last executing test programs: 4.233155588s ago: executing program 0 (id=2620): r0 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000240), 0xffffffffffffffff) sendmsg$NL80211_CMD_REGISTER_FRAME(0xffffffffffffffff, &(0x7f0000000380)={&(0x7f0000000180), 0xc, &(0x7f0000000300)={&(0x7f00000006c0)={0x118, r0, 0x300, 0x70bd29, 0x25dfdbfd, {{}, {@void, @val={0xc, 0x99, {0x2}}}}, [@NL80211_ATTR_FRAME_MATCH={0xee, 0x5b, "5176d02e67b202575b96fdc26993d9017d61c5e1e7b9228b78a808d2358b1013c87a7ee15826a18c16bef58a14d74d35dc16234d2f5a92332d775efc2d75c50a291931564052d237e42ee97896f6a14b27ea2815a1414b88c9d3341604af06c5f7ccb4b65f7a9802948aa8599ba918bb12ddf3008d3b1cd8697ca33749e774c84f1b08f9fdccbf7c740df3a091a50dc1ef21118f8dbeddfbbd6d23701df0b379bd66e959f0aae745c5c782e820a4dc5629b949616eea5b6b88c59b6ff4e15d915837e134c139c0a2404550ee5cee2f5deeed1093410e5e64500343b3036398a853e248f39b257dbc4568"}, @NL80211_ATTR_FRAME_TYPE={0x6, 0x65, 0x1}]}, 0x118}, 0x1, 0x0, 0x0, 0x20000800}, 0x0) socket$packet(0x11, 0x3, 0x300) socket$nl_route(0x10, 0x3, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) syz_init_net_socket$ax25(0x3, 0x3, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff}) pipe(&(0x7f0000000080)) pipe(&(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) bpf$PROG_LOAD(0x5, &(0x7f0000000800)={0x11, 0x0, 0x0, &(0x7f0000000280)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, r2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0xfffffffffffffd40) socket$vsock_stream(0x28, 0x1, 0x0) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) syz_init_net_socket$ax25(0x3, 0x3, 0xcf) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f000000c2c0)={0x0, 0x0, 0x0}, 0x0) r3 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xb, &(0x7f0000000440)=ANY=[@ANYBLOB="18000000000000000000000000000000180100002020702500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000083850000007100000095"], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000540)={&(0x7f0000000140)='sched_switch\x00', r3}, 0x18) unshare(0x6a040000) r4 = socket(0xa, 0x3, 0x3a) setsockopt$MRT6_ADD_MFC(r4, 0x29, 0xcc, &(0x7f0000000000)={{0xa, 0x0, 0x0, @private2={0xfc, 0x2, '\x00', 0x1}, 0x809}, {0xa, 0x8, 0x0, @empty}, 0x2, {[0x0, 0x1, 0xfffffffe, 0x0, 0xffffffff, 0x8]}}, 0x5c) setsockopt$MRT6_ADD_MFC(r4, 0x29, 0xcc, &(0x7f0000000280)={{0xa, 0x0, 0x0, @loopback}, {0xa, 0x0, 0x0, @mcast2}, 0x0, {[0x1, 0x0, 0x0, 0x0, 0x9]}}, 0x5c) setsockopt$MRT6_ADD_MFC(r4, 0x29, 0xcc, &(0x7f00000001c0)={{0xa, 0x0, 0x0, @remote}, {0xa, 0x4e22, 0x0, @mcast1}}, 0x5c) setsockopt$MRT6_ADD_MFC(r4, 0x29, 0xcc, &(0x7f0000000000)={{0xa, 0x0, 0x0, @private2}, {0xa, 0x0, 0x0, @empty}, 0x0, {[0x0, 0x0, 0x0, 0x0, 0x89f, 0x10000]}}, 0x5c) r5 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl802154(0x0, r5) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x81) socketpair$tipc(0x1e, 0x2, 0x0, &(0x7f0000000000)) setsockopt$MRT6_FLUSH(r4, 0x29, 0xd4, &(0x7f0000000340)=0x6, 0x4) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000001300)={0xffffffffffffffff, 0xffffffffffffffff}) r7 = socket(0x10, 0x3, 0x0) sendmsg$nl_route(r7, &(0x7f0000000900)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000040)=ANY=[@ANYBLOB="4400000010000304016100"/20, @ANYRES32=0x0, @ANYBLOB="d3ddd1de00000000140012800b0001006d616373656300000400028008000500", @ANYRES32=r6, @ANYRES32=r1], 0x44}, 0x1, 0x0, 0x0, 0x20000000}, 0x0) 3.491943697s ago: executing program 0 (id=2628): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000340)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0) sendmsg$NFT_BATCH(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000003c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a64000000060a0b04000000000000000002000004380004803400018009000100686173680000000024000280080007400000000108000440fdfffff70800024000000010080006402f0000080900010073797a30000000000900020073797a32"], 0x8c}}, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) ioctl$ifreq_SIOCGIFINDEX_vcan(0xffffffffffffffff, 0x8933, 0x0) setsockopt$IPT_SO_SET_REPLACE(0xffffffffffffffff, 0x0, 0x40, &(0x7f0000000000)=@filter={'filter\x00', 0x42, 0x4, 0x2b0, 0xffffffff, 0xb0, 0x0, 0x0, 0xffffffff, 0xffffffff, 0x2d8, 0x2d8, 0x2d8, 0xffffffff, 0x4, 0x0, {[{{@uncond, 0x0, 0x70, 0xb0, 0x0, {0x100000000000000}}, @common=@unspec=@RATEEST={0x40, 'RATEEST\x00', 0x0, {'syz0\x00', 0x0, 0x9}}}, {{@uncond, 0x0, 0x70, 0xd0}, @common=@CLUSTERIP={0x60, 'CLUSTERIP\x00', 0x0, {0x0, @remote, 0x4ca, 0xb, [0x10, 0x2a, 0x36, 0xe, 0x7, 0xf, 0xb, 0x22, 0x39, 0x12, 0x17, 0x36, 0x6, 0xe, 0xa, 0x10], 0x0, 0xb, 0x681}}}, {{@ip={@remote, @initdev={0xac, 0x1e, 0x0, 0x0}, 0x0, 0x0, 'wlan1\x00', 'pim6reg1\x00', {0xff}}, 0x0, 0x70, 0x98}, @REJECT={0x28}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x310) r2 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCBRDELBR(r2, 0x89a2, 0x0) sendmsg$netlink(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f00000001c0)={0x114, 0x2d, 0x1, 0x0, 0x0, "", [@nested={0x104, 0x0, 0x0, 0x1, [@typed={0xc, 0x0, 0x0, 0x0, @u64}, @typed={0x14, 0x1, 0x0, 0x0, @ipv6=@loopback={0x100000000000000}}, @generic="50bb2d6f67d29d6fabadb107d0def49c88ea04abde1d5e8d3fb22a1b5046778bdafefc46b0449ade68bf84b36ec72dd71265fc2e882348c26c2126237dd5b37f5ae655b1086cda40e00aec58754734be31d750351dc076eb43d9621dc08c029d1608a487f26fbe816b89f7cb81bff81a8b9482565856555ee923c65973deb0a99b962bc0fe94a3fcae3697bd7b85b3a682167c43dbf137115a40ebddcad74875ec58e9a3ddb9ad02a078cf0d972df9e99f079767734f69ce475f55ac64337803f5eb4e5842f4d98fe3fa370d47eb640dc5061dc35817c8a66c29be82fd3f8cd1"]}]}, 0x114}], 0x1}, 0x0) socket$igmp6(0xa, 0x3, 0x2) syz_extract_tcp_res(&(0x7f0000000380)={0x41424344}, 0x0, 0x10000) syz_emit_ethernet(0x52, &(0x7f0000000080)={@broadcast, @local, @void, {@ipv6={0x86dd, @tcp={0x0, 0x6, "101040", 0x1c, 0x6, 0x0, @ipv4={'\x00', '\xff\xff', @multicast2}, @local, {[], {{0x0, 0x4e22, 0x41424344, r3, 0x0, 0x2, 0x7, 0x70, 0x0, 0x0, 0x0, {[@exp_smc={0xfe, 0x6}]}}}}}}}}, 0x0) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) r5 = socket$inet_mptcp(0x2, 0x1, 0x106) setsockopt$inet_tcp_int(r5, 0x6, 0x19, 0x0, 0x0) sendmmsg$inet(r5, &(0x7f0000004980)=[{{&(0x7f0000000100)={0x2, 0x4e24, @loopback}, 0x10, &(0x7f0000000140)=[{0x0}], 0x1}}], 0x1, 0x2000c000) socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$ethtool(&(0x7f0000000080), 0xffffffffffffffff) bind$inet(r5, 0x0, 0x0) setsockopt$inet_tcp_TLS_TX(r5, 0x6, 0xc, &(0x7f0000000000)=@ccm_128={{0x304}, "9effe4ad99f7008e", "4d1a267a1d8fa8f4fd9b7eb99e785f84", "799a0e39", "a5e77b58ffac206a"}, 0x28) sendmsg$IPSET_CMD_ADD(r4, &(0x7f00000002c0)={0x0, 0x4001, &(0x7f0000000240)={&(0x7f0000000300)=ANY=[@ANYBLOB="50000000090601020000000000000000020000840900020073797a31000000000500010007000000280007800c00018008000140fffffff70500070084000000060004404e22000006000540"], 0x50}, 0x1, 0x0, 0x0, 0x10000082}, 0x80) r6 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r6, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000000)=ANY=[@ANYBLOB="140000001000010000000000000000000000000ae8000000000a01010000000000000000050000000900010073797a3000000000ba000600e9eec003775c64e64f439fc0b5fb34bcd039590bba579a25436e11f718b64e3e01796b9e930a3d8eefa0bccf8429a311f3ce5ec5a0a7bb9e08c60e03cbcdd726725fb9b1bd1000cf2a77ab6ab91f2294632773ea59b8de2361cdd8045c5fdb81611e843cb814e4cfe672542287ebd3b2ed48dca1a08690b05bb9bbbcc05551bd05e4c6e0625fcae04323e0f29dbad3c57456d2ca020462188e1236ebe6da1442c71ab0a8ebfaacef2710111417370a0f8cd19c5f9e1a00000900010073797a300000000014010000030a01030000000000000000050000000900010073797a30000000000800054000000000af000c008451bef8928cf9ec5c3c0fca5cedf6b9ae811484cd4abbaec9eba3118a64f7b105ab0e5c8e377ddaf98490703415da6a50c72a1434c93ef4daa32cd2b643c4ab99e8adc29f67b58cd27b71b30213e6acd60b8fa2190c3fd64f382e41b97f4b12379ce9470cbfdb02cc2a2d8e0e7aec144e2df705b37b99cafc9b141b0f3176897eba9802e14cc423ecff994b4ff320f5786bd4fba343449446d922b94ac3f8621197db4c2dc061e9278f5a000900030073797a32000000000b00070066696c746572000024000480080002406b10a6210800014000000004080002404e73b858080001400000000014000000020a030000000000000000000500000014000000110001"], 0x238}}, 0x0) close(r6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x22051, r1, 0x0) 2.489328432s ago: executing program 0 (id=2640): socket$packet(0x11, 0x2, 0x300) socket$inet6_sctp(0xa, 0x1, 0x84) socket$inet_udp(0x2, 0x2, 0x0) socket(0x10, 0x3, 0x0) syz_init_net_socket$802154_raw(0x24, 0x3, 0x0) socket$inet6_sctp(0xa, 0x1, 0x84) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) openat$tun(0xffffffffffffff9c, &(0x7f00000001c0), 0x80001, 0x0) epoll_create1(0x0) socket$nl_generic(0x10, 0x3, 0x10) socket$inet_mptcp(0x2, 0x1, 0x106) socket$nl_route(0x10, 0x3, 0x0) socket$nl_xfrm(0x10, 0x3, 0x6) socket$vsock_stream(0x28, 0x1, 0x0) pipe(&(0x7f0000002740)) socket$inet6(0xa, 0x3, 0x87) socket$inet6_tcp(0xa, 0x1, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x0, 0x4, &(0x7f0000000000)=@framed={{0x18, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9}, [@call={0x85, 0x0, 0x0, 0xb4}]}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x40, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) socket(0x10, 0x3, 0x0) socket$nl_generic(0x10, 0x3, 0x10) r0 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f00000000c0), 0x48) bpf$MAP_LOOKUP_ELEM(0x5, &(0x7f00000000c0)={r0, &(0x7f0000000000), &(0x7f0000000040)=""/73}, 0x70) 2.404901291s ago: executing program 1 (id=2642): r0 = socket$can_bcm(0x1d, 0x2, 0x2) r1 = bpf$OBJ_GET_PROG(0x7, &(0x7f0000000080)=@o_path={&(0x7f0000000180)='./file0/file0\x00', 0x0, 0xc, r0}, 0x18) bpf$PROG_BIND_MAP(0x23, &(0x7f0000000140)={r1}, 0xc) bpf$PROG_LOAD(0x5, 0x0, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000940)={0xffffffffffffffff, 0xffffffffffffffff}) pipe(&(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) splice(r3, 0x0, r5, 0x0, 0xf3a, 0x0) r6 = openat$tun(0xffffffffffffff9c, &(0x7f0000000140), 0x841, 0x0) ioctl$TUNSETIFF(r6, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x6bf1c2d5adba8c32}) r7 = socket$packet(0x11, 0x2, 0x300) setsockopt$SO_ATTACH_FILTER(r7, 0x1, 0x1a, &(0x7f0000000040)={0x2, &(0x7f0000000400)=[{0x20, 0x0, 0x0, 0xfffff00c}, {0x6, 0x0, 0x0, 0x4}]}, 0x10) r8 = socket$kcm(0x2, 0xa, 0x2) ioctl$SIOCSIFHWADDR(r8, 0x8914, &(0x7f0000000040)={'syzkaller1\x00', @multicast}) write$tun(r6, &(0x7f00000003c0)={@val={0x4}, @void, @eth={@broadcast, @local, @val={@void}, {@ipv6={0x86dd, @gre_packet={0x0, 0x6, "b79a56", 0x44, 0x29, 0x0, @local, @mcast2={0xff, 0x3}, {[], {{}, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81c}, {}, {}, {0x8, 0x22eb, 0x0, {{}, 0x2, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1}}}}}}}}}}, 0x82) read$alg(r4, &(0x7f00000003c0)=""/98, 0x4c) socket$inet6(0xa, 0x2, 0x3) r9 = socket$alg(0x26, 0x5, 0x0) bind$alg(r9, &(0x7f0000000280)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb(cipher_null)\x00'}, 0x58) r10 = accept4(r9, 0x0, 0x0, 0x0) syz_genetlink_get_family_id$nl80211(&(0x7f0000000100), r10) syz_genetlink_get_family_id$devlink(&(0x7f0000000040), r10) bind$netrom(r10, 0x0, 0x0) recvmmsg(r10, &(0x7f00000005c0)=[{{0x0, 0xfffffffffffffc4c, 0x0}}], 0x3ffffffffffff62, 0x0, 0x0) setsockopt$bt_hci_HCI_FILTER(r10, 0x0, 0x2, &(0x7f0000000040)={0x6, [0x10001, 0xfffff5b5], 0x4}, 0x10) r11 = bpf$PROG_LOAD(0x5, &(0x7f0000000600)={0x11, 0xc, &(0x7f0000000380)=@framed={{0x18, 0x0, 0x0, 0x0, 0x80000000, 0x0, 0x0, 0x0, 0x4}, [@printk={@llu, {}, {}, {}, {}, {0x7, 0x0, 0xb, 0x3, 0x0, 0x0, 0x3}, {0x85, 0x0, 0x0, 0x2d}}, @call={0x85, 0x0, 0x0, 0x2}]}, &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x40f00, 0x2, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0xfffffffffffffe5a) bpf$PROG_BIND_MAP(0xa, &(0x7f00000007c0)={r11}, 0xc) ioctl$int_in(r5, 0x5452, &(0x7f0000000000)=0x10001) write(r2, 0x0, 0x0) 2.352735345s ago: executing program 0 (id=2643): r0 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f00000009c0)={0x1b, 0x0, 0x0, 0x40000, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0}, 0x48) bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x1f, 0x17, &(0x7f00000007c0)=@ringbuf={{}, {{0x18, 0x1, 0x1, 0x0, r2}, {}, {}, {0x85, 0x0, 0x0, 0x8}}, {{0x6, 0x0, 0xb, 0x9, 0x0, 0x4}, {0x65, 0x0, 0x6, 0x9}}, [@printk={@i, {0x3, 0x3, 0x3, 0xa, 0x9}, {0x5, 0x1, 0x2, 0xa, 0x9}, {0x4, 0x0, 0x3, 0x9}, {}, {0x7, 0x0, 0xb, 0x3, 0x0, 0x0, 0xfffffffc}, {0x15}}], {{0x5, 0x1, 0x3, 0x3}, {0x5, 0x0, 0xb, 0x3}, {0x85, 0x0, 0x0, 0x76}}}, &(0x7f0000000040)='syzkaller\x00', 0x3, 0x0, 0x0, 0x0, 0x10, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1}, 0x94) r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r5 = socket$nl_generic(0x10, 0x3, 0x10) r6 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000380), r5) sendmsg$NL80211_CMD_REMAIN_ON_CHANNEL(r5, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000540)={0x1c, r6, 0x9c3fa077fa966179, 0xfe, 0x0, {{0x7e}, {@val={0x33}, @void}}}, 0x1c}}, 0x4000054) ioctl$ifreq_SIOCGIFINDEX_team(0xffffffffffffffff, 0x8933, &(0x7f0000000340)={'team0\x00', 0x0}) sendmmsg$inet(r5, &(0x7f0000000540)=[{{&(0x7f00000001c0)={0x2, 0x4e23, @initdev={0xac, 0x1e, 0x1, 0x0}}, 0x10, &(0x7f0000000280)=[{&(0x7f00000003c0)="d08e2d58147683e273beaa61045122bf0af8693296bd02e8b692d8f4721386d907f4b12597c5ec21dbb259e5c92c0ecc834fc8c146a8ab10866e3128bfbe61293b4aa9714f5c6f383eda059ba1ee9198049575cc69fff7dfd2d804fdec0701912b58826c4b33b9131dc4e0d7b96f485c509d14e2a3dcd109278e2d64c844df4c760831e9258fe1ed8d922e0d5468b0d4ae5e7173b867975663ce1b2cbfd5bb7db13627b91ae70bb5b6293658a276547c6d4dec8e06ef60a26c7a5059e77a2c8919d21304513c27df3f25f576ed74af50f5d5f557bba5459e5f97c4b4767ceaae92e43ebd395c5b77b025157f50a64ea0fa1c4ee0e98caf401dac6cf3a53c", 0xfe}, {&(0x7f0000000200)="0801d76e3880af6c56582491a82a8790f2a4af93f91cf6299bf9a94e03753037a9", 0x21}], 0x2, &(0x7f00000004c0)=[@ip_tos_int={{0x14, 0x0, 0x1, 0x98a}}, @ip_pktinfo={{0x1c, 0x0, 0x8, {r7, @dev={0xac, 0x14, 0x14, 0x27}, @multicast2}}}, @ip_ttl={{0x14, 0x0, 0x2, 0x57d}}], 0x50}}], 0x1, 0x4000080) r8 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r9 = syz_genetlink_get_family_id$ieee802154(&(0x7f00000006c0), r8) sendmsg$IEEE802154_LLSEC_DEL_KEY(r4, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000780)={&(0x7f00000002c0)={0x30, r9, 0x1, 0x20, 0x0, {}, [@IEEE802154_ATTR_LLSEC_KEY_ID={0x5, 0x2e, 0x7f}, @IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan0\x00'}, @IEEE802154_ATTR_LLSEC_KEY_MODE={0x5, 0x2b, 0x2}]}, 0x30}}, 0x0) syz_genetlink_get_family_id$ieee802154(&(0x7f0000000040), r3) r10 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000240), r3) sendmsg$IEEE802154_START_REQ(r3, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000080)={0x1c, r10, 0x1, 0x0, 0x0, {}, [@IEEE802154_ATTR_COORD_PAN_ID={0x6, 0xa, 0xffff}]}, 0x1c}, 0x1, 0x0, 0x0, 0x18000}, 0x0) sendmsg$NL80211_CMD_GET_MPP(r1, &(0x7f0000000880)={0x0, 0x0, &(0x7f0000000840)={&(0x7f0000000800)={0x34, r0, 0x241a07f23122330d, 0x70bd27, 0x25dfdbfe, {{}, {@val={0x8}, @void}}, [@NL80211_ATTR_MAC={0xa}, @NL80211_ATTR_MAC={0x7}]}, 0x34}, 0x1, 0x0, 0x0, 0x48040}, 0x800) 2.274700574s ago: executing program 2 (id=2645): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000240), 0xffffffffffffffff) sendmsg$ETHTOOL_MSG_LINKINFO_SET(r0, &(0x7f0000000500)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000380)={0x3c, r1, 0x1, 0x70bd24, 0x25dfdbff, {}, [@ETHTOOL_A_LINKINFO_HEADER={0x18, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'syz_tun\x00'}]}, @ETHTOOL_A_LINKINFO_PHYADDR={0x5, 0x3, 0x1}, @ETHTOOL_A_LINKINFO_PORT={0x5, 0x2, 0x3}]}, 0x3c}, 0x1, 0x0, 0x0, 0x20009005}, 0x0) 2.166473098s ago: executing program 2 (id=2646): r0 = socket$can_bcm(0x1d, 0x2, 0x2) r1 = bpf$OBJ_GET_PROG(0x7, &(0x7f0000000080)=@o_path={&(0x7f0000000180)='./file0/file0\x00', 0x0, 0xc, r0}, 0x18) bpf$PROG_BIND_MAP(0x23, &(0x7f0000000140)={r1}, 0xc) bpf$PROG_LOAD(0x5, 0x0, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000940)={0xffffffffffffffff, 0xffffffffffffffff}) pipe(&(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) splice(r3, 0x0, r5, 0x0, 0xf3a, 0x0) r6 = openat$tun(0xffffffffffffff9c, &(0x7f0000000140), 0x841, 0x0) ioctl$TUNSETIFF(r6, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x6bf1c2d5adba8c32}) r7 = socket$packet(0x11, 0x2, 0x300) setsockopt$SO_ATTACH_FILTER(r7, 0x1, 0x1a, &(0x7f0000000040)={0x2, &(0x7f0000000400)=[{0x20, 0x0, 0x0, 0xfffff00c}, {0x6, 0x0, 0x0, 0x4}]}, 0x10) r8 = socket$kcm(0x2, 0xa, 0x2) ioctl$SIOCSIFHWADDR(r8, 0x8914, &(0x7f0000000040)={'syzkaller1\x00', @multicast}) write$tun(r6, &(0x7f00000003c0)={@val={0x4}, @void, @eth={@broadcast, @local, @val={@void}, {@ipv6={0x86dd, @gre_packet={0x0, 0x6, "b79a56", 0x44, 0x29, 0x0, @local, @mcast2={0xff, 0x3}, {[], {{}, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81c}, {}, {}, {0x8, 0x22eb, 0x0, {{}, 0x2, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1}}}}}}}}}}, 0x82) read$alg(r4, &(0x7f00000003c0)=""/98, 0x4c) socket$inet6(0xa, 0x2, 0x3) r9 = socket$alg(0x26, 0x5, 0x0) bind$alg(r9, &(0x7f0000000280)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb(cipher_null)\x00'}, 0x58) r10 = accept4(r9, 0x0, 0x0, 0x0) syz_genetlink_get_family_id$nl80211(&(0x7f0000000100), r10) syz_genetlink_get_family_id$devlink(&(0x7f0000000040), r10) bind$netrom(r10, 0x0, 0x0) recvmmsg(r10, &(0x7f00000005c0)=[{{0x0, 0xfffffffffffffc4c, 0x0}}], 0x3ffffffffffff62, 0x0, 0x0) setsockopt$bt_hci_HCI_FILTER(r10, 0x0, 0x2, &(0x7f0000000040)={0x6, [0x10001, 0xfffff5b5], 0x4}, 0x10) write(r5, &(0x7f0000003300)="ac", 0x1) bpf$PROG_BIND_MAP(0xa, &(0x7f00000007c0), 0xc) ioctl$int_in(r5, 0x5452, &(0x7f0000000000)=0x10001) write(r2, 0x0, 0x0) 2.097272564s ago: executing program 0 (id=2648): mmap(&(0x7f0000001000/0xc00000)=nil, 0xc00000, 0x0, 0x3032, 0xffffffffffffffff, 0x0) bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f00000003c0)={0x2, 0x4, 0x8, 0x1, 0x80, 0xffffffffffffffff, 0xffffffff, '\x00', 0x0, 0xffffffffffffffff, 0x0, 0x1}, 0x50) openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x1c9042, 0x0) r0 = getpid() bind$inet6(0xffffffffffffffff, &(0x7f0000000040)={0xa, 0x10010000004e20}, 0x1c) syz_emit_ethernet(0x83, &(0x7f0000000500)=ANY=[@ANYRESDEC=r0], 0x0) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$devlink(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$DEVLINK_CMD_RELOAD(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000080)={0x3c, r2, 0x1, 0x0, 0x0, {}, [{@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, @DEVLINK_ATTR_NETNS_PID={0x8, 0x8b, r0}}]}, 0x3c}}, 0x0) r3 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000300)={0x11, 0x5, &(0x7f00000002c0)=ANY=[@ANYBLOB="1805000000000000000000004b64ffec8500000075000000040000000700000095"], &(0x7f0000000080)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000240)={&(0x7f0000000080)='sched_switch\x00', r3}, 0x10) r4 = socket$packet(0x11, 0x3, 0x300) r5 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_fanout(r5, 0x107, 0x12, 0x0, 0x0) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000300)={'ip6_vti0\x00', 0x0}) sendto$packet(r5, &(0x7f0000000180), 0x0, 0x0, &(0x7f0000000140)={0x11, 0x0, r6}, 0x14) r7 = socket$netlink(0x10, 0x3, 0x400000000000004) r8 = socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_TX_RING(r8, 0x11b, 0x3, &(0x7f00000001c0)=0x100000, 0x4) writev(r7, &(0x7f0000000000)=[{&(0x7f0000000200)="480000001400190d7ebdeb75fd0d8c562c84d8c033ed7a80fae0090f000000000000a2bc5603ca00000f7f89000000200000004a2471083ec6811778581acb6c0101ff0000000309", 0x48}], 0x1) setsockopt$XDP_TX_RING(r8, 0x11b, 0x3, &(0x7f0000000040), 0x4) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r9, 0x0, 0x0) sendmmsg$unix(r10, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r9, 0x0, 0x0, 0x0, 0x0) socket$netlink(0x10, 0x3, 0x10) bind$netlink(0xffffffffffffffff, &(0x7f0000514ff4)={0x10, 0x0, 0x1}, 0xc) socket(0x1d, 0x2, 0x6) 1.811466953s ago: executing program 3 (id=2652): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$TIPC_NL_KEY_SET(r0, &(0x7f0000000540)={0x0, 0x0, &(0x7f0000000500)={&(0x7f0000000140)={0x58, r1, 0x1, 0x70bd28, 0x25dfdbfc, {}, [@TIPC_NLA_NODE={0x44, 0x6, 0x0, 0x1, [@TIPC_NLA_NODE_KEY={0x3c, 0x4, {'gcm(aes)\x00', 0x14, "96557917d5d82cebae9347436de1ace2fe62c079"}}, @TIPC_NLA_NODE_ID={0x4}]}]}, 0x58}}, 0x4004) 1.580577035s ago: executing program 3 (id=2654): r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000300)=ANY=[@ANYBLOB="18000000240001030000000000000000010000000400ae"], 0x18}}, 0x4044004) recvmmsg(r0, &(0x7f00000086c0)=[{{0x0, 0x0, 0x0}, 0x4008101}, {{0x0, 0x0, 0x0}, 0x10000}, {{0x0, 0x0, 0x0}, 0x1}, {{0x0, 0x0, &(0x7f0000001a00)=[{&(0x7f00000000c0)=""/177, 0xb1}, {&(0x7f0000000dc0)=""/262, 0x106}, {&(0x7f0000000040)=""/43, 0x2b}, {&(0x7f0000000440)=""/84, 0x54}, {&(0x7f0000003bc0)=""/4109, 0x100d}, {&(0x7f00000017c0)=""/227, 0xe3}, {&(0x7f0000000340)=""/219, 0xdb}], 0x7}, 0x80000000}], 0x4, 0x0, 0x0) 1.312440231s ago: executing program 3 (id=2656): socket(0x10, 0x3, 0x0) socket$vsock_stream(0x28, 0x1, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000240)) socket$packet(0x11, 0x3, 0x300) socket$inet6(0xa, 0x800000000000002, 0x0) socket$kcm(0x2, 0x3, 0x2) bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f00000002c0)={0x2, 0x4, 0x8, 0x1, 0x80, 0x0, 0x80000001, '\x00', 0x0, 0x0}, 0x48) bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="0200000004000000080000000d"], 0x48) socket$inet6(0xa, 0x800000000000002, 0x0) socket(0x28, 0x1, 0x0) socket$inet_smc(0x2b, 0x1, 0x0) socket$inet6_icmp(0xa, 0x2, 0x3a) socket$nl_route(0x10, 0x3, 0x0) socket$can_j1939(0x1d, 0x2, 0x7) socket$rds(0x15, 0x5, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) socket$nl_route(0x10, 0x3, 0x0) r1 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000340)={0x18, 0x3, &(0x7f0000000d00)=ANY=[@ANYBLOB="1800"/13], &(0x7f0000000000)='syzkaller\x00'}, 0x94) socket$nl_generic(0x10, 0x3, 0x10) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={&(0x7f00000001c0)='task_newtask\x00', r1}, 0x18) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) bpf$BPF_PROG_DETACH(0x9, &(0x7f0000000280)=ANY=[@ANYRES32, @ANYRES32, @ANYRES64=r2, @ANYRESOCT=r0], 0x20) 1.302610836s ago: executing program 2 (id=2657): socket$kcm(0xa, 0x3, 0x87) r0 = socket$inet6_sctp(0xa, 0x1, 0x84) syz_init_net_socket$ax25(0x3, 0x5, 0xcc) sendmmsg$inet6(r0, 0x0, 0x0, 0x2001) socket$inet6_sctp(0xa, 0x1, 0x84) syz_init_net_socket$netrom(0x6, 0x5, 0x0) bpf$BPF_GET_MAP_INFO(0xf, &(0x7f0000000100)={0x1, 0x0, 0x0}, 0x10) setsockopt$MRT6_DEL_MIF(0xffffffffffffffff, 0x29, 0xcb, 0x0, 0x0) r1 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="1b00000000000000"], 0x48) r2 = bpf$PROG_LOAD(0x5, &(0x7f0000000b00)={0x11, 0xf, &(0x7f0000000340)=ANY=[@ANYBLOB="18000000000000000000", @ANYRES32=r1, @ANYBLOB="0000000000000000b702000014000000b7030000000000008500000083000000bf0900000000000055090100000000009500000800000000bf91000000000000b702000043e7b5538500000085000000b70000000000000095"], &(0x7f0000000080)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r3 = socket(0x2b, 0x80801, 0x1) connect$inet6(r3, &(0x7f00000001c0)={0xa, 0x4, 0x3ff, @empty, 0x1}, 0x1c) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000000c0)={&(0x7f0000000140)='kmem_cache_free\x00', r2}, 0x10) r4 = bpf$PROG_LOAD(0x5, &(0x7f0000000440)={0x11, 0x6, &(0x7f0000000cc0)=ANY=[@ANYBLOB], 0x0, 0x5, 0xc3, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x6}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000000c0)={&(0x7f0000000080)='sched_switch\x00', r4}, 0x10) pselect6(0x40, &(0x7f00000001c0)={0x0, 0x0, 0x3, 0xfffffffffffffffd}, 0x0, &(0x7f00000002c0)={0x3ff, 0x0, 0x0, 0x9, 0x0, 0x0, 0x7fffffff}, 0x0, 0x0) 1.221163836s ago: executing program 1 (id=2659): socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000000)='blkio.bfq.io_merged\x00', 0x275a, 0x0) mmap(&(0x7f0000e10000/0x1000)=nil, 0x1000, 0x2000006, 0x12, r0, 0x913e0000) mmap(&(0x7f000028f000/0x2000)=nil, 0x2000, 0x0, 0x3032, 0xffffffffffffffff, 0x2000000) socket$xdp(0x2c, 0x3, 0x0) r2 = socket$netlink(0x10, 0x3, 0x0) r3 = socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000040), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r3, 0x8933, &(0x7f0000000080)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_JOIN_MESH(r1, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000740)={0xfffffffffffffd65, r4, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r5}, @void}}, [@NL80211_ATTR_MESH_ID={0xa}, @NL80211_ATTR_MESH_SETUP={0x8, 0x70, [@NL80211_MESH_SETUP_USERSPACE_AUTH={0x4}]}]}, 0x30}}, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000200)={'geneve0\x00', 0x0}) sendmsg$nl_route(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000400)=@newlink={0x34, 0x10, 0x1, 0x0, 0x0, {0x0, 0x0, 0x0, r6, 0x2608}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @geneve={{0xb}, {0x4}}}]}, 0x34}, 0x1, 0x2}, 0x0) r7 = socket$nl_route(0x10, 0x3, 0x0) r8 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX(r8, 0x8933, &(0x7f0000000000)={'hsr0\x00', 0x0}) r10 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFQNL_MSG_CONFIG(r10, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000180)={0x1c, 0x2, 0x3, 0x3, 0x0, 0x0, {}, [@NFQA_CFG_CMD={0x8, 0x1, {0x1}}]}, 0x1c}, 0x1, 0x0, 0x0, 0x400c000}, 0x0) sendmsg$nl_route(r7, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000380)=@newlink={0x50, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x18207}, [@IFLA_LINKINFO={0x28, 0x12, 0x0, 0x1, @vxcan={{0xa}, {0x18, 0x2, 0x0, 0x1, @val={0x14, 0x1, {{0x0, 0x0, 0x0, r9, 0x8}}}}}}, @IFLA_MASTER={0x8, 0xa, r9}]}, 0x50}}, 0x0) 1.177359745s ago: executing program 3 (id=2660): socket$netlink(0x10, 0x3, 0x0) r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000002c80)={0x6, 0xc, &(0x7f0000000580)=ANY=[@ANYBLOB="18020000000000000000000000000000850000000e000000180100002020692500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b701000000000000850000007b00000095"], &(0x7f0000000180)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x23}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f00000002c0)={r0, 0x0, 0xe, 0x0, &(0x7f0000000100)="0000000000000000000051229dc9", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) 1.172921078s ago: executing program 2 (id=2661): r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000200)=ANY=[@ANYBLOB="18000000240001030000000000000000010000000400ae"], 0x18}, 0x1, 0x0, 0x0, 0x8001}, 0x4000) recvmmsg(r0, &(0x7f0000000000)=[{{0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000540)=""/4090, 0xffa}, {&(0x7f0000000080)=""/86, 0x56}, {&(0x7f00000001c0)=""/49, 0x31}], 0x3}, 0x9}], 0x1, 0x10000, 0x0) 990.182311ms ago: executing program 1 (id=2663): r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$IP_VS_SO_SET_DELDEST(r0, 0x6, 0x9, &(0x7f0000000480)={{0x2, @loopback, 0x0, 0x3, 'wrr\x00', 0x0, 0x0, 0x2d}, {@broadcast, 0x4e24, 0x2000, 0x0, 0x6}}, 0x44) getsockopt$inet_tcp_int(r0, 0x6, 0x9, 0x0, &(0x7f0000000040)) 982.519157ms ago: executing program 3 (id=2665): r0 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f00000009c0)={0x1b, 0x0, 0x0, 0x40000, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0}, 0x48) bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x1f, 0x17, &(0x7f00000007c0)=@ringbuf={{}, {{0x18, 0x1, 0x1, 0x0, r2}, {}, {}, {0x85, 0x0, 0x0, 0x8}}, {{0x6, 0x0, 0xb, 0x9, 0x0, 0x4}, {0x65, 0x0, 0x6, 0x9}}, [@printk={@i, {0x3, 0x3, 0x3, 0xa, 0x9}, {0x5, 0x1, 0x2, 0xa, 0x9}, {0x4, 0x0, 0x3, 0x9}, {}, {0x7, 0x0, 0xb, 0x3, 0x0, 0x0, 0xfffffffc}, {0x15}}], {{0x5, 0x1, 0x3, 0x3}, {0x5, 0x0, 0xb, 0x3}, {0x85, 0x0, 0x0, 0x76}}}, &(0x7f0000000040)='syzkaller\x00', 0x3, 0x0, 0x0, 0x0, 0x10, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1}, 0x94) r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r5 = socket$nl_generic(0x10, 0x3, 0x10) r6 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000380), r5) sendmsg$NL80211_CMD_REMAIN_ON_CHANNEL(r5, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000540)={0x1c, r6, 0x9c3fa077fa966179, 0xfe, 0x0, {{0x7e}, {@val={0x33}, @void}}}, 0x1c}}, 0x4000054) ioctl$ifreq_SIOCGIFINDEX_team(0xffffffffffffffff, 0x8933, &(0x7f0000000340)={'team0\x00', 0x0}) sendmmsg$inet(r5, &(0x7f0000000540)=[{{&(0x7f00000001c0)={0x2, 0x4e23, @initdev={0xac, 0x1e, 0x1, 0x0}}, 0x10, &(0x7f0000000280)=[{&(0x7f00000003c0)="d08e2d58147683e273beaa61045122bf0af8693296bd02e8b692d8f4721386d907f4b12597c5ec21dbb259e5c92c0ecc834fc8c146a8ab10866e3128bfbe61293b4aa9714f5c6f383eda059ba1ee9198049575cc69fff7dfd2d804fdec0701912b58826c4b33b9131dc4e0d7b96f485c509d14e2a3dcd109278e2d64c844df4c760831e9258fe1ed8d922e0d5468b0d4ae5e7173b867975663ce1b2cbfd5bb7db13627b91ae70bb5b6293658a276547c6d4dec8e06ef60a26c7a5059e77a2c8919d21304513c27df3f25f576ed74af50f5d5f557bba5459e5f97c4b4767ceaae92e43ebd395c5b77b025157f50a64ea0fa1c4ee0e98caf401dac6cf3a53c", 0xfe}, {0x0}], 0x2, &(0x7f00000004c0)=[@ip_tos_int={{0x14, 0x0, 0x1, 0x98a}}, @ip_pktinfo={{0x1c, 0x0, 0x8, {r7, @dev={0xac, 0x14, 0x14, 0x27}, @multicast2}}}, @ip_ttl={{0x14, 0x0, 0x2, 0x57d}}], 0x50}}], 0x1, 0x4000080) r8 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r9 = syz_genetlink_get_family_id$ieee802154(&(0x7f00000006c0), r8) sendmsg$IEEE802154_LLSEC_DEL_KEY(r4, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000780)={&(0x7f00000002c0)={0x30, r9, 0x1, 0x20, 0x0, {}, [@IEEE802154_ATTR_LLSEC_KEY_ID={0x5, 0x2e, 0x7f}, @IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan0\x00'}, @IEEE802154_ATTR_LLSEC_KEY_MODE={0x5, 0x2b, 0x2}]}, 0x30}}, 0x0) syz_genetlink_get_family_id$ieee802154(&(0x7f0000000040), r3) r10 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000240), r3) sendmsg$IEEE802154_START_REQ(r3, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000080)={0x1c, r10, 0x1, 0x0, 0x0, {}, [@IEEE802154_ATTR_COORD_PAN_ID={0x6, 0xa, 0xffff}]}, 0x1c}, 0x1, 0x0, 0x0, 0x18000}, 0x0) sendmsg$NL80211_CMD_GET_MPP(r1, &(0x7f0000000880)={0x0, 0x0, &(0x7f0000000840)={&(0x7f0000000800)={0x34, r0, 0x241a07f23122330d, 0x70bd27, 0x25dfdbfe, {{}, {@val={0x8}, @void}}, [@NL80211_ATTR_MAC={0xa}, @NL80211_ATTR_MAC={0x7}]}, 0x34}, 0x1, 0x0, 0x0, 0x48040}, 0x800) 942.230935ms ago: executing program 2 (id=2666): r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) sendto$inet(r0, &(0x7f0000000340)="48efd77724000000", 0x8, 0x0, &(0x7f0000000100)={0x2, 0x4e22, @empty}, 0x10) recvmmsg(r0, &(0x7f0000000ac0)=[{{0x0, 0x0, 0x0}}], 0x1, 0x20, 0x0) 873.535243ms ago: executing program 1 (id=2668): r0 = socket$can_bcm(0x1d, 0x2, 0x2) r1 = bpf$OBJ_GET_PROG(0x7, &(0x7f0000000080)=@o_path={&(0x7f0000000180)='./file0/file0\x00', 0x0, 0xc, r0}, 0x18) bpf$PROG_BIND_MAP(0x23, &(0x7f0000000140)={r1}, 0xc) bpf$PROG_LOAD(0x5, 0x0, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000940)={0xffffffffffffffff, 0xffffffffffffffff}) pipe(&(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) splice(r3, 0x0, r5, 0x0, 0xf3a, 0x0) r6 = openat$tun(0xffffffffffffff9c, &(0x7f0000000140), 0x841, 0x0) ioctl$TUNSETIFF(r6, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x6bf1c2d5adba8c32}) r7 = socket$packet(0x11, 0x2, 0x300) setsockopt$SO_ATTACH_FILTER(r7, 0x1, 0x1a, &(0x7f0000000040)={0x2, &(0x7f0000000400)=[{0x20, 0x0, 0x0, 0xfffff00c}, {0x6, 0x0, 0x0, 0x4}]}, 0x10) r8 = socket$kcm(0x2, 0xa, 0x2) ioctl$SIOCSIFHWADDR(r8, 0x8914, &(0x7f0000000040)={'syzkaller1\x00', @multicast}) write$tun(r6, &(0x7f00000003c0)={@val={0x4}, @void, @eth={@broadcast, @local, @val={@void}, {@ipv6={0x86dd, @gre_packet={0x0, 0x6, "b79a56", 0x44, 0x29, 0x0, @local, @mcast2={0xff, 0x3}, {[], {{}, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81c}, {}, {}, {0x8, 0x22eb, 0x0, {{}, 0x2, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1}}}}}}}}}}, 0x82) read$alg(r4, &(0x7f00000003c0)=""/98, 0x4c) socket$inet6(0xa, 0x2, 0x3) r9 = socket$alg(0x26, 0x5, 0x0) bind$alg(r9, &(0x7f0000000280)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb(cipher_null)\x00'}, 0x58) r10 = accept4(r9, 0x0, 0x0, 0x0) syz_genetlink_get_family_id$nl80211(&(0x7f0000000100), r10) syz_genetlink_get_family_id$devlink(&(0x7f0000000040), r10) bind$netrom(r10, 0x0, 0x0) recvmmsg(r10, &(0x7f00000005c0)=[{{0x0, 0xfffffffffffffc4c, 0x0}}], 0x3ffffffffffff62, 0x0, 0x0) setsockopt$bt_hci_HCI_FILTER(r10, 0x0, 0x2, &(0x7f0000000040)={0x6, [0x10001, 0xfffff5b5], 0x4}, 0x10) write(r5, &(0x7f0000003300)="ac", 0x1) bpf$PROG_BIND_MAP(0xa, &(0x7f00000007c0), 0xc) ioctl$int_in(r5, 0x5452, &(0x7f0000000000)=0x10001) write(r2, 0x0, 0x0) 727.313055ms ago: executing program 0 (id=2670): socket$netlink(0x10, 0x3, 0x0) r0 = socket$netlink(0x10, 0x3, 0x10) bind$netlink(r0, &(0x7f0000514ff4)={0x10, 0x0, 0x0, 0x2ffffffff}, 0xc) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) close(r1) r2 = socket$inet6_mptcp(0xa, 0x1, 0x106) bind$inet6(r1, &(0x7f0000000040)={0xa, 0x4e22, 0x0, @empty}, 0x1c) listen(r1, 0x9) r3 = socket$inet_mptcp(0x2, 0x1, 0x106) sendmmsg(r3, &(0x7f0000002840)=[{{0x0, 0x0, 0x0}}], 0x1, 0x20044000) connect$inet(r3, &(0x7f0000000000)={0x2, 0x4e22, @empty}, 0x10) r4 = socket$nl_generic(0x10, 0x3, 0x10) sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0) getsockopt$IP_VS_SO_GET_DAEMON(r3, 0x0, 0x487, 0x0, &(0x7f0000000480)) r5 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000740), 0xffffffffffffffff) sendmsg$MPTCP_PM_CMD_FLUSH_ADDRS(r4, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000003140)=ANY=[@ANYBLOB, @ANYRES16=r5, @ANYBLOB="01002cbd7000ffdbdf2504"], 0x14}, 0x1, 0x0, 0x0, 0x20000800}, 0x800) accept4(r2, &(0x7f0000000080)=@qipcrtr, 0x0, 0x80000) 726.4468ms ago: executing program 3 (id=2671): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000100)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a01020000000000000000070000000900010073797a30000000004c000000090a010400000000000000000700000008000a40000000000900020073797a31000000000900010073797a3000000000080005400000000d08000640ffffff000800034000000038580000000c0a01010000000000000000070000000900020073797a31000000000900010073797a30000000002c000380280000800800034000000002040002800c000440000010c6f7a0b5ec0c0005408640"], 0xec}}, 0x0) r1 = syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10) sendmsg$netlink(r1, 0x0, 0x0) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = socket$nl_audit(0x10, 0x3, 0x9) bind$netlink(r3, &(0x7f0000000300)={0x10, 0x0, 0x25dfdbfb, 0x1}, 0xc) close(r3) r4 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$tipc(0x0, r4) sendmsg$TIPC_CMD_SHOW_NAME_TABLE(r4, 0x0, 0x2c040090) sendmsg$TIPC_CMD_GET_BEARER_NAMES(r2, 0x0, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) r5 = syz_init_net_socket$802154_raw(0x24, 0x3, 0x0) recvfrom(r5, 0x0, 0x0, 0xc0006020, 0x0, 0x0) r6 = socket(0x10, 0x3, 0x0) r7 = socket$packet(0x11, 0x3, 0x300) ioctl$sock_SIOCGIFINDEX(r7, 0x8933, &(0x7f0000000080)={'ip6tnl0\x00', 0x0}) sendmsg$nl_route_sched(r6, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000b80)=@newqdisc={0x24, 0x24, 0x3fe3aa0262d8c783, 0x0, 0x0, {0x0, 0x0, 0x0, r8, {}, {0xffff, 0xffff}}}, 0x24}}, 0x0) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000600)={0xffffffffffffffff, 0x0, 0x2107, 0x0, &(0x7f0000000100), 0x0, 0x1008, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9}, 0x50) sendmsg$802154_raw(r5, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000300)="1121e5", 0x3}, 0x1, 0x0, 0x0, 0x24008011}, 0x4c0e4) r9 = bpf$PROG_LOAD(0x5, &(0x7f0000000c40)={0x11, 0x3, &(0x7f00000009c0)=ANY=[@ANYBLOB="180000003100000000000000c90000009500200000000000"], 0x0, 0x7, 0x0, 0x0, 0x41000, 0x2, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x10, 0x2}, 0x90) write$cgroup_subtree(r9, &(0x7f0000000240)=ANY=[@ANYBLOB], 0x28) pipe(&(0x7f0000000340)) r10 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$sock_inet_SIOCSIFFLAGS(r10, 0x8924, &(0x7f00000000c0)={'wlan0\x00', 0x1}) bpf$PROG_LOAD(0x5, &(0x7f00000054c0)={0x2, 0x16, &(0x7f0000001600)=ANY=[@ANYBLOB="61128c000000000061134c0000000000bf200000000000002600020007ffffffbd0310000000000095002000000000006916000000000000bf6700000000000007070000b964b01a4607feff00200000540700000ee61e00bf150000000000000f5700000000000065070000d23700002c030000000000001f75000000000000bf54000000000000070000000400f9ffad430100000000007c000000000000000500000000000000950000000000000032ed3c5be95e5db67754bb12dc8c4ed68ecf264e0f84f9f17d3c30e3c7bdd2d17f2f175455000078af6d71d79a5e12814cb1d8a5d4601d295c45a6a0b9bdb7dd390700000500000000f18c30907d7bee45a0100000fe9de56c9d05000000c6c60bef0d742a81762bab8395fa64810b5b40d893ea8fe0185473d51b546cac3f1d5af65727546e7c955ccefa1f6ab689ffffff7f63ede202fa4e0a2127b8b83c71a51445dc8dfd13ff15f852a39e5b2ab7bcb8f512036a5ba6d04ae76002d4519af619e3cca4d69e0dee5eb106774a8f3e6916fcecc8158f0200000000c8fb735fd552bdc268694aeb0743e326c819b6cf5c8ac86f8a297dff0445a13d0045fb3cda30a673a6037ed8c85f21ec2c081bdce431e56723888fb126a19bc1172b84b3ebe174aba210d739a018f9bbec63222d20cecac4d03723f1c921b5bbf7949632cacfdd32b3a6aa57f1ad2e99e0e67a993716dbf580469f0f53acbb400001e3738270b315d362ed834f2af97787f696649a462e7e090000000000000045eac1f2014f720e83b7838e3eede14308d582685e1becd6f35154bcb4000000000000000000000000000000bc3af2b170ad3e2b26539cebca8f4ddc211bc3ccf0bd9d42ca019dd5d022cf74686e9fbe2562979eaed840a7afaab43176e65ec1118d46d1e827f3472f4445d353887a5ad103649afa1769080584f800031e03a651bb04000000ab04871bc47287cd31cc43ea0ffb567b4040c1458d0320ce7d0000413a0000000000000000005f37983f84e98a523d80bd56a57fa82b82f639601ae899a559944cb9a62a29ab028acfc1cb26a0f6a5480a55d624a0c544ba0dc828c22fe30000aa391598000000437d57fcf8295f63a70837f5cd4e5e77964522dc7ca3aa3476b7f2d851d27fd4de6eabb43e0799dc8d9fb7dc6c523ffbd74a6a40e4acb1ac872ade9d1f2ab779b8dbe843aeeda0426c767c00327b8c95b2bb6ddb55117669d9598c0f3598073f3a921c76beceff7e4fbf909a2cabf5b8ea5011db9020823b83abe54346c7af0a99fa077ffe7000feb9e44023a1749eb1d0d572b77d6e0d0fcd74031c8ef2629f5ecff4626746d6abe98a255e92c3c4f79bfcd0d91741380000cfeb73dec68ed56b5d3dfdf0cb8b71ad79000000000000000000000000000000dd434a25e95d0ec29d3adaccf89d0888031ecdfdb4dfbe444673be099ece7e4009c76c7108ef0a7e59fd6d906fbc3c9b412e0478cfee4485f423c63f49db43833c92eeeb647cebd4d7a93a17bcbb6bae5ff876375d4fe39cc2d292691672cc18ca372104ceb83a35ecedd97fc191d8f64d2b1d60c6d12911aada66c26aa4802c3514c3d92ec905000000b13f4a2575fbe943a6c40000000000000000000000000000028026b80c3899543223a6079ee96198b9a326db3be3a48af415ca28ca68c502550044ed8e29af8d763ef9b1f31befcad2ce5394601c7cdc233bff7f0000000000009fb3ad650f77e339768924dfdbeead13b88371154d743544a6091ec93e0d3fd5b4dc42911c1ba322fd4d6fbf19e617d51f964727bfd5cc5ba15370f6e1141d2271eded0b15e4316a1e4623272beb249a0928c417720be14c898f397411c88a7bcf3df46ab3efe7cd5e160c2afd3cc945f75011a102d952c7ad17a58d9be691c334ea35bae71e76e160cc2260bd028162917807ce89e11b5f261052ee0dde18efa1d802af2b7bcf6f8af41933cea0d0343261bccf64ca1c81045153eafbefdb91fbdff9ee3307d4a1837963b2dc2a3698d90e7915b098f19392e792adaea86052f4e948184001b6494e906925a092483adc7e9c8f7a29d226763c100aecae7f00619c36bceb9fb6dd7e55487d8485e498fdfc377fd3d266d21d46ab2f6b2ce22cd0aebba9b0ffbfe8ec3143c3734967c90b16ebbeeae1ce2baaae05aed6bf0f40c8a323f9235dc99698bd0b800067a901a79daada03cc77e74feb98b1586946b452764ff917a8ecc10e529c5bea49cad70e22df522c2803b6ef65df70223c6e22c3433e322d8dbd6e9b040065a9d6b3d5ae276cffe935d559bea88e1aa36b4e6c19e78457904297e77370e013b705a96548d47c609a93c45f4d1382b39c05dcc07d5b49ad75ddb3ce5b5b9416e03995da04647aa5e6fc1a6f5d663380967ccef9de49a90ced031335e3219ebd9d06c257a50497ec523f5ff7361261ccfe239d603364a42e2e81fc068fcbb9792b673827fe7018a988fbce55bb74cdb327ced4b77b8743fb3cb72cc280b9f62e4f92f46a19600b802cba88b7d0a938d9e0e6cfe5d66b874c9a0c6c04b96360d6f499d004179e5b6025c0e1050faec7ecd9de190a975db2f8c06a551236278c4766d7e22e3b85168c9851de6266c791252f919b4f8b257b5a786734e5142e4666c67aef5b7b2f88c6640995434aa8636993089c73f196c54ae829ad4307132655b075ae534fa7f1ea9a17e62357b0bd2bd1d62d34bfc1364640250136729ba4f763ff25c33e8acc806611792add8254e705fefd2a44d5b15e3b36f6b75c97c9c04c511d8cf9e24c61c8284a913a381cb1a5628878040000000000000017b68afd95d4abf7920de9ebe1c89661f4adc3d83d72b1b778e30c2bf2efbbcd054cf51f4205ebf9a98a0d9f18135cb1d8d567c3436fa697b72c3b0200000000000079c0b3339debc78352b2e65299223d7ef2bd540e78167b3ac92a4c4f826f6d0e5c4ebf4f7a70c03e2f5ddbebf168586360c3663531eb5995d228f011a10ffc8b17d716b0c528dab6d0c4fe2ee402348104bc5d4012babedee898c6d3e1017be2e9bc759d3ab4d615f5000000000000000000000000000000000000000000007fff0000000000e693e314adf7dc9f517d04f1e6ca367d30d31d3647c6059db6e1e9529eb1623ef99e2d9ac2ab4872f8e784b07a31110bef6d000000a6f9e89e6d50ee06ce716f94da60f1f22d9669560d296287c13c92070000ee7553eb2df17839542fa88d09f000e88a90cf4406b9000000000000000000000000f441d6a6f516c235c6f5863e7f454ee0e16b9aa2593eb31fa3836703e7765aaeb77a8770e518efaa6d3dd85e03b3b133eb749057cea9af75a0e6f633532f2891b8e263cb6eecea691842827bc7c8c0130187081c8d320642389f5f0c42dba0ff68e84d7b130906f17f6aa075a257310f2d92cb1d1e16468949f5675262ee318e735930b01d8f586e34537bcff7d6196f494cdcf3a712078d745db0f5687a78ee6d000b3d171a0f08299b52d207f32e9da311ca090000003a42732808515eec574f892622c5be497fc3d9ca122d7c18b9e54637812c8debc61f0e42d838e44a819b74bce1a56108bb0fde97a02475920532309c55b2c9ae9f281391ec5cc72a5e94cca1cbf1ff01000000000000bdb537a0c52bd45a9f966c25616cec30c3ea3246cb8e6aac7cf273638e6656a3e4ccadc348f0172028c99cc5f6d5c6d09ed65aa54549e73c28b7c8ad06ad3c5e3c27eec0eff1a6c84f1189919eefcee807fc081e004ffb7d3104af00ac92f1080211c4bee74381a0e31021918f27863fdbafb50f70857d52a1f7df51935a80b1980a4778d35f183ea517f55a98095305701ab3f3ae43f06e91bc7d85e3800b46926944fba9805a985e63e53a62232fcd3f01dbe1728f300e247a7ebe344f9749818ff3961b2a42664ccd680a90bbb6ab400e286acc8f9febef64594777f848ed1cf980a3da2f0f7745760a05887d0c28060d613dd6539d392fc21fee0b5131609664b821d7a994e6c5965a4fa1ec1790c54e54586907dcc5e8bac16e79da9c2444420900000000000000f888a94365b99b72796fca1b922fc9aefaf1546c17cbb1d2d2fd12cb1a49cad501a3ca218c595b667b634606c57987ebfb0783a4948e4561d5cda158fe74453ff4a837beeedba483842c57d6005b544b4f80003386edfd3d4a88a667bd41eefe0d808abed08a29e6bc370a80cc0366fb4080bfbaaa946fd47ab662c794846e403950bbc3a48bb276cbb08a8eab145c06221ef16a238e3d50ad18aea9a2cec97d3c2d0569caabe2bffe02506bc9cb7294c5d020536dd5e7a6351642112df3b55d0215aaec7e45598995e79699e47567e353e68b03f82be860b188554b734e1192f9c1a867b815ef52cdc3307c0cc9be05a40fde69c350e59f11f1d26a4d04d8c8b2c4a4d23ec931d14bc7807db773a614b670acf46f83f7c65a0f8d43c5f64705f0d27c46d4b686e867e9b0be76a7978a8f962bb5a070df97f2bf7612115cfe5ebdc7ad0bc5a5f3ace25347d0e5c347279d55aa67a967380000000000000000000000000000000000000000000000ed0942d980c754c6c69ef65c375ad018824f78b260d5f51bc3feba504408a8c8141d84f3f417603b5081680f346ff0ffbe4ae19e936511966965ce268b6345a0001c0f26a32e0a999fc869292e939dcf89b9bfd794f9c12d41959a00688cca43015a9eec58f647796adea520cd2abeb0b55c22949d10e5a05fee4543fdc1e02554a55b5fef2427a6e5708edc38fac53c2f961945a3f83cdf01979939b49bc6b1aef8c733401bbe473de8d64efbe0d123739f387d1c0d9e74f2175c174ada1678c7db79492e8dd0f34e2ccf419cf7f14ffa408b50a52685b36aed14aa22ad928191d5a2697646edc52a1c0c5d720ae690add2b34aed161f51cc1cb424f76098e1e1921e5a405f9d298a8461f2da30e47b7c6ed7c95c84c745f58723e4cddffae3b53b5b947f9435e589f9ae55b30ecd3827b2de5df31976870823da8058c2538c04e397f3d0ef90c11c74da984fa558697ecb57224ce8fa6f79aadbd7dbf3678e74d790bc2ee72769a3ada1dd504f8e4133ce1effd446bc9a2f139e65cc4bd83912af3122352506c7c2191b3705116b2f4fc20d4e93882bdd6ccea97f3a08d3565b0000000000000000000000000000d35fb97c2d7a9374294dcec3da3df9a13c4fc63b00426682534d894caee0b963a3"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0xfffffffffffffe50}, 0x48) 491.928398ms ago: executing program 4 (id=2673): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$IPVS_CMD_NEW_DAEMON(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000140)={0x34, r1, 0x1, 0x4, 0x0, {}, [@IPVS_CMD_ATTR_DAEMON={0x20, 0x3, 0x0, 0x1, [@IPVS_DAEMON_ATTR_MCAST_IFN={0x14, 0x2, 'ip6erspan0\x00'}, @IPVS_DAEMON_ATTR_STATE={0x8, 0x1, 0x2}]}]}, 0x34}}, 0x0) 385.370907ms ago: executing program 4 (id=2674): r0 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000003c0)={'netdevsim0\x00', 0x0}) bpf$MAP_CREATE(0x0, &(0x7f0000000140)=ANY=[@ANYBLOB="010000000b000000010000000200000000000000", @ANYRES32, @ANYBLOB="0007000000e9baed4cd3b1cf7d2d6e48b817b376", @ANYRES32=r1, @ANYRES32, @ANYBLOB="0000000002"], 0x50) 248.355747ms ago: executing program 4 (id=2675): bpf$MAP_CREATE(0x0, &(0x7f0000000440)=@base={0xb, 0x7, 0x10001, 0xb, 0x1}, 0x50) socket$nl_generic(0x10, 0x3, 0x10) r0 = socket$inet6_sctp(0xa, 0x5, 0x84) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000240)={0x0, 0xffffffffffffffff, 0x0, 0x7, &(0x7f0000000000)='cgroup\x00'}, 0x30) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x9, 0x4, &(0x7f00000008c0)=ANY=[@ANYBLOB="180000000000000000000000000000006112000000000000950000000000000051fa7824c74186dc02ec0696c37b64e3b24da3180100000005165c0f63cdc2e82818254950ee03568b8809a1ff4c7c4750eabfafcb9531b31e6a86827d1010c5a909ab98e00e19644a88e95ba26d1c9eecddb2d11c541418ceeb29b9b6829c6e433822bdb3cc85244aab60c1aae1314d7381fcfeb970bea672cf1e926f6a51479343144648a07a975bd89dc398712376610f6254f12495b4658319684387f6f3543205d4bc4ce05b8b961103673dff7f158052e62b20f05fd24108d8363d44fcd0f8f3647899762a17282a1914452d11f557c28f396eebdc858558db0276d14f9035f2b5f703e5be7e4acf8b78c2834ae5805fffee38a9a0033d520bcf6b08ede50899d4b9bdf85c71c5de2503dab358f42a2624c7daa9ed44039aab46419496362e54cfad05a0004ac71a003d7b85d07191bed4e5a890826300214146f7ed569985439baa355c2766dd056f5d79e454f3d873095e7a237bc06d035a8d601f21746d886419f38b34a495040000000071c2f0cce8c93cc17e9afa314fcb2ba15d646c66b0f65021829f87d988b4e2d71753b1549fa734f0b2e56dbd21ed2e09d0cddad721971637f384eed3034597c93e1c52f42cad0ed09c395dc6e9703660fefa1c80f467367c006f25caf0cbcefd13d68839893e39c588eb032905f91cafa4996dbf0c9be9654db05fb918086cc8228d02a3092c0830b8f587a5624515298b2d4eb2bde6f9a2eb83d53f717f13fa7552d92c51dbd32ea50c490ecd085d2811a7555c538cffffff7f00000000dd872244bfa64779e0f43a9c277e2910b7ccdc3d6726d34ad2101033a623ca2a49ad344884289130bc71cee2b7de62bf48129ae1af052a2d46a61625735a9eea7f793946b3229e861d8ea49806b3f7d4295f6b000000000000f337b1ceb2d8a65dcdcd895d7ba37098d2593fdaaef445af5bee02019c00000099b13ecda2a5b37de0519e974cba92ebaf0f701611a9b027ce04340bda4594cc9049c3f101629ab028145e004209ebe71a6fe84af50804000000000000004a27213354964e250a98fe357676f94b6947383e320fbb1118f586d5b9b1b977e1e1a4490ff67703a9b5900f8a6f8a805879dd91ec5ff435b219c53680c0ae04dcc4ef69b98fcb0d6b6a03a8b71a66b4e2876dc4b610444bf10000000000b046b6ae5d68156bcbd6d8793ade9a22ac8fc7857e5bbc14adc4e12b08f350c6789283b9990c72e64372a1f79769a8bdc632fc1a0b3417855d8b7d25ca4d404c23631ad3d2f55dcd385371c86170a4bca58c2b2b4eabc365f45bd10bb45b0c5bc354456a52be18d9b44014d20a3c51c8f013dade83562e73278662829e4f5a9ac00fd91178468c737f0872d97d38d11a176be5a0d7294c51eb161eddcfefa8837c7430721851ec2a107af0df6d43e732bbc01e76c66895eb85d36798d61622773591ee21ad9f6a1b73fa9cf3ffeb8a00b63af800a81d0fb8aa29df8b8ad6fbafefb5802a23cbdeeabceda5bfc5ff2fa5c1d61d04a1324794c6ed000696d9f04010c35474e690545c3d9bd836d4cef2585ba616e01c3d000000000000000000470ebc6f3453ecbf3047e4547d7632d3ad21798e730cb5d1da059b5bdb8107815dff995c0788906790406dfb4f8ee9f24ff94233e2e6e581e6e5de33a5f254c9a8b612547473c3001df3928dac9203b744619082421a8da7c00000000000000000000000000000018a73ef40cca690fb7595c6962984f8276677be6f66cbdbccf1896433808c9c84d74ac4a7c186a04a2250972f7acb156b21f9826b6acb7db32c4e3b3ec8b59fd972975edb1da872d81a35e4fda2f5cbde6b40bea20418c6e9dad30b791eea58f53e80fee4dd7fe08373ea2784fcd3a65261de71eb866458d2c22a"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @cgroup_sock}, 0x70) shutdown(r0, 0x0) bpf$MAP_CREATE(0x0, &(0x7f00000003c0)=@base={0x1, 0x4, 