks suppressed [ 291.679877][T12002] netlink: 4 bytes leftover after parsing attributes in process `syz.4.1637'. [ 291.726528][T12002] bond8: (slave veth0_to_bond): Releasing active interface [ 291.758920][T12014] netlink: 24 bytes leftover after parsing attributes in process `syz.3.1639'. [ 292.074982][T12020] netlink: 120 bytes leftover after parsing attributes in process `syz.3.1642'. [ 292.075185][T12020] netlink: 120 bytes leftover after parsing attributes in process `syz.3.1642'. [ 292.082188][T12019] netlink: 'syz.2.1641': attribute type 62 has an invalid length. [ 292.173001][T12020] netlink: 'syz.3.1642': attribute type 1 has an invalid length. [ 292.217595][T12021] netlink: 'syz.3.1642': attribute type 1 has an invalid length. [ 292.580885][T12042] netlink: 'syz.2.1648': attribute type 1 has an invalid length. [ 292.593323][T12038] pim6reg: entered allmulticast mode [ 292.616781][T12039] pim6reg: left allmulticast mode [ 292.646150][T12043] netlink: 28 bytes leftover after parsing attributes in process `syz.2.1648'. [ 292.703269][T12044] netlink: 28 bytes leftover after parsing attributes in process `syz.2.1648'. [ 293.035957][T12054] netlink: 3 bytes leftover after parsing attributes in process `syz.1.1650'. [ 293.612927][T12076] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 293.679325][T12077] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 293.721353][T12084] netlink: 12 bytes leftover after parsing attributes in process `syz.1.1656'. [ 293.751384][T12077] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 293.801884][T12088] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 293.832557][T12088] netlink: 'syz.4.1657': attribute type 7 has an invalid length. [ 293.832585][T12088] netlink: 'syz.4.1657': attribute type 8 has an invalid length. [ 293.832600][T12088] netlink: 'syz.4.1657': attribute type 13 has an invalid length. [ 293.868590][T12088] IPv6: NLM_F_REPLACE set, but no existing node found! [ 294.137923][T12095] netlink: 24 bytes leftover after parsing attributes in process `syz.1.1658'. [ 294.163913][T12095] netlink: 152 bytes leftover after parsing attributes in process `syz.1.1658'. [ 294.711968][T12121] validate_nla: 1 callbacks suppressed [ 294.711991][T12121] netlink: 'syz.2.1666': attribute type 4 has an invalid length. [ 295.739387][T12155] ip_tables: iptables: counters copy to user failed while replacing table [ 295.949857][T12168] netlink: 'syz.0.1683': attribute type 4 has an invalid length. [ 296.253605][T12180] openvswitch: netlink: Missing key (keys=c0, expected=100) [ 297.249447][T12210] netlink: 'syz.0.1693': attribute type 4 has an invalid length. [ 297.477143][T12215] xt_hashlimit: size too large, truncated to 1048576 [ 298.532575][ T31] audit: type=1107 audit(1789763153.083:2): pid=12240 uid=0 auid=4294967295 ses=4294967295 subj=unconfined msg='' [ 298.756576][ T31] audit: type=1804 audit(1789763153.303:3): pid=12245 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=open_writers comm="syz.2.1702" name="/newroot/333/cgroup.controllers" dev="tmpfs" ino=1731 res=1 errno=0 [ 298.758061][ T31] audit: type=1800 audit(1789763153.313:4): pid=12245 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.2.1702" name="cgroup.controllers" dev="tmpfs" ino=1731 res=0 errno=0 [ 301.591497][T12260] __nla_validate_parse: 8 callbacks suppressed [ 301.591521][T12260] netlink: 4 bytes leftover after parsing attributes in process `syz.4.1705'. [ 301.958364][T12267] netlink: 2 bytes leftover after parsing attributes in process `syz.2.1707'. [ 302.003798][ C0] ip6_tunnel: ip6gre2 xmit: Local address not yet configured! [ 302.771179][T12295] netlink: 1363 bytes leftover after parsing attributes in process `syz.3.1713'. [ 302.837276][T12295] netlink: 'syz.3.1713': attribute type 11 has an invalid length. [ 302.880345][T12298] netlink: 'syz.4.1714': attribute type 4 has an invalid length. [ 303.209290][T12308] netlink: 'syz.2.1717': attribute type 21 has an invalid length. [ 303.209378][T12308] netlink: 'syz.2.1717': attribute type 3 has an invalid length. [ 303.209394][T12308] netlink: 144 bytes leftover after parsing attributes in process `syz.2.1717'. [ 303.479026][T12319] sctp: [Deprecated]: syz.1.1720 (pid 12319) Use of struct sctp_assoc_value in delayed_ack socket option. [ 303.479026][T12319] Use struct sctp_sack_info instead [ 303.886983][T12341] netlink: 60 bytes leftover after parsing attributes in process `syz.4.1725'. [ 304.822827][T12328] netlink: 'syz.1.1722': attribute type 10 has an invalid length. [ 305.967802][T12405] tipc: Started in network mode [ 305.967839][T12405] tipc: Node identity fe80000000000000000000000000001, cluster identity 4711 [ 305.994344][T12405] tipc: Enabled bearer , priority 10 [ 306.620020][T12434] tipc: Enabling of bearer rejected, failed to enable media [ 307.113247][ T6557] tipc: Node number set to 4269801488 [ 307.763520][ C0] ip6_tunnel: ip6tnl2 xmit: Local address not yet configured! [ 308.001523][T12501] netlink: 4 bytes leftover after parsing attributes in process `syz.0.1756'. [ 308.221357][T12501] bond8: (slave veth0_to_bond): Releasing active interface [ 308.314088][T12501] bond0: (slave bond_slave_0): Releasing backup interface [ 308.372467][T12506] netlink: 8 bytes leftover after parsing attributes in process `syz.4.1758'. [ 308.412262][T12509] netlink: 28 bytes leftover after parsing attributes in process `syz.3.1757'. [ 308.412338][T12509] netlink: 28 bytes leftover after parsing attributes in process `syz.3.1757'. [ 308.412358][T12509] netlink: 'syz.3.1757': attribute type 4 has an invalid length. [ 308.531021][T12509] netlink: 4 bytes leftover after parsing attributes in process `syz.3.1757'. [ 308.932447][T12525] netlink: 15 bytes leftover after parsing attributes in process `syz.4.1761'. [ 309.089218][T12525] netlink: 'syz.4.1761': attribute type 1 has an invalid length. [ 309.089247][T12525] netlink: 8 bytes leftover after parsing attributes in process `syz.4.1761'. [ 309.262036][T12547] xt_cgroup: invalid path, errno=-2 [ 309.945252][T12569] netlink: 'syz.4.1774': attribute type 1 has an invalid length. [ 309.948399][T12576] ip6gre2: entered promiscuous mode [ 309.948430][T12576] ip6gre2: entered allmulticast mode [ 309.999600][T12573] netlink: 4 bytes leftover after parsing attributes in process `syz.4.1774'. [ 310.037532][T12569] bond9: entered promiscuous mode [ 310.038014][T12569] 8021q: adding VLAN 0 to HW filter on device bond9 [ 310.131023][T12573] 8021q: adding VLAN 0 to HW filter on device bond9 [ 310.143935][T12573] bond9: (slave wireguard0): The slave device specified does not support setting the MAC address [ 310.143963][T12573] bond9: (slave wireguard0): Setting fail_over_mac to active for active-backup mode [ 310.211903][T12573] bond9: (slave wireguard0): making interface the new active one [ 310.211932][T12573] wireguard0: entered promiscuous mode [ 310.250487][T12573] bond9: (slave wireguard0): Enslaving as an active interface with an up link [ 310.573847][ T8002] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 310.573871][ T8002] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 310.885947][T12610] block nbd0: not configured, cannot reconfigure [ 311.114169][T12620] netlink: 'syz.0.1789': attribute type 4 has an invalid length. [ 312.176826][T12657] netlink: 'syz.1.1800': attribute type 4 has an invalid length. [ 312.199495][T12663] tipc: Resetting bearer [ 312.202478][T12663] syzkaller0: left promiscuous mode [ 312.202502][T12663] syzkaller0: left allmulticast mode [ 312.918851][T12690] netlink: 'syz.3.1810': attribute type 1 has an invalid length. [ 312.918878][T12690] netlink: 244 bytes leftover after parsing attributes in process `syz.3.1810'. [ 313.069698][T12690] netlink: 'syz.3.1810': attribute type 6 has an invalid length. [ 313.123271][ T6555] netdevsim netdevsim3 netdevsim0: entered promiscuous mode [ 313.128406][T12690] 8021q: adding VLAN 0 to HW filter on device macsec0 [ 313.132699][T12692] FAULT_INJECTION: forcing a failure. [ 313.132699][T12692] name