last executing test programs: 1.545636128s ago: executing program 0 (id=149): r0 = socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt$inet6_int(r0, 0x29, 0x4e, &(0x7f0000000040)=0x2, 0x4) setsockopt$inet_sctp6_SCTP_SOCKOPT_BINDX_ADD(r0, 0x84, 0x64, &(0x7f0000000080)=[@in6={0xa, 0x4e22, 0xfffffffd, @ipv4={'\x00', '\xff\xff', @rand_addr=0x64010101}, 0x4}], 0x1c) sendmmsg$inet(r0, &(0x7f00000036c0)=[{{&(0x7f0000000000)={0x2, 0x4e21, @rand_addr=0x64010100}, 0x10, &(0x7f00000000c0)=[{&(0x7f0000000040)="dc", 0x1}], 0x1}}], 0x1, 0x20048040) 1.40973712s ago: executing program 0 (id=151): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000280), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f00000002c0)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_FRAME(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000640)={&(0x7f0000000040)={0x3c, r1, 0x1, 0x2, 0x0, {{}, {@val={0x8, 0x3, r2}, @void}}, [@NL80211_ATTR_FRAME={0x1f, 0x33, @action={{{}, {}, @device_b}, @vht_op_mode_ntf={0x15, 0x2, {0x1, 0x0, 0x1, 0x1, 0x1}}}}]}, 0x3c}}, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) 1.286065555s ago: executing program 0 (id=153): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040), 0x20702, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000080)={'syzkaller0\x00', 0xca58c30f81b6079f}) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$tipc(&(0x7f00000000c0), r1) sendmsg$TIPC_CMD_ENABLE_BEARER(r1, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000680)=ANY=[@ANYBLOB='8\x00\x00\x00', @ANYRES16=r2, @ANYBLOB="010000000d0000000000010000000000000001410000001c001700000000000000006574683a73797a6b616c6c657230"], 0x38}}, 0x0) 1.258417817s ago: executing program 4 (id=155): bpf$PROG_LOAD(0x5, &(0x7f0000000140)={0x15, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000240)=@dellink={0x34, 0x11, 0x1, 0x70bd27, 0x25dfdbfd, {0x0, 0x0, 0x0, 0x0, 0x1020, 0x40000}, [@IFLA_IFNAME={0x14, 0x3, 'veth1_vlan\x00'}]}, 0x34}, 0x1, 0x0, 0x0, 0x801}, 0x4000000) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000040), r1) sendmsg$ETHTOOL_MSG_STRSET_GET(r1, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000023c0)={0x2c, r2, 0x1, 0x70bd2d, 0x25dfdbff, {}, [@ETHTOOL_A_STRSET_HEADER={0x18, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'ipvlan1\x00'}]}]}, 0x2c}, 0x1, 0x0, 0x0, 0x2001}, 0x4010000) 1.2015249s ago: executing program 3 (id=156): bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x18, 0xb, &(0x7f00000005c0)=ANY=[@ANYBLOB="18000000000000000000000000000000180100002020702500000000730000007b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b70300000000000085"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000040)={0x1f, 0xffffffffffffffff, 0x3}, 0x6) write$bt_hci(r0, &(0x7f00000005c0)=ANY=[@ANYBLOB="0e00000002"], 0x8) 1.201393416s ago: executing program 1 (id=157): r0 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f00000003c0)={'wlan0\x00', 0x0}) r2 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000280), 0xffffffffffffffff) sendmsg$NL80211_CMD_FRAME(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000024c0)={0x60, r2, 0x1, 0x70bd26, 0x0, {{}, {@val={0x8, 0x3, r1}, @void}}, [@NL80211_ATTR_FRAME={0x42, 0x33, @assoc_req={{{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1}, {0x10}, @device_b, @device_a, @initial, {0xc, 0x9}, @value=@ver_80211n={0x0, 0x60, 0x0, 0x0, 0x0, 0x3, 0x1, 0x0, 0x0, 0x1}}, 0x2f20, 0x2, {}, @void, @val={0x2d, 0x1a, {0x80, 0x2, 0x2, 0x0, {0xf, 0x9, 0x0, 0x9, 0x0, 0x1, 0x1, 0x0, 0x1}, 0x8, 0x3, 0x5}}}}]}, 0x60}, 0x1, 0x0, 0x0, 0xc0}, 0x0) 1.095532898s ago: executing program 3 (id=159): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_TIMEOUT_NEW(r0, &(0x7f0000000640)={0x0, 0x0, &(0x7f0000000600)={&(0x7f0000000500)={0x3c, 0x0, 0x8, 0x201, 0x0, 0x0, {0x3, 0x0, 0x4}, [@CTA_TIMEOUT_NAME={0x9, 0x1, 'syz1\x00'}, @CTA_TIMEOUT_L3PROTO={0x6, 0x2, 0x1, 0x0, 0xa01}, @CTA_TIMEOUT_L4PROTO={0x5, 0x3, 0x88}, @CTA_TIMEOUT_DATA={0xc, 0x4, 0x0, 0x1, @sctp=[@CTA_TIMEOUT_SCTP_CLOSED={0x8, 0x1, 0x1, 0x0, 0x7}]}]}, 0x3c}, 0x1, 0x0, 0x0, 0x20004044}, 0x4044080) 941.554422ms ago: executing program 1 (id=160): r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000000)={'bridge_slave_1\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000540)=@newlink={0x4c, 0x10, 0x1, 0x70bd25, 0x25dfdbfe, {0x0, 0x0, 0x0, r2, 0x40810, 0x103}, [@IFLA_LINKINFO={0x2c, 0x12, 0x0, 0x1, @bridge_slave={{0x11}, {0x14, 0x5, 0x0, 0x1, [@IFLA_BRPORT_PROXYARP={0x5, 0xa, 0x1}, @IFLA_BRPORT_BCAST_FLOOD={0x5}]}}}]}, 0x4c}, 0x1, 0x0, 0x0, 0x200404c1}, 0x4000000) 941.452656ms ago: executing program 2 (id=161): bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000240)={0x18, 0xb, &(0x7f0000000000)=ANY=[@ANYBLOB="180000000300000000000000403fd000180100002020782500000000002020207b1af8ff000000006d0afeff000000000701b092f8ffffffb702000008000000b70300000f200000a500feff0600000095"], &(0x7f0000000080)='GPL\x00', 0xb, 0x101a, &(0x7f0000000840)=""/4122, 0x41100, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x6}, 0x94) 941.409184ms ago: executing program 3 (id=162): syz_80211_join_ibss(&(0x7f0000000280)='wlan0\x00', 0x0, 0x0, 0x0) 819.314551ms ago: executing program 2 (id=163): r0 = socket$inet_sctp(0x2, 0x1, 0x84) setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(r0, 0x84, 0x64, &(0x7f0000000080)=[@in={0x2, 0x4e21, @local}], 0x10) sendmsg$inet_sctp(r0, &(0x7f0000000700)={&(0x7f0000000340)=@in={0x2, 0x4e21, @local}, 0x10, &(0x7f00000006c0)=[{&(0x7f0000000380)='N', 0x1}], 0x1, 0x0, 0x0, 0x804c040}, 0x0) setsockopt$inet_sctp_SCTP_STREAM_SCHEDULER(r0, 0x84, 0x7b, &(0x7f0000000200), 0x8) 741.958467ms ago: executing program 2 (id=164): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x0) sendmsg$NFT_BATCH(r0, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f0000000680)={{0x14}, [@NFT_MSG_NEWRULE={0x60, 0x6, 0xa, 0x401, 0x0, 0x0, {0xa, 0x0, 0x6}, [@NFTA_RULE_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_RULE_EXPRESSIONS={0x34, 0x4, 0x0, 0x1, [{0x30, 0x1, 0x0, 0x1, @bitwise={{0xc}, @val={0x20, 0x2, 0x0, 0x1, [@NFTA_BITWISE_LEN={0x8, 0x3, 0x1, 0x0, 0xc}, @NFTA_BITWISE_SREG={0x8, 0x1, 0x1, 0x0, 0x2}, @NFTA_BITWISE_DREG={0x8, 0x2, 0x1, 0x0, 0x8}, @NFTA_BITWISE_DATA={0x4}]}}}]}, @NFTA_RULE_CHAIN={0x9, 0x2, 'syz2\x00'}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0xa}}}, 0x88}, 0x1, 0x0, 0x0, 0x4000850}, 0x24000000) 672.493234ms ago: executing program 1 (id=165): r0 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) close(0x3) r1 = socket(0x2b, 0x80801, 0x1) connect$inet6(r1, &(0x7f00000001c0)={0xa, 0x0, 0x3ff, @empty, 0xfffffff7}, 0x1c) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f00000015c0)=@mangle={'mangle\x00', 0x10, 0x6, 0x4d4, 0x3f0, 0x3f0, 0xec, 0x0, 0x2e0, 0x4b8, 0x4b8, 0x4b8, 0x4b8, 0x4b8, 0x6, 0x0, {[{{@uncond, 0x0, 0xa4, 0xec, 0x0, {0x7a00000000000000}}, @common=@inet=@TEE={0x48, 'TEE\x00', 0x1, {@ipv4=@remote, 'hsr0\x00', {0xfffffffffffff800}}}}, {{@ipv6={@dev, @private1={0xfc, 0x1, '\x00', 0x1}, [0x0, 0x0, 0xff000000, 0xff], [0x0, 0x0, 0xff000000], 'pim6reg\x00', 'geneve1\x00', {}, {0xff}}, 0x0, 0xa4, 0xc8}, @HL={0x24, 'HL\x00', 0x0, {0x2}}}, {{@ipv6={@dev={0xfe, 0x80, '\x00', 0x33}, @private2={0xfc, 0x2, '\x00', 0x1}, [0x7f8000ff, 0xffffff00, 0xffffff00], [0xffffff00, 0xffffff00, 0xff000000, 0xffff00], 'veth0_to_batadv\x00', 'macvtap0\x00', {}, {0xff}, 0x88, 0xb, 0x1, 0x4}, 0x0, 0xa4, 0xc8}, @unspec=@CHECKSUM={0x24}}, {{@ipv6={@ipv4={'\x00', '\xff\xff', @local}, @private2={0xfc, 0x2, '\x00', 0x1}, [0xffffffff, 0xffffff00, 0xffffff00, 0xff], [0xff, 0xff000000, 0xffffff00], 'veth1_to_batadv\x00', 'geneve0\x00', {}, {}, 0x3b, 0xe, 0x6, 0x58}, 0x0, 0xa4, 0xc8}, @inet=@TOS={0x24, 'TOS\x00', 0x0, {0x3, 0x9}}}, {{@uncond, 0x0, 0xa4, 0xc8}, @unspec=@CHECKSUM={0x24}}], {{'\x00', 