last executing test programs:

42.941399643s ago: executing program 0 (id=5871):
r0 = socket$nl_route(0x10, 0x3, 0x0)
r1 = socket$nl_generic(0x10, 0x3, 0x10)
r2 = syz_genetlink_get_family_id$nl80211(&(0x7f00000000c0), 0xffffffffffffffff)
sendmsg$NL80211_CMD_ASSOCIATE(r1, &(0x7f00000001c0)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x20}, 0xc, &(0x7f0000000180)={&(0x7f0000000100)={0x34, r2, 0x4, 0x70bd2b, 0x25dfdbff, {{}, {@val={0x8}, @val={0xc, 0x99, {0x6, 0x2d}}}}, [@NL80211_ATTR_MAC={0xa, 0x6, @from_mac}]}, 0x34}}, 0x20000011)
r3 = socket(0x10, 0x803, 0x0)
sendmsg$nl_route(r3, &(0x7f0000000380)={0x0, 0x4076cbba9945d516, &(0x7f0000000340)={0x0, 0x14}}, 0x0)
getsockname$packet(r3, &(0x7f0000000140)={0x11, 0x0, <r4=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x28a)
r5 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route(r5, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000500)={&(0x7f0000000240)=@newlink={0x38, 0x10, 0x439, 0x0, 0x0, {0x0, 0x0, 0x0, r4, 0x9801}, [@IFLA_LINKINFO={0x18, 0x12, 0x0, 0x1, @gre={{0x8}, {0xc, 0x2, 0x0, 0x1, [@IFLA_GRE_LINK={0x8, 0x1, r4}]}}}]}, 0x38}}, 0x0)
r6 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendmsg$NFT_BATCH(r6, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000340)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a300000001f0900030073797a320000000014000000110001"], 0x7c}}, 0x0)
sendmsg$NFT_BATCH(r6, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000003c0)={{0x14}, [@NFT_MSG_NEWRULE={0x6c, 0x6, 0xa, 0x401, 0x0, 0x0, {0x2}, [@NFTA_RULE_EXPRESSIONS={0x40, 0x4, 0x0, 0x1, [{0x3c, 0x1, 0x0, 0x1, @immediate={{0xe}, @val={0x28, 0x2, 0x0, 0x1, [@NFTA_IMMEDIATE_DREG={0x8}, @NFTA_IMMEDIATE_DATA={0x1c, 0x2, 0x0, 0x1, [@NFTA_DATA_VERDICT={0x18, 0x2, 0x0, 0x1, [@NFTA_VERDICT_CHAIN={0x9, 0x2, 'syz2\x00'}, @NFTA_VERDICT_CODE={0x8, 0x1, 0x0, 0x1, 0xfffffffffffffffd}]}]}]}}}]}, @NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_RULE_CHAIN={0x9, 0x2, 'syz2\x00'}]}], {0x14}}, 0x94}}, 0x0)
sendmsg$NFT_BATCH(r6, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a2c000000050a0900000000000000001d020000000900010073797a30000000000900030073797a32"], 0x54}}, 0x0)
sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000500)={&(0x7f0000000000)=@newlink={0x34, 0x10, 0x439, 0x0, 0x0, {0x0, 0x0, 0x0, r4, 0x0, 0x4100}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @gre={{0x8}, {0x8, 0x2, 0x0, 0x1, [@IFLA_GRE_COLLECT_METADATA={0x4}]}}}]}, 0x34}}, 0x0)

42.940919403s ago: executing program 0 (id=5872):
bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000380)={0x0, 0xffffffffffffffff, 0x0, 0x1c, &(0x7f0000000000)='/proc/1/\x00\x82q\xee\xe5\xa0\xbd\xc2\x98#YP\xee\x9c2G\xf0\x81x\x97'}, 0x30)
r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0)
openat$cgroup_ro(r0, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0)
r1 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route(r1, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000000)=@newlink={0x40, 0x10, 0x403, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @bond={{0x9}, {0x22}}}, @IFLA_ADDRESS={0x6, 0x1, @dev}]}, 0x40}}, 0x0)
bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000085000000070000001801000020756c2500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b70300000000a5df850000002d00000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)
pipe(&(0x7f00000000c0)={<r2=>0xffffffffffffffff, <r3=>0xffffffffffffffff})
close(0x3)
write$cgroup_subtree(r3, 0x0, 0xd)
r4 = bpf$PROG_LOAD(0x5, &(0x7f0000000a40)={0x18, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)
setsockopt$inet_tcp_TCP_CONGESTION(r2, 0x6, 0xd, &(0x7f0000000040)='nv\x00', 0x3)
bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000540)={&(0x7f0000000140)='sched_switch\x00', r4}, 0x10)
bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000000c0)={0x15, 0x3, &(0x7f0000000080)=ANY=[@ANYBLOB="dbaa00005100000071101a000000000095"], &(0x7f0000000480)='syzkaller\x00', 0x5}, 0x94)
r5 = socket$nl_netfilter(0x10, 0x3, 0xc)
r6 = socket$inet6(0xa, 0x800000000000002, 0x0)
setsockopt$SO_TIMESTAMPING(r6, 0x1, 0x41, &(0x7f0000000200)=0x632a, 0x4)
setsockopt$inet6_int(r6, 0x29, 0x31, &(0x7f0000000000)=0xb2, 0x4)
sendmmsg$inet6(r6, &(0x7f0000000e00)=[{{&(0x7f0000000080)={0xa, 0x4e23, 0x0, @empty}, 0x1c, 0x0}}], 0x1, 0x0)
recvmmsg(r6, &(0x7f0000003880)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f0000000440)=""/29, 0x1d}}], 0x1, 0x12141, 0x0)
setsockopt$netlink_NETLINK_DROP_MEMBERSHIP(r5, 0x10e, 0x2, &(0x7f00000001c0)=0x4, 0x4)
r7 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000002000)={0x18, 0xb, &(0x7f0000000640)=ANY=[@ANYBLOB="18000000000000000000000000000000180100002020000000000000000000007b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000000600000095"], &(0x7f00000004c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2}, 0x94)
bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={&(0x7f00000002c0)='contention_begin\x00', r7, 0x0, 0xd}, 0x18)
r8 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$nl_generic(r8, &(0x7f0000001040)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000300)=ANY=[@ANYBLOB="140000003940010324bd7002fadbdf25019ed5e4d31af9491404cb5bcaaefffa00"], 0x14}}, 0x4000000)
sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000006c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000200)=ANY=[@ANYBLOB="4400000010000d0400"/20, @ANYRES32=0x0, @ANYBLOB="00a5020000002000240012800b00010062726964026d84016500020000000800040000000080"], 0x44}}, 0x0)

42.860338591s ago: executing program 0 (id=5875):
r0 = syz_init_net_socket$netrom(0x6, 0x5, 0x0)
r1 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendmsg$NFT_BATCH(r1, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000003c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0)
sendmsg$NFT_BATCH(r1, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000000c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a6c000000060a090400000000000000000200000040000480100001800c0001006e6f747261636b002c0001800e000100696d6d656469617465000000180002800c00028005000100c402000008000140000000080900010073797a30000000000900020073797a320000000014000000110001"], 0x94}}, 0x0)
close(r1)
connect$netrom(r0, &(0x7f0000000380)={{0x6, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x0}, 0xa}, [@rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @default, @bcast, @null, @bcast, @null, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}]}, 0x48)
socket$kcm(0x10, 0x2, 0x0)
r2 = socket$inet6_tcp(0xa, 0x1, 0x0)
setsockopt$sock_int(r2, 0x1, 0xf, &(0x7f0000000180)=0x800001, 0x4)
bind$inet6(r2, &(0x7f0000000140)={0xa, 0x4e22, 0x0, @empty}, 0x1c)
listen(0xffffffffffffffff, 0x44)
r3 = socket$inet6_tcp(0xa, 0x1, 0x0)
setsockopt$sock_int(r3, 0x1, 0xf, &(0x7f0000000180)=0x800001, 0x4)
bind$inet6(r3, &(0x7f00000001c0)={0xa, 0x4e22, 0x0, @dev={0xfe, 0x80, '\x00', 0x3}}, 0x1c)
listen(r3, 0x0)
shutdown(r2, 0x1)
r4 = socket$nl_generic(0x10, 0x3, 0x10)
ioctl$sock_SIOCGIFINDEX_80211(r4, 0x8933, &(0x7f0000000000)={'wlan1\x00', <r5=>0x0})
r6 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000100), 0xffffffffffffffff)
sendmsg$NL80211_CMD_FRAME(r4, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000fc0)={&(0x7f0000000440)=ANY=[@ANYBLOB='<\x00\x00\x00', @ANYRES16=r6, @ANYBLOB="010000080000000000000200000008000300", @ANYRES32=r5, @ANYBLOB="08009f0007000000080026006c09000005001901040000000500180104000000508d2526c91f256af79e58e83dc9f84a627bdd76e5faab8e66a31ccf70f064ef6f3c11ac23352c50c73c7eecf62d5a9693d31e54c25324580a8a59b452df8abef8b357582c87e75276c360e2a366a8ac25704be8da613d4e36d662718a89b3eec66bb573c020c7e5423bb8a40868057e6259a1f1ff97e3ed22d0e6609667cd17a5f10c56f95b88bc30be4e9f94ebbddbfb309b784eab5faa3d127691a86674191aa696d9870883a44bfdfcfd0f82"], 0x3c}}, 0x0)
r7 = socket$pptp(0x18, 0x1, 0x2)
r8 = socket$pptp(0x18, 0x1, 0x2)
bind$pptp(r8, &(0x7f0000000000)={0x18, 0x2, {0x0, @dev={0xac, 0x14, 0x14, 0x2f}}}, 0x1e)
bind$pptp(r7, &(0x7f0000000000)={0x18, 0x2, {0xfffc, @loopback}}, 0x1e)
connect$pptp(r7, &(0x7f00000000c0)={0x18, 0x2, {0x1, @empty}}, 0x1e)
r9 = socket(0x10, 0x3, 0x0)
ioctl$sock_SIOCGIFINDEX(r9, 0x8933, &(0x7f0000000240)={'lo\x00', <r10=>0x0})
sendmsg$nl_route_sched(r9, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000280)=@newqdisc={0x3c, 0x24, 0xd0f, 0x0, 0x4, {0x60, 0x0, 0x0, r10, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_cake={{0x9}, {0xc, 0x2, [@TCA_CAKE_SPLIT_GSO={0x8}]}}]}, 0x3c}, 0x1, 0x0, 0x0, 0x80}, 0x0)
r11 = socket$packet(0x11, 0x3, 0x300)
setsockopt$packet_int(r11, 0x107, 0xf, &(0x7f0000000100)=0x9, 0x4)

42.720947238s ago: executing program 2 (id=5877):
r0 = socket$packet(0x11, 0x3, 0x300)
setsockopt$packet_fanout(r0, 0x107, 0x12, &(0x7f0000000000)={0x0, 0x8000}, 0x4)
r1 = socket$packet(0x11, 0x3, 0x300)
setsockopt$packet_int(r1, 0x107, 0xf, &(0x7f0000000000)=0x9, 0x4)
ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000300)={'wg0\x00', <r2=>0x0})
r3 = syz_init_net_socket$ax25(0x3, 0x3, 0xcd)
getsockopt$ax25_int(r3, 0x101, 0x8, &(0x7f0000000140), &(0x7f0000000180)=0x4)
r4 = socket$inet6_sctp(0xa, 0x1, 0x84)
ioctl$sock_SIOCBRADDBR(r1, 0x89a0, &(0x7f0000000080)='erspan0\x00')
sendfile(r1, r4, &(0x7f0000000040), 0x6)
sendto$packet(r1, &(0x7f0000000180)="0b03feff4f00071202004788aa96a13bb1200011000088ca1a00", 0x1fffc, 0x0, &(0x7f0000000140)={0x11, 0x0, r2}, 0x14)

42.720290403s ago: executing program 2 (id=5878):
r0 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000004c0)=@ipv4_newrule={0x24, 0x1e, 0x1, 0x0, 0x0, {0x2, 0x0, 0x0, 0x0, 0x1}, [@FRA_DST={0x8, 0x1, @empty}]}, 0x24}, 0x1, 0x0, 0x0, 0x2}, 0x0)

42.652024535s ago: executing program 2 (id=5879):
r0 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000180)=ANY=[@ANYBLOB="4400000010004b0400000000000000007a000000", @ANYRES32=0x0, @ANYRES32=0x0], 0x44}, 0x1, 0x0, 0x0, 0x8000}, 0x44000000) (async)
r1 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="0500000004000000ff0f000007"], 0x48)
bpf$PROG_LOAD(0x5, &(0x7f0000000280)={0x20, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r1, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000000000000b70400000000000085000000c300000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @netfilter, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0}, 0x94)
bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000340)={{r1}, &(0x7f0000000080), &(0x7f00000000c0)}, 0x20) (async)
r2 = socket$inet6(0xa, 0x2, 0x0)
r3 = bpf$MAP_CREATE(0x0, &(0x7f00000004c0)=@base={0x2, 0x4, 0x4, 0x8}, 0x48)
r4 = bpf$MAP_CREATE(0x0, &(0x7f0000000040)=@base={0xd, 0x5, 0x4, 0x7, 0x0, r3}, 0x50)
bpf$MAP_UPDATE_BATCH(0x1a, &(0x7f0000000300)={0x0, 0x0, 0x0, 0x0, 0x316, r4, 0x4}, 0x38) (async)
sendmmsg$inet6(r2, &(0x7f0000003940), 0x0, 0x804) (async)
r5 = bpf$PROG_LOAD(0x5, &(0x7f0000000800)={0x16, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x16, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)
bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000000)={r5, 0x2000000, 0x11, 0x0, &(0x7f0000000200)="63eced8e46dc3f0adf33c9f7b986", 0x0, 0x8001, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50)
bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000480)={&(0x7f0000001580)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0x18, 0x18, 0x5, [@struct={0x1, 0x1, 0x0, 0x4, 0x0, 0x0, [{0x2, 0x3, 0xfffdffff}]}]}, {0x0, [0x5f, 0x2e, 0x5f]}}, 0x0, 0x35, 0x0, 0x1, 0x9}, 0x28) (async)
setsockopt$ARPT_SO_SET_ADD_COUNTERS(0xffffffffffffffff, 0x0, 0x61, &(0x7f00000000c0)={'filter\x00', 0x4}, 0x68)

42.64655307s ago: executing program 2 (id=5880):
r0 = socket$nl_route(0x10, 0x3, 0x0)
r1 = socket$nl_route(0x10, 0x3, 0x0)
r2 = socket$kcm(0x10, 0x2, 0x10)
sendmsg$kcm(r2, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000480)=[{&(0x7f0000000000)="1400000010003507d25a806f8c6394f90324fc60", 0x14}], 0x1}, 0x0)
r3 = socket$nl_generic(0x10, 0x3, 0x10)
ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, 0x0)
syz_genetlink_get_family_id$nl80211(&(0x7f0000000000), r3)
syz_init_net_socket$nl_generic(0x10, 0x3, 0x10)
syz_genetlink_get_family_id$nbd(&(0x7f0000000180), 0xffffffffffffffff)
r4 = socket$vsock_stream(0x28, 0x1, 0x0)
bind$vsock_stream(r4, &(0x7f0000000040)={0x28, 0x0, 0x2710, @local}, 0x10)
listen(r4, 0x0)
r5 = accept(r4, 0x0, 0x0)
r6 = bpf$MAP_CREATE(0x0, &(0x7f0000000580)=ANY=[@ANYBLOB="120000000400000004000000a4"], 0x50)
bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000140)={r6, &(0x7f0000000300), &(0x7f0000000100)=@tcp6=r5}, 0x20)
sendmsg$nl_route(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000004c0)=@ipv4_newrule={0x24, 0x1e, 0x1, 0x0, 0x0, {0x2, 0x0, 0x0, 0x0, 0x1}, [@FRA_DST={0x8, 0x1, @empty}]}, 0x24}, 0x1, 0x0, 0x0, 0x2}, 0x0)
r7 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10)
syz_genetlink_get_family_id$netlbl_cipso(&(0x7f0000000bc0), r7)
r8 = syz_init_net_socket$bt_l2cap(0x1f, 0x3, 0x0)
setsockopt$bt_BT_RCVMTU(r8, 0x112, 0xd, 0x0, 0x80ff)
r9 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$nl_generic(r9, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000140)={0x2c, 0x3e, 0x107, 0x0, 0x0, {0x4, 0x7c}, [@nested={0x4, 0x12}, @nested={0x14, 0x1, 0x0, 0x1, [@typed={0x8, 0x3, 0x0, 0x0, @uid=0xee00}, @typed={0x8, 0x10, 0x0, 0x0, @ipv4=@multicast1}]}]}, 0x2c}}, 0x0)
r10 = syz_genetlink_get_family_id$nfc(&(0x7f00000000c0), r7)
ioctl$IOCTL_GET_NCIDEV_IDX(0xffffffffffffffff, 0x0, &(0x7f0000000200)=<r11=>0x0)
sendmsg$NFC_CMD_ACTIVATE_TARGET(r7, &(0x7f00000003c0)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x4}, 0xc, &(0x7f0000000380)={&(0x7f0000000240)={0x3c, r10, 0x800, 0x70bd28, 0x25dfdbfd, {}, [@NFC_ATTR_TARGET_INDEX={0x8, 0x4, 0x1}, @NFC_ATTR_DEVICE_INDEX={0x8, 0x1, r11}, @NFC_ATTR_PROTOCOLS={0x8, 0x3, 0x6}, @NFC_ATTR_TARGET_INDEX={0x8, 0x4, 0x1}, @NFC_ATTR_DEVICE_INDEX={0x8}]}, 0x3c}, 0x1, 0x0, 0x0, 0x20000000}, 0x4000040)
r12 = socket(0x200000000000011, 0x2, 0x0)
sendto$rxrpc(r12, 0x0, 0x0, 0x20000880, 0x0, 0x0)
ioctl$SIOCAX25DELFWD(r12, 0x89eb, &(0x7f0000000080)={@rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @bcast})
syz_genetlink_get_family_id$batadv(&(0x7f00000002c0), r12)
sendmsg$NLBL_CIPSOV4_C_ADD(r7, &(0x7f0000000580)={0x0, 0x0, 0x0}, 0x0)

41.990583778s ago: executing program 0 (id=5882):
socket$netlink(0x10, 0x3, 0x0)
socket$nl_route(0x10, 0x3, 0x0)
socket$inet6_sctp(0xa, 0x1, 0x84)
openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='memory.events\x00', 0x275a, 0x0)
socket$packet(0x11, 0xa, 0x300)
r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000200)=@base={0x1b, 0x0, 0x0, 0x8000, 0x0, 0xffffffffffffffff, 0x8af}, 0x50)
r1 = socket(0x10, 0x3, 0x0)
setsockopt$netlink_NETLINK_TX_RING(r1, 0x10e, 0xc, &(0x7f0000000040)={0x10000802, 0x80, 0x0, 0x40000}, 0x10)
sendmsg$nl_generic(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000003c0)=ANY=[@ANYBLOB="2800000052000100040000f4000000001c0000001400", @ANYRES16=r0], 0x28}, 0x1, 0x0, 0x0, 0x10040000}, 0x0)

41.94149814s ago: executing program 0 (id=5883):
getsockopt$inet6_IPV6_FLOWLABEL_MGR(0xffffffffffffffff, 0x29, 0x20, &(0x7f0000000100)={@remote, 0x0, 0x2}, 0x0)
bpf$ENABLE_STATS(0x20, 0x0, 0x0)
r0 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000040), 0x161042, 0x0)
ioctl$PPPIOCNEWUNIT(r0, 0xc004743e, &(0x7f0000000000)=0x3)
ioctl$PPPIOCSPASS(r0, 0x40107447, &(0x7f0000000080)={0x2, &(0x7f0000000100)=[{0x50, 0xff, 0x0, 0xffeffffd}, {0x6, 0x60, 0x0, 0x8}]})
write$ppp(r0, &(0x7f0000000300)="5af9", 0x2)
socket$alg(0x26, 0x5, 0x0)
sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={0x0, 0x7c}}, 0x0)
syz_init_net_socket$802154_raw(0x24, 0x3, 0x0)
r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000640)=ANY=[@ANYBLOB="160000000000000004000000ff"], 0x48)
bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000a40)={0x3, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r1, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000005900000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0xd1eae8f721276f1}, 0x94)
r2 = bpf$PROG_LOAD(0x5, &(0x7f0000000880)={0x6, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f00000002c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @xdp, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)
bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000000)={r2, 0x2000002, 0xe, 0x0, &(0x7f0000000200)="df12c9f7b9a60000000000000000", 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x50)
r3 = syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x3)
r4 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2)
ioctl$sock_ifreq(r4, 0x8910, &(0x7f0000000000)={'veth0_vlan\x00', @ifru_ivalue=0x4})
ioctl$sock_netdev_private(r4, 0x89f0, &(0x7f0000000000))
sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000040)=ANY=[@ANYBLOB="200000001000010400000000fedbdf2500000000", @ANYRES32=0x0, @ANYBLOB="0000000000ffff00"], 0x20}}, 0x0)
ioctl$FS_IOC_GETFSLABEL(r3, 0x400452c8, &(0x7f0000000100))
socket$igmp6(0xa, 0x3, 0x2)
r5 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000240)={0x2, 0x4, 0x8, 0x1, 0x80, 0xffffffffffffffff, 0x0, '\x00', 0x0, 0x0}, 0x48)
r6 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f0000000580)={0x1b, 0x0, 0x0, 0x40000, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0}, 0x50)
bpf$PROG_LOAD(0x5, &(0x7f0000000840)={0x15, 0x1c, &(0x7f0000000680)=ANY=[@ANYBLOB="18080000000000000d200000000000000000000070c0c06a5a4cd3fa14e60849c26edd3f918225c8670eb6486546b5dec225829d0bff3cf5c1b7a4aaa3da2abcac00cc52b69a3712c15aff176635aed78bb50815411e8db15a4575f0d50aa179de7e5d6b0913ea515dbbe5395f641fb371d9c33ac5377158132703cda9b52365014fc40ea770d82c740b56fffd1f6dfd434f4ccb66ab0a2561e4b1c00216b127a86bc923f53c8999c6f5d4b45998a141d2e452ab352ebe59deaaefac0f266186a946a41a2cb8eb3056377b77d8ecf55102fd998392f733c049", @ANYRES32=r6, @ANYBLOB="0000000000000000b702000014000000b7030000000000008500000005000000bca90000000000003509010000000000950000000000000075090200020000007b9a00fe00000000b509000002000000c39a04fee1000000bf8700000000000007080000f8ffffffbfa400000000000007040000f0ffffffb70200000800000018290000", @ANYRES32=r5, @ANYBLOB="0000000000000000b7050000080000004608f0ff76000000bf9800000000000056080000020000008500000007000000b7000000000000009500000000000000"], &(0x7f0000000980)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x4, '\x00', 0x0, @sk_reuseport, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)
r7 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$nl_generic(r7, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000001700)=ANY=[@ANYBLOB="1800000024000103000000000000000001008c000400ae"], 0x18}, 0x1, 0x0, 0x0, 0x8001}, 0x4000)
recvmmsg(r7, &(0x7f0000004b40)=[{{0x0, 0x0, &(0x7f00000000c0)=[{&(0x7f0000001740)=""/4071, 0xfe7}, {&(0x7f00000012c0)=""/165, 0xa5}, {&(0x7f0000001380)=""/127, 0x7f}, {&(0x7f0000001440)=""/131, 0x89}, {&(0x7f0000000000)=""/48, 0x30}], 0x5}, 0x4}], 0x45, 0x12000, 0x0)
openat$tun(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0)
r8 = syz_init_net_socket$x25(0x9, 0x5, 0x0)
socket$inet_mptcp(0x2, 0x1, 0x106)
ioctl$SIOCX25CALLACCPTAPPRV(r8, 0x89e8)

41.762027521s ago: executing program 2 (id=5884):
r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40a01, 0x0)
ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201})
r1 = socket$nl_route(0x10, 0x3, 0x0)
mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.cpu/syz1\x00', 0x1ff)
openat$cgroup_procs(0xffffffffffffffff, &(0x7f00000002c0)='cgroup.procs\x00', 0x2, 0x0)
sendmsg$IPCTNL_MSG_CT_GET(0xffffffffffffffff, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000000c0)={0x3c, 0x0, 0x1, 0x505, 0x0, 0x0, {0xa, 0x0, 0x3}, [@CTA_LABELS={0xc, 0x16, 0x1, 0x0, [0x0, 0x8]}, @CTA_SEQ_ADJ_REPLY={0x14, 0x10, 0x0, 0x1, [@CTA_SEQADJ_OFFSET_AFTER={0x8, 0x3, 0x1, 0x0, 0xf}, @CTA_SEQADJ_OFFSET_AFTER={0x8, 0x3, 0x1, 0x0, 0xe5a}]}, @CTA_STATUS_MASK={0x8, 0x1a, 0x1, 0x0, 0xa7}]}, 0x3c}}, 0x0)
socket$nl_netfilter(0x10, 0x3, 0xc)
sendmsg$nl_route(r1, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=@ipv6_getaddr={0x2c, 0x15, 0x1, 0x0, 0x0, {}, [@IFA_LOCAL={0x14, 0x2, @empty}]}, 0x2c}}, 0x0)
socket$kcm(0x10, 0x3, 0x10)
r2 = socket$kcm(0x2, 0xa, 0x2)
ioctl$SIOCSIFHWADDR(r2, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x2}})
write$tun(r0, &(0x7f00000000c0)=ANY=[@ANYBLOB="001c86dd0700100000004000000060ec97000fc83c00fe8000000000000000000000000000aaff02000000000000000000002000000106"], 0xffe)

41.761548167s ago: executing program 0 (id=5885):
r0 = socket$nl_route(0x10, 0x3, 0x0)
getsockname$packet(0xffffffffffffffff, &(0x7f0000000000)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000080)=0x14)
ioctl$F2FS_IOC_MOVE_RANGE(r0, 0xc020f509, &(0x7f00000000c0)={<r1=>r0, 0x2, 0x8, 0x4})
r2 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), 0xffffffffffffffff)
sendmsg$L2TP_CMD_SESSION_DELETE(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000100)={0x1c, r2, 0x1, 0x70bd27, 0x4, {0x5}, [@L2TP_ATTR_CONN_ID={0x8, 0x9, 0x2}]}, 0x1c}}, 0x200080c0)
sendmsg$L2TP_CMD_SESSION_DELETE(r1, &(0x7f00000001c0)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x20000}, 0xc, &(0x7f0000000180)={&(0x7f0000000140)={0x3c, r2, 0x300, 0x70bd2a, 0x25dfdbfb, {}, [@L2TP_ATTR_VLAN_ID={0x6}, @L2TP_ATTR_ENCAP_TYPE={0x6}, @L2TP_ATTR_SEND_SEQ={0x5, 0x13, 0xd0}, @L2TP_ATTR_PEER_SESSION_ID={0x8, 0xc, 0x3}, @L2TP_ATTR_PEER_SESSION_ID={0x8, 0xc, 0x1}]}, 0x3c}, 0x1, 0x0, 0x0, 0x40}, 0x40040)
sendmsg$nl_route_sched(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000280)=@gettaction={0x150, 0x32, 0x400, 0x70bd2c, 0x25dfdbff, {}, [@action_gd=@TCA_ACT_TAB={0x7c, 0x1, [{0xc, 0x13, 0x0, 0x0, @TCA_ACT_INDEX={0x8, 0x3, 0x80000000}}, {0xc, 0x17, 0x0, 0x0, @TCA_ACT_INDEX={0x8, 0x3, 0x6}}, {0xc, 0x6, 0x0, 0x0, @TCA_ACT_INDEX={0x8, 0x3, 0x9}}, {0x10, 0x19, 0x0, 0x0, @TCA_ACT_KIND={0xb, 0x1, 'mirred\x00'}}, {0x10, 0x1b, 0x0, 0x0, @TCA_ACT_KIND={0xb, 0x1, 'mirred\x00'}}, {0x10, 0x18, 0x0, 0x0, @TCA_ACT_KIND={0x9, 0x1, 'vlan\x00'}}, {0xc, 0xb, 0x0, 0x0, @TCA_ACT_INDEX={0x8}}, {0xc, 0x6, 0x0, 0x0, @TCA_ACT_INDEX={0x8, 0x3, 0x2707}}, {0xc, 0xd, 0x0, 0x0, @TCA_ACT_INDEX={0x8, 0x3, 0x9dd4}}]}, @action_gd=@TCA_ACT_TAB={0x5c, 0x1, [{0xc, 0x16, 0x0, 0x0, @TCA_ACT_INDEX={0x8, 0x3, 0xd1a}}, {0x10, 0x19, 0x0, 0x0, @TCA_ACT_KIND={0xb, 0x1, 'skbmod\x00'}}, {0xc, 0x3, 0x0, 0x0, @TCA_ACT_INDEX={0x8, 0x3, 0x5}}, {0xc, 0x6, 0x0, 0x0, @TCA_ACT_KIND={0x8, 0x1, 'nat\x00'}}, {0xc, 0x12, 0x0, 0x0, @TCA_ACT_INDEX={0x8, 0x3, 0xd8}}, {0xc, 0xc, 0x0, 0x0, @TCA_ACT_INDEX={0x8}}, {0xc, 0x13, 0x0, 0x0, @TCA_ACT_KIND={0x7, 0x1, 'xt\x00'}}]}, @action_gd=@TCA_ACT_TAB={0x14, 0x1, [{0x10, 0x12, 0x0, 0x0, @TCA_ACT_KIND={0xc, 0x1, 'skbedit\x00'}}]}, @action_gd=@TCA_ACT_TAB={0x10, 0x1, [{0xc, 0xa, 0x0, 0x0, @TCA_ACT_INDEX={0x8, 0x3, 0x2}}]}, @action_dump_flags=@TCA_ROOT_FLAGS={0xc, 0x2, {0x0, 0x1}}, @action_dump_flags=@TCA_ROOT_TIME_DELTA={0x8, 0x4, 0x34fb}, @action_dump_flags=@TCA_ROOT_TIME_DELTA={0x8, 0x4, 0x7}, @action_dump_flags=@TCA_ROOT_TIME_DELTA={0x8, 0x4, 0x2}, @action_gd=@TCA_ACT_TAB={0x1c, 0x1, [{0xc, 0x17, 0x0, 0x0, @TCA_ACT_KIND={0x7, 0x1, 'xt\x00'}}, {0xc, 0x1b, 0x0, 0x0, @TCA_ACT_INDEX={0x8, 0x3, 0x8}}]}]}, 0x150}, 0x1, 0x0, 0x0, 0x20000000}, 0x0)

41.664376013s ago: executing program 32 (id=5885):
r0 = socket$nl_route(0x10, 0x3, 0x0)
getsockname$packet(0xffffffffffffffff, &(0x7f0000000000)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000080)=0x14)
ioctl$F2FS_IOC_MOVE_RANGE(r0, 0xc020f509, &(0x7f00000000c0)={<r1=>r0, 0x2, 0x8, 0x4})
r2 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), 0xffffffffffffffff)
sendmsg$L2TP_CMD_SESSION_DELETE(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000100)={0x1c, r2, 0x1, 0x70bd27, 0x4, {0x5}, [@L2TP_ATTR_CONN_ID={0x8, 0x9, 0x2}]}, 0x1c}}, 0x200080c0)
sendmsg$L2TP_CMD_SESSION_DELETE(r1, &(0x7f00000001c0)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x20000}, 0xc, &(0x7f0000000180)={&(0x7f0000000140)={0x3c, r2, 0x300, 0x70bd2a, 0x25dfdbfb, {}, [@L2TP_ATTR_VLAN_ID={0x6}, @L2TP_ATTR_ENCAP_TYPE={0x6}, @L2TP_ATTR_SEND_SEQ={0x5, 0x13, 0xd0}, @L2TP_ATTR_PEER_SESSION_ID={0x8, 0xc, 0x3}, @L2TP_ATTR_PEER_SESSION_ID={0x8, 0xc, 0x1}]}, 0x3c}, 0x1, 0x0, 0x0, 0x40}, 0x40040)
sendmsg$nl_route_sched(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000280)=@gettaction={0x150, 0x32, 0x400, 0x70bd2c, 0x25dfdbff, {}, [@action_gd=@TCA_ACT_TAB={0x7c, 0x1, [{0xc, 0x13, 0x0, 0x0, @TCA_ACT_INDEX={0x8, 0x3, 0x80000000}}, {0xc, 0x17, 0x0, 0x0, @TCA_ACT_INDEX={0x8, 0x3, 0x6}}, {0xc, 0x6, 0x0, 0x0, @TCA_ACT_INDEX={0x8, 0x3, 0x9}}, {0x10, 0x19, 0x0, 0x0, @TCA_ACT_KIND={0xb, 0x1, 'mirred\x00'}}, {0x10, 0x1b, 0x0, 0x0, @TCA_ACT_KIND={0xb, 0x1, 'mirred\x00'}}, {0x10, 0x18, 0x0, 0x0, @TCA_ACT_KIND={0x9, 0x1, 'vlan\x00'}}, {0xc, 0xb, 0x0, 0x0, @TCA_ACT_INDEX={0x8}}, {0xc, 0x6, 0x0, 0x0, @TCA_ACT_INDEX={0x8, 0x3, 0x2707}}, {0xc, 0xd, 0x0, 0x0, @TCA_ACT_INDEX={0x8, 0x3, 0x9dd4}}]}, @action_gd=@TCA_ACT_TAB={0x5c, 0x1, [{0xc, 0x16, 0x0, 0x0, @TCA_ACT_INDEX={0x8, 0x3, 0xd1a}}, {0x10, 0x19, 0x0, 0x0, @TCA_ACT_KIND={0xb, 0x1, 'skbmod\x00'}}, {0xc, 0x3, 0x0, 0x0, @TCA_ACT_INDEX={0x8, 0x3, 0x5}}, {0xc, 0x6, 0x0, 0x0, @TCA_ACT_KIND={0x8, 0x1, 'nat\x00'}}, {0xc, 0x12, 0x0, 0x0, @TCA_ACT_INDEX={0x8, 0x3, 0xd8}}, {0xc, 0xc, 0x0, 0x0, @TCA_ACT_INDEX={0x8}}, {0xc, 0x13, 0x0, 0x0, @TCA_ACT_KIND={0x7, 0x1, 'xt\x00'}}]}, @action_gd=@TCA_ACT_TAB={0x14, 0x1, [{0x10, 0x12, 0x0, 0x0, @TCA_ACT_KIND={0xc, 0x1, 'skbedit\x00'}}]}, @action_gd=@TCA_ACT_TAB={0x10, 0x1, [{0xc, 0xa, 0x0, 0x0, @TCA_ACT_INDEX={0x8, 0x3, 0x2}}]}, @action_dump_flags=@TCA_ROOT_FLAGS={0xc, 0x2, {0x0, 0x1}}, @action_dump_flags=@TCA_ROOT_TIME_DELTA={0x8, 0x4, 0x34fb}, @action_dump_flags=@TCA_ROOT_TIME_DELTA={0x8, 0x4, 0x7}, @action_dump_flags=@TCA_ROOT_TIME_DELTA={0x8, 0x4, 0x2}, @action_gd=@TCA_ACT_TAB={0x1c, 0x1, [{0xc, 0x17, 0x0, 0x0, @TCA_ACT_KIND={0x7, 0x1, 'xt\x00'}}, {0xc, 0x1b, 0x0, 0x0, @TCA_ACT_INDEX={0x8, 0x3, 0x8}}]}]}, 0x150}, 0x1, 0x0, 0x0, 0x20000000}, 0x0)

