last executing test programs: 27.827749365s ago: executing program 4 (id=9367): r0 = socket(0x10, 0x3, 0x0) syz_genetlink_get_family_id$fou(0x0, r0) r1 = socket$packet(0x11, 0x3, 0x300) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000000)={'ip6gretap0\x00', 0x0}) sendmsg$nl_route_sched(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000680)=@newqdisc={0x3c, 0x24, 0xf0b, 0x0, 0x25dfdbff, {0x60, 0x0, 0x0, r2, {0x0, 0x3}, {0xffff, 0xffff}, {0x2}}, [@qdisc_kind_options=@q_cake={{0x9}, {0xc, 0x2, [@TCA_CAKE_WASH={0x8}]}}]}, 0x3c}, 0x1, 0x0, 0x0, 0x24040800}, 0x0) 27.646789915s ago: executing program 4 (id=9370): r0 = socket$inet_smc(0x2b, 0x1, 0x0) ppoll(&(0x7f00000000c0)=[{r0, 0x100}], 0x1, 0x0, 0x0, 0x0) setsockopt$inet_tcp_TCP_FASTOPEN_KEY(r0, 0x6, 0x21, &(0x7f0000000040)="5766b1b827f600333b09d3748ee7d700", 0x10) listen(r0, 0xffffffff) shutdown(r0, 0x0) 27.399702795s ago: executing program 4 (id=9373): r0 = socket$inet(0xa, 0x801, 0x84) connect$inet(r0, &(0x7f0000004cc0)={0x2, 0x0, @remote={0xac, 0x14, 0xffffffffffffffff}}, 0x10) listen(r0, 0x8) r1 = accept4(r0, 0x0, 0x0, 0x0) getsockopt$inet_sctp6_SCTP_MAX_BURST(r1, 0x84, 0x14, &(0x7f00000000c0), &(0x7f0000000100)=0x4) 27.120194247s ago: executing program 4 (id=9377): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r0, &(0x7f00000000c0)={0xa, 0x4e22, 0x9, @ipv4={'\x00', '\xff\xff', @remote}, 0x6}, 0x1c) sendmsg$inet6(r0, &(0x7f0000000480)={&(0x7f0000000040)={0xa, 0x4e20, 0x89a8, @remote, 0x2}, 0x4f, 0x0}, 0x20008814) connect$inet6(r0, &(0x7f0000000080)={0xa, 0x4e22, 0x7, @ipv4={'\x00', '\xff\xff', @empty}, 0x106}, 0x1c) syz_emit_ethernet(0x36, &(0x7f0000000100)={@local, @empty, @void, {@ipv4={0x800, @tcp={{0x5, 0x4, 0x2, 0x3, 0x28, 0x64, 0x0, 0x7, 0x6, 0x0, @remote, @remote}, {{0x4e22, 0x4e22, 0x41424344, 0x41424344, 0x0, 0x0, 0x5, 0x4, 0x6071, 0x0, 0xe7}}}}}}, 0x0) 26.857080769s ago: executing program 0 (id=9381): r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL802154_CMD_SET_LBT_MODE(r0, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000740)={0x14, 0x0, 0x4, 0xfffffffc, 0x25dfdbfd}, 0x14}}, 0x0) syz_genetlink_get_family_id$nfc(&(0x7f0000000cc0), r0) r1 = syz_genetlink_get_family_id$netlbl_mgmt(&(0x7f0000000380), r0) sendmsg$NLBL_MGMT_C_VERSION(r0, &(0x7f0000001380)={0x0, 0x0, &(0x7f0000001340)={&(0x7f0000000080)={0xb4, r1, 0xf03, 0x0, 0x0, {}, [@NLBL_MGMT_A_DOMAIN={0xa0, 0x1, '\x05\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xc1\x9fz\x14T\xd5o\xdd\xf9m3vH\xf7\xcf\xc3\xc0A?\xc7\xce^\x12\xbc\xba\xd6\x80\xb7\xa9\xbc\xc9\x0e\x8ek\x83a\xdb\x14\xf7\xe8\xfb\xa0\f\x12\xf3R\xf8\xeb\xfb\xa7\xc0j_[\xc0\x1d}M\x81\xc2\x02\xbc\x84\xd4&RTP\xa7\xfb\xefe+\xfcuy\x832i\x87m\tB\x86\xf24S[\x89\x7f\xe23\xc6bj\xa7\xe4\x9c\x8eH\x86\xd9\xd4#\xa6\xda\x88\xbf\xf3\xe4\f\xf1jT\x80j\xcd\x1a\x1b\xd8^\xef\x99\x14\x8a*\xe6K\x87c\x93my\x18\xe8H\x103\xf0'}]}, 0xb4}}, 0x0) 26.703084918s ago: executing program 0 (id=9383): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x13, &(0x7f0000000180)=0x100000001, 0x4) connect$inet6(r0, &(0x7f0000000200)={0xa, 0x0, 0x0, @loopback}, 0x1c) setsockopt$inet6_tcp_TCP_ULP(r0, 0x6, 0x1f, &(0x7f0000000540), 0x3c) setsockopt$inet6_tcp_int(r0, 0x11a, 0x9, 0x0, 0x0) 26.588631858s ago: executing program 0 (id=9384): r0 = socket$inet6_udp(0xa, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000c80)={'lo\x00', 0x0}) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$wireguard(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$WG_CMD_SET_DEVICE(r2, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000dc0)={0x1c, r3, 0x5, 0x70bd2a, 0x25dfdbfd, {}, [@WGDEVICE_A_IFINDEX={0x8, 0x1, r1}]}, 0x1c}, 0x1, 0x0, 0x0, 0x4000}, 0x40) 26.439656731s ago: executing program 0 (id=9389): socketpair$tipc(0x1e, 0x5, 0x0, &(0x7f0000000500)={0xffffffffffffffff, 0xffffffffffffffff}) recvmsg(r0, &(0x7f0000000ac0)={0x0, 0x0, &(0x7f0000000540)=[{&(0x7f0000000680)=""/153, 0x99}], 0x1, &(0x7f0000002f40)=""/229, 0xe5}, 0x0) sendmsg$tipc(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f00000005c0)="b8d3d8e48974aae56e0046d828cd3b00000000008bdf0100d6b9aa5ffc723899ad120c5a54b1c64080f64f103ee1de769e5e9dd847dc85fea662eaad499c52a16f40cb3a0900000000000000b2e6b5397f7806b6ff846de37a34c8342bbac5a51eacf8a09cede8676044eafd3d7935f90651aa2d9c57276322b82e8976f5a4d980eaeb3b636630b810f2e200"/154, 0x9a}], 0x1, 0x0, 0x0, 0x84}, 0x20000000) mmap(&(0x7f0000003000/0x2000)=nil, 0x2000, 0x0, 0x31, 0xffffffffffffffff, 0xfb83a000) close(r1) 26.184557658s ago: executing program 0 (id=9393): r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl802154(&(0x7f0000001d00), r0) ioctl$sock_SIOCGIFINDEX_802154(0xffffffffffffffff, 0x8933, 0x0) ioctl$sock_SIOCGIFINDEX_802154(r0, 0x8933, &(0x7f0000001e40)={'wpan0\x00', 0x0}) sendmsg$NL802154_CMD_GET_INTERFACE(r0, &(0x7f0000001f40)={&(0x7f0000001cc0)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f0000001f00)={&(0x7f0000001e80)={0x5c, r1, 0x1, 0x70bd28, 0x25dfdbfb, {}, [@NL802154_ATTR_IFINDEX={0x8}, @NL802154_ATTR_IFINDEX={0x8}, @NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x200000002}, @NL802154_ATTR_IFINDEX={0x8}, @NL802154_ATTR_IFINDEX={0x8}, @NL802154_ATTR_IFINDEX={0x8}, @NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x3}, @NL802154_ATTR_IFINDEX={0x8, 0x3, r2}]}, 0x5c}, 0x1, 0x0, 0x0, 0x40000c0}, 0x20008000) 26.164498632s ago: executing program 4 (id=9394): r0 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$inet_MCAST_JOIN_GROUP(r0, 0x0, 0x2a, &(0x7f0000000180)={0x2, {{0x2, 0x0, @multicast2}}}, 0x88) setsockopt$inet_MCAST_MSFILTER(r0, 0x0, 0x30, &(0x7f0000000600)=ANY=[@ANYBLOB="020000000000000002000000e0000002000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000100000002"], 0x110) setsockopt$inet_group_source_req(r0, 0x0, 0x2c, &(0x7f00000006c0)={0x2, {{0x2, 0x0, @multicast2}}, {{0x2, 0x0, @empty}}}, 0x108) setsockopt$inet_group_source_req(r0, 0x0, 0x2c, &(0x7f00000004c0)={0x2, {{0x2, 0x0, @multicast2}}, {{0x2, 0x0, @private}}}, 0x108) 25.734029312s ago: executing program 0 (id=9402): sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000300)=@newlink={0x34, 0x10, 0x401, 0x800000, 0x0, {0x0, 0x0, 0x0, 0x0, 0x32b, 0x3069e}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @vcan={{0x9}, {0x4}}}]}, 0x34}, 0x1, 0x0, 0x0, 0x20000000}, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000002c0)={'macvlan0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f00000000c0)={0x0, 0x0, &(0x7f00000010c0)={&(0x7f0000000300)=ANY=[@ANYBLOB="440000001000010400"/20, @ANYRES32=r1, @ANYBLOB="00001700000000001c0037"], 0x44}, 0x1, 0x0, 0x0, 0x50}, 0x0) 25.716948284s ago: executing program 4 (id=9403): r0 = socket$pppl2tp(0x18, 0x1, 0x1) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0x275a, 0x0) write$tun(r1, &(0x7f0000000000)=ANY=[], 0x38) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1, 0x10012, r1, 0x0) connect$pppl2tp(r0, &(0x7f0000000040)=@pppol2tpin6={0x18, 0x1, {0x0, r0, 0x4, 0x3, 0x0, 0x1, {0xa, 0x4e21, 0x480, @dev={0xfe, 0x80, '\x00', 0x40}, 0x1}}}, 0x32) 25.300355564s ago: executing program 32 (id=9402): sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000300)=@newlink={0x34, 0x10, 0x401, 0x800000, 0x0, {0x0, 0x0, 0x0, 0x0, 0x32b, 0x3069e}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @vcan={{0x9}, {0x4}}}]}, 0x34}, 0x1, 0x0, 0x0, 0x20000000}, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000002c0)={'macvlan0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f00000000c0)={0x0, 0x0, &(0x7f00000010c0)={&(0x7f0000000300)=ANY=[@ANYBLOB="440000001000010400"/20, @ANYRES32=r1, @ANYBLOB="00001700000000001c0037"], 0x44}, 0x1, 0x0, 0x0, 0x50}, 0x0) 25.269690539s ago: executing program 33 (id=9403): r0 = socket$pppl2tp(0x18, 0x1, 0x1) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0x275a, 0x0) write$tun(r1, &(0x7f0000000000)=ANY=[], 0x38) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1, 0x10012, r1, 0x0) connect$pppl2tp(r0, &(0x7f0000000040)=@pppol2tpin6={0x18, 0x1, {0x0, r0, 0x4, 0x3, 0x0, 0x1, {0xa, 0x4e21, 0x480, @dev={0xfe, 0x80, '\x00', 0x40}, 0x1}}}, 0x32) 2.329195981s ago: executing program 6 (id=9837): r0 = socket(0x10, 0x803, 0x0) syz_genetlink_get_family_id$tipc(&(0x7f0000000400), r0) getsockname$packet(r0, &(0x7f0000000600)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000001c0)=0x14) r2 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000240)={0x2, 0x4, 0x8, 0x1, 0x80, 0xffffffffffffffff, 0x0, '\x00', 0x0, 0x0}, 0x48) sendmsg$nl_route(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000040)=ANY=[@ANYBLOB="480000001000030500"/20, @ANYRES32=r1, @ANYBLOB="0000000040000200280012800a000100767863616e000000180002801400010000000000", @ANYRES64=r2], 0x48}, 0x1, 0x0, 0x0, 0x2400008c}, 0x0) 2.087367642s ago: executing program 6 (id=9840): r0 = socket$inet6(0xa, 0x80002, 0x88) bind$inet6(r0, &(0x7f0000000000)={0xa, 0x10000000004e20, 0x0, @mcast2, 0x6}, 0x1c) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, 0x0, 0x0) recvfrom$inet6(r0, 0x0, 0x0, 0xc0010102, 0x0, 0x0) syz_emit_ethernet(0x83, &(0x7f0000000040)=ANY=[@ANYBLOB="aaaaaaaaaaaaaaaaf9ff030486dd601b8b97004d88c19e9ace00000000000000002100000002ff02000000000000000000000000000104004e200023b0"], 0x0) 1.909199839s ago: executing program 2 (id=9844): r0 = socket$inet(0xa, 0x801, 0x84) connect$inet(r0, &(0x7f0000004cc0)={0x2, 0x0, @remote={0xac, 0x14, 0xffffffffffffffff}}, 0x10) listen(r0, 0x8) r1 = accept4(r0, 0x0, 0x0, 0x0) getsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(r1, 0x84, 0x9, &(0x7f0000000400)={0x0, @in={{0x2, 0x4e20, @empty}}, 0x7, 0x1e10, 0x4, 0x5, 0x30, 0x8, 0x8a}, &(0x7f00000004c0)=0x9c) 1.787813015s ago: executing program 2 (id=9847): r0 = socket$netlink(0x10, 0x3, 0x0) setsockopt$IPT_SO_SET_REPLACE(0xffffffffffffffff, 0x0, 0x40, &(0x7f0000000240)=@filter={'filter\x00', 0xc, 0x4, 0x260, 0xffffffff, 0x130, 0x98, 0x0, 0x98, 0xffffffff, 0x1c8, 0x1c8, 0x1c8, 0x98, 0x4, 0x0, {[{{@uncond, 0x0, 0x70, 0x98}, @REJECT={0x28}}, {{@uncond, 0x0, 0x70, 0x98}, @common=@unspec=@STANDARD={0x28, '\x00', 0x0, 0xffffffffffffffff}}, {{@uncond, 0x0, 0x70, 0x98}, @common=@unspec=@NFQUEUE2={0x28}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x2c0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000000)={'macsec0\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000002c0)=ANY=[@ANYBLOB="3c0000001000010010000002ffebdf2530000000", @ANYRES32=r2, @ANYBLOB="20000000000000001c0012800b0001006d616373656300000c00028005000f"], 0x3c}}, 0x0) 1.466729407s ago: executing program 5 (id=9853): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x129a01, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) r1 = socket$kcm(0x2, 0xa, 0x2) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @broadcast}) write$tun(r0, &(0x7f0000000040)={@val={0x0, 0x800}, @val={0x1, 0x0, 0x0, 0x3, 0x3d}, @mpls={[], @ipv4=@tcp={{0x5, 0x4, 0x0, 0x0, 0x3f, 0x0, 0x0, 0x0, 0x84, 0x0, @empty=0x3fffffff, @local}, {{0x4e24, 0x0, 0x41424344, 0x41424344, 0x0, 0x2, 0x8, 0x0, 0x7, 0x0, 0x13, {[@timestamp={0x5, 0xa, 0x460000c1, 0x4000}]}}, {"2244070000bc0be4bdf9da"}}}}}, 0x4d) 1.465599453s ago: executing program 1 (id=9854): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000180)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_AUTHENTICATE(r1, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000440)={&(0x7f00000001c0)={0x3c, r2, 0x1, 0x70bd28, 0x25dfdbfb, {{}, {@val={0x8, 0x3, r3}, @void}}, [@NL80211_ATTR_MAC={0xa, 0x6, @random="0e7668d28bc7"}, @NL80211_ATTR_SSID={0x4}, @NL80211_ATTR_AUTH_TYPE={0x8, 0x35, 0x5}, @chandef_params=[@NL80211_ATTR_WIPHY_FREQ={0x8, 0x26, @random=0x9b4}]]}, 0x3c}, 0x1, 0x0, 0x0, 0x4}, 0x800) 1.465312798s ago: executing program 2 (id=9855): r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$ieee802154(&(0x7f00000001c0), r0) r2 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_802154(r2, 0x8933, &(0x7f0000000340)={'wpan0\x00', 0x0}) sendmsg$IEEE802154_LLSEC_ADD_DEV(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000001100)={0x38, r1, 0x852dd6c070cd7e4d, 0x0, 0x0, {}, [@IEEE802154_ATTR_LLSEC_FRAME_COUNTER={0x8}, @IEEE802154_ATTR_HW_ADDR={0xc}, @IEEE802154_ATTR_DEV_INDEX={0x8, 0x2, r3}, @IEEE802154_ATTR_LLSEC_DEV_OVERRIDE={0x5, 0x36, 0x1}]}, 0x38}, 0x4, 0x700000000000000}, 0x0) 1.367618846s ago: executing program 3 (id=9856): ioctl$sock_ipv6_tunnel_SIOCADDTUNNEL(0xffffffffffffffff, 0x89f1, &(0x7f00000000c0)={'syztnl0\x00', &(0x7f0000000040)={'syztnl2\x00', 0x0, 0x29, 0x80, 0xd, 0x2, 0x10, @ipv4={'\x00', '\xff\xff', @broadcast}, @ipv4={'\x00', '\xff\xff', @multicast1}, 0x7800, 0x10, 0x14853, 0x400000}}) r0 = socket$kcm(0x10, 0x2, 0x10) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000240)=@newtaction={0x48, 0x30, 0x53b, 0x0, 0x0, {0x9}, [{0x34, 0x1, [@m_sample={0x30, 0x1, 0x0, 0x0, {{0xb}, {0x4}, {0x4}, {0xc}, {0xc, 0x4, {0x3}}}}]}]}, 0x48}}, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000001140)={&(0x7f0000000040)=ANY=[@ANYBLOB="680000001000030500"/20, @ANYRES32=0x0, @ANYBLOB="0000000000000000400012800c0001006d6163766c616e0030000280080006"], 0x68}}, 0x0) sendmsg$kcm(r0, &(0x7f0000000000)={0x0, 0xd18c9b25, &(0x7f0000000080)=[{&(0x7f0000000040)="e03f03003f000b05d25a806c8c6394f90324fc60100002000a000300053582c137153e3704020180fc0b09000c00", 0x33fe0}], 0x1}, 0x0) 1.313165194s ago: executing program 1 (id=9857): r0 = socket$inet_tcp(0x2, 0x1, 0x0) connect$inet(r0, &(0x7f0000000180)={0x2, 0x4e21, @empty}, 0x10) setsockopt$inet_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f00000001c0)='dctcp', 0x5) r1 = socket$inet6(0x10, 0x2, 0x4) sendto$inet6(r1, &(0x7f0000000080)="4c00000012001f15b9409b849ac00a00a5784002000000000000030038c88cc055c5ac27a6c5b068d0bf46d323452536005ad94a461cdbfee9bdb9423523599751d1ec0cffc8792cd8000080", 0x4c, 0x0, 0x0, 0x0) 1.232853961s ago: executing program 2 (id=9858): syz_emit_ethernet(0x76, &(0x7f0000000080)={@local, @remote, @void, {@ipv4={0x800, @tcp={{0x5, 0x4, 0x0, 0x0, 0x68, 0x0, 0x0, 0x0, 0x6, 0x0, @remote, @local}, {{0x0, 0x4001, 0x41424344, 0x41424344, 0x0, 0x0, 0x5, 0x2}}}}}}, 0x0) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0xc0041, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) ioctl$TUNSETVNETHDRSZ(r0, 0x400454d8, &(0x7f0000000140)=0x90) write$tun(r0, &(0x7f0000000080)=ANY=[@ANYRESOCT], 0xfdef) 1.183069367s ago: executing program 6 (id=9859): r0 = socket$inet(0xa, 0x801, 0x84) setsockopt$sock_int(r0, 0x1, 0x23, &(0x7f00000000c0)=0x6, 0x4) connect$inet(r0, &(0x7f0000004cc0)={0x2, 0x0, @remote={0xac, 0x14, 0xffffffffffffffff}}, 0x10) listen(r0, 0x8) accept4(r0, 0x0, 0x0, 0x0) 1.136156629s ago: executing program 3 (id=9860): r0 = socket$igmp6(0xa, 0x3, 0x2) r1 = socket$packet(0x11, 0x2, 0x300) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000080)={'ip6tnl0\x00', 0x0}) ioctl$sock_inet6_SIOCADDRT(r0, 0x890b, &(0x7f00000005c0)={@dev={0xfe, 0x80, '\x00', 0x40}, @remote, @remote, 0x3, 0x2, 0x5, 0x400, 0xb7, 0xc20022, r2}) syz_emit_ethernet(0x82, &(0x7f0000000040)={@broadcast, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x80}, @val={@void}, {@ipv6={0x86dd, @icmpv6={0x0, 0x6, "f53a04", 0x48, 0x3a, 0x0, @remote, @mcast2, {[], @param_prob={0x2, 0x0, 0x0, 0x500, {0x0, 0x6, '\x00', 0x0, 0x0, 0x0, @private1, @private2, [@hopopts={0x3a, 0x1, '\x00', [@calipso={0x7, 0x8, {0x0, 0x0, 0x0, 0x80}}]}]}}}}}}}, 0x0) 1.131621876s ago: executing program 1 (id=9861): r0 = socket$inet(0xa, 0x801, 0x84) connect$inet(r0, &(0x7f0000004cc0)={0x2, 0x0, @private=0xa010100}, 0x10) listen(r0, 0x8) r1 = accept4(r0, 0x0, 0x0, 0x0) setsockopt(r1, 0x84, 0x82, &(0x7f0000000480)="1a00000002000000", 0x8) 1.114761259s ago: executing program 5 (id=9862): sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000300)=@newlink={0x3c, 0x10, 0x401, 0x800000, 0x0, {0x0, 0x0, 0x0, 0x0, 0x32b, 0x3069e}, [@IFLA_LINKINFO={0x1c, 0x12, 0x0, 0x1, @bond={{0x9}, {0xc, 0x2, 0x0, 0x1, [@IFLA_BOND_ARP_VALIDATE={0x8, 0x9, 0x3}]}}}]}, 0x3c}, 0x1, 0x0, 0x0, 0x20000000}, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000002c0)={'macvlan0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f00000000c0)={0x0, 0x0, &(0x7f00000010c0)={&(0x7f0000000300)=ANY=[@ANYBLOB="440000001000010400"/20, @ANYRES32=r1, @ANYBLOB="00001700000000001c0037"], 0x44}, 0x1, 0x0, 0x0, 0x50}, 0x0) 1.072205837s ago: executing program 6 (id=9863): bpf$PROG_LOAD(0x5, &(0x7f0000000b00)={0x11, 0xf, &(0x7f0000000000)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32, @ANYBLOB="0000000000000000b702000014fa0000b7030000000000008500000083000000bf09"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x34, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$PROG_LOAD_XDP(0x5, &(0x7f00000006c0)={0x6, 0x3, &(0x7f0000000680)=ANY=[@ANYBLOB="1800000002000000000000000000000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x55}, 0x94) write$cgroup_subtree(0xffffffffffffffff, &(0x7f0000000000)=ANY=[@ANYBLOB="8fedcb010789005e107538e486dd6317ce22000000fffe80000000000000101000007f0600080000000000000071273fa7b49301641184a907"], 0xfdef) r0 = bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000480)={0x6, 0x3, &(0x7f0000000680)=ANY=[], &(0x7f0000000200)='syzkaller\x00'}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000600)={r0, 0x5, 0xb68, 0x0, &(0x7f0000000000)='%', 0x0, 0xd01, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x1100}, 0x48) 971.435355ms ago: executing program 3 (id=9864): r0 = socket$kcm(0x10, 0x2, 0x10) sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000040)=@newsa={0xec, 0x10, 0x200, 0x70bd28, 0x0, {{@in=@initdev={0xac, 0x1e, 0x9, 0x0}, @in=@local, 0x4e23, 0x1, 0x0, 0x2000, 0xa, 0x0, 0x0, 0x33}, {@in6=@initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, 0x0, 0x32}, @in6=@rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01', {0x0, 0x0, 0x8, 0x100000001, 0x6}, {0x0, 0x0, 0x2, 0xfffffffffffffffc}, {0xc, 0xfffffffc}, 0x70bd27, 0x0, 0x2, 0x0, 0x2}}, 0xec}, 0x1, 0x0, 0x0, 0xc0}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000240)=@newtaction={0x48, 0x30, 0x53b, 0x0, 0x0, {0x9}, [{0x34, 0x1, [@m_sample={0x30, 0x1, 0x0, 0x0, {{0xb}, {0x4}, {0x4}, {0xc}, {0xc, 0x4, {0x3}}}}]}]}, 0x48}}, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000480)={&(0x7f0000000040)=@RTM_NEWMDB={0x38, 0x54, 0x1, 0x1, 0x0, {}, [@MDBA_SET_ENTRY={0x20, 0x1, {0x0, 0x1, 0x0, 0x3, {@ip4=@initdev={0xac, 0x1e, 0x0, 0x0}, 0x86dd}}}]}, 0x38}, 0x1, 0x0, 0x0, 0x4}, 0x0) sendmsg$kcm(r0, &(0x7f0000000000)={0x0, 0xd18c9b25, &(0x7f0000000080)=[{&(0x7f0000000040)="e03f03003f000b05d25a806c8c6394f90324fc60100002000a000300053582c137153e3704020180fc0b09000c00", 0x33fe0}], 0x1}, 0x0) 961.471464ms ago: executing program 1 (id=9865): r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000180)={0x18, 0x5, &(0x7f00000002c0)=ANY=[@ANYBLOB="1801000021000000000000003b810000850000006d000000070000000000000095"], &(0x7f0000000040)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000600)={&(0x7f0000000000)='inet_sock_set_state\x00', r0, 0x0, 0x3}, 0x18) r1 = socket$inet_mptcp(0x2, 0x1, 0x106) setsockopt$inet_tcp_int(r1, 0x6, 0x22, &(0x7f0000000000)=0x1, 0x4) sendmmsg(r1, &(0x7f00000007c0)=[{{&(0x7f0000000380)=@in={0x2, 0x4e24, @local}, 0x80, &(0x7f0000000140)=[{&(0x7f00000004c0)='&', 0x1}], 0x1}}], 0xf00, 0x2c000011) 816.754877ms ago: executing program 3 (id=9866): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000100), r0) r2 = socket$nl_rdma(0x10, 0x3, 0x14) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000001740)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_SET_QOS_MAP(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000540)={0x1c, r1, 0x1, 0x70bd25, 0x25dfdbfb, {{}, {@val={0x8, 0x3, r3}, @void}}}, 0x1c}, 0x1, 0x0, 0x0, 0x10}, 0x20000810) 816.49208ms ago: executing program 1 (id=9867): r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='memory.events\x00', 0x275a, 0x0) write$cgroup_subtree(r0, &(0x7f0000000100)=ANY=[], 0x32600) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x2000001, 0x12, r0, 0x0) r1 = socket$inet_sctp(0x2, 0x5, 0x84) getsockopt$inet_sctp_SCTP_GET_ASSOC_NUMBER(r1, 0x84, 0x1c, 0x0, &(0x7f00000000c0)) 773.134238ms ago: executing program 2 (id=9868): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f00000006c0), 0xffffffffffffffff) r2 