last executing test programs: 2.05207858s ago: executing program 2 (id=371): bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0x3, 0x4, &(0x7f0000000040)=@framed={{0xffffffb4, 0x5, 0x0, 0x0, 0x0, 0x71, 0x10, 0x7b}, [@ldst={0x6}]}, &(0x7f0000003ff6)='GPL\x00', 0x5, 0xfd96, &(0x7f0000000080)=""/201, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0xfffffffffffffd56, 0x10, &(0x7f0000000000), 0x1dd}, 0x48) 1.931959081s ago: executing program 2 (id=376): r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)=@base={0x2, 0x4, 0x1, 0xbf22}, 0x48) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000440)={{r0, 0xffffffffffffffff}, &(0x7f00000003c0), &(0x7f0000000400)}, 0x20) bpf$MAP_LOOKUP_BATCH(0x18, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000280), &(0x7f0000000380), 0xffffd6c0, r1}, 0x38) r2 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x3, 0xc, &(0x7f0000000000)=ANY=[@ANYBLOB="180000000000000000000000000000008500000022000000180100002020702500000000002020207b0af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000001700000095"], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) syz_emit_ethernet(0x32, &(0x7f00000002c0)=ANY=[@ANYBLOB="ffffffffffff0180c2000000080045000024000000000011"], 0x0) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000240)={r2, 0x0, 0xe40, 0xe40, &(0x7f00000002c0)='\x00\x00\x00\x00\x00\x00\x00\x00', &(0x7f0000000300)=""/8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x4c) 1.207540692s ago: executing program 3 (id=392): r0 = socket$inet6_udplite(0xa, 0x2, 0x88) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(0xffffffffffffffff, 0x89f2, &(0x7f0000000040)={'ip6gre0\x00', 0x0}) bind$alg(0xffffffffffffffff, 0x0, 0x0) setsockopt$ALG_SET_KEY(0xffffffffffffffff, 0x117, 0x1, &(0x7f0000000040)="4dc0", 0x2) r1 = accept4(0xffffffffffffffff, 0x0, 0x0, 0x0) sendmsg$IPCTNL_MSG_TIMEOUT_DEFAULT_GET(0xffffffffffffffff, 0x0, 0x0) syz_genetlink_get_family_id$team(0x0, r1) ioctl$ifreq_SIOCGIFINDEX_wireguard(r0, 0x8933, 0x0) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000b80)={0x6, 0x1, &(0x7f0000000080)=@raw=[@generic={0x0, 0x2, 0xd}], &(0x7f0000000a40)='GPL\x00', 0x0, 0x0, 0x0, 0x40f00, 0x40, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, &(0x7f0000000ac0), 0x8, 0x10, 0x0, 0x0, 0x0, 0x0, 0x2, &(0x7f0000000b00)=[0xffffffffffffffff, 0xffffffffffffffff, 0x1, 0xffffffffffffffff, 0xffffffffffffffff, 0x1, 0x1, 0xffffffffffffffff], &(0x7f0000000b40)=[{0x0, 0x1, 0x0, 0xa}, {0x5, 0x5}], 0x10, 0x5}, 0x90) recvmsg$kcm(0xffffffffffffffff, 0x0, 0x0) openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x275a, 0x0) connect$bt_sco(0xffffffffffffffff, &(0x7f0000000280), 0x8) ioctl$sock_ipv6_tunnel_SIOCADDTUNNEL(r0, 0x89f1, &(0x7f0000000200)={'ip6tnl0\x00', &(0x7f0000000180)={'syztnl2\x00', 0x0, 0x29, 0x6, 0x0, 0x7, 0x20, @loopback, @mcast2, 0x80, 0x0, 0x0, 0x9}}) 1.106445126s ago: executing program 2 (id=394): r0 = socket$inet6_udp(0xa, 0x2, 0x0) bind$alg(0xffffffffffffffff, 0x0, 0x0) r1 = socket(0xa, 0x3, 0x3a) setsockopt$MRT6_DEL_MFC(r1, 0x29, 0xcd, &(0x7f0000000080)={{0xa, 0x0, 0x0, @mcast1}, {0xa, 0x0, 0x0, @dev}}, 0x5c) r2 = socket$pppl2tp(0x18, 0x1, 0x1) connect$pppl2tp(r2, &(0x7f0000000000)=@pppol2tpv3in6={0x18, 0x1, {0x0, r0, 0x400003, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @local}}}, 0x3a) close(r0) r3 = socket$inet6_sctp(0xa, 0x5, 0x84) getsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(r3, 0x84, 0x9, &(0x7f00000005c0)={0x0, @in={{0x2, 0x0, @multicast1}}}, &(0x7f0000000680)=0x9c) bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f00000007c0)={0x1b, 0x0, 0x0, 0x40000, 0x0, 0x0, 0xa, '\x00', 0x0, 0x0, 0x0, 0x1}, 0x48) r4 = socket$vsock_stream(0x28, 0x1, 0x0) setsockopt$SO_VM_SOCKETS_BUFFER_MIN_SIZE(r4, 0x28, 0x1, &(0x7f0000000380)=0xffffffff00000041, 0x8) bind$vsock_stream(r4, &(0x7f0000000440), 0x10) listen(r4, 0x0) r5 = socket$vsock_stream(0x28, 0x1, 0x0) connect$vsock_stream(r5, &(0x7f0000000000)={0x28, 0x0, 0x0, @local}, 0x10) writev(r5, &(0x7f00000002c0)=[{&(0x7f0000000080)='?', 0x20000081}], 0x1) close(r2) 967.959898ms ago: executing program 4 (id=396): r0 = socket(0x2, 0x80805, 0x0) sendmmsg$inet_sctp(0xffffffffffffffff, &(0x7f0000001a40)=[{&(0x7f0000000000)=@in={0x2, 0x0, @private}, 0x10, 0x0}], 0x1, 0x0) r1 = socket$inet(0x2, 0x80001, 0x84) getsockopt$inet_sctp_SCTP_MAX_BURST(r1, 0x84, 0x14, &(0x7f0000000000)=@assoc_value={0x0}, &(0x7f0000000040)=0x8) setsockopt$inet_sctp6_SCTP_DELAYED_SACK(r0, 0x84, 0x10, &(0x7f0000009440)=@assoc_value={r2, 0x9}, 0x8) 908.812392ms ago: executing program 3 (id=398): r0 = socket$inet6_sctp(0xa, 0x5, 0x84) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r0, 0x84, 0x6f, &(0x7f0000000000)={0x0, 0x30, &(0x7f0000000040)=[@in={0x2, 0x4e21, @broadcast}, @in={0x2, 0x4e21, @loopback}, @in={0x2, 0x4e20, @local}]}, &(0x7f0000002100)=0x10) r2 = socket$igmp(0x2, 0x3, 0x2) setsockopt$inet_opts(r2, 0x0, 0x4, &(0x7f0000000040)="e3052a20e3991b03ae9fab14fad049e36162b7925f20e170e95c97af0532f3", 0x1f) bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=@base={0xe, 0x4, 0x8, 0x7}, 0x48) r3 = socket$inet6(0xa, 0x6, 0x0) setsockopt$inet_sctp6_SCTP_PEER_ADDR_THLDS(0xffffffffffffffff, 0x84, 0x85, &(0x7f0000000000)={0x0, @in6={{0xa, 0x0, 0x0, @remote}}}, 0x90) bind$inet6(r3, &(0x7f0000000000)={0xa, 0x4e20}, 0x1c) listen(r3, 0x400) r4 = socket$inet_dccp(0x2, 0x6, 0x0) connect$inet(r4, &(0x7f0000000040)={0x2, 0x4e20, @loopback}, 0x10) r5 = socket$netlink(0x10, 0x3, 0x0) writev(r5, &(0x7f0000000040), 0x0) close(0xffffffffffffffff) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000100)={0x17, 0x1f, 0x0, &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0xe}, 0x90) r6 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=@base={0x6, 0x4, 0x8, 0x8}, 0x48) r7 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0xc, 0xc, &(0x7f0000000280)=@framed={{}, [@ringbuf_output={{0x18, 0x5, 0x1, 0x0, r6}, {}, {}, {}, {}, {}, {0x7, 0x0, 0xb, 0x4, 0x0, 0x0, 0x1}, {0x85, 0x0, 0x0, 0x15}}]}, &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000600)={r7, 0x0, 0xe, 0x0, &(0x7f0000000100)="e0857f9f582f0300000000000000", 0x0, 0x2e00, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) sendto$inet(r4, &(0x7f0000000080)='!', 0xffc3, 0x0, 0x0, 0x0) accept$inet6(r3, &(0x7f00000000c0)={0xa, 0x0, 0x0, @dev}, 0x0) r8 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$ETHTOOL_MSG_DEBUG_SET(r8, &(0x7f0000001540)={0x0, 0x0, &(0x7f0000000100)={&(0x7f00000001c0)=ANY=[@ANYBLOB='D\x00\x00\x00', @ANYRES16, @ANYBLOB="0100000000000000000008000000180001801400020073797a5f74756e000000000000000000180002800400010008000400000005000800020020a427cac9bd3c35fffb606840a84822"], 0x44}}, 0x0) r9 = socket$inet6_sctp(0xa, 0x5, 0x84) getsockopt$inet_sctp6_SCTP_MAXSEG(r9, 0x84, 0xd, &(0x7f0000000080)=@assoc_id=r1, &(0x7f00000000c0)=0x4) 758.772138ms ago: executing program 4 (id=402): r0 = socket$inet6(0xa, 0x2, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$nl_route(r2, &(0x7f0000000380)={0x0, 0x4076cbba9945d516, &(0x7f0000000340)={0x0, 0x14}}, 0x0) getsockname$packet(r2, &(0x7f0000000140)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000240)=ANY=[@ANYBLOB="500000001000390400"/20, @ANYRES32=r3, @ANYBLOB="01980000000000003000128008000100677265002400028006000e0001000000060000004e220000080007000a"], 0x50}}, 0x0) sendmmsg$inet(r0, &(0x7f0000005ac0)=[{{&(0x7f0000000180)={0x2, 0x4e21, @initdev={0xac, 0x1e, 0x0, 0x0}}, 0x10, 0x0, 0x0, &(0x7f0000000400)=[@ip_pktinfo={{0x1c, 0x0, 0x8, {r3, @local, @local}}}], 0x20}}], 0x1, 0x0) 702.056559ms ago: executing program 1 (id=403): r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000001c0)={0x1c, 0x35, 0x107, 0x0, 0x0, {0xa, 0x7c}, [@typed={0x8, 0x1, 0x0, 0x0, @pid}]}, 0x1c}}, 0x0) 627.149987ms ago: executing program 0 (id=404): r0 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$IPT_SO_SET_REPLACE(r0, 0x8001000000000000, 0x40, &(0x7f0000000900)=@raw={'raw\x00', 0x8, 0x3, 0x2d0, 0x110, 0x18c, 0x148, 0x0, 0x0, 0x238, 0x2a8, 0x2a8, 0x238, 0x2a8, 0x3, 0x0, {[{{@ip={@dev, @remote, 0x0, 0x0, 'gretap0\x00', 'veth0_to_bond\x00'}, 0x0, 0xb0, 0x110, 0x0, {}, [@common=@unspec=@connlimit={{0x40}}]}, @common=@SET={0x60, 'SET\x00', 0x0, {{0xffffffffffffffff, [0x6, 0x2, 0x6]}, {0xffffffffffffffff}}}}, {{@ip={@remote, @initdev={0xac, 0x1e, 0x0, 0x0}, 0x0, 0x0, 'veth0_to_bridge\x00', 'geneve1\x00'}, 0x0, 0x100, 0x128, 0x0, {}, [@common=@unspec=@rateest={{0x68}, {'rose0\x00', 'geneve1\x00'}}, @common=@inet=@tos={{0x28}}]}, @common=@unspec=@NFQUEUE2={0x28}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x330) 593.249096ms ago: executing program 3 (id=405): unshare(0x400) r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x5, 0x0) connect$bt_l2cap(r0, 0x0, 0x0) 560.538089ms ago: executing program 2 (id=406): r0 = socket$qrtr(0x2a, 0x2, 0x0) connect$qrtr(r0, &(0x7f0000000080), 0xc) read(r0, &(0x7f00000001c0)=""/149, 0x95) r1 = socket$qrtr(0x2a, 0x2, 0x0) ioctl$sock_TIOCOUTQ(r0, 0x891b, 0x0) connect$qrtr(r1, &(0x7f0000000040)={0x2a, 0x1, 0x4000}, 0xc) write$binfmt_script(r1, 0x0, 0x0) 541.196519ms ago: executing program 1 (id=407): r0 = syz_genetlink_get_family_id$nl80211(&(0x7f00000000c0), 0xffffffffffffffff) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f0000000a40)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_TDLS_MGMT(r2, &(0x7f0000000b40)={0x0, 0x0, &(0x7f0000000b00)={&(0x7f0000000a80)={0x1c, r0, 0x1, 0x0, 0x0, {{}, {@val={0x8, 0x3, r3}, @void}}}, 0x1c}}, 0x0) 501.055006ms ago: executing program 3 (id=408): r0 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0x13, &(0x7f0000000280)=@framed={{}, [@printk={@lu}, @printk={@lx, {}, {}, {}, {}, {}, {0x85, 0x0, 0x0, 0x10}}]}, &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000600)={&(0x7f00000005c0)='sys_enter\x00', r0}, 0x10) syz_open_procfs$namespace(0x0, &(0x7f0000001a80)='ns/pid_for_children\x00') 452.782977ms ago: executing program 0 (id=409): r0 = socket$tipc(0x1e, 0x2, 0x0) bind$tipc(r0, &(0x7f0000000180)=@nameseq={0x1e, 0x1, 0x0, {0x41, 0x4, 0x4}}, 0x10) r1 = socket$tipc(0x1e, 0x2, 0x0) bind$tipc(r1, &(0x7f0000000180)=@nameseq={0x1e, 0x1, 0x0, {0x41, 0x0, 0x4}}, 0x10) bind$tipc(r1, &(0x7f0000000000)=@nameseq={0x1e, 0x1, 0x0, {0x41}}, 0x10) setsockopt$TIPC_GROUP_JOIN(r1, 0x10f, 0x87, &(0x7f0000000240)={0x41, 0x2}, 0x10) r2 = socket$tipc(0x1e, 0x2, 0x0) sendmsg$tipc(r2, &(0x7f0000000840)={&(0x7f0000000080)=@nameseq={0x1e, 0x1, 0x0, {0x41, 0x3, 0x4}}, 0x55, 0x0}, 0x0) 430.043889ms ago: executing program 1 (id=410): r0 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000340)={0x2, 0x4, 0x8, 0x1, 0x80, 0x0, 0x0, '\x00', 0x0, 0x0}, 0x48) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000000)='hugetlb.1GB.usage_in_bytes\x00', 0x275a, 0x0) mmap(&(0x7f0000001000/0x4000)=nil, 0x4000, 0x0, 0x13, r1, 0x0) unshare(0x6020400) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000400)={0x18, 0x10, &(0x7f0000000000)=@framed={{}, [@snprintf={{}, {0x3, 0x3, 0x3, 0xa, 0xa}, {0x5}, {}, {}, {}, {}, {}, {}, {0x18, 0x3, 0x2, 0x0, r0, 0x0, 0x0, 0x0, 0x8}, {}, {0x85, 0x0, 0x0, 0x69}}]}, &(0x7f0000000300)='GPL\x00', 0x4, 0xff7, &(0x7f0000001e00)=""/4087}, 0x90) 408.082887ms ago: executing program 4 (id=411): r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000180)='memory.events\x00', 0x275a, 0x0) ioctl$FS_IOC_FSSETXATTR(r0, 0x401c5820, &(0x7f0000000080)={0x8}) ioctl$FS_IOC_FSSETXATTR(r0, 0x401c5820, &(0x7f0000000000)={0x8}) syz_emit_ethernet(0xa6, &(0x7f0000000680)={@random="c121d5857875", @dev, @void, {@ipv6={0x86dd, @icmpv6={0x0, 0x6, "0000d0", 0x70, 0x3a, 0xff, @dev, @mcast2, {[], @ndisc_ra={0x86, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, [{0x19, 0xa, "a78ce5400659808000000000004023493b87aafaffffffffffffff23732472eefa45ad96579269748e254c1e4a8a8b3f0ab0c430d3be27df3e34066d42ca0a5c15b37adac15084dbaf736b41e5af2502"}, {0x0, 0x1, "000000190000001995319c00"}]}}}}}}, 0x0) 366.614953ms ago: executing program 3 (id=412): r0 = socket(0x2, 0x80805, 0x0) sendmmsg$inet_sctp(0xffffffffffffffff, &(0x7f0000001a40)=[{&(0x7f0000000000)=@in={0x2, 0x0, @private}, 0x10, 0x0}], 0x1, 0x0) r1 = socket$inet(0x2, 0x80001, 0x84) getsockopt$inet_sctp_SCTP_MAX_BURST(r1, 0x84, 0x14, &(0x7f0000000000)=@assoc_value={0x0}, &(0x7f0000000040)=0x8) setsockopt$inet_sctp6_SCTP_DELAYED_SACK(r0, 0x84, 0x10, &(0x7f0000009440)=@assoc_value={r2, 0x9}, 0x8) 334.260323ms ago: executing program 0 (id=413): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000380)={{0x14}, [@NFT_MSG_NEWTABLE={0x20, 0x0, 0xa, 0x801, 0x0, 0x0, {0x1}, [@NFTA_TABLE_NAME={0x9, 0x1, 'syz0\x00'}]}, @NFT_MSG_NEWCHAIN={0x48, 0x3, 0xa, 0x201, 0x0, 0x0, {0x1}, [@NFTA_CHAIN_TYPE={0x8, 0x7, 'nat\x00'}, @NFTA_CHAIN_NAME={0x9, 0x3, 'syz1\x00'}, @NFTA_CHAIN_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_CHAIN_HOOK={0x14, 0x4, 0x0, 0x1, [@NFTA_HOOK_HOOKNUM={0x8}, @NFTA_HOOK_PRIORITY={0x8, 0x2, 0x1, 0x0, 0x9cffffff}]}]}], {0x14}}, 0x90}}, 0x0) 298.617567ms ago: executing program 4 (id=414): r0 = socket$pppoe(0x18, 0x1, 0x0) connect$pppoe(r0, &(0x7f0000000080)={0x18, 0x0, {0x2, @local, 'veth1_to_hsr\x00'}}, 0x1e) ioctl$PPPIOCGCHAN(r0, 0x80047437, &(0x7f0000000000)) recvmmsg(r0, &(0x7f0000000f00)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0) 294.302412ms ago: executing program 1 (id=415): bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000340)={0x11, 0x4, &(0x7f0000000040)=@framed={{}, [@generic={0x20}]}, &(0x7f0000000100)='GPL\x00', 0x9}, 0x90) 281.113889ms ago: executing program 2 (id=416): bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000300)={&(0x7f00000001c0)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0x10, 0x10, 0x39, [@int]}, {0x0, [0x0, 0x0, 0x0]}}, &(0x7f00000003c0)=""/224, 0x2d, 0xd0, 0x1}, 0x1a) 271.205752ms ago: executing program 0 (id=417): r0 = socket$inet6_sctp(0xa, 0x801, 0x84) sendto$inet6(r0, &(0x7f00000001c0)="c2", 0x1, 0x0, &(0x7f0000000000)={0xa, 0x0, 0x0, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01'}, 0x1c) shutdown(r0, 0x1) r1 = socket$inet(0x2, 0x80001, 0x84) getsockopt$inet_sctp_SCTP_MAX_BURST(r1, 0x84, 0x14, &(0x7f0000000000)=@assoc_value={0x0}, &(0x7f0000000040)=0x8) getsockopt$inet_sctp6_SCTP_LOCAL_AUTH_CHUNKS(r0, 0x84, 0x6d, &(0x7f0000000080)={r2}, &(0x7f0000000180)=0x8) 169.428317ms ago: executing program 1 (id=418): bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0xe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0xf00, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x55}, 0x90) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='memory.events\x00', 0x275a, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x275a, 0x0) write$binfmt_script(r0, &(0x7f0000000100), 0xfecc) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1, 0x12, r1, 0x0) r2 = socket(0xa, 0x6, 0x0) getsockopt$inet6_mreq(r2, 0x10d, 0xd6, 0x0, &(0x7f0000000080)) 161.796196ms ago: executing program 3 (id=419): r0 = syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10) sendmsg$netlink(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000001ac0)=[{&(0x7f0000003080)={0x29c, 0x23, 0x1, 0x0, 0x0, "", [@nested={0x267, 0x0, 0x0, 0x1, [@typed={0xc, 0x1, 0x0, 0x0, @u64=0x2}, @typed={0x14, 0x0, 0x0, 0x0, @ipv6=@rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02'}, @generic="50bb2d6f67d29d6fabadb107d0def49c88ea04abde1d5e8d3fb22a1b5046778bdafefc46b0449ade68bf84b36ec72dd71265fc2e882348c26c2126237dd5b37f5ae655b1086cda40e00aec58754734be31d750351dc076060000001dc08c029d1608a487f26fbe8101000000010000008b9482565856555ee923c65973deb0a99b962bc0fe94a3fcae3697bd7b85b3a682167c43dbf137115a40ebddcad74875ec58e9a3ddb9ad02a078cf0d972df9e99f079767734f69ce475f55ac64337803f5eb4e5842f4d98fe3fa370d47eb640dc5061dc35817c8a66c29be82fd8c25027ee5251b46fd001ade28bc17a024928a1016d5a00b82c159f270ed9b3ad1622d034b0d859ad83cd4e4238574a6fdc4499a8076c32959ea31bb6b744b0a96fc1a59ac4d04424911934049d65d97cfc11806fb0619ba4007af3f0110c92f826d2f90c3d50c7591625f40e6f6b163f5caefea45f5f606467719022a4a538ae03e99562aed5a0cca18b134fa238be21c9d0474216cb250ee441f04d4343f6a69cfac2964b49e3329675346e12e236f2ec2a5dbb8cad405bd6ba1e8e4b05948466dd5fe8b4b6cbc857637ef614020d4a7a53f0d6f368916dfff6e70e6193511a11753bcd004286b2bd70d155da5ea550aa65b09d671efe57cb69939837c5a1034812c604327647676fdde5dfa52a082d74c8ff1f6e0aa5af8ec650ac86f0c22cc03843b8d2156063dbd1be2f7f25f45107bacfad348b681135a98bd19783f50feffffffffffffff6785bccbaf2d32e35a03b01472f81078b878f6b8d0920cfc597633ec8e411a46154a7e87d89b0863c5b3217e35b0033d1b9b4c52886981a716b79c847dd01200c7242b"]}]}, 0x29c}], 0x1}, 0x0) 161.456992ms ago: executing program 4 (id=420): r0 = syz_genetlink_get_family_id$nl80211(&(0x7f00000000c0), 0xffffffffffffffff) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f0000000a40)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_TDLS_MGMT(r2, &(0x7f0000000b40)={0x0, 0x0, &(0x7f0000000b00)={&(0x7f0000000a80)={0x1c, r0, 0x1, 0x0, 0x0, {{}, {@val={0x8, 0x3, r3}, @void}}}, 0x1c}}, 0x0) 156.936804ms ago: executing program 0 (id=421): bpf$PROG_LOAD(0x5, 0x0, 0x0) bpf$PROG_LOAD_XDP(0x5, 0x0, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x0, 0xc, &(0x7f0000000440)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) r0 = syz_genetlink_get_family_id$batadv(0x0, 0xffffffffffffffff) sendmsg$BATADV_CMD_TP_METER_CANCEL(0xffffffffffffffff, &(0x7f0000000300)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x10000000}, 0xc, &(0x7f00000002c0)={&(0x7f0000000240)={0x24, r0, 0x8, 0x70bd2a, 0x25dfdbfe, {}, [@BATADV_ATTR_MULTICAST_FANOUT={0x8, 0x3c, 0x2}, @BATADV_ATTR_VLANID={0x6, 0x28, 0x3}]}, 0x24}}, 0x4000000) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r1, 0x0, 0x0) sendmsg$NFT_BATCH(r1, 0x0, 0x0) bpf$PROG_LOAD_XDP(0x5, &(0x7f00000001c0)={0x12, 0x4, &(0x7f0000000000)=@framed={{}, [@call={0x85, 0x0, 0x0, 0x31}]}, &(0x7f0000000140)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x8}, 