41.621169894s ago: executing program 2 (id=5887):
r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0)
ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101})
r1 = socket(0x10, 0x803, 0x0)
r2 = socket$unix(0x1, 0x1, 0x0)
ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', <r3=>0x0})
sendmsg$nl_route_sched(r1, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000005c0)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0xffffffff, {0x0, 0x0, 0x0, r3, {0x0, 0x9}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_multiq={{0xb}, {0x8, 0x2, {0x4, 0xc00}}}]}, 0x38}}, 0x0)
r4 = bpf$MAP_CREATE(0x0, 0x0, 0x48)
r5 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000004c0)={0x18, 0x14, &(0x7f0000000400)=@ringbuf={{0x18, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x4}, {{0x18, 0x1, 0x1, 0x0, r4}}, {}, [@tail_call={{0x18, 0x2, 0x1, 0x0, r4}}], {{}, {0x7, 0x0, 0xb, 0x2, 0x0, 0x0, 0x1}, {0x85, 0x0, 0x0, 0x84}}}, &(0x7f00000000c0)='GPL\x00', 0x2f9, 0xe0, &(0x7f0000000600)=""/224, 0x41000, 0x28, '\x00', r3, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, &(0x7f0000000140)={0x0, 0xd, 0x2, 0x9}, 0x10, 0x0, 0x0, 0x2, &(0x7f0000000180)=[r4, r4, r4, r4, r4, r4, r2], &(0x7f0000000200)=[{0x0, 0x353fe76, 0xa, 0xb}, {0x1, 0x2, 0xf}], 0x10, 0x3}, 0x94)
bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000001c0)={&(0x7f0000000000)='kfree\x00', r5}, 0x18)
r6 = socket(0x400000000010, 0x3, 0x0)
r7 = socket$unix(0x1, 0x1, 0x0)
ioctl$sock_SIOCGIFINDEX(r7, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', <r8=>0x0})
sendmsg$nl_route_sched(r6, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000340)=@newtfilter={0x8c, 0x2c, 0xd27, 0x30bd29, 0x25dfdc00, {0x0, 0x0, 0x0, r8, {0x0, 0x3}, {}, {0x7}}, [@filter_kind_options=@f_matchall={{0xd}, {0x50, 0x2, [@TCA_MATCHALL_ACT={0x4c, 0x2, [@m_gact={0x48, 0x1, 0x0, 0x0, {{0x9}, {0x1c, 0x2, 0x0, 0x1, [@TCA_GACT_PARMS={0x18, 0x2, {0x9, 0x9, 0x1, 0x80000001}}]}, {0x4}, {0xc}, {0xc, 0x8, {0x2, 0x2}}}}]}]}}, @TCA_RATE={0x6, 0x5, {0x5, 0x4}}]}, 0x8c}, 0x1, 0x0, 0x0, 0x10}, 0x0)

41.557738271s ago: executing program 33 (id=5887):
r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0)
ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101})
r1 = socket(0x10, 0x803, 0x0)
r2 = socket$unix(0x1, 0x1, 0x0)
ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', <r3=>0x0})
sendmsg$nl_route_sched(r1, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000005c0)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0xffffffff, {0x0, 0x0, 0x0, r3, {0x0, 0x9}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_multiq={{0xb}, {0x8, 0x2, {0x4, 0xc00}}}]}, 0x38}}, 0x0)
r4 = bpf$MAP_CREATE(0x0, 0x0, 0x48)
r5 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000004c0)={0x18, 0x14, &(0x7f0000000400)=@ringbuf={{0x18, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x4}, {{0x18, 0x1, 0x1, 0x0, r4}}, {}, [@tail_call={{0x18, 0x2, 0x1, 0x0, r4}}], {{}, {0x7, 0x0, 0xb, 0x2, 0x0, 0x0, 0x1}, {0x85, 0x0, 0x0, 0x84}}}, &(0x7f00000000c0)='GPL\x00', 0x2f9, 0xe0, &(0x7f0000000600)=""/224, 0x41000, 0x28, '\x00', r3, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, &(0x7f0000000140)={0x0, 0xd, 0x2, 0x9}, 0x10, 0x0, 0x0, 0x2, &(0x7f0000000180)=[r4, r4, r4, r4, r4, r4, r2], &(0x7f0000000200)=[{0x0, 0x353fe76, 0xa, 0xb}, {0x1, 0x2, 0xf}], 0x10, 0x3}, 0x94)
bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000001c0)={&(0x7f0000000000)='kfree\x00', r5}, 0x18)
r6 = socket(0x400000000010, 0x3, 0x0)
r7 = socket$unix(0x1, 0x1, 0x0)
ioctl$sock_SIOCGIFINDEX(r7, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', <r8=>0x0})
sendmsg$nl_route_sched(r6, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000340)=@newtfilter={0x8c, 0x2c, 0xd27, 0x30bd29, 0x25dfdc00, {0x0, 0x0, 0x0, r8, {0x0, 0x3}, {}, {0x7}}, [@filter_kind_options=@f_matchall={{0xd}, {0x50, 0x2, [@TCA_MATCHALL_ACT={0x4c, 0x2, [@m_gact={0x48, 0x1, 0x0, 0x0, {{0x9}, {0x1c, 0x2, 0x0, 0x1, [@TCA_GACT_PARMS={0x18, 0x2, {0x9, 0x9, 0x1, 0x80000001}}]}, {0x4}, {0xc}, {0xc, 0x8, {0x2, 0x2}}}}]}]}}, @TCA_RATE={0x6, 0x5, {0x5, 0x4}}]}, 0x8c}, 0x1, 0x0, 0x0, 0x10}, 0x0)

1.997263796s ago: executing program 4 (id=6625):
r0 = accept$nfc_llcp(0xffffffffffffffff, 0x0, &(0x7f0000000180))
sendmsg$NFC_CMD_DEV_UP(0xffffffffffffffff, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000000)={0x1c, 0x0, 0x1, 0x70bd26, 0x25dfdbfc, {}, [@NFC_ATTR_DEVICE_INDEX={0x8}]}, 0x1c}}, 0x0)
ioctl$IOCTL_GET_NCIDEV_IDX(0xffffffffffffffff, 0x0, &(0x7f0000000280)=<r1=>0x0)
r2 = openat$nci(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0)
r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10)
r4 = syz_genetlink_get_family_id$nfc(&(0x7f0000000100), r3)
ioctl$IOCTL_GET_NCIDEV_IDX(r2, 0x0, &(0x7f00000000c0)=<r5=>0x0)
sendmsg$NFC_CMD_DEV_UP(r3, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000004c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r4, @ANYBLOB="010026bd70003c0200000200000008000100", @ANYRES32=r5], 0xfd45}}, 0x0)
r6 = openat$nci(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0)
ioctl$IOCTL_GET_NCIDEV_IDX(r6, 0x0, &(0x7f00000000c0)=<r7=>0x0)
r8 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10)
r9 = syz_genetlink_get_family_id$nfc(&(0x7f0000000100), r8)
sendmsg$NFC_CMD_DEV_UP(r8, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000700)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r9, @ANYBLOB="010023010000340200000200000008000100", @ANYRES32=r7], 0x1c}}, 0x0)
sendmsg$NFC_CMD_LLC_GET_PARAMS(0xffffffffffffffff, &(0x7f0000000400)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x4000}, 0xc, &(0x7f00000003c0)={&(0x7f00000002c0)={0x50, 0x0, 0x400, 0x70bd29, 0x25dfdbfd, {}, [@NFC_ATTR_DEVICE_INDEX={0x8}, @NFC_ATTR_FIRMWARE_NAME={0xb, 0x14, 'broute\x00'}, @NFC_ATTR_DEVICE_INDEX={0x8}, @NFC_ATTR_DEVICE_INDEX={0x8, 0x1, r1}, @NFC_ATTR_DEVICE_INDEX={0x8, 0x1, r5}, @NFC_ATTR_FIRMWARE_NAME={0x8, 0x14, 'c@,0'}, @NFC_ATTR_DEVICE_INDEX={0x8, 0x1, r7}]}, 0x50}, 0x1, 0x0, 0x0, 0x40}, 0x0)
ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000001c0)={'geneve1\x00'})
r10 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10)
syz_genetlink_get_family_id$ieee802154(0x0, r10)
syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1)
unshare(0x24020400)
setsockopt$EBT_SO_SET_ENTRIES(0xffffffffffffffff, 0x0, 0x80, &(0x7f0000000340)=@broute={'broute\x00', 0x20, 0x0, 0x90, [0x0, 0x0, 0xfeffff0700000000, 0x0, 0x0, 0x200000000080], 0x0, 0x0, &(0x7f0000000080)=[{0x0, '\x00', 0x0, 0xfffffffffffffffe}, {0x0, '\x00', 0x0, 0xfffffffffffffffc}, {0x0, '\x00', 0x0, 0xffffffffffffffff}]}, 0x108)
r11 = socket$inet6_mptcp(0xa, 0x1, 0x106)
bind$inet6(r11, &(0x7f0000000040)={0xa, 0x4e22, 0x0, @empty, 0x7}, 0x1c)
listen(r11, 0xbf2d)
r12 = socket$inet_mptcp(0x2, 0x1, 0x106)
syz_init_net_socket$nl_generic(0x10, 0x3, 0x10)
connect$inet(r12, &(0x7f0000000000)={0x2, 0x4e22, @local}, 0x10)
r13 = socket$nl_generic(0x10, 0x3, 0x10)
r14 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000040), 0xffffffffffffffff)
sendmsg$MPTCP_PM_CMD_DEL_ADDR(r13, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000500)=ANY=[@ANYBLOB='(\x00\x00\x00', @ANYRES16=r14, @ANYBLOB="070000000000000000000200000014000180060003000200000008000300ac1414aa"], 0x28}}, 0x0)
accept4(r11, 0x0, 0x0, 0x0)

1.07986829s ago: executing program 4 (id=6632):
r0 = socket$nl_netfilter(0x10, 0x3, 0xc)
r1 = syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0)
r2 = socket$nl_generic(0x10, 0x3, 0x10)
r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000380), r2)
r4 = socket$packet(0x11, 0x2, 0x300)
sendmsg$NL80211_CMD_FRAME(r2, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000400)={&(0x7f0000000600)=ANY=[@ANYBLOB='@\x00\x00\x00', @ANYRES16=r3, @ANYBLOB="010000000000000000000200000008000300", @ANYRES32=r4], 0x40}, 0x1, 0x0, 0x0, 0x4004001}, 0x0)
setsockopt$WPAN_SECURITY(r1, 0x0, 0x1, &(0x7f0000000040)=0x2, 0x4)
sendmsg$802154_dgram(r1, &(0x7f00000000c0)={&(0x7f0000000000)={0x24, @long={0x3, 0xffff, {0xaaaaaaaaaaaa0302}}}, 0x14, &(0x7f0000000080)={0x0}, 0x1, 0x0, 0x0, 0x20044005}, 0x4000010)
syz_emit_ethernet(0x76, &(0x7f00000006c0)={@broadcast, @local, @void, {@ipv6={0x86dd, @icmpv6={0x0, 0x6, "120008", 0x40, 0x3a, 0x0, @remote, @local, {[], @pkt_toobig={0x2, 0x0, 0x0, 0x0, {0x0, 0x6, "5b29ab", 0x0, 0x11, 0x0, @private1, @private2, [@dstopts={0x0, 0x0, '\x00', [@generic={0x40}]}]}}}}}}}, 0x0)
r5 = socket$inet6_tcp(0xa, 0x1, 0x0)
setsockopt$inet6_group_source_req(r5, 0x29, 0x2b, &(0x7f0000001740)={0xd92, {{0xa, 0x4e20, 0x7fff, @private1, 0x10}}, {{0xa, 0x4e21, 0x5, @mcast1, 0x449a}}}, 0x108)
sendmsg$IPSET_CMD_CREATE(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000044c0)={&(0x7f0000000080)={0x60, 0x2, 0x6, 0x5, 0x0, 0x0, {0x7}, [@IPSET_ATTR_DATA={0x14, 0x7, 0x0, 0x1, [@IPSET_ATTR_TIMEOUT={0x8, 0x11}, @IPSET_ATTR_HASHSIZE={0x8, 0x12, 0x1, 0x0, 0xffff}]}, @IPSET_ATTR_PROTOCOL={0x5, 0x1, 0x6}, @IPSET_ATTR_FAMILY={0x5, 0x5, 0x2}, @IPSET_ATTR_REVISION={0x5}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}, @IPSET_ATTR_TYPENAME={0x11, 0x3, 'hash:net,net\x00'}]}, 0x60}, 0x1, 0x0, 0x0, 0x810}, 0x20004000)

1.006608694s ago: executing program 4 (id=6634):
r0 = socket$nl_generic(0x10, 0x3, 0x10) (async)
r1 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000d00), 0xffffffffffffffff) (async)
pipe(&(0x7f0000000000)={<r2=>0xffffffffffffffff, <r3=>0xffffffffffffffff})
vmsplice(r3, &(0x7f0000001c00)=[{&(0x7f0000000600)="14f887d15f", 0x5}], 0x1, 0x9) (async)
close(r3) (async)
splice(r2, 0x0, r3, 0x0, 0x10500, 0x0) (async, rerun: 64)
ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(r2, 0x89f1, &(0x7f0000000080)={'gre0\x00', &(0x7f0000000140)={'sit0\x00', <r4=>0x0, 0x80, 0x27, 0x0, 0xaf, {{0x9, 0x4, 0x1, 0x2d, 0x24, 0x66, 0x0, 0x4, 0x29, 0x0, @remote, @empty, {[@noop, @generic={0x86, 0xc, "3e2d903a8b6fdd4509e1"}]}}}}}) (rerun: 64)
sendmsg$ETHTOOL_MSG_FEATURES_SET(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000e00)={0x4c, r1, 0x1, 0xfffffffd, 0x0, {}, [@ETHTOOL_A_FEATURES_HEADER={0xc, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r4}]}, @ETHTOOL_A_FEATURES_WANTED={0x2c, 0x3, 0x0, 0x1, [@ETHTOOL_A_BITSET_BITS={0x28, 0x3, 0x0, 0x1, [{0x24, 0x1, 0x0, 0x1, [@ETHTOOL_A_BITSET_BIT_NAME={0x1f, 0x2, '\xcb\xa6\x18av\xde`\x16\x8f/\xf0\x12\a\xdc)\xc9n\xbd\xc7\xe6\xab\xa8\x00\x00\x00\x00\x00'}]}]}]}]}, 0x4c}, 0x1, 0x0, 0x0, 0x4000080}, 0x4000)

936.623544ms ago: executing program 4 (id=6635):
sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000240)={&(0x7f0000000040)=@in={0x2, 0x4e24, @broadcast}, 0x80, &(0x7f0000000200)=[{&(0x7f0000000140)='a', 0x1}], 0x1}, 0x0)
r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x2, 0x0)
connect$bt_l2cap(r0, &(0x7f0000000140)={0x1f, 0x0, @fixed, 0x3ff}, 0xe)
setsockopt$sock_linger(r0, 0x1, 0xd, &(0x7f0000000000)={0x1, 0x27fd}, 0x8)
shutdown(r0, 0x1)
r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='devices.list\x00', 0x275a, 0x0)
write$cgroup_subtree(r1, &(0x7f0000000200)=ANY=[], 0x32600)
readv(r0, &(0x7f0000001480)=[{&(0x7f0000000280)=""/192, 0xc0}, {&(0x7f0000000100)=""/9, 0x9}, {&(0x7f0000000340)=""/89, 0x59}, {&(0x7f00000003c0)=""/182, 0xb6}, {&(0x7f0000000480)=""/4096, 0x1000}], 0x5)
r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x1c1842, 0x0)
ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101})
r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0)
ioctl$TUNSETIFF(r3, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101})
socket$nl_route(0x10, 0x3, 0x0)
write$cgroup_devices(r2, &(0x7f0000000880)=ANY=[@ANYBLOB="1e0301003c05000128876b60864668f82ffdeefa000000000000ffd2acb165fe580cd568020031b87b548cb74136f366da0abe01880b"], 0xffdd)
r4 = socket$nl_generic(0x10, 0x3, 0x10)
r5 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000040), 0xffffffffffffffff)
sendmsg$ETHTOOL_MSG_DEBUG_SET(r4, &(0x7f0000001540)={0x0, 0x0, &(0x7f0000001500)={&(0x7f0000000140)=ANY=[@ANYBLOB='D\x00\x00\x00', @ANYRES16=r5, @ANYBLOB="0100000000000000000008000000180001801400020073797a5f74756e00000000000000000018000280080002002000000004000100080004"], 0x44}}, 0x0)
mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x2000001, 0x12, r1, 0x0)
connect$pppoe(r1, &(0x7f00000000c0)={0x18, 0x0, {0x1, @link_local, 'ip6_vti0\x00'}}, 0x1e)
r6 = socket(0x2, 0x80805, 0x0)
getsockopt$inet_sctp_SCTP_GET_ASSOC_ID_LIST(r6, 0x84, 0x1d, &(0x7f0000000000)={0x1, [0x0]}, &(0x7f0000000040)=0x8)

596.084722ms ago: executing program 3 (id=6644):
syz_emit_ethernet(0x2416, &(0x7f0000000580)=ANY=[@ANYBLOB="e727dc07001f391e7dd7a2d786dd609907a623e02c03cb697a653e336f000000500000000000ff02000000000000000000000000000132000012"], 0x0)
syz_emit_ethernet(0x66, &(0x7f0000000080)=ANY=[@ANYBLOB="69e1629b6174391e7dd7a2d786dd60b6000000302c03cb697a653e336f000000500000000000ff0200000000000000000000000000010223e803"], 0x0)
r0 = socket(0x2c, 0x3, 0x0)
r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="110000000400000004000000ff"], 0x48)
bpf$MAP_UPDATE_ELEM(0x2, &(0x7f00000001c0)={r1, &(0x7f0000000140), &(0x7f0000000080)=@udp=r0}, 0x20)
r2 = socket(0x2c, 0x3, 0x0)
bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000340)={r1, &(0x7f0000000180), &(0x7f0000000280)=@tcp6=r2, 0x1}, 0x20)
r3 = socket$nl_generic(0x10, 0x3, 0x10)
r4 = socket$nl_generic(0x10, 0x3, 0x10)
setsockopt$MRT6_DEL_MFC_PROXY(r2, 0x29, 0xd3, &(0x7f0000000440)={{0xa, 0x4e22, 0x4, @private2, 0x2}, {0xa, 0x4e21, 0x3d, @ipv4={'\x00', '\xff\xff', @initdev={0xac, 0x1e, 0x1, 0x0}}, 0x7fffffff}, 0x1, {[0x6, 0x9, 0x1, 0x8, 0x65ec, 0x8000, 0x6, 0xc9e]}}, 0x5c)
sendmsg$nl_generic(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000080)={0x28, 0x33, 0x107, 0x0, 0x25dfdbfb, {0x1, 0x7c}, [@nested={0xc, 0x1, 0x0, 0x1, [@typed={0x6, 0x6, 0x0, 0x0, @str='\x80\n'}]}, @nested={0x8, 0x2, 0x0, 0x1, [@typed={0x4, 0x18, 0x0, 0x0, @binary}]}]}, 0x28}}, 0x4010)
r5 = socket(0x10, 0x3, 0x0)
r6 = socket$nl_route(0x10, 0x3, 0x0)
r7 = socket(0x10, 0x803, 0x2)
syz_genetlink_get_family_id$mptcp(&(0x7f00000000c0), r7)
getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, <r8=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000003c0)=0x14)
sendmsg$nl_route(r6, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="3c0000001000010400eeffff11ffffffff000000", @ANYRES32=r8, @ANYBLOB="01000000010000001c0012000c000100627269646765"], 0x3c}}, 0x0)
sendmsg$nl_route_sched(r5, &(0x7f0000005840)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000200)=@newqdisc={0x2c, 0x24, 0x5820a61ca228651, 0x0, 0x0, {0x0, 0x0, 0x0, r8, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_drr={0x8}]}, 0x2c}}, 0x0)
sendmsg$nl_route_sched(r6, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000400)=@newtfilter={0x68, 0x28, 0xd27, 0x0, 0x0, {0x0, 0x0, 0x0, r8, {}, {}, {0xfff1, 0x4}}, [@filter_kind_options=@f_cgroup={{0xb}, {0x38, 0x2, [@TCA_CGROUP_ACT={0x34}]}}]}, 0x68}}, 0x0)
r9 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendmsg$IPSET_CMD_CREATE(r9, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000740)={0x58, 0x2, 0x6, 0x3, 0x0, 0x0, {0x0, 0x0, 0x7}, [@IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}, @IPSET_ATTR_DATA={0xc, 0x7, 0x0, 0x1, [@IPSET_ATTR_MAXELEM={0x8, 0x13, 0x0}]}, @IPSET_ATTR_FAMILY={0x5, 0x5, 0x2}, @IPSET_ATTR_REVISION={0x5, 0x4, 0x1}, @IPSET_ATTR_TYPENAME={0x11, 0x3, 'hash:net,net\x00'}]}, 0x58}, 0x1, 0x0, 0x0, 0x4000}, 0x20004000)
sendmsg$nl_generic(r3, &(0x7f0000001540)={0x0, 0x0, &(0x7f0000001500)={&(0x7f0000000180)={0x14, 0x25, 0x1, 0x70bd2c, 0x259fdbfb, {0x8}}, 0x14}, 0x1, 0x0, 0x0, 0x80}, 0x10)
bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000300)=@bpf_lsm={0xd, 0x5, &(0x7f0000000040)=@framed={{0x66, 0xa, 0x0, 0x0, 0x0, 0x61, 0x11, 0x84}, [@initr0]}, &(0x7f0000000000)='GPL\x00'}, 0x80)

518.227612ms ago: executing program 3 (id=6645):
sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000004c0)=@updpolicy={0xfc, 0x19, 0x1, 0x0, 0x0, {{@in=@private, @in=@private, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff}, {}, {}, 0x0, 0x0, 0x1}, [@tmpl={0x44, 0x5, [{{@in=@multicast1}, 0x0, @in6=@empty, 0x0, 0x4, 0x0, 0x7}]}]}, 0xfc}}, 0x0)

517.569265ms ago: executing program 3 (id=6646):
r0 = socket$inet6_tcp(0xa, 0x1, 0x0)
setsockopt$inet6_int(r0, 0x29, 0xb, &(0x7f0000000140)=0x7fc, 0x4)
r1 = socket$inet_mptcp(0x2, 0x1, 0x106)
setsockopt$inet_tcp_TCP_CONGESTION(r1, 0x6, 0xd, &(0x7f00000000c0)='vegas\x00', 0x6)
write$cgroup_subtree(0xffffffffffffffff, &(0x7f0000000000)=ANY=[@ANYBLOB="8fed007907001175f37538e486dd6317ce2200102f00fe80000000000000875a65059ff57b00000000000000000000000000ac1414aa35f022eb"], 0xcfa4)
write$cgroup_subtree(0xffffffffffffffff, &(0x7f0000000000)=ANY=[@ANYBLOB="8fedcb7907001175f37538e486dd637f4b22667f"], 0xfdef)
r2 = socket$kcm(0x11, 0x200000000000002, 0x300)
socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={<r3=>0xffffffffffffffff, <r4=>0xffffffffffffffff})
bpf$PROG_LOAD_XDP(0x5, &(0x7f00000001c0)={0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x59, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, &(0x7f00000003c0)=[{0x0, 0x2, 0x0, 0xa}, {0x90010022}]}, 0x94)
close(r4)
recvmsg$unix(r3, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x0, &(0x7f00000003c0)=[@rights={{0x14, 0x1, 0x1, [<r5=>0xffffffffffffffff]}}], 0x18}, 0x0)
setsockopt$sock_attach_bpf(r2, 0x107, 0x12, &(0x7f00000008c0)=r5, 0x4)
bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000140)={0x6, 0x3, &(0x7f0000000680)=ANY=[@ANYBLOB="1800000002000000000000000000000095"], 0x0}, 0x90)
r6 = bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000200)={0x6, 0x3, &(0x7f0000000680)=ANY=[], &(0x7f00000002c0)='syzkaller\x00'}, 0x94)
getsockopt$inet6_tcp_TCP_ZEROCOPY_RECEIVE(r0, 0x6, 0x23, &(0x7f00000006c0)={&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x0, 0x0, 0x0, &(0x7f00000004c0)=""/206, 0xce, 0x0, &(0x7f00000005c0)=""/61, 0x3d}, &(0x7f0000000700)=0x40)
write$cgroup_subtree(0xffffffffffffffff, &(0x7f0000000000)=ANY=[@ANYBLOB="8fed007907001175f37538e486dd6317ce2200"], 0xcfa4)
bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000600)={r6, 0x5, 0xb68, 0x0, &(0x7f0000000000)='%', 0x0, 0xd01, 0x88be, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x48)
getsockopt$inet_tcp_buf(r1, 0x6, 0x1a, 0x0, &(0x7f0000000000))
bind$inet6(r0, &(0x7f0000000240)={0xa, 0x4e20, 0xf, @empty, 0x5}, 0x1c)
sendmmsg$inet6(r0, &(0x7f0000000ac0)=[{{&(0x7f0000000440)={0xa, 0x4e20, 0x2, @empty, 0x6}, 0x1c, 0x0}}], 0x1, 0x20080058)
pselect6(0x40, &(0x7f0000000040)={0x2, 0xffff, 0x251, 0x6, 0x7f, 0x7, 0x6219, 0x8}, &(0x7f0000000080)={0x4, 0x8000000000000000, 0x9, 0x100, 0x8001, 0x2, 0xd, 0xb}, &(0x7f0000000100)={0x26ab, 0x9, 0x8, 0x3, 0x7, 0x2, 0x10001, 0x1c00000000000000}, &(0x7f0000000300)={0x77359400}, &(0x7f0000000380)={&(0x7f0000000340)={[0x9]}, 0x8})
write(r0, &(0x7f0000000480)="001600080000000000e5b9189420e6f0d11d4ee96e5b94a687e7842c3994fc7dcd00f1044bee0dc33ae23c0d6cc669e2", 0x30)

386.746635ms ago: executing program 3 (id=6649):
r0 = socket$packet(0x11, 0x2, 0x300)
setsockopt$packet_fanout(r0, 0x107, 0x12, &(0x7f0000000000)={0x2, 0x2000}, 0x4)
setsockopt$packet_fanout(r0, 0x107, 0x12, &(0x7f0000000040)={0x0, 0x6}, 0x4)
r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='memory.events\x00', 0x275a, 0x0)
mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x2000001, 0x12, r1, 0x0)
setsockopt$packet_fanout_data(r0, 0x107, 0x16, &(0x7f0000000100)={0x0, 0x0}, 0x10)

386.334326ms ago: executing program 1 (id=6650):
r0 = syz_init_net_socket$nfc_llcp(0x27, 0x2, 0x1)
bind$nfc_llcp(r0, &(0x7f00000001c0)={0x27, 0x0, 0x0, 0x2, 0x0, 0x49, "c46e9fd1a84b7fa0bf2cca6beb9363a680b652a86bcf56a1b9ca5386103a5ccbe47b7b9aa6d8d701a3ba00000000b97800001022f987617c318500", 0x3a}, 0x60)
getsockopt$inet_buf(r0, 0x118, 0x0, 0x0, &(0x7f00000003c0)=0x14)
r1 = socket$netlink(0x10, 0x3, 0x0)
r2 = socket(0x10, 0x3, 0x0)
sendmsg$nl_route_sched(r2, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000100)={0x0, 0x24}}, 0x0)
getsockname$packet(r2, &(0x7f0000000080)={0x11, 0x0, <r3=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000100)=0x14)
sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000008c0)=ANY=[@ANYBLOB="4800000010000507000000000000000016000000", @ANYRES32=r3, @ANYBLOB="0000000200000000280012000c00010076657468"], 0x48}, 0x1, 0x0, 0x0, 0x44}, 0x0)
sendmsg$nl_route_sched(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000140)=@newqdisc={0x30, 0x24, 0xf1d, 0x0, 0x0, {0x0, 0x0, 0x0, r3, {}, {0xfff1, 0xffff}}, [@qdisc_kind_options=@q_clsact={0xb}]}, 0x30}}, 0x0)
r4 = socket$nl_route(0x10, 0x3, 0x0)
r5 = socket(0x10, 0x803, 0x4)
r6 = socket$can_raw(0x1d, 0x3, 0x1)
r7 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000200), r2)
sendmsg$TIPC_NL_PUBL_GET(r5, &(0x7f0000000340)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x80100000}, 0xc, &(0x7f0000000240)={&(0x7f0000000440)={0x454, r7, 0x400, 0x70bd2d, 0x25dfdbff, {}, [@TIPC_NLA_SOCK={0x20, 0x2, 0x0, 0x1, [@TIPC_NLA_SOCK_CON={0xc, 0x3, 0x0, 0x1, [@TIPC_NLA_CON_FLAG={0x8, 0x1, 0x9bf}]}, @TIPC_NLA_SOCK_REF={0x8, 0x2, 0x6}, @TIPC_NLA_SOCK_REF={0x8, 0x2, 0x9}]}, @TIPC_NLA_MON={0x14, 0x9, 0x0, 0x1, [@TIPC_NLA_MON_REF={0x8, 0x2, 0x9}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8}]}, @TIPC_NLA_MEDIA={0x58, 0x5, 0x0, 0x1, [@TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'eth\x00'}, @TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'udp\x00'}, @TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'udp\x00'}, @TIPC_NLA_MEDIA_PROP={0x3c, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0x5}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0xd}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x81}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x80}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x6}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x8000}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0xffffffff}]}]}, @TIPC_NLA_MEDIA={0x58, 0x5, 0x0, 0x1, [@TIPC_NLA_MEDIA_PROP={0x4}, @TIPC_NLA_MEDIA_PROP={0x1c, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x10}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0xd}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x7}]}, @TIPC_NLA_MEDIA_PROP={0x34, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_WIN={0x8, 0x3, 0x8001}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x14}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x800}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x14}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0xa}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0xcd}]}]}, @TIPC_NLA_MON={0x1c, 0x9, 0x0, 0x1, [@TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8, 0x1, 0x1}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8, 0x1, 0x4}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8, 0x1, 0xe}]}, @TIPC_NLA_MEDIA={0x6c, 0x5, 0x0, 0x1, [@TIPC_NLA_MEDIA_PROP={0x2c, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_TOL={0x8, 0x2, 0xa0}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x83d}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x5}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x6}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x54}]}, @TIPC_NLA_MEDIA_PROP={0x3c, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x12}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x1}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x1d}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x100}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x8af}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0xd}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0xd}]}]}, @TIPC_NLA_NET={0x50, 0x7, 0x0, 0x1, [@TIPC_NLA_NET_ID={0x8, 0x1, 0x6}, @TIPC_NLA_NET_NODEID_W1={0xc, 0x4, 0x9fbc}, @TIPC_NLA_NET_NODEID={0xc, 0x3, 0x1}, @TIPC_NLA_NET_NODEID_W1={0xc}, @TIPC_NLA_NET_ID={0x8, 0x1, 0xfffffffd}, @TIPC_NLA_NET_NODEID={0xc, 0x3, 0xfffffffffffffff8}, @TIPC_NLA_NET_NODEID={0xc, 0x3, 0x6}]}, @TIPC_NLA_BEARER={0x184, 0x1, 0x0, 0x1, [@TIPC_NLA_BEARER_UDP_OPTS={0x2c, 0x4, {{0x14, 0x1, @in={0x2, 0x4e20, @broadcast}}, {0x14, 0x2, @in={0x2, 0x4e21, @broadcast}}}}, @TIPC_NLA_BEARER_NAME={0xd, 0x1, @udp='udp:syz0\x00'}, @TIPC_NLA_BEARER_DOMAIN={0x8, 0x3, 0x80}, @TIPC_NLA_BEARER_PROP={0x4c, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_TOL={0x8, 0x2, 0x7f}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0xbf}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x6}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x6}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x19}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x1}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0xfffffff2}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x7}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x20}]}, @TIPC_NLA_BEARER_UDP_OPTS={0x38, 0x4, {{0x20, 0x1, @in6={0xa, 0x4e20, 0x2, @loopback}}, {0x14, 0x2, @in={0x2, 0x4e20, @local}}}}, @TIPC_NLA_BEARER_NAME={0xe, 0x1, @l2={'eth', 0x3a, 'caif0\x00'}}, @TIPC_NLA_BEARER_NAME={0xd, 0x1, @udp='udp:syz0\x00'}, @TIPC_NLA_BEARER_UDP_OPTS={0x44, 0x4, {{0x20, 0x1, @in6={0xa, 0x4e24, 0x8, @local}}, {0x20, 0x2, @in6={0xa, 0x4e20, 0x3, @loopback, 0x3}}}}, @TIPC_NLA_BEARER_PROP={0x54, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_TOL={0x8, 0x2, 0x7}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x9}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x1ff}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x19}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x10000}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x2}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x1c}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x2}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x8}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x100}]}]}, @TIPC_NLA_NET={0x60, 0x7, 0x0, 0x1, [@TIPC_NLA_NET_ADDR={0x8, 0x2, 0x8001}, @TIPC_NLA_NET_NODEID={0xc, 0x3, 0x5}, @TIPC_NLA_NET_NODEID_W1={0xc, 0x4, 0x1}, @TIPC_NLA_NET_ADDR={0x8, 0x2, 0x7}, @TIPC_NLA_NET_ADDR={0x8, 0x2, 0xfffffff4}, @TIPC_NLA_NET_ADDR={0x8, 0x2, 0xbb8}, @TIPC_NLA_NET_ID={0x8, 0x1, 0x1}, @TIPC_NLA_NET_NODEID_W1={0xc, 0x4, 0x8}, @TIPC_NLA_NET_ADDR={0x8, 0x2, 0x2}, @TIPC_NLA_NET_ID={0x8, 0x1, 0x1ff}]}, @TIPC_NLA_NODE={0xa0, 0x6, 0x0, 0x1, [@TIPC_NLA_NODE_KEY={0x4c, 0x4, {'gcm(aes)\x00', 0x24, "b40158e3e79580211cd0abe59a2bdfebb855be8023962a07c68e85d3ad67dfaab18f824f"}}, @TIPC_NLA_NODE_KEY={0x43, 0x4, {'gcm(aes)\x00', 0x1b, "4999f673c270d49ee12877c2c7d2d0488551d45e1c239dbe777913"}}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_ADDR={0x8, 0x1, 0x7ff}]}]}, 0x454}, 0x1, 0x0, 0x0, 0x6000}, 0x4)
getsockopt$sock_buf(r6, 0x1, 0x1c, 0x0, &(0x7f0000000400))
syz_genetlink_get_family_id$nl80211(&(0x7f0000000380), r5)
getsockname$packet(r5, &(0x7f0000000180)={0x11, 0x0, <r8=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000001c0)=0x14)
sendmsg$nl_route_sched(r4, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000940)=@delchain={0x38, 0x2c, 0xf31, 0x0, 0x2000, {0x0, 0x0, 0x0, r8, {}, {0xfff2, 0xffff}, {0xc, 0x1}}, [@filter_kind_options=@f_u32={{0x8}, {0xc, 0x2, [@TCA_U32_HASH={0x8, 0x2, 0xffffffd8}]}}]}, 0x38}, 0x1, 0x0, 0x0, 0x4008844}, 0x4010)

