40)=ANY=[@ANYRES32=0x0, @ANYBLOB='\x00'/12], &(0x7f0000000980)=0x10) getsockopt$inet_sctp_SCTP_GET_PEER_ADDR_INFO(r0, 0x84, 0xf, &(0x7f00000009c0)={r2, @in6={{0xa, 0x4e21, 0x8, @local, 0x401}}, 0x9, 0x1, 0x7, 0x7f, 0x6}, &(0x7f0000000a80)=0x98) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000400)='nl80211\x00') sendmsg$NL80211_CMD_GET_MESH_CONFIG(r0, &(0x7f0000000580)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x103190}, 0xc, &(0x7f0000000540)={&(0x7f0000000500)={0x28, r3, 0x10, 0x70bd2d, 0x25dfdbfe, {}, [@NL80211_ATTR_WIPHY={0x8, 0x1, 0x1}, @NL80211_ATTR_WDEV={0xc, 0x99, {0x3f, 0x3}}]}, 0x28}, 0x1, 0x0, 0x0, 0x800}, 0x40000) r4 = socket$nl_generic(0x10, 0x3, 0x10) bind$netlink(r4, &(0x7f0000000000)={0x10, 0x0, 0x25dfdbff, 0x1004280}, 0xffffffffffffffb3) sendmsg$nl_generic(r4, &(0x7f0000000080)={&(0x7f0000000480)={0x10, 0xbb7f}, 0xc, &(0x7f0000000440)={&(0x7f00000004c0)={0x1c, 0x22, 0x1, 0x0, 0x0, {0x4}, [@typed={0x8, 0xc}]}, 0x1c}}, 0x0) socket$netlink(0x10, 0x3, 0x0) r5 = socket$alg(0x26, 0x5, 0x0) bind$alg(r5, &(0x7f0000000080)={0x26, 'hash\x00', 0x0, 0x0, 'sha512\x00'}, 0x58) [ 361.127937][T16026] bridge162: port 1(syz_tun) entered disabled state [ 361.297912][T16026] bridge163: port 1(syz_tun) entered blocking state [ 361.305488][T16026] bridge163: port 1(syz_tun) entered disabled state [ 361.315988][T16026] device syz_tun entered promiscuous mode 15:24:03 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000004c0)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r2, @ANYBLOB="0000000000000000280012000c0001007665746800000000180002001400010000000000", @ANYRES32=0x0, @ANYBLOB="00000000008433df6d6f6b577d4eaaf2000007"], 0x48}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000540)=ANY=[@ANYBLOB="7400000024000705000000000000000000010000", @ANYRES32=r2, @ANYBLOB="00000000ffffffff000000000800010073667100486818973f73461919309b68e1693572bb000229c6090032d0ed64f3c3545aaf6e000085a4e4ebb5ef670000000000000000000000000000001a4e624d29a84abf03265700000000000000000000000000000000000000000000000000000000000000ac20000089b53c947244306a0216a3de887763df5b42498b13bb1938de859ee6d7ae7dd2224dc672b69b4358871b170ea0b667832e5224ee3538f885b7abd9bc4a7d"], 0x74}}, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r3, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000300)=ANY=[@ANYBLOB="840000002c00010700"/20, @ANYRES32=r2, @ANYBLOB="0008008000000000030000000800010075333200580002001400050000000000000000000000000000000000400006003c0001000000000000001020898dde66057433b6ef3a41d22be225e0001b0000000000000000000000000017256ffc66e43a2484e1a912c5998bcbf0d0000000000000000000000000000000798a3c067277da1a290b9613a33c575c36fad473382c8f5532ef3f0e1d2c450a7decbf3431a69f9b2ecb3291bed174245a962fe0484676958265e2988326a89db3139d91fe4aee6ae7e745ab00001a9f61f20500000000000000b3958bc14fce6e66a36d1ab3194534ba4e973684b27793bff837d3"], 0x84}}, 0x0) r4 = socket(0x10, 0x80002, 0x0) sendmmsg$alg(r4, &(0x7f0000000140), 0x49249249249278c, 0x0) r5 = socket$nl_route(0x10, 0x3, 0x0) r6 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r6, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r5, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000500)=@newlink={0x20, 0x11, 0x40d, 0x0, 0x0, {0x0, 0x0, 0x0, r7}}, 0x20}}, 0x0) r8 = socket(0x10, 0x80002, 0x0) getsockopt$inet_sctp_SCTP_PEER_AUTH_CHUNKS(0xffffffffffffffff, 0x84, 0x1a, &(0x7f0000000940)=ANY=[@ANYRES32=0x0, @ANYBLOB='\x00'/12], &(0x7f0000000980)=0x10) r9 = socket(0xa, 0x6, 0x0) close(r9) r10 = socket$inet6_sctp(0xa, 0x10000000005, 0x84) setsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX(r10, 0x84, 0x6e, &(0x7f0000000180)=[@in6={0xa, 0x0, 0x0, @remote, 0x9}], 0x1c) getsockopt$inet_sctp6_SCTP_GET_ASSOC_ID_LIST(r10, 0x84, 0x1d, &(0x7f000095dff8)={0x1, [0x0]}, &(0x7f000095dffc)=0x8) setsockopt$inet_sctp_SCTP_RTOINFO(r9, 0x84, 0x0, &(0x7f0000000000)={r11, 0x0, 0x0, 0x1000000}, 0x10) setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(0xffffffffffffffff, 0x84, 0x9, &(0x7f0000000680)={r11, @in={{0x2, 0x4e20, @remote}}, 0x10001, 0xfff7, 0x5, 0x1, 0x8, 0x5, 0xba}, 0x9c) ioctl(r8, 0x1000008912, &(0x7f00000001c0)="080db5055e0bcfe8696071") getsockopt$inet_sctp_SCTP_PEER_AUTH_CHUNKS(r8, 0x84, 0x1a, &(0x7f0000000940)=ANY=[@ANYRES32=0x0, @ANYBLOB='\x00'/12], &(0x7f0000000980)=0x10) r12 = socket$nl_generic(0x10, 0x3, 0x10) r13 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080)='nl80211\x00') r14 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL80211_CMD_GET_STATION(r14, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000240)={0x1c, r13, 0xf2b, 0x0, 0x0, {}, [@NL80211_ATTR_AIRTIME_WEIGHT={0x8}]}, 0x1c}}, 0x0) sendmsg$NL80211_CMD_GET_MPATH(r12, &(0x7f00000001c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x2000}, 0x268, &(0x7f0000000080)={&(0x7f0000000200)={0x40, r13, 0x4, 0x70bd2d, 0x25dfdbff}, 0xff6b}, 0x1, 0x0, 0x0, 0x10049050}, 0x260448c0) sendmsg$NL80211_CMD_NEW_KEY(r8, &(0x7f0000000640)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0xb0024000}, 0xc, &(0x7f00000002c0)={&(0x7f0000000440)={0x7c, r13, 0x23, 0x70bd27, 0x25dfdbff, {}, [@NL80211_ATTR_KEY_DATA_WEP40={0x9, 0x7, "a80875ab12"}, @NL80211_ATTR_KEY={0x5c, 0x50, [@NL80211_KEY_DEFAULT_TYPES={0x14, 0x8, [@NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_MULTICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_MULTICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_MULTICAST={0x4}]}, @NL80211_KEY_DEFAULT_TYPES={0x28, 0x8, [@NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_MULTICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_MULTICAST={0x4}]}, @NL80211_KEY_IDX={0x5, 0x2, 0x5}, @NL80211_KEY_DATA_WEP104={0x11, 0x1, "4d84c4e30151cb27f51a4adf63"}]}]}, 0x7c}, 0x1, 0x0, 0x0, 0x24000}, 0x40) 15:24:03 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) r2 = socket(0x10, 0x80002, 0x0) ioctl(r2, 0x1000008912, &(0x7f00000001c0)="080db5055e0bcfe8696071") getsockopt$inet_sctp_SCTP_PEER_AUTH_CHUNKS(r2, 0x84, 0x1a, &(0x7f0000000940)=ANY=[@ANYRES32=0x0, @ANYBLOB='\x00'/12], &(0x7f0000000980)=0x10) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000180)={0x0}, 0x1, 0x0, 0x0, 0x4044080}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r0, &(0x7f0000000140)={0x0, 0x2000000, &(0x7f0000000200)={&(0x7f0000000080)=@newlink={0x30, 0x10, 0x801, 0x0, 0x0, {}, [@IFLA_MASTER={0x8, 0x4, r3}, @IFLA_GROUP={0x8}]}, 0x30}}, 0x0) [ 361.342159][T16038] device syz_tun left promiscuous mode [ 361.353932][T16038] bridge178: port 1(syz_tun) entered disabled state 15:24:03 executing program 5: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000340)={'erspan0\x00'}) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000300)={'syz_tun\x00', 0x0}) r5 = socket$nl_route(0x10, 0x3, 0x0) r6 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r6, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r6, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r5, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000380)=@newlink={0x34, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r7}, [@IFLA_LINKINFO={0x14, 0x12, @bridge={{0xb, 0x1, 'bridge\x00'}, {0x4}}}]}, 0x34}}, 0x0) sendmsg$nl_route(r3, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000002700)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r4}, [@IFLA_MASTER={0x8, 0xa, r7}]}, 0x28}}, 0x0) sendmsg$nl_route(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f00000000c0)=ANY=[@ANYBLOB="2800000010000104000040000000000000001ea6", @ANYRES32, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00\b\x00\n\x00', @ANYRES32=r7], 0x28}}, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r9 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r8, 0x8933, &(0x7f0000000300)={'syz_tun\x00', 0x0}) sendmsg$nl_route(r9, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000040)=@newlink={0x2c, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r10}, [@IFLA_BROADCAST={0xa}]}, 0x332}}, 0x0) 15:24:03 executing program 2: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000340)={'erspan0\x00', 0x0}) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000300)={'syz_tun\x00', 0x0}) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r7, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r6, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000380)=@newlink={0x34, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r8}, [@IFLA_LINKINFO={0x14, 0x12, @bridge={{0xb, 0x1, 'bridge\x00'}, {0x4}}}]}, 0x34}}, 0x0) sendmsg$nl_route(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000002700)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r5}, [@IFLA_MASTER={0x8, 0xa, r8}]}, 0x28}}, 0x0) sendmsg$nl_route(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f00000000c0)=ANY=[@ANYBLOB="280000001000010400004000000000000000", @ANYRES32=r2, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00\b\x00\n\x00', @ANYRES32=r8], 0x4}}, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r10 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r9, 0x8933, &(0x7f0000000300)={'syz_tun\x00', 0x0}) sendmsg$nl_route(r10, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000040)=@newlink={0x2c, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r11}, [@IFLA_BROADCAST={0xa}]}, 0x332}}, 0x0) [ 361.528201][T16038] bridge179: port 1(syz_tun) entered blocking state [ 361.537806][T16038] bridge179: port 1(syz_tun) entered disabled state [ 361.546001][T16038] device syz_tun entered promiscuous mode 15:24:03 executing program 4: r0 = socket$inet6(0xa, 0x80003, 0x6b) ioctl(r0, 0x1000008912, &(0x7f00000001c0)="080db5055e0bcfe8476071") r1 = socket(0x0, 0x2, 0x0) sendto(r1, &(0x7f0000000200)="120000001200e7ef007b1a3fcd00000000a1", 0x12, 0x0, 0x0, 0x18) recvmmsg(r1, &(0x7f00000037c0)=[{{&(0x7f0000000600)=@ethernet={0x0, @random}, 0x80, &(0x7f0000000380)=[{&(0x7f0000000040)=""/95, 0x2000007d}, {&(0x7f00000000c0)=""/85, 0x1f3}, {&(0x7f00000024c0)=""/4096, 0x1048}, {&(0x7f0000000400)=""/120, 0x1aa}, {&(0x7f0000000480)=""/60, 0xc6}, {&(0x7f0000000280)=""/77, 0x4d}, {&(0x7f0000000540)=""/154, 0x207}, {&(0x7f0000000340)=""/22, 0x1de}], 0x8, &(0x7f0000002400)=""/191, 0xfffffffffffffea2}}], 0x4000000000001de, 0x6, &(0x7f0000003700)={0x77359400}) [ 361.625444][T16051] netlink: 72 bytes leftover after parsing attributes in process `syz-executor.1'. [ 361.650585][T16053] IPv6: ADDRCONF(NETDEV_CHANGE): lo: link becomes ready [ 361.722975][T16055] device syz_tun left promiscuous mode [ 361.745031][T16055] bridge163: port 1(syz_tun) entered disabled state [ 361.918638][T16055] bridge164: port 1(syz_tun) entered blocking state [ 361.925556][T16055] bridge164: port 1(syz_tun) entered disabled state [ 361.933945][T16055] device syz_tun entered promiscuous mode 15:24:04 executing program 0: r0 = socket(0x21, 0xa, 0x1) r1 = socket(0x10, 0x80002, 0x0) ioctl(r1, 0x1000008912, &(0x7f00000001c0)="080db5055e0bcfe8696071") getsockopt$inet_sctp_SCTP_PEER_AUTH_CHUNKS(r1, 0x84, 0x1a, &(0x7f0000000940)=ANY=[@ANYRES32=0x0, @ANYBLOB='\x00'/12], &(0x7f0000000980)=0x10) getsockopt$inet_sctp_SCTP_GET_PEER_ADDR_INFO(r0, 0x84, 0xf, &(0x7f00000009c0)={r2, @in6={{0xa, 0x4e21, 0x8, @local, 0x401}}, 0x9, 0x1, 0x7, 0x7f, 0x6}, &(0x7f0000000a80)=0x98) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000400)='nl80211\x00') sendmsg$NL80211_CMD_GET_MESH_CONFIG(r0, &(0x7f0000000580)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x103190}, 0xc, &(0x7f0000000540)={&(0x7f0000000500)={0x34, r3, 0x10, 0x70bd2d, 0x25dfdbfe, {}, [@NL80211_ATTR_WDEV={0xc, 0x99, {0x0, 0xffffffffffffffff}}, @NL80211_ATTR_WIPHY={0x8, 0x1, 0x1}, @NL80211_ATTR_WDEV={0xc, 0x99, {0x3f, 0x3}}]}, 0x34}, 0x1, 0x0, 0x0, 0x800}, 0x40000) r4 = socket$nl_generic(0x10, 0x3, 0x10) bind$netlink(r4, &(0x7f0000000000)={0x10, 0x0, 0x25dfdbff, 0x1004280}, 0xffffffffffffffb3) sendmsg$nl_generic(r4, &(0x7f0000000080)={&(0x7f0000000480)={0x10, 0xbb7f}, 0xc, &(0x7f0000000440)={&(0x7f00000004c0)={0x1c, 0x22, 0x1, 0x0, 0x0, {0x4}, [@typed={0x8, 0xc}]}, 0x1c}}, 0x0) socket$netlink(0x10, 0x3, 0x0) r5 = socket$alg(0x26, 0x5, 0x0) bind$alg(r5, &(0x7f0000000080)={0x26, 'hash\x00', 0x0, 0x0, 'sha512\x00'}, 0x58) 15:24:04 executing program 3: r0 = socket$kcm(0x10, 0x2, 0x0) r1 = socket$packet(0x11, 0x3, 0x300) pipe(&(0x7f0000000440)={0xffffffffffffffff}) setsockopt$bt_hci_HCI_DATA_DIR(r2, 0x0, 0x1, &(0x7f0000001200)=0x5, 0x4) setsockopt$packet_int(r1, 0x107, 0xb, &(0x7f0000000000)=0x802, 0x4) recvmmsg(r1, &(0x7f0000001100)=[{{&(0x7f0000000080)=@hci, 0x80, &(0x7f00000009c0)=[{&(0x7f0000000100)=""/71, 0x47}, {&(0x7f00000002c0)=""/221, 0xdd}, {&(0x7f00000001c0)=""/103, 0x67}, {&(0x7f0000000480)=""/70, 0x46}, {&(0x7f0000000500)=""/195, 0xc3}, {&(0x7f0000000600)=""/96, 0x60}, {&(0x7f0000000680)=""/151, 0x97}, {&(0x7f0000000740)=""/233, 0xe9}, {&(0x7f0000000840)=""/195, 0xc3}, {&(0x7f0000000940)=""/65, 0x41}], 0xa, &(0x7f0000000a80)=""/128, 0x80}}, {{&(0x7f0000000b00)=@rc, 0x80, &(0x7f0000000ec0)=[{&(0x7f0000000b80)=""/179, 0xb3}, {&(0x7f0000000c40)=""/83, 0x53}, {&(0x7f0000000cc0)=""/100, 0x64}, {&(0x7f0000000240)=""/58, 0x3a}, {&(0x7f0000000d40)=""/221, 0xdd}, {&(0x7f0000000e40)=""/122, 0x7a}], 0x6, &(0x7f00000003c0)=""/12, 0xc}, 0x8000}, {{&(0x7f0000000f40)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @empty}}}, 0x80, &(0x7f00000010c0)=[{&(0x7f0000000fc0)=""/221, 0xdd}], 0x1}, 0x1}], 0x3, 0x141, &(0x7f00000011c0)) sendmsg$kcm(r3, &(0x7f0000000400)={0x0, 0xffffff77, &(0x7f0000000440), 0x1}, 0x1) r4 = socket$nl_route(0x10, 0x3, 0x0) getsockname$inet(r2, &(0x7f0000001280)={0x2, 0x0, @local}, &(0x7f00000012c0)=0x10) sendmsg$nl_route(r4, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000280)=ANY=[@ANYBLOB="14f3540f67855367caa45b00000000", @ANYRES32=0x0, @ANYBLOB="00ec000000000000140012000b003d191d0b69646767000004000600"], 0x34}}, 0x0) r5 = socket(0x10, 0x80002, 0x0) ioctl(r5, 0x1000008912, &(0x7f00000001c0)="080db5055e0bcfe8696071") getsockopt$inet_sctp_SCTP_PEER_AUTH_CHUNKS(r5, 0x84, 0x1a, &(0x7f0000000940)=ANY=[@ANYRES32=0x0, @ANYBLOB='\x00'/12], &(0x7f0000000980)=0x10) setsockopt$bt_BT_POWER(r5, 0x112, 0x9, &(0x7f0000001240)=0xfc, 0x1) bpf$MAP_GET_NEXT_KEY(0x4, &(0x7f00000013c0)={r2, &(0x7f0000001300)="775eb1650b7be41bad8f3fb7c813d9ae772c00f6ff79e7fbbb9eb9c002d37e2bc0b3160b0d582ccd6a694532c82d73659f97b319196fcab47a751333b1f2c2c6a46ed3ea1a63ffb6006618c53e2aa7fb708ca168b07d109fa98a1af6603b6341f81eeda3288bf65e4ec585c61b36ef2c4d6b3e14c79bd64b49a67801685ba65480713032b9052e5108967ab99e83ed", &(0x7f00000014c0)=""/4096}, 0x20) recvmsg$kcm(r0, &(0x7f0000001480)={0x0, 0x0, 0x0}, 0x0) 15:24:04 executing program 5: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000340)={'erspan0\x00'}) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000300)={'syz_tun\x00', 0x0}) r5 = socket$nl_route(0x10, 0x3, 0x0) r6 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r6, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r6, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r5, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000380)=@newlink={0x34, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r7}, [@IFLA_LINKINFO={0x14, 0x12, @bridge={{0xb, 0x1, 'bridge\x00'}, {0x4}}}]}, 0x34}}, 0x0) sendmsg$nl_route(r3, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000002700)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r4}, [@IFLA_MASTER={0x8, 0xa, r7}]}, 0x28}}, 0x0) sendmsg$nl_route(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f00000000c0)=ANY=[@ANYBLOB="2800000010000104000040000000000000001ea6", @ANYRES32, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00\b\x00\n\x00', @ANYRES32=r7], 0x28}}, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r9 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r8, 0x8933, &(0x7f0000000300)={'syz_tun\x00', 0x0}) sendmsg$nl_route(r9, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000040)=@newlink={0x2c, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r10}, [@IFLA_BROADCAST={0xa}]}, 0x332}}, 0x0) [ 361.987879][T16067] device syz_tun left promiscuous mode [ 361.993562][T16067] bridge179: port 1(syz_tun) entered disabled state 15:24:04 executing program 4: r0 = socket$inet6(0xa, 0x80003, 0x6b) ioctl(r0, 0x1000008912, &(0x7f00000001c0)="080db5055e0bcfe8476071") r1 = socket(0x0, 0x2, 0x0) sendto(r1, &(0x7f0000000200)="120000001200e7ef007b1a3fcd00000000a1", 0x12, 0x0, 0x0, 0x18) recvmmsg(r1, &(0x7f00000037c0)=[{{&(0x7f0000000600)=@ethernet={0x0, @random}, 0x80, &(0x7f0000000380)=[{&(0x7f0000000040)=""/95, 0x2000007d}, {&(0x7f00000000c0)=""/85, 0x1f3}, {&(0x7f00000024c0)=""/4096, 0x1048}, {&(0x7f0000000400)=""/120, 0x1aa}, {&(0x7f0000000480)=""/60, 0xc6}, {&(0x7f0000000280)=""/77, 0x4d}, {&(0x7f0000000540)=""/154, 0x207}, {&(0x7f0000000340)=""/22, 0x1de}], 0x8, &(0x7f0000002400)=""/191, 0xfffffffffffffea2}}], 0x4000000000001de, 0x6, &(0x7f0000003700)={0x77359400}) [ 362.157834][T16067] bridge180: port 1(syz_tun) entered blocking state [ 362.173734][T16067] bridge180: port 1(syz_tun) entered disabled state 15:24:04 executing program 2: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000340)={'erspan0\x00', 0x0}) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000300)={'syz_tun\x00', 0x0}) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r7, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r6, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000380)=@newlink={0x34, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r8}, [@IFLA_LINKINFO={0x14, 0x12, @bridge={{0xb, 0x1, 'bridge\x00'}, {0x4}}}]}, 0x34}}, 0x0) sendmsg$nl_route(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000002700)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r5}, [@IFLA_MASTER={0x8, 0xa, r8}]}, 0x28}}, 0x0) sendmsg$nl_route(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f00000000c0)=ANY=[@ANYBLOB="2800000010000104000040000000000000001e", @ANYRES32=r2, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00\b\x00\n\x00', @ANYRES32=r8], 0x4}}, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r10 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r9, 0x8933, &(0x7f0000000300)={'syz_tun\x00', 0x0}) sendmsg$nl_route(r10, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000040)=@newlink={0x2c, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r11}, [@IFLA_BROADCAST={0xa}]}, 0x332}}, 0x0) [ 362.201761][T16067] device syz_tun entered promiscuous mode [ 362.231608][T16085] device syz_tun left promiscuous mode [ 362.244679][T16085] bridge164: port 1(syz_tun) entered disabled state 15:24:04 executing program 4: r0 = socket$inet6(0xa, 0x80003, 0x6b) ioctl(r0, 0x1000008912, &(0x7f00000001c0)="080db5055e0bcfe8476071") r1 = socket(0x0, 0x2, 0x0) sendto(r1, &(0x7f0000000200)="120000001200e7ef007b1a3fcd00000000a1", 0x12, 0x0, 0x0, 0x18) recvmmsg(r1, &(0x7f00000037c0)=[{{&(0x7f0000000600)=@ethernet={0x0, @random}, 0x80, &(0x7f0000000380)=[{&(0x7f0000000040)=""/95, 0x2000007d}, {&(0x7f00000000c0)=""/85, 0x1f3}, {&(0x7f00000024c0)=""/4096, 0x1048}, {&(0x7f0000000400)=""/120, 0x1aa}, {&(0x7f0000000480)=""/60, 0xc6}, {&(0x7f0000000280)=""/77, 0x4d}, {&(0x7f0000000540)=""/154, 0x207}, {&(0x7f0000000340)=""/22, 0x1de}], 0x8, &(0x7f0000002400)=""/191, 0xfffffffffffffea2}}], 0x4000000000001de, 0x6, &(0x7f0000003700)={0x77359400}) [ 362.368728][T16085] bridge165: port 1(syz_tun) entered blocking state [ 362.380484][T16085] bridge165: port 1(syz_tun) entered disabled state [ 362.389852][T16085] device syz_tun entered promiscuous mode 15:24:04 executing program 5: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000340)={'erspan0\x00', 0x0}) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000300)={'syz_tun\x00', 0x0}) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r7, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r6, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000380)=@newlink={0x34, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r8}, [@IFLA_LINKINFO={0x14, 0x12, @bridge={{0xb, 0x1, 'bridge\x00'}, {0x4}}}]}, 0x34}}, 0x0) sendmsg$nl_route(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000002700)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r5}, [@IFLA_MASTER={0x8, 0xa, r8}]}, 0x28}}, 0x0) sendmsg$nl_route(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f00000000c0)=ANY=[@ANYRES32=r2, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00\b\x00\n\x00', @ANYRES32=r8], 0x3}}, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r10 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r9, 0x8933, &(0x7f0000000300)={'syz_tun\x00', 0x0}) sendmsg$nl_route(r10, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000040)=@newlink={0x2c, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r11}, [@IFLA_BROADCAST={0xa}]}, 0x332}}, 0x0) [ 362.422407][T16094] device syz_tun left promiscuous mode [ 362.428386][T16094] bridge180: port 1(syz_tun) entered disabled state 15:24:04 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000004c0)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r2, @ANYBLOB="0000000000000000280012000c0001007665746800000000180002001400010000000000", @ANYRES32=0x0, @ANYBLOB="00000000008433df6d6f6b577d4eaaf2000007"], 0x48}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000540)=ANY=[@ANYBLOB="7400000024000705000000000000000000010000", @ANYRES32=r2, @ANYBLOB="00000000ffffffff000000000800010073667100486818973f73461919309b68e1693572bb000229c6090032d0ed64f3c3545aaf6e000085a4e4ebb5ef670000000000000000000000000000001a4e624d29a84abf03265700000000000000000000000000000000000000000000000000000000000000ac20000089b53c947244306a0216a3de887763df5b42498b13bb1938de859ee6d7ae7dd2224dc672b69b4358871b170ea0b667832e5224ee3538f885b7abd9bc4a7d"], 0x74}}, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r3, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000300)=ANY=[@ANYBLOB="840000002c00010700"/20, @ANYRES32=r2, @ANYBLOB="0008008000000000030000000800010075333200580002001400050000000000000000000000000000000000400006003c0001000000000000001020898dde66057433b6ef3a41d22be225e0001b0000000000000000000000000017256ffc66e43a2484e1a912c5998bcbf0d0000000000000000000000000000000798a3c067277da1a290b9613a33c575c36fad473382c8f5532ef3f0e1d2c450a7decbf3431a69f9b2ecb3291bed174245a962fe0484676958265e2988326a89db3139d91fe4aee6ae7e745ab00001a9f61f20500000000000000b3958bc14fce6e66a36d1ab3194534ba4e973684b27793bff837d3"], 0x84}}, 0x0) r4 = socket(0x10, 0x80002, 0x0) sendmmsg$alg(r4, &(0x7f0000000140), 0x49249249249278c, 0x0) r5 = socket$nl_route(0x10, 0x3, 0x0) r6 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r6, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r5, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000500)=@newlink={0x20, 0x11, 0x40d, 0x0, 0x0, {0x0, 0x0, 0x0, r7}}, 0x20}}, 0x0) r8 = socket(0x10, 0x80002, 0x0) getsockopt$inet_sctp_SCTP_PEER_AUTH_CHUNKS(0xffffffffffffffff, 0x84, 0x1a, &(0x7f0000000940)=ANY=[@ANYRES32=0x0, @ANYBLOB='\x00'/12], &(0x7f0000000980)=0x10) r9 = socket(0xa, 0x6, 0x0) close(r9) r10 = socket$inet6_sctp(0xa, 0x10000000005, 0x84) setsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX(r10, 0x84, 0x6e, &(0x7f0000000180)=[@in6={0xa, 0x0, 0x0, @remote, 0x9}], 0x1c) getsockopt$inet_sctp6_SCTP_GET_ASSOC_ID_LIST(r10, 0x84, 0x1d, &(0x7f000095dff8)={0x1, [0x0]}, &(0x7f000095dffc)=0x8) setsockopt$inet_sctp_SCTP_RTOINFO(r9, 0x84, 0x0, &(0x7f0000000000)={r11, 0x0, 0x0, 0x1000000}, 0x10) setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(0xffffffffffffffff, 0x84, 0x9, &(0x7f0000000680)={r11, @in={{0x2, 0x4e20, @remote}}, 0x10001, 0xfff7, 0x5, 0x1, 0x8, 0x5, 0xba}, 0x9c) ioctl(r8, 0x1000008912, &(0x7f00000001c0)="080db5055e0bcfe8696071") getsockopt$inet_sctp_SCTP_PEER_AUTH_CHUNKS(r8, 0x84, 0x1a, &(0x7f0000000940)=ANY=[@ANYRES32=0x0, @ANYBLOB='\x00'/12], &(0x7f0000000980)=0x10) r12 = socket$nl_generic(0x10, 0x3, 0x10) r13 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080)='nl80211\x00') r14 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL80211_CMD_GET_STATION(r14, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000240)={0x1c, r13, 0xf2b, 0x0, 0x0, {}, [@NL80211_ATTR_AIRTIME_WEIGHT={0x8}]}, 0x1c}}, 0x0) sendmsg$NL80211_CMD_GET_MPATH(r12, &(0x7f00000001c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x2000}, 0x268, &(0x7f0000000080)={&(0x7f0000000200)={0x40, r13, 0x4, 0x70bd2d, 0x25dfdbff}, 0xff6b}, 0x1, 0x0, 0x0, 0x10049050}, 0x260448c0) sendmsg$NL80211_CMD_NEW_KEY(r8, &(0x7f0000000640)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0xb0024000}, 0xc, &(0x7f00000002c0)={&(0x7f0000000440)={0x7c, r13, 0x23, 0x70bd27, 0x25dfdbff, {}, [@NL80211_ATTR_KEY_DATA_WEP40={0x9, 0x7, "a80875ab12"}, @NL80211_ATTR_KEY={0x5c, 0x50, [@NL80211_KEY_DEFAULT_TYPES={0x14, 0x8, [@NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_MULTICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_MULTICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_MULTICAST={0x4}]}, @NL80211_KEY_DEFAULT_TYPES={0x28, 0x8, [@NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_MULTICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_MULTICAST={0x4}]}, @NL80211_KEY_IDX={0x5, 0x2, 0x5}, @NL80211_KEY_DATA_WEP104={0x11, 0x1, "4d84c4e30151cb27f51a4adf63"}]}]}, 0x7c}, 0x1, 0x0, 0x0, 0x24000}, 0x40) 15:24:04 executing program 4: r0 = socket$inet6(0xa, 0x80003, 0x6b) ioctl(r0, 0x1000008912, &(0x7f00000001c0)="080db5055e0bcfe8476071") r1 = socket(0x10, 0x0, 0x0) sendto(r1, &(0x7f0000000200)="120000001200e7ef007b1a3fcd00000000a1", 0x12, 0x0, 0x0, 0x18) recvmmsg(r1, &(0x7f00000037c0)=[{{&(0x7f0000000600)=@ethernet={0x0, @random}, 0x80, &(0x7f0000000380)=[{&(0x7f0000000040)=""/95, 0x2000007d}, {&(0x7f00000000c0)=""/85, 0x1f3}, {&(0x7f00000024c0)=""/4096, 0x1048}, {&(0x7f0000000400)=""/120, 0x1aa}, {&(0x7f0000000480)=""/60, 0xc6}, {&(0x7f0000000280)=""/77, 0x4d}, {&(0x7f0000000540)=""/154, 0x207}, {&(0x7f0000000340)=""/22, 0x1de}], 0x8, &(0x7f0000002400)=""/191, 0xfffffffffffffea2}}], 0x4000000000001de, 0x6, &(0x7f0000003700)={0x77359400}) [ 362.567882][T16094] bridge181: port 1(syz_tun) entered blocking state [ 362.576009][T16094] bridge181: port 1(syz_tun) entered disabled state [ 362.609496][T16094] device syz_tun entered promiscuous mode [ 362.642881][T16106] netlink: 72 bytes leftover after parsing attributes in process `syz-executor.1'. 15:24:04 executing program 4: r0 = socket$inet6(0xa, 0x80003, 0x6b) ioctl(r0, 0x1000008912, &(0x7f00000001c0)="080db5055e0bcfe8476071") r1 = socket(0x10, 0x0, 0x0) sendto(r1, &(0x7f0000000200)="120000001200e7ef007b1a3fcd00000000a1", 0x12, 0x0, 0x0, 0x18) recvmmsg(r1, &(0x7f00000037c0)=[{{&(0x7f0000000600)=@ethernet={0x0, @random}, 0x80, &(0x7f0000000380)=[{&(0x7f0000000040)=""/95, 0x2000007d}, {&(0x7f00000000c0)=""/85, 0x1f3}, {&(0x7f00000024c0)=""/4096, 0x1048}, {&(0x7f0000000400)=""/120, 0x1aa}, {&(0x7f0000000480)=""/60, 0xc6}, {&(0x7f0000000280)=""/77, 0x4d}, {&(0x7f0000000540)=""/154, 0x207}, {&(0x7f0000000340)=""/22, 0x1de}], 0x8, &(0x7f0000002400)=""/191, 0xfffffffffffffea2}}], 0x4000000000001de, 0x6, &(0x7f0000003700)={0x77359400}) 15:24:04 executing program 0: r0 = socket(0x21, 0xa, 0x1) r1 = socket(0x10, 0x80002, 0x0) ioctl(r1, 0x1000008912, &(0x7f00000001c0)="080db5055e0bcfe8696071") getsockopt$inet_sctp_SCTP_PEER_AUTH_CHUNKS(r1, 0x84, 0x1a, &(0x7f0000000940)=ANY=[@ANYRES32=0x0, @ANYBLOB='\x00'/12], &(0x7f0000000980)=0x10) getsockopt$inet_sctp_SCTP_GET_PEER_ADDR_INFO(r0, 0x84, 0xf, &(0x7f00000009c0)={r2, @in6={{0xa, 0x4e21, 0x8, @local, 0x401}}, 0x9, 0x1, 0x7, 0x7f, 0x6}, &(0x7f0000000a80)=0x98) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000400)='nl80211\x00') sendmsg$NL80211_CMD_GET_MESH_CONFIG(r0, &(0x7f0000000580)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x103190}, 0xc, &(0x7f0000000540)={&(0x7f0000000500)={0x34, r3, 0x10, 0x70bd2d, 0x25dfdbfe, {}, [@NL80211_ATTR_WDEV={0xc, 0x99, {0x0, 0xffffffffffffffff}}, @NL80211_ATTR_WIPHY={0x8, 0x1, 0x1}, @NL80211_ATTR_WDEV={0xc, 0x99, {0x3f, 0x3}}]}, 0x34}, 0x1, 0x0, 0x0, 0x800}, 0x40000) r4 = socket$nl_generic(0x10, 0x3, 0x10) bind$netlink(r4, &(0x7f0000000000)={0x10, 0x0, 0x25dfdbff, 0x1004280}, 0xffffffffffffffb3) sendmsg$nl_generic(r4, &(0x7f0000000080)={&(0x7f0000000480)={0x10, 0xbb7f}, 0xc, &(0x7f0000000440)={&(0x7f00000004c0)={0x1c, 0x22, 0x1, 0x0, 0x0, {0x4}, [@typed={0x8, 0xc}]}, 0x1c}}, 0x0) socket$netlink(0x10, 0x3, 0x0) r5 = socket$alg(0x26, 0x5, 0x0) bind$alg(r5, &(0x7f0000000080)={0x26, 'hash\x00', 0x0, 0x0, 'sha512\x00'}, 0x58) 15:24:04 executing program 2: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000340)={'erspan0\x00', 0x0}) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000300)={'syz_tun\x00', 0x0}) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r7, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r6, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000380)=@newlink={0x34, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r8}, [@IFLA_LINKINFO={0x14, 0x12, @bridge={{0xb, 0x1, 'bridge\x00'}, {0x4}}}]}, 0x34}}, 0x0) sendmsg$nl_route(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000002700)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r5}, [@IFLA_MASTER={0x8, 0xa, r8}]}, 0x28}}, 0x0) sendmsg$nl_route(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f00000000c0)=ANY=[@ANYBLOB="2800000010000104000040000000000000001e", @ANYRES32=r2, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00\b\x00\n\x00', @ANYRES32=r8], 0x4}}, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r10 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r9, 0x8933, &(0x7f0000000300)={'syz_tun\x00', 0x0}) sendmsg$nl_route(r10, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000040)=@newlink={0x2c, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r11}, [@IFLA_BROADCAST={0xa}]}, 0x332}}, 0x0) [ 362.675754][T16105] device syz_tun left promiscuous mode [ 362.699734][T16105] bridge165: port 1(syz_tun) entered disabled state [ 362.857917][T16105] bridge166: port 1(syz_tun) entered blocking state [ 362.865180][T16105] bridge166: port 1(syz_tun) entered disabled state [ 362.874516][T16105] device syz_tun entered promiscuous mode 15:24:04 executing program 4: r0 = socket$inet6(0xa, 0x80003, 0x6b) ioctl(r0, 0x1000008912, &(0x7f00000001c0)="080db5055e0bcfe8476071") r1 = socket(0x10, 0x0, 0x0) sendto(r1, &(0x7f0000000200)="120000001200e7ef007b1a3fcd00000000a1", 0x12, 0x0, 0x0, 0x18) recvmmsg(r1, &(0x7f00000037c0)=[{{&(0x7f0000000600)=@ethernet={0x0, @random}, 0x80, &(0x7f0000000380)=[{&(0x7f0000000040)=""/95, 0x2000007d}, {&(0x7f00000000c0)=""/85, 0x1f3}, {&(0x7f00000024c0)=""/4096, 0x1048}, {&(0x7f0000000400)=""/120, 0x1aa}, {&(0x7f0000000480)=""/60, 0xc6}, {&(0x7f0000000280)=""/77, 0x4d}, {&(0x7f0000000540)=""/154, 0x207}, {&(0x7f0000000340)=""/22, 0x1de}], 0x8, &(0x7f0000002400)=""/191, 0xfffffffffffffea2}}], 0x4000000000001de, 0x6, &(0x7f0000003700)={0x77359400}) 15:24:05 executing program 3: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000340)={'erspan0\x00'}) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000300)={'syz_tun\x00', 0x0}) r5 = socket$nl_route(0x10, 0x3, 0x0) r6 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r6, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r6, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r5, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000380)=@newlink={0x34, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r7}, [@IFLA_LINKINFO={0x14, 0x12, @bridge={{0xb, 0x1, 'bridge\x00'}, {0x4}}}]}, 0x34}}, 0x0) sendmsg$nl_route(r3, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000002700)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r4}, [@IFLA_MASTER={0x8, 0xa, r7}]}, 0x28}}, 0x0) sendmsg$nl_route(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f00000000c0)=ANY=[@ANYBLOB="2800000010000104000040000000000000001ea6", @ANYRES32, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00\b\x00\n\x00', @ANYRES32=r7], 0x28}}, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r9 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r8, 0x8933, &(0x7f0000000300)={'syz_tun\x00', 0x0}) sendmsg$nl_route(r9, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000040)=@newlink={0x2c, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r10}, [@IFLA_BROADCAST={0xa}]}, 0x332}}, 0x0) 15:24:05 executing program 5: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000340)={'erspan0\x00', 0x0}) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000300)={'syz_tun\x00', 0x0}) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r7, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r6, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000380)=@newlink={0x34, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r8}, [@IFLA_LINKINFO={0x14, 0x12, @bridge={{0xb, 0x1, 'bridge\x00'}, {0x4}}}]}, 0x34}}, 0x0) sendmsg$nl_route(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000002700)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r5}, [@IFLA_MASTER={0x8, 0xa, r8}]}, 0x28}}, 0x0) sendmsg$nl_route(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f00000000c0)=ANY=[@ANYRES32=r2, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00\b\x00\n\x00', @ANYRES32=r8], 0x3}}, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r10 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r9, 0x8933, &(0x7f0000000300)={'syz_tun\x00', 0x0}) sendmsg$nl_route(r10, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000040)=@newlink={0x2c, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r11}, [@IFLA_BROADCAST={0xa}]}, 0x332}}, 0x0) [ 362.926671][T16117] netlink: 'syz-executor.1': attribute type 274 has an invalid length. [ 362.946966][T16119] device syz_tun left promiscuous mode [ 362.967999][T16119] bridge181: port 1(syz_tun) entered disabled state [ 363.107921][T16119] bridge182: port 1(syz_tun) entered blocking state [ 363.114889][T16119] bridge182: port 1(syz_tun) entered disabled state [ 363.124655][T16119] device syz_tun entered promiscuous mode [ 363.145566][T16121] netlink: 'syz-executor.1': attribute type 274 has an invalid length. 15:24:05 executing program 2: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000340)={'erspan0\x00', 0x0}) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000300)={'syz_tun\x00', 0x0}) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r7, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r6, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000380)=@newlink={0x34, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r8}, [@IFLA_LINKINFO={0x14, 0x12, @bridge={{0xb, 0x1, 'bridge\x00'}, {0x4}}}]}, 0x34}}, 0x0) sendmsg$nl_route(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000002700)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r5}, [@IFLA_MASTER={0x8, 0xa, r8}]}, 0x28}}, 0x0) sendmsg$nl_route(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f00000000c0)=ANY=[@ANYBLOB="2800000010000104000040000000000000001e", @ANYRES32=r2, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00\b\x00\n\x00', @ANYRES32=r8], 0x4}}, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r10 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r9, 0x8933, &(0x7f0000000300)={'syz_tun\x00', 0x0}) sendmsg$nl_route(r10, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000040)=@newlink={0x2c, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r11}, [@IFLA_BROADCAST={0xa}]}, 0x332}}, 0x0) 15:24:05 executing program 4: r0 = socket$inet6(0xa, 0x80003, 0x6b) ioctl(r0, 0x1000008912, &(0x7f00000001c0)="080db5055e0bcfe8476071") r1 = socket(0x10, 0x2, 0x0) sendto(0xffffffffffffffff, &(0x7f0000000200)="120000001200e7ef007b1a3fcd00000000a1", 0x12, 0x0, 0x0, 0x18) recvmmsg(r1, &(0x7f00000037c0)=[{{&(0x7f0000000600)=@ethernet={0x0, @random}, 0x80, &(0x7f0000000380)=[{&(0x7f0000000040)=""/95, 0x2000007d}, {&(0x7f00000000c0)=""/85, 0x1f3}, {&(0x7f00000024c0)=""/4096, 0x1048}, {&(0x7f0000000400)=""/120, 0x1aa}, {&(0x7f0000000480)=""/60, 0xc6}, {&(0x7f0000000280)=""/77, 0x4d}, {&(0x7f0000000540)=""/154, 0x207}, {&(0x7f0000000340)=""/22, 0x1de}], 0x8, &(0x7f0000002400)=""/191, 0xfffffffffffffea2}}], 0x4000000000001de, 0x6, &(0x7f0000003700)={0x77359400}) 15:24:05 executing program 0: r0 = socket(0x21, 0xa, 0x1) r1 = socket(0x10, 0x80002, 0x0) ioctl(r1, 0x1000008912, &(0x7f00000001c0)="080db5055e0bcfe8696071") getsockopt$inet_sctp_SCTP_PEER_AUTH_CHUNKS(r1, 0x84, 0x1a, &(0x7f0000000940)=ANY=[@ANYRES32=0x0, @ANYBLOB='\x00'/12], &(0x7f0000000980)=0x10) getsockopt$inet_sctp_SCTP_GET_PEER_ADDR_INFO(r0, 0x84, 0xf, &(0x7f00000009c0)={r2, @in6={{0xa, 0x4e21, 0x8, @local, 0x401}}, 0x9, 0x1, 0x7, 0x7f, 0x6}, &(0x7f0000000a80)=0x98) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000400)='nl80211\x00') sendmsg$NL80211_CMD_GET_MESH_CONFIG(r0, &(0x7f0000000580)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x103190}, 0xc, &(0x7f0000000540)={&(0x7f0000000500)={0x34, r3, 0x10, 0x70bd2d, 0x25dfdbfe, {}, [@NL80211_ATTR_WDEV={0xc, 0x99, {0x0, 0xffffffffffffffff}}, @NL80211_ATTR_WIPHY={0x8, 0x1, 0x1}, @NL80211_ATTR_WDEV={0xc, 0x99, {0x3f, 0x3}}]}, 0x34}, 0x1, 0x0, 0x0, 0x800}, 0x40000) r4 = socket$nl_generic(0x10, 0x3, 0x10) bind$netlink(r4, &(0x7f0000000000)={0x10, 0x0, 0x25dfdbff, 0x1004280}, 0xffffffffffffffb3) sendmsg$nl_generic(r4, &(0x7f0000000080)={&(0x7f0000000480)={0x10, 0xbb7f}, 0xc, &(0x7f0000000440)={&(0x7f00000004c0)={0x1c, 0x22, 0x1, 0x0, 0x0, {0x4}, [@typed={0x8, 0xc}]}, 0x1c}}, 0x0) socket$netlink(0x10, 0x3, 0x0) r5 = socket$alg(0x26, 0x5, 0x0) bind$alg(r5, &(0x7f0000000080)={0x26, 'hash\x00', 0x0, 0x0, 'sha512\x00'}, 0x58) [ 363.189565][T16134] device syz_tun left promiscuous mode [ 363.218010][T16134] bridge166: port 1(syz_tun) entered disabled state [ 363.367895][T16134] bridge167: port 1(syz_tun) entered blocking state [ 363.374839][T16134] bridge167: port 1(syz_tun) entered disabled state [ 363.384578][T16134] device syz_tun entered promiscuous mode [ 363.412709][T16135] device syz_tun left promiscuous mode [ 363.418695][T16135] bridge54: port 1(syz_tun) entered disabled state [ 363.548149][T16135] bridge55: port 1(syz_tun) entered blocking state [ 363.554981][T16135] bridge55: port 1(syz_tun) entered disabled state [ 363.564771][T16135] device syz_tun entered promiscuous mode 15:24:05 executing program 5: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000340)={'erspan0\x00', 0x0}) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000300)={'syz_tun\x00', 0x0}) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r7, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r6, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000380)=@newlink={0x34, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r8}, [@IFLA_LINKINFO={0x14, 0x12, @bridge={{0xb, 0x1, 'bridge\x00'}, {0x4}}}]}, 0x34}}, 0x0) sendmsg$nl_route(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000002700)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r5}, [@IFLA_MASTER={0x8, 0xa, r8}]}, 0x28}}, 0x0) sendmsg$nl_route(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f00000000c0)=ANY=[@ANYRES32=r2, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00\b\x00\n\x00', @ANYRES32=r8], 0x3}}, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r10 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r9, 0x8933, &(0x7f0000000300)={'syz_tun\x00', 0x0}) sendmsg$nl_route(r10, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000040)=@newlink={0x2c, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r11}, [@IFLA_BROADCAST={0xa}]}, 0x332}}, 0x0) 15:24:05 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x0, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000004c0)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r3, @ANYBLOB="0000000000000000280012000c0001007665746800000000180002001400010000000000", @ANYRES32=0x0, @ANYBLOB="00000000008433df6d6f6b577d4eaaf2000007"], 0x48}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000540)=ANY=[@ANYBLOB="7400000024000705000000000000000000010000", @ANYRES32=r3, @ANYBLOB="00000000ffffffff000000000800010073667100486818973f73461919309b68e1693572bb000229c6090032d0ed64f3c3545aaf6e000085a4e4ebb5ef670000000000000000000000000000001a4e624d29a84abf03265700000000000000000000000000000000000000000000000000000000000000ac20000089b53c947244306a0216a3de887763df5b42498b13bb1938de859ee6d7ae7dd2224dc672b69b4358871b170ea0b667832e5224ee3538f885b7abd9bc4a7d"], 0x74}}, 0x0) r4 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r4, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000300)=ANY=[@ANYBLOB="840000002c00010700"/20, @ANYRES32=r3, @ANYBLOB="0008008000000000030000000800010075333200580002001400050000000000000000000000000000000000400006003c0001000000000000001020898dde66057433b6ef3a41d22be225e0001b0000000000000000000000000017256ffc66e43a2484e1a912c5998bcbf0d0000000000000000000000000000000798a3c067277da1a290b9613a33c575c36fad473382c8f5532ef3f0e1d2c450a7decbf3431a69f9b2ecb3291bed174245a962fe0484676958265e2988326a89db3139d91fe4aee6ae7e745ab00001a9f61f20500000000000000b3958bc14fce6e66a36d1ab3194534ba4e973684b27793bff837d3"], 0x84}}, 0x0) r5 = socket(0x10, 0x80002, 0x0) sendmmsg$alg(r5, &(0x7f0000000140), 0x49249249249278c, 0x0) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r6, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000500)=@newlink={0x20, 0x11, 0x40d, 0x0, 0x0, {0x0, 0x0, 0x0, r8}}, 0x20}}, 0x0) r9 = socket(0x10, 0x80002, 0x0) getsockopt$inet_sctp_SCTP_PEER_AUTH_CHUNKS(0xffffffffffffffff, 0x84, 0x1a, &(0x7f0000000940)=ANY=[@ANYRES32=0x0, @ANYBLOB='\x00'/12], &(0x7f0000000980)=0x10) r10 = socket(0xa, 0x6, 0x0) close(r10) r11 = socket$inet6_sctp(0xa, 0x10000000005, 0x84) setsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX(r11, 0x84, 0x6e, &(0x7f0000000180)=[@in6={0xa, 0x0, 0x0, @remote, 0x9}], 0x1c) getsockopt$inet_sctp6_SCTP_GET_ASSOC_ID_LIST(r11, 0x84, 0x1d, &(0x7f000095dff8)={0x1, [0x0]}, &(0x7f000095dffc)=0x8) setsockopt$inet_sctp_SCTP_RTOINFO(r10, 0x84, 0x0, &(0x7f0000000000)={r12, 0x0, 0x0, 0x1000000}, 0x10) setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(0xffffffffffffffff, 0x84, 0x9, &(0x7f0000000680)={r12, @in={{0x2, 0x4e20, @remote}}, 0x10001, 0xfff7, 0x5, 0x1, 0x8, 0x5, 0xba}, 0x9c) ioctl(r9, 0x1000008912, &(0x7f00000001c0)="080db5055e0bcfe8696071") getsockopt$inet_sctp_SCTP_PEER_AUTH_CHUNKS(r9, 0x84, 0x1a, &(0x7f0000000940)=ANY=[@ANYRES32=0x0, @ANYBLOB='\x00'/12], &(0x7f0000000980)=0x10) r13 = socket$nl_generic(0x10, 0x3, 0x10) r14 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080)='nl80211\x00') r15 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL80211_CMD_GET_STATION(r15, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000240)={0x1c, r14, 0xf2b, 0x0, 0x0, {}, [@NL80211_ATTR_AIRTIME_WEIGHT={0x8}]}, 0x1c}}, 0x0) sendmsg$NL80211_CMD_GET_MPATH(r13, &(0x7f00000001c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x2000}, 0x268, &(0x7f0000000080)={&(0x7f0000000200)={0x40, r14, 0x4, 0x70bd2d, 0x25dfdbff}, 0xff6b}, 0x1, 0x0, 0x0, 0x10049050}, 0x260448c0) sendmsg$NL80211_CMD_NEW_KEY(r9, &(0x7f0000000640)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0xb0024000}, 0xc, &(0x7f00000002c0)={&(0x7f0000000440)={0x7c, r14, 0x23, 0x70bd27, 0x25dfdbff, {}, [@NL80211_ATTR_KEY_DATA_WEP40={0x9, 0x7, "a80875ab12"}, @NL80211_ATTR_KEY={0x5c, 0x50, [@NL80211_KEY_DEFAULT_TYPES={0x14, 0x8, [@NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_MULTICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_MULTICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_MULTICAST={0x4}]}, @NL80211_KEY_DEFAULT_TYPES={0x28, 0x8, [@NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_MULTICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_MULTICAST={0x4}]}, @NL80211_KEY_IDX={0x5, 0x2, 0x5}, @NL80211_KEY_DATA_WEP104={0x11, 0x1, "4d84c4e30151cb27f51a4adf63"}]}]}, 0x7c}, 0x1, 0x0, 0x0, 0x24000}, 0x40) [ 363.598583][T16148] device syz_tun left promiscuous mode [ 363.614526][T16148] bridge182: port 1(syz_tun) entered disabled state 15:24:05 executing program 3: r0 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r0, &(0x7f0000000280)={0x2, 0x0, @local}, 0x10) setsockopt$sock_int(r0, 0x1, 0x6, &(0x7f0000000100)=0x32, 0x4) connect$inet(r0, &(0x7f0000000200)={0x2, 0x0, @broadcast}, 0x10) r1 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_fanout(r1, 0x107, 0x12, &(0x7f0000000140)={0x0, 0x4}, 0x4) r2 = socket$inet6(0xa, 0x80003, 0x6b) ioctl(r2, 0x1000008912, &(0x7f00000001c0)="0805b5055e0bcfe8474071") pipe(&(0x7f0000000f00)={0xffffffffffffffff}) ioctl$SIOCX25GCAUSEDIAG(r3, 0x89e6, &(0x7f0000000940)) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000001600)={0x0, r3, 0x0, 0x0, 0x0, 0xffffffffffffffff}, 0x30) write$ppp(r3, &(0x7f0000000000)="0850b583e79b2d8cdfeb93e833d2c4c8c933ce9df245e4c987ead57d66e892b055574932d801b976e1cfd5f9078a51a6da950c62180f825377a1cd91136f029b73be1a024bbd2fa2eaa8df41593cf7f49608f930b7c6551d5572850a02ec9752bb4c7c62581c4e86420de6f9393c52d7fc99ecd3bd401f95ddf11c53727ec78f0a834543a864fde3da58b615ce2eaf5595c89ec30b", 0x95) sendmmsg(r0, &(0x7f0000007fc0), 0x4000000000001a8, 0x0) [ 363.757884][T16148] bridge183: port 1(syz_tun) entered blocking state [ 363.768006][T16148] bridge183: port 1(syz_tun) entered disabled state [ 363.797527][T16148] device syz_tun entered promiscuous mode 15:24:05 executing program 2: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000340)={'erspan0\x00', 0x0}) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000300)={'syz_tun\x00', 0x0}) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r7, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r6, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000380)=@newlink={0x34, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r8}, [@IFLA_LINKINFO={0x14, 0x12, @bridge={{0xb, 0x1, 'bridge\x00'}, {0x4}}}]}, 0x34}}, 0x0) sendmsg$nl_route(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000002700)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r5}, [@IFLA_MASTER={0x8, 0xa, r8}]}, 0x28}}, 0x0) sendmsg$nl_route(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f00000000c0)=ANY=[@ANYBLOB="2800000010000104000040000000000000001ea6", @ANYRES32=r2, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00\b\x00\n\x00', @ANYRES32=r8], 0x28}}, 0x0) socketpair$unix(0x1, 0x0, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r10 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r9, 0x8933, &(0x7f0000000300)={'syz_tun\x00', 0x0}) sendmsg$nl_route(r10, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000040)=@newlink={0x2c, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r11}, [@IFLA_BROADCAST={0xa}]}, 0x332}}, 0x0) 15:24:05 executing program 0: r0 = socket(0x21, 0xa, 0x1) r1 = socket(0x10, 0x80002, 0x0) ioctl(r1, 0x1000008912, &(0x7f00000001c0)="080db5055e0bcfe8696071") getsockopt$inet_sctp_SCTP_PEER_AUTH_CHUNKS(r1, 0x84, 0x1a, &(0x7f0000000940)=ANY=[@ANYRES32=0x0, @ANYBLOB='\x00'/12], &(0x7f0000000980)=0x10) getsockopt$inet_sctp_SCTP_GET_PEER_ADDR_INFO(r0, 0x84, 0xf, &(0x7f00000009c0)={r2, @in6={{0xa, 0x4e21, 0x8, @local, 0x401}}, 0x9, 0x1, 0x7, 0x7f, 0x6}, &(0x7f0000000a80)=0x98) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000400)='nl80211\x00') sendmsg$NL80211_CMD_GET_MESH_CONFIG(r0, &(0x7f0000000580)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x103190}, 0xc, &(0x7f0000000540)={&(0x7f0000000500)={0x34, r3, 0x10, 0x70bd2d, 0x25dfdbfe, {}, [@NL80211_ATTR_WDEV={0xc, 0x99, {0x1}}, @NL80211_ATTR_WIPHY={0x8, 0x1, 0x1}, @NL80211_ATTR_WDEV={0xc, 0x99, {0x3f, 0x3}}]}, 0x34}, 0x1, 0x0, 0x0, 0x800}, 0x40000) r4 = socket$nl_generic(0x10, 0x3, 0x10) bind$netlink(r4, &(0x7f0000000000)={0x10, 0x0, 0x25dfdbff, 0x1004280}, 0xffffffffffffffb3) sendmsg$nl_generic(r4, &(0x7f0000000080)={&(0x7f0000000480)={0x10, 0xbb7f}, 0xc, &(0x7f0000000440)={&(0x7f00000004c0)={0x1c, 0x22, 0x1, 0x0, 0x0, {0x4}, [@typed={0x8, 0xc}]}, 0x1c}}, 0x0) socket$netlink(0x10, 0x3, 0x0) r5 = socket$alg(0x26, 0x5, 0x0) bind$alg(r5, &(0x7f0000000080)={0x26, 'hash\x00', 0x0, 0x0, 'sha512\x00'}, 0x58) [ 364.066049][T16160] device syz_tun left promiscuous mode [ 364.076107][T16160] bridge167: port 1(syz_tun) entered disabled state 15:24:06 executing program 4: r0 = socket$inet6(0xa, 0x80003, 0x6b) ioctl(r0, 0x1000008912, &(0x7f00000001c0)="080db5055e0bcfe8476071") r1 = socket(0x10, 0x2, 0x0) sendto(0xffffffffffffffff, &(0x7f0000000200)="120000001200e7ef007b1a3fcd00000000a1", 0x12, 0x0, 0x0, 0x18) recvmmsg(r1, &(0x7f00000037c0)=[{{&(0x7f0000000600)=@ethernet={0x0, @random}, 0x80, &(0x7f0000000380)=[{&(0x7f0000000040)=""/95, 0x2000007d}, {&(0x7f00000000c0)=""/85, 0x1f3}, {&(0x7f00000024c0)=""/4096, 0x1048}, {&(0x7f0000000400)=""/120, 0x1aa}, {&(0x7f0000000480)=""/60, 0xc6}, {&(0x7f0000000280)=""/77, 0x4d}, {&(0x7f0000000540)=""/154, 0x207}, {&(0x7f0000000340)=""/22, 0x1de}], 0x8, &(0x7f0000002400)=""/191, 0xfffffffffffffea2}}], 0x4000000000001de, 0x6, &(0x7f0000003700)={0x77359400}) [ 364.192288][T16160] bridge168: port 1(syz_tun) entered blocking state [ 364.199212][T16160] bridge168: port 1(syz_tun) entered disabled state [ 364.207311][T16160] device syz_tun entered promiscuous mode [ 364.216561][T16161] netlink: 72 bytes leftover after parsing attributes in process `syz-executor.1'. 15:24:06 executing program 5: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000340)={'erspan0\x00', 0x0}) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000300)={'syz_tun\x00', 0x0}) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r7, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r6, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000380)=@newlink={0x34, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r8}, [@IFLA_LINKINFO={0x14, 0x12, @bridge={{0xb, 0x1, 'bridge\x00'}, {0x4}}}]}, 0x34}}, 0x0) sendmsg$nl_route(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000002700)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r5}, [@IFLA_MASTER={0x8, 0xa, r8}]}, 0x28}}, 0x0) sendmsg$nl_route(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f00000000c0)=ANY=[@ANYBLOB, @ANYRES32=r2, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00\b\x00\n\x00', @ANYRES32=r8], 0x4}}, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r10 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r9, 0x8933, &(0x7f0000000300)={'syz_tun\x00', 0x0}) sendmsg$nl_route(r10, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000040)=@newlink={0x2c, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r11}, [@IFLA_BROADCAST={0xa}]}, 0x332}}, 0x0) [ 364.251370][T16172] device syz_tun left promiscuous mode [ 364.257026][T16172] bridge183: port 1(syz_tun) entered disabled state [ 364.368747][T16172] bridge184: port 1(syz_tun) entered blocking state [ 364.375410][T16172] bridge184: port 1(syz_tun) entered disabled state [ 364.385251][T16172] device syz_tun entered promiscuous mode [ 364.394084][T16176] bridge184: port 2(erspan0) entered blocking state [ 364.401173][T16176] bridge184: port 2(erspan0) entered disabled state [ 364.409624][T16176] device erspan0 entered promiscuous mode 15:24:06 executing program 3: r0 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r0, &(0x7f0000000280)={0x2, 0x0, @local}, 0x10) setsockopt$sock_int(r0, 0x1, 0x6, &(0x7f0000000100)=0x32, 0x4) connect$inet(r0, &(0x7f0000000200)={0x2, 0x0, @broadcast}, 0x10) r1 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_fanout(r1, 0x107, 0x12, &(0x7f0000000140)={0x0, 0x4}, 0x4) r2 = socket$inet6(0xa, 0x80003, 0x6b) ioctl(r2, 0x1000008912, &(0x7f00000001c0)="0805b5055e0bcfe8474071") pipe(&(0x7f0000000f00)={0xffffffffffffffff}) ioctl$SIOCX25GCAUSEDIAG(r3, 0x89e6, &(0x7f0000000940)) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000001600)={0x0, r3, 0x0, 0x0, 0x0, 0xffffffffffffffff}, 0x30) write$ppp(r3, &(0x7f0000000000)="0850b583e79b2d8cdfeb93e833d2c4c8c933ce9df245e4c987ead57d66e892b055574932d801b976e1cfd5f9078a51a6da950c62180f825377a1cd91136f029b73be1a024bbd2fa2eaa8df41593cf7f49608f930b7c6551d5572850a02ec9752bb4c7c62581c4e86420de6f9393c52d7fc99ecd3bd401f95ddf11c53727ec78f0a834543a864fde3da58b615ce2eaf5595c89ec30b", 0x95) sendmmsg(r0, &(0x7f0000007fc0), 0x4000000000001a8, 0x0) 15:24:06 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x0, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000004c0)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r3, @ANYBLOB="0000000000000000280012000c0001007665746800000000180002001400010000000000", @ANYRES32=0x0, @ANYBLOB="00000000008433df6d6f6b577d4eaaf2000007"], 0x48}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000540)=ANY=[@ANYBLOB="7400000024000705000000000000000000010000", @ANYRES32=r3, @ANYBLOB="00000000ffffffff000000000800010073667100486818973f73461919309b68e1693572bb000229c6090032d0ed64f3c3545aaf6e000085a4e4ebb5ef670000000000000000000000000000001a4e624d29a84abf03265700000000000000000000000000000000000000000000000000000000000000ac20000089b53c947244306a0216a3de887763df5b42498b13bb1938de859ee6d7ae7dd2224dc672b69b4358871b170ea0b667832e5224ee3538f885b7abd9bc4a7d"], 0x74}}, 0x0) r4 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r4, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000300)=ANY=[@ANYBLOB="840000002c00010700"/20, @ANYRES32=r3, @ANYBLOB="0008008000000000030000000800010075333200580002001400050000000000000000000000000000000000400006003c0001000000000000001020898dde66057433b6ef3a41d22be225e0001b0000000000000000000000000017256ffc66e43a2484e1a912c5998bcbf0d0000000000000000000000000000000798a3c067277da1a290b9613a33c575c36fad473382c8f5532ef3f0e1d2c450a7decbf3431a69f9b2ecb3291bed174245a962fe0484676958265e2988326a89db3139d91fe4aee6ae7e745ab00001a9f61f20500000000000000b3958bc14fce6e66a36d1ab3194534ba4e973684b27793bff837d3"], 0x84}}, 0x0) r5 = socket(0x10, 0x80002, 0x0) sendmmsg$alg(r5, &(0x7f0000000140), 0x49249249249278c, 0x0) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r6, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000500)=@newlink={0x20, 0x11, 0x40d, 0x0, 0x0, {0x0, 0x0, 0x0, r8}}, 0x20}}, 0x0) r9 = socket(0x10, 0x80002, 0x0) getsockopt$inet_sctp_SCTP_PEER_AUTH_CHUNKS(0xffffffffffffffff, 0x84, 0x1a, &(0x7f0000000940)=ANY=[@ANYRES32=0x0, @ANYBLOB='\x00'/12], &(0x7f0000000980)=0x10) r10 = socket(0xa, 0x6, 0x0) close(r10) r11 = socket$inet6_sctp(0xa, 0x10000000005, 0x84) setsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX(r11, 0x84, 0x6e, &(0x7f0000000180)=[@in6={0xa, 0x0, 0x0, @remote, 0x9}], 0x1c) getsockopt$inet_sctp6_SCTP_GET_ASSOC_ID_LIST(r11, 0x84, 0x1d, &(0x7f000095dff8)={0x1, [0x0]}, &(0x7f000095dffc)=0x8) setsockopt$inet_sctp_SCTP_RTOINFO(r10, 0x84, 0x0, &(0x7f0000000000)={r12, 0x0, 0x0, 0x1000000}, 0x10) setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(0xffffffffffffffff, 0x84, 0x9, &(0x7f0000000680)={r12, @in={{0x2, 0x4e20, @remote}}, 0x10001, 0xfff7, 0x5, 0x1, 0x8, 0x5, 0xba}, 0x9c) ioctl(r9, 0x1000008912, &(0x7f00000001c0)="080db5055e0bcfe8696071") getsockopt$inet_sctp_SCTP_PEER_AUTH_CHUNKS(r9, 0x84, 0x1a, &(0x7f0000000940)=ANY=[@ANYRES32=0x0, @ANYBLOB='\x00'/12], &(0x7f0000000980)=0x10) r13 = socket$nl_generic(0x10, 0x3, 0x10) r14 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080)='nl80211\x00') r15 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL80211_CMD_GET_STATION(r15, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000240)={0x1c, r14, 0xf2b, 0x0, 0x0, {}, [@NL80211_ATTR_AIRTIME_WEIGHT={0x8}]}, 0x1c}}, 0x0) sendmsg$NL80211_CMD_GET_MPATH(r13, &(0x7f00000001c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x2000}, 0x268, &(0x7f0000000080)={&(0x7f0000000200)={0x40, r14, 0x4, 0x70bd2d, 0x25dfdbff}, 0xff6b}, 0x1, 0x0, 0x0, 0x10049050}, 0x260448c0) sendmsg$NL80211_CMD_NEW_KEY(r9, &(0x7f0000000640)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0xb0024000}, 0xc, &(0x7f00000002c0)={&(0x7f0000000440)={0x7c, r14, 0x23, 0x70bd27, 0x25dfdbff, {}, [@NL80211_ATTR_KEY_DATA_WEP40={0x9, 0x7, "a80875ab12"}, @NL80211_ATTR_KEY={0x5c, 0x50, [@NL80211_KEY_DEFAULT_TYPES={0x14, 0x8, [@NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_MULTICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_MULTICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_MULTICAST={0x4}]}, @NL80211_KEY_DEFAULT_TYPES={0x28, 0x8, [@NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_MULTICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_MULTICAST={0x4}]}, @NL80211_KEY_IDX={0x5, 0x2, 0x5}, @NL80211_KEY_DATA_WEP104={0x11, 0x1, "4d84c4e30151cb27f51a4adf63"}]}]}, 0x7c}, 0x1, 0x0, 0x0, 0x24000}, 0x40) 15:24:06 executing program 2: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000340)={'erspan0\x00', 0x0}) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000300)={'syz_tun\x00', 0x0}) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r7, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r6, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000380)=@newlink={0x34, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r8}, [@IFLA_LINKINFO={0x14, 0x12, @bridge={{0xb, 0x1, 'bridge\x00'}, {0x4}}}]}, 0x34}}, 0x0) sendmsg$nl_route(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000002700)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r5}, [@IFLA_MASTER={0x8, 0xa, r8}]}, 0x28}}, 0x0) sendmsg$nl_route(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f00000000c0)=ANY=[@ANYBLOB="2800000010000104000040000000000000001ea6", @ANYRES32=r2, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00\b\x00\n\x00', @ANYRES32=r8], 0x28}}, 0x0) socketpair$unix(0x1, 0x0, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r10 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r9, 0x8933, &(0x7f0000000300)={'syz_tun\x00', 0x0}) sendmsg$nl_route(r10, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000040)=@newlink={0x2c, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r11}, [@IFLA_BROADCAST={0xa}]}, 0x332}}, 0x0) [ 364.507988][T16190] device syz_tun left promiscuous mode [ 364.564771][T16190] bridge168: port 1(syz_tun) entered disabled state [ 364.707813][T16190] bridge169: port 1(syz_tun) entered blocking state [ 364.715057][T16190] bridge169: port 1(syz_tun) entered disabled state [ 364.754140][T16190] device syz_tun entered promiscuous mode 15:24:06 executing program 0: r0 = socket(0x21, 0xa, 0x1) r1 = socket(0x10, 0x80002, 0x0) ioctl(r1, 0x1000008912, &(0x7f00000001c0)="080db5055e0bcfe8696071") getsockopt$inet_sctp_SCTP_PEER_AUTH_CHUNKS(r1, 0x84, 0x1a, &(0x7f0000000940)=ANY=[@ANYRES32=0x0, @ANYBLOB='\x00'/12], &(0x7f0000000980)=0x10) getsockopt$inet_sctp_SCTP_GET_PEER_ADDR_INFO(r0, 0x84, 0xf, &(0x7f00000009c0)={r2, @in6={{0xa, 0x4e21, 0x8, @local, 0x401}}, 0x9, 0x1, 0x7, 0x7f, 0x6}, &(0x7f0000000a80)=0x98) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000400)='nl80211\x00') sendmsg$NL80211_CMD_GET_MESH_CONFIG(r0, &(0x7f0000000580)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x103190}, 0xc, &(0x7f0000000540)={&(0x7f0000000500)={0x34, r3, 0x10, 0x70bd2d, 0x25dfdbfe, {}, [@NL80211_ATTR_WDEV={0xc, 0x99, {0x1}}, @NL80211_ATTR_WIPHY={0x8, 0x1, 0x1}, @NL80211_ATTR_WDEV={0xc, 0x99, {0x3f, 0x3}}]}, 0x34}, 0x1, 0x0, 0x0, 0x800}, 0x40000) r4 = socket$nl_generic(0x10, 0x3, 0x10) bind$netlink(r4, &(0x7f0000000000)={0x10, 0x0, 0x25dfdbff, 0x1004280}, 0xffffffffffffffb3) sendmsg$nl_generic(r4, &(0x7f0000000080)={&(0x7f0000000480)={0x10, 0xbb7f}, 0xc, &(0x7f0000000440)={&(0x7f00000004c0)={0x1c, 0x22, 0x1, 0x0, 0x0, {0x4}, [@typed={0x8, 0xc}]}, 0x1c}}, 0x0) socket$netlink(0x10, 0x3, 0x0) r5 = socket$alg(0x26, 0x5, 0x0) bind$alg(r5, &(0x7f0000000080)={0x26, 'hash\x00', 0x0, 0x0, 'sha512\x00'}, 0x58) [ 364.801870][T16208] netlink: 72 bytes leftover after parsing attributes in process `syz-executor.1'. [ 364.824399][T16201] device syz_tun left promiscuous mode [ 364.844688][T16201] bridge184: port 1(syz_tun) entered disabled state 15:24:06 executing program 5: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000340)={'erspan0\x00', 0x0}) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000300)={'syz_tun\x00', 0x0}) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r7, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r6, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000380)=@newlink={0x34, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r8}, [@IFLA_LINKINFO={0x14, 0x12, @bridge={{0xb, 0x1, 'bridge\x00'}, {0x4}}}]}, 0x34}}, 0x0) sendmsg$nl_route(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000002700)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r5}, [@IFLA_MASTER={0x8, 0xa, r8}]}, 0x28}}, 0x0) sendmsg$nl_route(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f00000000c0)=ANY=[@ANYBLOB, @ANYRES32=r2, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00\b\x00\n\x00', @ANYRES32=r8], 0x4}}, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r10 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r9, 0x8933, &(0x7f0000000300)={'syz_tun\x00', 0x0}) sendmsg$nl_route(r10, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000040)=@newlink={0x2c, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r11}, [@IFLA_BROADCAST={0xa}]}, 0x332}}, 0x0) 15:24:07 executing program 4: r0 = socket$inet6(0xa, 0x80003, 0x6b) ioctl(r0, 0x1000008912, &(0x7f00000001c0)="080db5055e0bcfe8476071") r1 = socket(0x10, 0x2, 0x0) sendto(0xffffffffffffffff, &(0x7f0000000200)="120000001200e7ef007b1a3fcd00000000a1", 0x12, 0x0, 0x0, 0x18) recvmmsg(r1, &(0x7f00000037c0)=[{{&(0x7f0000000600)=@ethernet={0x0, @random}, 0x80, &(0x7f0000000380)=[{&(0x7f0000000040)=""/95, 0x2000007d}, {&(0x7f00000000c0)=""/85, 0x1f3}, {&(0x7f00000024c0)=""/4096, 0x1048}, {&(0x7f0000000400)=""/120, 0x1aa}, {&(0x7f0000000480)=""/60, 0xc6}, {&(0x7f0000000280)=""/77, 0x4d}, {&(0x7f0000000540)=""/154, 0x207}, {&(0x7f0000000340)=""/22, 0x1de}], 0x8, &(0x7f0000002400)=""/191, 0xfffffffffffffea2}}], 0x4000000000001de, 0x6, &(0x7f0000003700)={0x77359400}) [ 364.998427][T16201] bridge185: port 1(syz_tun) entered blocking state [ 365.005116][T16201] bridge185: port 1(syz_tun) entered disabled state [ 365.019545][T16201] device syz_tun entered promiscuous mode 15:24:07 executing program 3: r0 = socket(0x10, 0x80002, 0x0) ioctl(r0, 0x1000008912, &(0x7f00000001c0)="080db5055e0bcfe8696071") r1 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r1, 0x6, 0x80000000000002, &(0x7f00000000c0)=0x2000000000000074, 0x25d) bind$inet(r1, &(0x7f0000000280)={0x2, 0x4e23, @multicast2}, 0x10) sendto$inet(r1, 0x0, 0x0, 0x200007fd, &(0x7f0000e68000)={0x2, 0x4e23, @local}, 0x10) setsockopt$inet_tcp_TCP_CONGESTION(r1, 0x6, 0xd, &(0x7f0000000100)='illinois\x00', 0x210) sendto$inet(r1, &(0x7f00000012c0)="05268a927f1f6588b967481241ba7868f1eaf65ac618ded8974895abeaf4b4834ff922b3f1e0b02bd67aa03059bcecc7a95425a3a07e758044ab4ea6f7ae55d88fecf9091a7511bf746bec66ba", 0xfe6a, 0x2, 0x0, 0x27) r2 = socket(0x10, 0x80002, 0x0) ioctl(r2, 0x1000008912, &(0x7f00000001c0)="080db5055e0bcfe8696071") getsockopt$inet_sctp_SCTP_PEER_AUTH_CHUNKS(r2, 0x84, 0x1a, &(0x7f0000000940)=ANY=[@ANYRES32=0x0, @ANYBLOB], &(0x7f0000000980)=0x10) getpeername$llc(r2, &(0x7f0000000000)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @local}, &(0x7f0000000040)=0x10) [ 365.264366][T16204] device erspan0 left promiscuous mode [ 365.277883][T16204] bridge184: port 2(erspan0) entered disabled state [ 365.430606][T16204] bridge185: port 2(erspan0) entered blocking state [ 365.437281][T16204] bridge185: port 2(erspan0) entered disabled state [ 365.459011][T16204] device erspan0 entered promiscuous mode 15:24:07 executing program 2: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000340)={'erspan0\x00', 0x0}) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000300)={'syz_tun\x00', 0x0}) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r7, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r6, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000380)=@newlink={0x34, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r8}, [@IFLA_LINKINFO={0x14, 0x12, @bridge={{0xb, 0x1, 'bridge\x00'}, {0x4}}}]}, 0x34}}, 0x0) sendmsg$nl_route(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000002700)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r5}, [@IFLA_MASTER={0x8, 0xa, r8}]}, 0x28}}, 0x0) sendmsg$nl_route(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f00000000c0)=ANY=[@ANYBLOB="2800000010000104000040000000000000001ea6", @ANYRES32=r2, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00\b\x00\n\x00', @ANYRES32=r8], 0x28}}, 0x0) socketpair$unix(0x1, 0x0, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r10 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r9, 0x8933, &(0x7f0000000300)={'syz_tun\x00', 0x0}) sendmsg$nl_route(r10, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000040)=@newlink={0x2c, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r11}, [@IFLA_BROADCAST={0xa}]}, 0x332}}, 0x0) [ 365.479907][T16205] netlink: 72 bytes leftover after parsing attributes in process `syz-executor.1'. [ 365.509587][T16211] netlink: 'syz-executor.1': attribute type 274 has an invalid length. [ 365.544128][T16216] netlink: 'syz-executor.1': attribute type 274 has an invalid length. [ 365.607037][T16222] device syz_tun left promiscuous mode [ 365.623837][T16222] bridge169: port 1(syz_tun) entered disabled state [ 365.787824][T16222] bridge170: port 1(syz_tun) entered blocking state [ 365.794487][T16222] bridge170: port 1(syz_tun) entered disabled state [ 365.808116][T16222] device syz_tun entered promiscuous mode 15:24:07 executing program 3: r0 = socket$inet(0x2, 0x4000000000000001, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) write$cgroup_int(r1, &(0x7f0000000140), 0xff4d) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000540)='memory.events\x00', 0xb00000000065808, 0x0) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000000)='memory.events\x00', 0x7a05, 0x1700) sendfile(r3, r2, 0x0, 0xffffffff800) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x0) ioctl$TUNSETFILTEREBPF(0xffffffffffffffff, 0x800454e1, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x80000000000002, &(0x7f0000000000)=0x200, 0x4) openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x26e1, 0x0) write$cgroup_int(0xffffffffffffffff, 0x0, 0x2bc) getsockopt$inet_sctp_SCTP_INITMSG(0xffffffffffffffff, 0x84, 0x2, 0x0, 0x0) bind$inet(r0, &(0x7f00000003c0)={0x2, 0x200000000004e23}, 0x10) setsockopt$inet_tcp_TCP_MD5SIG(0xffffffffffffffff, 0x6, 0xe, 0x0, 0x0) getsockopt$SO_BINDTODEVICE(0xffffffffffffffff, 0x1, 0x19, 0x0, 0x0) setsockopt$inet_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f00000002c0)='veno\x00', 0x5) socket$inet_dccp(0x2, 0x6, 0x0) ioctl$sock_inet_SIOCADDRT(0xffffffffffffffff, 0x890b, 0x0) getsockopt$inet_mreq(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0) getsockopt$inet_sctp6_SCTP_FRAGMENT_INTERLEAVE(0xffffffffffffffff, 0x84, 0x12, 0x0, 0x0) socket$nl_generic(0x10, 0x3, 0x10) socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl80211(0x0) sendmsg$NL80211_CMD_SET_BEACON(0xffffffffffffffff, 0x0, 0x0) getsockopt$inet6_mreq(0xffffffffffffffff, 0x29, 0x0, 0x0, 0x0) sendmsg$NL80211_CMD_TRIGGER_SCAN(0xffffffffffffffff, 0x0, 0x0) sendto$inet(r0, 0x0, 0x0, 0x200007fd, &(0x7f00000008c0)={0x2, 0x4e23, @local}, 0x10) recvmsg(r0, &(0x7f0000000240)={&(0x7f0000000040)=@nfc, 0xf012, &(0x7f0000000180)=[{&(0x7f0000003ac0)=""/4096, 0xffffffa4}], 0x1, &(0x7f0000000200)=""/20, 0x14}, 0x100) write$binfmt_elf64(r0, &(0x7f0000000280)=ANY=[@ANYRES32=r0], 0x100000530) [ 365.864150][T16234] device syz_tun left promiscuous mode [ 365.869970][T16234] bridge185: port 1(syz_tun) entered disabled state 15:24:07 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x0, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000004c0)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r3, @ANYBLOB="0000000000000000280012000c0001007665746800000000180002001400010000000000", @ANYRES32=0x0, @ANYBLOB="00000000008433df6d6f6b577d4eaaf2000007"], 0x48}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000540)=ANY=[@ANYBLOB="7400000024000705000000000000000000010000", @ANYRES32=r3, @ANYBLOB="00000000ffffffff000000000800010073667100486818973f73461919309b68e1693572bb000229c6090032d0ed64f3c3545aaf6e000085a4e4ebb5ef670000000000000000000000000000001a4e624d29a84abf03265700000000000000000000000000000000000000000000000000000000000000ac20000089b53c947244306a0216a3de887763df5b42498b13bb1938de859ee6d7ae7dd2224dc672b69b4358871b170ea0b667832e5224ee3538f885b7abd9bc4a7d"], 0x74}}, 0x0) r4 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r4, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000300)=ANY=[@ANYBLOB="840000002c00010700"/20, @ANYRES32=r3, @ANYBLOB="0008008000000000030000000800010075333200580002001400050000000000000000000000000000000000400006003c0001000000000000001020898dde66057433b6ef3a41d22be225e0001b0000000000000000000000000017256ffc66e43a2484e1a912c5998bcbf0d0000000000000000000000000000000798a3c067277da1a290b9613a33c575c36fad473382c8f5532ef3f0e1d2c450a7decbf3431a69f9b2ecb3291bed174245a962fe0484676958265e2988326a89db3139d91fe4aee6ae7e745ab00001a9f61f20500000000000000b3958bc14fce6e66a36d1ab3194534ba4e973684b27793bff837d3"], 0x84}}, 0x0) r5 = socket(0x10, 0x80002, 0x0) sendmmsg$alg(r5, &(0x7f0000000140), 0x49249249249278c, 0x0) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r6, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000500)=@newlink={0x20, 0x11, 0x40d, 0x0, 0x0, {0x0, 0x0, 0x0, r8}}, 0x20}}, 0x0) r9 = socket(0x10, 0x80002, 0x0) getsockopt$inet_sctp_SCTP_PEER_AUTH_CHUNKS(0xffffffffffffffff, 0x84, 0x1a, &(0x7f0000000940)=ANY=[@ANYRES32=0x0, @ANYBLOB='\x00'/12], &(0x7f0000000980)=0x10) r10 = socket(0xa, 0x6, 0x0) close(r10) r11 = socket$inet6_sctp(0xa, 0x10000000005, 0x84) setsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX(r11, 0x84, 0x6e, &(0x7f0000000180)=[@in6={0xa, 0x0, 0x0, @remote, 0x9}], 0x1c) getsockopt$inet_sctp6_SCTP_GET_ASSOC_ID_LIST(r11, 0x84, 0x1d, &(0x7f000095dff8)={0x1, [0x0]}, &(0x7f000095dffc)=0x8) setsockopt$inet_sctp_SCTP_RTOINFO(r10, 0x84, 0x0, &(0x7f0000000000)={r12, 0x0, 0x0, 0x1000000}, 0x10) setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(0xffffffffffffffff, 0x84, 0x9, &(0x7f0000000680)={r12, @in={{0x2, 0x4e20, @remote}}, 0x10001, 0xfff7, 0x5, 0x1, 0x8, 0x5, 0xba}, 0x9c) ioctl(r9, 0x1000008912, &(0x7f00000001c0)="080db5055e0bcfe8696071") getsockopt$inet_sctp_SCTP_PEER_AUTH_CHUNKS(r9, 0x84, 0x1a, &(0x7f0000000940)=ANY=[@ANYRES32=0x0, @ANYBLOB='\x00'/12], &(0x7f0000000980)=0x10) r13 = socket$nl_generic(0x10, 0x3, 0x10) r14 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080)='nl80211\x00') r15 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL80211_CMD_GET_STATION(r15, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000240)={0x1c, r14, 0xf2b, 0x0, 0x0, {}, [@NL80211_ATTR_AIRTIME_WEIGHT={0x8}]}, 0x1c}}, 0x0) sendmsg$NL80211_CMD_GET_MPATH(r13, &(0x7f00000001c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x2000}, 0x268, &(0x7f0000000080)={&(0x7f0000000200)={0x40, r14, 0x4, 0x70bd2d, 0x25dfdbff}, 0xff6b}, 0x1, 0x0, 0x0, 0x10049050}, 0x260448c0) sendmsg$NL80211_CMD_NEW_KEY(r9, &(0x7f0000000640)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0xb0024000}, 0xc, &(0x7f00000002c0)={&(0x7f0000000440)={0x7c, r14, 0x23, 0x70bd27, 0x25dfdbff, {}, [@NL80211_ATTR_KEY_DATA_WEP40={0x9, 0x7, "a80875ab12"}, @NL80211_ATTR_KEY={0x5c, 0x50, [@NL80211_KEY_DEFAULT_TYPES={0x14, 0x8, [@NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_MULTICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_MULTICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_MULTICAST={0x4}]}, @NL80211_KEY_DEFAULT_TYPES={0x28, 0x8, [@NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_MULTICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_MULTICAST={0x4}]}, @NL80211_KEY_IDX={0x5, 0x2, 0x5}, @NL80211_KEY_DATA_WEP104={0x11, 0x1, "4d84c4e30151cb27f51a4adf63"}]}]}, 0x7c}, 0x1, 0x0, 0x0, 0x24000}, 0x40) 15:24:07 executing program 5: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000340)={'erspan0\x00', 0x0}) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000300)={'syz_tun\x00', 0x0}) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r7, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r6, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000380)=@newlink={0x34, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r8}, [@IFLA_LINKINFO={0x14, 0x12, @bridge={{0xb, 0x1, 'bridge\x00'}, {0x4}}}]}, 0x34}}, 0x0) sendmsg$nl_route(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000002700)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r5}, [@IFLA_MASTER={0x8, 0xa, r8}]}, 0x28}}, 0x0) sendmsg$nl_route(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f00000000c0)=ANY=[@ANYBLOB, @ANYRES32=r2, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00\b\x00\n\x00', @ANYRES32=r8], 0x4}}, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r10 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r9, 0x8933, &(0x7f0000000300)={'syz_tun\x00', 0x0}) sendmsg$nl_route(r10, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000040)=@newlink={0x2c, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r11}, [@IFLA_BROADCAST={0xa}]}, 0x332}}, 0x0) 15:24:08 executing program 0: r0 = socket(0x21, 0xa, 0x1) r1 = socket(0x10, 0x80002, 0x0) ioctl(r1, 0x1000008912, &(0x7f00000001c0)="080db5055e0bcfe8696071") getsockopt$inet_sctp_SCTP_PEER_AUTH_CHUNKS(r1, 0x84, 0x1a, &(0x7f0000000940)=ANY=[@ANYRES32=0x0, @ANYBLOB='\x00'/12], &(0x7f0000000980)=0x10) getsockopt$inet_sctp_SCTP_GET_PEER_ADDR_INFO(r0, 0x84, 0xf, &(0x7f00000009c0)={r2, @in6={{0xa, 0x4e21, 0x8, @local, 0x401}}, 0x9, 0x1, 0x7, 0x7f, 0x6}, &(0x7f0000000a80)=0x98) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000400)='nl80211\x00') sendmsg$NL80211_CMD_GET_MESH_CONFIG(r0, &(0x7f0000000580)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x103190}, 0xc, &(0x7f0000000540)={&(0x7f0000000500)={0x34, r3, 0x10, 0x70bd2d, 0x25dfdbfe, {}, [@NL80211_ATTR_WDEV={0xc, 0x99, {0x1}}, @NL80211_ATTR_WIPHY={0x8, 0x1, 0x1}, @NL80211_ATTR_WDEV={0xc, 0x99, {0x3f, 0x3}}]}, 0x34}, 0x1, 0x0, 0x0, 0x800}, 0x40000) r4 = socket$nl_generic(0x10, 0x3, 0x10) bind$netlink(r4, &(0x7f0000000000)={0x10, 0x0, 0x25dfdbff, 0x1004280}, 0xffffffffffffffb3) sendmsg$nl_generic(r4, &(0x7f0000000080)={&(0x7f0000000480)={0x10, 0xbb7f}, 0xc, &(0x7f0000000440)={&(0x7f00000004c0)={0x1c, 0x22, 0x1, 0x0, 0x0, {0x4}, [@typed={0x8, 0xc}]}, 0x1c}}, 0x0) socket$netlink(0x10, 0x3, 0x0) r5 = socket$alg(0x26, 0x5, 0x0) bind$alg(r5, &(0x7f0000000080)={0x26, 'hash\x00', 0x0, 0x0, 'sha512\x00'}, 0x58) 15:24:08 executing program 4: r0 = socket$inet6(0xa, 0x80003, 0x6b) ioctl(r0, 0x1000008912, &(0x7f00000001c0)="080db5055e0bcfe8476071") r1 = socket(0x10, 0x2, 0x0) sendto(r1, 0x0, 0x0, 0x0, 0x0, 0x0) recvmmsg(r1, &(0x7f00000037c0)=[{{&(0x7f0000000600)=@ethernet={0x0, @random}, 0x80, &(0x7f0000000380)=[{&(0x7f0000000040)=""/95, 0x2000007d}, {&(0x7f00000000c0)=""/85, 0x1f3}, {&(0x7f00000024c0)=""/4096, 0x1048}, {&(0x7f0000000400)=""/120, 0x1aa}, {&(0x7f0000000480)=""/60, 0xc6}, {&(0x7f0000000280)=""/77, 0x4d}, {&(0x7f0000000540)=""/154, 0x207}, {&(0x7f0000000340)=""/22, 0x1de}], 0x8, &(0x7f0000002400)=""/191, 0xfffffffffffffea2}}], 0x4000000000001de, 0x6, &(0x7f0000003700)={0x77359400}) [ 366.021578][T16234] bridge186: port 1(syz_tun) entered blocking state [ 366.080265][T16234] bridge186: port 1(syz_tun) entered disabled state [ 366.113135][ T27] audit: type=1804 audit(1578842648.142:170): pid=16239 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.3" name="/root/syzkaller-testdir786929788/syzkaller.vkoNrY/175/memory.events" dev="sda1" ino=16881 res=1 [ 366.175752][T16234] device syz_tun entered promiscuous mode [ 366.202134][ T27] audit: type=1800 audit(1578842648.192:171): pid=16239 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed(directio) comm="syz-executor.3" name="memory.events" dev="sda1" ino=16881 res=0 [ 366.229201][T16235] device erspan0 left promiscuous mode [ 366.234868][T16235] bridge185: port 2(erspan0) entered disabled state [ 366.235692][ T27] audit: type=1804 audit(1578842648.192:172): pid=16253 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.3" name="/root/syzkaller-testdir786929788/syzkaller.vkoNrY/175/memory.events" dev="sda1" ino=16881 res=1 15:24:08 executing program 2: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000340)={'erspan0\x00', 0x0}) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000300)={'syz_tun\x00', 0x0}) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r7, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r6, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000380)=@newlink={0x34, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r8}, [@IFLA_LINKINFO={0x14, 0x12, @bridge={{0xb, 0x1, 'bridge\x00'}, {0x4}}}]}, 0x34}}, 0x0) sendmsg$nl_route(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000002700)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r5}, [@IFLA_MASTER={0x8, 0xa, r8}]}, 0x28}}, 0x0) sendmsg$nl_route(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f00000000c0)=ANY=[@ANYBLOB="2800000010000104000040000000000000001ea6", @ANYRES32=r2, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00\b\x00\n\x00', @ANYRES32=r8], 0x28}}, 0x0) socketpair$unix(0x1, 0x2, 0x0, 0x0) r9 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000300)={'syz_tun\x00', 0x0}) sendmsg$nl_route(r9, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000040)=@newlink={0x2c, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r10}, [@IFLA_BROADCAST={0xa}]}, 0x332}}, 0x0) [ 366.357906][T16235] bridge186: port 2(erspan0) entered blocking state [ 366.364773][T16235] bridge186: port 2(erspan0) entered disabled state [ 366.378386][T16235] device erspan0 entered promiscuous mode [ 366.558257][T16255] device syz_tun left promiscuous mode [ 366.564056][T16255] bridge170: port 1(syz_tun) entered disabled state 15:24:08 executing program 5: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000340)={'erspan0\x00', 0x0}) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000300)={'syz_tun\x00', 0x0}) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r7, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r6, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000380)=@newlink={0x34, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r8}, [@IFLA_LINKINFO={0x14, 0x12, @bridge={{0xb, 0x1, 'bridge\x00'}, {0x4}}}]}, 0x34}}, 0x0) sendmsg$nl_route(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000002700)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r5}, [@IFLA_MASTER={0x8, 0xa, r8}]}, 0x28}}, 0x0) sendmsg$nl_route(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f00000000c0)=ANY=[@ANYBLOB="28000000100001040000", @ANYRES32=r2, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00\b\x00\n\x00', @ANYRES32=r8], 0x4}}, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r10 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r9, 0x8933, &(0x7f0000000300)={'syz_tun\x00', 0x0}) sendmsg$nl_route(r10, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000040)=@newlink={0x2c, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r11}, [@IFLA_BROADCAST={0xa}]}, 0x332}}, 0x0) [ 366.719364][T16255] bridge171: port 1(syz_tun) entered blocking state [ 366.726187][T16255] bridge171: port 1(syz_tun) entered disabled state [ 366.734454][T16255] device syz_tun entered promiscuous mode [ 366.742833][T16248] netlink: 72 bytes leftover after parsing attributes in process `syz-executor.1'. [ 366.791080][T16270] device syz_tun left promiscuous mode [ 366.815667][T16270] bridge186: port 1(syz_tun) entered disabled state 15:24:08 executing program 4: r0 = socket$inet6(0xa, 0x80003, 0x6b) ioctl(r0, 0x1000008912, &(0x7f00000001c0)="080db5055e0bcfe8476071") r1 = socket(0x10, 0x2, 0x0) sendto(r1, 0x0, 0x0, 0x0, 0x0, 0x0) recvmmsg(r1, &(0x7f00000037c0)=[{{&(0x7f0000000600)=@ethernet={0x0, @random}, 0x80, &(0x7f0000000380)=[{&(0x7f0000000040)=""/95, 0x2000007d}, {&(0x7f00000000c0)=""/85, 0x1f3}, {&(0x7f00000024c0)=""/4096, 0x1048}, {&(0x7f0000000400)=""/120, 0x1aa}, {&(0x7f0000000480)=""/60, 0xc6}, {&(0x7f0000000280)=""/77, 0x4d}, {&(0x7f0000000540)=""/154, 0x207}, {&(0x7f0000000340)=""/22, 0x1de}], 0x8, &(0x7f0000002400)=""/191, 0xfffffffffffffea2}}], 0x4000000000001de, 0x6, &(0x7f0000003700)={0x77359400}) [ 366.940002][T16270] bridge187: port 1(syz_tun) entered blocking state [ 366.961420][T16270] bridge187: port 1(syz_tun) entered disabled state [ 366.995130][T16270] device syz_tun entered promiscuous mode [ 367.004338][T16271] device erspan0 left promiscuous mode [ 367.010552][T16271] bridge186: port 2(erspan0) entered disabled state [ 367.127932][T16271] bridge187: port 2(erspan0) entered blocking state [ 367.134796][T16271] bridge187: port 2(erspan0) entered disabled state [ 367.143143][T16271] device erspan0 entered promiscuous mode 15:24:09 executing program 2: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000340)={'erspan0\x00', 0x0}) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000300)={'syz_tun\x00', 0x0}) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r7, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r6, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000380)=@newlink={0x34, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r8}, [@IFLA_LINKINFO={0x14, 0x12, @bridge={{0xb, 0x1, 'bridge\x00'}, {0x4}}}]}, 0x34}}, 0x0) sendmsg$nl_route(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000002700)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r5}, [@IFLA_MASTER={0x8, 0xa, r8}]}, 0x28}}, 0x0) sendmsg$nl_route(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f00000000c0)=ANY=[@ANYBLOB="2800000010000104000040000000000000001ea6", @ANYRES32=r2, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00\b\x00\n\x00', @ANYRES32=r8], 0x28}}, 0x0) socketpair$unix(0x1, 0x2, 0x0, 0x0) r9 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000300)={'syz_tun\x00', 0x0}) sendmsg$nl_route(r9, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000040)=@newlink={0x2c, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r10}, [@IFLA_BROADCAST={0xa}]}, 0x332}}, 0x0) 15:24:09 executing program 3: r0 = socket(0x10, 0x80002, 0x0) sendmmsg$alg(r0, &(0x7f0000000180)=[{0x2, 0x1000000000000, &(0x7f0000000080), 0x0, &(0x7f0000000100)}], 0x492492492492642, 0x0) socket(0x19, 0x98e56fc339c14c80, 0x2) socket$nl_generic(0x10, 0x3, 0x10) gettid() sendmsg$nl_generic(0xffffffffffffffff, 0x0, 0x0) pipe(&(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$netlink(0x10, 0x3, 0x0) r3 = socket$inet_tcp(0x2, 0x1, 0x0) ioctl$sock_SIOCSIFVLAN_ADD_VLAN_CMD(r3, 0x8983, &(0x7f0000000140)={0x0, 'ip6tnl0\x00', {0x4}, 0xc6b}) ioctl(r2, 0x1000008912, &(0x7f00000001c0)="080db5055e0bcfe8478071") sendmsg$NL80211_CMD_START_SCHED_SCAN(0xffffffffffffffff, 0x0, 0x0) ioctl$FS_IOC_REMOVE_ENCRYPTION_KEY_ALL_USERS(r1, 0xc0406619, &(0x7f0000000240)={{0x6, 0x0, @identifier="d255969353ad0633fb3240fa9273779d"}}) r4 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r4, &(0x7f0000000000)={0xa, 0x8000002}, 0x1c) sendto$inet6(r4, 0x0, 0x0, 0x20000001, &(0x7f0000b63fe4)={0xa, 0x2, 0x0, @loopback}, 0x1c) syz_genetlink_get_family_id$netlbl_unlabel(&(0x7f00000002c0)='NLBL_UNLBL\x00') sendmsg$sock(r4, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000b80)=[{0x0}, {&(0x7f0000000780)="1f11c391ebb0498200c347e9bd47244fd3a5c023544bcb8aa2529d374448452e2f7b27efda85e330dc9220b9081ef4e1f31c0e632cad4fc988caf71b479bc6c8e1c31a471c76fcd44961d295561c906c7f45fb3d2197e86aa42fa237e4880e1c43f22ef649b1e31f8eac87aef5fd0dc37827e4d4c83a4b80dcc5b6d97b441cbfc8", 0xfe95}, {&(0x7f0000000840)="f46cbd20fd4b1cbce1a13485b90f59ea6f6ff7d1d49d49638713fdb1f9948a1c0b6f3fe3d61a2acf22d1366859278aeff3d7877b013f83663b0b10f2a41ede88514b50e870f171bf281675932c38887237a754b1bd142f633071c6621340274ad26fec3bca58a92c7a867327e91084834ea6e49a916be86a997789b25ceec3a9ff834cf36c1ffc120777c2f6d1216b5b23985b4d7df305bf6cdf43cc3b319f76429b45aa7ce56ebeb46a5d2968b8abe4ec5436fdd6b685ce3c63ca248d995177ac0d4bdc074e70f32c4e750b11fb6a240e770da692e8015ee679bc9a3bf1a852b280f5f673ac8f9fe986ee48fb7aeb7062de7224aad9966d454cc69a96", 0xfd}, {&(0x7f0000000940)="c97bead89525da49a6e9e27830e41ac4aa53b96bf12be3495b331e23ee0c4747d34977d8bf41ab9f082d981f820fa784fd2274ad3944d71110286a211b65db461de7cd29323b", 0x46}, {&(0x7f00000009c0)="9a97b4714716eac6000e39ae06bb1893e3abdb1c3bc5439ded8ec8258984d920fd5c16aa0e08751b24f01dfbe9739d021138fe06f497c78c21c8c2aeb603c16ad31d42ed3f239652eced63555f131fba39d3cb2bac97a366e5b3aacf5705ae4ae9bfece85d6c15f38cf83738cbd3d0648ceb04dceb7d968e12f6be4a7cf42dcaf8fc9ec5a4c44ce73338ead1d78e9054becf951dd58c56d458f90d69dad1bea60ac98f3ffc14fd9d7d0b984911e3d4e82eb41ec3236ac6f6460e4fb7", 0xbc}, {&(0x7f0000000a80)="8b392db9b7a4ffb8f4184472a38d4021e56db1c33c4b2b363aa62702ccc4c13a65eca09d69ea4a69debbb41b0862798f28174adb11b105f136e0410359c1f3cc0e1eebe2490039a3806968aaefe814e21ed9596058b3450a5784210b84cbc39cbac76865ea762634b394bf62656fed0bed1daf55aa352b13e45b08c63726b9956e3879922591e38b9f149cca01321d3ecc7bc5c261cbc774e2a2d45e54c61f", 0x9f}, {&(0x7f00000001c0)="cc0004b41ece4bba9770befebb3520104bd32c10a73f84e0c8c28fe2f74d57d8b3d514616ecb3d72ad882932e78da5", 0x2f}], 0x7}, 0x4004045) splice(r4, 0x0, r1, 0x0, 0x60000, 0x0) 15:24:09 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x0, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000004c0)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r3, @ANYBLOB="0000000000000000280012000c0001007665746800000000180002001400010000000000", @ANYRES32=0x0, @ANYBLOB="00000000008433df6d6f6b577d4eaaf2000007"], 0x48}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000540)=ANY=[@ANYBLOB="7400000024000705000000000000000000010000", @ANYRES32=r3, @ANYBLOB="00000000ffffffff000000000800010073667100486818973f73461919309b68e1693572bb000229c6090032d0ed64f3c3545aaf6e000085a4e4ebb5ef670000000000000000000000000000001a4e624d29a84abf03265700000000000000000000000000000000000000000000000000000000000000ac20000089b53c947244306a0216a3de887763df5b42498b13bb1938de859ee6d7ae7dd2224dc672b69b4358871b170ea0b667832e5224ee3538f885b7abd9bc4a7d"], 0x74}}, 0x0) r4 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r4, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000300)=ANY=[@ANYBLOB="840000002c00010700"/20, @ANYRES32=r3, @ANYBLOB="0008008000000000030000000800010075333200580002001400050000000000000000000000000000000000400006003c0001000000000000001020898dde66057433b6ef3a41d22be225e0001b0000000000000000000000000017256ffc66e43a2484e1a912c5998bcbf0d0000000000000000000000000000000798a3c067277da1a290b9613a33c575c36fad473382c8f5532ef3f0e1d2c450a7decbf3431a69f9b2ecb3291bed174245a962fe0484676958265e2988326a89db3139d91fe4aee6ae7e745ab00001a9f61f20500000000000000b3958bc14fce6e66a36d1ab3194534ba4e973684b27793bff837d3"], 0x84}}, 0x0) r5 = socket(0x10, 0x80002, 0x0) sendmmsg$alg(r5, &(0x7f0000000140), 0x49249249249278c, 0x0) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r6, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000500)=@newlink={0x20, 0x11, 0x40d, 0x0, 0x0, {0x0, 0x0, 0x0, r8}}, 0x20}}, 0x0) r9 = socket(0x10, 0x80002, 0x0) getsockopt$inet_sctp_SCTP_PEER_AUTH_CHUNKS(0xffffffffffffffff, 0x84, 0x1a, &(0x7f0000000940)=ANY=[@ANYRES32=0x0, @ANYBLOB='\x00'/12], &(0x7f0000000980)=0x10) r10 = socket(0xa, 0x6, 0x0) close(r10) r11 = socket$inet6_sctp(0xa, 0x10000000005, 0x84) setsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX(r11, 0x84, 0x6e, &(0x7f0000000180)=[@in6={0xa, 0x0, 0x0, @remote, 0x9}], 0x1c) getsockopt$inet_sctp6_SCTP_GET_ASSOC_ID_LIST(r11, 0x84, 0x1d, &(0x7f000095dff8)={0x1, [0x0]}, &(0x7f000095dffc)=0x8) setsockopt$inet_sctp_SCTP_RTOINFO(r10, 0x84, 0x0, &(0x7f0000000000)={r12, 0x0, 0x0, 0x1000000}, 0x10) setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(0xffffffffffffffff, 0x84, 0x9, &(0x7f0000000680)={r12, @in={{0x2, 0x4e20, @remote}}, 0x10001, 0xfff7, 0x5, 0x1, 0x8, 0x5, 0xba}, 0x9c) ioctl(r9, 0x1000008912, &(0x7f00000001c0)="080db5055e0bcfe8696071") getsockopt$inet_sctp_SCTP_PEER_AUTH_CHUNKS(r9, 0x84, 0x1a, &(0x7f0000000940)=ANY=[@ANYRES32=0x0, @ANYBLOB='\x00'/12], &(0x7f0000000980)=0x10) r13 = socket$nl_generic(0x10, 0x3, 0x10) r14 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080)='nl80211\x00') r15 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL80211_CMD_GET_STATION(r15, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000240)={0x1c, r14, 0xf2b, 0x0, 0x0, {}, [@NL80211_ATTR_AIRTIME_WEIGHT={0x8}]}, 0x1c}}, 0x0) sendmsg$NL80211_CMD_GET_MPATH(r13, &(0x7f00000001c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x2000}, 0x268, &(0x7f0000000080)={&(0x7f0000000200)={0x40, r14, 0x4, 0x70bd2d, 0x25dfdbff}, 0xff6b}, 0x1, 0x0, 0x0, 0x10049050}, 0x260448c0) sendmsg$NL80211_CMD_NEW_KEY(r9, &(0x7f0000000640)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0xb0024000}, 0xc, &(0x7f00000002c0)={&(0x7f0000000440)={0x7c, r14, 0x23, 0x70bd27, 0x25dfdbff, {}, [@NL80211_ATTR_KEY_DATA_WEP40={0x9, 0x7, "a80875ab12"}, @NL80211_ATTR_KEY={0x5c, 0x50, [@NL80211_KEY_DEFAULT_TYPES={0x14, 0x8, [@NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_MULTICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_MULTICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_MULTICAST={0x4}]}, @NL80211_KEY_DEFAULT_TYPES={0x28, 0x8, [@NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_MULTICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_MULTICAST={0x4}]}, @NL80211_KEY_IDX={0x5, 0x2, 0x5}, @NL80211_KEY_DATA_WEP104={0x11, 0x1, "4d84c4e30151cb27f51a4adf63"}]}]}, 0x7c}, 0x1, 0x0, 0x0, 0x24000}, 0x40) [ 367.182524][T16276] device syz_tun left promiscuous mode [ 367.196349][T16276] bridge171: port 1(syz_tun) entered disabled state 15:24:09 executing program 0: r0 = socket(0x21, 0xa, 0x1) r1 = socket(0x10, 0x80002, 0x0) ioctl(r1, 0x1000008912, &(0x7f00000001c0)="080db5055e0bcfe8696071") getsockopt$inet_sctp_SCTP_PEER_AUTH_CHUNKS(r1, 0x84, 0x1a, &(0x7f0000000940)=ANY=[@ANYRES32=0x0, @ANYBLOB='\x00'/12], &(0x7f0000000980)=0x10) getsockopt$inet_sctp_SCTP_GET_PEER_ADDR_INFO(r0, 0x84, 0xf, &(0x7f00000009c0)={r2, @in6={{0xa, 0x4e21, 0x8, @local, 0x401}}, 0x9, 0x1, 0x7, 0x7f, 0x6}, &(0x7f0000000a80)=0x98) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000400)='nl80211\x00') sendmsg$NL80211_CMD_GET_MESH_CONFIG(r0, &(0x7f0000000580)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x103190}, 0xc, &(0x7f0000000540)={&(0x7f0000000500)={0x34, r3, 0x10, 0x70bd2d, 0x25dfdbfe, {}, [@NL80211_ATTR_WDEV={0xc, 0x99, {0x1, 0xffffffffffffffff}}, @NL80211_ATTR_WIPHY={0x8, 0x1, 0x1}, @NL80211_ATTR_WDEV={0xc, 0x99, {0x3f, 0x3}}]}, 0x34}}, 0x40000) r4 = socket$nl_generic(0x10, 0x3, 0x10) bind$netlink(r4, &(0x7f0000000000)={0x10, 0x0, 0x25dfdbff, 0x1004280}, 0xffffffffffffffb3) sendmsg$nl_generic(r4, &(0x7f0000000080)={&(0x7f0000000480)={0x10, 0xbb7f}, 0xc, &(0x7f0000000440)={&(0x7f00000004c0)={0x1c, 0x22, 0x1, 0x0, 0x0, {0x4}, [@typed={0x8, 0xc}]}, 0x1c}}, 0x0) socket$netlink(0x10, 0x3, 0x0) r5 = socket$alg(0x26, 0x5, 0x0) bind$alg(r5, &(0x7f0000000080)={0x26, 'hash\x00', 0x0, 0x0, 'sha512\x00'}, 0x58) [ 367.354576][T16276] bridge172: port 1(syz_tun) entered blocking state [ 367.387885][T16276] bridge172: port 1(syz_tun) entered disabled state [ 367.405285][T16276] device syz_tun entered promiscuous mode 15:24:09 executing program 5: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000340)={'erspan0\x00', 0x0}) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000300)={'syz_tun\x00', 0x0}) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r7, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r6, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000380)=@newlink={0x34, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r8}, [@IFLA_LINKINFO={0x14, 0x12, @bridge={{0xb, 0x1, 'bridge\x00'}, {0x4}}}]}, 0x34}}, 0x0) sendmsg$nl_route(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000002700)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r5}, [@IFLA_MASTER={0x8, 0xa, r8}]}, 0x28}}, 0x0) sendmsg$nl_route(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f00000000c0)=ANY=[@ANYBLOB="28000000100001040000", @ANYRES32=r2, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00\b\x00\n\x00', @ANYRES32=r8], 0x4}}, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r10 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r9, 0x8933, &(0x7f0000000300)={'syz_tun\x00', 0x0}) sendmsg$nl_route(r10, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000040)=@newlink={0x2c, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r11}, [@IFLA_BROADCAST={0xa}]}, 0x332}}, 0x0) [ 367.462687][T16285] device syz_tun left promiscuous mode [ 367.475467][T16285] bridge187: port 1(syz_tun) entered disabled state [ 367.647900][T16285] bridge188: port 1(syz_tun) entered blocking state [ 367.654720][T16285] bridge188: port 1(syz_tun) entered disabled state [ 367.663098][T16285] device syz_tun entered promiscuous mode 15:24:09 executing program 4: r0 = socket$inet6(0xa, 0x80003, 0x6b) ioctl(r0, 0x1000008912, &(0x7f00000001c0)="080db5055e0bcfe8476071") r1 = socket(0x10, 0x2, 0x0) sendto(r1, 0x0, 0x0, 0x0, 0x0, 0x0) recvmmsg(r1, &(0x7f00000037c0)=[{{&(0x7f0000000600)=@ethernet={0x0, @random}, 0x80, &(0x7f0000000380)=[{&(0x7f0000000040)=""/95, 0x2000007d}, {&(0x7f00000000c0)=""/85, 0x1f3}, {&(0x7f00000024c0)=""/4096, 0x1048}, {&(0x7f0000000400)=""/120, 0x1aa}, {&(0x7f0000000480)=""/60, 0xc6}, {&(0x7f0000000280)=""/77, 0x4d}, {&(0x7f0000000540)=""/154, 0x207}, {&(0x7f0000000340)=""/22, 0x1de}], 0x8, &(0x7f0000002400)=""/191, 0xfffffffffffffea2}}], 0x4000000000001de, 0x6, &(0x7f0000003700)={0x77359400}) 15:24:09 executing program 2: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000340)={'erspan0\x00', 0x0}) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000300)={'syz_tun\x00', 0x0}) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r7, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r6, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000380)=@newlink={0x34, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r8}, [@IFLA_LINKINFO={0x14, 0x12, @bridge={{0xb, 0x1, 'bridge\x00'}, {0x4}}}]}, 0x34}}, 0x0) sendmsg$nl_route(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000002700)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r5}, [@IFLA_MASTER={0x8, 0xa, r8}]}, 0x28}}, 0x0) sendmsg$nl_route(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f00000000c0)=ANY=[@ANYBLOB="2800000010000104000040000000000000001ea6", @ANYRES32=r2, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00\b\x00\n\x00', @ANYRES32=r8], 0x28}}, 0x0) socketpair$unix(0x1, 0x2, 0x0, 0x0) r9 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000300)={'syz_tun\x00', 0x0}) sendmsg$nl_route(r9, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000040)=@newlink={0x2c, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r10}, [@IFLA_BROADCAST={0xa}]}, 0x332}}, 0x0) [ 367.839216][T16297] netlink: 72 bytes leftover after parsing attributes in process `syz-executor.1'. [ 367.898370][T16311] device syz_tun left promiscuous mode [ 367.906154][T16311] bridge172: port 1(syz_tun) entered disabled state [ 368.029107][T16311] bridge173: port 1(syz_tun) entered blocking state [ 368.035950][T16311] bridge173: port 1(syz_tun) entered disabled state [ 368.044972][T16311] device syz_tun entered promiscuous mode 15:24:10 executing program 5: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000340)={'erspan0\x00', 0x0}) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000300)={'syz_tun\x00', 0x0}) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r7, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r6, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000380)=@newlink={0x34, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r8}, [@IFLA_LINKINFO={0x14, 0x12, @bridge={{0xb, 0x1, 'bridge\x00'}, {0x4}}}]}, 0x34}}, 0x0) sendmsg$nl_route(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000002700)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r5}, [@IFLA_MASTER={0x8, 0xa, r8}]}, 0x28}}, 0x0) sendmsg$nl_route(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f00000000c0)=ANY=[@ANYBLOB="28000000100001040000", @ANYRES32=r2, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00\b\x00\n\x00', @ANYRES32=r8], 0x4}}, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r10 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r9, 0x8933, &(0x7f0000000300)={'syz_tun\x00', 0x0}) sendmsg$nl_route(r10, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000040)=@newlink={0x2c, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r11}, [@IFLA_BROADCAST={0xa}]}, 0x332}}, 0x0) [ 368.082277][T16322] device syz_tun left promiscuous mode [ 368.099640][T16322] bridge188: port 1(syz_tun) entered disabled state 15:24:10 executing program 0: r0 = socket(0x21, 0xa, 0x1) r1 = socket(0x10, 0x80002, 0x0) ioctl(r1, 0x1000008912, &(0x7f00000001c0)="080db5055e0bcfe8696071") getsockopt$inet_sctp_SCTP_PEER_AUTH_CHUNKS(r1, 0x84, 0x1a, &(0x7f0000000940)=ANY=[@ANYRES32=0x0, @ANYBLOB='\x00'/12], &(0x7f0000000980)=0x10) getsockopt$inet_sctp_SCTP_GET_PEER_ADDR_INFO(r0, 0x84, 0xf, &(0x7f00000009c0)={r2, @in6={{0xa, 0x4e21, 0x8, @local, 0x401}}, 0x9, 0x1, 0x7, 0x7f, 0x6}, &(0x7f0000000a80)=0x98) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000400)='nl80211\x00') sendmsg$NL80211_CMD_GET_MESH_CONFIG(r0, &(0x7f0000000580)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x103190}, 0xc, &(0x7f0000000540)={&(0x7f0000000500)={0x34, r3, 0x10, 0x70bd2d, 0x25dfdbfe, {}, [@NL80211_ATTR_WDEV={0xc, 0x99, {0x1, 0xffffffffffffffff}}, @NL80211_ATTR_WIPHY={0x8, 0x1, 0x1}, @NL80211_ATTR_WDEV={0xc, 0x99, {0x3f, 0x3}}]}, 0x34}}, 0x40000) r4 = socket$nl_generic(0x10, 0x3, 0x10) bind$netlink(r4, &(0x7f0000000000)={0x10, 0x0, 0x25dfdbff, 0x1004280}, 0xffffffffffffffb3) sendmsg$nl_generic(r4, &(0x7f0000000080)={&(0x7f0000000480)={0x10, 0xbb7f}, 0xc, &(0x7f0000000440)={&(0x7f00000004c0)={0x1c, 0x22, 0x1, 0x0, 0x0, {0x4}, [@typed={0x8, 0xc}]}, 0x1c}}, 0x0) socket$netlink(0x10, 0x3, 0x0) r5 = socket$alg(0x26, 0x5, 0x0) bind$alg(r5, &(0x7f0000000080)={0x26, 'hash\x00', 0x0, 0x0, 'sha512\x00'}, 0x58) 15:24:10 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x0, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000004c0)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r3, @ANYBLOB="0000000000000000280012000c0001007665746800000000180002001400010000000000", @ANYRES32=0x0, @ANYBLOB="00000000008433df6d6f6b577d4eaaf2000007"], 0x48}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000540)=ANY=[@ANYBLOB="7400000024000705000000000000000000010000", @ANYRES32=r3, @ANYBLOB="00000000ffffffff000000000800010073667100486818973f73461919309b68e1693572bb000229c6090032d0ed64f3c3545aaf6e000085a4e4ebb5ef670000000000000000000000000000001a4e624d29a84abf03265700000000000000000000000000000000000000000000000000000000000000ac20000089b53c947244306a0216a3de887763df5b42498b13bb1938de859ee6d7ae7dd2224dc672b69b4358871b170ea0b667832e5224ee3538f885b7abd9bc4a7d"], 0x74}}, 0x0) r4 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r4, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000300)=ANY=[@ANYBLOB="840000002c00010700"/20, @ANYRES32=r3, @ANYBLOB="0008008000000000030000000800010075333200580002001400050000000000000000000000000000000000400006003c0001000000000000001020898dde66057433b6ef3a41d22be225e0001b0000000000000000000000000017256ffc66e43a2484e1a912c5998bcbf0d0000000000000000000000000000000798a3c067277da1a290b9613a33c575c36fad473382c8f5532ef3f0e1d2c450a7decbf3431a69f9b2ecb3291bed174245a962fe0484676958265e2988326a89db3139d91fe4aee6ae7e745ab00001a9f61f20500000000000000b3958bc14fce6e66a36d1ab3194534ba4e973684b27793bff837d3"], 0x84}}, 0x0) r5 = socket(0x10, 0x80002, 0x0) sendmmsg$alg(r5, &(0x7f0000000140), 0x49249249249278c, 0x0) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r6, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000500)=@newlink={0x20, 0x11, 0x40d, 0x0, 0x0, {0x0, 0x0, 0x0, r8}}, 0x20}}, 0x0) r9 = socket(0x10, 0x80002, 0x0) getsockopt$inet_sctp_SCTP_PEER_AUTH_CHUNKS(0xffffffffffffffff, 0x84, 0x1a, &(0x7f0000000940)=ANY=[@ANYRES32=0x0, @ANYBLOB='\x00'/12], &(0x7f0000000980)=0x10) r10 = socket(0xa, 0x6, 0x0) close(r10) r11 = socket$inet6_sctp(0xa, 0x10000000005, 0x84) setsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX(r11, 0x84, 0x6e, &(0x7f0000000180)=[@in6={0xa, 0x0, 0x0, @remote, 0x9}], 0x1c) getsockopt$inet_sctp6_SCTP_GET_ASSOC_ID_LIST(r11, 0x84, 0x1d, &(0x7f000095dff8)={0x1, [0x0]}, &(0x7f000095dffc)=0x8) setsockopt$inet_sctp_SCTP_RTOINFO(r10, 0x84, 0x0, &(0x7f0000000000)={r12, 0x0, 0x0, 0x1000000}, 0x10) setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(0xffffffffffffffff, 0x84, 0x9, &(0x7f0000000680)={r12, @in={{0x2, 0x4e20, @remote}}, 0x10001, 0xfff7, 0x5, 0x1, 0x8, 0x5, 0xba}, 0x9c) ioctl(r9, 0x1000008912, &(0x7f00000001c0)="080db5055e0bcfe8696071") getsockopt$inet_sctp_SCTP_PEER_AUTH_CHUNKS(r9, 0x84, 0x1a, &(0x7f0000000940)=ANY=[@ANYRES32=0x0, @ANYBLOB='\x00'/12], &(0x7f0000000980)=0x10) r13 = socket$nl_generic(0x10, 0x3, 0x10) r14 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080)='nl80211\x00') r15 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL80211_CMD_GET_STATION(r15, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000240)={0x1c, r14, 0xf2b, 0x0, 0x0, {}, [@NL80211_ATTR_AIRTIME_WEIGHT={0x8}]}, 0x1c}}, 0x0) sendmsg$NL80211_CMD_GET_MPATH(r13, &(0x7f00000001c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x2000}, 0x268, &(0x7f0000000080)={&(0x7f0000000200)={0x40, r14, 0x4, 0x70bd2d, 0x25dfdbff}, 0xff6b}, 0x1, 0x0, 0x0, 0x10049050}, 0x260448c0) sendmsg$NL80211_CMD_NEW_KEY(r9, &(0x7f0000000640)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0xb0024000}, 0xc, &(0x7f00000002c0)={&(0x7f0000000440)={0x7c, r14, 0x23, 0x70bd27, 0x25dfdbff, {}, [@NL80211_ATTR_KEY_DATA_WEP40={0x9, 0x7, "a80875ab12"}, @NL80211_ATTR_KEY={0x5c, 0x50, [@NL80211_KEY_DEFAULT_TYPES={0x14, 0x8, [@NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_MULTICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_MULTICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_MULTICAST={0x4}]}, @NL80211_KEY_DEFAULT_TYPES={0x28, 0x8, [@NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_MULTICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_MULTICAST={0x4}]}, @NL80211_KEY_IDX={0x5, 0x2, 0x5}, @NL80211_KEY_DATA_WEP104={0x11, 0x1, "4d84c4e30151cb27f51a4adf63"}]}]}, 0x7c}, 0x1, 0x0, 0x0, 0x24000}, 0x40) [ 368.207943][T16322] bridge189: port 1(syz_tun) entered blocking state [ 368.207982][T16322] bridge189: port 1(syz_tun) entered disabled state [ 368.209418][T16322] device syz_tun entered promiscuous mode [ 368.236602][T16323] device erspan0 left promiscuous mode [ 368.242419][T16323] bridge187: port 2(erspan0) entered disabled state [ 368.368335][T16323] bridge189: port 2(erspan0) entered blocking state [ 368.377756][T16323] bridge189: port 2(erspan0) entered disabled state [ 368.386055][T16323] device erspan0 entered promiscuous mode [ 368.406945][T16330] device syz_tun left promiscuous mode 15:24:10 executing program 2: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000340)={'erspan0\x00', 0x0}) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000300)={'syz_tun\x00', 0x0}) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r7, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r6, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000380)=@newlink={0x34, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r8}, [@IFLA_LINKINFO={0x14, 0x12, @bridge={{0xb, 0x1, 'bridge\x00'}, {0x4}}}]}, 0x34}}, 0x0) sendmsg$nl_route(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000002700)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r5}, [@IFLA_MASTER={0x8, 0xa, r8}]}, 0x28}}, 0x0) sendmsg$nl_route(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f00000000c0)=ANY=[@ANYBLOB="2800000010000104000040000000000000001ea6", @ANYRES32=r2, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00\b\x00\n\x00', @ANYRES32=r8], 0x28}}, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)) r9 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000300)={'syz_tun\x00', 0x0}) sendmsg$nl_route(r9, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000040)=@newlink={0x2c, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r10}, [@IFLA_BROADCAST={0xa}]}, 0x332}}, 0x0) [ 368.419599][T16330] bridge173: port 1(syz_tun) entered disabled state [ 368.547807][T16330] bridge174: port 1(syz_tun) entered blocking state [ 368.554740][T16330] bridge174: port 1(syz_tun) entered disabled state [ 368.566889][T16330] device syz_tun entered promiscuous mode 15:24:10 executing program 5: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000340)={'erspan0\x00', 0x0}) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000300)={'syz_tun\x00', 0x0}) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r7, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r6, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000380)=@newlink={0x34, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r8}, [@IFLA_LINKINFO={0x14, 0x12, @bridge={{0xb, 0x1, 'bridge\x00'}, {0x4}}}]}, 0x34}}, 0x0) sendmsg$nl_route(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000002700)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r5}, [@IFLA_MASTER={0x8, 0xa, r8}]}, 0x28}}, 0x0) sendmsg$nl_route(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f00000000c0)=ANY=[@ANYBLOB="280000001000010400004000000000", @ANYRES32=r2, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00\b\x00\n\x00', @ANYRES32=r8], 0x4}}, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r10 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r9, 0x8933, &(0x7f0000000300)={'syz_tun\x00', 0x0}) sendmsg$nl_route(r10, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000040)=@newlink={0x2c, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r11}, [@IFLA_BROADCAST={0xa}]}, 0x332}}, 0x0) 15:24:10 executing program 4: r0 = socket$inet6(0xa, 0x80003, 0x6b) ioctl(r0, 0x1000008912, &(0x7f00000001c0)="080db5055e0bcfe8476071") r1 = socket(0x10, 0x2, 0x0) sendto(r1, &(0x7f0000000200), 0x0, 0x0, 0x0, 0x0) recvmmsg(r1, &(0x7f00000037c0)=[{{&(0x7f0000000600)=@ethernet={0x0, @random}, 0x80, &(0x7f0000000380)=[{&(0x7f0000000040)=""/95, 0x2000007d}, {&(0x7f00000000c0)=""/85, 0x1f3}, {&(0x7f00000024c0)=""/4096, 0x1048}, {&(0x7f0000000400)=""/120, 0x1aa}, {&(0x7f0000000480)=""/60, 0xc6}, {&(0x7f0000000280)=""/77, 0x4d}, {&(0x7f0000000540)=""/154, 0x207}, {&(0x7f0000000340)=""/22, 0x1de}], 0x8, &(0x7f0000002400)=""/191, 0xfffffffffffffea2}}], 0x4000000000001de, 0x6, &(0x7f0000003700)={0x77359400}) [ 368.747860][T16337] netlink: 72 bytes leftover after parsing attributes in process `syz-executor.1'. [ 368.768339][T16345] device syz_tun left promiscuous mode [ 368.774008][T16345] bridge189: port 1(syz_tun) entered disabled state [ 368.889025][T16345] bridge190: port 1(syz_tun) entered blocking state [ 368.895911][T16345] bridge190: port 1(syz_tun) entered disabled state [ 368.905114][T16345] device syz_tun entered promiscuous mode [ 368.920394][T16347] device erspan0 left promiscuous mode [ 368.926000][T16347] bridge189: port 2(erspan0) entered disabled state [ 369.057784][T16347] bridge190: port 2(erspan0) entered blocking state [ 369.064598][T16347] bridge190: port 2(erspan0) entered disabled state [ 369.074377][T16347] device erspan0 entered promiscuous mode [ 369.097898][T16356] device syz_tun left promiscuous mode [ 369.105629][T16356] bridge174: port 1(syz_tun) entered disabled state [ 369.227793][T16356] bridge175: port 1(syz_tun) entered blocking state [ 369.234625][T16356] bridge175: port 1(syz_tun) entered disabled state [ 369.243589][T16356] device syz_tun entered promiscuous mode 15:24:12 executing program 3: r0 = socket$inet6(0xa, 0x3, 0x3c) connect$inet6(r0, &(0x7f0000000040)={0xa, 0x0, 0x0, @mcast2, 0x9}, 0x1c) sendmsg$inet6(r0, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000600)}, 0x20000000) sendmsg(r0, &(0x7f0000000a40)={0x0, 0xfffffffffffffe3d, &(0x7f0000000380)=[{&(0x7f00000003c0)="339a", 0x2d05}], 0x1}, 0x0) 15:24:12 executing program 0: r0 = socket(0x21, 0xa, 0x1) r1 = socket(0x10, 0x80002, 0x0) ioctl(r1, 0x1000008912, &(0x7f00000001c0)="080db5055e0bcfe8696071") getsockopt$inet_sctp_SCTP_PEER_AUTH_CHUNKS(r1, 0x84, 0x1a, &(0x7f0000000940)=ANY=[@ANYRES32=0x0, @ANYBLOB='\x00'/12], &(0x7f0000000980)=0x10) getsockopt$inet_sctp_SCTP_GET_PEER_ADDR_INFO(r0, 0x84, 0xf, &(0x7f00000009c0)={r2, @in6={{0xa, 0x4e21, 0x8, @local, 0x401}}, 0x9, 0x1, 0x7, 0x7f, 0x6}, &(0x7f0000000a80)=0x98) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000400)='nl80211\x00') sendmsg$NL80211_CMD_GET_MESH_CONFIG(r0, &(0x7f0000000580)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x103190}, 0xc, &(0x7f0000000540)={&(0x7f0000000500)={0x34, r3, 0x10, 0x70bd2d, 0x25dfdbfe, {}, [@NL80211_ATTR_WDEV={0xc, 0x99, {0x1, 0xffffffffffffffff}}, @NL80211_ATTR_WIPHY={0x8, 0x1, 0x1}, @NL80211_ATTR_WDEV={0xc, 0x99, {0x3f, 0x3}}]}, 0x34}}, 0x40000) r4 = socket$nl_generic(0x10, 0x3, 0x10) bind$netlink(r4, &(0x7f0000000000)={0x10, 0x0, 0x25dfdbff, 0x1004280}, 0xffffffffffffffb3) sendmsg$nl_generic(r4, &(0x7f0000000080)={&(0x7f0000000480)={0x10, 0xbb7f}, 0xc, &(0x7f0000000440)={&(0x7f00000004c0)={0x1c, 0x22, 0x1, 0x0, 0x0, {0x4}, [@typed={0x8, 0xc}]}, 0x1c}}, 0x0) socket$netlink(0x10, 0x3, 0x0) r5 = socket$alg(0x26, 0x5, 0x0) bind$alg(r5, &(0x7f0000000080)={0x26, 'hash\x00', 0x0, 0x0, 'sha512\x00'}, 0x58) 15:24:12 executing program 5: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000340)={'erspan0\x00', 0x0}) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000300)={'syz_tun\x00', 0x0}) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r7, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r6, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000380)=@newlink={0x34, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r8}, [@IFLA_LINKINFO={0x14, 0x12, @bridge={{0xb, 0x1, 'bridge\x00'}, {0x4}}}]}, 0x34}}, 0x0) sendmsg$nl_route(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000002700)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r5}, [@IFLA_MASTER={0x8, 0xa, r8}]}, 0x28}}, 0x0) sendmsg$nl_route(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f00000000c0)=ANY=[@ANYBLOB="280000001000010400004000000000", @ANYRES32=r2, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00\b\x00\n\x00', @ANYRES32=r8], 0x4}}, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r10 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r9, 0x8933, &(0x7f0000000300)={'syz_tun\x00', 0x0}) sendmsg$nl_route(r10, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000040)=@newlink={0x2c, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r11}, [@IFLA_BROADCAST={0xa}]}, 0x332}}, 0x0) 15:24:12 executing program 2: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000340)={'erspan0\x00', 0x0}) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000300)={'syz_tun\x00', 0x0}) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r7, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r6, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000380)=@newlink={0x34, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r8}, [@IFLA_LINKINFO={0x14, 0x12, @bridge={{0xb, 0x1, 'bridge\x00'}, {0x4}}}]}, 0x34}}, 0x0) sendmsg$nl_route(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000002700)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r5}, [@IFLA_MASTER={0x8, 0xa, r8}]}, 0x28}}, 0x0) sendmsg$nl_route(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f00000000c0)=ANY=[@ANYBLOB="2800000010000104000040000000000000001ea6", @ANYRES32=r2, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00\b\x00\n\x00', @ANYRES32=r8], 0x28}}, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)) r9 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000300)={'syz_tun\x00', 0x0}) sendmsg$nl_route(r9, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000040)=@newlink={0x2c, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r10}, [@IFLA_BROADCAST={0xa}]}, 0x332}}, 0x0) 15:24:12 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x0, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000004c0)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r3, @ANYBLOB="0000000000000000280012000c0001007665746800000000180002001400010000000000", @ANYRES32=0x0, @ANYBLOB="00000000008433df6d6f6b577d4eaaf2000007"], 0x48}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000540)=ANY=[@ANYBLOB="7400000024000705000000000000000000010000", @ANYRES32=r3, @ANYBLOB="00000000ffffffff000000000800010073667100486818973f73461919309b68e1693572bb000229c6090032d0ed64f3c3545aaf6e000085a4e4ebb5ef670000000000000000000000000000001a4e624d29a84abf03265700000000000000000000000000000000000000000000000000000000000000ac20000089b53c947244306a0216a3de887763df5b42498b13bb1938de859ee6d7ae7dd2224dc672b69b4358871b170ea0b667832e5224ee3538f885b7abd9bc4a7d"], 0x74}}, 0x0) r4 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r4, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000300)=ANY=[@ANYBLOB="840000002c00010700"/20, @ANYRES32=r3, @ANYBLOB="0008008000000000030000000800010075333200580002001400050000000000000000000000000000000000400006003c0001000000000000001020898dde66057433b6ef3a41d22be225e0001b0000000000000000000000000017256ffc66e43a2484e1a912c5998bcbf0d0000000000000000000000000000000798a3c067277da1a290b9613a33c575c36fad473382c8f5532ef3f0e1d2c450a7decbf3431a69f9b2ecb3291bed174245a962fe0484676958265e2988326a89db3139d91fe4aee6ae7e745ab00001a9f61f20500000000000000b3958bc14fce6e66a36d1ab3194534ba4e973684b27793bff837d3"], 0x84}}, 0x0) r5 = socket(0x10, 0x80002, 0x0) sendmmsg$alg(r5, &(0x7f0000000140), 0x49249249249278c, 0x0) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r6, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000500)=@newlink={0x20, 0x11, 0x40d, 0x0, 0x0, {0x0, 0x0, 0x0, r8}}, 0x20}}, 0x0) r9 = socket(0x10, 0x80002, 0x0) getsockopt$inet_sctp_SCTP_PEER_AUTH_CHUNKS(0xffffffffffffffff, 0x84, 0x1a, &(0x7f0000000940)=ANY=[@ANYRES32=0x0, @ANYBLOB='\x00'/12], &(0x7f0000000980)=0x10) r10 = socket(0xa, 0x6, 0x0) close(r10) r11 = socket$inet6_sctp(0xa, 0x10000000005, 0x84) setsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX(r11, 0x84, 0x6e, &(0x7f0000000180)=[@in6={0xa, 0x0, 0x0, @remote, 0x9}], 0x1c) getsockopt$inet_sctp6_SCTP_GET_ASSOC_ID_LIST(r11, 0x84, 0x1d, &(0x7f000095dff8)={0x1, [0x0]}, &(0x7f000095dffc)=0x8) setsockopt$inet_sctp_SCTP_RTOINFO(r10, 0x84, 0x0, &(0x7f0000000000)={r12, 0x0, 0x0, 0x1000000}, 0x10) setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(0xffffffffffffffff, 0x84, 0x9, &(0x7f0000000680)={r12, @in={{0x2, 0x4e20, @remote}}, 0x10001, 0xfff7, 0x5, 0x1, 0x8, 0x5, 0xba}, 0x9c) ioctl(r9, 0x1000008912, &(0x7f00000001c0)="080db5055e0bcfe8696071") getsockopt$inet_sctp_SCTP_PEER_AUTH_CHUNKS(r9, 0x84, 0x1a, &(0x7f0000000940)=ANY=[@ANYRES32=0x0, @ANYBLOB='\x00'/12], &(0x7f0000000980)=0x10) r13 = socket$nl_generic(0x10, 0x3, 0x10) r14 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080)='nl80211\x00') r15 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL80211_CMD_GET_STATION(r15, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000240)={0x1c, r14, 0xf2b, 0x0, 0x0, {}, [@NL80211_ATTR_AIRTIME_WEIGHT={0x8}]}, 0x1c}}, 0x0) sendmsg$NL80211_CMD_GET_MPATH(r13, &(0x7f00000001c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x2000}, 0x268, &(0x7f0000000080)={&(0x7f0000000200)={0x40, r14, 0x4, 0x70bd2d, 0x25dfdbff}, 0xff6b}, 0x1, 0x0, 0x0, 0x10049050}, 0x260448c0) sendmsg$NL80211_CMD_NEW_KEY(r9, &(0x7f0000000640)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0xb0024000}, 0xc, &(0x7f00000002c0)={&(0x7f0000000440)={0x7c, r14, 0x23, 0x70bd27, 0x25dfdbff, {}, [@NL80211_ATTR_KEY_DATA_WEP40={0x9, 0x7, "a80875ab12"}, @NL80211_ATTR_KEY={0x5c, 0x50, [@NL80211_KEY_DEFAULT_TYPES={0x14, 0x8, [@NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_MULTICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_MULTICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_MULTICAST={0x4}]}, @NL80211_KEY_DEFAULT_TYPES={0x28, 0x8, [@NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_MULTICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_MULTICAST={0x4}]}, @NL80211_KEY_IDX={0x5, 0x2, 0x5}, @NL80211_KEY_DATA_WEP104={0x11, 0x1, "4d84c4e30151cb27f51a4adf63"}]}]}, 0x7c}, 0x1, 0x0, 0x0, 0x24000}, 0x40) 15:24:12 executing program 4: r0 = socket$inet6(0xa, 0x80003, 0x6b) ioctl(r0, 0x1000008912, &(0x7f00000001c0)="080db5055e0bcfe8476071") r1 = socket(0x10, 0x2, 0x0) sendto(r1, &(0x7f0000000200), 0x0, 0x0, 0x0, 0x0) recvmmsg(r1, &(0x7f00000037c0)=[{{&(0x7f0000000600)=@ethernet={0x0, @random}, 0x80, &(0x7f0000000380)=[{&(0x7f0000000040)=""/95, 0x2000007d}, {&(0x7f00000000c0)=""/85, 0x1f3}, {&(0x7f00000024c0)=""/4096, 0x1048}, {&(0x7f0000000400)=""/120, 0x1aa}, {&(0x7f0000000480)=""/60, 0xc6}, {&(0x7f0000000280)=""/77, 0x4d}, {&(0x7f0000000540)=""/154, 0x207}, {&(0x7f0000000340)=""/22, 0x1de}], 0x8, &(0x7f0000002400)=""/191, 0xfffffffffffffea2}}], 0x4000000000001de, 0x6, &(0x7f0000003700)={0x77359400}) 15:24:12 executing program 3: r0 = socket$inet(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0xa, &(0x7f00000002c0)=0x40000000000ffb, 0x4) bind$inet(r0, &(0x7f0000001280)={0x2, 0x8000004e23, @multicast2}, 0x10) sendto$inet(r0, 0x0, 0x1e924292373e0323, 0x2408c815, &(0x7f0000000080)={0x2, 0x200000004e23, @loopback}, 0x10) r1 = socket(0x10, 0x80002, 0x0) ioctl(r1, 0x1000008912, &(0x7f00000001c0)="080db5055e0bcfe8696071") setsockopt$sock_int(r0, 0x1, 0x8, &(0x7f0000000100), 0x4) sendto(r0, &(0x7f0000002300)="862e2f66792f889eff93bedf6dc14fbb5a2b270209382521cf00bd5dd192f45ebb2d3656aa7d2db118c1c5a23f3a048d3eb30f0822434274f4b162e1474c3914fb732bdca1055334420dcab57de08c17959534b91556dbbd89f09ab0dcf026e395133d98bfcefb71ade9b5bc3504247948cead01382cfd9cba102d4bedbb0b2ba22bd411c8c4f6be2e8823e353e1042674ca22cc9417c8b3d08e4e2d5b9637022963ce5fc28072dbab19ec0e569fa1c0c3a4e9337423dfee462a64fa0752ab0db772f78af4bb11a7fbef321f6b2e9b64de572eac1dc2c2aa3ba98c3c0f455b211c00c1393d660ed41470aa789655f8a6f785f30b077a467eadbc34af99dd8ba4030f792f80f341419fb005806debc35c70dfa5b41b45923da7efbbeda51003af18201b882a657459962342fe18a68e1587434451500f358b1234889cb683b8050a2b1d222e209e68b7748863854419ff3815c8ea99574a7e5049ba18714e7197a136bf39d95ffa39fa2824a1ab51a447abfe7bbee785a65378e9a90960272ff919cf9db83de033949e63e3cf34db98901f1a9c9ba12f4e1e38a609830baf4d6b188408305600e32bbdc4fcf86f67df43c6a84f7abe5e7408932206116c02b63f4ad51e1c3e3f7a2f04f7f92fd3a3b200280b00243d142033522214ed5f025cbc8164cd9781388d0ef067de46c756f272ea611209d74ee770f073615965307e3fa5a7469cb5a68eef95fb036b7767360e2299fd3d67a850089c533244a5a94941a52a1097284be1da86d3c9169cfb6a17384f8983fc0237d35cf1ca19084dda4e1d3cbd0520fd7a45be921c49460ce366847f812ac53693bc85d75c40a1c2a19f2e677b421921f549110f2827d9c10acbc3c939c971fe80ca39b786f634a0b05f74e155253c1437bf143e8ce84365b46ead29d7bffc7f55274601452a1c6ef093044af63da0f464902b025c866498c7e3004d3d1e8731bd6d1b5774d8e8954a745604400f49b9d022f249de3c15907bff0ef7d757483cdc353f3143e7ebdece542cfc1dc8e933d24ebb760567cf6429d186a43162af49eb5e9d3e943addff581bd5b9c0d589492a938add82b8f806f141e38edbbbc09494d419f9f60bbd2374ed801923f2f8784f4cf8ce729e73410e2899d4d62d59ebf51d831210d85cf71c8617f989c6e90bd74c44076a606f01f4d1d31148c47f667c2702f242b526d1b0e775feaf021d0678326c8a58c92b651e117fd31c9687ac5e9d39cdfcce38dd7122ebde51632fe55817ee7cb59f9cc2b637a3b932a63571a049f39cda426cfc6abf9aca4c06df9ae80d9cce64ca6f356e28a9cd348f94ea73b4d9e61bcdd5d52f6919c0863b1408cf379e0afc3ff7167d816bb79640f8202a8ddcf573d2c22894ef0c480b9b523f63458a95ceabb014387bd07a98220177c3836fed6ec898bef837510bf5c5fa11171ccf42558ed487639274a822993604a2bc421fc425347e33fe52beb590efeebaaf463b1702ab34fa3ac399cc1328c9ae70239df9803d600618aca26e0cbbd1a0cffe8f8c676c5866e6f9e5846259d82e4e6a07e82a036015d17bc7c0a560cf91ed4099791aaefd6a0e551123065eba1d5ce0d280733c16aa6e0f14869fcffe7375a7c43c906b45e26886e47102e499c9a2f4a97275624e6666b9b409b896bded7610d47460be53a3afb75fdc10e5204f5062ef3e1cf5113c72566de4f80f068c10d59c90250f4eb08a3485c3020ef48fdfa0f332528af815fd4ca56f1c362cc1daed51d7c9f8fe3dcbae2186978396a418b40900a65da58fcda3177bdd4d1de6b3177438650538b25cc77d0e514c5ea9df00d08f93ad5bb92000900097721f99ed31982405347d380420440894cd057e35ae5533ee5af356d76f03cb0ffb13a87dc4509a17492794d967681974748a36caa08434bec91ba252449624199c36d7876a3fc0a8008daa406405a5435e58d6822f242855d56e92ffe36f0a1a111bdd914a60eca465358ffabb07e2f83d423f819d409913bec430d7850af781db4090e6290ca2fb3c4b593db3fdbc731905bfe148e4e5bc253eb920d7b9521fc50cf20037d8eeed1e1317b4a5c3f73dc23a6bab225470adbc96fb0f276e52c0d046d100018cd284b6b9de6e153a2124bbd3ef7711900b0a702d70de15a2bd61daef920fd74e020aac4a477c9a40e5e0a8bc5354dcc1416df59a232510a163291f2133d9481a9016aa2add24d896d1f9b89cad76e3a56ae62ec96d454c2cdf5bd3304a08ca7d01e302926f27510826cc87be97186a331832d5415ee6e55c2e13858ba7050cf61308462cae16fa67305b1d3ef219a72f65f527338cfcff1a95943118071dbe4626d36fd0a95698b08333e3c08b012f44e129056c4d3c9c29139ecade113e112aa8056b24ab2abd0a6c5059098ffbed1136a65c511cd40574a31c43abf2ff7bc2fe93ba904c0f31fbbfb0d9e369d2d3b74b2a04c88226c92b63c63b35b013705ee4dbf29eff81f4987137599ae9c6a9740134d31c2098221ef3b7e2a94aff4b85f0c95d14dc273df1b2a3822a3ff5fe156af71ce9bd9ee97f39f4e634cd28f16de650bca52458aad4a4711eae00d4cc7b6d1b0fc02829ca47b2072679779ac8ba6f62e56c941b66d3c463f17848ff4089236c909620133ecde673ea6e72af8ca3981e6a889e2664f3ae7a712f6ba8d59c89c064ff4daea7fbfea37bb72c23b2cb3499725f37ac4108ae6399b04db672f13581c7c5a8195964c07e478c3d5051c95b2b519946b5a5b59e882900a8b2c245e972210d76f0c0e12309863091fa3aadba3634069280d9aab701751a2e2223a317d4024c8f307f3c15d0cbb774b333bf5cb15f93c33d2eac24a0097bb64d540971a2a023", 0x7fe, 0x0, 0x0, 0x0) r2 = socket(0x21, 0xa, 0x1) r3 = socket(0x10, 0x80002, 0x0) ioctl(r3, 0x1000008912, &(0x7f00000001c0)="080db5055e0bcfe8696071") getsockopt$inet_sctp_SCTP_PEER_AUTH_CHUNKS(r3, 0x84, 0x1a, &(0x7f0000000940)=ANY=[@ANYRES32=0x0, @ANYBLOB='\x00'/12], &(0x7f0000000980)=0x10) getsockopt$inet_sctp_SCTP_GET_PEER_ADDR_INFO(r2, 0x84, 0xf, &(0x7f00000009c0)={r4, @in6={{0xa, 0x4e21, 0x8, @local, 0x401}}, 0x9, 0x1, 0x7, 0x7f, 0x9}, &(0x7f0000000a80)=0x98) getsockopt$EBT_SO_GET_INFO(r2, 0x0, 0x80, &(0x7f0000000000)={'broute\x00'}, &(0x7f00000000c0)=0x78) sendto$inet(r0, &(0x7f0000000300)='8', 0xfffffffffffffe14, 0x0, 0x0, 0x0) recvmsg(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f0000003ac0)=""/4096, 0xffc}], 0x1}, 0x400100) [ 370.614430][T16372] device syz_tun left promiscuous mode [ 370.621882][T16372] bridge190: port 1(syz_tun) entered disabled state [ 370.750981][T16372] bridge191: port 1(syz_tun) entered blocking state [ 370.758081][T16372] bridge191: port 1(syz_tun) entered disabled state [ 370.766051][T16372] device syz_tun entered promiscuous mode [ 370.774075][T16378] netlink: 72 bytes leftover after parsing attributes in process `syz-executor.1'. [ 370.783744][T16380] device syz_tun left promiscuous mode [ 370.789504][T16380] bridge175: port 1(syz_tun) entered disabled state [ 370.907786][T16380] bridge176: port 1(syz_tun) entered blocking state [ 370.914611][T16380] bridge176: port 1(syz_tun) entered disabled state [ 370.927423][T16380] device syz_tun entered promiscuous mode [ 370.935665][T16381] device erspan0 left promiscuous mode [ 370.942782][T16381] bridge190: port 2(erspan0) entered disabled state [ 371.088709][T16381] bridge191: port 2(erspan0) entered blocking state [ 371.095469][T16381] bridge191: port 2(erspan0) entered disabled state [ 371.109810][T16381] device erspan0 entered promiscuous mode 15:24:13 executing program 3: r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x5, 0x0) accept$inet(0xffffffffffffffff, &(0x7f0000000280)={0x2, 0x0, @multicast1}, &(0x7f0000000500)=0x10) socket$inet_sctp(0x2, 0x1, 0x84) socketpair(0x1a, 0x0, 0x3, &(0x7f0000000540)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$sock_kcm_SIOCKCMCLONE(0xffffffffffffff9c, 0x89e2, &(0x7f0000002380)={r0}) r2 = accept4$inet(0xffffffffffffff9c, &(0x7f0000002540)={0x2, 0x0, @loopback}, &(0x7f0000002580)=0x10, 0x80000) setsockopt$inet_sctp_SCTP_ADAPTATION_LAYER(r2, 0x84, 0x7, 0x0, 0x4d) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cpu.stat\x00', 0x275a, 0x0) write$binfmt_script(r3, &(0x7f0000000040)=ANY=[], 0x7c774aac) mmap(&(0x7f0000a00000/0x600000)=nil, 0x600000, 0x300000a, 0x2011, r3, 0x0) mmap(&(0x7f0000a35000/0x400000)=nil, 0x400000, 0x1000006, 0x2011, r3, 0x0) r4 = socket$inet6(0xa, 0x3, 0x400000000006) ioctl(r4, 0x8912, &(0x7f0000000200)='\x00\x00\x00\x00\x00\x00\x00\x00\x00') unshare(0x40000000) r5 = socket$inet_tcp(0x2, 0x1, 0x0) ioctl$sock_inet_SIOCSIFFLAGS(r5, 0x8914, &(0x7f00000000c0)={'\x00', 0x101}) r6 = socket$inet(0x2, 0x4000000000000001, 0x0) r7 = accept(r6, &(0x7f0000002840)=@in6={0xa, 0x0, 0x0, @mcast2}, &(0x7f00000028c0)=0x80) shutdown(r7, 0x0) getsockopt$bt_rfcomm_RFCOMM_LM(r7, 0x12, 0x3, &(0x7f0000000440), &(0x7f0000002940)=0x4) ioctl$sock_inet_SIOCADDRT(r6, 0x890b, &(0x7f0000000000)={0x0, {0x2, 0x0, @loopback=0x7f004700}, {0x2, 0x0, @loopback}, {0x2, 0x0, @remote}, 0x27}) sendto$llc(r7, &(0x7f0000000100)="f970073b521a3a2059fcfb4e8ff5daaa892b23d0d93e42e29fd18b0a0ba812eee04266ea1e381a4bb2e397868f69542dd70dd9c732d82d1fb2fc114f477c5628dfd9882cb1704a9f32aac44aae8374041822b9186cf14d60459bd23b2cdfa2331560f6603715660f40eb2abb6eb4ac55a1b1b79c6b0cf8b2b9318c3851c8c082044b202dfddf065073e5b86df813839f8469d5e3897560064588b8857deb8aa08bb97eab5a3c887c75722b8f29c0676355437301c7bab02cae987fb632bc787275cc10ffa7d27aec6dde9675ce109785c50042c06113974ffe11fc8c778aa09dfb093bb384905f3b6b5899e819b4f5263cb840bd", 0xf4, 0x800, 0x0, 0x0) sendmsg$nl_route(r7, &(0x7f00000003c0)={&(0x7f0000000300)={0x10, 0x0, 0x0, 0x20000000}, 0xc, &(0x7f0000000380)={&(0x7f0000000340)=@ipv4_newrule={0x30, 0x20, 0x200, 0x70bd2d, 0x25dfdbff, {0x2, 0x20, 0xb4, 0xcf0, 0x0, 0x0, 0x0, 0x6, 0x10}, [@FRA_SRC={0x8, 0x2, @empty}, @FRA_FLOW={0x8, 0xb, 0x8}]}, 0x30}, 0x1, 0x0, 0x0, 0x4000000}, 0x0) accept4$vsock_stream(r7, &(0x7f0000000580)={0x28, 0x0, 0xffffffff}, 0x10, 0x100800) ioctl$sock_inet_SIOCSIFADDR(r1, 0x8916, &(0x7f00000005c0)={'netdevsim0\x00', {0x2, 0x4e20, @multicast1}}) ioctl$sock_inet_SIOCGIFADDR(r5, 0x8915, &(0x7f00000002c0)={'\x00', {0x2, 0x4e23, @multicast1}}) r8 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r8, &(0x7f0000000400)={0x0, 0x0, &(0x7f00008feff0)={&(0x7f0000000480)=ANY=[@ANYBLOB="02050000050000000002000100000000000000000000000000866ab6f58df1e1bdb6841ea5e3fd574c8845a2c9f509c84ecc4c2942464894b8e02b01ecc322db9c8a4aff33c0cb398fffcf67d591b03e8b4d85a13bd5cd4d059d504245be053f81209d"], 0x63}}, 0x0) setsockopt(r0, 0x53, 0x3a, &(0x7f0000000240)="01aeefef2d5883d4b1375b1f2c600b3abece185118e1d6987f223823a5915ea15e4a9f763a82cbeadee9732e73f16d76f369684839cf6039e1", 0x39) socket$nl_generic(0x10, 0x3, 0x10) write$binfmt_script(r0, &(0x7f0000000200)=ANY=[@ANYBLOB="2321202e2f66696c6530202d47504c366d6e6574314750cc70707030a874ef91205b62646576207d0a"], 0x29) setsockopt$inet6_tcp_TLS_RX(r3, 0x6, 0x2, &(0x7f0000000040), 0x4) setsockopt$inet_sctp_SCTP_FRAGMENT_INTERLEAVE(r6, 0x84, 0x12, &(0x7f0000000080)=0x6, 0x4) ioctl$EXT4_IOC_SWAP_BOOT(r3, 0x6611) bind$bt_l2cap(r0, &(0x7f0000000800)={0x1f, 0x0, {0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x4777}, 0x9, 0xfffffffffffffffe}, 0xe) ioctl$sock_bt_hidp_HIDPCONNADD(r3, 0x400448c8, &(0x7f0000000340)=ANY=[@ANYBLOB="0701eca20100070020abe1ff0000000099ed78c38a3f144de930d46ebd660ded192b0c62b9da357b5f9eb6c9e1"]) 15:24:13 executing program 5: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000340)={'erspan0\x00', 0x0}) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000300)={'syz_tun\x00', 0x0}) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r7, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r6, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000380)=@newlink={0x34, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r8}, [@IFLA_LINKINFO={0x14, 0x12, @bridge={{0xb, 0x1, 'bridge\x00'}, {0x4}}}]}, 0x34}}, 0x0) sendmsg$nl_route(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000002700)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r5}, [@IFLA_MASTER={0x8, 0xa, r8}]}, 0x28}}, 0x0) sendmsg$nl_route(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f00000000c0)=ANY=[@ANYBLOB="280000001000010400004000000000", @ANYRES32=r2, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00\b\x00\n\x00', @ANYRES32=r8], 0x4}}, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r10 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r9, 0x8933, &(0x7f0000000300)={'syz_tun\x00', 0x0}) sendmsg$nl_route(r10, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000040)=@newlink={0x2c, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r11}, [@IFLA_BROADCAST={0xa}]}, 0x332}}, 0x0) 15:24:13 executing program 2: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000340)={'erspan0\x00', 0x0}) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000300)={'syz_tun\x00', 0x0}) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r7, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r6, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000380)=@newlink={0x34, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r8}, [@IFLA_LINKINFO={0x14, 0x12, @bridge={{0xb, 0x1, 'bridge\x00'}, {0x4}}}]}, 0x34}}, 0x0) sendmsg$nl_route(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000002700)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r5}, [@IFLA_MASTER={0x8, 0xa, r8}]}, 0x28}}, 0x0) sendmsg$nl_route(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f00000000c0)=ANY=[@ANYBLOB="2800000010000104000040000000000000001ea6", @ANYRES32=r2, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00\b\x00\n\x00', @ANYRES32=r8], 0x28}}, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)) r9 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000300)={'syz_tun\x00', 0x0}) sendmsg$nl_route(r9, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000040)=@newlink={0x2c, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r10}, [@IFLA_BROADCAST={0xa}]}, 0x332}}, 0x0) 15:24:13 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000004c0)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r3, @ANYBLOB="0000000000000000280012000c0001007665746800000000180002001400010000000000", @ANYRES32=0x0, @ANYBLOB="00000000008433df6d6f6b577d4eaaf2000007"], 0x48}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000540)=ANY=[@ANYBLOB="7400000024000705000000000000000000010000", @ANYRES32=r3, @ANYBLOB="00000000ffffffff000000000800010073667100486818973f73461919309b68e1693572bb000229c6090032d0ed64f3c3545aaf6e000085a4e4ebb5ef670000000000000000000000000000001a4e624d29a84abf03265700000000000000000000000000000000000000000000000000000000000000ac20000089b53c947244306a0216a3de887763df5b42498b13bb1938de859ee6d7ae7dd2224dc672b69b4358871b170ea0b667832e5224ee3538f885b7abd9bc4a7d"], 0x74}}, 0x0) r4 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r4, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000300)=ANY=[@ANYBLOB="840000002c00010700"/20, @ANYRES32=r3, @ANYBLOB="0008008000000000030000000800010075333200580002001400050000000000000000000000000000000000400006003c0001000000000000001020898dde66057433b6ef3a41d22be225e0001b0000000000000000000000000017256ffc66e43a2484e1a912c5998bcbf0d0000000000000000000000000000000798a3c067277da1a290b9613a33c575c36fad473382c8f5532ef3f0e1d2c450a7decbf3431a69f9b2ecb3291bed174245a962fe0484676958265e2988326a89db3139d91fe4aee6ae7e745ab00001a9f61f20500000000000000b3958bc14fce6e66a36d1ab3194534ba4e973684b27793bff837d3"], 0x84}}, 0x0) r5 = socket(0x10, 0x80002, 0x0) sendmmsg$alg(r5, &(0x7f0000000140), 0x49249249249278c, 0x0) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r6, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000500)=@newlink={0x20, 0x11, 0x40d, 0x0, 0x0, {0x0, 0x0, 0x0, r8}}, 0x20}}, 0x0) r9 = socket(0x10, 0x80002, 0x0) getsockopt$inet_sctp_SCTP_PEER_AUTH_CHUNKS(0xffffffffffffffff, 0x84, 0x1a, &(0x7f0000000940)=ANY=[@ANYRES32=0x0, @ANYBLOB='\x00'/12], &(0x7f0000000980)=0x10) r10 = socket(0xa, 0x6, 0x0) close(r10) r11 = socket$inet6_sctp(0xa, 0x10000000005, 0x84) setsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX(r11, 0x84, 0x6e, &(0x7f0000000180)=[@in6={0xa, 0x0, 0x0, @remote, 0x9}], 0x1c) getsockopt$inet_sctp6_SCTP_GET_ASSOC_ID_LIST(r11, 0x84, 0x1d, &(0x7f000095dff8)={0x1, [0x0]}, &(0x7f000095dffc)=0x8) setsockopt$inet_sctp_SCTP_RTOINFO(r10, 0x84, 0x0, &(0x7f0000000000)={r12, 0x0, 0x0, 0x1000000}, 0x10) setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(0xffffffffffffffff, 0x84, 0x9, &(0x7f0000000680)={r12, @in={{0x2, 0x4e20, @remote}}, 0x10001, 0xfff7, 0x5, 0x1, 0x8, 0x5, 0xba}, 0x9c) ioctl(r9, 0x1000008912, &(0x7f00000001c0)="080db5055e0bcfe8696071") getsockopt$inet_sctp_SCTP_PEER_AUTH_CHUNKS(r9, 0x84, 0x1a, &(0x7f0000000940)=ANY=[@ANYRES32=0x0, @ANYBLOB='\x00'/12], &(0x7f0000000980)=0x10) r13 = socket$nl_generic(0x10, 0x3, 0x10) r14 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080)='nl80211\x00') r15 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL80211_CMD_GET_STATION(r15, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000240)={0x1c, r14, 0xf2b, 0x0, 0x0, {}, [@NL80211_ATTR_AIRTIME_WEIGHT={0x8}]}, 0x1c}}, 0x0) sendmsg$NL80211_CMD_GET_MPATH(r13, &(0x7f00000001c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x2000}, 0x268, &(0x7f0000000080)={&(0x7f0000000200)={0x40, r14, 0x4, 0x70bd2d, 0x25dfdbff}, 0xff6b}, 0x1, 0x0, 0x0, 0x10049050}, 0x260448c0) sendmsg$NL80211_CMD_NEW_KEY(r9, &(0x7f0000000640)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0xb0024000}, 0xc, &(0x7f00000002c0)={&(0x7f0000000440)={0x7c, r14, 0x23, 0x70bd27, 0x25dfdbff, {}, [@NL80211_ATTR_KEY_DATA_WEP40={0x9, 0x7, "a80875ab12"}, @NL80211_ATTR_KEY={0x5c, 0x50, [@NL80211_KEY_DEFAULT_TYPES={0x14, 0x8, [@NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_MULTICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_MULTICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_MULTICAST={0x4}]}, @NL80211_KEY_DEFAULT_TYPES={0x28, 0x8, [@NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_MULTICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_MULTICAST={0x4}]}, @NL80211_KEY_IDX={0x5, 0x2, 0x5}, @NL80211_KEY_DATA_WEP104={0x11, 0x1, "4d84c4e30151cb27f51a4adf63"}]}]}, 0x7c}, 0x1, 0x0, 0x0, 0x24000}, 0x40) 15:24:13 executing program 4: r0 = socket$inet6(0xa, 0x80003, 0x6b) ioctl(r0, 0x1000008912, &(0x7f00000001c0)="080db5055e0bcfe8476071") r1 = socket(0x10, 0x2, 0x0) sendto(r1, &(0x7f0000000200), 0x0, 0x0, 0x0, 0x0) recvmmsg(r1, &(0x7f00000037c0)=[{{&(0x7f0000000600)=@ethernet={0x0, @random}, 0x80, &(0x7f0000000380)=[{&(0x7f0000000040)=""/95, 0x2000007d}, {&(0x7f00000000c0)=""/85, 0x1f3}, {&(0x7f00000024c0)=""/4096, 0x1048}, {&(0x7f0000000400)=""/120, 0x1aa}, {&(0x7f0000000480)=""/60, 0xc6}, {&(0x7f0000000280)=""/77, 0x4d}, {&(0x7f0000000540)=""/154, 0x207}, {&(0x7f0000000340)=""/22, 0x1de}], 0x8, &(0x7f0000002400)=""/191, 0xfffffffffffffea2}}], 0x4000000000001de, 0x6, &(0x7f0000003700)={0x77359400}) 15:24:13 executing program 0: r0 = socket(0x21, 0xa, 0x1) r1 = socket(0x10, 0x80002, 0x0) ioctl(r1, 0x1000008912, &(0x7f00000001c0)="080db5055e0bcfe8696071") getsockopt$inet_sctp_SCTP_PEER_AUTH_CHUNKS(r1, 0x84, 0x1a, &(0x7f0000000940)=ANY=[@ANYRES32=0x0, @ANYBLOB='\x00'/12], &(0x7f0000000980)=0x10) getsockopt$inet_sctp_SCTP_GET_PEER_ADDR_INFO(r0, 0x84, 0xf, &(0x7f00000009c0)={r2, @in6={{0xa, 0x4e21, 0x8, @local, 0x401}}, 0x9, 0x1, 0x7, 0x7f, 0x6}, &(0x7f0000000a80)=0x98) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000400)='nl80211\x00') sendmsg$NL80211_CMD_GET_MESH_CONFIG(r0, &(0x7f0000000580)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x103190}, 0xc, &(0x7f0000000540)={&(0x7f0000000500)={0x34, r3, 0x10, 0x70bd2d, 0x25dfdbfe, {}, [@NL80211_ATTR_WDEV={0xc, 0x99, {0x1, 0xffffffffffffffff}}, @NL80211_ATTR_WIPHY={0x8, 0x1, 0x1}, @NL80211_ATTR_WDEV={0xc, 0x99, {0x3f, 0x3}}]}, 0x34}, 0x1, 0x0, 0x0, 0x800}, 0x0) r4 = socket$nl_generic(0x10, 0x3, 0x10) bind$netlink(r4, &(0x7f0000000000)={0x10, 0x0, 0x25dfdbff, 0x1004280}, 0xffffffffffffffb3) sendmsg$nl_generic(r4, &(0x7f0000000080)={&(0x7f0000000480)={0x10, 0xbb7f}, 0xc, &(0x7f0000000440)={&(0x7f00000004c0)={0x1c, 0x22, 0x1, 0x0, 0x0, {0x4}, [@typed={0x8, 0xc}]}, 0x1c}}, 0x0) socket$netlink(0x10, 0x3, 0x0) r5 = socket$alg(0x26, 0x5, 0x0) bind$alg(r5, &(0x7f0000000080)={0x26, 'hash\x00', 0x0, 0x0, 'sha512\x00'}, 0x58) [ 371.402270][T16408] device syz_tun left promiscuous mode [ 371.412810][T16408] bridge176: port 1(syz_tun) entered disabled state [ 371.577927][T16408] bridge177: port 1(syz_tun) entered blocking state [ 371.585287][T16408] bridge177: port 1(syz_tun) entered disabled state [ 371.596465][T16408] device syz_tun entered promiscuous mode [ 371.619912][T16413] device syz_tun left promiscuous mode [ 371.633748][T16425] IPVS: ftp: loaded support on port[0] = 21 [ 371.634052][T16413] bridge191: port 1(syz_tun) entered disabled state [ 371.767907][T16413] bridge192: port 1(syz_tun) entered blocking state [ 371.777462][T16413] bridge192: port 1(syz_tun) entered disabled state [ 371.795950][T16413] device syz_tun entered promiscuous mode 15:24:13 executing program 5: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000340)={'erspan0\x00', 0x0}) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000300)={'syz_tun\x00', 0x0}) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r7, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r6, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000380)=@newlink={0x34, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r8}, [@IFLA_LINKINFO={0x14, 0x12, @bridge={{0xb, 0x1, 'bridge\x00'}, {0x4}}}]}, 0x34}}, 0x0) sendmsg$nl_route(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000002700)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r5}, [@IFLA_MASTER={0x8, 0xa, r8}]}, 0x28}}, 0x0) sendmsg$nl_route(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f00000000c0)=ANY=[@ANYBLOB="280000001000010400004000000000000000", @ANYRES32=r2, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00\b\x00\n\x00', @ANYRES32=r8], 0x4}}, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r10 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r9, 0x8933, &(0x7f0000000300)={'syz_tun\x00', 0x0}) sendmsg$nl_route(r10, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000040)=@newlink={0x2c, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r11}, [@IFLA_BROADCAST={0xa}]}, 0x332}}, 0x0) [ 371.824183][T16417] device erspan0 left promiscuous mode [ 371.847339][T16417] bridge191: port 2(erspan0) entered disabled state [ 371.977870][T16417] bridge192: port 2(erspan0) entered blocking state [ 371.984769][T16417] bridge192: port 2(erspan0) entered disabled state [ 371.993036][T16417] device erspan0 entered promiscuous mode [ 372.001681][T16418] netlink: 72 bytes leftover after parsing attributes in process `syz-executor.1'. 