0x8, 0x6}, 0x50) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0x3, &(0x7f0000000280)=@framed={{0x18, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}}, &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000080)={&(0x7f0000000000)='tlb_flush\x00', r1}, 0x10) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r0, 0x84, 0x6f, 0x0, &(0x7f0000000140)) getsockopt$inet_sctp6_SCTP_PRIMARY_ADDR(r0, 0x84, 0x7a, &(0x7f0000000340)={0x0, @in6={{0xa, 0x3, 0x4, @mcast1}}}, &(0x7f0000000040)=0x84) socket$netlink(0x10, 0x3, 0xf) socket$nl_generic(0x10, 0x3, 0x10) socket$netlink(0x10, 0x3, 0x0) socket$pppl2tp(0x18, 0x1, 0x1) socket$packet(0x11, 0x2, 0x300) socket$inet6_tcp(0xa, 0x1, 0x0) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) bpf$BPF_PROG_DETACH(0x9, &(0x7f0000000280)=ANY=[@ANYRES32, @ANYRES32, @ANYRES64=r3, @ANYRESOCT=r2], 0x20) 189.319045ms ago: executing program 4 (id=2676): r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000180)={'team_slave_1\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f0000000840)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000002c0)=ANY=[@ANYBLOB="800000001000030400000ffe0000000000000000", @ANYRES32=0x0, @ANYBLOB="00000000000000005000128009000100766c616e00000000400002800600010000000000340003800c0001000ffe0000000000000c00010094040000000000000c00010000010000000000000c000100040000000000000008000500", @ANYRES32=r1, @ANYBLOB="080003"], 0x80}}, 0x8000) 132.229112ms ago: executing program 1 (id=2677): r0 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f00000009c0)={0x1b, 0x0, 0x0, 0x40000, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0}, 0x48) bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x1f, 0x17, &(0x7f00000007c0)=@ringbuf={{}, {{0x18, 0x1, 0x1, 0x0, r2}, {}, {}, {0x85, 0x0, 0x0, 0x8}}, {{0x6, 0x0, 0xb, 0x9, 0x0, 0x4}, {0x65, 0x0, 0x6, 0x9}}, [@printk={@i, {0x3, 0x3, 0x3, 0xa, 0x9}, {0x5, 0x1, 0x2, 0xa, 0x9}, {0x4, 0x0, 0x3, 0x9}, {}, {0x7, 0x0, 0xb, 0x3, 0x0, 0x0, 0xfffffffc}, {0x15}}], {{0x5, 0x1, 0x3, 0x3}, {0x5, 0x0, 0xb, 0x3}, {0x85, 0x0, 0x0, 0x76}}}, &(0x7f0000000040)='syzkaller\x00', 0x3, 0x0, 0x0, 0x0, 0x10, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1}, 0x94) r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r5 = socket$nl_generic(0x10, 0x3, 0x10) r6 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000380), r5) sendmsg$NL80211_CMD_REMAIN_ON_CHANNEL(r5, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000540)={0x1c, r6, 0x9c3fa077fa966179, 0xfe, 0x0, {{0x7e}, {@val={0x33}, @void}}}, 0x1c}}, 0x4000054) ioctl$ifreq_SIOCGIFINDEX_team(0xffffffffffffffff, 0x8933, &(0x7f0000000340)={'team0\x00', 0x0}) sendmmsg$inet(r5, &(0x7f0000000540)=[{{&(0x7f00000001c0)={0x2, 0x4e23, @initdev={0xac, 0x1e, 0x1, 0x0}}, 0x10, &(0x7f0000000280)=[{&(0x7f00000003c0)="d08e2d58147683e273beaa61045122bf0af8693296bd02e8b692d8f4721386d907f4b12597c5ec21dbb259e5c92c0ecc834fc8c146a8ab10866e3128bfbe61293b4aa9714f5c6f383eda059ba1ee9198049575cc69fff7dfd2d804fdec0701912b58826c4b33b9131dc4e0d7b96f485c509d14e2a3dcd109278e2d64c844df4c760831e9258fe1ed8d922e0d5468b0d4ae5e7173b867975663ce1b2cbfd5bb7db13627b91ae70bb5b6293658a276547c6d4dec8e06ef60a26c7a5059e77a2c8919d21304513c27df3f25f576ed74af50f5d5f557bba5459e5f97c4b4767ceaae92e43ebd395c5b77b025157f50a64ea0fa1c4ee0e98caf401dac6cf3a53c", 0xfe}, {&(0x7f0000000200)="0801d76e3880af6c56582491a82a8790f2a4af93f91cf6299bf9a94e03753037a9632e1d798f7f", 0x27}], 0x2, &(0x7f00000004c0)=[@ip_tos_int={{0x14, 0x0, 0x1, 0x98a}}, @ip_pktinfo={{0x1c, 0x0, 0x8, {r7, @dev={0xac, 0x14, 0x14, 0x27}, @multicast2}}}, @ip_ttl={{0x14, 0x0, 0x2, 0x57d}}], 0x50}}], 0x1, 0x4000080) r8 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r9 = syz_genetlink_get_family_id$ieee802154(&(0x7f00000006c0), r8) sendmsg$IEEE802154_LLSEC_DEL_KEY(r4, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000780)={&(0x7f00000002c0)={0x30, r9, 0x1, 0x20, 0x0, {}, [@IEEE802154_ATTR_LLSEC_KEY_ID={0x5, 0x2e, 0x7f}, @IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan0\x00'}, @IEEE802154_ATTR_LLSEC_KEY_MODE={0x5, 0x2b, 0x2}]}, 0x30}}, 0x0) syz_genetlink_get_family_id$ieee802154(&(0x7f0000000040), r3) r10 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000240), r3) sendmsg$IEEE802154_START_REQ(r3, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000080)={0x1c, r10, 0x1, 0x0, 0x0, {}, [@IEEE802154_ATTR_COORD_PAN_ID={0x6, 0xa, 0xffff}]}, 0x1c}, 0x1, 0x0, 0x0, 0x18000}, 0x0) sendmsg$NL80211_CMD_GET_MPP(r1, &(0x7f0000000880)={0x0, 0x0, &(0x7f0000000840)={&(0x7f0000000800)={0x34, r0, 0x241a07f23122330d, 0x70bd27, 0x25dfdbfe, {{}, {@val={0x8}, @void}}, [@NL80211_ATTR_MAC={0xa}, @NL80211_ATTR_MAC={0x7}]}, 0x34}, 0x1, 0x0, 0x0, 0x48040}, 0x800) 125.692804ms ago: executing program 4 (id=2678): r0 = socket$kcm(0x11, 0x3, 0x0) setsockopt$sock_attach_bpf(r0, 0x107, 0xf, &(0x7f0000000000), 0x4) sendmsg$kcm(r0, &(0x7f0000000b00)={&(0x7f0000001340)=@hci={0x1f, 0x0, 0x6}, 0x80, &(0x7f0000000500)=[{&(0x7f0000000040)="62031400d755af176510120800afbcf711e12b7f96e5521c8cf21730087f5d2ae1b278c482c2be6770380e8ddd9aff775f8e", 0x32}], 0x1}, 0x4084) 17.411682ms ago: executing program 4 (id=2679): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$TIPC_NL_BEARER_ENABLE(r0, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000380)={0x24, r1, 0x1, 0x0, 0x8, {}, [@TIPC_NLA_BEARER={0x10, 0x1, 0x0, 0x1, [@TIPC_NLA_BEARER_NAME={0xa, 0x1, @l2={'ib', 0x3a, 'lo\x00'}}]}]}, 0x24}, 0x1, 0x0, 0x0, 0x40000}, 0x4000004) 16.827573ms ago: executing program 2 (id=2680): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000008c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0) sendmsg$NFT_BATCH(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000300)={{0x14}, [@NFT_MSG_NEWRULE={0x50, 0x6, 0xa, 0x40b, 0x0, 0x0, {0x2}, [@NFTA_RULE_EXPRESSIONS={0x24, 0x4, 0x0, 0x1, [{0x20, 0x1, 0x0, 0x1, @nat={{0x8}, @val={0x14, 0x2, 0x0, 0x1, [@NFTA_NAT_TYPE={0x8, 0x1, 0x1, 0x0, 0x20}, @NFTA_NAT_REG_ADDR_MIN={0x8, 0x3, 0x1, 0x0, 0x3}]}}}]}, @NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_RULE_CHAIN={0x9, 0x2, 'syz2\x00'}]}], {0x14}}, 0x78}}, 0x0) 0s ago: executing program 1 (id=2681): accept4$llc(0xffffffffffffffff, 0x0, 0x0, 0x80000) r0 = syz_init_net_socket$rose(0xb, 0x5, 0x0) connect$rose(r0, &(0x7f00000000c0)=@short={0xb, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @default, 0x1, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}}, 0x1c) kernel console output (not intermixed with test programs): parsing attributes in process `syz.2.1256'. [ 288.312657][T10383] netlink: 8 bytes leftover after parsing attributes in process `syz.4.1276'. [ 288.392593][T10386] netlink: 8 bytes leftover after parsing attributes in process `syz.2.1265'. [ 288.621120][T10396] netlink: 4 bytes leftover after parsing attributes in process `syz.0.1269'. [ 288.714149][T10396] macvtap2: entered promiscuous mode [ 288.775183][T10396] erspan0: entered promiscuous mode [ 288.781811][T10396] macvtap2: entered allmulticast mode [ 288.788863][T10396] erspan0: entered allmulticast mode [ 289.570590][T10428] 8021q: adding VLAN 0 to HW filter on device bond0 [ 289.591162][T10428] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 289.799409][T10438] lo speed is unknown, defaulting to 1000 [ 289.807151][T10438] lo speed is unknown, defaulting to 1000 [ 291.232871][T10469] __nla_validate_parse: 7 callbacks suppressed [ 291.232893][T10469] netlink: 452 bytes leftover after parsing attributes in process `syz.0.1297'. [ 292.345778][T10493] IPVS: Error joining to the multicast group [ 292.368503][T10502] veth0: entered promiscuous mode [ 292.380141][T10502] netlink: 4 bytes leftover after parsing attributes in process `syz.1.1306'. [ 292.436845][T10505] nbd: nbd0 already in use [ 292.452173][T10504] netlink: 8 bytes leftover after parsing attributes in process `syz.4.1308'. [ 292.473492][T10505] block nbd0: NBD_DISCONNECT [ 292.485789][T10505] block nbd0: Send disconnect failed -107 [ 292.491993][T10505] block nbd0: shutting down sockets [ 292.548883][T10502] veth0 (unregistering): left promiscuous mode [ 292.897984][T10526] lo: entered allmulticast mode [ 293.079235][T10531] GUP no longer grows the stack in syz.0.1314 (10531): 200000006000-20000000a000 (200000005000) [ 293.137940][T10531] CPU: 1 UID: 0 PID: 10531 Comm: syz.0.1314 Not tainted 6.16.0-rc3-syzkaller-00903-g20a0c20f82ac #0 PREEMPT(full) [ 293.137968][T10531] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 293.137980][T10531] Call Trace: [ 293.137988][T10531] [ 293.137996][T10531] dump_stack_lvl+0x189/0x250 [ 293.138058][T10531] ? __pfx_dump_stack_lvl+0x10/0x10 [ 293.138090][T10531] ? __pfx__printk+0x10/0x10 [ 293.138107][T10531] ? find_vma+0xe7/0x160 [ 293.138139][T10531] __get_user_pages+0x2a60/0x30b0 [ 293.138202][T10531] ? __pfx___get_user_pages+0x10/0x10 [ 293.138229][T10531] ? __gup_longterm_locked+0xbf7/0x15b0 [ 293.138257][T10531] ? down_read_killable+0x1d1/0x350 [ 293.138281][T10531] ? try_get_folio+0x633/0x660 [ 293.138314][T10531] __gup_longterm_locked+0xd66/0x15b0 [ 293.138346][T10531] ? try_grab_folio_fast+0x1be/0x4f0 [ 293.138391][T10531] ? gup_fast_fallback+0x1afc/0x2260 [ 293.138423][T10531] gup_fast_fallback+0x1cd4/0x2260 [ 293.138487][T10531] ? __pfx_gup_fast_fallback+0x10/0x10 [ 293.138511][T10531] ? trace_contention_end+0x39/0x120 [ 293.138531][T10531] ? __mutex_lock+0x330/0xe80 [ 293.138553][T10531] ? futex_unqueue+0x22/0x240 [ 293.138571][T10531] ? futex_unqueue+0x22/0x240 [ 293.138587][T10531] ? futex_unqueue+0x22/0x240 [ 293.138605][T10531] ? is_valid_gup_args+0x11f/0x200 [ 293.138633][T10531] ? get_user_pages_fast+0x4d/0xb0 [ 293.138663][T10531] __iov_iter_get_pages_alloc+0x39a/0xb40 [ 293.138701][T10531] ? __pfx_pipe_clear_nowait+0x10/0x10 [ 293.138723][T10531] ? wait_for_space+0x24d/0x2d0 [ 293.138744][T10531] iov_iter_get_pages2+0x5e/0xa0 [ 293.138777][T10531] __se_sys_vmsplice+0x548/0x10d0 [ 293.138817][T10531] ? __pfx___se_sys_vmsplice+0x10/0x10 [ 293.138838][T10531] ? __pfx_futex_wait+0x10/0x10 [ 293.138875][T10531] ? __lock_acquire+0xab9/0xd20 [ 293.138943][T10531] ? rcu_is_watching+0x15/0xb0 [ 293.138982][T10531] ? do_syscall_64+0xbe/0x3b0 [ 293.139009][T10531] do_syscall_64+0xfa/0x3b0 [ 293.139036][T10531] ? lockdep_hardirqs_on+0x9c/0x150 [ 293.139057][T10531] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 293.139077][T10531] ? clear_bhb_loop+0x60/0xb0 [ 293.139101][T10531] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 293.139119][T10531] RIP: 0033:0x7fd1cb38e929 [ 293.139136][T10531] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 293.139153][T10531] RSP: 002b:00007fd1cc215038 EFLAGS: 00000246 ORIG_RAX: 0000000000000116 [ 293.139172][T10531] RAX: ffffffffffffffda RBX: 00007fd1cb5b5fa0 RCX: 00007fd1cb38e929 [ 293.139187][T10531] RDX: 0000000000000001 RSI: 00002000000000c0 RDI: 000000000000000b [ 293.139199][T10531] RBP: 00007fd1cb410b39 R08: 0000000000000000 R09: 0000000000000000 [ 293.139210][T10531] R10: 0000000000000001 R11: 0000000000000246 R12: 0000000000000000 [ 293.139222][T10531] R13: 0000000000000000 R14: 00007fd1cb5b5fa0 R15: 00007ffeb9dc2d38 [ 293.139254][T10531] [ 293.586488][T10536] xt_NFQUEUE: number of queues (65532) out of range (got 66665) [ 293.625465][T10549] tipc: Bearer : already 2 bearers with priority 10 [ 293.663913][T10549] tipc: Bearer : trying with adjusted priority [ 293.672796][T10549] tipc: New replicast peer: 255.255.255.255 [ 293.680257][T10549] tipc: Enabled bearer , priority 9 [ 293.981724][T10558] netlink: 'syz.4.1320': attribute type 1 has an invalid length. [ 294.012364][T10558] netlink: 224 bytes leftover after parsing attributes in process `syz.4.1320'. [ 294.051185][T10558] macvtap2: entered promiscuous mode [ 294.068933][T10558] vlan0: entered promiscuous mode [ 294.075235][T10558] macvtap2: entered allmulticast mode [ 294.080967][T10558] vlan0: entered allmulticast mode [ 294.105187][T10558] veth0_vlan: entered allmulticast mode [ 294.123298][T10558] vlan0: left allmulticast mode [ 294.129988][T10558] veth0_vlan: left allmulticast mode [ 294.135534][T10558] vlan0: left promiscuous mode [ 294.151890][T10565] netlink: 'syz.3.1319': attribute type 16 has an invalid length. [ 294.160320][T10565] netlink: 'syz.3.1319': attribute type 17 has an invalid length. [ 294.224052][T10565] 8021q: adding VLAN 0 to HW filter on device bond0 [ 294.233733][T10565] 8021q: adding VLAN 0 to HW filter on device team0 [ 294.249536][T10565] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 294.450881][T10571] netlink: 8 bytes leftover after parsing attributes in process `syz.4.1322'. [ 294.755052][T10581] netlink: 68 bytes leftover after parsing attributes in process `syz.2.1324'. [ 294.889291][T10589] netlink: 248 bytes leftover after parsing attributes in process `syz.0.1325'. [ 294.919986][T10589] netlink: 48 bytes leftover after parsing attributes in process `syz.0.1325'. [ 294.972280][T10589] rdma_rxe: rxe_newlink: failed to add lo [ 295.001855][T10589] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 295.129461][T10606] !: renamed from dummy0 (while UP) [ 295.156485][T10603] netlink: 72 bytes leftover after parsing attributes in process `syz.2.1330'. [ 295.300759][T10603] tipc: Enabling of bearer rejected, already enabled [ 295.395617][T10609] netlink: 'syz.4.1329': attribute type 16 has an invalid length. [ 295.403878][T10609] netlink: 'syz.4.1329': attribute type 17 has an invalid length. [ 295.476808][T10609] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 295.810212][T10617] lo speed is unknown, defaulting to 1000 [ 295.866478][T10617] lo speed is unknown, defaulting to 1000 [ 296.110289][T10642] netlink: 56 bytes leftover after parsing attributes in process `syz.3.1337'. [ 296.339794][T10652] __nla_validate_parse: 3 callbacks suppressed [ 296.339812][T10652] netlink: 36 bytes leftover after parsing attributes in process `syz.4.1338'. [ 296.342160][T10648] lo speed is unknown, defaulting to 1000 [ 296.368860][T10652] netlink: 16 bytes leftover after parsing attributes in process `syz.4.1338'. [ 296.433240][T10652] netlink: 36 bytes leftover after parsing attributes in process `syz.4.1338'. [ 296.488304][T10652] netlink: 36 bytes leftover after parsing attributes in process `syz.4.1338'. [ 296.526549][T10653] netlink: 72 bytes leftover after parsing attributes in process `syz.3.1339'. [ 296.584020][T10653] tipc: Enabling of bearer rejected, already enabled [ 296.823338][T10665] netlink: 'syz.3.1342': attribute type 10 has an invalid length. [ 296.901652][T10665] 8021q: adding VLAN 0 to HW filter on device team0 [ 296.941068][T10665] bond0: (slave team0): Enslaving as an active interface with an up link [ 296.972868][T10674] IPVS: sync thread started: state = BACKUP, mcast_ifn = lo, syncid = 3, id = 0 [ 297.008042][T10668] lo speed is unknown, defaulting to 1000 [ 297.017757][T10672] netlink: 'syz.2.1343': attribute type 13 has an invalid length. [ 297.025587][T10672] netlink: 'syz.2.1343': attribute type 17 has an invalid length. [ 297.266677][T10648] lo speed is unknown, defaulting to 1000 [ 297.274795][T10679] batadv_slave_1: entered promiscuous mode [ 297.280967][T10679] netlink: 8 bytes leftover after parsing attributes in process `syz.3.1344'. [ 297.630228][T10690] netlink: 8 bytes leftover after parsing attributes in process `syz.3.1349'. [ 297.704846][T10668] lo speed is unknown, defaulting to 1000 [ 297.780532][T10696] netlink: 'syz.1.1348': attribute type 4 has an invalid length. [ 298.325636][T10706] netlink: 72 bytes leftover after parsing attributes in process `syz.3.1352'. [ 298.439105][T10706] tipc: Enabling of bearer rejected, already enabled [ 298.449814][ T7111] lo speed is unknown, defaulting to 1000 [ 298.475215][ T7111] syz0: Port: 1 Link DOWN [ 298.486906][ T7104] lo speed is unknown, defaulting to 1000 [ 298.738607][T10709] lo speed is unknown, defaulting to 1000 [ 298.746310][T10709] lo speed is unknown, defaulting to 1000 [ 299.053573][T10712] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 299.093818][T10712] netlink: 28 bytes leftover after parsing attributes in process `syz.3.1354'. [ 300.015770][T10739] netlink: 24 bytes leftover after parsing attributes in process `syz.3.1361'. [ 300.746564][T10740] lo speed is unknown, defaulting to 1000 [ 300.850794][T10740] lo speed is unknown, defaulting to 1000 [ 301.572146][T10752] __nla_validate_parse: 1 callbacks suppressed [ 301.572163][T10752] netlink: 4 bytes leftover after parsing attributes in process `syz.2.1365'. [ 301.627590][T10752] netlink: 12 bytes leftover after parsing attributes in process `syz.2.1365'. [ 301.807438][T10759] veth0_to_bond: entered allmulticast mode [ 301.818342][T10759] netlink: 76 bytes leftover after parsing attributes in process `syz.1.1367'. [ 302.053879][T10769] netlink: 'syz.4.1370': attribute type 10 has an invalid length. [ 302.174611][T10765] netlink: 1041 bytes leftover after parsing attributes in process `syz.4.1370'. [ 302.855096][T10786] lo speed is unknown, defaulting to 1000 [ 302.863134][T10786] lo speed is unknown, defaulting to 1000 [ 302.877191][T10791] netlink: 'syz.3.1378': attribute type 8 has an invalid length. [ 302.921271][T10789] pim6reg1: entered allmulticast mode [ 303.170736][T10798] xt_hashlimit: size too large, truncated to 1048576 [ 303.677995][T10807] netlink: 32 bytes leftover after parsing attributes in process `syz.4.1382'. [ 304.137820][T10819] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 304.225358][ T7111] lo speed is unknown, defaulting to 1000 [ 304.241990][ T7111] syz0: Port: 1 Link ACTIVE [ 304.262116][T10807] lo speed is unknown, defaulting to 1000 [ 304.285963][ T7111] lo speed is unknown, defaulting to 1000 [ 304.323895][T10807] lo speed is unknown, defaulting to 1000 [ 304.334251][T10830] lo speed is unknown, defaulting to 1000 [ 304.695469][T10830] lo speed is unknown, defaulting to 1000 [ 304.706974][T10839] netlink: 4 bytes leftover after parsing attributes in process `syz.2.1389'. [ 305.099727][T10837] rdma_rxe: rxe_newlink: failed to add batadv_slave_1 [ 305.133364][T10843] netlink: 'syz.3.1390': attribute type 303 has an invalid length. [ 305.179228][T10843] netlink: 8 bytes leftover after parsing attributes in process `syz.3.1390'. [ 305.471849][T10848] netlink: 24 bytes leftover after parsing attributes in process `syz.2.1392'. [ 306.039852][T10869] netlink: 8 bytes leftover after parsing attributes in process `syz.2.1398'. [ 306.050860][T10869] netlink: 32 bytes leftover after parsing attributes in process `syz.2.1398'. [ 306.381215][T10884] netlink: 'syz.3.1404': attribute type 5 has an invalid length. [ 306.395841][T10879] rdma_rxe: rxe_newlink: failed to add batadv_slave_1 [ 306.401718][T10884] netlink: 'syz.3.1404': attribute type 2 has an invalid length. [ 306.750167][ T30] audit: type=1800 audit(1751196722.238:5): pid=10887 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.1.1403" name="memory.events" dev="tmpfs" ino=1413 res=0 errno=0 [ 307.074295][T10896] xfrm1: entered promiscuous mode [ 307.083350][T10896] xfrm1: entered allmulticast mode [ 307.102858][T10896] xt_hashlimit: size too large, truncated to 1048576 [ 307.243217][T10908] __nla_validate_parse: 2 callbacks suppressed [ 307.243235][T10908] netlink: 4 bytes leftover after parsing attributes in process `syz.1.1409'. [ 307.642084][T10918] lo: entered allmulticast mode [ 307.702322][T10919] netlink: 4 bytes leftover after parsing attributes in process `syz.1.1415'. [ 307.760046][T10917] rdma_rxe: rxe_newlink: failed to add batadv_slave_1 [ 307.769930][T10922] netlink: 28 bytes leftover after parsing attributes in process `syz.2.1416'. [ 308.063720][T10929] lo speed is unknown, defaulting to 1000 [ 308.127574][T10929] lo speed is unknown, defaulting to 1000 [ 309.234119][T10960] netlink: 72 bytes leftover after parsing attributes in process `syz.3.1426'. [ 309.270287][T10960] tipc: Enabling of bearer rejected, already enabled [ 309.448327][T10953] netlink: 12 bytes leftover after parsing attributes in process `syz.2.1424'. [ 309.589801][T10969] netlink: 4 bytes leftover after parsing attributes in process `syz.0.1428'. [ 309.657942][T10969] rdma_rxe: rxe_newlink: failed to add batadv_slave_1 [ 309.766504][T10972] netlink: 'syz.2.1429': attribute type 1 has an invalid length. [ 309.808542][T10972] netlink: 'syz.2.1429': attribute type 2 has an invalid length. [ 310.580929][ T30] audit: type=1800 audit(1751196726.068:6): pid=10981 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.3.1430" name="memory.events" dev="tmpfs" ino=1474 res=0 errno=0 [ 311.530568][T11007] netlink: 12 bytes leftover after parsing attributes in process `syz.2.1439'. [ 311.667810][T11018] netlink: 4 bytes leftover after parsing attributes in process `syz.1.1441'. [ 311.924516][T11027] A link change request failed with some changes committed already. Interface syz_tun may have been left with an inconsistent configuration, please check. [ 312.156721][T11021] syzkaller0: entered promiscuous mode [ 312.162608][T11021] syzkaller0: entered allmulticast mode [ 312.270308][T11035] netlink: 8 bytes leftover after parsing attributes in process `syz.3.1447'. [ 312.544006][T11048] netlink: 36 bytes leftover after parsing attributes in process `syz.3.1449'. [ 312.825468][T11051] netlink: 4 bytes leftover after parsing attributes in process `syz.3.1451'. [ 314.158865][T11059] bridge5: entered promiscuous mode [ 314.164165][T11059] bridge5: entered allmulticast mode [ 314.171868][T11059] team0: Port device bridge5 added [ 314.281373][T11051] bond0: (slave team0): Releasing backup interface [ 314.293688][T11051] team0 (unregistering): Port device bridge5 removed [ 314.326783][T11060] lo speed is unknown, defaulting to 1000 [ 314.353607][T11060] lo speed is unknown, defaulting to 1000 [ 314.460773][T11076] netlink: 'syz.3.1457': attribute type 16 has an invalid length. [ 314.470225][T11076] netlink: 'syz.3.1457': attribute type 17 has an invalid length. [ 314.568545][T11082] IPv6: NLM_F_REPLACE set, but no existing node found! [ 314.583727][T11081] netlink: 4 bytes leftover after parsing attributes in process `syz.3.1457'. [ 314.705188][T11085] netlink: 'syz.4.1458': attribute type 12 has an invalid length. [ 314.792197][T11089] netlink: 8 bytes leftover after parsing attributes in process `syz.3.1460'. [ 314.860596][T11087] netlink: 16 bytes leftover after parsing attributes in process `syz.0.1459'. [ 315.068448][T11096] netlink: 36 bytes leftover after parsing attributes in process `syz.3.1461'. [ 315.193454][T11100] !: renamed from dummy0 (while UP) [ 315.439001][T11107] lo speed is unknown, defaulting to 1000 [ 315.466230][T11108] lo speed is unknown, defaulting to 1000 [ 315.466993][T11107] lo speed is unknown, defaulting to 1000 [ 315.689251][T11116] input: Bluetooth HID Boot Protocol Device as /devices/virtual/bluetooth/hci4/hci4:200/input14 [ 316.039179][T11108] lo speed is unknown, defaulting to 1000 [ 316.877711][ T5841] Bluetooth: hci4: command 0x0405 tx timeout [ 317.213972][T11150] IPVS: Schedule: port zero only supported in persistent services, check your ipvs configuration [ 317.730219][T11155] lo speed is unknown, defaulting to 1000 [ 317.785220][T11155] lo speed is unknown, defaulting to 1000 [ 318.379245][T11185] netlink: 72 bytes leftover after parsing attributes in process `syz.1.1478'. [ 318.427907][T11185] tipc: Started in network mode [ 318.435061][T11185] tipc: Node identity , cluster identity 4711 [ 318.478262][T11185] tipc: Failed to obtain node identity [ 318.503067][T11185] tipc: Enabling of bearer rejected, failed to enable media [ 318.914230][T11195] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 318.968665][T11199] netlink: 72 bytes leftover after parsing attributes in process `syz.2.1480'. [ 319.001125][T11195] netlink: 28 bytes leftover after parsing attributes in process `syz.1.1479'. [ 319.037692][T11199] tipc: Enabling of bearer rejected, already enabled [ 320.463126][T11214] netlink: 'syz.3.1486': attribute type 1 has an invalid length. [ 320.821049][T11220] netlink: 8 bytes leftover after parsing attributes in process `syz.1.1487'. [ 321.061673][T11224] netlink: 72 bytes leftover after parsing attributes in process `syz.3.1489'. [ 321.123341][T11224] tipc: Enabling of bearer rejected, already enabled [ 322.183353][T11241] netlink: 112 bytes leftover after parsing attributes in process `syz.3.1491'. [ 322.318611][T11243] openvswitch: netlink: IP tunnel attribute has 20 unknown bytes. [ 322.362054][T11243] block nbd0: NBD_DISCONNECT [ 322.390035][T11247] syz.3.1494 (11247) used obsolete PPPIOCDETACH ioctl [ 322.497066][T11249] netlink: 72 bytes leftover after parsing attributes in process `syz.4.1493'. [ 322.521969][T11249] tipc: Enabling of bearer rejected, already enabled [ 322.624017][T11250] lo speed is unknown, defaulting to 1000 [ 322.666801][T11250] lo speed is unknown, defaulting to 1000 [ 322.713334][T11260] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 322.863368][T11260] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 322.902683][T11271] netlink: 8 bytes leftover after parsing attributes in process `syz.1.1502'. [ 322.964861][T11257] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 323.019246][T11271] netlink: 'syz.1.1502': attribute type 10 has an invalid length. [ 323.027084][T11271] netlink: 40 bytes leftover after parsing attributes in process `syz.1.1502'. [ 323.057277][T11271] team0: Failed to send port change of device geneve0 via netlink (err -105) [ 323.067577][T11271] team0: Failed to send options change via netlink (err -105) [ 323.075327][T11271] team0: Port device geneve0 added [ 323.082660][ T6232] netdevsim netdevsim1 eth0: set [1, 1] type 2 family 0 port 6081 - 0 [ 323.092903][ T6232] netdevsim netdevsim1 eth1: set [1, 1] type 2 family 0 port 6081 - 0 [ 323.115533][ T6232] netdevsim netdevsim1 eth2: set [1, 1] type 2 family 0 port 6081 - 0 [ 323.134213][ T6232] netdevsim netdevsim1 eth3: set [1, 1] type 2 family 0 port 6081 - 0 [ 323.260606][T11277] netlink: 8 bytes leftover after parsing attributes in process `syz.1.1503'. [ 323.436170][T11283] netlink: 4 bytes leftover after parsing attributes in process `syz.0.1505'. [ 323.473756][T11282] lo speed is unknown, defaulting to 1000 [ 323.475838][T11283] netlink: 4 bytes leftover after parsing attributes in process `syz.0.1505'. [ 323.483395][T11282] lo speed is unknown, defaulting to 1000 [ 324.032522][T11297] netlink: 4 bytes leftover after parsing attributes in process `syz.3.1510'. [ 324.069304][T11294] netlink: 72 bytes leftover after parsing attributes in process `syz.2.1509'. [ 324.094054][T11294] tipc: Enabling of bearer rejected, already enabled [ 324.116898][T11284] xt_CT: No such helper "snmp" [ 324.308355][T11303] netlink: 72 bytes leftover after parsing attributes in process `syz.4.1511'. [ 324.320867][T11303] tipc: Enabling of bearer rejected, already enabled [ 324.577490][T11309] netlink: 'syz.0.1513': attribute type 10 has an invalid length. [ 324.585437][T11309] openvswitch: netlink: Flow key attr not present in new flow. [ 324.668208][T11310] sctp: [Deprecated]: syz.0.1513 (pid 11310) Use of int in max_burst socket option deprecated. [ 324.668208][T11310] Use struct sctp_assoc_value instead [ 325.053431][T11325] wireguard0: entered promiscuous mode [ 325.062197][T11325] wireguard0: entered allmulticast mode [ 325.103763][T11324] tap0: tun_chr_ioctl cmd 1074025677 [ 325.124385][T11324] tap0: linktype set to 0 [ 325.292071][T11331] lo speed is unknown, defaulting to 1000 [ 325.299713][T11331] lo speed is unknown, defaulting to 1000 [ 325.344404][T11332] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 325.417420][T11332] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 325.490072][T11332] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 325.553139][T11336] netlink: 4 bytes leftover after parsing attributes in process `syz.4.1522'. [ 325.574441][T11336] geneve3: entered promiscuous mode [ 325.580083][T11336] geneve3: entered allmulticast mode [ 325.594761][ T49] netdevsim netdevsim4 eth0: set [1, 0] type 2 family 0 port 53713 - 0 [ 325.603451][ T49] netdevsim netdevsim4 eth1: set [1, 0] type 2 family 0 port 53713 - 0 [ 325.629068][ T49] netdevsim netdevsim4 eth2: set [1, 0] type 2 family 0 port 53713 - 0 [ 325.638225][ T49] netdevsim netdevsim4 eth3: set [1, 0] type 2 family 0 port 53713 - 0 [ 325.851075][T11339] tipc: Resetting bearer [ 325.959874][T11339] ip6gretap0: left allmulticast mode [ 325.979915][T11339] macvtap1: left promiscuous mode [ 325.992674][T11339] macvtap1: left allmulticast mode [ 326.043091][T11339] gretap1: left promiscuous mode [ 326.072485][T11339] xfrm1: left promiscuous mode [ 326.107352][T11339] xfrm1: left allmulticast mode [ 326.144101][T11339] geneve3: left promiscuous mode [ 326.151830][T11339] geneve3: left allmulticast mode [ 326.166188][T11347] netlink: 72 bytes leftover after parsing attributes in process `syz.0.1525'. [ 326.175555][T11347] tipc: Enabling of bearer rejected, already enabled [ 326.184422][ T6232] netdevsim netdevsim4 eth0: unset [1, 0] type 2 family 0 port 53713 - 0 [ 326.226810][ T6232] netdevsim netdevsim4 eth1: unset [1, 0] type 2 family 0 port 53713 - 0 [ 326.309908][ T6232] netdevsim netdevsim4 eth2: unset [1, 0] type 2 family 0 port 53713 - 0 [ 326.350029][ T6232] netdevsim netdevsim4 eth3: unset [1, 0] type 2 family 0 port 53713 - 0 [ 326.476597][T11358] netlink: 4 bytes leftover after parsing attributes in process `syz.3.1527'. [ 326.500570][T11364] netlink: 12 bytes leftover after parsing attributes in process `syz.4.1531'. [ 326.521662][T11363] netlink: 8 bytes leftover after parsing attributes in process `syz.0.1528'. [ 326.622268][T11367] netlink: 'syz.0.1528': attribute type 10 has an invalid length. [ 326.631032][T11367] A link change request failed with some changes committed already. Interface geneve0 may have been left with an inconsistent configuration, please check. [ 327.010715][T11378] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 327.157731][T11391] lo speed is unknown, defaulting to 1000 [ 327.173173][T11391] lo speed is unknown, defaulting to 1000 [ 327.316919][T11392] tipc: Enabling of bearer rejected, already enabled [ 327.393485][T11389] lo speed is unknown, defaulting to 1000 [ 327.587841][T11399] lo speed is unknown, defaulting to 1000 [ 327.608002][T11389] lo speed is unknown, defaulting to 1000 [ 328.256073][T11416] geneve3: entered promiscuous mode [ 328.265776][T11416] geneve3: entered allmulticast mode [ 328.280361][ T49] netdevsim netdevsim0 eth0: set [1, 0] type 2 family 0 port 39335 - 0 [ 328.309199][ T49] netdevsim netdevsim0 eth1: set [1, 0] type 2 family 0 port 39335 - 0 [ 328.328742][ T49] netdevsim netdevsim0 eth2: set [1, 0] type 2 family 0 port 39335 - 0 [ 328.356517][T11399] lo speed is unknown, defaulting to 1000 [ 328.367958][ T49] netdevsim netdevsim0 eth3: set [1, 0] type 2 family 0 port 39335 - 0 [ 328.771975][T11403] lo speed is unknown, defaulting to 1000 [ 328.970132][T11403] lo speed is unknown, defaulting to 1000 [ 330.929536][T11436] __nla_validate_parse: 6 callbacks suppressed [ 330.929555][T11436] netlink: 4 bytes leftover after parsing attributes in process `syz.0.1550'. [ 331.313137][T11447] netlink: 8 bytes leftover after parsing attributes in process `syz.0.1555'. [ 331.530956][T11452] x_tables: ip_tables: rpfilter match: used from hooks FORWARD, but only valid from PREROUTING [ 331.740362][T11462] netlink: 24 bytes leftover after parsing attributes in process `syz.0.1559'. [ 331.898729][ T30] audit: type=1800 audit(1751196747.388:7): pid=11458 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.3.1556" name="memory.events" dev="tmpfs" ino=1620 res=0 errno=0 [ 332.014896][T11467] netlink: 4 bytes leftover after parsing attributes in process `syz.4.1562'. [ 332.255974][T11476] netlink: 136 bytes leftover after parsing attributes in process `syz.4.1566'. [ 332.269656][T11476] !: renamed from dummy0 [ 332.666434][T11488] batadv_slave_1: left promiscuous mode [ 332.684196][T11488] bridge5: left promiscuous mode [ 332.692953][T11488] bridge5: left allmulticast mode [ 332.779299][T11496] netlink: 8 bytes leftover after parsing attributes in process `syz.1.1570'. [ 333.351287][T11513] lo speed is unknown, defaulting to 1000 [ 333.363198][T11513] lo speed is unknown, defaulting to 1000 [ 333.624792][T11522] netlink: 72 bytes leftover after parsing attributes in process `syz.4.1574'. [ 333.660724][T11522] tipc: Enabling of bearer rejected, already enabled [ 333.806344][T11528] netlink: 4 bytes leftover after parsing attributes in process `syz.2.1576'. [ 333.986010][T11536] netlink: 8 bytes leftover after parsing attributes in process `syz.0.1577'. [ 334.099302][T11540] xfrm2: entered promiscuous mode [ 334.104521][T11540] xfrm2: entered allmulticast mode [ 334.170046][T11540] xt_hashlimit: size too large, truncated to 1048576 [ 334.492145][T11552] netlink: 8 bytes leftover after parsing attributes in process `syz.2.1581'. [ 334.695370][T11561] IPVS: set_ctl: invalid protocol: 98 127.0.0.1:20003 [ 335.977077][T11594] __nla_validate_parse: 3 callbacks suppressed [ 335.977095][T11594] netlink: 8 bytes leftover after parsing attributes in process `syz.3.1595'. [ 336.209709][T11605] tap0: tun_chr_ioctl cmd 1074025677 [ 336.318677][T11605] tap0: linktype set to 0 [ 336.523859][T11613] ip6gretap0: left allmulticast mode [ 336.552119][T11613] macvtap1: left promiscuous mode [ 336.570422][T11613] macvtap1: left allmulticast mode [ 336.654784][ T43] lo speed is unknown, defaulting to 1000 [ 336.660714][ T43] syz2: Port: 1 Link DOWN [ 336.719448][T11614] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 337.270735][T11635] netlink: 4 bytes leftover after parsing attributes in process `syz.0.1602'. [ 337.313718][T11621] lo speed is unknown, defaulting to 1000 [ 337.394212][T11621] lo speed is unknown, defaulting to 1000 [ 337.583862][T11641] netlink: 'syz.0.1603': attribute type 9 has an invalid length. [ 337.611264][T11641] netlink: 'syz.0.1603': attribute type 6 has an invalid length. [ 337.755561][T11647] netlink: 'syz.1.1604': attribute type 303 has an invalid length. [ 337.821456][T11643] netlink: 8 bytes leftover after parsing attributes in process `syz.1.1604'. [ 338.128374][T11653] netlink: 4 bytes leftover after parsing attributes in process `syz.3.1605'. [ 338.147490][ T5841] Bluetooth: hci4: command 0x0405 tx timeout [ 338.348651][T11661] netlink: 72 bytes leftover after parsing attributes in process `syz.0.1607'. [ 338.363391][T11661] tipc: Enabling of bearer rejected, already enabled [ 338.816078][T11670] netlink: 8 bytes leftover after parsing attributes in process `syz.1.1608'. [ 339.228652][T11679] netlink: 48 bytes leftover after parsing attributes in process `syz.1.1612'. [ 339.293135][T11677] lo speed is unknown, defaulting to 1000 [ 339.325487][T11677] lo speed is unknown, defaulting to 1000 [ 339.726000][T11682] netlink: 'syz.3.1613': attribute type 12 has an invalid length. [ 340.022979][T11686] netlink: 4 bytes leftover after parsing attributes in process `syz.1.1614'. [ 340.069556][T11688] netlink: 'syz.3.1616': attribute type 13 has an invalid length. [ 340.235943][T11693] netlink: 'syz.0.1615': attribute type 3 has an invalid length. [ 340.555036][T11615] Set syz1 is full, maxelem 65536 reached [ 341.167848][T11704] netlink: 4 bytes leftover after parsing attributes in process `syz.0.1620'. [ 341.174767][T11702] netlink: 'syz.2.1617': attribute type 1 has an invalid length. [ 341.209297][T11702] 8021q: adding VLAN 0 to HW filter on device bond3 [ 341.260355][T11702] bond3: (slave veth0_to_bond): Enslaving as an active interface with a down link [ 341.286792][T11702] vlan1: entered allmulticast mode [ 341.298979][T11702] bond3: (slave vlan1): Opening slave failed [ 341.419115][T11713] netlink: 72 bytes leftover after parsing attributes in process `syz.4.1621'. [ 341.437345][T11713] tipc: Enabling of bearer rejected, already enabled [ 341.673820][T11724] netlink: 'syz.2.1626': attribute type 12 has an invalid length. [ 341.687139][T11728] netlink: 4 bytes leftover after parsing attributes in process `syz.4.1628'. [ 342.086785][T11736] bond3: (slave veth0_to_bond): Releasing active interface [ 342.127501][T11736] bond2: left allmulticast mode [ 342.140522][T11736] bond2: left promiscuous mode [ 342.145553][T11736] bridge0: port 1(bond2) entered disabled state [ 342.205675][T11742] netlink: 4 bytes leftover after parsing attributes in process `syz.1.1632'. [ 342.227821][T11743] lo speed is unknown, defaulting to 1000 [ 342.294588][T11745] netlink: 4 bytes leftover after parsing attributes in process `syz.1.1632'. [ 342.332451][T11743] lo speed is unknown, defaulting to 1000 [ 342.658415][T11751] netlink: 4 bytes leftover after parsing attributes in process `syz.1.1634'. [ 342.728474][T11753] netlink: 'syz.0.1635': attribute type 1 has an invalid length. [ 342.737498][T11738] netlink: 156 bytes leftover after parsing attributes in process `syz.4.1631'. [ 342.757193][T11753] netlink: 4 bytes leftover after parsing attributes in process `syz.0.1635'. [ 342.787682][T11753] netlink: 16 bytes leftover after parsing attributes in process `syz.0.1635'. [ 343.032554][T11763] netlink: 8 bytes leftover after parsing attributes in process `syz.2.1640'. [ 343.448955][T11767] tipc: Enabling of bearer rejected, already enabled [ 345.739364][T11829] lo speed is unknown, defaulting to 1000 [ 345.747134][T11829] lo speed is unknown, defaulting to 1000 [ 345.776466][T11840] tipc: Bearer : already 2 bearers with priority 10 [ 345.847685][T11840] tipc: Bearer : trying with adjusted priority [ 345.856901][T11840] tipc: Enabling of bearer rejected, failed to enable media [ 346.170957][T11848] netlink: 'syz.1.1655': attribute type 12 has an invalid length. [ 346.438291][T11859] __nla_validate_parse: 5 callbacks suppressed [ 346.438308][T11859] netlink: 72 bytes leftover after parsing attributes in process `syz.3.1657'. [ 346.479758][T11859] tipc: Enabling of bearer rejected, already enabled [ 346.713143][T11865] IPVS: Schedule: port zero only supported in persistent services, check your ipvs configuration [ 346.898425][T11860] lo speed is unknown, defaulting to 1000 [ 346.926823][T11860] lo speed is unknown, defaulting to 1000 [ 346.942408][T11857] lo speed is unknown, defaulting to 1000 [ 347.187195][T11878] xt_CHECKSUM: unsupported CHECKSUM operation 68 [ 347.219011][T11879] netlink: 72 bytes leftover after parsing attributes in process `syz.3.1663'. [ 347.288321][T11879] tipc: Enabling of bearer rejected, already enabled [ 347.342765][T11878] lo speed is unknown, defaulting to 1000 [ 347.380147][T11880] netlink: 8 bytes leftover after parsing attributes in process `syz.1.1662'. [ 347.396665][T11880] netlink: 8 bytes leftover after parsing attributes in process `syz.1.1662'. [ 347.410374][T11880] netlink: 8 bytes leftover after parsing attributes in process `syz.1.1662'. [ 347.459384][T11880] netlink: 8 bytes leftover after parsing attributes in process `syz.1.1662'. [ 347.483889][T11880] netlink: 8 bytes leftover after parsing attributes in process `syz.1.1662'. [ 347.510744][T11880] netlink: 8 bytes leftover after parsing attributes in process `syz.1.1662'. [ 347.534890][T11880] netlink: 8 bytes leftover after parsing attributes in process `syz.1.1662'. [ 347.636223][T11880] netlink: 8 bytes leftover after parsing attributes in process `syz.1.1662'. [ 347.683322][T11857] lo speed is unknown, defaulting to 1000 [ 347.726054][T11886] lo speed is unknown, defaulting to 1000 [ 347.935585][T11890] IPVS: Scheduler module ip_vs_sip not found [ 348.088223][T11878] lo speed is unknown, defaulting to 1000 [ 348.302377][T11904] netlink: zone id is out of range [ 348.325993][T11904] netlink: zone id is out of range [ 348.337104][T11904] netlink: zone id is out of range [ 348.355714][T11905] tipc: Enabling of bearer rejected, already enabled [ 348.363357][T11904] netlink: zone id is out of range [ 348.376811][T11904] netlink: zone id is out of range [ 348.382014][T11904] netlink: zone id is out of range [ 348.387154][T11904] netlink: zone id is out of range [ 348.393533][T11904] netlink: zone id is out of range [ 348.400583][T11904] netlink: zone id is out of range [ 348.405798][T11904] netlink: zone id is out of range [ 348.484666][T11886] lo speed is unknown, defaulting to 1000 [ 348.920617][T11913] Cannot find add_set index 0 as target [ 349.168279][T11915] netlink: 'syz.3.1673': attribute type 12 has an invalid length. [ 349.787035][T11925] bridge0: port 1(veth1) entered blocking state [ 349.794819][T11925] bridge0: port 1(veth1) entered disabled state [ 349.820843][T11925] veth1: entered allmulticast mode [ 349.840950][T11925] veth1: entered promiscuous mode [ 349.853087][T11927] veth0_to_bond: left allmulticast mode [ 349.859134][T11927] bridge0: port 2(veth0_to_bond) entered blocking state [ 349.869363][T11927] bridge0: port 2(veth0_to_bond) entered disabled state [ 349.898665][T11927] veth0_to_bond: entered allmulticast mode [ 349.921286][T11927] veth0_to_bond: entered promiscuous mode [ 349.935589][T11926] tipc: Enabling of bearer rejected, already enabled [ 350.124758][T11925] vlan0: entered allmulticast mode [ 350.137943][T11925] bridge0: port 3(vlan0) entered blocking state [ 350.146478][T11925] bridge0: port 3(vlan0) entered disabled state [ 350.155877][T11925] vlan0: entered promiscuous mode [ 350.188325][T11931] tipc: New replicast peer: 255.255.255.255 [ 350.213196][T11931] tipc: Enabled bearer , priority 10 [ 350.290525][T11936] vxcan3: entered allmulticast mode [ 350.488424][T11951] tipc: Enabling of bearer rejected, already enabled [ 350.886614][T11953] bond0 (unregistering): Released all slaves [ 350.941881][T11959] sch_tbf: burst 4398 is lower than device lo mtu (39799) ! [ 351.042600][T11966] lo speed is unknown, defaulting to 1000 [ 351.050626][T11966] lo speed is unknown, defaulting to 1000 [ 351.190443][T11969] lo speed is unknown, defaulting to 1000 [ 351.244114][T11974] netlink: 'syz.0.1688': attribute type 12 has an invalid length. [ 351.287135][T11972] input: Bluetooth HID Boot Protocol Device as /devices/virtual/bluetooth/hci4/hci4:200/input15 [ 351.412458][ T9873] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 351.442905][ T9873] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 351.525452][T11984] __nla_validate_parse: 19 callbacks suppressed [ 351.525472][T11984] netlink: 4 bytes leftover after parsing attributes in process `syz.4.1691'. [ 351.590208][T11988] netlink: 8 bytes leftover after parsing attributes in process `syz.1.1692'. [ 351.616091][T11969] lo speed is unknown, defaulting to 1000 [ 351.631162][T11990] netlink: 72 bytes leftover after parsing attributes in process `syz.2.1690'. [ 351.647629][T11990] tipc: Enabling of bearer rejected, already enabled [ 351.934566][T11995] lo: entered allmulticast mode [ 351.974643][T11995] lo: left allmulticast mode [ 352.114925][T11998] netlink: 'syz.1.1695': attribute type 12 has an invalid length. [ 352.151785][T11989] rdma_rxe: rxe_newlink: failed to add batadv_slave_1 [ 352.279115][T12003] netlink: 72 bytes leftover after parsing attributes in process `syz.2.1696'. [ 352.313457][T12003] tipc: Enabling of bearer rejected, already enabled [ 352.381596][T12008] netlink: 8 bytes leftover after parsing attributes in process `syz.4.1698'. [ 352.982081][T12018] netlink: 8 bytes leftover after parsing attributes in process `syz.2.1700'. [ 353.078855][T12018] infiniband syz1: RDMA CMA: cma_listen_on_dev, error -98 [ 353.163145][T12027] netlink: 8 bytes leftover after parsing attributes in process `syz.1.1701'. [ 353.272256][T12033] netlink: 4 bytes leftover after parsing attributes in process `syz.3.1702'. [ 353.400690][T12032] netlink: 4 bytes leftover after parsing attributes in process `syz.0.1703'. [ 353.412861][T12036] netlink: 8 bytes leftover after parsing attributes in process `syz.1.1704'. [ 353.554776][T12042] lo: entered allmulticast mode [ 353.837017][T12042] lo: left allmulticast mode [ 353.850849][T12044] vlan0: left promiscuous mode [ 353.856086][T12044] bridge0: port 3(vlan0) entered disabled state [ 353.896049][T12044] veth0_to_bond: left allmulticast mode [ 353.913501][T12044] veth0_to_bond: left promiscuous mode [ 353.964839][T12044] bridge0: port 2(veth0_to_bond) entered disabled state [ 354.054303][T12044] veth1: left promiscuous mode [ 354.087645][T12044] bridge0: port 1(veth1) entered disabled state [ 354.366555][T12056] tipc: Enabling of bearer rejected, already enabled [ 354.577039][T12059] netlink: 'syz.0.1711': attribute type 12 has an invalid length. [ 354.634509][T12060] lo speed is unknown, defaulting to 1000 [ 354.655028][T12060] lo speed is unknown, defaulting to 1000 [ 355.150834][T12075] rdma_rxe: rxe_newlink: failed to add batadv_slave_1 [ 356.346059][T12099] tipc: Enabling of bearer rejected, already enabled [ 356.817818][T12110] __nla_validate_parse: 10 callbacks suppressed [ 356.817838][T12110] netlink: 8 bytes leftover after parsing attributes in process `syz.1.1726'. [ 356.866683][T12109] bond1: (slave gretap1): Releasing active interface [ 356.889749][T12117] netlink: 4 bytes leftover after parsing attributes in process `syz.3.1728'. [ 356.924666][T12121] netlink: 8 bytes leftover after parsing attributes in process `syz.2.1730'. [ 356.963819][T12112] rdma_rxe: rxe_newlink: failed to add batadv_slave_1 [ 356.998344][T12109] ip6gretap0: left promiscuous mode [ 357.006952][T12109] 8021q: adding VLAN 0 to HW filter on device team0 [ 357.020259][T12109] net_ratelimit: 4059 callbacks suppressed [ 357.020267][T12109] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 357.106758][T12122] netlink: 'syz.0.1731': attribute type 12 has an invalid length. [ 357.152958][T12110] netlink: 'syz.1.1726': attribute type 10 has an invalid length. [ 357.161100][T12110] netlink: 40 bytes leftover after parsing attributes in process `syz.1.1726'. [ 357.193832][T12110] team0: Failed to send port change of device geneve0 via netlink (err -105) [ 357.222254][T12130] netlink: 8 bytes leftover after parsing attributes in process `syz.3.1732'. [ 357.239957][ T3452] netdevsim netdevsim1 eth0: unset [1, 1] type 2 family 0 port 6081 - 0 [ 357.365241][ T3452] netdevsim netdevsim1 eth1: unset [1, 1] type 2 family 0 port 6081 - 0 [ 357.377121][ T3452] netdevsim netdevsim1 eth2: unset [1, 1] type 2 family 0 port 6081 - 0 [ 357.448509][ T3452] netdevsim netdevsim1 eth3: unset [1, 1] type 2 family 0 port 6081 - 0 [ 357.602454][T12145] netlink: 4 bytes leftover after parsing attributes in process `syz.2.1736'. [ 357.724710][T12149] lo: entered allmulticast mode [ 357.738994][T12149] lo: left allmulticast mode [ 357.854000][T12153] netlink: 4 bytes leftover after parsing attributes in process `syz.2.1739'. [ 357.926666][T12157] netlink: 'syz.2.1739': attribute type 7 has an invalid length. [ 358.974418][T12184] lo speed is unknown, defaulting to 1000 [ 359.027054][T12184] lo speed is unknown, defaulting to 1000 [ 359.095954][T12195] netlink: 4 bytes leftover after parsing attributes in process `syz.2.1749'. [ 359.192740][T12201] lo: left allmulticast mode [ 359.260261][T12200] netlink: 'syz.1.1751': attribute type 1 has an invalid length. [ 359.273901][T12200] netlink: 'syz.1.1751': attribute type 1 has an invalid length. [ 359.307469][T12200] netlink: 192 bytes leftover after parsing attributes