last executing test programs: 12.26658731s ago: executing program 3 (id=20845): r0 = socket$kcm(0x10, 0x2, 0x10) r1 = perf_event_open(&(0x7f0000000040)={0x2, 0x80, 0xed, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xa}, 0x104101, 0x4, 0x0, 0x1, 0x0, 0x0, 0x1}, 0x0, 0x1, 0xffffffffffffffff, 0x0) r2 = bpf$PROG_LOAD(0x5, &(0x7f00000018c0)={0x5, 0x5, &(0x7f0000000180)=ANY=[@ANYBLOB="180800000000000000000000000000001800000000000000000000000000000095"], &(0x7f0000000280)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x48, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) ioctl$PERF_EVENT_IOC_SET_BPF(r1, 0x40042408, r2) sendmsg$kcm(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f00000002c0)=[{&(0x7f0000000080)="2e0000003e000511d25a80698c6394090324fc602f6e35400800018025581d00d1bd00"/46, 0x2e}], 0x1, 0x0, 0x0, 0x39c}, 0x0) 11.981832348s ago: executing program 3 (id=20851): r0 = perf_event_open(&(0x7f0000000040)={0x2, 0x80, 0xec, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0x4}, 0x10001, 0x7ff, 0x0, 0x7, 0x0, 0x0, 0x1}, 0x0, 0x1, 0xffffffffffffffff, 0x0) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000018c0)={0x5, 0x5, &(0x7f0000000180)=ANY=[@ANYBLOB="180800000000000000000000000000001800000000000000000000000000000095"], &(0x7f0000000280)='GPL\x00', 0x4, 0x0, 0x0, 0x0, 0x48, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) ioctl$PERF_EVENT_IOC_SET_BPF(r0, 0x40042408, r1) r2 = socket$kcm(0x10, 0x2, 0x10) sendmsg$kcm(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)=[{&(0x7f0000000040)="140000002d000b02d25a806f8c6394f9031a0400", 0x14}], 0x1}, 0x0) 11.773069313s ago: executing program 3 (id=20856): r0 = perf_event_open(&(0x7f0000000040)={0x2, 0x80, 0xec, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xa}, 0x114905, 0x4, 0x0, 0x1, 0x0, 0x0, 0x1}, 0x0, 0x1, 0xffffffffffffffff, 0x0) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x5, 0x5, &(0x7f0000000180)=ANY=[@ANYBLOB="180800000000000000000000000000001800000000000000000000000000000095"], &(0x7f0000000280)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x48, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) ioctl$PERF_EVENT_IOC_SET_BPF(r0, 0x40042408, r1) r2 = socket$kcm(0x10, 0x2, 0x10) sendmsg$kcm(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000000c0)=[{&(0x7f0000000180)="350400004100054cc6a119e30980a843015a35400c00020002452b0c7f21d100002037153e370c04018006041a004500ac377653c6de2a7c1af4a918505e7a19ff6dc6a3cb9708b9469405009c8e000000800000516c006c154938456646efee34b951a078932502bdbcf6c6b8d226dc64f5b1a0718d687ed8934d4780bae8ba0a55a6c130214043ff8ad5084a642a4d4aac02e408ff3af4be0000000000005b3ceabc3ad0dcf506e49fc53f2d6ef7b311065ea22bc6d528c88fd15df422c8a63e1835674464541c201f843eccf75e7cecddf3a7464ca5b6a9e0b8f2cb286aa8cf672e7bf2e0270f830e01f0a48af76682b068ccaef35850dc2168aa5f5d25c9042255c7ee9048013dd0c07bdbd29d5617f26824ebdce61e63402cec93032363325edd84bb957353b8f9add6f0bc8f0923277229e8b85fd6916d61e6ea2c2e68c581331a74", 0x145}, {&(0x7f0000000a40)="d4fa0c511aad03aa5ed217677bc41c027d9c830c439c7f821ddd78b6915cb170e7603acf9e433c2903bb6773f4b0130668a1e5b5e08d21d0b69c28ca3455aed65855c86f3d1e5789d26375a0d85eaf5e92e19c9affcf76e7a94e76556d2b104ebf645747fadc91460f4b3c94e1a89b51be4a6aa4c65285f988329a8163b69c51b801500a5bacd0463976e2960e2679ef2feee5e6ce6bb78a51fb0e15820d13e4a5aa9e0742a6f8d677ad28fea356657bb550c8311b682d9003c82267a15aa7334bc53b65b9119a1a7d905c7dd365b85c230bbad0d5d0a79819e112637819d9a187cfdf782c6127d2d4281926ab0e22f7346b616fe28ed0b9f4a0c9fdac6d3a90a9c38b5e31448a45546388c95045bc2261c238a5159ea98db9c00aeef644ae98a8cb8da3ff3b7ba14d7971910b559623af829524d83bf19f18628464076329140e0203fc75859185ccd019302afb784e41e16cf2d31db7aba83d0f500ce25fc2d7f524a04cfaa0015ea8a297477a5517f8a4ac167083a321c78070974afc897fb738fbcfeac369844fd7fc11fff502c02b7607007ead2007a18006a6ca8dc2d0119f01d7083c2ab5760ac7b24d7bf26b9030cf455a08385f9e662cbe0c3ca6e6fd4ac0c8566c0fca986c68ef7016a11d3e44253b6f2d07d53505ed58b8ad410f89425046321b4a9b27b5e767bdfa0ebf7abf3d91b319129c48853d8e5cbc4a2c5c560b007eafe03e3332f6017f3164c7f602180aad23dfe5e770fe8855f45925e342b7dfd7ddaa68b65065465cdf4d5b8d995d6e6a7042ebea3d139c6a616232eb4efd1a50d0e6db3188a8e98375fda2a7ebd4cd59b9ea626c13685b05e6cf4d484e32869fd7c7167dbfa48b1529e5dd5f5a02673ccc7dbedfd75e34f3f9eb3c7833734a59acada6dd2ff364475e03f2219deedb5d0c941f2177a23167adcc5a15f4e5441ed537f26a1620df057aeb55b2ad3a00a77e23d304ed6034dd5ec9b2cfe777ca21ec4f48abdafa0d66a78d653068ef871bdc6598fd32edcba60c675a1e8f4e81e83f73414c179bfb7f329d71", 0x2f0}], 0x2}, 0x10041094) 11.367893024s ago: executing program 3 (id=20857): bpf$MAP_GET_NEXT_KEY(0x2, &(0x7f0000000080)={0xffffffffffffffff, 0x0, &(0x7f0000000200)=""/166}, 0x20) ioctl$TUNSETCARRIER(0xffffffffffffffff, 0x400454e2, &(0x7f0000000000)=0x3d) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000080)={'netdevsim0\x00'}) socketpair(0x1, 0x1, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_SET_FILTER(r0, 0x8946, &(0x7f0000000080)) 11.211883697s ago: executing program 3 (id=20860): bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000240)={0x0, 0xffffffffffffffff, 0x0, 0x7, &(0x7f0000000000)='cgroup\x00'}, 0x30) r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r1 = openat$cgroup_int(r0, &(0x7f0000000080)='pids.max\x00', 0x2, 0x0) write$cgroup_subtree(r1, &(0x7f0000000100)=ANY=[@ANYBLOB='-0'], 0x9) syz_clone(0x4001000, 0x0, 0x408, &(0x7f0000000140), 0x0, 0x0) 10.997206493s ago: executing program 2 (id=20861): r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000200)=@base={0x5, 0x5, 0x2, 0x7, 0x0, 0x1, 0x10000}, 0x50) close(0x3) bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="0600000004000000ff0f000007"], 0x48) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xd, &(0x7f0000000440)=@framed={{0x18, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x4000}, [@ringbuf_output={{0x18, 0x1, 0x1, 0x0, r0}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0x4}, {}, {}, {}, {}, {0x7, 0x0, 0xb, 0x4, 0x0, 0x0, 0x2}, {0x85, 0x0, 0x0, 0x3}}, @call={0x85, 0x0, 0x0, 0x7d}]}, &(0x7f0000000400)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback=0xd, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$PROG_BIND_MAP(0xa, &(0x7f00000003c0)={r1, r0}, 0xc) 10.886558355s ago: executing program 3 (id=20862): perf_event_open(&(0x7f0000000140)={0x2, 0x80, 0x29, 0x1, 0x0, 0x0, 0x0, 0x40000004, 0xa021, 0x15, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffe, 0x2, @perf_config_ext={0xd040, 0x10000}, 0x14403, 0xfffc, 0x0, 0x5, 0x582, 0x20005, 0x4, 0x0, 0x0, 0x0, 0x80000001}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x2) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000380)='memory.events\x00', 0x26e1, 0x0) r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000300)=@base={0x10, 0x4, 0x4, 0x2, 0x0, 0x1}, 0x50) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000a80)={{r1}, &(0x7f0000000a00), &(0x7f0000000400)=r0}, 0x20) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000900)={{r1}, &(0x7f0000000880), &(0x7f00000008c0)=r0}, 0x20) 10.520400015s ago: executing program 2 (id=20865): r0 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000580)=ANY=[@ANYBLOB="0200000004000000080000000100000080"], 0x50) bpf$MAP_UPDATE_CONST_STR(0x2, &(0x7f00000000c0)={{r0, 0xffffffffffffffff}, &(0x7f0000000040), &(0x7f0000000080)='%-5lx \x00'}, 0x20) bpf$BPF_MAP_CONST_STR_FREEZE(0x16, &(0x7f0000000100)={r1}, 0x4) r2 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x3, 0x18, &(0x7f0000000640)=@framed={{}, [@printk={@lli, {}, {}, {}, {}, {0x7, 0x0, 0xb, 0x3, 0x0, 0x0, 0xfffffffd}, {0x85, 0x0, 0x0, 0x71}}, @snprintf={{}, {}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0x54}, {}, {}, {}, {}, {}, {}, {0x18, 0x3, 0x2, 0x0, r0}}]}, &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sched_cls, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000240)={r2, 0x0, 0x10, 0x10, &(0x7f00000002c0)="0000ffffffffa000", &(0x7f0000000300)=""/8, 0xa00, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x4c) 4.614227754s ago: executing program 2 (id=20868): bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000800)={0x1f, 0xc, &(0x7f00000000c0)=ANY=[@ANYRESDEC], 0x0, 0x0, 0x0, 0x0, 0x0, 0x1b}, 0x94) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup/syz1\x00', 0x1ff) r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r1 = openat$cgroup_procs(r0, &(0x7f0000000080)='cgroup.procs\x00', 0x2, 0x0) write$cgroup_subtree(r1, &(0x7f00000000c0)=ANY=[], 0xc) 4.37770384s ago: executing program 2 (id=20872): bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000240)={0x0, 0xffffffffffffffff, 0x0, 0x7, &(0x7f0000000000)='cgroup\x00'}, 0x30) r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r1 = openat$cgroup_int(r0, &(0x7f0000000080)='pids.max\x00', 0x2, 0x0) write$cgroup_subtree(r1, &(0x7f0000000100)=ANY=[@ANYBLOB='-0'], 0x9) syz_clone(0x4001000, 0x0, 0x408, &(0x7f0000000140), 0x0, 0x0) 3.869029242s ago: executing program 2 (id=20875): bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="0000000000000000000000000000000001"], 0x48) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000480)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$inet(r1, &(0x7f0000001780)={0x0, 0x0, 0x0}, 0x0) recvmsg$unix(r0, &(0x7f0000001b40)={0x0, 0x0, 0x0, 0x0, &(0x7f00000000c0)=[@rights={{0x14, 0x1, 0x1, [0xffffffffffffffff]}}], 0xfffffffffffffde3}, 0x0) setsockopt$sock_attach_bpf(r1, 0x1, 0x35, &(0x7f0000000040)=r2, 0x13) 3.781424335s ago: executing program 1 (id=20876): socketpair(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000380)=@base={0x12, 0xa, 0x4, 0x2}, 0x50) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000180)={{r1}, &(0x7f0000000040), &(0x7f0000000140)=r0}, 0x20) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000600)={{r1}, &(0x7f0000000580)=0x2, &(0x7f00000005c0)=r0}, 0x20) bpf$MAP_DELETE_ELEM(0x3, &(0x7f0000000080)={r1, &(0x7f0000000040)}, 0x20) 3.642157928s ago: executing program 1 (id=20878): perf_event_open(&(0x7f0000000500)={0x2, 0x80, 0x28, 0x1, 0x0, 0x0, 0x0, 0x9, 0x640b9, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x107b7e, 0x2, @perf_config_ext={0x0, 0x3fff8000}, 0x0, 0x32, 0x43a1bd76, 0x7, 0x9, 0x6, 0x2, 0x0, 0x0, 0x0, 0x2009}, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f00000001c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5d34, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, 0x3efd7ab4c41335d9, @perf_bp={0x0, 0xf}, 0x0, 0x4, 0x310c, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x4000000000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xa) bpf$MAP_CREATE_CONST_STR(0x0, 0x0, 0x0) r0 = socket$kcm(0x11, 0x3, 0x0) sendmsg$kcm(r0, &(0x7f0000000fc0)={&(0x7f0000000e00)=@hci={0x1f, 0x200, 0x31}, 0x80, &(0x7f0000000200)=[{&(0x7f0000000180)="4a440100000021d77e601993f019c088fb", 0x11}], 0x1}, 0x0) 3.258881648s ago: executing program 1 (id=20880): ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000080)={'wlan0\x00'}) socketpair(0x1, 0x5, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) close(r0) socket$kcm(0xa, 0x2, 0x73) ioctl$PERF_EVENT_IOC_SET_FILTER(r0, 0x8931, &(0x7f0000000080)) 2.952808516s ago: executing program 0 (id=20882): close(0x3) bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x1d, 0x0, 0x0, &(0x7f0000000000)='GPL\x00', 0x4}, 0x94) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000080)={'wlan0\x00', 0x200}) socketpair(0x1, 0x1, 0x1, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_SET_FILTER(r0, 0x8946, &(0x7f0000000080)) 1.906739922s ago: executing program 1 (id=20883): bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000240)={0x0, 0xffffffffffffffff, 0x0, 0x7, &(0x7f0000000000)='cgroup\x00'}, 0x30) r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r1 = openat$cgroup_int(r0, &(0x7f0000000080)='pids.max\x00', 0x2, 0x0) write$cgroup_subtree(r1, &(0x7f0000000100)=ANY=[@ANYBLOB='-0'], 0x9) syz_clone(0x4001000, 0x0, 0x408, &(0x7f0000000140), 0x0, 0x0) 1.906603232s ago: executing program 2 (id=20884): bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=@base={0x5, 0x4, 0x8, 0x5}, 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0x14, &(0x7f0000000280)=ANY=[@ANYBLOB="180000000000000000000000000000001801000020646c2100000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000007d00000018110000", @ANYRES32, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b70400000000000085000000c300000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r0 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[], 0x48) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0x14, &(0x7f0000000280)=ANY=[@ANYBLOB="180000000000000000000000000000001801000020646c2100000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000007300000018110000", @ANYRES32=r0], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0xe, '\x00', 0x0, @fallback=0x25, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$PROG_BIND_MAP(0xa, &(0x7f0000000080)={r1}, 0xc) 1.903235763s ago: executing program 0 (id=20890): ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000080)={'wlan0\x00'}) socketpair(0x1, 0x5, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) close(r0) socket$kcm(0xa, 0x2, 0x73) ioctl$PERF_EVENT_IOC_SET_FILTER(r0, 0x8931, &(0x7f0000000080)) 1.292758608s ago: executing program 0 (id=20885): socketpair(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000380)=@base={0x12, 0xa, 0x4, 0x2}, 0x50) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000180)={{r1}, &(0x7f0000000040), &(0x7f0000000140)=r0}, 0x20) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000600)={{r1}, &(0x7f0000000580)=0x2, &(0x7f00000005c0)=r0}, 0x20) bpf$MAP_DELETE_ELEM(0x3, &(0x7f0000000080)={r1, &(0x7f0000000040)}, 0x20) 1.287228318s ago: executing program 1 (id=20893): r0 = perf_event_open(&(0x7f0000000040)={0x2, 0x80, 0xec, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0x4}, 0x10001, 0x7ff, 0x0, 0x7, 0x0, 0x0, 0x1}, 0x0, 0x1, 0xffffffffffffffff, 0x0) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000018c0)={0x5, 0x5, &(0x7f0000000180)=ANY=[@ANYBLOB="180800000000000000000000000000001800000000000000000000000000000095"], &(0x7f0000000280)='GPL\x00', 0x4, 0x0, 0x0, 0x0, 0x48, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) ioctl$PERF_EVENT_IOC_SET_BPF(r0, 0x40042408, r1) r2 = socket$kcm(0x10, 0x2, 0x10) sendmsg$kcm(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)=[{&(0x7f0000000040)="140000002d000b02d25a806f8c6394f9031a0400", 0x14}], 0x1}, 0x0) 1.088207393s ago: executing program 0 (id=20886): perf_event_open(&(0x7f0000000040)={0x2, 0x80, 0xec, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2101, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, @perf_config_ext={0x7, 0xffffffffffffffff}, 0x828, 0x0, 0x0, 0x0, 0x0, 0x800000, 0x0, 0x0, 0x0, 0x0, 0x40}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000940)={0x0, 0x0, &(0x7f0000000180)=[{&(0x7f0000000000)="d8000000180081064e81f782db44b904021d080006007c09e8fe55a10a0015400100142603600e12080006000000040104001600400001", 0x37}], 0x1}, 0x0) sendmsg$kcm(0xffffffffffffffff, &(0x7f00000005c0)={0x0, 0x0, &(0x7f0000000180)=[{&(0x7f0000000040)="d800000018009d064e81060000000000000036660730e70d12c9dd97021d080006007cfce7fe55a10a0015000200142603600e1208000f", 0x37}], 0x1}, 0x0) r0 = socket$kcm(0x10, 0x2, 0x0) write$cgroup_subtree(r0, &(0x7f0000000000)=ANY=[@ANYBLOB="563f00001a00599c6d0e000091d028ef80"], 0xfe33) 593.250985ms ago: executing program 1 (id=20887): r0 = perf_event_open(&(0x7f0000000040)={0x2, 0x80, 0xec, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xa}, 0x114905, 0x4, 0x0, 0x1, 0x0, 0x0, 0x1}, 0x0, 0x1, 0xffffffffffffffff, 0x0) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x5, 0x5, &(0x7f0000000180)=ANY=[@ANYBLOB="180800000000000000000000000000001800000000000000000000000000000095"], &(0x7f0000000280)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x48, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) ioctl$PERF_EVENT_IOC_SET_BPF(r0, 0x40042408, r1) r2 = socket$kcm(0x10, 0x2, 0x10) sendmsg$kcm(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000000c0)=[{&(0x7f0000000180)="350400004100054cc6a119e30980a843015a35400c00020002452b0c7f21d100002037153e370c04018006041a004500ac377653c6de2a7c1af4a918505e7a19ff6dc6a3cb9708b9469405009c8e000000800000516c006c154938456646efee34b951a078932502bdbcf6c6b8d226dc64f5b1a0718d687ed8934d4780bae8ba0a55a6c130214043ff8ad5084a642a4d4aac02e408ff3af4be0000000000005b3ceabc3ad0dcf506e49fc53f2d6ef7b311065ea22bc6d528c88fd15df422c8a63e1835674464541c201f843eccf75e7cecddf3a7464ca5b6a9e0b8f2cb286aa8cf672e7bf2e0270f830e01f0a48af76682b068ccaef35850dc2168aa5f5d25c9042255c7ee9048013dd0c07bdbd29d5617f26824ebdce61e63402cec93032363325edd84bb957353b8f9add6f0bc8f0923277229e8b85fd6916d61e6ea2c2e68c581331a74", 0x145}, {&(0x7f0000000a40)="d4fa0c511aad03aa5ed217677bc41c027d9c830c439c7f821ddd78b6915cb170e7603acf9e433c2903bb6773f4b0130668a1e5b5e08d21d0b69c28ca3455aed65855c86f3d1e5789d26375a0d85eaf5e92e19c9affcf76e7a94e76556d2b104ebf645747fadc91460f4b3c94e1a89b51be4a6aa4c65285f988329a8163b69c51b801500a5bacd0463976e2960e2679ef2feee5e6ce6bb78a51fb0e15820d13e4a5aa9e0742a6f8d677ad28fea356657bb550c8311b682d9003c82267a15aa7334bc53b65b9119a1a7d905c7dd365b85c230bbad0d5d0a79819e112637819d9a187cfdf782c6127d2d4281926ab0e22f7346b616fe28ed0b9f4a0c9fdac6d3a90a9c38b5e31448a45546388c95045bc2261c238a5159ea98db9c00aeef644ae98a8cb8da3ff3b7ba14d7971910b559623af829524d83bf19f18628464076329140e0203fc75859185ccd019302afb784e41e16cf2d31db7aba83d0f500ce25fc2d7f524a04cfaa0015ea8a297477a5517f8a4ac167083a321c78070974afc897fb738fbcfeac369844fd7fc11fff502c02b7607007ead2007a18006a6ca8dc2d0119f01d7083c2ab5760ac7b24d7bf26b9030cf455a08385f9e662cbe0c3ca6e6fd4ac0c8566c0fca986c68ef7016a11d3e44253b6f2d07d53505ed58b8ad410f89425046321b4a9b27b5e767bdfa0ebf7abf3d91b319129c48853d8e5cbc4a2c5c560b007eafe03e3332f6017f3164c7f602180aad23dfe5e770fe8855f45925e342b7dfd7ddaa68b65065465cdf4d5b8d995d6e6a7042ebea3d139c6a616232eb4efd1a50d0e6db3188a8e98375fda2a7ebd4cd59b9ea626c13685b05e6cf4d484e32869fd7c7167dbfa48b1529e5dd5f5a02673ccc7dbedfd75e34f3f9eb3c7833734a59acada6dd2ff364475e03f2219deedb5d0c941f2177a23167adcc5a15f4e5441ed537f26a1620df057aeb55b2ad3a00a77e23d304ed6034dd5ec9b2cfe777ca21ec4f48abdafa0d66a78d653068ef871bdc6598fd32edcba60c675a1e8f4e81e83f73414c179bfb7f329d71", 0x2f0}], 0x2}, 0x10041094) 592.507485ms ago: executing program 0 (id=20896): bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="09000000010000000800000008"], 0x48) r0 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[], 0x50) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0x14, &(0x7f0000000280)=ANY=[@ANYBLOB="180000000000000000000000000000001801000020646c2100000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000000000000b703000000000000850000007000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000300000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0x14, &(0x7f0000000280)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0xe, '\x00', 0x0, @fallback=0x25, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$PROG_BIND_MAP(0xa, &(0x7f0000000080)={r1}, 0xc) 0s ago: executing program 0 (id=20888): perf_event_open(&(0x7f0000000500)={0x2, 0x80, 0x28, 0x1, 0x0, 0x0, 0x0, 0x9, 0x640b9, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x107b7e, 0x2, @perf_config_ext={0x0, 0x3fff8000}, 0x0, 0x32, 0x43a1bd76, 0x7, 0x9, 0x6, 0x2, 0x0, 0x0, 0x0, 0x2009}, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f00000001c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5d34, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, 0x3efd7ab4c41335d9, @perf_bp={0x0, 0xf}, 0x0, 0x4, 0x310c, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x4000000000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xa) bpf$MAP_CREATE_CONST_STR(0x0, 0x0, 0x0) r0 = socket$kcm(0x11, 0x3, 0x0) sendmsg$kcm(r0, &(0x7f0000000fc0)={&(0x7f0000000e00)=@hci={0x1f, 0x200, 0x31}, 0x80, &(0x7f0000000200)=[{&(0x7f0000000180)="4a440100000021d77e601993f019c088fb", 0x11}], 0x1}, 0x0) kernel console output (not intermixed with test programs): 949.173596][ T6601] ? genl_bind+0x360/0x360 [ 949.178280][ T6601] ? netlink_ack+0x1160/0x1160 [ 949.183102][ T6601] ? __lock_acquire+0x7d80/0x7d80 [ 949.188169][ T6601] ? down_read+0x1ac/0x2e0 [ 949.192629][ T6601] genl_rcv+0x28/0x40 [ 949.196648][ T6601] netlink_unicast+0x7b1/0x930 [ 949.201468][ T6601] netlink_sendmsg+0x8d0/0xbf0 [ 949.206281][ T6601] ? netlink_getsockopt+0x590/0x590 [ 949.211519][ T6601] ? apparmor_socket_sendmsg+0x8e/0x330 [ 949.217100][ T6601] ? bpf_lsm_socket_sendmsg+0x9/0x10 [ 949.222425][ T6601] ? security_socket_sendmsg+0x80/0xa0 [ 949.227914][ T6601] ? netlink_getsockopt+0x590/0x590 [ 949.233147][ T6601] ____sys_sendmsg+0x61b/0x980 [ 949.237970][ T6601] ? __asan_memset+0x22/0x40 [ 949.242701][ T6601] ? __sys_sendmsg_sock+0x30/0x30 [ 949.247770][ T6601] ? __import_iovec+0x5f2/0x850 [ 949.252677][ T6601] ? import_iovec+0x73/0xa0 [ 949.257223][ T6601] ___sys_sendmsg+0x2a6/0x360 [ 949.261969][ T6601] ? __sys_sendmsg+0x2b0/0x2b0 [ 949.266844][ T6601] __se_sys_sendmsg+0x1d0/0x2c0 [ 949.271797][ T6601] ? __x64_sys_sendmsg+0x80/0x80 [ 949.276844][ T6601] ? lockdep_hardirqs_on+0x98/0x150 [ 949.282101][ T6601] do_syscall_64+0x55/0xb0 [ 949.286564][ T6601] ? clear_bhb_loop+0x40/0x90 [ 949.291276][ T6601] ? clear_bhb_loop+0x40/0x90 [ 949.295994][ T6601] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 949.301930][ T6601] RIP: 0033:0x7f142919e019 [ 949.306395][ T6601] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 949.326306][ T6601] RSP: 002b:00007f142a010028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 949.334760][ T6601] RAX: ffffffffffffffda RBX: 00007f1429425fa0 RCX: 00007f142919e019 [ 949.342763][ T6601] RDX: 0000000000000000 RSI: 0000200000000000 RDI: 0000000000000003 [ 949.350794][ T6601] RBP: 00007f142923500c R08: 0000000000000000 R09: 0000000000000000 [ 949.358820][ T6601] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 949.366957][ T6601] R13: 00007f1429426038 R14: 00007f1429425fa0 R15: 00007ffcaf147338 [ 949.375090][ T6601] [ 949.952093][ T6620] netlink: 14560 bytes leftover after parsing attributes in process `syz.2.15910'. [ 950.836462][ T6649] netlink: 14560 bytes leftover after parsing attributes in process `syz.3.15922'. [ 951.969827][ T6675] netlink: 148 bytes leftover after parsing attributes in process `syz.3.15932'. [ 953.111003][ T6707] netlink: 148 bytes leftover after parsing attributes in process `syz.1.15944'. [ 953.969101][ T6734] netlink: 148 bytes leftover after parsing attributes in process `syz.2.15955'. [ 958.157745][ T6788] netlink: 16278 bytes leftover after parsing attributes in process `syz.3.15975'. [ 958.346323][ T6792] netlink: 'syz.0.15978': attribute type 21 has an invalid length. [ 958.354331][ T6792] netlink: 164 bytes leftover after parsing attributes in process `syz.0.15978'. [ 958.587751][ T6806] netlink: 'syz.2.15985': attribute type 16 has an invalid length. [ 958.596504][ T6806] netlink: 'syz.2.15985': attribute type 3 has an invalid length. [ 958.606639][ T6806] netlink: 132 bytes leftover after parsing attributes in process `syz.2.15985'. [ 958.670773][ T6808] netlink: 'syz.0.15987': attribute type 8 has an invalid length. [ 958.696826][ T6808] netlink: 'syz.0.15987': attribute type 6 has an invalid length. [ 958.704734][ T6808] netlink: 144448 bytes leftover after parsing attributes in process `syz.0.15987'. [ 958.760348][ T6810] netlink: 'syz.1.15988': attribute type 8 has an invalid length. [ 958.936434][ T6817] pim6reg0: tun_chr_ioctl cmd 1074025672 [ 958.944058][ T6817] pim6reg0: ignored: set checksum disabled [ 958.972728][ T6821] netlink: 'syz.2.15992': attribute type 21 has an invalid length. [ 958.985614][ T6821] netlink: 164 bytes leftover after parsing attributes in process `syz.2.15992'. [ 959.146951][ T6831] netlink: 'syz.3.15997': attribute type 16 has an invalid length. [ 959.154959][ T6831] netlink: 'syz.3.15997': attribute type 3 has an invalid length. [ 959.172813][ T6831] netlink: 132 bytes leftover after parsing attributes in process `syz.3.15997'. [ 959.376800][ T6839] netlink: 'syz.2.16001': attribute type 8 has an invalid length. [ 959.396845][ T6839] netlink: 144448 bytes leftover after parsing attributes in process `syz.2.16001'. [ 959.562916][ T6847] netlink: 164 bytes leftover after parsing attributes in process `syz.1.16005'. [ 959.626717][ T6853] pim6reg0: tun_chr_ioctl cmd 1074025672 [ 959.645647][ T6853] pim6reg0: ignored: set checksum disabled [ 959.751220][ T6860] netlink: 132 bytes leftover after parsing attributes in process `syz.0.16010'. [ 960.023567][ T6871] netlink: 144448 bytes leftover after parsing attributes in process `syz.1.16016'. [ 960.498624][ T6883] pim6reg0: tun_chr_ioctl cmd 1074025672 [ 960.511112][ T6883] pim6reg0: ignored: set checksum disabled [ 965.063004][ T6934] __nla_validate_parse: 5 callbacks suppressed [ 965.063034][ T6934] netlink: 60 bytes leftover after parsing attributes in process `syz.2.16046'. [ 965.089413][ T6934] netlink: 60 bytes leftover after parsing attributes in process `syz.2.16046'. [ 965.102393][ T6934] netlink: 60 bytes leftover after parsing attributes in process `syz.2.16046'. [ 965.118822][ T6934] netlink: 60 bytes leftover after parsing attributes in process `syz.2.16046'. [ 965.147521][ T6938] netlink: 15999 bytes leftover after parsing attributes in process `syz.1.16045'. [ 966.292279][ T6960] pim6reg0: tun_chr_ioctl cmd 1074812118 [ 966.344438][ T6965] netlink: 16278 bytes leftover after parsing attributes in process `syz.1.16054'. [ 967.404685][ T7003] netlink: 60 bytes leftover after parsing attributes in process `syz.3.16073'. [ 967.414958][ T7003] netlink: 60 bytes leftover after parsing attributes in process `syz.3.16073'. [ 967.426981][ T7003] netlink: 60 bytes leftover after parsing attributes in process `syz.3.16073'. [ 967.438153][ T7003] netlink: 60 bytes leftover after parsing attributes in process `syz.3.16073'. [ 970.629634][ T7105] __nla_validate_parse: 5 callbacks suppressed [ 970.629652][ T7105] netlink: 60 bytes leftover after parsing attributes in process `syz.0.16120'. [ 971.414182][ T7134] netlink: 60 bytes leftover after parsing attributes in process `syz.1.16132'. [ 972.268722][ T7163] netlink: 60 bytes leftover after parsing attributes in process `syz.2.16157'. [ 972.294124][ T7163] netlink: 60 bytes leftover after parsing attributes in process `syz.2.16157'. [ 972.317626][ T7163] netlink: 60 bytes leftover after parsing attributes in process `syz.2.16157'. [ 972.328813][ T7163] netlink: 60 bytes leftover after parsing attributes in process `syz.2.16157'. [ 973.398183][ T7197] netlink: 60 bytes leftover after parsing attributes in process `syz.3.16163'. [ 973.428988][ T7197] netlink: 60 bytes leftover after parsing attributes in process `syz.3.16163'. [ 973.452459][ T7197] netlink: 60 bytes leftover after parsing attributes in process `syz.3.16163'. [ 973.479306][ T7197] netlink: 60 bytes leftover after parsing attributes in process `syz.3.16163'. [ 974.336028][ T7224] pimreg1: tun_chr_ioctl cmd 2147767517 [ 974.754426][ T7242] validate_nla: 11 callbacks suppressed [ 974.754449][ T7242] netlink: 'syz.2.16185': attribute type 10 has an invalid length. [ 974.890899][ T7247] netlink: 'syz.0.16187': attribute type 10 has an invalid length. [ 975.170229][ T7258] netlink: 'syz.1.16192': attribute type 27 has an invalid length. [ 975.181785][ T7258] A link change request failed with some changes committed already. Interface netdevsim0 may have been left with an inconsistent configuration, please check. [ 976.054052][ T7268] tun0: tun_chr_ioctl cmd 1074025678 [ 976.064938][ T7268] tun0: group set to 0 [ 976.471241][ T7286] pimreg1: tun_chr_ioctl cmd 2147767517 [ 976.962614][ T7294] netlink: 'syz.3.16208': attribute type 10 has an invalid length. [ 976.974204][ T7294] __nla_validate_parse: 7 callbacks suppressed [ 976.974222][ T7294] netlink: 65015 bytes leftover after parsing attributes in process `syz.3.16208'. [ 980.172441][ T7342] pimreg1: tun_chr_ioctl cmd 2147767517 [ 980.537502][ T7361] netlink: 'syz.0.16239': attribute type 10 has an invalid length. [ 980.551489][ T7361] netlink: 65015 bytes leftover after parsing attributes in process `syz.0.16239'. [ 980.972055][ T7385] netlink: 'syz.3.16251': attribute type 9 has an invalid length. [ 980.988628][ T7385] netlink: 61967 bytes leftover after parsing attributes in process `syz.3.16251'. [ 981.494285][ T7411] netlink: 'syz.2.16263': attribute type 9 has an invalid length. [ 981.515683][ T7411] netlink: 61967 bytes leftover after parsing attributes in process `syz.2.16263'. [ 981.746227][ T7425] netlink: 'syz.3.16278': attribute type 10 has an invalid length. [ 981.764570][ T7425] netlink: 65015 bytes leftover after parsing attributes in process `syz.3.16278'. [ 982.194808][ T7444] netlink: 'syz.1.16277': attribute type 9 has an invalid length. [ 982.204823][ T7442] netlink: 135856 bytes leftover after parsing attributes in process `syz.0.16281'. [ 982.230629][ T7444] netlink: 61967 bytes leftover after parsing attributes in process `syz.1.16277'. [ 982.241028][ T7442] netlink: 8442 bytes leftover after parsing attributes in process `syz.0.16281'. [ 982.398062][ T7452] netlink: 135856 bytes leftover after parsing attributes in process `syz.1.16293'. [ 982.409435][ T7450] netlink: 'syz.2.16284': attribute type 10 has an invalid length. [ 982.417670][ T7450] netlink: 65015 bytes leftover after parsing attributes in process `syz.2.16284'. [ 982.427255][ T7452] netlink: 8442 bytes leftover after parsing attributes in process `syz.1.16293'. [ 982.683408][ T7464] netlink: 'syz.2.16290': attribute type 29 has an invalid length. [ 982.700089][ T7464] netlink: 'syz.2.16290': attribute type 29 has an invalid length. [ 982.717789][ T7464] netlink: 'syz.2.16290': attribute type 29 has an invalid length. [ 982.730550][ T7464] netlink: 'syz.2.16290': attribute type 29 has an invalid length. [ 982.896839][ T7474] netlink: 135856 bytes leftover after parsing attributes in process `syz.3.16296'. [ 982.906595][ T7474] netlink: 8442 bytes leftover after parsing attributes in process `syz.3.16296'. [ 984.617602][ T7542] netlink: 40 bytes leftover after parsing attributes in process `syz.0.16327'. [ 985.504694][ T7575] netlink: 15999 bytes leftover after parsing attributes in process `syz.3.16344'. [ 989.299867][ T7616] validate_nla: 10 callbacks suppressed [ 989.299889][ T7616] netlink: 'syz.2.16359': attribute type 10 has an invalid length. [ 989.315147][ T7616] netlink: 40 bytes leftover after parsing attributes in process `syz.2.16359'. [ 989.326797][ T7616] ipvlan1: entered promiscuous mode [ 989.343829][ T7616] ipvlan1: entered allmulticast mode [ 989.353402][ T7616] veth0_vlan: entered allmulticast mode [ 989.380070][ T7616] bridge0: port 3(ipvlan1) entered blocking state [ 989.394624][ T7616] bridge0: port 3(ipvlan1) entered disabled state [ 989.408161][ T7616] A link change request failed with some changes committed already. Interface ipvlan1 may have been left with an inconsistent configuration, please check. [ 989.942376][ T7634] tap0: tun_chr_ioctl cmd 1074025677 [ 989.962639][ T7634] tap0: linktype set to 780 [ 990.070314][ T7641] netlink: 209592 bytes leftover after parsing attributes in process `syz.0.16374'. [ 990.087284][ T7641] netlink: zone id is out of range [ 990.231761][ T7648] netlink: 48 bytes leftover after parsing attributes in process `syz.0.16377'. [ 990.328408][ T7654] netlink: 'syz.2.16380': attribute type 29 has an invalid length. [ 990.349863][ T7654] netlink: 'syz.2.16380': attribute type 29 has an invalid length. [ 990.380990][ T7654] netlink: 'syz.2.16380': attribute type 29 has an invalid length. [ 990.406963][ T7654] netlink: 'syz.2.16380': attribute type 29 has an invalid length. [ 991.261382][ T7684] netlink: 'syz.3.16392': attribute type 29 has an invalid length. [ 991.286083][ T7684] netlink: 'syz.3.16392': attribute type 29 has an invalid length. [ 991.305946][ T7684] netlink: 'syz.3.16392': attribute type 29 has an invalid length. [ 991.325703][ T7684] netlink: 'syz.3.16392': attribute type 29 has an invalid length. [ 991.496877][ T7688] netlink: 'syz.3.16393': attribute type 27 has an invalid length. [ 993.446691][ T1292] ieee802154 phy0 wpan0: encryption failed: -22 [ 993.453092][ T1292] ieee802154 phy1 wpan1: encryption failed: -22 [ 994.534409][ T7773] netlink: 209592 bytes leftover after parsing attributes in process `syz.2.16434'. [ 994.555652][ T7773] netlink: zone id is out of range [ 996.489471][ T7826] tap0: tun_chr_ioctl cmd 1074025677 [ 996.495042][ T7826] tap0: linktype set to 774 [ 997.623652][ T7867] validate_nla: 7 callbacks suppressed [ 997.623671][ T7867] netlink: 'syz.3.16479': attribute type 10 has an invalid length. [ 997.640890][ T7867] netlink: 'syz.3.16479': attribute type 4 has an invalid length. [ 997.655366][ T7867] netlink: 116 bytes leftover after parsing attributes in process `syz.3.16479'. [ 997.713170][ T7871] pim6reg0: tun_chr_ioctl cmd 1074025673 [ 997.719843][ T7871] pim6reg0: tun_chr_ioctl cmd 1074025675 [ 997.746039][ T7871] pim6reg0: persist enabled [ 998.093035][ T7888] netlink: 'syz.1.16491': attribute type 28 has an invalid length. [ 998.275917][ T7892] syzkaller1: tun_chr_ioctl cmd 1074025677 [ 998.287704][ T7892] syzkaller1: linktype set to 805 [ 1002.438409][ T7933] netlink: 60 bytes leftover after parsing attributes in process `syz.3.16511'. [ 1002.459377][ T7933] netlink: 60 bytes leftover after parsing attributes in process `syz.3.16511'. [ 1002.484757][ T7933] netlink: 60 bytes leftover after parsing attributes in process `syz.3.16511'. [ 1002.508118][ T7933] netlink: 60 bytes leftover after parsing attributes in process `syz.3.16511'. [ 1004.990714][ T8020] netlink: 60 bytes leftover after parsing attributes in process `syz.2.16550'. [ 1005.015058][ T8020] netlink: 60 bytes leftover after parsing attributes in process `syz.2.16550'. [ 1005.048551][ T8020] netlink: 60 bytes leftover after parsing attributes in process `syz.2.16550'. [ 1005.101770][ T8020] netlink: 60 bytes leftover after parsing attributes in process `syz.2.16550'. [ 1007.394866][ T8053] netlink: 60 bytes leftover after parsing attributes in process `syz.0.16567'. [ 1007.415652][ T8053] netlink: 60 bytes leftover after parsing attributes in process `syz.0.16567'. [ 1009.554217][ T8058] __nla_validate_parse: 2 callbacks suppressed [ 1009.554237][ T8058] netlink: 203516 bytes leftover after parsing attributes in process `syz.0.16576'. [ 1009.616486][ T8058] netlink: zone id is out of range [ 1009.633531][ T8058] netlink: zone id is out of range [ 1009.642513][ T8058] netlink: zone id is out of range [ 1009.655555][ T8058] netlink: zone id is out of range [ 1009.665918][ T8058] netlink: zone id is out of range [ 1009.680894][ T8058] netlink: zone id is out of range [ 1009.691345][ T8058] netlink: zone id is out of range [ 1009.705531][ T8058] netlink: zone id is out of range [ 1009.718934][ T8058] netlink: zone id is out of range [ 1009.730555][ T8058] netlink: zone id is out of range [ 1009.736350][ T8063] netlink: 48 bytes leftover after parsing attributes in process `syz.1.16571'. [ 1009.765531][ T8063] netlink: 4 bytes leftover after parsing attributes in process `syz.1.16571'. [ 1009.959258][ T8072] tap0: tun_chr_ioctl cmd 1074025677 [ 1009.964841][ T8072] tap0: linktype set to 270 [ 1010.391433][ T8090] netlink: 48 bytes leftover after parsing attributes in process `syz.0.16583'. [ 1010.401800][ T8090] netlink: 4 bytes leftover after parsing attributes in process `syz.0.16583'. [ 1010.734196][ T8097] netlink: 203516 bytes leftover after parsing attributes in process `syz.1.16586'. [ 1010.851726][ T8102] tap1: tun_chr_ioctl cmd 1074025677 [ 1010.866488][ T8102] tap1: linktype set to 270 [ 1011.076678][ T8113] netlink: 48 bytes leftover after parsing attributes in process `syz.3.16594'. [ 1011.091745][ T8113] netlink: 4 bytes leftover after parsing attributes in process `syz.3.16594'. [ 1011.674832][ T8124] netlink: 203516 bytes leftover after parsing attributes in process `syz.3.16599'. [ 1011.792072][ T8132] netlink: 'syz.3.16602': attribute type 10 has an invalid length. [ 1011.800447][ T8132] netlink: 164 bytes leftover after parsing attributes in process `syz.3.16602'. [ 1011.992885][ T8138] tap0: tun_chr_ioctl cmd 1074025677 [ 1011.999915][ T8138] tap0: linktype set to 270 [ 1015.909839][ T8262] __nla_validate_parse: 3 callbacks suppressed [ 1015.909861][ T8262] netlink: 2759 bytes leftover after parsing attributes in process `syz.2.16663'. [ 1016.632052][ T8288] netlink: 2759 bytes leftover after parsing attributes in process `syz.3.16675'. [ 1017.553362][ T8322] netlink: 2759 bytes leftover after parsing attributes in process `syz.1.16686'. [ 1021.730915][ T8400] tap0: tun_chr_ioctl cmd 1074025676 [ 1021.769163][ T8400] tap0: owner set to 776 [ 1022.733934][ T8429] tap1: tun_chr_ioctl cmd 1074025676 [ 1022.767350][ T8429] tap1: owner set to 776 [ 1023.789178][ T8460] tap0: tun_chr_ioctl cmd 1074025676 [ 1023.794666][ T8460] tap0: owner set to 776 [ 1027.468129][ T8551] tap0: tun_chr_ioctl cmd 2147767520 [ 1027.844511][ T8557] netlink: 'syz.1.16805': attribute type 3 has an invalid length. [ 1027.862963][ T8557] netlink: 132 bytes leftover after parsing attributes in process `syz.1.16805'. [ 1032.517288][ T8665] netlink: 16255 bytes leftover after parsing attributes in process `syz.1.16849'. [ 1032.738888][ T8669] netlink: 16255 bytes leftover after parsing attributes in process `syz.2.16860'. [ 1033.578692][ T8699] netlink: 16255 bytes leftover after parsing attributes in process `syz.0.16864'. [ 1033.983655][ T8709] netlink: 16255 bytes leftover after parsing attributes in process `syz.1.16871'. [ 1035.942871][ T8777] netlink: 16255 bytes leftover after parsing attributes in process `syz.3.16905'. [ 1036.799701][ T8797] netlink: 16255 bytes leftover after parsing attributes in process `syz.2.16915'. [ 1039.849142][ T8880] dvmrp1: tun_chr_ioctl cmd 1074025677 [ 1039.865696][ T8880] dvmrp1: linktype set to 768 [ 1041.356401][ T8906] dvmrp1: tun_chr_ioctl cmd 1074025677 [ 1041.369209][ T8906] dvmrp1: linktype set to 768 [ 1042.322065][ T8934] dvmrp1: tun_chr_ioctl cmd 1074025677 [ 1042.332523][ T8934] dvmrp1: linktype set to 768 [ 1042.805152][ T8941] dvmrp1: tun_chr_ioctl cmd 21731 [ 1044.090021][ T8965] netlink: 64859 bytes leftover after parsing attributes in process `syz.2.16997'. [ 1044.503114][ T8977] sctp: [Deprecated]: syz.1.17002 (pid 8977) Use of struct sctp_assoc_value in delayed_ack socket option. [ 1044.503114][ T8977] Use struct sctp_sack_info instead [ 1045.517215][ T9029] netlink: 16255 bytes leftover after parsing attributes in process `syz.3.17027'. [ 1045.546099][ T9031] sctp: [Deprecated]: syz.0.17028 (pid 9031) Use of struct sctp_assoc_value in delayed_ack socket option. [ 1045.546099][ T9031] Use struct sctp_sack_info instead [ 1045.752803][ T9043] netlink: 64859 bytes leftover after parsing attributes in process `syz.3.17041'. [ 1046.098284][ T9060] netlink: 'syz.1.17051': attribute type 2 has an invalid length. [ 1046.109864][ T9060] netlink: 17267 bytes leftover after parsing attributes in process `syz.1.17051'. [ 1046.186889][ T9063] sctp: [Deprecated]: syz.3.17045 (pid 9063) Use of struct sctp_assoc_value in delayed_ack socket option. [ 1046.186889][ T9063] Use struct sctp_sack_info instead [ 1047.349318][ T9084] netlink: 16255 bytes leftover after parsing attributes in process `syz.2.17057'. [ 1047.483203][ T9088] sctp: [Deprecated]: syz.2.17058 (pid 9088) Use of struct sctp_assoc_value in delayed_ack socket option. [ 1047.483203][ T9088] Use struct sctp_sack_info instead [ 1047.515015][ T9092] netlink: 16255 bytes leftover after parsing attributes in process `syz.1.17066'. [ 1047.890005][ T9106] netlink: 209852 bytes leftover after parsing attributes in process `syz.1.17074'. [ 1047.934776][ T9106] net_ratelimit: 734 callbacks suppressed [ 1047.934961][ T9106] openvswitch: netlink: Tunnel attr 0 has unexpected len 1788 expected 8 [ 1048.237779][ T5776] cgroup: fork rejected by pids controller in /syz1 [ 1048.761030][ T9117] sctp: [Deprecated]: syz.2.17071 (pid 9117) Use of struct sctp_assoc_value in