15:24:14 executing program 2: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000340)={'erspan0\x00', 0x0}) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000300)={'syz_tun\x00', 0x0}) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r7, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r6, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000380)=@newlink={0x34, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r8}, [@IFLA_LINKINFO={0x14, 0x12, @bridge={{0xb, 0x1, 'bridge\x00'}, {0x4}}}]}, 0x34}}, 0x0) sendmsg$nl_route(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000002700)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r5}, [@IFLA_MASTER={0x8, 0xa, r8}]}, 0x28}}, 0x0) sendmsg$nl_route(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f00000000c0)=ANY=[@ANYBLOB="2800000010000104000040000000000000001ea6", @ANYRES32=r2, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00\b\x00\n\x00', @ANYRES32=r8], 0x28}}, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r10 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r9, 0x8933, 0x0) sendmsg$nl_route(r10, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000040)=@newlink={0x2c, 0x10, 0x401, 0x0, 0x0, {}, [@IFLA_BROADCAST={0xa}]}, 0x332}}, 0x0) [ 372.023032][T16421] netlink: 72 bytes leftover after parsing attributes in process `syz-executor.1'. [ 372.044430][T16441] device syz_tun left promiscuous mode [ 372.050683][T16441] bridge177: port 1(syz_tun) entered disabled state [ 372.157874][T16441] bridge178: port 1(syz_tun) entered blocking state [ 372.164753][T16441] bridge178: port 1(syz_tun) entered disabled state [ 372.177862][T16441] device syz_tun entered promiscuous mode [ 372.200603][T16446] device syz_tun left promiscuous mode 15:24:14 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000004c0)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r3, @ANYBLOB="0000000000000000280012000c0001007665746800000000180002001400010000000000", @ANYRES32=0x0, @ANYBLOB="00000000008433df6d6f6b577d4eaaf2000007"], 0x48}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000540)=ANY=[@ANYBLOB="7400000024000705000000000000000000010000", @ANYRES32=r3, @ANYBLOB="00000000ffffffff000000000800010073667100486818973f73461919309b68e1693572bb000229c6090032d0ed64f3c3545aaf6e000085a4e4ebb5ef670000000000000000000000000000001a4e624d29a84abf03265700000000000000000000000000000000000000000000000000000000000000ac20000089b53c947244306a0216a3de887763df5b42498b13bb1938de859ee6d7ae7dd2224dc672b69b4358871b170ea0b667832e5224ee3538f885b7abd9bc4a7d"], 0x74}}, 0x0) r4 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r4, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000300)=ANY=[@ANYBLOB="840000002c00010700"/20, @ANYRES32=r3, @ANYBLOB="0008008000000000030000000800010075333200580002001400050000000000000000000000000000000000400006003c0001000000000000001020898dde66057433b6ef3a41d22be225e0001b0000000000000000000000000017256ffc66e43a2484e1a912c5998bcbf0d0000000000000000000000000000000798a3c067277da1a290b9613a33c575c36fad473382c8f5532ef3f0e1d2c450a7decbf3431a69f9b2ecb3291bed174245a962fe0484676958265e2988326a89db3139d91fe4aee6ae7e745ab00001a9f61f20500000000000000b3958bc14fce6e66a36d1ab3194534ba4e973684b27793bff837d3"], 0x84}}, 0x0) r5 = socket(0x10, 0x80002, 0x0) sendmmsg$alg(r5, &(0x7f0000000140), 0x49249249249278c, 0x0) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r6, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000500)=@newlink={0x20, 0x11, 0x40d, 0x0, 0x0, {0x0, 0x0, 0x0, r8}}, 0x20}}, 0x0) r9 = socket(0x10, 0x80002, 0x0) getsockopt$inet_sctp_SCTP_PEER_AUTH_CHUNKS(0xffffffffffffffff, 0x84, 0x1a, &(0x7f0000000940)=ANY=[@ANYRES32=0x0, @ANYBLOB='\x00'/12], &(0x7f0000000980)=0x10) r10 = socket(0xa, 0x6, 0x0) close(r10) r11 = socket$inet6_sctp(0xa, 0x10000000005, 0x84) setsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX(r11, 0x84, 0x6e, &(0x7f0000000180)=[@in6={0xa, 0x0, 0x0, @remote, 0x9}], 0x1c) getsockopt$inet_sctp6_SCTP_GET_ASSOC_ID_LIST(r11, 0x84, 0x1d, &(0x7f000095dff8)={0x1, [0x0]}, &(0x7f000095dffc)=0x8) setsockopt$inet_sctp_SCTP_RTOINFO(r10, 0x84, 0x0, &(0x7f0000000000)={r12, 0x0, 0x0, 0x1000000}, 0x10) setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(0xffffffffffffffff, 0x84, 0x9, &(0x7f0000000680)={r12, @in={{0x2, 0x4e20, @remote}}, 0x10001, 0xfff7, 0x5, 0x1, 0x8, 0x5, 0xba}, 0x9c) ioctl(r9, 0x1000008912, &(0x7f00000001c0)="080db5055e0bcfe8696071") getsockopt$inet_sctp_SCTP_PEER_AUTH_CHUNKS(r9, 0x84, 0x1a, &(0x7f0000000940)=ANY=[@ANYRES32=0x0, @ANYBLOB='\x00'/12], &(0x7f0000000980)=0x10) r13 = socket$nl_generic(0x10, 0x3, 0x10) r14 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080)='nl80211\x00') r15 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL80211_CMD_GET_STATION(r15, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000240)={0x1c, r14, 0xf2b, 0x0, 0x0, {}, [@NL80211_ATTR_AIRTIME_WEIGHT={0x8}]}, 0x1c}}, 0x0) sendmsg$NL80211_CMD_GET_MPATH(r13, &(0x7f00000001c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x2000}, 0x268, &(0x7f0000000080)={&(0x7f0000000200)={0x40, r14, 0x4, 0x70bd2d, 0x25dfdbff}, 0xff6b}, 0x1, 0x0, 0x0, 0x10049050}, 0x260448c0) sendmsg$NL80211_CMD_NEW_KEY(r9, &(0x7f0000000640)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0xb0024000}, 0xc, &(0x7f00000002c0)={&(0x7f0000000440)={0x7c, r14, 0x23, 0x70bd27, 0x25dfdbff, {}, [@NL80211_ATTR_KEY_DATA_WEP40={0x9, 0x7, "a80875ab12"}, @NL80211_ATTR_KEY={0x5c, 0x50, [@NL80211_KEY_DEFAULT_TYPES={0x14, 0x8, [@NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_MULTICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_MULTICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_MULTICAST={0x4}]}, @NL80211_KEY_DEFAULT_TYPES={0x28, 0x8, [@NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_MULTICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_MULTICAST={0x4}]}, @NL80211_KEY_IDX={0x5, 0x2, 0x5}, @NL80211_KEY_DATA_WEP104={0x11, 0x1, "4d84c4e30151cb27f51a4adf63"}]}]}, 0x7c}, 0x1, 0x0, 0x0, 0x24000}, 0x40) [ 372.206582][T16446] bridge192: port 1(syz_tun) entered disabled state 15:24:14 executing program 4: r0 = socket$inet6(0xa, 0x80003, 0x6b) ioctl(r0, 0x1000008912, &(0x7f00000001c0)="080db5055e0bcfe8476071") r1 = socket(0x10, 0x2, 0x0) sendto(r1, &(0x7f0000000200)="120000001200e7ef00", 0x9, 0x0, 0x0, 0x0) recvmmsg(r1, &(0x7f00000037c0)=[{{&(0x7f0000000600)=@ethernet={0x0, @random}, 0x80, &(0x7f0000000380)=[{&(0x7f0000000040)=""/95, 0x2000007d}, {&(0x7f00000000c0)=""/85, 0x1f3}, {&(0x7f00000024c0)=""/4096, 0x1048}, {&(0x7f0000000400)=""/120, 0x1aa}, {&(0x7f0000000480)=""/60, 0xc6}, {&(0x7f0000000280)=""/77, 0x4d}, {&(0x7f0000000540)=""/154, 0x207}, {&(0x7f0000000340)=""/22, 0x1de}], 0x8, &(0x7f0000002400)=""/191, 0xfffffffffffffea2}}], 0x4000000000001de, 0x6, &(0x7f0000003700)={0x77359400}) 15:24:14 executing program 0: r0 = socket(0x21, 0xa, 0x1) r1 = socket(0x10, 0x80002, 0x0) ioctl(r1, 0x1000008912, &(0x7f00000001c0)="080db5055e0bcfe8696071") getsockopt$inet_sctp_SCTP_PEER_AUTH_CHUNKS(r1, 0x84, 0x1a, &(0x7f0000000940)=ANY=[@ANYRES32=0x0, @ANYBLOB='\x00'/12], &(0x7f0000000980)=0x10) getsockopt$inet_sctp_SCTP_GET_PEER_ADDR_INFO(r0, 0x84, 0xf, &(0x7f00000009c0)={r2, @in6={{0xa, 0x4e21, 0x8, @local, 0x401}}, 0x9, 0x1, 0x7, 0x7f, 0x6}, &(0x7f0000000a80)=0x98) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000400)='nl80211\x00') sendmsg$NL80211_CMD_GET_MESH_CONFIG(r0, &(0x7f0000000580)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x103190}, 0xc, &(0x7f0000000540)={&(0x7f0000000500)={0x34, r3, 0x10, 0x70bd2d, 0x25dfdbfe, {}, [@NL80211_ATTR_WDEV={0xc, 0x99, {0x1, 0xffffffffffffffff}}, @NL80211_ATTR_WIPHY={0x8, 0x1, 0x1}, @NL80211_ATTR_WDEV={0xc, 0x99, {0x3f, 0x3}}]}, 0x34}, 0x1, 0x0, 0x0, 0x800}, 0x0) r4 = socket$nl_generic(0x10, 0x3, 0x10) bind$netlink(r4, &(0x7f0000000000)={0x10, 0x0, 0x25dfdbff, 0x1004280}, 0xffffffffffffffb3) sendmsg$nl_generic(r4, &(0x7f0000000080)={&(0x7f0000000480)={0x10, 0xbb7f}, 0xc, &(0x7f0000000440)={&(0x7f00000004c0)={0x1c, 0x22, 0x1, 0x0, 0x0, {0x4}, [@typed={0x8, 0xc}]}, 0x1c}}, 0x0) socket$netlink(0x10, 0x3, 0x0) r5 = socket$alg(0x26, 0x5, 0x0) bind$alg(r5, &(0x7f0000000080)={0x26, 'hash\x00', 0x0, 0x0, 'sha512\x00'}, 0x58) 15:24:14 executing program 5: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000340)={'erspan0\x00', 0x0}) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000300)={'syz_tun\x00', 0x0}) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r7, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r6, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000380)=@newlink={0x34, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r8}, [@IFLA_LINKINFO={0x14, 0x12, @bridge={{0xb, 0x1, 'bridge\x00'}, {0x4}}}]}, 0x34}}, 0x0) sendmsg$nl_route(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000002700)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r5}, [@IFLA_MASTER={0x8, 0xa, r8}]}, 0x28}}, 0x0) sendmsg$nl_route(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f00000000c0)=ANY=[@ANYBLOB="280000001000010400004000000000000000", @ANYRES32=r2, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00\b\x00\n\x00', @ANYRES32=r8], 0x4}}, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r10 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r9, 0x8933, &(0x7f0000000300)={'syz_tun\x00', 0x0}) sendmsg$nl_route(r10, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000040)=@newlink={0x2c, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r11}, [@IFLA_BROADCAST={0xa}]}, 0x332}}, 0x0) [ 372.338762][T16446] bridge193: port 1(syz_tun) entered blocking state [ 372.367838][T16446] bridge193: port 1(syz_tun) entered disabled state [ 372.406441][T16446] device syz_tun entered promiscuous mode [ 372.508709][T16445] device erspan0 left promiscuous mode [ 372.514418][T16445] bridge192: port 2(erspan0) entered disabled state [ 372.707836][T16445] bridge193: port 2(erspan0) entered blocking state [ 372.717365][T16445] bridge193: port 2(erspan0) entered disabled state [ 372.733557][T16445] device erspan0 entered promiscuous mode [ 372.768520][T16460] netlink: 72 bytes leftover after parsing attributes in process `syz-executor.1'. [ 372.860692][T16464] netlink: 72 bytes leftover after parsing attributes in process `syz-executor.1'. [ 372.898043][T16466] device syz_tun left promiscuous mode [ 372.903715][T16466] bridge178: port 1(syz_tun) entered disabled state [ 373.117807][T16466] bridge179: port 1(syz_tun) entered blocking state [ 373.124878][T16466] bridge179: port 1(syz_tun) entered disabled state [ 373.142799][T16466] device syz_tun entered promiscuous mode 15:24:15 executing program 3: r0 = socket(0x1000000010, 0x80003, 0x0) bind$x25(r0, &(0x7f00000000c0)={0x9, @remote={[], 0x2}}, 0x12) setsockopt(r0, 0x6, 0x2, &(0x7f0000000000)="d601336919d6846a715efa21b54d6ed14ae85748d9ff5bb01e037727c984be60a6f19e2d2e2e09bcf9c45a0727731b331f625c93d955fad248e1021b863027da8effe9420c4b8464d37c53e15e1a45ce67255197b5de8de6398bcf78f3e186092063564dcb60b792c98250992a3f91ea4c98e82f0d7b188f902be4f1e904cc0d3a9e9513cd", 0x85) sendmsg$nl_generic(r0, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000400)={&(0x7f0000000200)={0x1c, 0x2e, 0x1, 0x0, 0x0, {0x3}, [@typed={0x4}, @nested={0x4}]}, 0x1c}}, 0x40050d1) 15:24:15 executing program 2: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000340)={'erspan0\x00', 0x0}) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000300)={'syz_tun\x00', 0x0}) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r7, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r6, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000380)=@newlink={0x34, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r8}, [@IFLA_LINKINFO={0x14, 0x12, @bridge={{0xb, 0x1, 'bridge\x00'}, {0x4}}}]}, 0x34}}, 0x0) sendmsg$nl_route(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000002700)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r5}, [@IFLA_MASTER={0x8, 0xa, r8}]}, 0x28}}, 0x0) sendmsg$nl_route(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f00000000c0)=ANY=[@ANYBLOB="2800000010000104000040000000000000001ea6", @ANYRES32=r2, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00\b\x00\n\x00', @ANYRES32=r8], 0x28}}, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r10 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r9, 0x8933, 0x0) sendmsg$nl_route(r10, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000040)=@newlink={0x2c, 0x10, 0x401, 0x0, 0x0, {}, [@IFLA_BROADCAST={0xa}]}, 0x332}}, 0x0) 15:24:15 executing program 0: r0 = socket(0x21, 0xa, 0x1) r1 = socket(0x10, 0x80002, 0x0) ioctl(r1, 0x1000008912, &(0x7f00000001c0)="080db5055e0bcfe8696071") getsockopt$inet_sctp_SCTP_PEER_AUTH_CHUNKS(r1, 0x84, 0x1a, &(0x7f0000000940)=ANY=[@ANYRES32=0x0, @ANYBLOB='\x00'/12], &(0x7f0000000980)=0x10) getsockopt$inet_sctp_SCTP_GET_PEER_ADDR_INFO(r0, 0x84, 0xf, &(0x7f00000009c0)={r2, @in6={{0xa, 0x4e21, 0x8, @local, 0x401}}, 0x9, 0x1, 0x7, 0x7f, 0x6}, &(0x7f0000000a80)=0x98) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000400)='nl80211\x00') sendmsg$NL80211_CMD_GET_MESH_CONFIG(r0, &(0x7f0000000580)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x103190}, 0xc, &(0x7f0000000540)={&(0x7f0000000500)={0x34, r3, 0x10, 0x70bd2d, 0x25dfdbfe, {}, [@NL80211_ATTR_WDEV={0xc, 0x99, {0x1, 0xffffffffffffffff}}, @NL80211_ATTR_WIPHY={0x8, 0x1, 0x1}, @NL80211_ATTR_WDEV={0xc, 0x99, {0x3f, 0x3}}]}, 0x34}, 0x1, 0x0, 0x0, 0x800}, 0x0) r4 = socket$nl_generic(0x10, 0x3, 0x10) bind$netlink(r4, &(0x7f0000000000)={0x10, 0x0, 0x25dfdbff, 0x1004280}, 0xffffffffffffffb3) sendmsg$nl_generic(r4, &(0x7f0000000080)={&(0x7f0000000480)={0x10, 0xbb7f}, 0xc, &(0x7f0000000440)={&(0x7f00000004c0)={0x1c, 0x22, 0x1, 0x0, 0x0, {0x4}, [@typed={0x8, 0xc}]}, 0x1c}}, 0x0) socket$netlink(0x10, 0x3, 0x0) r5 = socket$alg(0x26, 0x5, 0x0) bind$alg(r5, &(0x7f0000000080)={0x26, 'hash\x00', 0x0, 0x0, 'sha512\x00'}, 0x58) 15:24:15 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000004c0)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r3, @ANYBLOB="0000000000000000280012000c0001007665746800000000180002001400010000000000", @ANYRES32=0x0, @ANYBLOB="00000000008433df6d6f6b577d4eaaf2000007"], 0x48}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000540)=ANY=[@ANYBLOB="7400000024000705000000000000000000010000", @ANYRES32=r3, @ANYBLOB="00000000ffffffff000000000800010073667100486818973f73461919309b68e1693572bb000229c6090032d0ed64f3c3545aaf6e000085a4e4ebb5ef670000000000000000000000000000001a4e624d29a84abf03265700000000000000000000000000000000000000000000000000000000000000ac20000089b53c947244306a0216a3de887763df5b42498b13bb1938de859ee6d7ae7dd2224dc672b69b4358871b170ea0b667832e5224ee3538f885b7abd9bc4a7d"], 0x74}}, 0x0) r4 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r4, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000300)=ANY=[@ANYBLOB="840000002c00010700"/20, @ANYRES32=r3, @ANYBLOB="0008008000000000030000000800010075333200580002001400050000000000000000000000000000000000400006003c0001000000000000001020898dde66057433b6ef3a41d22be225e0001b0000000000000000000000000017256ffc66e43a2484e1a912c5998bcbf0d0000000000000000000000000000000798a3c067277da1a290b9613a33c575c36fad473382c8f5532ef3f0e1d2c450a7decbf3431a69f9b2ecb3291bed174245a962fe0484676958265e2988326a89db3139d91fe4aee6ae7e745ab00001a9f61f20500000000000000b3958bc14fce6e66a36d1ab3194534ba4e973684b27793bff837d3"], 0x84}}, 0x0) r5 = socket(0x10, 0x80002, 0x0) sendmmsg$alg(r5, &(0x7f0000000140), 0x49249249249278c, 0x0) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r6, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000500)=@newlink={0x20, 0x11, 0x40d, 0x0, 0x0, {0x0, 0x0, 0x0, r8}}, 0x20}}, 0x0) r9 = socket(0x10, 0x80002, 0x0) getsockopt$inet_sctp_SCTP_PEER_AUTH_CHUNKS(0xffffffffffffffff, 0x84, 0x1a, &(0x7f0000000940)=ANY=[@ANYRES32=0x0, @ANYBLOB='\x00'/12], &(0x7f0000000980)=0x10) r10 = socket(0xa, 0x6, 0x0) close(r10) r11 = socket$inet6_sctp(0xa, 0x10000000005, 0x84) setsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX(r11, 0x84, 0x6e, &(0x7f0000000180)=[@in6={0xa, 0x0, 0x0, @remote, 0x9}], 0x1c) getsockopt$inet_sctp6_SCTP_GET_ASSOC_ID_LIST(r11, 0x84, 0x1d, &(0x7f000095dff8)={0x1, [0x0]}, &(0x7f000095dffc)=0x8) setsockopt$inet_sctp_SCTP_RTOINFO(r10, 0x84, 0x0, &(0x7f0000000000)={r12, 0x0, 0x0, 0x1000000}, 0x10) setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(0xffffffffffffffff, 0x84, 0x9, &(0x7f0000000680)={r12, @in={{0x2, 0x4e20, @remote}}, 0x10001, 0xfff7, 0x5, 0x1, 0x8, 0x5, 0xba}, 0x9c) ioctl(r9, 0x1000008912, &(0x7f00000001c0)="080db5055e0bcfe8696071") getsockopt$inet_sctp_SCTP_PEER_AUTH_CHUNKS(r9, 0x84, 0x1a, &(0x7f0000000940)=ANY=[@ANYRES32=0x0, @ANYBLOB='\x00'/12], &(0x7f0000000980)=0x10) r13 = socket$nl_generic(0x10, 0x3, 0x10) r14 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080)='nl80211\x00') r15 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL80211_CMD_GET_STATION(r15, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000240)={0x1c, r14, 0xf2b, 0x0, 0x0, {}, [@NL80211_ATTR_AIRTIME_WEIGHT={0x8}]}, 0x1c}}, 0x0) sendmsg$NL80211_CMD_GET_MPATH(r13, &(0x7f00000001c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x2000}, 0x268, &(0x7f0000000080)={&(0x7f0000000200)={0x40, r14, 0x4, 0x70bd2d, 0x25dfdbff}, 0xff6b}, 0x1, 0x0, 0x0, 0x10049050}, 0x260448c0) sendmsg$NL80211_CMD_NEW_KEY(r9, &(0x7f0000000640)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0xb0024000}, 0xc, &(0x7f00000002c0)={&(0x7f0000000440)={0x7c, r14, 0x23, 0x70bd27, 0x25dfdbff, {}, [@NL80211_ATTR_KEY_DATA_WEP40={0x9, 0x7, "a80875ab12"}, @NL80211_ATTR_KEY={0x5c, 0x50, [@NL80211_KEY_DEFAULT_TYPES={0x14, 0x8, [@NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_MULTICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_MULTICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_MULTICAST={0x4}]}, @NL80211_KEY_DEFAULT_TYPES={0x28, 0x8, [@NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_MULTICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_MULTICAST={0x4}]}, @NL80211_KEY_IDX={0x5, 0x2, 0x5}, @NL80211_KEY_DATA_WEP104={0x11, 0x1, "4d84c4e30151cb27f51a4adf63"}]}]}, 0x7c}, 0x1, 0x0, 0x0, 0x24000}, 0x40) 15:24:15 executing program 5: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000340)={'erspan0\x00', 0x0}) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000300)={'syz_tun\x00', 0x0}) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r7, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r6, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000380)=@newlink={0x34, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r8}, [@IFLA_LINKINFO={0x14, 0x12, @bridge={{0xb, 0x1, 'bridge\x00'}, {0x4}}}]}, 0x34}}, 0x0) sendmsg$nl_route(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000002700)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r5}, [@IFLA_MASTER={0x8, 0xa, r8}]}, 0x28}}, 0x0) sendmsg$nl_route(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f00000000c0)=ANY=[@ANYBLOB="280000001000010400004000000000000000", @ANYRES32=r2, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00\b\x00\n\x00', @ANYRES32=r8], 0x4}}, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r10 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r9, 0x8933, &(0x7f0000000300)={'syz_tun\x00', 0x0}) sendmsg$nl_route(r10, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000040)=@newlink={0x2c, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r11}, [@IFLA_BROADCAST={0xa}]}, 0x332}}, 0x0) 15:24:15 executing program 4: r0 = socket$inet6(0xa, 0x80003, 0x6b) ioctl(r0, 0x1000008912, &(0x7f00000001c0)="080db5055e0bcfe8476071") r1 = socket(0x10, 0x2, 0x0) sendto(r1, &(0x7f0000000200)="120000001200e7ef00", 0x9, 0x0, 0x0, 0x0) recvmmsg(r1, &(0x7f00000037c0)=[{{&(0x7f0000000600)=@ethernet={0x0, @random}, 0x80, &(0x7f0000000380)=[{&(0x7f0000000040)=""/95, 0x2000007d}, {&(0x7f00000000c0)=""/85, 0x1f3}, {&(0x7f00000024c0)=""/4096, 0x1048}, {&(0x7f0000000400)=""/120, 0x1aa}, {&(0x7f0000000480)=""/60, 0xc6}, {&(0x7f0000000280)=""/77, 0x4d}, {&(0x7f0000000540)=""/154, 0x207}, {&(0x7f0000000340)=""/22, 0x1de}], 0x8, &(0x7f0000002400)=""/191, 0xfffffffffffffea2}}], 0x4000000000001de, 0x6, &(0x7f0000003700)={0x77359400}) [ 373.997443][T16484] device syz_tun left promiscuous mode [ 374.003367][T16484] bridge193: port 1(syz_tun) entered disabled state 15:24:16 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000200)=ANY=[@ANYBLOB="4400000010cf83ac914a5100010600000000f20000cc0ca3a42c0c920aa59e3ab764d4c03e7115a8ffae82bc1c7cdcde0ab7012dfef71c08d456fd92ca0586af259d2b6452d87ad2708b91df633c7f7032b8c97febdd02ad85714167", @ANYRES32=0x0, @ANYBLOB="000000000000000024001a8020000a800500080000000000140007000000e5ffffff00000000000000000001"], 0x44}}, 0x0) setsockopt$netlink_NETLINK_DROP_MEMBERSHIP(0xffffffffffffffff, 0x10e, 0x2, &(0x7f0000000080)=0x11, 0x4) r1 = accept4$inet(0xffffffffffffffff, &(0x7f00000000c0)={0x2, 0x0, @loopback}, &(0x7f0000000180)=0x10, 0xc0000) setsockopt$inet_sctp_SCTP_PARTIAL_DELIVERY_POINT(r1, 0x84, 0x13, &(0x7f00000001c0)=0x5, 0x4) 15:24:16 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000080)=ANY=[@ANYBLOB="300000001000010800"/20, @ANYRES32=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00\b\x00\r\x00', @ANYRES32=r2, @ANYBLOB="08001b0000d47a00"], 0x30}}, 0x0) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x0) [ 374.158559][T16484] bridge194: port 1(syz_tun) entered blocking state [ 374.165463][T16484] bridge194: port 1(syz_tun) entered disabled state [ 374.184912][T16484] device syz_tun entered promiscuous mode [ 374.196670][T16486] netlink: 72 bytes leftover after parsing attributes in process `syz-executor.1'. [ 374.245042][T16485] device syz_tun left promiscuous mode [ 374.253124][T16485] bridge179: port 1(syz_tun) entered disabled state [ 374.383639][T16485] bridge180: port 1(syz_tun) entered blocking state [ 374.390479][T16485] bridge180: port 1(syz_tun) entered disabled state [ 374.403835][T16485] device syz_tun entered promiscuous mode [ 374.418548][T16488] device erspan0 left promiscuous mode 15:24:16 executing program 0: r0 = socket(0x21, 0xa, 0x1) r1 = socket(0x10, 0x80002, 0x0) ioctl(r1, 0x1000008912, &(0x7f00000001c0)="080db5055e0bcfe8696071") getsockopt$inet_sctp_SCTP_PEER_AUTH_CHUNKS(r1, 0x84, 0x1a, &(0x7f0000000940)=ANY=[@ANYRES32=0x0, @ANYBLOB='\x00'/12], &(0x7f0000000980)=0x10) getsockopt$inet_sctp_SCTP_GET_PEER_ADDR_INFO(r0, 0x84, 0xf, &(0x7f00000009c0)={r2, @in6={{0xa, 0x4e21, 0x8, @local, 0x401}}, 0x9, 0x1, 0x7, 0x7f, 0x6}, &(0x7f0000000a80)=0x98) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000400)='nl80211\x00') sendmsg$NL80211_CMD_GET_MESH_CONFIG(r0, &(0x7f0000000580)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x103190}, 0xc, &(0x7f0000000540)={&(0x7f0000000500)={0x34, r3, 0x10, 0x70bd2d, 0x25dfdbfe, {}, [@NL80211_ATTR_WDEV={0xc, 0x99, {0x1, 0xffffffffffffffff}}, @NL80211_ATTR_WIPHY={0x8, 0x1, 0x1}, @NL80211_ATTR_WDEV={0xc, 0x99, {0x3f, 0x3}}]}, 0x34}, 0x1, 0x0, 0x0, 0x800}, 0x40000) r4 = socket$nl_generic(0x10, 0x3, 0x10) bind$netlink(0xffffffffffffffff, &(0x7f0000000000)={0x10, 0x0, 0x25dfdbff, 0x1004280}, 0xffffffffffffffb3) sendmsg$nl_generic(r4, &(0x7f0000000080)={&(0x7f0000000480)={0x10, 0xbb7f}, 0xc, &(0x7f0000000440)={&(0x7f00000004c0)={0x1c, 0x22, 0x1, 0x0, 0x0, {0x4}, [@typed={0x8, 0xc}]}, 0x1c}}, 0x0) socket$netlink(0x10, 0x3, 0x0) r5 = socket$alg(0x26, 0x5, 0x0) bind$alg(r5, &(0x7f0000000080)={0x26, 'hash\x00', 0x0, 0x0, 'sha512\x00'}, 0x58) [ 374.431361][T16488] bridge193: port 2(erspan0) entered disabled state [ 374.578049][T16488] bridge194: port 2(erspan0) entered blocking state [ 374.585103][T16488] bridge194: port 2(erspan0) entered disabled state [ 374.593389][T16488] device erspan0 entered promiscuous mode [ 374.603163][T16489] netlink: 72 bytes leftover after parsing attributes in process `syz-executor.1'. 15:24:16 executing program 5: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000340)={'erspan0\x00', 0x0}) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000300)={'syz_tun\x00', 0x0}) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r7, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r6, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000380)=@newlink={0x34, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r8}, [@IFLA_LINKINFO={0x14, 0x12, @bridge={{0xb, 0x1, 'bridge\x00'}, {0x4}}}]}, 0x34}}, 0x0) sendmsg$nl_route(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000002700)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r5}, [@IFLA_MASTER={0x8, 0xa, r8}]}, 0x28}}, 0x0) sendmsg$nl_route(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f00000000c0)=ANY=[@ANYBLOB="2800000010000104000040000000000000001e", @ANYRES32=r2, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00\b\x00\n\x00', @ANYRES32=r8], 0x4}}, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r10 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r9, 0x8933, &(0x7f0000000300)={'syz_tun\x00', 0x0}) sendmsg$nl_route(r10, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000040)=@newlink={0x2c, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r11}, [@IFLA_BROADCAST={0xa}]}, 0x332}}, 0x0) 15:24:16 executing program 3: socket$inet(0x10, 0x2000000000003, 0x0) r0 = socket(0x10, 0x80002, 0x0) ioctl(r0, 0x1000008912, &(0x7f00000001c0)="080db5055e0bcfe8696071") getsockopt$inet_sctp_SCTP_PEER_AUTH_CHUNKS(r0, 0x84, 0x1a, &(0x7f0000000940)=ANY=[@ANYRES32=0x0, @ANYBLOB='\x00'/12], &(0x7f0000000980)=0x10) r1 = socket$inet6_udp(0xa, 0x2, 0x0) ioctl$sock_inet6_SIOCSIFADDR(r1, 0x89a1, &(0x7f00000000c0)={@local={0xfe, 0x80, [0x600, 0x3ef, 0x0, 0x3f00000000000000, 0x100000000000000, 0x0, 0x1103, 0x0, 0x0, 0x0, 0x0, 0x6]}}) ioctl$sock_inet6_SIOCADDRT(r1, 0x89a0, &(0x7f00000005c0)={@initdev={0xfe, 0x88, [], 0x1, 0x0}, @remote, @remote, 0x0, 0x4, 0xfffc, 0x0, 0x1, 0x6010060}) r2 = socket(0x10, 0x80002, 0x0) ioctl(r2, 0x1000008912, &(0x7f00000001c0)="080db5055e0bcfe8696071") getsockopt$inet_sctp_SCTP_PEER_AUTH_CHUNKS(r2, 0x84, 0x1a, &(0x7f0000000940)=ANY=[@ANYRES32=0x0, @ANYBLOB='\x00'/12], &(0x7f0000000980)=0x10) write(0xffffffffffffffff, &(0x7f0000000040)="24010000580001000400f4f9002304000a04f111080001c70c200201009f0400478001006d7b37a2491906bdd295970d3e9a5fb26efb8cc3c094dbe50067f2039f178827a1475d7851df2d16aeec5d16fbbb0c45", 0x383) 15:24:16 executing program 2: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000340)={'erspan0\x00', 0x0}) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000300)={'syz_tun\x00', 0x0}) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r7, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r6, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000380)=@newlink={0x34, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r8}, [@IFLA_LINKINFO={0x14, 0x12, @bridge={{0xb, 0x1, 'bridge\x00'}, {0x4}}}]}, 0x34}}, 0x0) sendmsg$nl_route(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000002700)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r5}, [@IFLA_MASTER={0x8, 0xa, r8}]}, 0x28}}, 0x0) sendmsg$nl_route(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f00000000c0)=ANY=[@ANYBLOB="2800000010000104000040000000000000001ea6", @ANYRES32=r2, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00\b\x00\n\x00', @ANYRES32=r8], 0x28}}, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r10 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r9, 0x8933, 0x0) sendmsg$nl_route(r10, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000040)=@newlink={0x2c, 0x10, 0x401, 0x0, 0x0, {}, [@IFLA_BROADCAST={0xa}]}, 0x332}}, 0x0) 15:24:16 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, 0x0, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000004c0)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r3, @ANYBLOB="0000000000000000280012000c0001007665746800000000180002001400010000000000", @ANYRES32=0x0, @ANYBLOB="00000000008433df6d6f6b577d4eaaf2000007"], 0x48}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000540)=ANY=[@ANYBLOB="7400000024000705000000000000000000010000", @ANYRES32=r3, @ANYBLOB="00000000ffffffff000000000800010073667100486818973f73461919309b68e1693572bb000229c6090032d0ed64f3c3545aaf6e000085a4e4ebb5ef670000000000000000000000000000001a4e624d29a84abf03265700000000000000000000000000000000000000000000000000000000000000ac20000089b53c947244306a0216a3de887763df5b42498b13bb1938de859ee6d7ae7dd2224dc672b69b4358871b170ea0b667832e5224ee3538f885b7abd9bc4a7d"], 0x74}}, 0x0) r4 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r4, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000300)=ANY=[@ANYBLOB="840000002c00010700"/20, @ANYRES32=r3, @ANYBLOB="0008008000000000030000000800010075333200580002001400050000000000000000000000000000000000400006003c0001000000000000001020898dde66057433b6ef3a41d22be225e0001b0000000000000000000000000017256ffc66e43a2484e1a912c5998bcbf0d0000000000000000000000000000000798a3c067277da1a290b9613a33c575c36fad473382c8f5532ef3f0e1d2c450a7decbf3431a69f9b2ecb3291bed174245a962fe0484676958265e2988326a89db3139d91fe4aee6ae7e745ab00001a9f61f20500000000000000b3958bc14fce6e66a36d1ab3194534ba4e973684b27793bff837d3"], 0x84}}, 0x0) r5 = socket(0x10, 0x80002, 0x0) sendmmsg$alg(r5, &(0x7f0000000140), 0x49249249249278c, 0x0) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r6, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000500)=@newlink={0x20, 0x11, 0x40d, 0x0, 0x0, {0x0, 0x0, 0x0, r8}}, 0x20}}, 0x0) r9 = socket(0x10, 0x80002, 0x0) getsockopt$inet_sctp_SCTP_PEER_AUTH_CHUNKS(0xffffffffffffffff, 0x84, 0x1a, &(0x7f0000000940)=ANY=[@ANYRES32=0x0, @ANYBLOB='\x00'/12], &(0x7f0000000980)=0x10) r10 = socket(0xa, 0x6, 0x0) close(r10) r11 = socket$inet6_sctp(0xa, 0x10000000005, 0x84) setsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX(r11, 0x84, 0x6e, &(0x7f0000000180)=[@in6={0xa, 0x0, 0x0, @remote, 0x9}], 0x1c) getsockopt$inet_sctp6_SCTP_GET_ASSOC_ID_LIST(r11, 0x84, 0x1d, &(0x7f000095dff8)={0x1, [0x0]}, &(0x7f000095dffc)=0x8) setsockopt$inet_sctp_SCTP_RTOINFO(r10, 0x84, 0x0, &(0x7f0000000000)={r12, 0x0, 0x0, 0x1000000}, 0x10) setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(0xffffffffffffffff, 0x84, 0x9, &(0x7f0000000680)={r12, @in={{0x2, 0x4e20, @remote}}, 0x10001, 0xfff7, 0x5, 0x1, 0x8, 0x5, 0xba}, 0x9c) ioctl(r9, 0x1000008912, &(0x7f00000001c0)="080db5055e0bcfe8696071") getsockopt$inet_sctp_SCTP_PEER_AUTH_CHUNKS(r9, 0x84, 0x1a, &(0x7f0000000940)=ANY=[@ANYRES32=0x0, @ANYBLOB='\x00'/12], &(0x7f0000000980)=0x10) r13 = socket$nl_generic(0x10, 0x3, 0x10) r14 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080)='nl80211\x00') r15 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL80211_CMD_GET_STATION(r15, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000240)={0x1c, r14, 0xf2b, 0x0, 0x0, {}, [@NL80211_ATTR_AIRTIME_WEIGHT={0x8}]}, 0x1c}}, 0x0) sendmsg$NL80211_CMD_GET_MPATH(r13, &(0x7f00000001c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x2000}, 0x268, &(0x7f0000000080)={&(0x7f0000000200)={0x40, r14, 0x4, 0x70bd2d, 0x25dfdbff}, 0xff6b}, 0x1, 0x0, 0x0, 0x10049050}, 0x260448c0) sendmsg$NL80211_CMD_NEW_KEY(r9, &(0x7f0000000640)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0xb0024000}, 0xc, &(0x7f00000002c0)={&(0x7f0000000440)={0x7c, r14, 0x23, 0x70bd27, 0x25dfdbff, {}, [@NL80211_ATTR_KEY_DATA_WEP40={0x9, 0x7, "a80875ab12"}, @NL80211_ATTR_KEY={0x5c, 0x50, [@NL80211_KEY_DEFAULT_TYPES={0x14, 0x8, [@NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_MULTICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_MULTICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_MULTICAST={0x4}]}, @NL80211_KEY_DEFAULT_TYPES={0x28, 0x8, [@NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_MULTICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_MULTICAST={0x4}]}, @NL80211_KEY_IDX={0x5, 0x2, 0x5}, @NL80211_KEY_DATA_WEP104={0x11, 0x1, "4d84c4e30151cb27f51a4adf63"}]}]}, 0x7c}, 0x1, 0x0, 0x0, 0x24000}, 0x40) 15:24:16 executing program 4: r0 = socket$inet6(0xa, 0x80003, 0x6b) ioctl(r0, 0x1000008912, &(0x7f00000001c0)="080db5055e0bcfe8476071") r1 = socket(0x10, 0x2, 0x0) sendto(r1, &(0x7f0000000200)="120000001200e7ef00", 0x9, 0x0, 0x0, 0x0) recvmmsg(r1, &(0x7f00000037c0)=[{{&(0x7f0000000600)=@ethernet={0x0, @random}, 0x80, &(0x7f0000000380)=[{&(0x7f0000000040)=""/95, 0x2000007d}, {&(0x7f00000000c0)=""/85, 0x1f3}, {&(0x7f00000024c0)=""/4096, 0x1048}, {&(0x7f0000000400)=""/120, 0x1aa}, {&(0x7f0000000480)=""/60, 0xc6}, {&(0x7f0000000280)=""/77, 0x4d}, {&(0x7f0000000540)=""/154, 0x207}, {&(0x7f0000000340)=""/22, 0x1de}], 0x8, &(0x7f0000002400)=""/191, 0xfffffffffffffea2}}], 0x4000000000001de, 0x6, &(0x7f0000003700)={0x77359400}) 15:24:16 executing program 0: r0 = socket(0x21, 0xa, 0x1) r1 = socket(0x10, 0x80002, 0x0) ioctl(r1, 0x1000008912, &(0x7f00000001c0)="080db5055e0bcfe8696071") getsockopt$inet_sctp_SCTP_PEER_AUTH_CHUNKS(r1, 0x84, 0x1a, &(0x7f0000000940)=ANY=[@ANYRES32=0x0, @ANYBLOB='\x00'/12], &(0x7f0000000980)=0x10) getsockopt$inet_sctp_SCTP_GET_PEER_ADDR_INFO(r0, 0x84, 0xf, &(0x7f00000009c0)={r2, @in6={{0xa, 0x4e21, 0x8, @local, 0x401}}, 0x9, 0x1, 0x7, 0x7f, 0x6}, &(0x7f0000000a80)=0x98) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000400)='nl80211\x00') sendmsg$NL80211_CMD_GET_MESH_CONFIG(r0, &(0x7f0000000580)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x103190}, 0xc, &(0x7f0000000540)={&(0x7f0000000500)={0x34, r3, 0x10, 0x70bd2d, 0x25dfdbfe, {}, [@NL80211_ATTR_WDEV={0xc, 0x99, {0x1, 0xffffffffffffffff}}, @NL80211_ATTR_WIPHY={0x8, 0x1, 0x1}, @NL80211_ATTR_WDEV={0xc, 0x99, {0x3f, 0x3}}]}, 0x34}, 0x1, 0x0, 0x0, 0x800}, 0x40000) r4 = socket$nl_generic(0x10, 0x3, 0x10) bind$netlink(0xffffffffffffffff, &(0x7f0000000000)={0x10, 0x0, 0x25dfdbff, 0x1004280}, 0xffffffffffffffb3) sendmsg$nl_generic(r4, &(0x7f0000000080)={&(0x7f0000000480)={0x10, 0xbb7f}, 0xc, &(0x7f0000000440)={&(0x7f00000004c0)={0x1c, 0x22, 0x1, 0x0, 0x0, {0x4}, [@typed={0x8, 0xc}]}, 0x1c}}, 0x0) socket$netlink(0x10, 0x3, 0x0) r5 = socket$alg(0x26, 0x5, 0x0) bind$alg(r5, &(0x7f0000000080)={0x26, 'hash\x00', 0x0, 0x0, 'sha512\x00'}, 0x58) [ 374.861431][T16518] device syz_tun left promiscuous mode [ 374.907077][T16518] bridge180: port 1(syz_tun) entered disabled state [ 375.079080][T16518] bridge181: port 1(syz_tun) entered blocking state [ 375.085838][T16518] bridge181: port 1(syz_tun) entered disabled state [ 375.094184][T16518] device syz_tun entered promiscuous mode [ 375.102238][T16522] device syz_tun left promiscuous mode [ 375.108372][T16522] bridge194: port 1(syz_tun) entered disabled state [ 375.237915][T16522] bridge195: port 1(syz_tun) entered blocking state [ 375.245408][T16522] bridge195: port 1(syz_tun) entered disabled state [ 375.258806][T16522] device syz_tun entered promiscuous mode [ 375.266597][T16529] device erspan0 left promiscuous mode [ 375.272634][T16529] bridge194: port 2(erspan0) entered disabled state 15:24:17 executing program 5: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000340)={'erspan0\x00', 0x0}) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000300)={'syz_tun\x00', 0x0}) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r7, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r6, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000380)=@newlink={0x34, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r8}, [@IFLA_LINKINFO={0x14, 0x12, @bridge={{0xb, 0x1, 'bridge\x00'}, {0x4}}}]}, 0x34}}, 0x0) sendmsg$nl_route(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000002700)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r5}, [@IFLA_MASTER={0x8, 0xa, r8}]}, 0x28}}, 0x0) sendmsg$nl_route(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f00000000c0)=ANY=[@ANYBLOB="2800000010000104000040000000000000001e", @ANYRES32=r2, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00\b\x00\n\x00', @ANYRES32=r8], 0x4}}, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r10 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r9, 0x8933, &(0x7f0000000300)={'syz_tun\x00', 0x0}) sendmsg$nl_route(r10, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000040)=@newlink={0x2c, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r11}, [@IFLA_BROADCAST={0xa}]}, 0x332}}, 0x0) [ 375.408811][T16529] bridge195: port 2(erspan0) entered blocking state [ 375.415529][T16529] bridge195: port 2(erspan0) entered disabled state [ 375.427709][T16529] device erspan0 entered promiscuous mode [ 375.446265][T16540] netlink: 72 bytes leftover after parsing attributes in process `syz-executor.1'. 15:24:17 executing program 2: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000340)={'erspan0\x00', 0x0}) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000300)={'syz_tun\x00', 0x0}) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r7, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r6, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000380)=@newlink={0x34, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r8}, [@IFLA_LINKINFO={0x14, 0x12, @bridge={{0xb, 0x1, 'bridge\x00'}, {0x4}}}]}, 0x34}}, 0x0) sendmsg$nl_route(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000002700)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r5}, [@IFLA_MASTER={0x8, 0xa, r8}]}, 0x28}}, 0x0) sendmsg$nl_route(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f00000000c0)=ANY=[@ANYBLOB="2800000010000104000040000000000000001ea6", @ANYRES32=r2, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00\b\x00\n\x00', @ANYRES32=r8], 0x28}}, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r9, 0x8933, &(0x7f0000000300)={'syz_tun\x00', 0x0}) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000040)=@newlink={0x2c, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r10}, [@IFLA_BROADCAST={0xa}]}, 0x332}}, 0x0) [ 375.518790][T16543] netlink: 72 bytes leftover after parsing attributes in process `syz-executor.1'. 15:24:17 executing program 3: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000340)={'erspan0\x00', 0x0}) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000300)={'syz_tun\x00', 0x0}) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r7, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r6, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000380)=@newlink={0x34, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r8}, [@IFLA_LINKINFO={0x14, 0x12, @bridge={{0xb, 0x1, 'bridge\x00'}, {0x4}}}]}, 0x34}}, 0x0) sendmsg$nl_route(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000002700)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r5}, [@IFLA_MASTER={0x8, 0xa, r8}]}, 0x28}}, 0x0) sendmsg$nl_route(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f00000000c0)=ANY=[@ANYBLOB="2800000010000104000040000000000000001e", @ANYRES32=r2, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00\b\x00\n\x00', @ANYRES32=r8], 0x4}}, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r10 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r9, 0x8933, &(0x7f0000000300)={'syz_tun\x00', 0x0}) sendmsg$nl_route(r10, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000040)=@newlink={0x2c, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r11}, [@IFLA_BROADCAST={0xa}]}, 0x332}}, 0x0) 15:24:17 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, 0x0, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000004c0)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r3, @ANYBLOB="0000000000000000280012000c0001007665746800000000180002001400010000000000", @ANYRES32=0x0, @ANYBLOB="00000000008433df6d6f6b577d4eaaf2000007"], 0x48}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000540)=ANY=[@ANYBLOB="7400000024000705000000000000000000010000", @ANYRES32=r3, @ANYBLOB="00000000ffffffff000000000800010073667100486818973f73461919309b68e1693572bb000229c6090032d0ed64f3c3545aaf6e000085a4e4ebb5ef670000000000000000000000000000001a4e624d29a84abf03265700000000000000000000000000000000000000000000000000000000000000ac20000089b53c947244306a0216a3de887763df5b42498b13bb1938de859ee6d7ae7dd2224dc672b69b4358871b170ea0b667832e5224ee3538f885b7abd9bc4a7d"], 0x74}}, 0x0) r4 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r4, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000300)=ANY=[@ANYBLOB="840000002c00010700"/20, @ANYRES32=r3, @ANYBLOB="0008008000000000030000000800010075333200580002001400050000000000000000000000000000000000400006003c0001000000000000001020898dde66057433b6ef3a41d22be225e0001b0000000000000000000000000017256ffc66e43a2484e1a912c5998bcbf0d0000000000000000000000000000000798a3c067277da1a290b9613a33c575c36fad473382c8f5532ef3f0e1d2c450a7decbf3431a69f9b2ecb3291bed174245a962fe0484676958265e2988326a89db3139d91fe4aee6ae7e745ab00001a9f61f20500000000000000b3958bc14fce6e66a36d1ab3194534ba4e973684b27793bff837d3"], 0x84}}, 0x0) r5 = socket(0x10, 0x80002, 0x0) sendmmsg$alg(r5, &(0x7f0000000140), 0x49249249249278c, 0x0) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r6, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000500)=@newlink={0x20, 0x11, 0x40d, 0x0, 0x0, {0x0, 0x0, 0x0, r8}}, 0x20}}, 0x0) r9 = socket(0x10, 0x80002, 0x0) getsockopt$inet_sctp_SCTP_PEER_AUTH_CHUNKS(0xffffffffffffffff, 0x84, 0x1a, &(0x7f0000000940)=ANY=[@ANYRES32=0x0, @ANYBLOB='\x00'/12], &(0x7f0000000980)=0x10) r10 = socket(0xa, 0x6, 0x0) close(r10) r11 = socket$inet6_sctp(0xa, 0x10000000005, 0x84) setsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX(r11, 0x84, 0x6e, &(0x7f0000000180)=[@in6={0xa, 0x0, 0x0, @remote, 0x9}], 0x1c) getsockopt$inet_sctp6_SCTP_GET_ASSOC_ID_LIST(r11, 0x84, 0x1d, &(0x7f000095dff8)={0x1, [0x0]}, &(0x7f000095dffc)=0x8) setsockopt$inet_sctp_SCTP_RTOINFO(r10, 0x84, 0x0, &(0x7f0000000000)={r12, 0x0, 0x0, 0x1000000}, 0x10) setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(0xffffffffffffffff, 0x84, 0x9, &(0x7f0000000680)={r12, @in={{0x2, 0x4e20, @remote}}, 0x10001, 0xfff7, 0x5, 0x1, 0x8, 0x5, 0xba}, 0x9c) ioctl(r9, 0x1000008912, &(0x7f00000001c0)="080db5055e0bcfe8696071") getsockopt$inet_sctp_SCTP_PEER_AUTH_CHUNKS(r9, 0x84, 0x1a, &(0x7f0000000940)=ANY=[@ANYRES32=0x0, @ANYBLOB='\x00'/12], &(0x7f0000000980)=0x10) r13 = socket$nl_generic(0x10, 0x3, 0x10) r14 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080)='nl80211\x00') r15 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL80211_CMD_GET_STATION(r15, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000240)={0x1c, r14, 0xf2b, 0x0, 0x0, {}, [@NL80211_ATTR_AIRTIME_WEIGHT={0x8}]}, 0x1c}}, 0x0) sendmsg$NL80211_CMD_GET_MPATH(r13, &(0x7f00000001c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x2000}, 0x268, &(0x7f0000000080)={&(0x7f0000000200)={0x40, r14, 0x4, 0x70bd2d, 0x25dfdbff}, 0xff6b}, 0x1, 0x0, 0x0, 0x10049050}, 0x260448c0) sendmsg$NL80211_CMD_NEW_KEY(r9, &(0x7f0000000640)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0xb0024000}, 0xc, &(0x7f00000002c0)={&(0x7f0000000440)={0x7c, r14, 0x23, 0x70bd27, 0x25dfdbff, {}, [@NL80211_ATTR_KEY_DATA_WEP40={0x9, 0x7, "a80875ab12"}, @NL80211_ATTR_KEY={0x5c, 0x50, [@NL80211_KEY_DEFAULT_TYPES={0x14, 0x8, [@NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_MULTICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_MULTICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_MULTICAST={0x4}]}, @NL80211_KEY_DEFAULT_TYPES={0x28, 0x8, [@NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_MULTICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_MULTICAST={0x4}]}, @NL80211_KEY_IDX={0x5, 0x2, 0x5}, @NL80211_KEY_DATA_WEP104={0x11, 0x1, "4d84c4e30151cb27f51a4adf63"}]}]}, 0x7c}, 0x1, 0x0, 0x0, 0x24000}, 0x40) [ 375.616066][T16554] device syz_tun left promiscuous mode [ 375.625498][T16554] bridge195: port 1(syz_tun) entered disabled state 15:24:17 executing program 0: r0 = socket(0x21, 0xa, 0x1) r1 = socket(0x10, 0x80002, 0x0) ioctl(r1, 0x1000008912, &(0x7f00000001c0)="080db5055e0bcfe8696071") getsockopt$inet_sctp_SCTP_PEER_AUTH_CHUNKS(r1, 0x84, 0x1a, &(0x7f0000000940)=ANY=[@ANYRES32=0x0, @ANYBLOB='\x00'/12], &(0x7f0000000980)=0x10) getsockopt$inet_sctp_SCTP_GET_PEER_ADDR_INFO(r0, 0x84, 0xf, &(0x7f00000009c0)={r2, @in6={{0xa, 0x4e21, 0x8, @local, 0x401}}, 0x9, 0x1, 0x7, 0x7f, 0x6}, &(0x7f0000000a80)=0x98) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000400)='nl80211\x00') sendmsg$NL80211_CMD_GET_MESH_CONFIG(r0, &(0x7f0000000580)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x103190}, 0xc, &(0x7f0000000540)={&(0x7f0000000500)={0x34, r3, 0x10, 0x70bd2d, 0x25dfdbfe, {}, [@NL80211_ATTR_WDEV={0xc, 0x99, {0x1, 0xffffffffffffffff}}, @NL80211_ATTR_WIPHY={0x8, 0x1, 0x1}, @NL80211_ATTR_WDEV={0xc, 0x99, {0x3f, 0x3}}]}, 0x34}, 0x1, 0x0, 0x0, 0x800}, 0x40000) r4 = socket$nl_generic(0x10, 0x3, 0x10) bind$netlink(0xffffffffffffffff, &(0x7f0000000000)={0x10, 0x0, 0x25dfdbff, 0x1004280}, 0xffffffffffffffb3) sendmsg$nl_generic(r4, &(0x7f0000000080)={&(0x7f0000000480)={0x10, 0xbb7f}, 0xc, &(0x7f0000000440)={&(0x7f00000004c0)={0x1c, 0x22, 0x1, 0x0, 0x0, {0x4}, [@typed={0x8, 0xc}]}, 0x1c}}, 0x0) socket$netlink(0x10, 0x3, 0x0) r5 = socket$alg(0x26, 0x5, 0x0) bind$alg(r5, &(0x7f0000000080)={0x26, 'hash\x00', 0x0, 0x0, 'sha512\x00'}, 0x58) 15:24:17 executing program 4: r0 = socket$inet6(0xa, 0x80003, 0x6b) ioctl(r0, 0x1000008912, &(0x7f00000001c0)="080db5055e0bcfe8476071") r1 = socket(0x10, 0x2, 0x0) sendto(r1, &(0x7f0000000200)="120000001200e7ef007b1a3fcd00", 0xe, 0x0, 0x0, 0x0) recvmmsg(r1, &(0x7f00000037c0)=[{{&(0x7f0000000600)=@ethernet={0x0, @random}, 0x80, &(0x7f0000000380)=[{&(0x7f0000000040)=""/95, 0x2000007d}, {&(0x7f00000000c0)=""/85, 0x1f3}, {&(0x7f00000024c0)=""/4096, 0x1048}, {&(0x7f0000000400)=""/120, 0x1aa}, {&(0x7f0000000480)=""/60, 0xc6}, {&(0x7f0000000280)=""/77, 0x4d}, {&(0x7f0000000540)=""/154, 0x207}, {&(0x7f0000000340)=""/22, 0x1de}], 0x8, &(0x7f0000002400)=""/191, 0xfffffffffffffea2}}], 0x4000000000001de, 0x6, &(0x7f0000003700)={0x77359400}) [ 375.776234][T16554] bridge196: port 1(syz_tun) entered blocking state [ 375.795381][T16554] bridge196: port 1(syz_tun) entered disabled state [ 375.824348][T16554] device syz_tun entered promiscuous mode [ 375.870016][T16553] device syz_tun left promiscuous mode [ 375.876213][T16553] bridge181: port 1(syz_tun) entered disabled state [ 375.989016][T16553] bridge182: port 1(syz_tun) entered blocking state [ 375.995904][T16553] bridge182: port 1(syz_tun) entered disabled state [ 376.004362][T16553] device syz_tun entered promiscuous mode [ 376.014418][T16556] device erspan0 left promiscuous mode [ 376.020426][T16556] bridge195: port 2(erspan0) entered disabled state 15:24:18 executing program 5: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000340)={'erspan0\x00', 0x0}) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000300)={'syz_tun\x00', 0x0}) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r7, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r6, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000380)=@newlink={0x34, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r8}, [@IFLA_LINKINFO={0x14, 0x12, @bridge={{0xb, 0x1, 'bridge\x00'}, {0x4}}}]}, 0x34}}, 0x0) sendmsg$nl_route(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000002700)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r5}, [@IFLA_MASTER={0x8, 0xa, r8}]}, 0x28}}, 0x0) sendmsg$nl_route(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f00000000c0)=ANY=[@ANYBLOB="2800000010000104000040000000000000001e", @ANYRES32=r2, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00\b\x00\n\x00', @ANYRES32=r8], 0x4}}, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r10 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r9, 0x8933, &(0x7f0000000300)={'syz_tun\x00', 0x0}) sendmsg$nl_route(r10, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000040)=@newlink={0x2c, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r11}, [@IFLA_BROADCAST={0xa}]}, 0x332}}, 0x0) [ 376.147800][T16556] bridge196: port 2(erspan0) entered blocking state [ 376.154814][T16556] bridge196: port 2(erspan0) entered disabled state [ 376.163153][T16556] device erspan0 entered promiscuous mode 15:24:18 executing program 2: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000340)={'erspan0\x00', 0x0}) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000300)={'syz_tun\x00', 0x0}) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r7, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r6, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000380)=@newlink={0x34, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r8}, [@IFLA_LINKINFO={0x14, 0x12, @bridge={{0xb, 0x1, 'bridge\x00'}, {0x4}}}]}, 0x34}}, 0x0) sendmsg$nl_route(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000002700)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r5}, [@IFLA_MASTER={0x8, 0xa, r8}]}, 0x28}}, 0x0) sendmsg$nl_route(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f00000000c0)=ANY=[@ANYBLOB="2800000010000104000040000000000000001ea6", @ANYRES32=r2, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00\b\x00\n\x00', @ANYRES32=r8], 0x28}}, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r9, 0x8933, &(0x7f0000000300)={'syz_tun\x00', 0x0}) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000040)=@newlink={0x2c, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r10}, [@IFLA_BROADCAST={0xa}]}, 0x332}}, 0x0) [ 376.201417][T16565] device syz_tun left promiscuous mode [ 376.207102][T16565] bridge55: port 1(syz_tun) entered disabled state [ 376.367809][T16565] bridge56: port 1(syz_tun) entered blocking state [ 376.377314][T16565] bridge56: port 1(syz_tun) entered disabled state [ 376.385480][T16565] device syz_tun entered promiscuous mode [ 376.394235][T16567] netlink: 72 bytes leftover after parsing attributes in process `syz-executor.1'. [ 376.411361][T16570] netlink: 72 bytes leftover after parsing attributes in process `syz-executor.1'. 15:24:18 executing program 3: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) r1 = socket(0x21, 0xa, 0x1) r2 = socket(0x10, 0x80002, 0x0) ioctl(r2, 0x1000008912, &(0x7f00000001c0)="080db5055e0bcfe8696071") getsockopt$inet_sctp_SCTP_PEER_AUTH_CHUNKS(r2, 0x84, 0x1a, &(0x7f0000000940)=ANY=[@ANYRES32=0x0, @ANYBLOB='\x00'/12], &(0x7f0000000980)=0x10) getsockopt$inet_sctp_SCTP_GET_PEER_ADDR_INFO(r1, 0x84, 0xf, &(0x7f00000009c0)={r3, @in6={{0xa, 0x4e21, 0x8, @local, 0x401}}, 0x9, 0x1, 0x7, 0x7f, 0x6}, &(0x7f0000000a80)=0x98) ioctl$sock_SIOCGIFVLAN_SET_VLAN_NAME_TYPE_CMD(r1, 0x8982, &(0x7f0000000000)={0x6, 'vlan0\x00', {0xf40f}, 0x5}) sendmsg$IPSET_CMD_CREATE(r0, &(0x7f0000001080)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000f80)={0x54, 0x2, 0x6, 0x1, 0x0, 0x0, {}, [@IPSET_ATTR_TYPENAME={0xd, 0x3, 'hash:net\x00'}, @IPSET_ATTR_REVISION={0x5}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz0\x00'}, @IPSET_ATTR_DATA={0xc, 0x7, 0x0, 0x1, [@IPSET_ATTR_TIMEOUT={0x8, 0x12, 0x0}]}, @IPSET_ATTR_FAMILY={0x5, 0x5, 0x2}, @IPSET_ATTR_PROTOCOL={0x5}]}, 0x54}}, 0x0) [ 376.470471][T16588] device syz_tun left promiscuous mode [ 376.480893][T16588] bridge182: port 1(syz_tun) entered disabled state 15:24:18 executing program 4: r0 = socket$inet6(0xa, 0x80003, 0x6b) ioctl(r0, 0x1000008912, &(0x7f00000001c0)="080db5055e0bcfe8476071") r1 = socket(0x10, 0x2, 0x0) sendto(r1, &(0x7f0000000200)="120000001200e7ef007b1a3fcd00", 0xe, 0x0, 0x0, 0x0) recvmmsg(r1, &(0x7f00000037c0)=[{{&(0x7f0000000600)=@ethernet={0x0, @random}, 0x80, &(0x7f0000000380)=[{&(0x7f0000000040)=""/95, 0x2000007d}, {&(0x7f00000000c0)=""/85, 0x1f3}, {&(0x7f00000024c0)=""/4096, 0x1048}, {&(0x7f0000000400)=""/120, 0x1aa}, {&(0x7f0000000480)=""/60, 0xc6}, {&(0x7f0000000280)=""/77, 0x4d}, {&(0x7f0000000540)=""/154, 0x207}, {&(0x7f0000000340)=""/22, 0x1de}], 0x8, &(0x7f0000002400)=""/191, 0xfffffffffffffea2}}], 0x4000000000001de, 0x6, &(0x7f0000003700)={0x77359400}) [ 376.617832][T16588] bridge183: port 1(syz_tun) entered blocking state [ 376.624720][T16588] bridge183: port 1(syz_tun) entered disabled state [ 376.637511][T16588] device syz_tun entered promiscuous mode [ 376.645301][T16589] device syz_tun left promiscuous mode [ 376.651226][T16589] bridge196: port 1(syz_tun) entered disabled state [ 376.767885][T16589] bridge197: port 1(syz_tun) entered blocking state [ 376.774825][T16589] bridge197: port 1(syz_tun) entered disabled state [ 376.783134][T16589] device syz_tun entered promiscuous mode [ 376.793474][T16591] device erspan0 left promiscuous mode [ 376.811618][T16591] bridge196: port 2(erspan0) entered disabled state 15:24:18 executing program 5: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000340)={'erspan0\x00', 0x0}) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000300)={'syz_tun\x00', 0x0}) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r7, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r6, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000380)=@newlink={0x34, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r8}, [@IFLA_LINKINFO={0x14, 0x12, @bridge={{0xb, 0x1, 'bridge\x00'}, {0x4}}}]}, 0x34}}, 0x0) sendmsg$nl_route(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000002700)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r5}, [@IFLA_MASTER={0x8, 0xa, r8}]}, 0x28}}, 0x0) sendmsg$nl_route(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f00000000c0)=ANY=[@ANYBLOB="2800000010000104000040000000000000001ea6", @ANYRES32=r2, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00\b\x00\n\x00', @ANYRES32=r8], 0x28}}, 0x0) socketpair$unix(0x1, 0x0, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r10 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r9, 0x8933, &(0x7f0000000300)={'syz_tun\x00', 0x0}) sendmsg$nl_route(r10, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000040)=@newlink={0x2c, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r11}, [@IFLA_BROADCAST={0xa}]}, 0x332}}, 0x0) [ 376.967898][T16591] bridge197: port 2(erspan0) entered blocking state [ 376.974793][T16591] bridge197: port 2(erspan0) entered disabled state [ 376.986847][T16591] device erspan0 entered promiscuous mode 15:24:19 executing program 0: r0 = socket(0x21, 0xa, 0x1) r1 = socket(0x10, 0x80002, 0x0) ioctl(r1, 0x1000008912, &(0x7f00000001c0)="080db5055e0bcfe8696071") getsockopt$inet_sctp_SCTP_PEER_AUTH_CHUNKS(r1, 0x84, 0x1a, &(0x7f0000000940)=ANY=[@ANYRES32=0x0, @ANYBLOB='\x00'/12], &(0x7f0000000980)=0x10) getsockopt$inet_sctp_SCTP_GET_PEER_ADDR_INFO(r0, 0x84, 0xf, &(0x7f00000009c0)={r2, @in6={{0xa, 0x4e21, 0x8, @local, 0x401}}, 0x9, 0x1, 0x7, 0x7f, 0x6}, &(0x7f0000000a80)=0x98) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000400)='nl80211\x00') sendmsg$NL80211_CMD_GET_MESH_CONFIG(r0, &(0x7f0000000580)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x103190}, 0xc, &(0x7f0000000540)={&(0x7f0000000500)={0x34, r3, 0x10, 0x70bd2d, 0x25dfdbfe, {}, [@NL80211_ATTR_WDEV={0xc, 0x99, {0x1, 0xffffffffffffffff}}, @NL80211_ATTR_WIPHY={0x8, 0x1, 0x1}, @NL80211_ATTR_WDEV={0xc, 0x99, {0x3f, 0x3}}]}, 0x34}, 0x1, 0x0, 0x0, 0x800}, 0x40000) r4 = socket$nl_generic(0x10, 0x3, 0x10) bind$netlink(r4, 0x0, 0x0) sendmsg$nl_generic(r4, &(0x7f0000000080)={&(0x7f0000000480)={0x10, 0xbb7f}, 0xc, &(0x7f0000000440)={&(0x7f00000004c0)={0x1c, 0x22, 0x1, 0x0, 0x0, {0x4}, [@typed={0x8, 0xc}]}, 0x1c}}, 0x0) socket$netlink(0x10, 0x3, 0x0) r5 = socket$alg(0x26, 0x5, 0x0) bind$alg(r5, &(0x7f0000000080)={0x26, 'hash\x00', 0x0, 0x0, 'sha512\x00'}, 0x58) 15:24:19 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, 0x0, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000004c0)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r3, @ANYBLOB="0000000000000000280012000c0001007665746800000000180002001400010000000000", @ANYRES32=0x0, @ANYBLOB="00000000008433df6d6f6b577d4eaaf2000007"], 0x48}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000540)=ANY=[@ANYBLOB="7400000024000705000000000000000000010000", @ANYRES32=r3, @ANYBLOB="00000000ffffffff000000000800010073667100486818973f73461919309b68e1693572bb000229c6090032d0ed64f3c3545aaf6e000085a4e4ebb5ef670000000000000000000000000000001a4e624d29a84abf03265700000000000000000000000000000000000000000000000000000000000000ac20000089b53c947244306a0216a3de887763df5b42498b13bb1938de859ee6d7ae7dd2224dc672b69b4358871b170ea0b667832e5224ee3538f885b7abd9bc4a7d"], 0x74}}, 0x0) r4 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r4, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000300)=ANY=[@ANYBLOB="840000002c00010700"/20, @ANYRES32=r3, @ANYBLOB="0008008000000000030000000800010075333200580002001400050000000000000000000000000000000000400006003c0001000000000000001020898dde66057433b6ef3a41d22be225e0001b0000000000000000000000000017256ffc66e43a2484e1a912c5998bcbf0d0000000000000000000000000000000798a3c067277da1a290b9613a33c575c36fad473382c8f5532ef3f0e1d2c450a7decbf3431a69f9b2ecb3291bed174245a962fe0484676958265e2988326a89db3139d91fe4aee6ae7e745ab00001a9f61f20500000000000000b3958bc14fce6e66a36d1ab3194534ba4e973684b27793bff837d3"], 0x84}}, 0x0) r5 = socket(0x10, 0x80002, 0x0) sendmmsg$alg(r5, &(0x7f0000000140), 0x49249249249278c, 0x0) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r6, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000500)=@newlink={0x20, 0x11, 0x40d, 0x0, 0x0, {0x0, 0x0, 0x0, r8}}, 0x20}}, 0x0) r9 = socket(0x10, 0x80002, 0x0) getsockopt$inet_sctp_SCTP_PEER_AUTH_CHUNKS(0xffffffffffffffff, 0x84, 0x1a, &(0x7f0000000940)=ANY=[@ANYRES32=0x0, @ANYBLOB='\x00'/12], &(0x7f0000000980)=0x10) r10 = socket(0xa, 0x6, 0x0) close(r10) r11 = socket$inet6_sctp(0xa, 0x10000000005, 0x84) setsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX(r11, 0x84, 0x6e, &(0x7f0000000180)=[@in6={0xa, 0x0, 0x0, @remote, 0x9}], 0x1c) getsockopt$inet_sctp6_SCTP_GET_ASSOC_ID_LIST(r11, 0x84, 0x1d, &(0x7f000095dff8)={0x1, [0x0]}, &(0x7f000095dffc)=0x8) setsockopt$inet_sctp_SCTP_RTOINFO(r10, 0x84, 0x0, &(0x7f0000000000)={r12, 0x0, 0x0, 0x1000000}, 0x10) setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(0xffffffffffffffff, 0x84, 0x9, &(0x7f0000000680)={r12, @in={{0x2, 0x4e20, @remote}}, 0x10001, 0xfff7, 0x5, 0x1, 0x8, 0x5, 0xba}, 0x9c) ioctl(r9, 0x1000008912, &(0x7f00000001c0)="080db5055e0bcfe8696071") getsockopt$inet_sctp_SCTP_PEER_AUTH_CHUNKS(r9, 0x84, 0x1a, &(0x7f0000000940)=ANY=[@ANYRES32=0x0, @ANYBLOB='\x00'/12], &(0x7f0000000980)=0x10) r13 = socket$nl_generic(0x10, 0x3, 0x10) r14 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080)='nl80211\x00') r15 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL80211_CMD_GET_STATION(r15, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000240)={0x1c, r14, 0xf2b, 0x0, 0x0, {}, [@NL80211_ATTR_AIRTIME_WEIGHT={0x8}]}, 0x1c}}, 0x0) sendmsg$NL80211_CMD_GET_MPATH(r13, &(0x7f00000001c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x2000}, 0x268, &(0x7f0000000080)={&(0x7f0000000200)={0x40, r14, 0x4, 0x70bd2d, 0x25dfdbff}, 0xff6b}, 0x1, 0x0, 0x0, 0x10049050}, 0x260448c0) sendmsg$NL80211_CMD_NEW_KEY(r9, &(0x7f0000000640)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0xb0024000}, 0xc, &(0x7f00000002c0)={&(0x7f0000000440)={0x7c, r14, 0x23, 0x70bd27, 0x25dfdbff, {}, [@NL80211_ATTR_KEY_DATA_WEP40={0x9, 0x7, "a80875ab12"}, @NL80211_ATTR_KEY={0x5c, 0x50, [@NL80211_KEY_DEFAULT_TYPES={0x14, 0x8, [@NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_MULTICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_MULTICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_MULTICAST={0x4}]}, @NL80211_KEY_DEFAULT_TYPES={0x28, 0x8, [@NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_MULTICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_MULTICAST={0x4}]}, @NL80211_KEY_IDX={0x5, 0x2, 0x5}, @NL80211_KEY_DATA_WEP104={0x11, 0x1, "4d84c4e30151cb27f51a4adf63"}]}]}, 0x7c}, 0x1, 0x0, 0x0, 0x24000}, 0x40) 15:24:19 executing program 3: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000340)={'erspan0\x00', 0x0}) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000300)={'syz_tun\x00', 0x0}) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r7, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r6, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000380)=@newlink={0x34, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r8}, [@IFLA_LINKINFO={0x14, 0x12, @bridge={{0xb, 0x1, 'bridge\x00'}, {0x4}}}]}, 0x34}}, 0x0) sendmsg$nl_route(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000002700)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r5}, [@IFLA_MASTER={0x8, 0xa, r8}]}, 0x28}}, 0x0) sendmsg$nl_route(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f00000000c0)=ANY=[@ANYBLOB="2800000010000104000040000000000000001e", @ANYRES32=r2, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00\b\x00\n\x00', @ANYRES32=r8], 0x4}}, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r10 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r9, 0x8933, &(0x7f0000000300)={'syz_tun\x00', 0x0}) sendmsg$nl_route(r10, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000040)=@newlink={0x2c, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r11}, [@IFLA_BROADCAST={0xa}]}, 0x332}}, 0x0) [ 377.013171][T16604] device syz_tun left promiscuous mode [ 377.039073][T16604] bridge183: port 1(syz_tun) entered disabled state 15:24:19 executing program 2: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000340)={'erspan0\x00', 0x0}) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000300)={'syz_tun\x00', 0x0}) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r7, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r6, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000380)=@newlink={0x34, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r8}, [@IFLA_LINKINFO={0x14, 0x12, @bridge={{0xb, 0x1, 'bridge\x00'}, {0x4}}}]}, 0x34}}, 0x0) sendmsg$nl_route(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000002700)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r5}, [@IFLA_MASTER={0x8, 0xa, r8}]}, 0x28}}, 0x0) sendmsg$nl_route(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f00000000c0)=ANY=[@ANYBLOB="2800000010000104000040000000000000001ea6", @ANYRES32=r2, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00\b\x00\n\x00', @ANYRES32=r8], 0x28}}, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r9, 0x8933, &(0x7f0000000300)={'syz_tun\x00', 0x0}) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000040)=@newlink={0x2c, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r10}, [@IFLA_BROADCAST={0xa}]}, 0x332}}, 0x0) [ 377.159233][T16604] bridge184: port 1(syz_tun) entered blocking state [ 377.179866][T16604] bridge184: port 1(syz_tun) entered disabled state [ 377.230590][T16604] device syz_tun entered promiscuous mode [ 377.251532][T16605] bridge184: port 2(erspan0) entered blocking state [ 377.263940][T16605] bridge184: port 2(erspan0) entered disabled state [ 377.273617][T16605] device erspan0 entered promiscuous mode 15:24:19 executing program 5: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000340)={'erspan0\x00', 0x0}) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000300)={'syz_tun\x00', 0x0}) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r7, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r6, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000380)=@newlink={0x34, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r8}, [@IFLA_LINKINFO={0x14, 0x12, @bridge={{0xb, 0x1, 'bridge\x00'}, {0x4}}}]}, 0x34}}, 0x0) sendmsg$nl_route(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000002700)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r5}, [@IFLA_MASTER={0x8, 0xa, r8}]}, 0x28}}, 0x0) sendmsg$nl_route(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f00000000c0)=ANY=[@ANYBLOB="2800000010000104000040000000000000001ea6", @ANYRES32=r2, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00\b\x00\n\x00', @ANYRES32=r8], 0x28}}, 0x0) socketpair$unix(0x1, 0x0, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r10 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r9, 0x8933, &(0x7f0000000300)={'syz_tun\x00', 0x0}) sendmsg$nl_route(r10, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000040)=@newlink={0x2c, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r11}, [@IFLA_BROADCAST={0xa}]}, 0x332}}, 0x0) [ 377.325161][T16619] netlink: 72 bytes leftover after parsing attributes in process `syz-executor.1'. [ 377.372817][T16622] device syz_tun left promiscuous mode [ 377.382162][T16622] bridge56: port 1(syz_tun) entered disabled state 15:24:19 executing program 4: r0 = socket$inet6(0xa, 0x80003, 0x6b) ioctl(r0, 0x1000008912, &(0x7f00000001c0)="080db5055e0bcfe8476071") r1 = socket(0x10, 0x2, 0x0) sendto(r1, &(0x7f0000000200)="120000001200e7ef007b1a3fcd00", 0xe, 0x0, 0x0, 0x0) recvmmsg(r1, &(0x7f00000037c0)=[{{&(0x7f0000000600)=@ethernet={0x0, @random}, 0x80, &(0x7f0000000380)=[{&(0x7f0000000040)=""/95, 0x2000007d}, {&(0x7f00000000c0)=""/85, 0x1f3}, {&(0x7f00000024c0)=""/4096, 0x1048}, {&(0x7f0000000400)=""/120, 0x1aa}, {&(0x7f0000000480)=""/60, 0xc6}, {&(0x7f0000000280)=""/77, 0x4d}, {&(0x7f0000000540)=""/154, 0x207}, {&(0x7f0000000340)=""/22, 0x1de}], 0x8, &(0x7f0000002400)=""/191, 0xfffffffffffffea2}}], 0x4000000000001de, 0x6, &(0x7f0000003700)={0x77359400}) [ 377.527879][T16622] bridge57: port 1(syz_tun) entered blocking state [ 377.542511][T16622] bridge57: port 1(syz_tun) entered disabled state [ 377.552724][T16622] device syz_tun entered promiscuous mode [ 377.580338][T16614] netlink: 72 bytes leftover after parsing attributes in process `syz-executor.1'. [ 377.608710][T16623] device syz_tun left promiscuous mode [ 377.614602][T16623] bridge197: port 1(syz_tun) entered disabled state 15:24:19 executing program 0: r0 = socket(0x21, 0xa, 0x1) r1 = socket(0x10, 0x80002, 0x0) ioctl(r1, 0x1000008912, &(0x7f00000001c0)="080db5055e0bcfe8696071") getsockopt$inet_sctp_SCTP_PEER_AUTH_CHUNKS(r1, 0x84, 0x1a, &(0x7f0000000940)=ANY=[@ANYRES32=0x0, @ANYBLOB='\x00'/12], &(0x7f0000000980)=0x10) getsockopt$inet_sctp_SCTP_GET_PEER_ADDR_INFO(r0, 0x84, 0xf, &(0x7f00000009c0)={r2, @in6={{0xa, 0x4e21, 0x8, @local, 0x401}}, 0x9, 0x1, 0x7, 0x7f, 0x6}, &(0x7f0000000a80)=0x98) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000400)='nl80211\x00') sendmsg$NL80211_CMD_GET_MESH_CONFIG(r0, &(0x7f0000000580)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x103190}, 0xc, &(0x7f0000000540)={&(0x7f0000000500)={0x34, r3, 0x10, 0x70bd2d, 0x25dfdbfe, {}, [@NL80211_ATTR_WDEV={0xc, 0x99, {0x1, 0xffffffffffffffff}}, @NL80211_ATTR_WIPHY={0x8, 0x1, 0x1}, @NL80211_ATTR_WDEV={0xc, 0x99, {0x3f, 0x3}}]}, 0x34}, 0x1, 0x0, 0x0, 0x800}, 0x40000) r4 = socket$nl_generic(0x10, 0x3, 0x10) bind$netlink(r4, 0x0, 0x0) sendmsg$nl_generic(r4, &(0x7f0000000080)={&(0x7f0000000480)={0x10, 0xbb7f}, 0xc, &(0x7f0000000440)={&(0x7f00000004c0)={0x1c, 0x22, 0x1, 0x0, 0x0, {0x4}, [@typed={0x8, 0xc}]}, 0x1c}}, 0x0) socket$netlink(0x10, 0x3, 0x0) r5 = socket$alg(0x26, 0x5, 0x0) bind$alg(r5, &(0x7f0000000080)={0x26, 'hash\x00', 0x0, 0x0, 'sha512\x00'}, 0x58) [ 377.757815][T16623] bridge198: port 1(syz_tun) entered blocking state [ 377.764692][T16623] bridge198: port 1(syz_tun) entered disabled state [ 377.773135][T16623] device syz_tun entered promiscuous mode [ 377.790861][T16628] device erspan0 left promiscuous mode [ 377.796642][T16628] bridge197: port 2(erspan0) entered disabled state 15:24:19 executing program 3: r0 = socket$inet6(0xa, 0x1, 0x8010000000000084) listen(r0, 0x4000000043) r1 = socket$netlink(0x10, 0x3, 0x200000000000004) writev(r1, &(0x7f0000000040)=[{&(0x7f0000000200)="480000001400190d09004bb5050d8c560a8447000bffe0064e230f00000000a2bc5603b700000f7f89000000200000000101ff0000000309ff5bffff00c7e5ed5e00000000000000", 0x48}], 0x1) r2 = socket(0x21, 0xa, 0x1) r3 = socket(0x10, 0x80002, 0x0) ioctl(r3, 0x1000008912, &(0x7f00000001c0)="080db5055e0bcfe8696071") getsockopt$inet_sctp_SCTP_PEER_AUTH_CHUNKS(r3, 0x84, 0x1a, &(0x7f0000000940)=ANY=[@ANYRES32=0x0, @ANYBLOB='\x00'/12], &(0x7f0000000980)=0x10) getsockopt$inet_sctp_SCTP_GET_PEER_ADDR_INFO(r2, 0x84, 0xf, &(0x7f00000009c0)={r4, @in6={{0xa, 0x4e21, 0x8, @local, 0x401}}, 0x9, 0x1, 0x7, 0x7f, 0x6}, &(0x7f0000000a80)=0x98) setsockopt$inet6_MRT6_ADD_MFC(r2, 0x29, 0xcc, &(0x7f0000000080)={{0xa, 0x4e24, 0x6, @initdev={0xfe, 0x88, [], 0x0, 0x0}, 0x1}, {0xa, 0x4e20, 0x8, @initdev={0xfe, 0x88, [], 0x1, 0x0}, 0x8}, 0xb45, [0x9, 0x401, 0x7, 0x0, 0x3, 0x5a, 0x124c, 0x1]}, 0x5c) [ 377.938019][T16628] bridge198: port 2(erspan0) entered blocking state [ 377.944950][T16628] bridge198: port 2(erspan0) entered disabled state [ 377.955480][T16628] device erspan0 entered promiscuous mode 15:24:20 executing program 2: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000340)={'erspan0\x00', 0x0}) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000300)={'syz_tun\x00', 0x0}) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r7, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r6, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000380)=@newlink={0x34, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r8}, [@IFLA_LINKINFO={0x14, 0x12, @bridge={{0xb, 0x1, 'bridge\x00'}, {0x4}}}]}, 0x34}}, 0x0) sendmsg$nl_route(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000002700)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r5}, [@IFLA_MASTER={0x8, 0xa, r8}]}, 0x28}}, 0x0) sendmsg$nl_route(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f00000000c0)=ANY=[@ANYBLOB="2800000010000104000040000000000000001ea6", @ANYRES32=r2, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00\b\x00\n\x00', @ANYRES32=r8], 0x28}}, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r10 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r9, 0x8933, &(0x7f0000000300)={'syz_tun\x00'}) sendmsg$nl_route(r10, 0x0, 0x0) [ 377.981818][T16630] device syz_tun left promiscuous mode [ 378.001385][T16630] bridge184: port 1(syz_tun) entered disabled state 15:24:20 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, 0x0}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000004c0)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r3, @ANYBLOB="0000000000000000280012000c0001007665746800000000180002001400010000000000", @ANYRES32=0x0, @ANYBLOB="00000000008433df6d6f6b577d4eaaf2000007"], 0x48}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000540)=ANY=[@ANYBLOB="7400000024000705000000000000000000010000", @ANYRES32=r3, @ANYBLOB="00000000ffffffff000000000800010073667100486818973f73461919309b68e1693572bb000229c6090032d0ed64f3c3545aaf6e000085a4e4ebb5ef670000000000000000000000000000001a4e624d29a84abf03265700000000000000000000000000000000000000000000000000000000000000ac20000089b53c947244306a0216a3de887763df5b42498b13bb1938de859ee6d7ae7dd2224dc672b69b4358871b170ea0b667832e5224ee3538f885b7abd9bc4a7d"], 0x74}}, 0x0) r4 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r4, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000300)=ANY=[@ANYBLOB="840000002c00010700"/20, @ANYRES32=r3, @ANYBLOB="0008008000000000030000000800010075333200580002001400050000000000000000000000000000000000400006003c0001000000000000001020898dde66057433b6ef3a41d22be225e0001b0000000000000000000000000017256ffc66e43a2484e1a912c5998bcbf0d0000000000000000000000000000000798a3c067277da1a290b9613a33c575c36fad473382c8f5532ef3f0e1d2c450a7decbf3431a69f9b2ecb3291bed174245a962fe0484676958265e2988326a89db3139d91fe4aee6ae7e745ab00001a9f61f20500000000000000b3958bc14fce6e66a36d1ab3194534ba4e973684b27793bff837d3"], 0x84}}, 0x0) r5 = socket(0x10, 0x80002, 0x0) sendmmsg$alg(r5, &(0x7f0000000140), 0x49249249249278c, 0x0) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r6, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000500)=@newlink={0x20, 0x11, 0x40d, 0x0, 0x0, {0x0, 0x0, 0x0, r8}}, 0x20}}, 0x0) r9 = socket(0x10, 0x80002, 0x0) getsockopt$inet_sctp_SCTP_PEER_AUTH_CHUNKS(0xffffffffffffffff, 0x84, 0x1a, &(0x7f0000000940)=ANY=[@ANYRES32=0x0, @ANYBLOB='\x00'/12], &(0x7f0000000980)=0x10) r10 = socket(0xa, 0x6, 0x0) close(r10) r11 = socket$inet6_sctp(0xa, 0x10000000005, 0x84) setsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX(r11, 0x84, 0x6e, &(0x7f0000000180)=[@in6={0xa, 0x0, 0x0, @remote, 0x9}], 0x1c) getsockopt$inet_sctp6_SCTP_GET_ASSOC_ID_LIST(r11, 0x84, 0x1d, &(0x7f000095dff8)={0x1, [0x0]}, &(0x7f000095dffc)=0x8) setsockopt$inet_sctp_SCTP_RTOINFO(r10, 0x84, 0x0, &(0x7f0000000000)={r12, 0x0, 0x0, 0x1000000}, 0x10) setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(0xffffffffffffffff, 0x84, 0x9, &(0x7f0000000680)={r12, @in={{0x2, 0x4e20, @remote}}, 0x10001, 0xfff7, 0x5, 0x1, 0x8, 0x5, 0xba}, 0x9c) ioctl(r9, 0x1000008912, &(0x7f00000001c0)="080db5055e0bcfe8696071") getsockopt$inet_sctp_SCTP_PEER_AUTH_CHUNKS(r9, 0x84, 0x1a, &(0x7f0000000940)=ANY=[@ANYRES32=0x0, @ANYBLOB='\x00'/12], &(0x7f0000000980)=0x10) r13 = socket$nl_generic(0x10, 0x3, 0x10) r14 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080)='nl80211\x00') r15 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL80211_CMD_GET_STATION(r15, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000240)={0x1c, r14, 0xf2b, 0x0, 0x0, {}, [@NL80211_ATTR_AIRTIME_WEIGHT={0x8}]}, 0x1c}}, 0x0) sendmsg$NL80211_CMD_GET_MPATH(r13, &(0x7f00000001c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x2000}, 0x268, &(0x7f0000000080)={&(0x7f0000000200)={0x40, r14, 0x4, 0x70bd2d, 0x25dfdbff}, 0xff6b}, 0x1, 0x0, 0x0, 0x10049050}, 0x260448c0) sendmsg$NL80211_CMD_NEW_KEY(r9, &(0x7f0000000640)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0xb0024000}, 0xc, &(0x7f00000002c0)={&(0x7f0000000440)={0x7c, r14, 0x23, 0x70bd27, 0x25dfdbff, {}, [@NL80211_ATTR_KEY_DATA_WEP40={0x9, 0x7, "a80875ab12"}, @NL80211_ATTR_KEY={0x5c, 0x50, [@NL80211_KEY_DEFAULT_TYPES={0x14, 0x8, [@NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_MULTICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_MULTICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_MULTICAST={0x4}]}, @NL80211_KEY_DEFAULT_TYPES={0x28, 0x8, [@NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_MULTICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_MULTICAST={0x4}]}, @NL80211_KEY_IDX={0x5, 0x2, 0x5}, @NL80211_KEY_DATA_WEP104={0x11, 0x1, "4d84c4e30151cb27f51a4adf63"}]}]}, 0x7c}, 0x1, 0x0, 0x0, 0x24000}, 0x40) [ 378.147782][T16630] bridge185: port 1(syz_tun) entered blocking state [ 378.154689][T16630] bridge185: port 1(syz_tun) entered disabled state [ 378.168159][T16630] device syz_tun entered promiscuous mode [ 378.176404][T16632] device erspan0 left promiscuous mode [ 378.191293][T16632] bridge184: port 2(erspan0) entered disabled state [ 378.297817][T16632] bridge185: port 2(erspan0) entered blocking state [ 378.304629][T16632] bridge185: port 2(erspan0) entered disabled state [ 378.317094][T16632] device erspan0 entered promiscuous mode 15:24:20 executing program 5: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000340)={'erspan0\x00', 0x0}) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000300)={'syz_tun\x00', 0x0}) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r7, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r6, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000380)=@newlink={0x34, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r8}, [@IFLA_LINKINFO={0x14, 0x12, @bridge={{0xb, 0x1, 'bridge\x00'}, {0x4}}}]}, 0x34}}, 0x0) sendmsg$nl_route(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000002700)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r5}, [@IFLA_MASTER={0x8, 0xa, r8}]}, 0x28}}, 0x0) sendmsg$nl_route(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f00000000c0)=ANY=[@ANYBLOB="2800000010000104000040000000000000001ea6", @ANYRES32=r2, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00\b\x00\n\x00', @ANYRES32=r8], 0x28}}, 0x0) socketpair$unix(0x1, 0x0, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r10 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r9, 0x8933, &(0x7f0000000300)={'syz_tun\x00', 0x0}) sendmsg$nl_route(r10, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000040)=@newlink={0x2c, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r11}, [@IFLA_BROADCAST={0xa}]}, 0x332}}, 0x0) 15:24:20 executing program 4: r0 = socket$inet6(0xa, 0x80003, 0x6b) ioctl(r0, 0x1000008912, &(0x7f00000001c0)="080db5055e0bcfe8476071") r1 = socket(0x10, 0x2, 0x0) sendto(r1, &(0x7f0000000200)="120000001200e7ef007b1a3fcd000000", 0x10, 0x0, 0x0, 0x0) recvmmsg(r1, &(0x7f00000037c0)=[{{&(0x7f0000000600)=@ethernet={0x0, @random}, 0x80, &(0x7f0000000380)=[{&(0x7f0000000040)=""/95, 0x2000007d}, {&(0x7f00000000c0)=""/85, 0x1f3}, {&(0x7f00000024c0)=""/4096, 0x1048}, {&(0x7f0000000400)=""/120, 0x1aa}, {&(0x7f0000000480)=""/60, 0xc6}, {&(0x7f0000000280)=""/77, 0x4d}, {&(0x7f0000000540)=""/154, 0x207}, {&(0x7f0000000340)=""/22, 0x1de}], 0x8, &(0x7f0000002400)=""/191, 0xfffffffffffffea2}}], 0x4000000000001de, 0x6, &(0x7f0000003700)={0x77359400}) [ 378.340696][T16652] device syz_tun left promiscuous mode [ 378.349229][T16652] bridge198: port 1(syz_tun) entered disabled state [ 378.498091][T16652] bridge199: port 1(syz_tun) entered blocking state [ 378.504818][T16652] bridge199: port 1(syz_tun) entered disabled state [ 378.513814][T16652] device syz_tun entered promiscuous mode [ 378.522418][T16653] device erspan0 left promiscuous mode [ 378.528493][T16653] bridge198: port 2(erspan0) entered disabled state 15:24:20 executing program 2: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000340)={'erspan0\x00', 0x0}) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000300)={'syz_tun\x00', 0x0}) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r7, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r6, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000380)=@newlink={0x34, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r8}, [@IFLA_LINKINFO={0x14, 0x12, @bridge={{0xb, 0x1, 'bridge\x00'}, {0x4}}}]}, 0x34}}, 0x0) sendmsg$nl_route(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000002700)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r5}, [@IFLA_MASTER={0x8, 0xa, r8}]}, 0x28}}, 0x0) sendmsg$nl_route(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f00000000c0)=ANY=[@ANYBLOB="2800000010000104000040000000000000001ea6", @ANYRES32=r2, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00\b\x00\n\x00', @ANYRES32=r8], 0x28}}, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r10 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r9, 0x8933, &(0x7f0000000300)={'syz_tun\x00'}) sendmsg$nl_route(r10, 0x0, 0x0) 15:24:20 executing program 3: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000340)={'erspan0\x00', 0x0}) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000300)={'syz_tun\x00', 0x0}) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r7, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r6, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000380)=@newlink={0x34, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r8}, [@IFLA_LINKINFO={0x14, 0x12, @bridge={{0xb, 0x1, 'bridge\x00'}, {0x4}}}]}, 0x34}}, 0x0) sendmsg$nl_route(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000002700)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r5}, [@IFLA_MASTER={0x8, 0xa, r8}]}, 0x28}}, 0x0) sendmsg$nl_route(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f00000000c0)=ANY=[@ANYBLOB="2800000010000104000040000000000000001ea6", @ANYRES32=r2, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00\b\x00\n\x00', @ANYRES32=r8], 0x28}}, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r9, 0x8933, &(0x7f0000000300)={'syz_tun\x00', 0x0}) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000040)=@newlink={0x2c, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r10}, [@IFLA_BROADCAST={0xa}]}, 0x332}}, 0x0) [ 378.659071][T16653] bridge199: port 2(erspan0) entered blocking state [ 378.665944][T16653] bridge199: port 2(erspan0) entered disabled state [ 378.674415][T16653] device erspan0 entered promiscuous mode [ 378.693337][T16658] netlink: 72 bytes leftover after parsing attributes in process `syz-executor.1'. [ 378.748583][T16669] device syz_tun left promiscuous mode [ 378.771662][T16669] bridge185: port 1(syz_tun) entered disabled state 15:24:20 executing program 0: r0 = socket(0x21, 0xa, 0x1) r1 = socket(0x10, 0x80002, 0x0) ioctl(r1, 0x1000008912, &(0x7f00000001c0)="080db5055e0bcfe8696071") getsockopt$inet_sctp_SCTP_PEER_AUTH_CHUNKS(r1, 0x84, 0x1a, &(0x7f0000000940)=ANY=[@ANYRES32=0x0, @ANYBLOB='\x00'/12], &(0x7f0000000980)=0x10) getsockopt$inet_sctp_SCTP_GET_PEER_ADDR_INFO(r0, 0x84, 0xf, &(0x7f00000009c0)={r2, @in6={{0xa, 0x4e21, 0x8, @local, 0x401}}, 0x9, 0x1, 0x7, 0x7f, 0x6}, &(0x7f0000000a80)=0x98) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000400)='nl80211\x00') sendmsg$NL80211_CMD_GET_MESH_CONFIG(r0, &(0x7f0000000580)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x103190}, 0xc, &(0x7f0000000540)={&(0x7f0000000500)={0x34, r3, 0x10, 0x70bd2d, 0x25dfdbfe, {}, [@NL80211_ATTR_WDEV={0xc, 0x99, {0x1, 0xffffffffffffffff}}, @NL80211_ATTR_WIPHY={0x8, 0x1, 0x1}, @NL80211_ATTR_WDEV={0xc, 0x99, {0x3f, 0x3}}]}, 0x34}, 0x1, 0x0, 0x0, 0x800}, 0x40000) r4 = socket$nl_generic(0x10, 0x3, 0x10) bind$netlink(r4, 0x0, 0x0) sendmsg$nl_generic(r4, &(0x7f0000000080)={&(0x7f0000000480)={0x10, 0xbb7f}, 0xc, &(0x7f0000000440)={&(0x7f00000004c0)={0x1c, 0x22, 0x1, 0x0, 0x0, {0x4}, [@typed={0x8, 0xc}]}, 0x1c}}, 0x0) socket$netlink(0x10, 0x3, 0x0) r5 = socket$alg(0x26, 0x5, 0x0) bind$alg(r5, &(0x7f0000000080)={0x26, 'hash\x00', 0x0, 0x0, 'sha512\x00'}, 0x58) [ 378.959011][T16669] bridge186: port 1(syz_tun) entered blocking state [ 378.965719][T16669] bridge186: port 1(syz_tun) entered disabled state [ 378.974148][T16669] device syz_tun entered promiscuous mode [ 378.983554][T16671] device erspan0 left promiscuous mode [ 378.990007][T16671] bridge185: port 2(erspan0) entered disabled state 15:24:21 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, 0x0}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000004c0)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r3, @ANYBLOB="0000000000000000280012000c0001007665746800000000180002001400010000000000", @ANYRES32=0x0, @ANYBLOB="00000000008433df6d6f6b577d4eaaf2000007"], 0x48}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000540)=ANY=[@ANYBLOB="7400000024000705000000000000000000010000", @ANYRES32=r3, @ANYBLOB="00000000ffffffff000000000800010073667100486818973f73461919309b68e1693572bb000229c6090032d0ed64f3c3545aaf6e000085a4e4ebb5ef670000000000000000000000000000001a4e624d29a84abf03265700000000000000000000000000000000000000000000000000000000000000ac20000089b53c947244306a0216a3de887763df5b42498b13bb1938de859ee6d7ae7dd2224dc672b69b4358871b170ea0b667832e5224ee3538f885b7abd9bc4a7d"], 0x74}}, 0x0) r4 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r4, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000300)=ANY=[@ANYBLOB="840000002c00010700"/20, @ANYRES32=r3, @ANYBLOB="0008008000000000030000000800010075333200580002001400050000000000000000000000000000000000400006003c0001000000000000001020898dde66057433b6ef3a41d22be225e0001b0000000000000000000000000017256ffc66e43a2484e1a912c5998bcbf0d0000000000000000000000000000000798a3c067277da1a290b9613a33c575c36fad473382c8f5532ef3f0e1d2c450a7decbf3431a69f9b2ecb3291bed174245a962fe0484676958265e2988326a89db3139d91fe4aee6ae7e745ab00001a9f61f20500000000000000b3958bc14fce6e66a36d1ab3194534ba4e973684b27793bff837d3"], 0x84}}, 0x0) r5 = socket(0x10, 0x80002, 0x0) sendmmsg$alg(r5, &(0x7f0000000140), 0x49249249249278c, 0x0) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r6, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000500)=@newlink={0x20, 0x11, 0x40d, 0x0, 0x0, {0x0, 0x0, 0x0, r8}}, 0x20}}, 0x0) r9 = socket(0x10, 0x80002, 0x0) getsockopt$inet_sctp_SCTP_PEER_AUTH_CHUNKS(0xffffffffffffffff, 0x84, 0x1a, &(0x7f0000000940)=ANY=[@ANYRES32=0x0, @ANYBLOB='\x00'/12], &(0x7f0000000980)=0x10) r10 = socket(0xa, 0x6, 0x0) close(r10) r11 = socket$inet6_sctp(0xa, 0x10000000005, 0x84) setsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX(r11, 0x84, 0x6e, &(0x7f0000000180)=[@in6={0xa, 0x0, 0x0, @remote, 0x9}], 0x1c) getsockopt$inet_sctp6_SCTP_GET_ASSOC_ID_LIST(r11, 0x84, 0x1d, &(0x7f000095dff8)={0x1, [0x0]}, &(0x7f000095dffc)=0x8) setsockopt$inet_sctp_SCTP_RTOINFO(r10, 0x84, 0x0, &(0x7f0000000000)={r12, 0x0, 0x0, 0x1000000}, 0x10) setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(0xffffffffffffffff, 0x84, 0x9, &(0x7f0000000680)={r12, @in={{0x2, 0x4e20, @remote}}, 0x10001, 0xfff7, 0x5, 0x1, 0x8, 0x5, 0xba}, 0x9c) ioctl(r9, 0x1000008912, &(0x7f00000001c0)="080db5055e0bcfe8696071") getsockopt$inet_sctp_SCTP_PEER_AUTH_CHUNKS(r9, 0x84, 0x1a, &(0x7f0000000940)=ANY=[@ANYRES32=0x0, @ANYBLOB='\x00'/12], &(0x7f0000000980)=0x10) r13 = socket$nl_generic(0x10, 0x3, 0x10) r14 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080)='nl80211\x00') r15 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL80211_CMD_GET_STATION(r15, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000240)={0x1c, r14, 0xf2b, 0x0, 0x0, {}, [@NL80211_ATTR_AIRTIME_WEIGHT={0x8}]}, 0x1c}}, 0x0) sendmsg$NL80211_CMD_GET_MPATH(r13, &(0x7f00000001c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x2000}, 0x268, &(0x7f0000000080)={&(0x7f0000000200)={0x40, r14, 0x4, 0x70bd2d, 0x25dfdbff}, 0xff6b}, 0x1, 0x0, 0x0, 0x10049050}, 0x260448c0) sendmsg$NL80211_CMD_NEW_KEY(r9, &(0x7f0000000640)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0xb0024000}, 0xc, &(0x7f00000002c0)={&(0x7f0000000440)={0x7c, r14, 0x23, 0x70bd27, 0x25dfdbff, {}, [@NL80211_ATTR_KEY_DATA_WEP40={0x9, 0x7, "a80875ab12"}, @NL80211_ATTR_KEY={0x5c, 0x50, [@NL80211_KEY_DEFAULT_TYPES={0x14, 0x8, [@NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_MULTICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_MULTICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_MULTICAST={0x4}]}, @NL80211_KEY_DEFAULT_TYPES={0x28, 0x8, [@NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_MULTICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_MULTICAST={0x4}]}, @NL80211_KEY_IDX={0x5, 0x2, 0x5}, @NL80211_KEY_DATA_WEP104={0x11, 0x1, "4d84c4e30151cb27f51a4adf63"}]}]}, 0x7c}, 0x1, 0x0, 0x0, 0x24000}, 0x40) [ 379.138220][T16671] bridge186: port 2(erspan0) entered blocking state [ 379.146429][T16671] bridge186: port 2(erspan0) entered disabled state [ 379.160076][T16671] device erspan0 entered promiscuous mode 15:24:21 executing program 5: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000340)={'erspan0\x00', 0x0}) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000300)={'syz_tun\x00', 0x0}) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r7, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r6, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000380)=@newlink={0x34, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r8}, [@IFLA_LINKINFO={0x14, 0x12, @bridge={{0xb, 0x1, 'bridge\x00'}, {0x4}}}]}, 0x34}}, 0x0) sendmsg$nl_route(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000002700)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r5}, [@IFLA_MASTER={0x8, 0xa, r8}]}, 0x28}}, 0x0) sendmsg$nl_route(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f00000000c0)=ANY=[@ANYBLOB="2800000010000104000040000000000000001ea6", @ANYRES32=r2, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00\b\x00\n\x00', @ANYRES32=r8], 0x28}}, 0x0) socketpair$unix(0x1, 0x2, 0x0, 0x0) r9 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000300)={'syz_tun\x00', 0x0}) sendmsg$nl_route(r9, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000040)=@newlink={0x2c, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r10}, [@IFLA_BROADCAST={0xa}]}, 0x332}}, 0x0) [ 379.187400][T16684] device syz_tun left promiscuous mode [ 379.196980][T16684] bridge57: port 1(syz_tun) entered disabled state 15:24:21 executing program 4: r0 = socket$inet6(0xa, 0x80003, 0x6b) ioctl(r0, 0x1000008912, &(0x7f00000001c0)="080db5055e0bcfe8476071") r1 = socket(0x10, 0x2, 0x0) sendto(r1, &(0x7f0000000200)="120000001200e7ef007b1a3fcd000000", 0x10, 0x0, 0x0, 0x0) recvmmsg(r1, &(0x7f00000037c0)=[{{&(0x7f0000000600)=@ethernet={0x0, @random}, 0x80, &(0x7f0000000380)=[{&(0x7f0000000040)=""/95, 0x2000007d}, {&(0x7f00000000c0)=""/85, 0x1f3}, {&(0x7f00000024c0)=""/4096, 0x1048}, {&(0x7f0000000400)=""/120, 0x1aa}, {&(0x7f0000000480)=""/60, 0xc6}, {&(0x7f0000000280)=""/77, 0x4d}, {&(0x7f0000000540)=""/154, 0x207}, {&(0x7f0000000340)=""/22, 0x1de}], 0x8, &(0x7f0000002400)=""/191, 0xfffffffffffffea2}}], 0x4000000000001de, 0x6, &(0x7f0000003700)={0x77359400}) [ 379.328127][T16684] bridge58: port 1(syz_tun) entered blocking state [ 379.335527][T16684] bridge58: port 1(syz_tun) entered disabled state [ 379.344051][T16684] device syz_tun entered promiscuous mode [ 379.353013][T16685] device syz_tun left promiscuous mode [ 379.360339][T16685] bridge199: port 1(syz_tun) entered disabled state [ 379.469697][T16685] bridge200: port 1(syz_tun) entered blocking state [ 379.477820][T16685] bridge200: port 1(syz_tun) entered disabled state [ 379.486467][T16685] device syz_tun entered promiscuous mode [ 379.494586][T16686] bridge58: port 2(erspan0) entered blocking state [ 379.501460][T16686] bridge58: port 2(erspan0) entered disabled state [ 379.509859][T16686] device erspan0 entered promiscuous mode 15:24:21 executing program 3: ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f00000001c0)) r0 = socket$nl_xfrm(0x10, 0x3, 0x6) bind$netlink(r0, 0x0, 0x0) r1 = socket$inet6(0xa, 0x3, 0x7) connect$inet6(r1, &(0x7f00000000c0)={0xa, 0x0, 0x0, @loopback}, 0x1c) setsockopt$inet6_IPV6_XFRM_POLICY(r1, 0x29, 0x23, &(0x7f0000000100)={{{@in6=@ipv4={[], [], @initdev={0xac, 0x1e, 0x0, 0x0}}, @in=@loopback, 0x0, 0x0, 0x0, 0x0, 0xa}, {}, {}, 0x0, 0x0, 0x1}, {{@in=@local, 0x0, 0x3c}, 0x0, @in6=@ipv4={[], [], @multicast2}, 0x0, 0x0, 0x0, 0x6}}, 0xe8) sendmmsg(r1, &(0x7f0000000480), 0x2e9, 0x0) r2 = socket(0x10, 0x80002, 0x0) ioctl(r2, 0x1000008912, &(0x7f00000001c0)="080db5055e0bcfe8696071") getsockopt$inet_sctp_SCTP_PEER_AUTH_CHUNKS(r2, 0x84, 0x1a, &(0x7f0000000940)=ANY=[@ANYRES32=0x0, @ANYBLOB='\x00'/12], &(0x7f0000000980)=0x10) getsockopt$inet6_mreq(r1, 0x29, 0x1b, &(0x7f0000000240)={@ipv4={[], [], @broadcast}, 0x0}, &(0x7f0000000280)=0x14) sendmsg$xdp(r2, &(0x7f0000000a00)={&(0x7f00000002c0)={0x2c, 0x0, r3, 0x2c}, 0x10, &(0x7f0000000940)=[{&(0x7f0000000300)="1b4c975fea4dd0ddef9569ef85253ca76e50512759c4b5132867be95c0bea94a390b6dc849c1deb792b52db1dcfa2657d4d5f00abba340cf0bcd8c5e2bf164df2a2bc852aa2a95427859656d31a4015cf936755a3a24b391a3a412b13764e56b5053d9d8c8aea8e52198408f679fbada356846b4fcc9c5f95a1c547db2daf9f911aea0a751d7776f5e74ec45847dcdc25bafcf4590e4bfc81f6c8e83f6d25dca0a9b1454ed59ac0f64aa98f2da25f8efda95d334bea3384c0413d4b78c7f7d525000d77c1eae2a1aa137d39ea1c14e32b08e01d2d159d30df5e2b4e4ce7f79819b8d87b938d3", 0xe6}, {&(0x7f0000000400)="4ea499e033adc9cc46a999f624a1be32fd4a61adccde67f96b12025f01cd75e272aee4e161d221ddcc7431c527e4e7179e4c0a7c486258570af5343565a41bb8f14739d2d2cfcd49db60963918b467c7b31cf9e1e13da1da087e80a624b209a789e3980a6fcb2283e6d927ac17a1eaa9bfc5cca65807e2015ddd1c9aaac6a6e731fd026df6f09290afc071e1830109a0c77879f64f042a13af82a0f550411feaa0107c5b1e2faeaa7bb4313c959547e3ffc93c5970ac87236407057743fa60e8b019fadb91ce8307954239f484c1bab4840349208ee332ddd6e91aa9d85045b087f17f861aa13fe8", 0xe8}, {&(0x7f0000000500)="3af475c21798d5a622d9873b60fc1cd0cf56a78e03daaa84f463a68ad04fcb8e2c6bcf15ce34ff25975b82d1cd345a367bf153b23701c0327b63c67eaf833e277869a49a5c2627623f6e5ca953be51c109efc2fbbe08ca443446a5223ad0a3629a79a3b29ab1a6", 0x67}, {&(0x7f0000000580)="d9e1276e4ce5002fecc4f4d7bde38cedd208f368c33d2d278937a6f31ac208fc56e66e1b45c4747cf4908012ae4bf1e2ff7532538537e050beee0da5c7bec01741299dfe780932bf3b94bece7954741ca6d9", 0x52}, {&(0x7f0000000600)="3e43361f4dec77fe3b6dc0fe5ada72ce5f5cd2d80da1486dfbe05acca5bd98bf41292ad59d05fb61505fc1fd1fd6e16d0ae79d6ae352f4136ae9da69189b248be5e46fd1ab620504a45a8013b3ed889b4d3eb264d33703de5a23ef9ce2eb2f41adb58e1fc6fa915da157512db126e5a3b8e8d97b34bf6626d94b8f4a5d66a16819d9b33d58c50bb84db1f8b5167f87005dd5a38445d22fc5c8238da10c375591231bddfdb7de73ed99c3aec840b0c18adb3681428b003f4b86d0", 0xba}, {&(0x7f00000006c0)="28d007430aa2ed1fc23f396aaf6b54cb74066a223efa9d6caa54d8fb24db1d33b3e34c0bec58630b2ecd1d2a93543b57802888bb9c856b76e054de999090e58a04fe95b122e6270247dbc75a36b1be81e27e856062f540c7d6cf1008ab38e28141b4997a76fdbd81cd67151353e73dce039bb55aebefd0bcce02fdcf474f538ece96524f8ee9a60babcb6e0abaee057cc81dc48136258ebc4c728160c38a2fbe2fa2b9d8e3", 0xa5}, {&(0x7f0000000780)="d3013f37cad076bf47f234b8f0afef0776138c393325d53446691e983da9932fb9c2b047682fc227334fbb12f12af9eedfb78b3f6753389e0a7bee3b514a659bdea8d5e7a2abc901", 0x48}, {&(0x7f0000000800)="6179c36b009289f7e2fd6a3999907b50b647069610bfff65e3e153bbeada830682345e5425", 0x25}, {&(0x7f0000000840)="b4ce75ea044fb22de38ce395f992d1b7186a808471f204a556fbaf542214f911517139777527238a22343f37062886f21bec69710cf851e495e10fab1cd904be544808bab1e9a5bcb288ec2de6bbf0911805011f519d86790ef66b8d3e937bb207f6535d6f2189d295aaaadedd6195c1be", 0x71}, {&(0x7f00000008c0)="f18d46a0840fc97d64d92420e22760c70581825c07b756737b344aadee20c1e40a31fd0215abbbe19c9040fc20929676345807335de3c54cf403d864ebfa3044ac16b4730635a88de624cd2c9922d1475d4bbf359f82c3d65bf3e45be5bf7b072626a5c92deeb61e9d9fbc02f9d73f8db4314b01daef988965", 0x79}], 0xa, 0x0, 0x0, 0x4000}, 0x880) [ 379.517745][T16688] device erspan0 left promiscuous mode [ 379.523565][T16688] bridge199: port 2(erspan0) entered disabled state 15:24:21 executing program 2: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000340)={'erspan0\x00', 0x0}) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000300)={'syz_tun\x00', 0x0}) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r7, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r6, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000380)=@newlink={0x34, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r8}, [@IFLA_LINKINFO={0x14, 0x12, @bridge={{0xb, 0x1, 'bridge\x00'}, {0x4}}}]}, 0x34}}, 0x0) sendmsg$nl_route(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000002700)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r5}, [@IFLA_MASTER={0x8, 0xa, r8}]}, 0x28}}, 0x0) sendmsg$nl_route(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f00000000c0)=ANY=[@ANYBLOB="2800000010000104000040000000000000001ea6", @ANYRES32=r2, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00\b\x00\n\x00', @ANYRES32=r8], 0x28}}, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r10 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r9, 0x8933, &(0x7f0000000300)={'syz_tun\x00'}) sendmsg$nl_route(r10, 0x0, 0x0) [ 379.697994][T16688] bridge200: port 2(erspan0) entered blocking state [ 379.704882][T16688] bridge200: port 2(erspan0) entered disabled state [ 379.719469][T16688] device erspan0 entered promiscuous mode [ 379.771227][T16695] netlink: 72 bytes leftover after parsing attributes in process `syz-executor.1'. [ 379.794359][T16702] device syz_tun left promiscuous mode [ 379.801583][T16702] bridge186: port 1(syz_tun) entered disabled state [ 379.917870][T16702] bridge187: port 1(syz_tun) entered blocking state [ 379.924636][T16702] bridge187: port 1(syz_tun) entered disabled state [ 379.933455][T16702] device syz_tun entered promiscuous mode [ 379.943394][T16707] device erspan0 left promiscuous mode [ 379.949639][T16707] bridge186: port 2(erspan0) entered disabled state [ 380.078075][T16707] bridge187: port 2(erspan0) entered blocking state [ 380.084935][T16707] bridge187: port 2(erspan0) entered disabled state [ 380.093093][T16707] device erspan0 entered promiscuous mode 15:24:22 executing program 5: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000340)={'erspan0\x00', 0x0}) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000300)={'syz_tun\x00', 0x0}) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r7, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r6, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000380)=@newlink={0x34, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r8}, [@IFLA_LINKINFO={0x14, 0x12, @bridge={{0xb, 0x1, 'bridge\x00'}, {0x4}}}]}, 0x34}}, 0x0) sendmsg$nl_route(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000002700)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r5}, [@IFLA_MASTER={0x8, 0xa, r8}]}, 0x28}}, 0x0) sendmsg$nl_route(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f00000000c0)=ANY=[@ANYBLOB="2800000010000104000040000000000000001ea6", @ANYRES32=r2, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00\b\x00\n\x00', @ANYRES32=r8], 0x28}}, 0x0) socketpair$unix(0x1, 0x2, 0x0, 0x0) r9 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000300)={'syz_tun\x00', 0x0}) sendmsg$nl_route(r9, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000040)=@newlink={0x2c, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r10}, [@IFLA_BROADCAST={0xa}]}, 0x332}}, 0x0) 15:24:22 executing program 3: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$devlink(&(0x7f00000041c0)='devlink\x00') sendmsg$DEVLINK_CMD_RELOAD(r0, &(0x7f0000004300)={0x0, 0x0, &(0x7f00000042c0)={&(0x7f0000004200)={0x3c, r1, 0x1, 0x0, 0x0, {}, [{@nsim={{0xe, 0x1, 'netdevsim\x00'}, {0xf, 0x2, {'netdevsim', 0x0}}}, @DEVLINK_ATTR_NETNS_FD={0x8}}]}, 0x345}}, 0x0) r2 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000040)='nl80211\x00') sendmsg$NL80211_CMD_DEL_KEY(r0, &(0x7f0000000180)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f0000000140)={&(0x7f0000000080)={0x94, r2, 0x0, 0x70bd2c, 0x25dfdbfb, {}, [@NL80211_ATTR_KEY_TYPE={0x8, 0x37, 0x3}, @NL80211_ATTR_KEY_IDX={0x5, 0x8, 0x2}, @NL80211_ATTR_KEY_DATA_WEP104={0x11, 0x7, "d42fb854c7fbac2558d73a94ec"}, @NL80211_ATTR_KEY_IDX={0x5, 0x8, 0x5}, @NL80211_ATTR_KEY_SEQ={0x13, 0xa, "5c32aadd98a9446f1b1521be32402f"}, @NL80211_ATTR_KEY={0x30, 0x50, [@NL80211_KEY_IDX={0x5, 0x2, 0x5}, @NL80211_KEY_DATA_WEP104={0x11, 0x1, "e2a98406e3bffdf71e4a4a4453"}, @NL80211_KEY_DEFAULT_TYPES={0x10, 0x8, [@NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_MULTICAST={0x4}]}]}, @NL80211_ATTR_KEY_DEFAULT_TYPES={0x8, 0x6e, [@NL80211_KEY_DEFAULT_TYPE_MULTICAST={0x4}]}, @NL80211_ATTR_KEY_TYPE={0x8}]}, 0x94}, 0x1, 0x0, 0x0, 0x4}, 0x80) 15:24:22 executing program 4: r0 = socket$inet6(0xa, 0x80003, 0x6b) ioctl(r0, 0x1000008912, &(0x7f00000001c0)="080db5055e0bcfe8476071") r1 = socket(0x10, 0x2, 0x0) sendto(r1, &(0x7f0000000200)="120000001200e7ef007b1a3fcd000000", 0x10, 0x0, 0x0, 0x0) recvmmsg(r1, &(0x7f00000037c0)=[{{&(0x7f0000000600)=@ethernet={0x0, @random}, 0x80, &(0x7f0000000380)=[{&(0x7f0000000040)=""/95, 0x2000007d}, {&(0x7f00000000c0)=""/85, 0x1f3}, {&(0x7f00000024c0)=""/4096, 0x1048}, {&(0x7f0000000400)=""/120, 0x1aa}, {&(0x7f0000000480)=""/60, 0xc6}, {&(0x7f0000000280)=""/77, 0x4d}, {&(0x7f0000000540)=""/154, 0x207}, {&(0x7f0000000340)=""/22, 0x1de}], 0x8, &(0x7f0000002400)=""/191, 0xfffffffffffffea2}}], 0x4000000000001de, 0x6, &(0x7f0000003700)={0x77359400}) [ 380.130768][T16719] device syz_tun left promiscuous mode [ 380.136454][T16719] bridge200: port 1(syz_tun) entered disabled state 15:24:22 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, 0x0}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000004c0)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r3, @ANYBLOB="0000000000000000280012000c0001007665746800000000180002001400010000000000", @ANYRES32=0x0, @ANYBLOB="00000000008433df6d6f6b577d4eaaf2000007"], 0x48}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000540)=ANY=[@ANYBLOB="7400000024000705000000000000000000010000", @ANYRES32=r3, @ANYBLOB="00000000ffffffff000000000800010073667100486818973f73461919309b68e1693572bb000229c6090032d0ed64f3c3545aaf6e000085a4e4ebb5ef670000000000000000000000000000001a4e624d29a84abf03265700000000000000000000000000000000000000000000000000000000000000ac20000089b53c947244306a0216a3de887763df5b42498b13bb1938de859ee6d7ae7dd2224dc672b69b4358871b170ea0b667832e5224ee3538f885b7abd9bc4a7d"], 0x74}}, 0x0) r4 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r4, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000300)=ANY=[@ANYBLOB="840000002c00010700"/20, @ANYRES32=r3, @ANYBLOB="0008008000000000030000000800010075333200580002001400050000000000000000000000000000000000400006003c0001000000000000001020898dde66057433b6ef3a41d22be225e0001b0000000000000000000000000017256ffc66e43a2484e1a912c5998bcbf0d0000000000000000000000000000000798a3c067277da1a290b9613a33c575c36fad473382c8f5532ef3f0e1d2c450a7decbf3431a69f9b2ecb3291bed174245a962fe0484676958265e2988326a89db3139d91fe4aee6ae7e745ab00001a9f61f20500000000000000b3958bc14fce6e66a36d1ab3194534ba4e973684b27793bff837d3"], 0x84}}, 0x0) r5 = socket(0x10, 0x80002, 0x0) sendmmsg$alg(r5, &(0x7f0000000140), 0x49249249249278c, 0x0) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r6, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000500)=@newlink={0x20, 0x11, 0x40d, 0x0, 0x0, {0x0, 0x0, 0x0, r8}}, 0x20}}, 0x0) r9 = socket(0x10, 0x80002, 0x0) getsockopt$inet_sctp_SCTP_PEER_AUTH_CHUNKS(0xffffffffffffffff, 0x84, 0x1a, &(0x7f0000000940)=ANY=[@ANYRES32=0x0, @ANYBLOB='\x00'/12], &(0x7f0000000980)=0x10) r10 = socket(0xa, 0x6, 0x0) close(r10) r11 = socket$inet6_sctp(0xa, 0x10000000005, 0x84) setsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX(r11, 0x84, 0x6e, &(0x7f0000000180)=[@in6={0xa, 0x0, 0x0, @remote, 0x9}], 0x1c) getsockopt$inet_sctp6_SCTP_GET_ASSOC_ID_LIST(r11, 0x84, 0x1d, &(0x7f000095dff8)={0x1, [0x0]}, &(0x7f000095dffc)=0x8) setsockopt$inet_sctp_SCTP_RTOINFO(r10, 0x84, 0x0, &(0x7f0000000000)={r12, 0x0, 0x0, 0x1000000}, 0x10) setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(0xffffffffffffffff, 0x84, 0x9, &(0x7f0000000680)={r12, @in={{0x2, 0x4e20, @remote}}, 0x10001, 0xfff7, 0x5, 0x1, 0x8, 0x5, 0xba}, 0x9c) ioctl(r9, 0x1000008912, &(0x7f00000001c0)="080db5055e0bcfe8696071") getsockopt$inet_sctp_SCTP_PEER_AUTH_CHUNKS(r9, 0x84, 0x1a, &(0x7f0000000940)=ANY=[@ANYRES32=0x0, @ANYBLOB='\x00'/12], &(0x7f0000000980)=0x10) r13 = socket$nl_generic(0x10, 0x3, 0x10) r14 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080)='nl80211\x00') r15 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL80211_CMD_GET_STATION(r15, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000240)={0x1c, r14, 0xf2b, 0x0, 0x0, {}, [@NL80211_ATTR_AIRTIME_WEIGHT={0x8}]}, 0x1c}}, 0x0) sendmsg$NL80211_CMD_GET_MPATH(r13, &(0x7f00000001c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x2000}, 0x268, &(0x7f0000000080)={&(0x7f0000000200)={0x40, r14, 0x4, 0x70bd2d, 0x25dfdbff}, 0xff6b}, 0x1, 0x0, 0x0, 0x10049050}, 0x260448c0) sendmsg$NL80211_CMD_NEW_KEY(r9, &(0x7f0000000640)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0xb0024000}, 0xc, &(0x7f00000002c0)={&(0x7f0000000440)={0x7c, r14, 0x23, 0x70bd27, 0x25dfdbff, {}, [@NL80211_ATTR_KEY_DATA_WEP40={0x9, 0x7, "a80875ab12"}, @NL80211_ATTR_KEY={0x5c, 0x50, [@NL80211_KEY_DEFAULT_TYPES={0x14, 0x8, [@NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_MULTICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_MULTICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_MULTICAST={0x4}]}, @NL80211_KEY_DEFAULT_TYPES={0x28, 0x8, [@NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_MULTICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_MULTICAST={0x4}]}, @NL80211_KEY_IDX={0x5, 0x2, 0x5}, @NL80211_KEY_DATA_WEP104={0x11, 0x1, "4d84c4e30151cb27f51a4adf63"}]}]}, 0x7c}, 0x1, 0x0, 0x0, 0x24000}, 0x40) 15:24:22 executing program 0: r0 = socket(0x21, 0xa, 0x1) r1 = socket(0x10, 0x80002, 0x0) ioctl(r1, 0x1000008912, &(0x7f00000001c0)="080db5055e0bcfe8696071") getsockopt$inet_sctp_SCTP_PEER_AUTH_CHUNKS(r1, 0x84, 0x1a, &(0x7f0000000940)=ANY=[@ANYRES32=0x0, @ANYBLOB='\x00'/12], &(0x7f0000000980)=0x10) getsockopt$inet_sctp_SCTP_GET_PEER_ADDR_INFO(r0, 0x84, 0xf, &(0x7f00000009c0)={r2, @in6={{0xa, 0x4e21, 0x8, @local, 0x401}}, 0x9, 0x1, 0x7, 0x7f, 0x6}, &(0x7f0000000a80)=0x98) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000400)='nl80211\x00') sendmsg$NL80211_CMD_GET_MESH_CONFIG(r0, &(0x7f0000000580)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x103190}, 0xc, &(0x7f0000000540)={&(0x7f0000000500)={0x34, r3, 0x10, 0x70bd2d, 0x25dfdbfe, {}, [@NL80211_ATTR_WDEV={0xc, 0x99, {0x1, 0xffffffffffffffff}}, @NL80211_ATTR_WIPHY={0x8, 0x1, 0x1}, @NL80211_ATTR_WDEV={0xc, 0x99, {0x3f, 0x3}}]}, 0x34}, 0x1, 0x0, 0x0, 0x800}, 0x40000) r4 = socket$nl_generic(0x10, 0x3, 0x10) bind$netlink(r4, &(0x7f0000000000)={0x10, 0x0, 0x0, 0x1004280}, 0xffffffffffffffb3) sendmsg$nl_generic(r4, &(0x7f0000000080)={&(0x7f0000000480)={0x10, 0xbb7f}, 0xc, &(0x7f0000000440)={&(0x7f00000004c0)={0x1c, 0x22, 0x1, 0x0, 0x0, {0x4}, [@typed={0x8, 0xc}]}, 0x1c}}, 0x0) socket$netlink(0x10, 0x3, 0x0) r5 = socket$alg(0x26, 0x5, 0x0) bind$alg(r5, &(0x7f0000000080)={0x26, 'hash\x00', 0x0, 0x0, 'sha512\x00'}, 0x58) 15:24:22 executing program 3: unshare(0x40000000) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x8031, 0xffffffffffffffff, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x7a05, 0x1700) r1 = socket$inet(0x2, 0x3, 0x2) setsockopt$inet_int(r1, 0x0, 0xade29b03e222e3f8, &(0x7f0000000000), 0x4) getsockopt$CAN_RAW_RECV_OWN_MSGS(r0, 0x65, 0x4, &(0x7f0000000040), &(0x7f0000000080)=0x4) [ 380.339006][T16719] bridge201: port 1(syz_tun) entered blocking state [ 380.348683][T16719] bridge201: port 1(syz_tun) entered disabled state [ 380.389680][T16719] device syz_tun entered promiscuous mode [ 380.407322][T16720] device erspan0 left promiscuous mode [ 380.413376][T16720] bridge200: port 2(erspan0) entered disabled state [ 380.455498][T16745] IPVS: ftp: loaded support on port[0] = 21 [ 380.547841][T16720] bridge201: port 2(erspan0) entered blocking state [ 380.557936][T16720] bridge201: port 2(erspan0) entered disabled state [ 380.579375][T16720] device erspan0 entered promiscuous mode 15:24:22 executing program 2: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000340)={'erspan0\x00', 0x0}) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000300)={'syz_tun\x00', 0x0}) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r7, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r6, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000380)=@newlink={0x34, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r8}, [@IFLA_LINKINFO={0x14, 0x12, @bridge={{0xb, 0x1, 'bridge\x00'}, {0x4}}}]}, 0x34}}, 0x0) sendmsg$nl_route(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000002700)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r5}, [@IFLA_MASTER={0x8, 0xa, r8}]}, 0x28}}, 0x0) sendmsg$nl_route(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f00000000c0)=ANY=[@ANYBLOB="2800000010000104000040000000000000001ea6", @ANYRES32=r2, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00\b\x00\n\x00', @ANYRES32=r8], 0x28}}, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r10 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r9, 0x8933, &(0x7f0000000300)={'syz_tun\x00'}) sendmsg$nl_route(r10, &(0x7f0000000000)={0x0, 0x0, 0x0}, 0x0) [ 380.609686][T16737] device syz_tun left promiscuous mode [ 380.616856][T16737] bridge187: port 1(syz_tun) entered disabled state [ 380.748100][T16737] bridge188: port 1(syz_tun) entered blocking state [ 380.755060][T16737] bridge188: port 1(syz_tun) entered disabled state [ 380.763969][T16737] device syz_tun entered promiscuous mode [ 380.781513][T16741] device erspan0 left promiscuous mode [ 380.790881][T16741] bridge187: port 2(erspan0) entered disabled state [ 380.918643][T16741] bridge188: port 2(erspan0) entered blocking state [ 380.925298][T16741] bridge188: port 2(erspan0) entered disabled state [ 380.938847][T16741] device erspan0 entered promiscuous mode [ 380.946400][T16743] netlink: 72 bytes leftover after parsing attributes in process `syz-executor.1'. 