failslab, interval 1, probability 0, space 0, times 0 [ 313.132737][T12692] CPU: 0 UID: 0 PID: 12692 Comm: syz.1.1811 Not tainted syzkaller #0 PREEMPT(full) [ 313.132762][T12692] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 313.132778][T12692] Call Trace: [ 313.132787][T12692] [ 313.132797][T12692] dump_stack_lvl+0xe8/0x150 [ 313.132835][T12692] should_fail_ex+0x410/0x560 [ 313.132866][T12692] ? __alloc_skb+0x1db/0x7a0 [ 313.132893][T12692] should_failslab+0xa8/0x100 [ 313.132937][T12692] ? __alloc_skb+0x1db/0x7a0 [ 313.132962][T12692] kmem_cache_alloc_node_noprof+0xa1/0x610 [ 313.132999][T12692] ? __alloc_skb+0x18d/0x7a0 [ 313.133023][T12692] ? __alloc_skb+0x1db/0x7a0 [ 313.133053][T12692] __alloc_skb+0x1db/0x7a0 [ 313.133083][T12692] netlink_sendmsg+0x5d4/0xb40 [ 313.133127][T12692] ? __pfx_netlink_sendmsg+0x10/0x10 [ 313.133169][T12692] ? apparmor_socket_sendmsg+0x98/0x360 [ 313.133196][T12692] ? __pfx_netlink_sendmsg+0x10/0x10 [ 313.133228][T12692] sock_sendmsg_nosec+0x13a/0x180 [ 313.133255][T12692] ____sys_sendmsg+0x54e/0x850 [ 313.133292][T12692] ? __pfx_____sys_sendmsg+0x10/0x10 [ 313.133330][T12692] ? import_iovec+0x73/0xa0 [ 313.133362][T12692] ___sys_sendmsg+0x2a5/0x360 [ 313.133392][T12692] ? __lock_acquire+0x747/0x2de0 [ 313.133421][T12692] ? __pfx____sys_sendmsg+0x10/0x10 [ 313.133490][T12692] ? __fget_files+0x2a/0x420 [ 313.133522][T12692] ? __fget_files+0x3a2/0x420 [ 313.133565][T12692] __x64_sys_sendmsg+0x1b1/0x290 [ 313.133599][T12692] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 313.133653][T12692] do_syscall_64+0x166/0x520 [ 313.133679][T12692] ? trace_irq_disable+0x3b/0x140 [ 313.133701][T12692] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 313.133722][T12692] ? clear_bhb_loop+0x70/0xc0 [ 313.133749][T12692] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 313.133772][T12692] RIP: 0033:0x7f74eb99e159 [ 313.133794][T12692] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 313.133813][T12692] RSP: 002b:00007f74ec7fd028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 313.133837][T12692] RAX: ffffffffffffffda RBX: 00007f74ebc25fa0 RCX: 00007f74eb99e159 [ 313.133854][T12692] RDX: 0000000004000004 RSI: 0000200000000040 RDI: 0000000000000003 [ 313.133868][T12692] RBP: 00007f74ec7fd090 R08: 0000000000000000 R09: 0000000000000000 [ 313.133882][T12692] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 313.133895][T12692] R13: 00007f74ebc26038 R14: 00007f74ebc25fa0 R15: 00007ffce07129d8 [ 313.133938][T12692] [ 313.456328][T12694] ¾x9ÿ: renamed from bridge_slave_0 (while UP) [ 313.682008][T12707] netlink: 16 bytes leftover after parsing attributes in process `syz.2.1815'. [ 313.682034][T12707] netlink: 23 bytes leftover after parsing attributes in process `syz.2.1815'. [ 314.015773][T12724] netlink: 'syz.0.1817': attribute type 4 has an invalid length. [ 314.385134][T12734] netlink: 8 bytes leftover after parsing attributes in process `syz.4.1825'. [ 315.088934][T12765] netlink: 4 bytes leftover after parsing attributes in process `syz.1.1834'. [ 315.252403][T12775] netlink: 'syz.2.1835': attribute type 15 has an invalid length. [ 315.252428][T12775] netlink: 24 bytes leftover after parsing attributes in process `syz.2.1835'. [ 315.792102][T12783] can: request_module (can-proto-0) failed. [ 315.901165][T12793] netlink: 'syz.4.1842': attribute type 4 has an invalid length. [ 316.190779][T12803] netlink: 24 bytes leftover after parsing attributes in process `syz.0.1845'. [ 316.207618][T12803] netlink: 'syz.0.1845': attribute type 4 has an invalid length. [ 316.207643][T12803] netlink: 152 bytes leftover after parsing attributes in process `syz.0.1845'. [ 316.243842][T12808] tipc: Enabling of bearer rejected, already enabled [ 317.210846][T12840] sch_tbf: peakrate 3 is lower than or equals to rate 6829859379779001161 ! [ 317.240109][T12841] netlink: 24 bytes leftover after parsing attributes in process `syz.1.1858'. [ 317.339283][T12841] netlink: 'syz.1.1858': attribute type 4 has an invalid length. [ 317.339310][T12841] netlink: 152 bytes leftover after parsing attributes in process `syz.1.1858'. [ 317.378173][T12845] netlink: 36 bytes leftover after parsing attributes in process `syz.2.1857'. [ 320.122055][T12943] netlink: 12 bytes leftover after parsing attributes in process `syz.0.1891'. [ 320.122110][T12943] netlink: 20 bytes leftover after parsing attributes in process `syz.0.1891'. [ 320.379604][T12953] netlink: 8 bytes leftover after parsing attributes in process `syz.0.1895'. [ 320.380436][T12953] netlink: 4356 bytes leftover after parsing attributes in process `syz.0.1895'. [ 320.380502][T12953] netlink: 4356 bytes leftover after parsing attributes in process `syz.0.1895'. [ 321.069340][T12970] bond10: option ad_user_port_key: mode dependency failed, not supported in mode balance-alb(6) [ 321.086492][T12970] bond10 (unregistering): Released all slaves [ 321.180132][T12978] FAULT_INJECTION: forcing a failure. [ 321.180132][T12978] name failslab, interval 1, probability 0, space 0, times 0 [ 321.180171][T12978] CPU: 1 UID: 0 PID: 12978 Comm: syz.4.1908 Not tainted syzkaller #0 PREEMPT(full) [ 321.180195][T12978] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 321.180210][T12978] Call Trace: [ 321.180218][T12978] [ 321.180229][T12978] dump_stack_lvl+0xe8/0x150 [ 321.180267][T12978] should_fail_ex+0x410/0x560 [ 321.180299][T12978] should_failslab+0xa8/0x100 [ 321.180330][T12978] __kmalloc_cache_noprof+0xa3/0x600 [ 321.180355][T12978] ? nf_ct_tmpl_alloc+0x7e/0x230 [ 321.180382][T12978] ? nf_ct_tmpl_alloc+0x7e/0x230 [ 321.180416][T12978] nf_ct_tmpl_alloc+0x7e/0x230 [ 321.180452][T12978] nft_ct_set_init+0x34c/0x7c0 [ 321.180487][T12978] ? __pfx_nft_ct_set_init+0x10/0x10 [ 321.180513][T12978] ? __kmalloc_noprof+0x1ab/0x720 [ 321.180533][T12978] ? nf_tables_newrule+0x1524/0x28a0 [ 321.180560][T12978] ? nf_tables_newrule+0x1524/0x28a0 [ 321.180597][T12978] nf_tables_newrule+0x179e/0x28a0 [ 321.180653][T12978] ? __pfx_nf_tables_newrule+0x10/0x10 [ 321.180682][T12978] ? lock_acquire+0x115/0x350 [ 321.180706][T12978] ? nfnl_pernet+0x23/0x240 [ 321.180748][T12978] ? __nla_parse+0x40/0x60 [ 321.180783][T12978] nfnetlink_rcv+0x1288/0x28c0 [ 321.180854][T12978] ? __pfx_nfnetlink_rcv+0x10/0x10 [ 321.180904][T12978] ? ref_tracker_free+0x689/0x830 [ 321.180959][T12978] ? skb_clone+0x246/0x3a0 [ 321.181011][T12978] ? __netlink_deliver_tap+0x811/0x860 [ 321.181056][T12978] ? netlink_deliver_tap+0x2e/0x1b0 [ 321.181090][T12978] ? netlink_deliver_tap+0x2e/0x1b0 [ 321.181131][T12978] netlink_unicast+0x7bd/0x940 [ 321.181175][T12978] netlink_sendmsg+0x813/0xb40 [ 321.181221][T12978] ? __pfx_netlink_sendmsg+0x10/0x10 [ 321.181265][T12978] ? apparmor_socket_sendmsg+0x98/0x360 [ 321.181293][T12978] ? __pfx_netlink_sendmsg+0x10/0x10 [ 321.181327][T12978] sock_sendmsg_nosec+0x13a/0x180 [ 321.181353][T12978] ____sys_sendmsg+0x54e/0x850 [ 321.181390][T12978] ? __pfx_____sys_sendmsg+0x10/0x10 [ 321.181431][T12978] ? import_iovec+0x73/0xa0 [ 321.181464][T12978] ___sys_sendmsg+0x2a5/0x360 [ 321.181493][T12978] ? __lock_acquire+0x747/0x2de0 [ 321.181522][T12978] ? __pfx____sys_sendmsg+0x10/0x10 [ 321.181594][T12978] ? __fget_files+0x2a/0x420 [ 321.181631][T12978] ? __fget_files+0x3a2/0x420 [ 321.181672][T12978] __x64_sys_sendmsg+0x1b1/0x290 [ 321.181706][T12978] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 321.181762][T12978] do_syscall_64+0x166/0x520 [ 321.181789][T12978] ? trace_irq_disable+0x3b/0x140 [ 321.181812][T12978] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 321.181836][T12978] ? clear_bhb_loop+0x70/0xc0 [ 321.181864][T12978] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 321.181887][T12978] RIP: 0033:0x7f8c3279e159 [ 321.181908][T12978] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 321.181928][T12978] RSP: 002b:00007f8c33651028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 321.181952][T12978] RAX: ffffffffffffffda RBX: 00007f8c32a25fa0 RCX: 00007f8c3279e159 [ 321.181969][T12978] RDX: 0000000004000004 RSI: 0000200000000040 RDI: 0000000000000003 [ 321.181985][T12978] RBP: 00007f8c33651090 R08: 0000000000000000 R09: 0000000000000000 [ 321.181999][T12978] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 321.182013][T12978] R13: 00007f8c32a26038 R14: 00007f8c32a25fa0 R15: 00007ffc5bcdf138 [ 321.182050][T12978] [ 321.706947][T12982] netlink: 'syz.2.1907': attribute type 4 has an invalid length. [ 321.792543][T12985] netlink: 24 bytes leftover after parsing attributes in process `syz.3.1909'. [ 321.841218][T12985] netlink: 'syz.3.1909': attribute type 4 has an invalid length. [ 321.841242][T12985] netlink: 152 bytes leftover after parsing attributes in process `syz.3.1909'. [ 322.419679][T13017] FAULT_INJECTION: forcing a failure. [ 322.419679][T13017] name failslab, interval 1, probability 0, space 0, times 0 [ 322.419714][T13017] CPU: 1 UID: 0 PID: 13017 Comm: syz.1.1920 Not tainted syzkaller #0 PREEMPT(full) [ 322.419740][T13017] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 322.419754][T13017] Call Trace: [ 322.419763][T13017] [ 322.419773][T13017] dump_stack_lvl+0xe8/0x150 [ 322.419812][T13017] should_fail_ex+0x410/0x560 [ 322.419845][T13017] should_failslab+0xa8/0x100 [ 322.419875][T13017] __kmalloc_cache_noprof+0xa3/0x600 [ 322.419898][T13017] ? nfnetlink_rcv+0x1021/0x28c0 [ 322.419936][T13017] ? nfnetlink_rcv+0x1021/0x28c0 [ 322.419972][T13017] nfnetlink_rcv+0x1021/0x28c0 [ 322.420035][T13017] ? __pfx_nfnetlink_rcv+0x10/0x10 [ 322.420115][T13017] ? lock_acquire+0x115/0x350 [ 322.420147][T13017] ? netlink_deliver_tap+0x2e/0x1b0 [ 322.420180][T13017] ? netlink_deliver_tap+0x2e/0x1b0 [ 322.420219][T13017] netlink_unicast+0x7bd/0x940 [ 322.420263][T13017] netlink_sendmsg+0x813/0xb40 [ 322.420309][T13017] ? __pfx_netlink_sendmsg+0x10/0x10 [ 322.420354][T13017] ? apparmor_socket_sendmsg+0x98/0x360 [ 322.420383][T13017] ? __pfx_netlink_sendmsg+0x10/0x10 [ 322.420414][T13017] sock_sendmsg_nosec+0x13a/0x180 [ 322.420441][T13017] ____sys_sendmsg+0x54e/0x850 [ 322.420478][T13017] ? __pfx_____sys_sendmsg+0x10/0x10 [ 322.420520][T13017] ? import_iovec+0x73/0xa0 [ 322.420553][T13017] ___sys_sendmsg+0x2a5/0x360 [ 322.420589][T13017] ? __lock_acquire+0x747/0x2de0 [ 322.420617][T13017] ? __pfx____sys_sendmsg+0x10/0x10 [ 322.420699][T13017] ? __fget_files+0x2a/0x420 [ 322.420728][T13017] ? __fget_files+0x3a2/0x420 [ 322.420768][T13017] __x64_sys_sendmsg+0x1b1/0x290 [ 322.420799][T13017] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 322.420851][T13017] do_syscall_64+0x166/0x520 [ 322.420895][T13017] ? trace_irq_disable+0x3b/0x140 [ 322.420925][T13017] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 322.420948][T13017] ? clear_bhb_loop+0x70/0xc0 [ 322.420974][T13017] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 322.420994][T13017] RIP: 0033:0x7f74eb99e159 [ 322.421014][T13017] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 322.421032][T13017] RSP: 002b:00007f74ec7fd028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 322.421056][T13017] RAX: ffffffffffffffda RBX: 00007f74ebc25fa0 RCX: 00007f74eb99e159 [ 322.421073][T13017] RDX: 0000000004000004 RSI: 0000200000000040 RDI: 0000000000000003 [ 322.421088][T13017] RBP: 00007f74ec7fd090 R08: 0000000000000000 R09: 0000000000000000 [ 322.421103][T13017] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 322.421116][T13017] R13: 00007f74ebc26038 R14: 00007f74ebc25fa0 R15: 00007ffce07129d8 [ 322.421151][T13017] [ 323.206032][T13031] netlink: 24 bytes leftover after parsing attributes in process `syz.0.1927'. [ 323.263743][T13031] netlink: 'syz.0.1927': attribute type 4 has an invalid length. [ 323.263770][T13031] netlink: 152 bytes leftover after parsing attributes in process `syz.0.1927'. [ 324.175353][T13071] netlink: 8 bytes leftover after parsing attributes in process `syz.3.1941'. [ 324.240377][T13071] bond13: up delay (10) is not a multiple of miimon (7), value rounded to 7 ms [ 324.276881][T13071] bond13 (unregistering): Released all slaves [ 324.331705][T13080] netlink: 'syz.4.1942': attribute type 4 has an invalid length. [ 324.421769][T13082] FAULT_INJECTION: forcing a failure. [ 324.421769][T13082] name failslab, interval 1, probability 0, space 0, times 0 [ 324.421817][T13082] CPU: 0 UID: 0 PID: 13082 Comm: syz.0.1943 Not tainted syzkaller #0 PREEMPT(full) [ 324.421842][T13082] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 324.421856][T13082] Call Trace: [ 324.421865][T13082] [ 324.421874][T13082] dump_stack_lvl+0xe8/0x150 [ 324.421911][T13082] should_fail_ex+0x410/0x560 [ 324.421943][T13082] should_failslab+0xa8/0x100 [ 324.421974][T13082] __kmalloc_cache_noprof+0xa3/0x600 [ 324.421998][T13082] ? nf_ct_tmpl_alloc+0x7e/0x230 [ 324.422025][T13082] ? nf_ct_tmpl_alloc+0x7e/0x230 [ 324.422059][T13082] nf_ct_tmpl_alloc+0x7e/0x230 [ 324.422090][T13082] nft_ct_set_init+0x34c/0x7c0 [ 324.422124][T13082] ? __pfx_nft_ct_set_init+0x10/0x10 [ 324.422151][T13082] ? __kmalloc_noprof+0x1ab/0x720 [ 324.422171][T13082] ? nf_tables_newrule+0x1524/0x28a0 [ 324.422199][T13082] ? nf_tables_newrule+0x1524/0x28a0 [ 324.422236][T13082] nf_tables_newrule+0x179e/0x28a0 [ 324.422280][T13082] ? __pfx_nf_tables_newrule+0x10/0x10 [ 324.422313][T13082] ? lock_acquire+0x115/0x350 [ 324.422336][T13082] ? nfnl_pernet+0x23/0x240 [ 324.422376][T13082] ? __nla_parse+0x40/0x60 [ 324.422406][T13082] nfnetlink_rcv+0x1288/0x28c0 [ 324.422471][T13082] ? __pfx_nfnetlink_rcv+0x10/0x10 [ 324.422518][T13082] ? ref_tracker_free+0x689/0x830 [ 324.422575][T13082] ? _raw_spin_unlock_irqrestore+0x4c/0x80 [ 324.422601][T13082] ? rcu_preempt_deferred_qs_irqrestore+0x7b7/0xb90 [ 324.422660][T13082] netlink_unicast+0x7bd/0x940 [ 324.422703][T13082] netlink_sendmsg+0x813/0xb40 [ 324.422748][T13082] ? __pfx_netlink_sendmsg+0x10/0x10 [ 324.422791][T13082] ? apparmor_socket_sendmsg+0x98/0x360 [ 324.422828][T13082] ? __pfx_netlink_sendmsg+0x10/0x10 [ 324.422862][T13082] sock_sendmsg_nosec+0x13a/0x180 [ 324.422888][T13082] ____sys_sendmsg+0x54e/0x850 [ 324.422924][T13082] ? __pfx_____sys_sendmsg+0x10/0x10 [ 324.422965][T13082] ? import_iovec+0x73/0xa0 [ 324.422996][T13082] ___sys_sendmsg+0x2a5/0x360 [ 324.423024][T13082] ? __lock_acquire+0x747/0x2de0 [ 324.423049][T13082] ? __pfx____sys_sendmsg+0x10/0x10 [ 324.423116][T13082] ? __fget_files+0x2a/0x420 [ 324.423146][T13082] ? __fget_files+0x3a2/0x420 [ 324.423187][T13082] __x64_sys_sendmsg+0x1b1/0x290 [ 324.423219][T13082] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 324.423273][T13082] do_syscall_64+0x166/0x520 [ 324.423314][T13082] ? trace_irq_disable+0x3b/0x140 [ 324.423336][T13082] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 324.423359][T13082] ? clear_bhb_loop+0x70/0xc0 [ 324.423387][T13082] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 324.423410][T13082] RIP: 0033:0x7f61edf9e159 [ 324.423430][T13082] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 324.423449][T13082] RSP: 002b:00007f61eee57028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 324.423474][T13082] RAX: ffffffffffffffda RBX: 00007f61ee225fa0 RCX: 00007f61edf9e159 [ 324.423491][T13082] RDX: 0000000004000004 RSI: 0000200000000040 RDI: 0000000000000003 [ 324.423506][T13082] RBP: 00007f61eee57090 R08: 0000000000000000 R09: 0000000000000000 [ 324.423521][T13082] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 324.423534][T13082] R13: 00007f61ee226038 R14: 00007f61ee225fa0 R15: 00007ffdf1117818 [ 324.423570][T13082] [ 326.149205][T13119] netlink: 'syz.3.1954': attribute type 4 has an invalid length. [ 326.225975][T13121] __nla_validate_parse: 2 callbacks suppressed [ 326.226001][T13121] netlink: 108 bytes leftover after parsing attributes in process `syz.2.1955'. [ 326.228484][T13121] netlink: 28 bytes leftover after parsing attributes in process `syz.2.1955'. [ 326.228521][T13121] netlink: 28 bytes leftover after parsing attributes in process `syz.2.1955'. [ 326.238349][T13123] netlink: 28 bytes leftover after parsing attributes in process `syz.2.1955'. [ 326.238447][T13123] netlink: 28 bytes leftover after parsing attributes in process `syz.2.1955'. [ 326.331989][T13125] netlink: 28 bytes leftover after parsing attributes in process `syz.2.1955'. [ 326.332028][T13125] netlink: 28 bytes leftover after parsing attributes in process `syz.2.1955'. [ 326.367012][T13121] ip6gretap0: entered promiscuous mode [ 326.380151][T13121] ip6gretap0: left promiscuous mode [ 326.529237][T13123] ip6gretap0: entered promiscuous mode [ 326.550023][T13137] netlink: 'syz.4.1958': attribute type 4 has an invalid length. [ 326.565339][T13123] ip6gretap0: left promiscuous mode [ 326.615687][T13125] ip6gretap0: entered promiscuous mode [ 326.619437][T13125] ip6gretap0: left promiscuous mode [ 326.729348][T13134] netlink: 36 bytes leftover after parsing attributes in process `syz.3.1959'. [ 327.459372][T13178] netlink: 'syz.1.1969': attribute type 1 has an invalid length. [ 327.459762][T13178] netlink: 20 bytes leftover after parsing attributes in process `syz.1.1969'. [ 327.870030][ T52] block nbd0: Receive control failed (result -32) [ 327.871644][ T5621] block nbd0: Receive control failed (result -32) [ 328.246350][T13194] netlink: 'syz.4.1977': attribute type 1 has an invalid length. [ 328.323639][T13204] FAULT_INJECTION: forcing a failure. [ 328.323639][T13204] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 328.323674][T13204] CPU: 1 UID: 0 PID: 13204 Comm: syz.1.1980 Not tainted syzkaller #0 PREEMPT(full) [ 328.323698][T13204] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 328.323712][T13204] Call Trace: [ 328.323721][T13204] [ 328.323730][T13204] dump_stack_lvl+0xe8/0x150 [ 328.323766][T13204] should_fail_ex+0x410/0x560 [ 328.323794][T13204] _copy_from_user+0x2d/0xb0 [ 328.323818][T13204] kstrtouint_from_user+0xd6/0x180 [ 328.323839][T13204] ? __pfx_kstrtouint_from_user+0x10/0x10 [ 328.323873][T13204] ? lock_acquire+0x115/0x350 [ 328.323897][T13204] proc_fail_nth_write+0x8e/0x210 [ 328.323916][T13204] ? __pfx_proc_fail_nth_write+0x10/0x10 [ 328.323954][T13204] ? __pfx_proc_fail_nth_write+0x10/0x10 [ 328.323983][T13204] vfs_write+0x296/0xba0 [ 328.324017][T13204] ? __pfx_vfs_write+0x10/0x10 [ 328.324046][T13204] ? __fget_files+0x2a/0x420 [ 328.324078][T13204] ? __fget_files+0x3a2/0x420 [ 328.324103][T13204] ? __fget_files+0x2a/0x420 [ 328.324138][T13204] ksys_write+0x150/0x270 [ 328.324171][T13204] ? __pfx_ksys_write+0x10/0x10 [ 328.324210][T13204] do_syscall_64+0x166/0x520 [ 328.324235][T13204] ? trace_irq_disable+0x3b/0x140 [ 328.324256][T13204] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 328.324279][T13204] ? clear_bhb_loop+0x70/0xc0 [ 328.324306][T13204] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 328.324328][T13204] RIP: 0033:0x7f74eb95e98e [ 328.324359][T13204] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 328.324379][T13204] RSP: 002b:00007f74ec7fcfe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 328.324407][T13204] RAX: ffffffffffffffda RBX: 00007f74ec7fd6c0 RCX: 00007f74eb95e98e [ 328.324423][T13204] RDX: 0000000000000001 RSI: 00007f74ec7fd0a0 RDI: 0000000000000004 [ 328.324436][T13204] RBP: 00007f74ec7fd090 R08: 0000000000000000 R09: 0000000000000000 [ 328.324450][T13204] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 328.324463][T13204] R13: 00007f74ebc26038 R14: 00007f74ebc25fa0 R15: 00007ffce07129d8 [ 328.324499][T13204] [ 328.329786][T13194] 8021q: adding VLAN 0 to HW filter on device bond10 [ 328.379954][T13203] netlink: 'syz.3.1979': attribute type 1 has an invalid length. [ 328.711652][T13207] netlink: 4 bytes leftover after parsing attributes in process `syz.3.1979'. [ 328.737831][T13203] bond13: entered promiscuous mode [ 328.738241][T13203] 8021q: adding VLAN 0 to HW filter on device bond13 [ 328.856450][T13207] 8021q: adding VLAN 0 to HW filter on device bond13 [ 328.862445][T13207] bond13: (slave wireguard0): The slave device specified does not support setting the MAC address [ 328.862473][T13207] bond13: (slave wireguard0): Setting fail_over_mac to active for active-backup mode [ 329.019646][T13207] bond13: (slave wireguard0): making interface the new active one [ 329.019673][T13207] wireguard0: entered promiscuous mode [ 329.048504][T13207] bond13: (slave wireguard0): Enslaving as an active interface with an up link [ 329.132813][T13222] netlink: 'syz.1.1984': attribute type 5 has an invalid length. [ 329.345227][T13230] netlink: 'syz.1.1986': attribute type 3 has an invalid length. [ 329.360082][T13231] netlink: 'syz.1.1986': attribute type 3 has an invalid length. [ 329.809596][T13248] veth0: entered promiscuous mode [ 330.058377][T13247] veth0: left promiscuous mode [ 330.931822][T13293] netlink: 'syz.3.2004': attribute type 1 has an invalid length. [ 331.160081][T13298] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 331.562235][T13306] netlink: 'syz.4.2007': attribute type 4 has an invalid length. [ 331.562259][T13306] __nla_validate_parse: 7 callbacks suppressed [ 331.562281][T13306] netlink: 152 bytes leftover after parsing attributes in process `syz.4.2007'. [ 331.697984][T13302] netlink: 24 bytes leftover after parsing attributes in process `syz.4.2007'. [ 332.119863][T13321] netlink: 20 bytes leftover after parsing attributes in process `syz.1.2012'. [ 332.119905][T13321] netlink: 'syz.1.2012': attribute type 1 has an invalid length. [ 332.191497][T13321] geneve2: entered promiscuous mode [ 332.749830][T13338] netlink: 'syz.1.2016': attribute type 4 has an invalid length. [ 332.779525][T13338] –: renamed from virt_wifi0 [ 333.424732][T13366] netlink: 16 bytes leftover after parsing attributes in process `syz.3.2019'. [ 333.481176][T13366] syzkaller1: entered promiscuous mode [ 333.481202][T13366] syzkaller1: entered allmulticast mode [ 334.111901][T13372] vlan2: left promiscuous mode [ 334.111929][T13372] bridge0: left promiscuous mode [ 334.136269][T13372] ip6gre1: left promiscuous mode [ 334.167005][T13372] ipip0: left promiscuous mode [ 334.182048][T13372] 8021q: adding VLAN 0 to HW filter on device bond6 [ 334.209396][T13372] 8021q: adding VLAN 0 to HW filter on device eth0 [ 334.227430][T13372] 8021q: adding VLAN 0 to HW filter on device eth1 [ 334.242880][T13388] netlink: 'syz.2.2026': attribute type 4 has an invalid length. [ 334.256976][T13372] 8021q: adding VLAN 0 to HW filter on device eth2 [ 334.260776][T13372] 8021q: adding VLAN 0 to HW filter on device eth3 [ 334.291050][T13372] gtp0: left promiscuous mode [ 334.312689][T13372] bond9: left promiscuous mode [ 334.312716][T13372] wireguard0: left promiscuous mode [ 334.382693][T13386] mac80211_hwsim hwsim6 syzkaller0: entered promiscuous mode [ 334.382773][T13386] mac80211_hwsim hwsim6 syzkaller0: entered allmulticast mode [ 334.407208][ T342] netdevsim netdevsim4 eth0: set [0, 0] type 1 family 0 port 8472 - 0 [ 334.412412][ T221] ip6_tunnel: ip6tnl2 xmit: Local address not yet configured! [ 334.432850][ T342] netdevsim netdevsim4 eth3: set [0, 0] type 1 family 0 port 8472 - 0 [ 334.432900][ T342] netdevsim netdevsim4 eth2: set [0, 0] type 1 family 0 port 8472 - 0 [ 334.432939][ T342] netdevsim netdevsim4 eth1: set [0, 0] type 1 family 0 port 8472 - 0 [ 334.671944][T13391] netlink: 24 bytes leftover after parsing attributes in process `syz.2.2028'. [ 334.697743][T13391] netlink: 'syz.2.2028': attribute type 21 has an invalid length. [ 334.824381][T13396] netlink: 8 bytes leftover after parsing attributes in process `syz.3.2027'. [ 335.038725][T13407] netlink: 24 bytes leftover after parsing attributes in process `syz.4.2032'. [ 335.095661][T13407] netlink: 'syz.4.2032': attribute type 4 has an invalid length. [ 335.095686][T13407] netlink: 152 bytes leftover after parsing attributes in process `syz.4.2032'. [ 335.187990][T13412] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 335.290534][T13410] netlink: 24 bytes leftover after parsing attributes in process `syz.0.2033'. [ 335.290870][T13415] netlink: 12 bytes leftover after parsing attributes in process `syz.3.2035'. [ 335.360796][T13410] netlink: 'syz.0.2033': attribute type 4 has an invalid length. [ 335.558672][T13423] netlink: 'syz.3.2038': attribute type 4 has an invalid length. [ 335.596316][T13425] netlink: 'syz.1.2037': attribute type 4 has an invalid length. [ 336.013300][T13439] xt_TCPMSS: Only works on TCP SYN packets [ 336.310166][T13452] netlink: 'syz.1.2049': attribute type 4 has an invalid length. [ 336.462079][T13458] netlink: 'syz.4.2050': attribute type 4 has an invalid length. [ 337.453541][T13487] __nla_validate_parse: 5 callbacks suppressed [ 337.453565][T13487] netlink: 24 bytes leftover after parsing attributes in process `syz.4.2062'. [ 337.476692][T13487] netlink: 'syz.4.2062': attribute type 4 has an invalid length. [ 337.476761][T13487] netlink: 152 bytes leftover after parsing attributes in process `syz.4.2062'. [ 338.173387][ C0] ip6_tunnel: ip6tnl2 xmit: Local address not yet configured! [ 339.312141][T13502] netlink: 'syz.1.2068': attribute type 4 has an invalid length. [ 340.791470][T13527] netlink: 'syz.2.2078': attribute type 32 has an invalid length. [ 340.805862][T13527] Bluetooth: hci0: unsupported parameter 5135 [ 340.805889][T13527] Bluetooth: hci0: unsupported parameter 8192 [ 340.805905][T13527] Bluetooth: hci0: unsupported parameter 5135 [ 340.805920][T13527] Bluetooth: hci0: unsupported parameter 8192 [ 341.125221][T13540] netlink: 'syz.3.2080': attribute type 4 has an invalid length. [ 342.308247][T13567] netlink: 'syz.3.2091': attribute type 4 has an invalid length. [ 342.617770][T13582] netlink: 'syz.4.2098': attribute type 23 has an invalid length. [ 342.790323][T13586] netlink: 24 bytes leftover after parsing attributes in process `syz.3.2099'. [ 342.862493][T13586] netlink: 'syz.3.2099': attribute type 4 has an invalid length. [ 342.862518][T13586] netlink: 152 bytes leftover after parsing attributes in process `syz.3.2099'. [ 343.668695][T13606] bridge0: received packet on syz_tun with own address as source address (addr:aa:aa:aa:aa:aa:aa, vlan:1) [ 343.769402][T13619] netlink: 'syz.2.2105': attribute type 4 has an invalid length. [ 344.265062][T13631] netlink: 'syz.2.2110': attribute type 4 has an invalid length. [ 345.130616][T13648] FAULT_INJECTION: forcing a failure. [ 345.130616][T13648] name fail_page_alloc, interval 1, probability 0, space 0, times 0 [ 345.130654][T13648] CPU: 0 UID: 0 PID: 13648 Comm: syz.0.2116 Not tainted syzkaller #0 PREEMPT(full) [ 345.130679][T13648] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 345.130693][T13648] Call Trace: [ 345.130703][T13648] [ 345.130712][T13648] dump_stack_lvl+0xe8/0x150 [ 345.130752][T13648] should_fail_ex+0x410/0x560 [ 345.130782][T13648] prepare_alloc_pages+0x223/0x600 [ 345.130816][T13648] __alloc_frozen_pages_noprof+0x185/0x5a0 [ 345.130847][T13648] ? __pfx___alloc_frozen_pages_noprof+0x10/0x10 [ 345.130878][T13648] ? __pfx_policy_nodemask+0x10/0x10 [ 345.130911][T13648] ? __lock_acquire+0x747/0x2de0 [ 345.130938][T13648] alloc_pages_mpol+0x21e/0x390 [ 345.131063][T13648] folio_alloc_mpol_noprof+0x39/0x160 [ 345.131114][T13648] vma_alloc_folio_noprof+0xe1/0x1e0 [ 345.131151][T13648] ? __pfx_vma_alloc_folio_noprof+0x10/0x10 [ 345.131186][T13648] ? lock_acquire+0x115/0x350 [ 345.131221][T13648] do_pte_missing+0x173a/0x34b0 [ 345.131268][T13648] handle_mm_fault+0x1a53/0x3750 [ 345.131315][T13648] ? handle_mm_fault+0xf1/0x3750 [ 345.131365][T13648] ? __pfx_handle_mm_fault+0x10/0x10 [ 345.131399][T13648] ? lock_vma_under_rcu+0x45a/0x500 [ 345.131442][T13648] ? __fget_files+0x2a/0x420 [ 345.131504][T13648] do_user_addr_fault+0xa4f/0x1340 [ 345.131544][T13648] ? trace_page_fault_user+0x84/0x1e0 [ 345.131573][T13648] exc_page_fault+0x6a/0xc0 [ 345.131608][T13648] asm_exc_page_fault+0x26/0x30 [ 345.131635][T13648] RIP: 0033:0x7f61ede5f6cb [ 345.131659][T13648] Code: 00 00 00 48 8d 3d 5d b1 1a 00 48 89 c1 31 c0 e8 0b 2e ff ff eb d2 66 0f 1f 84 00 00 00 00 00 55 31 c0 53 48 81 ec 68 10 00 00 <48> 89 7c 24 08 48 8d 3d 91 b1 1a 00 48 89 34 24 48 8b 14 24 48 8b [ 345.131690][T13648] RSP: 002b:00007f61eee34fa0 EFLAGS: 00010206 [ 345.131712][T13648] RAX: 0000000000000000 RBX: 00007f61ee226090 RCX: 0000000000000000 [ 345.131728][T13648] RDX: 0000000000000000 RSI: ffffffffffffffff RDI: 0000200000000280 [ 345.131742][T13648] RBP: 00007f61eee36090 R08: 0000000000000000 R09: 0000000000000000 [ 345.131756][T13648] R10: 0000200000000280 R11: 0000000000000000 R12: 0000000000000001 [ 345.131769][T13648] R13: 00007f61ee226128 R14: 00007f61ee226090 R15: 00007ffdf1117818 [ 345.131803][T13648] [ 345.132873][T13648] Huh VM_FAULT_OOM leaked out to the #PF handler. Retrying PF [ 346.163541][ C0] ip6_tunnel: ip6tnl2 xmit: Local address not yet configured! [ 346.319323][T13610] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 346.828680][T13674] netlink: 24 bytes leftover after parsing attributes in process `syz.4.2123'. [ 346.832615][T13676] netlink: 'syz.0.2122': attribute type 4 has an invalid length. [ 346.861501][T13674] netlink: 'syz.4.2123': attribute type 4 has an invalid length. [ 346.861526][T13674] netlink: 152 bytes leftover after parsing attributes in process `syz.4.2123'. [ 347.232968][T13688] netlink: 'syz.2.2128': attribute type 4 has an invalid length. [ 347.327620][T13691] netlink: 'syz.3.2130': attribute type 1 has an invalid length. [ 347.453984][T13691] 8021q: adding VLAN 0 to HW filter on device bond14 [ 347.478316][T13699] netlink: 72 bytes leftover after parsing attributes in process `syz.4.2133'. [ 348.580418][T13732] netlink: 'syz.1.2144': attribute type 4 has an invalid length. [ 348.760855][T13727] netlink: 8 bytes leftover after parsing attributes in process `syz.3.2141'. [ 349.391228][T13758] netlink: 92 bytes leftover after parsing attributes in process `syz.1.2153'. [ 350.165242][T13775] netlink: 'syz.0.2159': attribute type 4 has an invalid length. [ 350.259077][T13781] netlink: 'syz.2.2161': attribute type 30 has an invalid length. [ 350.396602][T13778] netlink: 276 bytes leftover after parsing attributes in process `syz.4.2160'. [ 350.467877][T13781] netlink: 'syz.2.2161': attribute type 30 has an invalid length. [ 350.718189][T13793] netlink: 4 bytes leftover after parsing attributes in process `syz.3.2165'. [ 350.739239][T13793] netlink: 4 bytes leftover after parsing attributes in process `syz.3.2165'. [ 350.764416][T13793] IPVS: set_ctl: invalid protocol: 43 172.20.20.187:20001 [ 350.767730][T13793] netlink: 4 bytes leftover after parsing attributes in process `syz.3.2165'. [ 350.807223][T13793] hsr_slave_1 (unregistering): left promiscuous mode [ 350.830044][T13800] FAULT_INJECTION: forcing a failure. [ 350.830044][T13800] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 350.830082][T13800] CPU: 1 UID: 0 PID: 13800 Comm: syz.0.2168 Not tainted syzkaller #0 PREEMPT(full) [ 350.830106][T13800] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 350.830121][T13800] Call Trace: [ 350.830130][T13800] [ 350.830139][T13800] dump_stack_lvl+0xe8/0x150 [ 350.830265][T13800] should_fail_ex+0x410/0x560 [ 350.830386][T13800] _copy_from_user+0x2d/0xb0 [ 350.830490][T13800] sctp_setsockopt+0x1c4/0x12c0 [ 350.830587][T13800] ? sock_common_setsockopt+0x36/0xc0 [ 350.830675][T13800] ? __pfx_sock_common_setsockopt+0x10/0x10 [ 350.830712][T13800] do_sock_setsockopt+0x17c/0x1b0 [ 350.830769][T13800] __x64_sys_setsockopt+0x13d/0x1b0 [ 350.830806][T13800] do_syscall_64+0x166/0x520 [ 350.830905][T13800] ? trace_irq_disable+0x3b/0x140 [ 350.830953][T13800] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 350.830991][T13800] ? clear_bhb_loop+0x70/0xc0 [ 350.831017][T13800] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 350.831039][T13800] RIP: 0033:0x7f61edf9e159 [ 350.831060][T13800] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 350.831079][T13800] RSP: 002b:00007f61eee36028 EFLAGS: 00000246 ORIG_RAX: 0000000000000036 [ 350.831103][T13800] RAX: ffffffffffffffda RBX: 00007f61ee226090 RCX: 00007f61edf9e159 [ 350.831119][T13800] RDX: 0000000000000075 RSI: 0000000000000084 RDI: 0000000000000003 [ 350.831133][T13800] RBP: 00007f61eee36090 R08: 0000000000000008 R09: 0000000000000000 [ 350.831146][T13800] R10: 00002000000001c0 R11: 0000000000000246 R12: 0000000000000001 [ 350.831160][T13800] R13: 00007f61ee226128 R14: 00007f61ee226090 R15: 00007ffdf1117818 [ 350.831193][T13800] [ 351.565948][T13819] netlink: 8 bytes leftover after parsing attributes in process `syz.3.2177'. [ 351.770028][T13821] 8021q: VLANs not supported on ip_vti0 [ 353.141711][T13870] gretap0: entered promiscuous mode [ 353.192712][T13870] 8021q: adding VLAN 0 to HW filter on device team0 [ 353.247938][T13874] netlink: 20 bytes leftover after parsing attributes in process `syz.1.2191'. [ 353.300412][T13878] netlink: 76 bytes leftover after parsing attributes in process `syz.0.2193'. [ 353.451530][T13870] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 353.451559][T13870] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 353.490321][T13870] veth0_vlan: left promiscuous mode [ 353.500268][T13870] veth0_vlan: entered promiscuous mode [ 353.509809][T13870] veth1_vlan: entered promiscuous mode [ 353.524360][T13870] veth1_macvtap: left promiscuous mode [ 353.526685][T13882] netlink: 24 bytes leftover after parsing attributes in process `syz.0.2194'. [ 353.526710][T13882] openvswitch: netlink: Flow key attr not present in new flow. [ 353.528214][T13870] veth0_macvtap: left promiscuous mode [ 353.531520][T13870] veth0_macvtap: entered promiscuous mode [ 353.570987][T13870] veth1_macvtap: entered promiscuous mode [ 353.586488][T13870] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 353.589637][T13870] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 353.592518][T13870] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 353.599025][T13870] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 353.609302][T13870] A link change request failed with some changes committed already. Interface wlan0 may have been left with an inconsistent configuration, please check. [ 353.619404][ T1451] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 353.675849][ T8009] bond11: (slave veth0_to_bond): link status definitely up, 10000 Mbps full duplex [ 353.676147][ T8009] bond11: (slave veth0_to_bond): making interface the new active one [ 353.717555][ T8009] bond11: active interface up! [ 353.785672][T13885] netlink: 67 bytes leftover after parsing attributes in process `syz.0.2195'. [ 353.892368][T13885] 8021q: adding VLAN 0 to HW filter on device bond2 [ 353.904861][T13890] netlink: 8 bytes leftover after parsing attributes in process `syz.0.2195'. [ 353.904902][T13890] netlink: 48 bytes leftover after parsing attributes in process `syz.0.2195'. [ 353.912653][T13885] 8021q: adding VLAN 0 to HW filter on device bond4 [ 353.944496][ T6555] ip6_tunnel: ip6gre1 xmit: Local address not yet configured! [ 354.018870][T13885] 8021q: adding VLAN 0 to HW filter on device bond7 [ 354.022196][T13885] 8021q: adding VLAN 0 to HW filter on device bond9 [ 354.054921][ T59] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 354.055895][ T59] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 354.250833][T13900] netlink: 16 bytes leftover after parsing attributes in process `syz.1.2198'. [ 354.266255][T13900] netlink: 10 bytes leftover after parsing attributes in process `syz.1.2198'. [ 354.317417][T13895] netlink: 8 bytes leftover after parsing attributes in process `syz.4.2199'. [ 354.362942][T13895] netlink: 'syz.4.2199': attribute type 8 has an invalid length. [ 354.371738][ T342] ip6_tunnel: ip6tnl1 xmit: Local address not yet configured! [ 354.438078][T13906] netlink: 24 bytes leftover after parsing attributes in process `syz.3.2200'. [ 354.453808][T13906] netlink: 'syz.3.2200': attribute type 4 has an invalid length. [ 354.453829][T13906] netlink: 152 bytes leftover after parsing attributes in process `syz.3.2200'. [ 354.462223][ T1451] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 354.817805][T13918] netlink: 144 bytes leftover after parsing attributes in process `syz.2.2201'. [ 354.967604][ T6556] ip6_tunnel: ip6gre1 xmit: Local address not yet configured! [ 355.178531][T13933] netlink: 12 bytes leftover after parsing attributes in process `syz.0.2208'. [ 355.439279][T13933] veth3: entered allmulticast mode [ 355.486069][T13933] bond10: (slave veth3): Enslaving as an active interface with an up link [ 356.109878][ C0] vcan0: j1939_tp_rxtimer: 0xffff88805693c400: rx timeout, send abort [ 356.312660][T13975] netlink: 'syz.0.2220': attribute type 10 has an invalid length. [ 356.321484][T13973] netlink: 'syz.0.2220': attribute type 10 has an invalid length. [ 356.368246][T13975] team0 (unregistering): Port device team_slave_0 removed [ 356.405712][T13975] team0 (unregistering): Port device team_slave_1 removed [ 356.456618][T13977] bridge0: entered allmulticast mode [ 356.610175][ C0] vcan0: j1939_tp_rxtimer: 0xffff88805693ec00: rx timeout, send abort [ 356.611442][ C0] vcan0: j1939_tp_rxtimer: 0xffff88805693c400: abort rx timeout. Force session deactivation [ 356.902152][T13992] Bluetooth: hci0: invalid length 0, exp 2 for type 21 [ 356.949877][T13995] xt_hashlimit: size too large, truncated to 1048576 [ 356.969293][T13994] mac80211_hwsim hwsim6 syzkaller0: left promiscuous mode [ 356.969326][T13994] mac80211_hwsim hwsim6 syzkaller0: left allmulticast mode [ 357.110234][ C0] vcan0: j1939_tp_rxtimer: 0xffff88805693ec00: abort rx timeout. Force session deactivation [ 357.552071][T14026] netlink: 'syz.4.2236': attribute type 3 has an invalid length. [ 358.481111][T14051] openvswitch: netlink: Missing key (keys=c0, expected=20080) [ 358.563738][ C1] ip6_tunnel: ip6tnl1 xmit: Local address not yet configured! [ 358.699467][T14054] ip_tables: iptables: counters copy to user failed while replacing table [ 358.867853][T14065] bridge_slave_0: vlans aren't supported yet for dev_uc|mc_add() [ 358.884453][T14064] __nla_validate_parse: 11 callbacks suppressed [ 358.884476][T14064] netlink: 24 bytes leftover after parsing attributes in process `syz.4.2248'. [ 358.920683][T14069] netlink: 'syz.4.2248': attribute type 4 has an invalid length. [ 358.920708][T14069] netlink: 152 bytes leftover after parsing attributes in process `syz.4.2248'. [ 359.441176][T14092] netlink: 8 bytes leftover after parsing attributes in process `syz.2.2257'. [ 359.626168][T14100] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 359.708630][T14107] netlink: 'syz.0.2262': attribute type 12 has an invalid length. [ 359.710784][T14107] netlink: 4 bytes leftover after parsing attributes in process `syz.0.2262'. [ 359.741820][T14108] netlink: 36 bytes leftover after parsing attributes in process `syz.3.2261'. [ 359.864140][T14111] netlink: 'syz.0.2263': attribute type 1 has an invalid length. [ 359.866750][T14111] netlink: 12 bytes leftover after parsing attributes in process `syz.0.2263'. [ 359.866789][T14111] netlink: 12 bytes leftover after parsing attributes in process `syz.0.2263'. [ 360.018862][T14117] netlink: 9 bytes leftover after parsing attributes in process `syz.3.2265'. [ 360.118945][T14121] netlink: 16 bytes leftover after parsing attributes in process `syz.3.2267'. [ 360.135268][T14121] tipc: Enabled bearer , priority 10 [ 360.349187][T14132] netlink: 28 bytes leftover after parsing attributes in process `syz.3.2271'. [ 360.575224][T14137] xt_policy: output policy not valid in PREROUTING and INPUT [ 360.883407][ C0] ip6_tunnel: ip6tnl2 xmit: Local address not yet configured! [ 361.175825][T14164] batman_adv: batadv0: Adding interface: veth0 [ 361.175846][T14164] batman_adv: batadv0: The MTU of interface veth0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 361.175880][T14164] batman_adv: batadv0: Interface activated: veth0 [ 361.212024][T14164] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 361.212109][T14164] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 361.222011][T14164] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 361.222082][T14164] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 361.252127][T14164] batman_adv: batadv0: Interface deactivated: gretap1 [ 361.252196][T14164] batman_adv: batadv0: Removing interface: gretap1 [ 361.287562][T14164] batman_adv: batadv0: Interface deactivated: veth0 [ 361.287590][T14164] batman_adv: batadv0: Removing interface: veth0 [ 362.531562][T14218] mac80211_hwsim hwsim6 syzkaller0: entered promiscuous mode [ 362.531599][T14218] mac80211_hwsim hwsim6 syzkaller0: entered allmulticast mode [ 362.660934][T14222] ipvlan0: entered promiscuous mode [ 362.972376][T14243] syzkaller0: entered promiscuous mode [ 362.972401][T14243] syzkaller0: entered allmulticast mode [ 363.031800][T14244] netlink: 'syz.1.2296': attribute type 11 has an invalid length. [ 363.134369][T14248] netlink: 'syz.4.2298': attribute type 1 has an invalid length. [ 363.179921][T14248] bond11: entered promiscuous mode [ 363.180475][T14248] 8021q: adding VLAN 0 to HW filter on device bond11 [ 363.222892][T14241] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 363.342045][T14248] veth5: entered allmulticast mode [ 363.394069][T14248] bond11: (slave veth5): making interface the new active one [ 363.394097][T14248] veth5: entered promiscuous mode [ 363.483367][T14248] bond11: (slave veth5): Enslaving as an active interface with an up link [ 363.978822][T14276] bridge0: port 1(syz_tun) entered disabled state [ 364.015160][T14284] __nla_validate_parse: 6 callbacks suppressed [ 364.015185][T14284] netlink: 24 bytes leftover after parsing attributes in process `syz.3.2308'. [ 364.015208][T14284] netlink: 24 bytes leftover after parsing attributes in process `syz.3.2308'. [ 364.018961][T14284] netlink: 8 bytes leftover after parsing attributes in process `syz.3.2308'. [ 364.018993][T14284] netlink: 8 bytes leftover after parsing attributes in process `syz.3.2308'. [ 364.035271][T14276] syz_tun (unregistering): left allmulticast mode [ 364.035350][T14276] syz_tun (unregistering): left promiscuous mode [ 364.035610][T14276] bridge0: port 1(syz_tun) entered disabled state [ 364.151645][T14287] netlink: 36 bytes leftover after parsing attributes in process `syz.1.2307'. [ 364.239758][T14291] netlink: 36 bytes leftover after parsing attributes in process `syz.1.2307'. [ 364.711650][T14320] netlink: 'syz.4.2315': attribute type 2 has an invalid length. [ 364.711675][T14320] netlink: 164 bytes leftover after parsing attributes in process `syz.4.2315'. [ 364.781766][T14322] netlink: 844 bytes leftover after parsing attributes in process `syz.2.2316'. [ 364.781797][T14322] netlink: 844 bytes leftover after parsing attributes in process `syz.2.2316'. [ 364.891655][T14322] nbd2: detected capacity change from 0 to 63 [ 364.902130][ T26] [ 364.904653][ T26] ====================================================== [ 364.911809][ T26] WARNING: possible circular locking dependency detected [ 364.920643][ T26] syzkaller #0 Not tainted [ 364.925087][ T26] ------------------------------------------------------ [ 364.933004][ T26] kworker/1:0H/26 is trying to acquire lock: [ 364.940241][ T26] ffff888076c13468 (&nsock->tx_lock){+.+.}-{4:4}, at: nbd_queue_rq+0x373/0xff0 [ 364.949479][ T26] [ 364.949479][ T26] but task is already holding lock: [ 364.957071][ T26] ffff88802717e178 (&cmd->lock){+.+.}-{4:4}, at: nbd_queue_rq+0xc1/0xff0 [ 364.965760][ T26] [ 364.965760][ T26] which lock already depends on the new lock. [ 364.965760][ T26] [ 364.976746][ T26] [ 364.976746][ T26] the existing dependency chain (in reverse order) is: [ 364.986595][ T26] [ 364.986595][ T26] -> #7 (&cmd->lock){+.+.}-{4:4}: [ 364.996643][ T26] __mutex_lock+0x19d/0x1550 [ 365.002329][ T26] nbd_queue_rq+0xc1/0xff0 [ 365.008440][ T26] blk_mq_dispatch_rq_list+0x499/0x1990 [ 365.010260][T14322] block nbd2: NBD_DISCONNECT [ 365.010582][T14322] block nbd2: Disconnected due to user request. [ 365.010625][T14322] block nbd2: shutting down sockets [ 365.039834][ T26] __blk_mq_sched_dispatch_requests+0xd36/0x1580 [ 365.066839][ T26] blk_mq_sched_dispatch_requests+0xd7/0x190 [ 365.079213][ T26] blk_mq_run_work_fn+0x16c/0x300 [ 365.086910][ T26] process_scheduled_works+0xc3d/0x1630 [ 365.099236][ T26] worker_thread+0xa47/0xfb0 [ 365.105458][ T26] kthread+0x38b/0x480 [ 365.110741][ T26] ret_from_fork+0x514/0xb70 [ 365.116099][ T26] ret_from_fork_asm+0x1a/0x30 [ 365.121445][ T26] [ 365.121445][ T26] -> #6 (set->srcu){.+.+}-{0:0}: [ 365.129330][ T26] __synchronize_srcu+0xc9/0x2f0 [ 365.135302][ T26] elevator_switch+0x1e8/0x7b0 [ 365.141197][ T26] elevator_change+0x2fa/0x480 [ 365.147261][ T26] elevator_set_default+0x375/0x440 [ 365.153301][ T26] blk_register_queue+0x3f3/0x4e0 [ 365.161075][ T26] __add_disk+0x6b8/0xdb0 [ 365.167203][ T26] add_disk_fwnode+0x100/0x3a0 [ 365.173083][ T26] nbd_dev_add+0x733/0xb60 [ 365.178249][ T26] nbd_init+0x168/0x1f0 [ 365.183439][ T26] do_one_initcall+0x250/0x870 [ 365.188955][ T26] do_initcall_level+0x10a/0x1a0 [ 365.194600][ T26] do_initcalls+0x59/0xa0 [ 365.199593][ T26] kernel_init_freeable+0x29d/0x3e0 [ 365.205381][ T26] kernel_init+0x22/0x1d0 [ 365.210557][ T26] ret_from_fork+0x514/0xb70 [ 365.215939][ T26] ret_from_fork_asm+0x1a/0x30 [ 365.222143][ T26] [ 365.222143][ T26] -> #5 (&q->elevator_lock){+.+.}-{4:4}: [ 365.230576][ T26] __mutex_lock+0x19d/0x1550 [ 365.237309][ T26] elevator_change+0x1af/0x480 [ 365.243343][ T26] elevator_set_none+0xb5/0x140 [ 365.248758][ T26] blk_mq_update_nr_hw_queues+0x5ef/0x19f0 [ 365.255178][ T26] nbd_start_device+0x189/0xb30 [ 365.260850][ T26] nbd_genl_connect+0x167d/0x1cd0 [ 365.267068][ T26] genl_family_rcv_msg_doit+0x233/0x340 [ 365.273804][ T26] genl_rcv_msg+0x614/0x7a0 [ 365.278945][ T26] netlink_rcv_skb+0x226/0x4a0 [ 365.284503][ T26] genl_rcv+0x28/0x40 [ 365.289286][ T26] netlink_unicast+0x7bd/0x940 [ 365.295938][ T26] netlink_sendmsg+0x813/0xb40 [ 365.301991][ T26] sock_sendmsg_nosec+0x13a/0x180 [ 365.308043][ T26] ____sys_sendmsg+0x54e/0x850 [ 365.316061][ T26] ___sys_sendmsg+0x2a5/0x360 [ 365.321396][ T26] __x64_sys_sendmsg+0x1b1/0x290 [ 365.327569][ T26] do_syscall_64+0x166/0x520 [ 365.332740][ T26] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 365.339276][ T26] [ 365.339276][ T26] -> #4 (&q->q_usage_counter(io)#49){++++}-{0:0}: [ 365.348739][ T26] blk_alloc_queue+0x544/0x690 [ 365.354095][ T26] __blk_mq_alloc_disk+0x194/0x390 [ 365.359782][ T26] nbd_dev_add+0x494/0xb60 [ 365.364738][ T26] nbd_init+0x168/0x1f0 [ 365.369450][ T26] do_one_initcall+0x250/0x870 [ 365.374961][ T26] do_initcall_level+0x10a/0x1a0 [ 365.380481][ T26] do_initcalls+0x59/0xa0 [ 365.385497][ T26] kernel_init_freeable+0x29d/0x3e0 [ 365.391361][ T26] kernel_init+0x22/0x1d0 [ 365.396429][ T26] ret_from_fork+0x514/0xb70 [ 365.401592][ T26] ret_from_fork_asm+0x1a/0x30 [ 365.406927][ T26] [ 365.406927][ T26] -> #3 (fs_reclaim){+.+.}-{0:0}: [ 365.414459][ T26] fs_reclaim_acquire+0x71/0x100 [ 365.420267][ T26] kmem_cache_alloc_node_noprof+0x5f/0x610 [ 365.426658][ T26] __alloc_skb+0x1db/0x7a0 [ 365.431680][ T26] tcp_stream_alloc_skb+0x3f/0x580 [ 365.437459][ T26] tcp_sendmsg_locked+0x138c/0x5400 [ 365.443299][ T26] tcp_sendmsg+0x2f/0x50 [ 365.448093][ T26] sock_sendmsg_nosec+0x10e/0x180 [ 365.453671][ T26] sock_write_iter+0x2de/0x3e0 [ 365.459190][ T26] vfs_write+0x612/0xba0 [ 365.464012][ T26] ksys_write+0x150/0x270 [ 365.468921][ T26] do_syscall_64+0x166/0x520 [ 365.474146][ T26] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 365.480602][ T26] [ 365.480602][ T26] -> #2 (sk_lock-AF_INET){+.+.}-{0:0}: [ 365.488291][ T26] lock_sock_nested+0x41/0x100 [ 365.493635][ T26] tls_sw_sendmsg+0x15f/0x2b50 [ 365.499043][ T26] sock_sendmsg_nosec+0x10e/0x180 [ 365.504625][ T26] ____sys_sendmsg+0x54e/0x850 [ 365.510128][ T26] ___sys_sendmsg+0x2a5/0x360 [ 365.515367][ T26] __x64_sys_sendmsg+0x1b1/0x290 [ 365.520885][ T26] do_syscall_64+0x166/0x520 [ 365.526041][ T26] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 365.532561][ T26] [ 365.532561][ T26] -> #1 (&ctx->tx_lock){+.+.