last executing test programs: 41.649193999s ago: executing program 2 (id=8543): r0 = socket$inet_udp(0x2, 0x2, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='memory.events\x00', 0x7a44, 0x1700) (async) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='memory.events\x00', 0x7a44, 0x1700) ioctl$EXT4_IOC_GROUP_ADD(r1, 0x40086602, &(0x7f0000000000)={0xfff}) getsockopt$ARPT_SO_GET_ENTRIES(r0, 0x0, 0x61, 0x0, &(0x7f0000000040)) 41.376654062s ago: executing program 2 (id=8548): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0x5001}) r1 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_inet_SIOCSIFFLAGS(r1, 0x8914, &(0x7f0000000200)={'syzkaller1\x00', 0x1}) ioctl$sock_inet_SIOCSIFADDR(r1, 0x8916, &(0x7f0000000200)={'syzkaller1\x00', {0x2, 0x0, @dev={0xac, 0x14, 0x0, 0x1}}}) bind$inet(r1, &(0x7f0000000040)={0x2, 0x4e20, @dev={0xac, 0x14, 0x0, 0x1}}, 0x10) write$tun(r0, &(0x7f00000000c0)={@void, @val={0x1, 0x5, 0xfffe, 0x10, 0x1014, 0x5}, @arp=@ether_ipv6={0x1, 0x86dd, 0x6, 0x10, 0xa, @random="fa5a536f3548", @initdev={0xfe, 0x88, '\x00', 0x1, 0x0}, @broadcast, @dev={0xfe, 0x80, '\x00', 0x17}}}, 0x3e) 40.829612237s ago: executing program 1 (id=8551): socket$nl_generic(0x10, 0x3, 0x10) (async) r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000040), 0xffffffffffffffff) r2 = socket$pptp(0x18, 0x1, 0x2) setsockopt$XDP_RX_RING(0xffffffffffffffff, 0x11b, 0x2, &(0x7f0000000040)=0x20, 0x4) r3 = socket$netlink(0x10, 0x3, 0x400000000000004) r4 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r4, 0x6, 0x13, &(0x7f0000000040)=0x100000001, 0x4) (async) setsockopt$inet6_tcp_int(r4, 0x6, 0x13, &(0x7f0000000040)=0x100000001, 0x4) connect$inet6(r4, &(0x7f0000000080)={0xa, 0x4e22, 0xfffffffe, @mcast1, 0x8}, 0x1c) (async) connect$inet6(r4, &(0x7f0000000080)={0xa, 0x4e22, 0xfffffffe, @mcast1, 0x8}, 0x1c) bpf$MAP_CREATE(0x0, &(0x7f00000004c0)=ANY=[@ANYBLOB="0f00000004000000040200a8cce5b8d44d065e6efa6a1ee3b353dab66397e500000000000000db1e8f838bdd196bf1658f07c502e9a564119a187dce83be5d"], 0x50) (async) r5 = bpf$MAP_CREATE(0x0, &(0x7f00000004c0)=ANY=[@ANYBLOB="0f00000004000000040200a8cce5b8d44d065e6efa6a1ee3b353dab66397e500000000000000db1e8f838bdd196bf1658f07c502e9a564119a187dce83be5d"], 0x50) setsockopt$inet6_tcp_TCP_ULP(r4, 0x6, 0x1f, &(0x7f0000000140), 0x4) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f00000048c0)={0xffffffffffffffff, &(0x7f00000005c0)="797e12f0faf0c9e0dc79131643afd71bfdde90c89039fb8d4dfd9a41c28cc472a171dd62271a214077db28c3c8fa7b01595032ffcaa61529ff554c40ec076231a3edbcb601362cd42cb93733b86b289ce9c675aceb01f4e85325a769e73c8c99096649715695dda5b51e685a8dd6faa9cbd0e35ff5bde7ca7816e106cfc4d5b920c1a3909dc0c6d6af2034752bc6", &(0x7f0000000000)=@tcp6=r4}, 0x20) (async) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f00000048c0)={0xffffffffffffffff, &(0x7f00000005c0)="797e12f0faf0c9e0dc79131643afd71bfdde90c89039fb8d4dfd9a41c28cc472a171dd62271a214077db28c3c8fa7b01595032ffcaa61529ff554c40ec076231a3edbcb601362cd42cb93733b86b289ce9c675aceb01f4e85325a769e73c8c99096649715695dda5b51e685a8dd6faa9cbd0e35ff5bde7ca7816e106cfc4d5b920c1a3909dc0c6d6af2034752bc6", &(0x7f0000000000)=@tcp6=r4}, 0x20) bpf$MAP_CREATE(0x0, &(0x7f0000000780)=ANY=[@ANYRES64=r1, @ANYRES32, @ANYRES16=r1, @ANYRES32=0x0, @ANYRESOCT=r5, @ANYRES8=r2], 0x48) (async) r6 = bpf$MAP_CREATE(0x0, &(0x7f0000000780)=ANY=[@ANYRES64=r1, @ANYRES32, @ANYRES16=r1, @ANYRES32=0x0, @ANYRESOCT=r5, @ANYRES8=r2], 0x48) bpf$MAP_CREATE(0x0, &(0x7f00000007c0)=ANY=[@ANYBLOB="0c00000004000000040000000900000000000000", @ANYRESOCT, @ANYBLOB="00000000000023000000000000000000000000003309333ec522e4d59e480d6c12fe2db992febe0100e2a97a2cc06adff231e74c59b90c23c8b16ab103834ee7b7e26d0600f98c141d04a95c1b41d043c702775df71c3c33ced9fccfca6a85245dc6d3ee712f56efc6e1adaaea7c692256ad885d9f50d60924a4eaacafb76431fb8d77f66c088ac5e1b24e958d5c6eed4072d7c87042628e8b68ac0fb4431a39d0294071ca90a61d7ae3c8e9d1948593b1a418f4c174a46250cd16137c72e7a4cf3b683c6bfd970a537a8f8bded142eb4e9a18ec071d292fea59bbb51f61cdf54a90c674e6a4f6ebfb07b7314b39e76c0c6e1b085255938a6b1ff16bb480e5c7144dc091c143666efdefe5b56b0e50282310c3aa79b6edc0a919561dc0397e2933e15da4d700fb018ac437e9c291379a95fc46d99765d27d3608fb1cfcf128e28954f763f6ade16966b462bc0fa817a7df8d0300000049a200c4a8c71b461f2d5594c6b0ea8d77121ef6", @ANYRES32=0x0, @ANYRES32, @ANYBLOB='\x00'/28], 0x50) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, &(0x7f0000000440)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r7 = bpf$BPF_BTF_GET_FD_BY_ID(0x13, &(0x7f0000000180)=0xffffffffffffffff, 0x4) socket$xdp(0x2c, 0x3, 0x0) socket$netlink(0x10, 0x3, 0x8) (async) r8 = socket$netlink(0x10, 0x3, 0x8) writev(r8, &(0x7f0000000080)=[{&(0x7f00000002c0)="480000001400190d09004beafd0d8c562c84ed7a060f000000000000a2bc5603ca00000f7f89000000200000000101ff0000000309ff5bffff00c700"/72, 0x48}], 0x1) bpf$PROG_LOAD(0x5, &(0x7f0000000400)={0x1d, 0xc, &(0x7f0000000380)=ANY=[@ANYRES8=r6], &(0x7f00000003c0)='GPL\x00', 0x0, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, @lsm=0x2b, r7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) writev(r3, &(0x7f0000019440)=[{&(0x7f0000000200)="480000001400190d7ebdeb75fd0d8c562c84d8c033ed7a80ffe0090f000060000000a2bc5603ca00000f7f89000000200000004a2471083ec6991778581acb6c0101ff0000000309", 0x48}], 0x1) r9 = socket$kcm(0x2, 0x200000000000001, 0x106) r10 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000580)='cpuacct.usage_all\x00', 0x275a, 0x0) write$cgroup_subtree(r10, &(0x7f0000000000)=ANY=[], 0x3261e) (async) write$cgroup_subtree(r10, &(0x7f0000000000)=ANY=[], 0x3261e) r11 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r11, &(0x7f0000000040)={0x3, 0x0, &(0x7f0000000340)={&(0x7f0000000200)=ANY=[@ANYBLOB="020300030c0000002abd7000fbcbdf2502000900080000000000000000000000030006000000000002004e22e0000002000000000000000002000100000000000000020300000000030005000000000002"], 0x60}, 0x1, 0x7}, 0x0) mmap(&(0x7f0000002000/0x2000)=nil, 0x2000, 0x3000005, 0x10010, r9, 0x8000) setsockopt$sock_attach_bpf(r9, 0x6, 0x19, &(0x7f0000000ec0)=r10, 0x4) (async) setsockopt$sock_attach_bpf(r9, 0x6, 0x19, &(0x7f0000000ec0)=r10, 0x4) sendmsg$RDMA_NLDEV_CMD_SET(0xffffffffffffffff, &(0x7f0000000300)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x2000010}, 0xc, &(0x7f00000002c0)={&(0x7f0000000280)=ANY=[@ANYBLOB="24000000021400042abd7000fddbdf2508004400", @ANYRES32=r10, @ANYBLOB="0900020073797a3204000000"], 0x24}, 0x1, 0x0, 0x0, 0x41}, 0x4011) (async) sendmsg$RDMA_NLDEV_CMD_SET(0xffffffffffffffff, &(0x7f0000000300)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x2000010}, 0xc, &(0x7f00000002c0)={&(0x7f0000000280)=ANY=[@ANYBLOB="24000000021400042abd7000fddbdf2508004400", @ANYRES32=r10, @ANYBLOB="0900020073797a3204000000"], 0x24}, 0x1, 0x0, 0x0, 0x41}, 0x4011) pwrite64(0xffffffffffffffff, &(0x7f0000000000), 0x0, 0x9) sendmsg$IPVS_CMD_NEW_DAEMON(r0, &(0x7f0000000dc0)={0x0, 0x0, &(0x7f0000000d80)={&(0x7f0000000080)=ANY=[@ANYBLOB='C\x00\x00\x00', @ANYRES16=r1, @ANYBLOB="010000040000fedbdf25090000003800038014000200726f736530000000000000000000000006000400000000000800030000000000080001000200000008000500ac1414bb"], 0x4c}}, 0x44890) 40.525801416s ago: executing program 0 (id=8554): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_NEW(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f00000001c0)=ANY=[@ANYBLOB="a00000000001010400000000000000000a0000003c0001802c00018014000300fe8000000000000000000000000000aa14000400ff0100000000000000000000000000010c0002800500010000000000440002802c00018014000300fe8000000000000000000000000000aa14000400fe8800000000000000000000000000010c0002800500010000000000000004000680ca98707835dc8f9ad116aba8bcadbb69f5323ee63a7cd6c62974bd58228d08732e9b26b2dfba48a883f2a02b0000000000000000000000000000f9863fb7e2befc9d963f1a208cbfebf4c81d49881d6514fc665dc10f2e381ff3"], 0xa0}}, 0x0) sendmsg$IPCTNL_MSG_CT_NEW(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f00000004c0)={0xac, 0x0, 0x1, 0x401, 0x0, 0x0, {0xa}, [@CTA_TUPLE_ORIG={0x3c, 0x1, 0x0, 0x1, [@CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @empty}, {0x14, 0x4, @mcast1}}}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5}}]}, @CTA_TUPLE_REPLY={0x3c, 0x2, 0x0, 0x1, [@CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @local}, {0x14, 0x4, @local}}}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5}}]}, @CTA_TIMEOUT={0x8}, @CTA_NAT_SRC={0x18, 0x6, 0x0, 0x1, [@CTA_NAT_V6_MINIP={0x14, 0x4, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01'}]}]}, 0xac}}, 0x0) r1 = socket(0x80000000000000a, 0x2, 0x0) setsockopt$inet6_group_source_req(r1, 0x29, 0x2a, &(0x7f0000000080)={0x0, {{0xa, 0x0, 0x0, @mcast1={0xff, 0x7}}}, {{0xa, 0x0, 0x0, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}}}}, 0xfffffffffffffe5a) setsockopt$inet6_group_source_req(r1, 0x29, 0x2b, &(0x7f00000005c0)={0x0, {{0xa, 0x0, 0x7, @mcast1={0xff, 0x7}}}, {{0xa, 0x0, 0x0, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}}}}, 0x108) r2 = socket(0x400000000010, 0x3, 0x0) r3 = socket$can_j1939(0x1d, 0x2, 0x7) r4 = syz_init_net_socket$x25(0x9, 0x5, 0x0) write(r4, 0x0, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000100)={'veth1_to_team\x00', 0x0}) r6 = socket$inet(0x2, 0x2, 0x0) getsockopt$ARPT_SO_GET_REVISION_TARGET(r6, 0x0, 0x63, 0x0, &(0x7f0000000040)=0x1e) sendmsg$nl_route_sched(r2, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0x25dfdbfd, {0x0, 0x0, 0x0, r5, {0x0, 0xfff1}, {0xffff, 0xffff}, {0x0, 0xf}}, [@qdisc_kind_options=@q_multiq={{0xb}, {0x6, 0x2, {0x42}}}]}, 0x38}}, 0x0) setsockopt$inet6_group_source_req(r1, 0x29, 0x2c, &(0x7f0000000480)={0x0, {{0xa, 0x0, 0x1, @mcast1={0xff, 0x7}, 0x8002}}, {{0xa, 0xfffd, 0xea, @remote, 0xfffffffc}}}, 0x108) 40.525129483s ago: executing program 2 (id=8555): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_init_net_socket$llc(0x1a, 0x1, 0x0) getsockopt$llc_int(r1, 0x10c, 0x6, &(0x7f00000018c0), &(0x7f00000079c0)=0x4) r2 = socket$netlink(0x10, 0x3, 0x8000000004) writev(r2, &(0x7f0000000280)=[{&(0x7f0000000040)="580000001400192340834b80040d8c560a067fbc45ff810540010000000058000b480400945f64009400050038925a01000000000000008004000000ffe809000000fff5dd000000100001000b080800418e01400004fcff", 0x58}], 0x1) r3 = socket$nl_route(0x10, 0x3, 0x0) r4 = socket$nl_generic(0x10, 0x3, 0x10) r5 = socket$nl_generic(0x10, 0x3, 0x10) r6 = socket$nl_generic(0x10, 0x3, 0x10) r7 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000000), 0xffffffffffffffff) r8 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r8, 0x8933, &(0x7f0000000080)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_EXTERNAL_AUTH(r5, &(0x7f0000000640)={0x0, 0x0, &(0x7f0000000600)={&(0x7f0000000380)=ANY=[@ANYBLOB="055766ed020ef1389b289c6c3f93b75f334ff6d4b3702ad6ac7a176e09873f7d95b4e5f8617924816383e2d6c5e7f029dc53d6b17282227d47901a6ee2ceb7e4a393ebe4a20521aeb4c49a5d0ae6dcd6b06a9f83a5f5d569681148e265e1c33b38354fe2666b0a07b8ff57aafab57dd70404de6578602ef6f51371b3dbb0c8db08a98f4800127dfa93be3c78f9a483ea5bf37fb25d", @ANYRES16=r7, @ANYBLOB="01002abd7000fddbdf257f00000008000300", @ANYRES32=r9, @ANYBLOB], 0x1c}, 0x1, 0x0, 0x0, 0x4040010}, 0x4000000) r10 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000300), r4) ioctl$sock_SIOCGIFINDEX_80211(r3, 0x8933, &(0x7f0000000340)={'wlan1\x00'}) sendmsg$NL80211_CMD_DEL_MPATH(r4, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000440)={&(0x7f0000000780)=ANY=[@ANYBLOB="88000000", @ANYRESOCT=r5, @ANYRESHEX=r10, @ANYRES32=r8, @ANYBLOB="0a001a0008021100000100000a001a0008021100000100000a001a0008021100000000000a001a0008021100000100000a00060008021100000000000a001af207021100000000000a000600ffffffffffff00000a90916b81001a00ffffffffffff00000a0006000802110000010000", @ANYRESDEC=r6, @ANYRESOCT=r7, @ANYRES64=r4], 0x88}, 0x1, 0x0, 0x0, 0x40040c0}, 0x4001) ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8933, &(0x7f0000000100)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_EXTERNAL_AUTH(r0, &(0x7f0000000200)={&(0x7f0000000040), 0xc, &(0x7f00000001c0)={&(0x7f0000000140)=ANY=[@ANYBLOB='L\x00\x00\x00', @ANYRES16=r10, @ANYBLOB="000127bd7000fedbdf257f00000008000300", @ANYRES32=r12, @ANYBLOB="06004800410000000a00f500c06d505050505008000019003400f3bca3bc3cbaffbf1b8530e60306b1ce3683ffb00f00"], 0x4c}, 0x1, 0x0, 0x0, 0x811}, 0x4014) sendmsg$NL80211_CMD_TDLS_CHANNEL_SWITCH(r8, &(0x7f0000000680)={&(0x7f00000002c0)={0x10, 0x0, 0x0, 0x40060018}, 0xc, &(0x7f00000005c0)={&(0x7f0000000880)=ANY=[@ANYRESOCT=r11, @ANYRES16=r10, @ANYRESOCT], 0x94}, 0x1, 0x0, 0x0, 0x40}, 0x4081) r13 = socket$packet(0x11, 0x3, 0x300) r14 = socket$inet_smc(0x2b, 0x1, 0x0) setsockopt$packet_tx_ring(r13, 0x107, 0xd, &(0x7f00000004c0)=@req3={0xfffffff9, 0x6, 0xc60, 0x9, 0x5, 0x16ac, 0xffff}, 0x1c) r15 = socket$inet_mptcp(0x2, 0x1, 0x106) setsockopt$inet_tcp_int(r15, 0x6, 0x19, &(0x7f00000001c0)=0x1, 0x4) bind$inet(r15, &(0x7f0000000100)={0x2, 0x4e24, @loopback}, 0x10) sendmmsg$inet(r15, &(0x7f0000004980)=[{{&(0x7f0000000000)={0x2, 0x4e24, @loopback}, 0x10, &(0x7f0000000040)=[{&(0x7f0000000340)="b9cd14c222ee", 0x4b}], 0x1}}], 0x49, 0x20008000) setsockopt$inet_tcp_TLS_TX(r15, 0x6, 0x1, &(0x7f0000000080)=@gcm_128={{0x304}, "be45f415d19a877b", "53a8e8ba641839da93589ef68e3aace9", "d6c25a50", "12b78d5d9ab7ce57"}, 0x28) getsockopt$inet_tcp_buf(r14, 0x11e, 0xd, 0x0, &(0x7f0000000100)=0xfffffd46) getsockopt$inet_mreqsrc(r14, 0x0, 0x26, &(0x7f0000000240)={@local, @remote, @initdev}, &(0x7f0000000280)=0xc) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r13, 0x8933, &(0x7f0000000080)) 39.77783262s ago: executing program 0 (id=8556): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$batadv(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$BATADV_CMD_GET_NEIGHBORS(r0, &(0x7f0000004340)={0x0, 0x0, &(0x7f0000000280)={&(0x7f00000000c0)=ANY=[@ANYBLOB='$\x00\x00\x00', @ANYRES16=r1, @ANYBLOB="310300000000000000000900000008000300", @ANYBLOB='\b'], 0x24}}, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f00000018c0)={0x0, 0x0, &(0x7f00000007c0)}, 0x8841) r2 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$MPTCP_PM_CMD_DEL_ADDR(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000240)={0x28, r2, 0x7, 0x0, 0x0, {}, [@MPTCP_PM_ATTR_ADDR={0x14, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_FAMILY={0x6, 0x1, 0x2}, @MPTCP_PM_ADDR_ATTR_ADDR4={0x8, 0x3, @local}]}]}, 0x28}}, 0x0) sendmsg$MPTCP_PM_CMD_FLUSH_ADDRS(0xffffffffffffffff, &(0x7f0000000900)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x8000}, 0xc, &(0x7f00000008c0)={&(0x7f0000000800)={0x14, r2, 0x1, 0x70bd26, 0x25dfdbff}, 0x14}, 0x1, 0x0, 0x0, 0x4000000}, 0x4005) sendmmsg$alg(0xffffffffffffffff, 0x0, 0x0, 0x40800) r3 = socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000580), 0xffffffffffffffff) bpf$MAP_CREATE_TAIL_CALL(0x0, 0x0, 0x50) ioctl$XFS_IOC_START_COMMIT(0xffffffffffffffff, 0x80585882, 0x0) bpf$MAP_UPDATE_CONST_STR(0x2, 0x0, 0x0) bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f0000000e80)=ANY=[], 0x50) ioctl$sock_SIOCGIFINDEX_80211(r3, 0x8933, &(0x7f00000013c0)={'wlan1\x00', 0x0}) setsockopt$IP6T_SO_SET_REPLACE(0xffffffffffffffff, 0x29, 0x40, &(0x7f0000000ec0)=@raw={'raw\x00', 0x8, 0x3, 0x590, 0x358, 0xffffffff, 0xffffffff, 0x358, 0xffffffff, 0x618, 0xffffffff, 0xffffffff, 0x618, 0xffffffff, 0x3, 0x0, {[{{@ipv6={@private0, @mcast2, [], [], 'veth0_macvtap\x00', 'dvmrp1\x00'}, 0x0, 0x330, 0x358, 0x0, {}, [@common=@unspec=@bpf1={{0x230}, @pinned={0x1, 0x0, 0x0, './file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa', {0x6}}}, @common=@inet=@hashlimit1={{0x58}, {'bond_slave_1\x00', {0x41, 0x1ff, 0x6, 0xb0e2, 0x10001, 0x84e, 0xfffffffb, 0x18, 0x8}, {0x1}}}]}, @common=@unspec=@NFQUEUE0={0x28}}, {{@ipv6={@remote, @ipv4={'\x00', '\xff\xff', @dev}, [], [], 'erspan0\x00', 'gre0\x00'}, 0x0, 0x100, 0x168, 0x0, {}, [@common=@inet=@hashlimit1={{0x58}, {'pim6reg\x00', {0xc4, 0x0, 0x5, 0x0, 0x0, 0x7, 0x3ff}}}]}, @unspec=@CT1={0x68, 'CT\x00', 0x1, {0x0, 0x8000, 0x16a, 0x1, 'syz1\x00', 'syz0\x00', {0x80000001}}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28, '\x00', 0x7}}}}, 0x5f0) sendmsg$NL80211_CMD_FRAME(r3, &(0x7f0000001380)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000dc0)=ANY=[@ANYBLOB="f4060000", @ANYRES16=r4, @ANYBLOB="01000000000000e14f003b00000008000300", @ANYRES32=r5, @ANYBLOB="d50633008000009effffffffffff080211000001"], 0x6f4}}, 0x0) r6 = socket$nl_generic(0x10, 0x3, 0x10) r7 = socket$nl_route(0x10, 0x3, 0x0) r8 = socket$inet6_udp(0xa, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r8, 0x8933, &(0x7f0000000c80)={'lo\x00', 0x0}) sendmsg$nl_route_sched(r7, &(0x7f0000001200)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000500)=@newqdisc={0x58, 0x24, 0x4ee4e6a52ff56541, 0x0, 0x0, {0x0, 0x0, 0x0, r9, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_netem={{0xa}, {0x28, 0x2, {{}, [@TCA_NETEM_JITTER64={0xc, 0xb, 0x6}]}}}]}, 0x58}}, 0x0) sendmsg$nl_generic(r6, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000400)={&(0x7f0000000300)=ANY=[@ANYBLOB="2400000047000701feffffffffffffff017c0000080001"], 0x24}, 0x1, 0x0, 0x0, 0x4048011}, 0xc000) 39.609640685s ago: executing program 1 (id=8558): r0 = socket$netlink(0x10, 0x3, 0x0) getsockopt$sock_int(r0, 0x1, 0x2d, 0x0, &(0x7f0000000040)) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000280)=[{&(0x7f0000000040)="d8000000180081054e81f782db4cb904021d080406037c09e8fe55a10a0015400200142603600e122f00160006000500a8000600200006400600027c035c9cc652bdcea3ea5a7134cf6efb8000a007a290457f0189b316277ce06bbace8017cbec4c2ee5a7cef4090000001fb791643a5ee4ce1b14d6d930dfe1d9d322fe7c9f8775730d16a4683f5aeb4edbb57a5025ccca9e00360db798262f3d40fad95667e006dcdfb8951f215ce3bbce81ed0bffece0b42a9ecb84ec95ee5de6ccd40dd6e4f1ef3d93452a92782f9ffcdb020e6f3baf432b25a55e08", 0xd8}], 0x1, 0x0, 0x0, 0x4a0f0000}, 0x4c000) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='memory.events\x00', 0x275a, 0x0) sendto$inet(r1, &(0x7f0000000140)="71b5fc0f1e72cbcf7fc32bba87ce5608b331bbe540817e93b0d4dc", 0x1b, 0xc840, &(0x7f0000000180)={0x2, 0x4e22, @rand_addr=0x64010102}, 0x10) write$cgroup_subtree(r1, &(0x7f0000000000)=ANY=[], 0x10448) socket$inet6_tcp(0xa, 0x1, 0x0) (async) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) listen(r2, 0x39b3) (async) listen(r2, 0x39b3) r3 = socket$inet6_mptcp(0xa, 0x1, 0x106) listen(r3, 0x7d4165c9) (async) listen(r3, 0x7d4165c9) r4 = socket$inet6_tcp(0xa, 0x1, 0x0) listen(r4, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) (async) r5 = socket$inet6_tcp(0xa, 0x1, 0x0) r6 = socket$inet6_mptcp(0xa, 0x1, 0x106) listen(r6, 0xb) listen(r5, 0x0) (async) listen(r5, 0x0) r7 = socket$inet6_mptcp(0xa, 0x1, 0x106) listen(r7, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) (async) r8 = socket$inet6_tcp(0xa, 0x1, 0x0) openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) (async) r9 = openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$TUNSETIFF(r9, 0x400454ca, 0x0) (async) ioctl$TUNSETIFF(r9, 0x400454ca, 0x0) listen(r8, 0x0) setsockopt$inet6_tcp_TCP_MD5SIG(r5, 0x6, 0xe, &(0x7f0000000680)={@in6={{0xa, 0x4e21, 0x1, @private2={0xfc, 0x2, '\x00', 0x1}, 0x81}}, 0x0, 0x0, 0x40, 0x0, "2b20a1a47cddc63b223be606d7303a4d4d11e10450d766feb63b382d54bab577021cad5de4fe7630a33b6deca160b1267ff02123bc27830000000000ffff40000000000000b5b29049cb65f00300"}, 0xd8) r10 = socket$netlink(0x10, 0x3, 0x8000000004) writev(r10, &(0x7f0000000540)=[{&(0x7f0000000180)="580000001400192340834b80040d8c560a066f0200ff000000000000000058000b4824ca945f64009400ff0325010ebc000000000000008000f0effeffe809005300fff5dd00000010000100080c10000000000000000000", 0x58}], 0x1) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x2000001, 0x12, r1, 0x0) r11 = socket$nl_route(0x10, 0x3, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000440)={0xd, 0x9, &(0x7f00000002c0)=ANY=[@ANYBLOB="1808000000000000000000000000000085100000050000008500000088000000a700000000000000180000000000000000000000000000009500000000000000950000000000000080913bbcf549d9160fcdfd5d3262aa8035cfd3215f0c8db6b14ba4f43e20e45df87d221acec71fdb5c6a3fc189a50464762f214280a994a82561522f524af6c8b8cca2fcaab4ddb85297aafdd35245e895e51fad3d4943a9b3150653ff90584492daa6b8333bd151be2ed94e25a40410bcee34ed7006ed8b98719123c5431aeac31cce304a8dc29a0751f2a1fc6dfc13de0b63c5fb28a7ba5c535b7a2cc1d175754903b168d0a8347b0900"/256], &(0x7f00000003c0)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x34}, 0x90) sendmsg$nl_route(r11, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x24008000}, 0x4000) (async) sendmsg$nl_route(r11, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x24008000}, 0x4000) 37.383608084s ago: executing program 2 (id=8560): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x0) sendmsg$NFT_BATCH(r0, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f0000000340)=ANY=[@ANYBLOB="140000001000010000000000000000000200000a64000000060a010400000000000000000a0020050900010073797a3100000000380004803400018009000100686173680000000024000280080002400000000c0800064000000007080007510000000108000440fffffffe0900020073797a32"], 0x8c}, 0x1, 0x0, 0x0, 0x8890}, 0x24000000) r1 = socket$inet6_sctp(0xa, 0x1, 0x84) r2 = accept$inet6(r1, &(0x7f0000000080)={0xa, 0x0, 0x0, @local}, &(0x7f00000000c0)=0x1c) connect$inet6(r2, &(0x7f0000000100)={0xa, 0x4e24, 0xe82, @ipv4={'\x00', '\xff\xff', @initdev={0xac, 0x1e, 0x1, 0x0}}, 0x80000000}, 0x1c) sendmsg$NFT_MSG_GETSETELEM(r0, &(0x7f0000000480)={&(0x7f00000003c0)={0x10, 0x0, 0x0, 0x800000}, 0xc, &(0x7f0000000440)={&(0x7f0000000400)={0x20, 0xd, 0xa, 0x401, 0x0, 0x0, {0x2, 0x0, 0x3}, [@NFTA_SET_ELEM_LIST_TABLE={0x9, 0x1, 'syz1\x00'}]}, 0x20}, 0x1, 0x0, 0x0, 0x4040}, 0x4004800) syz_init_net_socket$bt_rfcomm(0x1f, 0x3, 0x3) (async) r3 = syz_init_net_socket$bt_rfcomm(0x1f, 0x3, 0x3) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) connect$bt_rfcomm(r3, &(0x7f0000000000)={0x1f, @none, 0x9}, 0xa) r5 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r5, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000044c0)={&(0x7f00000004c0)={0x5c, 0x2, 0x6, 0x3, 0x0, 0x0, {0x7}, [@IPSET_ATTR_DATA={0xc, 0x7, 0x0, 0x1, [@IPSET_ATTR_HASHSIZE={0x8, 0x12, 0x1, 0x0, 0x4}]}, @IPSET_ATTR_PROTOCOL={0x5, 0x1, 0x6}, @IPSET_ATTR_FAMILY={0x5, 0x5, 0x2}, @IPSET_ATTR_REVISION={0x5, 0x4, 0x5}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}, @IPSET_ATTR_TYPENAME={0x15, 0x3, 'hash:ip,port,net\x00'}]}, 0x5c}, 0x1, 0x0, 0x0, 0x810}, 0x20004000) (async) sendmsg$IPSET_CMD_CREATE(r5, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000044c0)={&(0x7f00000004c0)={0x5c, 0x2, 0x6, 0x3, 0x0, 0x0, {0x7}, [@IPSET_ATTR_DATA={0xc, 0x7, 0x0, 0x1, [@IPSET_ATTR_HASHSIZE={0x8, 0x12, 0x1, 0x0, 0x4}]}, @IPSET_ATTR_PROTOCOL={0x5, 0x1, 0x6}, @IPSET_ATTR_FAMILY={0x5, 0x5, 0x2}, @IPSET_ATTR_REVISION={0x5, 0x4, 0x5}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}, @IPSET_ATTR_TYPENAME={0x15, 0x3, 'hash:ip,port,net\x00'}]}, 0x5c}, 0x1, 0x0, 0x0, 0x810}, 0x20004000) accept(r3, &(0x7f0000000240)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @link_local}, &(0x7f00000002c0)=0x80) (async) r6 = accept(r3, &(0x7f0000000240)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @link_local}, &(0x7f00000002c0)=0x80) connect$llc(r6, &(0x7f0000000300)={0x1a, 0xffff, 0x2, 0x89, 0x5, 0x7d, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x17}}, 0x10) (async) connect$llc(r6, &(0x7f0000000300)={0x1a, 0xffff, 0x2, 0x89, 0x5, 0x7d, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x17}}, 0x10) r7 = socket$netlink(0x10, 0x3, 0x9) sendmsg$NFT_BATCH(r7, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000100)={{0x14, 0x3ec}, [], {0x14, 0x3e8}}, 0x28}, 0x1, 0x0, 0x0, 0x20000001}, 0x0) (async) sendmsg$NFT_BATCH(r7, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000100)={{0x14, 0x3ec}, [], {0x14, 0x3e8}}, 0x28}, 0x1, 0x0, 0x0, 0x20000001}, 0x0) getsockopt$inet_sctp6_SCTP_GET_ASSOC_STATS(r1, 0x84, 0x24, 0x0, &(0x7f0000000040)) (async) getsockopt$inet_sctp6_SCTP_GET_ASSOC_STATS(r1, 0x84, 0x24, 0x0, &(0x7f0000000040)) sendmsg$IPCTNL_MSG_CT_GET_STATS_CPU(r4, &(0x7f0000000200)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f00000001c0)={&(0x7f0000000180)={0x14, 0x4, 0x1, 0x0, 0x0, 0x0, {0xa, 0x0, 0x2}, ["", "", "", ""]}, 0x14}, 0x1, 0x0, 0x0, 0x30040090}, 0x240008c0) 35.556045163s ago: executing program 0 (id=8562): bpf$BPF_BTF_LOAD(0x12, &(0x7f0000006a40)={&(0x7f0000006940)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0xc, 0xc, 0x2, [@restrict={0x0, 0x0, 0x0, 0x12}]}}, 0x0, 0x26}, 0x20) bpf$PROG_LOAD(0x5, &(0x7f00000017c0)={0x18, 0xe, &(0x7f0000000200)=ANY=[@ANYBLOB="b700000001000000bfa30000000000000703000030feffff720af0fff8ffffff71a4f0ff000000002d040000000000003d400300000000006504000001ed000079110000000000006c440000000000007a0ab0fe000000007b13000000000000c500f9ffffff00009500000000000000023bc065b7a379d17cf9333379fc9e94af05000000f1a864a710aad58db6a693002e6b3be361917adef6ee1c8a2a4f8ef1e50becb19bc461e91a715bc5181554a090f32050e436fe275daf51efd601b6bf01c8e8b1b526375ec4dd6fcd82e4fee5bef7a29aa0d7d600c095199fe3ff3128c4e599b0eaebbdbd732c9cc00eec363e4a8f6456e2cc21557c0afc646cb7798b3e6440c2fbdb00a3e35208b0bb0d2cd829e654400e2438ec649dc74a28610643a98d9ec21ead2ed51b104d0800af25b845d8a7925c3109b151b8b9f75dd08d123deda88c658d42ecbf28bf7076c15b463bebc72f526d8e8afcb913466aaa7f6df70252e79166d858fcd0e06dd31af9612f2460d0b11008e59a5923906f88b53987ad1714e72ba7a54f0c33d390dd65be2467b373eafd9aa58f2077184b6a89adaf17b0a6041bdef728d236619074d6ebdf098bc908f523d228a40f9411fe7226a40409d6e37c4f46756d31cb467600ade70063e5291569b33d21dae356e1c5da18ec0ae564162a27afea62d84f3a10746443d64364f56e24e6d2105bd901204a1deeed4155617572652d950ad31928b0b0c3dc2869f478341d02d0f5ad94b081fcd507acb4b93d000000225d85ae49cee383dc5049076b98fb6853ab39a21514da60d2ae20cfb91d6a49964757cdf538f9ce2bdb1ab062cd54e67011d355d84ce97bb0c6b4a595e487efbb2d710b651f898ba749e40bc6980fe78683ac5c0c31030699ddd71063be9261b2e1aab1675b34a220488c126aeef5f510a8f1aded94a129e4aec6ffc3a15d96c2ea3e2e04cfe0e669e51731b2875353193f82ade69d0540059fe6c7fe7cd86975023cb08cc7596566d674e425da5e87e59602a9f6590521d31d3804b3e0a1053abdc31282dfb15eb6841bb64a1b304502dda787343ce3c953992e4a982f3c48153baae244e7bf37548c7f1a4cad2422ee965a38f7defbd2960242b104e20dc2d9b0c35608d402ccdd9069bd50b994fda7a9de44022a579dfc0229cc0dc98816106dec28eaeb883418f562ae00003ea96d10f172c0374d6eed82641687f3b3a70bfe9b4a9c5a90ff59d54d1f92ecc4e95dd2d18383117c039862198899b212c5538a294270a1ad10c80fef7c24c87afce829ba0f85da6d888f18ea40ab959f6074ab2a4009b9e5f07ab513cdc6c0e17fb1c1ca571380d7b4ead35a655e0b4a26b702396df7e0cbe02b6e4314f244a94aa8e98b0b263f0083bf93f05beb72f0861f7580e69db384ac7eeedcf2ba1a9508f9d6aba5823a34a9f1ffa968eacea75caf822a7a63ba34015ea5aacb1188883ad2a3b1832371fe5bc621426d1ed0a4a9b702cc1b6912a1e717d29135753208165b9cdbae2ed9dc06000000000000008fe26e37037f27f2f9a6a8346962a350845ffa0d829e4f79adc287906943408e05000000d03aac93df8866fb010aec0e92bed1fe39af169d2a466f0db6f3d9436a7d0a874c74b777df005c55fc30511d00000000c85265b2bd83d64a532869d708000000000000007baa5b6a682b50f0937f778af083e055f6138a757ebd0ed91114a6b244f9acf41ac5d73a008364e0606a594817031fc2f52c8785fe0721719b3d654026c6ea08b83b123145ab5703dad844ceb201ddeb6dc5f6a9037d2283c42efc54fa84323a56edbd287eba77f35c35d91f3c62a0ca74836a640224de85f2b4a5fee500bbc584328a6a7a4628c4378c9b71dff64075b74a6520adb187b40d2cccbcb08c0634ee74658d3e23bf2871ed2aa2a05e319374511c8b0bf1b69d2b3782b3f481c314e7bd4615dbbf24c06ac95bd639e68d0e6aa7f0d07bf69a93365f803f0144af37236ea133c2255b0613bf8ba1d538e06c2411e8d70053b712084fd0e313de9bb19266e49a3a2190cb039c6f89610acd896319b9c8d1b8aac2eaa5a4f8be7419a09e3fb5be3be2fcdadd2299839cc40e684e6e2b4e1385fde7a0babcb0be672110268a34dad364fddee69e564119cebb6940c6356ff83ca527c573d700000000000000c6299263e6d9097f225de969485bce3d7dc471c0669bb6a467cf0de54dfcc1857048fe22a19dbb1b3cb9babaa839f1f6e817a62d95a5b971ff96a5c66c338c6f2a2da4644519f40761402e9c81013d76c7152c95ba5efa24ce1930f23a2277f057ffb6b0144f3b434a2adc456ef4d2fbdf7c6238c2bb00ffcf2d23d68cb9b027f3b22589f7956b66c5692b46ea03abb6a404c8ccceaa4ba4161409fcb54b86eaca26b24464e0ff504b87c90697ec2a82bbfd1c31713190d3e6e502c434909d6ba06cd0361a0fd90552272f24519ea9938413947edd3a0a7aa780c1dcdddf13b46ca94f37c89664c9cc1857d64ca371fa1b6131"], &(0x7f00000001c0)='GPL\x00', 