15:24:23 executing program 5: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000340)={'erspan0\x00', 0x0}) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000300)={'syz_tun\x00', 0x0}) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r7, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r6, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000380)=@newlink={0x34, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r8}, [@IFLA_LINKINFO={0x14, 0x12, @bridge={{0xb, 0x1, 'bridge\x00'}, {0x4}}}]}, 0x34}}, 0x0) sendmsg$nl_route(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000002700)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r5}, [@IFLA_MASTER={0x8, 0xa, r8}]}, 0x28}}, 0x0) sendmsg$nl_route(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f00000000c0)=ANY=[@ANYBLOB="2800000010000104000040000000000000001ea6", @ANYRES32=r2, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00\b\x00\n\x00', @ANYRES32=r8], 0x28}}, 0x0) socketpair$unix(0x1, 0x2, 0x0, 0x0) r9 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000300)={'syz_tun\x00', 0x0}) sendmsg$nl_route(r9, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000040)=@newlink={0x2c, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r10}, [@IFLA_BROADCAST={0xa}]}, 0x332}}, 0x0) [ 380.984143][T16758] device syz_tun left promiscuous mode [ 381.005463][T16758] bridge201: port 1(syz_tun) entered disabled state 15:24:23 executing program 4: r0 = socket$inet6(0xa, 0x80003, 0x6b) ioctl(r0, 0x1000008912, &(0x7f00000001c0)="080db5055e0bcfe8476071") r1 = socket(0x10, 0x2, 0x0) sendto(r1, &(0x7f0000000200)="120000001200e7ef007b1a3fcd00000000", 0x11, 0x0, 0x0, 0x0) recvmmsg(r1, &(0x7f00000037c0)=[{{&(0x7f0000000600)=@ethernet={0x0, @random}, 0x80, &(0x7f0000000380)=[{&(0x7f0000000040)=""/95, 0x2000007d}, {&(0x7f00000000c0)=""/85, 0x1f3}, {&(0x7f00000024c0)=""/4096, 0x1048}, {&(0x7f0000000400)=""/120, 0x1aa}, {&(0x7f0000000480)=""/60, 0xc6}, {&(0x7f0000000280)=""/77, 0x4d}, {&(0x7f0000000540)=""/154, 0x207}, {&(0x7f0000000340)=""/22, 0x1de}], 0x8, &(0x7f0000002400)=""/191, 0xfffffffffffffea2}}], 0x4000000000001de, 0x6, &(0x7f0000003700)={0x77359400}) [ 381.138005][T16758] bridge202: port 1(syz_tun) entered blocking state [ 381.147271][T16758] bridge202: port 1(syz_tun) entered disabled state [ 381.177848][T16758] device syz_tun entered promiscuous mode [ 381.189835][T16759] device erspan0 left promiscuous mode [ 381.195913][T16759] bridge201: port 2(erspan0) entered disabled state [ 381.247077][T16749] IPVS: ftp: loaded support on port[0] = 21 [ 381.318635][T16759] bridge202: port 2(erspan0) entered blocking state [ 381.325319][T16759] bridge202: port 2(erspan0) entered disabled state [ 381.349184][T16759] device erspan0 entered promiscuous mode 15:24:23 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(0xffffffffffffffff, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000004c0)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r3, @ANYBLOB="0000000000000000280012000c0001007665746800000000180002001400010000000000", @ANYRES32=0x0, @ANYBLOB="00000000008433df6d6f6b577d4eaaf2000007"], 0x48}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000540)=ANY=[@ANYBLOB="7400000024000705000000000000000000010000", @ANYRES32=r3, @ANYBLOB="00000000ffffffff000000000800010073667100486818973f73461919309b68e1693572bb000229c6090032d0ed64f3c3545aaf6e000085a4e4ebb5ef670000000000000000000000000000001a4e624d29a84abf03265700000000000000000000000000000000000000000000000000000000000000ac20000089b53c947244306a0216a3de887763df5b42498b13bb1938de859ee6d7ae7dd2224dc672b69b4358871b170ea0b667832e5224ee3538f885b7abd9bc4a7d"], 0x74}}, 0x0) r4 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r4, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000300)=ANY=[@ANYBLOB="840000002c00010700"/20, @ANYRES32=r3, @ANYBLOB="0008008000000000030000000800010075333200580002001400050000000000000000000000000000000000400006003c0001000000000000001020898dde66057433b6ef3a41d22be225e0001b0000000000000000000000000017256ffc66e43a2484e1a912c5998bcbf0d0000000000000000000000000000000798a3c067277da1a290b9613a33c575c36fad473382c8f5532ef3f0e1d2c450a7decbf3431a69f9b2ecb3291bed174245a962fe0484676958265e2988326a89db3139d91fe4aee6ae7e745ab00001a9f61f20500000000000000b3958bc14fce6e66a36d1ab3194534ba4e973684b27793bff837d3"], 0x84}}, 0x0) r5 = socket(0x10, 0x80002, 0x0) sendmmsg$alg(r5, &(0x7f0000000140), 0x49249249249278c, 0x0) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r6, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000500)=@newlink={0x20, 0x11, 0x40d, 0x0, 0x0, {0x0, 0x0, 0x0, r8}}, 0x20}}, 0x0) r9 = socket(0x10, 0x80002, 0x0) getsockopt$inet_sctp_SCTP_PEER_AUTH_CHUNKS(0xffffffffffffffff, 0x84, 0x1a, &(0x7f0000000940)=ANY=[@ANYRES32=0x0, @ANYBLOB='\x00'/12], &(0x7f0000000980)=0x10) r10 = socket(0xa, 0x6, 0x0) close(r10) r11 = socket$inet6_sctp(0xa, 0x10000000005, 0x84) setsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX(r11, 0x84, 0x6e, &(0x7f0000000180)=[@in6={0xa, 0x0, 0x0, @remote, 0x9}], 0x1c) getsockopt$inet_sctp6_SCTP_GET_ASSOC_ID_LIST(r11, 0x84, 0x1d, &(0x7f000095dff8)={0x1, [0x0]}, &(0x7f000095dffc)=0x8) setsockopt$inet_sctp_SCTP_RTOINFO(r10, 0x84, 0x0, &(0x7f0000000000)={r12, 0x0, 0x0, 0x1000000}, 0x10) setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(0xffffffffffffffff, 0x84, 0x9, &(0x7f0000000680)={r12, @in={{0x2, 0x4e20, @remote}}, 0x10001, 0xfff7, 0x5, 0x1, 0x8, 0x5, 0xba}, 0x9c) ioctl(r9, 0x1000008912, &(0x7f00000001c0)="080db5055e0bcfe8696071") getsockopt$inet_sctp_SCTP_PEER_AUTH_CHUNKS(r9, 0x84, 0x1a, &(0x7f0000000940)=ANY=[@ANYRES32=0x0, @ANYBLOB='\x00'/12], &(0x7f0000000980)=0x10) r13 = socket$nl_generic(0x10, 0x3, 0x10) r14 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080)='nl80211\x00') r15 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL80211_CMD_GET_STATION(r15, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000240)={0x1c, r14, 0xf2b, 0x0, 0x0, {}, [@NL80211_ATTR_AIRTIME_WEIGHT={0x8}]}, 0x1c}}, 0x0) sendmsg$NL80211_CMD_GET_MPATH(r13, &(0x7f00000001c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x2000}, 0x268, &(0x7f0000000080)={&(0x7f0000000200)={0x40, r14, 0x4, 0x70bd2d, 0x25dfdbff}, 0xff6b}, 0x1, 0x0, 0x0, 0x10049050}, 0x260448c0) sendmsg$NL80211_CMD_NEW_KEY(r9, &(0x7f0000000640)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0xb0024000}, 0xc, &(0x7f00000002c0)={&(0x7f0000000440)={0x7c, r14, 0x23, 0x70bd27, 0x25dfdbff, {}, [@NL80211_ATTR_KEY_DATA_WEP40={0x9, 0x7, "a80875ab12"}, @NL80211_ATTR_KEY={0x5c, 0x50, [@NL80211_KEY_DEFAULT_TYPES={0x14, 0x8, [@NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_MULTICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_MULTICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_MULTICAST={0x4}]}, @NL80211_KEY_DEFAULT_TYPES={0x28, 0x8, [@NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_MULTICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_MULTICAST={0x4}]}, @NL80211_KEY_IDX={0x5, 0x2, 0x5}, @NL80211_KEY_DATA_WEP104={0x11, 0x1, "4d84c4e30151cb27f51a4adf63"}]}]}, 0x7c}, 0x1, 0x0, 0x0, 0x24000}, 0x40) 15:24:23 executing program 0: r0 = socket(0x21, 0xa, 0x1) r1 = socket(0x10, 0x80002, 0x0) ioctl(r1, 0x1000008912, &(0x7f00000001c0)="080db5055e0bcfe8696071") getsockopt$inet_sctp_SCTP_PEER_AUTH_CHUNKS(r1, 0x84, 0x1a, &(0x7f0000000940)=ANY=[@ANYRES32=0x0, @ANYBLOB='\x00'/12], &(0x7f0000000980)=0x10) getsockopt$inet_sctp_SCTP_GET_PEER_ADDR_INFO(r0, 0x84, 0xf, &(0x7f00000009c0)={r2, @in6={{0xa, 0x4e21, 0x8, @local, 0x401}}, 0x9, 0x1, 0x7, 0x7f, 0x6}, &(0x7f0000000a80)=0x98) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000400)='nl80211\x00') sendmsg$NL80211_CMD_GET_MESH_CONFIG(r0, &(0x7f0000000580)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x103190}, 0xc, &(0x7f0000000540)={&(0x7f0000000500)={0x34, r3, 0x10, 0x70bd2d, 0x25dfdbfe, {}, [@NL80211_ATTR_WDEV={0xc, 0x99, {0x1, 0xffffffffffffffff}}, @NL80211_ATTR_WIPHY={0x8, 0x1, 0x1}, @NL80211_ATTR_WDEV={0xc, 0x99, {0x3f, 0x3}}]}, 0x34}, 0x1, 0x0, 0x0, 0x800}, 0x40000) r4 = socket$nl_generic(0x10, 0x3, 0x10) bind$netlink(r4, &(0x7f0000000000)={0x10, 0x0, 0x0, 0x1004280}, 0xffffffffffffffb3) sendmsg$nl_generic(r4, &(0x7f0000000080)={&(0x7f0000000480)={0x10, 0xbb7f}, 0xc, &(0x7f0000000440)={&(0x7f00000004c0)={0x1c, 0x22, 0x1, 0x0, 0x0, {0x4}, [@typed={0x8, 0xc}]}, 0x1c}}, 0x0) socket$netlink(0x10, 0x3, 0x0) r5 = socket$alg(0x26, 0x5, 0x0) bind$alg(r5, &(0x7f0000000080)={0x26, 'hash\x00', 0x0, 0x0, 'sha512\x00'}, 0x58) 15:24:23 executing program 2: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000340)={'erspan0\x00', 0x0}) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000300)={'syz_tun\x00', 0x0}) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r7, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r6, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000380)=@newlink={0x34, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r8}, [@IFLA_LINKINFO={0x14, 0x12, @bridge={{0xb, 0x1, 'bridge\x00'}, {0x4}}}]}, 0x34}}, 0x0) sendmsg$nl_route(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000002700)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r5}, [@IFLA_MASTER={0x8, 0xa, r8}]}, 0x28}}, 0x0) sendmsg$nl_route(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f00000000c0)=ANY=[@ANYBLOB="2800000010000104000040000000000000001ea6", @ANYRES32=r2, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00\b\x00\n\x00', @ANYRES32=r8], 0x28}}, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r10 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r9, 0x8933, &(0x7f0000000300)={'syz_tun\x00'}) sendmsg$nl_route(r10, &(0x7f0000000000)={0x0, 0x0, 0x0}, 0x0) [ 381.411023][T16764] device syz_tun left promiscuous mode [ 381.430306][T16764] bridge188: port 1(syz_tun) entered disabled state [ 381.618461][T16764] bridge189: port 1(syz_tun) entered blocking state [ 381.632325][T16764] bridge189: port 1(syz_tun) entered disabled state [ 381.644989][T16764] device syz_tun entered promiscuous mode [ 381.663454][T16765] device erspan0 left promiscuous mode [ 381.674746][T16765] bridge188: port 2(erspan0) entered disabled state 15:24:23 executing program 5: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000340)={'erspan0\x00', 0x0}) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000300)={'syz_tun\x00', 0x0}) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r7, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r6, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000380)=@newlink={0x34, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r8}, [@IFLA_LINKINFO={0x14, 0x12, @bridge={{0xb, 0x1, 'bridge\x00'}, {0x4}}}]}, 0x34}}, 0x0) sendmsg$nl_route(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000002700)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r5}, [@IFLA_MASTER={0x8, 0xa, r8}]}, 0x28}}, 0x0) sendmsg$nl_route(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f00000000c0)=ANY=[@ANYBLOB="2800000010000104000040000000000000001ea6", @ANYRES32=r2, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00\b\x00\n\x00', @ANYRES32=r8], 0x28}}, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)) r9 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000300)={'syz_tun\x00', 0x0}) sendmsg$nl_route(r9, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000040)=@newlink={0x2c, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r10}, [@IFLA_BROADCAST={0xa}]}, 0x332}}, 0x0) [ 381.798411][T16765] bridge189: port 2(erspan0) entered blocking state [ 381.805407][T16765] bridge189: port 2(erspan0) entered disabled state [ 381.813780][T16765] device erspan0 entered promiscuous mode 15:24:24 executing program 4: r0 = socket$inet6(0xa, 0x80003, 0x6b) ioctl(r0, 0x1000008912, &(0x7f00000001c0)="080db5055e0bcfe8476071") r1 = socket(0x10, 0x2, 0x0) sendto(r1, &(0x7f0000000200)="120000001200e7ef007b1a3fcd00000000", 0x11, 0x0, 0x0, 0x0) recvmmsg(r1, &(0x7f00000037c0)=[{{&(0x7f0000000600)=@ethernet={0x0, @random}, 0x80, &(0x7f0000000380)=[{&(0x7f0000000040)=""/95, 0x2000007d}, {&(0x7f00000000c0)=""/85, 0x1f3}, {&(0x7f00000024c0)=""/4096, 0x1048}, {&(0x7f0000000400)=""/120, 0x1aa}, {&(0x7f0000000480)=""/60, 0xc6}, {&(0x7f0000000280)=""/77, 0x4d}, {&(0x7f0000000540)=""/154, 0x207}, {&(0x7f0000000340)=""/22, 0x1de}], 0x8, &(0x7f0000002400)=""/191, 0xfffffffffffffea2}}], 0x4000000000001de, 0x6, &(0x7f0000003700)={0x77359400}) [ 381.999710][T16778] netlink: 72 bytes leftover after parsing attributes in process `syz-executor.1'. [ 382.065783][T16784] device syz_tun left promiscuous mode [ 382.072189][T16784] bridge202: port 1(syz_tun) entered disabled state [ 382.187740][T16784] bridge203: port 1(syz_tun) entered blocking state [ 382.194550][T16784] bridge203: port 1(syz_tun) entered disabled state [ 382.202754][T16784] device syz_tun entered promiscuous mode [ 382.211729][T16788] device erspan0 left promiscuous mode [ 382.217413][T16788] bridge202: port 2(erspan0) entered disabled state 15:24:24 executing program 2: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000340)={'erspan0\x00', 0x0}) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000300)={'syz_tun\x00', 0x0}) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r7, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r6, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000380)=@newlink={0x34, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r8}, [@IFLA_LINKINFO={0x14, 0x12, @bridge={{0xb, 0x1, 'bridge\x00'}, {0x4}}}]}, 0x34}}, 0x0) sendmsg$nl_route(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000002700)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r5}, [@IFLA_MASTER={0x8, 0xa, r8}]}, 0x28}}, 0x0) sendmsg$nl_route(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f00000000c0)=ANY=[@ANYBLOB="2800000010000104000040000000000000001ea6", @ANYRES32=r2, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00\b\x00\n\x00', @ANYRES32=r8], 0x28}}, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r10 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r9, 0x8933, &(0x7f0000000300)={'syz_tun\x00'}) sendmsg$nl_route(r10, &(0x7f0000000000)={0x0, 0x0, 0x0}, 0x0) [ 382.337867][T16788] bridge203: port 2(erspan0) entered blocking state [ 382.344710][T16788] bridge203: port 2(erspan0) entered disabled state [ 382.352867][T16788] device erspan0 entered promiscuous mode [ 382.366562][T16797] device syz_tun left promiscuous mode [ 382.377137][T16797] bridge189: port 1(syz_tun) entered disabled state [ 382.507831][T16797] bridge190: port 1(syz_tun) entered blocking state [ 382.514613][T16797] bridge190: port 1(syz_tun) entered disabled state [ 382.526858][T16797] device syz_tun entered promiscuous mode [ 382.534712][T16798] device erspan0 left promiscuous mode [ 382.541308][T16798] bridge189: port 2(erspan0) entered disabled state [ 382.678316][T16798] bridge190: port 2(erspan0) entered blocking state [ 382.685168][T16798] bridge190: port 2(erspan0) entered disabled state [ 382.693505][T16798] device erspan0 entered promiscuous mode 15:24:24 executing program 5: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000340)={'erspan0\x00', 0x0}) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000300)={'syz_tun\x00', 0x0}) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r7, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r6, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000380)=@newlink={0x34, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r8}, [@IFLA_LINKINFO={0x14, 0x12, @bridge={{0xb, 0x1, 'bridge\x00'}, {0x4}}}]}, 0x34}}, 0x0) sendmsg$nl_route(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000002700)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r5}, [@IFLA_MASTER={0x8, 0xa, r8}]}, 0x28}}, 0x0) sendmsg$nl_route(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f00000000c0)=ANY=[@ANYBLOB="2800000010000104000040000000000000001ea6", @ANYRES32=r2, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00\b\x00\n\x00', @ANYRES32=r8], 0x28}}, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)) r9 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000300)={'syz_tun\x00', 0x0}) sendmsg$nl_route(r9, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000040)=@newlink={0x2c, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r10}, [@IFLA_BROADCAST={0xa}]}, 0x332}}, 0x0) 15:24:24 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(0xffffffffffffffff, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000004c0)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r3, @ANYBLOB="0000000000000000280012000c0001007665746800000000180002001400010000000000", @ANYRES32=0x0, @ANYBLOB="00000000008433df6d6f6b577d4eaaf2000007"], 0x48}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000540)=ANY=[@ANYBLOB="7400000024000705000000000000000000010000", @ANYRES32=r3, @ANYBLOB="00000000ffffffff000000000800010073667100486818973f73461919309b68e1693572bb000229c6090032d0ed64f3c3545aaf6e000085a4e4ebb5ef670000000000000000000000000000001a4e624d29a84abf03265700000000000000000000000000000000000000000000000000000000000000ac20000089b53c947244306a0216a3de887763df5b42498b13bb1938de859ee6d7ae7dd2224dc672b69b4358871b170ea0b667832e5224ee3538f885b7abd9bc4a7d"], 0x74}}, 0x0) r4 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r4, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000300)=ANY=[@ANYBLOB="840000002c00010700"/20, @ANYRES32=r3, @ANYBLOB="0008008000000000030000000800010075333200580002001400050000000000000000000000000000000000400006003c0001000000000000001020898dde66057433b6ef3a41d22be225e0001b0000000000000000000000000017256ffc66e43a2484e1a912c5998bcbf0d0000000000000000000000000000000798a3c067277da1a290b9613a33c575c36fad473382c8f5532ef3f0e1d2c450a7decbf3431a69f9b2ecb3291bed174245a962fe0484676958265e2988326a89db3139d91fe4aee6ae7e745ab00001a9f61f20500000000000000b3958bc14fce6e66a36d1ab3194534ba4e973684b27793bff837d3"], 0x84}}, 0x0) r5 = socket(0x10, 0x80002, 0x0) sendmmsg$alg(r5, &(0x7f0000000140), 0x49249249249278c, 0x0) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r6, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000500)=@newlink={0x20, 0x11, 0x40d, 0x0, 0x0, {0x0, 0x0, 0x0, r8}}, 0x20}}, 0x0) r9 = socket(0x10, 0x80002, 0x0) getsockopt$inet_sctp_SCTP_PEER_AUTH_CHUNKS(0xffffffffffffffff, 0x84, 0x1a, &(0x7f0000000940)=ANY=[@ANYRES32=0x0, @ANYBLOB='\x00'/12], &(0x7f0000000980)=0x10) r10 = socket(0xa, 0x6, 0x0) close(r10) r11 = socket$inet6_sctp(0xa, 0x10000000005, 0x84) setsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX(r11, 0x84, 0x6e, &(0x7f0000000180)=[@in6={0xa, 0x0, 0x0, @remote, 0x9}], 0x1c) getsockopt$inet_sctp6_SCTP_GET_ASSOC_ID_LIST(r11, 0x84, 0x1d, &(0x7f000095dff8)={0x1, [0x0]}, &(0x7f000095dffc)=0x8) setsockopt$inet_sctp_SCTP_RTOINFO(r10, 0x84, 0x0, &(0x7f0000000000)={r12, 0x0, 0x0, 0x1000000}, 0x10) setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(0xffffffffffffffff, 0x84, 0x9, &(0x7f0000000680)={r12, @in={{0x2, 0x4e20, @remote}}, 0x10001, 0xfff7, 0x5, 0x1, 0x8, 0x5, 0xba}, 0x9c) ioctl(r9, 0x1000008912, &(0x7f00000001c0)="080db5055e0bcfe8696071") getsockopt$inet_sctp_SCTP_PEER_AUTH_CHUNKS(r9, 0x84, 0x1a, &(0x7f0000000940)=ANY=[@ANYRES32=0x0, @ANYBLOB='\x00'/12], &(0x7f0000000980)=0x10) r13 = socket$nl_generic(0x10, 0x3, 0x10) r14 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080)='nl80211\x00') r15 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL80211_CMD_GET_STATION(r15, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000240)={0x1c, r14, 0xf2b, 0x0, 0x0, {}, [@NL80211_ATTR_AIRTIME_WEIGHT={0x8}]}, 0x1c}}, 0x0) sendmsg$NL80211_CMD_GET_MPATH(r13, &(0x7f00000001c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x2000}, 0x268, &(0x7f0000000080)={&(0x7f0000000200)={0x40, r14, 0x4, 0x70bd2d, 0x25dfdbff}, 0xff6b}, 0x1, 0x0, 0x0, 0x10049050}, 0x260448c0) sendmsg$NL80211_CMD_NEW_KEY(r9, &(0x7f0000000640)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0xb0024000}, 0xc, &(0x7f00000002c0)={&(0x7f0000000440)={0x7c, r14, 0x23, 0x70bd27, 0x25dfdbff, {}, [@NL80211_ATTR_KEY_DATA_WEP40={0x9, 0x7, "a80875ab12"}, @NL80211_ATTR_KEY={0x5c, 0x50, [@NL80211_KEY_DEFAULT_TYPES={0x14, 0x8, [@NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_MULTICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_MULTICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_MULTICAST={0x4}]}, @NL80211_KEY_DEFAULT_TYPES={0x28, 0x8, [@NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_MULTICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_MULTICAST={0x4}]}, @NL80211_KEY_IDX={0x5, 0x2, 0x5}, @NL80211_KEY_DATA_WEP104={0x11, 0x1, "4d84c4e30151cb27f51a4adf63"}]}]}, 0x7c}, 0x1, 0x0, 0x0, 0x24000}, 0x40) [ 382.773641][T16807] device syz_tun left promiscuous mode [ 382.814827][T16807] bridge203: port 1(syz_tun) entered disabled state [ 382.988090][T16807] bridge204: port 1(syz_tun) entered blocking state [ 382.995021][T16807] bridge204: port 1(syz_tun) entered disabled state [ 383.014173][T16807] device syz_tun entered promiscuous mode [ 383.026260][T16808] device erspan0 left promiscuous mode [ 383.035229][T16808] bridge203: port 2(erspan0) entered disabled state [ 383.217900][T16808] bridge204: port 2(erspan0) entered blocking state [ 383.225108][T16808] bridge204: port 2(erspan0) entered disabled state [ 383.245011][T16808] device erspan0 entered promiscuous mode [ 383.538950][T16817] device syz_tun left promiscuous mode [ 383.544775][T16817] bridge190: port 1(syz_tun) entered disabled state [ 383.711357][T16817] bridge191: port 1(syz_tun) entered blocking state [ 383.718240][T16817] bridge191: port 1(syz_tun) entered disabled state [ 383.725979][T16817] device syz_tun entered promiscuous mode [ 383.734212][T16818] netlink: 72 bytes leftover after parsing attributes in process `syz-executor.1'. [ 383.744055][T16820] device erspan0 left promiscuous mode [ 383.750201][T16820] bridge190: port 2(erspan0) entered disabled state [ 383.880210][T16820] bridge191: port 2(erspan0) entered blocking state [ 383.886884][T16820] bridge191: port 2(erspan0) entered disabled state [ 383.894740][T16820] device erspan0 entered promiscuous mode 15:24:28 executing program 3: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000340)={'erspan0\x00', 0x0}) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000300)={'syz_tun\x00', 0x0}) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r7, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r6, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000380)=@newlink={0x34, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r8}, [@IFLA_LINKINFO={0x14, 0x12, @bridge={{0xb, 0x1, 'bridge\x00'}, {0x4}}}]}, 0x34}}, 0x0) sendmsg$nl_route(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000002700)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r5}, [@IFLA_MASTER={0x8, 0xa, r8}]}, 0x28}}, 0x0) sendmsg$nl_route(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f00000000c0)=ANY=[@ANYBLOB="2800000010000104000040000000000000001ea6", @ANYRES32=r2, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00\b\x00\n\x00', @ANYRES32=r8], 0x28}}, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)) r9 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000300)={'syz_tun\x00', 0x0}) sendmsg$nl_route(r9, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000040)=@newlink={0x2c, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r10}, [@IFLA_BROADCAST={0xa}]}, 0x332}}, 0x0) 15:24:28 executing program 4: r0 = socket$inet6(0xa, 0x80003, 0x6b) ioctl(r0, 0x1000008912, &(0x7f00000001c0)="080db5055e0bcfe8476071") r1 = socket(0x10, 0x2, 0x0) sendto(r1, &(0x7f0000000200)="120000001200e7ef007b1a3fcd00000000", 0x11, 0x0, 0x0, 0x0) recvmmsg(r1, &(0x7f00000037c0)=[{{&(0x7f0000000600)=@ethernet={0x0, @random}, 0x80, &(0x7f0000000380)=[{&(0x7f0000000040)=""/95, 0x2000007d}, {&(0x7f00000000c0)=""/85, 0x1f3}, {&(0x7f00000024c0)=""/4096, 0x1048}, {&(0x7f0000000400)=""/120, 0x1aa}, {&(0x7f0000000480)=""/60, 0xc6}, {&(0x7f0000000280)=""/77, 0x4d}, {&(0x7f0000000540)=""/154, 0x207}, {&(0x7f0000000340)=""/22, 0x1de}], 0x8, &(0x7f0000002400)=""/191, 0xfffffffffffffea2}}], 0x4000000000001de, 0x6, &(0x7f0000003700)={0x77359400}) 15:24:28 executing program 0: r0 = socket(0x21, 0xa, 0x1) r1 = socket(0x10, 0x80002, 0x0) ioctl(r1, 0x1000008912, &(0x7f00000001c0)="080db5055e0bcfe8696071") getsockopt$inet_sctp_SCTP_PEER_AUTH_CHUNKS(r1, 0x84, 0x1a, &(0x7f0000000940)=ANY=[@ANYRES32=0x0, @ANYBLOB='\x00'/12], &(0x7f0000000980)=0x10) getsockopt$inet_sctp_SCTP_GET_PEER_ADDR_INFO(r0, 0x84, 0xf, &(0x7f00000009c0)={r2, @in6={{0xa, 0x4e21, 0x8, @local, 0x401}}, 0x9, 0x1, 0x7, 0x7f, 0x6}, &(0x7f0000000a80)=0x98) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000400)='nl80211\x00') sendmsg$NL80211_CMD_GET_MESH_CONFIG(r0, &(0x7f0000000580)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x103190}, 0xc, &(0x7f0000000540)={&(0x7f0000000500)={0x34, r3, 0x10, 0x70bd2d, 0x25dfdbfe, {}, [@NL80211_ATTR_WDEV={0xc, 0x99, {0x1, 0xffffffffffffffff}}, @NL80211_ATTR_WIPHY={0x8, 0x1, 0x1}, @NL80211_ATTR_WDEV={0xc, 0x99, {0x3f, 0x3}}]}, 0x34}, 0x1, 0x0, 0x0, 0x800}, 0x40000) r4 = socket$nl_generic(0x10, 0x3, 0x10) bind$netlink(r4, &(0x7f0000000000)={0x10, 0x0, 0x0, 0x1004280}, 0xffffffffffffffb3) sendmsg$nl_generic(r4, &(0x7f0000000080)={&(0x7f0000000480)={0x10, 0xbb7f}, 0xc, &(0x7f0000000440)={&(0x7f00000004c0)={0x1c, 0x22, 0x1, 0x0, 0x0, {0x4}, [@typed={0x8, 0xc}]}, 0x1c}}, 0x0) socket$netlink(0x10, 0x3, 0x0) r5 = socket$alg(0x26, 0x5, 0x0) bind$alg(r5, &(0x7f0000000080)={0x26, 'hash\x00', 0x0, 0x0, 'sha512\x00'}, 0x58) 15:24:28 executing program 2: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000340)={'erspan0\x00', 0x0}) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000300)={'syz_tun\x00', 0x0}) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r7, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r6, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000380)=@newlink={0x34, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r8}, [@IFLA_LINKINFO={0x14, 0x12, @bridge={{0xb, 0x1, 'bridge\x00'}, {0x4}}}]}, 0x34}}, 0x0) sendmsg$nl_route(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000002700)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r5}, [@IFLA_MASTER={0x8, 0xa, r8}]}, 0x28}}, 0x0) sendmsg$nl_route(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f00000000c0)=ANY=[@ANYBLOB="2800000010000104000040000000000000001ea6", @ANYRES32=r2, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00\b\x00\n\x00', @ANYRES32=r8], 0x28}}, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r10 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r9, 0x8933, &(0x7f0000000300)={'syz_tun\x00'}) sendmsg$nl_route(r10, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={0x0}}, 0x0) 15:24:28 executing program 5: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000340)={'erspan0\x00', 0x0}) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000300)={'syz_tun\x00', 0x0}) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r7, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r6, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000380)=@newlink={0x34, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r8}, [@IFLA_LINKINFO={0x14, 0x12, @bridge={{0xb, 0x1, 'bridge\x00'}, {0x4}}}]}, 0x34}}, 0x0) sendmsg$nl_route(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000002700)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r5}, [@IFLA_MASTER={0x8, 0xa, r8}]}, 0x28}}, 0x0) sendmsg$nl_route(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f00000000c0)=ANY=[@ANYBLOB="2800000010000104000040000000000000001ea6", @ANYRES32=r2, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00\b\x00\n\x00', @ANYRES32=r8], 0x28}}, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)) r9 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000300)={'syz_tun\x00', 0x0}) sendmsg$nl_route(r9, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000040)=@newlink={0x2c, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r10}, [@IFLA_BROADCAST={0xa}]}, 0x332}}, 0x0) 15:24:28 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(0xffffffffffffffff, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000004c0)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r3, @ANYBLOB="0000000000000000280012000c0001007665746800000000180002001400010000000000", @ANYRES32=0x0, @ANYBLOB="00000000008433df6d6f6b577d4eaaf2000007"], 0x48}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000540)=ANY=[@ANYBLOB="7400000024000705000000000000000000010000", @ANYRES32=r3, @ANYBLOB="00000000ffffffff000000000800010073667100486818973f73461919309b68e1693572bb000229c6090032d0ed64f3c3545aaf6e000085a4e4ebb5ef670000000000000000000000000000001a4e624d29a84abf03265700000000000000000000000000000000000000000000000000000000000000ac20000089b53c947244306a0216a3de887763df5b42498b13bb1938de859ee6d7ae7dd2224dc672b69b4358871b170ea0b667832e5224ee3538f885b7abd9bc4a7d"], 0x74}}, 0x0) r4 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r4, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000300)=ANY=[@ANYBLOB="840000002c00010700"/20, @ANYRES32=r3, @ANYBLOB="0008008000000000030000000800010075333200580002001400050000000000000000000000000000000000400006003c0001000000000000001020898dde66057433b6ef3a41d22be225e0001b0000000000000000000000000017256ffc66e43a2484e1a912c5998bcbf0d0000000000000000000000000000000798a3c067277da1a290b9613a33c575c36fad473382c8f5532ef3f0e1d2c450a7decbf3431a69f9b2ecb3291bed174245a962fe0484676958265e2988326a89db3139d91fe4aee6ae7e745ab00001a9f61f20500000000000000b3958bc14fce6e66a36d1ab3194534ba4e973684b27793bff837d3"], 0x84}}, 0x0) r5 = socket(0x10, 0x80002, 0x0) sendmmsg$alg(r5, &(0x7f0000000140), 0x49249249249278c, 0x0) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r6, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000500)=@newlink={0x20, 0x11, 0x40d, 0x0, 0x0, {0x0, 0x0, 0x0, r8}}, 0x20}}, 0x0) r9 = socket(0x10, 0x80002, 0x0) getsockopt$inet_sctp_SCTP_PEER_AUTH_CHUNKS(0xffffffffffffffff, 0x84, 0x1a, &(0x7f0000000940)=ANY=[@ANYRES32=0x0, @ANYBLOB='\x00'/12], &(0x7f0000000980)=0x10) r10 = socket(0xa, 0x6, 0x0) close(r10) r11 = socket$inet6_sctp(0xa, 0x10000000005, 0x84) setsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX(r11, 0x84, 0x6e, &(0x7f0000000180)=[@in6={0xa, 0x0, 0x0, @remote, 0x9}], 0x1c) getsockopt$inet_sctp6_SCTP_GET_ASSOC_ID_LIST(r11, 0x84, 0x1d, &(0x7f000095dff8)={0x1, [0x0]}, &(0x7f000095dffc)=0x8) setsockopt$inet_sctp_SCTP_RTOINFO(r10, 0x84, 0x0, &(0x7f0000000000)={r12, 0x0, 0x0, 0x1000000}, 0x10) setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(0xffffffffffffffff, 0x84, 0x9, &(0x7f0000000680)={r12, @in={{0x2, 0x4e20, @remote}}, 0x10001, 0xfff7, 0x5, 0x1, 0x8, 0x5, 0xba}, 0x9c) ioctl(r9, 0x1000008912, &(0x7f00000001c0)="080db5055e0bcfe8696071") getsockopt$inet_sctp_SCTP_PEER_AUTH_CHUNKS(r9, 0x84, 0x1a, &(0x7f0000000940)=ANY=[@ANYRES32=0x0, @ANYBLOB='\x00'/12], &(0x7f0000000980)=0x10) r13 = socket$nl_generic(0x10, 0x3, 0x10) r14 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080)='nl80211\x00') r15 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL80211_CMD_GET_STATION(r15, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000240)={0x1c, r14, 0xf2b, 0x0, 0x0, {}, [@NL80211_ATTR_AIRTIME_WEIGHT={0x8}]}, 0x1c}}, 0x0) sendmsg$NL80211_CMD_GET_MPATH(r13, &(0x7f00000001c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x2000}, 0x268, &(0x7f0000000080)={&(0x7f0000000200)={0x40, r14, 0x4, 0x70bd2d, 0x25dfdbff}, 0xff6b}, 0x1, 0x0, 0x0, 0x10049050}, 0x260448c0) sendmsg$NL80211_CMD_NEW_KEY(r9, &(0x7f0000000640)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0xb0024000}, 0xc, &(0x7f00000002c0)={&(0x7f0000000440)={0x7c, r14, 0x23, 0x70bd27, 0x25dfdbff, {}, [@NL80211_ATTR_KEY_DATA_WEP40={0x9, 0x7, "a80875ab12"}, @NL80211_ATTR_KEY={0x5c, 0x50, [@NL80211_KEY_DEFAULT_TYPES={0x14, 0x8, [@NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_MULTICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_MULTICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_MULTICAST={0x4}]}, @NL80211_KEY_DEFAULT_TYPES={0x28, 0x8, [@NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_MULTICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_MULTICAST={0x4}]}, @NL80211_KEY_IDX={0x5, 0x2, 0x5}, @NL80211_KEY_DATA_WEP104={0x11, 0x1, "4d84c4e30151cb27f51a4adf63"}]}]}, 0x7c}, 0x1, 0x0, 0x0, 0x24000}, 0x40) [ 386.485719][T16836] device syz_tun left promiscuous mode [ 386.491867][T16836] bridge191: port 1(syz_tun) entered disabled state [ 386.607826][T16836] bridge192: port 1(syz_tun) entered blocking state [ 386.614748][T16836] bridge192: port 1(syz_tun) entered disabled state [ 386.623587][T16836] device syz_tun entered promiscuous mode 15:24:28 executing program 0: r0 = socket(0x21, 0xa, 0x1) r1 = socket(0x10, 0x80002, 0x0) ioctl(r1, 0x1000008912, &(0x7f00000001c0)="080db5055e0bcfe8696071") getsockopt$inet_sctp_SCTP_PEER_AUTH_CHUNKS(r1, 0x84, 0x1a, &(0x7f0000000940)=ANY=[@ANYRES32=0x0, @ANYBLOB='\x00'/12], &(0x7f0000000980)=0x10) getsockopt$inet_sctp_SCTP_GET_PEER_ADDR_INFO(r0, 0x84, 0xf, &(0x7f00000009c0)={r2, @in6={{0xa, 0x4e21, 0x8, @local, 0x401}}, 0x9, 0x1, 0x7, 0x7f, 0x6}, &(0x7f0000000a80)=0x98) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000400)='nl80211\x00') sendmsg$NL80211_CMD_GET_MESH_CONFIG(r0, &(0x7f0000000580)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x103190}, 0xc, &(0x7f0000000540)={&(0x7f0000000500)={0x34, r3, 0x10, 0x70bd2d, 0x25dfdbfe, {}, [@NL80211_ATTR_WDEV={0xc, 0x99, {0x1, 0xffffffffffffffff}}, @NL80211_ATTR_WIPHY={0x8, 0x1, 0x1}, @NL80211_ATTR_WDEV={0xc, 0x99, {0x3f, 0x3}}]}, 0x34}, 0x1, 0x0, 0x0, 0x800}, 0x40000) r4 = socket$nl_generic(0x10, 0x3, 0x10) bind$netlink(r4, &(0x7f0000000000)={0x10, 0x0, 0x25dfdbff}, 0xffffffffffffffb3) sendmsg$nl_generic(r4, &(0x7f0000000080)={&(0x7f0000000480)={0x10, 0xbb7f}, 0xc, &(0x7f0000000440)={&(0x7f00000004c0)={0x1c, 0x22, 0x1, 0x0, 0x0, {0x4}, [@typed={0x8, 0xc}]}, 0x1c}}, 0x0) socket$netlink(0x10, 0x3, 0x0) r5 = socket$alg(0x26, 0x5, 0x0) bind$alg(r5, &(0x7f0000000080)={0x26, 'hash\x00', 0x0, 0x0, 'sha512\x00'}, 0x58) [ 386.660744][T16844] netlink: 72 bytes leftover after parsing attributes in process `syz-executor.1'. [ 386.674070][T16846] device erspan0 left promiscuous mode [ 386.681219][T16846] bridge191: port 2(erspan0) entered disabled state [ 386.827821][T16846] bridge192: port 2(erspan0) entered blocking state [ 386.834688][T16846] bridge192: port 2(erspan0) entered disabled state [ 386.848235][T16846] device erspan0 entered promiscuous mode [ 386.856008][T16847] device syz_tun left promiscuous mode [ 386.863211][T16847] bridge204: port 1(syz_tun) entered disabled state 15:24:29 executing program 4: r0 = socket$inet6(0xa, 0x80003, 0x6b) ioctl(r0, 0x1000008912, &(0x7f00000001c0)="080db5055e0bcfe8476071") r1 = socket(0x10, 0x2, 0x0) sendto(r1, &(0x7f0000000200)="120000001200e7ef007b1a3fcd00000000a1", 0x12, 0x0, 0x0, 0x18) recvmmsg(0xffffffffffffffff, &(0x7f00000037c0)=[{{&(0x7f0000000600)=@ethernet={0x0, @random}, 0x80, &(0x7f0000000380)=[{&(0x7f0000000040)=""/95, 0x2000007d}, {&(0x7f00000000c0)=""/85, 0x1f3}, {&(0x7f00000024c0)=""/4096, 0x1048}, {&(0x7f0000000400)=""/120, 0x1aa}, {&(0x7f0000000480)=""/60, 0xc6}, {&(0x7f0000000280)=""/77, 0x4d}, {&(0x7f0000000540)=""/154, 0x207}, {&(0x7f0000000340)=""/22, 0x1de}], 0x8, &(0x7f0000002400)=""/191, 0xfffffffffffffea2}}], 0x4000000000001de, 0x6, &(0x7f0000003700)={0x77359400}) [ 387.018694][T16847] bridge205: port 1(syz_tun) entered blocking state [ 387.025615][T16847] bridge205: port 1(syz_tun) entered disabled state [ 387.039905][T16847] device syz_tun entered promiscuous mode [ 387.054460][T16848] device syz_tun left promiscuous mode [ 387.060786][T16848] bridge58: port 1(syz_tun) entered disabled state 15:24:29 executing program 5: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000340)={'erspan0\x00', 0x0}) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000300)={'syz_tun\x00', 0x0}) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r7, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r6, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000380)=@newlink={0x34, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r8}, [@IFLA_LINKINFO={0x14, 0x12, @bridge={{0xb, 0x1, 'bridge\x00'}, {0x4}}}]}, 0x34}}, 0x0) sendmsg$nl_route(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000002700)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r5}, [@IFLA_MASTER={0x8, 0xa, r8}]}, 0x28}}, 0x0) sendmsg$nl_route(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f00000000c0)=ANY=[@ANYBLOB="2800000010000104000040000000000000001ea6", @ANYRES32=r2, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00\b\x00\n\x00', @ANYRES32=r8], 0x28}}, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r10 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r9, 0x8933, 0x0) sendmsg$nl_route(r10, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000040)=@newlink={0x2c, 0x10, 0x401, 0x0, 0x0, {}, [@IFLA_BROADCAST={0xa}]}, 0x332}}, 0x0) [ 387.197893][T16848] bridge59: port 1(syz_tun) entered blocking state [ 387.204599][T16848] bridge59: port 1(syz_tun) entered disabled state [ 387.214335][T16848] device syz_tun entered promiscuous mode [ 387.227819][T16851] device erspan0 left promiscuous mode [ 387.233479][T16851] bridge204: port 2(erspan0) entered disabled state 15:24:29 executing program 2: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000340)={'erspan0\x00', 0x0}) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000300)={'syz_tun\x00', 0x0}) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r7, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r6, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000380)=@newlink={0x34, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r8}, [@IFLA_LINKINFO={0x14, 0x12, @bridge={{0xb, 0x1, 'bridge\x00'}, {0x4}}}]}, 0x34}}, 0x0) sendmsg$nl_route(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000002700)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r5}, [@IFLA_MASTER={0x8, 0xa, r8}]}, 0x28}}, 0x0) sendmsg$nl_route(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f00000000c0)=ANY=[@ANYBLOB="2800000010000104000040000000000000001ea6", @ANYRES32=r2, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00\b\x00\n\x00', @ANYRES32=r8], 0x28}}, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r10 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r9, 0x8933, &(0x7f0000000300)={'syz_tun\x00'}) sendmsg$nl_route(r10, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={0x0}}, 0x0) [ 387.338730][T16851] bridge205: port 2(erspan0) entered blocking state [ 387.345563][T16851] bridge205: port 2(erspan0) entered disabled state [ 387.354293][T16851] device erspan0 entered promiscuous mode [ 387.362768][T16852] device erspan0 left promiscuous mode [ 387.369323][T16852] bridge58: port 2(erspan0) entered disabled state 15:24:29 executing program 3: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000340)={'erspan0\x00', 0x0}) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000300)={'syz_tun\x00', 0x0}) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r7, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r6, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000380)=@newlink={0x34, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r8}, [@IFLA_LINKINFO={0x14, 0x12, @bridge={{0xb, 0x1, 'bridge\x00'}, {0x4}}}]}, 0x34}}, 0x0) sendmsg$nl_route(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000002700)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r5}, [@IFLA_MASTER={0x8, 0xa, r8}]}, 0x28}}, 0x0) sendmsg$nl_route(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f00000000c0)=ANY=[@ANYBLOB="2800000010000104000040000000000000001ea6", @ANYRES32=r2, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00\b\x00\n\x00', @ANYRES32=r8], 0x28}}, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)) r9 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000300)={'syz_tun\x00', 0x0}) sendmsg$nl_route(r9, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000040)=@newlink={0x2c, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r10}, [@IFLA_BROADCAST={0xa}]}, 0x332}}, 0x0) [ 387.478596][T16852] bridge59: port 2(erspan0) entered blocking state [ 387.485452][T16852] bridge59: port 2(erspan0) entered disabled state [ 387.495228][T16852] device erspan0 entered promiscuous mode 15:24:29 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, 0x0, &(0x7f0000000200)) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000004c0)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32, @ANYBLOB="0000000000000000280012000c0001007665746800000000180002001400010000000000", @ANYRES32=0x0, @ANYBLOB="00000000008433df6d6f6b577d4eaaf2000007"], 0x48}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000540)=ANY=[@ANYBLOB="7400000024000705000000000000000000010000", @ANYRES32, @ANYBLOB="00000000ffffffff000000000800010073667100486818973f73461919309b68e1693572bb000229c6090032d0ed64f3c3545aaf6e000085a4e4ebb5ef670000000000000000000000000000001a4e624d29a84abf03265700000000000000000000000000000000000000000000000000000000000000ac20000089b53c947244306a0216a3de887763df5b42498b13bb1938de859ee6d7ae7dd2224dc672b69b4358871b170ea0b667832e5224ee3538f885b7abd9bc4a7d"], 0x74}}, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r3, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000300)=ANY=[@ANYBLOB="840000002c00010700"/20, @ANYRES32, @ANYBLOB="0008008000000000030000000800010075333200580002001400050000000000000000000000000000000000400006003c0001000000000000001020898dde66057433b6ef3a41d22be225e0001b0000000000000000000000000017256ffc66e43a2484e1a912c5998bcbf0d0000000000000000000000000000000798a3c067277da1a290b9613a33c575c36fad473382c8f5532ef3f0e1d2c450a7decbf3431a69f9b2ecb3291bed174245a962fe0484676958265e2988326a89db3139d91fe4aee6ae7e745ab00001a9f61f20500000000000000b3958bc14fce6e66a36d1ab3194534ba4e973684b27793bff837d3"], 0x84}}, 0x0) r4 = socket(0x10, 0x80002, 0x0) sendmmsg$alg(r4, &(0x7f0000000140), 0x49249249249278c, 0x0) r5 = socket$nl_route(0x10, 0x3, 0x0) r6 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r6, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r5, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000500)=@newlink={0x20, 0x11, 0x40d, 0x0, 0x0, {0x0, 0x0, 0x0, r7}}, 0x20}}, 0x0) r8 = socket(0x10, 0x80002, 0x0) getsockopt$inet_sctp_SCTP_PEER_AUTH_CHUNKS(0xffffffffffffffff, 0x84, 0x1a, &(0x7f0000000940)=ANY=[@ANYRES32=0x0, @ANYBLOB='\x00'/12], &(0x7f0000000980)=0x10) r9 = socket(0xa, 0x6, 0x0) close(r9) r10 = socket$inet6_sctp(0xa, 0x10000000005, 0x84) setsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX(r10, 0x84, 0x6e, &(0x7f0000000180)=[@in6={0xa, 0x0, 0x0, @remote, 0x9}], 0x1c) getsockopt$inet_sctp6_SCTP_GET_ASSOC_ID_LIST(r10, 0x84, 0x1d, &(0x7f000095dff8)={0x1, [0x0]}, &(0x7f000095dffc)=0x8) setsockopt$inet_sctp_SCTP_RTOINFO(r9, 0x84, 0x0, &(0x7f0000000000)={r11, 0x0, 0x0, 0x1000000}, 0x10) setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(0xffffffffffffffff, 0x84, 0x9, &(0x7f0000000680)={r11, @in={{0x2, 0x4e20, @remote}}, 0x10001, 0xfff7, 0x5, 0x1, 0x8, 0x5, 0xba}, 0x9c) ioctl(r8, 0x1000008912, &(0x7f00000001c0)="080db5055e0bcfe8696071") getsockopt$inet_sctp_SCTP_PEER_AUTH_CHUNKS(r8, 0x84, 0x1a, &(0x7f0000000940)=ANY=[@ANYRES32=0x0, @ANYBLOB='\x00'/12], &(0x7f0000000980)=0x10) r12 = socket$nl_generic(0x10, 0x3, 0x10) r13 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080)='nl80211\x00') r14 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL80211_CMD_GET_STATION(r14, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000240)={0x1c, r13, 0xf2b, 0x0, 0x0, {}, [@NL80211_ATTR_AIRTIME_WEIGHT={0x8}]}, 0x1c}}, 0x0) sendmsg$NL80211_CMD_GET_MPATH(r12, &(0x7f00000001c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x2000}, 0x268, &(0x7f0000000080)={&(0x7f0000000200)={0x40, r13, 0x4, 0x70bd2d, 0x25dfdbff}, 0xff6b}, 0x1, 0x0, 0x0, 0x10049050}, 0x260448c0) sendmsg$NL80211_CMD_NEW_KEY(r8, &(0x7f0000000640)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0xb0024000}, 0xc, &(0x7f00000002c0)={&(0x7f0000000440)={0x7c, r13, 0x23, 0x70bd27, 0x25dfdbff, {}, [@NL80211_ATTR_KEY_DATA_WEP40={0x9, 0x7, "a80875ab12"}, @NL80211_ATTR_KEY={0x5c, 0x50, [@NL80211_KEY_DEFAULT_TYPES={0x14, 0x8, [@NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_MULTICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_MULTICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_MULTICAST={0x4}]}, @NL80211_KEY_DEFAULT_TYPES={0x28, 0x8, [@NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_MULTICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_MULTICAST={0x4}]}, @NL80211_KEY_IDX={0x5, 0x2, 0x5}, @NL80211_KEY_DATA_WEP104={0x11, 0x1, "4d84c4e30151cb27f51a4adf63"}]}]}, 0x7c}, 0x1, 0x0, 0x0, 0x24000}, 0x40) 15:24:29 executing program 4: r0 = socket$inet6(0xa, 0x80003, 0x6b) ioctl(r0, 0x1000008912, &(0x7f00000001c0)="080db5055e0bcfe8476071") r1 = socket(0x10, 0x2, 0x0) sendto(r1, &(0x7f0000000200)="120000001200e7ef007b1a3fcd00000000a1", 0x12, 0x0, 0x0, 0x18) recvmmsg(0xffffffffffffffff, &(0x7f00000037c0)=[{{&(0x7f0000000600)=@ethernet={0x0, @random}, 0x80, &(0x7f0000000380)=[{&(0x7f0000000040)=""/95, 0x2000007d}, {&(0x7f00000000c0)=""/85, 0x1f3}, {&(0x7f00000024c0)=""/4096, 0x1048}, {&(0x7f0000000400)=""/120, 0x1aa}, {&(0x7f0000000480)=""/60, 0xc6}, {&(0x7f0000000280)=""/77, 0x4d}, {&(0x7f0000000540)=""/154, 0x207}, {&(0x7f0000000340)=""/22, 0x1de}], 0x8, &(0x7f0000002400)=""/191, 0xfffffffffffffea2}}], 0x4000000000001de, 0x6, &(0x7f0000003700)={0x77359400}) [ 387.566756][T16873] device syz_tun left promiscuous mode [ 387.595498][T16873] bridge192: port 1(syz_tun) entered disabled state [ 387.787840][T16873] bridge193: port 1(syz_tun) entered blocking state [ 387.794688][T16873] bridge193: port 1(syz_tun) entered disabled state [ 387.805103][T16873] device syz_tun entered promiscuous mode [ 387.814283][T16874] device erspan0 left promiscuous mode [ 387.820794][T16874] bridge192: port 2(erspan0) entered disabled state [ 387.947802][T16874] bridge193: port 2(erspan0) entered blocking state [ 387.956108][T16874] bridge193: port 2(erspan0) entered disabled state [ 387.969129][T16874] device erspan0 entered promiscuous mode [ 387.987686][T16879] device syz_tun left promiscuous mode 15:24:30 executing program 5: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000340)={'erspan0\x00', 0x0}) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000300)={'syz_tun\x00', 0x0}) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r7, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r6, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000380)=@newlink={0x34, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r8}, [@IFLA_LINKINFO={0x14, 0x12, @bridge={{0xb, 0x1, 'bridge\x00'}, {0x4}}}]}, 0x34}}, 0x0) sendmsg$nl_route(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000002700)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r5}, [@IFLA_MASTER={0x8, 0xa, r8}]}, 0x28}}, 0x0) sendmsg$nl_route(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f00000000c0)=ANY=[@ANYBLOB="2800000010000104000040000000000000001ea6", @ANYRES32=r2, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00\b\x00\n\x00', @ANYRES32=r8], 0x28}}, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r10 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r9, 0x8933, 0x0) sendmsg$nl_route(r10, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000040)=@newlink={0x2c, 0x10, 0x401, 0x0, 0x0, {}, [@IFLA_BROADCAST={0xa}]}, 0x332}}, 0x0) [ 387.994655][T16879] bridge205: port 1(syz_tun) entered disabled state [ 388.138867][T16879] bridge206: port 1(syz_tun) entered blocking state [ 388.145700][T16879] bridge206: port 1(syz_tun) entered disabled state [ 388.154090][T16879] device syz_tun entered promiscuous mode [ 388.162631][T16880] device erspan0 left promiscuous mode [ 388.171874][T16880] bridge205: port 2(erspan0) entered disabled state 15:24:30 executing program 2: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000340)={'erspan0\x00', 0x0}) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000300)={'syz_tun\x00', 0x0}) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r7, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r6, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000380)=@newlink={0x34, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r8}, [@IFLA_LINKINFO={0x14, 0x12, @bridge={{0xb, 0x1, 'bridge\x00'}, {0x4}}}]}, 0x34}}, 0x0) sendmsg$nl_route(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000002700)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r5}, [@IFLA_MASTER={0x8, 0xa, r8}]}, 0x28}}, 0x0) sendmsg$nl_route(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f00000000c0)=ANY=[@ANYBLOB="2800000010000104000040000000000000001ea6", @ANYRES32=r2, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00\b\x00\n\x00', @ANYRES32=r8], 0x28}}, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r10 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r9, 0x8933, &(0x7f0000000300)={'syz_tun\x00'}) sendmsg$nl_route(r10, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={0x0}}, 0x0) [ 388.308780][T16880] bridge206: port 2(erspan0) entered blocking state [ 388.315538][T16880] bridge206: port 2(erspan0) entered disabled state [ 388.323641][T16880] device erspan0 entered promiscuous mode 15:24:30 executing program 0: r0 = socket(0x21, 0xa, 0x1) r1 = socket(0x10, 0x80002, 0x0) ioctl(r1, 0x1000008912, &(0x7f00000001c0)="080db5055e0bcfe8696071") getsockopt$inet_sctp_SCTP_PEER_AUTH_CHUNKS(r1, 0x84, 0x1a, &(0x7f0000000940)=ANY=[@ANYRES32=0x0, @ANYBLOB='\x00'/12], &(0x7f0000000980)=0x10) getsockopt$inet_sctp_SCTP_GET_PEER_ADDR_INFO(r0, 0x84, 0xf, &(0x7f00000009c0)={r2, @in6={{0xa, 0x4e21, 0x8, @local, 0x401}}, 0x9, 0x1, 0x7, 0x7f, 0x6}, &(0x7f0000000a80)=0x98) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000400)='nl80211\x00') sendmsg$NL80211_CMD_GET_MESH_CONFIG(r0, &(0x7f0000000580)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x103190}, 0xc, &(0x7f0000000540)={&(0x7f0000000500)={0x34, r3, 0x10, 0x70bd2d, 0x25dfdbfe, {}, [@NL80211_ATTR_WDEV={0xc, 0x99, {0x1, 0xffffffffffffffff}}, @NL80211_ATTR_WIPHY={0x8, 0x1, 0x1}, @NL80211_ATTR_WDEV={0xc, 0x99, {0x3f, 0x3}}]}, 0x34}, 0x1, 0x0, 0x0, 0x800}, 0x40000) r4 = socket$nl_generic(0x10, 0x3, 0x10) bind$netlink(r4, &(0x7f0000000000)={0x10, 0x0, 0x25dfdbff}, 0xffffffffffffffb3) sendmsg$nl_generic(r4, &(0x7f0000000080)={&(0x7f0000000480)={0x10, 0xbb7f}, 0xc, &(0x7f0000000440)={&(0x7f00000004c0)={0x1c, 0x22, 0x1, 0x0, 0x0, {0x4}, [@typed={0x8, 0xc}]}, 0x1c}}, 0x0) socket$netlink(0x10, 0x3, 0x0) r5 = socket$alg(0x26, 0x5, 0x0) bind$alg(r5, &(0x7f0000000080)={0x26, 'hash\x00', 0x0, 0x0, 'sha512\x00'}, 0x58) [ 388.548668][T16891] device syz_tun left promiscuous mode [ 388.554298][T16891] bridge59: port 1(syz_tun) entered disabled state 15:24:30 executing program 4: r0 = socket$inet6(0xa, 0x80003, 0x6b) ioctl(r0, 0x1000008912, &(0x7f00000001c0)="080db5055e0bcfe8476071") r1 = socket(0x10, 0x2, 0x0) sendto(r1, &(0x7f0000000200)="120000001200e7ef007b1a3fcd00000000a1", 0x12, 0x0, 0x0, 0x18) recvmmsg(0xffffffffffffffff, &(0x7f00000037c0)=[{{&(0x7f0000000600)=@ethernet={0x0, @random}, 0x80, &(0x7f0000000380)=[{&(0x7f0000000040)=""/95, 0x2000007d}, {&(0x7f00000000c0)=""/85, 0x1f3}, {&(0x7f00000024c0)=""/4096, 0x1048}, {&(0x7f0000000400)=""/120, 0x1aa}, {&(0x7f0000000480)=""/60, 0xc6}, {&(0x7f0000000280)=""/77, 0x4d}, {&(0x7f0000000540)=""/154, 0x207}, {&(0x7f0000000340)=""/22, 0x1de}], 0x8, &(0x7f0000002400)=""/191, 0xfffffffffffffea2}}], 0x4000000000001de, 0x6, &(0x7f0000003700)={0x77359400}) [ 388.677863][T16891] bridge60: port 1(syz_tun) entered blocking state [ 388.684838][T16891] bridge60: port 1(syz_tun) entered disabled state [ 388.693902][T16891] device syz_tun entered promiscuous mode [ 388.701702][T16892] netlink: 72 bytes leftover after parsing attributes in process `syz-executor.1'. [ 388.714019][T16894] device erspan0 left promiscuous mode [ 388.720345][T16894] bridge59: port 2(erspan0) entered disabled state 15:24:30 executing program 3: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000340)={'erspan0\x00', 0x0}) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000300)={'syz_tun\x00', 0x0}) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r7, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r6, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000380)=@newlink={0x34, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r8}, [@IFLA_LINKINFO={0x14, 0x12, @bridge={{0xb, 0x1, 'bridge\x00'}, {0x4}}}]}, 0x34}}, 0x0) sendmsg$nl_route(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000002700)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r5}, [@IFLA_MASTER={0x8, 0xa, r8}]}, 0x28}}, 0x0) sendmsg$nl_route(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f00000000c0)=ANY=[@ANYBLOB="2800000010000104000040000000000000001ea6", @ANYRES32=r2, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00\b\x00\n\x00', @ANYRES32=r8], 0x28}}, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)) r9 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000300)={'syz_tun\x00', 0x0}) sendmsg$nl_route(r9, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000040)=@newlink={0x2c, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r10}, [@IFLA_BROADCAST={0xa}]}, 0x332}}, 0x0) [ 388.857891][T16894] bridge60: port 2(erspan0) entered blocking state [ 388.864494][T16894] bridge60: port 2(erspan0) entered disabled state [ 388.872750][T16894] device erspan0 entered promiscuous mode [ 388.887546][T16906] device syz_tun left promiscuous mode [ 388.893311][T16906] bridge193: port 1(syz_tun) entered disabled state [ 389.037809][T16906] bridge194: port 1(syz_tun) entered blocking state [ 389.044679][T16906] bridge194: port 1(syz_tun) entered disabled state [ 389.052915][T16906] device syz_tun entered promiscuous mode [ 389.062601][T16907] device erspan0 left promiscuous mode [ 389.068391][T16907] bridge193: port 2(erspan0) entered disabled state 15:24:31 executing program 5: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000340)={'erspan0\x00', 0x0}) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000300)={'syz_tun\x00', 0x0}) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r7, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r6, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000380)=@newlink={0x34, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r8}, [@IFLA_LINKINFO={0x14, 0x12, @bridge={{0xb, 0x1, 'bridge\x00'}, {0x4}}}]}, 0x34}}, 0x0) sendmsg$nl_route(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000002700)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r5}, [@IFLA_MASTER={0x8, 0xa, r8}]}, 0x28}}, 0x0) sendmsg$nl_route(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f00000000c0)=ANY=[@ANYBLOB="2800000010000104000040000000000000001ea6", @ANYRES32=r2, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00\b\x00\n\x00', @ANYRES32=r8], 0x28}}, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r10 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r9, 0x8933, 0x0) sendmsg$nl_route(r10, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000040)=@newlink={0x2c, 0x10, 0x401, 0x0, 0x0, {}, [@IFLA_BROADCAST={0xa}]}, 0x332}}, 0x0) [ 389.197962][T16907] bridge194: port 2(erspan0) entered blocking state [ 389.204772][T16907] bridge194: port 2(erspan0) entered disabled state [ 389.213066][T16907] device erspan0 entered promiscuous mode [ 389.229300][T16915] device syz_tun left promiscuous mode [ 389.235034][T16915] bridge206: port 1(syz_tun) entered disabled state [ 389.358683][T16915] bridge207: port 1(syz_tun) entered blocking state [ 389.365501][T16915] bridge207: port 1(syz_tun) entered disabled state [ 389.377578][T16915] device syz_tun entered promiscuous mode [ 389.395721][T16917] device erspan0 left promiscuous mode [ 389.402671][T16917] bridge206: port 2(erspan0) entered disabled state [ 389.527891][T16917] bridge207: port 2(erspan0) entered blocking state [ 389.534777][T16917] bridge207: port 2(erspan0) entered disabled state [ 389.543273][T16917] device erspan0 entered promiscuous mode 15:24:31 executing program 2: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000340)={'erspan0\x00', 0x0}) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000300)={'syz_tun\x00', 0x0}) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r7, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r6, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000380)=@newlink={0x34, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r8}, [@IFLA_LINKINFO={0x14, 0x12, @bridge={{0xb, 0x1, 'bridge\x00'}, {0x4}}}]}, 0x34}}, 0x0) sendmsg$nl_route(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000002700)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r5}, [@IFLA_MASTER={0x8, 0xa, r8}]}, 0x28}}, 0x0) sendmsg$nl_route(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f00000000c0)=ANY=[@ANYBLOB="2800000010000104000040000000000000001ea6", @ANYRES32=r2, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00\b\x00\n\x00', @ANYRES32=r8], 0x28}}, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r10 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r9, 0x8933, &(0x7f0000000300)={'syz_tun\x00', 0x0}) sendmsg$nl_route(r10, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000040)=@newlink={0x2c, 0x10, 0x0, 0x0, 0x0, {0x0, 0x0, 0x0, r11}, [@IFLA_BROADCAST={0xa}]}, 0x332}}, 0x0) 15:24:31 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, 0x0, &(0x7f0000000200)) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000004c0)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32, @ANYBLOB="0000000000000000280012000c0001007665746800000000180002001400010000000000", @ANYRES32=0x0, @ANYBLOB="00000000008433df6d6f6b577d4eaaf2000007"], 0x48}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000540)=ANY=[@ANYBLOB="7400000024000705000000000000000000010000", @ANYRES32, @ANYBLOB="00000000ffffffff000000000800010073667100486818973f73461919309b68e1693572bb000229c6090032d0ed64f3c3545aaf6e000085a4e4ebb5ef670000000000000000000000000000001a4e624d29a84abf03265700000000000000000000000000000000000000000000000000000000000000ac20000089b53c947244306a0216a3de887763df5b42498b13bb1938de859ee6d7ae7dd2224dc672b69b4358871b170ea0b667832e5224ee3538f885b7abd9bc4a7d"], 0x74}}, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r3, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000300)=ANY=[@ANYBLOB="840000002c00010700"/20, @ANYRES32, @ANYBLOB="0008008000000000030000000800010075333200580002001400050000000000000000000000000000000000400006003c0001000000000000001020898dde66057433b6ef3a41d22be225e0001b0000000000000000000000000017256ffc66e43a2484e1a912c5998bcbf0d0000000000000000000000000000000798a3c067277da1a290b9613a33c575c36fad473382c8f5532ef3f0e1d2c450a7decbf3431a69f9b2ecb3291bed174245a962fe0484676958265e2988326a89db3139d91fe4aee6ae7e745ab00001a9f61f20500000000000000b3958bc14fce6e66a36d1ab3194534ba4e973684b27793bff837d3"], 0x84}}, 0x0) r4 = socket(0x10, 0x80002, 0x0) sendmmsg$alg(r4, &(0x7f0000000140), 0x49249249249278c, 0x0) r5 = socket$nl_route(0x10, 0x3, 0x0) r6 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r6, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r5, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000500)=@newlink={0x20, 0x11, 0x40d, 0x0, 0x0, {0x0, 0x0, 0x0, r7}}, 0x20}}, 0x0) r8 = socket(0x10, 0x80002, 0x0) getsockopt$inet_sctp_SCTP_PEER_AUTH_CHUNKS(0xffffffffffffffff, 0x84, 0x1a, &(0x7f0000000940)=ANY=[@ANYRES32=0x0, @ANYBLOB='\x00'/12], &(0x7f0000000980)=0x10) r9 = socket(0xa, 0x6, 0x0) close(r9) r10 = socket$inet6_sctp(0xa, 0x10000000005, 0x84) setsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX(r10, 0x84, 0x6e, &(0x7f0000000180)=[@in6={0xa, 0x0, 0x0, @remote, 0x9}], 0x1c) getsockopt$inet_sctp6_SCTP_GET_ASSOC_ID_LIST(r10, 0x84, 0x1d, &(0x7f000095dff8)={0x1, [0x0]}, &(0x7f000095dffc)=0x8) setsockopt$inet_sctp_SCTP_RTOINFO(r9, 0x84, 0x0, &(0x7f0000000000)={r11, 0x0, 0x0, 0x1000000}, 0x10) setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(0xffffffffffffffff, 0x84, 0x9, &(0x7f0000000680)={r11, @in={{0x2, 0x4e20, @remote}}, 0x10001, 0xfff7, 0x5, 0x1, 0x8, 0x5, 0xba}, 0x9c) ioctl(r8, 0x1000008912, &(0x7f00000001c0)="080db5055e0bcfe8696071") getsockopt$inet_sctp_SCTP_PEER_AUTH_CHUNKS(r8, 0x84, 0x1a, &(0x7f0000000940)=ANY=[@ANYRES32=0x0, @ANYBLOB='\x00'/12], &(0x7f0000000980)=0x10) r12 = socket$nl_generic(0x10, 0x3, 0x10) r13 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080)='nl80211\x00') r14 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL80211_CMD_GET_STATION(r14, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000240)={0x1c, r13, 0xf2b, 0x0, 0x0, {}, [@NL80211_ATTR_AIRTIME_WEIGHT={0x8}]}, 0x1c}}, 0x0) sendmsg$NL80211_CMD_GET_MPATH(r12, &(0x7f00000001c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x2000}, 0x268, &(0x7f0000000080)={&(0x7f0000000200)={0x40, r13, 0x4, 0x70bd2d, 0x25dfdbff}, 0xff6b}, 0x1, 0x0, 0x0, 0x10049050}, 0x260448c0) sendmsg$NL80211_CMD_NEW_KEY(r8, &(0x7f0000000640)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0xb0024000}, 0xc, &(0x7f00000002c0)={&(0x7f0000000440)={0x7c, r13, 0x23, 0x70bd27, 0x25dfdbff, {}, [@NL80211_ATTR_KEY_DATA_WEP40={0x9, 0x7, "a80875ab12"}, @NL80211_ATTR_KEY={0x5c, 0x50, [@NL80211_KEY_DEFAULT_TYPES={0x14, 0x8, [@NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_MULTICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_MULTICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_MULTICAST={0x4}]}, @NL80211_KEY_DEFAULT_TYPES={0x28, 0x8, [@NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_MULTICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_MULTICAST={0x4}]}, @NL80211_KEY_IDX={0x5, 0x2, 0x5}, @NL80211_KEY_DATA_WEP104={0x11, 0x1, "4d84c4e30151cb27f51a4adf63"}]}]}, 0x7c}, 0x1, 0x0, 0x0, 0x24000}, 0x40) 15:24:31 executing program 4: r0 = socket$inet6(0xa, 0x80003, 0x6b) ioctl(r0, 0x1000008912, &(0x7f00000001c0)="080db5055e0bcfe8476071") r1 = socket(0x10, 0x2, 0x0) sendto(r1, &(0x7f0000000200)="120000001200e7ef007b1a3fcd00000000a1", 0x12, 0x0, 0x0, 0x18) recvmmsg(r1, 0x0, 0x0, 0x6, &(0x7f0000003700)={0x77359400}) [ 389.573532][T16928] device syz_tun left promiscuous mode [ 389.610983][T16928] bridge60: port 1(syz_tun) entered disabled state [ 389.768110][T16928] bridge61: port 1(syz_tun) entered blocking state [ 389.774956][T16928] bridge61: port 1(syz_tun) entered disabled state [ 389.783046][T16928] device syz_tun entered promiscuous mode [ 389.791148][T16929] device erspan0 left promiscuous mode [ 389.796849][T16929] bridge60: port 2(erspan0) entered disabled state 15:24:32 executing program 3: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000340)={'erspan0\x00', 0x0}) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000300)={'syz_tun\x00', 0x0}) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r7, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r6, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000380)=@newlink={0x34, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r8}, [@IFLA_LINKINFO={0x14, 0x12, @bridge={{0xb, 0x1, 'bridge\x00'}, {0x4}}}]}, 0x34}}, 0x0) sendmsg$nl_route(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000002700)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r5}, [@IFLA_MASTER={0x8, 0xa, r8}]}, 0x28}}, 0x0) sendmsg$nl_route(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f00000000c0)=ANY=[@ANYBLOB="2800000010000104000040000000000000001ea6", @ANYRES32=r2, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00\b\x00\n\x00', @ANYRES32=r8], 0x28}}, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r10 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r9, 0x8933, &(0x7f0000000300)={'syz_tun\x00'}) sendmsg$nl_route(r10, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={0x0}}, 0x0) [ 389.937841][T16929] bridge61: port 2(erspan0) entered blocking state [ 389.944638][T16929] bridge61: port 2(erspan0) entered disabled state [ 389.953041][T16929] device erspan0 entered promiscuous mode [ 389.973031][T16934] device syz_tun left promiscuous mode [ 389.983204][T16934] bridge194: port 1(syz_tun) entered disabled state [ 390.117815][T16934] bridge195: port 1(syz_tun) entered blocking state [ 390.124573][T16934] bridge195: port 1(syz_tun) entered disabled state [ 390.137386][T16934] device syz_tun entered promiscuous mode [ 390.144890][T16935] device erspan0 left promiscuous mode [ 390.150809][T16935] bridge194: port 2(erspan0) entered disabled state [ 390.287781][T16935] bridge195: port 2(erspan0) entered blocking state [ 390.294634][T16935] bridge195: port 2(erspan0) entered disabled state [ 390.307120][T16935] device erspan0 entered promiscuous mode 15:24:32 executing program 0: r0 = socket(0x21, 0xa, 0x1) r1 = socket(0x10, 0x80002, 0x0) ioctl(r1, 0x1000008912, &(0x7f00000001c0)="080db5055e0bcfe8696071") getsockopt$inet_sctp_SCTP_PEER_AUTH_CHUNKS(r1, 0x84, 0x1a, &(0x7f0000000940)=ANY=[@ANYRES32=0x0, @ANYBLOB='\x00'/12], &(0x7f0000000980)=0x10) getsockopt$inet_sctp_SCTP_GET_PEER_ADDR_INFO(r0, 0x84, 0xf, &(0x7f00000009c0)={r2, @in6={{0xa, 0x4e21, 0x8, @local, 0x401}}, 0x9, 0x1, 0x7, 0x7f, 0x6}, &(0x7f0000000a80)=0x98) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000400)='nl80211\x00') sendmsg$NL80211_CMD_GET_MESH_CONFIG(r0, &(0x7f0000000580)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x103190}, 0xc, &(0x7f0000000540)={&(0x7f0000000500)={0x34, r3, 0x10, 0x70bd2d, 0x25dfdbfe, {}, [@NL80211_ATTR_WDEV={0xc, 0x99, {0x1, 0xffffffffffffffff}}, @NL80211_ATTR_WIPHY={0x8, 0x1, 0x1}, @NL80211_ATTR_WDEV={0xc, 0x99, {0x3f, 0x3}}]}, 0x34}, 0x1, 0x0, 0x0, 0x800}, 0x40000) r4 = socket$nl_generic(0x10, 0x3, 0x10) bind$netlink(r4, &(0x7f0000000000)={0x10, 0x0, 0x25dfdbff}, 0xffffffffffffffb3) sendmsg$nl_generic(r4, &(0x7f0000000080)={&(0x7f0000000480)={0x10, 0xbb7f}, 0xc, &(0x7f0000000440)={&(0x7f00000004c0)={0x1c, 0x22, 0x1, 0x0, 0x0, {0x4}, [@typed={0x8, 0xc}]}, 0x1c}}, 0x0) socket$netlink(0x10, 0x3, 0x0) r5 = socket$alg(0x26, 0x5, 0x0) bind$alg(r5, &(0x7f0000000080)={0x26, 'hash\x00', 0x0, 0x0, 'sha512\x00'}, 0x58) 15:24:32 executing program 5: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000340)={'erspan0\x00', 0x0}) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000300)={'syz_tun\x00', 0x0}) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r7, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r6, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000380)=@newlink={0x34, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r8}, [@IFLA_LINKINFO={0x14, 0x12, @bridge={{0xb, 0x1, 'bridge\x00'}, {0x4}}}]}, 0x34}}, 0x0) sendmsg$nl_route(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000002700)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r5}, [@IFLA_MASTER={0x8, 0xa, r8}]}, 0x28}}, 0x0) sendmsg$nl_route(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f00000000c0)=ANY=[@ANYBLOB="2800000010000104000040000000000000001ea6", @ANYRES32=r2, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00\b\x00\n\x00', @ANYRES32=r8], 0x28}}, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r9, 0x8933, &(0x7f0000000300)={'syz_tun\x00', 0x0}) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000040)=@newlink={0x2c, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r10}, [@IFLA_BROADCAST={0xa}]}, 0x332}}, 0x0) [ 390.482777][T16946] netlink: 72 bytes leftover after parsing attributes in process `syz-executor.1'. [ 390.494074][T16947] device syz_tun left promiscuous mode [ 390.503069][T16947] bridge207: port 1(syz_tun) entered disabled state 15:24:32 executing program 4: r0 = socket$inet6(0xa, 0x80003, 0x6b) ioctl(r0, 0x1000008912, &(0x7f00000001c0)="080db5055e0bcfe8476071") r1 = socket(0x10, 0x2, 0x0) sendto(r1, &(0x7f0000000200)="120000001200e7ef007b1a3fcd00000000a1", 0x12, 0x0, 0x0, 0x18) recvmmsg(r1, 0x0, 0x0, 0x6, &(0x7f0000003700)={0x77359400}) [ 390.618674][T16947] bridge208: port 1(syz_tun) entered blocking state [ 390.625466][T16947] bridge208: port 1(syz_tun) entered disabled state [ 390.641495][T16947] device syz_tun entered promiscuous mode [ 390.653786][T16950] device erspan0 left promiscuous mode [ 390.659525][T16950] bridge207: port 2(erspan0) entered disabled state 15:24:32 executing program 2: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000340)={'erspan0\x00', 0x0}) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000300)={'syz_tun\x00', 0x0}) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r7, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r6, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000380)=@newlink={0x34, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r8}, [@IFLA_LINKINFO={0x14, 0x12, @bridge={{0xb, 0x1, 'bridge\x00'}, {0x4}}}]}, 0x34}}, 0x0) sendmsg$nl_route(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000002700)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r5}, [@IFLA_MASTER={0x8, 0xa, r8}]}, 0x28}}, 0x0) sendmsg$nl_route(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f00000000c0)=ANY=[@ANYBLOB="2800000010000104000040000000000000001ea6", @ANYRES32=r2, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00\b\x00\n\x00', @ANYRES32=r8], 0x28}}, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r10 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r9, 0x8933, &(0x7f0000000300)={'syz_tun\x00', 0x0}) sendmsg$nl_route(r10, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000040)=@newlink={0x2c, 0x10, 0x0, 0x0, 0x0, {0x0, 0x0, 0x0, r11}, [@IFLA_BROADCAST={0xa}]}, 0x332}}, 0x0) [ 390.787839][T16950] bridge208: port 2(erspan0) entered blocking state [ 390.794785][T16950] bridge208: port 2(erspan0) entered disabled state [ 390.803281][T16950] device erspan0 entered promiscuous mode [ 390.817590][T16961] device syz_tun left promiscuous mode [ 390.824493][T16961] bridge61: port 1(syz_tun) entered disabled state [ 390.977822][T16961] bridge62: port 1(syz_tun) entered blocking state [ 390.984591][T16961] bridge62: port 1(syz_tun) entered disabled state [ 390.992886][T16961] device syz_tun entered promiscuous mode [ 391.000727][T16962] device erspan0 left promiscuous mode [ 391.006562][T16962] bridge61: port 2(erspan0) entered disabled state 15:24:33 executing program 3: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000340)={'erspan0\x00', 0x0}) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000300)={'syz_tun\x00', 0x0}) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r7, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r6, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000380)=@newlink={0x34, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r8}, [@IFLA_LINKINFO={0x14, 0x12, @bridge={{0xb, 0x1, 'bridge\x00'}, {0x4}}}]}, 0x34}}, 0x0) sendmsg$nl_route(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000002700)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r5}, [@IFLA_MASTER={0x8, 0xa, r8}]}, 0x28}}, 0x0) sendmsg$nl_route(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f00000000c0)=ANY=[@ANYBLOB="2800000010000104000040000000000000001ea6", @ANYRES32=r2, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00\b\x00\n\x00', @ANYRES32=r8], 0x28}}, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r10 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r9, 0x8933, &(0x7f0000000300)={'syz_tun\x00'}) sendmsg$nl_route(r10, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={0x0}}, 0x0) [ 391.127816][T16962] bridge62: port 2(erspan0) entered blocking state [ 391.138956][T16962] bridge62: port 2(erspan0) entered disabled state [ 391.146939][T16962] device erspan0 entered promiscuous mode 15:24:33 executing program 0: r0 = socket(0x21, 0xa, 0x1) r1 = socket(0x10, 0x80002, 0x0) ioctl(r1, 0x1000008912, &(0x7f00000001c0)="080db5055e0bcfe8696071") getsockopt$inet_sctp_SCTP_PEER_AUTH_CHUNKS(r1, 0x84, 0x1a, &(0x7f0000000940)=ANY=[@ANYRES32=0x0, @ANYBLOB='\x00'/12], &(0x7f0000000980)=0x10) getsockopt$inet_sctp_SCTP_GET_PEER_ADDR_INFO(r0, 0x84, 0xf, &(0x7f00000009c0)={r2, @in6={{0xa, 0x4e21, 0x8, @local, 0x401}}, 0x9, 0x1, 0x7, 0x7f, 0x6}, &(0x7f0000000a80)=0x98) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000400)='nl80211\x00') sendmsg$NL80211_CMD_GET_MESH_CONFIG(r0, &(0x7f0000000580)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x103190}, 0xc, &(0x7f0000000540)={&(0x7f0000000500)={0x34, r3, 0x10, 0x70bd2d, 0x25dfdbfe, {}, [@NL80211_ATTR_WDEV={0xc, 0x99, {0x1, 0xffffffffffffffff}}, @NL80211_ATTR_WIPHY={0x8, 0x1, 0x1}, @NL80211_ATTR_WDEV={0xc, 0x99, {0x3f, 0x3}}]}, 0x34}, 0x1, 0x0, 0x0, 0x800}, 0x40000) r4 = socket$nl_generic(0x10, 0x3, 0x10) bind$netlink(r4, &(0x7f0000000000)={0x10, 0x0, 0x25dfdbff, 0x1004280}, 0xffffffffffffffb3) sendmsg$nl_generic(0xffffffffffffffff, &(0x7f0000000080)={&(0x7f0000000480)={0x10, 0xbb7f}, 0xc, &(0x7f0000000440)={&(0x7f00000004c0)={0x1c, 0x22, 0x1, 0x0, 0x0, {0x4}, [@typed={0x8, 0xc}]}, 0x1c}}, 0x0) socket$netlink(0x10, 0x3, 0x0) r5 = socket$alg(0x26, 0x5, 0x0) bind$alg(r5, &(0x7f0000000080)={0x26, 'hash\x00', 0x0, 0x0, 'sha512\x00'}, 0x58) [ 391.197421][T16971] device syz_tun left promiscuous mode [ 391.222484][T16971] bridge195: port 1(syz_tun) entered disabled state [ 391.367758][T16971] bridge196: port 1(syz_tun) entered blocking state [ 391.374564][T16971] bridge196: port 1(syz_tun) entered disabled state [ 391.387288][T16971] device syz_tun entered promiscuous mode [ 391.396720][T16973] device erspan0 left promiscuous mode [ 391.402593][T16973] bridge195: port 2(erspan0) entered disabled state 15:24:33 executing program 5: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000340)={'erspan0\x00', 0x0}) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000300)={'syz_tun\x00', 0x0}) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r7, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r6, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000380)=@newlink={0x34, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r8}, [@IFLA_LINKINFO={0x14, 0x12, @bridge={{0xb, 0x1, 'bridge\x00'}, {0x4}}}]}, 0x34}}, 0x0) sendmsg$nl_route(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000002700)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r5}, [@IFLA_MASTER={0x8, 0xa, r8}]}, 0x28}}, 0x0) sendmsg$nl_route(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f00000000c0)=ANY=[@ANYBLOB="2800000010000104000040000000000000001ea6", @ANYRES32=r2, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00\b\x00\n\x00', @ANYRES32=r8], 0x28}}, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r9, 0x8933, &(0x7f0000000300)={'syz_tun\x00', 0x0}) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000040)=@newlink={0x2c, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r10}, [@IFLA_BROADCAST={0xa}]}, 0x332}}, 0x0) [ 391.517813][T16973] bridge196: port 2(erspan0) entered blocking state [ 391.524739][T16973] bridge196: port 2(erspan0) entered disabled state [ 391.533527][T16973] device erspan0 entered promiscuous mode 15:24:33 executing program 4: r0 = socket$inet6(0xa, 0x80003, 0x6b) ioctl(r0, 0x1000008912, &(0x7f00000001c0)="080db5055e0bcfe8476071") r1 = socket(0x10, 0x2, 0x0) sendto(r1, &(0x7f0000000200)="120000001200e7ef007b1a3fcd00000000a1", 0x12, 0x0, 0x0, 0x18) recvmmsg(r1, 0x0, 0x0, 0x6, &(0x7f0000003700)={0x77359400}) 15:24:33 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, 0x0, &(0x7f0000000200)) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000004c0)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32, @ANYBLOB="0000000000000000280012000c0001007665746800000000180002001400010000000000", @ANYRES32=0x0, @ANYBLOB="00000000008433df6d6f6b577d4eaaf2000007"], 0x48}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000540)=ANY=[@ANYBLOB="7400000024000705000000000000000000010000", @ANYRES32, @ANYBLOB="00000000ffffffff000000000800010073667100486818973f73461919309b68e1693572bb000229c6090032d0ed64f3c3545aaf6e000085a4e4ebb5ef670000000000000000000000000000001a4e624d29a84abf03265700000000000000000000000000000000000000000000000000000000000000ac20000089b53c947244306a0216a3de887763df5b42498b13bb1938de859ee6d7ae7dd2224dc672b69b4358871b170ea0b667832e5224ee3538f885b7abd9bc4a7d"], 0x74}}, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r3, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000300)=ANY=[@ANYBLOB="840000002c00010700"/20, @ANYRES32, @ANYBLOB="0008008000000000030000000800010075333200580002001400050000000000000000000000000000000000400006003c0001000000000000001020898dde66057433b6ef3a41d22be225e0001b0000000000000000000000000017256ffc66e43a2484e1a912c5998bcbf0d0000000000000000000000000000000798a3c067277da1a290b9613a33c575c36fad473382c8f5532ef3f0e1d2c450a7decbf3431a69f9b2ecb3291bed174245a962fe0484676958265e2988326a89db3139d91fe4aee6ae7e745ab00001a9f61f20500000000000000b3958bc14fce6e66a36d1ab3194534ba4e973684b27793bff837d3"], 0x84}}, 0x0) r4 = socket(0x10, 0x80002, 0x0) sendmmsg$alg(r4, &(0x7f0000000140), 0x49249249249278c, 0x0) r5 = socket$nl_route(0x10, 0x3, 0x0) r6 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r6, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r5, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000500)=@newlink={0x20, 0x11, 0x40d, 0x0, 0x0, {0x0, 0x0, 0x0, r7}}, 0x20}}, 0x0) r8 = socket(0x10, 0x80002, 0x0) getsockopt$inet_sctp_SCTP_PEER_AUTH_CHUNKS(0xffffffffffffffff, 0x84, 0x1a, &(0x7f0000000940)=ANY=[@ANYRES32=0x0, @ANYBLOB='\x00'/12], &(0x7f0000000980)=0x10) r9 = socket(0xa, 0x6, 0x0) close(r9) r10 = socket$inet6_sctp(0xa, 0x10000000005, 0x84) setsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX(r10, 0x84, 0x6e, &(0x7f0000000180)=[@in6={0xa, 0x0, 0x0, @remote, 0x9}], 0x1c) getsockopt$inet_sctp6_SCTP_GET_ASSOC_ID_LIST(r10, 0x84, 0x1d, &(0x7f000095dff8)={0x1, [0x0]}, &(0x7f000095dffc)=0x8) setsockopt$inet_sctp_SCTP_RTOINFO(r9, 0x84, 0x0, &(0x7f0000000000)={r11, 0x0, 0x0, 0x1000000}, 0x10) setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(0xffffffffffffffff, 0x84, 0x9, &(0x7f0000000680)={r11, @in={{0x2, 0x4e20, @remote}}, 0x10001, 0xfff7, 0x5, 0x1, 0x8, 0x5, 0xba}, 0x9c) ioctl(r8, 0x1000008912, &(0x7f00000001c0)="080db5055e0bcfe8696071") getsockopt$inet_sctp_SCTP_PEER_AUTH_CHUNKS(r8, 0x84, 0x1a, &(0x7f0000000940)=ANY=[@ANYRES32=0x0, @ANYBLOB='\x00'/12], &(0x7f0000000980)=0x10) r12 = socket$nl_generic(0x10, 0x3, 0x10) r13 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080)='nl80211\x00') r14 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL80211_CMD_GET_STATION(r14, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000240)={0x1c, r13, 0xf2b, 0x0, 0x0, {}, [@NL80211_ATTR_AIRTIME_WEIGHT={0x8}]}, 0x1c}}, 0x0) sendmsg$NL80211_CMD_GET_MPATH(r12, &(0x7f00000001c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x2000}, 0x268, &(0x7f0000000080)={&(0x7f0000000200)={0x40, r13, 0x4, 0x70bd2d, 0x25dfdbff}, 0xff6b}, 0x1, 0x0, 0x0, 0x10049050}, 0x260448c0) sendmsg$NL80211_CMD_NEW_KEY(r8, &(0x7f0000000640)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0xb0024000}, 0xc, &(0x7f00000002c0)={&(0x7f0000000440)={0x7c, r13, 0x23, 0x70bd27, 0x25dfdbff, {}, [@NL80211_ATTR_KEY_DATA_WEP40={0x9, 0x7, "a80875ab12"}, @NL80211_ATTR_KEY={0x5c, 0x50, [@NL80211_KEY_DEFAULT_TYPES={0x14, 0x8, [@NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_MULTICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_MULTICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_MULTICAST={0x4}]}, @NL80211_KEY_DEFAULT_TYPES={0x28, 0x8, [@NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_MULTICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_MULTICAST={0x4}]}, @NL80211_KEY_IDX={0x5, 0x2, 0x5}, @NL80211_KEY_DATA_WEP104={0x11, 0x1, "4d84c4e30151cb27f51a4adf63"}]}]}, 0x7c}, 0x1, 0x0, 0x0, 0x24000}, 0x40) [ 391.564642][T16983] device syz_tun left promiscuous mode [ 391.585225][T16983] bridge208: port 1(syz_tun) entered disabled state [ 391.748772][T16983] bridge209: port 1(syz_tun) entered blocking state [ 391.758600][T16983] bridge209: port 1(syz_tun) entered disabled state [ 391.766594][T16983] device syz_tun entered promiscuous mode [ 391.774615][T16984] device erspan0 left promiscuous mode [ 391.780813][T16984] bridge208: port 2(erspan0) entered disabled state 15:24:34 executing program 2: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000340)={'erspan0\x00', 0x0}) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000300)={'syz_tun\x00', 0x0}) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r7, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r6, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000380)=@newlink={0x34, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r8}, [@IFLA_LINKINFO={0x14, 0x12, @bridge={{0xb, 0x1, 'bridge\x00'}, {0x4}}}]}, 0x34}}, 0x0) sendmsg$nl_route(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000002700)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r5}, [@IFLA_MASTER={0x8, 0xa, r8}]}, 0x28}}, 0x0) sendmsg$nl_route(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f00000000c0)=ANY=[@ANYBLOB="2800000010000104000040000000000000001ea6", @ANYRES32=r2, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00\b\x00\n\x00', @ANYRES32=r8], 0x28}}, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r10 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r9, 0x8933, &(0x7f0000000300)={'syz_tun\x00', 0x0}) sendmsg$nl_route(r10, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000040)=@newlink={0x2c, 0x10, 0x0, 0x0, 0x0, {0x0, 0x0, 0x0, r11}, [@IFLA_BROADCAST={0xa}]}, 0x332}}, 0x0) [ 391.918714][T16984] bridge209: port 2(erspan0) entered blocking state [ 391.925475][T16984] bridge209: port 2(erspan0) entered disabled state [ 391.938473][T16984] device erspan0 entered promiscuous mode [ 391.956128][T16991] device syz_tun left promiscuous mode 15:24:34 executing program 0: r0 = socket(0x21, 0xa, 0x1) r1 = socket(0x10, 0x80002, 0x0) ioctl(r1, 0x1000008912, &(0x7f00000001c0)="080db5055e0bcfe8696071") getsockopt$inet_sctp_SCTP_PEER_AUTH_CHUNKS(r1, 0x84, 0x1a, &(0x7f0000000940)=ANY=[@ANYRES32=0x0, @ANYBLOB='\x00'/12], &(0x7f0000000980)=0x10) getsockopt$inet_sctp_SCTP_GET_PEER_ADDR_INFO(r0, 0x84, 0xf, &(0x7f00000009c0)={r2, @in6={{0xa, 0x4e21, 0x8, @local, 0x401}}, 0x9, 0x1, 0x7, 0x7f, 0x6}, &(0x7f0000000a80)=0x98) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000400)='nl80211\x00') sendmsg$NL80211_CMD_GET_MESH_CONFIG(r0, &(0x7f0000000580)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x103190}, 0xc, &(0x7f0000000540)={&(0x7f0000000500)={0x34, r3, 0x10, 0x70bd2d, 0x25dfdbfe, {}, [@NL80211_ATTR_WDEV={0xc, 0x99, {0x1, 0xffffffffffffffff}}, @NL80211_ATTR_WIPHY={0x8, 0x1, 0x1}, @NL80211_ATTR_WDEV={0xc, 0x99, {0x3f, 0x3}}]}, 0x34}, 0x1, 0x0, 0x0, 0x800}, 0x40000) r4 = socket$nl_generic(0x10, 0x3, 0x10) bind$netlink(r4, &(0x7f0000000000)={0x10, 0x0, 0x25dfdbff, 0x1004280}, 0xffffffffffffffb3) sendmsg$nl_generic(0xffffffffffffffff, &(0x7f0000000080)={&(0x7f0000000480)={0x10, 0xbb7f}, 0xc, &(0x7f0000000440)={&(0x7f00000004c0)={0x1c, 0x22, 0x1, 0x0, 0x0, {0x4}, [@typed={0x8, 0xc}]}, 0x1c}}, 0x0) socket$netlink(0x10, 0x3, 0x0) r5 = socket$alg(0x26, 0x5, 0x0) bind$alg(r5, &(0x7f0000000080)={0x26, 'hash\x00', 0x0, 0x0, 'sha512\x00'}, 0x58) [ 391.992239][T16991] bridge62: port 1(syz_tun) entered disabled state [ 392.157847][T16991] bridge63: port 1(syz_tun) entered blocking state [ 392.164725][T16991] bridge63: port 1(syz_tun) entered disabled state [ 392.173849][T16991] device syz_tun entered promiscuous mode [ 392.181600][T16994] device erspan0 left promiscuous mode [ 392.187332][T16994] bridge62: port 2(erspan0) entered disabled state 15:24:34 executing program 3: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000340)={'erspan0\x00', 0x0}) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000300)={'syz_tun\x00', 0x0}) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r7, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r6, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000380)=@newlink={0x34, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r8}, [@IFLA_LINKINFO={0x14, 0x12, @bridge={{0xb, 0x1, 'bridge\x00'}, {0x4}}}]}, 0x34}}, 0x0) sendmsg$nl_route(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000002700)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r5}, [@IFLA_MASTER={0x8, 0xa, r8}]}, 0x28}}, 0x0) sendmsg$nl_route(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f00000000c0)=ANY=[@ANYBLOB="2800000010000104000040000000000000001ea6", @ANYRES32=r2, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00\b\x00\n\x00', @ANYRES32=r8], 0x28}}, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)) r9 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000300)={'syz_tun\x00', 0x0}) sendmsg$nl_route(r9, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000040)=@newlink={0x2c, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r10}, [@IFLA_BROADCAST={0xa}]}, 0x332}}, 0x0) [ 392.320656][T16994] bridge63: port 2(erspan0) entered blocking state [ 392.327378][T16994] bridge63: port 2(erspan0) entered disabled state [ 392.335555][T16994] device erspan0 entered promiscuous mode [ 392.349312][T17003] device syz_tun left promiscuous mode [ 392.355123][T17003] bridge196: port 1(syz_tun) entered disabled state [ 392.468220][T17003] bridge197: port 1(syz_tun) entered blocking state [ 392.475186][T17003] bridge197: port 1(syz_tun) entered disabled state [ 392.483595][T17003] device syz_tun entered promiscuous mode [ 392.657888][T17006] device erspan0 left promiscuous mode [ 392.663719][T17006] bridge196: port 2(erspan0) entered disabled state 15:24:34 executing program 4: r0 = socket$inet6(0xa, 0x80003, 0x6b) ioctl(r0, 0x1000008912, &(0x7f00000001c0)="080db5055e0bcfe8476071") r1 = socket(0x10, 0x2, 0x0) sendto(r1, &(0x7f0000000200)="120000001200e7ef007b1a3fcd00000000a1", 0x12, 0x0, 0x0, 0x18) recvmmsg(r1, &(0x7f00000037c0), 0x0, 0x6, &(0x7f0000003700)={0x77359400}) [ 392.797870][T17006] bridge197: port 2(erspan0) entered blocking state [ 392.804696][T17006] bridge197: port 2(erspan0) entered disabled state [ 392.816831][T17006] device erspan0 entered promiscuous mode [ 392.824609][T17008] netlink: 72 bytes leftover after parsing attributes in process `syz-executor.1'. 15:24:34 executing program 5: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000340)={'erspan0\x00', 0x0}) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000300)={'syz_tun\x00', 0x0}) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r7, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r6, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000380)=@newlink={0x34, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r8}, [@IFLA_LINKINFO={0x14, 0x12, @bridge={{0xb, 0x1, 'bridge\x00'}, {0x4}}}]}, 0x34}}, 0x0) sendmsg$nl_route(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000002700)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r5}, [@IFLA_MASTER={0x8, 0xa, r8}]}, 0x28}}, 0x0) sendmsg$nl_route(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f00000000c0)=ANY=[@ANYBLOB="2800000010000104000040000000000000001ea6", @ANYRES32=r2, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00\b\x00\n\x00', @ANYRES32=r8], 0x28}}, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r9, 0x8933, &(0x7f0000000300)={'syz_tun\x00', 0x0}) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000040)=@newlink={0x2c, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r10}, [@IFLA_BROADCAST={0xa}]}, 0x332}}, 0x0) 15:24:34 executing program 0: r0 = socket(0x21, 0xa, 0x1) r1 = socket(0x10, 0x80002, 0x0) ioctl(r1, 0x1000008912, &(0x7f00000001c0)="080db5055e0bcfe8696071") getsockopt$inet_sctp_SCTP_PEER_AUTH_CHUNKS(r1, 0x84, 0x1a, &(0x7f0000000940)=ANY=[@ANYRES32=0x0, @ANYBLOB='\x00'/12], &(0x7f0000000980)=0x10) getsockopt$inet_sctp_SCTP_GET_PEER_ADDR_INFO(r0, 0x84, 0xf, &(0x7f00000009c0)={r2, @in6={{0xa, 0x4e21, 0x8, @local, 0x401}}, 0x9, 0x1, 0x7, 0x7f, 0x6}, &(0x7f0000000a80)=0x98) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000400)='nl80211\x00') sendmsg$NL80211_CMD_GET_MESH_CONFIG(r0, &(0x7f0000000580)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x103190}, 0xc, &(0x7f0000000540)={&(0x7f0000000500)={0x34, r3, 0x10, 0x70bd2d, 0x25dfdbfe, {}, [@NL80211_ATTR_WDEV={0xc, 0x99, {0x1, 0xffffffffffffffff}}, @NL80211_ATTR_WIPHY={0x8, 0x1, 0x1}, @NL80211_ATTR_WDEV={0xc, 0x99, {0x3f, 0x3}}]}, 0x34}, 0x1, 0x0, 0x0, 0x800}, 0x40000) r4 = socket$nl_generic(0x10, 0x3, 0x10) bind$netlink(r4, &(0x7f0000000000)={0x10, 0x0, 0x25dfdbff, 0x1004280}, 0xffffffffffffffb3) sendmsg$nl_generic(0xffffffffffffffff, &(0x7f0000000080)={&(0x7f0000000480)={0x10, 0xbb7f}, 0xc, &(0x7f0000000440)={&(0x7f00000004c0)={0x1c, 0x22, 0x1, 0x0, 0x0, {0x4}, [@typed={0x8, 0xc}]}, 0x1c}}, 0x0) socket$netlink(0x10, 0x3, 0x0) r5 = socket$alg(0x26, 0x5, 0x0) bind$alg(r5, &(0x7f0000000080)={0x26, 'hash\x00', 0x0, 0x0, 'sha512\x00'}, 0x58) [ 392.870361][T17024] device syz_tun left promiscuous mode [ 392.891513][T17024] bridge209: port 1(syz_tun) entered disabled state [ 393.030283][T17024] bridge210: port 1(syz_tun) entered blocking state [ 393.037106][T17024] bridge210: port 1(syz_tun) entered disabled state [ 393.045255][T17024] device syz_tun entered promiscuous mode [ 393.054191][T17025] device erspan0 left promiscuous mode [ 393.060105][T17025] bridge209: port 2(erspan0) entered disabled state 15:24:35 executing program 2: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000340)={'erspan0\x00', 0x0}) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000300)={'syz_tun\x00', 0x0}) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r7, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r6, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000380)=@newlink={0x34, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r8}, [@IFLA_LINKINFO={0x14, 0x12, @bridge={{0xb, 0x1, 'bridge\x00'}, {0x4}}}]}, 0x34}}, 0x0) sendmsg$nl_route(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000002700)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r5}, [@IFLA_MASTER={0x8, 0xa, r8}]}, 0x28}}, 0x0) sendmsg$nl_route(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f00000000c0)=ANY=[@ANYBLOB="2800000010000104000040000000000000001ea6", @ANYRES32=r2, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00\b\x00\n\x00', @ANYRES32=r8], 0x28}}, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r10 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r9, 0x8933, &(0x7f0000000300)={'syz_tun\x00'}) sendmsg$nl_route(r10, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000040)=@newlink={0x2c, 0x10, 0x401, 0x0, 0x0, {}, [@IFLA_BROADCAST={0xa}]}, 0x332}}, 0x0) [ 393.177860][T17025] bridge210: port 2(erspan0) entered blocking state [ 393.184648][T17025] bridge210: port 2(erspan0) entered disabled state [ 393.193567][T17025] device erspan0 entered promiscuous mode [ 393.225243][T17030] device syz_tun left promiscuous mode [ 393.231343][T17030] bridge63: port 1(syz_tun) entered disabled state [ 393.367854][T17030] bridge64: port 1(syz_tun) entered blocking state [ 393.374680][T17030] bridge64: port 1(syz_tun) entered disabled state [ 393.386811][T17030] device syz_tun entered promiscuous mode [ 393.395153][T17031] device erspan0 left promiscuous mode [ 393.402160][T17031] bridge63: port 2(erspan0) entered disabled state [ 393.538611][T17031] bridge64: port 2(erspan0) entered blocking state [ 393.545319][T17031] bridge64: port 2(erspan0) entered disabled state [ 393.557392][T17031] device erspan0 entered promiscuous mode 15:24:35 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x0) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000004c0)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r3, @ANYBLOB="0000000000000000280012000c0001007665746800000000180002001400010000000000", @ANYRES32=0x0, @ANYBLOB="00000000008433df6d6f6b577d4eaaf2000007"], 0x48}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000540)=ANY=[@ANYBLOB="7400000024000705000000000000000000010000", @ANYRES32=r3, @ANYBLOB="00000000ffffffff000000000800010073667100486818973f73461919309b68e1693572bb000229c6090032d0ed64f3c3545aaf6e000085a4e4ebb5ef670000000000000000000000000000001a4e624d29a84abf03265700000000000000000000000000000000000000000000000000000000000000ac20000089b53c947244306a0216a3de887763df5b42498b13bb1938de859ee6d7ae7dd2224dc672b69b4358871b170ea0b667832e5224ee3538f885b7abd9bc4a7d"], 0x74}}, 0x0) r4 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r4, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000300)=ANY=[@ANYBLOB="840000002c00010700"/20, @ANYRES32=r3, @ANYBLOB="0008008000000000030000000800010075333200580002001400050000000000000000000000000000000000400006003c0001000000000000001020898dde66057433b6ef3a41d22be225e0001b0000000000000000000000000017256ffc66e43a2484e1a912c5998bcbf0d0000000000000000000000000000000798a3c067277da1a290b9613a33c575c36fad473382c8f5532ef3f0e1d2c450a7decbf3431a69f9b2ecb3291bed174245a962fe0484676958265e2988326a89db3139d91fe4aee6ae7e745ab00001a9f61f20500000000000000b3958bc14fce6e66a36d1ab3194534ba4e973684b27793bff837d3"], 0x84}}, 0x0) r5 = socket(0x10, 0x80002, 0x0) sendmmsg$alg(r5, &(0x7f0000000140), 0x49249249249278c, 0x0) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r6, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000500)=@newlink={0x20, 0x11, 0x40d, 0x0, 0x0, {0x0, 0x0, 0x0, r8}}, 0x20}}, 0x0) r9 = socket(0x10, 0x80002, 0x0) getsockopt$inet_sctp_SCTP_PEER_AUTH_CHUNKS(0xffffffffffffffff, 0x84, 0x1a, &(0x7f0000000940)=ANY=[@ANYRES32=0x0, @ANYBLOB='\x00'/12], &(0x7f0000000980)=0x10) r10 = socket(0xa, 0x6, 0x0) close(r10) r11 = socket$inet6_sctp(0xa, 0x10000000005, 0x84) setsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX(r11, 0x84, 0x6e, &(0x7f0000000180)=[@in6={0xa, 0x0, 0x0, @remote, 0x9}], 0x1c) getsockopt$inet_sctp6_SCTP_GET_ASSOC_ID_LIST(r11, 0x84, 0x1d, &(0x7f000095dff8)={0x1, [0x0]}, &(0x7f000095dffc)=0x8) setsockopt$inet_sctp_SCTP_RTOINFO(r10, 0x84, 0x0, &(0x7f0000000000)={r12, 0x0, 0x0, 0x1000000}, 0x10) setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(0xffffffffffffffff, 0x84, 0x9, &(0x7f0000000680)={r12, @in={{0x2, 0x4e20, @remote}}, 0x10001, 0xfff7, 0x5, 0x1, 0x8, 0x5, 0xba}, 0x9c) ioctl(r9, 0x1000008912, &(0x7f00000001c0)="080db5055e0bcfe8696071") getsockopt$inet_sctp_SCTP_PEER_AUTH_CHUNKS(r9, 0x84, 0x1a, &(0x7f0000000940)=ANY=[@ANYRES32=0x0, @ANYBLOB='\x00'/12], &(0x7f0000000980)=0x10) r13 = socket$nl_generic(0x10, 0x3, 0x10) r14 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080)='nl80211\x00') r15 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL80211_CMD_GET_STATION(r15, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000240)={0x1c, r14, 0xf2b, 0x0, 0x0, {}, [@NL80211_ATTR_AIRTIME_WEIGHT={0x8}]}, 0x1c}}, 0x0) sendmsg$NL80211_CMD_GET_MPATH(r13, &(0x7f00000001c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x2000}, 0x268, &(0x7f0000000080)={&(0x7f0000000200)={0x40, r14, 0x4, 0x70bd2d, 0x25dfdbff}, 0xff6b}, 0x1, 0x0, 0x0, 0x10049050}, 0x260448c0) sendmsg$NL80211_CMD_NEW_KEY(r9, &(0x7f0000000640)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0xb0024000}, 0xc, &(0x7f00000002c0)={&(0x7f0000000440)={0x7c, r14, 0x23, 0x70bd27, 0x25dfdbff, {}, [@NL80211_ATTR_KEY_DATA_WEP40={0x9, 0x7, "a80875ab12"}, @NL80211_ATTR_KEY={0x5c, 0x50, [@NL80211_KEY_DEFAULT_TYPES={0x14, 0x8, [@NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_MULTICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_MULTICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_MULTICAST={0x4}]}, @NL80211_KEY_DEFAULT_TYPES={0x28, 0x8, [@NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_MULTICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_MULTICAST={0x4}]}, @NL80211_KEY_IDX={0x5, 0x2, 0x5}, @NL80211_KEY_DATA_WEP104={0x11, 0x1, "4d84c4e30151cb27f51a4adf63"}]}]}, 0x7c}, 0x1, 0x0, 0x0, 0x24000}, 0x40) 15:24:35 executing program 4: r0 = socket$inet6(0xa, 0x80003, 0x6b) ioctl(r0, 0x1000008912, &(0x7f00000001c0)="080db5055e0bcfe8476071") r1 = socket(0x10, 0x2, 0x0) sendto(r1, &(0x7f0000000200)="120000001200e7ef007b1a3fcd00000000a1", 0x12, 0x0, 0x0, 0x18) recvmmsg(r1, &(0x7f00000037c0), 0x0, 0x6, &(0x7f0000003700)={0x77359400}) 15:24:35 executing program 0: r0 = socket(0x21, 0xa, 0x1) r1 = socket(0x10, 0x80002, 0x0) ioctl(r1, 0x1000008912, &(0x7f00000001c0)="080db5055e0bcfe8696071") getsockopt$inet_sctp_SCTP_PEER_AUTH_CHUNKS(r1, 0x84, 0x1a, &(0x7f0000000940)=ANY=[@ANYRES32=0x0, @ANYBLOB='\x00'/12], &(0x7f0000000980)=0x10) getsockopt$inet_sctp_SCTP_GET_PEER_ADDR_INFO(r0, 0x84, 0xf, &(0x7f00000009c0)={r2, @in6={{0xa, 0x4e21, 0x8, @local, 0x401}}, 0x9, 0x1, 0x7, 0x7f, 0x6}, &(0x7f0000000a80)=0x98) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000400)='nl80211\x00') sendmsg$NL80211_CMD_GET_MESH_CONFIG(r0, &(0x7f0000000580)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x103190}, 0xc, &(0x7f0000000540)={&(0x7f0000000500)={0x34, r3, 0x10, 0x70bd2d, 0x25dfdbfe, {}, [@NL80211_ATTR_WDEV={0xc, 0x99, {0x1, 0xffffffffffffffff}}, @NL80211_ATTR_WIPHY={0x8, 0x1, 0x1}, @NL80211_ATTR_WDEV={0xc, 0x99, {0x3f, 0x3}}]}, 0x34}, 0x1, 0x0, 0x0, 0x800}, 0x40000) r4 = socket$nl_generic(0x10, 0x3, 0x10) bind$netlink(r4, &(0x7f0000000000)={0x10, 0x0, 0x25dfdbff, 0x1004280}, 0xffffffffffffffb3) sendmsg$nl_generic(r4, 0x0, 0x0) socket$netlink(0x10, 0x3, 0x0) r5 = socket$alg(0x26, 0x5, 0x0) bind$alg(r5, &(0x7f0000000080)={0x26, 'hash\x00', 0x0, 0x0, 'sha512\x00'}, 0x58) [ 393.586706][T17043] device syz_tun left promiscuous mode [ 393.619356][T17043] bridge197: port 1(syz_tun) entered disabled state 15:24:35 executing program 3: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000340)={'erspan0\x00', 0x0}) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000300)={'syz_tun\x00', 0x0}) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r7, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r6, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000380)=@newlink={0x34, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r8}, [@IFLA_LINKINFO={0x14, 0x12, @bridge={{0xb, 0x1, 'bridge\x00'}, {0x4}}}]}, 0x34}}, 0x0) sendmsg$nl_route(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000002700)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r5}, [@IFLA_MASTER={0x8, 0xa, r8}]}, 0x28}}, 0x0) sendmsg$nl_route(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f00000000c0)=ANY=[@ANYBLOB="2800000010000104000040000000000000001ea6", @ANYRES32=r2, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00\b\x00\n\x00', @ANYRES32=r8], 0x28}}, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)) r9 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000300)={'syz_tun\x00', 0x0}) sendmsg$nl_route(r9, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000040)=@newlink={0x2c, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r10}, [@IFLA_BROADCAST={0xa}]}, 0x332}}, 0x0) [ 393.798983][T17043] bridge198: port 1(syz_tun) entered blocking state [ 393.805855][T17043] bridge198: port 1(syz_tun) entered disabled state [ 393.814402][T17043] device syz_tun entered promiscuous mode [ 393.822768][T17046] device erspan0 left promiscuous mode [ 393.829890][T17046] bridge197: port 2(erspan0) entered disabled state 15:24:36 executing program 5: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000340)={'erspan0\x00', 0x0}) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000300)={'syz_tun\x00', 0x0}) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r7, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r6, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000380)=@newlink={0x34, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r8}, [@IFLA_LINKINFO={0x14, 0x12, @bridge={{0xb, 0x1, 'bridge\x00'}, {0x4}}}]}, 0x34}}, 0x0) sendmsg$nl_route(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000002700)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r5}, [@IFLA_MASTER={0x8, 0xa, r8}]}, 0x28}}, 0x0) sendmsg$nl_route(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f00000000c0)=ANY=[@ANYBLOB="2800000010000104000040000000000000001ea6", @ANYRES32=r2, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00\b\x00\n\x00', @ANYRES32=r8], 0x28}}, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r10 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r9, 0x8933, &(0x7f0000000300)={'syz_tun\x00'}) sendmsg$nl_route(r10, 0x0, 0x0) [ 393.947760][T17046] bridge198: port 2(erspan0) entered blocking state [ 393.954709][T17046] bridge198: port 2(erspan0) entered disabled state [ 393.963425][T17046] device erspan0 entered promiscuous mode [ 393.983514][T17051] device syz_tun left promiscuous mode [ 393.991017][T17051] bridge210: port 1(syz_tun) entered disabled state [ 394.137776][T17051] bridge211: port 1(syz_tun) entered blocking state [ 394.144745][T17051] bridge211: port 1(syz_tun) entered disabled state [ 394.157483][T17051] device syz_tun entered promiscuous mode [ 394.165176][T17052] device erspan0 left promiscuous mode [ 394.171375][T17052] bridge210: port 2(erspan0) entered disabled state 15:24:36 executing program 2: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000340)={'erspan0\x00', 0x0}) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000300)={'syz_tun\x00', 0x0}) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r7, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r6, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000380)=@newlink={0x34, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r8}, [@IFLA_LINKINFO={0x14, 0x12, @bridge={{0xb, 0x1, 'bridge\x00'}, {0x4}}}]}, 0x34}}, 0x0) sendmsg$nl_route(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000002700)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r5}, [@IFLA_MASTER={0x8, 0xa, r8}]}, 0x28}}, 0x0) sendmsg$nl_route(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f00000000c0)=ANY=[@ANYBLOB="2800000010000104000040000000000000001ea6", @ANYRES32=r2, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00\b\x00\n\x00', @ANYRES32=r8], 0x28}}, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r10 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r9, 0x8933, &(0x7f0000000300)={'syz_tun\x00'}) sendmsg$nl_route(r10, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000040)=@newlink={0x2c, 0x10, 0x401, 0x0, 0x0, {}, [@IFLA_BROADCAST={0xa}]}, 0x332}}, 0x0) [ 394.317843][T17052] bridge211: port 2(erspan0) entered blocking state [ 394.324861][T17052] bridge211: port 2(erspan0) entered disabled state [ 394.333242][T17052] device erspan0 entered promiscuous mode 15:24:36 executing program 4: r0 = socket$inet6(0xa, 0x80003, 0x6b) ioctl(r0, 0x1000008912, &(0x7f00000001c0)="080db5055e0bcfe8476071") r1 = socket(0x10, 0x2, 0x0) sendto(r1, &(0x7f0000000200)="120000001200e7ef007b1a3fcd00000000a1", 0x12, 0x0, 0x0, 0x18) recvmmsg(r1, &(0x7f00000037c0), 0x0, 0x6, &(0x7f0000003700)={0x77359400}) 15:24:36 executing program 0: r0 = socket(0x21, 0xa, 0x1) r1 = socket(0x10, 0x80002, 0x0) ioctl(r1, 0x1000008912, &(0x7f00000001c0)="080db5055e0bcfe8696071") getsockopt$inet_sctp_SCTP_PEER_AUTH_CHUNKS(r1, 0x84, 0x1a, &(0x7f0000000940)=ANY=[@ANYRES32=0x0, @ANYBLOB='\x00'/12], &(0x7f0000000980)=0x10) getsockopt$inet_sctp_SCTP_GET_PEER_ADDR_INFO(r0, 0x84, 0xf, &(0x7f00000009c0)={r2, @in6={{0xa, 0x4e21, 0x8, @local, 0x401}}, 0x9, 0x1, 0x7, 0x7f, 0x6}, &(0x7f0000000a80)=0x98) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000400)='nl80211\x00') sendmsg$NL80211_CMD_GET_MESH_CONFIG(r0, &(0x7f0000000580)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x103190}, 0xc, &(0x7f0000000540)={&(0x7f0000000500)={0x34, r3, 0x10, 0x70bd2d, 0x25dfdbfe, {}, [@NL80211_ATTR_WDEV={0xc, 0x99, {0x1, 0xffffffffffffffff}}, @NL80211_ATTR_WIPHY={0x8, 0x1, 0x1}, @NL80211_ATTR_WDEV={0xc, 0x99, {0x3f, 0x3}}]}, 0x34}, 0x1, 0x0, 0x0, 0x800}, 0x40000) r4 = socket$nl_generic(0x10, 0x3, 0x10) bind$netlink(r4, &(0x7f0000000000)={0x10, 0x0, 0x25dfdbff, 0x1004280}, 0xffffffffffffffb3) sendmsg$nl_generic(r4, 0x0, 0x0) socket$netlink(0x10, 0x3, 0x0) r5 = socket$alg(0x26, 0x5, 0x0) bind$alg(r5, &(0x7f0000000080)={0x26, 'hash\x00', 0x0, 0x0, 'sha512\x00'}, 0x58) [ 394.507835][T17063] netlink: 72 bytes leftover after parsing attributes in process `syz-executor.1'. [ 394.532238][T17072] device syz_tun left promiscuous mode [ 394.540487][T17072] bridge64: port 1(syz_tun) entered disabled state [ 394.688039][T17072] bridge65: port 1(syz_tun) entered blocking state [ 394.697821][T17072] bridge65: port 1(syz_tun) entered disabled state [ 394.705969][T17072] device syz_tun entered promiscuous mode [ 394.713978][T17074] device erspan0 left promiscuous mode [ 394.719858][T17074] bridge64: port 2(erspan0) entered disabled state 15:24:36 executing program 3: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000340)={'erspan0\x00', 0x0}) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000300)={'syz_tun\x00', 0x0}) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r7, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r6, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000380)=@newlink={0x34, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r8}, [@IFLA_LINKINFO={0x14, 0x12, @bridge={{0xb, 0x1, 'bridge\x00'}, {0x4}}}]}, 0x34}}, 0x0) sendmsg$nl_route(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000002700)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r5}, [@IFLA_MASTER={0x8, 0xa, r8}]}, 0x28}}, 0x0) sendmsg$nl_route(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f00000000c0)=ANY=[@ANYBLOB="2800000010000104000040000000000000001ea6", @ANYRES32=r2, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00\b\x00\n\x00', @ANYRES32=r8], 0x28}}, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)) r9 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000300)={'syz_tun\x00', 0x0}) sendmsg$nl_route(r9, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000040)=@newlink={0x2c, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r10}, [@IFLA_BROADCAST={0xa}]}, 0x332}}, 0x0) [ 394.838166][T17074] bridge65: port 2(erspan0) entered blocking state [ 394.845032][T17074] bridge65: port 2(erspan0) entered disabled state [ 394.853734][T17074] device erspan0 entered promiscuous mode [ 394.869421][T17082] device syz_tun left promiscuous mode [ 394.876232][T17082] bridge198: port 1(syz_tun) entered disabled state [ 395.017827][T17082] bridge199: port 1(syz_tun) entered blocking state [ 395.024794][T17082] bridge199: port 1(syz_tun) entered disabled state [ 395.033475][T17082] device syz_tun entered promiscuous mode [ 395.042197][T17083] device erspan0 left promiscuous mode [ 395.051017][T17083] bridge198: port 2(erspan0) entered disabled state 15:24:37 executing program 5: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000340)={'erspan0\x00', 0x0}) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000300)={'syz_tun\x00', 0x0}) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r7, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r6, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000380)=@newlink={0x34, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r8}, [@IFLA_LINKINFO={0x14, 0x12, @bridge={{0xb, 0x1, 'bridge\x00'}, {0x4}}}]}, 0x34}}, 0x0) sendmsg$nl_route(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000002700)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r5}, [@IFLA_MASTER={0x8, 0xa, r8}]}, 0x28}}, 0x0) sendmsg$nl_route(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f00000000c0)=ANY=[@ANYBLOB="2800000010000104000040000000000000001ea6", @ANYRES32=r2, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00\b\x00\n\x00', @ANYRES32=r8], 0x28}}, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r10 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r9, 0x8933, &(0x7f0000000300)={'syz_tun\x00'}) sendmsg$nl_route(r10, 0x0, 0x0) [ 395.177751][T17083] bridge199: port 2(erspan0) entered blocking state [ 395.184593][T17083] bridge199: port 2(erspan0) entered disabled state [ 395.198090][T17083] device erspan0 entered promiscuous mode [ 395.229674][T17088] device syz_tun left promiscuous mode [ 395.237426][T17088] bridge211: port 1(syz_tun) entered disabled state [ 395.397926][T17088] bridge212: port 1(syz_tun) entered blocking state [ 395.405364][T17088] bridge212: port 1(syz_tun) entered disabled state [ 395.413958][T17088] device syz_tun entered promiscuous mode [ 395.423056][T17089] device erspan0 left promiscuous mode [ 395.430396][T17089] bridge211: port 2(erspan0) entered disabled state [ 395.557828][T17089] bridge212: port 2(erspan0) entered blocking state [ 395.564642][T17089] bridge212: port 2(erspan0) entered disabled state [ 395.573504][T17089] device erspan0 entered promiscuous mode 15:24:37 executing program 0: r0 = socket(0x21, 0xa, 0x1) r1 = socket(0x10, 0x80002, 0x0) ioctl(r1, 0x1000008912, &(0x7f00000001c0)="080db5055e0bcfe8696071") getsockopt$inet_sctp_SCTP_PEER_AUTH_CHUNKS(r1, 0x84, 0x1a, &(0x7f0000000940)=ANY=[@ANYRES32=0x0, @ANYBLOB='\x00'/12], &(0x7f0000000980)=0x10) getsockopt$inet_sctp_SCTP_GET_PEER_ADDR_INFO(r0, 0x84, 0xf, &(0x7f00000009c0)={r2, @in6={{0xa, 0x4e21, 0x8, @local, 0x401}}, 0x9, 0x1, 0x7, 0x7f, 0x6}, &(0x7f0000000a80)=0x98) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000400)='nl80211\x00') sendmsg$NL80211_CMD_GET_MESH_CONFIG(r0, &(0x7f0000000580)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x103190}, 0xc, &(0x7f0000000540)={&(0x7f0000000500)={0x34, r3, 0x10, 0x70bd2d, 0x25dfdbfe, {}, [@NL80211_ATTR_WDEV={0xc, 0x99, {0x1, 0xffffffffffffffff}}, @NL80211_ATTR_WIPHY={0x8, 0x1, 0x1}, @NL80211_ATTR_WDEV={0xc, 0x99, {0x3f, 0x3}}]}, 0x34}, 0x1, 0x0, 0x0, 0x800}, 0x40000) r4 = socket$nl_generic(0x10, 0x3, 0x10) bind$netlink(r4, &(0x7f0000000000)={0x10, 0x0, 0x25dfdbff, 0x1004280}, 0xffffffffffffffb3) sendmsg$nl_generic(r4, 0x0, 0x0) socket$netlink(0x10, 0x3, 0x0) r5 = socket$alg(0x26, 0x5, 0x0) bind$alg(r5, &(0x7f0000000080)={0x26, 'hash\x00', 0x0, 0x0, 'sha512\x00'}, 0x58) 15:24:37 executing program 4: r0 = socket$inet6(0xa, 0x80003, 0x6b) ioctl(r0, 0x1000008912, &(0x7f00000001c0)="080db5055e0bcfe8476071") r1 = socket(0x10, 0x2, 0x0) sendto(r1, &(0x7f0000000200)="120000001200e7ef007b1a3fcd00000000a1", 0x12, 0x0, 0x0, 0x18) recvmmsg(r1, &(0x7f00000037c0)=[{{0x0, 0x0, &(0x7f0000000380)=[{&(0x7f0000000040)=""/95, 0x5f}, {&(0x7f00000000c0)=""/85, 0x55}, {&(0x7f00000024c0)=""/4096, 0x1000}, {&(0x7f0000000400)=""/120, 0x78}, {&(0x7f0000000480)=""/60, 0x3c}, {&(0x7f0000000280)=""/77, 0x4d}, {&(0x7f0000000540)=""/154, 0x9a}, {&(0x7f0000000340)=""/22, 0x16}], 0x8, &(0x7f0000002400)=""/191, 0xbf}}], 0x1, 0x6, &(0x7f0000003700)={0x77359400}) 15:24:37 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x0) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000004c0)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r3, @ANYBLOB="0000000000000000280012000c0001007665746800000000180002001400010000000000", @ANYRES32=0x0, @ANYBLOB="00000000008433df6d6f6b577d4eaaf2000007"], 0x48}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000540)=ANY=[@ANYBLOB="7400000024000705000000000000000000010000", @ANYRES32=r3, @ANYBLOB="00000000ffffffff000000000800010073667100486818973f73461919309b68e1693572bb000229c6090032d0ed64f3c3545aaf6e000085a4e4ebb5ef670000000000000000000000000000001a4e624d29a84abf03265700000000000000000000000000000000000000000000000000000000000000ac20000089b53c947244306a0216a3de887763df5b42498b13bb1938de859ee6d7ae7dd2224dc672b69b4358871b170ea0b667832e5224ee3538f885b7abd9bc4a7d"], 0x74}}, 0x0) r4 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r4, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000300)=ANY=[@ANYBLOB="840000002c00010700"/20, @ANYRES32=r3, @ANYBLOB="0008008000000000030000000800010075333200580002001400050000000000000000000000000000000000400006003c0001000000000000001020898dde66057433b6ef3a41d22be225e0001b0000000000000000000000000017256ffc66e43a2484e1a912c5998bcbf0d0000000000000000000000000000000798a3c067277da1a290b9613a33c575c36fad473382c8f5532ef3f0e1d2c450a7decbf3431a69f9b2ecb3291bed174245a962fe0484676958265e2988326a89db3139d91fe4aee6ae7e745ab00001a9f61f20500000000000000b3958bc14fce6e66a36d1ab3194534ba4e973684b27793bff837d3"], 0x84}}, 0x0) r5 = socket(0x10, 0x80002, 0x0) sendmmsg$alg(r5, &(0x7f0000000140), 0x49249249249278c, 0x0) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r6, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000500)=@newlink={0x20, 0x11, 0x40d, 0x0, 0x0, {0x0, 0x0, 0x0, r8}}, 0x20}}, 0x0) r9 = socket(0x10, 0x80002, 0x0) getsockopt$inet_sctp_SCTP_PEER_AUTH_CHUNKS(0xffffffffffffffff, 0x84, 0x1a, &(0x7f0000000940)=ANY=[@ANYRES32=0x0, @ANYBLOB='\x00'/12], &(0x7f0000000980)=0x10) r10 = socket(0xa, 0x6, 0x0) close(r10) r11 = socket$inet6_sctp(0xa, 0x10000000005, 0x84) setsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX(r11, 0x84, 0x6e, &(0x7f0000000180)=[@in6={0xa, 0x0, 0x0, @remote, 0x9}], 0x1c) getsockopt$inet_sctp6_SCTP_GET_ASSOC_ID_LIST(r11, 0x84, 0x1d, &(0x7f000095dff8)={0x1, [0x0]}, &(0x7f000095dffc)=0x8) setsockopt$inet_sctp_SCTP_RTOINFO(r10, 0x84, 0x0, &(0x7f0000000000)={r12, 0x0, 0x0, 0x1000000}, 0x10) setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(0xffffffffffffffff, 0x84, 0x9, &(0x7f0000000680)={r12, @in={{0x2, 0x4e20, @remote}}, 0x10001, 0xfff7, 0x5, 0x1, 0x8, 0x5, 0xba}, 0x9c) ioctl(r9, 0x1000008912, &(0x7f00000001c0)="080db5055e0bcfe8696071") getsockopt$inet_sctp_SCTP_PEER_AUTH_CHUNKS(r9, 0x84, 0x1a, &(0x7f0000000940)=ANY=[@ANYRES32=0x0, @ANYBLOB='\x00'/12], &(0x7f0000000980)=0x10) r13 = socket$nl_generic(0x10, 0x3, 0x10) r14 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080)='nl80211\x00') r15 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL80211_CMD_GET_STATION(r15, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000240)={0x1c, r14, 0xf2b, 0x0, 0x0, {}, [@NL80211_ATTR_AIRTIME_WEIGHT={0x8}]}, 0x1c}}, 0x0) sendmsg$NL80211_CMD_GET_MPATH(r13, &(0x7f00000001c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x2000}, 0x268, &(0x7f0000000080)={&(0x7f0000000200)={0x40, r14, 0x4, 0x70bd2d, 0x25dfdbff}, 0xff6b}, 0x1, 0x0, 0x0, 0x10049050}, 0x260448c0) sendmsg$NL80211_CMD_NEW_KEY(r9, &(0x7f0000000640)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0xb0024000}, 0xc, &(0x7f00000002c0)={&(0x7f0000000440)={0x7c, r14, 0x23, 0x70bd27, 0x25dfdbff, {}, [@NL80211_ATTR_KEY_DATA_WEP40={0x9, 0x7, "a80875ab12"}, @NL80211_ATTR_KEY={0x5c, 0x50, [@NL80211_KEY_DEFAULT_TYPES={0x14, 0x8, [@NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_MULTICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_MULTICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_MULTICAST={0x4}]}, @NL80211_KEY_DEFAULT_TYPES={0x28, 0x8, [@NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_MULTICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_MULTICAST={0x4}]}, @NL80211_KEY_IDX={0x5, 0x2, 0x5}, @NL80211_KEY_DATA_WEP104={0x11, 0x1, "4d84c4e30151cb27f51a4adf63"}]}]}, 0x7c}, 0x1, 0x0, 0x0, 0x24000}, 0x40) 15:24:37 executing program 2: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000340)={'erspan0\x00', 0x0}) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000300)={'syz_tun\x00', 0x0}) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r7, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r6, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000380)=@newlink={0x34, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r8}, [@IFLA_LINKINFO={0x14, 0x12, @bridge={{0xb, 0x1, 'bridge\x00'}, {0x4}}}]}, 0x34}}, 0x0) sendmsg$nl_route(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000002700)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r5}, [@IFLA_MASTER={0x8, 0xa, r8}]}, 0x28}}, 0x0) sendmsg$nl_route(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f00000000c0)=ANY=[@ANYBLOB="2800000010000104000040000000000000001ea6", @ANYRES32=r2, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00\b\x00\n\x00', @ANYRES32=r8], 0x28}}, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r10 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r9, 0x8933, &(0x7f0000000300)={'syz_tun\x00'}) sendmsg$nl_route(r10, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000040)=@newlink={0x2c, 0x10, 0x401, 0x0, 0x0, {}, [@IFLA_BROADCAST={0xa}]}, 0x332}}, 0x0) [ 395.613854][T17103] device syz_tun left promiscuous mode [ 395.666906][T17103] bridge65: port 1(syz_tun) entered disabled state [ 395.867830][T17103] bridge66: port 1(syz_tun) entered blocking state [ 395.874634][T17103] bridge66: port 1(syz_tun) entered disabled state [ 395.884501][T17103] device syz_tun entered promiscuous mode [ 395.892436][T17104] device erspan0 left promiscuous mode [ 395.898487][T17104] bridge65: port 2(erspan0) entered disabled state 15:24:38 executing program 3: r0 = socket(0x21, 0xa, 0x1) r1 = socket(0x10, 0x80002, 0x0) ioctl(r1, 0x1000008912, &(0x7f00000001c0)="080db5055e0bcfe8696071") getsockopt$inet_sctp_SCTP_PEER_AUTH_CHUNKS(r1, 0x84, 0x1a, &(0x7f0000000940)=ANY=[@ANYRES32=0x0, @ANYBLOB='\x00'/12], &(0x7f0000000980)=0x10) getsockopt$inet_sctp_SCTP_GET_PEER_ADDR_INFO(r0, 0x84, 0xf, &(0x7f00000009c0)={r2, @in6={{0xa, 0x4e21, 0x8, @local, 0x401}}, 0x9, 0x1, 0x7, 0x7f, 0x6}, &(0x7f0000000a80)=0x98) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000400)='nl80211\x00') sendmsg$NL80211_CMD_GET_MESH_CONFIG(r0, &(0x7f0000000580)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x103190}, 0xc, &(0x7f0000000540)={&(0x7f0000000500)={0x34, r3, 0x10, 0x70bd2d, 0x25dfdbfe, {}, [@NL80211_ATTR_WDEV={0xc, 0x99, {0x1, 0xffffffffffffffff}}, @NL80211_ATTR_WIPHY={0x8, 0x1, 0x1}, @NL80211_ATTR_WDEV={0xc, 0x99, {0x3f, 0x3}}]}, 0x34}, 0x1, 0x0, 0x0, 0x800}, 0x40000) r4 = socket$nl_generic(0x10, 0x3, 0x10) bind$netlink(r4, &(0x7f0000000000)={0x10, 0x0, 0x25dfdbff, 0x1004280}, 0xffffffffffffffb3) sendmsg$nl_generic(0xffffffffffffffff, &(0x7f0000000080)={&(0x7f0000000480)={0x10, 0xbb7f}, 0xc, &(0x7f0000000440)={&(0x7f00000004c0)={0x1c, 0x22, 0x1, 0x0, 0x0, {0x4}, [@typed={0x8, 0xc}]}, 0x1c}}, 0x0) socket$netlink(0x10, 0x3, 0x0) r5 = socket$alg(0x26, 0x5, 0x0) bind$alg(r5, &(0x7f0000000080)={0x26, 'hash\x00', 0x0, 0x0, 'sha512\x00'}, 0x58) [ 396.008541][T17104] bridge66: port 2(erspan0) entered blocking state [ 396.015258][T17104] bridge66: port 2(erspan0) entered disabled state [ 396.023408][T17104] device erspan0 entered promiscuous mode [ 396.041511][T17109] device syz_tun left promiscuous mode [ 396.049747][T17109] bridge199: port 1(syz_tun) entered disabled state [ 396.187923][T17109] bridge200: port 1(syz_tun) entered blocking state [ 396.195005][T17109] bridge200: port 1(syz_tun) entered disabled state [ 396.203624][T17109] device syz_tun entered promiscuous mode [ 396.212870][T17110] device erspan0 left promiscuous mode [ 396.218708][T17110] bridge199: port 2(erspan0) entered disabled state 15:24:38 executing program 5: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000340)={'erspan0\x00', 0x0}) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000300)={'syz_tun\x00', 0x0}) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r7, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r6, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000380)=@newlink={0x34, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r8}, [@IFLA_LINKINFO={0x14, 0x12, @bridge={{0xb, 0x1, 'bridge\x00'}, {0x4}}}]}, 0x34}}, 0x0) sendmsg$nl_route(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000002700)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r5}, [@IFLA_MASTER={0x8, 0xa, r8}]}, 0x28}}, 0x0) sendmsg$nl_route(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f00000000c0)=ANY=[@ANYBLOB="2800000010000104000040000000000000001ea6", @ANYRES32=r2, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00\b\x00\n\x00', @ANYRES32=r8], 0x28}}, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r10 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r9, 0x8933, &(0x7f0000000300)={'syz_tun\x00'}) sendmsg$nl_route(r10, 0x0, 0x0) [ 396.358660][T17110] bridge200: port 2(erspan0) entered blocking state [ 396.367766][T17110] bridge200: port 2(erspan0) entered disabled state [ 396.379371][T17110] device erspan0 entered promiscuous mode 15:24:38 executing program 0: r0 = socket(0x21, 0xa, 0x1) r1 = socket(0x10, 0x80002, 0x0) ioctl(r1, 0x1000008912, &(0x7f00000001c0)="080db5055e0bcfe8696071") getsockopt$inet_sctp_SCTP_PEER_AUTH_CHUNKS(r1, 0x84, 0x1a, &(0x7f0000000940)=ANY=[@ANYRES32=0x0, @ANYBLOB='\x00'/12], &(0x7f0000000980)=0x10) getsockopt$inet_sctp_SCTP_GET_PEER_ADDR_INFO(r0, 0x84, 0xf, &(0x7f00000009c0)={r2, @in6={{0xa, 0x4e21, 0x8, @local, 0x401}}, 0x9, 0x1, 0x7, 0x7f, 0x6}, &(0x7f0000000a80)=0x98) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000400)='nl80211\x00') sendmsg$NL80211_CMD_GET_MESH_CONFIG(r0, &(0x7f0000000580)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x103190}, 0xc, &(0x7f0000000540)={&(0x7f0000000500)={0x34, r3, 0x10, 0x70bd2d, 0x25dfdbfe, {}, [@NL80211_ATTR_WDEV={0xc, 0x99, {0x1, 0xffffffffffffffff}}, @NL80211_ATTR_WIPHY={0x8, 0x1, 0x1}, @NL80211_ATTR_WDEV={0xc, 0x99, {0x3f, 0x3}}]}, 0x34}, 0x1, 0x0, 0x0, 0x800}, 0x40000) r4 = socket$nl_generic(0x10, 0x3, 0x10) bind$netlink(r4, &(0x7f0000000000)={0x10, 0x0, 0x25dfdbff, 0x1004280}, 0xffffffffffffffb3) sendmsg$nl_generic(r4, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000440)={&(0x7f00000004c0)={0x18, 0x22, 0x1, 0x0, 0x0, {0x4}, [@typed={0x4, 0xc}]}, 0x18}}, 0x0) socket$netlink(0x10, 0x3, 0x0) r5 = socket$alg(0x26, 0x5, 0x0) bind$alg(r5, &(0x7f0000000080)={0x26, 'hash\x00', 0x0, 0x0, 'sha512\x00'}, 0x58) 15:24:38 executing program 4: r0 = socket$inet6(0xa, 0x80003, 0x6b) ioctl(r0, 0x1000008912, &(0x7f00000001c0)="080db5055e0bcfe8476071") r1 = socket(0x10, 0x2, 0x0) sendto(r1, &(0x7f0000000200)="120000001200e7ef007b1a3fcd00000000a1", 0x12, 0x0, 0x0, 0x18) recvmmsg(r1, &(0x7f00000037c0)=[{{0x0, 0x0, &(0x7f0000000380)=[{&(0x7f0000000040)=""/95, 0x5f}, {&(0x7f00000000c0)=""/85, 0x55}, {&(0x7f00000024c0)=""/4096, 0x1000}, {&(0x7f0000000400)=""/120, 0x78}, {&(0x7f0000000480)=""/60, 0x3c}, {&(0x7f0000000280)=""/77, 0x4d}, {&(0x7f0000000540)=""/154, 0x9a}, {&(0x7f0000000340)=""/22, 0x16}], 0x8, &(0x7f0000002400)=""/191, 0xbf}}], 0x1, 0x6, &(0x7f0000003700)={0x77359400}) [ 396.585089][T17124] netlink: 72 bytes leftover after parsing attributes in process `syz-executor.1'. [ 396.599483][T17127] device syz_tun left promiscuous mode [ 396.606746][T17127] bridge212: port 1(syz_tun) entered disabled state [ 396.727446][T17153] netlink: 'syz-executor.0': attribute type 12 has an invalid length. [ 396.757825][T17127] bridge213: port 1(syz_tun) entered blocking state [ 396.764713][T17127] bridge213: port 1(syz_tun) entered disabled state [ 396.773607][T17127] device syz_tun entered promiscuous mode [ 396.783067][T17130] device erspan0 left promiscuous mode [ 396.788827][T17130] bridge212: port 2(erspan0) entered disabled state 15:24:39 executing program 3: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000340)={'erspan0\x00', 0x0}) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000300)={'syz_tun\x00', 0x0}) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r7, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r6, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000380)=@newlink={0x34, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r8}, [@IFLA_LINKINFO={0x14, 0x12, @bridge={{0xb, 0x1, 'bridge\x00'}, {0x4}}}]}, 0x34}}, 0x0) sendmsg$nl_route(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000002700)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r5}, [@IFLA_MASTER={0x8, 0xa, r8}]}, 0x28}}, 0x0) sendmsg$nl_route(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f00000000c0)=ANY=[@ANYBLOB="2800000010000104000040000000000000001ea6", @ANYRES32=r2, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00\b\x00\n\x00', @ANYRES32=r8], 0x28}}, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r10 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r9, 0x8933, &(0x7f0000000300)={'syz_tun\x00'}) sendmsg$nl_route(r10, &(0x7f0000000000)={0x0, 0x0, 0x0}, 0x0) 15:24:39 executing program 2: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000340)={'erspan0\x00', 0x0}) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000300)={'syz_tun\x00', 0x0}) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r7, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r6, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000380)=@newlink={0x34, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r8}, [@IFLA_LINKINFO={0x14, 0x12, @bridge={{0xb, 0x1, 'bridge\x00'}, {0x4}}}]}, 0x34}}, 0x0) sendmsg$nl_route(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000002700)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r5}, [@IFLA_MASTER={0x8, 0xa, r8}]}, 0x28}}, 0x0) sendmsg$nl_route(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f00000000c0)=ANY=[@ANYBLOB="2800000010000104000040000000000000001ea6", @ANYRES32=r2, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00\b\x00\n\x00', @ANYRES32=r8], 0x28}}, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r10 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r9, 0x8933, &(0x7f0000000300)={'syz_tun\x00', 0x0}) sendmsg$nl_route(r10, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000040)=@newlink={0x20, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r11}}, 0x20}}, 0x0) [ 396.917822][T17130] bridge213: port 2(erspan0) entered blocking state [ 396.924751][T17130] bridge213: port 2(erspan0) entered disabled state [ 396.933984][T17130] device erspan0 entered promiscuous mode [ 396.952011][T17144] device syz_tun left promiscuous mode [ 396.959260][T17144] bridge200: port 1(syz_tun) entered disabled state [ 397.112067][T17144] bridge201: port 1(syz_tun) entered blocking state [ 397.118863][T17144] bridge201: port 1(syz_tun) entered disabled state [ 397.126826][T17144] device syz_tun entered promiscuous mode [ 397.138670][T17145] device erspan0 left promiscuous mode [ 397.144658][T17145] bridge200: port 2(erspan0) entered disabled state [ 397.268145][T17145] bridge201: port 2(erspan0) entered blocking state [ 397.275126][T17145] bridge201: port 2(erspan0) entered disabled state [ 397.283560][T17145] device erspan0 entered promiscuous mode 15:24:39 executing program 5: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000340)={'erspan0\x00', 0x0}) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000300)={'syz_tun\x00', 0x0}) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r7, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r6, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000380)=@newlink={0x34, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r8}, [@IFLA_LINKINFO={0x14, 0x12, @bridge={{0xb, 0x1, 'bridge\x00'}, {0x4}}}]}, 0x34}}, 0x0) sendmsg$nl_route(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000002700)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r5}, [@IFLA_MASTER={0x8, 0xa, r8}]}, 0x28}}, 0x0) sendmsg$nl_route(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f00000000c0)=ANY=[@ANYBLOB="2800000010000104000040000000000000001ea6", @ANYRES32=r2, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00\b\x00\n\x00', @ANYRES32=r8], 0x28}}, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r10 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r9, 0x8933, &(0x7f0000000300)={'syz_tun\x00'}) sendmsg$nl_route(r10, &(0x7f0000000000)={0x0, 0x0, 0x0}, 0x0) 15:24:39 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x0) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000004c0)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r3, @ANYBLOB="0000000000000000280012000c0001007665746800000000180002001400010000000000", @ANYRES32=0x0, @ANYBLOB="00000000008433df6d6f6b577d4eaaf2000007"], 0x48}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000540)=ANY=[@ANYBLOB="7400000024000705000000000000000000010000", @ANYRES32=r3, @ANYBLOB="00000000ffffffff000000000800010073667100486818973f73461919309b68e1693572bb000229c6090032d0ed64f3c3545aaf6e000085a4e4ebb5ef670000000000000000000000000000001a4e624d29a84abf03265700000000000000000000000000000000000000000000000000000000000000ac20000089b53c947244306a0216a3de887763df5b42498b13bb1938de859ee6d7ae7dd2224dc672b69b4358871b170ea0b667832e5224ee3538f885b7abd9bc4a7d"], 0x74}}, 0x0) r4 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r4, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000300)=ANY=[@ANYBLOB="840000002c00010700"/20, @ANYRES32=r3, @ANYBLOB="0008008000000000030000000800010075333200580002001400050000000000000000000000000000000000400006003c0001000000000000001020898dde66057433b6ef3a41d22be225e0001b0000000000000000000000000017256ffc66e43a2484e1a912c5998bcbf0d0000000000000000000000000000000798a3c067277da1a290b9613a33c575c36fad473382c8f5532ef3f0e1d2c450a7decbf3431a69f9b2ecb3291bed174245a962fe0484676958265e2988326a89db3139d91fe4aee6ae7e745ab00001a9f61f20500000000000000b3958bc14fce6e66a36d1ab3194534ba4e973684b27793bff837d3"], 0x84}}, 0x0) r5 = socket(0x10, 0x80002, 0x0) sendmmsg$alg(r5, &(0x7f0000000140), 0x49249249249278c, 0x0) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r6, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000500)=@newlink={0x20, 0x11, 0x40d, 0x0, 0x0, {0x0, 0x0, 0x0, r8}}, 0x20}}, 0x0) r9 = socket(0x10, 0x80002, 0x0) getsockopt$inet_sctp_SCTP_PEER_AUTH_CHUNKS(0xffffffffffffffff, 0x84, 0x1a, &(0x7f0000000940)=ANY=[@ANYRES32=0x0, @ANYBLOB='\x00'/12], &(0x7f0000000980)=0x10) r10 = socket(0xa, 0x6, 0x0) close(r10) r11 = socket$inet6_sctp(0xa, 0x10000000005, 0x84) setsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX(r11, 0x84, 0x6e, &(0x7f0000000180)=[@in6={0xa, 0x0, 0x0, @remote, 0x9}], 0x1c) getsockopt$inet_sctp6_SCTP_GET_ASSOC_ID_LIST(r11, 0x84, 0x1d, &(0x7f000095dff8)={0x1, [0x0]}, &(0x7f000095dffc)=0x8) setsockopt$inet_sctp_SCTP_RTOINFO(r10, 0x84, 0x0, &(0x7f0000000000)={r12, 0x0, 0x0, 0x1000000}, 0x10) setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(0xffffffffffffffff, 0x84, 0x9, &(0x7f0000000680)={r12, @in={{0x2, 0x4e20, @remote}}, 0x10001, 0xfff7, 0x5, 0x1, 0x8, 0x5, 0xba}, 0x9c) ioctl(r9, 0x1000008912, &(0x7f00000001c0)="080db5055e0bcfe8696071") getsockopt$inet_sctp_SCTP_PEER_AUTH_CHUNKS(r9, 0x84, 0x1a, &(0x7f0000000940)=ANY=[@ANYRES32=0x0, @ANYBLOB='\x00'/12], &(0x7f0000000980)=0x10) r13 = socket$nl_generic(0x10, 0x3, 0x10) r14 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080)='nl80211\x00') r15 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL80211_CMD_GET_STATION(r15, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000240)={0x1c, r14, 0xf2b, 0x0, 0x0, {}, [@NL80211_ATTR_AIRTIME_WEIGHT={0x8}]}, 0x1c}}, 0x0) sendmsg$NL80211_CMD_GET_MPATH(r13, &(0x7f00000001c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x2000}, 0x268, &(0x7f0000000080)={&(0x7f0000000200)={0x40, r14, 0x4, 0x70bd2d, 0x25dfdbff}, 0xff6b}, 0x1, 0x0, 0x0, 0x10049050}, 0x260448c0) sendmsg$NL80211_CMD_NEW_KEY(r9, &(0x7f0000000640)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0xb0024000}, 0xc, &(0x7f00000002c0)={&(0x7f0000000440)={0x7c, r14, 0x23, 0x70bd27, 0x25dfdbff, {}, [@NL80211_ATTR_KEY_DATA_WEP40={0x9, 0x7, "a80875ab12"}, @NL80211_ATTR_KEY={0x5c, 0x50, [@NL80211_KEY_DEFAULT_TYPES={0x14, 0x8, [@NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_MULTICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_MULTICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_MULTICAST={0x4}]}, @NL80211_KEY_DEFAULT_TYPES={0x28, 0x8, [@NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_MULTICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_MULTICAST={0x4}]}, @NL80211_KEY_IDX={0x5, 0x2, 0x5}, @NL80211_KEY_DATA_WEP104={0x11, 0x1, "4d84c4e30151cb27f51a4adf63"}]}]}, 0x7c}, 0x1, 0x0, 0x0, 0x24000}, 0x40) [ 397.333882][T17163] device syz_tun left promiscuous mode [ 397.368210][T17163] bridge66: port 1(syz_tun) entered disabled state [ 397.507885][T17163] bridge67: port 1(syz_tun) entered blocking state [ 397.514662][T17163] bridge67: port 1(syz_tun) entered disabled state [ 397.522858][T17163] device syz_tun entered promiscuous mode [ 397.531363][T17164] device syz_tun left promiscuous mode [ 397.537401][T17164] bridge213: port 1(syz_tun) entered disabled state [ 397.667818][T17164] bridge214: port 1(syz_tun) entered blocking state [ 397.674701][T17164] bridge214: port 1(syz_tun) entered disabled state [ 397.682878][T17164] device syz_tun entered promiscuous mode [ 397.691723][T17165] device erspan0 left promiscuous mode [ 397.697456][T17165] bridge66: port 2(erspan0) entered disabled state 15:24:39 executing program 3: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000340)={'erspan0\x00', 0x0}) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000300)={'syz_tun\x00', 0x0}) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r7, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r6, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000380)=@newlink={0x34, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r8}, [@IFLA_LINKINFO={0x14, 0x12, @bridge={{0xb, 0x1, 'bridge\x00'}, {0x4}}}]}, 0x34}}, 0x0) sendmsg$nl_route(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000002700)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r5}, [@IFLA_MASTER={0x8, 0xa, r8}]}, 0x28}}, 0x0) sendmsg$nl_route(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f00000000c0)=ANY=[@ANYBLOB="2800000010000104000040000000000000001ea6", @ANYRES32=r2, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00\b\x00\n\x00', @ANYRES32=r8], 0x28}}, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r10 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r9, 0x8933, &(0x7f0000000300)={'syz_tun\x00'}) sendmsg$nl_route(r10, &(0x7f0000000000)={0x0, 0x0, 0x0}, 0x0) [ 397.827839][T17165] bridge67: port 2(erspan0) entered blocking state [ 397.834574][T17165] bridge67: port 2(erspan0) entered disabled state [ 397.846812][T17165] device erspan0 entered promiscuous mode [ 397.854856][T17166] device erspan0 left promiscuous mode [ 397.861060][T17166] bridge213: port 2(erspan0) entered disabled state 15:24:40 executing program 4: r0 = socket$inet6(0xa, 0x80003, 0x6b) ioctl(r0, 0x1000008912, &(0x7f00000001c0)="080db5055e0bcfe8476071") r1 = socket(0x10, 0x2, 0x0) sendto(r1, &(0x7f0000000200)="120000001200e7ef007b1a3fcd00000000a1", 0x12, 0x0, 0x0, 0x18) recvmmsg(r1, &(0x7f00000037c0)=[{{0x0, 0x0, &(0x7f0000000380)=[{&(0x7f0000000040)=""/95, 0x5f}, {&(0x7f00000000c0)=""/85, 0x55}, {&(0x7f00000024c0)=""/4096, 0x1000}, {&(0x7f0000000400)=""/120, 0x78}, {&(0x7f0000000480)=""/60, 0x3c}, {&(0x7f0000000280)=""/77, 0x4d}, {&(0x7f0000000540)=""/154, 0x9a}, {&(0x7f0000000340)=""/22, 0x16}], 0x8, &(0x7f0000002400)=""/191, 0xbf}}], 0x1, 0x6, &(0x7f0000003700)={0x77359400}) [ 397.997829][T17166] bridge214: port 2(erspan0) entered blocking state [ 398.004753][T17166] bridge214: port 2(erspan0) entered disabled state [ 398.013618][T17166] device erspan0 entered promiscuous mode 15:24:40 executing program 2: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000340)={'erspan0\x00', 0x0}) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000300)={'syz_tun\x00', 0x0}) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r7, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r6, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000380)=@newlink={0x34, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r8}, [@IFLA_LINKINFO={0x14, 0x12, @bridge={{0xb, 0x1, 'bridge\x00'}, {0x4}}}]}, 0x34}}, 0x0) sendmsg$nl_route(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000002700)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r5}, [@IFLA_MASTER={0x8, 0xa, r8}]}, 0x28}}, 0x0) sendmsg$nl_route(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f00000000c0)=ANY=[@ANYBLOB="2800000010000104000040000000000000001ea6", @ANYRES32=r2, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00\b\x00\n\x00', @ANYRES32=r8], 0x28}}, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r10 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r9, 0x8933, &(0x7f0000000300)={'syz_tun\x00', 0x0}) sendmsg$nl_route(r10, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000040)=@newlink={0x20, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r11}}, 0x20}}, 0x0) 15:24:40 executing program 0: r0 = socket(0x21, 0xa, 0x1) r1 = socket(0x10, 0x80002, 0x0) ioctl(r1, 0x1000008912, &(0x7f00000001c0)="080db5055e0bcfe8696071") getsockopt$inet_sctp_SCTP_PEER_AUTH_CHUNKS(r1, 0x84, 0x1a, &(0x7f0000000940)=ANY=[@ANYRES32=0x0, @ANYBLOB='\x00'/12], &(0x7f0000000980)=0x10) getsockopt$inet_sctp_SCTP_GET_PEER_ADDR_INFO(r0, 0x84, 0xf, &(0x7f00000009c0)={r2, @in6={{0xa, 0x4e21, 0x8, @local, 0x401}}, 0x9, 0x1, 0x7, 0x7f, 0x6}, &(0x7f0000000a80)=0x98) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000400)='nl80211\x00') sendmsg$NL80211_CMD_GET_MESH_CONFIG(r0, &(0x7f0000000580)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x103190}, 0xc, &(0x7f0000000540)={&(0x7f0000000500)={0x34, r3, 0x10, 0x70bd2d, 0x25dfdbfe, {}, [@NL80211_ATTR_WDEV={0xc, 0x99, {0x1, 0xffffffffffffffff}}, @NL80211_ATTR_WIPHY={0x8, 0x1, 0x1}, @NL80211_ATTR_WDEV={0xc, 0x99, {0x3f, 0x3}}]}, 0x34}, 0x1, 0x0, 0x0, 0x800}, 0x40000) r4 = socket$nl_generic(0x10, 0x3, 0x10) bind$netlink(r4, &(0x7f0000000000)={0x10, 0x0, 0x25dfdbff, 0x1004280}, 0xffffffffffffffb3) sendmsg$nl_generic(r4, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000440)={&(0x7f00000004c0)={0x18, 0x22, 0x1, 0x0, 0x0, {0x4}, [@typed={0x4, 0xc}]}, 0x18}}, 0x0) socket$netlink(0x10, 0x3, 0x0) r5 = socket$alg(0x26, 0x5, 0x0) bind$alg(r5, &(0x7f0000000080)={0x26, 'hash\x00', 0x0, 0x0, 'sha512\x00'}, 0x58) [ 398.211030][T17201] netlink: 'syz-executor.0': attribute type 12 has an invalid length. [ 398.220132][T17175] device syz_tun left promiscuous mode [ 398.226143][T17175] bridge201: port 1(syz_tun) entered disabled state [ 398.371025][T17175] bridge202: port 1(syz_tun) entered blocking state [ 398.383049][T17175] bridge202: port 1(syz_tun) entered disabled state [ 398.391042][T17175] device syz_tun entered promiscuous mode [ 398.402483][T17176] netlink: 72 bytes leftover after parsing attributes in process `syz-executor.1'. [ 398.412396][T17177] device erspan0 left promiscuous mode [ 398.418444][T17177] bridge201: port 2(erspan0) entered disabled state 15:24:40 executing program 5: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000340)={'erspan0\x00', 0x0}) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000300)={'syz_tun\x00', 0x0}) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r7, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r6, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000380)=@newlink={0x34, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r8}, [@IFLA_LINKINFO={0x14, 0x12, @bridge={{0xb, 0x1, 'bridge\x00'}, {0x4}}}]}, 0x34}}, 0x0) sendmsg$nl_route(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000002700)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r5}, [@IFLA_MASTER={0x8, 0xa, r8}]}, 0x28}}, 0x0) sendmsg$nl_route(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f00000000c0)=ANY=[@ANYBLOB="2800000010000104000040000000000000001ea6", @ANYRES32=r2, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00\b\x00\n\x00', @ANYRES32=r8], 0x28}}, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r10 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r9, 0x8933, &(0x7f0000000300)={'syz_tun\x00'}) sendmsg$nl_route(r10, &(0x7f0000000000)={0x0, 0x0, 0x0}, 0x0) [ 398.557814][T17177] bridge202: port 2(erspan0) entered blocking state [ 398.564783][T17177] bridge202: port 2(erspan0) entered disabled state [ 398.573043][T17177] device erspan0 entered promiscuous mode [ 398.588417][T17188] device syz_tun left promiscuous mode [ 398.596779][T17188] bridge67: port 1(syz_tun) entered disabled state [ 398.747809][T17188] bridge68: port 1(syz_tun) entered blocking state [ 398.754616][T17188] bridge68: port 1(syz_tun) entered disabled state [ 398.764088][T17188] device syz_tun entered promiscuous mode [ 398.773454][T17189] device erspan0 left promiscuous mode [ 398.779537][T17189] bridge67: port 2(erspan0) entered disabled state 15:24:40 executing program 3: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000340)={'erspan0\x00', 0x0}) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000300)={'syz_tun\x00', 0x0}) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r7, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r6, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000380)=@newlink={0x34, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r8}, [@IFLA_LINKINFO={0x14, 0x12, @bridge={{0xb, 0x1, 'bridge\x00'}, {0x4}}}]}, 0x34}}, 0x0) sendmsg$nl_route(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000002700)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r5}, [@IFLA_MASTER={0x8, 0xa, r8}]}, 0x28}}, 0x0) sendmsg$nl_route(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f00000000c0)=ANY=[@ANYBLOB="2800000010000104000040000000000000001ea6", @ANYRES32=r2, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00\b\x00\n\x00', @ANYRES32=r8], 0x28}}, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r10 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r9, 0x8933, &(0x7f0000000300)={'syz_tun\x00'}) sendmsg$nl_route(r10, &(0x7f0000000000)={0x0, 0x0, 0x0}, 0x0) [ 398.908394][T17189] bridge68: port 2(erspan0) entered blocking state [ 398.915136][T17189] bridge68: port 2(erspan0) entered disabled state [ 398.923698][T17189] device erspan0 entered promiscuous mode [ 398.967548][T17203] device syz_tun left promiscuous mode [ 398.975340][T17203] bridge214: port 1(syz_tun) entered disabled state [ 399.107833][T17203] bridge215: port 1(syz_tun) entered blocking state [ 399.114601][T17203] bridge215: port 1(syz_tun) entered disabled state [ 399.123369][T17203] device syz_tun entered promiscuous mode [ 399.131014][T17205] device erspan0 left promiscuous mode [ 399.136869][T17205] bridge214: port 2(erspan0) entered disabled state 15:24:41 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) socket$netlink(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000004c0)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r2, @ANYBLOB="0000000000000000280012000c0001007665746800000000180002001400010000000000", @ANYRES32=0x0, @ANYBLOB="00000000008433df6d6f6b577d4eaaf2000007"], 0x48}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000540)=ANY=[@ANYBLOB="7400000024000705000000000000000000010000", @ANYRES32=r2, @ANYBLOB="00000000ffffffff000000000800010073667100486818973f73461919309b68e1693572bb000229c6090032d0ed64f3c3545aaf6e000085a4e4ebb5ef670000000000000000000000000000001a4e624d29a84abf03265700000000000000000000000000000000000000000000000000000000000000ac20000089b53c947244306a0216a3de887763df5b42498b13bb1938de859ee6d7ae7dd2224dc672b69b4358871b170ea0b667832e5224ee3538f885b7abd9bc4a7d"], 0x74}}, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r3, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000300)=ANY=[@ANYBLOB="840000002c00010700"/20, @ANYRES32=r2, @ANYBLOB="0008008000000000030000000800010075333200580002001400050000000000000000000000000000000000400006003c0001000000000000001020898dde66057433b6ef3a41d22be225e0001b0000000000000000000000000017256ffc66e43a2484e1a912c5998bcbf0d0000000000000000000000000000000798a3c067277da1a290b9613a33c575c36fad473382c8f5532ef3f0e1d2c450a7decbf3431a69f9b2ecb3291bed174245a962fe0484676958265e2988326a89db3139d91fe4aee6ae7e745ab00001a9f61f20500000000000000b3958bc14fce6e66a36d1ab3194534ba4e973684b27793bff837d3"], 0x84}}, 0x0) r4 = socket(0x10, 0x80002, 0x0) sendmmsg$alg(r4, &(0x7f0000000140), 0x49249249249278c, 0x0) r5 = socket$nl_route(0x10, 0x3, 0x0) r6 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r6, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r5, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000500)=@newlink={0x20, 0x11, 0x40d, 0x0, 0x0, {0x0, 0x0, 0x0, r7}}, 0x20}}, 0x0) r8 = socket(0x10, 0x80002, 0x0) getsockopt$inet_sctp_SCTP_PEER_AUTH_CHUNKS(0xffffffffffffffff, 0x84, 0x1a, &(0x7f0000000940)=ANY=[@ANYRES32=0x0, @ANYBLOB='\x00'/12], &(0x7f0000000980)=0x10) r9 = socket(0xa, 0x6, 0x0) close(r9) r10 = socket$inet6_sctp(0xa, 0x10000000005, 0x84) setsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX(r10, 0x84, 0x6e, &(0x7f0000000180)=[@in6={0xa, 0x0, 0x0, @remote, 0x9}], 0x1c) getsockopt$inet_sctp6_SCTP_GET_ASSOC_ID_LIST(r10, 0x84, 0x1d, &(0x7f000095dff8)={0x1, [0x0]}, &(0x7f000095dffc)=0x8) setsockopt$inet_sctp_SCTP_RTOINFO(r9, 0x84, 0x0, &(0x7f0000000000)={r11, 0x0, 0x0, 0x1000000}, 0x10) setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(0xffffffffffffffff, 0x84, 0x9, &(0x7f0000000680)={r11, @in={{0x2, 0x4e20, @remote}}, 0x10001, 0xfff7, 0x5, 0x1, 0x8, 0x5, 0xba}, 0x9c) ioctl(r8, 0x1000008912, &(0x7f00000001c0)="080db5055e0bcfe8696071") getsockopt$inet_sctp_SCTP_PEER_AUTH_CHUNKS(r8, 0x84, 0x1a, &(0x7f0000000940)=ANY=[@ANYRES32=0x0, @ANYBLOB='\x00'/12], &(0x7f0000000980)=0x10) r12 = socket$nl_generic(0x10, 0x3, 0x10) r13 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080)='nl80211\x00') r14 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL80211_CMD_GET_STATION(r14, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000240)={0x1c, r13, 0xf2b, 0x0, 0x0, {}, [@NL80211_ATTR_AIRTIME_WEIGHT={0x8}]}, 0x1c}}, 0x0) sendmsg$NL80211_CMD_GET_MPATH(r12, &(0x7f00000001c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x2000}, 0x268, &(0x7f0000000080)={&(0x7f0000000200)={0x40, r13, 0x4, 0x70bd2d, 0x25dfdbff}, 0xff6b}, 0x1, 0x0, 0x0, 0x10049050}, 0x260448c0) sendmsg$NL80211_CMD_NEW_KEY(r8, &(0x7f0000000640)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0xb0024000}, 0xc, &(0x7f00000002c0)={&(0x7f0000000440)={0x7c, r13, 0x23, 0x70bd27, 0x25dfdbff, {}, [@NL80211_ATTR_KEY_DATA_WEP40={0x9, 0x7, "a80875ab12"}, @NL80211_ATTR_KEY={0x5c, 0x50, [@NL80211_KEY_DEFAULT_TYPES={0x14, 0x8, [@NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_MULTICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_MULTICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_MULTICAST={0x4}]}, @NL80211_KEY_DEFAULT_TYPES={0x28, 0x8, [@NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_MULTICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_MULTICAST={0x4}]}, @NL80211_KEY_IDX={0x5, 0x2, 0x5}, @NL80211_KEY_DATA_WEP104={0x11, 0x1, "4d84c4e30151cb27f51a4adf63"}]}]}, 0x7c}, 0x1, 0x0, 0x0, 0x24000}, 0x40) [ 399.258745][T17205] bridge215: port 2(erspan0) entered blocking state [ 399.265513][T17205] bridge215: port 2(erspan0) entered disabled state [ 399.273915][T17205] device erspan0 entered promiscuous mode [ 399.291599][T17210] device syz_tun left promiscuous mode [ 399.301164][T17210] bridge202: port 1(syz_tun) entered disabled state 15:24:41 executing program 2: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000340)={'erspan0\x00', 0x0}) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000300)={'syz_tun\x00', 0x0}) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r7, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r6, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000380)=@newlink={0x34, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r8}, [@IFLA_LINKINFO={0x14, 0x12, @bridge={{0xb, 0x1, 'bridge\x00'}, {0x4}}}]}, 0x34}}, 0x0) sendmsg$nl_route(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000002700)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r5}, [@IFLA_MASTER={0x8, 0xa, r8}]}, 0x28}}, 0x0) sendmsg$nl_route(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f00000000c0)=ANY=[@ANYBLOB="2800000010000104000040000000000000001ea6", @ANYRES32=r2, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00\b\x00\n\x00', @ANYRES32=r8], 0x28}}, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r10 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r9, 0x8933, &(0x7f0000000300)={'syz_tun\x00', 0x0}) sendmsg$nl_route(r10, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000040)=@newlink={0x20, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r11}}, 0x20}}, 0x0) [ 399.440206][T17210] bridge203: port 1(syz_tun) entered blocking state [ 399.451232][T17210] bridge203: port 1(syz_tun) entered disabled state [ 399.460694][T17210] device syz_tun entered promiscuous mode [ 399.469043][T17211] device erspan0 left promiscuous mode [ 399.474632][T17211] bridge202: port 2(erspan0) entered disabled state [ 399.627763][T17211] bridge203: port 2(erspan0) entered blocking state [ 399.634701][T17211] bridge203: port 2(erspan0) entered disabled state [ 399.647826][T17211] device erspan0 entered promiscuous mode [ 399.672275][T17216] device syz_tun left promiscuous mode 15:24:41 executing program 4: r0 = socket$inet6(0xa, 0x80003, 0x6b) ioctl(r0, 0x1000008912, &(0x7f00000001c0)="080db5055e0bcfe8476071") r1 = socket(0x10, 0x2, 0x0) sendto(r1, &(0x7f0000000200)="120000001200e7ef007b1a3fcd00000000a1", 0x12, 0x0, 0x0, 0x18) recvmmsg(r1, &(0x7f00000037c0)=[{{&(0x7f0000000600)=@ethernet={0x0, @random}, 0x80, 0x0, 0x0, &(0x7f0000002400)=""/191, 0xbf}}], 0x1, 0x6, &(0x7f0000003700)={0x77359400}) 15:24:41 executing program 5: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000340)={'erspan0\x00', 0x0}) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000300)={'syz_tun\x00', 0x0}) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r7, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r6, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000380)=@newlink={0x34, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r8}, [@IFLA_LINKINFO={0x14, 0x12, @bridge={{0xb, 0x1, 'bridge\x00'}, {0x4}}}]}, 0x34}}, 0x0) sendmsg$nl_route(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000002700)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r5}, [@IFLA_MASTER={0x8, 0xa, r8}]}, 0x28}}, 0x0) sendmsg$nl_route(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f00000000c0)=ANY=[@ANYBLOB="2800000010000104000040000000000000001ea6", @ANYRES32=r2, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00\b\x00\n\x00', @ANYRES32=r8], 0x28}}, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r10 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r9, 0x8933, &(0x7f0000000300)={'syz_tun\x00'}) sendmsg$nl_route(r10, &(0x7f0000000000)={0x0, 0x0, 0x0}, 0x0) 15:24:41 executing program 0: r0 = socket(0x21, 0xa, 0x1) r1 = socket(0x10, 0x80002, 0x0) ioctl(r1, 0x1000008912, &(0x7f00000001c0)="080db5055e0bcfe8696071") getsockopt$inet_sctp_SCTP_PEER_AUTH_CHUNKS(r1, 0x84, 0x1a, &(0x7f0000000940)=ANY=[@ANYRES32=0x0, @ANYBLOB='\x00'/12], &(0x7f0000000980)=0x10) getsockopt$inet_sctp_SCTP_GET_PEER_ADDR_INFO(r0, 0x84, 0xf, &(0x7f00000009c0)={r2, @in6={{0xa, 0x4e21, 0x8, @local, 0x401}}, 0x9, 0x1, 0x7, 0x7f, 0x6}, &(0x7f0000000a80)=0x98) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000400)='nl80211\x00') sendmsg$NL80211_CMD_GET_MESH_CONFIG(r0, &(0x7f0000000580)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x103190}, 0xc, &(0x7f0000000540)={&(0x7f0000000500)={0x34, r3, 0x10, 0x70bd2d, 0x25dfdbfe, {}, [@NL80211_ATTR_WDEV={0xc, 0x99, {0x1, 0xffffffffffffffff}}, @NL80211_ATTR_WIPHY={0x8, 0x1, 0x1}, @NL80211_ATTR_WDEV={0xc, 0x99, {0x3f, 0x3}}]}, 0x34}, 0x1, 0x0, 0x0, 0x800}, 0x40000) r4 = socket$nl_generic(0x10, 0x3, 0x10) bind$netlink(r4, &(0x7f0000000000)={0x10, 0x0, 0x25dfdbff, 0x1004280}, 0xffffffffffffffb3) sendmsg$nl_generic(r4, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000440)={&(0x7f00000004c0)={0x18, 0x22, 0x1, 0x0, 0x0, {0x4}, [@typed={0x4, 0xc}]}, 0x18}}, 0x0) socket$netlink(0x10, 0x3, 0x0) r5 = socket$alg(0x26, 0x5, 0x0) bind$alg(r5, &(0x7f0000000080)={0x26, 'hash\x00', 0x0, 0x0, 'sha512\x00'}, 0x58) [ 399.693828][T17216] bridge68: port 1(syz_tun) entered disabled state [ 399.857350][T17246] netlink: 'syz-executor.0': attribute type 12 has an invalid length. [ 399.868143][T17216] bridge69: port 1(syz_tun) entered blocking state [ 399.877907][T17216] bridge69: port 1(syz_tun) entered disabled state [ 399.891266][T17216] device syz_tun entered promiscuous mode [ 399.901154][T17217] device erspan0 left promiscuous mode [ 399.907301][T17217] bridge68: port 2(erspan0) entered disabled state [ 400.037853][T17217] bridge69: port 2(erspan0) entered blocking state [ 400.044682][T17217] bridge69: port 2(erspan0) entered disabled state [ 400.053009][T17217] device erspan0 entered promiscuous mode [ 400.060637][T17221] netlink: 72 bytes leftover after parsing attributes in process `syz-executor.1'. 