in process `syz.1.1751'. [ 359.494795][T12213] netlink: 56 bytes leftover after parsing attributes in process `syz.2.1754'. [ 359.573208][T12213] syzkaller1: entered promiscuous mode [ 359.591485][T12213] syzkaller1: entered allmulticast mode [ 360.420337][T12222] lo speed is unknown, defaulting to 1000 [ 360.566831][T12222] lo speed is unknown, defaulting to 1000 [ 360.657561][T12245] lo: entered allmulticast mode [ 360.670021][T12245] lo: left allmulticast mode [ 360.821045][T12251] openvswitch: netlink: Unexpected mask (mask=200040, allowed=10048) [ 361.138645][T12257] IPVS: Error joining to the multicast group [ 361.610699][T12274] lo: entered allmulticast mode [ 361.796435][T12278] lo: left allmulticast mode [ 361.870270][T12280] __nla_validate_parse: 6 callbacks suppressed [ 361.870288][T12280] netlink: 36 bytes leftover after parsing attributes in process `syz.0.1774'. [ 361.931977][T12280] netlink: 16 bytes leftover after parsing attributes in process `syz.0.1774'. [ 361.981815][T12282] netlink: 32 bytes leftover after parsing attributes in process `syz.3.1776'. [ 361.987380][T12280] netlink: 36 bytes leftover after parsing attributes in process `syz.0.1774'. [ 362.010039][T12280] netlink: 36 bytes leftover after parsing attributes in process `syz.0.1774'. [ 362.103573][T12290] netlink: 8 bytes leftover after parsing attributes in process `syz.3.1776'. [ 362.178203][T12285] netlink: 4 bytes leftover after parsing attributes in process `syz.2.1778'. [ 362.180439][T12287] netlink: 4 bytes leftover after parsing attributes in process `syz.4.1777'. [ 362.274187][T12279] lo speed is unknown, defaulting to 1000 [ 362.366251][T12294] netlink: 24 bytes leftover after parsing attributes in process `syz.1.1779'. [ 362.382551][T12289] netlink: 32 bytes leftover after parsing attributes in process `syz.3.1776'. [ 362.399821][T12279] lo speed is unknown, defaulting to 1000 [ 362.522184][T12294] lo speed is unknown, defaulting to 1000 [ 362.703428][T12294] lo speed is unknown, defaulting to 1000 [ 363.105793][T12313] netlink: 'syz.2.1784': attribute type 5 has an invalid length. [ 363.367086][T12320] lo: left allmulticast mode [ 363.626604][T12329] netlink: 'syz.4.1791': attribute type 1 has an invalid length. [ 363.809773][T12329] 8021q: adding VLAN 0 to HW filter on device bond2 [ 363.958972][T12329] bond2: (slave gretap2): making interface the new active one [ 363.984667][T12329] bond2: (slave gretap2): Enslaving as an active interface with an up link [ 364.005023][T12332] lo speed is unknown, defaulting to 1000 [ 364.031890][T12327] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 364.042045][T12332] lo speed is unknown, defaulting to 1000 [ 364.053952][T12328] lo speed is unknown, defaulting to 1000 [ 364.320487][T12328] lo speed is unknown, defaulting to 1000 [ 364.589890][T12355] syzkaller1: entered promiscuous mode [ 364.606595][T12355] syzkaller1: entered allmulticast mode [ 365.437927][T12387] netlink: 'syz.0.1803': attribute type 29 has an invalid length. [ 365.679103][T12392] netlink: 'syz.4.1804': attribute type 12 has an invalid length. [ 366.114513][T12398] lo speed is unknown, defaulting to 1000 [ 366.129537][T12398] lo speed is unknown, defaulting to 1000 [ 367.053417][T12435] netlink: 'syz.1.1817': attribute type 1 has an invalid length. [ 367.091954][T12435] netlink: 'syz.1.1817': attribute type 1 has an invalid length. [ 367.102359][T12436] xt_CHECKSUM: unsupported CHECKSUM operation 68 [ 367.240096][T12442] __nla_validate_parse: 3 callbacks suppressed [ 367.240114][T12442] netlink: 56 bytes leftover after parsing attributes in process `syz.3.1819'. [ 367.281289][T12445] netlink: 8 bytes leftover after parsing attributes in process `syz.4.1816'. [ 367.323864][T12445] netlink: 8 bytes leftover after parsing attributes in process `syz.4.1816'. [ 367.368957][T12445] netlink: 8 bytes leftover after parsing attributes in process `syz.4.1816'. [ 367.394058][T12445] netlink: 8 bytes leftover after parsing attributes in process `syz.4.1816'. [ 367.412562][T12445] netlink: 8 bytes leftover after parsing attributes in process `syz.4.1816'. [ 367.423237][T12445] netlink: 8 bytes leftover after parsing attributes in process `syz.4.1816'. [ 367.435946][T12445] netlink: 8 bytes leftover after parsing attributes in process `syz.4.1816'. [ 367.465994][T12445] netlink: 8 bytes leftover after parsing attributes in process `syz.4.1816'. [ 367.488037][T12445] netlink: 8 bytes leftover after parsing attributes in process `syz.4.1816'. [ 367.537418][T12449] netlink: 'syz.1.1820': attribute type 1 has an invalid length. [ 367.585606][T12436] lo speed is unknown, defaulting to 1000 [ 367.600145][ T1088] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 367.611102][T12436] lo speed is unknown, defaulting to 1000 [ 367.624660][ T1088] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 367.630401][T12454] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 367.790362][T12457] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 368.004329][T12460] lo speed is unknown, defaulting to 1000 [ 368.022039][T12460] lo speed is unknown, defaulting to 1000 [ 368.046709][T12461] af_packet: tpacket_rcv: packet too big, clamped from 3954 to 3710. macoff=82 [ 368.735487][T12469] netlink: 'syz.2.1825': attribute type 16 has an invalid length. [ 368.743447][T12469] netlink: 'syz.2.1825': attribute type 17 has an invalid length. [ 368.813742][T12469] ip6gretap0: left promiscuous mode [ 368.826944][T12469] 8021q: adding VLAN 0 to HW filter on device bond0 [ 368.847448][T12469] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 368.877581][ T43] lo speed is unknown, defaulting to 1000 [ 368.883334][ T43] syz2: Port: 1 Link ACTIVE [ 368.971491][T12483] netlink: 'syz.1.1828': attribute type 1 has an invalid length. [ 369.103878][T12488] syzkaller1: entered promiscuous mode [ 369.109854][T12488] syzkaller1: entered allmulticast mode [ 369.164643][T12483] 8021q: adding VLAN 0 to HW filter on device bond0 [ 369.348024][T12487] veth9: entered promiscuous mode [ 369.379232][T12498] rdma_rxe: rxe_newlink: failed to add batadv_slave_1 [ 369.411383][T12487] bond0: (slave veth9): Enslaving as a backup interface with a down link [ 369.509950][T12483] team0: Port device geneve0 removed [ 369.558999][T12483] bond0: (slave veth9): Releasing backup interface [ 369.612306][T12500] lo speed is unknown, defaulting to 1000 [ 369.619956][T12500] lo speed is unknown, defaulting to 1000 [ 369.878447][T12513] netlink: 'syz.4.1837': attribute type 12 has an invalid length. [ 370.271003][T12522] xt_cgroup: path and classid specified [ 370.306507][T12522] netlink: zone id is out of range [ 370.313078][T12522] netlink: zone id is out of range [ 370.328352][T12522] netlink: zone id is out of range [ 370.347180][T12522] netlink: zone id is out of range [ 370.376005][T12522] netlink: zone id is out of range [ 370.420005][T12522] netlink: zone id is out of range [ 370.425162][T12522] netlink: zone id is out of range [ 370.436389][T12522] netlink: zone id is out of range [ 370.449837][T12526] netlink: 'syz.3.1839': attribute type 4 has an invalid length. [ 370.491938][T12522] netlink: zone id is out of range [ 370.543593][T12526] netlink: 'syz.3.1839': attribute type 2 has an invalid length. [ 370.930799][T12543] netlink: 'syz.4.1848': attribute type 12 has an invalid length. [ 370.959665][T12539] lo speed is unknown, defaulting to 1000 [ 370.966812][T12539] lo speed is unknown, defaulting to 1000 [ 371.231707][T12557] netlink: 'syz.2.1851': attribute type 13 has an invalid length. [ 371.279397][T12557] netlink: 'syz.2.1851': attribute type 17 has an invalid length. [ 371.458367][T12564] netlink: 'syz.3.1854': attribute type 10 has an invalid length. [ 371.482614][T12557] gretap0: refused to change device tx_queue_len [ 371.501484][ T7111] lo speed is unknown, defaulting to 1000 [ 371.509223][ T7111] syz2: Port: 1 Link DOWN [ 371.538233][T12555] lo speed is unknown, defaulting to 1000 [ 371.668152][ T9873] wlan0: Trigger new scan to find an IBSS to join [ 371.755475][T12555] lo speed is unknown, defaulting to 1000 [ 372.384313][T12581] __nla_validate_parse: 19 callbacks suppressed [ 372.384332][T12581] netlink: 12 bytes leftover after parsing attributes in process `syz.1.1859'. [ 372.452601][T12581] netlink: 8 bytes leftover after parsing attributes in process `syz.1.1859'. [ 372.467026][T12586] netlink: 4 bytes leftover after parsing attributes in process `syz.4.1861'. [ 373.156531][T12593] netlink: 20 bytes leftover after parsing attributes in process `syz.3.1862'. [ 373.380173][T12596] netlink: 72 bytes leftover after parsing attributes in process `syz.3.1864'. [ 373.399492][T12596] tipc: Enabling of bearer rejected, already enabled [ 373.793599][T12606] netlink: 'syz.2.1868': attribute type 4 has an invalid length. [ 373.999882][T12622] xt_hashlimit: size too large, truncated to 1048576 [ 374.011146][T12622] xt_hashlimit: overflow, try lower: 3/0 [ 374.091773][T12613] netlink: 8 bytes leftover after parsing attributes in process `syz.0.1869'. [ 374.135172][T12624] lo speed is unknown, defaulting to 1000 [ 374.163306][T12624] lo speed is unknown, defaulting to 1000 [ 374.684668][T12641] netlink: 72 bytes leftover after parsing attributes in process `syz.3.1876'. [ 374.725710][T12641] tipc: Enabling of bearer rejected, already enabled [ 374.798638][T12645] netlink: 104 bytes leftover after parsing attributes in process `syz.0.1875'. [ 375.003054][T12645] netlink: 8 bytes leftover after parsing attributes in process `syz.0.1875'. [ 375.068824][T12650] Bluetooth: hci0: Opcode 0x080f failed: -22 [ 375.091059][T12647] netlink: 9 bytes leftover after parsing attributes in process `syz.0.1875'. [ 375.111651][T12647] gretap0: entered promiscuous mode [ 375.151886][T12653] batadv0: entered promiscuous mode [ 375.157140][T12653] batadv0: entered allmulticast mode [ 375.345270][T12663] syzkaller1: entered promiscuous mode [ 375.357043][T12663] syzkaller1: entered allmulticast mode [ 375.372892][T12663] x_tables: duplicate underflow at hook 2 [ 375.667353][ T6232] wlan0: Trigger new scan to find an IBSS to join [ 375.714450][ T7115] hid-generic 0005:16BF:5505.0002: unknown main item tag 0x0 [ 375.724452][T12683] tipc: Enabling of bearer rejected, already enabled [ 375.744739][ T7115] hid-generic 0005:16BF:5505.0002: unknown main item tag 0x0 [ 375.785961][ T7115] hid-generic 0005:16BF:5505.0002: hidraw0: BLUETOOTH HID vc3.b8 Device [syz0] on aa:aa:aa:aa:aa:aa [ 376.565974][ T9873] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 377.109251][ T5841] Bluetooth: hci0: command tx timeout [ 377.116256][T12733] lo speed is unknown, defaulting to 1000 [ 377.146296][T12733] lo speed is unknown, defaulting to 1000 [ 377.537742][T12754] __nla_validate_parse: 6 callbacks suppressed [ 377.537762][T12754] netlink: 72 bytes leftover after parsing attributes in process `syz.3.1905'. [ 377.587858][T12754] tipc: Enabling of bearer rejected, already enabled [ 377.690226][T12756] netlink: 'syz.4.1906': attribute type 1 has an invalid length. [ 377.698912][T12756] netlink: 144 bytes leftover after parsing attributes in process `syz.4.1906'. [ 377.722715][T12756] netlink: 28 bytes leftover after parsing attributes in process `syz.4.1906'. [ 378.034447][T12767] netlink: 'syz.0.1909': attribute type 10 has an invalid length. [ 378.072541][T12767] netlink: 40 bytes leftover after parsing attributes in process `syz.0.1909'. [ 378.147525][T12767] net_ratelimit: 15 callbacks suppressed [ 378.147541][T12767] A link change request failed with some changes committed already. Interface geneve0 may have been left with an inconsistent configuration, please check. [ 378.349635][T12781] rdma_rxe: rxe_newlink: failed to add batadv_slave_1 [ 378.897420][T12790] can: request_module (can-proto-3) failed. [ 379.147107][T12801] netlink: 27 bytes leftover after parsing attributes in process `syz.3.1917'. [ 379.289309][T12798] syzkaller0: default qdisc (pfifo_fast) fail, fallback to noqueue [ 379.335969][T12798] syzkaller0: entered promiscuous mode [ 379.378533][T12798] syzkaller0: entered allmulticast mode [ 379.619226][T12812] netlink: 72 bytes leftover after parsing attributes in process `syz.1.1920'. [ 379.651043][T12812] tipc: Started in network mode [ 379.670393][T12812] tipc: Node identity , cluster identity 4711 [ 379.691456][T12812] tipc: Failed to obtain node identity [ 379.705900][T12812] tipc: Enabling of bearer rejected, failed to enable media [ 379.892708][T12813] lo speed is unknown, defaulting to 1000 [ 379.926067][T12822] netlink: 8 bytes leftover after parsing attributes in process `syz.1.1923'. [ 379.996022][T12826] netlink: 8 bytes leftover after parsing attributes in process `syz.4.1924'. [ 380.166129][T12832] netlink: 8 bytes leftover after parsing attributes in process `syz.2.1925'. [ 380.551704][ T5843] Bluetooth: hci4: command 0x0405 tx timeout [ 381.403238][T12813] lo speed is unknown, defaulting to 1000 [ 381.404444][T12826] platform regulatory.0: loading /lib/firmware/regulatory.db failed with error -12 [ 381.420893][T12826] platform regulatory.0: Direct firmware load for regulatory.db failed with error -12 [ 381.431235][T12826] platform regulatory.0: Falling back to sysfs fallback for: regulatory.db [ 381.612183][T12850] netlink: 56 bytes leftover after parsing attributes in process `syz.2.1930'. [ 382.618907][T12841] geneve2: left promiscuous mode [ 382.624381][T12841] gretap1: left promiscuous mode [ 382.646383][T12841] geneve3: left promiscuous mode [ 382.656911][T12841] geneve3: left allmulticast mode [ 382.705028][T12841] xfrm2: left promiscuous mode [ 382.717627][T12841] xfrm2: left allmulticast mode [ 382.848515][T12841] veth9: left promiscuous mode [ 382.856628][ T7115] lo speed is unknown, defaulting to 1000 [ 382.868482][T12817] lo speed is unknown, defaulting to 1000 [ 382.897307][ T7115] syz0: Port: 1 Link DOWN [ 382.910453][ T6232] netdevsim netdevsim1 eth0: unset [1, 0] type 2 family 0 port 37038 - 0 [ 382.919201][ T6232] netdevsim netdevsim1 eth1: unset [1, 0] type 2 family 0 port 37038 - 0 [ 382.948040][T12817] lo speed is unknown, defaulting to 1000 [ 382.957256][T12854] lo speed is unknown, defaulting to 1000 [ 382.964570][T12845] lo speed is unknown, defaulting to 1000 [ 382.980717][ T6232] netdevsim netdevsim1 eth2: unset [1, 0] type 2 family 0 port 37038 - 0 [ 382.993220][ T6232] netdevsim netdevsim1 eth3: unset [1, 0] type 2 family 0 port 37038 - 0 [ 383.018345][ T7115] lo speed is unknown, defaulting to 1000 [ 383.428565][T12873] 8021q: adding VLAN 0 to HW filter on device bond4 [ 383.438505][T12873] bond0: (slave bond4): Enslaving as an active interface with an up link [ 383.448187][T12854] lo speed is unknown, defaulting to 1000 [ 383.481814][ T7111] syz1: Port: 1 Link ACTIVE [ 383.713684][T12845] lo speed is unknown, defaulting to 1000 [ 383.765258][T12885] netlink: 1016 bytes leftover after parsing attributes in process `syz.2.1937'. [ 384.100440][T12877] lo speed is unknown, defaulting to 1000 [ 384.246699][T12877] lo speed is unknown, defaulting to 1000 [ 385.142361][T12895] netlink: 8 bytes leftover after parsing attributes in process `syz.2.1940'. [ 385.287694][T12897] netlink: 24 bytes leftover after parsing attributes in process `syz.2.1941'. [ 385.614895][T12909] netlink: 36 bytes leftover after parsing attributes in process `syz.3.1942'. [ 385.658183][T12909] netlink: 36 bytes leftover after parsing attributes in process `syz.3.1942'. [ 386.517810][T12932] netdevsim netdevsim0 eth3 (unregistering): unset [1, 0] type 2 family 0 port 39335 - 0 [ 386.540207][T12935] siw: device registration error -23 [ 386.621987][T12932] netdevsim netdevsim0 eth2 (unregistering): unset [1, 0] type 2 family 0 port 39335 - 0 [ 386.714525][T12939] netlink: 8 bytes leftover after parsing attributes in process `syz.4.1951'. [ 386.756939][T12932] netdevsim netdevsim0 eth1 (unregistering): unset [1, 0] type 2 family 0 port 39335 - 0 [ 386.835842][T12941] 8021q: adding VLAN 0 to HW filter on device team0 [ 386.849974][T12941] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 386.869897][ T7115] lo speed is unknown, defaulting to 1000 [ 386.876150][ T7115] syz0: Port: 1 Link ACTIVE [ 386.932466][T12932] netdevsim netdevsim0 eth0 (unregistering): unset [1, 0] type 2 family 0 port 39335 - 0 [ 386.970703][ T7017] lo speed is unknown, defaulting to 1000 [ 386.992550][T12945] netlink: 32 bytes leftover after parsing attributes in process `syz.3.1953'. [ 387.088352][T12949] lo speed is unknown, defaulting to 1000 [ 387.090588][ T9873] netdevsim netdevsim0 eth0: set [1, 0] type 2 family 0 port 39335 - 0 [ 387.126476][T12949] lo speed is unknown, defaulting to 1000 [ 387.152176][ T9873] netdevsim netdevsim0 eth1: set [1, 0] type 2 family 0 port 39335 - 0 [ 387.181744][ T9873] netdevsim netdevsim0 eth2: set [1, 0] type 2 family 0 port 39335 - 0 [ 387.218976][ T9873] netdevsim netdevsim0 eth3: set [1, 0] type 2 family 0 port 39335 - 0 [ 387.296438][T12958] netlink: 72 bytes leftover after parsing attributes in process `syz.3.1956'. [ 387.315825][T12958] tipc: Enabling of bearer rejected, already enabled [ 387.331886][T12959] netlink: 40 bytes leftover after parsing attributes in process `syz.4.1957'. [ 387.648995][T12968] netlink: 8 bytes leftover after parsing attributes in process `syz.2.1960'. [ 387.690910][T12967] netlink: 'syz.0.1959': attribute type 1 has an invalid length. [ 387.829171][T12969] xt_hashlimit: size too large, truncated to 1048576 [ 388.011001][T12980] netlink: 'syz.0.1962': attribute type 12 has an invalid length. [ 388.122224][T12974] openvswitch: netlink: Missing key (keys=40, expected=200000) [ 388.317817][T12983] lo speed is unknown, defaulting to 1000 [ 388.364119][T12983] lo speed is unknown, defaulting to 1000 [ 389.699179][T13000] __nla_validate_parse: 3 callbacks suppressed [ 389.699198][T13000] netlink: 72 bytes leftover after parsing attributes in process `syz.2.1967'. [ 389.700879][T12999] netlink: 3 bytes leftover after parsing attributes in process `syz.3.1966'. [ 389.715670][T13000] tipc: Enabling of bearer rejected, already enabled [ 389.834256][T12999] batadv0: entered promiscuous mode [ 389.846554][T12999] batadv0: entered allmulticast mode [ 389.928869][T13007] netlink: 48 bytes leftover after parsing attributes in process `syz.3.1966'. [ 389.988406][ T5843] Bluetooth: hci4: command 0x0405 tx timeout [ 390.068004][T13008] netlink: 72 bytes leftover after parsing attributes in process `syz.0.1968'. [ 390.087432][T13008] tipc: Enabling of bearer rejected, already enabled [ 390.435176][T13022] netlink: 72 bytes leftover after parsing attributes in process `syz.3.1971'. [ 390.458567][T13022] tipc: Enabling of bearer rejected, already enabled [ 390.538311][T13026] netlink: 4 bytes leftover after parsing attributes in process `syz.4.1972'. [ 391.336933][T13044] syzkaller0: entered promiscuous mode [ 391.398779][T13044] syzkaller0: entered allmulticast mode [ 391.422774][T13048] netlink: 20 bytes leftover after parsing attributes in process `syz.4.1976'. [ 391.446071][T13049] netlink: 56 bytes leftover after parsing attributes in process `syz.2.1978'. [ 391.448310][T13048] netlink: 40 bytes leftover after parsing attributes in process `syz.4.1976'. [ 391.837988][T13058] netlink: 8 bytes leftover after parsing attributes in process `syz.4.1981'. [ 392.097572][T13069] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 392.186347][T13069] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 392.261526][T13069] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 393.262252][T13058] platform regulatory.0: loading /lib/firmware/regulatory.db failed with error -12 [ 393.273199][T13066] A link change request failed with some changes committed already. Interface veth0_macvtap may have been left with an inconsistent configuration, please check. [ 393.290154][T13058] platform regulatory.0: Direct firmware load for regulatory.db failed with error -12 [ 393.300630][T13058] platform regulatory.0: Falling back to sysfs fallback for: regulatory.db [ 393.310721][T13070] sch_tbf: burst 1 is lower than device ip6tnl0 mtu (39785) ! [ 393.353564][T13061] lo speed is unknown, defaulting to 1000 [ 393.379734][T13061] lo speed is unknown, defaulting to 1000 [ 393.397860][T13060] lo speed is unknown, defaulting to 1000 [ 393.761782][T13074] tipc: Resetting bearer [ 394.039384][T13080] tipc: Started in network mode [ 394.044462][T13080] tipc: Node identity , cluster identity 4711 [ 394.055173][T13080] tipc: Failed to obtain node identity [ 394.061250][T13080] tipc: Enabling of bearer rejected, failed to enable media [ 394.084898][T13060] lo speed is unknown, defaulting to 1000 [ 394.956842][T13114] __nla_validate_parse: 5 callbacks suppressed [ 394.956859][T13114] netlink: 8 bytes leftover after parsing attributes in process `syz.3.1995'. [ 395.000398][T13111] lo speed is unknown, defaulting to 1000 [ 395.009793][T13111] lo speed is unknown, defaulting to 1000 [ 395.361531][T13122] netlink: 'syz.3.1998': attribute type 12 has an invalid length. [ 395.623103][T13124] lo speed is unknown, defaulting to 1000 [ 395.696217][T13124] lo speed is unknown, defaulting to 1000 [ 395.722707][T13110] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 395.921638][T13137] lo: entered allmulticast mode [ 395.953600][T13137] lo: left allmulticast mode [ 396.196910][T13147] ipt_ECN: cannot use operation on non-tcp rule [ 396.277101][T13146] lo speed is unknown, defaulting to 1000 [ 396.316402][T13146] lo speed is unknown, defaulting to 1000 [ 396.893567][T13154] 8021q: adding VLAN 0 to HW filter on device bond4 [ 396.970403][T13169] netlink: 'syz.4.2010': attribute type 27 has an invalid length. [ 397.164615][T13168] bond4: (slave gretap2): Enslaving as an active interface with an up link [ 398.180335][T13200] netlink: 256 bytes leftover after parsing attributes in process `syz.4.2015'. [ 398.242493][T13204] netlink: 4 bytes leftover after parsing attributes in process `syz.3.2014'. [ 399.244467][T13220] netlink: 4 bytes leftover after parsing attributes in process `syz.0.2017'. [ 399.424851][T13228] netlink: 'syz.1.2021': attribute type 1 has an invalid length. [ 399.535913][T13228] 8021q: adding VLAN 0 to HW filter on device bond6 [ 399.588557][T13228] veth11: entered promiscuous mode [ 399.609606][T13228] bond6: (slave veth11): Enslaving as a backup interface with a down link [ 399.635234][T13230] bond6: (slave veth11): Releasing backup interface [ 399.707942][T13236] !: renamed from dummy0 (while UP) [ 400.319482][T13257] netlink: 'syz.2.2025': attribute type 27 has an invalid length. [ 400.369910][T13258] netlink: 'syz.1.2024': attribute type 27 has an invalid length. [ 401.288618][T13288] netlink: 'syz.3.2032': attribute type 12 has an invalid length. [ 401.333495][T13290] netlink: 24 bytes leftover after parsing attributes in process `syz.1.2033'. [ 401.400463][T13293] netlink: 'syz.1.2034': attribute type 12 has an invalid length. [ 401.714518][T13296] mac80211_hwsim hwsim9 syzkaller0: Caught tx_queue_len zero misconfig [ 403.372749][T13320] veth11: left promiscuous mode [ 403.404392][T13318] tipc: Enabling of bearer rejected, already enabled [ 403.432576][ T43] lo speed is unknown, defaulting to 1000 [ 403.444843][ T43] syz0: Port: 1 Link DOWN [ 403.636728][ T43] lo speed is unknown, defaulting to 1000 [ 403.838008][T13344] netlink: 'syz.0.2047': attribute type 1 has an invalid length. [ 403.898228][T13344] bond5 (unregistering): Released all slaves [ 403.924381][T13352] netlink: 20 bytes leftover after parsing attributes in process `syz.2.2049'. [ 404.092525][T13355] netlink: 'syz.3.2050': attribute type 