0x90) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) r2 = socket$pppl2tp(0x18, 0x1, 0x1) r3 = socket$pppl2tp(0x18, 0x1, 0x1) r4 = socket$inet_udp(0x2, 0x2, 0x0) connect$pppl2tp(r3, &(0x7f0000000980)=@pppol2tpin6={0x18, 0x1, {0x0, r4, 0x1, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @local}}}, 0x32) connect$pppl2tp(r2, &(0x7f0000000980)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @private}, 0x1, 0x2}}, 0x26) getsockopt$bt_BT_SECURITY(r2, 0x111, 0x5, 0x0, 0x20001f00) ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8b0f, 0x0) bind$alg(0xffffffffffffffff, 0x0, 0x0) r5 = socket(0x200000100000011, 0x803, 0x0) r6 = socket$packet(0x11, 0x2, 0x300) ioctl$sock_SIOCGIFINDEX(r6, 0x8933, &(0x7f0000000040)={'xfrm0\x00', 0x0}) sendto$packet(r5, &(0x7f00000000c0)="4dcdc7d96a760000002f00050000000000060000450b21e9e89291df563213e9152234f5623c526156de8ae4ae9150d3d2dd194a", 0x34, 0x0, &(0x7f0000000000)={0x11, 0x0, r7, 0x1, 0x0, 0x6, @dev}, 0x14) 129.899335ms ago: executing program 2 (id=422): r0 = socket$inet6(0xa, 0x2, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$nl_route(r2, &(0x7f0000000380)={0x0, 0x4076cbba9945d516, &(0x7f0000000340)={0x0, 0x14}}, 0x0) getsockname$packet(r2, &(0x7f0000000140)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000240)=ANY=[@ANYBLOB="500000001000390400"/20, @ANYRES32=r3, @ANYBLOB="01980000000000003000128008000100677265002400028006000e0001000000060000004e220000080007000a"], 0x50}}, 0x0) sendmmsg$inet(r0, &(0x7f0000005ac0)=[{{&(0x7f0000000180)={0x2, 0x4e21, @initdev={0xac, 0x1e, 0x0, 0x0}}, 0x10, 0x0, 0x0, &(0x7f0000000400)=[@ip_pktinfo={{0x1c, 0x0, 0x8, {r3, @local, @local}}}], 0x20}}], 0x1, 0x0) 57.630719ms ago: executing program 4 (id=423): sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x0, &(0x7f0000000000)={0x2, 0x0, @remote}, 0x10) r0 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000100)={'netdevsim0\x00', 0x0}) r2 = bpf$MAP_CREATE(0x0, &(0x7f00000004c0)=@base={0x1, 0x3, 0x261, 0x2, 0x0, 0xffffffffffffffff, 0x0, '\x00', r1}, 0x48) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000140)={r2, &(0x7f0000000000), &(0x7f0000000080)=@udp}, 0x20) bpf$MAP_UPDATE_CONST_STR(0x2, &(0x7f0000000d80)={{r2}, &(0x7f0000000d00), &(0x7f0000000d40)='%pB \x00'}, 0x20) bpf$MAP_DELETE_ELEM(0x3, &(0x7f0000000040)={r2}, 0x20) bpf$MAP_GET_NEXT_KEY(0x3, &(0x7f0000000280)={r2, &(0x7f0000000340), 0x0}, 0x20) 11.103364ms ago: executing program 0 (id=424): r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000180)='memory.events\x00', 0x275a, 0x0) ioctl$FS_IOC_FSSETXATTR(r0, 0x401c5820, &(0x7f0000000080)={0x8}) ioctl$FS_IOC_FSSETXATTR(r0, 0x401c5820, &(0x7f0000000000)={0x8}) syz_emit_ethernet(0xa6, &(0x7f0000000680)={@random="c121d5857875", @dev, @void, {@ipv6={0x86dd, @icmpv6={0x0, 0x6, "0000d0", 0x70, 0x3a, 0xff, @dev, @mcast2, {[], @ndisc_ra={0x86, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, [{0x19, 0xa, "a78ce5400659808000000000004023493b87aafaffffffffffffff23732472eefa45ad96579269748e254c1e4a8a8b3f0ab0c430d3be27df3e34066d42ca0a5c15b37adac15084dbaf736b41e5af2502"}, {0x0, 0x1, "000000190000001995319c00"}]}}}}}}, 0x0) 0s ago: executing program 1 (id=425): ioctl$SIOCX25GCALLUSERDATA(0xffffffffffffffff, 0x89e4, 0x0) sendmsg$FOU_CMD_ADD(0xffffffffffffffff, 0x0, 0x0) socket$inet_tcp(0x2, 0x1, 0x0) socket$inet6_sctp(0xa, 0x0, 0x84) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) close(r0) r1 = socket$inet6_mptcp(0xa, 0x1, 0x106) bind$inet6(r0, &(0x7f0000000040)={0xa, 0x4e22, 0x0, @empty}, 0x1c) listen(r1, 0x5) r2 = socket$inet_mptcp(0x2, 0x1, 0x106) connect$inet(r2, &(0x7f0000000000)={0x2, 0x4e22, @local}, 0x10) r3 = accept(r0, 0x0, 0x0) sendmsg$TEAM_CMD_OPTIONS_SET(r3, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000080)=ANY=[], 0xfffffdef}}, 0x0) recvfrom(r2, &(0x7f0000000180)=""/60, 0xfffffffffffffecb, 0x0, 0x0, 0x0) kernel console output (not intermixed with test programs): Warning: Permanently added '10.128.0.193' (ED25519) to the list of known hosts. [ 48.015979][ T5080] cgroup: Unknown subsys name 'net' [ 48.152494][ T5080] cgroup: Unknown subsys name 'rlimit' Setting up swapspace version 1, size = 127995904 bytes [ 49.493258][ T5080] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 50.055685][ T5097] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 50.064294][ T5097] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 50.084894][ T5101] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 50.093812][ T5099] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 50.103134][ T5099] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 50.110407][ T5102] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 50.118563][ T5102] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 50.125980][ T5102] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 50.133486][ T5102] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 50.140296][ T5108] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 50.141794][ T5102] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 50.148225][ T5108] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 50.155731][ T5102] Bluetooth: hci4: unexpected cc 0x0c03 length: 249 > 1 [ 50.171100][ T5102] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 50.173341][ T5109] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 50.178414][ T5102] Bluetooth: hci4: unexpected cc 0x1003 length: 249 > 9 [ 50.185551][ T5108] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 50.200751][ T5102] Bluetooth: hci0: unexpected cc 0x0c25 length: 249 > 3 [ 50.201907][ T5108] Bluetooth: hci2: unexpected cc 0x0c25 length: 249 > 3 [ 50.208660][ T5112] Bluetooth: hci1: unexpected cc 0x0c25 length: 249 > 3 [ 50.215185][ T5108] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 50.222252][ T5112] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 50.229298][ T5108] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 50.238513][ T4496] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 50.250798][ T4496] Bluetooth: hci4: unexpected cc 0x1001 length: 249 > 9 [ 50.274325][ T5108] Bluetooth: hci3: unexpected cc 0x0c25 length: 249 > 3 [ 50.282617][ T5108] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 50.289825][ T4496] Bluetooth: hci4: unexpected cc 0x0c23 length: 249 > 4 [ 50.298734][ T4496] Bluetooth: hci4: unexpected cc 0x0c25 length: 249 > 3 [ 50.311790][ T5108] Bluetooth: hci4: unexpected cc 0x0c38 length: 249 > 2 [ 50.787463][ T5098] chnl_net:caif_netlink_parms(): no params data found [ 50.839936][ T5093] chnl_net:caif_netlink_parms(): no params data found [ 50.900070][ T5092] chnl_net:caif_netlink_parms(): no params data found [ 50.929393][ T5100] chnl_net:caif_netlink_parms(): no params data found [ 51.091031][ T5098] bridge0: port 1(bridge_slave_0) entered blocking state [ 51.099900][ T5098] bridge0: port 1(bridge_slave_0) entered disabled state [ 51.107869][ T5098] bridge_slave_0: entered allmulticast mode [ 51.115308][ T5098] bridge_slave_0: entered promiscuous mode [ 51.142662][ T5093] bridge0: port 1(bridge_slave_0) entered blocking state [ 51.152472][ T5093] bridge0: port 1(bridge_slave_0) entered disabled state [ 51.159861][ T5093] bridge_slave_0: entered allmulticast mode [ 51.167401][ T5093] bridge_slave_0: entered promiscuous mode [ 51.175383][ T5093] bridge0: port 2(bridge_slave_1) entered blocking state [ 51.182520][ T5093] bridge0: port 2(bridge_slave_1) entered disabled state [ 51.189814][ T5093] bridge_slave_1: entered allmulticast mode [ 51.197397][ T5093] bridge_slave_1: entered promiscuous mode [ 51.204982][ T5098] bridge0: port 2(bridge_slave_1) entered blocking state [ 51.212055][ T5098] bridge0: port 2(bridge_slave_1) entered disabled state [ 51.219619][ T5098] bridge_slave_1: entered allmulticast mode [ 51.226378][ T5098] bridge_slave_1: entered promiscuous mode [ 51.258019][ T5092] bridge0: port 1(bridge_slave_0) entered blocking state [ 51.265287][ T5092] bridge0: port 1(bridge_slave_0) entered disabled state [ 51.272484][ T5092] bridge_slave_0: entered allmulticast mode [ 51.279525][ T5092] bridge_slave_0: entered promiscuous mode [ 51.318440][ T5110] chnl_net:caif_netlink_parms(): no params data found [ 51.339663][ T5092] bridge0: port 2(bridge_slave_1) entered blocking state [ 51.349265][ T5092] bridge0: port 2(bridge_slave_1) entered disabled state [ 51.356572][ T5092] bridge_slave_1: entered allmulticast mode [ 51.363312][ T5092] bridge_slave_1: entered promiscuous mode [ 51.393551][ T5098] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 51.421374][ T5100] bridge0: port 1(bridge_slave_0) entered blocking state [ 51.429026][ T5100] bridge0: port 1(bridge_slave_0) entered disabled state [ 51.436687][ T5100] bridge_slave_0: entered allmulticast mode [ 51.443443][ T5100] bridge_slave_0: entered promiscuous mode [ 51.463629][ T5093] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 51.477970][ T5098] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 51.506647][ T5100] bridge0: port 2(bridge_slave_1) entered blocking state [ 51.513817][ T5100] bridge0: port 2(bridge_slave_1) entered disabled state [ 51.521170][ T5100] bridge_slave_1: entered allmulticast mode [ 51.528626][ T5100] bridge_slave_1: entered promiscuous mode [ 51.550739][ T5092] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 51.562039][ T5093] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 51.631012][ T5100] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 51.643050][ T5092] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 51.666821][ T5093] team0: Port device team_slave_0 added [ 51.684048][ T5098] team0: Port device team_slave_0 added [ 51.692271][ T5100] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 51.725811][ T5093] team0: Port device team_slave_1 added [ 51.743842][ T5098] team0: Port device team_slave_1 added [ 51.823130][ T5098] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 51.830402][ T5098] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 51.857441][ T5098] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 51.872699][ T5100] team0: Port device team_slave_0 added [ 51.891514][ T5093] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 51.898595][ T5093] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 51.924764][ T5093] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 51.939409][ T5092] team0: Port device team_slave_0 added [ 51.945939][ T5110] bridge0: port 1(bridge_slave_0) entered blocking state [ 51.953140][ T5110] bridge0: port 1(bridge_slave_0) entered disabled state [ 51.960831][ T5110] bridge_slave_0: entered allmulticast mode [ 51.968378][ T5110] bridge_slave_0: entered promiscuous mode [ 51.976877][ T5110] bridge0: port 2(bridge_slave_1) entered blocking state [ 51.984080][ T5110] bridge0: port 2(bridge_slave_1) entered disabled state [ 51.991604][ T5110] bridge_slave_1: entered allmulticast mode [ 51.999452][ T5110] bridge_slave_1: entered promiscuous mode [ 52.006880][ T5098] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 52.013827][ T5098] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 52.039991][ T5098] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 52.053263][ T5100] team0: Port device team_slave_1 added [ 52.069929][ T5093] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 52.077448][ T5093] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 52.103417][ T5093] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 52.123992][ T5092] team0: Port device team_slave_1 added [ 52.168170][ T5100] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 52.175573][ T5100] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 52.202361][ T5100] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 52.216024][ T5100] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 52.222988][ T5100] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 52.249144][ T5100] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 52.286038][ T5099] Bluetooth: hci0: command tx timeout [ 52.286051][ T5108] Bluetooth: hci1: command tx timeout [ 52.286314][ T5108] Bluetooth: hci2: command tx timeout [ 52.293922][ T5110] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 52.331276][ T5092] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 52.338395][ T5092] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 52.364675][ T5108] Bluetooth: hci3: command tx timeout [ 52.364862][ T5101] Bluetooth: hci4: command tx timeout [ 52.370725][ T5092] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 52.390090][ T5110] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 52.425523][ T5093] hsr_slave_0: entered promiscuous mode [ 52.432311][ T5093] hsr_slave_1: entered promiscuous mode [ 52.441542][ T5092] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 52.450535][ T5092] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 52.477059][ T5092] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 52.543970][ T5098] hsr_slave_0: entered promiscuous mode [ 52.550582][ T5098] hsr_slave_1: entered promiscuous mode [ 52.559742][ T5098] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 52.567581][ T5098] Cannot create hsr debugfs directory [ 52.577106][ T5110] team0: Port device team_slave_0 added [ 52.621907][ T5110] team0: Port device team_slave_1 added [ 52.643334][ T5100] hsr_slave_0: entered promiscuous mode [ 52.650827][ T5100] hsr_slave_1: entered promiscuous mode [ 52.657535][ T5100] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 52.665605][ T5100] Cannot create hsr debugfs directory [ 52.730036][ T5110] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 52.737428][ T5110] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 52.763536][ T5110] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 52.777102][ T5110] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 52.784072][ T5110] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 52.811428][ T5110] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 52.842116][ T5092] hsr_slave_0: entered promiscuous mode [ 52.848729][ T5092] hsr_slave_1: entered promiscuous mode [ 52.855026][ T5092] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 52.862596][ T5092] Cannot create hsr debugfs directory [ 53.030896][ T5110] hsr_slave_0: entered promiscuous mode [ 53.037684][ T5110] hsr_slave_1: entered promiscuous mode [ 53.043743][ T5110] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 53.051545][ T5110] Cannot create hsr debugfs directory [ 53.334489][ T5093] netdevsim netdevsim2 netdevsim0: renamed from eth0 [ 53.361163][ T5093] netdevsim netdevsim2 netdevsim1: renamed from eth1 [ 53.381156][ T5093] netdevsim netdevsim2 netdevsim2: renamed from eth2 [ 53.392128][ T5093] netdevsim netdevsim2 netdevsim3: renamed from eth3 [ 53.446234][ T5100] netdevsim netdevsim4 netdevsim0: renamed from eth0 [ 53.465506][ T5100] netdevsim netdevsim4 netdevsim1: renamed from eth1 [ 53.475415][ T5100] netdevsim netdevsim4 netdevsim2: renamed from eth2 [ 53.500449][ T5100] netdevsim netdevsim4 netdevsim3: renamed from eth3 [ 53.595375][ T5098] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 53.610637][ T5098] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 53.632628][ T5098] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 53.643809][ T5098] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 53.731088][ T5092] netdevsim netdevsim1 netdevsim0: renamed from eth0 [ 53.762172][ T5092] netdevsim netdevsim1 netdevsim1: renamed from eth1 [ 53.808556][ T5110] netdevsim netdevsim3 netdevsim0: renamed from eth0 [ 53.823126][ T5092] netdevsim netdevsim1 netdevsim2: renamed from eth2 [ 53.846657][ T5110] netdevsim netdevsim3 netdevsim1: renamed from eth1 [ 53.856221][ T5092] netdevsim netdevsim1 netdevsim3: renamed from eth3 [ 53.880140][ T5093] 8021q: adding VLAN 0 to HW filter on device bond0 [ 53.890616][ T5110] netdevsim netdevsim3 netdevsim2: renamed from eth2 [ 53.911956][ T5110] netdevsim netdevsim3 netdevsim3: renamed from eth3 [ 53.955863][ T5100] 8021q: adding VLAN 0 to HW filter on device bond0 [ 54.015705][ T5100] 8021q: adding VLAN 0 to HW filter on device team0 [ 54.026054][ T5093] 8021q: adding VLAN 0 to HW filter on device team0 [ 54.056905][ T5145] bridge0: port 1(bridge_slave_0) entered blocking state [ 54.064316][ T5145] bridge0: port 1(bridge_slave_0) entered forwarding state [ 54.101159][ T5145] bridge0: port 2(bridge_slave_1) entered blocking state [ 54.108334][ T5145] bridge0: port 2(bridge_slave_1) entered forwarding state [ 54.122959][ T5145] bridge0: port 1(bridge_slave_0) entered blocking state [ 54.130071][ T5145] bridge0: port 1(bridge_slave_0) entered forwarding state [ 54.158528][ T5145] bridge0: port 2(bridge_slave_1) entered blocking state [ 54.165754][ T5145] bridge0: port 2(bridge_slave_1) entered forwarding state [ 54.203294][ T5098] 8021q: adding VLAN 0 to HW filter on device bond0 [ 54.283373][ T5098] 8021q: adding VLAN 0 to HW filter on device team0 [ 54.328201][ T5145] bridge0: port 1(bridge_slave_0) entered blocking state [ 54.335405][ T5145] bridge0: port 1(bridge_slave_0) entered forwarding state [ 54.366438][ T5101] Bluetooth: hci0: command tx timeout [ 54.366447][ T5108] Bluetooth: hci1: command tx timeout [ 54.373319][ T785] bridge0: port 2(bridge_slave_1) entered blocking state [ 54.384375][ T785] bridge0: port 2(bridge_slave_1) entered forwarding state [ 54.391959][ T5101] Bluetooth: hci2: command tx timeout [ 54.445500][ T5101] Bluetooth: hci3: command tx timeout [ 54.445704][ T5108] Bluetooth: hci4: command tx timeout [ 54.487997][ T5092] 8021q: adding VLAN 0 to HW filter on device bond0 [ 54.559142][ T5098] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 54.583620][ T5092] 8021q: adding VLAN 0 to HW filter on device team0 [ 54.610735][ T5110] 8021q: adding VLAN 0 to HW filter on device bond0 [ 54.637762][ T784] bridge0: port 1(bridge_slave_0) entered blocking state [ 54.644984][ T784] bridge0: port 1(bridge_slave_0) entered forwarding state [ 54.711330][ T5093] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 54.726590][ T5146] bridge0: port 2(bridge_slave_1) entered blocking state [ 54.733855][ T5146] bridge0: port 2(bridge_slave_1) entered forwarding state [ 54.782964][ T5110] 8021q: adding VLAN 0 to HW filter on device team0 [ 54.828887][ T5145] bridge0: port 1(bridge_slave_0) entered blocking state [ 54.836087][ T5145] bridge0: port 1(bridge_slave_0) entered forwarding state [ 54.889967][ T5145] bridge0: port 2(bridge_slave_1) entered blocking state [ 54.897212][ T5145] bridge0: port 2(bridge_slave_1) entered forwarding state [ 54.921015][ T5100] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 55.001819][ T5093] veth0_vlan: entered promiscuous mode [ 55.032633][ T5093] veth1_vlan: entered promiscuous mode [ 55.068171][ T5098] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 55.247313][ T5093] veth0_macvtap: entered promiscuous mode [ 55.260992][ T5098] veth0_vlan: entered promiscuous mode [ 55.281916][ T5098] veth1_vlan: entered promiscuous mode [ 55.303584][ T5093] veth1_macvtap: entered promiscuous mode [ 55.328003][ T5092] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 55.394279][ T5093] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 55.411502][ T5093] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 55.430987][ T5098] veth0_macvtap: entered promiscuous mode [ 55.452536][ T5093] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 55.471090][ T5093] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 55.500273][ T5093] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 55.509247][ T5093] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 55.549112][ T5098] veth1_macvtap: entered promiscuous mode [ 55.601192][ T5110] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 55.622733][ T5098] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 55.636099][ T5098] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 55.651315][ T5098] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 55.663724][ T5098] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 55.676263][ T5098] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 55.687914][ T5098] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 55.737242][ T5098] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 55.747042][ T5098] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 55.755926][ T5098] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 55.765403][ T5098] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 55.802927][ T5092] veth0_vlan: entered promiscuous mode [ 55.847036][ T5100] veth0_vlan: entered promiscuous mode [ 55.867382][ T1101] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 55.876025][ T1101] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 55.901125][ T5092] veth1_vlan: entered promiscuous mode [ 55.913508][ T5110] veth0_vlan: entered promiscuous mode [ 55.954303][ T5110] veth1_vlan: entered promiscuous mode [ 55.977010][ T5100] veth1_vlan: entered promiscuous mode [ 56.043187][ T1048] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 56.046017][ T5092] veth0_macvtap: entered promiscuous mode [ 56.061610][ T1048] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 56.102500][ T5092] veth1_macvtap: entered promiscuous mode [ 56.113390][ T1048] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 56.147136][ T1048] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 56.171581][ T5110] veth0_macvtap: entered promiscuous mode [ 56.219526][ T5110] veth1_macvtap: entered promiscuous mode [ 56.262541][ T5100] veth0_macvtap: entered promiscuous mode [ 56.317335][ T5092] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 56.330408][ T5092] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 56.341827][ T5092] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 56.359899][ T5092] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 56.381187][ T5092] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 56.398479][ T5100] veth1_macvtap: entered promiscuous mode [ 56.415963][ T1068] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 56.418625][ T5110] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 56.440850][ T5110] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 56.452210][ T5108] Bluetooth: hci2: command tx timeout [ 56.453169][ T5101] Bluetooth: hci0: command tx timeout [ 56.458345][ T5108] Bluetooth: hci1: command tx timeout [ 56.474637][ T1068] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 56.478156][ T5110] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 56.503711][ T5110] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 56.513695][ T5110] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 56.525017][ T5099] Bluetooth: hci4: command tx timeout [ 56.530445][ T5099] Bluetooth: hci3: command tx timeout [ 56.537773][ T5110] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 56.549770][ T5110] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 56.571053][ T5092] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 56.587103][ T5092] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 56.598589][ T5092] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 56.609921][ T5092] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 56.620986][ T5092] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 56.639103][ T5092] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 56.648317][ T5092] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 56.658629][ T5092] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 56.674595][ T5092] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 56.706792][ T5110] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 56.719007][ T5110] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 56.729250][ T5110] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 56.752000][ T5110] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 56.762306][ T5110] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 56.780656][ T5110] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 56.793333][ T5110] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 56.859292][ T5100] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 56.885398][ T5100] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 56.895504][ T5100] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 56.914041][ T5100] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 56.934601][ T5100] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 56.946283][ T5193] xt_AUDIT: Audit type out of range (valid range: 0..2) [ 56.955082][ T5100] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 56.965349][ T5100] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 56.969125][ T5195] netlink: 'syz.2.11': attribute type 2 has an invalid length. [ 56.976303][ T5100] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 56.995656][ T5195] netlink: 244 bytes leftover after parsing attributes in process `syz.2.11'. [ 57.005951][ T5100] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 57.031900][ T5110] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 57.053577][ T5110] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 57.063211][ T5110] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 57.072247][ T5110] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 57.099579][ T5100] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 57.126760][ T5100] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 57.141218][ T5100] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 57.152646][ T5100] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 57.182007][ T5100] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 57.199039][ T5100] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 57.210337][ T5100] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 57.221502][ T5100] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 57.235409][ T5100] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 57.305151][ T5100] netdevsim netdevsim4 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 57.316861][ T5100] netdevsim netdevsim4 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 57.326566][ T5100] netdevsim netdevsim4 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 57.335803][ T5100] netdevsim netdevsim4 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 57.393647][ T5202] vlan2: entered promiscuous mode [ 57.403272][ T5202] veth1: entered promiscuous mode [ 57.409556][ T5202] vlan2: entered allmulticast mode [ 57.415053][ T5202] veth1: entered allmulticast mode [ 57.426419][ T5202] veth1: left allmulticast mode [ 57.431386][ T5202] veth1: left promiscuous mode [ 57.499066][ T1068] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 57.515095][ T1068] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 