15:24:42 executing program 3: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000340)={'erspan0\x00', 0x0}) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000300)={'syz_tun\x00', 0x0}) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r7, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r6, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000380)=@newlink={0x34, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r8}, [@IFLA_LINKINFO={0x14, 0x12, @bridge={{0xb, 0x1, 'bridge\x00'}, {0x4}}}]}, 0x34}}, 0x0) sendmsg$nl_route(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000002700)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r5}, [@IFLA_MASTER={0x8, 0xa, r8}]}, 0x28}}, 0x0) sendmsg$nl_route(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f00000000c0)=ANY=[@ANYBLOB="2800000010000104000040000000000000001ea6", @ANYRES32=r2, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00\b\x00\n\x00', @ANYRES32=r8], 0x28}}, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r10 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r9, 0x8933, &(0x7f0000000300)={'syz_tun\x00'}) sendmsg$nl_route(r10, 0x0, 0x0) [ 400.083690][T17225] netlink: 72 bytes leftover after parsing attributes in process `syz-executor.1'. [ 400.095463][T17226] device syz_tun left promiscuous mode [ 400.109433][T17226] bridge215: port 1(syz_tun) entered disabled state [ 400.238902][T17226] bridge216: port 1(syz_tun) entered blocking state [ 400.245881][T17226] bridge216: port 1(syz_tun) entered disabled state [ 400.254376][T17226] device syz_tun entered promiscuous mode [ 400.262620][T17228] device erspan0 left promiscuous mode [ 400.271952][T17228] bridge215: port 2(erspan0) entered disabled state [ 400.397936][T17228] bridge216: port 2(erspan0) entered blocking state [ 400.404810][T17228] bridge216: port 2(erspan0) entered disabled state [ 400.414673][T17228] device erspan0 entered promiscuous mode [ 400.423504][T17232] netlink: 'syz-executor.1': attribute type 274 has an invalid length. [ 400.453661][T17234] netlink: 'syz-executor.1': attribute type 274 has an invalid length. [ 400.492398][T17247] device syz_tun left promiscuous mode 15:24:42 executing program 2: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000340)={'erspan0\x00', 0x0}) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000300)={'syz_tun\x00', 0x0}) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r7, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r6, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000380)=@newlink={0x34, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r8}, [@IFLA_LINKINFO={0x14, 0x12, @bridge={{0xb, 0x1, 'bridge\x00'}, {0x4}}}]}, 0x34}}, 0x0) sendmsg$nl_route(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000002700)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r5}, [@IFLA_MASTER={0x8, 0xa, r8}]}, 0x28}}, 0x0) sendmsg$nl_route(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f00000000c0)=ANY=[@ANYBLOB="2800000010000104000040000000000000001ea6", @ANYRES32=r2, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00\b\x00\n\x00', @ANYRES32=r8], 0x28}}, 0x0) socketpair$unix(0x1, 0x2, 0x0, 0x0) r9 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000300)={'syz_tun\x00', 0x0}) sendmsg$nl_route(r9, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000040)=@newlink={0x2c, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r10}, [@IFLA_BROADCAST={0xa}]}, 0x332}}, 0x0) 15:24:42 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) socket$netlink(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000004c0)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r2, @ANYBLOB="0000000000000000280012000c0001007665746800000000180002001400010000000000", @ANYRES32=0x0, @ANYBLOB="00000000008433df6d6f6b577d4eaaf2000007"], 0x48}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000540)=ANY=[@ANYBLOB="7400000024000705000000000000000000010000", @ANYRES32=r2, @ANYBLOB="00000000ffffffff000000000800010073667100486818973f73461919309b68e1693572bb000229c6090032d0ed64f3c3545aaf6e000085a4e4ebb5ef670000000000000000000000000000001a4e624d29a84abf03265700000000000000000000000000000000000000000000000000000000000000ac20000089b53c947244306a0216a3de887763df5b42498b13bb1938de859ee6d7ae7dd2224dc672b69b4358871b170ea0b667832e5224ee3538f885b7abd9bc4a7d"], 0x74}}, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r3, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000300)=ANY=[@ANYBLOB="840000002c00010700"/20, @ANYRES32=r2, @ANYBLOB="0008008000000000030000000800010075333200580002001400050000000000000000000000000000000000400006003c0001000000000000001020898dde66057433b6ef3a41d22be225e0001b0000000000000000000000000017256ffc66e43a2484e1a912c5998bcbf0d0000000000000000000000000000000798a3c067277da1a290b9613a33c575c36fad473382c8f5532ef3f0e1d2c450a7decbf3431a69f9b2ecb3291bed174245a962fe0484676958265e2988326a89db3139d91fe4aee6ae7e745ab00001a9f61f20500000000000000b3958bc14fce6e66a36d1ab3194534ba4e973684b27793bff837d3"], 0x84}}, 0x0) r4 = socket(0x10, 0x80002, 0x0) sendmmsg$alg(r4, &(0x7f0000000140), 0x49249249249278c, 0x0) r5 = socket$nl_route(0x10, 0x3, 0x0) r6 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r6, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r5, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000500)=@newlink={0x20, 0x11, 0x40d, 0x0, 0x0, {0x0, 0x0, 0x0, r7}}, 0x20}}, 0x0) r8 = socket(0x10, 0x80002, 0x0) getsockopt$inet_sctp_SCTP_PEER_AUTH_CHUNKS(0xffffffffffffffff, 0x84, 0x1a, &(0x7f0000000940)=ANY=[@ANYRES32=0x0, @ANYBLOB='\x00'/12], &(0x7f0000000980)=0x10) r9 = socket(0xa, 0x6, 0x0) close(r9) r10 = socket$inet6_sctp(0xa, 0x10000000005, 0x84) setsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX(r10, 0x84, 0x6e, &(0x7f0000000180)=[@in6={0xa, 0x0, 0x0, @remote, 0x9}], 0x1c) getsockopt$inet_sctp6_SCTP_GET_ASSOC_ID_LIST(r10, 0x84, 0x1d, &(0x7f000095dff8)={0x1, [0x0]}, &(0x7f000095dffc)=0x8) setsockopt$inet_sctp_SCTP_RTOINFO(r9, 0x84, 0x0, &(0x7f0000000000)={r11, 0x0, 0x0, 0x1000000}, 0x10) setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(0xffffffffffffffff, 0x84, 0x9, &(0x7f0000000680)={r11, @in={{0x2, 0x4e20, @remote}}, 0x10001, 0xfff7, 0x5, 0x1, 0x8, 0x5, 0xba}, 0x9c) ioctl(r8, 0x1000008912, &(0x7f00000001c0)="080db5055e0bcfe8696071") getsockopt$inet_sctp_SCTP_PEER_AUTH_CHUNKS(r8, 0x84, 0x1a, &(0x7f0000000940)=ANY=[@ANYRES32=0x0, @ANYBLOB='\x00'/12], &(0x7f0000000980)=0x10) r12 = socket$nl_generic(0x10, 0x3, 0x10) r13 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080)='nl80211\x00') r14 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL80211_CMD_GET_STATION(r14, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000240)={0x1c, r13, 0xf2b, 0x0, 0x0, {}, [@NL80211_ATTR_AIRTIME_WEIGHT={0x8}]}, 0x1c}}, 0x0) sendmsg$NL80211_CMD_GET_MPATH(r12, &(0x7f00000001c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x2000}, 0x268, &(0x7f0000000080)={&(0x7f0000000200)={0x40, r13, 0x4, 0x70bd2d, 0x25dfdbff}, 0xff6b}, 0x1, 0x0, 0x0, 0x10049050}, 0x260448c0) sendmsg$NL80211_CMD_NEW_KEY(r8, &(0x7f0000000640)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0xb0024000}, 0xc, &(0x7f00000002c0)={&(0x7f0000000440)={0x7c, r13, 0x23, 0x70bd27, 0x25dfdbff, {}, [@NL80211_ATTR_KEY_DATA_WEP40={0x9, 0x7, "a80875ab12"}, @NL80211_ATTR_KEY={0x5c, 0x50, [@NL80211_KEY_DEFAULT_TYPES={0x14, 0x8, [@NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_MULTICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_MULTICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_MULTICAST={0x4}]}, @NL80211_KEY_DEFAULT_TYPES={0x28, 0x8, [@NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_MULTICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_MULTICAST={0x4}]}, @NL80211_KEY_IDX={0x5, 0x2, 0x5}, @NL80211_KEY_DATA_WEP104={0x11, 0x1, "4d84c4e30151cb27f51a4adf63"}]}]}, 0x7c}, 0x1, 0x0, 0x0, 0x24000}, 0x40) 15:24:42 executing program 4: r0 = socket$inet6(0xa, 0x80003, 0x6b) ioctl(r0, 0x1000008912, &(0x7f00000001c0)="080db5055e0bcfe8476071") r1 = socket(0x10, 0x2, 0x0) sendto(r1, &(0x7f0000000200)="120000001200e7ef007b1a3fcd00000000a1", 0x12, 0x0, 0x0, 0x18) recvmmsg(r1, &(0x7f00000037c0)=[{{&(0x7f0000000600)=@ethernet={0x0, @random}, 0x80, 0x0, 0x0, &(0x7f0000002400)=""/191, 0xbf}}], 0x1, 0x6, &(0x7f0000003700)={0x77359400}) [ 400.522817][T17247] bridge203: port 1(syz_tun) entered disabled state [ 400.727965][T17247] bridge204: port 1(syz_tun) entered blocking state [ 400.735455][T17247] bridge204: port 1(syz_tun) entered disabled state [ 400.743641][T17247] device syz_tun entered promiscuous mode [ 400.769105][T17249] device erspan0 left promiscuous mode [ 400.774801][T17249] bridge203: port 2(erspan0) entered disabled state 15:24:42 executing program 5: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000340)={'erspan0\x00', 0x0}) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000300)={'syz_tun\x00', 0x0}) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r7, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r6, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000380)=@newlink={0x34, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r8}, [@IFLA_LINKINFO={0x14, 0x12, @bridge={{0xb, 0x1, 'bridge\x00'}, {0x4}}}]}, 0x34}}, 0x0) sendmsg$nl_route(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000002700)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r5}, [@IFLA_MASTER={0x8, 0xa, r8}]}, 0x28}}, 0x0) sendmsg$nl_route(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f00000000c0)=ANY=[@ANYBLOB="2800000010000104000040000000000000001ea6", @ANYRES32=r2, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00\b\x00\n\x00', @ANYRES32=r8], 0x28}}, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r10 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r9, 0x8933, &(0x7f0000000300)={'syz_tun\x00'}) sendmsg$nl_route(r10, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={0x0}}, 0x0) [ 400.887866][T17249] bridge204: port 2(erspan0) entered blocking state [ 400.894633][T17249] bridge204: port 2(erspan0) entered disabled state [ 400.905967][T17249] device erspan0 entered promiscuous mode [ 400.919932][T17254] device syz_tun left promiscuous mode [ 400.941081][T17254] bridge69: port 1(syz_tun) entered disabled state [ 401.077828][T17254] bridge70: port 1(syz_tun) entered blocking state [ 401.084539][T17254] bridge70: port 1(syz_tun) entered disabled state [ 401.099824][T17254] device syz_tun entered promiscuous mode [ 401.107145][T17255] device erspan0 left promiscuous mode [ 401.114294][T17255] bridge69: port 2(erspan0) entered disabled state 15:24:43 executing program 3: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000340)={'erspan0\x00', 0x0}) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000300)={'syz_tun\x00', 0x0}) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r7, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r6, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000380)=@newlink={0x34, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r8}, [@IFLA_LINKINFO={0x14, 0x12, @bridge={{0xb, 0x1, 'bridge\x00'}, {0x4}}}]}, 0x34}}, 0x0) sendmsg$nl_route(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000002700)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r5}, [@IFLA_MASTER={0x8, 0xa, r8}]}, 0x28}}, 0x0) sendmsg$nl_route(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f00000000c0)=ANY=[@ANYBLOB="2800000010000104000040000000000000001ea6", @ANYRES32=r2, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00\b\x00\n\x00', @ANYRES32=r8], 0x28}}, 0x0) socketpair$unix(0x1, 0x2, 0x0, 0x0) r9 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000300)={'syz_tun\x00', 0x0}) sendmsg$nl_route(r9, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000040)=@newlink={0x2c, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r10}, [@IFLA_BROADCAST={0xa}]}, 0x332}}, 0x0) [ 401.239006][T17255] bridge70: port 2(erspan0) entered blocking state [ 401.246035][T17255] bridge70: port 2(erspan0) entered disabled state [ 401.254386][T17255] device erspan0 entered promiscuous mode [ 401.268630][T17263] device syz_tun left promiscuous mode [ 401.275781][T17263] bridge216: port 1(syz_tun) entered disabled state [ 401.429629][T17263] bridge217: port 1(syz_tun) entered blocking state [ 401.436315][T17263] bridge217: port 1(syz_tun) entered disabled state [ 401.448817][T17263] device syz_tun entered promiscuous mode [ 401.456018][T17262] netlink: 72 bytes leftover after parsing attributes in process `syz-executor.1'. [ 401.466963][T17267] device erspan0 left promiscuous mode [ 401.472958][T17267] bridge216: port 2(erspan0) entered disabled state [ 401.628040][T17267] bridge217: port 2(erspan0) entered blocking state [ 401.634858][T17267] bridge217: port 2(erspan0) entered disabled state [ 401.643075][T17267] device erspan0 entered promiscuous mode [ 401.651801][T17268] netlink: 72 bytes leftover after parsing attributes in process `syz-executor.1'. 15:24:43 executing program 4: r0 = socket$inet6(0xa, 0x80003, 0x6b) ioctl(r0, 0x1000008912, &(0x7f00000001c0)="080db5055e0bcfe8476071") r1 = socket(0x10, 0x2, 0x0) sendto(r1, &(0x7f0000000200)="120000001200e7ef007b1a3fcd00000000a1", 0x12, 0x0, 0x0, 0x18) recvmmsg(r1, &(0x7f00000037c0)=[{{&(0x7f0000000600)=@ethernet={0x0, @random}, 0x80, 0x0, 0x0, &(0x7f0000002400)=""/191, 0xbf}}], 0x1, 0x6, &(0x7f0000003700)={0x77359400}) 15:24:43 executing program 2: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000340)={'erspan0\x00', 0x0}) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000300)={'syz_tun\x00', 0x0}) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r7, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r6, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000380)=@newlink={0x34, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r8}, [@IFLA_LINKINFO={0x14, 0x12, @bridge={{0xb, 0x1, 'bridge\x00'}, {0x4}}}]}, 0x34}}, 0x0) sendmsg$nl_route(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000002700)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r5}, [@IFLA_MASTER={0x8, 0xa, r8}]}, 0x28}}, 0x0) sendmsg$nl_route(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f00000000c0)=ANY=[@ANYBLOB="2800000010000104000040000000000000001ea6", @ANYRES32=r2, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00\b\x00\n\x00', @ANYRES32=r8], 0x28}}, 0x0) socketpair$unix(0x1, 0x2, 0x0, 0x0) r9 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000300)={'syz_tun\x00', 0x0}) sendmsg$nl_route(r9, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000040)=@newlink={0x2c, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r10}, [@IFLA_BROADCAST={0xa}]}, 0x332}}, 0x0) [ 401.683285][T17280] device syz_tun left promiscuous mode [ 401.692349][T17280] bridge204: port 1(syz_tun) entered disabled state 15:24:43 executing program 0: r0 = socket(0x21, 0xa, 0x1) r1 = socket(0x10, 0x80002, 0x0) ioctl(r1, 0x1000008912, &(0x7f00000001c0)="080db5055e0bcfe8696071") getsockopt$inet_sctp_SCTP_PEER_AUTH_CHUNKS(r1, 0x84, 0x1a, &(0x7f0000000940)=ANY=[@ANYRES32=0x0, @ANYBLOB='\x00'/12], &(0x7f0000000980)=0x10) getsockopt$inet_sctp_SCTP_GET_PEER_ADDR_INFO(r0, 0x84, 0xf, &(0x7f00000009c0)={r2, @in6={{0xa, 0x4e21, 0x8, @local, 0x401}}, 0x9, 0x1, 0x7, 0x7f, 0x6}, &(0x7f0000000a80)=0x98) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000400)='nl80211\x00') sendmsg$NL80211_CMD_GET_MESH_CONFIG(r0, &(0x7f0000000580)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x103190}, 0xc, &(0x7f0000000540)={&(0x7f0000000500)={0x34, r3, 0x10, 0x70bd2d, 0x25dfdbfe, {}, [@NL80211_ATTR_WDEV={0xc, 0x99, {0x1, 0xffffffffffffffff}}, @NL80211_ATTR_WIPHY={0x8, 0x1, 0x1}, @NL80211_ATTR_WDEV={0xc, 0x99, {0x3f, 0x3}}]}, 0x34}, 0x1, 0x0, 0x0, 0x800}, 0x40000) r4 = socket$nl_generic(0x10, 0x3, 0x10) bind$netlink(r4, &(0x7f0000000000)={0x10, 0x0, 0x25dfdbff, 0x1004280}, 0xffffffffffffffb3) sendmsg$nl_generic(r4, &(0x7f0000000080)={&(0x7f0000000480)={0x10, 0xbb7f}, 0xc, 0x0}, 0x0) socket$netlink(0x10, 0x3, 0x0) r5 = socket$alg(0x26, 0x5, 0x0) bind$alg(r5, &(0x7f0000000080)={0x26, 'hash\x00', 0x0, 0x0, 'sha512\x00'}, 0x58) 15:24:43 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) socket$netlink(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000004c0)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r2, @ANYBLOB="0000000000000000280012000c0001007665746800000000180002001400010000000000", @ANYRES32=0x0, @ANYBLOB="00000000008433df6d6f6b577d4eaaf2000007"], 0x48}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000540)=ANY=[@ANYBLOB="7400000024000705000000000000000000010000", @ANYRES32=r2, @ANYBLOB="00000000ffffffff000000000800010073667100486818973f73461919309b68e1693572bb000229c6090032d0ed64f3c3545aaf6e000085a4e4ebb5ef670000000000000000000000000000001a4e624d29a84abf03265700000000000000000000000000000000000000000000000000000000000000ac20000089b53c947244306a0216a3de887763df5b42498b13bb1938de859ee6d7ae7dd2224dc672b69b4358871b170ea0b667832e5224ee3538f885b7abd9bc4a7d"], 0x74}}, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r3, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000300)=ANY=[@ANYBLOB="840000002c00010700"/20, @ANYRES32=r2, @ANYBLOB="0008008000000000030000000800010075333200580002001400050000000000000000000000000000000000400006003c0001000000000000001020898dde66057433b6ef3a41d22be225e0001b0000000000000000000000000017256ffc66e43a2484e1a912c5998bcbf0d0000000000000000000000000000000798a3c067277da1a290b9613a33c575c36fad473382c8f5532ef3f0e1d2c450a7decbf3431a69f9b2ecb3291bed174245a962fe0484676958265e2988326a89db3139d91fe4aee6ae7e745ab00001a9f61f20500000000000000b3958bc14fce6e66a36d1ab3194534ba4e973684b27793bff837d3"], 0x84}}, 0x0) r4 = socket(0x10, 0x80002, 0x0) sendmmsg$alg(r4, &(0x7f0000000140), 0x49249249249278c, 0x0) r5 = socket$nl_route(0x10, 0x3, 0x0) r6 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r6, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r5, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000500)=@newlink={0x20, 0x11, 0x40d, 0x0, 0x0, {0x0, 0x0, 0x0, r7}}, 0x20}}, 0x0) r8 = socket(0x10, 0x80002, 0x0) getsockopt$inet_sctp_SCTP_PEER_AUTH_CHUNKS(0xffffffffffffffff, 0x84, 0x1a, &(0x7f0000000940)=ANY=[@ANYRES32=0x0, @ANYBLOB='\x00'/12], &(0x7f0000000980)=0x10) r9 = socket(0xa, 0x6, 0x0) close(r9) r10 = socket$inet6_sctp(0xa, 0x10000000005, 0x84) setsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX(r10, 0x84, 0x6e, &(0x7f0000000180)=[@in6={0xa, 0x0, 0x0, @remote, 0x9}], 0x1c) getsockopt$inet_sctp6_SCTP_GET_ASSOC_ID_LIST(r10, 0x84, 0x1d, &(0x7f000095dff8)={0x1, [0x0]}, &(0x7f000095dffc)=0x8) setsockopt$inet_sctp_SCTP_RTOINFO(r9, 0x84, 0x0, &(0x7f0000000000)={r11, 0x0, 0x0, 0x1000000}, 0x10) setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(0xffffffffffffffff, 0x84, 0x9, &(0x7f0000000680)={r11, @in={{0x2, 0x4e20, @remote}}, 0x10001, 0xfff7, 0x5, 0x1, 0x8, 0x5, 0xba}, 0x9c) ioctl(r8, 0x1000008912, &(0x7f00000001c0)="080db5055e0bcfe8696071") getsockopt$inet_sctp_SCTP_PEER_AUTH_CHUNKS(r8, 0x84, 0x1a, &(0x7f0000000940)=ANY=[@ANYRES32=0x0, @ANYBLOB='\x00'/12], &(0x7f0000000980)=0x10) r12 = socket$nl_generic(0x10, 0x3, 0x10) r13 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080)='nl80211\x00') r14 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL80211_CMD_GET_STATION(r14, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000240)={0x1c, r13, 0xf2b, 0x0, 0x0, {}, [@NL80211_ATTR_AIRTIME_WEIGHT={0x8}]}, 0x1c}}, 0x0) sendmsg$NL80211_CMD_GET_MPATH(r12, &(0x7f00000001c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x2000}, 0x268, &(0x7f0000000080)={&(0x7f0000000200)={0x40, r13, 0x4, 0x70bd2d, 0x25dfdbff}, 0xff6b}, 0x1, 0x0, 0x0, 0x10049050}, 0x260448c0) sendmsg$NL80211_CMD_NEW_KEY(r8, &(0x7f0000000640)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0xb0024000}, 0xc, &(0x7f00000002c0)={&(0x7f0000000440)={0x7c, r13, 0x23, 0x70bd27, 0x25dfdbff, {}, [@NL80211_ATTR_KEY_DATA_WEP40={0x9, 0x7, "a80875ab12"}, @NL80211_ATTR_KEY={0x5c, 0x50, [@NL80211_KEY_DEFAULT_TYPES={0x14, 0x8, [@NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_MULTICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_MULTICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_MULTICAST={0x4}]}, @NL80211_KEY_DEFAULT_TYPES={0x28, 0x8, [@NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_MULTICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_MULTICAST={0x4}]}, @NL80211_KEY_IDX={0x5, 0x2, 0x5}, @NL80211_KEY_DATA_WEP104={0x11, 0x1, "4d84c4e30151cb27f51a4adf63"}]}]}, 0x7c}, 0x1, 0x0, 0x0, 0x24000}, 0x40) [ 401.867870][T17280] bridge205: port 1(syz_tun) entered blocking state [ 401.875912][T17280] bridge205: port 1(syz_tun) entered disabled state [ 401.900625][T17280] device syz_tun entered promiscuous mode [ 401.912884][T17281] device erspan0 left promiscuous mode [ 401.922050][T17281] bridge204: port 2(erspan0) entered disabled state 15:24:44 executing program 5: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000340)={'erspan0\x00', 0x0}) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000300)={'syz_tun\x00', 0x0}) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r7, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r6, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000380)=@newlink={0x34, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r8}, [@IFLA_LINKINFO={0x14, 0x12, @bridge={{0xb, 0x1, 'bridge\x00'}, {0x4}}}]}, 0x34}}, 0x0) sendmsg$nl_route(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000002700)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r5}, [@IFLA_MASTER={0x8, 0xa, r8}]}, 0x28}}, 0x0) sendmsg$nl_route(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f00000000c0)=ANY=[@ANYBLOB="2800000010000104000040000000000000001ea6", @ANYRES32=r2, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00\b\x00\n\x00', @ANYRES32=r8], 0x28}}, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r10 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r9, 0x8933, &(0x7f0000000300)={'syz_tun\x00'}) sendmsg$nl_route(r10, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={0x0}}, 0x0) [ 402.048342][T17281] bridge205: port 2(erspan0) entered blocking state [ 402.061527][T17281] bridge205: port 2(erspan0) entered disabled state [ 402.071799][T17281] device erspan0 entered promiscuous mode [ 402.083942][T17286] device syz_tun left promiscuous mode [ 402.090940][T17286] bridge70: port 1(syz_tun) entered disabled state [ 402.227802][T17286] bridge71: port 1(syz_tun) entered blocking state [ 402.234619][T17286] bridge71: port 1(syz_tun) entered disabled state [ 402.243659][T17286] device syz_tun entered promiscuous mode [ 402.253663][T17287] device erspan0 left promiscuous mode [ 402.260251][T17287] bridge70: port 2(erspan0) entered disabled state [ 402.377786][T17287] bridge71: port 2(erspan0) entered blocking state [ 402.384649][T17287] bridge71: port 2(erspan0) entered disabled state [ 402.395573][T17287] device erspan0 entered promiscuous mode [ 402.413376][T17302] netlink: 72 bytes leftover after parsing attributes in process `syz-executor.1'. 15:24:44 executing program 3: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000340)={'erspan0\x00', 0x0}) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000300)={'syz_tun\x00', 0x0}) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r7, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r6, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000380)=@newlink={0x34, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r8}, [@IFLA_LINKINFO={0x14, 0x12, @bridge={{0xb, 0x1, 'bridge\x00'}, {0x4}}}]}, 0x34}}, 0x0) sendmsg$nl_route(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000002700)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r5}, [@IFLA_MASTER={0x8, 0xa, r8}]}, 0x28}}, 0x0) sendmsg$nl_route(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f00000000c0)=ANY=[@ANYBLOB="2800000010000104000040000000000000001ea6", @ANYRES32=r2, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00\b\x00\n\x00', @ANYRES32=r8], 0x28}}, 0x0) socketpair$unix(0x1, 0x2, 0x0, 0x0) r9 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000300)={'syz_tun\x00', 0x0}) sendmsg$nl_route(r9, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000040)=@newlink={0x2c, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r10}, [@IFLA_BROADCAST={0xa}]}, 0x332}}, 0x0) 15:24:44 executing program 4: r0 = socket$inet6(0xa, 0x80003, 0x6b) ioctl(r0, 0x1000008912, &(0x7f00000001c0)="080db5055e0bcfe8476071") r1 = socket(0x10, 0x2, 0x0) sendto(r1, &(0x7f0000000200)="120000001200e7ef007b1a3fcd00000000a1", 0x12, 0x0, 0x0, 0x18) recvmmsg(r1, &(0x7f00000037c0)=[{{&(0x7f0000000600)=@ethernet={0x0, @random}, 0x80, &(0x7f0000000380)=[{&(0x7f0000000040)=""/95, 0x5f}, {&(0x7f00000000c0)=""/85, 0x55}, {&(0x7f00000024c0)=""/4096, 0x1000}, {&(0x7f0000000400)=""/120, 0x78}, {&(0x7f0000000480)=""/60, 0x3c}, {&(0x7f0000000280)=""/77, 0x4d}, {&(0x7f0000000540)=""/154, 0x9a}], 0x7, &(0x7f0000002400)=""/191, 0xbf}}], 0x1, 0x6, &(0x7f0000003700)={0x77359400}) 15:24:44 executing program 0: r0 = socket(0x21, 0xa, 0x1) r1 = socket(0x10, 0x80002, 0x0) ioctl(r1, 0x1000008912, &(0x7f00000001c0)="080db5055e0bcfe8696071") getsockopt$inet_sctp_SCTP_PEER_AUTH_CHUNKS(r1, 0x84, 0x1a, &(0x7f0000000940)=ANY=[@ANYRES32=0x0, @ANYBLOB='\x00'/12], &(0x7f0000000980)=0x10) getsockopt$inet_sctp_SCTP_GET_PEER_ADDR_INFO(r0, 0x84, 0xf, &(0x7f00000009c0)={r2, @in6={{0xa, 0x4e21, 0x8, @local, 0x401}}, 0x9, 0x1, 0x7, 0x7f, 0x6}, &(0x7f0000000a80)=0x98) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000400)='nl80211\x00') sendmsg$NL80211_CMD_GET_MESH_CONFIG(r0, &(0x7f0000000580)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x103190}, 0xc, &(0x7f0000000540)={&(0x7f0000000500)={0x34, r3, 0x10, 0x70bd2d, 0x25dfdbfe, {}, [@NL80211_ATTR_WDEV={0xc, 0x99, {0x1, 0xffffffffffffffff}}, @NL80211_ATTR_WIPHY={0x8, 0x1, 0x1}, @NL80211_ATTR_WDEV={0xc, 0x99, {0x3f, 0x3}}]}, 0x34}, 0x1, 0x0, 0x0, 0x800}, 0x40000) r4 = socket$nl_generic(0x10, 0x3, 0x10) bind$netlink(r4, &(0x7f0000000000)={0x10, 0x0, 0x25dfdbff, 0x1004280}, 0xffffffffffffffb3) sendmsg$nl_generic(r4, &(0x7f0000000080)={&(0x7f0000000480)={0x10, 0xbb7f}, 0xc, 0x0}, 0x0) socket$netlink(0x10, 0x3, 0x0) r5 = socket$alg(0x26, 0x5, 0x0) bind$alg(r5, &(0x7f0000000080)={0x26, 'hash\x00', 0x0, 0x0, 'sha512\x00'}, 0x58) [ 402.443269][T17304] device syz_tun left promiscuous mode [ 402.458516][T17304] bridge217: port 1(syz_tun) entered disabled state [ 402.628154][T17304] bridge218: port 1(syz_tun) entered blocking state [ 402.635869][T17304] bridge218: port 1(syz_tun) entered disabled state [ 402.644182][T17304] device syz_tun entered promiscuous mode [ 402.652201][T17305] netlink: 72 bytes leftover after parsing attributes in process `syz-executor.1'. [ 402.661782][T17306] device erspan0 left promiscuous mode [ 402.667415][T17306] bridge217: port 2(erspan0) entered disabled state 15:24:44 executing program 2: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000340)={'erspan0\x00', 0x0}) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000300)={'syz_tun\x00', 0x0}) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r7, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r6, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000380)=@newlink={0x34, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r8}, [@IFLA_LINKINFO={0x14, 0x12, @bridge={{0xb, 0x1, 'bridge\x00'}, {0x4}}}]}, 0x34}}, 0x0) sendmsg$nl_route(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000002700)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r5}, [@IFLA_MASTER={0x8, 0xa, r8}]}, 0x28}}, 0x0) sendmsg$nl_route(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f00000000c0)=ANY=[@ANYBLOB="2800000010000104000040000000000000001ea6", @ANYRES32=r2, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00\b\x00\n\x00', @ANYRES32=r8], 0x28}}, 0x0) socketpair$unix(0x1, 0x2, 0x0, 0x0) r9 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000300)={'syz_tun\x00', 0x0}) sendmsg$nl_route(r9, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000040)=@newlink={0x2c, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r10}, [@IFLA_BROADCAST={0xa}]}, 0x332}}, 0x0) [ 402.798030][T17306] bridge218: port 2(erspan0) entered blocking state [ 402.804935][T17306] bridge218: port 2(erspan0) entered disabled state [ 402.814602][T17306] device erspan0 entered promiscuous mode [ 402.824034][T17313] netlink: 'syz-executor.1': attribute type 274 has an invalid length. 15:24:44 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, 0x0, 0x0) sendmsg$nl_route_sched(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000540)=ANY=[@ANYBLOB="7400000024000705000000000000000000010000", @ANYRES32=r3, @ANYBLOB="00000000ffffffff000000000800010073667100486818973f73461919309b68e1693572bb000229c6090032d0ed64f3c3545aaf6e000085a4e4ebb5ef670000000000000000000000000000001a4e624d29a84abf03265700000000000000000000000000000000000000000000000000000000000000ac20000089b53c947244306a0216a3de887763df5b42498b13bb1938de859ee6d7ae7dd2224dc672b69b4358871b170ea0b667832e5224ee3538f885b7abd9bc4a7d"], 0x74}}, 0x0) r4 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r4, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000300)=ANY=[@ANYBLOB="840000002c00010700"/20, @ANYRES32=r3, @ANYBLOB="0008008000000000030000000800010075333200580002001400050000000000000000000000000000000000400006003c0001000000000000001020898dde66057433b6ef3a41d22be225e0001b0000000000000000000000000017256ffc66e43a2484e1a912c5998bcbf0d0000000000000000000000000000000798a3c067277da1a290b9613a33c575c36fad473382c8f5532ef3f0e1d2c450a7decbf3431a69f9b2ecb3291bed174245a962fe0484676958265e2988326a89db3139d91fe4aee6ae7e745ab00001a9f61f20500000000000000b3958bc14fce6e66a36d1ab3194534ba4e973684b27793bff837d3"], 0x84}}, 0x0) r5 = socket(0x10, 0x80002, 0x0) sendmmsg$alg(r5, &(0x7f0000000140), 0x49249249249278c, 0x0) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r6, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000500)=@newlink={0x20, 0x11, 0x40d, 0x0, 0x0, {0x0, 0x0, 0x0, r8}}, 0x20}}, 0x0) r9 = socket(0x10, 0x80002, 0x0) getsockopt$inet_sctp_SCTP_PEER_AUTH_CHUNKS(0xffffffffffffffff, 0x84, 0x1a, &(0x7f0000000940)=ANY=[@ANYRES32=0x0, @ANYBLOB='\x00'/12], &(0x7f0000000980)=0x10) r10 = socket(0xa, 0x6, 0x0) close(r10) r11 = socket$inet6_sctp(0xa, 0x10000000005, 0x84) setsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX(r11, 0x84, 0x6e, &(0x7f0000000180)=[@in6={0xa, 0x0, 0x0, @remote, 0x9}], 0x1c) getsockopt$inet_sctp6_SCTP_GET_ASSOC_ID_LIST(r11, 0x84, 0x1d, &(0x7f000095dff8)={0x1, [0x0]}, &(0x7f000095dffc)=0x8) setsockopt$inet_sctp_SCTP_RTOINFO(r10, 0x84, 0x0, &(0x7f0000000000)={r12, 0x0, 0x0, 0x1000000}, 0x10) setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(0xffffffffffffffff, 0x84, 0x9, &(0x7f0000000680)={r12, @in={{0x2, 0x4e20, @remote}}, 0x10001, 0xfff7, 0x5, 0x1, 0x8, 0x5, 0xba}, 0x9c) ioctl(r9, 0x1000008912, &(0x7f00000001c0)="080db5055e0bcfe8696071") getsockopt$inet_sctp_SCTP_PEER_AUTH_CHUNKS(r9, 0x84, 0x1a, &(0x7f0000000940)=ANY=[@ANYRES32=0x0, @ANYBLOB='\x00'/12], &(0x7f0000000980)=0x10) r13 = socket$nl_generic(0x10, 0x3, 0x10) r14 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080)='nl80211\x00') r15 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL80211_CMD_GET_STATION(r15, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000240)={0x1c, r14, 0xf2b, 0x0, 0x0, {}, [@NL80211_ATTR_AIRTIME_WEIGHT={0x8}]}, 0x1c}}, 0x0) sendmsg$NL80211_CMD_GET_MPATH(r13, &(0x7f00000001c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x2000}, 0x268, &(0x7f0000000080)={&(0x7f0000000200)={0x40, r14, 0x4, 0x70bd2d, 0x25dfdbff}, 0xff6b}, 0x1, 0x0, 0x0, 0x10049050}, 0x260448c0) sendmsg$NL80211_CMD_NEW_KEY(r9, &(0x7f0000000640)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0xb0024000}, 0xc, &(0x7f00000002c0)={&(0x7f0000000440)={0x7c, r14, 0x23, 0x70bd27, 0x25dfdbff, {}, [@NL80211_ATTR_KEY_DATA_WEP40={0x9, 0x7, "a80875ab12"}, @NL80211_ATTR_KEY={0x5c, 0x50, [@NL80211_KEY_DEFAULT_TYPES={0x14, 0x8, [@NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_MULTICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_MULTICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_MULTICAST={0x4}]}, @NL80211_KEY_DEFAULT_TYPES={0x28, 0x8, [@NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_MULTICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_MULTICAST={0x4}]}, @NL80211_KEY_IDX={0x5, 0x2, 0x5}, @NL80211_KEY_DATA_WEP104={0x11, 0x1, "4d84c4e30151cb27f51a4adf63"}]}]}, 0x7c}, 0x1, 0x0, 0x0, 0x24000}, 0x40) [ 402.846141][T17315] netlink: 'syz-executor.1': attribute type 274 has an invalid length. [ 402.864261][T17316] device syz_tun left promiscuous mode [ 402.875737][T17316] bridge205: port 1(syz_tun) entered disabled state [ 403.027926][T17316] bridge206: port 1(syz_tun) entered blocking state [ 403.034840][T17316] bridge206: port 1(syz_tun) entered disabled state [ 403.043217][T17316] device syz_tun entered promiscuous mode [ 403.051692][T17318] device erspan0 left promiscuous mode [ 403.058879][T17318] bridge205: port 2(erspan0) entered disabled state [ 403.187846][T17318] bridge206: port 2(erspan0) entered blocking state [ 403.194745][T17318] bridge206: port 2(erspan0) entered disabled state [ 403.203111][T17318] device erspan0 entered promiscuous mode [ 403.225319][T17332] device syz_tun left promiscuous mode 15:24:45 executing program 4: r0 = socket$inet6(0xa, 0x80003, 0x6b) ioctl(r0, 0x1000008912, &(0x7f00000001c0)="080db5055e0bcfe8476071") r1 = socket(0x10, 0x2, 0x0) sendto(r1, &(0x7f0000000200)="120000001200e7ef007b1a3fcd00000000a1", 0x12, 0x0, 0x0, 0x18) recvmmsg(r1, &(0x7f00000037c0)=[{{&(0x7f0000000600)=@ethernet={0x0, @random}, 0x80, &(0x7f0000000380)=[{&(0x7f0000000040)=""/95, 0x5f}, {&(0x7f00000000c0)=""/85, 0x55}, {&(0x7f00000024c0)=""/4096, 0x1000}, {&(0x7f0000000400)=""/120, 0x78}, {&(0x7f0000000480)=""/60, 0x3c}, {&(0x7f0000000280)=""/77, 0x4d}, {&(0x7f0000000540)=""/154, 0x9a}], 0x7, &(0x7f0000002400)=""/191, 0xbf}}], 0x1, 0x6, &(0x7f0000003700)={0x77359400}) 15:24:45 executing program 5: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000340)={'erspan0\x00', 0x0}) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000300)={'syz_tun\x00', 0x0}) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r7, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r6, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000380)=@newlink={0x34, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r8}, [@IFLA_LINKINFO={0x14, 0x12, @bridge={{0xb, 0x1, 'bridge\x00'}, {0x4}}}]}, 0x34}}, 0x0) sendmsg$nl_route(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000002700)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r5}, [@IFLA_MASTER={0x8, 0xa, r8}]}, 0x28}}, 0x0) sendmsg$nl_route(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f00000000c0)=ANY=[@ANYBLOB="2800000010000104000040000000000000001ea6", @ANYRES32=r2, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00\b\x00\n\x00', @ANYRES32=r8], 0x28}}, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r10 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r9, 0x8933, &(0x7f0000000300)={'syz_tun\x00'}) sendmsg$nl_route(r10, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={0x0}}, 0x0) 15:24:45 executing program 0: r0 = socket(0x21, 0xa, 0x1) r1 = socket(0x10, 0x80002, 0x0) ioctl(r1, 0x1000008912, &(0x7f00000001c0)="080db5055e0bcfe8696071") getsockopt$inet_sctp_SCTP_PEER_AUTH_CHUNKS(r1, 0x84, 0x1a, &(0x7f0000000940)=ANY=[@ANYRES32=0x0, @ANYBLOB='\x00'/12], &(0x7f0000000980)=0x10) getsockopt$inet_sctp_SCTP_GET_PEER_ADDR_INFO(r0, 0x84, 0xf, &(0x7f00000009c0)={r2, @in6={{0xa, 0x4e21, 0x8, @local, 0x401}}, 0x9, 0x1, 0x7, 0x7f, 0x6}, &(0x7f0000000a80)=0x98) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000400)='nl80211\x00') sendmsg$NL80211_CMD_GET_MESH_CONFIG(r0, &(0x7f0000000580)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x103190}, 0xc, &(0x7f0000000540)={&(0x7f0000000500)={0x34, r3, 0x10, 0x70bd2d, 0x25dfdbfe, {}, [@NL80211_ATTR_WDEV={0xc, 0x99, {0x1, 0xffffffffffffffff}}, @NL80211_ATTR_WIPHY={0x8, 0x1, 0x1}, @NL80211_ATTR_WDEV={0xc, 0x99, {0x3f, 0x3}}]}, 0x34}, 0x1, 0x0, 0x0, 0x800}, 0x40000) r4 = socket$nl_generic(0x10, 0x3, 0x10) bind$netlink(r4, &(0x7f0000000000)={0x10, 0x0, 0x25dfdbff, 0x1004280}, 0xffffffffffffffb3) sendmsg$nl_generic(r4, &(0x7f0000000080)={&(0x7f0000000480)={0x10, 0xbb7f}, 0xc, 0x0}, 0x0) socket$netlink(0x10, 0x3, 0x0) r5 = socket$alg(0x26, 0x5, 0x0) bind$alg(r5, &(0x7f0000000080)={0x26, 'hash\x00', 0x0, 0x0, 'sha512\x00'}, 0x58) [ 403.237831][T17332] bridge71: port 1(syz_tun) entered disabled state [ 403.388029][T17332] bridge72: port 1(syz_tun) entered blocking state [ 403.403754][T17332] bridge72: port 1(syz_tun) entered disabled state [ 403.413947][T17332] device syz_tun entered promiscuous mode [ 403.423909][T17333] device erspan0 left promiscuous mode [ 403.430102][T17333] bridge71: port 2(erspan0) entered disabled state 15:24:45 executing program 3: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000340)={'erspan0\x00', 0x0}) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000300)={'syz_tun\x00', 0x0}) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r7, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r6, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000380)=@newlink={0x34, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r8}, [@IFLA_LINKINFO={0x14, 0x12, @bridge={{0xb, 0x1, 'bridge\x00'}, {0x4}}}]}, 0x34}}, 0x0) sendmsg$nl_route(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000002700)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r5}, [@IFLA_MASTER={0x8, 0xa, r8}]}, 0x28}}, 0x0) sendmsg$nl_route(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f00000000c0)=ANY=[@ANYBLOB="2800000010000104000040000000000000001ea6", @ANYRES32=r2, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00\b\x00\n\x00', @ANYRES32=r8], 0x28}}, 0x0) socketpair$unix(0x1, 0x2, 0x0, 0x0) r9 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000300)={'syz_tun\x00', 0x0}) sendmsg$nl_route(r9, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000040)=@newlink={0x2c, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r10}, [@IFLA_BROADCAST={0xa}]}, 0x332}}, 0x0) [ 403.557891][T17333] bridge72: port 2(erspan0) entered blocking state [ 403.564723][T17333] bridge72: port 2(erspan0) entered disabled state [ 403.573055][T17333] device erspan0 entered promiscuous mode [ 403.587784][T17340] device syz_tun left promiscuous mode [ 403.599038][T17340] bridge218: port 1(syz_tun) entered disabled state [ 403.747786][T17340] bridge219: port 1(syz_tun) entered blocking state [ 403.754686][T17340] bridge219: port 1(syz_tun) entered disabled state [ 403.763032][T17340] device syz_tun entered promiscuous mode [ 403.771809][T17341] netlink: 72 bytes leftover after parsing attributes in process `syz-executor.1'. [ 403.781707][T17342] device erspan0 left promiscuous mode [ 403.788041][T17342] bridge218: port 2(erspan0) entered disabled state [ 403.907987][T17342] bridge219: port 2(erspan0) entered blocking state [ 403.914864][T17342] bridge219: port 2(erspan0) entered disabled state [ 403.923160][T17342] device erspan0 entered promiscuous mode [ 403.931593][T17343] netlink: 72 bytes leftover after parsing attributes in process `syz-executor.1'. [ 403.945556][T17348] netlink: 'syz-executor.1': attribute type 274 has an invalid length. 15:24:46 executing program 2 (fault-call:16 fault-nth:0): socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000340)={'erspan0\x00', 0x0}) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000300)={'syz_tun\x00', 0x0}) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r7, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r6, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000380)=@newlink={0x34, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r8}, [@IFLA_LINKINFO={0x14, 0x12, @bridge={{0xb, 0x1, 'bridge\x00'}, {0x4}}}]}, 0x34}}, 0x0) sendmsg$nl_route(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000002700)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r5}, [@IFLA_MASTER={0x8, 0xa, r8}]}, 0x28}}, 0x0) sendmsg$nl_route(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f00000000c0)=ANY=[@ANYBLOB="2800000010000104000040000000000000001ea6", @ANYRES32=r2, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00\b\x00\n\x00', @ANYRES32=r8], 0x28}}, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r10 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r9, 0x8933, &(0x7f0000000300)={'syz_tun\x00', 0x0}) sendmsg$nl_route(r10, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000040)=@newlink={0x2c, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r11}, [@IFLA_BROADCAST={0xa}]}, 0x332}}, 0x0) [ 403.954220][T17349] netlink: 'syz-executor.1': attribute type 274 has an invalid length. [ 403.974417][T17360] device syz_tun left promiscuous mode 15:24:46 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, 0x0, 0x0) sendmsg$nl_route_sched(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000540)=ANY=[@ANYBLOB="7400000024000705000000000000000000010000", @ANYRES32=r3, @ANYBLOB="00000000ffffffff000000000800010073667100486818973f73461919309b68e1693572bb000229c6090032d0ed64f3c3545aaf6e000085a4e4ebb5ef670000000000000000000000000000001a4e624d29a84abf03265700000000000000000000000000000000000000000000000000000000000000ac20000089b53c947244306a0216a3de887763df5b42498b13bb1938de859ee6d7ae7dd2224dc672b69b4358871b170ea0b667832e5224ee3538f885b7abd9bc4a7d"], 0x74}}, 0x0) r4 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r4, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000300)=ANY=[@ANYBLOB="840000002c00010700"/20, @ANYRES32=r3, @ANYBLOB="0008008000000000030000000800010075333200580002001400050000000000000000000000000000000000400006003c0001000000000000001020898dde66057433b6ef3a41d22be225e0001b0000000000000000000000000017256ffc66e43a2484e1a912c5998bcbf0d0000000000000000000000000000000798a3c067277da1a290b9613a33c575c36fad473382c8f5532ef3f0e1d2c450a7decbf3431a69f9b2ecb3291bed174245a962fe0484676958265e2988326a89db3139d91fe4aee6ae7e745ab00001a9f61f20500000000000000b3958bc14fce6e66a36d1ab3194534ba4e973684b27793bff837d3"], 0x84}}, 0x0) r5 = socket(0x10, 0x80002, 0x0) sendmmsg$alg(r5, &(0x7f0000000140), 0x49249249249278c, 0x0) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r6, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000500)=@newlink={0x20, 0x11, 0x40d, 0x0, 0x0, {0x0, 0x0, 0x0, r8}}, 0x20}}, 0x0) r9 = socket(0x10, 0x80002, 0x0) getsockopt$inet_sctp_SCTP_PEER_AUTH_CHUNKS(0xffffffffffffffff, 0x84, 0x1a, &(0x7f0000000940)=ANY=[@ANYRES32=0x0, @ANYBLOB='\x00'/12], &(0x7f0000000980)=0x10) r10 = socket(0xa, 0x6, 0x0) close(r10) r11 = socket$inet6_sctp(0xa, 0x10000000005, 0x84) setsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX(r11, 0x84, 0x6e, &(0x7f0000000180)=[@in6={0xa, 0x0, 0x0, @remote, 0x9}], 0x1c) getsockopt$inet_sctp6_SCTP_GET_ASSOC_ID_LIST(r11, 0x84, 0x1d, &(0x7f000095dff8)={0x1, [0x0]}, &(0x7f000095dffc)=0x8) setsockopt$inet_sctp_SCTP_RTOINFO(r10, 0x84, 0x0, &(0x7f0000000000)={r12, 0x0, 0x0, 0x1000000}, 0x10) setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(0xffffffffffffffff, 0x84, 0x9, &(0x7f0000000680)={r12, @in={{0x2, 0x4e20, @remote}}, 0x10001, 0xfff7, 0x5, 0x1, 0x8, 0x5, 0xba}, 0x9c) ioctl(r9, 0x1000008912, &(0x7f00000001c0)="080db5055e0bcfe8696071") getsockopt$inet_sctp_SCTP_PEER_AUTH_CHUNKS(r9, 0x84, 0x1a, &(0x7f0000000940)=ANY=[@ANYRES32=0x0, @ANYBLOB='\x00'/12], &(0x7f0000000980)=0x10) r13 = socket$nl_generic(0x10, 0x3, 0x10) r14 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080)='nl80211\x00') r15 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL80211_CMD_GET_STATION(r15, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000240)={0x1c, r14, 0xf2b, 0x0, 0x0, {}, [@NL80211_ATTR_AIRTIME_WEIGHT={0x8}]}, 0x1c}}, 0x0) sendmsg$NL80211_CMD_GET_MPATH(r13, &(0x7f00000001c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x2000}, 0x268, &(0x7f0000000080)={&(0x7f0000000200)={0x40, r14, 0x4, 0x70bd2d, 0x25dfdbff}, 0xff6b}, 0x1, 0x0, 0x0, 0x10049050}, 0x260448c0) sendmsg$NL80211_CMD_NEW_KEY(r9, &(0x7f0000000640)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0xb0024000}, 0xc, &(0x7f00000002c0)={&(0x7f0000000440)={0x7c, r14, 0x23, 0x70bd27, 0x25dfdbff, {}, [@NL80211_ATTR_KEY_DATA_WEP40={0x9, 0x7, "a80875ab12"}, @NL80211_ATTR_KEY={0x5c, 0x50, [@NL80211_KEY_DEFAULT_TYPES={0x14, 0x8, [@NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_MULTICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_MULTICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_MULTICAST={0x4}]}, @NL80211_KEY_DEFAULT_TYPES={0x28, 0x8, [@NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_MULTICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_MULTICAST={0x4}]}, @NL80211_KEY_IDX={0x5, 0x2, 0x5}, @NL80211_KEY_DATA_WEP104={0x11, 0x1, "4d84c4e30151cb27f51a4adf63"}]}]}, 0x7c}, 0x1, 0x0, 0x0, 0x24000}, 0x40) [ 404.000344][T17360] bridge206: port 1(syz_tun) entered disabled state [ 404.127963][T17360] bridge207: port 1(syz_tun) entered blocking state [ 404.134958][T17360] bridge207: port 1(syz_tun) entered disabled state [ 404.144015][T17360] device syz_tun entered promiscuous mode [ 404.167928][T17362] device erspan0 left promiscuous mode 15:24:46 executing program 4: r0 = socket$inet6(0xa, 0x80003, 0x6b) ioctl(r0, 0x1000008912, &(0x7f00000001c0)="080db5055e0bcfe8476071") r1 = socket(0x10, 0x2, 0x0) sendto(r1, &(0x7f0000000200)="120000001200e7ef007b1a3fcd00000000a1", 0x12, 0x0, 0x0, 0x18) recvmmsg(r1, &(0x7f00000037c0)=[{{&(0x7f0000000600)=@ethernet={0x0, @random}, 0x80, &(0x7f0000000380)=[{&(0x7f0000000040)=""/95, 0x5f}, {&(0x7f00000000c0)=""/85, 0x55}, {&(0x7f00000024c0)=""/4096, 0x1000}, {&(0x7f0000000400)=""/120, 0x78}, {&(0x7f0000000480)=""/60, 0x3c}, {&(0x7f0000000280)=""/77, 0x4d}, {&(0x7f0000000540)=""/154, 0x9a}], 0x7, &(0x7f0000002400)=""/191, 0xbf}}], 0x1, 0x6, &(0x7f0000003700)={0x77359400}) [ 404.169474][T17381] FAULT_INJECTION: forcing a failure. [ 404.169474][T17381] name failslab, interval 1, probability 0, space 0, times 1 [ 404.174108][T17362] bridge206: port 2(erspan0) entered disabled state [ 404.204716][T17381] CPU: 0 PID: 17381 Comm: syz-executor.2 Not tainted 5.5.0-rc5-syzkaller #0 [ 404.213448][T17381] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 404.223622][T17381] Call Trace: [ 404.227129][T17381] dump_stack+0x197/0x210 [ 404.231554][T17381] should_fail.cold+0xa/0x15 [ 404.236363][T17381] ? release_sock+0x156/0x1c0 [ 404.241070][T17381] ? fault_create_debugfs_attr+0x180/0x180 [ 404.247015][T17381] ? ___might_sleep+0x163/0x2c0 [ 404.251999][T17381] __should_failslab+0x121/0x190 [ 404.257632][T17381] should_failslab+0x9/0x14 [ 404.262244][T17381] kmem_cache_alloc_node+0x268/0x740 [ 404.269475][T17381] __alloc_skb+0xd5/0x5e0 [ 404.273860][T17381] ? __kmalloc_reserve.isra.0+0xf0/0xf0 [ 404.279531][T17381] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 404.285941][T17381] ? netlink_autobind.isra.0+0x223/0x300 [ 404.291609][T17381] netlink_sendmsg+0xa1b/0xea0 [ 404.296405][T17381] ? netlink_unicast+0x7d0/0x7d0 [ 404.301446][T17381] ? aa_sock_msg_perm.isra.0+0xba/0x170 [ 404.307020][T17381] ? apparmor_socket_sendmsg+0x2a/0x30 [ 404.312519][T17381] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 404.319816][T17381] ? security_socket_sendmsg+0x8d/0xc0 [ 404.325296][T17381] ? netlink_unicast+0x7d0/0x7d0 [ 404.330255][T17381] sock_sendmsg+0xd7/0x130 [ 404.335226][T17381] ____sys_sendmsg+0x753/0x880 [ 404.340132][T17381] ? kernel_sendmsg+0x50/0x50 [ 404.344876][T17381] ? __fget+0x35d/0x550 [ 404.349112][T17381] ? find_held_lock+0x35/0x130 [ 404.353920][T17381] ___sys_sendmsg+0x100/0x170 [ 404.358722][T17381] ? sendmsg_copy_msghdr+0x70/0x70 [ 404.363856][T17381] ? __kasan_check_read+0x11/0x20 [ 404.368904][T17381] ? __fget+0x37f/0x550 [ 404.373081][T17381] ? ksys_dup3+0x3e0/0x3e0 [ 404.377528][T17381] ? __fget_light+0x1a9/0x230 [ 404.382218][T17381] ? __fdget+0x1b/0x20 [ 404.389458][T17381] ? __sanitizer_cov_trace_const_cmp8+0x18/0x20 [ 404.395727][T17381] __sys_sendmsg+0x105/0x1d0 [ 404.400342][T17381] ? __sys_sendmsg_sock+0xc0/0xc0 [ 404.405462][T17381] ? trace_hardirqs_on_thunk+0x1a/0x1c [ 404.410940][T17381] ? do_syscall_64+0x26/0x790 [ 404.415718][T17381] ? entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 404.422070][T17381] ? do_syscall_64+0x26/0x790 15:24:46 executing program 0: r0 = socket(0x21, 0xa, 0x1) r1 = socket(0x10, 0x80002, 0x0) ioctl(r1, 0x1000008912, &(0x7f00000001c0)="080db5055e0bcfe8696071") getsockopt$inet_sctp_SCTP_PEER_AUTH_CHUNKS(r1, 0x84, 0x1a, &(0x7f0000000940)=ANY=[@ANYRES32=0x0, @ANYBLOB='\x00'/12], &(0x7f0000000980)=0x10) getsockopt$inet_sctp_SCTP_GET_PEER_ADDR_INFO(r0, 0x84, 0xf, &(0x7f00000009c0)={r2, @in6={{0xa, 0x4e21, 0x8, @local, 0x401}}, 0x9, 0x1, 0x7, 0x7f, 0x6}, &(0x7f0000000a80)=0x98) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000400)='nl80211\x00') sendmsg$NL80211_CMD_GET_MESH_CONFIG(r0, &(0x7f0000000580)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x103190}, 0xc, &(0x7f0000000540)={&(0x7f0000000500)={0x34, r3, 0x10, 0x70bd2d, 0x25dfdbfe, {}, [@NL80211_ATTR_WDEV={0xc, 0x99, {0x1, 0xffffffffffffffff}}, @NL80211_ATTR_WIPHY={0x8, 0x1, 0x1}, @NL80211_ATTR_WDEV={0xc, 0x99, {0x3f, 0x3}}]}, 0x34}, 0x1, 0x0, 0x0, 0x800}, 0x40000) r4 = socket$nl_generic(0x10, 0x3, 0x10) bind$netlink(r4, &(0x7f0000000000)={0x10, 0x0, 0x25dfdbff, 0x1004280}, 0xffffffffffffffb3) sendmsg$nl_generic(r4, &(0x7f0000000080)={&(0x7f0000000480)={0x10, 0xbb7f}, 0xc, &(0x7f0000000440)={0x0}}, 0x0) socket$netlink(0x10, 0x3, 0x0) r5 = socket$alg(0x26, 0x5, 0x0) bind$alg(r5, &(0x7f0000000080)={0x26, 'hash\x00', 0x0, 0x0, 'sha512\x00'}, 0x58) [ 404.426753][T17381] __x64_sys_sendmsg+0x78/0xb0 [ 404.431613][T17381] do_syscall_64+0xfa/0x790 [ 404.436123][T17381] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 404.442025][T17381] RIP: 0033:0x45af49 [ 404.446049][T17381] Code: ad b6 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 7b b6 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 404.465668][T17381] RSP: 002b:00007f44f4f31c78 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 404.474193][T17381] RAX: ffffffffffffffda RBX: 00007f44f4f31c90 RCX: 000000000045af49 [ 404.482392][T17381] RDX: 0000000000000000 RSI: 0000000020000000 RDI: 000000000000000d [ 404.490382][T17381] RBP: 000000000075c118 R08: 0000000000000000 R09: 0000000000000000 [ 404.498469][T17381] R10: 0000000000000000 R11: 0000000000000246 R12: 00007f44f4f326d4 [ 404.506493][T17381] R13: 00000000004caa0f R14: 00000000004e3eb0 R15: 000000000000000e 15:24:46 executing program 5: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000340)={'erspan0\x00', 0x0}) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000300)={'syz_tun\x00', 0x0}) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r7, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r6, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000380)=@newlink={0x34, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r8}, [@IFLA_LINKINFO={0x14, 0x12, @bridge={{0xb, 0x1, 'bridge\x00'}, {0x4}}}]}, 0x34}}, 0x0) sendmsg$nl_route(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000002700)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r5}, [@IFLA_MASTER={0x8, 0xa, r8}]}, 0x28}}, 0x0) sendmsg$nl_route(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f00000000c0)=ANY=[@ANYBLOB="2800000010000104000040000000000000001ea6", @ANYRES32=r2, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00\b\x00\n\x00', @ANYRES32=r8], 0x28}}, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r10 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r9, 0x8933, &(0x7f0000000300)={'syz_tun\x00', 0x0}) sendmsg$nl_route(r10, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000040)=@newlink={0x2c, 0x10, 0x0, 0x0, 0x0, {0x0, 0x0, 0x0, r11}, [@IFLA_BROADCAST={0xa}]}, 0x332}}, 0x0) [ 404.647836][T17362] bridge207: port 2(erspan0) entered blocking state [ 404.656932][T17362] bridge207: port 2(erspan0) entered disabled state [ 404.665083][T17362] device erspan0 entered promiscuous mode [ 404.681534][T17369] device syz_tun left promiscuous mode [ 404.688029][T17369] bridge72: port 1(syz_tun) entered disabled state [ 404.807918][T17369] bridge73: port 1(syz_tun) entered blocking state [ 404.814631][T17369] bridge73: port 1(syz_tun) entered disabled state [ 404.827745][T17369] device syz_tun entered promiscuous mode [ 404.835123][T17370] device erspan0 left promiscuous mode [ 404.842298][T17370] bridge72: port 2(erspan0) entered disabled state 15:24:47 executing program 3: r0 = socket$inet_sctp(0x2, 0x800000000000001, 0x84) sendto$inet(r0, &(0x7f0000a34fff)='H', 0x1, 0x0, &(0x7f0000030ff0)={0x2, 0x0, @local={0xac, 0x14, 0xffffffffffffffff}}, 0x10) sendto$inet(r0, &(0x7f0000000140)="3554e47147558d0b2f6096d2bb193877e62295e5403d866f0d9611ebe5a1839ef9f9bc8ee4904039d20aa3886847c73a878a38aa56ef16c1f3e91ce343e74d8cf44ff0cdc83ce4aba123e1e63854de421feba8f2ac5636789427d7d93f8e15bb7d8bb61d03177fd3a8d20123cc78af531b", 0x71, 0x0, &(0x7f00000000c0)={0x2, 0x0, @remote={0xac, 0x14, 0xffffffffffffffff}}, 0x10) shutdown(r0, 0x1) setsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(r0, 0x84, 0x9, &(0x7f00000001c0)={0x0, @in6, 0x0, 0x10001, 0x0, 0x0, 0x46}, 0x98) r1 = socket(0x10, 0x80002, 0x0) ioctl(r1, 0x1000008912, &(0x7f00000001c0)="080db5055e0bcfe8696071") setsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(r0, 0x84, 0x9, &(0x7f00000004c0)={0x0, @in={{0x2, 0x0, @initdev={0xac, 0x1e, 0x1, 0x0}}}, 0x0, 0x0, 0x0, 0x273, 0x34}, 0x9c) recvmmsg(r0, &(0x7f0000000140), 0x3db, 0x0, 0x0) setsockopt$inet_sctp6_SCTP_EVENTS(r0, 0x84, 0xb, &(0x7f0000000100)={0x0, 0x0, 0x4}, 0xb) accept4$x25(r1, &(0x7f0000001c40), &(0x7f0000001c80)=0x12, 0x800) r2 = socket$caif_stream(0x25, 0x1, 0x2) r3 = socket(0x21, 0xa, 0x1) r4 = socket(0x10, 0x80002, 0x0) ioctl(r4, 0x1000008912, &(0x7f00000001c0)="080db5055e0bcfe8696071") getsockopt$inet_sctp_SCTP_PEER_AUTH_CHUNKS(r4, 0x84, 0x1a, &(0x7f0000000940)=ANY=[@ANYRES32=0x0, @ANYBLOB='\x00'/12], &(0x7f0000000980)=0x10) getsockopt$inet_sctp_SCTP_GET_PEER_ADDR_INFO(r3, 0x84, 0xf, &(0x7f00000009c0)={r5, @in6={{0xa, 0x4e21, 0x8, @local, 0x401}}, 0x9, 0x1, 0x7, 0x7f, 0x6}, &(0x7f0000000a80)=0x98) r6 = accept4$bt_l2cap(r3, &(0x7f0000000280), &(0x7f00000002c0)=0xe, 0x800) sendmmsg(r2, &(0x7f0000001c00)=[{{&(0x7f0000000300)=@pppol2tpv3={0x18, 0x1, {0x0, r6, {0x2, 0x4e21, @dev={0xac, 0x14, 0x14, 0x2b}}, 0x4, 0x0, 0x0, 0x4}}, 0x80, &(0x7f0000000940)=[{&(0x7f0000000380)="584fe409f2f22a54b863a7a85f9a77ccd2948cfcc16169204817d01cc08093eab603ef9ec01422fa02dfc36180ceaa47bb013452cb1fbbba0f90f6a024dbd87d9bcb9f8a94ed965488bcfea178b114e4cd265eb4334454f2981b92558bb9963021a4a2311ea35a69aae50a1e13ee497b00851589e4a20c4655d56a9aad40", 0x7e}, {&(0x7f0000000400)="33a412178744ecdbc9b2b4c0cdb39c20d1a69c", 0x13}, {&(0x7f0000000580)="1bfd6a31a49d7a308601d9e87dbf849186a61389c4c6d94764b7293b3a35576c2a6ea28f0ce0f6712ae97d8fec780086e279b45fc9eeaf1af6c014e9e35db408ccb2164b91da33df237903bd401919bd3a3872b0a57c3a1dcde342678414384af19f537b5e486fd1bd7e2e2e797d23fbc6a93c2e57685caec6237280e8679a2ea77a4fff03b469167a409f394245b186abbd13436e89111ceed1657b5732e35f512af94eb17def1561beec0777f5d3fde71e5a4ca33cceb6cb0dad7a40b7264c89bd85be41d6db60fa50053880a176d3c692", 0xd2}, {&(0x7f0000000680)="0268aae490d8e092862b4aeec60287d89a6d0fbcfd4a056df42031194b184bb2fb9f7173bcc4d8fc338a41156ae0524cb77f925e014ecfc9e9a7d97781e57d7bc2cdded9c4157817e644d509273911a6ab223f6b1419490ac5084265421c0c313861a4b741d7b672da517e35b6d7747f8012fd79aa930789b1b48d39559a26eb051cbddd", 0x84}, {&(0x7f0000000440)="7ff7734bd9de28b26221a466938f233d5472c8ab02ac73d14213dd8e65885bcb441267332fc7aa9d07e780e8f4c535e411e0968ba13ff03f84dd30702cb7e496f111a5302aa63c053938209595ecfa78512eab", 0x53}, {&(0x7f0000000740)='T', 0x1}, {&(0x7f0000000780)="0936574495b2c3bf2f718c040d1f682a4e4c0e1bf1b66d33e17b05ec642d1ddb4ea8328edd01f9e20a961cde62983004955260e77f77a1a7a9254dce896407a644b4cbbe329dd18cb0da40aa42b96f8ed31d0c3f5b4e6de9c9dec9d16982cbfdcc6360855f03030d3d997192133a093459fdff7d674796ba40ad7fef32572594f49d40f129a32eadd24e983badb6b971cd1db7eae6eacef91e3d5afe688b354d34af1e4b5130047a84d08aa3873fc36535a3bfb74b39130488faf2ec67ed783b69091ebdcb5d73abdef319a5", 0xcc}, {&(0x7f0000000880)="39840778e2184843449849ade326738cb70276a809af1842c6e8633eb88b8119b7bd53ea307425af0bcedf699c57e2827356ee79d7537f8c8a789dce7e7cb2ffa29ec7b585730e30e7bbf61bc9336488c5d91570819bda1e086289f655ec68e287f1c8e9d2c81f46ab68b5542f22d02142218324c663d7a98507fb50471c3be1f7bca673b7c6a993a48a97f89bf6e5f53e449f2ababa9c069336539b4e90aa59a75dc6b465bee0a479e1042ced01983c71", 0xb1}], 0x8, &(0x7f00000009c0)=[{0x70, 0x102, 0x6, "b159e340da7cc3e21d583a33a83b50b543b4e092b06c1a1a19ac54fb517021020191440f68d42f621f57da92222bfe0d989b7ad51d3707d6237cee443536b16db812dd3c4950998b2295c3cd008557a6f39eb47c213c1038caf65422b8d8df76"}, {0xb8, 0x1, 0x8001, "bd914eb90326daea7d9d15a8f255357b49414fbfc6dc31034f1150b721971beabdc5673a4c08adcedba566adbab49304c8e694714612f81e80ce68ba30ebdc925c91355b0941d7b66f1f3fb50555b332fca4fe4f07ea2e13eb096a8a68c216169c06bb5f10438b53bb1b7027d0e70f3c3f007cad85a7508f559267b8c2af10fde28e85329dd2c440250e4f00a177e853fefee67eb136476f70cd28c82248291e96dc69f6ee8576ef"}, {0x1010, 0x10e, 0x9, "bd1cb20f184018106f1d285646c68d65ab2a375b8f438dcf1cc51d60055981548224a28d38bac646db3583f5cb8680e3ed6bdf853095262f3a678541d21dcc69108cf3274ed2c7736c15b34fc6dec63f18a3dcbcd9345202de97f9a41d4895257ec7f46c30f8a749fa8953d0484f2185c000f94ae4a9e6685994fcb9e1c8cde338f3f14f7f56d78abea873a318d1bd5367ae290466e24ff5f317c5ffcb452fb373b7cf602f518ec39ecc3f7ef281b07957fdf1a6b1e3985e179a7123b831e0cf6a4325ea59fbd457f68f2f327005912c695f35777039621eb1ad632b65642d055fa774be55e90789e6f985a873389a1b39c7766ddcbb263676bb6cace022ba8dc25e343325a1a93ad2d0c4023ad25395bc16c30fd6cda6d7f114970a5a72b48ffde89c17981d1cecc8ea88229079dcf85f74b7453ed445bddd748462e1653606439fc5c2c60a11ea1157c0bf757b581d1e5441d4bafe3fe28e85c2074a184fe7421a3420cb41098165fdefd3373f73933317626e414d2faf1f1e0542157e85d2f37913d7872df980f47c29c087e14d25892c92a6cba092e8c3899fc7c5d0aa9ccaeee49e9f1d88d3e90f3a1ca789d77e6c76dea94aadeea36c902175fa3cc300381dda22a901f4e91638328c0e76f6470ab74bd2b935a03b04b144c33739eb269daf712d95f008cad8e19940bec1f5626069e84c75c508463eeb4f38da6fdc996a41b2a481c7c491c0df7e83c37c2975ecd3a2bf86e0bd1a62a2b8d33e79d3d04341be139f2b5f0d8fb3c3a7073d0139c29aba6058be2c6cec6a6270758e77c37711aaffb5aea16d85ffbcae807742a0fc32243cb24740dc1ade3ef6c47b8c1639d0635a15d30fae00b6dc08ced87dfa117975c46459112547825ef52cb994f6b8d5a49b2908940be5a314d0c89561723ed2ff436cad5d33e779bdfcdd534a5eb27d54e0789314fefe76d866a68b0fc23fa7abbed3f120666be3b458643daf554661e30ea1f2f6e92cbf616ac41bc284003268becb90694e7d13f21455dc592f3afc06ca2890bf5fe378545c95f48d53d4c7b3d810e5e5fbe19ee06585ee75691a30c9189d0389a6127e6a42ba8be933965be763881a26dc2c320337b4a34b93b811befcbb5b38b3aa92d529d8d0a63c2f79b82e4d014910bbf3df280c354261e136590f4a5f4812667112d5a810a9b18bed7f86badbe51829f2ac9dd13b0404fe31654add5c8112addee078c91711482cfce03927bcaa00c397c0367a82687ae2ad910ee18045d910cfa5ee6e09b1f46a6f1be3706ec5717f6a05f536fe9ca5110395c54d7e976f8aa7393377367169b2f4520edfb776a284c07e227ef67252dc74c87600dc7285645bb6ec97d8d0e26da9cf255bd1a11607320177e849eeb5fd1309efecc5105ecaa7d37af5a301e35bcda2d26bbb7883e88340192d3f905742b86552f698b9cf0b1cba88ee5c6ce2dff8da13c58ca7f53734f3647e7e8b2250707e90647c033d155ebf11adabea554b03e477315c973c64ee550c62c4f644eca1a74e1e55cc22f255339dea0297a3caca82ced552a586feb5aaec4584a914f23d92014e7f6da5f8a7757019fab0f1d8a1f1ec2b9a77e3b565b21ff29ce7558aea10806587c939b4863fc8747cbc2a159c0ee9cc0ded3143723f1a7ce6cc2906146ed09211dc4b713c18866d789e99d7363f470c8e5bb24dc99efdae044caa3a164e67e2ee66765960c84cfbfcf084cc51382cd01102ba07c250e3a52cce89b71245f82defdd86ba1b02ca0c4abb2c88fc57769c49f8f7d787a3b1ce4002b461afad1a667fba77f9c0e9e7a53c02d0ffed77394416ff24b2c0741fc59db2b343c3067b06bc75d3b5999eb88041028b54b82f4a21cecb8150087215ee07da255152cd0d07f1bb7ab5b94bea00ef18ca0ba07ab7330450adc0d3bab88b5f6bb2d494e220d15ef9b80568f765772eb84070d9a01a1b755b99d8fbdf2913658e6903969dac48634e21758a8e8bf099d917ce43195d82ae98852d93af4bfdb7dd9d606eac5849152053a35647e82b26975816869b29ac772a053e1dd9eac2727d9dca3d801da48ea008912e426715bf4d79a71a5075238cef2a0e1a9743ce6377d3325d601aad15eb1289acb1bfec572038f8d3f5b567f3615cf0c01138c8a9efcd301dc2a5f434b9839f10bb1ae73faab5a8b4be8dd2dc213e3777e368dd188fde45c7647715b79b648069ac0cf796801f5c13e8624da7d37c05b71087016ef6009f5da71b0f312c9528248268b8f0eb36f3f32539c88074a4fef5d3782a91475b8370f37050ecd45cca7b5ba915f8424baaaea8a8ac795331ecf8cd76e3035008b0ee6a04971fb271f8970d8cd5febada6ce80dce08dfa0b310cb97f150e6ddc6b8759137b34ed18ada6030994d955ba867e33c81abee9b1e084d438c6dd53a8995a987e9a8191d22adb38df3e57264553ebb29acb71b71566d434e3504fc14d764b79bb6fdedc6a3b04de20bbf8b8d8c7040472d289a472f84c9c72ea6b980274d67a387c6443ed29909467fb16742c7037065cf334fe7064d3e0d691f34e9e4ccf61ca07c39537a9f00c4de64ce9c5b307ef434881871a327d14c5138c61f3831a10c15512a2e8d9808811dd1bd9b7efdf7d344650829031dccd550a9bba44de6a00e8bb882f76e64e7dc78b52c614748faaa37875011871c3e9a2147c7ab860eb02aae65224c08ca8ab14db7e68ea4c1e0388bd262a003796aacfb94b0240c2c3af515c0c45a556c5bb597e168b1e866322dc43c04fc915d9519bcf9b8472f3c4a030ee0a4a7a08600b3bbba2515aa6335c3a25e04b3f51e8cdda15873db67ecdb68720f053de7e0fccf3ecede14e31a7d151e649573f3366099e0c39d28eefa1c99904248edea85ccb1f3543d1197ade8904ffff14a7cf073f408f12e040c04848d095ed45778358fa623296cae91ff1c6c3f2d6b63629436439342dba1ceb89098a14a732afb50d89038a959ff180b27567409b3871f4daa414ac6c18bcb9cc09cc8791e8bc913d8e7bd9053704d01a52ee168d9c12fe5484fba90440ba60eac71bfef22b492f0c84a92b7c8e70899f6127756389e52bfdb12b3bbaee62e0169fb47bcfff7c927fbd365ec80e617005173bd953468584b40d4e02829c335595aa37db11060c70db93f2eb43b03f2dde4f3b08733d59399547696be0a2ec699cd3a5ac11175ab8d2c19b2a0134e4850f9aa7151b0b94eb277ee1f24aba4cc58acb5c96d361f4d5467f9e6751e4590d2379e447fdd67f638c8581fc88fc7a64035d239691c13f8307d66d97b568443c82e304525d02ac5bc83c4aa1f3e4412499ad26a2df30e14af7742031ecf67110fffbdc13c91a2afc5170636f229804c7faeaf1db8488521299429f2b108888f3c0190d0186024d907214206f27a373d441d46aa1bbc54602faa26b4882d9f3b2502e1fad760c6db633c1a8358d70019a9a50c64a285c5375a40f8e371562de325d5ad6050e6021595fc4c7c2190cdcdb80edd2b408da2cd4028b9890c8a700c2f03912acec3987d05a7db86f660c212a3079358d2d43ca01e4ba12e7c4daff0a6d1580dbc6214ee163a27ae62c51f7a83450e6b35ac0525a9680fcf87d6930aff8671f1cd6ac77de36d23f39fbd4d82dbd5467ee9267eeef6eb831344dd3a2adc04d7313e1c1232840d1fbf4d57bd701f31a0404b63b70bc28bc1938934215f905eb937ffa0e74574495705a147be622ea990ff0a2a7b287b770a5b7403c12e3510feae0e03c575941d9c1b21b6158c13c90aeea46fd95968ad446b72a00b3659b15d73157f1ee896733d688f29fc58ccbea42b6d025c16b3f475c3dc57ef0b410019151829a413e19b8abfa5fc22c9a3c29d277edbaf16ed7cbadccf92decf72e6f0450501bc881590e24acd17317fb8a1c2804d825588455039934ede685b09b67ee9907126fc7b30fe5ddd637bb159a119150cb42b3ceae9a0132e49dc1fccf702a49f9e0451667d4838f94b0bec65a30422022e31d437229bd82fa2af2b67ce86cdb2bfba18426d81421e73a3d3f7165e9942b3c79f5e9ec0c0d29ba00d6ac9a2f2f104b16a83b0aae63e2d017a0b4628276d1fee3bac6e2fcc23e7d89099ccee0fdd7120b3f0d496d2ea3baa0264074a67ca22fbf5f3fbf71871a6f9ddbb440f30becf3596dc2d5864a9b7b354d12c1b8b672493ce5fd9765c38f73b0c588a7fe0bc10b1212dba2b67ed5da46fb9f01ed25d9d4bcea70a8e3cc82d8b5ecb3393b587a2b4b6372f83ac5707cf22edb9910b015961eb333c446b776d5356819a9b9ae1135db8c560d3916a4ef71201151a216f56a9803c74146fb40a47a186070169fc0ec9c1383666c1a4fc17952ea9234332426b45791f0754c369573af0f6cdd2e69aab377c12a99238f1b45232fb2658a2ef5fd963e49cfe8fcd6349a550241bfb57a2deda864c2385f11623537934d89ef72a5bd2928032bcd23800007d37f591359dd1a8d061ce8a7169b366df4bd8355c60179f74e8dbaf256587063c388884dd547f0313ba446f2e16180f5b855a9376daf7219ec1e198cb1644b38a641a2b4e690817b6de18a4f75a69b5e8898a0a38382d9838159f6bae8cd97fb89e2cd52313dfeb4426aff2ddba9f28d622372561fc1d647c9bf54c623d29d44a2ca68a1f41f85e71a5d49573c51f1425c5099d3d2911ad3a23b0e95a5a38121b2b324b13698a1cc734ba6bd6d4ea64232e8045ab25b63ef313355483cb897c1fef2844eecb80d55b69d56cf4e810dcb3771a543b23f088b6a5f770a14cbd08b1e4b7cac8ebdb0a614179620b7ebceabf6630cf27938cc77a9a7b6c6111e21a561ed476a34890d91acb797ec8bf9da4049f3a24c30ad4f444a99071399cd182ecadfe97f074a28520b6064e53f95d9e65d57b3b4c7db21ec4d38ce00f3c81e2b14d765f44e05da8cc85ff0f9945218adbb2d2391a8a1676468302ff7c87f435a4f767fc2bec28022f0b00db15b1f0e1c91f694fd01807dbe25c9756ecbb75e33706e0075af7d94bbce144ac00b60f55efd593ca1eeea1d1d5cdddcbd07f1da9940682194f5f57ccd8a2100e8dc9142930ed89d096e21095aa03fce7f7359f1ef7d9b523fa625de6c19f6a3d23a5b8420d2af081a6daffbc19c7e042bf4b6aaa784d592eb2f4e9515c48104668b34dd323d2540d7349284f1fd1f584a9ac05c4ec29623f99e9ccc32d3c3e7784f73f8c3d995017e1e8c1afe06f8fe3d602af9471d686d5cffb87e79dd6e181268ccecca9454fedf6c9d886211f45d4b19c9fadc280d1d2de2a57386be7587ef63390fa178aec6d899fb2f028ff41d2479a459ec1d14308d7eb33e7d8150e746930eed4817c2dc35c428b9dea0abb26419cb72c1951a446a3501c1a9527ccc66c05cad169929a56e15219780c9e7a0fc344699aba0a01e234260558b0ee71d526393505331f10bb517df890e1780dbf9a6748ccc85dc3ace476cd55bb5af6daa2965d75412ffe171f17c6d981b7eccd7a4c7a036fb3b510c39f397061ed5c5408df60907081eb9758c4a124740c316aa1a1c669ff561d6777fe65ef83d93dcc58941128f26c6f0e655027bfd76390c1420d735e7b66de3fe362bd1d18b5db83cce7df620c8c2bc1f8c0833d8d944783cee49580b1600f18d8d1d43ac79a8151526e875f14f350f9656af1d2d2e654ba8fd84ee618eb0090b51a78cdbca17e0992e53f493efcf50712abdf7790698647103ab2da8180131d38fec7ac53f0580e1f9e3a"}, {0xf0, 0x84, 0x80, "f2de373ffae6fd0cad1354e5ce454c8c441c6d4a9d4cdcb3edee5c1a6fd9fd9b1b3ca77a7f279be25323708b4812ec31ac93c5eb51b0b152b0e395187a957c2136590ef96383bbc664ec8389a269d9037ed4fe65710f3d3fb92cd42589f496f39b3af6af9079c6851bbf33b5caf7568927b449889310f380c13401f7b20802a8906970c236e95e42a0b467fb5080896ce88419e21ed7e4f9f89bcf379257b065baddb5e211e0859ddbaf361cb7b853056e82610121f30bbd1e2bfe583274887732eae2312e1f0f115ed8b1cf648c7f6903e27877c9593c4b85540c4179b01f"}], 0x1228}}], 0x1, 0x80040a9) r7 = socket$inet6(0xa, 0x80003, 0x80) ioctl(r7, 0x0, 0x0) setsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(r0, 0x84, 0x9, &(0x7f0000000000)={0x0, @in={{0x2, 0x0, @empty}}, 0x0, 0x0, 0x0, 0x0, 0xc}, 0x9c) [ 404.959719][T17370] bridge73: port 2(erspan0) entered blocking state [ 404.966458][T17370] bridge73: port 2(erspan0) entered disabled state [ 404.974684][T17370] device erspan0 entered promiscuous mode [ 404.993640][T17376] device syz_tun left promiscuous mode [ 405.000637][T17376] bridge219: port 1(syz_tun) entered disabled state [ 405.127835][T17376] bridge220: port 1(syz_tun) entered blocking state [ 405.134699][T17376] bridge220: port 1(syz_tun) entered disabled state [ 405.144144][T17376] device syz_tun entered promiscuous mode [ 405.151819][T17378] netlink: 72 bytes leftover after parsing attributes in process `syz-executor.1'. [ 405.165791][T17379] device erspan0 left promiscuous mode [ 405.172407][T17379] bridge219: port 2(erspan0) entered disabled state 15:24:47 executing program 2 (fault-call:16 fault-nth:1): socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000340)={'erspan0\x00', 0x0}) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000300)={'syz_tun\x00', 0x0}) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r7, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r6, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000380)=@newlink={0x34, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r8}, [@IFLA_LINKINFO={0x14, 0x12, @bridge={{0xb, 0x1, 'bridge\x00'}, {0x4}}}]}, 0x34}}, 0x0) sendmsg$nl_route(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000002700)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r5}, [@IFLA_MASTER={0x8, 0xa, r8}]}, 0x28}}, 0x0) sendmsg$nl_route(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f00000000c0)=ANY=[@ANYBLOB="2800000010000104000040000000000000001ea6", @ANYRES32=r2, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00\b\x00\n\x00', @ANYRES32=r8], 0x28}}, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r10 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r9, 0x8933, &(0x7f0000000300)={'syz_tun\x00', 0x0}) sendmsg$nl_route(r10, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000040)=@newlink={0x2c, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r11}, [@IFLA_BROADCAST={0xa}]}, 0x332}}, 0x0) [ 405.307770][T17379] bridge220: port 2(erspan0) entered blocking state [ 405.314523][T17379] bridge220: port 2(erspan0) entered disabled state [ 405.324186][T17379] device erspan0 entered promiscuous mode [ 405.332254][T17380] netlink: 72 bytes leftover after parsing attributes in process `syz-executor.1'. 15:24:47 executing program 4: r0 = socket$inet6(0xa, 0x80003, 0x6b) ioctl(r0, 0x1000008912, &(0x7f00000001c0)="080db5055e0bcfe8476071") r1 = socket(0x10, 0x2, 0x0) sendto(r1, &(0x7f0000000200)="120000001200e7ef007b1a3fcd00000000a1", 0x12, 0x0, 0x0, 0x18) recvmmsg(r1, &(0x7f00000037c0)=[{{&(0x7f0000000600)=@ethernet={0x0, @random}, 0x80, &(0x7f0000000380)=[{&(0x7f0000000040)=""/95, 0x5f}, {&(0x7f00000000c0)=""/85, 0x55}, {&(0x7f00000024c0)=""/4096, 0x1000}, {&(0x7f0000000400)=""/120, 0x78}, {&(0x7f0000000480)=""/60, 0x3c}, {&(0x7f0000000280)=""/77, 0x4d}, {&(0x7f0000000540)=""/154, 0x9a}, {0x0}], 0x8, &(0x7f0000002400)=""/191, 0xbf}}], 0x1, 0x6, &(0x7f0000003700)={0x77359400}) [ 405.367921][T17390] netlink: 'syz-executor.1': attribute type 274 has an invalid length. [ 405.396766][T17392] netlink: 'syz-executor.1': attribute type 274 has an invalid length. 15:24:47 executing program 0: r0 = socket(0x21, 0xa, 0x1) r1 = socket(0x10, 0x80002, 0x0) ioctl(r1, 0x1000008912, &(0x7f00000001c0)="080db5055e0bcfe8696071") getsockopt$inet_sctp_SCTP_PEER_AUTH_CHUNKS(r1, 0x84, 0x1a, &(0x7f0000000940)=ANY=[@ANYRES32=0x0, @ANYBLOB='\x00'/12], &(0x7f0000000980)=0x10) getsockopt$inet_sctp_SCTP_GET_PEER_ADDR_INFO(r0, 0x84, 0xf, &(0x7f00000009c0)={r2, @in6={{0xa, 0x4e21, 0x8, @local, 0x401}}, 0x9, 0x1, 0x7, 0x7f, 0x6}, &(0x7f0000000a80)=0x98) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000400)='nl80211\x00') sendmsg$NL80211_CMD_GET_MESH_CONFIG(r0, &(0x7f0000000580)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x103190}, 0xc, &(0x7f0000000540)={&(0x7f0000000500)={0x34, r3, 0x10, 0x70bd2d, 0x25dfdbfe, {}, [@NL80211_ATTR_WDEV={0xc, 0x99, {0x1, 0xffffffffffffffff}}, @NL80211_ATTR_WIPHY={0x8, 0x1, 0x1}, @NL80211_ATTR_WDEV={0xc, 0x99, {0x3f, 0x3}}]}, 0x34}, 0x1, 0x0, 0x0, 0x800}, 0x40000) r4 = socket$nl_generic(0x10, 0x3, 0x10) bind$netlink(r4, &(0x7f0000000000)={0x10, 0x0, 0x25dfdbff, 0x1004280}, 0xffffffffffffffb3) sendmsg$nl_generic(r4, &(0x7f0000000080)={&(0x7f0000000480)={0x10, 0xbb7f}, 0xc, &(0x7f0000000440)={0x0}}, 0x0) socket$netlink(0x10, 0x3, 0x0) r5 = socket$alg(0x26, 0x5, 0x0) bind$alg(r5, &(0x7f0000000080)={0x26, 'hash\x00', 0x0, 0x0, 'sha512\x00'}, 0x58) [ 405.461111][T17400] device syz_tun left promiscuous mode [ 405.466894][T17400] bridge207: port 1(syz_tun) entered disabled state 15:24:47 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, 0x0, 0x0) sendmsg$nl_route_sched(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000540)=ANY=[@ANYBLOB="7400000024000705000000000000000000010000", @ANYRES32=r3, @ANYBLOB="00000000ffffffff000000000800010073667100486818973f73461919309b68e1693572bb000229c6090032d0ed64f3c3545aaf6e000085a4e4ebb5ef670000000000000000000000000000001a4e624d29a84abf03265700000000000000000000000000000000000000000000000000000000000000ac20000089b53c947244306a0216a3de887763df5b42498b13bb1938de859ee6d7ae7dd2224dc672b69b4358871b170ea0b667832e5224ee3538f885b7abd9bc4a7d"], 0x74}}, 0x0) r4 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r4, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000300)=ANY=[@ANYBLOB="840000002c00010700"/20, @ANYRES32=r3, @ANYBLOB="0008008000000000030000000800010075333200580002001400050000000000000000000000000000000000400006003c0001000000000000001020898dde66057433b6ef3a41d22be225e0001b0000000000000000000000000017256ffc66e43a2484e1a912c5998bcbf0d0000000000000000000000000000000798a3c067277da1a290b9613a33c575c36fad473382c8f5532ef3f0e1d2c450a7decbf3431a69f9b2ecb3291bed174245a962fe0484676958265e2988326a89db3139d91fe4aee6ae7e745ab00001a9f61f20500000000000000b3958bc14fce6e66a36d1ab3194534ba4e973684b27793bff837d3"], 0x84}}, 0x0) r5 = socket(0x10, 0x80002, 0x0) sendmmsg$alg(r5, &(0x7f0000000140), 0x49249249249278c, 0x0) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r6, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000500)=@newlink={0x20, 0x11, 0x40d, 0x0, 0x0, {0x0, 0x0, 0x0, r8}}, 0x20}}, 0x0) r9 = socket(0x10, 0x80002, 0x0) getsockopt$inet_sctp_SCTP_PEER_AUTH_CHUNKS(0xffffffffffffffff, 0x84, 0x1a, &(0x7f0000000940)=ANY=[@ANYRES32=0x0, @ANYBLOB='\x00'/12], &(0x7f0000000980)=0x10) r10 = socket(0xa, 0x6, 0x0) close(r10) r11 = socket$inet6_sctp(0xa, 0x10000000005, 0x84) setsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX(r11, 0x84, 0x6e, &(0x7f0000000180)=[@in6={0xa, 0x0, 0x0, @remote, 0x9}], 0x1c) getsockopt$inet_sctp6_SCTP_GET_ASSOC_ID_LIST(r11, 0x84, 0x1d, &(0x7f000095dff8)={0x1, [0x0]}, &(0x7f000095dffc)=0x8) setsockopt$inet_sctp_SCTP_RTOINFO(r10, 0x84, 0x0, &(0x7f0000000000)={r12, 0x0, 0x0, 0x1000000}, 0x10) setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(0xffffffffffffffff, 0x84, 0x9, &(0x7f0000000680)={r12, @in={{0x2, 0x4e20, @remote}}, 0x10001, 0xfff7, 0x5, 0x1, 0x8, 0x5, 0xba}, 0x9c) ioctl(r9, 0x1000008912, &(0x7f00000001c0)="080db5055e0bcfe8696071") getsockopt$inet_sctp_SCTP_PEER_AUTH_CHUNKS(r9, 0x84, 0x1a, &(0x7f0000000940)=ANY=[@ANYRES32=0x0, @ANYBLOB='\x00'/12], &(0x7f0000000980)=0x10) r13 = socket$nl_generic(0x10, 0x3, 0x10) r14 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080)='nl80211\x00') r15 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL80211_CMD_GET_STATION(r15, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000240)={0x1c, r14, 0xf2b, 0x0, 0x0, {}, [@NL80211_ATTR_AIRTIME_WEIGHT={0x8}]}, 0x1c}}, 0x0) sendmsg$NL80211_CMD_GET_MPATH(r13, &(0x7f00000001c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x2000}, 0x268, &(0x7f0000000080)={&(0x7f0000000200)={0x40, r14, 0x4, 0x70bd2d, 0x25dfdbff}, 0xff6b}, 0x1, 0x0, 0x0, 0x10049050}, 0x260448c0) sendmsg$NL80211_CMD_NEW_KEY(r9, &(0x7f0000000640)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0xb0024000}, 0xc, &(0x7f00000002c0)={&(0x7f0000000440)={0x7c, r14, 0x23, 0x70bd27, 0x25dfdbff, {}, [@NL80211_ATTR_KEY_DATA_WEP40={0x9, 0x7, "a80875ab12"}, @NL80211_ATTR_KEY={0x5c, 0x50, [@NL80211_KEY_DEFAULT_TYPES={0x14, 0x8, [@NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_MULTICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_MULTICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_MULTICAST={0x4}]}, @NL80211_KEY_DEFAULT_TYPES={0x28, 0x8, [@NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_MULTICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_MULTICAST={0x4}]}, @NL80211_KEY_IDX={0x5, 0x2, 0x5}, @NL80211_KEY_DATA_WEP104={0x11, 0x1, "4d84c4e30151cb27f51a4adf63"}]}]}, 0x7c}, 0x1, 0x0, 0x0, 0x24000}, 0x40) [ 405.560604][T17421] FAULT_INJECTION: forcing a failure. [ 405.560604][T17421] name failslab, interval 1, probability 0, space 0, times 0 [ 405.594360][T17421] CPU: 0 PID: 17421 Comm: syz-executor.2 Not tainted 5.5.0-rc5-syzkaller #0 [ 405.604058][T17421] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 405.614127][T17421] Call Trace: [ 405.617421][T17421] dump_stack+0x197/0x210 [ 405.621895][T17421] should_fail.cold+0xa/0x15 [ 405.626488][T17421] ? fault_create_debugfs_attr+0x180/0x180 [ 405.632287][T17421] ? ___might_sleep+0x163/0x2c0 [ 405.637131][T17421] __should_failslab+0x121/0x190 [ 405.642066][T17421] should_failslab+0x9/0x14 [ 405.646571][T17421] kmem_cache_alloc_node_trace+0x274/0x750 [ 405.652486][T17421] ? rcu_read_lock_any_held.part.0+0x50/0x50 [ 405.658473][T17421] ? __kasan_kmalloc.constprop.0+0xcf/0xe0 [ 405.664375][T17421] __kmalloc_node_track_caller+0x3d/0x70 [ 405.670014][T17421] __kmalloc_reserve.isra.0+0x40/0xf0 [ 405.675376][T17421] __alloc_skb+0x10b/0x5e0 [ 405.679790][T17421] ? __kmalloc_reserve.isra.0+0xf0/0xf0 [ 405.685331][T17421] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 405.691569][T17421] ? netlink_autobind.isra.0+0x223/0x300 [ 405.697199][T17421] netlink_sendmsg+0xa1b/0xea0 [ 405.701950][T17421] ? netlink_unicast+0x7d0/0x7d0 [ 405.706873][T17421] ? aa_sock_msg_perm.isra.0+0xba/0x170 [ 405.712404][T17421] ? apparmor_socket_sendmsg+0x2a/0x30 [ 405.717852][T17421] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 405.724075][T17421] ? security_socket_sendmsg+0x8d/0xc0 [ 405.729517][T17421] ? netlink_unicast+0x7d0/0x7d0 [ 405.734449][T17421] sock_sendmsg+0xd7/0x130 [ 405.738878][T17421] ____sys_sendmsg+0x753/0x880 [ 405.743642][T17421] ? kernel_sendmsg+0x50/0x50 [ 405.748311][T17421] ? __fget+0x35d/0x550 [ 405.752474][T17421] ? find_held_lock+0x35/0x130 [ 405.757236][T17421] ___sys_sendmsg+0x100/0x170 [ 405.761908][T17421] ? sendmsg_copy_msghdr+0x70/0x70 [ 405.767017][T17421] ? __kasan_check_read+0x11/0x20 [ 405.772042][T17421] ? __fget+0x37f/0x550 [ 405.776190][T17421] ? ksys_dup3+0x3e0/0x3e0 [ 405.780605][T17421] ? __fget_light+0x1a9/0x230 [ 405.785274][T17421] ? __fdget+0x1b/0x20 [ 405.789342][T17421] ? __sanitizer_cov_trace_const_cmp8+0x18/0x20 [ 405.795566][T17421] __sys_sendmsg+0x105/0x1d0 [ 405.800154][T17421] ? __sys_sendmsg_sock+0xc0/0xc0 [ 405.805200][T17421] ? trace_hardirqs_on_thunk+0x1a/0x1c [ 405.810649][T17421] ? do_syscall_64+0x26/0x790 [ 405.815332][T17421] ? entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 405.821385][T17421] ? do_syscall_64+0x26/0x790 [ 405.826055][T17421] __x64_sys_sendmsg+0x78/0xb0 [ 405.830804][T17421] do_syscall_64+0xfa/0x790 [ 405.835310][T17421] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 405.841209][T17421] RIP: 0033:0x45af49 [ 405.845098][T17421] Code: ad b6 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 7b b6 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 405.864690][T17421] RSP: 002b:00007f44f4f31c78 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 405.864703][T17421] RAX: ffffffffffffffda RBX: 00007f44f4f31c90 RCX: 000000000045af49 [ 405.864711][T17421] RDX: 0000000000000000 RSI: 0000000020000000 RDI: 000000000000000d [ 405.864718][T17421] RBP: 000000000075c118 R08: 0000000000000000 R09: 0000000000000000 [ 405.864725][T17421] R10: 0000000000000000 R11: 0000000000000246 R12: 00007f44f4f326d4 [ 405.864733][T17421] R13: 00000000004caa0f R14: 00000000004e3eb0 R15: 000000000000000e [ 405.947928][T17400] bridge208: port 1(syz_tun) entered blocking state [ 405.955171][T17400] bridge208: port 1(syz_tun) entered disabled state [ 405.966049][T17400] device syz_tun entered promiscuous mode [ 405.974118][T17401] device erspan0 left promiscuous mode [ 405.980007][T17401] bridge207: port 2(erspan0) entered disabled state [ 406.098028][T17401] bridge208: port 2(erspan0) entered blocking state [ 406.104715][T17401] bridge208: port 2(erspan0) entered disabled state [ 406.116869][T17401] device erspan0 entered promiscuous mode 15:24:48 executing program 5: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000340)={'erspan0\x00', 0x0}) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000300)={'syz_tun\x00', 0x0}) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r7, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r6, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000380)=@newlink={0x34, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r8}, [@IFLA_LINKINFO={0x14, 0x12, @bridge={{0xb, 0x1, 'bridge\x00'}, {0x4}}}]}, 0x34}}, 0x0) sendmsg$nl_route(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000002700)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r5}, [@IFLA_MASTER={0x8, 0xa, r8}]}, 0x28}}, 0x0) sendmsg$nl_route(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f00000000c0)=ANY=[@ANYBLOB="2800000010000104000040000000000000001ea6", @ANYRES32=r2, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00\b\x00\n\x00', @ANYRES32=r8], 0x28}}, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r10 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r9, 0x8933, &(0x7f0000000300)={'syz_tun\x00', 0x0}) sendmsg$nl_route(r10, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000040)=@newlink={0x2c, 0x10, 0x0, 0x0, 0x0, {0x0, 0x0, 0x0, r11}, [@IFLA_BROADCAST={0xa}]}, 0x332}}, 0x0) [ 406.139196][T17415] device syz_tun left promiscuous mode [ 406.148765][T17415] bridge220: port 1(syz_tun) entered disabled state [ 406.297847][T17415] bridge221: port 1(syz_tun) entered blocking state [ 406.304747][T17415] bridge221: port 1(syz_tun) entered disabled state [ 406.317455][T17415] device syz_tun entered promiscuous mode [ 406.325206][T17416] device erspan0 left promiscuous mode [ 406.331072][T17416] bridge220: port 2(erspan0) entered disabled state [ 406.467774][T17416] bridge221: port 2(erspan0) entered blocking state [ 406.474624][T17416] bridge221: port 2(erspan0) entered disabled state [ 406.487491][T17416] device erspan0 entered promiscuous mode [ 406.498357][T17426] netlink: 72 bytes leftover after parsing attributes in process `syz-executor.1'. 15:24:48 executing program 2 (fault-call:16 fault-nth:2): socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000340)={'erspan0\x00', 0x0}) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000300)={'syz_tun\x00', 0x0}) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r7, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r6, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000380)=@newlink={0x34, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r8}, [@IFLA_LINKINFO={0x14, 0x12, @bridge={{0xb, 0x1, 'bridge\x00'}, {0x4}}}]}, 0x34}}, 0x0) sendmsg$nl_route(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000002700)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r5}, [@IFLA_MASTER={0x8, 0xa, r8}]}, 0x28}}, 0x0) sendmsg$nl_route(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f00000000c0)=ANY=[@ANYBLOB="2800000010000104000040000000000000001ea6", @ANYRES32=r2, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00\b\x00\n\x00', @ANYRES32=r8], 0x28}}, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r10 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r9, 0x8933, &(0x7f0000000300)={'syz_tun\x00', 0x0}) sendmsg$nl_route(r10, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000040)=@newlink={0x2c, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r11}, [@IFLA_BROADCAST={0xa}]}, 0x332}}, 0x0) 15:24:48 executing program 0: r0 = socket(0x21, 0xa, 0x1) r1 = socket(0x10, 0x80002, 0x0) ioctl(r1, 0x1000008912, &(0x7f00000001c0)="080db5055e0bcfe8696071") getsockopt$inet_sctp_SCTP_PEER_AUTH_CHUNKS(r1, 0x84, 0x1a, &(0x7f0000000940)=ANY=[@ANYRES32=0x0, @ANYBLOB='\x00'/12], &(0x7f0000000980)=0x10) getsockopt$inet_sctp_SCTP_GET_PEER_ADDR_INFO(r0, 0x84, 0xf, &(0x7f00000009c0)={r2, @in6={{0xa, 0x4e21, 0x8, @local, 0x401}}, 0x9, 0x1, 0x7, 0x7f, 0x6}, &(0x7f0000000a80)=0x98) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000400)='nl80211\x00') sendmsg$NL80211_CMD_GET_MESH_CONFIG(r0, &(0x7f0000000580)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x103190}, 0xc, &(0x7f0000000540)={&(0x7f0000000500)={0x34, r3, 0x10, 0x70bd2d, 0x25dfdbfe, {}, [@NL80211_ATTR_WDEV={0xc, 0x99, {0x1, 0xffffffffffffffff}}, @NL80211_ATTR_WIPHY={0x8, 0x1, 0x1}, @NL80211_ATTR_WDEV={0xc, 0x99, {0x3f, 0x3}}]}, 0x34}, 0x1, 0x0, 0x0, 0x800}, 0x40000) r4 = socket$nl_generic(0x10, 0x3, 0x10) bind$netlink(r4, &(0x7f0000000000)={0x10, 0x0, 0x25dfdbff, 0x1004280}, 0xffffffffffffffb3) sendmsg$nl_generic(r4, &(0x7f0000000080)={&(0x7f0000000480)={0x10, 0xbb7f}, 0xc, &(0x7f0000000440)={0x0}}, 0x0) socket$netlink(0x10, 0x3, 0x0) r5 = socket$alg(0x26, 0x5, 0x0) bind$alg(r5, &(0x7f0000000080)={0x26, 'hash\x00', 0x0, 0x0, 'sha512\x00'}, 0x58) 15:24:48 executing program 4: r0 = socket$inet6(0xa, 0x80003, 0x6b) ioctl(r0, 0x1000008912, &(0x7f00000001c0)="080db5055e0bcfe8476071") r1 = socket(0x10, 0x2, 0x0) sendto(r1, &(0x7f0000000200)="120000001200e7ef007b1a3fcd00000000a1", 0x12, 0x0, 0x0, 0x18) recvmmsg(r1, &(0x7f00000037c0)=[{{&(0x7f0000000600)=@ethernet={0x0, @random}, 0x80, &(0x7f0000000380)=[{&(0x7f0000000040)=""/95, 0x5f}, {&(0x7f00000000c0)=""/85, 0x55}, {&(0x7f00000024c0)=""/4096, 0x1000}, {&(0x7f0000000400)=""/120, 0x78}, {&(0x7f0000000480)=""/60, 0x3c}, {&(0x7f0000000280)=""/77, 0x4d}, {&(0x7f0000000540)=""/154, 0x9a}, {0x0}], 0x8, &(0x7f0000002400)=""/191, 0xbf}}], 0x1, 0x6, &(0x7f0000003700)={0x77359400}) [ 406.517763][T17427] netlink: 72 bytes leftover after parsing attributes in process `syz-executor.1'. [ 406.532848][T17431] netlink: 'syz-executor.1': attribute type 274 has an invalid length. [ 406.542282][T17432] netlink: 'syz-executor.1': attribute type 274 has an invalid length. [ 406.588553][T17441] device syz_tun left promiscuous mode [ 406.594232][T17441] bridge208: port 1(syz_tun) entered disabled state 15:24:48 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, 0x0}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000540)=ANY=[@ANYBLOB="7400000024000705000000000000000000010000", @ANYRES32=r3, @ANYBLOB="00000000ffffffff000000000800010073667100486818973f73461919309b68e1693572bb000229c6090032d0ed64f3c3545aaf6e000085a4e4ebb5ef670000000000000000000000000000001a4e624d29a84abf03265700000000000000000000000000000000000000000000000000000000000000ac20000089b53c947244306a0216a3de887763df5b42498b13bb1938de859ee6d7ae7dd2224dc672b69b4358871b170ea0b667832e5224ee3538f885b7abd9bc4a7d"], 0x74}}, 0x0) r4 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r4, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000300)=ANY=[@ANYBLOB="840000002c00010700"/20, @ANYRES32=r3, @ANYBLOB="0008008000000000030000000800010075333200580002001400050000000000000000000000000000000000400006003c0001000000000000001020898dde66057433b6ef3a41d22be225e0001b0000000000000000000000000017256ffc66e43a2484e1a912c5998bcbf0d0000000000000000000000000000000798a3c067277da1a290b9613a33c575c36fad473382c8f5532ef3f0e1d2c450a7decbf3431a69f9b2ecb3291bed174245a962fe0484676958265e2988326a89db3139d91fe4aee6ae7e745ab00001a9f61f20500000000000000b3958bc14fce6e66a36d1ab3194534ba4e973684b27793bff837d3"], 0x84}}, 0x0) r5 = socket(0x10, 0x80002, 0x0) sendmmsg$alg(r5, &(0x7f0000000140), 0x49249249249278c, 0x0) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r6, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000500)=@newlink={0x20, 0x11, 0x40d, 0x0, 0x0, {0x0, 0x0, 0x0, r8}}, 0x20}}, 0x0) r9 = socket(0x10, 0x80002, 0x0) getsockopt$inet_sctp_SCTP_PEER_AUTH_CHUNKS(0xffffffffffffffff, 0x84, 0x1a, &(0x7f0000000940)=ANY=[@ANYRES32=0x0, @ANYBLOB='\x00'/12], &(0x7f0000000980)=0x10) r10 = socket(0xa, 0x6, 0x0) close(r10) r11 = socket$inet6_sctp(0xa, 0x10000000005, 0x84) setsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX(r11, 0x84, 0x6e, &(0x7f0000000180)=[@in6={0xa, 0x0, 0x0, @remote, 0x9}], 0x1c) getsockopt$inet_sctp6_SCTP_GET_ASSOC_ID_LIST(r11, 0x84, 0x1d, &(0x7f000095dff8)={0x1, [0x0]}, &(0x7f000095dffc)=0x8) setsockopt$inet_sctp_SCTP_RTOINFO(r10, 0x84, 0x0, &(0x7f0000000000)={r12, 0x0, 0x0, 0x1000000}, 0x10) setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(0xffffffffffffffff, 0x84, 0x9, &(0x7f0000000680)={r12, @in={{0x2, 0x4e20, @remote}}, 0x10001, 0xfff7, 0x5, 0x1, 0x8, 0x5, 0xba}, 0x9c) ioctl(r9, 0x1000008912, &(0x7f00000001c0)="080db5055e0bcfe8696071") getsockopt$inet_sctp_SCTP_PEER_AUTH_CHUNKS(r9, 0x84, 0x1a, &(0x7f0000000940)=ANY=[@ANYRES32=0x0, @ANYBLOB='\x00'/12], &(0x7f0000000980)=0x10) r13 = socket$nl_generic(0x10, 0x3, 0x10) r14 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080)='nl80211\x00') r15 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL80211_CMD_GET_STATION(r15, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000240)={0x1c, r14, 0xf2b, 0x0, 0x0, {}, [@NL80211_ATTR_AIRTIME_WEIGHT={0x8}]}, 0x1c}}, 0x0) sendmsg$NL80211_CMD_GET_MPATH(r13, &(0x7f00000001c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x2000}, 0x268, &(0x7f0000000080)={&(0x7f0000000200)={0x40, r14, 0x4, 0x70bd2d, 0x25dfdbff}, 0xff6b}, 0x1, 0x0, 0x0, 0x10049050}, 0x260448c0) sendmsg$NL80211_CMD_NEW_KEY(r9, &(0x7f0000000640)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0xb0024000}, 0xc, &(0x7f00000002c0)={&(0x7f0000000440)={0x7c, r14, 0x23, 0x70bd27, 0x25dfdbff, {}, [@NL80211_ATTR_KEY_DATA_WEP40={0x9, 0x7, "a80875ab12"}, @NL80211_ATTR_KEY={0x5c, 0x50, [@NL80211_KEY_DEFAULT_TYPES={0x14, 0x8, [@NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_MULTICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_MULTICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_MULTICAST={0x4}]}, @NL80211_KEY_DEFAULT_TYPES={0x28, 0x8, [@NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_MULTICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_MULTICAST={0x4}]}, @NL80211_KEY_IDX={0x5, 0x2, 0x5}, @NL80211_KEY_DATA_WEP104={0x11, 0x1, "4d84c4e30151cb27f51a4adf63"}]}]}, 0x7c}, 0x1, 0x0, 0x0, 0x24000}, 0x40) 15:24:48 executing program 3: r0 = openat$ppp(0xffffffffffffff9c, &(0x7f0000001740)='/dev/ppp\x00', 0x0, 0x0) ioctl$PPPIOCNEWUNIT(r0, 0xc004743e, &(0x7f0000000000)) pipe(&(0x7f0000000f00)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$SIOCX25GCAUSEDIAG(r1, 0x89e6, &(0x7f0000000940)) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000001600)={0x0, r1, 0x0, 0x0, 0x0, 0xffffffffffffffff}, 0x30) connect$ax25(r2, &(0x7f0000000040)={{0x3, @bcast, 0x4}, [@null, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x0}, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @bcast, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x0}, @null, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}]}, 0x48) ioctl$PPPIOCGUNIT(r1, 0x80047456, &(0x7f00000000c0)) [ 406.787931][T17441] bridge209: port 1(syz_tun) entered blocking state [ 406.794925][T17441] bridge209: port 1(syz_tun) entered disabled state [ 406.803470][T17441] device syz_tun entered promiscuous mode [ 406.811479][T17442] device erspan0 left promiscuous mode [ 406.817172][T17442] bridge208: port 2(erspan0) entered disabled state [ 406.829200][T17465] FAULT_INJECTION: forcing a failure. [ 406.829200][T17465] name failslab, interval 1, probability 0, space 0, times 0 [ 406.846764][T17465] CPU: 1 PID: 17465 Comm: syz-executor.2 Not tainted 5.5.0-rc5-syzkaller #0 [ 406.855538][T17465] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 406.865595][T17465] Call Trace: [ 406.868903][T17465] dump_stack+0x197/0x210 [ 406.873238][T17465] should_fail.cold+0xa/0x15 [ 406.877927][T17465] ? fault_create_debugfs_attr+0x180/0x180 [ 406.883804][T17465] __should_failslab+0x121/0x190 [ 406.888738][T17465] should_failslab+0x9/0x14 [ 406.893337][T17465] kmem_cache_alloc+0x47/0x710 [ 406.898206][T17465] ? lock_acquire+0x190/0x410 [ 406.902872][T17465] ? netlink_deliver_tap+0x146/0xbe0 [ 406.908164][T17465] skb_clone+0x154/0x3d0 [ 406.912412][T17465] netlink_deliver_tap+0x943/0xbe0 [ 406.917521][T17465] netlink_unicast+0x643/0x7d0 [ 406.922375][T17465] ? netlink_attachskb+0x870/0x870 [ 406.927482][T17465] ? __sanitizer_cov_trace_cmp8+0x18/0x20 [ 406.933329][T17465] ? __check_object_size+0x3d/0x437 [ 406.938531][T17465] netlink_sendmsg+0x91c/0xea0 [ 406.943295][T17465] ? netlink_unicast+0x7d0/0x7d0 [ 406.948240][T17465] ? aa_sock_msg_perm.isra.0+0xba/0x170 [ 406.953802][T17465] ? apparmor_socket_sendmsg+0x2a/0x30 [ 406.959269][T17465] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 406.965556][T17465] ? security_socket_sendmsg+0x8d/0xc0 [ 406.971008][T17465] ? netlink_unicast+0x7d0/0x7d0 [ 406.975946][T17465] sock_sendmsg+0xd7/0x130 [ 406.980360][T17465] ____sys_sendmsg+0x753/0x880 [ 406.985127][T17465] ? kernel_sendmsg+0x50/0x50 [ 406.989807][T17465] ? __fget+0x35d/0x550 [ 406.993998][T17465] ? find_held_lock+0x35/0x130 [ 406.998769][T17465] ___sys_sendmsg+0x100/0x170 [ 407.003553][T17465] ? sendmsg_copy_msghdr+0x70/0x70 [ 407.008676][T17465] ? __kasan_check_read+0x11/0x20 [ 407.013691][T17465] ? __fget+0x37f/0x550 [ 407.017843][T17465] ? ksys_dup3+0x3e0/0x3e0 [ 407.022250][T17465] ? __fget_light+0x1a9/0x230 [ 407.026925][T17465] ? __fdget+0x1b/0x20 [ 407.030987][T17465] ? __sanitizer_cov_trace_const_cmp8+0x18/0x20 [ 407.037224][T17465] __sys_sendmsg+0x105/0x1d0 [ 407.041814][T17465] ? __sys_sendmsg_sock+0xc0/0xc0 [ 407.046846][T17465] ? trace_hardirqs_on_thunk+0x1a/0x1c [ 407.052477][T17465] ? do_syscall_64+0x26/0x790 [ 407.057146][T17465] ? entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 407.063225][T17465] ? do_syscall_64+0x26/0x790 [ 407.067913][T17465] __x64_sys_sendmsg+0x78/0xb0 [ 407.072676][T17465] do_syscall_64+0xfa/0x790 [ 407.077170][T17465] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 407.083051][T17465] RIP: 0033:0x45af49 [ 407.086945][T17465] Code: ad b6 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 7b b6 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 407.106554][T17465] RSP: 002b:00007f44f4f31c78 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 407.114970][T17465] RAX: ffffffffffffffda RBX: 00007f44f4f31c90 RCX: 000000000045af49 [ 407.122929][T17465] RDX: 0000000000000000 RSI: 0000000020000000 RDI: 000000000000000d [ 407.130884][T17465] RBP: 000000000075c118 R08: 0000000000000000 R09: 0000000000000000 [ 407.138855][T17465] R10: 0000000000000000 R11: 0000000000000246 R12: 00007f44f4f326d4 [ 407.146825][T17465] R13: 00000000004caa0f R14: 00000000004e3eb0 R15: 000000000000000e 15:24:49 executing program 5: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000340)={'erspan0\x00', 0x0}) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000300)={'syz_tun\x00', 0x0}) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r7, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r6, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000380)=@newlink={0x34, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r8}, [@IFLA_LINKINFO={0x14, 0x12, @bridge={{0xb, 0x1, 'bridge\x00'}, {0x4}}}]}, 0x34}}, 0x0) sendmsg$nl_route(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000002700)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r5}, [@IFLA_MASTER={0x8, 0xa, r8}]}, 0x28}}, 0x0) sendmsg$nl_route(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f00000000c0)=ANY=[@ANYBLOB="2800000010000104000040000000000000001ea6", @ANYRES32=r2, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00\b\x00\n\x00', @ANYRES32=r8], 0x28}}, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r10 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r9, 0x8933, &(0x7f0000000300)={'syz_tun\x00', 0x0}) sendmsg$nl_route(r10, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000040)=@newlink={0x2c, 0x10, 0x0, 0x0, 0x0, {0x0, 0x0, 0x0, r11}, [@IFLA_BROADCAST={0xa}]}, 0x332}}, 0x0) [ 407.247871][T17442] bridge209: port 2(erspan0) entered blocking state [ 407.254856][T17442] bridge209: port 2(erspan0) entered disabled state [ 407.263229][T17442] device erspan0 entered promiscuous mode [ 407.277938][T17454] device syz_tun left promiscuous mode [ 407.289425][T17454] bridge221: port 1(syz_tun) entered disabled state 15:24:49 executing program 0: r0 = socket(0x21, 0xa, 0x1) r1 = socket(0x10, 0x80002, 0x0) ioctl(r1, 0x1000008912, &(0x7f00000001c0)="080db5055e0bcfe8696071") getsockopt$inet_sctp_SCTP_PEER_AUTH_CHUNKS(r1, 0x84, 0x1a, &(0x7f0000000940)=ANY=[@ANYRES32=0x0, @ANYBLOB='\x00'/12], &(0x7f0000000980)=0x10) getsockopt$inet_sctp_SCTP_GET_PEER_ADDR_INFO(r0, 0x84, 0xf, &(0x7f00000009c0)={r2, @in6={{0xa, 0x4e21, 0x8, @local, 0x401}}, 0x9, 0x1, 0x7, 0x7f, 0x6}, &(0x7f0000000a80)=0x98) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000400)='nl80211\x00') sendmsg$NL80211_CMD_GET_MESH_CONFIG(r0, &(0x7f0000000580)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x103190}, 0xc, &(0x7f0000000540)={&(0x7f0000000500)={0x34, r3, 0x10, 0x70bd2d, 0x25dfdbfe, {}, [@NL80211_ATTR_WDEV={0xc, 0x99, {0x1, 0xffffffffffffffff}}, @NL80211_ATTR_WIPHY={0x8, 0x1, 0x1}, @NL80211_ATTR_WDEV={0xc, 0x99, {0x3f, 0x3}}]}, 0x34}, 0x1, 0x0, 0x0, 0x800}, 0x40000) r4 = socket$nl_generic(0x10, 0x3, 0x10) bind$netlink(r4, &(0x7f0000000000)={0x10, 0x0, 0x25dfdbff, 0x1004280}, 0xffffffffffffffb3) sendmsg$nl_generic(r4, &(0x7f0000000080)={&(0x7f0000000480)={0x10, 0xbb7f}, 0xc, &(0x7f0000000440)={&(0x7f00000004c0)={0x1c, 0x0, 0x1, 0x0, 0x0, {0x4}, [@typed={0x8, 0xc}]}, 0x1c}}, 0x0) socket$netlink(0x10, 0x3, 0x0) r5 = socket$alg(0x26, 0x5, 0x0) bind$alg(r5, &(0x7f0000000080)={0x26, 'hash\x00', 0x0, 0x0, 'sha512\x00'}, 0x58) [ 407.400549][T17454] bridge222: port 1(syz_tun) entered blocking state [ 407.409920][T17454] bridge222: port 1(syz_tun) entered disabled state [ 407.423498][T17454] device syz_tun entered promiscuous mode [ 407.431813][T17461] device erspan0 left promiscuous mode [ 407.444259][T17461] bridge221: port 2(erspan0) entered disabled state [ 407.597934][T17461] bridge222: port 2(erspan0) entered blocking state [ 407.605900][T17461] bridge222: port 2(erspan0) entered disabled state [ 407.614239][T17461] device erspan0 entered promiscuous mode [ 407.624417][T17458] netlink: 72 bytes leftover after parsing attributes in process `syz-executor.1'. 15:24:49 executing program 2: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000340)={'erspan0\x00', 0x0}) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000300)={'syz_tun\x00', 0x0}) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r7, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r6, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000380)=@newlink={0x34, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r8}, [@IFLA_LINKINFO={0x14, 0x12, @bridge={{0xb, 0x1, 'bridge\x00'}, {0x4}}}]}, 0x34}}, 0x0) sendmsg$nl_route(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000002700)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r5}, [@IFLA_MASTER={0x8, 0xa, r8}]}, 0x28}}, 0x0) sendmsg$nl_route(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f00000000c0)=ANY=[@ANYBLOB="2800000010000104000040000000000000001ea6", @ANYRES32=r2, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00\b\x00\n\x00', @ANYRES32=r8], 0x28}}, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r10 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r9, 0x8933, &(0x7f0000000300)={'syz_tun\x00', 0x0}) sendmsg$nl_route(r10, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000040)=@newlink={0x2c, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r11}, [@IFLA_BROADCAST={0xa}]}, 0x332}}, 0x0) [ 407.639665][T17464] netlink: 72 bytes leftover after parsing attributes in process `syz-executor.1'. [ 407.660128][T17470] netlink: 'syz-executor.1': attribute type 274 has an invalid length. [ 407.676679][T17474] netlink: 'syz-executor.1': attribute type 274 has an invalid length. [ 407.714597][T17479] device syz_tun left promiscuous mode 15:24:49 executing program 0: r0 = socket(0x21, 0xa, 0x1) r1 = socket(0x10, 0x80002, 0x0) ioctl(r1, 0x1000008912, &(0x7f00000001c0)="080db5055e0bcfe8696071") getsockopt$inet_sctp_SCTP_PEER_AUTH_CHUNKS(r1, 0x84, 0x1a, &(0x7f0000000940)=ANY=[@ANYRES32=0x0, @ANYBLOB='\x00'/12], &(0x7f0000000980)=0x10) getsockopt$inet_sctp_SCTP_GET_PEER_ADDR_INFO(r0, 0x84, 0xf, &(0x7f00000009c0)={r2, @in6={{0xa, 0x4e21, 0x8, @local, 0x401}}, 0x9, 0x1, 0x7, 0x7f, 0x6}, &(0x7f0000000a80)=0x98) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000400)='nl80211\x00') sendmsg$NL80211_CMD_GET_MESH_CONFIG(r0, &(0x7f0000000580)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x103190}, 0xc, &(0x7f0000000540)={&(0x7f0000000500)={0x34, r3, 0x10, 0x70bd2d, 0x25dfdbfe, {}, [@NL80211_ATTR_WDEV={0xc, 0x99, {0x1, 0xffffffffffffffff}}, @NL80211_ATTR_WIPHY={0x8, 0x1, 0x1}, @NL80211_ATTR_WDEV={0xc, 0x99, {0x3f, 0x3}}]}, 0x34}, 0x1, 0x0, 0x0, 0x800}, 0x40000) r4 = socket$nl_generic(0x10, 0x3, 0x10) bind$netlink(r4, &(0x7f0000000000)={0x10, 0x0, 0x25dfdbff, 0x1004280}, 0xffffffffffffffb3) sendmsg$nl_generic(r4, &(0x7f0000000080)={&(0x7f0000000480)={0x10, 0xbb7f}, 0xc, &(0x7f0000000440)={&(0x7f00000004c0)={0x1c, 0x0, 0x1, 0x0, 0x0, {0x4}, [@typed={0x8, 0xc}]}, 0x1c}}, 0x0) socket$netlink(0x10, 0x3, 0x0) r5 = socket$alg(0x26, 0x5, 0x0) bind$alg(r5, &(0x7f0000000080)={0x26, 'hash\x00', 0x0, 0x0, 'sha512\x00'}, 0x58) 15:24:49 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, 0x0}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000540)=ANY=[@ANYBLOB="7400000024000705000000000000000000010000", @ANYRES32=r3, @ANYBLOB="00000000ffffffff000000000800010073667100486818973f73461919309b68e1693572bb000229c6090032d0ed64f3c3545aaf6e000085a4e4ebb5ef670000000000000000000000000000001a4e624d29a84abf03265700000000000000000000000000000000000000000000000000000000000000ac20000089b53c947244306a0216a3de887763df5b42498b13bb1938de859ee6d7ae7dd2224dc672b69b4358871b170ea0b667832e5224ee3538f885b7abd9bc4a7d"], 0x74}}, 0x0) r4 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r4, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000300)=ANY=[@ANYBLOB="840000002c00010700"/20, @ANYRES32=r3, @ANYBLOB="0008008000000000030000000800010075333200580002001400050000000000000000000000000000000000400006003c0001000000000000001020898dde66057433b6ef3a41d22be225e0001b0000000000000000000000000017256ffc66e43a2484e1a912c5998bcbf0d0000000000000000000000000000000798a3c067277da1a290b9613a33c575c36fad473382c8f5532ef3f0e1d2c450a7decbf3431a69f9b2ecb3291bed174245a962fe0484676958265e2988326a89db3139d91fe4aee6ae7e745ab00001a9f61f20500000000000000b3958bc14fce6e66a36d1ab3194534ba4e973684b27793bff837d3"], 0x84}}, 0x0) r5 = socket(0x10, 0x80002, 0x0) sendmmsg$alg(r5, &(0x7f0000000140), 0x49249249249278c, 0x0) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r6, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000500)=@newlink={0x20, 0x11, 0x40d, 0x0, 0x0, {0x0, 0x0, 0x0, r8}}, 0x20}}, 0x0) r9 = socket(0x10, 0x80002, 0x0) getsockopt$inet_sctp_SCTP_PEER_AUTH_CHUNKS(0xffffffffffffffff, 0x84, 0x1a, &(0x7f0000000940)=ANY=[@ANYRES32=0x0, @ANYBLOB='\x00'/12], &(0x7f0000000980)=0x10) r10 = socket(0xa, 0x6, 0x0) close(r10) r11 = socket$inet6_sctp(0xa, 0x10000000005, 0x84) setsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX(r11, 0x84, 0x6e, &(0x7f0000000180)=[@in6={0xa, 0x0, 0x0, @remote, 0x9}], 0x1c) getsockopt$inet_sctp6_SCTP_GET_ASSOC_ID_LIST(r11, 0x84, 0x1d, &(0x7f000095dff8)={0x1, [0x0]}, &(0x7f000095dffc)=0x8) setsockopt$inet_sctp_SCTP_RTOINFO(r10, 0x84, 0x0, &(0x7f0000000000)={r12, 0x0, 0x0, 0x1000000}, 0x10) setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(0xffffffffffffffff, 0x84, 0x9, &(0x7f0000000680)={r12, @in={{0x2, 0x4e20, @remote}}, 0x10001, 0xfff7, 0x5, 0x1, 0x8, 0x5, 0xba}, 0x9c) ioctl(r9, 0x1000008912, &(0x7f00000001c0)="080db5055e0bcfe8696071") getsockopt$inet_sctp_SCTP_PEER_AUTH_CHUNKS(r9, 0x84, 0x1a, &(0x7f0000000940)=ANY=[@ANYRES32=0x0, @ANYBLOB='\x00'/12], &(0x7f0000000980)=0x10) r13 = socket$nl_generic(0x10, 0x3, 0x10) r14 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080)='nl80211\x00') r15 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL80211_CMD_GET_STATION(r15, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000240)={0x1c, r14, 0xf2b, 0x0, 0x0, {}, [@NL80211_ATTR_AIRTIME_WEIGHT={0x8}]}, 0x1c}}, 0x0) sendmsg$NL80211_CMD_GET_MPATH(r13, &(0x7f00000001c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x2000}, 0x268, &(0x7f0000000080)={&(0x7f0000000200)={0x40, r14, 0x4, 0x70bd2d, 0x25dfdbff}, 0xff6b}, 0x1, 0x0, 0x0, 0x10049050}, 0x260448c0) sendmsg$NL80211_CMD_NEW_KEY(r9, &(0x7f0000000640)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0xb0024000}, 0xc, &(0x7f00000002c0)={&(0x7f0000000440)={0x7c, r14, 0x23, 0x70bd27, 0x25dfdbff, {}, [@NL80211_ATTR_KEY_DATA_WEP40={0x9, 0x7, "a80875ab12"}, @NL80211_ATTR_KEY={0x5c, 0x50, [@NL80211_KEY_DEFAULT_TYPES={0x14, 0x8, [@NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_MULTICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_MULTICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_MULTICAST={0x4}]}, @NL80211_KEY_DEFAULT_TYPES={0x28, 0x8, [@NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_MULTICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_MULTICAST={0x4}]}, @NL80211_KEY_IDX={0x5, 0x2, 0x5}, @NL80211_KEY_DATA_WEP104={0x11, 0x1, "4d84c4e30151cb27f51a4adf63"}]}]}, 0x7c}, 0x1, 0x0, 0x0, 0x24000}, 0x40) [ 407.763192][T17479] bridge209: port 1(syz_tun) entered disabled state 15:24:49 executing program 4: r0 = socket$inet6(0xa, 0x80003, 0x6b) ioctl(r0, 0x1000008912, &(0x7f00000001c0)="080db5055e0bcfe8476071") r1 = socket(0x10, 0x2, 0x0) sendto(r1, &(0x7f0000000200)="120000001200e7ef007b1a3fcd00000000a1", 0x12, 0x0, 0x0, 0x18) recvmmsg(r1, &(0x7f00000037c0)=[{{&(0x7f0000000600)=@ethernet={0x0, @random}, 0x80, &(0x7f0000000380)=[{&(0x7f0000000040)=""/95, 0x5f}, {&(0x7f00000000c0)=""/85, 0x55}, {&(0x7f00000024c0)=""/4096, 0x1000}, {&(0x7f0000000400)=""/120, 0x78}, {&(0x7f0000000480)=""/60, 0x3c}, {&(0x7f0000000280)=""/77, 0x4d}, {&(0x7f0000000540)=""/154, 0x9a}, {0x0}], 0x8, &(0x7f0000002400)=""/191, 0xbf}}], 0x1, 0x6, &(0x7f0000003700)={0x77359400}) [ 407.887959][T17479] bridge210: port 1(syz_tun) entered blocking state [ 407.894832][T17479] bridge210: port 1(syz_tun) entered disabled state [ 407.903369][T17479] device syz_tun entered promiscuous mode [ 407.918983][T17481] device erspan0 left promiscuous mode [ 407.930494][T17481] bridge209: port 2(erspan0) entered disabled state 15:24:50 executing program 5: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000340)={'erspan0\x00', 0x0}) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000300)={'syz_tun\x00', 0x0}) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r7, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r6, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000380)=@newlink={0x34, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r8}, [@IFLA_LINKINFO={0x14, 0x12, @bridge={{0xb, 0x1, 'bridge\x00'}, {0x4}}}]}, 0x34}}, 0x0) sendmsg$nl_route(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000002700)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r5}, [@IFLA_MASTER={0x8, 0xa, r8}]}, 0x28}}, 0x0) sendmsg$nl_route(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f00000000c0)=ANY=[@ANYBLOB="2800000010000104000040000000000000001ea6", @ANYRES32=r2, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00\b\x00\n\x00', @ANYRES32=r8], 0x28}}, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r10 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r9, 0x8933, &(0x7f0000000300)={'syz_tun\x00'}) sendmsg$nl_route(r10, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000040)=@newlink={0x2c, 0x10, 0x401, 0x0, 0x0, {}, [@IFLA_BROADCAST={0xa}]}, 0x332}}, 0x0) [ 408.077797][T17481] bridge210: port 2(erspan0) entered blocking state [ 408.084636][T17481] bridge210: port 2(erspan0) entered disabled state [ 408.093019][T17481] device erspan0 entered promiscuous mode [ 408.114397][T17490] device syz_tun left promiscuous mode [ 408.120299][T17490] bridge222: port 1(syz_tun) entered disabled state [ 408.218055][T17490] bridge223: port 1(syz_tun) entered blocking state [ 408.229092][T17490] bridge223: port 1(syz_tun) entered disabled state [ 408.236906][T17490] device syz_tun entered promiscuous mode [ 408.247555][T17496] device erspan0 left promiscuous mode 15:24:50 executing program 0: r0 = socket(0x21, 0xa, 0x1) r1 = socket(0x10, 0x80002, 0x0) ioctl(r1, 0x1000008912, &(0x7f00000001c0)="080db5055e0bcfe8696071") getsockopt$inet_sctp_SCTP_PEER_AUTH_CHUNKS(r1, 0x84, 0x1a, &(0x7f0000000940)=ANY=[@ANYRES32=0x0, @ANYBLOB='\x00'/12], &(0x7f0000000980)=0x10) getsockopt$inet_sctp_SCTP_GET_PEER_ADDR_INFO(r0, 0x84, 0xf, &(0x7f00000009c0)={r2, @in6={{0xa, 0x4e21, 0x8, @local, 0x401}}, 0x9, 0x1, 0x7, 0x7f, 0x6}, &(0x7f0000000a80)=0x98) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000400)='nl80211\x00') sendmsg$NL80211_CMD_GET_MESH_CONFIG(r0, &(0x7f0000000580)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x103190}, 0xc, &(0x7f0000000540)={&(0x7f0000000500)={0x34, r3, 0x10, 0x70bd2d, 0x25dfdbfe, {}, [@NL80211_ATTR_WDEV={0xc, 0x99, {0x1, 0xffffffffffffffff}}, @NL80211_ATTR_WIPHY={0x8, 0x1, 0x1}, @NL80211_ATTR_WDEV={0xc, 0x99, {0x3f, 0x3}}]}, 0x34}, 0x1, 0x0, 0x0, 0x800}, 0x40000) r4 = socket$nl_generic(0x10, 0x3, 0x10) bind$netlink(r4, &(0x7f0000000000)={0x10, 0x0, 0x25dfdbff, 0x1004280}, 0xffffffffffffffb3) sendmsg$nl_generic(r4, &(0x7f0000000080)={&(0x7f0000000480)={0x10, 0xbb7f}, 0xc, &(0x7f0000000440)={&(0x7f00000004c0)={0x1c, 0x0, 0x1, 0x0, 0x0, {0x4}, [@typed={0x8, 0xc}]}, 0x1c}}, 0x0) socket$netlink(0x10, 0x3, 0x0) r5 = socket$alg(0x26, 0x5, 0x0) bind$alg(r5, &(0x7f0000000080)={0x26, 'hash\x00', 0x0, 0x0, 'sha512\x00'}, 0x58) [ 408.262415][T17496] bridge222: port 2(erspan0) entered disabled state [ 408.407930][T17496] bridge223: port 2(erspan0) entered blocking state [ 408.414858][T17496] bridge223: port 2(erspan0) entered disabled state [ 408.424145][T17496] device erspan0 entered promiscuous mode [ 408.432626][T17495] netlink: 72 bytes leftover after parsing attributes in process `syz-executor.1'. [ 408.448168][T17499] netlink: 72 bytes leftover after parsing attributes in process `syz-executor.1'. 15:24:50 executing program 4: r0 = socket$inet6(0xa, 0x80003, 0x6b) ioctl(r0, 0x1000008912, &(0x7f00000001c0)="080db5055e0bcfe8476071") r1 = socket(0x10, 0x2, 0x0) sendto(r1, &(0x7f0000000200)="120000001200e7ef007b1a3fcd00000000a1", 0x12, 0x0, 0x0, 0x18) recvmmsg(r1, &(0x7f00000037c0)=[{{&(0x7f0000000600)=@ethernet={0x0, @random}, 0x80, &(0x7f0000000380)=[{&(0x7f0000000040)=""/95, 0x5f}, {&(0x7f00000000c0)=""/85, 0x55}, {&(0x7f00000024c0)=""/4096, 0x1000}, {&(0x7f0000000400)=""/120, 0x78}, {&(0x7f0000000480)=""/60, 0x3c}, {&(0x7f0000000280)=""/77, 0x4d}, {&(0x7f0000000340)=""/22, 0x16}], 0x7, &(0x7f0000002400)=""/191, 0xbf}}], 0x1, 0x6, &(0x7f0000003700)={0x77359400}) [ 408.464915][T17508] netlink: 'syz-executor.1': attribute type 274 has an invalid length. [ 408.494194][T17509] netlink: 'syz-executor.1': attribute type 274 has an invalid length. 15:24:50 executing program 2: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000340)={'erspan0\x00', 0x0}) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000300)={'syz_tun\x00', 0x0}) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r7, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r6, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000380)=@newlink={0x34, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r8}, [@IFLA_LINKINFO={0x14, 0x12, @bridge={{0xb, 0x1, 'bridge\x00'}, {0x4}}}]}, 0x34}}, 0x0) sendmsg$nl_route(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000002700)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r5}, [@IFLA_MASTER={0x8, 0xa, r8}]}, 0x28}}, 0x0) sendmsg$nl_route(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f00000000c0)=ANY=[@ANYBLOB="2800000010000104000040000000000000001ea6", @ANYRES32=r2, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00\b\x00\n\x00', @ANYRES32=r8], 0x28}}, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r10 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r9, 0x8933, &(0x7f0000000300)={'syz_tun\x00', 0x0}) sendmsg$nl_route(r10, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000040)=@newlink={0x2c, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r11}, [@IFLA_BROADCAST={0xa}]}, 0x332}}, 0x0) [ 408.540971][T17514] device syz_tun left promiscuous mode 15:24:50 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, 0x0}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000540)=ANY=[@ANYBLOB="7400000024000705000000000000000000010000", @ANYRES32=r3, @ANYBLOB="00000000ffffffff000000000800010073667100486818973f73461919309b68e1693572bb000229c6090032d0ed64f3c3545aaf6e000085a4e4ebb5ef670000000000000000000000000000001a4e624d29a84abf03265700000000000000000000000000000000000000000000000000000000000000ac20000089b53c947244306a0216a3de887763df5b42498b13bb1938de859ee6d7ae7dd2224dc672b69b4358871b170ea0b667832e5224ee3538f885b7abd9bc4a7d"], 0x74}}, 0x0) r4 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r4, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000300)=ANY=[@ANYBLOB="840000002c00010700"/20, @ANYRES32=r3, @ANYBLOB="0008008000000000030000000800010075333200580002001400050000000000000000000000000000000000400006003c0001000000000000001020898dde66057433b6ef3a41d22be225e0001b0000000000000000000000000017256ffc66e43a2484e1a912c5998bcbf0d0000000000000000000000000000000798a3c067277da1a290b9613a33c575c36fad473382c8f5532ef3f0e1d2c450a7decbf3431a69f9b2ecb3291bed174245a962fe0484676958265e2988326a89db3139d91fe4aee6ae7e745ab00001a9f61f20500000000000000b3958bc14fce6e66a36d1ab3194534ba4e973684b27793bff837d3"], 0x84}}, 0x0) r5 = socket(0x10, 0x80002, 0x0) sendmmsg$alg(r5, &(0x7f0000000140), 0x49249249249278c, 0x0) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r6, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000500)=@newlink={0x20, 0x11, 0x40d, 0x0, 0x0, {0x0, 0x0, 0x0, r8}}, 0x20}}, 0x0) r9 = socket(0x10, 0x80002, 0x0) getsockopt$inet_sctp_SCTP_PEER_AUTH_CHUNKS(0xffffffffffffffff, 0x84, 0x1a, &(0x7f0000000940)=ANY=[@ANYRES32=0x0, @ANYBLOB='\x00'/12], &(0x7f0000000980)=0x10) r10 = socket(0xa, 0x6, 0x0) close(r10) r11 = socket$inet6_sctp(0xa, 0x10000000005, 0x84) setsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX(r11, 0x84, 0x6e, &(0x7f0000000180)=[@in6={0xa, 0x0, 0x0, @remote, 0x9}], 0x1c) getsockopt$inet_sctp6_SCTP_GET_ASSOC_ID_LIST(r11, 0x84, 0x1d, &(0x7f000095dff8)={0x1, [0x0]}, &(0x7f000095dffc)=0x8) setsockopt$inet_sctp_SCTP_RTOINFO(r10, 0x84, 0x0, &(0x7f0000000000)={r12, 0x0, 0x0, 0x1000000}, 0x10) setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(0xffffffffffffffff, 0x84, 0x9, &(0x7f0000000680)={r12, @in={{0x2, 0x4e20, @remote}}, 0x10001, 0xfff7, 0x5, 0x1, 0x8, 0x5, 0xba}, 0x9c) ioctl(r9, 0x1000008912, &(0x7f00000001c0)="080db5055e0bcfe8696071") getsockopt$inet_sctp_SCTP_PEER_AUTH_CHUNKS(r9, 0x84, 0x1a, &(0x7f0000000940)=ANY=[@ANYRES32=0x0, @ANYBLOB='\x00'/12], &(0x7f0000000980)=0x10) r13 = socket$nl_generic(0x10, 0x3, 0x10) r14 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080)='nl80211\x00') r15 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL80211_CMD_GET_STATION(r15, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000240)={0x1c, r14, 0xf2b, 0x0, 0x0, {}, [@NL80211_ATTR_AIRTIME_WEIGHT={0x8}]}, 0x1c}}, 0x0) sendmsg$NL80211_CMD_GET_MPATH(r13, &(0x7f00000001c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x2000}, 0x268, &(0x7f0000000080)={&(0x7f0000000200)={0x40, r14, 0x4, 0x70bd2d, 0x25dfdbff}, 0xff6b}, 0x1, 0x0, 0x0, 0x10049050}, 0x260448c0) sendmsg$NL80211_CMD_NEW_KEY(r9, &(0x7f0000000640)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0xb0024000}, 0xc, &(0x7f00000002c0)={&(0x7f0000000440)={0x7c, r14, 0x23, 0x70bd27, 0x25dfdbff, {}, [@NL80211_ATTR_KEY_DATA_WEP40={0x9, 0x7, "a80875ab12"}, @NL80211_ATTR_KEY={0x5c, 0x50, [@NL80211_KEY_DEFAULT_TYPES={0x14, 0x8, [@NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_MULTICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_MULTICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_MULTICAST={0x4}]}, @NL80211_KEY_DEFAULT_TYPES={0x28, 0x8, [@NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_MULTICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_MULTICAST={0x4}]}, @NL80211_KEY_IDX={0x5, 0x2, 0x5}, @NL80211_KEY_DATA_WEP104={0x11, 0x1, "4d84c4e30151cb27f51a4adf63"}]}]}, 0x7c}, 0x1, 0x0, 0x0, 0x24000}, 0x40) [ 408.587900][T17514] bridge210: port 1(syz_tun) entered disabled state 15:24:50 executing program 3: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000340)={'erspan0\x00', 0x0}) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000300)={'syz_tun\x00', 0x0}) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r7, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r6, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000380)=@newlink={0x34, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r8}, [@IFLA_LINKINFO={0x14, 0x12, @bridge={{0xb, 0x1, 'bridge\x00'}, {0x4}}}]}, 0x34}}, 0x0) sendmsg$nl_route(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000002700)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r5}, [@IFLA_MASTER={0x8, 0xa, r8}]}, 0x28}}, 0x0) sendmsg$nl_route(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f00000000c0)=ANY=[@ANYBLOB="2800000010000104000040000000000000001ea6", @ANYRES32=r2, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00\b\x00\n\x00', @ANYRES32=r8], 0x28}}, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r10 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r9, 0x8933, &(0x7f0000000300)={'syz_tun\x00', 0x0}) sendmsg$nl_route(r10, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000040)=@newlink={0x2c, 0x10, 0x0, 0x0, 0x0, {0x0, 0x0, 0x0, r11}, [@IFLA_BROADCAST={0xa}]}, 0x332}}, 0x0) [ 408.697869][T17514] bridge211: port 1(syz_tun) entered blocking state [ 408.716634][T17514] bridge211: port 1(syz_tun) entered disabled state [ 408.745827][T17514] device syz_tun entered promiscuous mode [ 408.755281][T17515] device erspan0 left promiscuous mode [ 408.763787][T17515] bridge210: port 2(erspan0) entered disabled state [ 408.897936][T17515] bridge211: port 2(erspan0) entered blocking state [ 408.904892][T17515] bridge211: port 2(erspan0) entered disabled state [ 408.913501][T17515] device erspan0 entered promiscuous mode [ 408.931736][T17529] netlink: 72 bytes leftover after parsing attributes in process `syz-executor.1'. 