12 has an invalid length. [ 404.376847][T13371] netlink: 72 bytes leftover after parsing attributes in process `syz.2.2053'. [ 404.449463][T13371] tipc: Enabling of bearer rejected, already enabled [ 404.950137][T13385] lo speed is unknown, defaulting to 1000 [ 404.961564][T13385] lo speed is unknown, defaulting to 1000 [ 404.993916][ T5841] Bluetooth: hci4: link tx timeout [ 404.999549][ T5841] Bluetooth: hci4: killing stalled connection 10:aa:aa:aa:aa:aa [ 405.037842][T13390] netlink: 'syz.4.2056': attribute type 6 has an invalid length. [ 405.048838][T13391] netlink: 48 bytes leftover after parsing attributes in process `syz.3.2058'. [ 405.098404][T13391] bond4: (slave gretap2): Releasing backup interface [ 405.353942][T13396] lo speed is unknown, defaulting to 1000 [ 405.389053][T13396] lo speed is unknown, defaulting to 1000 [ 405.544072][T13407] lo speed is unknown, defaulting to 1000 [ 405.569180][T13410] lo speed is unknown, defaulting to 1000 [ 405.594560][T13406] netlink: 'syz.1.2062': attribute type 13 has an invalid length. [ 405.602842][T13406] netlink: 'syz.1.2062': attribute type 17 has an invalid length. [ 405.825064][T13415] netlink: 88 bytes leftover after parsing attributes in process `syz.2.2063'. [ 405.841115][T13415] netlink: 16 bytes leftover after parsing attributes in process `syz.2.2063'. [ 405.871652][T13407] lo speed is unknown, defaulting to 1000 [ 406.012863][T13418] netlink: 72 bytes leftover after parsing attributes in process `syz.3.2064'. [ 406.037854][T13418] tipc: Enabling of bearer rejected, already enabled [ 406.478547][T13420] A link change request failed with some changes committed already. Interface bond4 may have been left with an inconsistent configuration, please check. [ 406.501893][T13410] lo speed is unknown, defaulting to 1000 [ 406.643695][T13428] netlink: 'syz.3.2068': attribute type 12 has an invalid length. [ 406.751433][T13433] netlink: 72 bytes leftover after parsing attributes in process `syz.2.2069'. [ 406.780809][T13433] tipc: Enabling of bearer rejected, already enabled [ 406.838517][T13435] netlink: 'syz.4.2070': attribute type 12 has an invalid length. [ 407.040444][ T5841] Bluetooth: hci4: command 0x0405 tx timeout [ 407.781637][T13450] netlink: 'syz.4.2074': attribute type 1 has an invalid length. [ 407.907914][T13450] 8021q: adding VLAN 0 to HW filter on device bond3 [ 407.990729][T13454] 8021q: adding VLAN 0 to HW filter on device bond3 [ 407.997906][T13454] bond3: (slave vxcan1): The slave device specified does not support setting the MAC address [ 408.010114][T13454] bond3: (slave vxcan1): Error -95 calling set_mac_address [ 408.059332][T13455] veth9: entered promiscuous mode [ 408.076026][T13455] bond3: (slave veth9): Enslaving as an active interface with a down link [ 408.303185][T13465] netlink: 'syz.1.2076': attribute type 1 has an invalid length. [ 408.345237][T13465] bond7: entered promiscuous mode [ 408.357762][T13465] 8021q: adding VLAN 0 to HW filter on device bond7 [ 408.383922][T13467] bond7: (slave bridge0): making interface the new active one [ 408.392149][T13467] bridge0: entered promiscuous mode [ 408.400098][T13469] netlink: 8 bytes leftover after parsing attributes in process `syz.0.2077'. [ 408.410013][T13467] bond7: (slave bridge0): Enslaving as an active interface with an up link [ 408.529605][T13472] netlink: 8 bytes leftover after parsing attributes in process `syz.1.2078'. [ 408.556355][T13474] netlink: 'syz.3.2079': attribute type 12 has an invalid length. [ 408.606860][T13478] netlink: 12 bytes leftover after parsing attributes in process `syz.4.2080'. [ 408.743218][T13479] ip6t_srh: unknown srh invflags 4449 [ 408.747068][T13486] Bluetooth: MGMT ver 1.23 [ 408.823557][T13483] lo speed is unknown, defaulting to 1000 [ 408.831491][T13483] lo speed is unknown, defaulting to 1000 [ 408.905024][T13491] netlink: 32 bytes leftover after parsing attributes in process `syz.1.2082'. [ 409.117324][ T9873] wlan0: No active IBSS STAs - trying to scan for other IBSS networks with same SSID (merge) [ 409.512802][T13498] netlink: 'syz.3.2085': attribute type 27 has an invalid length. [ 409.556585][T13500] netlink: 56 bytes leftover after parsing attributes in process `syz.0.2087'. [ 409.940350][T13506] lo speed is unknown, defaulting to 1000 [ 409.956693][T13510] netlink: 28 bytes leftover after parsing attributes in process `syz.2.2089'. [ 410.002619][T13506] lo speed is unknown, defaulting to 1000 [ 410.201155][ T30] audit: type=1107 audit(1751196825.688:8): pid=13502 uid=0 auid=4294967295 ses=4294967295 subj=unconfined msg='1d]:xJP@cd$JnyO^D#z' [ 410.528042][T13520] netlink: 8 bytes leftover after parsing attributes in process `syz.2.2091'. [ 411.034526][T13535] geneve0: entered allmulticast mode [ 411.066300][T13535] vxcan3: entered allmulticast mode [ 411.070450][T13537] netlink: 'syz.4.2097': attribute type 1 has an invalid length. [ 411.079882][T13537] netlink: 224 bytes leftover after parsing attributes in process `syz.4.2097'. [ 411.092910][T13537] netlink: 8 bytes leftover after parsing attributes in process `syz.4.2097'. [ 411.151726][T13540] netlink: 'syz.2.2096': attribute type 12 has an invalid length. [ 411.258278][T13542] veth9: left promiscuous mode [ 411.471510][T13546] bridge0: entered promiscuous mode [ 411.742563][T13555] lo speed is unknown, defaulting to 1000 [ 411.773043][T13559] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 411.796844][T13555] lo speed is unknown, defaulting to 1000 [ 411.857446][T13560] lo speed is unknown, defaulting to 1000 [ 411.869488][T13559] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 411.978425][T13562] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 412.041571][T13564] __nla_validate_parse: 3 callbacks suppressed [ 412.041598][T13564] netlink: 8 bytes leftover after parsing attributes in process `syz.4.2103'. [ 412.079040][T13566] netlink: 12 bytes leftover after parsing attributes in process `syz.2.2104'. [ 412.192122][T13561] netlink: 312 bytes leftover after parsing attributes in process `syz.1.2102'. [ 412.229112][T13561] netlink: 8 bytes leftover after parsing attributes in process `syz.1.2102'. [ 412.294128][T13560] lo speed is unknown, defaulting to 1000 [ 412.811035][T13587] lo speed is unknown, defaulting to 1000 [ 412.819018][T13587] lo speed is unknown, defaulting to 1000 [ 413.362095][T13600] netlink: 44 bytes leftover after parsing attributes in process `syz.3.2109'. [ 413.371305][T13600] netlink: 43 bytes leftover after parsing attributes in process `syz.3.2109'. [ 413.448856][T13598] netlink: 'syz.3.2109': attribute type 16 has an invalid length. [ 413.453692][T13600] netlink: 'syz.3.2109': attribute type 6 has an invalid length. [ 413.456787][T13598] netlink: 'syz.3.2109': attribute type 17 has an invalid length. [ 413.537683][T13600] netlink: 'syz.3.2109': attribute type 5 has an invalid length. [ 413.557765][T13600] netlink: 43 bytes leftover after parsing attributes in process `syz.3.2109'. [ 413.571324][T13598] 8021q: adding VLAN 0 to HW filter on device bond0 [ 413.634531][T13598] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 413.838653][T13607] netlink: 56 bytes leftover after parsing attributes in process `syz.2.2113'. [ 414.197878][T13615] nbd: socks must be embedded in a SOCK_ITEM attr [ 414.212860][T13615] block nbd0: shutting down sockets [ 414.295302][T13612] netlink: 20 bytes leftover after parsing attributes in process `syz.3.2115'. [ 414.443989][T13625] (unnamed net_device) (uninitialized): up delay (1024) is not a multiple of miimon (100), value rounded to 1000 ms [ 414.477366][T13625] (unnamed net_device) (uninitialized): down delay (4) is not a multiple of miimon (100), value rounded to 0 ms [ 414.892783][T13638] netlink: 'syz.3.2119': attribute type 21 has an invalid length. [ 414.924687][T13639] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 415.018302][T13630] lo speed is unknown, defaulting to 1000 [ 415.025815][T13630] lo speed is unknown, defaulting to 1000 [ 415.030132][T13638] netlink: 'syz.3.2119': attribute type 6 has an invalid length. [ 415.051394][T13639] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 415.110366][T13638] netlink: 64 bytes leftover after parsing attributes in process `syz.3.2119'. [ 415.149806][T13646] sctp: [Deprecated]: syz.1.2116 (pid 13646) Use of struct sctp_assoc_value in delayed_ack socket option. [ 415.149806][T13646] Use struct sctp_sack_info instead [ 415.177154][T13639] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 415.243038][T13635] lo speed is unknown, defaulting to 1000 [ 415.269718][T13617] lo speed is unknown, defaulting to 1000 [ 415.376108][T13648] xt_addrtype: ipv6 PROHIBIT (THROW, NAT ..) matching not supported [ 415.642534][T13635] lo speed is unknown, defaulting to 1000 [ 415.953230][T13617] lo speed is unknown, defaulting to 1000 [ 415.982903][T13653] tipc: Bearer : already 2 bearers with priority 10 [ 415.994835][T13653] tipc: Bearer : trying with adjusted priority [ 416.004129][T13653] tipc: Enabling of bearer rejected, max 3 bearers permitted [ 418.207528][T13694] __nla_validate_parse: 5 callbacks suppressed [ 418.207546][T13694] netlink: 8 bytes leftover after parsing attributes in process `syz.4.2135'. [ 418.244305][T13693] lo speed is unknown, defaulting to 1000 [ 418.332350][T13693] lo speed is unknown, defaulting to 1000 [ 418.403272][T13701] netlink: 'syz.4.2135': attribute type 10 has an invalid length. [ 418.427146][T13701] netlink: 40 bytes leftover after parsing attributes in process `syz.4.2135'. [ 418.472896][T13701] team0: Failed to send port change of device geneve0 via netlink (err -105) [ 418.481913][ T30] audit: type=1107 audit(1751196833.958:9): pid=13689 uid=0 auid=4294967295 ses=4294967295 subj=unconfined msg='1d]:xJP@cd$JnyO^D#z' [ 418.513238][T13701] team0: Failed to send options change via netlink (err -105) [ 418.531259][T13701] team0: Port device geneve0 added [ 418.563121][ T9873] netdevsim netdevsim4 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 418.572133][ T9873] netdevsim netdevsim4 eth1: set [1, 0] type 2 family 0 port 6081 - 0 [ 418.592348][ T9873] netdevsim netdevsim4 eth2: set [1, 0] type 2 family 0 port 6081 - 0 [ 418.617820][ T9873] netdevsim netdevsim4 eth3: set [1, 0] type 2 family 0 port 6081 - 0 [ 418.818589][T13709] netlink: 12 bytes leftover after parsing attributes in process `syz.0.2138'. [ 418.893725][T13710] netlink: 72 bytes leftover after parsing attributes in process `syz.0.2138'. [ 418.916135][T13710] tipc: Enabling of bearer rejected, already enabled [ 419.580272][T13722] netlink: 8 bytes leftover after parsing attributes in process `syz.0.2141'. [ 420.053320][T13724] lo speed is unknown, defaulting to 1000 [ 420.100157][T13723] lo speed is unknown, defaulting to 1000 [ 420.138238][T13724] lo speed is unknown, defaulting to 1000 [ 420.242041][T13738] netlink: 'syz.0.2148': attribute type 13 has an invalid length. [ 420.250247][T13738] netlink: 'syz.0.2148': attribute type 17 has an invalid length. [ 420.300221][T13738] gretap0: left promiscuous mode [ 420.349431][T13746] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 420.370010][T13746] netlink: 'syz.2.2147': attribute type 4 has an invalid length. [ 420.525376][T13738] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 420.554528][T13745] geneve0: entered allmulticast mode [ 420.566988][T13738] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 420.729414][ T36] netdevsim netdevsim4 eth0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 420.744529][T13743] lo speed is unknown, defaulting to 1000 [ 420.752973][ T36] netdevsim netdevsim4 eth1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 420.773785][T13749] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 420.794660][ T36] netdevsim netdevsim4 eth2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 420.817570][ T36] netdevsim netdevsim4 eth3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 420.888196][T13738] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 421.136493][T13762] netlink: 4 bytes leftover after parsing attributes in process `syz.4.2152'. [ 421.272826][T13764] block nbd1: must specify backend [ 421.287499][T13748] xt_CT: No such helper "snmp" [ 421.291701][T13764] netlink: 64 bytes leftover after parsing attributes in process `syz.1.2153'. [ 421.327597][T13764] netlink: 64 bytes leftover after parsing attributes in process `syz.1.2153'. [ 421.359131][T13723] lo speed is unknown, defaulting to 1000 [ 421.616318][T13774] netlink: 72 bytes leftover after parsing attributes in process `syz.1.2156'. [ 421.626123][T13774] tipc: Started in network mode [ 421.631810][T13774] tipc: Node identity , cluster identity 4711 [ 421.638359][T13774] tipc: Failed to obtain node identity [ 421.644205][T13774] tipc: Enabling of bearer rejected, failed to enable media [ 422.014314][T13743] lo speed is unknown, defaulting to 1000 [ 422.272465][T13793] geneve0: entered allmulticast mode [ 422.638711][T13799] netlink: 64 bytes leftover after parsing attributes in process `syz.4.2164'. [ 423.140597][T13815] tipc: Started in network mode [ 423.145497][T13815] tipc: Node identity , cluster identity 4711 [ 423.157663][T13815] tipc: Failed to obtain node identity [ 423.164399][T13815] tipc: Enabling of bearer rejected, failed to enable media [ 423.372603][T13825] __nla_validate_parse: 3 callbacks suppressed [ 423.372621][T13825] netlink: 4 bytes leftover after parsing attributes in process `syz.4.2169'. [ 423.396571][T13825] rdma_rxe: rxe_newlink: failed to add batadv_slave_1 [ 423.410139][T13827] netlink: 4 bytes leftover after parsing attributes in process `syz.2.2179'. [ 423.423705][T13828] netlink: 'syz.1.2168': attribute type 13 has an invalid length. [ 423.449143][T13828] netlink: 'syz.1.2168': attribute type 17 has an invalid length. [ 423.468340][T13827] rdma_rxe: rxe_newlink: failed to add batadv_slave_1 [ 423.639432][T13828] 8021q: adding VLAN 0 to HW filter on device team0 [ 423.651607][T13828] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 423.671248][ T7103] lo speed is unknown, defaulting to 1000 [ 423.677802][ T7103] syz0: Port: 1 Link ACTIVE [ 423.684661][ T7103] lo speed is unknown, defaulting to 1000 [ 423.728884][T13828] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 423.840665][T13828] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 423.869099][T13840] tipc: Can't bind to reserved service type 0 [ 423.934621][T13835] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 424.190506][T13833] geneve0: left allmulticast mode [ 424.196613][T13833] mac80211_hwsim hwsim11 syzkaller0: left promiscuous mode [ 424.204849][T13833] mac80211_hwsim hwsim11 syzkaller0: left allmulticast mode [ 424.213933][T13833] gretap1: left promiscuous mode [ 424.219585][T13833] macvtap1: left promiscuous mode [ 424.228113][T13833] macvtap1: left allmulticast mode [ 424.239276][T13833] geneve2: left promiscuous mode [ 424.244525][T13833] macsec1: left promiscuous mode [ 424.250220][T13833] macsec1: left allmulticast mode [ 424.256774][T13833] bridge1: left allmulticast mode [ 424.301971][T13833] bond4: left promiscuous mode [ 424.313687][T13833] bridge4: left promiscuous mode [ 424.338015][T13833] erspan0: left allmulticast mode [ 424.349552][T13833] macvtap2: left promiscuous mode [ 424.354952][T13833] macvtap2: left allmulticast mode [ 424.376856][T13833] geneve3: left promiscuous mode [ 424.386316][T13833] geneve3: left allmulticast mode [ 424.413875][T13833] bridge0: left promiscuous mode [ 424.453285][T13840] bond0: entered promiscuous mode [ 424.459011][T13840] bond4: entered promiscuous mode [ 424.465562][T13840] 8021q: adding VLAN 0 to HW filter on device macvlan1 [ 424.476545][T13840] bond0: left promiscuous mode [ 424.483816][T13840] bond4: left promiscuous mode [ 424.522137][ T9873] netdevsim netdevsim0 eth0: unset [1, 0] type 2 family 0 port 39335 - 0 [ 424.525235][T13844] netlink: 4 bytes leftover after parsing attributes in process `syz.0.2173'. [ 424.531307][ T9873] netdevsim netdevsim0 eth1: unset [1, 0] type 2 family 0 port 39335 - 0 [ 424.562791][ T9873] netdevsim netdevsim0 eth2: unset [1, 0] type 2 family 0 port 39335 - 0 [ 424.584417][ T9873] netdevsim netdevsim0 eth3: unset [1, 0] type 2 family 0 port 39335 - 0 [ 424.606942][T13830] lo speed is unknown, defaulting to 1000 [ 424.629138][T13830] lo speed is unknown, defaulting to 1000 [ 424.990177][T13856] netlink: 72 bytes leftover after parsing attributes in process `syz.0.2178'. [ 425.040115][T13856] tipc: Enabling of bearer rejected, already enabled [ 425.375242][T13871] netlink: 'syz.0.2182': attribute type 10 has an invalid length. [ 426.041170][T13882] netlink: 4 bytes leftover after parsing attributes in process `syz.4.2187'. [ 426.333631][T13880] bond7: left promiscuous mode [ 426.350679][T13880] bridge0: left promiscuous mode [ 426.385934][ T7103] lo speed is unknown, defaulting to 1000 [ 426.392164][ T7103] syz0: Port: 1 Link DOWN [ 426.396613][ T7103] lo speed is unknown, defaulting to 1000 [ 426.511937][T13892] netlink: 4 bytes leftover after parsing attributes in process `syz.4.2189'. [ 426.635020][T13896] netlink: 12 bytes leftover after parsing attributes in process `syz.2.2191'. [ 426.651102][T13898] netlink: 'syz.3.2192': attribute type 13 has an invalid length. [ 426.985406][T13916] netlink: 20 bytes leftover after parsing attributes in process `syz.3.2196'. [ 427.252098][T13925] bond0: entered promiscuous mode [ 427.259683][T13925] 8021q: adding VLAN 0 to HW filter on device macvlan2 [ 427.275531][T13925] bond0: left promiscuous mode [ 427.294213][T13927] netlink: 12 bytes leftover after parsing attributes in process `syz.0.2199'. [ 427.366532][T13927] netlink: 20 bytes leftover after parsing attributes in process `syz.0.2199'. [ 427.388246][T13927] netlink: 'syz.0.2199': attribute type 3 has an invalid length. [ 427.395994][T13927] netlink: 'syz.0.2199': attribute type 2 has an invalid length. [ 427.405284][T13916] lo speed is unknown, defaulting to 1000 [ 427.418507][T13916] lo speed is unknown, defaulting to 1000 [ 427.632726][T13933] Bluetooth: hci0: Opcode 0x0c03 failed: -4 [ 427.713312][T13933] netlink: 'syz.4.2201': attribute type 4 has an invalid length. [ 427.910869][ T5841] Bluetooth: hci4: command 0x0405 tx timeout [ 428.165134][T13947] netlink: 'syz.3.2206': attribute type 11 has an invalid length. [ 428.778110][T13964] __nla_validate_parse: 8 callbacks suppressed [ 428.778148][T13964] netlink: 48 bytes leftover after parsing attributes in process `syz.0.2209'. [ 428.802355][T13959] lo speed is unknown, defaulting to 1000 [ 428.882859][T13966] netlink: 100 bytes leftover after parsing attributes in process `syz.3.2210'. [ 428.898032][T13959] lo speed is unknown, defaulting to 1000 [ 429.225041][T13964] bond4: (slave bridge4): Releasing backup interface [ 429.355747][T13971] geneve0: left allmulticast mode [ 429.390066][T13976] netlink: 'syz.3.2212': attribute type 303 has an invalid length. [ 429.520800][T13976] netlink: 8 bytes leftover after parsing attributes in process `syz.3.2212'. [ 429.697980][T13982] netlink: 4 bytes leftover after parsing attributes in process `syz.2.2213'. [ 429.783552][T13988] netlink: 4 bytes leftover after parsing attributes in process `syz.1.2215'. [ 430.062096][T13988] bond7: (slave bridge0): Releasing backup interface [ 430.175697][T13991] netlink: 'syz.2.2216': attribute type 12 has an invalid length. [ 430.564386][T14014] geneve0: entered allmulticast mode [ 430.590214][T14014] vxcan3: entered allmulticast mode [ 430.759978][T14018] netlink: 'syz.0.2224': attribute type 13 has an invalid length. [ 430.768329][T14018] netlink: 'syz.0.2224': attribute type 17 has an invalid length. [ 430.789039][T14018] erspan0: left promiscuous mode [ 430.843889][T14018] 8021q: adding VLAN 0 to HW filter on device bond0 [ 430.866557][T14018] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 430.912477][T14022] lo speed is unknown, defaulting to 1000 [ 430.921064][T14022] lo speed is unknown, defaulting to 1000 [ 430.960490][T14018] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 431.048425][T14018] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 431.131476][T14018] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 431.537081][T14026] xt_CT: You must specify a L4 protocol and not use inversions on it [ 431.710159][T14048] netlink: 64 bytes leftover after parsing attributes in process `syz.1.2231'. [ 431.743614][T14049] netlink: 4 bytes leftover after parsing attributes in process `syz.3.2230'. [ 431.765009][T14049] rdma_rxe: rxe_newlink: failed to add batadv_slave_1 [ 432.082195][T14061] netlink: 'syz.1.2235': attribute type 1 has an invalid length. [ 432.269405][T14061] 8021q: adding VLAN 0 to HW filter on device bond8 [ 432.306531][T14068] lo: entered allmulticast mode [ 432.355363][T14078] erspan0: entered promiscuous mode [ 432.379229][T14078] erspan0: left promiscuous mode [ 432.513760][T14071] 8021q: adding VLAN 0 to HW filter on device bond8 [ 432.547586][T14082] netlink: 12 bytes leftover after parsing attributes in process `syz.0.2237'. [ 432.555773][T14071] bond8: (slave vxcan3): The slave device specified does not support setting the MAC address [ 432.583392][T14071] bond8: (slave vxcan3): Error -95 calling set_mac_address [ 432.688084][T14063] lo: left allmulticast mode [ 432.721550][T14077] veth13: entered promiscuous mode [ 432.736318][T14077] bond8: (slave veth13): Enslaving as an active interface with a down link [ 433.266410][T14091] netlink: 52 bytes leftover after parsing attributes in process `syz.1.2240'. [ 433.375400][T14096] netlink: 24 bytes leftover after parsing attributes in process `syz.1.2240'. [ 433.404088][T14096] netlink: 'syz.1.2240': attribute type 3 has an invalid length. [ 433.474916][T14096] xt_CT: You must specify a L4 protocol and not use inversions on it [ 433.484488][T14100] openvswitch: netlink: Missing key (keys=40, expected=80) [ 433.486743][T14098] lo speed is unknown, defaulting to 1000 [ 433.520012][T14098] lo speed is unknown, defaulting to 1000 [ 434.160193][T14114] __nla_validate_parse: 6 callbacks suppressed [ 434.160212][T14114] netlink: 2 bytes leftover after parsing attributes in process `syz.1.2246'. [ 434.176301][T14114] batadv_slave_1: entered promiscuous mode [ 434.575788][T14125] netlink: 'syz.0.2251': attribute type 1 has an invalid length. [ 434.584328][T14123] batadv_slave_1: left promiscuous mode [ 434.628438][T14123] veth13: left promiscuous mode [ 434.790499][T14138] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 434.901179][T14126] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 434.951314][T14125] 8021q: adding VLAN 0 to HW filter on device bond5 [ 435.011331][T14126] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 435.180434][T14129] 8021q: adding VLAN 0 to HW filter on device bond5 [ 435.208625][T14129] bond5: (slave vxcan3): The slave device specified does not support setting the MAC address [ 435.239525][T14129] bond5: (slave vxcan3): Error -95 calling set_mac_address [ 435.348962][T14131] veth7: entered promiscuous mode [ 435.362623][T14131] bond5: (slave veth7): Enslaving as an active interface with a down link [ 435.386043][T14121] lo speed is unknown, defaulting to 1000 [ 435.393812][T14121] lo speed is unknown, defaulting to 1000 [ 435.450915][T14147] macsec1: entered promiscuous mode [ 435.476525][T14147] veth0: entered promiscuous mode [ 435.507734][T14137] lo speed is unknown, defaulting to 1000 [ 435.689624][T14151] netlink: 'syz.0.2253': attribute type 21 has an invalid length. [ 435.698011][T14151] netlink: 128 bytes leftover after parsing attributes in process `syz.0.2253'. [ 