386.061899ms ago: executing program 3 (id=6651):
r0 = socket$nl_route(0x10, 0x3, 0x0)
bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x1, 0x5, 0x0, 0x0}, 0x94)
r1 = openat$nci(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0)
r2 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10)
r3 = syz_genetlink_get_family_id$nfc(&(0x7f0000000500), r2)
ioctl$IOCTL_GET_NCIDEV_IDX(r1, 0x0, &(0x7f0000000580)=<r4=>0x0)
sendmsg$NFC_CMD_SE_IO(r2, &(0x7f0000000840)={0x0, 0x0, &(0x7f0000000800)={&(0x7f0000000a00)=ANY=[@ANYBLOB=',\x00\x00\x00', @ANYRES16=r3, @ANYBLOB="010028bd7000fcdbdf251b00000008000100", @ANYRES32=r4, @ANYBLOB="080015001900d8a06d75000000000000"], 0x2c}, 0x1, 0x0, 0x0, 0x8000}, 0x0)
sendmsg$nl_route(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000001140)={&(0x7f0000000140)=ANY=[@ANYRES32=r0, @ANYRESDEC=r1, @ANYRES8=r2], 0x44}}, 0x80)

267.945459ms ago: executing program 3 (id=6652):
ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000000)={'tunl0\x00'})
r0 = bpf$TOKEN_CREATE(0x24, &(0x7f0000000040), 0x8)
bpf$TOKEN_CREATE(0x24, &(0x7f0000000100)={0x0, r0}, 0x8)
socket$inet_icmp_raw(0x2, 0x3, 0x1)
syz_init_net_socket$bt_hci(0x1f, 0x3, 0x5)
close(0x4)
syz_open_procfs$namespace(0x0, &(0x7f0000000300)='ns/ipc\x00')
r1 = socket$nl_generic(0x10, 0x3, 0x10)
r2 = syz_genetlink_get_family_id$fou(&(0x7f0000000080), 0xffffffffffffffff)
sendmsg$FOU_CMD_ADD(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000340)={&(0x7f00000006c0)=ANY=[@ANYBLOB='8\x00\x00\x00', @ANYRES16=r2, @ANYBLOB="490239c400000000000001000000050012000a000000140000000000000000000000000108000b00c9bd4cf57933c5cbbcef2283dbc7002728f3e7a4e89336673f8045acb46b93c5faf1b6d9b5c76be6d650215b8c6ff4fef4aa70cdbecefd1f1a0c891584e42a6798a8d664de2769f16eece356652d804a1af8684333b70a3b38cfc97555ec739c2745d39d0e6278859064f63df73f63b38d3d9e40454c346ad7bc998fe74f8f77df617647432a8550e5183f8f57d5fa7dcdf3fe3f1c771c9a2130ea1a7ad8ae14f97958415dea53219f72025c8cf8331b7cda1e24381a492ee8a27b47252d8105c7e59944a01424aa7b27fcd10336c9473e6009a39a09f20ef174843ee7232974d6945892afa732aedbddbd164823c6f46c260895ff5c14f694275b6f503aa5445b9eff92fb2dfa19f6bb4ebb0ba94210031fedafb726d88b534726c7ccc03d7739963461b1d91caa432217812473f41df5adec8214e66a8078a37ecf1e82c32e782902ee2bae765396c7d431f631db4457fe78ff4afa6787a5fad74ba8256475dfef6b172b362262c22b011e85ab79d4e7ccca614ac1c696e948ac0d117a3ef96d665cc835a5a5511ae047c7d38fe12a2d134ea9e33fcc0a866ba784a0943a0b63324579d2220a54df0f746ee515963fc4df4eabc6af63222f2ee9f1b0c1f150dc4fedc015234252173c7469d70545ac96bcbe56729da2c8c58012691af39818b6d90b8232f5c51a980e8d03718594ca5303d2180de4700fda33cc98863f2739d47584b0bc299713aa3886946460849551309694865d75bfb9caafe9d8e91a96fb008c2146b4", @ANYRESOCT], 0x38}}, 0x0)
sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x0)
unshare(0x6a040000)
r3 = socket$nl_generic(0x10, 0x3, 0x10)
r4 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000000), 0xffffffffffffffff)
socket$l2tp(0x2, 0x2, 0x73)
socket$inet6_tcp(0xa, 0x1, 0x0)
r5 = socket$inet6_sctp(0xa, 0x5, 0x84)
r6 = socket$vsock_stream(0x28, 0x1, 0x0)
bind$vsock_stream(r6, &(0x7f0000000940), 0x10)
close(0x3)
listen(r6, 0x0)
r7 = socket$vsock_stream(0x28, 0x1, 0x0)
connect$vsock_stream(r7, &(0x7f0000000000)={0x28, 0x0, 0x0, @local}, 0x10)
shutdown(r5, 0x2)
close(r5)
sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000140)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x4000000}, 0xc, 0x0, 0x1, 0x0, 0x0, 0x1}, 0x4000001)
setsockopt$netlink_NETLINK_TX_RING(0xffffffffffffffff, 0x10e, 0xc, &(0x7f0000000040)={0x802}, 0x10)
sendmsg$nl_generic(0xffffffffffffffff, 0x0, 0x0)
sendmsg$TIPC_NL_NET_SET(r3, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000440)={&(0x7f0000000240)=ANY=[@ANYBLOB='0\x00\x00\x00', @ANYRES16=r4, @ANYBLOB="010000000000000000000f0000001c0007800c0004003a2e000000002e3a0c0003"], 0x30}}, 0x20088004)
setsockopt$netlink_NETLINK_TX_RING(0xffffffffffffffff, 0x10e, 0xc, 0x0, 0x0)

266.914789ms ago: executing program 1 (id=6653):
r0 = socket(0x10, 0x3, 0x0)
sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000040)=ANY=[@ANYBLOB="380000001800dd8d00000000000000000200000000000006000000000600150004000000140016"], 0x38}, 0x1, 0x0, 0x0, 0x20000800}, 0xc001) (async)
sendmsg$nl_route_sched(0xffffffffffffffff, 0x0, 0x4020000)
socket$packet(0x11, 0x2, 0x300)
ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f00000000c0)={'xfrm0\x00'})
r1 = socket$kcm(0x10, 0x2, 0x10) (async)
syz_init_net_socket$x25(0x9, 0x5, 0x0)
setsockopt$inet_int(0xffffffffffffffff, 0x0, 0x18, &(0x7f0000000080)=0x5, 0x4) (async)
sendmsg$kcm(r1, 0x0, 0x4) (async)
openat$tun(0xffffffffffffff9c, 0x0, 0x40241, 0x0)
socket(0x10, 0x3, 0x0) (async)
r2 = syz_init_net_socket$x25(0x9, 0x5, 0x0) (async)
r3 = syz_init_net_socket$x25(0x9, 0x5, 0x0)
bind$x25(r3, &(0x7f0000000200), 0x12) (async)
bind$x25(r2, &(0x7f0000000080), 0x12) (async)
r4 = syz_init_net_socket$netrom(0x6, 0x5, 0x0)
ioctl$sock_inet_SIOCSIFFLAGS(r4, 0x8914, &(0x7f0000000700)={'bond0\x00'}) (async)
sendmmsg(r0, &(0x7f0000000000), 0x4000000000001f2, 0x0)

198.387929ms ago: executing program 1 (id=6654):
r0 = bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000000)={&(0x7f0000000380)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0x15c, 0x15c, 0x3, [@union={0x0, 0x8, 0x0, 0x5, 0x0, 0x1, [{0x10, 0x0, 0xa}, {0xb, 0x3, 0x10001}, {0x5, 0x3, 0x5}, {0xa, 0x3, 0x5}, {0x7, 0x2, 0x4}, {0xc, 0x1, 0xc}, {0x4, 0x1, 0x1}, {0x9, 0x5, 0x8783}]}, @volatile={0x4, 0x0, 0x0, 0x9, 0x4}, @func={0xa, 0x0, 0x0, 0xc, 0x2}, @struct={0x4, 0x4, 0x0, 0x4, 0x1, 0x80000000, [{0xa, 0x0, 0x4}, {0xa, 0x0, 0x5}, {0xe, 0x0, 0xef}, {0x4, 0x2, 0xe85}]}, @func_proto={0x0, 0x6, 0x0, 0xd, 0x0, [{0x3, 0x3}, {0xc, 0x5}, {0x4}, {0xa, 0x1}, {0x6, 0x1}, {0x6, 0x5}]}, @array={0x0, 0x0, 0x0, 0x3, 0x0, {0x1, 0x5, 0xfffffffd}}, @typedef={0x5, 0x0, 0x0, 0x8, 0x1}, @func_proto={0x0, 0x3, 0x0, 0xd, 0x0, [{0xf, 0x3}, {0x9}, {0x1, 0x5}]}, @union={0x2, 0x1, 0x0, 0x5, 0x0, 0x4, [{0x7, 0x3, 0x74f}]}]}, {0x0, [0x61]}}, &(0x7f0000000140)=""/134, 0x177, 0x86, 0x0, 0x2, 0x10000}, 0x28)
r1 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f00000000c0)={0x1b, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, '\x00', 0x0, r0}, 0x50)
bpf$PROG_LOAD(0x5, &(0x7f00000002c0)={0x15, 0x10, &(0x7f0000000040)=@ringbuf={{0x18, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8}, {{0x18, 0x1, 0x1, 0x0, r1}}, {}, [@func={0x85, 0x0, 0x1, 0x0, 0xfffffff5}], {{}, {}, {0x85, 0x0, 0x0, 0x84}}}, &(0x7f0000000240)='syzkaller\x00', 0x9, 0x0, 0x0, 0x0, 0xe, '\x00', 0x0, @sk_reuseport, 0x0, 0x8300, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)
ioctl$VFAT_IOCTL_READDIR_BOTH(r1, 0x82307201, &(0x7f0000000500)=[{0x0, 0x0, 0x100}, {0x0, 0x0, 0x100}])

196.624058ms ago: executing program 1 (id=6655):
socket$nl_xfrm(0x10, 0x3, 0x6)
socket$nl_route(0x10, 0x3, 0x0)
socket(0x10, 0x2, 0x0)
socket$nl_netfilter(0x10, 0x3, 0xc)
socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000002d40))
socket$inet6_sctp(0xa, 0x801, 0x84)
socket$nl_route(0x10, 0x3, 0x0)
socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000))
r0 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendmsg$IPCTNL_MSG_CT_NEW(r0, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000100)=ANY=[@ANYBLOB="640000000001010400000000141a000002000000240001801400018008000100e000000108000200e00000010c00028005000100000000002400028014000180080001000000000008000200ac1e00010c00028005000100000000000800074000000001"], 0x64}}, 0x0)
sendmsg$IPCTNL_MSG_CT_NEW(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000340)=ANY=[@ANYBLOB="5c00000000010104000000000000000002001000240002801400018008000100e000000108000200e00000010c00028005000100000000001c0010800800014000000000d97405010000000008000240880000000800", @ANYRES64=r0], 0x5c}, 0x1, 0x0, 0x0, 0x4000}, 0x4000)

147.741859ms ago: executing program 1 (id=6656):
syz_genetlink_get_family_id$netlbl_calipso(0x0, 0xffffffffffffffff)
r0 = socket$kcm(0x10, 0x2, 0x0)
r1 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000100)=@newqdisc={0x44, 0x24, 0x400, 0x70bd2e, 0x0, {0x0, 0x0, 0x0, 0x0, {}, {0xfff2, 0xffff}}, [@qdisc_kind_options=@q_fq_pie={{0xb}, {0x14, 0x8002, [@TCA_FQ_PIE_ECN_PROB={0x8, 0x9, 0x37}, @TCA_FQ_PIE_FLOWS={0x8, 0x2, 0xf01d}]}}]}, 0x44}, 0x1, 0x0, 0x0, 0x24000080}, 0x0)
sendmsg$nl_route(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000100)=ANY=[@ANYBLOB="500000001000010425bbe5ad600027842cf52300", @ANYRES32=0x0, @ANYBLOB="0000000000008000280012800a00010076786c616e00"], 0x50}, 0x1, 0x0, 0x0, 0x4880}, 0x20008844)
bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, 0x0, 0x0)
socket$nl_xfrm(0x10, 0x3, 0x6)
socket(0x2a, 0x2, 0x0)
socket$netlink(0x10, 0x3, 0x0)
r2 = bpf$PROG_LOAD(0x5, 0x0, 0x0)
bpf$BPF_PROG_DETACH(0x1c, &(0x7f0000000000)={@cgroup=r2, r2, 0x2e}, 0x20)
r3 = socket$alg(0x26, 0x5, 0x0)
setsockopt$ALG_SET_KEY(r3, 0x117, 0x1, 0x0, 0x0)
r4 = accept4(r3, 0x0, 0x0, 0x0)
r5 = syz_genetlink_get_family_id$smc(&(0x7f0000000000), 0xffffffffffffffff)
r6 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$SMC_PNETID_ADD(r6, &(0x7f00000001c0)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f00000006c0)={0x34, r5, 0x1, 0x0, 0x0, {}, [@SMC_PNETID_ETHNAME={0x14, 0x2, 'bond0\x00'}, @SMC_PNETID_NAME={0x9, 0x1, 'syz2\x00'}]}, 0x34}}, 0x800)
sendmsg$IPVS_CMD_DEL_DEST(r4, &(0x7f0000000740)={0x0, 0x0, &(0x7f00000007c0)={&(0x7f0000000300)={0x20, 0x0, 0x20, 0x70bd2c, 0x25dfdbfe, {}, [@IPVS_CMD_ATTR_DEST={0xc, 0x2, 0x0, 0x1, [@IPVS_DEST_ATTR_FWD_METHOD={0x8, 0x3, 0x4}]}]}, 0x20}, 0x1, 0x0, 0x0, 0x1}, 0x400c000)
sendmsg$kcm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f00000002c0)="2e00000011008b88040f80ee59acbc04130800480f0000005e2900421803001825800000000000000280000c0012", 0x2e}], 0x1}, 0x0)

147.23938ms ago: executing program 1 (id=6657):
getsockopt$inet6_mreq(0xffffffffffffffff, 0x29, 0x1b, &(0x7f0000000040)={@empty, <r0=>0x0}, &(0x7f0000000080)=0x14)
sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000180)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x4}, 0xc, &(0x7f0000000140)={&(0x7f00000000c0)=@ipv4_getaddr={0x50, 0x16, 0x300, 0x70bd29, 0x25dfdbfe, {0x2, 0x3f, 0xc, 0xfe, r0}, [@IFA_RT_PRIORITY={0x8, 0x9, 0xfff}, @IFA_CACHEINFO={0x14, 0x6, {0x400, 0xfffffff7, 0x40, 0xf}}, @IFA_CACHEINFO={0x14, 0x6, {0x5, 0xffffffff, 0x8001, 0x2b4a0a6a}}, @IFA_ADDRESS={0x8, 0x1, @broadcast}]}, 0x50}, 0x1, 0x0, 0x0, 0x44004}, 0x400c0c5)
r1 = socket$inet(0x2, 0xa, 0x38000)
ioctl$sock_netdev_private(r1, 0x89f5, &(0x7f00000001c0)="02611ed56383a4006f")
sendto(r1, &(0x7f0000000200)="02c2305c5ef5fed558d182f82b38c6f093a0ec56223b1ad110e1728f6685dc694392b5284e63c8daef95191c38de0a85276586bf9b1bcbbcc205340bad70bfa612502a8228735bacf9e090a5de8d986b98c46127cb32ca1d1bed5bbe7a555436faa3d2c2b3f583153bd80005cb24ce23ea071fc01464da6682e045b00add7edcc5852586638708261b1ac493d0d47d8d0d40c965910e38028d78", 0x9a, 0x40, &(0x7f00000002c0)=@rc={0x1f, @none, 0x80}, 0x80) (async)
socketpair(0x1e, 0x79f8f2a2d05e5d99, 0x4, &(0x7f0000000340)={<r2=>0xffffffffffffffff, <r3=>0xffffffffffffffff})
sendmsg$DCCPDIAG_GETSOCK(r2, &(0x7f0000000480)={&(0x7f0000000380)={0x10, 0x0, 0x0, 0x10100200}, 0xc, &(0x7f0000000440)={&(0x7f00000003c0)={0x4c, 0x13, 0x200, 0x70bd2b, 0x25dfdbff, {0x11, 0x1, 0x90, 0x7, {0x4e22, 0x4e20, [0x5, 0x0, 0xca2, 0x5], [0x2, 0x80, 0x1, 0x4], r0, [0x7, 0xa373]}, 0x9, 0x6a6e}}, 0x4c}, 0x1, 0x0, 0x0, 0x4004004}, 0x2000c8c0)
getsockopt$inet_sctp6_SCTP_GET_ASSOC_NUMBER(r3, 0x84, 0x1c, &(0x7f00000004c0), &(0x7f0000000500)=0x4) (async)
socket$nl_netfilter(0x10, 0x3, 0xc) (async)
r4 = syz_genetlink_get_family_id$tipc(&(0x7f0000000580), r3)
sendmsg$TIPC_CMD_RESET_LINK_STATS(r2, &(0x7f0000000640)={&(0x7f0000000540)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f0000000600)={&(0x7f00000005c0)={0x28, r4, 0x300, 0x70bd27, 0x25dfdbfb, {{}, {}, {0xc, 0x14, 'syz0\x00'}}, ["", "", "", "", "", "", "", "", ""]}, 0x28}, 0x1, 0x0, 0x0, 0x4000900}, 0x44880) (async)
setsockopt$inet_tcp_TLS_TX(r1, 0x6, 0x1, &(0x7f0000000680)=@ccm_128={{0x303}, "a75cdee83f7935c2", "bcb443368c479a80c2c7f0d4d54e56d9", "cbd32fe1", "322a7abca37e2530"}, 0x28) (async)
r5 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f00000006c0)={0x2, 0x4, 0x8, 0x1, 0x80, 0xffffffffffffffff, 0x8000, '\x00', r0, 0xffffffffffffffff, 0x2, 0x954, 0x1}, 0x50) (async)
r6 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000780), r3)
sendmsg$TIPC_NL_BEARER_SET(r2, &(0x7f0000000a40)={&(0x7f0000000740)={0x10, 0x0, 0x0, 0x4000}, 0xc, &(0x7f0000000a00)={&(0x7f00000007c0)={0x234, r6, 0xb6fe2af8497655d9, 0x70bd27, 0x25dfdbff, {}, [@TIPC_NLA_MON={0x1c, 0x9, 0x0, 0x1, [@TIPC_NLA_MON_REF={0x8, 0x2, 0xf}, @TIPC_NLA_MON_REF={0x8, 0x2, 0x8208}, @TIPC_NLA_MON_REF={0x8, 0x2, 0x200}]}, @TIPC_NLA_NET={0x40, 0x7, 0x0, 0x1, [@TIPC_NLA_NET_NODEID={0xc, 0x3, 0xfffffffffffffffa}, @TIPC_NLA_NET_NODEID={0xc, 0x3, 0x7f}, @TIPC_NLA_NET_NODEID={0xc, 0x3, 0x8}, @TIPC_NLA_NET_ID={0x8, 0x1, 0x2}, @TIPC_NLA_NET_ID={0x8, 0x1, 0x6f}, @TIPC_NLA_NET_ADDR={0x8, 0x2, 0x400000}]}, @TIPC_NLA_MON={0x14, 0x9, 0x0, 0x1, [@TIPC_NLA_MON_REF={0x8, 0x2, 0x6}, @TIPC_NLA_MON_REF={0x8, 0x2, 0x2}]}, @TIPC_NLA_SOCK={0x98, 0x2, 0x0, 0x1, [@TIPC_NLA_SOCK_HAS_PUBL={0x4}, @TIPC_NLA_SOCK_CON={0xc, 0x3, 0x0, 0x1, [@TIPC_NLA_CON_FLAG={0x8, 0x1, 0x2}]}, @TIPC_NLA_SOCK_ADDR={0x8, 0x1, 0x7}, @TIPC_NLA_SOCK_HAS_PUBL={0x4}, @TIPC_NLA_SOCK_HAS_PUBL={0x4}, @TIPC_NLA_SOCK_REF={0x8, 0x2, 0x4}, @TIPC_NLA_SOCK_CON={0x3c, 0x3, 0x0, 0x1, [@TIPC_NLA_CON_NODE={0x8, 0x2, 0x95b}, @TIPC_NLA_CON_NODE={0x8, 0x2, 0x1}, @TIPC_NLA_CON_NODE={0x8, 0x2, 0x6}, @TIPC_NLA_CON_NODE={0x8, 0x2, 0x4}, @TIPC_NLA_CON_NODE={0x8, 0x2, 0x6}, @TIPC_NLA_CON_NODE={0x8, 0x2, 0x7e7}, @TIPC_NLA_CON_FLAG={0x8, 0x1, 0x4}]}, @TIPC_NLA_SOCK_CON={0xc, 0x3, 0x0, 0x1, [@TIPC_NLA_CON_FLAG={0x8, 0x1, 0x1a}]}, @TIPC_NLA_SOCK_CON={0x24, 0x3, 0x0, 0x1, [@TIPC_NLA_CON_NODE={0x8, 0x2, 0x5}, @TIPC_NLA_CON_NODE={0x8, 0x2, 0xde}, @TIPC_NLA_CON_NODE={0x8, 0x2, 0x1}, @TIPC_NLA_CON_FLAG={0x8, 0x1, 0x1000}]}]}, @TIPC_NLA_BEARER={0x9c, 0x1, 0x0, 0x1, [@TIPC_NLA_BEARER_NAME={0xd, 0x1, @udp='udp:syz0\x00'}, @TIPC_NLA_BEARER_DOMAIN={0x8, 0x3, 0x5}, @TIPC_NLA_BEARER_NAME={0xf, 0x1, @l2={'eth', 0x3a, 'dvmrp0\x00'}}, @TIPC_NLA_BEARER_UDP_OPTS={0x38, 0x4, {{0x20, 0x1, @in6={0xa, 0x4e23, 0x0, @private1={0xfc, 0x1, '\x00', 0x1}, 0x9}}, {0x14, 0x2, @in={0x2, 0x4e24, @dev={0xac, 0x14, 0x14, 0x41}}}}}, @TIPC_NLA_BEARER_UDP_OPTS={0x38, 0x4, {{0x20, 0x1, @in6={0xa, 0x4e20, 0x5, @mcast1, 0x7}}, {0x14, 0x2, @in={0x2, 0x4e23, @multicast2}}}}]}, @TIPC_NLA_BEARER={0x7c, 0x1, 0x0, 0x1, [@TIPC_NLA_BEARER_NAME={0xd, 0x1, @udp='udp:syz0\x00'}, @TIPC_NLA_BEARER_PROP={0x4c, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x1f}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0xb}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x3}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0xe}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x4cf15346}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x5}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0xf}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0xd}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x1ff}]}, @TIPC_NLA_BEARER_NAME={0x12, 0x1, @l2={'ib', 0x3a, 'ip6erspan0\x00'}}, @TIPC_NLA_BEARER_DOMAIN={0x8, 0x3, 0x4}]}]}, 0x234}, 0x1, 0x0, 0x0, 0x4000085}, 0x80) (async)
write$bt_hci(r3, &(0x7f0000000a80)={0x1, @role_discovery={{0x809, 0x2}, {0xc9}}}, 0x6) (async)
ioctl$BTRFS_IOC_SET_FEATURES(r3, 0x40309439, &(0x7f0000000ac0)={0x1, 0x1, 0x8})
r7 = openat$tun(0xffffffffffffff9c, &(0x7f0000000b00), 0x200000, 0x0)
ioctl$TUNATTACHFILTER(r7, 0x401054d5, &(0x7f0000000b80)={0x8, &(0x7f0000000b40)=[{0x401, 0x7, 0x0, 0x1ff}, {0x8, 0xee, 0x0, 0xa}, {0xb3b, 0xe, 0x2, 0xfffffffa}, {0x2, 0x4, 0x8}, {0xf, 0x80, 0x9, 0xaf0d}, {0x4, 0x9, 0x9, 0x3}, {0xd91, 0xa5, 0x9, 0x6}, {0x4, 0x7, 0x2}]}) (async)
r8 = syz_init_net_socket$llc(0x1a, 0x2, 0x0)
shutdown(r8, 0x1) (async)
socket$inet6_udplite(0xa, 0x2, 0x88)
bpf$BPF_GET_PROG_INFO(0xf, &(0x7f0000000e80)={r5, 0xe0, &(0x7f0000000d80)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, &(0x7f0000000bc0)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], ""/16, 0x0, 0x0, 0x0, 0x0, 0x5, 0x5, &(0x7f0000000c00)=[0x0, 0x0, 0x0, 0x0, 0x0], &(0x7f0000000c40)=[0x0, 0x0, 0x0, 0x0, 0x0], <r9=>0x0, 0x77, &(0x7f0000000c80)=[{}, {}], 0x10, 0x10, &(0x7f0000000cc0), &(0x7f0000000d00), 0x8, 0xbd, 0x8, 0x8, &(0x7f0000000d40)}}, 0x10) (async)
setsockopt$inet6_icmp_ICMP_FILTER(r2, 0x1, 0x1, &(0x7f0000000ec0)={0x4}, 0x4) (async)
getsockopt$inet_sctp6_SCTP_STATUS(r3, 0x84, 0xe, &(0x7f0000000f00)={<r10=>0x0, 0x1, 0x5, 0x8, 0x5, 0xf, 0x9, 0x63c9, {0x0, @in={{0x2, 0x4e22, @private=0xa010102}}, 0xb, 0x80, 0x3, 0x8001, 0x4}}, &(0x7f0000000fc0)=0xb0)
setsockopt$inet_sctp6_SCTP_AUTH_DEACTIVATE_KEY(r3, 0x84, 0x23, &(0x7f0000001000)={r10, 0x3ff}, 0x8)
clock_gettime(0x0, &(0x7f0000001100)={<r11=>0x0, <r12=>0x0})
pselect6(0x40, &(0x7f0000001040)={0x6, 0x4, 0x0, 0x7f, 0x4, 0xff, 0x7, 0x7}, &(0x7f0000001080)={0x9, 0x4, 0xa, 0x92, 0x100, 0x1, 0x6, 0x8}, &(0x7f00000010c0)={0x10, 0xffffffffffffffff, 0x7fffffff, 0x5, 0x4d, 0x1, 0x1, 0x1}, &(0x7f0000001140)={r11, r12+10000000}, &(0x7f00000011c0)={&(0x7f0000001180)={[0x45c]}, 0x8}) (async)
bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000001280)={{0x1, <r13=>0xffffffffffffffff}, &(0x7f0000001200), &(0x7f0000001240)}, 0x20)
bpf$PROG_LOAD(0x5, &(0x7f00000014c0)={0x5, 0xc, &(0x7f00000012c0)=@framed={{0x18, 0x0, 0x0, 0x0, 0x1}, [@ringbuf_output={{0x18, 0x1, 0x1, 0x0, r13}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0xa83b}, {}, {}, {}, {}, {0x7, 0x0, 0xb, 0x4, 0x0, 0x0, 0x1}}]}, &(0x7f0000001340)='syzkaller\x00', 0x9, 0x95, &(0x7f0000001380)=""/149, 0x41100, 0x20, '\x00', 0x0, @fallback=0x2d, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, &(0x7f0000001440)={0x5, 0xd, 0xfff, 0x2}, 0x10, r9, r3, 0x0, &(0x7f0000001480)=[r8, r5, r5], 0x0, 0x10, 0x8}, 0x94)