15:24:51 executing program 5: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000340)={'erspan0\x00', 0x0}) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000300)={'syz_tun\x00', 0x0}) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r7, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r6, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000380)=@newlink={0x34, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r8}, [@IFLA_LINKINFO={0x14, 0x12, @bridge={{0xb, 0x1, 'bridge\x00'}, {0x4}}}]}, 0x34}}, 0x0) sendmsg$nl_route(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000002700)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r5}, [@IFLA_MASTER={0x8, 0xa, r8}]}, 0x28}}, 0x0) sendmsg$nl_route(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f00000000c0)=ANY=[@ANYBLOB="2800000010000104000040000000000000001ea6", @ANYRES32=r2, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00\b\x00\n\x00', @ANYRES32=r8], 0x28}}, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r10 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r9, 0x8933, &(0x7f0000000300)={'syz_tun\x00'}) sendmsg$nl_route(r10, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000040)=@newlink={0x2c, 0x10, 0x401, 0x0, 0x0, {}, [@IFLA_BROADCAST={0xa}]}, 0x332}}, 0x0) 15:24:51 executing program 0: r0 = socket(0x21, 0xa, 0x1) r1 = socket(0x10, 0x80002, 0x0) ioctl(r1, 0x1000008912, &(0x7f00000001c0)="080db5055e0bcfe8696071") getsockopt$inet_sctp_SCTP_PEER_AUTH_CHUNKS(r1, 0x84, 0x1a, &(0x7f0000000940)=ANY=[@ANYRES32=0x0, @ANYBLOB='\x00'/12], &(0x7f0000000980)=0x10) getsockopt$inet_sctp_SCTP_GET_PEER_ADDR_INFO(r0, 0x84, 0xf, &(0x7f00000009c0)={r2, @in6={{0xa, 0x4e21, 0x8, @local, 0x401}}, 0x9, 0x1, 0x7, 0x7f, 0x6}, &(0x7f0000000a80)=0x98) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000400)='nl80211\x00') sendmsg$NL80211_CMD_GET_MESH_CONFIG(r0, &(0x7f0000000580)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x103190}, 0xc, &(0x7f0000000540)={&(0x7f0000000500)={0x34, r3, 0x10, 0x70bd2d, 0x25dfdbfe, {}, [@NL80211_ATTR_WDEV={0xc, 0x99, {0x1, 0xffffffffffffffff}}, @NL80211_ATTR_WIPHY={0x8, 0x1, 0x1}, @NL80211_ATTR_WDEV={0xc, 0x99, {0x3f, 0x3}}]}, 0x34}, 0x1, 0x0, 0x0, 0x800}, 0x40000) r4 = socket$nl_generic(0x10, 0x3, 0x10) bind$netlink(r4, &(0x7f0000000000)={0x10, 0x0, 0x25dfdbff, 0x1004280}, 0xffffffffffffffb3) sendmsg$nl_generic(r4, &(0x7f0000000080)={&(0x7f0000000480)={0x10, 0xbb7f}, 0xc, &(0x7f0000000440)={&(0x7f00000004c0)={0x1c, 0x22, 0x0, 0x0, 0x0, {0x4}, [@typed={0x8, 0xc}]}, 0x1c}}, 0x0) socket$netlink(0x10, 0x3, 0x0) r5 = socket$alg(0x26, 0x5, 0x0) bind$alg(r5, &(0x7f0000000080)={0x26, 'hash\x00', 0x0, 0x0, 'sha512\x00'}, 0x58) [ 408.955295][T17531] device syz_tun left promiscuous mode [ 408.962992][T17531] bridge223: port 1(syz_tun) entered disabled state [ 409.128009][T17531] bridge224: port 1(syz_tun) entered blocking state [ 409.134887][T17531] bridge224: port 1(syz_tun) entered disabled state [ 409.143481][T17531] device syz_tun entered promiscuous mode [ 409.152344][T17532] netlink: 72 bytes leftover after parsing attributes in process `syz-executor.1'. [ 409.165645][T17536] device erspan0 left promiscuous mode [ 409.172681][T17536] bridge223: port 2(erspan0) entered disabled state [ 409.287977][T17536] bridge224: port 2(erspan0) entered blocking state [ 409.294875][T17536] bridge224: port 2(erspan0) entered disabled state [ 409.303307][T17536] device erspan0 entered promiscuous mode [ 409.324271][T17541] device syz_tun left promiscuous mode [ 409.331684][T17541] bridge73: port 1(syz_tun) entered disabled state [ 409.458680][T17541] bridge74: port 1(syz_tun) entered blocking state [ 409.465417][T17541] bridge74: port 1(syz_tun) entered disabled state [ 409.473422][T17541] device syz_tun entered promiscuous mode [ 409.481037][T17543] device erspan0 left promiscuous mode [ 409.486669][T17543] bridge73: port 2(erspan0) entered disabled state [ 409.608060][T17543] bridge74: port 2(erspan0) entered blocking state [ 409.614874][T17543] bridge74: port 2(erspan0) entered disabled state [ 409.623192][T17543] device erspan0 entered promiscuous mode [ 409.632730][T17544] netlink: 'syz-executor.1': attribute type 274 has an invalid length. 15:24:51 executing program 3: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000340)={'erspan0\x00', 0x0}) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000300)={'syz_tun\x00', 0x0}) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r7, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r6, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000380)=@newlink={0x34, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r8}, [@IFLA_LINKINFO={0x14, 0x12, @bridge={{0xb, 0x1, 'bridge\x00'}, {0x4}}}]}, 0x34}}, 0x0) sendmsg$nl_route(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000002700)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r5}, [@IFLA_MASTER={0x8, 0xa, r8}]}, 0x28}}, 0x0) sendmsg$nl_route(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f00000000c0)=ANY=[@ANYBLOB="2800000010000104000040000000000000001ea6", @ANYRES32=r2, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00\b\x00\n\x00', @ANYRES32=r8], 0x28}}, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r10 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r9, 0x8933, &(0x7f0000000300)={'syz_tun\x00', 0x0}) sendmsg$nl_route(r10, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000040)=@newlink={0x2c, 0x10, 0x0, 0x0, 0x0, {0x0, 0x0, 0x0, r11}, [@IFLA_BROADCAST={0xa}]}, 0x332}}, 0x0) 15:24:51 executing program 4: r0 = socket$inet6(0xa, 0x80003, 0x6b) ioctl(r0, 0x1000008912, &(0x7f00000001c0)="080db5055e0bcfe8476071") r1 = socket(0x10, 0x2, 0x0) sendto(r1, &(0x7f0000000200)="120000001200e7ef007b1a3fcd00000000a1", 0x12, 0x0, 0x0, 0x18) recvmmsg(r1, &(0x7f00000037c0)=[{{&(0x7f0000000600)=@ethernet={0x0, @random}, 0x80, &(0x7f0000000380)=[{&(0x7f0000000040)=""/95, 0x5f}, {&(0x7f00000000c0)=""/85, 0x55}, {&(0x7f00000024c0)=""/4096, 0x1000}, {&(0x7f0000000400)=""/120, 0x78}, {&(0x7f0000000480)=""/60, 0x3c}, {&(0x7f0000000280)=""/77, 0x4d}, {&(0x7f0000000340)=""/22, 0x16}], 0x7, &(0x7f0000002400)=""/191, 0xbf}}], 0x1, 0x6, &(0x7f0000003700)={0x77359400}) [ 409.657804][T17546] netlink: 'syz-executor.1': attribute type 274 has an invalid length. [ 409.684139][T17551] device syz_tun left promiscuous mode 15:24:51 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000540)=ANY=[@ANYBLOB="7400000024000705000000000000000000010000", @ANYRES32=r3, @ANYBLOB="00000000ffffffff000000000800010073667100486818973f73461919309b68e1693572bb000229c6090032d0ed64f3c3545aaf6e000085a4e4ebb5ef670000000000000000000000000000001a4e624d29a84abf03265700000000000000000000000000000000000000000000000000000000000000ac20000089b53c947244306a0216a3de887763df5b42498b13bb1938de859ee6d7ae7dd2224dc672b69b4358871b170ea0b667832e5224ee3538f885b7abd9bc4a7d"], 0x74}}, 0x0) r4 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r4, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000300)=ANY=[@ANYBLOB="840000002c00010700"/20, @ANYRES32=r3, @ANYBLOB="0008008000000000030000000800010075333200580002001400050000000000000000000000000000000000400006003c0001000000000000001020898dde66057433b6ef3a41d22be225e0001b0000000000000000000000000017256ffc66e43a2484e1a912c5998bcbf0d0000000000000000000000000000000798a3c067277da1a290b9613a33c575c36fad473382c8f5532ef3f0e1d2c450a7decbf3431a69f9b2ecb3291bed174245a962fe0484676958265e2988326a89db3139d91fe4aee6ae7e745ab00001a9f61f20500000000000000b3958bc14fce6e66a36d1ab3194534ba4e973684b27793bff837d3"], 0x84}}, 0x0) r5 = socket(0x10, 0x80002, 0x0) sendmmsg$alg(r5, &(0x7f0000000140), 0x49249249249278c, 0x0) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r6, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000500)=@newlink={0x20, 0x11, 0x40d, 0x0, 0x0, {0x0, 0x0, 0x0, r8}}, 0x20}}, 0x0) r9 = socket(0x10, 0x80002, 0x0) getsockopt$inet_sctp_SCTP_PEER_AUTH_CHUNKS(0xffffffffffffffff, 0x84, 0x1a, &(0x7f0000000940)=ANY=[@ANYRES32=0x0, @ANYBLOB='\x00'/12], &(0x7f0000000980)=0x10) r10 = socket(0xa, 0x6, 0x0) close(r10) r11 = socket$inet6_sctp(0xa, 0x10000000005, 0x84) setsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX(r11, 0x84, 0x6e, &(0x7f0000000180)=[@in6={0xa, 0x0, 0x0, @remote, 0x9}], 0x1c) getsockopt$inet_sctp6_SCTP_GET_ASSOC_ID_LIST(r11, 0x84, 0x1d, &(0x7f000095dff8)={0x1, [0x0]}, &(0x7f000095dffc)=0x8) setsockopt$inet_sctp_SCTP_RTOINFO(r10, 0x84, 0x0, &(0x7f0000000000)={r12, 0x0, 0x0, 0x1000000}, 0x10) setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(0xffffffffffffffff, 0x84, 0x9, &(0x7f0000000680)={r12, @in={{0x2, 0x4e20, @remote}}, 0x10001, 0xfff7, 0x5, 0x1, 0x8, 0x5, 0xba}, 0x9c) ioctl(r9, 0x1000008912, &(0x7f00000001c0)="080db5055e0bcfe8696071") getsockopt$inet_sctp_SCTP_PEER_AUTH_CHUNKS(r9, 0x84, 0x1a, &(0x7f0000000940)=ANY=[@ANYRES32=0x0, @ANYBLOB='\x00'/12], &(0x7f0000000980)=0x10) r13 = socket$nl_generic(0x10, 0x3, 0x10) r14 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080)='nl80211\x00') r15 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL80211_CMD_GET_STATION(r15, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000240)={0x1c, r14, 0xf2b, 0x0, 0x0, {}, [@NL80211_ATTR_AIRTIME_WEIGHT={0x8}]}, 0x1c}}, 0x0) sendmsg$NL80211_CMD_GET_MPATH(r13, &(0x7f00000001c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x2000}, 0x268, &(0x7f0000000080)={&(0x7f0000000200)={0x40, r14, 0x4, 0x70bd2d, 0x25dfdbff}, 0xff6b}, 0x1, 0x0, 0x0, 0x10049050}, 0x260448c0) sendmsg$NL80211_CMD_NEW_KEY(r9, &(0x7f0000000640)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0xb0024000}, 0xc, &(0x7f00000002c0)={&(0x7f0000000440)={0x7c, r14, 0x23, 0x70bd27, 0x25dfdbff, {}, [@NL80211_ATTR_KEY_DATA_WEP40={0x9, 0x7, "a80875ab12"}, @NL80211_ATTR_KEY={0x5c, 0x50, [@NL80211_KEY_DEFAULT_TYPES={0x14, 0x8, [@NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_MULTICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_MULTICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_MULTICAST={0x4}]}, @NL80211_KEY_DEFAULT_TYPES={0x28, 0x8, [@NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_MULTICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_MULTICAST={0x4}]}, @NL80211_KEY_IDX={0x5, 0x2, 0x5}, @NL80211_KEY_DATA_WEP104={0x11, 0x1, "4d84c4e30151cb27f51a4adf63"}]}]}, 0x7c}, 0x1, 0x0, 0x0, 0x24000}, 0x40) [ 409.713068][T17551] bridge211: port 1(syz_tun) entered disabled state 15:24:51 executing program 0: r0 = socket(0x21, 0xa, 0x1) r1 = socket(0x10, 0x80002, 0x0) ioctl(r1, 0x1000008912, &(0x7f00000001c0)="080db5055e0bcfe8696071") getsockopt$inet_sctp_SCTP_PEER_AUTH_CHUNKS(r1, 0x84, 0x1a, &(0x7f0000000940)=ANY=[@ANYRES32=0x0, @ANYBLOB='\x00'/12], &(0x7f0000000980)=0x10) getsockopt$inet_sctp_SCTP_GET_PEER_ADDR_INFO(r0, 0x84, 0xf, &(0x7f00000009c0)={r2, @in6={{0xa, 0x4e21, 0x8, @local, 0x401}}, 0x9, 0x1, 0x7, 0x7f, 0x6}, &(0x7f0000000a80)=0x98) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000400)='nl80211\x00') sendmsg$NL80211_CMD_GET_MESH_CONFIG(r0, &(0x7f0000000580)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x103190}, 0xc, &(0x7f0000000540)={&(0x7f0000000500)={0x34, r3, 0x10, 0x70bd2d, 0x25dfdbfe, {}, [@NL80211_ATTR_WDEV={0xc, 0x99, {0x1, 0xffffffffffffffff}}, @NL80211_ATTR_WIPHY={0x8, 0x1, 0x1}, @NL80211_ATTR_WDEV={0xc, 0x99, {0x3f, 0x3}}]}, 0x34}, 0x1, 0x0, 0x0, 0x800}, 0x40000) r4 = socket$nl_generic(0x10, 0x3, 0x10) bind$netlink(r4, &(0x7f0000000000)={0x10, 0x0, 0x25dfdbff, 0x1004280}, 0xffffffffffffffb3) sendmsg$nl_generic(r4, &(0x7f0000000080)={&(0x7f0000000480)={0x10, 0xbb7f}, 0xc, &(0x7f0000000440)={&(0x7f00000004c0)={0x1c, 0x22, 0x0, 0x0, 0x0, {0x4}, [@typed={0x8, 0xc}]}, 0x1c}}, 0x0) socket$netlink(0x10, 0x3, 0x0) r5 = socket$alg(0x26, 0x5, 0x0) bind$alg(r5, &(0x7f0000000080)={0x26, 'hash\x00', 0x0, 0x0, 'sha512\x00'}, 0x58) [ 409.847974][T17551] bridge212: port 1(syz_tun) entered blocking state [ 409.854812][T17551] bridge212: port 1(syz_tun) entered disabled state [ 409.865807][T17551] device syz_tun entered promiscuous mode [ 409.874581][T17554] device erspan0 left promiscuous mode [ 409.883331][T17554] bridge211: port 2(erspan0) entered disabled state [ 410.007842][T17554] bridge212: port 2(erspan0) entered blocking state [ 410.014591][T17554] bridge212: port 2(erspan0) entered disabled state [ 410.025899][T17554] device erspan0 entered promiscuous mode 15:24:52 executing program 5: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000340)={'erspan0\x00', 0x0}) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000300)={'syz_tun\x00', 0x0}) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r7, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r6, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000380)=@newlink={0x34, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r8}, [@IFLA_LINKINFO={0x14, 0x12, @bridge={{0xb, 0x1, 'bridge\x00'}, {0x4}}}]}, 0x34}}, 0x0) sendmsg$nl_route(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000002700)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r5}, [@IFLA_MASTER={0x8, 0xa, r8}]}, 0x28}}, 0x0) sendmsg$nl_route(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f00000000c0)=ANY=[@ANYBLOB="2800000010000104000040000000000000001ea6", @ANYRES32=r2, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00\b\x00\n\x00', @ANYRES32=r8], 0x28}}, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r10 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r9, 0x8933, &(0x7f0000000300)={'syz_tun\x00'}) sendmsg$nl_route(r10, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000040)=@newlink={0x2c, 0x10, 0x401, 0x0, 0x0, {}, [@IFLA_BROADCAST={0xa}]}, 0x332}}, 0x0) 15:24:52 executing program 2: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000340)={'erspan0\x00', 0x0}) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000300)={'syz_tun\x00', 0x0}) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r7, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r6, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000380)=@newlink={0x34, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r8}, [@IFLA_LINKINFO={0x14, 0x12, @bridge={{0xb, 0x1, 'bridge\x00'}, {0x4}}}]}, 0x34}}, 0x0) sendmsg$nl_route(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000002700)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r5}, [@IFLA_MASTER={0x8, 0xa, r8}]}, 0x28}}, 0x0) sendmsg$nl_route(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f00000000c0)=ANY=[@ANYBLOB="2800000010000104000040000000000000001ea6", @ANYRES32=r2, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00\b\x00\n\x00', @ANYRES32=r8], 0x28}}, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r10 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r9, 0x8933, &(0x7f0000000300)={'syz_tun\x00', 0x0}) sendmsg$nl_route(r10, &(0x7f0000000000)={0x0, 0x2, &(0x7f00000000c0)={&(0x7f0000000040)=@newlink={0x2c, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r11}, [@IFLA_BROADCAST={0xa}]}, 0x332}}, 0x0) [ 410.053250][T17567] device syz_tun left promiscuous mode [ 410.064749][T17567] bridge74: port 1(syz_tun) entered disabled state [ 410.247915][T17567] bridge75: port 1(syz_tun) entered blocking state [ 410.256935][T17567] bridge75: port 1(syz_tun) entered disabled state [ 410.267819][T17567] device syz_tun entered promiscuous mode [ 410.289168][T17568] __nla_validate_parse: 1 callbacks suppressed [ 410.289180][T17568] netlink: 72 bytes leftover after parsing attributes in process `syz-executor.1'. [ 410.306432][T17571] device erspan0 left promiscuous mode [ 410.312804][T17571] bridge74: port 2(erspan0) entered disabled state [ 410.447744][T17571] bridge75: port 2(erspan0) entered blocking state [ 410.454553][T17571] bridge75: port 2(erspan0) entered disabled state [ 410.463287][T17571] device erspan0 entered promiscuous mode [ 410.472546][T17565] netlink: 'syz-executor.1': attribute type 274 has an invalid length. 15:24:52 executing program 4: r0 = socket$inet6(0xa, 0x80003, 0x6b) ioctl(r0, 0x1000008912, &(0x7f00000001c0)="080db5055e0bcfe8476071") r1 = socket(0x10, 0x2, 0x0) sendto(r1, &(0x7f0000000200)="120000001200e7ef007b1a3fcd00000000a1", 0x12, 0x0, 0x0, 0x18) recvmmsg(r1, &(0x7f00000037c0)=[{{&(0x7f0000000600)=@ethernet={0x0, @random}, 0x80, &(0x7f0000000380)=[{&(0x7f0000000040)=""/95, 0x5f}, {&(0x7f00000000c0)=""/85, 0x55}, {&(0x7f00000024c0)=""/4096, 0x1000}, {&(0x7f0000000400)=""/120, 0x78}, {&(0x7f0000000480)=""/60, 0x3c}, {&(0x7f0000000280)=""/77, 0x4d}, {&(0x7f0000000340)=""/22, 0x16}], 0x7, &(0x7f0000002400)=""/191, 0xbf}}], 0x1, 0x6, &(0x7f0000003700)={0x77359400}) 15:24:52 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000140)={0x0, 0xfffffe96, &(0x7f0000000200)={&(0x7f0000000000)=ANY=[@ANYBLOB="4c0000001000e20d000000000000000600000000", @ANYRES32=0x0, @ANYBLOB="000000000400000000000000", @ANYRES32=0x0, @ANYBLOB="08001b000000000080ff1c00", @ANYRES32, @ANYBLOB="14000300766c616e3000"/20], 0x4c}, 0x1, 0x0, 0x0, 0x40004}, 0x0) r1 = accept(0xffffffffffffffff, 0x0, &(0x7f0000001b00)) getsockopt$PNPIPE_IFINDEX(0xffffffffffffffff, 0x113, 0x2, &(0x7f0000001b40)=0x0, &(0x7f0000001b80)=0x4) bind$can_j1939(r1, &(0x7f0000001bc0)={0x1d, r2, 0x1, {0x1, 0x0, 0x2}, 0xfd}, 0x18) r3 = socket(0x10, 0x80002, 0x0) ioctl(r3, 0x1000008912, &(0x7f00000001c0)="080db5055e0bcfe8696071") getsockopt$inet_sctp_SCTP_PEER_AUTH_CHUNKS(r3, 0x84, 0x1a, &(0x7f0000000940)=ANY=[@ANYRES32=0x0, @ANYBLOB='\x00'/12], &(0x7f0000000980)=0x10) shutdown(r3, 0x0) 15:24:52 executing program 0: r0 = socket(0x21, 0xa, 0x1) r1 = socket(0x10, 0x80002, 0x0) ioctl(r1, 0x1000008912, &(0x7f00000001c0)="080db5055e0bcfe8696071") getsockopt$inet_sctp_SCTP_PEER_AUTH_CHUNKS(r1, 0x84, 0x1a, &(0x7f0000000940)=ANY=[@ANYRES32=0x0, @ANYBLOB='\x00'/12], &(0x7f0000000980)=0x10) getsockopt$inet_sctp_SCTP_GET_PEER_ADDR_INFO(r0, 0x84, 0xf, &(0x7f00000009c0)={r2, @in6={{0xa, 0x4e21, 0x8, @local, 0x401}}, 0x9, 0x1, 0x7, 0x7f, 0x6}, &(0x7f0000000a80)=0x98) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000400)='nl80211\x00') sendmsg$NL80211_CMD_GET_MESH_CONFIG(r0, &(0x7f0000000580)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x103190}, 0xc, &(0x7f0000000540)={&(0x7f0000000500)={0x34, r3, 0x10, 0x70bd2d, 0x25dfdbfe, {}, [@NL80211_ATTR_WDEV={0xc, 0x99, {0x1, 0xffffffffffffffff}}, @NL80211_ATTR_WIPHY={0x8, 0x1, 0x1}, @NL80211_ATTR_WDEV={0xc, 0x99, {0x3f, 0x3}}]}, 0x34}, 0x1, 0x0, 0x0, 0x800}, 0x40000) r4 = socket$nl_generic(0x10, 0x3, 0x10) bind$netlink(r4, &(0x7f0000000000)={0x10, 0x0, 0x25dfdbff, 0x1004280}, 0xffffffffffffffb3) sendmsg$nl_generic(r4, &(0x7f0000000080)={&(0x7f0000000480)={0x10, 0xbb7f}, 0xc, &(0x7f0000000440)={&(0x7f00000004c0)={0x1c, 0x22, 0x0, 0x0, 0x0, {0x4}, [@typed={0x8, 0xc}]}, 0x1c}}, 0x0) socket$netlink(0x10, 0x3, 0x0) r5 = socket$alg(0x26, 0x5, 0x0) bind$alg(r5, &(0x7f0000000080)={0x26, 'hash\x00', 0x0, 0x0, 'sha512\x00'}, 0x58) [ 410.506195][T17582] netlink: 'syz-executor.1': attribute type 274 has an invalid length. [ 410.541563][T17587] device syz_tun left promiscuous mode [ 410.547510][T17587] bridge224: port 1(syz_tun) entered disabled state 15:24:52 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000540)=ANY=[@ANYBLOB="7400000024000705000000000000000000010000", @ANYRES32=r3, @ANYBLOB="00000000ffffffff000000000800010073667100486818973f73461919309b68e1693572bb000229c6090032d0ed64f3c3545aaf6e000085a4e4ebb5ef670000000000000000000000000000001a4e624d29a84abf03265700000000000000000000000000000000000000000000000000000000000000ac20000089b53c947244306a0216a3de887763df5b42498b13bb1938de859ee6d7ae7dd2224dc672b69b4358871b170ea0b667832e5224ee3538f885b7abd9bc4a7d"], 0x74}}, 0x0) r4 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r4, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000300)=ANY=[@ANYBLOB="840000002c00010700"/20, @ANYRES32=r3, @ANYBLOB="0008008000000000030000000800010075333200580002001400050000000000000000000000000000000000400006003c0001000000000000001020898dde66057433b6ef3a41d22be225e0001b0000000000000000000000000017256ffc66e43a2484e1a912c5998bcbf0d0000000000000000000000000000000798a3c067277da1a290b9613a33c575c36fad473382c8f5532ef3f0e1d2c450a7decbf3431a69f9b2ecb3291bed174245a962fe0484676958265e2988326a89db3139d91fe4aee6ae7e745ab00001a9f61f20500000000000000b3958bc14fce6e66a36d1ab3194534ba4e973684b27793bff837d3"], 0x84}}, 0x0) r5 = socket(0x10, 0x80002, 0x0) sendmmsg$alg(r5, &(0x7f0000000140), 0x49249249249278c, 0x0) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r6, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000500)=@newlink={0x20, 0x11, 0x40d, 0x0, 0x0, {0x0, 0x0, 0x0, r8}}, 0x20}}, 0x0) r9 = socket(0x10, 0x80002, 0x0) getsockopt$inet_sctp_SCTP_PEER_AUTH_CHUNKS(0xffffffffffffffff, 0x84, 0x1a, &(0x7f0000000940)=ANY=[@ANYRES32=0x0, @ANYBLOB='\x00'/12], &(0x7f0000000980)=0x10) r10 = socket(0xa, 0x6, 0x0) close(r10) r11 = socket$inet6_sctp(0xa, 0x10000000005, 0x84) setsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX(r11, 0x84, 0x6e, &(0x7f0000000180)=[@in6={0xa, 0x0, 0x0, @remote, 0x9}], 0x1c) getsockopt$inet_sctp6_SCTP_GET_ASSOC_ID_LIST(r11, 0x84, 0x1d, &(0x7f000095dff8)={0x1, [0x0]}, &(0x7f000095dffc)=0x8) setsockopt$inet_sctp_SCTP_RTOINFO(r10, 0x84, 0x0, &(0x7f0000000000)={r12, 0x0, 0x0, 0x1000000}, 0x10) setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(0xffffffffffffffff, 0x84, 0x9, &(0x7f0000000680)={r12, @in={{0x2, 0x4e20, @remote}}, 0x10001, 0xfff7, 0x5, 0x1, 0x8, 0x5, 0xba}, 0x9c) ioctl(r9, 0x1000008912, &(0x7f00000001c0)="080db5055e0bcfe8696071") getsockopt$inet_sctp_SCTP_PEER_AUTH_CHUNKS(r9, 0x84, 0x1a, &(0x7f0000000940)=ANY=[@ANYRES32=0x0, @ANYBLOB='\x00'/12], &(0x7f0000000980)=0x10) r13 = socket$nl_generic(0x10, 0x3, 0x10) r14 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080)='nl80211\x00') r15 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL80211_CMD_GET_STATION(r15, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000240)={0x1c, r14, 0xf2b, 0x0, 0x0, {}, [@NL80211_ATTR_AIRTIME_WEIGHT={0x8}]}, 0x1c}}, 0x0) sendmsg$NL80211_CMD_GET_MPATH(r13, &(0x7f00000001c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x2000}, 0x268, &(0x7f0000000080)={&(0x7f0000000200)={0x40, r14, 0x4, 0x70bd2d, 0x25dfdbff}, 0xff6b}, 0x1, 0x0, 0x0, 0x10049050}, 0x260448c0) sendmsg$NL80211_CMD_NEW_KEY(r9, &(0x7f0000000640)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0xb0024000}, 0xc, &(0x7f00000002c0)={&(0x7f0000000440)={0x7c, r14, 0x23, 0x70bd27, 0x25dfdbff, {}, [@NL80211_ATTR_KEY_DATA_WEP40={0x9, 0x7, "a80875ab12"}, @NL80211_ATTR_KEY={0x5c, 0x50, [@NL80211_KEY_DEFAULT_TYPES={0x14, 0x8, [@NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_MULTICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_MULTICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_MULTICAST={0x4}]}, @NL80211_KEY_DEFAULT_TYPES={0x28, 0x8, [@NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_MULTICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_MULTICAST={0x4}]}, @NL80211_KEY_IDX={0x5, 0x2, 0x5}, @NL80211_KEY_DATA_WEP104={0x11, 0x1, "4d84c4e30151cb27f51a4adf63"}]}]}, 0x7c}, 0x1, 0x0, 0x0, 0x24000}, 0x40) [ 410.757822][T17587] bridge225: port 1(syz_tun) entered blocking state [ 410.768055][T17587] bridge225: port 1(syz_tun) entered disabled state [ 410.807869][T17587] device syz_tun entered promiscuous mode [ 410.838662][T17588] device syz_tun left promiscuous mode [ 410.844358][T17588] bridge212: port 1(syz_tun) entered disabled state [ 410.989910][T17588] bridge213: port 1(syz_tun) entered blocking state [ 410.996592][T17588] bridge213: port 1(syz_tun) entered disabled state [ 411.032787][T17588] device syz_tun entered promiscuous mode [ 411.057281][T17589] device erspan0 left promiscuous mode [ 411.065901][T17589] bridge224: port 2(erspan0) entered disabled state [ 411.197865][T17589] bridge225: port 2(erspan0) entered blocking state [ 411.204677][T17589] bridge225: port 2(erspan0) entered disabled state [ 411.213047][T17589] device erspan0 entered promiscuous mode [ 411.221789][T17590] device erspan0 left promiscuous mode [ 411.227832][T17590] bridge212: port 2(erspan0) entered disabled state [ 411.357841][T17590] bridge213: port 2(erspan0) entered blocking state [ 411.364667][T17590] bridge213: port 2(erspan0) entered disabled state [ 411.372957][T17590] device erspan0 entered promiscuous mode [ 411.393168][T17608] netlink: 72 bytes leftover after parsing attributes in process `syz-executor.1'. 15:24:53 executing program 4: r0 = socket$inet6(0xa, 0x80003, 0x6b) ioctl(r0, 0x1000008912, &(0x7f00000001c0)="080db5055e0bcfe8476071") r1 = socket(0x10, 0x2, 0x0) sendto(r1, &(0x7f0000000200)="120000001200e7ef007b1a3fcd00000000a1", 0x12, 0x0, 0x0, 0x18) recvmmsg(r1, &(0x7f00000037c0)=[{{&(0x7f0000000600)=@ethernet={0x0, @random}, 0x80, &(0x7f0000000380)=[{&(0x7f0000000040)=""/95, 0x5f}, {&(0x7f00000000c0)=""/85, 0x55}, {&(0x7f00000024c0)=""/4096, 0x1000}, {&(0x7f0000000400)=""/120, 0x78}, {&(0x7f0000000480)=""/60, 0x3c}, {&(0x7f0000000280)=""/77, 0x4d}, {0x0}, {&(0x7f0000000340)=""/22, 0x16}], 0x8, &(0x7f0000002400)=""/191, 0xbf}}], 0x1, 0x6, &(0x7f0000003700)={0x77359400}) 15:24:53 executing program 3: r0 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ppp\x00', 0x0, 0x0) ioctl$PPPIOCNEWUNIT(r0, 0xc004743e, &(0x7f0000000100)) r1 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$SO_TIMESTAMP(r1, 0x1, 0x0, &(0x7f0000000380)=0x8, 0x4) r2 = openat$ppp(0xffffffffffffff9c, &(0x7f0000002340)='/dev/ppp\x00', 0x0, 0x0) r3 = socket(0x21, 0xa, 0x1) r4 = socket(0x10, 0x80002, 0x0) ioctl(r4, 0x1000008912, &(0x7f00000001c0)="080db5055e0bcfe8696071") getsockopt$inet_sctp_SCTP_PEER_AUTH_CHUNKS(r4, 0x84, 0x1a, &(0x7f0000000940)=ANY=[@ANYRES32=0x0, @ANYBLOB='\x00'/12], &(0x7f0000000980)=0x10) getsockopt$inet_sctp_SCTP_GET_PEER_ADDR_INFO(r3, 0x84, 0xf, &(0x7f00000009c0)={r5, @in6={{0xa, 0x4e21, 0x8, @local, 0x401}}, 0x9, 0x1, 0x7, 0x7f, 0x6}, &(0x7f0000000a80)=0x98) r7 = syz_genetlink_get_family_id$netlbl_cipso(&(0x7f0000000140)='NLBL_CIPSOv4\x00') sendmsg$NLBL_CIPSOV4_C_ADD(r3, &(0x7f0000000240)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x20}, 0xc, &(0x7f0000000200)={&(0x7f0000000180)={0x2c, r7, 0x2, 0x70bd29, 0x25dfdbfe, {}, [@NLBL_CIPSOV4_A_DOI={0x8}, @NLBL_CIPSOV4_A_DOI={0x8, 0x1, 0x3}, @NLBL_CIPSOV4_A_DOI={0x8, 0x1, 0x2}]}, 0x2c}}, 0x4040010) getsockopt$inet_sctp_SCTP_PEER_AUTH_CHUNKS(r3, 0x84, 0x1a, &(0x7f0000000280)={r6, 0xb2, "6b096874ef5975ffd2a48d8c540f1fe7986d1e9ab99c97a3b41dfb853412d0bdd47cee047d35ee1e9b3b2d734b148d4f6d0b8897116cf261a23458be3d98ecb50ccdb1381b4e17e9c911bb462c1206d1e11ede92f4f2899496d6fb692df12bbdb10c6e78fa9b26376f16994cf6029542d89a0b1b47e44675bd96e1d1031237ce613b3cf39a94009971f9582f3403531fd361a53549b3b5a2068598112c0d55688d9ac528572a704e4e54606260c13a96bcd6"}, &(0x7f0000000340)=0xba) ioctl$PPPIOCATTACH(r2, 0x4004743d, &(0x7f0000002380)) r8 = socket(0x25, 0x0, 0x0) ioctl(r8, 0x1000008912, &(0x7f00000001c0)="080db5055e0bcfe8696071") getsockopt$inet_sctp_SCTP_PEER_AUTH_CHUNKS(r8, 0x84, 0x1a, &(0x7f0000000940)=ANY=[@ANYRES32=0x0, @ANYBLOB='\x00'/12], &(0x7f0000000980)=0x10) setsockopt$bt_BT_POWER(r8, 0x112, 0x9, &(0x7f0000000040)=0x6, 0x1) close(r2) ioctl$SIOCGSTAMPNS(r8, 0x8907, &(0x7f0000000080)) 15:24:53 executing program 5: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000340)={'erspan0\x00', 0x0}) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000300)={'syz_tun\x00', 0x0}) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r7, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r6, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000380)=@newlink={0x34, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r8}, [@IFLA_LINKINFO={0x14, 0x12, @bridge={{0xb, 0x1, 'bridge\x00'}, {0x4}}}]}, 0x34}}, 0x0) sendmsg$nl_route(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000002700)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r5}, [@IFLA_MASTER={0x8, 0xa, r8}]}, 0x28}}, 0x0) sendmsg$nl_route(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f00000000c0)=ANY=[@ANYBLOB="2800000010000104000040000000000000001ea6", @ANYRES32=r2, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00\b\x00\n\x00', @ANYRES32=r8], 0x28}}, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r10 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r9, 0x8933, &(0x7f0000000300)={'syz_tun\x00', 0x0}) sendmsg$nl_route(r10, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000040)=@newlink={0x20, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r11}}, 0x20}}, 0x0) 15:24:53 executing program 0: r0 = socket(0x21, 0xa, 0x1) r1 = socket(0x10, 0x80002, 0x0) ioctl(r1, 0x1000008912, &(0x7f00000001c0)="080db5055e0bcfe8696071") getsockopt$inet_sctp_SCTP_PEER_AUTH_CHUNKS(r1, 0x84, 0x1a, &(0x7f0000000940)=ANY=[@ANYRES32=0x0, @ANYBLOB='\x00'/12], &(0x7f0000000980)=0x10) getsockopt$inet_sctp_SCTP_GET_PEER_ADDR_INFO(r0, 0x84, 0xf, &(0x7f00000009c0)={r2, @in6={{0xa, 0x4e21, 0x8, @local, 0x401}}, 0x9, 0x1, 0x7, 0x7f, 0x6}, &(0x7f0000000a80)=0x98) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000400)='nl80211\x00') sendmsg$NL80211_CMD_GET_MESH_CONFIG(r0, &(0x7f0000000580)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x103190}, 0xc, &(0x7f0000000540)={&(0x7f0000000500)={0x34, r3, 0x10, 0x70bd2d, 0x25dfdbfe, {}, [@NL80211_ATTR_WDEV={0xc, 0x99, {0x1, 0xffffffffffffffff}}, @NL80211_ATTR_WIPHY={0x8, 0x1, 0x1}, @NL80211_ATTR_WDEV={0xc, 0x99, {0x3f, 0x3}}]}, 0x34}, 0x1, 0x0, 0x0, 0x800}, 0x40000) r4 = socket$nl_generic(0x10, 0x3, 0x10) bind$netlink(r4, &(0x7f0000000000)={0x10, 0x0, 0x25dfdbff, 0x1004280}, 0xffffffffffffffb3) sendmsg$nl_generic(r4, &(0x7f0000000080)={&(0x7f0000000480)={0x10, 0xbb7f}, 0xc, &(0x7f0000000440)={&(0x7f00000004c0)={0x1c, 0x22, 0x1, 0x0, 0x0, {}, [@typed={0x8, 0xc}]}, 0x1c}}, 0x0) socket$netlink(0x10, 0x3, 0x0) r5 = socket$alg(0x26, 0x5, 0x0) bind$alg(r5, &(0x7f0000000080)={0x26, 'hash\x00', 0x0, 0x0, 'sha512\x00'}, 0x58) [ 411.418245][T17609] netlink: 72 bytes leftover after parsing attributes in process `syz-executor.1'. [ 411.498199][T17587] device erspan0 left promiscuous mode [ 411.503882][T17587] bridge225: port 2(erspan0) entered disabled state 15:24:53 executing program 2: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000340)={'erspan0\x00', 0x0}) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000300)={'syz_tun\x00', 0x0}) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r7, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r6, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000380)=@newlink={0x34, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r8}, [@IFLA_LINKINFO={0x14, 0x12, @bridge={{0xb, 0x1, 'bridge\x00'}, {0x4}}}]}, 0x34}}, 0x0) sendmsg$nl_route(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000002700)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r5}, [@IFLA_MASTER={0x8, 0xa, r8}]}, 0x28}}, 0x0) sendmsg$nl_route(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f00000000c0)=ANY=[@ANYBLOB="2800000010000104000040000000000000001ea6", @ANYRES32=r2, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00\b\x00\n\x00', @ANYRES32=r8], 0x28}}, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r10 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r9, 0x8933, &(0x7f0000000300)={'syz_tun\x00', 0x0}) sendmsg$nl_route(r10, &(0x7f0000000000)={0x0, 0x3, &(0x7f00000000c0)={&(0x7f0000000040)=@newlink={0x2c, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r11}, [@IFLA_BROADCAST={0xa}]}, 0x332}}, 0x0) [ 411.687756][T17614] netlink: 'syz-executor.1': attribute type 274 has an invalid length. [ 411.696112][T17615] netlink: 'syz-executor.1': attribute type 274 has an invalid length. 15:24:53 executing program 0: r0 = socket(0x21, 0xa, 0x1) r1 = socket(0x10, 0x80002, 0x0) ioctl(r1, 0x1000008912, &(0x7f00000001c0)="080db5055e0bcfe8696071") getsockopt$inet_sctp_SCTP_PEER_AUTH_CHUNKS(r1, 0x84, 0x1a, &(0x7f0000000940)=ANY=[@ANYRES32=0x0, @ANYBLOB='\x00'/12], &(0x7f0000000980)=0x10) getsockopt$inet_sctp_SCTP_GET_PEER_ADDR_INFO(r0, 0x84, 0xf, &(0x7f00000009c0)={r2, @in6={{0xa, 0x4e21, 0x8, @local, 0x401}}, 0x9, 0x1, 0x7, 0x7f, 0x6}, &(0x7f0000000a80)=0x98) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000400)='nl80211\x00') sendmsg$NL80211_CMD_GET_MESH_CONFIG(r0, &(0x7f0000000580)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x103190}, 0xc, &(0x7f0000000540)={&(0x7f0000000500)={0x34, r3, 0x10, 0x70bd2d, 0x25dfdbfe, {}, [@NL80211_ATTR_WDEV={0xc, 0x99, {0x1, 0xffffffffffffffff}}, @NL80211_ATTR_WIPHY={0x8, 0x1, 0x1}, @NL80211_ATTR_WDEV={0xc, 0x99, {0x3f, 0x3}}]}, 0x34}, 0x1, 0x0, 0x0, 0x800}, 0x40000) r4 = socket$nl_generic(0x10, 0x3, 0x10) bind$netlink(r4, &(0x7f0000000000)={0x10, 0x0, 0x25dfdbff, 0x1004280}, 0xffffffffffffffb3) sendmsg$nl_generic(r4, &(0x7f0000000080)={&(0x7f0000000480)={0x10, 0xbb7f}, 0xc, &(0x7f0000000440)={&(0x7f00000004c0)={0x1c, 0x22, 0x1, 0x0, 0x0, {}, [@typed={0x8, 0xc}]}, 0x1c}}, 0x0) socket$netlink(0x10, 0x3, 0x0) r5 = socket$alg(0x26, 0x5, 0x0) bind$alg(r5, &(0x7f0000000080)={0x26, 'hash\x00', 0x0, 0x0, 'sha512\x00'}, 0x58) 15:24:53 executing program 4: r0 = socket$inet6(0xa, 0x80003, 0x6b) ioctl(r0, 0x1000008912, &(0x7f00000001c0)="080db5055e0bcfe8476071") r1 = socket(0x10, 0x2, 0x0) sendto(r1, &(0x7f0000000200)="120000001200e7ef007b1a3fcd00000000a1", 0x12, 0x0, 0x0, 0x18) recvmmsg(r1, &(0x7f00000037c0)=[{{&(0x7f0000000600)=@ethernet={0x0, @random}, 0x80, &(0x7f0000000380)=[{&(0x7f0000000040)=""/95, 0x5f}, {&(0x7f00000000c0)=""/85, 0x55}, {&(0x7f00000024c0)=""/4096, 0x1000}, {&(0x7f0000000400)=""/120, 0x78}, {&(0x7f0000000480)=""/60, 0x3c}, {&(0x7f0000000280)=""/77, 0x4d}, {0x0}, {&(0x7f0000000340)=""/22, 0x16}], 0x8, &(0x7f0000002400)=""/191, 0xbf}}], 0x1, 0x6, &(0x7f0000003700)={0x77359400}) 15:24:53 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000540)=ANY=[@ANYBLOB="7400000024000705000000000000000000010000", @ANYRES32=r3, @ANYBLOB="00000000ffffffff000000000800010073667100486818973f73461919309b68e1693572bb000229c6090032d0ed64f3c3545aaf6e000085a4e4ebb5ef670000000000000000000000000000001a4e624d29a84abf03265700000000000000000000000000000000000000000000000000000000000000ac20000089b53c947244306a0216a3de887763df5b42498b13bb1938de859ee6d7ae7dd2224dc672b69b4358871b170ea0b667832e5224ee3538f885b7abd9bc4a7d"], 0x74}}, 0x0) r4 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r4, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000300)=ANY=[@ANYBLOB="840000002c00010700"/20, @ANYRES32=r3, @ANYBLOB="0008008000000000030000000800010075333200580002001400050000000000000000000000000000000000400006003c0001000000000000001020898dde66057433b6ef3a41d22be225e0001b0000000000000000000000000017256ffc66e43a2484e1a912c5998bcbf0d0000000000000000000000000000000798a3c067277da1a290b9613a33c575c36fad473382c8f5532ef3f0e1d2c450a7decbf3431a69f9b2ecb3291bed174245a962fe0484676958265e2988326a89db3139d91fe4aee6ae7e745ab00001a9f61f20500000000000000b3958bc14fce6e66a36d1ab3194534ba4e973684b27793bff837d3"], 0x84}}, 0x0) r5 = socket(0x10, 0x80002, 0x0) sendmmsg$alg(r5, &(0x7f0000000140), 0x49249249249278c, 0x0) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r6, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000500)=@newlink={0x20, 0x11, 0x40d, 0x0, 0x0, {0x0, 0x0, 0x0, r8}}, 0x20}}, 0x0) r9 = socket(0x10, 0x80002, 0x0) getsockopt$inet_sctp_SCTP_PEER_AUTH_CHUNKS(0xffffffffffffffff, 0x84, 0x1a, &(0x7f0000000940)=ANY=[@ANYRES32=0x0, @ANYBLOB='\x00'/12], &(0x7f0000000980)=0x10) r10 = socket(0xa, 0x6, 0x0) close(r10) r11 = socket$inet6_sctp(0xa, 0x10000000005, 0x84) setsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX(r11, 0x84, 0x6e, &(0x7f0000000180)=[@in6={0xa, 0x0, 0x0, @remote, 0x9}], 0x1c) getsockopt$inet_sctp6_SCTP_GET_ASSOC_ID_LIST(r11, 0x84, 0x1d, &(0x7f000095dff8)={0x1, [0x0]}, &(0x7f000095dffc)=0x8) setsockopt$inet_sctp_SCTP_RTOINFO(r10, 0x84, 0x0, &(0x7f0000000000)={r12, 0x0, 0x0, 0x1000000}, 0x10) setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(0xffffffffffffffff, 0x84, 0x9, &(0x7f0000000680)={r12, @in={{0x2, 0x4e20, @remote}}, 0x10001, 0xfff7, 0x5, 0x1, 0x8, 0x5, 0xba}, 0x9c) ioctl(r9, 0x1000008912, &(0x7f00000001c0)="080db5055e0bcfe8696071") getsockopt$inet_sctp_SCTP_PEER_AUTH_CHUNKS(r9, 0x84, 0x1a, &(0x7f0000000940)=ANY=[@ANYRES32=0x0, @ANYBLOB='\x00'/12], &(0x7f0000000980)=0x10) r13 = socket$nl_generic(0x10, 0x3, 0x10) r14 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080)='nl80211\x00') r15 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL80211_CMD_GET_STATION(r15, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000240)={0x1c, r14, 0xf2b, 0x0, 0x0, {}, [@NL80211_ATTR_AIRTIME_WEIGHT={0x8}]}, 0x1c}}, 0x0) sendmsg$NL80211_CMD_GET_MPATH(r13, &(0x7f00000001c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x2000}, 0x268, &(0x7f0000000080)={&(0x7f0000000200)={0x40, r14, 0x4, 0x70bd2d, 0x25dfdbff}, 0xff6b}, 0x1, 0x0, 0x0, 0x10049050}, 0x260448c0) sendmsg$NL80211_CMD_NEW_KEY(r9, &(0x7f0000000640)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0xb0024000}, 0xc, &(0x7f00000002c0)={&(0x7f0000000440)={0x7c, r14, 0x23, 0x70bd27, 0x25dfdbff, {}, [@NL80211_ATTR_KEY_DATA_WEP40={0x9, 0x7, "a80875ab12"}, @NL80211_ATTR_KEY={0x5c, 0x50, [@NL80211_KEY_DEFAULT_TYPES={0x14, 0x8, [@NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_MULTICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_MULTICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_MULTICAST={0x4}]}, @NL80211_KEY_DEFAULT_TYPES={0x28, 0x8, [@NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_MULTICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_MULTICAST={0x4}]}, @NL80211_KEY_IDX={0x5, 0x2, 0x5}, @NL80211_KEY_DATA_WEP104={0x11, 0x1, "4d84c4e30151cb27f51a4adf63"}]}]}, 0x7c}, 0x1, 0x0, 0x0, 0x24000}, 0x40) [ 411.757504][T17633] device syz_tun left promiscuous mode [ 411.773055][T17633] bridge213: port 1(syz_tun) entered disabled state [ 411.977955][T17633] bridge214: port 1(syz_tun) entered blocking state [ 411.984843][T17633] bridge214: port 1(syz_tun) entered disabled state [ 411.993106][T17633] device syz_tun entered promiscuous mode [ 412.001203][T17636] device erspan0 left promiscuous mode [ 412.006925][T17636] bridge213: port 2(erspan0) entered disabled state [ 412.137801][T17636] bridge214: port 2(erspan0) entered blocking state [ 412.144734][T17636] bridge214: port 2(erspan0) entered disabled state [ 412.153106][T17636] device erspan0 entered promiscuous mode 15:24:54 executing program 4: r0 = socket$inet6(0xa, 0x80003, 0x6b) ioctl(r0, 0x1000008912, &(0x7f00000001c0)="080db5055e0bcfe8476071") r1 = socket(0x10, 0x2, 0x0) sendto(r1, &(0x7f0000000200)="120000001200e7ef007b1a3fcd00000000a1", 0x12, 0x0, 0x0, 0x18) recvmmsg(r1, &(0x7f00000037c0)=[{{&(0x7f0000000600)=@ethernet={0x0, @random}, 0x80, &(0x7f0000000380)=[{&(0x7f0000000040)=""/95, 0x5f}, {&(0x7f00000000c0)=""/85, 0x55}, {&(0x7f00000024c0)=""/4096, 0x1000}, {&(0x7f0000000400)=""/120, 0x78}, {&(0x7f0000000480)=""/60, 0x3c}, {&(0x7f0000000280)=""/77, 0x4d}, {0x0}, {&(0x7f0000000340)=""/22, 0x16}], 0x8, &(0x7f0000002400)=""/191, 0xbf}}], 0x1, 0x6, &(0x7f0000003700)={0x77359400}) 15:24:54 executing program 0: r0 = socket(0x21, 0xa, 0x1) r1 = socket(0x10, 0x80002, 0x0) ioctl(r1, 0x1000008912, &(0x7f00000001c0)="080db5055e0bcfe8696071") getsockopt$inet_sctp_SCTP_PEER_AUTH_CHUNKS(r1, 0x84, 0x1a, &(0x7f0000000940)=ANY=[@ANYRES32=0x0, @ANYBLOB='\x00'/12], &(0x7f0000000980)=0x10) getsockopt$inet_sctp_SCTP_GET_PEER_ADDR_INFO(r0, 0x84, 0xf, &(0x7f00000009c0)={r2, @in6={{0xa, 0x4e21, 0x8, @local, 0x401}}, 0x9, 0x1, 0x7, 0x7f, 0x6}, &(0x7f0000000a80)=0x98) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000400)='nl80211\x00') sendmsg$NL80211_CMD_GET_MESH_CONFIG(r0, &(0x7f0000000580)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x103190}, 0xc, &(0x7f0000000540)={&(0x7f0000000500)={0x34, r3, 0x10, 0x70bd2d, 0x25dfdbfe, {}, [@NL80211_ATTR_WDEV={0xc, 0x99, {0x1, 0xffffffffffffffff}}, @NL80211_ATTR_WIPHY={0x8, 0x1, 0x1}, @NL80211_ATTR_WDEV={0xc, 0x99, {0x3f, 0x3}}]}, 0x34}, 0x1, 0x0, 0x0, 0x800}, 0x40000) r4 = socket$nl_generic(0x10, 0x3, 0x10) bind$netlink(r4, &(0x7f0000000000)={0x10, 0x0, 0x25dfdbff, 0x1004280}, 0xffffffffffffffb3) sendmsg$nl_generic(r4, &(0x7f0000000080)={&(0x7f0000000480)={0x10, 0xbb7f}, 0xc, &(0x7f0000000440)={&(0x7f00000004c0)={0x1c, 0x22, 0x1, 0x0, 0x0, {}, [@typed={0x8, 0xc}]}, 0x1c}}, 0x0) socket$netlink(0x10, 0x3, 0x0) r5 = socket$alg(0x26, 0x5, 0x0) bind$alg(r5, &(0x7f0000000080)={0x26, 'hash\x00', 0x0, 0x0, 'sha512\x00'}, 0x58) [ 412.181181][T17652] device syz_tun left promiscuous mode [ 412.197903][T17652] bridge225: port 1(syz_tun) entered disabled state 15:24:54 executing program 5: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000340)={'erspan0\x00', 0x0}) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000300)={'syz_tun\x00', 0x0}) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r7, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r6, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000380)=@newlink={0x34, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r8}, [@IFLA_LINKINFO={0x14, 0x12, @bridge={{0xb, 0x1, 'bridge\x00'}, {0x4}}}]}, 0x34}}, 0x0) sendmsg$nl_route(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000002700)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r5}, [@IFLA_MASTER={0x8, 0xa, r8}]}, 0x28}}, 0x0) sendmsg$nl_route(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f00000000c0)=ANY=[@ANYBLOB="2800000010000104000040000000000000001ea6", @ANYRES32=r2, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00\b\x00\n\x00', @ANYRES32=r8], 0x28}}, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r10 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r9, 0x8933, &(0x7f0000000300)={'syz_tun\x00', 0x0}) sendmsg$nl_route(r10, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000040)=@newlink={0x20, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r11}}, 0x20}}, 0x0) [ 412.337785][T17652] bridge226: port 1(syz_tun) entered blocking state [ 412.357883][T17652] bridge226: port 1(syz_tun) entered disabled state [ 412.368474][T17652] device syz_tun entered promiscuous mode [ 412.375893][T17651] netlink: 72 bytes leftover after parsing attributes in process `syz-executor.1'. [ 412.386214][T17654] bridge226: port 2(erspan0) entered blocking state [ 412.392957][T17654] bridge226: port 2(erspan0) entered disabled state [ 412.402276][T17654] device erspan0 entered promiscuous mode [ 412.411290][T17655] netlink: 72 bytes leftover after parsing attributes in process `syz-executor.1'. [ 412.427117][T17660] netlink: 'syz-executor.1': attribute type 274 has an invalid length. 15:24:54 executing program 0: r0 = socket(0x21, 0xa, 0x1) r1 = socket(0x10, 0x80002, 0x0) ioctl(r1, 0x1000008912, &(0x7f00000001c0)="080db5055e0bcfe8696071") getsockopt$inet_sctp_SCTP_PEER_AUTH_CHUNKS(r1, 0x84, 0x1a, &(0x7f0000000940)=ANY=[@ANYRES32=0x0, @ANYBLOB='\x00'/12], &(0x7f0000000980)=0x10) getsockopt$inet_sctp_SCTP_GET_PEER_ADDR_INFO(r0, 0x84, 0xf, &(0x7f00000009c0)={r2, @in6={{0xa, 0x4e21, 0x8, @local, 0x401}}, 0x9, 0x1, 0x7, 0x7f, 0x6}, &(0x7f0000000a80)=0x98) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000400)='nl80211\x00') sendmsg$NL80211_CMD_GET_MESH_CONFIG(r0, &(0x7f0000000580)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x103190}, 0xc, &(0x7f0000000540)={&(0x7f0000000500)={0x34, r3, 0x10, 0x70bd2d, 0x25dfdbfe, {}, [@NL80211_ATTR_WDEV={0xc, 0x99, {0x1, 0xffffffffffffffff}}, @NL80211_ATTR_WIPHY={0x8, 0x1, 0x1}, @NL80211_ATTR_WDEV={0xc, 0x99, {0x3f, 0x3}}]}, 0x34}, 0x1, 0x0, 0x0, 0x800}, 0x40000) r4 = socket$nl_generic(0x10, 0x3, 0x10) bind$netlink(r4, &(0x7f0000000000)={0x10, 0x0, 0x25dfdbff, 0x1004280}, 0xffffffffffffffb3) sendmsg$nl_generic(r4, &(0x7f0000000080)={&(0x7f0000000480)={0x10, 0xbb7f}, 0xc, &(0x7f0000000440)={&(0x7f00000004c0)={0x14, 0x22, 0x1, 0x0, 0x0, {0x4}}, 0x14}}, 0x0) socket$netlink(0x10, 0x3, 0x0) r5 = socket$alg(0x26, 0x5, 0x0) bind$alg(r5, &(0x7f0000000080)={0x26, 'hash\x00', 0x0, 0x0, 'sha512\x00'}, 0x58) 15:24:54 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000004c0)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r3, @ANYBLOB="0000000000000000280012000c0001007665746800000000180002001400010000000000", @ANYRES32=0x0], 0x4}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000540)=ANY=[@ANYBLOB="7400000024000705000000000000000000010000", @ANYRES32=r3, @ANYBLOB="00000000ffffffff000000000800010073667100486818973f73461919309b68e1693572bb000229c6090032d0ed64f3c3545aaf6e000085a4e4ebb5ef670000000000000000000000000000001a4e624d29a84abf03265700000000000000000000000000000000000000000000000000000000000000ac20000089b53c947244306a0216a3de887763df5b42498b13bb1938de859ee6d7ae7dd2224dc672b69b4358871b170ea0b667832e5224ee3538f885b7abd9bc4a7d"], 0x74}}, 0x0) r4 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r4, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000300)=ANY=[@ANYBLOB="840000002c00010700"/20, @ANYRES32=r3, @ANYBLOB="0008008000000000030000000800010075333200580002001400050000000000000000000000000000000000400006003c0001000000000000001020898dde66057433b6ef3a41d22be225e0001b0000000000000000000000000017256ffc66e43a2484e1a912c5998bcbf0d0000000000000000000000000000000798a3c067277da1a290b9613a33c575c36fad473382c8f5532ef3f0e1d2c450a7decbf3431a69f9b2ecb3291bed174245a962fe0484676958265e2988326a89db3139d91fe4aee6ae7e745ab00001a9f61f20500000000000000b3958bc14fce6e66a36d1ab3194534ba4e973684b27793bff837d3"], 0x84}}, 0x0) r5 = socket(0x10, 0x80002, 0x0) sendmmsg$alg(r5, &(0x7f0000000140), 0x49249249249278c, 0x0) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r6, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000500)=@newlink={0x20, 0x11, 0x40d, 0x0, 0x0, {0x0, 0x0, 0x0, r8}}, 0x20}}, 0x0) r9 = socket(0x10, 0x80002, 0x0) getsockopt$inet_sctp_SCTP_PEER_AUTH_CHUNKS(0xffffffffffffffff, 0x84, 0x1a, &(0x7f0000000940)=ANY=[@ANYRES32=0x0, @ANYBLOB='\x00'/12], &(0x7f0000000980)=0x10) r10 = socket(0xa, 0x6, 0x0) close(r10) r11 = socket$inet6_sctp(0xa, 0x10000000005, 0x84) setsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX(r11, 0x84, 0x6e, &(0x7f0000000180)=[@in6={0xa, 0x0, 0x0, @remote, 0x9}], 0x1c) getsockopt$inet_sctp6_SCTP_GET_ASSOC_ID_LIST(r11, 0x84, 0x1d, &(0x7f000095dff8)={0x1, [0x0]}, &(0x7f000095dffc)=0x8) setsockopt$inet_sctp_SCTP_RTOINFO(r10, 0x84, 0x0, &(0x7f0000000000)={r12, 0x0, 0x0, 0x1000000}, 0x10) setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(0xffffffffffffffff, 0x84, 0x9, &(0x7f0000000680)={r12, @in={{0x2, 0x4e20, @remote}}, 0x10001, 0xfff7, 0x5, 0x1, 0x8, 0x5, 0xba}, 0x9c) ioctl(r9, 0x1000008912, &(0x7f00000001c0)="080db5055e0bcfe8696071") getsockopt$inet_sctp_SCTP_PEER_AUTH_CHUNKS(r9, 0x84, 0x1a, &(0x7f0000000940)=ANY=[@ANYRES32=0x0, @ANYBLOB='\x00'/12], &(0x7f0000000980)=0x10) r13 = socket$nl_generic(0x10, 0x3, 0x10) r14 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080)='nl80211\x00') r15 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL80211_CMD_GET_STATION(r15, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000240)={0x1c, r14, 0xf2b, 0x0, 0x0, {}, [@NL80211_ATTR_AIRTIME_WEIGHT={0x8}]}, 0x1c}}, 0x0) sendmsg$NL80211_CMD_GET_MPATH(r13, &(0x7f00000001c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x2000}, 0x268, &(0x7f0000000080)={&(0x7f0000000200)={0x40, r14, 0x4, 0x70bd2d, 0x25dfdbff}, 0xff6b}, 0x1, 0x0, 0x0, 0x10049050}, 0x260448c0) sendmsg$NL80211_CMD_NEW_KEY(r9, &(0x7f0000000640)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0xb0024000}, 0xc, &(0x7f00000002c0)={&(0x7f0000000440)={0x7c, r14, 0x23, 0x70bd27, 0x25dfdbff, {}, [@NL80211_ATTR_KEY_DATA_WEP40={0x9, 0x7, "a80875ab12"}, @NL80211_ATTR_KEY={0x5c, 0x50, [@NL80211_KEY_DEFAULT_TYPES={0x14, 0x8, [@NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_MULTICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_MULTICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_MULTICAST={0x4}]}, @NL80211_KEY_DEFAULT_TYPES={0x28, 0x8, [@NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_MULTICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_MULTICAST={0x4}]}, @NL80211_KEY_IDX={0x5, 0x2, 0x5}, @NL80211_KEY_DATA_WEP104={0x11, 0x1, "4d84c4e30151cb27f51a4adf63"}]}]}, 0x7c}, 0x1, 0x0, 0x0, 0x24000}, 0x40) [ 412.436477][T17661] netlink: 'syz-executor.1': attribute type 274 has an invalid length. [ 412.460628][T17674] device syz_tun left promiscuous mode [ 412.466323][T17674] bridge214: port 1(syz_tun) entered disabled state [ 412.597961][T17674] bridge215: port 1(syz_tun) entered blocking state [ 412.604868][T17674] bridge215: port 1(syz_tun) entered disabled state [ 412.622259][T17674] device syz_tun entered promiscuous mode [ 412.632226][T17676] device erspan0 left promiscuous mode [ 412.644605][T17676] bridge214: port 2(erspan0) entered disabled state [ 412.777878][T17676] bridge215: port 2(erspan0) entered blocking state [ 412.784749][T17676] bridge215: port 2(erspan0) entered disabled state [ 412.797512][T17676] device erspan0 entered promiscuous mode [ 412.823544][T17682] netlink: 72 bytes leftover after parsing attributes in process `syz-executor.1'. [ 412.951723][T17684] netlink: 72 bytes leftover after parsing attributes in process `syz-executor.1'. 15:24:55 executing program 3: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000340)={'erspan0\x00', 0x0}) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000300)={'syz_tun\x00', 0x0}) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r7, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r6, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000380)=@newlink={0x34, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r8}, [@IFLA_LINKINFO={0x14, 0x12, @bridge={{0xb, 0x1, 'bridge\x00'}, {0x4}}}]}, 0x34}}, 0x0) sendmsg$nl_route(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000002700)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r5}, [@IFLA_MASTER={0x8, 0xa, r8}]}, 0x28}}, 0x0) sendmsg$nl_route(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f00000000c0)=ANY=[@ANYBLOB="2800000010000104000040000000000000001ea6", @ANYRES32=r2, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00\b\x00\n\x00', @ANYRES32=r8], 0x28}}, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r10 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r9, 0x8933, &(0x7f0000000300)={'syz_tun\x00', 0x0}) sendmsg$nl_route(r10, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000040)=@newlink={0x20, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r11}}, 0x20}}, 0x0) 15:24:55 executing program 4: r0 = socket$inet6(0xa, 0x80003, 0x6b) ioctl(r0, 0x1000008912, &(0x7f00000001c0)="080db5055e0bcfe8476071") r1 = socket(0x10, 0x2, 0x0) sendto(r1, &(0x7f0000000200)="120000001200e7ef007b1a3fcd00000000a1", 0x12, 0x0, 0x0, 0x18) recvmmsg(r1, &(0x7f00000037c0)=[{{&(0x7f0000000600)=@ethernet={0x0, @random}, 0x80, &(0x7f0000000380)=[{&(0x7f0000000040)=""/95, 0x5f}, {&(0x7f00000000c0)=""/85, 0x55}, {&(0x7f00000024c0)=""/4096, 0x1000}, {&(0x7f0000000400)=""/120, 0x78}, {&(0x7f0000000480)=""/60, 0x3c}, {&(0x7f0000000540)=""/154, 0x9a}, {&(0x7f0000000340)=""/22, 0x16}], 0x7, &(0x7f0000002400)=""/191, 0xbf}}], 0x1, 0x6, &(0x7f0000003700)={0x77359400}) 15:24:55 executing program 2: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000340)={'erspan0\x00', 0x0}) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000300)={'syz_tun\x00', 0x0}) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r7, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r6, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000380)=@newlink={0x34, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r8}, [@IFLA_LINKINFO={0x14, 0x12, @bridge={{0xb, 0x1, 'bridge\x00'}, {0x4}}}]}, 0x34}}, 0x0) sendmsg$nl_route(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000002700)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r5}, [@IFLA_MASTER={0x8, 0xa, r8}]}, 0x28}}, 0x0) sendmsg$nl_route(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f00000000c0)=ANY=[@ANYBLOB="2800000010000104000040000000000000001ea6", @ANYRES32=r2, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00\b\x00\n\x00', @ANYRES32=r8], 0x28}}, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r10 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r9, 0x8933, &(0x7f0000000300)={'syz_tun\x00', 0x0}) sendmsg$nl_route(r10, &(0x7f0000000000)={0x0, 0x4, &(0x7f00000000c0)={&(0x7f0000000040)=@newlink={0x2c, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r11}, [@IFLA_BROADCAST={0xa}]}, 0x332}}, 0x0) 15:24:55 executing program 5: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000340)={'erspan0\x00', 0x0}) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000300)={'syz_tun\x00', 0x0}) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r7, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r6, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000380)=@newlink={0x34, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r8}, [@IFLA_LINKINFO={0x14, 0x12, @bridge={{0xb, 0x1, 'bridge\x00'}, {0x4}}}]}, 0x34}}, 0x0) sendmsg$nl_route(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000002700)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r5}, [@IFLA_MASTER={0x8, 0xa, r8}]}, 0x28}}, 0x0) sendmsg$nl_route(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f00000000c0)=ANY=[@ANYBLOB="2800000010000104000040000000000000001ea6", @ANYRES32=r2, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00\b\x00\n\x00', @ANYRES32=r8], 0x28}}, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r10 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r9, 0x8933, &(0x7f0000000300)={'syz_tun\x00', 0x0}) sendmsg$nl_route(r10, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000040)=@newlink={0x20, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r11}}, 0x20}}, 0x0) 15:24:55 executing program 0: r0 = socket(0x21, 0xa, 0x1) r1 = socket(0x10, 0x80002, 0x0) ioctl(r1, 0x1000008912, &(0x7f00000001c0)="080db5055e0bcfe8696071") getsockopt$inet_sctp_SCTP_PEER_AUTH_CHUNKS(r1, 0x84, 0x1a, &(0x7f0000000940)=ANY=[@ANYRES32=0x0, @ANYBLOB='\x00'/12], &(0x7f0000000980)=0x10) getsockopt$inet_sctp_SCTP_GET_PEER_ADDR_INFO(r0, 0x84, 0xf, &(0x7f00000009c0)={r2, @in6={{0xa, 0x4e21, 0x8, @local, 0x401}}, 0x9, 0x1, 0x7, 0x7f, 0x6}, &(0x7f0000000a80)=0x98) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000400)='nl80211\x00') sendmsg$NL80211_CMD_GET_MESH_CONFIG(r0, &(0x7f0000000580)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x103190}, 0xc, &(0x7f0000000540)={&(0x7f0000000500)={0x34, r3, 0x10, 0x70bd2d, 0x25dfdbfe, {}, [@NL80211_ATTR_WDEV={0xc, 0x99, {0x1, 0xffffffffffffffff}}, @NL80211_ATTR_WIPHY={0x8, 0x1, 0x1}, @NL80211_ATTR_WDEV={0xc, 0x99, {0x3f, 0x3}}]}, 0x34}, 0x1, 0x0, 0x0, 0x800}, 0x40000) r4 = socket$nl_generic(0x10, 0x3, 0x10) bind$netlink(r4, &(0x7f0000000000)={0x10, 0x0, 0x25dfdbff, 0x1004280}, 0xffffffffffffffb3) sendmsg$nl_generic(r4, &(0x7f0000000080)={&(0x7f0000000480)={0x10, 0xbb7f}, 0xc, &(0x7f0000000440)={&(0x7f00000004c0)={0x14, 0x22, 0x1, 0x0, 0x0, {0x4}}, 0x14}}, 0x0) socket$netlink(0x10, 0x3, 0x0) r5 = socket$alg(0x26, 0x5, 0x0) bind$alg(r5, &(0x7f0000000080)={0x26, 'hash\x00', 0x0, 0x0, 'sha512\x00'}, 0x58) 15:24:55 executing program 4: r0 = socket$inet6(0xa, 0x80003, 0x6b) ioctl(r0, 0x1000008912, &(0x7f00000001c0)="080db5055e0bcfe8476071") r1 = socket(0x10, 0x2, 0x0) sendto(r1, &(0x7f0000000200)="120000001200e7ef007b1a3fcd00000000a1", 0x12, 0x0, 0x0, 0x18) recvmmsg(r1, &(0x7f00000037c0)=[{{&(0x7f0000000600)=@ethernet={0x0, @random}, 0x80, &(0x7f0000000380)=[{&(0x7f0000000040)=""/95, 0x5f}, {&(0x7f00000000c0)=""/85, 0x55}, {&(0x7f00000024c0)=""/4096, 0x1000}, {&(0x7f0000000400)=""/120, 0x78}, {&(0x7f0000000480)=""/60, 0x3c}, {&(0x7f0000000540)=""/154, 0x9a}, {&(0x7f0000000340)=""/22, 0x16}], 0x7, &(0x7f0000002400)=""/191, 0xbf}}], 0x1, 0x6, &(0x7f0000003700)={0x77359400}) [ 413.332153][T17699] device syz_tun left promiscuous mode [ 413.338066][T17699] bridge226: port 1(syz_tun) entered disabled state 15:24:55 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000004c0)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r3, @ANYBLOB="0000000000000000280012000c0001007665746800000000180002001400010000000000", @ANYRES32=0x0], 0x4}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000540)=ANY=[@ANYBLOB="7400000024000705000000000000000000010000", @ANYRES32=r3, @ANYBLOB="00000000ffffffff000000000800010073667100486818973f73461919309b68e1693572bb000229c6090032d0ed64f3c3545aaf6e000085a4e4ebb5ef670000000000000000000000000000001a4e624d29a84abf03265700000000000000000000000000000000000000000000000000000000000000ac20000089b53c947244306a0216a3de887763df5b42498b13bb1938de859ee6d7ae7dd2224dc672b69b4358871b170ea0b667832e5224ee3538f885b7abd9bc4a7d"], 0x74}}, 0x0) r4 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r4, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000300)=ANY=[@ANYBLOB="840000002c00010700"/20, @ANYRES32=r3, @ANYBLOB="0008008000000000030000000800010075333200580002001400050000000000000000000000000000000000400006003c0001000000000000001020898dde66057433b6ef3a41d22be225e0001b0000000000000000000000000017256ffc66e43a2484e1a912c5998bcbf0d0000000000000000000000000000000798a3c067277da1a290b9613a33c575c36fad473382c8f5532ef3f0e1d2c450a7decbf3431a69f9b2ecb3291bed174245a962fe0484676958265e2988326a89db3139d91fe4aee6ae7e745ab00001a9f61f20500000000000000b3958bc14fce6e66a36d1ab3194534ba4e973684b27793bff837d3"], 0x84}}, 0x0) r5 = socket(0x10, 0x80002, 0x0) sendmmsg$alg(r5, &(0x7f0000000140), 0x49249249249278c, 0x0) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r6, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000500)=@newlink={0x20, 0x11, 0x40d, 0x0, 0x0, {0x0, 0x0, 0x0, r8}}, 0x20}}, 0x0) r9 = socket(0x10, 0x80002, 0x0) getsockopt$inet_sctp_SCTP_PEER_AUTH_CHUNKS(0xffffffffffffffff, 0x84, 0x1a, &(0x7f0000000940)=ANY=[@ANYRES32=0x0, @ANYBLOB='\x00'/12], &(0x7f0000000980)=0x10) r10 = socket(0xa, 0x6, 0x0) close(r10) r11 = socket$inet6_sctp(0xa, 0x10000000005, 0x84) setsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX(r11, 0x84, 0x6e, &(0x7f0000000180)=[@in6={0xa, 0x0, 0x0, @remote, 0x9}], 0x1c) getsockopt$inet_sctp6_SCTP_GET_ASSOC_ID_LIST(r11, 0x84, 0x1d, &(0x7f000095dff8)={0x1, [0x0]}, &(0x7f000095dffc)=0x8) setsockopt$inet_sctp_SCTP_RTOINFO(r10, 0x84, 0x0, &(0x7f0000000000)={r12, 0x0, 0x0, 0x1000000}, 0x10) setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(0xffffffffffffffff, 0x84, 0x9, &(0x7f0000000680)={r12, @in={{0x2, 0x4e20, @remote}}, 0x10001, 0xfff7, 0x5, 0x1, 0x8, 0x5, 0xba}, 0x9c) ioctl(r9, 0x1000008912, &(0x7f00000001c0)="080db5055e0bcfe8696071") getsockopt$inet_sctp_SCTP_PEER_AUTH_CHUNKS(r9, 0x84, 0x1a, &(0x7f0000000940)=ANY=[@ANYRES32=0x0, @ANYBLOB='\x00'/12], &(0x7f0000000980)=0x10) r13 = socket$nl_generic(0x10, 0x3, 0x10) r14 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080)='nl80211\x00') r15 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL80211_CMD_GET_STATION(r15, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000240)={0x1c, r14, 0xf2b, 0x0, 0x0, {}, [@NL80211_ATTR_AIRTIME_WEIGHT={0x8}]}, 0x1c}}, 0x0) sendmsg$NL80211_CMD_GET_MPATH(r13, &(0x7f00000001c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x2000}, 0x268, &(0x7f0000000080)={&(0x7f0000000200)={0x40, r14, 0x4, 0x70bd2d, 0x25dfdbff}, 0xff6b}, 0x1, 0x0, 0x0, 0x10049050}, 0x260448c0) sendmsg$NL80211_CMD_NEW_KEY(r9, &(0x7f0000000640)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0xb0024000}, 0xc, &(0x7f00000002c0)={&(0x7f0000000440)={0x7c, r14, 0x23, 0x70bd27, 0x25dfdbff, {}, [@NL80211_ATTR_KEY_DATA_WEP40={0x9, 0x7, "a80875ab12"}, @NL80211_ATTR_KEY={0x5c, 0x50, [@NL80211_KEY_DEFAULT_TYPES={0x14, 0x8, [@NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_MULTICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_MULTICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_MULTICAST={0x4}]}, @NL80211_KEY_DEFAULT_TYPES={0x28, 0x8, [@NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_MULTICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_MULTICAST={0x4}]}, @NL80211_KEY_IDX={0x5, 0x2, 0x5}, @NL80211_KEY_DATA_WEP104={0x11, 0x1, "4d84c4e30151cb27f51a4adf63"}]}]}, 0x7c}, 0x1, 0x0, 0x0, 0x24000}, 0x40) [ 413.462388][T17699] bridge227: port 1(syz_tun) entered blocking state [ 413.474757][T17699] bridge227: port 1(syz_tun) entered disabled state [ 413.489642][T17699] device syz_tun entered promiscuous mode [ 413.498366][T17700] device syz_tun left promiscuous mode [ 413.504046][T17700] bridge215: port 1(syz_tun) entered disabled state [ 413.637871][T17700] bridge216: port 1(syz_tun) entered blocking state [ 413.644741][T17700] bridge216: port 1(syz_tun) entered disabled state [ 413.653915][T17700] device syz_tun entered promiscuous mode 15:24:55 executing program 0: r0 = socket(0x21, 0xa, 0x1) r1 = socket(0x10, 0x80002, 0x0) ioctl(r1, 0x1000008912, &(0x7f00000001c0)="080db5055e0bcfe8696071") getsockopt$inet_sctp_SCTP_PEER_AUTH_CHUNKS(r1, 0x84, 0x1a, &(0x7f0000000940)=ANY=[@ANYRES32=0x0, @ANYBLOB='\x00'/12], &(0x7f0000000980)=0x10) getsockopt$inet_sctp_SCTP_GET_PEER_ADDR_INFO(r0, 0x84, 0xf, &(0x7f00000009c0)={r2, @in6={{0xa, 0x4e21, 0x8, @local, 0x401}}, 0x9, 0x1, 0x7, 0x7f, 0x6}, &(0x7f0000000a80)=0x98) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000400)='nl80211\x00') sendmsg$NL80211_CMD_GET_MESH_CONFIG(r0, &(0x7f0000000580)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x103190}, 0xc, &(0x7f0000000540)={&(0x7f0000000500)={0x34, r3, 0x10, 0x70bd2d, 0x25dfdbfe, {}, [@NL80211_ATTR_WDEV={0xc, 0x99, {0x1, 0xffffffffffffffff}}, @NL80211_ATTR_WIPHY={0x8, 0x1, 0x1}, @NL80211_ATTR_WDEV={0xc, 0x99, {0x3f, 0x3}}]}, 0x34}, 0x1, 0x0, 0x0, 0x800}, 0x40000) r4 = socket$nl_generic(0x10, 0x3, 0x10) bind$netlink(r4, &(0x7f0000000000)={0x10, 0x0, 0x25dfdbff, 0x1004280}, 0xffffffffffffffb3) sendmsg$nl_generic(r4, &(0x7f0000000080)={&(0x7f0000000480)={0x10, 0xbb7f}, 0xc, &(0x7f0000000440)={&(0x7f00000004c0)={0x14, 0x22, 0x1, 0x0, 0x0, {0x4}}, 0x14}}, 0x0) socket$netlink(0x10, 0x3, 0x0) r5 = socket$alg(0x26, 0x5, 0x0) bind$alg(r5, &(0x7f0000000080)={0x26, 'hash\x00', 0x0, 0x0, 'sha512\x00'}, 0x58) [ 413.684240][T17707] device erspan0 left promiscuous mode [ 413.692684][T17707] bridge226: port 2(erspan0) entered disabled state [ 413.817846][T17707] bridge227: port 2(erspan0) entered blocking state [ 413.827835][T17707] bridge227: port 2(erspan0) entered disabled state [ 413.835982][T17707] device erspan0 entered promiscuous mode [ 413.844071][T17709] device erspan0 left promiscuous mode [ 413.850096][T17709] bridge215: port 2(erspan0) entered disabled state [ 413.977904][T17709] bridge216: port 2(erspan0) entered blocking state [ 413.984843][T17709] bridge216: port 2(erspan0) entered disabled state [ 413.993285][T17709] device erspan0 entered promiscuous mode [ 414.002258][T17712] device syz_tun left promiscuous mode [ 414.008727][T17712] bridge75: port 1(syz_tun) entered disabled state 15:24:56 executing program 5 (fault-call:16 fault-nth:0): socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000340)={'erspan0\x00', 0x0}) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000300)={'syz_tun\x00', 0x0}) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r7, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r6, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000380)=@newlink={0x34, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r8}, [@IFLA_LINKINFO={0x14, 0x12, @bridge={{0xb, 0x1, 'bridge\x00'}, {0x4}}}]}, 0x34}}, 0x0) sendmsg$nl_route(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000002700)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r5}, [@IFLA_MASTER={0x8, 0xa, r8}]}, 0x28}}, 0x0) sendmsg$nl_route(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f00000000c0)=ANY=[@ANYBLOB="2800000010000104000040000000000000001ea6", @ANYRES32=r2, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00\b\x00\n\x00', @ANYRES32=r8], 0x28}}, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r10 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r9, 0x8933, &(0x7f0000000300)={'syz_tun\x00', 0x0}) sendmsg$nl_route(r10, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000040)=@newlink={0x2c, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r11}, [@IFLA_BROADCAST={0xa}]}, 0x332}}, 0x0) [ 414.127849][T17712] bridge76: port 1(syz_tun) entered blocking state [ 414.135333][T17712] bridge76: port 1(syz_tun) entered disabled state [ 414.147005][T17712] device syz_tun entered promiscuous mode [ 414.158802][T17716] device erspan0 left promiscuous mode [ 414.171446][T17716] bridge75: port 2(erspan0) entered disabled state 15:24:56 executing program 4: r0 = socket$inet6(0xa, 0x80003, 0x6b) ioctl(r0, 0x1000008912, &(0x7f00000001c0)="080db5055e0bcfe8476071") r1 = socket(0x10, 0x2, 0x0) sendto(r1, &(0x7f0000000200)="120000001200e7ef007b1a3fcd00000000a1", 0x12, 0x0, 0x0, 0x18) recvmmsg(r1, &(0x7f00000037c0)=[{{&(0x7f0000000600)=@ethernet={0x0, @random}, 0x80, &(0x7f0000000380)=[{&(0x7f0000000040)=""/95, 0x5f}, {&(0x7f00000000c0)=""/85, 0x55}, {&(0x7f00000024c0)=""/4096, 0x1000}, {&(0x7f0000000400)=""/120, 0x78}, {&(0x7f0000000480)=""/60, 0x3c}, {&(0x7f0000000540)=""/154, 0x9a}, {&(0x7f0000000340)=""/22, 0x16}], 0x7, &(0x7f0000002400)=""/191, 0xbf}}], 0x1, 0x6, &(0x7f0000003700)={0x77359400}) [ 414.337912][T17716] bridge76: port 2(erspan0) entered blocking state [ 414.344706][T17716] bridge76: port 2(erspan0) entered disabled state [ 414.352923][T17716] device erspan0 entered promiscuous mode [ 414.360652][T17719] netlink: 72 bytes leftover after parsing attributes in process `syz-executor.1'. [ 414.372051][T17722] netlink: 72 bytes leftover after parsing attributes in process `syz-executor.1'. 15:24:56 executing program 3: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000340)={'erspan0\x00', 0x0}) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000300)={'syz_tun\x00', 0x0}) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r7, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r6, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000380)=@newlink={0x34, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r8}, [@IFLA_LINKINFO={0x14, 0x12, @bridge={{0xb, 0x1, 'bridge\x00'}, {0x4}}}]}, 0x34}}, 0x0) sendmsg$nl_route(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000002700)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r5}, [@IFLA_MASTER={0x8, 0xa, r8}]}, 0x28}}, 0x0) sendmsg$nl_route(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f00000000c0)=ANY=[@ANYBLOB="2800000010000104000040000000000000001ea6", @ANYRES32=r2, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00\b\x00\n\x00', @ANYRES32=r8], 0x28}}, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r10 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r9, 0x8933, &(0x7f0000000300)={'syz_tun\x00', 0x0}) sendmsg$nl_route(r10, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000040)=@newlink={0x20, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r11}}, 0x20}}, 0x0) [ 414.390887][T17746] FAULT_INJECTION: forcing a failure. [ 414.390887][T17746] name failslab, interval 1, probability 0, space 0, times 0 [ 414.404475][T17726] netlink: 'syz-executor.1': attribute type 274 has an invalid length. [ 414.426004][T17729] netlink: 'syz-executor.1': attribute type 274 has an invalid length. [ 414.442273][T17746] CPU: 0 PID: 17746 Comm: syz-executor.5 Not tainted 5.5.0-rc5-syzkaller #0 [ 414.451002][T17746] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 414.461084][T17746] Call Trace: [ 414.464398][T17746] dump_stack+0x197/0x210 [ 414.468759][T17746] should_fail.cold+0xa/0x15 [ 414.473382][T17746] ? release_sock+0x156/0x1c0 [ 414.478077][T17746] ? fault_create_debugfs_attr+0x180/0x180 [ 414.483904][T17746] ? ___might_sleep+0x163/0x2c0 [ 414.488788][T17746] __should_failslab+0x121/0x190 [ 414.493746][T17746] should_failslab+0x9/0x14 [ 414.498268][T17746] kmem_cache_alloc_node+0x268/0x740 [ 414.503577][T17746] __alloc_skb+0xd5/0x5e0 [ 414.507931][T17746] ? __kmalloc_reserve.isra.0+0xf0/0xf0 [ 414.513495][T17746] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 414.519746][T17746] ? netlink_autobind.isra.0+0x223/0x300 [ 414.525512][T17746] netlink_sendmsg+0xa1b/0xea0 [ 414.530294][T17746] ? netlink_unicast+0x7d0/0x7d0 [ 414.535244][T17746] ? aa_sock_msg_perm.isra.0+0xba/0x170 [ 414.540807][T17746] ? apparmor_socket_sendmsg+0x2a/0x30 [ 414.546357][T17746] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 414.546375][T17746] ? security_socket_sendmsg+0x8d/0xc0 [ 414.546392][T17746] ? netlink_unicast+0x7d0/0x7d0 [ 414.546409][T17746] sock_sendmsg+0xd7/0x130 [ 414.546426][T17746] ____sys_sendmsg+0x753/0x880 [ 414.546445][T17746] ? kernel_sendmsg+0x50/0x50 [ 414.546458][T17746] ? __fget+0x35d/0x550 [ 414.546475][T17746] ? find_held_lock+0x35/0x130 [ 414.585828][T17746] ___sys_sendmsg+0x100/0x170 15:24:56 executing program 0: r0 = socket(0x21, 0xa, 0x1) r1 = socket(0x10, 0x80002, 0x0) ioctl(r1, 0x1000008912, &(0x7f00000001c0)="080db5055e0bcfe8696071") getsockopt$inet_sctp_SCTP_PEER_AUTH_CHUNKS(r1, 0x84, 0x1a, &(0x7f0000000940)=ANY=[@ANYRES32=0x0, @ANYBLOB='\x00'/12], &(0x7f0000000980)=0x10) getsockopt$inet_sctp_SCTP_GET_PEER_ADDR_INFO(r0, 0x84, 0xf, &(0x7f00000009c0)={r2, @in6={{0xa, 0x4e21, 0x8, @local, 0x401}}, 0x9, 0x1, 0x7, 0x7f, 0x6}, &(0x7f0000000a80)=0x98) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000400)='nl80211\x00') sendmsg$NL80211_CMD_GET_MESH_CONFIG(r0, &(0x7f0000000580)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x103190}, 0xc, &(0x7f0000000540)={&(0x7f0000000500)={0x34, r3, 0x10, 0x70bd2d, 0x25dfdbfe, {}, [@NL80211_ATTR_WDEV={0xc, 0x99, {0x1, 0xffffffffffffffff}}, @NL80211_ATTR_WIPHY={0x8, 0x1, 0x1}, @NL80211_ATTR_WDEV={0xc, 0x99, {0x3f, 0x3}}]}, 0x34}, 0x1, 0x0, 0x0, 0x800}, 0x40000) r4 = socket$nl_generic(0x10, 0x3, 0x10) bind$netlink(r4, &(0x7f0000000000)={0x10, 0x0, 0x25dfdbff, 0x1004280}, 0xffffffffffffffb3) sendmsg$nl_generic(r4, &(0x7f0000000080)={&(0x7f0000000480)={0x10, 0xbb7f}, 0xc, &(0x7f0000000440)={&(0x7f00000004c0)={0x1c, 0x22, 0x1, 0x0, 0x0, {0x4}, [@typed={0x8}]}, 0x1c}}, 0x0) socket$netlink(0x10, 0x3, 0x0) r5 = socket$alg(0x26, 0x5, 0x0) bind$alg(r5, &(0x7f0000000080)={0x26, 'hash\x00', 0x0, 0x0, 'sha512\x00'}, 0x58) [ 414.590522][T17746] ? sendmsg_copy_msghdr+0x70/0x70 [ 414.595639][T17746] ? __kasan_check_read+0x11/0x20 [ 414.600676][T17746] ? __fget+0x37f/0x550 [ 414.604857][T17746] ? ksys_dup3+0x3e0/0x3e0 [ 414.609297][T17746] ? __fget_light+0x1a9/0x230 [ 414.613990][T17746] ? __fdget+0x1b/0x20 [ 414.618071][T17746] ? __sanitizer_cov_trace_const_cmp8+0x18/0x20 [ 414.624323][T17746] __sys_sendmsg+0x105/0x1d0 [ 414.628931][T17746] ? __sys_sendmsg_sock+0xc0/0xc0 [ 414.633979][T17746] ? trace_hardirqs_on_thunk+0x1a/0x1c [ 414.639451][T17746] ? do_syscall_64+0x26/0x790 [ 414.644251][T17746] ? entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 414.650331][T17746] ? do_syscall_64+0x26/0x790 [ 414.655027][T17746] __x64_sys_sendmsg+0x78/0xb0 [ 414.659810][T17746] do_syscall_64+0xfa/0x790 [ 414.664340][T17746] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 414.670239][T17746] RIP: 0033:0x45af49 [ 414.674141][T17746] Code: ad b6 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 7b b6 fb ff c3 66 2e 0f 1f 84 00 00 00 00 15:24:56 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000004c0)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r3, @ANYBLOB="0000000000000000280012000c0001007665746800000000180002001400010000000000", @ANYRES32=0x0], 0x4}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000540)=ANY=[@ANYBLOB="7400000024000705000000000000000000010000", @ANYRES32=r3, @ANYBLOB="00000000ffffffff000000000800010073667100486818973f73461919309b68e1693572bb000229c6090032d0ed64f3c3545aaf6e000085a4e4ebb5ef670000000000000000000000000000001a4e624d29a84abf03265700000000000000000000000000000000000000000000000000000000000000ac20000089b53c947244306a0216a3de887763df5b42498b13bb1938de859ee6d7ae7dd2224dc672b69b4358871b170ea0b667832e5224ee3538f885b7abd9bc4a7d"], 0x74}}, 0x0) r4 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r4, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000300)=ANY=[@ANYBLOB="840000002c00010700"/20, @ANYRES32=r3, @ANYBLOB="0008008000000000030000000800010075333200580002001400050000000000000000000000000000000000400006003c0001000000000000001020898dde66057433b6ef3a41d22be225e0001b0000000000000000000000000017256ffc66e43a2484e1a912c5998bcbf0d0000000000000000000000000000000798a3c067277da1a290b9613a33c575c36fad473382c8f5532ef3f0e1d2c450a7decbf3431a69f9b2ecb3291bed174245a962fe0484676958265e2988326a89db3139d91fe4aee6ae7e745ab00001a9f61f20500000000000000b3958bc14fce6e66a36d1ab3194534ba4e973684b27793bff837d3"], 0x84}}, 0x0) r5 = socket(0x10, 0x80002, 0x0) sendmmsg$alg(r5, &(0x7f0000000140), 0x49249249249278c, 0x0) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r6, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000500)=@newlink={0x20, 0x11, 0x40d, 0x0, 0x0, {0x0, 0x0, 0x0, r8}}, 0x20}}, 0x0) r9 = socket(0x10, 0x80002, 0x0) getsockopt$inet_sctp_SCTP_PEER_AUTH_CHUNKS(0xffffffffffffffff, 0x84, 0x1a, &(0x7f0000000940)=ANY=[@ANYRES32=0x0, @ANYBLOB='\x00'/12], &(0x7f0000000980)=0x10) r10 = socket(0xa, 0x6, 0x0) close(r10) r11 = socket$inet6_sctp(0xa, 0x10000000005, 0x84) setsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX(r11, 0x84, 0x6e, &(0x7f0000000180)=[@in6={0xa, 0x0, 0x0, @remote, 0x9}], 0x1c) getsockopt$inet_sctp6_SCTP_GET_ASSOC_ID_LIST(r11, 0x84, 0x1d, &(0x7f000095dff8)={0x1, [0x0]}, &(0x7f000095dffc)=0x8) setsockopt$inet_sctp_SCTP_RTOINFO(r10, 0x84, 0x0, &(0x7f0000000000)={r12, 0x0, 0x0, 0x1000000}, 0x10) setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(0xffffffffffffffff, 0x84, 0x9, &(0x7f0000000680)={r12, @in={{0x2, 0x4e20, @remote}}, 0x10001, 0xfff7, 0x5, 0x1, 0x8, 0x5, 0xba}, 0x9c) ioctl(r9, 0x1000008912, &(0x7f00000001c0)="080db5055e0bcfe8696071") getsockopt$inet_sctp_SCTP_PEER_AUTH_CHUNKS(r9, 0x84, 0x1a, &(0x7f0000000940)=ANY=[@ANYRES32=0x0, @ANYBLOB='\x00'/12], &(0x7f0000000980)=0x10) r13 = socket$nl_generic(0x10, 0x3, 0x10) r14 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080)='nl80211\x00') r15 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL80211_CMD_GET_STATION(r15, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000240)={0x1c, r14, 0xf2b, 0x0, 0x0, {}, [@NL80211_ATTR_AIRTIME_WEIGHT={0x8}]}, 0x1c}}, 0x0) sendmsg$NL80211_CMD_GET_MPATH(r13, &(0x7f00000001c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x2000}, 0x268, &(0x7f0000000080)={&(0x7f0000000200)={0x40, r14, 0x4, 0x70bd2d, 0x25dfdbff}, 0xff6b}, 0x1, 0x0, 0x0, 0x10049050}, 0x260448c0) sendmsg$NL80211_CMD_NEW_KEY(r9, &(0x7f0000000640)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0xb0024000}, 0xc, &(0x7f00000002c0)={&(0x7f0000000440)={0x7c, r14, 0x23, 0x70bd27, 0x25dfdbff, {}, [@NL80211_ATTR_KEY_DATA_WEP40={0x9, 0x7, "a80875ab12"}, @NL80211_ATTR_KEY={0x5c, 0x50, [@NL80211_KEY_DEFAULT_TYPES={0x14, 0x8, [@NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_MULTICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_MULTICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_MULTICAST={0x4}]}, @NL80211_KEY_DEFAULT_TYPES={0x28, 0x8, [@NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_MULTICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_MULTICAST={0x4}]}, @NL80211_KEY_IDX={0x5, 0x2, 0x5}, @NL80211_KEY_DATA_WEP104={0x11, 0x1, "4d84c4e30151cb27f51a4adf63"}]}]}, 0x7c}, 0x1, 0x0, 0x0, 0x24000}, 0x40) [ 414.693758][T17746] RSP: 002b:00007fdf150e9c78 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 414.702182][T17746] RAX: ffffffffffffffda RBX: 00007fdf150e9c90 RCX: 000000000045af49 [ 414.710171][T17746] RDX: 0000000000000000 RSI: 0000000020000000 RDI: 000000000000000d [ 414.718159][T17746] RBP: 000000000075c118 R08: 0000000000000000 R09: 0000000000000000 [ 414.726146][T17746] R10: 0000000000000000 R11: 0000000000000246 R12: 00007fdf150ea6d4 [ 414.734132][T17746] R13: 00000000004caa0f R14: 00000000004e3eb0 R15: 000000000000000e 15:24:56 executing program 2: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000340)={'erspan0\x00', 0x0}) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000300)={'syz_tun\x00', 0x0}) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r7, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r6, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000380)=@newlink={0x34, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r8}, [@IFLA_LINKINFO={0x14, 0x12, @bridge={{0xb, 0x1, 'bridge\x00'}, {0x4}}}]}, 0x34}}, 0x0) sendmsg$nl_route(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000002700)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r5}, [@IFLA_MASTER={0x8, 0xa, r8}]}, 0x28}}, 0x0) sendmsg$nl_route(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f00000000c0)=ANY=[@ANYBLOB="2800000010000104000040000000000000001ea6", @ANYRES32=r2, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00\b\x00\n\x00', @ANYRES32=r8], 0x28}}, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r10 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r9, 0x8933, &(0x7f0000000300)={'syz_tun\x00', 0x0}) sendmsg$nl_route(r10, &(0x7f0000000000)={0x0, 0x6, &(0x7f00000000c0)={&(0x7f0000000040)=@newlink={0x2c, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r11}, [@IFLA_BROADCAST={0xa}]}, 0x332}}, 0x0) [ 414.800197][T17742] device syz_tun left promiscuous mode [ 414.849272][T17742] bridge216: port 1(syz_tun) entered disabled state 15:24:57 executing program 4: r0 = socket$inet6(0xa, 0x80003, 0x6b) ioctl(r0, 0x1000008912, &(0x7f00000001c0)="080db5055e0bcfe8476071") r1 = socket(0x10, 0x2, 0x0) sendto(r1, &(0x7f0000000200)="120000001200e7ef007b1a3fcd00000000a1", 0x12, 0x0, 0x0, 0x18) recvmmsg(r1, &(0x7f00000037c0)=[{{&(0x7f0000000600)=@ethernet={0x0, @random}, 0x80, &(0x7f0000000380)=[{&(0x7f0000000040)=""/95, 0x5f}, {&(0x7f00000000c0)=""/85, 0x55}, {&(0x7f00000024c0)=""/4096, 0x1000}, {&(0x7f0000000400)=""/120, 0x78}, {&(0x7f0000000480)=""/60, 0x3c}, {0x0}, {&(0x7f0000000540)=""/154, 0x9a}, {&(0x7f0000000340)=""/22, 0x16}], 0x8, &(0x7f0000002400)=""/191, 0xbf}}], 0x1, 0x6, &(0x7f0000003700)={0x77359400}) [ 414.997959][T17742] bridge217: port 1(syz_tun) entered blocking state [ 415.004778][T17742] bridge217: port 1(syz_tun) entered disabled state [ 415.012995][T17742] device syz_tun entered promiscuous mode [ 415.021276][T17744] device erspan0 left promiscuous mode [ 415.027282][T17744] bridge216: port 2(erspan0) entered disabled state 15:24:57 executing program 5 (fault-call:16 fault-nth:1): socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000340)={'erspan0\x00', 0x0}) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000300)={'syz_tun\x00', 0x0}) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r7, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r6, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000380)=@newlink={0x34, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r8}, [@IFLA_LINKINFO={0x14, 0x12, @bridge={{0xb, 0x1, 'bridge\x00'}, {0x4}}}]}, 0x34}}, 0x0) sendmsg$nl_route(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000002700)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r5}, [@IFLA_MASTER={0x8, 0xa, r8}]}, 0x28}}, 0x0) sendmsg$nl_route(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f00000000c0)=ANY=[@ANYBLOB="2800000010000104000040000000000000001ea6", @ANYRES32=r2, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00\b\x00\n\x00', @ANYRES32=r8], 0x28}}, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r10 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r9, 0x8933, &(0x7f0000000300)={'syz_tun\x00', 0x0}) sendmsg$nl_route(r10, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000040)=@newlink={0x2c, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r11}, [@IFLA_BROADCAST={0xa}]}, 0x332}}, 0x0) [ 415.167924][T17744] bridge217: port 2(erspan0) entered blocking state [ 415.177879][T17744] bridge217: port 2(erspan0) entered disabled state [ 415.185897][T17744] device erspan0 entered promiscuous mode [ 415.198588][T17750] device syz_tun left promiscuous mode [ 415.204242][T17750] bridge76: port 1(syz_tun) entered disabled state [ 415.357850][T17750] bridge77: port 1(syz_tun) entered blocking state [ 415.364673][T17750] bridge77: port 1(syz_tun) entered disabled state [ 415.373910][T17750] device syz_tun entered promiscuous mode [ 415.382360][T17751] device erspan0 left promiscuous mode [ 415.388345][T17751] bridge76: port 2(erspan0) entered disabled state [ 415.415019][T17782] FAULT_INJECTION: forcing a failure. [ 415.415019][T17782] name failslab, interval 1, probability 0, space 0, times 0 [ 415.427746][T17782] CPU: 1 PID: 17782 Comm: syz-executor.5 Not tainted 5.5.0-rc5-syzkaller #0 [ 415.436465][T17782] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 415.446531][T17782] Call Trace: [ 415.449845][T17782] dump_stack+0x197/0x210 [ 415.454185][T17782] should_fail.cold+0xa/0x15 [ 415.458768][T17782] ? fault_create_debugfs_attr+0x180/0x180 [ 415.464585][T17782] ? ___might_sleep+0x163/0x2c0 [ 415.469455][T17782] __should_failslab+0x121/0x190 [ 415.474395][T17782] should_failslab+0x9/0x14 [ 415.478923][T17782] kmem_cache_alloc_node_trace+0x274/0x750 [ 415.484718][T17782] ? rcu_read_lock_any_held.part.0+0x50/0x50 [ 415.490711][T17782] ? __kasan_kmalloc.constprop.0+0xcf/0xe0 [ 415.496538][T17782] __kmalloc_node_track_caller+0x3d/0x70 [ 415.502183][T17782] __kmalloc_reserve.isra.0+0x40/0xf0 [ 415.507576][T17782] __alloc_skb+0x10b/0x5e0 [ 415.511998][T17782] ? __kmalloc_reserve.isra.0+0xf0/0xf0 [ 415.517534][T17782] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 415.523771][T17782] ? netlink_autobind.isra.0+0x223/0x300 [ 415.529469][T17782] netlink_sendmsg+0xa1b/0xea0 [ 415.534225][T17782] ? netlink_unicast+0x7d0/0x7d0 [ 415.539164][T17782] ? aa_sock_msg_perm.isra.0+0xba/0x170 [ 415.544771][T17782] ? apparmor_socket_sendmsg+0x2a/0x30 [ 415.550275][T17782] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 415.556519][T17782] ? security_socket_sendmsg+0x8d/0xc0 [ 415.563027][T17782] ? netlink_unicast+0x7d0/0x7d0 [ 415.567958][T17782] sock_sendmsg+0xd7/0x130 [ 415.572372][T17782] ____sys_sendmsg+0x753/0x880 [ 415.577180][T17782] ? kernel_sendmsg+0x50/0x50 [ 415.581978][T17782] ? __fget+0x35d/0x550 [ 415.586196][T17782] ? find_held_lock+0x35/0x130 [ 415.590969][T17782] ___sys_sendmsg+0x100/0x170 [ 415.595780][T17782] ? sendmsg_copy_msghdr+0x70/0x70 [ 415.600996][T17782] ? __kasan_check_read+0x11/0x20 [ 415.606026][T17782] ? __fget+0x37f/0x550 [ 415.610195][T17782] ? ksys_dup3+0x3e0/0x3e0 [ 415.614614][T17782] ? __fget_light+0x1a9/0x230 [ 415.619305][T17782] ? __fdget+0x1b/0x20 [ 415.623372][T17782] ? __sanitizer_cov_trace_const_cmp8+0x18/0x20 [ 415.629618][T17782] __sys_sendmsg+0x105/0x1d0 [ 415.634223][T17782] ? __sys_sendmsg_sock+0xc0/0xc0 [ 415.639243][T17782] ? trace_hardirqs_on_thunk+0x1a/0x1c [ 415.644800][T17782] ? do_syscall_64+0x26/0x790 [ 415.649534][T17782] ? entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 415.655610][T17782] ? do_syscall_64+0x26/0x790 [ 415.660327][T17782] __x64_sys_sendmsg+0x78/0xb0 [ 415.665083][T17782] do_syscall_64+0xfa/0x790 [ 415.669596][T17782] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 415.675496][T17782] RIP: 0033:0x45af49 [ 415.679388][T17782] Code: ad b6 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 7b b6 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 415.699112][T17782] RSP: 002b:00007fdf150e9c78 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 415.707533][T17782] RAX: ffffffffffffffda RBX: 00007fdf150e9c90 RCX: 000000000045af49 [ 415.715678][T17782] RDX: 0000000000000000 RSI: 0000000020000000 RDI: 000000000000000d [ 415.723697][T17782] RBP: 000000000075c118 R08: 0000000000000000 R09: 0000000000000000 [ 415.731678][T17782] R10: 0000000000000000 R11: 0000000000000246 R12: 00007fdf150ea6d4 [ 415.739647][T17782] R13: 00000000004caa0f R14: 00000000004e3eb0 R15: 000000000000000e [ 415.807831][T17751] bridge77: port 2(erspan0) entered blocking state [ 415.814575][T17751] bridge77: port 2(erspan0) entered disabled state [ 415.822598][T17751] device erspan0 entered promiscuous mode 15:24:57 executing program 3: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000340)={'erspan0\x00', 0x0}) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000300)={'syz_tun\x00', 0x0}) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r7, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r6, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000380)=@newlink={0x34, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r8}, [@IFLA_LINKINFO={0x14, 0x12, @bridge={{0xb, 0x1, 'bridge\x00'}, {0x4}}}]}, 0x34}}, 0x0) sendmsg$nl_route(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000002700)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r5}, [@IFLA_MASTER={0x8, 0xa, r8}]}, 0x28}}, 0x0) sendmsg$nl_route(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f00000000c0)=ANY=[@ANYBLOB="2800000010000104000040000000000000001ea6", @ANYRES32=r2, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00\b\x00\n\x00', @ANYRES32=r8], 0x28}}, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r10 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r9, 0x8933, &(0x7f0000000300)={'syz_tun\x00', 0x0}) sendmsg$nl_route(r10, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000040)=@newlink={0x20, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r11}}, 0x20}}, 0x0) [ 415.854583][T17759] netlink: 72 bytes leftover after parsing attributes in process `syz-executor.1'. [ 415.882761][T17763] netlink: 72 bytes leftover after parsing attributes in process `syz-executor.1'. [ 415.901934][T17765] device syz_tun left promiscuous mode [ 415.912204][T17765] bridge227: port 1(syz_tun) entered disabled state [ 416.037907][T17765] bridge228: port 1(syz_tun) entered blocking state [ 416.044899][T17765] bridge228: port 1(syz_tun) entered disabled state [ 416.053088][T17765] device syz_tun entered promiscuous mode [ 416.061204][T17767] device erspan0 left promiscuous mode [ 416.067137][T17767] bridge227: port 2(erspan0) entered disabled state 15:24:58 executing program 4: r0 = socket$inet6(0xa, 0x80003, 0x6b) ioctl(r0, 0x1000008912, &(0x7f00000001c0)="080db5055e0bcfe8476071") r1 = socket(0x10, 0x2, 0x0) sendto(r1, &(0x7f0000000200)="120000001200e7ef007b1a3fcd00000000a1", 0x12, 0x0, 0x0, 0x18) recvmmsg(r1, &(0x7f00000037c0)=[{{&(0x7f0000000600)=@ethernet={0x0, @random}, 0x80, &(0x7f0000000380)=[{&(0x7f0000000040)=""/95, 0x5f}, {&(0x7f00000000c0)=""/85, 0x55}, {&(0x7f00000024c0)=""/4096, 0x1000}, {&(0x7f0000000400)=""/120, 0x78}, {&(0x7f0000000480)=""/60, 0x3c}, {0x0}, {&(0x7f0000000540)=""/154, 0x9a}, {&(0x7f0000000340)=""/22, 0x16}], 0x8, &(0x7f0000002400)=""/191, 0xbf}}], 0x1, 0x6, &(0x7f0000003700)={0x77359400}) [ 416.207792][T17767] bridge228: port 2(erspan0) entered blocking state [ 416.214563][T17767] bridge228: port 2(erspan0) entered disabled state [ 416.226825][T17767] device erspan0 entered promiscuous mode [ 416.243670][T17780] device syz_tun left promiscuous mode [ 416.259948][T17780] bridge217: port 1(syz_tun) entered disabled state [ 416.407872][T17780] bridge218: port 1(syz_tun) entered blocking state [ 416.414687][T17780] bridge218: port 1(syz_tun) entered disabled state [ 416.425027][T17780] device syz_tun entered promiscuous mode [ 416.434161][T17781] device erspan0 left promiscuous mode [ 416.441270][T17781] bridge217: port 2(erspan0) entered disabled state [ 416.577828][T17781] bridge218: port 2(erspan0) entered blocking state [ 416.584750][T17781] bridge218: port 2(erspan0) entered disabled state [ 416.593327][T17781] device erspan0 entered promiscuous mode 15:24:58 executing program 5 (fault-call:16 fault-nth:2): socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000340)={'erspan0\x00', 0x0}) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000300)={'syz_tun\x00', 0x0}) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r7, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r6, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000380)=@newlink={0x34, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r8}, [@IFLA_LINKINFO={0x14, 0x12, @bridge={{0xb, 0x1, 'bridge\x00'}, {0x4}}}]}, 0x34}}, 0x0) sendmsg$nl_route(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000002700)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r5}, [@IFLA_MASTER={0x8, 0xa, r8}]}, 0x28}}, 0x0) sendmsg$nl_route(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f00000000c0)=ANY=[@ANYBLOB="2800000010000104000040000000000000001ea6", @ANYRES32=r2, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00\b\x00\n\x00', @ANYRES32=r8], 0x28}}, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r10 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r9, 0x8933, &(0x7f0000000300)={'syz_tun\x00', 0x0}) sendmsg$nl_route(r10, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000040)=@newlink={0x2c, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r11}, [@IFLA_BROADCAST={0xa}]}, 0x332}}, 0x0) [ 416.627591][T17790] device syz_tun left promiscuous mode [ 416.633613][T17790] bridge77: port 1(syz_tun) entered disabled state 15:24:58 executing program 2: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000340)={'erspan0\x00', 0x0}) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000300)={'syz_tun\x00', 0x0}) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r7, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r6, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000380)=@newlink={0x34, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r8}, [@IFLA_LINKINFO={0x14, 0x12, @bridge={{0xb, 0x1, 'bridge\x00'}, {0x4}}}]}, 0x34}}, 0x0) sendmsg$nl_route(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000002700)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r5}, [@IFLA_MASTER={0x8, 0xa, r8}]}, 0x28}}, 0x0) sendmsg$nl_route(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f00000000c0)=ANY=[@ANYBLOB="2800000010000104000040000000000000001ea6", @ANYRES32=r2, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00\b\x00\n\x00', @ANYRES32=r8], 0x28}}, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r10 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r9, 0x8933, &(0x7f0000000300)={'syz_tun\x00', 0x0}) sendmsg$nl_route(r10, &(0x7f0000000000)={0x0, 0xa, &(0x7f00000000c0)={&(0x7f0000000040)=@newlink={0x2c, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r11}, [@IFLA_BROADCAST={0xa}]}, 0x332}}, 0x0) 15:24:58 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000004c0)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r3, @ANYBLOB="0000000000000000280012000c0001007665746800000000180002001400010000000000", @ANYRES32=0x0, @ANYBLOB], 0x5}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000540)=ANY=[@ANYBLOB="7400000024000705000000000000000000010000", @ANYRES32=r3, @ANYBLOB="00000000ffffffff000000000800010073667100486818973f73461919309b68e1693572bb000229c6090032d0ed64f3c3545aaf6e000085a4e4ebb5ef670000000000000000000000000000001a4e624d29a84abf03265700000000000000000000000000000000000000000000000000000000000000ac20000089b53c947244306a0216a3de887763df5b42498b13bb1938de859ee6d7ae7dd2224dc672b69b4358871b170ea0b667832e5224ee3538f885b7abd9bc4a7d"], 0x74}}, 0x0) r4 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r4, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000300)=ANY=[@ANYBLOB="840000002c00010700"/20, @ANYRES32=r3, @ANYBLOB="0008008000000000030000000800010075333200580002001400050000000000000000000000000000000000400006003c0001000000000000001020898dde66057433b6ef3a41d22be225e0001b0000000000000000000000000017256ffc66e43a2484e1a912c5998bcbf0d0000000000000000000000000000000798a3c067277da1a290b9613a33c575c36fad473382c8f5532ef3f0e1d2c450a7decbf3431a69f9b2ecb3291bed174245a962fe0484676958265e2988326a89db3139d91fe4aee6ae7e745ab00001a9f61f20500000000000000b3958bc14fce6e66a36d1ab3194534ba4e973684b27793bff837d3"], 0x84}}, 0x0) r5 = socket(0x10, 0x80002, 0x0) sendmmsg$alg(r5, &(0x7f0000000140), 0x49249249249278c, 0x0) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r6, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000500)=@newlink={0x20, 0x11, 0x40d, 0x0, 0x0, {0x0, 0x0, 0x0, r8}}, 0x20}}, 0x0) r9 = socket(0x10, 0x80002, 0x0) getsockopt$inet_sctp_SCTP_PEER_AUTH_CHUNKS(0xffffffffffffffff, 0x84, 0x1a, &(0x7f0000000940)=ANY=[@ANYRES32=0x0, @ANYBLOB='\x00'/12], &(0x7f0000000980)=0x10) r10 = socket(0xa, 0x6, 0x0) close(r10) r11 = socket$inet6_sctp(0xa, 0x10000000005, 0x84) setsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX(r11, 0x84, 0x6e, &(0x7f0000000180)=[@in6={0xa, 0x0, 0x0, @remote, 0x9}], 0x1c) getsockopt$inet_sctp6_SCTP_GET_ASSOC_ID_LIST(r11, 0x84, 0x1d, &(0x7f000095dff8)={0x1, [0x0]}, &(0x7f000095dffc)=0x8) setsockopt$inet_sctp_SCTP_RTOINFO(r10, 0x84, 0x0, &(0x7f0000000000)={r12, 0x0, 0x0, 0x1000000}, 0x10) setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(0xffffffffffffffff, 0x84, 0x9, &(0x7f0000000680)={r12, @in={{0x2, 0x4e20, @remote}}, 0x10001, 0xfff7, 0x5, 0x1, 0x8, 0x5, 0xba}, 0x9c) ioctl(r9, 0x1000008912, &(0x7f00000001c0)="080db5055e0bcfe8696071") getsockopt$inet_sctp_SCTP_PEER_AUTH_CHUNKS(r9, 0x84, 0x1a, &(0x7f0000000940)=ANY=[@ANYRES32=0x0, @ANYBLOB='\x00'/12], &(0x7f0000000980)=0x10) r13 = socket$nl_generic(0x10, 0x3, 0x10) r14 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080)='nl80211\x00') r15 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL80211_CMD_GET_STATION(r15, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000240)={0x1c, r14, 0xf2b, 0x0, 0x0, {}, [@NL80211_ATTR_AIRTIME_WEIGHT={0x8}]}, 0x1c}}, 0x0) sendmsg$NL80211_CMD_GET_MPATH(r13, &(0x7f00000001c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x2000}, 0x268, &(0x7f0000000080)={&(0x7f0000000200)={0x40, r14, 0x4, 0x70bd2d, 0x25dfdbff}, 0xff6b}, 0x1, 0x0, 0x0, 0x10049050}, 0x260448c0) sendmsg$NL80211_CMD_NEW_KEY(r9, &(0x7f0000000640)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0xb0024000}, 0xc, &(0x7f00000002c0)={&(0x7f0000000440)={0x7c, r14, 0x23, 0x70bd27, 0x25dfdbff, {}, [@NL80211_ATTR_KEY_DATA_WEP40={0x9, 0x7, "a80875ab12"}, @NL80211_ATTR_KEY={0x5c, 0x50, [@NL80211_KEY_DEFAULT_TYPES={0x14, 0x8, [@NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_MULTICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_MULTICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_MULTICAST={0x4}]}, @NL80211_KEY_DEFAULT_TYPES={0x28, 0x8, [@NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_MULTICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_MULTICAST={0x4}]}, @NL80211_KEY_IDX={0x5, 0x2, 0x5}, @NL80211_KEY_DATA_WEP104={0x11, 0x1, "4d84c4e30151cb27f51a4adf63"}]}]}, 0x7c}, 0x1, 0x0, 0x0, 0x24000}, 0x40) 15:24:58 executing program 0: r0 = socket(0x21, 0xa, 0x1) r1 = socket(0x10, 0x80002, 0x0) ioctl(r1, 0x1000008912, &(0x7f00000001c0)="080db5055e0bcfe8696071") getsockopt$inet_sctp_SCTP_PEER_AUTH_CHUNKS(r1, 0x84, 0x1a, &(0x7f0000000940)=ANY=[@ANYRES32=0x0, @ANYBLOB='\x00'/12], &(0x7f0000000980)=0x10) getsockopt$inet_sctp_SCTP_GET_PEER_ADDR_INFO(r0, 0x84, 0xf, &(0x7f00000009c0)={r2, @in6={{0xa, 0x4e21, 0x8, @local, 0x401}}, 0x9, 0x1, 0x7, 0x7f, 0x6}, &(0x7f0000000a80)=0x98) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000400)='nl80211\x00') sendmsg$NL80211_CMD_GET_MESH_CONFIG(r0, &(0x7f0000000580)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x103190}, 0xc, &(0x7f0000000540)={&(0x7f0000000500)={0x34, r3, 0x10, 0x70bd2d, 0x25dfdbfe, {}, [@NL80211_ATTR_WDEV={0xc, 0x99, {0x1, 0xffffffffffffffff}}, @NL80211_ATTR_WIPHY={0x8, 0x1, 0x1}, @NL80211_ATTR_WDEV={0xc, 0x99, {0x3f, 0x3}}]}, 0x34}, 0x1, 0x0, 0x0, 0x800}, 0x40000) r4 = socket$nl_generic(0x10, 0x3, 0x10) bind$netlink(r4, &(0x7f0000000000)={0x10, 0x0, 0x25dfdbff, 0x1004280}, 0xffffffffffffffb3) sendmsg$nl_generic(r4, &(0x7f0000000080)={&(0x7f0000000480)={0x10, 0xbb7f}, 0xc, &(0x7f0000000440)={&(0x7f00000004c0)={0x1c, 0x22, 0x1, 0x0, 0x0, {0x4}, [@typed={0x8}]}, 0x1c}}, 0x0) socket$netlink(0x10, 0x3, 0x0) r5 = socket$alg(0x26, 0x5, 0x0) bind$alg(r5, &(0x7f0000000080)={0x26, 'hash\x00', 0x0, 0x0, 'sha512\x00'}, 0x58) [ 416.820285][T17790] bridge78: port 1(syz_tun) entered blocking state [ 416.830615][T17790] bridge78: port 1(syz_tun) entered disabled state [ 416.855640][T17790] device syz_tun entered promiscuous mode [ 416.864499][T17791] device erspan0 left promiscuous mode [ 416.870473][T17791] bridge77: port 2(erspan0) entered disabled state [ 416.893089][T17816] FAULT_INJECTION: forcing a failure. [ 416.893089][T17816] name failslab, interval 1, probability 0, space 0, times 0 [ 416.911243][T17816] CPU: 1 PID: 17816 Comm: syz-executor.5 Not tainted 5.5.0-rc5-syzkaller #0 [ 416.919967][T17816] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 416.930030][T17816] Call Trace: [ 416.933336][T17816] dump_stack+0x197/0x210 [ 416.937708][T17816] should_fail.cold+0xa/0x15 [ 416.942326][T17816] ? fault_create_debugfs_attr+0x180/0x180 [ 416.948155][T17816] __should_failslab+0x121/0x190 [ 416.953198][T17816] should_failslab+0x9/0x14 [ 416.957711][T17816] kmem_cache_alloc+0x47/0x710 [ 416.962483][T17816] ? lock_acquire+0x190/0x410 [ 416.967176][T17816] ? netlink_deliver_tap+0x146/0xbe0 [ 416.972595][T17816] skb_clone+0x154/0x3d0 [ 416.976830][T17816] netlink_deliver_tap+0x943/0xbe0 [ 416.981955][T17816] netlink_unicast+0x643/0x7d0 [ 416.986729][T17816] ? netlink_attachskb+0x870/0x870 [ 416.991840][T17816] ? __sanitizer_cov_trace_cmp8+0x18/0x20 [ 416.997551][T17816] ? __check_object_size+0x3d/0x437 [ 417.003619][T17816] netlink_sendmsg+0x91c/0xea0 [ 417.008391][T17816] ? netlink_unicast+0x7d0/0x7d0 [ 417.013361][T17816] ? aa_sock_msg_perm.isra.0+0xba/0x170 [ 417.018921][T17816] ? apparmor_socket_sendmsg+0x2a/0x30 [ 417.024382][T17816] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 417.030637][T17816] ? security_socket_sendmsg+0x8d/0xc0 [ 417.036105][T17816] ? netlink_unicast+0x7d0/0x7d0 [ 417.041045][T17816] sock_sendmsg+0xd7/0x130 [ 417.045458][T17816] ____sys_sendmsg+0x753/0x880 [ 417.050220][T17816] ? kernel_sendmsg+0x50/0x50 [ 417.054902][T17816] ? __fget+0x35d/0x550 [ 417.059065][T17816] ? find_held_lock+0x35/0x130 [ 417.063832][T17816] ___sys_sendmsg+0x100/0x170 [ 417.068516][T17816] ? sendmsg_copy_msghdr+0x70/0x70 [ 417.073641][T17816] ? __kasan_check_read+0x11/0x20 [ 417.078675][T17816] ? __fget+0x37f/0x550 [ 417.082936][T17816] ? ksys_dup3+0x3e0/0x3e0 [ 417.087359][T17816] ? __fget_light+0x1a9/0x230 [ 417.092024][T17816] ? __fdget+0x1b/0x20 [ 417.096112][T17816] ? __sanitizer_cov_trace_const_cmp8+0x18/0x20 [ 417.102358][T17816] __sys_sendmsg+0x105/0x1d0 [ 417.106958][T17816] ? __sys_sendmsg_sock+0xc0/0xc0 [ 417.111988][T17816] ? trace_hardirqs_on_thunk+0x1a/0x1c [ 417.117460][T17816] ? do_syscall_64+0x26/0x790 [ 417.122134][T17816] ? entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 417.128192][T17816] ? do_syscall_64+0x26/0x790 [ 417.132884][T17816] __x64_sys_sendmsg+0x78/0xb0 [ 417.137655][T17816] do_syscall_64+0xfa/0x790 [ 417.142166][T17816] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 417.148069][T17816] RIP: 0033:0x45af49 [ 417.151976][T17816] Code: ad b6 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 7b b6 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 417.171608][T17816] RSP: 002b:00007fdf150e9c78 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 417.180013][T17816] RAX: ffffffffffffffda RBX: 00007fdf150e9c90 RCX: 000000000045af49 [ 417.187991][T17816] RDX: 0000000000000000 RSI: 0000000020000000 RDI: 000000000000000d [ 417.195972][T17816] RBP: 000000000075c118 R08: 0000000000000000 R09: 0000000000000000 [ 417.203948][T17816] R10: 0000000000000000 R11: 0000000000000246 R12: 00007fdf150ea6d4 [ 417.211917][T17816] R13: 00000000004caa0f R14: 00000000004e3eb0 R15: 000000000000000e [ 417.307783][T17791] bridge78: port 2(erspan0) entered blocking state [ 417.314688][T17791] bridge78: port 2(erspan0) entered disabled state [ 417.327998][T17791] device erspan0 entered promiscuous mode [ 417.345040][T17805] netlink: 72 bytes leftover after parsing attributes in process `syz-executor.1'. 15:24:59 executing program 4: r0 = socket$inet6(0xa, 0x80003, 0x6b) ioctl(r0, 0x1000008912, &(0x7f00000001c0)="080db5055e0bcfe8476071") r1 = socket(0x10, 0x2, 0x0) sendto(r1, &(0x7f0000000200)="120000001200e7ef007b1a3fcd00000000a1", 0x12, 0x0, 0x0, 0x18) recvmmsg(r1, &(0x7f00000037c0)=[{{&(0x7f0000000600)=@ethernet={0x0, @random}, 0x80, &(0x7f0000000380)=[{&(0x7f0000000040)=""/95, 0x5f}, {&(0x7f00000000c0)=""/85, 0x55}, {&(0x7f00000024c0)=""/4096, 0x1000}, {&(0x7f0000000400)=""/120, 0x78}, {&(0x7f0000000480)=""/60, 0x3c}, {0x0}, {&(0x7f0000000540)=""/154, 0x9a}, {&(0x7f0000000340)=""/22, 0x16}], 0x8, &(0x7f0000002400)=""/191, 0xbf}}], 0x1, 0x6, &(0x7f0000003700)={0x77359400}) 15:24:59 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000004c0)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r3, @ANYBLOB="0000000000000000280012000c0001007665746800000000180002001400010000000000", @ANYRES32=0x0], 0x4}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000540)=ANY=[@ANYBLOB="7400000024000705000000000000000000010000", @ANYRES32=r3, @ANYBLOB="00000000ffffffff000000000800010073667100486818973f73461919309b68e1693572bb000229c6090032d0ed64f3c3545aaf6e000085a4e4ebb5ef670000000000000000000000000000001a4e624d29a84abf03265700000000000000000000000000000000000000000000000000000000000000ac20000089b53c947244306a0216a3de887763df5b42498b13bb1938de859ee6d7ae7dd2224dc672b69b4358871b170ea0b667832e5224ee3538f885b7abd9bc4a7d"], 0x74}}, 0x0) r4 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r4, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000300)=ANY=[@ANYBLOB="840000002c00010700"/20, @ANYRES32=r3, @ANYBLOB="0008008000000000030000000800010075333200580002001400050000000000000000000000000000000000400006003c0001000000000000001020898dde66057433b6ef3a41d22be225e0001b0000000000000000000000000017256ffc66e43a2484e1a912c5998bcbf0d0000000000000000000000000000000798a3c067277da1a290b9613a33c575c36fad473382c8f5532ef3f0e1d2c450a7decbf3431a69f9b2ecb3291bed174245a962fe0484676958265e2988326a89db3139d91fe4aee6ae7e745ab00001a9f61f20500000000000000b3958bc14fce6e66a36d1ab3194534ba4e973684b27793bff837d3"], 0x84}}, 0x0) r5 = socket(0x10, 0x80002, 0x0) sendmmsg$alg(r5, &(0x7f0000000140), 0x49249249249278c, 0x0) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r6, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000500)=@newlink={0x20, 0x11, 0x40d, 0x0, 0x0, {0x0, 0x0, 0x0, r8}}, 0x20}}, 0x0) r9 = socket(0x10, 0x80002, 0x0) getsockopt$inet_sctp_SCTP_PEER_AUTH_CHUNKS(0xffffffffffffffff, 0x84, 0x1a, &(0x7f0000000940)=ANY=[@ANYRES32=0x0, @ANYBLOB='\x00'/12], &(0x7f0000000980)=0x10) r10 = socket(0xa, 0x6, 0x0) close(r10) r11 = socket$inet6_sctp(0xa, 0x10000000005, 0x84) setsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX(r11, 0x84, 0x6e, &(0x7f0000000180)=[@in6={0xa, 0x0, 0x0, @remote, 0x9}], 0x1c) getsockopt$inet_sctp6_SCTP_GET_ASSOC_ID_LIST(r11, 0x84, 0x1d, &(0x7f000095dff8)={0x1, [0x0]}, &(0x7f000095dffc)=0x8) setsockopt$inet_sctp_SCTP_RTOINFO(r10, 0x84, 0x0, &(0x7f0000000000)={r12, 0x0, 0x0, 0x1000000}, 0x10) setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(0xffffffffffffffff, 0x84, 0x9, &(0x7f0000000680)={r12, @in={{0x2, 0x4e20, @remote}}, 0x10001, 0xfff7, 0x5, 0x1, 0x8, 0x5, 0xba}, 0x9c) ioctl(r9, 0x1000008912, &(0x7f00000001c0)="080db5055e0bcfe8696071") getsockopt$inet_sctp_SCTP_PEER_AUTH_CHUNKS(r9, 0x84, 0x1a, &(0x7f0000000940)=ANY=[@ANYRES32=0x0, @ANYBLOB='\x00'/12], &(0x7f0000000980)=0x10) r13 = socket$nl_generic(0x10, 0x3, 0x10) r14 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080)='nl80211\x00') r15 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL80211_CMD_GET_STATION(r15, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000240)={0x1c, r14, 0xf2b, 0x0, 0x0, {}, [@NL80211_ATTR_AIRTIME_WEIGHT={0x8}]}, 0x1c}}, 0x0) sendmsg$NL80211_CMD_GET_MPATH(r13, &(0x7f00000001c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x2000}, 0x268, &(0x7f0000000080)={&(0x7f0000000200)={0x40, r14, 0x4, 0x70bd2d, 0x25dfdbff}, 0xff6b}, 0x1, 0x0, 0x0, 0x10049050}, 0x260448c0) sendmsg$NL80211_CMD_NEW_KEY(r9, &(0x7f0000000640)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0xb0024000}, 0xc, &(0x7f00000002c0)={&(0x7f0000000440)={0x7c, r14, 0x23, 0x70bd27, 0x25dfdbff, {}, [@NL80211_ATTR_KEY_DATA_WEP40={0x9, 0x7, "a80875ab12"}, @NL80211_ATTR_KEY={0x5c, 0x50, [@NL80211_KEY_DEFAULT_TYPES={0x14, 0x8, [@NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_MULTICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_MULTICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_MULTICAST={0x4}]}, @NL80211_KEY_DEFAULT_TYPES={0x28, 0x8, [@NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_MULTICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_MULTICAST={0x4}]}, @NL80211_KEY_IDX={0x5, 0x2, 0x5}, @NL80211_KEY_DATA_WEP104={0x11, 0x1, "4d84c4e30151cb27f51a4adf63"}]}]}, 0x7c}, 0x1, 0x0, 0x0, 0x24000}, 0x40) [ 417.367956][T17807] device syz_tun left promiscuous mode [ 417.373657][T17807] bridge218: port 1(syz_tun) entered disabled state [ 417.511879][T17807] bridge219: port 1(syz_tun) entered blocking state [ 417.518739][T17807] bridge219: port 1(syz_tun) entered disabled state [ 417.526949][T17807] device syz_tun entered promiscuous mode [ 417.541659][T17811] netlink: 72 bytes leftover after parsing attributes in process `syz-executor.1'. [ 417.552816][T17812] device erspan0 left promiscuous mode [ 417.558654][T17812] bridge218: port 2(erspan0) entered disabled state [ 417.680219][T17812] bridge219: port 2(erspan0) entered blocking state [ 417.686898][T17812] bridge219: port 2(erspan0) entered disabled state [ 417.696072][T17812] device erspan0 entered promiscuous mode [ 417.704105][T17813] device syz_tun left promiscuous mode [ 417.710180][T17813] bridge228: port 1(syz_tun) entered disabled state [ 417.829110][T17813] bridge229: port 1(syz_tun) entered blocking state [ 417.836325][T17813] bridge229: port 1(syz_tun) entered disabled state [ 417.844842][T17813] device syz_tun entered promiscuous mode [ 417.868375][T17817] device erspan0 left promiscuous mode [ 417.876175][T17817] bridge228: port 2(erspan0) entered disabled state [ 417.997850][T17817] bridge229: port 2(erspan0) entered blocking state [ 418.004733][T17817] bridge229: port 2(erspan0) entered disabled state [ 418.017339][T17817] device erspan0 entered promiscuous mode [ 418.033866][T17830] netlink: 72 bytes leftover after parsing attributes in process `syz-executor.3'. 15:25:00 executing program 5: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000340)={'erspan0\x00', 0x0}) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000300)={'syz_tun\x00', 0x0}) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r7, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r6, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000380)=@newlink={0x34, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r8}, [@IFLA_LINKINFO={0x14, 0x12, @bridge={{0xb, 0x1, 'bridge\x00'}, {0x4}}}]}, 0x34}}, 0x0) sendmsg$nl_route(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000002700)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r5}, [@IFLA_MASTER={0x8, 0xa, r8}]}, 0x28}}, 0x0) sendmsg$nl_route(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f00000000c0)=ANY=[@ANYBLOB="2800000010000104000040000000000000001ea6", @ANYRES32=r2, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00\b\x00\n\x00', @ANYRES32=r8], 0x28}}, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r10 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r9, 0x8933, &(0x7f0000000300)={'syz_tun\x00', 0x0}) sendmsg$nl_route(r10, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000040)=@newlink={0x2c, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r11}, [@IFLA_BROADCAST={0xa}]}, 0x332}}, 0x0) 15:25:00 executing program 4: r0 = socket$inet6(0xa, 0x80003, 0x6b) ioctl(r0, 0x1000008912, &(0x7f00000001c0)="080db5055e0bcfe8476071") r1 = socket(0x10, 0x2, 0x0) sendto(r1, &(0x7f0000000200)="120000001200e7ef007b1a3fcd00000000a1", 0x12, 0x0, 0x0, 0x18) recvmmsg(r1, &(0x7f00000037c0)=[{{&(0x7f0000000600)=@ethernet={0x0, @random}, 0x80, &(0x7f0000000380)=[{&(0x7f0000000040)=""/95, 0x5f}, {&(0x7f00000000c0)=""/85, 0x55}, {&(0x7f00000024c0)=""/4096, 0x1000}, {&(0x7f0000000400)=""/120, 0x78}, {&(0x7f0000000280)=""/77, 0x4d}, {&(0x7f0000000540)=""/154, 0x9a}, {&(0x7f0000000340)=""/22, 0x16}], 0x7, &(0x7f0000002400)=""/191, 0xbf}}], 0x1, 0x6, &(0x7f0000003700)={0x77359400}) [ 418.057740][T17832] netlink: 72 bytes leftover after parsing attributes in process `syz-executor.3'. 