435.707242][T14151] netlink: 'syz.0.2253': attribute type 4 has an invalid length. [ 435.715119][T14151] netlink: 3 bytes leftover after parsing attributes in process `syz.0.2253'. [ 435.758038][T14151] lo speed is unknown, defaulting to 1000 [ 435.912319][T14137] lo speed is unknown, defaulting to 1000 [ 436.190020][T14151] lo speed is unknown, defaulting to 1000 [ 437.463094][T14059] Set syz1 is full, maxelem 65536 reached [ 437.925624][T14185] lo speed is unknown, defaulting to 1000 [ 437.943674][T14185] lo speed is unknown, defaulting to 1000 [ 438.034745][T14195] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 438.163771][T14195] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 438.224667][T14199] netlink: 'syz.1.2265': attribute type 1 has an invalid length. [ 438.277138][T14190] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 438.278171][T14201] netlink: 3 bytes leftover after parsing attributes in process `syz.1.2265'. [ 438.309400][T14199] bond9: entered promiscuous mode [ 438.315103][T14199] 8021q: adding VLAN 0 to HW filter on device bond9 [ 438.356219][T14201] batadv0: entered promiscuous mode [ 438.383432][T14201] batadv0: entered allmulticast mode [ 438.400447][T14201] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 438.415548][T14201] bond9: (slave batadv0): making interface the new active one [ 438.424751][T14201] bond9: (slave batadv0): Enslaving as an active interface with an up link [ 438.540222][T14199] netlink: 48 bytes leftover after parsing attributes in process `syz.1.2265'. [ 438.770588][T14208] netlink: 'syz.0.2266': attribute type 12 has an invalid length. [ 438.826950][T14212] netlink: 'syz.1.2268': attribute type 12 has an invalid length. [ 438.884675][T14210] syz.3.2267: vmalloc error: size 8589938688, exceeds total pages, mode:0xdc0(GFP_KERNEL|__GFP_ZERO), nodemask=(null),cpuset=/,mems_allowed=0-1 [ 438.902958][T14210] CPU: 0 UID: 0 PID: 14210 Comm: syz.3.2267 Not tainted 6.16.0-rc3-syzkaller-00903-g20a0c20f82ac #0 PREEMPT(full) [ 438.902985][T14210] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 438.903005][T14210] Call Trace: [ 438.903013][T14210] [ 438.903022][T14210] dump_stack_lvl+0x189/0x250 [ 438.903061][T14210] ? __pfx_dump_stack_lvl+0x10/0x10 [ 438.903092][T14210] ? __pfx__printk+0x10/0x10 [ 438.903115][T14210] ? cpuset_print_current_mems_allowed+0x1f/0x360 [ 438.903137][T14210] ? cpuset_print_current_mems_allowed+0x1f/0x360 [ 438.903162][T14210] ? cpuset_print_current_mems_allowed+0x2ee/0x360 [ 438.903187][T14210] warn_alloc+0x214/0x310 [ 438.903210][T14210] ? stack_depot_save_flags+0x40/0x900 [ 438.903241][T14210] ? __pfx_warn_alloc+0x10/0x10 [ 438.903265][T14210] ? kasan_save_track+0x4f/0x80 [ 438.903296][T14210] ? xskq_create+0x56/0x170 [ 438.903315][T14210] ? xsk_init_queue+0xb0/0x110 [ 438.903332][T14210] ? xsk_setsockopt+0x43f/0x710 [ 438.903348][T14210] ? do_sock_setsockopt+0x25a/0x3e0 [ 438.903374][T14210] ? __x64_sys_setsockopt+0x18b/0x220 [ 438.903405][T14210] ? do_syscall_64+0xfa/0x3b0 [ 438.903427][T14210] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 438.903457][T14210] __vmalloc_node_range_noprof+0x125/0x12f0 [ 438.903512][T14210] ? __pfx___vmalloc_node_range_noprof+0x10/0x10 [ 438.903537][T14210] ? xskq_create+0x56/0x170 [ 438.903560][T14210] ? __kasan_kmalloc+0x93/0xb0 [ 438.903582][T14210] vmalloc_user_noprof+0xad/0xf0 [ 438.903604][T14210] ? xskq_create+0xbf/0x170 [ 438.903626][T14210] xskq_create+0xbf/0x170 [ 438.903651][T14210] xsk_init_queue+0xb0/0x110 [ 438.903674][T14210] xsk_setsockopt+0x43f/0x710 [ 438.903697][T14210] ? __pfx_xsk_setsockopt+0x10/0x10 [ 438.903715][T14210] ? __lock_acquire+0xab9/0xd20 [ 438.903763][T14210] ? bpf_lsm_socket_setsockopt+0x9/0x20 [ 438.903786][T14210] ? __pfx_xsk_setsockopt+0x10/0x10 [ 438.903806][T14210] do_sock_setsockopt+0x25a/0x3e0 [ 438.903835][T14210] ? __pfx_do_sock_setsockopt+0x10/0x10 [ 438.903866][T14210] ? __fget_files+0x2a/0x420 [ 438.903896][T14210] __x64_sys_setsockopt+0x18b/0x220 [ 438.903928][T14210] do_syscall_64+0xfa/0x3b0 [ 438.903949][T14210] ? lockdep_hardirqs_on+0x9c/0x150 [ 438.903969][T14210] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 438.903987][T14210] ? clear_bhb_loop+0x60/0xb0 [ 438.904010][T14210] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 438.904034][T14210] RIP: 0033:0x7fb471d8e929 [ 438.904052][T14210] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 438.904068][T14210] RSP: 002b:00007fb472b40038 EFLAGS: 00000246 ORIG_RAX: 0000000000000036 [ 438.904087][T14210] RAX: ffffffffffffffda RBX: 00007fb471fb5fa0 RCX: 00007fb471d8e929 [ 438.904118][T14210] RDX: 0000000000000006 RSI: 000000000000011b RDI: 0000000000000009 [ 438.904130][T14210] RBP: 00007fb471e10b39 R08: 0000000000000004 R09: 0000000000000000 [ 438.904142][T14210] R10: 0000200000000000 R11: 0000000000000246 R12: 0000000000000000 [ 438.904154][T14210] R13: 0000000000000000 R14: 00007fb471fb5fa0 R15: 00007ffeeaf05338 [ 438.904187][T14210] [ 438.904200][T14210] Mem-Info: [ 439.220005][T14210] active_anon:7436 inactive_anon:0 isolated_anon:0 [ 439.220005][T14210] active_file:1404 inactive_file:39996 isolated_file:0 [ 439.220005][T14210] unevictable:770 dirty:544 writeback:0 [ 439.220005][T14210] slab_reclaimable:12174 slab_unreclaimable:206301 [ 439.220005][T14210] mapped:31414 shmem:1376 pagetables:1006 [ 439.220005][T14210] sec_pagetables:0 bounce:0 [ 439.220005][T14210] kernel_misc_reclaimable:0 [ 439.220005][T14210] free:1204184 free_pcp:15735 free_cma:0 [ 439.265775][T14210] Node 0 active_anon:29744kB inactive_anon:0kB active_file:5616kB inactive_file:159780kB unevictable:1544kB isolated(anon):0kB isolated(file):0kB mapped:125656kB dirty:2176kB writeback:0kB shmem:3968kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB writeback_tmp:0kB kernel_stack:13304kB pagetables:3876kB sec_pagetables:0kB all_unreclaimable? no Balloon:0kB [ 439.343409][T14210] Node 1 active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:204kB unevictable:1536kB isolated(anon):0kB isolated(file):0kB mapped:0kB dirty:0kB writeback:0kB shmem:1536kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB writeback_tmp:0kB kernel_stack:48kB pagetables:148kB sec_pagetables:0kB all_unreclaimable? no Balloon:0kB [ 439.434534][T14210] Node 0 DMA free:15360kB boost:0kB min:204kB low:252kB high:300kB reserved_highatomic:0KB free_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB present:15992kB managed:15360kB mlocked:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB [ 439.477165][T14210] lowmem_reserve[]: 0 2500 2502 2502 2502 [ 439.578640][T14210] Node 0 DMA32 free:920984kB boost:0kB min:34264kB low:42828kB high:51392kB reserved_highatomic:0KB free_highatomic:0KB active_anon:29496kB inactive_anon:0kB active_file:5616kB inactive_file:157952kB unevictable:1544kB writepending:2176kB present:3129332kB managed:2560932kB mlocked:8kB bounce:0kB free_pcp:35492kB local_pcp:15988kB free_cma:0kB [ 439.727623][T14210] lowmem_reserve[]: 0 0 1 1 1 [ 439.763363][T14210] Node 0 Normal free:16kB boost:0kB min:24kB low:28kB high:32kB reserved_highatomic:0KB free_highatomic:0KB active_anon:48kB inactive_anon:0kB active_file:0kB inactive_file:1828kB unevictable:0kB writepending:0kB present:1048580kB managed:1900kB mlocked:0kB bounce:0kB free_pcp:8kB local_pcp:8kB free_cma:0kB [ 439.924906][T14210] lowmem_reserve[]: 0 0 0 0 0 [ 439.952967][T14236] netlink: 'syz.1.2274': attribute type 1 has an invalid length. [ 439.974780][T14210] Node 1 Normal free:3892396kB boost:0kB min:55612kB low:69512kB high:83412kB reserved_highatomic:0KB free_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:204kB unevictable:1536kB writepending:0kB present:4194300kB managed:4111164kB mlocked:0kB bounce:0kB free_pcp:23840kB local_pcp:12480kB free_cma:0kB [ 440.028297][T14210] lowmem_reserve[]: 0 0 0 0 0 [ 440.033366][T14210] Node 0 DMA: 0*4kB 0*8kB 0*16kB 0*32kB 0*64kB 0*128kB 0*256kB 0*512kB 1*1024kB (U) 1*2048kB (M) 3*4096kB (M) = 15360kB [ 440.108463][T14210] Node 0 DMA32: 1640*4kB (UME) 1498*8kB (UM) 1031*16kB (UME) 1451*32kB (UME) 446*64kB (UME) 119*128kB (UME) 51*256kB (UM) 48*512kB (UME) 51*1024kB (UM) 6*2048kB (ME) 169*4096kB (M) = 919616kB [ 440.133490][T14210] Node 0 Normal: 0*4kB 0*8kB 1*16kB (M) 0*32kB 0*64kB 0*128kB 0*256kB 0*512kB 0*1024kB 0*2048kB 0*4096kB = 16kB [ 440.149113][T14210] Node 1 Normal: 237*4kB (UE) 63*8kB (UME) 46*16kB (UME) 69*32kB (UME) 22*64kB (UME) 6*128kB (UME) 5*256kB (UM) 5*512kB (UME) 1*1024kB (M) 3*2048kB (UE) 946*4096kB (M) = 3892396kB [ 440.169229][T14210] Node 0 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 440.259380][T14210] Node 0 hugepages_total=2 hugepages_free=0 hugepages_surp=0 hugepages_size=2048kB [ 440.269023][T14210] Node 1 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 440.280394][T14210] Node 1 hugepages_total=2 hugepages_free=2 hugepages_surp=0 hugepages_size=2048kB [ 440.302171][T14210] 42794 total pagecache pages [ 440.314820][T14210] 0 pages in swap cache [ 440.333657][T14210] Free swap = 124996kB [ 440.350175][T14210] Total swap = 124996kB [ 440.358219][T14210] 2097051 pages RAM [ 440.365856][T14210] 0 pages HighMem/MovableOnly [ 440.376418][T14210] 424712 pages reserved [ 440.385800][T14210] 0 pages cma reserved [ 440.762639][T14251] lo speed is unknown, defaulting to 1000 [ 440.790249][T14251] lo speed is unknown, defaulting to 1000 [ 440.971251][T14253] sctp: [Deprecated]: syz.4.2277 (pid 14253) Use of struct sctp_assoc_value in delayed_ack socket option. [ 440.971251][T14253] Use struct sctp_sack_info instead [ 441.009418][T14242] lo speed is unknown, defaulting to 1000 [ 441.379101][T14242] lo speed is unknown, defaulting to 1000 [ 441.519974][T14269] netlink: 12 bytes leftover after parsing attributes in process `syz.1.2283'. [ 441.529748][T14269] tipc: Started in network mode [ 441.534635][T14269] tipc: Node identity 00000000000000000000000000000001, cluster identity 4711 [ 441.548212][T14269] tipc: Enabling of bearer rejected, failed to enable media [ 441.893729][T14282] lo speed is unknown, defaulting to 1000 [ 442.003724][T14282] lo speed is unknown, defaulting to 1000 [ 442.827118][T14292] lo speed is unknown, defaulting to 1000 [ 442.846466][T14292] lo speed is unknown, defaulting to 1000 [ 443.475375][T14296] bond0: (slave bond4): Releasing backup interface [ 443.641628][ T10] syz1: Port: 1 Link DOWN [ 444.449172][T14325] netlink: 8 bytes leftover after parsing attributes in process `syz.2.2290'. [ 444.901143][T14335] lo speed is unknown, defaulting to 1000 [ 444.913568][T14335] lo speed is unknown, defaulting to 1000 [ 445.028841][T14340] netlink: 'syz.3.2294': attribute type 1 has an invalid length. [ 445.054231][T14340] netlink: 'syz.3.2294': attribute type 4 has an invalid length. [ 445.074523][T14340] netlink: 9462 bytes leftover after parsing attributes in process `syz.3.2294'. [ 445.660146][T14351] netlink: 56 bytes leftover after parsing attributes in process `syz.4.2298'. [ 445.732683][T14349] netlink: 12 bytes leftover after parsing attributes in process `syz.3.2296'. [ 445.758533][T14349] tipc: Enabling of bearer rejected, failed to enable media [ 445.908744][T14363] netlink: 44 bytes leftover after parsing attributes in process `syz.2.2299'. [ 445.918044][T14363] netlink: 43 bytes leftover after parsing attributes in process `syz.2.2299'. [ 445.927078][T14363] netlink: 'syz.2.2299': attribute type 6 has an invalid length. [ 445.951459][T14363] netlink: 'syz.2.2299': attribute type 5 has an invalid length. [ 445.984090][T14354] netlink: 'syz.2.2299': attribute type 16 has an invalid length. [ 445.992291][T14354] netlink: 'syz.2.2299': attribute type 17 has an invalid length. [ 446.000365][T14363] netlink: 43 bytes leftover after parsing attributes in process `syz.2.2299'. [ 446.058227][T14354] 8021q: adding VLAN 0 to HW filter on device bond0 [ 446.100901][T14354] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 446.164053][ T7103] lo speed is unknown, defaulting to 1000 [ 446.170298][ T7103] syz2: Port: 1 Link ACTIVE [ 446.219824][T14373] netlink: 16 bytes leftover after parsing attributes in process `syz.4.2300'. [ 446.280457][T14238] Set syz1 is full, maxelem 65536 reached [ 446.418504][T14379] netlink: 8 bytes leftover after parsing attributes in process `syz.3.2302'. [ 446.515968][T14379] (unnamed net_device) (uninitialized): option lacp_rate: mode dependency failed, not supported in mode balance-rr(0) [ 446.707735][ T5843] Bluetooth: hci4: command 0x0405 tx timeout [ 447.066515][T14392] lo speed is unknown, defaulting to 1000 [ 447.104494][T14392] lo speed is unknown, defaulting to 1000 [ 447.346198][T14410] netlink: 56 bytes leftover after parsing attributes in process `syz.4.2310'. [ 448.313224][T14396] geneve0: left allmulticast mode [ 448.319404][T14396] veth7: left promiscuous mode [ 448.339321][T14406] geneve0: entered allmulticast mode [ 448.530074][T14425] xt_hashlimit: size too large, truncated to 1048576 [ 448.771190][T14427] lo speed is unknown, defaulting to 1000 [ 448.790442][T14427] lo speed is unknown, defaulting to 1000 [ 449.664648][T14450] netlink: 56 bytes leftover after parsing attributes in process `syz.0.2321'. [ 449.806545][T14444] lo speed is unknown, defaulting to 1000 [ 449.826933][T14444] lo speed is unknown, defaulting to 1000 [ 449.865023][T14455] netlink: 12 bytes leftover after parsing attributes in process `syz.0.2323'. [ 449.927102][T14454] lo speed is unknown, defaulting to 1000 [ 449.950691][T14457] xt_CT: You must specify a L4 protocol and not use inversions on it [ 450.337776][T14474] netlink: 72 bytes leftover after parsing attributes in process `syz.2.2325'. [ 450.407509][T14474] tipc: Enabling of bearer rejected, already enabled [ 450.418805][T14462] netlink: 8 bytes leftover after parsing attributes in process `syz.4.2324'. [ 450.600260][T14454] lo speed is unknown, defaulting to 1000 [ 451.653502][T14490] netlink: 16 bytes leftover after parsing attributes in process `syz.1.2329'. [ 451.727427][T14494] netlink: 4 bytes leftover after parsing attributes in process `syz.3.2331'. [ 451.857139][T14495] lo speed is unknown, defaulting to 1000 [ 451.880962][T14495] lo speed is unknown, defaulting to 1000 [ 452.183683][T14509] netlink: 72 bytes leftover after parsing attributes in process `syz.3.2336'. [ 452.216853][T14509] tipc: Enabling of bearer rejected, already enabled [ 452.559507][T14510] lo speed is unknown, defaulting to 1000 [ 452.598905][T14510] lo speed is unknown, defaulting to 1000 [ 452.649632][T14519] netlink: 4 bytes leftover after parsing attributes in process `syz.1.2339'. [ 452.752177][T14521] ICMPv6: Received fragmented ndisc packet. Carefully consider disabling suppress_frag_ndisc. [ 452.835242][T14526] netlink: 12 bytes leftover after parsing attributes in process `syz.3.2340'. [ 452.909943][T14526] bridge6: entered promiscuous mode [ 452.915344][T14526] bridge6: entered allmulticast mode [ 453.224329][T14495] syz.4.2330: vmalloc error: size 268435456, failed to allocated page array size 524288, mode:0xdc2(GFP_KERNEL|__GFP_HIGHMEM|__GFP_ZERO), nodemask=(null),cpuset=/,mems_allowed=0-1 [ 453.244359][T14495] CPU: 0 UID: 0 PID: 14495 Comm: syz.4.2330 Not tainted 6.16.0-rc3-syzkaller-00903-g20a0c20f82ac #0 PREEMPT(full) [ 453.244386][T14495] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 453.244400][T14495] Call Trace: [ 453.244407][T14495] [ 453.244416][T14495] dump_stack_lvl+0x189/0x250 [ 453.244457][T14495] ? __pfx_dump_stack_lvl+0x10/0x10 [ 453.244489][T14495] ? __pfx__printk+0x10/0x10 [ 453.244511][T14495] ? cpuset_print_current_mems_allowed+0x1f/0x360 [ 453.244534][T14495] ? cpuset_print_current_mems_allowed+0x1f/0x360 [ 453.244558][T14495] ? cpuset_print_current_mems_allowed+0x2ee/0x360 [ 453.244583][T14495] warn_alloc+0x214/0x310 [ 453.244612][T14495] ? __pfx_warn_alloc+0x10/0x10 [ 453.244644][T14495] ? __get_vm_area_node+0x28f/0x300 [ 453.244666][T14495] ? __do_replace+0xb4/0xaa0 [ 453.244700][T14495] __vmalloc_node_range_noprof+0x67e/0x12f0 [ 453.244720][T14495] ? stack_depot_save_flags+0x40/0x900 [ 453.244770][T14495] ? translate_table+0x1b4d/0x1f90 [ 453.244802][T14495] ? __pfx___vmalloc_node_range_noprof+0x10/0x10 [ 453.244832][T14495] ? __do_replace+0xb4/0xaa0 [ 453.244884][T14495] vzalloc_noprof+0xb2/0xf0 [ 453.244905][T14495] ? __do_replace+0xb4/0xaa0 [ 453.244936][T14495] __do_replace+0xb4/0xaa0 [ 453.244969][T14495] ? __pfx_translate_table+0x10/0x10 [ 453.245012][T14495] ? __pfx___do_replace+0x10/0x10 [ 453.245052][T14495] ? _copy_from_user+0x94/0xb0 [ 453.245077][T14495] do_arpt_set_ctl+0xa2a/0xf10 [ 453.245111][T14495] ? __mutex_trylock_common+0x153/0x260 [ 453.245134][T14495] ? __pfx_do_arpt_set_ctl+0x10/0x10 [ 453.245168][T14495] ? rcu_is_watching+0x15/0xb0 [ 453.245216][T14495] ? __mutex_unlock_slowpath+0x1cd/0x700 [ 453.245244][T14495] ? __pfx___mutex_lock+0x10/0x10 [ 453.245267][T14495] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 453.245288][T14495] ? aa_sk_perm+0x81e/0x950 [ 453.245316][T14495] ? __pfx_aa_sk_perm+0x10/0x10 [ 453.245346][T14495] nf_setsockopt+0x26f/0x290 [ 453.245380][T14495] ? __pfx_sock_common_setsockopt+0x10/0x10 [ 453.245425][T14495] do_sock_setsockopt+0x25a/0x3e0 [ 453.245458][T14495] ? __pfx_do_sock_setsockopt+0x10/0x10 [ 453.245495][T14495] ? __fget_files+0x2a/0x420 [ 453.245529][T14495] __x64_sys_setsockopt+0x18b/0x220 [ 453.245566][T14495] do_syscall_64+0xfa/0x3b0 [ 453.245591][T14495] ? lockdep_hardirqs_on+0x9c/0x150 [ 453.245614][T14495] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 453.245636][T14495] ? clear_bhb_loop+0x60/0xb0 [ 453.245663][T14495] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 453.245684][T14495] RIP: 0033:0x7f21ce78e929 [ 453.245711][T14495] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 453.245731][T14495] RSP: 002b:00007f21cf5e0038 EFLAGS: 00000246 ORIG_RAX: 0000000000000036 [ 453.245754][T14495] RAX: ffffffffffffffda RBX: 00007f21ce9b6080 RCX: 00007f21ce78e929 [ 453.245771][T14495] RDX: 0000000000000060 RSI: 0000000000000000 RDI: 0000000000000003 [ 453.245784][T14495] RBP: 00007f21ce810b39 R08: 0000000000000068 R09: 0000000000000000 [ 453.245798][T14495] R10: 0000200000000180 R11: 0000000000000246 R12: 0000000000000000 [ 453.245812][T14495] R13: 0000000000000000 R14: 00007f21ce9b6080 R15: 00007fffbcde8c68 [ 453.245854][T14495] [ 453.245863][T14495] Mem-Info: [ 453.479949][T14532] netlink: 12 bytes leftover after parsing attributes in process `syz.1.2343'. [ 453.514576][T14495] active_anon:13169 inactive_anon:0 isolated_anon:0 [ 453.514576][T14495] active_file:1421 inactive_file:40002 isolated_file:0 [ 453.514576][T14495] unevictable:768 dirty:506 writeback:0 [ 453.514576][T14495] slab_reclaimable:12126 slab_unreclaimable:209768 [ 453.514576][T14495] mapped:37198 shmem:7112 pagetables:1036 [ 453.514576][T14495] sec_pagetables:0 bounce:0 [ 453.514576][T14495] kernel_misc_reclaimable:0 [ 453.514576][T14495] free:1195769 free_pcp:13746 free_cma:0 [ 453.514633][T14495] Node 0 active_anon:52676kB inactive_anon:0kB active_file:5684kB inactive_file:159804kB unevictable:1536kB isolated(anon):0kB isolated(file):0kB mapped:148792kB dirty:2024kB writeback:0kB shmem:26912kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB writeback_tmp:0kB kernel_stack:12880kB pagetables:3996kB sec_pagetables:0kB all_unreclaimable? no Balloon:0kB [ 453.514684][T14495] Node 1 active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:204kB unevictable:1536kB isolated(anon):0kB isolated(file):0kB mapped:0kB dirty:0kB writeback:0kB shmem:1536kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB writeback_tmp:0kB kernel_stack:48kB pagetables:148kB sec_pagetables:0kB all_unreclaimable? no Balloon:0kB [ 453.695726][T14532] tipc: Enabling of bearer rejected, failed to enable media [ 453.768036][T14495] Node 0 DMA free:15360kB boost:0kB min:204kB low:252kB high:300kB reserved_highatomic:0KB free_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB present:15992kB managed:15360kB mlocked:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB [ 453.836063][T14495] lowmem_reserve[]: 0 2500 2502 2502 2502 [ 453.843543][T14495] Node 0 DMA32 free:839076kB boost:0kB min:34264kB low:42828kB high:51392kB reserved_highatomic:0KB free_highatomic:0KB active_anon:52520kB inactive_anon:0kB active_file:5684kB inactive_file:157976kB unevictable:1536kB writepending:1736kB present:3129332kB managed:2560932kB mlocked:0kB bounce:0kB free_pcp:30812kB local_pcp:15808kB free_cma:0kB [ 453.955247][T14495] lowmem_reserve[]: 0 0 1 1 1 [ 454.007202][T14495] Node 0 Normal free:16kB boost:0kB min:24kB low:28kB high:32kB reserved_highatomic:0KB free_highatomic:0KB active_anon:48kB inactive_anon:0kB active_file:0kB inactive_file:1828kB unevictable:0kB writepending:0kB present:1048580kB managed:1900kB mlocked:0kB bounce:0kB free_pcp:8kB local_pcp:8kB free_cma:0kB [ 454.097503][T14495] lowmem_reserve[]: 0 0 0 0 0 [ 454.102356][T14495] Node 1 Normal free:3892652kB boost:0kB min:55612kB low:69512kB high:83412kB reserved_highatomic:0KB free_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:204kB unevictable:1536kB writepending:0kB present:4194300kB managed:4111164kB mlocked:0kB bounce:0kB free_pcp:23560kB local_pcp:12488kB free_cma:0kB [ 454.179768][T14495] lowmem_reserve[]: 0 0 0 0 0 [ 454.191848][T14495] Node 0 DMA: 0*4kB 0*8kB 0*16kB 0*32kB 0*64kB 0*128kB 0*256kB 0*512kB 1*1024kB (U) 1*2048kB (M) 3*4096kB (M) = 15360kB [ 454.226200][T14495] Node 0 DMA32: 1*4kB (E) 49*8kB (ME) 3*16kB (UME) 2*32kB (ME) 56*64kB (UME) 140*128kB (UME) 83*256kB (UM) 66*512kB (UME) 63*1024kB (UM) 13*2048kB (UME) 162*4096kB (UM) = 831740kB [ 454.290155][T14495] Node 0 Normal: 0*4kB 0*8kB 1*16kB (M) 0*32kB 0*64kB 0*128kB 0*256kB 0*512kB 0*1024kB 0*2048kB 0*4096kB = 16kB [ 454.330849][T14553] netlink: 48 bytes leftover after parsing attributes in process `syz.1.2348'. [ 454.354036][T14549] lo speed is unknown, defaulting to 1000 [ 454.360925][T14495] Node 1 Normal: 237*4kB (UE) 63*8kB (UME) 46*16kB (UME) 76*32kB (UME) 23*64kB (UME) 6*128kB (UME) 5*256kB (UM) 5*512kB (UME) 1*1024kB (M) 3*2048kB (UE) 946*4096kB (M) = 3892684kB [ 454.409369][T14495] Node 0 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 454.426332][T14549] lo speed is unknown, defaulting to 1000 [ 454.459031][T14495] Node 0 hugepages_total=2 hugepages_free=2 hugepages_surp=0 hugepages_size=2048kB [ 454.488480][T14495] Node 1 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 454.530209][T14495] Node 1 hugepages_total=2 hugepages_free=2 hugepages_surp=0 hugepages_size=2048kB [ 454.539847][T14495] 47411 total pagecache pages [ 454.549802][T14495] 0 pages in swap cache [ 454.553967][T14495] Free swap = 124996kB [ 454.570710][T14495] Total swap = 124996kB [ 454.574981][T14495] 2097051 pages RAM [ 454.580589][T14553] bond8: (slave veth13): Releasing active interface [ 454.588457][T14495] 0 pages HighMem/MovableOnly [ 454.598108][T14495] 424712 pages reserved [ 454.607980][T14495] 0 pages cma reserved [ 454.620389][T14553] bond9: (slave batadv0): Releasing active interface [ 454.638610][T14561] netlink: 32 bytes leftover after parsing attributes in process `syz.0.2349'. [ 454.702674][T14560] netlink: 72 bytes leftover after parsing attributes in process `syz.3.2350'. [ 454.717360][T14560] tipc: Enabling of bearer rejected, already enabled [ 455.157744][T14555] lo speed is unknown, defaulting to 1000 [ 455.207059][T14565] netlink: 8 bytes leftover after parsing attributes in process `syz.3.2351'. [ 455.253844][T14555] lo speed is unknown, defaulting to 1000 [ 455.284271][T14570] netlink: 4 bytes leftover after parsing attributes in process `syz.4.2352'. [ 455.342303][T14572] netlink: 4 bytes leftover after parsing