0x0, 0xa4, 0xc8}, {0x24}}}}, 0x530) 667.178969ms ago: executing program 3 (id=166): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x2241, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000380)={'pimreg\x00', 0x5005}) write$tun(r0, &(0x7f0000000480)=ANY=[@ANYRES32], 0x1043) 609.647749ms ago: executing program 4 (id=167): r0 = socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt$inet6_mreq(r0, 0x29, 0x1b, &(0x7f0000000140)={@remote}, 0x14) r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r1, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000300)=@ipv6_getanyicast={0x14, 0x3e, 0x601, 0x70bd2c, 0x25dfdbfc}, 0x14}, 0x1, 0x0, 0x0, 0x800}, 0x880) 545.654973ms ago: executing program 0 (id=168): r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r0, &(0x7f0000000b00)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000200)=@newtaction={0x70, 0x30, 0x1, 0x70bd2b, 0x25dfdbfd, {}, [{0x5c, 0x1, [@m_skbedit={0x58, 0x1, 0x0, 0x0, {{0xc}, {0x2c, 0x2, 0x0, 0x1, [@TCA_SKBEDIT_PARMS={0x18, 0x2, {0x2, 0x9, 0x4, 0x8be6, 0x5}}, @TCA_SKBEDIT_QUEUE_MAPPING={0x6, 0x4, 0x4}, @TCA_SKBEDIT_MARK={0x8, 0x5, 0x50}]}, {0x4}, {0xc}, {0xc, 0x8, {0x0, 0x1}}}}]}]}, 0x70}, 0x1, 0x0, 0x0, 0x4081}, 0x2400c800) 534.209278ms ago: executing program 2 (id=169): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_EXP_GET(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f00000000c0)={0x14, 0x1, 0x2, 0x101, 0x0, 0x0, {0x2, 0x0, 0xa}}, 0x14}, 0x1, 0x0, 0x0, 0x4000}, 0x10) 502.818851ms ago: executing program 1 (id=170): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000a40)=ANY=[@ANYBLOB="140000001000010000000000000000000a00000a20000000000a01080000000000000000010000090900010073797a31000000006c000000030a010400000000000000000100000a0900010073797a310000000008000b400000000228000480080002401501ad7d1400030076657468305f766972745f776966690008000140000000051c0008800c00014080000000000000000c0002"], 0xb4}, 0x1, 0x0, 0x0, 0x24000144}, 0x4c50) 479.1464ms ago: executing program 0 (id=171): r0 = socket$inet6(0xa, 0x2, 0x0) sendmmsg$inet6(r0, &(0x7f0000000cc0)=[{{&(0x7f0000000380)={0xa, 0x4e24, 0x433, @empty, 0x8000}, 0x1c, 0x0, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="14000000000000002900000008000000ffff00000000000024000000000000002900000032"], 0x40}}], 0x1, 0x80) 413.617885ms ago: executing program 4 (id=172): r0 = bpf$PROG_LOAD(0x5, &(0x7f0000000240)={0x11, 0xb, &(0x7f0000000180)=ANY=[@ANYBLOB="18000000000000000000000000000000180100002020702500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000000000000b703000000000000850000000400000095"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x40f00, 0x8, '\x00', 0x0, @fallback=0x1d, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={&(0x7f0000000340)='kfree\x00', r0}, 0x10) r1 = socket$kcm(0x2b, 0x1, 0x0) sendmsg$inet(r1, &(0x7f0000000240)={&(0x7f00000000c0)={0x2, 0x4001, @remote}, 0x10, 0x0, 0x0, 0x0, 0x0, 0x300}, 0x200048cc) sendmsg$kcm(r1, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000280)=[{&(0x7f00000017c0)="93", 0x1}], 0x1}, 0x40) sendmsg$inet(r1, &(0x7f0000000200)={0x0, 0x0, 0x0}, 0x2004c841) 413.424936ms ago: executing program 3 (id=173): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x2241, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000380)={'pimreg\x00', 0x5005}) write$tun(r0, &(0x7f00000003c0)={@void, @val={0x3, 0x1, 0xe, 0x9, 0x20e, 0x10}, @ipv6=@dccp_packet={0x2, 0x6, "001300", 0x204, 0x21, 0xff, @private2={0xfc, 0x2, '\x00', 0x1}, @remote, {[@dstopts={0x1, 0x3, '\x00', [@ra={0x5, 0x2, 0x7}, @pad1, @padn={0x1, 0x6, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}, @ra={0x5, 0x2, 0x2}, @enc_lim={0x4, 0x1, 0xaa}, @enc_lim={0x4, 0x1, 0xfc}]}, @srh={0x3b, 0x6, 0x4, 0x3, 0x3, 0x20, 0x6, [@private2={0xfc, 0x2, '\x00', 0x1}, @mcast1, @private0]}, @fragment={0x33, 0x0, 0x9, 0x1, 0x0, 0x4, 0x68}, @hopopts={0x21, 0x0, '\x00', [@ra={0x5, 0x2, 0x3}]}, @hopopts={0x2b, 0x1d, '\x00', [@ra={0x5, 0x2, 0x7}, @enc_lim={0x4, 0x1, 0xff}, @generic={0x8, 0xe0, "80a25f794936f039defcccbe787055120eb33239a8e0fb4601c0075906ab317e9bb66480b49731691e65467e4360eeb2bf29f63c782ec0ace03c4092190d80ad9ea10ff479bb2475ea34a8eeb1c7e9771bc670b2ea1acbcd903c2fe699203b665c4f89e19bafc77dc2bb86dc73d17091ee1ac5e1efbb601687bbf90d69c0121ab9c83d1e28a700d5d7ea6b6421e371e99d67fcb897c3846e13c78c7c3b109d70e82506330819b02a07ad415bb42c6dca673b3062dbd002f75b7fcae634e3264e0359aa5193af2d515b8801efb4b98e9ef3093dab595eda23df06fb9dcad00504"}]}], {{0x4e20, 0x4e20, 0x4, 0x1, 0x3, 0x0, 0x0, 0x3, 0x0, "f5c144", 0x0, "7fd5cd"}, "677d5b3a539a25ca342231cfd61e878b495a1b04b397af927c0ff18d4613655faf185f77f9bb64a04ac88fafcc6089f64a23f1f27b9025afa13f90547bcf76196f2a8070598748d9fa4f68763beda804ddac2ea643e431c85a5740b3561c69138c0f2fb0b66f7c6575eeff16eb01caaed7dbe26d427f5eb33b5fe938216a6d47ac2584bd"}}}}, 0x236) 354.024964ms ago: executing program 0 (id=174): r0 = socket$inet_sctp(0x2, 0x5, 0x84) setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(r0, 0x84, 0x64, &(0x7f0000000180)=[@in={0x2, 0x4e21, @empty}], 0x10) sendmsg$inet_sctp(r0, &(0x7f0000000700)={&(0x7f0000000340)=@in={0x2, 0x4e21, @local}, 0x10, &(0x7f00000006c0)=[{&(0x7f0000000380)='N', 0x2a028}], 0x1, 0x0, 0x0, 0x804c040}, 0x0) setsockopt$inet_sctp_SCTP_EVENTS(r0, 0x84, 0xb, 0x0, 0x0) 325.674845ms ago: executing program 1 (id=175): socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff}) r1 = bpf$MAP_CREATE(0x0, &(0x7f00000023c0)=ANY=[@ANYBLOB="1200000026000000080000000b"], 0x48) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f00000003c0)={{r1, 0xffffffffffffffff}, &(0x7f0000000340), &(0x7f0000000380)=r0}, 0x20) bpf$MAP_DELETE_ELEM(0x3, &(0x7f0000000680)={r2, &(0x7f0000000600)}, 0x20) 261.706516ms ago: executing program 2 (id=176): r0 = socket$nl_route(0x10, 0x3, 0x0) socket$inet_udp(0x2, 0x2, 0x0) sendmsg$nl_route(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000540)=@newlink={0x4c, 0x10, 0x1, 0x70bd25, 0x25dfdbfe, {0x0, 0x0, 0x0, 0x0, 0x40810, 0x103}, [@IFLA_LINKINFO={0x2c, 0x12, 0x0, 0x1, @bridge_slave={{0x11}, {0x14, 0x5, 0x0, 0x1, [@IFLA_BRPORT_PROXYARP={0x5, 0xa, 0x1}, @IFLA_BRPORT_BCAST_FLOOD={0x5}]}}}]}, 0x4c}, 0x1, 0x0, 0x0, 0x200404c1}, 0x4000000) 261.59165ms ago: executing program 4 (id=177): sendmsg$inet_sctp(0xffffffffffffffff, &(0x7f0000000140)={&(0x7f00000001c0)=@in6={0xa, 0x4e22, 0x26fef2d1, @remote, 0x800800}, 0x1c, 0x0, 0x0, 0x0, 0x0, 0x804c040}, 0x200088f5) r0 = socket$inet_sctp(0x2, 0x5, 0x84) setsockopt$inet_sctp_SCTP_RESET_STREAMS(r0, 0x84, 0x7d, &(0x7f0000000140)=ANY=[], 0x8) 188.751016ms ago: executing program 1 (id=178): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x13, &(0x7f0000000040)=0x100000001, 0x76dc) connect$inet6(r0, &(0x7f0000000100)={0xa, 0x0, 0x0, @empty}, 0x1c) setsockopt$inet6_tcp_TCP_ULP(r0, 0x6, 0x1f, &(0x7f00000002c0), 0x4) setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r0, 0x6, 0x14, &(0x7f0000000400)=0x1, 0x4) setsockopt$inet6_tcp_TLS_TX(r0, 0x11a, 0x2, &(0x7f0000000000)=@gcm_128={{0x304}, "00000000faffffff", "cb83a84cbae76006000000192b90d142", '\f_\x00', "e449990e9977d061"}, 0x28) syz_genetlink_get_family_id$ethtool(&(0x7f0000000240), r0) syz_genetlink_get_family_id$devlink(&(0x7f0000000080), r0) shutdown(r0, 0x1) 136.075973ms ago: executing program 3 (id=179): socket$inet_udplite(0x2, 0x2, 0x88) r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect$can_bcm(r0, 0x0, 0x0) setsockopt$inet6_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000100)=0x1, 0x4) bpf$PROG_LOAD_XDP(0x5, 0x0, 0x0) socket(0x0, 0x803, 0x0) r1 = socket$inet_icmp(0x2, 0x2, 0x1) ioctl$sock_inet_SIOCSARP(r1, 0x8955, &(0x7f00000001c0)={{0x2, 0x4e22, @rand_addr=0x64010101}, {0x306, @local}, 0x58, {0x2, 0x4e23, @multicast1}, 'lo\x00'}) socket$inet_udp(0x2, 0x2, 