15:25:00 executing program 2: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000340)={'erspan0\x00', 0x0}) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000300)={'syz_tun\x00', 0x0}) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r7, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r6, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000380)=@newlink={0x34, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r8}, [@IFLA_LINKINFO={0x14, 0x12, @bridge={{0xb, 0x1, 'bridge\x00'}, {0x4}}}]}, 0x34}}, 0x0) sendmsg$nl_route(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000002700)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r5}, [@IFLA_MASTER={0x8, 0xa, r8}]}, 0x28}}, 0x0) sendmsg$nl_route(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f00000000c0)=ANY=[@ANYBLOB="2800000010000104000040000000000000001ea6", @ANYRES32=r2, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00\b\x00\n\x00', @ANYRES32=r8], 0x28}}, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r10 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r9, 0x8933, &(0x7f0000000300)={'syz_tun\x00', 0x0}) sendmsg$nl_route(r10, &(0x7f0000000000)={0x0, 0xc, &(0x7f00000000c0)={&(0x7f0000000040)=@newlink={0x2c, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r11}, [@IFLA_BROADCAST={0xa}]}, 0x332}}, 0x0) 15:25:00 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000004c0)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r3, @ANYBLOB="0000000000000000280012000c0001007665746800000000180002001400010000000000", @ANYRES32=0x0, @ANYBLOB], 0x5}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000540)=ANY=[@ANYBLOB="7400000024000705000000000000000000010000", @ANYRES32=r3, @ANYBLOB="00000000ffffffff000000000800010073667100486818973f73461919309b68e1693572bb000229c6090032d0ed64f3c3545aaf6e000085a4e4ebb5ef670000000000000000000000000000001a4e624d29a84abf03265700000000000000000000000000000000000000000000000000000000000000ac20000089b53c947244306a0216a3de887763df5b42498b13bb1938de859ee6d7ae7dd2224dc672b69b4358871b170ea0b667832e5224ee3538f885b7abd9bc4a7d"], 0x74}}, 0x0) r4 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r4, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000300)=ANY=[@ANYBLOB="840000002c00010700"/20, @ANYRES32=r3, @ANYBLOB="0008008000000000030000000800010075333200580002001400050000000000000000000000000000000000400006003c0001000000000000001020898dde66057433b6ef3a41d22be225e0001b0000000000000000000000000017256ffc66e43a2484e1a912c5998bcbf0d0000000000000000000000000000000798a3c067277da1a290b9613a33c575c36fad473382c8f5532ef3f0e1d2c450a7decbf3431a69f9b2ecb3291bed174245a962fe0484676958265e2988326a89db3139d91fe4aee6ae7e745ab00001a9f61f20500000000000000b3958bc14fce6e66a36d1ab3194534ba4e973684b27793bff837d3"], 0x84}}, 0x0) r5 = socket(0x10, 0x80002, 0x0) sendmmsg$alg(r5, &(0x7f0000000140), 0x49249249249278c, 0x0) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r6, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000500)=@newlink={0x20, 0x11, 0x40d, 0x0, 0x0, {0x0, 0x0, 0x0, r8}}, 0x20}}, 0x0) r9 = socket(0x10, 0x80002, 0x0) getsockopt$inet_sctp_SCTP_PEER_AUTH_CHUNKS(0xffffffffffffffff, 0x84, 0x1a, &(0x7f0000000940)=ANY=[@ANYRES32=0x0, @ANYBLOB='\x00'/12], &(0x7f0000000980)=0x10) r10 = socket(0xa, 0x6, 0x0) close(r10) r11 = socket$inet6_sctp(0xa, 0x10000000005, 0x84) setsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX(r11, 0x84, 0x6e, &(0x7f0000000180)=[@in6={0xa, 0x0, 0x0, @remote, 0x9}], 0x1c) getsockopt$inet_sctp6_SCTP_GET_ASSOC_ID_LIST(r11, 0x84, 0x1d, &(0x7f000095dff8)={0x1, [0x0]}, &(0x7f000095dffc)=0x8) setsockopt$inet_sctp_SCTP_RTOINFO(r10, 0x84, 0x0, &(0x7f0000000000)={r12, 0x0, 0x0, 0x1000000}, 0x10) setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(0xffffffffffffffff, 0x84, 0x9, &(0x7f0000000680)={r12, @in={{0x2, 0x4e20, @remote}}, 0x10001, 0xfff7, 0x5, 0x1, 0x8, 0x5, 0xba}, 0x9c) ioctl(r9, 0x1000008912, &(0x7f00000001c0)="080db5055e0bcfe8696071") getsockopt$inet_sctp_SCTP_PEER_AUTH_CHUNKS(r9, 0x84, 0x1a, &(0x7f0000000940)=ANY=[@ANYRES32=0x0, @ANYBLOB='\x00'/12], &(0x7f0000000980)=0x10) r13 = socket$nl_generic(0x10, 0x3, 0x10) r14 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080)='nl80211\x00') r15 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL80211_CMD_GET_STATION(r15, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000240)={0x1c, r14, 0xf2b, 0x0, 0x0, {}, [@NL80211_ATTR_AIRTIME_WEIGHT={0x8}]}, 0x1c}}, 0x0) sendmsg$NL80211_CMD_GET_MPATH(r13, &(0x7f00000001c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x2000}, 0x268, &(0x7f0000000080)={&(0x7f0000000200)={0x40, r14, 0x4, 0x70bd2d, 0x25dfdbff}, 0xff6b}, 0x1, 0x0, 0x0, 0x10049050}, 0x260448c0) sendmsg$NL80211_CMD_NEW_KEY(r9, &(0x7f0000000640)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0xb0024000}, 0xc, &(0x7f00000002c0)={&(0x7f0000000440)={0x7c, r14, 0x23, 0x70bd27, 0x25dfdbff, {}, [@NL80211_ATTR_KEY_DATA_WEP40={0x9, 0x7, "a80875ab12"}, @NL80211_ATTR_KEY={0x5c, 0x50, [@NL80211_KEY_DEFAULT_TYPES={0x14, 0x8, [@NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_MULTICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_MULTICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_MULTICAST={0x4}]}, @NL80211_KEY_DEFAULT_TYPES={0x28, 0x8, [@NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_MULTICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_MULTICAST={0x4}]}, @NL80211_KEY_IDX={0x5, 0x2, 0x5}, @NL80211_KEY_DATA_WEP104={0x11, 0x1, "4d84c4e30151cb27f51a4adf63"}]}]}, 0x7c}, 0x1, 0x0, 0x0, 0x24000}, 0x40) 15:25:00 executing program 0: r0 = socket(0x21, 0xa, 0x1) r1 = socket(0x10, 0x80002, 0x0) ioctl(r1, 0x1000008912, &(0x7f00000001c0)="080db5055e0bcfe8696071") getsockopt$inet_sctp_SCTP_PEER_AUTH_CHUNKS(r1, 0x84, 0x1a, &(0x7f0000000940)=ANY=[@ANYRES32=0x0, @ANYBLOB='\x00'/12], &(0x7f0000000980)=0x10) getsockopt$inet_sctp_SCTP_GET_PEER_ADDR_INFO(r0, 0x84, 0xf, &(0x7f00000009c0)={r2, @in6={{0xa, 0x4e21, 0x8, @local, 0x401}}, 0x9, 0x1, 0x7, 0x7f, 0x6}, &(0x7f0000000a80)=0x98) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000400)='nl80211\x00') sendmsg$NL80211_CMD_GET_MESH_CONFIG(r0, &(0x7f0000000580)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x103190}, 0xc, &(0x7f0000000540)={&(0x7f0000000500)={0x34, r3, 0x10, 0x70bd2d, 0x25dfdbfe, {}, [@NL80211_ATTR_WDEV={0xc, 0x99, {0x1, 0xffffffffffffffff}}, @NL80211_ATTR_WIPHY={0x8, 0x1, 0x1}, @NL80211_ATTR_WDEV={0xc, 0x99, {0x3f, 0x3}}]}, 0x34}, 0x1, 0x0, 0x0, 0x800}, 0x40000) r4 = socket$nl_generic(0x10, 0x3, 0x10) bind$netlink(r4, &(0x7f0000000000)={0x10, 0x0, 0x25dfdbff, 0x1004280}, 0xffffffffffffffb3) sendmsg$nl_generic(r4, &(0x7f0000000080)={&(0x7f0000000480)={0x10, 0xbb7f}, 0xc, &(0x7f0000000440)={&(0x7f00000004c0)={0x1c, 0x22, 0x1, 0x0, 0x0, {0x4}, [@typed={0x8}]}, 0x1c}}, 0x0) socket$netlink(0x10, 0x3, 0x0) r5 = socket$alg(0x26, 0x5, 0x0) bind$alg(r5, &(0x7f0000000080)={0x26, 'hash\x00', 0x0, 0x0, 'sha512\x00'}, 0x58) 15:25:00 executing program 4: r0 = socket$inet6(0xa, 0x80003, 0x6b) ioctl(r0, 0x1000008912, &(0x7f00000001c0)="080db5055e0bcfe8476071") r1 = socket(0x10, 0x2, 0x0) sendto(r1, &(0x7f0000000200)="120000001200e7ef007b1a3fcd00000000a1", 0x12, 0x0, 0x0, 0x18) recvmmsg(r1, &(0x7f00000037c0)=[{{&(0x7f0000000600)=@ethernet={0x0, @random}, 0x80, &(0x7f0000000380)=[{&(0x7f0000000040)=""/95, 0x5f}, {&(0x7f00000000c0)=""/85, 0x55}, {&(0x7f00000024c0)=""/4096, 0x1000}, {&(0x7f0000000400)=""/120, 0x78}, {&(0x7f0000000280)=""/77, 0x4d}, {&(0x7f0000000540)=""/154, 0x9a}, {&(0x7f0000000340)=""/22, 0x16}], 0x7, &(0x7f0000002400)=""/191, 0xbf}}], 0x1, 0x6, &(0x7f0000003700)={0x77359400}) 15:25:00 executing program 3: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000340)={'erspan0\x00', 0x0}) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000300)={'syz_tun\x00', 0x0}) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r7, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r6, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000380)=@newlink={0x34, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r8}, [@IFLA_LINKINFO={0x14, 0x12, @bridge={{0xb, 0x1, 'bridge\x00'}, {0x4}}}]}, 0x34}}, 0x0) sendmsg$nl_route(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000002700)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r5}, [@IFLA_MASTER={0x8, 0xa, r8}]}, 0x28}}, 0x0) sendmsg$nl_route(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f00000000c0)=ANY=[@ANYBLOB="2800000010000104000040000000000000001ea6", @ANYRES32=r2, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00\b\x00\n\x00', @ANYRES32=r8], 0x28}}, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r10 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r9, 0x8933, &(0x7f0000000300)={'syz_tun\x00', 0x0}) sendmsg$nl_route(r10, &(0x7f0000000000)={0x0, 0xa, &(0x7f00000000c0)={&(0x7f0000000040)=@newlink={0x2c, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r11}, [@IFLA_BROADCAST={0xa}]}, 0x332}}, 0x0) [ 418.388373][T17853] device syz_tun left promiscuous mode [ 418.394084][T17853] bridge229: port 1(syz_tun) entered disabled state [ 418.591332][T17853] bridge230: port 1(syz_tun) entered blocking state [ 418.598280][T17853] bridge230: port 1(syz_tun) entered disabled state [ 418.606701][T17853] device syz_tun entered promiscuous mode [ 418.615406][T17856] device syz_tun left promiscuous mode [ 418.624005][T17856] bridge219: port 1(syz_tun) entered disabled state [ 418.749102][T17856] bridge220: port 1(syz_tun) entered blocking state [ 418.756225][T17856] bridge220: port 1(syz_tun) entered disabled state [ 418.765488][T17856] device syz_tun entered promiscuous mode [ 418.773404][T17854] netlink: 72 bytes leftover after parsing attributes in process `syz-executor.1'. [ 418.795325][T17850] device erspan0 left promiscuous mode [ 418.803122][T17850] bridge229: port 2(erspan0) entered disabled state [ 418.929865][T17850] bridge230: port 2(erspan0) entered blocking state [ 418.936828][T17850] bridge230: port 2(erspan0) entered disabled state [ 418.945836][T17850] device erspan0 entered promiscuous mode [ 418.954380][T17859] netlink: 72 bytes leftover after parsing attributes in process `syz-executor.1'. [ 418.983002][T17846] device erspan0 left promiscuous mode [ 418.990342][T17846] bridge219: port 2(erspan0) entered disabled state [ 419.117796][T17846] bridge220: port 2(erspan0) entered blocking state [ 419.130164][T17846] bridge220: port 2(erspan0) entered disabled state [ 419.142602][T17846] device erspan0 entered promiscuous mode 15:25:01 executing program 5: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000340)={'erspan0\x00', 0x0}) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000300)={'syz_tun\x00', 0x0}) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r7, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r6, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000380)=@newlink={0x34, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r8}, [@IFLA_LINKINFO={0x14, 0x12, @bridge={{0xb, 0x1, 'bridge\x00'}, {0x4}}}]}, 0x34}}, 0x0) sendmsg$nl_route(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000002700)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r5}, [@IFLA_MASTER={0x8, 0xa, r8}]}, 0x28}}, 0x0) sendmsg$nl_route(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f00000000c0)=ANY=[@ANYBLOB="2800000010000104000040000000000000001ea6", @ANYRES32=r2, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00\b\x00\n\x00', @ANYRES32=r8], 0x28}}, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r10 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r9, 0x8933, &(0x7f0000000300)={'syz_tun\x00', 0x0}) sendmsg$nl_route(r10, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000040)=@newlink={0x2c, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r11}, [@IFLA_BROADCAST={0xa}]}, 0x332}}, 0x0) [ 419.166937][T17872] device syz_tun left promiscuous mode [ 419.178099][T17872] bridge78: port 1(syz_tun) entered disabled state [ 419.287807][T17872] bridge79: port 1(syz_tun) entered blocking state [ 419.294675][T17872] bridge79: port 1(syz_tun) entered disabled state [ 419.304348][T17872] device syz_tun entered promiscuous mode [ 419.313362][T17875] device erspan0 left promiscuous mode [ 419.319914][T17875] bridge78: port 2(erspan0) entered disabled state [ 419.438215][T17875] bridge79: port 2(erspan0) entered blocking state [ 419.445035][T17875] bridge79: port 2(erspan0) entered disabled state [ 419.453936][T17875] device erspan0 entered promiscuous mode 15:25:01 executing program 3: getpeername(0xffffffffffffffff, 0x0, &(0x7f0000000180)) r0 = socket$packet(0x11, 0x2, 0x300) setsockopt$SO_ATTACH_FILTER(r0, 0x1, 0x1a, &(0x7f0000fbe000)={0x1, &(0x7f0000000080)=[{0x0, 0x0, 0x0, 0xfffff00c}]}, 0x10) r1 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$sock_int(r1, 0x1, 0x6, 0x0, 0x0) pipe(&(0x7f00000001c0)) r2 = socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_UMEM_REG(r2, 0x11b, 0x4, 0x0, 0x0) getuid() getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, &(0x7f0000000480)) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cpu.stat\x00', 0x275a, 0x0) write$binfmt_script(r3, &(0x7f0000000040)=ANY=[], 0x2343a726) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r3, 0x0) ioctl$EXT4_IOC_SWAP_BOOT(r3, 0x6611) getsockopt$inet_IP_IPSEC_POLICY(0xffffffffffffffff, 0x0, 0x10, 0x0, &(0x7f00000005c0)) r4 = socket$inet_tcp(0x2, 0x1, 0x0) ioctl$sock_FIOGETOWN(r4, 0x8903, &(0x7f0000000040)) r5 = socket(0x21, 0xa, 0x1) r6 = socket(0x10, 0x80002, 0x0) ioctl(r6, 0x1000008912, &(0x7f00000001c0)="080db5055e0bcfe8696071") getsockopt$inet_sctp_SCTP_PEER_AUTH_CHUNKS(r6, 0x84, 0x1a, &(0x7f00000000c0)=ANY=[@ANYRES32=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00q\x00\x00\x00\x00\x00\x00'], &(0x7f0000000980)=0x10) getsockopt$inet_sctp_SCTP_GET_PEER_ADDR_INFO(r5, 0x84, 0xf, &(0x7f00000009c0)={r7, @in6={{0xa, 0x4e21, 0x8, @local, 0x401}}, 0x9, 0x1, 0x7, 0x7f, 0x6}, &(0x7f0000000a80)=0x98) accept4$packet(r3, &(0x7f0000000340)={0x11, 0x0, 0x0}, &(0x7f0000000380)=0x14, 0x80c00) bind$packet(r5, &(0x7f00000003c0)={0x11, 0x17, r8, 0x1, 0x0, 0x6, @remote}, 0x14) socket(0x10, 0x0, 0x0) r9 = socket$inet6(0xa, 0x2, 0x0) bind$inet6(r9, &(0x7f0000000000), 0x1c) connect$inet6(r9, &(0x7f00000002c0)={0xa, 0x4e24}, 0x1c) sendmmsg(r9, &(0x7f00000092c0), 0x4ff, 0x0) socket$inet6(0xa, 0x0, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cpu.stat\x00', 0x275a, 0x0) 15:25:01 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000004c0)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r3, @ANYBLOB="0000000000000000280012000c0001007665746800000000180002001400010000000000", @ANYRES32=0x0, @ANYBLOB], 0x5}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000540)=ANY=[@ANYBLOB="7400000024000705000000000000000000010000", @ANYRES32=r3, @ANYBLOB="00000000ffffffff000000000800010073667100486818973f73461919309b68e1693572bb000229c6090032d0ed64f3c3545aaf6e000085a4e4ebb5ef670000000000000000000000000000001a4e624d29a84abf03265700000000000000000000000000000000000000000000000000000000000000ac20000089b53c947244306a0216a3de887763df5b42498b13bb1938de859ee6d7ae7dd2224dc672b69b4358871b170ea0b667832e5224ee3538f885b7abd9bc4a7d"], 0x74}}, 0x0) r4 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r4, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000300)=ANY=[@ANYBLOB="840000002c00010700"/20, @ANYRES32=r3, @ANYBLOB="0008008000000000030000000800010075333200580002001400050000000000000000000000000000000000400006003c0001000000000000001020898dde66057433b6ef3a41d22be225e0001b0000000000000000000000000017256ffc66e43a2484e1a912c5998bcbf0d0000000000000000000000000000000798a3c067277da1a290b9613a33c575c36fad473382c8f5532ef3f0e1d2c450a7decbf3431a69f9b2ecb3291bed174245a962fe0484676958265e2988326a89db3139d91fe4aee6ae7e745ab00001a9f61f20500000000000000b3958bc14fce6e66a36d1ab3194534ba4e973684b27793bff837d3"], 0x84}}, 0x0) r5 = socket(0x10, 0x80002, 0x0) sendmmsg$alg(r5, &(0x7f0000000140), 0x49249249249278c, 0x0) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r6, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000500)=@newlink={0x20, 0x11, 0x40d, 0x0, 0x0, {0x0, 0x0, 0x0, r8}}, 0x20}}, 0x0) r9 = socket(0x10, 0x80002, 0x0) getsockopt$inet_sctp_SCTP_PEER_AUTH_CHUNKS(0xffffffffffffffff, 0x84, 0x1a, &(0x7f0000000940)=ANY=[@ANYRES32=0x0, @ANYBLOB='\x00'/12], &(0x7f0000000980)=0x10) r10 = socket(0xa, 0x6, 0x0) close(r10) r11 = socket$inet6_sctp(0xa, 0x10000000005, 0x84) setsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX(r11, 0x84, 0x6e, &(0x7f0000000180)=[@in6={0xa, 0x0, 0x0, @remote, 0x9}], 0x1c) getsockopt$inet_sctp6_SCTP_GET_ASSOC_ID_LIST(r11, 0x84, 0x1d, &(0x7f000095dff8)={0x1, [0x0]}, &(0x7f000095dffc)=0x8) setsockopt$inet_sctp_SCTP_RTOINFO(r10, 0x84, 0x0, &(0x7f0000000000)={r12, 0x0, 0x0, 0x1000000}, 0x10) setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(0xffffffffffffffff, 0x84, 0x9, &(0x7f0000000680)={r12, @in={{0x2, 0x4e20, @remote}}, 0x10001, 0xfff7, 0x5, 0x1, 0x8, 0x5, 0xba}, 0x9c) ioctl(r9, 0x1000008912, &(0x7f00000001c0)="080db5055e0bcfe8696071") getsockopt$inet_sctp_SCTP_PEER_AUTH_CHUNKS(r9, 0x84, 0x1a, &(0x7f0000000940)=ANY=[@ANYRES32=0x0, @ANYBLOB='\x00'/12], &(0x7f0000000980)=0x10) r13 = socket$nl_generic(0x10, 0x3, 0x10) r14 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080)='nl80211\x00') r15 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL80211_CMD_GET_STATION(r15, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000240)={0x1c, r14, 0xf2b, 0x0, 0x0, {}, [@NL80211_ATTR_AIRTIME_WEIGHT={0x8}]}, 0x1c}}, 0x0) sendmsg$NL80211_CMD_GET_MPATH(r13, &(0x7f00000001c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x2000}, 0x268, &(0x7f0000000080)={&(0x7f0000000200)={0x40, r14, 0x4, 0x70bd2d, 0x25dfdbff}, 0xff6b}, 0x1, 0x0, 0x0, 0x10049050}, 0x260448c0) sendmsg$NL80211_CMD_NEW_KEY(r9, &(0x7f0000000640)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0xb0024000}, 0xc, &(0x7f00000002c0)={&(0x7f0000000440)={0x7c, r14, 0x23, 0x70bd27, 0x25dfdbff, {}, [@NL80211_ATTR_KEY_DATA_WEP40={0x9, 0x7, "a80875ab12"}, @NL80211_ATTR_KEY={0x5c, 0x50, [@NL80211_KEY_DEFAULT_TYPES={0x14, 0x8, [@NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_MULTICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_MULTICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_MULTICAST={0x4}]}, @NL80211_KEY_DEFAULT_TYPES={0x28, 0x8, [@NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_MULTICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_MULTICAST={0x4}]}, @NL80211_KEY_IDX={0x5, 0x2, 0x5}, @NL80211_KEY_DATA_WEP104={0x11, 0x1, "4d84c4e30151cb27f51a4adf63"}]}]}, 0x7c}, 0x1, 0x0, 0x0, 0x24000}, 0x40) 15:25:01 executing program 4: r0 = socket$inet6(0xa, 0x80003, 0x6b) ioctl(r0, 0x1000008912, &(0x7f00000001c0)="080db5055e0bcfe8476071") r1 = socket(0x10, 0x2, 0x0) sendto(r1, &(0x7f0000000200)="120000001200e7ef007b1a3fcd00000000a1", 0x12, 0x0, 0x0, 0x18) recvmmsg(r1, &(0x7f00000037c0)=[{{&(0x7f0000000600)=@ethernet={0x0, @random}, 0x80, &(0x7f0000000380)=[{&(0x7f0000000040)=""/95, 0x5f}, {&(0x7f00000000c0)=""/85, 0x55}, {&(0x7f00000024c0)=""/4096, 0x1000}, {&(0x7f0000000400)=""/120, 0x78}, {&(0x7f0000000280)=""/77, 0x4d}, {&(0x7f0000000540)=""/154, 0x9a}, {&(0x7f0000000340)=""/22, 0x16}], 0x7, &(0x7f0000002400)=""/191, 0xbf}}], 0x1, 0x6, &(0x7f0000003700)={0x77359400}) [ 419.504223][T17885] device syz_tun left promiscuous mode [ 419.522611][T17885] bridge220: port 1(syz_tun) entered disabled state 15:25:01 executing program 2: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000340)={'erspan0\x00', 0x0}) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000300)={'syz_tun\x00', 0x0}) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r7, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r6, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000380)=@newlink={0x34, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r8}, [@IFLA_LINKINFO={0x14, 0x12, @bridge={{0xb, 0x1, 'bridge\x00'}, {0x4}}}]}, 0x34}}, 0x0) sendmsg$nl_route(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000002700)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r5}, [@IFLA_MASTER={0x8, 0xa, r8}]}, 0x28}}, 0x0) sendmsg$nl_route(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f00000000c0)=ANY=[@ANYBLOB="2800000010000104000040000000000000001ea6", @ANYRES32=r2, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00\b\x00\n\x00', @ANYRES32=r8], 0x28}}, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r10 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r9, 0x8933, &(0x7f0000000300)={'syz_tun\x00', 0x0}) sendmsg$nl_route(r10, &(0x7f0000000000)={0x0, 0xe, &(0x7f00000000c0)={&(0x7f0000000040)=@newlink={0x2c, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r11}, [@IFLA_BROADCAST={0xa}]}, 0x332}}, 0x0) 15:25:01 executing program 0: r0 = socket(0x21, 0xa, 0x1) r1 = socket(0x10, 0x80002, 0x0) ioctl(r1, 0x1000008912, &(0x7f00000001c0)="080db5055e0bcfe8696071") getsockopt$inet_sctp_SCTP_PEER_AUTH_CHUNKS(r1, 0x84, 0x1a, &(0x7f0000000940)=ANY=[@ANYRES32=0x0, @ANYBLOB='\x00'/12], &(0x7f0000000980)=0x10) getsockopt$inet_sctp_SCTP_GET_PEER_ADDR_INFO(r0, 0x84, 0xf, &(0x7f00000009c0)={r2, @in6={{0xa, 0x4e21, 0x8, @local, 0x401}}, 0x9, 0x1, 0x7, 0x7f, 0x6}, &(0x7f0000000a80)=0x98) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000400)='nl80211\x00') sendmsg$NL80211_CMD_GET_MESH_CONFIG(r0, &(0x7f0000000580)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x103190}, 0xc, &(0x7f0000000540)={&(0x7f0000000500)={0x34, r3, 0x10, 0x70bd2d, 0x25dfdbfe, {}, [@NL80211_ATTR_WDEV={0xc, 0x99, {0x1, 0xffffffffffffffff}}, @NL80211_ATTR_WIPHY={0x8, 0x1, 0x1}, @NL80211_ATTR_WDEV={0xc, 0x99, {0x3f, 0x3}}]}, 0x34}, 0x1, 0x0, 0x0, 0x800}, 0x40000) r4 = socket$nl_generic(0x10, 0x3, 0x10) bind$netlink(r4, &(0x7f0000000000)={0x10, 0x0, 0x25dfdbff, 0x1004280}, 0xffffffffffffffb3) sendmsg$nl_generic(r4, &(0x7f0000000080)={&(0x7f0000000480)={0x10, 0xbb7f}, 0xc, &(0x7f0000000440)={&(0x7f00000004c0)={0x1c, 0x22, 0x1, 0x0, 0x0, {0x4}, [@typed={0x8, 0xc}]}, 0x1c}}, 0x0) socket$netlink(0x10, 0x3, 0x0) socket$alg(0x26, 0x5, 0x0) bind$alg(0xffffffffffffffff, &(0x7f0000000080)={0x26, 'hash\x00', 0x0, 0x0, 'sha512\x00'}, 0x58) [ 419.728133][T17885] bridge221: port 1(syz_tun) entered blocking state [ 419.734827][T17885] bridge221: port 1(syz_tun) entered disabled state [ 419.771788][T17885] device syz_tun entered promiscuous mode [ 419.780244][T17886] device erspan0 left promiscuous mode [ 419.785990][T17886] bridge220: port 2(erspan0) entered disabled state [ 419.907877][T17886] bridge221: port 2(erspan0) entered blocking state [ 419.914554][T17886] bridge221: port 2(erspan0) entered disabled state [ 419.923488][T17886] device erspan0 entered promiscuous mode 15:25:02 executing program 4: r0 = socket$inet6(0xa, 0x80003, 0x6b) ioctl(r0, 0x1000008912, &(0x7f00000001c0)="080db5055e0bcfe8476071") r1 = socket(0x10, 0x2, 0x0) sendto(r1, &(0x7f0000000200)="120000001200e7ef007b1a3fcd00000000a1", 0x12, 0x0, 0x0, 0x18) recvmmsg(r1, &(0x7f00000037c0)=[{{&(0x7f0000000600)=@ethernet={0x0, @random}, 0x80, &(0x7f0000000380)=[{&(0x7f0000000040)=""/95, 0x5f}, {&(0x7f00000000c0)=""/85, 0x55}, {&(0x7f00000024c0)=""/4096, 0x1000}, {&(0x7f0000000400)=""/120, 0x78}, {0x0}, {&(0x7f0000000280)=""/77, 0x4d}, {&(0x7f0000000540)=""/154, 0x9a}, {&(0x7f0000000340)=""/22, 0x16}], 0x8, &(0x7f0000002400)=""/191, 0xbf}}], 0x1, 0x6, &(0x7f0000003700)={0x77359400}) [ 419.953223][T17901] netlink: 72 bytes leftover after parsing attributes in process `syz-executor.1'. [ 419.969361][T17905] device syz_tun left promiscuous mode [ 419.976812][T17905] bridge230: port 1(syz_tun) entered disabled state [ 420.138664][T17905] bridge231: port 1(syz_tun) entered blocking state [ 420.145611][T17905] bridge231: port 1(syz_tun) entered disabled state [ 420.154667][T17905] device syz_tun entered promiscuous mode [ 420.162758][T17907] netlink: 72 bytes leftover after parsing attributes in process `syz-executor.1'. [ 420.176832][T17909] device erspan0 left promiscuous mode [ 420.183766][T17909] bridge230: port 2(erspan0) entered disabled state [ 420.317802][T17909] bridge231: port 2(erspan0) entered blocking state [ 420.324688][T17909] bridge231: port 2(erspan0) entered disabled state [ 420.333483][T17909] device erspan0 entered promiscuous mode 15:25:02 executing program 4: r0 = socket$inet6(0xa, 0x80003, 0x6b) ioctl(r0, 0x1000008912, &(0x7f00000001c0)="080db5055e0bcfe8476071") r1 = socket(0x10, 0x2, 0x0) sendto(r1, &(0x7f0000000200)="120000001200e7ef007b1a3fcd00000000a1", 0x12, 0x0, 0x0, 0x18) recvmmsg(r1, &(0x7f00000037c0)=[{{&(0x7f0000000600)=@ethernet={0x0, @random}, 0x80, &(0x7f0000000380)=[{&(0x7f0000000040)=""/95, 0x5f}, {&(0x7f00000000c0)=""/85, 0x55}, {&(0x7f00000024c0)=""/4096, 0x1000}, {&(0x7f0000000400)=""/120, 0x78}, {0x0}, {&(0x7f0000000280)=""/77, 0x4d}, {&(0x7f0000000540)=""/154, 0x9a}, {&(0x7f0000000340)=""/22, 0x16}], 0x8, &(0x7f0000002400)=""/191, 0xbf}}], 0x1, 0x6, &(0x7f0000003700)={0x77359400}) 15:25:02 executing program 5: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000340)={'erspan0\x00', 0x0}) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000300)={'syz_tun\x00', 0x0}) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r7, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r6, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000380)=@newlink={0x34, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r8}, [@IFLA_LINKINFO={0x14, 0x12, @bridge={{0xb, 0x1, 'bridge\x00'}, {0x4}}}]}, 0x34}}, 0x0) sendmsg$nl_route(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000002700)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r5}, [@IFLA_MASTER={0x8, 0xa, r8}]}, 0x28}}, 0x0) sendmsg$nl_route(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f00000000c0)=ANY=[@ANYBLOB="2800000010000104000040000000000000001ea6", @ANYRES32=r2, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00\b\x00\n\x00', @ANYRES32=r8], 0x28}}, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r10 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r9, 0x8933, &(0x7f0000000300)={'syz_tun\x00', 0x0}) sendmsg$nl_route(r10, &(0x7f0000000000)={0x0, 0x2, &(0x7f00000000c0)={&(0x7f0000000040)=@newlink={0x2c, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r11}, [@IFLA_BROADCAST={0xa}]}, 0x332}}, 0x0) [ 420.369063][T17905] device erspan0 left promiscuous mode [ 420.374734][T17905] bridge231: port 2(erspan0) entered disabled state 15:25:02 executing program 3: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000340)={'erspan0\x00', 0x0}) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000300)={'syz_tun\x00', 0x0}) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r7, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r6, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000380)=@newlink={0x34, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r8}, [@IFLA_LINKINFO={0x14, 0x12, @bridge={{0xb, 0x1, 'bridge\x00'}, {0x4}}}]}, 0x34}}, 0x0) sendmsg$nl_route(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000002700)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r5}, [@IFLA_MASTER={0x8, 0xa, r8}]}, 0x28}}, 0x0) sendmsg$nl_route(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f00000000c0)=ANY=[@ANYBLOB="2800000010000104000040000000000000001ea6", @ANYRES32=r2, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00\b\x00\n\x00', @ANYRES32=r8], 0x28}}, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r10 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r9, 0x8933, &(0x7f0000000300)={'syz_tun\x00', 0x0}) sendmsg$nl_route(r10, &(0x7f0000000000)={0x0, 0xc, &(0x7f00000000c0)={&(0x7f0000000040)=@newlink={0x2c, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r11}, [@IFLA_BROADCAST={0xa}]}, 0x332}}, 0x0) 15:25:02 executing program 2: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000340)={'erspan0\x00', 0x0}) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000300)={'syz_tun\x00', 0x0}) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r7, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r6, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000380)=@newlink={0x34, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r8}, [@IFLA_LINKINFO={0x14, 0x12, @bridge={{0xb, 0x1, 'bridge\x00'}, {0x4}}}]}, 0x34}}, 0x0) sendmsg$nl_route(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000002700)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r5}, [@IFLA_MASTER={0x8, 0xa, r8}]}, 0x28}}, 0x0) sendmsg$nl_route(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f00000000c0)=ANY=[@ANYBLOB="2800000010000104000040000000000000001ea6", @ANYRES32=r2, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00\b\x00\n\x00', @ANYRES32=r8], 0x28}}, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r10 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r9, 0x8933, &(0x7f0000000300)={'syz_tun\x00', 0x0}) sendmsg$nl_route(r10, &(0x7f0000000000)={0x0, 0xf, &(0x7f00000000c0)={&(0x7f0000000040)=@newlink={0x2c, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r11}, [@IFLA_BROADCAST={0xa}]}, 0x332}}, 0x0) 15:25:02 executing program 4: r0 = socket$inet6(0xa, 0x80003, 0x6b) ioctl(r0, 0x1000008912, &(0x7f00000001c0)="080db5055e0bcfe8476071") r1 = socket(0x10, 0x2, 0x0) sendto(r1, &(0x7f0000000200)="120000001200e7ef007b1a3fcd00000000a1", 0x12, 0x0, 0x0, 0x18) recvmmsg(r1, &(0x7f00000037c0)=[{{&(0x7f0000000600)=@ethernet={0x0, @random}, 0x80, &(0x7f0000000380)=[{&(0x7f0000000040)=""/95, 0x5f}, {&(0x7f00000000c0)=""/85, 0x55}, {&(0x7f00000024c0)=""/4096, 0x1000}, {&(0x7f0000000400)=""/120, 0x78}, {0x0}, {&(0x7f0000000280)=""/77, 0x4d}, {&(0x7f0000000540)=""/154, 0x9a}, {&(0x7f0000000340)=""/22, 0x16}], 0x8, &(0x7f0000002400)=""/191, 0xbf}}], 0x1, 0x6, &(0x7f0000003700)={0x77359400}) 15:25:02 executing program 0: r0 = socket(0x21, 0xa, 0x1) r1 = socket(0x10, 0x80002, 0x0) ioctl(r1, 0x1000008912, &(0x7f00000001c0)="080db5055e0bcfe8696071") getsockopt$inet_sctp_SCTP_PEER_AUTH_CHUNKS(r1, 0x84, 0x1a, &(0x7f0000000940)=ANY=[@ANYRES32=0x0, @ANYBLOB='\x00'/12], &(0x7f0000000980)=0x10) getsockopt$inet_sctp_SCTP_GET_PEER_ADDR_INFO(r0, 0x84, 0xf, &(0x7f00000009c0)={r2, @in6={{0xa, 0x4e21, 0x8, @local, 0x401}}, 0x9, 0x1, 0x7, 0x7f, 0x6}, &(0x7f0000000a80)=0x98) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000400)='nl80211\x00') sendmsg$NL80211_CMD_GET_MESH_CONFIG(r0, &(0x7f0000000580)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x103190}, 0xc, &(0x7f0000000540)={&(0x7f0000000500)={0x34, r3, 0x10, 0x70bd2d, 0x25dfdbfe, {}, [@NL80211_ATTR_WDEV={0xc, 0x99, {0x1, 0xffffffffffffffff}}, @NL80211_ATTR_WIPHY={0x8, 0x1, 0x1}, @NL80211_ATTR_WDEV={0xc, 0x99, {0x3f, 0x3}}]}, 0x34}, 0x1, 0x0, 0x0, 0x800}, 0x40000) r4 = socket$nl_generic(0x10, 0x3, 0x10) bind$netlink(r4, &(0x7f0000000000)={0x10, 0x0, 0x25dfdbff, 0x1004280}, 0xffffffffffffffb3) sendmsg$nl_generic(r4, &(0x7f0000000080)={&(0x7f0000000480)={0x10, 0xbb7f}, 0xc, &(0x7f0000000440)={&(0x7f00000004c0)={0x1c, 0x22, 0x1, 0x0, 0x0, {0x4}, [@typed={0x8, 0xc}]}, 0x1c}}, 0x0) socket$netlink(0x10, 0x3, 0x0) socket$alg(0x26, 0x5, 0x0) bind$alg(0xffffffffffffffff, &(0x7f0000000080)={0x26, 'hash\x00', 0x0, 0x0, 'sha512\x00'}, 0x58) [ 420.616230][T17937] device syz_tun left promiscuous mode [ 420.627518][T17937] bridge221: port 1(syz_tun) entered disabled state 15:25:02 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000004c0)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r3, @ANYBLOB="0000000000000000280012000c0001007665746800000000180002001400010000000000", @ANYRES32=0x0, @ANYBLOB="00000000008433df6d6f"], 0x5}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000540)=ANY=[@ANYBLOB="7400000024000705000000000000000000010000", @ANYRES32=r3, @ANYBLOB="00000000ffffffff000000000800010073667100486818973f73461919309b68e1693572bb000229c6090032d0ed64f3c3545aaf6e000085a4e4ebb5ef670000000000000000000000000000001a4e624d29a84abf03265700000000000000000000000000000000000000000000000000000000000000ac20000089b53c947244306a0216a3de887763df5b42498b13bb1938de859ee6d7ae7dd2224dc672b69b4358871b170ea0b667832e5224ee3538f885b7abd9bc4a7d"], 0x74}}, 0x0) r4 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r4, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000300)=ANY=[@ANYBLOB="840000002c00010700"/20, @ANYRES32=r3, @ANYBLOB="0008008000000000030000000800010075333200580002001400050000000000000000000000000000000000400006003c0001000000000000001020898dde66057433b6ef3a41d22be225e0001b0000000000000000000000000017256ffc66e43a2484e1a912c5998bcbf0d0000000000000000000000000000000798a3c067277da1a290b9613a33c575c36fad473382c8f5532ef3f0e1d2c450a7decbf3431a69f9b2ecb3291bed174245a962fe0484676958265e2988326a89db3139d91fe4aee6ae7e745ab00001a9f61f20500000000000000b3958bc14fce6e66a36d1ab3194534ba4e973684b27793bff837d3"], 0x84}}, 0x0) r5 = socket(0x10, 0x80002, 0x0) sendmmsg$alg(r5, &(0x7f0000000140), 0x49249249249278c, 0x0) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r6, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000500)=@newlink={0x20, 0x11, 0x40d, 0x0, 0x0, {0x0, 0x0, 0x0, r8}}, 0x20}}, 0x0) r9 = socket(0x10, 0x80002, 0x0) getsockopt$inet_sctp_SCTP_PEER_AUTH_CHUNKS(0xffffffffffffffff, 0x84, 0x1a, &(0x7f0000000940)=ANY=[@ANYRES32=0x0, @ANYBLOB='\x00'/12], &(0x7f0000000980)=0x10) r10 = socket(0xa, 0x6, 0x0) close(r10) r11 = socket$inet6_sctp(0xa, 0x10000000005, 0x84) setsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX(r11, 0x84, 0x6e, &(0x7f0000000180)=[@in6={0xa, 0x0, 0x0, @remote, 0x9}], 0x1c) getsockopt$inet_sctp6_SCTP_GET_ASSOC_ID_LIST(r11, 0x84, 0x1d, &(0x7f000095dff8)={0x1, [0x0]}, &(0x7f000095dffc)=0x8) setsockopt$inet_sctp_SCTP_RTOINFO(r10, 0x84, 0x0, &(0x7f0000000000)={r12, 0x0, 0x0, 0x1000000}, 0x10) setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(0xffffffffffffffff, 0x84, 0x9, &(0x7f0000000680)={r12, @in={{0x2, 0x4e20, @remote}}, 0x10001, 0xfff7, 0x5, 0x1, 0x8, 0x5, 0xba}, 0x9c) ioctl(r9, 0x1000008912, &(0x7f00000001c0)="080db5055e0bcfe8696071") getsockopt$inet_sctp_SCTP_PEER_AUTH_CHUNKS(r9, 0x84, 0x1a, &(0x7f0000000940)=ANY=[@ANYRES32=0x0, @ANYBLOB='\x00'/12], &(0x7f0000000980)=0x10) r13 = socket$nl_generic(0x10, 0x3, 0x10) r14 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080)='nl80211\x00') r15 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL80211_CMD_GET_STATION(r15, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000240)={0x1c, r14, 0xf2b, 0x0, 0x0, {}, [@NL80211_ATTR_AIRTIME_WEIGHT={0x8}]}, 0x1c}}, 0x0) sendmsg$NL80211_CMD_GET_MPATH(r13, &(0x7f00000001c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x2000}, 0x268, &(0x7f0000000080)={&(0x7f0000000200)={0x40, r14, 0x4, 0x70bd2d, 0x25dfdbff}, 0xff6b}, 0x1, 0x0, 0x0, 0x10049050}, 0x260448c0) sendmsg$NL80211_CMD_NEW_KEY(r9, &(0x7f0000000640)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0xb0024000}, 0xc, &(0x7f00000002c0)={&(0x7f0000000440)={0x7c, r14, 0x23, 0x70bd27, 0x25dfdbff, {}, [@NL80211_ATTR_KEY_DATA_WEP40={0x9, 0x7, "a80875ab12"}, @NL80211_ATTR_KEY={0x5c, 0x50, [@NL80211_KEY_DEFAULT_TYPES={0x14, 0x8, [@NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_MULTICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_MULTICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_MULTICAST={0x4}]}, @NL80211_KEY_DEFAULT_TYPES={0x28, 0x8, [@NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_MULTICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_MULTICAST={0x4}]}, @NL80211_KEY_IDX={0x5, 0x2, 0x5}, @NL80211_KEY_DATA_WEP104={0x11, 0x1, "4d84c4e30151cb27f51a4adf63"}]}]}, 0x7c}, 0x1, 0x0, 0x0, 0x24000}, 0x40) [ 420.767962][T17937] bridge222: port 1(syz_tun) entered blocking state [ 420.781544][T17937] bridge222: port 1(syz_tun) entered disabled state [ 420.803899][T17937] device syz_tun entered promiscuous mode [ 420.823798][T17939] device syz_tun left promiscuous mode [ 420.829913][T17939] bridge79: port 1(syz_tun) entered disabled state [ 420.977929][T17939] bridge80: port 1(syz_tun) entered blocking state [ 420.986746][T17939] bridge80: port 1(syz_tun) entered disabled state [ 420.995068][T17939] device syz_tun entered promiscuous mode [ 421.005126][T17938] device erspan0 left promiscuous mode [ 421.014548][T17938] bridge221: port 2(erspan0) entered disabled state [ 421.147827][T17938] bridge222: port 2(erspan0) entered blocking state [ 421.154914][T17938] bridge222: port 2(erspan0) entered disabled state [ 421.163334][T17938] device erspan0 entered promiscuous mode [ 421.171965][T17942] device erspan0 left promiscuous mode [ 421.178250][T17942] bridge79: port 2(erspan0) entered disabled state [ 421.307845][T17942] bridge80: port 2(erspan0) entered blocking state [ 421.314604][T17942] bridge80: port 2(erspan0) entered disabled state [ 421.322745][T17942] device erspan0 entered promiscuous mode [ 421.342037][T17954] netlink: 72 bytes leftover after parsing attributes in process `syz-executor.1'. 15:25:03 executing program 4: r0 = socket$inet6(0xa, 0x80003, 0x6b) ioctl(r0, 0x1000008912, &(0x7f00000001c0)="080db5055e0bcfe8476071") r1 = socket(0x10, 0x2, 0x0) sendto(r1, &(0x7f0000000200)="120000001200e7ef007b1a3fcd00000000a1", 0x12, 0x0, 0x0, 0x18) recvmmsg(r1, &(0x7f00000037c0)=[{{&(0x7f0000000600)=@ethernet={0x0, @random}, 0x80, &(0x7f0000000380)=[{&(0x7f0000000040)=""/95, 0x5f}, {&(0x7f00000000c0)=""/85, 0x55}, {&(0x7f00000024c0)=""/4096, 0x1000}, {&(0x7f0000000480)=""/60, 0x3c}, {&(0x7f0000000280)=""/77, 0x4d}, {&(0x7f0000000540)=""/154, 0x9a}, {&(0x7f0000000340)=""/22, 0x16}], 0x7, &(0x7f0000002400)=""/191, 0xbf}}], 0x1, 0x6, &(0x7f0000003700)={0x77359400}) 15:25:03 executing program 3: r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x5, 0x0) accept$inet(0xffffffffffffffff, &(0x7f0000000280)={0x2, 0x0, @multicast1}, &(0x7f0000000500)=0x10) socket$inet_sctp(0x2, 0x1, 0x84) socketpair(0x1a, 0x0, 0x6d, &(0x7f0000000540)) ioctl$sock_kcm_SIOCKCMCLONE(0xffffffffffffff9c, 0x89e2, &(0x7f0000002380)={r0}) r1 = accept4$inet(0xffffffffffffff9c, &(0x7f0000002540)={0x2, 0x0, @loopback}, &(0x7f0000002580)=0x10, 0x80000) setsockopt$inet_sctp_SCTP_ADAPTATION_LAYER(r1, 0x84, 0x7, 0x0, 0x4d) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cpu.stat\x00', 0x275a, 0x0) write$binfmt_script(r2, &(0x7f0000000040)=ANY=[], 0x7c774aac) mmap(&(0x7f0000a00000/0x600000)=nil, 0x600000, 0x300000a, 0x2011, r2, 0x0) mmap(&(0x7f0000a35000/0x400000)=nil, 0x400000, 0x1000006, 0x2011, r2, 0x0) r3 = socket$inet6(0xa, 0x3, 0x400000000006) ioctl(r3, 0x8912, &(0x7f0000000200)='\x00\x00\x00\x00\x00\x00\x00\x00\x00') unshare(0x40000000) r4 = socket$inet_tcp(0x2, 0x1, 0x0) ioctl$sock_inet_SIOCSIFFLAGS(r4, 0x8914, &(0x7f00000000c0)={'\x00', 0x101}) r5 = socket$inet(0x2, 0x4000000000000001, 0x0) r6 = accept(r5, &(0x7f0000002840)=@in6={0xa, 0x0, 0x0, @mcast2}, &(0x7f00000028c0)=0x80) r7 = socket(0x21, 0xa, 0x1) r8 = socket(0x10, 0x80002, 0x0) ioctl(r8, 0x1000008912, &(0x7f00000001c0)="080db5055e0bcfe8696071") getsockopt$inet_sctp_SCTP_PEER_AUTH_CHUNKS(r8, 0x84, 0x1a, &(0x7f0000000940)=ANY=[@ANYRES32=0x0, @ANYBLOB='\x00'/12], &(0x7f0000000980)=0x10) getsockopt$inet_sctp_SCTP_GET_PEER_ADDR_INFO(r7, 0x84, 0xf, &(0x7f00000009c0)={r9, @in6={{0xa, 0x4e21, 0x8, @local, 0x401}}, 0x9, 0x1, 0x7, 0x7f, 0x6}, &(0x7f0000000a80)=0x98) r10 = socket$inet6_dccp(0xa, 0x6, 0x0) shutdown(r10, 0x0) getsockopt$bt_rfcomm_RFCOMM_LM(r6, 0x12, 0x3, &(0x7f0000000440), &(0x7f0000002940)=0x4) ioctl$sock_inet_SIOCADDRT(r5, 0x890b, &(0x7f0000000000)={0x0, {0x2, 0x0, @loopback=0x7f004700}, {0x2, 0x0, @loopback}, {0x2, 0x0, @remote}, 0x27}) sendto$llc(r6, &(0x7f0000000100)="f970073b521a3a2059fcfb4e8ff5daaa892b23d0d93e42e29fd18b0a0ba812eee04266ea1e381a4bb2e397868f69542dd70dd9c732d82d1fb2fc114f477c5628dfd9882cb1704a9f32aac44aae8374041822b9186cf14d60459bd23b2cdfa2331560f6603715660f40eb2abb6eb4ac55a1b1b79c6b0cf8b2b9318c3851c8c082044b202dfddf065073e5b86df813839f8469d5e3897560064588b8857deb8aa08bb97eab5a3c887c75722b8f29c0676355437301c7bab02cae987fb632bc787275cc10ffa7d27aec6dde9675ce109785c50042c06113974ffe11fc8c778aa09dfb093bb384905f3b6b5899e819b4f5263cb840bd", 0xf4, 0x800, 0x0, 0x0) sendmsg$nl_route(r6, &(0x7f00000003c0)={&(0x7f0000000300)={0x10, 0x0, 0x0, 0x20000000}, 0xc, &(0x7f0000000380)={&(0x7f0000000340)=ANY=[@ANYBLOB="30000000200000022dbd7000ffdbdf250220b4f000000006100000000800020000009f0208000b0008000000"], 0x30}, 0x1, 0x0, 0x0, 0x4000000}, 0x0) ioctl$sock_inet_SIOCSIFADDR(r4, 0x8916, &(0x7f00000000c0)={'lo\x00', {0x2, 0x0, @dev}}) ioctl$sock_inet_SIOCGIFADDR(r4, 0x8915, &(0x7f00000002c0)={'\x00', {0x2, 0x4e23, @multicast1}}) r11 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r11, &(0x7f0000000400)={0x0, 0x0, &(0x7f00008feff0)={&(0x7f0000000480)=ANY=[@ANYBLOB="02050000050000000002000100000000000000000000000000866ab6f58df1e1bdb6841ea5e3fd574c8845a2c9f509c84ecc4c2942464894b8e02b01ecc322db9c8a4aff33c0cb398fffcf67d591b03e8b4d85a13bd5cd4d059d504245be053f81209d"], 0x63}}, 0x0) setsockopt(r0, 0x53, 0x3a, &(0x7f0000000240)="01aeefef2d5883d4b1375b1f2c600b3abece185118e1d6987f223823a5915ea15e4a9f763a82cbeadee9732e73f16d76f369684839cf6039e1", 0x39) socket$nl_generic(0x10, 0x3, 0x10) write$binfmt_script(r0, &(0x7f0000000580)=ANY=[@ANYBLOB="2321202e2f66696c6530202d47504c366d6e6574314750cc70707030a874ef91205b62646576207d0aa943f10a377b8f8c43bfe5f302d5bb1a6a95873b3c5af551f51b8c755c682c346f360b59530f6fff21850add7d9bea94d09303430860fa1caec6dd07dea6998cb77fe2e15e5a51a6a04901c3bedcc0b48c011d38bd5bd9b9412b558aca751c73a0b724315e5e16b2f298c9ca4befd69bfd572c3a790cf5f0f0d3560444dd2354565c25d03cc9ea1a9e1cff51576b3857193e8bbb713a3359c400ebc93ece50f52483298d04f4704c6fb07a04e384ea2ad8091642e6d1cb58b93d7ad0669236c8fb2df8d6f82382aeb25384d72bb760dca779eef82b4babec56b13fbb044aa5fcc1"], 0x10a) setsockopt$inet6_tcp_TLS_RX(r2, 0x6, 0x2, &(0x7f0000000040), 0x4) setsockopt$inet_sctp_SCTP_FRAGMENT_INTERLEAVE(r5, 0x84, 0x12, &(0x7f0000000080)=0x6, 0x4) ioctl$EXT4_IOC_SWAP_BOOT(r2, 0x6611) bind$bt_l2cap(r0, &(0x7f0000000800)={0x1f, 0x0, {0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x4777}, 0x9, 0xfffffffffffffffe}, 0xe) ioctl$sock_bt_hidp_HIDPCONNADD(r2, 0x400448c8, &(0x7f0000000340)=ANY=[@ANYBLOB="0701eca20100070020abe1ff0000000099ed78c38a3f144de930d46ebd660ded192b0c62b9da357b5f9eb6c9e1"]) [ 421.369172][T17955] device syz_tun left promiscuous mode [ 421.376519][T17955] bridge231: port 1(syz_tun) entered disabled state [ 421.498239][T17955] bridge232: port 1(syz_tun) entered blocking state [ 421.506722][T17955] bridge232: port 1(syz_tun) entered disabled state [ 421.535722][T17955] device syz_tun entered promiscuous mode [ 421.549484][T17959] bridge232: port 2(erspan0) entered blocking state [ 421.556660][T17959] bridge232: port 2(erspan0) entered disabled state [ 421.581833][T17959] device erspan0 entered promiscuous mode [ 421.604882][T17958] netlink: 72 bytes leftover after parsing attributes in process `syz-executor.1'. 15:25:03 executing program 5: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000340)={'erspan0\x00', 0x0}) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000300)={'syz_tun\x00', 0x0}) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r7, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r6, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000380)=@newlink={0x34, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r8}, [@IFLA_LINKINFO={0x14, 0x12, @bridge={{0xb, 0x1, 'bridge\x00'}, {0x4}}}]}, 0x34}}, 0x0) sendmsg$nl_route(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000002700)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r5}, [@IFLA_MASTER={0x8, 0xa, r8}]}, 0x28}}, 0x0) sendmsg$nl_route(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f00000000c0)=ANY=[@ANYBLOB="2800000010000104000040000000000000001ea6", @ANYRES32=r2, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00\b\x00\n\x00', @ANYRES32=r8], 0x28}}, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r10 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r9, 0x8933, &(0x7f0000000300)={'syz_tun\x00', 0x0}) sendmsg$nl_route(r10, &(0x7f0000000000)={0x0, 0x4, &(0x7f00000000c0)={&(0x7f0000000040)=@newlink={0x2c, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r11}, [@IFLA_BROADCAST={0xa}]}, 0x332}}, 0x0) 15:25:03 executing program 4: r0 = socket$inet6(0xa, 0x80003, 0x6b) ioctl(r0, 0x1000008912, &(0x7f00000001c0)="080db5055e0bcfe8476071") r1 = socket(0x10, 0x2, 0x0) sendto(r1, &(0x7f0000000200)="120000001200e7ef007b1a3fcd00000000a1", 0x12, 0x0, 0x0, 0x18) recvmmsg(r1, &(0x7f00000037c0)=[{{&(0x7f0000000600)=@ethernet={0x0, @random}, 0x80, &(0x7f0000000380)=[{&(0x7f0000000040)=""/95, 0x5f}, {&(0x7f00000000c0)=""/85, 0x55}, {&(0x7f00000024c0)=""/4096, 0x1000}, {&(0x7f0000000480)=""/60, 0x3c}, {&(0x7f0000000280)=""/77, 0x4d}, {&(0x7f0000000540)=""/154, 0x9a}, {&(0x7f0000000340)=""/22, 0x16}], 0x7, &(0x7f0000002400)=""/191, 0xbf}}], 0x1, 0x6, &(0x7f0000003700)={0x77359400}) [ 421.693085][T17980] IPVS: ftp: loaded support on port[0] = 21 15:25:03 executing program 2: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000340)={'erspan0\x00', 0x0}) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000300)={'syz_tun\x00', 0x0}) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r7, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r6, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000380)=@newlink={0x34, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r8}, [@IFLA_LINKINFO={0x14, 0x12, @bridge={{0xb, 0x1, 'bridge\x00'}, {0x4}}}]}, 0x34}}, 0x0) sendmsg$nl_route(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000002700)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r5}, [@IFLA_MASTER={0x8, 0xa, r8}]}, 0x28}}, 0x0) sendmsg$nl_route(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f00000000c0)=ANY=[@ANYBLOB="2800000010000104000040000000000000001ea6", @ANYRES32=r2, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00\b\x00\n\x00', @ANYRES32=r8], 0x28}}, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r10 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r9, 0x8933, &(0x7f0000000300)={'syz_tun\x00', 0x0}) sendmsg$nl_route(r10, &(0x7f0000000000)={0x0, 0x10, &(0x7f00000000c0)={&(0x7f0000000040)=@newlink={0x2c, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r11}, [@IFLA_BROADCAST={0xa}]}, 0x332}}, 0x0) 15:25:03 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000004c0)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r3, @ANYBLOB="0000000000000000280012000c0001007665746800000000180002001400010000000000", @ANYRES32=0x0, @ANYBLOB="00000000008433df6d6f"], 0x5}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000540)=ANY=[@ANYBLOB="7400000024000705000000000000000000010000", @ANYRES32=r3, @ANYBLOB="00000000ffffffff000000000800010073667100486818973f73461919309b68e1693572bb000229c6090032d0ed64f3c3545aaf6e000085a4e4ebb5ef670000000000000000000000000000001a4e624d29a84abf03265700000000000000000000000000000000000000000000000000000000000000ac20000089b53c947244306a0216a3de887763df5b42498b13bb1938de859ee6d7ae7dd2224dc672b69b4358871b170ea0b667832e5224ee3538f885b7abd9bc4a7d"], 0x74}}, 0x0) r4 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r4, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000300)=ANY=[@ANYBLOB="840000002c00010700"/20, @ANYRES32=r3, @ANYBLOB="0008008000000000030000000800010075333200580002001400050000000000000000000000000000000000400006003c0001000000000000001020898dde66057433b6ef3a41d22be225e0001b0000000000000000000000000017256ffc66e43a2484e1a912c5998bcbf0d0000000000000000000000000000000798a3c067277da1a290b9613a33c575c36fad473382c8f5532ef3f0e1d2c450a7decbf3431a69f9b2ecb3291bed174245a962fe0484676958265e2988326a89db3139d91fe4aee6ae7e745ab00001a9f61f20500000000000000b3958bc14fce6e66a36d1ab3194534ba4e973684b27793bff837d3"], 0x84}}, 0x0) r5 = socket(0x10, 0x80002, 0x0) sendmmsg$alg(r5, &(0x7f0000000140), 0x49249249249278c, 0x0) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r6, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000500)=@newlink={0x20, 0x11, 0x40d, 0x0, 0x0, {0x0, 0x0, 0x0, r8}}, 0x20}}, 0x0) r9 = socket(0x10, 0x80002, 0x0) getsockopt$inet_sctp_SCTP_PEER_AUTH_CHUNKS(0xffffffffffffffff, 0x84, 0x1a, &(0x7f0000000940)=ANY=[@ANYRES32=0x0, @ANYBLOB='\x00'/12], &(0x7f0000000980)=0x10) r10 = socket(0xa, 0x6, 0x0) close(r10) r11 = socket$inet6_sctp(0xa, 0x10000000005, 0x84) setsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX(r11, 0x84, 0x6e, &(0x7f0000000180)=[@in6={0xa, 0x0, 0x0, @remote, 0x9}], 0x1c) getsockopt$inet_sctp6_SCTP_GET_ASSOC_ID_LIST(r11, 0x84, 0x1d, &(0x7f000095dff8)={0x1, [0x0]}, &(0x7f000095dffc)=0x8) setsockopt$inet_sctp_SCTP_RTOINFO(r10, 0x84, 0x0, &(0x7f0000000000)={r12, 0x0, 0x0, 0x1000000}, 0x10) setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(0xffffffffffffffff, 0x84, 0x9, &(0x7f0000000680)={r12, @in={{0x2, 0x4e20, @remote}}, 0x10001, 0xfff7, 0x5, 0x1, 0x8, 0x5, 0xba}, 0x9c) ioctl(r9, 0x1000008912, &(0x7f00000001c0)="080db5055e0bcfe8696071") getsockopt$inet_sctp_SCTP_PEER_AUTH_CHUNKS(r9, 0x84, 0x1a, &(0x7f0000000940)=ANY=[@ANYRES32=0x0, @ANYBLOB='\x00'/12], &(0x7f0000000980)=0x10) r13 = socket$nl_generic(0x10, 0x3, 0x10) r14 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080)='nl80211\x00') r15 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL80211_CMD_GET_STATION(r15, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000240)={0x1c, r14, 0xf2b, 0x0, 0x0, {}, [@NL80211_ATTR_AIRTIME_WEIGHT={0x8}]}, 0x1c}}, 0x0) sendmsg$NL80211_CMD_GET_MPATH(r13, &(0x7f00000001c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x2000}, 0x268, &(0x7f0000000080)={&(0x7f0000000200)={0x40, r14, 0x4, 0x70bd2d, 0x25dfdbff}, 0xff6b}, 0x1, 0x0, 0x0, 0x10049050}, 0x260448c0) sendmsg$NL80211_CMD_NEW_KEY(r9, &(0x7f0000000640)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0xb0024000}, 0xc, &(0x7f00000002c0)={&(0x7f0000000440)={0x7c, r14, 0x23, 0x70bd27, 0x25dfdbff, {}, [@NL80211_ATTR_KEY_DATA_WEP40={0x9, 0x7, "a80875ab12"}, @NL80211_ATTR_KEY={0x5c, 0x50, [@NL80211_KEY_DEFAULT_TYPES={0x14, 0x8, [@NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_MULTICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_MULTICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_MULTICAST={0x4}]}, @NL80211_KEY_DEFAULT_TYPES={0x28, 0x8, [@NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_MULTICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_MULTICAST={0x4}]}, @NL80211_KEY_IDX={0x5, 0x2, 0x5}, @NL80211_KEY_DATA_WEP104={0x11, 0x1, "4d84c4e30151cb27f51a4adf63"}]}]}, 0x7c}, 0x1, 0x0, 0x0, 0x24000}, 0x40) 15:25:03 executing program 0: r0 = socket(0x21, 0xa, 0x1) r1 = socket(0x10, 0x80002, 0x0) ioctl(r1, 0x1000008912, &(0x7f00000001c0)="080db5055e0bcfe8696071") getsockopt$inet_sctp_SCTP_PEER_AUTH_CHUNKS(r1, 0x84, 0x1a, &(0x7f0000000940)=ANY=[@ANYRES32=0x0, @ANYBLOB='\x00'/12], &(0x7f0000000980)=0x10) getsockopt$inet_sctp_SCTP_GET_PEER_ADDR_INFO(r0, 0x84, 0xf, &(0x7f00000009c0)={r2, @in6={{0xa, 0x4e21, 0x8, @local, 0x401}}, 0x9, 0x1, 0x7, 0x7f, 0x6}, &(0x7f0000000a80)=0x98) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000400)='nl80211\x00') sendmsg$NL80211_CMD_GET_MESH_CONFIG(r0, &(0x7f0000000580)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x103190}, 0xc, &(0x7f0000000540)={&(0x7f0000000500)={0x34, r3, 0x10, 0x70bd2d, 0x25dfdbfe, {}, [@NL80211_ATTR_WDEV={0xc, 0x99, {0x1, 0xffffffffffffffff}}, @NL80211_ATTR_WIPHY={0x8, 0x1, 0x1}, @NL80211_ATTR_WDEV={0xc, 0x99, {0x3f, 0x3}}]}, 0x34}, 0x1, 0x0, 0x0, 0x800}, 0x40000) r4 = socket$nl_generic(0x10, 0x3, 0x10) bind$netlink(r4, &(0x7f0000000000)={0x10, 0x0, 0x25dfdbff, 0x1004280}, 0xffffffffffffffb3) sendmsg$nl_generic(r4, &(0x7f0000000080)={&(0x7f0000000480)={0x10, 0xbb7f}, 0xc, &(0x7f0000000440)={&(0x7f00000004c0)={0x1c, 0x22, 0x1, 0x0, 0x0, {0x4}, [@typed={0x8, 0xc}]}, 0x1c}}, 0x0) socket$netlink(0x10, 0x3, 0x0) socket$alg(0x26, 0x5, 0x0) bind$alg(0xffffffffffffffff, &(0x7f0000000080)={0x26, 'hash\x00', 0x0, 0x0, 'sha512\x00'}, 0x58) [ 421.927376][T17996] device syz_tun left promiscuous mode [ 421.952116][T17996] bridge232: port 1(syz_tun) entered disabled state [ 422.097832][T17996] bridge233: port 1(syz_tun) entered blocking state [ 422.118471][T17996] bridge233: port 1(syz_tun) entered disabled state [ 422.126705][T17996] device syz_tun entered promiscuous mode [ 422.135005][T17997] device syz_tun left promiscuous mode [ 422.140828][T17997] bridge222: port 1(syz_tun) entered disabled state [ 422.290448][T17997] bridge223: port 1(syz_tun) entered blocking state [ 422.297569][T17997] bridge223: port 1(syz_tun) entered disabled state [ 422.307328][T17997] device syz_tun entered promiscuous mode [ 422.320082][T17991] device erspan0 left promiscuous mode [ 422.326711][T17991] bridge232: port 2(erspan0) entered disabled state [ 422.438817][T17991] bridge233: port 2(erspan0) entered blocking state [ 422.445565][T17991] bridge233: port 2(erspan0) entered disabled state [ 422.454466][T17991] device erspan0 entered promiscuous mode [ 422.462588][T17999] netlink: 72 bytes leftover after parsing attributes in process `syz-executor.1'. [ 422.472135][T17987] device erspan0 left promiscuous mode [ 422.478042][T17987] bridge222: port 2(erspan0) entered disabled state 15:25:04 executing program 4: r0 = socket$inet6(0xa, 0x80003, 0x6b) ioctl(r0, 0x1000008912, &(0x7f00000001c0)="080db5055e0bcfe8476071") r1 = socket(0x10, 0x2, 0x0) sendto(r1, &(0x7f0000000200)="120000001200e7ef007b1a3fcd00000000a1", 0x12, 0x0, 0x0, 0x18) recvmmsg(r1, &(0x7f00000037c0)=[{{&(0x7f0000000600)=@ethernet={0x0, @random}, 0x80, &(0x7f0000000380)=[{&(0x7f0000000040)=""/95, 0x5f}, {&(0x7f00000000c0)=""/85, 0x55}, {&(0x7f00000024c0)=""/4096, 0x1000}, {&(0x7f0000000480)=""/60, 0x3c}, {&(0x7f0000000280)=""/77, 0x4d}, {&(0x7f0000000540)=""/154, 0x9a}, {&(0x7f0000000340)=""/22, 0x16}], 0x7, &(0x7f0000002400)=""/191, 0xbf}}], 0x1, 0x6, &(0x7f0000003700)={0x77359400}) [ 422.598152][T17987] bridge223: port 2(erspan0) entered blocking state [ 422.605131][T17987] bridge223: port 2(erspan0) entered disabled state [ 422.615019][T17987] device erspan0 entered promiscuous mode [ 422.627452][T18004] netlink: 72 bytes leftover after parsing attributes in process `syz-executor.1'. [ 422.675514][T17996] device erspan0 left promiscuous mode [ 422.688020][T17996] bridge233: port 2(erspan0) entered disabled state 15:25:04 executing program 2: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000340)={'erspan0\x00', 0x0}) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000300)={'syz_tun\x00', 0x0}) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r7, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r6, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000380)=@newlink={0x34, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r8}, [@IFLA_LINKINFO={0x14, 0x12, @bridge={{0xb, 0x1, 'bridge\x00'}, {0x4}}}]}, 0x34}}, 0x0) sendmsg$nl_route(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000002700)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r5}, [@IFLA_MASTER={0x8, 0xa, r8}]}, 0x28}}, 0x0) sendmsg$nl_route(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f00000000c0)=ANY=[@ANYBLOB="2800000010000104000040000000000000001ea6", @ANYRES32=r2, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00\b\x00\n\x00', @ANYRES32=r8], 0x28}}, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r10 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r9, 0x8933, &(0x7f0000000300)={'syz_tun\x00', 0x0}) sendmsg$nl_route(r10, &(0x7f0000000000)={0x0, 0x60, &(0x7f00000000c0)={&(0x7f0000000040)=@newlink={0x2c, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r11}, [@IFLA_BROADCAST={0xa}]}, 0x332}}, 0x0) 15:25:04 executing program 4: r0 = socket$inet6(0xa, 0x80003, 0x6b) ioctl(r0, 0x1000008912, &(0x7f00000001c0)="080db5055e0bcfe8476071") r1 = socket(0x10, 0x2, 0x0) sendto(r1, &(0x7f0000000200)="120000001200e7ef007b1a3fcd00000000a1", 0x12, 0x0, 0x0, 0x18) recvmmsg(r1, &(0x7f00000037c0)=[{{&(0x7f0000000600)=@ethernet={0x0, @random}, 0x80, &(0x7f0000000380)=[{&(0x7f0000000040)=""/95, 0x5f}, {&(0x7f00000000c0)=""/85, 0x55}, {&(0x7f00000024c0)=""/4096, 0x1000}, {0x0}, {&(0x7f0000000480)=""/60, 0x3c}, {&(0x7f0000000280)=""/77, 0x4d}, {&(0x7f0000000540)=""/154, 0x9a}, {&(0x7f0000000340)=""/22, 0x16}], 0x8, &(0x7f0000002400)=""/191, 0xbf}}], 0x1, 0x6, &(0x7f0000003700)={0x77359400}) 15:25:04 executing program 0: r0 = socket(0x21, 0xa, 0x1) r1 = socket(0x10, 0x80002, 0x0) ioctl(r1, 0x1000008912, &(0x7f00000001c0)="080db5055e0bcfe8696071") getsockopt$inet_sctp_SCTP_PEER_AUTH_CHUNKS(r1, 0x84, 0x1a, &(0x7f0000000940)=ANY=[@ANYRES32=0x0, @ANYBLOB='\x00'/12], &(0x7f0000000980)=0x10) getsockopt$inet_sctp_SCTP_GET_PEER_ADDR_INFO(r0, 0x84, 0xf, &(0x7f00000009c0)={r2, @in6={{0xa, 0x4e21, 0x8, @local, 0x401}}, 0x9, 0x1, 0x7, 0x7f, 0x6}, &(0x7f0000000a80)=0x98) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000400)='nl80211\x00') sendmsg$NL80211_CMD_GET_MESH_CONFIG(r0, &(0x7f0000000580)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x103190}, 0xc, &(0x7f0000000540)={&(0x7f0000000500)={0x34, r3, 0x10, 0x70bd2d, 0x25dfdbfe, {}, [@NL80211_ATTR_WDEV={0xc, 0x99, {0x1, 0xffffffffffffffff}}, @NL80211_ATTR_WIPHY={0x8, 0x1, 0x1}, @NL80211_ATTR_WDEV={0xc, 0x99, {0x3f, 0x3}}]}, 0x34}, 0x1, 0x0, 0x0, 0x800}, 0x40000) r4 = socket$nl_generic(0x10, 0x3, 0x10) bind$netlink(r4, &(0x7f0000000000)={0x10, 0x0, 0x25dfdbff, 0x1004280}, 0xffffffffffffffb3) sendmsg$nl_generic(r4, &(0x7f0000000080)={&(0x7f0000000480)={0x10, 0xbb7f}, 0xc, &(0x7f0000000440)={&(0x7f00000004c0)={0x1c, 0x22, 0x1, 0x0, 0x0, {0x4}, [@typed={0x8, 0xc}]}, 0x1c}}, 0x0) socket$netlink(0x10, 0x3, 0x0) r5 = socket$alg(0x26, 0x5, 0x0) bind$alg(r5, 0x0, 0x0) 15:25:04 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000004c0)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r3, @ANYBLOB="0000000000000000280012000c0001007665746800000000180002001400010000000000", @ANYRES32=0x0, @ANYBLOB="00000000008433df6d6f"], 0x5}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000540)=ANY=[@ANYBLOB="7400000024000705000000000000000000010000", @ANYRES32=r3, @ANYBLOB="00000000ffffffff000000000800010073667100486818973f73461919309b68e1693572bb000229c6090032d0ed64f3c3545aaf6e000085a4e4ebb5ef670000000000000000000000000000001a4e624d29a84abf03265700000000000000000000000000000000000000000000000000000000000000ac20000089b53c947244306a0216a3de887763df5b42498b13bb1938de859ee6d7ae7dd2224dc672b69b4358871b170ea0b667832e5224ee3538f885b7abd9bc4a7d"], 0x74}}, 0x0) r4 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r4, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000300)=ANY=[@ANYBLOB="840000002c00010700"/20, @ANYRES32=r3, @ANYBLOB="0008008000000000030000000800010075333200580002001400050000000000000000000000000000000000400006003c0001000000000000001020898dde66057433b6ef3a41d22be225e0001b0000000000000000000000000017256ffc66e43a2484e1a912c5998bcbf0d0000000000000000000000000000000798a3c067277da1a290b9613a33c575c36fad473382c8f5532ef3f0e1d2c450a7decbf3431a69f9b2ecb3291bed174245a962fe0484676958265e2988326a89db3139d91fe4aee6ae7e745ab00001a9f61f20500000000000000b3958bc14fce6e66a36d1ab3194534ba4e973684b27793bff837d3"], 0x84}}, 0x0) r5 = socket(0x10, 0x80002, 0x0) sendmmsg$alg(r5, &(0x7f0000000140), 0x49249249249278c, 0x0) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r6, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000500)=@newlink={0x20, 0x11, 0x40d, 0x0, 0x0, {0x0, 0x0, 0x0, r8}}, 0x20}}, 0x0) r9 = socket(0x10, 0x80002, 0x0) getsockopt$inet_sctp_SCTP_PEER_AUTH_CHUNKS(0xffffffffffffffff, 0x84, 0x1a, &(0x7f0000000940)=ANY=[@ANYRES32=0x0, @ANYBLOB='\x00'/12], &(0x7f0000000980)=0x10) r10 = socket(0xa, 0x6, 0x0) close(r10) r11 = socket$inet6_sctp(0xa, 0x10000000005, 0x84) setsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX(r11, 0x84, 0x6e, &(0x7f0000000180)=[@in6={0xa, 0x0, 0x0, @remote, 0x9}], 0x1c) getsockopt$inet_sctp6_SCTP_GET_ASSOC_ID_LIST(r11, 0x84, 0x1d, &(0x7f000095dff8)={0x1, [0x0]}, &(0x7f000095dffc)=0x8) setsockopt$inet_sctp_SCTP_RTOINFO(r10, 0x84, 0x0, &(0x7f0000000000)={r12, 0x0, 0x0, 0x1000000}, 0x10) setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(0xffffffffffffffff, 0x84, 0x9, &(0x7f0000000680)={r12, @in={{0x2, 0x4e20, @remote}}, 0x10001, 0xfff7, 0x5, 0x1, 0x8, 0x5, 0xba}, 0x9c) ioctl(r9, 0x1000008912, &(0x7f00000001c0)="080db5055e0bcfe8696071") getsockopt$inet_sctp_SCTP_PEER_AUTH_CHUNKS(r9, 0x84, 0x1a, &(0x7f0000000940)=ANY=[@ANYRES32=0x0, @ANYBLOB='\x00'/12], &(0x7f0000000980)=0x10) r13 = socket$nl_generic(0x10, 0x3, 0x10) r14 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080)='nl80211\x00') r15 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL80211_CMD_GET_STATION(r15, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000240)={0x1c, r14, 0xf2b, 0x0, 0x0, {}, [@NL80211_ATTR_AIRTIME_WEIGHT={0x8}]}, 0x1c}}, 0x0) sendmsg$NL80211_CMD_GET_MPATH(r13, &(0x7f00000001c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x2000}, 0x268, &(0x7f0000000080)={&(0x7f0000000200)={0x40, r14, 0x4, 0x70bd2d, 0x25dfdbff}, 0xff6b}, 0x1, 0x0, 0x0, 0x10049050}, 0x260448c0) sendmsg$NL80211_CMD_NEW_KEY(r9, &(0x7f0000000640)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0xb0024000}, 0xc, &(0x7f00000002c0)={&(0x7f0000000440)={0x7c, r14, 0x23, 0x70bd27, 0x25dfdbff, {}, [@NL80211_ATTR_KEY_DATA_WEP40={0x9, 0x7, "a80875ab12"}, @NL80211_ATTR_KEY={0x5c, 0x50, [@NL80211_KEY_DEFAULT_TYPES={0x14, 0x8, [@NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_MULTICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_MULTICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_MULTICAST={0x4}]}, @NL80211_KEY_DEFAULT_TYPES={0x28, 0x8, [@NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_MULTICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_MULTICAST={0x4}]}, @NL80211_KEY_IDX={0x5, 0x2, 0x5}, @NL80211_KEY_DATA_WEP104={0x11, 0x1, "4d84c4e30151cb27f51a4adf63"}]}]}, 0x7c}, 0x1, 0x0, 0x0, 0x24000}, 0x40) 15:25:04 executing program 5: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000340)={'erspan0\x00', 0x0}) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000300)={'syz_tun\x00', 0x0}) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r7, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r6, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000380)=@newlink={0x34, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r8}, [@IFLA_LINKINFO={0x14, 0x12, @bridge={{0xb, 0x1, 'bridge\x00'}, {0x4}}}]}, 0x34}}, 0x0) sendmsg$nl_route(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000002700)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r5}, [@IFLA_MASTER={0x8, 0xa, r8}]}, 0x28}}, 0x0) sendmsg$nl_route(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f00000000c0)=ANY=[@ANYBLOB="2800000010000104000040000000000000001ea6", @ANYRES32=r2, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00\b\x00\n\x00', @ANYRES32=r8], 0x28}}, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r10 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r9, 0x8933, &(0x7f0000000300)={'syz_tun\x00', 0x0}) sendmsg$nl_route(r10, &(0x7f0000000000)={0x0, 0x6, &(0x7f00000000c0)={&(0x7f0000000040)=@newlink={0x2c, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r11}, [@IFLA_BROADCAST={0xa}]}, 0x332}}, 0x0) 15:25:05 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0xfffffffffffffff2) r4 = socket(0x10, 0x80002, 0x0) ioctl(r4, 0x1000008912, &(0x7f00000001c0)="080db5055e0bcfe8696071") getsockopt$inet_sctp_SCTP_PEER_AUTH_CHUNKS(r4, 0x84, 0x1a, &(0x7f0000000940)=ANY=[@ANYRES32=0x0, @ANYBLOB='\x00'/12], &(0x7f0000000980)=0x10) r5 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000080)='pids.current\x00', 0x0, 0x0) r6 = socket$packet(0x11, 0x3, 0x300) r7 = socket(0x100000000011, 0x2, 0x0) bind(r7, &(0x7f0000000140)=@generic={0x11, "0000010000000000080044944eeba7502f6c59e7f202738f6e3d2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027eccaf3f6db1c000100000000000000497400000000000000069e735ecc326d3a09ffc2c65400"}, 0x80) getsockname$packet(r7, &(0x7f0000000240)={0x11, 0x0, 0x0}, &(0x7f00000002c0)=0xfeeb) sendmmsg(r6, &(0x7f0000002e00)=[{{&(0x7f0000000000)=@ll={0x11, 0x0, r8, 0x1, 0x0, 0x6, @random="a46c24750bc4"}, 0x80, &(0x7f0000001180)=[{&(0x7f0000000080)="86695a361aedc8b7c4b983cbf545", 0xe}], 0x1}}, {{&(0x7f0000001440)=@hci={0x1f, 0x0, 0x3}, 0x80, 0x0, 0x0, &(0x7f00000009c0)=[{0x80, 0x1, 0x0, "78ea071c8b649d0dbe94f416470edac1c9e8d53bb61f029b7fd966eea3c3619bcd227f59a776c602a9ebe4f2781c97ed95934abf06bbdacbd5f4a72e046cec3e398f4ba54cfd5c44f1ad2e584b7682cf413e84e8251f57cfdc159acbf73be772a8224ad9f217b6930ac9fce7b6"}, {0x18, 0x10c, 0x6, "a4a4718ea1b94a"}, {0x110, 0x11b, 0x88f0, "6d01657b874f31c06580eee53ffa027ef62f5b3de661501adec1636a7025e0aa5d71d752b3e8d38ae7f7c09d4088141d17c1afcdd726b3e288819a7344a63fca319d23edbc8a0f9135bc84975aef3c7f19a57258449354dcd2d531f107f4e4d2999e35f93506d259e0406d0d808a17ad5340ac200421587dac1b34a5fe713f5a20bc6689af8680caf67190c94e4ada1741c4fe78314a6ed524701712b012cfb5d57fae34ec8700b6408b092fcafb09d99bce630190b88602d02bef7390376cb6785ff924a34bd6cd9cf5e1add65c36b143872891993db4b439dbaa4578b199408eaadab3a8a430804b420c31fb27c6053374cdedfb31affaf752a6"}, {0x10, 0x100, 0x88}, {0x50, 0x110, 0x7fff, "2637dede951fc9f288f328aeef9e754b26e58986955cdd846a6f06723231f4db7c6e3d7e9e08dcf95888749684059bf4d8a62eb6cb0073e820"}, {0x80, 0x108, 0x6, "76d88782db48bb11ecd0f35f5f59430e2ce0507d584303be78a9e7268141b0b71501fe8fdfea2fd934013aee0e9c84f0f23caec2d52b7c7892422fbab8dc7fca62349b66157ce039de936c6fa831dc3da69f8a3f4c0c995186ac1924ae2aef87b480da6d6705680a5fb2cb"}, {0x58, 0x10d, 0x49a7ecf7, "c6644182967fdfd5a6b22f12703697a67f89be4c9468f050c86c4dbdfb37965bccf9f041f4087bc88188ddb7a90b714d9b53ccf6e182d2a5c2e751be25d4a10ee98fdf"}, {0x30, 0x115, 0x103, "03ab2f7461c8c436cd40e01f245c2454656c6c5a321c98688af8a9ed06"}, {0x30, 0x10d, 0x5, "28870700e677f9ef6979a8bb570017d5c097da276ce64d056fd310ca46"}, {0xd0, 0x110, 0x10, "8fe3ff4f9d45ba94280aa1b4e7c969e368d61bbf79352a8441fdf9bf2d1f7344f64cc2eabce5c337d37bbe483519d1bc43c4e053a874668f5b97f01ffd706c1db8f839dfc7ecc5301a7874bc3053017d231f4a4e1ee430c1e095c1487be88f7fb8b3f37737cd802e0798eaf39a16e0b52c6482cbca311cffaacc1743f960ba11aee74487367ddfd6c6753884606e0d064c304ca7242e7b0832080c920d82a5154be96ab6ce869909d476eed7c54f5c41578749890381f2caedfff50f3a72"}], 0x410}}], 0x2, 0x0) ioctl$TUNSETIFINDEX(r5, 0x400454da, &(0x7f0000000440)=r8) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000380)=ANY=[@ANYBLOB="480000001000050700000000000000000000e1c0723bcb2d0a7d237e25295986fd733c0a1ead03294c29df15d9cd574b2cce2296ccbfcf25f47c8a166b5d2777701620c15aad191df55fc9f5b9ae4a1594bad89cf37fff8d13ccdc834b4ecf0e97715eaf0dc5", @ANYRES32=r3, @ANYBLOB="0000000000000000280012000c0001080065746800"/33, @ANYRES32=r4, @ANYBLOB='\x00\x00'], 0x5}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000280)={&(0x7f00000002c0)=ANY=[@ANYBLOB="740000002400070500"/20, @ANYRES32=r3, @ANYBLOB="00000000ffffffff000000000800010073667100480002000000000000000000000000000000000000000000000000000000000000471a00000000000000000000000000000000000000000000f3aff151ed1e4a08454f9c9ed6974ba345296ca6ffafecb3ab42207c5c129cdf6500"/126], 0x74}}, 0x0) socket$inet6_sctp(0xa, 0x5, 0x84) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000500)=ANY=[@ANYBLOB="7c0000002c00010700"/20, @ANYRES32=r3, @ANYBLOB="00000002000000000300c4c1080001006270660004000500400002023c00010000000000eeff0075da891600000011000000000000000010000000000000000000000000000000000000e4ff00ddffffff00000000000000001064d2f1a58b6dcc2a86f100000000"], 0x7c}}, 0x0) r9 = socket(0x4000000000010, 0x1000000000080002, 0x0) sendmmsg$alg(r9, &(0x7f0000000140), 0x42, 0x0) [ 423.049073][T18030] netlink: 72 bytes leftover after parsing attributes in process `syz-executor.1'. [ 423.097316][T18030] netlink: 72 bytes leftover after parsing attributes in process `syz-executor.1'. [ 423.127263][ T1076] tipc: TX() has been purged, node left! 15:25:05 executing program 4: r0 = socket$inet6(0xa, 0x80003, 0x6b) ioctl(r0, 0x1000008912, &(0x7f00000001c0)="080db5055e0bcfe8476071") r1 = socket(0x10, 0x2, 0x0) sendto(r1, &(0x7f0000000200)="120000001200e7ef007b1a3fcd00000000a1", 0x12, 0x0, 0x0, 0x18) recvmmsg(r1, &(0x7f00000037c0)=[{{&(0x7f0000000600)=@ethernet={0x0, @random}, 0x80, &(0x7f0000000380)=[{&(0x7f0000000040)=""/95, 0x5f}, {&(0x7f00000000c0)=""/85, 0x55}, {&(0x7f00000024c0)=""/4096, 0x1000}, {0x0}, {&(0x7f0000000480)=""/60, 0x3c}, {&(0x7f0000000280)=""/77, 0x4d}, {&(0x7f0000000540)=""/154, 0x9a}, {&(0x7f0000000340)=""/22, 0x16}], 0x8, &(0x7f0000002400)=""/191, 0xbf}}], 0x1, 0x6, &(0x7f0000003700)={0x77359400}) [ 423.187497][T18037] device syz_tun left promiscuous mode [ 423.214725][T18037] bridge233: port 1(syz_tun) entered disabled state [ 423.316666][T18055] netlink: 12 bytes leftover after parsing attributes in process `syz-executor.3'. [ 423.349666][T18037] bridge234: port 1(syz_tun) entered blocking state [ 423.356465][T18037] bridge234: port 1(syz_tun) entered disabled state [ 423.364576][T18037] device syz_tun entered promiscuous mode [ 423.388277][T18039] device syz_tun left promiscuous mode [ 423.396822][T18039] bridge223: port 1(syz_tun) entered disabled state [ 423.510211][T18039] bridge224: port 1(syz_tun) entered blocking state [ 423.517068][T18039] bridge224: port 1(syz_tun) entered disabled state [ 423.525622][T18039] device syz_tun entered promiscuous mode [ 423.533220][T18043] bridge234: port 2(erspan0) entered blocking state [ 423.542410][T18043] bridge234: port 2(erspan0) entered disabled state [ 423.550810][T18043] device erspan0 entered promiscuous mode [ 423.559882][T18049] device erspan0 left promiscuous mode [ 423.566058][T18049] bridge223: port 2(erspan0) entered disabled state [ 423.697802][T18049] bridge224: port 2(erspan0) entered blocking state [ 423.704831][T18049] bridge224: port 2(erspan0) entered disabled state [ 423.713661][T18049] device erspan0 entered promiscuous mode 15:25:05 executing program 4: r0 = socket$inet6(0xa, 0x80003, 0x6b) ioctl(r0, 0x1000008912, &(0x7f00000001c0)="080db5055e0bcfe8476071") r1 = socket(0x10, 0x2, 0x0) sendto(r1, &(0x7f0000000200)="120000001200e7ef007b1a3fcd00000000a1", 0x12, 0x0, 0x0, 0x18) recvmmsg(r1, &(0x7f00000037c0)=[{{&(0x7f0000000600)=@ethernet={0x0, @random}, 0x80, &(0x7f0000000380)=[{&(0x7f0000000040)=""/95, 0x5f}, {&(0x7f00000000c0)=""/85, 0x55}, {&(0x7f00000024c0)=""/4096, 0x1000}, {0x0}, {&(0x7f0000000480)=""/60, 0x3c}, {&(0x7f0000000280)=""/77, 0x4d}, {&(0x7f0000000540)=""/154, 0x9a}, {&(0x7f0000000340)=""/22, 0x16}], 0x8, &(0x7f0000002400)=""/191, 0xbf}}], 0x1, 0x6, &(0x7f0000003700)={0x77359400}) [ 423.752172][T18049] device erspan0 left promiscuous mode [ 423.764061][T18049] bridge224: port 2(erspan0) entered disabled state 15:25:05 executing program 0: r0 = socket(0x21, 0xa, 0x1) r1 = socket(0x10, 0x80002, 0x0) ioctl(r1, 0x1000008912, &(0x7f00000001c0)="080db5055e0bcfe8696071") getsockopt$inet_sctp_SCTP_PEER_AUTH_CHUNKS(r1, 0x84, 0x1a, &(0x7f0000000940)=ANY=[@ANYRES32=0x0, @ANYBLOB='\x00'/12], &(0x7f0000000980)=0x10) getsockopt$inet_sctp_SCTP_GET_PEER_ADDR_INFO(r0, 0x84, 0xf, &(0x7f00000009c0)={r2, @in6={{0xa, 0x4e21, 0x8, @local, 0x401}}, 0x9, 0x1, 0x7, 0x7f, 0x6}, &(0x7f0000000a80)=0x98) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000400)='nl80211\x00') sendmsg$NL80211_CMD_GET_MESH_CONFIG(r0, &(0x7f0000000580)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x103190}, 0xc, &(0x7f0000000540)={&(0x7f0000000500)={0x34, r3, 0x10, 0x70bd2d, 0x25dfdbfe, {}, [@NL80211_ATTR_WDEV={0xc, 0x99, {0x1, 0xffffffffffffffff}}, @NL80211_ATTR_WIPHY={0x8, 0x1, 0x1}, @NL80211_ATTR_WDEV={0xc, 0x99, {0x3f, 0x3}}]}, 0x34}, 0x1, 0x0, 0x0, 0x800}, 0x40000) r4 = socket$nl_generic(0x10, 0x3, 0x10) bind$netlink(r4, &(0x7f0000000000)={0x10, 0x0, 0x25dfdbff, 0x1004280}, 0xffffffffffffffb3) sendmsg$nl_generic(r4, &(0x7f0000000080)={&(0x7f0000000480)={0x10, 0xbb7f}, 0xc, &(0x7f0000000440)={&(0x7f00000004c0)={0x1c, 0x22, 0x1, 0x0, 0x0, {0x4}, [@typed={0x8, 0xc}]}, 0x1c}}, 0x0) socket$netlink(0x10, 0x3, 0x0) r5 = socket$alg(0x26, 0x5, 0x0) bind$alg(r5, 0x0, 0x0) 15:25:05 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000004c0)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r3, @ANYBLOB="0000000000000000280012000c0001007665746800000000180002001400010000000000", @ANYRES32=0x0, @ANYBLOB="00000000008433df6d6f6b577d4eaa"], 0x5}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000540)=ANY=[@ANYBLOB="7400000024000705000000000000000000010000", @ANYRES32=r3, @ANYBLOB="00000000ffffffff000000000800010073667100486818973f73461919309b68e1693572bb000229c6090032d0ed64f3c3545aaf6e000085a4e4ebb5ef670000000000000000000000000000001a4e624d29a84abf03265700000000000000000000000000000000000000000000000000000000000000ac20000089b53c947244306a0216a3de887763df5b42498b13bb1938de859ee6d7ae7dd2224dc672b69b4358871b170ea0b667832e5224ee3538f885b7abd9bc4a7d"], 0x74}}, 0x0) r4 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r4, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000300)=ANY=[@ANYBLOB="840000002c00010700"/20, @ANYRES32=r3, @ANYBLOB="0008008000000000030000000800010075333200580002001400050000000000000000000000000000000000400006003c0001000000000000001020898dde66057433b6ef3a41d22be225e0001b0000000000000000000000000017256ffc66e43a2484e1a912c5998bcbf0d0000000000000000000000000000000798a3c067277da1a290b9613a33c575c36fad473382c8f5532ef3f0e1d2c450a7decbf3431a69f9b2ecb3291bed174245a962fe0484676958265e2988326a89db3139d91fe4aee6ae7e745ab00001a9f61f20500000000000000b3958bc14fce6e66a36d1ab3194534ba4e973684b27793bff837d3"], 0x84}}, 0x0) r5 = socket(0x10, 0x80002, 0x0) sendmmsg$alg(r5, &(0x7f0000000140), 0x49249249249278c, 0x0) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r6, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000500)=@newlink={0x20, 0x11, 0x40d, 0x0, 0x0, {0x0, 0x0, 0x0, r8}}, 0x20}}, 0x0) r9 = socket(0x10, 0x80002, 0x0) getsockopt$inet_sctp_SCTP_PEER_AUTH_CHUNKS(0xffffffffffffffff, 0x84, 0x1a, &(0x7f0000000940)=ANY=[@ANYRES32=0x0, @ANYBLOB='\x00'/12], &(0x7f0000000980)=0x10) r10 = socket(0xa, 0x6, 0x0) close(r10) r11 = socket$inet6_sctp(0xa, 0x10000000005, 0x84) setsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX(r11, 0x84, 0x6e, &(0x7f0000000180)=[@in6={0xa, 0x0, 0x0, @remote, 0x9}], 0x1c) getsockopt$inet_sctp6_SCTP_GET_ASSOC_ID_LIST(r11, 0x84, 0x1d, &(0x7f000095dff8)={0x1, [0x0]}, &(0x7f000095dffc)=0x8) setsockopt$inet_sctp_SCTP_RTOINFO(r10, 0x84, 0x0, &(0x7f0000000000)={r12, 0x0, 0x0, 0x1000000}, 0x10) setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(0xffffffffffffffff, 0x84, 0x9, &(0x7f0000000680)={r12, @in={{0x2, 0x4e20, @remote}}, 0x10001, 0xfff7, 0x5, 0x1, 0x8, 0x5, 0xba}, 0x9c) ioctl(r9, 0x1000008912, &(0x7f00000001c0)="080db5055e0bcfe8696071") getsockopt$inet_sctp_SCTP_PEER_AUTH_CHUNKS(r9, 0x84, 0x1a, &(0x7f0000000940)=ANY=[@ANYRES32=0x0, @ANYBLOB='\x00'/12], &(0x7f0000000980)=0x10) r13 = socket$nl_generic(0x10, 0x3, 0x10) r14 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080)='nl80211\x00') r15 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL80211_CMD_GET_STATION(r15, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000240)={0x1c, r14, 0xf2b, 0x0, 0x0, {}, [@NL80211_ATTR_AIRTIME_WEIGHT={0x8}]}, 0x1c}}, 0x0) sendmsg$NL80211_CMD_GET_MPATH(r13, &(0x7f00000001c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x2000}, 0x268, &(0x7f0000000080)={&(0x7f0000000200)={0x40, r14, 0x4, 0x70bd2d, 0x25dfdbff}, 0xff6b}, 0x1, 0x0, 0x0, 0x10049050}, 0x260448c0) sendmsg$NL80211_CMD_NEW_KEY(r9, &(0x7f0000000640)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0xb0024000}, 0xc, &(0x7f00000002c0)={&(0x7f0000000440)={0x7c, r14, 0x23, 0x70bd27, 0x25dfdbff, {}, [@NL80211_ATTR_KEY_DATA_WEP40={0x9, 0x7, "a80875ab12"}, @NL80211_ATTR_KEY={0x5c, 0x50, [@NL80211_KEY_DEFAULT_TYPES={0x14, 0x8, [@NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_MULTICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_MULTICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_MULTICAST={0x4}]}, @NL80211_KEY_DEFAULT_TYPES={0x28, 0x8, [@NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_MULTICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_MULTICAST={0x4}]}, @NL80211_KEY_IDX={0x5, 0x2, 0x5}, @NL80211_KEY_DATA_WEP104={0x11, 0x1, "4d84c4e30151cb27f51a4adf63"}]}]}, 0x7c}, 0x1, 0x0, 0x0, 0x24000}, 0x40) 15:25:06 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000004c0)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r3, @ANYBLOB="0000000000000000280012000c0001007665746800000000180002001400010000000000", @ANYRES32=0x0, @ANYBLOB="00000000008433df6d6f"], 0x5}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000540)=ANY=[@ANYBLOB="7400000024000705000000000000000000010000", @ANYRES32=r3, @ANYBLOB="00000000ffffffff000000000800010073667100486818973f73461919309b68e1693572bb000229c6090032d0ed64f3c3545aaf6e000085a4e4ebb5ef670000000000000000000000000000001a4e624d29a84abf03265700000000000000000000000000000000000000000000000000000000000000ac20000089b53c947244306a0216a3de887763df5b42498b13bb1938de859ee6d7ae7dd2224dc672b69b4358871b170ea0b667832e5224ee3538f885b7abd9bc4a7d"], 0x74}}, 0x0) r4 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r4, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000300)=ANY=[@ANYBLOB="840000002c00010700"/20, @ANYRES32=r3, @ANYBLOB="0008008000000000030000000800010075333200580002001400050000000000000000000000000000000000400006003c0001000000000000001020898dde66057433b6ef3a41d22be225e0001b0000000000000000000000000017256ffc66e43a2484e1a912c5998bcbf0d0000000000000000000000000000000798a3c067277da1a290b9613a33c575c36fad473382c8f5532ef3f0e1d2c450a7decbf3431a69f9b2ecb3291bed174245a962fe0484676958265e2988326a89db3139d91fe4aee6ae7e745ab00001a9f61f20500000000000000b3958bc14fce6e66a36d1ab3194534ba4e973684b27793bff837d3"], 0x84}}, 0x0) r5 = socket(0x10, 0x80002, 0x0) sendmmsg$alg(r5, &(0x7f0000000140), 0x49249249249278c, 0x0) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r6, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000500)=@newlink={0x20, 0x11, 0x40d, 0x0, 0x0, {0x0, 0x0, 0x0, r8}}, 0x20}}, 0x0) r9 = socket(0x10, 0x80002, 0x0) getsockopt$inet_sctp_SCTP_PEER_AUTH_CHUNKS(0xffffffffffffffff, 0x84, 0x1a, &(0x7f0000000940)=ANY=[@ANYRES32=0x0, @ANYBLOB='\x00'/12], &(0x7f0000000980)=0x10) r10 = socket(0xa, 0x6, 0x0) close(r10) r11 = socket$inet6_sctp(0xa, 0x10000000005, 0x84) setsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX(r11, 0x84, 0x6e, &(0x7f0000000180)=[@in6={0xa, 0x0, 0x0, @remote, 0x9}], 0x1c) getsockopt$inet_sctp6_SCTP_GET_ASSOC_ID_LIST(r11, 0x84, 0x1d, &(0x7f000095dff8)={0x1, [0x0]}, &(0x7f000095dffc)=0x8) setsockopt$inet_sctp_SCTP_RTOINFO(r10, 0x84, 0x0, &(0x7f0000000000)={r12, 0x0, 0x0, 0x1000000}, 0x10) setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(0xffffffffffffffff, 0x84, 0x9, &(0x7f0000000680)={r12, @in={{0x2, 0x4e20, @remote}}, 0x10001, 0xfff7, 0x5, 0x1, 0x8, 0x5, 0xba}, 0x9c) ioctl(r9, 0x1000008912, &(0x7f00000001c0)="080db5055e0bcfe8696071") getsockopt$inet_sctp_SCTP_PEER_AUTH_CHUNKS(r9, 0x84, 0x1a, &(0x7f0000000940)=ANY=[@ANYRES32=0x0, @ANYBLOB='\x00'/12], &(0x7f0000000980)=0x10) r13 = socket$nl_generic(0x10, 0x3, 0x10) r14 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080)='nl80211\x00') r15 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL80211_CMD_GET_STATION(r15, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000240)={0x1c, r14, 0xf2b, 0x0, 0x0, {}, [@NL80211_ATTR_AIRTIME_WEIGHT={0x8}]}, 0x1c}}, 0x0) sendmsg$NL80211_CMD_GET_MPATH(r13, &(0x7f00000001c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x2000}, 0x268, &(0x7f0000000080)={&(0x7f0000000200)={0x40, r14, 0x4, 0x70bd2d, 0x25dfdbff}, 0xff6b}, 0x1, 0x0, 0x0, 0x10049050}, 0x260448c0) sendmsg$NL80211_CMD_NEW_KEY(r9, &(0x7f0000000640)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0xb0024000}, 0xc, &(0x7f00000002c0)={&(0x7f0000000440)={0x7c, r14, 0x23, 0x70bd27, 0x25dfdbff, {}, [@NL80211_ATTR_KEY_DATA_WEP40={0x9, 0x7, "a80875ab12"}, @NL80211_ATTR_KEY={0x5c, 0x50, [@NL80211_KEY_DEFAULT_TYPES={0x14, 0x8, [@NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_MULTICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_MULTICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_MULTICAST={0x4}]}, @NL80211_KEY_DEFAULT_TYPES={0x28, 0x8, [@NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_MULTICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_MULTICAST={0x4}]}, @NL80211_KEY_IDX={0x5, 0x2, 0x5}, @NL80211_KEY_DATA_WEP104={0x11, 0x1, "4d84c4e30151cb27f51a4adf63"}]}]}, 0x7c}, 0x1, 0x0, 0x0, 0x24000}, 0x40) [ 423.960383][T18069] netlink: 72 bytes leftover after parsing attributes in process `syz-executor.1'. 15:25:06 executing program 4: r0 = socket$inet6(0xa, 0x80003, 0x6b) ioctl(r0, 0x1000008912, &(0x7f00000001c0)="080db5055e0bcfe8476071") r1 = socket(0x10, 0x2, 0x0) sendto(r1, &(0x7f0000000200)="120000001200e7ef007b1a3fcd00000000a1", 0x12, 0x0, 0x0, 0x18) recvmmsg(r1, &(0x7f00000037c0)=[{{&(0x7f0000000600)=@ethernet={0x0, @random}, 0x80, &(0x7f0000000380)=[{&(0x7f0000000040)=""/95, 0x5f}, {&(0x7f00000000c0)=""/85, 0x55}, {&(0x7f0000000400)=""/120, 0x78}, {&(0x7f0000000480)=""/60, 0x3c}, {&(0x7f0000000280)=""/77, 0x4d}, {&(0x7f0000000540)=""/154, 0x9a}, {&(0x7f0000000340)=""/22, 0x16}], 0x7, &(0x7f0000002400)=""/191, 0xbf}}], 0x1, 0x6, &(0x7f0000003700)={0x77359400}) 15:25:06 executing program 2: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000340)={'erspan0\x00', 0x0}) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000300)={'syz_tun\x00', 0x0}) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r7, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r6, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000380)=@newlink={0x34, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r8}, [@IFLA_LINKINFO={0x14, 0x12, @bridge={{0xb, 0x1, 'bridge\x00'}, {0x4}}}]}, 0x34}}, 0x0) sendmsg$nl_route(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000002700)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r5}, [@IFLA_MASTER={0x8, 0xa, r8}]}, 0x28}}, 0x0) sendmsg$nl_route(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f00000000c0)=ANY=[@ANYBLOB="2800000010000104000040000000000000001ea6", @ANYRES32=r2, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00\b\x00\n\x00', @ANYRES32=r8], 0x28}}, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r10 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r9, 0x8933, &(0x7f0000000300)={'syz_tun\x00', 0x0}) sendmsg$nl_route(r10, &(0x7f0000000000)={0x0, 0xf0, &(0x7f00000000c0)={&(0x7f0000000040)=@newlink={0x2c, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r11}, [@IFLA_BROADCAST={0xa}]}, 0x332}}, 0x0) 15:25:06 executing program 5: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000340)={'erspan0\x00', 0x0}) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000300)={'syz_tun\x00', 0x0}) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r7, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r6, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000380)=@newlink={0x34, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r8}, [@IFLA_LINKINFO={0x14, 0x12, @bridge={{0xb, 0x1, 'bridge\x00'}, {0x4}}}]}, 0x34}}, 0x0) sendmsg$nl_route(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000002700)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r5}, [@IFLA_MASTER={0x8, 0xa, r8}]}, 0x28}}, 0x0) sendmsg$nl_route(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f00000000c0)=ANY=[@ANYBLOB="2800000010000104000040000000000000001ea6", @ANYRES32=r2, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00\b\x00\n\x00', @ANYRES32=r8], 0x28}}, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r10 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r9, 0x8933, &(0x7f0000000300)={'syz_tun\x00', 0x0}) sendmsg$nl_route(r10, &(0x7f0000000000)={0x0, 0xa, &(0x7f00000000c0)={&(0x7f0000000040)=@newlink={0x2c, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r11}, [@IFLA_BROADCAST={0xa}]}, 0x332}}, 0x0) [ 424.040097][T18069] netlink: 72 bytes leftover after parsing attributes in process `syz-executor.1'. [ 424.129921][T18075] netlink: 72 bytes leftover after parsing attributes in process `syz-executor.3'. 15:25:06 executing program 0: r0 = socket(0x21, 0xa, 0x1) r1 = socket(0x10, 0x80002, 0x0) ioctl(r1, 0x1000008912, &(0x7f00000001c0)="080db5055e0bcfe8696071") getsockopt$inet_sctp_SCTP_PEER_AUTH_CHUNKS(r1, 0x84, 0x1a, &(0x7f0000000940)=ANY=[@ANYRES32=0x0, @ANYBLOB='\x00'/12], &(0x7f0000000980)=0x10) getsockopt$inet_sctp_SCTP_GET_PEER_ADDR_INFO(r0, 0x84, 0xf, &(0x7f00000009c0)={r2, @in6={{0xa, 0x4e21, 0x8, @local, 0x401}}, 0x9, 0x1, 0x7, 0x7f, 0x6}, &(0x7f0000000a80)=0x98) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000400)='nl80211\x00') sendmsg$NL80211_CMD_GET_MESH_CONFIG(r0, &(0x7f0000000580)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x103190}, 0xc, &(0x7f0000000540)={&(0x7f0000000500)={0x34, r3, 0x10, 0x70bd2d, 0x25dfdbfe, {}, [@NL80211_ATTR_WDEV={0xc, 0x99, {0x1, 0xffffffffffffffff}}, @NL80211_ATTR_WIPHY={0x8, 0x1, 0x1}, @NL80211_ATTR_WDEV={0xc, 0x99, {0x3f, 0x3}}]}, 0x34}, 0x1, 0x0, 0x0, 0x800}, 0x40000) r4 = socket$nl_generic(0x10, 0x3, 0x10) bind$netlink(r4, &(0x7f0000000000)={0x10, 0x0, 0x25dfdbff, 0x1004280}, 0xffffffffffffffb3) sendmsg$nl_generic(r4, &(0x7f0000000080)={&(0x7f0000000480)={0x10, 0xbb7f}, 0xc, &(0x7f0000000440)={&(0x7f00000004c0)={0x1c, 0x22, 0x1, 0x0, 0x0, {0x4}, [@typed={0x8, 0xc}]}, 0x1c}}, 0x0) socket$netlink(0x10, 0x3, 0x0) r5 = socket$alg(0x26, 0x5, 0x0) bind$alg(r5, 0x0, 0x0) [ 424.220418][T18072] netlink: 'syz-executor.1': attribute type 274 has an invalid length. 15:25:06 executing program 4: r0 = socket$inet6(0xa, 0x80003, 0x6b) ioctl(r0, 0x1000008912, &(0x7f00000001c0)="080db5055e0bcfe8476071") r1 = socket(0x10, 0x2, 0x0) sendto(r1, &(0x7f0000000200)="120000001200e7ef007b1a3fcd00000000a1", 0x12, 0x0, 0x0, 0x18) recvmmsg(r1, &(0x7f00000037c0)=[{{&(0x7f0000000600)=@ethernet={0x0, @random}, 0x80, &(0x7f0000000380)=[{&(0x7f0000000040)=""/95, 0x5f}, {&(0x7f00000000c0)=""/85, 0x55}, {&(0x7f0000000400)=""/120, 0x78}, {&(0x7f0000000480)=""/60, 0x3c}, {&(0x7f0000000280)=""/77, 0x4d}, {&(0x7f0000000540)=""/154, 0x9a}, {&(0x7f0000000340)=""/22, 0x16}], 0x7, &(0x7f0000002400)=""/191, 0xbf}}], 0x1, 0x6, &(0x7f0000003700)={0x77359400}) [ 424.271241][T18072] netlink: 'syz-executor.1': attribute type 274 has an invalid length. [ 424.290320][T18088] device syz_tun left promiscuous mode [ 424.308702][T18088] bridge234: port 1(syz_tun) entered disabled state [ 424.458027][T18088] bridge235: port 1(syz_tun) entered blocking state [ 424.465171][T18088] bridge235: port 1(syz_tun) entered disabled state [ 424.474147][T18088] device syz_tun entered promiscuous mode [ 424.482040][T18090] device syz_tun left promiscuous mode [ 424.490451][T18090] bridge224: port 1(syz_tun) entered disabled state [ 424.608931][T18090] bridge225: port 1(syz_tun) entered blocking state [ 424.615656][T18090] bridge225: port 1(syz_tun) entered disabled state [ 424.624465][T18090] device syz_tun entered promiscuous mode [ 424.634138][T18085] bridge225: port 2(erspan0) entered blocking state [ 424.641042][T18085] bridge225: port 2(erspan0) entered disabled state [ 424.649483][T18085] device erspan0 entered promiscuous mode [ 424.657712][T18084] device erspan0 left promiscuous mode [ 424.664911][T18084] bridge234: port 2(erspan0) entered disabled state 15:25:06 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000004c0)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r3, @ANYBLOB="0000000000000000280012000c0001007665746800000000180002001400010000000000", @ANYRES32=0x0, @ANYBLOB="00000000008433df6d6f6b577d4eaa"], 0x5}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000540)=ANY=[@ANYBLOB="7400000024000705000000000000000000010000", @ANYRES32=r3, @ANYBLOB="00000000ffffffff000000000800010073667100486818973f73461919309b68e1693572bb000229c6090032d0ed64f3c3545aaf6e000085a4e4ebb5ef670000000000000000000000000000001a4e624d29a84abf03265700000000000000000000000000000000000000000000000000000000000000ac20000089b53c947244306a0216a3de887763df5b42498b13bb1938de859ee6d7ae7dd2224dc672b69b4358871b170ea0b667832e5224ee3538f885b7abd9bc4a7d"], 0x74}}, 0x0) r4 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r4, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000300)=ANY=[@ANYBLOB="840000002c00010700"/20, @ANYRES32=r3, @ANYBLOB="0008008000000000030000000800010075333200580002001400050000000000000000000000000000000000400006003c0001000000000000001020898dde66057433b6ef3a41d22be225e0001b0000000000000000000000000017256ffc66e43a2484e1a912c5998bcbf0d0000000000000000000000000000000798a3c067277da1a290b9613a33c575c36fad473382c8f5532ef3f0e1d2c450a7decbf3431a69f9b2ecb3291bed174245a962fe0484676958265e2988326a89db3139d91fe4aee6ae7e745ab00001a9f61f20500000000000000b3958bc14fce6e66a36d1ab3194534ba4e973684b27793bff837d3"], 0x84}}, 0x0) r5 = socket(0x10, 0x80002, 0x0) sendmmsg$alg(r5, &(0x7f0000000140), 0x49249249249278c, 0x0) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r6, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000500)=@newlink={0x20, 0x11, 0x40d, 0x0, 0x0, {0x0, 0x0, 0x0, r8}}, 0x20}}, 0x0) r9 = socket(0x10, 0x80002, 0x0) getsockopt$inet_sctp_SCTP_PEER_AUTH_CHUNKS(0xffffffffffffffff, 0x84, 0x1a, &(0x7f0000000940)=ANY=[@ANYRES32=0x0, @ANYBLOB='\x00'/12], &(0x7f0000000980)=0x10) r10 = socket(0xa, 0x6, 0x0) close(r10) r11 = socket$inet6_sctp(0xa, 0x10000000005, 0x84) setsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX(r11, 0x84, 0x6e, &(0x7f0000000180)=[@in6={0xa, 0x0, 0x0, @remote, 0x9}], 0x1c) getsockopt$inet_sctp6_SCTP_GET_ASSOC_ID_LIST(r11, 0x84, 0x1d, &(0x7f000095dff8)={0x1, [0x0]}, &(0x7f000095dffc)=0x8) setsockopt$inet_sctp_SCTP_RTOINFO(r10, 0x84, 0x0, &(0x7f0000000000)={r12, 0x0, 0x0, 0x1000000}, 0x10) setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(0xffffffffffffffff, 0x84, 0x9, &(0x7f0000000680)={r12, @in={{0x2, 0x4e20, @remote}}, 0x10001, 0xfff7, 0x5, 0x1, 0x8, 0x5, 0xba}, 0x9c) ioctl(r9, 0x1000008912, &(0x7f00000001c0)="080db5055e0bcfe8696071") getsockopt$inet_sctp_SCTP_PEER_AUTH_CHUNKS(r9, 0x84, 0x1a, &(0x7f0000000940)=ANY=[@ANYRES32=0x0, @ANYBLOB='\x00'/12], &(0x7f0000000980)=0x10) r13 = socket$nl_generic(0x10, 0x3, 0x10) r14 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080)='nl80211\x00') r15 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL80211_CMD_GET_STATION(r15, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000240)={0x1c, r14, 0xf2b, 0x0, 0x0, {}, [@NL80211_ATTR_AIRTIME_WEIGHT={0x8}]}, 0x1c}}, 0x0) sendmsg$NL80211_CMD_GET_MPATH(r13, &(0x7f00000001c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x2000}, 0x268, &(0x7f0000000080)={&(0x7f0000000200)={0x40, r14, 0x4, 0x70bd2d, 0x25dfdbff}, 0xff6b}, 0x1, 0x0, 0x0, 0x10049050}, 0x260448c0) sendmsg$NL80211_CMD_NEW_KEY(r9, &(0x7f0000000640)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0xb0024000}, 0xc, &(0x7f00000002c0)={&(0x7f0000000440)={0x7c, r14, 0x23, 0x70bd27, 0x25dfdbff, {}, [@NL80211_ATTR_KEY_DATA_WEP40={0x9, 0x7, "a80875ab12"}, @NL80211_ATTR_KEY={0x5c, 0x50, [@NL80211_KEY_DEFAULT_TYPES={0x14, 0x8, [@NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_MULTICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_MULTICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_MULTICAST={0x4}]}, @NL80211_KEY_DEFAULT_TYPES={0x28, 0x8, [@NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_MULTICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_MULTICAST={0x4}]}, @NL80211_KEY_IDX={0x5, 0x2, 0x5}, @NL80211_KEY_DATA_WEP104={0x11, 0x1, "4d84c4e30151cb27f51a4adf63"}]}]}, 0x7c}, 0x1, 0x0, 0x0, 0x24000}, 0x40) [ 424.807850][T18084] bridge235: port 2(erspan0) entered blocking state [ 424.814770][T18084] bridge235: port 2(erspan0) entered disabled state [ 424.823324][T18084] device erspan0 entered promiscuous mode 15:25:06 executing program 5: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000340)={'erspan0\x00', 0x0}) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000300)={'syz_tun\x00', 0x0}) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r7, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r6, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000380)=@newlink={0x34, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r8}, [@IFLA_LINKINFO={0x14, 0x12, @bridge={{0xb, 0x1, 'bridge\x00'}, {0x4}}}]}, 0x34}}, 0x0) sendmsg$nl_route(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000002700)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r5}, [@IFLA_MASTER={0x8, 0xa, r8}]}, 0x28}}, 0x0) sendmsg$nl_route(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f00000000c0)=ANY=[@ANYBLOB="2800000010000104000040000000000000001ea6", @ANYRES32=r2, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00\b\x00\n\x00', @ANYRES32=r8], 0x28}}, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r10 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r9, 0x8933, &(0x7f0000000300)={'syz_tun\x00', 0x0}) sendmsg$nl_route(r10, &(0x7f0000000000)={0x0, 0xc, &(0x7f00000000c0)={&(0x7f0000000040)=@newlink={0x2c, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r11}, [@IFLA_BROADCAST={0xa}]}, 0x332}}, 0x0) 15:25:06 executing program 4: r0 = socket$inet6(0xa, 0x80003, 0x6b) ioctl(r0, 0x1000008912, &(0x7f00000001c0)="080db5055e0bcfe8476071") r1 = socket(0x10, 0x2, 0x0) sendto(r1, &(0x7f0000000200)="120000001200e7ef007b1a3fcd00000000a1", 0x12, 0x0, 0x0, 0x18) recvmmsg(r1, &(0x7f00000037c0)=[{{&(0x7f0000000600)=@ethernet={0x0, @random}, 0x80, &(0x7f0000000380)=[{&(0x7f0000000040)=""/95, 0x5f}, {&(0x7f00000000c0)=""/85, 0x55}, {&(0x7f0000000400)=""/120, 0x78}, {&(0x7f0000000480)=""/60, 0x3c}, {&(0x7f0000000280)=""/77, 0x4d}, {&(0x7f0000000540)=""/154, 0x9a}, {&(0x7f0000000340)=""/22, 0x16}], 0x7, &(0x7f0000002400)=""/191, 0xbf}}], 0x1, 0x6, &(0x7f0000003700)={0x77359400}) 15:25:07 executing program 2: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000340)={'erspan0\x00', 0x0}) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000300)={'syz_tun\x00', 0x0}) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r7, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r6, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000380)=@newlink={0x34, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r8}, [@IFLA_LINKINFO={0x14, 0x12, @bridge={{0xb, 0x1, 'bridge\x00'}, {0x4}}}]}, 0x34}}, 0x0) sendmsg$nl_route(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000002700)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r5}, [@IFLA_MASTER={0x8, 0xa, r8}]}, 0x28}}, 0x0) sendmsg$nl_route(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f00000000c0)=ANY=[@ANYBLOB="2800000010000104000040000000000000001ea6", @ANYRES32=r2, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00\b\x00\n\x00', @ANYRES32=r8], 0x28}}, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r10 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r9, 0x8933, &(0x7f0000000300)={'syz_tun\x00', 0x0}) sendmsg$nl_route(r10, &(0x7f0000000000)={0x0, 0x300, &(0x7f00000000c0)={&(0x7f0000000040)=@newlink={0x2c, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r11}, [@IFLA_BROADCAST={0xa}]}, 0x332}}, 0x0) 15:25:07 executing program 3: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000340)={'erspan0\x00', 0x0}) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000300)={'syz_tun\x00', 0x0}) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r7, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r6, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000380)=@newlink={0x34, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r8}, [@IFLA_LINKINFO={0x14, 0x12, @bridge={{0xb, 0x1, 'bridge\x00'}, {0x4}}}]}, 0x34}}, 0x0) sendmsg$nl_route(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000002700)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r5}, [@IFLA_MASTER={0x8, 0xa, r8}]}, 0x28}}, 0x0) sendmsg$nl_route(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f00000000c0)=ANY=[@ANYBLOB="2800000010000104000040000000000000001ea6", @ANYRES32=r2, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00\b\x00\n\x00', @ANYRES32=r8], 0x28}}, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r10 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r9, 0x8933, &(0x7f0000000300)={'syz_tun\x00', 0x0}) sendmsg$nl_route(r10, &(0x7f0000000000)={0x0, 0x60, &(0x7f00000000c0)={&(0x7f0000000040)=@newlink={0x2c, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r11}, [@IFLA_BROADCAST={0xa}]}, 0x332}}, 0x0) [ 424.945164][T18107] netlink: 'syz-executor.1': attribute type 274 has an invalid length. [ 424.971802][T18107] netlink: 'syz-executor.1': attribute type 274 has an invalid length. 15:25:07 executing program 0: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000340)={'erspan0\x00', 0x0}) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000300)={'syz_tun\x00', 0x0}) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r7, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r6, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000380)=@newlink={0x34, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r8}, [@IFLA_LINKINFO={0x14, 0x12, @bridge={{0xb, 0x1, 'bridge\x00'}, {0x4}}}]}, 0x34}}, 0x0) sendmsg$nl_route(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000002700)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r5}, [@IFLA_MASTER={0x8, 0xa, r8}]}, 0x28}}, 0x0) sendmsg$nl_route(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f00000000c0)=ANY=[@ANYBLOB="2800000010000104000040000000000000001ea6", @ANYRES32=r2, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00\b\x00\n\x00', @ANYRES32=r8], 0x28}}, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r10 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r9, 0x8933, &(0x7f0000000300)={'syz_tun\x00', 0x0}) sendmsg$nl_route(r10, &(0x7f0000000000)={0x0, 0x6, &(0x7f00000000c0)={&(0x7f0000000040)=@newlink={0x2c, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r11}, [@IFLA_BROADCAST={0xa}]}, 0x332}}, 0x0) [ 425.075316][T18116] device syz_tun left promiscuous mode [ 425.109119][T18116] bridge225: port 1(syz_tun) entered disabled state [ 425.269181][T18116] bridge226: port 1(syz_tun) entered blocking state [ 425.282691][T18116] bridge226: port 1(syz_tun) entered disabled state [ 425.291901][T18116] device syz_tun entered promiscuous mode [ 425.306559][T18121] device erspan0 left promiscuous mode [ 425.313184][T18121] bridge225: port 2(erspan0) entered disabled state [ 425.447809][T18121] bridge226: port 2(erspan0) entered blocking state [ 425.455005][T18121] bridge226: port 2(erspan0) entered disabled state [ 425.467560][T18121] device erspan0 entered promiscuous mode [ 425.493674][T18129] device syz_tun left promiscuous mode [ 425.504455][T18129] bridge235: port 1(syz_tun) entered disabled state 15:25:07 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000004c0)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r3, @ANYBLOB="0000000000000000280012000c0001007665746800000000180002001400010000000000", @ANYRES32=0x0, @ANYBLOB="00000000008433df6d6f6b577d4eaa"], 0x5}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000540)=ANY=[@ANYBLOB="7400000024000705000000000000000000010000", @ANYRES32=r3, @ANYBLOB="00000000ffffffff000000000800010073667100486818973f73461919309b68e1693572bb000229c6090032d0ed64f3c3545aaf6e000085a4e4ebb5ef670000000000000000000000000000001a4e624d29a84abf03265700000000000000000000000000000000000000000000000000000000000000ac20000089b53c947244306a0216a3de887763df5b42498b13bb1938de859ee6d7ae7dd2224dc672b69b4358871b170ea0b667832e5224ee3538f885b7abd9bc4a7d"], 0x74}}, 0x0) r4 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r4, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000300)=ANY=[@ANYBLOB="840000002c00010700"/20, @ANYRES32=r3, @ANYBLOB="0008008000000000030000000800010075333200580002001400050000000000000000000000000000000000400006003c0001000000000000001020898dde66057433b6ef3a41d22be225e0001b0000000000000000000000000017256ffc66e43a2484e1a912c5998bcbf0d0000000000000000000000000000000798a3c067277da1a290b9613a33c575c36fad473382c8f5532ef3f0e1d2c450a7decbf3431a69f9b2ecb3291bed174245a962fe0484676958265e2988326a89db3139d91fe4aee6ae7e745ab00001a9f61f20500000000000000b3958bc14fce6e66a36d1ab3194534ba4e973684b27793bff837d3"], 0x84}}, 0x0) r5 = socket(0x10, 0x80002, 0x0) sendmmsg$alg(r5, &(0x7f0000000140), 0x49249249249278c, 0x0) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r6, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000500)=@newlink={0x20, 0x11, 0x40d, 0x0, 0x0, {0x0, 0x0, 0x0, r8}}, 0x20}}, 0x0) r9 = socket(0x10, 0x80002, 0x0) getsockopt$inet_sctp_SCTP_PEER_AUTH_CHUNKS(0xffffffffffffffff, 0x84, 0x1a, &(0x7f0000000940)=ANY=[@ANYRES32=0x0, @ANYBLOB='\x00'/12], &(0x7f0000000980)=0x10) r10 = socket(0xa, 0x6, 0x0) close(r10) r11 = socket$inet6_sctp(0xa, 0x10000000005, 0x84) setsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX(r11, 0x84, 0x6e, &(0x7f0000000180)=[@in6={0xa, 0x0, 0x0, @remote, 0x9}], 0x1c) getsockopt$inet_sctp6_SCTP_GET_ASSOC_ID_LIST(r11, 0x84, 0x1d, &(0x7f000095dff8)={0x1, [0x0]}, &(0x7f000095dffc)=0x8) setsockopt$inet_sctp_SCTP_RTOINFO(r10, 0x84, 0x0, &(0x7f0000000000)={r12, 0x0, 0x0, 0x1000000}, 0x10) setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(0xffffffffffffffff, 0x84, 0x9, &(0x7f0000000680)={r12, @in={{0x2, 0x4e20, @remote}}, 0x10001, 0xfff7, 0x5, 0x1, 0x8, 0x5, 0xba}, 0x9c) ioctl(r9, 0x1000008912, &(0x7f00000001c0)="080db5055e0bcfe8696071") getsockopt$inet_sctp_SCTP_PEER_AUTH_CHUNKS(r9, 0x84, 0x1a, &(0x7f0000000940)=ANY=[@ANYRES32=0x0, @ANYBLOB='\x00'/12], &(0x7f0000000980)=0x10) r13 = socket$nl_generic(0x10, 0x3, 0x10) r14 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080)='nl80211\x00') r15 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL80211_CMD_GET_STATION(r15, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000240)={0x1c, r14, 0xf2b, 0x0, 0x0, {}, [@NL80211_ATTR_AIRTIME_WEIGHT={0x8}]}, 0x1c}}, 0x0) sendmsg$NL80211_CMD_GET_MPATH(r13, &(0x7f00000001c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x2000}, 0x268, &(0x7f0000000080)={&(0x7f0000000200)={0x40, r14, 0x4, 0x70bd2d, 0x25dfdbff}, 0xff6b}, 0x1, 0x0, 0x0, 0x10049050}, 0x260448c0) sendmsg$NL80211_CMD_NEW_KEY(r9, &(0x7f0000000640)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0xb0024000}, 0xc, &(0x7f00000002c0)={&(0x7f0000000440)={0x7c, r14, 0x23, 0x70bd27, 0x25dfdbff, {}, [@NL80211_ATTR_KEY_DATA_WEP40={0x9, 0x7, "a80875ab12"}, @NL80211_ATTR_KEY={0x5c, 0x50, [@NL80211_KEY_DEFAULT_TYPES={0x14, 0x8, [@NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_MULTICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_MULTICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_MULTICAST={0x4}]}, @NL80211_KEY_DEFAULT_TYPES={0x28, 0x8, [@NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_MULTICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_MULTICAST={0x4}]}, @NL80211_KEY_IDX={0x5, 0x2, 0x5}, @NL80211_KEY_DATA_WEP104={0x11, 0x1, "4d84c4e30151cb27f51a4adf63"}]}]}, 0x7c}, 0x1, 0x0, 0x0, 0x24000}, 0x40) [ 425.619316][T18129] bridge236: port 1(syz_tun) entered blocking state [ 425.626069][T18129] bridge236: port 1(syz_tun) entered disabled state [ 425.645109][T18129] device syz_tun entered promiscuous mode [ 425.677276][T18130] device erspan0 left promiscuous mode [ 425.688002][T18130] bridge235: port 2(erspan0) entered disabled state [ 425.807947][T18130] bridge236: port 2(erspan0) entered blocking state [ 425.814838][T18130] bridge236: port 2(erspan0) entered disabled state [ 425.823260][T18130] device erspan0 entered promiscuous mode [ 425.832091][T18131] device syz_tun left promiscuous mode [ 425.841623][T18131] bridge80: port 1(syz_tun) entered disabled state [ 426.007943][T18131] bridge81: port 1(syz_tun) entered blocking state [ 426.014867][T18131] bridge81: port 1(syz_tun) entered disabled state [ 426.022993][T18131] device syz_tun entered promiscuous mode [ 426.031078][T18132] bridge1: port 1(syz_tun) entered blocking state [ 426.038749][T18132] bridge1: port 1(syz_tun) entered disabled state [ 426.046844][T18132] device syz_tun entered promiscuous mode [ 426.056752][T18134] device erspan0 left promiscuous mode [ 426.063253][T18134] bridge80: port 2(erspan0) entered disabled state [ 426.177764][T18134] bridge81: port 2(erspan0) entered blocking state [ 426.184469][T18134] bridge81: port 2(erspan0) entered disabled state [ 426.196369][T18134] device erspan0 entered promiscuous mode [ 426.203965][T18135] bridge1: port 2(erspan0) entered blocking state [ 426.210752][T18135] bridge1: port 2(erspan0) entered disabled state [ 426.218356][T18135] device erspan0 entered promiscuous mode 15:25:08 executing program 3: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000340)={'erspan0\x00', 0x0}) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000300)={'syz_tun\x00', 0x0}) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r7, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r6, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000380)=@newlink={0x34, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r8}, [@IFLA_LINKINFO={0x14, 0x12, @bridge={{0xb, 0x1, 'bridge\x00'}, {0x4}}}]}, 0x34}}, 0x0) sendmsg$nl_route(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000002700)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r5}, [@IFLA_MASTER={0x8, 0xa, r8}]}, 0x28}}, 0x0) sendmsg$nl_route(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f00000000c0)=ANY=[@ANYBLOB="2800000010000104000040000000000000001ea6", @ANYRES32=r2, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00\b\x00\n\x00', @ANYRES32=r8], 0x28}}, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r10 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r9, 0x8933, &(0x7f0000000300)={'syz_tun\x00', 0x0}) sendmsg$nl_route(r10, &(0x7f0000000000)={0x0, 0x60, &(0x7f00000000c0)={&(0x7f0000000040)=@newlink={0x2c, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r11}, [@IFLA_BROADCAST={0xa}]}, 0x332}}, 0x0) 15:25:08 executing program 4: r0 = socket$inet6(0xa, 0x80003, 0x6b) ioctl(r0, 0x1000008912, &(0x7f00000001c0)="080db5055e0bcfe8476071") r1 = socket(0x10, 0x2, 0x0) sendto(r1, &(0x7f0000000200)="120000001200e7ef007b1a3fcd00000000a1", 0x12, 0x0, 0x0, 0x18) recvmmsg(r1, &(0x7f00000037c0)=[{{&(0x7f0000000600)=@ethernet={0x0, @random}, 0x80, &(0x7f0000000380)=[{&(0x7f0000000040)=""/95, 0x5f}, {&(0x7f00000000c0)=""/85, 0x55}, {0x0}, {&(0x7f0000000400)=""/120, 0x78}, {&(0x7f0000000480)=""/60, 0x3c}, {&(0x7f0000000280)=""/77, 0x4d}, {&(0x7f0000000540)=""/154, 0x9a}, {&(0x7f0000000340)=""/22, 0x16}], 0x8, &(0x7f0000002400)=""/191, 0xbf}}], 0x1, 0x6, &(0x7f0000003700)={0x77359400}) 15:25:08 executing program 0: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000340)={'erspan0\x00', 0x0}) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000300)={'syz_tun\x00', 0x0}) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r7, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r6, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000380)=@newlink={0x34, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r8}, [@IFLA_LINKINFO={0x14, 0x12, @bridge={{0xb, 0x1, 'bridge\x00'}, {0x4}}}]}, 0x34}}, 0x0) sendmsg$nl_route(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000002700)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r5}, [@IFLA_MASTER={0x8, 0xa, r8}]}, 0x28}}, 0x0) sendmsg$nl_route(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f00000000c0)=ANY=[@ANYBLOB="2800000010000104000040000000000000001ea6", @ANYRES32=r2, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00\b\x00\n\x00', @ANYRES32=r8], 0x28}}, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r10 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r9, 0x8933, &(0x7f0000000300)={'syz_tun\x00', 0x0}) sendmsg$nl_route(r10, &(0x7f0000000000)={0x0, 0x6, &(0x7f00000000c0)={&(0x7f0000000040)=@newlink={0x2c, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r11}, [@IFLA_BROADCAST={0xa}]}, 0x332}}, 0x0) [ 426.241585][T18121] device erspan0 left promiscuous mode [ 426.247387][T18121] bridge226: port 2(erspan0) entered disabled state 15:25:08 executing program 5: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000340)={'erspan0\x00', 0x0}) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000300)={'syz_tun\x00', 0x0}) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r7, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r6, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000380)=@newlink={0x34, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r8}, [@IFLA_LINKINFO={0x14, 0x12, @bridge={{0xb, 0x1, 'bridge\x00'}, {0x4}}}]}, 0x34}}, 0x0) sendmsg$nl_route(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000002700)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r5}, [@IFLA_MASTER={0x8, 0xa, r8}]}, 0x28}}, 0x0) sendmsg$nl_route(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f00000000c0)=ANY=[@ANYBLOB="2800000010000104000040000000000000001ea6", @ANYRES32=r2, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00\b\x00\n\x00', @ANYRES32=r8], 0x28}}, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r10 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r9, 0x8933, &(0x7f0000000300)={'syz_tun\x00', 0x0}) sendmsg$nl_route(r10, &(0x7f0000000000)={0x0, 0xe, &(0x7f00000000c0)={&(0x7f0000000040)=@newlink={0x2c, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r11}, [@IFLA_BROADCAST={0xa}]}, 0x332}}, 0x0) [ 426.389214][T18141] __nla_validate_parse: 3 callbacks suppressed [ 426.389225][T18141] netlink: 72 bytes leftover after parsing attributes in process `syz-executor.1'. [ 426.426112][T18142] netlink: 72 bytes leftover after parsing attributes in process `syz-executor.1'. [ 426.444484][T18146] netlink: 'syz-executor.1': attribute type 274 has an invalid length. [ 426.462990][T18147] netlink: 'syz-executor.1': attribute type 274 has an invalid length. [ 426.477224][T18164] device syz_tun left promiscuous mode [ 426.487124][T18164] bridge1: port 1(syz_tun) entered disabled state 15:25:08 executing program 2: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000340)={'erspan0\x00', 0x0}) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000300)={'syz_tun\x00', 0x0}) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r7, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r6, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000380)=@newlink={0x34, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r8}, [@IFLA_LINKINFO={0x14, 0x12, @bridge={{0xb, 0x1, 'bridge\x00'}, {0x4}}}]}, 0x34}}, 0x0) sendmsg$nl_route(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000002700)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r5}, [@IFLA_MASTER={0x8, 0xa, r8}]}, 0x28}}, 0x0) sendmsg$nl_route(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f00000000c0)=ANY=[@ANYBLOB="2800000010000104000040000000000000001ea6", @ANYRES32=r2, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00\b\x00\n\x00', @ANYRES32=r8], 0x28}}, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r10 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r9, 0x8933, &(0x7f0000000300)={'syz_tun\x00', 0x0}) sendmsg$nl_route(r10, &(0x7f0000000000)={0x0, 0x306, &(0x7f00000000c0)={&(0x7f0000000040)=@newlink={0x2c, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r11}, [@IFLA_BROADCAST={0xa}]}, 0x332}}, 0x0) 15:25:08 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000004c0)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r3, @ANYBLOB="0000000000000000280012000c0001007665746800000000180002001400010000000000", @ANYRES32=0x0, @ANYBLOB="00000000008433df6d6f6b577d4eaaf200"], 0x5}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000540)=ANY=[@ANYBLOB="7400000024000705000000000000000000010000", @ANYRES32=r3, @ANYBLOB="00000000ffffffff000000000800010073667100486818973f73461919309b68e1693572bb000229c6090032d0ed64f3c3545aaf6e000085a4e4ebb5ef670000000000000000000000000000001a4e624d29a84abf03265700000000000000000000000000000000000000000000000000000000000000ac20000089b53c947244306a0216a3de887763df5b42498b13bb1938de859ee6d7ae7dd2224dc672b69b4358871b170ea0b667832e5224ee3538f885b7abd9bc4a7d"], 0x74}}, 0x0) r4 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r4, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000300)=ANY=[@ANYBLOB="840000002c00010700"/20, @ANYRES32=r3, @ANYBLOB="0008008000000000030000000800010075333200580002001400050000000000000000000000000000000000400006003c0001000000000000001020898dde66057433b6ef3a41d22be225e0001b0000000000000000000000000017256ffc66e43a2484e1a912c5998bcbf0d0000000000000000000000000000000798a3c067277da1a290b9613a33c575c36fad473382c8f5532ef3f0e1d2c450a7decbf3431a69f9b2ecb3291bed174245a962fe0484676958265e2988326a89db3139d91fe4aee6ae7e745ab00001a9f61f20500000000000000b3958bc14fce6e66a36d1ab3194534ba4e973684b27793bff837d3"], 0x84}}, 0x0) r5 = socket(0x10, 0x80002, 0x0) sendmmsg$alg(r5, &(0x7f0000000140), 0x49249249249278c, 0x0) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r6, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000500)=@newlink={0x20, 0x11, 0x40d, 0x0, 0x0, {0x0, 0x0, 0x0, r8}}, 0x20}}, 0x0) r9 = socket(0x10, 0x80002, 0x0) getsockopt$inet_sctp_SCTP_PEER_AUTH_CHUNKS(0xffffffffffffffff, 0x84, 0x1a, &(0x7f0000000940)=ANY=[@ANYRES32=0x0, @ANYBLOB='\x00'/12], &(0x7f0000000980)=0x10) r10 = socket(0xa, 0x6, 0x0) close(r10) r11 = socket$inet6_sctp(0xa, 0x10000000005, 0x84) setsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX(r11, 0x84, 0x6e, &(0x7f0000000180)=[@in6={0xa, 0x0, 0x0, @remote, 0x9}], 0x1c) getsockopt$inet_sctp6_SCTP_GET_ASSOC_ID_LIST(r11, 0x84, 0x1d, &(0x7f000095dff8)={0x1, [0x0]}, &(0x7f000095dffc)=0x8) setsockopt$inet_sctp_SCTP_RTOINFO(r10, 0x84, 0x0, &(0x7f0000000000)={r12, 0x0, 0x0, 0x1000000}, 0x10) setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(0xffffffffffffffff, 0x84, 0x9, &(0x7f0000000680)={r12, @in={{0x2, 0x4e20, @remote}}, 0x10001, 0xfff7, 0x5, 0x1, 0x8, 0x5, 0xba}, 0x9c) ioctl(r9, 0x1000008912, &(0x7f00000001c0)="080db5055e0bcfe8696071") getsockopt$inet_sctp_SCTP_PEER_AUTH_CHUNKS(r9, 0x84, 0x1a, &(0x7f0000000940)=ANY=[@ANYRES32=0x0, @ANYBLOB='\x00'/12], &(0x7f0000000980)=0x10) r13 = socket$nl_generic(0x10, 0x3, 0x10) r14 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080)='nl80211\x00') r15 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL80211_CMD_GET_STATION(r15, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000240)={0x1c, r14, 0xf2b, 0x0, 0x0, {}, [@NL80211_ATTR_AIRTIME_WEIGHT={0x8}]}, 0x1c}}, 0x0) sendmsg$NL80211_CMD_GET_MPATH(r13, &(0x7f00000001c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x2000}, 0x268, &(0x7f0000000080)={&(0x7f0000000200)={0x40, r14, 0x4, 0x70bd2d, 0x25dfdbff}, 0xff6b}, 0x1, 0x0, 0x0, 0x10049050}, 0x260448c0) sendmsg$NL80211_CMD_NEW_KEY(r9, &(0x7f0000000640)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0xb0024000}, 0xc, &(0x7f00000002c0)={&(0x7f0000000440)={0x7c, r14, 0x23, 0x70bd27, 0x25dfdbff, {}, [@NL80211_ATTR_KEY_DATA_WEP40={0x9, 0x7, "a80875ab12"}, @NL80211_ATTR_KEY={0x5c, 0x50, [@NL80211_KEY_DEFAULT_TYPES={0x14, 0x8, [@NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_MULTICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_MULTICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_MULTICAST={0x4}]}, @NL80211_KEY_DEFAULT_TYPES={0x28, 0x8, [@NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_MULTICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_MULTICAST={0x4}]}, @NL80211_KEY_IDX={0x5, 0x2, 0x5}, @NL80211_KEY_DATA_WEP104={0x11, 0x1, "4d84c4e30151cb27f51a4adf63"}]}]}, 0x7c}, 0x1, 0x0, 0x0, 0x24000}, 0x40) [ 426.632004][T18178] netlink: 72 bytes leftover after parsing attributes in process `syz-executor.1'. 15:25:08 executing program 4: r0 = socket$inet6(0xa, 0x80003, 0x6b) ioctl(r0, 0x1000008912, &(0x7f00000001c0)="080db5055e0bcfe8476071") r1 = socket(0x10, 0x2, 0x0) sendto(r1, &(0x7f0000000200)="120000001200e7ef007b1a3fcd00000000a1", 0x12, 0x0, 0x0, 0x18) recvmmsg(r1, &(0x7f00000037c0)=[{{&(0x7f0000000600)=@ethernet={0x0, @random}, 0x80, &(0x7f0000000380)=[{&(0x7f0000000040)=""/95, 0x5f}, {&(0x7f00000000c0)=""/85, 0x55}, {0x0}, {&(0x7f0000000400)=""/120, 0x78}, {&(0x7f0000000480)=""/60, 0x3c}, {&(0x7f0000000280)=""/77, 0x4d}, {&(0x7f0000000540)=""/154, 0x9a}, {&(0x7f0000000340)=""/22, 0x16}], 0x8, &(0x7f0000002400)=""/191, 0xbf}}], 0x1, 0x6, &(0x7f0000003700)={0x77359400}) [ 426.674600][T18161] device syz_tun left promiscuous mode [ 426.685723][T18161] bridge81: port 1(syz_tun) entered disabled state [ 426.788058][T18161] bridge82: port 1(syz_tun) entered blocking state [ 426.794775][T18161] bridge82: port 1(syz_tun) entered disabled state [ 426.807465][T18161] device syz_tun entered promiscuous mode [ 426.815529][T18165] device erspan0 left promiscuous mode [ 426.827555][T18165] bridge81: port 2(erspan0) entered disabled state [ 426.958624][T18165] bridge82: port 2(erspan0) entered blocking state [ 426.965301][T18165] bridge82: port 2(erspan0) entered disabled state [ 426.974178][T18165] device erspan0 entered promiscuous mode [ 426.986702][T18167] device erspan0 left promiscuous mode [ 426.994337][T18167] bridge1: port 2(erspan0) entered disabled state [ 427.137898][T18167] bridge2: port 1(erspan0) entered blocking state [ 427.147921][T18167] bridge2: port 1(erspan0) entered disabled state [ 427.155848][T18167] device erspan0 entered promiscuous mode [ 427.165694][T18170] device syz_tun left promiscuous mode [ 427.172059][T18170] bridge226: port 1(syz_tun) entered disabled state 15:25:09 executing program 3: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000340)={'erspan0\x00', 0x0}) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000300)={'syz_tun\x00', 0x0}) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r7, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r6, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000380)=@newlink={0x34, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r8}, [@IFLA_LINKINFO={0x14, 0x12, @bridge={{0xb, 0x1, 'bridge\x00'}, {0x4}}}]}, 0x34}}, 0x0) sendmsg$nl_route(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000002700)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r5}, [@IFLA_MASTER={0x8, 0xa, r8}]}, 0x28}}, 0x0) sendmsg$nl_route(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f00000000c0)=ANY=[@ANYBLOB="2800000010000104000040000000000000001ea6", @ANYRES32=r2, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00\b\x00\n\x00', @ANYRES32=r8], 0x28}}, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r10 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r9, 0x8933, &(0x7f0000000300)={'syz_tun\x00', 0x0}) sendmsg$nl_route(r10, &(0x7f0000000000)={0x0, 0x60, &(0x7f00000000c0)={&(0x7f0000000040)=@newlink={0x2c, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r11}, [@IFLA_BROADCAST={0xa}]}, 0x332}}, 0x0) [ 427.297884][T18170] bridge227: port 1(syz_tun) entered blocking state [ 427.305189][T18170] bridge227: port 1(syz_tun) entered disabled state [ 427.314312][T18170] device syz_tun entered promiscuous mode [ 427.327787][T18173] netlink: 72 bytes leftover after parsing attributes in process `syz-executor.1'. 15:25:09 executing program 0: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000340)={'erspan0\x00', 0x0}) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000300)={'syz_tun\x00', 0x0}) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r7, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r6, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000380)=@newlink={0x34, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r8}, [@IFLA_LINKINFO={0x14, 0x12, @bridge={{0xb, 0x1, 'bridge\x00'}, {0x4}}}]}, 0x34}}, 0x0) sendmsg$nl_route(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000002700)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r5}, [@IFLA_MASTER={0x8, 0xa, r8}]}, 0x28}}, 0x0) sendmsg$nl_route(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f00000000c0)=ANY=[@ANYBLOB="2800000010000104000040000000000000001ea6", @ANYRES32=r2, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00\b\x00\n\x00', @ANYRES32=r8], 0x28}}, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r10 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r9, 0x8933, &(0x7f0000000300)={'syz_tun\x00', 0x0}) sendmsg$nl_route(r10, &(0x7f0000000000)={0x0, 0x6, &(0x7f00000000c0)={&(0x7f0000000040)=@newlink={0x2c, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r11}, [@IFLA_BROADCAST={0xa}]}, 0x332}}, 0x0) [ 427.348384][T18177] bridge227: port 2(erspan0) entered blocking state [ 427.355675][T18177] bridge227: port 2(erspan0) entered disabled state [ 427.374082][T18177] device erspan0 entered promiscuous mode [ 427.456489][T18181] device syz_tun left promiscuous mode [ 427.463854][T18181] bridge236: port 1(syz_tun) entered disabled state [ 427.598708][T18181] bridge237: port 1(syz_tun) entered blocking state [ 427.605510][T18181] bridge237: port 1(syz_tun) entered disabled state [ 427.615331][T18181] device syz_tun entered promiscuous mode [ 427.623635][T18185] device erspan0 left promiscuous mode [ 427.633427][T18185] bridge236: port 2(erspan0) entered disabled state 15:25:09 executing program 4: r0 = socket$inet6(0xa, 0x80003, 0x6b) ioctl(r0, 0x1000008912, &(0x7f00000001c0)="080db5055e0bcfe8476071") r1 = socket(0x10, 0x2, 0x0) sendto(r1, &(0x7f0000000200)="120000001200e7ef007b1a3fcd00000000a1", 0x12, 0x0, 0x0, 0x18) recvmmsg(r1, &(0x7f00000037c0)=[{{&(0x7f0000000600)=@ethernet={0x0, @random}, 0x80, &(0x7f0000000380)=[{&(0x7f0000000040)=""/95, 0x5f}, {&(0x7f00000000c0)=""/85, 0x55}, {0x0}, {&(0x7f0000000400)=""/120, 0x78}, {&(0x7f0000000480)=""/60, 0x3c}, {&(0x7f0000000280)=""/77, 0x4d}, {&(0x7f0000000540)=""/154, 0x9a}, {&(0x7f0000000340)=""/22, 0x16}], 0x8, &(0x7f0000002400)=""/191, 0xbf}}], 0x1, 0x6, &(0x7f0000003700)={0x77359400}) [ 427.777741][T18185] bridge237: port 2(erspan0) entered blocking state [ 427.784524][T18185] bridge237: port 2(erspan0) entered disabled state [ 427.792629][T18185] device erspan0 entered promiscuous mode [ 427.807083][T18189] netlink: 'syz-executor.1': attribute type 274 has an invalid length. [ 427.824664][T18191] netlink: 'syz-executor.1': attribute type 274 has an invalid length. 15:25:09 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000004c0)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r3, @ANYBLOB="0000000000000000280012000c0001007665746800000000180002001400010000000000", @ANYRES32=0x0, @ANYBLOB="00000000008433df6d6f6b577d4eaaf200"], 0x5}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000540)=ANY=[@ANYBLOB="7400000024000705000000000000000000010000", @ANYRES32=r3, @ANYBLOB="00000000ffffffff000000000800010073667100486818973f73461919309b68e1693572bb000229c6090032d0ed64f3c3545aaf6e000085a4e4ebb5ef670000000000000000000000000000001a4e624d29a84abf03265700000000000000000000000000000000000000000000000000000000000000ac20000089b53c947244306a0216a3de887763df5b42498b13bb1938de859ee6d7ae7dd2224dc672b69b4358871b170ea0b667832e5224ee3538f885b7abd9bc4a7d"], 0x74}}, 0x0) r4 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r4, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000300)=ANY=[@ANYBLOB="840000002c00010700"/20, @ANYRES32=r3, @ANYBLOB="0008008000000000030000000800010075333200580002001400050000000000000000000000000000000000400006003c0001000000000000001020898dde66057433b6ef3a41d22be225e0001b0000000000000000000000000017256ffc66e43a2484e1a912c5998bcbf0d0000000000000000000000000000000798a3c067277da1a290b9613a33c575c36fad473382c8f5532ef3f0e1d2c450a7decbf3431a69f9b2ecb3291bed174245a962fe0484676958265e2988326a89db3139d91fe4aee6ae7e745ab00001a9f61f20500000000000000b3958bc14fce6e66a36d1ab3194534ba4e973684b27793bff837d3"], 0x84}}, 0x0) r5 = socket(0x10, 0x80002, 0x0) sendmmsg$alg(r5, &(0x7f0000000140), 0x49249249249278c, 0x0) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r6, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000500)=@newlink={0x20, 0x11, 0x40d, 0x0, 0x0, {0x0, 0x0, 0x0, r8}}, 0x20}}, 0x0) r9 = socket(0x10, 0x80002, 0x0) getsockopt$inet_sctp_SCTP_PEER_AUTH_CHUNKS(0xffffffffffffffff, 0x84, 0x1a, &(0x7f0000000940)=ANY=[@ANYRES32=0x0, @ANYBLOB='\x00'/12], &(0x7f0000000980)=0x10) r10 = socket(0xa, 0x6, 0x0) close(r10) r11 = socket$inet6_sctp(0xa, 0x10000000005, 0x84) setsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX(r11, 0x84, 0x6e, &(0x7f0000000180)=[@in6={0xa, 0x0, 0x0, @remote, 0x9}], 0x1c) getsockopt$inet_sctp6_SCTP_GET_ASSOC_ID_LIST(r11, 0x84, 0x1d, &(0x7f000095dff8)={0x1, [0x0]}, &(0x7f000095dffc)=0x8) setsockopt$inet_sctp_SCTP_RTOINFO(r10, 0x84, 0x0, &(0x7f0000000000)={r12, 0x0, 0x0, 0x1000000}, 0x10) setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(0xffffffffffffffff, 0x84, 0x9, &(0x7f0000000680)={r12, @in={{0x2, 0x4e20, @remote}}, 0x10001, 0xfff7, 0x5, 0x1, 0x8, 0x5, 0xba}, 0x9c) ioctl(r9, 0x1000008912, &(0x7f00000001c0)="080db5055e0bcfe8696071") getsockopt$inet_sctp_SCTP_PEER_AUTH_CHUNKS(r9, 0x84, 0x1a, &(0x7f0000000940)=ANY=[@ANYRES32=0x0, @ANYBLOB='\x00'/12], &(0x7f0000000980)=0x10) r13 = socket$nl_generic(0x10, 0x3, 0x10) r14 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080)='nl80211\x00') r15 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL80211_CMD_GET_STATION(r15, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000240)={0x1c, r14, 0xf2b, 0x0, 0x0, {}, [@NL80211_ATTR_AIRTIME_WEIGHT={0x8}]}, 0x1c}}, 0x0) sendmsg$NL80211_CMD_GET_MPATH(r13, &(0x7f00000001c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x2000}, 0x268, &(0x7f0000000080)={&(0x7f0000000200)={0x40, r14, 0x4, 0x70bd2d, 0x25dfdbff}, 0xff6b}, 0x1, 0x0, 0x0, 0x10049050}, 0x260448c0) sendmsg$NL80211_CMD_NEW_KEY(r9, &(0x7f0000000640)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0xb0024000}, 0xc, &(0x7f00000002c0)={&(0x7f0000000440)={0x7c, r14, 0x23, 0x70bd27, 0x25dfdbff, {}, [@NL80211_ATTR_KEY_DATA_WEP40={0x9, 0x7, "a80875ab12"}, @NL80211_ATTR_KEY={0x5c, 0x50, [@NL80211_KEY_DEFAULT_TYPES={0x14, 0x8, [@NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_MULTICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_MULTICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_MULTICAST={0x4}]}, @NL80211_KEY_DEFAULT_TYPES={0x28, 0x8, [@NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_MULTICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_MULTICAST={0x4}]}, @NL80211_KEY_IDX={0x5, 0x2, 0x5}, @NL80211_KEY_DATA_WEP104={0x11, 0x1, "4d84c4e30151cb27f51a4adf63"}]}]}, 0x7c}, 0x1, 0x0, 0x0, 0x24000}, 0x40) 15:25:09 executing program 5: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000340)={'erspan0\x00', 0x0}) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000300)={'syz_tun\x00', 0x0}) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r7, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r6, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000380)=@newlink={0x34, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r8}, [@IFLA_LINKINFO={0x14, 0x12, @bridge={{0xb, 0x1, 'bridge\x00'}, {0x4}}}]}, 0x34}}, 0x0) sendmsg$nl_route(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000002700)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r5}, [@IFLA_MASTER={0x8, 0xa, r8}]}, 0x28}}, 0x0) sendmsg$nl_route(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f00000000c0)=ANY=[@ANYBLOB="2800000010000104000040000000000000001ea6", @ANYRES32=r2, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00\b\x00\n\x00', @ANYRES32=r8], 0x28}}, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r10 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r9, 0x8933, &(0x7f0000000300)={'syz_tun\x00', 0x0}) sendmsg$nl_route(r10, &(0x7f0000000000)={0x0, 0x10, &(0x7f00000000c0)={&(0x7f0000000040)=@newlink={0x2c, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r11}, [@IFLA_BROADCAST={0xa}]}, 0x332}}, 0x0) [ 427.867112][T18205] device syz_tun left promiscuous mode [ 427.887222][T18205] bridge82: port 1(syz_tun) entered disabled state 15:25:10 executing program 2: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000340)={'erspan0\x00', 0x0}) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000300)={'syz_tun\x00', 0x0}) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r7, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r6, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000380)=@newlink={0x34, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r8}, [@IFLA_LINKINFO={0x14, 0x12, @bridge={{0xb, 0x1, 'bridge\x00'}, {0x4}}}]}, 0x34}}, 0x0) sendmsg$nl_route(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000002700)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r5}, [@IFLA_MASTER={0x8, 0xa, r8}]}, 0x28}}, 0x0) sendmsg$nl_route(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f00000000c0)=ANY=[@ANYBLOB="2800000010000104000040000000000000001ea6", @ANYRES32=r2, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00\b\x00\n\x00', @ANYRES32=r8], 0x28}}, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r10 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r9, 0x8933, &(0x7f0000000300)={'syz_tun\x00', 0x0}) sendmsg$nl_route(r10, &(0x7f0000000000)={0x0, 0x600, &(0x7f00000000c0)={&(0x7f0000000040)=@newlink={0x2c, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r11}, [@IFLA_BROADCAST={0xa}]}, 0x332}}, 0x0) [ 428.047902][T18205] bridge83: port 1(syz_tun) entered blocking state [ 428.054746][T18205] bridge83: port 1(syz_tun) entered disabled state [ 428.064441][T18205] device syz_tun entered promiscuous mode [ 428.078235][T18206] device erspan0 left promiscuous mode [ 428.106741][T18206] bridge82: port 2(erspan0) entered disabled state [ 428.237734][T18206] bridge83: port 2(erspan0) entered blocking state [ 428.244661][T18206] bridge83: port 2(erspan0) entered disabled state [ 428.253152][T18206] device erspan0 entered promiscuous mode [ 428.263627][T18207] bridge3: port 1(syz_tun) entered blocking state [ 428.272455][T18207] bridge3: port 1(syz_tun) entered disabled state 15:25:10 executing program 3 (fault-call:9 fault-nth:0): r0 = socket(0x21, 0xa, 0x1) r1 = socket(0x10, 0x80002, 0x0) ioctl(r1, 0x1000008912, &(0x7f00000001c0)="080db5055e0bcfe8696071") getsockopt$inet_sctp_SCTP_PEER_AUTH_CHUNKS(r1, 0x84, 0x1a, &(0x7f0000000940)=ANY=[@ANYRES32=0x0, @ANYBLOB='\x00'/12], &(0x7f0000000980)=0x10) getsockopt$inet_sctp_SCTP_GET_PEER_ADDR_INFO(r0, 0x84, 0xf, &(0x7f00000009c0)={r2, @in6={{0xa, 0x4e21, 0x8, @local, 0x401}}, 0x9, 0x1, 0x7, 0x7f, 0x6}, &(0x7f0000000a80)=0x98) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000400)='nl80211\x00') sendmsg$NL80211_CMD_GET_MESH_CONFIG(r0, &(0x7f0000000580)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x103190}, 0xc, &(0x7f0000000540)={&(0x7f0000000500)={0x34, r3, 0x10, 0x70bd2d, 0x25dfdbfe, {}, [@NL80211_ATTR_WDEV={0xc, 0x99, {0x1, 0xffffffffffffffff}}, @NL80211_ATTR_WIPHY={0x8, 0x1, 0x1}, @NL80211_ATTR_WDEV={0xc, 0x99, {0x3f, 0x3}}]}, 0x34}, 0x1, 0x0, 0x0, 0x800}, 0x40000) r4 = socket$nl_generic(0x10, 0x3, 0x10) bind$netlink(r4, &(0x7f0000000000)={0x10, 0x0, 0x25dfdbff, 0x1004280}, 0xffffffffffffffb3) sendmsg$nl_generic(r4, &(0x7f0000000080)={&(0x7f0000000480)={0x10, 0xbb7f}, 0xc, &(0x7f0000000440)={&(0x7f00000004c0)={0x1c, 0x22, 0x1, 0x0, 0x0, {0x4}, [@typed={0x8, 0xc}]}, 0x1c}}, 0x0) socket$netlink(0x10, 0x3, 0x0) r5 = socket$alg(0x26, 0x5, 0x0) bind$alg(r5, &(0x7f0000000080)={0x26, 'hash\x00', 0x0, 0x0, 'sha512\x00'}, 0x58) [ 428.287169][T18207] device syz_tun entered promiscuous mode [ 428.296314][T18209] device erspan0 left promiscuous mode [ 428.310694][T18209] bridge2: port 1(erspan0) entered disabled state [ 428.413367][T18241] FAULT_INJECTION: forcing a failure. [ 428.413367][T18241] name failslab, interval 1, probability 0, space 0, times 0 [ 428.426177][T18241] CPU: 0 PID: 18241 Comm: syz-executor.3 Not tainted 5.5.0-rc5-syzkaller #0 [ 428.434874][T18241] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 428.444943][T18241] Call Trace: [ 428.448274][T18241] dump_stack+0x197/0x210 [ 428.452606][T18241] should_fail.cold+0xa/0x15 [ 428.457220][T18241] ? release_sock+0x156/0x1c0 [ 428.461918][T18241] ? fault_create_debugfs_attr+0x180/0x180 [ 428.467910][T18241] ? ___might_sleep+0x163/0x2c0 [ 428.472818][T18241] __should_failslab+0x121/0x190 [ 428.477809][T18241] should_failslab+0x9/0x14 [ 428.482306][T18241] kmem_cache_alloc_node+0x268/0x740 [ 428.487602][T18241] __alloc_skb+0xd5/0x5e0 [ 428.492002][T18241] ? __kmalloc_reserve.isra.0+0xf0/0xf0 [ 428.497550][T18241] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 428.503794][T18241] ? netlink_autobind.isra.0+0x223/0x300 [ 428.509482][T18241] netlink_sendmsg+0xa1b/0xea0 [ 428.514252][T18241] ? netlink_unicast+0x7d0/0x7d0 [ 428.519209][T18241] ? aa_sock_msg_perm.isra.0+0xba/0x170 [ 428.524794][T18241] ? apparmor_socket_sendmsg+0x2a/0x30 [ 428.530272][T18241] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 428.536603][T18241] ? security_socket_sendmsg+0x8d/0xc0 [ 428.542052][T18241] ? netlink_unicast+0x7d0/0x7d0 [ 428.546977][T18241] sock_sendmsg+0xd7/0x130 [ 428.551384][T18241] ____sys_sendmsg+0x753/0x880 [ 428.557024][T18241] ? kernel_sendmsg+0x50/0x50 [ 428.561712][T18241] ? __fget+0x35d/0x550 [ 428.565868][T18241] ? find_held_lock+0x35/0x130 [ 428.570642][T18241] ___sys_sendmsg+0x100/0x170 [ 428.575335][T18241] ? sendmsg_copy_msghdr+0x70/0x70 [ 428.580451][T18241] ? __kasan_check_read+0x11/0x20 [ 428.585477][T18241] ? __fget+0x37f/0x550 [ 428.589654][T18241] ? ksys_dup3+0x3e0/0x3e0 [ 428.594082][T18241] ? __fget_light+0x1a9/0x230 [ 428.598757][T18241] ? __fdget+0x1b/0x20 [ 428.602825][T18241] ? __sanitizer_cov_trace_const_cmp8+0x18/0x20 [ 428.609070][T18241] __sys_sendmsg+0x105/0x1d0 [ 428.613645][T18241] ? __sys_sendmsg_sock+0xc0/0xc0 [ 428.618679][T18241] ? trace_hardirqs_on_thunk+0x1a/0x1c [ 428.624142][T18241] ? do_syscall_64+0x26/0x790 [ 428.628838][T18241] ? entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 428.634921][T18241] ? do_syscall_64+0x26/0x790 [ 428.639590][T18241] __x64_sys_sendmsg+0x78/0xb0 [ 428.644353][T18241] do_syscall_64+0xfa/0x790 [ 428.648845][T18241] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 428.654718][T18241] RIP: 0033:0x45af49 [ 428.658608][T18241] Code: ad b6 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 7b b6 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 428.678206][T18241] RSP: 002b:00007fecc9f56c78 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 428.686607][T18241] RAX: ffffffffffffffda RBX: 00007fecc9f56c90 RCX: 000000000045af49 [ 428.694571][T18241] RDX: 0000000000000000 RSI: 0000000020000080 RDI: 0000000000000004 [ 428.702552][T18241] RBP: 000000000075bfc8 R08: 0000000000000000 R09: 0000000000000000 [ 428.710515][T18241] R10: 0000000000000000 R11: 0000000000000246 R12: 00007fecc9f576d4 [ 428.718490][T18241] R13: 00000000004ca9e7 R14: 00000000004e3e80 R15: 0000000000000005 [ 428.738570][T18209] bridge3: port 2(erspan0) entered blocking state [ 428.745189][T18209] bridge3: port 2(erspan0) entered disabled state [ 428.757251][T18209] device erspan0 entered promiscuous mode 15:25:10 executing program 0: pipe(&(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000300)=ANY=[@ANYBLOB="d00800002400ffffff7f00000005ffffa6fffff7", @ANYRES32, @ANYBLOB="00000000ffffffff000e00000800010063627100a408020004040600030000000500000000700300fdffffffffff00001f0000000500000000020000010000000000100083000000fdffffff07000000084900000100000002000000cf000000feffffff080000000180000003000000090000000200000000800000d00d337d05000000050000000100000004000000ff7f000000000000000400000002000004000000ff0f0000f44f350001000000010400005eb768350100000008000000ffffffffc38d00001f000000040000000600000000000100f7ffffff030000000080ffff050000000600000006000000a900000000000000c0000000c0ffffff08000000018000000101000006000000b300000000000020050000000104000004000000070000000800000001010000c22e0000c0ffffff0500000004000000060000000900000008000000f7ffffff0800000003000000080000000400000001000080040000000400000000100000040000000700000009000000fcffffff01000000010000000900000000020000060e0000080000000200000002000000090000000800000007000000ab000000fb00000007000000ff0100000800000001040000070000000300000009230000ff07000008000000ffff0000a90100000900000005000000200000000500000001000000070000008eb7000000000080010000000000000007000000fffffffffcffffff01f0ffff000000003f00000003000000000100000080000000800000030000000500000005000000ffffffff0700000015ba000004000000070000000300000003000000ffffffff04000000554f00006ff800000700000003000000000200000600000008000000b3000000060000004b0d00000500000001010000030000000080000000040000730a000001000080010000009e0c0000000800000100008000000000000000004000000000fefffff67d000004000000ff01000002000000000000004000000040000000ed000000010001000e0a00000020000000020000040000000600000002000000ff7f00000100000001000000060000007f000000020000000004000004000000090000009000000008000000b6000000040000000400000005000000f50a0000ffff0000060000008ff9ffff070000001eaaffff3f0000008000000000000000ff0c0000ff7f0000030000007f0000002d0000000800000000010000ff070000ffffffff2bab000002000000ace800000500000000000000e1bf934d070000001f0000000300000004000000070000000900000005000000030000000200000087d400000200000008000000000100007f0000000e000000080000000200000007000000ffffff7f06000000000000000500000001000000820000001f0000000004000001000000faffffff0500000006000000070000000300000010000500810306009fff040008000000040406"], 0x3}}, 0x0) r2 = socket$inet_udp(0x2, 0x2, 0x0) syz_genetlink_get_family_id$ipvs(&(0x7f0000000740)='IPVS\x00') r3 = socket(0x11, 0x800000003, 0x0) bind(r3, &(0x7f0000000080)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(r3, &(0x7f0000000000)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000140)=0x14) r5 = socket(0x10, 0x80002, 0x0) ioctl(r5, 0x1000008912, &(0x7f00000001c0)="080db5055e0bcfe8696071") getsockopt$inet_sctp_SCTP_PEER_AUTH_CHUNKS(r5, 0x84, 0x1a, &(0x7f0000000940)=ANY=[@ANYRES32=0x0, @ANYBLOB='\x00'/12], &(0x7f0000000980)=0x10) setsockopt$IPT_SO_SET_ADD_COUNTERS(r5, 0x0, 0x41, &(0x7f0000000180)={'security\x00', 0x3, [{}, {}, {}]}, 0x58) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000300)=ANY=[@ANYBLOB="d00800002400ffffff7f00000005ffffa6fffff7", @ANYRES32=r4], 0x2}}, 0x0) setsockopt$inet6_mreq(0xffffffffffffffff, 0x29, 0x0, &(0x7f0000000000)={@mcast2}, 0x14) close(r2) socket$inet(0x10, 0x2, 0x0) write$binfmt_misc(r1, &(0x7f0000000000)=ANY=[], 0xfffffecc) splice(r0, 0x0, r2, 0x0, 0x4ffe0, 0x0) 15:25:10 executing program 4: r0 = socket$inet6(0xa, 0x80003, 0x6b) ioctl(r0, 0x1000008912, &(0x7f00000001c0)="080db5055e0bcfe8476071") r1 = socket(0x10, 0x2, 0x0) sendto(r1, &(0x7f0000000200)="120000001200e7ef007b1a3fcd00000000a1", 0x12, 0x0, 0x0, 0x18) recvmmsg(r1, &(0x7f00000037c0)=[{{&(0x7f0000000600)=@ethernet={0x0, @random}, 0x80, &(0x7f0000000380)=[{&(0x7f0000000040)=""/95, 0x5f}, {&(0x7f00000024c0)=""/4096, 0x1000}, {&(0x7f0000000400)=""/120, 0x78}, {&(0x7f0000000480)=""/60, 0x3c}, {&(0x7f0000000280)=""/77, 0x4d}, {&(0x7f0000000540)=""/154, 0x9a}, {&(0x7f0000000340)=""/22, 0x16}], 0x7, &(0x7f0000002400)=""/191, 0xbf}}], 0x1, 0x6, &(0x7f0000003700)={0x77359400}) [ 428.778082][T18216] netlink: 72 bytes leftover after parsing attributes in process `syz-executor.1'. [ 428.802393][T18220] netlink: 72 bytes leftover after parsing attributes in process `syz-executor.1'. [ 428.867811][T18224] device syz_tun left promiscuous mode [ 428.897944][T18224] bridge227: port 1(syz_tun) entered disabled state [ 429.047859][T18224] bridge228: port 1(syz_tun) entered blocking state [ 429.054633][T18224] bridge228: port 1(syz_tun) entered disabled state [ 429.068356][T18224] device syz_tun entered promiscuous mode [ 429.075843][T18226] device erspan0 left promiscuous mode [ 429.081832][T18226] bridge227: port 2(erspan0) entered disabled state [ 429.207978][T18226] bridge228: port 2(erspan0) entered blocking state [ 429.217740][T18226] bridge228: port 2(erspan0) entered disabled state [ 429.226028][T18226] device erspan0 entered promiscuous mode [ 429.241361][T18232] netlink: 'syz-executor.1': attribute type 274 has an invalid length. [ 429.250976][T18233] device syz_tun left promiscuous mode [ 429.256848][T18233] bridge237: port 1(syz_tun) entered disabled state 15:25:11 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000004c0)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r3, @ANYBLOB="0000000000000000280012000c0001007665746800000000180002001400010000000000", @ANYRES32=0x0, @ANYBLOB="00000000008433df6d6f6b577d4eaaf200"], 0x5}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000540)=ANY=[@ANYBLOB="7400000024000705000000000000000000010000", @ANYRES32=r3, @ANYBLOB="00000000ffffffff000000000800010073667100486818973f73461919309b68e1693572bb000229c6090032d0ed64f3c3545aaf6e000085a4e4ebb5ef670000000000000000000000000000001a4e624d29a84abf03265700000000000000000000000000000000000000000000000000000000000000ac20000089b53c947244306a0216a3de887763df5b42498b13bb1938de859ee6d7ae7dd2224dc672b69b4358871b170ea0b667832e5224ee3538f885b7abd9bc4a7d"], 0x74}}, 0x0) r4 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r4, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000300)=ANY=[@ANYBLOB="840000002c00010700"/20, @ANYRES32=r3, @ANYBLOB="0008008000000000030000000800010075333200580002001400050000000000000000000000000000000000400006003c0001000000000000001020898dde66057433b6ef3a41d22be225e0001b0000000000000000000000000017256ffc66e43a2484e1a912c5998bcbf0d0000000000000000000000000000000798a3c067277da1a290b9613a33c575c36fad473382c8f5532ef3f0e1d2c450a7decbf3431a69f9b2ecb3291bed174245a962fe0484676958265e2988326a89db3139d91fe4aee6ae7e745ab00001a9f61f20500000000000000b3958bc14fce6e66a36d1ab3194534ba4e973684b27793bff837d3"], 0x84}}, 0x0) r5 = socket(0x10, 0x80002, 0x0) sendmmsg$alg(r5, &(0x7f0000000140), 0x49249249249278c, 0x0) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r6, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000500)=@newlink={0x20, 0x11, 0x40d, 0x0, 0x0, {0x0, 0x0, 0x0, r8}}, 0x20}}, 0x0) r9 = socket(0x10, 0x80002, 0x0) getsockopt$inet_sctp_SCTP_PEER_AUTH_CHUNKS(0xffffffffffffffff, 0x84, 0x1a, &(0x7f0000000940)=ANY=[@ANYRES32=0x0, @ANYBLOB='\x00'/12], &(0x7f0000000980)=0x10) r10 = socket(0xa, 0x6, 0x0) close(r10) r11 = socket$inet6_sctp(0xa, 0x10000000005, 0x84) setsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX(r11, 0x84, 0x6e, &(0x7f0000000180)=[@in6={0xa, 0x0, 0x0, @remote, 0x9}], 0x1c) getsockopt$inet_sctp6_SCTP_GET_ASSOC_ID_LIST(r11, 0x84, 0x1d, &(0x7f000095dff8)={0x1, [0x0]}, &(0x7f000095dffc)=0x8) setsockopt$inet_sctp_SCTP_RTOINFO(r10, 0x84, 0x0, &(0x7f0000000000)={r12, 0x0, 0x0, 0x1000000}, 0x10) setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(0xffffffffffffffff, 0x84, 0x9, &(0x7f0000000680)={r12, @in={{0x2, 0x4e20, @remote}}, 0x10001, 0xfff7, 0x5, 0x1, 0x8, 0x5, 0xba}, 0x9c) ioctl(r9, 0x1000008912, &(0x7f00000001c0)="080db5055e0bcfe8696071") getsockopt$inet_sctp_SCTP_PEER_AUTH_CHUNKS(r9, 0x84, 0x1a, &(0x7f0000000940)=ANY=[@ANYRES32=0x0, @ANYBLOB='\x00'/12], &(0x7f0000000980)=0x10) r13 = socket$nl_generic(0x10, 0x3, 0x10) r14 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080)='nl80211\x00') r15 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL80211_CMD_GET_STATION(r15, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000240)={0x1c, r14, 0xf2b, 0x0, 0x0, {}, [@NL80211_ATTR_AIRTIME_WEIGHT={0x8}]}, 0x1c}}, 0x0) sendmsg$NL80211_CMD_GET_MPATH(r13, &(0x7f00000001c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x2000}, 0x268, &(0x7f0000000080)={&(0x7f0000000200)={0x40, r14, 0x4, 0x70bd2d, 0x25dfdbff}, 0xff6b}, 0x1, 0x0, 0x0, 0x10049050}, 0x260448c0) sendmsg$NL80211_CMD_NEW_KEY(r9, &(0x7f0000000640)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0xb0024000}, 0xc, &(0x7f00000002c0)={&(0x7f0000000440)={0x7c, r14, 0x23, 0x70bd27, 0x25dfdbff, {}, [@NL80211_ATTR_KEY_DATA_WEP40={0x9, 0x7, "a80875ab12"}, @NL80211_ATTR_KEY={0x5c, 0x50, [@NL80211_KEY_DEFAULT_TYPES={0x14, 0x8, [@NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_MULTICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_MULTICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_MULTICAST={0x4}]}, @NL80211_KEY_DEFAULT_TYPES={0x28, 0x8, [@NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_MULTICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_MULTICAST={0x4}]}, @NL80211_KEY_IDX={0x5, 0x2, 0x5}, @NL80211_KEY_DATA_WEP104={0x11, 0x1, "4d84c4e30151cb27f51a4adf63"}]}]}, 0x7c}, 0x1, 0x0, 0x0, 0x24000}, 0x40) [ 429.377848][T18233] bridge238: port 1(syz_tun) entered blocking state [ 429.384679][T18233] bridge238: port 1(syz_tun) entered disabled state [ 429.394955][T18233] device syz_tun entered promiscuous mode [ 429.402622][T18234] netlink: 'syz-executor.1': attribute type 274 has an invalid length. [ 429.412378][T18235] device erspan0 left promiscuous mode [ 429.420471][T18235] bridge237: port 2(erspan0) entered disabled state 15:25:11 executing program 3 (fault-call:9 fault-nth:1): r0 = socket(0x21, 0xa, 0x1) r1 = socket(0x10, 0x80002, 0x0) ioctl(r1, 0x1000008912, &(0x7f00000001c0)="080db5055e0bcfe8696071") getsockopt$inet_sctp_SCTP_PEER_AUTH_CHUNKS(r1, 0x84, 0x1a, &(0x7f0000000940)=ANY=[@ANYRES32=0x0, @ANYBLOB='\x00'/12], &(0x7f0000000980)=0x10) getsockopt$inet_sctp_SCTP_GET_PEER_ADDR_INFO(r0, 0x84, 0xf, &(0x7f00000009c0)={r2, @in6={{0xa, 0x4e21, 0x8, @local, 0x401}}, 0x9, 0x1, 0x7, 0x7f, 0x6}, &(0x7f0000000a80)=0x98) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000400)='nl80211\x00') sendmsg$NL80211_CMD_GET_MESH_CONFIG(r0, &(0x7f0000000580)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x103190}, 0xc, &(0x7f0000000540)={&(0x7f0000000500)={0x34, r3, 0x10, 0x70bd2d, 0x25dfdbfe, {}, [@NL80211_ATTR_WDEV={0xc, 0x99, {0x1, 0xffffffffffffffff}}, @NL80211_ATTR_WIPHY={0x8, 0x1, 0x1}, @NL80211_ATTR_WDEV={0xc, 0x99, {0x3f, 0x3}}]}, 0x34}, 0x1, 0x0, 0x0, 0x800}, 0x40000) r4 = socket$nl_generic(0x10, 0x3, 0x10) bind$netlink(r4, &(0x7f0000000000)={0x10, 0x0, 0x25dfdbff, 0x1004280}, 0xffffffffffffffb3) sendmsg$nl_generic(r4, &(0x7f0000000080)={&(0x7f0000000480)={0x10, 0xbb7f}, 0xc, &(0x7f0000000440)={&(0x7f00000004c0)={0x1c, 0x22, 0x1, 0x0, 0x0, {0x4}, [@typed={0x8, 0xc}]}, 0x1c}}, 0x0) socket$netlink(0x10, 0x3, 0x0) r5 = socket$alg(0x26, 0x5, 0x0) bind$alg(r5, &(0x7f0000000080)={0x26, 'hash\x00', 0x0, 0x0, 'sha512\x00'}, 0x58) [ 429.547821][T18235] bridge238: port 2(erspan0) entered blocking state [ 429.554769][T18235] bridge238: port 2(erspan0) entered disabled state [ 429.564335][T18235] device erspan0 entered promiscuous mode 15:25:11 executing program 5: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000340)={'erspan0\x00', 0x0}) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000300)={'syz_tun\x00', 0x0}) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r7, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r6, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000380)=@newlink={0x34, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r8}, [@IFLA_LINKINFO={0x14, 0x12, @bridge={{0xb, 0x1, 'bridge\x00'}, {0x4}}}]}, 0x34}}, 0x0) sendmsg$nl_route(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000002700)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r5}, [@IFLA_MASTER={0x8, 0xa, r8}]}, 0x28}}, 0x0) sendmsg$nl_route(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f00000000c0)=ANY=[@ANYBLOB="2800000010000104000040000000000000001ea6", @ANYRES32=r2, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00\b\x00\n\x00', @ANYRES32=r8], 0x28}}, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r10 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r9, 0x8933, &(0x7f0000000300)={'syz_tun\x00', 0x0}) sendmsg$nl_route(r10, &(0x7f0000000000)={0x0, 0x60, &(0x7f00000000c0)={&(0x7f0000000040)=@newlink={0x2c, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r11}, [@IFLA_BROADCAST={0xa}]}, 0x332}}, 0x0) [ 429.609102][T18257] netlink: 140 bytes leftover after parsing attributes in process `syz-executor.0'. 