184.397µs ago: executing program 4 (id=6658):
bpf$PROG_LOAD(0x5, &(0x7f00000054c0)={0x4, 0x16, &(0x7f0000001000)=ANY=[@ANYBLOB="61128c000000000061134c0000000000bf20000000000000070000000f0000003d030100000000009500ffb1000000006926000000000000bf6720000000000036000b000fff52004507000015300000d60600000ee6ff80bf050000000000003d63000000000000650700000200000007070000fbffffff1f75000000000000bf54000000000000070000000410f900bd430100000000009500000000000000050000000000000095000000000000001c15a3ce747c693a74b62fd0758b15f09429c09074bc4b2bd2dc480dd7a064b8673e2060162cc43bcba1060999eef9d60bb39d0af449deaa27ea949e8f9000d885deea2783835e29eba8546fc020c1966f8b5f32b095f566edf66b7751828da9dbd5b996b9e8d897e461c01c697671d100000000400036c17fb01dde179c1f26cac1c7b21bde7d1a55d6ebe700b3be005e47ef55e0dd81244b18590e000000000000356d82e43407a6d7fa94b21002f06cd247b126b6349ab62d7b07ba0a71a72145edade9941f49f300a8c8913e0e4ea9e4c77740ab3312edee62a4dc2fc85755d387d8a1bc8eb71fbe11b2216cc8d1f0160c237d929b49d828724b95555b459f4763c6222175c974be2f76fb5f330b015a68587a75c013000000000000000000000003000000000000d6ddc46e58eff8f4fbadfc6a3af8123b7f4240713a4c0cdc9d7820c4eb67cc0f8b5fe9258eeacb5776aebbab3d5c55020000006082778366dadfc36029633e0514cbcee1f3928970bde148c940434f33acd377cbad17673b2d30b6339255c98eba97efb4e9ac1f11be815dd6045592edcbee7f253ec74c7c1313505bd7ff8fd58b3a6569c91dbdef1df585aeaea7346a2a65caee5c85f9eddeeeee3c8a2e523c864ac430eb47cb4d0c8767b9d4125661b5a1a170c04b64da3a99ddb93bf14fae3ca2d1e882375b8dbac83978e136c34f90b33cc0eeb57debcfe26589efc08125d5d62a7e593c9738a50171adf051ea4f07e7e7e770c2016eeacbe8511afffffbea75759a1ea5404f5453c0b5c46c9700808c096cf8cf5223f341cbea3841b5cd224c1b381d56afebe9f99a00e3cd94dc0bb7af9e8709db487cc4d9b3b96723d69d512ddd57b0dee9b9f6ae80a502cce352098603e77f9ecced07fa25e99e9e415414c91f8bfd1c150570512f26c4ee34a64c131dce3800000000000000006c86287945bd8d258442870e000000000000000000000000f7e6a10de4bf7369b0d5b5373829b09bf5b7b34099b27ac7770fca449d4c4ca15f88b588b2429af2e1d1a4e1fa44cb80fcfae6e50d7e5b4675d7e0be706224f34e6eed553b40e2b897e73752fc7d1e4b0f4c5967eefd7448d5fde5841fa464a67267c631052bd7333769a4b8d19d4794357edce762e8136ab9d7ed34a72baffd849b90579b96b3"], &(0x7f0000000100)='GPL\x00'}, 0x48)
r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='memory.events\x00', 0x275a, 0x0)
r1 = socket$nl_generic(0x10, 0x3, 0x10)
r2 = syz_genetlink_get_family_id$devlink(&(0x7f00000001c0), r1)
sendmsg$DEVLINK_CMD_RATE_SET(r1, &(0x7f00000005c0)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000140)={0x3c, r2, 0x1, 0x0, 0x0, {0x2a}, [@DEVLINK_ATTR_PORT_INDEX={0x8, 0x58}, @handle=@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}]}, 0x3c}, 0x1, 0x0, 0x0, 0x4001}, 0x0)
r3 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendmsg$NFT_BATCH(r3, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000340)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0)
sendmsg$NFT_BATCH(r3, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000400)={{0x14}, [@NFT_MSG_DELTABLE={0x20, 0x2, 0xa, 0x101, 0x0, 0x0, {0x2, 0x0, 0xd058}, [@NFTA_TABLE_NAME={0x9, 0x1, 'syz0\x00'}]}], {0x14}}, 0x48}, 0x1, 0x0, 0x0, 0x4000040}, 0x0)
write$cgroup_subtree(r0, &(0x7f0000000100)=ANY=[], 0x32600)
r4 = socket$rxrpc(0x21, 0x2, 0x2)
connect$rxrpc(r4, &(0x7f0000000240)=@in6={0x21, 0x9, 0x2, 0x6, {0xa, 0x4e24, 0xe4e, @loopback, 0x3}}, 0x24)
mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x2000001, 0x12, r0, 0x0)
setsockopt$inet6_tcp_buf(r0, 0x6, 0x21, &(0x7f0000000000)="089946dabf1c07d3839f2925e808", 0xe)
bpf$PROG_LOAD(0x5, &(0x7f00000054c0)={0x4, 0x16, &(0x7f0000001000)=ANY=[@ANYBLOB="61128c000000000061134c0000000000bf20000000000000070000000f0000003d030100000000009500ffb1000000006926000000000000bf6720000000000036000b000fff52004507000015300000d60600000ee6ff80bf050000000000003d63000000000000650700000200000007070000fbffffff1f75000000000000bf54000000000000070000000410f900bd430100000000009500000000000000050000000000000095000000000000001c15a3ce747c693a74b62fd0758b15f09429c09074bc4b2bd2dc480dd7a064b8673e2060162cc43bcba1060999eef9d60bb39d0af449deaa27ea949e8f9000d885deea2783835e29eba8546fc020c1966f8b5f32b095f566edf66b7751828da9dbd5b996b9e8d897e461c01c697671d100000000400036c17fb01dde179c1f26cac1c7b21bde7d1a55d6ebe700b3be005e47ef55e0dd81244b18590e000000000000356d82e43407a6d7fa94b21002f06cd247b126b6349ab62d7b07ba0a71a72145edade9941f49f300a8c8913e0e4ea9e4c77740ab3312edee62a4dc2fc85755d387d8a1bc8eb71fbe11b2216cc8d1f0160c237d929b49d828724b95555b459f4763c6222175c974be2f76fb5f330b015a68587a75c013000000000000000000000003000000000000d6ddc46e58eff8f4fbadfc6a3af8123b7f4240713a4c0cdc9d7820c4eb67cc0f8b5fe9258eeacb5776aebbab3d5c55020000006082778366dadfc36029633e0514cbcee1f3928970bde148c940434f33acd377cbad17673b2d30b6339255c98eba97efb4e9ac1f11be815dd6045592edcbee7f253ec74c7c1313505bd7ff8fd58b3a6569c91dbdef1df585aeaea7346a2a65caee5c85f9eddeeeee3c8a2e523c864ac430eb47cb4d0c8767b9d4125661b5a1a170c04b64da3a99ddb93bf14fae3ca2d1e882375b8dbac83978e136c34f90b33cc0eeb57debcfe26589efc08125d5d62a7e593c9738a50171adf051ea4f07e7e7e770c2016eeacbe8511afffffbea75759a1ea5404f5453c0b5c46c9700808c096cf8cf5223f341cbea3841b5cd224c1b381d56afebe9f99a00e3cd94dc0bb7af9e8709db487cc4d9b3b96723d69d512ddd57b0dee9b9f6ae80a502cce352098603e77f9ecced07fa25e99e9e415414c91f8bfd1c150570512f26c4ee34a64c131dce3800000000000000006c86287945bd8d258442870e000000000000000000000000f7e6a10de4bf7369b0d5b5373829b09bf5b7b34099b27ac7770fca449d4c4ca15f88b588b2429af2e1d1a4e1fa44cb80fcfae6e50d7e5b4675d7e0be706224f34e6eed553b40e2b897e73752fc7d1e4b0f4c5967eefd7448d5fde5841fa464a67267c631052bd7333769a4b8d19d4794357edce762e8136ab9d7ed34a72baffd849b90579b96b3"], &(0x7f0000000100)='GPL\x00'}, 0x48) (async)
openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='memory.events\x00', 0x275a, 0x0) (async)
socket$nl_generic(0x10, 0x3, 0x10) (async)
syz_genetlink_get_family_id$devlink(&(0x7f00000001c0), r1) (async)
sendmsg$DEVLINK_CMD_RATE_SET(r1, &(0x7f00000005c0)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000140)={0x3c, r2, 0x1, 0x0, 0x0, {0x2a}, [@DEVLINK_ATTR_PORT_INDEX={0x8, 0x58}, @handle=@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}]}, 0x3c}, 0x1, 0x0, 0x0, 0x4001}, 0x0) (async)
socket$nl_netfilter(0x10, 0x3, 0xc) (async)
sendmsg$NFT_BATCH(r3, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000340)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0) (async)
sendmsg$NFT_BATCH(r3, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000400)={{0x14}, [@NFT_MSG_DELTABLE={0x20, 0x2, 0xa, 0x101, 0x0, 0x0, {0x2, 0x0, 0xd058}, [@NFTA_TABLE_NAME={0x9, 0x1, 'syz0\x00'}]}], {0x14}}, 0x48}, 0x1, 0x0, 0x0, 0x4000040}, 0x0) (async)
write$cgroup_subtree(r0, &(0x7f0000000100)=ANY=[], 0x32600) (async)
socket$rxrpc(0x21, 0x2, 0x2) (async)
connect$rxrpc(r4, &(0x7f0000000240)=@in6={0x21, 0x9, 0x2, 0x6, {0xa, 0x4e24, 0xe4e, @loopback, 0x3}}, 0x24) (async)
mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x2000001, 0x12, r0, 0x0) (async)
setsockopt$inet6_tcp_buf(r0, 0x6, 0x21, &(0x7f0000000000)="089946dabf1c07d3839f2925e808", 0xe) (async)

0s ago: executing program 4 (id=6659):
sendmsg$IPCTNL_MSG_CT_GET(0xffffffffffffffff, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={0x0}, 0x1, 0x0, 0x0, 0x8c0}, 0x0) (async)
sendmsg$netlink(0xffffffffffffffff, &(0x7f00000047c0)={0x0, 0x0, &(0x7f0000000e40)=[{&(0x7f0000000200)=ANY=[@ANYBLOB="180000007a00010600000000fbdbdf2507"], 0x18}], 0x1, 0x0, 0x0, 0x4000050}, 0x80) (async)
sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000200)=ANY=[], 0xa0}}, 0x0) (async)
r0 = socket(0x10, 0x3, 0x0)
sendmmsg(r0, &(0x7f0000000000), 0x4000000000001f2, 0x0)
r1 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) (async)
socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff, <r2=>0xffffffffffffffff}) (async)
r3 = syz_init_net_socket$ax25(0x3, 0x2, 0x0)
bind$ax25(r3, &(0x7f0000000100)={{0x3, @default, 0x1}, [@default, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @null, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @bcast, @default, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x2}, @null]}, 0x48) (async)
ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000000)={'batadv_slave_0\x00'})
r4 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2)
setsockopt$ax25_SO_BINDTODEVICE(0xffffffffffffffff, 0x101, 0x19, &(0x7f0000000000)=@bpq0, 0x10) (async)
ioctl$sock_netdev_private(r4, 0x8914, &(0x7f0000000000)) (async)
syz_init_net_socket$ax25(0x3, 0x2, 0xcc)
ioctl$sock_netrom_SIOCADDRT(0xffffffffffffffff, 0x890b, &(0x7f0000000000)={0x0, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @bpq0, 0x1, 'syz0\x00', @default, 0x1, 0x0, [@null, @default, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @bcast, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x3}, @default, @default]}) (async)
setsockopt$ax25_SO_BINDTODEVICE(0xffffffffffffffff, 0x101, 0x19, &(0x7f0000000000)=@bpq0, 0xfffffffffffffe1d) (async)
ioctl$sock_netdev_private(r1, 0x8914, &(0x7f0000000000))

kernel console output (not intermixed with test programs):

tive IBSS STAs - trying to scan for other IBSS networks with same SSID (merge)
[  282.675655][T20089] syzkaller1: entered promiscuous mode
[  282.677445][T20089] syzkaller1: entered allmulticast mode
[  282.941296][T20112] bridge10: entered promiscuous mode
[  284.204271][T20154] A link change request failed with some changes committed already. Interface ip6gretap0 may have been left with an inconsistent configuration, please check.
[  284.230857][T20143] Bluetooth: hci2: Opcode 0x0401 failed: -4
[  284.508437][T20171] syzkaller1: tun_chr_ioctl cmd 1074025672
[  284.510322][T20171] syzkaller1: ignored: set checksum disabled
[  284.599166][T20178] vlan0: entered promiscuous mode
[  284.600894][T20178] bridge0: entered promiscuous mode
[  284.853296][T20184] xt_TCPMSS: path-MTU clamping only supported in FORWARD, OUTPUT and POSTROUTING hooks
[  285.024483][T20194] __nla_validate_parse: 20 callbacks suppressed
[  285.024494][T20194] netlink: 260 bytes leftover after parsing attributes in process `syz.0.4352'.
[  285.029218][T20194] netlink: 260 bytes leftover after parsing attributes in process `syz.0.4352'.
[  285.086268][T20198] validate_nla: 6 callbacks suppressed
[  285.086278][T20198] netlink: 'syz.2.4354': attribute type 3 has an invalid length.
[  285.418972][T20227] netlink: 28 bytes leftover after parsing attributes in process `syz.1.4365'.
[  285.438852][T20229] syzkaller1: entered promiscuous mode
[  285.440690][T20229] syzkaller1: entered allmulticast mode
[  285.447172][T20229] netlink: 36 bytes leftover after parsing attributes in process `syz.2.4366'.
[  285.451756][T20229] netlink: 'syz.2.4366': attribute type 10 has an invalid length.
[  285.455216][T20229] netlink: 28 bytes leftover after parsing attributes in process `syz.2.4366'.
[  285.471715][   T55] Bluetooth: hci2: command 0x0419 tx timeout
[  285.519269][T20227] 8021q: adding VLAN 0 to HW filter on device bond27
[  285.537503][T20227] veth7: entered promiscuous mode
[  285.587171][T20227] erspan0: entered allmulticast mode
[  285.619090][T20237] ipt_REJECT: TCP_RESET invalid for non-tcp
[  285.784624][T20253] bond16: (slave bridge0): Releasing active interface
[  285.827653][T20257] netlink: 76 bytes leftover after parsing attributes in process `syz.0.4372'.
[  285.830341][T20257] netlink: 76 bytes leftover after parsing attributes in process `syz.0.4372'.
[  285.836594][T20254] netlink: 8 bytes leftover after parsing attributes in process `syz.1.4371'.
[  285.847220][T20254] PF_CAN: dropped non conform CAN FD skbuff: dev type 65534, len 4300
[  285.855279][   T33] audit: type=1800 audit(1753037268.679:12): pid=20254 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.1.4371" name="blkio.bfq.time_recursive" dev="tmpfs" ino=7422 res=0 errno=0
[  285.879613][T20259] netlink: 'syz.0.4373': attribute type 58 has an invalid length.
[  285.882216][T20259] netlink: 20 bytes leftover after parsing attributes in process `syz.0.4373'.
[  285.939030][T20263] smc: ib device syz1 ibport 1 applied user defined pnetid SYZ1
[  286.682833][T20270] netlink: 36 bytes leftover after parsing attributes in process `syz.2.4378'.
[  286.887018][T20286] netlink: 'syz.0.4384': attribute type 58 has an invalid length.
[  286.943901][T20289] netlink: 'syz.0.4385': attribute type 22 has an invalid length.
[  287.045013][T20305] xt_policy: too many policy elements
[  287.186116][T20328] netlink: 'syz.2.4398': attribute type 7 has an invalid length.
[  287.444643][T20367] openvswitch: netlink: Actions may not be safe on all matching packets
[  287.447596][T20368] netlink: 'syz.2.4407': attribute type 4 has an invalid length.
[  287.669427][T20384] syzkaller1: entered promiscuous mode
[  287.671418][T20384] syzkaller1: entered allmulticast mode
[  287.845287][T20415] netlink: 'syz.2.4421': attribute type 14 has an invalid length.
[  287.848745][T20415] netlink: 'syz.2.4421': attribute type 14 has an invalid length.
[  287.939465][T20421] tipc: Enabling of bearer <eth:syzkaller0> rejected, max 3 bearers permitted
[  287.942772][T20421] syzkaller0: entered promiscuous mode
[  287.944466][T20421] syzkaller0: entered allmulticast mode
[  288.513154][T20444] netlink: 'syz.0.4430': attribute type 32 has an invalid length.
[  288.522125][T20444] (unnamed net_device) (uninitialized): Setting coupled_control to off (0)
[  290.165510][T20512] validate_nla: 1 callbacks suppressed
[  290.165520][T20512] netlink: 'syz.0.4452': attribute type 11 has an invalid length.
[  290.211277][T20516] netlink: 'syz.2.4454': attribute type 282 has an invalid length.
[  290.294929][T20527] netlink: 'syz.2.4458': attribute type 14 has an invalid length.
[  290.494837][T20530] tipc: Enabled bearer <eth:syzkaller0>, priority 0
[  290.497519][T20530] syzkaller0: entered promiscuous mode
[  290.499293][T20530] syzkaller0: entered allmulticast mode
[  290.511828][T20530] tipc: Resetting bearer <eth:syzkaller0>
[  290.672473][T20543] IPVS: nq: UDP 224.0.0.2:0 - no destination available
[  290.709455][T20547] netlink: 'syz.0.4466': attribute type 58 has an invalid length.
[  290.714828][T20547] __nla_validate_parse: 14 callbacks suppressed
[  290.714852][T20547] netlink: 20 bytes leftover after parsing attributes in process `syz.0.4466'.
[  290.834860][T20560] IPVS: set_ctl: invalid protocol: 47 224.0.0.1:20003
[  291.009097][T20570] netlink: 4 bytes leftover after parsing attributes in process `syz.0.4473'.
[  291.036140][   T33] audit: type=1800 audit(1753037273.859:13): pid=20558 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.1.4469" name="cgroup.controllers" dev="tmpfs" ino=7555 res=0 errno=0
[  291.058594][T20574] IPVS: nq: UDP 224.0.0.2:0 - no destination available
[  291.113741][T20578] x_tables: duplicate underflow at hook 2
[  291.154025][T20581] netlink: 260 bytes leftover after parsing attributes in process `syz.1.4477'.
[  291.213297][T20529] tipc: Resetting bearer <eth:syzkaller0>
[  291.230035][T20529] tipc: Disabling bearer <eth:syzkaller0>
[  291.317021][T20596] netlink: 'syz.0.4481': attribute type 58 has an invalid length.
[  291.330728][T20596] netlink: 20 bytes leftover after parsing attributes in process `syz.0.4481'.
[  291.367105][T20604] netlink: 'syz.0.4485': attribute type 23 has an invalid length.
[  291.405339][T20607] sch_tbf: burst 0 is lower than device vlan0 mtu (1514) !
[  291.423541][T20608] syzkaller0: entered promiscuous mode
[  291.425296][T20608] syzkaller0: entered allmulticast mode
[  291.545940][T20628] netlink: 52 bytes leftover after parsing attributes in process `syz.1.4492'.
[  291.869131][T20647] IPVS: rr: UDP 224.0.0.2:0 - no destination available
[  292.229643][T20654] netlink: 8 bytes leftover after parsing attributes in process `syz.2.4500'.
[  292.355390][T20667] openvswitch: netlink: Unknown key attributes 2
[  292.371963][T20667] smc: net device bond0 applied user defined pnetid SYZ2
[  292.374419][T20667] netlink: 14 bytes leftover after parsing attributes in process `syz.0.4504'.
[  292.386573][T20667]  (unregistering): Released all slaves
[  292.537221][T20673] netlink: 8 bytes leftover after parsing attributes in process `syz.2.4507'.
[  292.545654][T20675] netlink: 'syz.0.4508': attribute type 62 has an invalid length.
[  292.636385][T20685] netlink: 996 bytes leftover after parsing attributes in process `syz.2.4513'.
[  292.855047][T20702] rdma_op ffff888020c4b1f0 conn xmit_rdma 0000000000000000
[  292.938540][T20711] IPVS: nq: UDP 224.0.0.2:0 - no destination available
[  292.975658][T20714] netlink: 20 bytes leftover after parsing attributes in process `syz.2.4523'.
[  295.409306][ T5281] udevd[5281]: worker [15189] /devices/virtual/block/nbd2 is taking a long time
[  296.114950][ T1146] block nbd0: Possible stuck request ffff888022928000: control (read@0,4096B). Runtime 60 seconds
[  298.417534][ T5281] udevd[5281]: worker [16054] /devices/virtual/block/nbd0 is taking a long time
[  303.162038][   T62] block nbd2: Possible stuck request ffff888022980000: control (read@0,1024B). Runtime 90 seconds
[  303.166277][   T62] block nbd2: Possible stuck request ffff888022980200: control (read@1024,1024B). Runtime 90 seconds
[  303.170489][   T62] block nbd2: Possible stuck request ffff888022980400: control (read@2048,1024B). Runtime 90 seconds
[  303.174751][   T62] block nbd2: Possible stuck request ffff888022980600: control (read@3072,1024B). Runtime 90 seconds
[  314.682341][ T1087] wlan0: No active IBSS STAs - trying to scan for other IBSS networks with same SSID (merge)
[  317.945140][T20753] veth0_to_bridge: entered promiscuous mode
[  317.948662][T20753] syzkaller1: entered promiscuous mode
[  317.950338][T20753] syzkaller1: entered allmulticast mode
[  317.961795][T20752] veth0_to_bridge: left promiscuous mode
[  318.030881][T20766] __nla_validate_parse: 1 callbacks suppressed
[  318.030892][T20766] netlink: 4 bytes leftover after parsing attributes in process `syz.2.4538'.
[  318.093853][T20771] openvswitch: netlink: Flow actions may not be safe on all matching packets.
[  318.100551][T20771] netlink: 'syz.0.4540': attribute type 8 has an invalid length.
[  318.104845][T20771] xt_connbytes: Forcing CT accounting to be enabled
[  318.106799][T20771] x_tables: ip6_tables: SNPT target: used from hooks OUTPUT, but only usable from INPUT/POSTROUTING
[  318.154575][T20780] netlink: 'syz.0.4542': attribute type 1 has an invalid length.
[  318.184430][T20780] 8021q: adding VLAN 0 to HW filter on device bond19
[  318.198509][T20780] bond19: (slave bridge7): making interface the new active one
[  318.205309][T20780] bond19: (slave bridge7): Enslaving as an active interface with an up link
[  318.247658][T20780] gretap3: entered promiscuous mode
[  318.251245][T20780] bond19: (slave gretap3): Enslaving as an active interface with an up link
[  318.259255][T20786] netlink: 'syz.1.4543': attribute type 58 has an invalid length.
[  318.261912][T20786] netlink: 20 bytes leftover after parsing attributes in process `syz.1.4543'.
[  318.275145][T20780] macvlan0: entered promiscuous mode
[  318.276867][T20780] macvlan0: entered allmulticast mode
[  318.279040][T20780] bond19: entered promiscuous mode
[  318.280648][T20780] bridge7: entered promiscuous mode
[  318.284391][T20780] 8021q: adding VLAN 0 to HW filter on device macvlan0
[  318.287073][T20780] bond19: (slave macvlan0): the slave hw address is in use by the bond; couldn't find a slave with a free hw address to give it (this should not have happened)
[  318.292920][T20780] bond19: left promiscuous mode
[  318.294530][T20780] bridge7: left promiscuous mode
[  318.339040][T20789] netlink: 8 bytes leftover after parsing attributes in process `syz.1.4544'.
[  318.406489][T20798] Can not set IPV6_FL_F_REFLECT if flowlabel_consistency sysctl is enable
[  318.469939][T20806] lo speed is unknown, defaulting to 1000
[  318.493031][T20812] openvswitch: netlink: IP tunnel dst address not specified
[  318.695262][T20825] netlink: 32 bytes leftover after parsing attributes in process `syz.1.4553'.
[  318.698352][T20825] netlink: 32 bytes leftover after parsing attributes in process `syz.1.4553'.
[  318.701736][T20825] netlink: 32 bytes leftover after parsing attributes in process `syz.1.4553'.
[  318.705459][T20825] netlink: 32 bytes leftover after parsing attributes in process `syz.1.4553'.
[  318.712960][T20825] netlink: 32 bytes leftover after parsing attributes in process `syz.1.4553'.
[  318.720699][T20825] netlink: 32 bytes leftover after parsing attributes in process `syz.1.4553'.
[  318.734467][T20825] netlink: 32 bytes leftover after parsing attributes in process `syz.1.4553'.
[  319.056911][T20840] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check.
[  319.266477][T20850] team0: Port device batadv1 removed
[  319.269819][T20850] bond19: (slave bridge7): Releasing active interface
[  319.276421][T20850] bond19: (slave bridge7): the permanent HWaddr of slave - 9a:b3:5c:7c:a4:1f - is still in use by bond - set the HWaddr of slave to a different address to avoid conflicts
[  319.284400][T20850] bond19: (slave gretap3): making interface the new active one
[  319.300423][T20850] bond19: (slave gretap3): Releasing active interface
[  319.502019][T20866] gtp3: entered promiscuous mode
[  319.503599][T20866] gtp3: entered allmulticast mode
[  319.515697][T20871] netlink: 'syz.0.4565': attribute type 58 has an invalid length.
[  319.587935][T20881] netlink: 'syz.2.4568': attribute type 29 has an invalid length.
[  319.625237][T20881] sctp: [Deprecated]: syz.2.4568 (pid 20881) Use of int in max_burst socket option deprecated.
[  319.625237][T20881] Use struct sctp_assoc_value instead
[  319.721124][T20888] lo speed is unknown, defaulting to 1000
[  319.854801][T20895] netlink: 'syz.1.4573': attribute type 58 has an invalid length.
[  321.088792][T20920] netlink: 'syz.1.4581': attribute type 1 has an invalid length.
[  321.112010][T20921] lo speed is unknown, defaulting to 1000
[  321.551978][T20946] IPVS: length: 148 != 24
[  321.578874][T20943] netlink: 'syz.2.4587': attribute type 1 has an invalid length.
[  321.583685][T20943] tipc: Enabled bearer <eth:syzkaller0>, priority 0
[  321.586170][T20943] syzkaller0: entered promiscuous mode
[  321.587873][T20943] syzkaller0: entered allmulticast mode
[  321.593802][T20942] tipc: Resetting bearer <eth:syzkaller0>
[  321.607647][T20942] tipc: Disabling bearer <eth:syzkaller0>
[  321.803481][T20964] SET target dimension over the limit!
[  321.826778][T20966] openvswitch: netlink: Unknown key attributes 2
[  321.977114][T20979] netlink: 'syz.0.4599': attribute type 7 has an invalid length.
[  321.979539][T20979] netlink: 'syz.0.4599': attribute type 8 has an invalid length.
[  322.444161][T21026] syzkaller0: entered promiscuous mode
[  322.446885][T21026] syzkaller0: entered allmulticast mode
[  322.544699][T21036] ip6tnl3: entered promiscuous mode
[  322.546494][T21036] ip6tnl3: entered allmulticast mode
[  322.902710][T21084] tipc: Enabled bearer <eth:syzkaller0>, priority 0
[  322.905128][T21084] syzkaller0: entered promiscuous mode
[  322.906844][T21084] syzkaller0: entered allmulticast mode
[  322.913419][T21084] tipc: Resetting bearer <eth:syzkaller0>
[  322.916469][T21083] tipc: Resetting bearer <eth:syzkaller0>
[  322.929825][T21083] tipc: Disabling bearer <eth:syzkaller0>
[  322.997948][T21090] SET target dimension over the limit!
[  323.000318][T21090] xt_TCPMSS: Only works on TCP SYN packets
[  323.097052][T21101] lo speed is unknown, defaulting to 1000
[  323.128357][T21102] __nla_validate_parse: 20 callbacks suppressed
[  323.128369][T21102] netlink: 12 bytes leftover after parsing attributes in process `syz.2.4636'.
[  323.135368][T21102] netlink: 12 bytes leftover after parsing attributes in process `syz.2.4636'.
[  323.661169][T21116] netlink: 28 bytes leftover after parsing attributes in process `syz.2.4641'.
[  323.666942][T21116] xt_TPROXY: Can be used only with -p tcp or -p udp
[  323.944934][T21129] netlink: 16178 bytes leftover after parsing attributes in process `syz.2.4645'.
[  325.077233][T21152] TCP: TCP_TX_DELAY enabled
[  325.083312][T21152] netlink: 4 bytes leftover after parsing attributes in process `syz.0.4651'.
[  325.192609][T21166] validate_nla: 6 callbacks suppressed
[  325.192619][T21166] netlink: 'syz.1.4658': attribute type 1 has an invalid length.
[  325.197242][T21166] netlink: 224 bytes leftover after parsing attributes in process `syz.1.4658'.
[  325.338707][T21181] netlink: 16 bytes leftover after parsing attributes in process `syz.0.4661'.
[  325.417217][T21188] netlink: 8 bytes leftover after parsing attributes in process `syz.0.4664'.
[  325.563530][T21205] netlink: 8 bytes leftover after parsing attributes in process `syz.1.4668'.
[  325.566369][T21205] netlink: 4 bytes leftover after parsing attributes in process `syz.1.4668'.
[  326.107649][T21258] syzkaller0: entered promiscuous mode
[  326.109418][T21258] syzkaller0: entered allmulticast mode
[  326.194791][ T1146] block nbd0: Possible stuck request ffff888022928000: control (read@0,4096B). Runtime 90 seconds
[  327.175744][T21261] netlink: 'syz.2.4689': attribute type 3 has an invalid length.
[  327.450544][T21297] 8021q: adding VLAN 0 to HW filter on device bond20
[  328.479714][T21325] __nla_validate_parse: 11 callbacks suppressed
[  328.479724][T21325] netlink: 4 bytes leftover after parsing attributes in process `syz.2.4706'.
[  328.491421][T21333] wg2: entered promiscuous mode
[  328.493510][T21333] wg2: entered allmulticast mode
[  328.596583][T21337] netlink: 12 bytes leftover after parsing attributes in process `syz.0.4709'.
[  328.602940][T21346] netlink: 12 bytes leftover after parsing attributes in process `syz.1.4711'.
[  328.639836][T21351] netlink: 36 bytes leftover after parsing attributes in process `syz.1.4713'.
[  328.644545][T21349] netlink: 'syz.2.4712': attribute type 58 has an invalid length.
[  328.647091][T21349] netlink: 20 bytes leftover after parsing attributes in process `syz.2.4712'.
[  328.770549][T21365] netlink: 12 bytes leftover after parsing attributes in process `syz.1.4719'.
[  328.774962][T21361] netlink: 56 bytes leftover after parsing attributes in process `syz.0.4718'.
[  328.780128][T21361] netlink: 19 bytes leftover after parsing attributes in process `syz.0.4718'.
[  328.784633][T21361] netlink: 19 bytes leftover after parsing attributes in process `syz.0.4718'.
[  328.809797][T21367] netlink: 20 bytes leftover after parsing attributes in process `syz.2.4720'.
[  329.124703][T21399] nbd: must specify an index to disconnect
[  329.246215][T21415] IPv6: sit3: Disabled Multicast RS
[  329.249390][T21415] sit3: entered allmulticast mode
[  329.284654][T21427] af_packet: tpacket_rcv: packet too big, clamped from 36 to 4294967272. macoff=96
[  329.354133][T21427] netlink: 'syz.1.4738': attribute type 1 has an invalid length.
[  329.400769][T21436] tipc: Enabling of bearer <eth:syzkaller0> rejected, max 3 bearers permitted
[  329.409308][T21436] syzkaller0: entered promiscuous mode
[  329.412017][T21436] syzkaller0: entered allmulticast mode
[  329.471230][T21452] netlink: 'syz.1.4746': attribute type 1 has an invalid length.
[  329.474078][T21452] openvswitch: netlink: Flow actions may not be safe on all matching packets.
[  329.541612][T21457] netlink: 'syz.1.4747': attribute type 1 has an invalid length.
[  330.758780][T21535] netlink: 'syz.1.4773': attribute type 2 has an invalid length.
[  331.619850][T21544] xt_physdev: --physdev-out and --physdev-is-out only supported in the FORWARD and POSTROUTING chains with bridged traffic
[  331.750007][T21567] netlink: 'syz.2.4782': attribute type 2 has an invalid length.
[  331.759528][T21567] : entered promiscuous mode
[  331.900000][T21587] atomic_op ffff888031b92998 conn xmit_atomic 0000000000000000
[  332.073381][T21606] tipc: Enabling of bearer <eth:syzkaller0> rejected, already enabled
[  332.077736][T21606] syzkaller0: MTU too low for tipc bearer
[  332.079476][T21606] tipc: Disabling bearer <eth:syzkaller0>
[  332.852782][    T9] hid-generic 0005:0C45:1012.0003: item fetching failed at offset 0/1
[  332.860397][    T9] hid-generic 0005:0C45:1012.0003: probe with driver hid-generic failed with error -22
[  333.156288][T21643] x_tables: duplicate underflow at hook 3
[  333.199179][T21647] netlink: 'syz.0.4808': attribute type 58 has an invalid length.
[  333.246298][   T62] block nbd2: Possible stuck request ffff888022980000: control (read@0,1024B). Runtime 120 seconds
[  333.249590][   T62] block nbd2: Possible stuck request ffff888022980200: control (read@1024,1024B). Runtime 120 seconds
[  333.254510][   T62] block nbd2: Possible stuck request ffff888022980400: control (read@2048,1024B). Runtime 120 seconds
[  333.257890][   T62] block nbd2: Possible stuck request ffff888022980600: control (read@3072,1024B). Runtime 120 seconds
[  333.279045][T21651] 8021q: adding VLAN 0 to HW filter on device team0
[  333.285523][T21651] !: left promiscuous mode
[  333.286941][T21651] !: left allmulticast mode
[  333.289753][T21651] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check.
[  333.297752][T21655] netlink: 'syz.0.4811': attribute type 32 has an invalid length.
[  333.331756][    T9] ip6_tunnel: ip6gretap0 xmit: Local address not yet configured!
[  333.355182][   T13] ip6_tunnel: ip6gretap0 xmit: Local address not yet configured!
[  333.523417][T21670] netlink: 'syz.2.4816': attribute type 58 has an invalid length.
[  333.525803][T21670] __nla_validate_parse: 41 callbacks suppressed
[  333.525811][T21670] netlink: 20 bytes leftover after parsing attributes in process `syz.2.4816'.
[  333.530467][T21670] netlink: 20 bytes leftover after parsing attributes in process `syz.2.4816'.
[  333.532671][    T9] ip6_tunnel: ip6gretap0 xmit: Local address not yet configured!
[  333.636061][T21674] lo speed is unknown, defaulting to 1000
[  334.136745][T21691] checksum_tg_check: 1 callbacks suppressed
[  334.136756][T21691] xt_CHECKSUM: unsupported CHECKSUM operation 68
[  334.187028][T21691] lo speed is unknown, defaulting to 1000
[  334.431936][ T5872] ip6_tunnel: ip6gretap0 xmit: Local address not yet configured!
[  334.434519][ T5872] ip6_tunnel: ip6gretap0 xmit: Local address not yet configured!
[  334.601272][T21704] netlink: 5 bytes leftover after parsing attributes in process `syz.2.4824'.
[  334.606664][T21704] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check.
[  334.656668][T21704] netlink: 5 bytes leftover after parsing attributes in process `syz.2.4824'.
[  334.660295][T21704] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check.
[  335.471761][T10237] ip6_tunnel: ip6gretap0 xmit: Local address not yet configured!
[  335.563540][T21718] ip6gre3: entered allmulticast mode
[  335.627558][T21723] netlink: 8 bytes leftover after parsing attributes in process `syz.2.4830'.
[  335.644983][T21729] netlink: 20 bytes leftover after parsing attributes in process `syz.1.4832'.
[  335.693980][T21723] syzkaller1: entered promiscuous mode
[  335.702107][T21723] syzkaller1: entered allmulticast mode
[  335.738702][T21738] lo speed is unknown, defaulting to 1000
[  335.756201][T21735] netlink: 4 bytes leftover after parsing attributes in process `syz.0.4834'.
[  335.760020][T21736] netlink: 4 bytes leftover after parsing attributes in process `syz.0.4834'.
[  336.201699][ T5222] Bluetooth: hci2: command 0x0419 tx timeout
[  336.597531][T21749] lo speed is unknown, defaulting to 1000
[  336.859697][T21758] netlink: 20 bytes leftover after parsing attributes in process `syz.0.4838'.
[  337.013951][T21764] netlink: 8 bytes leftover after parsing attributes in process `syz.0.4840'.
[  337.342541][T21776] netlink: 'syz.0.4843': attribute type 58 has an invalid length.
[  337.395915][T21779] pim6reg1: entered allmulticast mode
[  337.455511][T21780] netlink: 'syz.0.4844': attribute type 7 has an invalid length.
[  337.549349][T21782] netlink: 'syz.1.4845': attribute type 11 has an invalid length.
[  337.553850][T21782] netlink: 'syz.1.4845': attribute type 11 has an invalid length.
[  337.660147][T21790] lo speed is unknown, defaulting to 1000
[  337.663843][T21793] netlink: 'syz.2.4848': attribute type 1 has an invalid length.
[  337.669167][T21795] netlink: 'syz.2.4848': attribute type 1 has an invalid length.
[  337.983792][T21794] netlink: 'syz.1.4847': attribute type 2 has an invalid length.
[  338.121037][T21810] netlink: 'syz.2.4852': attribute type 12 has an invalid length.
[  338.173674][T21811] netlink: 'syz.2.4852': attribute type 12 has an invalid length.
[  338.347081][T21817] (unnamed net_device) (uninitialized): option ad_user_port_key: invalid value (65535)
[  338.350206][T21817] (unnamed net_device) (uninitialized): option ad_user_port_key: allowed values 0 - 1023
[  338.450954][T21824] IPVS: nq: UDP 224.0.0.2:0 - no destination available
[  338.626225][T21838] __nla_validate_parse: 5 callbacks suppressed
[  338.626237][T21838] netlink: 4 bytes leftover after parsing attributes in process `syz.2.4860'.
[  338.751033][T21843] lo speed is unknown, defaulting to 1000
[  338.753213][    C0] ip6_tunnel: ip6gretap0 xmit: Local address not yet configured!
[  338.879564][T21851] tipc: Enabling of bearer <eth:syzkaller0> rejected, max 3 bearers permitted
[  338.944932][T21861] pim6reg: mtu greater than device maximum
[  339.151881][   T55] Bluetooth: hci0: Opcode 0x0c03 failed: -110
[  339.366171][T21884] netlink: 76 bytes leftover after parsing attributes in process `syz.1.4869'.
[  339.630655][T21907] netlink: 'syz.0.4879': attribute type 4 has an invalid length.
[  339.666620][T21908] syzkaller1: entered promiscuous mode
[  339.668763][T21908] syzkaller1: entered allmulticast mode
[  339.768796][T21914] netlink: 'syz.0.4882': attribute type 58 has an invalid length.
[  339.773536][T21914] netlink: 20 bytes leftover after parsing attributes in process `syz.0.4882'.
[  339.815733][T21916] netlink: 16 bytes leftover after parsing attributes in process `syz.0.4883'.
[  340.148131][T21944] netlink: 212376 bytes leftover after parsing attributes in process `syz.0.4890'.
[  340.153178][T21944] netlink: 24 bytes leftover after parsing attributes in process `syz.0.4890'.
[  340.212242][T21950] xt_addrtype: input interface limitation not valid in POSTROUTING and OUTPUT
[  340.278331][T21956] 0: A HSR master's MTU cannot be greater than the smallest MTU of its slaves minus the HSR Tag length (6 octets).
[  340.356642][T21960] mac80211_hwsim hwsim4 syzkaller0: entered promiscuous mode
[  340.359107][T21960] mac80211_hwsim hwsim4 syzkaller0: entered allmulticast mode
[  340.381962][T21962] netlink: 212376 bytes leftover after parsing attributes in process `syz.1.4899'.
[  340.448100][T21968] netlink: 24 bytes leftover after parsing attributes in process `syz.0.4902'.
[  340.451426][T21968] netlink: 28 bytes leftover after parsing attributes in process `syz.0.4902'.
[  340.569142][T21978] netlink: 16 bytes leftover after parsing attributes in process `syz.0.4906'.
[  340.762065][T21999] netlink: 'syz.0.4914': attribute type 1 has an invalid length.
[  340.781028][T21999] bond22: entered promiscuous mode
[  340.784230][T21999] 8021q: adding VLAN 0 to HW filter on device bond22
[  340.808631][T21999] 8021q: adding VLAN 0 to HW filter on device bond22
[  340.810885][T21999] bond22: (slave vcan0): The slave device specified does not support setting the MAC address
[  340.815626][T21999] bond22: (slave vcan0): Setting fail_over_mac to active for active-backup mode
[  340.821984][T21999] bond22: (slave vcan0): making interface the new active one
[  340.824381][T21999] vcan0: entered promiscuous mode
[  340.826825][T21999] bond22: (slave vcan0): Enslaving as an active interface with an up link
[  340.834637][T22006] batadv_slave_0: entered promiscuous mode
[  340.846340][T22006] mac80211_hwsim hwsim5 wlan0: left promiscuous mode
[  340.854144][T22006] A link change request failed with some changes committed already. Interface wlan0 may have been left with an inconsistent configuration, please check.
[  340.859501][T22005] batadv_slave_0: left promiscuous mode
[  340.940321][T22021] openvswitch: netlink: nsh attribute has 65532 unknown bytes.
[  340.942868][T22021] openvswitch: netlink: Flow actions may not be safe on all matching packets.
[  341.154563][T22043] pim6reg0: tun_chr_ioctl cmd 1074025694
[  341.591249][T22079] openvswitch: netlink: Flow actions may not be safe on all matching packets.
[  341.690983][T22083] dummy0: entered promiscuous mode
[  341.693339][T22083] dummy0: entered allmulticast mode
[  341.696094][T22083] A link change request failed with some changes committed already. Interface dummy0 may have been left with an inconsistent configuration, please check.
[  341.826351][T22089] erspan0: left allmulticast mode
[  341.857098][T22089] dummy0: left promiscuous mode
[  341.860938][T22089] dummy0: left allmulticast mode
[  341.869494][T22089] batadv0: left promiscuous mode
[  341.874785][T22089] A link change request failed with some changes committed already. Interface veth0_to_bond may have been left with an inconsistent configuration, please check.
[  341.879480][    T9] lo speed is unknown, defaulting to 1000
[  341.881178][    T9] syz0: Port: 1 Link DOWN
[  341.882709][    T9] lo speed is unknown, defaulting to 1000
[  342.050265][T22094] openvswitch: netlink: nsh attr 2560 is out of range max 3
[  342.052861][T22094] openvswitch: netlink: Flow actions may not be safe on all matching packets.
[  342.164935][T22104] lo speed is unknown, defaulting to 1000
[  342.215191][T22115] @: renamed from bond_slave_0
[  342.546839][T22147] validate_nla: 5 callbacks suppressed
[  342.546969][T22147] netlink: 'syz.0.4959': attribute type 1 has an invalid length.
[  342.599840][T22147] 8021q: adding VLAN 0 to HW filter on device bond23
[  342.602694][T22149] xt_addrtype: ipv6 does not support BROADCAST matching
[  342.617666][T22147] bond23: (slave gretap4): making interface the new active one
[  342.620777][T22147] bond23: (slave gretap4): Enslaving as an active interface with an up link
[  342.816552][T22172] netlink: 'syz.2.4967': attribute type 7 has an invalid length.
[  342.819937][T22172] netlink: 'syz.2.4967': attribute type 8 has an invalid length.
[  342.837904][T22172] gretap0: entered promiscuous mode
[  342.840962][T22172] batadv_slave_1: entered promiscuous mode
[  342.850627][T22172] erspan0: entered promiscuous mode
[  342.853161][T22172] hsr2: Slave B (batadv_slave_1) is not up; please bring it up to get a fully working HSR network
[  344.026495][T22210] netlink: 'syz.1.4978': attribute type 58 has an invalid length.
[  344.028926][T22210] __nla_validate_parse: 43 callbacks suppressed
[  344.028935][T22210] netlink: 20 bytes leftover after parsing attributes in process `syz.1.4978'.
[  344.042138][T22210] netlink: 16 bytes leftover after parsing attributes in process `syz.1.4978'.
[  344.248403][T22230] lo speed is unknown, defaulting to 1000
[  344.303679][T22233] netlink: 'syz.0.4986': attribute type 58 has an invalid length.
[  344.306075][T22233] netlink: 20 bytes leftover after parsing attributes in process `syz.0.4986'.
[  344.487248][T22239] netlink: 'syz.0.4989': attribute type 32 has an invalid length.
[  344.554602][T22244] netlink: 8 bytes leftover after parsing attributes in process `syz.0.4991'.
[  344.557482][T22231] netlink: 'syz.1.4985': attribute type 2 has an invalid length.
[  344.559963][T22244] netlink: 312 bytes leftover after parsing attributes in process `syz.0.4991'.
[  344.588341][T22244] netlink: 8 bytes leftover after parsing attributes in process `syz.0.4991'.
[  344.665617][T22253] smc: ib device syz1 ibport 1 erased user defined pnetid SYZ1
[  344.770803][T22259] @: renamed from bond_slave_0
[  344.808936][T22262] Unsupported ieee802154 address type: 0
[  344.811000][T22262] netlink: 8 bytes leftover after parsing attributes in process `syz.2.4997'.
[  344.814016][T22262] netlink: 4 bytes leftover after parsing attributes in process `syz.2.4997'.
[  344.864760][T22254] xt_hashlimit: max too large, truncated to 1048576
[  344.867195][T22254] Cannot find add_set index 3 as target
[  344.898991][T22267] netlink: 32 bytes leftover after parsing attributes in process `syz.1.4999'.
[  345.017745][T22272] bridge11: entered promiscuous mode
[  345.525963][T22282] netlink: 12 bytes leftover after parsing attributes in process `syz.2.5002'.
[  345.529607][T22282] nbd: illegal input index 65535
[  345.585403][T22289] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check.
[  345.777294][T22315] openvswitch: netlink: Missing key (keys=40, expected=10000000)
[  345.840219][T22323] ipt_REJECT: TCP_RESET invalid for non-tcp
[  345.906218][T22329] veth16: entered allmulticast mode
[  346.198155][T22349] netlink: 'syz.0.5025': attribute type 1 has an invalid length.
[  346.200571][T22349] netlink: 'syz.0.5025': attribute type 2 has an invalid length.
[  346.204691][T22349] netlink: 'syz.0.5025': attribute type 1 has an invalid length.
[  346.224664][T22351] netdevsim netdevsim1 eth3 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0
[  346.281698][T22351] netdevsim netdevsim1 eth2 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0
[  346.331404][T22351] netdevsim netdevsim1 eth1 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0
[  346.384738][T22351] netdevsim netdevsim1 eth0 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0
[  346.452416][T22351] netdevsim netdevsim1 eth0: set [0, 0] type 1 family 0 port 8472 - 0
[  346.460768][T22351] netdevsim netdevsim1 eth1: set [0, 0] type 1 family 0 port 8472 - 0
[  346.469208][T22351] netdevsim netdevsim1 eth2: set [0, 0] type 1 family 0 port 8472 - 0
[  346.485476][T22351] netdevsim netdevsim1 eth3: set [0, 0] type 1 family 0 port 8472 - 0
[  346.846115][T22361] tc_dump_action: action bad kind
[  347.222469][T10236] lo speed is unknown, defaulting to 1000
[  347.224193][T10236] syz0: Port: 1 Link ACTIVE
[  347.225696][T10236] lo speed is unknown, defaulting to 1000
[  347.951669][    C0] ip6_tunnel: ip6gretap0 xmit: Local address not yet configured!
[  348.004244][T22402] tipc: Enabled bearer <eth:syzkaller0>, priority 0
[  348.010989][T22402] syzkaller0: entered promiscuous mode
[  348.016887][T22402] syzkaller0: entered allmulticast mode
[  348.049682][T22402] tipc: Resetting bearer <eth:syzkaller0>
[  348.064549][T22412] openvswitch: netlink: Flow actions may not be safe on all matching packets.
[  348.113901][T22401] tipc: Resetting bearer <eth:syzkaller0>
[  348.126624][T22401] tipc: Disabling bearer <eth:syzkaller0>
[  348.537390][T22462] tipc: Can't bind to reserved service type 1
[  348.540538][T22462] openvswitch: netlink: Flow actions attr not present in new flow.
[  348.686240][T22477] bond0: entered promiscuous mode
[  348.791722][T22490] pim6reg1: entered promiscuous mode
[  348.793462][T22490] pim6reg1: entered allmulticast mode
[  348.978504][T22503] validate_nla: 2 callbacks suppressed
[  348.978520][T22503] netlink: 'syz.1.5066': attribute type 3 has an invalid length.
[  349.094691][T22511] netlink: 'syz.1.5070': attribute type 11 has an invalid length.
[  349.193113][T22517] tap0: tun_chr_ioctl cmd 1074025676
[  349.194885][T22517] tap0: owner set to 0
[  349.344668][T22530] syzkaller1: entered promiscuous mode
[  349.346547][T22530] syzkaller1: entered allmulticast mode
[  349.625722][T22485] Bluetooth: hci0: Opcode 0x0c20 failed: -4
[  349.645103][T22551] __nla_validate_parse: 23 callbacks suppressed
[  349.645117][T22551] netlink: 8 bytes leftover after parsing attributes in process `syz.1.5081'.
[  349.654877][T22553] netlink: 60 bytes leftover after parsing attributes in process `syz.0.5082'.
[  349.685349][T22556] x_tables: ip_tables: TCPOPTSTRIP target: only valid in mangle table, not raw
[  349.790057][T22562] netdevsim netdevsim1 eth0: unset [0, 0] type 1 family 0 port 8472 - 0
[  349.792914][T22562] netdevsim netdevsim1 eth1: unset [0, 0] type 1 family 0 port 8472 - 0
[  349.795383][T22562] netdevsim netdevsim1 eth2: unset [0, 0] type 1 family 0 port 8472 - 0
[  349.797822][T22562] netdevsim netdevsim1 eth3: unset [0, 0] type 1 family 0 port 8472 - 0
[  349.866186][T10236] lo speed is unknown, defaulting to 1000
[  349.867942][T10236] syz0: Port: 1 Link DOWN
[  349.869291][T10236] lo speed is unknown, defaulting to 1000
[  349.884756][T22565] lo speed is unknown, defaulting to 1000
[  350.387076][T22574] netlink: 'syz.0.5089': attribute type 2 has an invalid length.
[  350.389410][T22574] netlink: 12 bytes leftover after parsing attributes in process `syz.0.5089'.
[  350.617074][T22595] netlink: 'syz.2.5095': attribute type 58 has an invalid length.
[  350.620006][T22595] netlink: 20 bytes leftover after parsing attributes in process `syz.2.5095'.
[  350.795140][T22604] netlink: 'syz.1.5098': attribute type 1 has an invalid length.
[  350.894225][T22622] netlink: 36 bytes leftover after parsing attributes in process `syz.1.5102'.
[  350.974417][T22632] xt_socket: unknown flags 0x8
[  350.981790][T22634] xt_socket: unknown flags 0x8
[  356.273599][ T1146] block nbd0: Possible stuck request ffff888022928000: control (read@0,4096B). Runtime 120 seconds
[  363.312561][   T62] block nbd2: Possible stuck request ffff888022980000: control (read@0,1024B). Runtime 150 seconds
[  363.316878][   T62] block nbd2: Possible stuck request ffff888022980200: control (read@1024,1024B). Runtime 150 seconds
[  363.321264][   T62] block nbd2: Possible stuck request ffff888022980400: control (read@2048,1024B). Runtime 150 seconds
[  363.325861][   T62] block nbd2: Possible stuck request ffff888022980600: control (read@3072,1024B). Runtime 150 seconds
[  366.511792][    C0] ip6_tunnel: ip6gretap0 xmit: Local address not yet configured!
[  378.807445][T22679] netlink: 4 bytes leftover after parsing attributes in process `syz.0.5107'.
[  378.820593][T22682] netlink: 12 bytes leftover after parsing attributes in process `syz.1.5108'.
[  378.876070][T22690] netlink: 8 bytes leftover after parsing attributes in process `syz.0.5110'.
[  378.916096][T22694] netlink: 4 bytes leftover after parsing attributes in process `syz.0.5111'.
[  378.960452][T22698] netlink: 4 bytes leftover after parsing attributes in process `syz.0.5113'.
[  379.117835][T22709] netlink: 20 bytes leftover after parsing attributes in process `syz.1.5117'.
[  379.170398][T22716] netlink: 8 bytes leftover after parsing attributes in process `syz.1.5120'.
[  379.175009][T22716] netlink: 'syz.1.5120': attribute type 29 has an invalid length.
[  379.177393][T22716] netlink: 4 bytes leftover after parsing attributes in process `syz.1.5120'.
[  379.205362][T22721] netlink: 104 bytes leftover after parsing attributes in process `syz.0.5122'.
[  379.214503][T22725] netlink: 104 bytes leftover after parsing attributes in process `syz.0.5122'.
[  379.354589][T22742] netlink: 'syz.0.5126': attribute type 21 has an invalid length.
[  379.357534][T22742] IPv6: NLM_F_CREATE should be specified when creating new route
[  379.360062][T22742] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE
[  379.362492][T22742] IPv6: NLM_F_CREATE should be set when creating new route
[  379.364777][T22742] IPv6: NLM_F_CREATE should be set when creating new route
[  379.367116][T22742] IPv6: NLM_F_CREATE should be set when creating new route
[  379.387265][T22742] openvswitch: netlink: Flow actions attr not present in new flow.
[  379.391762][T22742] syzkaller1: entered promiscuous mode
[  379.394500][T22742] syzkaller1: entered allmulticast mode
[  379.527451][T22760] netlink: 'syz.1.5133': attribute type 4 has an invalid length.
[  379.581935][T22768] netlink: 'syz.0.5135': attribute type 58 has an invalid length.
[  379.606748][T22766] bond29: (slave bridge12): Enslaving as an active interface with an up link
[  380.020718][T22812] lo speed is unknown, defaulting to 1000
[  380.788482][T22856] netlink: 'syz.0.5162': attribute type 10 has an invalid length.
[  380.879747][T22864] netlink: 'syz.1.5164': attribute type 58 has an invalid length.
[  381.183050][T22879] xt_nat: multiple ranges no longer supported
[  381.305259][T22887] lo speed is unknown, defaulting to 1000
[  381.814611][T22898] netlink: 'syz.0.5175': attribute type 287 has an invalid length.
[  381.822321][T22898] netlink: 'syz.0.5175': attribute type 30 has an invalid length.
[  382.070406][T22912] lo speed is unknown, defaulting to 1000
[  382.404517][T22947] netlink: 'syz.2.5192': attribute type 5 has an invalid length.
[  382.493080][T22952] netlink: 'syz.2.5194': attribute type 58 has an invalid length.
[  383.897462][T23013] __nla_validate_parse: 32 callbacks suppressed
[  383.897505][T23013] netlink: 8 bytes leftover after parsing attributes in process `syz.2.5212'.
[  383.991770][T10236] ip6_tunnel: ip6gretap0 xmit: Local address not yet configured!
[  384.059022][T23016] netlink: 20 bytes leftover after parsing attributes in process `syz.0.5213'.
[  384.238688][T23025] netlink: 4 bytes leftover after parsing attributes in process `syz.2.5218'.
[  384.275891][T23031] validate_nla: 3 callbacks suppressed
[  384.275905][T23031] netlink: 'syz.2.5220': attribute type 58 has an invalid length.
[  384.279986][T23031] netlink: 20 bytes leftover after parsing attributes in process `syz.2.5220'.
[  384.303969][T23034] netlink: 16402 bytes leftover after parsing attributes in process `syz.0.5221'.
[  384.337209][T23037] netlink: 8 bytes leftover after parsing attributes in process `syz.0.5223'.
[  384.340030][T23037] netlink: 4 bytes leftover after parsing attributes in process `syz.0.5223'.
[  384.389146][T23044] IPVS: set_ctl: invalid protocol: 43 172.20.20.170:20001
[  384.560640][T23061] netlink: 'syz.0.5231': attribute type 58 has an invalid length.
[  384.567153][T23061] netlink: 20 bytes leftover after parsing attributes in process `syz.0.5231'.
[  384.644642][T23070] netlink: 4 bytes leftover after parsing attributes in process `syz.2.5234'.
[  384.754687][    T9] ip6_tunnel: ip6gretap0 xmit: Local address not yet configured!
[  384.809911][T23085] netlink: 'syz.2.5239': attribute type 58 has an invalid length.
[  384.814635][T23085] netlink: 20 bytes leftover after parsing attributes in process `syz.2.5239'.
[  385.038602][T23113] lo speed is unknown, defaulting to 1000
[  385.222141][T23121] netlink: 'syz.1.5251': attribute type 58 has an invalid length.
[  385.338731][T23123] netlink: 'syz.1.5252': attribute type 11 has an invalid length.
[  385.341202][T23123] netlink: 'syz.1.5252': attribute type 11 has an invalid length.
[  386.234618][T23154] tipc: Enabling of bearer <eth:syzkaller0> rejected, max 3 bearers permitted
[  386.289716][T23163] ip6gretap3: default qdisc (pfifo_fast) fail, fallback to noqueue
[  386.353293][ T1146] block nbd0: Possible stuck request ffff888022928000: control (read@0,4096B). Runtime 150 seconds
[  386.547728][T23167] netlink: 'syz.0.5263': attribute type 1 has an invalid length.
[  386.646116][T23174] SET target dimension over the limit!
[  386.857021][T23191] netlink: 'syz.2.5270': attribute type 58 has an invalid length.
[  387.223838][T23220] netlink: 'syz.1.5279': attribute type 58 has an invalid length.
[  387.300868][T23228] netlink: 'syz.1.5282': attribute type 1 has an invalid length.
[  387.337400][T23228] bond31: (slave vti0): The slave device specified does not support setting the MAC address
[  387.340398][T23228] bond31: (slave vti0): Setting fail_over_mac to active for active-backup mode
[  387.346200][T23228] bond31: (slave vti0): making interface the new active one
[  387.349048][T23228] bond31: (slave vti0): Enslaving as an active interface with an up link
[  387.723366][T23262] openvswitch: netlink: Flow actions may not be safe on all matching packets.
[  387.735781][T23262] siw: device registration error -23
[  387.863634][T23275] sch_tbf: burst 88 is lower than device veth19 mtu (1514) !
[  387.953967][T23277] nbd: couldn't find a device at index 65546
[  387.956881][T23276] delete_channel: no stack
[  387.989481][T23279] netlink: 'syz.0.5299': attribute type 58 has an invalid length.
[  388.025301][T23281] netlink: 'syz.0.5300': attribute type 1 has an invalid length.
[  388.045140][T23281] 8021q: adding VLAN 0 to HW filter on device bond24
[  388.298825][T23300] dvmrp1: tun_chr_ioctl cmd 1074025677
[  388.300661][T23300] dvmrp1: linktype set to 773
[  388.351454][T23298] lo speed is unknown, defaulting to 1000
[  388.420603][T23304] veth1_to_team: entered allmulticast mode
[  388.948832][T23341] __nla_validate_parse: 22 callbacks suppressed
[  388.948845][T23341] netlink: 4 bytes leftover after parsing attributes in process `syz.2.5317'.
[  389.280485][T23367] siw: device registration error -23
[  389.346949][T23372] netlink: 8 bytes leftover after parsing attributes in process `syz.1.5325'.
[  389.484483][T23385] netlink: 16 bytes leftover after parsing attributes in process `syz.1.5328'.
[  389.558001][T23389] netlink: 66 bytes leftover after parsing attributes in process `syz.1.5329'.
[  389.564034][T23389] syzkaller0: MTU too low for tipc bearer
[  389.565821][T23389] tipc: Enabling of bearer <eth:syzkaller0> rejected, failed to enable media
[  389.701061][T23392] validate_nla: 1 callbacks suppressed
[  389.701075][T23392] netlink: 'syz.1.5330': attribute type 4 has an invalid length.
[  389.705225][T23392] netlink: 152 bytes leftover after parsing attributes in process `syz.1.5330'.
[  389.768122][T23396] netlink: 'syz.1.5332': attribute type 58 has an invalid length.
[  389.770625][T23396] netlink: 20 bytes leftover after parsing attributes in process `syz.1.5332'.
[  389.855386][T23398] syzkaller1: entered promiscuous mode
[  389.857156][T23398] syzkaller1: entered allmulticast mode
[  389.965465][T23405] netlink: 4 bytes leftover after parsing attributes in process `syz.1.5336'.
[  390.294216][T23420] lo speed is unknown, defaulting to 1000
[  391.014475][T23435] openvswitch: netlink: Tunnel attr 227 out of range max 16
[  391.381887][T23458] syzkaller0: entered promiscuous mode
[  391.383578][T23458] syzkaller0: entered allmulticast mode
[  391.395621][T23458] syzkaller1: entered promiscuous mode
[  391.397327][T23458] syzkaller1: entered allmulticast mode