0x7, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, &(0x7f0000000000)={0x0, 0x5}, 0x8, 0x10, &(0x7f0000000000), 0x10}, 0x94) 34.366077527s ago: executing program 2 (id=8564): r0 = socket$nl_route(0x10, 0x3, 0x0) pselect6(0x0, 0x0, &(0x7f0000000080)={0x7, 0x1, 0x6537, 0x9, 0x339, 0x9, 0x3, 0x6}, 0x0, &(0x7f0000000140), 0x0) sendmsg$nl_route_sched(r0, &(0x7f0000006040)={0x0, 0x0, &(0x7f0000000300)={&(0x7f00000000c0)=@newtfilter={0x74, 0x2c, 0xd3f, 0x70bd2d, 0x25dfdbfb, {0x0, 0x0, 0x0, 0x0, {0xc, 0x4}, {0x0, 0x9}, {0x10, 0x9}}, [@filter_kind_options=@f_flow={{0x9}, {0xc, 0x2, [@TCA_FLOW_BASECLASS={0x8, 0x3, {0xa, 0xa}}]}}, @TCA_RATE={0x6, 0x5, {0x1, 0x9}}, @TCA_CHAIN={0x8, 0xb, 0x3}, @filter_kind_options=@f_u32={{0x8}, {0x18, 0x2, [@TCA_U32_INDEV={0x14, 0x8, 'veth1\x00'}]}}, @TCA_RATE={0x6, 0x5, {0x7, 0xf}}]}, 0x74}, 0x1, 0x0, 0x0, 0x4000004}, 0x0) r1 = socket$nl_generic(0x10, 0x3, 0x10) socket$nl_route(0x10, 0x3, 0x0) r2 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$nbd(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$NBD_CMD_CONNECT(r2, &(0x7f0000001ac0)={0x0, 0x0, &(0x7f0000001a80)={&(0x7f0000000a80)={0x30, r3, 0x1, 0xfffffffe, 0x0, {}, [@NBD_ATTR_SOCKETS={0x10, 0x7, 0x0, 0x1, [{0xc, 0x1, 0x0, 0x1, {0x7}}]}, @NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0xffff}]}, 0x30}, 0x1, 0x0, 0x0, 0x8000}, 0x20000000) r4 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r4, &(0x7f00000018c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000001900)=@bridge_delneigh={0x28, 0x1e, 0x100, 0x0, 0x0, {0x7}, [@NDA_LLADDR={0xa, 0x7}]}, 0x28}}, 0x0) sendmsg$nl_generic(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000001c0)=ANY=[@ANYBLOB="8025000041000701fefffffffeffffff017c0000040042800c00018006000600800a00005a250280bc1c1480b61318"], 0x2580}, 0x1, 0x0, 0x0, 0x4048011}, 0x24008841) 34.307628768s ago: executing program 0 (id=8565): sendmsg$BATADV_CMD_GET_TRANSTABLE_LOCAL(0xffffffffffffffff, 0x0, 0x20000000) r0 = socket$inet_mptcp(0x2, 0x1, 0x106) setsockopt$inet_tcp_int(r0, 0x6, 0x22, &(0x7f0000000180)=0x1, 0x4) setsockopt$inet_tcp_buf(r0, 0x6, 0x21, &(0x7f00000000c0)="6f73e0f2f60cba8a1e9f8c46bac19938f8e3d3bf2cc433ea7d831a080aab374acfe0dd4107819d7616f6bfe62a56d2f8f0fa2f82781ef26064ca072fd347db257d567b15092c52756621be273805df62f5dfd9b887c54d1f2e35be3b45323fd0d0285aa026c9fcad8dcc29ee8b6e9519e15d437e7ef77a0ed0d9b11efe", 0x7d) socket$inet6_icmp_raw(0xa, 0x3, 0x3a) sendmmsg$inet(r0, &(0x7f0000002080)=[{{&(0x7f0000000000)={0x2, 0x4e23, @empty}, 0x10, &(0x7f0000000080)=[{&(0x7f0000000040)="eb", 0x1}], 0x1}}, {{0x0, 0x0, 0x0}}], 0x2, 0x200080fc) bpf$TOKEN_CREATE(0x24, 0x0, 0x0) 33.822370677s ago: executing program 1 (id=8566): r0 = syz_init_net_socket$nfc_llcp(0x27, 0x1, 0x1) bind$bt_hci(r0, 0x0, 0x0) r1 = bpf$BPF_MAP_GET_FD_BY_ID(0xe, &(0x7f0000000000)={0xffffffffffffffff, 0x3}, 0xc) r2 = socket(0x11, 0x3, 0x300) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'hsr0\x00'}) (async) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'hsr0\x00', 0x0}) sendto$packet(r2, &(0x7f0000000240)="01154e00010000112233445588fb00010001160c8cc047e1e94b530d1d7f21d84742", 0x22, 0x0, &(0x7f0000000040)={0x11, 0xd, r3, 0x0, 0xff, 0x0}, 0x14) (async) sendto$packet(r2, &(0x7f0000000240)="01154e00010000112233445588fb00010001160c8cc047e1e94b530d1d7f21d84742", 0x22, 0x0, &(0x7f0000000040)={0x11, 0xd, r3, 0x0, 0xff, 0x0}, 0x14) bpf$BPF_BTF_GET_FD_BY_ID(0x13, &(0x7f00000001c0), 0x4) (async) r4 = bpf$BPF_BTF_GET_FD_BY_ID(0x13, &(0x7f00000001c0), 0x4) r5 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f0000000280)={0x3, 0x4, 0x4, 0xa, 0x0, 0xffffffffffffffff, 0x1, '\x00', 0x0, 0xffffffffffffffff, 0x4, 0x1, 0x5}, 0x50) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='memory.events\x00', 0x275a, 0x0) (async) r6 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='memory.events\x00', 0x275a, 0x0) write$cgroup_subtree(r6, &(0x7f0000000100)=ANY=[], 0x32600) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x2000001, 0x12, r6, 0x0) r7 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000300)='memory.swap.events\x00', 0x0, 0x0) ioctl$XFS_IOC_PATH_TO_HANDLE(r0, 0xc0385869, &(0x7f0000000440)={r0, &(0x7f0000000340)='%\x00', 0x80401, &(0x7f0000000380)={@_ha_fsid={[0x3, 0x3]}, {0x3, 0x2, 0xb, 0x10000}}, 0xfff, &(0x7f00000003c0)={@_ha_fsid}, &(0x7f0000000400)=0x1}) r9 = bpf$MAP_CREATE(0x0, &(0x7f0000000480)=@bloom_filter={0x1e, 0x60, 0x10, 0x2, 0x3a814, 0xffffffffffffffff, 0x10000, '\x00', 0x0, 0xffffffffffffffff, 0x4, 0x2, 0x1, 0x4}, 0x50) bpf$MAP_CREATE(0x0, &(0x7f0000000500)=@bloom_filter={0x1e, 0x2, 0x301, 0x0, 0x16508, 0x1, 0x40, '\x00', 0x0, 0xffffffffffffffff, 0x1, 0x5, 0x4, 0xa}, 0x50) (async) r10 = bpf$MAP_CREATE(0x0, &(0x7f0000000500)=@bloom_filter={0x1e, 0x2, 0x301, 0x0, 0x16508, 0x1, 0x40, '\x00', 0x0, 0xffffffffffffffff, 0x1, 0x5, 0x4, 0xa}, 0x50) bpf$MAP_UPDATE_CONST_STR(0x2, &(0x7f0000000600)={{0x1, 0xffffffffffffffff}, &(0x7f0000000580), &(0x7f00000005c0)='%pI4 \x00'}, 0x20) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000700)={0x18, 0x3, &(0x7f0000000040)=@raw=[@map_val={0x18, 0x6, 0x2, 0x0, r1, 0x0, 0x0, 0x0, 0x592}, @call={0x85, 0x0, 0x0, 0x11}], &(0x7f0000000080)='GPL\x00', 0x1, 0xd5, &(0x7f00000000c0)=""/213, 0x41100, 0x7, '\x00', r3, 0x0, r4, 0x8, &(0x7f0000000200)={0x4, 0x2}, 0x8, 0x10, &(0x7f0000000240)={0x0, 0xc, 0x9, 0x5}, 0x10, 0x0, 0x0, 0x5, &(0x7f0000000640)=[r5, 0x1, 0xffffffffffffffff, r6, r7, r8, r9, r10, r11], &(0x7f0000000680)=[{0x3, 0x3, 0xa, 0x8}, {0x1, 0x1, 0x3, 0x1}, {0xd, 0x2, 0x0, 0xb}, {0x4, 0x5, 0xb, 0x1}, {0x0, 0x4, 0xc, 0x2}], 0x10, 0x1000}, 0x94) 33.597083584s ago: executing program 0 (id=8567): r0 = socket(0x10, 0x3, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) (async) r2 = socket(0x3, 0x803, 0x1) syz_genetlink_get_family_id$mptcp(&(0x7f00000000c0), r2) r3 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r3, &(0x7f0000000280)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x754809e24e591deb}, 0xc, &(0x7f0000000240)={&(0x7f0000000180)={0x1c, 0x11, 0x2, 0x70bd2a, 0x25dfdbfb, {0x15}, [@typed={0x8, 0x4d, 0x0, 0x0, @u32=0x6}]}, 0x1c}, 0x1, 0x0, 0x0, 0x14000000}, 0xc080) r4 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_int(r4, 0x107, 0xc, &(0x7f00000000c0), 0x4) (async) getsockname$packet(r2, &(0x7f0000000680)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000003c0)=0x14) sendmsg$nl_route(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="3c0000001000010400eeffff11ffffffff000000", @ANYRES32=r5, @ANYBLOB="01000000010000001c0012000c000100627269646765"], 0x3c}}, 0x0) (async) sendmsg$nl_route_sched(r0, &(0x7f0000005840)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000200)=@newqdisc={0x2c, 0x24, 0x5820a61ca228651, 0x0, 0x25dfdbfb, {0x0, 0x0, 0x0, r5, {}, {0xffff, 0xffff}, {0x0, 0xfff1}}, [@qdisc_kind_options=@q_drr={0x8}]}, 0x2c}}, 0x0) (async) sendmsg$nl_route_sched(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000a40)=@newtfilter={0x24, 0x28, 0x1, 0x50bd29, 0x4, {0x0, 0x0, 0x0, r5, {0x9}, {0xffff}, {0x10, 0x5}}}, 0x24}, 0x1, 0x0, 0x0, 0x11}, 0x40) 31.415486322s ago: executing program 1 (id=8568): r0 = socket(0x10, 0x3, 0x0) setsockopt$netlink_NETLINK_TX_RING(r0, 0x10e, 0xc, &(0x7f0000000280)={0xffffffff}, 0x10) (async) sendmsg$nl_generic(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000c00)={0x24, 0x12, 0xa01, 0x0, 0x0, {0x7, 0x2}, [@nested={0x10, 0x0, 0x0, 0x1, [@typed={0xc, 0x0, 0x0, 0x0, @u64}]}]}, 0x24}}, 0x0) (async) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFULNL_MSG_CONFIG(r1, &(0x7f00000004c0)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000000440)={0x24, 0x1, 0x4, 0x801, 0x0, 0x0, {}, [@NFULA_CFG_FLAGS={0x6, 0x6, 0x1, 0x0, 0x6}, @NFULA_CFG_CMD={0x5, 0x1, 0x1}]}, 0x24}}, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000540)={&(0x7f0000000400)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0xc, 0xc, 0x2, [@struct={0x0, 0x58, 0x0, 0x3}]}}, 0x0, 0x26}, 0x20) (async) r2 = socket$inet_sctp(0x2, 0x1, 0x84) setsockopt$inet_mreqn(r2, 0x0, 0x24, &(0x7f0000000040)={@rand_addr=0x64010100, @multicast2}, 0xc) 26.874734052s ago: executing program 3 (id=8569): r0 = socket$nl_generic(0x10, 0x3, 0x10) (async) r1 = socket$netlink(0x10, 0x3, 0x10) (async) r2 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r1, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000006800)={&(0x7f0000000080)={0x3c, r2, 0x615, 0x0, 0x0, {}, [@MPTCP_PM_ATTR_ADDR={0x28, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_ADDR6={0x14, 0x4, @ipv4={'\x00', '\xff\xff', @private=0xa010100}}, @MPTCP_PM_ADDR_ATTR_PORT={0x6, 0x5, 0x4e22}, @MPTCP_PM_ADDR_ATTR_FAMILY={0x6, 0x1, 0xa}]}]}, 0x3c}, 0x5}, 0x0) (async) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r0, &(0x7f00000001c0)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x8}, 0xc, &(0x7f00000000c0)={&(0x7f0000000300)={0x7c, r2, 0x200, 0x70bd26, 0x25dfdbfc, {}, [@MPTCP_PM_ATTR_ADDR_REMOTE={0x3c, 0x6, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_ID={0x5, 0x2, 0x8}, @MPTCP_PM_ADDR_ATTR_ADDR4={0x8, 0x3, @empty}, @MPTCP_PM_ADDR_ATTR_ID={0x5, 0x2, 0x5}, @MPTCP_PM_ADDR_ATTR_FLAGS={0x8, 0x6, 0xc}, @MPTCP_PM_ADDR_ATTR_FLAGS={0x8, 0x6, 0x4}, @MPTCP_PM_ADDR_ATTR_PORT={0x6, 0x5, 0x4e21}, @MPTCP_PM_ADDR_ATTR_FLAGS={0x8, 0x6, 0x1f}]}, @MPTCP_PM_ATTR_ADDR_REMOTE={0x2c, 0x6, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_ID={0x5, 0x2, 0x7}, @MPTCP_PM_ADDR_ATTR_FLAGS={0x8, 0x6, 0x15}, @MPTCP_PM_ADDR_ATTR_ADDR4={0x8, 0x3, @initdev={0xac, 0x1e, 0x1, 0x0}}, @MPTCP_PM_ADDR_ATTR_ADDR4={0x8, 0x3, @local}, @MPTCP_PM_ADDR_ATTR_ID={0x5, 0x2, 0x8}]}]}, 0x7c}, 0x1, 0x0, 0x0, 0x40004}, 0x44000) (async) r3 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r3, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000000)=@ipv6_newrule={0x1c, 0x1a, 0x1, 0x0, 0x0, {0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10}}, 0x1c}}, 0x0) 25.767307868s ago: executing program 4 (id=8570): r0 = socket$inet6_mptcp(0xa, 0x1, 0x106) setsockopt$inet6_mtu(r0, 0x6, 0x11, 0x0, 0x0) r1 = syz_init_net_socket$bt_hidp(0x1f, 0x3, 0x6) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='memory.events\x00', 0x275a, 0x0) write$cgroup_subtree(r2, &(0x7f0000000100)=ANY=[], 0x32600) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x2000001, 0x12, r2, 0x0) ioctl$sock_bt_hidp_HIDPGETCONNLIST(r1, 0x800448d2, &(0x7f00000000c0)={0x0, 0x0}) r3 = socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt$SO_ATTACH_FILTER(r3, 0x1, 0x1a, &(0x7f0000000100)={0x1, &(0x7f0000000080)=[{0x6, 0x6e, 0x5, 0x6}]}, 0x10) setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(r3, 0x84, 0x64, &(0x7f0000000000)=[@in6={0xa, 0x4e23, 0x0, @loopback}], 0x1c) sendto$inet6(r3, &(0x7f0000000400)="cd", 0x1, 0x24040010, &(0x7f0000000100)={0xa, 0x4e23, 0x0, @loopback, 0xfffffffe}, 0x1c) 25.4465915s ago: executing program 1 (id=8571): r0 = socket$igmp(0x2, 0x3, 0x2) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000b80), 0xffffffffffffffff) r2 = socket$inet(0x2, 0x2, 0x1) bind$inet(r2, &(0x7f0000000000)={0x2, 0x6e24, @empty}, 0x10) r3 = socket$inet(0x2, 0x2, 0x1) bind$inet(r3, &(0x7f0000000000)={0x2, 0x6e24, @empty}, 0x10) close(0x4) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000bc0)={'wlan0\x00', 0x0}) r5 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL80211_CMD_REGISTER_FRAME(r5, &(0x7f0000002740)={0x0, 0x0, &(0x7f0000002700)={&(0x7f0000002380)={0x28, r1, 0x1, 0x70bd2a, 0x25dfdbff, {{}, {@val={0x8, 0x3, r4}, @void}}, [@NL80211_ATTR_FRAME_MATCH={0x4}, @NL80211_ATTR_FRAME_TYPE={0x6, 0x65, 0x5}]}, 0x28}, 0x1, 0x0, 0x0, 0xc001}, 0x0) 23.532000512s ago: executing program 4 (id=8572): r0 = socket$inet6_mptcp(0xa, 0x1, 0x106) getsockopt$inet6_int(r0, 0x29, 0x4e, 0x0, &(0x7f0000000000)) setsockopt$inet6_tcp_TCP_REPAIR(r0, 0x6, 0x13, &(0x7f0000000040)=0x1, 0x4) r1 = socket$netlink(0x10, 0x3, 0x0) setsockopt$netlink_NETLINK_DROP_MEMBERSHIP(r1, 0x10e, 0xc, &(0x7f00000000c0)=0x8, 0x4) sendmsg$netlink(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000580)=[{&(0x7f0000000140)=ANY=[@ANYBLOB="180000000005000c90d6f100806acde7ecbc708d01006f0000000000000000000000004aa00d468b4dc92fa8dd9467401529a5e7bd0e23f53eea95a72b5d8cc08bfa178e6541678193bd50ce53681be817fd0404a0f900000000008d8ae42d03d2c14fe8bc5472881f7f00af9380d2597d1aca19a66a2e8e547edecfe1cf35b7bcd7f5115e9517"], 0x18}], 0x1}, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000600)={0xb, 0x3, &(0x7f0000000000)=ANY=[@ANYBLOB="620ac4ff00000000711084000000000095"], &(0x7f0000000480)='GPL\x00'}, 0x90) 23.221179628s ago: executing program 4 (id=8573): r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f00000006c0), 0xffffffffffffffff) (async, rerun: 64) r2 = socket$nl_generic(0x10, 0x3, 0x10) (rerun: 64) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000001040)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_SET_TID_CONFIG(r2, &(0x7f0000000c00)={0x0, 0x0, &(0x7f0000000bc0)={&(0x7f0000000200)={0x34, r1, 0x1, 0x70bd25, 0x0, {{}, {@val={0x8, 0x3, r3}, @void}}, [@NL80211_ATTR_TID_CONFIG={0x18, 0x11d, 0x0, 0x1, [{0x14, 0x0, 0x0, 0x1, [@NL80211_TID_CONFIG_ATTR_TIDS={0x6, 0x5, 0xc0}, @NL80211_TID_CONFIG_ATTR_TX_RATE_TYPE={0x5, 0xc, 0x1}]}]}]}, 0x34}}, 0x0) (async) r4 = socket$nl_generic(0x10, 0x3, 0x10) r5 = syz_genetlink_get_family_id$wireguard(&(0x7f0000001100), r4) (async, rerun: 32) ioctl$ifreq_SIOCGIFINDEX_wireguard(r0, 0x8933, &(0x7f00000002c0)={'wg2\x00', 0x0}) (rerun: 32) sendmsg$WG_CMD_SET_DEVICE(r4, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000002040)=ANY=[@ANYBLOB='@\r\x00\x00', @ANYRES16=r5, @ANYBLOB="05000000000000000000010000000600060000000000c40c0880e400008024000100d1732899f611cd8994034d7f413dc957630e5493c285aca40065cb6311be696b24000100000000000000000000000000000000000000000000000000000000000000000024000200fcbefe9641719404cc5c9ab2766dd4793e367b0ea55e65e2e3416ac9d4e68841240002001171ee8da334a5099295af229a5d237a7f4102f01f28b34347d6cbbe135d83ec24000100975c9d81c983c8209ee781254b899f8ed925ae9f0923c23c62f53c57cdbf691c0800030000000000240002005da952055e5857d673cddd36909746c80efa3ff95c317de1063db32bc80a0b3e0003008024000100dbffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff0600050000000000d002098058000080060001000200000008000200ac1e00010500030000000000060001000a00000014000200000000000000000000000000000000010500030000000000060001000200000008000200ffffffff05000300000000007c000080060001000a00000014000200000000000000000000000000000000010500030000000000060001000200000008000200ac1414bb0500030000000000060001000a00000014000200000000000000000000000000000000010500030000000000060001000200000008000200000000000500030000000000dc000080060001000a0000001400020000000000000000000000ffffac1414aa05000300000000000600010002000000080002000000000005000300000000000600010002000000080002007f0000010500030000000000060001000200000008000200000000000500030000000000060001000200000008000200e00000010500030000000000060001000a00000014000200fc0100000000000000000000000000000500030000000000060001000200000008000200000000000500030000000000060001000200000008000200ac1e0001050003000000000094000080060001000a00000014000200fc0200000000000000000000000000000500030000000000060001000a00000014000200ff0100000000000000000000000000010500030000000000060001000200000008000200e00000010500030000000000060001000200000008000200ac1414bb0500030000000000060001000200000008000200ffffffff050003000000000088000080060001000a00000014000200fe8000000000000000000000000000aa0500030000000000060001000200000008000200ac1414aa0500030000000000060001000a00000014000200fe8800000000000000000000000000010500030000000000060001000a00000014000200ff020000000000000000000000000001050003000000000064000080080003000000000008000a000100000024000100f44da367a88ee6564f020211456727082f5cebee8b1bf5eb7337341b459b3922080003000000000024000200379aa288b2244a5b504ba04bea45625d328fb93b62e607a1b2e4da2f7f76a5499400008024000100975c9d81c983c8209ee781254b899f8ed925ae9f0923c23c62f53c57cdbf691c080003000000000024000100f44da367a88ee6564f020211456727082f5cebee8b1bf5eb7337341b459b3922080003000000000024000100d1732899f611cd8994034d7f413dc957630e5493c285aca40065cb6311be696b1400040002000000000000000000000000000000d807008000030980f4000080060001000a00000014000200000000000000000000000000000000000500030000000000060001000a00000014000200fc0000000000000000000000000000000500030000000000060001000200000008000200ffffffff0500030000000000060001000200000008000200ac1e00010500030000000000060001000200000008000200e000000105000300000000000600010002000000080002007f0000010500030000000000060001000a00000014000200000000000000000000000000000000010500030000000000060001000a00000014000200fc01000000000000000000000000000005000300000000004c000080060001000200000008000200ac1414bb0500030000000000060001000200000008000200000000000500030000000000060001000200000008000200ac1414bb05000300000000000c010080060001000a00000014000200200100000000000000000000000000010500030000000000060001000200000008000200e000000205000300000000000600010002000000080002000000000005000300000000000600010002000000080002007f0000010500030000000000060001000a00000014000200fe8800000000000000000000000000010500030000000000060001000a00000014000200fe8000000000000000000000000000bb0500030000000000060001000200000008000200ffffffff0500030000000000060001000200000008000200e00000010500030000000000060001000a00000014000200fc0100000000000000000000000000000500030000000000940000800600010002000000080002000000000005000300000000000600010002000000080002000000000005000300000000000600010002000000080002007f0000010500030000000000060001000200000008000200e00000020500030000000000060001000200000008000200ac1414000500030000000000060001000200000008000200ac14140005000300000000001c000080060001000200000008000200ffffffff0500030000000000080003000000000024000100f44da367a88ee6564f020211456727082f5cebee8b1bf5eb7337341b459b39221d0004000a0000000000000000000000000000000000ffffac1e0001000000001c04098094000080060001000a0000001400020000000000000000000000ffffac1414bb0500030000000000060001000a00000014000200fe8800000000000000000000000000010500030000000000060001000a00000014000200ff0100000000000000000000000000010500030000000000060001000a00000014000200fe880000000000000000000000000001050003000000000064000080060001000a00000014000200fe8000000000000000000000000000bb0500030000000000060001000200000008000200ac1414bb0500030000000000060001000a0000001400020000000000000000000000ffffe00000020500030000000000ac000080060001000200000008000200000000000500030000000000060001000a00000014000200fe80000000000000000000000000000005000300000000000600010002000000080002007f0000010500030000000000060001000200000008000200ac1414bb0500030000000000060001000a00000014000200000000000000000000000000000000010500030000000000060001000200000008000200e0000001050003000000000064000080060001000a00000014000200fc0100000000000000000000000000000500030000000000060001000a00000014000200fe8000000000000000000000000000bb0500030000000000060001000200000008000200ac1414000500030000000000f4000080060001000200000008000200000000000500030000000000060001000a00000014000200200100000000000000000000000000000500030000000000060001000a00000014000200fc0200000000000000000000000000000500030000000000060001000a00000014000200fe8000000000000000000000000000aa0500030000000000060001000200000008000200ac1414aa0500030000000000060001000200000008000200000000000500030000000000060001000200000008000200ac1414000500030000000000060001000a00000014000200200100000000000000000000000000020500030000000000a0000080060001000a00000014000200fc0000000000000000000000000000000500030000000000060001000200000008000200ac1414aa0500030000000000060001000a00000014000200fe8800000000000000000000000000010500030000000000060001000a00000014000200fe8000000000000000000000000000aa0500030000000000060001000200000008000200ac14140005000300000000007c000080060001000200000008000200ac1414aa0500030000000000060001000a00000014000200fe8000000000000000000000000000000500030000000000060001000200000008000200e00000010500030000000000060001000a00000014000200fe8000000000000000000000000000bb050003000000000024000100d1732899f611cd8994034d7f413dc957630e5493c285aca40065cb6311be696b2400020055fbc2635cc801d67c589cc98f3cf65074dffe0886750dec83be49fbf628e1dc240002000f1b8b82264208ab1a2dce776c03b9f348f500ef8e7606466943f5ba2ae2881e0c0000800800030000000000060006000000000008000100", @ANYRES32=r6, @ANYBLOB="24000300000000000000000000000000000000000000000000000000000000000000000024000300a05ca84f6c9c8e3853e2fd7a7cae0fb20fa152600cb00845174f08076f8d7843080007"], 0xd40}}, 0x8) 22.218829442s ago: executing program 2 (id=8574): socket$nl_generic(0x10, 0x3, 0x10) r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$IPVS_CMD_SET_INFO(r2, &(0x7f0000000b00)={0x0, 0x0, &(0x7f0000000ac0)={0x0, 0x14}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000380)=ANY=[@ANYBLOB="3c0000001000850600"/20, @ANYRES32=r3, @ANYBLOB="01000000000000001c0012000c000100626f6e64000000000c0002000800010005"], 0x3c}}, 0x0) r4 = socket$nl_route(0x10, 0x3, 0x0) r5 = socket(0x1, 0x803, 0x0) getsockname$packet(r5, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000002c0)=0x14) sendmsg$nl_route(r4, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000440)=ANY=[@ANYBLOB="50000000100009060000001c1949af48db5d3f0a1b4eb5e1147af2f60d3e130000000078a812767195c627e9943ff9bc3037ceb75cf746858648b98fd536850eecb9fa7be0665a2f837733b80a830c2127e130f401013241d4ce015b825c7f448afc5f195cae8551580c0998a9ce7ef02c597868ae77b3e6162445b98eb3a3f2cca8abb71324a2c46cc7c6afb484a5dc232abcfb9c1d2215e40642802b40f193e82948cf5ccfe1220bf5d36b041617e90f73d96a2ed4eb1e37dcc90a0174065c00d565f7fb261c413f1bced306d9fd705c37d19f3e2d075e95bd51297aab3702", @ANYRES32=0x0, @ANYBLOB="86feae88000004001c00128009000100766c616e000000000c000280060001000100000008000500", @ANYRES32=r6, @ANYBLOB="0a000100aaaaaaaaaabb0000"], 0x50}}, 0x0) getsockname$packet(r5, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000240)=0xffe4) r8 = bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x4, 0x5, &(0x7f00000002c0)=ANY=[@ANYBLOB="180200000200000000000000000000008500000087000000850000000500000095"], &(0x7f00000000c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x2a, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000600)={r8, 0x0, 0xe, 0x0, &(0x7f0000000280)="5767c331e895cd135c5b7feeffd9", 0x0, 0xba, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, 0x50) sendmsg$nl_route(r0, &(0x7f00000000c0)={0x0, 0x60, &(0x7f0000000300)={&(0x7f0000000900)=ANY=[@ANYBLOB="5c00000010001ffffcffffff0000000000000000", @ANYRES32=0x0, @ANYBLOB="0000000000000000340012800b0001006772657461700000240002800800070064010100060003601008000008001500700f0d0008000700ac1414bb08000a00", @ANYRES32=r7], 0x5c}}, 0x40) 22.218031829s ago: executing program 3 (id=8575): r0 = socket$inet(0x2, 0x1, 0x0) setsockopt$IPT_SO_SET_REPLACE(r0, 0x0, 0x40, &(0x7f00000002c0)=@mangle={'mangle\x00', 0x1f, 0x6, 0x390, 0x0, 0x130, 0x1c8, 0x260, 0x2f8, 0x98, 0x130, 0x1c8, 0x260, 0x2f8, 0x6, 0x0, {[{{@uncond, 0x0, 0x70, 0x98}, @ECN={0x28, 'ECN\x00', 0x0, {0x1, 0x1}}}, {{@uncond, 0x0, 0x70, 0x98}, @common=@unspec=@STANDARD={0x28, '\x00', 0x0, 0xfffffffe}}, {{@uncond, 0x0, 0x70, 0x98}, @common=@unspec=@STANDARD={0x28, '\x00', 0x0, 0xfffffffe}}, {{@uncond, 0x0, 0x70, 0x98}, @common=@unspec=@STANDARD={0x28, '\x00', 0x0, 0xfffffffe}}, {{@uncond, 0x0, 0x70, 0x98}, @common=@unspec=@STANDARD={0x28, '\x00', 0x0, 0xfffffffe}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x3f0) syz_emit_ethernet(0x0, 0x0, 0x0) syz_emit_ethernet(0x6c, &(0x7f0000000180)={@broadcast, @link_local, @void, {@ipv4={0x800, @gre={{0x5, 0x4, 0x3, 0x0, 0x37, 0x65, 0x0, 0x0, 0x2f, 0x0, @private, @empty}, {{0x0, 0x0, 0x1, 0x0, 0x2, 0x0, 0x0, 0x4, 0x88a8, 0x3e8, 0x0, [0xff, 0x3]}, {0x0, 0x0, 0x0, 0x0, 0x11, 0x0, 0x800, [0x6]}, {}, {}, {}, {0x8, 0x6558, 0xfffffffd}}}}}}, 0x0) 22.142285584s ago: executing program 1 (id=8576): setsockopt$inet6_tcp_TCP_MD5SIG(0xffffffffffffffff, 0x6, 0xe, &(0x7f0000000300)={@in6={{0xa, 0x4e02, 0xffffffff, @empty, 0x5}}, 0x0, 0x0, 0x23f, 0x0, "bb02a3c364ca41d6357e544524474004000b42a21d7214bf92494925208a0e2f964e0000c534a6324d6193fcf19b2df3ee818afaa4ff1f56c54dc46d8b6d2ccd008aa0cc1dc2767bbe00"}, 0xd8) r0 = socket$kcm(0x23, 0x5, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) close(r3) r4 = socket(0x400000000010, 0x3, 0xfffffffe) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000380)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r4, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000001c0)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56d49, 0x70bd2a, 0xffdfffff, {0x0, 0x0, 0x0, r5, {0x0, 0x6}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_multiq={{0xb}, {0x8, 0x2, {0x5}}}]}, 0x38}}, 0x0) sendmsg$nl_route_sched(r4, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000003c0)=@newtfilter={0x44, 0x2c, 0xd27, 0x70bd2b, 0x2, {0x0, 0x0, 0x0, r5, {0x0, 0x10}, {}, {0x8, 0x4}}, [@filter_kind_options=@f_flow={{0x9}, {0x14, 0x2, [@TCA_FLOW_MODE={0x8, 0x2, 0x1}, @TCA_FLOW_KEYS={0x8, 0x1, 0x12d6}]}}]}, 0x44}}, 0x0) ioctl$SIOCSIFHWADDR(r3, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) r6 = socket$igmp(0x2, 0x3, 0x2) r7 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_int(r7, 0x107, 0xf, &(0x7f0000000100)=0x207, 0x4) ioctl$sock_SIOCGIFINDEX(r6, 0x8933, &(0x7f0000000040)={'syzkaller0\x00', 0x0}) sendto$packet(r7, &(0x7f00000002c0)="05031c00d1fd14f401004788031c09102c28", 0xfdef, 0x4, &(0x7f0000000140)={0x11, 0x0, r8, 0x1, 0x0, 0x6, @multicast}, 0x14) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) setsockopt$sock_int(r0, 0x1, 0x6, &(0x7f0000000240)=0x9, 0x4) listen(r0, 0x800) r9 = accept4(r0, 0x0, 0x0, 0x80000) r10 = socket$kcm(0x2, 0xa, 0x2) ioctl$SIOCSIFHWADDR(r10, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local}) r11 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r12 = syz_genetlink_get_family_id$netlbl_mgmt(&(0x7f0000000cc0), r11) sendmsg$NLBL_MGMT_C_ADD(r11, &(0x7f0000000d80)={0x0, 0x0, &(0x7f0000000d40)={&(0x7f0000000d00)=ANY=[@ANYBLOB='0\x00\x00\x00', @ANYRES16=r12, @ANYBLOB="f78c00000000000000000100000000001200010076657468305f6d616376746170000000"], 0x30}}, 0x0) ioctl$sock_ipv6_tunnel_SIOCADDTUNNEL(r4, 0x89f1, &(0x7f00000000c0)={'ip6tnl0\x00', &(0x7f0000000040)={'ip6gre0\x00', 0x0, 0x4, 0x3, 0x5, 0x5, 0x32, @ipv4={'\x00', '\xff\xff', @empty}, @ipv4={'\x00', '\xff\xff', @dev={0xac, 0x14, 0x14, 0x41}}, 0x1, 0x20, 0x0, 0x5}}) getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffffff, 0x29, 0x22, &(0x7f0000000640)={{{@in=@loopback, @in=@remote, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6}, 0x0, @in6}}, &(0x7f0000000500)=0xe8) setsockopt$inet_IP_IPSEC_POLICY(r9, 0x0, 0x10, &(0x7f0000000540)={{{@in=@rand_addr=0x64010100, @in=@multicast2, 0x4e22, 0x0, 0x4e21, 0x3ff, 0x2, 0x80, 0x80, 0x33, r13, r14}, {0x2, 0x100000000, 0x7, 0x4, 0x2, 0x5, 0x0, 0x2}, {0x1, 0x40, 0x8, 0x4}, 0xfffffff9, 0x0, 0x1, 0x1, 0x3, 0x98ff76bf2c3eee29}, {{@in6=@remote, 0x4d2, 0x33}, 0xa, @in=@local, 0x34ff, 0x0, 0x0, 0xc, 0x2, 0x9, 0x7}}, 0xe8) write$tun(r1, &(0x7f0000000380)=ANY=[@ANYBLOB="1c0000f500000000000000862dfdff000000"], 0x78) 21.968869482s ago: executing program 0 (id=8577): r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000480)=@newtaction={0x6c, 0x30, 0x10b, 0x0, 0x0, {}, [{0x58, 0x1, [@m_ife={0x54, 0x1, 0x0, 0x0, {{0x8}, {0x2c, 0x2, 0x0, 0x1, [@TCA_IFE_PARMS={0x1c, 0x1, {{0x3, 0x800000, 0x6}, 0x1}}, @TCA_IFE_METALST={0xc, 0x6, [@IFE_META_TCINDEX={0x6, 0x5, @val=0x3}]}]}, {0x4}, {0xc}, {0xc, 0x8, {0x0, 0x2}}}}]}]}, 0x6c}}, 0x0) r1 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r1, &(0x7f0000000600)={0x0, 0x0, &(0x7f00000003c0)=[{&(0x7f0000000380)="2e00000010008188e6b62aa73772cc9f1ba1f848110000005e140602000000000e000a001000000002", 0x29}, {&(0x7f0000000000)="11c9064268", 0x5}], 0x2}, 0x40) sendmsg$kcm(r1, &(0x7f0000000600)={0x0, 