delayed_ack socket option. [ 1048.761030][ T9117] Use struct sctp_sack_info instead [ 1048.817509][ T9119] netlink: 16255 bytes leftover after parsing attributes in process `syz.0.17070'. [ 1049.713683][ T9143] sctp: [Deprecated]: syz.3.17084 (pid 9143) Use of struct sctp_assoc_value in delayed_ack socket option. [ 1049.713683][ T9143] Use struct sctp_sack_info instead [ 1049.984224][ T9151] netlink: 'syz.2.17087': attribute type 29 has an invalid length. [ 1050.163868][ T9160] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 1050.173125][ T9151] netlink: 'syz.2.17087': attribute type 29 has an invalid length. [ 1050.182976][ T9160] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 1050.191170][ T9156] netlink: 'syz.2.17087': attribute type 29 has an invalid length. [ 1050.200021][ T9160] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 1050.211553][ T9160] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 1050.221039][ T9160] Bluetooth: hci3: unexpected cc 0x0c25 length: 249 > 3 [ 1050.228579][ T9160] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 1050.247401][ T9165] netlink: 201392 bytes leftover after parsing attributes in process `syz.3.17090'. [ 1050.295824][ T9159] netlink: 'syz.2.17087': attribute type 29 has an invalid length. [ 1050.362422][ T9165] netlink: 8446 bytes leftover after parsing attributes in process `syz.3.17090'. [ 1050.754650][ T5775] cgroup: fork rejected by pids controller in /syz0 [ 1051.142160][ T9158] chnl_net:caif_netlink_parms(): no params data found [ 1051.513325][ T9158] bridge0: port 1(bridge_slave_0) entered blocking state [ 1051.530292][ T9158] bridge0: port 1(bridge_slave_0) entered disabled state [ 1051.538952][ T9158] bridge_slave_0: entered allmulticast mode [ 1051.557446][ T9158] bridge_slave_0: entered promiscuous mode [ 1051.591058][ T9158] bridge0: port 2(bridge_slave_1) entered blocking state [ 1051.615576][ T9158] bridge0: port 2(bridge_slave_1) entered disabled state [ 1051.638076][ T9158] bridge_slave_1: entered allmulticast mode [ 1051.664441][ T9158] bridge_slave_1: entered promiscuous mode [ 1051.805941][ T9158] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 1051.839598][ T9158] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 1051.941439][ T9158] team0: Port device team_slave_0 added [ 1051.974152][ T9158] team0: Port device team_slave_1 added [ 1052.216184][ T9158] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 1052.245713][ T9158] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 1052.305561][ T5787] Bluetooth: hci3: command tx timeout [ 1052.341157][ T9158] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 1052.391739][ T9160] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 1052.408589][ T9160] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 1052.418937][ T9160] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 1052.429108][ T9158] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 1052.440411][ T9158] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 1052.467199][ T9160] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 1052.478041][ T9160] Bluetooth: hci1: unexpected cc 0x0c25 length: 249 > 3 [ 1052.486570][ T9160] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 1052.529038][ T9158] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 1052.640676][ T9158] hsr_slave_0: entered promiscuous mode [ 1052.654639][ T9158] hsr_slave_1: entered promiscuous mode [ 1053.332372][ T9219] chnl_net:caif_netlink_parms(): no params data found [ 1053.724914][ T9219] bridge0: port 1(bridge_slave_0) entered blocking state [ 1053.745203][ T9219] bridge0: port 1(bridge_slave_0) entered disabled state [ 1053.754710][ T9219] bridge_slave_0: entered allmulticast mode [ 1053.764076][ T9219] bridge_slave_0: entered promiscuous mode [ 1053.783542][ T9219] bridge0: port 2(bridge_slave_1) entered blocking state [ 1053.799120][ T9219] bridge0: port 2(bridge_slave_1) entered disabled state [ 1053.809771][ T9219] bridge_slave_1: entered allmulticast mode [ 1053.821794][ T9219] bridge_slave_1: entered promiscuous mode [ 1053.940083][ T6317] hsr_slave_0: left promiscuous mode [ 1053.948165][ T6317] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 1053.961854][ T6317] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 1053.970939][ T6317] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 1053.981102][ T6317] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 1053.989442][ T6317] batman_adv: batadv0: Interface deactivated: virt_wifi0 [ 1053.996624][ T6317] batman_adv: batadv0: Removing interface: virt_wifi0 [ 1054.004036][ T6317] : left promiscuous mode [ 1054.010235][ T6317] bridge0: port 1(30) entered disabled state [ 1054.375727][ T9160] Bluetooth: hci3: command tx timeout [ 1054.491942][ T6317] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 1054.501040][ T6317] bond_slave_1 (unregistering): left promiscuous mode [ 1054.540233][ T9160] Bluetooth: hci1: command tx timeout [ 1054.559625][ T6317] bond0 (unregistering): (slave bridge_slave_1): Releasing backup interface [ 1054.568954][ T6317] bridge_slave_1 (unregistering): left promiscuous mode [ 1054.791198][ T6317] bond0 (unregistering): (slave bridge0): Releasing backup interface [ 1054.808304][ T6317] bridge0 (unregistering): left promiscuous mode [ 1054.814872][ T6317] bond0 (unregistering): Released all slaves [ 1054.863458][ T1292] ieee802154 phy0 wpan0: encryption failed: -22 [ 1054.872365][ T1292] ieee802154 phy1 wpan1: encryption failed: -22 [ 1054.959277][ T9219] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 1054.994737][ T9219] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 1055.012457][ T9158] netdevsim netdevsim1 netdevsim0: renamed from eth0 [ 1055.022925][ T9158] netdevsim netdevsim1 netdevsim1: renamed from eth1 [ 1055.036928][ T9158] netdevsim netdevsim1 netdevsim2: renamed from eth2 [ 1055.084309][ T9158] netdevsim netdevsim1 netdevsim3: renamed from eth3 [ 1055.119794][ T9219] team0: Port device team_slave_0 added [ 1055.131101][ T9219] team0: Port device team_slave_1 added [ 1055.186869][ T9219] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 1055.193898][ T9219] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 1055.220306][ T9219] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 1055.243162][ T9219] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 1055.250902][ T9219] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 1055.277338][ T9219] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 1055.378600][ T9219] hsr_slave_0: entered promiscuous mode [ 1055.385167][ T9219] hsr_slave_1: entered promiscuous mode [ 1055.392850][ T9219] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 1055.400946][ T9219] Cannot create hsr debugfs directory [ 1055.528493][ T9158] 8021q: adding VLAN 0 to HW filter on device bond0 [ 1055.624297][ T9158] 8021q: adding VLAN 0 to HW filter on device team0 [ 1055.666229][ T6317] netdevsim netdevsim0 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1055.707215][T23106] bridge0: port 1(bridge_slave_0) entered blocking state [ 1055.714436][T23106] bridge0: port 1(bridge_slave_0) entered forwarding state [ 1055.778405][ T6317] netdevsim netdevsim0 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1055.801646][ T2954] bridge0: port 2(bridge_slave_1) entered blocking state [ 1055.809018][ T2954] bridge0: port 2(bridge_slave_1) entered forwarding state [ 1055.888458][ T6317] netdevsim netdevsim0 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1055.986697][ T6317] netdevsim netdevsim0 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1056.455512][ T9160] Bluetooth: hci3: command tx timeout [ 1056.474798][ T9158] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 1056.615603][ T9160] Bluetooth: hci1: command tx timeout [ 1056.661984][ T9158] veth0_vlan: entered promiscuous mode [ 1056.701888][ T9158] veth1_vlan: entered promiscuous mode [ 1056.789869][ T9158] veth0_macvtap: entered promiscuous mode [ 1056.802417][ T9158] veth1_macvtap: entered promiscuous mode [ 1056.852645][ T9158] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 1056.864123][ T9158] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1056.874982][ T9158] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 1056.885966][ T9158] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1056.903455][ T9158] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 1056.941692][ T9158] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: €Â0 [ 1056.958637][ T9158] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1056.972890][ T9158] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 1057.007143][ T9158] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 1057.016272][ T9158] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 1057.025038][ T9158] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 1057.035326][ T9158] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 1057.302296][ T11] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1057.336257][ T11] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1057.460683][ T11] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1057.465763][ T9219] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 1057.479769][ T9219] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 1057.485771][ T11] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1057.536740][ T9219] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 1057.590979][ T9219] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 1058.160658][ T9219] 8021q: adding VLAN 0 to HW filter on device bond0 [ 1058.278280][ T9219] 8021q: adding VLAN 0 to HW filter on device team0 [ 1058.339249][ T6315] bridge0: port 1(bridge_slave_0) entered blocking state [ 1058.346505][ T6315] bridge0: port 1(bridge_slave_0) entered forwarding state [ 1058.371426][ T6315] bridge0: port 2(bridge_slave_1) entered blocking state [ 1058.378797][ T6315] bridge0: port 2(bridge_slave_1) entered forwarding state [ 1058.536882][ T9160] Bluetooth: hci3: command tx timeout [ 1058.594420][ T9303] syzkaller1: tun_chr_ioctl cmd 2147767521 [ 1058.696310][ T9160] Bluetooth: hci1: command tx timeout [ 1060.331930][ T9338] netlink: 'syz.1.17115': attribute type 1 has an invalid length. [ 1060.340178][ T9338] netlink: 193500 bytes leftover after parsing attributes in process `syz.1.17115'. [ 1060.446020][ T6317] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 1060.453546][ T6317] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 1060.478382][ T6317] batadv0: left allmulticast mode [ 1060.492615][ T6317] batadv0: left promiscuous mode [ 1060.498088][ T6317] bridge0: port 3(batadv0) entered disabled state [ 1060.506806][ T6317] bridge_slave_1: left allmulticast mode [ 1060.512984][ T6317] bridge_slave_1: left promiscuous mode [ 1060.519418][ T6317] bridge0: port 2(bridge_slave_1) entered disabled state [ 1060.528984][ T6317] bridge_slave_0: left promiscuous mode [ 1060.534869][ T6317] bridge0: port 1(bridge_slave_0) entered disabled state [ 1060.785585][ T9160] Bluetooth: hci1: command tx timeout [ 1060.969421][ T6317] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 1060.982081][ T6317] bond_slave_1 (unregistering): left promiscuous mode [ 1061.250129][ T6317] bond0 (unregistering): (slave bridge0): Releasing backup interface [ 1061.263475][ T6317] bridge0 (unregistering): left promiscuous mode [ 1061.273368][ T6317] bond0 (unregistering): Released all slaves [ 1061.359943][ T9219] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 1061.439194][ T9219] veth0_vlan: entered promiscuous mode [ 1061.461565][ T9219] veth1_vlan: entered promiscuous mode [ 1061.509633][ T9219] veth0_macvtap: entered promiscuous mode [ 1061.530575][ T9219] veth1_macvtap: entered promiscuous mode [ 1061.566495][ T9219] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 1061.577869][ T9219] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1061.588229][ T9219] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 1061.599089][ T9219] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1061.611983][ T9219] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 1061.633943][ T9219] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: €Â0 [ 1061.644697][ T9219] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1061.657989][ T9219] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 1061.669775][ T9219] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1061.681287][ T9219] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 1061.703165][ T9219] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 1061.712183][ T9219] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 1061.721222][ T9219] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 1061.730071][ T9219] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 1061.830406][ T9254] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1061.845528][ T9254] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1061.881125][ T6315] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1061.890361][ T6315] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1062.003054][ T9345] netlink: 'syz.3.17128': attribute type 29 has an invalid length. [ 1062.016871][ T9345] netlink: 'syz.3.17128': attribute type 29 has an invalid length. [ 1062.034272][ T9347] netlink: 199836 bytes leftover after parsing attributes in process `syz.0.17109'. [ 1062.040619][ T9345] netlink: 'syz.3.17128': attribute type 29 has an invalid length. [ 1062.062644][ T9345] netlink: 'syz.3.17128': attribute type 29 has an invalid length. [ 1062.103092][ T9346] syzkaller0: tun_chr_ioctl cmd 2147767506 [ 1062.732593][ T9367] netlink: 199836 bytes leftover after parsing attributes in process `syz.1.17131'. [ 1062.992713][ T9375] syzkaller0: tun_chr_ioctl cmd 2147767506 [ 1063.509977][ T9401] sctp: [Deprecated]: syz.2.17147 (pid 9401) Use of struct sctp_assoc_value in delayed_ack socket option. [ 1063.509977][ T9401] Use struct sctp_sack_info instead [ 1064.509297][ T9439] sctp: [Deprecated]: syz.2.17165 (pid 9439) Use of struct sctp_assoc_value in delayed_ack socket option. [ 1064.509297][ T9439] Use struct sctp_sack_info instead [ 1066.301555][ T9521] netlink: 'syz.3.17204': attribute type 3 has an invalid length. [ 1066.321162][ T9521] netlink: 130984 bytes leftover after parsing attributes in process `syz.3.17204'. [ 1066.700825][ T9539] netlink: 4083 bytes leftover after parsing attributes in process `syz.1.17212'. [ 1066.729370][ T9539] netlink: 4083 bytes leftover after parsing attributes in process `syz.1.17212'. [ 1066.758060][ T9538] netlink: 4083 bytes leftover after parsing attributes in process `syz.1.17212'. [ 1066.774688][ T9539] netlink: 4083 bytes leftover after parsing attributes in process `syz.1.17212'. [ 1067.137681][ T9556] netlink: 'syz.1.17219': attribute type 19 has an invalid length. [ 1067.150419][ T9556] netlink: 172 bytes leftover after parsing attributes in process `syz.1.17219'. [ 1067.726594][ T9578] netlink: 'syz.1.17229': attribute type 3 has an invalid length. [ 1067.736897][ T9578] netlink: 130984 bytes leftover after parsing attributes in process `syz.1.17229'. [ 1067.898502][ T9586] netlink: 'syz.0.17233': attribute type 19 has an invalid length. [ 1067.935642][ T9586] netlink: 172 bytes leftover after parsing attributes in process `syz.0.17233'. [ 1070.024261][ T9671] netlink: 135856 bytes leftover after parsing attributes in process `syz.3.17276'. [ 1070.751478][ T9700] netlink: 135856 bytes leftover after parsing attributes in process `syz.1.17290'. [ 1072.329423][ T9763] __nla_validate_parse: 1 callbacks suppressed [ 1072.329442][ T9763] netlink: 61967 bytes leftover after parsing attributes in process `syz.2.17320'. [ 1072.348820][ T9763] tc_dump_action: action bad kind [ 1072.807724][ T9773] netlink: 'syz.0.17334': attribute type 3 has an invalid length. [ 1072.835943][ T9773] netlink: 130984 bytes leftover after parsing attributes in process `syz.0.17334'. [ 1073.019540][ T9787] syzkaller1: tun_chr_ioctl cmd 1074025677 [ 1073.026216][ T9787] syzkaller1: linktype set to 773 [ 1074.305279][ T9819] syzkaller1: tun_chr_ioctl cmd 1074025677 [ 1074.311500][ T9819] syzkaller1: linktype set to 773 [ 1074.719563][ T9835] netlink: 164 bytes leftover after parsing attributes in process `syz.2.17354'. [ 1074.988773][ T9839] netlink: 'syz.1.17356': attribute type 3 has an invalid length. [ 1075.012433][ T9839] netlink: 130984 bytes leftover after parsing attributes in process `syz.1.17356'. [ 1075.302205][ T9849] netlink: 61967 bytes leftover after parsing attributes in process `syz.1.17362'. [ 1075.327226][ T9849] tc_dump_action: action bad kind [ 1075.923011][ T9861] netlink: 164 bytes leftover after parsing attributes in process `syz.3.17367'. [ 1076.055929][ T9865] netlink: 'syz.3.17370': attribute type 3 has an invalid length. [ 1076.064323][ T9865] netlink: 130984 bytes leftover after parsing attributes in process `syz.3.17370'. [ 1076.980489][ T9893] netlink: 'syz.2.17383': attribute type 3 has an invalid length. [ 1076.993937][ T9893] netlink: 130984 bytes leftover after parsing attributes in process `syz.2.17383'. [ 1078.001614][ T9917] netlink: 11562 bytes leftover after parsing attributes in process `syz.2.17396'. [ 1078.133314][ T9923] netlink: 'syz.2.17398': attribute type 49 has an invalid length. [ 1078.155698][ T9923] netlink: 'syz.2.17398': attribute type 49 has an invalid length. [ 1079.679943][ T9954] netlink: 'syz.1.17411': attribute type 49 has an invalid length. [ 1079.699932][ T9954] netlink: 'syz.1.17411': attribute type 49 has an invalid length. [ 1080.359405][ T9971] netlink: 16054 bytes leftover after parsing attributes in process `syz.0.17420'. [ 1080.505027][ T9980] netlink: 'syz.0.17425': attribute type 29 has an invalid length. [ 1080.514951][ T9980] netlink: 'syz.0.17425': attribute type 29 has an invalid length. [ 1080.534655][ T9980] netlink: 'syz.0.17425': attribute type 29 has an invalid length. [ 1080.545009][ T9980] netlink: 'syz.0.17425': attribute type 29 has an invalid length. [ 1081.020067][T10000] netlink: 16054 bytes leftover after parsing attributes in process `syz.3.17435'. [ 1081.255053][T10014] netlink: 'syz.2.17441': attribute type 29 has an invalid length. [ 1081.275923][T10014] netlink: 'syz.2.17441': attribute type 29 has an invalid length. [ 1081.563315][T10025] netlink: 16054 bytes leftover after parsing attributes in process `syz.2.17448'. [ 1083.235097][T10059] tap1: tun_chr_ioctl cmd 1074025692 [ 1083.576070][T10065] validate_nla: 6 callbacks suppressed [ 1083.576088][T10065] netlink: 'syz.3.17466': attribute type 29 has an invalid length. [ 1083.602479][T10065] netlink: 'syz.3.17466': attribute type 29 has an invalid length. [ 1083.635564][T10065] netlink: 'syz.3.17466': attribute type 29 has an invalid length. [ 1083.666621][T10065] netlink: 'syz.3.17466': attribute type 29 has an invalid length. [ 1084.472642][T10108] netlink: 'syz.0.17486': attribute type 29 has an invalid length. [ 1084.481877][T10108] netlink: 'syz.0.17486': attribute type 29 has an invalid length. [ 1084.496725][T10108] netlink: 'syz.0.17486': attribute type 29 has an invalid length. [ 1084.515567][T10108] netlink: 'syz.0.17486': attribute type 29 has an invalid length. [ 1085.399720][T10157] netlink: 60 bytes leftover after parsing attributes in process `syz.2.17508'. [ 1085.415612][T10157] netlink: 60 bytes leftover after parsing attributes in process `syz.2.17508'. [ 1085.425182][T10150] netlink: 60 bytes leftover after parsing attributes in process `syz.2.17508'. [ 1085.445566][T10154] netlink: 60 bytes leftover after parsing attributes in process `syz.2.17508'. [ 1086.592716][T10190] netlink: 'syz.1.17524': attribute type 29 has an invalid length. [ 1086.616992][T10190] netlink: 'syz.1.17524': attribute type 29 has an invalid length. [ 1086.790588][T10203] netlink: 60 bytes leftover after parsing attributes in process `syz.0.17534'. [ 1086.815523][T10203] netlink: 60 bytes leftover after parsing attributes in process `syz.0.17534'. [ 1086.839182][T10194] netlink: 60 bytes leftover after parsing