program: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000140)=ANY=[@ANYBLOB="30000000100001001fff00"/20, @ANYRES32=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00\b\x00\n\x00', @ANYRES32=0x0, @ANYBLOB="08001b"], 0x30}}, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$ifreq_SIOCGIFINDEX_team(r1, 0x8933, &(0x7f0000000000)={'team0\x00', 0x0}) ioctl$sock_ifreq(r0, 0x8922, &(0x7f0000000080)={'pimreg1\x00', @ifru_ivalue=0x1b8b}) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r3, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000680)={{0x14}, [@NFT_MSG_NEWTABLE={0x20, 0x0, 0xa, 0x5, 0x0, 0x0, {0x1}, [@NFTA_TABLE_NAME={0x9, 0x1, 'syz0\x00'}]}, @NFT_MSG_NEWCHAIN={0x2c, 0x3, 0xa, 0x201, 0x0, 0x0, {0x1}, [@NFTA_CHAIN_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_CHAIN_NAME={0x9, 0x3, 'syz2\x00'}]}, @NFT_MSG_NEWRULE={0x50, 0x6, 0xa, 0x401, 0x0, 0x0, {0x1}, [@NFTA_RULE_CHAIN_ID={0x8}, @NFTA_RULE_EXPRESSIONS={0x28, 0x4, 0x0, 0x1, [{0x24, 0x1, 0x0, 0x1, @tproxy={{0xb}, @val={0x14, 0x2, 0x0, 0x1, [@NFTA_TPROXY_REG_PORT={0x8, 0x3, 0x1, 0x0, 0x16}, @NFTA_TPROXY_FAMILY={0x8, 0x1, 0x1, 0x0, 0xa}]}}}]}, @NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}]}], {0x14}}, 0xc4}}, 0x0) syz_emit_ethernet(0x52, &(0x7f00000007c0)={@local, @random="89ab9b4c72ca", @void, {@ipv6={0x86dd, @tcp={0x0, 0x6, "7927f3", 0x1c, 0x2c, 0x0, @remote, @local, {[@routing={0x0, 0x0, 0x0, 0x8}], {{0x0, 0x400, 0x41424344, 0x41424344, 0x0, 0x0, 0x5}}}}}}}, 0x0) syz_emit_ethernet(0x46, &(0x7f0000000000)=ANY=[@ANYBLOB="ffffffffffffffffffffffff86dd6060626000102c00fe8000000000000000000000000000bbfe8000000000000000000000000000aa11000301"], 0x0) r4 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_SIOCBRDELBR(r4, 0x89a2, &(0x7f0000000000)='bridge0\x00') sendmsg$nl_route(r1, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000100)=@newlink={0x3c, 0x10, 0x1, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x10104}, [@IFLA_IFNAME={0x14, 0x3, 'ip6gre0\x00'}, @IFLA_MASTER={0x8, 0xa, r2}]}, 0x3c}}, 0x0) socket$nl_route(0x10, 0x3, 0x0) (async) sendmsg$nl_route(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000140)=ANY=[@ANYBLOB="30000000100001001fff00"/20, @ANYRES32=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00\b\x00\n\x00', @ANYRES32=0x0, @ANYBLOB="08001b"], 0x30}}, 0x0) (async) socket$nl_route(0x10, 0x3, 0x0) (async) ioctl$ifreq_SIOCGIFINDEX_team(r1, 0x8933, &(0x7f0000000000)) (async) ioctl$sock_ifreq(r0, 0x8922, &(0x7f0000000080)={'pimreg1\x00', @ifru_ivalue=0x1b8b}) (async) socket$nl_netfilter(0x10, 0x3, 0xc) (async) sendmsg$NFT_BATCH(r3, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000680)={{0x14}, [@NFT_MSG_NEWTABLE={0x20, 0x0, 0xa, 0x5, 0x0, 0x0, {0x1}, [@NFTA_TABLE_NAME={0x9, 0x1, 'syz0\x00'}]}, @NFT_MSG_NEWCHAIN={0x2c, 0x3, 0xa, 0x201, 0x0, 0x0, {0x1}, [@NFTA_CHAIN_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_CHAIN_NAME={0x9, 0x3, 'syz2\x00'}]}, @NFT_MSG_NEWRULE={0x50, 0x6, 0xa, 0x401, 0x0, 0x0, {0x1}, [@NFTA_RULE_CHAIN_ID={0x8}, @NFTA_RULE_EXPRESSIONS={0x28, 0x4, 0x0, 0x1, [{0x24, 0x1, 0x0, 0x1, @tproxy={{0xb}, @val={0x14, 0x2, 0x0, 0x1, [@NFTA_TPROXY_REG_PORT={0x8, 0x3, 0x1, 0x0, 