0x0, &(0x7f0000000080)=[{&(0x7f0000000040)="2e00000011008188040f80ec59acbc0413a1f848110000005e140602000000000e000a000f00000002800000121f", 0x2e}], 0x1}, 0x8084) 18.916811219s ago: executing program 4 (id=8578): r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$netlbl_mgmt(&(0x7f0000000080), r1) sendmsg$NLBL_MGMT_C_REMOVE(r0, &(0x7f0000000480)={&(0x7f0000000000), 0xc, &(0x7f00000003c0)={&(0x7f0000000cc0)={0x24, r2, 0x1, 0x0, 0x0, {}, [@NLBL_MGMT_A_IPV4ADDR={0x8, 0x7, @remote}, @NLBL_MGMT_A_CLPDOI={0x8}]}, 0x24}}, 0x0) 18.437368335s ago: executing program 3 (id=8579): socketpair(0x1e, 0x80005, 0x0, &(0x7f0000000000)={0x0, 0x0}) r2 = socket$rxrpc(0x21, 0x2, 0x2) sendmsg(r2, &(0x7f0000000a00)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000b00)=[{0x18, 0x110, 0x1, 'd\x00\x00\x00\x00\x00\x00\x00'}, {0x14, 0x110, 0x2, "01000000"}], 0x2c}, 0x0) (async) sendmsg(r2, &(0x7f0000000a00)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000b00)=[{0x18, 0x110, 0x1, 'd\x00\x00\x00\x00\x00\x00\x00'}, {0x14, 0x110, 0x2, "01000000"}], 0x2c}, 0x0) syz_genetlink_get_family_id$nl80211(&(0x7f0000000700), 0xffffffffffffffff) (async) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000700), 0xffffffffffffffff) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r4, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000340)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0) (async) sendmsg$NFT_BATCH(r4, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000340)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0) r5 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) getsockopt$inet6_int(r5, 0x29, 0x35, 0x0, &(0x7f000000bac0)) sendmsg$NFT_BATCH(r4, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000740)={{0x14}, [@NFT_MSG_NEWRULE={0x68, 0x6, 0xa, 0x40b, 0x0, 0x0, {0x2}, [@NFTA_RULE_EXPRESSIONS={0x2c, 0x4, 0x0, 0x1, [{0x28, 0x1, 0x0, 0x1, @connlimit={{0xe}, @val={0x14, 0x2, 0x0, 0x1, [@NFTA_CONNLIMIT_FLAGS={0x8, 0x2, 0x1, 0x0, 0x1}, @NFTA_CONNLIMIT_FLAGS={0x8, 0x2, 0x1, 0x0, 0x1}]}}}]}, @NFTA_RULE_COMPAT={0x1c, 0x5, 0x0, 0x1, [@NFTA_RULE_COMPAT_PROTO_IPV4={0x8, 0x1, 0x1, 0x0, 0x84}, @NFTA_RULE_COMPAT_PROTO_IPV6={0x8, 0x1, 0x1, 0x0, 0x5c}, @NFTA_RULE_COMPAT_PROTO_IPV6={0x8, 0x1, 0x1, 0x0, 0x2c}]}, @NFTA_RULE_CHAIN={0x9, 0x2, 'syz2\x00'}]}], {0x14}}, 0x90}}, 0x0) mmap(&(0x7f0000000000/0x11000)=nil, 0x11000, 0xb635773f04ebbeec, 0x11171, 0xffffffffffffffff, 0xa1679000) (async) mmap(&(0x7f0000000000/0x11000)=nil, 0x11000, 0xb635773f04ebbeec, 0x11171, 0xffffffffffffffff, 0xa1679000) r6 = socket$nl_generic(0x10, 0x3, 0x10) r7 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r7, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000680)=ANY=[@ANYBLOB="14000000100001000000000000b890c1a000000a80000000160a01030000000000000000020000000900020073797a30000000000900010073797a30000000005400038008000240000000000800014000000000400003801400010076657468315f746f5f6272696467650014000100776732000000000000000000000000000b00010076657468305f746f5f7465616d00000014000000110001"], 0xa8}}, 0x0) sendmsg$NFT_BATCH(r7, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000540)={{0x14}, [@NFT_MSG_NEWRULE={0x58, 0x6, 0xa, 0x40b, 0x0, 0x0, {0x2}, [@NFTA_RULE_EXPRESSIONS={0x2c, 0x4, 0x0, 0x1, [{0x28, 0x1, 0x0, 0x1, @flow_offload={{0x11}, @val={0x10, 0x2, 0x0, 0x1, [@NFTA_FLOW_TABLE_NAME={0x9, 0x1, 'syz0\x00'}]}}}]}, @NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_RULE_CHAIN={0x9, 0x2, 'syz2\x00'}]}], {0x14}}, 0x80}, 0x1, 0x0, 0x0, 0x2000094}, 0x80) sendmsg$NFT_BATCH(r7, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000001200)={{0x14, 0x10, 0x1, 0x0, 0x0, {0xa}}, [@NFT_MSG_DELTABLE={0x14, 0x2, 0xa, 0x201, 0x0, 0x0, {0x2, 0x0, 0x5}}], {0x14}}, 0x3c}, 0x1, 0x0, 0x0, 0x4008005}, 0x4000000) (async) sendmsg$NFT_BATCH(r7, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000001200)={{0x14, 0x10, 0x1, 0x0, 0x0, {0xa}}, [@NFT_MSG_DELTABLE={0x14, 0x2, 0xa, 0x201, 0x0, 0x0, {0x2, 0x0, 0x5}}], {0x14}}, 0x3c}, 0x1, 0x0, 0x0, 0x4008005}, 0x4000000) sendmsg$NL80211_CMD_VENDOR(r6, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f00000001c0)={0x124, r3, 0x1, 0x0, 0x0, {{}, {@val={0x8, 0x1, 0x35}, @val={0x8}, @val={0xc, 0x99, {0x2, 0x21}}}}, [@NL80211_ATTR_VENDOR_SUBCMD={0x8, 0xc4, 0x1}, @NL80211_ATTR_VENDOR_ID={0x8, 0xc3, 0x1378}, @NL80211_ATTR_VENDOR_DATA={0xda, 0xc5, "87308f344b5cb35ea2701073e3fc09353467369e879e1616d06763c029182270ad1f04f815d71482845cde8d236cf506eea884aeb0e5071aa9df9e90589cc237cf6fce8420636264ed3bce84a1d6684ea61dd7e5a54f3f1b172448b10909425360a43ba70b2af6626f1d57cea5fe0fb25716b629ee422ede88216817e3d5c8008479ed0deb0892830fdf6d1648339ba9f7e8166a03d30248d963cdf2c9c8639f69e8068fb0cafe3ac64f14132ec1af067bce374b6bf16b9d1ecd8942b8592b6d9c6dd03363daf24d8bd545fd24c76d308f95af46deeb"}, @NL80211_ATTR_VENDOR_SUBCMD={0x8, 0xc4, 0x9}]}, 0x124}}, 0x880) syz_genetlink_get_family_id$mptcp(&(0x7f00000000c0), r1) socket$inet_udp(0x2, 0x2, 0x0) (async) r8 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$inet_MCAST_JOIN_GROUP(r8, 0x0, 0x2a, &(0x7f0000000180)={0x2, {{0x2, 0x0, @multicast2}}}, 0x88) r9 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r9, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000840)={&(0x7f0000000c40)=ANY=[@ANYBLOB="580000001000010009000000000000000000ffff", @ANYRES32=0x0, @ANYBLOB="00000000da44000024001a8020000a8014000700fe8000000000000000020040000000000500080002000000140003007866726d30"], 0x58}}, 0x240488c4) (async) sendmsg$nl_route(r9, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000840)={&(0x7f0000000c40)=ANY=[@ANYBLOB="580000001000010009000000000000000000ffff", @ANYRES32=0x0, @ANYBLOB="00000000da44000024001a8020000a8014000700fe8000000000000000020040000000000500080002000000140003007866726d30"], 0x58}}, 0x240488c4) setsockopt$inet_MCAST_MSFILTER(r8, 0x0, 0x30, &(0x7f0000000c80)=ANY=[@ANYBLOB="020000000000000002000000e0000002000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000a00000002000000ffffffff00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002000000ac1414aa00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002000000e000000100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002000000ac1e0001000000000000000000000080000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000020000007f000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002000000e000000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002000000e000000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002000000ac1414bb00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002"], 0x590) (async) setsockopt$inet_MCAST_MSFILTER(r8, 0x0, 0x30, &(0x7f0000000c80)=ANY=[@ANYBLOB="020000000000000002000000e0000002000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000a00000002000000ffffffff00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002000000ac1414aa00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002000000e000000100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002000000ac1e0001000000000000000000000080000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000020000007f000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002000000e000000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002000000e000000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002000000ac1414bb00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002"], 0x590) setsockopt$inet_group_source_req(r8, 0x0, 0x2c, &(0x7f00000004c0)={0x2, {{0x2, 0x0, @multicast2}}, {{0x2, 0x0, @empty}}}, 0x108) close(r0) 17.884684615s ago: executing program 4 (id=8580): r0 = socket$nl_generic(0x10, 0x3, 0x10) (async) bpf$MAP_UPDATE_CONST_STR(0x2, &(0x7f00000000c0)={{0x1, 0xffffffffffffffff}, &(0x7f0000000000), &(0x7f0000000080)='%pB \x00'}, 0x20) (async) pipe(&(0x7f0000000600)={0xffffffffffffffff, 0xffffffffffffffff}) pipe(&(0x7f0000000500)={0xffffffffffffffff, 0xffffffffffffffff}) splice(r3, 0x0, r2, 0x0, 0xffffffffffff8000, 0x0) (async) r5 = bpf$PROG_LOAD(0x5, &(0x7f0000000140)={0x2, 0x5, &(0x7f0000000040)=@framed={{}, [@map_val={0x18, 0x2, 0x2, 0x0, r1, 0x0, 0x0, 0x0, 0xfffffa34}]}, &(0x7f0000000600)='syzkaller\x00', 0x5, 0x0, 0x0, 0x0, 0x10, '\x00', 0x0, @fallback=0xa, r3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0xa}, 0x94) (async) r6 = socket$inet6_sctp(0xa, 0x1, 0x84) sendmmsg$inet6(r6, &(0x7f0000004b40)=[{{&(0x7f0000001140)={0xa, 0x4e21, 0x10, @initdev={0xfe, 0x88, '\x00', 0x1, 0x0}, 0x8}, 0x1c, &(0x7f00000013c0)=[{&(0x7f00000016c0)="99", 0x1}], 0x1}}, {{&(0x7f0000000000)={0xa, 0x4e24, 0x9b5d, @private2={0xfc, 0x2, '\x00', 0x1}, 0x80}, 0x1c, &(0x7f00000015c0)=[{&(0x7f0000001700)="92", 0x1}], 0x1}}], 0x2, 0x4000090) (async) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={0x0, 0x48}}, 0x0) (async) shutdown(r6, 0x1) (async) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(r6, 0x81f8943c, &(0x7f0000000200)={0x0, ""/256, 0x0, 0x0}) ioctl$BTRFS_IOC_GET_SUBVOL_ROOTREF(r5, 0xd000943d, &(0x7f0000001740)={0x9, [{}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {0x0}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {0x0, r7}], 0x81, "41aa33c3aa02be"}) ioctl$BTRFS_IOC_INO_LOOKUP(r4, 0xd0009412, &(0x7f00000027c0)={r8, 0x9f}) (async) sendmsg$nl_generic(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000400)={&(0x7f0000002780)=ANY=[@ANYBLOB="180000002f00099828bd70000000000004000000040012"], 0x18}, 0x1, 0x0, 0x0, 0x42804}, 0x10) 17.066560128s ago: executing program 3 (id=8581): r0 = socket(0x28, 0x5, 0x0) r1 = socket$inet_udp(0x2, 0x2, 0x0) close(0x3) socket$inet_tcp(0x2, 0x1, 0x6) (async) r2 = socket$inet_tcp(0x2, 0x1, 0x6) setsockopt$inet_tcp_buf(r2, 0x6, 0x1f, &(0x7f0000000400)='espintcp', 0x8) (async) setsockopt$inet_tcp_buf(r2, 0x6, 0x1f, &(0x7f0000000400)='espintcp', 0x8) recvmmsg(r1, &(0x7f0000000040), 0x291962b, 0x45833af92e4b39ff, 0x0) connect$vsock_stream(r0, &(0x7f0000000080), 0x10) sendmmsg(r0, &(0x7f0000000480)=[{{0x0, 0x0, 0x0}}], 0x1, 0x24008094) 16.21386597s ago: executing program 4 (id=8582): r0 = socket$inet_smc(0x2b, 0x1, 0x0) ioctl$BTRFS_IOC_DEV_INFO(0xffffffffffffffff, 0xd000941e, &(0x7f0000000480)={0x0, "44fa01fc4adfd3c99780d7672003b6cb"}) ioctl$BTRFS_IOC_SCRUB_PROGRESS(r0, 0xc400941d, &(0x7f0000001500)={r1, 0x10001}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r2, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000400)={&(0x7f0000001480)=@newtaction={0x6c, 0x30, 0x83d79f1e8021ba05, 0x0, 0x0, {}, [{0xfffffffffffffd39, 0x1, [@m_nat={0x54, 0x1, 0x0, 0x0, {{0x8}, {0x2c, 0x2, 0x0, 0x1, [@TCA_NAT_PARMS={0x28, 0x1, {{0x0, 0x0, 0x20000000}, @rand_addr, @multicast2}}]}, {0x4}, {0xc}, {0xc}}}]}]}, 0x6c}}, 0x0) r3 = socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000080), r3) sendmsg$TIPC_NL_MEDIA_GET(r3, &(0x7f0000000100)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x4000000}, 0xc, &(0x7f00000001c0)={&(0x7f0000000580)=ANY=[@ANYBLOB="14000000", @ANYRES16=r4, @ANYBLOB="000126bd700002dcdf250b000000"], 0x14}, 0x1, 0x0, 0x0, 0x80}, 0x24044890) r5 = syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff) r6 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f0000000540)={0x3, 0x4, 0x4, 0xa, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0}, 0x48) close(r6) r7 = accept$unix(0xffffffffffffffff, &(0x7f0000000140)=@abs, &(0x7f0000000200)=0x6e) recvmmsg(r7, &(0x7f0000004740)=[{{0x0, 0x0, &(0x7f0000002b00)=[{&(0x7f0000001900)=""/4096, 0x1000}, {&(0x7f0000002900)=""/204, 0xcc}, {&(0x7f0000002a00)=""/249, 0xf9}], 0x3, &(0x7f0000002b40)=""/76, 0x4c}, 0x35}, {{&(0x7f0000002bc0)=@phonet, 0x80, &(0x7f0000002ec0)=[{&(0x7f0000002c40)=""/120, 0x78}, {&(0x7f0000002cc0)=""/18, 0x12}, {&(0x7f0000002d00)=""/225, 0xe1}, {&(0x7f0000002e00)=""/134, 0x86}], 0x4, &(0x7f0000002f00)=""/18, 0x12}, 0x7}, {{&(0x7f0000002f40)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @remote}, 0x80, &(0x7f00000042c0)=[{&(0x7f0000002fc0)=""/109, 0x6d}, {&(0x7f0000003040)=""/100, 0x64}, {&(0x7f00000030c0)}, {&(0x7f0000003100)=""/4096, 0x1000}, {&(0x7f0000004100)=""/163, 0xa3}, {&(0x7f00000041c0)=""/25, 0x19}, {&(0x7f0000004200)=""/138, 0x8a}], 0x7, &(0x7f0000004340)=""/154, 0x9a}, 0x100}, {{&(0x7f0000004400)=@ieee802154={0x24, @short}, 0x80, &(0x7f0000004700)=[{&(0x7f0000004480)=""/94, 0x5e}, {&(0x7f0000004500)=""/20, 0x14}, {&(0x7f0000004540)=""/244, 0xf4}, {&(0x7f0000004640)=""/129, 0x81}], 0x4}, 0x3}], 0x4, 0x60, &(0x7f0000004840)={0x77359400}) ioctl$sock_SIOCGIFINDEX_80211(r3, 0x8933, &(0x7f0000000000)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_NEW_INTERFACE(r3, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000340)=ANY=[@ANYBLOB="e4000000", @ANYRES16=r5, @ANYBLOB="07002abd5248ffdbdf2507ff000008000300", @ANYRES32=r8, @ANYBLOB="0c00990001000c0069000000140004002f6163766c616e3100000000000000000400cc00080005000a"], 0xe4}, 0x1, 0x0, 0x0, 0x4004001}, 0x0) ioctl$XFS_IOC_PATH_TO_HANDLE(r2, 0xc0385869, &(0x7f0000000100)={r3, &(0x7f0000000000)='nat\x00', 0x161200, &(0x7f0000000040)={@align=0x5, {0x0, 0x5, 0x10a, 0x100000000}}, 0xd5, &(0x7f0000000080)={@_ha_fsid}, &(0x7f00000000c0)}) 15.766828191s ago: executing program 3 (id=8583): r0 = socket(0x10, 0x3, 0x0) sendmsg$nl_generic(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000001240)={&(0x7f0000000000)={0xfd9a, 0x19, 0x1, 0x0, 0x0, {0x1d, 0xd601, 0x9}}, 0x14}, 0x1, 0x0, 0x0, 0x4008080}, 0x0) 15.445869666s ago: executing program 3 (id=8584): r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x2, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000040)={'syzkaller1\x00', 0x1}) r2 = socket$unix(0x1, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'syzkaller1\x00', 0x0}) ioctl$sock_inet_SIOCSIFFLAGS(r2, 0x8914, &(0x7f0000000200)={'syzkaller1\x00', 0x1}) sendmsg$nl_route_sched(r0, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000000c0)=@newqdisc={0x30, 0x24, 0x601, 0x0, 0x0, {0x0, 0x0, 0x0, r3, {}, {0xfff1, 0xffff}}, [@qdisc_kind_options=@q_ingress={0xc}]}, 0x30}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000001300)=@newtfilter={0x88, 0x2c, 0x601, 0x0, 0x0, {0x0, 0x0, 0x0, r3, {}, {0xfff1, 0xffff}, {0x300}}, [@filter_kind_options=@f_matchall={{0xd}, {0x54, 0x2, [@TCA_MATCHALL_ACT={0x50, 0x2, [@m_mpls={0x4c, 0x1, 0x0, 0x0, {{0x9}, {0x20, 0x2, 0x0, 0x1, [@TCA_MPLS_PARMS={0x1c, 0x2, {{0x0, 0x0, 0x20000000}, 0x3}}]}, {0x4}, {0xc}, {0xc}}}]}]}}]}, 0x88}}, 0x0) write(r1, &(0x7f0000000400)="0000884700064001", 0x8) r4 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r4, &(0x7f0000000b40)={0x0, 0x0, &(0x7f0000000b00)={&(0x7f0000000000)=@newtaction={0x68, 0x30, 0x101, 0x0, 0x0, {}, [{0x54, 0x1, [@m_connmark={0x50, 0x1, 0x0, 0x0, {{0xd}, {0xfffffffffffffc24, 0x2, 0x0, 0x1, [@TCA_CONNMARK_PARMS={0x1c}]}, {0x4}, {0xc}, {0xc}}}]}]}, 0x68}}, 0x0) bpf$BPF_GET_PROG_INFO(0xf, &(0x7f00000006c0)={0xffffffffffffffff, 0xe0, &(0x7f00000005c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, &(0x7f00000002c0)=[0x0, 0x0, 0x0], ""/16, 0x0, 0x0, 0x0, 0x0, 0x7, 0x3, &(0x7f0000000340)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], &(0x7f0000000380)=[0x0, 0x0, 0x0], 0x0, 0x30, &(0x7f00000003c0)=[{}, {}, {}, {}, {}, {}], 0x30, 0x10, &(0x7f0000000440), &(0x7f0000000480), 0x8, 0xdd, 0x8, 0x8, &(0x7f00000004c0)}}, 0x10) r6 = bpf$BPF_PROG_GET_FD_BY_ID(0xd, &(0x7f0000000700)={0xffffffffffffffff}, 0x4) bpf$PROG_LOAD(0x5, &(0x7f0000000780)={0x6, 0x5, &(0x7f0000000140)=@framed={{0x18, 0x0, 0x0, 0x0, 0xffffffff, 0x0, 0x0, 0x0, 0x7}, [@cb_func={0x18, 0xb, 0x4, 0x0, 0xfffffffffffffffa}]}, &(0x7f0000000180)='GPL\x00', 0xa, 0x0, 0x0, 0x40f00, 0x24, '\x00', r3, @xdp, 0xffffffffffffffff, 0x8, &(0x7f00000001c0)={0x6, 0x1}, 0x8, 0x10, &(0x7f0000000280)={0x3, 0x3, 0x7, 0x5de6}, 0x10, r5, r6, 0x3, 0x0, &(0x7f0000000740)=[{0x1, 0x4, 0x0, 0x8}, {0x3, 0x4, 0xd, 0x4}, {0x6, 0x5, 0x8, 0xc}], 0x10, 0xf}, 0x94) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) 7.027390777s ago: executing program 32 (id=8576): setsockopt$inet6_tcp_TCP_MD5SIG(0xffffffffffffffff, 0x6, 0xe, &(0x7f0000000300)={@in6={{0xa, 0x4e02, 0xffffffff, @empty, 0x5}}, 0x0, 0x0, 0x23f, 0x0, "bb02a3c364ca41d6357e544524474004000b42a21d7214bf92494925208a0e2f964e0000c534a6324d6193fcf19b2df3ee818afaa4ff1f56c54dc46d8b6d2ccd008aa0cc1dc2767bbe00"}, 0xd8) r0 = socket$kcm(0x23, 0x5, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) close(r3) r4 = socket(0x400000000010, 0x3, 0xfffffffe) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000380)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r4, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000001c0)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56d49, 0x70bd2a, 0xffdfffff, {0x0, 0x0, 0x0, r5, {0x0, 0x6}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_multiq={{0xb}, {0x8, 0x2, {0x5}}}]}, 0x38}}, 0x0) sendmsg$nl_route_sched(r4, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000003c0)=@newtfilter={0x44, 0x2c, 0xd27, 0x70bd2b, 0x2, {0x0, 0x0, 0x0, r5, {0x0, 0x10}, {}, {0x8, 0x4}}, [@filter_kind_options=@f_flow={{0x9}, {0x14, 0x2, [@TCA_FLOW_MODE={0x8, 0x2, 0x1}, @TCA_FLOW_KEYS={0x8, 0x1, 0x12d6}]}}]}, 0x44}}, 0x0) ioctl$SIOCSIFHWADDR(r3, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) r6 = socket$igmp(0x2, 0x3, 0x2) r7 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_int(r7, 0x107, 0xf, &(0x7f0000000100)=0x207, 0x4) ioctl$sock_SIOCGIFINDEX(r6, 0x8933, &(0x7f0000000040)={'syzkaller0\x00', 0x0}) sendto$packet(r7, &(0x7f00000002c0)="05031c00d1fd14f401004788031c09102c28", 0xfdef, 0x4, &(0x7f0000000140)={0x11, 0x0, r8, 0x1, 0x0, 0x6, @multicast}, 0x14) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) setsockopt$sock_int(r0, 0x1, 0x6, &(0x7f0000000240)=0x9, 0x4) listen(r0, 0x800) r9 = accept4(r0, 0x0, 0x0, 0x80000) r10 = socket$kcm(0x2, 0xa, 0x2) ioctl$SIOCSIFHWADDR(r10, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local}) r11 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r12 = syz_genetlink_get_family_id$netlbl_mgmt(&(0x7f0000000cc0), r11) sendmsg$NLBL_MGMT_C_ADD(r11, &(0x7f0000000d80)={0x0, 0x0, &(0x7f0000000d40)={&(0x7f0000000d00)=ANY=[@ANYBLOB='0\x00\x00\x00', @ANYRES16=r12, @ANYBLOB="f78c00000000000000000100000000001200010076657468305f6d616376746170000000"], 0x30}}, 0x0) ioctl$sock_ipv6_tunnel_SIOCADDTUNNEL(r4, 0x89f1, &(0x7f00000000c0)={'ip6tnl0\x00', &(0x7f0000000040)={'ip6gre0\x00', 0x0, 0x4, 0x3, 0x5, 0x5, 0x32, @ipv4={'\x00', '\xff\xff', @empty}, @ipv4={'\x00', '\xff\xff', @dev={0xac, 0x14, 0x14, 0x41}}, 0x1, 0x20, 0x0, 0x5}}) getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffffff, 0x29, 0x22, &(0x7f0000000640)={{{@in=@loopback, @in=@remote, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6}, 0x0, @in6}}, &(0x7f0000000500)=0xe8) setsockopt$inet_IP_IPSEC_POLICY(r9, 0x0, 0x10, &(0x7f0000000540)={{{@in=@rand_addr=0x64010100, @in=@multicast2, 0x4e22, 0x0, 0x4e21, 0x3ff, 0x2, 0x80, 0x80, 0x33, r13, r14}, {0x2, 0x100000000, 0x7, 0x4, 0x2, 0x5, 0x0, 0x2}, {0x1, 0x40, 0x8, 0x4}, 0xfffffff9, 0x0, 0x1, 0x1, 0x3, 0x98ff76bf2c3eee29}, {{@in6=@remote, 0x4d2, 0x33}, 0xa, @in=@local, 0x34ff, 0x0, 0x0, 0xc, 0x2, 0x9, 0x7}}, 0xe8) write$tun(r1, &(0x7f0000000380)=ANY=[@ANYBLOB="1c0000f500000000000000862dfdff000000"], 0x78) 6.899582175s ago: executing program 33 (id=8574): socket$nl_generic(0x10, 0x3, 0x10) r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$IPVS_CMD_SET_INFO(r2, &(0x7f0000000b00)={0x0, 0x0, &(0x7f0000000ac0)={0x0, 0x14}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000380)=ANY=[@ANYBLOB="3c0000001000850600"/20, @ANYRES32=r3, @ANYBLOB="01000000000000001c0012000c000100626f6e64000000000c0002000800010005"], 0x3c}}, 0x0) r4 = socket$nl_route(0x10, 0x3, 0x0) r5 = socket(0x1, 0x803, 0x0) getsockname$packet(r5, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000002c0)=0x14) sendmsg$nl_route(r4, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000440)=ANY=[@ANYBLOB="50000000100009060000001c1949af48db5d3f0a1b4eb5e1147af2f60d3e130000000078a812767195c627e9943ff9bc3037ceb75cf746858648b98fd536850eecb9fa7be0665a2f837733b80a830c2127e130f401013241d4ce015b825c7f448afc5f195cae8551580c0998a9ce7ef02c597868ae77b3e6162445b98eb3a3f2cca8abb71324a2c46cc7c6afb484a5dc232abcfb9c1d2215e40642802b40f193e82948cf5ccfe1220bf5d36b041617e90f73d96a2ed4eb1e37dcc90a0174065c00d565f7fb261c413f1bced306d9fd705c37d19f3e2d075e95bd51297aab3702", @ANYRES32=0x0, @ANYBLOB="86feae88000004001c00128009000100766c616e000000000c000280060001000100000008000500", @ANYRES32=r6, @ANYBLOB="0a000100aaaaaaaaaabb0000"], 0x50}}, 0x0) getsockname$packet(r5, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000240)=0xffe4) r8 = bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x4, 0x5, &(0x7f00000002c0)=ANY=[@ANYBLOB="180200000200000000000000000000008500000087000000850000000500000095"], &(0x7f00000000c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x2a, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000600)={r8, 0x0, 0xe, 0x0, &(0x7f0000000280)="5767c331e895cd135c5b7feeffd9", 0x0, 0xba, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, 0x50) sendmsg$nl_route(r0, &(0x7f00000000c0)={0x0, 0x60, &(0x7f0000000300)={&(0x7f0000000900)=ANY=[@ANYBLOB="5c00000010001ffffcffffff0000000000000000", @ANYRES32=0x0, @ANYBLOB="0000000000000000340012800b0001006772657461700000240002800800070064010100060003601008000008001500700f0d0008000700ac1414bb08000a00", @ANYRES32=r7], 0x5c}}, 0x40) 5.628666413s ago: executing program 34 (id=8577): r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000480)=@newtaction={0x6c, 0x30, 0x10b, 0x0, 0x0, {}, [{0x58, 0x1, [@m_ife={0x54, 0x1, 0x0, 0x0, {{0x8}, {0x2c, 0x2, 0x0, 0x1, [@TCA_IFE_PARMS={0x1c, 0x1, {{0x3, 0x800000, 0x6}, 0x1}}, @TCA_IFE_METALST={0xc, 0x6, [@IFE_META_TCINDEX={0x6, 0x5, @val=0x3}]}]}, {0x4}, {0xc}, {0xc, 0x8, {0x0, 0x2}}}}]}]}, 0x6c}}, 0x0) r1 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r1, &(0x7f0000000600)={0x0, 0x0, &(0x7f00000003c0)=[{&(0x7f0000000380)="2e00000010008188e6b62aa73772cc9f1ba1f848110000005e140602000000000e000a001000000002", 0x29}, {&(0x7f0000000000)="11c9064268", 0x5}], 0x2}, 0x40) sendmsg$kcm(r1, &(0x7f0000000600)={0x0, 0x0, &(0x7f0000000080)=[{&(0x7f0000000040)="2e00000011008188040f80ec59acbc0413a1f848110000005e140602000000000e000a000f00000002800000121f", 0x2e}], 0x1}, 0x8084) 194.746163ms ago: executing program 35 (id=8584): r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x2, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000040)={'syzkaller1\x00', 0x1}) r2 = socket$unix(0x1, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'syzkaller1\x00', 0x0}) ioctl$sock_inet_SIOCSIFFLAGS(r2, 0x8914, &(0x7f0000000200)={'syzkaller1\x00', 0x1}) sendmsg$nl_route_sched(r0, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000000c0)=@newqdisc={0x30, 0x24, 0x601, 0x0, 0x0, {0x0, 0x0, 0x0, r3, {}, {0xfff1, 0xffff}}, [@qdisc_kind_options=@q_ingress={0xc}]}, 0x30}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000001300)=@newtfilter={0x88, 0x2c, 0x601, 0x0, 0x0, {0x0, 0x0, 0x0, r3, {}, {0xfff1, 0xffff}, {0x300}}, [@filter_kind_options=@f_matchall={{0xd}, {0x54, 0x2, [@TCA_MATCHALL_ACT={0x50, 0x2, [@m_mpls={0x4c, 0x1, 0x0, 0x0, {{0x9}, {0x20, 0x2, 0x0, 0x1, [@TCA_MPLS_PARMS={0x1c, 0x2, {{0x0, 0x0, 0x20000000}, 0x3}}]}, {0x4}, {0xc}, {0xc}}}]}]}}]}, 0x88}}, 0x0) write(r1, &(0x7f0000000400)="0000884700064001", 0x8) r4 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r4, &(0x7f0000000b40)={0x0, 0x0, &(0x7f0000000b00)={&(0x7f0000000000)=@newtaction={0x68, 0x30, 0x101, 0x0, 0x0, {}, [{0x54, 0x1, [@m_connmark={0x50, 0x1, 0x0, 0x0, {{0xd}, {0xfffffffffffffc24, 0x2, 0x0, 0x1, [@TCA_CONNMARK_PARMS={0x1c}]}, {0x4}, {0xc}, {0xc}}}]}]}, 0x68}}, 0x0) bpf$BPF_GET_PROG_INFO(0xf, &(0x7f00000006c0)={0xffffffffffffffff, 0xe0, &(0x7f00000005c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, &(0x7f00000002c0)=[0x0, 0x0, 0x0], ""/16, 0x0, 0x0, 0x0, 0x0, 0x7, 0x3, &(0x7f0000000340)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], &(0x7f0000000380)=[0x0, 0x0, 0x0], 0x0, 0x30, &(0x7f00000003c0)=[{}, {}, {}, {}, {}, {}], 0x30, 0x10, &(0x7f0000000440), &(0x7f0000000480), 0x8, 0xdd, 0x8, 0x8, &(0x7f00000004c0)}}, 0x10) r6 = bpf$BPF_PROG_GET_FD_BY_ID(0xd, &(0x7f0000000700)={0xffffffffffffffff}, 0x4) bpf$PROG_LOAD(0x5, &(0x7f0000000780)={0x6, 0x5, &(0x7f0000000140)=@framed={{0x18, 0x0, 0x0, 0x0, 0xffffffff, 0x0, 0x0, 0x0, 0x7}, [@cb_func={0x18, 0xb, 0x4, 0x0, 0xfffffffffffffffa}]}, &(0x7f0000000180)='GPL\x00', 0xa, 0x0, 0x0, 0x40f00, 0x24, '\x00', r3, @xdp, 0xffffffffffffffff, 0x8, &(0x7f00000001c0)={0x6, 0x1}, 0x8, 0x10, &(0x7f0000000280)={0x3, 0x3, 0x7, 0x5de6}, 0x10, r5, r6, 0x3, 0x0, &(0x7f0000000740)=[{0x1, 0x4, 0x0, 0x8}, {0x3, 0x4, 0xd, 0x4}, {0x6, 0x5, 0x8, 0xc}], 0x10, 0xf}, 0x94) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) 0s ago: executing program 36 (id=8582): r0 = socket$inet_smc(0x2b, 0x1, 0x0) ioctl$BTRFS_IOC_DEV_INFO(0xffffffffffffffff, 0xd000941e, &(0x7f0000000480)={0x0, "44fa01fc4adfd3c99780d7672003b6cb"}) ioctl$BTRFS_IOC_SCRUB_PROGRESS(r0, 0xc400941d, &(0x7f0000001500)={r1, 0x10001}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r2, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000400)={&(0x7f0000001480)=@newtaction={0x6c, 0x30, 0x83d79f1e8021ba05, 0x0, 0x0, {}, [{0xfffffffffffffd39, 0x1, [@m_nat={0x54, 0x1, 0x0, 0x0, {{0x8}, {0x2c, 0x2, 0x0, 0x1, [@TCA_NAT_PARMS={0x28, 0x1, {{0x0, 0x0, 0x20000000}, @rand_addr, @multicast2}}]}, {0x4}, {0xc}, {0xc}}}]}]}, 0x6c}}, 0x0) r3 = socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000080), r3) sendmsg$TIPC_NL_MEDIA_GET(r3, &(0x7f0000000100)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x4000000}, 0xc, &(0x7f00000001c0)={&(0x7f0000000580)=ANY=[@ANYBLOB="14000000", @ANYRES16=r4, @ANYBLOB="000126bd700002dcdf250b000000"], 0x14}, 0x1, 0x0, 0x0, 0x80}, 0x24044890) r5 = syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff) r6 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f0000000540)={0x3, 0x4, 0x4, 0xa, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0}, 0x48) close(r6) r7 = accept$unix(0xffffffffffffffff, &(0x7f0000000140)=@abs, &(0x7f0000000200)=0x6e) recvmmsg(r7, &(0x7f0000004740)=[{{0x0, 0x0, &(0x7f0000002b00)=[{&(0x7f0000001900)=""/4096, 0x1000}, {&(0x7f0000002900)=""/204, 0xcc}, {&(0x7f0000002a00)=""/249, 0xf9}], 0x3, &(0x7f0000002b40)=""/76, 0x4c}, 0x35}, {{&(0x7f0000002bc0)=@phonet, 0x80, &(0x7f0000002ec0)=[{&(0x7f0000002c40)=""/120, 0x78}, {&(0x7f0000002cc0)=""/18, 0x12}, {&(0x7f0000002d00)=""/225, 0xe1}, {&(0x7f0000002e00)=""/134, 0x86}], 0x4, &(0x7f0000002f00)=""/18, 0x12}, 0x7}, {{&(0x7f0000002f40)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @remote}, 0x80, &(0x7f00000042c0)=[{&(0x7f0000002fc0)=""/109, 0x6d}, {&(0x7f0000003040)=""/100, 0x64}, {&(0x7f00000030c0)}, {&(0x7f0000003100)=""/4096, 0x1000}, {&(0x7f0000004100)=""/163, 0xa3}, {&(0x7f00000041c0)=""/25, 0x19}, {&(0x7f0000004200)=""/138, 0x8a}], 0x7, &(0x7f0000004340)=""/154, 0x9a}, 0x100}, {{&(0x7f0000004400)=@ieee802154={0x24, @short}, 0x80, &(0x7f0000004700)=[{&(0x7f0000004480)=""/94, 0x5e}, {&(0x7f0000004500)=""/20, 0x14}, {&(0x7f0000004540)=""/244, 0xf4}, {&(0x7f0000004640)=""/129, 0x81}], 0x4}, 0x3}], 0x4, 0x60, &(0x7f0000004840)={0x77359400}) ioctl$sock_SIOCGIFINDEX_80211(r3, 0x8933, &(0x7f0000000000)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_NEW_INTERFACE(r3, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000340)=ANY=[@ANYBLOB="e4000000", @ANYRES16=r5, @ANYBLOB="07002abd5248ffdbdf2507ff000008000300", @ANYRES32=r8, @ANYBLOB="0c00990001000c0069000000140004002f6163766c616e3100000000000000000400cc00080005000a"], 0xe4}, 0x1, 0x0, 0x0, 0x4004001}, 0x0) ioctl$XFS_IOC_PATH_TO_HANDLE(r2, 0xc0385869, &(0x7f0000000100)={r3, &(0x7f0000000000)='nat\x00', 0x161200, &(0x7f0000000040)={@align=0x5, {0x0, 0x5, 0x10a, 0x100000000}}, 0xd5, &(0x7f0000000080)={@_ha_fsid}, &(0x7f00000000c0)}) kernel console output (not intermixed with test programs): 8][ T76] netdevsim netdevsim4 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 853.080923][ T76] netdevsim netdevsim4 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 853.261866][ T7782] netdevsim netdevsim4 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 853.344054][T31462] netlink: 'syz.1.6766': attribute type 1 has an invalid length. [ 853.388326][T31462] netlink: 'syz.1.6766': attribute type 1 has an invalid length. [ 853.492331][ T7782] netdevsim netdevsim4 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 853.618187][T31473] veth1_to_bond: entered allmulticast mode [ 853.638091][T31474] veth1_to_bond: entered promiscuous mode [ 853.655040][T31473] veth1_to_bond: left promiscuous mode [ 853.672294][T31473] veth1_to_bond: left allmulticast mode [ 853.712837][ T7782] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 853.753605][ T7782] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 853.882824][ T76] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 853.920765][ T76] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 854.125987][T31484] ip6gre0 speed is unknown, defaulting to 1000 [ 854.348195][T31493] 8021q: adding VLAN 0 to HW filter on device ipvlan2 [ 854.367223][T31493] team0: Device ipvlan2 is already an upper device of the team interface [ 854.418632][T31502] IPVS: set_ctl: invalid protocol: 135 127.0.0.1:20000 [ 854.742149][ C1] ip6_tunnel: ip6gre1 xmit: Local address not yet configured! [ 854.862488][T31508] netlink: 'syz.2.6781': attribute type 3 has an invalid length. [ 855.471236][T31518] Bluetooth: MGMT ver 1.23 [ 855.578895][T31521] __nla_validate_parse: 9 callbacks suppressed [ 855.578917][T31521] netlink: 4 bytes leftover after parsing attributes in process `syz.4.6786'. [ 855.869627][T31489] netlink: 300 bytes leftover after parsing attributes in process `syz.1.6774'. [ 856.070206][T31533] netlink: 20 bytes leftover after parsing attributes in process `syz.2.6788'. [ 857.015848][T31585] tap0: tun_chr_ioctl cmd 2148553947 [ 857.791022][T31602] netlink: 'syz.2.6802': attribute type 11 has an invalid length. [ 858.096138][T31608] netlink: 28 bytes leftover after parsing attributes in process `syz.2.6805'. [ 858.113561][T31608] netlink: 28 bytes leftover after parsing attributes in process `syz.2.6805'. [ 859.052743][T31632] netlink: 'syz.1.6815': attribute type 64 has an invalid length. [ 859.093770][T31628] netlink: 'syz.0.6813': attribute type 3 has an invalid length. [ 859.123571][T31635] netlink: 'syz.1.6815': attribute type 64 has an invalid length. [ 859.192549][T31632] netlink: 4 bytes leftover after parsing attributes in process `syz.1.6815'. [ 859.433229][T31638] ip6t_REJECT: TCP_RESET illegal for non-tcp [ 860.225278][T31652] netlink: 524 bytes leftover after parsing attributes in process `syz.1.6820'. [ 860.241547][T31656] netlink: 24 bytes leftover after parsing attributes in process `syz.3.6821'. [ 860.620563][T31667] netlink: 8 bytes leftover after parsing attributes in process `syz.1.6825'. [ 860.758339][T31671] netlink: 8 bytes leftover after parsing attributes in process `syz.0.6826'. [ 860.789669][T31669] syzkaller1: entered promiscuous mode [ 860.809693][T31669] syzkaller1: entered allmulticast mode [ 860.942850][T31676] netlink: 24 bytes leftover after parsing attributes in process `syz.4.6827'. [ 861.268277][T31673] netlink: 32 bytes leftover after parsing attributes in process `syz.4.6827'. [ 861.395641][T31686] netlink: 116 bytes leftover after parsing attributes in process `syz.3.6830'. [ 861.477075][T31686] macvtap1: entered promiscuous mode [ 861.527061][T31686] macvtap1: entered allmulticast mode [ 861.572623][T31686] veth1_vlan: entered allmulticast mode [ 861.696090][T31695] netlink: 12 bytes leftover after parsing attributes in process `syz.1.6832'. [ 861.800649][T31700] netlink: 16 bytes leftover after parsing attributes in process `syz.4.6833'. [ 861.816718][T31697] netlink: 16 bytes leftover after parsing attributes in process `syz.4.6833'. [ 861.999342][T31710] ipt_REJECT: TCP_RESET invalid for non-tcp [ 862.287989][T31718] syzkaller1: entered promiscuous mode [ 862.303220][T31718] syzkaller1: entered allmulticast mode [ 862.316240][T31722] net_ratelimit: 14 callbacks suppressed [ 862.316260][T31722] openvswitch: netlink: Actions may not be safe on all matching packets [ 862.735259][T31734] netlink: 8 bytes leftover after parsing attributes in process `syz.1.6845'. [ 862.822286][T31737] netlink: 24 bytes leftover after parsing attributes in process `syz.2.6844'. [ 862.997561][T31746] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 863.767612][T31771] syzkaller1: entered promiscuous mode [ 863.793811][T31771] syzkaller1: entered allmulticast mode [ 864.966149][T31809] syzkaller1: entered promiscuous mode [ 864.979730][T31809] syzkaller1: entered allmulticast mode [ 865.405557][T31822] netlink: 'syz.3.6877': attribute type 1 has an invalid length. [ 865.555731][T31824] xt_TCPMSS: Only works on TCP SYN packets [ 866.181808][T31853] bridge0: port 2(bridge_slave_1) entered disabled state [ 866.191894][T31853] bridge0: port 1(bridge_slave_0) entered disabled state [ 866.370089][T31862] __nla_validate_parse: 9 callbacks suppressed [ 866.370110][T31862] netlink: 64 bytes leftover after parsing attributes in process `syz.0.6889'. [ 866.454956][T31867] x_tables: ip_tables: DNAT target: used from hooks POSTROUTING, but only usable from PREROUTING/OUTPUT [ 866.495124][T31867] x_tables: ip_tables: DNAT target: used from hooks POSTROUTING, but only usable from PREROUTING/OUTPUT [ 866.563172][T31871] x_tables: ip_tables: DNAT target: used from hooks POSTROUTING, but only usable from PREROUTING/OUTPUT [ 866.595559][T31870] netlink: 12 bytes leftover after parsing attributes in process `syz.1.6892'. [ 866.691014][T31867] x_tables: ip_tables: DNAT target: used from hooks POSTROUTING, but only usable from PREROUTING/OUTPUT [ 866.725211][T31873] x_tables: ip_tables: DNAT target: used from hooks POSTROUTING, but only usable from PREROUTING/OUTPUT [ 866.772917][T31867] x_tables: ip_tables: DNAT target: used from hooks POSTROUTING, but only usable from PREROUTING/OUTPUT [ 866.799663][T31878] netlink: 'syz.1.6892': attribute type 11 has an invalid length. [ 866.824355][T31867] x_tables: ip_tables: DNAT target: used from hooks POSTROUTING, but only usable from PREROUTING/OUTPUT [ 866.884900][T31871] x_tables: ip_tables: DNAT target: used from hooks POSTROUTING, but only usable from PREROUTING/OUTPUT [ 866.937812][T31867] x_tables: ip_tables: DNAT target: used from hooks POSTROUTING, but only usable from PREROUTING/OUTPUT [ 866.999964][T31871] x_tables: ip_tables: DNAT target: used from hooks POSTROUTING, but only usable from PREROUTING/OUTPUT [ 867.220791][T31867] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 867.250686][T31892] netlink: 24 bytes leftover after parsing attributes in process `syz.0.6897'. [ 867.635548][T31903] netlink: 12 bytes leftover after parsing attributes in process `syz.4.6901'. [ 871.874000][T31879] syzkaller1: entered promiscuous mode [ 871.882048][T31879] syzkaller1: entered allmulticast mode [ 872.000284][T31907] netlink: 'syz.4.6901': attribute type 1 has an invalid length. [ 872.091920][T31917] netlink: 4 bytes leftover after parsing attributes in process `syz.1.6904'. [ 872.167358][T31917] macsec1: entered promiscuous mode [ 872.179004][T31917] bridge0: entered promiscuous mode [ 872.218913][T31917] macsec1: entered allmulticast mode [ 872.251070][T31917] bridge0: entered allmulticast mode [ 872.285774][T31917] bridge0: port 3(macsec1) entered blocking state [ 872.307086][T31917] bridge0: port 3(macsec1) entered disabled state [ 872.360239][T31917] bridge0: left allmulticast mode [ 872.410588][T31931] netlink: 'syz.0.6908': attribute type 10 has an invalid length. [ 872.455230][T31931] netlink: 40 bytes leftover after parsing attributes in process `syz.0.6908'. [ 872.562768][T29679] bridge0: left promiscuous mode [ 872.617502][T31931] team0: Port device geneve1 added [ 872.639879][T31926] netlink: 14 bytes leftover after parsing attributes in process `syz.0.6908'. [ 873.081887][T31949] veth1_virt_wifi: entered promiscuous mode [ 873.109642][T31949] veth1_virt_wifi: left promiscuous mode [ 873.354385][T31952] syzkaller1: entered promiscuous mode [ 873.363159][T31952] syzkaller1: entered allmulticast mode [ 873.695314][T31964] syzkaller0: entered promiscuous mode [ 873.715158][T31964] syzkaller0: entered allmulticast mode [ 873.968400][T31969] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 874.447537][T32000] xt_TPROXY: Can be used only with -p tcp or -p udp [ 878.692852][T31993] workqueue: Failed to create a rescuer kthread for wq "bond6": -EINTR [ 878.711725][T32007] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 878.815599][T32019] netlink: 4 bytes leftover after parsing attributes in process `syz.2.6931'. [ 878.867323][T32020] netlink: 8 bytes leftover after parsing attributes in process `syz.2.6931'. [ 878.902192][T32019] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 879.159773][T32019] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 879.362388][T32032] netlink: 16 bytes leftover after parsing attributes in process `syz.3.6934'. [ 879.605206][T32037] netlink: 'syz.1.6937': attribute type 1 has an invalid length. [ 879.733268][T32037] 8021q: adding VLAN 0 to HW filter on device bond3 [ 879.748103][T32050] tipc: Enabling of bearer rejected, failed to enable media [ 879.826443][T32051] netlink: 'syz.0.6941': attribute type 4 has an invalid length. [ 879.870602][T32048] bond3: (slave veth0_to_bond): making interface the new active one [ 879.885751][T32048] bond3: (slave veth0_to_bond): Enslaving as an active interface with an up link [ 879.928946][T32050] batman_adv: Cannot find parent device. Skipping batadv-on-batadv check for gretap1 [ 879.951525][T32050] gretap1: default qdisc (pfifo_fast) fail, fallback to noqueue [ 879.962629][T32050] gretap1: entered promiscuous mode [ 879.980133][T32050] gretap1: entered allmulticast mode [ 880.069522][T32059] netlink: 88 bytes leftover after parsing attributes in process `syz.3.6942'. [ 880.087948][T32059] netlink: 24 bytes leftover after parsing attributes in process `syz.3.6942'. [ 880.113605][T32059] netlink: 24 bytes leftover after parsing attributes in process `syz.3.6942'. [ 880.165005][T32037] macvlan2: entered promiscuous mode [ 880.173295][T32037] macvlan2: entered allmulticast mode [ 880.179876][T32037] bond3: entered promiscuous mode [ 880.185964][T32037] veth0_to_bond: entered promiscuous mode [ 880.205265][T32037] 8021q: adding VLAN 0 to HW filter on device macvlan2 [ 880.235806][T32037] bond3: (slave macvlan2): the slave hw address is in use by the bond; couldn't find a slave with a free hw address to give it (this should not have happened) [ 880.280298][T32037] bond3: left promiscuous mode [ 880.299235][T32037] veth0_to_bond: left promiscuous mode [ 880.657076][T32076] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 881.496219][T32105] nftables ruleset with unbound chain [ 881.505177][T32095] mac80211_hwsim hwsim54 wlan0: left promiscuous mode [ 881.620527][T32095] bridge1: left promiscuous mode [ 881.667816][T32095] bridge2: left promiscuous mode [ 881.796153][T32112] workqueue: Failed to create a rescuer kthread for wq "nfc2_nci_tx_wq": -EINTR [ 881.903201][T32119] ip_tunnel: non-ECT from 172.20.20.187 with TOS=0x2 [ 882.464800][T32142] netlink: 8 bytes leftover after parsing attributes in process `syz.2.6967'. [ 882.505584][T32136] netlink: 104 bytes leftover after parsing attributes in process `syz.1.6965'. [ 882.547670][T32142] netlink: 24 bytes leftover after parsing attributes in process `syz.2.6967'. [ 882.595673][T32146] netlink: 4 bytes leftover after parsing attributes in process `syz.3.6968'. [ 882.612957][T32145] netlink: 'syz.2.6967': attribute type 1 has an invalid length. [ 882.634405][T32142] netlink: 'syz.2.6967': attribute type 1 has an invalid length. [ 882.645495][T32145] netlink: 'syz.2.6967': attribute type 2 has an invalid length. [ 882.688669][T32148] veth0: entered promiscuous mode [ 882.694184][T32142] netlink: 'syz.2.6967': attribute type 2 has an invalid length. [ 882.724205][T32148] netlink: 'syz.0.6969': attribute type 1 has an invalid length. [ 882.914700][T32148] bond2: entered promiscuous mode [ 882.965324][T32148] 8021q: adding VLAN 0 to HW filter on device bond2 [ 883.154627][T32157] bond2: (slave bridge3): making interface the new active one [ 883.195938][T32157] bridge3: entered promiscuous mode [ 883.235047][T32157] bridge3: left promiscuous mode [ 883.290295][ C0] vcan0: j1939_tp_rxtimer: 0xffff88807f51f000: rx timeout, send abort [ 883.458807][T32147] veth0: left promiscuous mode [ 883.846088][T32179] netlink: 'syz.4.6975': attribute type 1 has an invalid length. [ 883.905661][T32189] netlink: 'syz.1.6977': attribute type 2 has an invalid length. [ 883.945105][T32189] C: renamed from lo [ 883.998906][T32189] A link change request failed with some changes committed already. Interface C may have been left with an inconsistent configuration, please check. [ 884.119935][T32194] IPVS: set_ctl: invalid protocol: 115 224.0.0.2:20003 [ 884.205455][T32199] __nla_validate_parse: 1 callbacks suppressed [ 884.205477][T32199] netlink: 8 bytes leftover after parsing attributes in process `syz.0.6981'. [ 884.666573][ T5796] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 884.709575][T32222] Cannot find set identified by id 4 to match [ 884.828062][ T188] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 884.948321][T32242] netlink: 12 bytes leftover after parsing attributes in process `syz.0.6992'. [ 884.959793][T32234] sctp: [Deprecated]: syz.1.6991 (pid 32234) Use of struct sctp_assoc_value in delayed_ack socket option. [ 884.959793][T32234] Use struct sctp_sack_info instead [ 885.694767][T32251] bridge0: port 2(bridge_slave_1) entered disabled state [ 885.718157][T29671] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 885.853927][T32269] netlink: 'syz.3.7000': attribute type 1 has an invalid length. [ 885.967853][T32262] batman_adv: Cannot find parent device. Skipping batadv-on-batadv check for gretap1 [ 886.048430][T32262] batman_adv: batadv0: Adding interface: gretap1 [ 886.075327][T32262] batman_adv: batadv0: The MTU of interface gretap1 is too small (1462) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 886.230091][T32274] netlink: 36 bytes leftover after parsing attributes in process `syz.1.7002'. [ 886.251612][T32262] batman_adv: batadv0: Interface activated: gretap1 [ 886.290089][T32268] netlink: 8 bytes leftover after parsing attributes in process `syz.0.6999'. [ 886.340556][T32284] Cannot find set identified by id 4 to match [ 886.589190][T32269] 8021q: adding VLAN 0 to HW filter on device bond2 [ 886.733529][T32272] bond2: (slave geneve2): making interface the new active one [ 886.753025][ T5796] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 886.808592][T32272] bond2: (slave geneve2): Enslaving as an active interface with an up link [ 886.886753][T32289] vcan1: entered promiscuous mode [ 886.902947][T32291] netlink: 524 bytes leftover after parsing attributes in process `syz.2.7006'. [ 886.924435][T32289] vcan1: entered allmulticast mode [ 887.309386][T32296] netlink: 4 bytes leftover after parsing attributes in process `syz.1.7008'. [ 887.784030][ T5796] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 887.862169][T18858] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 888.194651][T32323] netlink: 8 bytes leftover after parsing attributes in process `syz.2.7018'. [ 888.826752][T29671] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 889.134018][T32357] tipc: Enabling of bearer rejected, failed to enable media [ 889.769186][T32379] netlink: 'syz.3.7033': attribute type 1 has an invalid length. [ 889.794682][T32376] xt_CT: You must specify a L4 protocol and not use inversions on it [ 889.868740][T29671] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 890.513788][T32389] netlink: 'syz.2.7036': attribute type 1 has an invalid length. [ 890.906923][T29671] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 890.954428][ T188] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 891.194638][T32431] openvswitch: netlink: Key 4 has unexpected len 107 expected 12 [ 891.194795][T32428] netlink: 'syz.0.7048': attribute type 1 has an invalid length. [ 891.233914][T32428] netlink: 228 bytes leftover after parsing attributes in process `syz.0.7048'. [ 891.451848][T32439] netlink: 8 bytes leftover after parsing attributes in process `syz.4.7051'. [ 891.505191][T32439] netlink: 8 bytes leftover after parsing attributes in process `syz.4.7051'. [ 891.781124][ T50] Bluetooth: hci1: command tx timeout [ 892.271248][ T5796] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 892.439556][T32448] xt_hl: Unknown Hop Limit match mode: 206 [ 892.521549][ T188] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 892.605731][T32448] netlink: 16 bytes leftover after parsing attributes in process `syz.0.7054'. [ 892.908314][T32462] netlink: 4 bytes leftover after parsing attributes in process `syz.2.7060'. [ 893.156969][ T188] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 893.282092][T32474] bridge0: port 2(bridge_slave_1) entered disabled state [ 893.289856][T32474] bridge0: port 1(bridge_slave_0) entered disabled state [ 893.311856][T29671] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 893.340584][T32475] netlink: 20 bytes leftover after parsing attributes in process `syz.0.7062'. [ 893.627644][T32483] netlink: 104 bytes leftover after parsing attributes in process `syz.4.7064'. [ 893.661870][T32476] bridge0: port 2(bridge_slave_1) entered blocking state [ 893.670185][T32476] bridge0: port 2(bridge_slave_1) entered forwarding state [ 893.683178][T32476] bridge0: port 1(bridge_slave_0) entered blocking state [ 893.693014][T32476] bridge0: port 1(bridge_slave_0) entered forwarding state [ 893.796059][T32476] bridge0: entered promiscuous mode [ 893.832517][T32476] bridge0: entered allmulticast mode [ 893.906761][T32489] netlink: 4 bytes leftover after parsing attributes in process `syz.1.7066'. [ 893.987170][T32475] ip6gre1: entered promiscuous mode [ 894.024919][T18858] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 894.032257][T32475] ip6gre1: entered allmulticast mode [ 894.158969][T32496] netlink: 'syz.2.7068': attribute type 14 has an invalid length. [ 894.345189][ T5796] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 894.491896][T32502] netlink: 4 bytes leftover after parsing attributes in process `syz.4.7067'. [ 894.669470][T32502] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 895.172625][T32502] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 895.758763][T32532] Cannot find set identified by id 4 to match [ 895.772984][T32533] net_ratelimit: 3 callbacks suppressed [ 895.773009][T32533] openvswitch: netlink: Unexpected mask (mask=200240, allowed=10048) [ 896.096807][T32536] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 896.462284][T32562] xt_hashlimit: size too large, truncated to 1048576 [ 896.529933][T32562] xt_hashlimit: max too large, truncated to 1048576 [ 896.596984][T32562] xt_hashlimit: invalid rate [ 897.154898][T32585] tun0: tun_chr_ioctl cmd 1074025675 [ 897.160998][T32585] tun0: persist disabled [ 897.422022][T32591] smbdirect: ib_dev[syz0]: added: RNIC max_fast_reg_page_list_len=256 device_cap_flags=0x200000 kernel_cap_flags=0x10 page_size_cap=0x1000 [ 897.481406][T32591] smbdirect: ib_dev[syz0]: num_ports=1 max_qp_rd_atom=128 max_qp_init_rd_atom=128 max_sgl_rd=0 max_sge_rd=1 max_cqe=3276800 max_qp_wr=32768 max_send_sge=6 max_recv_sge=6 [ 897.538737][T32594] netlink: 4595 bytes leftover after parsing attributes in process `syz.1.7093'. [ 897.551935][T32591] smbdirect: ib_dev[syz0]PORT[1]: iwarp=1 ib=0 roce=0 v1=0 v2=0 core_cap_flags=0x400008 [ 897.573182][T32594] netlink: 4595 bytes leftover after parsing attributes in process `syz.1.7093'. [ 897.589597][T32597] Cannot find set identified by id 4 to match [ 897.670541][T32591] iwpm_register_pid: Unable to send a nlmsg (client = 2) [ 897.934057][T32591] infiniband syz0: RDMA CMA: cma_listen_on_dev, error -98 [ 898.100626][T32602] netlink: 104 bytes leftover after parsing attributes in process `syz.4.7095'. [ 898.542358][T32607] netlink: 'syz.4.7096': attribute type 4 has an invalid length. [ 898.847148][T32614] syzkaller0: entered allmulticast mode [ 898.940403][T32614] syzkaller0: entered promiscuous mode [ 899.761879][T32571] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 899.786781][T32629] netlink: 12 bytes leftover after parsing attributes in process `syz.3.7103'. [ 900.053635][T32638] Cannot find set identified by id 4 to match [ 900.683688][T32652] 0: reclassify loop, rule prio 0, protocol 03 [ 901.121966][T32660] netlink: 'syz.0.7113': attribute type 1 has an invalid length. [ 901.203813][T32657] netlink: 8 bytes leftover after parsing attributes in process `syz.1.7112'. [ 901.597956][T32660] 8021q: adding VLAN 0 to HW filter on device bond3 [ 901.615594][T32671] x_tables: (null)_tables: NFQUEUE.1 target: invalid size 8 (kernel) != (user) 16 [ 901.721895][T32661] bond3: (slave veth0_to_bond): making interface the new active one [ 901.797821][T32661] bond3: (slave veth0_to_bond): Enslaving as an active interface with an up link [ 901.868493][T32663] bond3: entered promiscuous mode [ 901.903382][T32663] veth0_to_bond: entered promiscuous mode [ 901.936015][T32663] bond3: entered allmulticast mode [ 901.949663][T32682] openvswitch: netlink: Missing key (keys=40, expected=100) [ 901.961037][T32663] veth0_to_bond: entered allmulticast mode [ 902.535833][T32696] netlink: 8 bytes leftover after parsing attributes in process `syz.2.7120'. [ 902.788324][ T5715] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 903.023894][T32701] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 903.111988][T32703] netlink: 176 bytes leftover after parsing attributes in process `syz.1.7121'. [ 904.332914][T32728] syzkaller0: entered allmulticast mode [ 904.460618][T32734] netlink: 'syz.0.7131': attribute type 1 has an invalid length. [ 904.576851][T32733] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 904.792262][T32734] bond4: entered promiscuous mode [ 904.911293][T32734] 8021q: adding VLAN 0 to HW filter on device bond4 [ 904.968220][T32741] syzkaller0: entered promiscuous mode [ 905.109033][T32738] 8021q: adding VLAN 0 to HW filter on device bond4 [ 905.164107][T32738] bond4: (slave gre2): The slave device specified does not support setting the MAC address [ 905.192972][T32738] bond4: (slave gre2): Setting fail_over_mac to active for active-backup mode [ 905.302988][T32738] bond4: (slave gre2): making interface the new active one [ 905.325483][T32738] gre2: entered promiscuous mode [ 905.344210][T32738] bond4: (slave gre2): Enslaving as an active interface with an up link [ 905.447045][T32751] bond0: option ad_user_port_key: mode dependency failed, not supported in mode balance-rr(0) [ 905.736290][T32763] netlink: 8 bytes leftover after parsing attributes in process `syz.1.7138'. [ 905.907041][T32765] veth1_to_bond: entered allmulticast mode [ 905.933863][T32765] veth1_to_bond: entered promiscuous mode [ 905.995402][T32765] SET target dimension over the limit! [ 906.029851][T32765] netlink: 4 bytes leftover after parsing attributes in process `syz.3.7139'. [ 906.365216][T32765] veth1_to_bond (unregistering): left allmulticast mode [ 906.381256][T32765] veth1_to_bond (unregistering): left promiscuous mode [ 906.466404][ T309] ip6t_REJECT: TCP_RESET illegal for non-tcp [ 906.477480][T32765] bond0: (slave bond_slave_1): Releasing backup interface [ 906.504666][ T309] netlink: 'syz.4.7143': attribute type 1 has an invalid length. [ 906.704639][ T309] 8021q: adding VLAN 0 to HW filter on device bond1 [ 906.763399][ T315] netlink: 20 bytes leftover after parsing attributes in process `syz.2.7144'. [ 907.053348][ T329] IPv6: NLM_F_REPLACE set, but no existing node found! [ 907.125195][ T330] xt_hashlimit: size too large, truncated to 1048576 [ 907.327722][ T331] sctp: [Deprecated]: syz.0.7149 (pid 331) Use of int in max_burst socket option. [ 907.327722][ T331] Use struct sctp_assoc_value instead [ 908.063269][ T344] syzkaller0: entered allmulticast mode [ 908.221654][ T346] A link change request failed with some changes committed already. Interface wg2 may have been left with an inconsistent configuration, please check. [ 908.497268][ T347] syzkaller0: entered promiscuous mode [ 909.199563][ T368] netlink: 32 bytes leftover after parsing attributes in process `syz.4.7159'. [ 909.490977][ T374] netlink: 32 bytes leftover after parsing attributes in process `syz.0.7161'. [ 909.511973][ T370] netlink: 542 bytes leftover after parsing attributes in process `syz.1.7158'. [ 909.563944][ T374] veth1_macvtap: left promiscuous mode [ 909.697515][ T380] netlink: 'syz.4.7162': attribute type 1 has an invalid length. [ 909.744850][ T380] netlink: 232 bytes leftover after parsing attributes in process `syz.4.7162'. [ 909.780469][ T380] netlink: 'syz.4.7162': attribute type 1 has an invalid length. [ 909.820570][ T382] netlink: 8 bytes leftover after parsing attributes in process `syz.2.7163'. [ 909.992020][ T382] netlink: 112 bytes leftover after parsing attributes in process `syz.2.7163'. [ 910.058770][ T382] netlink: 20 bytes leftover after parsing attributes in process `syz.2.7163'. [ 910.469469][ T394] netlink: 'syz.1.7167': attribute type 2 has an invalid length. [ 911.135051][ T188] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 911.152953][ T411] netlink: 4 bytes leftover after parsing attributes in process `syz.3.7174'. [ 911.170233][ T413] netlink: 12 bytes leftover after parsing attributes in process `syz.2.7171'. [ 911.861293][ T429] team0: Port device syz_tun added [ 911.906037][ T430] netlink: 8 bytes leftover after parsing attributes in process `syz.4.7176'. [ 913.485252][ T455] netlink: 'syz.0.7183': attribute type 9 has an invalid length. [ 915.168463][ T487] netlink: 28 bytes leftover after parsing attributes in process `syz.1.7189'. [ 915.195937][ T485] ip_tables: iptables: counters copy to user failed while replacing table [ 915.209131][ T486] ip_tables: iptables: counters copy to user failed while replacing table [ 915.380990][ T494] netlink: 8 bytes leftover after parsing attributes in process `syz.0.7191'. [ 915.435509][ T494] netlink: 24 bytes leftover after parsing attributes in process `syz.0.7191'. [ 915.858170][ T506] netlink: 40 bytes leftover after parsing attributes in process `syz.4.7194'. [ 915.869392][ T506] netlink: 40 bytes leftover after parsing attributes in process `syz.4.7194'. [ 916.159685][ T510] netlink: 'syz.1.7196': attribute type 21 has an invalid length. [ 916.310280][ T514] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 916.330175][ T518] netlink: 12 bytes leftover after parsing attributes in process `syz.1.7196'. [ 916.379882][ T514] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 916.439403][ T514] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 916.455421][ T514] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 916.473850][ T514] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 916.825542][ C0] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 917.017351][ T511] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 917.466449][T18858] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 917.510632][ T547] netlink: 8 bytes leftover after parsing attributes in process `syz.4.7204'. [ 917.566343][ T548] netlink: 8 bytes leftover after parsing attributes in process `syz.4.7204'. [ 919.692518][ T547] netlink: 8 bytes leftover after parsing attributes in process `syz.4.7204'. [ 919.733206][ T548] netlink: 8 bytes leftover after parsing attributes in process `syz.4.7204'. [ 919.847708][ T564] tipc: MTU too low for tipc bearer [ 919.985242][ T570] netlink: 'syz.3.7210': attribute type 6 has an invalid length. [ 919.997553][T23189] netdevsim netdevsim4 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0 [ 920.020059][ T570] netlink: 'syz.3.7210': attribute type 5 has an invalid length. [ 920.271306][ T571] netlink: Failed to add helper -22 [ 920.301340][ T571] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 920.315154][T15465] netdevsim netdevsim4 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0 [ 920.373031][T15465] netdevsim netdevsim4 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0 [ 920.446862][T15465] netdevsim netdevsim4 netdevsim0: set [0, 0] type 1 family 0 port 8472 - 0 [ 921.247235][ T588] skbuff: bad partial csum: csum=65535/2 headroom=4 headlen=65543 [ 921.295888][ T599] __nla_validate_parse: 5 callbacks suppressed [ 921.295930][ T599] netlink: 4 bytes leftover after parsing attributes in process `syz.1.7218'. [ 921.297550][ T600] netlink: 4 bytes leftover after parsing attributes in process `syz.1.7218'. [ 921.390504][ T599] netlink: 12 bytes leftover after parsing attributes in process `syz.1.7218'. [ 921.421472][ T602] netlink: 12 bytes leftover after parsing attributes in process `syz.1.7218'. [ 922.161082][ T48] netdevsim netdevsim4 netdevsim0: unset [0, 0] type 1 family 0 port 8472 - 0 [ 922.213832][ T48] netdevsim netdevsim4 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 922.626396][ T633] No such timeout policy "syz1" [ 922.785723][ T639] netlink: 65047 bytes leftover after parsing attributes in process `syz.0.7230'. [ 923.251539][ T654] SET target dimension over the limit! [ 924.207993][ T672] netlink: 56 bytes leftover after parsing attributes in process `syz.4.7239'. [ 924.984140][ T643] syzkaller0: entered promiscuous mode [ 925.037978][ T643] syzkaller0: entered allmulticast mode [ 926.008361][ T721] Cannot find set identified by id 4 to match [ 927.066698][ T188] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 927.130199][ T738] netlink: 'syz.4.7259': attribute type 1 has an invalid length. [ 927.159184][ T738] netlink: 'syz.4.7259': attribute type 3 has an invalid length. [ 927.192186][ T738] netlink: 224 bytes leftover after parsing attributes in process `syz.4.7259'. [ 927.703212][T30171] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 927.764822][ T747] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 927.778266][ C0] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 928.392127][ T753] netlink: 'syz.4.7263': attribute type 24 has an invalid length. [ 932.838015][ T765] netlink: 8 bytes leftover after parsing attributes in process `syz.0.7267'. [ 932.918163][ T767] batadv0: mtu less than device minimum [ 932.951557][ T767] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (0) [ 932.967482][ T767] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (0) [ 932.980985][ T767] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (0) [ 932.994459][ T767] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (0) [ 933.008090][ T767] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (0) [ 933.021703][ T767] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (0) [ 933.035047][ T767] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (0) [ 933.048263][ T767] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (0) [ 933.060908][ T767] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (0) [ 933.436106][ T780] netlink: 4 bytes leftover after parsing attributes in process `syz.0.7271'. [ 933.497513][ T784] netlink: 12 bytes leftover after parsing attributes in process `syz.0.7271'. [ 933.735789][ T789] ip6erspan0: entered allmulticast mode [ 934.014905][ T795] netlink: 16 bytes leftover after parsing attributes in process `syz.2.7275'. [ 934.160133][ T804] xt_addrtype: both incoming and outgoing interface limitation cannot be selected [ 934.897396][ T824] bridge: RTM_NEWNEIGH bridge0 without NUD_PERMANENT [ 934.986880][ T827] xt_TCPMSS: path-MTU clamping only supported in FORWARD, OUTPUT and POSTROUTING hooks [ 935.106901][ T827] xt_hashlimit: size too large, truncated to 1048576 [ 935.583134][ T843] netlink: 'syz.4.7293': attribute type 29 has an invalid length. [ 935.641663][ T839] macvtap1: entered promiscuous mode [ 935.659572][ T839] macvtap1: entered allmulticast mode [ 935.690118][ T839] veth1_vlan: entered allmulticast mode [ 935.832644][ T849] xt_limit: Overflow, try lower: 536871034/127 [ 935.894307][ T853] netlink: 240 bytes leftover after parsing attributes in process `syz.2.7295'. [ 935.915328][ T850] netlink: 12 bytes leftover after parsing attributes in process `syz.3.7294'. [ 936.593543][ T850] 8021q: adding VLAN 0 to HW filter on device bond4 [ 937.763921][ T895] netlink: 8 bytes leftover after parsing attributes in process `syz.1.7309'. [ 937.842177][ T901] tipc: Enabling of bearer rejected, failed to enable media [ 938.115048][ T911] netlink: 'syz.2.7313': attribute type 23 has an invalid length. [ 938.763441][ T870] Bluetooth: hci2: command 0x0406 tx timeout [ 938.846712][ T949] net_ratelimit: 248 callbacks suppressed [ 938.846735][ T949] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 939.138327][ T949] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 939.161811][ T957] veth0_to_bridge: entered promiscuous mode [ 939.245757][ T957] : renamed from bond_slave_1 (while UP) [ 939.360556][ T954] veth0_to_bridge: left promiscuous mode [ 939.437025][ T949] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 939.507500][ T949] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 939.557386][ T949] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 939.693079][ T949] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 939.974842][ T976] netlink: 88 bytes leftover after parsing attributes in process `syz.4.7330'. [ 940.022639][ T981] IPVS: length: 28 != 24 [ 940.050274][ T981] IPVS: length: 28 != 24 [ 940.285393][ T990] netlink: 1 bytes leftover after parsing attributes in process `syz.2.7334'. [ 940.333685][ T991] netdevsim netdevsim0: Direct firmware load for .. failed with error -2 [ 940.386768][ T991] netdevsim netdevsim0: Falling back to sysfs fallback for: .. [ 940.667630][ T1003] Cannot find set identified by id 4 to match [ 941.974884][ T1030] x_tables: duplicate underflow at hook 3 [ 942.298029][ T1043] syzkaller0: entered promiscuous mode [ 942.323342][ T1043] syzkaller0: entered allmulticast mode [ 942.418752][ T1047] netlink: 8 bytes leftover after parsing attributes in process `syz.0.7352'. [ 942.479945][ T1047] netlink: 8 bytes leftover after parsing attributes in process `syz.0.7352'. [ 942.497789][ T1057] Cannot find set identified by id 4 to match [ 942.931952][T23190] netdevsim netdevsim0 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0 [ 942.999058][T23190] netdevsim netdevsim0 netdevsim0: set [0, 0] type 1 family 0 port 8472 - 0 [ 943.063739][T23190] netdevsim netdevsim0 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0 [ 943.114084][T23190] netdevsim netdevsim0 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0 [ 943.225100][ T1076] netlink: 4 bytes leftover after parsing attributes in process `syz.4.7357'. [ 943.478523][ T1086] netlink: 228 bytes leftover after parsing attributes in process `syz.1.7361'. [ 943.529064][ T1086] netlink: 4 bytes leftover after parsing attributes in process `syz.1.7361'. [ 944.063267][ T1082] mac80211_hwsim hwsim49 wlan0: entered promiscuous mode [ 944.187936][ T1102] ip6gre1: entered allmulticast mode [ 944.431824][ T76] ip6_tunnel: ip6gre1 xmit: Local address not yet configured! [ 946.956713][T30171] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 948.664699][ C0] ip6_tunnel: ip6gre1 xmit: Local address not yet configured! [ 952.045756][ T1144] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 952.071247][ T1144] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 952.808847][ T1167] Cannot find set identified by id 4 to match [ 953.396763][ T1178] netlink: 36 bytes leftover after parsing attributes in process `syz.1.7383'. [ 953.718225][ T1192] netlink: 60 bytes leftover after parsing attributes in process `syz.4.7384'. [ 953.732247][ T1192] netlink: 8 bytes leftover after parsing attributes in process `syz.4.7384'. [ 953.895672][ T1201] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 954.276127][ T1214] Cannot find set identified by id 4 to match [ 954.313613][ T1181] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 954.836887][ T1220] openvswitch: netlink: ERSPAN option length err (len 256, max 255). [ 955.215148][ T1220] syzkaller0: entered promiscuous mode [ 955.238209][ T1220] syzkaller0: entered allmulticast mode [ 955.430140][ T1237] netlink: 'syz.0.7400': attribute type 10 has an invalid length. [ 955.548322][ T1242] netlink: 24 bytes leftover after parsing attributes in process `syz.4.7402'. [ 955.791831][ T1234] netlink: 1047 bytes leftover after parsing attributes in process `syz.0.7400'. [ 955.830337][ T1234] veth0_to_bond: default FDB implementation only supports local addresses [ 955.893704][ T1237] hsr0: A HSR master's MTU cannot be greater than the smallest MTU of its slaves minus the HSR Tag length (6 octets). [ 956.273141][ T1254] Cannot find set identified by id 4 to match [ 956.502712][T30171] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 956.717835][ T1265] netlink: 4 bytes leftover after parsing attributes in process `syz.4.7406'. [ 956.757072][ T1247] netlink: 'syz.1.7403': attribute type 12 has an invalid length. [ 956.773526][ T1266] netlink: 20 bytes leftover after parsing attributes in process `syz.4.7406'. [ 956.788703][ T1247] netlink: 'syz.1.7403': attribute type 29 has an invalid length. [ 956.825642][ T1247] netlink: 148 bytes leftover after parsing attributes in process `syz.1.7403'. [ 956.863249][ T1247] netlink: 'syz.1.7403': attribute type 1 has an invalid length. [ 956.880213][ T1247] netlink: 'syz.1.7403': attribute type 2 has an invalid length. [ 956.889884][ T1247] netlink: 31 bytes leftover after parsing attributes in process `syz.1.7403'. [ 956.944246][ T1262] bond0: entered promiscuous mode [ 956.950261][ T1262] bond_slave_0: entered promiscuous mode [ 956.961578][ T1262] : entered promiscuous mode [ 956.979529][ T1262] batadv0: entered promiscuous mode [ 957.006282][ T1262] debugfs: 'hsr1' already exists in 'hsr' [ 957.019511][ T1262] Cannot create hsr debugfs directory [ 957.044993][ T1262] 8021q: adding VLAN 0 to HW filter on device hsr1 [ 957.058071][ T1262] bond0: left promiscuous mode [ 957.070890][ T1262] bond_slave_0: left promiscuous mode [ 957.079488][ T1262] : left promiscuous mode [ 957.088579][ T1262] batadv0: left promiscuous mode [ 957.781312][ C0] ip6_tunnel: ip6gre1 xmit: Local address not yet configured! [ 959.155162][ T1286] netlink: 72 bytes leftover after parsing attributes in process `syz.0.7412'. [ 959.431515][ T1289] netlink: 32 bytes leftover after parsing attributes in process `syz.0.7413'. [ 962.793449][ T1257] syzkaller0: entered promiscuous mode [ 962.803084][ T1257] syzkaller0: entered allmulticast mode [ 963.363741][ T1303] Cannot find set identified by id 4 to match [ 963.432039][ T1305] netlink: 4 bytes leftover after parsing attributes in process `syz.4.7414'. [ 963.533364][ T1305] netlink: 4 bytes leftover after parsing attributes in process `syz.4.7414'. [ 963.839639][ T1312] netlink: 20 bytes leftover after parsing attributes in process `syz.0.7417'. [ 964.685128][ T1336] netlink: 68 bytes leftover after parsing attributes in process `syz.1.7425'. [ 964.741606][ T1336] netlink: 108 bytes leftover after parsing attributes in process `syz.1.7425'. [ 964.742503][ T1338] netlink: 14 bytes leftover after parsing attributes in process `syz.0.7426'. [ 964.911519][ T1337] bridge0: left promiscuous mode [ 965.397193][ T1337] netdevsim netdevsim3 netdevsim0: left promiscuous mode [ 965.422868][ T1337] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 965.578240][ T1337] A link change request failed with some changes committed already. Interface rose0 may have been left with an inconsistent configuration, please check. [ 966.072501][ T1368] netlink: 4 bytes leftover after parsing attributes in process `syz.0.7430'. [ 966.108844][ T188] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 966.690734][ T1378] netlink: 'syz.3.7435': attribute type 5 has an invalid length. [ 966.721072][ T1378] netlink: 24 bytes leftover after parsing attributes in process `syz.3.7435'. [ 967.219210][ T1390] tipc: Failed to remove unknown binding: 66,0,0/0:3539809859/3539809860 [ 967.250951][ T1388] netlink: 12 bytes leftover after parsing attributes in process `syz.3.7439'. [ 967.285185][ T1390] tipc: Failed to remove unknown binding: 66,0,0/0:3539809859/3539809860 [ 967.313088][ T1388] netlink: 2 bytes leftover after parsing attributes in process `syz.3.7439'. [ 967.540670][ T1394] netlink: 12 bytes leftover after parsing attributes in process `syz.1.7441'. [ 968.137138][ T1400] –: renamed from vxcan1 (while UP) [ 968.956680][ T1437] netlink: 52 bytes leftover after parsing attributes in process `syz.4.7450'. [ 969.420182][ T1453] Cannot find set identified by id 4 to match [ 969.833508][ T1465] sch_tbf: burst 19872 is lower than device lo mtu (65550) ! [ 969.957575][ T1468] netlink: 12 bytes leftover after parsing attributes in process `syz.1.7461'. [ 970.031958][ T1471] netlink: 8 bytes leftover after parsing attributes in process `syz.1.7461'. [ 970.068900][ T1471] netlink: 24 bytes leftover after parsing attributes in process `syz.1.7461'. [ 970.119217][ T1471] netlink: 8 bytes leftover after parsing attributes in process `syz.1.7461'. [ 970.164662][ T1471] netlink: 24 bytes leftover after parsing attributes in process `syz.1.7461'. [ 970.240100][ T1468] bond0: entered promiscuous mode [ 970.285679][ T1468] bond_slave_0: entered promiscuous mode [ 970.307903][ T1468] : entered promiscuous mode [ 970.316295][ T1468] bond0: entered allmulticast mode [ 970.327003][ T1468] bond_slave_0: entered allmulticast mode [ 970.338041][ T1468] : entered allmulticast mode [ 971.033826][ T1484] netlink: 68 bytes leftover after parsing attributes in process `syz.4.7465'. [ 971.575915][ T1492] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 971.585705][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 971.726662][ T1498] Cannot find set identified by id 4 to match [ 972.999122][ T1517] syzkaller1: tun_chr_ioctl cmd 1074025677 [ 973.072225][ T1517] syzkaller1: Refused to change device type [ 973.108933][ T1529] netlink: 8 bytes leftover after parsing attributes in process `syz.2.7479'. [ 973.544393][ T1536] netlink: 68 bytes leftover after parsing attributes in process `syz.4.7481'. [ 973.794963][ T1541] gre0: entered promiscuous mode [ 973.817856][ T1541] gre0: entered allmulticast mode [ 974.140798][ T1551] netlink: 4 bytes leftover after parsing attributes in process `syz.0.7487'. [ 974.390031][ T1552] syzkaller0: entered promiscuous mode [ 974.426046][ T1552] syzkaller0: entered allmulticast mode [ 975.023626][ T1576] netlink: 12 bytes leftover after parsing attributes in process `syz.0.7494'. [ 975.061603][ C0] ip6_tunnel: ip6gre1 xmit: Local address not yet configured! [ 975.083387][ T1578] netlink: 8 bytes leftover after parsing attributes in process `syz.0.7494'. [ 975.159961][ T1578] netlink: 12 bytes leftover after parsing attributes in process `syz.0.7494'. [ 975.507806][ T1587] netlink: 8 bytes leftover after parsing attributes in process `syz.1.7497'. [ 975.596390][ T1583] netlink: 8 bytes leftover after parsing attributes in process `syz.3.7496'. [ 976.341423][ T1605] netlink: 12 bytes leftover after parsing attributes in process `syz.2.7501'. [ 978.165418][ T1652] IPVS: sync thread started: state = MASTER, mcast_ifn = pimreg, syncid = 3, id = 0 [ 978.573007][ T1654] netlink: 40 bytes leftover after parsing attributes in process `syz.3.7511'. [ 978.804403][ T1658] netlink: 8 bytes leftover after parsing attributes in process `syz.4.7512'. [ 979.976591][ T1674] Cannot find set identified by id 4 to match [ 980.946016][ T1699] netlink: 12 bytes leftover after parsing attributes in process `syz.2.7525'. [ 981.015144][ C0] vcan0: j1939_tp_rxtimer: 0xffff888057056800: rx timeout, send abort [ 981.258813][ T1706] netlink: 12 bytes leftover after parsing attributes in process `syz.3.7529'. [ 981.291992][ T1706] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 981.515489][ C0] vcan0: j1939_tp_rxtimer: 0xffff888057054800: rx timeout, send abort [ 981.524822][ C0] vcan0: j1939_tp_rxtimer: 0xffff888057056800: abort rx timeout. Force session deactivation [ 982.024640][ C0] vcan0: j1939_tp_rxtimer: 0xffff888057054800: abort rx timeout. Force session deactivation [ 982.361466][ T1731] mac80211_hwsim hwsim54 wlan0: entered promiscuous mode [ 982.401758][ T1731] batman_adv: batadv0: Adding interface: wlan0 [ 982.409596][ T1730] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 982.435378][ T1731] batman_adv: batadv0: The MTU of interface wlan0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 982.649444][ T1731] batman_adv: batadv0: Interface activated: wlan0 [ 984.204932][ T1764] mac80211_hwsim hwsim58 wlan0: entered promiscuous mode [ 984.245621][ T1764] batman_adv: batadv0: Adding interface: wlan0 [ 984.272708][ T1764] batman_adv: batadv0: The MTU of interface wlan0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 984.352775][ T1764] batman_adv: batadv0: Interface activated: wlan0 [ 984.519274][ T1769] netlink: 12 bytes leftover after parsing attributes in process `syz.4.7548'. [ 984.671462][ T1770] ip6t_srh: unknown srh invflags 4000 [ 984.739344][ T1769] bond2: entered promiscuous mode [ 984.745999][ T1769] 8021q: adding VLAN 0 to HW filter on device bond2 [ 984.797284][ T1770] bridge2: entered promiscuous mode [ 984.810963][ T1770] bond2: (slave bridge2): Enslaving as an active interface with an up link [ 984.830287][ T1774] netlink: 1524 bytes leftover after parsing attributes in process `syz.3.7549'. [ 984.885649][ T1774] openvswitch: netlink: Flow key attr not present in new flow. [ 986.017428][ T1751] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 986.737805][ T1811] netlink: 8 bytes leftover after parsing attributes in process `syz.4.7555'. [ 986.889535][ T1811] batman_adv: Cannot find parent device. Skipping batadv-on-batadv check for gretap1 [ 987.052700][ T1812] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 988.538516][ T1829] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 988.920491][ T1862] netlink: 32 bytes leftover after parsing attributes in process `syz.0.7567'. [ 991.076209][ T1905] batman_adv: batadv0: Interface deactivated: wlan0 [ 991.166057][ T1910] netlink: 36 bytes leftover after parsing attributes in process `syz.2.7580'. [ 991.305239][ T1905] batman_adv: batadv0: Interface deactivated: wlan0 [ 991.811690][ T1917] geneve2: entered promiscuous mode [ 991.846845][ T1917] geneve2: entered allmulticast mode [ 992.045229][ T48] netdevsim netdevsim1 netdevsim3: set [1, 1] type 2 family 0 port 19999 - 0 [ 992.142846][ T1926] can: request_module (can-proto-0) failed. [ 992.504000][ T48] netdevsim netdevsim1 netdevsim0: set [1, 1] type 2 family 0 port 19999 - 0 [ 992.545872][ T1935] netlink: 16 bytes leftover after parsing attributes in process `syz.3.7587'. [ 992.572838][ T48] netdevsim netdevsim1 netdevsim2: set [1, 1] type 2 family 0 port 19999 - 0 [ 992.614177][ T48] netdevsim netdevsim1 netdevsim1: set [1, 1] type 2 family 0 port 19999 - 0 [ 993.165993][T29679] IPVS: starting estimator thread 0... [ 993.180870][ T1957] IPVS: set_ctl: invalid protocol: 20 0.0.0.0:256 [ 993.302272][ T1959] IPVS: using max 26 ests per chain, 62400 per kthread [ 995.955011][ T2008] netlink: 'syz.4.7605': attribute type 1 has an invalid length. [ 996.157285][ T2008] 8021q: adding VLAN 0 to HW filter on device bond3 [ 997.435885][ T2050] netlink: 20 bytes leftover after parsing attributes in process `syz.0.7614'. [ 997.470507][ T2050] netlink: 4 bytes leftover after parsing attributes in process `syz.0.7614'. [ 999.357216][ T2100] ip6t_srh: unknown srh invflags 4000 [ 999.485157][ T2103] netlink: 64 bytes leftover after parsing attributes in process `syz.1.7630'. [ 999.704352][ T2104] bond5: entered promiscuous mode [ 999.730331][ T2104] bond5: entered allmulticast mode [ 999.740286][ T2104] 8021q: adding VLAN 0 to HW filter on device bond5 [ 1000.059077][ T2125] Cannot find set identified by id 4 to match [ 1000.473574][ T2135] netlink: 8 bytes leftover after parsing attributes in process `syz.2.7640'. [ 1000.565051][ T2135] netlink: 20 bytes leftover after parsing attributes in process `syz.2.7640'. [ 1000.705061][ T2142] ip_tables: iptables: counters copy to user failed while replacing table [ 1000.767803][ T2142] netlink: 'syz.4.7643': attribute type 1 has an invalid length. [ 1001.170264][ T2153] netlink: 28 bytes leftover after parsing attributes in process `syz.2.7646'. [ 1001.353480][ T2161] netlink: 16 bytes leftover after parsing attributes in process `syz.3.7648'. [ 1001.918521][ T2177] Cannot find set identified by id 4 to match [ 1002.215200][ T2182] rdma_rxe: rxe_newlink: rxe creation allowed on top of a real device only [ 1002.326986][ T2184] sctp: [Deprecated]: syz.2.7655 (pid 2184) Use of int in max_burst socket option. [ 1002.326986][ T2184] Use struct sctp_assoc_value instead [ 1002.580542][ T2194] ip_tables: iptables: counters copy to user failed while replacing table [ 1002.620007][ T2193] veth0_macvtap: entered allmulticast mode [ 1002.683043][ T2193] A link change request failed with some changes committed already. Interface veth0_macvtap may have been left with an inconsistent configuration, please check. [ 1003.038422][ T2208] netlink: 36 bytes leftover after parsing attributes in process `syz.0.7662'. [ 1003.060848][ T2206] x_tables: ip6_tables: mh match: only valid for protocol 135 [ 1003.163496][ T2214] x_tables: ip6_tables: mh match: only valid for protocol 135 [ 1003.217781][ T2213] netlink: 72 bytes leftover after parsing attributes in process `syz.4.7664'. [ 1003.280790][ T2215] netlink: 72 bytes leftover after parsing attributes in process `syz.4.7664'. [ 1003.411349][ T2218] sctp: [Deprecated]: syz.3.7665 (pid 2218) Use of int in max_burst socket option. [ 1003.411349][ T2218] Use struct sctp_assoc_value instead [ 1003.955203][ T2238] xt_hashlimit: size too large, truncated to 1048576 [ 1004.144167][ T2241] bridge0: port 1(bridge_slave_0) entered disabled state [ 1004.294838][ T2250] ip_tables: iptables: counters copy to user failed while replacing table [ 1004.634700][ T2241] bridge_slave_0 (unregistering): left allmulticast mode [ 1004.917363][ T2247] netlink: 'syz.1.7668': attribute type 21 has an invalid length. [ 1005.043649][ T2241] bridge_slave_0 (unregistering): left promiscuous mode [ 1005.365991][ T2241] bridge0: port 1(bridge_slave_0) entered disabled state [ 1005.936227][ T2278] netlink: 'syz.2.7677': attribute type 7 has an invalid length. [ 1006.795278][ T2298] ip_tables: iptables: counters copy to user failed while replacing table [ 1006.844713][ T2302] ip_tables: iptables: counters copy to user failed while replacing table [ 1006.952671][ T2304] netlink: 4 bytes leftover after parsing attributes in process `syz.1.7683'. [ 1008.220589][ T2331] netlink: 20 bytes leftover after parsing attributes in process `syz.1.7689'. [ 1008.629514][ T2342] syzkaller0: entered allmulticast mode [ 1009.556315][ T2352] netlink: 80 bytes leftover after parsing attributes in process `syz.1.7694'. [ 1009.631344][ C0] ip6_tunnel: ip6gre1 xmit: Local address not yet configured! [ 1010.809181][ T2361] ip_tables: iptables: counters copy to user failed while replacing table [ 1011.116103][ T2370] bridge0: port 1(bridge_slave_0) entered disabled state [ 1011.220476][ T2370] bridge_slave_0 (unregistering): left allmulticast mode [ 1011.255674][ T2370] bridge_slave_0 (unregistering): left promiscuous mode [ 1011.281641][ T2370] bridge0: port 1(bridge_slave_0) entered disabled state [ 1011.315390][ T2373] netlink: 4 bytes leftover after parsing attributes in process `syz.0.7700'. [ 1011.643352][ T2380] openvswitch: netlink: Tunnel attr 4097 out of range max 16 [ 1012.033074][ T2391] netlink: 100 bytes leftover after parsing attributes in process `syz.2.7706'. [ 1012.080414][ T2391] netlink: 'syz.2.7706': attribute type 10 has an invalid length. [ 1012.245360][ T2401] netlink: 28 bytes leftover after parsing attributes in process `syz.3.7708'. [ 1014.143516][ T2437] netlink: 20 bytes leftover after parsing attributes in process `syz.1.7718'. [ 1014.602969][ T2454] netlink: 12 bytes leftover after parsing attributes in process `syz.1.7722'. [ 1015.899022][ T2494] netlink: 'syz.0.7729': attribute type 1 has an invalid length. [ 1016.637279][ T2494] workqueue: Failed to create a rescuer kthread for wq "bond5": -EINTR [ 1017.550290][ T2544] netlink: 28 bytes leftover after parsing attributes in process `syz.4.7742'. [ 1017.629466][ T2547] netlink: 4 bytes leftover after parsing attributes in process `syz.1.7743'. [ 1017.647679][ T2544] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 1017.647787][ T2549] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 1017.669646][ T2547] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 1017.768025][ T2559] netlink: 12 bytes leftover after parsing attributes in process `syz.2.7745'. [ 1017.882698][ T2559] netlink: 8 bytes leftover after parsing attributes in process `syz.2.7745'. [ 1017.917892][ T2547] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 1018.475700][ T2572] netlink: 8 bytes leftover after parsing attributes in process `syz.2.7748'. [ 1018.817943][ T2578] netlink: 76 bytes leftover after parsing attributes in process `syz.4.7751'. [ 1020.514521][ T2631] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 1021.046822][ T2598] netlink: 24 bytes leftover after parsing attributes in process `syz.4.7756'. [ 1021.120392][ T2598] netlink: 48 bytes leftover after parsing attributes in process `syz.4.7756'. [ 1021.681674][ T2662] syzkaller0: entered promiscuous mode [ 1021.695453][ T2662] syzkaller0: entered allmulticast mode [ 1022.095459][ T2669] netlink: 8 bytes leftover after parsing attributes in process `syz.4.7777'. [ 1024.000975][ T2726] netlink: 24 bytes leftover after parsing attributes in process `syz.3.7787'. [ 1024.015671][ T2732] netlink: 76 bytes leftover after parsing attributes in process `syz.4.7789'. [ 1024.049037][ T2732] netlink: 8 bytes leftover after parsing attributes in process `syz.4.7789'. [ 1024.066864][ T2735] netlink: 12 bytes leftover after parsing attributes in process `syz.3.7787'. [ 1024.078665][ T2732] netlink: 86 bytes leftover after parsing attributes in process `syz.4.7789'. [ 1024.090855][ T2732] netlink: 4956 bytes leftover after parsing attributes in process `syz.4.7789'. [ 1024.433150][ T2712] vlan0: left promiscuous mode [ 1024.475137][ T2712] macvlan0: left promiscuous mode [ 1024.662871][ T2712] mac80211_hwsim hwsim49 wlan0: left promiscuous mode [ 1024.698139][ T2739] netlink: 8 bytes leftover after parsing attributes in process `syz.4.7791'. [ 1024.765301][ T2712] 8021q: adding VLAN 0 to HW filter on device bond1 [ 1024.812698][ T2712] 8021q: adding VLAN 0 to HW filter on device bond2 [ 1024.830109][ T2712] bridge1: left promiscuous mode [ 1024.838786][ T2712] bridge2: left promiscuous mode [ 1024.878579][ T2712] geneve2: left promiscuous mode [ 1024.953273][ T2712] 8021q: adding VLAN 0 to HW filter on device bond5 [ 1024.971951][ T2712] gretap1: left promiscuous mode [ 1025.008108][ T2712] 8021q: adding VLAN 0 to HW filter on device bond6 [ 1025.044833][ T2712] 8021q: adding VLAN 0 to HW filter on device bond7 [ 1025.378386][ T2739] ip6gre0 speed is unknown, defaulting to 1000 [ 1025.398474][ T48] ip6_tunnel:  xmit: Local address not yet configured! [ 1025.558631][ T2752] netlink: 12 bytes leftover after parsing attributes in process `syz.3.7793'. [ 1026.058386][ T2770] netlink: 'syz.0.7799': attribute type 1 has an invalid length. [ 1026.292715][ T2769] netlink: 144 bytes leftover after parsing attributes in process `syz.3.7798'. [ 1026.915221][ T2791] bridge4: the hash_elasticity option has been deprecated and is always 16 [ 1026.941068][ T2797] ipt_ECN: cannot use operation on non-tcp rule [ 1027.170786][ T2802] netlink: 'syz.3.7808': attribute type 30 has an invalid length. [ 1027.189719][ T2806] netlink: 8 bytes leftover after parsing attributes in process `syz.1.7809'. [ 1027.636741][ T2813] netlink: 'syz.4.7810': attribute type 64 has an invalid length. [ 1027.739238][ T2802] bond5: option arp_missed_max: invalid value (0) [ 1027.770827][ T2802] bond5: option arp_missed_max: allowed values 1 - 255 [ 1027.824157][ T2802] bond5 (unregistering): Released all slaves [ 1028.885301][ T2869] netlink: 'syz.0.7820': attribute type 1 has an invalid length. [ 1029.124517][ T2879] netlink: 'syz.4.7821': attribute type 12 has an invalid length. [ 1029.170451][ T2879] __nla_validate_parse: 4 callbacks suppressed [ 1029.170474][ T2879] netlink: 4 bytes leftover after parsing attributes in process `syz.4.7821'. [ 1029.287264][ T2879] netlink: 'syz.4.7821': attribute type 12 has an invalid length. [ 1029.313295][ T2879] netlink: 4 bytes leftover after parsing attributes in process `syz.4.7821'. [ 1029.598012][ T2886] ip_tables: iptables: counters copy to user failed while replacing table [ 1029.657895][ T2887] netlink: 20 bytes leftover after parsing attributes in process `syz.1.7824'. [ 1029.701415][ C0] ip6_tunnel:  xmit: Local address not yet configured! [ 1029.763742][ T2890] netlink: 4 bytes leftover after parsing attributes in process `syz.3.7826'. [ 1029.826246][ T2898] gre0: left promiscuous mode [ 1029.834629][ T2899] netlink: 12 bytes leftover after parsing attributes in process `syz.4.7828'. [ 1029.877342][ T2900] netlink: 12 bytes leftover after parsing attributes in process `syz.1.7824'. [ 1030.036004][ T2898] bond0: left promiscuous mode [ 1030.045275][ T2898] bond_slave_0: left promiscuous mode [ 1030.054954][ T2898] : left promiscuous mode [ 1030.299414][ T2898] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 1030.374641][ T2898] 8021q: adding VLAN 0 to HW filter on device bond1 [ 1030.389576][ T2898] A link change request failed with some changes committed already. Interface batadv1 may have been left with an inconsistent configuration, please check. [ 1030.514262][ T7780] bridge0: port 2(bridge_slave_1) entered blocking state [ 1030.521513][ T7780] bridge0: port 2(bridge_slave_1) entered listening state [ 1031.076179][ T2912] netlink: 8 bytes leftover after parsing attributes in process `syz.0.7831'. [ 1031.180254][ T2930] netlink: 'syz.0.7831': attribute type 16 has an invalid length. [ 1031.483190][ T2916] netlink: 48 bytes leftover after parsing attributes in process `syz.2.7833'. [ 1031.681417][ T2942] block nbd4: server does not support multiple connections per device. [ 1031.800593][ T2942] block nbd4: shutting down sockets [ 1031.937461][ T2946] netlink: 8 bytes leftover after parsing attributes in process `syz.1.7839'. [ 1031.996161][ T2946] netlink: 'syz.1.7839': attribute type 4 has an invalid length. [ 1032.089909][ T2946] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 1032.115181][ T2951] netlink: 24 bytes leftover after parsing attributes in process `syz.2.7841'. [ 1032.977267][ T2982] C: renamed from lo (while UP) [ 1033.098322][ T2982] A link change request failed with some changes committed already. Interface C may have been left with an inconsistent configuration, please check. [ 1034.512179][ T2999] __nla_validate_parse: 1 callbacks suppressed [ 1034.512215][ T2999] netlink: 8 bytes leftover after parsing attributes in process `syz.3.7854'. [ 1034.646081][ T2997] tls_set_device_offload: netdev not found [ 1034.664388][ T2999] netlink: 24 bytes leftover after parsing attributes in process `syz.3.7854'. [ 1034.748518][ T3005] netlink: 'syz.3.7854': attribute type 1 has an invalid length. [ 1035.199551][ T3012] netlink: 28 bytes leftover after parsing attributes in process `syz.1.7858'. [ 1035.245900][ T3012] netlink: 28 bytes leftover after parsing attributes in process `syz.1.7858'. [ 1035.309774][ T3012] netlink: 'syz.1.7858': attribute type 1 has an invalid length. [ 1035.589365][ T3024] atomic_op ffff88807cc28998 conn xmit_atomic 0000000000000000 [ 1035.652847][ T3022] bond6: option all_slaves_active: invalid value (222) [ 1035.678854][ T3022] bond6 (unregistering): Released all slaves [ 1036.056162][ T3040] netlink: 'syz.2.7864': attribute type 10 has an invalid length. [ 1036.459338][ T3040] bond0: (slave veth0_to_bond): Enslaving as an active interface with an up link [ 1037.454246][ T3061] 8021q: adding VLAN 0 to HW filter on device ipvlan2 [ 1037.464621][ T3061] bond0: (slave ipvlan2): enslaved VLAN challenged slave. Adding VLANs will be blocked as long as it is part of bond. [ 1038.070458][ T3090] netlink: 8 bytes leftover after parsing attributes in process `syz.1.7877'. [ 1038.197251][ T3086] bond5: option tlb_dynamic_lb: mode dependency failed, not supported in mode balance-rr(0) [ 1038.314390][ T3086] bond5 (unregistering): Released all slaves [ 1038.422656][ C0] ip6_tunnel:  xmit: Local address not yet configured! [ 1038.444854][ T3104] ip_tables: iptables: counters copy to user failed while replacing table [ 1038.789500][ T3110] netlink: 'syz.0.7883': attribute type 21 has an invalid length. [ 1038.868376][ T3110] netlink: 156 bytes leftover after parsing attributes in process `syz.0.7883'. [ 1038.905999][ T3114] netlink: 36 bytes leftover after parsing attributes in process `syz.3.7886'. [ 1038.984379][ T3114] netlink: 4 bytes leftover after parsing attributes in process `syz.3.7886'. [ 1039.099779][ T3114] RDS: rds_bind could not find a transport for fe80::, load rds_tcp or rds_rdma? [ 1039.819339][ T3142] netlink: 12 bytes leftover after parsing attributes in process `syz.2.7893'. [ 1040.057498][ T3149] netlink: 8 bytes leftover after parsing attributes in process `syz.0.7897'. [ 1040.147327][ T3155] netlink: 8 bytes leftover after parsing attributes in process `syz.0.7897'. [ 1040.419068][ T3162] gretap0: entered promiscuous mode [ 1040.513064][ T3164] netlink: 8 bytes leftover after parsing attributes in process `syz.2.7898'. [ 1040.605276][ T3164] gretap0: left promiscuous mode [ 1040.999948][ T3179] ip_tables: iptables: counters copy to user failed while replacing table [ 1041.079514][ T12] netdevsim netdevsim2 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 1041.126170][ T12] netdevsim netdevsim2 netdevsim0: unset [1, 1] type 2 family 0 port 256 - 0 [ 1041.894471][ T3197] netlink: 8 bytes leftover after parsing attributes in process `syz.0.7906'. [ 1041.966532][ T3196] bridge0: port 1(ipvlan2) entered blocking state [ 1041.982672][ T3196] bridge0: port 1(ipvlan2) entered disabled state [ 1042.036376][ T3196] ipvlan2: entered allmulticast mode [ 1042.071243][ T3196] ipvlan2: left allmulticast mode [ 1042.379108][ T3214] netlink: 40 bytes leftover after parsing attributes in process `syz.1.7909'. [ 1042.522872][ T3216] netlink: 8 bytes leftover after parsing attributes in process `syz.4.7910'. [ 1042.713016][ T3226] netlink: 12 bytes leftover after parsing attributes in process `syz.2.7912'. [ 1042.942502][ T3230] netlink: 'syz.0.7914': attribute type 1 has an invalid length. [ 1044.353913][ T3276] netlink: 'syz.0.7926': attribute type 21 has an invalid length. [ 1044.367272][ T3276] netlink: 'syz.0.7926': attribute type 21 has an invalid length. [ 1044.377472][ T3276] netlink: 'syz.0.7926': attribute type 21 has an invalid length. [ 1044.388055][ T3276] netlink: 'syz.0.7926': attribute type 21 has an invalid length. [ 1044.398658][ T3276] netlink: 'syz.0.7926': attribute type 21 has an invalid length. [ 1044.410141][ T3276] netlink: 'syz.0.7926': attribute type 21 has an invalid length. [ 1044.419492][ T3276] netlink: 'syz.0.7926': attribute type 21 has an invalid length. [ 1044.429281][ T3276] netlink: 'syz.0.7926': attribute type 21 has an invalid length. [ 1044.439492][ T3276] netlink: 'syz.0.7926': attribute type 21 has an invalid length. [ 1044.450303][ T3276] netlink: 'syz.0.7926': attribute type 21 has an invalid length. [ 1045.166365][ T3287] netlink: 36 bytes leftover after parsing attributes in process `syz.0.7929'. [ 1046.036111][ T3244] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 1046.102992][ C1] bridge0: port 2(bridge_slave_1) entered learning state [ 1046.905776][ T3323] netlink: 12 bytes leftover after parsing attributes in process `syz.2.7939'. [ 1046.922134][ T3316] block nbd4: Unsupported socket: should be TCP or UNIX. [ 1047.021938][ T3316] netlink: 28 bytes leftover after parsing attributes in process `syz.0.7938'. [ 1047.103394][ T3316] netlink: 28 bytes leftover after parsing attributes in process `syz.0.7938'. [ 1047.468752][ T3337] bridge0: port 1(bridge_slave_0) entered disabled state [ 1047.602160][ T3337] bridge_slave_0 (unregistering): left allmulticast mode [ 1047.637364][ T3337] bridge_slave_0 (unregistering): left promiscuous mode [ 1047.675926][ T3337] bridge0: port 1(bridge_slave_0) entered disabled state [ 1048.129313][ T3355] Bluetooth: hci0: Opcode 0x0c03 failed: -4 [ 1048.234512][ T3363] ip_tables: iptables: counters copy to user failed while replacing table [ 1049.471347][ T3398] openvswitch: netlink: Port 856954028 exceeds max allowable 65535 [ 1049.589397][ T3403] netlink: 60 bytes leftover after parsing attributes in process `syz.2.7959'. [ 1049.601170][ T3403] netlink: 24 bytes leftover after parsing attributes in process `syz.2.7959'. [ 1049.958558][ T3409] ip_tables: iptables: counters copy to user failed while replacing table [ 1049.994157][ T3409] FAULT_INJECTION: forcing a failure. [ 1049.994157][ T3409] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1050.025822][ T3409] CPU: 1 UID: 0 PID: 3409 Comm: syz.2.7962 Not tainted syzkaller #0 PREEMPT(full) [ 1050.025854][ T3409] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 1050.025869][ T3409] Call Trace: [ 1050.025878][ T3409] [ 1050.025889][ T3409] dump_stack_lvl+0xe8/0x150 [ 1050.025927][ T3409] should_fail_ex+0x40c/0x560 [ 1050.025958][ T3409] _copy_from_iter+0x1d3/0x1660 [ 1050.025986][ T3409] ? __pfx___alloc_frozen_pages_noprof+0x10/0x10 [ 1050.026022][ T3409] ? __pfx_policy_nodemask+0x10/0x10 [ 1050.026055][ T3409] ? unwind_next_frame+0x8f/0x2550 [ 1050.026078][ T3409] ? __pfx__copy_from_iter+0x10/0x10 [ 1050.026107][ T3409] ? alloc_pages_mpol+0x24a/0x380 [ 1050.026147][ T3409] copy_page_from_iter+0x219/0x2d0 [ 1050.026180][ T3409] tun_get_user+0x1bf1/0x4370 [ 1050.026223][ T3409] ? tun_get_user+0x6e7/0x4370 [ 1050.026274][ T3409] ? aa_file_perm+0x4ed/0x15f0 [ 1050.026297][ T3409] ? __pfx_tun_get_user+0x10/0x10 [ 1050.026328][ T3409] ? __lock_acquire+0x683/0x2cf0 [ 1050.026373][ T3409] ? ref_tracker_alloc+0x341/0x4b0 [ 1050.026396][ T3409] ? get_pid_task+0x20/0x1f0 [ 1050.026427][ T3409] ? __pfx_ref_tracker_alloc+0x10/0x10 [ 1050.026454][ T3409] ? tun_get+0x1c/0x2f0 [ 1050.026481][ T3409] ? tun_get+0x1c/0x2f0 [ 1050.026513][ T3409] ? tun_get+0x1c/0x2f0 [ 1050.026540][ T3409] ? tun_get+0x1c/0x2f0 [ 1050.026573][ T3409] tun_chr_write_iter+0x113/0x200 [ 1050.026602][ T3409] vfs_write+0x612/0xba0 [ 1050.026644][ T3409] ? __pfx_vfs_write+0x10/0x10 [ 1050.026688][ T3409] ? __fget_files+0x2a/0x420 [ 1050.026724][ T3409] ksys_write+0x150/0x270 [ 1050.026760][ T3409] ? __pfx_ksys_write+0x10/0x10 [ 1050.026800][ T3409] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1050.026825][ T3409] do_syscall_64+0x174/0x580 [ 1050.026854][ T3409] ? trace_irq_disable+0x3b/0x140 [ 1050.026881][ T3409] ? clear_bhb_loop+0x70/0xc0 [ 1050.026908][ T3409] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1050.026931][ T3409] RIP: 0033:0x7fd44935e90e [ 1050.026952][ T3409] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 1050.026971][ T3409] RSP: 002b:00007fd44a2b2fb8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 1050.026996][ T3409] RAX: ffffffffffffffda RBX: 00007fd44a2b36c0 RCX: 00007fd44935e90e [ 1050.027011][ T3409] RDX: 000000000000006c RSI: 0000200000000180 RDI: 00000000000000c8 [ 1050.027026][ T3409] RBP: 00007fd44a2b3090 R08: 0000000000000000 R09: 0000000000000000 [ 1050.027040][ T3409] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1050.027053][ T3409] R13: 00007fd449626038 R14: 00007fd449625fa0 R15: 00007ffc0775a898 [ 1050.027087][ T3409] [ 1050.440167][ T3368] validate_nla: 55 callbacks suppressed [ 1050.440227][ T3368] netlink: 'syz.0.7951': attribute type 4 has an invalid length. [ 1051.143923][ T3427] openvswitch: netlink: Flow key attribute not present in set flow. [ 1051.197797][ T3425] tipc: Started in network mode [ 1051.230936][ T3425] tipc: Node identity ac141441, cluster identity 4711 [ 1051.262534][ T3432] netlink: 16 bytes leftover after parsing attributes in process `syz.2.7968'. [ 1051.286222][ T3425] tipc: Enabled bearer , priority 10 [ 1051.406340][ T3438] netlink: 'syz.2.7968': attribute type 2 has an invalid length. [ 1051.436087][ T3438] netlink: 188 bytes leftover after parsing attributes in process `syz.2.7968'. [ 1051.612785][ T3440] netlink: 12 bytes leftover after parsing attributes in process `syz.3.7969'. [ 1051.710930][ T3441] netlink: 8 bytes leftover after parsing attributes in process `syz.3.7969'. [ 1051.792810][ T3441] netlink: 12 bytes leftover after parsing attributes in process `syz.3.7969'. [ 1051.825616][ T3442] netlink: 4 bytes leftover after parsing attributes in process `syz.3.7969'. [ 1052.269784][T23189] netdevsim netdevsim3 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0 [ 1052.335686][T23189] netdevsim netdevsim3 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0 [ 1052.358438][ T3458] ip_tables: iptables: counters copy to user failed while replacing table [ 1052.393908][T23189] netdevsim netdevsim3 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0 [ 1052.457367][T23189] netdevsim netdevsim3 netdevsim0: set [0, 0] type 1 family 0 port 8472 - 0 [ 1052.515154][T29679] tipc: Node number set to 2886997057 [ 1052.598272][ T3457] ip6gre0 speed is unknown, defaulting to 1000 [ 1052.638818][ T3468] netlink: 12 bytes leftover after parsing attributes in process `syz.1.7976'. [ 1052.928591][ T3477] nbd: couldn't find a device at index 3 [ 1053.349624][ T3486] netlink: 'syz.4.7981': attribute type 1 has an invalid length. [ 1053.375934][ T3486] netlink: 232 bytes leftover after parsing attributes in process `syz.4.7981'. [ 1053.447303][ T3486] netlink: 'syz.4.7981': attribute type 1 has an invalid length. [ 1055.012756][ T3524] netlink: 8 bytes leftover after parsing attributes in process `syz.2.7990'. [ 1055.809306][ T3538] nbd: couldn't find a device at index 1 [ 1056.259163][ T3548] netlink: 60 bytes leftover after parsing attributes in process `syz.1.7997'. [ 1056.298404][ T3549] netlink: 60 bytes leftover after parsing attributes in process `syz.1.7997'. [ 1056.341899][ C0] ip6_tunnel:  xmit: Local address not yet configured! [ 1057.670807][ T3581] block nbd4: not configured, cannot reconfigure [ 1057.737162][ T3585] netlink: 8 bytes leftover after parsing attributes in process `syz.0.8006'. [ 1057.802152][ T3585] netlink: 4 bytes leftover after parsing attributes in process `syz.0.8006'. [ 1057.849391][ T3586] team0: entered allmulticast mode [ 1057.883952][ T3585] netlink: 'syz.0.8006': attribute type 14 has an invalid length. [ 1057.895354][ T3586] team_slave_0: entered allmulticast mode [ 1057.928985][ T3586] team_slave_1: entered allmulticast mode [ 1057.961592][ T3586] syz_tun: entered allmulticast mode [ 1058.287599][ T3601] netlink: 'syz.1.8013': attribute type 1 has an invalid length. [ 1058.563974][ T3606] netlink: 596 bytes leftover after parsing attributes in process `syz.0.8016'. [ 1058.804510][ T3615] netlink: 8 bytes leftover after parsing attributes in process `syz.3.8018'. [ 1059.138861][ T3627] netlink: 4 bytes leftover after parsing attributes in process `syz.4.8021'. [ 1059.200316][ T3627] netlink: 'syz.4.8021': attribute type 8 has an invalid length. [ 1059.417526][ T3637] netlink: 'syz.1.8023': attribute type 21 has an invalid length. [ 1059.762078][ T3637] bond6: option lacp_rate: mode dependency failed, not supported in mode broadcast(3) [ 1059.904061][ T3637] bond6 (unregistering): Released all slaves [ 1059.908801][ T3650] netlink: 20 bytes leftover after parsing attributes in process `syz.3.8027'. [ 1059.990651][ T3639] tipc: New replicast peer: 255.255.255.255 [ 1060.046919][ T3639] tipc: Enabled bearer , priority 10 [ 1060.810667][ T3666] IPVS: set_ctl: invalid protocol: 117 172.20.20.170:20000 [ 1060.814841][ T3669] ip6t_REJECT: TCP_RESET illegal for non-tcp [ 1060.830810][ T3671] ip6t_REJECT: TCP_RESET illegal for non-tcp [ 1061.131156][T29679] tipc: Node number set to 3758096385 [ 1061.217737][ T3675] ip_tables: iptables: counters copy to user failed while replacing table [ 1061.429921][ T3681] netlink: 'syz.3.8038': attribute type 83 has an invalid length. [ 1061.460987][ C1] bridge0: port 2(bridge_slave_1) entered forwarding state [ 1061.468376][ C1] bridge0: topology change detected, propagating [ 1061.702982][ T3693] tipc: Started in network mode [ 1061.736290][ T3691] netlink: 48 bytes leftover after parsing attributes in process `syz.2.8040'. [ 1061.759620][ T3693] tipc: Node identity e0000001, cluster identity 4711 [ 1061.768995][ T3693] tipc: Enabling of bearer rejected, failed to enable media [ 1062.556483][ T3709] ip_tables: iptables: counters copy to user failed while replacing table [ 1062.668194][ T3710] netlink: 5 bytes leftover after parsing attributes in process `syz.4.8046'. [ 1062.779305][ T3719] netlink: 'syz.2.8050': attribute type 1 has an invalid length. [ 1062.890404][ T3722] netlink: 52 bytes leftover after parsing attributes in process `syz.2.8050'. [ 1063.406067][ T3735] netlink: 20 bytes leftover after parsing attributes in process `syz.0.8054'. [ 1063.509985][ T3741] Cannot find del_set index 4 as target [ 1063.584300][ T3745] netlink: 'syz.3.8056': attribute type 15 has an invalid length. [ 1063.694619][ T3747] netlink: 32 bytes leftover after parsing attributes in process `syz.0.8054'. [ 1063.819171][ T3747] netlink: 20 bytes leftover after parsing attributes in process `syz.0.8054'. [ 1063.973098][ T3760] ip_tables: iptables: counters copy to user failed while replacing table [ 1064.112423][ T3764] netlink: 4768 bytes leftover after parsing attributes in process `syz.2.8060'. [ 1064.369367][ T3769] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 1064.540325][ T3758] netlink: 'syz.1.8059': attribute type 5 has an invalid length. [ 1064.726133][ T3769] netlink: 16 bytes leftover after parsing attributes in process `syz.4.8062'. [ 1064.812827][ T3769] netlink: 16 bytes leftover after parsing attributes in process `syz.4.8062'. [ 1064.923253][T15465] bond3: (slave veth0_to_bond): link status definitely down, disabling slave [ 1064.998065][T15465] bond3: now running without any active interface! [ 1065.016700][ T2235] udevd[2235]: inotify_add_watch(7, /dev/nbd64, 10) failed: No such file or directory [ 1065.085180][ T2005] udevd[2005]: inotify_add_watch(7, /dev/nbd64, 10) failed: No such file or directory [ 1066.246843][ T3808] netlink: 4 bytes leftover after parsing attributes in process `syz.2.8073'. [ 1066.276060][ T3805] ip_tables: iptables: counters copy to user failed while replacing table [ 1066.832395][ T3826] netlink: 8 bytes leftover after parsing attributes in process `syz.1.8078'. [ 1066.946046][ T3830] netlink: 12 bytes leftover after parsing attributes in process `syz.2.8080'. [ 1067.206044][ T3838] netlink: 104 bytes leftover after parsing attributes in process `syz.4.8082'. [ 1067.230040][ T50] Bluetooth: hci1: link tx timeout [ 1067.241137][ T50] Bluetooth: hci1: killing stalled connection 10:aa:aa:aa:aa:aa [ 1067.258815][ T50] Bluetooth: hci1: link tx timeout [ 1067.265871][ T50] Bluetooth: hci1: killing stalled connection 11:aa:aa:aa:aa:aa [ 1068.493240][ T3858] ip_tables: iptables: counters copy to user failed while replacing table [ 1069.000948][ T3872] netlink: 420 bytes leftover after parsing attributes in process `syz.4.8093'. [ 1069.078946][ T3875] netlink: 'syz.3.8094': attribute type 1 has an invalid length. [ 1069.133247][ T3876] netlink: 28 bytes leftover after parsing attributes in process `syz.3.8094'. [ 1069.202912][ T3880] netlink: 28 bytes leftover after parsing attributes in process `syz.3.8094'. [ 1069.301920][ T50] Bluetooth: hci1: command 0x0406 tx timeout [ 1070.255344][ T3894] netlink: 8 bytes leftover after parsing attributes in process `syz.0.8099'. [ 1070.289370][ T3894] netlink: 4 bytes leftover after parsing attributes in process `syz.0.8099'. [ 1071.381054][ T50] Bluetooth: hci1: command 0x0406 tx timeout [ 1071.467323][ T3919] bridge0: port 1(bridge_slave_0) entered disabled state [ 1071.586772][ T3919] bridge0: port 2(bridge_slave_1) entered disabled state [ 1072.010990][ T3933] ipt_ECN: cannot use operation on non-tcp rule [ 1072.771792][ T3943] netlink: 'syz.1.8115': attribute type 10 has an invalid length. [ 1072.794883][ T3943] netlink: 4 bytes leftover after parsing attributes in process `syz.1.8115'. [ 1072.862193][ T3946] netlink: NAT attribute has 5 unknown bytes [ 1072.888229][ T3946] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 1072.978308][ T3943] gre1: entered promiscuous mode [ 1073.099154][ T3951] ¾x9ÿ: renamed from bridge_slave_0 (while UP) [ 1073.835146][ T3957] bond6: option arp_validate: mode dependency failed, not supported in mode 802.3ad(4) [ 1073.895617][ T3962] xt_CT: You must specify a L4 protocol and not use inversions on it [ 1073.906127][ T3957] bond6 (unregistering): Released all slaves [ 1074.210841][ T3962] syzkaller0: entered promiscuous mode [ 1074.245053][ T3962] syzkaller0: entered allmulticast mode [ 1074.315146][ T3962] tipc: Enabled bearer , priority 0 [ 1074.490428][ T3971] syzkaller0: entered allmulticast mode [ 1074.591666][ T3962] geneve2: entered promiscuous mode [ 1075.065431][ T3961] tipc: Resetting bearer [ 1075.216676][ T3961] tipc: Disabling bearer [ 1075.583676][ T4008] xt_TPROXY: Can be used only with -p tcp or -p udp [ 1075.775409][ T4011] netlink: 8 bytes leftover after parsing attributes in process `syz.4.8132'. [ 1076.472350][ T4030] netlink: 8 bytes leftover after parsing attributes in process `syz.0.8137'. [ 1076.562170][ T4030] netlink: 4 bytes leftover after parsing attributes in process `syz.0.8137'. [ 1076.596610][ T4030] openvswitch: netlink: Flow key attribute not present in set flow. [ 1076.675119][ T4030] nbd: must specify an index to disconnect [ 1076.827057][ T4019] syzkaller1: entered promiscuous mode [ 1076.873763][ T4019] syzkaller1: entered allmulticast mode [ 1077.482585][ T4052] ip_tables: iptables: counters copy to user failed while replacing table [ 1077.589690][ T4055] erspan0: entered promiscuous mode [ 1077.615556][ T4055] erspan0: entered allmulticast mode [ 1077.848317][ T4074] netlink: 12 bytes leftover after parsing attributes in process `syz.4.8143'. [ 1078.004755][ T4052] syzkaller0: entered promiscuous mode [ 1078.067403][ T4052] syzkaller0: entered allmulticast mode [ 1079.529507][ T4098] openvswitch: netlink: Missing key (keys=c0, expected=1100) [ 1079.620719][ T4096] IPVS: set_ctl: invalid protocol: 47 172.30.0.3:20002 [ 1079.715137][ T4102] netlink: 240 bytes leftover after parsing attributes in process `syz.4.8153'. [ 1079.844752][ T4102] tun0: tun_chr_ioctl cmd 1074025675 [ 1079.867288][ T4102] tun0: persist disabled [ 1080.025073][ C0] ip6_tunnel: ip6gre1 xmit: Local address not yet configured! [ 1080.257904][ T4120] netlink: 24 bytes leftover after parsing attributes in process `syz.3.8157'. [ 1081.163266][ T4157] ip_tables: iptables: counters copy to user failed while replacing table [ 1081.644704][ T4168] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 1081.697988][ T7782] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1081.739857][ T7782] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1081.876527][ T4172] netlink: 232 bytes leftover after parsing attributes in process `syz.4.8171'. [ 1082.925159][ T4204] nbd: socks must be embedded in a SOCK_ITEM attr [ 1083.066266][ T4210] ip_tables: iptables: counters copy to user failed while replacing table [ 1083.434369][ T4218] netlink: 4595 bytes leftover after parsing attributes in process `syz.4.8186'. [ 1083.473607][ T4218] netlink: 4595 bytes leftover after parsing attributes in process `syz.4.8186'. [ 1083.494237][ T4219] netlink: 20 bytes leftover after parsing attributes in process `syz.4.8186'. [ 1083.526143][ T4219] openvswitch: netlink: Missing key (keys=c0, expected=1100) [ 1083.608524][ T4228] netlink: 60 bytes leftover after parsing attributes in process `syz.0.8187'. [ 1083.629807][ T4227] netlink: 32 bytes leftover after parsing attributes in process `syz.2.8188'. [ 1083.685423][ T4228] netlink: 'syz.0.8187': attribute type 20 has an invalid length. [ 1083.707284][ T4230] netlink: 16 bytes leftover after parsing attributes in process `syz.2.8188'. [ 1083.741891][ T4228] IPv6: NLM_F_CREATE should be specified when creating new route [ 1083.972682][ T4228] netlink: 16 bytes leftover after parsing attributes in process `syz.0.8187'. [ 1084.015817][ T4228] netlink: 8 bytes leftover after parsing attributes in process `syz.0.8187'. [ 1084.077917][ T4229] netlink: 4 bytes leftover after parsing attributes in process `syz.0.8187'. [ 1084.399206][ T4253] netlink: 'syz.4.8193': attribute type 11 has an invalid length. [ 1084.425379][ T4253] netlink: 64 bytes leftover after parsing attributes in process `syz.4.8193'. [ 1084.862981][ T4260] netlink: 'syz.3.8195': attribute type 3 has an invalid length. [ 1085.235505][ T4279] netlink: 'syz.2.8200': attribute type 7 has an invalid length. [ 1085.622980][ T50] Bluetooth: hci1: command 0x0406 tx timeout [ 1086.059870][ T4296] netlink: 'syz.0.8205': attribute type 15 has an invalid length. [ 1086.211972][ T7782] netdevsim netdevsim0 netdevsim3: set [0, 1] type 1 family 0 port 256 - 0 [ 1086.235789][ T4297] nbd: socks must be embedded in a SOCK_ITEM attr [ 1086.244956][ T4296] netlink: 'syz.0.8205': attribute type 15 has an invalid length. [ 1086.269495][ T7782] netdevsim netdevsim0 netdevsim2: set [0, 1] type 1 family 0 port 256 - 0 [ 1086.347145][T23189] netdevsim netdevsim0 netdevsim0: set [0, 1] type 1 family 0 port 256 - 0 [ 1086.384489][T23189] netdevsim netdevsim0 netdevsim1: set [0, 1] type 1 family 0 port 256 - 0 [ 1086.923543][ T4314] ip_tables: iptables: counters copy to user failed while replacing table [ 1087.241879][ T4322] netlink: 'syz.1.8214': attribute type 4 has an invalid length. [ 1087.527775][ T4331] ip_tables: iptables: counters copy to user failed while replacing table [ 1087.627294][ T4323] syzkaller1: entered promiscuous mode [ 1087.657562][ T4323] syzkaller1: entered allmulticast mode [ 1087.871398][ T4337] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 1088.588396][ T4360] __nla_validate_parse: 7 callbacks suppressed [ 1088.588453][ T4360] netlink: 44 bytes leftover after parsing attributes in process `syz.0.8223'. [ 1088.656594][ T4360] netlink: 'syz.0.8223': attribute type 4 has an invalid length. [ 1088.906032][ T4369] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 1090.264911][ C0] ip6_tunnel:  xmit: Local address not yet configured! [ 1090.827168][ T4401] netlink: 44 bytes leftover after parsing attributes in process `syz.1.8234'. [ 1090.918264][ T4405] netlink: 104 bytes leftover after parsing attributes in process `syz.3.8236'. [ 1091.933795][ T4421] syzkaller0: entered allmulticast mode [ 1092.404631][ T4430] netlink: 12 bytes leftover after parsing attributes in process `syz.3.8241'. [ 1092.645567][ T4445] netlink: 4 bytes leftover after parsing attributes in process `syz.4.8243'. [ 1092.916722][ T4445] macsec1: entered promiscuous mode [ 1092.970750][ T4445] bridge0: entered promiscuous mode [ 1093.048679][ T4445] macsec1: entered allmulticast mode [ 1093.091119][ T4445] bridge0: entered allmulticast mode [ 1093.117457][ T4445] bridge0: port 3(macsec1) entered blocking state [ 1093.244385][ T4445] bridge0: port 3(macsec1) entered disabled state [ 1093.483290][ T4445] bridge0: left allmulticast mode [ 1093.529149][ T4445] bridge0: left promiscuous mode [ 1093.673926][ T4459] netlink: 20 bytes leftover after parsing attributes in process `syz.1.8246'. [ 1093.814954][ T4462] netlink: 28 bytes leftover after parsing attributes in process `syz.2.8247'. [ 1095.121266][ T4496] syzkaller0: entered allmulticast mode [ 1095.134062][ T4493] SET target dimension over the limit! [ 1095.311252][ T4492] ICMPv6: RA: ndisc_router_discovery failed to add default route [ 1095.320336][ T4492] ICMPv6: RA: ndisc_router_discovery failed to add default route [ 1095.329054][ T4492] ICMPv6: RA: ndisc_router_discovery failed to add default route [ 1095.337939][ T4492] ICMPv6: RA: ndisc_router_discovery failed to add default route [ 1095.346828][ T4492] ICMPv6: RA: ndisc_router_discovery failed to add default route [ 1095.357561][ T4492] ICMPv6: RA: ndisc_router_discovery failed to add default route [ 1095.366715][ T4492] ICMPv6: RA: ndisc_router_discovery failed to add default route [ 1095.375845][ T4492] ICMPv6: RA: ndisc_router_discovery failed to add default route [ 1095.384917][ T4492] ICMPv6: RA: ndisc_router_discovery failed to add default route [ 1095.394061][ T4492] ICMPv6: RA: ndisc_router_discovery failed to add default route [ 1096.361572][ T4520] netlink: 4 bytes leftover after parsing attributes in process `syz.0.8260'. [ 1096.468958][ T4521] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 1096.522338][ T4521] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 1096.576409][ T4521] batman_adv: batadv0: Interface deactivated: dummy0 [ 1096.598832][ T4521] batman_adv: batadv0: Removing interface: dummy0 [ 1097.225994][ T4536] netlink: 4 bytes leftover after parsing attributes in process `syz.3.8267'. [ 1097.428603][ T4547] netlink: 4 bytes leftover after parsing attributes in process `syz.4.8271'. [ 1097.456152][ T4548] netlink: 4 bytes leftover after parsing attributes in process `syz.1.8270'. [ 1097.649205][ T4554] syzkaller0: entered allmulticast mode [ 1098.636080][ T4581] netlink: 4 bytes leftover after parsing attributes in process `syz.0.8283'. [ 1098.925285][ T4594] netlink: 256 bytes leftover after parsing attributes in process `syz.3.8285'. [ 1099.682837][ T4605] syzkaller0: entered allmulticast mode [ 1099.907254][ T4608] netlink: 28 bytes leftover after parsing attributes in process `syz.1.8290'. [ 1101.277046][ T4640] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 1101.305094][ T4640] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 1101.882908][ T4646] veth3: entered allmulticast mode [ 1102.330069][ T4658] netlink: 216 bytes leftover after parsing attributes in process `syz.3.8305'. [ 1102.364179][ T4658] netlink: 8 bytes leftover after parsing attributes in process `syz.3.8305'. [ 1102.399149][ T4661] netlink: 8 bytes leftover after parsing attributes in process `syz.4.8307'. [ 1102.479871][ T4662] syzkaller0: entered allmulticast mode [ 1102.636689][ T4669] sctp: [Deprecated]: syz.2.8308 (pid 4669) Use of struct sctp_assoc_value in delayed_ack socket option. [ 1102.636689][ T4669] Use struct sctp_sack_info instead [ 1103.164313][ T4682] IPVS: length: 145 != 24 [ 1103.230929][ T4686] netlink: 'syz.0.8314': attribute type 22 has an invalid length. [ 1103.267661][ T4687] netlink: 36 bytes leftover after parsing attributes in process `syz.1.8315'. [ 1103.291199][ T4686] netlink: 8 bytes leftover after parsing attributes in process `syz.0.8314'. [ 1103.369575][ T4683] netlink: 16 bytes leftover after parsing attributes in process `syz.4.8313'. [ 1103.398035][ T4694] net_ratelimit: 49 callbacks suppressed [ 1103.398073][ T4694] openvswitch: netlink: Tunnel attr 68 out of range max 16 [ 1104.709297][ T4725] syzkaller0: entered allmulticast mode [ 1105.038707][ T4735] netlink: 12 bytes leftover after parsing attributes in process `syz.3.8326'. [ 1105.107769][ T4738] netlink: 8 bytes leftover after parsing attributes in process `syz.3.8326'. [ 1105.972728][ T4758] netlink: 20 bytes leftover after parsing attributes in process `syz.3.8331'. [ 1106.976449][ T4785] syzkaller0: entered allmulticast mode [ 1107.003243][ T4795] netlink: 16 bytes leftover after parsing attributes in process `syz.0.8341'. [ 1107.238831][ T4802] netlink: 40 bytes leftover after parsing attributes in process `syz.2.8342'. [ 1107.411234][ T4801] mac80211_hwsim hwsim49 wlan0: entered allmulticast mode [ 1107.564516][ T4807] netlink: 4 bytes leftover after parsing attributes in process `syz.1.8344'. [ 1107.583525][ T4810] netlink: 8 bytes leftover after parsing attributes in process `syz.0.8343'. [ 1108.070283][ T4822] bridge: RTM_NEWNEIGH with invalid state 0x20 [ 1108.090061][ T4821] bridge: RTM_NEWNEIGH with invalid state 0x20 [ 1108.127162][ T4821] syzkaller0: entered promiscuous mode [ 1108.173593][ T4821] syzkaller0: entered allmulticast mode [ 1109.102026][ T4848] netlink: 'syz.0.8353': attribute type 2 has an invalid length. [ 1109.270272][ T4850] syzkaller0: entered allmulticast mode [ 1110.714329][ T4892] netlink: 16 bytes leftover after parsing attributes in process `syz.2.8363'. [ 1110.879914][ T4892] netlink: 16 bytes leftover after parsing attributes in process `syz.2.8363'. [ 1111.375853][ T4899] netlink: 4 bytes leftover after parsing attributes in process `syz.0.8365'. [ 1111.450068][ T4904] netlink: 8 bytes leftover after parsing attributes in process `syz.3.8367'. [ 1112.175594][ T4918] netlink: 256 bytes leftover after parsing attributes in process `syz.0.8365'. [ 1112.264890][ T4914] openvswitch: netlink: Missing key (keys=40, expected=10000000) [ 1112.603185][ T4925] netlink: 'syz.3.8370': attribute type 24 has an invalid length. [ 1112.837852][ T4933] tipc: Failed to remove unknown binding: 66,0,0/3758096385:972781472/972781474 [ 1112.851631][ T4933] tipc: Failed to remove unknown binding: 66,0,0/3758096385:972781472/972781473 [ 1112.943747][ T4935] tipc: Failed to remove unknown binding: 66,0,0/3758096385:972781472/972781474 [ 1113.006350][ T4938] syzkaller0: entered allmulticast mode [ 1113.020518][ T4935] tipc: Failed to remove unknown binding: 66,0,0/3758096385:972781472/972781473 [ 1113.599684][ T4956] A link change request failed with some changes committed already. Interface gre3 may have been left with an inconsistent configuration, please check. [ 1113.663032][ T4964] veth1_macvtap: left promiscuous mode [ 1114.761472][ T4998] syzkaller1: default qdisc (pfifo_fast) fail, fallback to noqueue [ 1115.016525][ T5009] netlink: 'syz.4.8388': attribute type 19 has an invalid length. [ 1115.164441][ T5012] netlink: 12 bytes leftover after parsing attributes in process `syz.1.8389'. [ 1115.285185][ T5012] netlink: 104 bytes leftover after parsing attributes in process `syz.1.8389'. [ 1115.494094][ T5017] syzkaller0: entered allmulticast mode [ 1115.915768][ T5034] netlink: 60 bytes leftover after parsing attributes in process `syz.0.8397'. [ 1116.238787][ T5048] netlink: 64 bytes leftover after parsing attributes in process `syz.1.8398'. [ 1116.321049][ T5052] netlink: 28 bytes leftover after parsing attributes in process `syz.2.8400'. [ 1116.336774][ T5048] netdevsim netdevsim1: Direct firmware load for ./file0 failed with error -2 [ 1116.348644][ T5048] netdevsim netdevsim1: Falling back to sysfs fallback for: ./file0 [ 1116.464162][ T5043] bond7: entered promiscuous mode [ 1116.510174][ T5043] bond7: entered allmulticast mode [ 1116.545296][ T5043] 8021q: adding VLAN 0 to HW filter on device bond7 [ 1116.637528][ T5052] netlink: 'syz.2.8400': attribute type 1 has an invalid length. [ 1116.667569][ T5052] netlink: 224 bytes leftover after parsing attributes in process `syz.2.8400'. [ 1116.703904][ T5057] sctp: [Deprecated]: syz.3.8401 (pid 5057) Use of struct sctp_assoc_value in delayed_ack socket option. [ 1116.703904][ T5057] Use struct sctp_sack_info instead [ 1117.216527][ T5069] netlink: 4 bytes leftover after parsing attributes in process `syz.4.8402'. [ 1117.948560][ T5083] netlink: 12 bytes leftover after parsing attributes in process `syz.1.8407'. [ 1118.411856][ T5091] syzkaller0: entered allmulticast mode [ 1118.470239][ T5097] netlink: 'syz.3.8411': attribute type 1 has an invalid length. [ 1118.575398][ T5103] netlink: 20 bytes leftover after parsing attributes in process `syz.2.8413'. [ 1119.122000][ T5116] netlink: 24 bytes leftover after parsing attributes in process `syz.2.8418'. [ 1119.234347][ T5122] netlink: 8 bytes leftover after parsing attributes in process `syz.1.8417'. [ 1119.290031][ T5116] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 1119.328378][ T5122] netlink: 'syz.1.8417': attribute type 5 has an invalid length. [ 1119.409068][ T5122] netlink: 20 bytes leftover after parsing attributes in process `syz.1.8417'. [ 1119.644312][ T5122] geneve3: entered promiscuous mode [ 1119.669832][ T5122] geneve3: entered allmulticast mode [ 1119.714322][ T5129] IPv6: NLM_F_CREATE should be specified when creating new route [ 1119.754649][ T7782] netdevsim netdevsim1 netdevsim0: set [1, 2] type 2 family 0 port 256 - 0 [ 1119.774658][ T7782] netdevsim netdevsim1 netdevsim1: set [1, 2] type 2 family 0 port 256 - 0 [ 1119.810274][ T7782] netdevsim netdevsim1 netdevsim2: set [1, 2] type 2 family 0 port 256 - 0 [ 1119.848931][ T7782] netdevsim netdevsim1 netdevsim3: set [1, 2] type 2 family 0 port 256 - 0 [ 1120.281529][ T5139] xt_hashlimit: size too large, truncated to 1048576 [ 1120.315728][ T5139] xt_hashlimit: max too large, truncated to 1048576 [ 1120.328331][ T5139] xt_hashlimit: invalid rate [ 1120.436696][ T5152] netlink: 'syz.0.8428': attribute type 3 has an invalid length. [ 1120.481306][T18887] IPVS: starting estimator thread 0... [ 1120.899970][ T5156] netlink: 'syz.2.8427': attribute type 2 has an invalid length. [ 1120.951190][ T5156] __nla_validate_parse: 3 callbacks suppressed [ 1120.951210][ T5156] netlink: 244 bytes leftover after parsing attributes in process `syz.2.8427'. [ 1120.996401][ T5153] IPVS: using max 28 ests per chain, 67200 per kthread [ 1121.117091][ T5164] syzkaller0: entered allmulticast mode [ 1121.484062][ T5168] netlink: 'syz.3.8431': attribute type 21 has an invalid length. [ 1121.531608][ T5168] netlink: 156 bytes leftover after parsing attributes in process `syz.3.8431'. [ 1122.539456][ T5187] netlink: 4 bytes leftover after parsing attributes in process `syz.1.8439'. [ 1122.605258][ T5199] netlink: 32 bytes leftover after parsing attributes in process `syz.2.8440'. [ 1122.778590][ T5205] bridge0: port 3(veth1_to_bridge) entered blocking state [ 1122.813605][ T5205] bridge0: port 3(veth1_to_bridge) entered disabled state [ 1122.825654][ T5206] netlink: 8 bytes leftover after parsing attributes in process `syz.3.8443'. [ 1122.856408][ T5205] veth1_to_bridge: entered allmulticast mode [ 1122.874183][ T5205] veth1_to_bridge: entered promiscuous mode [ 1122.900775][ T5207] netlink: NAT attribute has 5 unknown bytes [ 1122.934572][ T5207] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 1123.208090][ T5211] netlink: 12 bytes leftover after parsing attributes in process `syz.2.8440'. [ 1123.290181][ T5211] netlink: 56 bytes leftover after parsing attributes in process `syz.2.8440'. [ 1123.409780][ T5211] netlink: 8 bytes leftover after parsing attributes in process `syz.2.8440'. [ 1123.899234][ T5230] netlink: 8 bytes leftover after parsing attributes in process `syz.3.8449'. [ 1124.088848][ T5244] netlink: 24 bytes leftover after parsing attributes in process `syz.1.8454'. [ 1124.558198][ T5256] netlink: 'syz.2.8456': attribute type 1 has an invalid length. [ 1124.572888][ T5256] netlink: 'syz.2.8456': attribute type 1 has an invalid length. [ 1124.631790][ T5262] netlink: 'syz.0.8459': attribute type 1 has an invalid length. [ 1126.373129][ T5298] __nla_validate_parse: 6 callbacks suppressed [ 1126.373171][ T5298] netlink: 104 bytes leftover after parsing attributes in process `syz.1.8466'. [ 1126.821019][ T5317] netlink: 'syz.4.8471': attribute type 1 has an invalid length. [ 1127.419996][ T5334] netlink: 24 bytes leftover after parsing attributes in process `syz.0.8472'. [ 1127.656459][ T5343] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 1127.713999][ T5344] netlink: 28 bytes leftover after parsing attributes in process `syz.3.8478'. [ 1127.726739][ T5346] xt_cluster: node mask cannot exceed total number of nodes [ 1127.745937][ T5346] netlink: 40 bytes leftover after parsing attributes in process `syz.2.8479'. [ 1127.947423][ T5350] netlink: 'syz.3.8480': attribute type 12 has an invalid length. [ 1128.125110][ T5350] bond7: option primary_reselect: invalid value (255) [ 1128.168128][ T5350] bond7 (unregistering): Released all slaves [ 1130.198445][ T5324] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 1130.768123][ T5375] netlink: 56 bytes leftover after parsing attributes in process `syz.4.8484'. [ 1130.912920][ T5381] syz.2.8489: vmalloc error: size 8589938688, exceeds total pages, mode:0xdc0(GFP_KERNEL|__GFP_ZERO), nodemask=(null),cpuset=/,mems_allowed=0-1 [ 1130.953299][ T5384] netlink: 'syz.1.8490': attribute type 26 has an invalid length. [ 1130.970628][ T5381] CPU: 0 UID: 0 PID: 5381 Comm: syz.2.8489 Not tainted syzkaller #0 PREEMPT(full) [ 1130.970664][ T5381] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 1130.970680][ T5381] Call Trace: [ 1130.970689][ T5381] [ 1130.970698][ T5381] dump_stack_lvl+0xe8/0x150 [ 1130.970740][ T5381] warn_alloc+0x24c/0x270 [ 1130.970773][ T5381] ? stack_depot_save_flags+0x33/0x800 [ 1130.970803][ T5381] ? __pfx_warn_alloc+0x10/0x10 [ 1130.970832][ T5381] ? kasan_save_track+0x3e/0x80 [ 1130.970856][ T5381] ? __kasan_kmalloc+0x93/0xb0 [ 1130.970885][ T5381] ? xsk_setsockopt+0x52a/0x960 [ 1130.970907][ T5381] ? do_sock_setsockopt+0x17c/0x1b0 [ 1130.970941][ T5381] ? __x64_sys_setsockopt+0x13d/0x1b0 [ 1130.970971][ T5381] ? do_syscall_64+0x174/0x580 [ 1130.970998][ T5381] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1130.971031][ T5381] __vmalloc_node_range_noprof+0x12c/0x1730 [ 1130.971089][ T5381] ? __pfx___vmalloc_node_range_noprof+0x10/0x10 [ 1130.971121][ T5381] ? __kasan_kmalloc+0x93/0xb0 [ 1130.971154][ T5381] ? __kmalloc_cache_noprof+0x32d/0x660 [ 1130.971184][ T5381] ? __kmalloc_cache_noprof+0x150/0x660 [ 1130.971215][ T5381] vmalloc_user_noprof+0xad/0xe0 [ 1130.971242][ T5381] ? xskq_create+0xbf/0x170 [ 1130.971267][ T5381] xskq_create+0xbf/0x170 [ 1130.971295][ T5381] xsk_init_queue+0x8a/0xe0 [ 1130.971321][ T5381] xsk_setsockopt+0x52a/0x960 [ 1130.971343][ T5381] ? __fget_files+0x2a/0x420 [ 1130.971373][ T5381] ? __pfx_xsk_setsockopt+0x10/0x10 [ 1130.971396][ T5381] ? __pfx_aa_sk_perm+0x10/0x10 [ 1130.971463][ T5381] ? aa_sock_opt_perm+0xff/0x1a0 [ 1130.971500][ T5381] ? bpf_lsm_socket_setsockopt+0x9/0x20 [ 1130.971524][ T5381] ? __pfx_xsk_setsockopt+0x10/0x10 [ 1130.971550][ T5381] do_sock_setsockopt+0x17c/0x1b0 [ 1130.971591][ T5381] __x64_sys_setsockopt+0x13d/0x1b0 [ 1130.971627][ T5381] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1130.971651][ T5381] do_syscall_64+0x174/0x580 [ 1130.971679][ T5381] ? clear_bhb_loop+0x70/0xc0 [ 1130.971707][ T5381] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1130.971729][ T5381] RIP: 0033:0x7fd44939e0d9 [ 1130.971750][ T5381] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1130.971770][ T5381] RSP: 002b:00007fd44a2b3028 EFLAGS: 00000246 ORIG_RAX: 0000000000000036 [ 1130.971794][ T5381] RAX: ffffffffffffffda RBX: 00007fd449625fa0 RCX: 00007fd44939e0d9 [ 1130.971811][ T5381] RDX: 0000000000000006 RSI: 000000000000011b RDI: 0000000000000003 [ 1130.971825][ T5381] RBP: 00007fd449435024 R08: 0000000000000004 R09: 0000000000000000 [ 1130.971839][ T5381] R10: 0000200000000000 R11: 0000000000000246 R12: 0000000000000000 [ 1130.971853][ T5381] R13: 00007fd449626038 R14: 00007fd449625fa0 R15: 00007ffc0775a898 [ 1130.971889][ T5381] [ 1130.983330][ T5384] netlink: 16 bytes leftover after parsing attributes in process `syz.1.8490'. [ 1131.156435][ T5381] Mem-Info: [ 1131.603064][ T5381] active_anon:5642 inactive_anon:0 isolated_anon:0 [ 1131.603064][ T5381] active_file:4 inactive_file:43674 isolated_file:0 [ 1131.603064][ T5381] unevictable:0 dirty:121 writeback:0 [ 1131.603064][ T5381] slab_reclaimable:11744 slab_unreclaimable:119888 [ 1131.603064][ T5381] mapped:29626 shmem:529 pagetables:3526 [ 1131.603064][ T5381] sec_pagetables:0 bounce:0 [ 1131.603064][ T5381] kernel_misc_reclaimable:0 [ 1131.603064][ T5381] free:1297898 free_pcp:8840 free_cma:0 [ 1131.772077][ T5381] Node 0 active_anon:22568kB inactive_anon:0kB active_file:16kB inactive_file:174504kB unevictable:0kB isolated(anon):0kB isolated(file):0kB mapped:118504kB dirty:484kB writeback:0kB shmem:2116kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB kernel_stack:14012kB pagetables:14044kB sec_pagetables:0kB all_unreclaimable? no Balloon:0kB gpu_active:0kB gpu_reclaim:0kB [ 1131.823437][ T5391] netlink: 12 bytes leftover after parsing attributes in process `syz.4.8492'. [ 1131.837429][ T5385] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 1131.886411][ T5394] ip_tables: iptables: counters copy to user failed while replacing table [ 1131.943715][ T5381] Node 1 active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:192kB unevictable:0kB isolated(anon):0kB isolated(file):0kB mapped:0kB dirty:0kB writeback:0kB shmem:0kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB kernel_stack:32kB pagetables:160kB sec_pagetables:0kB all_unreclaimable? no Balloon:0kB gpu_active:0kB gpu_reclaim:0kB [ 1131.977624][ T5391] 8021q: VLANs not supported on lo [ 1132.069402][ T5381] Node 0 DMA free:15360kB boost:0kB min:208kB low:260kB high:312kB reserved_highatomic:0KB free_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB zspages:0kB present:15992kB managed:15360kB mlocked:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB [ 1132.162123][ T5381] lowmem_reserve[]: 0 2488 2489 2489 2489 [ 1132.174728][ T5381] Node 0 DMA32 free:1235148kB boost:0kB min:34160kB low:42700kB high:51240kB reserved_highatomic:0KB free_highatomic:0KB active_anon:22432kB inactive_anon:0kB active_file:16kB inactive_file:174504kB unevictable:0kB writepending:484kB zspages:0kB present:3129332kB managed:2548692kB mlocked:0kB bounce:0kB free_pcp:40312kB local_pcp:20428kB free_cma:0kB [ 1132.264612][ T5381] lowmem_reserve[]: 0 0 0 0 0 [ 1132.276821][ T5381] Node 0 Normal free:0kB boost:0kB min:0kB low:0kB high:0kB reserved_highatomic:0KB free_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB zspages:0kB present:1048580kB managed:264kB mlocked:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB [ 1132.376678][ T5381] lowmem_reserve[]: 0 0 0 0 0 [ 1132.408376][ T5399] mac80211_hwsim hwsim59 ÿ: renamed from wlan1 [ 1132.419124][ T5381] Node 1 Normal free:3941052kB boost:0kB min:55736kB low:69668kB high:83600kB reserved_highatomic:0KB free_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:192kB unevictable:0kB writepending:0kB zspages:0kB present:4194300kB managed:4111100kB mlocked:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB [ 1132.520411][ T5381] lowmem_reserve[]: 0 0 0 0 0 [ 1132.527231][ T5381] Node 0 DMA: 0*4kB 0*8kB 0*16kB 0*32kB 0*64kB 0*128kB 0*256kB 0*512kB 1*1024kB (U) 1*2048kB (M) 3*4096kB (M) = 15360kB [ 1132.558092][ T5401] macvlan0: entered promiscuous mode [ 1132.647146][ T5381] Node 0 DMA32: 1525*4kB (UME) 2239*8kB (UM) 1044*16kB (UME) 603*32kB (UME) 600*64kB (UME) 523*128kB (UME) 364*256kB (UM) 235*512kB (UM) 148*1024kB (UM) 6*2048kB (UM) 169*4096kB (UM) = 1234924kB [ 1132.785660][ T5381] Node 0 Normal: 0*4kB 0*8kB 0*16kB 0*32kB 0*64kB 0*128kB 0*256kB 0*512kB 0*1024kB 0*2048kB 0*4096kB = 0kB [ 1132.956362][ T5381] Node 1 Normal: 1*4kB (M) 5*8kB (UM) 9*16kB (UM) 8*32kB (UM) 4*64kB (UM) 2*128kB (UM) 3*256kB (UM) 2*512kB (M) 2*1024kB (UM) 0*2048kB 961*4096kB (UM) = 3941052kB [ 1133.127616][ T5410] netlink: 16 bytes leftover after parsing attributes in process `syz.1.8499'. [ 1133.213410][ T5381] Node 0 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 1133.270936][ T5381] Node 0 hugepages_total=2 hugepages_free=2 hugepages_surp=0 hugepages_size=2048kB [ 1133.285366][ T5410] netlink: 16 bytes leftover after parsing attributes in process `syz.1.8499'. [ 1133.349911][ T5381] Node 1 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 1133.391616][ T5381] Node 1 hugepages_total=2 hugepages_free=2 hugepages_surp=0 hugepages_size=2048kB [ 1133.423466][ T5410] netlink: 16 bytes leftover after parsing attributes in process `syz.1.8499'. [ 1133.441551][ T5381] 44203 total pagecache pages [ 1133.478363][ T5381] 0 pages in swap cache [ 1133.498056][ T5381] Free swap = 124996kB [ 1133.520475][ T5381] Total swap = 124996kB [ 1133.545331][ T5381] 2097051 pages RAM [ 1133.576337][ T5381] 0 pages HighMem/MovableOnly [ 1133.602355][ T5381] 428197 pages reserved [ 1133.625818][ T5381] 0 pages cma reserved [ 1133.867251][ T5432] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 1133.899078][ T5431] netlink: 'syz.1.8504': attribute type 33 has an invalid length. [ 1134.026116][ T5434] ip_tables: iptables: counters copy to user failed while replacing table [ 1134.311088][ T5439] openvswitch: netlink: VXLAN extension 317 out of range max 1 [ 1134.411979][ T5444] netlink: zone id is out of range [ 1134.430947][ T5444] netlink: zone id is out of range [ 1134.446381][ T5444] netlink: zone id is out of range [ 1134.460206][ T5444] netlink: zone id is out of range [ 1134.474081][ T5444] netlink: zone id is out of range [ 1134.490380][ T5446] syzkaller0: entered allmulticast mode [ 1134.506078][ T5444] netlink: zone id is out of range [ 1134.519251][ T5444] netlink: zone id is out of range [ 1134.806395][ T5455] netlink: 32 bytes leftover after parsing attributes in process `syz.0.8510'. [ 1135.699667][ T5470] netlink: 12 bytes leftover after parsing attributes in process `syz.4.8514'. [ 1135.876647][ T5476] netlink: 8 bytes leftover after parsing attributes in process `syz.0.8517'. [ 1136.055015][ T5479] netlink: 24 bytes leftover after parsing attributes in process `syz.2.8516'. [ 1136.194471][ T5482] netlink: 'syz.4.8518': attribute type 1 has an invalid length. [ 1136.214354][ T5482] netlink: 5120 bytes leftover after parsing attributes in process `syz.4.8518'. [ 1136.636750][ T5489] netlink: 76 bytes leftover after parsing attributes in process `syz.1.8522'. [ 1136.655076][ T5489] nbd: illegal input index 65508 [ 1136.663799][ T5489] xt_hashlimit: size too large, truncated to 1048576 [ 1138.002642][ T5517] bridge0: port 2(bridge_slave_1) entered disabled state [ 1139.560235][ T5552] __nla_validate_parse: 1 callbacks suppressed [ 1139.560294][ T5552] netlink: 12 bytes leftover after parsing attributes in process `syz.0.8544'. [ 1139.610878][ T5561] IPVS: set_ctl: invalid protocol: 60 224.0.0.2:20003 [ 1139.666087][ T5561] IPVS: set_ctl: invalid protocol: 60 224.0.0.2:20003 [ 1140.013950][ T5571] netlink: 96 bytes leftover after parsing attributes in process `syz.0.8550'. [ 1140.310697][ T5577] netlink: 47 bytes leftover after parsing attributes in process `syz.1.8551'. [ 1140.526566][ T5585] netlink: 40 bytes leftover after parsing attributes in process `syz.3.8553'. [ 1140.617814][ T5591] netlink: 12 bytes leftover after parsing attributes in process `syz.0.8554'. [ 1140.702888][ T5591] netlink: 8 bytes leftover after parsing attributes in process `syz.0.8554'. [ 1140.797962][ T5581] bond5 (unregistering): Released all slaves [ 1142.730183][ T5622] netlink: 8 bytes leftover after parsing attributes in process `syz.0.8556'. [ 1142.892229][ T5623] netlink: 'syz.3.8559': attribute type 1 has an invalid length. [ 1143.217375][ T5624] netlink: 'syz.1.8558': attribute type 21 has an invalid length. [ 1144.556136][ T5614] netlink: 'syz.1.8558': attribute type 21 has an invalid length. [ 1145.472828][ T5624] netlink: 128 bytes leftover after parsing attributes in process `syz.1.8558'. [ 1145.762143][ T5614] netlink: 128 bytes leftover after parsing attributes in process `syz.1.8558'. [ 1145.908094][ T5624] netlink: 'syz.1.8558': attribute type 5 has an invalid length. [ 1146.240606][ T5624] netlink: 'syz.1.8558': attribute type 6 has an invalid length. [ 1146.314494][ T5624] netlink: 3 bytes leftover after parsing attributes in process `syz.1.8558'. [ 1146.423162][ T5614] netlink: 'syz.1.8558': attribute type 5 has an invalid length. [ 1146.513980][ T5614] netlink: 'syz.1.8558': attribute type 6 has an invalid length. [ 1146.654372][ T5614] netlink: 3 bytes leftover after parsing attributes in process `syz.1.8558'. [ 1146.868305][ T5644] netlink: 'syz.2.8564': attribute type 1 has an invalid length. [ 1146.952154][ T5644] nbd: error processing sock list [ 1157.710842][ C0] sched: DL replenish lagged too much [ 1160.978822][ T5690] net_ratelimit: 172 callbacks suppressed [ 1160.978846][ T5690] ip_tables: iptables: counters copy to user failed while replacing table [ 1161.035970][ T5692] netlink: 'syz.2.8574': attribute type 1 has an invalid length. [ 1161.070721][ T5694] netlink: 'syz.0.8577': attribute type 10 has an invalid length. [ 1161.878027][ T5695] netlink: 48 bytes leftover after parsing attributes in process `syz.2.8574'. [ 1161.964761][ C0] ip6_tunnel:  xmit: Local address not yet configured! [ 1161.983301][ T5698] netlink: 'syz.0.8577': attribute type 10 has an invalid length. [ 1162.635788][ T5707] netlink: 28 bytes leftover after parsing attributes in process `syz.1.8576'. [ 1162.860349][ T5692] 8021q: adding VLAN 0 to HW filter on device bond10 [ 1175.308402][ T50] Bluetooth: hci4: unexpected cc 0x0c03 length: 249 > 1 [ 1175.330109][ T50] Bluetooth: hci4: unexpected cc 0x1003 length: 249 > 9 [ 1175.348143][ T50] Bluetooth: hci4: unexpected cc 0x1001 length: 249 > 9 [ 1175.358728][ T50] Bluetooth: hci4: unexpected cc 0x0c23 length: 249 > 4 [ 1175.368288][ T50] Bluetooth: hci4: unexpected cc 0x0c38 length: 249 > 2 [ 1175.961667][ T870] Bluetooth: hci6: unexpected cc 0x0c03 length: 249 > 1 [ 1175.976531][ T870] Bluetooth: hci6: unexpected cc 0x1003 length: 249 > 9 [ 1175.990282][ T870] Bluetooth: hci6: unexpected cc 0x1001 length: 249 > 9 [ 1176.074984][ T870] Bluetooth: hci6: unexpected cc 0x0c23 length: 249 > 4 [ 1176.087482][ T870] Bluetooth: hci6: unexpected cc 0x0c38 length: 249 > 2 [ 1177.861069][ T870] Bluetooth: hci4: command tx timeout [ 1178.181538][ T870] Bluetooth: hci6: command tx timeout [ 1179.318459][ T50] Bluetooth: hci7: unexpected cc 0x0c03 length: 249 > 1 [ 1179.342425][ T50] Bluetooth: hci7: unexpected cc 0x1003 length: 249 > 9 [ 1179.355326][ T50] Bluetooth: hci7: unexpected cc 0x1001 length: 249 > 9 [ 1179.367223][ T50] Bluetooth: hci7: unexpected cc 0x0c23 length: 249 > 4 [ 1179.400662][ T50] Bluetooth: hci7: unexpected cc 0x0c38 length: 249 > 2 [ 1179.770604][ T5705] bond10: (slave gretap2): making interface the new active one [ 1179.832826][ T5705] bond10: (slave gretap2): Enslaving as an active interface with an up link [ 1179.963585][ T50] Bluetooth: hci4: command tx timeout [ 1180.261383][ T50] Bluetooth: hci6: command tx timeout [ 1181.471221][ T50] Bluetooth: hci7: command tx timeout [ 1182.021560][ T50] Bluetooth: hci4: command tx timeout [ 1182.348918][ T50] Bluetooth: hci6: command tx timeout [ 1183.541061][ T50] Bluetooth: hci7: command tx timeout [ 1184.033912][ T870] Bluetooth: hci8: unexpected cc 0x0c03 length: 249 > 1 [ 1184.049167][ T870] Bluetooth: hci8: unexpected cc 0x1003 