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000280)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_NEW_INTERFACE(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f00000001c0)=ANY=[@ANYBLOB='`\x00\x00\x00', @ANYRES16=r1, @ANYBLOB="0100000000000000000007000000080001006e00000008000300", @ANYRES32=r3, @ANYBLOB="0c0099000000000000000000050053000100000014000400776c616e310000000000000000000000140006"], 0x60}}, 0x0) 702.483751ms ago: executing program 3 (id=9869): r0 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_int(r0, 0x107, 0xf, &(0x7f0000000040)=0x46c, 0x4) r1 = socket$inet6_udplite(0xa, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000180)={'geneve1\x00', 0x0}) sendto$packet(r0, 0x0, 0x0, 0x40008c1, &(0x7f00000000c0)={0x11, 0x86dd, r2, 0x1, 0x62}, 0x14) 702.348385ms ago: executing program 5 (id=9870): socket$xdp(0x2c, 0x3, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000040)={'bridge_slave_1\x00', 0x0}) r3 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r3, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000140)=ANY=[@ANYBLOB="7c0000001000010400"/20, @ANYRES32=r2, @ANYBLOB="00000000000000005c001280110001006272696467655f736c617665000000004400058005000500000000000500", @ANYRES8=r0], 0x7c}, 0x1, 0x0, 0x0, 0x40094}, 0x0) 638.829397ms ago: executing program 1 (id=9871): r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000240)=@dellink={0x34, 0x11, 0x1, 0x70bd27, 0x25dfdbfd, {0x0, 0x0, 0x0, 0x0, 0x1020, 0x40000}, [@IFLA_IFNAME={0x14, 0x3, 'veth1_vlan\x00'}]}, 0x34}, 0x1, 0x0, 0x0, 0x801}, 0x4000000) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000040), r1) sendmsg$ETHTOOL_MSG_STRSET_GET(r1, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000023c0)={0x2c, r2, 0x1, 0x70bd2d, 0x25dfdbff, {}, [@ETHTOOL_A_STRSET_HEADER={0x18, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'ipvlan1\x00'}]}]}, 0x2c}, 0x1, 0x0, 0x0, 0x2001}, 0x4010000) 632.802847ms ago: executing program 6 (id=9872): r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r0, 0x8933, &(0x7f0000000040)={'batadv_slave_0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'macvlan0\x00', 0x0}) sendmsg$nl_route(r2, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000140)=ANY=[@ANYBLOB="500000001000cff500000000ffffffff00000700", @ANYRES32=0x0, @ANYBLOB="000000000140060030001280080001006873720024000280050007000100000008000100", @ANYRES32=r3, @ANYBLOB="08000200", @ANYRES32=r1], 0x50}}, 0x0) 600.7923ms ago: executing program 2 (id=9873): r0 = socket$inet6_sctp(0xa, 0x5, 0x84) r1 = socket$inet6_sctp(0xa, 0x5, 0x84) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r1, 0x84, 0x6f, &(0x7f0000000040)={0x0, 0x10, &(0x7f0000000000)=[@in={0x2, 0x0, @private=0xa010101}]}, &(0x7f0000000080)=0x10) getsockopt$inet_sctp6_SCTP_GET_ASSOC_ID_LIST(r1, 0x84, 0x1d, &(0x7f0000000140)={0x1, [0x0]}, &(0x7f0000000240)=0x8) setsockopt$inet_sctp6_SCTP_MAXSEG(r0, 0x84, 0xd, &(0x7f0000000040)=@assoc_value={r2, 0x9}, 0x8) 504.646349ms ago: executing program 3 (id=9874): r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$ifreq_SIOCGIFINDEX_team(r0, 0x8933, &(0x7f0000000100)={'team0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r2, &(0x7f0000006280)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f00000014c0)=@newtaction={0x68, 0x30, 0xb, 0x0, 0x25dfdbfc, {0x0, 0x0, 0x6a00}, [{0x54, 0x1, [@m_mirred={0x50, 0x1, 0x0, 0x0, {{0xb}, {0x24, 0x2, 0x0, 0x1, [@TCA_MIRRED_PARMS={0x20, 0x2, {{0x6, 0xff, 0x4, 0x6, 0x6}, 0x4, r1}}]}, {0x4, 0xa}, {0xc}, {0xc}}}]}]}, 0x68}}, 0x2000a804) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000140)=ANY=[@ANYBLOB="200000001100010100"/20, @ANYRES32=r1], 0x20}, 0x1, 0x0, 0x0, 0x80d5}, 0x0) 199.237351ms ago: executing program 5 (id=9875): r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000280)='memory.events\x00', 0x275a, 0x0) writev(r0, &(0x7f0000000400)=[{&(0x7f00000002c0)="a609a89c9edd34187123b5adceb3968557f4e107445a53c0815c9636d00f896d1e8cd8de77a79f1e3e2c53ddf1bb9f8ac5cb5257ff4e8b960026bc4244c4b09179a97dffdf02563e23546d3e78f944e7e2fee2a00b6313048fe354223318badb21d8c086669c5f7772f4a6d90d0997babdf79f7d557e055b3e6f2e4f41ec06a39a57b9ccc00bbca22395e41f9e9652af665f0e1603fb85d4799d54d44c706ff8df9bb805b182a1260b5936ae44f649b5e2fdca240984dcd0033ec28aeaaa686608", 0xc1}], 0x1) mmap(&(0x7f0000000000/0x4000)=nil, 0x4000, 0x1, 0x10012, r0, 0x0) r1 = socket$inet_sctp(0x2, 0x5, 0x84) getsockopt$inet_sctp_SCTP_AUTO_ASCONF(r1, 0x84, 0x1e, 0x0, &(0x7f00000000c0)) 198.473627ms ago: executing program 6 (id=9876): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x109001, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x6bf1c2d5adba8c32}) r1 = socket$kcm(0x2, 0xa, 0x2) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000000280)={'syzkaller1\x00', @link_local}) write$tun(r0, &(0x7f00000002c0)={@val={0x0, 0x88b5}, @void, @eth={@broadcast, @local, @void, {@ipv4={0x800, @udp={{0x5, 0x4, 0x0, 0x0, 0x1c, 0x0, 0xe000, 0x0, 0x2f, 0x0, @private=0x1fe1, @local}, {0xa000, 0x86dd, 0x8}}}}}}, 0x2e) 72.15812ms ago: executing program 5 (id=9877): r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000000)={0x26, 'aead\x00', 0x0, 0x0, 'rfc4106-gcm-aesni\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f00000009c0)="ad56b6c5820fae9d6dcd3292ea54c7be8bbdadbb1632ea5704cae881ef915d374c90c200", 0x24) r1 = accept4(r0, 0x0, 0x0, 0x800) syz_genetlink_get_family_id$devlink(&(0x7f00000000c0), r1) 0s ago: executing program 5 (id=9878): r0 = socket$inet6_sctp(0xa, 0x5, 0x84) setsockopt$inet_sctp6_SCTP_EVENTS(r0, 0x84, 0xb, &(0x7f0000000280)={0x0, 0x4}, 0xe) shutdown(r0, 0x0) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r0, 0x84, 0x6f, &(0x7f0000000000)={0x0, 0x10, &(0x7f00000002c0)=[@in={0x2, 0x0, @local}]}, &(0x7f0000000240)=0x10) getsockopt$inet_sctp6_SCTP_PR_SUPPORTED(r0, 0x84, 0x71, &(0x7f0000000140)={r1, 0x6}, &(0x7f0000000180)=0x8) kernel console output (not intermixed with test programs): wpan0: encryption failed: -22 [ 209.446212][T12902] __nla_validate_parse: 10 callbacks suppressed [ 209.446230][T12902] netlink: 20 bytes leftover after parsing attributes in process `syz.1.3199'. [ 209.698356][T12917] netlink: 48 bytes leftover after parsing attributes in process `syz.1.3205'. [ 209.716501][T12917] (unnamed net_device) (uninitialized): option ad_actor_sys_prio: mode dependency failed, not supported in mode balance-tlb(5) [ 210.414500][T12964] netlink: 348 bytes leftover after parsing attributes in process `syz.2.3227'. [ 210.426525][T12966] netlink: 128 bytes leftover after parsing attributes in process `syz.4.3225'. [ 210.435762][T12966] netlink: 20 bytes leftover after parsing attributes in process `syz.4.3225'. [ 210.478162][T12968] netlink: 8 bytes leftover after parsing attributes in process `syz.3.3228'. [ 210.637803][T12980] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 210.992480][T13001] netlink: 'syz.4.3242': attribute type 10 has an invalid length. [ 211.044622][T13001] netlink: 40 bytes leftover after parsing attributes in process `syz.4.3242'. [ 211.112633][T13001] team0: Port device geneve0 added [ 211.325036][T13022] openvswitch: netlink: Actions may not be safe on all matching packets [ 211.595603][T13037] netlink: 'syz.1.3259': attribute type 33 has an invalid length. [ 211.645778][T13037] netlink: 152 bytes leftover after parsing attributes in process `syz.1.3259'. [ 211.677193][T13044] netlink: 'syz.4.3263': attribute type 13 has an invalid length. [ 211.715222][T13044] netlink: 'syz.4.3263': attribute type 58 has an invalid length. [ 211.733940][T13044] netlink: 152 bytes leftover after parsing attributes in process `syz.4.3263'. [ 211.997084][T13060] batman_adv: Cannot find parent device. Skipping batadv-on-batadv check for gretap1 [ 212.032669][T13060] gretap1: default qdisc (pfifo_fast) fail, fallback to noqueue [ 212.049374][T13060] gretap1: entered promiscuous mode [ 212.079282][T13060] gretap1: entered allmulticast mode [ 212.437572][T13085] 8021q: adding VLAN 0 to HW filter on device bond1 [ 212.653205][T13105] netlink: 52 bytes leftover after parsing attributes in process `syz.4.3292'. [ 212.872187][T13121] rdma_rxe: rxe_newlink: failed to add lo [ 213.259321][T13146] (unnamed net_device) (uninitialized): Unable to set down delay as MII monitoring is disabled [ 213.702411][T13177] netlink: 'syz.2.3326': attribute type 4 has an invalid length. [ 213.732132][T13177] `: renamed from bond0 (while UP) [ 213.878482][T13186] netlink: 'syz.3.3331': attribute type 2 has an invalid length. [ 213.912368][T13192] netlink: 'syz.2.3335': attribute type 1 has an invalid length. [ 214.148746][T13205] netlink: 'syz.2.3342': attribute type 33 has an invalid length. [ 215.146406][T13270] delete_channel: no stack [ 215.172729][T13274] __nla_validate_parse: 4 callbacks suppressed [ 215.172744][T13274] netlink: 199836 bytes leftover after parsing attributes in process `syz.3.3376'. [ 215.464697][T13294] netlink: 116 bytes leftover after parsing attributes in process `syz.4.3386'. [ 216.035578][T13334] netlink: 'syz.1.3404': attribute type 10 has an invalid length. [ 216.072966][T13334] netlink: 4 bytes leftover after parsing attributes in process `syz.1.3404'. [ 216.127855][T13338] netlink: 12 bytes leftover after parsing attributes in process `syz.0.3408'. [ 216.445598][T13363] netlink: 64 bytes leftover after parsing attributes in process `syz.1.3419'. [ 216.479487][T13363] netlink: 64 bytes leftover after parsing attributes in process `syz.1.3419'. [ 216.513916][T13364] pimreg: entered allmulticast mode [ 216.756239][T13384] netlink: 16 bytes leftover after parsing attributes in process `syz.3.3431'. [ 217.127000][T13409] netlink: 'syz.4.3442': attribute type 1 has an invalid length. [ 217.151643][T13409] netlink: 244 bytes leftover after parsing attributes in process `syz.4.3442'. [ 217.419530][T13424] bond3: entered promiscuous mode [ 217.433818][T13424] bond3: entered allmulticast mode [ 217.441300][T13424] 8021q: adding VLAN 0 to HW filter on device bond3 [ 217.525968][T13435] netlink: 'syz.3.3455': attribute type 1 has an invalid length. [ 217.610490][T13439] delete_channel: no stack [ 217.774314][T13453] netlink: 20 bytes leftover after parsing attributes in process `syz.4.3462'. [ 217.806169][T13453] netlink: 20 bytes leftover after parsing attributes in process `syz.4.3462'. [ 218.470972][T13496] netlink: 'syz.2.3484': attribute type 1 has an invalid length. [ 218.654882][T13513] (unnamed net_device) (uninitialized): option min_links: invalid value (18446744073709551614) [ 218.691385][T13513] (unnamed net_device) (uninitialized): option min_links: allowed values 0 - 2147483647 [ 219.530842][T13571] netlink: zone id is out of range [ 219.535997][T13571] netlink: zone id is out of range [ 219.555674][T13571] netlink: zone id is out of range [ 219.565658][T13571] netlink: zone id is out of range [ 219.581117][T13571] netlink: zone id is out of range [ 219.591956][T13577] netlink: 'syz.1.3524': attribute type 1 has an invalid length. [ 219.596106][T13571] netlink: zone id is out of range [ 219.616221][T13571] netlink: zone id is out of range [ 219.635484][T13571] netlink: zone id is out of range [ 219.645611][T13571] netlink: zone id is out of range [ 219.659062][T13571] netlink: zone id is out of range [ 220.169996][T13617] netlink: 'syz.3.3545': attribute type 1 has an invalid length. [ 220.208241][T13617] __nla_validate_parse: 1 callbacks suppressed [ 220.208258][T13617] netlink: 224 bytes leftover after parsing attributes in process `syz.3.3545'. [ 220.275352][T13617] netlink: 'syz.3.3545': attribute type 1 has an invalid length. [ 220.408127][T13629] netlink: 'syz.1.3552': attribute type 3 has an invalid length. [ 220.426417][T13629] netlink: 666 bytes leftover after parsing attributes in process `syz.1.3552'. [ 220.546735][T13638] netlink: 64985 bytes leftover after parsing attributes in process `syz.1.3556'. [ 220.839020][T13658] netlink: 'syz.0.3564': attribute type 1 has an invalid length. [ 220.854081][T13658] netlink: 15 bytes leftover after parsing attributes in process `syz.0.3564'. [ 221.232917][T13686] syz.3.3579: vmalloc error: size 8589938688, exceeds total pages, mode:0xdc0(GFP_KERNEL|__GFP_ZERO), nodemask=(null),cpuset=/,mems_allowed=0-1 [ 221.295658][T13686] CPU: 1 UID: 0 PID: 13686 Comm: syz.3.3579 Not tainted syzkaller #0 PREEMPT(full) [ 221.295685][T13686] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/18/2025 [ 221.295704][T13686] Call Trace: [ 221.295711][T13686] [ 221.295719][T13686] dump_stack_lvl+0x189/0x250 [ 221.295751][T13686] ? __pfx_dump_stack_lvl+0x10/0x10 [ 221.295772][T13686] ? __pfx__printk+0x10/0x10 [ 221.295795][T13686] ? cpuset_print_current_mems_allowed+0x1f/0x360 [ 221.295815][T13686] ? cpuset_print_current_mems_allowed+0x1f/0x360 [ 221.295837][T13686] ? cpuset_print_current_mems_allowed+0x2ee/0x360 [ 221.295859][T13686] warn_alloc+0x214/0x310 [ 221.295885][T13686] ? stack_depot_save_flags+0x41b/0x860 [ 221.295911][T13686] ? __pfx_warn_alloc+0x10/0x10 [ 221.295937][T13686] ? kasan_save_track+0x4f/0x80 [ 221.295957][T13686] ? xskq_create+0x56/0x170 [ 221.295972][T13686] ? xsk_init_queue+0xb0/0x110 [ 221.295985][T13686] ? xsk_setsockopt+0x4dc/0x8d0 [ 221.296005][T13686] ? do_sock_setsockopt+0x179/0x1b0 [ 221.296026][T13686] ? __x64_sys_setsockopt+0x13f/0x1b0 [ 221.296042][T13686] ? do_syscall_64+0xfa/0x3b0 [ 221.296058][T13686] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 221.296082][T13686] __vmalloc_node_range_noprof+0x125/0x12f0 [ 221.296132][T13686] ? __pfx___vmalloc_node_range_noprof+0x10/0x10 [ 221.296161][T13686] ? __kasan_kmalloc+0x93/0xb0 [ 221.296186][T13686] vmalloc_user_noprof+0xad/0xf0 [ 221.296219][T13686] ? xskq_create+0xbf/0x170 [ 221.296237][T13686] xskq_create+0xbf/0x170 [ 221.296256][T13686] xsk_init_queue+0xb0/0x110 [ 221.296275][T13686] xsk_setsockopt+0x4dc/0x8d0 [ 221.296303][T13686] ? __pfx_xsk_setsockopt+0x10/0x10 [ 221.296328][T13686] ? __pfx_aa_sk_perm+0x10/0x10 [ 221.296357][T13686] ? aa_sock_opt_perm+0xff/0x1b0 [ 221.296378][T13686] ? bpf_lsm_socket_setsockopt+0x9/0x20 [ 221.296396][T13686] ? __pfx_xsk_setsockopt+0x10/0x10 [ 221.296421][T13686] do_sock_setsockopt+0x179/0x1b0 [ 221.296446][T13686] __x64_sys_setsockopt+0x13f/0x1b0 [ 221.296473][T13686] do_syscall_64+0xfa/0x3b0 [ 221.296490][T13686] ? lockdep_hardirqs_on+0x9c/0x150 [ 221.296508][T13686] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 221.296525][T13686] ? clear_bhb_loop+0x60/0xb0 [ 221.296546][T13686] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 221.296562][T13686] RIP: 0033:0x7fb2bcf8eec9 [ 221.296586][T13686] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 221.296600][T13686] RSP: 002b:00007fb2bdd70038 EFLAGS: 00000246 ORIG_RAX: 0000000000000036 [ 221.296620][T13686] RAX: ffffffffffffffda RBX: 00007fb2bd1e5fa0 RCX: 00007fb2bcf8eec9 [ 221.296633][T13686] RDX: 0000000000000006 RSI: 000000000000011b RDI: 0000000000000003 [ 221.296643][T13686] RBP: 00007fb2bd011f91 R08: 0000000000000004 R09: 0000000000000000 [ 221.296654][T13686] R10: 0000200000000000 R11: 0000000000000246 R12: 0000000000000000 [ 221.296665][T13686] R13: 00007fb2bd1e6038 R14: 00007fb2bd1e5fa0 R15: 00007ffdf71417f8 [ 221.296696][T13686] [ 221.601100][T13686] Mem-Info: [ 221.604320][T13686] active_anon:6092 inactive_anon:0 isolated_anon:0 [ 221.604320][T13686] active_file:3086 inactive_file:39930 isolated_file:0 [ 221.604320][T13686] unevictable:768 dirty:113 writeback:25 [ 221.604320][T13686] slab_reclaimable:11324 slab_unreclaimable:114351 [ 221.604320][T13686] mapped:29127 shmem:1369 pagetables:1248 [ 221.604320][T13686] sec_pagetables:0 bounce:0 [ 221.604320][T13686] kernel_misc_reclaimable:0 [ 221.604320][T13686] free:1310153 free_pcp:13961 free_cma:0 [ 221.679576][T13686] Node 0 active_anon:24268kB inactive_anon:0kB active_file:12344kB inactive_file:159520kB unevictable:1536kB isolated(anon):0kB isolated(file):0kB mapped:116508kB dirty:552kB writeback:100kB shmem:3940kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB kernel_stack:12620kB pagetables:4624kB sec_pagetables:0kB all_unreclaimable? no Balloon:0kB [ 221.747215][T13686] Node 1 active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:200kB unevictable:1536kB isolated(anon):0kB isolated(file):0kB mapped:0kB dirty:0kB writeback:0kB shmem:1536kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB kernel_stack:48kB pagetables:168kB sec_pagetables:0kB all_unreclaimable? no Balloon:0kB [ 221.809076][T13686] Node 0 DMA free:15360kB boost:0kB min:204kB low:252kB high:300kB reserved_highatomic:0KB free_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB present:15992kB managed:15360kB mlocked:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB [ 221.840293][T13686] lowmem_reserve[]: 0 2497 2499 2499 2499 [ 221.899791][T13686] Node 0 DMA32 free:1335688kB boost:0kB min:34248kB low:42808kB high:51368kB reserved_highatomic:0KB free_highatomic:0KB active_anon:24648kB inactive_anon:0kB active_file:12344kB inactive_file:157952kB unevictable:1536kB writepending:564kB present:3129332kB managed:2557412kB mlocked:0kB bounce:0kB free_pcp:38108kB local_pcp:19668kB free_cma:0kB [ 221.996142][T13686] lowmem_reserve[]: 0 0 1 1 1 [ 222.013458][T13686] Node 0 Normal free:12kB boost:0kB min:20kB low:24kB high:28kB reserved_highatomic:0KB free_highatomic:0KB active_anon:48kB inactive_anon:0kB active_file:0kB inactive_file:1568kB unevictable:0kB writepending:0kB present:1048580kB managed:1644kB mlocked:0kB bounce:0kB free_pcp:16kB local_pcp:8kB free_cma:0kB [ 222.135716][T13686] lowmem_reserve[]: 0 0 0 0 0 [ 222.167536][T13686] Node 1 Normal free:3889320kB boost:0kB min:55632kB low:69540kB high:83448kB reserved_highatomic:0KB free_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:200kB unevictable:1536kB writepending:0kB present:4194300kB managed:4111100kB mlocked:0kB bounce:0kB free_pcp:17600kB local_pcp:7296kB free_cma:0kB [ 222.225292][T13686] lowmem_reserve[]: 0 0 0 0 0 [ 222.244110][T13686] Node 0 DMA: 0*4kB 0*8kB 0*16kB 0*32kB 0*64kB 0*128kB 0*256kB 0*512kB 1*1024kB (U) 1*2048kB (M) 3*4096kB (M) = 15360kB [ 222.288566][T13686] Node 0 DMA32: 431*4kB (UM) 135*8kB (ME) 404*16kB (UME) 1219*32kB (UME) 567*64kB (UME) 180*128kB (UM) 25*256kB (UM) 2*512kB (U) 4*1024kB (UM) 4*2048kB (UME) 295*4096kB (UM) = 1335636kB [ 222.316815][T13686] Node 0 Normal: 1*4kB (M) 1*8kB (M) 0*16kB 0*32kB 0*64kB 0*128kB 0*256kB 0*512kB 0*1024kB 0*2048kB 0*4096kB = 12kB [ 222.330123][T13686] Node 1 Normal: 184*4kB (UE) 41*8kB (UME) 28*16kB (UME) 54*32kB (UME) 20*64kB (UME) 4*128kB (UME) 5*256kB (UME) 4*512kB (UME) 4*1024kB (UME) 1*2048kB (E) 946*4096kB (M) = 3889320kB [ 222.369172][T13686] Node 0 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 222.419469][T13686] Node 0 hugepages_total=2 hugepages_free=2 hugepages_surp=0 hugepages_size=2048kB [ 222.466658][T13686] Node 1 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 222.516095][T13686] Node 1 hugepages_total=2 hugepages_free=2 hugepages_surp=0 hugepages_size=2048kB [ 222.549717][T13686] 44381 total pagecache pages [ 222.554435][T13686] 0 pages in swap cache [ 222.573905][T13686] Free swap = 124996kB [ 222.584770][T13686] Total swap = 124996kB [ 222.610014][T13686] 2097051 pages RAM [ 222.613850][T13686] 0 pages HighMem/MovableOnly [ 222.646495][T13686] 425672 pages reserved [ 222.650680][T13686] 0 pages cma reserved [ 222.744596][T13748] netlink: 'syz.0.3604': attribute type 2 has an invalid length. [ 224.693432][T13877] netlink: 'syz.3.3667': attribute type 6 has an invalid length. [ 225.375407][T13926] netlink: 72 bytes leftover after parsing attributes in process `syz.1.3689'. [ 225.405030][T13926] netlink: 72 bytes leftover after parsing attributes in process `syz.1.3689'. [ 226.279491][T13988] netlink: 12 bytes leftover after parsing attributes in process `syz.1.3721'. [ 226.434363][T13998] netlink: 'syz.1.3724': attribute type 32 has an invalid length. [ 227.235944][T14048] (unnamed net_device) (uninitialized): option ad_user_port_key: mode dependency failed, not supported in mode balance-rr(0) [ 227.286294][T14050] siw: device registration error -23 [ 227.423348][T14056] netlink: 'syz.0.3755': attribute type 10 has an invalid length. [ 227.481461][T14056] batman_adv: batadv0: Adding interface: team0 [ 227.496438][T14056] batman_adv: batadv0: The MTU of interface team0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 227.580719][T14064] netlink: 'syz.4.3759': attribute type 1 has an invalid length. [ 227.596159][T14056] batman_adv: batadv0: Not using interface team0 (retrying later): interface not active [ 227.616126][T14064] netlink: 4 bytes leftover after parsing attributes in process `syz.4.3759'. [ 227.624997][T14064] netlink: 4 bytes leftover after parsing attributes in process `syz.4.3759'. [ 227.933126][T14080] net_ratelimit: 18 callbacks suppressed [ 227.933144][T14080] openvswitch: netlink: IPv4 tunnel dst address is zero [ 228.138101][T14088] netlink: 128 bytes leftover after parsing attributes in process `syz.3.3771'. [ 228.156233][T14085] netlink: 'syz.4.3772': attribute type 15 has an invalid length. [ 228.170581][T14090] openvswitch: netlink: ERSPAN option length err (len 256, max 255). [ 228.206135][T14085] netlink: 24 bytes leftover after parsing attributes in process `syz.4.3772'. [ 228.239279][T14092] (unnamed net_device) (uninitialized): option packets_per_slave: invalid value (18446744073709551615) [ 228.256343][T14092] (unnamed net_device) (uninitialized): option packets_per_slave: allowed values 0 - 65535 [ 228.876396][T14135] netlink: 108 bytes leftover after parsing attributes in process `syz.0.3795'. [ 228.920351][T14135] netlink: 108 bytes leftover after parsing attributes in process `syz.0.3795'. [ 228.941101][T14139] netlink: 'syz.4.3796': attribute type 10 has an invalid length. [ 228.943482][T14135] netlink: 108 bytes leftover after parsing attributes in process `syz.0.3795'. [ 228.991989][T14139] team0: Device hsr_slave_0 failed to register rx_handler [ 229.358831][T14166] (unnamed net_device) (uninitialized): option xmit_hash_policy: invalid value (64) [ 229.672308][T14190] tc_dump_action: action bad kind [ 229.842757][T14201] netlink: 'syz.1.3826': attribute type 1 has an invalid length. [ 229.976477][T14212] netlink: 'syz.1.3833': attribute type 16 has an invalid length. [ 229.986166][T14212] netlink: 'syz.1.3833': attribute type 17 has an invalid length. [ 230.016384][T14212] lo: left promiscuous mode [ 230.052817][T14212] tunl0: left promiscuous mode [ 230.071630][T14212] gre0: left promiscuous mode [ 230.164454][T14212] gretap0: left promiscuous mode [ 230.183004][T14212] erspan0: left promiscuous mode [ 230.200469][T14212] ip_vti0: left promiscuous mode [ 230.207566][T14224] openvswitch: netlink: Geneve opt len 62 is not a multiple of 4. [ 230.238004][T14212] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 230.287137][T14222] tunl0: entered promiscuous mode [ 230.294983][T14222] netlink: 'syz.0.3840': attribute type 3 has an invalid length. [ 230.483686][T14240] __nla_validate_parse: 5 callbacks suppressed [ 230.483705][T14240] netlink: 4 bytes leftover after parsing attributes in process `syz.2.3846'. [ 231.180504][T14283] netlink: 24 bytes leftover after parsing attributes in process `syz.4.3869'. [ 231.420364][T14291] bond0: entered allmulticast mode [ 231.635654][T14315] netlink: 'syz.3.3883': attribute type 1 has an invalid length. [ 231.648635][T14315] netlink: 'syz.3.3883': attribute type 2 has an invalid length. [ 231.759224][T14323] netlink: 8 bytes leftover after parsing attributes in process `syz.4.3886'. [ 231.976869][T14336] netlink: 209852 bytes leftover after parsing attributes in process `syz.1.3896'. [ 231.996424][T14336] openvswitch: netlink: ufid size 3068 bytes exceeds the range (1, 16) [ 232.314409][T14359] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 232.382599][T14365] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 233.065640][T14409] netlink: 'syz.4.3930': attribute type 3 has an invalid length. [ 233.083963][T14409] netlink: 'syz.4.3930': attribute type 1 has an invalid length. [ 233.516296][T14438] netlink: 36 bytes leftover after parsing attributes in process `syz.1.3944'. [ 233.661003][T14446] netlink: 20 bytes leftover after parsing attributes in process `syz.3.3948'. [ 234.380769][T14498] netlink: 'syz.3.3975': attribute type 1 has an invalid length. [ 234.395488][T14498] netlink: 228 bytes leftover after parsing attributes in process `syz.3.3975'. [ 234.411429][T14498] netlink: 8 bytes leftover after parsing attributes in process `syz.3.3975'. [ 234.681699][T14516] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 235.282981][T14560] netlink: 48 bytes leftover after parsing attributes in process `syz.4.4006'. [ 235.508024][T14572] netlink: 'syz.3.4011': attribute type 1 has an invalid length. [ 235.526218][T14572] netlink: 'syz.3.4011': attribute type 1 has an invalid length. [ 235.844981][T14597] netlink: 'syz.1.4024': attribute type 11 has an invalid length. [ 235.979927][T14604] netlink: 'syz.4.4028': attribute type 11 has an invalid length. [ 236.477526][T14640] netlink: 'syz.3.4045': attribute type 1 has an invalid length. [ 236.485285][T14640] netlink: 224 bytes leftover after parsing attributes in process `syz.3.4045'. [ 236.494876][T14636] bridge4: entered promiscuous mode [ 236.509352][T14641] openvswitch: netlink: Either Ethernet header or EtherType is required. [ 236.518730][T14636] bridge4: entered allmulticast mode [ 236.915129][T14665] ieee802154 phy1 wpan1: encryption failed: -22 [ 237.208359][T14688] ksmbd: Daemon and kernel module version mismatch. ksmbd: 124, kernel module: 1. User-space ksmbd should terminate. [ 237.371585][T14697] netlink: 16 bytes leftover after parsing attributes in process `syz.0.4071'. [ 237.540723][T14712] netlink: 'syz.2.4077': attribute type 1 has an invalid length. [ 237.916489][T14735] netlink: 'syz.0.4090': attribute type 8 has an invalid length. [ 238.117936][T14749] netlink: 'syz.1.4097': attribute type 2 has an invalid length. [ 238.713561][T14777] netlink: 164 bytes leftover after parsing attributes in process `syz.1.4112'. [ 238.727061][T14777] netlink: 164 bytes leftover after parsing attributes in process `syz.1.4112'. [ 238.762656][T14777] netlink: 60 bytes leftover after parsing attributes in process `syz.1.4112'. [ 238.856336][T14786] netlink: 'syz.4.4115': attribute type 1 has an invalid length. [ 238.899637][T14786] netlink: 232 bytes leftover after parsing attributes in process `syz.4.4115'. [ 238.959421][T14791] netlink: 4 bytes leftover after parsing attributes in process `syz.3.4119'. [ 238.983668][T14791] netlink: 50 bytes leftover after parsing attributes in process `syz.3.4119'. [ 239.009731][T14791] netlink: 50 bytes leftover after parsing attributes in process `syz.3.4119'. [ 239.544755][T14832] openvswitch: netlink: Key type 85 is out of range max 32 [ 239.751373][T14845] openvswitch: netlink: Either Ethernet header or EtherType is required. [ 239.878400][T14851] netlink: 'syz.2.4146': attribute type 10 has an invalid length. [ 239.919266][T14851] bridge0: port 2(bridge_slave_1) entered disabled state [ 239.952329][T14851] bridge_slave_1: left allmulticast mode [ 239.984443][T14851] bridge_slave_1: left promiscuous mode [ 239.999984][T14851] bridge0: port 2(bridge_slave_1) entered disabled state [ 240.032663][T14851] bridge_slave_1: entered allmulticast mode [ 240.049914][T14851] `: (slave bridge_slave_1): Enslaving as an active interface with an up link [ 240.183874][T14869] IPv6: NLM_F_REPLACE set, but no existing node found! [ 240.613879][T14898] ieee802154 phy1 wpan1: encryption failed: -22 [ 240.744916][T14909] netlink: 'syz.1.4176': attribute type 30 has an invalid length. [ 240.809220][T14909] (unnamed net_device) (uninitialized): option arp_missed_max: invalid value (0) [ 240.837045][T14909] (unnamed net_device) (uninitialized): option arp_missed_max: allowed values 1 - 255 [ 241.753638][T14977] netlink: 4 bytes leftover after parsing attributes in process `syz.3.4209'. [ 241.806125][T14977] netlink: 4 bytes leftover after parsing attributes in process `syz.3.4209'. [ 242.325313][T15017] netlink: 16 bytes leftover after parsing attributes in process `syz.1.4229'. [ 242.343357][T15017] netlink: 224 bytes leftover after parsing attributes in process `syz.1.4229'. [ 242.364989][T15019] netlink: 80 bytes leftover after parsing attributes in process `syz.0.4231'. [ 242.668573][T15039] netlink: 'syz.1.4240': attribute type 1 has an invalid length. [ 242.686153][T15039] netlink: 'syz.1.4240': attribute type 3 has an invalid length. [ 242.703039][T15039] netlink: 224 bytes leftover after parsing attributes in process `syz.1.4240'. [ 243.505549][T15097] (unnamed net_device) (uninitialized): option ad_actor_sys_prio: mode dependency failed, not supported in mode balance-rr(0) [ 243.664795][T15109] netlink: 'syz.2.4275': attribute type 21 has an invalid length. [ 243.700147][T15109] netlink: 132 bytes leftover after parsing attributes in process `syz.2.4275'. [ 243.721167][T15111] netlink: 44 bytes leftover after parsing attributes in process `syz.1.4277'. [ 243.871701][T15119] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 244.032452][T15129] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 244.693962][T15175] gre0: entered promiscuous mode [ 245.414519][T15227] openvswitch: netlink: Unknown key attributes 2 [ 245.855267][T15258] netlink: 'syz.3.4349': attribute type 26 has an invalid length. [ 246.365017][T15295] netlink: 'syz.1.4367': attribute type 3 has an invalid length. [ 246.635334][T15313] ieee802154 phy1 wpan1: encryption failed: -22 [ 246.936875][T15337] netlink: 4 bytes leftover after parsing attributes in process `syz.2.4388'. [ 247.025683][T15341] netlink: 'syz.3.4391': attribute type 1 has an invalid length. [ 247.043814][T15341] netlink: 224 bytes leftover after parsing attributes in process `syz.3.4391'. [ 247.081004][T15345] netlink: 8 bytes leftover after parsing attributes in process `syz.4.4392'. [ 247.280312][T15355] IPv6: Can't replace route, no match found [ 247.327161][T15362] : renamed from bridge_slave_0 (while UP) [ 247.350839][T15363] (unnamed net_device) (uninitialized): option tlb_dynamic_lb: mode dependency failed, not supported in mode balance-xor(2) [ 247.516648][T15375] openvswitch: netlink: Actions may not be safe on all matching packets [ 247.993179][T15407] netlink: 'syz.4.4424': attribute type 5 has an invalid length. [ 248.521087][T15435] netlink: 192 bytes leftover after parsing attributes in process `syz.2.4435'. [ 248.591569][T15441] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 249.002776][T15468] netlink: 4 bytes leftover after parsing attributes in process `syz.4.4451'. [ 249.178204][T15479] openvswitch: netlink: Unexpected mask (mask=1040, allowed=10048) [ 249.215950][T15481] dvmrp1: entered allmulticast mode [ 249.433207][T15492] netlink: 32 bytes leftover after parsing attributes in process `syz.1.4463'. [ 249.682262][T15506] netlink: 12 bytes leftover after parsing attributes in process `syz.1.4471'. [ 249.826747][T15516] netlink: 'syz.4.4475': attribute type 12 has an invalid length. [ 249.852821][T15516] (unnamed net_device) (uninitialized): option primary_reselect: invalid value (255) [ 250.013533][T15521] netlink: 4 bytes leftover after parsing attributes in process `syz.1.4478'. [ 250.050585][T15529] netlink: 8 bytes leftover after parsing attributes in process `syz.3.4482'. [ 250.197247][T15537] Unsupported ieee802154 address type: 0 [ 250.558175][T15557] netlink: 4 bytes leftover after parsing attributes in process `syz.1.4495'. [ 250.750843][T15567] (unnamed net_device) (uninitialized): option packets_per_slave: mode dependency failed, not supported in mode active-backup(1) [ 251.009710][T15590] netlink: 'syz.2.4507': attribute type 1 has an invalid length. [ 251.183560][T15599] (unnamed net_device) (uninitialized): option arp_validate: mode dependency failed, not supported in mode balance-alb(6) [ 251.183705][T15600] openvswitch: netlink: Key 9 has unexpected len 0 expected 4 [ 251.682509][T15628] Bluetooth: MGMT ver 1.23 [ 252.091668][T15648] __nla_validate_parse: 9 callbacks suppressed [ 252.091685][T15648] netlink: 88 bytes leftover after parsing attributes in process `syz.3.4534'. [ 252.130803][T15648] netlink: 24 bytes leftover after parsing attributes in process `syz.3.4534'. [ 252.141010][T15648] netlink: 24 bytes leftover after parsing attributes in process `syz.3.4534'. [ 252.384347][T15669] openvswitch: netlink: IPv4 frag type 255 is out of range max 2 [ 252.652970][T15685] (unnamed net_device) (uninitialized): option miimon: invalid value (18446744073709551585) [ 252.692891][T15685] (unnamed net_device) (uninitialized): option miimon: allowed values 0 - 2147483647 [ 253.050258][T15707] Bluetooth: MGMT ver 1.23 [ 253.315653][T15719] netlink: 'syz.1.4562': attribute type 1 has an invalid length. [ 253.351736][T15719] netlink: 12 bytes leftover after parsing attributes in process `syz.1.4562'. [ 253.371416][T15723] netlink: 24 bytes leftover after parsing attributes in process `syz.4.4564'. [ 253.531792][T15732] netlink: 44 bytes leftover after parsing attributes in process `syz.0.4566'. [ 253.585910][T15732] netlink: 43 bytes leftover after parsing attributes in process `syz.0.4566'. [ 253.621169][T15732] netlink: 'syz.0.4566': attribute type 5 has an invalid length. [ 253.659186][T15732] netlink: 43 bytes leftover after parsing attributes in process `syz.0.4566'. [ 254.047765][ T30] audit: type=1107 audit(1758772029.736:2): pid=15757 uid=0 auid=4294967295 ses=4294967295 subj=unconfined msg='ً5%UA٠0ltݕ/ 6򊨊' [ 254.406337][T15780] netlink: 12 bytes leftover after parsing attributes in process `syz.2.4586'. [ 255.435913][T15850] netlink: 'syz.2.4620': attribute type 18 has an invalid length. [ 255.489031][T15850] Zero length message leads to an empty skb [ 255.497247][ T8583] netdevsim netdevsim2 netdevsim0: set [0, 0] type 1 family 0 port 8472 - 0 [ 255.526745][ T8583] netdevsim netdevsim2 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0 [ 255.557179][ T8583] netdevsim netdevsim2 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0 [ 255.590783][ T8583] netdevsim netdevsim2 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0 [ 255.612095][T15858] Bluetooth: MGMT ver 1.23 [ 255.702500][ T1302] ieee802154 phy1 wpan1: encryption failed: -22 [ 255.981049][T15882] netlink: 4 bytes leftover after parsing attributes in process `syz.4.4636'. [ 256.343411][T15908] xt_socket: unknown flags 0x50 [ 256.541830][T15917] openvswitch: netlink: Unknown nsh attribute 0 [ 256.550029][T15917] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 257.142795][T15950] __nla_validate_parse: 2 callbacks suppressed [ 257.142814][T15950] netlink: 44 bytes leftover after parsing attributes in process `syz.1.4668'. [ 257.172739][T15950] netlink: 35 bytes leftover after parsing attributes in process `syz.1.4668'. [ 257.195357][T15950] netlink: 'syz.1.4668': attribute type 5 has an invalid length. [ 257.203436][T15950] netlink: 'syz.1.4668': attribute type 6 has an invalid length. [ 257.211467][T15950] netlink: 35 bytes leftover after parsing attributes in process `syz.1.4668'. [ 257.970987][T15973] sock: sock_timestamping_bind_phc: sock not bind to device [ 258.059779][T15978] pim6reg: entered allmulticast mode [ 258.071151][T15978] pim6reg: left allmulticast mode [ 258.865879][T16028] ipvlan2: entered promiscuous mode [ 259.084685][T16045] netlink: 'syz.3.4714': attribute type 1 has an invalid length. [ 259.310334][T16059] netlink: 12 bytes leftover after parsing attributes in process `syz.0.4720'. [ 259.364296][T16059] netlink: 12 bytes leftover after parsing attributes in process `syz.0.4720'. [ 260.240232][T16101] netlink: 36 bytes leftover after parsing attributes in process `syz.1.4740'. [ 260.253877][T16101] netlink: 36 bytes leftover after parsing attributes in process `syz.1.4740'. [ 260.259600][T16104] netlink: 'syz.0.4742': attribute type 1 has an invalid length. [ 260.279465][T16104] netlink: 'syz.0.4742': attribute type 2 has an invalid length. [ 260.308551][T16104] netlink: 1172 bytes leftover after parsing attributes in process `syz.0.4742'. [ 260.502823][T16115] netlink: 76 bytes leftover after parsing attributes in process `syz.3.4745'. [ 260.733544][T16126] netlink: 'syz.0.4751': attribute type 3 has an invalid length. [ 260.978174][T16147] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 261.130809][T16156] netlink: 'syz.3.4767': attribute type 142 has an invalid length. [ 261.507284][T16182] netlink: 10 bytes leftover after parsing attributes in process `syz.1.4775'. [ 262.777071][T16224] netlink: 44 bytes leftover after parsing attributes in process `syz.2.4794'. [ 262.806599][T16224] netlink: 43 bytes leftover after parsing attributes in process `syz.2.4794'. [ 262.843000][T16224] netlink: 'syz.2.4794': attribute type 6 has an invalid length. [ 262.860368][T16224] netlink: 'syz.2.4794': attribute type 5 has an invalid length. [ 262.876151][T16224] netlink: 43 bytes leftover after parsing attributes in process `syz.2.4794'. [ 262.970116][ T5928] IPVS: starting estimator thread 0... [ 263.079419][T16239] IPVS: using max 34 ests per chain, 81600 per kthread [ 263.185036][T16251] netlink: 28 bytes leftover after parsing attributes in process `syz.0.4804'. [ 264.204209][T16311] netlink: 8 bytes leftover after parsing attributes in process `syz.1.4829'. [ 264.364960][T16320] netlink: 212376 bytes leftover after parsing attributes in process `syz.4.4833'. [ 265.321417][T16381] netlink: 'syz.0.4862': attribute type 10 has an invalid length. [ 265.342467][T16381] batman_adv: batadv0: Removing interface: team0 [ 265.354037][T16381] bridge0: port 3(team0) entered blocking state [ 265.362406][T16381] bridge0: port 3(team0) entered disabled state [ 265.375125][T16381] team0: entered allmulticast mode [ 265.383223][T16381] team_slave_0: entered allmulticast mode [ 265.390106][T16381] team_slave_1: entered allmulticast mode [ 265.415285][T16381] team0: entered promiscuous mode [ 265.424046][T16381] team_slave_0: entered promiscuous mode [ 265.434040][T16381] team_slave_1: entered promiscuous mode [ 265.505671][T16393] netlink: 16 bytes leftover after parsing attributes in process `syz.0.4867'. [ 265.847276][T16412] netlink: 18 bytes leftover after parsing attributes in process `syz.0.4875'. [ 265.871801][T16411] 8021q: adding VLAN 0 to HW filter on device ipvlan0 [ 266.090138][T16416] netlink: 12 bytes leftover after parsing attributes in process `syz.0.4876'. [ 266.204030][T16422] ICMPv6: Received fragmented ndisc packet. Carefully consider disabling suppress_frag_ndisc. [ 267.369088][T16481] netlink: 12 bytes leftover after parsing attributes in process `syz.1.4899'. [ 267.593738][T16492] tipc: Started in network mode [ 267.615507][T16492] tipc: Node identity b9, cluster identity 4711 [ 267.645949][T16492] tipc: Node number set to 185 [ 267.923198][T16512] netlink: 'syz.4.4912': attribute type 1 has an invalid length. [ 267.992079][T16517] netlink: 8 bytes leftover after parsing attributes in process `syz.3.4915'. [ 268.135335][T16527] netlink: 12 bytes leftover after parsing attributes in process `syz.0.4918'. [ 268.608426][T16560] netlink: 4 bytes leftover after parsing attributes in process `syz.4.4936'. [ 268.684682][T16563] netlink: 16 bytes leftover after parsing attributes in process `syz.3.4937'. [ 268.929565][T16583] netlink: 'syz.1.4947': attribute type 29 has an invalid length. [ 268.955905][T16583] netlink: 'syz.1.4947': attribute type 29 has an invalid length. [ 269.384088][T16608] netlink: 32 bytes leftover after parsing attributes in process `syz.3.4959'. [ 269.450344][T16612] xt_time: invalid argument - start or stop time greater than 23:59:59 [ 269.531703][T16618] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 269.643771][T16624] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 269.763289][T16633] netlink: 4 bytes leftover after parsing attributes in process `syz.3.4969'. [ 270.103538][T16655] netlink: 8 bytes leftover after parsing attributes in process `syz.3.4981'. [ 270.117992][T16655] netlink: 12 bytes leftover after parsing attributes in process `syz.3.4981'. [ 270.298336][T16668] veth0_to_bond: entered allmulticast mode [ 270.414219][T16675] netlink: 4 bytes leftover after parsing attributes in process `syz.1.4991'. [ 270.452107][T16675] bridge0: entered promiscuous mode [ 270.481741][T16675] macsec1: entered promiscuous mode [ 270.507251][T16675] macsec1: entered allmulticast mode [ 270.523378][T16675] bridge0: entered allmulticast mode [ 270.544004][T16675] bridge0: port 3(macsec1) entered blocking state [ 270.563615][T16675] bridge0: port 3(macsec1) entered disabled state [ 270.617116][T16686] netlink: 36 bytes leftover after parsing attributes in process `syz.0.4996'. [ 270.630483][T16675] bridge0: left allmulticast mode [ 270.635968][T16675] bridge0: left promiscuous mode [ 271.497836][T16746] netlink: 'syz.3.5024': attribute type 1 has an invalid length. [ 271.521221][T16746] netlink: 'syz.3.5024': attribute type 1 has an invalid length. [ 271.535010][T16746] netlink: 'syz.3.5024': attribute type 2 has an invalid length. [ 272.903950][T16839] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 273.114462][T16850] __nla_validate_parse: 5 callbacks suppressed [ 273.114475][T16850] netlink: 12 bytes leftover after parsing attributes in process `syz.2.5073'. [ 273.938800][T16906] netlink: 20 bytes leftover after parsing attributes in process `syz.1.5101'. [ 273.955236][T16905] netlink: 20 bytes leftover after parsing attributes in process `syz.0.5100'. [ 274.184799][T16924] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 274.192123][T16924] IPv6: NLM_F_CREATE should be set when creating new route [ 274.199447][T16924] IPv6: NLM_F_CREATE should be set when creating new route [ 274.206728][T16924] IPv6: NLM_F_CREATE should be set when creating new route [ 274.218962][T16924] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 275.544077][T16965] lo: entered allmulticast mode [ 275.572772][T16965] lo: left allmulticast mode [ 275.692958][T16974] netlink: 96 bytes leftover after parsing attributes in process `syz.1.5133'. [ 275.731733][T16974] vlan2: entered allmulticast mode [ 275.749706][T16974] gretap0: entered allmulticast mode [ 275.936065][T16988] team0: Device wireguard1 is of different type [ 276.377434][T17021] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 276.746741][T17049] rdma_op ffff888021b709f0 conn xmit_rdma 0000000000000000 [ 277.464572][T17090] netlink: 'syz.3.5182': attribute type 1 has an invalid length. [ 277.483851][T17090] netlink: 208 bytes leftover after parsing attributes in process `syz.3.5182'. [ 277.494281][T17090] netlink: 'syz.3.5182': attribute type 1 has an invalid length. [ 277.505797][T17090] netlink: 'syz.3.5182': attribute type 2 has an invalid length. [ 277.772088][T17108] netlink: 184 bytes leftover after parsing attributes in process `syz.1.5191'. [ 277.805596][T17108] xt_socket: unknown flags 0xd0 [ 278.087661][T17132] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 279.055165][T17198] xt_bpf: check failed: parse error [ 279.329394][T17216] IPVS: Error connecting to the multicast addr [ 279.708285][T17236] netlink: 277 bytes leftover after parsing attributes in process `syz.3.5253'. [ 280.086653][T17265] netlink: 28 bytes leftover after parsing attributes in process `syz.0.5267'. [ 280.419190][T17287] openvswitch: netlink: IP tunnel attribute has 16 unknown bytes. [ 280.555212][T17292] netlink: 4 bytes leftover after parsing attributes in process `syz.1.5281'. [ 281.110418][T17320] netlink: 176 bytes leftover after parsing attributes in process `syz.2.5295'. [ 281.122652][T17320] netlink: 32 bytes leftover after parsing attributes in process `syz.2.5295'. [ 281.194660][T17324] netlink: 12 bytes leftover after parsing attributes in process `syz.1.5296'. [ 281.483681][T17341] netlink: 80 bytes leftover after parsing attributes in process `syz.3.5304'. [ 281.493262][T17341] netlink: 80 bytes leftover after parsing attributes in process `syz.3.5304'. [ 281.890717][T17371] tipc: Started in network mode [ 281.908005][T17371] tipc: Node identity aaaaaaaaaa3, cluster identity 4711 [ 281.940201][T17371] tipc: Enabled bearer , priority 10 [ 282.054716][T17383] bridge0: port 3(ipvlan2) entered blocking state [ 282.068800][T17383] bridge0: port 3(ipvlan2) entered disabled state [ 282.116411][T17383] ipvlan2: entered allmulticast mode [ 282.121741][T17383] bridge0: entered allmulticast mode [ 282.149562][T17383] ipvlan2: left allmulticast mode [ 282.166388][T17383] bridge0: left allmulticast mode [ 282.195052][T17384] team0: Device ip6gre2 is of different type [ 282.437353][T17401] xt_l2tp: v2 tid > 0xffff: 1114244 [ 282.462005][T17403] ipvlan1: entered promiscuous mode [ 282.505111][T17408] netlink: 8 bytes leftover after parsing attributes in process `syz.4.5338'. [ 282.690369][T17419] netlink: 'syz.1.5345': attribute type 2 has an invalid length. [ 282.939261][ T5986] tipc: Node number set to 10136234 [ 283.158206][T17453] netlink: 'syz.4.5359': attribute type 1 has an invalid length. [ 283.316686][T17464] netlink: 212388 bytes leftover after parsing attributes in process `syz.0.5364'. [ 283.329507][T17464] openvswitch: netlink: Message has 5 unknown bytes. [ 283.937555][T17497] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 284.543212][T17536] netlink: 'syz.3.5399': attribute type 29 has an invalid length. [ 284.557242][T17536] netlink: 'syz.3.5399': attribute type 29 has an invalid length. [ 284.601093][T17541] openvswitch: netlink: IP tunnel attribute has 12 unknown bytes. [ 284.722011][T17548] xt_HMARK: proto mask must be zero with L3 mode [ 284.921800][T17563] vlan2: entered promiscuous mode [ 284.931762][T17563] bridge0: entered promiscuous mode [ 285.835130][T17623] __nla_validate_parse: 5 callbacks suppressed [ 285.835150][T17623] netlink: 168 bytes leftover after parsing attributes in process `syz.1.5441'. [ 286.335779][T17660] tipc: Failed to obtain node identity [ 286.343686][T17660] tipc: Enabling of bearer rejected, failed to enable media [ 286.441764][T17666] IPVS: ip_vs_edit_dest(): lower threshold is higher than upper threshold [ 287.001252][T17704] netlink: 16 bytes leftover after parsing attributes in process `syz.3.5480'. [ 287.438975][T17734] xt_l2tp: missing protocol rule (udp|l2tpip) [ 287.887147][T17759] syz.2.5507 (17759) used greatest stack depth: 17864 bytes left [ 287.957831][T17770] netlink: 4 bytes leftover after parsing attributes in process `syz.2.5512'. [ 288.082264][T17770] hsr_slave_0: left promiscuous mode [ 288.102473][T17770] hsr_slave_1: left promiscuous mode [ 288.293897][T17787] netlink: 'syz.0.5519': attribute type 1 has an invalid length. [ 288.313047][T17787] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 289.438290][T17860] netlink: 'syz.4.5556': attribute type 1 has an invalid length. [ 289.458342][T17860] netlink: 184 bytes leftover after parsing attributes in process `syz.4.5556'. [ 289.493315][T17860] netlink: 'syz.4.5556': attribute type 1 has an invalid length. [ 290.267969][T17921] netlink: 16 bytes leftover after parsing attributes in process `syz.2.5585'. [ 290.472012][T17934] netlink: 'syz.4.5594': attribute type 3 has an invalid length. [ 290.522628][T17938] xt_l2tp: v2 sid > 0xffff: 1114112 [ 290.982169][T17970] netlink: 'syz.4.5610': attribute type 1 has an invalid length. [ 290.987996][T17972] netlink: 'syz.0.5609': attribute type 6 has an invalid length. [ 291.029755][T17972] netlink: 'syz.0.5609': attribute type 1 has an invalid length. [ 291.039356][T17972] netlink: 181400 bytes leftover after parsing attributes in process `syz.0.5609'. [ 291.730566][T18021] netlink: 'syz.2.5633': attribute type 1 has an invalid length. [ 291.975265][T18037] netlink: 'syz.2.5641': attribute type 7 has an invalid length. [ 292.093395][T18045] netlink: 'syz.1.5647': attribute type 1 has an invalid length. [ 292.117599][T18045] netlink: 216 bytes leftover after parsing attributes in process `syz.1.5647'. [ 292.591897][T18081] netlink: 4 bytes leftover after parsing attributes in process `syz.4.5663'. [ 293.740990][T18128] netlink: 65039 bytes leftover after parsing attributes in process `syz.2.5685'. [ 293.955659][T18138] netlink: 16 bytes leftover after parsing attributes in process `syz.1.5690'. [ 294.271021][T18158] validate_nla: 1 callbacks suppressed [ 294.271039][T18158] netlink: 'syz.2.5699': attribute type 1 has an invalid length. [ 294.312449][T18158] netlink: 236 bytes leftover after parsing attributes in process `syz.2.5699'. [ 294.493136][T18171] netlink: 24 bytes leftover after parsing attributes in process `syz.2.5704'. [ 294.690898][T18189] netlink: 'syz.3.5714': attribute type 1 has an invalid length. [ 294.771503][T18192] netlink: 8 bytes leftover after parsing attributes in process `syz.2.5716'. [ 295.587272][T18212] `: left allmulticast mode [ 295.597995][T18212] bond_slave_0: left allmulticast mode [ 295.603688][T18212] bond_slave_1: left allmulticast mode [ 295.609930][T18212] bridge_slave_1: left allmulticast mode [ 295.900011][T18212] A link change request failed with some changes committed already. Interface  may have been left with an inconsistent configuration, please check. [ 295.936852][T18233] netlink: 'syz.4.5735': attribute type 3 has an invalid length. [ 296.675508][T18280] netlink: 96 bytes leftover after parsing attributes in process `syz.2.5755'. [ 296.823243][T18290] netlink: 32 bytes leftover after parsing attributes in process `syz.1.5759'. [ 296.970110][T18298] netlink: 104 bytes leftover after parsing attributes in process `syz.3.5763'. [ 297.023065][T18301] netlink: 'syz.1.5764': attribute type 1 has an invalid length. [ 297.046086][T18301] netlink: 232 bytes leftover after parsing attributes in process `syz.1.5764'. [ 297.075279][T18301] netlink: 8 bytes leftover after parsing attributes in process `syz.1.5764'. [ 297.615825][T18338] netlink: 4 bytes leftover after parsing attributes in process `syz.2.5783'. [ 297.842423][T18352] tipc: MTU too low for tipc bearer [ 297.947978][ T30] audit: type=1800 audit(1758772073.646:3): pid=18360 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.3.5795" name="memory.events" dev="tmpfs" ino=5766 res=0 errno=0 [ 298.010300][ T30] audit: type=1804 audit(1758772073.666:4): pid=18360 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=ToMToU comm="syz.3.5795" name="/newroot/1148/memory.events" dev="tmpfs" ino=5766 res=1 errno=0 [ 298.260438][T18380] netlink: 'syz.4.5804': attribute type 3 has an invalid length. [ 298.580261][T18397] netlink: 'syz.1.5812': attribute type 178 has an invalid length. [ 299.592272][T18458] xt_time: invalid argument - start or stop time greater than 23:59:59 [ 299.682662][T18463] netlink: 'syz.2.5845': attribute type 1 has an invalid length. [ 299.756995][T18470] netlink: 256 bytes leftover after parsing attributes in process `syz.4.5849'. [ 300.602279][T18526] netlink: 4 bytes leftover after parsing attributes in process `syz.1.5876'. [ 300.691135][T18532] netlink: 100 bytes leftover after parsing attributes in process `syz.3.5879'. [ 301.027381][T18552] netlink: 212364 bytes leftover after parsing attributes in process `syz.3.5889'. [ 301.076992][T18552] openvswitch: netlink: Message has 5 unknown bytes. [ 301.424175][T18580] openvswitch: netlink: push_nsh: missing base or metadata attributes [ 301.438900][T18580] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 301.660430][T18597] netlink: 'syz.3.5910': attribute type 33 has an invalid length. [ 301.733767][T18601] __nla_validate_parse: 5 callbacks suppressed [ 301.747875][T18601] netlink: 4 bytes leftover after parsing attributes in process `syz.2.5912'. [ 301.788904][T18601] (unnamed net_device) (uninitialized): Invalid ad_actor_system MAC address. [ 301.808700][T18601] (unnamed net_device) (uninitialized): option ad_actor_system: invalid value (1) [ 301.854169][T18610] sock: sock_set_timeout: `syz.0.5916' (pid 18610) tries to set negative timeout [ 301.924048][T18614] tipc: Invalid UDP bearer configuration [ 301.924109][T18614] tipc: Enabling of bearer rejected, failed to enable media [ 301.945389][T18615] xt_socket: unknown flags 0xe4 [ 302.058223][T18621] netlink: 76 bytes leftover after parsing attributes in process `syz.2.5921'. [ 302.086838][T18621] nbd: illegal input index -8454144 [ 302.123494][T18628] netlink: 1 bytes leftover after parsing attributes in process `syz.0.5925'. [ 302.143000][T18628] xt_policy: neither incoming nor outgoing policy selected [ 302.309952][T18636] netlink: 24 bytes leftover after parsing attributes in process `syz.0.5929'. [ 302.459947][T18646] openvswitch: netlink: IP tunnel attribute has 12 unknown bytes. [ 303.036899][T18673] x_tables: ip6_tables: MASQUERADE target: only valid in nat table, not syz1 [ 303.275820][T18678] xt_l2tp: invalid flags combination: 0 [ 303.795821][T18709] netlink: 8 bytes leftover after parsing attributes in process `syz.4.5962'. [ 303.815831][ C0] Illegal XDP return value 16128 on prog (id 371) dev `, expect packet loss! [ 304.235257][T18743] IPVS: sync thread started: state = BACKUP, mcast_ifn = veth1_to_bridge, syncid = 512, id = 0 [ 304.247497][T18739] IPVS: stopping backup sync thread 18743 ... [ 304.686574][ T5986] IPVS: starting estimator thread 0... [ 304.774564][T18778] netlink: 65047 bytes leftover after parsing attributes in process `syz.2.5996'. [ 304.790906][T18774] IPVS: using max 26 ests per chain, 62400 per kthread [ 304.929801][T18788] netlink: 4 bytes leftover after parsing attributes in process `syz.4.6002'. [ 305.004602][T18796] netlink: 'syz.2.6006': attribute type 1 has an invalid length. [ 305.033288][T18796] netlink: 220 bytes leftover after parsing attributes in process `syz.2.6006'. [ 305.062419][T18796] netlink: 'syz.2.6006': attribute type 1 has an invalid length. [ 305.387574][T18819] netlink: 'syz.3.6017': attribute type 29 has an invalid length. [ 305.462182][T18819] netlink: 'syz.3.6017': attribute type 29 has an invalid length. [ 305.558710][T18831] netlink: 'syz.4.6023': attribute type 4 has an invalid length. [ 305.723752][T18843] netlink: 348 bytes leftover after parsing attributes in process `syz.4.6029'. [ 305.992139][T18860] netlink: 12 bytes leftover after parsing attributes in process `syz.4.6038'. [ 306.525601][T18888] Bluetooth: MGMT ver 1.23 [ 306.802860][T18904] netlink: 8 bytes leftover after parsing attributes in process `syz.0.6058'. [ 306.890181][T18909] netlink: 240 bytes leftover after parsing attributes in process `syz.4.6060'. [ 307.008985][T18915] netlink: 12 bytes leftover after parsing attributes in process `syz.1.6063'. [ 307.643555][T18931] tunl0: left promiscuous mode [ 307.657223][T18931] gre0: left promiscuous mode [ 307.737306][T18931] bridge0: port 2(bridge_slave_1) entered disabled state [ 307.745153][T18931] bridge0: port 1(bridge_slave_0) entered disabled state [ 307.785480][T18931] A link change request failed with some changes committed already. Interface bond0 may have been left with an inconsistent configuration, please check. [ 308.993998][T19026] netlink: 'syz.1.6119': attribute type 1 has an invalid length. [ 309.002453][T19026] netlink: 184 bytes leftover after parsing attributes in process `syz.1.6119'. [ 309.033183][T19026] netlink: 40 bytes leftover after parsing attributes in process `syz.1.6119'. [ 309.260170][T19044] netlink: 100 bytes leftover after parsing attributes in process `syz.2.6125'. [ 309.301700][T19046] netlink: 'syz.0.6126': attribute type 3 has an invalid length. [ 309.994870][T19097] netlink: 'syz.0.6152': attribute type 4 has an invalid length. [ 310.013850][T19097] netlink: 17 bytes leftover after parsing attributes in process `syz.0.6152'. [ 310.107575][T19104] netlink: 28 bytes leftover after parsing attributes in process `syz.2.6155'. [ 310.149903][T19109] RDS: rds_bind could not find a transport for 400:0:1200:0:1030:0:ffff:ffff, load rds_tcp or rds_rdma? [ 310.373009][T19124] netlink: 'syz.4.6163': attribute type 2 has an invalid length. [ 310.878554][T19161] netlink: 'syz.0.6182': attribute type 1 has an invalid length. [ 310.965087][T19167] netlink: 20 bytes leftover after parsing attributes in process `syz.0.6185'. [ 310.979480][T19167] netlink: 120 bytes leftover after parsing attributes in process `syz.0.6185'. [ 311.807694][T19223] __nla_validate_parse: 2 callbacks suppressed [ 311.807713][T19223] netlink: 8 bytes leftover after parsing attributes in process `syz.4.6212'. [ 312.396949][T19260] openvswitch: netlink: IPv6 tunnel dst address is zero [ 312.427164][T19265] smc: net device erspan0 applied user defined pnetid SYZ0 [ 312.585510][T19272] netlink: 12 bytes leftover after parsing attributes in process `syz.4.6236'. [ 312.626417][T19272] netlink: 12 bytes leftover after parsing attributes in process `syz.4.6236'. [ 312.940022][T19297] netlink: 24 bytes leftover after parsing attributes in process `syz.3.6248'. [ 313.420597][T19332] netlink: 32 bytes leftover after parsing attributes in process `syz.2.6265'. [ 313.501897][T19336] netlink: 'syz.3.6267': attribute type 1 has an invalid length. [ 313.526268][T19336] netlink: 236 bytes leftover after parsing attributes in process `syz.3.6267'. [ 313.671714][T19349] xt_limit: Overflow, try lower: 604147548/4200216962 [ 313.875116][T19364] openvswitch: netlink: Unknown key attributes 2 [ 314.097350][T19377] tipc: Enabling of bearer rejected, failed to enable media [ 314.443104][T19395] netlink: 'syz.1.6297': attribute type 1 has an invalid length. [ 314.453457][T19395] netlink: 212 bytes leftover after parsing attributes in process `syz.1.6297'. [ 314.465928][T19395] netlink: 'syz.1.6297': attribute type 1 has an invalid length. [ 314.809923][T19413] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 314.844632][T19417] Dead loop on virtual device ip6_vti0, fix it urgently! [ 315.205596][T19439] netlink: 'syz.3.6318': attribute type 1 has an invalid length. [ 315.657049][T19472] netlink: 'syz.4.6333': attribute type 2 has an invalid length. [ 315.664928][T19472] netlink: 188 bytes leftover after parsing attributes in process `syz.4.6333'. [ 315.786131][T19479] netlink: 8 bytes leftover after parsing attributes in process `syz.1.6335'. [ 316.344270][T19510] netlink: 'syz.0.6351': attribute type 32 has an invalid length. [ 316.355767][T19510] netlink: 8 bytes leftover after parsing attributes in process `syz.0.6351'. [ 316.397476][T19510] (unnamed net_device) (uninitialized): Setting coupled_control to off (0) [ 316.935809][T19552] vcan0: entered allmulticast mode [ 317.039027][T19561] sch_tbf: peakrate 7 is lower than or equals to rate 2147483647 ! [ 318.025951][T19627] __nla_validate_parse: 1 callbacks suppressed [ 318.053447][T19627] netlink: 8 bytes leftover after parsing attributes in process `syz.4.6404'. [ 318.399130][T19650] netlink: 16 bytes leftover after parsing attributes in process `syz.1.6416'. [ 318.823254][T19674] syz.3.6428 (19674) used obsolete PPPIOCDETACH ioctl [ 319.123829][T19691] netlink: 'syz.2.6435': attribute type 3 has an invalid length. [ 319.532041][T19711] netlink: 104 bytes leftover after parsing attributes in process `syz.2.6446'. [ 320.339297][T19763] netlink: 8 bytes leftover after parsing attributes in process `syz.3.6472'. [ 320.382436][T19763] netlink: 'syz.3.6472': attribute type 3 has an invalid length. [ 320.610974][T19785] netlink: 'syz.1.6483': attribute type 11 has an invalid length. [ 321.226891][T19817] netlink: 'syz.0.6499': attribute type 1 has an invalid length. [ 321.242901][T19817] netlink: 5624 bytes leftover after parsing attributes in process `syz.0.6499'. [ 321.434366][T19826] nbd: socks must be embedded in a SOCK_ITEM attr [ 321.530229][T19830] tipc: Enabling of bearer rejected, media not registered [ 322.076310][T19861] netlink: 132 bytes leftover after parsing attributes in process `syz.4.6518'. [ 322.274104][T19876] tipc: Enabling of bearer rejected, failed to enable media [ 322.613242][T19897] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 323.135590][T19933] netlink: 'syz.1.6553': attribute type 23 has an invalid length. [ 323.284371][T19939] netlink: 8 bytes leftover after parsing attributes in process `syz.2.6557'. [ 323.318062][T19939] netlink: 4 bytes leftover after parsing attributes in process `syz.2.6557'. [ 323.503170][T19955] vlan1: entered allmulticast mode [ 323.535314][T19955] veth0_vlan: entered allmulticast mode [ 324.245270][T19997] netlink: 8 bytes leftover after parsing attributes in process `syz.0.6585'. [ 324.289780][T20000] IPVS: length: 8 != 1152 [ 324.302946][T20001] netlink: 8 bytes leftover after parsing attributes in process `syz.2.6587'. [ 325.271053][T20062] tipc: Started in network mode [ 325.280195][T20065] netlink: 8 bytes leftover after parsing attributes in process `syz.4.6619'. [ 325.290559][T20065] openvswitch: netlink: nsh attribute has 2338 unknown bytes. [ 325.298378][T20062] tipc: Node identity 0900000000000000ffffffffffffffff, cluster identity 4711 [ 325.308168][T20065] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 325.773359][T20096] netlink: 8 bytes leftover after parsing attributes in process `syz.0.6631'. [ 325.820308][T20096] openvswitch: netlink: Invalid MD length 0 for MD type 0 [ 325.846262][T20096] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 325.879829][T20105] netlink: 100 bytes leftover after parsing attributes in process `syz.2.6636'. [ 326.478992][T20135] netlink: 'syz.4.6650': attribute type 83 has an invalid length. [ 327.257598][T20181] netlink: 64 bytes leftover after parsing attributes in process `syz.0.6671'. [ 327.537502][T20197] netlink: 165 bytes leftover after parsing attributes in process `syz.0.6677'. [ 329.484787][T20319] netlink: 12 bytes leftover after parsing attributes in process `syz.1.6737'. [ 329.731658][T20338] netlink: 8 bytes leftover after parsing attributes in process `syz.0.6746'. [ 330.114014][T20362] netlink: 68 bytes leftover after parsing attributes in process `syz.3.6758'. [ 330.506935][T20390] veth0: entered promiscuous mode [ 330.530378][T20388] veth0: left promiscuous mode [ 330.711038][T20402] netlink: 284 bytes leftover after parsing attributes in process `syz.3.6775'. [ 330.872221][T20414] netlink: 188 bytes leftover after parsing attributes in process `syz.2.6780'. [ 330.888485][T20410] bridge0: port 1(bridge_slave_0) entered disabled state [ 330.898609][T20415] netlink: 'syz.3.6779': attribute type 16 has an invalid length. [ 330.914011][T20410] bridge0: port 2(bridge_slave_1) entered disabled state [ 330.925658][T20415] netlink: 'syz.3.6779': attribute type 17 has an invalid length. [ 331.109853][T20415] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 331.409424][T20441] veth0_to_bridge: entered promiscuous mode [ 331.433540][T20440] veth0_to_bridge: left promiscuous mode [ 331.772124][T20460] netlink: 52 bytes leftover after parsing attributes in process `syz.1.6802'. [ 331.987869][T20475] netlink: 'syz.0.6809': attribute type 8 has an invalid length. [ 332.050023][T20481] netlink: 12 bytes leftover after parsing attributes in process `syz.4.6811'. [ 332.547001][T20509] netlink: 212376 bytes leftover after parsing attributes in process `syz.4.6824'. [ 332.837964][T20524] netlink: 8 bytes leftover after parsing attributes in process `syz.4.6830'. [ 332.866750][T20524] netlink: 12 bytes leftover after parsing attributes in process `syz.4.6830'. [ 332.880150][T20525] netlink: 'syz.2.6831': attribute type 2 has an invalid length. [ 333.501333][T20553] netlink: 'syz.1.6846': attribute type 83 has an invalid length. [ 333.643878][T20560] netlink: 'syz.0.6844': attribute type 1 has an invalid length. [ 333.945506][T20583] netlink: 'syz.3.6859': attribute type 83 has an invalid length. [ 334.115460][T20581] team0 (unregistering): Port device team_slave_0 removed [ 334.142560][T20581] team0 (unregistering): Port device team_slave_1 removed [ 334.539753][T20617] tipc: New replicast peer: 255.255.255.255 [ 334.565737][T20617] tipc: Enabled bearer , priority 10 [ 334.911491][T20640] __nla_validate_parse: 3 callbacks suppressed [ 334.911509][T20640] netlink: 12 bytes leftover after parsing attributes in process `syz.1.6884'. [ 334.935632][T20640] netlink: 12 bytes leftover after parsing attributes in process `syz.1.6884'. [ 334.949209][T20643] netlink: 12 bytes leftover after parsing attributes in process `syz.0.6885'. [ 335.259723][T20660] veth0_to_team: entered promiscuous mode [ 335.272075][T20660] veth0_to_team: entered allmulticast mode [ 335.645405][T20684] netlink: 71 bytes leftover after parsing attributes in process `syz.4.6905'. [ 335.676730][ T5927] tipc: Node number set to 150994944 [ 336.537230][T20747] netlink: 20 bytes leftover after parsing attributes in process `syz.4.6935'. [ 336.548366][T20749] netlink: 36 bytes leftover after parsing attributes in process `syz.0.6932'. [ 336.674749][T20757] openvswitch: netlink: Multiple metadata blocks provided [ 337.097295][T20783] netlink: 36 bytes leftover after parsing attributes in process `syz.1.6950'. [ 337.600728][T20821] bridge0: port 2(bridge_slave_1) entered disabled state [ 337.609804][T20821] bridge0: port 1(bridge_slave_0) entered disabled state [ 337.828443][T20832] netlink: 4 bytes leftover after parsing attributes in process `syz.3.6975'. [ 338.029232][T20832] macvtap1: entered promiscuous mode [ 338.034960][T20832] vlan0: entered promiscuous mode [ 338.043255][T20832] geneve1: entered promiscuous mode [ 338.050918][T20832] macvtap1: entered allmulticast mode [ 338.056726][T20832] vlan0: entered allmulticast mode [ 338.062092][T20832] geneve1: entered allmulticast mode [ 338.174423][T20844] netlink: 10 bytes leftover after parsing attributes in process `syz.2.6981'. [ 338.728234][T20869] netlink: 196 bytes leftover after parsing attributes in process `syz.3.6993'. [ 339.339996][T20909] netlink: 'syz.3.7012': attribute type 1 has an invalid length. [ 339.446171][T20917] netlink: 'syz.3.7015': attribute type 83 has an invalid length. [ 339.570279][T20925] netlink: 'syz.4.7020': attribute type 11 has an invalid length. [ 339.843343][T20945] openvswitch: netlink: IPv4 tun info is not correct [ 340.095745][T20961] netlink: 'syz.2.7036': attribute type 19 has an invalid length. [ 340.589214][T20990] __nla_validate_parse: 1 callbacks suppressed [ 340.589231][T20990] netlink: 36 bytes leftover after parsing attributes in process `syz.2.7049'. [ 341.055920][T21015] netlink: 'syz.1.7058': attribute type 4 has an invalid length. [ 341.266269][T21029] netlink: 'syz.0.7065': attribute type 58 has an invalid length. [ 341.274276][T21029] netlink: 20 bytes leftover after parsing attributes in process `syz.0.7065'. [ 341.368575][T21026] tipc: Enabling of bearer rejected, already enabled [ 341.830004][T21059] netlink: 'syz.2.7080': attribute type 9 has an invalid length. [ 341.856415][T21059] netlink: 211988 bytes leftover after parsing attributes in process `syz.2.7080'. [ 342.054225][T21075] netlink: 'syz.4.7088': attribute type 10 has an invalid length. [ 342.095058][T21078] sch_fq: defrate 0 ignored. [ 342.218258][T21086] netlink: 52 bytes leftover after parsing attributes in process `syz.2.7093'. [ 343.023099][T21142] netlink: 8 bytes leftover after parsing attributes in process `syz.2.7119'. [ 343.605135][ T5986] IPVS: starting estimator thread 0... [ 343.620312][T21169] IPVS: dh: SCTP 172.20.20.187:0 - no destination available [ 343.716094][T21172] IPVS: using max 30 ests per chain, 72000 per kthread [ 343.765314][T21181] netlink: 'syz.0.7138': attribute type 6 has an invalid length. [ 343.894942][T21187] netlink: 'syz.2.7140': attribute type 1 has an invalid length. [ 344.108329][T21205] netlink: 4 bytes leftover after parsing attributes in process `syz.1.7148'. [ 344.313818][T21216] netlink: 8 bytes leftover after parsing attributes in process `syz.1.7156'. [ 344.334682][T21216] openvswitch: netlink: nsh attribute has 1 unknown bytes. [ 344.353354][T21216] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 344.593511][T21235] netlink: 16 bytes leftover after parsing attributes in process `syz.4.7163'. [ 344.662477][T21241] batadv0: entered promiscuous mode [ 344.677830][T21243] netlink: 20 bytes leftover after parsing attributes in process `syz.3.7166'. [ 344.685429][T21241] bond0: entered promiscuous mode [ 344.704467][T21241] bond_slave_0: entered promiscuous mode [ 344.713051][T21241] bond_slave_1: entered promiscuous mode [ 344.722136][T21241] hsr1: entered allmulticast mode [ 344.732118][T21241] batadv0: entered allmulticast mode [ 344.747561][T21241] bond0: entered allmulticast mode [ 344.755069][T21241] bond_slave_0: entered allmulticast mode [ 344.765510][T21241] bond_slave_1: entered allmulticast mode [ 344.776922][T21241] 8021q: adding VLAN 0 to HW filter on device hsr1 [ 345.132892][T21273] netlink: 'syz.4.7181': attribute type 4 has an invalid length. [ 345.213021][T21278] netlink: 104 bytes leftover after parsing attributes in process `syz.3.7183'. [ 345.801816][T21318] netlink: 16186 bytes leftover after parsing attributes in process `syz.2.7203'. [ 346.162850][T21345] netlink: 8 bytes leftover after parsing attributes in process `syz.1.7216'. [ 346.209795][T21345] netlink: 'syz.1.7216': attribute type 1 has an invalid length. [ 346.243615][T21345] netlink: 'syz.1.7216': attribute type 2 has an invalid length. [ 346.258572][T21350] netlink: 'syz.2.7218': attribute type 4 has an invalid length. [ 346.387511][T21358] netlink: 20 bytes leftover after parsing attributes in process `syz.1.7223'. [ 346.637993][T21369] netlink: 8 bytes leftover after parsing attributes in process `syz.4.7229'. [ 346.698164][T21369] netlink: 'syz.4.7229': attribute type 30 has an invalid length. [ 346.716158][T21369] netlink: 4 bytes leftover after parsing attributes in process `syz.4.7229'. [ 346.773939][T21374] netlink: 4 bytes leftover after parsing attributes in process `syz.2.7231'. [ 347.012152][T21382] tap0: tun_chr_ioctl cmd 1074025678 [ 347.024208][T21382] tap0: group set to 0 [ 347.508666][T21414] netlink: 8 bytes leftover after parsing attributes in process `syz.4.7251'. [ 347.559944][T21420] veth1_macvtap: left promiscuous mode [ 347.711026][T21430] netlink: 'syz.0.7258': attribute type 5 has an invalid length. [ 347.913716][T21441] netlink: 165 bytes leftover after parsing attributes in process `syz.4.7261'. [ 348.231816][T21461] netlink: 'syz.4.7271': attribute type 1 has an invalid length. [ 349.892147][T21565] erspan0: entered promiscuous mode [ 350.318848][T21595] netlink: 'syz.3.7331': attribute type 83 has an invalid length. [ 350.564943][T21610] netlink: 52 bytes leftover after parsing attributes in process `syz.1.7340'. [ 350.585257][T21610] netlink: 52 bytes leftover after parsing attributes in process `syz.1.7340'. [ 350.864409][T21631] netlink: 'syz.0.7349': attribute type 1 has an invalid length. [ 350.876551][T21631] __nla_validate_parse: 1 callbacks suppressed [ 350.876567][T21631] netlink: 172 bytes leftover after parsing attributes in process `syz.0.7349'. [ 351.095684][T21647] netlink: 340 bytes leftover after parsing attributes in process `syz.0.7357'. [ 352.800497][T21750] netlink: 8 bytes leftover after parsing attributes in process `syz.1.7403'. [ 353.087979][T21768] netlink: 40 bytes leftover after parsing attributes in process `syz.2.7407'. [ 353.609786][T21801] (unnamed net_device) (uninitialized): ARP target 1.0.0.0 is already present [ 353.658846][T21801] (unnamed net_device) (uninitialized): option arp_ip_target: invalid value (1) [ 354.379420][T21850] netlink: 40 bytes leftover after parsing attributes in process `syz.1.7438'. [ 354.563859][T21864] netlink: 'syz.1.7444': attribute type 5 has an invalid length. [ 354.576202][T21859] netlink: 4 bytes leftover after parsing attributes in process `syz.4.7443'. [ 354.862489][T21882] netlink: 248 bytes leftover after parsing attributes in process `syz.1.7453'. [ 355.163901][T21903] netlink: 16 bytes leftover after parsing attributes in process `syz.1.7460'. [ 355.190388][T21903] netlink: 16 bytes leftover after parsing attributes in process `syz.1.7460'. [ 355.423593][T21917] tap0: tun_chr_ioctl cmd 2148553947 [ 355.565863][T21926] netlink: 40 bytes leftover after parsing attributes in process `syz.0.7471'. [ 355.884217][T21951] veth0: entered promiscuous mode [ 355.895191][T21949] veth0: left promiscuous mode [ 356.138484][T21968] blkio.reset_stats is deprecated [ 356.642619][T21987] netlink: 28 bytes leftover after parsing attributes in process `syz.1.7499'. [ 357.343486][T22029] openvswitch: netlink: Multiple metadata blocks provided [ 358.019523][T22064] netlink: 8 bytes leftover after parsing attributes in process `syz.3.7530'. [ 358.082305][T22064] A link change request failed with some changes committed already. Interface team0 may have been left with an inconsistent configuration, please check. [ 358.230847][T22072] netlink: 104 bytes leftover after parsing attributes in process `syz.2.7534'. [ 358.386600][T22081] netlink: 16 bytes leftover after parsing attributes in process `syz.3.7539'. [ 358.441662][ T8589] ip6_tunnel: ip6gre1 xmit: Local address not yet configured! [ 358.464498][ T8589] ip6_tunnel: ip6gre1 xmit: Local address not yet configured! [ 358.474673][ T919] ip6_tunnel: ip6gre1 xmit: Local address not yet configured! [ 358.741429][T22105] netlink: 8 bytes leftover after parsing attributes in process `syz.1.7549'. [ 359.296627][ T919] ip6_tunnel: ip6gre1 xmit: Local address not yet configured! [ 359.536710][ T919] ip6_tunnel: ip6gre1 xmit: Local address not yet configured! [ 359.591621][T22164] netlink: 4 bytes leftover after parsing attributes in process `syz.2.7576'. [ 359.758592][T22174] netdevsim netdevsim4 netdevsim0: entered promiscuous mode [ 359.949737][T22190] netlink: 'syz.2.7589': attribute type 1 has an invalid length. [ 360.253040][T22208] tun0: tun_chr_ioctl cmd 1074025675 [ 360.261376][T22208] tun0: persist disabled [ 360.590986][T22235] netlink: 44 bytes leftover after parsing attributes in process `syz.3.7611'. [ 362.656607][ C1] ip6_tunnel: ip6gre1 xmit: Local address not yet configured! [ 362.898039][T22381] netlink: 16 bytes leftover after parsing attributes in process `syz.0.7675'. [ 362.916240][T22381] netlink: 16 bytes leftover after parsing attributes in process `syz.0.7675'. [ 362.948960][T22386] netlink: 20 bytes leftover after parsing attributes in process `syz.2.7676'. [ 363.065094][T22394] netlink: 'syz.0.7680': attribute type 18 has an invalid length. [ 363.137350][T22400] team0: Cannot enslave team device to itself [ 363.225624][T22403] netlink: 4 bytes leftover after parsing attributes in process `syz.3.7684'. [ 363.302634][T22410] netlink: 16 bytes leftover after parsing attributes in process `syz.4.7688'. [ 363.434005][T22417] netlink: 12 bytes leftover after parsing attributes in process `syz.1.7690'. [ 363.591291][T22425] netlink: 'syz.0.7694': attribute type 2 has an invalid length. [ 363.609331][T22425] netlink: 84 bytes leftover after parsing attributes in process `syz.0.7694'. [ 364.021130][T22457] netlink: 104 bytes leftover after parsing attributes in process `syz.0.7710'. [ 364.155878][T22463] netlink: 'syz.2.7712': attribute type 1 has an invalid length. [ 364.185586][T22463] netlink: 24 bytes leftover after parsing attributes in process `syz.2.7712'. [ 364.622644][T22492] netlink: 360 bytes leftover after parsing attributes in process `syz.0.7727'. [ 365.012044][T22523] netlink: 'syz.1.7738': attribute type 1 has an invalid length. [ 365.033161][T22523] netlink: 'syz.1.7738': attribute type 4 has an invalid length. [ 365.202442][T22531] netlink: zone id is out of range [ 365.213090][T22531] netlink: zone id is out of range [ 365.234133][T22531] netlink: zone id is out of range [ 365.252467][T22531] netlink: zone id is out of range [ 365.257893][T22531] netlink: zone id is out of range [ 365.264545][T22531] netlink: zone id is out of range [ 365.300642][T22531] netlink: zone id is out of range [ 365.308341][T22531] netlink: zone id is out of range [ 365.314337][T22531] netlink: zone id is out of range [ 365.319957][T22531] netlink: zone id is out of range [ 365.458652][T22550] batadv_slave_1: entered promiscuous mode [ 365.468730][T22550] batman_adv: batadv0: Adding interface: macsec2 [ 365.475161][T22550] batman_adv: batadv0: The MTU of interface macsec2 is too small (1468) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 365.523120][T22550] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 365.544015][T22550] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 365.563093][T22550] batman_adv: batadv0: Interface activated: macsec2 [ 365.789469][T22564] tap0: tun_chr_ioctl cmd 1074025672 [ 365.800897][T22564] tap0: ignored: set checksum disabled [ 367.957558][T22709] netlink: 'syz.2.7827': attribute type 9 has an invalid length. [ 367.965455][T22709] __nla_validate_parse: 12 callbacks suppressed [ 367.965470][T22709] netlink: 212260 bytes leftover after parsing attributes in process `syz.2.7827'. [ 368.164986][T22721] netlink: 8 bytes leftover after parsing attributes in process `syz.4.7832'. [ 368.189038][T22721] bond0: entered promiscuous mode [ 368.194154][T22721] bond_slave_0: entered promiscuous mode [ 368.203388][T22721] bond_slave_1: entered promiscuous mode [ 368.224246][T22721] bond0: left promiscuous mode [ 368.235741][T22721] bond_slave_0: left promiscuous mode [ 368.245651][T22721] bond_slave_1: left promiscuous mode [ 368.267938][T22727] netlink: 24 bytes leftover after parsing attributes in process `syz.2.7834'. [ 368.288545][T22729] netlink: 8 bytes leftover after parsing attributes in process `syz.0.7836'. [ 368.402232][T22733] syz.2.7838: vmalloc error: size 8589938688, exceeds total pages, mode:0xdc0(GFP_KERNEL|__GFP_ZERO), nodemask=(null),cpuset=/,mems_allowed=0-1 [ 368.480682][T22733] CPU: 1 UID: 0 PID: 22733 Comm: syz.2.7838 Not tainted syzkaller #0 PREEMPT(full) [ 368.480710][T22733] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/18/2025 [ 368.480728][T22733] Call Trace: [ 368.480736][T22733] [ 368.480745][T22733] dump_stack_lvl+0x189/0x250 [ 368.480776][T22733] ? __pfx_dump_stack_lvl+0x10/0x10 [ 368.480797][T22733] ? __pfx__printk+0x10/0x10 [ 368.480821][T22733] ? cpuset_print_current_mems_allowed+0x1f/0x360 [ 368.480843][T22733] ? cpuset_print_current_mems_allowed+0x1f/0x360 [ 368.480866][T22733] ? cpuset_print_current_mems_allowed+0x2ee/0x360 [ 368.480889][T22733] warn_alloc+0x214/0x310 [ 368.480917][T22733] ? stack_depot_save_flags+0x40/0x860 [ 368.480945][T22733] ? __pfx_warn_alloc+0x10/0x10 [ 368.480972][T22733] ? kasan_save_track+0x4f/0x80 [ 368.480994][T22733] ? xskq_create+0x56/0x170 [ 368.481010][T22733] ? xsk_init_queue+0xb0/0x110 [ 368.481025][T22733] ? xsk_setsockopt+0x4dc/0x8d0 [ 368.481046][T22733] ? do_sock_setsockopt+0x179/0x1b0 [ 368.481065][T22733] ? __x64_sys_setsockopt+0x13f/0x1b0 [ 368.481084][T22733] ? do_syscall_64+0xfa/0x3b0 [ 368.481102][T22733] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 368.481129][T22733] __vmalloc_node_range_noprof+0x125/0x12f0 [ 368.481182][T22733] ? __pfx___vmalloc_node_range_noprof+0x10/0x10 [ 368.481212][T22733] ? __kasan_kmalloc+0x93/0xb0 [ 368.481237][T22733] vmalloc_user_noprof+0xad/0xf0 [ 368.481261][T22733] ? xskq_create+0xbf/0x170 [ 368.481279][T22733] xskq_create+0xbf/0x170 [ 368.481300][T22733] xsk_init_queue+0xb0/0x110 [ 368.481320][T22733] xsk_setsockopt+0x4dc/0x8d0 [ 368.481347][T22733] ? __pfx_xsk_setsockopt+0x10/0x10 [ 368.481371][T22733] ? __pfx_aa_sk_perm+0x10/0x10 [ 368.481401][T22733] ? aa_sock_opt_perm+0xff/0x1b0 [ 368.481422][T22733] ? bpf_lsm_socket_setsockopt+0x9/0x20 [ 368.481441][T22733] ? __pfx_xsk_setsockopt+0x10/0x10 [ 368.481466][T22733] do_sock_setsockopt+0x179/0x1b0 [ 368.481491][T22733] __x64_sys_setsockopt+0x13f/0x1b0 [ 368.481517][T22733] do_syscall_64+0xfa/0x3b0 [ 368.481540][T22733] ? lockdep_hardirqs_on+0x9c/0x150 [ 368.481559][T22733] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 368.481577][T22733] ? clear_bhb_loop+0x60/0xb0 [ 368.481599][T22733] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 368.481620][T22733] RIP: 0033:0x7f4e5f98eec9 [ 368.481637][T22733] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 368.481652][T22733] RSP: 002b:00007f4e608d7038 EFLAGS: 00000246 ORIG_RAX: 0000000000000036 [ 368.481671][T22733] RAX: ffffffffffffffda RBX: 00007f4e5fbe5fa0 RCX: 00007f4e5f98eec9 [ 368.481684][T22733] RDX: 0000000000000006 RSI: 000000000000011b RDI: 0000000000000003 [ 368.481695][T22733] RBP: 00007f4e5fa11f91 R08: 0000000000000004 R09: 0000000000000000 [ 368.481706][T22733] R10: 0000200000000000 R11: 0000000000000246 R12: 0000000000000000 [ 368.481718][T22733] R13: 00007f4e5fbe6038 R14: 00007f4e5fbe5fa0 R15: 00007fffe7db5cf8 [ 368.481749][T22733] [ 368.481760][T22733] Mem-Info: [ 368.806053][T22733] active_anon:5587 inactive_anon:0 isolated_anon:0 [ 368.806053][T22733] active_file:3213 inactive_file:39991 isolated_file:0 [ 368.806053][T22733] unevictable:768 dirty:296 writeback:0 [ 368.806053][T22733] slab_reclaimable:11826 slab_unreclaimable:113007 [ 368.806053][T22733] mapped:29036 shmem:1369 pagetables:1245 [ 368.806053][T22733] sec_pagetables:0 bounce:0 [ 368.806053][T22733] kernel_misc_reclaimable:0 [ 368.806053][T22733] free:1311687 free_pcp:12783 free_cma:0 [ 368.948394][T22733] Node 0 active_anon:22248kB inactive_anon:0kB active_file:12852kB inactive_file:159764kB unevictable:1536kB isolated(anon):0kB isolated(file):0kB mapped:116124kB dirty:1188kB writeback:0kB shmem:3940kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB kernel_stack:12748kB pagetables:4284kB sec_pagetables:0kB all_unreclaimable? no Balloon:0kB [ 368.981340][T22733] Node 1 active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:200kB unevictable:1536kB isolated(anon):0kB isolated(file):0kB mapped:0kB dirty:0kB writeback:0kB shmem:1536kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB kernel_stack:48kB pagetables:168kB sec_pagetables:0kB all_unreclaimable? no Balloon:0kB [ 369.029006][T22733] Node 0 DMA free:15360kB boost:0kB min:204kB low:252kB high:300kB reserved_highatomic:0KB free_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB present:15992kB managed:15360kB mlocked:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB [ 369.058841][T22733] lowmem_reserve[]: 0 2497 2499 2499 2499 [ 369.065145][T22758] netlink: 24 bytes leftover after parsing attributes in process `syz.4.7846'. [ 369.136152][T22733] Node 0 DMA32 free:1341980kB boost:0kB min:34248kB low:42808kB high:51368kB reserved_highatomic:0KB free_highatomic:0KB active_anon:22000kB inactive_anon:0kB active_file:12852kB inactive_file:158196kB unevictable:1536kB writepending:1188kB present:3129332kB managed:2557412kB mlocked:0kB bounce:0kB free_pcp:34060kB local_pcp:13452kB free_cma:0kB [ 369.178351][T22733] lowmem_reserve[]: 0 0 1 1 1 [ 369.183114][T22733] Node 0 Normal free:12kB boost:0kB min:20kB low:24kB high:28kB reserved_highatomic:0KB free_highatomic:0KB active_anon:48kB inactive_anon:0kB active_file:0kB inactive_file:1568kB unevictable:0kB writepending:0kB present:1048580kB managed:1644kB mlocked:0kB bounce:0kB free_pcp:16kB local_pcp:8kB free_cma:0kB [ 369.212898][T22733] lowmem_reserve[]: 0 0 0 0 0 [ 369.219056][T22733] Node 1 Normal free:3890344kB boost:0kB min:55632kB low:69540kB high:83448kB reserved_highatomic:0KB free_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:200kB unevictable:1536kB writepending:0kB present:4194300kB managed:4111100kB mlocked:0kB bounce:0kB free_pcp:17136kB local_pcp:7120kB free_cma:0kB [ 369.290998][T22733] lowmem_reserve[]: 0 0 0 0 0 [ 369.295768][T22733] Node 0 DMA: 0*4kB 0*8kB 0*16kB 0*32kB 0*64kB 0*128kB 0*256kB 0*512kB 1*1024kB (U) 1*2048kB (M) 3*4096kB (M) = 15360kB [ 369.323041][T22733] Node 0 DMA32: 797*4kB (UME) 413*8kB (UME) 553*16kB (UME) 1050*32kB (UM) 671*64kB (UME) 264*128kB (UME) 72*256kB (UM) 17*512kB (UME) 13*1024kB (UME) 12*2048kB (UME) 281*4096kB (UM) = 1341676kB [ 369.348502][T22733] Node 0 Normal: 1*4kB (M) 1*8kB (M) 0*16kB 0*32kB 0*64kB 0*128kB 0*256kB 0*512kB 0*1024kB 0*2048kB 0*4096kB = 12kB [ 369.368931][T22733] Node 1 Normal: 184*4kB (UE) 41*8kB (UME) 28*16kB (UME) 64*32kB (UME) 21*64kB (UME) 5*128kB (UME) 5*256kB (UME) 5*512kB (UME) 4*1024kB (UME) 1*2048kB (E) 946*4096kB (M) = 3890344kB [ 369.399831][T22772] netlink: 'syz.1.7855': attribute type 1 has an invalid length. [ 369.412565][T22772] netlink: 'syz.1.7855': attribute type 10 has an invalid length. [ 369.422889][T22733] Node 0 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 369.436912][T22733] Node 0 hugepages_total=2 hugepages_free=2 hugepages_surp=0 hugepages_size=2048kB [ 369.449618][T22772] netlink: 236 bytes leftover after parsing attributes in process `syz.1.7855'. [ 369.459309][T22733] Node 1 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 369.473047][T22733] Node 1 hugepages_total=2 hugepages_free=2 hugepages_surp=0 hugepages_size=2048kB [ 369.492908][T22733] 44569 total pagecache pages [ 369.503048][T22733] 0 pages in swap cache [ 369.513629][T22733] Free swap = 124996kB [ 369.521376][T22733] Total swap = 124996kB [ 369.536805][T22733] 2097051 pages RAM [ 369.556225][T22733] 0 pages HighMem/MovableOnly [ 369.561191][T22733] 425672 pages reserved [ 369.565366][T22733] 0 pages cma reserved [ 369.614680][T22786] netlink: 104 bytes leftover after parsing attributes in process `syz.3.7862'. [ 369.815183][T22800] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 369.822486][T22800] IPv6: NLM_F_CREATE should be set when creating new route [ 369.829760][T22800] IPv6: NLM_F_CREATE should be set when creating new route [ 369.843434][T22800] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 369.965217][T22805] netlink: 'syz.4.7871': attribute type 3 has an invalid length. [ 370.602517][T22849] netlink: 4 bytes leftover after parsing attributes in process `syz.4.7892'. [ 371.017238][T22880] netlink: 4 bytes leftover after parsing attributes in process `syz.1.7903'. [ 371.036208][T22880] netlink: 16 bytes leftover after parsing attributes in process `syz.1.7903'. [ 371.200423][T22894] net_ratelimit: 219 callbacks suppressed [ 371.200441][T22894] openvswitch: netlink: ufid size 3068 bytes exceeds the range (1, 16) [ 371.218043][T22894] openvswitch: netlink: Duplicate key (type 0). [ 371.536161][ C1] ip6_tunnel: ip6gre1 xmit: Local address not yet configured! [ 371.859018][T22938] bridge0: trying to set multicast startup query interval below minimum, setting to 100 (1000ms) [ 371.903258][T22938] bridge0: port 2(bridge_slave_1) entered disabled state [ 371.910902][T22938] bridge0: port 1(bridge_slave_0) entered disabled state [ 372.512934][T22975] netlink: 'syz.4.7950': attribute type 1 has an invalid length. [ 373.271954][T23018] __nla_validate_parse: 3 callbacks suppressed [ 373.271972][T23018] netlink: 64 bytes leftover after parsing attributes in process `syz.4.7970'. [ 373.361521][T23023] netem: unknown loss type 0 [ 373.379622][T23023] netem: change failed [ 375.018814][T23138] netlink: 'syz.3.8027': attribute type 83 has an invalid length. [ 375.711819][T23178] tap0: tun_chr_ioctl cmd 1074025677 [ 375.736899][T23178] tap0: linktype set to 65534 [ 376.045784][T23207] netlink: 100 bytes leftover after parsing attributes in process `syz.1.8057'. [ 376.571257][T23244] netlink: 8 bytes leftover after parsing attributes in process `syz.2.8077'. [ 377.361164][T23300] tipc: New replicast peer: 255.255.255.255 [ 377.369731][T23300] tipc: Enabled bearer , priority 10 [ 377.382244][T23300] netlink: 12 bytes leftover after parsing attributes in process `syz.1.8101'. [ 377.568841][T23313] tap0: tun_chr_ioctl cmd 1074025676 [ 377.574269][T23313] tap0: owner set to 0 [ 377.862203][T23331] netlink: 16 bytes leftover after parsing attributes in process `syz.1.8116'. [ 377.972829][T23339] netlink: 104 bytes leftover after parsing attributes in process `syz.4.8120'. [ 378.133211][T23350] netlink: 4 bytes leftover after parsing attributes in process `syz.0.8125'. [ 378.243048][T23356] netlink: 12 bytes leftover after parsing attributes in process `syz.1.8128'. [ 378.590313][T23384] netlink: 48 bytes leftover after parsing attributes in process `syz.4.8141'. [ 378.740059][T23394] veth0: entered promiscuous mode [ 378.750037][T23392] veth0: left promiscuous mode [ 379.081544][T23418] netlink: 'syz.2.8157': attribute type 5 has an invalid length. [ 379.164464][T23422] netlink: 24 bytes leftover after parsing attributes in process `syz.4.8159'. [ 379.183918][T23422] netlink: 10 bytes leftover after parsing attributes in process `syz.4.8159'. [ 379.489813][T23434] netlink: 'syz.1.8165': attribute type 8 has an invalid length. [ 380.245683][T23469] netlink: 4 bytes leftover after parsing attributes in process `syz.2.8180'. [ 380.882506][T23511] netlink: 8 bytes leftover after parsing attributes in process `syz.3.8199'. [ 381.174648][T23524] gtp0: entered promiscuous mode [ 381.187777][T23524] gtp0: entered allmulticast mode [ 381.552318][T23548] netlink: 'syz.0.8213': attribute type 42 has an invalid length. [ 382.100147][T23578] netlink: 8 bytes leftover after parsing attributes in process `syz.1.8230'. [ 382.166196][T23578] netlink: 8 bytes leftover after parsing attributes in process `syz.1.8230'. [ 382.186399][T23578] netlink: 8 bytes leftover after parsing attributes in process `syz.1.8230'. [ 382.848737][ T5865] block nbd0: Receive control failed (result -32) [ 382.883472][T23634] netlink: 20 bytes leftover after parsing attributes in process `syz.2.8255'. [ 384.516460][T23749] netlink: 'syz.3.8308': attribute type 1 has an invalid length. [ 384.559444][T23749] netlink: 'syz.3.8308': attribute type 1 has an invalid length. [ 384.599644][T23749] netlink: 216 bytes leftover after parsing attributes in process `syz.3.8308'. [ 384.734959][T23760] Bluetooth: hci1: too big key_count value 32778 [ 385.013526][T23783] netlink: 12 bytes leftover after parsing attributes in process `syz.1.8324'. [ 385.033925][T23784] netlink: 256 bytes leftover after parsing attributes in process `syz.4.8326'. [ 385.037269][T23783] netlink: 12 bytes leftover after parsing attributes in process `syz.1.8324'. [ 385.371476][T23803] openvswitch: netlink: Unknown VXLAN extension attribute 0 [ 385.800622][T23834] netlink: 4 bytes leftover after parsing attributes in process `syz.0.8350'. [ 385.984248][T23850] netlink: 165 bytes leftover after parsing attributes in process `syz.4.8358'. [ 386.593486][T23894] openvswitch: netlink: IP tunnel dst address not specified [ 386.671488][T23900] openvswitch: netlink: Multiple metadata blocks provided [ 386.858258][T23913] netlink: 40 bytes leftover after parsing attributes in process `syz.3.8388'. [ 387.090273][T23926] netlink: 8 bytes leftover after parsing attributes in process `syz.0.8394'. [ 387.116789][T23926] netlink: 4 bytes leftover after parsing attributes in process `syz.0.8394'. [ 387.710679][T23967] netlink: 'syz.4.8413': attribute type 1 has an invalid length. [ 387.737155][T23967] netlink: 140 bytes leftover after parsing attributes in process `syz.4.8413'. [ 387.761872][T23967] netlink: 'syz.4.8413': attribute type 1 has an invalid length. [ 387.996253][T23981] netlink: 'syz.4.8419': attribute type 1 has an invalid length. [ 388.143449][T23986] sctp: [Deprecated]: syz.2.8421 (pid 23986) Use of int in max_burst socket option deprecated. [ 388.143449][T23986] Use struct sctp_assoc_value instead [ 388.176153][ C1] ip6_tunnel: ip6gre1 xmit: Local address not yet configured! [ 388.399205][T24002] block nbd1: server does not support multiple connections per device. [ 388.414955][T24002] block nbd1: shutting down sockets [ 388.793491][T24031] veth0: entered promiscuous mode [ 388.812796][T24031] veth0: left promiscuous mode [ 388.970618][T24043] netlink: 'syz.4.8450': attribute type 1 has an invalid length. [ 388.998982][T24043] netlink: 'syz.4.8450': attribute type 1 has an invalid length. [ 389.738785][T24085] netlink: 'syz.1.8468': attribute type 1 has an invalid length. [ 390.134650][T24108] __nla_validate_parse: 5 callbacks suppressed [ 390.134668][T24108] netlink: 64 bytes leftover after parsing attributes in process `syz.1.8479'. [ 390.763048][T24151] lo: entered allmulticast mode [ 390.779108][T24151] tunl0: entered allmulticast mode [ 390.798869][T24151] gre0: entered allmulticast mode [ 390.808610][T24151] gretap0: entered allmulticast mode [ 390.839849][T24151] erspan0: entered allmulticast mode [ 390.861613][T24151] ip_vti0: entered allmulticast mode [ 390.870182][T24151] ip6_vti0: entered allmulticast mode [ 390.880886][T24151] sit0: entered allmulticast mode [ 390.894611][T24151] ip6tnl0: entered allmulticast mode [ 390.907750][T24151] ip6gre0: entered allmulticast mode [ 390.918992][T24151] syz_tun: entered allmulticast mode [ 390.930470][T24151] ip6gretap0: entered allmulticast mode [ 390.942419][T24151] bridge0: entered allmulticast mode [ 390.954575][T24151] vcan0: entered allmulticast mode [ 390.963309][T24151] bond0: entered allmulticast mode [ 390.972180][T24151] bond_slave_0: entered allmulticast mode [ 390.978848][T24151] bond_slave_1: entered allmulticast mode [ 390.997583][T24151] team0: entered allmulticast mode [ 391.010344][T24151] team_slave_0: entered allmulticast mode [ 391.016418][T24151] team_slave_1: entered allmulticast mode [ 391.031416][T24151] dummy0: entered allmulticast mode [ 391.043299][T24151] nlmon0: entered allmulticast mode [ 391.054100][T24151] caif0: entered allmulticast mode [ 391.059874][T24151] batadv0: entered allmulticast mode [ 391.068850][T24151] vxcan0: entered allmulticast mode [ 391.075675][T24151] vxcan1: entered allmulticast mode [ 391.082331][T24151] veth0: entered allmulticast mode [ 391.090534][T24151] veth1: entered allmulticast mode [ 391.101093][T24151] wg0: entered allmulticast mode [ 391.108637][T24151] wg1: left promiscuous mode [ 391.121579][T24151] wg2: entered allmulticast mode [ 391.149872][T24151] veth0_to_bridge: entered allmulticast mode [ 391.174787][T24151] veth1_to_bridge: entered allmulticast mode [ 391.200783][T24151] veth0_to_bond: entered allmulticast mode [ 391.212700][T24151] veth1_to_bond: entered allmulticast mode [ 391.225071][T24151] veth0_to_team: entered allmulticast mode [ 391.238727][T24151] veth1_to_team: entered allmulticast mode [ 391.251641][T24151] veth0_to_batadv: entered allmulticast mode [ 391.261427][T24151] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 391.273634][T24151] batadv_slave_0: entered allmulticast mode [ 391.292169][T24151] veth1_to_batadv: entered allmulticast mode [ 391.303523][T24151] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 391.311764][T24151] batadv_slave_1: entered allmulticast mode [ 391.327002][T24151] xfrm0: entered allmulticast mode [ 391.337063][T24151] veth0_to_hsr: entered allmulticast mode [ 391.347816][T24151] hsr_slave_0: entered allmulticast mode [ 391.356740][T24151] veth1_to_hsr: entered allmulticast mode [ 391.369304][T24151] hsr_slave_1: entered allmulticast mode [ 391.387462][T24151] hsr0: entered allmulticast mode [ 391.396892][T24151] veth1_macvtap: entered allmulticast mode [ 391.407773][T24151] veth0_macvtap: entered allmulticast mode [ 391.424541][T24151] macvtap0: entered allmulticast mode [ 391.433939][T24151] macsec0: entered allmulticast mode [ 391.443284][T24151] geneve0: entered allmulticast mode [ 391.464669][T24151] netdevsim netdevsim3 netdevsim0: entered allmulticast mode [ 391.479472][T24151] netdevsim netdevsim3 netdevsim1: entered allmulticast mode [ 391.529174][T24151] netdevsim netdevsim3 netdevsim2: entered allmulticast mode [ 391.544268][T24151] netdevsim netdevsim3 netdevsim3: entered allmulticast mode [ 391.566260][T24151] mac80211_hwsim hwsim6 wlan0: entered allmulticast mode [ 391.573726][T24151] mac80211_hwsim hwsim7 wlan1: entered allmulticast mode [ 391.581284][T24151] ip6erspan0: entered allmulticast mode [ 391.591255][T24151] bond1: left promiscuous mode [ 391.609185][T24151] bridge1: entered allmulticast mode [ 391.622069][T24151] erspan1: entered allmulticast mode [ 391.638492][T24151] geneve2: entered allmulticast mode [ 391.651328][T24151] bond2: entered allmulticast mode [ 391.663649][T24151] bond3: left promiscuous mode [ 391.670038][T24151] syztnl1: entered allmulticast mode [ 391.675597][T24151] geneve3: entered allmulticast mode [ 391.685047][T24151] ipvlan0: entered allmulticast mode [ 391.693465][T24151] vxlan0: entered allmulticast mode [ 391.700016][T24151] ipvlan1: left promiscuous mode [ 391.705137][T24151] ipvlan1: entered allmulticast mode [ 391.714120][T24151] bond4: entered allmulticast mode [ 391.742359][T24151] vlan0: left promiscuous mode [ 391.748552][T24151] geneve1: left promiscuous mode [ 391.753894][T24151] macvtap1: left promiscuous mode [ 391.763018][T24151] ip6gre1: entered allmulticast mode [ 391.770013][T24151] mac80211_hwsim hwsim6 pim6reg0: entered allmulticast mode [ 391.779058][T24151] gtp0: left promiscuous mode [ 391.790321][T24170] ip6gre0: Master is either lo or non-ether device [ 391.815642][ T13] netdevsim netdevsim3 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 391.850172][ T13] netdevsim netdevsim3 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 391.877136][ T13] netdevsim netdevsim3 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 391.909117][ T13] netdevsim netdevsim3 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 391.918802][T24193] sctp: [Deprecated]: syz.3.8518 (pid 24193) Use of struct sctp_assoc_value in delayed_ack socket option. [ 391.918802][T24193] Use struct sctp_sack_info instead [ 392.304100][T24222] netlink: 12 bytes leftover after parsing attributes in process `syz.3.8530'. [ 392.406521][T24217] netlink: 'syz.1.8529': attribute type 2 has an invalid length. [ 392.545348][T24236] netlink: 284 bytes leftover after parsing attributes in process `syz.4.8535'. [ 392.652395][T24244] netlink: 2 bytes leftover after parsing attributes in process `syz.2.8540'. [ 393.051280][T24262] openvswitch: netlink: VXLAN extension message has 3 unknown bytes. [ 393.462197][T24277] netlink: 'syz.2.8556': attribute type 28 has an invalid length. [ 393.472878][T24277] netlink: 'syz.2.8556': attribute type 3 has an invalid length. [ 393.483031][T24277] netlink: 132 bytes leftover after parsing attributes in process `syz.2.8556'. [ 393.735540][T24295] netlink: 4 bytes leftover after parsing attributes in process `syz.4.8565'. [ 393.885812][T24306] bond0: option ad_user_port_key: mode dependency failed, not supported in mode balance-rr(0) [ 393.904462][T24306] bond0: option ad_user_port_key: mode dependency failed, not supported in mode balance-rr(0) [ 394.008575][T24311] netlink: 8 bytes leftover after parsing attributes in process `syz.4.8571'. [ 394.012848][T24314] netlink: 1036 bytes leftover after parsing attributes in process `syz.2.8572'. [ 394.027527][T24314] sch_tbf: burst 0 is lower than device lo mtu (81) ! [ 394.371210][T24340] netlink: 576 bytes leftover after parsing attributes in process `syz.4.8585'. [ 394.598741][T24352] netlink: 8 bytes leftover after parsing attributes in process `syz.4.8591'. [ 395.034822][T24384] openvswitch: netlink: IP tunnel attribute has 8 unknown bytes. [ 396.221259][T24459] __nla_validate_parse: 3 callbacks suppressed [ 396.221280][T24459] netlink: 212296 bytes leftover after parsing attributes in process `syz.1.8642'. [ 396.303272][T24465] netlink: 4 bytes leftover after parsing attributes in process `syz.0.8645'. [ 396.630175][T24486] netlink: 8 bytes leftover after parsing attributes in process `syz.0.8655'. [ 397.744971][T24562] netlink: 81 bytes leftover after parsing attributes in process `syz.1.8691'. [ 399.023759][T24626] dvmrp0: entered allmulticast mode [ 399.067720][T24626] dvmrp0: left allmulticast mode [ 399.073074][T24626] pimreg: left allmulticast mode [ 399.300286][T24641] block nbd1: Unsupported socket: shutdown callout must be supported. [ 399.361226][T24646] netlink: 212376 bytes leftover after parsing attributes in process `syz.0.8727'. [ 399.443591][T24650] netlink: 4 bytes leftover after parsing attributes in process `syz.1.8729'. [ 400.495910][T24726] netlink: 4 bytes leftover after parsing attributes in process `syz.0.8766'. [ 400.631926][ T5865] block nbd1: Receive control failed (result -32) [ 400.843348][T24750] netlink: 104 bytes leftover after parsing attributes in process `syz.0.8777'. [ 401.260579][T24773] netlink: 16 bytes leftover after parsing attributes in process `syz.3.8788'. [ 401.916147][T24817] netlink: 8 bytes leftover after parsing attributes in process `syz.2.8807'. [ 401.983296][T24821] netlink: 12 bytes leftover after parsing attributes in process `syz.1.8811'. [ 402.127414][T24831] netlink: 8 bytes leftover after parsing attributes in process `syz.1.8816'. [ 402.560324][T24862] netlink: 8 bytes leftover after parsing attributes in process `syz.2.8831'. [ 402.583419][T24864] netlink: 4 bytes leftover after parsing attributes in process `syz.1.8832'. [ 403.261224][T24907] netlink: 8 bytes leftover after parsing attributes in process `syz.3.8853'. [ 403.532658][T24927] openvswitch: netlink: VXLAN extension message has 4 unknown bytes. [ 403.866821][T24948] netlink: 88 bytes leftover after parsing attributes in process `syz.4.8872'. [ 403.893627][T24948] netem: invalid attributes len -24 [ 404.034144][T24960] netlink: 20 bytes leftover after parsing attributes in process `syz.4.8879'. [ 404.150817][T24968] netlink: 12 bytes leftover after parsing attributes in process `syz.1.8882'. [ 404.768646][T25012] openvswitch: netlink: IP tunnel attribute has 8 unknown bytes. [ 406.004922][T25093] netlink: 'syz.1.8942': attribute type 33 has an invalid length. [ 406.013439][T25093] (unnamed net_device) (uninitialized): option broadcast_neighbor: mode dependency failed, not supported in mode balance-rr(0) [ 406.129828][T25106] netlink: 'syz.3.8949': attribute type 6 has an invalid length. [ 406.314808][T25120] __nla_validate_parse: 7 callbacks suppressed [ 406.314826][T25120] netlink: 232 bytes leftover after parsing attributes in process `syz.3.8954'. [ 406.558318][ T30] audit: type=1804 audit(1758772182.246:5): pid=25134 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=open_writers comm="syz.2.8961" name="/newroot/1802/cgroup.controllers" dev="tmpfs" ino=9055 res=1 errno=0 [ 406.648205][ T30] audit: type=1800 audit(1758772182.246:6): pid=25134 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.2.8961" name="cgroup.controllers" dev="tmpfs" ino=9055 res=0 errno=0 [ 407.197244][T25165] netlink: 52 bytes leftover after parsing attributes in process `syz.4.8976'. [ 407.227828][T25168] openvswitch: netlink: Either Ethernet header or EtherType is required. [ 407.350069][T25175] netlink: 4 bytes leftover after parsing attributes in process `syz.0.8981'. [ 407.478829][T25181] netlink: 4 bytes leftover after parsing attributes in process `syz.0.8985'. [ 407.516893][T25183] netlink: 4 bytes leftover after parsing attributes in process `syz.3.8984'. [ 408.006857][T25218] netlink: 8 bytes leftover after parsing attributes in process `syz.3.9001'. [ 408.034768][T25218] vlan1: entered allmulticast mode [ 408.352938][T25245] netlink: 72 bytes leftover after parsing attributes in process `syz.2.9012'. [ 408.772706][T25268] netlink: 48 bytes leftover after parsing attributes in process `syz.0.9021'. [ 408.832159][T25272] sch_tbf: burst 8 is lower than device ip6tnl0 mtu (1452) ! [ 408.949542][T25277] netlink: 4 bytes leftover after parsing attributes in process `syz.3.9026'. [ 409.009122][T25280] netlink: 212376 bytes leftover after parsing attributes in process `syz.2.9028'. [ 409.038464][T25282] macvtap2: entered allmulticast mode [ 409.280249][ T8583] tipc: Subscription rejected, illegal request [ 409.309119][T25300] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 409.693745][T25324] : renamed from vlan0 [ 409.819523][T25332] sch_fq: defrate 0 ignored. [ 409.956770][T25335] nbd2: detected capacity change from 0 to 127 [ 409.987665][ T5865] block nbd2: Receive control failed (result -32) [ 410.001936][T25339] block nbd2: Dead connection, failed to find a fallback [ 410.026746][T25339] block nbd2: shutting down sockets [ 410.032471][T25339] I/O error, dev nbd2, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 410.050886][T25339] Buffer I/O error on dev nbd2, logical block 0, async page read [ 410.059262][T25339] I/O error, dev nbd2, sector 2 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 410.069964][T25339] Buffer I/O error on dev nbd2, logical block 1, async page read [ 410.077944][T25339] I/O error, dev nbd2, sector 4 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 410.092324][T25339] Buffer I/O error on dev nbd2, logical block 2, async page read [ 410.109781][T25339] I/O error, dev nbd2, sector 6 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 410.150675][T25339] Buffer I/O error on dev nbd2, logical block 3, async page read [ 410.170683][T25339] I/O error, dev nbd2, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 410.193678][T25339] Buffer I/O error on dev nbd2, logical block 0, async page read [ 410.216439][T25339] I/O error, dev nbd2, sector 2 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 410.225511][T25339] Buffer I/O error on dev nbd2, logical block 1, async page read [ 410.264303][T25339] I/O error, dev nbd2, sector 4 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 410.275359][T25339] Buffer I/O error on dev nbd2, logical block 2, async page read [ 410.306446][T25339] I/O error, dev nbd2, sector 6 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 410.332298][T25339] Buffer I/O error on dev nbd2, logical block 3, async page read [ 410.341463][T25339] I/O error, dev nbd2, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 410.363922][T25339] Buffer I/O error on dev nbd2, logical block 0, async page read [ 410.394201][T25339] I/O error, dev nbd2, sector 2 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 410.429359][T25339] Buffer I/O error on dev nbd2, logical block 1, async page read [ 410.450462][T25339] ldm_validate_partition_table(): Disk read failed. [ 410.459484][T25339] Dev nbd2: unable to read RDB block 0 [ 410.467177][T25339] nbd2: unable to read partition table [ 410.520806][T25339] ldm_validate_partition_table(): Disk read failed. [ 410.569723][T25339] Dev nbd2: unable to read RDB block 0 [ 410.614446][T25339] nbd2: unable to read partition table [ 410.826245][T25382] netlink: 'syz.2.9067': attribute type 1 has an invalid length. [ 411.033022][T25396] netlink: 'syz.2.9086': attribute type 4 has an invalid length. [ 411.424528][T25422] __nla_validate_parse: 3 callbacks suppressed [ 411.424547][T25422] netlink: 212376 bytes leftover after parsing attributes in process `syz.4.9096'. [ 412.197198][ T8583] tipc: Subscription rejected, illegal request [ 412.533618][T25501] netlink: 64 bytes leftover after parsing attributes in process `syz.4.9132'. [ 412.871490][T25532] netlink: 'syz.3.9141': attribute type 1 has an invalid length. [ 412.916348][T25532] netlink: 'syz.3.9141': attribute type 3 has an invalid length. [ 412.924127][T25532] netlink: 216 bytes leftover after parsing attributes in process `syz.3.9141'. [ 412.943510][T25532] NCSI netlink: No device for ifindex 813332851 [ 412.990659][T25538] netlink: 12 bytes leftover after parsing attributes in process `syz.1.9144'. [ 413.083968][T25543] netlink: 'syz.4.9146': attribute type 5 has an invalid length. [ 413.288015][T25555] sctp: [Deprecated]: syz.4.9152 (pid 25555) Use of struct sctp_assoc_value in delayed_ack socket option. [ 413.288015][T25555] Use struct sctp_sack_info instead [ 413.314649][T25558] Freezing with imperfect legacy cgroup freezer. See cgroup.freeze of cgroup v2 [ 414.229573][T25623] netlink: 108 bytes leftover after parsing attributes in process `syz.4.9183'. [ 414.240163][T25623] netlink: 8 bytes leftover after parsing attributes in process `syz.4.9183'. [ 414.414288][T25634] netlink: 12 bytes leftover after parsing attributes in process `syz.2.9188'. [ 415.583103][T25720] netlink: 24 bytes leftover after parsing attributes in process `syz.2.9228'. [ 415.615845][T25720] netlink: 24 bytes leftover after parsing attributes in process `syz.2.9228'. [ 415.820966][T25726] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 415.851068][T25726] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 416.307386][T25726] netdevsim netdevsim2 netdevsim0: left promiscuous mode [ 416.413461][T25726] geneve2: left promiscuous mode [ 416.531066][ T13] netdevsim netdevsim2 netdevsim0: unset [0, 0] type 1 family 0 port 8472 - 0 [ 416.551298][ T13] netdevsim netdevsim2 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 416.597747][ T13] netdevsim netdevsim2 netdevsim1: unset [0, 0] type 1 family 0 port 8472 - 0 [ 416.606853][ T13] netdevsim netdevsim2 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 416.656450][ T13] netdevsim netdevsim2 netdevsim2: unset [0, 0] type 1 family 0 port 8472 - 0 [ 416.673065][ T13] netdevsim netdevsim2 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 416.683199][ T13] netdevsim netdevsim2 netdevsim3: unset [0, 0] type 1 family 0 port 8472 - 0 [ 416.714268][ T13] netdevsim netdevsim2 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 416.884619][T25777] netlink: 'syz.3.9250': attribute type 4 has an invalid length. [ 417.106789][T25789] openvswitch: netlink: IPv4 tun info is not correct [ 417.684639][T25823] mac80211_hwsim hwsim3 wlan1: (WE) : Wireless Event (cmd=0x8B1A) too big (33) [ 418.067025][T25840] netlink: 56 bytes leftover after parsing attributes in process `syz.1.9277'. [ 418.121611][T25844] pim6reg1: entered promiscuous mode [ 418.128012][T25844] pim6reg1: entered allmulticast mode [ 418.311289][T25860] netlink: 'syz.0.9286': attribute type 1 has an invalid length. [ 418.320623][T25860] netlink: 'syz.0.9286': attribute type 10 has an invalid length. [ 418.328637][T25860] netlink: 'syz.0.9286': attribute type 4 has an invalid length. [ 418.339844][T25860] netlink: 136 bytes leftover after parsing attributes in process `syz.0.9286'. [ 418.640326][T25877] netlink: 'syz.2.9294': attribute type 29 has an invalid length. [ 418.649637][T25877] netlink: 'syz.2.9294': attribute type 29 has an invalid length. [ 418.794237][T25883] netlink: 'syz.0.9297': attribute type 2 has an invalid length. [ 418.921325][T25891] netlink: 36 bytes leftover after parsing attributes in process `syz.0.9299'. [ 419.239399][T25907] hsr0 speed is unknown, defaulting to 1000 [ 419.271301][T25907] hsr0 speed is unknown, defaulting to 1000 [ 419.288407][T25907] hsr0 speed is unknown, defaulting to 1000 [ 419.300237][T25907] iwpm_register_pid: Unable to send a nlmsg (client = 2) [ 419.340486][T25907] infiniband syz1: RDMA CMA: cma_listen_on_dev, error -98 [ 419.391841][T25907] hsr0 speed is unknown, defaulting to 1000 [ 419.401259][T25907] hsr0 speed is unknown, defaulting to 1000 [ 419.410780][T25907] hsr0 speed is unknown, defaulting to 1000 [ 419.420312][T25907] hsr0 speed is unknown, defaulting to 1000 [ 419.438275][T25907] hsr0 speed is unknown, defaulting to 1000 [ 419.705349][T25936] netlink: 12 bytes leftover after parsing attributes in process `syz.0.9318'. [ 419.710336][T25934] batman_adv: Cannot find parent device. Skipping batadv-on-batadv check for gretap1 [ 419.740385][T25934] gretap1: default qdisc (pfifo_fast) fail, fallback to noqueue [ 419.761456][T25934] gretap1: entered promiscuous mode [ 419.776090][T25934] gretap1: entered allmulticast mode [ 420.023770][T25954] netlink: 36 bytes leftover after parsing attributes in process `syz.0.9327'. [ 420.375184][T25978] netlink: 28 bytes leftover after parsing attributes in process `syz.4.9339'. [ 420.394573][T25978] netlink: 'syz.4.9339': attribute type 7 has an invalid length. [ 420.431965][T25978] netlink: 20 bytes leftover after parsing attributes in process `syz.4.9339'. [ 420.455547][T25981] netlink: 212376 bytes leftover after parsing attributes in process `syz.2.9340'. [ 420.623889][T25994] netlink: 14560 bytes leftover after parsing attributes in process `syz.2.9347'. [ 420.865763][T26009] nbd: nbd0 already in use [ 420.887579][T26009] block nbd0: NBD_DISCONNECT [ 420.892233][T26009] block nbd0: Send disconnect failed -32 [ 420.913561][T26009] block nbd0: shutting down sockets [ 420.926855][T26013] netlink: 4 bytes leftover after parsing attributes in process `syz.1.9355'. [ 421.274217][T26029] PF_CAN: dropped non conform CAN FD skbuff: dev type 65534, len 4032 [ 421.819878][T26052] netdevsim netdevsim1 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 421.835647][T26058] nbd: device at index 3 is going down [ 422.057446][T26070] sctp: [Deprecated]: syz.4.9373 (pid 26070) Use of int in max_burst socket option. [ 422.057446][T26070] Use struct sctp_assoc_value instead [ 422.102507][T25919] udevd[25919]: inotify_add_watch(7, /dev/nbd3, 10) failed: No such file or directory [ 422.136505][T26052] netdevsim netdevsim1 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 422.351341][T26052] netdevsim netdevsim1 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 422.503490][T26052] netdevsim netdevsim1 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 422.518205][T26093] netlink: 'syz.0.9381': attribute type 1 has an invalid length. [ 422.811945][ T8585] netdevsim netdevsim1 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 422.868841][ T8585] netdevsim netdevsim1 eth1: set [1, 0] type 2 family 0 port 6081 - 0 [ 422.901764][ T8585] netdevsim netdevsim1 eth2: set [1, 0] type 2 family 0 port 6081 - 0 [ 422.948438][ T8583] netdevsim netdevsim1 eth3: set [1, 0] type 2 family 0 port 6081 - 0 [ 423.333272][T26134] __nla_validate_parse: 5 callbacks suppressed [ 423.333289][T26134] netlink: 36 bytes leftover after parsing attributes in process `syz.3.9396'. [ 424.721676][ T5870] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 424.731886][ T5870] Bluetooth: hci4: unexpected cc 0x0c03 length: 249 > 1 [ 424.740231][ T5870] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 424.752014][ T5870] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 424.752171][T26178] Bluetooth: hci4: unexpected cc 0x1003 length: 249 > 9 [ 424.775865][ T5870] Bluetooth: hci4: unexpected cc 0x1001 length: 249 > 9 [ 424.783706][T26178] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 424.794182][ T5870] Bluetooth: hci4: unexpected cc 0x0c23 length: 249 > 4 [ 424.795194][T26178] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 424.809003][ T5870] Bluetooth: hci4: unexpected cc 0x0c38 length: 249 > 2 [ 425.373949][T26174] hsr0 speed is unknown, defaulting to 1000 [ 425.928380][T26174] chnl_net:caif_netlink_parms(): no params data found [ 425.978414][T26173] hsr0 speed is unknown, defaulting to 1000 [ 426.143689][T26244] netlink: 8 bytes leftover after parsing attributes in process `syz.2.9440'. [ 426.154065][T26244] netlink: 12 bytes leftover after parsing attributes in process `syz.2.9440'. [ 426.163162][T26244] netlink: 'syz.2.9440': attribute type 6 has an invalid length. [ 426.188923][T26174] bridge0: port 1(bridge_slave_0) entered blocking state [ 426.202400][T26174] bridge0: port 1(bridge_slave_0) entered disabled state [ 426.218802][T26174] bridge_slave_0: entered allmulticast mode [ 426.234043][T26174] bridge_slave_0: entered promiscuous mode [ 426.244523][T26174] bridge0: port 2(bridge_slave_1) entered blocking state [ 426.260309][T26174] bridge0: port 2(bridge_slave_1) entered disabled state [ 426.272748][T26174] bridge_slave_1: entered allmulticast mode [ 426.281489][T26174] bridge_slave_1: entered promiscuous mode [ 426.385521][T26174] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 426.414549][T26174] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 426.507611][T26174] team0: Port device team_slave_0 added [ 426.531972][T26174] team0: Port device team_slave_1 added [ 426.655814][T26174] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 426.663260][T26174] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 426.690748][T26174] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 426.710991][T26174] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 426.718399][T26174] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 426.751021][T26174] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 426.879323][T26173] chnl_net:caif_netlink_parms(): no params data found [ 426.896824][T26175] Bluetooth: hci4: command tx timeout [ 426.898140][T26178] Bluetooth: hci1: command tx timeout [ 426.908708][T26174] hsr_slave_0: entered promiscuous mode [ 426.915692][T26174] hsr_slave_1: entered promiscuous mode [ 426.930960][T26174] debugfs: 'hsr0' already exists in 'hsr' [ 426.936896][T26174] Cannot create hsr debugfs directory [ 427.360428][T26173] bridge0: port 1(bridge_slave_0) entered blocking state [ 427.371682][T26173] bridge0: port 1(bridge_slave_0) entered disabled state [ 427.381740][T26173] bridge_slave_0: entered allmulticast mode [ 427.394621][T26173] bridge_slave_0: entered promiscuous mode [ 427.415408][T26173] bridge0: port 2(bridge_slave_1) entered blocking state [ 427.430882][T26173] bridge0: port 2(bridge_slave_1) entered disabled state [ 427.439729][T26173] bridge_slave_1: entered allmulticast mode [ 427.452708][T26173] bridge_slave_1: entered promiscuous mode [ 427.561115][T26173] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 427.603820][T26173] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 427.670122][T26173] team0: Port device team_slave_0 added [ 427.682456][T26173] team0: Port device team_slave_1 added [ 427.724383][T26173] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 427.732119][T26173] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 427.758840][T26173] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 427.782876][T26173] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 427.790821][T26173] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 427.821384][T26173] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 427.947172][T26173] hsr_slave_0: entered promiscuous mode [ 427.953833][T26173] hsr_slave_1: entered promiscuous mode [ 427.960586][T26173] debugfs: 'hsr0' already exists in 'hsr' [ 427.966505][T26173] Cannot create hsr debugfs directory [ 427.991520][T26174] netdevsim netdevsim6 netdevsim0: renamed from eth0 [ 428.010386][T26174] netdevsim netdevsim6 netdevsim1: renamed from eth1 [ 428.040230][T26174] netdevsim netdevsim6 netdevsim2: renamed from eth2 [ 428.055378][T26174] netdevsim netdevsim6 netdevsim3: renamed from eth3 [ 428.324674][T26329] sctp: [Deprecated]: syz.3.9472 (pid 26329) Use of struct sctp_assoc_value in delayed_ack socket option. [ 428.324674][T26329] Use struct sctp_sack_info instead [ 428.696499][T26173] netdevsim netdevsim5 netdevsim0: renamed from eth0 [ 428.731224][T26173] netdevsim netdevsim5 netdevsim1: renamed from eth1 [ 428.815765][T26173] netdevsim netdevsim5 netdevsim2: renamed from eth2 [ 428.874586][T26173] netdevsim netdevsim5 netdevsim3: renamed from eth3 [ 428.976023][T26178] Bluetooth: hci4: command tx timeout [ 428.983207][T26174] 8021q: adding VLAN 0 to HW filter on device bond0 [ 428.991291][T26178] Bluetooth: hci1: command tx timeout [ 429.127498][T26174] 8021q: adding VLAN 0 to HW filter on device team0 [ 429.148545][ T8589] bridge0: port 1(bridge_slave_0) entered blocking state [ 429.156618][ T8589] bridge0: port 1(bridge_slave_0) entered forwarding state [ 429.178050][ T8589] bridge0: port 2(bridge_slave_1) entered blocking state [ 429.185194][ T8589] bridge0: port 2(bridge_slave_1) entered forwarding state [ 429.450957][T26173] 8021q: adding VLAN 0 to HW filter on device bond0 [ 429.517464][T26173] 8021q: adding VLAN 0 to HW filter on device team0 [ 429.535864][ T8583] bridge0: port 1(bridge_slave_0) entered blocking state [ 429.543056][ T8583] bridge0: port 1(bridge_slave_0) entered forwarding state [ 429.575319][ T8583] bridge0: port 2(bridge_slave_1) entered blocking state [ 429.582535][ T8583] bridge0: port 2(bridge_slave_1) entered forwarding state [ 429.837358][T26384] openvswitch: netlink: Either Ethernet header or EtherType is required. [ 429.979775][T26174] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 430.199328][T26173] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 430.735765][T26174] veth0_vlan: entered promiscuous mode [ 430.780621][T26174] veth1_vlan: entered promiscuous mode [ 430.924064][T26174] veth0_macvtap: entered promiscuous mode [ 430.954714][T26174] veth1_macvtap: entered promiscuous mode [ 431.011267][T26173] veth0_vlan: entered promiscuous mode [ 431.033205][T26174] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 431.043064][T26173] veth1_vlan: entered promiscuous mode [ 431.057932][T26178] Bluetooth: hci1: command tx timeout [ 431.057956][T26175] Bluetooth: hci4: command tx timeout [ 431.075746][T26174] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 431.103310][ T61] netdevsim netdevsim6 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 431.115794][ T61] netdevsim netdevsim6 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 431.135111][ T61] netdevsim netdevsim6 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 431.156207][ T61] netdevsim netdevsim6 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 431.280388][T26173] veth0_macvtap: entered promiscuous mode [ 431.305392][T26173] veth1_macvtap: entered promiscuous mode [ 431.401888][T26173] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 431.433363][ T13] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 431.462329][T26173] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 431.463486][ T13] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 431.513735][ T2995] netdevsim netdevsim5 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 431.524859][ T2995] netdevsim netdevsim5 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 431.555208][ T2995] netdevsim netdevsim5 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 431.564866][ T2995] netdevsim netdevsim5 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 431.580836][ T13] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 431.604332][ T13] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 431.776633][ T13] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 431.784475][ T13] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 431.879503][ T2995] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 431.911719][ T2995] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 431.995178][T26469] netlink: 8 bytes leftover after parsing attributes in process `syz.2.9521'. [ 432.075872][T26471] Bluetooth: MGMT ver 1.23 [ 432.095452][T26471] Bluetooth: hci1: expected 19 bytes, got 2 bytes [ 432.485021][T26493] netlink: 4 bytes leftover after parsing attributes in process `syz.2.9532'. [ 432.497231][T26495] netlink: 28 bytes leftover after parsing attributes in process `syz.3.9533'. [ 433.136559][T26175] Bluetooth: hci4: command tx timeout [ 433.137010][T26178] Bluetooth: hci1: command tx timeout [ 433.402277][T26537] netlink: 64 bytes leftover after parsing attributes in process `syz.6.9550'. [ 433.669845][T26548] netlink: 212376 bytes leftover after parsing attributes in process `syz.1.9556'. [ 433.834543][T26558] netlink: 32 bytes leftover after parsing attributes in process `syz.1.9561'. [ 434.277257][T26579] netlink: 84 bytes leftover after parsing attributes in process `syz.5.9568'. [ 434.686980][T26605] netlink: 28 bytes leftover after parsing attributes in process `syz.5.9583'. [ 434.704358][T26605] netlink: 'syz.5.9583': attribute type 7 has an invalid length. [ 434.712919][T26605] netlink: 'syz.5.9583': attribute type 8 has an invalid length. [ 434.724057][T26605] netlink: 4 bytes leftover after parsing attributes in process `syz.5.9583'. [ 434.775255][T26605] gretap0: entered promiscuous mode [ 434.833133][T26605] batadv_slave_1: entered promiscuous mode [ 434.845202][T26605] gretap0: left promiscuous mode [ 434.852156][T26605] batadv_slave_1: left promiscuous mode [ 435.173179][T26630] input: Bluetooth HID Boot Protocol Device as /devices/virtual/bluetooth/hci4/hci4:200/input5 [ 435.405118][T26640] netlink: 104 bytes leftover after parsing attributes in process `syz.5.9596'. [ 436.471324][T26671] netlink: 'syz.6.9610': attribute type 10 has an invalid length. [ 436.515884][T26671] team0: Device veth1_macvtap failed to register rx_handler [ 436.987743][T26696] veth0: entered promiscuous mode [ 437.006350][T26694] veth0: left promiscuous mode [ 437.145166][T26705] __nla_validate_parse: 1 callbacks suppressed [ 437.145183][T26705] netlink: 9 bytes leftover after parsing attributes in process `syz.6.9626'. [ 437.153080][T26706] netlink: 68 bytes leftover after parsing attributes in process `syz.2.9628'. [ 437.153102][T26706] netlink: 12 bytes leftover after parsing attributes in process `syz.2.9628'. [ 437.193004][T26705] gretap0: entered promiscuous mode [ 437.225043][T26710] netlink: 5 bytes leftover after parsing attributes in process `syz.6.9626'. [ 437.291974][T26710] 0{X: renamed from gretap0 [ 437.313801][T26710] 0{X: left promiscuous mode [ 437.319583][T26710] 0{X: entered allmulticast mode [ 437.328896][T26710] A link change request failed with some changes committed already. Interface 30{X may have been left with an inconsistent configuration, please check. [ 437.641950][T26728] pim6reg1: entered promiscuous mode [ 437.669984][T26728] pim6reg1: entered allmulticast mode [ 437.752380][T26730] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 437.924599][T26739] PF_CAN: dropped non conform CAN XL skbuff: dev type 65534, len 40 [ 438.395174][T26767] veth0: entered promiscuous mode [ 438.414274][T26766] veth0: left promiscuous mode [ 438.788024][T26784] IPVS: lblc: UDP 224.0.0.2:0 - no destination available [ 438.983751][T26801] netlink: 4 bytes leftover after parsing attributes in process `syz.6.9669'. [ 439.655344][T26838] syzkaller1: entered promiscuous mode [ 439.667671][T26838] syzkaller1: entered allmulticast mode [ 439.754644][T26843] af_packet: tpacket_rcv: packet too big, clamped from 39 to 4294967272. macoff=96 [ 440.201477][T26865] netlink: 20 bytes leftover after parsing attributes in process `syz.1.9699'. [ 440.333728][T26871] syzkaller1: entered promiscuous mode [ 440.383305][T26871] syzkaller1: entered allmulticast mode [ 440.610502][T26886] veth0: entered promiscuous mode [ 440.637880][T26884] veth0: left promiscuous mode [ 440.932991][T26903] netlink: 212376 bytes leftover after parsing attributes in process `syz.6.9717'. [ 442.237398][T26971] netlink: 20 bytes leftover after parsing attributes in process `syz.3.9744'. [ 442.310019][T26972] syzkaller1: entered promiscuous mode [ 442.323141][T26972] syzkaller1: entered allmulticast mode [ 442.462653][T26984] openvswitch: netlink: VXLAN extension 1 has unexpected len 0 expected 4 [ 443.252567][ T5928] hid (null): unknown global tag 0xe [ 443.260854][T27019] netlink: 76 bytes leftover after parsing attributes in process `syz.1.9763'. [ 443.278759][ T5928] hid (null): nested delimiters [ 443.758456][T27038] netlink: 28 bytes leftover after parsing attributes in process `syz.1.9771'. [ 443.778311][T27038] netlink: 'syz.1.9771': attribute type 7 has an invalid length. [ 443.826769][T27038] netlink: 'syz.1.9771': attribute type 8 has an invalid length. [ 443.877177][T27038] netlink: 4 bytes leftover after parsing attributes in process `syz.1.9771'. [ 443.911966][T27042] tipc: Enabled bearer , priority 10 [ 443.996542][T27046] netlink: 'syz.6.9774': attribute type 16 has an invalid length. [ 443.999221][T27044] bridge0: port 1(bridge_slave_0) entered disabled state [ 444.040646][T27046] netlink: 'syz.6.9774': attribute type 17 has an invalid length. [ 444.069018][T27044] bridge0: port 2(bridge_slave_1) entered disabled state [ 444.144619][T27046] 0{X: left allmulticast mode [ 444.186642][T27046] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 445.293109][T27106] netlink: 'syz.1.9801': attribute type 39 has an invalid length. [ 445.458057][ T5913] IPVS: starting estimator thread 0... [ 445.547901][T27114] IPVS: using max 29 ests per chain, 69600 per kthread [ 445.807612][T27130] netlink: 212376 bytes leftover after parsing attributes in process `syz.1.9812'. [ 445.981102][ T5928] hid-generic 0005:0D45:1012.0001: unknown global tag 0xe [ 446.018997][ T5928] hid-generic 0005:0D45:1012.0001: item 0 2 1 14 parsing failed [ 446.038900][ T5928] hid-generic 0005:0D45:1012.0001: probe with driver hid-generic failed with error -22 [ 446.045104][T27140] netlink: 20 bytes leftover after parsing attributes in process `syz.6.9817'. [ 446.075178][T27142] openvswitch: netlink: IPv4 tun info is not correct [ 447.050588][T27183] netlink: 12 bytes leftover after parsing attributes in process `syz.1.9835'. [ 447.076036][T27183] netlink: 12 bytes leftover after parsing attributes in process `syz.1.9835'. [ 447.085013][T27183] netlink: 50 bytes leftover after parsing attributes in process `syz.1.9835'. [ 447.316385][T27197] netlink: 4 bytes leftover after parsing attributes in process `syz.2.9841'. [ 447.623406][T27213] netlink: 8 bytes leftover after parsing attributes in process `syz.1.9849'. [ 447.648662][T27213] netlink: 4 bytes leftover after parsing attributes in process `syz.1.9849'. [ 447.658392][T27213] netlink: 'syz.1.9849': attribute type 11 has an invalid length. [ 447.948418][T27226] syzkaller1: entered promiscuous mode [ 447.958619][T27226] syzkaller1: entered allmulticast mode [ 448.051677][T27231] netlink: 212376 bytes leftover after parsing attributes in process `syz.3.9856'. [ 448.283799][T27241] netlink: 8 bytes leftover after parsing attributes in process `syz.5.9862'. [ 448.372924][T27247] netlink: 212376 bytes leftover after parsing attributes in process `syz.3.9864'. [ 448.399828][T27249] IPVS: Schedule: port zero only supported in persistent services, check your ipvs configuration [ 448.412692][T27249] IPVS: Schedule: port zero only supported in persistent services, check your ipvs configuration [ 448.487940][T27241] netlink: 'syz.5.9862': attribute type 1 has an invalid length. [ 448.519284][T27241] netlink: 'syz.5.9862': attribute type 2 has an invalid length. [ 448.616982][T27255] netlink: 'syz.2.9868': attribute type 11 has an invalid length. [ 448.777272][T27265] netlink: 8 bytes leftover after parsing attributes in process `syz.6.9872'. [ 448.931661][T27264] tipc: Disabling bearer [ 448.952648][ T2995] smc: removing ib device syz2 [ 448.998872][T27265] macvlan0: entered promiscuous mode [ 449.005273][T27265] batadv_slave_0: entered promiscuous mode [ 449.015344][T27265] debugfs: 'hsr1' already exists in 'hsr' [ 449.028620][T27265] Cannot create hsr debugfs directory [ 449.034226][T27257] netlink: 48 bytes leftover after parsing attributes in process `syz.5.9870'. [ 449.272789][T27271] team0 (unregistering): Port device team_slave_0 removed [ 449.289591][T27271] team0 (unregistering): Port device team_slave_1 removed [ 449.352230][ T5928] ================================================================== [ 449.360331][ T5928] BUG: KASAN: slab-use-after-free in __ethtool_get_link_ksettings+0x6e/0x190 [ 449.369097][ T5928] Read of size 8 at addr ffff88807dfa22e8 by task kworker/1:4/5928 [ 449.376978][ T5928] [ 449.379292][ T5928] CPU: 1 UID: 0 PID: 5928 Comm: kworker/1:4 Not tainted syzkaller #0 PREEMPT(full) [ 449.379309][ T5928] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/18/2025 [ 449.379320][ T5928] Workqueue: events smc_ib_port_event_work [ 449.379345][ T5928] Call Trace: [ 449.379352][ T5928] [ 449.379359][ T5928] dump_stack_lvl+0x189/0x250 [ 449.379376][ T5928] ? rcu_is_watching+0x15/0xb0 [ 449.379389][ T5928] ? __kasan_check_byte+0x12/0x40 [ 449.379408][ T5928] ? __pfx_dump_stack_lvl+0x10/0x10 [ 449.379422][ T5928] ? rcu_is_watching+0x15/0xb0 [ 449.379434][ T5928] ? lock_release+0x4b/0x3e0 [ 449.379453][ T5928] ? __virt_addr_valid+0x1c8/0x5c0 [ 449.379469][ T5928] ? __virt_addr_valid+0x4a5/0x5c0 [ 449.379485][ T5928] print_report+0xca/0x240 [ 449.379498][ T5928] ? __ethtool_get_link_ksettings+0x6e/0x190 [ 449.379514][ T5928] kasan_report+0x118/0x150 [ 449.379532][ T5928] ? __ethtool_get_link_ksettings+0x6e/0x190 [ 449.379550][ T5928] __ethtool_get_link_ksettings+0x6e/0x190 [ 449.379568][ T5928] ib_get_eth_speed+0x15e/0x7b0 [ 449.379586][ T5928] ? __pfx_ib_get_eth_speed+0x10/0x10 [ 449.379604][ T5928] ? do_raw_spin_unlock+0x122/0x240 [ 449.379623][ T5928] rxe_query_port+0x93/0x3b0 [ 449.379638][ T5928] ib_query_port+0x16d/0x830 [ 449.379656][ T5928] smc_ib_port_event_work+0x15a/0x940 [ 449.379678][ T5928] ? _raw_spin_unlock_irq+0x23/0x50 [ 449.379691][ T5928] ? process_scheduled_works+0x9ef/0x17b0 [ 449.379703][ T5928] ? process_scheduled_works+0x9ef/0x17b0 [ 449.379717][ T5928] process_scheduled_works+0xae1/0x17b0 [ 449.379739][ T5928] ? __pfx_process_scheduled_works+0x10/0x10 [ 449.379759][ T5928] worker_thread+0x8a0/0xda0 [ 449.379774][ T5928] ? __pfx__raw_spin_unlock_irqrestore+0x10/0x10 [ 449.379795][ T5928] ? __kthread_parkme+0x7b/0x200 [ 449.379812][ T5928] kthread+0x70e/0x8a0 [ 449.379828][ T5928] ? __pfx_worker_thread+0x10/0x10 [ 449.379841][ T5928] ? __pfx_kthread+0x10/0x10 [ 449.379856][ T5928] ? _raw_spin_unlock_irq+0x23/0x50 [ 449.379868][ T5928] ? lockdep_hardirqs_on+0x9c/0x150 [ 449.379881][ T5928] ? __pfx_kthread+0x10/0x10 [ 449.379896][ T5928] ret_from_fork+0x439/0x7d0 [ 449.379911][ T5928] ? __pfx_ret_from_fork+0x10/0x10 [ 449.379926][ T5928] ? __switch_to_asm+0x39/0x70 [ 449.379941][ T5928] ? __switch_to_asm+0x33/0x70 [ 449.379956][ T5928] ? __pfx_kthread+0x10/0x10 [ 449.379971][ T5928] ret_from_fork_asm+0x1a/0x30 [ 449.379992][ T5928] [ 449.380002][ T5928] [ 449.612430][ T5928] Allocated by task 5868: [ 449.616737][ T5928] kasan_save_track+0x3e/0x80 [ 449.621399][ T5928] __kasan_kmalloc+0x93/0xb0 [ 449.625971][ T5928] __kvmalloc_node_noprof+0x30d/0x5f0 [ 449.631335][ T5928] alloc_netdev_mqs+0xa3/0x11b0 [ 449.636165][ T5928] rtnl_create_link+0x31f/0xd10 [ 449.641000][ T5928] rtnl_newlink_create+0x25c/0xb00 [ 449.646089][ T5928] rtnl_newlink+0x16d6/0x1c70 [ 449.650745][ T5928] rtnetlink_rcv_msg+0x7cf/0xb70 [ 449.655661][ T5928] netlink_rcv_skb+0x208/0x470 [ 449.660402][ T5928] netlink_unicast+0x82f/0x9e0 [ 449.665152][ T5928] netlink_sendmsg+0x805/0xb30 [ 449.669893][ T5928] __sock_sendmsg+0x219/0x270 [ 449.674553][ T5928] __sys_sendto+0x3bd/0x520 [ 449.679032][ T5928] __x64_sys_sendto+0xde/0x100 [ 449.683775][ T5928] do_syscall_64+0xfa/0x3b0 [ 449.688255][ T5928] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 449.694124][ T5928] [ 449.696429][ T5928] Freed by task 27264: [ 449.700468][ T5928] kasan_save_track+0x3e/0x80 [ 449.705124][ T5928] kasan_save_free_info+0x46/0x50 [ 449.710128][ T5928] __kasan_slab_free+0x5b/0x80 [ 449.714876][ T5928] kfree+0x18e/0x440 [ 449.718750][ T5928] device_release+0x9c/0x1c0 [ 449.723321][ T5928] kobject_put+0x22b/0x480 [ 449.727726][ T5928] netdev_run_todo+0xd2e/0xea0 [ 449.732494][ T5928] rtnl_dellink+0x537/0x710 [ 449.736983][ T5928] rtnetlink_rcv_msg+0x7cf/0xb70 [ 449.741914][ T5928] netlink_rcv_skb+0x208/0x470 [ 449.746664][ T5928] netlink_unicast+0x82f/0x9e0 [ 449.751417][ T5928] netlink_sendmsg+0x805/0xb30 [ 449.756166][ T5928] __sock_sendmsg+0x219/0x270 [ 449.760838][ T5928] ____sys_sendmsg+0x505/0x830 [ 449.765584][ T5928] ___sys_sendmsg+0x21f/0x2a0 [ 449.770241][ T5928] __x64_sys_sendmsg+0x19b/0x260 [ 449.775161][ T5928] do_syscall_64+0xfa/0x3b0 [ 449.779645][ T5928] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 449.785516][ T5928] [ 449.787822][ T5928] The buggy address belongs to the object at ffff88807dfa2000 [ 449.787822][ T5928] which belongs to the cache kmalloc-cg-4k of size 4096 [ 449.802112][ T5928] The buggy address is located 744 bytes inside of [ 449.802112][ T5928] freed 4096-byte region [ffff88807dfa2000, ffff88807dfa3000) [ 449.815974][ T5928] [ 449.818287][ T5928] The buggy address belongs to the physical page: [ 449.824687][ T5928] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x7dfa0 [ 449.833431][ T5928] head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 449.841909][ T5928] flags: 0xfff00000000040(head|node=0|zone=1|lastcpupid=0x7ff) [ 449.849431][ T5928] page_type: f5(slab) [ 449.853397][ T5928] raw: 00fff00000000040 ffff88801a44b500 dead000000000122 0000000000000000 [ 449.861960][ T5928] raw: 0000000000000000 0000000000040004 00000000f5000000 0000000000000000 [ 449.870526][ T5928] head: 00fff00000000040 ffff88801a44b500 dead000000000122 0000000000000000 [ 449.879180][ T5928] head: 0000000000000000 0000000000040004 00000000f5000000 0000000000000000 [ 449.887830][ T5928] head: 00fff00000000003 ffffea0001f7e801 00000000ffffffff 00000000ffffffff [ 449.896478][ T5928] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000008 [ 449.905119][ T5928] page dumped because: kasan: bad access detected [ 449.911515][ T5928] page_owner tracks the page as allocated [ 449.917206][ T5928] page last allocated via order 3, migratetype Unmovable, gfp_mask 0xd60c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_RETRY_MAYFAIL|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 5867, tgid 5867 (syz-executor), ts 76881920457, free_ts 76732235202 [ 449.940279][ T5928] post_alloc_hook+0x240/0x2a0 [ 449.945032][ T5928] get_page_from_freelist+0x21e4/0x22c0 [ 449.950555][ T5928] __alloc_frozen_pages_noprof+0x181/0x370 [ 449.956340][ T5928] alloc_pages_mpol+0x232/0x4a0 [ 449.961180][ T5928] allocate_slab+0x8a/0x370 [ 449.965660][ T5928] ___slab_alloc+0xbeb/0x1420 [ 449.970321][ T5928] __kvmalloc_node_noprof+0x429/0x5f0 [ 449.975676][ T5928] veth_dev_init+0x363/0x570 [ 449.980242][ T5928] register_netdevice+0x6bf/0x1ae0 [ 449.985335][ T5928] veth_newlink+0x42f/0xa50 [ 449.989812][ T5928] rtnl_newlink_create+0x310/0xb00 [ 449.994902][ T5928] rtnl_newlink+0x16d6/0x1c70 [ 449.999556][ T5928] rtnetlink_rcv_msg+0x7cf/0xb70 [ 450.004473][ T5928] netlink_rcv_skb+0x208/0x470 [ 450.009214][ T5928] netlink_unicast+0x82f/0x9e0 [ 450.013965][ T5928] netlink_sendmsg+0x805/0xb30 [ 450.018712][ T5928] page last free pid 5858 tgid 5858 stack trace: [ 450.025012][ T5928] __free_frozen_pages+0xbc4/0xd30 [ 450.030107][ T5928] __put_partials+0x156/0x1a0 [ 450.034761][ T5928] put_cpu_partial+0x17c/0x250 [ 450.039506][ T5928] __slab_free+0x2d5/0x3c0 [ 450.043905][ T5928] qlist_free_all+0x97/0x140 [ 450.048473][ T5928] kasan_quarantine_reduce+0x148/0x160 [ 450.053912][ T5928] __kasan_slab_alloc+0x22/0x80 [ 450.058746][ T5928] __kmalloc_cache_noprof+0x1be/0x3d0 [ 450.064100][ T5928] ____ip_mc_inc_group+0x528/0xde0 [ 450.069191][ T5928] ip_mc_up+0x125/0x300 [ 450.073327][ T5928] inetdev_event+0xfb3/0x15b0 [ 450.077989][ T5928] notifier_call_chain+0x1b3/0x3e0 [ 450.083079][ T5928] __dev_notify_flags+0x18d/0x2e0 [ 450.088084][ T5928] rtnl_newlink_create+0x61c/0xb00 [ 450.093177][ T5928] rtnl_newlink+0x16d6/0x1c70 [ 450.097865][ T5928] rtnetlink_rcv_msg+0x7cf/0xb70 [ 450.102796][ T5928] [ 450.105102][ T5928] Memory state around the buggy address: [ 450.110714][ T5928] ffff88807dfa2180: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 450.118762][ T5928] ffff88807dfa2200: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 450.126804][ T5928] >ffff88807dfa2280: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 450.134842][ T5928] ^ [ 450.142271][ T5928] ffff88807dfa2300: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 450.150313][ T5928] ffff88807dfa2380: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 450.158351][ T5928] ================================================================== [ 450.271829][ T5928] Kernel panic - not syncing: KASAN: panic_on_warn set ... [ 450.279062][ T5928] CPU: 1 UID: 0 PID: 5928 Comm: kworker/1:4 Not tainted syzkaller #0 PREEMPT(full) [ 450.288432][ T5928] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/18/2025 [ 450.298490][ T5928] Workqueue: events smc_ib_port_event_work [ 450.304312][ T5928] Call Trace: [ 450.307585][ T5928] [ 450.310508][ T5928] dump_stack_lvl+0x99/0x250 [ 450.315100][ T5928] ? __asan_memcpy+0x40/0x70 [ 450.319687][ T5928] ? __pfx_dump_stack_lvl+0x10/0x10 [ 450.324883][ T5928] ? __pfx__printk+0x10/0x10 [ 450.329484][ T5928] vpanic+0x281/0x750 [ 450.333468][ T5928] ? preempt_schedule+0xae/0xc0 [ 450.338315][ T5928] ? __pfx_vpanic+0x10/0x10 [ 450.342811][ T5928] ? preempt_schedule_common+0x83/0xd0 [ 450.348266][ T5928] ? preempt_schedule+0xae/0xc0 [ 450.353115][ T5928] ? __pfx_preempt_schedule+0x10/0x10 [ 450.358497][ T5928] panic+0xb9/0xc0 [ 450.362216][ T5928] ? __pfx_panic+0x10/0x10 [ 450.366627][ T5928] ? _raw_spin_unlock_irqrestore+0xfd/0x110 [ 450.372516][ T5928] ? __ethtool_get_link_ksettings+0x6e/0x190 [ 450.378495][ T5928] check_panic_on_warn+0x89/0xb0 [ 450.383436][ T5928] ? __ethtool_get_link_ksettings+0x6e/0x190 [ 450.389417][ T5928] end_report+0x78/0x160 [ 450.393658][ T5928] kasan_report+0x129/0x150 [ 450.398161][ T5928] ? __ethtool_get_link_ksettings+0x6e/0x190 [ 450.404141][ T5928] __ethtool_get_link_ksettings+0x6e/0x190 [ 450.409957][ T5928] ib_get_eth_speed+0x15e/0x7b0 [ 450.414807][ T5928] ? __pfx_ib_get_eth_speed+0x10/0x10 [ 450.420177][ T5928] ? do_raw_spin_unlock+0x122/0x240 [ 450.425374][ T5928] rxe_query_port+0x93/0x3b0 [ 450.429965][ T5928] ib_query_port+0x16d/0x830 [ 450.434563][ T5928] smc_ib_port_event_work+0x15a/0x940 [ 450.439953][ T5928] ? _raw_spin_unlock_irq+0x23/0x50 [ 450.445148][ T5928] ? process_scheduled_works+0x9ef/0x17b0 [ 450.450864][ T5928] ? process_scheduled_works+0x9ef/0x17b0 [ 450.456579][ T5928] process_scheduled_works+0xae1/0x17b0 [ 450.462130][ T5928] ? __pfx_process_scheduled_works+0x10/0x10 [ 450.468111][ T5928] worker_thread+0x8a0/0xda0 [ 450.472698][ T5928] ? __pfx__raw_spin_unlock_irqrestore+0x10/0x10 [ 450.479032][ T5928] ? __kthread_parkme+0x7b/0x200 [ 450.483978][ T5928] kthread+0x70e/0x8a0 [ 450.488046][ T5928] ? __pfx_worker_thread+0x10/0x10 [ 450.493159][ T5928] ? __pfx_kthread+0x10/0x10 [ 450.497760][ T5928] ? _raw_spin_unlock_irq+0x23/0x50 [ 450.502958][ T5928] ? lockdep_hardirqs_on+0x9c/0x150 [ 450.508155][ T5928] ? __pfx_kthread+0x10/0x10 [ 450.512754][ T5928] ret_from_fork+0x439/0x7d0 [ 450.517349][ T5928] ? __pfx_ret_from_fork+0x10/0x10 [ 450.522458][ T5928] ? __switch_to_asm+0x39/0x70 [ 450.527224][ T5928] ? __switch_to_asm+0x33/0x70 [ 450.531991][ T5928] ? __pfx_kthread+0x10/0x10 [ 450.536586][ T5928] ret_from_fork_asm+0x1a/0x30 [ 450.541356][ T5928] [ 450.544647][ T5928] Kernel Offset: disabled [ 450.548952][ T5928] Rebooting in 86400 seconds..