attributes in process `syz.0.17534'. [ 1086.881293][T10198] netlink: 60 bytes leftover after parsing attributes in process `syz.0.17534'. [ 1086.897134][T10205] netlink: 9062 bytes leftover after parsing attributes in process `syz.2.17529'. [ 1088.016104][T10239] netlink: 9062 bytes leftover after parsing attributes in process `syz.0.17545'. [ 1088.606884][T10266] validate_nla: 8 callbacks suppressed [ 1088.606904][T10266] netlink: 'syz.3.17559': attribute type 21 has an invalid length. [ 1088.621269][T10266] netlink: 'syz.3.17559': attribute type 1 has an invalid length. [ 1088.629557][T10266] netlink: 'syz.3.17559': attribute type 2 has an invalid length. [ 1091.597625][T10332] netlink: 'syz.3.17590': attribute type 1 has an invalid length. [ 1091.635532][T10332] __nla_validate_parse: 1 callbacks suppressed [ 1091.635551][T10332] netlink: 16255 bytes leftover after parsing attributes in process `syz.3.17590'. [ 1093.084669][T10371] netlink: 'syz.1.17606': attribute type 12 has an invalid length. [ 1093.125452][T10371] netlink: 112 bytes leftover after parsing attributes in process `syz.1.17606'. [ 1093.418983][T10382] netlink: 'syz.0.17620': attribute type 1 has an invalid length. [ 1093.439794][T10382] netlink: 16255 bytes leftover after parsing attributes in process `syz.0.17620'. [ 1093.476431][T10380] netlink: 'syz.1.17611': attribute type 3 has an invalid length. [ 1093.512474][T10380] netlink: 13435 bytes leftover after parsing attributes in process `syz.1.17611'. [ 1094.669637][T10411] netlink: 60 bytes leftover after parsing attributes in process `syz.0.17636'. [ 1094.713194][T10411] netlink: 60 bytes leftover after parsing attributes in process `syz.0.17636'. [ 1094.737495][T10415] netlink: 'syz.1.17627': attribute type 1 has an invalid length. [ 1094.750149][T10415] netlink: 16255 bytes leftover after parsing attributes in process `syz.1.17627'. [ 1094.769740][T10416] netlink: 60 bytes leftover after parsing attributes in process `syz.0.17636'. [ 1094.819545][T10411] netlink: 60 bytes leftover after parsing attributes in process `syz.0.17636'. [ 1094.988152][T10422] netlink: 'syz.2.17629': attribute type 10 has an invalid length. [ 1095.021535][T10422] netlink: 65015 bytes leftover after parsing attributes in process `syz.2.17629'. [ 1095.846530][T10448] netlink: 'syz.3.17646': attribute type 12 has an invalid length. [ 1095.881849][T10452] netlink: 'syz.0.17647': attribute type 10 has an invalid length. [ 1097.209007][T10481] netlink: 'syz.3.17659': attribute type 10 has an invalid length. [ 1097.235419][T10481] __nla_validate_parse: 2 callbacks suppressed [ 1097.235493][T10481] netlink: 65015 bytes leftover after parsing attributes in process `syz.3.17659'. [ 1099.351384][T10523] netlink: 9286 bytes leftover after parsing attributes in process `syz.3.17690'. [ 1099.737712][T10541] netlink: 60 bytes leftover after parsing attributes in process `syz.0.17686'. [ 1099.756878][T10541] netlink: 60 bytes leftover after parsing attributes in process `syz.0.17686'. [ 1099.776375][T10533] netlink: 60 bytes leftover after parsing attributes in process `syz.0.17686'. [ 1099.797730][T10540] netlink: 48 bytes leftover after parsing attributes in process `syz.3.17689'. [ 1099.807704][T10536] netlink: 60 bytes leftover after parsing attributes in process `syz.0.17686'. [ 1100.347774][T10563] netlink: 9286 bytes leftover after parsing attributes in process `syz.0.17700'. [ 1100.567418][T10569] netlink: 48 bytes leftover after parsing attributes in process `syz.0.17703'. [ 1100.651390][T10571] netlink: 60 bytes leftover after parsing attributes in process `syz.3.17702'. [ 1102.660566][T10637] __nla_validate_parse: 10 callbacks suppressed [ 1102.660586][T10637] netlink: 16255 bytes leftover after parsing attributes in process `syz.2.17730'. [ 1102.823852][T10645] netlink: 203516 bytes leftover after parsing attributes in process `syz.0.17735'. [ 1102.848609][T10645] netlink: del zone limit has 8 unknown bytes [ 1106.658916][T10692] netlink: 64859 bytes leftover after parsing attributes in process `syz.0.17757'. [ 1107.660292][T10712] netlink: 64859 bytes leftover after parsing attributes in process `syz.3.17768'. [ 1107.797138][T10716] netlink: 193500 bytes leftover after parsing attributes in process `syz.1.17770'. [ 1107.816841][T10716] netlink: 6324 bytes leftover after parsing attributes in process `syz.1.17770'. [ 1108.459248][T10741] netlink: 193500 bytes leftover after parsing attributes in process `syz.2.17782'. [ 1108.492618][T10741] netlink: 6324 bytes leftover after parsing attributes in process `syz.2.17782'. [ 1109.156478][T10757] netlink: 64859 bytes leftover after parsing attributes in process `syz.1.17790'. [ 1109.279640][T10764] netlink: 193500 bytes leftover after parsing attributes in process `syz.0.17792'. [ 1109.305259][T10764] netlink: 6324 bytes leftover after parsing attributes in process `syz.0.17792'. [ 1109.827810][T10783] netlink: 64859 bytes leftover after parsing attributes in process `syz.3.17802'. [ 1110.068270][T10789] netlink: 64859 bytes leftover after parsing attributes in process `syz.1.17805'. [ 1110.173945][T10793] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 1110.181346][T10793] IPv6: NLM_F_CREATE should be set when creating new route [ 1110.188742][T10793] IPv6: NLM_F_CREATE should be set when creating new route [ 1110.196096][T10793] IPv6: NLM_F_CREATE should be set when creating new route [ 1112.280895][T10862] netlink: 203516 bytes leftover after parsing attributes in process `syz.3.17837'. [ 1112.330635][T10864] sctp: [Deprecated]: syz.2.17838 (pid 10864) Use of struct sctp_assoc_value in delayed_ack socket option. [ 1112.330635][T10864] Use struct sctp_sack_info instead [ 1112.460319][T10870] tap0: tun_chr_ioctl cmd 1074025677 [ 1112.478971][T10870] tap0: linktype set to 1 [ 1114.128205][T10918] __nla_validate_parse: 4 callbacks suppressed [ 1114.128225][T10918] netlink: 60 bytes leftover after parsing attributes in process `syz.2.17865'. [ 1114.163668][T10918] netlink: 60 bytes leftover after parsing attributes in process `syz.2.17865'. [ 1114.188969][T10919] netlink: 60 bytes leftover after parsing attributes in process `syz.2.17865'. [ 1114.229219][T10918] netlink: 60 bytes leftover after parsing attributes in process `syz.2.17865'. [ 1114.539116][T10937] tap1: tun_chr_ioctl cmd 1074025677 [ 1114.544860][T10937] tap1: linktype set to 1 [ 1114.676775][T10941] netlink: 60 bytes leftover after parsing attributes in process `syz.2.17873'. [ 1114.690318][T10941] netlink: 60 bytes leftover after parsing attributes in process `syz.2.17873'. [ 1114.699962][T10939] netlink: 60 bytes leftover after parsing attributes in process `syz.2.17873'. [ 1114.711858][T10940] netlink: 60 bytes leftover after parsing attributes in process `syz.2.17873'. [ 1114.879723][T10949] sctp: [Deprecated]: syz.3.17877 (pid 10949) Use of struct sctp_assoc_value in delayed_ack socket option. [ 1114.879723][T10949] Use struct sctp_sack_info instead [ 1115.099069][T10959] netlink: 203516 bytes leftover after parsing attributes in process `syz.2.17880'. [ 1115.307829][T10967] netlink: 209832 bytes leftover after parsing attributes in process `syz.2.17888'. [ 1115.533267][T10976] sctp: [Deprecated]: syz.1.17890 (pid 10976) Use of struct sctp_assoc_value in delayed_ack socket option. [ 1115.533267][T10976] Use struct sctp_sack_info instead [ 1115.661529][T10983] netlink: 'syz.0.17894': attribute type 29 has an invalid length. [ 1115.670085][T10983] netlink: 'syz.0.17894': attribute type 29 has an invalid length. [ 1115.692309][T10983] netlink: 'syz.0.17894': attribute type 29 has an invalid length. [ 1115.707013][T10983] netlink: 'syz.0.17894': attribute type 29 has an invalid length. [ 1116.311733][ T1292] ieee802154 phy0 wpan0: encryption failed: -22 [ 1116.328958][ T1292] ieee802154 phy1 wpan1: encryption failed: -22 [ 1116.487098][T11009] tap0: tun_chr_ioctl cmd 1074025677 [ 1116.492703][T11009] tap0: linktype set to 1 [ 1118.873169][T11076] netlink: 'syz.1.17938': attribute type 1 has an invalid length. [ 1118.905549][T11079] netlink: zone id is out of range [ 1118.910753][T11079] netlink: zone id is out of range [ 1118.922421][T11079] netlink: zone id is out of range [ 1118.928226][T11079] netlink: zone id is out of range [ 1118.933523][T11079] netlink: zone id is out of range [ 1118.940156][T11079] netlink: zone id is out of range [ 1118.945837][T11079] netlink: zone id is out of range [ 1118.975420][T11079] netlink: zone id is out of range [ 1118.980719][T11079] netlink: zone id is out of range [ 1118.995604][T11079] netlink: zone id is out of range [ 1120.244188][T11124] __nla_validate_parse: 6 callbacks suppressed [ 1120.244208][T11124] netlink: 201392 bytes leftover after parsing attributes in process `syz.0.17961'. [ 1120.366656][T11130] tap0: tun_chr_ioctl cmd 35111 [ 1120.723606][T11149] netlink: 201392 bytes leftover after parsing attributes in process `syz.2.17975'. [ 1121.996837][T11172] netlink: 201392 bytes leftover after parsing attributes in process `syz.1.17984'. [ 1122.353515][T11192] tap1: tun_chr_ioctl cmd 35111 [ 1123.231305][T11219] netlink: 60 bytes leftover after parsing attributes in process `syz.3.18009'. [ 1123.269502][T11219] netlink: 60 bytes leftover after parsing attributes in process `syz.3.18009'. [ 1123.299250][T11220] tap0: tun_chr_ioctl cmd 35111 [ 1123.314597][T11221] netlink: 60 bytes leftover after parsing attributes in process `syz.3.18009'. [ 1123.330480][T11219] netlink: 60 bytes leftover after parsing attributes in process `syz.3.18009'. [ 1124.143801][T11236] net_ratelimit: 59 callbacks suppressed [ 1124.143823][T11236] skbuff: bad partial csum: csum=65489/0 headroom=64 headlen=65491 [ 1126.082306][T11272] skbuff: bad partial csum: csum=65489/0 headroom=64 headlen=65491 [ 1127.978790][T11335] netlink: 60 bytes leftover after parsing attributes in process `syz.2.18062'. [ 1127.988651][T11335] netlink: 60 bytes leftover after parsing attributes in process `syz.2.18062'. [ 1128.000930][T11335] netlink: 60 bytes leftover after parsing attributes in process `syz.2.18062'. [ 1128.011125][T11335] netlink: 60 bytes leftover after parsing attributes in process `syz.2.18062'. [ 1134.299778][T11456] netlink: 'syz.2.18119': attribute type 49 has an invalid length. [ 1134.335908][T11456] netlink: set zone limit has 8 unknown bytes [ 1139.260883][T11562] delete_channel: no stack [ 1140.486917][T11608] netlink: 44 bytes leftover after parsing attributes in process `syz.1.18189'. [ 1140.508859][T11610] netlink: 'syz.3.18190': attribute type 16 has an invalid length. [ 1140.518152][T11610] netlink: 'syz.3.18190': attribute type 3 has an invalid length. [ 1140.526216][T11610] netlink: 132 bytes leftover after parsing attributes in process `syz.3.18190'. [ 1141.163504][T11630] netlink: 44 bytes leftover after parsing attributes in process `syz.2.18208'. [ 1141.461516][T11637] netlink: 'syz.0.18205': attribute type 21 has an invalid length. [ 1141.874783][T11648] delete_channel: no stack [ 1142.077346][T11669] netlink: 'syz.2.18219': attribute type 21 has an invalid length. [ 1143.171478][T11694] delete_channel: no stack [ 1143.707980][T11724] netlink: 'syz.3.18247': attribute type 27 has an invalid length. [ 1143.719375][T11726] do_dccp_setsockopt: sockopt(CHANGE_L/R) is deprecated: fix your app [ 1143.729416][T11724] netlink: 2418 bytes leftover after parsing attributes in process `syz.3.18247'. [ 1143.771247][T11728] netlink: 68 bytes leftover after parsing attributes in process `syz.2.18248'. [ 1143.942969][T11736] tap1: tun_chr_ioctl cmd 1074025677 [ 1143.952927][T11736] tap1: linktype set to 777 [ 1144.020577][T11739] netlink: 60 bytes leftover after parsing attributes in process `syz.3.18252'. [ 1144.067676][T11739] netlink: 60 bytes leftover after parsing attributes in process `syz.3.18252'. [ 1144.081514][T11735] netlink: 60 bytes leftover after parsing attributes in process `syz.3.18252'. [ 1144.093683][T11738] netlink: 60 bytes leftover after parsing attributes in process `syz.3.18252'. [ 1144.104388][T11741] netlink: 16255 bytes leftover after parsing attributes in process `syz.2.18253'. [ 1144.328929][T11754] do_dccp_setsockopt: sockopt(CHANGE_L/R) is deprecated: fix your app [ 1144.462293][T11759] do_dccp_setsockopt: sockopt(CHANGE_L/R) is deprecated: fix your app [ 1144.620878][T11765] syzkaller0: tun_chr_ioctl cmd 1074025677 [ 1144.627660][T11765] syzkaller0: linktype set to 0 [ 1144.718747][T11768] tap1: tun_chr_ioctl cmd 1074025677 [ 1144.724355][T11768] tap1: linktype set to 777 [ 1144.899722][T11776] netlink: 'syz.2.18269': attribute type 27 has an invalid length. [ 1145.514510][T11805] syzkaller0: tun_chr_ioctl cmd 1074025677 [ 1145.525535][T11805] syzkaller0: linktype set to 0 [ 1145.668720][T11812] netlink: 'syz.0.18280': attribute type 27 has an invalid length. [ 1145.677205][T11812] __nla_validate_parse: 2 callbacks suppressed [ 1145.677238][T11812] netlink: 2418 bytes leftover after parsing attributes in process `syz.0.18280'. [ 1146.149046][T11833] netlink: 60 bytes leftover after parsing attributes in process `syz.2.18293'. [ 1146.158999][T11833] netlink: 60 bytes leftover after parsing attributes in process `syz.2.18293'. [ 1146.176569][T11833] netlink: 60 bytes leftover after parsing attributes in process `syz.2.18293'. [ 1146.190760][T11833] netlink: 60 bytes leftover after parsing attributes in process `syz.2.18293'. [ 1146.989643][T11866] netlink: 65047 bytes leftover after parsing attributes in process `syz.3.18308'. [ 1147.103111][T11873] netlink: 'syz.3.18311': attribute type 29 has an invalid length. [ 1147.111622][T11873] netlink: 'syz.3.18311': attribute type 29 has an invalid length. [ 1147.122612][T11873] netlink: 'syz.3.18311': attribute type 29 has an invalid length. [ 1147.132440][T11873] netlink: 'syz.3.18311': attribute type 29 has an invalid length. [ 1147.790532][T11885] pim6reg0: tun_chr_ioctl cmd 1074025694 [ 1148.100710][T11901] netlink: 'syz.0.18322': attribute type 29 has an invalid length. [ 1148.138499][T11901] netlink: 'syz.0.18322': attribute type 29 has an invalid length. [ 1148.158107][T11901] netlink: 'syz.0.18322': attribute type 29 has an invalid length. [ 1148.169140][T11901] netlink: 'syz.0.18322': attribute type 29 has an invalid length. [ 1148.363322][T11907] netlink: 64535 bytes leftover after parsing attributes in process `syz.3.18326'. [ 1148.654185][T11923] netlink: 830 bytes leftover after parsing attributes in process `syz.2.18340'. [ 1148.955829][T11932] netlink: 'syz.2.18336': attribute type 29 has an invalid length. [ 1151.653917][T12032] validate_nla: 3 callbacks suppressed [ 1151.653939][T12032] netlink: 'syz.0.18382': attribute type 19 has an invalid length. [ 1151.702576][T12032] netlink: 14552 bytes leftover after parsing attributes in process `syz.0.18382'. [ 1153.067397][T12098] netlink: 60 bytes leftover after parsing attributes in process `syz.2.18406'. [ 1153.095059][T12098] netlink: 60 bytes leftover after parsing attributes in process `syz.2.18406'. [ 1153.115938][T12098] netlink: 60 bytes leftover after parsing attributes in process `syz.2.18406'. [ 1153.133569][T12098] netlink: 60 bytes leftover after parsing attributes in process `syz.2.18406'. [ 1153.341599][T12103] netlink: 209592 bytes leftover after parsing attributes in process `syz.3.18412'. [ 1153.372044][T12103] netlink: zone id is out of range [ 1153.613359][T12118] netlink: 'syz.1.18416': attribute type 19 has an invalid length. [ 1153.624907][T12118] netlink: 14552 bytes leftover after parsing attributes in process `syz.1.18416'. [ 1155.344070][T12173] dvmrp1: tun_chr_ioctl cmd 1074025675 [ 1155.349967][T12173] dvmrp1: persist disabled [ 1155.552986][T12183] netlink: 65039 bytes leftover after parsing attributes in process `syz.2.18446'. [ 1157.144565][T12221] netlink: 65047 bytes leftover after parsing attributes in process `syz.0.18465'. [ 1157.365777][T12231] netlink: 209832 bytes leftover after parsing attributes in process `syz.2.18469'. [ 1157.530306][T12233] dvmrp1: tun_chr_ioctl cmd 1074025675 [ 1157.544224][T12233] dvmrp1: persist disabled [ 1157.766710][T12243] netlink: 65047 bytes leftover after parsing attributes in process `syz.2.18476'. [ 1158.049980][T12253] netlink: 209832 bytes leftover after parsing attributes in process `syz.1.18480'. [ 1158.385659][T12262] netlink: 65047 bytes leftover after parsing attributes in process `syz.1.18485'. [ 1158.663212][T12276] netlink: 209832 bytes leftover after parsing attributes in process `syz.0.18490'. [ 1159.288846][T12297] netlink: 'syz.0.18499': attribute type 13 has an invalid length. [ 1159.306304][T12297] netlink: 24643 bytes leftover after parsing attributes in process `syz.0.18499'. [ 1161.432649][T12357] netlink: 199824 bytes leftover after parsing attributes in process `syz.2.18527'. [ 1161.589103][T12365] netlink: 'syz.1.18531': attribute type 13 has an invalid length. [ 1161.603721][T12365] netlink: 24643 bytes leftover after parsing attributes in process `syz.1.18531'. [ 1162.203716][T12387] netlink: 140 bytes leftover after parsing attributes in process `syz.0.18540'. [ 1162.500335][T12395] netlink: 'syz.3.18543': attribute type 13 has an invalid length. [ 1162.515521][T12395] netlink: 24643 bytes leftover after parsing attributes in process `syz.3.18543'. [ 1171.330748][T12632] netlink: 60 bytes leftover after parsing attributes in process `syz.2.18649'. [ 1171.340446][T12632] netlink: 60 bytes leftover after parsing attributes in process `syz.2.18649'. [ 1171.350577][T12630] netlink: 60 bytes leftover after parsing attributes in process `syz.2.18649'. [ 1171.361478][T12631] netlink: 60 bytes leftover after parsing attributes in process `syz.2.18649'. [ 1174.049671][T12704] netlink: 60 bytes leftover after parsing attributes in process `syz.1.18680'. [ 1174.065741][T12704] netlink: 60 bytes leftover after parsing attributes in process `syz.1.18680'. [ 1174.077498][T12700] netlink: 60 bytes leftover after parsing attributes in process `syz.1.18680'. [ 1174.089463][T12703] netlink: 60 bytes leftover after parsing attributes in process `syz.1.18680'. [ 1174.644879][T12726] C: renamed from team_slave_0 (while UP) [ 1174.677586][T12726] netlink: 'syz.1.18689': attribute type 1 has an invalid length. [ 1174.688989][T12726] netlink: 128 bytes leftover after parsing attributes in process `syz.1.18689'. [ 1174.699897][T12669] Bluetooth: hci3: command 0x0406 tx timeout [ 1174.707628][T12669] Bluetooth: hci1: command 0x0406 tx timeout [ 1174.737196][T12726] A link change request failed with some changes committed already. Interface C may have been left with an inconsistent configuration, please check. [ 1174.971677][T12737] netlink: 60 bytes leftover after parsing attributes in process `syz.3.18692'. [ 1175.827077][T12763] netlink: 'syz.2.18707': attribute type 3 has an invalid length. [ 1175.845551][T12763] netlink: 'syz.2.18707': attribute type 1 has an invalid length. [ 1176.561005][T12785] __nla_validate_parse: 13 callbacks suppressed [ 1176.561028][T12785] netlink: 8 bytes leftover after parsing attributes in process `syz.3.18717'. [ 1176.610426][T12785] netlink: 4 bytes leftover after parsing attributes in process `syz.3.18717'. [ 1176.632616][T12785] netlink: 33 bytes leftover after parsing attributes in process `syz.3.18717'. [ 1176.656026][T12785] netlink: 4 bytes leftover after parsing attributes in process `syz.3.18717'. [ 1176.665500][T12785] netlink: 33 bytes leftover after parsing attributes in process `syz.3.18717'. [ 1176.771574][T12791] tap1: tun_chr_ioctl cmd 1074025681 [ 1177.496942][T12819] netlink: 16046 bytes leftover after parsing attributes in process `syz.0.18738'. [ 1177.609705][T12824] C: renamed from team_slave_0 (while UP) [ 1177.628180][T12824] netlink: 'syz.0.18732': attribute type 1 has an invalid length. [ 1177.637091][T12824] netlink: 128 bytes leftover after parsing attributes in process `syz.0.18732'. [ 1177.647553][T12824] A link change request failed with some changes committed already. Interface C may have been left with an inconsistent