length: 249 > 9 [ 1184.074578][ T870] Bluetooth: hci8: unexpected cc 0x1001 length: 249 > 9 [ 1184.103945][ T870] Bluetooth: hci4: command tx timeout [ 1184.249727][ T870] Bluetooth: hci8: unexpected cc 0x0c23 length: 249 > 4 [ 1184.266047][ T870] Bluetooth: hci8: unexpected cc 0x0c38 length: 249 > 2 [ 1184.431477][ T870] Bluetooth: hci6: command tx timeout [ 1185.046930][ T50] Bluetooth: hci9: unexpected cc 0x0c03 length: 249 > 1 [ 1185.092898][ T50] Bluetooth: hci9: unexpected cc 0x1003 length: 249 > 9 [ 1185.102849][ T50] Bluetooth: hci9: unexpected cc 0x1001 length: 249 > 9 [ 1185.138035][ T50] Bluetooth: hci9: unexpected cc 0x0c23 length: 249 > 4 [ 1185.150039][ T50] Bluetooth: hci9: unexpected cc 0x0c38 length: 249 > 2 [ 1185.394386][ T5731] netlink: 88 bytes leftover after parsing attributes in process `syz.4.8582'. [ 1185.633235][ T50] Bluetooth: hci7: command tx timeout [ 1186.101472][ T5746] netlink: 60 bytes leftover after parsing attributes in process `syz.3.8584'. [ 1186.184347][ T5746] netlink: 60 bytes leftover after parsing attributes in process `syz.3.8584'. [ 1187.001141][ T50] Bluetooth: hci8: command tx timeout [ 1187.228914][ T50] Bluetooth: hci9: command tx timeout [ 1187.854053][ T50] Bluetooth: hci7: command tx timeout [ 1188.081886][ T5705] syz.2.8574 (5705) used greatest stack depth: 17712 bytes left [ 1189.077551][ T50] Bluetooth: hci8: command tx timeout [ 1189.309733][ T50] Bluetooth: hci9: command tx timeout [ 1191.141051][ T50] Bluetooth: hci8: command tx timeout [ 1191.381248][ T50] Bluetooth: hci9: command tx timeout [ 1193.221081][ T50] Bluetooth: hci8: command tx timeout [ 1193.461109][ T50] Bluetooth: hci9: command tx timeout [ 1198.834775][ T3263] netdevsim netdevsim0 netdevsim3 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 1199.563052][ T3263] netdevsim netdevsim0 netdevsim3 (unregistering): unset [0, 1] type 1 family 0 port 256 - 0 [ 1199.980110][ T3263] netdevsim netdevsim0 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1213.210595][ T5736] syz_tun (unregistering): left allmulticast mode [ 1213.279318][ T5736] team0: Port device syz_tun removed [ 1215.099314][ T3263] netdevsim netdevsim0 netdevsim2 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 1215.152534][ T3263] netdevsim netdevsim0 netdevsim2 (unregistering): unset [0, 1] type 1 family 0 port 256 - 0 [ 1215.185813][ T3263] netdevsim netdevsim0 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1215.657955][ T5752] ip6gre0 speed is unknown, defaulting to 1000 [ 1223.393168][ C0] ip6_tunnel: ip6gre1 xmit: Local address not yet configured! [ 1225.001930][ T3263] netdevsim netdevsim0 netdevsim1 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 1225.020862][ T3263] netdevsim netdevsim0 netdevsim1 (unregistering): unset [0, 1] type 1 family 0 port 256 - 0 [ 1225.063321][ T3263] netdevsim netdevsim0 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1225.131435][ T5764] ip6gre0 speed is unknown, defaulting to 1000 [ 1235.803064][ T870] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 1235.818983][ T870] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 1235.832723][ T870] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 1235.879470][ T870] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 1235.888357][ T870] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 1236.140468][ T50] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 1236.157361][ T50] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 1236.178133][ T50] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 1236.240980][ T5631] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 1236.263739][ T5631] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 1237.508619][ T5631] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 1237.524597][ T5631] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 1237.538099][ T5631] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 1237.566668][ T5631] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 1237.580513][ T5631] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 1238.080888][ T870] Bluetooth: hci0: command tx timeout [ 1238.421070][ T870] Bluetooth: hci1: command tx timeout [ 1239.701014][ T870] Bluetooth: hci2: command tx timeout [ 1240.101002][ T870] Bluetooth: hci0: command tx timeout [ 1240.631612][ T870] Bluetooth: hci1: command tx timeout [ 1241.346181][ T5631] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 1241.364651][ T5631] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 1241.388086][ T5631] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 1241.403725][ T5631] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 1241.419114][ T5631] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 1241.781345][ T5631] Bluetooth: hci2: command tx timeout [ 1242.196358][ T5631] Bluetooth: hci0: command tx timeout [ 1242.661282][ T5631] Bluetooth: hci1: command tx timeout [ 1243.095599][ T870] Bluetooth: hci5: unexpected cc 0x0c03 length: 249 > 1 [ 1243.115558][ T870] Bluetooth: hci5: unexpected cc 0x1003 length: 249 > 9 [ 1243.132840][ T870] Bluetooth: hci5: unexpected cc 0x1001 length: 249 > 9 [ 1243.146306][ T870] Bluetooth: hci5: unexpected cc 0x0c23 length: 249 > 4 [ 1243.164342][ T870] Bluetooth: hci5: unexpected cc 0x0c38 length: 249 > 2 [ 1243.665554][ T870] Bluetooth: hci3: command tx timeout [ 1243.862618][ T870] Bluetooth: hci2: command tx timeout [ 1244.271316][ T870] Bluetooth: hci0: command tx timeout [ 1244.741322][ T870] Bluetooth: hci1: command tx timeout [ 1245.221834][ T870] Bluetooth: hci5: command tx timeout [ 1245.840854][ T870] Bluetooth: hci3: command tx timeout [ 1245.941038][ T870] Bluetooth: hci2: command tx timeout [ 1246.949810][ T3263] netdevsim netdevsim0 netdevsim0 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 1246.990870][ T3263] netdevsim netdevsim0 netdevsim0 (unregistering): unset [0, 1] type 1 family 0 port 256 - 0 [ 1247.013768][ T3263] netdevsim netdevsim0 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1247.173223][ T5770] ip6gre0 speed is unknown, defaulting to 1000 [ 1247.301435][ T870] Bluetooth: hci5: command tx timeout [ 1247.911308][ T870] Bluetooth: hci3: command tx timeout [ 1249.380994][ T870] Bluetooth: hci5: command tx timeout [ 1249.941417][ T870] Bluetooth: hci3: command tx timeout [ 1251.461072][ T870] Bluetooth: hci5: command tx timeout [ 1266.168029][ T5753] ip6gre0 speed is unknown, defaulting to 1000 [ 1277.002565][T23189] netdevsim netdevsim0 eth1: set [1, 0] type 2 family 0 port 6081 - 0 [ 1277.101478][ T5775] ip6gre0 speed is unknown, defaulting to 1000 [ 1277.372284][ T1143] netdevsim netdevsim0 eth2: set [1, 0] type 2 family 0 port 6081 - 0 [ 1277.702653][ T7780] netdevsim netdevsim0 eth3: set [1, 0] type 2 family 0 port 6081 - 0 [ 1278.841400][ T7777] netdevsim netdevsim0 eth4: set [1, 0] type 2 family 0 port 6081 - 0 [ 1279.969170][ T3263] bridge_slave_1: left allmulticast mode [ 1280.007372][ T3263] bridge_slave_1: left promiscuous mode [ 1280.048401][ T3263] bridge0: port 2(bridge_slave_1) entered disabled state [ 1280.392675][ T3263] batman_adv: batadv0: Interface deactivated: gretap1 [ 1299.462542][ T5631] Bluetooth: hci10: unexpected cc 0x0c03 length: 249 > 1 [ 1299.477434][ T5631] Bluetooth: hci10: unexpected cc 0x1003 length: 249 > 9 [ 1299.492814][ T5631] Bluetooth: hci10: unexpected cc 0x1001 length: 249 > 9 [ 1299.517353][ T5631] Bluetooth: hci10: unexpected cc 0x0c23 length: 249 > 4 [ 1299.526195][ T5631] Bluetooth: hci10: unexpected cc 0x0c38 length: 249 > 2 [ 1300.164600][ T870] Bluetooth: hci11: unexpected cc 0x0c03 length: 249 > 1 [ 1300.202009][ C0] ip6_tunnel:  xmit: Local address not yet configured! [ 1300.280407][ T5916] Bluetooth: hci11: unexpected cc 0x1003 length: 249 > 9 [ 1300.290349][ T5916] Bluetooth: hci11: unexpected cc 0x1001 length: 249 > 9 [ 1300.306605][ T5916] Bluetooth: hci11: unexpected cc 0x0c23 length: 249 > 4 [ 1300.317374][ T5916] Bluetooth: hci11: unexpected cc 0x0c38 length: 249 > 2 [ 1301.894714][ T5916] Bluetooth: hci10: command tx timeout [ 1302.348845][ T5916] Bluetooth: hci4: command 0x0406 tx timeout [ 1302.355226][ T5631] Bluetooth: hci6: command 0x0406 tx timeout [ 1302.370503][ T5631] Bluetooth: hci7: command 0x0406 tx timeout [ 1302.421272][ T5920] Bluetooth: hci11: command tx timeout [ 1303.599427][ T50] Bluetooth: hci12: unexpected cc 0x0c03 length: 249 > 1 [ 1303.626540][ T50] Bluetooth: hci12: unexpected cc 0x1003 length: 249 > 9 [ 1303.652938][ T50] Bluetooth: hci12: unexpected cc 0x1001 length: 249 > 9 [ 1303.663390][ T50] Bluetooth: hci12: unexpected cc 0x0c23 length: 249 > 4 [ 1303.675271][ T50] Bluetooth: hci12: unexpected cc 0x0c38 length: 249 > 2 [ 1303.940984][ T50] Bluetooth: hci10: command tx timeout [ 1304.501271][ T50] Bluetooth: hci11: command tx timeout [ 1305.045245][ T3263] batman_adv: batadv0: Removing interface: gretap1 [ 1305.781470][ T5920] Bluetooth: hci12: command tx timeout [ 1305.810179][ T5920] Bluetooth: hci13: unexpected cc 0x0c03 length: 249 > 1 [ 1305.835043][ T5920] Bluetooth: hci13: unexpected cc 0x1003 length: 249 > 9 [ 1305.844802][ T5920] Bluetooth: hci13: unexpected cc 0x1001 length: 249 > 9 [ 1305.860286][ T5920] Bluetooth: hci13: unexpected cc 0x0c23 length: 249 > 4 [ 1305.871014][ T5920] Bluetooth: hci13: unexpected cc 0x0c38 length: 249 > 2 [ 1306.198063][ T5920] Bluetooth: hci10: command tx timeout [ 1306.402099][ T3263] bond4 (unregistering): (slave gre2): Releasing backup interface [ 1306.410175][ T3263] gre2 (unregistering): left promiscuous mode [ 1306.618544][ T5920] Bluetooth: hci11: command tx timeout [ 1307.282720][ T5915] Bluetooth: hci14: unexpected cc 0x0c03 length: 249 > 1 [ 1307.297584][ T5915] Bluetooth: hci14: unexpected cc 0x1003 length: 249 > 9 [ 1307.315021][ T5915] Bluetooth: hci14: unexpected cc 0x1001 length: 249 > 9 [ 1307.391458][ T5631] Bluetooth: hci9: command 0x0406 tx timeout [ 1307.397650][ T5915] Bluetooth: hci8: command 0x0406 tx timeout [ 1307.641470][ T5915] Bluetooth: hci14: unexpected cc 0x0c23 length: 249 > 4 [ 1307.665129][ T5915] Bluetooth: hci14: unexpected cc 0x0c38 length: 249 > 2 [ 1307.867438][ T5915] Bluetooth: hci12: command tx timeout [ 1308.028471][ T5915] Bluetooth: hci13: command tx timeout [ 1308.421400][ T50] Bluetooth: hci10: command tx timeout [ 1308.661156][ T50] Bluetooth: hci11: command tx timeout [ 1309.106096][ T3263] team0: Port device geneve1 removed [ 1309.943854][ T50] Bluetooth: hci12: command tx timeout [ 1310.121383][ T50] Bluetooth: hci14: command tx timeout [ 1310.129308][ T5914] Bluetooth: hci13: command tx timeout [ 1312.021205][ T5914] Bluetooth: hci12: command tx timeout [ 1312.181046][ T50] Bluetooth: hci14: command tx timeout [ 1312.186753][ T5914] Bluetooth: hci13: command tx timeout [ 1314.401281][ T5914] Bluetooth: hci13: command tx timeout [ 1314.406845][ T5914] Bluetooth: hci14: command tx timeout [ 1316.501376][ T5914] Bluetooth: hci14: command tx timeout [ 1338.292212][ T3263] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 1338.423295][ T3263] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 1338.546781][ T3263] bond0 (unregistering): Released all slaves [ 1338.709751][ T3263] bond1 (unregistering): Released all slaves [ 1338.835615][ T3263] bond2 (unregistering): Released all slaves [ 1339.022118][ T3263] bond3 (unregistering): (slave veth0_to_bond): Releasing active interface [ 1339.040814][ T3263] veth0_to_bond: left promiscuous mode [ 1339.056479][ T3263] veth0_to_bond: left allmulticast mode [ 1340.059137][ T3263] bond3 (unregistering): Released all slaves [ 1340.528551][ T3263] bond4 (unregistering): Released all slaves [ 1340.669598][ T3263] bond5 (unregistering): Released all slaves [ 1342.018745][ T5276] 8021q: adding VLAN 0 to HW filter on device eth1 [ 1342.879908][ T5841] ip6gre0 speed is unknown, defaulting to 1000 [ 1351.644855][ T3263] tipc: Disabling bearer [ 1351.668933][ T3263] tipc: Left network mode [ 1359.450782][ T5920] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 1359.483689][ T5920] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 1359.496949][ T5920] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 1359.525974][ T5920] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 1359.536414][ T5920] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 1360.605351][ T5914] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 1360.628936][ T5914] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 1360.647448][ T5914] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 1360.684712][ T5914] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 1360.699020][ T5914] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 1362.161428][ T5920] Bluetooth: hci0: command tx timeout [ 1362.821711][ T5920] Bluetooth: hci1: command tx timeout [ 1362.880779][ T50] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 1362.926709][ T50] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 1362.936210][ T50] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 1362.963221][ T50] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 1362.994595][ T50] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 1363.701235][ T50] Bluetooth: hci3: command 0x0406 tx timeout [ 1364.181202][ T50] Bluetooth: hci0: command tx timeout [ 1364.971430][ T50] Bluetooth: hci1: command tx timeout [ 1365.241133][ T50] Bluetooth: hci2: command tx timeout [ 1365.633085][ T5920] Bluetooth: hci5: unexpected cc 0x0c03 length: 249 > 1 [ 1365.650456][ T5920] Bluetooth: hci5: unexpected cc 0x1003 length: 249 > 9 [ 1365.662389][ T5920] Bluetooth: hci5: unexpected cc 0x1001 length: 249 > 9 [ 1365.683970][ T5920] Bluetooth: hci5: unexpected cc 0x0c23 length: 249 > 4 [ 1365.720631][ T5920] Bluetooth: hci5: unexpected cc 0x0c38 length: 249 > 2 [ 1366.212502][ T5915] Bluetooth: hci15: unexpected cc 0x0c03 length: 249 > 1 [ 1366.239758][ T5915] Bluetooth: hci15: unexpected cc 0x1003 length: 249 > 9 [ 1366.264160][ T5915] Bluetooth: hci0: command tx timeout [ 1366.281724][ T5915] Bluetooth: hci15: unexpected cc 0x1001 length: 249 > 9 [ 1366.297085][ T5915] Bluetooth: hci15: unexpected cc 0x0c23 length: 249 > 4 [ 1366.306315][ T5915] Bluetooth: hci15: unexpected cc 0x0c38 length: 249 > 2 [ 1366.741195][ C1] ip6_tunnel: ip6gre1 xmit: Local address not yet configured! [ 1367.129736][ T5920] Bluetooth: hci1: command tx timeout [ 1367.324270][ T5920] Bluetooth: hci2: command tx timeout [ 1368.386181][ T5920] Bluetooth: hci0: command tx timeout [ 1369.385247][ T5920] Bluetooth: hci1: command tx timeout [ 1369.430890][ T5920] Bluetooth: hci2: command tx timeout [ 1371.763572][ T5631] Bluetooth: hci2: command tx timeout [ 1465.590710][ C0] rcu: INFO: rcu_preempt detected stalls on CPUs/tasks: [ 1465.597816][ C0] rcu: Tasks blocked on level-0 rcu_node (CPUs 0-1): P5347/1:b..l [ 1465.606394][ C0] rcu: (detected by 0, t=10503 jiffies, g=225533, q=3136 ncpus=2) [ 1465.614359][ C0] task:kworker/0:3 state:R running task stack:23168 pid:5347 tgid:5347 ppid:2 task_flags:0x4208060 flags:0x00080000 [ 1465.629683][ C0] Workqueue: events free_obj_work [ 1465.634900][ C0] Call Trace: [ 1465.638222][ C0] [ 1465.641202][ C0] __schedule+0x17d9/0x56c0 [ 1465.645822][ C0] ? irqentry_exit+0x218/0x8f0 [ 1465.650635][ C0] ? trace_irq_disable+0x3b/0x140 [ 1465.655734][ C0] ? __pfx___schedule+0x10/0x10 [ 1465.660765][ C0] preempt_schedule_irq+0x4d/0xa0 [ 1465.665848][ C0] irqentry_exit+0x14f/0x8f0 [ 1465.670486][ C0] ? trace_irq_disable+0x3b/0x140 [ 1465.675559][ C0] asm_sysvec_apic_timer_interrupt+0x1a/0x20 [ 1465.681613][ C0] RIP: 0010:lock_acquire+0x221/0x350 [ 1465.686963][ C0] Code: ff ff ff e8 51 7d 2d 0a f7 44 24 08 00 02 00 00 0f 84 3a ff ff ff 65 48 8b 05 db c7 c9 11 48 3b 44 24 58 75 33 fb 48 83 c4 60 <5b> 41 5c 41 5d 41 5e 41 5f 5d e9 80 7f 30 0a cc 48 8d 3d c8 0c b8 [ 1465.706786][ C0] RSP: 0018:ffffc90003027540 EFLAGS: 00000282 [ 1465.712905][ C0] RAX: da0220d49e31cd00 RBX: 0000000000000000 RCX: 0000000000000046 [ 1465.720920][ C0] RDX: 000000002daefaeb RSI: ffffffff8e4acd76 RDI: ffffffff8c4bba80 [ 1465.729110][ C0] RBP: ffffffff8177827f R08: ffffffff8177827f R09: 0000000000000000 [ 1465.737123][ C0] R10: 0000000000000000 R11: ffffffff8eb59c60 R12: 0000000000000002 [ 1465.745138][ C0] R13: ffffffff8eb59c60 R14: 0000000000000000 R15: 0000000000000246 [ 1465.753169][ C0] ? unwind_next_frame+0x8f/0x2550 [ 1465.758364][ C0] ? unwind_next_frame+0x8f/0x2550 [ 1465.763530][ C0] ? kthread+0x388/0x470 [ 1465.767833][ C0] ? unwind_next_frame+0x8f/0x2550 [ 1465.772988][ C0] unwind_next_frame+0xac/0x2550 [ 1465.778047][ C0] ? unwind_next_frame+0x8f/0x2550 [ 1465.783234][ C0] ? worker_thread+0xa47/0xfb0 [ 1465.788040][ C0] ? unwind_next_frame+0x8f/0x2550 [ 1465.793285][ C0] ? __pfx_stack_trace_consume_entry+0x10/0x10 [ 1465.799508][ C0] arch_stack_walk+0x11b/0x150 [ 1465.804343][ C0] ? kthread+0x388/0x470 [ 1465.808641][ C0] stack_trace_save+0xa9/0x100 [ 1465.813446][ C0] ? __pfx_stack_trace_save+0x10/0x10 [ 1465.818871][ C0] ? stack_depot_save_flags+0x33/0x800 [ 1465.824483][ C0] kasan_save_track+0x3e/0x80 [ 1465.829236][ C0] ? kasan_save_track+0x3e/0x80 [ 1465.834130][ C0] ? kasan_save_free_info+0x40/0x50 [ 1465.839382][ C0] ? __kasan_slab_free+0x5c/0x80 [ 1465.844364][ C0] ? kmem_cache_free+0x182/0x650 [ 1465.849448][ C0] ? free_obj_work+0x357/0x490 [ 1465.854266][ C0] ? process_scheduled_works+0xa8e/0x14e0 [ 1465.860028][ C0] ? worker_thread+0xa47/0xfb0 [ 1465.864845][ C0] ? kthread+0x388/0x470 [ 1465.869186][ C0] ? free_obj_work+0x357/0x490 [ 1465.874001][ C0] kasan_save_free_info+0x40/0x50 [ 1465.879073][ C0] __kasan_slab_free+0x5c/0x80 [ 1465.883980][ C0] kmem_cache_free+0x182/0x650 [ 1465.888796][ C0] ? _raw_spin_unlock_irqrestore+0x30/0x80 [ 1465.894766][ C0] free_obj_work+0x357/0x490 [ 1465.899411][ C0] ? __pfx_free_obj_work+0x10/0x10 [ 1465.904574][ C0] ? rcu_is_watching+0x15/0xb0 [ 1465.909400][ C0] ? process_scheduled_works+0xa20/0x14e0 [ 1465.915253][ C0] process_scheduled_works+0xa8e/0x14e0 [ 1465.920876][ C0] ? __pfx_process_scheduled_works+0x10/0x10 [ 1465.926997][ C0] ? assign_work+0x3cf/0x5d0 [ 1465.931641][ C0] worker_thread+0xa47/0xfb0 [ 1465.936293][ C0] ? __kthread_parkme+0x71/0x1f0 [ 1465.941292][ C0] kthread+0x388/0x470 [ 1465.945416][ C0] ? __pfx_worker_thread+0x10/0x10 [ 1465.950571][ C0] ? __pfx_kthread+0x10/0x10 [ 1465.955220][ C0] ret_from_fork+0x514/0xb70 [ 1465.959895][ C0] ? __pfx_ret_from_fork+0x10/0x10 [ 1465.965062][ C0] ? __switch_to+0xc89/0x1420 [ 1465.969785][ C0] ? __pfx_kthread+0x10/0x10 [ 1465.974427][ C0] ret_from_fork_asm+0x1a/0x30 [ 1465.979325][ C0] [ 1465.982392][ C0] rcu: rcu_preempt kthread starved for 6339 jiffies! g225533 f0x0 RCU_GP_WAIT_FQS(5) ->state=0x0 ->cpu=1 [ 1465.993620][ C0] rcu: Unless rcu_preempt kthread gets sufficient CPU time, OOM is now expected behavior. [ 1466.003706][ C0] rcu: RCU grace-period kthread stack dump: [ 1466.009625][ C0] task:rcu_preempt state:R running task stack:27496 pid:16 tgid:16 ppid:2 task_flags:0x208040 flags:0x00080000 [ 1466.023178][ C0] Call Trace: [ 1466.026642][ C0] [ 1466.029617][ C0] __schedule+0x17d9/0x56c0 [ 1466.034255][ C0] ? __lock_acquire+0x683/0x2cf0 [ 1466.039267][ C0] ? __pfx___schedule+0x10/0x10 [ 1466.044181][ C0] ? schedule+0x90/0x2b0 [ 1466.048521][ C0] schedule+0x164/0x2b0 [ 1466.052732][ C0] schedule_timeout+0x152/0x2c0 [ 1466.057641][ C0] ? __pfx_schedule_timeout+0x10/0x10 [ 1466.063069][ C0] ? __pfx_process_timeout+0x10/0x10 [ 1466.068403][ C0] ? _raw_spin_unlock_irqrestore+0x4c/0x80 [ 1466.074263][ C0] ? prepare_to_swait_event+0x322/0x350 [ 1466.079906][ C0] rcu_gp_fqs_loop+0x30c/0x11f0 [ 1466.084830][ C0] ? __pfx_rcu_watching_snap_recheck+0x10/0x10 [ 1466.091066][ C0] ? __pfx_rcu_gp_fqs_loop+0x10/0x10 [ 1466.096396][ C0] ? _raw_spin_unlock_irq+0x2e/0x50 [ 1466.101647][ C0] ? _raw_spin_unlock_irqrestore+0x30/0x80 [ 1466.107532][ C0] rcu_gp_kthread+0x9e/0x2b0 [ 1466.112209][ C0] ? __pfx_rcu_gp_kthread+0x10/0x10 [ 1466.117547][ C0] ? __kthread_parkme+0x71/0x1f0 [ 1466.122532][ C0] ? __kthread_parkme+0x196/0x1f0 [ 1466.127608][ C0] kthread+0x388/0x470 [ 1466.131724][ C0] ? __pfx_rcu_gp_kthread+0x10/0x10 [ 1466.136979][ C0] ? __pfx_kthread+0x10/0x10 [ 1466.141622][ C0] ret_from_fork+0x514/0xb70 [ 1466.146273][ C0] ? __pfx_ret_from_fork+0x10/0x10 [ 1466.151440][ C0] ? __switch_to+0xc89/0x1420 [ 1466.156189][ C0] ? __pfx_kthread+0x10/0x10 [ 1466.160837][ C0] ret_from_fork_asm+0x1a/0x30 [ 1466.165670][ C0] [ 1466.168724][ C0] rcu: Stack dump where RCU GP kthread last ran: [ 1466.175091][ C0] Sending NMI from CPU 0 to CPUs 1: [ 1466.180359][ C1] NMI backtrace for cpu 1 [ 1466.180384][ C1] CPU: 1 UID: 0 PID: 30301 Comm: kworker/R-bond4 Not tainted syzkaller #0 PREEMPT(full) [ 1466.180415][ C1] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 1466.180433][ C1] Workqueue: bond4 bond_alb_monitor [ 1466.180552][ C1] RIP: 0010:lockdep_hardirqs_off+0x56/0xd0 [ 1466.180578][ C1] Code: 75 09 9c 58 a9 00 02 00 00 75 6a 65 8b 05 7a 89 9c 07 85 c0 74 56 65 4c 8b 35 ee 48 9c 07 48 c7 c7 fc 7d 22 8e e8 5a 1c 00 00 <65> c7 05 57 89 9c 07 00 00 00 00 49 89 9e 48 0b 00 00 41 8b 86 38 [ 1466.180593][ C1] RSP: 0018:ffffc90000a07f50 EFLAGS: 00000002 [ 1466.180607][ C1] RAX: 0000000000000001 RBX: ffffffff8bd2edaa RCX: 0000000000000101 [ 1466.180620][ C1] RDX: 0000000000000000 RSI: ffffffff8e227dfc RDI: ffffffff8c4bba80 [ 1466.180632][ C1] RBP: 0000000000a12110 R08: ffffc90000a07fff R09: 0000000000000000 [ 1466.180644][ C1] R10: ffffc90000a07fd8 R11: fffff52000141000 R12: 0000000000000000 [ 1466.180656][ C1] R13: ffff8880a7126000 R14: ffff888028b39f00 R15: ffffffff8a7dbc6c [ 1466.180676][ C1] FS: 0000000000000000(0000) GS:ffff888125058000(0000) knlGS:0000000000000000 [ 1466.180696][ C1] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 1466.180708][ C1] CR2: 00007f208b42a77f CR3: 000000000e946000 CR4: 00000000003526f0 [ 1466.180724][ C1] Call Trace: [ 1466.180731][ C1] [ 1466.180738][ C1] ? _raw_spin_lock_irqsave+0x1a/0x60 [ 1466.180758][ C1] trace_hardirqs_off+0x12/0x40 [ 1466.180780][ C1] _raw_spin_lock_irqsave+0x1a/0x60 [ 1466.180798][ C1] debug_check_no_obj_freed+0xcb/0x450 [ 1466.180820][ C1] ? lockdep_hardirqs_on+0x7a/0x110 [ 1466.180847][ C1] ? ip6_pkt_discard+0x1c/0x30 [ 1466.180920][ C1] kmem_cache_free+0xfd/0x650 [ 1466.180947][ C1] ? __pfx_ip6_rcv_finish+0x10/0x10 [ 1466.180984][ C1] ip6_pkt_discard+0x1c/0x30 [ 1466.181006][ C1] ip_sabotage_in+0x1e1/0x270 [ 1466.181055][ C1] ? __pfx_ip_sabotage_in+0x10/0x10 [ 1466.181076][ C1] nf_hook_slow+0xc5/0x220 [ 1466.181111][ C1] NF_HOOK+0x21f/0x3c0 [ 1466.181129][ C1] ? __pfx_ip6_rcv_finish+0x10/0x10 [ 1466.181145][ C1] ? NF_HOOK+0x9e/0x3c0 [ 1466.181161][ C1] ? __pfx_NF_HOOK+0x10/0x10 [ 1466.181177][ C1] ? ip6_rcv_core+0xa1/0x1870 [ 1466.181195][ C1] ? __pfx_ip6_rcv_finish+0x10/0x10 [ 1466.181216][ C1] ? netif_receive_skb+0x102/0xbf0 [ 1466.181282][ C1] netif_receive_skb+0x278/0xbf0 [ 1466.181302][ C1] ? NF_HOOK+0xfa/0x3a0 [ 1466.181345][ C1] ? lock_acquire+0x106/0x350 [ 1466.181370][ C1] ? __pfx_netif_receive_skb+0x10/0x10 [ 1466.181393][ C1] ? br_netif_receive_skb+0x126/0x190 [ 1466.181415][ C1] NF_HOOK+0xa4/0x3a0 [ 1466.181433][ C1] ? __pfx_br_netif_receive_skb+0x10/0x10 [ 1466.181453][ C1] ? NF_HOOK+0xfa/0x3a0 [ 1466.181471][ C1] ? __pfx_NF_HOOK+0x10/0x10 [ 1466.181491][ C1] ? __pfx_br_netif_receive_skb+0x10/0x10 [ 1466.181513][ C1] ? br_pass_frame_up+0x275/0x420 [ 1466.181535][ C1] br_handle_frame_finish+0x1192/0x1990 [ 1466.181554][ C1] ? kasan_save_track+0x4f/0x80 [ 1466.181582][ C1] ? __pfx_br_handle_frame_finish+0x10/0x10 [ 1466.181606][ C1] ? ip6t_do_table+0x1d1/0x15b0 [ 1466.181654][ C1] ? __pfx_ip6t_do_table+0x10/0x10 [ 1466.181684][ C1] ? nf_hook_slow+0x176/0x220 [ 1466.181705][ C1] ? __pfx_br_handle_frame_finish+0x10/0x10 [ 1466.181725][ C1] br_nf_hook_thresh+0x3dd/0x4c0 [ 1466.181744][ C1] ? __pfx_nf_nat_ipv6_fn+0x10/0x10 [ 1466.181792][ C1] ? __pfx_br_nf_hook_thresh+0x10/0x10 [ 1466.181813][ C1] ? __pfx_br_handle_frame_finish+0x10/0x10 [ 1466.181833][ C1] ? __pfx_nf_nat_ipv6_in+0x10/0x10 [ 1466.181850][ C1] ? lock_acquire+0x106/0x350 [ 1466.181876][ C1] br_nf_pre_routing_finish_ipv6+0x90c/0xc40 [ 1466.181898][ C1] ? __pfx_br_handle_frame_finish+0x10/0x10 [ 1466.181922][ C1] br_nf_pre_routing_ipv6+0x382/0x6f0 [ 1466.181944][ C1] ? br_nf_pre_routing_ipv6+0x43d/0x6f0 [ 1466.181965][ C1] ? __pfx_br_nf_pre_routing_ipv6+0x10/0x10 [ 1466.181988][ C1] ? __pfx_br_nf_pre_routing_finish_ipv6+0x10/0x10 [ 1466.182009][ C1] ? br_nf_pre_routing+0x720/0x14b0 [ 1466.182033][ C1] ? __pfx_br_nf_pre_routing+0x10/0x10 [ 1466.182052][ C1] br_handle_frame+0x127f/0x1510 [ 1466.182077][ C1] ? __pfx_br_handle_frame+0x10/0x10 [ 1466.182098][ C1] ? __pfx_br_handle_frame_finish+0x10/0x10 [ 1466.182117][ C1] ? kasan_quarantine_put+0xbb/0x1f0 [ 1466.182138][ C1] ? lockdep_hardirqs_on+0x7a/0x110 [ 1466.182162][ C1] ? __pfx_br_handle_frame+0x10/0x10 [ 1466.182181][ C1] __netif_receive_skb_core+0x989/0x30b0 [ 1466.182234][ C1] ? __pfx_ip6_mc_input+0x10/0x10 [ 1466.182253][ C1] ? __pfx___netif_receive_skb_core+0x10/0x10 [ 1466.182275][ C1] ? ip6_rcv_finish+0x265/0x280 [ 1466.182294][ C1] ? NF_HOOK+0x336/0x3c0 [ 1466.182316][ C1] ? process_backlog+0x3c3/0x1860 [ 1466.182345][ C1] ? process_backlog+0x3c3/0x1860 [ 1466.182367][ C1] ? process_backlog+0x3c3/0x1860 [ 1466.182393][ C1] process_backlog+0x706/0x1860 [ 1466.182419][ C1] ? process_backlog+0x3c3/0x1860 [ 1466.182451][ C1] __napi_poll+0xaa/0x330 [ 1466.182475][ C1] net_rx_action+0x61d/0xf50 [ 1466.182505][ C1] ? __pfx_net_rx_action+0x10/0x10 [ 1466.182545][ C1] handle_softirqs+0x225/0x840 [ 1466.182573][ C1] ? do_softirq+0x76/0xd0 [ 1466.182593][ C1] ? __dev_queue_xmit+0x29b/0x3820 [ 1466.182612][ C1] do_softirq+0x76/0xd0 [ 1466.182630][ C1] [ 1466.182637][ C1] [ 1466.182643][ C1] __local_bh_enable_ip+0xf8/0x130 [ 1466.182661][ C1] ? __dev_queue_xmit+0x29b/0x3820 [ 1466.182685][ C1] __dev_queue_xmit+0x1edc/0x3820 [ 1466.182711][ C1] ? __dev_queue_xmit+0x29b/0x3820 [ 1466.182735][ C1] ? __pfx___dev_queue_xmit+0x10/0x10 [ 1466.182754][ C1] ? rcu_is_watching+0x15/0xb0 [ 1466.182778][ C1] ? kmem_cache_alloc_node_noprof+0x1c1/0x610 [ 1466.182799][ C1] ? trace_kmem_cache_alloc+0x29/0xe0 [ 1466.182817][ C1] ? kmem_cache_alloc_node_noprof+0x1c1/0x610 [ 1466.182838][ C1] ? kmem_cache_alloc_node_noprof+0x3b8/0x610 [ 1466.182857][ C1] ? local_lock_release+0x9c/0x160 [ 1466.182884][ C1] ? kmem_cache_alloc_node_noprof+0x1f5/0x610 [ 1466.182911][ C1] ? __alloc_skb+0x4cc/0x7a0 [ 1466.182937][ C1] ? alb_send_lp_vid+0x14e/0x550 [ 1466.182963][ C1] alb_send_lp_vid+0x348/0x550 [ 1466.182988][ C1] ? __pfx_alb_send_lp_vid+0x10/0x10 [ 1466.183020][ C1] alb_send_learning_packets+0x12c/0x300 [ 1466.183045][ C1] ? __pfx_alb_send_learning_packets+0x10/0x10 [ 1466.183068][ C1] ? bond_alb_monitor+0xf3/0x1820 [ 1466.183094][ C1] ? netdev_lower_get_next_private_rcu+0x9f/0x100 [ 1466.183121][ C1] bond_alb_monitor+0x3d0/0x1820 [ 1466.183145][ C1] ? bond_alb_monitor+0xf3/0x1820 [ 1466.183168][ C1] ? __pfx_bond_alb_monitor+0x10/0x10 [ 1466.183192][ C1] ? rcu_is_watching+0x15/0xb0 [ 1466.183218][ C1] ? process_scheduled_works+0xa20/0x14e0 [ 1466.183237][ C1] process_scheduled_works+0xa8e/0x14e0 [ 1466.183272][ C1] ? __pfx_process_scheduled_works+0x10/0x10 [ 1466.183289][ C1] ? do_raw_spin_lock+0x12b/0x2f0 [ 1466.183313][ C1] ? assign_work+0x3af/0x5d0 [ 1466.183333][ C1] rescuer_thread+0x7b6/0x10b0 [ 1466.183357][ C1] ? rescuer_thread+0xb8/0x10b0 [ 1466.183388][ C1] kthread+0x388/0x470 [ 1466.183411][ C1] ? __pfx_rescuer_thread+0x10/0x10 [ 1466.183430][ C1] ? __pfx_kthread+0x10/0x10 [ 1466.183453][ C1] ret_from_fork+0x514/0xb70 [ 1466.183479][ C1] ? __pfx_ret_from_fork+0x10/0x10 [ 1466.183502][ C1] ? __switch_to+0xc89/0x1420 [ 1466.183522][ C1] ? __pfx_kthread+0x10/0x10 [ 1466.183545][ C1] ret_from_fork_asm+0x1a/0x30 [ 1466.183580][ C1]