0x16}, @NFTA_TPROXY_FAMILY={0x8, 0x1, 0x1, 0x0, 0xa}]}}}]}, @NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}]}], {0x14}}, 0xc4}}, 0x0) (async) syz_emit_ethernet(0x52, &(0x7f00000007c0)={@local, @random="89ab9b4c72ca", @void, {@ipv6={0x86dd, @tcp={0x0, 0x6, "7927f3", 0x1c, 0x2c, 0x0, @remote, @local, {[@routing={0x0, 0x0, 0x0, 0x8}], {{0x0, 0x400, 0x41424344, 0x41424344, 0x0, 0x0, 0x5}}}}}}}, 0x0) (async) syz_emit_ethernet(0x46, &(0x7f0000000000)=ANY=[@ANYBLOB="ffffffffffffffffffffffff86dd6060626000102c00fe8000000000000000000000000000bbfe8000000000000000000000000000aa11000301"], 0x0) (async) socket$netlink(0x10, 0x3, 0x0) (async) ioctl$sock_SIOCBRDELBR(r4, 0x89a2, &(0x7f0000000000)='bridge0\x00') (async) sendmsg$nl_route(r1, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000100)=@newlink={0x3c, 0x10, 0x1, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x10104}, [@IFLA_IFNAME={0x14, 0x3, 'ip6gre0\x00'}, @IFLA_MASTER={0x8, 0xa, r2}]}, 0x3c}}, 0x0) (async) [ 74.357032][ T46] Bluetooth: hci0: command tx timeout [ 74.425600][ T5338] bridge_slave_0: left allmulticast mode [ 74.430960][ T5338] bridge_slave_0: left promiscuous mode [ 74.433778][ T5338] bridge0: port 1(bridge_slave_0) entered disabled state [ 74.444243][ T5338] bridge_slave_1: left allmulticast mode [ 74.450258][ T5338] bridge_slave_1: left promiscuous mode [ 74.452853][ T5338] bridge0: port 2(bridge_slave_1) entered disabled state [ 74.459639][ T5338] bond0: (slave bond_slave_0): Releasing backup interface [ 74.469777][ T5338] bond0: (slave bond_slave_1): Releasing backup interface [ 74.489229][ T5338] team0: Port device team_slave_0 removed [ 74.502757][ T5338] team0: Port device team_slave_1 removed [ 74.512200][ T5338] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 74.515137][ T5338] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 74.537746][ T5338] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 74.557723][ T5338] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 74.563785][ T5338] A link change request failed with some changes committed already. Interface hsr_slave_0 may have been left with an inconsistent configuration, please check. [ 74.593282][ T5341] ip6gre0: entered promiscuous mode [ 74.611795][ T5341] team0: Port device ip6gre0 added [ 74.649731][ T5338] team0: Port device ip6gre0 removed [ 74.674246][ T5338] A link change request failed with some changes committed already. Interface hsr_slave_0 may have been left with an inconsistent configuration, please check. [ 74.699504][ T1392] skbuff: skb_under_panic: text:ffffffff8a29dd38 len:136 put:40 head:ffff888038438000 data:ffff888038437fe8 tail:0x70 end:0x6c0 dev:team0 [ 74.708214][ T1392] ------------[ cut here ]------------ [ 74.710702][ T1392] kernel BUG at net/core/skbuff.c:213! [ 74.713194][ T1392] Oops: invalid opcode: 0000 [#1] SMP KASAN NOPTI [ 74.716194][ T1392] CPU: 0 UID: 0 PID: 1392 Comm: kworker/0:3 Not tainted syzkaller #0 PREEMPT(full) [ 74.720231][ T1392] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014 [ 74.724928][ T1392] Workqueue: mld mld_ifc_work [ 74.726964][ T1392] RIP: 0010:skb_panic+0x157/0x160 [ 74.728973][ T1392] Code: c7 20 ac 8f 8c 48 8b 74 24 