15:25:11 executing program 4: r0 = socket$inet6(0xa, 0x80003, 0x6b) ioctl(r0, 0x1000008912, &(0x7f00000001c0)="080db5055e0bcfe8476071") r1 = socket(0x10, 0x2, 0x0) sendto(r1, &(0x7f0000000200)="120000001200e7ef007b1a3fcd00000000a1", 0x12, 0x0, 0x0, 0x18) recvmmsg(r1, &(0x7f00000037c0)=[{{&(0x7f0000000600)=@ethernet={0x0, @random}, 0x80, &(0x7f0000000380)=[{&(0x7f0000000040)=""/95, 0x5f}, {&(0x7f00000024c0)=""/4096, 0x1000}, {&(0x7f0000000400)=""/120, 0x78}, {&(0x7f0000000480)=""/60, 0x3c}, {&(0x7f0000000280)=""/77, 0x4d}, {&(0x7f0000000540)=""/154, 0x9a}, {&(0x7f0000000340)=""/22, 0x16}], 0x7, &(0x7f0000002400)=""/191, 0xbf}}], 0x1, 0x6, &(0x7f0000003700)={0x77359400}) [ 429.668811][T18263] netlink: 72 bytes leftover after parsing attributes in process `syz-executor.1'. 15:25:11 executing program 2: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000340)={'erspan0\x00', 0x0}) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000300)={'syz_tun\x00', 0x0}) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r7, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r6, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000380)=@newlink={0x34, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r8}, [@IFLA_LINKINFO={0x14, 0x12, @bridge={{0xb, 0x1, 'bridge\x00'}, {0x4}}}]}, 0x34}}, 0x0) sendmsg$nl_route(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000002700)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r5}, [@IFLA_MASTER={0x8, 0xa, r8}]}, 0x28}}, 0x0) sendmsg$nl_route(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f00000000c0)=ANY=[@ANYBLOB="2800000010000104000040000000000000001ea6", @ANYRES32=r2, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00\b\x00\n\x00', @ANYRES32=r8], 0x28}}, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r10 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r9, 0x8933, &(0x7f0000000300)={'syz_tun\x00', 0x0}) sendmsg$nl_route(r10, &(0x7f0000000000)={0x0, 0x603, &(0x7f00000000c0)={&(0x7f0000000040)=@newlink={0x2c, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r11}, [@IFLA_BROADCAST={0xa}]}, 0x332}}, 0x0) 15:25:11 executing program 0: bpf$PROG_LOAD(0x5, &(0x7f0000000240)={0x1, 0x4, &(0x7f0000000480)=ANY=[@ANYBLOB="b70500000000000065103c0000000000a6000000f61e000095007d0689b567006ba734ffa54c93148c485e76"], &(0x7f00000002c0)='syzkaller\x00', 0x5, 0xfd90, &(0x7f0000000300)=""/188, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0xfffffffffffffd55, 0x10, &(0x7f0000000080), 0xfffffffffffffc79}, 0x2a) r0 = socket(0x21, 0xa, 0x1) r1 = socket(0x10, 0x80002, 0x0) ioctl(r1, 0x1000008912, &(0x7f00000001c0)="080db5055e0bcfe8696071") getsockopt$inet_sctp_SCTP_PEER_AUTH_CHUNKS(r1, 0x84, 0x1a, &(0x7f0000000940)=ANY=[@ANYRES32=0x0, @ANYBLOB='\x00'/12], &(0x7f0000000980)=0x10) getsockopt$inet_sctp_SCTP_GET_PEER_ADDR_INFO(r0, 0x84, 0xf, &(0x7f00000009c0)={r2, @in6={{0xa, 0x4e21, 0x8, @local, 0x401}}, 0x9, 0x1, 0x7, 0x7f, 0x6}, &(0x7f0000000a80)=0x98) r3 = socket(0xa, 0x6, 0x0) close(r3) r4 = socket$inet6_sctp(0xa, 0x10000000005, 0x84) setsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX(r4, 0x84, 0x6e, &(0x7f0000000180)=[@in6={0xa, 0x0, 0x0, @remote, 0x9}], 0x1c) ioctl$sock_SIOCSIFBR(r0, 0x8941, &(0x7f0000000400)=@add_del={0x2, &(0x7f00000003c0)='team0\x00'}) getsockopt$inet_sctp6_SCTP_GET_ASSOC_ID_LIST(r4, 0x84, 0x1d, &(0x7f000095dff8)={0x1, [0x0]}, &(0x7f000095dffc)=0x8) r6 = socket(0x21, 0xa, 0x1) r7 = socket(0x10, 0x80002, 0x0) ioctl(r7, 0x1000008912, &(0x7f00000001c0)="080db5055e0bcfe8696071") getsockopt$inet_sctp_SCTP_PEER_AUTH_CHUNKS(r7, 0x84, 0x1a, &(0x7f0000000940)=ANY=[@ANYRES32=0x0, @ANYBLOB='\x00'/12], &(0x7f0000000980)=0x10) getsockopt$inet_sctp_SCTP_GET_PEER_ADDR_INFO(r6, 0x84, 0xf, &(0x7f00000009c0)={r8, @in6={{0xa, 0x4e21, 0x8, @local, 0x401}}, 0x9, 0x1, 0x7, 0x7f, 0x6}, &(0x7f0000000a80)=0x98) setsockopt$inet_sctp_SCTP_RTOINFO(r6, 0x84, 0x0, &(0x7f0000000000)={r5, 0x0, 0x0, 0x1000000}, 0x10) r9 = socket(0x10, 0x80002, 0x0) r10 = socket(0x21, 0xa, 0x1) r11 = socket(0x10, 0x80002, 0x0) ioctl(r11, 0x1000008912, &(0x7f00000001c0)="080db5055e0bcfe8696071") getsockopt$inet_sctp_SCTP_PEER_AUTH_CHUNKS(r11, 0x84, 0x1a, &(0x7f0000000940)=ANY=[@ANYRES32=0x0, @ANYBLOB='\x00'/12], &(0x7f0000000980)=0x10) getsockopt$inet_sctp_SCTP_GET_PEER_ADDR_INFO(r10, 0x84, 0xf, &(0x7f00000009c0)={r12, @in6={{0xa, 0x4e21, 0x8, @local, 0x401}}, 0x9, 0x1, 0x7, 0x7f, 0x6}, &(0x7f0000000a80)=0x98) ioctl$sock_kcm_SIOCKCMCLONE(r10, 0x89e2, &(0x7f0000000440)={r3}) ioctl(r9, 0x1000008912, &(0x7f00000001c0)="080db5055e0bcfe8696071") getsockopt$inet_sctp_SCTP_PEER_AUTH_CHUNKS(r9, 0x84, 0x1a, &(0x7f0000000940)=ANY=[@ANYRES32=0x0, @ANYBLOB='\x00'/12], &(0x7f0000000980)=0x10) r13 = socket(0xa, 0x6, 0x0) close(r13) r14 = socket$inet6_sctp(0xa, 0x10000000005, 0x84) setsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX(r14, 0x84, 0x6e, &(0x7f0000000180)=[@in6={0xa, 0x0, 0x0, @remote, 0x9}], 0x1c) getsockopt$inet_sctp6_SCTP_GET_ASSOC_ID_LIST(r14, 0x84, 0x1d, &(0x7f000095dff8)={0x1, [0x0]}, &(0x7f000095dffc)=0x8) setsockopt$inet_sctp_SCTP_RTOINFO(r13, 0x84, 0x0, &(0x7f0000000000)={r15, 0x0, 0x0, 0x1000000}, 0x10) getsockopt$inet_sctp_SCTP_ASSOCINFO(r9, 0x84, 0x1, &(0x7f00000000c0)={r15, 0x0, 0x1, 0x4, 0x9, 0x101}, &(0x7f0000000100)=0x14) getsockopt$inet_sctp_SCTP_STATUS(r0, 0x84, 0xe, &(0x7f0000000140)={r5, 0x7, 0x8, 0x9, 0x4, 0x3f, 0x6, 0xfffffffb, {r16, @in6={{0xa, 0x4e24, 0x100, @dev={0xfe, 0x80, [], 0x2b}, 0x80000001}}, 0x5, 0x62, 0xfffffffd, 0xfffffff9}}, &(0x7f0000000200)=0xb0) [ 429.738316][T18264] netlink: 72 bytes leftover after parsing attributes in process `syz-executor.1'. [ 429.771038][T18275] FAULT_INJECTION: forcing a failure. [ 429.771038][T18275] name failslab, interval 1, probability 0, space 0, times 0 [ 429.817833][T18275] CPU: 1 PID: 18275 Comm: syz-executor.3 Not tainted 5.5.0-rc5-syzkaller #0 [ 429.826564][T18275] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 429.836631][T18275] Call Trace: [ 429.839948][T18275] dump_stack+0x197/0x210 [ 429.844308][T18275] should_fail.cold+0xa/0x15 [ 429.848916][T18275] ? fault_create_debugfs_attr+0x180/0x180 [ 429.854737][T18275] ? ___might_sleep+0x163/0x2c0 [ 429.859606][T18275] __should_failslab+0x121/0x190 [ 429.864557][T18275] should_failslab+0x9/0x14 [ 429.869077][T18275] kmem_cache_alloc_node_trace+0x274/0x750 [ 429.874894][T18275] ? rcu_read_lock_any_held.part.0+0x50/0x50 [ 429.880883][T18275] ? __kasan_kmalloc.constprop.0+0xcf/0xe0 [ 429.886708][T18275] __kmalloc_node_track_caller+0x3d/0x70 [ 429.893231][T18275] __kmalloc_reserve.isra.0+0x40/0xf0 [ 429.898616][T18275] __alloc_skb+0x10b/0x5e0 [ 429.903047][T18275] ? __kmalloc_reserve.isra.0+0xf0/0xf0 [ 429.908690][T18275] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 429.914939][T18275] ? netlink_autobind.isra.0+0x223/0x300 [ 429.920594][T18275] netlink_sendmsg+0xa1b/0xea0 [ 429.925371][T18275] ? netlink_unicast+0x7d0/0x7d0 [ 429.930317][T18275] ? aa_sock_msg_perm.isra.0+0xba/0x170 [ 429.935882][T18275] ? apparmor_socket_sendmsg+0x2a/0x30 [ 429.941349][T18275] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 429.947597][T18275] ? security_socket_sendmsg+0x8d/0xc0 [ 429.953064][T18275] ? netlink_unicast+0x7d0/0x7d0 [ 429.958006][T18275] sock_sendmsg+0xd7/0x130 [ 429.962438][T18275] ____sys_sendmsg+0x753/0x880 [ 429.967213][T18275] ? kernel_sendmsg+0x50/0x50 [ 429.971895][T18275] ? __fget+0x35d/0x550 [ 429.976061][T18275] ? find_held_lock+0x35/0x130 [ 429.980846][T18275] ___sys_sendmsg+0x100/0x170 [ 429.985536][T18275] ? sendmsg_copy_msghdr+0x70/0x70 [ 429.990650][T18275] ? __kasan_check_read+0x11/0x20 [ 429.995684][T18275] ? __fget+0x37f/0x550 [ 429.999846][T18275] ? ksys_dup3+0x3e0/0x3e0 [ 430.004276][T18275] ? __fget_light+0x1a9/0x230 [ 430.009220][T18275] ? __fdget+0x1b/0x20 [ 430.013292][T18275] ? __sanitizer_cov_trace_const_cmp8+0x18/0x20 [ 430.019542][T18275] __sys_sendmsg+0x105/0x1d0 [ 430.024138][T18275] ? __sys_sendmsg_sock+0xc0/0xc0 [ 430.029186][T18275] ? trace_hardirqs_on_thunk+0x1a/0x1c [ 430.034648][T18275] ? do_syscall_64+0x26/0x790 [ 430.039334][T18275] ? entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 430.045411][T18275] ? do_syscall_64+0x26/0x790 [ 430.050099][T18275] __x64_sys_sendmsg+0x78/0xb0 [ 430.054869][T18275] do_syscall_64+0xfa/0x790 [ 430.059401][T18275] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 430.065302][T18275] RIP: 0033:0x45af49 [ 430.069214][T18275] Code: ad b6 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 7b b6 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 430.088830][T18275] RSP: 002b:00007fecc9f56c78 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 430.097249][T18275] RAX: ffffffffffffffda RBX: 00007fecc9f56c90 RCX: 000000000045af49 [ 430.107141][T18275] RDX: 0000000000000000 RSI: 0000000020000080 RDI: 0000000000000004 [ 430.115231][T18275] RBP: 000000000075bfc8 R08: 0000000000000000 R09: 0000000000000000 [ 430.123218][T18275] R10: 0000000000000000 R11: 0000000000000246 R12: 00007fecc9f576d4 [ 430.131207][T18275] R13: 00000000004ca9e7 R14: 00000000004e3e80 R15: 0000000000000005 15:25:12 executing program 3 (fault-call:9 fault-nth:2): r0 = socket(0x21, 0xa, 0x1) r1 = socket(0x10, 0x80002, 0x0) ioctl(r1, 0x1000008912, &(0x7f00000001c0)="080db5055e0bcfe8696071") getsockopt$inet_sctp_SCTP_PEER_AUTH_CHUNKS(r1, 0x84, 0x1a, &(0x7f0000000940)=ANY=[@ANYRES32=0x0, @ANYBLOB='\x00'/12], &(0x7f0000000980)=0x10) getsockopt$inet_sctp_SCTP_GET_PEER_ADDR_INFO(r0, 0x84, 0xf, &(0x7f00000009c0)={r2, @in6={{0xa, 0x4e21, 0x8, @local, 0x401}}, 0x9, 0x1, 0x7, 0x7f, 0x6}, &(0x7f0000000a80)=0x98) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000400)='nl80211\x00') sendmsg$NL80211_CMD_GET_MESH_CONFIG(r0, &(0x7f0000000580)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x103190}, 0xc, &(0x7f0000000540)={&(0x7f0000000500)={0x34, r3, 0x10, 0x70bd2d, 0x25dfdbfe, {}, [@NL80211_ATTR_WDEV={0xc, 0x99, {0x1, 0xffffffffffffffff}}, @NL80211_ATTR_WIPHY={0x8, 0x1, 0x1}, @NL80211_ATTR_WDEV={0xc, 0x99, {0x3f, 0x3}}]}, 0x34}, 0x1, 0x0, 0x0, 0x800}, 0x40000) r4 = socket$nl_generic(0x10, 0x3, 0x10) bind$netlink(r4, &(0x7f0000000000)={0x10, 0x0, 0x25dfdbff, 0x1004280}, 0xffffffffffffffb3) sendmsg$nl_generic(r4, &(0x7f0000000080)={&(0x7f0000000480)={0x10, 0xbb7f}, 0xc, &(0x7f0000000440)={&(0x7f00000004c0)={0x1c, 0x22, 0x1, 0x0, 0x0, {0x4}, [@typed={0x8, 0xc}]}, 0x1c}}, 0x0) socket$netlink(0x10, 0x3, 0x0) r5 = socket$alg(0x26, 0x5, 0x0) bind$alg(r5, &(0x7f0000000080)={0x26, 'hash\x00', 0x0, 0x0, 'sha512\x00'}, 0x58) [ 430.175940][T18279] device syz_tun left promiscuous mode [ 430.212529][T18279] bridge228: port 1(syz_tun) entered disabled state 15:25:12 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000004c0)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r3, @ANYBLOB="0000000000000000280012000c0001007665746800000000180002001400010000000000", @ANYRES32=0x0, @ANYBLOB="00000000008433df6d6f6b577d4eaaf20000"], 0x5}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000540)=ANY=[@ANYBLOB="7400000024000705000000000000000000010000", @ANYRES32=r3, @ANYBLOB="00000000ffffffff000000000800010073667100486818973f73461919309b68e1693572bb000229c6090032d0ed64f3c3545aaf6e000085a4e4ebb5ef670000000000000000000000000000001a4e624d29a84abf03265700000000000000000000000000000000000000000000000000000000000000ac20000089b53c947244306a0216a3de887763df5b42498b13bb1938de859ee6d7ae7dd2224dc672b69b4358871b170ea0b667832e5224ee3538f885b7abd9bc4a7d"], 0x74}}, 0x0) r4 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r4, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000300)=ANY=[@ANYBLOB="840000002c00010700"/20, @ANYRES32=r3, @ANYBLOB="0008008000000000030000000800010075333200580002001400050000000000000000000000000000000000400006003c0001000000000000001020898dde66057433b6ef3a41d22be225e0001b0000000000000000000000000017256ffc66e43a2484e1a912c5998bcbf0d0000000000000000000000000000000798a3c067277da1a290b9613a33c575c36fad473382c8f5532ef3f0e1d2c450a7decbf3431a69f9b2ecb3291bed174245a962fe0484676958265e2988326a89db3139d91fe4aee6ae7e745ab00001a9f61f20500000000000000b3958bc14fce6e66a36d1ab3194534ba4e973684b27793bff837d3"], 0x84}}, 0x0) r5 = socket(0x10, 0x80002, 0x0) sendmmsg$alg(r5, &(0x7f0000000140), 0x49249249249278c, 0x0) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r6, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000500)=@newlink={0x20, 0x11, 0x40d, 0x0, 0x0, {0x0, 0x0, 0x0, r8}}, 0x20}}, 0x0) r9 = socket(0x10, 0x80002, 0x0) getsockopt$inet_sctp_SCTP_PEER_AUTH_CHUNKS(0xffffffffffffffff, 0x84, 0x1a, &(0x7f0000000940)=ANY=[@ANYRES32=0x0, @ANYBLOB='\x00'/12], &(0x7f0000000980)=0x10) r10 = socket(0xa, 0x6, 0x0) close(r10) r11 = socket$inet6_sctp(0xa, 0x10000000005, 0x84) setsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX(r11, 0x84, 0x6e, &(0x7f0000000180)=[@in6={0xa, 0x0, 0x0, @remote, 0x9}], 0x1c) getsockopt$inet_sctp6_SCTP_GET_ASSOC_ID_LIST(r11, 0x84, 0x1d, &(0x7f000095dff8)={0x1, [0x0]}, &(0x7f000095dffc)=0x8) setsockopt$inet_sctp_SCTP_RTOINFO(r10, 0x84, 0x0, &(0x7f0000000000)={r12, 0x0, 0x0, 0x1000000}, 0x10) setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(0xffffffffffffffff, 0x84, 0x9, &(0x7f0000000680)={r12, @in={{0x2, 0x4e20, @remote}}, 0x10001, 0xfff7, 0x5, 0x1, 0x8, 0x5, 0xba}, 0x9c) ioctl(r9, 0x1000008912, &(0x7f00000001c0)="080db5055e0bcfe8696071") getsockopt$inet_sctp_SCTP_PEER_AUTH_CHUNKS(r9, 0x84, 0x1a, &(0x7f0000000940)=ANY=[@ANYRES32=0x0, @ANYBLOB='\x00'/12], &(0x7f0000000980)=0x10) r13 = socket$nl_generic(0x10, 0x3, 0x10) r14 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080)='nl80211\x00') r15 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL80211_CMD_GET_STATION(r15, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000240)={0x1c, r14, 0xf2b, 0x0, 0x0, {}, [@NL80211_ATTR_AIRTIME_WEIGHT={0x8}]}, 0x1c}}, 0x0) sendmsg$NL80211_CMD_GET_MPATH(r13, &(0x7f00000001c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x2000}, 0x268, &(0x7f0000000080)={&(0x7f0000000200)={0x40, r14, 0x4, 0x70bd2d, 0x25dfdbff}, 0xff6b}, 0x1, 0x0, 0x0, 0x10049050}, 0x260448c0) sendmsg$NL80211_CMD_NEW_KEY(r9, &(0x7f0000000640)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0xb0024000}, 0xc, &(0x7f00000002c0)={&(0x7f0000000440)={0x7c, r14, 0x23, 0x70bd27, 0x25dfdbff, {}, [@NL80211_ATTR_KEY_DATA_WEP40={0x9, 0x7, "a80875ab12"}, @NL80211_ATTR_KEY={0x5c, 0x50, [@NL80211_KEY_DEFAULT_TYPES={0x14, 0x8, [@NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_MULTICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_MULTICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_MULTICAST={0x4}]}, @NL80211_KEY_DEFAULT_TYPES={0x28, 0x8, [@NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_MULTICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_MULTICAST={0x4}]}, @NL80211_KEY_IDX={0x5, 0x2, 0x5}, @NL80211_KEY_DATA_WEP104={0x11, 0x1, "4d84c4e30151cb27f51a4adf63"}]}]}, 0x7c}, 0x1, 0x0, 0x0, 0x24000}, 0x40) [ 430.368152][T18279] bridge229: port 1(syz_tun) entered blocking state [ 430.387423][T18300] FAULT_INJECTION: forcing a failure. [ 430.387423][T18300] name failslab, interval 1, probability 0, space 0, times 0 [ 430.409721][T18300] CPU: 0 PID: 18300 Comm: syz-executor.3 Not tainted 5.5.0-rc5-syzkaller #0 [ 430.418467][T18300] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 430.428532][T18300] Call Trace: [ 430.431840][T18300] dump_stack+0x197/0x210 [ 430.436194][T18300] should_fail.cold+0xa/0x15 [ 430.440815][T18300] ? fault_create_debugfs_attr+0x180/0x180 [ 430.446659][T18300] __should_failslab+0x121/0x190 [ 430.451822][T18300] should_failslab+0x9/0x14 [ 430.456344][T18300] kmem_cache_alloc+0x47/0x710 [ 430.461129][T18300] ? lock_acquire+0x190/0x410 [ 430.465827][T18300] ? netlink_deliver_tap+0x146/0xbe0 [ 430.471136][T18300] skb_clone+0x154/0x3d0 [ 430.475491][T18300] netlink_deliver_tap+0x943/0xbe0 [ 430.480625][T18300] netlink_unicast+0x643/0x7d0 [ 430.485416][T18300] ? netlink_attachskb+0x870/0x870 [ 430.490643][T18300] ? __sanitizer_cov_trace_cmp8+0x18/0x20 [ 430.496393][T18300] ? __check_object_size+0x3d/0x437 [ 430.501742][T18300] netlink_sendmsg+0x91c/0xea0 [ 430.506525][T18300] ? netlink_unicast+0x7d0/0x7d0 [ 430.511473][T18300] ? aa_sock_msg_perm.isra.0+0xba/0x170 [ 430.517041][T18300] ? apparmor_socket_sendmsg+0x2a/0x30 [ 430.522519][T18300] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 430.528768][T18300] ? security_socket_sendmsg+0x8d/0xc0 [ 430.534239][T18300] ? netlink_unicast+0x7d0/0x7d0 [ 430.539190][T18300] sock_sendmsg+0xd7/0x130 [ 430.543619][T18300] ____sys_sendmsg+0x753/0x880 [ 430.548399][T18300] ? kernel_sendmsg+0x50/0x50 [ 430.553083][T18300] ? __fget+0x35d/0x550 [ 430.557249][T18300] ? find_held_lock+0x35/0x130 [ 430.562033][T18300] ___sys_sendmsg+0x100/0x170 [ 430.566722][T18300] ? sendmsg_copy_msghdr+0x70/0x70 [ 430.571837][T18300] ? __kasan_check_read+0x11/0x20 [ 430.576875][T18300] ? __fget+0x37f/0x550 [ 430.581046][T18300] ? ksys_dup3+0x3e0/0x3e0 [ 430.585476][T18300] ? __fget_light+0x1a9/0x230 [ 430.590171][T18300] ? __fdget+0x1b/0x20 [ 430.594257][T18300] ? __sanitizer_cov_trace_const_cmp8+0x18/0x20 [ 430.600521][T18300] __sys_sendmsg+0x105/0x1d0 [ 430.605180][T18300] ? __sys_sendmsg_sock+0xc0/0xc0 [ 430.610229][T18300] ? trace_hardirqs_on_thunk+0x1a/0x1c [ 430.615736][T18300] ? do_syscall_64+0x26/0x790 [ 430.620536][T18300] ? entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 430.626619][T18300] ? do_syscall_64+0x26/0x790 [ 430.631438][T18300] __x64_sys_sendmsg+0x78/0xb0 [ 430.636216][T18300] do_syscall_64+0xfa/0x790 [ 430.640862][T18300] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 430.646775][T18300] RIP: 0033:0x45af49 [ 430.650778][T18300] Code: ad b6 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 7b b6 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 430.670393][T18300] RSP: 002b:00007fecc9f56c78 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 430.678818][T18300] RAX: ffffffffffffffda RBX: 00007fecc9f56c90 RCX: 000000000045af49 [ 430.686809][T18300] RDX: 0000000000000000 RSI: 0000000020000080 RDI: 0000000000000004 [ 430.694798][T18300] RBP: 000000000075bfc8 R08: 0000000000000000 R09: 0000000000000000 [ 430.702777][T18300] R10: 0000000000000000 R11: 0000000000000246 R12: 00007fecc9f576d4 [ 430.710759][T18300] R13: 00000000004ca9e7 R14: 00000000004e3e80 R15: 0000000000000005 [ 430.718936][T18279] bridge229: port 1(syz_tun) entered disabled state [ 430.733343][T18279] device syz_tun entered promiscuous mode [ 430.741772][T18280] device erspan0 left promiscuous mode [ 430.763422][T18280] bridge228: port 2(erspan0) entered disabled state [ 430.949848][T18280] bridge229: port 2(erspan0) entered blocking state [ 430.960011][T18280] bridge229: port 2(erspan0) entered disabled state [ 430.979814][T18280] device erspan0 entered promiscuous mode 15:25:13 executing program 4: r0 = socket$inet6(0xa, 0x80003, 0x6b) ioctl(r0, 0x1000008912, &(0x7f00000001c0)="080db5055e0bcfe8476071") r1 = socket(0x10, 0x2, 0x0) sendto(r1, &(0x7f0000000200)="120000001200e7ef007b1a3fcd00000000a1", 0x12, 0x0, 0x0, 0x18) recvmmsg(r1, &(0x7f00000037c0)=[{{&(0x7f0000000600)=@ethernet={0x0, @random}, 0x80, &(0x7f0000000380)=[{&(0x7f0000000040)=""/95, 0x5f}, {&(0x7f00000024c0)=""/4096, 0x1000}, {&(0x7f0000000400)=""/120, 0x78}, {&(0x7f0000000480)=""/60, 0x3c}, {&(0x7f0000000280)=""/77, 0x4d}, {&(0x7f0000000540)=""/154, 0x9a}, {&(0x7f0000000340)=""/22, 0x16}], 0x7, &(0x7f0000002400)=""/191, 0xbf}}], 0x1, 0x6, &(0x7f0000003700)={0x77359400}) [ 431.018804][T18289] device syz_tun left promiscuous mode [ 431.024507][T18289] bridge238: port 1(syz_tun) entered disabled state [ 431.218683][T18289] bridge239: port 1(syz_tun) entered blocking state [ 431.225353][T18289] bridge239: port 1(syz_tun) entered disabled state [ 431.237520][T18289] device syz_tun entered promiscuous mode [ 431.246730][T18293] device erspan0 left promiscuous mode [ 431.252797][T18293] bridge238: port 2(erspan0) entered disabled state [ 431.389891][T18293] bridge239: port 2(erspan0) entered blocking state [ 431.396651][T18293] bridge239: port 2(erspan0) entered disabled state [ 431.405197][T18293] device erspan0 entered promiscuous mode [ 431.415740][T18301] netlink: 72 bytes leftover after parsing attributes in process `syz-executor.1'. [ 431.427694][T18308] netlink: 72 bytes leftover after parsing attributes in process `syz-executor.1'. 15:25:13 executing program 0: socket(0x10, 0x80002, 0x0) r0 = socket(0x21, 0xa, 0x1) r1 = socket(0x10, 0x80002, 0x0) ioctl(r1, 0x1000008912, &(0x7f00000001c0)="080db5055e0bcfe8696071") getsockopt$inet_sctp_SCTP_PEER_AUTH_CHUNKS(r1, 0x84, 0x1a, &(0x7f0000000940)=ANY=[@ANYRES32=0x0, @ANYPTR64], &(0x7f0000000980)=0x2) getsockopt$inet_sctp_SCTP_GET_PEER_ADDR_INFO(r0, 0x84, 0xf, &(0x7f00000009c0)={r2, @in6={{0xa, 0x4e21, 0x8, @local, 0x401}}, 0x9, 0x1, 0x7, 0x7f, 0x6}, &(0x7f0000000a80)=0x98) sendmsg$alg(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000880)=[{&(0x7f0000000200)="7b96c7aa76b03aa674edc2493950b9efbd98baa1078ff19e4b356fec6d1adbfc07a0c56aac48cc069f0bc10d6246c8860e6babaf5575519f50b46149f58d3f51695ff839ad55501e792520d48a528bd6e7f3b273215aa462192c67e0861290a611ff6e3c5ebff810e5a7a41165857c575ce1e78a38b02adf7a59e8ac0d6fd3c134b54bf98b2fdfda55d23ea117623b6a0a701a81f9ff8a5dfb817aa6976667f5ed9a19e68218a8bd54e9673982e72830596d364e64a7b381e4888fde2258e9fbbebfe0ed5212a7d8", 0xc8}, {&(0x7f0000000300)="6b53943b2ca8415b9906f6f78bc8c249ac472f6c7946105cd6febb7f4ad0848971e9699e761165c433afed09a23265872572c5368a2c8ca2250e04ef3fd91029738e19fcd45ec0ac116e2e35f08a652e4868520ad78c716b8ee25a6a7181d0da68229f89ad952df7ffcaed1cfaaa0bd420793b5e74c995e170a4428128d02bc2bd54b156fc7063a5bb5b427b9001d5683594e552e10c35a0c86e1a55e5c50a221a767b783093a0c0e58d73c0b9a145495443fac5b8e8a8693d0ca459ebe460838ad398203b716d7477039c0b1694a58416741f0aad530065a2cadef7372cb56ce2f21f9ded036f8862f235c0594a3bbd", 0xf0}, {&(0x7f0000000400)="e87236e8d86e576a518d985695cfcc9c11cfc77f7539f77d6544a585e8e49e5527219c1959dde19997258fe5053a468d35320322bb6b5bbb2270443393e8ad283e2acc6cf61e1194da98a87f1b297755df2c4c86199643804dffa0b8209ef2706541b96a94dccb703b8b2aa0eb1bf3a7645d2f7c4b9417c517958b08c42bc8ab4d0a546fe56a03ea771d2341b9b6c78deba087f98ddf8ff8cd7bbdc0d931180879d293370e1c6c95e8ef7ec31ea1854ed40f7ac7d7a8585fb8a11a35f68f35527880d1590b6d2e597a5fc46253ac9a0c81d4239357bfb35d43a9a046aa791813ea8a9b69a622cd54bb853bb47a0f68fff5f2a1057386fc", 0xf7}, {&(0x7f0000000140)="639496f2f483c5afed72ace621ea45a6", 0x10}, {&(0x7f0000000500)="2361d74f45531d72111e8149cce78003a33ea05e468412790068d757ba17e3260046dabf3291b69b53dd6bf693a7098c9da1ad8223cc1d093e8404797659ac6c16d0d558979702ba5bc6c415bf", 0x4d}, {&(0x7f0000000640)="3e8261519dec2d736ca8ea58e705902474322e9d0d8214049ad2c3fc034d744c324b6020ab6e8b524a50970fe819147aad9467225e7018a395570d8da983ab672c7bfd18172c2a1e9be37e38a78ce733674a15ddd7923f497c4ba2867355", 0x5e}, {&(0x7f00000006c0)="f38f256081e556ba03c3d13971f59e192fbfff0eadc858d65a4b53246b9983cde7f9814a690504fb01348514d46303fe2a6f0f5aed4125026448e5bc5ba3ea0ff4bbe0022841cee2a15254071b86ae0d6e6db45950ae58395ae1a4e7eb4a43901e279037edbc5b7eb5776d2e2c6a0bd73b5edbd0b3f9897c9d74edec609cfa9a1f51871332f659", 0x87}, {&(0x7f0000000780)="a3234913eb7ebc3f9b8693547ffc74455dc3b21788c80db8478e80707012c51852ad16b6072ada9430181d61666be90d2ffe6ced74c3c95a503a27dcf2e6336ae98be953af92c0809224cd2af7ae057307541badfd27d5d391eeca6637b42932a636299fd5de825b2a659d46c0621b317dd85fac8626d8b0569642271b15ed862db11341c8002e58ed55ddcc7a6e7f1a585d42352066c47dc9547d92325cc0d268776525504a5bd39a0843f6e493f3cfb043d4ad941c07a341a292fb5e92984d3863807a456f5dc9cb5ac9ffe9264259f36f3c12", 0xd4}], 0x8, &(0x7f00000009c0)=[@assoc={0x18, 0x117, 0x4, 0xffffffff}, @op={0x18}, @assoc={0x18, 0x117, 0x4, 0x80}, @assoc={0x18, 0x117, 0x4, 0x8}, @op={0x18}, @op={0x18}], 0x90, 0x40000}, 0x802) r3 = socket$inet6(0xa, 0x3, 0x84) connect$inet6(r3, &(0x7f0000000080)={0xa, 0x0, 0x0, @local, 0x9}, 0x1c) write$binfmt_aout(r3, &(0x7f00000001c0)={{0x0, 0x0, 0x0, 0x0, 0x0, 0x20404}}, 0x20) r4 = socket(0x10, 0x80002, 0x0) r5 = socket$inet6_udp(0xa, 0x2, 0x0) ioctl$sock_inet6_SIOCSIFADDR(r5, 0x89a1, &(0x7f00000000c0)={@local={0xfe, 0x80, [0x600, 0x3ef, 0x0, 0x3f00000000000000, 0x100000000000000, 0x0, 0x1103, 0x0, 0x0, 0x0, 0x0, 0x6]}}) ioctl$sock_inet6_SIOCADDRT(r5, 0x89a0, &(0x7f00000005c0)={@initdev={0xfe, 0x88, [], 0x1, 0x0}, @remote, @remote, 0x0, 0x4, 0xfffc, 0x0, 0x1, 0x6010060}) ioctl$sock_SIOCOUTQNSD(r5, 0x894b, &(0x7f0000000100)) ioctl(r4, 0x1000008912, &(0x7f00000001c0)="080db5055e0bcfe8696071") getsockopt$inet_sctp_SCTP_PEER_AUTH_CHUNKS(r4, 0x84, 0x1a, &(0x7f0000000940)=ANY=[@ANYRES32=0x0, @ANYBLOB='\x00'/12], &(0x7f0000000980)=0x10) getpeername$ax25(r4, &(0x7f0000000000)={{0x3, @null}, [@default, @rose, @null, @null, @remote, @netrom, @netrom]}, &(0x7f00000000c0)=0x48) getsockopt$IP_VS_SO_GET_TIMEOUT(r3, 0x0, 0x486, &(0x7f0000000580), &(0x7f0000000900)=0xc) 15:25:13 executing program 2: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000340)={'erspan0\x00', 0x0}) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000300)={'syz_tun\x00', 0x0}) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r7, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r6, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000380)=@newlink={0x34, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r8}, [@IFLA_LINKINFO={0x14, 0x12, @bridge={{0xb, 0x1, 'bridge\x00'}, {0x4}}}]}, 0x34}}, 0x0) sendmsg$nl_route(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000002700)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r5}, [@IFLA_MASTER={0x8, 0xa, r8}]}, 0x28}}, 0x0) sendmsg$nl_route(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f00000000c0)=ANY=[@ANYBLOB="2800000010000104000040000000000000001ea6", @ANYRES32=r2, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00\b\x00\n\x00', @ANYRES32=r8], 0x28}}, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r10 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r9, 0x8933, &(0x7f0000000300)={'syz_tun\x00', 0x0}) sendmsg$nl_route(r10, &(0x7f0000000000)={0x0, 0xa00, &(0x7f00000000c0)={&(0x7f0000000040)=@newlink={0x2c, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r11}, [@IFLA_BROADCAST={0xa}]}, 0x332}}, 0x0) 15:25:13 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000004c0)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r3, @ANYBLOB="0000000000000000280012000c0001007665746800000000180002001400010000000000", @ANYRES32=0x0, @ANYBLOB="00000000008433df6d6f6b577d4eaaf20000"], 0x5}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000540)=ANY=[@ANYBLOB="7400000024000705000000000000000000010000", @ANYRES32=r3, @ANYBLOB="00000000ffffffff000000000800010073667100486818973f73461919309b68e1693572bb000229c6090032d0ed64f3c3545aaf6e000085a4e4ebb5ef670000000000000000000000000000001a4e624d29a84abf03265700000000000000000000000000000000000000000000000000000000000000ac20000089b53c947244306a0216a3de887763df5b42498b13bb1938de859ee6d7ae7dd2224dc672b69b4358871b170ea0b667832e5224ee3538f885b7abd9bc4a7d"], 0x74}}, 0x0) r4 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r4, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000300)=ANY=[@ANYBLOB="840000002c00010700"/20, @ANYRES32=r3, @ANYBLOB="0008008000000000030000000800010075333200580002001400050000000000000000000000000000000000400006003c0001000000000000001020898dde66057433b6ef3a41d22be225e0001b0000000000000000000000000017256ffc66e43a2484e1a912c5998bcbf0d0000000000000000000000000000000798a3c067277da1a290b9613a33c575c36fad473382c8f5532ef3f0e1d2c450a7decbf3431a69f9b2ecb3291bed174245a962fe0484676958265e2988326a89db3139d91fe4aee6ae7e745ab00001a9f61f20500000000000000b3958bc14fce6e66a36d1ab3194534ba4e973684b27793bff837d3"], 0x84}}, 0x0) r5 = socket(0x10, 0x80002, 0x0) sendmmsg$alg(r5, &(0x7f0000000140), 0x49249249249278c, 0x0) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r6, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000500)=@newlink={0x20, 0x11, 0x40d, 0x0, 0x0, {0x0, 0x0, 0x0, r8}}, 0x20}}, 0x0) r9 = socket(0x10, 0x80002, 0x0) getsockopt$inet_sctp_SCTP_PEER_AUTH_CHUNKS(0xffffffffffffffff, 0x84, 0x1a, &(0x7f0000000940)=ANY=[@ANYRES32=0x0, @ANYBLOB='\x00'/12], &(0x7f0000000980)=0x10) r10 = socket(0xa, 0x6, 0x0) close(r10) r11 = socket$inet6_sctp(0xa, 0x10000000005, 0x84) setsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX(r11, 0x84, 0x6e, &(0x7f0000000180)=[@in6={0xa, 0x0, 0x0, @remote, 0x9}], 0x1c) getsockopt$inet_sctp6_SCTP_GET_ASSOC_ID_LIST(r11, 0x84, 0x1d, &(0x7f000095dff8)={0x1, [0x0]}, &(0x7f000095dffc)=0x8) setsockopt$inet_sctp_SCTP_RTOINFO(r10, 0x84, 0x0, &(0x7f0000000000)={r12, 0x0, 0x0, 0x1000000}, 0x10) setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(0xffffffffffffffff, 0x84, 0x9, &(0x7f0000000680)={r12, @in={{0x2, 0x4e20, @remote}}, 0x10001, 0xfff7, 0x5, 0x1, 0x8, 0x5, 0xba}, 0x9c) ioctl(r9, 0x1000008912, &(0x7f00000001c0)="080db5055e0bcfe8696071") getsockopt$inet_sctp_SCTP_PEER_AUTH_CHUNKS(r9, 0x84, 0x1a, &(0x7f0000000940)=ANY=[@ANYRES32=0x0, @ANYBLOB='\x00'/12], &(0x7f0000000980)=0x10) r13 = socket$nl_generic(0x10, 0x3, 0x10) r14 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080)='nl80211\x00') r15 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL80211_CMD_GET_STATION(r15, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000240)={0x1c, r14, 0xf2b, 0x0, 0x0, {}, [@NL80211_ATTR_AIRTIME_WEIGHT={0x8}]}, 0x1c}}, 0x0) sendmsg$NL80211_CMD_GET_MPATH(r13, &(0x7f00000001c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x2000}, 0x268, &(0x7f0000000080)={&(0x7f0000000200)={0x40, r14, 0x4, 0x70bd2d, 0x25dfdbff}, 0xff6b}, 0x1, 0x0, 0x0, 0x10049050}, 0x260448c0) sendmsg$NL80211_CMD_NEW_KEY(r9, &(0x7f0000000640)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0xb0024000}, 0xc, &(0x7f00000002c0)={&(0x7f0000000440)={0x7c, r14, 0x23, 0x70bd27, 0x25dfdbff, {}, [@NL80211_ATTR_KEY_DATA_WEP40={0x9, 0x7, "a80875ab12"}, @NL80211_ATTR_KEY={0x5c, 0x50, [@NL80211_KEY_DEFAULT_TYPES={0x14, 0x8, [@NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_MULTICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_MULTICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_MULTICAST={0x4}]}, @NL80211_KEY_DEFAULT_TYPES={0x28, 0x8, [@NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_MULTICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_MULTICAST={0x4}]}, @NL80211_KEY_IDX={0x5, 0x2, 0x5}, @NL80211_KEY_DATA_WEP104={0x11, 0x1, "4d84c4e30151cb27f51a4adf63"}]}]}, 0x7c}, 0x1, 0x0, 0x0, 0x24000}, 0x40) 15:25:13 executing program 5: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000340)={'erspan0\x00', 0x0}) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000300)={'syz_tun\x00', 0x0}) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r7, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r6, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000380)=@newlink={0x34, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r8}, [@IFLA_LINKINFO={0x14, 0x12, @bridge={{0xb, 0x1, 'bridge\x00'}, {0x4}}}]}, 0x34}}, 0x0) sendmsg$nl_route(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000002700)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r5}, [@IFLA_MASTER={0x8, 0xa, r8}]}, 0x28}}, 0x0) sendmsg$nl_route(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f00000000c0)=ANY=[@ANYBLOB="2800000010000104000040000000000000001ea6", @ANYRES32=r2, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00\b\x00\n\x00', @ANYRES32=r8], 0x28}}, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r10 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r9, 0x8933, &(0x7f0000000300)={'syz_tun\x00', 0x0}) sendmsg$nl_route(r10, &(0x7f0000000000)={0x0, 0xf0, &(0x7f00000000c0)={&(0x7f0000000040)=@newlink={0x2c, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r11}, [@IFLA_BROADCAST={0xa}]}, 0x332}}, 0x0) 15:25:13 executing program 4: r0 = socket$inet6(0xa, 0x80003, 0x6b) ioctl(r0, 0x1000008912, &(0x7f00000001c0)="080db5055e0bcfe8476071") r1 = socket(0x10, 0x2, 0x0) sendto(r1, &(0x7f0000000200)="120000001200e7ef007b1a3fcd00000000a1", 0x12, 0x0, 0x0, 0x18) recvmmsg(r1, &(0x7f00000037c0)=[{{&(0x7f0000000600)=@ethernet={0x0, @random}, 0x80, &(0x7f0000000380)=[{&(0x7f0000000040)=""/95, 0x5f}, {0x0}, {&(0x7f00000024c0)=""/4096, 0x1000}, {&(0x7f0000000400)=""/120, 0x78}, {&(0x7f0000000480)=""/60, 0x3c}, {&(0x7f0000000280)=""/77, 0x4d}, {&(0x7f0000000540)=""/154, 0x9a}, {&(0x7f0000000340)=""/22, 0x16}], 0x8, &(0x7f0000002400)=""/191, 0xbf}}], 0x1, 0x6, &(0x7f0000003700)={0x77359400}) 15:25:13 executing program 3: r0 = socket(0x21, 0xa, 0x1) r1 = socket(0x10, 0x80002, 0x0) ioctl(r1, 0x1000008912, &(0x7f00000001c0)="080db5055e0bcfe8696071") getsockopt$inet_sctp_SCTP_PEER_AUTH_CHUNKS(r1, 0x84, 0x1a, &(0x7f0000000940)=ANY=[@ANYRES32=0x0, @ANYBLOB='\x00'/12], &(0x7f0000000980)=0x10) getsockopt$inet_sctp_SCTP_GET_PEER_ADDR_INFO(r0, 0x84, 0xf, &(0x7f00000009c0)={r2, @in6={{0xa, 0x4e21, 0x8, @local, 0x401}}, 0x9, 0x1, 0x7, 0x7f, 0x6}, &(0x7f0000000a80)=0x98) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000400)='nl80211\x00') sendmsg$NL80211_CMD_GET_MESH_CONFIG(r0, &(0x7f0000000580)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x103190}, 0xc, &(0x7f0000000540)={&(0x7f0000000500)={0x34, r3, 0x10, 0x70bd2d, 0x25dfdbfe, {}, [@NL80211_ATTR_WDEV={0xc, 0x99, {0x1, 0xffffffffffffffff}}, @NL80211_ATTR_WIPHY={0x8, 0x1, 0x1}, @NL80211_ATTR_WDEV={0xc, 0x99, {0x3f, 0x3}}]}, 0x34}, 0x1, 0x0, 0x0, 0x800}, 0x40000) r4 = socket$nl_generic(0x10, 0x3, 0x10) bind$netlink(r4, &(0x7f0000000000)={0x10, 0x0, 0x25dfdbff, 0x1004280}, 0xffffffffffffffb3) sendmsg$nl_generic(r4, &(0x7f0000000080)={&(0x7f0000000480)={0x10, 0xbb7f}, 0xc, &(0x7f0000000440)={&(0x7f00000004c0)={0x1c, 0x22, 0x1, 0x0, 0x0, {0x4}, [@typed={0x8, 0xc}]}, 0x1c}}, 0x0) socket$netlink(0x10, 0x3, 0x0) r5 = socket$alg(0x26, 0x5, 0x0) bind$alg(r5, &(0x7f0000000080)={0x26, 'hash\x00', 0x0, 0x0, 'sha512\x00'}, 0x58) 15:25:13 executing program 4: r0 = socket$inet6(0xa, 0x80003, 0x6b) ioctl(r0, 0x1000008912, &(0x7f00000001c0)="080db5055e0bcfe8476071") r1 = socket(0x10, 0x2, 0x0) sendto(r1, &(0x7f0000000200)="120000001200e7ef007b1a3fcd00000000a1", 0x12, 0x0, 0x0, 0x18) recvmmsg(r1, &(0x7f00000037c0)=[{{&(0x7f0000000600)=@ethernet={0x0, @random}, 0x80, &(0x7f0000000380)=[{&(0x7f0000000040)=""/95, 0x5f}, {0x0}, {&(0x7f00000024c0)=""/4096, 0x1000}, {&(0x7f0000000400)=""/120, 0x78}, {&(0x7f0000000480)=""/60, 0x3c}, {&(0x7f0000000280)=""/77, 0x4d}, {&(0x7f0000000540)=""/154, 0x9a}, {&(0x7f0000000340)=""/22, 0x16}], 0x8, &(0x7f0000002400)=""/191, 0xbf}}], 0x1, 0x6, &(0x7f0000003700)={0x77359400}) [ 431.808251][T18343] device syz_tun left promiscuous mode [ 431.818835][T18343] bridge239: port 1(syz_tun) entered disabled state 15:25:14 executing program 0: getsockopt$sock_timeval(0xffffffffffffffff, 0x1, 0x37, &(0x7f0000000040), &(0x7f0000000080)=0x10) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r0, &(0x7f0000000100)={0xa, 0x4e22, 0x0, @loopback}, 0x1c) listen(r0, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) sendto$inet6(r1, 0x0, 0x0, 0x20000004, &(0x7f000031e000)={0xa, 0x4e22}, 0x1c) recvfrom$inet6(r1, &(0x7f00000001c0)=""/31, 0xfffffffffffffe3c, 0x100, &(0x7f0000001880), 0x17c) r2 = socket$pptp(0x18, 0x1, 0x2) ioctl(r2, 0x1f, 0x0) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000340)='cgroup.controllers\x00', 0x7a05, 0x1700) write$cgroup_subtree(0xffffffffffffffff, 0x0, 0x0) setsockopt$bt_BT_RCVMTU(r3, 0x112, 0xd, &(0x7f0000000000)=0x8, 0x2) setsockopt$ALG_SET_KEY(0xffffffffffffffff, 0x117, 0x1, 0x0, 0x0) ioctl$SIOCSIFMTU(0xffffffffffffffff, 0x8922, 0x0) ioctl$TUNSETPERSIST(0xffffffffffffffff, 0x400454cb, 0x0) setsockopt$inet6_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f0000000180)='yeah\x00', 0x5) shutdown(r1, 0x1) r4 = socket(0xa, 0x6, 0x0) close(r4) r5 = socket$inet6_sctp(0xa, 0x10000000005, 0x84) setsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX(r5, 0x84, 0x6e, &(0x7f0000000180)=[@in6={0xa, 0x0, 0x0, @remote, 0x9}], 0x1c) getsockopt$inet_sctp6_SCTP_GET_ASSOC_ID_LIST(r5, 0x84, 0x1d, &(0x7f0000000380)={0xb}, &(0x7f00000003c0)=0xfffffffffffffde1) setsockopt$inet_sctp_SCTP_RTOINFO(r4, 0x84, 0x0, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x1000000}, 0x10) getsockopt$inet_sctp6_SCTP_PEER_AUTH_CHUNKS(0xffffffffffffffff, 0x84, 0x1a, &(0x7f0000000200)={0x0, 0xa9, "74914312787bbbf299343276fa44d52e56e6eb4acf074e38c83d4320636aaf9e8ae7a0f691853b9f0f4db3989b7266e87fad5aedadc9ee6900f8fcc06fa508a671c0f7102aeed8f14d39b8116a1341d7d3cca87bd966c6362416b9dd936497dbb4ce96bef89ceb5b1abd4a14dd91412c22c2ae8253421756c21da281a2e5ca40eb8d0f1e251a715e59c8438550d765f4b4a2ce066d3fce84f254ebb39685f7b71305d2a5a140dfb34e"}, &(0x7f00000002c0)=0xb1) r6 = accept4(r0, 0x0, 0x0, 0x0) r7 = socket(0x21, 0xa, 0x1) r8 = socket(0x10, 0x80002, 0x0) ioctl(r8, 0x1000008912, &(0x7f00000001c0)="080db5055e0bcfe8696071") getsockopt$inet_sctp_SCTP_PEER_AUTH_CHUNKS(r8, 0x84, 0x1a, &(0x7f0000000940)=ANY=[@ANYRES32=0x0, @ANYBLOB='\x00'/12], &(0x7f0000000980)=0x10) getsockopt$inet_sctp_SCTP_GET_PEER_ADDR_INFO(r7, 0x84, 0xf, &(0x7f00000009c0)={r9, @in6={{0xa, 0x4e21, 0x8, @local, 0x401}}, 0x9, 0x1, 0x7, 0x7f, 0x6}, &(0x7f0000000a80)=0x98) splice(r6, &(0x7f00000000c0)=0x5, r7, &(0x7f0000000140)=0x1, 0x80, 0x2) socket$inet(0x2, 0x3, 0x800000000000b) sendto$inet6(r6, &(0x7f00000000c0), 0xfffffdda, 0x0, 0x0, 0x0) [ 431.948361][T18343] bridge240: port 1(syz_tun) entered blocking state [ 431.957452][T18343] bridge240: port 1(syz_tun) entered disabled state [ 431.968737][T18343] device syz_tun entered promiscuous mode [ 431.982393][T18342] netlink: 72 bytes leftover after parsing attributes in process `syz-executor.1'. [ 432.008257][T18337] device erspan0 left promiscuous mode [ 432.032632][T18337] bridge239: port 2(erspan0) entered disabled state [ 432.046498][ C1] TCP: request_sock_TCPv6: Possible SYN flooding on port 20002. Sending cookies. Check SNMP counters. [ 432.188318][T18337] bridge240: port 2(erspan0) entered blocking state [ 432.197851][T18337] bridge240: port 2(erspan0) entered disabled state [ 432.206158][T18337] device erspan0 entered promiscuous mode [ 432.240940][T18347] netlink: 72 bytes leftover after parsing attributes in process `syz-executor.1'. [ 432.257341][T18348] device syz_tun left promiscuous mode [ 432.263341][T18348] bridge229: port 1(syz_tun) entered disabled state [ 432.407920][T18348] bridge230: port 1(syz_tun) entered blocking state [ 432.414852][T18348] bridge230: port 1(syz_tun) entered disabled state [ 432.423277][T18348] device syz_tun entered promiscuous mode [ 432.432915][T18354] device erspan0 left promiscuous mode [ 432.439162][T18354] bridge229: port 2(erspan0) entered disabled state [ 432.558059][T18354] bridge230: port 2(erspan0) entered blocking state [ 432.567221][T18354] bridge230: port 2(erspan0) entered disabled state [ 432.575507][T18354] device erspan0 entered promiscuous mode 15:25:14 executing program 4: r0 = socket$inet6(0xa, 0x80003, 0x6b) ioctl(r0, 0x1000008912, &(0x7f00000001c0)="080db5055e0bcfe8476071") r1 = socket(0x10, 0x2, 0x0) sendto(r1, &(0x7f0000000200)="120000001200e7ef007b1a3fcd00000000a1", 0x12, 0x0, 0x0, 0x18) recvmmsg(r1, &(0x7f00000037c0)=[{{&(0x7f0000000600)=@ethernet={0x0, @random}, 0x80, &(0x7f0000000380)=[{&(0x7f0000000040)=""/95, 0x5f}, {0x0}, {&(0x7f00000024c0)=""/4096, 0x1000}, {&(0x7f0000000400)=""/120, 0x78}, {&(0x7f0000000480)=""/60, 0x3c}, {&(0x7f0000000280)=""/77, 0x4d}, {&(0x7f0000000540)=""/154, 0x9a}, {&(0x7f0000000340)=""/22, 0x16}], 0x8, &(0x7f0000002400)=""/191, 0xbf}}], 0x1, 0x6, &(0x7f0000003700)={0x77359400}) 15:25:14 executing program 2: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000340)={'erspan0\x00', 0x0}) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000300)={'syz_tun\x00', 0x0}) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r7, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r6, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000380)=@newlink={0x34, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r8}, [@IFLA_LINKINFO={0x14, 0x12, @bridge={{0xb, 0x1, 'bridge\x00'}, {0x4}}}]}, 0x34}}, 0x0) sendmsg$nl_route(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000002700)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r5}, [@IFLA_MASTER={0x8, 0xa, r8}]}, 0x28}}, 0x0) sendmsg$nl_route(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f00000000c0)=ANY=[@ANYBLOB="2800000010000104000040000000000000001ea6", @ANYRES32=r2, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00\b\x00\n\x00', @ANYRES32=r8], 0x28}}, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r10 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r9, 0x8933, &(0x7f0000000300)={'syz_tun\x00', 0x0}) sendmsg$nl_route(r10, &(0x7f0000000000)={0x0, 0xc00, &(0x7f00000000c0)={&(0x7f0000000040)=@newlink={0x2c, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r11}, [@IFLA_BROADCAST={0xa}]}, 0x332}}, 0x0) [ 432.607119][T18348] device erspan0 left promiscuous mode [ 432.613191][T18348] bridge230: port 2(erspan0) entered disabled state 15:25:14 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000004c0)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r3, @ANYBLOB="0000000000000000280012000c0001007665746800000000180002001400010000000000", @ANYRES32=0x0, @ANYBLOB="00000000008433df6d6f6b577d4eaaf20000"], 0x5}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000540)=ANY=[@ANYBLOB="7400000024000705000000000000000000010000", @ANYRES32=r3, @ANYBLOB="00000000ffffffff000000000800010073667100486818973f73461919309b68e1693572bb000229c6090032d0ed64f3c3545aaf6e000085a4e4ebb5ef670000000000000000000000000000001a4e624d29a84abf03265700000000000000000000000000000000000000000000000000000000000000ac20000089b53c947244306a0216a3de887763df5b42498b13bb1938de859ee6d7ae7dd2224dc672b69b4358871b170ea0b667832e5224ee3538f885b7abd9bc4a7d"], 0x74}}, 0x0) r4 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r4, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000300)=ANY=[@ANYBLOB="840000002c00010700"/20, @ANYRES32=r3, @ANYBLOB="0008008000000000030000000800010075333200580002001400050000000000000000000000000000000000400006003c0001000000000000001020898dde66057433b6ef3a41d22be225e0001b0000000000000000000000000017256ffc66e43a2484e1a912c5998bcbf0d0000000000000000000000000000000798a3c067277da1a290b9613a33c575c36fad473382c8f5532ef3f0e1d2c450a7decbf3431a69f9b2ecb3291bed174245a962fe0484676958265e2988326a89db3139d91fe4aee6ae7e745ab00001a9f61f20500000000000000b3958bc14fce6e66a36d1ab3194534ba4e973684b27793bff837d3"], 0x84}}, 0x0) r5 = socket(0x10, 0x80002, 0x0) sendmmsg$alg(r5, &(0x7f0000000140), 0x49249249249278c, 0x0) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r6, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000500)=@newlink={0x20, 0x11, 0x40d, 0x0, 0x0, {0x0, 0x0, 0x0, r8}}, 0x20}}, 0x0) r9 = socket(0x10, 0x80002, 0x0) getsockopt$inet_sctp_SCTP_PEER_AUTH_CHUNKS(0xffffffffffffffff, 0x84, 0x1a, &(0x7f0000000940)=ANY=[@ANYRES32=0x0, @ANYBLOB='\x00'/12], &(0x7f0000000980)=0x10) r10 = socket(0xa, 0x6, 0x0) close(r10) r11 = socket$inet6_sctp(0xa, 0x10000000005, 0x84) setsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX(r11, 0x84, 0x6e, &(0x7f0000000180)=[@in6={0xa, 0x0, 0x0, @remote, 0x9}], 0x1c) getsockopt$inet_sctp6_SCTP_GET_ASSOC_ID_LIST(r11, 0x84, 0x1d, &(0x7f000095dff8)={0x1, [0x0]}, &(0x7f000095dffc)=0x8) setsockopt$inet_sctp_SCTP_RTOINFO(r10, 0x84, 0x0, &(0x7f0000000000)={r12, 0x0, 0x0, 0x1000000}, 0x10) setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(0xffffffffffffffff, 0x84, 0x9, &(0x7f0000000680)={r12, @in={{0x2, 0x4e20, @remote}}, 0x10001, 0xfff7, 0x5, 0x1, 0x8, 0x5, 0xba}, 0x9c) ioctl(r9, 0x1000008912, &(0x7f00000001c0)="080db5055e0bcfe8696071") getsockopt$inet_sctp_SCTP_PEER_AUTH_CHUNKS(r9, 0x84, 0x1a, &(0x7f0000000940)=ANY=[@ANYRES32=0x0, @ANYBLOB='\x00'/12], &(0x7f0000000980)=0x10) r13 = socket$nl_generic(0x10, 0x3, 0x10) r14 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080)='nl80211\x00') r15 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL80211_CMD_GET_STATION(r15, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000240)={0x1c, r14, 0xf2b, 0x0, 0x0, {}, [@NL80211_ATTR_AIRTIME_WEIGHT={0x8}]}, 0x1c}}, 0x0) sendmsg$NL80211_CMD_GET_MPATH(r13, &(0x7f00000001c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x2000}, 0x268, &(0x7f0000000080)={&(0x7f0000000200)={0x40, r14, 0x4, 0x70bd2d, 0x25dfdbff}, 0xff6b}, 0x1, 0x0, 0x0, 0x10049050}, 0x260448c0) sendmsg$NL80211_CMD_NEW_KEY(r9, &(0x7f0000000640)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0xb0024000}, 0xc, &(0x7f00000002c0)={&(0x7f0000000440)={0x7c, r14, 0x23, 0x70bd27, 0x25dfdbff, {}, [@NL80211_ATTR_KEY_DATA_WEP40={0x9, 0x7, "a80875ab12"}, @NL80211_ATTR_KEY={0x5c, 0x50, [@NL80211_KEY_DEFAULT_TYPES={0x14, 0x8, [@NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_MULTICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_MULTICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_MULTICAST={0x4}]}, @NL80211_KEY_DEFAULT_TYPES={0x28, 0x8, [@NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_MULTICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_MULTICAST={0x4}]}, @NL80211_KEY_IDX={0x5, 0x2, 0x5}, @NL80211_KEY_DATA_WEP104={0x11, 0x1, "4d84c4e30151cb27f51a4adf63"}]}]}, 0x7c}, 0x1, 0x0, 0x0, 0x24000}, 0x40) 15:25:14 executing program 3: r0 = socket(0x21, 0xa, 0x1) r1 = socket(0x10, 0x80002, 0x0) ioctl(r1, 0x1000008912, &(0x7f00000001c0)="080db5055e0bcfe8696071") getsockopt$inet_sctp_SCTP_PEER_AUTH_CHUNKS(r1, 0x84, 0x1a, &(0x7f0000000940)=ANY=[@ANYRES32=0x0, @ANYBLOB='\x00'/12], &(0x7f0000000980)=0x10) getsockopt$inet_sctp_SCTP_GET_PEER_ADDR_INFO(r0, 0x84, 0xf, &(0x7f00000009c0)={r2, @in6={{0xa, 0x4e21, 0x8, @local, 0x401}}, 0x9, 0x1, 0x7, 0x7f, 0x6}, &(0x7f0000000a80)=0x98) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000400)='nl80211\x00') sendmsg$NL80211_CMD_GET_MESH_CONFIG(r0, &(0x7f0000000580)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x103190}, 0xc, &(0x7f0000000540)={&(0x7f0000000500)={0x34, r3, 0x10, 0x70bd2d, 0x25dfdbfe, {}, [@NL80211_ATTR_WDEV={0xc, 0x99, {0x1, 0xffffffffffffffff}}, @NL80211_ATTR_WIPHY={0x8, 0x1, 0x1}, @NL80211_ATTR_WDEV={0xc, 0x99, {0x3f, 0x3}}]}, 0x34}, 0x1, 0x0, 0x0, 0x800}, 0x40000) r4 = socket$nl_generic(0x10, 0x3, 0x10) bind$netlink(r4, &(0x7f0000000000)={0x10, 0x0, 0x25dfdbff, 0x1004280}, 0xffffffffffffffb3) sendmsg$nl_generic(r4, &(0x7f0000000080)={&(0x7f0000000480)={0x2, 0xbb7f}, 0xc, &(0x7f0000000440)={&(0x7f00000004c0)={0x1c, 0x22, 0x1, 0x0, 0x0, {0x4}, [@typed={0x8, 0xc}]}, 0x1c}}, 0x0) socket$netlink(0x10, 0x3, 0x0) r5 = socket$alg(0x26, 0x5, 0x0) bind$alg(r5, &(0x7f0000000080)={0x26, 'hash\x00', 0x0, 0x0, 'sha512\x00'}, 0x58) 15:25:14 executing program 5: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000340)={'erspan0\x00', 0x0}) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000300)={'syz_tun\x00', 0x0}) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r7, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r6, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000380)=@newlink={0x34, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r8}, [@IFLA_LINKINFO={0x14, 0x12, @bridge={{0xb, 0x1, 'bridge\x00'}, {0x4}}}]}, 0x34}}, 0x0) sendmsg$nl_route(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000002700)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r5}, [@IFLA_MASTER={0x8, 0xa, r8}]}, 0x28}}, 0x0) sendmsg$nl_route(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f00000000c0)=ANY=[@ANYBLOB="2800000010000104000040000000000000001ea6", @ANYRES32=r2, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00\b\x00\n\x00', @ANYRES32=r8], 0x28}}, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r10 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r9, 0x8933, &(0x7f0000000300)={'syz_tun\x00', 0x0}) sendmsg$nl_route(r10, &(0x7f0000000000)={0x0, 0x600, &(0x7f00000000c0)={&(0x7f0000000040)=@newlink={0x2c, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r11}, [@IFLA_BROADCAST={0xa}]}, 0x332}}, 0x0) 15:25:14 executing program 4: r0 = socket$inet6(0xa, 0x80003, 0x6b) ioctl(r0, 0x1000008912, &(0x7f00000001c0)="080db5055e0bcfe8476071") r1 = socket(0x10, 0x2, 0x0) sendto(r1, &(0x7f0000000200)="120000001200e7ef007b1a3fcd00000000a1", 0x12, 0x0, 0x0, 0x18) recvmmsg(r1, &(0x7f00000037c0)=[{{&(0x7f0000000600)=@ethernet={0x0, @random}, 0x80, &(0x7f0000000380)=[{&(0x7f00000000c0)=""/85, 0x55}, {&(0x7f00000024c0)=""/4096, 0x1000}, {&(0x7f0000000400)=""/120, 0x78}, {&(0x7f0000000480)=""/60, 0x3c}, {&(0x7f0000000280)=""/77, 0x4d}, {&(0x7f0000000540)=""/154, 0x9a}, {&(0x7f0000000340)=""/22, 0x16}], 0x7, &(0x7f0000002400)=""/191, 0xbf}}], 0x1, 0x6, &(0x7f0000003700)={0x77359400}) [ 432.831567][T18378] device syz_tun left promiscuous mode [ 432.851366][T18378] bridge240: port 1(syz_tun) entered disabled state [ 432.880635][ C1] TCP: request_sock_TCPv6: Possible SYN flooding on port 20002. Sending cookies. Check SNMP counters. [ 433.007973][T18378] bridge241: port 1(syz_tun) entered blocking state [ 433.031098][T18378] bridge241: port 1(syz_tun) entered disabled state [ 433.055219][T18378] device syz_tun entered promiscuous mode [ 433.065734][T18380] netlink: 72 bytes leftover after parsing attributes in process `syz-executor.1'. [ 433.091014][T18375] device erspan0 left promiscuous mode [ 433.103637][T18375] bridge240: port 2(erspan0) entered disabled state [ 433.217938][T18375] bridge241: port 2(erspan0) entered blocking state [ 433.224790][T18375] bridge241: port 2(erspan0) entered disabled state [ 433.233533][T18375] device erspan0 entered promiscuous mode [ 433.241860][T18384] netlink: 72 bytes leftover after parsing attributes in process `syz-executor.1'. 15:25:15 executing program 0: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000340)={'erspan0\x00', 0x0}) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000300)={'syz_tun\x00', 0x0}) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r7, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r6, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000380)=@newlink={0x34, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r8}, [@IFLA_LINKINFO={0x14, 0x12, @bridge={{0xb, 0x1, 'bridge\x00'}, {0x4}}}]}, 0x34}}, 0x0) sendmsg$nl_route(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000002700)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r5}, [@IFLA_MASTER={0x8, 0xa, r8}]}, 0x28}}, 0x0) sendmsg$nl_route(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f00000000c0)=ANY=[@ANYBLOB="2800000010000104000040000000000000001ea6", @ANYRES32=r2, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00\b\x00\n\x00', @ANYRES32=r8], 0x28}}, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r10 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r9, 0x8933, &(0x7f0000000300)={'syz_tun\x00', 0x0}) sendmsg$nl_route(r10, &(0x7f0000000000)={0x0, 0xf0, &(0x7f00000000c0)={&(0x7f0000000040)=@newlink={0x2c, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r11}, [@IFLA_BROADCAST={0xa}]}, 0x332}}, 0x0) [ 433.264764][T18396] device syz_tun left promiscuous mode [ 433.271673][T18396] bridge230: port 1(syz_tun) entered disabled state [ 433.417938][T18396] bridge231: port 1(syz_tun) entered blocking state [ 433.425030][T18396] bridge231: port 1(syz_tun) entered disabled state [ 433.434061][T18396] device syz_tun entered promiscuous mode [ 433.442118][T18398] bridge231: port 2(erspan0) entered blocking state [ 433.448849][T18398] bridge231: port 2(erspan0) entered disabled state [ 433.457471][T18398] device erspan0 entered promiscuous mode 15:25:15 executing program 3: r0 = socket(0x21, 0xa, 0x1) r1 = socket(0x10, 0x80002, 0x0) ioctl(r1, 0x1000008912, &(0x7f00000001c0)="080db5055e0bcfe8696071") getsockopt$inet_sctp_SCTP_PEER_AUTH_CHUNKS(r1, 0x84, 0x1a, &(0x7f0000000940)=ANY=[@ANYRES32=0x0, @ANYBLOB='\x00'/12], &(0x7f0000000980)=0x10) getsockopt$inet_sctp_SCTP_GET_PEER_ADDR_INFO(r0, 0x84, 0xf, &(0x7f00000009c0)={r2, @in6={{0xa, 0x4e21, 0x8, @local, 0x401}}, 0x9, 0x1, 0x7, 0x7f, 0x6}, &(0x7f0000000a80)=0x98) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000400)='nl80211\x00') sendmsg$NL80211_CMD_GET_MESH_CONFIG(r0, &(0x7f0000000580)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x103190}, 0xc, &(0x7f0000000540)={&(0x7f0000000500)={0x34, r3, 0x10, 0x70bd2d, 0x25dfdbfe, {}, [@NL80211_ATTR_WDEV={0xc, 0x99, {0x1, 0xffffffffffffffff}}, @NL80211_ATTR_WIPHY={0x8, 0x1, 0x1}, @NL80211_ATTR_WDEV={0xc, 0x99, {0x3f, 0x3}}]}, 0x34}, 0x1, 0x0, 0x0, 0x800}, 0x40000) r4 = socket$nl_generic(0x10, 0x3, 0x10) bind$netlink(r4, &(0x7f0000000000)={0x10, 0x0, 0x25dfdbff, 0x1004280}, 0xffffffffffffffb3) sendmsg$nl_generic(r4, &(0x7f0000000080)={&(0x7f0000000480)={0x3, 0xbb7f}, 0xc, &(0x7f0000000440)={&(0x7f00000004c0)={0x1c, 0x22, 0x1, 0x0, 0x0, {0x4}, [@typed={0x8, 0xc}]}, 0x1c}}, 0x0) socket$netlink(0x10, 0x3, 0x0) r5 = socket$alg(0x26, 0x5, 0x0) bind$alg(r5, &(0x7f0000000080)={0x26, 'hash\x00', 0x0, 0x0, 'sha512\x00'}, 0x58) [ 433.465738][T18380] netlink: 'syz-executor.1': attribute type 274 has an invalid length. [ 433.475624][T18401] netlink: 'syz-executor.1': attribute type 274 has an invalid length. [ 433.514955][T18407] device syz_tun left promiscuous mode 15:25:15 executing program 2: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000340)={'erspan0\x00', 0x0}) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000300)={'syz_tun\x00', 0x0}) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r7, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r6, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000380)=@newlink={0x34, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r8}, [@IFLA_LINKINFO={0x14, 0x12, @bridge={{0xb, 0x1, 'bridge\x00'}, {0x4}}}]}, 0x34}}, 0x0) sendmsg$nl_route(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000002700)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r5}, [@IFLA_MASTER={0x8, 0xa, r8}]}, 0x28}}, 0x0) sendmsg$nl_route(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f00000000c0)=ANY=[@ANYBLOB="2800000010000104000040000000000000001ea6", @ANYRES32=r2, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00\b\x00\n\x00', @ANYRES32=r8], 0x28}}, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r10 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r9, 0x8933, &(0x7f0000000300)={'syz_tun\x00', 0x0}) sendmsg$nl_route(r10, &(0x7f0000000000)={0x0, 0xe00, &(0x7f00000000c0)={&(0x7f0000000040)=@newlink={0x2c, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r11}, [@IFLA_BROADCAST={0xa}]}, 0x332}}, 0x0) 15:25:15 executing program 4: r0 = socket$inet6(0xa, 0x80003, 0x6b) ioctl(r0, 0x1000008912, &(0x7f00000001c0)="080db5055e0bcfe8476071") r1 = socket(0x10, 0x2, 0x0) sendto(r1, &(0x7f0000000200)="120000001200e7ef007b1a3fcd00000000a1", 0x12, 0x0, 0x0, 0x18) recvmmsg(r1, &(0x7f00000037c0)=[{{&(0x7f0000000600)=@ethernet={0x0, @random}, 0x80, &(0x7f0000000380)=[{&(0x7f00000000c0)=""/85, 0x55}, {&(0x7f00000024c0)=""/4096, 0x1000}, {&(0x7f0000000400)=""/120, 0x78}, {&(0x7f0000000480)=""/60, 0x3c}, {&(0x7f0000000280)=""/77, 0x4d}, {&(0x7f0000000540)=""/154, 0x9a}, {&(0x7f0000000340)=""/22, 0x16}], 0x7, &(0x7f0000002400)=""/191, 0xbf}}], 0x1, 0x6, &(0x7f0000003700)={0x77359400}) [ 433.562704][T18407] bridge3: port 1(syz_tun) entered disabled state 15:25:15 executing program 5: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000340)={'erspan0\x00', 0x0}) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000300)={'syz_tun\x00', 0x0}) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r7, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r6, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000380)=@newlink={0x34, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r8}, [@IFLA_LINKINFO={0x14, 0x12, @bridge={{0xb, 0x1, 'bridge\x00'}, {0x4}}}]}, 0x34}}, 0x0) sendmsg$nl_route(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000002700)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r5}, [@IFLA_MASTER={0x8, 0xa, r8}]}, 0x28}}, 0x0) sendmsg$nl_route(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f00000000c0)=ANY=[@ANYBLOB="2800000010000104000040000000000000001ea6", @ANYRES32=r2, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00\b\x00\n\x00', @ANYRES32=r8], 0x28}}, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r10 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r9, 0x8933, &(0x7f0000000300)={'syz_tun\x00', 0x0}) sendmsg$nl_route(r10, &(0x7f0000000000)={0x0, 0xa00, &(0x7f00000000c0)={&(0x7f0000000040)=@newlink={0x2c, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r11}, [@IFLA_BROADCAST={0xa}]}, 0x332}}, 0x0) 15:25:15 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000004c0)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r3, @ANYBLOB="0000000000000000280012000c0001007665746800000000180002001400010000000000", @ANYBLOB="00000000008433df6d6f6b577d4eaaf2000007"], 0x4}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000540)=ANY=[@ANYBLOB="7400000024000705000000000000000000010000", @ANYRES32=r3, @ANYBLOB="00000000ffffffff000000000800010073667100486818973f73461919309b68e1693572bb000229c6090032d0ed64f3c3545aaf6e000085a4e4ebb5ef670000000000000000000000000000001a4e624d29a84abf03265700000000000000000000000000000000000000000000000000000000000000ac20000089b53c947244306a0216a3de887763df5b42498b13bb1938de859ee6d7ae7dd2224dc672b69b4358871b170ea0b667832e5224ee3538f885b7abd9bc4a7d"], 0x74}}, 0x0) r4 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r4, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000300)=ANY=[@ANYBLOB="840000002c00010700"/20, @ANYRES32=r3, @ANYBLOB="0008008000000000030000000800010075333200580002001400050000000000000000000000000000000000400006003c0001000000000000001020898dde66057433b6ef3a41d22be225e0001b0000000000000000000000000017256ffc66e43a2484e1a912c5998bcbf0d0000000000000000000000000000000798a3c067277da1a290b9613a33c575c36fad473382c8f5532ef3f0e1d2c450a7decbf3431a69f9b2ecb3291bed174245a962fe0484676958265e2988326a89db3139d91fe4aee6ae7e745ab00001a9f61f20500000000000000b3958bc14fce6e66a36d1ab3194534ba4e973684b27793bff837d3"], 0x84}}, 0x0) r5 = socket(0x10, 0x80002, 0x0) sendmmsg$alg(r5, &(0x7f0000000140), 0x49249249249278c, 0x0) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r6, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000500)=@newlink={0x20, 0x11, 0x40d, 0x0, 0x0, {0x0, 0x0, 0x0, r8}}, 0x20}}, 0x0) r9 = socket(0x10, 0x80002, 0x0) getsockopt$inet_sctp_SCTP_PEER_AUTH_CHUNKS(0xffffffffffffffff, 0x84, 0x1a, &(0x7f0000000940)=ANY=[@ANYRES32=0x0, @ANYBLOB='\x00'/12], &(0x7f0000000980)=0x10) r10 = socket(0xa, 0x6, 0x0) close(r10) r11 = socket$inet6_sctp(0xa, 0x10000000005, 0x84) setsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX(r11, 0x84, 0x6e, &(0x7f0000000180)=[@in6={0xa, 0x0, 0x0, @remote, 0x9}], 0x1c) getsockopt$inet_sctp6_SCTP_GET_ASSOC_ID_LIST(r11, 0x84, 0x1d, &(0x7f000095dff8)={0x1, [0x0]}, &(0x7f000095dffc)=0x8) setsockopt$inet_sctp_SCTP_RTOINFO(r10, 0x84, 0x0, &(0x7f0000000000)={r12, 0x0, 0x0, 0x1000000}, 0x10) setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(0xffffffffffffffff, 0x84, 0x9, &(0x7f0000000680)={r12, @in={{0x2, 0x4e20, @remote}}, 0x10001, 0xfff7, 0x5, 0x1, 0x8, 0x5, 0xba}, 0x9c) ioctl(r9, 0x1000008912, &(0x7f00000001c0)="080db5055e0bcfe8696071") getsockopt$inet_sctp_SCTP_PEER_AUTH_CHUNKS(r9, 0x84, 0x1a, &(0x7f0000000940)=ANY=[@ANYRES32=0x0, @ANYBLOB='\x00'/12], &(0x7f0000000980)=0x10) r13 = socket$nl_generic(0x10, 0x3, 0x10) r14 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080)='nl80211\x00') r15 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL80211_CMD_GET_STATION(r15, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000240)={0x1c, r14, 0xf2b, 0x0, 0x0, {}, [@NL80211_ATTR_AIRTIME_WEIGHT={0x8}]}, 0x1c}}, 0x0) sendmsg$NL80211_CMD_GET_MPATH(r13, &(0x7f00000001c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x2000}, 0x268, &(0x7f0000000080)={&(0x7f0000000200)={0x40, r14, 0x4, 0x70bd2d, 0x25dfdbff}, 0xff6b}, 0x1, 0x0, 0x0, 0x10049050}, 0x260448c0) sendmsg$NL80211_CMD_NEW_KEY(r9, &(0x7f0000000640)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0xb0024000}, 0xc, &(0x7f00000002c0)={&(0x7f0000000440)={0x7c, r14, 0x23, 0x70bd27, 0x25dfdbff, {}, [@NL80211_ATTR_KEY_DATA_WEP40={0x9, 0x7, "a80875ab12"}, @NL80211_ATTR_KEY={0x5c, 0x50, [@NL80211_KEY_DEFAULT_TYPES={0x14, 0x8, [@NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_MULTICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_MULTICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_MULTICAST={0x4}]}, @NL80211_KEY_DEFAULT_TYPES={0x28, 0x8, [@NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_MULTICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_MULTICAST={0x4}]}, @NL80211_KEY_IDX={0x5, 0x2, 0x5}, @NL80211_KEY_DATA_WEP104={0x11, 0x1, "4d84c4e30151cb27f51a4adf63"}]}]}, 0x7c}, 0x1, 0x0, 0x0, 0x24000}, 0x40) [ 433.817995][T18407] bridge4: port 1(syz_tun) entered blocking state [ 433.824694][T18407] bridge4: port 1(syz_tun) entered disabled state [ 433.835829][T18407] device syz_tun entered promiscuous mode [ 433.843609][T18408] device erspan0 left promiscuous mode [ 433.856818][T18408] bridge3: port 2(erspan0) entered disabled state [ 433.977826][T18408] bridge4: port 2(erspan0) entered blocking state [ 433.984528][T18408] bridge4: port 2(erspan0) entered disabled state [ 433.992905][T18408] device erspan0 entered promiscuous mode 15:25:16 executing program 4: r0 = socket$inet6(0xa, 0x80003, 0x6b) ioctl(r0, 0x1000008912, &(0x7f00000001c0)="080db5055e0bcfe8476071") r1 = socket(0x10, 0x2, 0x0) sendto(r1, &(0x7f0000000200)="120000001200e7ef007b1a3fcd00000000a1", 0x12, 0x0, 0x0, 0x18) recvmmsg(r1, &(0x7f00000037c0)=[{{&(0x7f0000000600)=@ethernet={0x0, @random}, 0x80, &(0x7f0000000380)=[{&(0x7f00000000c0)=""/85, 0x55}, {&(0x7f00000024c0)=""/4096, 0x1000}, {&(0x7f0000000400)=""/120, 0x78}, {&(0x7f0000000480)=""/60, 0x3c}, {&(0x7f0000000280)=""/77, 0x4d}, {&(0x7f0000000540)=""/154, 0x9a}, {&(0x7f0000000340)=""/22, 0x16}], 0x7, &(0x7f0000002400)=""/191, 0xbf}}], 0x1, 0x6, &(0x7f0000003700)={0x77359400}) 15:25:16 executing program 0: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000340)={'erspan0\x00', 0x0}) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000300)={'syz_tun\x00', 0x0}) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r7, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r6, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000380)=@newlink={0x34, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r8}, [@IFLA_LINKINFO={0x14, 0x12, @bridge={{0xb, 0x1, 'bridge\x00'}, {0x4}}}]}, 0x34}}, 0x0) sendmsg$nl_route(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000002700)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r5}, [@IFLA_MASTER={0x8, 0xa, r8}]}, 0x28}}, 0x0) sendmsg$nl_route(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f00000000c0)=ANY=[@ANYBLOB="2800000010000104000040000000000000001ea6", @ANYRES32=r2, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00\b\x00\n\x00', @ANYRES32=r8], 0x28}}, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r10 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r9, 0x8933, &(0x7f0000000300)={'syz_tun\x00', 0x0}) sendmsg$nl_route(r10, &(0x7f0000000000)={0x0, 0x600, &(0x7f00000000c0)={&(0x7f0000000040)=@newlink={0x2c, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r11}, [@IFLA_BROADCAST={0xa}]}, 0x332}}, 0x0) [ 434.018243][T18427] device syz_tun left promiscuous mode [ 434.032324][T18427] bridge231: port 1(syz_tun) entered disabled state [ 434.187945][T18427] bridge232: port 1(syz_tun) entered blocking state [ 434.194855][T18427] bridge232: port 1(syz_tun) entered disabled state [ 434.203831][T18427] device syz_tun entered promiscuous mode [ 434.213859][T18426] netlink: 72 bytes leftover after parsing attributes in process `syz-executor.1'. [ 434.226291][T18428] device syz_tun left promiscuous mode [ 434.232405][T18428] bridge241: port 1(syz_tun) entered disabled state [ 434.367910][T18428] bridge242: port 1(syz_tun) entered blocking state [ 434.374786][T18428] bridge242: port 1(syz_tun) entered disabled state [ 434.383185][T18428] device syz_tun entered promiscuous mode [ 434.391274][T18430] device erspan0 left promiscuous mode [ 434.398877][T18430] bridge231: port 2(erspan0) entered disabled state [ 434.527814][T18430] bridge232: port 2(erspan0) entered blocking state [ 434.534653][T18430] bridge232: port 2(erspan0) entered disabled state [ 434.546768][T18430] device erspan0 entered promiscuous mode [ 434.554706][T18431] netlink: 72 bytes leftover after parsing attributes in process `syz-executor.1'. [ 434.565254][T18432] device erspan0 left promiscuous mode [ 434.570964][T18432] bridge241: port 2(erspan0) entered disabled state [ 434.718886][T18432] bridge242: port 2(erspan0) entered blocking state [ 434.725597][T18432] bridge242: port 2(erspan0) entered disabled state [ 434.733740][T18432] device erspan0 entered promiscuous mode [ 434.746703][T18438] netlink: 'syz-executor.1': attribute type 274 has an invalid length. [ 434.757138][T18440] netlink: 'syz-executor.1': attribute type 274 has an invalid length. 15:25:16 executing program 3: r0 = socket(0x21, 0xa, 0x1) r1 = socket(0x10, 0x80002, 0x0) ioctl(r1, 0x1000008912, &(0x7f00000001c0)="080db5055e0bcfe8696071") getsockopt$inet_sctp_SCTP_PEER_AUTH_CHUNKS(r1, 0x84, 0x1a, &(0x7f0000000940)=ANY=[@ANYRES32=0x0, @ANYBLOB='\x00'/12], &(0x7f0000000980)=0x10) getsockopt$inet_sctp_SCTP_GET_PEER_ADDR_INFO(r0, 0x84, 0xf, &(0x7f00000009c0)={r2, @in6={{0xa, 0x4e21, 0x8, @local, 0x401}}, 0x9, 0x1, 0x7, 0x7f, 0x6}, &(0x7f0000000a80)=0x98) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000400)='nl80211\x00') sendmsg$NL80211_CMD_GET_MESH_CONFIG(r0, &(0x7f0000000580)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x103190}, 0xc, &(0x7f0000000540)={&(0x7f0000000500)={0x34, r3, 0x10, 0x70bd2d, 0x25dfdbfe, {}, [@NL80211_ATTR_WDEV={0xc, 0x99, {0x1, 0xffffffffffffffff}}, @NL80211_ATTR_WIPHY={0x8, 0x1, 0x1}, @NL80211_ATTR_WDEV={0xc, 0x99, {0x3f, 0x3}}]}, 0x34}, 0x1, 0x0, 0x0, 0x800}, 0x40000) r4 = socket$nl_generic(0x10, 0x3, 0x10) bind$netlink(r4, &(0x7f0000000000)={0x10, 0x0, 0x25dfdbff, 0x1004280}, 0xffffffffffffffb3) sendmsg$nl_generic(r4, &(0x7f0000000080)={&(0x7f0000000480)={0x4, 0xbb7f}, 0xc, &(0x7f0000000440)={&(0x7f00000004c0)={0x1c, 0x22, 0x1, 0x0, 0x0, {0x4}, [@typed={0x8, 0xc}]}, 0x1c}}, 0x0) socket$netlink(0x10, 0x3, 0x0) r5 = socket$alg(0x26, 0x5, 0x0) bind$alg(r5, &(0x7f0000000080)={0x26, 'hash\x00', 0x0, 0x0, 'sha512\x00'}, 0x58) 15:25:16 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000004c0)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r3, @ANYBLOB="0000000000000000280012000c0001007665746800000000180002001400010000000000", @ANYBLOB="00000000008433df6d6f6b577d4eaaf2000007"], 0x4}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000540)=ANY=[@ANYBLOB="7400000024000705000000000000000000010000", @ANYRES32=r3, @ANYBLOB="00000000ffffffff000000000800010073667100486818973f73461919309b68e1693572bb000229c6090032d0ed64f3c3545aaf6e000085a4e4ebb5ef670000000000000000000000000000001a4e624d29a84abf03265700000000000000000000000000000000000000000000000000000000000000ac20000089b53c947244306a0216a3de887763df5b42498b13bb1938de859ee6d7ae7dd2224dc672b69b4358871b170ea0b667832e5224ee3538f885b7abd9bc4a7d"], 0x74}}, 0x0) r4 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r4, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000300)=ANY=[@ANYBLOB="840000002c00010700"/20, @ANYRES32=r3, @ANYBLOB="0008008000000000030000000800010075333200580002001400050000000000000000000000000000000000400006003c0001000000000000001020898dde66057433b6ef3a41d22be225e0001b0000000000000000000000000017256ffc66e43a2484e1a912c5998bcbf0d0000000000000000000000000000000798a3c067277da1a290b9613a33c575c36fad473382c8f5532ef3f0e1d2c450a7decbf3431a69f9b2ecb3291bed174245a962fe0484676958265e2988326a89db3139d91fe4aee6ae7e745ab00001a9f61f20500000000000000b3958bc14fce6e66a36d1ab3194534ba4e973684b27793bff837d3"], 0x84}}, 0x0) r5 = socket(0x10, 0x80002, 0x0) sendmmsg$alg(r5, &(0x7f0000000140), 0x49249249249278c, 0x0) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r6, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000500)=@newlink={0x20, 0x11, 0x40d, 0x0, 0x0, {0x0, 0x0, 0x0, r8}}, 0x20}}, 0x0) r9 = socket(0x10, 0x80002, 0x0) getsockopt$inet_sctp_SCTP_PEER_AUTH_CHUNKS(0xffffffffffffffff, 0x84, 0x1a, &(0x7f0000000940)=ANY=[@ANYRES32=0x0, @ANYBLOB='\x00'/12], &(0x7f0000000980)=0x10) r10 = socket(0xa, 0x6, 0x0) close(r10) r11 = socket$inet6_sctp(0xa, 0x10000000005, 0x84) setsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX(r11, 0x84, 0x6e, &(0x7f0000000180)=[@in6={0xa, 0x0, 0x0, @remote, 0x9}], 0x1c) getsockopt$inet_sctp6_SCTP_GET_ASSOC_ID_LIST(r11, 0x84, 0x1d, &(0x7f000095dff8)={0x1, [0x0]}, &(0x7f000095dffc)=0x8) setsockopt$inet_sctp_SCTP_RTOINFO(r10, 0x84, 0x0, &(0x7f0000000000)={r12, 0x0, 0x0, 0x1000000}, 0x10) setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(0xffffffffffffffff, 0x84, 0x9, &(0x7f0000000680)={r12, @in={{0x2, 0x4e20, @remote}}, 0x10001, 0xfff7, 0x5, 0x1, 0x8, 0x5, 0xba}, 0x9c) ioctl(r9, 0x1000008912, &(0x7f00000001c0)="080db5055e0bcfe8696071") getsockopt$inet_sctp_SCTP_PEER_AUTH_CHUNKS(r9, 0x84, 0x1a, &(0x7f0000000940)=ANY=[@ANYRES32=0x0, @ANYBLOB='\x00'/12], &(0x7f0000000980)=0x10) r13 = socket$nl_generic(0x10, 0x3, 0x10) r14 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080)='nl80211\x00') r15 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL80211_CMD_GET_STATION(r15, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000240)={0x1c, r14, 0xf2b, 0x0, 0x0, {}, [@NL80211_ATTR_AIRTIME_WEIGHT={0x8}]}, 0x1c}}, 0x0) sendmsg$NL80211_CMD_GET_MPATH(r13, &(0x7f00000001c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x2000}, 0x268, &(0x7f0000000080)={&(0x7f0000000200)={0x40, r14, 0x4, 0x70bd2d, 0x25dfdbff}, 0xff6b}, 0x1, 0x0, 0x0, 0x10049050}, 0x260448c0) sendmsg$NL80211_CMD_NEW_KEY(r9, &(0x7f0000000640)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0xb0024000}, 0xc, &(0x7f00000002c0)={&(0x7f0000000440)={0x7c, r14, 0x23, 0x70bd27, 0x25dfdbff, {}, [@NL80211_ATTR_KEY_DATA_WEP40={0x9, 0x7, "a80875ab12"}, @NL80211_ATTR_KEY={0x5c, 0x50, [@NL80211_KEY_DEFAULT_TYPES={0x14, 0x8, [@NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_MULTICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_MULTICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_MULTICAST={0x4}]}, @NL80211_KEY_DEFAULT_TYPES={0x28, 0x8, [@NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_MULTICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_MULTICAST={0x4}]}, @NL80211_KEY_IDX={0x5, 0x2, 0x5}, @NL80211_KEY_DATA_WEP104={0x11, 0x1, "4d84c4e30151cb27f51a4adf63"}]}]}, 0x7c}, 0x1, 0x0, 0x0, 0x24000}, 0x40) [ 434.781227][T18449] device syz_tun left promiscuous mode [ 434.786862][T18449] bridge4: port 1(syz_tun) entered disabled state [ 434.908708][T18449] bridge5: port 1(syz_tun) entered blocking state [ 434.915624][T18449] bridge5: port 1(syz_tun) entered disabled state [ 434.924697][T18449] device syz_tun entered promiscuous mode [ 434.932930][T18451] device erspan0 left promiscuous mode [ 434.948791][T18451] bridge4: port 2(erspan0) entered disabled state [ 435.087841][T18451] bridge5: port 2(erspan0) entered blocking state [ 435.094522][T18451] bridge5: port 2(erspan0) entered disabled state [ 435.103925][T18451] device erspan0 entered promiscuous mode 15:25:17 executing program 0: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000340)={'erspan0\x00', 0x0}) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000300)={'syz_tun\x00', 0x0}) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r7, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r6, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000380)=@newlink={0x34, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r8}, [@IFLA_LINKINFO={0x14, 0x12, @bridge={{0xb, 0x1, 'bridge\x00'}, {0x4}}}]}, 0x34}}, 0x0) sendmsg$nl_route(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000002700)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r5}, [@IFLA_MASTER={0x8, 0xa, r8}]}, 0x28}}, 0x0) sendmsg$nl_route(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f00000000c0)=ANY=[@ANYBLOB="2800000010000104000040000000000000001ea6", @ANYRES32=r2, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00\b\x00\n\x00', @ANYRES32=r8], 0x28}}, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r10 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r9, 0x8933, &(0x7f0000000300)={'syz_tun\x00', 0x0}) sendmsg$nl_route(r10, &(0x7f0000000000)={0x0, 0xa00, &(0x7f00000000c0)={&(0x7f0000000040)=@newlink={0x2c, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r11}, [@IFLA_BROADCAST={0xa}]}, 0x332}}, 0x0) 15:25:17 executing program 5: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000340)={'erspan0\x00', 0x0}) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000300)={'syz_tun\x00', 0x0}) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r7, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r6, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000380)=@newlink={0x34, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r8}, [@IFLA_LINKINFO={0x14, 0x12, @bridge={{0xb, 0x1, 'bridge\x00'}, {0x4}}}]}, 0x34}}, 0x0) sendmsg$nl_route(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000002700)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r5}, [@IFLA_MASTER={0x8, 0xa, r8}]}, 0x28}}, 0x0) sendmsg$nl_route(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f00000000c0)=ANY=[@ANYBLOB="2800000010000104000040000000000000001ea6", @ANYRES32=r2, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00\b\x00\n\x00', @ANYRES32=r8], 0x28}}, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r10 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r9, 0x8933, &(0x7f0000000300)={'syz_tun\x00', 0x0}) sendmsg$nl_route(r10, &(0x7f0000000000)={0x0, 0xc00, &(0x7f00000000c0)={&(0x7f0000000040)=@newlink={0x2c, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r11}, [@IFLA_BROADCAST={0xa}]}, 0x332}}, 0x0) 15:25:17 executing program 4: r0 = socket$inet6(0xa, 0x80003, 0x6b) ioctl(r0, 0x1000008912, &(0x7f00000001c0)="080db5055e0bcfe8476071") r1 = socket(0x10, 0x2, 0x0) sendto(r1, &(0x7f0000000200)="120000001200e7ef007b1a3fcd00000000a1", 0x12, 0x0, 0x0, 0x18) recvmmsg(r1, &(0x7f00000037c0)=[{{&(0x7f0000000600)=@ethernet={0x0, @random}, 0x80, &(0x7f0000000380)=[{0x0}, {&(0x7f00000000c0)=""/85, 0x55}, {&(0x7f00000024c0)=""/4096, 0x1000}, {&(0x7f0000000400)=""/120, 0x78}, {&(0x7f0000000480)=""/60, 0x3c}, {&(0x7f0000000280)=""/77, 0x4d}, {&(0x7f0000000540)=""/154, 0x9a}, {&(0x7f0000000340)=""/22, 0x16}], 0x8, &(0x7f0000002400)=""/191, 0xbf}}], 0x1, 0x6, &(0x7f0000003700)={0x77359400}) 15:25:17 executing program 2: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000340)={'erspan0\x00', 0x0}) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000300)={'syz_tun\x00', 0x0}) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r7, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r6, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000380)=@newlink={0x34, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r8}, [@IFLA_LINKINFO={0x14, 0x12, @bridge={{0xb, 0x1, 'bridge\x00'}, {0x4}}}]}, 0x34}}, 0x0) sendmsg$nl_route(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000002700)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r5}, [@IFLA_MASTER={0x8, 0xa, r8}]}, 0x28}}, 0x0) sendmsg$nl_route(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f00000000c0)=ANY=[@ANYBLOB="2800000010000104000040000000000000001ea6", @ANYRES32=r2, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00\b\x00\n\x00', @ANYRES32=r8], 0x28}}, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r10 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r9, 0x8933, &(0x7f0000000300)={'syz_tun\x00', 0x0}) sendmsg$nl_route(r10, &(0x7f0000000000)={0x0, 0xf00, &(0x7f00000000c0)={&(0x7f0000000040)=@newlink={0x2c, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r11}, [@IFLA_BROADCAST={0xa}]}, 0x332}}, 0x0) [ 435.138266][T18461] netlink: 72 bytes leftover after parsing attributes in process `syz-executor.1'. [ 435.174053][T18463] netlink: 72 bytes leftover after parsing attributes in process `syz-executor.1'. 15:25:17 executing program 3: r0 = socket(0x21, 0xa, 0x1) r1 = socket(0x10, 0x80002, 0x0) ioctl(r1, 0x1000008912, &(0x7f00000001c0)="080db5055e0bcfe8696071") getsockopt$inet_sctp_SCTP_PEER_AUTH_CHUNKS(r1, 0x84, 0x1a, &(0x7f0000000940)=ANY=[@ANYRES32=0x0, @ANYBLOB='\x00'/12], &(0x7f0000000980)=0x10) getsockopt$inet_sctp_SCTP_GET_PEER_ADDR_INFO(r0, 0x84, 0xf, &(0x7f00000009c0)={r2, @in6={{0xa, 0x4e21, 0x8, @local, 0x401}}, 0x9, 0x1, 0x7, 0x7f, 0x6}, &(0x7f0000000a80)=0x98) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000400)='nl80211\x00') sendmsg$NL80211_CMD_GET_MESH_CONFIG(r0, &(0x7f0000000580)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x103190}, 0xc, &(0x7f0000000540)={&(0x7f0000000500)={0x34, r3, 0x10, 0x70bd2d, 0x25dfdbfe, {}, [@NL80211_ATTR_WDEV={0xc, 0x99, {0x1, 0xffffffffffffffff}}, @NL80211_ATTR_WIPHY={0x8, 0x1, 0x1}, @NL80211_ATTR_WDEV={0xc, 0x99, {0x3f, 0x3}}]}, 0x34}, 0x1, 0x0, 0x0, 0x800}, 0x40000) r4 = socket$nl_generic(0x10, 0x3, 0x10) bind$netlink(r4, &(0x7f0000000000)={0x10, 0x0, 0x25dfdbff, 0x1004280}, 0xffffffffffffffb3) sendmsg$nl_generic(r4, &(0x7f0000000080)={&(0x7f0000000480)={0x5, 0xbb7f}, 0xc, &(0x7f0000000440)={&(0x7f00000004c0)={0x1c, 0x22, 0x1, 0x0, 0x0, {0x4}, [@typed={0x8, 0xc}]}, 0x1c}}, 0x0) socket$netlink(0x10, 0x3, 0x0) r5 = socket$alg(0x26, 0x5, 0x0) bind$alg(r5, &(0x7f0000000080)={0x26, 'hash\x00', 0x0, 0x0, 'sha512\x00'}, 0x58) [ 435.221393][T18461] netlink: 'syz-executor.1': attribute type 274 has an invalid length. [ 435.239755][T18461] netlink: 'syz-executor.1': attribute type 274 has an invalid length. 15:25:17 executing program 4: r0 = socket$inet6(0xa, 0x80003, 0x6b) ioctl(r0, 0x1000008912, &(0x7f00000001c0)="080db5055e0bcfe8476071") r1 = socket(0x10, 0x2, 0x0) sendto(r1, &(0x7f0000000200)="120000001200e7ef007b1a3fcd00000000a1", 0x12, 0x0, 0x0, 0x18) recvmmsg(r1, &(0x7f00000037c0)=[{{&(0x7f0000000600)=@ethernet={0x0, @random}, 0x80, &(0x7f0000000380)=[{0x0}, {&(0x7f00000000c0)=""/85, 0x55}, {&(0x7f00000024c0)=""/4096, 0x1000}, {&(0x7f0000000400)=""/120, 0x78}, {&(0x7f0000000480)=""/60, 0x3c}, {&(0x7f0000000280)=""/77, 0x4d}, {&(0x7f0000000540)=""/154, 0x9a}, {&(0x7f0000000340)=""/22, 0x16}], 0x8, &(0x7f0000002400)=""/191, 0xbf}}], 0x1, 0x6, &(0x7f0000003700)={0x77359400}) [ 435.406365][T18478] device syz_tun left promiscuous mode [ 435.433679][T18478] bridge232: port 1(syz_tun) entered disabled state [ 435.567983][T18478] bridge233: port 1(syz_tun) entered blocking state [ 435.574937][T18478] bridge233: port 1(syz_tun) entered disabled state [ 435.583404][T18478] device syz_tun entered promiscuous mode [ 435.597268][T18475] device syz_tun left promiscuous mode [ 435.605023][T18475] bridge5: port 1(syz_tun) entered disabled state 15:25:17 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000004c0)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r3, @ANYBLOB="0000000000000000280012000c0001007665746800000000180002001400010000000000", @ANYBLOB="00000000008433df6d6f6b577d4eaaf2000007"], 0x4}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000540)=ANY=[@ANYBLOB="7400000024000705000000000000000000010000", @ANYRES32=r3, @ANYBLOB="00000000ffffffff000000000800010073667100486818973f73461919309b68e1693572bb000229c6090032d0ed64f3c3545aaf6e000085a4e4ebb5ef670000000000000000000000000000001a4e624d29a84abf03265700000000000000000000000000000000000000000000000000000000000000ac20000089b53c947244306a0216a3de887763df5b42498b13bb1938de859ee6d7ae7dd2224dc672b69b4358871b170ea0b667832e5224ee3538f885b7abd9bc4a7d"], 0x74}}, 0x0) r4 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r4, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000300)=ANY=[@ANYBLOB="840000002c00010700"/20, @ANYRES32=r3, @ANYBLOB="0008008000000000030000000800010075333200580002001400050000000000000000000000000000000000400006003c0001000000000000001020898dde66057433b6ef3a41d22be225e0001b0000000000000000000000000017256ffc66e43a2484e1a912c5998bcbf0d0000000000000000000000000000000798a3c067277da1a290b9613a33c575c36fad473382c8f5532ef3f0e1d2c450a7decbf3431a69f9b2ecb3291bed174245a962fe0484676958265e2988326a89db3139d91fe4aee6ae7e745ab00001a9f61f20500000000000000b3958bc14fce6e66a36d1ab3194534ba4e973684b27793bff837d3"], 0x84}}, 0x0) r5 = socket(0x10, 0x80002, 0x0) sendmmsg$alg(r5, &(0x7f0000000140), 0x49249249249278c, 0x0) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r6, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000500)=@newlink={0x20, 0x11, 0x40d, 0x0, 0x0, {0x0, 0x0, 0x0, r8}}, 0x20}}, 0x0) r9 = socket(0x10, 0x80002, 0x0) getsockopt$inet_sctp_SCTP_PEER_AUTH_CHUNKS(0xffffffffffffffff, 0x84, 0x1a, &(0x7f0000000940)=ANY=[@ANYRES32=0x0, @ANYBLOB='\x00'/12], &(0x7f0000000980)=0x10) r10 = socket(0xa, 0x6, 0x0) close(r10) r11 = socket$inet6_sctp(0xa, 0x10000000005, 0x84) setsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX(r11, 0x84, 0x6e, &(0x7f0000000180)=[@in6={0xa, 0x0, 0x0, @remote, 0x9}], 0x1c) getsockopt$inet_sctp6_SCTP_GET_ASSOC_ID_LIST(r11, 0x84, 0x1d, &(0x7f000095dff8)={0x1, [0x0]}, &(0x7f000095dffc)=0x8) setsockopt$inet_sctp_SCTP_RTOINFO(r10, 0x84, 0x0, &(0x7f0000000000)={r12, 0x0, 0x0, 0x1000000}, 0x10) setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(0xffffffffffffffff, 0x84, 0x9, &(0x7f0000000680)={r12, @in={{0x2, 0x4e20, @remote}}, 0x10001, 0xfff7, 0x5, 0x1, 0x8, 0x5, 0xba}, 0x9c) ioctl(r9, 0x1000008912, &(0x7f00000001c0)="080db5055e0bcfe8696071") getsockopt$inet_sctp_SCTP_PEER_AUTH_CHUNKS(r9, 0x84, 0x1a, &(0x7f0000000940)=ANY=[@ANYRES32=0x0, @ANYBLOB='\x00'/12], &(0x7f0000000980)=0x10) r13 = socket$nl_generic(0x10, 0x3, 0x10) r14 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080)='nl80211\x00') r15 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL80211_CMD_GET_STATION(r15, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000240)={0x1c, r14, 0xf2b, 0x0, 0x0, {}, [@NL80211_ATTR_AIRTIME_WEIGHT={0x8}]}, 0x1c}}, 0x0) sendmsg$NL80211_CMD_GET_MPATH(r13, &(0x7f00000001c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x2000}, 0x268, &(0x7f0000000080)={&(0x7f0000000200)={0x40, r14, 0x4, 0x70bd2d, 0x25dfdbff}, 0xff6b}, 0x1, 0x0, 0x0, 0x10049050}, 0x260448c0) sendmsg$NL80211_CMD_NEW_KEY(r9, &(0x7f0000000640)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0xb0024000}, 0xc, &(0x7f00000002c0)={&(0x7f0000000440)={0x7c, r14, 0x23, 0x70bd27, 0x25dfdbff, {}, [@NL80211_ATTR_KEY_DATA_WEP40={0x9, 0x7, "a80875ab12"}, @NL80211_ATTR_KEY={0x5c, 0x50, [@NL80211_KEY_DEFAULT_TYPES={0x14, 0x8, [@NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_MULTICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_MULTICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_MULTICAST={0x4}]}, @NL80211_KEY_DEFAULT_TYPES={0x28, 0x8, [@NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_MULTICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_MULTICAST={0x4}]}, @NL80211_KEY_IDX={0x5, 0x2, 0x5}, @NL80211_KEY_DATA_WEP104={0x11, 0x1, "4d84c4e30151cb27f51a4adf63"}]}]}, 0x7c}, 0x1, 0x0, 0x0, 0x24000}, 0x40) [ 435.727789][T18475] bridge6: port 1(syz_tun) entered blocking state [ 435.734327][T18475] bridge6: port 1(syz_tun) entered disabled state [ 435.755404][T18475] device syz_tun entered promiscuous mode [ 435.783867][T18485] device syz_tun left promiscuous mode [ 435.790718][T18485] bridge242: port 1(syz_tun) entered disabled state 15:25:18 executing program 3: r0 = socket(0x21, 0xa, 0x1) r1 = socket(0x10, 0x80002, 0x0) ioctl(r1, 0x1000008912, &(0x7f00000001c0)="080db5055e0bcfe8696071") getsockopt$inet_sctp_SCTP_PEER_AUTH_CHUNKS(r1, 0x84, 0x1a, &(0x7f0000000940)=ANY=[@ANYRES32=0x0, @ANYBLOB='\x00'/12], &(0x7f0000000980)=0x10) getsockopt$inet_sctp_SCTP_GET_PEER_ADDR_INFO(r0, 0x84, 0xf, &(0x7f00000009c0)={r2, @in6={{0xa, 0x4e21, 0x8, @local, 0x401}}, 0x9, 0x1, 0x7, 0x7f, 0x6}, &(0x7f0000000a80)=0x98) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000400)='nl80211\x00') sendmsg$NL80211_CMD_GET_MESH_CONFIG(r0, &(0x7f0000000580)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x103190}, 0xc, &(0x7f0000000540)={&(0x7f0000000500)={0x34, r3, 0x10, 0x70bd2d, 0x25dfdbfe, {}, [@NL80211_ATTR_WDEV={0xc, 0x99, {0x1, 0xffffffffffffffff}}, @NL80211_ATTR_WIPHY={0x8, 0x1, 0x1}, @NL80211_ATTR_WDEV={0xc, 0x99, {0x3f, 0x3}}]}, 0x34}, 0x1, 0x0, 0x0, 0x800}, 0x40000) r4 = socket$nl_generic(0x10, 0x3, 0x10) bind$netlink(r4, &(0x7f0000000000)={0x10, 0x0, 0x25dfdbff, 0x1004280}, 0xffffffffffffffb3) sendmsg$nl_generic(r4, &(0x7f0000000080)={&(0x7f0000000480)={0x6, 0xbb7f}, 0xc, &(0x7f0000000440)={&(0x7f00000004c0)={0x1c, 0x22, 0x1, 0x0, 0x0, {0x4}, [@typed={0x8, 0xc}]}, 0x1c}}, 0x0) socket$netlink(0x10, 0x3, 0x0) r5 = socket$alg(0x26, 0x5, 0x0) bind$alg(r5, &(0x7f0000000080)={0x26, 'hash\x00', 0x0, 0x0, 'sha512\x00'}, 0x58) [ 435.907899][T18485] bridge243: port 1(syz_tun) entered blocking state [ 435.914918][T18485] bridge243: port 1(syz_tun) entered disabled state [ 435.923332][T18485] device syz_tun entered promiscuous mode [ 435.934575][T18486] device erspan0 left promiscuous mode [ 435.943743][T18486] bridge232: port 2(erspan0) entered disabled state [ 436.057875][T18486] bridge233: port 2(erspan0) entered blocking state [ 436.064734][T18486] bridge233: port 2(erspan0) entered disabled state [ 436.073398][T18486] device erspan0 entered promiscuous mode [ 436.082454][T18489] device erspan0 left promiscuous mode [ 436.090909][T18489] bridge5: port 2(erspan0) entered disabled state [ 436.217965][T18489] bridge6: port 2(erspan0) entered blocking state [ 436.224637][T18489] bridge6: port 2(erspan0) entered disabled state [ 436.237792][T18489] device erspan0 entered promiscuous mode [ 436.245715][T18491] device erspan0 left promiscuous mode [ 436.251486][T18491] bridge242: port 2(erspan0) entered disabled state 15:25:18 executing program 0: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000080)=0x14) ioctl$sock_SIOCGSKNS(r1, 0x894c, &(0x7f00000000c0)=0x7) sendmsg$nl_route(r1, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000280)=@newlink={0x34, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r3}, [@IFLA_LINKINFO={0x14, 0x12, @bridge={{0xc, 0x1, 'bridge\x00'}, {0x4}}}]}, 0x34}}, 0x0) r4 = socket$packet(0x11, 0x3, 0x300) r5 = socket(0x100000000011, 0x2, 0x0) bind(r5, &(0x7f0000000140)=@generic={0x11, "0000010000000000080044944eeba7502f6c59e7f202738f6e3d2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027eccaf3f6db1c000100000000000000497400000000000000069e735ecc326d3a09ffc2c65400"}, 0x80) getsockname$packet(r5, &(0x7f0000000240)={0x11, 0x0, 0x0}, &(0x7f00000002c0)=0xfeeb) sendmmsg(r4, &(0x7f0000002e00)=[{{&(0x7f0000000000)=@ll={0x11, 0x0, r6, 0x1, 0x0, 0x6, @random="a46c24750bc4"}, 0x80, &(0x7f0000001180)=[{&(0x7f0000000080)="86695a361aedc8b7c4b983cbf545", 0xe}], 0x1}}, {{&(0x7f0000001440)=@hci={0x1f, 0x0, 0x3}, 0x80, 0x0, 0x0, &(0x7f0000001a40)=[{0x10, 0x1}], 0x10}}], 0x2, 0x0) sendmsg$nl_route(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000200)=@bridge_delneigh={0x0, 0x1d, 0x1, 0x70bd2a, 0x25dfdbfe, {0x0, 0x0, 0x0, r6, 0x2, 0x40, 0x2}, [@NDA_MASTER={0x0, 0x9, 0x80}, @NDA_VNI={0x0, 0x7, 0x7f}, @NDA_VNI={0x0, 0x7, 0x1}, @NDA_MASTER={0x0, 0x9, 0x3a8}, @NDA_VLAN={0x0, 0x5, 0x2}, @NDA_LLADDR={0x0, 0x2, @random="b36e7678438f"}, @NDA_DST_IPV4={0x0, 0x1, @initdev={0xac, 0x1e, 0x1, 0x0}}]}, 0x15d}}, 0x0) [ 436.378946][T18491] bridge243: port 2(erspan0) entered blocking state [ 436.385949][T18491] bridge243: port 2(erspan0) entered disabled state [ 436.394359][T18491] device erspan0 entered promiscuous mode [ 436.414768][T18508] netlink: 'syz-executor.1': attribute type 274 has an invalid length. 15:25:18 executing program 4: r0 = socket$inet6(0xa, 0x80003, 0x6b) ioctl(r0, 0x1000008912, &(0x7f00000001c0)="080db5055e0bcfe8476071") r1 = socket(0x10, 0x2, 0x0) sendto(r1, &(0x7f0000000200)="120000001200e7ef007b1a3fcd00000000a1", 0x12, 0x0, 0x0, 0x18) recvmmsg(r1, &(0x7f00000037c0)=[{{&(0x7f0000000600)=@ethernet={0x0, @random}, 0x80, &(0x7f0000000380)=[{0x0}, {&(0x7f00000000c0)=""/85, 0x55}, {&(0x7f00000024c0)=""/4096, 0x1000}, {&(0x7f0000000400)=""/120, 0x78}, {&(0x7f0000000480)=""/60, 0x3c}, {&(0x7f0000000280)=""/77, 0x4d}, {&(0x7f0000000540)=""/154, 0x9a}, {&(0x7f0000000340)=""/22, 0x16}], 0x8, &(0x7f0000002400)=""/191, 0xbf}}], 0x1, 0x6, &(0x7f0000003700)={0x77359400}) [ 436.431995][T18510] netlink: 'syz-executor.1': attribute type 274 has an invalid length. [ 436.472510][T18485] device erspan0 left promiscuous mode [ 436.481337][T18485] bridge243: port 2(erspan0) entered disabled state 15:25:18 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000004c0)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r3, @ANYRES32=0x0, @ANYBLOB="00000000008433df6d6f6b577d4eaaf2000007"], 0x4}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000540)=ANY=[@ANYBLOB="7400000024000705000000000000000000010000", @ANYRES32=r3, @ANYBLOB="00000000ffffffff000000000800010073667100486818973f73461919309b68e1693572bb000229c6090032d0ed64f3c3545aaf6e000085a4e4ebb5ef670000000000000000000000000000001a4e624d29a84abf03265700000000000000000000000000000000000000000000000000000000000000ac20000089b53c947244306a0216a3de887763df5b42498b13bb1938de859ee6d7ae7dd2224dc672b69b4358871b170ea0b667832e5224ee3538f885b7abd9bc4a7d"], 0x74}}, 0x0) r4 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r4, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000300)=ANY=[@ANYBLOB="840000002c00010700"/20, @ANYRES32=r3, @ANYBLOB="0008008000000000030000000800010075333200580002001400050000000000000000000000000000000000400006003c0001000000000000001020898dde66057433b6ef3a41d22be225e0001b0000000000000000000000000017256ffc66e43a2484e1a912c5998bcbf0d0000000000000000000000000000000798a3c067277da1a290b9613a33c575c36fad473382c8f5532ef3f0e1d2c450a7decbf3431a69f9b2ecb3291bed174245a962fe0484676958265e2988326a89db3139d91fe4aee6ae7e745ab00001a9f61f20500000000000000b3958bc14fce6e66a36d1ab3194534ba4e973684b27793bff837d3"], 0x84}}, 0x0) r5 = socket(0x10, 0x80002, 0x0) sendmmsg$alg(r5, &(0x7f0000000140), 0x49249249249278c, 0x0) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r6, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000500)=@newlink={0x20, 0x11, 0x40d, 0x0, 0x0, {0x0, 0x0, 0x0, r8}}, 0x20}}, 0x0) r9 = socket(0x10, 0x80002, 0x0) getsockopt$inet_sctp_SCTP_PEER_AUTH_CHUNKS(0xffffffffffffffff, 0x84, 0x1a, &(0x7f0000000940)=ANY=[@ANYRES32=0x0, @ANYBLOB='\x00'/12], &(0x7f0000000980)=0x10) r10 = socket(0xa, 0x6, 0x0) close(r10) r11 = socket$inet6_sctp(0xa, 0x10000000005, 0x84) setsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX(r11, 0x84, 0x6e, &(0x7f0000000180)=[@in6={0xa, 0x0, 0x0, @remote, 0x9}], 0x1c) getsockopt$inet_sctp6_SCTP_GET_ASSOC_ID_LIST(r11, 0x84, 0x1d, &(0x7f000095dff8)={0x1, [0x0]}, &(0x7f000095dffc)=0x8) setsockopt$inet_sctp_SCTP_RTOINFO(r10, 0x84, 0x0, &(0x7f0000000000)={r12, 0x0, 0x0, 0x1000000}, 0x10) setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(0xffffffffffffffff, 0x84, 0x9, &(0x7f0000000680)={r12, @in={{0x2, 0x4e20, @remote}}, 0x10001, 0xfff7, 0x5, 0x1, 0x8, 0x5, 0xba}, 0x9c) ioctl(r9, 0x1000008912, &(0x7f00000001c0)="080db5055e0bcfe8696071") getsockopt$inet_sctp_SCTP_PEER_AUTH_CHUNKS(r9, 0x84, 0x1a, &(0x7f0000000940)=ANY=[@ANYRES32=0x0, @ANYBLOB='\x00'/12], &(0x7f0000000980)=0x10) r13 = socket$nl_generic(0x10, 0x3, 0x10) r14 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080)='nl80211\x00') r15 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL80211_CMD_GET_STATION(r15, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000240)={0x1c, r14, 0xf2b, 0x0, 0x0, {}, [@NL80211_ATTR_AIRTIME_WEIGHT={0x8}]}, 0x1c}}, 0x0) sendmsg$NL80211_CMD_GET_MPATH(r13, &(0x7f00000001c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x2000}, 0x268, &(0x7f0000000080)={&(0x7f0000000200)={0x40, r14, 0x4, 0x70bd2d, 0x25dfdbff}, 0xff6b}, 0x1, 0x0, 0x0, 0x10049050}, 0x260448c0) sendmsg$NL80211_CMD_NEW_KEY(r9, &(0x7f0000000640)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0xb0024000}, 0xc, &(0x7f00000002c0)={&(0x7f0000000440)={0x7c, r14, 0x23, 0x70bd27, 0x25dfdbff, {}, [@NL80211_ATTR_KEY_DATA_WEP40={0x9, 0x7, "a80875ab12"}, @NL80211_ATTR_KEY={0x5c, 0x50, [@NL80211_KEY_DEFAULT_TYPES={0x14, 0x8, [@NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_MULTICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_MULTICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_MULTICAST={0x4}]}, @NL80211_KEY_DEFAULT_TYPES={0x28, 0x8, [@NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_MULTICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_MULTICAST={0x4}]}, @NL80211_KEY_IDX={0x5, 0x2, 0x5}, @NL80211_KEY_DATA_WEP104={0x11, 0x1, "4d84c4e30151cb27f51a4adf63"}]}]}, 0x7c}, 0x1, 0x0, 0x0, 0x24000}, 0x40) 15:25:18 executing program 2: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000340)={'erspan0\x00', 0x0}) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000300)={'syz_tun\x00', 0x0}) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r7, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r6, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000380)=@newlink={0x34, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r8}, [@IFLA_LINKINFO={0x14, 0x12, @bridge={{0xb, 0x1, 'bridge\x00'}, {0x4}}}]}, 0x34}}, 0x0) sendmsg$nl_route(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000002700)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r5}, [@IFLA_MASTER={0x8, 0xa, r8}]}, 0x28}}, 0x0) sendmsg$nl_route(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f00000000c0)=ANY=[@ANYBLOB="2800000010000104000040000000000000001ea6", @ANYRES32=r2, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00\b\x00\n\x00', @ANYRES32=r8], 0x28}}, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r10 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r9, 0x8933, &(0x7f0000000300)={'syz_tun\x00', 0x0}) sendmsg$nl_route(r10, &(0x7f0000000000)={0x0, 0x3f00, &(0x7f00000000c0)={&(0x7f0000000040)=@newlink={0x2c, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r11}, [@IFLA_BROADCAST={0xa}]}, 0x332}}, 0x0) 15:25:18 executing program 5: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000340)={'erspan0\x00', 0x0}) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000300)={'syz_tun\x00', 0x0}) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r7, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r6, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000380)=@newlink={0x34, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r8}, [@IFLA_LINKINFO={0x14, 0x12, @bridge={{0xb, 0x1, 'bridge\x00'}, {0x4}}}]}, 0x34}}, 0x0) sendmsg$nl_route(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000002700)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r5}, [@IFLA_MASTER={0x8, 0xa, r8}]}, 0x28}}, 0x0) sendmsg$nl_route(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f00000000c0)=ANY=[@ANYBLOB="2800000010000104000040000000000000001ea6", @ANYRES32=r2, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00\b\x00\n\x00', @ANYRES32=r8], 0x28}}, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r10 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r9, 0x8933, &(0x7f0000000300)={'syz_tun\x00', 0x0}) sendmsg$nl_route(r10, &(0x7f0000000000)={0x0, 0xe00, &(0x7f00000000c0)={&(0x7f0000000040)=@newlink={0x2c, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r11}, [@IFLA_BROADCAST={0xa}]}, 0x332}}, 0x0) [ 436.615369][T18529] __nla_validate_parse: 2 callbacks suppressed [ 436.615381][T18529] netlink: 72 bytes leftover after parsing attributes in process `syz-executor.1'. 15:25:18 executing program 3: r0 = socket(0x21, 0xa, 0x1) r1 = socket(0x10, 0x80002, 0x0) ioctl(r1, 0x1000008912, &(0x7f00000001c0)="080db5055e0bcfe8696071") getsockopt$inet_sctp_SCTP_PEER_AUTH_CHUNKS(r1, 0x84, 0x1a, &(0x7f0000000940)=ANY=[@ANYRES32=0x0, @ANYBLOB='\x00'/12], &(0x7f0000000980)=0x10) getsockopt$inet_sctp_SCTP_GET_PEER_ADDR_INFO(r0, 0x84, 0xf, &(0x7f00000009c0)={r2, @in6={{0xa, 0x4e21, 0x8, @local, 0x401}}, 0x9, 0x1, 0x7, 0x7f, 0x6}, &(0x7f0000000a80)=0x98) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000400)='nl80211\x00') sendmsg$NL80211_CMD_GET_MESH_CONFIG(r0, &(0x7f0000000580)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x103190}, 0xc, &(0x7f0000000540)={&(0x7f0000000500)={0x34, r3, 0x10, 0x70bd2d, 0x25dfdbfe, {}, [@NL80211_ATTR_WDEV={0xc, 0x99, {0x1, 0xffffffffffffffff}}, @NL80211_ATTR_WIPHY={0x8, 0x1, 0x1}, @NL80211_ATTR_WDEV={0xc, 0x99, {0x3f, 0x3}}]}, 0x34}, 0x1, 0x0, 0x0, 0x800}, 0x40000) r4 = socket$nl_generic(0x10, 0x3, 0x10) bind$netlink(r4, &(0x7f0000000000)={0x10, 0x0, 0x25dfdbff, 0x1004280}, 0xffffffffffffffb3) sendmsg$nl_generic(r4, &(0x7f0000000080)={&(0x7f0000000480)={0x7, 0xbb7f}, 0xc, &(0x7f0000000440)={&(0x7f00000004c0)={0x1c, 0x22, 0x1, 0x0, 0x0, {0x4}, [@typed={0x8, 0xc}]}, 0x1c}}, 0x0) socket$netlink(0x10, 0x3, 0x0) r5 = socket$alg(0x26, 0x5, 0x0) bind$alg(r5, &(0x7f0000000080)={0x26, 'hash\x00', 0x0, 0x0, 'sha512\x00'}, 0x58) [ 436.701405][T18526] netlink: 72 bytes leftover after parsing attributes in process `syz-executor.1'. 15:25:18 executing program 4: r0 = socket$inet6(0xa, 0x80003, 0x6b) ioctl(r0, 0x1000008912, &(0x7f00000001c0)="080db5055e0bcfe8476071") r1 = socket(0x10, 0x2, 0x0) sendto(r1, &(0x7f0000000200)="120000001200e7ef007b1a3fcd00000000a1", 0x12, 0x0, 0x0, 0x18) recvmmsg(r1, &(0x7f00000037c0)=[{{&(0x7f0000000600)=@ethernet={0x0, @random}, 0x80, &(0x7f0000000380)=[{&(0x7f0000000040)=""/95, 0x5f}, {&(0x7f00000000c0)=""/85, 0x55}, {&(0x7f00000024c0)=""/4096, 0x1000}, {&(0x7f0000000400)=""/120, 0x78}, {&(0x7f0000000480)=""/60, 0x3c}, {&(0x7f0000000280)=""/77, 0x4d}, {&(0x7f0000000540)=""/154, 0x9a}, {&(0x7f0000000340)=""/22, 0x16}], 0x8}}], 0x1, 0x6, &(0x7f0000003700)={0x77359400}) 15:25:18 executing program 0: pipe(&(0x7f0000000f00)={0xffffffffffffffff}) ioctl$SIOCX25GCAUSEDIAG(r0, 0x89e6, &(0x7f0000000940)) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000001600)={0x0, r0, 0x0, 0x0, 0x0, 0xffffffffffffffff}, 0x30) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000700)={r0, &(0x7f0000000640)="4a0f125b69a590ddb903a268a6c9fd890f88b107b8fd8e2aa31a64ee3da091c6af0897c6365f2cebbd4d7d2e6a9b28ff9f7d6eeaab9974b4ff7df4bf8d37f2eb831b372514010bc730522e3100f5178d207cbd79b656c89519e95963e0ea23527e6c71be50c5f933e380d2d0bad8a825f61dcbfb67baa65cb496b42882eb51cf6140fe0810f2e21e79843c15e8c524b90ba7b2c653898505327b550e1743baa7eb527a23220311e97530e62a53216238", &(0x7f00000002c0)="791c5bb0b87af4a94d7a59c52acd6379b134d99239f7e9136742e1f819667ea60c31ea1993dba7e2f589118789877afb23a171a1565691244e012fc212e3d32bb3", 0x2}, 0x20) r1 = socket(0x10, 0x80002, 0x0) ioctl(r1, 0x1000008912, &(0x7f00000001c0)="080db5055e0bcfe8696071") pipe(&(0x7f0000000f00)={0xffffffffffffffff}) ioctl$SIOCX25GCAUSEDIAG(r2, 0x89e6, &(0x7f0000000940)) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000001600)={0x0, r2, 0x0, 0x0, 0x0, 0xffffffffffffffff}, 0x30) openat$cgroup_ro(r2, &(0x7f0000000400)='cpuacct.usage_all\x00', 0x0, 0x0) sendmsg$NBD_CMD_DISCONNECT(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0xffffffffffffff12, &(0x7f0000000180)={0x0}}, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="3c0000001000010400"/20, @ANYRES32, @ANYBLOB="19000000000000001c0012000c00010062726964676500000c0002000800050001000000"], 0x3c}}, 0x0) r3 = socket(0x10, 0x80002, 0x0) sendmsg$IPSET_CMD_ADD(r1, &(0x7f0000000840)={&(0x7f0000000740)={0x10, 0x0, 0x0, 0x100018}, 0xc, &(0x7f0000000800)={&(0x7f0000000780)={0x44, 0x9, 0x6, 0x20, 0x70bd2a, 0x25dfdbfe, {0x7, 0x0, 0x3}, [@IPSET_ATTR_DATA={0x14, 0x7, 0x0, 0x1, [@IPSET_ATTR_PROTO={0x5, 0x7, 0x17}, @IPSET_ATTR_CADT_FLAGS={0x8, 0x8, 0x1, 0x0, 0x2}]}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz0\x00'}, @IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_PROTOCOL={0x5}]}, 0x44}, 0x1, 0x0, 0x0, 0x4000010}, 0x4008010) sendmmsg$alg(r3, &(0x7f0000000180)=[{0x2, 0x1000000000000, &(0x7f0000000080), 0xe, &(0x7f0000000100)}], 0x492492492492642, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000000c0)=ANY=[@ANYBLOB="a000000010003b0e00"/20, @ANYRES32=0x0, @ANYBLOB="000000000000000080001200080001007674693674000200580005000000000008000200000009000800030000000000080d06000000000008000100", @ANYRES32=0x0, @ANYBLOB="0800020000000800fdff030000000000080004007f000001080005000000000008000400000000000800060000000000080006000000000008000100", @ANYRES32=0x0, @ANYBLOB="0800020000000000"], 0xa0}}, 0x0) r4 = socket(0x10, 0x80002, 0x0) ioctl(r4, 0x1000008912, &(0x7f00000001c0)="080db5055e0bcfe8696071") getsockopt$inet_sctp_SCTP_PEER_AUTH_CHUNKS(r4, 0x84, 0x1a, &(0x7f0000000940)=ANY=[@ANYRES32=0x0, @ANYBLOB='\x00'/12], &(0x7f0000000980)=0x10) r5 = socket$nl_generic(0x10, 0x3, 0x10) r6 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000280)='TIPCv2\x00') ioctl$sock_bt_bnep_BNEPGETCONNLIST(0xffffffffffffffff, 0x800442d2, &(0x7f0000000200)={0x6, &(0x7f0000000580)=[{0x0, 0x0, 0x0, @random}, {0x0, 0x0, 0x0, @broadcast}, {0x0, 0x0, 0x0, @broadcast}, {0x0, 0x0, 0x0, @random}, {}, {0x0, 0x0, 0x0, @broadcast}]}) r7 = socket(0x10, 0x80002, 0x0) ioctl(r7, 0x1000008912, &(0x7f00000001c0)="080db5055e0bcfe8696071") getsockopt$inet_sctp_SCTP_PEER_AUTH_CHUNKS(r7, 0x84, 0x1a, &(0x7f0000000940)=ANY=[@ANYRES32=0x0, @ANYBLOB='\x00'/12], &(0x7f0000000980)=0x10) setsockopt$inet_sctp_SCTP_SOCKOPT_CONNECTX(r7, 0x84, 0x6e, &(0x7f00000003c0)=[@in={0x2, 0x4e22, @remote}, @in={0x2, 0x4e22, @local}], 0x20) sendmsg$TIPC_NL_MON_PEER_GET(r5, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000009c0)=ANY=[@ANYBLOB="8eba3ee858f23d90666b14c26ed4ca5a372fa2433d2f19213f9af21cf8db87624ae186cfe1d26d68fc6f650273b7f3aec0ee0982c23121f256a127f9610a7a8e09e1ca509922170ecd46f1bb11aded496c646b1078780c93094a66293750a8ce0c81a4bfee3cf829c2f154843b4b66a7b32f3d27ef6768d6e6134c3478a0a4e5cbda59e2ec976a7af420282cefd04b81c1261ec140579bb31e1dea07bae4c0485f92748342cf8b52a0b59ec5f8a909a18ead3d1021c7eee48910f14351798fb6607dbf0f64f7d8a26776e36dc55f28ce7d17b2a8926d1f9f98dc", @ANYRES16=r6, @ANYBLOB="d57f00000000000000001300f5000c000900080002000000000027b98f3fecd9d9bd6acc01abab48a71a464a17f1022877f0b9f8e9f30fc78dbac12edb435e3ad72c4875c24a926d3afb0b8b9fcc63bb578279b65aa96289f27d6e526f290a3f5cd1986163fe6f4adfc62ae3058e3ff6816edd5f0a0cb4c1639f46c9c06a129dfbf51436cc97895ed3c0d643a8b01ec3634cb5121bf6a0b485adf682cb0e3439614f9efe03c33a7bcf414f650f329333a0e61784f78ad3a9221c8e6084fea94064d0754263afb1ed66f15e8f75ae1958da1d05964b19c897e7f8d0903d8ad3eb83a59d0710bef934f44a075729fe86f89ab2ea870ade32292cf1effa7997efa1e865984d51dbae"], 0x20}}, 0x0) sendmsg$TIPC_NL_MON_GET(r1, &(0x7f0000000380)={&(0x7f00000004c0)={0x10, 0x0, 0x0, 0x200000}, 0xc, &(0x7f0000000340)={&(0x7f0000000500)={0x64, r6, 0x0, 0x70bd2d, 0x25dfdbfc, {}, [@TIPC_NLA_BEARER={0x50, 0x1, [@TIPC_NLA_BEARER_PROP={0x4c, 0x2, [@TIPC_NLA_PROP_WIN={0x8, 0x3, 0xffffffff}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x1d}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x1c}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0xaf}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0xffffff01}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x447f}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x10}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x6}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x1}]}]}]}, 0xffffffffffffff46}, 0x1, 0x0, 0x0, 0x10}, 0x0) [ 436.814800][T18526] netlink: 'syz-executor.1': attribute type 274 has an invalid length. [ 436.843029][T18537] device syz_tun left promiscuous mode [ 436.854189][T18537] bridge243: port 1(syz_tun) entered disabled state [ 436.967928][T18537] bridge244: port 1(syz_tun) entered blocking state [ 436.974815][T18537] bridge244: port 1(syz_tun) entered disabled state [ 436.983599][T18537] device syz_tun entered promiscuous mode [ 436.993652][T18536] device syz_tun left promiscuous mode [ 437.002266][T18536] bridge233: port 1(syz_tun) entered disabled state [ 437.127800][T18536] bridge234: port 1(syz_tun) entered blocking state [ 437.134965][T18536] bridge234: port 1(syz_tun) entered disabled state [ 437.143389][T18536] device syz_tun entered promiscuous mode [ 437.152767][T18526] netlink: 'syz-executor.1': attribute type 274 has an invalid length. [ 437.162319][T18542] device erspan0 left promiscuous mode [ 437.168661][T18542] bridge233: port 2(erspan0) entered disabled state [ 437.298861][T18542] bridge234: port 2(erspan0) entered blocking state [ 437.305628][T18542] bridge234: port 2(erspan0) entered disabled state [ 437.319837][T18542] device erspan0 entered promiscuous mode [ 437.327476][T18543] bridge244: port 2(erspan0) entered blocking state [ 437.335692][T18543] bridge244: port 2(erspan0) entered disabled state [ 437.345279][T18543] device erspan0 entered promiscuous mode 15:25:19 executing program 4: r0 = socket$inet6(0xa, 0x80003, 0x6b) ioctl(r0, 0x1000008912, &(0x7f00000001c0)="080db5055e0bcfe8476071") r1 = socket(0x10, 0x2, 0x0) sendto(r1, &(0x7f0000000200)="120000001200e7ef007b1a3fcd00000000a1", 0x12, 0x0, 0x0, 0x18) recvmmsg(r1, &(0x7f00000037c0)=[{{&(0x7f0000000600)=@ethernet={0x0, @random}, 0x80, &(0x7f0000000380)=[{&(0x7f0000000040)=""/95, 0x5f}, {&(0x7f00000000c0)=""/85, 0x55}, {&(0x7f00000024c0)=""/4096, 0x1000}, {&(0x7f0000000400)=""/120, 0x78}, {&(0x7f0000000480)=""/60, 0x3c}, {&(0x7f0000000280)=""/77, 0x4d}, {&(0x7f0000000540)=""/154, 0x9a}, {&(0x7f0000000340)=""/22, 0x16}], 0x8}}], 0x1, 0x6, &(0x7f0000003700)={0x77359400}) 15:25:19 executing program 3: r0 = socket(0x21, 0xa, 0x1) r1 = socket(0x10, 0x80002, 0x0) ioctl(r1, 0x1000008912, &(0x7f00000001c0)="080db5055e0bcfe8696071") getsockopt$inet_sctp_SCTP_PEER_AUTH_CHUNKS(r1, 0x84, 0x1a, &(0x7f0000000940)=ANY=[@ANYRES32=0x0, @ANYBLOB='\x00'/12], &(0x7f0000000980)=0x10) getsockopt$inet_sctp_SCTP_GET_PEER_ADDR_INFO(r0, 0x84, 0xf, &(0x7f00000009c0)={r2, @in6={{0xa, 0x4e21, 0x8, @local, 0x401}}, 0x9, 0x1, 0x7, 0x7f, 0x6}, &(0x7f0000000a80)=0x98) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000400)='nl80211\x00') sendmsg$NL80211_CMD_GET_MESH_CONFIG(r0, &(0x7f0000000580)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x103190}, 0xc, &(0x7f0000000540)={&(0x7f0000000500)={0x34, r3, 0x10, 0x70bd2d, 0x25dfdbfe, {}, [@NL80211_ATTR_WDEV={0xc, 0x99, {0x1, 0xffffffffffffffff}}, @NL80211_ATTR_WIPHY={0x8, 0x1, 0x1}, @NL80211_ATTR_WDEV={0xc, 0x99, {0x3f, 0x3}}]}, 0x34}, 0x1, 0x0, 0x0, 0x800}, 0x40000) r4 = socket$nl_generic(0x10, 0x3, 0x10) bind$netlink(r4, &(0x7f0000000000)={0x10, 0x0, 0x25dfdbff, 0x1004280}, 0xffffffffffffffb3) sendmsg$nl_generic(r4, &(0x7f0000000080)={&(0x7f0000000480)={0x8, 0xbb7f}, 0xc, &(0x7f0000000440)={&(0x7f00000004c0)={0x1c, 0x22, 0x1, 0x0, 0x0, {0x4}, [@typed={0x8, 0xc}]}, 0x1c}}, 0x0) socket$netlink(0x10, 0x3, 0x0) r5 = socket$alg(0x26, 0x5, 0x0) bind$alg(r5, &(0x7f0000000080)={0x26, 'hash\x00', 0x0, 0x0, 'sha512\x00'}, 0x58) 15:25:19 executing program 5: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000340)={'erspan0\x00', 0x0}) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000300)={'syz_tun\x00', 0x0}) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r7, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r6, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000380)=@newlink={0x34, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r8}, [@IFLA_LINKINFO={0x14, 0x12, @bridge={{0xb, 0x1, 'bridge\x00'}, {0x4}}}]}, 0x34}}, 0x0) sendmsg$nl_route(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000002700)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r5}, [@IFLA_MASTER={0x8, 0xa, r8}]}, 0x28}}, 0x0) sendmsg$nl_route(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f00000000c0)=ANY=[@ANYBLOB="2800000010000104000040000000000000001ea6", @ANYRES32=r2, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00\b\x00\n\x00', @ANYRES32=r8], 0x28}}, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r10 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r9, 0x8933, &(0x7f0000000300)={'syz_tun\x00', 0x0}) sendmsg$nl_route(r10, &(0x7f0000000000)={0x0, 0x4000, &(0x7f00000000c0)={&(0x7f0000000040)=@newlink={0x2c, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r11}, [@IFLA_BROADCAST={0xa}]}, 0x332}}, 0x0) 15:25:19 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000004c0)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r3, @ANYRES32=0x0, @ANYBLOB="00000000008433df6d6f6b577d4eaaf2000007"], 0x4}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000540)=ANY=[@ANYBLOB="7400000024000705000000000000000000010000", @ANYRES32=r3, @ANYBLOB="00000000ffffffff000000000800010073667100486818973f73461919309b68e1693572bb000229c6090032d0ed64f3c3545aaf6e000085a4e4ebb5ef670000000000000000000000000000001a4e624d29a84abf03265700000000000000000000000000000000000000000000000000000000000000ac20000089b53c947244306a0216a3de887763df5b42498b13bb1938de859ee6d7ae7dd2224dc672b69b4358871b170ea0b667832e5224ee3538f885b7abd9bc4a7d"], 0x74}}, 0x0) r4 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r4, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000300)=ANY=[@ANYBLOB="840000002c00010700"/20, @ANYRES32=r3, @ANYBLOB="0008008000000000030000000800010075333200580002001400050000000000000000000000000000000000400006003c0001000000000000001020898dde66057433b6ef3a41d22be225e0001b0000000000000000000000000017256ffc66e43a2484e1a912c5998bcbf0d0000000000000000000000000000000798a3c067277da1a290b9613a33c575c36fad473382c8f5532ef3f0e1d2c450a7decbf3431a69f9b2ecb3291bed174245a962fe0484676958265e2988326a89db3139d91fe4aee6ae7e745ab00001a9f61f20500000000000000b3958bc14fce6e66a36d1ab3194534ba4e973684b27793bff837d3"], 0x84}}, 0x0) r5 = socket(0x10, 0x80002, 0x0) sendmmsg$alg(r5, &(0x7f0000000140), 0x49249249249278c, 0x0) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r6, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000500)=@newlink={0x20, 0x11, 0x40d, 0x0, 0x0, {0x0, 0x0, 0x0, r8}}, 0x20}}, 0x0) r9 = socket(0x10, 0x80002, 0x0) getsockopt$inet_sctp_SCTP_PEER_AUTH_CHUNKS(0xffffffffffffffff, 0x84, 0x1a, &(0x7f0000000940)=ANY=[@ANYRES32=0x0, @ANYBLOB='\x00'/12], &(0x7f0000000980)=0x10) r10 = socket(0xa, 0x6, 0x0) close(r10) r11 = socket$inet6_sctp(0xa, 0x10000000005, 0x84) setsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX(r11, 0x84, 0x6e, &(0x7f0000000180)=[@in6={0xa, 0x0, 0x0, @remote, 0x9}], 0x1c) getsockopt$inet_sctp6_SCTP_GET_ASSOC_ID_LIST(r11, 0x84, 0x1d, &(0x7f000095dff8)={0x1, [0x0]}, &(0x7f000095dffc)=0x8) setsockopt$inet_sctp_SCTP_RTOINFO(r10, 0x84, 0x0, &(0x7f0000000000)={r12, 0x0, 0x0, 0x1000000}, 0x10) setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(0xffffffffffffffff, 0x84, 0x9, &(0x7f0000000680)={r12, @in={{0x2, 0x4e20, @remote}}, 0x10001, 0xfff7, 0x5, 0x1, 0x8, 0x5, 0xba}, 0x9c) ioctl(r9, 0x1000008912, &(0x7f00000001c0)="080db5055e0bcfe8696071") getsockopt$inet_sctp_SCTP_PEER_AUTH_CHUNKS(r9, 0x84, 0x1a, &(0x7f0000000940)=ANY=[@ANYRES32=0x0, @ANYBLOB='\x00'/12], &(0x7f0000000980)=0x10) r13 = socket$nl_generic(0x10, 0x3, 0x10) r14 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080)='nl80211\x00') r15 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL80211_CMD_GET_STATION(r15, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000240)={0x1c, r14, 0xf2b, 0x0, 0x0, {}, [@NL80211_ATTR_AIRTIME_WEIGHT={0x8}]}, 0x1c}}, 0x0) sendmsg$NL80211_CMD_GET_MPATH(r13, &(0x7f00000001c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x2000}, 0x268, &(0x7f0000000080)={&(0x7f0000000200)={0x40, r14, 0x4, 0x70bd2d, 0x25dfdbff}, 0xff6b}, 0x1, 0x0, 0x0, 0x10049050}, 0x260448c0) sendmsg$NL80211_CMD_NEW_KEY(r9, &(0x7f0000000640)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0xb0024000}, 0xc, &(0x7f00000002c0)={&(0x7f0000000440)={0x7c, r14, 0x23, 0x70bd27, 0x25dfdbff, {}, [@NL80211_ATTR_KEY_DATA_WEP40={0x9, 0x7, "a80875ab12"}, @NL80211_ATTR_KEY={0x5c, 0x50, [@NL80211_KEY_DEFAULT_TYPES={0x14, 0x8, [@NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_MULTICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_MULTICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_MULTICAST={0x4}]}, @NL80211_KEY_DEFAULT_TYPES={0x28, 0x8, [@NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_MULTICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_MULTICAST={0x4}]}, @NL80211_KEY_IDX={0x5, 0x2, 0x5}, @NL80211_KEY_DATA_WEP104={0x11, 0x1, "4d84c4e30151cb27f51a4adf63"}]}]}, 0x7c}, 0x1, 0x0, 0x0, 0x24000}, 0x40) 15:25:19 executing program 0: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000340)={'erspan0\x00', 0x0}) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000300)={'syz_tun\x00', 0x0}) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r7, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r6, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000380)=@newlink={0x34, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r8}, [@IFLA_LINKINFO={0x14, 0x12, @bridge={{0xb, 0x1, 'bridge\x00'}, {0x4}}}]}, 0x34}}, 0x0) sendmsg$nl_route(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000002700)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r5}, [@IFLA_MASTER={0x8, 0xa, r8}]}, 0x28}}, 0x0) sendmsg$nl_route(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f00000000c0)=ANY=[@ANYBLOB="2800000010000104000040000000000000001ea6", @ANYRES32=r2, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00\b\x00\n\x00', @ANYRES32=r8], 0x28}}, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r10 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r9, 0x8933, &(0x7f0000000300)={'syz_tun\x00', 0x0}) sendmsg$nl_route(r10, &(0x7f0000000000)={0x0, 0xe00, &(0x7f00000000c0)={&(0x7f0000000040)=@newlink={0x2c, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r11}, [@IFLA_BROADCAST={0xa}]}, 0x332}}, 0x0) 15:25:19 executing program 2: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000340)={'erspan0\x00', 0x0}) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000300)={'syz_tun\x00', 0x0}) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r7, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r6, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000380)=@newlink={0x34, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r8}, [@IFLA_LINKINFO={0x14, 0x12, @bridge={{0xb, 0x1, 'bridge\x00'}, {0x4}}}]}, 0x34}}, 0x0) sendmsg$nl_route(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000002700)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r5}, [@IFLA_MASTER={0x8, 0xa, r8}]}, 0x28}}, 0x0) sendmsg$nl_route(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f00000000c0)=ANY=[@ANYBLOB="2800000010000104000040000000000000001ea6", @ANYRES32=r2, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00\b\x00\n\x00', @ANYRES32=r8], 0x28}}, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r10 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r9, 0x8933, &(0x7f0000000300)={'syz_tun\x00', 0x0}) sendmsg$nl_route(r10, &(0x7f0000000000)={0x0, 0x4000, &(0x7f00000000c0)={&(0x7f0000000040)=@newlink={0x2c, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r11}, [@IFLA_BROADCAST={0xa}]}, 0x332}}, 0x0) 15:25:19 executing program 3: r0 = socket(0x21, 0xa, 0x1) r1 = socket(0x10, 0x80002, 0x0) ioctl(r1, 0x1000008912, &(0x7f00000001c0)="080db5055e0bcfe8696071") getsockopt$inet_sctp_SCTP_PEER_AUTH_CHUNKS(r1, 0x84, 0x1a, &(0x7f0000000940)=ANY=[@ANYRES32=0x0, @ANYBLOB='\x00'/12], &(0x7f0000000980)=0x10) getsockopt$inet_sctp_SCTP_GET_PEER_ADDR_INFO(r0, 0x84, 0xf, &(0x7f00000009c0)={r2, @in6={{0xa, 0x4e21, 0x8, @local, 0x401}}, 0x9, 0x1, 0x7, 0x7f, 0x6}, &(0x7f0000000a80)=0x98) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000400)='nl80211\x00') sendmsg$NL80211_CMD_GET_MESH_CONFIG(r0, &(0x7f0000000580)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x103190}, 0xc, &(0x7f0000000540)={&(0x7f0000000500)={0x34, r3, 0x10, 0x70bd2d, 0x25dfdbfe, {}, [@NL80211_ATTR_WDEV={0xc, 0x99, {0x1, 0xffffffffffffffff}}, @NL80211_ATTR_WIPHY={0x8, 0x1, 0x1}, @NL80211_ATTR_WDEV={0xc, 0x99, {0x3f, 0x3}}]}, 0x34}, 0x1, 0x0, 0x0, 0x800}, 0x40000) r4 = socket$nl_generic(0x10, 0x3, 0x10) bind$netlink(r4, &(0x7f0000000000)={0x10, 0x0, 0x25dfdbff, 0x1004280}, 0xffffffffffffffb3) sendmsg$nl_generic(r4, &(0x7f0000000080)={&(0x7f0000000480)={0x9, 0xbb7f}, 0xc, &(0x7f0000000440)={&(0x7f00000004c0)={0x1c, 0x22, 0x1, 0x0, 0x0, {0x4}, [@typed={0x8, 0xc}]}, 0x1c}}, 0x0) socket$netlink(0x10, 0x3, 0x0) r5 = socket$alg(0x26, 0x5, 0x0) bind$alg(r5, &(0x7f0000000080)={0x26, 'hash\x00', 0x0, 0x0, 'sha512\x00'}, 0x58) 15:25:19 executing program 4: r0 = socket$inet6(0xa, 0x80003, 0x6b) ioctl(r0, 0x1000008912, &(0x7f00000001c0)="080db5055e0bcfe8476071") r1 = socket(0x10, 0x2, 0x0) sendto(r1, &(0x7f0000000200)="120000001200e7ef007b1a3fcd00000000a1", 0x12, 0x0, 0x0, 0x18) recvmmsg(r1, &(0x7f00000037c0)=[{{&(0x7f0000000600)=@ethernet={0x0, @random}, 0x80, &(0x7f0000000380)=[{&(0x7f0000000040)=""/95, 0x5f}, {&(0x7f00000000c0)=""/85, 0x55}, {&(0x7f00000024c0)=""/4096, 0x1000}, {&(0x7f0000000400)=""/120, 0x78}, {&(0x7f0000000480)=""/60, 0x3c}, {&(0x7f0000000280)=""/77, 0x4d}, {&(0x7f0000000540)=""/154, 0x9a}, {&(0x7f0000000340)=""/22, 0x16}], 0x8}}], 0x1, 0x6, &(0x7f0000003700)={0x77359400}) [ 437.684580][T18576] device syz_tun left promiscuous mode [ 437.690934][T18576] bridge234: port 1(syz_tun) entered disabled state [ 437.838011][T18576] bridge235: port 1(syz_tun) entered blocking state [ 437.854302][T18576] bridge235: port 1(syz_tun) entered disabled state [ 437.863649][T18576] device syz_tun entered promiscuous mode [ 437.881088][T18580] netlink: 72 bytes leftover after parsing attributes in process `syz-executor.1'. [ 437.896829][T18581] device syz_tun left promiscuous mode [ 437.902992][T18581] bridge244: port 1(syz_tun) entered disabled state [ 438.029471][T18581] bridge245: port 1(syz_tun) entered blocking state [ 438.036281][T18581] bridge245: port 1(syz_tun) entered disabled state [ 438.044491][T18581] device syz_tun entered promiscuous mode [ 438.052345][T18583] netlink: 72 bytes leftover after parsing attributes in process `syz-executor.1'. [ 438.061918][T18585] device syz_tun left promiscuous mode [ 438.067553][T18585] bridge6: port 1(syz_tun) entered disabled state [ 438.187852][T18585] bridge9: port 1(syz_tun) entered blocking state [ 438.194624][T18585] bridge9: port 1(syz_tun) entered disabled state [ 438.203191][T18585] device syz_tun entered promiscuous mode [ 438.211282][T18587] device erspan0 left promiscuous mode [ 438.216965][T18587] bridge234: port 2(erspan0) entered disabled state [ 438.350148][T18587] bridge235: port 2(erspan0) entered blocking state [ 438.359089][T18587] bridge235: port 2(erspan0) entered disabled state [ 438.367389][T18587] device erspan0 entered promiscuous mode [ 438.375832][T18590] device erspan0 left promiscuous mode [ 438.382802][T18590] bridge244: port 2(erspan0) entered disabled state [ 438.508797][T18590] bridge245: port 2(erspan0) entered blocking state [ 438.515605][T18590] bridge245: port 2(erspan0) entered disabled state [ 438.524353][T18590] device erspan0 entered promiscuous mode [ 438.533216][T18592] device erspan0 left promiscuous mode [ 438.540380][T18592] bridge6: port 2(erspan0) entered disabled state [ 438.678026][T18592] bridge9: port 2(erspan0) entered blocking state [ 438.684566][T18592] bridge9: port 2(erspan0) entered disabled state [ 438.696952][T18592] device erspan0 entered promiscuous mode 15:25:20 executing program 4: r0 = socket$inet6(0xa, 0x80003, 0x6b) ioctl(r0, 0x1000008912, &(0x7f00000001c0)="080db5055e0bcfe8476071") r1 = socket(0x10, 0x2, 0x0) sendto(r1, &(0x7f0000000200)="120000001200e7ef007b1a3fcd00000000a1", 0x12, 0x0, 0x0, 0x18) recvmmsg(r1, &(0x7f00000037c0)=[{{&(0x7f0000000600)=@ethernet={0x0, @random}, 0x80, &(0x7f0000000380)=[{&(0x7f0000000040)=""/95, 0x2000007d}, {&(0x7f00000000c0)=""/85, 0x1f3}, {&(0x7f00000024c0)=""/4096, 0x1048}, {&(0x7f0000000400)=""/120, 0x1aa}, {&(0x7f0000000480)=""/60, 0xc6}, {&(0x7f0000000280)=""/77, 0x4d}, {&(0x7f0000000540)=""/154, 0x207}, {&(0x7f0000000340)=""/22, 0x1de}], 0x8, &(0x7f0000002400)=""/191, 0xfffffffffffffea2}}], 0x4000000000001de, 0x0, &(0x7f0000003700)={0x77359400}) 15:25:20 executing program 0: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000340)={'erspan0\x00', 0x0}) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000300)={'syz_tun\x00', 0x0}) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r7, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r6, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000380)=@newlink={0x34, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r8}, [@IFLA_LINKINFO={0x14, 0x12, @bridge={{0xb, 0x1, 'bridge\x00'}, {0x4}}}]}, 0x34}}, 0x0) sendmsg$nl_route(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000002700)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r5}, [@IFLA_MASTER={0x8, 0xa, r8}]}, 0x28}}, 0x0) sendmsg$nl_route(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f00000000c0)=ANY=[@ANYBLOB="2800000010000104000040000000000000001ea6", @ANYRES32=r2, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00\b\x00\n\x00', @ANYRES32=r8], 0x28}}, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r10 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r9, 0x8933, &(0x7f0000000300)={'syz_tun\x00', 0x0}) sendmsg$nl_route(r10, &(0x7f0000000000)={0x0, 0xe00, &(0x7f00000000c0)={&(0x7f0000000040)=@newlink={0x2c, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r11}, [@IFLA_BROADCAST={0xa}]}, 0x332}}, 0x0) 15:25:20 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000004c0)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r3, @ANYRES32=0x0, @ANYBLOB="00000000008433df6d6f6b577d4eaaf2000007"], 0x4}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000540)=ANY=[@ANYBLOB="7400000024000705000000000000000000010000", @ANYRES32=r3, @ANYBLOB="00000000ffffffff000000000800010073667100486818973f73461919309b68e1693572bb000229c6090032d0ed64f3c3545aaf6e000085a4e4ebb5ef670000000000000000000000000000001a4e624d29a84abf03265700000000000000000000000000000000000000000000000000000000000000ac20000089b53c947244306a0216a3de887763df5b42498b13bb1938de859ee6d7ae7dd2224dc672b69b4358871b170ea0b667832e5224ee3538f885b7abd9bc4a7d"], 0x74}}, 0x0) r4 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r4, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000300)=ANY=[@ANYBLOB="840000002c00010700"/20, @ANYRES32=r3, @ANYBLOB="0008008000000000030000000800010075333200580002001400050000000000000000000000000000000000400006003c0001000000000000001020898dde66057433b6ef3a41d22be225e0001b0000000000000000000000000017256ffc66e43a2484e1a912c5998bcbf0d0000000000000000000000000000000798a3c067277da1a290b9613a33c575c36fad473382c8f5532ef3f0e1d2c450a7decbf3431a69f9b2ecb3291bed174245a962fe0484676958265e2988326a89db3139d91fe4aee6ae7e745ab00001a9f61f20500000000000000b3958bc14fce6e66a36d1ab3194534ba4e973684b27793bff837d3"], 0x84}}, 0x0) r5 = socket(0x10, 0x80002, 0x0) sendmmsg$alg(r5, &(0x7f0000000140), 0x49249249249278c, 0x0) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r6, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000500)=@newlink={0x20, 0x11, 0x40d, 0x0, 0x0, {0x0, 0x0, 0x0, r8}}, 0x20}}, 0x0) r9 = socket(0x10, 0x80002, 0x0) getsockopt$inet_sctp_SCTP_PEER_AUTH_CHUNKS(0xffffffffffffffff, 0x84, 0x1a, &(0x7f0000000940)=ANY=[@ANYRES32=0x0, @ANYBLOB='\x00'/12], &(0x7f0000000980)=0x10) r10 = socket(0xa, 0x6, 0x0) close(r10) r11 = socket$inet6_sctp(0xa, 0x10000000005, 0x84) setsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX(r11, 0x84, 0x6e, &(0x7f0000000180)=[@in6={0xa, 0x0, 0x0, @remote, 0x9}], 0x1c) getsockopt$inet_sctp6_SCTP_GET_ASSOC_ID_LIST(r11, 0x84, 0x1d, &(0x7f000095dff8)={0x1, [0x0]}, &(0x7f000095dffc)=0x8) setsockopt$inet_sctp_SCTP_RTOINFO(r10, 0x84, 0x0, &(0x7f0000000000)={r12, 0x0, 0x0, 0x1000000}, 0x10) setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(0xffffffffffffffff, 0x84, 0x9, &(0x7f0000000680)={r12, @in={{0x2, 0x4e20, @remote}}, 0x10001, 0xfff7, 0x5, 0x1, 0x8, 0x5, 0xba}, 0x9c) ioctl(r9, 0x1000008912, &(0x7f00000001c0)="080db5055e0bcfe8696071") getsockopt$inet_sctp_SCTP_PEER_AUTH_CHUNKS(r9, 0x84, 0x1a, &(0x7f0000000940)=ANY=[@ANYRES32=0x0, @ANYBLOB='\x00'/12], &(0x7f0000000980)=0x10) r13 = socket$nl_generic(0x10, 0x3, 0x10) r14 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080)='nl80211\x00') r15 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL80211_CMD_GET_STATION(r15, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000240)={0x1c, r14, 0xf2b, 0x0, 0x0, {}, [@NL80211_ATTR_AIRTIME_WEIGHT={0x8}]}, 0x1c}}, 0x0) sendmsg$NL80211_CMD_GET_MPATH(r13, &(0x7f00000001c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x2000}, 0x268, &(0x7f0000000080)={&(0x7f0000000200)={0x40, r14, 0x4, 0x70bd2d, 0x25dfdbff}, 0xff6b}, 0x1, 0x0, 0x0, 0x10049050}, 0x260448c0) sendmsg$NL80211_CMD_NEW_KEY(r9, &(0x7f0000000640)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0xb0024000}, 0xc, &(0x7f00000002c0)={&(0x7f0000000440)={0x7c, r14, 0x23, 0x70bd27, 0x25dfdbff, {}, [@NL80211_ATTR_KEY_DATA_WEP40={0x9, 0x7, "a80875ab12"}, @NL80211_ATTR_KEY={0x5c, 0x50, [@NL80211_KEY_DEFAULT_TYPES={0x14, 0x8, [@NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_MULTICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_MULTICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_MULTICAST={0x4}]}, @NL80211_KEY_DEFAULT_TYPES={0x28, 0x8, [@NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_MULTICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_MULTICAST={0x4}]}, @NL80211_KEY_IDX={0x5, 0x2, 0x5}, @NL80211_KEY_DATA_WEP104={0x11, 0x1, "4d84c4e30151cb27f51a4adf63"}]}]}, 0x7c}, 0x1, 0x0, 0x0, 0x24000}, 0x40) [ 438.720576][T18580] netlink: 'syz-executor.1': attribute type 274 has an invalid length. [ 438.730860][T18602] netlink: 'syz-executor.1': attribute type 274 has an invalid length. [ 438.742603][T18581] device syz_tun left promiscuous mode [ 438.757970][T18581] bridge245: port 1(syz_tun) entered disabled state [ 438.879785][T18604] device erspan0 left promiscuous mode [ 438.885475][T18604] bridge245: port 2(erspan0) entered disabled state 15:25:21 executing program 5: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000340)={'erspan0\x00', 0x0}) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000300)={'syz_tun\x00', 0x0}) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r7, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r6, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000380)=@newlink={0x34, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r8}, [@IFLA_LINKINFO={0x14, 0x12, @bridge={{0xb, 0x1, 'bridge\x00'}, {0x4}}}]}, 0x34}}, 0x0) sendmsg$nl_route(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000002700)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r5}, [@IFLA_MASTER={0x8, 0xa, r8}]}, 0x28}}, 0x0) sendmsg$nl_route(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f00000000c0)=ANY=[@ANYBLOB="2800000010000104000040000000000000001ea6", @ANYRES32=r2, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00\b\x00\n\x00', @ANYRES32=r8], 0x28}}, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r10 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r9, 0x8933, &(0x7f0000000300)={'syz_tun\x00', 0x0}) sendmsg$nl_route(r10, &(0x7f0000000000)={0x0, 0x5865, &(0x7f00000000c0)={&(0x7f0000000040)=@newlink={0x2c, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r11}, [@IFLA_BROADCAST={0xa}]}, 0x332}}, 0x0) [ 439.048214][T18617] netlink: 72 bytes leftover after parsing attributes in process `syz-executor.1'. [ 439.070685][T18621] netlink: 72 bytes leftover after parsing attributes in process `syz-executor.1'. 