attributes in process `syz.2.2353'. [ 455.705948][T14581] netlink: 'syz.3.2355': attribute type 15 has an invalid length. [ 455.743442][T14581] netlink: 'syz.3.2355': attribute type 3 has an invalid length. [ 455.782181][T14581] netlink: 24 bytes leftover after parsing attributes in process `syz.3.2355'. [ 455.830750][T14582] netlink: 'syz.3.2355': attribute type 282 has an invalid length. [ 455.944577][T14576] rdma_rxe: rxe_newlink: failed to add batadv_slave_1 [ 456.296952][T14602] tipc: Enabling of bearer rejected, already enabled [ 456.746761][T14601] lo speed is unknown, defaulting to 1000 [ 456.786874][T14601] lo speed is unknown, defaulting to 1000 [ 457.166800][T14611] sctp: [Deprecated]: syz.3.2364 (pid 14611) Use of struct sctp_assoc_value in delayed_ack socket option. [ 457.166800][T14611] Use struct sctp_sack_info instead [ 457.330699][T14610] lo speed is unknown, defaulting to 1000 [ 457.375942][T14610] lo speed is unknown, defaulting to 1000 [ 457.445988][T14624] xt_addrtype: ipv6 PROHIBIT (THROW, NAT ..) matching not supported [ 457.949253][T14637] __nla_validate_parse: 3 callbacks suppressed [ 457.949272][T14637] netlink: 4 bytes leftover after parsing attributes in process `syz.4.2371'. [ 458.027580][T14639] netlink: 4 bytes leftover after parsing attributes in process `syz.0.2373'. [ 458.047629][T14637] rdma_rxe: rxe_newlink: failed to add batadv_slave_1 [ 458.515121][T14659] netlink: 32 bytes leftover after parsing attributes in process `syz.2.2378'. [ 458.591136][T14651] lo speed is unknown, defaulting to 1000 [ 458.617464][T14651] lo speed is unknown, defaulting to 1000 [ 458.892477][T14675] netlink: 8 bytes leftover after parsing attributes in process `syz.4.2388'. [ 458.991666][T14673] syzkaller0: create flow: hash 1151272614 index 1 [ 459.018672][ T3452] syzkaller0: tun_net_xmit 76 [ 459.031886][ T3452] syzkaller0: tun_net_xmit 48 [ 459.180458][ T7114] syzkaller0: tun_net_xmit 76 [ 459.203866][T14685] netlink: 4 bytes leftover after parsing attributes in process `syz.4.2390'. [ 459.291747][ T7114] syzkaller0: tun_net_xmit 76 [ 459.337879][T14678] syzkaller0: delete flow: hash 1151272614 index 1 [ 460.779877][T14698] netlink: 4 bytes leftover after parsing attributes in process `syz.3.2395'. [ 461.022774][T14703] wireguard0: entered promiscuous mode [ 461.047830][T14703] wireguard0: entered allmulticast mode [ 461.075781][T14707] netlink: 72 bytes leftover after parsing attributes in process `syz.0.2399'. [ 461.091391][T14707] tipc: Enabling of bearer rejected, already enabled [ 461.191489][T14711] netlink: 8 bytes leftover after parsing attributes in process `syz.3.2400'. [ 461.318276][T14720] netlink: 'syz.4.2404': attribute type 1 has an invalid length. [ 461.346011][T14721] netlink: 8 bytes leftover after parsing attributes in process `syz.0.2403'. [ 461.370616][T14720] bond4: entered promiscuous mode [ 461.376010][T14720] 8021q: adding VLAN 0 to HW filter on device bond4 [ 461.383214][T14725] netlink: 3 bytes leftover after parsing attributes in process `syz.4.2404'. [ 461.424708][T14725] batadv0: entered promiscuous mode [ 461.434589][T14725] batadv0: entered allmulticast mode [ 461.466750][T14725] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 461.525702][T14725] bond4: (slave batadv0): making interface the new active one [ 461.549333][T14725] bond4: (slave batadv0): Enslaving as an active interface with an up link [ 462.006967][T14754] nftables ruleset with unbound set [ 462.388666][T14778] bridge_slave_0: default FDB implementation only supports local addresses [ 462.421571][T14779] bridge6: entered promiscuous mode [ 462.438135][T14779] bridge6: entered allmulticast mode [ 462.556559][T14785] tipc: Enabling of bearer rejected, already enabled [ 462.953406][T14792] geneve0: entered allmulticast mode [ 463.018493][T14796] __nla_validate_parse: 6 callbacks suppressed [ 463.018521][T14796] netlink: 56 bytes leftover after parsing attributes in process `syz.2.2431'. [ 463.096363][T14799] xt_CT: You must specify a L4 protocol and not use inversions on it [ 463.190620][T14801] netlink: 12 bytes leftover after parsing attributes in process `syz.2.2431'. [ 463.407964][T14812] netlink: 4 bytes leftover after parsing attributes in process `syz.2.2437'. [ 463.462065][T14804] xt_CT: No such helper "pptp" [ 463.786761][T14824] netlink: 'syz.2.2444': attribute type 12 has an invalid length. [ 463.804366][T14826] lo: entered allmulticast mode [ 463.825736][T14826] lo: left allmulticast mode [ 463.926242][T14828] geneve0: entered allmulticast mode [ 464.011466][T14831] lo speed is unknown, defaulting to 1000 [ 464.030373][T14831] lo speed is unknown, defaulting to 1000 [ 464.095299][T14835] netlink: 28 bytes leftover after parsing attributes in process `syz.0.2447'. [ 464.160516][T14836] RDS: rds_bind could not find a transport for fe80::1a, load rds_tcp or rds_rdma? [ 464.494095][T14843] netlink: 72 bytes leftover after parsing attributes in process `syz.3.2450'. [ 464.528901][T14843] tipc: Enabling of bearer rejected, already enabled [ 464.732209][T14834] netlink: 20 bytes leftover after parsing attributes in process `syz.4.2446'. [ 464.781170][T14834] SET target dimension over the limit! [ 464.919523][T14850] geneve0: left allmulticast mode [ 464.938206][T14850] veth0: left promiscuous mode [ 464.947506][T14850] macsec1: left promiscuous mode [ 464.958146][T14850] bridge6: left promiscuous mode [ 464.963406][T14850] bridge6: left allmulticast mode [ 465.081196][T14861] xt_CT: You must specify a L4 protocol and not use inversions on it [ 465.084920][T14862] lo: entered allmulticast mode [ 465.225835][T14862] lo: left allmulticast mode [ 465.452700][T14878] netlink: 72 bytes leftover after parsing attributes in process `syz.3.2461'. [ 465.511714][T14878] tipc: Enabling of bearer rejected, already enabled [ 465.575316][T14877] netlink: 72 bytes leftover after parsing attributes in process `syz.0.2464'. [ 465.595311][T14877] tipc: Enabling of bearer rejected, already enabled [ 466.554003][T14928] netlink: 8 bytes leftover after parsing attributes in process `syz.4.2481'. [ 466.574097][T14928] netlink: 20 bytes leftover after parsing attributes in process `syz.4.2481'. [ 466.764167][T14941] tipc: Enabling of bearer rejected, already enabled [ 466.953808][T14948] lo speed is unknown, defaulting to 1000 [ 466.961444][T14948] lo speed is unknown, defaulting to 1000 [ 466.967574][ T30] audit: type=1107 audit(1751196882.428:10): pid=14940 uid=0 auid=4294967295 ses=4294967295 subj=unconfined msg='1d]:xJP@cd$JnyO^D#z' [ 466.992109][T14953] netlink: 'syz.1.2490': attribute type 12 has an invalid length. [ 467.589888][T14973] tc_dump_action: action bad kind [ 468.128969][T14993] geneve0: entered allmulticast mode [ 468.355760][T15008] hsr0: entered promiscuous mode [ 468.488345][T15020] __nla_validate_parse: 6 callbacks suppressed [ 468.488363][T15020] netlink: 72 bytes leftover after parsing attributes in process `syz.1.2515'. [ 468.504760][T15020] tipc: Enabled bearer , priority 10 [ 468.561278][T15022] netlink: 72 bytes leftover after parsing attributes in process `syz.3.2517'. [ 468.575081][T15022] tipc: Enabling of bearer rejected, already enabled [ 469.056841][T15039] netlink: 8 bytes leftover after parsing attributes in process `syz.0.2522'. [ 469.374325][T15059] netlink: 8 bytes leftover after parsing attributes in process `syz.1.2533'. [ 469.499447][ T7114] tipc: Node number set to 1 [ 469.597909][T15075] syzkaller1: entered promiscuous mode [ 469.603562][T15075] syzkaller1: entered allmulticast mode [ 470.000357][T15100] netlink: 'syz.4.2547': attribute type 12 has an invalid length. [ 470.108286][T15105] mac80211_hwsim hwsim3 wlan0: entered promiscuous mode [ 470.121367][T15105] A link change request failed with some changes committed already. Interface wlan0 may have been left with an inconsistent configuration, please check. [ 470.336801][T15111] lo speed is unknown, defaulting to 1000 [ 470.356258][T15111] lo speed is unknown, defaulting to 1000 [ 470.435426][T15117] netlink: 32 bytes leftover after parsing attributes in process `syz.3.2550'. [ 470.574242][T15122] netlink: 56 bytes leftover after parsing attributes in process `syz.1.2554'. [ 470.835942][T15133] mac80211_hwsim hwsim10 wlan0: entered promiscuous mode [ 470.954557][T15136] bond4: (slave batadv0): Releasing active interface [ 471.008309][T15141] syzkaller1: entered promiscuous mode [ 471.013831][T15141] syzkaller1: entered allmulticast mode [ 471.280640][T15153] netlink: 4 bytes leftover after parsing attributes in process `syz.3.2565'. [ 471.480790][T15163] netlink: 'syz.0.2567': attribute type 12 has an invalid length. [ 471.556498][T15167] netlink: 40 bytes leftover after parsing attributes in process `syz.3.2569'. [ 471.680149][T15172] netlink: 36 bytes leftover after parsing attributes in process `syz.4.2570'. [ 471.732975][T15172] netlink: 24 bytes leftover after parsing attributes in process `syz.4.2570'. [ 472.146070][T15192] netlink: 'syz.2.2578': attribute type 10 has an invalid length. [ 472.484877][T15202] netlink: 'syz.0.2582': attribute type 10 has an invalid length. [ 472.492929][T15202] geneve0: left allmulticast mode [ 472.515087][T15202] A link change request failed with some changes committed already. Interface geneve0 may have been left with an inconsistent configuration, please check. [ 472.701521][T15218] syzkaller1: entered promiscuous mode [ 472.707178][T15218] syzkaller1: entered allmulticast mode [ 472.760566][T15222] netlink: 'syz.3.2593': attribute type 12 has an invalid length. [ 473.226197][T15257] vlan0: entered promiscuous mode [ 473.248166][T15257] mac80211_hwsim hwsim11 wlan1: entered promiscuous mode [ 473.255388][T15257] vlan0: entered allmulticast mode [ 473.290402][T15257] mac80211_hwsim hwsim11 wlan1: entered allmulticast mode [ 473.471947][T15265] vxcan1: entered allmulticast mode [ 473.679865][T15274] __nla_validate_parse: 13 callbacks suppressed [ 473.679883][T15274] netlink: 4 bytes leftover after parsing attributes in process `syz.3.2610'. [ 473.701786][T15276] netlink: 'syz.2.2613': attribute type 3 has an invalid length. [ 473.931210][T15288] netlink: 72 bytes leftover after parsing attributes in process `syz.1.2614'. [ 473.952638][T15288] tipc: Enabling of bearer rejected, already enabled [ 473.986247][T15293] netlink: 4 bytes leftover after parsing attributes in process `syz.3.2616'. [ 474.019138][T15293] rdma_rxe: rxe_newlink: failed to add batadv_slave_1 [ 474.336711][T15304] lo speed is unknown, defaulting to 1000 [ 474.344224][T15304] lo speed is unknown, defaulting to 1000 [ 474.383003][T15310] syzkaller1: entered promiscuous mode [ 474.396534][T15310] syzkaller1: entered allmulticast mode [ 474.430754][T15311] macsec2: entered promiscuous mode [ 474.443063][T15311] veth0: entered promiscuous mode [ 474.779665][T15326] netlink: 12 bytes leftover after parsing attributes in process `syz.2.2625'. [ 474.802160][T15326] netlink: 12 bytes leftover after parsing attributes in process `syz.2.2625'. [ 475.076351][ T30] audit: type=1107 audit(1751196890.558:11): pid=15330 uid=0 auid=4294967295 ses=4294967295 subj=unconfined msg='1d]:xJP@cd$JnyO^D#z' [ 475.125165][T15335] lo speed is unknown, defaulting to 1000 [ 475.227314][T15335] lo speed is unknown, defaulting to 1000 [ 475.480801][T15352] netlink: 72 bytes leftover after parsing attributes in process `syz.2.2631'. [ 475.527259][T15352] tipc: Enabling of bearer rejected, already enabled [ 475.616697][T15358] netlink: 4 bytes leftover after parsing attributes in process `syz.1.2635'. [ 476.019686][T15373] lo: entered allmulticast mode [ 476.054094][T15373] lo: left allmulticast mode [ 476.215615][T15377] netlink: 8 bytes leftover after parsing attributes in process `syz.0.2643'. [ 476.243126][T15382] syzkaller1: entered promiscuous mode [ 476.257767][T15382] syzkaller1: entered allmulticast mode [ 476.468807][T15395] syzkaller1: entered promiscuous mode [ 476.474320][T15395] syzkaller1: entered allmulticast mode [ 476.856760][T15421] netlink: 8 bytes leftover after parsing attributes in process `syz.4.2653'. [ 477.071983][T15427] lo: entered allmulticast mode [ 477.082228][T15427] lo: left allmulticast mode [ 477.298830][T15436] vxcan3: entered allmulticast mode [ 477.568752][T15447] netlink: 8 bytes leftover after parsing attributes in process `syz.3.2665'. [ 477.696310][T15455] syzkaller1: entered promiscuous mode [ 477.708308][T15455] syzkaller1: entered allmulticast mode [ 477.846267][T15472] rdma_rxe: rxe_newlink: failed to add batadv_slave_1 [ 478.451407][T15498] tipc: Bearer : already 2 bearers with priority 10 [ 478.460833][T15498] tipc: Bearer : trying with adjusted priority [ 478.473743][T15500] ================================================================== [ 478.481833][T15500] BUG: KASAN: slab-use-after-free in rose_get_neigh+0x391/0x990 [ 478.489462][T15500] Read of size 1 at addr ffff88807abc4430 by task syz.1.2681/15500 [ 478.493691][T15498] tipc: Enabling of bearer rejected, max 3 bearers permitted [ 478.497353][T15500] [ 478.497369][T15500] CPU: 0 UID: 0 PID: 15500 Comm: syz.1.2681 Not tainted 6.16.0-rc3-syzkaller-00903-g20a0c20f82ac #0 PREEMPT(full) [ 478.497394][T15500] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 478.497407][T15500] Call Trace: [ 478.497415][T15500] [ 478.497423][T15500] dump_stack_lvl+0x189/0x250 [ 478.497457][T15500] ? __virt_addr_valid+0x1c8/0x5c0 [ 478.497475][T15500] ? rcu_is_watching+0x15/0xb0 [ 478.497505][T15500] ? __kasan_check_byte+0x12/0x40 [ 478.497526][T15500] ? __pfx_dump_stack_lvl+0x10/0x10 [ 478.497555][T15500] ? rcu_is_watching+0x15/0xb0 [ 478.497584][T15500] ? lock_release+0x4b/0x3e0 [ 478.497614][T15500] ? __virt_addr_valid+0x1c8/0x5c0 [ 478.497639][T15500] ? __virt_addr_valid+0x4a5/0x5c0 [ 478.497659][T15500] print_report+0xd2/0x2b0 [ 478.497684][T15500] ? rose_get_neigh+0x391/0x990 [ 478.497702][T15500] kasan_report+0x118/0x150 [ 478.497722][T15500] ? rose_get_neigh+0x391/0x990 [ 478.497745][T15500] rose_get_neigh+0x391/0x990 [ 478.497766][T15500] rose_connect+0x416/0x10a0 [ 478.497795][T15500] ? __pfx_current_check_access_socket+0x10/0x10 [ 478.497829][T15500] ? aa_sk_perm+0x81e/0x950 [ 478.497853][T15500] ? __might_fault+0xb0/0x130 [ 478.497887][T15500] ? __pfx_rose_connect+0x10/0x10 [ 478.497917][T15500] ? aa_af_perm+0x210/0x2b0 [ 478.497941][T15500] ? tomoyo_socket_connect_permission+0x164/0x290 [ 478.497979][T15500] ? bpf_lsm_socket_connect+0x9/0x20 [ 478.498009][T15500] __sys_connect+0x313/0x440 [ 478.498039][T15500] ? __pfx___sys_connect+0x10/0x10 [ 478.498075][T15500] ? rcu_is_watching+0x15/0xb0 [ 478.498113][T15500] __x64_sys_connect+0x7a/0x90 [ 478.498140][T15500] do_syscall_64+0xfa/0x3b0 [ 478.498166][T15500] ? lockdep_hardirqs_on+0x9c/0x150 [ 478.498190][T15500] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 478.498213][T15500] ? clear_bhb_loop+0x60/0xb0 [ 478.498238][T15500] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 478.498260][T15500] RIP: 0033:0x7fd4b078e929 [ 478.498281][T15500] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 478.498300][T15500] RSP: 002b:00007fd4b16bb038 EFLAGS: 00000246 ORIG_RAX: 000000000000002a [ 478.498324][T15500] RAX: ffffffffffffffda RBX: 00007fd4b09b5fa0 RCX: 00007fd4b078e929 [ 478.498340][T15500] RDX: 000000000000001c RSI: 00002000000000c0 RDI: 0000000000000004 [ 478.498354][T15500] RBP: 00007fd4b0810b39 R08: 0000000000000000 R09: 0000000000000000 [ 478.498368][T15500] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 478.498382][T15500] R13: 0000000000000000 R14: 00007fd4b09b5fa0 R15: 00007ffeda553518 [ 478.498409][T15500] [ 478.498416][T15500] [ 478.767851][T15500] Allocated by task 14404: [ 478.772256][T15500] kasan_save_track+0x3e/0x80 [ 478.776936][T15500] __kasan_kmalloc+0x93/0xb0 [ 478.781517][T15500] __kmalloc_noprof+0x27a/0x4f0 [ 478.786363][T15500] copy_splice_read+0x143/0x9b0 [ 478.791216][T15500] splice_direct_to_actor+0x4d0/0xcc0 [ 478.796582][T15500] do_splice_direct+0x181/0x270 [ 478.801432][T15500] do_sendfile+0x4da/0x7e0 [ 478.805849][T15500] __se_sys_sendfile64+0x13e/0x190 [ 478.811048][T15500] do_syscall_64+0xfa/0x3b0 [ 478.815556][T15500] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 478.821455][T15500] [ 478.823787][T15500] Freed by task 14404: [ 478.827851][T15500] kasan_save_track+0x3e/0x80 [ 478.832537][T15500] kasan_save_free_info+0x46/0x50 [ 478.837576][T15500] __kasan_slab_free+0x62/0x70 [ 478.842370][T15500] kfree+0x18e/0x440 [ 478.846267][T15500] copy_splice_read+0x881/0x9b0 [ 478.851162][T15500] splice_direct_to_actor+0x4d0/0xcc0 [ 478.856547][T15500] do_splice_direct+0x181/0x270 [ 478.861433][T15500] do_sendfile+0x4da/0x7e0 [ 478.865848][T15500] __se_sys_sendfile64+0x13e/0x190 [ 478.870961][T15500] do_syscall_64+0xfa/0x3b0 [ 478.875500][T15500] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 478.881396][T15500] [ 478.883715][T15500] The buggy address belongs to the object at ffff88807abc4400 [ 478.883715][T15500] which belongs to the cache kmalloc-512 of size 512 [ 478.897761][T15500] The buggy address is located 48 bytes inside of [ 478.897761][T15500] freed 512-byte region [ffff88807abc4400, ffff88807abc4600) [ 478.911465][T15500] [ 478.913803][T15500] The buggy address belongs to the physical page: [ 478.920218][T15500] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0xffff88807abc6400 pfn:0x7abc4 [ 478.930357][T15500] head: order:2 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 478.938854][T15500] flags: 0xfff00000000240(workingset|head|node=0|zone=1|lastcpupid=0x7ff) [ 478.947351][T15500] page_type: f5(slab) [ 478.951330][T15500] raw: 00fff00000000240 ffff88801a441c80 ffffea000143e410 ffffea00012c8b10 [ 478.959905][T15500] raw: ffff88807abc6400 0000000000100002 00000000f5000000 0000000000000000 [ 478.968486][T15500] head: 00fff00000000240 ffff88801a441c80 ffffea000143e410 ffffea00012c8b10 [ 478.977161][T15500] head: ffff88807abc6400 0000000000100002 00000000f5000000 0000000000000000 [ 478.985837][T15500] head: 00fff00000000002 ffffea0001eaf101 00000000ffffffff 00000000ffffffff [ 478.994509][T15500] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000004 [ 479.003181][T15500] page dumped because: kasan: bad access detected [ 479.009589][T15500] page_owner tracks the page as allocated [ 479.015296][T15500] page last allocated via order 2, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 7053, tgid 7052 (syz.0.277), ts 142043431707, free_ts 114168214006 [ 479.036567][T15500] post_alloc_hook+0x240/0x2a0 [ 479.041348][T15500] get_page_from_freelist+0x21e4/0x22c0 [ 479.046890][T15500] __alloc_frozen_pages_noprof+0x181/0x370 [ 479.052693][T15500] alloc_pages_mpol+0x232/0x4a0 [ 479.057541][T15500] allocate_slab+0x8a/0x3b0 [ 479.062043][T15500] ___slab_alloc+0xbfc/0x1480 [ 479.066711][T15500] __kmalloc_noprof+0x305/0x4f0 [ 479.071553][T15500] copy_splice_read+0x143/0x9b0 [ 479.076486][T15500] splice_direct_to_actor+0x4d0/0xcc0 [ 479.081857][T15500] do_splice_direct+0x181/0x270 [ 479.086701][T15500] do_sendfile+0x4da/0x7e0 [ 479.091109][T15500] __se_sys_sendfile64+0x13e/0x190 [ 479.096223][T15500] do_syscall_64+0xfa/0x3b0 [ 479.100732][T15500] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 479.106638][T15500] page last free pid 6514 tgid 6513 stack trace: [ 479.112956][T15500] __free_frozen_pages+0xc71/0xe70 [ 479.118071][T15500] __put_partials+0x161/0x1c0 [ 479.122742][T15500] put_cpu_partial+0x17c/0x250 [ 479.127502][T15500] __slab_free+0x2f7/0x400 [ 479.131913][T15500] qlist_free_all+0x97/0x140 [ 479.136505][T15500] kasan_quarantine_reduce+0x148/0x160 [ 479.141973][T15500] __kasan_slab_alloc+0x22/0x80 [ 479.146816][T15500] __kmalloc_cache_noprof+0x1be/0x3d0 [ 479.152183][T15500] __genradix_ptr_alloc+0x352/0x4a0 [ 479.157376][T15500] __genradix_prealloc+0x44/0x90 [ 479.162404][T15500] sctp_stream_init+0x14b/0x440 [ 479.167265][T15500] sctp_association_new+0x10dd/0x25f0 [ 479.172680][T15500] sctp_connect_new_asoc+0x2c5/0x690 [ 479.177973][T15500] sctp_sendmsg+0x155c/0x2810 [ 479.182664][T15500] __sock_sendmsg+0x19c/0x270 [ 479.187353][T15500] __sys_sendto+0x3bd/0x520 [ 479.191856][T15500] [ 479.194188][T15500] Memory state around the buggy address: [ 479.199811][T15500] ffff88807abc4300: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 479.207872][T15500] ffff88807abc4380: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 479.215930][T15500] >ffff88807abc4400: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 479.223984][T15500] ^ [ 479.229621][T15500] ffff88807abc4480: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 479.237762][T15500] ffff88807abc4500: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 479.245815][T15500] ================================================================== [ 479.254060][T15500] Kernel panic - not syncing: KASAN: panic_on_warn set ... [ 479.261263][T15500] CPU: 0 UID: 0 PID: 15500 Comm: syz.1.2681 Not tainted 6.16.0-rc3-syzkaller-00903-g20a0c20f82ac #0 PREEMPT(full) [ 479.273335][T15500] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 479.283402][T15500] Call Trace: [ 479.286699][T15500] [ 479.289734][T15500] dump_stack_lvl+0x99/0x250 [ 479.294336][T15500] ? __asan_memcpy+0x40/0x70 [ 479.298930][T15500] ? __pfx_dump_stack_lvl+0x10/0x10 [ 479.304135][T15500] ? __pfx__printk+0x10/0x10 [ 479.308728][T15500] panic+0x2db/0x790 [ 479.312638][T15500] ? __pfx_panic+0x10/0x10 [ 479.317067][T15500] ? _raw_spin_unlock_irqrestore+0xa8/0x110 [ 479.322960][T15500] ? _raw_spin_unlock_irqrestore+0xad/0x110 [ 479.328850][T15500] ? __pfx__raw_spin_unlock_irqrestore+0x10/0x10 [ 479.335178][T15500] ? print_memory_metadata+0x314/0x400 [ 479.340657][T15500] ? rose_get_neigh+0x391/0x990 [ 479.345509][T15500] check_panic_on_warn+0x89/0xb0 [ 479.350465][T15500] ? rose_get_neigh+0x391/0x990 [ 479.355331][T15500] end_report+0x78/0x160 [ 479.359577][T15500] kasan_report+0x129/0x150 [ 479.364093][T15500] ? rose_get_neigh+0x391/0x990 [ 479.368945][T15500] rose_get_neigh+0x391/0x990 [ 479.373646][T15500] rose_connect+0x416/0x10a0 [ 479.378246][T15500] ? __pfx_current_check_access_socket+0x10/0x10 [ 479.384589][T15500] ? aa_sk_perm+0x81e/0x950 [ 479.389196][T15500] ? __might_fault+0xb0/0x130 [ 479.393893][T15500] ? __pfx_rose_connect+0x10/0x10 [ 479.398924][T15500] ? aa_af_perm+0x210/0x2b0 [ 479.403423][T15500] ? tomoyo_socket_connect_permission+0x164/0x290 [ 479.409843][T15500] ? bpf_lsm_socket_connect+0x9/0x20 [ 479.415133][T15500] __sys_connect+0x313/0x440 [ 479.419743][T15500] ? __pfx___sys_connect+0x10/0x10 [ 479.424859][T15500] ? rcu_is_watching+0x15/0xb0 [ 479.429631][T15500] __x64_sys_connect+0x7a/0x90 [ 479.434399][T15500] do_syscall_64+0xfa/0x3b0 [ 479.438899][T15500] ? lockdep_hardirqs_on+0x9c/0x150 [ 479.444096][T15500] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 479.450155][T15500] ? clear_bhb_loop+0x60/0xb0 [ 479.454826][T15500] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 479.460715][T15500] RIP: 0033:0x7fd4b078e929 [ 479.465126][T15500] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 479.484727][T15500] RSP: 002b:00007fd4b16bb038 EFLAGS: 00000246 ORIG_RAX: 000000000000002a [ 479.493141][T15500] RAX: ffffffffffffffda RBX: 00007fd4b09b5fa0 RCX: 00007fd4b078e929 [ 479.501114][T15500] RDX: 000000000000001c RSI: 00002000000000c0 RDI: 0000000000000004 [ 479.509079][T15500] RBP: 00007fd4b0810b39 R08: 0000000000000000 R09: 0000000000000000 [ 479.517048][T15500] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 479.525014][T15500] R13: 0000000000000000 R14: 00007fd4b09b5fa0 R15: 00007ffeda553518 [ 479.532992][T15500] [ 479.536306][T15500] Kernel Offset: disabled [ 479.540630][T15500] Rebooting in 86400 seconds..