configuration, please check. [ 1177.754408][ T1292] ieee802154 phy0 wpan0: encryption failed: -22 [ 1177.761395][ T1292] ieee802154 phy1 wpan1: encryption failed: -22 [ 1177.848864][T12828] netlink: 60 bytes leftover after parsing attributes in process `syz.0.18735'. [ 1177.858296][T12828] netlink: 60 bytes leftover after parsing attributes in process `syz.0.18735'. [ 1177.876112][T12828] netlink: 60 bytes leftover after parsing attributes in process `syz.0.18735'. [ 1179.590201][T12910] netlink: 'syz.0.18775': attribute type 27 has an invalid length. [ 1182.542587][T13043] __nla_validate_parse: 7 callbacks suppressed [ 1182.542609][T13043] netlink: 1772 bytes leftover after parsing attributes in process `syz.3.18841'. [ 1182.832406][T13057] netlink: 703 bytes leftover after parsing attributes in process `syz.2.18848'. [ 1182.997162][T13065] netlink: 9286 bytes leftover after parsing attributes in process `syz.2.18853'. [ 1183.708331][T13098] netlink: 'syz.2.18869': attribute type 21 has an invalid length. [ 1183.732519][T13098] netlink: 'syz.2.18869': attribute type 1 has an invalid length. [ 1183.741601][T13098] netlink: 16090 bytes leftover after parsing attributes in process `syz.2.18869'. [ 1183.853797][T13104] netlink: 16255 bytes leftover after parsing attributes in process `syz.3.18874'. [ 1184.288790][T13125] netlink: 'syz.3.18881': attribute type 27 has an invalid length. [ 1186.196063][T13178] netlink: 1772 bytes leftover after parsing attributes in process `syz.2.18906'. [ 1186.440856][T13191] netlink: 9286 bytes leftover after parsing attributes in process `syz.1.18922'. [ 1187.012337][T13215] netlink: 9286 bytes leftover after parsing attributes in process `syz.3.18924'. [ 1187.569452][T13245] netlink: 193500 bytes leftover after parsing attributes in process `syz.1.18939'. [ 1191.553306][T13317] netlink: 'syz.3.18970': attribute type 9 has an invalid length. [ 1191.568678][T13317] netlink: 'syz.3.18970': attribute type 23 has an invalid length. [ 1191.577841][T13317] netlink: 156008 bytes leftover after parsing attributes in process `syz.3.18970'. [ 1192.537945][T13332] netlink: 60 bytes leftover after parsing attributes in process `syz.3.18978'. [ 1192.548497][T13332] netlink: 60 bytes leftover after parsing attributes in process `syz.3.18978'. [ 1192.559331][T13332] netlink: 60 bytes leftover after parsing attributes in process `syz.3.18978'. [ 1192.583046][T13332] netlink: 60 bytes leftover after parsing attributes in process `syz.3.18978'. [ 1193.321977][T13359] netlink: 'syz.0.18990': attribute type 29 has an invalid length. [ 1193.346583][T13359] netlink: 'syz.0.18990': attribute type 29 has an invalid length. [ 1193.366785][T13359] netlink: 'syz.0.18990': attribute type 29 has an invalid length. [ 1193.395836][T13359] netlink: 'syz.0.18990': attribute type 29 has an invalid length. [ 1193.678224][T13372] tun0: tun_chr_ioctl cmd 1074025681 [ 1194.793082][T13396] netlink: 209832 bytes leftover after parsing attributes in process `syz.3.19007'. [ 1198.401318][T13416] netlink: 'syz.0.19015': attribute type 9 has an invalid length. [ 1198.419381][T13416] netlink: 'syz.0.19015': attribute type 23 has an invalid length. [ 1198.442065][T13416] netlink: 156008 bytes leftover after parsing attributes in process `syz.0.19015'. [ 1199.954833][T13423] netlink: 148 bytes leftover after parsing attributes in process `syz.2.19018'. [ 1201.036539][T13448] netlink: 'syz.2.19029': attribute type 9 has an invalid length. [ 1201.046741][T13448] netlink: 'syz.2.19029': attribute type 23 has an invalid length. [ 1201.048947][T13450] netlink: 148 bytes leftover after parsing attributes in process `syz.3.19030'. [ 1201.055171][T13448] netlink: 156008 bytes leftover after parsing attributes in process `syz.2.19029'. [ 1201.384963][T13464] tun0: tun_chr_ioctl cmd 1074025681 [ 1201.473696][T13470] netlink: 'syz.1.19040': attribute type 29 has an invalid length. [ 1201.486001][T13470] netlink: 'syz.1.19040': attribute type 29 has an invalid length. [ 1201.497432][T13470] netlink: 'syz.1.19040': attribute type 29 has an invalid length. [ 1201.514666][T13470] netlink: 'syz.1.19040': attribute type 29 has an invalid length. [ 1201.664764][T13476] netlink: 'syz.1.19043': attribute type 9 has an invalid length. [ 1201.690769][T13476] netlink: 'syz.1.19043': attribute type 23 has an invalid length. [ 1201.702388][T13476] netlink: 156008 bytes leftover after parsing attributes in process `syz.1.19043'. [ 1202.578205][T13520] netlink: 4 bytes leftover after parsing attributes in process `syz.3.19065'. [ 1204.750647][T13563] netlink: 4 bytes leftover after parsing attributes in process `syz.2.19092'. [ 1205.801597][T13585] netlink: 4 bytes leftover after parsing attributes in process `syz.1.19096'. [ 1207.780951][T13609] netlink: 201392 bytes leftover after parsing attributes in process `syz.2.19105'. [ 1208.002865][T13616] netlink: 4 bytes leftover after parsing attributes in process `syz.0.19111'. [ 1208.055251][T13618] netlink: 16255 bytes leftover after parsing attributes in process `syz.1.19112'. [ 1208.293827][T13624] validate_nla: 4 callbacks suppressed [ 1208.293847][T13624] netlink: 'syz.0.19115': attribute type 22 has an invalid length. [ 1208.310396][T13624] netlink: 14380 bytes leftover after parsing attributes in process `syz.0.19115'. [ 1209.610131][T13644] netlink: 4 bytes leftover after parsing attributes in process `syz.3.19124'. [ 1209.789388][T13656] netlink: 'syz.2.19128': attribute type 22 has an invalid length. [ 1209.815827][T13656] netlink: 14380 bytes leftover after parsing attributes in process `syz.2.19128'. [ 1210.298757][T13673] netlink: 4083 bytes leftover after parsing attributes in process `syz.3.19137'. [ 1210.308250][T13673] netlink: 4083 bytes leftover after parsing attributes in process `syz.3.19137'. [ 1210.318502][T13671] netlink: 4083 bytes leftover after parsing attributes in process `syz.3.19137'. [ 1210.360014][T13674] tun0: tun_chr_ioctl cmd 1074812118 [ 1210.374472][T13673] netlink: 4083 bytes leftover after parsing attributes in process `syz.3.19137'. [ 1210.813199][T13676] netlink: 'syz.2.19138': attribute type 10 has an invalid length. [ 1210.825875][T13676] netlink: 65015 bytes leftover after parsing attributes in process `syz.2.19138'. [ 1210.839373][T13681] netlink: 4 bytes leftover after parsing attributes in process `syz.3.19139'. [ 1210.981485][T13687] netlink: 'syz.1.19142': attribute type 22 has an invalid length. [ 1210.995484][T13687] netlink: 14380 bytes leftover after parsing attributes in process `syz.1.19142'. [ 1213.757889][T13726] netlink: 'syz.1.19159': attribute type 8 has an invalid length. [ 1213.776682][T13726] A link change request failed with some changes committed already. Interface C may have been left with an inconsistent configuration, please check. [ 1213.799307][T13729] netlink: 'syz.2.19160': attribute type 29 has an invalid length. [ 1213.825974][T13729] netlink: 'syz.2.19160': attribute type 29 has an invalid length. [ 1213.888860][T13732] netlink: 'syz.2.19160': attribute type 29 has an invalid length. [ 1213.918423][T13729] netlink: 'syz.2.19160': attribute type 29 has an invalid length. [ 1214.085420][T13742] netlink: 201392 bytes leftover after parsing attributes in process `syz.0.19166'. [ 1214.106350][T13742] netlink: zone id is out of range [ 1214.111677][T13742] netlink: zone id is out of range [ 1214.155809][T13742] netlink: zone id is out of range [ 1214.161012][T13742] netlink: zone id is out of range [ 1214.183595][T13742] netlink: zone id is out of range [ 1214.196043][T13742] netlink: zone id is out of range [ 1214.207795][T13742] netlink: zone id is out of range [ 1214.219086][T13742] netlink: zone id is out of range [ 1214.224423][T13742] netlink: zone id is out of range [ 1214.271645][T13750] netlink: 60 bytes leftover after parsing attributes in process `syz.1.19170'. [ 1214.477255][T13760] netlink: 'syz.0.19175': attribute type 8 has an invalid length. [ 1214.647904][T13770] netlink: 'syz.3.19178': attribute type 29 has an invalid length. [ 1214.670701][T13770] netlink: 'syz.3.19178': attribute type 29 has an invalid length. [ 1214.699021][T13770] netlink: 'syz.3.19178': attribute type 29 has an invalid length. [ 1214.708731][T13770] netlink: 'syz.3.19178': attribute type 29 has an invalid length. [ 1214.843578][T13778] __nla_validate_parse: 3 callbacks suppressed [ 1214.843599][T13778] netlink: 201392 bytes leftover after parsing attributes in process `syz.2.19181'. [ 1214.982712][T13784] netlink: 60 bytes leftover after parsing attributes in process `syz.2.19182'. [ 1214.995616][T13784] netlink: 60 bytes leftover after parsing attributes in process `syz.2.19182'. [ 1215.007903][T13784] netlink: 60 bytes leftover after parsing attributes in process `syz.2.19182'. [ 1215.018946][T13784] netlink: 60 bytes leftover after parsing attributes in process `syz.2.19182'. [ 1215.531414][T13796] netlink: 201392 bytes leftover after parsing attributes in process `syz.3.19192'. [ 1218.990615][T13900] netlink: 192436 bytes leftover after parsing attributes in process `syz.1.19238'. [ 1219.025983][T13900] net_ratelimit: 670 callbacks suppressed [ 1219.026003][T13900] openvswitch: netlink: Duplicate key (type 0). [ 1219.201624][T13905] netlink: 148 bytes leftover after parsing attributes in process `syz.0.19240'. [ 1219.461031][T13912] netlink: 60 bytes leftover after parsing attributes in process `syz.0.19243'. [ 1219.525273][T13912] netlink: 60 bytes leftover after parsing attributes in process `syz.0.19243'. [ 1220.103305][T13929] __nla_validate_parse: 2 callbacks suppressed [ 1220.103325][T13929] netlink: 148 bytes leftover after parsing attributes in process `syz.3.19253'. [ 1220.604011][T13941] netlink: 60 bytes leftover after parsing attributes in process `syz.2.19258'. [ 1220.658909][T13941] netlink: 60 bytes leftover after parsing attributes in process `syz.2.19258'. [ 1220.721745][T13944] netlink: 60 bytes leftover after parsing attributes in process `syz.2.19258'. [ 1220.799767][T13945] netlink: 60 bytes leftover after parsing attributes in process `syz.2.19258'. [ 1221.507785][T13957] netlink: 4595 bytes leftover after parsing attributes in process `syz.0.19266'. [ 1221.816994][T13969] syzkaller0: tun_chr_ioctl cmd 2147767519 [ 1222.409087][T13984] netlink: 4083 bytes leftover after parsing attributes in process `syz.0.19277'. [ 1222.461965][T13984] netlink: 4083 bytes leftover after parsing attributes in process `syz.0.19277'. [ 1222.484121][T13990] netlink: 60 bytes leftover after parsing attributes in process `syz.1.19278'. [ 1222.495508][T13990] netlink: 60 bytes leftover after parsing attributes in process `syz.1.19278'. [ 1222.590941][T13991] tap1: tun_chr_ioctl cmd 1074025680 [ 1222.885002][T14001] syzkaller0: tun_chr_ioctl cmd 2147767519 [ 1223.398882][T14024] tap1: tun_chr_ioctl cmd 1074025680 [ 1223.603243][T14030] syzkaller0: tun_chr_ioctl cmd 2147767519 [ 1225.125801][T14077] __nla_validate_parse: 16 callbacks suppressed [ 1225.125819][T14077] netlink: 60 bytes leftover after parsing attributes in process `syz.3.19316'. [ 1225.165498][T14077] netlink: 60 bytes leftover after parsing attributes in process `syz.3.19316'. [ 1225.185613][T14071] netlink: 60 bytes leftover after parsing attributes in process `syz.3.19316'. [ 1225.219838][T14074] netlink: 60 bytes leftover after parsing attributes in process `syz.3.19316'. [ 1228.460176][T14127] netlink: 40227 bytes leftover after parsing attributes in process `syz.1.19338'. [ 1229.133847][T14151] netlink: 40227 bytes leftover after parsing attributes in process `syz.3.19351'. [ 1229.304549][T14162] validate_nla: 5 callbacks suppressed [ 1229.304567][T14162] netlink: 'syz.0.19358': attribute type 29 has an invalid length. [ 1229.332055][T14162] netlink: 'syz.0.19358': attribute type 29 has an invalid length. [ 1229.347985][T14162] netlink: 'syz.0.19358': attribute type 29 has an invalid length. [ 1229.696766][T14178] netlink: 40227 bytes leftover after parsing attributes in process `syz.0.19366'. [ 1229.897981][T14190] netlink: 'syz.2.19371': attribute type 29 has an invalid length. [ 1229.915855][T14190] netlink: 'syz.2.19371': attribute type 29 has an invalid length. [ 1229.948950][T14190] netlink: 'syz.2.19371': attribute type 29 has an invalid length. [ 1230.639698][T14217] netlink: 'syz.3.19384': attribute type 29 has an invalid length. [ 1230.648588][T14217] netlink: 'syz.3.19384': attribute type 29 has an invalid length. [ 1230.677761][T14217] netlink: 'syz.3.19384': attribute type 29 has an invalid length. [ 1230.893026][T14229] netlink: 209832 bytes leftover after parsing attributes in process `syz.0.19390'. [ 1231.104620][T14241] netlink: 'syz.3.19396': attribute type 29 has an invalid length. [ 1233.544773][T14269] netlink: 144448 bytes leftover after parsing attributes in process `syz.3.19409'. [ 1235.324613][T14302] netlink: 209832 bytes leftover after parsing attributes in process `syz.1.19424'. [ 1235.526026][T14304] validate_nla: 6 callbacks suppressed [ 1235.526044][T14304] netlink: 'syz.0.19426': attribute type 29 has an invalid length. [ 1235.578705][T14304] netlink: 'syz.0.19426': attribute type 29 has an invalid length. [ 1235.587911][T14309] netlink: 'syz.0.19426': attribute type 29 has an invalid length. [ 1235.600293][T14304] netlink: 'syz.0.19426': attribute type 29 has an invalid length. [ 1235.945257][T14321] netlink: 209832 bytes leftover after parsing attributes in process `syz.3.19434'. [ 1236.599953][T14334] netlink: 'syz.1.19438': attribute type 29 has an invalid length. [ 1236.611814][T14334] netlink: 'syz.1.19438': attribute type 29 has an invalid length. [ 1236.622392][T14334] netlink: 'syz.1.19438': attribute type 29 has an invalid length. [ 1236.631776][T14334] netlink: 'syz.1.19438': attribute type 29 has an invalid length. [ 1237.256721][T14355] tap1: tun_chr_ioctl cmd 2147767511 [ 1238.208915][T14371] netlink: 'syz.2.19457': attribute type 27 has an invalid length. [ 1238.246019][T14371] netlink: 2418 bytes leftover after parsing attributes in process `syz.2.19457'. [ 1239.049108][T14402] netlink: 60 bytes leftover after parsing attributes in process `syz.0.19473'. [ 1239.076602][T14402] netlink: 60 bytes leftover after parsing attributes in process `syz.0.19473'. [ 1239.100528][T14402] netlink: 60 bytes leftover after parsing attributes in process `syz.0.19473'. [ 1239.130502][T14402] netlink: 60 bytes leftover after parsing attributes in process `syz.0.19473'. [ 1239.185909][ T1292] ieee802154 phy0 wpan0: encryption failed: -22 [ 1239.192516][ T1292] ieee802154 phy1 wpan1: encryption failed: -22 [ 1239.278956][T14407] netlink: 209832 bytes leftover after parsing attributes in process `syz.2.19477'. [ 1240.344519][T14442] netlink: 'syz.2.19493': attribute type 3 has an invalid length. [ 1240.376382][T14442] netlink: 144448 bytes leftover after parsing attributes in process `syz.2.19493'. [ 1242.301036][T14460] netlink: 60 bytes leftover after parsing attributes in process `syz.2.19500'. [ 1242.320831][T14460] netlink: 60 bytes leftover after parsing attributes in process `syz.2.19500'. [ 1242.344471][T14460] netlink: 60 bytes leftover after parsing attributes in process `syz.2.19500'. [ 1242.376866][T14460] netlink: 60 bytes leftover after parsing attributes in process `syz.2.19500'. [ 1242.703373][T14472] tap1: tun_chr_ioctl cmd 1074025677 [ 1242.749589][T14472] tap1: linktype set to 778 [ 1244.427547][T14480] netlink: 64859 bytes leftover after parsing attributes in process `syz.2.19510'. [ 1244.802898][T14493] netlink: 60 bytes leftover after parsing attributes in process `syz.1.19514'. [ 1244.825817][T14493] netlink: 60 bytes leftover after parsing attributes in process `syz.1.19514'. [ 1244.855656][T14493] netlink: 60 bytes leftover after parsing attributes in process `syz.1.19514'. [ 1244.877000][T14493] netlink: 60 bytes leftover after parsing attributes in process `syz.1.19514'. [ 1248.171093][T14600] tap1: tun_chr_ioctl cmd 1074025677 [ 1248.177107][T14600] tap1: linktype set to 778 [ 1249.068770][T14637] tap1: tun_chr_ioctl cmd 1074025677 [ 1249.074271][T14637] tap1: linktype set to 778 [ 1249.469329][T14661] netlink: 16186 bytes leftover after parsing attributes in process `syz.0.19592'. [ 1249.760252][T14674] validate_nla: 2 callbacks suppressed [ 1249.760273][T14674] netlink: 'syz.2.19599': attribute type 1 has an invalid length. [ 1250.076286][T14692] netlink: 16186 bytes leftover after parsing attributes in process `syz.2.19607'. [ 1252.418312][T14791] netlink: 55631 bytes leftover after parsing attributes in process `syz.1.19650'. [ 1252.446560][T14791] netlink: 6260 bytes leftover after parsing attributes in process `syz.1.19650'. [ 1252.462984][T14791] netlink: 65 bytes leftover after parsing attributes in process `syz.1.19650'. [ 1253.574519][T14829] netlink: 'syz.2.19666': attribute type 9 has an invalid length. [ 1253.583143][T14829] netlink: 61951 bytes leftover after parsing attributes in process `syz.2.19666'. [ 1253.914956][T14843] netlink: 144 bytes leftover after parsing attributes in process `syz.3.19675'. [ 1254.514343][T14861] netlink: 209852 bytes leftover after parsing attributes in process `syz.1.19683'. [ 1254.533470][T14861] openvswitch: netlink: Key type 29 is not supported [ 1254.743717][T14870] netlink: 144 bytes leftover after parsing attributes in process `syz.0.19687'. [ 1255.423959][T14880] netlink: 'syz.3.19692': attribute type 9 has an invalid length. [ 1255.457958][T14880] netlink: 61951 bytes leftover after parsing attributes in process `syz.3.19692'. [ 1255.688475][T14894] netlink: 209852 bytes leftover after parsing attributes in process `syz.2.19695'. [ 1255.706675][T14894] openvswitch: netlink: Key type 29 is not supported [ 1255.862380][T14900] netlink: 40227 bytes leftover after parsing attributes in process `syz.2.19700'. [ 1255.905252][T14902] sctp: [Deprecated]: syz.3.19701 (pid 14902) Use of struct sctp_assoc_value in delayed_ack socket option. [ 1255.905252][T14902] Use struct sctp_sack_info instead [ 1256.240030][T14914] netlink: 'syz.0.19706': attribute type 9 has an invalid length. [ 1256.249823][T14914] netlink: 61951 bytes leftover after parsing attributes in process `syz.0.19706'. [ 1256.407212][T14920] netlink: 209852 bytes leftover after parsing attributes in process `syz.0.19708'. [ 1256.418681][T14920] openvswitch: netlink: Key type 29 is not supported [ 1257.008169][T14944] netlink: 144 bytes leftover after parsing attributes in process `syz.1.19720'. [ 1257.183498][T14948] wlan0: mtu greater than device maximum [ 1258.539821][T14993] netlink: 'syz.3.19740': attribute type 1 has an invalid length. [ 1258.552647][T14993] netlink: 'syz.3.19740': attribute type 2 has an invalid length. [ 1258.562500][T14993] netlink: 'syz.3.19740': attribute type 2 has an invalid length. [ 1258.571049][T14993] netlink: 'syz.3.19740': attribute type 3 has an invalid length. [ 1258.579478][T14993] netlink: 'syz.3.19740': attribute type 4 has an invalid length. [ 1258.588047][T14993] netlink: 'syz.3.19740': attribute type 5 has an invalid length. [ 1258.596676][T14993] netlink: 'syz.3.19740': attribute type 6 has an invalid length. [ 1258.604762][T14993] netlink: 'syz.3.19740': attribute type 7 has an invalid length. [ 1258.613624][T14993] netlink: 126304 bytes leftover after parsing attributes in process `syz.3.19740'. [ 1258.848158][T15005] wlan0: mtu greater than device maximum [ 1259.236594][T15024] netlink: 126304 bytes leftover after parsing attributes in process `syz.0.19755'. [ 1260.244304][T15071] netlink: 14 bytes leftover after parsing attributes in process `syz.0.19778'. [ 1261.077862][T15103] netlink: 14 bytes leftover after parsing attributes in process `syz.3.19792'. [ 1261.747686][T15135] netlink: 14 bytes leftover after parsing attributes in process `syz.2.19806'. [ 1262.174954][T15154] validate_nla: 18 callbacks suppressed [ 1262.174972][T15154] netlink: 'syz.1.19816': attribute type 27 has an invalid length. [ 1262.197787][T15154] netlink: 'syz.1.19816': attribute type 25 has an invalid length. [ 