[  391.540741][T23472] netlink: 4 bytes leftover after parsing attributes in process `syz.0.5357'.
[  392.697654][T23478] netlink: 830 bytes leftover after parsing attributes in process `syz.2.5359'.
[  392.701827][T23478] netlink: 128 bytes leftover after parsing attributes in process `syz.2.5359'.
[  392.721952][    C0] PF_CAN: dropped non conform CAN skbuff: dev type 280, len 16
[  392.739787][T23482] sctp: [Deprecated]: syz.2.5360 (pid 23482) Use of int in max_burst socket option.
[  392.739787][T23482] Use struct sctp_assoc_value instead
[  392.817957][T23490] netlink: 'syz.2.5362': attribute type 4 has an invalid length.
[  392.994160][T23509] netlink: 'syz.2.5371': attribute type 58 has an invalid length.
[  393.173749][T23525] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE
[  393.176061][T23525] IPv6: NLM_F_CREATE should be set when creating new route
[  393.178284][T23525] IPv6: NLM_F_CREATE should be set when creating new route
[  393.180444][T23525] IPv6: NLM_F_CREATE should be set when creating new route
[  393.333637][T23538] netlink: 'syz.2.5380': attribute type 58 has an invalid length.
[  393.392010][   T62] block nbd2: Possible stuck request ffff888022980000: control (read@0,1024B). Runtime 180 seconds
[  393.395399][   T62] block nbd2: Possible stuck request ffff888022980200: control (read@1024,1024B). Runtime 180 seconds
[  393.399684][   T62] block nbd2: Possible stuck request ffff888022980400: control (read@2048,1024B). Runtime 180 seconds
[  393.405511][   T62] block nbd2: Possible stuck request ffff888022980600: control (read@3072,1024B). Runtime 180 seconds
[  393.474562][T23549] syzkaller0: entered promiscuous mode
[  393.477783][T23549] syzkaller0: entered allmulticast mode
[  393.639469][T23557] openvswitch: netlink: Multiple metadata blocks provided
[  393.746226][T23567] lo speed is unknown, defaulting to 1000
[  393.787643][T23568] xt_ipcomp: unknown flags F7
[  394.013992][T23579] __nla_validate_parse: 13 callbacks suppressed
[  394.014004][T23579] netlink: 24 bytes leftover after parsing attributes in process `syz.0.5391'.
[  394.018616][T23579] netlink: 24 bytes leftover after parsing attributes in process `syz.0.5391'.
[  394.034115][T23579] netlink: 4 bytes leftover after parsing attributes in process `syz.0.5391'.
[  394.136037][T23586] netlink: 4 bytes leftover after parsing attributes in process `syz.0.5393'.
[  394.167523][T23586] netlink: 4 bytes leftover after parsing attributes in process `syz.0.5393'.
[  394.294853][T23596] netlink: 'syz.1.5396': attribute type 8 has an invalid length.
[  394.345820][T23595] team0: Mode changed to "loadbalance"
[  394.495872][T23607] netlink: 4 bytes leftover after parsing attributes in process `syz.1.5402'.
[  394.708694][T23625] netlink: 'syz.2.5410': attribute type 58 has an invalid length.
[  394.711228][T23625] netlink: 20 bytes leftover after parsing attributes in process `syz.2.5410'.
[  395.003021][T23634] netlink: 12 bytes leftover after parsing attributes in process `syz.2.5412'.
[  395.101377][T23636] netlink: 104 bytes leftover after parsing attributes in process `syz.0.5413'.
[  395.108348][T23636] netlink: 'syz.0.5413': attribute type 7 has an invalid length.
[  395.111008][T23636] netlink: 8 bytes leftover after parsing attributes in process `syz.0.5413'.
[  395.191037][T23642] (unnamed net_device) (uninitialized): option arp_all_targets: invalid value (3)
[  395.268059][T23650] netlink: 'syz.2.5419': attribute type 58 has an invalid length.
[  395.305199][T23652] openvswitch: netlink: Either Ethernet header or EtherType is required.
[  395.648193][T23669] netlink: 'syz.1.5428': attribute type 58 has an invalid length.
[  395.739794][T23675] Timeout policy `syz0' can only be used by L3 protocol number 34916
[  395.833348][T23683] netlink: 'syz.2.5433': attribute type 9 has an invalid length.
[  395.848532][T23679] netlink: 'syz.1.5432': attribute type 1 has an invalid length.
[  395.989097][T23691] netlink: 'syz.2.5436': attribute type 58 has an invalid length.
[  396.129553][ T1097] smc: removing ib device syz!
[  396.205496][T23709] bridge0: entered allmulticast mode
[  396.348311][T23718] SET target dimension over the limit!
[  396.388101][T23721] netlink: 'syz.1.5446': attribute type 58 has an invalid length.
[  396.489400][T23730] netlink: 'syz.1.5449': attribute type 5 has an invalid length.
[  396.493023][T23729] netlink: 'syz.1.5449': attribute type 5 has an invalid length.
[  396.561365][T23739] syzkaller0: MTU too low for tipc bearer
[  396.591937][T23739] tipc: Enabling of bearer <eth:syzkaller0> rejected, failed to enable media
[  396.962976][T23774] RDS: rds_bind could not find a transport for fe80::1a, load rds_tcp or rds_rdma?
[  397.883800][T23833] openvswitch: netlink: Geneve opt len 126 is not a multiple of 4.
[  397.911888][T23840] openvswitch: netlink: Missing key (keys=40, expected=100)
[  397.919601][T23840] x_tables: duplicate underflow at hook 1
[  399.350377][T23902] __nla_validate_parse: 25 callbacks suppressed
[  399.350388][T23902] netlink: 45 bytes leftover after parsing attributes in process `syz.0.5496'.
[  399.353537][T23905] netlink: 20 bytes leftover after parsing attributes in process `syz.2.5497'.
[  399.457917][T23916] netlink: 16 bytes leftover after parsing attributes in process `syz.2.5501'.
[  399.678744][T23953] xt_l2tp: v2 doesn't support IP mode
[  399.684860][T23953] netlink: 104 bytes leftover after parsing attributes in process `syz.0.5506'.
[  399.697124][T23955] netlink: 20 bytes leftover after parsing attributes in process `syz.2.5507'.
[  399.699877][T23955] netlink: 8 bytes leftover after parsing attributes in process `syz.2.5507'.
[  400.094407][T23986] validate_nla: 5 callbacks suppressed
[  400.094419][T23986] netlink: 'syz.1.5517': attribute type 58 has an invalid length.
[  400.098503][T23986] netlink: 20 bytes leftover after parsing attributes in process `syz.1.5517'.
[  400.284448][T24012] netlink: 8 bytes leftover after parsing attributes in process `syz.2.5524'.
[  400.287913][T24009] netlink: 48 bytes leftover after parsing attributes in process `syz.1.5525'.
[  400.295125][T24009] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE
[  400.297315][T24009] IPv6: NLM_F_CREATE should be set when creating new route
[  400.399077][T24029] sctp: [Deprecated]: syz.2.5526 (pid 24029) Use of int in max_burst socket option deprecated.
[  400.399077][T24029] Use struct sctp_assoc_value instead
[  400.426162][T24026] lo speed is unknown, defaulting to 1000
[  400.709083][   T33] audit: type=1800 audit(1753037383.529:14): pid=24046 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.1.5533" name="blkio.bfq.time_recursive" dev="tmpfs" ino=9195 res=0 errno=0
[  400.717102][   T33] audit: type=1800 audit(1753037383.549:15): pid=24046 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.1.5533" name="blkio.bfq.time_recursive" dev="tmpfs" ino=9195 res=0 errno=0
[  401.270546][T24054] netlink: 'syz.0.5536': attribute type 1 has an invalid length.
[  401.271385][T24052] lo speed is unknown, defaulting to 1000
[  401.276835][T24055] netlink: 'syz.0.5536': attribute type 1 has an invalid length.
[  401.335243][T24060] No such timeout policy "syz0"
[  401.527389][T24072] netlink: 596 bytes leftover after parsing attributes in process `syz.0.5542'.
[  401.856021][T24074] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512
[  402.073810][T24106] netem: invalid attributes len -16
[  402.075413][T24106] netem: change failed
[  402.227619][T24118] netlink: 'syz.1.5558': attribute type 1 has an invalid length.
[  402.293531][T24118] xt_CT: No such helper "snmp"
[  402.475477][T24145] !: renamed from dummy0
[  402.520079][T24144] netlink: 'syz.2.5565': attribute type 1 has an invalid length.
[  402.574295][T24154] openvswitch: netlink: IPv4 tunnel dst address is zero
[  402.628025][T24160] netlink: 'syz.2.5570': attribute type 2 has an invalid length.
[  402.670795][T24160] netlink: 'syz.2.5570': attribute type 19 has an invalid length.
[  402.818539][T24185] netlink: 'syz.2.5578': attribute type 3 has an invalid length.
[  403.194677][T24211] IPVS: Unknown mcast interface: pim6reg0
[  403.200056][T24213] x_tables: duplicate underflow at hook 1
[  403.243981][T24216] netlink: 'syz.2.5587': attribute type 1 has an invalid length.
[  403.405847][T24227] syzkaller1: entered promiscuous mode
[  403.407840][T24227] syzkaller1: entered allmulticast mode
[  403.612925][T24237] netlink: 'syz.0.5593': attribute type 1 has an invalid length.
[  403.677662][T24244] (unnamed net_device) (uninitialized): Setting coupled_control to off (0)
[  404.057161][T24282] ip6t_srh: unknown srh invflags 4449
[  404.059242][T24283] ip6t_srh: unknown srh invflags 4449
[  404.599517][T24315] __nla_validate_parse: 36 callbacks suppressed
[  404.599529][T24315] netlink: 4 bytes leftover after parsing attributes in process `syz.2.5622'.
[  404.614976][T24310] lo speed is unknown, defaulting to 1000
[  404.629293][T24316] netlink: 16 bytes leftover after parsing attributes in process `syz.1.5621'.
[  404.693217][T24316] xt_hashlimit: size too large, truncated to 1048576
[  405.280023][T24328] validate_nla: 7 callbacks suppressed
[  405.280034][T24328] netlink: 'syz.2.5625': attribute type 58 has an invalid length.
[  405.297938][T24328] netlink: 20 bytes leftover after parsing attributes in process `syz.2.5625'.
[  405.303371][T24328] netlink: 8 bytes leftover after parsing attributes in process `syz.2.5625'.
[  405.766653][T24345] netlink: 4 bytes leftover after parsing attributes in process `syz.1.5632'.
[  405.811365][T24351] openvswitch: netlink: Unexpected mask (mask=440, allowed=10048)
[  406.083887][T24366] netlink: 'syz.1.5638': attribute type 58 has an invalid length.
[  406.086310][T24366] netlink: 20 bytes leftover after parsing attributes in process `syz.1.5638'.
[  406.089000][T24366] netlink: 8 bytes leftover after parsing attributes in process `syz.1.5638'.
[  406.207428][T24374] netlink: 12 bytes leftover after parsing attributes in process `syz.1.5641'.
[  406.245095][T24378] tipc: Enabling of bearer <eth:syzkaller0> rejected, max 3 bearers permitted
[  406.462140][T24395] netlink: 'syz.1.5651': attribute type 58 has an invalid length.
[  406.464938][T24395] netlink: 20 bytes leftover after parsing attributes in process `syz.1.5651'.
[  406.467754][T24395] netlink: 8 bytes leftover after parsing attributes in process `syz.1.5651'.
[  406.810579][T24425] netlink: 'syz.0.5658': attribute type 58 has an invalid length.
[  406.868574][T24430] netlink: 'syz.0.5661': attribute type 2 has an invalid length.
[  407.184492][T24455] rose0: entered promiscuous mode
[  407.186595][T24455] bond0: (slave rose0): Enslaving as an active interface with an up link
[  408.253210][T24502] sctp: [Deprecated]: syz.0.5685 (pid 24502) Use of int in max_burst socket option.
[  408.253210][T24502] Use struct sctp_assoc_value instead
[  408.260274][T24502] veth1_to_bond: entered allmulticast mode
[  408.264471][T24501] veth1_to_bond: left allmulticast mode
[  408.292887][T24504] netlink: 'syz.0.5686': attribute type 58 has an invalid length.
[  409.016873][T24538] netlink: 'syz.1.5698': attribute type 58 has an invalid length.
[  409.154902][T24544] openvswitch: netlink: ufid size 3068 bytes exceeds the range (1, 16)
[  409.304609][T24555] netlink: 'syz.1.5704': attribute type 2 has an invalid length.
[  409.309123][T24555] netlink: 'syz.1.5704': attribute type 1 has an invalid length.
[  409.410145][T24560] netlink: 'syz.1.5705': attribute type 58 has an invalid length.
[  409.490842][T24573] Timeout policy `syz0' can only be used by L3 protocol number 34916
[  409.500380][T24572] Timeout policy `syz0' can only be used by L3 protocol number 34916
[  409.684580][T24589] __nla_validate_parse: 26 callbacks suppressed
[  409.684593][T24589] netlink: 4 bytes leftover after parsing attributes in process `syz.1.5711'.
[  409.797449][T24601] bond29: (slave bridge12): Releasing backup interface
[  409.805237][T24601] bond31: (slave vti0): Releasing backup interface
[  409.883337][T24609] netlink: 20 bytes leftover after parsing attributes in process `syz.1.5714'.
[  410.124448][T24624] bridge0: port 1(erspan0) entered blocking state
[  410.126697][T24624] bridge0: port 1(erspan0) entered disabled state
[  410.128807][T24624] erspan0: entered allmulticast mode
[  410.131353][T24624] erspan0: entered promiscuous mode
[  410.137129][T24624] erspan0: left allmulticast mode
[  410.138739][T24624] erspan0: left promiscuous mode
[  410.141567][T24624] bridge0: port 1(erspan0) entered disabled state
[  410.229017][T24631] netlink: 4 bytes leftover after parsing attributes in process `syz.1.5721'.
[  410.269783][T24631] bridge0 (unregistering): left allmulticast mode
[  410.450615][T24646] validate_nla: 3 callbacks suppressed
[  410.450628][T24646] netlink: 'syz.0.5724': attribute type 21 has an invalid length.
[  410.464426][T24644] netlink: 4 bytes leftover after parsing attributes in process `syz.1.5723'.
[  410.467212][T24644] netlink: 4 bytes leftover after parsing attributes in process `syz.1.5723'.
[  410.468245][T24646] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE
[  410.476140][T24644] netlink: 'syz.1.5723': attribute type 1 has an invalid length.
[  410.549267][T24656] netlink: 28 bytes leftover after parsing attributes in process `syz.0.5727'.
[  410.558363][T24656] netlink: 28 bytes leftover after parsing attributes in process `syz.0.5727'.
[  410.567211][T24658] netlink: 36 bytes leftover after parsing attributes in process `syz.1.5728'.
[  410.598138][T24660] netlink: 'syz.1.5729': attribute type 1 has an invalid length.
[  410.601298][T24660] netlink: 100 bytes leftover after parsing attributes in process `syz.1.5729'.
[  410.605796][T24660] netlink: 'syz.1.5729': attribute type 21 has an invalid length.
[  410.608373][T24660] netlink: 132 bytes leftover after parsing attributes in process `syz.1.5729'.
[  410.764789][T24678] netlink: 'syz.1.5736': attribute type 2 has an invalid length.
[  410.773005][   T33] audit: type=1107 audit(1753037393.599:16): pid=24673 uid=0 auid=4294967295 ses=4294967295 subj=unconfined msg=''
[  411.039645][T24686] tipc: Enabled bearer <eth:syzkaller0>, priority 0
[  411.222722][T24697] veth0: entered promiscuous mode
[  411.256877][T24697] veth0 (unregistering): left promiscuous mode
[  411.645489][T24720] mac80211_hwsim hwsim38 wlan1: entered allmulticast mode
[  411.650647][T24720] netlink: 'syz.2.5748': attribute type 10 has an invalid length.
[  411.775564][T24732] netlink: 'syz.2.5752': attribute type 21 has an invalid length.
[  411.778206][T24732] IPv6: NLM_F_CREATE should be specified when creating new route
[  411.780775][T24732] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE
[  411.783071][T24732] IPv6: NLM_F_CREATE should be set when creating new route
[  411.785400][T24732] IPv6: NLM_F_CREATE should be set when creating new route
[  411.787660][T24732] IPv6: NLM_F_CREATE should be set when creating new route
[  412.047771][T24761] netlink: 'syz.2.5759': attribute type 21 has an invalid length.
[  412.050473][T24761] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE
[  412.098786][T24769] tipc: Enabling of bearer <eth:syzkaller0> rejected, max 3 bearers permitted
[  412.107310][T24767] tipc: Enabled bearer <eth:syzkaller0>, priority 0
[  412.109875][T24767] syzkaller0: entered promiscuous mode
[  412.113068][T24767] syzkaller0: entered allmulticast mode
[  412.153640][T24767] tipc: Resetting bearer <eth:syzkaller0>
[  412.167942][T24766] tipc: Resetting bearer <eth:syzkaller0>
[  412.185673][T24766] tipc: Disabling bearer <eth:syzkaller0>
[  412.424729][T24794] IPVS: set_ctl: invalid protocol: 59 172.20.20.187:20003
[  412.576264][T24812] netlink: 'syz.1.5775': attribute type 58 has an invalid length.
[  412.687226][T24822] netlink: 'syz.1.5780': attribute type 1 has an invalid length.
[  412.702029][T24831] : entered promiscuous mode
[  412.963443][T24860] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE
[  413.005578][T24870] A link change request failed with some changes committed already. Interface ip6gretap0 may have been left with an inconsistent configuration, please check.
[  413.150327][T24884] IPv6: sit6: Disabled Multicast RS
[  413.180800][T24892] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE
[  413.218828][T24896] x_tables: ip6_tables: rpfilter match: used from hooks OUTPUT, but only valid from PREROUTING
[  413.270509][T24898] (unnamed net_device) (uninitialized): option tlb_dynamic_lb: invalid value (71)
[  413.447309][ T1097] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[  413.449711][ T1097] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50
[  413.616137][T24924] lo speed is unknown, defaulting to 1000
[  413.982067][T24930] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE
[  414.205136][T24942] tipc: Enabled bearer <eth:syzkaller0>, priority 0
[  414.208293][T24942] syzkaller0: entered promiscuous mode
[  414.210534][T24942] syzkaller0: entered allmulticast mode
[  414.289960][T24943] sch_fq: defrate 257 ignored.
[  414.295100][T24943] tipc: Resetting bearer <eth:syzkaller0>
[  414.388115][T24954] 8021q: adding VLAN 0 to HW filter on device team0
[  414.394360][T24954] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check.
[  414.413900][T24955] erspan0: entered allmulticast mode
[  414.436540][T24955] sch_tbf: burst 0 is lower than device vlan0 mtu (1514) !
[  414.524412][T24961] RDS: rds_bind could not find a transport for fe80::1a, load rds_tcp or rds_rdma?
[  414.591953][T24969] IPv6: NLM_F_CREATE should be specified when creating new route
[  414.594528][T24969] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE
[  414.596888][T24969] IPv6: NLM_F_CREATE should be set when creating new route
[  414.599223][T24969] IPv6: NLM_F_CREATE should be set when creating new route
[  414.601460][T24969] IPv6: NLM_F_CREATE should be set when creating new route
[  414.699279][T24974] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE
[  414.702300][T24974] IPv6: NLM_F_CREATE should be set when creating new route
[  414.704622][T24974] IPv6: NLM_F_CREATE should be set when creating new route
[  414.707028][T24974] IPv6: NLM_F_CREATE should be set when creating new route
[  414.981820][T24994] __nla_validate_parse: 21 callbacks suppressed
[  414.981838][T24994] netlink: 12 bytes leftover after parsing attributes in process `syz.1.5833'.
[  415.018885][T25001] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE
[  415.029868][T24941] tipc: Resetting bearer <eth:syzkaller0>
[  415.042786][T24941] tipc: Disabling bearer <eth:syzkaller0>
[  415.195631][T25019] netlink: 4 bytes leftover after parsing attributes in process `syz.0.5840'.
[  415.300737][T25028] netlink: 204 bytes leftover after parsing attributes in process `syz.2.5842'.
[  415.309412][T25026] openvswitch: netlink: Flow actions may not be safe on all matching packets.
[  415.312494][   T55] Bluetooth: hci2: Opcode 0x0401 failed: -110
[  415.313576][   T55] Bluetooth: hci2: command 0x0419 tx timeout
[  415.357985][T25031] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE
[  415.394831][T25035] netlink: 16 bytes leftover after parsing attributes in process `syz.1.5844'.
[  415.568403][T25057] lo speed is unknown, defaulting to 1000
[  415.572532][T25054] syzkaller1: entered promiscuous mode
[  415.574253][T25054] syzkaller1: entered allmulticast mode
[  415.655737][T25064] netlink: 24 bytes leftover after parsing attributes in process `syz.2.5852'.
[  415.685313][T25068] validate_nla: 18 callbacks suppressed
[  415.685324][T25068] netlink: 'syz.2.5853': attribute type 21 has an invalid length.
[  415.689874][T25068] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE
[  415.781111][T25074] netlink: 24 bytes leftover after parsing attributes in process `syz.0.5856'.
[  415.948297][T25090] netlink: 28 bytes leftover after parsing attributes in process `syz.2.5862'.
[  415.978072][T25092] netlink: 4 bytes leftover after parsing attributes in process `syz.0.5863'.
[  415.981719][T25092] netlink: 316 bytes leftover after parsing attributes in process `syz.0.5863'.
[  416.001348][T25090] netlink: 28 bytes leftover after parsing attributes in process `syz.2.5862'.
[  416.168643][T25105] netlink: 'syz.0.5869': attribute type 21 has an invalid length.
[  416.171131][T25105] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE
[  416.353928][T25116] ipt_ECN: cannot use operation on non-tcp rule
[  416.365327][T25121] pim6reg: entered allmulticast mode
[  416.368541][T25116] macsec0: entered promiscuous mode
[  416.373907][T25121] pim6reg: left allmulticast mode
[  416.438138][ T1146] block nbd0: Possible stuck request ffff888022928000: control (read@0,4096B). Runtime 180 seconds
[  416.616909][T25136] openvswitch: netlink: IP tunnel attribute has 4 unknown bytes.
[  418.410078][T25162] xt_hashlimit: size too large, truncated to 1048576
[  418.542091][T24899] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1
[  418.546512][T24899] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9
[  418.549619][T24899] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9
[  418.552904][T24899] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4
[  418.556676][T24899] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2
[  418.586130][T25165] lo speed is unknown, defaulting to 1000
[  418.856429][T25165] chnl_net:caif_netlink_parms(): no params data found
[  418.904760][T25165] bridge0: port 1(bridge_slave_0) entered blocking state
[  418.907057][T25165] bridge0: port 1(bridge_slave_0) entered disabled state
[  418.909251][T25165] bridge_slave_0: entered allmulticast mode
[  418.912132][T25165] bridge_slave_0: entered promiscuous mode
[  418.915396][T25165] bridge0: port 2(bridge_slave_1) entered blocking state
[  418.917551][T25165] bridge0: port 2(bridge_slave_1) entered disabled state
[  418.919828][T25165] bridge_slave_1: entered allmulticast mode
[  418.922851][T25165] bridge_slave_1: entered promiscuous mode
[  418.944547][T25165] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link
[  418.949263][T25165] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link
[  418.975458][T25165] team0: Port device team_slave_0 added
[  418.978960][T25165] team0: Port device team_slave_1 added
[  418.998249][T25165] batman_adv: batadv0: Adding interface: batadv_slave_0
[  419.000471][T25165] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[  419.008520][T25165] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active
[  419.015452][T25165] batman_adv: batadv0: Adding interface: batadv_slave_1
[  419.017629][T25165] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[  419.031763][T25165] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active
[  419.087224][T25165] hsr_slave_0: entered promiscuous mode
[  419.089632][T25165] hsr_slave_1: entered promiscuous mode
[  419.092642][T25165] debugfs: Directory 'hsr0' with parent 'hsr' already present!
[  419.095003][T25165] Cannot create hsr debugfs directory
[  419.182802][T24899] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1
[  419.186359][T24899] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9
[  419.188985][T24899] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9
[  419.191726][T24899] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4
[  419.194122][T24899] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2
[  419.237539][T25179] lo speed is unknown, defaulting to 1000
[  419.285980][T25165] netdevsim netdevsim3 netdevsim0: renamed from eth0
[  419.293917][T25165] netdevsim netdevsim3 netdevsim1: renamed from eth1
[  419.298436][T25165] netdevsim netdevsim3 netdevsim2: renamed from eth2
[  419.305747][T25165] netdevsim netdevsim3 netdevsim3: renamed from eth3
[  419.383489][T25165] 8021q: adding VLAN 0 to HW filter on device bond0
[  419.400796][T25165] 8021q: adding VLAN 0 to HW filter on device team0
[  419.435158][   T27] bridge0: port 1(bridge_slave_0) entered blocking state
[  419.437463][   T27] bridge0: port 1(bridge_slave_0) entered forwarding state
[  419.447088][T11522] bridge0: port 2(bridge_slave_1) entered blocking state
[  419.449512][T11522] bridge0: port 2(bridge_slave_1) entered forwarding state
[  419.633885][T25179] chnl_net:caif_netlink_parms(): no params data found
[  419.697353][T25179] bridge0: port 1(bridge_slave_0) entered blocking state
[  419.699780][T25179] bridge0: port 1(bridge_slave_0) entered disabled state
[  419.702594][T25179] bridge_slave_0: entered allmulticast mode
[  419.707044][T25179] bridge_slave_0: entered promiscuous mode
[  419.711408][T25179] bridge0: port 2(bridge_slave_1) entered blocking state
[  419.714884][T25179] bridge0: port 2(bridge_slave_1) entered disabled state
[  419.717246][T25179] bridge_slave_1: entered allmulticast mode
[  419.722625][T25179] bridge_slave_1: entered promiscuous mode
[  419.756210][T25179] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link
[  419.763679][T25165] 8021q: adding VLAN 0 to HW filter on device batadv0
[  419.768132][T25179] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link
[  419.808075][T25179] team0: Port device team_slave_0 added
[  419.819339][T25210] tipc: Enabling of bearer <eth:syzkaller0> rejected, already enabled
[  419.826701][T25179] team0: Port device team_slave_1 added
[  419.860168][T25165] veth0_vlan: entered promiscuous mode
[  419.864594][T25179] batman_adv: batadv0: Adding interface: batadv_slave_0
[  419.867297][T25179] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[  419.876971][T25179] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active
[  419.887600][T25165] veth1_vlan: entered promiscuous mode
[  419.898676][T25179] batman_adv: batadv0: Adding interface: batadv_slave_1
[  419.900948][T25179] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[  419.911032][T25179] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active
[  419.972379][T25179] hsr_slave_0: entered promiscuous mode
[  419.975853][T25179] hsr_slave_1: entered promiscuous mode
[  419.978017][T25179] debugfs: Directory 'hsr0' with parent 'hsr' already present!
[  419.980393][T25179] Cannot create hsr debugfs directory
[  420.004114][T25165] veth0_macvtap: entered promiscuous mode
[  420.024442][T25165] veth1_macvtap: entered promiscuous mode
[  420.030260][T25220] netlink: 'syz.1.5897': attribute type 21 has an invalid length.
[  420.041033][T25220] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE
[  420.089114][T25165] batman_adv: batadv0: Interface activated: batadv_slave_0
[  420.102633][T25165] batman_adv: batadv0: Interface activated: batadv_slave_1
[  420.108092][T25165] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0
[  420.110743][T25165] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0
[  420.116528][T25165] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0
[  420.119220][T25165] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0
[  420.232866][ T1097] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[  420.235333][ T1097] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50
[  420.270079][T25179] netdevsim netdevsim4 netdevsim0: renamed from eth0
[  420.278470][T25179] netdevsim netdevsim4 netdevsim1: renamed from eth1
[  420.278560][ T1088] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[  420.284464][ T1088] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50
[  420.294284][T25179] netdevsim netdevsim4 netdevsim2: renamed from eth2
[  420.300008][T25179] netdevsim netdevsim4 netdevsim3: renamed from eth3
[  420.393430][T25179] 8021q: adding VLAN 0 to HW filter on device bond0
[  420.411156][T25179] 8021q: adding VLAN 0 to HW filter on device team0
[  420.418073][T11522] bridge0: port 1(bridge_slave_0) entered blocking state
[  420.420323][T11522] bridge0: port 1(bridge_slave_0) entered forwarding state
[  420.438911][T11522] bridge0: port 2(bridge_slave_1) entered blocking state
[  420.441094][T11522] bridge0: port 2(bridge_slave_1) entered forwarding state
[  420.594760][   T55] Bluetooth: hci1: command tx timeout
[  420.598178][T25179] 8021q: adding VLAN 0 to HW filter on device batadv0
[  420.676908][T25262] netlink: 'syz.1.5906': attribute type 21 has an invalid length.
[  420.679348][T25262] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE
[  420.738951][T25269] __nla_validate_parse: 8 callbacks suppressed
[  420.738973][T25269] netlink: 12 bytes leftover after parsing attributes in process `syz.1.5907'.
[  420.745449][T25269] netlink: 'syz.1.5907': attribute type 14 has an invalid length.
[  420.748138][T25269] netlink: 12 bytes leftover after parsing attributes in process `syz.1.5907'.
[  420.750781][T25269] netlink: 'syz.1.5907': attribute type 14 has an invalid length.
[  420.834014][T25179] veth0_vlan: entered promiscuous mode
[  420.839206][T25179] veth1_vlan: entered promiscuous mode
[  420.867482][T25179] veth0_macvtap: entered promiscuous mode
[  420.876400][T25280] netlink: 96 bytes leftover after parsing attributes in process `syz.1.5911'.
[  420.877746][T25179] veth1_macvtap: entered promiscuous mode
[  420.903010][T25179] batman_adv: batadv0: Interface activated: batadv_slave_0
[  420.912580][T25179] batman_adv: batadv0: Interface activated: batadv_slave_1
[  420.918203][T25179] netdevsim netdevsim4 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0
[  420.920910][T25179] netdevsim netdevsim4 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0
[  420.926168][T25179] netdevsim netdevsim4 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0
[  420.928895][T25179] netdevsim netdevsim4 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0
[  421.002138][T11519] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[  421.004539][T11519] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50
[  421.053005][   T27] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[  421.058269][   T27] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50
[  421.092569][T25293] x_tables: ip6_tables: quota.0 match: invalid size 24 (kernel) != (user) 144
[  421.231751][   T55] Bluetooth: hci2: command tx timeout
[  421.310887][T25310] xt_limit: Overflow, try lower: 262144/524288
[  421.313513][T25310] Cannot find add_set index 0 as target
[  421.324802][T25312] openvswitch: netlink: Missing key (keys=44, expected=200000)
[  421.328242][T25312] netlink: 25 bytes leftover after parsing attributes in process `syz.1.5919'.
[  421.393822][T25314] netlink: 'syz.3.5920': attribute type 13 has an invalid length.
[  421.396435][T25314] netlink: 'syz.3.5920': attribute type 17 has an invalid length.
[  421.425959][T25320] netlink: 'syz.1.5923': attribute type 1 has an invalid length.
[  421.436433][T25320] netlink: 'syz.1.5923': attribute type 4 has an invalid length.
[  421.441868][T25320] netlink: 208 bytes leftover after parsing attributes in process `syz.1.5923'.
[  421.444727][T25320] NCSI netlink: No device for ifindex 3088861696
[  421.462857][T25314] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check.
[  421.476731][T25320] netlink: 'syz.1.5923': attribute type 21 has an invalid length.
[  421.479224][T25320] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE
[  421.491949][T25318] tipc: Started in network mode
[  421.494336][T25318] tipc: Node identity 569f8e16e663, cluster identity 4711
[  421.496926][T25318] tipc: Enabled bearer <eth:syzkaller0>, priority 0
[  421.501276][T25318] syzkaller0: entered promiscuous mode
[  421.505434][T25318] syzkaller0: entered allmulticast mode
[  421.533250][T25318] tipc: Resetting bearer <eth:syzkaller0>
[  421.537456][T25317] tipc: Resetting bearer <eth:syzkaller0>
[  421.565736][T25317] tipc: Disabling bearer <eth:syzkaller0>
[  421.654867][T25326] netlink: 'syz.1.5925': attribute type 11 has an invalid length.
[  421.694731][T25331] netlink: 16186 bytes leftover after parsing attributes in process `syz.4.5926'.
[  421.696187][T25334] xt_addrtype: both incoming and outgoing interface limitation cannot be selected
[  421.876452][T25339] netlink: 80 bytes leftover after parsing attributes in process `syz.4.5928'.
[  421.879284][T25339] netlink: 12 bytes leftover after parsing attributes in process `syz.4.5928'.
[  421.891872][T25339] netlink: 20 bytes leftover after parsing attributes in process `syz.4.5928'.
[  421.903107][T25341] openvswitch: netlink: Flow actions may not be safe on all matching packets.
[  421.996466][T25341] netlink: 'syz.1.5930': attribute type 8 has an invalid length.
[  422.005480][T25341] netlink: 104 bytes leftover after parsing attributes in process `syz.1.5930'.
[  422.331993][T25381] sctp: [Deprecated]: syz.4.5939 (pid 25381) Use of int in max_burst socket option deprecated.
[  422.331993][T25381] Use struct sctp_assoc_value instead
[  422.388979][T25385] veth0_macvtap: entered promiscuous mode
[  422.391151][T25385] macvtap1: entered allmulticast mode
[  422.394927][T25385] veth0_macvtap: entered allmulticast mode
[  422.672612][   T55] Bluetooth: hci1: command tx timeout
[  422.984617][T25422] @: renamed from bond_slave_0 (while UP)
[  423.152106][T25431] syz.3.5957 (25431) used greatest stack depth: 20008 bytes left
[  423.199100][T25436] tipc: Started in network mode
[  423.201031][T25436] tipc: Node identity 5a5b6f6a1706, cluster identity 4711
[  423.210023][T25436] tipc: Enabled bearer <eth:syzkaller0>, priority 0
[  423.225056][T25436] syzkaller0: entered promiscuous mode
[  423.227195][T25436] syzkaller0: entered allmulticast mode
[  423.311808][   T55] Bluetooth: hci2: command tx timeout
[  423.316892][T25441] tipc: Resetting bearer <eth:syzkaller0>
[  423.340920][T25436] tipc: Resetting bearer <eth:syzkaller0>
[  423.351350][T25436] tipc: Disabling bearer <eth:syzkaller0>
[  423.473509][   T62] block nbd2: Possible stuck request ffff888022980000: control (read@0,1024B). Runtime 210 seconds
[  423.476649][   T62] block nbd2: Possible stuck request ffff888022980200: control (read@1024,1024B). Runtime 210 seconds
[  423.479870][   T62] block nbd2: Possible stuck request ffff888022980400: control (read@2048,1024B). Runtime 210 seconds
[  423.483466][   T62] block nbd2: Possible stuck request ffff888022980600: control (read@3072,1024B). Runtime 210 seconds
[  423.637744][T25455] No such timeout policy "syz1"
[  424.446186][T25470] xt_TCPMSS: path-MTU clamping only supported in FORWARD, OUTPUT and POSTROUTING hooks
[  424.545149][T25478] netlink: 'syz.4.5972': attribute type 1 has an invalid length.
[  424.635854][T25483] xt_CT: No such helper "snmp"
[  424.648394][T25478] tipc: New replicast peer: fe80:0000:0000:0000:0000:0000:0000:0000
[  424.651279][T25478] tipc: Enabled bearer <udp:syz1>, priority 26
[  424.771651][   T55] Bluetooth: hci1: command tx timeout
[  424.784952][T25495] x_tables: unsorted underflow at hook 3
[  425.104987][T25526] workqueue: Failed to create a rescuer kthread for wq "nfc2_nci_tx_wq": -EINTR
[  425.392594][   T55] Bluetooth: hci2: command tx timeout
[  425.761591][ T2300] tipc: Node number set to 2969341462
[  426.039856][T25546] __nla_validate_parse: 16 callbacks suppressed
[  426.039867][T25546] netlink: 4 bytes leftover after parsing attributes in process `syz.3.5992'.
[  426.049363][T25549] netlink: 4 bytes leftover after parsing attributes in process `syz.4.5993'.
[  426.151330][T25558] netlink: 16178 bytes leftover after parsing attributes in process `syz.3.5996'.
[  426.211419][T25564] netlink: 156 bytes leftover after parsing attributes in process `syz.3.5998'.
[  426.222822][T25564] netlink: 'syz.3.5998': attribute type 3 has an invalid length.
[  426.276389][T25569] openvswitch: netlink: Unexpected mask (mask=20040, allowed=10048)
[  426.469449][T25590] netlink: 12 bytes leftover after parsing attributes in process `syz.3.6003'.
[  426.762045][T25611] openvswitch: netlink: Port -1156311892 exceeds max allowable 65535
[  426.832632][   T55] Bluetooth: hci1: command tx timeout
[  426.834945][T25615] netlink: 4 bytes leftover after parsing attributes in process `syz.3.6008'.
[  427.042230][T25636] netlink: 4 bytes leftover after parsing attributes in process `syz.3.6015'.
[  427.045243][T25636] batman_adv: batadv0: Interface deactivated: batadv_slave_0
[  427.073117][T25636] batman_adv: batadv0: Removing interface: batadv_slave_0
[  427.134748][T25636] netlink: 4 bytes leftover after parsing attributes in process `syz.3.6015'.
[  427.137810][T25636] netlink: 4 bytes leftover after parsing attributes in process `syz.3.6015'.
[  427.140956][T25636] netlink: 4 bytes leftover after parsing attributes in process `syz.3.6015'.
[  427.307036][T25655] netlink: 'syz.3.6017': attribute type 1 has an invalid length.
[  427.329087][T25655] bond2: (slave bridge1): making interface the new active one
[  427.332702][T25655] bond2: (slave bridge1): Enslaving as an active interface with an up link
[  427.471817][T24899] Bluetooth: hci2: command tx timeout
[  427.680163][T25690] netlink: zone id is out of range
[  427.683148][T25690] netlink: zone id is out of range
[  427.685155][T25690] netlink: zone id is out of range
[  427.687927][T25690] netlink: zone id is out of range
[  427.689531][T25690] netlink: zone id is out of range
[  427.691075][T25690] netlink: zone id is out of range
[  427.696466][T25690] netlink: zone id is out of range
[  427.698060][T25690] netlink: zone id is out of range
[  427.699634][T25690] netlink: zone id is out of range
[  427.703766][T25690] xt_cgroup: path and classid specified
[  427.801945][T25697] vlan0: entered promiscuous mode
[  427.995472][T25717] netlink: 'syz.3.6037': attribute type 3 has an invalid length.
[  428.055106][T25720] x_tables: ip6_tables: CLASSIFY target: used from hooks PREROUTING, but only usable from FORWARD/OUTPUT/POSTROUTING
[  428.365755][T25752] lo speed is unknown, defaulting to 1000
[  428.656105][T25753] lo speed is unknown, defaulting to 1000
[  429.247924][T25787] gretap0: entered promiscuous mode
[  429.551710][T24899] Bluetooth: hci2: command 0x0405 tx timeout
[  429.603621][T25799] batadv1: entered promiscuous mode
[  429.888357][T25811] ip6t_srh: unknown srh invflags 4000
[  430.438735][T25860] netlink: 'syz.4.6088': attribute type 1 has an invalid length.
[  430.489842][T25860] bridge_slave_0: left allmulticast mode
[  430.492377][T25860] bridge_slave_0: left promiscuous mode
[  430.494387][T25860] bridge0: port 1(bridge_slave_0) entered disabled state
[  430.498752][T25860] bridge_slave_1: left allmulticast mode
[  430.500648][T25860] bridge_slave_1: left promiscuous mode
[  430.505939][T25860] bridge0: port 2(bridge_slave_1) entered disabled state
[  430.512771][T25860] bond0: (slave bond_slave_0): Releasing backup interface
[  430.519550][T25860] bond0: (slave bond_slave_1): Releasing backup interface
[  430.544091][T25860] team0: Port device team_slave_0 removed
[  430.551113][T25860] team0: Port device team_slave_1 removed
[  430.553950][T25860] batman_adv: batadv0: Interface deactivated: batadv_slave_0
[  430.556262][T25860] batman_adv: batadv0: Removing interface: batadv_slave_0
[  430.559573][T25860] batman_adv: batadv0: Interface deactivated: batadv_slave_1
[  430.562187][T25860] batman_adv: batadv0: Removing interface: batadv_slave_1
[  430.685606][T25886] netlink: 'syz.3.6094': attribute type 11 has an invalid length.
[  430.778244][T25894] x_tables: duplicate underflow at hook 3
[  430.787134][T25891] syzkaller0: entered promiscuous mode
[  430.788899][T25891] syzkaller0: entered allmulticast mode
[  432.199548][T25919] netlink: 'syz.4.6106': attribute type 12 has an invalid length.
[  432.204059][T25919] __nla_validate_parse: 87 callbacks suppressed
[  432.204067][T25919] netlink: 9472 bytes leftover after parsing attributes in process `syz.4.6106'.
[  432.287885][T25926] netlink: 4 bytes leftover after parsing attributes in process `syz.4.6109'.
[  432.405910][T25931] netlink: 'syz.1.6111': attribute type 1 has an invalid length.
[  432.578855][T25948] xt_time: invalid argument - start or stop time greater than 23:59:59
[  432.715612][T25956] vti0: entered promiscuous mode
[  432.721146][T25958] netlink: 'syz.3.6122': attribute type 1 has an invalid length.
[  432.921180][T25978] sysfs: cannot create duplicate filename '/class/ieee80211/^>>Mv^侦Kc'A_xDpj8TT!'
[  432.925287][T25978] CPU: 1 UID: 0 PID: 25978 Comm: syz.4.6125 Not tainted 6.16.0-rc5-syzkaller-00212-g9f735b6f8a77-dirty #0 PREEMPT(full) 
[  432.925301][T25978] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.2-debian-1.16.2-1 04/01/2014
[  432.925308][T25978] Call Trace:
[  432.925313][T25978]  <TASK>
[  432.925318][T25978]  dump_stack_lvl+0x189/0x250
[  432.925340][T25978]  ? __pfx_dump_stack_lvl+0x10/0x10
[  432.925351][T25978]  ? __pfx__printk+0x10/0x10
[  432.925365][T25978]  ? kernfs_path_from_node+0x2c/0x260
[  432.925376][T25978]  ? kernfs_path_from_node+0x2c/0x260
[  432.925383][T25978]  ? kernfs_path_from_node+0x2c/0x260
[  432.925392][T25978]  ? kernfs_path_from_node+0x22c/0x260
[  432.925399][T25978]  ? kernfs_path_from_node+0x2c/0x260
[  432.925409][T25978]  sysfs_warn_dup+0x8e/0xa0
[  432.925421][T25978]  sysfs_do_create_link_sd+0xc0/0x110
[  432.925432][T25978]  device_add_class_symlinks+0x1cf/0x240
[  432.925448][T25978]  device_add+0x475/0xb50
[  432.925463][T25978]  wiphy_register+0x199a/0x26b0
[  432.925486][T25978]  ? __pfx_wiphy_register+0x10/0x10
[  432.925496][T25978]  ? minstrel_ht_alloc+0x6dd/0x7e0
[  432.925512][T25978]  ? ieee80211_init_rate_ctrl_alg+0x56d/0x5f0
[  432.925527][T25978]  ieee80211_register_hw+0x33e1/0x4120
[  432.925549][T25978]  ? ieee80211_register_hw+0x14d1/0x4120
[  432.925565][T25978]  ? __pfx_ieee80211_register_hw+0x10/0x10
[  432.925579][T25978]  ? __pfx__raw_spin_unlock_irqrestore+0x10/0x10
[  432.925597][T25978]  ? __hrtimer_setup+0x187/0x210
[  432.925607][T25978]  ? __pfx_mac80211_hwsim_beacon+0x10/0x10
[  432.925625][T25978]  mac80211_hwsim_new_radio+0x2f0e/0x5340
[  432.925659][T25978]  ? __pfx_mac80211_hwsim_new_radio+0x10/0x10
[  432.925671][T25978]  ? trace_kmalloc+0x1f/0xd0
[  432.925685][T25978]  ? __kmalloc_node_track_caller_noprof+0x28e/0x4e0
[  432.925722][T25978]  ? kstrndup+0xbf/0x160
[  432.925739][T25978]  hwsim_new_radio_nl+0xea4/0x1b10
[  432.925754][T25978]  ? __pfx___nla_validate_parse+0x10/0x10
[  432.925775][T25978]  ? __pfx_hwsim_new_radio_nl+0x10/0x10
[  432.925789][T25978]  ? genl_family_rcv_msg_attrs_parse+0xa3/0x2a0
[  432.925804][T25978]  ? __nla_parse+0x40/0x60
[  432.925815][T25978]  ? genl_family_rcv_msg_attrs_parse+0x1c9/0x2a0
[  432.925828][T25978]  genl_family_rcv_msg_doit+0x215/0x300
[  432.925841][T25978]  ? __pfx_genl_family_rcv_msg_doit+0x10/0x10
[  432.925856][T25978]  ? bpf_lsm_capable+0x9/0x20
[  432.925870][T25978]  ? security_capable+0x7e/0x2e0
[  432.925883][T25978]  genl_rcv_msg+0x60e/0x790
[  432.925894][T25978]  ? __pfx_genl_rcv_msg+0x10/0x10
[  432.925903][T25978]  ? __pfx_hwsim_new_radio_nl+0x10/0x10
[  432.925922][T25978]  netlink_rcv_skb+0x208/0x470
[  432.925934][T25978]  ? __pfx_genl_rcv_msg+0x10/0x10
[  432.925943][T25978]  ? __pfx_netlink_rcv_skb+0x10/0x10
[  432.925963][T25978]  ? down_read+0x1ad/0x2e0
[  432.925974][T25978]  genl_rcv+0x28/0x40
[  432.925982][T25978]  netlink_unicast+0x75c/0x8e0
[  432.925998][T25978]  netlink_sendmsg+0x805/0xb30
[  432.926014][T25978]  ? __pfx_netlink_sendmsg+0x10/0x10
[  432.926027][T25978]  ? aa_sock_msg_perm+0x94/0x160
[  432.926037][T25978]  ? bpf_lsm_socket_sendmsg+0x9/0x20
[  432.926047][T25978]  ? __pfx_netlink_sendmsg+0x10/0x10
[  432.926058][T25978]  __sock_sendmsg+0x21c/0x270
[  432.926070][T25978]  ____sys_sendmsg+0x505/0x830
[  432.926086][T25978]  ? __pfx_____sys_sendmsg+0x10/0x10
[  432.926103][T25978]  ? import_iovec+0x74/0xa0
[  432.926117][T25978]  ___sys_sendmsg+0x21f/0x2a0
[  432.926131][T25978]  ? __pfx____sys_sendmsg+0x10/0x10
[  432.926162][T25978]  ? __fget_files+0x2a/0x420
[  432.926170][T25978]  ? __fget_files+0x3a0/0x420
[  432.926183][T25978]  __x64_sys_sendmsg+0x19b/0x260
[  432.926197][T25978]  ? __pfx___x64_sys_sendmsg+0x10/0x10
[  432.926215][T25978]  ? rcu_is_watching+0x15/0xb0
[  432.926228][T25978]  ? do_syscall_64+0xbe/0x3b0
[  432.926241][T25978]  do_syscall_64+0xfa/0x3b0
[  432.926249][T25978]  ? lockdep_hardirqs_on+0x9c/0x150
[  432.926257][T25978]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  432.926266][T25978]  ? exc_page_fault+0x9f/0xf0
[  432.926275][T25978]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  432.926283][T25978] RIP: 0033:0x7f945798e9a9
[  432.926294][T25978] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
[  432.926302][T25978] RSP: 002b:00007f945870f038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e
[  432.926312][T25978] RAX: ffffffffffffffda RBX: 00007f9457bb5fa0 RCX: 00007f945798e9a9
[  432.926319][T25978] RDX: 0000000000000300 RSI: 0000200000000040 RDI: 0000000000000007
[  432.926325][T25978] RBP: 00007f9457a10ca1 R08: 0000000000000000 R09: 0000000000000000
[  432.926331][T25978] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
[  432.926337][T25978] R13: 0000000000000000 R14: 00007f9457bb5fa0 R15: 00007ffe8bb6c1b8
[  432.926353][T25978]  </TASK>
[  433.070489][T25970] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512