0x0) setsockopt$sock_linger(0xffffffffffffffff, 0x1, 0x3c, &(0x7f0000000180)={0x1, 0x5}, 0x8) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000180)=ANY=[@ANYBLOB="3000000010000100"/20, @ANYRES32=0x0, @ANYBLOB="8000000002000200080004000000000008001b"], 0x30}}, 0x0) setsockopt$inet6_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, 0x0, 0x0) 119.381724ms ago: executing program 2 (id=180): r0 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x80000000000002, &(0x7f00000004c0)=0x79, 0x4) bind$inet(r0, &(0x7f0000000080)={0x2, 0x4e23, @local}, 0x10) setsockopt$SO_ATTACH_FILTER(r0, 0x1, 0x1a, &(0x7f0000000140)={0x1, &(0x7f0000000280)=[{0x6, 0x0, 0x0, 0xe4}]}, 0x10) sendto$inet(r0, 0x0, 0x0, 0x200007fd, &(0x7f0000e68000)={0x2, 0x4e23, @local}, 0x10) setsockopt$inet_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f0000000100)='bbr\x00', 0x4) sendmmsg$inet(r0, &(0x7f00000006c0)=[{{0x0, 0x0, &(0x7f0000000500)=[{&(0x7f00000002c0)="68377863ac6ea61666eaa696435a75f1626fe3a3acedcaf71527ff51d446daac757559d2d6fc2b90952355ec6c61d718c91784312b1b4771888a0811895b02ffb658934b0bbd6466c9cc04cc7252f1f1deea5a8b9c6797c8f1263db526cf88899f7ecab544662eb34743cefb660a78cb9468d2900b3cda4cca9d89ab6d341d145acf249276dda272407bc98d9e5431316d468b9e4750f2316589dc4de3157592d27fd723a512c85b08035842b75ec422346f9696f4bb3226b0ca75d135ebd8cae46fb83b71c103e1fdcb1934fd1d28b4916abe2c44e26ea72be426c27052e816212096000155788943b846746ccb492175fc9e01", 0xf4}, {&(0x7f00000003c0)="5453b4b759f9d4f4f33bda880b70a0dadde06223919f4585429ef69078a4956f646ea03bfd4c090a003c01f32b1a175baf38c1eb4572c8b372a4cf9128062e58ff575546876a2804144c3aea98c4a3533396f87e860de8c66bceb0e6b387ec853b7e91c57587d38436637e702ae18eeccefdcd7a3cdd7bfc327b5d619b57d56afe1628b65e2948af5ee0e3f52746a5aff58bb7c6d253a58bf745584d1bc19fe5e42b5534eab9e9d2587b413e81f68b60f56130f82b327f5fe900e3e107bc6b783d1d23a056426d6502133386b51e657046c1c43a2a2c4a7611ee6592a5ee08700d24d832163b3def", 0xe8}, {&(0x7f0000000640)="d48c8225ddfdf2c06c27763617468581389d34126760ba3dd0fe077a7c2ce378dd62cafeeb4ba1493766d09fd561d69a5bf8109ffcd3e43d8c16b9c3fa92d4439c5af1fa4775d01dcf0748a24ab51b52fb", 0x51}, {&(0x7f0000000740)="f52ec22aafecc37a6d9995f1afb5c1727f223f9b84451a110b1dfbf19cc7ed183ba93f6d55645001887fc999262b9c938e22ef5ec46b4b1b535060dcca5cff1f0e5a1d9b32cef2b6e0a61af7968dc1759c4d901867d7d6e9f2521f6a1578e1cc2fbf58837a2633c0b8299192718c61227412dafd01e899723b33735bbec3e1429117362acc4139fc3565f183bd5568f47f4bc416adb360fdd9c497c2ad2ffe1ad738f4c073f1378d2b455e6184", 0xad}, {&(0x7f0000000200)="057322e18609ed78266492c2a2ae3f0c0f3f6394c53de2", 0x17}], 0x5}}, {{0x0, 0x0, &(0x7f0000000040)=[{&(0x7f0000000840)="f2fe84e07da72d5be0eee26e6693cc950e7080ba2900a53b969dc13369b90492865a9fb8d25a00b9c2d8e52e23e3267d15c4aeea5918add6f28e302868e1d4500b073ac1a7c72c4e805ff1fce9c5e0273d0ea144b6999eb1661fed8ddba6250af47fde6e4225f438528b6660d8b67812726721f6b755bb37ca116f51e2f239675ff38126c1d681638c", 0x89}, {&(0x7f0000000900)="a1e27575d35fd4f38d622e3237bfc6a28a4c21284fa1f95f8e2343cff8831a5a663f3fac3d082e19b04d59a071c5599a98b7bc07bf2bf94767fe9bf0db2b8fa547766a8e024ef76e320cf8e352f293b0c19f465a9deed8", 0x57}, {&(0x7f00000009c0)="4d25acabb0d76231f77e554a8c8c1b3afdb47d428c57725ff9b4fc3ff9300e603fd9b082e7b1dc654d7db972a680ad49a0b606b08d00b692df47c9b3d57a2ca02114cff55e05199643619f8b0e3c02546ba27d0e5eb073779970d0ec308a8a4cfee0902034edd8994ba51a4268555ba3deacb02348497e27dd55bb2bb7069bf0d855f1184a8770a54f5ec8329c465bb1466c0e08c07f08727281cf8e", 0x9c}], 0x3}}], 0x2, 0xc0) setsockopt$sock_int(r0, 0x1, 0x8, &(0x7f0000000600)=0xdfa, 0x4) sendto$inet(r0, &(0x7f0000000580)="17", 0x59a, 0x10008095, 0x0, 0x0) 45.693928ms ago: executing program 4 (id=181): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x13, &(0x7f0000000000)=0x100000001, 0x4) connect$inet6(r0, &(0x7f0000000200)={0xa, 0x0, 0x0, @loopback}, 0x1c) setsockopt$inet6_tcp_TCP_ULP(r0, 0x6, 0x1f, &(0x7f00000000c0), 0x4) setsockopt$inet6_tcp_TLS_TX(r0, 0x11a, 0x1, &(0x7f0000000140)=@gcm_128={{0x303}, "87ee8ac6c46dad33", "2607080d7f4fcf00fd4ef2dece6c7c58"}, 0x28) sendmsg$inet(r0, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xf0ffffff}, 0x40) 0s ago: executing program 4 (id=182): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x0) sendmsg$NFT_BATCH(r0, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f0000000100)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x5}}, [@NFT_MSG_NEWSET={0x5c, 0x9, 0xa, 0x401, 0x0, 0x0, {0xa, 0x0, 0x4}, [@NFTA_SET_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_SET_KEY_LEN={0x8, 0x5, 0x1, 0x0, 0x2}, @NFTA_SET_NAME={0x9, 0x2, 'syz1\x00'}, @NFTA_SET_ID={0x8, 0xa, 0x1, 0x0, 0xfffffffc}, @NFTA_SET_EXPR={0x20, 0x11, 0x0, 0x1, @connlimit={{0xe}, @val={0xc, 0x2, 0x0, 0x1, [@NFTA_CONNLIMIT_COUNT={0x8, 0x1, 0x1, 0x0, 0xfffff274}]}}}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x7}}}, 0x84}, 0x1, 0x0, 0x0, 0x4000850}, 0x40) kernel console output (not intermixed with test programs): Warning: Permanently added '10.128.1.95' (ED25519) to the list of known hosts. [ 83.841388][ T5837] cgroup: Unknown subsys name 'net' [ 83.940090][ T5837] cgroup: Unknown subsys name 'cpuset' [ 83.949076][ T5837] cgroup: Unknown subsys name 'rlimit' Setting up swapspace version 1, size = 127995904 bytes [ 85.566385][ T5837] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 88.214736][ T5854] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 88.229807][ T5854] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 88.247035][ T5856] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 88.255265][ T5856] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 88.255332][ T5863] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 88.263237][ T5856] Bluetooth: hci4: unexpected cc 0x0c03 length: 249 > 1 [ 88.277408][ T5869] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 88.292947][ T5869] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 88.312293][ T5869] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 88.312542][ T5863] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 88.322564][ T5869] Bluetooth: hci4: unexpected cc 0x1003 length: 249 > 9 [ 88.341799][ T5867] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 88.351463][ T5869] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 88.351668][ T5870] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 88.366691][ T5867] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 88.367987][ T5856] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 88.374989][ T5867] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 88.381598][ T5856] Bluetooth: hci4: unexpected cc 0x1001 length: 249 > 9 [ 88.390487][ T5867] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 88.395209][ T5856] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 88.410976][ T5856] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 88.418662][ T5856] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 88.432264][ T5856] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 88.439604][ T5856] Bluetooth: hci4: unexpected cc 0x0c23 length: 249 > 4 [ 88.450572][ T5856] Bluetooth: hci4: unexpected cc 0x0c38 length: 249 > 2 [ 89.040100][ T5849] chnl_net:caif_netlink_parms(): no params data found [ 89.174948][ T5848] chnl_net:caif_netlink_parms(): no params data found [ 89.292616][ T5850] chnl_net:caif_netlink_parms(): no params data found [ 89.341418][ T5860] chnl_net:caif_netlink_parms(): no params data found [ 89.433778][ T5849] bridge0: port 1(bridge_slave_0) entered blocking state [ 89.441460][ T5849] bridge0: port 1(bridge_slave_0) entered disabled state [ 89.450944][ T5849] bridge_slave_0: entered allmulticast mode [ 89.459008][ T5849] bridge_slave_0: entered promiscuous mode [ 89.468191][ T5857] chnl_net:caif_netlink_parms(): no params data found [ 89.518008][ T5849] bridge0: port 2(bridge_slave_1) entered blocking state [ 89.525207][ T5849] bridge0: port 2(bridge_slave_1) entered disabled state [ 89.533213][ T5849] bridge_slave_1: entered allmulticast mode [ 89.540558][ T5849] bridge_slave_1: entered promiscuous mode [ 89.645613][ T5848] bridge0: port 1(bridge_slave_0) entered blocking state [ 89.653189][ T5848] bridge0: port 1(bridge_slave_0) entered disabled state [ 89.660594][ T5848] bridge_slave_0: entered allmulticast mode [ 89.671535][ T5848] bridge_slave_0: entered promiscuous mode [ 89.699342][ T5849] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 89.724672][ T5848] bridge0: port 2(bridge_slave_1) entered blocking state [ 89.731872][ T5848] bridge0: port 2(bridge_slave_1) entered disabled state [ 89.739405][ T5848] bridge_slave_1: entered allmulticast mode [ 89.747346][ T5848] bridge_slave_1: entered promiscuous mode [ 89.786978][ T5849] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 89.850667][ T5850] bridge0: port 1(bridge_slave_0) entered blocking state [ 89.858298][ T5850] bridge0: port 1(bridge_slave_0) entered disabled state [ 89.866573][ T5850] bridge_slave_0: entered allmulticast mode [ 89.874131][ T5850] bridge_slave_0: entered promiscuous mode [ 89.882027][ T5850] bridge0: port 2(bridge_slave_1) entered blocking state [ 89.889349][ T5850] bridge0: port 2(bridge_slave_1) entered disabled state [ 89.896592][ T5850] bridge_slave_1: entered allmulticast mode [ 89.904614][ T5850] bridge_slave_1: entered promiscuous mode [ 89.932484][ T5848] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 89.941761][ T5860] bridge0: port 1(bridge_slave_0) entered blocking state [ 89.949329][ T5860] bridge0: port 1(bridge_slave_0) entered disabled state [ 89.958141][ T5860] bridge_slave_0: entered allmulticast mode [ 89.965768][ T5860] bridge_slave_0: entered promiscuous mode [ 90.020049][ T5848] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 90.040885][ T5860] bridge0: port 2(bridge_slave_1) entered blocking state [ 90.048990][ T5860] bridge0: port 2(bridge_slave_1) entered disabled state [ 90.056282][ T5860] bridge_slave_1: entered allmulticast mode [ 90.064406][ T5860] bridge_slave_1: entered promiscuous mode [ 90.087681][ T5850] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 90.099116][ T5849] team0: Port device team_slave_0 added [ 90.108357][ T5849] team0: Port device team_slave_1 added [ 90.167014][ T5850] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 90.207604][ T5857] bridge0: port 1(bridge_slave_0) entered blocking state [ 90.214902][ T5857] bridge0: port 1(bridge_slave_0) entered disabled state [ 90.225049][ T5857] bridge_slave_0: entered allmulticast mode [ 90.232534][ T5857] bridge_slave_0: entered promiscuous mode [ 90.241533][ T5848] team0: Port device team_slave_0 added [ 90.250663][ T5848] team0: Port device team_slave_1 added [ 90.288706][ T5849] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 90.295755][ T5849] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 90.322381][ T5849] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 90.336257][ T5849] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 90.343290][ T5849] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 90.369354][ T5849] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 90.380562][ T5857] bridge0: port 2(bridge_slave_1) entered blocking state [ 90.387991][ T5857] bridge0: port 2(bridge_slave_1) entered disabled state [ 90.395482][ T5857] bridge_slave_1: entered allmulticast mode [ 90.403165][ T5857] bridge_slave_1: entered promiscuous mode [ 90.423456][ T5854] Bluetooth: hci0: command tx timeout [ 90.441265][ T5860] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 90.492309][ T5857] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 90.502960][ T5854] Bluetooth: hci4: command tx timeout [ 90.508650][ T5854] Bluetooth: hci1: command tx timeout [ 90.514533][ T5852] Bluetooth: hci3: command tx timeout [ 90.514613][ T5856] Bluetooth: hci2: command tx timeout [ 90.537613][ T5860] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 90.564813][ T5850] team0: Port device team_slave_0 added [ 90.576139][ T5857] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 90.586026][ T5848] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 90.593191][ T5848] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 90.619468][ T5848] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 90.646543][ T5850] team0: Port device team_slave_1 added [ 90.667951][ T5848] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 90.675419][ T5848] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 90.701861][ T5848] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 90.720989][ T5860] team0: Port device team_slave_0 added [ 90.770159][ T5857] team0: Port device team_slave_0 added [ 90.794212][ T5860] team0: Port device team_slave_1 added [ 90.815308][ T5850] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 90.822349][ T5850] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 90.848451][ T5850] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 90.875640][ T5857] team0: Port device team_slave_1 added [ 90.887763][ T5849] hsr_slave_0: entered promiscuous mode [ 90.894770][ T5849] hsr_slave_1: entered promiscuous mode [ 90.928615][ T5848] hsr_slave_0: entered promiscuous mode [ 90.935095][ T5848] hsr_slave_1: entered promiscuous mode [ 90.941497][ T5848] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 90.950002][ T5848] Cannot create hsr debugfs directory [ 90.970798][ T5850] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 90.977968][ T5850] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 91.004641][ T5850] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 91.051407][ T5857] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 91.058490][ T5857] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 91.084838][ T5857] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 91.117639][ T5860] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 91.126005][ T5860] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 91.152574][ T5860] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 91.198092][ T5857] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 91.206085][ T5857] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 91.232612][ T5857] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 91.245072][ T5860] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 91.254906][ T5860] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 91.281567][ T5860] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 91.380649][ T5850] hsr_slave_0: entered promiscuous mode [ 91.387350][ T5850] hsr_slave_1: entered promiscuous mode [ 91.397946][ T5850] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 91.406380][ T5850] Cannot create hsr debugfs directory [ 91.522922][ T5857] hsr_slave_0: entered promiscuous mode [ 91.529483][ T5857] hsr_slave_1: entered promiscuous mode [ 91.536976][ T5857] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 91.544973][ T5857] Cannot create hsr debugfs directory [ 91.659954][ T5860] hsr_slave_0: entered promiscuous mode [ 91.667099][ T5860] hsr_slave_1: entered promiscuous mode [ 91.673393][ T5860] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 91.680964][ T5860] Cannot create hsr debugfs directory [ 91.865741][ T978] cfg80211: failed to load regulatory.db [ 92.080252][ T5848] netdevsim netdevsim2 netdevsim0: renamed from eth0 [ 92.095638][ T5848] netdevsim netdevsim2 netdevsim1: renamed from eth1 [ 92.128474][ T5848] netdevsim netdevsim2 netdevsim2: renamed from eth2 [ 92.161769][ T5848] netdevsim netdevsim2 netdevsim3: renamed from eth3 [ 92.261972][ T5850] netdevsim netdevsim3 netdevsim0: renamed from eth0 [ 92.281000][ T5850] netdevsim netdevsim3 netdevsim1: renamed from eth1 [ 92.302773][ T5850] netdevsim netdevsim3 netdevsim2: renamed from eth2 [ 92.319734][ T5850] netdevsim netdevsim3 netdevsim3: renamed from eth3 [ 92.439162][ T5849] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 92.468063][ T5849] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 92.479302][ T5849] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 92.502999][ T5856] Bluetooth: hci0: command tx timeout [ 92.514315][ T5849] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 92.582446][ T5852] Bluetooth: hci3: command tx timeout [ 92.583082][ T5869] Bluetooth: hci4: command tx timeout [ 92.587966][ T5854] Bluetooth: hci2: command tx timeout [ 92.599277][ T5856] Bluetooth: hci1: command tx timeout [ 92.614751][ T5857] netdevsim netdevsim4 netdevsim0: renamed from eth0 [ 92.626077][ T5857] netdevsim netdevsim4 netdevsim1: renamed from eth1 [ 92.657957][ T5857] netdevsim netdevsim4 netdevsim2: renamed from eth2 [ 92.686485][ T5857] netdevsim netdevsim4 netdevsim3: renamed from eth3 [ 92.787710][ T5848] 8021q: adding VLAN 0 to HW filter on device bond0 [ 92.808479][ T5860] netdevsim netdevsim1 netdevsim0: renamed from eth0 [ 92.820050][ T5860] netdevsim netdevsim1 netdevsim1: renamed from eth1 [ 92.845136][ T5860] netdevsim netdevsim1 netdevsim2: renamed from eth2 [ 92.868419][ T5860] netdevsim netdevsim1 netdevsim3: renamed from eth3 [ 92.897369][ T5848] 8021q: adding VLAN 0 to HW filter on device team0 [ 92.918186][ T5850] 8021q: adding VLAN 0 to HW filter on device bond0 [ 92.945021][ T3529] bridge0: port 1(bridge_slave_0) entered blocking state [ 92.952338][ T3529] bridge0: port 1(bridge_slave_0) entered forwarding state [ 92.990854][ T3529] bridge0: port 2(bridge_slave_1) entered blocking state [ 92.998011][ T3529] bridge0: port 2(bridge_slave_1) entered forwarding state [ 93.063210][ T5850] 8021q: adding VLAN 0 to HW filter on device team0 [ 93.085931][ T5849] 8021q: adding VLAN 0 to HW filter on device bond0 [ 93.116155][ T49] bridge0: port 1(bridge_slave_0) entered blocking state [ 93.123303][ T49] bridge0: port 1(bridge_slave_0) entered forwarding state [ 93.147001][ T1333] bridge0: port 2(bridge_slave_1) entered blocking state [ 93.154172][ T1333] bridge0: port 2(bridge_slave_1) entered forwarding state [ 93.212881][ T5849] 8021q: adding VLAN 0 to HW filter on device team0 [ 93.239973][ T5857] 8021q: adding VLAN 0 to HW filter on device bond0 [ 93.288514][ T3529] bridge0: port 1(bridge_slave_0) entered blocking state [ 93.296305][ T3529] bridge0: port 1(bridge_slave_0) entered forwarding state [ 93.309524][ T3529] bridge0: port 2(bridge_slave_1) entered blocking state [ 93.316736][ T3529] bridge0: port 2(bridge_slave_1) entered forwarding state [ 93.448491][ T5850] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 93.459699][ T5850] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 93.477871][ T5857] 8021q: adding VLAN 0 to HW filter on device team0 [ 93.489592][ T5860] 8021q: adding VLAN 0 to HW filter on device bond0 [ 93.529669][ T49] bridge0: port 1(bridge_slave_0) entered blocking state [ 93.536890][ T49] bridge0: port 1(bridge_slave_0) entered forwarding state [ 93.549029][ T49] bridge0: port 2(bridge_slave_1) entered blocking state [ 93.556256][ T49] bridge0: port 2(bridge_slave_1) entered forwarding state [ 93.625809][ T5848] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 93.679173][ T5860] 8021q: adding VLAN 0 to HW filter on device team0 [ 93.769470][ T12] bridge0: port 1(bridge_slave_0) entered blocking state [ 93.776722][ T12] bridge0: port 1(bridge_slave_0) entered forwarding state [ 93.790589][ T12] bridge0: port 2(bridge_slave_1) entered blocking state [ 93.797816][ T12] bridge0: port 2(bridge_slave_1) entered forwarding state [ 93.948056][ T5848] veth0_vlan: entered promiscuous mode [ 94.005396][ T5848] veth1_vlan: entered promiscuous mode [ 94.061281][ T5850] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 94.218625][ T5848] veth0_macvtap: entered promiscuous mode [ 94.280107][ T5848] veth1_macvtap: entered promiscuous mode [ 94.311146][ T5850] veth0_vlan: entered promiscuous mode [ 94.366724][ T5850] veth1_vlan: entered promiscuous mode [ 94.398756][ T5848] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 94.461003][ T5849] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 94.493982][ T5848] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 94.535345][ T5850] veth0_macvtap: entered promiscuous mode [ 94.550935][ T3529] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 94.560286][ T3529] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 94.579273][ T5857] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 94.584430][ T5856] Bluetooth: hci0: command tx timeout [ 94.604735][ T5850] veth1_macvtap: entered promiscuous mode [ 94.618783][ T3529] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 94.629648][ T3529] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 94.664096][ T5856] Bluetooth: hci4: command tx timeout [ 94.669555][ T5856] Bluetooth: hci1: command tx timeout [ 94.675072][ T5854] Bluetooth: hci2: command tx timeout [ 94.675098][ T5869] Bluetooth: hci3: command tx timeout [ 94.689258][ T5850] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 94.711985][ T5860] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 94.731296][ T5850] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 94.819717][ T1333] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 94.862962][ T1333] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 94.924305][ T1319] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 94.939569][ T5849] veth0_vlan: entered promiscuous mode [ 94.960625][ T1319] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 94.996007][ T13] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 95.014719][ T13] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 95.050374][ T5860] veth0_vlan: entered promiscuous mode [ 95.083760][ T5849] veth1_vlan: entered promiscuous mode [ 95.108852][ T1333] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 95.129108][ T1333] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 95.137136][ T5860] veth1_vlan: entered promiscuous mode [ 95.187987][ T12] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 95.226372][ T12] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 95.283035][ T5848] soft_limit_in_bytes is deprecated and will be removed. Please report your usecase to linux-mm@kvack.org if you depend on this functionality. [ 95.288773][ T5857] veth0_vlan: entered promiscuous mode [ 95.339398][ T1333] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 95.355728][ T1333] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 95.376266][ T5849] veth0_macvtap: entered promiscuous mode [ 95.394607][ T5857] veth1_vlan: entered promiscuous mode [ 95.405764][ T5849] veth1_macvtap: entered promiscuous mode [ 95.476489][ T5972] Set syz0 is full, maxelem 0 reached [ 95.485380][ T5860] veth0_macvtap: entered promiscuous mode [ 95.511069][ T5860] veth1_macvtap: entered promiscuous mode [ 95.546307][ T5849] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 95.610814][ T5860] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 95.640317][ T5974] Zero length message leads to an empty skb [ 95.658114][ T5849] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 95.704333][ T5860] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 95.770457][ T12] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 95.784371][ T12] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 95.803259][ T5857] veth0_macvtap: entered promiscuous mode [ 95.851072][ T12] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 95.863908][ T12] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 95.886678][ T5857] veth1_macvtap: entered promiscuous mode [ 95.984579][ T78] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 96.023018][ T12] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 96.202260][ T12] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 96.268612][ T12] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 96.451520][ T5857] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 96.540897][ T5857] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 96.557855][ T5974] UDPLite6: UDP-Lite is deprecated and scheduled to be removed in 2025, please contact the netdev mailing list [ 96.574702][ T1319] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 96.598708][ T1319] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 96.624029][ T13] netdevsim netdevsim4 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 96.634039][ T13] netdevsim netdevsim4 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 96.657757][ T13] netdevsim netdevsim4 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 96.666375][ T5869] Bluetooth: hci0: command tx timeout [ 96.669990][ T13] netdevsim netdevsim4 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 96.699483][ T78] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 96.722552][ T78] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 96.743107][ T5869] Bluetooth: hci1: command tx timeout [ 96.746725][ T5852] Bluetooth: hci2: command tx timeout [ 96.748568][ T5869] Bluetooth: hci4: command tx timeout [ 96.755192][ T5852] Bluetooth: hci3: command tx timeout [ 96.855554][ T13] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 96.886845][ T13] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 96.942007][ T12] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 96.970281][ T12] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 97.023897][ T12] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 97.074864][ T12] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 97.494301][ T13] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 97.544116][ T13] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 97.561193][ T5995] netlink: 16402 bytes leftover after parsing attributes in process `syz.1.2'. [ 97.625360][ T5998] IPVS: set_ctl: invalid protocol: 8345 172.30.1.2:20003 [ 97.658410][ T5997] vxcan1: entered allmulticast mode [ 97.679758][ T5995] Cannot find add_set index 3 as target [ 97.697716][ T5999] vxcan1: left allmulticast mode [ 97.737688][ T5993] netlink: 16402 bytes leftover after parsing attributes in process `syz.1.2'. [ 97.846023][ T5997] raw_sendmsg: syz.0.1 forgot to set AF_INET. Fix it! [ 97.944164][ T5998] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 98.348931][ T6008] UDPLite: UDP-Lite is deprecated and scheduled to be removed in 2025, please contact the netdev mailing list [ 98.561529][ T6011] netlink: 52 bytes leftover after parsing attributes in process `syz.3.11'. [ 98.588735][ T6011] netlink: 52 bytes leftover after parsing attributes in process `syz.3.11'. [ 98.614493][ T6011] netlink: 52 bytes leftover after parsing attributes in process `syz.3.11'. [ 98.618226][ T6013] x_tables: duplicate underflow at hook 3 [ 99.145099][ T6028] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 99.524069][ T6030] netlink: 76 bytes leftover after parsing attributes in process `syz.4.14'. [ 100.015551][ T6038] IPVS: Scheduler module ip_vs_ not found [ 100.226391][ T6049] workqueue: name exceeds WQ_NAME_LEN. Truncating to: žÀ^–>º>ùMv^µâ侦¸ÑKc'A¥»– [ 100.269686][ T6050] dummy0: entered promiscuous mode [ 100.300828][ T6050] vlan2: entered promiscuous mode [ 100.668071][ C0] Illegal XDP return value 16128 on prog (id 12) dev lo, expect packet loss! [ 100.727218][ T6054] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 102.010204][ C1] Unknown status report in ack skb [ 102.017562][ T6081] netlink: 32 bytes leftover after parsing attributes in process `syz.0.27'. [ 102.028803][ T6081] netem: unknown loss type 13 [ 102.034747][ T6081] netem: change failed [ 102.234650][ T978] ip6_tunnel: ip6gretap1 xmit: Local address not yet configured! [ 102.376214][ T6098] netlink: 32 bytes leftover after parsing attributes in process `syz.2.31'. [ 102.856193][ T6114] netlink: 212364 bytes leftover after parsing attributes in process `syz.1.34'. [ 102.859242][ T978] ip6_tunnel: ip6gretap1 xmit: Local address not yet configured! [ 102.891334][ T6114] openvswitch: netlink: Message has 5 unknown bytes. [ 102.913583][ T6117] syz.2.31 uses obsolete (PF_INET,SOCK_PACKET) [ 103.076045][ T1333] ip6_tunnel: ip6gretap1 xmit: Local address not yet configured! [ 103.466636][ T6127] netlink: 4 bytes leftover after parsing attributes in process `syz.3.37'. [ 103.496639][ T6125] lo: entered promiscuous mode [ 104.229605][ T3529] ip6_tunnel: ip6gretap1 xmit: Local address not yet configured! [ 104.257701][ T3529] ip6_tunnel: ip6gretap1 xmit: Local address not yet configured! [ 104.332395][ T9] ip6_tunnel: ip6gretap1 xmit: Local address not yet configured! [ 104.373681][ T6139] netlink: 'syz.1.41': attribute type 21 has an invalid length. [ 104.456343][ T6139] netlink: 156 bytes leftover after parsing attributes in process `syz.1.41'. [ 104.509715][ T6124] lo: left promiscuous mode [ 104.616696][ T6132] netlink: 8 bytes leftover after parsing attributes in process `syz.0.39'. [ 104.725386][ T6145] netlink: 8 bytes leftover after parsing attributes in process `syz.1.42'. [ 106.022190][ T6177] Bluetooth: MGMT ver 1.23 [ 106.159522][ T6178] netdevsim netdevsim0 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 106.332269][ T6188] !: renamed from dummy0 (while UP) [ 106.450026][ T6178] netdevsim netdevsim0 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 106.542226][ T6195] 8021q: VLANs not supported on lo [ 106.718731][ T6197] netlink: 28 bytes leftover after parsing attributes in process `syz.4.58'. [ 106.748168][ T6192] syz.1.57 (6192) used greatest stack depth: 17992 bytes left [ 106.768149][ T6178] netdevsim netdevsim0 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 106.918872][ T6178] netdevsim netdevsim0 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 106.951107][ C1] Unknown status report in ack skb [ 107.110882][ T6209] tipc: Started in network mode [ 107.116344][ T6209] tipc: Node identity fee0af746c17, cluster identity 4711 [ 107.125863][ T6209] tipc: Enabled bearer , priority 0 [ 107.143306][ T6209] syzkaller0: entered promiscuous mode [ 107.148839][ T6209] syzkaller0: entered allmulticast mode [ 107.176410][ T6212] netlink: 'syz.1.62': attribute type 1 has an invalid length. [ 107.188116][ T6211] netlink: 'syz.1.62': attribute type 1 has an invalid length. [ 107.198254][ T6211] netlink: 'syz.1.62': attribute type 2 has an invalid length. [ 107.206345][ T6212] netlink: 'syz.1.62': attribute type 1 has an invalid length. [ 107.230578][ T6214] bridge1: entered promiscuous mode [ 107.236181][ T6214] bridge1: entered allmulticast mode [ 107.349027][ T6209] tipc: Resetting bearer [ 107.367164][ T12] netdevsim netdevsim0 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 107.398228][ T6208] tipc: Resetting bearer [ 107.451325][ T6208] tipc: Disabling bearer [ 107.481405][ T12] netdevsim netdevsim0 eth1: set [1, 0] type 2 family 0 port 6081 - 0 [ 107.524887][ T1319] netdevsim netdevsim0 eth2: set [1, 0] type 2 family 0 port 6081 - 0 [ 107.571915][ T12] netdevsim netdevsim0 eth3: set [1, 0] type 2 family 0 port 6081 - 0 [ 107.796359][ T6237] netlink: 'syz.2.69': attribute type 2 has an invalid length. [ 107.942504][ T6242] netlink: 16 bytes leftover after parsing attributes in process `syz.2.69'. [ 108.224378][ T6244] Bluetooth: hci1: Opcode 0x080f failed: -4 [ 108.305346][ T6254] netlink: 248 bytes leftover after parsing attributes in process `syz.2.75'. [ 108.399373][ T6260] netlink: 20 bytes leftover after parsing attributes in process `syz.3.77'. [ 108.535907][ T6264] netlink: 8 bytes leftover after parsing attributes in process `syz.0.78'. [ 108.581165][ T6264] netlink: 4 bytes leftover after parsing attributes in process `syz.0.78'. [ 108.660582][ T6262] bridge0: port 2(bridge_slave_1) entered disabled state [ 108.669163][ T6262] bridge0: port 1(bridge_slave_0) entered disabled state [ 108.677202][ C0] ip6_tunnel: ip6gretap1 xmit: Local address not yet configured! [ 108.867278][ T6262] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 108.890112][ T6262] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 108.961845][ T6285] netlink: 8 bytes leftover after parsing attributes in process `syz.2.85'. [ 109.076660][ T6287] netlink: 8 bytes leftover after parsing attributes in process `syz.2.85'. [ 109.088760][ T6287] netlink: 4 bytes leftover after parsing attributes in process `syz.2.85'. [ 109.218219][ T1333] netdevsim netdevsim0 eth0: set [0, 0] type 1 family 0 port 8472 - 0 [ 109.243461][ T1333] netdevsim netdevsim0 eth0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 109.274362][ T1333] netdevsim netdevsim0 eth1: set [0, 0] type 1 family 0 port 8472 - 0 [ 109.292134][ T1333] netdevsim netdevsim0 eth1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 109.300730][ T6287] bridge_slave_1: left allmulticast mode [ 109.306760][ T6287] bridge_slave_1: left promiscuous mode [ 109.313621][ T6287] bridge0: port 2(bridge_slave_1) entered disabled state [ 109.340926][ T6287] bridge_slave_0: left allmulticast mode [ 109.347696][ T6287] bridge_slave_0: left promiscuous mode [ 109.354237][ T6287] bridge0: port 1(bridge_slave_0) entered disabled state [ 109.551371][ T1333] netdevsim netdevsim0 eth2: set [0, 0] type 1 family 0 port 8472 - 0 [ 109.575799][ T1333] netdevsim netdevsim0 eth2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 109.585201][ T1333] netdevsim netdevsim0 eth3: set [0, 0] type 1 family 0 port 8472 - 0 [ 109.601552][ T1333] netdevsim netdevsim0 eth3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 110.081104][ T6321] netlink: 4 bytes leftover after parsing attributes in process `syz.1.100'. [ 110.182541][ T5852] Bluetooth: hci1: command 0x080f tx timeout [ 110.220878][ T6328] netlink: 8 bytes leftover after parsing attributes in process `syz.2.102'. [ 111.210641][ T6373] A link change request failed with some changes committed already. Interface team0 may have been left with an inconsistent configuration, please check. [ 112.249764][ T6409] netlink: 'syz.4.137': attribute type 58 has an invalid length. [ 112.457307][ T6413] bridge0: port 2(bridge_slave_1) entered disabled state [ 112.646038][ T6428] bridge_slave_1: left allmulticast mode [ 112.659172][ T6428] bridge_slave_1: left promiscuous mode [ 112.693178][ T6428] bridge0: port 2(bridge_slave_1) entered disabled state [ 113.256520][ T6450] tipc: Started in network mode [ 113.261452][ T6450] tipc: Node identity , cluster identity 4711 [ 113.278602][ T6450] tipc: Failed to obtain node identity [ 113.324025][ T6450] tipc: Enabling of bearer rejected, failed to enable media [ 113.668025][ T6463] bridge0: port 2(bridge_slave_1) entered disabled state [ 114.408685][ T6509] ================================================================== [ 114.416816][ T6509] BUG: KASAN: slab-use-after-free in tcp_prune_ofo_queue+0x37e/0x6e0 [ 114.424937][ T6509] Read of size 4 at addr ffff88806230bd50 by task syz.2.180/6509 [ 114.432680][ T6509] [ 114.435053][ T6509] CPU: 0 UID: 0 PID: 6509 Comm: syz.2.180 Not tainted 6.16.0-rc5-syzkaller-01458-gc3886ccaadf8 #0 PREEMPT(full) [ 114.435082][ T6509] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 114.435102][ T6509] Call Trace: [ 114.435111][ T6509] [ 114.435120][ T6509] dump_stack_lvl+0x189/0x250 [ 114.435149][ T6509] ? rcu_is_watching+0x15/0xb0 [ 114.435174][ T6509] ? __kasan_check_byte+0x12/0x40 [ 114.435204][ T6509] ? __pfx_dump_stack_lvl+0x10/0x10 [ 114.435225][ T6509] ? rcu_is_watching+0x15/0xb0 [ 114.435244][ T6509] ? lock_release+0x4b/0x3e0 [ 114.435262][ T6509] ? _raw_spin_lock_irqsave+0xb3/0xf0 [ 114.435283][ T6509] ? __virt_addr_valid+0x1c8/0x5c0 [ 114.435306][ T6509] ? __virt_addr_valid+0x4a5/0x5c0 [ 114.435328][ T6509] print_report+0xd2/0x2b0 [ 114.435343][ T6509] ? tcp_prune_ofo_queue+0x37e/0x6e0 [ 114.435365][ T6509] kasan_report+0x118/0x150 [ 114.435388][ T6509] ? tcp_prune_ofo_queue+0x37e/0x6e0 [ 114.435414][ T6509] tcp_prune_ofo_queue+0x37e/0x6e0 [ 114.435444][ T6509] tcp_try_rmem_schedule+0xb6b/0x1830 [ 114.435471][ T6509] tcp_data_queue+0x4e3/0x6380 [ 114.435501][ T6509] ? __pfx_tcp_data_queue+0x10/0x10 [ 114.435521][ T6509] ? __pfx_tcp_urg+0x10/0x10 [ 114.435542][ T6509] ? read_tsc+0x9/0x20 [ 114.435563][ T6509] tcp_rcv_established+0xf9e/0x1eb0 [ 114.435584][ T6509] ? rt_is_expired+0x1c/0x2d0 [ 114.435615][ T6509] ? __pfx_tcp_rcv_established+0x10/0x10 [ 114.435634][ T6509] ? rt_is_expired+0x1c/0x2d0 [ 114.435663][ T6509] ? rt_is_expired+0x1c/0x2d0 [ 114.435693][ T6509] ? rt_is_expired+0x250/0x2d0 [ 114.435722][ T6509] ? __pfx_ipv4_dst_check+0x10/0x10 [ 114.435761][ T6509] ? __pfx_ipv4_dst_check+0x10/0x10 [ 114.435792][ T6509] tcp_v4_do_rcv+0xa23/0xce0 [ 114.435822][ T6509] ? __pfx_tcp_v4_do_rcv+0x10/0x10 [ 114.435848][ T6509] __release_sock+0x21c/0x350 [ 114.435876][ T6509] release_sock+0x5f/0x1f0 [ 114.435905][ T6509] tcp_sendmsg+0x39/0x50 [ 114.435928][ T6509] __sock_sendmsg+0x19c/0x270 [ 114.435952][ T6509] __sys_sendto+0x3bd/0x520 [ 114.435981][ T6509] ? __pfx___sys_sendto+0x10/0x10 [ 114.436006][ T6509] ? do_futex+0x395/0x420 [ 114.436049][ T6509] ? rcu_is_watching+0x15/0xb0 [ 114.436076][ T6509] __x64_sys_sendto+0xde/0x100 [ 114.436105][ T6509] do_syscall_64+0xfa/0x3b0 [ 114.436130][ T6509] ? lockdep_hardirqs_on+0x9c/0x150 [ 114.436154][ T6509] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 114.436172][ T6509] ? clear_bhb_loop+0x60/0xb0 [ 114.436195][ T6509] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 114.436214][ T6509] RIP: 0033:0x7f68c2b8e929 [ 114.436238][ T6509] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 114.436254][ T6509] RSP: 002b:00007f68c3944038 EFLAGS: 00000246 ORIG_RAX: 000000000000002c [ 114.436276][ T6509] RAX: ffffffffffffffda RBX: 00007f68c2db5fa0 RCX: 00007f68c2b8e929 [ 114.436291][ T6509] RDX: 000000000000059a RSI: 0000200000000580 RDI: 0000000000000003 [ 114.436304][ T6509] RBP: 00007f68c2c10b39 R08: 0000000000000000 R09: 0000000000000000 [ 114.436317][ T6509] R10: 0000000010008095 R11: 0000000000000246 R12: 0000000000000000 [ 114.436329][ T6509] R13: 0000000000000000 R14: 00007f68c2db5fa0 R15: 00007ffc1d0f7f08 [ 114.436351][ T6509] [ 114.436359][ T6509] [ 114.752554][ T6509] Allocated by task 6509: [ 114.756892][ T6509] kasan_save_track+0x3e/0x80 [ 114.761581][ T6509] __kasan_slab_alloc+0x6c/0x80 [ 114.766524][ T6509] kmem_cache_alloc_node_noprof+0x1bb/0x3c0 [ 114.772431][ T6509] __alloc_skb+0x112/0x2d0 [ 114.776859][ T6509] tcp_stream_alloc_skb+0x3d/0x340 [ 114.781978][ T6509] tcp_sendmsg_locked+0xefc/0x56d0 [ 114.787102][ T6509] tcp_sendmsg+0x2f/0x50 [ 114.791348][ T6509] __sock_sendmsg+0x19c/0x270 [ 114.796032][ T6509] __sys_sendto+0x3bd/0x520 [ 114.800544][ T6509] __x64_sys_sendto+0xde/0x100 [ 114.805318][ T6509] do_syscall_64+0xfa/0x3b0 [ 114.809843][ T6509] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 114.815782][ T6509] [ 114.818128][ T6509] Freed by task 6509: [ 114.822133][ T6509] kasan_save_track+0x3e/0x80 [ 114.826841][ T6509] kasan_save_free_info+0x46/0x50 [ 114.831902][ T6509] __kasan_slab_free+0x62/0x70 [ 114.836780][ T6509] kmem_cache_free+0x18f/0x400 [ 114.841566][ T6509] tcp_prune_ofo_queue+0x198/0x6e0 [ 114.846711][ T6509] tcp_try_rmem_schedule+0xb6b/0x1830 [ 114.852135][ T6509] tcp_data_queue+0x4e3/0x6380 [ 114.856924][ T6509] tcp_rcv_established+0xf9e/0x1eb0 [ 114.862166][ T6509] tcp_v4_do_rcv+0xa23/0xce0 [ 114.866784][ T6509] __release_sock+0x21c/0x350 [ 114.871559][ T6509] release_sock+0x5f/0x1f0 [ 114.875994][ T6509] tcp_sendmsg+0x39/0x50 [ 114.880260][ T6509] __sock_sendmsg+0x19c/0x270 [ 114.884962][ T6509] __sys_sendto+0x3bd/0x520 [ 114.889500][ T6509] __x64_sys_sendto+0xde/0x100 [ 114.894284][ T6509] do_syscall_64+0xfa/0x3b0 [ 114.898812][ T6509] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 114.904728][ T6509] [ 114.907070][ T6509] The buggy address belongs to the object at ffff88806230bb80 [ 114.907070][ T6509] which belongs to the cache skbuff_fclone_cache of size 488 [ 114.921839][ T6509] The buggy address is located 464 bytes inside of [ 114.921839][ T6509] freed 488-byte region [ffff88806230bb80, ffff88806230bd68) [ 114.935656][ T6509] [ 114.937994][ T6509] The buggy address belongs to the physical page: [ 114.944415][ T6509] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x6230a [ 114.953198][ T6509] head: order:1 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 114.961698][ T6509] flags: 0xfff00000000040(head|node=0|zone=1|lastcpupid=0x7ff) [ 114.969256][ T6509] page_type: f5(slab) [ 114.973243][ T6509] raw: 00fff00000000040 ffff88801eaeda00 ffffea0001f96080 0000000000000006 [ 114.981831][ T6509] raw: 0000000000000000 00000000000c000c 00000000f5000000 0000000000000000 [ 114.990428][ T6509] head: 00fff00000000040 ffff88801eaeda00 ffffea0001f96080 0000000000000006 [ 114.999105][ T6509] head: 0000000000000000 00000000000c000c 00000000f5000000 0000000000000000 [ 115.007956][ T6509] head: 00fff00000000001 ffffea000188c281 00000000ffffffff 00000000ffffffff [ 115.016641][ T6509] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000002 [ 115.025322][ T6509] page dumped because: kasan: bad access detected [ 115.031880][ T6509] page_owner tracks the page as allocated [ 115.037604][ T6509] page last allocated via order 1, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 5700, tgid 5700 (sshd-session), ts 74917175508, free_ts 29624592656 [ 115.059328][ T6509] post_alloc_hook+0x240/0x2a0 [ 115.064114][ T6509] get_page_from_freelist+0x21e4/0x22c0 [ 115.069672][ T6509] __alloc_frozen_pages_noprof+0x181/0x370 [ 115.075484][ T6509] alloc_pages_mpol+0x232/0x4a0 [ 115.080348][ T6509] allocate_slab+0x8a/0x3b0 [ 115.084877][ T6509] ___slab_alloc+0xbfc/0x1480 [ 115.089572][ T6509] kmem_cache_alloc_node_noprof+0x280/0x3c0 [ 115.095561][ T6509] __alloc_skb+0x112/0x2d0 [ 115.099993][ T6509] tcp_stream_alloc_skb+0x3d/0x340 [ 115.105223][ T6509] tcp_sendmsg_locked+0xefc/0x56d0 [ 115.110344][ T6509] tcp_sendmsg+0x2f/0x50 [ 115.114600][ T6509] __sock_sendmsg+0x19c/0x270 [ 115.119284][ T6509] sock_write_iter+0x258/0x330 [ 115.124053][ T6509] vfs_write+0x54b/0xa90 [ 115.128297][ T6509] ksys_write+0x145/0x250 [ 115.132625][ T6509] do_syscall_64+0xfa/0x3b0 [ 115.137145][ T6509] page last free pid 1 tgid 1 stack trace: [ 115.142952][ T6509] __free_frozen_pages+0xc71/0xe70 [ 115.148073][ T6509] free_contig_range+0x1bd/0x4a0 [ 115.153009][ T6509] destroy_args+0x7e/0x5d0 [ 115.157426][ T6509] debug_vm_pgtable+0x412/0x450 [ 115.162302][ T6509] do_one_initcall+0x233/0x820 [ 115.167692][ T6509] do_initcall_level+0x137/0x1f0 [ 115.172635][ T6509] do_initcalls+0x69/0xd0 [ 115.176971][ T6509] kernel_init_freeable+0x3d9/0x570 [ 115.182184][ T6509] kernel_init+0x1d/0x1d0 [ 115.186529][ T6509] ret_from_fork+0x3fc/0x770 [ 115.191134][ T6509] ret_from_fork_asm+0x1a/0x30 [ 115.195909][ T6509] [ 115.198235][ T6509] Memory state around the buggy address: [ 115.203867][ T6509] ffff88806230bc00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 115.211931][ T6509] ffff88806230bc80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 115.219993][ T6509] >ffff88806230bd00: fb fb fb fb fb fb fb fb fb fb fb fb fb fc fc fc [ 115.228049][ T6509] ^ [ 115.234719][ T6509] ffff88806230bd80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 115.242781][ T6509] ffff88806230be00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 115.250837][ T6509] ================================================================== [ 115.274226][ T6509] Kernel panic - not syncing: KASAN: panic_on_warn set ... [ 115.281479][ T6509] CPU: 0 UID: 0 PID: 6509 Comm: syz.2.180 Not tainted 6.16.0-rc5-syzkaller-01458-gc3886ccaadf8 #0 PREEMPT(full) [ 115.293655][ T6509] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 115.303816][ T6509] Call Trace: [ 115.307102][ T6509] [ 115.310036][ T6509] dump_stack_lvl+0x99/0x250 [ 115.314637][ T6509] ? __asan_memcpy+0x40/0x70 [ 115.319239][ T6509] ? __pfx_dump_stack_lvl+0x10/0x10 [ 115.324462][ T6509] ? __pfx__printk+0x10/0x10 [ 115.329085][ T6509] panic+0x2db/0x790 [ 115.332989][ T6509] ? __pfx_preempt_schedule+0x10/0x10 [ 115.338377][ T6509] ? __pfx_panic+0x10/0x10 [ 115.342812][ T6509] ? _raw_spin_unlock_irqrestore+0xfd/0x110 [ 115.348719][ T6509] ? __pfx__raw_spin_unlock_irqrestore+0x10/0x10 [ 115.355054][ T6509] ? tcp_prune_ofo_queue+0x37e/0x6e0 [ 115.360349][ T6509] check_panic_on_warn+0x89/0xb0 [ 115.365303][ T6509] ? tcp_prune_ofo_queue+0x37e/0x6e0 [ 115.370593][ T6509] end_report+0x78/0x160 [ 115.374843][ T6509] kasan_report+0x129/0x150 [ 115.379381][ T6509] ? tcp_prune_ofo_queue+0x37e/0x6e0 [ 115.384681][ T6509] tcp_prune_ofo_queue+0x37e/0x6e0 [ 115.389810][ T6509] tcp_try_rmem_schedule+0xb6b/0x1830 [ 115.395200][ T6509] tcp_data_queue+0x4e3/0x6380 [ 115.399987][ T6509] ? __pfx_tcp_data_queue+0x10/0x10 [ 115.405196][ T6509] ? __pfx_tcp_urg+0x10/0x10 [ 115.409800][ T6509] ? read_tsc+0x9/0x20 [ 115.413876][ T6509] tcp_rcv_established+0xf9e/0x1eb0 [ 115.419085][ T6509] ? rt_is_expired+0x1c/0x2d0 [ 115.423780][ T6509] ? __pfx_tcp_rcv_established+0x10/0x10 [ 115.429416][ T6509] ? rt_is_expired+0x1c/0x2d0 [ 115.434104][ T6509] ? rt_is_expired+0x1c/0x2d0 [ 115.438796][ T6509] ? rt_is_expired+0x250/0x2d0 [ 115.443577][ T6509] ? __pfx_ipv4_dst_check+0x10/0x10 [ 115.448787][ T6509] ? __pfx_ipv4_dst_check+0x10/0x10 [ 115.453997][ T6509] tcp_v4_do_rcv+0xa23/0xce0 [ 115.458601][ T6509] ? __pfx_tcp_v4_do_rcv+0x10/0x10 [ 115.463722][ T6509] __release_sock+0x21c/0x350 [ 115.468410][ T6509] release_sock+0x5f/0x1f0 [ 115.472835][ T6509] tcp_sendmsg+0x39/0x50 [ 115.477083][ T6509] __sock_sendmsg+0x19c/0x270 [ 115.481768][ T6509] __sys_sendto+0x3bd/0x520 [ 115.486287][ T6509] ? __pfx___sys_sendto+0x10/0x10 [ 115.491338][ T6509] ? do_futex+0x395/0x420 [ 115.495698][ T6509] ? rcu_is_watching+0x15/0xb0 [ 115.500475][ T6509] __x64_sys_sendto+0xde/0x100 [ 115.505255][ T6509] do_syscall_64+0xfa/0x3b0 [ 115.509772][ T6509] ? lockdep_hardirqs_on+0x9c/0x150 [ 115.514977][ T6509] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 115.521051][ T6509] ? clear_bhb_loop+0x60/0xb0 [ 115.525732][ T6509] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 115.531627][ T6509] RIP: 0033:0x7f68c2b8e929 [ 115.536052][ T6509] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 115.555663][ T6509] RSP: 002b:00007f68c3944038 EFLAGS: 00000246 ORIG_RAX: 000000000000002c [ 115.564092][ T6509] RAX: ffffffffffffffda RBX: 00007f68c2db5fa0 RCX: 00007f68c2b8e929 [ 115.572160][ T6509] RDX: 000000000000059a RSI: 0000200000000580 RDI: 0000000000000003 [ 115.580135][ T6509] RBP: 00007f68c2c10b39 R08: 0000000000000000 R09: 0000000000000000 [ 115.588115][ T6509] R10: 0000000010008095 R11: 0000000000000246 R12: 0000000000000000 [ 115.596112][ T6509] R13: 0000000000000000 R14: 00007f68c2db5fa0 R15: 00007ffc1d0f7f08 [ 115.604108][ T6509] [ 115.607453][ T6509] Kernel Offset: disabled [ 115.611783][ T6509] Rebooting in 86400 seconds..