08 48 8b 54 24 10 8b 0c 24 44 8b 44 24 04 4d 89 e9 50 55 41 57 41 56 e8 2e 6a f5 ff 48 83 c4 20 90 <0f> 0b cc cc cc cc cc cc cc 90 90 90 90 90 90 90 90 90 90 90 90 90 [ 74.736700][ T1392] RSP: 0018:ffffc9000858f280 EFLAGS: 00010282 [ 74.739194][ T1392] RAX: 0000000000000087 RBX: dffffc0000000000 RCX: 897d033a1f052a00 [ 74.742508][ T1392] RDX: 0000000000000000 RSI: 0000000080000000 RDI: 0000000000000000 [ 74.746050][ T1392] RBP: 00000000000006c0 R08: 0000000000000003 R09: 0000000000000004 [ 74.749753][ T1392] R10: dffffc0000000000 R11: fffffbfff1bfae2c R12: ffff88801a2a2dd0 [ 74.753330][ T1392] R13: ffff888038438000 R14: ffff888038437fe8 R15: 0000000000000070 [ 74.756938][ T1392] FS: 0000000000000000(0000) GS:ffff88808d22a000(0000) knlGS:0000000000000000 [ 74.761025][ T1392] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 74.763997][ T1392] CR2: 00007f6c7c9da6b0 CR3: 000000000df3a000 CR4: 0000000000352ef0 [ 74.767633][ T1392] Call Trace: [ 74.769246][ T1392] [ 74.770625][ T1392] ? ip6gre_header+0xc8/0x790 [ 74.772805][ T1392] ? ip6gre_header+0xc8/0x790 [ 74.774885][ T1392] skb_push+0xc3/0xe0 [ 74.776778][ T1392] ip6gre_header+0xc8/0x790 [ 74.778853][ T1392] ? __pfx_ip6gre_header+0x10/0x10 [ 74.781105][ T1392] ? read_seqbegin+0x1ac/0x250 [ 74.783274][ T1392] ? __pfx_read_seqbegin+0x10/0x10 [ 74.785667][ T1392] ? ___neigh_create+0x1c5f/0x2230 [ 74.787952][ T1392] ? __pfx_ip6gre_header+0x10/0x10 [ 74.790249][ T1392] neigh_connected_output+0x286/0x460 [ 74.792726][ T1392] ip6_finish_output2+0xfb3/0x1480 [ 74.795022][ T1392] ? __pfx_ip6_finish_output2+0x10/0x10 [ 74.797605][ T1392] ? ip6_mtu+0x7d/0x490 [ 74.799518][ T1392] ? ip6_mtu+0x7d/0x490 [ 74.801448][ T1392] ip6_finish_output+0x234/0x7d0 [ 74.803738][ T1392] ? ip6_output+0x126/0x550 [ 74.805946][ T1392] ip6_output+0x340/0x550 [ 74.807860][ T1392] NF_HOOK+0x9e/0x380 [ 74.809653][ T1392] ? NF_HOOK+0x101/0x380 [ 74.811585][ T1392] ? __pfx_NF_HOOK+0x10/0x10 [ 74.813745][ T1392] ? __pfx_dst_output+0x10/0x10 [ 74.815946][ T1392] ? icmp6_dst_alloc+0x3a5/0x420 [ 74.818163][ T1392] ? icmp6_dst_alloc+0x3a5/0x420 [ 74.820433][ T1392] mld_sendpack+0x8d4/0xe60 [ 74.822477][ T1392] ? mld_sendpack+0x1e7/0xe60 [ 74.824481][ T1392] ? __pfx_mld_sendpack+0x10/0x10 [ 74.826530][ T1392] mld_ifc_work+0x83e/0xd60 [ 74.828524][ T1392] ? _raw_spin_unlock_irq+0x23/0x50 [ 74.830880][ T1392] ? process_scheduled_works+0x9ef/0x1770 [ 74.833373][ T1392] process_scheduled_works+0xad1/0x1770 [ 74.835908][ T1392] ? __pfx_process_scheduled_works+0x10/0x10 [ 74.838691][ T1392] worker_thread+0x8a0/0xda0 [ 74.840875][ T1392] kthread+0x711/0x8a0 [ 74.842822][ T1392] ? __pfx_worker_thread+0x10/0x10 [ 74.845234][ T1392] ? __pfx_kthread+0x10/0x10 [ 74.847298][ T1392] ? _raw_spin_unlock_irq+0x23/0x50 [ 74.849720][ T1392] ? lockdep_hardirqs_on+0x98/0x140 [ 74.852124][ T1392] ? __pfx_kthread+0x10/0x10 [ 74.854244][ T1392] ret_from_fork+0x599/0xb30 [ 74.856351][ T1392] ? __pfx_ret_from_fork+0x10/0x10 [ 74.858673][ T1392] ? __pfx_kthread+0x10/0x10 [ 74.860695][ T1392] ret_from_fork_asm+0x1a/0x30 [ 74.862837][ T1392] [ 74.864216][ T1392] Modules linked in: [ 74.866246][ T1392] ---[ end trace 0000000000000000 ]---