[  433.076094][T25969] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512
[  433.145883][T25984] net_ratelimit: 166 callbacks suppressed
[  433.145893][T25984] openvswitch: netlink: Missing key (keys=40, expected=2000)
[  433.194809][T25988] netlink: 108 bytes leftover after parsing attributes in process `syz.4.6129'.
[  433.291231][T26004] netlink: 'syz.3.6134': attribute type 8 has an invalid length.
[  433.319543][T26004] openvswitch: netlink: Flow actions may not be safe on all matching packets.
[  433.482162][T26018] netlink: 28 bytes leftover after parsing attributes in process `syz.4.6141'.
[  433.484935][T26018] netlink: 'syz.4.6141': attribute type 7 has an invalid length.
[  433.487290][T26018] netlink: 'syz.4.6141': attribute type 8 has an invalid length.
[  433.489635][T26018] netlink: 4 bytes leftover after parsing attributes in process `syz.4.6141'.
[  433.525182][T26023] netlink: 8 bytes leftover after parsing attributes in process `syz.3.6143'.
[  433.570273][T26025] netlink: 16 bytes leftover after parsing attributes in process `syz.3.6144'.
[  433.588978][T26027] netlink: 'syz.4.6145': attribute type 1 has an invalid length.
[  433.591382][T26027] netlink: 'syz.4.6145': attribute type 2 has an invalid length.
[  433.616105][T26027] netlink: 'syz.4.6145': attribute type 2 has an invalid length.
[  433.618464][T26027] netlink: 'syz.4.6145': attribute type 2 has an invalid length.
[  433.768493][T26043] netlink: 4 bytes leftover after parsing attributes in process `syz.4.6150'.
[  433.771356][T26043] netlink: 34 bytes leftover after parsing attributes in process `syz.4.6150'.
[  433.834697][T26047] openvswitch: netlink: Flow actions may not be safe on all matching packets.
[  434.041086][T26067] bond0: entered promiscuous mode
[  434.043564][T26067] @: entered promiscuous mode
[  434.045426][T26067] bond_slave_1: entered promiscuous mode
[  434.048541][T26067] batadv0: entered promiscuous mode
[  434.050705][T26067] debugfs: Directory 'hsr1' with parent 'hsr' already present!
[  434.055093][T26067] Cannot create hsr debugfs directory
[  434.057295][T26067] hsr1: entered allmulticast mode
[  434.058909][T26067] bond0: entered allmulticast mode
[  434.060491][T26067] @: entered allmulticast mode
[  434.068548][T26067] bond_slave_1: entered allmulticast mode
[  434.070400][T26067] batadv0: entered allmulticast mode
[  434.074845][T26067] 8021q: adding VLAN 0 to HW filter on device hsr1
[  434.078407][T26067] bond0: left promiscuous mode
[  434.080029][T26067] @: left promiscuous mode
[  434.081918][T26067] bond_slave_1: left promiscuous mode
[  434.084315][T26067] batadv0: left promiscuous mode
[  434.187083][T26075] lo speed is unknown, defaulting to 1000
[  434.204501][T26076] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check.
[  434.225843][T26077] netlink: 36 bytes leftover after parsing attributes in process `syz.3.6160'.
[  434.486808][T26080] net veth1_virt_wifi virt_wifi0: refused to change device tx_queue_len
[  434.597065][T26085] Cannot find set identified by id 2 to match
[  434.606109][T26086] Cannot find set identified by id 2 to match
[  435.433232][T26127] openvswitch: netlink: Flow actions attr not present in new flow.
[  435.697110][T26136] tipc: Enabling of bearer <eth:syzkaller0> rejected, already enabled
[  436.080344][T26165] openvswitch: netlink: Flow actions may not be safe on all matching packets.
[  436.190282][T26175] xt_SECMARK: mode already set to 1 cannot mix with rules for mode 0
[  436.485501][T26188] bridge0: port 2(bridge_slave_1) entered disabled state
[  436.488026][T26188] bridge0: port 1(bridge_slave_0) entered disabled state
[  436.612809][T26188] batman_adv: batadv0: Interface deactivated: batadv_slave_1
[  436.670891][T26188] vlan0: left promiscuous mode
[  436.712612][T26188] netdevsim netdevsim3 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0
[  436.715363][T26188] netdevsim netdevsim3 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0
[  436.718149][T26188] netdevsim netdevsim3 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0
[  436.720863][T26188] netdevsim netdevsim3 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0
[  436.735352][T26205] netlink: 'syz.4.6203': attribute type 11 has an invalid length.
[  436.790830][T26200] veth3: entered promiscuous mode
[  436.818555][T26201] erspan0: entered allmulticast mode
[  438.079710][T26255] __nla_validate_parse: 19 callbacks suppressed
[  438.079721][T26255] netlink: 12 bytes leftover after parsing attributes in process `syz.4.6218'.
[  438.118569][T26261] delete_channel: no stack
[  438.143502][T26263] netlink: 20 bytes leftover after parsing attributes in process `syz.3.6222'.
[  438.172369][T26265] bond0: Unable to set up delay as MII monitoring is disabled
[  438.289664][T26275] netlink: 32 bytes leftover after parsing attributes in process `syz.3.6225'.
[  438.650680][T26304] netlink: 8 bytes leftover after parsing attributes in process `syz.1.6233'.
[  438.656489][T26304] netlink: 28 bytes leftover after parsing attributes in process `syz.1.6233'.
[  438.663940][T26304] netdevsim netdevsim1 eth0: set [1, 0] type 2 family 0 port 6081 - 0
[  438.666590][T26304] netdevsim netdevsim1 eth1: set [1, 0] type 2 family 0 port 6081 - 0
[  438.669020][T26304] netdevsim netdevsim1 eth2: set [1, 0] type 2 family 0 port 6081 - 0
[  438.671404][T26304] netdevsim netdevsim1 eth3: set [1, 0] type 2 family 0 port 6081 - 0
[  438.677196][T26304] geneve0: entered promiscuous mode
[  438.678821][T26304] geneve0: entered allmulticast mode
[  438.806803][T26317] netlink: 188 bytes leftover after parsing attributes in process `syz.1.6238'.
[  438.809558][T26317] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE
[  438.891830][T26328] netlink: 20 bytes leftover after parsing attributes in process `syz.1.6241'.
[  439.010820][T26345] netlink: 188 bytes leftover after parsing attributes in process `syz.1.6248'.
[  439.022428][T26345] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE
[  439.038176][T26349] validate_nla: 12 callbacks suppressed
[  439.038187][T26349] netlink: 'syz.4.6250': attribute type 21 has an invalid length.
[  439.042429][T26349] netlink: 128 bytes leftover after parsing attributes in process `syz.4.6250'.
[  439.045121][T26349] netlink: 'syz.4.6250': attribute type 4 has an invalid length.
[  439.047487][T26349] netlink: 'syz.4.6250': attribute type 3 has an invalid length.
[  439.049734][T26349] netlink: 3 bytes leftover after parsing attributes in process `syz.4.6250'.
[  439.117819][T26358] input: Bluetooth HID Boot Protocol Device as /devices/virtual/bluetooth/hci2/hci2:200/input7
[  439.190484][T26366] veth0_to_team: entered promiscuous mode
[  439.194978][T26366] veth0_to_team: entered allmulticast mode
[  439.263357][T26358] netlink: 'syz.1.6254': attribute type 3 has an invalid length.
[  439.423840][T26381] IPv6: NLM_F_CREATE should be specified when creating new route
[  439.426320][T26381] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE
[  439.428467][T26381] IPv6: NLM_F_CREATE should be set when creating new route
[  439.430648][T26381] IPv6: NLM_F_CREATE should be set when creating new route
[  439.432989][T26381] IPv6: NLM_F_CREATE should be set when creating new route
[  439.669912][T26395] vlan2: entered promiscuous mode
[  439.671703][T26395] vlan2: entered allmulticast mode
[  439.673314][T26395] hsr_slave_1: entered allmulticast mode
[  440.006807][T26410] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE
[  440.289653][T26438] netlink: 'syz.3.6278': attribute type 1 has an invalid length.
[  440.415590][T26446] netlink: 'syz.4.6281': attribute type 58 has an invalid length.
[  441.380866][T26483] netlink: 'syz.3.6295': attribute type 10 has an invalid length.
[  441.387345][T26483] bridge0: port 3(dummy0) entered blocking state
[  441.390112][T26483] bridge0: port 3(dummy0) entered disabled state
[  441.393179][T26483] dummy0: entered allmulticast mode
[  441.396076][T26483] dummy0: entered promiscuous mode
[  441.480017][T26484] lo speed is unknown, defaulting to 1000
[  441.986658][T26510] netlink: 'syz.4.6303': attribute type 1 has an invalid length.
[  442.199645][T26520] 8021q: VLANs not supported on lo
[  442.319257][T26529] syz.4.6309: vmalloc error: size 8589938688, exceeds total pages, mode:0xdc0(GFP_KERNEL|__GFP_ZERO), nodemask=(null),cpuset=/,mems_allowed=0-1
[  442.336842][T26529] CPU: 1 UID: 0 PID: 26529 Comm: syz.4.6309 Not tainted 6.16.0-rc5-syzkaller-00212-g9f735b6f8a77-dirty #0 PREEMPT(full) 
[  442.336860][T26529] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.2-debian-1.16.2-1 04/01/2014
[  442.336866][T26529] Call Trace:
[  442.336871][T26529]  <TASK>
[  442.336875][T26529]  dump_stack_lvl+0x189/0x250
[  442.336893][T26529]  ? __pfx_dump_stack_lvl+0x10/0x10
[  442.336905][T26529]  ? __pfx__printk+0x10/0x10
[  442.336918][T26529]  ? cpuset_print_current_mems_allowed+0x1f/0x360
[  442.336931][T26529]  ? cpuset_print_current_mems_allowed+0x1f/0x360
[  442.336943][T26529]  ? cpuset_print_current_mems_allowed+0x2ee/0x360
[  442.336955][T26529]  warn_alloc+0x214/0x310
[  442.337004][T26529]  ? stack_depot_save_flags+0x40/0x900
[  442.337027][T26529]  ? __pfx_warn_alloc+0x10/0x10
[  442.337043][T26529]  ? kasan_save_track+0x4f/0x80
[  442.337056][T26529]  ? xskq_create+0x56/0x170
[  442.337066][T26529]  ? xsk_init_queue+0xb0/0x110
[  442.337073][T26529]  ? xsk_setsockopt+0x43f/0x710
[  442.337085][T26529]  ? do_sock_setsockopt+0x17c/0x1b0
[  442.337097][T26529]  ? __x64_sys_setsockopt+0x13f/0x1b0
[  442.337110][T26529]  ? do_syscall_64+0xfa/0x3b0
[  442.337118][T26529]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  442.337130][T26529]  __vmalloc_node_range_noprof+0x125/0x12f0
[  442.337157][T26529]  ? __pfx___vmalloc_node_range_noprof+0x10/0x10
[  442.337180][T26529]  ? __kasan_kmalloc+0x93/0xb0
[  442.337194][T26529]  vmalloc_user_noprof+0xad/0xf0
[  442.337207][T26529]  ? xskq_create+0xbf/0x170
[  442.337217][T26529]  xskq_create+0xbf/0x170
[  442.337227][T26529]  xsk_init_queue+0xb0/0x110
[  442.337255][T26529]  xsk_setsockopt+0x43f/0x710
[  442.337270][T26529]  ? __pfx_xsk_setsockopt+0x10/0x10
[  442.337286][T26529]  ? __fget_files+0x2a/0x420
[  442.337294][T26529]  ? aa_sock_opt_perm+0x74/0x110
[  442.337306][T26529]  ? bpf_lsm_socket_setsockopt+0x9/0x20
[  442.337316][T26529]  ? __pfx_xsk_setsockopt+0x10/0x10
[  442.337329][T26529]  do_sock_setsockopt+0x17c/0x1b0
[  442.337343][T26529]  __x64_sys_setsockopt+0x13f/0x1b0
[  442.337359][T26529]  do_syscall_64+0xfa/0x3b0
[  442.337368][T26529]  ? lockdep_hardirqs_on+0x9c/0x150
[  442.337378][T26529]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  442.337387][T26529]  ? exc_page_fault+0x9f/0xf0
[  442.337397][T26529]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  442.337405][T26529] RIP: 0033:0x7f945798e9a9
[  442.337414][T26529] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
[  442.337422][T26529] RSP: 002b:00007f945870f038 EFLAGS: 00000246 ORIG_RAX: 0000000000000036
[  442.337433][T26529] RAX: ffffffffffffffda RBX: 00007f9457bb5fa0 RCX: 00007f945798e9a9
[  442.337439][T26529] RDX: 0000000000000006 RSI: 000000000000011b RDI: 0000000000000003
[  442.337445][T26529] RBP: 00007f9457a10ca1 R08: 0000000000000004 R09: 0000000000000000
[  442.337451][T26529] R10: 0000200000000000 R11: 0000000000000246 R12: 0000000000000000
[  442.337457][T26529] R13: 0000000000000000 R14: 00007f9457bb5fa0 R15: 00007ffe8bb6c1b8
[  442.337472][T26529]  </TASK>
[  442.337554][T26529] Mem-Info:
[  442.442062][T26529] active_anon:14301 inactive_anon:0 isolated_anon:0
[  442.442062][T26529]  active_file:1462 inactive_file:38358 isolated_file:0
[  442.442062][T26529]  unevictable:1768 dirty:96 writeback:0
[  442.442062][T26529]  slab_reclaimable:11274 slab_unreclaimable:113606
[  442.442062][T26529]  mapped:18723 shmem:2604 pagetables:1096
[  442.442062][T26529]  sec_pagetables:0 bounce:0
[  442.442062][T26529]  kernel_misc_reclaimable:0
[  442.442062][T26529]  free:214370 free_pcp:25240 free_cma:0
[  442.471000][T26529] Node 0 active_anon:16404kB inactive_anon:0kB active_file:4344kB inactive_file:7416kB unevictable:3536kB isolated(anon):0kB isolated(file):0kB mapped:66660kB dirty:288kB writeback:0kB shmem:4952kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB writeback_tmp:0kB kernel_stack:9320kB pagetables:2684kB sec_pagetables:0kB all_unreclaimable? no Balloon:0kB
[  442.496208][T26529] Node 1 active_anon:40868kB inactive_anon:0kB active_file:1504kB inactive_file:146016kB unevictable:3536kB isolated(anon):0kB isolated(file):0kB mapped:8232kB dirty:96kB writeback:0kB shmem:5464kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB writeback_tmp:0kB kernel_stack:5724kB pagetables:1700kB sec_pagetables:0kB all_unreclaimable? no Balloon:0kB
[  442.527280][T26529] Node 0 DMA free:15360kB boost:0kB min:640kB low:800kB high:960kB reserved_highatomic:0KB free_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB present:15992kB managed:15360kB mlocked:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB
[  442.548412][T26529] lowmem_reserve[]: 0 812 812 812 812
[  442.563389][T26529] Node 0 DMA32 free:155536kB boost:0kB min:33656kB low:42068kB high:50480kB reserved_highatomic:0KB free_highatomic:0KB active_anon:16404kB inactive_anon:0kB active_file:4344kB inactive_file:7416kB unevictable:3536kB writepending:288kB present:1556484kB managed:831988kB mlocked:0kB bounce:0kB free_pcp:49528kB local_pcp:30692kB free_cma:0kB
[  442.566212][T26540] netlink: 'syz.3.6314': attribute type 2 has an invalid length.
[  442.580869][T26540] batadv_slave_1: entered promiscuous mode
[  442.585182][T26529] lowmem_reserve[]: 0 0 0 0 0
[  442.587762][T26540] batadv_slave_1: left promiscuous mode
[  442.592322][T26540] netlink: 'syz.3.6314': attribute type 4 has an invalid length.
[  442.595146][T26529] Node 1 DMA32 free:446236kB boost:0kB min:19192kB low:23988kB high:28784kB reserved_highatomic:0KB free_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB present:524152kB managed:458616kB mlocked:0kB bounce:0kB free_pcp:12248kB local_pcp:256kB free_cma:0kB
[  442.621639][T26529] lowmem_reserve[]: 0 0 854 854 854
[  442.625684][T26529] Node 1 Normal free:240156kB boost:0kB min:36616kB low:45768kB high:54920kB reserved_highatomic:0KB free_highatomic:0KB active_anon:40868kB inactive_anon:0kB active_file:1504kB inactive_file:146016kB unevictable:3536kB writepending:96kB present:1048576kB managed:875016kB mlocked:0kB bounce:0kB free_pcp:40552kB local_pcp:15792kB free_cma:0kB
[  442.639784][T26529] lowmem_reserve[]: 0 0 0 0 0
[  442.646040][T26529] Node 0 DMA: 0*4kB 0*8kB 0*16kB 0*32kB 0*64kB 0*128kB 0*256kB 0*512kB 1*1024kB (U) 1*2048kB (M) 3*4096kB (M) = 15360kB
[  442.650231][T26529] Node 0 DMA32: 868*4kB (UM) 840*8kB (UME) 238*16kB (UME) 102*32kB (UM) 27*64kB (UME) 16*128kB (UME) 3*256kB (UME) 5*512kB (UME) 2*1024kB (UM) 1*2048kB (M) 31*4096kB (UM) = 155440kB
[  442.659018][T26529] Node 1 DMA32: 13*4kB (UM) 9*8kB (UM) 14*16kB (UME) 18*32kB (UME) 14*64kB (UM) 10*128kB (UM) 15*256kB (UME) 16*512kB (UME) 13*1024kB (UME) 12*2048kB (UME) 96*4096kB (UM) = 446236kB
[  442.672793][T26529] Node 1 Normal: 1519*4kB (UME) 1172*8kB (UME) 696*16kB (UME) 150*32kB (UME) 338*64kB (UE) 214*128kB (U) 114*256kB (UME) 41*512kB (UM) 15*1024kB (UM) 8*2048kB (UM) 19*4096kB (UM) = 240156kB
[  442.686914][T26529] Node 0 hugepages_total=2 hugepages_free=2 hugepages_surp=0 hugepages_size=2048kB
[  442.690266][T26529] Node 1 hugepages_total=2 hugepages_free=2 hugepages_surp=0 hugepages_size=2048kB
[  442.701349][T26529] 42424 total pagecache pages
[  442.704485][T26529] 0 pages in swap cache
[  442.705848][T26529] Free swap  = 124996kB
[  442.707239][T26529] Total swap = 124996kB
[  442.708606][T26529] 786301 pages RAM
[  442.709790][T26529] 0 pages HighMem/MovableOnly
[  442.711309][T26529] 241056 pages reserved
[  442.715303][T26529] 0 pages cma reserved
[  443.014938][T26567] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE
[  443.228529][T26577] @: renamed from veth0_vlan
[  443.263241][T26579] __nla_validate_parse: 22 callbacks suppressed
[  443.263252][T26579] netlink: 8 bytes leftover after parsing attributes in process `syz.3.6330'.
[  443.400011][T26584] netlink: 20 bytes leftover after parsing attributes in process `syz.3.6332'.
[  443.718565][T26604] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE
[  443.720830][T26604] IPv6: NLM_F_CREATE should be set when creating new route
[  443.723016][T26604] IPv6: NLM_F_CREATE should be set when creating new route
[  443.725120][T26604] IPv6: NLM_F_CREATE should be set when creating new route
[  443.790633][T26606] netlink: 8 bytes leftover after parsing attributes in process `syz.3.6340'.
[  443.894296][T26612] netlink: 6032 bytes leftover after parsing attributes in process `syz.4.6342'.
[  444.064399][T26621] netlink: 16 bytes leftover after parsing attributes in process `syz.4.6345'.
[  444.195780][T26626] netlink: 8 bytes leftover after parsing attributes in process `syz.4.6347'.
[  444.198486][T26626] netlink: 4 bytes leftover after parsing attributes in process `syz.4.6347'.
[  444.201174][T26626] validate_nla: 4 callbacks suppressed
[  444.201181][T26626] netlink: 'syz.4.6347': attribute type 1 has an invalid length.
[  444.207399][T26626] netlink: 10 bytes leftover after parsing attributes in process `syz.4.6347'.
[  444.266121][T26628] netlink: 1041 bytes leftover after parsing attributes in process `syz.4.6348'.
[  444.269105][T26628] netlink: 8 bytes leftover after parsing attributes in process `syz.4.6348'.
[  444.701195][T26641] netlink: 'syz.3.6351': attribute type 21 has an invalid length.
[  444.704130][T26641] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE
[  444.706567][T26641] IPv6: NLM_F_CREATE should be set when creating new route
[  445.919377][T26705] netlink: 'syz.3.6375': attribute type 21 has an invalid length.
[  445.922015][T26705] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE
[  445.922589][T26703] netlink: 'syz.4.6374': attribute type 21 has an invalid length.
[  445.924106][T26705] IPv6: NLM_F_CREATE should be set when creating new route
[  445.928617][T26705] IPv6: NLM_F_CREATE should be set when creating new route
[  445.975968][T26710] netlink: 'syz.4.6377': attribute type 29 has an invalid length.
[  446.140923][T26734] netlink: 'syz.3.6385': attribute type 21 has an invalid length.
[  446.144402][T26734] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE
[  446.292232][T26747] syzkaller1: entered promiscuous mode
[  446.294239][T26747] syzkaller1: entered allmulticast mode
[  446.518514][ T1146] block nbd0: Possible stuck request ffff888022928000: control (read@0,4096B). Runtime 210 seconds
[  446.829562][T26757] netlink: 'syz.1.6392': attribute type 21 has an invalid length.
[  446.832861][T26757] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE
[  446.835114][T26757] IPv6: NLM_F_CREATE should be set when creating new route
[  446.837665][T26757] IPv6: NLM_F_CREATE should be set when creating new route
[  447.145727][T26767] openvswitch: netlink: Key 6 has unexpected len 4 expected 2
[  447.225366][T26776] Bluetooth: hci1: Opcode 0x080f failed: -4
[  447.389752][T26791] lo speed is unknown, defaulting to 1000
[  447.464050][T26797] macvtap1: entered promiscuous mode
[  447.465811][T26797] gretap0: entered promiscuous mode
[  447.467627][T26797] macvtap1: entered allmulticast mode
[  447.469240][T26797] gretap0: entered allmulticast mode
[  447.687436][T26812] tipc: Cannot configure node identity twice
[  447.689497][T26811] tipc: Cannot configure node identity twice
[  447.697257][T26817] batadv_slave_1: entered promiscuous mode
[  447.729491][T26814] batadv_slave_1: left promiscuous mode
[  447.779678][T26824] A link change request failed with some changes committed already. Interface gre0 may have been left with an inconsistent configuration, please check.
[  448.294394][T26856] netlink: 'syz.3.6424': attribute type 17 has an invalid length.
[  448.303708][T26856] __nla_validate_parse: 16 callbacks suppressed
[  448.303719][T26856] netlink: 2 bytes leftover after parsing attributes in process `syz.3.6424'.
[  448.308581][T26856] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check.
[  448.433264][T26869] netlink: 12 bytes leftover after parsing attributes in process `syz.4.6429'.
[  448.545768][T26878] netlink: 44 bytes leftover after parsing attributes in process `syz.4.6432'.
[  448.564749][T26880] netlink: 'syz.1.6433': attribute type 58 has an invalid length.
[  448.567176][T26880] netlink: 20 bytes leftover after parsing attributes in process `syz.1.6433'.
[  448.808049][T26899] netlink: 4 bytes leftover after parsing attributes in process `syz.1.6439'.
[  448.880433][T26901] tipc: Enabling of bearer <eth:syzkaller0> rejected, already enabled
[  448.956176][T26903] netlink: 1041 bytes leftover after parsing attributes in process `syz.1.6440'.
[  448.959726][T26903] netlink: 8 bytes leftover after parsing attributes in process `syz.1.6440'.
[  449.043049][T26908] Bluetooth: MGMT ver 1.23
[  449.113737][T26911] ip6t_srh: unknown srh invflags 4449
[  449.166689][T26916] netlink: 4 bytes leftover after parsing attributes in process `syz.1.6444'.
[  449.231762][   T55] Bluetooth: hci1: command 0x080f tx timeout
[  449.660649][T26932] syzkaller0: entered allmulticast mode
[  449.774801][T26935] pim6reg: entered allmulticast mode
[  449.789012][T26935] lo: entered allmulticast mode
[  449.790860][T26935] lo: left allmulticast mode
[  449.793575][T26935] pim6reg: left allmulticast mode
[  450.013633][T26949] netlink: 12 bytes leftover after parsing attributes in process `syz.3.6454'.
[  450.168646][T26962] netlink: 'syz.1.6459': attribute type 21 has an invalid length.
[  450.171021][T26962] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE
[  450.177734][T26961] x_tables: ip6_tables: TCPMSS target: only valid for protocol 6
[  450.348982][T26975] _Z`Ԁ@: entered promiscuous mode
[  450.377859][T26978] netlink: 24 bytes leftover after parsing attributes in process `syz.3.6465'.
[  450.449211][T26986] x_tables: duplicate underflow at hook 3
[  450.468310][T26988] netlink: 'syz.4.6468': attribute type 21 has an invalid length.
[  450.470815][T26988] IPv6: NLM_F_CREATE should be specified when creating new route
[  450.474512][T26988] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE
[  450.476727][T26988] IPv6: NLM_F_CREATE should be set when creating new route
[  450.478881][T26988] IPv6: NLM_F_CREATE should be set when creating new route
[  450.481037][T26988] IPv6: NLM_F_CREATE should be set when creating new route
[  450.506633][T26985] RDS: rds_bind could not find a transport for ::ffff:172.20.20.170, load rds_tcp or rds_rdma?
[  450.651883][T27005] erspan0: left allmulticast mode
[  450.654896][T27005] veth0_to_team: left promiscuous mode
[  450.656626][T27005] veth0_to_team: left allmulticast mode
[  450.658487][T27005] veth1_to_team: left allmulticast mode
[  450.660495][T27005] veth1_to_batadv: left allmulticast mode
[  450.665444][T27005] macsec0: left promiscuous mode
[  450.667797][T27005] gre1: left allmulticast mode
[  450.669863][T27005] veth3: left promiscuous mode
[  450.673115][T27005] sit3: left promiscuous mode
[  450.674907][T27005] erspan1: left promiscuous mode
[  450.676434][T27005] erspan1: left allmulticast mode
[  450.679418][T27005] ip6gretap1: left promiscuous mode
[  450.684150][T27005] tipc: Resetting bearer <eth:syzkaller0>
[  450.686222][T27005] syzkaller0: left promiscuous mode
[  450.687874][T27005] syzkaller0: left allmulticast mode
[  450.693065][T27005] ip6tnl1: left promiscuous mode
[  450.694607][T27005] ip6tnl1: left allmulticast mode
[  450.696454][T27005] gtp1: left promiscuous mode
[  450.697884][T27005] gtp1: left allmulticast mode
[  450.699881][T27005] gtp2: left promiscuous mode
[  450.701327][T27005] gtp2: left allmulticast mode
[  450.705560][T27005] vlan0: left promiscuous mode
[  450.707282][T27005] vlan0: left allmulticast mode
[  450.708771][T27005] hsr_slave_1: left allmulticast mode
[  450.710684][T27005] bridge10: left promiscuous mode
[  450.712845][T27005] bridge11: left promiscuous mode
[  450.727986][T27005] veth0_macvtap: left allmulticast mode
[  450.729729][T27005] veth0_macvtap: left promiscuous mode
[  450.733559][T27005] macvtap1: left allmulticast mode
[  450.737056][T27005] netdevsim netdevsim1 eth0: unset [1, 0] type 2 family 0 port 6081 - 0
[  450.739614][T27005] netdevsim netdevsim1 eth1: unset [1, 0] type 2 family 0 port 6081 - 0
[  450.742200][T27005] netdevsim netdevsim1 eth2: unset [1, 0] type 2 family 0 port 6081 - 0
[  450.744750][T27005] netdevsim netdevsim1 eth3: unset [1, 0] type 2 family 0 port 6081 - 0
[  450.747508][T27005] geneve0: left promiscuous mode
[  450.749047][T27005] geneve0: left allmulticast mode
[  450.769695][T27006] 8021q: adding VLAN 0 to HW filter on device bond34
[  450.971275][T27019] netlink: 'syz.1.6476': attribute type 21 has an invalid length.
[  450.973887][T27019] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE
[  451.026093][T27023] netlink: 'syz.1.6478': attribute type 1 has an invalid length.
[  451.300419][   T33] audit: type=1800 audit(1753037434.119:17): pid=27037 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.1.6482" name="blkio.bfq.io_queued_recursive" dev="tmpfs" ino=10714 res=0 errno=0
[  451.488112][T27055] sysfs: cannot create duplicate filename '/class/ieee80211/^>>Mv^侦Kc'A_xDpj8TT!'
[  451.494387][T27055] CPU: 1 UID: 0 PID: 27055 Comm: syz.3.6486 Not tainted 6.16.0-rc5-syzkaller-00212-g9f735b6f8a77-dirty #0 PREEMPT(full) 
[  451.494405][T27055] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.2-debian-1.16.2-1 04/01/2014
[  451.494412][T27055] Call Trace:
[  451.494416][T27055]  <TASK>
[  451.494421][T27055]  dump_stack_lvl+0x189/0x250
[  451.494439][T27055]  ? __pfx_dump_stack_lvl+0x10/0x10
[  451.494450][T27055]  ? __pfx__printk+0x10/0x10
[  451.494478][T27055]  ? kernfs_path_from_node+0x2c/0x260
[  451.494490][T27055]  ? kernfs_path_from_node+0x2c/0x260
[  451.494498][T27055]  ? kernfs_path_from_node+0x2c/0x260
[  451.494508][T27055]  ? kernfs_path_from_node+0x22c/0x260
[  451.494516][T27055]  ? kernfs_path_from_node+0x2c/0x260
[  451.494527][T27055]  sysfs_warn_dup+0x8e/0xa0
[  451.494541][T27055]  sysfs_do_create_link_sd+0xc0/0x110
[  451.494552][T27055]  device_add_class_symlinks+0x1cf/0x240
[  451.494567][T27055]  device_add+0x475/0xb50
[  451.494581][T27055]  wiphy_register+0x199a/0x26b0
[  451.494600][T27055]  ? __pfx_wiphy_register+0x10/0x10
[  451.494610][T27055]  ? minstrel_ht_alloc+0x6dd/0x7e0
[  451.494625][T27055]  ? ieee80211_init_rate_ctrl_alg+0x56d/0x5f0
[  451.494641][T27055]  ieee80211_register_hw+0x33e1/0x4120
[  451.494663][T27055]  ? ieee80211_register_hw+0x14d1/0x4120
[  451.494679][T27055]  ? __pfx_ieee80211_register_hw+0x10/0x10
[  451.494693][T27055]  ? __pfx__raw_spin_unlock_irqrestore+0x10/0x10
[  451.494710][T27055]  ? __hrtimer_setup+0x187/0x210
[  451.494722][T27055]  ? __pfx_mac80211_hwsim_beacon+0x10/0x10
[  451.494738][T27055]  mac80211_hwsim_new_radio+0x2f0e/0x5340
[  451.494766][T27055]  ? __pfx_mac80211_hwsim_new_radio+0x10/0x10
[  451.494778][T27055]  ? trace_kmalloc+0x1f/0xd0
[  451.494789][T27055]  ? __kmalloc_node_track_caller_noprof+0x28e/0x4e0
[  451.494800][T27055]  ? kstrndup+0xbf/0x160
[  451.494814][T27055]  hwsim_new_radio_nl+0xea4/0x1b10
[  451.494827][T27055]  ? __pfx___nla_validate_parse+0x10/0x10
[  451.494845][T27055]  ? __pfx_hwsim_new_radio_nl+0x10/0x10
[  451.494863][T27055]  ? __nla_parse+0x40/0x60
[  451.494874][T27055]  ? genl_family_rcv_msg_attrs_parse+0x1c9/0x2a0
[  451.494889][T27055]  genl_family_rcv_msg_doit+0x215/0x300
[  451.494901][T27055]  ? __pfx_genl_family_rcv_msg_doit+0x10/0x10
[  451.494917][T27055]  ? bpf_lsm_capable+0x9/0x20
[  451.494927][T27055]  ? security_capable+0x7e/0x2e0
[  451.494941][T27055]  genl_rcv_msg+0x60e/0x790
[  451.494953][T27055]  ? __pfx_genl_rcv_msg+0x10/0x10
[  451.494962][T27055]  ? __pfx_hwsim_new_radio_nl+0x10/0x10
[  451.494981][T27055]  netlink_rcv_skb+0x208/0x470
[  451.494993][T27055]  ? __pfx_genl_rcv_msg+0x10/0x10
[  451.495002][T27055]  ? __pfx_netlink_rcv_skb+0x10/0x10
[  451.495022][T27055]  ? down_read+0x1ad/0x2e0
[  451.495033][T27055]  genl_rcv+0x28/0x40
[  451.495041][T27055]  netlink_unicast+0x75c/0x8e0
[  451.495056][T27055]  netlink_sendmsg+0x805/0xb30
[  451.495073][T27055]  ? __pfx_netlink_sendmsg+0x10/0x10
[  451.495086][T27055]  ? aa_sock_msg_perm+0x94/0x160
[  451.495095][T27055]  ? bpf_lsm_socket_sendmsg+0x9/0x20
[  451.495104][T27055]  ? __pfx_netlink_sendmsg+0x10/0x10
[  451.495116][T27055]  __sock_sendmsg+0x21c/0x270
[  451.495127][T27055]  ____sys_sendmsg+0x505/0x830
[  451.495142][T27055]  ? __pfx_____sys_sendmsg+0x10/0x10
[  451.495160][T27055]  ? import_iovec+0x74/0xa0
[  451.495180][T27055]  ___sys_sendmsg+0x21f/0x2a0
[  451.495196][T27055]  ? __pfx____sys_sendmsg+0x10/0x10
[  451.495230][T27055]  ? __fget_files+0x2a/0x420
[  451.495261][T27055]  ? __fget_files+0x3a0/0x420
[  451.495277][T27055]  __x64_sys_sendmsg+0x19b/0x260
[  451.495293][T27055]  ? __pfx___x64_sys_sendmsg+0x10/0x10
[  451.495313][T27055]  ? rcu_is_watching+0x15/0xb0
[  451.495327][T27055]  ? do_syscall_64+0xbe/0x3b0
[  451.495339][T27055]  do_syscall_64+0xfa/0x3b0
[  451.495347][T27055]  ? lockdep_hardirqs_on+0x9c/0x150
[  451.495355][T27055]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  451.495363][T27055]  ? exc_page_fault+0x9f/0xf0
[  451.495372][T27055]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  451.495380][T27055] RIP: 0033:0x7f811638e9a9
[  451.495390][T27055] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
[  451.495397][T27055] RSP: 002b:00007f811726f038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e
[  451.495409][T27055] RAX: ffffffffffffffda RBX: 00007f81165b6080 RCX: 00007f811638e9a9
[  451.495416][T27055] RDX: 0000000000000300 RSI: 0000200000000040 RDI: 0000000000000005
[  451.495422][T27055] RBP: 00007f8116410ca1 R08: 0000000000000000 R09: 0000000000000000
[  451.495428][T27055] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
[  451.495433][T27055] R13: 0000000000000000 R14: 00007f81165b6080 R15: 00007ffdf0936fa8
[  451.495450][T27055]  </TASK>
[  451.716079][T27062] netlink: 'syz.3.6490': attribute type 11 has an invalid length.
[  451.738816][T27058] delete_channel: no stack
[  452.229327][T27125] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE
[  452.231679][T27125] IPv6: NLM_F_CREATE should be set when creating new route
[  452.233909][T27125] IPv6: NLM_F_CREATE should be set when creating new route
[  452.236128][T27125] IPv6: NLM_F_CREATE should be set when creating new route
[  452.299744][T27132] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE
[  452.375807][T27138] tipc: Enabled bearer <eth:syzkaller0>, priority 0
[  452.378315][T27138] syzkaller0: entered promiscuous mode
[  452.380051][T27138] syzkaller0: entered allmulticast mode
[  452.396991][T27138] tipc: Resetting bearer <eth:syzkaller0>
[  452.405627][T27137] tipc: Resetting bearer <eth:syzkaller0>
[  452.418280][T27137] tipc: Disabling bearer <eth:syzkaller0>
[  452.863475][T27170] netlink: 'syz.1.6521': attribute type 41 has an invalid length.
[  453.408298][T27215] __nla_validate_parse: 24 callbacks suppressed
[  453.408309][T27215] netlink: 100 bytes leftover after parsing attributes in process `syz.1.6537'.
[  453.447053][T27217] netlink: 'syz.1.6538': attribute type 46 has an invalid length.
[  453.451151][T27217] netlink: 8 bytes leftover after parsing attributes in process `syz.1.6538'.
[  453.568956][   T62] block nbd2: Possible stuck request ffff888022980000: control (read@0,1024B). Runtime 240 seconds
[  453.572515][   T62] block nbd2: Possible stuck request ffff888022980200: control (read@1024,1024B). Runtime 240 seconds
[  453.576155][   T62] block nbd2: Possible stuck request ffff888022980400: control (read@2048,1024B). Runtime 240 seconds
[  453.579601][   T62] block nbd2: Possible stuck request ffff888022980600: control (read@3072,1024B). Runtime 240 seconds
[  453.580480][T27223] netlink: 8 bytes leftover after parsing attributes in process `syz.3.6540'.
[  453.585842][T27223] netlink: 8 bytes leftover after parsing attributes in process `syz.3.6540'.
[  453.696667][T27240] netlink: 1041 bytes leftover after parsing attributes in process `syz.1.6546'.
[  453.699891][T27240] netlink: 8 bytes leftover after parsing attributes in process `syz.1.6546'.
[  453.804190][T27254] netlink: 8 bytes leftover after parsing attributes in process `syz.1.6550'.
[  453.814879][T27254] netlink: 20 bytes leftover after parsing attributes in process `syz.1.6550'.
[  453.817593][T27254] netlink: 20 bytes leftover after parsing attributes in process `syz.1.6550'.
[  453.868330][T27265] netlink: 8 bytes leftover after parsing attributes in process `syz.1.6553'.
[  453.878765][T27266] netlink: 'syz.4.6554': attribute type 1 has an invalid length.
[  453.898086][T27266] 8021q: adding VLAN 0 to HW filter on device bond2
[  453.918940][T27266] bond2: (slave veth3): Enslaving as an active interface with a down link
[  453.926429][T27266] openvswitch: netlink: Geneve opt len 126 is not a multiple of 4.
[  453.934103][T27271] netlink: 'syz.3.6556': attribute type 8 has an invalid length.
[  454.129679][T27301] bridge_slave_0: entered promiscuous mode
[  454.989783][T27330] netlink: 'syz.3.6575': attribute type 17 has an invalid length.
[  454.994342][T27330] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check.
[  455.138109][T27337] SET target dimension over the limit!
[  455.165094][T27316] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512
[  455.209372][T27339] xt_l2tp: invalid flags combination: 4
[  455.370393][T27350] xt_CT: You must specify a L4 protocol and not use inversions on it
[  455.416916][T27365] (unnamed net_device) (uninitialized): option ad_user_port_key: mode dependency failed, not supported in mode balance-rr(0)
[  455.438284][T27364] (unnamed net_device) (uninitialized): option ad_user_port_key: mode dependency failed, not supported in mode balance-rr(0)
[  455.499590][T27371] netlink: 'syz.1.6591': attribute type 3 has an invalid length.
[  455.532109][T27378] sch_tbf: burst 0 is lower than device bridge3 mtu (1514) !
[  455.724848][T27400] (unnamed net_device) (uninitialized): option ad_actor_system: mode dependency failed, not supported in mode balance-rr(0)
[  455.781415][T27404] netlink: 'syz.4.6602': attribute type 11 has an invalid length.
[  456.375384][T27454] bond3: entered promiscuous mode
[  456.377252][T27454] 8021q: adding VLAN 0 to HW filter on device bond3
[  456.516237][T27457] netdevsim netdevsim4 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0
[  456.519089][T27457] netdevsim netdevsim4 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0
[  456.522580][T27457] netdevsim netdevsim4 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0
[  456.525312][T27457] netdevsim netdevsim4 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0
[  456.676423][T27463] pimreg: entered allmulticast mode
[  456.678517][T27463] pimreg: left allmulticast mode
[  457.076032][T27485] sctp: [Deprecated]: syz.3.6621 (pid 27485) Use of int in maxseg socket option.
[  457.076032][T27485] Use struct sctp_assoc_value instead
[  457.089912][T27487] netlink: 'syz.1.6622': attribute type 4 has an invalid length.
[  458.015495][T27498] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512
[  458.385842][T27564] tipc: Enabling of bearer <eth:syzkaller0> rejected, already enabled
[  458.392395][T27564] syzkaller0: entered promiscuous mode
[  458.394140][T27564] syzkaller0: entered allmulticast mode
[  458.479540][T27571] xt_hashlimit: size too large, truncated to 1048576
[  458.579821][T27580] netlink: 'syz.3.6644': attribute type 1 has an invalid length.
[  458.583666][T27580] __nla_validate_parse: 23 callbacks suppressed
[  458.583676][T27580] netlink: 12 bytes leftover after parsing attributes in process `syz.3.6644'.
[  458.617417][T27580] netlink: 'syz.3.6644': attribute type 1 has an invalid length.
[  458.683150][T27585] netlink: 12 bytes leftover after parsing attributes in process `syz.1.6647'.
[  458.841017][T27596] netlink: 24 bytes leftover after parsing attributes in process `syz.1.6650'.
[  458.854493][T27598] netlink: 8 bytes leftover after parsing attributes in process `syz.3.6651'.
[  458.935957][T27603] netlink: 8 bytes leftover after parsing attributes in process `syz.3.6652'.
[  458.936817][T27606] bond0: left promiscuous mode
[  458.940493][T27606] rose0: left promiscuous mode
[  458.946343][T27607] netlink: 16 bytes leftover after parsing attributes in process `syz.1.6653'.
[  458.966193][T27603] lo speed is unknown, defaulting to 1000
[  458.997506][T27611] tipc: Cannot configure node identity twice
[  459.036751][T27615] netlink: 8 bytes leftover after parsing attributes in process `syz.1.6656'.
[  459.039525][T27615] netlink: 4 bytes leftover after parsing attributes in process `syz.1.6656'.
[  459.046546][T27615] netlink: 14 bytes leftover after parsing attributes in process `syz.1.6656'.
[  459.206969][T27632] 
[  459.207814][T27632] ======================================================
[  459.209932][T27632] WARNING: possible circular locking dependency detected
[  459.212219][T27632] 6.16.0-rc5-syzkaller-00212-g9f735b6f8a77-dirty #0 Not tainted
[  459.214677][T27632] ------------------------------------------------------
[  459.217345][T27632] syz.4.6659/27632 is trying to acquire lock:
[  459.219184][T27632] ffffffff8f674638 (nr_node_list_lock){+...}-{3:3}, at: nr_rt_device_down+0xa9/0x720
[  459.222064][T27632] 
[  459.222064][T27632] but task is already holding lock:
[  459.224326][T27632] ffffffff8f6745d8 (nr_neigh_list_lock){+...}-{3:3}, at: nr_rt_device_down+0x28/0x720
[  459.227249][T27632] 
[  459.227249][T27632] which lock already depends on the new lock.
[  459.227249][T27632] 
[  459.230383][T27632] 
[  459.230383][T27632] the existing dependency chain (in reverse order) is:
[  459.233116][T27632] 
[  459.233116][T27632] -> #2 (nr_neigh_list_lock){+...}-{3:3}:
[  459.235512][T27632]        lock_acquire+0x120/0x360
[  459.237083][T27632]        _raw_spin_lock_bh+0x36/0x50
[  459.238650][T27632]        nr_rt_ioctl+0x390/0xd50
[  459.240106][T27632]        sock_do_ioctl+0xdc/0x300
[  459.241602][T27632]        sock_ioctl+0x576/0x790
[  459.243036][T27632]        __se_sys_ioctl+0xfc/0x170
[  459.244590][T27632]        do_syscall_64+0xfa/0x3b0
[  459.246161][T27632]        entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  459.248106][T27632] 
[  459.248106][T27632] -> #1 (&nr_node->node_lock){+...}-{3:3}:
[  459.250553][T27632]        lock_acquire+0x120/0x360
[  459.252105][T27632]        _raw_spin_lock_bh+0x36/0x50
[  459.253736][T27632]        nr_rt_ioctl+0x193/0xd50
[  459.255285][T27632]        sock_do_ioctl+0xdc/0x300
[  459.256836][T27632]        sock_ioctl+0x576/0x790
[  459.258328][T27632]        __se_sys_ioctl+0xfc/0x170
[  459.259928][T27632]        do_syscall_64+0xfa/0x3b0
[  459.261477][T27632]        entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  459.263439][T27632] 
[  459.263439][T27632] -> #0 (nr_node_list_lock){+...}-{3:3}:
[  459.265858][T27632]        validate_chain+0xb9b/0x2140
[  459.267468][T27632]        __lock_acquire+0xab9/0xd20
[  459.269089][T27632]        lock_acquire+0x120/0x360
[  459.270647][T27632]        _raw_spin_lock_bh+0x36/0x50
[  459.272281][T27632]        nr_rt_device_down+0xa9/0x720
[  459.273946][T27632]        nr_device_event+0x137/0x150
[  459.275568][T27632]        notifier_call_chain+0x1b6/0x3e0
[  459.277308][T27632]        __dev_notify_flags+0x18d/0x2e0
[  459.279003][T27632]        netif_change_flags+0xe8/0x1a0
[  459.280684][T27632]        dev_change_flags+0x130/0x260
[  459.282330][T27632]        dev_ioctl+0x7b4/0x1150
[  459.283837][T27632]        sock_do_ioctl+0x22c/0x300
[  459.285414][T27632]        sock_ioctl+0x576/0x790
[  459.286940][T27632]        __se_sys_ioctl+0xfc/0x170
[  459.288509][T27632]        do_syscall_64+0xfa/0x3b0
[  459.290060][T27632]        entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  459.292036][T27632] 
[  459.292036][T27632] other info that might help us debug this:
[  459.292036][T27632] 
[  459.295102][T27632] Chain exists of:
[  459.295102][T27632]   nr_node_list_lock --> &nr_node->node_lock --> nr_neigh_list_lock
[  459.295102][T27632] 
[  459.299353][T27632]  Possible unsafe locking scenario:
[  459.299353][T27632] 
[  459.301622][T27632]        CPU0                    CPU1
[  459.303281][T27632]        ----                    ----
[  459.304936][T27632]   lock(nr_neigh_list_lock);
[  459.306379][T27632]                                lock(&nr_node->node_lock);
[  459.308592][T27632]                                lock(nr_neigh_list_lock);
[  459.310805][T27632]   lock(nr_node_list_lock);
[  459.312233][T27632] 
[  459.312233][T27632]  *** DEADLOCK ***
[  459.312233][T27632] 
[  459.314751][T27632] 2 locks held by syz.4.6659/27632:
[  459.316352][T27632]  #0: ffffffff8f51bb48 (rtnl_mutex){+.+.}-{4:4}, at: dev_ioctl+0x7a4/0x1150
[  459.319017][T27632]  #1: ffffffff8f6745d8 (nr_neigh_list_lock){+...}-{3:3}, at: nr_rt_device_down+0x28/0x720
[  459.322046][T27632] 
[  459.322046][T27632] stack backtrace:
[  459.323844][T27632] CPU: 1 UID: 0 PID: 27632 Comm: syz.4.6659 Not tainted 6.16.0-rc5-syzkaller-00212-g9f735b6f8a77-dirty #0 PREEMPT(full) 
[  459.323856][T27632] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.2-debian-1.16.2-1 04/01/2014
[  459.323862][T27632] Call Trace:
[  459.323867][T27632]  <TASK>
[  459.323872][T27632]  dump_stack_lvl+0x189/0x250
[  459.323885][T27632]  ? __pfx_dump_stack_lvl+0x10/0x10
[  459.323895][T27632]  ? __pfx__printk+0x10/0x10
[  459.323906][T27632]  ? print_lock_name+0xde/0x100
[  459.323917][T27632]  print_circular_bug+0x2ee/0x310
[  459.323929][T27632]  check_noncircular+0x134/0x160
[  459.323940][T27632]  validate_chain+0xb9b/0x2140
[  459.323951][T27632]  ? rt6_disable_ip+0x6b3/0x720
[  459.323967][T27632]  ? __lock_acquire+0xab9/0xd20
[  459.323976][T27632]  __lock_acquire+0xab9/0xd20
[  459.323985][T27632]  ? nr_rt_device_down+0xa9/0x720
[  459.323993][T27632]  lock_acquire+0x120/0x360
[  459.324000][T27632]  ? nr_rt_device_down+0xa9/0x720
[  459.324010][T27632]  ? nr_rt_device_down+0xa9/0x720
[  459.324018][T27632]  _raw_spin_lock_bh+0x36/0x50
[  459.324031][T27632]  ? nr_rt_device_down+0xa9/0x720
[  459.324039][T27632]  nr_rt_device_down+0xa9/0x720
[  459.324048][T27632]  ? do_raw_spin_unlock+0x4d/0x240
[  459.324060][T27632]  nr_device_event+0x137/0x150
[  459.324068][T27632]  notifier_call_chain+0x1b6/0x3e0
[  459.324080][T27632]  __dev_notify_flags+0x18d/0x2e0
[  459.324093][T27632]  ? __pfx___dev_notify_flags+0x10/0x10
[  459.324104][T27632]  ? __dev_change_flags+0x4cc/0x6d0
[  459.324116][T27632]  ? __pfx___dev_change_flags+0x10/0x10
[  459.324126][T27632]  ? dev_ioctl+0x7a4/0x1150
[  459.324136][T27632]  ? full_name_hash+0x92/0xe0
[  459.324146][T27632]  netif_change_flags+0xe8/0x1a0
[  459.324158][T27632]  dev_change_flags+0x130/0x260
[  459.324170][T27632]  dev_ioctl+0x7b4/0x1150
[  459.324180][T27632]  sock_do_ioctl+0x22c/0x300
[  459.324190][T27632]  ? __pfx_sock_do_ioctl+0x10/0x10
[  459.324198][T27632]  ? __lock_acquire+0xab9/0xd20
[  459.324209][T27632]  sock_ioctl+0x576/0x790
[  459.324217][T27632]  ? __pfx_sock_ioctl+0x10/0x10
[  459.324225][T27632]  ? __fget_files+0x2a/0x420
[  459.324232][T27632]  ? __fget_files+0x3a0/0x420
[  459.324238][T27632]  ? __fget_files+0x2a/0x420
[  459.324245][T27632]  ? bpf_lsm_file_ioctl+0x9/0x20
[  459.324257][T27632]  ? __pfx_sock_ioctl+0x10/0x10
[  459.324264][T27632]  __se_sys_ioctl+0xfc/0x170
[  459.324275][T27632]  do_syscall_64+0xfa/0x3b0
[  459.324284][T27632]  ? lockdep_hardirqs_on+0x9c/0x150
[  459.324291][T27632]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  459.324300][T27632]  ? exc_page_fault+0x9f/0xf0
[  459.324307][T27632]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  459.324315][T27632] RIP: 0033:0x7f945798e9a9
[  459.324325][T27632] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
[  459.324333][T27632] RSP: 002b:00007f94557f6038 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
[  459.324341][T27632] RAX: ffffffffffffffda RBX: 00007f9457bb6080 RCX: 00007f945798e9a9
[  459.324347][T27632] RDX: 0000200000000000 RSI: 0000000000008914 RDI: 0000000000000009
[  459.324352][T27632] RBP: 00007f9457a10ca1 R08: 0000000000000000 R09: 0000000000000000
[  459.324357][T27632] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
[  459.324362][T27632] R13: 0000000000000001 R14: 00007f9457bb6080 R15: 00007ffe8bb6c1b8
[  459.324371][T27632]  </TASK>
[  464.074767][ T5281] udevd[5281]: worker [15189] /devices/virtual/block/nbd2 timeout; kill it
[  464.077775][ T5281] udevd[5281]: seq 18051 '/devices/virtual/block/nbd2' killed
[  464.080138][ T5281] udevd[5281]: worker [16054] /devices/virtual/block/nbd0 timeout; kill it
[  464.083025][ T5281] udevd[5281]: seq 18900 '/devices/virtual/block/nbd0' killed