1262.448748][T15166] netlink: 703 bytes leftover after parsing attributes in process `syz.2.19821'. [ 1262.569574][T15167] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 1262.952475][T15185] netlink: 'syz.0.19829': attribute type 27 has an invalid length. [ 1262.972599][T15185] netlink: 'syz.0.19829': attribute type 25 has an invalid length. [ 1263.112312][T15189] netlink: 'syz.1.19833': attribute type 29 has an invalid length. [ 1263.128470][T15189] netlink: 'syz.1.19833': attribute type 29 has an invalid length. [ 1263.165753][T15189] netlink: 'syz.1.19833': attribute type 29 has an invalid length. [ 1263.185541][T15189] netlink: 'syz.1.19833': attribute type 29 has an invalid length. [ 1263.206084][T15189] netlink: 'syz.1.19833': attribute type 29 has an invalid length. [ 1265.002475][T15254] netlink: 'syz.3.19859': attribute type 3 has an invalid length. [ 1265.023597][T15254] netlink: 13435 bytes leftover after parsing attributes in process `syz.3.19859'. [ 1266.508998][T15297] netlink: zone id is out of range [ 1266.514246][T15297] netlink: set zone limit has 8 unknown bytes [ 1266.773574][T15305] netlink: 16046 bytes leftover after parsing attributes in process `syz.3.19887'. [ 1266.932489][T15312] netlink: 161700 bytes leftover after parsing attributes in process `syz.2.19889'. [ 1267.795924][T15324] pim6reg1: entered promiscuous mode [ 1267.801343][T15324] pim6reg1: entered allmulticast mode [ 1267.916763][T15326] netlink: 14556 bytes leftover after parsing attributes in process `syz.2.19895'. [ 1268.088953][T15333] netlink: 16046 bytes leftover after parsing attributes in process `syz.1.19898'. [ 1268.246755][T15339] validate_nla: 1 callbacks suppressed [ 1268.246774][T15339] netlink: 'syz.2.19901': attribute type 1 has an invalid length. [ 1268.285743][T15339] netlink: 161700 bytes leftover after parsing attributes in process `syz.2.19901'. [ 1269.096523][T15372] tap1: tun_chr_ioctl cmd 2147767507 [ 1269.110953][T15372] tap1: tun_chr_ioctl cmd 2147767507 [ 1270.671290][T15434] sock: sock_timestamping_bind_phc: sock not bind to device [ 1271.114880][T15450] netlink: 'syz.1.19950': attribute type 1 has an invalid length. [ 1271.155134][T15450] netlink: 168864 bytes leftover after parsing attributes in process `syz.1.19950'. [ 1272.191863][T15484] sock: sock_timestamping_bind_phc: sock not bind to device [ 1274.506320][T15539] netlink: 55631 bytes leftover after parsing attributes in process `syz.1.19992'. [ 1274.551402][T15539] netlink: 6328 bytes leftover after parsing attributes in process `syz.1.19992'. [ 1274.573883][ T6317] tipc: Subscription rejected, illegal request [ 1275.172590][T15563] netlink: 'syz.1.20005': attribute type 2 has an invalid length. [ 1275.200768][T15563] netlink: 128 bytes leftover after parsing attributes in process `syz.1.20005'. [ 1275.214644][T15566] netlink: 55631 bytes leftover after parsing attributes in process `syz.2.20007'. [ 1275.237151][T15566] netlink: 6328 bytes leftover after parsing attributes in process `syz.2.20007'. [ 1278.926152][T15598] netlink: 55631 bytes leftover after parsing attributes in process `syz.3.20021'. [ 1278.985646][T15598] netlink: 6328 bytes leftover after parsing attributes in process `syz.3.20021'. [ 1279.704220][T15625] netlink: 55631 bytes leftover after parsing attributes in process `syz.2.20034'. [ 1279.714567][T15625] netlink: 6320 bytes leftover after parsing attributes in process `syz.2.20034'. [ 1279.734778][T15625] netlink: 6 bytes leftover after parsing attributes in process `syz.2.20034'. [ 1279.750375][T15625] tc_dump_action: action bad kind [ 1279.785044][T15627] netlink: 'syz.0.20035': attribute type 33 has an invalid length. [ 1279.803565][T15627] netlink: 128 bytes leftover after parsing attributes in process `syz.0.20035'. [ 1280.455658][T15655] netlink: 55631 bytes leftover after parsing attributes in process `syz.3.20046'. [ 1280.475387][T15655] netlink: 6320 bytes leftover after parsing attributes in process `syz.3.20046'. [ 1280.484740][T15655] netlink: 6 bytes leftover after parsing attributes in process `syz.3.20046'. [ 1280.506101][T15655] tc_dump_action: action bad kind [ 1280.583319][T15659] netlink: 'syz.2.20048': attribute type 33 has an invalid length. [ 1280.594472][T15659] netlink: 128 bytes leftover after parsing attributes in process `syz.2.20048'. [ 1281.171449][T15683] netlink: 55631 bytes leftover after parsing attributes in process `syz.1.20058'. [ 1281.181122][T15683] netlink: 6320 bytes leftover after parsing attributes in process `syz.1.20058'. [ 1281.195734][T15683] tc_dump_action: action bad kind [ 1281.275980][T15685] netlink: 'syz.3.20059': attribute type 33 has an invalid length. [ 1283.981024][T15673] syz.2.20054 (15673) used greatest stack depth: 18920 bytes left [ 1285.580754][T15733] __nla_validate_parse: 2 callbacks suppressed [ 1285.580776][T15733] netlink: 199836 bytes leftover after parsing attributes in process `syz.0.20085'. [ 1286.291637][T15759] netlink: 9286 bytes leftover after parsing attributes in process `syz.0.20090'. [ 1286.429588][T15763] netlink: 'syz.0.20093': attribute type 3 has an invalid length. [ 1286.445453][T15763] netlink: 199836 bytes leftover after parsing attributes in process `syz.0.20093'. [ 1288.259961][T15806] netlink: 'syz.3.20113': attribute type 3 has an invalid length. [ 1288.295767][T15806] netlink: 199836 bytes leftover after parsing attributes in process `syz.3.20113'. [ 1290.224145][T15864] netlink: 132 bytes leftover after parsing attributes in process `syz.3.20139'. [ 1290.342839][T15869] netlink: 199836 bytes leftover after parsing attributes in process `syz.2.20141'. [ 1291.500007][T15904] netlink: 199836 bytes leftover after parsing attributes in process `syz.2.20158'. [ 1292.456450][T15908] : renamed from veth1 (while UP) [ 1294.051326][T15952] netlink: 176 bytes leftover after parsing attributes in process `syz.3.20180'. [ 1294.299266][T15961] : renamed from veth1 (while UP) [ 1294.822112][T15977] netlink: 176 bytes leftover after parsing attributes in process `syz.2.20192'. [ 1295.668863][T16004] netlink: 176 bytes leftover after parsing attributes in process `syz.1.20202'. [ 1295.912442][ T9160] Bluetooth: hci0: unexpected event 0x03 length: 151 > 11 [ 1296.117062][T16016] syz.3.20207[16016] is installing a program with bpf_probe_write_user helper that may corrupt user memory! [ 1296.158969][T16016] syz.3.20207[16016] is installing a program with bpf_probe_write_user helper that may corrupt user memory! [ 1296.896876][T16032] netlink: 209852 bytes leftover after parsing attributes in process `syz.1.20215'. [ 1297.112923][T16036] netlink: 4083 bytes leftover after parsing attributes in process `syz.3.20216'. [ 1297.606745][ T9160] Bluetooth: hci3: unexpected event 0x03 length: 151 > 11 [ 1298.318856][ T9160] Bluetooth: hci2: unexpected event 0x03 length: 151 > 11 [ 1298.693402][T16071] netlink: 4083 bytes leftover after parsing attributes in process `syz.2.20232'. [ 1299.849234][T16104] netlink: 4083 bytes leftover after parsing attributes in process `syz.0.20245'. [ 1300.301227][T16114] netlink: 209852 bytes leftover after parsing attributes in process `syz.2.20253'. [ 1300.315256][T16114] sysfs: cannot create duplicate filename '/class/ieee80211/!!ô!' [ 1300.324718][T16114] CPU: 1 PID: 16114 Comm: syz.2.20253 Not tainted syzkaller #0 [ 1300.332354][T16114] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 1300.342591][T16114] Call Trace: [ 1300.345951][T16114] [ 1300.348967][T16114] dump_stack_lvl+0x18c/0x250 [ 1300.353748][T16114] ? show_regs_print_info+0x20/0x20 [ 1300.359041][T16114] ? load_image+0x420/0x420 [ 1300.363663][T16114] sysfs_warn_dup+0x8e/0xa0 [ 1300.368237][T16114] sysfs_do_create_link_sd+0xc0/0x110 [ 1300.373687][T16114] device_add_class_symlinks+0x1cf/0x240 [ 1300.379407][T16114] device_add+0x4f9/0xc40 [ 1300.383802][T16114] wiphy_register+0x1d99/0x2ac0 [ 1300.388772][T16114] ? cfg80211_event_work+0x40/0x40 [ 1300.393940][T16114] ? minstrel_ht_alloc+0x88a/0x990 [ 1300.399148][T16114] ? ieee80211_init_rate_ctrl_alg+0x562/0x5e0 [ 1300.405315][T16114] ieee80211_register_hw+0x2dd8/0x3b30 [ 1300.410888][T16114] ? ieee80211_register_hw+0xfb1/0x3b30 [ 1300.416528][T16114] ? ieee80211_tasklet_handler+0x20/0x20 [ 1300.422225][T16114] ? _raw_spin_unlock_irqrestore+0xc5/0x120 [ 1300.428205][T16114] ? __debug_object_init+0xec/0x450 [ 1300.433494][T16114] ? __asan_memset+0x22/0x40 [ 1300.438159][T16114] ? __hrtimer_init+0x189/0x270 [ 1300.443086][T16114] mac80211_hwsim_new_radio+0x2a75/0x4d70 [ 1300.448945][T16114] ? mac80211_hwsim_free+0x220/0x220 [ 1300.454283][T16114] ? rcu_is_watching+0x15/0xb0 [ 1300.459112][T16114] ? kstrndup+0xbd/0x140 [ 1300.463452][T16114] hwsim_new_radio_nl+0xdad/0x1a70 [ 1300.468661][T16114] ? __nla_validate+0x50/0x50 [ 1300.473538][T16114] ? hwsim_tx_info_frame_received_nl+0xce0/0xce0 [ 1300.479973][T16114] ? __nla_parse+0x40/0x50 [ 1300.484467][T16114] ? genl_family_rcv_msg_attrs_parse+0x1c6/0x290 [ 1300.490911][T16114] genl_family_rcv_msg_doit+0x21a/0x310 [ 1300.496579][T16114] ? genl_family_rcv_msg_dumpit+0x310/0x310 [ 1300.502574][T16114] ? bpf_lsm_capable+0x9/0x10 [ 1300.507351][T16114] ? security_capable+0x89/0xb0 [ 1300.512324][T16114] genl_rcv_msg+0x611/0x7a0 [ 1300.516975][T16114] ? genl_bind+0x360/0x360 [ 1300.521505][T16114] ? hwsim_tx_info_frame_received_nl+0xce0/0xce0 [ 1300.527918][T16114] ? perf_trace_lock+0x303/0x3b0 [ 1300.532958][T16114] netlink_rcv_skb+0x235/0x4c0 [ 1300.537921][T16114] ? genl_bind+0x360/0x360 [ 1300.542441][T16114] ? netlink_ack+0x1160/0x1160 [ 1300.547308][T16114] ? __lock_acquire+0x7d80/0x7d80 [ 1300.552485][T16114] ? down_read+0x1ac/0x2e0 [ 1300.556980][T16114] genl_rcv+0x28/0x40 [ 1300.561058][T16114] netlink_unicast+0x7b1/0x930 [ 1300.565936][T16114] netlink_sendmsg+0x8d0/0xbf0 [ 1300.570873][T16114] ? netlink_getsockopt+0x590/0x590 [ 1300.576162][T16114] ? apparmor_socket_sendmsg+0x8e/0x330 [ 1300.581786][T16114] ? bpf_lsm_socket_sendmsg+0x9/0x10 [ 1300.587130][T16114] ? security_socket_sendmsg+0x80/0xa0 [ 1300.592643][T16114] ? netlink_getsockopt+0x590/0x590 [ 1300.597912][T16114] ____sys_sendmsg+0x61b/0x980 [ 1300.602759][T16114] ? __asan_memset+0x22/0x40 [ 1300.607533][T16114] ? __sys_sendmsg_sock+0x30/0x30 [ 1300.612905][T16114] ? __import_iovec+0x5f2/0x850 [ 1300.617999][T16114] ? import_iovec+0x73/0xa0 [ 1300.622755][T16114] ___sys_sendmsg+0x2a6/0x360 [ 1300.627619][T16114] ? __sys_sendmsg+0x2b0/0x2b0 [ 1300.632657][T16114] __se_sys_sendmsg+0x1d0/0x2c0 [ 1300.637591][T16114] ? __x64_sys_sendmsg+0x80/0x80 [ 1300.642648][T16114] ? lockdep_hardirqs_on+0x98/0x150 [ 1300.647929][T16114] do_syscall_64+0x55/0xb0 [ 1300.652492][T16114] ? clear_bhb_loop+0x40/0x90 [ 1300.657236][T16114] ? clear_bhb_loop+0x40/0x90 [ 1300.661975][T16114] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 1300.667960][T16114] RIP: 0033:0x7f820e79e019 [ 1300.672452][T16114] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1300.692164][T16114] RSP: 002b:00007f820f6f0028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 1300.700645][T16114] RAX: ffffffffffffffda RBX: 00007f820ea25fa0 RCX: 00007f820e79e019 [ 1300.708672][T16114] RDX: 0000000000000000 RSI: 0000200000000000 RDI: 0000000000000005 [ 1300.716702][T16114] RBP: 00007f820e83500c R08: 0000000000000000 R09: 0000000000000000 [ 1300.724722][T16114] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 1300.732836][T16114] R13: 00007f820ea26038 R14: 00007f820ea25fa0 R15: 00007fffb4cc90b8 [ 1300.740915][T16114] [ 1300.830684][ T1292] ieee802154 phy0 wpan0: encryption failed: -22 [ 1300.844292][ T1292] ieee802154 phy1 wpan1: encryption failed: -22 [ 1301.136169][T16122] netlink: 9275 bytes leftover after parsing attributes in process `syz.1.20263'. [ 1301.459874][T16131] netlink: 'syz.1.20259': attribute type 29 has an invalid length. [ 1301.471287][T16131] netlink: 'syz.1.20259': attribute type 29 has an invalid length. [ 1301.481857][T16131] netlink: 'syz.1.20259': attribute type 29 has an invalid length. [ 1301.490459][T16131] netlink: 'syz.1.20259': attribute type 29 has an invalid length. [ 1301.499077][T16131] netlink: 'syz.1.20259': attribute type 29 has an invalid length. [ 1301.589543][T16133] netlink: 64535 bytes leftover after parsing attributes in process `syz.2.20261'. [ 1301.710280][T16141] netlink: 4083 bytes leftover after parsing attributes in process `syz.1.20260'. [ 1301.742153][T16143] netlink: 9275 bytes leftover after parsing attributes in process `syz.3.20265'. [ 1301.755205][T16145] syz.0.20262[16145] is installing a program with bpf_probe_write_user helper that may corrupt user memory! [ 1301.764117][T16145] syz.0.20262[16145] is installing a program with bpf_probe_write_user helper that may corrupt user memory! [ 1301.937706][T16150] netlink: 209852 bytes leftover after parsing attributes in process `syz.3.20266'. [ 1301.996302][T16150] sysfs: cannot create duplicate filename '/class/ieee80211/!!ô!' [ 1302.015461][T16150] CPU: 1 PID: 16150 Comm: syz.3.20266 Not tainted syzkaller #0 [ 1302.023230][T16150] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 1302.033410][T16150] Call Trace: [ 1302.036780][T16150] [ 1302.039809][T16150] dump_stack_lvl+0x18c/0x250 [ 1302.044622][T16150] ? show_regs_print_info+0x20/0x20 [ 1302.049953][T16150] ? load_image+0x420/0x420 [ 1302.054634][T16150] sysfs_warn_dup+0x8e/0xa0 [ 1302.059242][T16150] sysfs_do_create_link_sd+0xc0/0x110 [ 1302.064718][T16150] device_add_class_symlinks+0x1cf/0x240 [ 1302.070555][T16150] device_add+0x4f9/0xc40 [ 1302.074998][T16150] wiphy_register+0x1d99/0x2ac0 [ 1302.079995][T16150] ? cfg80211_event_work+0x40/0x40 [ 1302.085174][T16150] ? minstrel_ht_alloc+0x88a/0x990 [ 1302.090504][T16150] ? ieee80211_init_rate_ctrl_alg+0x562/0x5e0 [ 1302.096650][T16150] ieee80211_register_hw+0x2dd8/0x3b30 [ 1302.102206][T16150] ? ieee80211_register_hw+0xfb1/0x3b30 [ 1302.107854][T16150] ? ieee80211_tasklet_handler+0x20/0x20 [ 1302.113546][T16150] ? _raw_spin_unlock_irqrestore+0xc5/0x120 [ 1302.119519][T16150] ? __debug_object_init+0xec/0x450 [ 1302.124791][T16150] ? __asan_memset+0x22/0x40 [ 1302.129460][T16150] ? __hrtimer_init+0x189/0x270 [ 1302.134388][T16150] mac80211_hwsim_new_radio+0x2a75/0x4d70 [ 1302.140239][T16150] ? mac80211_hwsim_free+0x220/0x220 [ 1302.145600][T16150] ? rcu_is_watching+0x15/0xb0 [ 1302.150465][T16150] ? kstrndup+0xbd/0x140 [ 1302.154799][T16150] hwsim_new_radio_nl+0xdad/0x1a70 [ 1302.160083][T16150] ? __nla_validate+0x50/0x50 [ 1302.164866][T16150] ? hwsim_tx_info_frame_received_nl+0xce0/0xce0 [ 1302.171297][T16150] ? __nla_parse+0x40/0x50 [ 1302.175819][T16150] ? genl_family_rcv_msg_attrs_parse+0x1c6/0x290 [ 1302.182331][T16150] genl_family_rcv_msg_doit+0x21a/0x310 [ 1302.187967][T16150] ? genl_family_rcv_msg_dumpit+0x310/0x310 [ 1302.193951][T16150] ? bpf_lsm_capable+0x9/0x10 [ 1302.198696][T16150] ? security_capable+0x89/0xb0 [ 1302.203636][T16150] genl_rcv_msg+0x611/0x7a0 [ 1302.208220][T16150] ? genl_bind+0x360/0x360 [ 1302.212695][T16150] ? hwsim_tx_info_frame_received_nl+0xce0/0xce0 [ 1302.219081][T16150] ? perf_trace_lock+0x303/0x3b0 [ 1302.224195][T16150] netlink_rcv_skb+0x235/0x4c0 [ 1302.229035][T16150] ? genl_bind+0x360/0x360 [ 1302.233516][T16150] ? netlink_ack+0x1160/0x1160 [ 1302.238374][T16150] ? __lock_acquire+0x7d80/0x7d80 [ 1302.244180][T16150] ? down_read+0x1ac/0x2e0 [ 1302.248679][T16150] genl_rcv+0x28/0x40 [ 1302.252719][T16150] netlink_unicast+0x7b1/0x930 [ 1302.257589][T16150] netlink_sendmsg+0x8d0/0xbf0 [ 1302.262440][T16150] ? netlink_getsockopt+0x590/0x590 [ 1302.267704][T16150] ? apparmor_socket_sendmsg+0x8e/0x330 [ 1302.273328][T16150] ? bpf_lsm_socket_sendmsg+0x9/0x10 [ 1302.278681][T16150] ? security_socket_sendmsg+0x80/0xa0 [ 1302.284222][T16150] ? netlink_getsockopt+0x590/0x590 [ 1302.289494][T16150] ____sys_sendmsg+0x61b/0x980 [ 1302.294361][T16150] ? __asan_memset+0x22/0x40 [ 1302.299019][T16150] ? __sys_sendmsg_sock+0x30/0x30 [ 1302.304126][T16150] ? __import_iovec+0x5f2/0x850 [ 1302.309069][T16150] ? import_iovec+0x73/0xa0 [ 1302.313650][T16150] ___sys_sendmsg+0x2a6/0x360 [ 1302.318413][T16150] ? __sys_sendmsg+0x2b0/0x2b0 [ 1302.323384][T16150] __se_sys_sendmsg+0x1d0/0x2c0 [ 1302.328343][T16150] ? __x64_sys_sendmsg+0x80/0x80 [ 1302.333421][T16150] ? lockdep_hardirqs_on+0x98/0x150 [ 1302.338701][T16150] do_syscall_64+0x55/0xb0 [ 1302.343179][T16150] ? clear_bhb_loop+0x40/0x90 [ 1302.347913][T16150] ? clear_bhb_loop+0x40/0x90 [ 1302.352656][T16150] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 1302.358605][T16150] RIP: 0033:0x7fa644f9e019 [ 1302.363076][T16150] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1302.382869][T16150] RSP: 002b:00007fa645f45028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 1302.391384][T16150] RAX: ffffffffffffffda RBX: 00007fa645225fa0 RCX: 00007fa644f9e019 [ 1302.399418][T16150] RDX: 0000000000000000 RSI: 0000200000000000 RDI: 0000000000000005 [ 1302.407447][T16150] RBP: 00007fa64503500c R08: 0000000000000000 R09: 0000000000000000 [ 1302.415481][T16150] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 1302.423509][T16150] R13: 00007fa645226038 R14: 00007fa645225fa0 R15: 00007ffda246c098 [ 1302.431598][T16150] [ 1302.739926][T16156] netlink: 'syz.1.20277': attribute type 10 has an invalid length. [ 1302.786021][T16156] netlink: 209852 bytes leftover after parsing attributes in process `syz.1.20277'. [ 1302.982175][T16166] netlink: 64535 bytes leftover after parsing attributes in process `syz.0.20274'. [ 1303.086978][T16168] netlink: 9275 bytes leftover after parsing attributes in process `syz.2.20276'. [ 1303.172163][T16174] netlink: 12 bytes leftover after parsing attributes in process `syz.1.20280'. [ 1303.313966][T16182] netlink: 'syz.1.20283': attribute type 33 has an invalid length. [ 1303.335537][T16182] netlink: 128 bytes leftover after parsing attributes in process `syz.1.20283'. [ 1303.476996][T16186] netlink: 'syz.3.20285': attribute type 10 has an invalid length. [ 1303.502517][T16186] netlink: 209852 bytes leftover after parsing attributes in process `syz.3.20285'. [ 1303.677484][T16195] netlink: 64535 bytes leftover after parsing attributes in process `syz.1.20288'. [ 1303.733444][T16198] netlink: 12 bytes leftover after parsing attributes in process `syz.3.20291'. [ 1304.010288][T16212] netlink: 'syz.2.20298': attribute type 33 has an invalid length. [ 1304.024430][T16212] netlink: 128 bytes leftover after parsing attributes in process `syz.2.20298'. [ 1304.190231][T16215] netlink: 'syz.0.20299': attribute type 10 has an invalid length. [ 1309.294517][T16320] validate_nla: 7 callbacks suppressed [ 1309.294536][T16320] netlink: 'syz.2.20344': attribute type 29 has an invalid length. [ 1309.312196][T16320] netlink: 'syz.2.20344': attribute type 29 has an invalid length. [ 1309.348647][T16320] netlink: 'syz.2.20344': attribute type 29 has an invalid length. [ 1309.375611][T16320] netlink: 'syz.2.20344': attribute type 29 has an invalid length. [ 1309.404694][T16320] netlink: 'syz.2.20344': attribute type 29 has an invalid length. [ 1310.052513][T16355] netlink: 'syz.0.20361': attribute type 29 has an invalid length. [ 1310.061376][T16355] netlink: 'syz.0.20361': attribute type 29 has an invalid length. [ 1310.078833][T16355] netlink: 'syz.0.20361': attribute type 29 has an invalid length. [ 1310.092346][T16355] netlink: 'syz.0.20361': attribute type 29 has an invalid length. [ 1310.102118][T16355] netlink: 'syz.0.20361': attribute type 29 has an invalid length. [ 1313.950232][T16396] __nla_validate_parse: 3 callbacks suppressed [ 1313.950254][T16396] netlink: 209852 bytes leftover after parsing attributes in process `syz.3.20380'. [ 1314.596360][T16418] netlink: 12 bytes leftover after parsing attributes in process `syz.1.20391'. [ 1314.722877][T16424] netlink: 55631 bytes leftover after parsing attributes in process `syz.0.20394'. [ 1314.733504][T16424] netlink: 6320 bytes leftover after parsing attributes in process `syz.0.20394'. [ 1314.752840][T16424] tc_dump_action: action bad kind [ 1315.270161][ T9160] Bluetooth: hci2: unexpected event 0x2c length: 151 > 17 [ 1315.418327][T16453] netlink: 8 bytes leftover after parsing attributes in process `syz.3.20408'. [ 1315.494060][T16457] netlink: 'syz.0.20409': attribute type 3 has an invalid length. [ 1315.514553][T16457] netlink: 'syz.0.20409': attribute type 6 has an invalid length. [ 1315.536103][T16457] netlink: 144448 bytes leftover after parsing attributes in process `syz.0.20409'. [ 1316.894581][T16471] netlink: 'syz.3.20416': attribute type 46 has an invalid length. [ 1316.935884][T16471] netlink: 55 bytes leftover after parsing attributes in process `syz.3.20416'. [ 1317.465248][T16483] netlink: 'syz.1.20421': attribute type 3 has an invalid length. [ 1317.484230][T16483] netlink: 'syz.1.20421': attribute type 6 has an invalid length. [ 1317.501482][T16483] netlink: 144448 bytes leftover after parsing attributes in process `syz.1.20421'. [ 1317.903605][T16499] netlink: 'syz.2.20429': attribute type 46 has an invalid length. [ 1317.915680][T16499] netlink: 55 bytes leftover after parsing attributes in process `syz.2.20429'. [ 1318.161586][T16507] netlink: 'syz.0.20440': attribute type 46 has an invalid length. [ 1318.185422][T16507] netlink: 55 bytes leftover after parsing attributes in process `syz.0.20440'. [ 1318.458129][T16514] netlink: 'syz.2.20435': attribute type 3 has an invalid length. [ 1318.478985][T16514] netlink: 'syz.2.20435': attribute type 6 has an invalid length. [ 1318.977334][T16535] __nla_validate_parse: 1 callbacks suppressed [ 1318.977354][T16535] netlink: 55631 bytes leftover after parsing attributes in process `syz.3.20446'. [ 1319.013584][T16535] netlink: 6320 bytes leftover after parsing attributes in process `syz.3.20446'. [ 1319.033310][T16535] tc_dump_action: action bad kind [ 1319.349436][T16549] netlink: 12 bytes leftover after parsing attributes in process `syz.3.20451'. [ 1319.865048][T16565] netlink: 55631 bytes leftover after parsing attributes in process `syz.2.20459'. [ 1319.892354][T16565] netlink: 6320 bytes leftover after parsing attributes in process `syz.2.20459'. [ 1319.928869][T16565] tc_dump_action: action bad kind [ 1320.173968][T16574] netlink: 12 bytes leftover after parsing attributes in process `syz.2.20465'. [ 1321.298834][T16601] pim6reg1: entered promiscuous mode [ 1321.304223][T16601] pim6reg1: entered allmulticast mode [ 1321.445560][T16604] netlink: 209852 bytes leftover after parsing attributes in process `syz.0.20484'. [ 1322.121903][T16620] netlink: 'syz.0.20491': attribute type 21 has an invalid length. [ 1322.144458][T16620] netlink: 'syz.0.20491': attribute type 6 has an invalid length. [ 1322.170677][T16620] netlink: 132 bytes leftover after parsing attributes in process `syz.0.20491'. [ 1324.094251][T16649] netlink: 'syz.1.20496': attribute type 21 has an invalid length. [ 1324.118106][T16649] netlink: 'syz.1.20496': attribute type 6 has an invalid length. [ 1324.128231][T16649] netlink: 132 bytes leftover after parsing attributes in process `syz.1.20496'. [ 1325.917686][T16686] netlink: 9275 bytes leftover after parsing attributes in process `syz.2.20514'. [ 1327.579461][T16709] netlink: 9275 bytes leftover after parsing attributes in process `syz.0.20525'. [ 1328.695818][T16741] netlink: 'syz.0.20542': attribute type 39 has an invalid length. [ 1329.819937][T16767] netlink: 'syz.3.20553': attribute type 39 has an invalid length. [ 1331.147941][T16795] netlink: 'syz.2.20568': attribute type 39 has an invalid length. [ 1332.531532][T16829] netlink: 40227 bytes leftover after parsing attributes in process `syz.0.20584'. [ 1333.269586][T16851] netlink: 40227 bytes leftover after parsing attributes in process `syz.1.20594'. [ 1333.581372][T16860] netlink: 'syz.1.20598': attribute type 10 has an invalid length. [ 1333.589536][T16860] netlink: 'syz.1.20598': attribute type 4 has an invalid length. [ 1333.597909][T16860] netlink: 116 bytes leftover after parsing attributes in process `syz.1.20598'. [ 1333.926300][T16868] netlink: 61211 bytes leftover after parsing attributes in process `syz.2.20602'. [ 1334.589655][T16896] netlink: 61211 bytes leftover after parsing attributes in process `syz.3.20613'. [ 1334.699101][T16900] netlink: 152 bytes leftover after parsing attributes in process `syz.2.20618'. [ 1337.928439][T16982] netlink: 'syz.2.20653': attribute type 19 has an invalid length. [ 1337.941450][T16982] netlink: 156 bytes leftover after parsing attributes in process `syz.2.20653'. [ 1337.977392][T16983] netlink: 152 bytes leftover after parsing attributes in process `syz.1.20652'. [ 1338.123546][T16989] netlink: 64 bytes leftover after parsing attributes in process `syz.2.20656'. [ 1340.683227][T17035] netlink: 'syz.1.20675': attribute type 3 has an invalid length. [ 1340.692984][T17035] netlink: 'syz.1.20675': attribute type 4 has an invalid length. [ 1340.703656][T17035] netlink: 'syz.1.20675': attribute type 7 has an invalid length. [ 1340.711976][T17035] netlink: 'syz.1.20675': attribute type 8 has an invalid length. [ 1340.720268][T17035] netlink: 'syz.1.20675': attribute type 7 has an invalid length. [ 1340.728570][T17035] netlink: 198048 bytes leftover after parsing attributes in process `syz.1.20675'. [ 1341.398237][T17063] netlink: 'syz.3.20688': attribute type 3 has an invalid length. [ 1341.445015][T17063] netlink: 'syz.3.20688': attribute type 4 has an invalid length. [ 1341.472018][T17063] netlink: 'syz.3.20688': attribute type 7 has an invalid length. [ 1341.491541][T17063] netlink: 'syz.3.20688': attribute type 8 has an invalid length. [ 1341.511860][T17063] netlink: 198048 bytes leftover after parsing attributes in process `syz.3.20688'. [ 1342.451103][T17082] netlink: 198048 bytes leftover after parsing attributes in process `syz.2.20700'. [ 1349.806720][T17174] netlink: 60 bytes leftover after parsing attributes in process `syz.3.20739'. [ 1355.730279][T17216] netlink: 60 bytes leftover after parsing attributes in process `syz.0.20758'. [ 1356.863751][T17243] netlink: 4595 bytes leftover after parsing attributes in process `syz.3.20770'. [ 1359.685753][T17243] netlink: 4595 bytes leftover after parsing attributes in process `syz.3.20770'. [ 1362.059465][ T1292] ieee802154 phy0 wpan0: encryption failed: -22 [ 1362.065908][ T1292] ieee802154 phy1 wpan1: encryption failed: -22 [ 1368.106228][T17318] netlink: 208064 bytes leftover after parsing attributes in process `syz.2.20805'. [ 1368.120595][T17318] validate_nla: 6 callbacks suppressed [ 1368.120612][T17318] netlink: 'syz.2.20805': attribute type 1 has an invalid length. [ 1368.229565][T17320] netlink: 'syz.1.20806': attribute type 17 has an invalid length. [ 1369.647000][T17339] netlink: 15478 bytes leftover after parsing attributes in process `syz.3.20812'. [ 1370.083351][T17346] netlink: 208064 bytes leftover after parsing attributes in process `syz.3.20816'. [ 1370.125368][T17346] netlink: 'syz.3.20816': attribute type 1 has an invalid length. [ 1370.561894][T17357] netlink: 144 bytes leftover after parsing attributes in process `syz.3.20822'. [ 1370.897845][T17371] netlink: 208064 bytes leftover after parsing attributes in process `syz.0.20829'. [ 1370.925403][T17371] netlink: 'syz.0.20829': attribute type 1 has an invalid length. [ 1371.536395][T17389] netlink: 'syz.1.20836': attribute type 21 has an invalid length. [ 1371.544395][T17389] netlink: 'syz.1.20836': attribute type 1 has an invalid length. [ 1371.592773][T17389] netlink: 16090 bytes leftover after parsing attributes in process `syz.1.20836'. [ 1374.050027][T17395] netlink: 4595 bytes leftover after parsing attributes in process `syz.1.20839'. [ 1374.065452][T17395] netlink: 4595 bytes leftover after parsing attributes in process `syz.1.20839'. [ 1374.087882][T17395] netlink: 4595 bytes leftover after parsing attributes in process `syz.1.20839'. [ 1374.242407][T17404] netlink: 208064 bytes leftover after parsing attributes in process `syz.1.20840'. [ 1374.334308][T17404] netlink: 'syz.1.20840': attribute type 1 has an invalid length. [ 1374.529548][T17414] netlink: 14 bytes leftover after parsing attributes in process `syz.3.20845'. [ 1374.565707][T17414] netlink: get zone limit has 4 unknown bytes [ 1374.971566][T17433] netlink: 'syz.3.20856': attribute type 2 has an invalid length. [ 1374.999694][T17433] netlink: 1045 bytes leftover after parsing attributes in process `syz.3.20856'. [ 1375.144286][ T6325] netdevsim netdevsim0 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1375.249029][ T6325] netdevsim netdevsim0 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1375.394201][ T6325] netdevsim netdevsim0 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1375.447929][T17441] netlink: 14 bytes leftover after parsing attributes in process `syz.2.20859'. [ 1375.521738][T17441] netlink: get zone limit has 4 unknown bytes [ 1375.591005][ T6325] netdevsim netdevsim0 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1375.638211][T17444] cgroup: fork rejected by pids controller in /syz3 [ 1375.916797][T17450] netlink: 14 bytes leftover after parsing attributes in process `syz.1.20871'. [ 1375.961414][T17450] netlink: get zone limit has 4 unknown bytes [ 1376.127687][ T5787] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 1376.137981][ T5787] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 1376.154380][ T5787] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 1376.164680][ T5787] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 1376.203901][ T5787] Bluetooth: hci1: unexpected cc 0x0c25 length: 249 > 3 [ 1376.218245][ T5787] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 1376.907211][T17454] chnl_net:caif_netlink_parms(): no params data found [ 1377.102659][T17454] bridge0: port 1(bridge_slave_0) entered blocking state [ 1377.110387][T17454] bridge0: port 1(bridge_slave_0) entered disabled state [ 1377.117893][T17454] bridge_slave_0: entered allmulticast mode [ 1377.126165][T17454] bridge_slave_0: entered promiscuous mode [ 1377.136155][T17454] bridge0: port 2(bridge_slave_1) entered blocking state [ 1377.143516][T17454] bridge0: port 2(bridge_slave_1) entered disabled state [ 1377.151322][T17454] bridge_slave_1: entered allmulticast mode [ 1377.159052][T17454] bridge_slave_1: entered promiscuous mode [ 1377.213838][T17454] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 1377.248164][T17454] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 1377.284388][T17454] team0: Port device team_slave_0 added [ 1377.293815][T17454] team0: Port device team_slave_1 added [ 1377.373760][T17454] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 1377.390643][T17454] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 1377.423210][T17454] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 1377.450629][T17454] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 1377.457826][T17454] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 1377.484829][T17454] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 1377.624026][ T6325] hsr_slave_0: left promiscuous mode [ 1377.657869][ T6325] hsr_slave_1: left promiscuous mode [ 1377.664237][ T6325] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 1377.685412][ T6325] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 1377.696200][ T6325] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 1377.703785][ T6325] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 1377.726486][ T6325] bridge_slave_1: left allmulticast mode [ 1377.732320][ T6325] bridge_slave_1: left promiscuous mode [ 1377.741984][ T6325] bridge0: port 2(bridge_slave_1) entered disabled state [ 1377.758203][ T6325] bridge_slave_0: left allmulticast mode [ 1377.763968][ T6325] bridge_slave_0: left promiscuous mode [ 1377.785693][ T6325] bridge0: port 1(bridge_slave_0) entered disabled state [ 1377.849698][ T6325] veth1_macvtap: left promiscuous mode [ 1377.859791][ T6325] veth0_macvtap: left promiscuous mode [ 1377.866185][ T6325] veth1_vlan: left promiscuous mode [ 1377.871952][ T6325] veth0_vlan: left promiscuous mode [ 1378.303916][ T9160] Bluetooth: hci1: command tx timeout [ 1378.741707][ T6325] team0 (unregistering): Port device team_slave_1 removed [ 1378.792402][ T6325] team0 (unregistering): Port device C removed [ 1378.840087][ T6325] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 1378.890128][ T6325] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 1379.251912][ T6325] bond0 (unregistering): Released all slaves [ 1379.358322][T17454] hsr_slave_0: entered promiscuous mode [ 1379.364782][T17454] hsr_slave_1: entered promiscuous mode [ 1379.371345][T17454] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 1379.379058][T17454] Cannot create hsr debugfs directory [ 1380.333703][T17454] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 1380.344859][T17454] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 1380.359173][T17454] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 1380.374629][T17454] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 1380.376109][ T9160] Bluetooth: hci1: command tx timeout [ 1380.644514][T17454] 8021q: adding VLAN 0 to HW filter on device bond0 [ 1380.673272][T17454] 8021q: adding VLAN 0 to HW filter on device team0 [ 1380.713738][ T6325] bridge0: port 1(bridge_slave_0) entered blocking state [ 1380.721106][ T6325] bridge0: port 1(bridge_slave_0) entered forwarding state [ 1380.761676][ T6325] bridge0: port 2(bridge_slave_1) entered blocking state [ 1380.768951][ T6325] bridge0: port 2(bridge_slave_1) entered forwarding state [ 1381.122815][T17454] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 1381.253890][T17454] veth0_vlan: entered promiscuous mode [ 1381.270749][T17454] veth1_vlan: entered promiscuous mode [ 1381.334742][T17454] veth0_macvtap: entered promiscuous mode [ 1381.365116][T17454] veth1_macvtap: entered promiscuous mode [ 1381.412291][T17454] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 1381.436559][T17454] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1381.446699][T17454] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 1381.457176][T17454] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1381.469669][T17454] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 1381.493561][T17454] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: €Â0 [ 1381.504571][T17454] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1381.521318][T17454] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 1381.531946][T17454] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1381.543991][T17454] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 1381.578680][T17454] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 1381.589546][T17454] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 1381.598476][T17454] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 1381.609020][T17454] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 1381.818953][ T9254] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1381.839527][ T9254] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1381.902004][ T11] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1381.917784][ T11] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1382.199340][T17540] pim6reg1: entered promiscuous mode [ 1382.215060][T17540] pim6reg1: entered allmulticast mode [ 1382.455547][ T9160] Bluetooth: hci1: command tx timeout [ 1382.555935][T17547] cgroup: fork rejected by pids controller in /syz2 [ 1382.878478][ T5787] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 1382.898708][ T5787] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 1382.907248][ T5787] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 1382.928527][ T5787] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 1382.943532][ T5787] Bluetooth: hci0: unexpected cc 0x0c25 length: 249 > 3 [ 1382.951781][ T5787] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 1383.111805][ T6315] : left promiscuous mode [ 1383.125643][ T6315] bridge0: port 1(30) entered disabled state [ 1383.136030][T17565] netlink: 'syz.0.20877': attribute type 2 has an invalid length. [ 1383.143969][T17565] netlink: 1045 bytes leftover after parsing attributes in process `syz.0.20877'. [ 1383.258992][ T6315] veth1_macvtap: left promiscuous mode [ 1383.268333][ T6315] veth0_macvtap: left promiscuous mode [ 1383.309483][T17570] hsr_slave_0: hsr_addr_subst_dest: Unknown node [ 1383.317018][T17570] hsr_slave_1: hsr_addr_subst_dest: Unknown node [ 1384.149739][ T6315] bond0 (unregistering): (slave 4@0Ù): Releasing backup interface [ 1384.220309][ T6315] bond0 (unregistering): (slave bridge_slave_1): Releasing backup interface [ 1384.545641][ T9160] Bluetooth: hci1: command tx timeout [ 1384.592315][ T6315] bond0 (unregistering): (slave bridge0): Releasing backup interface [ 1384.601744][ T6315] bond0 (unregistering): Released all slaves [ 1385.015425][ T9160] Bluetooth: hci0: command tx timeout [ 1385.361758][T17557] chnl_net:caif_netlink_parms(): no params data found [ 1385.730963][ T6315] netdevsim netdevsim2 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1385.878046][T17632] netlink: 'syz.0.20886': attribute type 21 has an invalid length. [ 1385.886508][T17632] netlink: 'syz.0.20886': attribute type 1 has an invalid length. [ 1385.894501][T17632] netlink: 16090 bytes leftover after parsing attributes in process `syz.0.20886'. [ 1385.961124][T17557] bridge0: port 1(bridge_slave_0) entered blocking state [ 1385.980135][T17557] bridge0: port 1(bridge_slave_0) entered disabled state [ 1386.003202][T17557] bridge_slave_0: entered allmulticast mode [ 1386.011293][T17557] bridge_slave_0: entered promiscuous mode [ 1386.060356][ T6315] netdevsim netdevsim2 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1386.095130][T17557] bridge0: port 2(bridge_slave_1) entered blocking state [ 1386.119178][T17557] bridge0: port 2(bridge_slave_1) entered disabled state [ 1386.139808][T17557] bridge_slave_1: entered allmulticast mode [ 1386.151631][T17557] bridge_slave_1: entered promiscuous mode [ 1386.184743][ T5787] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 1386.194861][ T5787] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 1386.205054][ T5787] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 1386.213610][ T5787] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 1386.232407][ T5787] Bluetooth: hci2: unexpected cc 0x0c25 length: 249 > 3 [ 1386.240125][ T5787] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 1386.260422][ T6315] netdevsim netdevsim2 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1386.457303][ T6315] netdevsim netdevsim2 ÿÿÿÿÿÿ (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1386.506977][T17557] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 1386.539225][T17557] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 1386.644762][T17557] team0: Port device team_slave_0 added [ 1386.673335][T17557] team0: Port device team_slave_1 added [ 1386.770975][T17646] hsr_slave_0: hsr_addr_subst_dest: Unknown node [ 1386.777890][T17646] hsr_slave_1: hsr_addr_subst_dest: Unknown node [ 1386.793069][T17557] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 1386.818820][T17557] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 1386.856467][T17557] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 1386.919680][T17557] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 1386.945219][T17557] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 1386.977611][T17557] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 1387.105208][ T9160] Bluetooth: hci0: command tx timeout [ 1387.229287][T17557] hsr_slave_0: entered promiscuous mode [ 1387.237154][T17557] hsr_slave_1: entered promiscuous mode [ 1387.243724][T17557] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 1387.251898][T17557] Cannot create hsr debugfs directory [ 1387.461601][ T5787] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 1387.484380][ T5787] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 1387.492948][ T5787] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 1387.517623][ T5787] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 1387.532902][ T5787] Bluetooth: hci3: unexpected cc 0x0c25 length: 249 > 3 [ 1387.541083][ T5787] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 1387.852167][T17634] chnl_net:caif_netlink_parms(): no params data found [ 1388.280054][T17634] bridge0: port 1(bridge_slave_0) entered blocking state [ 1388.297330][T17634] bridge0: port 1(bridge_slave_0) entered disabled state [ 1388.304663][T17634] bridge_slave_0: entered allmulticast mode [ 1388.312691][T17634] bridge_slave_0: entered promiscuous mode [ 1388.341271][T17634] bridge0: port 2(bridge_slave_1) entered blocking state [ 1388.370355][T17634] bridge0: port 2(bridge_slave_1) entered disabled state [ 1388.385800][ T9160] Bluetooth: hci2: command tx timeout [ 1388.387865][T17634] bridge_slave_1: entered allmulticast mode [ 1388.402052][T17634] bridge_slave_1: entered promiscuous mode [ 1388.583596][T17634] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 1388.598786][T17634] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 1388.627850][T17557] netdevsim netdevsim3 netdevsim0: renamed from eth0 [ 1388.652964][T17557] netdevsim netdevsim3 netdevsim1: renamed from eth1 [ 1388.690487][T17557] netdevsim netdevsim3 netdevsim2: renamed from eth2 [ 1388.707556][T17557] netdevsim netdevsim3 netdevsim3: renamed from eth3 [ 1388.723200][T17634] team0: Port device team_slave_0 added [ 1388.762926][T17655] chnl_net:caif_netlink_parms(): no params data found [ 1388.790415][T17634] team0: Port device team_slave_1 added [ 1388.879984][T17634] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 1388.887126][T17634] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 1388.914070][T17634] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 1388.948083][T17634] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 1388.955121][T17634] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 1388.981975][T17634] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 1389.112803][T17655] bridge0: port 1(bridge_slave_0) entered blocking state [ 1389.125537][T17655] bridge0: port 1(bridge_slave_0) entered disabled state [ 1389.132864][T17655] bridge_slave_0: entered allmulticast mode [ 1389.140753][T17655] bridge_slave_0: entered promiscuous mode [ 1389.151029][T17655] bridge0: port 2(bridge_slave_1) entered blocking state [ 1389.158424][T17655] bridge0: port 2(bridge_slave_1) entered disabled state [ 1389.165825][T17655] bridge_slave_1: entered allmulticast mode [ 1389.173117][T17655] bridge_slave_1: entered promiscuous mode [ 1389.179097][ T9160] Bluetooth: hci0: command tx timeout [ 1389.226262][T17634] hsr_slave_0: entered promiscuous mode [ 1389.233237][T17634] hsr_slave_1: entered promiscuous mode [ 1389.240505][T17634] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 1389.249010][T17634] Cannot create hsr debugfs directory [ 1389.269525][T17655] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 1389.282313][T17655] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 1389.343765][T17655] team0: Port device team_slave_0 added [ 1389.377006][T17655] team0: Port device team_slave_1 added [ 1389.469982][T17655] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 1389.477097][T17655] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 1389.504556][T17655] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 1389.522028][T17655] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 1389.531294][T17655] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 1389.557993][T17655] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 1389.575704][ T9160] Bluetooth: hci3: command tx timeout [ 1389.732762][T17655] hsr_slave_0: entered promiscuous mode [ 1389.746074][T17655] hsr_slave_1: entered promiscuous mode [ 1389.752948][T17655] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 1389.775440][T17655] Cannot create hsr debugfs directory [ 1389.928359][T17557] 8021q: adding VLAN 0 to HW filter on device bond0 [ 1390.010181][ T6315] [ 1390.012601][ T6315] ====================================================== [ 1390.019750][ T6315] WARNING: possible circular locking dependency detected [ 1390.026812][ T6315] syzkaller #0 Not tainted [ 1390.031377][ T6315] ------------------------------------------------------ [ 1390.038445][ T6315] kworker/u4:14/6315 is trying to acquire lock: [ 1390.044704][ T6315] ffff88806095cd80 (team->team_lock_key#2){+.+.}-{3:3}, at: team_del_slave+0x31/0x1b0 [ 1390.054362][ T6315] [ 1390.054362][ T6315] but task is already holding lock: [ 1390.061837][ T6315] ffff88801b2f0768 (&rdev->wiphy.mtx){+.+.}-{3:3}, at: ieee80211_remove_interfaces+0x2bd/0x690 [ 1390.072230][ T6315] [ 1390.072230][ T6315] which lock already depends on the new lock. [ 1390.072230][ T6315] [ 1390.082651][ T6315] [ 1390.082651][ T6315] the existing dependency chain (in reverse order) is: [ 1390.091685][ T6315] [ 1390.091685][ T6315] -> #1 (&rdev->wiphy.mtx){+.+.}-{3:3}: [ 1390.099439][ T6315] __mutex_lock+0x135/0xc80 [ 1390.104499][ T6315] ieee80211_open+0x144/0x200 [ 1390.109727][ T6315] __dev_open+0x2cb/0x430 [ 1390.114699][ T6315] dev_open+0xab/0x190 [ 1390.119316][ T6315] team_add_slave+0x703/0x28a0 [ 1390.124635][ T6315] do_setlink+0xcde/0x3f40 [ 1390.129681][ T6315] rtnl_newlink+0x1848/0x2170 [ 1390.134922][ T6315] rtnetlink_rcv_msg+0x843/0xf90 [ 1390.140432][ T6315] netlink_rcv_skb+0x235/0x4c0 [ 1390.145798][ T6315] netlink_unicast+0x7b1/0x930 [ 1390.151126][ T6315] netlink_sendmsg+0x8d0/0xbf0 [ 1390.156550][ T6315] ____sys_sendmsg+0x61b/0x980 [ 1390.161873][ T6315] ___sys_sendmsg+0x2a6/0x360 [ 1390.167097][ T6315] __se_sys_sendmsg+0x1d0/0x2c0 [ 1390.172494][ T6315] do_syscall_64+0x55/0xb0 [ 1390.177981][ T6315] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 1390.184445][ T6315] [ 1390.184445][ T6315] -> #0 (team->team_lock_key#2){+.+.}-{3:3}: [ 1390.192762][ T6315] __lock_acquire+0x37ef/0x7d80 [ 1390.198164][ T6315] lock_acquire+0x19e/0x420 [ 1390.203223][ T6315] __mutex_lock+0x135/0xc80 [ 1390.208279][ T6315] team_del_slave+0x31/0x1b0 [ 1390.213425][ T6315] team_device_event+0x297/0xa30 [ 1390.218923][ T6315] notifier_call_chain+0x18f/0x380 [ 1390.224620][ T6315] unregister_netdevice_many_notify+0x1037/0x1910 [ 1390.231584][ T6315] unregister_netdevice_queue+0x2e9/0x330 [ 1390.238023][ T6315] _cfg80211_unregister_wdev+0x16d/0x580 [ 1390.244245][ T6315] ieee80211_remove_interfaces+0x4b3/0x690 [ 1390.250605][ T6315] ieee80211_unregister_hw+0x5d/0x2a0 [ 1390.256531][ T6315] mac80211_hwsim_del_radio+0x289/0x480 [ 1390.262652][ T6315] hwsim_exit_net+0x58d/0x650 [ 1390.267881][ T6315] cleanup_net+0x707/0xbb0 [ 1390.272845][ T6315] process_scheduled_works+0xa60/0x1600 [ 1390.278938][ T6315] worker_thread+0xa5e/0xfe0 [ 1390.284345][ T6315] kthread+0x2fa/0x390 [ 1390.288957][ T6315] ret_from_fork+0x48/0x80 [ 1390.293954][ T6315] ret_from_fork_asm+0x11/0x20 [ 1390.299290][ T6315] [ 1390.299290][ T6315] other info that might help us debug this: [ 1390.299290][ T6315] [ 1390.309547][ T6315] Possible unsafe locking scenario: [ 1390.309547][ T6315] [ 1390.317018][ T6315] CPU0 CPU1 [ 1390.322404][ T6315] ---- ---- [ 1390.327787][ T6315] lock(&rdev->wiphy.mtx); [ 1390.332318][ T6315] lock(team->team_lock_key#2); [ 1390.339807][ T6315] lock(&rdev->wiphy.mtx); [ 1390.346862][ T6315] lock(team->team_lock_key#2); [ 1390.351948][ T6315] [ 1390.351948][ T6315] *** DEADLOCK *** [ 1390.351948][ T6315] [ 1390.360114][ T6315] 5 locks held by kworker/u4:14/6315: [ 1390.365506][ T6315] #0: ffff88801a25d138 ((wq_completion)netns){+.+.}-{0:0}, at: process_scheduled_works+0x975/0x1600 [ 1390.376434][ T6315] #1: ffffc9000f80fd00 (net_cleanup_work){+.+.}-{0:0}, at: process_scheduled_works+0x975/0x1600 [ 1390.387031][ T6315] #2: ffffffff8e3ca0d0 (pernet_ops_rwsem){++++}-{3:3}, at: cleanup_net+0x14c/0xbb0 [ 1390.396548][ T6315] #3: ffffffff8e3d70c8 (rtnl_mutex){+.+.}-{3:3}, at: ieee80211_unregister_hw+0x55/0x2a0 [ 1390.406421][ T6315] #4: ffff88801b2f0768 (&rdev->wiphy.mtx){+.+.}-{3:3}, at: ieee80211_remove_interfaces+0x2bd/0x690 [ 1390.417247][ T6315] [ 1390.417247][ T6315] stack backtrace: [ 1390.423161][ T6315] CPU: 1 PID: 6315 Comm: kworker/u4:14 Not tainted syzkaller #0 [ 1390.430826][ T6315] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 1390.440929][ T6315] Workqueue: netns cleanup_net [ 1390.445732][ T6315] Call Trace: [ 1390.449038][ T6315] [ 1390.452000][ T6315] dump_stack_lvl+0x18c/0x250 [ 1390.456709][ T6315] ? load_image+0x420/0x420 [ 1390.461250][ T6315] ? show_regs_print_info+0x20/0x20 [ 1390.466490][ T6315] ? print_circular_bug+0x12b/0x1a0 [ 1390.471724][ T6315] check_noncircular+0x2fc/0x400 [ 1390.476699][ T6315] ? print_deadlock_bug+0x5d0/0x5d0 [ 1390.481952][ T6315] ? lockdep_lock+0xf5/0x230 [ 1390.486571][ T6315] ? _find_first_zero_bit+0xd6/0x100 [ 1390.491927][ T6315] __lock_acquire+0x37ef/0x7d80 [ 1390.496825][ T6315] ? verify_lock_unused+0x140/0x140 [ 1390.502053][ T6315] ? verify_lock_unused+0x140/0x140 [ 1390.507314][ T6315] ? __up_read+0x2b8/0x6b0 [ 1390.511858][ T6315] lock_acquire+0x19e/0x420 [ 1390.516403][ T6315] ? team_del_slave+0x31/0x1b0 [ 1390.521291][ T6315] ? __might_sleep+0xe0/0xe0 [ 1390.525916][ T6315] ? read_lock_is_recursive+0x20/0x20 [ 1390.531417][ T6315] __mutex_lock+0x135/0xc80 [ 1390.535981][ T6315] ? team_del_slave+0x31/0x1b0 [ 1390.540792][ T6315] ? __mutex_lock+0x30d/0xc80 [ 1390.545504][ T6315] ? team_del_slave+0x31/0x1b0 [ 1390.550331][ T6315] ? mutex_lock_nested+0x20/0x20 [ 1390.555301][ T6315] ? __mutex_unlock_slowpath+0x1b4/0x6c0 [ 1390.560979][ T6315] team_del_slave+0x31/0x1b0 [ 1390.565625][ T6315] team_device_event+0x297/0xa30 [ 1390.570644][ T6315] notifier_call_chain+0x18f/0x380 [ 1390.575793][ T6315] unregister_netdevice_many_notify+0x1037/0x1910 [ 1390.582248][ T6315] ? unregister_netdevice_many+0x20/0x20 [ 1390.587923][ T6315] ? kernfs_remove_by_name_ns+0x117/0x150 [ 1390.593695][ T6315] ? __lock_acquire+0x7d80/0x7d80 [ 1390.598779][ T6315] unregister_netdevice_queue+0x2e9/0x330 [ 1390.604541][ T6315] ? list_netdevice+0x730/0x730 [ 1390.609450][ T6315] ? kernfs_remove_by_name_ns+0x117/0x150 [ 1390.615223][ T6315] _cfg80211_unregister_wdev+0x16d/0x580 [ 1390.620966][ T6315] ieee80211_remove_interfaces+0x4b3/0x690 [ 1390.626839][ T6315] ? ieee80211_do_stop+0x2000/0x2000 [ 1390.632158][ T6315] ? rcu_is_watching+0x15/0xb0 [ 1390.636990][ T6315] ieee80211_unregister_hw+0x5d/0x2a0 [ 1390.642397][ T6315] mac80211_hwsim_del_radio+0x289/0x480 [ 1390.647973][ T6315] ? rhashtable_remove_fast+0xc00/0xc00 [ 1390.653554][ T6315] hwsim_exit_net+0x58d/0x650 [ 1390.658268][ T6315] ? hwsim_init_net+0x90/0x90 [ 1390.662978][ T6315] ? __ip_vs_dev_cleanup_batch+0x238/0x250 [ 1390.668931][ T6315] cleanup_net+0x707/0xbb0 [ 1390.673378][ T6315] ? ops_free_list+0x3b0/0x3b0 [ 1390.678169][ T6315] ? _raw_spin_unlock_irq+0x23/0x50 [ 1390.683412][ T6315] ? process_scheduled_works+0x975/0x1600 [ 1390.689162][ T6315] ? process_scheduled_works+0x975/0x1600 [ 1390.694914][ T6315] process_scheduled_works+0xa60/0x1600 [ 1390.700500][ T6315] ? worker_attach_to_pool+0x370/0x370 [ 1390.705999][ T6315] ? assign_work+0x3cc/0x5d0 [ 1390.710621][ T6315] worker_thread+0xa5e/0xfe0 [ 1390.715257][ T6315] kthread+0x2fa/0x390 [ 1390.719358][ T6315] ? pr_cont_work+0x550/0x550 [ 1390.724241][ T6315] ? kthread_blkcg+0xd0/0xd0 [ 1390.729057][ T6315] ret_from_fork+0x48/0x80 [ 1390.733506][ T6315] ? kthread_blkcg+0xd0/0xd0 [ 1390.738126][ T6315] ret_from_fork_asm+0x11/0x20 [ 1390.742925][ T6315] SYZFAIL: failed to recv rpc fd=3 want=4 recv=0 n=0 (errno 9: Bad file descriptor) [ 1390.764481][ T9160] Bluetooth: hci2: command tx timeout [ 1390.807815][ T6315] mac80211_hwsim hwsim3 wlan1 (unregistering): left allmulticast mode [ 1390.826133][ T6315] team0: Port device wlan1 removed [ 1391.246133][ T6315] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 1391.253634][ T6315] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 1391.260849][ T9160] Bluetooth: hci0: command tx timeout [ 1391.336377][ T6315] batman_adv: batadv0: Interface deactivated: €Â0 [ 1391.352458][ T6315] batman_adv: batadv0: Removing interface: €Â0 [ 1391.418499][ T6315] bridge_slave_1: left allmulticast mode [ 1391.424236][ T6315] bridge_slave_1: left promiscuous mode [ 1391.445466][ T6315] bridge0: port 2(bridge_slave_1) entered disabled state [ 1391.478970][ T6315] bridge_slave_0: left promiscuous mode [ 1391.484789][ T6315] bridge0: port 1(bridge_slave_0) entered disabled state [ 1391.510718][ T6315] veth0_macvtap: left promiscuous mode [ 1391.519218][ T6315] veth1_vlan: left promiscuous mode [ 1391.675828][ T6315] geneve1 (unregistering): left allmulticast mode [ 1391.683085][ T6315] team0 (unregistering): Port device geneve1 removed [ 1391.954046][ T6315] team_slave_1 (unregistering): left allmulticast mode [ 1391.963265][ T6315] team0 (unregistering): Port device team_slave_1 removed [ 1391.997936][ T6315] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 1392.007962][ T6315] bond_slave_1 (unregistering): left allmulticast mode [ 1392.107037][ T6315] bond0 (unregistering): (slave dummy0): Releasing backup interface [ 1392.121372][ T6315] dummy0 (unregistering): left allmulticast mode [ 1392.148129][ T6315] bond0 (unregistering): left allmulticast mode [ 1392.154442][ T6315] bridge0 (unregistering): left allmulticast mode [ 1392.163646][ T6315] team0 (unregistering): Port device bond0 removed [ 1392.196627][ T6315] bond0 (unregistering): (slave bridge0): Releasing backup interface [ 1392.205608][ T6315] bond0 (unregistering): Released all slaves [ 1393.120154][ T6315] netdevsim netdevsim0 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1393.171975][ T6315] netdevsim netdevsim0 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1393.242674][ T6315] netdevsim netdevsim0 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1393.323917][ T6315] netdevsim netdevsim0 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1393.468752][ T6315] netdevsim netdevsim1 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1393.545020][ T6315] netdevsim netdevsim1 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1393.594033][ T6315] netdevsim netdevsim1 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1393.652549][ T6315] netdevsim netdevsim1 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1395.052617][ T6315] hsr_slave_0: left promiscuous mode [ 1395.061980][ T6315] hsr_slave_1: left promiscuous mode [ 1395.069883][ T6315] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 1395.077698][ T6315] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 1395.086112][ T6315] bridge_slave_1: left allmulticast mode [ 1395.091810][ T6315] bridge_slave_1: left promiscuous mode [ 1395.097935][ T6315] bridge0: port 2(bridge_slave_1) entered disabled state [ 1395.108935][ T6315] bridge_slave_0: left allmulticast mode [ 1395.114660][ T6315] bridge_slave_0: left promiscuous mode [ 1395.120912][ T6315] bridge0: port 1(bridge_slave_0) entered disabled state [ 1395.134870][ T6315] hsr_slave_0: left promiscuous mode [ 1395.141146][ T6315] hsr_slave_1: left promiscuous mode [ 1395.149781][ T6315] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 1395.157927][ T6315] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 1395.165994][ T6315] bridge_slave_1: left allmulticast mode [ 1395.171779][ T6315] bridge_slave_1: left promiscuous mode [ 1395.178096][ T6315] bridge0: port 2(bridge_slave_1) entered disabled state [ 1395.187058][ T6315] bridge_slave_0: left allmulticast mode [ 1395.192777][ T6315] bridge_slave_0: left promiscuous mode [ 1395.199333][ T6315] bridge0: port 1(bridge_slave_0) entered disabled state [ 1395.212524][ T6315] hsr_slave_0: left promiscuous mode [ 1395.218778][ T6315] hsr_slave_1: left promiscuous mode [ 1395.224918][ T6315] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 1395.232878][ T6315] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 1395.243275][ T6315] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 1395.251092][ T6315] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 1395.259219][ T6315] bridge_slave_1: left allmulticast mode [ 1395.264936][ T6315] bridge_slave_1: left promiscuous mode [ 1395.271152][ T6315] bridge0: port 2(bridge_slave_1) entered disabled state [ 1395.281012][ T6315] bridge_slave_0: left allmulticast mode [ 1395.289355][ T6315] bridge_slave_0: left promiscuous mode [ 1395.295127][ T6315] bridge0: port 1(bridge_slave_0) entered disabled state [ 1395.310300][ T6315] hsr_slave_0: left promiscuous mode [ 1395.316846][ T6315] hsr_slave_1: left promiscuous mode [ 1395.323215][ T6315] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 1395.336487][ T6315] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 1395.344469][ T6315] bridge_slave_1: left allmulticast mode [ 1395.352265][ T6315] bridge_slave_1: left promiscuous mode [ 1395.358739][ T6315] bridge0: port 2(bridge_slave_1) entered disabled state [ 1395.367904][ T6315] bridge_slave_0: left allmulticast mode [ 1395.373635][ T6315] bridge_slave_0: left promiscuous mode [ 1395.379860][ T6315] bridge0: port 1(bridge_slave_0) entered disabled state [ 1395.393136][ T6315] hsr_slave_0: left promiscuous mode [ 1395.400701][ T6315] hsr_slave_1: left promiscuous mode [ 1395.410276][ T6315] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 1395.419348][ T6315] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 1395.428610][ T6315] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 1395.437611][ T6315] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 1395.446661][ T6315] bridge_slave_1: left allmulticast mode [ 1395.452421][ T6315] bridge_slave_1: left promiscuous mode [ 1395.459861][ T6315] bridge0: port 2(bridge_slave_1) entered disabled state [ 1395.469829][ T6315] bridge_slave_0: left promiscuous mode [ 1395.476845][ T6315] bridge0: port 1(bridge_slave_0) entered disabled state [ 1395.493961][ T6315] veth1_macvtap: left promiscuous mode [ 1395.501168][ T6315] veth0_macvtap: left promiscuous mode [ 1395.510787][ T6315] veth1_vlan: left promiscuous mode [ 1395.516549][ T6315] veth0_vlan: left promiscuous mode [ 1395.523695][ T6315] veth1_macvtap: left promiscuous mode [ 1395.530582][ T6315] veth0_macvtap: left promiscuous mode [ 1395.536338][ T6315] veth1_vlan: left promiscuous mode [ 1395.541684][ T6315] veth0_vlan: left promiscuous mode [ 1395.971458][ T6315] team0 (unregistering): Port device team_slave_1 removed [ 1396.001015][ T6315] team0 (unregistering): Port device team_slave_0 removed [ 1396.029595][ T6315] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 1396.062785][ T6315] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 1396.156233][ T6315] bond0 (unregistering): Released all slaves [ 1396.334249][ T6315] team0 (unregistering): Port device team_slave_1 removed [ 1396.367848][ T6315] team0 (unregistering): Port device team_slave_0 removed [ 1396.394240][ T6315] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 1396.430226][ T6315] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 1396.519370][ T6315] bond0 (unregistering): Released all slaves [ 1396.718117][ T6315] team0 (unregistering): Port device team_slave_1 removed [ 1396.749290][ T6315] team0 (unregistering): Port device team_slave_0 removed [ 1396.783474][ T6315] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 1396.812774][ T6315] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 1396.932392][ T6315] bond0 (unregistering): Released all slaves [ 1397.039427][ T6315] team0 (unregistering): Port device team_slave_1 removed [ 1397.054860][ T6315] team0 (unregistering): Port device team_slave_0 removed [ 1397.085702][ T6315] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 1397.119136][ T6315] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 1397.199873][ T6315] bond0 (unregistering): Released all slaves [ 1397.412021][ T6315] team0 (unregistering): Port device team_slave_1 removed [ 1397.441637][ T6315] team0 (unregistering): Port device C removed [ 1397.480413][ T6315] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 1397.511927][ T6315] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 1397.594655][ T6315] bond0 (unregistering): Released all slaves