57.674245][ T1048] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 57.682743][ T1048] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 57.696728][ T1101] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 57.719934][ T1101] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 57.770027][ T5216] xt_AUDIT: Audit type out of range (valid range: 0..2) [ 57.891903][ T1101] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 57.922761][ T12] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 57.925901][ T1101] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 57.964606][ T12] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 58.112362][ T5224] Driver unsupported XDP return value 0 on prog (id 3) dev N/A, expect packet loss! [ 58.200615][ T2886] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 58.216353][ T2886] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 58.525876][ T5099] Bluetooth: hci0: command tx timeout [ 58.531982][ T5108] Bluetooth: hci2: command tx timeout [ 58.538138][ T5108] Bluetooth: hci1: command tx timeout [ 58.605331][ T5099] Bluetooth: hci3: command tx timeout [ 58.612346][ T5108] Bluetooth: hci4: command tx timeout [ 58.770088][ T5250] xt_AUDIT: Audit type out of range (valid range: 0..2) [ 59.307922][ T5272] Bluetooth: MGMT ver 1.22 [ 59.584268][ T5283] syz.3.41 uses obsolete (PF_INET,SOCK_PACKET) [ 61.037582][ T5347] netlink: 'syz.0.73': attribute type 1 has an invalid length. [ 61.295060][ T5352] sock: sock_set_timeout: `syz.4.77' (pid 5352) tries to set negative timeout [ 61.518370][ T5359] netlink: 4 bytes leftover after parsing attributes in process `syz.1.79'. [ 61.546220][ T5363] UDPLite6: UDP-Lite is deprecated and scheduled to be removed in 2025, please contact the netdev mailing list [ 61.575934][ T5359] team0: entered promiscuous mode [ 61.592145][ T5359] team_slave_0: entered promiscuous mode [ 61.610935][ T5359] team_slave_1: entered promiscuous mode [ 61.729631][ T5108] Bluetooth: hci4: unexpected cc 0x0c03 length: 249 > 1 [ 61.739058][ T5108] Bluetooth: hci4: unexpected cc 0x1003 length: 249 > 9 [ 61.748446][ T5108] Bluetooth: hci4: unexpected cc 0x1001 length: 249 > 9 [ 61.759144][ T5359] team_slave_0: entered allmulticast mode [ 61.763740][ T5108] Bluetooth: hci4: unexpected cc 0x0c23 length: 249 > 4 [ 61.773277][ T5108] Bluetooth: hci4: unexpected cc 0x0c25 length: 249 > 3 [ 61.788721][ T5108] Bluetooth: hci4: unexpected cc 0x0c38 length: 249 > 2 [ 61.840132][ T5359] team0: Port device team_slave_0 removed [ 61.956639][ T2886] netdevsim netdevsim3 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 61.975954][ T5358] team0: left promiscuous mode [ 61.982217][ T5358] team_slave_1: left promiscuous mode [ 62.103884][ T2886] netdevsim netdevsim3 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 62.261382][ T2886] netdevsim netdevsim3 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 62.497685][ T2886] netdevsim netdevsim3 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 62.571892][ T5381] netlink: 20 bytes leftover after parsing attributes in process `syz.1.85'. [ 62.736455][ T5391] netlink: 8 bytes leftover after parsing attributes in process `syz.4.88'. [ 62.883933][ T5391] bridge0: port 1(bridge_slave_0) entered disabled state [ 62.926324][ T5391] bridge0: port 2(bridge_slave_1) entered disabled state [ 63.050721][ T5395] netlink: 'syz.4.88': attribute type 2 has an invalid length. [ 63.079507][ T5395] netlink: 4 bytes leftover after parsing attributes in process `syz.4.88'. [ 63.228571][ T2886] bridge_slave_1: left allmulticast mode [ 63.252593][ T2886] bridge_slave_1: left promiscuous mode [ 63.282065][ T2886] bridge0: port 2(bridge_slave_1) entered disabled state [ 63.323864][ T2886] bridge_slave_0: left allmulticast mode [ 63.336565][ T2886] bridge_slave_0: left promiscuous mode [ 63.342837][ T2886] bridge0: port 1(bridge_slave_0) entered disabled state [ 63.829618][ T2886] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 63.855089][ T2886] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 63.877908][ T2886] bond0 (unregistering): Released all slaves [ 63.886735][ T5099] Bluetooth: hci4: command tx timeout [ 63.959028][ T5367] chnl_net:caif_netlink_parms(): no params data found [ 64.422102][ T5429] netlink: 'syz.0.101': attribute type 10 has an invalid length. [ 64.540151][ T5429] bond0: (slave wlan1): Enslaving as an active interface with an up link [ 64.699626][ T5443] UDPLite: UDP-Lite is deprecated and scheduled to be removed in 2025, please contact the netdev mailing list [ 64.984925][ T5456] netlink: 4 bytes leftover after parsing attributes in process `syz.1.110'. [ 65.072888][ T5367] bridge0: port 1(bridge_slave_0) entered blocking state [ 65.094937][ T5367] bridge0: port 1(bridge_slave_0) entered disabled state [ 65.136564][ T5367] bridge_slave_0: entered allmulticast mode [ 65.158326][ T5367] bridge_slave_0: entered promiscuous mode [ 65.183532][ T5467] netlink: 'syz.1.113': attribute type 48 has an invalid length. [ 65.236585][ T2886] hsr_slave_0: left promiscuous mode [ 65.282278][ T2886] hsr_slave_1: left promiscuous mode [ 65.318375][ T2886] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 65.353146][ T2886] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 65.372562][ T2886] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 65.400545][ T2886] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 65.463755][ T2886] veth1_macvtap: left promiscuous mode [ 65.469778][ T2886] veth0_macvtap: left promiscuous mode [ 65.476349][ T2886] veth1_vlan: left promiscuous mode [ 65.482476][ T2886] veth0_vlan: left promiscuous mode [ 65.898563][ T2886] team0 (unregistering): Port device team_slave_1 removed [ 65.958700][ T2886] team0 (unregistering): Port device team_slave_0 removed [ 65.966480][ T5099] Bluetooth: hci4: command tx timeout [ 66.430112][ T5367] bridge0: port 2(bridge_slave_1) entered blocking state [ 66.440747][ T5367] bridge0: port 2(bridge_slave_1) entered disabled state [ 66.449188][ T5367] bridge_slave_1: entered allmulticast mode [ 66.461470][ T5367] bridge_slave_1: entered promiscuous mode [ 66.472921][ T5472] netlink: 'syz.1.115': attribute type 5 has an invalid length. [ 66.534751][ T5493] netlink: 'syz.4.122': attribute type 5 has an invalid length. [ 66.542704][ T5492] netlink: 40 bytes leftover after parsing attributes in process `syz.4.122'. [ 66.753127][ T5493] : entered promiscuous mode [ 66.764408][ T5496] netlink: 116 bytes leftover after parsing attributes in process `syz.4.122'. [ 66.784370][ T5496] bridge_slave_1: left allmulticast mode [ 66.813665][ T5496] bridge_slave_1: left promiscuous mode [ 66.834515][ T5496] bridge0: port 2(bridge_slave_1) entered disabled state [ 66.856482][ T5496] bridge_slave_0: left allmulticast mode [ 66.862184][ T5496] bridge_slave_0: left promiscuous mode [ 66.881010][ T5496] bridge0: port 1(bridge_slave_0) entered disabled state [ 67.086063][ T5367] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 67.108416][ T5367] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 67.262491][ T5367] team0: Port device team_slave_0 added [ 67.290335][ T5367] team0: Port device team_slave_1 added [ 67.454458][ T5367] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 67.474800][ T5367] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 67.561985][ T5367] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 67.588005][ T5535] netlink: 'syz.4.133': attribute type 5 has an invalid length. [ 67.598158][ T5532] dccp_xmit_packet: Payload too large (65475) for featneg. [ 67.620631][ T5367] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 67.640737][ T5532] dccp_close: ABORT with 65475 bytes unread [ 67.650855][ T5367] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 67.700090][ T5532] sctp: [Deprecated]: syz.1.134 (pid 5532) Use of int in maxseg socket option. [ 67.700090][ T5532] Use struct sctp_assoc_value instead [ 67.714597][ T5367] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 67.802179][ T5529] netlink: 4 bytes leftover after parsing attributes in process `syz.0.132'. [ 68.021786][ T5104] IPVS: starting estimator thread 0... [ 68.028159][ T5367] hsr_slave_0: entered promiscuous mode [ 68.044913][ T5099] Bluetooth: hci4: command tx timeout [ 68.057967][ T5367] hsr_slave_1: entered promiscuous mode [ 68.064477][ T5367] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 68.111519][ T5367] Cannot create hsr debugfs directory [ 68.129551][ T5552] IPVS: using max 19 ests per chain, 45600 per kthread [ 68.500192][ T5574] sctp: [Deprecated]: syz.0.149 (pid 5574) Use of int in max_burst socket option. [ 68.500192][ T5574] Use struct sctp_assoc_value instead [ 68.918534][ T2886] Ignoring NSS change in VHT Operating Mode Notification from 08:02:11:00:00:00 with invalid nss 2 [ 69.085750][ T5593] netlink: 40 bytes leftover after parsing attributes in process `syz.0.159'. [ 69.158163][ T5596] netlink: 'syz.0.159': attribute type 5 has an invalid length. [ 69.235967][ T5593] netlink: 116 bytes leftover after parsing attributes in process `syz.0.159'. [ 69.254870][ T5593] bridge_slave_1: left allmulticast mode [ 69.262832][ T5593] bridge_slave_1: left promiscuous mode [ 69.272570][ T5593] bridge0: port 2(bridge_slave_1) entered disabled state [ 69.310624][ T5593] bridge_slave_0: left allmulticast mode [ 69.316706][ T5593] bridge_slave_0: left promiscuous mode [ 69.326558][ T5593] bridge0: port 1(bridge_slave_0) entered disabled state [ 69.452722][ T5596] : entered promiscuous mode [ 69.469539][ T5367] netdevsim netdevsim3 netdevsim0: renamed from eth0 [ 69.511720][ T5367] netdevsim netdevsim3 netdevsim1: renamed from eth1 [ 69.591733][ T5367] netdevsim netdevsim3 netdevsim2: renamed from eth2 [ 69.667906][ T5367] netdevsim netdevsim3 netdevsim3: renamed from eth3 [ 69.743186][ T2886] Ignoring NSS change in VHT Operating Mode Notification from 08:02:11:00:00:00 with invalid nss 2 [ 70.011221][ T5367] 8021q: adding VLAN 0 to HW filter on device bond0 [ 70.113167][ T5367] 8021q: adding VLAN 0 to HW filter on device team0 [ 70.139602][ T5099] Bluetooth: hci4: command tx timeout [ 70.177530][ T5104] bridge0: port 1(bridge_slave_0) entered blocking state [ 70.184726][ T5104] bridge0: port 1(bridge_slave_0) entered forwarding state [ 70.252635][ T5104] bridge0: port 2(bridge_slave_1) entered blocking state [ 70.260988][ T5104] bridge0: port 2(bridge_slave_1) entered forwarding state [ 70.380796][ T5367] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 70.883614][ T5367] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 71.033868][ T5367] veth0_vlan: entered promiscuous mode [ 71.079337][ T5671] netlink: 'syz.2.192': attribute type 12 has an invalid length. [ 71.148881][ T5367] veth1_vlan: entered promiscuous mode [ 71.235376][ T5367] veth0_macvtap: entered promiscuous mode [ 71.262530][ T5367] veth1_macvtap: entered promiscuous mode [ 71.326838][ T5685] Zero length message leads to an empty skb [ 71.355382][ T5367] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 71.372685][ T5367] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 71.384443][ T5367] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 71.405619][ T5367] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 71.421409][ T5367] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 71.434412][ T5367] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 71.450188][ T5367] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 71.486766][ T5367] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 71.524045][ T5367] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 71.578445][ T5367] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 71.585036][ T4551] udevd[4551]: worker [5610] terminated by signal 33 (Unknown signal 33) [ 71.589859][ T5367] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 71.622721][ T4551] udevd[4551]: worker [5610] failed while handling '/devices/virtual/block/loop4' [ 71.652319][ T5367] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 71.674467][ T5367] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 71.703616][ T5367] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 71.731446][ T5367] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 71.735039][ T1242] ieee802154 phy0 wpan0: encryption failed: -22 [ 71.749358][ T1242] ieee802154 phy1 wpan1: encryption failed: -22 [ 71.760886][ T5367] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 71.773176][ T5367] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 71.797886][ T5367] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 71.861800][ T5367] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 71.881292][ T5367] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 71.914738][ T5367] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 71.923647][ T5367] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 72.043805][ T4551] udevd[4551]: worker [5085] terminated by signal 33 (Unknown signal 33) [ 72.070562][ T4551] udevd[4551]: worker [5085] failed while handling '/devices/virtual/block/loop2' [ 72.126722][ T5711] TCP: tcp_parse_options: Illegal window scaling value 150 > 14 received [ 72.286996][ T1048] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 72.325007][ T5716] netlink: 120 bytes leftover after parsing attributes in process `syz.0.210'. [ 72.330485][ T1048] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 72.378490][ T2886] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 72.394899][ T2886] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 73.107130][ T5765] netlink: 'syz.4.229': attribute type 12 has an invalid length. [ 73.585194][ T4551] udevd[4551]: worker [5107] terminated by signal 33 (Unknown signal 33) [ 73.604245][ T4551] udevd[4551]: worker [5107] failed while handling '/devices/virtual/block/loop1' [ 74.838783][ T5865] netlink: 'syz.4.277': attribute type 64 has an invalid length. [ 74.960337][ T5867] netlink: 120 bytes leftover after parsing attributes in process `syz.3.279'. [ 76.397022][ T5962] syz_tun: entered promiscuous mode [ 76.404046][ T5962] macsec1: entered promiscuous mode [ 76.435874][ T5962] macsec1: entered allmulticast mode [ 76.452056][ T5962] syz_tun: entered allmulticast mode [ 76.565461][ T5962] syz_tun: left allmulticast mode [ 76.656019][ T5962] syz_tun: left promiscuous mode [ 76.867677][ T45] cfg80211: failed to load regulatory.db [ 76.875388][ T5979] netlink: 4 bytes leftover after parsing attributes in process `syz.4.326'. [ 77.090755][ T5983] netlink: 'syz.0.330': attribute type 15 has an invalid length. [ 77.778524][ T6020] Bluetooth: MGMT ver 1.22 [ 77.783034][ T6020] Bluetooth: hci3: invalid length 0, exp 2 for type 21 [ 77.959901][ T6026] warning: `syz.0.345' uses wireless extensions which will stop working for Wi-Fi 7 hardware; use nl80211 [ 78.002864][ T6028] xt_TPROXY: Can be used only with -p tcp or -p udp [ 78.315165][ T6038] A link change request failed with some changes committed already. Interface netdevsim0 may have been left with an inconsistent configuration, please check. [ 78.610102][ T6057] xt_TPROXY: Can be used only with -p tcp or -p udp [ 79.320830][ T6102] Bluetooth: hci3: invalid length 0, exp 2 for type 21 [ 79.333028][ T6107] netlink: 168 bytes leftover after parsing attributes in process `syz.4.384'. [ 79.474774][ T6110] netlink: 8 bytes leftover after parsing attributes in process `syz.0.386'. [ 79.483602][ T6110] openvswitch: netlink: Flow actions attr not present in new flow. [ 79.611797][ T6118] netlink: 8 bytes leftover after parsing attributes in process `syz.3.390'. [ 79.711216][ T6121] syz_tun: entered promiscuous mode [ 79.717139][ T6113] netlink: 4 bytes leftover after parsing attributes in process `syz.4.388'. [ 79.733483][ T6121] macsec1: entered promiscuous mode [ 79.746943][ T6121] macsec1: entered allmulticast mode [ 79.754622][ T6121] syz_tun: entered allmulticast mode [ 79.773502][ T6121] syz_tun: left allmulticast mode [ 79.780728][ T6121] syz_tun: left promiscuous mode [ 80.002199][ T6131] sctp: [Deprecated]: syz.4.396 (pid 6131) Use of struct sctp_assoc_value in delayed_ack socket option. [ 80.002199][ T6131] Use struct sctp_sack_info instead [ 80.165547][ T6137] dccp_xmit_packet: Payload too large (65475) for featneg. [ 80.193626][ T6137] dccp_close: ABORT with 65475 bytes unread [ 80.218200][ T6137] sctp: [Deprecated]: syz.3.398 (pid 6137) Use of int in maxseg socket option. [ 80.218200][ T6137] Use struct sctp_assoc_value instead [ 80.257160][ T6146] netlink: 8 bytes leftover after parsing attributes in process `syz.4.402'. [ 80.607651][ T6169] sctp: [Deprecated]: syz.3.412 (pid 6169) Use of struct sctp_assoc_value in delayed_ack socket option. [ 80.607651][ T6169] Use struct sctp_sack_info instead [ 80.776803][ T6185] netlink: 'syz.3.419': attribute type 1 has an invalid length. [ 80.797193][ T6185] netlink: 616 bytes leftover after parsing attributes in process `syz.3.419'. [ 80.832707][ T6187] netlink: 8 bytes leftover after parsing attributes in process `syz.2.422'. [ 80.864974][ T2838] ================================================================== [ 80.873081][ T2838] BUG: KASAN: slab-use-after-free in l2tp_tunnel_del_work+0xe5/0x330 [ 80.881202][ T2838] Read of size 8 at addr ffff88802a0cc8b8 by task kworker/u8:12/2838 [ 80.889282][ T2838] [ 80.891624][ T2838] CPU: 0 PID: 2838 Comm: kworker/u8:12 Not tainted 6.10.0-rc4-syzkaller-00945-gf261aa15b2ca #0 [ 80.901961][ T2838] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/07/2024 [ 80.912026][ T2838] Workqueue: l2tp l2tp_tunnel_del_work [ 80.917523][ T2838] Call Trace: [ 80.920805][ T2838] [ 80.923726][ T2838] dump_stack_lvl+0x241/0x360 [ 80.928405][ T2838] ? __pfx_dump_stack_lvl+0x10/0x10 [ 80.933599][ T2838] ? __pfx__printk+0x10/0x10 [ 80.938186][ T2838] ? _printk+0xd5/0x120 [ 80.942554][ T2838] ? __virt_addr_valid+0x183/0x520 [ 80.947658][ T2838] ? __virt_addr_valid+0x183/0x520 [ 80.952847][ T2838] print_report+0x169/0x550 [ 80.957348][ T2838] ? __virt_addr_valid+0x183/0x520 [ 80.962456][ T2838] ? __virt_addr_valid+0x183/0x520 [ 80.967556][ T2838] ? __virt_addr_valid+0x44e/0x520 [ 80.972656][ T2838] ? __phys_addr+0xba/0x170 [ 80.977151][ T2838] ? l2tp_tunnel_del_work+0xe5/0x330 [ 80.982428][ T2838] kasan_report+0x143/0x180 [ 80.986920][ T2838] ? l2tp_tunnel_del_work+0xe5/0x330 [ 80.992197][ T2838] l2tp_tunnel_del_work+0xe5/0x330 [ 80.997304][ T2838] ? process_scheduled_works+0x945/0x1830 [ 81.003008][ T2838] process_scheduled_works+0xa2c/0x1830 [ 81.008648][ T2838] ? __pfx_process_scheduled_works+0x10/0x10 [ 81.014625][ T2838] ? assign_work+0x364/0x3d0 [ 81.019211][ T2838] worker_thread+0x86d/0xd70 [ 81.023795][ T2838] ? __kthread_parkme+0x169/0x1d0 [ 81.028816][ T2838] ? __pfx_worker_thread+0x10/0x10 [ 81.033913][ T2838] kthread+0x2f0/0x390 [ 81.037972][ T2838] ? __pfx_worker_thread+0x10/0x10 [ 81.043069][ T2838] ? __pfx_kthread+0x10/0x10 [ 81.047646][ T2838] ret_from_fork+0x4b/0x80 [ 81.052051][ T2838] ? __pfx_kthread+0x10/0x10 [ 81.056649][ T2838] ret_from_fork_asm+0x1a/0x30 [ 81.061415][ T2838] [ 81.064416][ T2838] [ 81.066730][ T2838] Allocated by task 6184: [ 81.071039][ T2838] kasan_save_track+0x3f/0x80 [ 81.075701][ T2838] __kasan_kmalloc+0x98/0xb0 [ 81.080274][ T2838] __kmalloc_noprof+0x1f9/0x400 [ 81.085107][ T2838] l2tp_session_create+0x3b/0xc20 [ 81.090134][ T2838] pppol2tp_connect+0xca3/0x17a0 [ 81.095058][ T2838] __sys_connect+0x2df/0x310 [ 81.099635][ T2838] __x64_sys_connect+0x7a/0x90 [ 81.104580][ T2838] do_syscall_64+0xf3/0x230 [ 81.109070][ T2838] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 81.114962][ T2838] [ 81.117285][ T2838] Freed by task 24: [ 81.121073][ T2838] kasan_save_track+0x3f/0x80 [ 81.125740][ T2838] kasan_save_free_info+0x40/0x50 [ 81.130749][ T2838] poison_slab_object+0xe0/0x150 [ 81.135671][ T2838] __kasan_slab_free+0x37/0x60 [ 81.140419][ T2838] kfree+0x149/0x360 [ 81.144300][ T2838] __sk_destruct+0x58/0x5f0 [ 81.148789][ T2838] rcu_core+0xafd/0x1830 [ 81.153022][ T2838] handle_softirqs+0x2c4/0x970 [ 81.157784][ T2838] run_ksoftirqd+0xca/0x130 [ 81.162359][ T2838] smpboot_thread_fn+0x544/0xa30 [ 81.167285][ T2838] kthread+0x2f0/0x390 [ 81.171343][ T2838] ret_from_fork+0x4b/0x80 [ 81.175756][ T2838] ret_from_fork_asm+0x1a/0x30 [ 81.180509][ T2838] [ 81.182827][ T2838] Last potentially related work creation: [ 81.188524][ T2838] kasan_save_stack+0x3f/0x60 [ 81.193189][ T2838] __kasan_record_aux_stack+0xac/0xc0 [ 81.198544][ T2838] call_rcu+0x167/0xa70 [ 81.202694][ T2838] pppol2tp_release+0x24b/0x350 [ 81.207616][ T2838] sock_close+0xbc/0x240 [ 81.211843][ T2838] __fput+0x406/0x8b0 [ 81.215812][ T2838] task_work_run+0x24f/0x310 [ 81.220398][ T2838] syscall_exit_to_user_mode+0x168/0x370 [ 81.226022][ T2838] do_syscall_64+0x100/0x230 [ 81.230599][ T2838] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 81.236489][ T2838] [ 81.238796][ T2838] The buggy address belongs to the object at ffff88802a0cc800 [ 81.238796][ T2838] which belongs to the cache kmalloc-1k of size 1024 [ 81.252837][ T2838] The buggy address is located 184 bytes inside of [ 81.252837][ T2838] freed 1024-byte region [ffff88802a0cc800, ffff88802a0ccc00) [ 81.266705][ T2838] [ 81.269012][ T2838] The buggy address belongs to the physical page: [ 81.275499][ T2838] page: refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x2a0c8 [ 81.284255][ T2838] head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 81.292736][ T2838] ksm flags: 0xfff00000000040(head|node=0|zone=1|lastcpupid=0x7ff) [ 81.300618][ T2838] page_type: 0xffffefff(slab) [ 81.305281][ T2838] raw: 00fff00000000040 ffff888015041dc0 ffffea0001f53600 dead000000000003 [ 81.313845][ T2838] raw: 0000000000000000 0000000000100010 00000001ffffefff 0000000000000000 [ 81.322416][ T2838] head: 00fff00000000040 ffff888015041dc0 ffffea0001f53600 dead000000000003 [ 81.331087][ T2838] head: 0000000000000000 0000000000100010 00000001ffffefff 0000000000000000 [ 81.339841][ T2838] head: 00fff00000000003 ffffea0000a83201 ffffffffffffffff 0000000000000000 [ 81.348501][ T2838] head: 0000000000000008 0000000000000000 00000000ffffffff 0000000000000000 [ 81.357155][ T2838] page dumped because: kasan: bad access detected [ 81.363562][ T2838] page_owner tracks the page as allocated [ 81.369264][ T2838] page last allocated via order 3, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 5093, tgid 5093 (syz-executor), ts 54180609450, free_ts 54146475466 [ 81.390696][ T2838] post_alloc_hook+0x1f3/0x230 [ 81.395452][ T2838] get_page_from_freelist+0x2e43/0x2f00 [ 81.400986][ T2838] __alloc_pages_noprof+0x256/0x6c0 [ 81.406184][ T2838] alloc_slab_page+0x5f/0x120 [ 81.410851][ T2838] allocate_slab+0x5a/0x2f0 [ 81.415343][ T2838] ___slab_alloc+0xcd1/0x14b0 [ 81.420007][ T2838] __slab_alloc+0x58/0xa0 [ 81.424329][ T2838] __kmalloc_node_noprof+0x286/0x440 [ 81.429604][ T2838] qdisc_alloc+0x97/0xa80 [ 81.433923][ T2838] qdisc_create_dflt+0x62/0x4b0 [ 81.438761][ T2838] dev_activate+0x3c0/0x1240 [ 81.443336][ T2838] __dev_open+0x352/0x450 [ 81.447653][ T2838] __dev_change_flags+0x1e2/0x6f0 [ 81.452663][ T2838] dev_change_flags+0x8b/0x1a0 [ 81.457500][ T2838] do_setlink+0xccd/0x41f0 [ 81.461901][ T2838] rtnl_newlink+0x180d/0x20a0 [ 81.466657][ T2838] page last free pid 25 tgid 25 stack trace: [ 81.472619][ T2838] free_unref_page+0xd22/0xea0 [ 81.477371][ T2838] __put_partials+0xeb/0x130 [ 81.481946][ T2838] put_cpu_partial+0x17c/0x250 [ 81.486702][ T2838] __slab_free+0x2ea/0x3d0 [ 81.491107][ T2838] qlist_free_all+0x9e/0x140 [ 81.495683][ T2838] kasan_quarantine_reduce+0x14f/0x170 [ 81.501126][ T2838] __kasan_slab_alloc+0x23/0x80 [ 81.505962][ T2838] kmalloc_trace_noprof+0x132/0x2c0 [ 81.511229][ T2838] nsim_fib_event_work+0x19c2/0x4130 [ 81.516510][ T2838] process_scheduled_works+0xa2c/0x1830 [ 81.522059][ T2838] worker_thread+0x86d/0xd70 [ 81.526641][ T2838] kthread+0x2f0/0x390 [ 81.530695][ T2838] ret_from_fork+0x4b/0x80 [ 81.535100][ T2838] ret_from_fork_asm+0x1a/0x30 [ 81.539855][ T2838] [ 81.542160][ T2838] Memory state around the buggy address: [ 81.547773][ T2838] ffff88802a0cc780: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 81.555816][ T2838] ffff88802a0cc800: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 81.563857][ T2838] >ffff88802a0cc880: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 81.571929][ T2838] ^ [ 81.577802][ T2838] ffff88802a0cc900: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 81.585849][ T2838] ffff88802a0cc980: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 81.593889][ T2838] ================================================================== [ 81.602007][ T2838] Kernel panic - not syncing: KASAN: panic_on_warn set ... [ 81.609206][ T2838] CPU: 0 PID: 2838 Comm: kworker/u8:12 Not tainted 6.10.0-rc4-syzkaller-00945-gf261aa15b2ca #0 [ 81.619544][ T2838] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/07/2024 [ 81.629699][ T2838] Workqueue: l2tp l2tp_tunnel_del_work [ 81.635184][ T2838] Call Trace: [ 81.638468][ T2838] [ 81.641401][ T2838] dump_stack_lvl+0x241/0x360 [ 81.646103][ T2838] ? __pfx_dump_stack_lvl+0x10/0x10 [ 81.651314][ T2838] ? __pfx__printk+0x10/0x10 [ 81.655912][ T2838] ? vscnprintf+0x5d/0x90 [ 81.660251][ T2838] panic+0x349/0x860 [ 81.664145][ T2838] ? check_panic_on_warn+0x21/0xb0 [ 81.669250][ T2838] ? __pfx_panic+0x10/0x10 [ 81.673659][ T2838] ? mark_lock+0x9a/0x350 [ 81.677979][ T2838] ? _raw_spin_unlock_irqrestore+0xd8/0x140 [ 81.683869][ T2838] ? _raw_spin_unlock_irqrestore+0xdd/0x140 [ 81.689748][ T2838] ? __pfx__raw_spin_unlock_irqrestore+0x10/0x10 [ 81.696065][ T2838] ? print_report+0x502/0x550 [ 81.700738][ T2838] check_panic_on_warn+0x86/0xb0 [ 81.705670][ T2838] ? l2tp_tunnel_del_work+0xe5/0x330 [ 81.710951][ T2838] end_report+0x77/0x160 [ 81.715186][ T2838] kasan_report+0x154/0x180 [ 81.719684][ T2838] ? l2tp_tunnel_del_work+0xe5/0x330 [ 81.724968][ T2838] l2tp_tunnel_del_work+0xe5/0x330 [ 81.730089][ T2838] ? process_scheduled_works+0x945/0x1830 [ 81.735816][ T2838] process_scheduled_works+0xa2c/0x1830 [ 81.741368][ T2838] ? __pfx_process_scheduled_works+0x10/0x10 [ 81.747351][ T2838] ? assign_work+0x364/0x3d0 [ 81.751939][ T2838] worker_thread+0x86d/0xd70 [ 81.756542][ T2838] ? __kthread_parkme+0x169/0x1d0 [ 81.761570][ T2838] ? __pfx_worker_thread+0x10/0x10 [ 81.766678][ T2838] kthread+0x2f0/0x390 [ 81.770743][ T2838] ? __pfx_worker_thread+0x10/0x10 [ 81.775859][ T2838] ? __pfx_kthread+0x10/0x10 [ 81.780459][ T2838] ret_from_fork+0x4b/0x80 [ 81.784879][ T2838] ? __pfx_kthread+0x10/0x10 [ 81.789477][ T2838] ret_from_fork_asm+0x1a/0x30 [ 81.794255][ T2838] [ 81.797482][ T2838] Kernel Offset: disabled [ 81.801799][ T2838] Rebooting in 86400 seconds..