VM DIAGNOSIS:
18:50:42  Registers:
info registers vcpu 0

CPU#0
RAX=83c46cfb403f1f00 RBX=ffffffff81976c78 RCX=83c46cfb403f1f00 RDX=0000000000000001
RSI=ffffffff8be28c20 RDI=ffffffff81976c78 RBP=ffffffff8de07ea8 RSP=ffffffff8de07d80
R8 =ffff88804b032f5b R9 =1ffff110096065eb R10=dffffc0000000000 R11=ffffed10096065ec
R12=ffffffff8fa1d5f0 R13=0000000000000000 R14=0000000000000000 R15=1ffffffff1bd2a50
RIP=ffffffff8b6d54d3 RFL=00000286 [--S--P-] CPL=0 II=0 A20=1 SMM=0 HLT=1
ES =0000 0000000000000000 ffffffff 00c00000
CS =0010 0000000000000000 ffffffff 00a09b00 DPL=0 CS64 [-RA]
SS =0018 0000000000000000 ffffffff 00c09300 DPL=0 DS   [-WA]
DS =0000 0000000000000000 ffffffff 00c00000
FS =0000 0000000000000000 ffffffff 00c00000
GS =0000 ffff8880b8626000 ffffffff 00c00000
LDT=0000 0000000000000000 ffffffff 00c00000
TR =0040 fffffe0000003000 00004087 00008b00 DPL=0 TSS64-busy
GDT=     fffffe0000001000 0000007f
IDT=     fffffe0000000000 00000fff
CR0=80050033 CR2=00007f9457b802d8 CR3=00000001236b2000 CR4=000006f0
DR0=0000000000000000 DR1=0000000000000000 DR2=0000000000000000 DR3=0000000000000000 
DR6=00000000ffff0ff0 DR7=0000000000000400
EFER=0000000000000d01
FCW=037f FSW=0000 [ST=0] FTW=00 MXCSR=00001f80
FPR0=0000000000000000 0000 FPR1=0000000000000000 0000
FPR2=0000000000000000 0000 FPR3=0000000000000000 0000
FPR4=0000000000000000 0000 FPR5=0000000000000000 0000
FPR6=0000000000000000 0000 FPR7=0000000000000000 0000
XMM00=0000000000000000 0000000000000000 XMM01=000c3a2e00000000 2e3a0004000c8007
XMM02=03000c3a2e000000 002e3a0004000c80 XMM03=07001c0000000f00 0000000000000000
XMM04=00007f81170ed100 00007f8116586440 XMM05=00007f8116586458 00007f81165864a0
XMM06=00007f8116586498 00007f8116586490 XMM07=00007f8116586488 00007f8116586480
XMM08=e40d18d20353ca94 8571038d0e981ac5 XMM09=0000000000000000 00007f8116411df9
XMM10=0000000000000000 0000000000000000 XMM11=0000000000000000 0000000000000000
XMM12=0000000000000000 0000000000000000 XMM13=0000000000000000 0000000000000000
XMM14=0000000000000000 0000000000000000 XMM15=0000000000000000 0000000000000000
info registers vcpu 1

CPU#1
RAX=000000000000002d RBX=000000000000002d RCX=0000000000000000 RDX=00000000000003f8
RSI=0000000000000000 RDI=0000000000000020 RBP=00000000000003f8 RSP=ffffc90020dc7030
R8 =ffff888021a10237 R9 =1ffff11004342046 R10=dffffc0000000000 R11=ffffffff85460db0
R12=dffffc0000000000 R13=ffffffff99aee89d R14=ffffffff99df32e0 R15=0000000000000000
RIP=ffffffff85460e2c RFL=00000002 [-------] CPL=0 II=0 A20=1 SMM=0 HLT=0
ES =0000 0000000000000000 ffffffff 00c00000
CS =0010 0000000000000000 ffffffff 00a09b00 DPL=0 CS64 [-RA]
SS =0018 0000000000000000 ffffffff 00c09300 DPL=0 DS   [-WA]
DS =0000 0000000000000000 ffffffff 00c00000
FS =0000 00007f94557f66c0 ffffffff 00c00000
GS =0000 ffff8881a3c26000 ffffffff 00c00000
LDT=0000 0000000000000000 ffffffff 00c00000
TR =0040 fffffe000004a000 00004087 00008b00 DPL=0 TSS64-busy
GDT=     fffffe0000048000 0000007f
IDT=     fffffe0000000000 00000fff
CR0=80050033 CR2=00007f94557d4fc8 CR3=000000012c86e000 CR4=000006f0
DR0=0000000000000000 DR1=0000000000000000 DR2=0000000000000000 DR3=0000000000000000 
DR6=00000000ffff0ff0 DR7=0000000000000400
EFER=0000000000000d01
FCW=037f FSW=0000 [ST=0] FTW=00 MXCSR=00001f80
FPR0=0000000000000000 0000 FPR1=0000000000000000 0000
FPR2=0000000000000000 0000 FPR3=0000000000000000 0000
FPR4=0000000000000000 0000 FPR5=0000000000000000 0000
FPR6=0000000000000000 0000 FPR7=0000000000000000 0000
XMM00=0000000000000000 0000000000000000 XMM01=0000000000000000 0000000000000000
XMM02=00007f9457b86478 00007f9457b86450 XMM03=00007f9457b86488 00007f9457b86480
XMM04=00007f94586ed100 00007f9457b86440 XMM05=00007f9457b86458 00007f9457b864a0
XMM06=00007f9457b86498 00007f9457b86490 XMM07=00007f9457b86488 00007f9457b86480
XMM08=0000000000000000 00524f5252450040 XMM09=0000000000000000 00007f9457a11df9
XMM10=0000000000000000 0000000000000000 XMM11=0000000000000000 0000000000000000
XMM12=0000000000000000 0000000000000000 XMM13=0000000000000000 0000000000000000
XMM14=0000000000000000 0000000000000000 XMM15=0000000000000000 0000000000000000