15:25:21 executing program 3: r0 = socket(0x21, 0xa, 0x1) r1 = socket(0x10, 0x80002, 0x0) ioctl(r1, 0x1000008912, &(0x7f00000001c0)="080db5055e0bcfe8696071") getsockopt$inet_sctp_SCTP_PEER_AUTH_CHUNKS(r1, 0x84, 0x1a, &(0x7f0000000940)=ANY=[@ANYRES32=0x0, @ANYBLOB='\x00'/12], &(0x7f0000000980)=0x10) getsockopt$inet_sctp_SCTP_GET_PEER_ADDR_INFO(r0, 0x84, 0xf, &(0x7f00000009c0)={r2, @in6={{0xa, 0x4e21, 0x8, @local, 0x401}}, 0x9, 0x1, 0x7, 0x7f, 0x6}, &(0x7f0000000a80)=0x98) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000400)='nl80211\x00') sendmsg$NL80211_CMD_GET_MESH_CONFIG(r0, &(0x7f0000000580)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x103190}, 0xc, &(0x7f0000000540)={&(0x7f0000000500)={0x34, r3, 0x10, 0x70bd2d, 0x25dfdbfe, {}, [@NL80211_ATTR_WDEV={0xc, 0x99, {0x1, 0xffffffffffffffff}}, @NL80211_ATTR_WIPHY={0x8, 0x1, 0x1}, @NL80211_ATTR_WDEV={0xc, 0x99, {0x3f, 0x3}}]}, 0x34}, 0x1, 0x0, 0x0, 0x800}, 0x40000) r4 = socket$nl_generic(0x10, 0x3, 0x10) bind$netlink(r4, &(0x7f0000000000)={0x10, 0x0, 0x25dfdbff, 0x1004280}, 0xffffffffffffffb3) sendmsg$nl_generic(r4, &(0x7f0000000080)={&(0x7f0000000480)={0xa, 0xbb7f}, 0xc, &(0x7f0000000440)={&(0x7f00000004c0)={0x1c, 0x22, 0x1, 0x0, 0x0, {0x4}, [@typed={0x8, 0xc}]}, 0x1c}}, 0x0) socket$netlink(0x10, 0x3, 0x0) r5 = socket$alg(0x26, 0x5, 0x0) bind$alg(r5, &(0x7f0000000080)={0x26, 'hash\x00', 0x0, 0x0, 'sha512\x00'}, 0x58) 15:25:21 executing program 2: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000340)={'erspan0\x00', 0x0}) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000300)={'syz_tun\x00', 0x0}) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r7, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r6, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000380)=@newlink={0x34, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r8}, [@IFLA_LINKINFO={0x14, 0x12, @bridge={{0xb, 0x1, 'bridge\x00'}, {0x4}}}]}, 0x34}}, 0x0) sendmsg$nl_route(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000002700)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r5}, [@IFLA_MASTER={0x8, 0xa, r8}]}, 0x28}}, 0x0) sendmsg$nl_route(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f00000000c0)=ANY=[@ANYBLOB="2800000010000104000040000000000000001ea6", @ANYRES32=r2, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00\b\x00\n\x00', @ANYRES32=r8], 0x28}}, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r10 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r9, 0x8933, &(0x7f0000000300)={'syz_tun\x00', 0x0}) sendmsg$nl_route(r10, &(0x7f0000000000)={0x0, 0x5865, &(0x7f00000000c0)={&(0x7f0000000040)=@newlink={0x2c, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r11}, [@IFLA_BROADCAST={0xa}]}, 0x332}}, 0x0) [ 439.100363][T18622] device syz_tun left promiscuous mode [ 439.106195][T18622] bridge9: port 1(syz_tun) entered disabled state [ 439.248253][T18622] bridge10: port 1(syz_tun) entered blocking state [ 439.255112][T18622] bridge10: port 1(syz_tun) entered disabled state [ 439.268641][T18622] device syz_tun entered promiscuous mode [ 439.277678][T18625] device erspan0 left promiscuous mode [ 439.283311][T18625] bridge9: port 2(erspan0) entered disabled state [ 439.417910][T18625] bridge10: port 2(erspan0) entered blocking state [ 439.417948][T18625] bridge10: port 2(erspan0) entered disabled state [ 439.419480][T18625] device erspan0 entered promiscuous mode [ 439.446746][T18637] bridge246: port 1(syz_tun) entered blocking state [ 439.455275][T18637] bridge246: port 1(syz_tun) entered disabled state 15:25:21 executing program 3: r0 = socket(0x21, 0xa, 0x1) r1 = socket(0x10, 0x80002, 0x0) ioctl(r1, 0x1000008912, &(0x7f00000001c0)="080db5055e0bcfe8696071") getsockopt$inet_sctp_SCTP_PEER_AUTH_CHUNKS(r1, 0x84, 0x1a, &(0x7f0000000940)=ANY=[@ANYRES32=0x0, @ANYBLOB='\x00'/12], &(0x7f0000000980)=0x10) getsockopt$inet_sctp_SCTP_GET_PEER_ADDR_INFO(r0, 0x84, 0xf, &(0x7f00000009c0)={r2, @in6={{0xa, 0x4e21, 0x8, @local, 0x401}}, 0x9, 0x1, 0x7, 0x7f, 0x6}, &(0x7f0000000a80)=0x98) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000400)='nl80211\x00') sendmsg$NL80211_CMD_GET_MESH_CONFIG(r0, &(0x7f0000000580)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x103190}, 0xc, &(0x7f0000000540)={&(0x7f0000000500)={0x34, r3, 0x10, 0x70bd2d, 0x25dfdbfe, {}, [@NL80211_ATTR_WDEV={0xc, 0x99, {0x1, 0xffffffffffffffff}}, @NL80211_ATTR_WIPHY={0x8, 0x1, 0x1}, @NL80211_ATTR_WDEV={0xc, 0x99, {0x3f, 0x3}}]}, 0x34}, 0x1, 0x0, 0x0, 0x800}, 0x40000) r4 = socket$nl_generic(0x10, 0x3, 0x10) bind$netlink(r4, &(0x7f0000000000)={0x10, 0x0, 0x25dfdbff, 0x1004280}, 0xffffffffffffffb3) sendmsg$nl_generic(r4, &(0x7f0000000080)={&(0x7f0000000480)={0xb, 0xbb7f}, 0xc, &(0x7f0000000440)={&(0x7f00000004c0)={0x1c, 0x22, 0x1, 0x0, 0x0, {0x4}, [@typed={0x8, 0xc}]}, 0x1c}}, 0x0) socket$netlink(0x10, 0x3, 0x0) r5 = socket$alg(0x26, 0x5, 0x0) bind$alg(r5, &(0x7f0000000080)={0x26, 'hash\x00', 0x0, 0x0, 'sha512\x00'}, 0x58) [ 439.466647][T18637] device syz_tun entered promiscuous mode [ 439.487573][T18640] bridge246: port 2(erspan0) entered blocking state 15:25:21 executing program 0: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000340)={'erspan0\x00', 0x0}) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000300)={'syz_tun\x00', 0x0}) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r7, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r6, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000380)=@newlink={0x34, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r8}, [@IFLA_LINKINFO={0x14, 0x12, @bridge={{0xb, 0x1, 'bridge\x00'}, {0x4}}}]}, 0x34}}, 0x0) sendmsg$nl_route(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000002700)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r5}, [@IFLA_MASTER={0x8, 0xa, r8}]}, 0x28}}, 0x0) sendmsg$nl_route(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f00000000c0)=ANY=[@ANYBLOB="2800000010000104000040000000000000001ea6", @ANYRES32=r2, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00\b\x00\n\x00', @ANYRES32=r8], 0x28}}, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r10 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r9, 0x8933, &(0x7f0000000300)={'syz_tun\x00', 0x0}) sendmsg$nl_route(r10, &(0x7f0000000000)={0x0, 0x3f00, &(0x7f00000000c0)={&(0x7f0000000040)=@newlink={0x2c, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r11}, [@IFLA_BROADCAST={0xa}]}, 0x332}}, 0x0) [ 439.525533][T18640] bridge246: port 2(erspan0) entered disabled state [ 439.533896][T18640] device erspan0 entered promiscuous mode [ 439.557423][T18642] device syz_tun left promiscuous mode [ 439.567083][T18642] bridge235: port 1(syz_tun) entered disabled state 15:25:21 executing program 4: r0 = socket$inet6(0xa, 0x80003, 0x6b) ioctl(r0, 0x1000008912, &(0x7f00000001c0)="080db5055e0bcfe8476071") r1 = socket(0x10, 0x2, 0x0) sendto(r1, &(0x7f0000000200)="120000001200e7ef007b1a3fcd00000000a1", 0x12, 0x0, 0x0, 0x18) recvmmsg(r1, &(0x7f00000037c0)=[{{&(0x7f0000000600)=@ethernet={0x0, @random}, 0x80, &(0x7f0000000380)=[{&(0x7f0000000040)=""/95, 0x2000007d}, {&(0x7f00000000c0)=""/85, 0x1f3}, {&(0x7f00000024c0)=""/4096, 0x1048}, {&(0x7f0000000400)=""/120, 0x1aa}, {&(0x7f0000000480)=""/60, 0xc6}, {&(0x7f0000000280)=""/77, 0x4d}, {&(0x7f0000000540)=""/154, 0x207}, {&(0x7f0000000340)=""/22, 0x1de}], 0x8, &(0x7f0000002400)=""/191, 0xfffffffffffffea2}}], 0x4000000000001de, 0x0, &(0x7f0000003700)={0x77359400}) 15:25:21 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000004c0)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r3, @ANYBLOB, @ANYRES32=0x0, @ANYBLOB="00000000008433df6d6f6b577d4eaaf2000007"], 0x5}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000540)=ANY=[@ANYBLOB="7400000024000705000000000000000000010000", @ANYRES32=r3, @ANYBLOB="00000000ffffffff000000000800010073667100486818973f73461919309b68e1693572bb000229c6090032d0ed64f3c3545aaf6e000085a4e4ebb5ef670000000000000000000000000000001a4e624d29a84abf03265700000000000000000000000000000000000000000000000000000000000000ac20000089b53c947244306a0216a3de887763df5b42498b13bb1938de859ee6d7ae7dd2224dc672b69b4358871b170ea0b667832e5224ee3538f885b7abd9bc4a7d"], 0x74}}, 0x0) r4 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r4, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000300)=ANY=[@ANYBLOB="840000002c00010700"/20, @ANYRES32=r3, @ANYBLOB="0008008000000000030000000800010075333200580002001400050000000000000000000000000000000000400006003c0001000000000000001020898dde66057433b6ef3a41d22be225e0001b0000000000000000000000000017256ffc66e43a2484e1a912c5998bcbf0d0000000000000000000000000000000798a3c067277da1a290b9613a33c575c36fad473382c8f5532ef3f0e1d2c450a7decbf3431a69f9b2ecb3291bed174245a962fe0484676958265e2988326a89db3139d91fe4aee6ae7e745ab00001a9f61f20500000000000000b3958bc14fce6e66a36d1ab3194534ba4e973684b27793bff837d3"], 0x84}}, 0x0) r5 = socket(0x10, 0x80002, 0x0) sendmmsg$alg(r5, &(0x7f0000000140), 0x49249249249278c, 0x0) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r6, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000500)=@newlink={0x20, 0x11, 0x40d, 0x0, 0x0, {0x0, 0x0, 0x0, r8}}, 0x20}}, 0x0) r9 = socket(0x10, 0x80002, 0x0) getsockopt$inet_sctp_SCTP_PEER_AUTH_CHUNKS(0xffffffffffffffff, 0x84, 0x1a, &(0x7f0000000940)=ANY=[@ANYRES32=0x0, @ANYBLOB='\x00'/12], &(0x7f0000000980)=0x10) r10 = socket(0xa, 0x6, 0x0) close(r10) r11 = socket$inet6_sctp(0xa, 0x10000000005, 0x84) setsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX(r11, 0x84, 0x6e, &(0x7f0000000180)=[@in6={0xa, 0x0, 0x0, @remote, 0x9}], 0x1c) getsockopt$inet_sctp6_SCTP_GET_ASSOC_ID_LIST(r11, 0x84, 0x1d, &(0x7f000095dff8)={0x1, [0x0]}, &(0x7f000095dffc)=0x8) setsockopt$inet_sctp_SCTP_RTOINFO(r10, 0x84, 0x0, &(0x7f0000000000)={r12, 0x0, 0x0, 0x1000000}, 0x10) setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(0xffffffffffffffff, 0x84, 0x9, &(0x7f0000000680)={r12, @in={{0x2, 0x4e20, @remote}}, 0x10001, 0xfff7, 0x5, 0x1, 0x8, 0x5, 0xba}, 0x9c) ioctl(r9, 0x1000008912, &(0x7f00000001c0)="080db5055e0bcfe8696071") getsockopt$inet_sctp_SCTP_PEER_AUTH_CHUNKS(r9, 0x84, 0x1a, &(0x7f0000000940)=ANY=[@ANYRES32=0x0, @ANYBLOB='\x00'/12], &(0x7f0000000980)=0x10) r13 = socket$nl_generic(0x10, 0x3, 0x10) r14 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080)='nl80211\x00') r15 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL80211_CMD_GET_STATION(r15, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000240)={0x1c, r14, 0xf2b, 0x0, 0x0, {}, [@NL80211_ATTR_AIRTIME_WEIGHT={0x8}]}, 0x1c}}, 0x0) sendmsg$NL80211_CMD_GET_MPATH(r13, &(0x7f00000001c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x2000}, 0x268, &(0x7f0000000080)={&(0x7f0000000200)={0x40, r14, 0x4, 0x70bd2d, 0x25dfdbff}, 0xff6b}, 0x1, 0x0, 0x0, 0x10049050}, 0x260448c0) sendmsg$NL80211_CMD_NEW_KEY(r9, &(0x7f0000000640)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0xb0024000}, 0xc, &(0x7f00000002c0)={&(0x7f0000000440)={0x7c, r14, 0x23, 0x70bd27, 0x25dfdbff, {}, [@NL80211_ATTR_KEY_DATA_WEP40={0x9, 0x7, "a80875ab12"}, @NL80211_ATTR_KEY={0x5c, 0x50, [@NL80211_KEY_DEFAULT_TYPES={0x14, 0x8, [@NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_MULTICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_MULTICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_MULTICAST={0x4}]}, @NL80211_KEY_DEFAULT_TYPES={0x28, 0x8, [@NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_MULTICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_MULTICAST={0x4}]}, @NL80211_KEY_IDX={0x5, 0x2, 0x5}, @NL80211_KEY_DATA_WEP104={0x11, 0x1, "4d84c4e30151cb27f51a4adf63"}]}]}, 0x7c}, 0x1, 0x0, 0x0, 0x24000}, 0x40) [ 439.699196][T18642] bridge236: port 1(syz_tun) entered blocking state [ 439.721005][T18642] bridge236: port 1(syz_tun) entered disabled state [ 439.749554][T18642] device syz_tun entered promiscuous mode [ 439.767716][T18644] device erspan0 left promiscuous mode [ 439.779095][T18644] bridge235: port 2(erspan0) entered disabled state [ 439.879063][ C0] [ 439.881441][ C0] ===================================== [ 439.886972][ C0] WARNING: bad unlock balance detected! [ 439.892508][ C0] 5.5.0-rc5-syzkaller #0 Not tainted [ 439.897764][ C0] ------------------------------------- [ 439.903282][ C0] syz-executor.5/9551 is trying to release lock (&dev->qdisc_xmit_lock_key) at: [ 439.912386][ C0] [] sch_direct_xmit+0x3fa/0xd30 [ 439.918869][ C0] but there are no more locks to release! [ 439.924570][ C0] [ 439.924570][ C0] other info that might help us debug this: [ 439.932698][ C0] 6 locks held by syz-executor.5/9551: [ 439.938124][ C0] #0: ffffc90000007d50 ((&ndev->rs_timer)){+.-.}, at: call_timer_fn+0xe0/0x780 [ 439.947182][ C0] #1: ffffffff899a3f00 (rcu_read_lock){....}, at: ndisc_send_skb+0x7fe/0x1490 [ 439.956159][ C0] #2: ffffffff899a3ec0 (rcu_read_lock_bh){....}, at: ip6_finish_output2+0x214/0x25c0 [ 439.965748][ C0] #3: ffffffff899a3ec0 (rcu_read_lock_bh){....}, at: __dev_queue_xmit+0x20a/0x35c0 [ 439.975180][ C0] #4: ffff8880a8f3d250 (&dev->qdisc_tx_busylock_key#23){+...}, at: __dev_queue_xmit+0x2412/0x35c0 [ 439.985846][ C0] #5: ffff8880a8f3d138 (&dev->qdisc_running_key#23){+...}, at: dev_queue_xmit+0x18/0x20 [ 439.995647][ C0] [ 439.995647][ C0] stack backtrace: [ 440.001546][ C0] CPU: 0 PID: 9551 Comm: syz-executor.5 Not tainted 5.5.0-rc5-syzkaller #0 [ 440.010166][ C0] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 440.020272][ C0] Call Trace: [ 440.023534][ C0] [ 440.026371][ C0] dump_stack+0x197/0x210 [ 440.030681][ C0] ? sch_direct_xmit+0x3fa/0xd30 [ 440.035598][ C0] print_unlock_imbalance_bug.cold+0x114/0x123 [ 440.041729][ C0] ? sch_direct_xmit+0x3fa/0xd30 [ 440.046655][ C0] lock_release+0x5f2/0x960 [ 440.051146][ C0] ? rcu_read_lock_sched_held+0x9c/0xd0 [ 440.056672][ C0] ? lock_downgrade+0x920/0x920 [ 440.061502][ C0] ? dev_hard_start_xmit+0x345/0x9b0 [ 440.066775][ C0] _raw_spin_unlock+0x16/0x40 [ 440.071444][ C0] sch_direct_xmit+0x3fa/0xd30 [ 440.076191][ C0] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 440.082421][ C0] ? dev_watchdog+0xca0/0xca0 [ 440.087074][ C0] ? lock_acquire+0x120/0x410 [ 440.091743][ C0] __dev_queue_xmit+0x2707/0x35c0 [ 440.096812][ C0] ? __kasan_check_read+0x11/0x20 [ 440.101823][ C0] ? netdev_core_pick_tx+0x2f0/0x2f0 [ 440.107092][ C0] ? ip6_finish_output2+0x109a/0x25c0 [ 440.112463][ C0] ? __kasan_check_read+0x11/0x20 [ 440.117480][ C0] ? mark_held_locks+0xa4/0xf0 [ 440.122228][ C0] dev_queue_xmit+0x18/0x20 [ 440.126710][ C0] ? dev_queue_xmit+0x18/0x20 [ 440.131421][ C0] neigh_resolve_output+0x5c4/0x990 [ 440.136613][ C0] ip6_finish_output2+0x109a/0x25c0 [ 440.141801][ C0] ? ip6_mtu+0x2e6/0x450 [ 440.146027][ C0] ? ip6_frag_next+0xb20/0xb20 [ 440.150790][ C0] ? lock_downgrade+0x920/0x920 [ 440.155628][ C0] ? rcu_read_lock_held+0x9c/0xb0 [ 440.160631][ C0] ? __kasan_check_read+0x11/0x20 [ 440.165680][ C0] __ip6_finish_output+0x444/0xaa0 [ 440.170773][ C0] ? __ip6_finish_output+0x444/0xaa0 [ 440.176040][ C0] ip6_finish_output+0x38/0x1f0 [ 440.180870][ C0] ip6_output+0x25e/0x880 [ 440.185177][ C0] ? ip6_finish_output+0x1f0/0x1f0 [ 440.190274][ C0] ? rcu_lockdep_current_cpu_online+0xe3/0x130 [ 440.196405][ C0] ? __ip6_finish_output+0xaa0/0xaa0 [ 440.201671][ C0] ? rcu_read_lock_held_common+0x130/0x130 [ 440.207494][ C0] ndisc_send_skb+0xf1f/0x1490 [ 440.212248][ C0] ? nf_hook.constprop.0+0x560/0x560 [ 440.217508][ C0] ? memcpy+0x46/0x50 [ 440.221471][ C0] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 440.227754][ C0] ndisc_send_rs+0x134/0x720 [ 440.232335][ C0] addrconf_rs_timer+0x30f/0x6e0 [ 440.237269][ C0] ? ipv6_get_lladdr+0x490/0x490 [ 440.242201][ C0] ? rcu_read_lock_any_held.part.0+0x50/0x50 [ 440.248164][ C0] call_timer_fn+0x1ac/0x780 [ 440.252763][ C0] ? ipv6_get_lladdr+0x490/0x490 [ 440.257685][ C0] ? msleep_interruptible+0x150/0x150 [ 440.263041][ C0] ? run_timer_softirq+0x6b1/0x1790 [ 440.268296][ C0] ? trace_hardirqs_on+0x67/0x240 [ 440.273307][ C0] ? ipv6_get_lladdr+0x490/0x490 [ 440.278223][ C0] ? ipv6_get_lladdr+0x490/0x490 [ 440.283248][ C0] run_timer_softirq+0x6c3/0x1790 [ 440.288263][ C0] ? add_timer+0x930/0x930 [ 440.292702][ C0] ? rcu_lockdep_current_cpu_online+0xe3/0x130 [ 440.298846][ C0] ? rcu_read_lock_sched_held+0x9c/0xd0 [ 440.304377][ C0] ? rcu_read_lock_any_held.part.0+0x50/0x50 [ 440.310461][ C0] ? trace_hardirqs_on+0x67/0x240 [ 440.315531][ C0] __do_softirq+0x262/0x98c [ 440.320017][ C0] ? sched_clock_cpu+0x1b/0x1b0 [ 440.324907][ C0] irq_exit+0x19b/0x1e0 [ 440.329047][ C0] smp_apic_timer_interrupt+0x1a3/0x610 [ 440.334584][ C0] apic_timer_interrupt+0xf/0x20 [ 440.339493][ C0] [ 440.342427][ C0] RIP: 0010:_raw_spin_unlock_irqrestore+0x90/0xe0 [ 440.348828][ C0] Code: 48 c7 c0 d8 34 93 89 48 ba 00 00 00 00 00 fc ff df 48 c1 e8 03 80 3c 10 00 75 39 48 83 3d ef ef be 01 00 74 24 48 89 df 57 9d <0f> 1f 44 00 00 bf 01 00 00 00 e8 91 45 7c f9 65 8b 05 82 d9 2d 78 [ 440.368424][ C0] RSP: 0018:ffffc900029e7b78 EFLAGS: 00000282 ORIG_RAX: ffffffffffffff13 [ 440.376825][ C0] RAX: 1ffffffff132669b RBX: 0000000000000282 RCX: 0000000000000000 [ 440.384873][ C0] RDX: dffffc0000000000 RSI: 0000000000000006 RDI: 0000000000000282 [ 440.392834][ C0] RBP: ffffc900029e7b88 R08: ffff888062f76600 R09: 0000000000000000 [ 440.400801][ C0] R10: 0000000000000000 R11: 0000000000000000 R12: ffff8880a9a48120 [ 440.408749][ C0] R13: ffff8880a9a48158 R14: 0000000000000282 R15: ffffc900029e7cf8 [ 440.416780][ C0] add_wait_queue+0x112/0x170 [ 440.421511][ C0] do_wait+0x19f/0xa10 [ 440.425565][ C0] ? mark_lock+0xc2/0x1220 [ 440.429995][ C0] ? wait_consider_task+0x3ae0/0x3ae0 [ 440.435362][ C0] ? __might_fault+0x12b/0x1e0 [ 440.440123][ C0] kernel_wait4+0x171/0x290 [ 440.444604][ C0] ? __ia32_sys_waitid+0x140/0x140 [ 440.449697][ C0] ? task_stopped_code+0x180/0x180 [ 440.454786][ C0] __do_sys_wait4+0x147/0x160 [ 440.459442][ C0] ? kernel_wait4+0x290/0x290 [ 440.464180][ C0] ? _copy_to_user+0x118/0x160 [ 440.468938][ C0] ? __sanitizer_cov_trace_const_cmp8+0x18/0x20 [ 440.475154][ C0] ? put_timespec64+0xda/0x140 [ 440.479909][ C0] ? ns_to_kernel_old_timeval+0x100/0x100 [ 440.485607][ C0] ? trace_hardirqs_on_thunk+0x1a/0x1c [ 440.491046][ C0] ? trace_hardirqs_on_thunk+0x1a/0x1c [ 440.496492][ C0] ? do_syscall_64+0x26/0x790 [ 440.501146][ C0] ? entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 440.507187][ C0] ? do_syscall_64+0x26/0x790 [ 440.511844][ C0] __x64_sys_wait4+0x97/0xf0 [ 440.516426][ C0] do_syscall_64+0xfa/0x790 [ 440.520922][ C0] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 440.526805][ C0] RIP: 0033:0x414d8a [ 440.530679][ C0] Code: 0f 83 6a 18 00 00 c3 66 0f 1f 84 00 00 00 00 00 8b 05 ee 36 66 00 85 c0 75 36 45 31 d2 48 63 d2 48 63 ff b8 3d 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 06 c3 0f 1f 44 00 00 48 c7 c2 d4 ff ff ff f7 [ 440.550281][ C0] RSP: 002b:00007ffd70211468 EFLAGS: 00000246 ORIG_RAX: 000000000000003d [ 440.558671][ C0] RAX: ffffffffffffffda RBX: 000000000006b5c1 RCX: 0000000000414d8a [ 440.566621][ C0] RDX: 0000000040000001 RSI: 00007ffd702114a0 RDI: ffffffffffffffff [ 440.574568][ C0] RBP: 0000000000000512 R08: 0000000000000001 R09: 0000000000e92940 [ 440.582526][ C0] R10: 0000000000000000 R11: 0000000000000246 R12: 000000000000000f [ 440.590476][ C0] R13: 00007ffd702114a0 R14: 000000000006b358 R15: 00007ffd702114b0 [ 440.607914][T18644] bridge236: port 2(erspan0) entered blocking state [ 440.614686][T18644] bridge236: port 2(erspan0) entered disabled state [ 440.622006][T18644] device erspan0 entered promiscuous mode [ 440.632983][T18653] device syz_tun left promiscuous mode [ 440.638654][T18653] bridge10: port 1(syz_tun) entered disabled state [ 440.758369][T18653] bridge11: port 1(syz_tun) entered blocking state [ 440.764988][T18653] bridge11: port 1(syz_tun) entered disabled state [ 440.772179][T18653] device syz_tun entered promiscuous mode [ 440.779032][T18656] device erspan0 left promiscuous mode [ 440.784641][T18656] bridge10: port 2(erspan0) entered disabled state [ 440.938448][T18656] bridge11: port 2(erspan0) entered blocking state [ 440.945085][T18656] bridge11: port 2(erspan0) entered disabled state [ 440.952327][T18656] device erspan0 entered promiscuous mode 15:25:23 executing program 4: r0 = socket$inet6(0xa, 0x80003, 0x6b) ioctl(r0, 0x1000008912, &(0x7f00000001c0)="080db5055e0bcfe8476071") r1 = socket(0x10, 0x2, 0x0) sendto(r1, &(0x7f0000000200)="120000001200e7ef007b1a3fcd00000000a1", 0x12, 0x0, 0x0, 0x18) recvmmsg(r1, &(0x7f00000037c0)=[{{&(0x7f0000000600)=@ethernet={0x0, @random}, 0x80, &(0x7f0000000380)=[{&(0x7f0000000040)=""/95, 0x2000007d}, {&(0x7f00000000c0)=""/85, 0x1f3}, {&(0x7f00000024c0)=""/4096, 0x1048}, {&(0x7f0000000400)=""/120, 0x1aa}, {&(0x7f0000000480)=""/60, 0xc6}, {&(0x7f0000000280)=""/77, 0x4d}, {&(0x7f0000000540)=""/154, 0x207}, {&(0x7f0000000340)=""/22, 0x1de}], 0x8, &(0x7f0000002400)=""/191, 0xfffffffffffffea2}}], 0x4000000000001de, 0x0, &(0x7f0000003700)={0x77359400}) 15:25:23 executing program 2: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000340)={'erspan0\x00', 0x0}) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000300)={'syz_tun\x00', 0x0}) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r7, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r6, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000380)=@newlink={0x34, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r8}, [@IFLA_LINKINFO={0x14, 0x12, @bridge={{0xb, 0x1, 'bridge\x00'}, {0x4}}}]}, 0x34}}, 0x0) sendmsg$nl_route(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000002700)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r5}, [@IFLA_MASTER={0x8, 0xa, r8}]}, 0x28}}, 0x0) sendmsg$nl_route(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f00000000c0)=ANY=[@ANYBLOB="2800000010000104000040000000000000001ea6", @ANYRES32=r2, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00\b\x00\n\x00', @ANYRES32=r8], 0x28}}, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r10 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r9, 0x8933, &(0x7f0000000300)={'syz_tun\x00', 0x0}) sendmsg$nl_route(r10, &(0x7f0000000000)={0x0, 0x6000, &(0x7f00000000c0)={&(0x7f0000000040)=@newlink={0x2c, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r11}, [@IFLA_BROADCAST={0xa}]}, 0x332}}, 0x0) 15:25:23 executing program 0: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000340)={'erspan0\x00', 0x0}) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000300)={'syz_tun\x00', 0x0}) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r7, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r6, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000380)=@newlink={0x34, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r8}, [@IFLA_LINKINFO={0x14, 0x12, @bridge={{0xb, 0x1, 'bridge\x00'}, {0x4}}}]}, 0x34}}, 0x0) sendmsg$nl_route(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000002700)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r5}, [@IFLA_MASTER={0x8, 0xa, r8}]}, 0x28}}, 0x0) sendmsg$nl_route(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f00000000c0)=ANY=[@ANYBLOB="2800000010000104000040000000000000001ea6", @ANYRES32=r2, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00\b\x00\n\x00', @ANYRES32=r8], 0x28}}, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r10 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r9, 0x8933, &(0x7f0000000300)={'syz_tun\x00', 0x0}) sendmsg$nl_route(r10, &(0x7f0000000000)={0x0, 0x3f00, &(0x7f00000000c0)={&(0x7f0000000040)=@newlink={0x2c, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r11}, [@IFLA_BROADCAST={0xa}]}, 0x332}}, 0x0) [ 440.985266][T18662] netlink: 72 bytes leftover after parsing attributes in process `syz-executor.1'. [ 440.996969][T18664] netlink: 72 bytes leftover after parsing attributes in process `syz-executor.1'. [ 441.007339][T18668] validate_nla: 2 callbacks suppressed [ 441.007348][T18668] netlink: 'syz-executor.1': attribute type 274 has an invalid length. 15:25:23 executing program 5: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000340)={'erspan0\x00', 0x0}) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000300)={'syz_tun\x00', 0x0}) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r7, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r6, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000380)=@newlink={0x34, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r8}, [@IFLA_LINKINFO={0x14, 0x12, @bridge={{0xb, 0x1, 'bridge\x00'}, {0x4}}}]}, 0x34}}, 0x0) sendmsg$nl_route(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000002700)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r5}, [@IFLA_MASTER={0x8, 0xa, r8}]}, 0x28}}, 0x0) sendmsg$nl_route(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f00000000c0)=ANY=[@ANYBLOB="2800000010000104000040000000000000001ea6", @ANYRES32=r2, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00\b\x00\n\x00', @ANYRES32=r8], 0x28}}, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r10 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r9, 0x8933, &(0x7f0000000300)={'syz_tun\x00', 0x0}) sendmsg$nl_route(r10, &(0x7f0000000000)={0x0, 0x6000, &(0x7f00000000c0)={&(0x7f0000000040)=@newlink={0x2c, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r11}, [@IFLA_BROADCAST={0xa}]}, 0x332}}, 0x0) 15:25:23 executing program 3: r0 = socket(0x21, 0xa, 0x1) r1 = socket(0x10, 0x80002, 0x0) ioctl(r1, 0x1000008912, &(0x7f00000001c0)="080db5055e0bcfe8696071") getsockopt$inet_sctp_SCTP_PEER_AUTH_CHUNKS(r1, 0x84, 0x1a, &(0x7f0000000940)=ANY=[@ANYRES32=0x0, @ANYBLOB='\x00'/12], &(0x7f0000000980)=0x10) getsockopt$inet_sctp_SCTP_GET_PEER_ADDR_INFO(r0, 0x84, 0xf, &(0x7f00000009c0)={r2, @in6={{0xa, 0x4e21, 0x8, @local, 0x401}}, 0x9, 0x1, 0x7, 0x7f, 0x6}, &(0x7f0000000a80)=0x98) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000400)='nl80211\x00') sendmsg$NL80211_CMD_GET_MESH_CONFIG(r0, &(0x7f0000000580)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x103190}, 0xc, &(0x7f0000000540)={&(0x7f0000000500)={0x34, r3, 0x10, 0x70bd2d, 0x25dfdbfe, {}, [@NL80211_ATTR_WDEV={0xc, 0x99, {0x1, 0xffffffffffffffff}}, @NL80211_ATTR_WIPHY={0x8, 0x1, 0x1}, @NL80211_ATTR_WDEV={0xc, 0x99, {0x3f, 0x3}}]}, 0x34}, 0x1, 0x0, 0x0, 0x800}, 0x40000) r4 = socket$nl_generic(0x10, 0x3, 0x10) bind$netlink(r4, &(0x7f0000000000)={0x10, 0x0, 0x25dfdbff, 0x1004280}, 0xffffffffffffffb3) sendmsg$nl_generic(r4, &(0x7f0000000080)={&(0x7f0000000480)={0xc, 0xbb7f}, 0xc, &(0x7f0000000440)={&(0x7f00000004c0)={0x1c, 0x22, 0x1, 0x0, 0x0, {0x4}, [@typed={0x8, 0xc}]}, 0x1c}}, 0x0) socket$netlink(0x10, 0x3, 0x0) r5 = socket$alg(0x26, 0x5, 0x0) bind$alg(r5, &(0x7f0000000080)={0x26, 'hash\x00', 0x0, 0x0, 'sha512\x00'}, 0x58) [ 441.057885][T18670] netlink: 'syz-executor.1': attribute type 274 has an invalid length. 15:25:23 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000004c0)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r3, @ANYBLOB, @ANYRES32=0x0, @ANYBLOB="00000000008433df6d6f6b577d4eaaf2000007"], 0x5}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000540)=ANY=[@ANYBLOB="7400000024000705000000000000000000010000", @ANYRES32=r3, @ANYBLOB="00000000ffffffff000000000800010073667100486818973f73461919309b68e1693572bb000229c6090032d0ed64f3c3545aaf6e000085a4e4ebb5ef670000000000000000000000000000001a4e624d29a84abf03265700000000000000000000000000000000000000000000000000000000000000ac20000089b53c947244306a0216a3de887763df5b42498b13bb1938de859ee6d7ae7dd2224dc672b69b4358871b170ea0b667832e5224ee3538f885b7abd9bc4a7d"], 0x74}}, 0x0) r4 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r4, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000300)=ANY=[@ANYBLOB="840000002c00010700"/20, @ANYRES32=r3, @ANYBLOB="0008008000000000030000000800010075333200580002001400050000000000000000000000000000000000400006003c0001000000000000001020898dde66057433b6ef3a41d22be225e0001b0000000000000000000000000017256ffc66e43a2484e1a912c5998bcbf0d0000000000000000000000000000000798a3c067277da1a290b9613a33c575c36fad473382c8f5532ef3f0e1d2c450a7decbf3431a69f9b2ecb3291bed174245a962fe0484676958265e2988326a89db3139d91fe4aee6ae7e745ab00001a9f61f20500000000000000b3958bc14fce6e66a36d1ab3194534ba4e973684b27793bff837d3"], 0x84}}, 0x0) r5 = socket(0x10, 0x80002, 0x0) sendmmsg$alg(r5, &(0x7f0000000140), 0x49249249249278c, 0x0) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r6, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000500)=@newlink={0x20, 0x11, 0x40d, 0x0, 0x0, {0x0, 0x0, 0x0, r8}}, 0x20}}, 0x0) r9 = socket(0x10, 0x80002, 0x0) getsockopt$inet_sctp_SCTP_PEER_AUTH_CHUNKS(0xffffffffffffffff, 0x84, 0x1a, &(0x7f0000000940)=ANY=[@ANYRES32=0x0, @ANYBLOB='\x00'/12], &(0x7f0000000980)=0x10) r10 = socket(0xa, 0x6, 0x0) close(r10) r11 = socket$inet6_sctp(0xa, 0x10000000005, 0x84) setsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX(r11, 0x84, 0x6e, &(0x7f0000000180)=[@in6={0xa, 0x0, 0x0, @remote, 0x9}], 0x1c) getsockopt$inet_sctp6_SCTP_GET_ASSOC_ID_LIST(r11, 0x84, 0x1d, &(0x7f000095dff8)={0x1, [0x0]}, &(0x7f000095dffc)=0x8) setsockopt$inet_sctp_SCTP_RTOINFO(r10, 0x84, 0x0, &(0x7f0000000000)={r12, 0x0, 0x0, 0x1000000}, 0x10) setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(0xffffffffffffffff, 0x84, 0x9, &(0x7f0000000680)={r12, @in={{0x2, 0x4e20, @remote}}, 0x10001, 0xfff7, 0x5, 0x1, 0x8, 0x5, 0xba}, 0x9c) ioctl(r9, 0x1000008912, &(0x7f00000001c0)="080db5055e0bcfe8696071") getsockopt$inet_sctp_SCTP_PEER_AUTH_CHUNKS(r9, 0x84, 0x1a, &(0x7f0000000940)=ANY=[@ANYRES32=0x0, @ANYBLOB='\x00'/12], &(0x7f0000000980)=0x10) r13 = socket$nl_generic(0x10, 0x3, 0x10) r14 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080)='nl80211\x00') r15 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL80211_CMD_GET_STATION(r15, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000240)={0x1c, r14, 0xf2b, 0x0, 0x0, {}, [@NL80211_ATTR_AIRTIME_WEIGHT={0x8}]}, 0x1c}}, 0x0) sendmsg$NL80211_CMD_GET_MPATH(r13, &(0x7f00000001c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x2000}, 0x268, &(0x7f0000000080)={&(0x7f0000000200)={0x40, r14, 0x4, 0x70bd2d, 0x25dfdbff}, 0xff6b}, 0x1, 0x0, 0x0, 0x10049050}, 0x260448c0) sendmsg$NL80211_CMD_NEW_KEY(r9, &(0x7f0000000640)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0xb0024000}, 0xc, &(0x7f00000002c0)={&(0x7f0000000440)={0x7c, r14, 0x23, 0x70bd27, 0x25dfdbff, {}, [@NL80211_ATTR_KEY_DATA_WEP40={0x9, 0x7, "a80875ab12"}, @NL80211_ATTR_KEY={0x5c, 0x50, [@NL80211_KEY_DEFAULT_TYPES={0x14, 0x8, [@NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_MULTICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_MULTICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_MULTICAST={0x4}]}, @NL80211_KEY_DEFAULT_TYPES={0x28, 0x8, [@NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_MULTICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_MULTICAST={0x4}]}, @NL80211_KEY_IDX={0x5, 0x2, 0x5}, @NL80211_KEY_DATA_WEP104={0x11, 0x1, "4d84c4e30151cb27f51a4adf63"}]}]}, 0x7c}, 0x1, 0x0, 0x0, 0x24000}, 0x40) [ 441.132353][T18686] device syz_tun left promiscuous mode [ 441.175654][T18686] bridge246: port 1(syz_tun) entered disabled state [ 441.317734][T18686] bridge247: port 1(syz_tun) entered blocking state [ 441.324556][T18686] bridge247: port 1(syz_tun) entered disabled state [ 441.331923][T18686] device syz_tun entered promiscuous mode [ 441.342478][T18694] device erspan0 left promiscuous mode [ 441.349595][T18694] bridge246: port 2(erspan0) entered disabled state [ 441.477761][T18694] bridge247: port 2(erspan0) entered blocking state [ 441.477808][T18694] bridge247: port 2(erspan0) entered disabled state [ 441.478660][T18694] device erspan0 entered promiscuous mode [ 441.499794][T18697] device syz_tun left promiscuous mode [ 441.505343][T18697] bridge11: port 1(syz_tun) entered disabled state [ 441.607777][T18697] bridge12: port 1(syz_tun) entered blocking state [ 441.614510][T18697] bridge12: port 1(syz_tun) entered disabled state [ 441.623205][T18697] device syz_tun entered promiscuous mode [ 441.634769][T18699] netlink: 72 bytes leftover after parsing attributes in process `syz-executor.1'. 15:25:23 executing program 3: r0 = socket(0x21, 0xa, 0x1) r1 = socket(0x10, 0x80002, 0x0) ioctl(r1, 0x1000008912, &(0x7f00000001c0)="080db5055e0bcfe8696071") getsockopt$inet_sctp_SCTP_PEER_AUTH_CHUNKS(r1, 0x84, 0x1a, &(0x7f0000000940)=ANY=[@ANYRES32=0x0, @ANYBLOB='\x00'/12], &(0x7f0000000980)=0x10) getsockopt$inet_sctp_SCTP_GET_PEER_ADDR_INFO(r0, 0x84, 0xf, &(0x7f00000009c0)={r2, @in6={{0xa, 0x4e21, 0x8, @local, 0x401}}, 0x9, 0x1, 0x7, 0x7f, 0x6}, &(0x7f0000000a80)=0x98) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000400)='nl80211\x00') sendmsg$NL80211_CMD_GET_MESH_CONFIG(r0, &(0x7f0000000580)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x103190}, 0xc, &(0x7f0000000540)={&(0x7f0000000500)={0x34, r3, 0x10, 0x70bd2d, 0x25dfdbfe, {}, [@NL80211_ATTR_WDEV={0xc, 0x99, {0x1, 0xffffffffffffffff}}, @NL80211_ATTR_WIPHY={0x8, 0x1, 0x1}, @NL80211_ATTR_WDEV={0xc, 0x99, {0x3f, 0x3}}]}, 0x34}, 0x1, 0x0, 0x0, 0x800}, 0x40000) r4 = socket$nl_generic(0x10, 0x3, 0x10) bind$netlink(r4, &(0x7f0000000000)={0x10, 0x0, 0x25dfdbff, 0x1004280}, 0xffffffffffffffb3) sendmsg$nl_generic(r4, &(0x7f0000000080)={&(0x7f0000000480)={0xd, 0xbb7f}, 0xc, &(0x7f0000000440)={&(0x7f00000004c0)={0x1c, 0x22, 0x1, 0x0, 0x0, {0x4}, [@typed={0x8, 0xc}]}, 0x1c}}, 0x0) socket$netlink(0x10, 0x3, 0x0) r5 = socket$alg(0x26, 0x5, 0x0) bind$alg(r5, &(0x7f0000000080)={0x26, 'hash\x00', 0x0, 0x0, 'sha512\x00'}, 0x58) [ 441.653941][T18701] device erspan0 left promiscuous mode [ 441.662401][T18701] bridge11: port 2(erspan0) entered disabled state 15:25:23 executing program 4: r0 = socket$inet6(0xa, 0x80003, 0x6b) ioctl(r0, 0x1000008912, &(0x7f00000001c0)="080db5055e0bcfe8476071") r1 = socket(0x10, 0x2, 0x0) sendto(r1, &(0x7f0000000200)="120000001200e7ef007b1a3fcd00000000a1", 0x12, 0x0, 0x0, 0x18) recvmmsg(r1, &(0x7f00000037c0)=[{{&(0x7f0000000600)=@ethernet={0x0, @random}, 0x80, &(0x7f0000000380)=[{&(0x7f0000000040)=""/95, 0x5f}, {&(0x7f00000000c0)=""/85, 0x55}, {&(0x7f00000024c0)=""/4096, 0x1000}, {&(0x7f0000000400)=""/120, 0x78}, {&(0x7f0000000480)=""/60, 0x3c}, {&(0x7f0000000280)=""/77, 0x4d}, {&(0x7f0000000540)=""/154, 0x9a}, {&(0x7f0000000340)=""/22, 0x16}], 0x8, &(0x7f0000002400)=""/191, 0xbf}}], 0x1, 0x6, 0x0) [ 441.787838][T18701] bridge12: port 2(erspan0) entered blocking state [ 441.794498][T18701] bridge12: port 2(erspan0) entered disabled state [ 441.810908][T18701] device erspan0 entered promiscuous mode [ 441.830303][T18702] device syz_tun left promiscuous mode [ 441.843863][T18702] bridge236: port 1(syz_tun) entered disabled state 15:25:24 executing program 0: r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000004c0)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r3, @ANYBLOB, @ANYRES32=0x0, @ANYBLOB="00000000008433df6d6f6b577d4eaaf2000007"], 0x5}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000540)=ANY=[@ANYBLOB="7400000024000705000000000000000000010000", @ANYRES32=r3, @ANYBLOB="00000000ffffffff000000000800010073667100486818973f73461919309b68e1693572bb000229c6090032d0ed64f3c3545aaf6e000085a4e4ebb5ef670000000000000000000000000000001a4e624d29a84abf03265700000000000000000000000000000000000000000000000000000000000000ac20000089b53c947244306a0216a3de887763df5b42498b13bb1938de859ee6d7ae7dd2224dc672b69b4358871b170ea0b667832e5224ee3538f885b7abd9bc4a7d"], 0x74}}, 0x0) r4 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r4, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000300)=ANY=[@ANYBLOB="840000002c00010700"/20, @ANYRES32=r3, @ANYBLOB="0008008000000000030000000800010075333200580002001400050000000000000000000000000000000000400006003c0001000000000000001020898dde66057433b6ef3a41d22be225e0001b0000000000000000000000000017256ffc66e43a2484e1a912c5998bcbf0d0000000000000000000000000000000798a3c067277da1a290b9613a33c575c36fad473382c8f5532ef3f0e1d2c450a7decbf3431a69f9b2ecb3291bed174245a962fe0484676958265e2988326a89db3139d91fe4aee6ae7e745ab00001a9f61f20500000000000000b3958bc14fce6e66a36d1ab3194534ba4e973684b27793bff837d3"], 0x84}}, 0x0) r5 = socket(0x10, 0x80002, 0x0) sendmmsg$alg(r5, &(0x7f0000000140), 0x49249249249278c, 0x0) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r6, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000500)=@newlink={0x20, 0x11, 0x40d, 0x0, 0x0, {0x0, 0x0, 0x0, r8}}, 0x20}}, 0x0) r9 = socket(0x10, 0x80002, 0x0) getsockopt$inet_sctp_SCTP_PEER_AUTH_CHUNKS(0xffffffffffffffff, 0x84, 0x1a, &(0x7f0000000940)=ANY=[@ANYRES32=0x0, @ANYBLOB='\x00'/12], &(0x7f0000000980)=0x10) r10 = socket(0xa, 0x6, 0x0) close(r10) r11 = socket$inet6_sctp(0xa, 0x10000000005, 0x84) setsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX(r11, 0x84, 0x6e, &(0x7f0000000180)=[@in6={0xa, 0x0, 0x0, @remote, 0x9}], 0x1c) getsockopt$inet_sctp6_SCTP_GET_ASSOC_ID_LIST(r11, 0x84, 0x1d, &(0x7f000095dff8)={0x1, [0x0]}, &(0x7f000095dffc)=0x8) setsockopt$inet_sctp_SCTP_RTOINFO(r10, 0x84, 0x0, &(0x7f0000000000)={r12, 0x0, 0x0, 0x1000000}, 0x10) setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(0xffffffffffffffff, 0x84, 0x9, &(0x7f0000000680)={r12, @in={{0x2, 0x4e20, @remote}}, 0x10001, 0xfff7, 0x5, 0x1, 0x8, 0x5, 0xba}, 0x9c) ioctl(r9, 0x1000008912, &(0x7f00000001c0)="080db5055e0bcfe8696071") getsockopt$inet_sctp_SCTP_PEER_AUTH_CHUNKS(r9, 0x84, 0x1a, &(0x7f0000000940)=ANY=[@ANYRES32=0x0, @ANYBLOB='\x00'/12], &(0x7f0000000980)=0x10) r13 = socket$nl_generic(0x10, 0x3, 0x10) r14 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080)='nl80211\x00') r15 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL80211_CMD_GET_STATION(r15, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000240)={0x1c, r14, 0xf2b, 0x0, 0x0, {}, [@NL80211_ATTR_AIRTIME_WEIGHT={0x8}]}, 0x1c}}, 0x0) sendmsg$NL80211_CMD_GET_MPATH(r13, &(0x7f00000001c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x2000}, 0x268, &(0x7f0000000080)={&(0x7f0000000200)={0x40, r14, 0x4, 0x70bd2d, 0x25dfdbff}, 0xff6b}, 0x1, 0x0, 0x0, 0x10049050}, 0x260448c0) sendmsg$NL80211_CMD_NEW_KEY(r9, &(0x7f0000000640)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0xb0024000}, 0xc, &(0x7f00000002c0)={&(0x7f0000000440)={0x7c, r14, 0x23, 0x70bd27, 0x25dfdbff, {}, [@NL80211_ATTR_KEY_DATA_WEP40={0x9, 0x7, "a80875ab12"}, @NL80211_ATTR_KEY={0x5c, 0x50, [@NL80211_KEY_DEFAULT_TYPES={0x14, 0x8, [@NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_MULTICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_MULTICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_MULTICAST={0x4}]}, @NL80211_KEY_DEFAULT_TYPES={0x28, 0x8, [@NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_MULTICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_MULTICAST={0x4}]}, @NL80211_KEY_IDX={0x5, 0x2, 0x5}, @NL80211_KEY_DATA_WEP104={0x11, 0x1, "4d84c4e30151cb27f51a4adf63"}]}]}, 0x7c}, 0x1, 0x0, 0x0, 0x24000}, 0x40) [ 441.977776][T18702] bridge237: port 1(syz_tun) entered blocking state [ 441.984554][T18702] bridge237: port 1(syz_tun) entered disabled state [ 441.993553][T18702] device syz_tun entered promiscuous mode [ 442.000579][T18704] netlink: 72 bytes leftover after parsing attributes in process `syz-executor.1'. [ 442.012400][T18706] device erspan0 left promiscuous mode [ 442.020522][T18706] bridge236: port 2(erspan0) entered disabled state [ 442.168412][T18706] bridge237: port 2(erspan0) entered blocking state [ 442.175215][T18706] bridge237: port 2(erspan0) entered disabled state [ 442.184334][T18706] device erspan0 entered promiscuous mode [ 442.192858][T18711] netlink: 'syz-executor.1': attribute type 274 has an invalid length. [ 442.201443][T18712] netlink: 'syz-executor.1': attribute type 274 has an invalid length. 15:25:24 executing program 4: r0 = socket$inet6(0xa, 0x80003, 0x6b) ioctl(r0, 0x1000008912, &(0x7f00000001c0)="080db5055e0bcfe8476071") r1 = socket(0x10, 0x2, 0x0) sendto(r1, &(0x7f0000000200)="120000001200e7ef007b1a3fcd00000000a1", 0x12, 0x0, 0x0, 0x18) recvmmsg(r1, &(0x7f00000037c0)=[{{&(0x7f0000000600)=@ethernet={0x0, @random}, 0x80, &(0x7f0000000380)=[{&(0x7f0000000040)=""/95, 0x5f}, {&(0x7f00000000c0)=""/85, 0x55}, {&(0x7f00000024c0)=""/4096, 0x1000}, {&(0x7f0000000400)=""/120, 0x78}, {&(0x7f0000000480)=""/60, 0x3c}, {&(0x7f0000000280)=""/77, 0x4d}, {&(0x7f0000000540)=""/154, 0x9a}, {&(0x7f0000000340)=""/22, 0x16}], 0x8, &(0x7f0000002400)=""/191, 0xbf}}], 0x1, 0x6, 0x0) 15:25:24 executing program 2: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000340)={'erspan0\x00', 0x0}) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000300)={'syz_tun\x00', 0x0}) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r7, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r6, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000380)=@newlink={0x34, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r8}, [@IFLA_LINKINFO={0x14, 0x12, @bridge={{0xb, 0x1, 'bridge\x00'}, {0x4}}}]}, 0x34}}, 0x0) sendmsg$nl_route(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000002700)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r5}, [@IFLA_MASTER={0x8, 0xa, r8}]}, 0x28}}, 0x0) sendmsg$nl_route(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f00000000c0)=ANY=[@ANYBLOB="2800000010000104000040000000000000001ea6", @ANYRES32=r2, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00\b\x00\n\x00', @ANYRES32=r8], 0x28}}, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r10 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r9, 0x8933, &(0x7f0000000300)={'syz_tun\x00', 0x0}) sendmsg$nl_route(r10, &(0x7f0000000000)={0x0, 0x6558, &(0x7f00000000c0)={&(0x7f0000000040)=@newlink={0x2c, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r11}, [@IFLA_BROADCAST={0xa}]}, 0x332}}, 0x0) 15:25:24 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000004c0)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r3, @ANYBLOB, @ANYRES32=0x0, @ANYBLOB="00000000008433df6d6f6b577d4eaaf2000007"], 0x5}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000540)=ANY=[@ANYBLOB="7400000024000705000000000000000000010000", @ANYRES32=r3, @ANYBLOB="00000000ffffffff000000000800010073667100486818973f73461919309b68e1693572bb000229c6090032d0ed64f3c3545aaf6e000085a4e4ebb5ef670000000000000000000000000000001a4e624d29a84abf03265700000000000000000000000000000000000000000000000000000000000000ac20000089b53c947244306a0216a3de887763df5b42498b13bb1938de859ee6d7ae7dd2224dc672b69b4358871b170ea0b667832e5224ee3538f885b7abd9bc4a7d"], 0x74}}, 0x0) r4 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r4, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000300)=ANY=[@ANYBLOB="840000002c00010700"/20, @ANYRES32=r3, @ANYBLOB="0008008000000000030000000800010075333200580002001400050000000000000000000000000000000000400006003c0001000000000000001020898dde66057433b6ef3a41d22be225e0001b0000000000000000000000000017256ffc66e43a2484e1a912c5998bcbf0d0000000000000000000000000000000798a3c067277da1a290b9613a33c575c36fad473382c8f5532ef3f0e1d2c450a7decbf3431a69f9b2ecb3291bed174245a962fe0484676958265e2988326a89db3139d91fe4aee6ae7e745ab00001a9f61f20500000000000000b3958bc14fce6e66a36d1ab3194534ba4e973684b27793bff837d3"], 0x84}}, 0x0) r5 = socket(0x10, 0x80002, 0x0) sendmmsg$alg(r5, &(0x7f0000000140), 0x49249249249278c, 0x0) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r6, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000500)=@newlink={0x20, 0x11, 0x40d, 0x0, 0x0, {0x0, 0x0, 0x0, r8}}, 0x20}}, 0x0) r9 = socket(0x10, 0x80002, 0x0) getsockopt$inet_sctp_SCTP_PEER_AUTH_CHUNKS(0xffffffffffffffff, 0x84, 0x1a, &(0x7f0000000940)=ANY=[@ANYRES32=0x0, @ANYBLOB='\x00'/12], &(0x7f0000000980)=0x10) r10 = socket(0xa, 0x6, 0x0) close(r10) r11 = socket$inet6_sctp(0xa, 0x10000000005, 0x84) setsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX(r11, 0x84, 0x6e, &(0x7f0000000180)=[@in6={0xa, 0x0, 0x0, @remote, 0x9}], 0x1c) getsockopt$inet_sctp6_SCTP_GET_ASSOC_ID_LIST(r11, 0x84, 0x1d, &(0x7f000095dff8)={0x1, [0x0]}, &(0x7f000095dffc)=0x8) setsockopt$inet_sctp_SCTP_RTOINFO(r10, 0x84, 0x0, &(0x7f0000000000)={r12, 0x0, 0x0, 0x1000000}, 0x10) setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(0xffffffffffffffff, 0x84, 0x9, &(0x7f0000000680)={r12, @in={{0x2, 0x4e20, @remote}}, 0x10001, 0xfff7, 0x5, 0x1, 0x8, 0x5, 0xba}, 0x9c) ioctl(r9, 0x1000008912, &(0x7f00000001c0)="080db5055e0bcfe8696071") getsockopt$inet_sctp_SCTP_PEER_AUTH_CHUNKS(r9, 0x84, 0x1a, &(0x7f0000000940)=ANY=[@ANYRES32=0x0, @ANYBLOB='\x00'/12], &(0x7f0000000980)=0x10) r13 = socket$nl_generic(0x10, 0x3, 0x10) r14 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080)='nl80211\x00') r15 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL80211_CMD_GET_STATION(r15, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000240)={0x1c, r14, 0xf2b, 0x0, 0x0, {}, [@NL80211_ATTR_AIRTIME_WEIGHT={0x8}]}, 0x1c}}, 0x0) sendmsg$NL80211_CMD_GET_MPATH(r13, &(0x7f00000001c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x2000}, 0x268, &(0x7f0000000080)={&(0x7f0000000200)={0x40, r14, 0x4, 0x70bd2d, 0x25dfdbff}, 0xff6b}, 0x1, 0x0, 0x0, 0x10049050}, 0x260448c0) sendmsg$NL80211_CMD_NEW_KEY(r9, &(0x7f0000000640)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0xb0024000}, 0xc, &(0x7f00000002c0)={&(0x7f0000000440)={0x7c, r14, 0x23, 0x70bd27, 0x25dfdbff, {}, [@NL80211_ATTR_KEY_DATA_WEP40={0x9, 0x7, "a80875ab12"}, @NL80211_ATTR_KEY={0x5c, 0x50, [@NL80211_KEY_DEFAULT_TYPES={0x14, 0x8, [@NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_MULTICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_MULTICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_MULTICAST={0x4}]}, @NL80211_KEY_DEFAULT_TYPES={0x28, 0x8, [@NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_MULTICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_MULTICAST={0x4}]}, @NL80211_KEY_IDX={0x5, 0x2, 0x5}, @NL80211_KEY_DATA_WEP104={0x11, 0x1, "4d84c4e30151cb27f51a4adf63"}]}]}, 0x7c}, 0x1, 0x0, 0x0, 0x24000}, 0x40) [ 442.215787][T18726] netlink: 72 bytes leftover after parsing attributes in process `syz-executor.0'. [ 442.233587][T18728] netlink: 72 bytes leftover after parsing attributes in process `syz-executor.0'. 15:25:24 executing program 5: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000340)={'erspan0\x00', 0x0}) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000300)={'syz_tun\x00', 0x0}) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r7, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r6, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000380)=@newlink={0x34, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r8}, [@IFLA_LINKINFO={0x14, 0x12, @bridge={{0xb, 0x1, 'bridge\x00'}, {0x4}}}]}, 0x34}}, 0x0) sendmsg$nl_route(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000002700)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r5}, [@IFLA_MASTER={0x8, 0xa, r8}]}, 0x28}}, 0x0) sendmsg$nl_route(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f00000000c0)=ANY=[@ANYBLOB="2800000010000104000040000000000000001ea6", @ANYRES32=r2, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00\b\x00\n\x00', @ANYRES32=r8], 0x28}}, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r10 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r9, 0x8933, &(0x7f0000000300)={'syz_tun\x00', 0x0}) sendmsg$nl_route(r10, &(0x7f0000000000)={0x0, 0x6558, &(0x7f00000000c0)={&(0x7f0000000040)=@newlink={0x2c, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r11}, [@IFLA_BROADCAST={0xa}]}, 0x332}}, 0x0) 15:25:24 executing program 3: r0 = socket(0x21, 0xa, 0x1) r1 = socket(0x10, 0x80002, 0x0) ioctl(r1, 0x1000008912, &(0x7f00000001c0)="080db5055e0bcfe8696071") getsockopt$inet_sctp_SCTP_PEER_AUTH_CHUNKS(r1, 0x84, 0x1a, &(0x7f0000000940)=ANY=[@ANYRES32=0x0, @ANYBLOB='\x00'/12], &(0x7f0000000980)=0x10) getsockopt$inet_sctp_SCTP_GET_PEER_ADDR_INFO(r0, 0x84, 0xf, &(0x7f00000009c0)={r2, @in6={{0xa, 0x4e21, 0x8, @local, 0x401}}, 0x9, 0x1, 0x7, 0x7f, 0x6}, &(0x7f0000000a80)=0x98) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000400)='nl80211\x00') sendmsg$NL80211_CMD_GET_MESH_CONFIG(r0, &(0x7f0000000580)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x103190}, 0xc, &(0x7f0000000540)={&(0x7f0000000500)={0x34, r3, 0x10, 0x70bd2d, 0x25dfdbfe, {}, [@NL80211_ATTR_WDEV={0xc, 0x99, {0x1, 0xffffffffffffffff}}, @NL80211_ATTR_WIPHY={0x8, 0x1, 0x1}, @NL80211_ATTR_WDEV={0xc, 0x99, {0x3f, 0x3}}]}, 0x34}, 0x1, 0x0, 0x0, 0x800}, 0x40000) r4 = socket$nl_generic(0x10, 0x3, 0x10) bind$netlink(r4, &(0x7f0000000000)={0x10, 0x0, 0x25dfdbff, 0x1004280}, 0xffffffffffffffb3) sendmsg$nl_generic(r4, &(0x7f0000000080)={&(0x7f0000000480)={0xe, 0xbb7f}, 0xc, &(0x7f0000000440)={&(0x7f00000004c0)={0x1c, 0x22, 0x1, 0x0, 0x0, {0x4}, [@typed={0x8, 0xc}]}, 0x1c}}, 0x0) socket$netlink(0x10, 0x3, 0x0) r5 = socket$alg(0x26, 0x5, 0x0) bind$alg(r5, &(0x7f0000000080)={0x26, 'hash\x00', 0x0, 0x0, 'sha512\x00'}, 0x58) [ 442.346571][T18726] netlink: 'syz-executor.0': attribute type 274 has an invalid length. [ 442.380756][T18739] netlink: 72 bytes leftover after parsing attributes in process `syz-executor.1'. 15:25:24 executing program 4: r0 = socket$inet6(0xa, 0x80003, 0x6b) ioctl(r0, 0x1000008912, &(0x7f00000001c0)="080db5055e0bcfe8476071") r1 = socket(0x10, 0x2, 0x0) sendto(r1, &(0x7f0000000200)="120000001200e7ef007b1a3fcd00000000a1", 0x12, 0x0, 0x0, 0x18) recvmmsg(r1, &(0x7f00000037c0)=[{{&(0x7f0000000600)=@ethernet={0x0, @random}, 0x80, &(0x7f0000000380)=[{&(0x7f0000000040)=""/95, 0x5f}, {&(0x7f00000000c0)=""/85, 0x55}, {&(0x7f00000024c0)=""/4096, 0x1000}, {&(0x7f0000000400)=""/120, 0x78}, {&(0x7f0000000480)=""/60, 0x3c}, {&(0x7f0000000280)=""/77, 0x4d}, {&(0x7f0000000540)=""/154, 0x9a}, {&(0x7f0000000340)=""/22, 0x16}], 0x8, &(0x7f0000002400)=""/191, 0xbf}}], 0x1, 0x6, 0x0) [ 442.411208][T18728] netlink: 'syz-executor.0': attribute type 274 has an invalid length. [ 442.443308][T18741] device syz_tun left promiscuous mode [ 442.453542][T18741] bridge247: port 1(syz_tun) entered disabled state [ 442.617721][T18741] bridge248: port 1(syz_tun) entered blocking state [ 442.624544][T18741] bridge248: port 1(syz_tun) entered disabled state [ 442.631931][T18741] device syz_tun entered promiscuous mode [ 442.640052][T18739] netlink: 72 bytes leftover after parsing attributes in process `syz-executor.1'. [ 442.654787][T18751] device erspan0 left promiscuous mode [ 442.662169][T18751] bridge247: port 2(erspan0) entered disabled state 15:25:24 executing program 0: r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000004c0)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r3, @ANYBLOB, @ANYRES32=0x0, @ANYBLOB="00000000008433df6d6f6b577d4eaaf2000007"], 0x5}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000540)=ANY=[@ANYBLOB="7400000024000705000000000000000000010000", @ANYRES32=r3, @ANYBLOB="00000000ffffffff000000000800010073667100486818973f73461919309b68e1693572bb000229c6090032d0ed64f3c3545aaf6e000085a4e4ebb5ef670000000000000000000000000000001a4e624d29a84abf03265700000000000000000000000000000000000000000000000000000000000000ac20000089b53c947244306a0216a3de887763df5b42498b13bb1938de859ee6d7ae7dd2224dc672b69b4358871b170ea0b667832e5224ee3538f885b7abd9bc4a7d"], 0x74}}, 0x0) r4 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r4, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000300)=ANY=[@ANYBLOB="840000002c00010700"/20, @ANYRES32=r3, @ANYBLOB="0008008000000000030000000800010075333200580002001400050000000000000000000000000000000000400006003c0001000000000000001020898dde66057433b6ef3a41d22be225e0001b0000000000000000000000000017256ffc66e43a2484e1a912c5998bcbf0d0000000000000000000000000000000798a3c067277da1a290b9613a33c575c36fad473382c8f5532ef3f0e1d2c450a7decbf3431a69f9b2ecb3291bed174245a962fe0484676958265e2988326a89db3139d91fe4aee6ae7e745ab00001a9f61f20500000000000000b3958bc14fce6e66a36d1ab3194534ba4e973684b27793bff837d3"], 0x84}}, 0x0) r5 = socket(0x10, 0x80002, 0x0) sendmmsg$alg(r5, &(0x7f0000000140), 0x49249249249278c, 0x0) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r6, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000500)=@newlink={0x20, 0x11, 0x40d, 0x0, 0x0, {0x0, 0x0, 0x0, r8}}, 0x20}}, 0x0) r9 = socket(0x10, 0x80002, 0x0) getsockopt$inet_sctp_SCTP_PEER_AUTH_CHUNKS(0xffffffffffffffff, 0x84, 0x1a, &(0x7f0000000940)=ANY=[@ANYRES32=0x0, @ANYBLOB='\x00'/12], &(0x7f0000000980)=0x10) r10 = socket(0xa, 0x6, 0x0) close(r10) r11 = socket$inet6_sctp(0xa, 0x10000000005, 0x84) setsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX(r11, 0x84, 0x6e, &(0x7f0000000180)=[@in6={0xa, 0x0, 0x0, @remote, 0x9}], 0x1c) getsockopt$inet_sctp6_SCTP_GET_ASSOC_ID_LIST(r11, 0x84, 0x1d, &(0x7f000095dff8)={0x1, [0x0]}, &(0x7f000095dffc)=0x8) setsockopt$inet_sctp_SCTP_RTOINFO(r10, 0x84, 0x0, &(0x7f0000000000)={r12, 0x0, 0x0, 0x1000000}, 0x10) setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(0xffffffffffffffff, 0x84, 0x9, &(0x7f0000000680)={r12, @in={{0x2, 0x4e20, @remote}}, 0x10001, 0xfff7, 0x5, 0x1, 0x8, 0x5, 0xba}, 0x9c) ioctl(r9, 0x1000008912, &(0x7f00000001c0)="080db5055e0bcfe8696071") getsockopt$inet_sctp_SCTP_PEER_AUTH_CHUNKS(r9, 0x84, 0x1a, &(0x7f0000000940)=ANY=[@ANYRES32=0x0, @ANYBLOB='\x00'/12], &(0x7f0000000980)=0x10) r13 = socket$nl_generic(0x10, 0x3, 0x10) r14 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080)='nl80211\x00') r15 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL80211_CMD_GET_STATION(r15, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000240)={0x1c, r14, 0xf2b, 0x0, 0x0, {}, [@NL80211_ATTR_AIRTIME_WEIGHT={0x8}]}, 0x1c}}, 0x0) sendmsg$NL80211_CMD_GET_MPATH(r13, &(0x7f00000001c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x2000}, 0x268, &(0x7f0000000080)={&(0x7f0000000200)={0x40, r14, 0x4, 0x70bd2d, 0x25dfdbff}, 0xff6b}, 0x1, 0x0, 0x0, 0x10049050}, 0x260448c0) sendmsg$NL80211_CMD_NEW_KEY(r9, &(0x7f0000000640)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0xb0024000}, 0xc, &(0x7f00000002c0)={&(0x7f0000000440)={0x7c, r14, 0x23, 0x70bd27, 0x25dfdbff, {}, [@NL80211_ATTR_KEY_DATA_WEP40={0x9, 0x7, "a80875ab12"}, @NL80211_ATTR_KEY={0x5c, 0x50, [@NL80211_KEY_DEFAULT_TYPES={0x14, 0x8, [@NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_MULTICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_MULTICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_MULTICAST={0x4}]}, @NL80211_KEY_DEFAULT_TYPES={0x28, 0x8, [@NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_MULTICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_MULTICAST={0x4}]}, @NL80211_KEY_IDX={0x5, 0x2, 0x5}, @NL80211_KEY_DATA_WEP104={0x11, 0x1, "4d84c4e30151cb27f51a4adf63"}]}]}, 0x7c}, 0x1, 0x0, 0x0, 0x24000}, 0x40) [ 442.797797][T18751] bridge248: port 2(erspan0) entered blocking state [ 442.804572][T18751] bridge248: port 2(erspan0) entered disabled state [ 442.811904][T18751] device erspan0 entered promiscuous mode [ 442.819545][T18753] device syz_tun left promiscuous mode [ 442.825298][T18753] bridge237: port 1(syz_tun) entered disabled state 15:25:25 executing program 4: r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000004c0)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r3, @ANYBLOB, @ANYRES32=0x0, @ANYBLOB="00000000008433df6d6f6b577d4eaaf2000007"], 0x5}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000540)=ANY=[@ANYBLOB="7400000024000705000000000000000000010000", @ANYRES32=r3, @ANYBLOB="00000000ffffffff000000000800010073667100486818973f73461919309b68e1693572bb000229c6090032d0ed64f3c3545aaf6e000085a4e4ebb5ef670000000000000000000000000000001a4e624d29a84abf03265700000000000000000000000000000000000000000000000000000000000000ac20000089b53c947244306a0216a3de887763df5b42498b13bb1938de859ee6d7ae7dd2224dc672b69b4358871b170ea0b667832e5224ee3538f885b7abd9bc4a7d"], 0x74}}, 0x0) r4 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r4, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000300)=ANY=[@ANYBLOB="840000002c00010700"/20, @ANYRES32=r3, @ANYBLOB="0008008000000000030000000800010075333200580002001400050000000000000000000000000000000000400006003c0001000000000000001020898dde66057433b6ef3a41d22be225e0001b0000000000000000000000000017256ffc66e43a2484e1a912c5998bcbf0d0000000000000000000000000000000798a3c067277da1a290b9613a33c575c36fad473382c8f5532ef3f0e1d2c450a7decbf3431a69f9b2ecb3291bed174245a962fe0484676958265e2988326a89db3139d91fe4aee6ae7e745ab00001a9f61f20500000000000000b3958bc14fce6e66a36d1ab3194534ba4e973684b27793bff837d3"], 0x84}}, 0x0) r5 = socket(0x10, 0x80002, 0x0) sendmmsg$alg(r5, &(0x7f0000000140), 0x49249249249278c, 0x0) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r6, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000500)=@newlink={0x20, 0x11, 0x40d, 0x0, 0x0, {0x0, 0x0, 0x0, r8}}, 0x20}}, 0x0) r9 = socket(0x10, 0x80002, 0x0) getsockopt$inet_sctp_SCTP_PEER_AUTH_CHUNKS(0xffffffffffffffff, 0x84, 0x1a, &(0x7f0000000940)=ANY=[@ANYRES32=0x0, @ANYBLOB='\x00'/12], &(0x7f0000000980)=0x10) r10 = socket(0xa, 0x6, 0x0) close(r10) r11 = socket$inet6_sctp(0xa, 0x10000000005, 0x84) setsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX(r11, 0x84, 0x6e, &(0x7f0000000180)=[@in6={0xa, 0x0, 0x0, @remote, 0x9}], 0x1c) getsockopt$inet_sctp6_SCTP_GET_ASSOC_ID_LIST(r11, 0x84, 0x1d, &(0x7f000095dff8)={0x1, [0x0]}, &(0x7f000095dffc)=0x8) setsockopt$inet_sctp_SCTP_RTOINFO(r10, 0x84, 0x0, &(0x7f0000000000)={r12, 0x0, 0x0, 0x1000000}, 0x10) setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(0xffffffffffffffff, 0x84, 0x9, &(0x7f0000000680)={r12, @in={{0x2, 0x4e20, @remote}}, 0x10001, 0xfff7, 0x5, 0x1, 0x8, 0x5, 0xba}, 0x9c) ioctl(r9, 0x1000008912, &(0x7f00000001c0)="080db5055e0bcfe8696071") getsockopt$inet_sctp_SCTP_PEER_AUTH_CHUNKS(r9, 0x84, 0x1a, &(0x7f0000000940)=ANY=[@ANYRES32=0x0, @ANYBLOB='\x00'/12], &(0x7f0000000980)=0x10) r13 = socket$nl_generic(0x10, 0x3, 0x10) r14 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080)='nl80211\x00') r15 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL80211_CMD_GET_STATION(r15, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000240)={0x1c, r14, 0xf2b, 0x0, 0x0, {}, [@NL80211_ATTR_AIRTIME_WEIGHT={0x8}]}, 0x1c}}, 0x0) sendmsg$NL80211_CMD_GET_MPATH(r13, &(0x7f00000001c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x2000}, 0x268, &(0x7f0000000080)={&(0x7f0000000200)={0x40, r14, 0x4, 0x70bd2d, 0x25dfdbff}, 0xff6b}, 0x1, 0x0, 0x0, 0x10049050}, 0x260448c0) sendmsg$NL80211_CMD_NEW_KEY(r9, &(0x7f0000000640)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0xb0024000}, 0xc, &(0x7f00000002c0)={&(0x7f0000000440)={0x7c, r14, 0x23, 0x70bd27, 0x25dfdbff, {}, [@NL80211_ATTR_KEY_DATA_WEP40={0x9, 0x7, "a80875ab12"}, @NL80211_ATTR_KEY={0x5c, 0x50, [@NL80211_KEY_DEFAULT_TYPES={0x14, 0x8, [@NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_MULTICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_MULTICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_MULTICAST={0x4}]}, @NL80211_KEY_DEFAULT_TYPES={0x28, 0x8, [@NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_MULTICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_MULTICAST={0x4}]}, @NL80211_KEY_IDX={0x5, 0x2, 0x5}, @NL80211_KEY_DATA_WEP104={0x11, 0x1, "4d84c4e30151cb27f51a4adf63"}]}]}, 0x7c}, 0x1, 0x0, 0x0, 0x24000}, 0x40) [ 442.947789][T18753] bridge238: port 1(syz_tun) entered blocking state [ 442.954559][T18753] bridge238: port 1(syz_tun) entered disabled state [ 442.962116][T18753] device syz_tun entered promiscuous mode [ 442.970964][T18758] device erspan0 left promiscuous mode [ 442.986266][T18758] bridge237: port 2(erspan0) entered disabled state 15:25:25 executing program 3: r0 = socket(0x21, 0xa, 0x1) r1 = socket(0x10, 0x80002, 0x0) ioctl(r1, 0x1000008912, &(0x7f00000001c0)="080db5055e0bcfe8696071") getsockopt$inet_sctp_SCTP_PEER_AUTH_CHUNKS(r1, 0x84, 0x1a, &(0x7f0000000940)=ANY=[@ANYRES32=0x0, @ANYBLOB='\x00'/12], &(0x7f0000000980)=0x10) getsockopt$inet_sctp_SCTP_GET_PEER_ADDR_INFO(r0, 0x84, 0xf, &(0x7f00000009c0)={r2, @in6={{0xa, 0x4e21, 0x8, @local, 0x401}}, 0x9, 0x1, 0x7, 0x7f, 0x6}, &(0x7f0000000a80)=0x98) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000400)='nl80211\x00') sendmsg$NL80211_CMD_GET_MESH_CONFIG(r0, &(0x7f0000000580)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x103190}, 0xc, &(0x7f0000000540)={&(0x7f0000000500)={0x34, r3, 0x10, 0x70bd2d, 0x25dfdbfe, {}, [@NL80211_ATTR_WDEV={0xc, 0x99, {0x1, 0xffffffffffffffff}}, @NL80211_ATTR_WIPHY={0x8, 0x1, 0x1}, @NL80211_ATTR_WDEV={0xc, 0x99, {0x3f, 0x3}}]}, 0x34}, 0x1, 0x0, 0x0, 0x800}, 0x40000) r4 = socket$nl_generic(0x10, 0x3, 0x10) bind$netlink(r4, &(0x7f0000000000)={0x10, 0x0, 0x25dfdbff, 0x1004280}, 0xffffffffffffffb3) sendmsg$nl_generic(r4, &(0x7f0000000080)={&(0x7f0000000480)={0x11, 0xbb7f}, 0xc, &(0x7f0000000440)={&(0x7f00000004c0)={0x1c, 0x22, 0x1, 0x0, 0x0, {0x4}, [@typed={0x8, 0xc}]}, 0x1c}}, 0x0) socket$netlink(0x10, 0x3, 0x0) r5 = socket$alg(0x26, 0x5, 0x0) bind$alg(r5, &(0x7f0000000080)={0x26, 'hash\x00', 0x0, 0x0, 'sha512\x00'}, 0x58) [ 443.108379][T18758] bridge238: port 2(erspan0) entered blocking state [ 443.115177][T18758] bridge238: port 2(erspan0) entered disabled state [ 443.122872][T18758] device erspan0 entered promiscuous mode [ 443.133997][T18762] netlink: 'syz-executor.1': attribute type 274 has an invalid length. [ 443.144648][T18763] netlink: 'syz-executor.1': attribute type 274 has an invalid length. 15:25:25 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000004c0)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r3, @ANYBLOB="0000000000000000280012000c0001007665", @ANYRES32=0x0, @ANYBLOB="00000000008433df6d6f6b577d4eaaf2000007"], 0x5}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000540)=ANY=[@ANYBLOB="7400000024000705000000000000000000010000", @ANYRES32=r3, @ANYBLOB="00000000ffffffff000000000800010073667100486818973f73461919309b68e1693572bb000229c6090032d0ed64f3c3545aaf6e000085a4e4ebb5ef670000000000000000000000000000001a4e624d29a84abf03265700000000000000000000000000000000000000000000000000000000000000ac20000089b53c947244306a0216a3de887763df5b42498b13bb1938de859ee6d7ae7dd2224dc672b69b4358871b170ea0b667832e5224ee3538f885b7abd9bc4a7d"], 0x74}}, 0x0) r4 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r4, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000300)=ANY=[@ANYBLOB="840000002c00010700"/20, @ANYRES32=r3, @ANYBLOB="0008008000000000030000000800010075333200580002001400050000000000000000000000000000000000400006003c0001000000000000001020898dde66057433b6ef3a41d22be225e0001b0000000000000000000000000017256ffc66e43a2484e1a912c5998bcbf0d0000000000000000000000000000000798a3c067277da1a290b9613a33c575c36fad473382c8f5532ef3f0e1d2c450a7decbf3431a69f9b2ecb3291bed174245a962fe0484676958265e2988326a89db3139d91fe4aee6ae7e745ab00001a9f61f20500000000000000b3958bc14fce6e66a36d1ab3194534ba4e973684b27793bff837d3"], 0x84}}, 0x0) r5 = socket(0x10, 0x80002, 0x0) sendmmsg$alg(r5, &(0x7f0000000140), 0x49249249249278c, 0x0) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r6, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000500)=@newlink={0x20, 0x11, 0x40d, 0x0, 0x0, {0x0, 0x0, 0x0, r8}}, 0x20}}, 0x0) r9 = socket(0x10, 0x80002, 0x0) getsockopt$inet_sctp_SCTP_PEER_AUTH_CHUNKS(0xffffffffffffffff, 0x84, 0x1a, &(0x7f0000000940)=ANY=[@ANYRES32=0x0, @ANYBLOB='\x00'/12], &(0x7f0000000980)=0x10) r10 = socket(0xa, 0x6, 0x0) close(r10) r11 = socket$inet6_sctp(0xa, 0x10000000005, 0x84) setsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX(r11, 0x84, 0x6e, &(0x7f0000000180)=[@in6={0xa, 0x0, 0x0, @remote, 0x9}], 0x1c) getsockopt$inet_sctp6_SCTP_GET_ASSOC_ID_LIST(r11, 0x84, 0x1d, &(0x7f000095dff8)={0x1, [0x0]}, &(0x7f000095dffc)=0x8) setsockopt$inet_sctp_SCTP_RTOINFO(r10, 0x84, 0x0, &(0x7f0000000000)={r12, 0x0, 0x0, 0x1000000}, 0x10) setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(0xffffffffffffffff, 0x84, 0x9, &(0x7f0000000680)={r12, @in={{0x2, 0x4e20, @remote}}, 0x10001, 0xfff7, 0x5, 0x1, 0x8, 0x5, 0xba}, 0x9c) ioctl(r9, 0x1000008912, &(0x7f00000001c0)="080db5055e0bcfe8696071") getsockopt$inet_sctp_SCTP_PEER_AUTH_CHUNKS(r9, 0x84, 0x1a, &(0x7f0000000940)=ANY=[@ANYRES32=0x0, @ANYBLOB='\x00'/12], &(0x7f0000000980)=0x10) r13 = socket$nl_generic(0x10, 0x3, 0x10) r14 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080)='nl80211\x00') r15 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL80211_CMD_GET_STATION(r15, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000240)={0x1c, r14, 0xf2b, 0x0, 0x0, {}, [@NL80211_ATTR_AIRTIME_WEIGHT={0x8}]}, 0x1c}}, 0x0) sendmsg$NL80211_CMD_GET_MPATH(r13, &(0x7f00000001c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x2000}, 0x268, &(0x7f0000000080)={&(0x7f0000000200)={0x40, r14, 0x4, 0x70bd2d, 0x25dfdbff}, 0xff6b}, 0x1, 0x0, 0x0, 0x10049050}, 0x260448c0) sendmsg$NL80211_CMD_NEW_KEY(r9, &(0x7f0000000640)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0xb0024000}, 0xc, &(0x7f00000002c0)={&(0x7f0000000440)={0x7c, r14, 0x23, 0x70bd27, 0x25dfdbff, {}, [@NL80211_ATTR_KEY_DATA_WEP40={0x9, 0x7, "a80875ab12"}, @NL80211_ATTR_KEY={0x5c, 0x50, [@NL80211_KEY_DEFAULT_TYPES={0x14, 0x8, [@NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_MULTICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_MULTICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_MULTICAST={0x4}]}, @NL80211_KEY_DEFAULT_TYPES={0x28, 0x8, [@NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_MULTICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_MULTICAST={0x4}]}, @NL80211_KEY_IDX={0x5, 0x2, 0x5}, @NL80211_KEY_DATA_WEP104={0x11, 0x1, "4d84c4e30151cb27f51a4adf63"}]}]}, 0x7c}, 0x1, 0x0, 0x0, 0x24000}, 0x40) [ 443.166338][T18768] netlink: 72 bytes leftover after parsing attributes in process `syz-executor.0'. [ 443.175876][T18769] netlink: 72 bytes leftover after parsing attributes in process `syz-executor.0'. [ 443.205109][T18768] netlink: 'syz-executor.0': attribute type 274 has an invalid length. [ 443.231952][T18751] device erspan0 left promiscuous mode [ 443.239986][T18751] bridge248: port 2(erspan0) entered disabled state 15:25:25 executing program 2: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000340)={'erspan0\x00', 0x0}) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000300)={'syz_tun\x00', 0x0}) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r7, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r6, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000380)=@newlink={0x34, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r8}, [@IFLA_LINKINFO={0x14, 0x12, @bridge={{0xb, 0x1, 'bridge\x00'}, {0x4}}}]}, 0x34}}, 0x0) sendmsg$nl_route(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000002700)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r5}, [@IFLA_MASTER={0x8, 0xa, r8}]}, 0x28}}, 0x0) sendmsg$nl_route(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f00000000c0)=ANY=[@ANYBLOB="2800000010000104000040000000000000001ea6", @ANYRES32=r2, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00\b\x00\n\x00', @ANYRES32=r8], 0x28}}, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r10 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r9, 0x8933, &(0x7f0000000300)={'syz_tun\x00', 0x0}) sendmsg$nl_route(r10, &(0x7f0000000000)={0x0, 0x8100, &(0x7f00000000c0)={&(0x7f0000000040)=@newlink={0x2c, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r11}, [@IFLA_BROADCAST={0xa}]}, 0x332}}, 0x0) [ 443.358809][T18773] netlink: 72 bytes leftover after parsing attributes in process `syz-executor.4'. [ 443.370329][T18776] netlink: 72 bytes leftover after parsing attributes in process `syz-executor.4'. [ 443.381848][T18779] netlink: 'syz-executor.0': attribute type 274 has an invalid length. [ 443.393393][T18758] device erspan0 left promiscuous mode [ 443.400233][T18758] bridge238: port 2(erspan0) entered disabled state 15:25:25 executing program 3: r0 = socket(0x21, 0xa, 0x1) r1 = socket(0x10, 0x80002, 0x0) ioctl(r1, 0x1000008912, &(0x7f00000001c0)="080db5055e0bcfe8696071") getsockopt$inet_sctp_SCTP_PEER_AUTH_CHUNKS(r1, 0x84, 0x1a, &(0x7f0000000940)=ANY=[@ANYRES32=0x0, @ANYBLOB='\x00'/12], &(0x7f0000000980)=0x10) getsockopt$inet_sctp_SCTP_GET_PEER_ADDR_INFO(r0, 0x84, 0xf, &(0x7f00000009c0)={r2, @in6={{0xa, 0x4e21, 0x8, @local, 0x401}}, 0x9, 0x1, 0x7, 0x7f, 0x6}, &(0x7f0000000a80)=0x98) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000400)='nl80211\x00') sendmsg$NL80211_CMD_GET_MESH_CONFIG(r0, &(0x7f0000000580)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x103190}, 0xc, &(0x7f0000000540)={&(0x7f0000000500)={0x34, r3, 0x10, 0x70bd2d, 0x25dfdbfe, {}, [@NL80211_ATTR_WDEV={0xc, 0x99, {0x1, 0xffffffffffffffff}}, @NL80211_ATTR_WIPHY={0x8, 0x1, 0x1}, @NL80211_ATTR_WDEV={0xc, 0x99, {0x3f, 0x3}}]}, 0x34}, 0x1, 0x0, 0x0, 0x800}, 0x40000) r4 = socket$nl_generic(0x10, 0x3, 0x10) bind$netlink(r4, &(0x7f0000000000)={0x10, 0x0, 0x25dfdbff, 0x1004280}, 0xffffffffffffffb3) sendmsg$nl_generic(r4, &(0x7f0000000080)={&(0x7f0000000480)={0x12, 0xbb7f}, 0xc, &(0x7f0000000440)={&(0x7f00000004c0)={0x1c, 0x22, 0x1, 0x0, 0x0, {0x4}, [@typed={0x8, 0xc}]}, 0x1c}}, 0x0) socket$netlink(0x10, 0x3, 0x0) r5 = socket$alg(0x26, 0x5, 0x0) bind$alg(r5, &(0x7f0000000080)={0x26, 'hash\x00', 0x0, 0x0, 'sha512\x00'}, 0x58) 15:25:25 executing program 4: r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000004c0)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r3, @ANYBLOB, @ANYRES32=0x0, @ANYBLOB="00000000008433df6d6f6b577d4eaaf2000007"], 0x5}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000540)=ANY=[@ANYBLOB="7400000024000705000000000000000000010000", @ANYRES32=r3, @ANYBLOB="00000000ffffffff000000000800010073667100486818973f73461919309b68e1693572bb000229c6090032d0ed64f3c3545aaf6e000085a4e4ebb5ef670000000000000000000000000000001a4e624d29a84abf03265700000000000000000000000000000000000000000000000000000000000000ac20000089b53c947244306a0216a3de887763df5b42498b13bb1938de859ee6d7ae7dd2224dc672b69b4358871b170ea0b667832e5224ee3538f885b7abd9bc4a7d"], 0x74}}, 0x0) r4 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r4, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000300)=ANY=[@ANYBLOB="840000002c00010700"/20, @ANYRES32=r3, @ANYBLOB="0008008000000000030000000800010075333200580002001400050000000000000000000000000000000000400006003c0001000000000000001020898dde66057433b6ef3a41d22be225e0001b0000000000000000000000000017256ffc66e43a2484e1a912c5998bcbf0d0000000000000000000000000000000798a3c067277da1a290b9613a33c575c36fad473382c8f5532ef3f0e1d2c450a7decbf3431a69f9b2ecb3291bed174245a962fe0484676958265e2988326a89db3139d91fe4aee6ae7e745ab00001a9f61f20500000000000000b3958bc14fce6e66a36d1ab3194534ba4e973684b27793bff837d3"], 0x84}}, 0x0) r5 = socket(0x10, 0x80002, 0x0) sendmmsg$alg(r5, &(0x7f0000000140), 0x49249249249278c, 0x0) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r6, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000500)=@newlink={0x20, 0x11, 0x40d, 0x0, 0x0, {0x0, 0x0, 0x0, r8}}, 0x20}}, 0x0) r9 = socket(0x10, 0x80002, 0x0) getsockopt$inet_sctp_SCTP_PEER_AUTH_CHUNKS(0xffffffffffffffff, 0x84, 0x1a, &(0x7f0000000940)=ANY=[@ANYRES32=0x0, @ANYBLOB='\x00'/12], &(0x7f0000000980)=0x10) r10 = socket(0xa, 0x6, 0x0) close(r10) r11 = socket$inet6_sctp(0xa, 0x10000000005, 0x84) setsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX(r11, 0x84, 0x6e, &(0x7f0000000180)=[@in6={0xa, 0x0, 0x0, @remote, 0x9}], 0x1c) getsockopt$inet_sctp6_SCTP_GET_ASSOC_ID_LIST(r11, 0x84, 0x1d, &(0x7f000095dff8)={0x1, [0x0]}, &(0x7f000095dffc)=0x8) setsockopt$inet_sctp_SCTP_RTOINFO(r10, 0x84, 0x0, &(0x7f0000000000)={r12, 0x0, 0x0, 0x1000000}, 0x10) setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(0xffffffffffffffff, 0x84, 0x9, &(0x7f0000000680)={r12, @in={{0x2, 0x4e20, @remote}}, 0x10001, 0xfff7, 0x5, 0x1, 0x8, 0x5, 0xba}, 0x9c) ioctl(r9, 0x1000008912, &(0x7f00000001c0)="080db5055e0bcfe8696071") getsockopt$inet_sctp_SCTP_PEER_AUTH_CHUNKS(r9, 0x84, 0x1a, &(0x7f0000000940)=ANY=[@ANYRES32=0x0, @ANYBLOB='\x00'/12], &(0x7f0000000980)=0x10) r13 = socket$nl_generic(0x10, 0x3, 0x10) r14 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080)='nl80211\x00') r15 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL80211_CMD_GET_STATION(r15, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000240)={0x1c, r14, 0xf2b, 0x0, 0x0, {}, [@NL80211_ATTR_AIRTIME_WEIGHT={0x8}]}, 0x1c}}, 0x0) sendmsg$NL80211_CMD_GET_MPATH(r13, &(0x7f00000001c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x2000}, 0x268, &(0x7f0000000080)={&(0x7f0000000200)={0x40, r14, 0x4, 0x70bd2d, 0x25dfdbff}, 0xff6b}, 0x1, 0x0, 0x0, 0x10049050}, 0x260448c0) sendmsg$NL80211_CMD_NEW_KEY(r9, &(0x7f0000000640)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0xb0024000}, 0xc, &(0x7f00000002c0)={&(0x7f0000000440)={0x7c, r14, 0x23, 0x70bd27, 0x25dfdbff, {}, [@NL80211_ATTR_KEY_DATA_WEP40={0x9, 0x7, "a80875ab12"}, @NL80211_ATTR_KEY={0x5c, 0x50, [@NL80211_KEY_DEFAULT_TYPES={0x14, 0x8, [@NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_MULTICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_MULTICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_MULTICAST={0x4}]}, @NL80211_KEY_DEFAULT_TYPES={0x28, 0x8, [@NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_MULTICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_MULTICAST={0x4}]}, @NL80211_KEY_IDX={0x5, 0x2, 0x5}, @NL80211_KEY_DATA_WEP104={0x11, 0x1, "4d84c4e30151cb27f51a4adf63"}]}]}, 0x7c}, 0x1, 0x0, 0x0, 0x24000}, 0x40) 15:25:25 executing program 5: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000340)={'erspan0\x00', 0x0}) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000300)={'syz_tun\x00', 0x0}) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r7, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r6, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000380)=@newlink={0x34, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r8}, [@IFLA_LINKINFO={0x14, 0x12, @bridge={{0xb, 0x1, 'bridge\x00'}, {0x4}}}]}, 0x34}}, 0x0) sendmsg$nl_route(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000002700)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r5}, [@IFLA_MASTER={0x8, 0xa, r8}]}, 0x28}}, 0x0) sendmsg$nl_route(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f00000000c0)=ANY=[@ANYBLOB="2800000010000104000040000000000000001ea6", @ANYRES32=r2, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00\b\x00\n\x00', @ANYRES32=r8], 0x28}}, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r10 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r9, 0x8933, &(0x7f0000000300)={'syz_tun\x00', 0x0}) sendmsg$nl_route(r10, &(0x7f0000000000)={0x0, 0x8100, &(0x7f00000000c0)={&(0x7f0000000040)=@newlink={0x2c, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r11}, [@IFLA_BROADCAST={0xa}]}, 0x332}}, 0x0) [ 443.563879][T18799] device syz_tun left promiscuous mode [ 443.598962][T18799] bridge248: port 1(syz_tun) entered disabled state 15:25:25 executing program 0: r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000004c0)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r3, @ANYBLOB, @ANYRES32=0x0, @ANYBLOB="00000000008433df6d6f6b577d4eaaf2000007"], 0x5}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000540)=ANY=[@ANYBLOB="7400000024000705000000000000000000010000", @ANYRES32=r3, @ANYBLOB="00000000ffffffff000000000800010073667100486818973f73461919309b68e1693572bb000229c6090032d0ed64f3c3545aaf6e000085a4e4ebb5ef670000000000000000000000000000001a4e624d29a84abf03265700000000000000000000000000000000000000000000000000000000000000ac20000089b53c947244306a0216a3de887763df5b42498b13bb1938de859ee6d7ae7dd2224dc672b69b4358871b170ea0b667832e5224ee3538f885b7abd9bc4a7d"], 0x74}}, 0x0) r4 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r4, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000300)=ANY=[@ANYBLOB="840000002c00010700"/20, @ANYRES32=r3, @ANYBLOB="0008008000000000030000000800010075333200580002001400050000000000000000000000000000000000400006003c0001000000000000001020898dde66057433b6ef3a41d22be225e0001b0000000000000000000000000017256ffc66e43a2484e1a912c5998bcbf0d0000000000000000000000000000000798a3c067277da1a290b9613a33c575c36fad473382c8f5532ef3f0e1d2c450a7decbf3431a69f9b2ecb3291bed174245a962fe0484676958265e2988326a89db3139d91fe4aee6ae7e745ab00001a9f61f20500000000000000b3958bc14fce6e66a36d1ab3194534ba4e973684b27793bff837d3"], 0x84}}, 0x0) r5 = socket(0x10, 0x80002, 0x0) sendmmsg$alg(r5, &(0x7f0000000140), 0x49249249249278c, 0x0) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r6, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000500)=@newlink={0x20, 0x11, 0x40d, 0x0, 0x0, {0x0, 0x0, 0x0, r8}}, 0x20}}, 0x0) r9 = socket(0x10, 0x80002, 0x0) getsockopt$inet_sctp_SCTP_PEER_AUTH_CHUNKS(0xffffffffffffffff, 0x84, 0x1a, &(0x7f0000000940)=ANY=[@ANYRES32=0x0, @ANYBLOB='\x00'/12], &(0x7f0000000980)=0x10) r10 = socket(0xa, 0x6, 0x0) close(r10) r11 = socket$inet6_sctp(0xa, 0x10000000005, 0x84) setsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX(r11, 0x84, 0x6e, &(0x7f0000000180)=[@in6={0xa, 0x0, 0x0, @remote, 0x9}], 0x1c) getsockopt$inet_sctp6_SCTP_GET_ASSOC_ID_LIST(r11, 0x84, 0x1d, &(0x7f000095dff8)={0x1, [0x0]}, &(0x7f000095dffc)=0x8) setsockopt$inet_sctp_SCTP_RTOINFO(r10, 0x84, 0x0, &(0x7f0000000000)={r12, 0x0, 0x0, 0x1000000}, 0x10) setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(0xffffffffffffffff, 0x84, 0x9, &(0x7f0000000680)={r12, @in={{0x2, 0x4e20, @remote}}, 0x10001, 0xfff7, 0x5, 0x1, 0x8, 0x5, 0xba}, 0x9c) ioctl(r9, 0x1000008912, &(0x7f00000001c0)="080db5055e0bcfe8696071") getsockopt$inet_sctp_SCTP_PEER_AUTH_CHUNKS(r9, 0x84, 0x1a, &(0x7f0000000940)=ANY=[@ANYRES32=0x0, @ANYBLOB='\x00'/12], &(0x7f0000000980)=0x10) r13 = socket$nl_generic(0x10, 0x3, 0x10) r14 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080)='nl80211\x00') r15 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL80211_CMD_GET_STATION(r15, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000240)={0x1c, r14, 0xf2b, 0x0, 0x0, {}, [@NL80211_ATTR_AIRTIME_WEIGHT={0x8}]}, 0x1c}}, 0x0) sendmsg$NL80211_CMD_GET_MPATH(r13, &(0x7f00000001c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x2000}, 0x268, &(0x7f0000000080)={&(0x7f0000000200)={0x40, r14, 0x4, 0x70bd2d, 0x25dfdbff}, 0xff6b}, 0x1, 0x0, 0x0, 0x10049050}, 0x260448c0) sendmsg$NL80211_CMD_NEW_KEY(r9, &(0x7f0000000640)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0xb0024000}, 0xc, &(0x7f00000002c0)={&(0x7f0000000440)={0x7c, r14, 0x23, 0x70bd27, 0x25dfdbff, {}, [@NL80211_ATTR_KEY_DATA_WEP40={0x9, 0x7, "a80875ab12"}, @NL80211_ATTR_KEY={0x5c, 0x50, [@NL80211_KEY_DEFAULT_TYPES={0x14, 0x8, [@NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_MULTICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_MULTICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_MULTICAST={0x4}]}, @NL80211_KEY_DEFAULT_TYPES={0x28, 0x8, [@NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_MULTICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_MULTICAST={0x4}]}, @NL80211_KEY_IDX={0x5, 0x2, 0x5}, @NL80211_KEY_DATA_WEP104={0x11, 0x1, "4d84c4e30151cb27f51a4adf63"}]}]}, 0x7c}, 0x1, 0x0, 0x0, 0x24000}, 0x40) [ 443.757816][T18799] bridge249: port 1(syz_tun) entered blocking state [ 443.764718][T18799] bridge249: port 1(syz_tun) entered disabled state [ 443.773503][T18799] device syz_tun entered promiscuous mode [ 443.780803][T18801] bridge249: port 2(erspan0) entered blocking state [ 443.790703][T18801] bridge249: port 2(erspan0) entered disabled state [ 443.798735][T18801] device erspan0 entered promiscuous mode [ 443.813933][T18812] device syz_tun left promiscuous mode [ 443.819985][T18812] bridge238: port 1(syz_tun) entered disabled state 15:25:26 executing program 3: r0 = socket(0x21, 0xa, 0x1) r1 = socket(0x10, 0x80002, 0x0) ioctl(r1, 0x1000008912, &(0x7f00000001c0)="080db5055e0bcfe8696071") getsockopt$inet_sctp_SCTP_PEER_AUTH_CHUNKS(r1, 0x84, 0x1a, &(0x7f0000000940)=ANY=[@ANYRES32=0x0, @ANYBLOB='\x00'/12], &(0x7f0000000980)=0x10) getsockopt$inet_sctp_SCTP_GET_PEER_ADDR_INFO(r0, 0x84, 0xf, &(0x7f00000009c0)={r2, @in6={{0xa, 0x4e21, 0x8, @local, 0x401}}, 0x9, 0x1, 0x7, 0x7f, 0x6}, &(0x7f0000000a80)=0x98) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000400)='nl80211\x00') sendmsg$NL80211_CMD_GET_MESH_CONFIG(r0, &(0x7f0000000580)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x103190}, 0xc, &(0x7f0000000540)={&(0x7f0000000500)={0x34, r3, 0x10, 0x70bd2d, 0x25dfdbfe, {}, [@NL80211_ATTR_WDEV={0xc, 0x99, {0x1, 0xffffffffffffffff}}, @NL80211_ATTR_WIPHY={0x8, 0x1, 0x1}, @NL80211_ATTR_WDEV={0xc, 0x99, {0x3f, 0x3}}]}, 0x34}, 0x1, 0x0, 0x0, 0x800}, 0x40000) r4 = socket$nl_generic(0x10, 0x3, 0x10) bind$netlink(r4, &(0x7f0000000000)={0x10, 0x0, 0x25dfdbff, 0x1004280}, 0xffffffffffffffb3) sendmsg$nl_generic(r4, &(0x7f0000000080)={&(0x7f0000000480)={0x28, 0xbb7f}, 0xc, &(0x7f0000000440)={&(0x7f00000004c0)={0x1c, 0x22, 0x1, 0x0, 0x0, {0x4}, [@typed={0x8, 0xc}]}, 0x1c}}, 0x0) socket$netlink(0x10, 0x3, 0x0) r5 = socket$alg(0x26, 0x5, 0x0) bind$alg(r5, &(0x7f0000000080)={0x26, 'hash\x00', 0x0, 0x0, 'sha512\x00'}, 0x58) [ 443.927780][T18812] bridge239: port 1(syz_tun) entered blocking state [ 443.934519][T18812] bridge239: port 1(syz_tun) entered disabled state [ 443.941848][T18812] device syz_tun entered promiscuous mode [ 443.949490][T18817] bridge239: port 2(erspan0) entered blocking state [ 443.956101][T18817] bridge239: port 2(erspan0) entered disabled state [ 443.964655][T18817] device erspan0 entered promiscuous mode 15:25:26 executing program 2: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000340)={'erspan0\x00', 0x0}) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000300)={'syz_tun\x00', 0x0}) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r7, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r6, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000380)=@newlink={0x34, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r8}, [@IFLA_LINKINFO={0x14, 0x12, @bridge={{0xb, 0x1, 'bridge\x00'}, {0x4}}}]}, 0x34}}, 0x0) sendmsg$nl_route(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000002700)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r5}, [@IFLA_MASTER={0x8, 0xa, r8}]}, 0x28}}, 0x0) sendmsg$nl_route(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f00000000c0)=ANY=[@ANYBLOB="2800000010000104000040000000000000001ea6", @ANYRES32=r2, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00\b\x00\n\x00', @ANYRES32=r8], 0x28}}, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r10 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r9, 0x8933, &(0x7f0000000300)={'syz_tun\x00', 0x0}) sendmsg$nl_route(r10, &(0x7f0000000000)={0x0, 0xf000, &(0x7f00000000c0)={&(0x7f0000000040)=@newlink={0x2c, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r11}, [@IFLA_BROADCAST={0xa}]}, 0x332}}, 0x0) [ 443.999456][T18812] device syz_tun left promiscuous mode [ 444.018895][T18812] bridge239: port 1(syz_tun) entered disabled state 15:25:26 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000004c0)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r3, @ANYBLOB="0000000000000000280012000c0001007665", @ANYRES32=0x0, @ANYBLOB="00000000008433df6d6f6b577d4eaaf2000007"], 0x5}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000540)=ANY=[@ANYBLOB="7400000024000705000000000000000000010000", @ANYRES32=r3, @ANYBLOB="00000000ffffffff000000000800010073667100486818973f73461919309b68e1693572bb000229c6090032d0ed64f3c3545aaf6e000085a4e4ebb5ef670000000000000000000000000000001a4e624d29a84abf03265700000000000000000000000000000000000000000000000000000000000000ac20000089b53c947244306a0216a3de887763df5b42498b13bb1938de859ee6d7ae7dd2224dc672b69b4358871b170ea0b667832e5224ee3538f885b7abd9bc4a7d"], 0x74}}, 0x0) r4 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r4, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000300)=ANY=[@ANYBLOB="840000002c00010700"/20, @ANYRES32=r3, @ANYBLOB="0008008000000000030000000800010075333200580002001400050000000000000000000000000000000000400006003c0001000000000000001020898dde66057433b6ef3a41d22be225e0001b0000000000000000000000000017256ffc66e43a2484e1a912c5998bcbf0d0000000000000000000000000000000798a3c067277da1a290b9613a33c575c36fad473382c8f5532ef3f0e1d2c450a7decbf3431a69f9b2ecb3291bed174245a962fe0484676958265e2988326a89db3139d91fe4aee6ae7e745ab00001a9f61f20500000000000000b3958bc14fce6e66a36d1ab3194534ba4e973684b27793bff837d3"], 0x84}}, 0x0) r5 = socket(0x10, 0x80002, 0x0) sendmmsg$alg(r5, &(0x7f0000000140), 0x49249249249278c, 0x0) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r6, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000500)=@newlink={0x20, 0x11, 0x40d, 0x0, 0x0, {0x0, 0x0, 0x0, r8}}, 0x20}}, 0x0) r9 = socket(0x10, 0x80002, 0x0) getsockopt$inet_sctp_SCTP_PEER_AUTH_CHUNKS(0xffffffffffffffff, 0x84, 0x1a, &(0x7f0000000940)=ANY=[@ANYRES32=0x0, @ANYBLOB='\x00'/12], &(0x7f0000000980)=0x10) r10 = socket(0xa, 0x6, 0x0) close(r10) r11 = socket$inet6_sctp(0xa, 0x10000000005, 0x84) setsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX(r11, 0x84, 0x6e, &(0x7f0000000180)=[@in6={0xa, 0x0, 0x0, @remote, 0x9}], 0x1c) getsockopt$inet_sctp6_SCTP_GET_ASSOC_ID_LIST(r11, 0x84, 0x1d, &(0x7f000095dff8)={0x1, [0x0]}, &(0x7f000095dffc)=0x8) setsockopt$inet_sctp_SCTP_RTOINFO(r10, 0x84, 0x0, &(0x7f0000000000)={r12, 0x0, 0x0, 0x1000000}, 0x10) setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(0xffffffffffffffff, 0x84, 0x9, &(0x7f0000000680)={r12, @in={{0x2, 0x4e20, @remote}}, 0x10001, 0xfff7, 0x5, 0x1, 0x8, 0x5, 0xba}, 0x9c) ioctl(r9, 0x1000008912, &(0x7f00000001c0)="080db5055e0bcfe8696071") getsockopt$inet_sctp_SCTP_PEER_AUTH_CHUNKS(r9, 0x84, 0x1a, &(0x7f0000000940)=ANY=[@ANYRES32=0x0, @ANYBLOB='\x00'/12], &(0x7f0000000980)=0x10) r13 = socket$nl_generic(0x10, 0x3, 0x10) r14 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080)='nl80211\x00') r15 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL80211_CMD_GET_STATION(r15, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000240)={0x1c, r14, 0xf2b, 0x0, 0x0, {}, [@NL80211_ATTR_AIRTIME_WEIGHT={0x8}]}, 0x1c}}, 0x0) sendmsg$NL80211_CMD_GET_MPATH(r13, &(0x7f00000001c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x2000}, 0x268, &(0x7f0000000080)={&(0x7f0000000200)={0x40, r14, 0x4, 0x70bd2d, 0x25dfdbff}, 0xff6b}, 0x1, 0x0, 0x0, 0x10049050}, 0x260448c0) sendmsg$NL80211_CMD_NEW_KEY(r9, &(0x7f0000000640)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0xb0024000}, 0xc, &(0x7f00000002c0)={&(0x7f0000000440)={0x7c, r14, 0x23, 0x70bd27, 0x25dfdbff, {}, [@NL80211_ATTR_KEY_DATA_WEP40={0x9, 0x7, "a80875ab12"}, @NL80211_ATTR_KEY={0x5c, 0x50, [@NL80211_KEY_DEFAULT_TYPES={0x14, 0x8, [@NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_MULTICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_MULTICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_MULTICAST={0x4}]}, @NL80211_KEY_DEFAULT_TYPES={0x28, 0x8, [@NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_MULTICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_MULTICAST={0x4}]}, @NL80211_KEY_IDX={0x5, 0x2, 0x5}, @NL80211_KEY_DATA_WEP104={0x11, 0x1, "4d84c4e30151cb27f51a4adf63"}]}]}, 0x7c}, 0x1, 0x0, 0x0, 0x24000}, 0x40) 15:25:26 executing program 5: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000340)={'erspan0\x00', 0x0}) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000300)={'syz_tun\x00', 0x0}) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r7, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r6, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000380)=@newlink={0x34, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r8}, [@IFLA_LINKINFO={0x14, 0x12, @bridge={{0xb, 0x1, 'bridge\x00'}, {0x4}}}]}, 0x34}}, 0x0) sendmsg$nl_route(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000002700)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r5}, [@IFLA_MASTER={0x8, 0xa, r8}]}, 0x28}}, 0x0) sendmsg$nl_route(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f00000000c0)=ANY=[@ANYBLOB="2800000010000104000040000000000000001ea6", @ANYRES32=r2, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00\b\x00\n\x00', @ANYRES32=r8], 0x28}}, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r10 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r9, 0x8933, &(0x7f0000000300)={'syz_tun\x00', 0x0}) sendmsg$nl_route(r10, &(0x7f0000000000)={0x0, 0xf000, &(0x7f00000000c0)={&(0x7f0000000040)=@newlink={0x2c, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r11}, [@IFLA_BROADCAST={0xa}]}, 0x332}}, 0x0) 15:25:26 executing program 3: r0 = socket(0x21, 0xa, 0x1) r1 = socket(0x10, 0x80002, 0x0) ioctl(r1, 0x1000008912, &(0x7f00000001c0)="080db5055e0bcfe8696071") getsockopt$inet_sctp_SCTP_PEER_AUTH_CHUNKS(r1, 0x84, 0x1a, &(0x7f0000000940)=ANY=[@ANYRES32=0x0, @ANYBLOB='\x00'/12], &(0x7f0000000980)=0x10) getsockopt$inet_sctp_SCTP_GET_PEER_ADDR_INFO(r0, 0x84, 0xf, &(0x7f00000009c0)={r2, @in6={{0xa, 0x4e21, 0x8, @local, 0x401}}, 0x9, 0x1, 0x7, 0x7f, 0x6}, &(0x7f0000000a80)=0x98) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000400)='nl80211\x00') sendmsg$NL80211_CMD_GET_MESH_CONFIG(r0, &(0x7f0000000580)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x103190}, 0xc, &(0x7f0000000540)={&(0x7f0000000500)={0x34, r3, 0x10, 0x70bd2d, 0x25dfdbfe, {}, [@NL80211_ATTR_WDEV={0xc, 0x99, {0x1, 0xffffffffffffffff}}, @NL80211_ATTR_WIPHY={0x8, 0x1, 0x1}, @NL80211_ATTR_WDEV={0xc, 0x99, {0x3f, 0x3}}]}, 0x34}, 0x1, 0x0, 0x0, 0x800}, 0x40000) r4 = socket$nl_generic(0x10, 0x3, 0x10) bind$netlink(r4, &(0x7f0000000000)={0x10, 0x0, 0x25dfdbff, 0x1004280}, 0xffffffffffffffb3) sendmsg$nl_generic(r4, &(0x7f0000000080)={&(0x7f0000000480)={0x2f, 0xbb7f}, 0xc, &(0x7f0000000440)={&(0x7f00000004c0)={0x1c, 0x22, 0x1, 0x0, 0x0, {0x4}, [@typed={0x8, 0xc}]}, 0x1c}}, 0x0) socket$netlink(0x10, 0x3, 0x0) r5 = socket$alg(0x26, 0x5, 0x0) bind$alg(r5, &(0x7f0000000080)={0x26, 'hash\x00', 0x0, 0x0, 'sha512\x00'}, 0x58) [ 444.162090][T18840] device syz_tun left promiscuous mode [ 444.174975][T18840] bridge249: port 1(syz_tun) entered disabled state [ 444.337762][T18840] bridge250: port 1(syz_tun) entered blocking state [ 444.344520][T18840] bridge250: port 1(syz_tun) entered disabled state [ 444.354047][T18840] device syz_tun entered promiscuous mode [ 444.361215][T18835] device erspan0 left promiscuous mode [ 444.366773][T18835] bridge249: port 2(erspan0) entered disabled state 15:25:26 executing program 4: r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000004c0)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r3, @ANYBLOB, @ANYRES32=0x0, @ANYBLOB="00000000008433df6d6f6b577d4eaaf2000007"], 0x5}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000540)=ANY=[@ANYBLOB="7400000024000705000000000000000000010000", @ANYRES32=r3, @ANYBLOB="00000000ffffffff000000000800010073667100486818973f73461919309b68e1693572bb000229c6090032d0ed64f3c3545aaf6e000085a4e4ebb5ef670000000000000000000000000000001a4e624d29a84abf03265700000000000000000000000000000000000000000000000000000000000000ac20000089b53c947244306a0216a3de887763df5b42498b13bb1938de859ee6d7ae7dd2224dc672b69b4358871b170ea0b667832e5224ee3538f885b7abd9bc4a7d"], 0x74}}, 0x0) r4 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r4, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000300)=ANY=[@ANYBLOB="840000002c00010700"/20, @ANYRES32=r3, @ANYBLOB="0008008000000000030000000800010075333200580002001400050000000000000000000000000000000000400006003c0001000000000000001020898dde66057433b6ef3a41d22be225e0001b0000000000000000000000000017256ffc66e43a2484e1a912c5998bcbf0d0000000000000000000000000000000798a3c067277da1a290b9613a33c575c36fad473382c8f5532ef3f0e1d2c450a7decbf3431a69f9b2ecb3291bed174245a962fe0484676958265e2988326a89db3139d91fe4aee6ae7e745ab00001a9f61f20500000000000000b3958bc14fce6e66a36d1ab3194534ba4e973684b27793bff837d3"], 0x84}}, 0x0) r5 = socket(0x10, 0x80002, 0x0) sendmmsg$alg(r5, &(0x7f0000000140), 0x49249249249278c, 0x0) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r6, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000500)=@newlink={0x20, 0x11, 0x40d, 0x0, 0x0, {0x0, 0x0, 0x0, r8}}, 0x20}}, 0x0) r9 = socket(0x10, 0x80002, 0x0) getsockopt$inet_sctp_SCTP_PEER_AUTH_CHUNKS(0xffffffffffffffff, 0x84, 0x1a, &(0x7f0000000940)=ANY=[@ANYRES32=0x0, @ANYBLOB='\x00'/12], &(0x7f0000000980)=0x10) r10 = socket(0xa, 0x6, 0x0) close(r10) r11 = socket$inet6_sctp(0xa, 0x10000000005, 0x84) setsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX(r11, 0x84, 0x6e, &(0x7f0000000180)=[@in6={0xa, 0x0, 0x0, @remote, 0x9}], 0x1c) getsockopt$inet_sctp6_SCTP_GET_ASSOC_ID_LIST(r11, 0x84, 0x1d, &(0x7f000095dff8)={0x1, [0x0]}, &(0x7f000095dffc)=0x8) setsockopt$inet_sctp_SCTP_RTOINFO(r10, 0x84, 0x0, &(0x7f0000000000)={r12, 0x0, 0x0, 0x1000000}, 0x10) setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(0xffffffffffffffff, 0x84, 0x9, &(0x7f0000000680)={r12, @in={{0x2, 0x4e20, @remote}}, 0x10001, 0xfff7, 0x5, 0x1, 0x8, 0x5, 0xba}, 0x9c) ioctl(r9, 0x1000008912, &(0x7f00000001c0)="080db5055e0bcfe8696071") getsockopt$inet_sctp_SCTP_PEER_AUTH_CHUNKS(r9, 0x84, 0x1a, &(0x7f0000000940)=ANY=[@ANYRES32=0x0, @ANYBLOB='\x00'/12], &(0x7f0000000980)=0x10) r13 = socket$nl_generic(0x10, 0x3, 0x10) r14 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080)='nl80211\x00') r15 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL80211_CMD_GET_STATION(r15, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000240)={0x1c, r14, 0xf2b, 0x0, 0x0, {}, [@NL80211_ATTR_AIRTIME_WEIGHT={0x8}]}, 0x1c}}, 0x0) sendmsg$NL80211_CMD_GET_MPATH(r13, &(0x7f00000001c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x2000}, 0x268, &(0x7f0000000080)={&(0x7f0000000200)={0x40, r14, 0x4, 0x70bd2d, 0x25dfdbff}, 0xff6b}, 0x1, 0x0, 0x0, 0x10049050}, 0x260448c0) sendmsg$NL80211_CMD_NEW_KEY(r9, &(0x7f0000000640)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0xb0024000}, 0xc, &(0x7f00000002c0)={&(0x7f0000000440)={0x7c, r14, 0x23, 0x70bd27, 0x25dfdbff, {}, [@NL80211_ATTR_KEY_DATA_WEP40={0x9, 0x7, "a80875ab12"}, @NL80211_ATTR_KEY={0x5c, 0x50, [@NL80211_KEY_DEFAULT_TYPES={0x14, 0x8, [@NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_MULTICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_MULTICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_MULTICAST={0x4}]}, @NL80211_KEY_DEFAULT_TYPES={0x28, 0x8, [@NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_MULTICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_MULTICAST={0x4}]}, @NL80211_KEY_IDX={0x5, 0x2, 0x5}, @NL80211_KEY_DATA_WEP104={0x11, 0x1, "4d84c4e30151cb27f51a4adf63"}]}]}, 0x7c}, 0x1, 0x0, 0x0, 0x24000}, 0x40) [ 444.479970][T18835] bridge250: port 2(erspan0) entered blocking state [ 444.486869][T18835] bridge250: port 2(erspan0) entered disabled state [ 444.494619][T18835] device erspan0 entered promiscuous mode [ 444.511283][T18853] bridge240: port 1(syz_tun) entered blocking state [ 444.519139][T18853] bridge240: port 1(syz_tun) entered disabled state 15:25:26 executing program 0: r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000004c0)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r3, @ANYBLOB, @ANYRES32=0x0, @ANYBLOB="00000000008433df6d6f6b577d4eaaf2000007"], 0x5}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000540)=ANY=[@ANYBLOB="7400000024000705000000000000000000010000", @ANYRES32=r3, @ANYBLOB="00000000ffffffff000000000800010073667100486818973f73461919309b68e1693572bb000229c6090032d0ed64f3c3545aaf6e000085a4e4ebb5ef670000000000000000000000000000001a4e624d29a84abf03265700000000000000000000000000000000000000000000000000000000000000ac20000089b53c947244306a0216a3de887763df5b42498b13bb1938de859ee6d7ae7dd2224dc672b69b4358871b170ea0b667832e5224ee3538f885b7abd9bc4a7d"], 0x74}}, 0x0) r4 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r4, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000300)=ANY=[@ANYBLOB="840000002c00010700"/20, @ANYRES32=r3, @ANYBLOB="0008008000000000030000000800010075333200580002001400050000000000000000000000000000000000400006003c0001000000000000001020898dde66057433b6ef3a41d22be225e0001b0000000000000000000000000017256ffc66e43a2484e1a912c5998bcbf0d0000000000000000000000000000000798a3c067277da1a290b9613a33c575c36fad473382c8f5532ef3f0e1d2c450a7decbf3431a69f9b2ecb3291bed174245a962fe0484676958265e2988326a89db3139d91fe4aee6ae7e745ab00001a9f61f20500000000000000b3958bc14fce6e66a36d1ab3194534ba4e973684b27793bff837d3"], 0x84}}, 0x0) r5 = socket(0x10, 0x80002, 0x0) sendmmsg$alg(r5, &(0x7f0000000140), 0x49249249249278c, 0x0) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r6, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000500)=@newlink={0x20, 0x11, 0x40d, 0x0, 0x0, {0x0, 0x0, 0x0, r8}}, 0x20}}, 0x0) r9 = socket(0x10, 0x80002, 0x0) getsockopt$inet_sctp_SCTP_PEER_AUTH_CHUNKS(0xffffffffffffffff, 0x84, 0x1a, &(0x7f0000000940)=ANY=[@ANYRES32=0x0, @ANYBLOB='\x00'/12], &(0x7f0000000980)=0x10) r10 = socket(0xa, 0x6, 0x0) close(r10) r11 = socket$inet6_sctp(0xa, 0x10000000005, 0x84) setsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX(r11, 0x84, 0x6e, &(0x7f0000000180)=[@in6={0xa, 0x0, 0x0, @remote, 0x9}], 0x1c) getsockopt$inet_sctp6_SCTP_GET_ASSOC_ID_LIST(r11, 0x84, 0x1d, &(0x7f000095dff8)={0x1, [0x0]}, &(0x7f000095dffc)=0x8) setsockopt$inet_sctp_SCTP_RTOINFO(r10, 0x84, 0x0, &(0x7f0000000000)={r12, 0x0, 0x0, 0x1000000}, 0x10) setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(0xffffffffffffffff, 0x84, 0x9, &(0x7f0000000680)={r12, @in={{0x2, 0x4e20, @remote}}, 0x10001, 0xfff7, 0x5, 0x1, 0x8, 0x5, 0xba}, 0x9c) ioctl(r9, 0x1000008912, &(0x7f00000001c0)="080db5055e0bcfe8696071") getsockopt$inet_sctp_SCTP_PEER_AUTH_CHUNKS(r9, 0x84, 0x1a, &(0x7f0000000940)=ANY=[@ANYRES32=0x0, @ANYBLOB='\x00'/12], &(0x7f0000000980)=0x10) r13 = socket$nl_generic(0x10, 0x3, 0x10) r14 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080)='nl80211\x00') r15 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL80211_CMD_GET_STATION(r15, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000240)={0x1c, r14, 0xf2b, 0x0, 0x0, {}, [@NL80211_ATTR_AIRTIME_WEIGHT={0x8}]}, 0x1c}}, 0x0) sendmsg$NL80211_CMD_GET_MPATH(r13, &(0x7f00000001c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x2000}, 0x268, &(0x7f0000000080)={&(0x7f0000000200)={0x40, r14, 0x4, 0x70bd2d, 0x25dfdbff}, 0xff6b}, 0x1, 0x0, 0x0, 0x10049050}, 0x260448c0) sendmsg$NL80211_CMD_NEW_KEY(r9, &(0x7f0000000640)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0xb0024000}, 0xc, &(0x7f00000002c0)={&(0x7f0000000440)={0x7c, r14, 0x23, 0x70bd27, 0x25dfdbff, {}, [@NL80211_ATTR_KEY_DATA_WEP40={0x9, 0x7, "a80875ab12"}, @NL80211_ATTR_KEY={0x5c, 0x50, [@NL80211_KEY_DEFAULT_TYPES={0x14, 0x8, [@NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_MULTICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_MULTICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_MULTICAST={0x4}]}, @NL80211_KEY_DEFAULT_TYPES={0x28, 0x8, [@NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_MULTICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_MULTICAST={0x4}]}, @NL80211_KEY_IDX={0x5, 0x2, 0x5}, @NL80211_KEY_DATA_WEP104={0x11, 0x1, "4d84c4e30151cb27f51a4adf63"}]}]}, 0x7c}, 0x1, 0x0, 0x0, 0x24000}, 0x40) [ 444.526667][T18853] device syz_tun entered promiscuous mode [ 444.536008][T18855] device erspan0 left promiscuous mode [ 444.544026][T18855] bridge239: port 2(erspan0) entered disabled state 15:25:26 executing program 3: r0 = socket(0x21, 0xa, 0x1) r1 = socket(0x10, 0x80002, 0x0) ioctl(r1, 0x1000008912, &(0x7f00000001c0)="080db5055e0bcfe8696071") getsockopt$inet_sctp_SCTP_PEER_AUTH_CHUNKS(r1, 0x84, 0x1a, &(0x7f0000000940)=ANY=[@ANYRES32=0x0, @ANYBLOB='\x00'/12], &(0x7f0000000980)=0x10) getsockopt$inet_sctp_SCTP_GET_PEER_ADDR_INFO(r0, 0x84, 0xf, &(0x7f00000009c0)={r2, @in6={{0xa, 0x4e21, 0x8, @local, 0x401}}, 0x9, 0x1, 0x7, 0x7f, 0x6}, &(0x7f0000000a80)=0x98) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000400)='nl80211\x00') sendmsg$NL80211_CMD_GET_MESH_CONFIG(r0, &(0x7f0000000580)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x103190}, 0xc, &(0x7f0000000540)={&(0x7f0000000500)={0x34, r3, 0x10, 0x70bd2d, 0x25dfdbfe, {}, [@NL80211_ATTR_WDEV={0xc, 0x99, {0x1, 0xffffffffffffffff}}, @NL80211_ATTR_WIPHY={0x8, 0x1, 0x1}, @NL80211_ATTR_WDEV={0xc, 0x99, {0x3f, 0x3}}]}, 0x34}, 0x1, 0x0, 0x0, 0x800}, 0x40000) r4 = socket$nl_generic(0x10, 0x3, 0x10) bind$netlink(r4, &(0x7f0000000000)={0x10, 0x0, 0x25dfdbff, 0x1004280}, 0xffffffffffffffb3) sendmsg$nl_generic(r4, &(0x7f0000000080)={&(0x7f0000000480)={0x6558, 0xbb7f}, 0xc, &(0x7f0000000440)={&(0x7f00000004c0)={0x1c, 0x22, 0x1, 0x0, 0x0, {0x4}, [@typed={0x8, 0xc}]}, 0x1c}}, 0x0) socket$netlink(0x10, 0x3, 0x0) r5 = socket$alg(0x26, 0x5, 0x0) bind$alg(r5, &(0x7f0000000080)={0x26, 'hash\x00', 0x0, 0x0, 'sha512\x00'}, 0x58) [ 444.637729][T18855] bridge240: port 2(erspan0) entered blocking state [ 444.644533][T18855] bridge240: port 2(erspan0) entered disabled state [ 444.651998][T18855] device erspan0 entered promiscuous mode [ 444.668039][T18846] device erspan0 left promiscuous mode [ 444.674900][T18846] bridge250: port 2(erspan0) entered disabled state 15:25:26 executing program 2: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000340)={'erspan0\x00', 0x0}) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000300)={'syz_tun\x00', 0x0}) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r7, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r6, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000380)=@newlink={0x34, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r8}, [@IFLA_LINKINFO={0x14, 0x12, @bridge={{0xb, 0x1, 'bridge\x00'}, {0x4}}}]}, 0x34}}, 0x0) sendmsg$nl_route(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000002700)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r5}, [@IFLA_MASTER={0x8, 0xa, r8}]}, 0x28}}, 0x0) sendmsg$nl_route(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f00000000c0)=ANY=[@ANYBLOB="2800000010000104000040000000000000001ea6", @ANYRES32=r2, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00\b\x00\n\x00', @ANYRES32=r8], 0x28}}, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r10 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r9, 0x8933, &(0x7f0000000300)={'syz_tun\x00', 0x0}) sendmsg$nl_route(r10, &(0x7f0000000000)={0x0, 0xf0ffff, &(0x7f00000000c0)={&(0x7f0000000040)=@newlink={0x2c, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r11}, [@IFLA_BROADCAST={0xa}]}, 0x332}}, 0x0) 15:25:26 executing program 5: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000340)={'erspan0\x00', 0x0}) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000300)={'syz_tun\x00', 0x0}) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r7, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r6, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000380)=@newlink={0x34, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r8}, [@IFLA_LINKINFO={0x14, 0x12, @bridge={{0xb, 0x1, 'bridge\x00'}, {0x4}}}]}, 0x34}}, 0x0) sendmsg$nl_route(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000002700)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r5}, [@IFLA_MASTER={0x8, 0xa, r8}]}, 0x28}}, 0x0) sendmsg$nl_route(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f00000000c0)=ANY=[@ANYBLOB="2800000010000104000040000000000000001ea6", @ANYRES32=r2, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00\b\x00\n\x00', @ANYRES32=r8], 0x28}}, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r10 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r9, 0x8933, &(0x7f0000000300)={'syz_tun\x00', 0x0}) sendmsg$nl_route(r10, &(0x7f0000000000)={0x0, 0xf0ffff, &(0x7f00000000c0)={&(0x7f0000000040)=@newlink={0x2c, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r11}, [@IFLA_BROADCAST={0xa}]}, 0x332}}, 0x0) 15:25:26 executing program 3: r0 = socket(0x21, 0xa, 0x1) r1 = socket(0x10, 0x80002, 0x0) ioctl(r1, 0x1000008912, &(0x7f00000001c0)="080db5055e0bcfe8696071") getsockopt$inet_sctp_SCTP_PEER_AUTH_CHUNKS(r1, 0x84, 0x1a, &(0x7f0000000940)=ANY=[@ANYRES32=0x0, @ANYBLOB='\x00'/12], &(0x7f0000000980)=0x10) getsockopt$inet_sctp_SCTP_GET_PEER_ADDR_INFO(r0, 0x84, 0xf, &(0x7f00000009c0)={r2, @in6={{0xa, 0x4e21, 0x8, @local, 0x401}}, 0x9, 0x1, 0x7, 0x7f, 0x6}, &(0x7f0000000a80)=0x98) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000400)='nl80211\x00') sendmsg$NL80211_CMD_GET_MESH_CONFIG(r0, &(0x7f0000000580)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x103190}, 0xc, &(0x7f0000000540)={&(0x7f0000000500)={0x34, r3, 0x10, 0x70bd2d, 0x25dfdbfe, {}, [@NL80211_ATTR_WDEV={0xc, 0x99, {0x1, 0xffffffffffffffff}}, @NL80211_ATTR_WIPHY={0x8, 0x1, 0x1}, @NL80211_ATTR_WDEV={0xc, 0x99, {0x3f, 0x3}}]}, 0x34}, 0x1, 0x0, 0x0, 0x800}, 0x40000) r4 = socket$nl_generic(0x10, 0x3, 0x10) bind$netlink(r4, &(0x7f0000000000)={0x10, 0x0, 0x25dfdbff, 0x1004280}, 0xffffffffffffffb3) sendmsg$nl_generic(r4, &(0x7f0000000080)={&(0x7f0000000480)={0x8100, 0xbb7f}, 0xc, &(0x7f0000000440)={&(0x7f00000004c0)={0x1c, 0x22, 0x1, 0x0, 0x0, {0x4}, [@typed={0x8, 0xc}]}, 0x1c}}, 0x0) socket$netlink(0x10, 0x3, 0x0) r5 = socket$alg(0x26, 0x5, 0x0) bind$alg(r5, &(0x7f0000000080)={0x26, 'hash\x00', 0x0, 0x0, 'sha512\x00'}, 0x58) 15:25:26 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000004c0)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r3, @ANYBLOB="0000000000000000280012000c0001007665", @ANYRES32=0x0, @ANYBLOB="00000000008433df6d6f6b577d4eaaf2000007"], 0x5}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000540)=ANY=[@ANYBLOB="7400000024000705000000000000000000010000", @ANYRES32=r3, @ANYBLOB="00000000ffffffff000000000800010073667100486818973f73461919309b68e1693572bb000229c6090032d0ed64f3c3545aaf6e000085a4e4ebb5ef670000000000000000000000000000001a4e624d29a84abf03265700000000000000000000000000000000000000000000000000000000000000ac20000089b53c947244306a0216a3de887763df5b42498b13bb1938de859ee6d7ae7dd2224dc672b69b4358871b170ea0b667832e5224ee3538f885b7abd9bc4a7d"], 0x74}}, 0x0) r4 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r4, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000300)=ANY=[@ANYBLOB="840000002c00010700"/20, @ANYRES32=r3, @ANYBLOB="0008008000000000030000000800010075333200580002001400050000000000000000000000000000000000400006003c0001000000000000001020898dde66057433b6ef3a41d22be225e0001b0000000000000000000000000017256ffc66e43a2484e1a912c5998bcbf0d0000000000000000000000000000000798a3c067277da1a290b9613a33c575c36fad473382c8f5532ef3f0e1d2c450a7decbf3431a69f9b2ecb3291bed174245a962fe0484676958265e2988326a89db3139d91fe4aee6ae7e745ab00001a9f61f20500000000000000b3958bc14fce6e66a36d1ab3194534ba4e973684b27793bff837d3"], 0x84}}, 0x0) r5 = socket(0x10, 0x80002, 0x0) sendmmsg$alg(r5, &(0x7f0000000140), 0x49249249249278c, 0x0) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r6, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000500)=@newlink={0x20, 0x11, 0x40d, 0x0, 0x0, {0x0, 0x0, 0x0, r8}}, 0x20}}, 0x0) r9 = socket(0x10, 0x80002, 0x0) getsockopt$inet_sctp_SCTP_PEER_AUTH_CHUNKS(0xffffffffffffffff, 0x84, 0x1a, &(0x7f0000000940)=ANY=[@ANYRES32=0x0, @ANYBLOB='\x00'/12], &(0x7f0000000980)=0x10) r10 = socket(0xa, 0x6, 0x0) close(r10) r11 = socket$inet6_sctp(0xa, 0x10000000005, 0x84) setsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX(r11, 0x84, 0x6e, &(0x7f0000000180)=[@in6={0xa, 0x0, 0x0, @remote, 0x9}], 0x1c) getsockopt$inet_sctp6_SCTP_GET_ASSOC_ID_LIST(r11, 0x84, 0x1d, &(0x7f000095dff8)={0x1, [0x0]}, &(0x7f000095dffc)=0x8) setsockopt$inet_sctp_SCTP_RTOINFO(r10, 0x84, 0x0, &(0x7f0000000000)={r12, 0x0, 0x0, 0x1000000}, 0x10) setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(0xffffffffffffffff, 0x84, 0x9, &(0x7f0000000680)={r12, @in={{0x2, 0x4e20, @remote}}, 0x10001, 0xfff7, 0x5, 0x1, 0x8, 0x5, 0xba}, 0x9c) ioctl(r9, 0x1000008912, &(0x7f00000001c0)="080db5055e0bcfe8696071") getsockopt$inet_sctp_SCTP_PEER_AUTH_CHUNKS(r9, 0x84, 0x1a, &(0x7f0000000940)=ANY=[@ANYRES32=0x0, @ANYBLOB='\x00'/12], &(0x7f0000000980)=0x10) r13 = socket$nl_generic(0x10, 0x3, 0x10) r14 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080)='nl80211\x00') r15 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL80211_CMD_GET_STATION(r15, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000240)={0x1c, r14, 0xf2b, 0x0, 0x0, {}, [@NL80211_ATTR_AIRTIME_WEIGHT={0x8}]}, 0x1c}}, 0x0) sendmsg$NL80211_CMD_GET_MPATH(r13, &(0x7f00000001c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x2000}, 0x268, &(0x7f0000000080)={&(0x7f0000000200)={0x40, r14, 0x4, 0x70bd2d, 0x25dfdbff}, 0xff6b}, 0x1, 0x0, 0x0, 0x10049050}, 0x260448c0) sendmsg$NL80211_CMD_NEW_KEY(r9, &(0x7f0000000640)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0xb0024000}, 0xc, &(0x7f00000002c0)={&(0x7f0000000440)={0x7c, r14, 0x23, 0x70bd27, 0x25dfdbff, {}, [@NL80211_ATTR_KEY_DATA_WEP40={0x9, 0x7, "a80875ab12"}, @NL80211_ATTR_KEY={0x5c, 0x50, [@NL80211_KEY_DEFAULT_TYPES={0x14, 0x8, [@NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_MULTICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_MULTICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_MULTICAST={0x4}]}, @NL80211_KEY_DEFAULT_TYPES={0x28, 0x8, [@NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_MULTICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_MULTICAST={0x4}]}, @NL80211_KEY_IDX={0x5, 0x2, 0x5}, @NL80211_KEY_DATA_WEP104={0x11, 0x1, "4d84c4e30151cb27f51a4adf63"}]}]}, 0x7c}, 0x1, 0x0, 0x0, 0x24000}, 0x40) [ 444.865438][T18880] device syz_tun left promiscuous mode [ 444.877862][T18880] bridge250: port 1(syz_tun) entered disabled state [ 444.999456][T18880] bridge251: port 1(syz_tun) entered blocking state [ 445.006221][T18880] bridge251: port 1(syz_tun) entered disabled state [ 445.014485][T18880] device syz_tun entered promiscuous mode [ 445.026342][T18887] bridge251: port 2(erspan0) entered blocking state [ 445.033515][T18887] bridge251: port 2(erspan0) entered disabled state [ 445.041149][T18887] device erspan0 entered promiscuous mode [ 445.049911][T18888] device syz_tun left promiscuous mode [ 445.059432][T18888] bridge240: port 1(syz_tun) entered disabled state [ 445.197785][T18888] bridge241: port 1(syz_tun) entered blocking state [ 445.206592][T18888] bridge241: port 1(syz_tun) entered disabled state [ 445.214530][T18888] device syz_tun entered promiscuous mode [ 445.223937][T18894] device erspan0 left promiscuous mode [ 445.230015][T18894] bridge240: port 2(erspan0) entered disabled state 15:25:27 executing program 4: r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000004c0)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r3, @ANYBLOB, @ANYRES32=0x0, @ANYBLOB="00000000008433df6d6f6b577d4eaaf2000007"], 0x5}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000540)=ANY=[@ANYBLOB="7400000024000705000000000000000000010000", @ANYRES32=r3, @ANYBLOB="00000000ffffffff000000000800010073667100486818973f73461919309b68e1693572bb000229c6090032d0ed64f3c3545aaf6e000085a4e4ebb5ef670000000000000000000000000000001a4e624d29a84abf03265700000000000000000000000000000000000000000000000000000000000000ac20000089b53c947244306a0216a3de887763df5b42498b13bb1938de859ee6d7ae7dd2224dc672b69b4358871b170ea0b667832e5224ee3538f885b7abd9bc4a7d"], 0x74}}, 0x0) r4 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r4, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000300)=ANY=[@ANYBLOB="840000002c00010700"/20, @ANYRES32=r3, @ANYBLOB="0008008000000000030000000800010075333200580002001400050000000000000000000000000000000000400006003c0001000000000000001020898dde66057433b6ef3a41d22be225e0001b0000000000000000000000000017256ffc66e43a2484e1a912c5998bcbf0d0000000000000000000000000000000798a3c067277da1a290b9613a33c575c36fad473382c8f5532ef3f0e1d2c450a7decbf3431a69f9b2ecb3291bed174245a962fe0484676958265e2988326a89db3139d91fe4aee6ae7e745ab00001a9f61f20500000000000000b3958bc14fce6e66a36d1ab3194534ba4e973684b27793bff837d3"], 0x84}}, 0x0) r5 = socket(0x10, 0x80002, 0x0) sendmmsg$alg(r5, &(0x7f0000000140), 0x49249249249278c, 0x0) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r6, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000500)=@newlink={0x20, 0x11, 0x40d, 0x0, 0x0, {0x0, 0x0, 0x0, r8}}, 0x20}}, 0x0) r9 = socket(0x10, 0x80002, 0x0) getsockopt$inet_sctp_SCTP_PEER_AUTH_CHUNKS(0xffffffffffffffff, 0x84, 0x1a, &(0x7f0000000940)=ANY=[@ANYRES32=0x0, @ANYBLOB='\x00'/12], &(0x7f0000000980)=0x10) r10 = socket(0xa, 0x6, 0x0) close(r10) r11 = socket$inet6_sctp(0xa, 0x10000000005, 0x84) setsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX(r11, 0x84, 0x6e, &(0x7f0000000180)=[@in6={0xa, 0x0, 0x0, @remote, 0x9}], 0x1c) getsockopt$inet_sctp6_SCTP_GET_ASSOC_ID_LIST(r11, 0x84, 0x1d, &(0x7f000095dff8)={0x1, [0x0]}, &(0x7f000095dffc)=0x8) setsockopt$inet_sctp_SCTP_RTOINFO(r10, 0x84, 0x0, &(0x7f0000000000)={r12, 0x0, 0x0, 0x1000000}, 0x10) setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(0xffffffffffffffff, 0x84, 0x9, &(0x7f0000000680)={r12, @in={{0x2, 0x4e20, @remote}}, 0x10001, 0xfff7, 0x5, 0x1, 0x8, 0x5, 0xba}, 0x9c) ioctl(r9, 0x1000008912, &(0x7f00000001c0)="080db5055e0bcfe8696071") getsockopt$inet_sctp_SCTP_PEER_AUTH_CHUNKS(r9, 0x84, 0x1a, &(0x7f0000000940)=ANY=[@ANYRES32=0x0, @ANYBLOB='\x00'/12], &(0x7f0000000980)=0x10) r13 = socket$nl_generic(0x10, 0x3, 0x10) r14 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080)='nl80211\x00') r15 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL80211_CMD_GET_STATION(r15, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000240)={0x1c, r14, 0xf2b, 0x0, 0x0, {}, [@NL80211_ATTR_AIRTIME_WEIGHT={0x8}]}, 0x1c}}, 0x0) sendmsg$NL80211_CMD_GET_MPATH(r13, &(0x7f00000001c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x2000}, 0x268, &(0x7f0000000080)={&(0x7f0000000200)={0x40, r14, 0x4, 0x70bd2d, 0x25dfdbff}, 0xff6b}, 0x1, 0x0, 0x0, 0x10049050}, 0x260448c0) [ 445.338002][T18894] bridge241: port 2(erspan0) entered blocking state [ 445.344717][T18894] bridge241: port 2(erspan0) entered disabled state [ 445.352156][T18894] device erspan0 entered promiscuous mode [ 445.367730][T18887] device erspan0 left promiscuous mode 15:25:27 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000004c0)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r3, @ANYBLOB="0000000000000000280012000c0001007665746800000000180002", @ANYRES32=0x0, @ANYBLOB="00000000008433df6d6f6b577d4eaaf2000007"], 0x5}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000540)=ANY=[@ANYBLOB="7400000024000705000000000000000000010000", @ANYRES32=r3, @ANYBLOB="00000000ffffffff000000000800010073667100486818973f73461919309b68e1693572bb000229c6090032d0ed64f3c3545aaf6e000085a4e4ebb5ef670000000000000000000000000000001a4e624d29a84abf03265700000000000000000000000000000000000000000000000000000000000000ac20000089b53c947244306a0216a3de887763df5b42498b13bb1938de859ee6d7ae7dd2224dc672b69b4358871b170ea0b667832e5224ee3538f885b7abd9bc4a7d"], 0x74}}, 0x0) r4 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r4, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000300)=ANY=[@ANYBLOB="840000002c00010700"/20, @ANYRES32=r3, @ANYBLOB="0008008000000000030000000800010075333200580002001400050000000000000000000000000000000000400006003c0001000000000000001020898dde66057433b6ef3a41d22be225e0001b0000000000000000000000000017256ffc66e43a2484e1a912c5998bcbf0d0000000000000000000000000000000798a3c067277da1a290b9613a33c575c36fad473382c8f5532ef3f0e1d2c450a7decbf3431a69f9b2ecb3291bed174245a962fe0484676958265e2988326a89db3139d91fe4aee6ae7e745ab00001a9f61f20500000000000000b3958bc14fce6e66a36d1ab3194534ba4e973684b27793bff837d3"], 0x84}}, 0x0) r5 = socket(0x10, 0x80002, 0x0) sendmmsg$alg(r5, &(0x7f0000000140), 0x49249249249278c, 0x0) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r6, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000500)=@newlink={0x20, 0x11, 0x40d, 0x0, 0x0, {0x0, 0x0, 0x0, r8}}, 0x20}}, 0x0) r9 = socket(0x10, 0x80002, 0x0) getsockopt$inet_sctp_SCTP_PEER_AUTH_CHUNKS(0xffffffffffffffff, 0x84, 0x1a, &(0x7f0000000940)=ANY=[@ANYRES32=0x0, @ANYBLOB='\x00'/12], &(0x7f0000000980)=0x10) r10 = socket(0xa, 0x6, 0x0) close(r10) r11 = socket$inet6_sctp(0xa, 0x10000000005, 0x84) setsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX(r11, 0x84, 0x6e, &(0x7f0000000180)=[@in6={0xa, 0x0, 0x0, @remote, 0x9}], 0x1c) getsockopt$inet_sctp6_SCTP_GET_ASSOC_ID_LIST(r11, 0x84, 0x1d, &(0x7f000095dff8)={0x1, [0x0]}, &(0x7f000095dffc)=0x8) setsockopt$inet_sctp_SCTP_RTOINFO(r10, 0x84, 0x0, &(0x7f0000000000)={r12, 0x0, 0x0, 0x1000000}, 0x10) setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(0xffffffffffffffff, 0x84, 0x9, &(0x7f0000000680)={r12, @in={{0x2, 0x4e20, @remote}}, 0x10001, 0xfff7, 0x5, 0x1, 0x8, 0x5, 0xba}, 0x9c) ioctl(r9, 0x1000008912, &(0x7f00000001c0)="080db5055e0bcfe8696071") getsockopt$inet_sctp_SCTP_PEER_AUTH_CHUNKS(r9, 0x84, 0x1a, &(0x7f0000000940)=ANY=[@ANYRES32=0x0, @ANYBLOB='\x00'/12], &(0x7f0000000980)=0x10) r13 = socket$nl_generic(0x10, 0x3, 0x10) r14 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080)='nl80211\x00') r15 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL80211_CMD_GET_STATION(r15, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000240)={0x1c, r14, 0xf2b, 0x0, 0x0, {}, [@NL80211_ATTR_AIRTIME_WEIGHT={0x8}]}, 0x1c}}, 0x0) sendmsg$NL80211_CMD_GET_MPATH(r13, &(0x7f00000001c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x2000}, 0x268, &(0x7f0000000080)={&(0x7f0000000200)={0x40, r14, 0x4, 0x70bd2d, 0x25dfdbff}, 0xff6b}, 0x1, 0x0, 0x0, 0x10049050}, 0x260448c0) sendmsg$NL80211_CMD_NEW_KEY(r9, &(0x7f0000000640)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0xb0024000}, 0xc, &(0x7f00000002c0)={&(0x7f0000000440)={0x7c, r14, 0x23, 0x70bd27, 0x25dfdbff, {}, [@NL80211_ATTR_KEY_DATA_WEP40={0x9, 0x7, "a80875ab12"}, @NL80211_ATTR_KEY={0x5c, 0x50, [@NL80211_KEY_DEFAULT_TYPES={0x14, 0x8, [@NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_MULTICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_MULTICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_MULTICAST={0x4}]}, @NL80211_KEY_DEFAULT_TYPES={0x28, 0x8, [@NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_MULTICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_MULTICAST={0x4}]}, @NL80211_KEY_IDX={0x5, 0x2, 0x5}, @NL80211_KEY_DATA_WEP104={0x11, 0x1, "4d84c4e30151cb27f51a4adf63"}]}]}, 0x7c}, 0x1, 0x0, 0x0, 0x24000}, 0x40) 15:25:27 executing program 3: r0 = socket(0x21, 0xa, 0x1) r1 = socket(0x10, 0x80002, 0x0) ioctl(r1, 0x1000008912, &(0x7f00000001c0)="080db5055e0bcfe8696071") getsockopt$inet_sctp_SCTP_PEER_AUTH_CHUNKS(r1, 0x84, 0x1a, &(0x7f0000000940)=ANY=[@ANYRES32=0x0, @ANYBLOB='\x00'/12], &(0x7f0000000980)=0x10) getsockopt$inet_sctp_SCTP_GET_PEER_ADDR_INFO(r0, 0x84, 0xf, &(0x7f00000009c0)={r2, @in6={{0xa, 0x4e21, 0x8, @local, 0x401}}, 0x9, 0x1, 0x7, 0x7f, 0x6}, &(0x7f0000000a80)=0x98) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000400)='nl80211\x00') sendmsg$NL80211_CMD_GET_MESH_CONFIG(r0, &(0x7f0000000580)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x103190}, 0xc, &(0x7f0000000540)={&(0x7f0000000500)={0x34, r3, 0x10, 0x70bd2d, 0x25dfdbfe, {}, [@NL80211_ATTR_WDEV={0xc, 0x99, {0x1, 0xffffffffffffffff}}, @NL80211_ATTR_WIPHY={0x8, 0x1, 0x1}, @NL80211_ATTR_WDEV={0xc, 0x99, {0x3f, 0x3}}]}, 0x34}, 0x1, 0x0, 0x0, 0x800}, 0x40000) r4 = socket$nl_generic(0x10, 0x3, 0x10) bind$netlink(r4, &(0x7f0000000000)={0x10, 0x0, 0x25dfdbff, 0x1004280}, 0xffffffffffffffb3) sendmsg$nl_generic(r4, &(0x7f0000000080)={&(0x7f0000000480)={0x10, 0xbb7f}, 0xc, &(0x7f0000000440)={&(0x7f00000004c0)={0x1c, 0x22, 0x1, 0x0, 0x0, {0x4}, [@typed={0x8, 0xc}]}, 0x1c}}, 0x0) socket$netlink(0x10, 0x3, 0x0) r5 = socket$alg(0x26, 0x5, 0x0) bind$alg(r5, &(0x7f0000000080)={0x26, 'hash\x00', 0x0, 0x0, 'sha512\x00'}, 0x58) [ 445.382344][T18887] bridge251: port 2(erspan0) entered disabled state 15:25:27 executing program 0: r0 = socket(0x21, 0xa, 0x1) r1 = socket(0x10, 0x80002, 0x0) ioctl(r1, 0x1000008912, &(0x7f00000001c0)="080db5055e0bcfe8696071") getsockopt$inet_sctp_SCTP_PEER_AUTH_CHUNKS(r1, 0x84, 0x1a, &(0x7f0000000940)=ANY=[@ANYRES32=0x0, @ANYBLOB='\x00'/12], &(0x7f0000000980)=0x10) getsockopt$inet_sctp_SCTP_GET_PEER_ADDR_INFO(r0, 0x84, 0xf, &(0x7f00000009c0)={r2, @in6={{0xa, 0x4e21, 0x8, @local, 0x401}}, 0x9, 0x1, 0x7, 0x7f, 0x6}, &(0x7f0000000a80)=0x98) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000400)='nl80211\x00') sendmsg$NL80211_CMD_GET_MESH_CONFIG(r0, &(0x7f0000000580)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x103190}, 0xc, &(0x7f0000000540)={&(0x7f0000000500)={0x34, r3, 0x10, 0x70bd2d, 0x25dfdbfe, {}, [@NL80211_ATTR_WDEV={0xc, 0x99, {0x1, 0xffffffffffffffff}}, @NL80211_ATTR_WIPHY={0x8, 0x1, 0x1}, @NL80211_ATTR_WDEV={0xc, 0x99, {0x3f, 0x3}}]}, 0x34}, 0x1, 0x0, 0x0, 0x800}, 0x40000) r4 = socket$nl_generic(0x10, 0x3, 0x10) bind$netlink(r4, &(0x7f0000000000)={0x10, 0x0, 0x25dfdbff, 0x1004280}, 0xffffffffffffffb3) sendmsg$nl_generic(r4, &(0x7f0000000080)={&(0x7f0000000480)={0x28, 0xbb7f}, 0xc, &(0x7f0000000440)={&(0x7f00000004c0)={0x1c, 0x22, 0x1, 0x0, 0x0, {0x4}, [@typed={0x8, 0xc}]}, 0x1c}}, 0x0) socket$netlink(0x10, 0x3, 0x0) r5 = socket$alg(0x26, 0x5, 0x0) bind$alg(r5, &(0x7f0000000080)={0x26, 'hash\x00', 0x0, 0x0, 'sha512\x00'}, 0x58) 15:25:27 executing program 2: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000340)={'erspan0\x00', 0x0}) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000300)={'syz_tun\x00', 0x0}) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r7, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r6, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000380)=@newlink={0x34, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r8}, [@IFLA_LINKINFO={0x14, 0x12, @bridge={{0xb, 0x1, 'bridge\x00'}, {0x4}}}]}, 0x34}}, 0x0) sendmsg$nl_route(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000002700)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r5}, [@IFLA_MASTER={0x8, 0xa, r8}]}, 0x28}}, 0x0) sendmsg$nl_route(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f00000000c0)=ANY=[@ANYBLOB="2800000010000104000040000000000000001ea6", @ANYRES32=r2, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00\b\x00\n\x00', @ANYRES32=r8], 0x28}}, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r10 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r9, 0x8933, &(0x7f0000000300)={'syz_tun\x00', 0x0}) sendmsg$nl_route(r10, &(0x7f0000000000)={0x0, 0x1000000, &(0x7f00000000c0)={&(0x7f0000000040)=@newlink={0x2c, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r11}, [@IFLA_BROADCAST={0xa}]}, 0x332}}, 0x0) 15:25:27 executing program 5: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000340)={'erspan0\x00', 0x0}) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000300)={'syz_tun\x00', 0x0}) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r7, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r6, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000380)=@newlink={0x34, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r8}, [@IFLA_LINKINFO={0x14, 0x12, @bridge={{0xb, 0x1, 'bridge\x00'}, {0x4}}}]}, 0x34}}, 0x0) sendmsg$nl_route(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000002700)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r5}, [@IFLA_MASTER={0x8, 0xa, r8}]}, 0x28}}, 0x0) sendmsg$nl_route(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f00000000c0)=ANY=[@ANYBLOB="2800000010000104000040000000000000001ea6", @ANYRES32=r2, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00\b\x00\n\x00', @ANYRES32=r8], 0x28}}, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r10 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r9, 0x8933, &(0x7f0000000300)={'syz_tun\x00', 0x0}) sendmsg$nl_route(r10, &(0x7f0000000000)={0x0, 0x1000000, &(0x7f00000000c0)={&(0x7f0000000040)=@newlink={0x2c, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r11}, [@IFLA_BROADCAST={0xa}]}, 0x332}}, 0x0) 15:25:27 executing program 0: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000340)={'erspan0\x00', 0x0}) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000300)={'syz_tun\x00', 0x0}) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r7, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r6, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000380)=@newlink={0x34, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r8}, [@IFLA_LINKINFO={0x14, 0x12, @bridge={{0xb, 0x1, 'bridge\x00'}, {0x4}}}]}, 0x34}}, 0x0) sendmsg$nl_route(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000002700)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r5}, [@IFLA_MASTER={0x8, 0xa, r8}]}, 0x28}}, 0x0) sendmsg$nl_route(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f00000000c0)=ANY=[@ANYBLOB="2800000010000104000040000000000000001ea6", @ANYRES32=r2, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00\b\x00\n\x00', @ANYRES32=r8], 0x28}}, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r10 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r9, 0x8933, &(0x7f0000000300)={'syz_tun\x00', 0x0}) sendmsg$nl_route(r10, &(0x7f0000000000)={0x0, 0xf0ffff, &(0x7f00000000c0)={&(0x7f0000000040)=@newlink={0x2c, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r11}, [@IFLA_BROADCAST={0xa}]}, 0x332}}, 0x0) [ 445.589868][T18921] ieee80211 phy246: Selected rate control algorithm 'minstrel_ht' [ 445.605325][T18924] device syz_tun left promiscuous mode [ 445.611177][T18924] bridge251: port 1(syz_tun) entered disabled state [ 445.737755][T18924] bridge252: port 1(syz_tun) entered blocking state [ 445.744564][T18924] bridge252: port 1(syz_tun) entered disabled state [ 445.753349][T18924] device syz_tun entered promiscuous mode [ 445.764725][T18929] bridge252: port 2(erspan0) entered blocking state [ 445.772353][T18929] bridge252: port 2(erspan0) entered disabled state [ 445.779946][T18929] device erspan0 entered promiscuous mode [ 445.792056][T18934] device syz_tun left promiscuous mode [ 445.797842][T18934] bridge241: port 1(syz_tun) entered disabled state [ 445.937705][T18934] bridge242: port 1(syz_tun) entered blocking state [ 445.944439][T18934] bridge242: port 1(syz_tun) entered disabled state [ 445.951919][T18934] device syz_tun entered promiscuous mode [ 445.969754][T18939] device syz_tun left promiscuous mode [ 445.976401][T18939] bridge12: