last executing test programs: 2.723424885s ago: executing program 0 (id=3845): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000b00)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a03000000000000000000010000000900010073797a30000000006c000000090a010400000000000000000100000008000a40000000000900020073797a32000000000900010073797a30000000000800054000000021300011800b"], 0xb4}}, 0x0) 2.655126303s ago: executing program 0 (id=3846): r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000000)={0x26, 'hash\x00', 0x0, 0x0, 'xcbc(aes)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000000140)="2c385aa3d49100dc6626c892b6bc436a", 0x10) r1 = accept4(r0, 0x0, 0x0, 0x80800) sendmsg$nl_route(r1, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000500)={&(0x7f0000000700)=ANY=[], 0x18}, 0x1, 0xf0ff, 0x0, 0x20048081}, 0x4000004) 2.597500379s ago: executing program 0 (id=3847): r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000000)={'veth1_macvtap\x00', 0x0}) sendmsg$nl_route_sched(r0, &(0x7f00000003c0)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f00000000c0)=@getchain={0x24, 0x11, 0x839, 0x70bd25, 0x0, {0x0, 0x0, 0x0, r2, {0x1, 0x6}, {0xc}, {0x3}}}, 0x24}}, 0x0) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_TYPE(r3, &(0x7f0000000140)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x800}, 0xc, &(0x7f0000000100)={&(0x7f0000000080)=ANY=[@ANYBLOB="3c0000000d06010200000000000000000100008d050001000700000010000300686173683a69702c6d61630005000500020000000599190a55e8a208"], 0x3c}, 0x1, 0x0, 0x0, 0x48c0}, 0x80) 2.412817888s ago: executing program 0 (id=3850): bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000005c0)={0x0, 0x5, &(0x7f0000000380)=ANY=[@ANYBLOB="18020000010000000000000000000000850000005300000085000000050000009500000000000000a94be0c51261be6a99fe3d0000a232d5e1f59f18f845f82e9a7bde9e8f4b9197701b547edf612a03f1737d95"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x20}, 0x94) r0 = socket$kcm(0x11, 0x200000000000002, 0x300) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000580)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000003840)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000380)="fbe6bd8dfcdda5a210b8cfefbd66f459c7261b927d25d3cf74d2f7c97735eba47f606a290d18492592230700000000000000081fdbd921ed4db0e67c9d5ab1452445a1e0da5ac68b13f4afe2712eeaad350d07", 0x53}], 0x1}, 0x0) close(r2) recvmsg$unix(r1, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x0, &(0x7f00000009c0)=[@rights={{0x14, 0x1, 0x1, [0xffffffffffffffff]}}], 0x18}, 0x40000000) setsockopt$sock_attach_bpf(r0, 0x107, 0x12, &(0x7f00000008c0), 0x4) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f00000001c0)=ANY=[@ANYRESDEC=r1], 0xb4}, 0x1, 0x0, 0x0, 0x2404c851}, 0x0) unshare(0x20040600) r3 = socket$inet_mptcp(0x2, 0x1, 0x106) ioctl$sock_SIOCSPGRP(r3, 0x8902, &(0x7f0000000200)) r4 = socket$inet_sctp(0x2, 0x1, 0x84) sendto$inet(r4, &(0x7f0000000140)='^', 0x34000, 0x0, &(0x7f0000004ff0)={0x2, 0x0, @rand_addr=0xfffffffffffffffe}, 0x10) listen(r4, 0xda90) syz_genetlink_get_family_id$nl80211(&(0x7f0000000980), 0xffffffffffffffff) accept4(r4, 0x0, 0x0, 0x0) unshare(0x22020400) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000500)={'veth1\x00', &(0x7f0000000200)=@ethtool_per_queue_op={0x4b, 0xf, [0xa, 0x1, 0x7fff, 0x1, 0x4, 0x9, 0xa4, 0xffb, 0x7, 0x1, 0xc1, 0x4, 0x1, 0x3, 0x0, 0x101, 0x1000, 0x9, 0x3, 0x3, 0x1, 0xfffffffa, 0x1, 0x6, 0x9, 0x4, 0x5, 0x5, 0x100000, 0x762, 0x3, 0x10, 0xe, 0x2b12, 0x100, 0x6, 0x1c02, 0xb, 0xfda, 0xbed4, 0x8, 0x8000100, 0x3, 0x0, 0x11000, 0x8, 0x5, 0x79b, 0x2, 0x1, 0x7f, 0x4, 0xa, 0x7, 0xf, 0x101, 0xd7, 0x1fa0860a, 0x7, 0xaa, 0x81, 0x2, 0x180000, 0x4003, 0x8b, 0x5, 0x2af, 0xf7, 0x5, 0x2, 0x6, 0x9, 0x4, 0x7, 0x4009, 0x5, 0x4, 0x100002, 0x8, 0x752, 0x0, 0x3, 0x0, 0x10001, 0x2, 0xffffffff, 0x6, 0x6, 0x9, 0x80000000, 0xfdffffff, 0x2, 0x2, 0x84, 0x100, 0x5, 0x252, 0x81, 0xb, 0x5, 0x20006, 0x5, 0x2, 0xb, 0x2, 0xd9a, 0xd, 0x2a2, 0xfffffffd, 0x3, 0x2, 0x5, 0x8, 0x3, 0x4, 0x2, 0x40, 0x8, 0x4, 0x4, 0x401, 0x66cd, 0x8, 0x6, 0x1, 0x1fc, 0xc5c, 0xffffffff]}}) poll(&(0x7f0000000000), 0x20000000000000b5, 0x9) socket$nl_xfrm(0x10, 0x3, 0x6) r5 = socket$igmp6(0xa, 0x3, 0x2) setsockopt$IP6T_SO_SET_REPLACE(r5, 0x29, 0x40, &(0x7f0000000440)=@raw={'raw\x00', 0x8, 0x3, 0x4c8, 0x170, 0xffffffff, 0xffffffff, 0x170, 0xffffffff, 0x3f8, 0xffffffff, 0xffffffff, 0x3f8, 0xffffffff, 0x3, 0x0, {[{{@ipv6={@private0, @mcast2, [], [], 'veth0_macvtap\x00', 'dvmrp1\x00'}, 0x0, 0x148, 0x170, 0x0, {}, [@common=@unspec=@helper={{0x48}}, @common=@inet=@hashlimit1={{0x58}, {'bond_slave_1\x00', {0x41, 0x1ff, 0x6, 0xb0e2, 0x10001, 0x84e, 0xfffffffb, 0x18, 0x8}, {0x1}}}]}, @common=@unspec=@NFQUEUE0={0x28}}, {{@ipv6={@remote, @ipv4={'\x00', '\xff\xff', @dev}, [], [], 'erspan0\x00', 'gre0\x00'}, 0x0, 0x258, 0x288, 0x0, {}, [@common=@inet=@hashlimit1={{0x58}, {'pim6reg\x00', {0x0, 0x0, 0x5, 0x0, 0x0, 0x7, 0x3ff}}}, @common=@inet=@hashlimit3={{0x158}, {'vcan0\x00', {0x3, 0x0, 0x41, 0x0, 0x2, 0x1000, 0x6, 0x3}}}]}, @common=@unspec=@CONNMARK={0x30}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28, '\x00', 0x7}}}}, 0x528) syz_emit_ethernet(0x5f, &(0x7f0000000bc0)={@multicast, @multicast, @void, {@ipv6={0x86dd, @icmpv6={0x0, 0x6, "c6dd00", 0x29, 0x3a, 0xff, @remote={0xfe, 0xe0}, @mcast2, {[], @ndisc_ra={0x89, 0x0, 0x0, 0xfe, 0x0, 0x0, 0x0, 0xffffffff, [{0x2, 0x3, "5749443c525b0c24bb55e1bdfbb5e99c42ddad4185f194"}]}}}}}}, 0x0) 1.670894547s ago: executing program 4 (id=3867): r0 = bpf$MAP_CREATE_CONST_STR(0x0, 0x0, 0x48) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r2, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000100)={0x0, 0x24}}, 0x0) bpf$MAP_CREATE(0x0, &(0x7f0000000500)=ANY=[@ANYRESOCT=r2, @ANYRES16=r2, @ANYRES64=r0, @ANYRES32=0x0, @ANYRESDEC=r0, @ANYBLOB="0000000000000200000000ffffffff00000000000000000004000000"], 0x48) getsockname$packet(r2, &(0x7f0000000080)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000000c0)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000008c0)=ANY=[@ANYBLOB="4800000010000507000000000000000016000000", @ANYRES32=r3, @ANYBLOB="0000000200000000280012000c00010076657468"], 0x48}}, 0x0) sendmsg$nl_route_sched(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000140)=@newqdisc={0x30, 0x24, 0xf1d, 0x0, 0x0, {0x0, 0x0, 0x0, r3, {0x0, 0xffff}, {0xfff1, 0xffff}}, [@qdisc_kind_options=@q_clsact={0xb}]}, 0x30}}, 0x0) r4 = socket$nl_route(0x10, 0x3, 0x0) syz_genetlink_get_family_id$nl80211(&(0x7f0000000380), 0xffffffffffffffff) getsockname$packet(0xffffffffffffffff, &(0x7f0000000180)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000001c0)=0x14) sendmsg$nl_route_sched(r4, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000300)={&(0x7f00000003c0)=@delchain={0x3c, 0x2c, 0xf31, 0x80, 0x2000, {0x0, 0x0, 0x0, r5, {0x4ecd559dfb18213}, {0x0, 0xffff}, {0x4, 0x1}}, [@filter_kind_options=@f_flower={{0xb}, {0xc, 0x2, [@TCA_FLOWER_FLAGS={0x8, 0x16, 0x3}]}}]}, 0x3c}, 0x1, 0x0, 0x0, 0x4008844}, 0x4010) 1.664906285s ago: executing program 2 (id=3868): r0 = socket$kcm(0x2, 0x5, 0x84) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) write$cgroup_int(r1, &(0x7f0000000200), 0x806000) ioctl$FS_IOC_SETFLAGS(r1, 0x40086602, &(0x7f0000000180)=0x20) r2 = openat$cgroup_ro(r1, &(0x7f0000000340)='cpuacct.usage_all\x00', 0x26e1, 0x0) setsockopt$sock_attach_bpf(r0, 0x84, 0x78, &(0x7f0000000040)=r2, 0x4) syz_emit_ethernet(0x6a, &(0x7f0000000000)=ANY=[@ANYBLOB="ffffffffffff00000000000008004500005c0000000000119078000000000000000000001b590048907803000000000000004b3f7633015aff9fa5e73369ed3ed4f938752184f1af202914ef9eaf90ab3e6f76a56d200f501fd4f4fc0d232b48a86ef0222fb636476697"], 0x0) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(0xffffffffffffffff, 0x8933, 0x0) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x111809dab92b3d31) r3 = socket$inet_mptcp(0x2, 0x1, 0x106) bind$inet(r3, &(0x7f0000000040)={0x2, 0x4e24, @multicast2}, 0x10) sendmmsg$inet(0xffffffffffffffff, &(0x7f0000000480)=[{{&(0x7f0000000000)={0x2, 0x4e24, @loopback}, 0x10, 0x0, 0x0, 0x0, 0xfffffee1}}], 0x1, 0x240408d0) sendmsg$kcm(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, 0x0}, 0x0) r4 = socket$nl_route(0x10, 0x3, 0x0) ioctl$BTRFS_IOC_DEFRAG_RANGE(r3, 0x40309410, 0x0) r5 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) r6 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$NL80211_CMD_TESTMODE(r2, &(0x7f0000000240)={0xfffffffffffffffc, 0x0, &(0x7f0000000200)={&(0x7f00000005c0)={0x13d4, r6, 0x100, 0x70bd2d, 0x25dfdbfb, {{}, {@void, @void}}, [@NL80211_ATTR_TESTDATA={0xfc, 0x45, "31988371d2f3e88ee6f4dd358c54e8503b91e0fa29eb0ab8a42f622705470c0da8f90afe985e0212207c1ad7bbfffe7746d92956fcecf100f2fdd6ee94b9e50c61d5c004c142cb8d2c2d875e370f60a8a813b67b7480ab6a1be908ffcd910de4b7bbb777b6d3573b83056cbd7e4f36ae6a1da5274e9b07a1f876314c4a4e7ebc270479e1b6dc654d3d7f286ce4dbcf7ca4d39ff298e0bcd818e950ab177babe609f59dbad36354b1b4d23204c9f8fc9c3153bb3aff108041c2d631050f843039dc12b7880c2c6f83db8661d9788e5cf23f31c0a863d27b22525f78a3b9dd7cf5479a3bc6c954df404ea85bc76201103e2761b31e375509dc"}, @NL80211_ATTR_TESTDATA={0xc8, 0x45, "d4d44f3813df03c3f2673d8d085aea59365abbdb78a18052029381849e1baf70590a655e8adf933400d4225cd85d87040a06d93548dc94861d4418e2676302097549f2f1bfec2e65a01a8cd1fcceef1bff0d6aeb0f32780ecbd7534f03d03b8574d715131d650c1dfca68d02486e5a017af23b7033caffa90dc3b69080b93589f9527fd138328984b4f18efa71f85b57e2e75cb0e30f4888b0440bfbaa8004a724d7d58d420dde49959c1ee3dbd338fa303ce580dfd647bd9d3ce3a717b19123d9edb6db"}, @NL80211_ATTR_TESTDATA={0xa2, 0x45, "c02007691863224f0743c823e6342915e2d6c847664b47a9ea0ae4bbafa3a67db1ee02223b8a583cbd0f7c297b6e450726e75aa748f084f308469d52a7041887dd1f3d80d2618346e504f1999368f7051db28d092fbd6c8c33470c7c3793b75eedae1959878d506a3f5356675286bfae373c57e6abb1dc1afc217152d1e764a1d4af143df64730d85a06710b595041880c40c0fc34a41430a6ee5de12660"}, @NL80211_ATTR_TESTDATA={0x1004, 0x45, "2423d6af68f60d475116d5a0d6f0294eb5660f22ec466ecc2801bc2d3fd1683bb83401402ba928341f7a84a6ef65e806b2406444bc1cb4a5511316dd719359e18f6450cdeb8b08b68e8ab3b08626e2a96546dfe8f79cf796aa9ef9204150659601c8d2440a5c0270013d4d9015f26d51b79720495481247fff4b8167940b42ac2336c7eb7d8afc7d9b6c7cbe6702991a9ee77161325aca508cd020fad959ec24a0448cb646c4819c622846db5e0f254c05029b5f599c8dfec603ebd38b7f8b06988bafacbef4ef704eb3b509bd6551d236048398057a1a1fbb31c70e569303b9e8bcf0047cb03fa9a8dac475858b1f0202cb1c7f106de674ce4bb77f16159aaa556afecf0c1f90dd3428f41e356a4c35007e2e3c0ef3d5a17b51ebf7fcae4db152c06ce858342203524646d510a7356a452e7df431eb95569ac0951177eb33d822b14ecf30cc4f2cb41ceb692d74649567043b66e008f115d38b3141b2ce953daadf391b582b66f63fb761b0b1c20a9b20fb1b5215428e8bf5b52edc8a86eac9a99a7e7cfa38916d08b08f8d633e8b4654480e9d78bf98dbc630099aa143d6d214ce2356e11131110d290c04a2f10b7d4879314391692bb748fac607fb65783db02752a3a322c07333f019ceaa54c7f251df359ab6a2af9f14f53167f7c0888c5c8e4141a881a4958e0139edf5b13a4baa6caff84b1a02e7adc062a195c30cf1648512028302077adcc650d531a41eca67c2f73217199cc771eb86e1cc4fc4d3c350e96e8f645a28273a0022335495f9632fdb6909ca87f4ebb7e71a8425e42bb27506d8faa3f6eea6dc48a15138e7687c36e1f5bd8dae758d51ceb79ab20488b93eb3a45ced4f422ca92b0732dc1c4ba3b9022561c7f78ff8fbe5a18119fdc2cf223b47fb3e77ae067a5b1d41738c9c0a0ddf3b99aedde3801e8d0121bd201baba415f9298176266579e18fc184ec3b18f4b61bf2d9a7dcb0074a4e5507880d461abd3c9f94da2cf5968adbf969b630d5d071a724c8a1c0bfb558add9ed00eb2919cab224b31f4b0b90b4996a91da2674cdf0739c72d13065aefb1346e1d5db903723f6bdccb7650ff49bc0b0ba1011f4ffe56b9e1001cd7dc79adc54bdaab756176eb5260789ea7b26f444471e21fad747e9eee9a984165aee4857b6370e7db55333571949732fcfaf2c6da6a327e7f7cef41745e117c53a5e5b5fb7ece23cd37a06ee154d6be29e81700422e6e70406e87ac197328ecb9417a028b67f8e6f0c10a25a5a84ca4ad63ed0f548b68342f04c166d329095116e9b8bd309754baf4d58dc0f08e9db91006c87bb768552881fe70bf5021b9649b197bb945d56c2971a51100f4659d0e69312b7fb105fa3a908616cd37f2e1fcfe224721462e33360cb544d6bdfb535a9704f43bbec6534543337b74372bc8fe57c142b56dc4063eff59724d284cd84de5a72b39d05515f1d54c17ab55fe884ff5fd6fb972529f8c03846a2888e5f8434bd969545301caffb968bb12558d5a69ee0ad8eec04d0ab7d891988926f8d3f121793db3e08f183b9ea644c7e721c3121ef3150c130b2958b6c09d077194d5bf38b8b338d03d6b64affcbad1d07b115dccd24633d53e6baaa55f0560926f25ab5059539d47d4c79f19ee77aac25e178b501be59551b2de236b7f7251110297f3bedb73ddd0bf0dec8e52f4e999db65e68e3ce23216d7a0e0bc6d38b67e3525ec2f2dd9fed717aa166511c7671d73de9c9e279b338140e2172cb44a86712f7dc264a3e42b388ef7f3d6daa90e71abc98b5c7fe5065780c81dff94831e1c4e8e3f55f5da4ecdbc97b7be3acb317ac2ba934e6a4c108a58d5ea53712fe1a493a157996e9b2f400dc5acd91aaedc7502f1f44ea15446f323107d815613dd6d97820b22e9446f87ddff71f4b7a8c240440bea5c112a7221fddcc13f00d5b0a4b298241158bf2017b41c3898b51756f881b1ad8bb2667884bad8d0d616d80d324919c9003c269aa5b74e192f13fde40b3aa08b4a44eecf00b8bc92e45d23f94f5981047642d2cfff84214d904ab0e6af328eeb99a4916f5caee2db143eb1e63e70899fdea54d34608557f15f340952399721df2d99306556dffe9ad76f377d0f6a288bf08b26ffcef985012bfe2b2dbf7a7094ac2d5114b29d49ecd964ab998d0f54e99224fb9c6ebca95a1c6043e34fc5a31958c1af202429d6096cdf3bcf9707d123d469d9fd26748376707a3e67d486909f79d08fe14d8343d2522de15cc7d86d98f932dd130d566863a10cca4af92685d9cc759ea2238e0ceecb7704c10f2881f181874b0ac737ffa21d56bc2bbf2cf28e1171122182b7301fccf2eda03ce0d4fd86f516b98a5faa923981393d9a9cb2f7c3e91ae6e7a06f26aab7ad14dcdf3bd1f487f8cf4e18e44b3939150b1b026b90079b5ef5db28ece81e3d52328b74e1c7a44ced71acb81382c7cf0082514fce566224d91272dc200d5054a4abc15f3272388136783a1e6f08895f19f9cb26f58897e61078a29d1ce0809e4f4c30476e2f60200b31d3b079c83fce4e4574f2f5e316846712641f9d65b74516c21865a1d24722b08637ce403b1b2446593375a46f4b7fad6b3e089ba03abaf0bf875258f5335dfbc86035771aad0b2c52f89153ca18de392493d5646808341ad6898765ebdfa6c45c6ebb45cb1986a87f93c9cbd05bcd97c553ad2243233d3860cf50749bfcbca0523f5854192a6bcf52b33ee513aeeb4c19dcaacd3bf84d6e96c51c97e5e11848a2c4d71253ee4379ed68e8b997e32efa1acd1aea135c1ef9b9cda3268cf8b6bb76a9e761759d35844ac43d227d7a0ac5722c8598e9a9afdc42db7b18de9288bf8ec9c0e54f215e48afd671da8cc717403720e6b14355ad5859435c2b6bdb7aa6100cd3eaad3b3184fe7ebf3307d4018f57d0c69b9df6f1a48cb5fe82c48853b8c797cc10fc99b0a740593a44df6b77981756266927aa42a145b35bf1a4ea726f6c54c309b7ae65e8b039f7e705229472be55aa22407f58a4b9624d7ae5ef047aa7d14d3f80d84c175aac3c90bebd8ec6e88634c4a29a55563f8764ed904a35bace49e71392bd61951cf75ffffe7c7cadede5732ab6371bb8972b10c7de567bfe4960450e7e38b29867cd5af6646b7fca7c30d1b5eddaf3148915faea3b1f2e29b152bcccf76a084aa8e6b031480e0ad83e2de9f72e687ad5c13ba93ab96290b44fc1d717c26ad2dd76df9e62dcb7ad7f973f38f79006ce63257f1243df04bfe68e501531fa8c7ab8635bbeec33072a707148e9bbf8ea8d7400736076d744b1832c1ff459636d078405dc8454e4e961763ba3c7c961513e5c68af9bbc8d50a1ffc235c53ef276b43c7c6ca8d4998b0afb120971b38a55fda218f7a82757252dc6567edf72521ecd9e19ac5830916a4616eeb77ea2e6d5ff1e3fc04e1ee7e17e04fea6d67fdfd6d0ae89a52bd4390fe7a0f8c6d5974e5dbe111c6f4055334c78450e235c9dc7b1637eb1288edad0bc8fa0822ed4ad06b2539921ef2336c60b2fdc2937769ccf747362b842d1cb4608b6f38d5e74ffe024a2690a096b5c3df4ae6d178681f3218a37cd88f010ccd994beba90fa9f03101fd979a283778453e50050446e519ce5e370bbdc0e38aa36fe0edaa3a93a388e0976348616823bd4f9b2a11a58aa5f492e6ec8484d95ddf0e21a23afa1a8ddf313394a6f80e552e77d98f04ffc8916eabf99ee32da7a2873a490e920b8e718849fdf1d8fc89814a004212af7e5e42eeecbdaec20c83aaffb58b485a72d0a6d7953c34a54182f1cc8f5231dbeaac86b4c977d4f776a152d7a6f79856b251ffe1a22782661e5a6c0ceab7f5405cbd08d35a4366e4b14464577c7cf26aab845ad1d20561cd10ea374b9e5272781df5e657552c9be355e8fd1f444d208625dfc193724cab2fa1d3072158bb3753d647217bd51c9bf6059f959c8ba928c428aa1383a3d42dee8a9c7ef135582f81ad5f91d4bc2a83136fd79dbefc3bf7c8116143f67d907f9c1c6e873c95527b03d507621a296441f2b3657ca39dfd1f0cf045fc8c7b4043003f1884f40919669f576c96b48d5e0a019fdf3b21a94fd302f78e4291db922bf6d452e493d338b2f3935fae1950f5832794ea4db1bda74a263e191ed097c4fdb5f814f01f4acdbd0959b767dca70d7d916d86d14063a7b5eb1766439bc8af3e5ef1326a28e2c5f4bcb20540274de5ee4931aca305bd996816d877f5ad323565f65f33b9d7aa59e25957a3aa7cbdabe7fb9393f44eef00c15eef072453b7460f98e837d67b36249c0bf38cdcbf017d3545825f169820d2cbc4c02fbc0757b62d61ea0af2ca630ffa0bf9f1878e99dbc04077774a8aba2f61526ff830fcfaf6bda105a343fe70fafd8b3f7b2e3a3db4bb04c93922e7c7058a51eb2505656450f4e28869285cee84ce97750f771530f819d3014be51e3ff4c37548489d98b124f9333817247a71ae5319e8105ca0c8e650ebd95ff55473c1e3ed8736e88eb0b33de58fb8a89c4de8b9efb0e40db1b78449828f56f4fe40ed08b823e79798103bb375a0c2b54819f2abb4b4a8d5ef9566936b0593baa472f057004b238e8a243ebeead3b3f7a447cf49e6751a66e26ae0f8727909326f62f2b4542afe7a3fb8f250287e855f84a021dbab0b76bceecb8b3e863a3a0e7d73ce7b4f5df36e7fe684e353a0ef6b004f15132781c903164abe9bdea64f626f47557aa69054c35994fba9d02aaec3e8dd2ca77e485550852995d9138902c2884b9180236a010fa087e8e35dd7d15a7ba3ff5861990ca1da81ff46fa811e05b3061648f74288921bea5de7a370803d1b766f7671d4d91d5ac33437690ad5d621b66976657b2b07da3148836c5a619b8ba6eec4b9f4e95011f3f2a5f14a0c5c45996cf5aa34ad7089f1fb84889a144bfd18a68c6025ba9b24f71b3c5354dce35f98edf5a243f63ab082c05c68beea268edd24e3eb5ff93cde80a86552d52065b54c92f6870093ebfda76896f1866a287d3d20fb0e0b91db214d3584bdaf4fc5c22b560cf3114e12849d09e92fb9a462f142678b2d549d1abb64d5ce150043f4299ab82beb9f7677364cafb4fa1260260cc929afd24a3ad080057bf73c631efcb3e89e8b97866da807cc382ec24a607ef9ade89d73b047c0111dbc2e65bcee697b4d6ec319915513f991af61310574e969c3012242e8ca172cf6aa9d5e1bba0bf74ad8c2e56905d6175080d63d0c4ed4471bb3f4b6e1aa66448eec4c4da67d4963903140afdef94fb562e7d42e5a73694ac967046ab9acc2a1820bce85d480328bf2db1bd5a8c3534d49f04e756a7857540dec06ddb3a0970296d2ab36c7b33f994fc0116a214787ed92be8df50b7dbcb29d0581a66b0e45a281f0eb25477b69696b45d81ef5a229eb5d00aa24806598deb4d60bc19ce73ea7eb3175efc27448d4e19a67d651e2283ffa23bfa1c9f8e73cf9e39fa0050559e21744222e0345cf89fe7e7dd9d0c47a887356a475c1c2a39dd4c449960d435b74920bbf68fd59ddf1c82837fa661ec6a7960110ce5428efb890609644e2946b5eb72d8e088067e430bf3da8b296ac24ac279f7ac80cdea3e823f2570b3bba8affac2a935f3fcfd61fd89cd65eb8f14bed2d7149241e01f8ec63e893d9bb80d4d0b4a8e2564d60266f61125e47f24cc7adfe69af3e06119ba9fa684df0aec51d16818159584b41990dbe84518209ba7ac94b193f0697633ee6881379055472597ae037afd80267c3561f92b0b653dc98379d"}, @NL80211_ATTR_TESTDATA={0x7c, 0x45, "820ff7a5fed891c721069953fe0064c430cbaa794eb8d697c067479933dae80226f9c585c7d08dc1a8e7607595c12ead33ceef6b9f34f002004bad35a8982cc30ca9f98d896aace6c8bef71454c58685cef3e1b85be41fc7f97d7c3a790c5f4a205853558b9781da2b7c6417111248518971bc4c35bb59ca"}, @NL80211_ATTR_TESTDATA={0x6c, 0x45, "a773ae5a6e0ff2ed672d29281edbdde709918b87af89de78e4c25737dbecddc0bec88307750f86a6780269aa5cd70612877c465b2602242ecf79667f16d9e7cb36caea71835447110a79bd579cc8caf91108e681bd4eb6f584dd6e9757be66a71f88b5c0b23b332d"}, @NL80211_ATTR_TESTDATA={0x6b, 0x45, "e583e0c6ce17c9c358ffa327bb62b5660a4c6bb18cbe23fc6963167d1a426c8b4c066c1e6a5e2bcc4ec12bde1111550fbe7757b9d21cd2872cef50d92e92137e60e6198251e60b2fa70f577b5367755580127ee14b395096d7ad799384f036d37d2302952e5282"}]}, 0x13d4}, 0x1, 0x0, 0x0, 0x48004}, 0x20080000) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000000)={'bond0\x00', 0x0}) r8 = syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10) sendmsg$netlink(r8, &(0x7f0000001ac0)={0x0, 0x0, &(0x7f0000000080)=[{&(0x7f0000001b00)={0x474, 0x1f, 0x301, 0x0, 0x0, "", [@nested={0x461, 0x0, 0x0, 0x1, [@typed={0xc, 0x1, 0x0, 0x0, @u64}, @generic="f400a489160a11", @generic="50bb2d6f67d29d6fabadb107d0def49c88ea04abde1d5e8d3fb22a1b5046778bdafefc46b0449ade68bf84b36ec72dd71265fc2e882348c26c2126237dd5b37f5ae655b1086cda40e00aec58754734be31d750351dc076eb47d96219c08c029d1608a487f26fbe816b89f7cb81bff81a8b7a82565856555ee923c65973deb0a99b962bc0fe94a3fcae3697bd7b85b3a682167c43dbf137115a40ebddcad74875cf0d972df9e99f07976773f4d98fe3fa370d47eb640dc5061dc35817c8a66c29be82fdc2f4393c05a007d12b505a84dfdb98d568175b62421d726d1e5331e1ddfd4d", @nested={0x366, 0x13a, 0x0, 0x1, [@nested={0x1a6, 0x26, 0x0, 0x1, [@generic="b6a05dd164d4a99cf92cd8d9c8897180838a992ab7fe357d3e61519711f324785d2d7affbc85e77ccd29b7aba37fd9d474dc63450b", @generic="db129f1c6befb62ac37c83f1ab915da11518d3ab1c7b14df4260926bae5a00106477566e5591e669192548d11916c325ff0a656011841a68d25c8b174e57e8d5d401dde907eab345b0318969bc0d109c84a526f880f114f3b59edd1c681df87d8e31e41d4d5a2cdae32efac32745e5ef7c2ef0", @generic="353068a835c4d1c710b62d533ad8af92423e15878f32d83258a845d96bba61b18c9d30ae989421592325589947092c2ab6e9cdd6d19d71504980bf08e301ca07f880989cfc82cc3d75808bb1c9f327273e84533c9cbbae8701c25ec1f7370c2452205fdebe39af4bde3b2880db61b7416d33d8bb65860878bcfe0146d7611eb76c27e108895105ce0c63c22850b9d0d14e523bf3f33d2cd6e9355d4c96f3647cf92fe81b184bbca4a2668797d621621100f14dd9b750d1557988c6252992a28301e672cebdafb69df78af317d428b8112742243511f1219ac399629225da536a00315ff39d15b6c27a2e07e2d0f347411df304c7f4ecdadf75b1"]}, @generic="aa0608754278230d5f6741623a20e89752b083cf1e8b45e345f20166a3d0af5d0bd6c206bd63affc34edd7975b833d8d4624e0f917b528dab68960fc", @generic="6f4d7d9bf7c93c995fa67eac7ac90ea839c7b955e6d80264d537facbf8c12745633c7a664f6c36e794c031348b9a3f17c38c42c1dfab52d650d584a1785120f8d915c6883bb3a8703f176b8fac8547d7c3248cc04cc3b57e34d04d70691a", @nested={0x120, 0x13a, 0x0, 0x1, [@nested={0x4, 0x13c}, @typed={0x4, 0x17}, @nested={0x4, 0x41}, @typed={0x8, 0x83, 0x0, 0x0, @ipv4=@loopback}, @generic="b4abc277a791e69c1e877a1ca48d0d9eac01af90c90994c4ade3e448a714638f47da8ded6e5b215f539632a246daf0d929a61a5afd30a6c32b50475b8ee7325e72a7c24ba40200250c0ee66ce32db91af3df50aaba63a2bc074c707970c099b993fd90dc745280fbc3bd157fd2215845bb441ae5448a4a30ac96bbf0827f4f22ad9cbb5108dd6930628babaac9748c644d05d171b988a15102f68245693f3d050ba045fbf1a360bcf15a73ccabfa762e1de9817e4bafc2e39c59d825f9bac0d67473ae4f", @generic="bd29bdcf90f2f3b45bff3a5d42e3dc0ebfb81f8ab09a983de413b7bb73f13179118e8e7f9cc8fea1681d6dc129e018066a40e16d0de70a06d4fec278daf2f2eddd679c3e"]}]}]}]}, 0x474}], 0x1}, 0x0) sendmsg$nl_route(r4, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000100)=ANY=[@ANYBLOB="6000000010000304040000000400000000000000", @ANYRES32=0x0, @ANYBLOB="010102000000000108000500b0b4e045caf2828de3b590fe76e9398de939e832f3457f8d59e0f11aa9ceaafbac871d7e5e303813539e1fcd67b56c5d27fda65ffa41e58dd2b84df8cab2fa0740d3018f9ba2a998d17ac0c7c8e1edb4a5f028e598b14b808e83e3c91e3c9e89ccc27e010f58ca6174bf7111b5b986b46434", @ANYRES32=r7, @ANYBLOB="3800128009000100766c616e000000002800028006000100020000001c0003800c00010006000000050000000c0001000600000000000000"], 0x60}, 0x1, 0xba01}, 0x8014) bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000440)={&(0x7f00000002c0)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0x1c, 0x1c, 0xc, [@typedef={0x1, 0x0, 0x0, 0x8, 0x4}, @var={0x1, 0x0, 0x0, 0xe, 0x4, 0x2}]}, {0x0, [0x5f, 0x5f, 0x0, 0x5f, 0x30, 0xe5000040ab052589, 0x5f, 0x0, 0x2e, 0x30]}}, &(0x7f0000000380)=""/161, 0x40, 0xa1, 0x1, 0x42bc}, 0x28) accept$inet6(0xffffffffffffffff, 0x0, 0x0) setsockopt$inet_tcp_TCP_REPAIR(r3, 0x6, 0x13, &(0x7f0000000300)=0xffffffffffffffff, 0x4) 1.577789327s ago: executing program 2 (id=3870): r0 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000240)={0x2, 0x4, 0x8, 0x1, 0x80, 0xffffffffffffffff, 0x0, '\x00', 0x0, 0x0}, 0x50) r1 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f0000000580)=ANY=[@ANYBLOB="1b0000000000000000000000000004"], 0x48) bpf$PROG_LOAD(0x5, &(0x7f0000000840)={0xd, 0x1c, &(0x7f0000000d80)=@ringbuf={{0x18, 0x8, 0x0, 0x0, 0xd0, 0x0, 0x0, 0x0, 0x10001}, {{0x18, 0x1, 0x1, 0x0, r1}, {}, {0x7, 0x0, 0xb, 0x3, 0x0, 0x0, 0x30000000}, {0x85, 0x0, 0x0, 0x5}, {0x4, 0x1, 0xb, 0x9, 0xa}}, {{0x5, 0x0, 0x3}, {0x95, 0x0, 0x50, 0x6000000}}, [@snprintf={{0x7, 0x0, 0xb, 0x2}, {0x3, 0x2, 0x3, 0xa, 0x9, 0xfff0}, {0x5, 0x0, 0xb, 0x9, 0x0, 0x2, 0xb0a3}, {0x3, 0x3, 0x6, 0xa, 0xa, 0xfff0, 0xf1}, {0x7, 0x1, 0x2, 0x9, 0x8}, {0x7, 0x0, 0x0, 0x8}, {}, {}, {}, {0x18, 0x2, 0x2, 0x0, r0}, {}, {0x46, 0x8, 0xfff0, 0x76}}], {{0x7, 0x1, 0xb, 0x8}, {0x6, 0x0, 0x3, 0x8, 0x0, 0xffff, 0xfffffff3}, {0x85, 0x0, 0x0, 0x7}, {0x7, 0x0, 0xb, 0x0, 0x0, 0x0, 0xf3ffffff}}}, &(0x7f0000000980)='GPL\x00', 0x4, 0x0, 0x0, 0x0, 0x7, '\x00', 0x0, @fallback=0x1c, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) 1.576510817s ago: executing program 4 (id=3871): ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(0xffffffffffffffff, 0x89f2, 0x0) sendmsg$SOCK_DIAG_BY_FAMILY(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000003c0)=ANY=[], 0x44}}, 0x20004059) socket$inet6_udp(0xa, 0x2, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000680)={0xffffffffffffffff, 0xffffffffffffffff}) setsockopt$sock_attach_bpf(r1, 0x1, 0x4c, &(0x7f0000000000), 0x4) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r2, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000002c0)={{0x14, 0x10, 0x4}, [@NFT_MSG_NEWTABLE={0x20, 0x0, 0xa, 0x5, 0x0, 0x0, {0x7}, [@NFTA_TABLE_NAME={0x9, 0x1, 'syz0\x00'}]}, @NFT_MSG_NEWSET={0x4c, 0x9, 0xa, 0x401, 0x0, 0x0, {0x7}, [@NFTA_SET_NAME={0x9, 0x2, 'syz1\x00'}, @NFTA_SET_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_SET_KEY_LEN={0x8, 0x5, 0x1, 0x0, 0x1c}, @NFTA_SET_ID={0x8}, @NFTA_SET_FLAGS={0x8, 0x3, 0x1, 0x0, 0x40}, @NFTA_SET_OBJ_TYPE={0x8, 0xf, 0x1, 0x0, 0x6}]}, @NFT_MSG_NEWSETELEM={0x48, 0xc, 0xa, 0x301, 0x0, 0x0, {0x7, 0x0, 0x7}, [@NFTA_SET_ELEM_LIST_SET={0x9, 0x2, 'syz1\x00'}, @NFTA_SET_ELEM_LIST_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_SET_ELEM_LIST_ELEMENTS={0x1c, 0x3, 0x0, 0x1, [{0x18, 0x0, 0x0, 0x1, [@NFTA_SET_ELEM_FLAGS={0x8, 0x3, 0x1, 0x0, 0x2}, @NFTA_SET_ELEM_OBJREF={0x9, 0x9, 'syz0\x00'}]}]}]}], {0x14, 0x10, 0x1, 0x0, 0x0, {0x0, 0x84}}}, 0xdc}}, 0x0) sendmsg$inet(r0, &(0x7f0000000140)={0x0, 0x0, 0x0}, 0x0) recvmsg$unix(r1, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000300)=[@rights={{0x14, 0x1, 0x1, [0xffffffffffffffff]}}], 0x18}, 0x0) r3 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="1b0000000000000000000000000004"], 0x48) r4 = bpf$PROG_LOAD(0x5, &(0x7f0000000b00)={0x11, 0xf, &(0x7f0000000340)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r3, @ANYBLOB="0000000000000000b702000014000000b7030000000000008500000083000000bf0900000000000055090100000000009500000800000000bf91000000000000b702000043e7b5538500000085000000b70000000000000095"], &(0x7f0000000080)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4a, 0x0, 0x0, 0x0}, 0x90) r5 = socket$nl_generic(0x10, 0x3, 0x10) r6 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000400), 0xffffffffffffffff) sendmsg$TIPC_NL_KEY_SET(r5, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000740)={0x34, r6, 0x1, 0xfffffd, 0x0, {0x3}, [@TIPC_NLA_BEARER={0x20, 0x1, 0x0, 0x1, [@TIPC_NLA_BEARER_NAME={0xd, 0x1, @l2={'eth', 0x3a, 'gre0\x00'}}, @TIPC_NLA_BEARER_PROP={0xc, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_WIN={0x8, 0x3, 0xfff}]}]}]}, 0x34}, 0x1, 0x0, 0x0, 0x84}, 0x80) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000000c0)={&(0x7f0000000140)='kmem_cache_free\x00', r4}, 0x10) ppoll(&(0x7f0000000500)=[{r3}], 0x1, 0x0, 0x0, 0x0) pselect6(0x40, &(0x7f00000001c0)={0x0, 0x0, 0x3, 0xfffffffffffffffd, 0x9323, 0xfffffffffffffffe, 0x0, 0x2}, 0x0, &(0x7f00000002c0)={0x3ff, 0x0, 0x0, 0x9, 0x0, 0x0, 0x7fffffff, 0x2}, 0x0, 0x0) bpf$BPF_PROG_TEST_RUN(0x1c, &(0x7f0000000240)={0xffffffffffffffff, 0xf, 0x25, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x40) r7 = bpf$PROG_LOAD(0x5, &(0x7f0000000440)={0x11, 0x6, &(0x7f0000001c40)=ANY=[@ANYBLOB="050000000000000061110c00000000008510000002000000850000000500000095000000000000009500a5050000000077d8f3b423cdac8d80000000000000002be16ad10a48b243ccc42606d25dfd73a015e0ca7fc2506a0f7535f7866907dc6751dfb265a0e3ccae669e17fd6587d452d6453559c3421eed73d56615fe6c54c3b3ffe1b4ce25d7c983c044c03bf3a48dfe47ec9dd6c091c30b93bfae76d9ebacd3ed3e26e7a23129d6606fd28a69989d552af9cc9e5ef6bda9df2c3af36effff9af2551ce935b0f327cb3f011a2fd52347125907000000000000003ed38ae89d24e1cebfba2f87925bfacba83109751fe6c05405d027edd68149ee99eef6a6992308a4fc0b7c70bc677d6dd4aed4af7511d7900a820b6347184e9a217b5614cd50cbe43a1ed2526814bc0000e9e086ce48e90defb6670c3df262ad0a97aec7291c25447c106a99893e10db21901eb397b2f5fd71d20fa7a050fbbef9e326ea27e513e96068fd1e8a43e89f9c85c822a961546ed5363c17ff1432d08806bc376e3e49ee52b59d13182e1f24ed200ada12f7a1525320e716660000000000b02b001500a710eb1affb87ba55b2d72078e9f40b4ae7d01000000d11cd22c35d3294000000000000000000000000000000000000000000000000000000000000000000000000c52f4ebd2c893bb97a068bd10738d3c9f7a98eccb26f7e2df3ad37b729ac83b0dcb4f48f3c3356b9997fc455a17690b6f7f9ccbe4b1701941b18a904c0e585a66c3b84b138efc20a546d3d5227e23b03f2a834391ad24fe977076ce7d9b20cf92cb151763d41f5c76e2ff3e93ee296c4082ee73e7e197253a2b66c353312c9d75711ce1623e9c54bdff59d1a69dcb7d84c235b23a4480c2461b405cfd1a38992f295ad3adc94cd07c850d1c77a211bfa02c24e9280333152fb794e4ddea02017a6c139b50101caecaf2abc084075ad10727522934a87a4ddcdb112754ca5bdec0ead14b6c0f19a4b126bbe0c2b8c9ff68236c8600000000000000000000000066e034c81c3cab4e33fc8dc55ce0ada18dcb1a47a87baf63e4edf11c6e82893add3bee3e10fc873d1d922b0877cbcd95b839d3059d5140a1f742f6e75741e39e5cb6a193e06a1043375b0f61b5d4e17c81baa31b924d84f2243471221c158ae8f44bfbfa7c2730302b66a99f66705b71e6205e7cbf36435e1eabb9a63fcd604d5cc27e1317ad94cf438d7187a2fe4e06fa6cbf84ef1efa82cb2c4af6bd1370616cdbe2b98fd89b79824ba089df1f81e6fcef073059f5f1d6a221d791839d7826ed1759c2153532c393fd1bd7be2e7f5abf2f0800000000ea46c07adee10d0f2bc85cf37182256e4fd8f56942726efc07180eaa5421d697665c8bacd39cdb392e6153af80bc1a69e3bfab032e78c9a96eab13be845a0d44ef2a4ab414ac2e4802a3b5d3aa2a4a4fc259206d97d0cc1602d6b45ff414c53fc9f5f68438f0423e168a97923ca0464b40b2f797841fb2bb2e5ad9feff37220ab7c34f4c382c247e7735adb55c209f7c0f8880733dbd3f5a095cc6a2"], &(0x7f0000000080)='GPL\x00', 0x5, 0x29e, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x6}, 0x70) r8 = bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000000c0)={&(0x7f0000000080)='sched_switch\x00', r7}, 0x10) bpf$BPF_GET_MAP_INFO(0xf, &(0x7f0000000140)={r8, 0x44}, 0x10) r9 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r10 = syz_genetlink_get_family_id$netlbl_mgmt(&(0x7f0000000800), r9) sendmsg$NLBL_MGMT_C_LISTALL(r9, &(0x7f0000000a40)={0x0, 0x0, &(0x7f0000000a00)={&(0x7f0000000980)=ANY=[@ANYBLOB="14000000", @ANYRES16=r10, @ANYBLOB="819b00"/14], 0x14}, 0x1, 0x0, 0x0, 0x8000}, 0x40008c4) r11 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r11, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000000c0)=@newlink={0x34, 0x10, 0x801, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x2031}, [@IFLA_XDP={0xc, 0x2b, 0x0, 0x1, [@IFLA_XDP_FD={0x8}]}, @IFLA_GROUP={0x8}]}, 0x34}, 0x1, 0x0, 0x0, 0x20048054}, 0x0) syz_emit_ethernet(0x9a, &(0x7f0000000540)=ANY=[@ANYBLOB="0180c2000000ffffffffffff86dd6000008000641100fe80000000f0ffffffffffffff0000bbff02000000000000000000000000000100004e22004d9078020000000000000000000000eaf12af8010d4894322fd8f9f39c6526ece5d2603725b9cabfc2c9f4513d3dfb201f3a70a41ef6c2fca06a9bd768d5f176c198150020000000000000000010009514b06796dbf2ea9e520f1475c8f65b13efcfbfc9b1d0e5c58b4be6608c9608e393ff14c36c9c3390f375043be439a02b275fa5b79c00e7ae925b94dcc6a70a1afb34cb5cb991a40a2f23"], 0x0) r12 = socket$inet(0x2, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX_80211(r12, 0x8b04, &(0x7f0000000200)={'wlan1\x00'}) bind$inet(r12, &(0x7f0000000100)={0x2, 0x4e23, @remote}, 0x10) 1.501987619s ago: executing program 1 (id=3872): r0 = socket$nl_crypto(0x10, 0x3, 0x15) sendmsg$nl_crypto(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000b80)=ANY=[@ANYBLOB="e8000000100001002dbd7000fddbdf257874732874776f666973682900000000000000000000000000000baa03612ce73e75780d2c6e0e57c900000000000000000000000000000000004100000000000000000000000000000000002000"/123], 0xe8}, 0x1, 0x0, 0x0, 0x44}, 0x80) 1.469301163s ago: executing program 2 (id=3873): r0 = bpf$MAP_CREATE(0x0, &(0x7f00000003c0)=ANY=[], 0x48) bpf$MAP_DELETE_ELEM(0x15, &(0x7f0000000040)={r0, 0x0, 0x20000000}, 0x20) 1.468030092s ago: executing program 0 (id=3874): r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000006c0)={0x18, 0xb, &(0x7f0000000640)=ANY=[@ANYBLOB="18000000000000000000000000000000180100002020000000000000000000007b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000000600000095"], &(0x7f00000004c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0xfffffffc}, 0x94) (async) r1 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000600)={0x11, 0x3, &(0x7f0000000200)=ANY=[@ANYBLOB], &(0x7f0000000100)='GPL\x00'}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000000)={&(0x7f0000000040)='contention_end\x00', r1}, 0x10) (async) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r2, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x4000000) (async) sendmsg$NFT_BATCH(r2, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f0000000380)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a80000000060a010400000000000000000a0000010900010073797a310000000054000480500001800b00010074617267657400004000028008000240000000012c0003007339f2f10455afb9fdd672bad09dfb78c7699c74e891a0c70000000000000000000000000000000008000100544545000900020073797a320000000014000000110001"], 0xa8}, 0x1, 0x0, 0x0, 0x4000850}, 0x24000840) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000280), 0x0, 0x0) ioctl$TUNSETIFF(r3, 0x400454ca, &(0x7f0000000140)={'pim6reg1\x00', 0x1}) r4 = syz_init_net_socket$rose(0xb, 0x5, 0x0) connect$rose(r4, &(0x7f0000000000)=@full={0xb, @dev={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, 0x5, [@bcast, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x3}, @bcast, @null, @default]}, 0x40) (async) bind$rose(r4, &(0x7f00000059c0)=@short={0xb, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0x2}, @null, 0x1, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x0}}, 0x1c) (async) r5 = socket$inet6_sctp(0xa, 0x5, 0x84) ioctl$int_in(r5, 0x5452, 0x0) r6 = socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt$inet_sctp6_SCTP_AUTO_ASCONF(r6, 0x84, 0x1e, &(0x7f00000020c0), 0x4) (async) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000540)={&(0x7f0000000580)='i2c_reply\x00', r0, 0x0, 0x8b9}, 0x18) (async) r7 = socket$nl_route(0x10, 0x3, 0x0) (async) r8 = socket$inet6_sctp(0xa, 0x5, 0x84) setsockopt$inet_sctp6_SCTP_DEFAULT_SNDINFO(r8, 0x84, 0x22, &(0x7f0000000080)={0x8, 0x8, 0x0, 0x3935}, 0x10) ioctl$sock_SIOCGIFINDEX(r7, 0x8933, &(0x7f0000000040)={'tunl0\x00', 0x0}) sendmsg$nl_route_sched(r7, &(0x7f0000001200)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000d00)=@newqdisc={0x26c, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0xfffffffe, {0x0, 0x0, 0x0, r9, {0x0, 0xb}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_red={{0x8}, {0x240, 0x2, [@TCA_RED_MAX_P={0x8, 0x3, 0x8}, @TCA_RED_EARLY_DROP_BLOCK={0x8, 0x5, 0x3}, @TCA_RED_STAB={0x104, 0x2, "f282a4c26f20526b3c4324a58c77385605e0c953f0c9151f0394308e027b48dd8eecf654407905cf3d96b7625d52e0e86d947ac5ba5f207e0d3746764c8d292d632be40ae5d84e8b3bc722eb8d55ade8e83fa8aac4c12f42f62012b65711ef3f8d3d820c62987e15f78cd4c7061e608c69482f9e43c39d880c4044e8760834148088f4d81e2cb02a65284ebad4cfad2534a33845248b2d7ab1f367806888aa057a7dc44f29b7bc3630886d6de187a8df3e29d2a9dd30c43c9c5c584cc5a8fa6c37b65e86b7a18daa4991a334095070bba84458d7d166e69c00d969dab5d19f44be7058ed6c30ccb3ec9db19c5d9d311facc2ab7d1811088c1da6cfda276fbf27"}, @TCA_RED_MAX_P={0x8, 0x3, 0x5}, @TCA_RED_FLAGS={0x0, 0x4, {0x8, 0x4}}, @TCA_RED_MARK_BLOCK={0x8, 0x6, 0x5}, @TCA_RED_MARK_BLOCK={0x0, 0x6, 0x20000000}, @TCA_RED_FLAGS={0xc, 0x4, {0x17, 0x10}}]}}]}, 0x26c}}, 0x0) (async) openat$nci(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) r10 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) (async, rerun: 64) r11 = socket$nl_route(0x10, 0x3, 0x0) (rerun: 64) sendmsg$nl_route(r11, &(0x7f0000000c00)={0x0, 0x0, &(0x7f0000000100)={&(0x7f00000000c0)=ANY=[@ANYBLOB="240000001800010900000000ffdbdf2502180000ff00000820000002084b0100a3141400"], 0x24}}, 0x0) (async) r12 = socket$inet6_sctp(0xa, 0x5, 0x84) setsockopt$inet_sctp6_SCTP_AUTH_DEACTIVATE_KEY(r12, 0x84, 0x23, &(0x7f0000000180)={0x0, 0xa}, 0x8) (async) syz_genetlink_get_family_id$nfc(&(0x7f0000000100), r10) r13 = socket$kcm(0x10, 0x3, 0x10) sendmsg$kcm(r13, &(0x7f0000000000)={0x0, 0x92c0199, &(0x7f0000000080)=[{&(0x7f0000000040)="e03f03003e000b05d25a806c8c6f94f90224fc60100005000a000200053582c137153e37000c0980fc0b10000300", 0x33fe0}], 0x1}, 0x0) 1.415368223s ago: executing program 1 (id=3875): r0 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="0e000000040000000800000005"], 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x6, 0xc, &(0x7f00000001c0)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r0, @ANYBLOB="00f8ff0000000000b7080000000000007b8af8ff00000000bc82100000000000a6020000f8ffffffb703000008000000b7030000000000000c0000000000000095"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @xdp, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) 1.386313092s ago: executing program 1 (id=3876): bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x3, 0xb, &(0x7f0000000180)=@framed={{}, [@printk={@d, {}, {}, {}, {}, {0x7, 0x0, 0xb, 0x3, 0x0, 0x0, 0x1234}}]}, &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sched_cls, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0xa0) r0 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000240)={0x2, 0x4, 0x8, 0x1, 0x80, 0x0, 0x0, '\x00', 0x0, 0x0}, 0x48) bpf$MAP_UPDATE_CONST_STR(0x2, &(0x7f00000002c0)={{r0, r0}, &(0x7f0000000300), &(0x7f0000000340)='%-010d \x00'}, 0x1c) bpf$BPF_MAP_CONST_STR_FREEZE(0x16, &(0x7f0000000380)={r0, r0}, 0x4) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000003c0)={0x3, 0x10, &(0x7f0000000480)=@framed={{}, [@snprintf={{}, {}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0x1234}, {}, {}, {}, {}, {}, {}, {0x18, 0x3, 0x2, 0x0, r0}}]}, &(0x7f0000000500)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sched_cls, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0xa0) r2 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f0000000540)={0x3, 0x4, 0x4, 0xa, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0}, 0x48) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f00000005c0)={{r2, r2}, &(0x7f0000000600), &(0x7f0000000640)=r1}, 0x1c) bpf$PROG_LOAD(0x5, &(0x7f0000000680)={0x3, 0x8, &(0x7f0000000740)=@framed={{}, [@tail_call={{0x18, 0x2, 0x1, 0x0, r2}, {}, {}, {0x7, 0x0, 0xb, 0x0, 0x0, 0x0, 0x90ffffff}}]}, &(0x7f0000000780)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sched_cls, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0xa0) r3 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f00000007c0)={0x1b, 0x0, 0x0, 0x40000, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0}, 0x48) bpf$PROG_LOAD(0x5, &(0x7f0000000840)={0x3, 0xf, &(0x7f0000000900)=@ringbuf={{}, {{0x18, 0x1, 0x1, 0x0, r3}}, {}, [], {{}, {0x7, 0x0, 0xb, 0x2, 0x0, 0x0, 0x1}, {0x85, 0x0, 0x0, 0x84}}}, &(0x7f0000000980)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sched_cls, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0xa0) bpf$PROG_LOAD(0x5, &(0x7f00000009c0)={0x3, 0x7, &(0x7f0000000a80)=@framed={{}, [@ringbuf_query={{0x18, 0x1, 0x1, 0x0, r3}}]}, &(0x7f0000000ac0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sched_cls, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0xa0) bpf$PROG_LOAD(0x5, &(0x7f0000000b00)={0x3, 0xc, &(0x7f0000000bc0)=@framed={{}, [@ringbuf_output={{0x18, 0x1, 0x1, 0x0, r3}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0x1234}, {}, {}, {}, {}, {0x7, 0x0, 0xb, 0x4, 0x0, 0x0, 0x2}}]}, &(0x7f0000000c40)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sched_cls, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0xa0) 1.376247418s ago: executing program 2 (id=3877): bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x11, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, '\x00', 0x0, @fallback=0x28}, 0x94) r0 = socket$inet6_sctp(0xa, 0x1, 0x84) sendmmsg$inet6(r0, &(0x7f0000002fc0)=[{{&(0x7f0000000340)={0xa, 0x4e23, 0xfffffff9, @dev={0xfe, 0x80, '\x00', 0x36}, 0x9}, 0x1c, &(0x7f00000004c0)=[{&(0x7f00000005c0)}], 0x1}}], 0x1, 0x24000045) sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000900)={0x0, 0x0, &(0x7f00000008c0)={&(0x7f0000000000)=ANY=[@ANYBLOB="d80000001b00010000000000fdfffffffc000000000000000000000000000000200100000000000000000000000000004e240000000000010000000000000000", @ANYRES32=0x0, @ANYRES32, @ANYBLOB="0000000000000000ffffffffffffff7ffcffffffffffffff04000000000000000000000000000000fdffffffffffffff00000000000000000000000000000000050000000000000000000000000000000000000000000000000000000000000006fcffff00000000000003000000000000000000000000000c0008"], 0xd8}}, 0x20008004) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000200)={'bond0\x00', 0x0}) setsockopt$IP6T_SO_SET_REPLACE(0xffffffffffffffff, 0x29, 0x40, &(0x7f0000000780)=@mangle={'mangle\x00', 0x10, 0x6, 0x5a8, 0x428, 0x428, 0x310, 0xe8, 0x428, 0x658, 0x658, 0x658, 0x658, 0x658, 0x6, 0x0, {[{{@uncond, 0x0, 0xa8, 0xe8, 0x0, {0x7a00000000000000}}, @inet=@TPROXY1={0x40, 'TPROXY\x00', 0x1, {0x6, 0x2e95058f, @ipv4=@broadcast, 0x4e24}}}, {{@uncond, 0x0, 0xa8, 0xd0}, @common=@unspec=@NFQUEUE3={0x28, 'NFQUEUE\x00', 0x3, {0x0, 0xfff7, 0x4}}}, {{@ipv6={@private0={0xfc, 0x0, '\x00', 0x1}, @private0={0xfc, 0x0, '\x00', 0x1}, [0xff000000, 0xffffffff, 0x0, 0xffffff00], [0xffffff00, 0xff000000, 0xffffff00, 0xff], 'batadv0\x00', 'pimreg0\x00', {0xff}, {}, 0xc, 0x2, 0x7, 0xc}, 0x0, 0xd0, 0x118, 0x0, {}, [@inet=@rpfilter={{0x28}}]}, @DNPT={0x48, 'DNPT\x00', 0x0, {@ipv6=@rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01', @ipv6=@mcast1}}}, {{@ipv6={@private0, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, [], [], 'veth1\x00', 'ip6gretap0\x00', {}, {}, 0x0, 0x2, 0x0, 0x7c}, 0x0, 0xd0, 0x118, 0x0, {}, [@common=@eui64={{0x28}}]}, @SNPT={0x48, 'SNPT\x00', 0x0, {@ipv4=@local, @ipv4=@multicast1}}}, {{@ipv6={@mcast1, @mcast2, [], [], 'wg1\x00', 'vxcan1\x00', {0xff}, {}, 0x2c}, 0x0, 0xa8, 0xf0}, @SNPT={0x48, 'SNPT\x00', 0x0, {@ipv6=@mcast2, @ipv6=@local}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x608) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000140)={'gretap0\x00', 0x0}) sendmsg$nl_route(r1, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000080)=ANY=[@ANYBLOB="500000001000010400"/20, @ANYRES32=0x0, @ANYBLOB="400d0000000000003000128008000100687372002400028008000200", @ANYRES32=r3, @ANYBLOB="08000100", @ANYRES32=r2], 0x50}, 0x1, 0x0, 0x0, 0x40000}, 0x8000) 1.23351372s ago: executing program 1 (id=3879): r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000000)={0x26, 'hash\x00', 0x0, 0x0, 'xcbc(aes)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000000140)="2c385aa3d49100dc6626c892b6bc436a", 0x10) r1 = accept4(r0, 0x0, 0x0, 0x80800) sendmsg$nl_route(r1, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000500)={&(0x7f0000000700)=ANY=[], 0x18}, 0x1, 0xfff0, 0x0, 0x20048081}, 0x4000004) 1.198205302s ago: executing program 1 (id=3880): r0 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000340)=ANY=[@ANYBLOB="0200000004000000080000000100000080"], 0x48) bpf$BPF_MAP_CONST_STR_FREEZE(0x16, &(0x7f0000000080)={r0, 0xffffffffffffffff}, 0x4) r2 = bpf$PROG_LOAD(0x5, &(0x7f0000000380)={0x16, 0x18, &(0x7f0000000440)=ANY=[@ANYRESOCT=r1, @ANYRES32=r0, @ANYBLOB="0000000000000000b70500000800000085000000b600000095"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x9e1dfbc0cf0a2eb5, 0x0, '\x00', 0x0, @fallback=0x30, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r3 = syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10) sendmsg$netlink(r3, &(0x7f0000001ac0)={0x0, 0x0, &(0x7f0000000080)=[{&(0x7f00000000c0)={0x14, 0x20, 0x301, 0x0, 0x0, "", [@nested={0x4}]}, 0x14}], 0x1}, 0x0) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000640)={r2, 0x0, 0x10, 0x70, &(0x7f00000006c0)="0000000005000000", &(0x7f0000000700)=""/8, 0x2f00, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x4c) r4 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) r5 = bpf$ITER_CREATE(0x21, &(0x7f0000000040), 0x8) r6 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$TUNATTACHFILTER(0xffffffffffffffff, 0x401054d5, &(0x7f0000000040)={0x49, &(0x7f00000000c0)}) bind$bt_hci(r6, &(0x7f0000000000)={0x1f, 0xffffffffffffffff, 0x3}, 0x6) write$bt_hci(r6, &(0x7f0000000040)=ANY=[], 0x6) accept$phonet_pipe(r4, 0x0, 0x0) r7 = socket$alg(0x26, 0x5, 0x0) getsockopt$inet_sctp6_SCTP_EVENTS(r5, 0x84, 0xb, &(0x7f0000000540), &(0x7f0000000580)=0xe) getsockopt$inet_sctp6_SCTP_PRIMARY_ADDR(r5, 0x84, 0x6, &(0x7f0000000180)={0x0, @in6={{0xa, 0x4e22, 0x3, @mcast1, 0x2}}}, &(0x7f00000000c0)=0x84) setsockopt$inet_sctp_SCTP_CONTEXT(r5, 0x84, 0x11, &(0x7f0000000100)={r8, 0x7c6}, 0x8) setsockopt$sock_int(r6, 0x1, 0x29, &(0x7f0000000300)=0x8, 0x4) r9 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f00000007c0)={0x1b, 0x0, 0x0, 0x40000, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0}, 0x50) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x11, &(0x7f0000000580)=@ringbuf={{0x18, 0x0, 0x0, 0x0, 0x8f, 0x0, 0x0, 0x0, 0xb}, {{0x18, 0x1, 0x1, 0x0, r9}, {}, {0x7, 0x0, 0xb, 0x3, 0x0, 0x0, 0x700}, {0x85, 0x0, 0x0, 0x86}}, {}, [@jmp={0x5, 0x1, 0xb, 0xa, 0x0, 0x4}, @jmp={0x5, 0x0, 0xc, 0x0, 0x0, 0xfffffffffffffff4, 0xfffffffffffffff0}], {{}, {0x7, 0x0, 0xb, 0x2, 0x0, 0x0, 0x3}, {0x85, 0x0, 0x0, 0x2a}}}, &(0x7f0000000080)='GPL\x00', 0x3, 0x1000, &(0x7f0000000cc0)=""/4096, 0x41100, 0xe}, 0x94) socketpair(0x1f, 0x800, 0x4, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$ifreq_SIOCGIFINDEX_vcan(r10, 0x8933, &(0x7f0000000280)={'vxcan0\x00', 0x0}) setsockopt$inet_sctp6_SCTP_PR_SUPPORTED(r5, 0x84, 0x71, &(0x7f00000005c0)={r8, 0x7}, 0x8) ioctl$TUNSETIFINDEX(r5, 0x400454da, &(0x7f00000002c0)=r12) r13 = syz_init_net_socket$ax25(0x3, 0x5, 0xc5) ioctl$SIOCAX25ADDUID(r13, 0x89e1, &(0x7f0000000380)={0x3, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x3}, 0xffffffffffffffff}) r14 = socket$alg(0x26, 0x5, 0x0) bind$alg(r14, &(0x7f0000000000)={0x26, 'aead\x00', 0x0, 0x0, 'morus640-generic\x00'}, 0x58) setsockopt$ALG_SET_KEY(r7, 0x117, 0x1, &(0x7f0000000140)="2c385aa3d49100dc6626c892b6bc436a", 0x10) accept4(r11, 0x0, 0x0, 0x80800) 1.01318969s ago: executing program 2 (id=3881): r0 = socket$nl_generic(0x10, 0x3, 0x10) socketpair$tipc(0x1e, 0x5, 0x0, &(0x7f0000000540)={0xffffffffffffffff, 0xffffffffffffffff}) recvmmsg(r2, &(0x7f0000000b80)=[{{0x0, 0x0, &(0x7f0000001a40)=[{&(0x7f0000000340)=""/186, 0xba}, {0x0}, {0x0}, {0x0}, {&(0x7f0000001880)=""/193, 0xc1}], 0x5}, 0x2}, {{&(0x7f0000000480)=@pptp={0x18, 0x2, {0x0, @initdev}}, 0x80, &(0x7f0000000200)=[{&(0x7f0000000580)=""/171, 0xab}, {&(0x7f0000000640)=""/201, 0xc9}, {&(0x7f0000000740)=""/226, 0xe2}, {&(0x7f0000000840)=""/90, 0x5a}], 0x4, &(0x7f0000000500)}, 0x6}, {{&(0x7f00000008c0)=@rc, 0x80, &(0x7f0000000b00)=[{&(0x7f0000000940)=""/95, 0x5f}, {&(0x7f00000009c0)=""/159, 0x9f}, {&(0x7f0000002640)=""/4096, 0x1000}, {&(0x7f0000000a80)=""/87, 0x57}], 0x4, &(0x7f0000000b40)=""/57, 0x39}, 0x4}], 0x3, 0x120, &(0x7f0000002040)={0x0, 0x989680}) sendmmsg$inet(r1, &(0x7f0000001540)=[{{0x0, 0xfffffffffffffda1, 0x0}}], 0x40001b6, 0x0) r3 = syz_genetlink_get_family_id$smc(&(0x7f0000000000), r0) syz_emit_ethernet(0x4e, &(0x7f0000000240)={@local, @remote, @void, {@ipv4={0x800, @tcp={{0x5, 0x4, 0x0, 0x0, 0x40, 0x0, 0x0, 0x0, 0x6, 0x0, @rand_addr=0x64010102, @local}, {{0x0, 0x0, 0x41424344, 0x41424344, 0x0, 0x6, 0xb, 0x0, 0x0, 0x0, 0x0, {[@mss={0x2, 0x4, 0x6}, @md5sig={0x1d, 0x12, "ac3272000000006f00"}]}}}}}}}, 0x0) r4 = syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10) sendmsg$SMC_PNETID_ADD(r4, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000300)={0x34, r3, 0x1, 0x0, 0x0, {}, [@SMC_PNETID_ETHNAME={0x14, 0x2, 'bond0\x00'}, @SMC_PNETID_NAME={0x9, 0x1, 'syz0\x00'}]}, 0x34}}, 0x0) bpf$ENABLE_STATS(0x20, 0x0, 0x0) r5 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_opts(r5, 0x0, 0x8000000000000c, &(0x7f0000000080)='@', 0x1) setsockopt$inet_int(r5, 0x0, 0x8, &(0x7f0000000180)=0x9f7, 0x4) syz_emit_ethernet(0x24a, &(0x7f0000000700)={@broadcast, @multicast, @val={@void, {0x8100, 0x0, 0x0, 0x4}}, {@ipv6={0x86dd, @icmpv6={0x7, 0x6, '\x00', 0x210, 0x3a, 0xff, @ipv4={'\x00', '\xff\xff', @local}, @local, {[], @param_prob={0x4, 0x1, 0x0, 0x9, {0x5, 0x6, "54c03a", 0x402, 0x88, 0x1, @loopback, @rand_addr=' \x01\x00', [@dstopts={0x3a}, @hopopts={0xc, 0x3a, '\x00', [@padn={0x1, 0x4, [0x0, 0x0, 0x0, 0x0]}, @generic={0x2, 0xd8, "4fc4823421498ad5d3c37f1f7f2b84bcb5ab284b52c81287bfa970baf6f0c4cbe1b6a835017215445c63275b28bfd59659a3925be76476d00c84c3f6a70cfbdb5d4bdda03d036bdca7e0fe2790f0fd4f70951b87292108013be8ccc91257100ad48807a7850c43389c827fbf63f4736adb904d25c00844e9f2236b7a9a74606a4a1aa486f3a37e04a7bc86c1adb644e153940d4df1d502f83b463164bac922af8c890af5677408b9c0ff96e6f0f0e768013b8e4ba4a5cf034a01c7c7e84871203519d2cb4429a87336869a0c84fee5bd2c09b00000000000"}, @calipso={0x7, 0x30, {0x2, 0xa, 0xff, 0x7fff, [0x0, 0x0, 0x91bc, 0xffffffffffffffff, 0x3f8000]}}, @hao={0xc9, 0x10, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}}, @calipso={0x7, 0x20, {0x1, 0x6, 0x81, 0x4, [0x401, 0x5, 0x80000000]}}, @generic={0x5, 0x88, "5e75a87691d3f7c94d3f65cb24e0c23624769dfc0fbdca48100798aa757399daaa58e1a1ca561587ac8dfb9daa9e3c4400eec7eb63ce3a0308a9ad2f3c26089411b1bc031c376921514f89ef53508b13ab193c14fa8ac0919594960b7153b2fa62fd60ab29a7a60695fe6f1a5838f255182f0db9c932f4b7ffdf162f8eba0a7ff9f8319c938f607e"}]}]}}}}}}}, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000000c0)={&(0x7f0000000040)='kfree\x00'}, 0x18) r6 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='memory.events\x00', 0x275a, 0x0) write$cgroup_subtree(r6, &(0x7f0000000000)=ANY=[], 0x3261e) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x2000001, 0x12, r6, 0x0) getsockopt$inet_opts(r5, 0x0, 0x9, 0xffffffffffffffff, &(0x7f00000000c0)) r7 = bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x3, 0xe, &(0x7f0000001b80)=ANY=[@ANYBLOB="b702000000000000bfa300000000000007030000f0ffffff7a0af0ff0200000079a4f0ff00000000b706000000000081ad64020000000000450404000100ff0f1704000001130a00b7050000010000006a0af2fe000000008500000042000000b700000000000010950000000000000000e154cd8445974b26c933f7ffffffffe4fbffffff55bb2007ee51050512b5b42128aa090a79507df79f298129daa7a6b2f91af50342115e17392ac627c87881c000006146001e04aeacea799a22a2fa798b5adc43eb27d53319d0ad229e5752548300000000dbc2777df150b7cdd77b85b941092314fd085f028f2ed1a4535550614e09d6378198a6097a670838337af2abd55a87ac0394b2f92ffab7d153d62058d0a413b2173619ccf55520f22c9ca8b6712f3024b7041b1df65b3e1b9bf115646d14ce53d13d0ccacda1ef0900094fa737c28b99938512c816fdcceaede3faedc51d29a47fc813a2ec00f4c7a53ac271d6d7f4ea6bf97f2f33e2ea2e534300bcb3fdc4b4861004eefbda7f54f82a804da4f85db47a4a69bf9bc5fa96ee293fbd165a5a68488e40b030166565a097b1b44b451de736bb6d43db8db03d4b7745fef1d04ec633dee254a6d491b849a5a787e814c4fd21a18986252a70f8f92eb6f0e8c7db4bf23242a1f2c28159f09943b1b0452d1b72183aacf4a84f9130b775dd4e9e3070756f97ad791fa99dac06b57479321a0574fb30ff0000001989328c8ddc20ea011bf5742e0e0d4334db8b20ce3f9f16cb7fc20fb4791ec85821d0c48fb657c29b309c73f0977e7cde65a82b94c461d7962b0d2277a84af326f37f3e2c25a61ec45c3af97a8f17da954aff3fc8c108755f75ca13fb7c8bbd8b6e7dac1aba4b20dc7de058a4dfa7e85a8bdf1d41a2d8bda74d66f47cc180f82c5f573c6d294d3665016ac59dda0fde4745db06753a7ac74a2d32f7528751313694bf5700b20ef0c248ddd3da32396a614cacad4aff2066bb5d4045c958559b7dcb98a6273b8c651e24d9f679e4fbe948dfb4cc4a389469608241730459f0123fd39206000000000000eb55dad46de56ef907b059b90b8aa49afb9a79ae5498f6589880ed6eea7f9c670012be05e7de0940313c5870786554df26236ebced9390cb6941b8375d936a7d2120eca291963eb2d537d8ee4de5c183c960119451c31539b22809e1d7f0cda06a9fa87d64cb77872a2cd8a104e16bb1a2bacf13464ca03aff14a9aa4bd9539f5096412b92012e095b84c20243ff98df3347f0e399d1b9f27e3c33269c0e153b28b2d4410572bc45b9d3fa02208d304d455c36300000000022320178b00cc6ed7966130b547dbf8b497af002000000cd1d00000020000000ef19349ee7f31abc11c800000000000000000000000928ee53595a779d243a48cea769470424d28804c04b2c4324ab7f4a5c81921f0128dfd70b438af60b060000000000000056642b49b745f3bf2c4af38ffb7d748308eea09fc361b4735efbf3411718d6ee7aebf9ef679dbfae9fb4a79f8a836801ed3a1079b0282a12043408cd60b687dcff91af19010000000000000000456f7d2a42bd13da202274f20675eb781925441578e93046aaddea8ec4ca37f71c2710a7ea8ae0dc214e1cc275b26adfa892e6de92000000000000000000ddff004cff9ec7ffff35e62f4eeee50e5bafecea4d4134f9d006c8d6883eca5c9c58c9e93311ab5009c68c73de2f04f15d005387577f480000ea65559eb00e76e9d0ada201bcbb5c252b28a60ca770663da451790cc36000906d5a9fad98c308e39bd5ffb6151d79c1cee1cd102e3c8e63e9fba05e3633be3f00000015762e5f5a3a0bc33fdbe28a5ffc83f2b485185cc92fe7f791e8f6429309d6adab4b7e508e5bf024ed8f8a005f2bbf96c89739f5cf1e750d50517a59a3ad09e8802e8f4f535447cc0fc9d5f99a73145dfcedad69da9cd4375c624600e78f4458542b14f29611f95d4a31838eeb20c20bb82aa31771cd379ec83554cea5e6539db7384e1f58d81f2f2653c4d9818708e27c89b552d7fcd116bce9c764c714c9402c21d181aac59efb28d4f91652f6750b6ec962802c0320f8059195729d60c534ee8e8ff0755b67fe4c25edb85bcff24c757aa8090000000000008c420eb4304f66e3a37aaf000000c42a570f0e9dd5fd545470f862f8c3c14fa9ecd1e877b0d8ca84c044859e85e6158f9184bc61a9a284db80e4636c25b96174327d82761c26e329555f9290af4100000000000000749efd3763655500344bae34137f5ab0d534b8d63e4ca3b671f2de1cdf519192c6b59a601fd419adc16e2055b85058f793484305d7a1759782e4c571ee855a47bc00edf5e9020c09ab004321610b857e8717764b633b21cb32f0eb3280e09758bd445ab91d20baca005452b79d7b574a247f1d2fe45b3c4e93da3d51de647c10dd49944dc87c92332af00f191b66b6a6f732a91f0e2e9120be61e58c79d497247d278888901d442ad7f8536605a644e9e3d769db497c3960dfde12182334caee994adc38a436367a54b9e182b78e9a0ceb9a2c4f63902c1ad1a7c5a08d09a0a23c2a86abbdf357849a651733e57f31019876026888c8ccb85c86b4f8ffffff7f000000002c331fca0e541b7ca211c28ed61c525708a13d115b43f8b1894c8fa8a14dc4810f61ae96bf704526a8919bc700002100000000000000000001000027c9a46157a3609b6fd9843ee19ec647249a9375de5858818f3c4a4fa6ce46f4d42b07199de8b99231ace58c77819ee214e49666c464d35ca9b5143ed3b3dc8c17a23692759ccf5a205311b7ab22532697b861dfb54609fd88e6043bd52ae84c1bb0c8a6c769f952283a1f4e3842edb3d42c68a27ef6a1296dfff4a979369b0e8ebc62887aa46e820a74f91381ccc198e353047db70686d147357024eb3cb94f1e89cb5ba0a56aa046b4dc521a3d9356b4b8b5917c4c860495b240e80063bde261fd00000000007271e28ef6806bc8e139c49b91c76bea3858f78fbd8d31330d89069f9648a2ff93060ff073b3a113e47edf76f7d116d2b0976cf2ec447c030931651dd315003b7a6a5433a2bb3c035fc6846abe389b25c988f0bbb889560ae99ec4b227eda2e63a1c31a2c2bd48a822cbe92b6524e0cd8020ecaa34e19e7141d5e221509342bfe7d294d1eb3de6a504a0301f89c2ee627e949c68b3a4a426a9b7d503a26e9a714ee5f72d8805dd1bfbd081f6a5d1f1289dfe14cb9194e26a44fac273461fc5c0e0a33db7f2d43ea8086cf059f40fa2640b6bfb74dd35f5a31059c01517cf4b6641fce9a24b96767b837ca037a1199735c375c705c798e0e208e4a5259d0bfa526b462af45a6eab34000000000000000000000000c4426344ec1a3366515dee221e747f55d7dd02534bc503b9b28277c253e410986bef2111a99cc448d652929f8a67a6a1d3f00dcad91aff428aade3f85714a1d3ef29acd4d49b62339c10c2ec0dac4728288e78980c1184d8223edbccbf9258b7374e79a1f8bf3fb73cfd1e76982f3d899f71e4a9f0ba8c6dbb7bbdfc399847a11921f97eba0ea14c4fed9a71eedb97c02461792e3a49dac16c60c3fcaab222025d78963c3ac899fa8b63f58a30212c9b2d7fe751e2046b78f86e22861b6504c667350244dd6d9189a8b9c45f8aaff9db694811ca86ed978f23eed7459c0382074170cf1e25b0e9ba3d1cc309353eea4cd8ab96bafda393276bdd8d32ead8db9e1b54d2d3d50e2815268fc1a6ec566981bc8ca2a4583f3d40e817433d0f4f25cfe6cc1897449ba5f26a9d66ac73e6f5c401376f23a314e0b9ff997d22f3e34b7524642c248aa813edaa626f000000"], &(0x7f0000000140)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sched_cls, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0xffffffffffffffaf, 0x10, &(0x7f0000000040)}, 0x4e) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000400)={r7, 0x0, 0xe, 0x0, &(0x7f00000002c0)="69d387051eaf71a0486e5c660000", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) sendmsg$SMC_PNETID_DEL(r4, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000c40)=ANY=[@ANYBLOB="14000000", @ANYRES16=r3, @ANYBLOB="270e2800000004070200000000008c055227d5d0440f91dc0d159ff6a0dcac30088c8af2c6dbb7514663e09d1598cd0a3df1050a48e129639a30d937ccc32401dc54f68c242a86e6e9ec48d6e3d3baf84580315c984cadedd3c89da44aa8affb46ca2087c9ccefd1b834d01e59c86ebf8cddbced484e0fc5f86c364499296f13dd991e4d8c10c9ab03fbaad9e0ea91a743b12663dd159856ee373d6691be6c18f5c75c8da82d53cd22352b10024467ee73cddd3ecd5e21be7c3308662e86cf94fbd7d69c881a25c5c95c7ef10e8af0e060ec36cd6a1e0121d5e96527621f417dba63b0c53d99ec9cf4f98ca81316bf342bc619c5f16de41f7ef4377e424b6ff971bff1b161ee4f5d"], 0x14}, 0x1, 0x40030000000000}, 0x4000) socket$kcm(0x29, 0x2, 0x0) ioctl$TUNSETLINK(0xffffffffffffffff, 0x400454cd, 0x102) ioctl$sock_kcm_SIOCKCMUNATTACH(r6, 0x89e1, &(0x7f0000000500)={r6}) 818.516295ms ago: executing program 0 (id=3882): r0 = socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt$inet_sctp6_SCTP_PEER_ADDR_THLDS(r0, 0x84, 0x84, &(0x7f00000000c0)={0x0, @in6={{0xa, 0x4e21, 0xfffffff9, @empty, 0x40}}, 0x9, 0x4000}, 0x90) ioctl$FIGETBSZ(r0, 0x2, &(0x7f0000000040)) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) r2 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_fanout(r2, 0x107, 0x12, &(0x7f0000000040)={0x0, 0x6}, 0x4) setsockopt$packet_fanout_data(r2, 0x107, 0x16, &(0x7f0000000100)={0x3, &(0x7f0000000080)=[{0x28, 0x0, 0x0, 0xfffff034}, {0x40, 0x83, 0x0, 0x80000001}, {0x6, 0x5, 0x0, 0xfffffc}]}, 0x10) sendmsg$ETHTOOL_MSG_CHANNELS_SET(0xffffffffffffffff, 0x0, 0x4000854) r3 = socket$kcm(0x2, 0xa, 0x2) socket$can_raw(0x1d, 0x3, 0x1) ioctl$SIOCSIFHWADDR(r3, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local}) write$tun(r1, &(0x7f00000003c0)=ANY=[@ANYBLOB="0800080003000000000014000000456d00300066000107"], 0x3e) connect$inet6(r0, &(0x7f0000000000)={0xa, 0x4e24, 0x10001, @remote, 0x4}, 0x1c) 684.831517ms ago: executing program 3 (id=3884): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000b00)=ANY=[@ANYBLOB="140000001000010000000000000000000000020a20000000000a03000000000000000000010000000900010073797a30000000006c000000090a010400000000000000000100000008000a40000000000900020073797a32000000000900010073797a30000000000800054000000021300011800b00010074617267657400002000028005000300c4000000080002400000000009000100534e4154"], 0xb4}}, 0x0) 626.334192ms ago: executing program 3 (id=3885): bpf$PROG_LOAD(0x5, 0x0, 0x0) socket$inet_icmp_raw(0x2, 0x3, 0x1) r0 = openat$nci(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) ioctl$IOCTL_GET_NCIDEV_IDX(r0, 0x0, &(0x7f00000000c0)=0x0) sendmsg$NFC_CMD_DEV_UP(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000740)=ANY=[@ANYBLOB="1c000000", @ANYRES16, @ANYBLOB="010026bd70003c0200000200000008000100", @ANYRES32=r2], 0x1c}}, 0x0) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) syz_init_net_socket$nfc_raw(0x27, 0x3, 0x0) ioctl$IOCTL_GET_NCIDEV_IDX(0xffffffffffffffff, 0x0, &(0x7f00000000c0)) write$nci(r0, &(0x7f0000001800)=ANY=[@ANYBLOB="7240082b0102020681055a03997713"], 0x16) socket$inet6_tcp(0xa, 0x1, 0x0) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000000)={'gretap0\x00', &(0x7f0000000100)=@ethtool_wolinfo={0x6, 0x9, 0x3, "746478bdfd09"}}) socket$pppl2tp(0x18, 0x1, 0x1) r3 = socket$inet6_udp(0xa, 0x2, 0x0) connect$inet6(r3, &(0x7f0000000080)={0xa, 0x4e21, 0x0, @loopback}, 0x1c) r4 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$ieee802154(&(0x7f0000000080), r4) ioctl$sock_SIOCGIFINDEX_802154(r4, 0x8933, &(0x7f00000000c0)={'wpan1\x00'}) sendmsg$IEEE802154_LLSEC_DEL_SECLEVEL(r1, 0x0, 0x14000) r5 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$L2TP_CMD_SESSION_DELETE(r5, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000c00)=ANY=[@ANYRES8=r1, @ANYRES16, @ANYBLOB="01002cbd7000040000000500000008001800ac14141a08000c00a80a0000060001000500000008000b0004000000ce8096876184772f7bd285308dc695b830e9e228f7f45a2ea6769f8384f6a085f1c94e8cb274735a293b2e6191356b80950770f94751942bafb143d577a8a023c8b1a174b655cc80b74f91aed69f283809afb1fe29a48da8c7a93ca465da17f977043f7d046ea473c8700503"], 0x34}, 0x1, 0x0, 0x0, 0x4c805}, 0x20000084) socket$nl_route(0x10, 0x3, 0x0) r6 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r6, &(0x7f00000037c0)={0x0, 0x0, &(0x7f0000003780)={&(0x7f0000000340)=@newtaction={0x898, 0x30, 0x12f, 0x0, 0x0, {}, [{0x884, 0x1, [@m_police={0x880, 0x1, 0x0, 0x0, {{0xb}, {0x854, 0x2, 0x0, 0x1, [[@TCA_POLICE_PEAKRATE={0x404, 0x3, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7]}], [@TCA_POLICE_RATE={0x404, 0x2, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4bd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffc, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x63]}, @TCA_POLICE_TBF={0x3c, 0x1, {0x0, 0x0, 0x0, 0x0, 0x2000, {0x7, 0x0, 0x0, 0x0, 0x0, 0x7}, {0x7, 0x0, 0x0, 0x0, 0x0, 0x7}}}], [@TCA_POLICE_PEAKRATE64={0xc}]]}, {0x4}, {0xc, 0xb}, {0xc, 0xa, {0x0, 0x1}}}}]}]}, 0x898}}, 0x0) 560.677953ms ago: executing program 4 (id=3886): r0 = socket$nl_crypto(0x10, 0x3, 0x15) sendmsg$nl_crypto(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000b80)=ANY=[@ANYBLOB="e8000000100001002dbd7000fddbdf257874732874776f666973682900000000000000000000000000000baa03612ce73e75780d2c6e0e57c900000000000000000000000000000000000003000000000000000000000000000000002000"/123], 0xe8}, 0x1, 0x0, 0x0, 0x44}, 0x80) 346.628465ms ago: executing program 4 (id=3887): syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) socket$nl_netfilter(0x10, 0x3, 0xc) socket$packet(0x11, 0x2, 0x300) r0 = socket$kcm(0x10, 0x2, 0x0) syz_init_net_socket$bt_l2cap(0x1f, 0x5, 0x0) mmap(&(0x7f0000691000/0x4000)=nil, 0x4000, 0x3, 0x28011, 0xffffffffffffffff, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x275a, 0x0) mmap(&(0x7f0000497000/0x2000)=nil, 0x2000, 0x2000002, 0x13, r1, 0x1000) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) mmap(&(0x7f00004f1000/0x3000)=nil, 0x3000, 0x2000006, 0x12, r2, 0x913e0000) r3 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)=@base={0x19, 0x4, 0x4, 0x2, 0x0, 0x1}, 0x48) bpf$MAP_GET_NEXT_KEY(0x2, &(0x7f0000000240)={r3, &(0x7f0000000280)="ca", &(0x7f0000000000)=""/3, 0x2}, 0x20) bpf$MAP_GET_NEXT_KEY(0x2, &(0x7f0000000240)={r3, &(0x7f0000000140), &(0x7f0000000000)=""/6, 0x2}, 0x20) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$kcm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)=[{&(0x7f00000002c0)="2e00000011008108090f9becdb4cb92e264831371900000069bd6efb2502eaf60d002700020400bf050005001201e5ff9e584eb1aa3d10e3dff9f8e583de3a48e95f3b1ef28da212fb3a0d2e2bba5a", 0x4f}], 0x1}, 0x48000) 334.5245ms ago: executing program 3 (id=3888): r0 = bpf$MAP_CREATE_CONST_STR(0x0, 0x0, 0x48) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r2, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000100)={0x0, 0x24}}, 0x0) bpf$MAP_CREATE(0x0, &(0x7f0000000500)=ANY=[@ANYRESOCT=r2, @ANYRES16=r2, @ANYRES64=r0, @ANYRES32=0x0, @ANYRESDEC=r0, @ANYBLOB="0000000000000200000000ffffffff00000000000000000004000000"], 0x48) getsockname$packet(r2, &(0x7f0000000080)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000000c0)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000008c0)=ANY=[@ANYBLOB="4800000010000507000000000000000016000000", @ANYRES32=r3, @ANYBLOB="0000000200000000280012000c00010076657468"], 0x48}}, 0x0) sendmsg$nl_route_sched(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000140)=@newqdisc={0x30, 0x24, 0xf1d, 0x0, 0x0, {0x0, 0x0, 0x0, r3, {0x0, 0xffff}, {0xfff1, 0xffff}}, [@qdisc_kind_options=@q_clsact={0xb}]}, 0x30}}, 0x0) r4 = socket$nl_route(0x10, 0x3, 0x0) r5 = socket(0x10, 0x803, 0x4) syz_genetlink_get_family_id$nl80211(&(0x7f0000000380), r5) getsockname$packet(r5, &(0x7f0000000180)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000001c0)=0x14) sendmsg$nl_route_sched(r4, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000300)={&(0x7f00000003c0)=@delchain={0x3c, 0x2c, 0xf31, 0x80, 0x2000, {0x0, 0x0, 0x0, r6, {0x4ecd559dfb18213}, {0x0, 0xffff}, {0x4, 0x1}}, [@filter_kind_options=@f_flower={{0xb}, {0xc, 0x2, [@TCA_FLOWER_FLAGS={0x8, 0x16, 0x3}]}}]}, 0x3c}, 0x1, 0x0, 0x0, 0x4008844}, 0x4010) 236.823617ms ago: executing program 4 (id=3889): r0 = socket(0x22, 0x2, 0x3) sendmsg$NFT_BATCH(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000080)={0x0}, 0x1, 0x0, 0x0, 0x80}, 0x24000805) r1 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000ac0)={0x18, 0x5, &(0x7f0000000000)=ANY=[@ANYBLOB="180100002100000000000000000000008500000075000000a50000002300000095"], &(0x7f0000000180)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x80}, 0x94) ioctl$sock_TIOCINQ(r0, 0x541b, &(0x7f0000000040)) r2 = openat$tun(0xffffffffffffff9c, &(0x7f00000000c0), 0x12040, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) r4 = socket$nl_route(0x10, 0x3, 0x0) r5 = socket$inet6_udplite(0xa, 0x2, 0x88) sendmmsg$inet6(r5, &(0x7f0000007e40)=[{{&(0x7f0000000340)={0xa, 0x4e20, 0x0, @dev}, 0x18, 0x0}}], 0x6c00, 0x48) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r4, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000380)=@newqdisc={0x4c, 0x24, 0x4ee4e6a52ff56541, 0x0, 0x25dfdbff, {0x0, 0x0, 0x0, r6, {0x0, 0xb}, {0xffff, 0xffff}, {0x0, 0xfff3}}, [@qdisc_kind_options=@q_netem={{0xa}, {0x1c, 0x2, {{0x100, 0x7, 0x6361, 0x5, 0xffffffed, 0x6}}}}]}, 0x4c}, 0x1, 0x0, 0x0, 0x20000001}, 0x810) sendmsg$nl_route_sched(r3, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000300)=@newqdisc={0x78, 0x24, 0x4ee4e6a52ff56541, 0x70b923, 0x7fffe, {0x0, 0x0, 0x0, r6, {}, {0xb, 0xb}, {0x2, 0xb}}, [@qdisc_kind_options=@q_sfq={{0x8}, {0x4c, 0x2, {{0x80, 0x808, 0x205, 0x1, 0xc}, 0xb, 0x0, 0x5, 0x5, 0x9, 0x2, 0x9, 0xd, 0x1, 0x1, {0xffff1c72, 0x3, 0x1000, 0xfd, 0xfffffffe, 0x7583}}}}]}, 0x78}}, 0x8000) ioctl$TUNSETIFINDEX(r2, 0x400454da, &(0x7f0000000200)=r6) r7 = bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000100)={&(0x7f00000001c0)='mmap_lock_acquire_returned\x00', r1}, 0x10) bpf$OBJ_PIN_MAP(0x6, &(0x7f0000000140)=@o_path={0x0, r7}, 0x18) 195.186885ms ago: executing program 3 (id=3890): r0 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(r0, 0x89f1, &(0x7f0000000440)={'tunl0\x00', &(0x7f0000000400)={'syztnl0\x00', 0x0, 0x0, 0x20, 0x0, 0x4, {{0x5, 0x4, 0x0, 0x0, 0x14, 0x0, 0x0, 0x0, 0x0, 0x0, @loopback, @rand_addr=0x64010101}}}}) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(r0, 0x89f3, &(0x7f0000000240)={'syztnl0\x00', &(0x7f0000000140)={'gretap0\x00', 0x0, 0x7800, 0xe0, 0x0, 0x8f2, {{0x5, 0x4, 0x0, 0x0, 0x14, 0x0, 0x0, 0x0, 0x0, 0x0, @loopback, @empty}}}}) 70.72432ms ago: executing program 3 (id=3891): r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000000)={0x26, 'hash\x00', 0x0, 0x0, 'xcbc(aes)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000000140)="2c385aa3d49100dc6626c892b6bc436a", 0x10) r1 = accept4(r0, 0x0, 0x0, 0x80800) sendmsg$nl_route(r1, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000500)={&(0x7f0000000700)=ANY=[], 0x18}, 0x1, 0x50000, 0x0, 0x20048081}, 0x4000004) 70.371932ms ago: executing program 4 (id=3892): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000b00)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a03000000000000000000010000000900010073797a30000000006c000000090a010400000000000000000100000008000a40000000000900020073797a32000000000900010073797a30000000000800054000000021300011800b00010074617267657400002000028005000300c400000008000240000000"], 0xb4}}, 0x0) 68.936464ms ago: executing program 1 (id=3893): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) (async) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000001c0)={&(0x7f00000000c0)=ANY=[@ANYBLOB="9feb0100"], 0x0, 0x58, 0x0, 0xa}, 0x28) r1 = socket$inet6_sctp(0xa, 0x5, 0x84) (async, rerun: 32) r2 = socket$inet_tcp(0x2, 0x1, 0x0) (rerun: 32) shutdown(r2, 0x0) (async, rerun: 64) listen(r2, 0x0) (rerun: 64) r3 = bpf$MAP_CREATE(0x0, &(0x7f0000000200)=@base={0xf, 0x4, 0x4, 0x12}, 0x48) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000280)={r3, &(0x7f0000000340), &(0x7f0000000040)=@tcp=r2}, 0x20) (async, rerun: 64) recvmmsg(r2, &(0x7f0000002bc0)=[{{0x0, 0x0, &(0x7f0000000080)=[{&(0x7f0000000300)=""/4096, 0x1000}], 0x1}}], 0x1, 0x10051, 0x0) (async, rerun: 64) bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="04000000040000000400000005"], 0x48) (async, rerun: 32) r4 = bpf$MAP_CREATE(0x0, &(0x7f0000000640)=ANY=[@ANYBLOB="170000000000000004000000ff"], 0x48) (rerun: 32) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000300)={0x3, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r4, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000005900000095"], 0x0}, 0x94) (async, rerun: 64) r5 = bpf$PROG_LOAD(0x5, &(0x7f00000005c0)={0x18, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) (rerun: 64) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000001c0)={&(0x7f0000000040)='page_pool_release\x00', r5}, 0x10) r6 = bpf$PROG_LOAD(0x5, &(0x7f00000005c0)={0x18, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000001c0)={&(0x7f0000000040)='page_pool_release\x00', r6}, 0x10) r7 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="0e"], 0x48) r8 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x6, 0xc, &(0x7f00000001c0)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r7, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bc82000000000000a6020000f8ffffffb703000008000000b703000000000000850000003300000095"], &(0x7f0000000180)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @xdp, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000500)={r8, 0x18000000000002a0, 0xe, 0x0, &(0x7f0000000300)="b9ff030768f1258c989e14f05c71", 0x0, 0x2, 0x60000000, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x50) (async) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r1, 0x84, 0x6f, &(0x7f0000000040)={0x0, 0x10, &(0x7f0000000000)=[@in={0x2, 0x0, @private=0xa010101}]}, &(0x7f0000000080)=0x10) (async) getsockopt$inet_sctp6_SCTP_GET_ASSOC_ID_LIST(r1, 0x84, 0x1d, &(0x7f0000000140), &(0x7f0000000240)=0x4) (async) setsockopt$inet6_tcp_int(r0, 0x6, 0x2000000000000020, &(0x7f0000000040)=0xa, 0x1959cc36) socket$nl_generic(0x10, 0x3, 0x10) r9 = bpf$MAP_CREATE(0x0, &(0x7f0000000c80)=ANY=[@ANYBLOB, @ANYRES32=0x1, @ANYBLOB="0500"/20, @ANYRES32=0x0, @ANYRES32, @ANYBLOB='\x00'/28], 0x50) bpf$MAP_LOOKUP_BATCH(0x18, &(0x7f0000000240)={&(0x7f0000000040), 0x0, 0x0, 0x0, 0x2000, r9}, 0x38) syz_genetlink_get_family_id$team(&(0x7f0000000100), 0xffffffffffffffff) (async) r10 = socket$nl_generic(0x10, 0x3, 0x10) r11 = syz_genetlink_get_family_id$team(&(0x7f0000000100), 0xffffffffffffffff) (async) ioctl$ifreq_SIOCGIFINDEX_team(r10, 0x8933, &(0x7f0000000040)={'team0\x00', 0x0}) sendmsg$TEAM_CMD_OPTIONS_SET(r10, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000002c0)={0x20, r11, 0x1, 0x0, 0x25dfdc01, {}, [{{0x8, 0x1, r12}, {0x4}}]}, 0x20}}, 0x40000) 704.822µs ago: executing program 3 (id=3894): r0 = socket$caif_stream(0x25, 0x1, 0x3) r1 = socket(0x40000000015, 0x5, 0x0) setsockopt$sock_int(r1, 0x1, 0x23, &(0x7f0000000000)=0x2, 0x4) bind$inet(r1, &(0x7f00008a5ff0)={0x2, 0x0, @loopback}, 0x10) syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8933, 0x0) r2 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL80211_CMD_REGISTER_FRAME(r2, 0x0, 0x0) recvmmsg(r1, &(0x7f00000040c0)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0) sendto$inet(r1, 0x0, 0x0, 0x0, &(0x7f0000000200)={0x2, 0x0, @loopback}, 0x10) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0xb, 0x12, r0, 0x0) 0s ago: executing program 2 (id=3895): syz_emit_ethernet(0x22, &(0x7f0000000280)={@local, @empty, @void, {@llc={0x4, {@snap={0xab, 0xaa, "d0", "b23386", 0x806, "ff17b1fb8fb2e63d3cc570b3"}}}}}, 0x0) sendmsg$NFT_BATCH(0xffffffffffffffff, 0x0, 0x0) bpf$MAP_CREATE(0x0, 0x0, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000004c0)={&(0x7f0000000240)=ANY=[@ANYBLOB="640000001000ffff25bd7000fddbdf2500000000", @ANYRES32=0x0, @ANYBLOB="7a0a0500212b0000440012800b000100697036746e6c000034000280140003000000000000000000000800000000003f14000200fe80000000000000000000002001000f08000100", @ANYBLOB='#'], 0x64}}, 0x24000000) kernel console output (not intermixed with test programs): ] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 390.737915][T15387] team0: Port device team_slave_0 added [ 390.761715][T15387] team0: Port device team_slave_1 added [ 390.898408][T15387] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 390.924246][T15387] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 390.983652][T15387] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 390.983687][T15487] netlink: 8 bytes leftover after parsing attributes in process `syz.1.2786'. [ 391.016235][T15486] Bluetooth: MGMT ver 1.23 [ 391.120262][T15387] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 391.124731][T15486] netlink: 4 bytes leftover after parsing attributes in process `syz.4.2787'. [ 391.131574][T15387] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 391.162938][T15387] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 391.308376][T15387] hsr_slave_0: entered promiscuous mode [ 391.325721][T15387] hsr_slave_1: entered promiscuous mode [ 391.336322][T15387] debugfs: 'hsr0' already exists in 'hsr' [ 391.342070][T15387] Cannot create hsr debugfs directory [ 391.352599][T15486] netlink: 16 bytes leftover after parsing attributes in process `syz.4.2787'. [ 391.438132][ C0] vcan0: j1939_tp_rxtimer: 0xffff88805c4cbc00: rx timeout, send abort [ 391.514214][ T5840] Bluetooth: hci0: command tx timeout [ 391.932651][T15531] netlink: 8 bytes leftover after parsing attributes in process `syz.2.2798'. [ 391.941717][ C0] vcan0: j1939_tp_rxtimer: 0xffff88805c4cb800: rx timeout, send abort [ 391.950220][ C0] vcan0: j1939_tp_rxtimer: 0xffff88805c4cbc00: abort rx timeout. Force session deactivation [ 391.994354][ C0] ip6_tunnel: ip6gretap5 xmit: Local address not yet configured! [ 392.268017][T15387] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 392.288312][T15387] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 392.315689][T15543] batadv_slave_0: entered promiscuous mode [ 392.321653][T15543] batadv_slave_0: entered allmulticast mode [ 392.334765][T15387] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 392.374729][T15387] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 392.441791][ C0] vcan0: j1939_tp_rxtimer: 0xffff88805c4cb800: abort rx timeout. Force session deactivation [ 392.514275][T15544] netlink: 'syz.3.2800': attribute type 10 has an invalid length. [ 392.522264][T15544] netlink: 2 bytes leftover after parsing attributes in process `syz.3.2800'. [ 392.713813][T15557] netlink: 80 bytes leftover after parsing attributes in process `syz.1.2804'. [ 392.737535][T15387] 8021q: adding VLAN 0 to HW filter on device bond0 [ 392.789781][T15387] 8021q: adding VLAN 0 to HW filter on device team0 [ 392.835353][T10175] bridge0: port 1(bridge_slave_0) entered blocking state [ 392.842566][T10175] bridge0: port 1(bridge_slave_0) entered forwarding state [ 392.883473][T10175] bridge0: port 2(bridge_slave_1) entered blocking state [ 392.890700][T10175] bridge0: port 2(bridge_slave_1) entered forwarding state [ 393.595765][ T5840] Bluetooth: hci0: command tx timeout [ 393.690610][T15387] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 393.822414][T15387] veth0_vlan: entered promiscuous mode [ 393.849244][T15387] veth1_vlan: entered promiscuous mode [ 393.917968][T15387] veth0_macvtap: entered promiscuous mode [ 393.935786][T15589] netlink: 'syz.1.2815': attribute type 4 has an invalid length. [ 393.956766][T15387] veth1_macvtap: entered promiscuous mode [ 394.042133][T15387] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 394.061769][T15387] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 394.082552][T15592] syzkaller0: tun_chr_ioctl cmd 1074025677 [ 394.093169][T15592] syzkaller0: linktype set to 780 [ 394.118011][ T8580] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 394.142990][ T8580] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 394.220054][ T8580] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 394.237548][ T8580] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 394.385032][ T8580] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 394.404828][ T8580] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 394.491135][ T8580] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 394.516543][ T8580] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 394.667482][T15641] xt_l2tp: v2 doesn't support IP mode [ 395.109223][T15670] netlink: 'syz.1.2836': attribute type 1 has an invalid length. [ 395.187308][T15670] bond3: (slave vxcan1): The slave device specified does not support setting the MAC address [ 395.199899][T15670] bond3: (slave vxcan1): Error -95 calling set_mac_address [ 395.218308][T15675] nbd: device at index 64 is going down [ 395.277942][T15679] bond3: (slave gretap1): making interface the new active one [ 395.288695][T15679] bond3: (slave gretap1): Enslaving as an active interface with an up link [ 395.297868][ T5931] hid-generic 0005:0002:5508.0001: hidraw0: BLUETOOTH HID vc3.38 Device [syz0] on aa:aa:aa:aa:aa:aa [ 395.322900][T15670] macvlan4: entered promiscuous mode [ 395.330931][T15670] macvlan4: entered allmulticast mode [ 395.339218][T15670] bond3: entered promiscuous mode [ 395.346336][T15670] gretap1: entered promiscuous mode [ 395.352813][T15670] 8021q: adding VLAN 0 to HW filter on device macvlan4 [ 395.384837][T15670] bond3: (slave macvlan4): the slave hw address is in use by the bond; giving it the hw address of gretap1 [ 395.413654][T15670] bond3: left promiscuous mode [ 395.420835][T15682] netlink: 'syz.2.2838': attribute type 1 has an invalid length. [ 395.429328][T15670] gretap1: left promiscuous mode [ 395.464067][T15682] netlink: 'syz.2.2838': attribute type 1 has an invalid length. [ 395.489465][T15682] __nla_validate_parse: 11 callbacks suppressed [ 395.489478][T15682] netlink: 9172 bytes leftover after parsing attributes in process `syz.2.2838'. [ 395.522057][T15689] netlink: 68 bytes leftover after parsing attributes in process `syz.3.2839'. [ 395.601743][T15695] x_tables: ip_tables: osf match: only valid for protocol 6 [ 395.680378][T15388] Bluetooth: hci0: command tx timeout [ 395.730823][T15699] netlink: 8 bytes leftover after parsing attributes in process `syz.3.2842'. [ 395.948321][T15700] sctp: [Deprecated]: syz.2.2841 (pid 15700) Use of int in maxseg socket option. [ 395.948321][T15700] Use struct sctp_assoc_value instead [ 395.964820][T15700] netlink: 4 bytes leftover after parsing attributes in process `syz.2.2841'. [ 396.144537][T15712] netlink: 'syz.3.2845': attribute type 8 has an invalid length. [ 396.159036][T15712] netlink: 4 bytes leftover after parsing attributes in process `syz.3.2845'. [ 396.180030][T15711] net_ratelimit: 12 callbacks suppressed [ 396.180040][T15711] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 396.366515][T15715] netlink: 16 bytes leftover after parsing attributes in process `syz.0.2847'. [ 396.498882][T15720] syzkaller0: entered promiscuous mode [ 396.504826][T15720] syzkaller0: entered allmulticast mode [ 397.203515][T15749] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 397.298187][T15752] netlink: 8 bytes leftover after parsing attributes in process `syz.1.2859'. [ 397.371784][T15756] syzkaller0: tun_chr_ioctl cmd 1074025677 [ 397.378078][T15756] syzkaller0: linktype set to 780 [ 397.437430][T15765] netlink: 4 bytes leftover after parsing attributes in process `syz.1.2861'. [ 397.550859][T15773] netlink: 4 bytes leftover after parsing attributes in process `syz.1.2861'. [ 397.722615][T15782] netlink: 'syz.1.2865': attribute type 39 has an invalid length. [ 397.754988][T15388] Bluetooth: hci0: command 0x0419 tx timeout [ 397.810769][T15786] netlink: 'syz.3.2867': attribute type 12 has an invalid length. [ 397.884393][T15792] syzkaller0: entered promiscuous mode [ 397.896739][T15792] syzkaller0: entered allmulticast mode [ 397.927845][T15792] netlink: 12 bytes leftover after parsing attributes in process `syz.1.2871'. [ 398.029298][T15803] netlink: 'syz.2.2874': attribute type 8 has an invalid length. [ 398.536794][T15827] netdevsim netdevsim0 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 398.563505][T15839] lo speed is unknown, defaulting to 1000 [ 398.576365][T15839] lo speed is unknown, defaulting to 1000 [ 398.590646][T15839] lo speed is unknown, defaulting to 1000 [ 398.619556][T15839] infiniband syz2: RDMA CMA: cma_listen_on_dev, error -98 [ 398.693694][T15827] netdevsim netdevsim0 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 398.731645][T15849] netlink: 'syz.4.2889': attribute type 8 has an invalid length. [ 398.740100][T15847] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 398.758937][T15839] lo speed is unknown, defaulting to 1000 [ 398.790713][T15827] netdevsim netdevsim0 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 398.825998][T15839] lo speed is unknown, defaulting to 1000 [ 398.833535][T15839] lo speed is unknown, defaulting to 1000 [ 398.842144][T15839] lo speed is unknown, defaulting to 1000 [ 398.853057][T15839] lo speed is unknown, defaulting to 1000 [ 398.893637][T15827] netdevsim netdevsim0 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 398.911610][T15839] lo speed is unknown, defaulting to 1000 [ 399.097459][T14717] netdevsim netdevsim0 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 399.129605][T14717] netdevsim netdevsim0 eth1: set [1, 0] type 2 family 0 port 6081 - 0 [ 399.155880][T14717] netdevsim netdevsim0 eth2: set [1, 0] type 2 family 0 port 6081 - 0 [ 399.187903][T14717] netdevsim netdevsim0 eth3: set [1, 0] type 2 family 0 port 6081 - 0 [ 399.407024][T15878] netlink: 'syz.3.2898': attribute type 1 has an invalid length. [ 399.450866][T15877] bond4: (slave gretap2): making interface the new active one [ 399.459367][T15877] bond4: (slave gretap2): Enslaving as an active interface with an up link [ 399.904677][T15887] netlink: 'syz.2.2900': attribute type 21 has an invalid length. [ 399.912137][ T5840] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 399.924598][ T5840] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 399.932496][ T5840] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 399.941325][ T5840] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 399.945370][T15886] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 399.949331][ T5840] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 399.971324][T15890] netlink: 'syz.2.2900': attribute type 1 has an invalid length. [ 399.981613][T15890] netlink: 'syz.2.2900': attribute type 6 has an invalid length. [ 399.990030][T15890] netlink: 'syz.2.2900': attribute type 3 has an invalid length. [ 400.055748][T15888] lo speed is unknown, defaulting to 1000 [ 400.195637][T15875] Bluetooth: hci0: Opcode 0x0c03 failed: -4 [ 400.659392][T15912] __nla_validate_parse: 10 callbacks suppressed [ 400.659410][T15912] netlink: 8 bytes leftover after parsing attributes in process `syz.4.2909'. [ 400.805496][T15919] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 400.836541][T15888] chnl_net:caif_netlink_parms(): no params data found [ 401.067505][T15888] bridge0: port 1(bridge_slave_0) entered blocking state [ 401.076745][T15888] bridge0: port 1(bridge_slave_0) entered disabled state [ 401.084832][T15888] bridge_slave_0: entered allmulticast mode [ 401.092743][T15888] bridge_slave_0: entered promiscuous mode [ 401.103063][T15888] bridge0: port 2(bridge_slave_1) entered blocking state [ 401.110416][T15888] bridge0: port 2(bridge_slave_1) entered disabled state [ 401.118175][T15888] bridge_slave_1: entered allmulticast mode [ 401.126260][T15888] bridge_slave_1: entered promiscuous mode [ 401.184596][T15888] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 401.206653][T15888] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 401.211414][T15947] netlink: 428 bytes leftover after parsing attributes in process `syz.1.2917'. [ 401.242593][T15947] netlink: 32 bytes leftover after parsing attributes in process `syz.1.2917'. [ 401.246091][T15888] team0: Port device team_slave_0 added [ 401.265229][T15888] team0: Port device team_slave_1 added [ 401.270887][T15945] syzkaller0: tun_chr_ioctl cmd 1074025677 [ 401.277480][T15945] syzkaller0: linktype set to 780 [ 401.347039][T15888] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 401.354562][T15888] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 401.383156][T15888] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 401.396611][T15888] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 401.403561][T15888] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 401.430193][T15888] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 401.526395][T15955] netlink: 'syz.4.2919': attribute type 39 has an invalid length. [ 401.545730][T15888] hsr_slave_0: entered promiscuous mode [ 401.553615][T15888] hsr_slave_1: entered promiscuous mode [ 401.561249][T15888] debugfs: 'hsr0' already exists in 'hsr' [ 401.567592][T15888] Cannot create hsr debugfs directory [ 401.599345][T15958] netlink: 8 bytes leftover after parsing attributes in process `syz.1.2920'. [ 401.793190][T15969] syzkaller0: entered promiscuous mode [ 401.799216][T15969] syzkaller0: entered allmulticast mode [ 401.830107][T15969] tipc: Enabling of bearer rejected, failed to enable media [ 402.021973][T15981] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 402.074189][T15388] Bluetooth: hci1: command tx timeout [ 402.077441][T15981] lo speed is unknown, defaulting to 1000 [ 402.193316][T15994] netlink: 252 bytes leftover after parsing attributes in process `syz.4.2932'. [ 402.302589][T15999] netlink: 20 bytes leftover after parsing attributes in process `syz.1.2933'. [ 402.428972][T16003] lo speed is unknown, defaulting to 1000 [ 402.439109][T16006] macvtap1: entered promiscuous mode [ 402.445907][T16006] batadv0: entered promiscuous mode [ 402.452053][T16006] 8021q: adding VLAN 0 to HW filter on device macvtap1 [ 402.468745][T16006] batadv0: left promiscuous mode [ 402.558854][T16010] netlink: 16 bytes leftover after parsing attributes in process `syz.1.2935'. [ 402.864235][T16022] syzkaller0: entered promiscuous mode [ 402.869748][T16022] syzkaller0: entered allmulticast mode [ 402.893921][T15888] netdevsim netdevsim3 netdevsim0: renamed from eth0 [ 402.948417][T15888] netdevsim netdevsim3 netdevsim1: renamed from eth1 [ 403.029046][T15888] netdevsim netdevsim3 netdevsim2: renamed from eth2 [ 403.096995][T16034] validate_nla: 1 callbacks suppressed [ 403.097010][T16034] netlink: 'syz.2.2940': attribute type 39 has an invalid length. [ 403.130857][T15888] netdevsim netdevsim3 netdevsim3: renamed from eth3 [ 403.178560][T16024] netlink: 4 bytes leftover after parsing attributes in process `syz.1.2938'. [ 403.341325][T15888] 8021q: adding VLAN 0 to HW filter on device bond0 [ 403.347561][T16050] netlink: 20 bytes leftover after parsing attributes in process `syz.0.2944'. [ 403.372854][T15888] 8021q: adding VLAN 0 to HW filter on device team0 [ 403.409532][T14718] bridge0: port 1(bridge_slave_0) entered blocking state [ 403.416756][T14718] bridge0: port 1(bridge_slave_0) entered forwarding state [ 403.453434][T14720] bridge0: port 2(bridge_slave_1) entered blocking state [ 403.460728][T14720] bridge0: port 2(bridge_slave_1) entered forwarding state [ 403.725131][T16072] netlink: 'syz.1.2951': attribute type 4 has an invalid length. [ 403.740514][T16070] geneve2: entered promiscuous mode [ 403.752913][T16072] netlink: 17 bytes leftover after parsing attributes in process `syz.1.2951'. [ 403.826498][T16075] netlink: 'syz.2.2952': attribute type 39 has an invalid length. [ 403.846137][T15888] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 403.943055][T15888] veth0_vlan: entered promiscuous mode [ 403.959874][T15888] veth1_vlan: entered promiscuous mode [ 404.010707][T15888] veth0_macvtap: entered promiscuous mode [ 404.029077][T15888] veth1_macvtap: entered promiscuous mode [ 404.056783][T15888] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 404.107518][T15888] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 404.159782][T15388] Bluetooth: hci1: command tx timeout [ 404.175469][T14716] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 404.195011][T14716] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 404.244261][T14716] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 404.271753][T14716] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 404.412729][T16106] netlink: 'syz.1.2965': attribute type 39 has an invalid length. [ 404.544187][ T8580] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 404.550463][T16108] syzkaller1: tun_chr_ioctl cmd 1074025677 [ 404.553509][ T8580] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 404.558684][T16108] syzkaller1: linktype set to 823 [ 404.643894][T14718] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 404.654548][T14718] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 404.794675][ C0] ip6_tunnel: ip6gretap6 xmit: Local address not yet configured! [ 404.901043][T16101] xt_hashlimit: size too large, truncated to 1048576 [ 405.813110][ T5840] Bluetooth: hci5: unexpected cc 0x0c03 length: 249 > 1 [ 405.825450][ T5840] Bluetooth: hci5: unexpected cc 0x1003 length: 249 > 9 [ 405.833498][ T5840] Bluetooth: hci5: unexpected cc 0x1001 length: 249 > 9 [ 405.848977][ T5840] Bluetooth: hci5: unexpected cc 0x0c23 length: 249 > 4 [ 405.865655][ T5840] Bluetooth: hci5: unexpected cc 0x0c38 length: 249 > 2 [ 405.868671][T16143] netlink: 'syz.0.2975': attribute type 39 has an invalid length. [ 405.907172][ T5834] syz_tun (unregistering): left allmulticast mode [ 405.923911][ T5834] syz_tun (unregistering): left promiscuous mode [ 405.936596][ T5834] bridge0: port 1(syz_tun) entered disabled state [ 405.969872][T16150] netlink: 'syz.2.2976': attribute type 10 has an invalid length. [ 405.987317][T16150] __nla_validate_parse: 2 callbacks suppressed [ 405.987331][T16150] netlink: 40 bytes leftover after parsing attributes in process `syz.2.2976'. [ 406.041791][T16145] A link change request failed with some changes committed already. Interface bond0 may have been left with an inconsistent configuration, please check. [ 406.094967][T16150] net veth1_virt_wifi virt_wifi0: left allmulticast mode [ 406.106751][T16150] batman_adv: batadv0: Adding interface: virt_wifi0 [ 406.113573][T16150] batman_adv: batadv0: The MTU of interface virt_wifi0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 406.143501][T16150] batman_adv: batadv0: Interface activated: virt_wifi0 [ 406.191400][T16155] IPVS: set_ctl: invalid protocol: 29 127.0.0.1:20004 [ 406.234375][T15388] Bluetooth: hci1: command tx timeout [ 406.247669][T16140] lo speed is unknown, defaulting to 1000 [ 406.318582][T16166] netlink: 'syz.3.2981': attribute type 8 has an invalid length. [ 406.672925][ T8580] netdevsim netdevsim1 eth1: set [1, 0] type 2 family 0 port 20000 - 0 [ 406.691669][ T8580] netdevsim netdevsim1 eth2: set [1, 0] type 2 family 0 port 20000 - 0 [ 406.721759][ T8580] netdevsim netdevsim1 eth3: set [1, 0] type 2 family 0 port 20000 - 0 [ 406.788922][ T8580] netdevsim netdevsim1 eth4: set [1, 0] type 2 family 0 port 20000 - 0 [ 406.950507][T16195] netlink: 'syz.4.2990': attribute type 11 has an invalid length. [ 407.032475][T16199] x_tables: unsorted underflow at hook 2 [ 407.495280][T16207] netlink: 4 bytes leftover after parsing attributes in process `syz.0.2993'. [ 407.600916][T14720] gretap0 (unregistering): left promiscuous mode [ 407.622759][T14720] bond3 (unregistering): (slave gretap1): Releasing active interface [ 407.688251][T14720] dvmrp6 (unregistering): left allmulticast mode [ 407.914233][T15388] Bluetooth: hci5: command tx timeout [ 408.108977][T16222] x_tables: duplicate underflow at hook 3 [ 408.116081][T16219] netlink: 20 bytes leftover after parsing attributes in process `syz.2.2996'. [ 408.228701][T14720] bond0 (unregistering): left promiscuous mode [ 408.236357][T14720] bond_slave_0: left promiscuous mode [ 408.243140][T14720] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 408.252605][T14720] bond0 (unregistering): Released all slaves [ 408.316674][T15388] Bluetooth: hci1: command tx timeout [ 408.345567][T14720] bond1 (unregistering): (slave vcan1): Releasing backup interface [ 408.354473][T14720] bond1 (unregistering): (slave vcan2): Releasing backup interface [ 408.362693][T14720] bond1 (unregistering): Released all slaves [ 408.448084][T14720] bond2 (unregistering): Released all slaves [ 408.460487][T14720] bond3 (unregistering): Released all slaves [ 408.664867][T14720] [†’Ì: left promiscuous mode [ 408.711704][T16226] netlink: 40 bytes leftover after parsing attributes in process `syz.3.2997'. [ 408.734333][T16226] netlink: 56 bytes leftover after parsing attributes in process `syz.3.2997'. [ 408.789453][T16237] IPVS: set_ctl: invalid protocol: 33 255.255.255.255:20003 [ 409.084891][T16140] chnl_net:caif_netlink_parms(): no params data found [ 409.141585][T16251] netlink: 28 bytes leftover after parsing attributes in process `syz.3.3007'. [ 409.168336][T16257] netlink: 12 bytes leftover after parsing attributes in process `syz.2.3009'. [ 409.263143][T16257] vlan1: entered promiscuous mode [ 409.280809][T16256] netlink: 'syz.2.3009': attribute type 14 has an invalid length. [ 409.307477][T16266] netlink: 32 bytes leftover after parsing attributes in process `syz.0.3010'. [ 409.518121][T16140] bridge0: port 1(bridge_slave_0) entered blocking state [ 409.525519][T16140] bridge0: port 1(bridge_slave_0) entered disabled state [ 409.533126][T16140] bridge_slave_0: entered allmulticast mode [ 409.541770][T16140] bridge_slave_0: entered promiscuous mode [ 409.548096][T16285] netlink: 4 bytes leftover after parsing attributes in process `syz.0.3016'. [ 409.559014][T16281] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 409.593897][T14720] veth0_to_batadv: left promiscuous mode [ 409.622454][T14720] hsr_slave_0: left promiscuous mode [ 409.639140][T14720] hsr_slave_1: left promiscuous mode [ 409.652053][T14720] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 409.667468][T14720] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 409.685276][T14720] batman_adv: batadv0: Interface deactivated: dummy0 [ 409.692029][T14720] batman_adv: batadv0: Removing interface: dummy0 [ 409.811651][T16292] openvswitch: netlink: Missing key (keys=40, expected=10000000) [ 409.998260][T15388] Bluetooth: hci5: command tx timeout [ 410.192767][T14720] ` (unregistering): Port device team_slave_1 removed [ 410.245208][T14720] ` (unregistering): Port device team_slave_0 removed [ 410.507072][T16284] netlink: 'syz.4.3013': attribute type 12 has an invalid length. [ 410.516617][T16140] bridge0: port 2(bridge_slave_1) entered blocking state [ 410.523880][T16140] bridge0: port 2(bridge_slave_1) entered disabled state [ 410.531388][T16140] bridge_slave_1: entered allmulticast mode [ 410.558007][T16140] bridge_slave_1: entered promiscuous mode [ 410.608868][ T6997] lo speed is unknown, defaulting to 1000 [ 410.614784][ T6997] infiniband syz2: ib_query_port failed (-19) [ 410.626196][T16299] netlink: 8 bytes leftover after parsing attributes in process `syz.2.3020'. [ 410.638034][T16297] syzkaller0: entered promiscuous mode [ 410.653894][T16297] syzkaller0: entered allmulticast mode [ 410.783166][T16140] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 410.843450][T16140] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 410.966997][T16140] team0: Port device team_slave_0 added [ 410.977732][T16140] team0: Port device team_slave_1 added [ 411.072088][T16340] netlink: 4 bytes leftover after parsing attributes in process `syz.2.3026'. [ 411.117746][T16140] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 411.125799][T16344] netlink: 12 bytes leftover after parsing attributes in process `syz.2.3026'. [ 411.139315][T16140] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 411.172054][T16140] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 411.250776][T16140] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 411.261700][T16140] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 411.293958][T16140] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 411.319575][T16349] tipc: Started in network mode [ 411.324744][T16349] tipc: Node identity da243ffa92a3, cluster identity 4711 [ 411.332997][T16349] tipc: Enabled bearer , priority 0 [ 411.342471][T16349] syzkaller0: entered promiscuous mode [ 411.348526][T16349] syzkaller0: entered allmulticast mode [ 411.357429][T16340] netlink: 8 bytes leftover after parsing attributes in process `syz.2.3026'. [ 411.439774][T16360] netlink: 8 bytes leftover after parsing attributes in process `syz.3.3037'. [ 411.449003][T16360] netlink: 8 bytes leftover after parsing attributes in process `syz.3.3037'. [ 411.480426][T16358] netlink: 'syz.4.3036': attribute type 3 has an invalid length. [ 411.490801][T16140] hsr_slave_0: entered promiscuous mode [ 411.496671][T16358] netlink: 8 bytes leftover after parsing attributes in process `syz.4.3036'. [ 411.507690][T16140] hsr_slave_1: entered promiscuous mode [ 411.514648][T16140] debugfs: 'hsr0' already exists in 'hsr' [ 411.521310][T16140] Cannot create hsr debugfs directory [ 411.530005][T16349] tipc: Resetting bearer [ 411.541701][T16348] tipc: Resetting bearer [ 411.559727][T16348] tipc: Disabling bearer [ 411.708157][T16358] dvmrp1: tun_chr_ioctl cmd 1074025677 [ 411.713832][T16358] dvmrp1: linktype set to 769 [ 411.958168][T16140] netdevsim netdevsim1 eth4 (unregistering): unset [1, 0] type 2 family 0 port 20000 - 0 [ 412.022250][T16140] netdevsim netdevsim1 eth3 (unregistering): unset [1, 0] type 2 family 0 port 20000 - 0 [ 412.074750][ T5840] Bluetooth: hci5: command tx timeout [ 412.102091][T16140] netdevsim netdevsim1 eth2 (unregistering): unset [1, 0] type 2 family 0 port 20000 - 0 [ 412.175210][T16140] netdevsim netdevsim1 eth1 (unregistering): unset [1, 0] type 2 family 0 port 20000 - 0 [ 412.249833][T16395] netlink: 8 bytes leftover after parsing attributes in process `syz.2.3047'. [ 412.258901][T16395] netlink: 8 bytes leftover after parsing attributes in process `syz.2.3047'. [ 412.418624][T16401] netlink: 'syz.3.3048': attribute type 39 has an invalid length. [ 412.479922][T16403] IPVS: sync thread started: state = BACKUP, mcast_ifn = ip6_vti0, syncid = 1, id = 0 [ 412.486210][T16140] netdevsim netdevsim1 netdevsim0: renamed from eth0 [ 412.517882][T16140] netdevsim netdevsim1 netdevsim1: renamed from eth1 [ 412.531179][T16140] netdevsim netdevsim1 netdevsim2: renamed from eth2 [ 412.579413][T16140] netdevsim netdevsim1 netdevsim3: renamed from eth3 [ 412.735592][T16421] netlink: 'syz.3.3052': attribute type 10 has an invalid length. [ 412.826200][T16421] bond0: (slave wlan1): Enslaving as an active interface with an up link [ 412.901133][T16140] 8021q: adding VLAN 0 to HW filter on device bond0 [ 412.933293][T16428] netlink: 'syz.2.3054': attribute type 10 has an invalid length. [ 412.933855][T16140] 8021q: adding VLAN 0 to HW filter on device team0 [ 412.971899][ T8580] bridge0: port 1(bridge_slave_0) entered blocking state [ 412.979137][ T8580] bridge0: port 1(bridge_slave_0) entered forwarding state [ 413.002239][T16433] netlink: 24 bytes leftover after parsing attributes in process `syz.3.3056'. [ 413.031185][ T8580] bridge0: port 2(bridge_slave_1) entered blocking state [ 413.038372][ T8580] bridge0: port 2(bridge_slave_1) entered forwarding state [ 413.060534][T16429] syzkaller0: tun_chr_ioctl cmd 1074025677 [ 413.066874][T16429] syzkaller0: linktype set to 780 [ 413.166242][T16433] netlink: 8 bytes leftover after parsing attributes in process `syz.3.3056'. [ 413.316523][T16447] bond1: entered promiscuous mode [ 413.321606][T16447] bond1: entered allmulticast mode [ 413.328922][T16447] 8021q: adding VLAN 0 to HW filter on device bond1 [ 413.421584][T16458] netlink: 'syz.0.3062': attribute type 8 has an invalid length. [ 413.488395][T16458] bond0: entered promiscuous mode [ 413.506514][T16458] bond_slave_0: entered promiscuous mode [ 413.512443][T16458] bond_slave_1: entered promiscuous mode [ 413.523861][T16458] gretap0: entered promiscuous mode [ 413.537046][T16458] veth0_to_batadv: entered promiscuous mode [ 413.543913][T16458] debugfs: 'hsr1' already exists in 'hsr' [ 413.552718][T16458] Cannot create hsr debugfs directory [ 413.558413][T16458] hsr1: entered promiscuous mode [ 413.888761][T16140] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 414.112281][T16140] veth0_vlan: entered promiscuous mode [ 414.150483][T16140] veth1_vlan: entered promiscuous mode [ 414.156298][ T5840] Bluetooth: hci5: command 0x0419 tx timeout [ 414.176437][T16489] syzkaller0: entered promiscuous mode [ 414.181944][T16489] syzkaller0: entered allmulticast mode [ 414.198072][T16488] syzkaller0: tun_chr_ioctl cmd 1074025677 [ 414.206552][T16488] syzkaller0: linktype set to 780 [ 414.218872][T16140] veth0_macvtap: entered promiscuous mode [ 414.232133][T16140] veth1_macvtap: entered promiscuous mode [ 414.285953][T16140] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 414.307963][T16140] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 414.337941][T14716] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 414.356874][T14716] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 414.391911][T14716] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 414.435741][T14716] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 414.523734][T14714] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 414.532078][T14714] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 414.633806][T10175] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 414.662640][T10175] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 415.001376][T16529] bridge0: left allmulticast mode [ 415.014601][T16529] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 415.057782][T16526] ip6tnl1: entered allmulticast mode [ 415.183152][T16538] syzkaller0: tun_chr_ioctl cmd 1074025677 [ 415.190172][T16538] syzkaller0: linktype set to 780 [ 415.338182][T16547] batman_adv: batadv0: Adding interface: dummy0 [ 415.344943][T16547] batman_adv: batadv0: The MTU of interface dummy0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 415.374452][T16547] batman_adv: batadv0: Interface activated: dummy0 [ 415.392965][T16547] batadv0: mtu less than device minimum [ 415.403179][T16547] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (-320) [ 415.415138][T16547] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (-320) [ 415.426986][T16547] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (-320) [ 415.438868][T16547] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (-320) [ 415.450666][T16547] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (-320) [ 415.462577][T16547] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (-320) [ 415.474439][T16547] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (-320) [ 415.486330][T16547] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (-320) [ 415.965375][T16562] batadv_slave_1: entered promiscuous mode [ 415.974202][T16562] batman_adv: batadv0: Adding interface: macvlan2 [ 415.994875][T16562] batman_adv: batadv0: The MTU of interface macvlan2 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 416.028977][T16561] xt_ecn: cannot match TCP bits for non-tcp packets [ 416.036469][ T5840] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 416.050868][ T5840] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 416.058190][T16562] batman_adv: batadv0: Interface activated: macvlan2 [ 416.065883][ T5840] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 416.096039][ T5840] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 416.104306][ T5840] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 416.234338][T15388] Bluetooth: hci5: command 0x0419 tx timeout [ 416.343468][T16573] __nla_validate_parse: 9 callbacks suppressed [ 416.343485][T16573] netlink: 16 bytes leftover after parsing attributes in process `syz.3.3087'. [ 416.577412][T16593] netlink: 16 bytes leftover after parsing attributes in process `syz.1.3092'. [ 416.586758][T16593] netlink: 16 bytes leftover after parsing attributes in process `syz.1.3092'. [ 416.658824][T16593] ip6gretap1: entered promiscuous mode [ 416.669574][T16593] ip6gretap1: entered allmulticast mode [ 416.737106][T16598] netlink: 8 bytes leftover after parsing attributes in process `syz.4.3093'. [ 416.823843][T16603] netlink: 4 bytes leftover after parsing attributes in process `syz.1.3094'. [ 416.903212][T14718] netdevsim netdevsim1 netdevsim0: set [0, 0] type 1 family 0 port 8472 - 0 [ 416.914157][T14718] netdevsim netdevsim1 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0 [ 416.923418][T14718] netdevsim netdevsim1 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0 [ 416.947902][T14718] netdevsim netdevsim1 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0 [ 416.989699][T16566] chnl_net:caif_netlink_parms(): no params data found [ 417.050678][T16613] netlink: 8 bytes leftover after parsing attributes in process `syz.0.3095'. [ 417.080456][T16613] netlink: 4 bytes leftover after parsing attributes in process `syz.0.3095'. [ 417.178071][T16566] bridge0: port 1(bridge_slave_0) entered blocking state [ 417.188308][T16566] bridge0: port 1(bridge_slave_0) entered disabled state [ 417.196599][T16566] bridge_slave_0: entered allmulticast mode [ 417.207238][T16566] bridge_slave_0: entered promiscuous mode [ 417.219662][T16566] bridge0: port 2(bridge_slave_1) entered blocking state [ 417.227339][T16566] bridge0: port 2(bridge_slave_1) entered disabled state [ 417.235707][T16566] bridge_slave_1: entered allmulticast mode [ 417.242344][T16623] netlink: 20 bytes leftover after parsing attributes in process `syz.3.3099'. [ 417.245147][T16566] bridge_slave_1: entered promiscuous mode [ 417.322705][T16566] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 417.369057][T16566] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 417.373458][T16621] netlink: 8 bytes leftover after parsing attributes in process `syz.1.3098'. [ 417.441991][T16566] team0: Port device team_slave_0 added [ 417.458884][T16566] team0: Port device team_slave_1 added [ 417.529502][T16566] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 417.548939][T16566] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 417.575913][T16566] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 417.589291][T16566] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 417.601333][T16566] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 417.629070][T16566] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 417.732512][T16566] hsr_slave_0: entered promiscuous mode [ 417.740218][T16566] hsr_slave_1: entered promiscuous mode [ 417.750200][T16566] debugfs: 'hsr0' already exists in 'hsr' [ 417.756719][T16566] Cannot create hsr debugfs directory [ 417.879929][T16632] lo speed is unknown, defaulting to 1000 [ 417.896837][T16632] lo speed is unknown, defaulting to 1000 [ 417.903518][T16632] lo speed is unknown, defaulting to 1000 [ 417.935005][T16634] netlink: 8 bytes leftover after parsing attributes in process `syz.0.3103'. [ 417.947451][T16632] infiniband syz2: RDMA CMA: cma_listen_on_dev, error -98 [ 418.006448][T16635] netlink: 'syz.4.3102': attribute type 10 has an invalid length. [ 418.070623][T16635] batadv_slave_0: left promiscuous mode [ 418.102464][T16635] batadv_slave_0: entered promiscuous mode [ 418.110019][T16635] bond0: (slave batadv_slave_0): Enslaving as an active interface with an up link [ 418.154306][T15388] Bluetooth: hci2: command tx timeout [ 418.170898][T16566] netdevsim netdevsim2 eth3 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 418.215942][T16632] lo speed is unknown, defaulting to 1000 [ 418.248230][T16632] lo speed is unknown, defaulting to 1000 [ 418.291615][T16566] netdevsim netdevsim2 eth2 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 418.326339][T16632] lo speed is unknown, defaulting to 1000 [ 418.334130][T16632] lo speed is unknown, defaulting to 1000 [ 418.343866][T16632] lo speed is unknown, defaulting to 1000 [ 418.345158][ T5881] IPVS: starting estimator thread 0... [ 418.365357][T16632] lo speed is unknown, defaulting to 1000 [ 418.373228][T16632] lo speed is unknown, defaulting to 1000 [ 418.381104][T16632] lo speed is unknown, defaulting to 1000 [ 418.397764][T16566] netdevsim netdevsim2 eth1 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 418.454132][T16645] IPVS: using max 29 ests per chain, 69600 per kthread [ 418.465099][T16632] lo speed is unknown, defaulting to 1000 [ 418.477994][T16632] lo speed is unknown, defaulting to 1000 [ 418.514230][T16566] netdevsim netdevsim2 eth0 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 418.552865][T16632] lo speed is unknown, defaulting to 1000 [ 418.566624][T16632] lo speed is unknown, defaulting to 1000 [ 418.586738][T16632] lo speed is unknown, defaulting to 1000 [ 418.616096][T16632] lo speed is unknown, defaulting to 1000 [ 418.729770][T16632] lo speed is unknown, defaulting to 1000 [ 418.732238][T16566] netdevsim netdevsim2 netdevsim0: renamed from eth0 [ 418.814563][T16566] netdevsim netdevsim2 netdevsim1: renamed from eth1 [ 418.837244][T16632] lo speed is unknown, defaulting to 1000 [ 418.837478][T16566] netdevsim netdevsim2 netdevsim2: renamed from eth2 [ 418.912625][T16566] netdevsim netdevsim2 netdevsim3: renamed from eth3 [ 418.967035][T16654] syzkaller1: entered promiscuous mode [ 418.972640][T16654] syzkaller1: entered allmulticast mode [ 419.005501][T16654] syzkaller1: left promiscuous mode [ 419.013658][T16654] syzkaller1: left allmulticast mode [ 419.058413][T16665] syzkaller1: entered promiscuous mode [ 419.066105][T16665] syzkaller1: entered allmulticast mode [ 419.145409][T16670] batman_adv: batadv0: Interface deactivated: virt_wifi0 [ 419.235614][T16670] tipc: Resetting bearer [ 419.407668][T16566] 8021q: adding VLAN 0 to HW filter on device bond0 [ 419.438228][T16566] 8021q: adding VLAN 0 to HW filter on device team0 [ 419.463953][T14714] bridge0: port 1(bridge_slave_0) entered blocking state [ 419.471227][T14714] bridge0: port 1(bridge_slave_0) entered forwarding state [ 419.496776][T14714] bridge0: port 2(bridge_slave_1) entered blocking state [ 419.504005][T14714] bridge0: port 2(bridge_slave_1) entered forwarding state [ 419.560289][T16684] Bluetooth: MGMT ver 1.23 [ 419.720509][T16689] netlink: 'syz.4.3116': attribute type 1 has an invalid length. [ 419.812540][T16689] 8021q: adding VLAN 0 to HW filter on device bond2 [ 419.844938][T16692] 8021q: adding VLAN 0 to HW filter on device bond2 [ 419.852074][T16692] bond2: (slave vxcan1): The slave device specified does not support setting the MAC address [ 419.867086][T16692] bond2: (slave vxcan1): Error -95 calling set_mac_address [ 419.979392][T16689] veth5: entered promiscuous mode [ 420.100229][T16696] syzkaller0: entered promiscuous mode [ 420.106041][T16696] syzkaller0: entered allmulticast mode [ 420.239911][T15388] Bluetooth: hci2: command tx timeout [ 420.260301][T16714] net_ratelimit: 12 callbacks suppressed [ 420.260317][T16714] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 420.281227][T16566] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 420.352704][T16566] veth0_vlan: entered promiscuous mode [ 420.369506][T16566] veth1_vlan: entered promiscuous mode [ 420.422384][T16566] veth0_macvtap: entered promiscuous mode [ 420.450080][T16566] veth1_macvtap: entered promiscuous mode [ 420.527812][T16566] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 420.552869][T16566] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 420.592355][T10175] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 420.612869][T10175] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 420.654824][T10175] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 420.663634][T10175] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 420.767208][T16725] bridge_slave_1: left allmulticast mode [ 420.773102][T16725] bridge_slave_1: left promiscuous mode [ 420.780335][T16725] bridge0: port 2(bridge_slave_1) entered disabled state [ 420.817467][T16725] bridge_slave_0: left allmulticast mode [ 420.833328][T16725] bridge_slave_0: left promiscuous mode [ 420.901509][T16725] bridge0: port 1(bridge_slave_0) entered disabled state [ 420.997522][T16723] netlink: 'syz.3.3123': attribute type 10 has an invalid length. [ 421.402098][T14716] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 421.415777][T14716] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 421.493103][T14714] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 421.545408][T14714] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 421.619087][T16747] __nla_validate_parse: 8 callbacks suppressed [ 421.619105][T16747] netlink: 4 bytes leftover after parsing attributes in process `syz.4.3131'. [ 421.665605][T16747] netlink: 12 bytes leftover after parsing attributes in process `syz.4.3131'. [ 421.741852][T16756] netlink: 'syz.0.3133': attribute type 1 has an invalid length. [ 421.750249][T16756] netlink: 8 bytes leftover after parsing attributes in process `syz.0.3133'. [ 421.770833][T16753] netlink: 8 bytes leftover after parsing attributes in process `syz.1.3134'. [ 421.791640][T16757] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 421.896576][T16760] input: Bluetooth HID Boot Protocol Device as /devices/virtual/bluetooth/hci2/hci2:200/input5 [ 422.027898][T16760] bond3: invalid ARP target 0.0.0.0 specified for addition [ 422.036495][T16760] bond3: option arp_ip_target: invalid value (0) [ 422.058373][T16760] bond3 (unregistering): Released all slaves [ 422.162246][T16773] netlink: 'syz.2.3139': attribute type 8 has an invalid length. [ 422.172974][T16773] netlink: 4 bytes leftover after parsing attributes in process `syz.2.3139'. [ 422.189991][T16773] bond0: entered promiscuous mode [ 422.197389][T16773] bond_slave_0: entered promiscuous mode [ 422.203253][T16773] bond_slave_1: entered promiscuous mode [ 422.242359][T16773] gretap0: entered promiscuous mode [ 422.260495][T16773] veth0_to_batadv: entered promiscuous mode [ 422.275332][T16773] debugfs: 'hsr1' already exists in 'hsr' [ 422.296727][T16773] Cannot create hsr debugfs directory [ 422.315538][T16773] hsr1: entered promiscuous mode [ 422.331664][T15388] Bluetooth: hci2: command tx timeout [ 422.351716][T16781] openvswitch: netlink: Tunnel attr 125 out of range max 16 [ 422.361082][T16781] netlink: 28 bytes leftover after parsing attributes in process `syz.1.3141'. [ 422.405909][T16781] ip6t_rpfilter: unknown options [ 422.549627][T16798] netlink: 8 bytes leftover after parsing attributes in process `syz.2.3147'. [ 422.556003][T16791] bridge4: entered allmulticast mode [ 422.582011][T16799] IPVS: nq: SCTP 172.20.20.187:0 - no destination available [ 422.590660][ T6998] IPVS: starting estimator thread 0... [ 422.684297][T16801] IPVS: using max 31 ests per chain, 74400 per kthread [ 422.776089][T16809] openvswitch: netlink: Either Ethernet header or EtherType is required. [ 422.835937][T16811] netlink: 8 bytes leftover after parsing attributes in process `syz.4.3150'. [ 422.888871][T16811] netlink: 4 bytes leftover after parsing attributes in process `syz.4.3150'. [ 422.935279][T16816] netlink: 'syz.3.3152': attribute type 10 has an invalid length. [ 422.947921][T16817] netlink: 'syz.2.3153': attribute type 8 has an invalid length. [ 422.957165][T16814] syzkaller1: entered promiscuous mode [ 422.962681][T16814] syzkaller1: entered allmulticast mode [ 422.964089][T16817] netlink: 4 bytes leftover after parsing attributes in process `syz.2.3153'. [ 423.038467][T16819] syzkaller0: entered promiscuous mode [ 423.049628][T16819] syzkaller0: entered allmulticast mode [ 423.114860][T16821] FAULT_INJECTION: forcing a failure. [ 423.114860][T16821] name failslab, interval 1, probability 0, space 0, times 0 [ 423.165351][T16821] CPU: 0 UID: 0 PID: 16821 Comm: syz.3.3155 Not tainted syzkaller #0 PREEMPT(full) [ 423.165377][T16821] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 423.165388][T16821] Call Trace: [ 423.165395][T16821] [ 423.165403][T16821] dump_stack_lvl+0x189/0x250 [ 423.165430][T16821] ? __pfx____ratelimit+0x10/0x10 [ 423.165456][T16821] ? __pfx_dump_stack_lvl+0x10/0x10 [ 423.165478][T16821] ? __pfx__printk+0x10/0x10 [ 423.165493][T16821] ? _raw_spin_unlock_irqrestore+0x85/0x110 [ 423.165522][T16821] ? _raw_spin_unlock_irqrestore+0xad/0x110 [ 423.165546][T16821] ? __pfx__raw_spin_unlock_irqrestore+0x10/0x10 [ 423.165574][T16821] should_fail_ex+0x414/0x560 [ 423.165604][T16821] should_failslab+0xa8/0x100 [ 423.165624][T16821] __kmalloc_noprof+0xcb/0x7f0 [ 423.165647][T16821] ? ___neigh_create+0x6d5/0x2260 [ 423.165677][T16821] ___neigh_create+0x6d5/0x2260 [ 423.165709][T16821] ? __ipv6_neigh_lookup_noref+0x531/0x710 [ 423.165730][T16821] ? dev_loopback_xmit+0x2f6/0x490 [ 423.165760][T16821] ip6_finish_output2+0x1175/0x1480 [ 423.165791][T16821] ? __pfx_ip6_finish_output2+0x10/0x10 [ 423.165811][T16821] ? ip6_mtu+0x7d/0x490 [ 423.165832][T16821] ? ip6_mtu+0x38c/0x490 [ 423.165856][T16821] ? ip6_finish_output+0x2ef/0x4e0 [ 423.165880][T16821] ? ip6_output+0x126/0x550 [ 423.165904][T16821] ip6_output+0x340/0x550 [ 423.165933][T16821] ip6_mr_output+0x4e9/0x1100 [ 423.165958][T16821] ? ip6_mr_output+0x1ca/0x1100 [ 423.165979][T16821] ? __pfx_ip6_mr_output+0x10/0x10 [ 423.166003][T16821] ? __ip6_local_out+0x609/0x870 [ 423.166030][T16821] ? __ip6_local_out+0x82c/0x870 [ 423.166054][T16821] ? __ip6_local_out+0x609/0x870 [ 423.166090][T16821] ? skb_dst+0x4f/0xd0 [ 423.166113][T16821] ? dst_output+0x17b/0x1c0 [ 423.166132][T16821] ? ip6_send_skb+0x10f/0x390 [ 423.166151][T16821] ip6_send_skb+0x1d5/0x390 [ 423.166171][T16821] udp_v6_send_skb+0xc17/0x1830 [ 423.166222][T16821] udpv6_sendmsg+0x1d62/0x2510 [ 423.166256][T16821] ? __pfx_udplite_getfrag+0x10/0x10 [ 423.166291][T16821] ? __pfx_udpv6_sendmsg+0x10/0x10 [ 423.166321][T16821] ? __lock_acquire+0xab9/0xd20 [ 423.166358][T16821] ? __local_bh_enable_ip+0x12d/0x1c0 [ 423.166376][T16821] ? __pfx___local_bh_enable_ip+0x10/0x10 [ 423.166403][T16821] ? inet_send_prepare+0x1b9/0x270 [ 423.166423][T16821] ? inet_send_prepare+0x1b9/0x270 [ 423.166445][T16821] ? inet6_sendmsg+0xe4/0x120 [ 423.166467][T16821] __sock_sendmsg+0xe5/0x270 [ 423.166495][T16821] ____sys_sendmsg+0x52d/0x830 [ 423.166520][T16821] ? __pfx_____sys_sendmsg+0x10/0x10 [ 423.166550][T16821] ? import_iovec+0x74/0xa0 [ 423.166575][T16821] ___sys_sendmsg+0x21f/0x2a0 [ 423.166597][T16821] ? __pfx____sys_sendmsg+0x10/0x10 [ 423.166655][T16821] ? __fget_files+0x2a/0x420 [ 423.166671][T16821] ? __fget_files+0x3a0/0x420 [ 423.166699][T16821] __sys_sendmmsg+0x227/0x430 [ 423.166725][T16821] ? __pfx___sys_sendmmsg+0x10/0x10 [ 423.166754][T16821] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 423.166792][T16821] ? ksys_write+0x22a/0x250 [ 423.166818][T16821] ? __pfx_ksys_write+0x10/0x10 [ 423.166846][T16821] __x64_sys_sendmmsg+0xa0/0xc0 [ 423.166867][T16821] do_syscall_64+0xfa/0xfa0 [ 423.166883][T16821] ? lockdep_hardirqs_on+0x9c/0x150 [ 423.166900][T16821] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 423.166917][T16821] ? clear_bhb_loop+0x60/0xb0 [ 423.166938][T16821] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 423.166954][T16821] RIP: 0033:0x7f3f48b8f749 [ 423.166970][T16821] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 423.166984][T16821] RSP: 002b:00007f3f499c0038 EFLAGS: 00000246 ORIG_RAX: 0000000000000133 [ 423.167003][T16821] RAX: ffffffffffffffda RBX: 00007f3f48de5fa0 RCX: 00007f3f48b8f749 [ 423.167016][T16821] RDX: 0000000000000002 RSI: 00002000000054c0 RDI: 0000000000000003 [ 423.167028][T16821] RBP: 00007f3f499c0090 R08: 0000000000000000 R09: 0000000000000000 [ 423.167038][T16821] R10: 0000000000000004 R11: 0000000000000246 R12: 0000000000000001 [ 423.167048][T16821] R13: 00007f3f48de6038 R14: 00007f3f48de5fa0 R15: 00007ffc3ce6d3e8 [ 423.167080][T16821] [ 423.635773][T16829] netlink: 'syz.2.3158': attribute type 10 has an invalid length. [ 423.736773][T16836] netlink: 'syz.0.3161': attribute type 83 has an invalid length. [ 423.914286][T16846] pimreg: entered allmulticast mode [ 424.166720][T16866] netlink: 'syz.1.3167': attribute type 8 has an invalid length. [ 424.211894][T16866] bond0: entered promiscuous mode [ 424.219430][T16866] bond_slave_0: entered promiscuous mode [ 424.249183][T16866] bond_slave_1: entered promiscuous mode [ 424.285784][T16866] gretap0: entered promiscuous mode [ 424.326008][T16866] veth0_to_batadv: entered promiscuous mode [ 424.372656][T16866] debugfs: 'hsr1' already exists in 'hsr' [ 424.394199][T15388] Bluetooth: hci2: command tx timeout [ 424.415981][T16866] Cannot create hsr debugfs directory [ 424.428801][T16866] hsr1: entered promiscuous mode [ 424.727317][T16875] lo speed is unknown, defaulting to 1000 [ 424.911777][T16878] lo speed is unknown, defaulting to 1000 [ 425.098251][T16886] netlink: 'syz.4.3172': attribute type 2 has an invalid length. [ 425.189492][T16886] : entered promiscuous mode [ 425.267700][T16889] netlink: 'syz.2.3173': attribute type 10 has an invalid length. [ 425.298815][T16886] syzkaller0: entered promiscuous mode [ 425.304406][T16886] syzkaller0: entered allmulticast mode [ 425.369423][T16889] mac80211_hwsim hwsim37 wlan1: entered promiscuous mode [ 425.392679][T16889] bond0: (slave wlan1): Enslaving as an active interface with an up link [ 425.892551][T16913] netlink: 'syz.4.3180': attribute type 8 has an invalid length. [ 426.053563][T10175] netdevsim netdevsim0 eth0: set [0, 0] type 1 family 0 port 8472 - 0 [ 426.082541][T10175] netdevsim netdevsim0 eth1: set [0, 0] type 1 family 0 port 8472 - 0 [ 426.100194][T10175] netdevsim netdevsim0 eth2: set [0, 0] type 1 family 0 port 8472 - 0 [ 426.138989][T10175] netdevsim netdevsim0 eth3: set [0, 0] type 1 family 0 port 8472 - 0 [ 426.236181][T16923] lo speed is unknown, defaulting to 1000 [ 426.358720][T16930] lo speed is unknown, defaulting to 1000 [ 426.688336][T16946] __nla_validate_parse: 13 callbacks suppressed [ 426.688355][T16946] netlink: 27 bytes leftover after parsing attributes in process `syz.2.3185'. [ 426.857393][T16950] netlink: 8 bytes leftover after parsing attributes in process `syz.1.3186'. [ 426.900903][T16950] netlink: 'syz.1.3186': attribute type 10 has an invalid length. [ 426.927078][T16950] mac80211_hwsim hwsim35 wlan1: entered promiscuous mode [ 426.946675][T16950] bond0: (slave wlan1): Enslaving as an active interface with an up link [ 427.311477][T16966] syzkaller0: entered promiscuous mode [ 427.331536][T16966] syzkaller0: entered allmulticast mode [ 427.344065][ T30] audit: type=1804 audit(1763649628.646:3): pid=16971 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=open_writers comm="syz.4.3190" name="cgroup.controllers" dev="tmpfs" ino=2987 res=1 errno=0 [ 427.412018][ T30] audit: type=1800 audit(1763649628.646:4): pid=16971 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.4.3190" name="cgroup.controllers" dev="tmpfs" ino=2987 res=0 errno=0 [ 427.505179][T14713] netdevsim netdevsim2 netdevsim0: set [0, 0] type 1 family 0 port 8472 - 0 [ 427.515427][T16980] netlink: 12 bytes leftover after parsing attributes in process `syz.4.3193'. [ 427.534384][T14713] netdevsim netdevsim2 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0 [ 427.749887][T16980] 8021q: adding VLAN 0 to HW filter on device bond3 [ 427.779880][T14713] netdevsim netdevsim2 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0 [ 427.823764][T14713] netdevsim netdevsim2 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0 [ 427.895284][T16994] netlink: 16 bytes leftover after parsing attributes in process `syz.0.3195'. [ 427.958003][T17000] netlink: 16 bytes leftover after parsing attributes in process `syz.2.3196'. [ 427.972580][T17000] netlink: 8 bytes leftover after parsing attributes in process `syz.2.3196'. [ 427.981748][T17000] netlink: 8 bytes leftover after parsing attributes in process `syz.2.3196'. [ 427.999042][T17003] netlink: 8 bytes leftover after parsing attributes in process `syz.4.3197'. [ 428.055626][T17003] netlink: 4 bytes leftover after parsing attributes in process `syz.4.3197'. [ 428.305315][T17014] netlink: 'syz.0.3201': attribute type 10 has an invalid length. [ 428.325462][T17014] mac80211_hwsim hwsim28 wlan1: entered promiscuous mode [ 428.340433][T17014] bond0: (slave wlan1): Enslaving as an active interface with an up link [ 428.374651][T17019] ip6tnl1: entered allmulticast mode [ 428.640236][T17028] lo speed is unknown, defaulting to 1000 [ 428.856282][T17025] lo speed is unknown, defaulting to 1000 [ 429.345281][T17054] netlink: 8 bytes leftover after parsing attributes in process `syz.0.3210'. [ 429.803184][T17071] netlink: 'syz.4.3216': attribute type 10 has an invalid length. [ 430.082665][T17091] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 430.993266][T15387] cgroup: fork rejected by pids controller in /syz0 [ 431.259194][T17132] bridge0: port 3(batadv1) entered blocking state [ 431.311413][T17132] bridge0: port 3(batadv1) entered disabled state [ 431.323653][T17132] batadv1: entered allmulticast mode [ 431.333799][T17132] batadv1: entered promiscuous mode [ 431.591947][T17143] team0: Port device team_slave_0 removed [ 431.741321][T17145] lo speed is unknown, defaulting to 1000 [ 431.756396][T14712] batman_adv: batadv1: No IGMP Querier present - multicast optimizations disabled [ 431.766003][T14712] batman_adv: batadv1: No MLD Querier present - multicast optimizations disabled [ 431.840431][T17151] ip6tnl8: entered allmulticast mode [ 431.907727][ T5840] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 431.922715][ T5840] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 431.932744][ T5840] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 431.940935][ T5840] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 431.951504][ T5840] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 432.028892][T17155] lo speed is unknown, defaulting to 1000 [ 432.036572][T17163] __nla_validate_parse: 15 callbacks suppressed [ 432.036588][T17163] netlink: 8 bytes leftover after parsing attributes in process `syz.3.3243'. [ 432.104463][T17163] netlink: 8 bytes leftover after parsing attributes in process `syz.3.3243'. [ 432.114139][T17163] netlink: 8 bytes leftover after parsing attributes in process `syz.3.3243'. [ 432.188298][T17171] syzkaller0: entered promiscuous mode [ 432.197322][T17171] syzkaller0: entered allmulticast mode [ 432.242910][T17175] netlink: 'syz.2.3246': attribute type 10 has an invalid length. [ 432.365993][T17155] chnl_net:caif_netlink_parms(): no params data found [ 432.478357][T17183] netlink: 8 bytes leftover after parsing attributes in process `syz.2.3249'. [ 432.722467][T17155] bridge0: port 1(bridge_slave_0) entered blocking state [ 432.731041][T17155] bridge0: port 1(bridge_slave_0) entered disabled state [ 432.744321][T17155] bridge_slave_0: entered allmulticast mode [ 432.753509][T17155] bridge_slave_0: entered promiscuous mode [ 432.811569][T17207] netlink: 8 bytes leftover after parsing attributes in process `syz.2.3257'. [ 432.821672][T17205] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 432.840415][T17155] bridge0: port 2(bridge_slave_1) entered blocking state [ 432.855594][T17155] bridge0: port 2(bridge_slave_1) entered disabled state [ 432.862907][T17155] bridge_slave_1: entered allmulticast mode [ 432.883095][T17155] bridge_slave_1: entered promiscuous mode [ 432.914280][T17209] ip6tnl1: entered allmulticast mode [ 432.928036][T17207] netlink: 8 bytes leftover after parsing attributes in process `syz.2.3257'. [ 432.944582][T17207] netlink: 8 bytes leftover after parsing attributes in process `syz.2.3257'. [ 433.178901][T17155] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 433.214889][T17155] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 433.261424][T17232] netlink: 'syz.4.3262': attribute type 10 has an invalid length. [ 433.329959][T17155] team0: Port device team_slave_0 added [ 433.346654][T17237] netlink: 8 bytes leftover after parsing attributes in process `syz.2.3264'. [ 433.356973][T17226] lo speed is unknown, defaulting to 1000 [ 433.359934][T17155] team0: Port device team_slave_1 added [ 433.503890][T17155] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 433.521734][T17155] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 433.591075][T17241] netlink: 8 bytes leftover after parsing attributes in process `syz.4.3265'. [ 433.630553][T17155] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 433.646759][T17242] netlink: 4 bytes leftover after parsing attributes in process `syz.4.3265'. [ 433.671082][T17155] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 433.698133][T17155] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 433.781947][T17155] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 433.898626][T17249] tipc: Started in network mode [ 433.903534][T17249] tipc: Node identity ac14140f, cluster identity 4711 [ 433.916471][T17249] tipc: New replicast peer: 255.255.255.32 [ 433.923258][T17249] tipc: Enabled bearer , priority 10 [ 433.937388][T17155] hsr_slave_0: entered promiscuous mode [ 433.944804][T17155] hsr_slave_1: entered promiscuous mode [ 433.951690][T17155] debugfs: 'hsr0' already exists in 'hsr' [ 433.957654][T17155] Cannot create hsr debugfs directory [ 433.971945][T17253] ip6tnl2: entered allmulticast mode [ 433.978092][T17254] tipc: Disabling bearer [ 434.001399][ T5840] Bluetooth: hci0: command tx timeout [ 434.378398][T17155] netdevsim netdevsim0 eth3 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 434.424264][T17155] netdevsim netdevsim0 eth3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 434.510526][T17155] netdevsim netdevsim0 eth2 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 434.528781][T17155] netdevsim netdevsim0 eth2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 434.656132][T17282] x_tables: duplicate underflow at hook 3 [ 434.667832][T17155] netdevsim netdevsim0 eth1 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 434.678560][T17155] netdevsim netdevsim0 eth1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 434.759559][T17155] netdevsim netdevsim0 eth0 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 434.773889][T17155] netdevsim netdevsim0 eth0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 434.801845][T17289] netlink: 'syz.1.3276': attribute type 10 has an invalid length. [ 435.030084][T17155] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 435.051034][T17155] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 435.064487][T17155] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 435.076632][T17155] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 435.249935][T17155] 8021q: adding VLAN 0 to HW filter on device bond0 [ 435.279699][T17155] 8021q: adding VLAN 0 to HW filter on device team0 [ 435.297864][T14713] bridge0: port 1(bridge_slave_0) entered blocking state [ 435.305156][T14713] bridge0: port 1(bridge_slave_0) entered forwarding state [ 435.329243][T14718] bridge0: port 2(bridge_slave_1) entered blocking state [ 435.336542][T14718] bridge0: port 2(bridge_slave_1) entered forwarding state [ 435.716787][T17155] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 435.781718][T17155] veth0_vlan: entered promiscuous mode [ 435.798061][T17155] veth1_vlan: entered promiscuous mode [ 435.900369][T17155] veth0_macvtap: entered promiscuous mode [ 435.921809][T17155] veth1_macvtap: entered promiscuous mode [ 435.952876][T17155] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 435.962797][T17340] FAULT_INJECTION: forcing a failure. [ 435.962797][T17340] name failslab, interval 1, probability 0, space 0, times 0 [ 435.978782][T17340] CPU: 1 UID: 0 PID: 17340 Comm: syz.2.3291 Not tainted syzkaller #0 PREEMPT(full) [ 435.978807][T17340] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 435.978821][T17340] Call Trace: [ 435.978828][T17340] [ 435.978836][T17340] dump_stack_lvl+0x189/0x250 [ 435.978864][T17340] ? __pfx____ratelimit+0x10/0x10 [ 435.978889][T17340] ? __pfx_dump_stack_lvl+0x10/0x10 [ 435.978910][T17340] ? __pfx__printk+0x10/0x10 [ 435.978922][T17340] ? kmalloc_reserve+0xbd/0x290 [ 435.978943][T17340] ? __lock_acquire+0xab9/0xd20 [ 435.978965][T17340] should_fail_ex+0x414/0x560 [ 435.978994][T17340] should_failslab+0xa8/0x100 [ 435.979013][T17340] kmem_cache_alloc_noprof+0x74/0x6e0 [ 435.979035][T17340] ? skb_clone+0x212/0x3a0 [ 435.979055][T17340] skb_clone+0x212/0x3a0 [ 435.979071][T17340] __netlink_deliver_tap+0x404/0x850 [ 435.979094][T17340] ? netlink_deliver_tap+0x2e/0x1b0 [ 435.979108][T17340] netlink_deliver_tap+0x19c/0x1b0 [ 435.979124][T17340] netlink_unicast+0x7fa/0x9e0 [ 435.979157][T17340] ? __pfx_netlink_unicast+0x10/0x10 [ 435.979181][T17340] ? netlink_sendmsg+0x642/0xb30 [ 435.979196][T17340] ? skb_put+0x11b/0x210 [ 435.979217][T17340] netlink_sendmsg+0x805/0xb30 [ 435.979245][T17340] ? __pfx_netlink_sendmsg+0x10/0x10 [ 435.979265][T17340] ? aa_sock_msg_perm+0xf1/0x1d0 [ 435.979288][T17340] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 435.979305][T17340] ? __pfx_netlink_sendmsg+0x10/0x10 [ 435.979321][T17340] __sock_sendmsg+0x21c/0x270 [ 435.979345][T17340] ____sys_sendmsg+0x505/0x830 [ 435.979370][T17340] ? __pfx_____sys_sendmsg+0x10/0x10 [ 435.979398][T17340] ? import_iovec+0x74/0xa0 [ 435.979424][T17340] ___sys_sendmsg+0x21f/0x2a0 [ 435.979446][T17340] ? __pfx____sys_sendmsg+0x10/0x10 [ 435.979502][T17340] ? __fget_files+0x2a/0x420 [ 435.979518][T17340] ? __fget_files+0x3a0/0x420 [ 435.979553][T17340] __x64_sys_sendmsg+0x19b/0x260 [ 435.979574][T17340] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 435.979603][T17340] ? __pfx_ksys_write+0x10/0x10 [ 435.979628][T17340] ? do_syscall_64+0xbe/0xfa0 [ 435.979649][T17340] do_syscall_64+0xfa/0xfa0 [ 435.979665][T17340] ? lockdep_hardirqs_on+0x9c/0x150 [ 435.979681][T17340] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 435.979702][T17340] ? clear_bhb_loop+0x60/0xb0 [ 435.979722][T17340] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 435.979744][T17340] RIP: 0033:0x7f70c578f749 [ 435.979761][T17340] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 435.979775][T17340] RSP: 002b:00007f70c6598038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 435.979794][T17340] RAX: ffffffffffffffda RBX: 00007f70c59e5fa0 RCX: 00007f70c578f749 [ 435.979807][T17340] RDX: 0000000004000000 RSI: 0000200000000000 RDI: 0000000000000003 [ 435.979818][T17340] RBP: 00007f70c6598090 R08: 0000000000000000 R09: 0000000000000000 [ 435.979828][T17340] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 435.979837][T17340] R13: 00007f70c59e6038 R14: 00007f70c59e5fa0 R15: 00007ffeeff0f008 [ 435.979869][T17340] [ 436.291786][ T5840] Bluetooth: hci0: command tx timeout [ 436.315938][T17340] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 436.348859][T17155] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 436.366102][ T8580] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 436.375073][ T8580] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 436.383780][ T8580] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 436.394856][T10175] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 436.492205][T14713] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 436.517395][T14713] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 436.559161][T14713] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 436.569012][T14713] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 437.098210][T17374] FAULT_INJECTION: forcing a failure. [ 437.098210][T17374] name failslab, interval 1, probability 0, space 0, times 0 [ 437.111240][T17374] CPU: 0 UID: 0 PID: 17374 Comm: syz.0.3302 Not tainted syzkaller #0 PREEMPT(full) [ 437.111265][T17374] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 437.111276][T17374] Call Trace: [ 437.111284][T17374] [ 437.111291][T17374] dump_stack_lvl+0x189/0x250 [ 437.111321][T17374] ? __pfx____ratelimit+0x10/0x10 [ 437.111346][T17374] ? __pfx_dump_stack_lvl+0x10/0x10 [ 437.111368][T17374] ? __pfx__printk+0x10/0x10 [ 437.111383][T17374] ? skb_network_protocol+0x4fe/0x760 [ 437.111411][T17374] ? __pfx_skb_network_protocol+0x10/0x10 [ 437.111430][T17374] ? __lock_acquire+0xab9/0xd20 [ 437.111453][T17374] should_fail_ex+0x414/0x560 [ 437.111491][T17374] should_failslab+0xa8/0x100 [ 437.111512][T17374] kmem_cache_alloc_noprof+0x74/0x6e0 [ 437.111534][T17374] ? dev_queue_xmit_nit+0x2d/0xad0 [ 437.111552][T17374] ? skb_clone+0x212/0x3a0 [ 437.111571][T17374] ? __pfx_validate_xmit_xfrm+0x10/0x10 [ 437.111592][T17374] skb_clone+0x212/0x3a0 [ 437.111611][T17374] ? dev_queue_xmit_nit+0x268/0xad0 [ 437.111631][T17374] dev_queue_xmit_nit+0x29a/0xad0 [ 437.111650][T17374] ? dev_queue_xmit_nit+0x2d/0xad0 [ 437.111680][T17374] dev_hard_start_xmit+0x1be/0x830 [ 437.111718][T17374] __dev_queue_xmit+0x172a/0x3740 [ 437.111743][T17374] ? kmem_cache_alloc_noprof+0x367/0x6e0 [ 437.111776][T17374] ? __dev_queue_xmit+0x284/0x3740 [ 437.111807][T17374] ? __pfx___dev_queue_xmit+0x10/0x10 [ 437.111844][T17374] ? __copy_skb_header+0xa7/0x550 [ 437.111866][T17374] ? __asan_memcpy+0x40/0x70 [ 437.111907][T17374] ? skb_clone+0x246/0x3a0 [ 437.111931][T17374] __netlink_deliver_tap+0x5ad/0x850 [ 437.111964][T17374] ? netlink_deliver_tap+0x2e/0x1b0 [ 437.111985][T17374] netlink_deliver_tap+0x19c/0x1b0 [ 437.112005][T17374] netlink_unicast+0x7fa/0x9e0 [ 437.112040][T17374] ? __pfx_netlink_unicast+0x10/0x10 [ 437.112068][T17374] ? netlink_sendmsg+0x642/0xb30 [ 437.112085][T17374] ? skb_put+0x11b/0x210 [ 437.112106][T17374] netlink_sendmsg+0x805/0xb30 [ 437.112135][T17374] ? __pfx_netlink_sendmsg+0x10/0x10 [ 437.112157][T17374] ? aa_sock_msg_perm+0xf1/0x1d0 [ 437.112183][T17374] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 437.112200][T17374] ? __pfx_netlink_sendmsg+0x10/0x10 [ 437.112218][T17374] __sock_sendmsg+0x21c/0x270 [ 437.112246][T17374] ____sys_sendmsg+0x505/0x830 [ 437.112271][T17374] ? __pfx_____sys_sendmsg+0x10/0x10 [ 437.112300][T17374] ? import_iovec+0x74/0xa0 [ 437.112325][T17374] ___sys_sendmsg+0x21f/0x2a0 [ 437.112348][T17374] ? __pfx____sys_sendmsg+0x10/0x10 [ 437.112405][T17374] ? __fget_files+0x2a/0x420 [ 437.112423][T17374] ? __fget_files+0x3a0/0x420 [ 437.112457][T17374] __x64_sys_sendmsg+0x19b/0x260 [ 437.112487][T17374] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 437.112517][T17374] ? __pfx_ksys_write+0x10/0x10 [ 437.112546][T17374] ? do_syscall_64+0xbe/0xfa0 [ 437.112567][T17374] do_syscall_64+0xfa/0xfa0 [ 437.112583][T17374] ? lockdep_hardirqs_on+0x9c/0x150 [ 437.112601][T17374] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 437.112619][T17374] ? clear_bhb_loop+0x60/0xb0 [ 437.112640][T17374] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 437.112657][T17374] RIP: 0033:0x7fbdfe78f749 [ 437.112672][T17374] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 437.112688][T17374] RSP: 002b:00007fbdff633038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 437.112707][T17374] RAX: ffffffffffffffda RBX: 00007fbdfe9e5fa0 RCX: 00007fbdfe78f749 [ 437.112720][T17374] RDX: 0000000004000000 RSI: 0000200000000000 RDI: 0000000000000003 [ 437.112731][T17374] RBP: 00007fbdff633090 R08: 0000000000000000 R09: 0000000000000000 [ 437.112742][T17374] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 437.112753][T17374] R13: 00007fbdfe9e6038 R14: 00007fbdfe9e5fa0 R15: 00007ffd7f34be48 [ 437.112783][T17374] [ 437.608252][T17374] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 437.701702][ T5840] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 437.722636][ T5840] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 437.731425][ T5840] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 437.744749][ T5840] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 437.752571][ T5840] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 437.837503][T17377] lo speed is unknown, defaulting to 1000 [ 437.856443][T17383] __nla_validate_parse: 23 callbacks suppressed [ 437.856466][T17383] netlink: 28 bytes leftover after parsing attributes in process `syz.1.3305'. [ 437.876557][T17384] Bluetooth: MGMT ver 1.23 [ 438.162600][T17399] netlink: 8 bytes leftover after parsing attributes in process `syz.2.3309'. [ 438.178263][T17399] netlink: 8 bytes leftover after parsing attributes in process `syz.2.3309'. [ 438.224577][T17377] chnl_net:caif_netlink_parms(): no params data found [ 438.242933][T17400] netlink: 20 bytes leftover after parsing attributes in process `syz.1.3311'. [ 438.314138][ T5840] Bluetooth: hci0: command tx timeout [ 438.522371][T17377] bridge0: port 1(bridge_slave_0) entered blocking state [ 438.537156][T17377] bridge0: port 1(bridge_slave_0) entered disabled state [ 438.550959][T17377] bridge_slave_0: entered allmulticast mode [ 438.560547][T17377] bridge_slave_0: entered promiscuous mode [ 438.604378][T17377] bridge0: port 2(bridge_slave_1) entered blocking state [ 438.614177][T17377] bridge0: port 2(bridge_slave_1) entered disabled state [ 438.617523][T17424] netlink: 8 bytes leftover after parsing attributes in process `syz.2.3315'. [ 438.635206][T17377] bridge_slave_1: entered allmulticast mode [ 438.656303][T17377] bridge_slave_1: entered promiscuous mode [ 438.675763][T17428] netlink: 4 bytes leftover after parsing attributes in process `syz.2.3315'. [ 439.625099][T17377] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 439.690731][T17377] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 439.718725][T17435] netlink: 176 bytes leftover after parsing attributes in process `syz.3.3318'. [ 439.834913][T15388] Bluetooth: hci3: command tx timeout [ 439.857989][T17377] team0: Port device team_slave_0 added [ 439.880045][ T5840] block nbd2: Receive control failed (result -32) [ 439.896393][T17377] team0: Port device team_slave_1 added [ 439.995775][T17377] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 440.026416][T17377] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 440.060749][T17450] netlink: 8 bytes leftover after parsing attributes in process `syz.2.3323'. [ 440.061239][T17377] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 440.083045][T17452] netlink: 28 bytes leftover after parsing attributes in process `syz.0.3324'. [ 440.091472][T17377] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 440.101722][T17377] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 440.131179][T17377] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 440.178781][T17454] veth3: entered promiscuous mode [ 440.191287][T17456] netlink: 8 bytes leftover after parsing attributes in process `syz.2.3325'. [ 440.302964][T17377] hsr_slave_0: entered promiscuous mode [ 440.318225][T17377] hsr_slave_1: entered promiscuous mode [ 440.335299][T17377] debugfs: 'hsr0' already exists in 'hsr' [ 440.341063][T17377] Cannot create hsr debugfs directory [ 440.394654][ T5840] Bluetooth: hci0: command tx timeout [ 440.563811][T17461] lo speed is unknown, defaulting to 1000 [ 440.673368][T17468] netlink: 'syz.3.3329': attribute type 10 has an invalid length. [ 440.753132][T17469] syzkaller0: entered promiscuous mode [ 440.754575][T17471] netlink: 'syz.1.3330': attribute type 10 has an invalid length. [ 440.759943][T17469] syzkaller0: entered allmulticast mode [ 441.192851][T17492] netlink: 'syz.0.3337': attribute type 1 has an invalid length. [ 441.371227][T17377] netdevsim netdevsim4 netdevsim0: renamed from eth0 [ 441.391852][T17377] netdevsim netdevsim4 netdevsim1: renamed from eth1 [ 441.416805][T17377] netdevsim netdevsim4 netdevsim2: renamed from eth2 [ 441.439542][T17377] netdevsim netdevsim4 netdevsim3: renamed from eth3 [ 441.670401][T17377] 8021q: adding VLAN 0 to HW filter on device bond0 [ 441.708201][T17377] 8021q: adding VLAN 0 to HW filter on device team0 [ 441.726801][T14712] bridge0: port 1(bridge_slave_0) entered blocking state [ 441.734050][T14712] bridge0: port 1(bridge_slave_0) entered forwarding state [ 441.755325][T14713] bridge0: port 2(bridge_slave_1) entered blocking state [ 441.762517][T14713] bridge0: port 2(bridge_slave_1) entered forwarding state [ 441.917655][ T5840] Bluetooth: hci3: command tx timeout [ 441.996814][T17530] ip6tnl2: entered allmulticast mode [ 442.306098][T17377] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 442.451677][T17557] netlink: 'syz.2.3355': attribute type 8 has an invalid length. [ 442.503363][T17553] netdevsim netdevsim1 netdevsim3 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 442.539626][T17553] netdevsim netdevsim1 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 442.693752][T17553] netdevsim netdevsim1 netdevsim2 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 442.707172][T17553] netdevsim netdevsim1 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 442.842637][T17571] netlink: 'syz.2.3357': attribute type 2 has an invalid length. [ 442.859076][T17553] netdevsim netdevsim1 netdevsim1 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 442.869785][T17553] netdevsim netdevsim1 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 442.941469][T17553] netdevsim netdevsim1 netdevsim0 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 442.952105][T17553] netdevsim netdevsim1 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 442.982842][T17575] delete_channel: no stack [ 443.070727][T17377] veth0_vlan: entered promiscuous mode [ 443.091903][T17579] netlink: 'syz.2.3360': attribute type 10 has an invalid length. [ 443.112560][T17377] veth1_vlan: entered promiscuous mode [ 443.150852][T14718] netdevsim netdevsim1 eth0: set [0, 0] type 1 family 0 port 8472 - 0 [ 443.171007][T14718] netdevsim netdevsim1 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 443.203346][T14713] netdevsim netdevsim1 eth1: set [0, 0] type 1 family 0 port 8472 - 0 [ 443.212171][T14713] netdevsim netdevsim1 eth1: set [1, 0] type 2 family 0 port 6081 - 0 [ 443.273048][T17377] veth0_macvtap: entered promiscuous mode [ 443.287985][T14712] netdevsim netdevsim1 eth2: set [0, 0] type 1 family 0 port 8472 - 0 [ 443.300492][T14712] netdevsim netdevsim1 eth2: set [1, 0] type 2 family 0 port 6081 - 0 [ 443.351356][T17377] veth1_macvtap: entered promiscuous mode [ 443.370070][T17590] __nla_validate_parse: 17 callbacks suppressed [ 443.370088][T17590] netlink: 32 bytes leftover after parsing attributes in process `syz.2.3362'. [ 443.432415][T14712] netdevsim netdevsim1 eth3: set [0, 0] type 1 family 0 port 8472 - 0 [ 443.449079][T14712] netdevsim netdevsim1 eth3: set [1, 0] type 2 family 0 port 6081 - 0 [ 443.461747][T17585] lo speed is unknown, defaulting to 1000 [ 443.472070][T17377] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 443.496628][T17377] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 443.510193][T17590] netlink: 4 bytes leftover after parsing attributes in process `syz.2.3362'. [ 443.513318][T14712] netdevsim netdevsim4 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 443.553280][T14712] netdevsim netdevsim4 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 443.620245][T14712] netdevsim netdevsim4 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 443.640366][T14712] netdevsim netdevsim4 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 443.835198][ C1] bridge0: received packet on bridge_slave_1 with own address as source address (addr:aa:aa:aa:aa:aa:1c, vlan:0) [ 443.948360][T14712] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 443.972225][T14712] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 444.004225][ T5840] Bluetooth: hci3: command tx timeout [ 444.105957][T10175] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 444.136630][T10175] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 444.279803][T17615] vlan3: entered allmulticast mode [ 444.490587][T17626] lo speed is unknown, defaulting to 1000 [ 444.709011][T17617] lo speed is unknown, defaulting to 1000 [ 444.715563][T17639] netlink: 132 bytes leftover after parsing attributes in process `syz.1.3375'. [ 444.736438][T17635] netlink: 8 bytes leftover after parsing attributes in process `syz.3.3373'. [ 444.740003][T17634] netlink: 12 bytes leftover after parsing attributes in process `syz.4.3374'. [ 444.861169][T17634] Bluetooth: MGMT ver 1.23 [ 445.057990][T17647] netlink: 528 bytes leftover after parsing attributes in process `syz.0.3376'. [ 445.103779][T17647] netlink: 28 bytes leftover after parsing attributes in process `syz.0.3376'. [ 445.558934][T17657] netlink: 12 bytes leftover after parsing attributes in process `syz.2.3379'. [ 445.857518][T17668] netlink: 'syz.2.3382': attribute type 8 has an invalid length. [ 445.894055][T17668] netlink: 4 bytes leftover after parsing attributes in process `syz.2.3382'. [ 445.956440][T17670] netlink: 20 bytes leftover after parsing attributes in process `syz.0.3384'. [ 445.967907][T17674] netlink: 'syz.4.3386': attribute type 3 has an invalid length. [ 446.033940][T17678] netlink: 'syz.1.3387': attribute type 5 has an invalid length. [ 446.076380][ T5840] Bluetooth: hci3: command tx timeout [ 446.084687][T17685] syzkaller1: entered promiscuous mode [ 446.096138][T17685] syzkaller1: entered allmulticast mode [ 446.169962][T14712] netdevsim netdevsim3 netdevsim0: set [0, 0] type 1 family 0 port 8472 - 0 [ 446.189592][T14712] netdevsim netdevsim3 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0 [ 446.208492][T14712] netdevsim netdevsim3 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0 [ 446.221964][T14712] netdevsim netdevsim3 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0 [ 446.427449][T17697] xt_connbytes: Forcing CT accounting to be enabled [ 446.446571][T17697] netlink: 'syz.0.3392': attribute type 10 has an invalid length. [ 446.520185][T17697] bond0: (slave wlan1): Enslaving as an active interface with an up link [ 446.613756][T17712] syzkaller0: entered promiscuous mode [ 446.632975][T17712] syzkaller0: entered allmulticast mode [ 446.682567][T17713] lo speed is unknown, defaulting to 1000 [ 448.508794][T17773] smc: net device bond0 applied user defined pnetid SYZ2 [ 448.543916][T17773] __nla_validate_parse: 7 callbacks suppressed [ 448.543932][T17773] netlink: 14 bytes leftover after parsing attributes in process `syz.4.3420'. [ 448.630512][T17780] netlink: 408 bytes leftover after parsing attributes in process `syz.4.3420'. [ 448.649507][T17780] netlink: 12 bytes leftover after parsing attributes in process `syz.4.3420'. [ 448.834652][T17773] smc: removing net device bond0 with user defined pnetid SYZ2 [ 448.851188][T17773] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 448.867397][T17773] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 448.883373][T17773] bond0 (unregistering): Released all slaves [ 448.947201][T17782] netlink: 'syz.0.3423': attribute type 8 has an invalid length. [ 449.015508][T17785] netlink: 8 bytes leftover after parsing attributes in process `syz.1.3424'. [ 449.103395][T17792] syzkaller0: entered promiscuous mode [ 449.154074][T17792] syzkaller0: entered allmulticast mode [ 449.419740][T17814] netlink: 8 bytes leftover after parsing attributes in process `syz.0.3429'. [ 449.437282][T17814] netlink: 4 bytes leftover after parsing attributes in process `syz.0.3429'. [ 449.496137][T17815] veth3: entered promiscuous mode [ 449.609984][T17818] netlink: 7 bytes leftover after parsing attributes in process `syz.1.3432'. [ 449.622382][T17818] netlink: 40 bytes leftover after parsing attributes in process `syz.1.3432'. [ 449.948942][T17836] netlink: 8 bytes leftover after parsing attributes in process `syz.4.3436'. [ 449.981546][T17830] netlink: 172 bytes leftover after parsing attributes in process `syz.4.3436'. [ 449.991982][T17830] A link change request failed with some changes committed already. Interface netdevsim0 may have been left with an inconsistent configuration, please check. [ 450.304250][T17843] lo speed is unknown, defaulting to 1000 [ 450.412520][T17853] SET target dimension over the limit! [ 450.887670][T17859] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 451.419638][T17883] netlink: 'syz.2.3455': attribute type 39 has an invalid length. [ 451.606548][ T5931] IPVS: starting estimator thread 0... [ 451.681300][T17900] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 451.717335][T17894] netlink: 'syz.0.3457': attribute type 25 has an invalid length. [ 451.735140][T17898] IPVS: using max 29 ests per chain, 69600 per kthread [ 451.736041][T17894] netlink: 'syz.0.3457': attribute type 7 has an invalid length. [ 451.762643][T17894] netlink: 'syz.0.3457': attribute type 1 has an invalid length. [ 451.795309][T17894] bridge0: port 1(bridge_slave_0) entered disabled state [ 452.176252][T17927] netlink: 'syz.0.3468': attribute type 9 has an invalid length. [ 452.284298][T17924] lo speed is unknown, defaulting to 1000 [ 452.429062][T17935] x_tables: duplicate underflow at hook 4 [ 452.812248][T17952] wlan1: mtu greater than device maximum [ 452.888618][T17964] lo speed is unknown, defaulting to 1000 [ 453.373616][T17966] lo speed is unknown, defaulting to 1000 [ 453.597612][T17990] __nla_validate_parse: 12 callbacks suppressed [ 453.597629][T17990] netlink: 8 bytes leftover after parsing attributes in process `syz.4.3479'. [ 453.671188][T17990] syzkaller1: entered promiscuous mode [ 453.685494][T17990] syzkaller1: entered allmulticast mode [ 453.725614][T17992] netlink: 8 bytes leftover after parsing attributes in process `syz.0.3480'. [ 453.747690][T17992] netlink: 8 bytes leftover after parsing attributes in process `syz.0.3480'. [ 453.784469][T17996] netlink: 'syz.2.3481': attribute type 8 has an invalid length. [ 453.802897][T17996] netlink: 4 bytes leftover after parsing attributes in process `syz.2.3481'. [ 453.921739][T18001] netlink: 'syz.3.3483': attribute type 11 has an invalid length. [ 454.046263][T18012] netlink: 20 bytes leftover after parsing attributes in process `syz.2.3487'. [ 454.156503][T18018] netlink: 'syz.4.3488': attribute type 39 has an invalid length. [ 454.229640][T18020] syzkaller0: tun_chr_ioctl cmd 1074025677 [ 454.236705][T18020] syzkaller0: linktype set to 780 [ 454.487588][T18052] netlink: 'syz.1.3491': attribute type 8 has an invalid length. [ 454.548565][T18055] rdma_rxe: rxe_newlink: failed to add ip6_vti0 [ 454.591277][T18058] netlink: 'syz.0.3497': attribute type 8 has an invalid length. [ 454.599247][T18058] netlink: 4 bytes leftover after parsing attributes in process `syz.0.3497'. [ 454.613017][T18058] bond0: entered promiscuous mode [ 454.618268][T18058] bond_slave_0: entered promiscuous mode [ 454.624261][T18058] bond_slave_1: entered promiscuous mode [ 454.630166][T18058] mac80211_hwsim hwsim39 wlan1: entered promiscuous mode [ 454.644279][T18058] gretap0: entered promiscuous mode [ 454.650538][T18058] veth0_to_batadv: entered promiscuous mode [ 454.657726][T18058] debugfs: 'hsr1' already exists in 'hsr' [ 454.663600][T18058] Cannot create hsr debugfs directory [ 454.669259][T18058] hsr1: entered promiscuous mode [ 454.879649][T18066] netlink: 240 bytes leftover after parsing attributes in process `syz.0.3498'. [ 455.182941][T18075] ip6tnl5: entered allmulticast mode [ 455.270271][T18079] syzkaller0: tun_chr_ioctl cmd 1074025677 [ 455.295664][T18079] syzkaller0: linktype set to 780 [ 455.408728][T18088] 8021q: adding VLAN 0 to HW filter on device bond1 [ 455.535701][T18101] netlink: 4 bytes leftover after parsing attributes in process `syz.4.3508'. [ 455.659295][T18087] netlink: 20 bytes leftover after parsing attributes in process `syz.2.3505'. [ 455.806528][T18112] netlink: 8 bytes leftover after parsing attributes in process `syz.4.3510'. [ 456.095174][T18120] team0: Port device dummy0 added [ 456.162587][T18121] team0: Port device dummy0 removed [ 456.187807][T18121] dummy0: entered promiscuous mode [ 456.193765][T18121] bond0: (slave dummy0): Enslaving as an active interface with an up link [ 456.551275][T18134] ip6tnl6: entered allmulticast mode [ 456.657395][T18138] validate_nla: 5 callbacks suppressed [ 456.657413][T18138] netlink: 'syz.3.3519': attribute type 1 has an invalid length. [ 456.682214][T18138] netlink: 'syz.3.3519': attribute type 1 has an invalid length. [ 456.707843][T18141] x_tables: duplicate underflow at hook 1 [ 456.734710][T18143] netlink: 'syz.2.3520': attribute type 39 has an invalid length. [ 457.101869][T18168] bond1: option ad_actor_sys_prio: invalid value (0) [ 457.110186][T18168] bond1: option ad_actor_sys_prio: allowed values 1 - 65535 [ 457.126436][T18168] bond1 (unregistering): Released all slaves [ 457.203136][T18174] ip6tnl3: entered allmulticast mode [ 457.805324][T18199] netlink: 'syz.3.3534': attribute type 5 has an invalid length. [ 457.829049][T18202] xt_hashlimit: max too large, truncated to 1048576 [ 457.844698][T18202] xt_bpf: check failed: parse error [ 457.848026][T18199] geneve2: entered promiscuous mode [ 457.858358][T18199] geneve2: entered allmulticast mode [ 457.879897][T14712] netdevsim netdevsim3 netdevsim0: set [1, 1] type 2 family 0 port 256 - 0 [ 457.904243][T14712] netdevsim netdevsim3 netdevsim1: set [1, 1] type 2 family 0 port 256 - 0 [ 457.972217][T14712] netdevsim netdevsim3 netdevsim2: set [1, 1] type 2 family 0 port 256 - 0 [ 457.983219][T14712] netdevsim netdevsim3 netdevsim3: set [1, 1] type 2 family 0 port 256 - 0 [ 458.016516][T18203] lo speed is unknown, defaulting to 1000 [ 458.497123][T18225] tipc: Started in network mode [ 458.510854][T18225] tipc: Node identity 4, cluster identity 4711 [ 458.518884][T18225] tipc: Node number set to 4 [ 458.762646][T18246] lo speed is unknown, defaulting to 1000 [ 459.480741][T18267] FAULT_INJECTION: forcing a failure. [ 459.480741][T18267] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 459.496822][T18267] CPU: 0 UID: 0 PID: 18267 Comm: syz.1.3550 Not tainted syzkaller #0 PREEMPT(full) [ 459.496848][T18267] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 459.496858][T18267] Call Trace: [ 459.496865][T18267] [ 459.496872][T18267] dump_stack_lvl+0x189/0x250 [ 459.496907][T18267] ? __pfx____ratelimit+0x10/0x10 [ 459.496930][T18267] ? __pfx_dump_stack_lvl+0x10/0x10 [ 459.496949][T18267] ? __pfx__printk+0x10/0x10 [ 459.496965][T18267] ? __might_fault+0xb0/0x130 [ 459.496996][T18267] should_fail_ex+0x414/0x560 [ 459.497023][T18267] _copy_from_iter+0x1de/0x1790 [ 459.497039][T18267] ? kmem_cache_alloc_node_noprof+0x483/0x710 [ 459.497060][T18267] ? kmalloc_reserve+0xbd/0x290 [ 459.497088][T18267] ? __pfx__copy_from_iter+0x10/0x10 [ 459.497102][T18267] ? __alloc_skb+0x2f1/0x430 [ 459.497119][T18267] ? __pfx___alloc_skb+0x10/0x10 [ 459.497137][T18267] ? netlink_sendmsg+0x642/0xb30 [ 459.497152][T18267] ? skb_put+0x11b/0x210 [ 459.497172][T18267] netlink_sendmsg+0x6b2/0xb30 [ 459.497197][T18267] ? __pfx_netlink_sendmsg+0x10/0x10 [ 459.497218][T18267] ? aa_sock_msg_perm+0xf1/0x1d0 [ 459.497242][T18267] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 459.497258][T18267] ? __pfx_netlink_sendmsg+0x10/0x10 [ 459.497275][T18267] __sock_sendmsg+0x21c/0x270 [ 459.497299][T18267] ____sys_sendmsg+0x505/0x830 [ 459.497322][T18267] ? __pfx_____sys_sendmsg+0x10/0x10 [ 459.497349][T18267] ? import_iovec+0x74/0xa0 [ 459.497370][T18267] ___sys_sendmsg+0x21f/0x2a0 [ 459.497390][T18267] ? __pfx____sys_sendmsg+0x10/0x10 [ 459.497442][T18267] ? __fget_files+0x2a/0x420 [ 459.497457][T18267] ? __fget_files+0x3a0/0x420 [ 459.497481][T18267] __x64_sys_sendmsg+0x19b/0x260 [ 459.497501][T18267] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 459.497528][T18267] ? __pfx_ksys_write+0x10/0x10 [ 459.497552][T18267] ? do_syscall_64+0xbe/0xfa0 [ 459.497572][T18267] do_syscall_64+0xfa/0xfa0 [ 459.497585][T18267] ? lockdep_hardirqs_on+0x9c/0x150 [ 459.497601][T18267] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 459.497617][T18267] ? clear_bhb_loop+0x60/0xb0 [ 459.497635][T18267] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 459.497650][T18267] RIP: 0033:0x7ff25978f749 [ 459.497666][T18267] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 459.497679][T18267] RSP: 002b:00007ff25a641038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 459.497697][T18267] RAX: ffffffffffffffda RBX: 00007ff2599e5fa0 RCX: 00007ff25978f749 [ 459.497708][T18267] RDX: 0000000000000000 RSI: 0000200000000040 RDI: 0000000000000003 [ 459.497718][T18267] RBP: 00007ff25a641090 R08: 0000000000000000 R09: 0000000000000000 [ 459.497728][T18267] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 459.497737][T18267] R13: 00007ff2599e6038 R14: 00007ff2599e5fa0 R15: 00007ffe54e1c6f8 [ 459.497766][T18267] [ 459.830901][T18269] __nla_validate_parse: 9 callbacks suppressed [ 459.830918][T18269] netlink: 4776 bytes leftover after parsing attributes in process `syz.1.3551'. [ 460.692134][T18272] mac80211_hwsim hwsim35 wlan1: entered allmulticast mode [ 460.715762][T18274] A link change request failed with some changes committed already. Interface gretap0 may have been left with an inconsistent configuration, please check. [ 460.758696][T18278] syzkaller0: entered promiscuous mode [ 460.767341][T18278] syzkaller0: entered allmulticast mode [ 460.947308][T18286] netlink: 4 bytes leftover after parsing attributes in process `syz.4.3556'. [ 461.000208][T18286] bridge_slave_1: left allmulticast mode [ 461.011011][T18286] bridge_slave_1: left promiscuous mode [ 461.019497][T18286] bridge0: port 2(bridge_slave_1) entered disabled state [ 461.035133][T18286] bridge_slave_0: left allmulticast mode [ 461.040971][T18286] bridge_slave_0: left promiscuous mode [ 461.063786][T18286] bridge0: port 1(bridge_slave_0) entered disabled state [ 461.113384][T18297] FAULT_INJECTION: forcing a failure. [ 461.113384][T18297] name failslab, interval 1, probability 0, space 0, times 0 [ 461.126889][T18297] CPU: 0 UID: 0 PID: 18297 Comm: syz.2.3561 Not tainted syzkaller #0 PREEMPT(full) [ 461.126914][T18297] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 461.126924][T18297] Call Trace: [ 461.126931][T18297] [ 461.126939][T18297] dump_stack_lvl+0x189/0x250 [ 461.126964][T18297] ? __pfx____ratelimit+0x10/0x10 [ 461.126989][T18297] ? __pfx_dump_stack_lvl+0x10/0x10 [ 461.127010][T18297] ? __pfx__printk+0x10/0x10 [ 461.127024][T18297] ? kmalloc_reserve+0xbd/0x290 [ 461.127047][T18297] ? __lock_acquire+0xab9/0xd20 [ 461.127071][T18297] should_fail_ex+0x414/0x560 [ 461.127100][T18297] should_failslab+0xa8/0x100 [ 461.127119][T18297] kmem_cache_alloc_noprof+0x74/0x6e0 [ 461.127143][T18297] ? skb_clone+0x212/0x3a0 [ 461.127167][T18297] skb_clone+0x212/0x3a0 [ 461.127189][T18297] __netlink_deliver_tap+0x404/0x850 [ 461.127219][T18297] ? netlink_deliver_tap+0x2e/0x1b0 [ 461.127238][T18297] netlink_deliver_tap+0x19c/0x1b0 [ 461.127257][T18297] netlink_unicast+0x7fa/0x9e0 [ 461.127289][T18297] ? __pfx_netlink_unicast+0x10/0x10 [ 461.127315][T18297] ? netlink_sendmsg+0x642/0xb30 [ 461.127331][T18297] ? skb_put+0x11b/0x210 [ 461.127352][T18297] netlink_sendmsg+0x805/0xb30 [ 461.127379][T18297] ? __pfx_netlink_sendmsg+0x10/0x10 [ 461.127401][T18297] ? aa_sock_msg_perm+0xf1/0x1d0 [ 461.127426][T18297] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 461.127442][T18297] ? __pfx_netlink_sendmsg+0x10/0x10 [ 461.127461][T18297] __sock_sendmsg+0x21c/0x270 [ 461.127487][T18297] ____sys_sendmsg+0x505/0x830 [ 461.127512][T18297] ? __pfx_____sys_sendmsg+0x10/0x10 [ 461.127539][T18297] ? import_iovec+0x74/0xa0 [ 461.127562][T18297] ___sys_sendmsg+0x21f/0x2a0 [ 461.127584][T18297] ? __pfx____sys_sendmsg+0x10/0x10 [ 461.127641][T18297] ? __fget_files+0x2a/0x420 [ 461.127657][T18297] ? __fget_files+0x3a0/0x420 [ 461.127684][T18297] __x64_sys_sendmsg+0x19b/0x260 [ 461.127706][T18297] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 461.127736][T18297] ? __pfx_ksys_write+0x10/0x10 [ 461.127762][T18297] ? do_syscall_64+0xbe/0xfa0 [ 461.127789][T18297] do_syscall_64+0xfa/0xfa0 [ 461.127804][T18297] ? lockdep_hardirqs_on+0x9c/0x150 [ 461.127821][T18297] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 461.127838][T18297] ? clear_bhb_loop+0x60/0xb0 [ 461.127859][T18297] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 461.127875][T18297] RIP: 0033:0x7f70c578f749 [ 461.127890][T18297] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 461.127905][T18297] RSP: 002b:00007f70c6598038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 461.127923][T18297] RAX: ffffffffffffffda RBX: 00007f70c59e5fa0 RCX: 00007f70c578f749 [ 461.127934][T18297] RDX: 0000000000000000 RSI: 0000200000000040 RDI: 0000000000000003 [ 461.127945][T18297] RBP: 00007f70c6598090 R08: 0000000000000000 R09: 0000000000000000 [ 461.127956][T18297] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 461.127966][T18297] R13: 00007f70c59e6038 R14: 00007f70c59e5fa0 R15: 00007ffeeff0f008 [ 461.127996][T18297] [ 461.193811][T18299] openvswitch: netlink: nsh attr 0 has unexpected len 116 expected 0 [ 461.257187][T18300] netlink: 24 bytes leftover after parsing attributes in process `syz.3.3560'. [ 461.258707][T18299] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 461.598975][T18307] netlink: 'syz.2.3562': attribute type 39 has an invalid length. [ 461.626246][T18308] netlink: 176 bytes leftover after parsing attributes in process `syz.0.3563'. [ 465.594646][ C0] ip6_tunnel: ip6gretap5 xmit: Local address not yet configured! [ 470.714266][ C0] ip6_tunnel: ip6gretap6 xmit: Local address not yet configured! [ 527.429469][T18329] netlink: 'syz.2.3568': attribute type 1 has an invalid length. [ 527.496386][T18332] netlink: 'syz.3.3569': attribute type 7 has an invalid length. [ 527.558740][T18329] 8021q: adding VLAN 0 to HW filter on device bond2 [ 527.672037][T18334] bond2: (slave gretap1): making interface the new active one [ 527.682342][T18334] bond2: (slave gretap1): Enslaving as an active interface with an up link [ 527.698839][T18343] netlink: 8 bytes leftover after parsing attributes in process `syz.4.3570'. [ 527.741236][T18329] netlink: 4 bytes leftover after parsing attributes in process `syz.2.3568'. [ 527.991735][T18347] xt_hashlimit: max too large, truncated to 1048576 [ 528.011057][T18347] netlink: 12 bytes leftover after parsing attributes in process `syz.3.3572'. [ 528.062427][T18329] bond2 (unregistering): (slave gretap1): Releasing active interface [ 528.079203][T18329] bond2 (unregistering): Released all slaves [ 528.188110][T18344] lo speed is unknown, defaulting to 1000 [ 528.448790][T18355] syz_tun: entered allmulticast mode [ 528.556344][T18355] syz_tun: entered promiscuous mode [ 528.578777][T18355] macvtap1: entered promiscuous mode [ 528.610018][T18355] syz_tun: left promiscuous mode [ 528.700708][T18360] netlink: 8 bytes leftover after parsing attributes in process `syz.3.3576'. [ 528.721569][T18360] netlink: 8 bytes leftover after parsing attributes in process `syz.3.3576'. [ 529.197574][T18371] IPVS: length: 141 != 8 [ 529.206860][T18381] netlink: 'syz.3.3580': attribute type 1 has an invalid length. [ 529.234734][T18381] netlink: 'syz.3.3580': attribute type 1 has an invalid length. [ 529.456127][T18392] netlink: 8 bytes leftover after parsing attributes in process `syz.4.3585'. [ 529.558929][T18402] lo speed is unknown, defaulting to 1000 [ 529.724599][T18411] netlink: 'syz.3.3589': attribute type 10 has an invalid length. [ 529.741934][T18411] netlink: 2 bytes leftover after parsing attributes in process `syz.3.3589'. [ 529.752151][T18399] llcp: llcp_sock_recvmsg: Recv datagram failed state 3 -6 0 [ 529.818637][T18417] netlink: 24 bytes leftover after parsing attributes in process `syz.2.3591'. [ 529.895774][T18411] team0: entered promiscuous mode [ 529.900924][T18411] team_slave_0: entered promiscuous mode [ 529.906933][T18411] team_slave_1: entered promiscuous mode [ 529.913223][T18411] bridge0: port 3(team0) entered blocking state [ 529.919771][T18411] bridge0: port 3(team0) entered disabled state [ 529.926438][T18411] team0: entered allmulticast mode [ 529.931567][T18411] team_slave_0: entered allmulticast mode [ 529.938399][T18411] team_slave_1: entered allmulticast mode [ 529.947440][T18411] bridge0: port 3(team0) entered blocking state [ 529.953795][T18411] bridge0: port 3(team0) entered forwarding state [ 530.016497][T18424] pim6reg: entered allmulticast mode [ 530.046045][T18418] pim6reg: left allmulticast mode [ 530.300458][T18439] netlink: 'syz.2.3599': attribute type 1 has an invalid length. [ 530.308032][T18437] netlink: 'syz.3.3598': attribute type 39 has an invalid length. [ 530.329600][T18436] netlink: 20 bytes leftover after parsing attributes in process `syz.1.3597'. [ 530.345701][T18439] 8021q: adding VLAN 0 to HW filter on device bond2 [ 530.410734][T18444] 8021q: adding VLAN 0 to HW filter on device bond2 [ 530.418299][T18444] bond2: (slave vxcan3): The slave device specified does not support setting the MAC address [ 530.439215][T18444] bond2: (slave vxcan3): Error -95 calling set_mac_address [ 530.539444][T18439] veth5: entered promiscuous mode [ 530.586022][T18439] bond2: (slave veth5): Enslaving as an active interface with a down link [ 530.706547][T18457] netlink: 'syz.4.3604': attribute type 39 has an invalid length. [ 530.800095][T18459] team0: left allmulticast mode [ 530.805192][T18459] team_slave_0: left allmulticast mode [ 530.810663][T18459] team_slave_1: left allmulticast mode [ 530.821172][T18459] bridge0: port 3(team0) entered disabled state [ 530.892364][T18459] bridge_slave_0: left allmulticast mode [ 530.909253][T18459] bridge_slave_0: left promiscuous mode [ 530.916981][T18459] bridge0: port 1(bridge_slave_0) entered disabled state [ 530.937610][T18459] bridge_slave_1: left allmulticast mode [ 530.943344][T18459] bridge_slave_1: left promiscuous mode [ 530.952865][T18459] bridge0: port 2(bridge_slave_1) entered disabled state [ 531.029335][T18459] bond0: (slave bond_slave_0): Releasing backup interface [ 531.043922][T18459] bond0: (slave bond_slave_1): Releasing backup interface [ 531.057074][T18459] team_slave_0: left promiscuous mode [ 531.095081][T18472] netlink: 8 bytes leftover after parsing attributes in process `syz.1.3606'. [ 531.126248][T18459] team0: Port device team_slave_0 removed [ 531.133300][T18459] team_slave_1: left promiscuous mode [ 531.171275][T18459] team0: Port device team_slave_1 removed [ 531.183932][T18459] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 531.191664][T18459] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 531.199651][T18478] xt_CT: No such helper "netbios-ns" [ 531.202208][T18459] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 531.214227][T18459] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 531.224127][T18459] A link change request failed with some changes committed already. Interface hsr_slave_0 may have been left with an inconsistent configuration, please check. [ 531.241984][T18461] team0: Mode changed to "activebackup" [ 531.281128][T18493] syzkaller0: tun_chr_ioctl cmd 1074025677 [ 531.297907][T18493] syzkaller0: linktype set to 780 [ 531.312433][T18465] lo speed is unknown, defaulting to 1000 [ 531.739734][T18503] llcp: llcp_sock_recvmsg: Recv datagram failed state 3 -6 0 [ 531.909402][T18516] tipc: Started in network mode [ 531.925195][T18516] tipc: Node identity 9a0a8d56dbec, cluster identity 4711 [ 531.943862][T18516] tipc: Enabled bearer , priority 0 [ 531.985474][T18521] syzkaller0: entered promiscuous mode [ 531.990980][T18521] syzkaller0: entered allmulticast mode [ 532.119313][T18525] team0: Port device team_slave_0 removed [ 532.192083][T18525] team0: Port device team_slave_1 removed [ 532.217493][T18525] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 532.241918][T18525] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 532.270391][T18537] netlink: 'syz.4.3618': attribute type 10 has an invalid length. [ 532.281110][T18525] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 532.307897][T18525] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 532.318355][T18525] A link change request failed with some changes committed already. Interface hsr_slave_0 may have been left with an inconsistent configuration, please check. [ 532.344321][T18521] tipc: Resetting bearer [ 532.363132][T18514] tipc: Resetting bearer [ 532.379433][T18514] tipc: Disabling bearer [ 532.417937][T18542] A link change request failed with some changes committed already. Interface gretap0 may have been left with an inconsistent configuration, please check. [ 532.545731][T18544] team0: No ports can be present during mode change [ 532.775030][T18553] __nla_validate_parse: 2 callbacks suppressed [ 532.775046][T18553] netlink: 8 bytes leftover after parsing attributes in process `syz.0.3625'. [ 532.811088][T18547] xt_CT: No such helper "netbios-ns" [ 532.822202][T18551] smc: adding net device bond0 with user defined pnetid SYZ2 [ 532.889918][T18551] bond0: option lacp_active: mode dependency failed, not supported in mode balance-alb(6) [ 532.978912][T18551] smc: removing net device bond0 with user defined pnetid SYZ2 [ 533.073216][T18551] bond0 (unregistering): Released all slaves [ 533.252328][T18546] lo speed is unknown, defaulting to 1000 [ 533.836766][T18588] netlink: 'syz.4.3631': attribute type 1 has an invalid length. [ 533.908938][T18588] smc: adding net device bond0 with user defined pnetid SYZ2 [ 533.918548][T18588] 8021q: adding VLAN 0 to HW filter on device bond0 [ 534.008180][T18595] 8021q: adding VLAN 0 to HW filter on device bond0 [ 534.018677][T18595] bond0: (slave vxcan3): The slave device specified does not support setting the MAC address [ 534.030678][T18595] bond0: (slave vxcan3): Error -95 calling set_mac_address [ 534.066160][T18594] geneve3: entered promiscuous mode [ 534.073422][T18596] syzkaller0: tun_chr_ioctl cmd 1074025677 [ 534.080780][T18596] syzkaller0: linktype set to 780 [ 534.155747][T18588] veth5: entered promiscuous mode [ 534.175385][T18588] bond0: (slave veth5): Enslaving as an active interface with a down link [ 534.206831][T14713] netdevsim netdevsim3 netdevsim0: set [1, 2] type 2 family 0 port 20001 - 0 [ 534.222382][T18603] tipc: Started in network mode [ 534.235283][T18603] tipc: Node identity 2a2d19a63b6d, cluster identity 4711 [ 534.242498][ T5827] Bluetooth: hci5: command 0x0419 tx timeout [ 534.248655][T18603] tipc: Enabled bearer , priority 0 [ 534.268466][T18612] syzkaller0: entered promiscuous mode [ 534.274475][T18612] syzkaller0: entered allmulticast mode [ 534.333879][T14713] netdevsim netdevsim3 netdevsim1: set [1, 2] type 2 family 0 port 20001 - 0 [ 534.353953][T18615] netlink: 8 bytes leftover after parsing attributes in process `syz.1.3638'. [ 534.369336][T18615] netlink: 8 bytes leftover after parsing attributes in process `syz.1.3638'. [ 534.446406][T18607] tipc: Resetting bearer [ 534.458906][T14713] netdevsim netdevsim3 netdevsim2: set [1, 2] type 2 family 0 port 20001 - 0 [ 534.487250][T14713] netdevsim netdevsim3 netdevsim3: set [1, 2] type 2 family 0 port 20001 - 0 [ 534.493512][T18603] netlink: 12 bytes leftover after parsing attributes in process `syz.2.3636'. [ 534.594482][T18602] tipc: Resetting bearer [ 534.650742][T18602] tipc: Disabling bearer [ 534.682951][T18632] netlink: 'syz.3.3643': attribute type 8 has an invalid length. [ 534.691294][T18632] netlink: 4 bytes leftover after parsing attributes in process `syz.3.3643'. [ 534.710541][T18632] bond0: entered promiscuous mode [ 534.716413][T18632] mac80211_hwsim hwsim33 wlan1: entered promiscuous mode [ 534.725840][T18632] gretap0: entered promiscuous mode [ 534.732700][T18632] veth0_to_batadv: entered promiscuous mode [ 534.754149][T18632] debugfs: 'hsr1' already exists in 'hsr' [ 534.764056][T18632] Cannot create hsr debugfs directory [ 534.792363][T18634] netlink: 12 bytes leftover after parsing attributes in process `syz.4.3644'. [ 534.794083][T18632] hsr1: entered promiscuous mode [ 534.870520][T18634] 8021q: adding VLAN 0 to HW filter on device bond1 [ 534.901023][T18642] ip6tnl7: entered allmulticast mode [ 534.946166][T18639] syzkaller0: tun_chr_ioctl cmd 1074025677 [ 534.953873][T18639] syzkaller0: linktype set to 780 [ 534.959734][T18638] syzkaller0: tun_chr_ioctl cmd 1074025677 [ 534.968658][T18638] syzkaller0: linktype set to 780 [ 535.172212][T18654] netlink: 8 bytes leftover after parsing attributes in process `syz.3.3649'. [ 535.343617][T18667] netlink: 'syz.1.3653': attribute type 13 has an invalid length. [ 535.462851][T18667] bridge0: port 2(bridge_slave_1) entered disabled state [ 535.470182][T18667] bridge0: port 1(bridge_slave_0) entered disabled state [ 535.490357][T18667] batman_adv: batadv0: Interface deactivated: dummy0 [ 535.580853][T18667] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 535.603730][T18667] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 535.739030][T18670] netlink: 8 bytes leftover after parsing attributes in process `syz.0.3654'. [ 535.748489][T18670] netlink: 8 bytes leftover after parsing attributes in process `syz.0.3654'. [ 535.791315][T14716] netdevsim netdevsim1 eth0: unset [0, 0] type 1 family 0 port 8472 - 0 [ 535.802844][T14716] netdevsim netdevsim1 eth0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 535.824854][T14716] netdevsim netdevsim1 eth1: unset [0, 0] type 1 family 0 port 8472 - 0 [ 535.850149][T14716] netdevsim netdevsim1 eth1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 535.876366][T14716] netdevsim netdevsim1 eth2: unset [0, 0] type 1 family 0 port 8472 - 0 [ 535.890985][T14716] netdevsim netdevsim1 eth2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 535.905558][T14716] netdevsim netdevsim1 eth3: unset [0, 0] type 1 family 0 port 8472 - 0 [ 535.915924][T14716] netdevsim netdevsim1 eth3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 535.939377][T18684] tipc: Enabled bearer , priority 0 [ 535.948144][T18684] syzkaller0: entered promiscuous mode [ 535.953720][T18684] syzkaller0: entered allmulticast mode [ 535.995983][T18684] tipc: Resetting bearer [ 536.026230][T18684] netlink: 12 bytes leftover after parsing attributes in process `syz.1.3656'. [ 536.045521][T18682] tipc: Resetting bearer [ 536.070777][T18682] tipc: Disabling bearer [ 536.132748][T18690] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 536.310795][T18697] syzkaller0: tun_chr_ioctl cmd 1074025677 [ 536.330525][T18697] syzkaller0: linktype set to 780 [ 536.448515][T18712] netlink: 'syz.2.3665': attribute type 13 has an invalid length. [ 536.817425][T18712] bridge0: port 2(bridge_slave_1) entered disabled state [ 536.824872][T18712] bridge0: port 1(bridge_slave_0) entered disabled state [ 537.065279][T18712] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 537.087448][T18712] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 537.414258][T14712] netdevsim netdevsim2 netdevsim0: unset [0, 0] type 1 family 0 port 8472 - 0 [ 537.428922][T14712] netdevsim netdevsim2 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 537.442442][T14712] netdevsim netdevsim2 netdevsim1: unset [0, 0] type 1 family 0 port 8472 - 0 [ 537.463492][T14712] netdevsim netdevsim2 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 537.513428][T14712] netdevsim netdevsim2 netdevsim2: unset [0, 0] type 1 family 0 port 8472 - 0 [ 537.526109][T14712] netdevsim netdevsim2 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 537.545648][T14712] netdevsim netdevsim2 netdevsim3: unset [0, 0] type 1 family 0 port 8472 - 0 [ 537.563691][T14712] netdevsim netdevsim2 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 537.873452][T18758] syzkaller0: tun_chr_ioctl cmd 1074025677 [ 537.880755][T18758] syzkaller0: linktype set to 780 [ 537.961043][T18770] netlink: 'syz.3.3683': attribute type 8 has an invalid length. [ 537.977451][T18770] __nla_validate_parse: 6 callbacks suppressed [ 537.977470][T18770] netlink: 4 bytes leftover after parsing attributes in process `syz.3.3683'. [ 538.224747][T18784] netlink: 8 bytes leftover after parsing attributes in process `syz.3.3689'. [ 538.301758][T18787] lo speed is unknown, defaulting to 1000 [ 538.323289][T18789] netlink: 4 bytes leftover after parsing attributes in process `syz.2.3692'. [ 538.379415][T18795] netlink: 24 bytes leftover after parsing attributes in process `syz.0.3694'. [ 538.381470][T18796] netlink: 4 bytes leftover after parsing attributes in process `syz.3.3693'. [ 538.433427][T18799] netlink: 12 bytes leftover after parsing attributes in process `syz.3.3693'. [ 538.482676][T18800] ip6tnl1: entered allmulticast mode [ 538.621860][T18803] netlink: 'syz.2.3696': attribute type 29 has an invalid length. [ 538.740084][T18803] netlink: 'syz.2.3696': attribute type 29 has an invalid length. [ 538.767101][T18808] netlink: 'syz.2.3696': attribute type 29 has an invalid length. [ 538.767207][T18810] netlink: 4 bytes leftover after parsing attributes in process `syz.2.3696'. [ 538.816763][T18808] netlink: 'syz.2.3696': attribute type 29 has an invalid length. [ 538.827288][T18808] netlink: 'syz.2.3696': attribute type 29 has an invalid length. [ 539.030514][T18815] validate_nla: 2 callbacks suppressed [ 539.030529][T18815] netlink: 'syz.0.3700': attribute type 8 has an invalid length. [ 539.047338][T18815] netlink: 4 bytes leftover after parsing attributes in process `syz.0.3700'. [ 539.192230][T18820] netlink: 100 bytes leftover after parsing attributes in process `syz.2.3702'. [ 539.264561][T18824] netlink: 8 bytes leftover after parsing attributes in process `syz.2.3705'. [ 539.346870][T18828] vlan3: entered promiscuous mode [ 539.387584][T18830] ip6tnl1: entered allmulticast mode [ 539.632794][T18844] netlink: 'syz.0.3712': attribute type 13 has an invalid length. [ 539.765198][T18854] netlink: 'syz.4.3716': attribute type 8 has an invalid length. [ 539.843068][T18844] bridge0: port 2(bridge_slave_1) entered disabled state [ 539.921871][T18844] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 539.935469][T18844] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 540.072009][T18854] bond0: entered promiscuous mode [ 540.083068][T18854] gretap0: entered promiscuous mode [ 540.090323][T18854] veth0_to_batadv: entered promiscuous mode [ 540.097884][T18854] debugfs: 'hsr1' already exists in 'hsr' [ 540.103850][T18854] Cannot create hsr debugfs directory [ 540.109990][T18854] hsr1: entered promiscuous mode [ 540.119514][T14718] netdevsim netdevsim0 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 540.134956][T14718] netdevsim netdevsim0 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 540.161448][T14718] netdevsim netdevsim0 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 540.227017][T14718] netdevsim netdevsim0 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 540.316028][T18875] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 540.344880][T18875] xt_hashlimit: overflow, try lower: 18446744073709551615/255 [ 540.361780][T18876] ip6tnl8: entered allmulticast mode [ 540.451560][T18881] syzkaller0: tun_chr_ioctl cmd 1074025677 [ 540.457798][T18881] syzkaller0: linktype set to 780 [ 540.610886][T18892] netlink: 'syz.3.3728': attribute type 13 has an invalid length. [ 540.706632][T18897] netlink: 'syz.0.3730': attribute type 8 has an invalid length. [ 541.040876][T18892] batman_adv: batadv0: Interface deactivated: macvlan2 [ 541.153808][T14716] netdevsim netdevsim3 netdevsim0: unset [0, 0] type 1 family 0 port 8472 - 0 [ 541.188925][T14716] netdevsim netdevsim3 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 541.228067][T14716] netdevsim netdevsim3 netdevsim0: unset [1, 1] type 2 family 0 port 256 - 0 [ 541.255731][T14716] netdevsim netdevsim3 netdevsim0: unset [1, 2] type 2 family 0 port 20001 - 0 [ 541.274257][T14716] netdevsim netdevsim3 netdevsim1: unset [0, 0] type 1 family 0 port 8472 - 0 [ 541.294857][T14716] netdevsim netdevsim3 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 541.319927][T14716] netdevsim netdevsim3 netdevsim1: unset [1, 1] type 2 family 0 port 256 - 0 [ 541.333335][T14716] netdevsim netdevsim3 netdevsim1: unset [1, 2] type 2 family 0 port 20001 - 0 [ 541.343048][T14716] netdevsim netdevsim3 netdevsim2: unset [0, 0] type 1 family 0 port 8472 - 0 [ 541.352535][T14716] netdevsim netdevsim3 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 541.365895][T14716] netdevsim netdevsim3 netdevsim2: unset [1, 1] type 2 family 0 port 256 - 0 [ 541.375569][T14716] netdevsim netdevsim3 netdevsim2: unset [1, 2] type 2 family 0 port 20001 - 0 [ 541.598597][T18920] ip6tnl2: entered allmulticast mode [ 541.638108][T14716] netdevsim netdevsim3 netdevsim3: unset [0, 0] type 1 family 0 port 8472 - 0 [ 541.664728][T14716] netdevsim netdevsim3 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 541.673635][T14716] netdevsim netdevsim3 netdevsim3: unset [1, 1] type 2 family 0 port 256 - 0 [ 541.694186][T14716] netdevsim netdevsim3 netdevsim3: unset [1, 2] type 2 family 0 port 20001 - 0 [ 541.770657][T18938] syzkaller0: tun_chr_ioctl cmd 1074025677 [ 541.786627][T18938] syzkaller0: linktype set to 780 [ 541.792079][T18936] netlink: 'syz.1.3740': attribute type 29 has an invalid length. [ 541.822209][T18936] netlink: 'syz.1.3740': attribute type 29 has an invalid length. [ 541.883244][T18944] netlink: 'syz.3.3744': attribute type 10 has an invalid length. [ 541.926609][T18936] netlink: 'syz.1.3740': attribute type 29 has an invalid length. [ 541.950143][T18944] geneve0: entered promiscuous mode [ 541.963197][T18944] team0: Port device geneve0 added [ 541.969276][T14716] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 541.982455][T18936] netlink: 'syz.1.3740': attribute type 29 has an invalid length. [ 541.997677][T14716] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 542.029295][T14716] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 542.068657][T14716] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 542.239311][T18958] team1: entered promiscuous mode [ 542.251606][T18958] team1: entered allmulticast mode [ 542.260532][T18958] 8021q: adding VLAN 0 to HW filter on device team1 [ 542.452985][T18976] ip6tnl2: entered allmulticast mode [ 542.471464][T18977] syzkaller0: entered promiscuous mode [ 542.477147][T18977] syzkaller0: entered allmulticast mode [ 542.783575][T18987] veth0: entered promiscuous mode [ 542.837448][T18986] veth0: left promiscuous mode [ 542.988389][T19009] __nla_validate_parse: 21 callbacks suppressed [ 542.988488][T19009] netlink: 240 bytes leftover after parsing attributes in process `syz.1.3765'. [ 543.008566][T19009] openvswitch: netlink: ufid size 164 bytes exceeds the range (1, 16) [ 543.016303][T19011] ip6tnl5: entered allmulticast mode [ 543.017724][T19009] openvswitch: netlink: Message has 75 unknown bytes. [ 543.140361][T19018] syzkaller0: entered promiscuous mode [ 543.146224][T19018] syzkaller0: entered allmulticast mode [ 543.180455][T19023] syzkaller0: entered promiscuous mode [ 543.186106][T19023] syzkaller0: entered allmulticast mode [ 543.251450][T19027] netlink: 20 bytes leftover after parsing attributes in process `syz.4.3772'. [ 543.294520][T19025] netlink: 8 bytes leftover after parsing attributes in process `syz.2.3768'. [ 543.422262][T19037] netlink: 4 bytes leftover after parsing attributes in process `syz.4.3775'. [ 543.592442][T19047] netlink: 4 bytes leftover after parsing attributes in process `syz.0.3778'. [ 543.623338][T19047] netlink: 12 bytes leftover after parsing attributes in process `syz.0.3778'. [ 543.639419][T19049] ip6tnl9: entered allmulticast mode [ 543.946848][T19059] netlink: 48 bytes leftover after parsing attributes in process `syz.3.3780'. [ 544.474382][ T5827] Bluetooth: hci2: command 0x0406 tx timeout [ 545.049082][T19095] syzkaller0: tun_chr_ioctl cmd 1074025677 [ 545.055214][T19095] syzkaller0: linktype set to 780 [ 545.060587][T19090] netlink: 32 bytes leftover after parsing attributes in process `syz.3.3793'. [ 545.237832][T19106] netlink: 8 bytes leftover after parsing attributes in process `syz.3.3796'. [ 545.250092][T19106] netlink: 28 bytes leftover after parsing attributes in process `syz.3.3796'. [ 545.292622][T19104] syzkaller0: entered promiscuous mode [ 545.304314][T19104] syzkaller0: entered allmulticast mode [ 545.810224][T19132] nbd: must specify at least one socket [ 546.049559][T19136] validate_nla: 7 callbacks suppressed [ 546.049574][T19136] netlink: 'syz.3.3806': attribute type 39 has an invalid length. [ 546.050875][T19137] lo speed is unknown, defaulting to 1000 [ 546.595066][T19150] syzkaller0: entered promiscuous mode [ 546.610842][T19150] syzkaller0: entered allmulticast mode [ 546.812010][T19156] netlink: 'syz.0.3814': attribute type 3 has an invalid length. [ 546.930293][T19158] lo speed is unknown, defaulting to 1000 [ 547.148453][T19168] netlink: 'syz.3.3818': attribute type 39 has an invalid length. [ 547.315520][T19170] veth3: entered promiscuous mode [ 547.443384][T19187] syzkaller0: tun_chr_ioctl cmd 1074025677 [ 547.454696][T19187] syzkaller0: linktype set to 780 [ 547.481139][T19192] vlan4: entered promiscuous mode [ 547.486302][T19192] geneve1: entered promiscuous mode [ 547.491798][T19192] vlan4: entered allmulticast mode [ 547.497980][T19192] geneve1: entered allmulticast mode [ 547.599500][T19195] bond2: (slave ip6gretap1): Enslaving as an active interface with an up link [ 547.620273][T19195] bond2 (unregistering): (slave ip6gretap1): Releasing backup interface [ 547.646633][T19195] bond2 (unregistering): Released all slaves [ 547.790446][T19211] netlink: 'syz.3.3835': attribute type 39 has an invalid length. [ 547.812642][T19209] bridge2: port 1(veth11) entered blocking state [ 547.829610][T19209] bridge2: port 1(veth11) entered disabled state [ 547.842182][T19209] veth11: entered allmulticast mode [ 547.850204][T19209] veth11: entered promiscuous mode [ 548.036835][T19223] lo speed is unknown, defaulting to 1000 [ 548.089918][T19224] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 548.128966][T19224] netlink: 'syz.3.3838': attribute type 2 has an invalid length. [ 548.171065][T19233] xt_limit: Overflow, try lower: 271964/0 [ 548.192517][T19229] __nla_validate_parse: 23 callbacks suppressed [ 548.192541][T19229] netlink: 20 bytes leftover after parsing attributes in process `syz.0.3840'. [ 548.216051][T19233] netlink: 25 bytes leftover after parsing attributes in process `syz.1.3842'. [ 548.328115][T19233] netlink: 24 bytes leftover after parsing attributes in process `syz.1.3842'. [ 548.441761][T19239] syzkaller0: tun_chr_ioctl cmd 1074025677 [ 548.448392][T19239] syzkaller0: linktype set to 780 [ 548.485675][T19246] netlink: 32 bytes leftover after parsing attributes in process `syz.0.3845'. [ 548.586754][T19250] netlink: 4 bytes leftover after parsing attributes in process `syz.0.3847'. [ 548.654518][T19253] netlink: 8 bytes leftover after parsing attributes in process `syz.0.3847'. [ 548.874545][ T5827] Bluetooth: hci3: command 0x0405 tx timeout [ 548.930992][T19264] ip6tnl10: entered allmulticast mode [ 549.239275][T19291] netlink: 'syz.2.3861': attribute type 1 has an invalid length. [ 549.252141][T19291] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 549.252534][T19294] netlink: 180 bytes leftover after parsing attributes in process `syz.2.3861'. [ 549.330005][T19301] sctp: [Deprecated]: syz.2.3864 (pid 19301) Use of struct sctp_assoc_value in delayed_ack socket option. [ 549.330005][T19301] Use struct sctp_sack_info instead [ 549.413567][T19306] netlink: 4 bytes leftover after parsing attributes in process `syz.2.3865'. [ 549.499387][T19310] netlink: 24 bytes leftover after parsing attributes in process `syz.4.3867'. [ 549.551642][T19312] netlink: 56 bytes leftover after parsing attributes in process `syz.2.3868'. [ 549.727916][T19319] tipc: Started in network mode [ 549.742865][T19319] tipc: Node identity , cluster identity 4711 [ 549.764298][T19319] tipc: Failed to obtain node identity [ 549.772076][T19319] tipc: Enabling of bearer rejected, failed to enable media [ 549.855892][T19328] netlink: 'syz.0.3874': attribute type 2 has an invalid length. [ 549.906517][T19328] netlink: 'syz.0.3874': attribute type 9 has an invalid length. [ 549.948744][T19337] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 549.968048][T19338] netlink: 'syz.2.3877': attribute type 8 has an invalid length. [ 550.430741][T19360] smc: net device bond0 applied user defined pnetid SYZ0 [ 550.893882][T19378] netlink: 'syz.4.3887': attribute type 39 has an invalid length. [ 551.124487][T14720] unregister_netdevice: waiting for vcan0 to become free. Usage count = 2 [ 551.230304][T19399] ip6tnl6: entered allmulticast mode [ 554.714168][ T5827] Bluetooth: hci0: command 0x0406 tx timeout