}-{4:4}: [ 365.540052][ T26] __mutex_lock+0x19d/0x1550 [ 365.545306][ T26] tls_sw_sendmsg+0x13a/0x2b50 [ 365.550765][ T26] sock_sendmsg_nosec+0x90/0x180 [ 365.556378][ T26] sock_sendmsg+0x1ca/0x2d0 [ 365.561458][ T26] __sock_xmit+0x245/0x4f0 [ 365.566512][ T26] nbd_disconnect+0x3ad/0x560 [ 365.572177][ T26] nbd_disconnect_and_put+0x32/0x280 [ 365.578015][ T26] nbd_genl_disconnect+0x4af/0x590 [ 365.583793][ T26] genl_family_rcv_msg_doit+0x233/0x340 [ 365.590341][ T26] genl_rcv_msg+0x614/0x7a0 [ 365.595615][ T26] netlink_rcv_skb+0x226/0x4a0 [ 365.601296][ T26] genl_rcv+0x28/0x40 [ 365.605838][ T26] netlink_unicast+0x7bd/0x940 [ 365.611254][ T26] netlink_sendmsg+0x813/0xb40 [ 365.617188][ T26] sock_sendmsg_nosec+0x13a/0x180 [ 365.623029][ T26] ____sys_sendmsg+0x54e/0x850 [ 365.628647][ T26] ___sys_sendmsg+0x2a5/0x360 [ 365.633885][ T26] __x64_sys_sendmsg+0x1b1/0x290 [ 365.639855][ T26] do_syscall_64+0x166/0x520 [ 365.645231][ T26] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 365.652224][ T26] [ 365.652224][ T26] -> #0 (&nsock->tx_lock){+.+.}-{4:4}: [ 365.659905][ T26] __lock_acquire+0x164c/0x2de0 [ 365.665331][ T26] lock_acquire+0x115/0x350 [ 365.671032][ T26] __mutex_lock+0x19d/0x1550 [ 365.676539][ T26] nbd_queue_rq+0x373/0xff0 [ 365.681586][ T26] blk_mq_dispatch_rq_list+0x499/0x1990 [ 365.687852][ T26] __blk_mq_sched_dispatch_requests+0xd36/0x1580 [ 365.694725][ T26] blk_mq_sched_dispatch_requests+0xd7/0x190 [ 365.701245][ T26] blk_mq_run_work_fn+0x16c/0x300 [ 365.706826][ T26] process_scheduled_works+0xc3d/0x1630 [ 365.713358][ T26] worker_thread+0xa47/0xfb0 [ 365.718765][ T26] kthread+0x38b/0x480 [ 365.723393][ T26] ret_from_fork+0x514/0xb70 [ 365.728640][ T26] ret_from_fork_asm+0x1a/0x30 [ 365.734148][ T26] [ 365.734148][ T26] other info that might help us debug this: [ 365.734148][ T26] [ 365.745533][ T26] Chain exists of: [ 365.745533][ T26] &nsock->tx_lock --> set->srcu --> &cmd->lock [ 365.745533][ T26] [ 365.758350][ T26] Possible unsafe locking scenario: [ 365.758350][ T26] [ 365.766262][ T26] CPU0 CPU1 [ 365.771732][ T26] ---- ---- [ 365.777203][ T26] lock(&cmd->lock); [ 365.781201][ T26] lock(set->srcu); [ 365.787637][ T26] lock(&cmd->lock); [ 365.795383][ T26] lock(&nsock->tx_lock); [ 365.799832][ T26] [ 365.799832][ T26] *** DEADLOCK *** [ 365.799832][ T26] [ 365.807995][ T26] locks held by kworker/1:0H/26: 4, last CPU#1: [ 365.814248][ T26] #0: ffff88801eaf0540 ((wq_completion)kblockd){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 [ 365.825343][ T26] #1: ffffc90000a0fc40 ((work_completion)(&(&hctx->run_work)->work)){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 [ 365.838616][ T26] #2: ffff8880269bca18 (set->srcu){.+.+}-{0:0}, at: blk_mq_run_work_fn+0x144/0x300 [ 365.848060][ T26] #3: ffff88802717e178 (&cmd->lock){+.+.}-{4:4}, at: nbd_queue_rq+0xc1/0xff0 [ 365.856991][ T26] [ 365.856991][ T26] stack backtrace: [ 365.862920][ T26] CPU: 1 UID: 0 PID: 26 Comm: kworker/1:0H Not tainted syzkaller #0 PREEMPT(full) [ 365.872228][ T26] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 365.882317][ T26] Workqueue: kblockd blk_mq_run_work_fn [ 365.887944][ T26] Call Trace: [ 365.891278][ T26] [ 365.894239][ T26] dump_stack_lvl+0xe8/0x150 [ 365.898875][ T26] print_circular_bug+0x2e2/0x300 [ 365.903940][ T26] check_noncircular+0x12f/0x150 [ 365.908922][ T26] __lock_acquire+0x164c/0x2de0 [ 365.913821][ T26] lock_acquire+0x115/0x350 [ 365.918345][ T26] ? nbd_queue_rq+0x373/0xff0 [ 365.923059][ T26] __mutex_lock+0x19d/0x1550 [ 365.927678][ T26] ? nbd_queue_rq+0x373/0xff0 [ 365.932397][ T26] ? ret_from_fork_asm+0x1a/0x30 [ 365.937380][ T26] ? unwind_next_frame+0x8f/0x2550 [ 365.942552][ T26] ? nbd_queue_rq+0x373/0xff0 [ 365.947262][ T26] ? __pfx___mutex_lock+0x10/0x10 [ 365.952313][ T26] ? ret_from_fork_asm+0x1a/0x30 [ 365.957281][ T26] ? stack_trace_save+0xa9/0x100 [ 365.962236][ T26] ? __pfx_stack_trace_save+0x10/0x10 [ 365.967623][ T26] nbd_queue_rq+0x373/0xff0 [ 365.972145][ T26] ? __lock_acquire+0x1511/0x2de0 [ 365.977192][ T26] ? __pfx_nbd_queue_rq+0x10/0x10 [ 365.982239][ T26] blk_mq_dispatch_rq_list+0x499/0x1990 [ 365.987815][ T26] ? sbitmap_get+0x229/0x390 [ 365.992521][ T26] ? __pfx_blk_mq_dispatch_rq_list+0x10/0x10 [ 365.998528][ T26] ? __blk_mq_alloc_driver_tag+0x2e7/0x6e0 [ 366.004363][ T26] __blk_mq_sched_dispatch_requests+0xd36/0x1580 [ 366.010741][ T26] ? __pfx___blk_mq_sched_dispatch_requests+0x10/0x10 [ 366.017545][ T26] ? lock_acquire+0x115/0x350 [ 366.022245][ T26] ? process_scheduled_works+0x97a/0x1630 [ 366.027994][ T26] blk_mq_sched_dispatch_requests+0xd7/0x190 [ 366.034354][ T26] ? blk_mq_run_work_fn+0x144/0x300 [ 366.039582][ T26] blk_mq_run_work_fn+0x16c/0x300 [ 366.044640][ T26] ? process_scheduled_works+0x97a/0x1630 [ 366.050392][ T26] process_scheduled_works+0xc3d/0x1630 [ 366.056034][ T26] ? __pfx_process_scheduled_works+0x10/0x10 [ 366.062058][ T26] ? assign_work+0x3cf/0x5d0 [ 366.066704][ T26] worker_thread+0xa47/0xfb0 [ 366.071731][ T26] kthread+0x38b/0x480 [ 366.075841][ T26] ? __pfx_worker_thread+0x10/0x10 [ 366.081093][ T26] ? __pfx_kthread+0x10/0x10 [ 366.086101][ T26] ret_from_fork+0x514/0xb70 [ 366.091009][ T26] ? __pfx_ret_from_fork+0x10/0x10 [ 366.096433][ T26] ? __switch_to+0xc89/0x1420 [ 366.101637][ T26] ? __pfx_kthread+0x10/0x10 [ 366.106557][ T26] ret_from_fork_asm+0x1a/0x30 [ 366.111466][ T26] [ 366.123256][ T26] I/O error, dev nbd2, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 366.123347][ T26] Buffer I/O error on dev nbd2, logical block 0, async page read [ 366.189360][T14331] netlink: 'syz.2.2316': attribute type 1 has an invalid length. [ 366.225312][ T1663] I/O error, dev nbd2, sector 2 op 0x0:(READ) flags 0x800000 phys_seg 3 prio class 2 [ 366.225353][ T1663] Buffer I/O error on dev nbd2, logical block 1, async page read [ 366.225373][ T1663] Buffer I/O error on dev nbd2, logical block 2, async page read [ 366.225390][ T1663] Buffer I/O error on dev nbd2, logical block 3, async page read [ 366.225558][ T1663] I/O error, dev nbd2, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 4 prio class 2 [ 366.225587][ T1663] Buffer I/O error on dev nbd2, logical block 0, async page read [ 366.225602][ T1663] Buffer I/O error on dev nbd2, logical block 1, async page read [ 366.225619][ T1663] Buffer I/O error on dev nbd2, logical block 2, async page read [ 366.225633][ T1663] Buffer I/O error on dev nbd2, logical block 3, async page read [ 366.225741][ T1663] I/O error, dev nbd2, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 4 prio class 2 [ 366.225768][ T1663] Buffer I/O error on dev nbd2, logical block 0, async page read [ 366.225784][ T1663] Buffer I/O error on dev nbd2, logical block 1, async page read [ 366.225917][ T1663] I/O error, dev nbd2, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 4 prio class 2 [ 366.226046][ T1663] I/O error, dev nbd2, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 4 prio class 2 [ 366.226192][ T1663] I/O error, dev nbd2, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 4 prio class 2 [ 366.226413][ T1663] I/O error, dev nbd2, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 4 prio class 2 [ 366.226544][ T1663] I/O error, dev nbd2, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 4 prio class 2 [ 366.226608][ T5833] ldm_validate_partition_table(): Disk read failed. [ 366.226705][ T1663] I/O error, dev nbd2, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 4 prio class 2 [ 366.227081][ T5833] Dev nbd2: unable to read RDB block 0 [ 366.227746][ T5833] nbd2: unable to read partition table [ 366.231049][ T5833] ldm_validate_partition_table(): Disk read failed. [ 366.231641][ T5833] Dev nbd2: unable to read RDB block 0 [ 366.232299][ T5833] nbd2: unable to read partition table [ 366.542556][T14331] 8021q: adding VLAN 0 to HW filter on device bond13 [ 366.581960][T14328] A link change request failed with some changes committed already. Interface wlan0 may have been left with an inconsistent configuration, please check. [ 366.655260][T14322] bond13: (slave veth5): Enslaving as an active interface with a down link [ 367.923922][ C1] ip6_tunnel: ip6tnl1 xmit: Local address not yet configured! [ 368.563222][ C0] ip6_tunnel: ip6tnl2 xmit: Local address not yet configured!